xmrig | 97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d

Analysis

max time kernel
97s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
Size

1.1MB
MD5

a2c4268b388b3cbbcf2d1ac375a25b01
SHA1

00578ef4a6d65efa470e085c576b2b741ffe1e1f
SHA256

97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d
SHA512

56655dc28e0c3bf595d727622532e442f702e690d28cd78dfc93cd96ff375761eb291e1c32d32a48b97199fe325efad5b1c8df6b64494c95d3de94355e7ee617
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5Qbyh4/:GezaTF8FcNkNdfE0pZ9ozttwIRx2OM

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023caa-4.dat	xmrig
behavioral2/files/0x0007000000023cae-9.dat	xmrig
behavioral2/files/0x0007000000023caf-14.dat	xmrig
behavioral2/files/0x0007000000023cb4-33.dat	xmrig
behavioral2/files/0x0007000000023cb7-49.dat	xmrig
behavioral2/files/0x0007000000023cb5-61.dat	xmrig
behavioral2/files/0x0007000000023cb9-91.dat	xmrig
behavioral2/files/0x0007000000023cc0-115.dat	xmrig
behavioral2/files/0x0007000000023cc5-125.dat	xmrig
behavioral2/files/0x0007000000023cc4-123.dat	xmrig
behavioral2/files/0x0007000000023cc3-121.dat	xmrig
behavioral2/files/0x0007000000023cc2-119.dat	xmrig
behavioral2/files/0x0007000000023cc1-117.dat	xmrig
behavioral2/files/0x0007000000023cbf-113.dat	xmrig
behavioral2/files/0x0007000000023cbe-111.dat	xmrig
behavioral2/files/0x0007000000023cbd-104.dat	xmrig
behavioral2/files/0x0007000000023cb6-89.dat	xmrig
behavioral2/files/0x0007000000023cbc-87.dat	xmrig
behavioral2/files/0x0007000000023cba-80.dat	xmrig
behavioral2/files/0x0007000000023cb8-77.dat	xmrig
behavioral2/files/0x0007000000023cc6-133.dat	xmrig
behavioral2/files/0x0007000000023cc9-151.dat	xmrig
behavioral2/files/0x0007000000023cca-152.dat	xmrig
behavioral2/files/0x0007000000023cc8-144.dat	xmrig
behavioral2/files/0x0008000000023cab-140.dat	xmrig
behavioral2/files/0x0007000000023cc7-134.dat	xmrig
behavioral2/files/0x0007000000023ccb-159.dat	xmrig
behavioral2/files/0x0007000000023cbb-83.dat	xmrig
behavioral2/files/0x0007000000023cb3-63.dat	xmrig
behavioral2/files/0x0007000000023cb2-46.dat	xmrig
behavioral2/files/0x0007000000023cb1-45.dat	xmrig
behavioral2/files/0x0007000000023cb0-39.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4136	PjBTOzn.exe
560	yLgaUjA.exe
4908	aeRiDRI.exe
628	yExZBPN.exe
520	mRCRskp.exe
3708	SrXUNpC.exe
4544	IsPvfym.exe
2832	OoBrFWA.exe
3728	CMFBWYH.exe
3088	rPVEsDJ.exe
1580	UJiaqZd.exe
1532	ySSGyGI.exe
2920	WnsGEHz.exe
2156	FlvnAIS.exe
2124	SPZCaWb.exe
2756	VccQHXu.exe
4940	hfuIpLw.exe
3024	rMRnrLp.exe
3884	nWYRKnb.exe
1688	dihhJkM.exe
4164	vHQROwi.exe
4888	iSTSTsl.exe
4008	pbFirVl.exe
3828	sByoTjA.exe
3264	MmQmnFb.exe
4248	RigRnPI.exe
4692	Diwubmg.exe
3972	SIVwANU.exe
1912	KhSnQQS.exe
3136	UUirGPY.exe
4112	EzmvDRc.exe
64	CSCupjH.exe
2780	ZpCvcPD.exe
4540	VpvHFoF.exe
4736	rhPCcRj.exe
2152	OOkjcEw.exe
1148	wqATAhQ.exe
2524	ghGaNth.exe
3508	gOgjrsJ.exe
2188	SReHXfB.exe
364	cjwiPfa.exe
2176	cNfJWqt.exe
1412	pDxYATI.exe
4056	JraNdjJ.exe
3556	bkUIITS.exe
3628	XUUurcA.exe
4100	EIETWbe.exe
2628	QMlPfgI.exe
4368	IZkrUgV.exe
3028	HTkdIIc.exe
4636	NQHfFUo.exe
2744	QUwINvb.exe
1832	xHUcomo.exe
1676	pDeFqON.exe
4572	nfFNZTJ.exe
468	ZrnkFOS.exe
1440	jKkDMRk.exe
2208	wgfeiOj.exe
2180	zymXLEb.exe
1696	fYdzQeb.exe
3568	odQdOxl.exe
3784	cDdKuQB.exe
3788	gFWOCBI.exe
1976	pPdohtS.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GUjooUN.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\maLEmyB.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\CKgqDWz.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\aBjPwAU.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\SbIWWyR.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\kxTlXXE.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\BiQNotk.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\bdluLUa.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\yLgaUjA.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\CayZObQ.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\KJitoCb.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\JiSDwXo.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\QJMukHT.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\ltVAZfK.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\eGcibEg.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\PjBTOzn.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\JpbIlBn.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\nnqSTMj.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\thBoDbj.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\jSuYRwi.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\ODWDgtX.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\hVNvJBt.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\SaeGywN.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\hbjAKxK.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\nWYRKnb.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\OciPGzf.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\ejdruQe.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\YcVfmAe.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\oWBfsTy.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\vpcdboK.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\FJlGtAw.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\zjAauCF.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\wXvxGWa.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\lqvqgrY.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\KCzMYMU.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\XbNRDoa.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\sInehhU.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\GZXnHss.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\fltAPeZ.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\UeBeerC.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\boFEpxg.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\dcMCGex.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\ROBgGUo.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\xZXmgSr.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\XQAFhdM.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\odNIkac.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\DTKZFtF.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\kDggefp.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\zMndJFb.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\pOBFDst.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\KJpBoid.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\svJoQBX.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\sDmLivb.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\SPZCaWb.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\GoJLUse.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\YxRTBMQ.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\eWSXZjE.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\IMkmNso.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\rCBYfia.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\nKCaEHS.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\fxGnRJp.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\qxhenBZ.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\OZTXkUY.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
File created	C:\Windows\System\deavoak.exe	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4136	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	84
PID 4176 wrote to memory of 4136	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	84
PID 4176 wrote to memory of 560	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	85
PID 4176 wrote to memory of 560	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	85
PID 4176 wrote to memory of 4908	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	86
PID 4176 wrote to memory of 4908	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	86
PID 4176 wrote to memory of 628	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	87
PID 4176 wrote to memory of 628	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	87
PID 4176 wrote to memory of 520	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	88
PID 4176 wrote to memory of 520	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	88
PID 4176 wrote to memory of 3708	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	89
PID 4176 wrote to memory of 3708	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	89
PID 4176 wrote to memory of 4544	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	90
PID 4176 wrote to memory of 4544	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	90
PID 4176 wrote to memory of 2832	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	91
PID 4176 wrote to memory of 2832	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	91
PID 4176 wrote to memory of 3728	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	92
PID 4176 wrote to memory of 3728	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	92
PID 4176 wrote to memory of 2756	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	93
PID 4176 wrote to memory of 2756	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	93
PID 4176 wrote to memory of 3088	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	94
PID 4176 wrote to memory of 3088	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	94
PID 4176 wrote to memory of 1580	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	95
PID 4176 wrote to memory of 1580	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	95
PID 4176 wrote to memory of 1532	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	96
PID 4176 wrote to memory of 1532	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	96
PID 4176 wrote to memory of 2920	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	97
PID 4176 wrote to memory of 2920	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	97
PID 4176 wrote to memory of 2156	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	98
PID 4176 wrote to memory of 2156	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	98
PID 4176 wrote to memory of 2124	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	99
PID 4176 wrote to memory of 2124	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	99
PID 4176 wrote to memory of 4940	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	100
PID 4176 wrote to memory of 4940	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	100
PID 4176 wrote to memory of 3024	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	101
PID 4176 wrote to memory of 3024	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	101
PID 4176 wrote to memory of 3884	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	102
PID 4176 wrote to memory of 3884	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	102
PID 4176 wrote to memory of 1688	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	103
PID 4176 wrote to memory of 1688	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	103
PID 4176 wrote to memory of 4164	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	104
PID 4176 wrote to memory of 4164	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	104
PID 4176 wrote to memory of 4888	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	105
PID 4176 wrote to memory of 4888	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	105
PID 4176 wrote to memory of 4008	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	106
PID 4176 wrote to memory of 4008	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	106
PID 4176 wrote to memory of 3828	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	107
PID 4176 wrote to memory of 3828	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	107
PID 4176 wrote to memory of 3264	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	108
PID 4176 wrote to memory of 3264	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	108
PID 4176 wrote to memory of 4248	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	109
PID 4176 wrote to memory of 4248	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	109
PID 4176 wrote to memory of 4692	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	110
PID 4176 wrote to memory of 4692	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	110
PID 4176 wrote to memory of 3972	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	111
PID 4176 wrote to memory of 3972	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	111
PID 4176 wrote to memory of 1912	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	112
PID 4176 wrote to memory of 1912	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	112
PID 4176 wrote to memory of 3136	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	113
PID 4176 wrote to memory of 3136	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	113
PID 4176 wrote to memory of 4112	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	114
PID 4176 wrote to memory of 4112	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	114
PID 4176 wrote to memory of 64	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	115
PID 4176 wrote to memory of 64	4176	97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe	115

C:\Users\Admin\AppData\Local\Temp\97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe
"C:\Users\Admin\AppData\Local\Temp\97ff04236eb537bca47ae2e7fac1fb6333ea93cc2f517f078457ff3e7f5d057d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\System\PjBTOzn.exe
  C:\Windows\System\PjBTOzn.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\yLgaUjA.exe
  C:\Windows\System\yLgaUjA.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\aeRiDRI.exe
  C:\Windows\System\aeRiDRI.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\yExZBPN.exe
  C:\Windows\System\yExZBPN.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\mRCRskp.exe
  C:\Windows\System\mRCRskp.exe
  2⤵
  - Executes dropped EXE
  PID:520
- C:\Windows\System\SrXUNpC.exe
  C:\Windows\System\SrXUNpC.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\IsPvfym.exe
  C:\Windows\System\IsPvfym.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\OoBrFWA.exe
  C:\Windows\System\OoBrFWA.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\CMFBWYH.exe
  C:\Windows\System\CMFBWYH.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\VccQHXu.exe
  C:\Windows\System\VccQHXu.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\rPVEsDJ.exe
  C:\Windows\System\rPVEsDJ.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\UJiaqZd.exe
  C:\Windows\System\UJiaqZd.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\ySSGyGI.exe
  C:\Windows\System\ySSGyGI.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\WnsGEHz.exe
  C:\Windows\System\WnsGEHz.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\FlvnAIS.exe
  C:\Windows\System\FlvnAIS.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\SPZCaWb.exe
  C:\Windows\System\SPZCaWb.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\hfuIpLw.exe
  C:\Windows\System\hfuIpLw.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\rMRnrLp.exe
  C:\Windows\System\rMRnrLp.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\nWYRKnb.exe
  C:\Windows\System\nWYRKnb.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\dihhJkM.exe
  C:\Windows\System\dihhJkM.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\vHQROwi.exe
  C:\Windows\System\vHQROwi.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\iSTSTsl.exe
  C:\Windows\System\iSTSTsl.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\pbFirVl.exe
  C:\Windows\System\pbFirVl.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\sByoTjA.exe
  C:\Windows\System\sByoTjA.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\MmQmnFb.exe
  C:\Windows\System\MmQmnFb.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\RigRnPI.exe
  C:\Windows\System\RigRnPI.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\Diwubmg.exe
  C:\Windows\System\Diwubmg.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\SIVwANU.exe
  C:\Windows\System\SIVwANU.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\KhSnQQS.exe
  C:\Windows\System\KhSnQQS.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\UUirGPY.exe
  C:\Windows\System\UUirGPY.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\EzmvDRc.exe
  C:\Windows\System\EzmvDRc.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\CSCupjH.exe
  C:\Windows\System\CSCupjH.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\ZpCvcPD.exe
  C:\Windows\System\ZpCvcPD.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\VpvHFoF.exe
  C:\Windows\System\VpvHFoF.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\rhPCcRj.exe
  C:\Windows\System\rhPCcRj.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\OOkjcEw.exe
  C:\Windows\System\OOkjcEw.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\wqATAhQ.exe
  C:\Windows\System\wqATAhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\ghGaNth.exe
  C:\Windows\System\ghGaNth.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\gOgjrsJ.exe
  C:\Windows\System\gOgjrsJ.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\SReHXfB.exe
  C:\Windows\System\SReHXfB.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\cjwiPfa.exe
  C:\Windows\System\cjwiPfa.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\cNfJWqt.exe
  C:\Windows\System\cNfJWqt.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\pDxYATI.exe
  C:\Windows\System\pDxYATI.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\JraNdjJ.exe
  C:\Windows\System\JraNdjJ.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\bkUIITS.exe
  C:\Windows\System\bkUIITS.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\XUUurcA.exe
  C:\Windows\System\XUUurcA.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\EIETWbe.exe
  C:\Windows\System\EIETWbe.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\IZkrUgV.exe
  C:\Windows\System\IZkrUgV.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\QMlPfgI.exe
  C:\Windows\System\QMlPfgI.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\HTkdIIc.exe
  C:\Windows\System\HTkdIIc.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\NQHfFUo.exe
  C:\Windows\System\NQHfFUo.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\QUwINvb.exe
  C:\Windows\System\QUwINvb.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\pDeFqON.exe
  C:\Windows\System\pDeFqON.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\xHUcomo.exe
  C:\Windows\System\xHUcomo.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\nfFNZTJ.exe
  C:\Windows\System\nfFNZTJ.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\ZrnkFOS.exe
  C:\Windows\System\ZrnkFOS.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\jKkDMRk.exe
  C:\Windows\System\jKkDMRk.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\fYdzQeb.exe
  C:\Windows\System\fYdzQeb.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\wgfeiOj.exe
  C:\Windows\System\wgfeiOj.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\zymXLEb.exe
  C:\Windows\System\zymXLEb.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\odQdOxl.exe
  C:\Windows\System\odQdOxl.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\cDdKuQB.exe
  C:\Windows\System\cDdKuQB.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\gFWOCBI.exe
  C:\Windows\System\gFWOCBI.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\pPdohtS.exe
  C:\Windows\System\pPdohtS.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\jaBzwWb.exe
  C:\Windows\System\jaBzwWb.exe
  2⤵
  PID:388
- C:\Windows\System\rmkanZm.exe
  C:\Windows\System\rmkanZm.exe
  2⤵
  PID:4348
- C:\Windows\System\CwTnPah.exe
  C:\Windows\System\CwTnPah.exe
  2⤵
  PID:4840
- C:\Windows\System\OQZVhUz.exe
  C:\Windows\System\OQZVhUz.exe
  2⤵
  PID:4460
- C:\Windows\System\ommGVNZ.exe
  C:\Windows\System\ommGVNZ.exe
  2⤵
  PID:3880
- C:\Windows\System\yemtPlh.exe
  C:\Windows\System\yemtPlh.exe
  2⤵
  PID:4884
- C:\Windows\System\XHKcVoU.exe
  C:\Windows\System\XHKcVoU.exe
  2⤵
  PID:3724
- C:\Windows\System\LDOTvdz.exe
  C:\Windows\System\LDOTvdz.exe
  2⤵
  PID:2728
- C:\Windows\System\wLiYIeG.exe
  C:\Windows\System\wLiYIeG.exe
  2⤵
  PID:3260
- C:\Windows\System\HqPULOJ.exe
  C:\Windows\System\HqPULOJ.exe
  2⤵
  PID:1176
- C:\Windows\System\NOdzAnm.exe
  C:\Windows\System\NOdzAnm.exe
  2⤵
  PID:3904
- C:\Windows\System\NHwLXvB.exe
  C:\Windows\System\NHwLXvB.exe
  2⤵
  PID:2632
- C:\Windows\System\snEXXpg.exe
  C:\Windows\System\snEXXpg.exe
  2⤵
  PID:4420
- C:\Windows\System\ftApyqf.exe
  C:\Windows\System\ftApyqf.exe
  2⤵
  PID:1540
- C:\Windows\System\cPqZxna.exe
  C:\Windows\System\cPqZxna.exe
  2⤵
  PID:3336
- C:\Windows\System\usWODCQ.exe
  C:\Windows\System\usWODCQ.exe
  2⤵
  PID:2680
- C:\Windows\System\KPZtqXi.exe
  C:\Windows\System\KPZtqXi.exe
  2⤵
  PID:1372
- C:\Windows\System\oTnFcek.exe
  C:\Windows\System\oTnFcek.exe
  2⤵
  PID:4616
- C:\Windows\System\ZDVjHHD.exe
  C:\Windows\System\ZDVjHHD.exe
  2⤵
  PID:5068
- C:\Windows\System\ILHcHkq.exe
  C:\Windows\System\ILHcHkq.exe
  2⤵
  PID:4836
- C:\Windows\System\nwCvNNu.exe
  C:\Windows\System\nwCvNNu.exe
  2⤵
  PID:3696
- C:\Windows\System\bVWUNdS.exe
  C:\Windows\System\bVWUNdS.exe
  2⤵
  PID:3464
- C:\Windows\System\WfRySNz.exe
  C:\Windows\System\WfRySNz.exe
  2⤵
  PID:5000
- C:\Windows\System\IQoGciw.exe
  C:\Windows\System\IQoGciw.exe
  2⤵
  PID:1940
- C:\Windows\System\JnKzuQl.exe
  C:\Windows\System\JnKzuQl.exe
  2⤵
  PID:1744
- C:\Windows\System\AFagmUA.exe
  C:\Windows\System\AFagmUA.exe
  2⤵
  PID:3292
- C:\Windows\System\hWXoLrK.exe
  C:\Windows\System\hWXoLrK.exe
  2⤵
  PID:3676
- C:\Windows\System\dHHjGpc.exe
  C:\Windows\System\dHHjGpc.exe
  2⤵
  PID:3792
- C:\Windows\System\EWJCcgN.exe
  C:\Windows\System\EWJCcgN.exe
  2⤵
  PID:4244
- C:\Windows\System\PUeIZfr.exe
  C:\Windows\System\PUeIZfr.exe
  2⤵
  PID:720
- C:\Windows\System\UyIrcMh.exe
  C:\Windows\System\UyIrcMh.exe
  2⤵
  PID:728
- C:\Windows\System\ljMiqmk.exe
  C:\Windows\System\ljMiqmk.exe
  2⤵
  PID:804
- C:\Windows\System\VWHsGdF.exe
  C:\Windows\System\VWHsGdF.exe
  2⤵
  PID:4868
- C:\Windows\System\PXSheKL.exe
  C:\Windows\System\PXSheKL.exe
  2⤵
  PID:1476
- C:\Windows\System\IjfdvCI.exe
  C:\Windows\System\IjfdvCI.exe
  2⤵
  PID:1896
- C:\Windows\System\OElfRBI.exe
  C:\Windows\System\OElfRBI.exe
  2⤵
  PID:1536
- C:\Windows\System\iZUsnFZ.exe
  C:\Windows\System\iZUsnFZ.exe
  2⤵
  PID:1692
- C:\Windows\System\wyOvopG.exe
  C:\Windows\System\wyOvopG.exe
  2⤵
  PID:1656
- C:\Windows\System\JiSDwXo.exe
  C:\Windows\System\JiSDwXo.exe
  2⤵
  PID:3804
- C:\Windows\System\FGwNreb.exe
  C:\Windows\System\FGwNreb.exe
  2⤵
  PID:4016
- C:\Windows\System\hjgMtKM.exe
  C:\Windows\System\hjgMtKM.exe
  2⤵
  PID:4260
- C:\Windows\System\ScKdyvl.exe
  C:\Windows\System\ScKdyvl.exe
  2⤵
  PID:2420
- C:\Windows\System\mfRmltb.exe
  C:\Windows\System\mfRmltb.exe
  2⤵
  PID:4296
- C:\Windows\System\IhLUyGK.exe
  C:\Windows\System\IhLUyGK.exe
  2⤵
  PID:4528
- C:\Windows\System\vJMnDTY.exe
  C:\Windows\System\vJMnDTY.exe
  2⤵
  PID:5016
- C:\Windows\System\fDngRoA.exe
  C:\Windows\System\fDngRoA.exe
  2⤵
  PID:4852
- C:\Windows\System\fkQSNZo.exe
  C:\Windows\System\fkQSNZo.exe
  2⤵
  PID:5124
- C:\Windows\System\EPxOhpb.exe
  C:\Windows\System\EPxOhpb.exe
  2⤵
  PID:5156
- C:\Windows\System\CayZObQ.exe
  C:\Windows\System\CayZObQ.exe
  2⤵
  PID:5188
- C:\Windows\System\KhZtzfW.exe
  C:\Windows\System\KhZtzfW.exe
  2⤵
  PID:5208
- C:\Windows\System\JcfKkdf.exe
  C:\Windows\System\JcfKkdf.exe
  2⤵
  PID:5236
- C:\Windows\System\nwnwJbI.exe
  C:\Windows\System\nwnwJbI.exe
  2⤵
  PID:5268
- C:\Windows\System\dVsviOL.exe
  C:\Windows\System\dVsviOL.exe
  2⤵
  PID:5296
- C:\Windows\System\TJEvPaj.exe
  C:\Windows\System\TJEvPaj.exe
  2⤵
  PID:5324
- C:\Windows\System\anQIXbb.exe
  C:\Windows\System\anQIXbb.exe
  2⤵
  PID:5356
- C:\Windows\System\rdzNEmJ.exe
  C:\Windows\System\rdzNEmJ.exe
  2⤵
  PID:5380
- C:\Windows\System\ejVHriq.exe
  C:\Windows\System\ejVHriq.exe
  2⤵
  PID:5416
- C:\Windows\System\OUfBkOI.exe
  C:\Windows\System\OUfBkOI.exe
  2⤵
  PID:5448
- C:\Windows\System\qlaXLqq.exe
  C:\Windows\System\qlaXLqq.exe
  2⤵
  PID:5472
- C:\Windows\System\VFfZdiH.exe
  C:\Windows\System\VFfZdiH.exe
  2⤵
  PID:5516
- C:\Windows\System\UOGuAFn.exe
  C:\Windows\System\UOGuAFn.exe
  2⤵
  PID:5540
- C:\Windows\System\RrEyBdl.exe
  C:\Windows\System\RrEyBdl.exe
  2⤵
  PID:5568
- C:\Windows\System\IdhjFkc.exe
  C:\Windows\System\IdhjFkc.exe
  2⤵
  PID:5596
- C:\Windows\System\rpjFAjQ.exe
  C:\Windows\System\rpjFAjQ.exe
  2⤵
  PID:5616
- C:\Windows\System\QZHoIPD.exe
  C:\Windows\System\QZHoIPD.exe
  2⤵
  PID:5644
- C:\Windows\System\fPJijjj.exe
  C:\Windows\System\fPJijjj.exe
  2⤵
  PID:5680
- C:\Windows\System\lZkUhrZ.exe
  C:\Windows\System\lZkUhrZ.exe
  2⤵
  PID:5708
- C:\Windows\System\qkIKUJh.exe
  C:\Windows\System\qkIKUJh.exe
  2⤵
  PID:5736
- C:\Windows\System\lqvqgrY.exe
  C:\Windows\System\lqvqgrY.exe
  2⤵
  PID:5752
- C:\Windows\System\OZTXkUY.exe
  C:\Windows\System\OZTXkUY.exe
  2⤵
  PID:5784
- C:\Windows\System\mfguuFz.exe
  C:\Windows\System\mfguuFz.exe
  2⤵
  PID:5820
- C:\Windows\System\QMKzvYl.exe
  C:\Windows\System\QMKzvYl.exe
  2⤵
  PID:5864
- C:\Windows\System\bINdSPR.exe
  C:\Windows\System\bINdSPR.exe
  2⤵
  PID:5888
- C:\Windows\System\hOWkTeZ.exe
  C:\Windows\System\hOWkTeZ.exe
  2⤵
  PID:5912
- C:\Windows\System\xfVdjbq.exe
  C:\Windows\System\xfVdjbq.exe
  2⤵
  PID:5936
- C:\Windows\System\vpcdboK.exe
  C:\Windows\System\vpcdboK.exe
  2⤵
  PID:5968
- C:\Windows\System\xiVIVVl.exe
  C:\Windows\System\xiVIVVl.exe
  2⤵
  PID:5996
- C:\Windows\System\BJRhszU.exe
  C:\Windows\System\BJRhszU.exe
  2⤵
  PID:6016
- C:\Windows\System\MamZNUN.exe
  C:\Windows\System\MamZNUN.exe
  2⤵
  PID:6044
- C:\Windows\System\tYGphOX.exe
  C:\Windows\System\tYGphOX.exe
  2⤵
  PID:6076
- C:\Windows\System\oCmMelc.exe
  C:\Windows\System\oCmMelc.exe
  2⤵
  PID:6108
- C:\Windows\System\gFSTuaZ.exe
  C:\Windows\System\gFSTuaZ.exe
  2⤵
  PID:6132
- C:\Windows\System\uXjXpEx.exe
  C:\Windows\System\uXjXpEx.exe
  2⤵
  PID:5136
- C:\Windows\System\gWIhvXU.exe
  C:\Windows\System\gWIhvXU.exe
  2⤵
  PID:5168
- C:\Windows\System\Trwcxvw.exe
  C:\Windows\System\Trwcxvw.exe
  2⤵
  PID:5252
- C:\Windows\System\JpbIlBn.exe
  C:\Windows\System\JpbIlBn.exe
  2⤵
  PID:5316
- C:\Windows\System\HMfrnLh.exe
  C:\Windows\System\HMfrnLh.exe
  2⤵
  PID:5388
- C:\Windows\System\EenspzO.exe
  C:\Windows\System\EenspzO.exe
  2⤵
  PID:5428
- C:\Windows\System\CxSfNDv.exe
  C:\Windows\System\CxSfNDv.exe
  2⤵
  PID:5524
- C:\Windows\System\nbkbCii.exe
  C:\Windows\System\nbkbCii.exe
  2⤵
  PID:5576
- C:\Windows\System\KJitoCb.exe
  C:\Windows\System\KJitoCb.exe
  2⤵
  PID:5636
- C:\Windows\System\SnLsfDr.exe
  C:\Windows\System\SnLsfDr.exe
  2⤵
  PID:5704
- C:\Windows\System\YLNdwhT.exe
  C:\Windows\System\YLNdwhT.exe
  2⤵
  PID:5768
- C:\Windows\System\jMQbbuH.exe
  C:\Windows\System\jMQbbuH.exe
  2⤵
  PID:5812
- C:\Windows\System\VcxkwTP.exe
  C:\Windows\System\VcxkwTP.exe
  2⤵
  PID:5880
- C:\Windows\System\TamfWyP.exe
  C:\Windows\System\TamfWyP.exe
  2⤵
  PID:5944
- C:\Windows\System\ngdKIiz.exe
  C:\Windows\System\ngdKIiz.exe
  2⤵
  PID:6028
- C:\Windows\System\BDQXQNC.exe
  C:\Windows\System\BDQXQNC.exe
  2⤵
  PID:6092
- C:\Windows\System\JTnYLYH.exe
  C:\Windows\System\JTnYLYH.exe
  2⤵
  PID:5184
- C:\Windows\System\jPFSiVU.exe
  C:\Windows\System\jPFSiVU.exe
  2⤵
  PID:5340
- C:\Windows\System\CyttelR.exe
  C:\Windows\System\CyttelR.exe
  2⤵
  PID:5460
- C:\Windows\System\hscmarq.exe
  C:\Windows\System\hscmarq.exe
  2⤵
  PID:5664
- C:\Windows\System\vKaxRBT.exe
  C:\Windows\System\vKaxRBT.exe
  2⤵
  PID:5832
- C:\Windows\System\nnTvdFc.exe
  C:\Windows\System\nnTvdFc.exe
  2⤵
  PID:5960
- C:\Windows\System\jISTHAP.exe
  C:\Windows\System\jISTHAP.exe
  2⤵
  PID:4500
- C:\Windows\System\oBlETxG.exe
  C:\Windows\System\oBlETxG.exe
  2⤵
  PID:5456
- C:\Windows\System\aOJAQob.exe
  C:\Windows\System\aOJAQob.exe
  2⤵
  PID:5836
- C:\Windows\System\JUKCutK.exe
  C:\Windows\System\JUKCutK.exe
  2⤵
  PID:2612
- C:\Windows\System\NfMJYXt.exe
  C:\Windows\System\NfMJYXt.exe
  2⤵
  PID:5668
- C:\Windows\System\ozvUSGl.exe
  C:\Windows\System\ozvUSGl.exe
  2⤵
  PID:6160
- C:\Windows\System\oZuzLOK.exe
  C:\Windows\System\oZuzLOK.exe
  2⤵
  PID:6184
- C:\Windows\System\nYyxrgk.exe
  C:\Windows\System\nYyxrgk.exe
  2⤵
  PID:6216
- C:\Windows\System\kosdDMM.exe
  C:\Windows\System\kosdDMM.exe
  2⤵
  PID:6248
- C:\Windows\System\TOmMwXO.exe
  C:\Windows\System\TOmMwXO.exe
  2⤵
  PID:6276
- C:\Windows\System\jnTwZSV.exe
  C:\Windows\System\jnTwZSV.exe
  2⤵
  PID:6296
- C:\Windows\System\LlQZTBo.exe
  C:\Windows\System\LlQZTBo.exe
  2⤵
  PID:6332
- C:\Windows\System\leGgeiC.exe
  C:\Windows\System\leGgeiC.exe
  2⤵
  PID:6360
- C:\Windows\System\BiSXNVx.exe
  C:\Windows\System\BiSXNVx.exe
  2⤵
  PID:6388
- C:\Windows\System\KQZTQnl.exe
  C:\Windows\System\KQZTQnl.exe
  2⤵
  PID:6408
- C:\Windows\System\ImoUsjb.exe
  C:\Windows\System\ImoUsjb.exe
  2⤵
  PID:6456
- C:\Windows\System\utoZRaI.exe
  C:\Windows\System\utoZRaI.exe
  2⤵
  PID:6480
- C:\Windows\System\dndQsSL.exe
  C:\Windows\System\dndQsSL.exe
  2⤵
  PID:6500
- C:\Windows\System\TmVAdbY.exe
  C:\Windows\System\TmVAdbY.exe
  2⤵
  PID:6528
- C:\Windows\System\AZHYhmu.exe
  C:\Windows\System\AZHYhmu.exe
  2⤵
  PID:6564
- C:\Windows\System\KhMizLE.exe
  C:\Windows\System\KhMizLE.exe
  2⤵
  PID:6592
- C:\Windows\System\wgmwnNk.exe
  C:\Windows\System\wgmwnNk.exe
  2⤵
  PID:6612
- C:\Windows\System\GaHVqBT.exe
  C:\Windows\System\GaHVqBT.exe
  2⤵
  PID:6664
- C:\Windows\System\BiQNotk.exe
  C:\Windows\System\BiQNotk.exe
  2⤵
  PID:6680
- C:\Windows\System\GZXnHss.exe
  C:\Windows\System\GZXnHss.exe
  2⤵
  PID:6708
- C:\Windows\System\aCxtMum.exe
  C:\Windows\System\aCxtMum.exe
  2⤵
  PID:6724
- C:\Windows\System\YoSNIVr.exe
  C:\Windows\System\YoSNIVr.exe
  2⤵
  PID:6752
- C:\Windows\System\MxJuagU.exe
  C:\Windows\System\MxJuagU.exe
  2⤵
  PID:6776
- C:\Windows\System\FYXjQuV.exe
  C:\Windows\System\FYXjQuV.exe
  2⤵
  PID:6800
- C:\Windows\System\EFvLoKK.exe
  C:\Windows\System\EFvLoKK.exe
  2⤵
  PID:6832
- C:\Windows\System\XjXTVAO.exe
  C:\Windows\System\XjXTVAO.exe
  2⤵
  PID:6856
- C:\Windows\System\LrfXnYN.exe
  C:\Windows\System\LrfXnYN.exe
  2⤵
  PID:6880
- C:\Windows\System\YtDzoyo.exe
  C:\Windows\System\YtDzoyo.exe
  2⤵
  PID:6912
- C:\Windows\System\mdOTBmU.exe
  C:\Windows\System\mdOTBmU.exe
  2⤵
  PID:6928
- C:\Windows\System\MjZXScD.exe
  C:\Windows\System\MjZXScD.exe
  2⤵
  PID:6948
- C:\Windows\System\aReBWkP.exe
  C:\Windows\System\aReBWkP.exe
  2⤵
  PID:6968
- C:\Windows\System\JYTEBNQ.exe
  C:\Windows\System\JYTEBNQ.exe
  2⤵
  PID:6996
- C:\Windows\System\odNIkac.exe
  C:\Windows\System\odNIkac.exe
  2⤵
  PID:7028
- C:\Windows\System\hVNvJBt.exe
  C:\Windows\System\hVNvJBt.exe
  2⤵
  PID:7048
- C:\Windows\System\ceLwcLJ.exe
  C:\Windows\System\ceLwcLJ.exe
  2⤵
  PID:7076
- C:\Windows\System\DnKYVWv.exe
  C:\Windows\System\DnKYVWv.exe
  2⤵
  PID:7100
- C:\Windows\System\vZUFxed.exe
  C:\Windows\System\vZUFxed.exe
  2⤵
  PID:7116
- C:\Windows\System\exFgkRK.exe
  C:\Windows\System\exFgkRK.exe
  2⤵
  PID:7144
- C:\Windows\System\URGEzRv.exe
  C:\Windows\System\URGEzRv.exe
  2⤵
  PID:5372
- C:\Windows\System\CdFVGeE.exe
  C:\Windows\System\CdFVGeE.exe
  2⤵
  PID:6192
- C:\Windows\System\wxhFBLn.exe
  C:\Windows\System\wxhFBLn.exe
  2⤵
  PID:6264
- C:\Windows\System\CBvBIwP.exe
  C:\Windows\System\CBvBIwP.exe
  2⤵
  PID:6348
- C:\Windows\System\naeaIYj.exe
  C:\Windows\System\naeaIYj.exe
  2⤵
  PID:6396
- C:\Windows\System\hXojHTR.exe
  C:\Windows\System\hXojHTR.exe
  2⤵
  PID:6452
- C:\Windows\System\ATnNjVm.exe
  C:\Windows\System\ATnNjVm.exe
  2⤵
  PID:6516
- C:\Windows\System\HzOBbFC.exe
  C:\Windows\System\HzOBbFC.exe
  2⤵
  PID:6584
- C:\Windows\System\MPWKDxP.exe
  C:\Windows\System\MPWKDxP.exe
  2⤵
  PID:6652
- C:\Windows\System\wBlDqnb.exe
  C:\Windows\System\wBlDqnb.exe
  2⤵
  PID:6720
- C:\Windows\System\hdsoEvm.exe
  C:\Windows\System\hdsoEvm.exe
  2⤵
  PID:6744
- C:\Windows\System\nMDfbwN.exe
  C:\Windows\System\nMDfbwN.exe
  2⤵
  PID:6824
- C:\Windows\System\YQTeiPY.exe
  C:\Windows\System\YQTeiPY.exe
  2⤵
  PID:6896
- C:\Windows\System\pCGattx.exe
  C:\Windows\System\pCGattx.exe
  2⤵
  PID:6924
- C:\Windows\System\KCzMYMU.exe
  C:\Windows\System\KCzMYMU.exe
  2⤵
  PID:7008
- C:\Windows\System\ZSHfJrw.exe
  C:\Windows\System\ZSHfJrw.exe
  2⤵
  PID:6980
- C:\Windows\System\pufCqPE.exe
  C:\Windows\System\pufCqPE.exe
  2⤵
  PID:7160
- C:\Windows\System\SuWJjGr.exe
  C:\Windows\System\SuWJjGr.exe
  2⤵
  PID:6224
- C:\Windows\System\zCYHkIT.exe
  C:\Windows\System\zCYHkIT.exe
  2⤵
  PID:6304
- C:\Windows\System\WyZksaG.exe
  C:\Windows\System\WyZksaG.exe
  2⤵
  PID:6244
- C:\Windows\System\IhqdkRv.exe
  C:\Windows\System\IhqdkRv.exe
  2⤵
  PID:6440
- C:\Windows\System\CSnsIlK.exe
  C:\Windows\System\CSnsIlK.exe
  2⤵
  PID:6784
- C:\Windows\System\MBZrtUm.exe
  C:\Windows\System\MBZrtUm.exe
  2⤵
  PID:6920
- C:\Windows\System\lXSWYHG.exe
  C:\Windows\System\lXSWYHG.exe
  2⤵
  PID:6600
- C:\Windows\System\PfHMkST.exe
  C:\Windows\System\PfHMkST.exe
  2⤵
  PID:6988
- C:\Windows\System\rRMfOQX.exe
  C:\Windows\System\rRMfOQX.exe
  2⤵
  PID:6716
- C:\Windows\System\FDWZKjB.exe
  C:\Windows\System\FDWZKjB.exe
  2⤵
  PID:7064
- C:\Windows\System\JWaZgVc.exe
  C:\Windows\System\JWaZgVc.exe
  2⤵
  PID:7192
- C:\Windows\System\pQfovXy.exe
  C:\Windows\System\pQfovXy.exe
  2⤵
  PID:7216
- C:\Windows\System\cLQeEck.exe
  C:\Windows\System\cLQeEck.exe
  2⤵
  PID:7236
- C:\Windows\System\MeqkRXh.exe
  C:\Windows\System\MeqkRXh.exe
  2⤵
  PID:7260
- C:\Windows\System\ZozzuDA.exe
  C:\Windows\System\ZozzuDA.exe
  2⤵
  PID:7280
- C:\Windows\System\AywJwOQ.exe
  C:\Windows\System\AywJwOQ.exe
  2⤵
  PID:7308
- C:\Windows\System\ryPhkDT.exe
  C:\Windows\System\ryPhkDT.exe
  2⤵
  PID:7332
- C:\Windows\System\FFlVyuE.exe
  C:\Windows\System\FFlVyuE.exe
  2⤵
  PID:7356
- C:\Windows\System\AmotQBT.exe
  C:\Windows\System\AmotQBT.exe
  2⤵
  PID:7384
- C:\Windows\System\FhgkyRC.exe
  C:\Windows\System\FhgkyRC.exe
  2⤵
  PID:7416
- C:\Windows\System\XbNRDoa.exe
  C:\Windows\System\XbNRDoa.exe
  2⤵
  PID:7436
- C:\Windows\System\iNQuSbM.exe
  C:\Windows\System\iNQuSbM.exe
  2⤵
  PID:7464
- C:\Windows\System\ydspIcF.exe
  C:\Windows\System\ydspIcF.exe
  2⤵
  PID:7488
- C:\Windows\System\cykdxgi.exe
  C:\Windows\System\cykdxgi.exe
  2⤵
  PID:7516
- C:\Windows\System\LjyqMRX.exe
  C:\Windows\System\LjyqMRX.exe
  2⤵
  PID:7536
- C:\Windows\System\YZNvwso.exe
  C:\Windows\System\YZNvwso.exe
  2⤵
  PID:7564
- C:\Windows\System\NEuZXJL.exe
  C:\Windows\System\NEuZXJL.exe
  2⤵
  PID:7588
- C:\Windows\System\SRGMgJC.exe
  C:\Windows\System\SRGMgJC.exe
  2⤵
  PID:7608
- C:\Windows\System\dKVICec.exe
  C:\Windows\System\dKVICec.exe
  2⤵
  PID:7632
- C:\Windows\System\RZeAuGq.exe
  C:\Windows\System\RZeAuGq.exe
  2⤵
  PID:7660
- C:\Windows\System\dDppzYf.exe
  C:\Windows\System\dDppzYf.exe
  2⤵
  PID:7696
- C:\Windows\System\eCkGUKG.exe
  C:\Windows\System\eCkGUKG.exe
  2⤵
  PID:7728
- C:\Windows\System\cSISdZg.exe
  C:\Windows\System\cSISdZg.exe
  2⤵
  PID:7752
- C:\Windows\System\fmcczWh.exe
  C:\Windows\System\fmcczWh.exe
  2⤵
  PID:7780
- C:\Windows\System\pgBQIiF.exe
  C:\Windows\System\pgBQIiF.exe
  2⤵
  PID:7804
- C:\Windows\System\xpjaddK.exe
  C:\Windows\System\xpjaddK.exe
  2⤵
  PID:7828
- C:\Windows\System\SjGjIIj.exe
  C:\Windows\System\SjGjIIj.exe
  2⤵
  PID:7856
- C:\Windows\System\iOpSEPd.exe
  C:\Windows\System\iOpSEPd.exe
  2⤵
  PID:7884
- C:\Windows\System\TmOAuqz.exe
  C:\Windows\System\TmOAuqz.exe
  2⤵
  PID:7904
- C:\Windows\System\XQRzEOb.exe
  C:\Windows\System\XQRzEOb.exe
  2⤵
  PID:7936
- C:\Windows\System\wxiABWO.exe
  C:\Windows\System\wxiABWO.exe
  2⤵
  PID:7972
- C:\Windows\System\wtDnQtN.exe
  C:\Windows\System\wtDnQtN.exe
  2⤵
  PID:8000
- C:\Windows\System\QhuuvYF.exe
  C:\Windows\System\QhuuvYF.exe
  2⤵
  PID:8024
- C:\Windows\System\BDYasAU.exe
  C:\Windows\System\BDYasAU.exe
  2⤵
  PID:8048
- C:\Windows\System\sAXSQNF.exe
  C:\Windows\System\sAXSQNF.exe
  2⤵
  PID:8072
- C:\Windows\System\lwDuBvW.exe
  C:\Windows\System\lwDuBvW.exe
  2⤵
  PID:8096
- C:\Windows\System\pqXwwbM.exe
  C:\Windows\System\pqXwwbM.exe
  2⤵
  PID:8124
- C:\Windows\System\aheIKdt.exe
  C:\Windows\System\aheIKdt.exe
  2⤵
  PID:8144
- C:\Windows\System\wWHeRZj.exe
  C:\Windows\System\wWHeRZj.exe
  2⤵
  PID:8172
- C:\Windows\System\sWuwsMI.exe
  C:\Windows\System\sWuwsMI.exe
  2⤵
  PID:7092
- C:\Windows\System\zfBSDXW.exe
  C:\Windows\System\zfBSDXW.exe
  2⤵
  PID:6536
- C:\Windows\System\OlYnsRB.exe
  C:\Windows\System\OlYnsRB.exe
  2⤵
  PID:7176
- C:\Windows\System\NmMesLP.exe
  C:\Windows\System\NmMesLP.exe
  2⤵
  PID:7276
- C:\Windows\System\FSROdEB.exe
  C:\Windows\System\FSROdEB.exe
  2⤵
  PID:7392
- C:\Windows\System\mXpKGFX.exe
  C:\Windows\System\mXpKGFX.exe
  2⤵
  PID:7472
- C:\Windows\System\SMeaGkz.exe
  C:\Windows\System\SMeaGkz.exe
  2⤵
  PID:7504
- C:\Windows\System\DTKZFtF.exe
  C:\Windows\System\DTKZFtF.exe
  2⤵
  PID:7248
- C:\Windows\System\rnXKRTO.exe
  C:\Windows\System\rnXKRTO.exe
  2⤵
  PID:7460
- C:\Windows\System\TcEgibX.exe
  C:\Windows\System\TcEgibX.exe
  2⤵
  PID:7532
- C:\Windows\System\FcmCbtv.exe
  C:\Windows\System\FcmCbtv.exe
  2⤵
  PID:7604
- C:\Windows\System\ZtZjJrk.exe
  C:\Windows\System\ZtZjJrk.exe
  2⤵
  PID:7548
- C:\Windows\System\OHGBwgY.exe
  C:\Windows\System\OHGBwgY.exe
  2⤵
  PID:7788
- C:\Windows\System\wPXJrCn.exe
  C:\Windows\System\wPXJrCn.exe
  2⤵
  PID:7920
- C:\Windows\System\cmnvgch.exe
  C:\Windows\System\cmnvgch.exe
  2⤵
  PID:7872
- C:\Windows\System\cUnckPr.exe
  C:\Windows\System\cUnckPr.exe
  2⤵
  PID:8060
- C:\Windows\System\LdaFRUI.exe
  C:\Windows\System\LdaFRUI.exe
  2⤵
  PID:7868
- C:\Windows\System\TUKUiNd.exe
  C:\Windows\System\TUKUiNd.exe
  2⤵
  PID:8012
- C:\Windows\System\wbQuliI.exe
  C:\Windows\System\wbQuliI.exe
  2⤵
  PID:8132
- C:\Windows\System\GoJLUse.exe
  C:\Windows\System\GoJLUse.exe
  2⤵
  PID:8064
- C:\Windows\System\YQompjQ.exe
  C:\Windows\System\YQompjQ.exe
  2⤵
  PID:7096
- C:\Windows\System\rDWDFvi.exe
  C:\Windows\System\rDWDFvi.exe
  2⤵
  PID:6540
- C:\Windows\System\GAiZKhg.exe
  C:\Windows\System\GAiZKhg.exe
  2⤵
  PID:7580
- C:\Windows\System\wVEpFJs.exe
  C:\Windows\System\wVEpFJs.exe
  2⤵
  PID:7712
- C:\Windows\System\EwjUZXy.exe
  C:\Windows\System\EwjUZXy.exe
  2⤵
  PID:8216
- C:\Windows\System\cMEywvK.exe
  C:\Windows\System\cMEywvK.exe
  2⤵
  PID:8244
- C:\Windows\System\eCMGTaP.exe
  C:\Windows\System\eCMGTaP.exe
  2⤵
  PID:8260
- C:\Windows\System\ZmTlcDN.exe
  C:\Windows\System\ZmTlcDN.exe
  2⤵
  PID:8280
- C:\Windows\System\TkPWoUR.exe
  C:\Windows\System\TkPWoUR.exe
  2⤵
  PID:8304
- C:\Windows\System\OwHwxRS.exe
  C:\Windows\System\OwHwxRS.exe
  2⤵
  PID:8336
- C:\Windows\System\PcBiFKF.exe
  C:\Windows\System\PcBiFKF.exe
  2⤵
  PID:8356
- C:\Windows\System\sstNrZL.exe
  C:\Windows\System\sstNrZL.exe
  2⤵
  PID:8376
- C:\Windows\System\qEPlbjX.exe
  C:\Windows\System\qEPlbjX.exe
  2⤵
  PID:8400
- C:\Windows\System\HNJcXqK.exe
  C:\Windows\System\HNJcXqK.exe
  2⤵
  PID:8420
- C:\Windows\System\RApHkfQ.exe
  C:\Windows\System\RApHkfQ.exe
  2⤵
  PID:8452
- C:\Windows\System\iqoGztc.exe
  C:\Windows\System\iqoGztc.exe
  2⤵
  PID:8476
- C:\Windows\System\aBjPwAU.exe
  C:\Windows\System\aBjPwAU.exe
  2⤵
  PID:8492
- C:\Windows\System\JzspMfr.exe
  C:\Windows\System\JzspMfr.exe
  2⤵
  PID:8524
- C:\Windows\System\qDgsEpO.exe
  C:\Windows\System\qDgsEpO.exe
  2⤵
  PID:8556
- C:\Windows\System\cooetvY.exe
  C:\Windows\System\cooetvY.exe
  2⤵
  PID:8592
- C:\Windows\System\mfiosNc.exe
  C:\Windows\System\mfiosNc.exe
  2⤵
  PID:8624
- C:\Windows\System\hKQLzwP.exe
  C:\Windows\System\hKQLzwP.exe
  2⤵
  PID:8648
- C:\Windows\System\ejdruQe.exe
  C:\Windows\System\ejdruQe.exe
  2⤵
  PID:8672
- C:\Windows\System\VwFusUZ.exe
  C:\Windows\System\VwFusUZ.exe
  2⤵
  PID:8712
- C:\Windows\System\uWfbhqh.exe
  C:\Windows\System\uWfbhqh.exe
  2⤵
  PID:8728
- C:\Windows\System\eDnlAwu.exe
  C:\Windows\System\eDnlAwu.exe
  2⤵
  PID:8752
- C:\Windows\System\KJpBoid.exe
  C:\Windows\System\KJpBoid.exe
  2⤵
  PID:8776
- C:\Windows\System\WNhuwVZ.exe
  C:\Windows\System\WNhuwVZ.exe
  2⤵
  PID:8804
- C:\Windows\System\LfPLFRU.exe
  C:\Windows\System\LfPLFRU.exe
  2⤵
  PID:8840
- C:\Windows\System\wessWqd.exe
  C:\Windows\System\wessWqd.exe
  2⤵
  PID:8860
- C:\Windows\System\DWEBkim.exe
  C:\Windows\System\DWEBkim.exe
  2⤵
  PID:8880
- C:\Windows\System\YRQNPAe.exe
  C:\Windows\System\YRQNPAe.exe
  2⤵
  PID:8916
- C:\Windows\System\tmpgsZQ.exe
  C:\Windows\System\tmpgsZQ.exe
  2⤵
  PID:8940
- C:\Windows\System\lzutfsA.exe
  C:\Windows\System\lzutfsA.exe
  2⤵
  PID:8968
- C:\Windows\System\ttgienk.exe
  C:\Windows\System\ttgienk.exe
  2⤵
  PID:8992
- C:\Windows\System\OMEUPsF.exe
  C:\Windows\System\OMEUPsF.exe
  2⤵
  PID:9024
- C:\Windows\System\imfxPVS.exe
  C:\Windows\System\imfxPVS.exe
  2⤵
  PID:9052
- C:\Windows\System\fxGnRJp.exe
  C:\Windows\System\fxGnRJp.exe
  2⤵
  PID:9076
- C:\Windows\System\GyJYlaC.exe
  C:\Windows\System\GyJYlaC.exe
  2⤵
  PID:9096
- C:\Windows\System\ZlfuVDA.exe
  C:\Windows\System\ZlfuVDA.exe
  2⤵
  PID:9124
- C:\Windows\System\SaeGywN.exe
  C:\Windows\System\SaeGywN.exe
  2⤵
  PID:9164
- C:\Windows\System\nFiIVqt.exe
  C:\Windows\System\nFiIVqt.exe
  2⤵
  PID:9192
- C:\Windows\System\FJlGtAw.exe
  C:\Windows\System\FJlGtAw.exe
  2⤵
  PID:7600
- C:\Windows\System\hClqIVA.exe
  C:\Windows\System\hClqIVA.exe
  2⤵
  PID:7840
- C:\Windows\System\tstEKvy.exe
  C:\Windows\System\tstEKvy.exe
  2⤵
  PID:7988
- C:\Windows\System\oydkiFc.exe
  C:\Windows\System\oydkiFc.exe
  2⤵
  PID:7668
- C:\Windows\System\farYVwa.exe
  C:\Windows\System\farYVwa.exe
  2⤵
  PID:8232
- C:\Windows\System\idGKcVt.exe
  C:\Windows\System\idGKcVt.exe
  2⤵
  PID:8348
- C:\Windows\System\xfEcYrt.exe
  C:\Windows\System\xfEcYrt.exe
  2⤵
  PID:8392
- C:\Windows\System\kKdmbpH.exe
  C:\Windows\System\kKdmbpH.exe
  2⤵
  PID:8256
- C:\Windows\System\GqZYNPP.exe
  C:\Windows\System\GqZYNPP.exe
  2⤵
  PID:8444
- C:\Windows\System\FbiKxrp.exe
  C:\Windows\System\FbiKxrp.exe
  2⤵
  PID:8520
- C:\Windows\System\rdHSVBu.exe
  C:\Windows\System\rdHSVBu.exe
  2⤵
  PID:8516
- C:\Windows\System\IwDGLdd.exe
  C:\Windows\System\IwDGLdd.exe
  2⤵
  PID:8636
- C:\Windows\System\UgApiTk.exe
  C:\Windows\System\UgApiTk.exe
  2⤵
  PID:8408
- C:\Windows\System\OdGCJoO.exe
  C:\Windows\System\OdGCJoO.exe
  2⤵
  PID:8764
- C:\Windows\System\xfZCiUO.exe
  C:\Windows\System\xfZCiUO.exe
  2⤵
  PID:8852
- C:\Windows\System\KTjCTKk.exe
  C:\Windows\System\KTjCTKk.exe
  2⤵
  PID:9000
- C:\Windows\System\UeBeerC.exe
  C:\Windows\System\UeBeerC.exe
  2⤵
  PID:9048
- C:\Windows\System\OBULbqt.exe
  C:\Windows\System\OBULbqt.exe
  2⤵
  PID:9144
- C:\Windows\System\HBjpUSd.exe
  C:\Windows\System\HBjpUSd.exe
  2⤵
  PID:8608
- C:\Windows\System\ESEXUeg.exe
  C:\Windows\System\ESEXUeg.exe
  2⤵
  PID:9204
- C:\Windows\System\vPjPSAj.exe
  C:\Windows\System\vPjPSAj.exe
  2⤵
  PID:8664
- C:\Windows\System\YWykelZ.exe
  C:\Windows\System\YWykelZ.exe
  2⤵
  PID:7404
- C:\Windows\System\rBcsVrc.exe
  C:\Windows\System\rBcsVrc.exe
  2⤵
  PID:9084
- C:\Windows\System\cSngrcB.exe
  C:\Windows\System\cSngrcB.exe
  2⤵
  PID:9120
- C:\Windows\System\GkzPXzN.exe
  C:\Windows\System\GkzPXzN.exe
  2⤵
  PID:8552
- C:\Windows\System\YoRTJbi.exe
  C:\Windows\System\YoRTJbi.exe
  2⤵
  PID:8904
- C:\Windows\System\ohGcQJn.exe
  C:\Windows\System\ohGcQJn.exe
  2⤵
  PID:7848
- C:\Windows\System\cboXLAM.exe
  C:\Windows\System\cboXLAM.exe
  2⤵
  PID:7292
- C:\Windows\System\mfVIlzN.exe
  C:\Windows\System\mfVIlzN.exe
  2⤵
  PID:9020
- C:\Windows\System\gOghTAZ.exe
  C:\Windows\System\gOghTAZ.exe
  2⤵
  PID:9232
- C:\Windows\System\iZQBMmj.exe
  C:\Windows\System\iZQBMmj.exe
  2⤵
  PID:9260
- C:\Windows\System\SDzStYK.exe
  C:\Windows\System\SDzStYK.exe
  2⤵
  PID:9292
- C:\Windows\System\uXhAxku.exe
  C:\Windows\System\uXhAxku.exe
  2⤵
  PID:9308
- C:\Windows\System\FFYhLzl.exe
  C:\Windows\System\FFYhLzl.exe
  2⤵
  PID:9324
- C:\Windows\System\UwLGGtz.exe
  C:\Windows\System\UwLGGtz.exe
  2⤵
  PID:9352
- C:\Windows\System\iYgllhc.exe
  C:\Windows\System\iYgllhc.exe
  2⤵
  PID:9368
- C:\Windows\System\IVilYpr.exe
  C:\Windows\System\IVilYpr.exe
  2⤵
  PID:9388
- C:\Windows\System\tOZBfwm.exe
  C:\Windows\System\tOZBfwm.exe
  2⤵
  PID:9408
- C:\Windows\System\GwdIMuF.exe
  C:\Windows\System\GwdIMuF.exe
  2⤵
  PID:9432
- C:\Windows\System\zXbMdRf.exe
  C:\Windows\System\zXbMdRf.exe
  2⤵
  PID:9456
- C:\Windows\System\MNphSRW.exe
  C:\Windows\System\MNphSRW.exe
  2⤵
  PID:9476
- C:\Windows\System\kTrZfyf.exe
  C:\Windows\System\kTrZfyf.exe
  2⤵
  PID:9500
- C:\Windows\System\weKbHpk.exe
  C:\Windows\System\weKbHpk.exe
  2⤵
  PID:9528
- C:\Windows\System\iVsOOGT.exe
  C:\Windows\System\iVsOOGT.exe
  2⤵
  PID:9552
- C:\Windows\System\FvnypZs.exe
  C:\Windows\System\FvnypZs.exe
  2⤵
  PID:9580
- C:\Windows\System\reTidcl.exe
  C:\Windows\System\reTidcl.exe
  2⤵
  PID:9604
- C:\Windows\System\ftQOBrC.exe
  C:\Windows\System\ftQOBrC.exe
  2⤵
  PID:9632
- C:\Windows\System\mvhAPkS.exe
  C:\Windows\System\mvhAPkS.exe
  2⤵
  PID:9656
- C:\Windows\System\bLYlnFg.exe
  C:\Windows\System\bLYlnFg.exe
  2⤵
  PID:9680
- C:\Windows\System\wIbtPps.exe
  C:\Windows\System\wIbtPps.exe
  2⤵
  PID:9708
- C:\Windows\System\MtBIqCQ.exe
  C:\Windows\System\MtBIqCQ.exe
  2⤵
  PID:9728
- C:\Windows\System\IYuRAZc.exe
  C:\Windows\System\IYuRAZc.exe
  2⤵
  PID:9752
- C:\Windows\System\LmljgUh.exe
  C:\Windows\System\LmljgUh.exe
  2⤵
  PID:9780
- C:\Windows\System\IEEUazO.exe
  C:\Windows\System\IEEUazO.exe
  2⤵
  PID:9808
- C:\Windows\System\McZylbx.exe
  C:\Windows\System\McZylbx.exe
  2⤵
  PID:9832
- C:\Windows\System\GbfGqjw.exe
  C:\Windows\System\GbfGqjw.exe
  2⤵
  PID:9864
- C:\Windows\System\ASULbiJ.exe
  C:\Windows\System\ASULbiJ.exe
  2⤵
  PID:9892
- C:\Windows\System\QeSPNqL.exe
  C:\Windows\System\QeSPNqL.exe
  2⤵
  PID:9920
- C:\Windows\System\wsNsJZv.exe
  C:\Windows\System\wsNsJZv.exe
  2⤵
  PID:9940
- C:\Windows\System\jiDKeth.exe
  C:\Windows\System\jiDKeth.exe
  2⤵
  PID:9960
- C:\Windows\System\qwjuTpt.exe
  C:\Windows\System\qwjuTpt.exe
  2⤵
  PID:9980
- C:\Windows\System\gINPWIa.exe
  C:\Windows\System\gINPWIa.exe
  2⤵
  PID:10008
- C:\Windows\System\TqBHtOb.exe
  C:\Windows\System\TqBHtOb.exe
  2⤵
  PID:10032
- C:\Windows\System\pXEfkhA.exe
  C:\Windows\System\pXEfkhA.exe
  2⤵
  PID:10052
- C:\Windows\System\COWdqyH.exe
  C:\Windows\System\COWdqyH.exe
  2⤵
  PID:10080
- C:\Windows\System\VYMGlKK.exe
  C:\Windows\System\VYMGlKK.exe
  2⤵
  PID:10104
- C:\Windows\System\sWuzbJH.exe
  C:\Windows\System\sWuzbJH.exe
  2⤵
  PID:10136
- C:\Windows\System\CtLLwqe.exe
  C:\Windows\System\CtLLwqe.exe
  2⤵
  PID:10164
- C:\Windows\System\TeCUfLc.exe
  C:\Windows\System\TeCUfLc.exe
  2⤵
  PID:10196
- C:\Windows\System\kBCYDGo.exe
  C:\Windows\System\kBCYDGo.exe
  2⤵
  PID:10220
- C:\Windows\System\gsXRNss.exe
  C:\Windows\System\gsXRNss.exe
  2⤵
  PID:10236
- C:\Windows\System\OkkNZyE.exe
  C:\Windows\System\OkkNZyE.exe
  2⤵
  PID:7744
- C:\Windows\System\EcpXWoH.exe
  C:\Windows\System\EcpXWoH.exe
  2⤵
  PID:8768
- C:\Windows\System\LWWvqTP.exe
  C:\Windows\System\LWWvqTP.exe
  2⤵
  PID:8896
- C:\Windows\System\EEiMLXq.exe
  C:\Windows\System\EEiMLXq.exe
  2⤵
  PID:8988
- C:\Windows\System\xZXmgSr.exe
  C:\Windows\System\xZXmgSr.exe
  2⤵
  PID:9248
- C:\Windows\System\fVerBeT.exe
  C:\Windows\System\fVerBeT.exe
  2⤵
  PID:8876
- C:\Windows\System\YuePnDx.exe
  C:\Windows\System\YuePnDx.exe
  2⤵
  PID:9364
- C:\Windows\System\HSYGZWa.exe
  C:\Windows\System\HSYGZWa.exe
  2⤵
  PID:8668
- C:\Windows\System\gWQsguf.exe
  C:\Windows\System\gWQsguf.exe
  2⤵
  PID:8324
- C:\Windows\System\aUpLLai.exe
  C:\Windows\System\aUpLLai.exe
  2⤵
  PID:9488
- C:\Windows\System\bdluLUa.exe
  C:\Windows\System\bdluLUa.exe
  2⤵
  PID:8484
- C:\Windows\System\xxaDLTv.exe
  C:\Windows\System\xxaDLTv.exe
  2⤵
  PID:9228
- C:\Windows\System\rwlnpvg.exe
  C:\Windows\System\rwlnpvg.exe
  2⤵
  PID:9640
- C:\Windows\System\deavoak.exe
  C:\Windows\System\deavoak.exe
  2⤵
  PID:9348
- C:\Windows\System\WRBmNGF.exe
  C:\Windows\System\WRBmNGF.exe
  2⤵
  PID:9740
- C:\Windows\System\gZIijIq.exe
  C:\Windows\System\gZIijIq.exe
  2⤵
  PID:9768
- C:\Windows\System\hbjAKxK.exe
  C:\Windows\System\hbjAKxK.exe
  2⤵
  PID:9468
- C:\Windows\System\waevMMu.exe
  C:\Windows\System\waevMMu.exe
  2⤵
  PID:9540
- C:\Windows\System\fdpsLJL.exe
  C:\Windows\System\fdpsLJL.exe
  2⤵
  PID:9600
- C:\Windows\System\VDvGBeQ.exe
  C:\Windows\System\VDvGBeQ.exe
  2⤵
  PID:9620
- C:\Windows\System\haWftkS.exe
  C:\Windows\System\haWftkS.exe
  2⤵
  PID:10060
- C:\Windows\System\ZOKugsq.exe
  C:\Windows\System\ZOKugsq.exe
  2⤵
  PID:10116
- C:\Windows\System\jSuYRwi.exe
  C:\Windows\System\jSuYRwi.exe
  2⤵
  PID:10160
- C:\Windows\System\YxRTBMQ.exe
  C:\Windows\System\YxRTBMQ.exe
  2⤵
  PID:9804
- C:\Windows\System\BJAjGoo.exe
  C:\Windows\System\BJAjGoo.exe
  2⤵
  PID:8268
- C:\Windows\System\jGvUMBb.exe
  C:\Windows\System\jGvUMBb.exe
  2⤵
  PID:8912
- C:\Windows\System\RwaVcaJ.exe
  C:\Windows\System\RwaVcaJ.exe
  2⤵
  PID:10248
- C:\Windows\System\jEStJvO.exe
  C:\Windows\System\jEStJvO.exe
  2⤵
  PID:10276
- C:\Windows\System\HHeHfPD.exe
  C:\Windows\System\HHeHfPD.exe
  2⤵
  PID:10292
- C:\Windows\System\qYHEUQt.exe
  C:\Windows\System\qYHEUQt.exe
  2⤵
  PID:10316
- C:\Windows\System\SbIWWyR.exe
  C:\Windows\System\SbIWWyR.exe
  2⤵
  PID:10344
- C:\Windows\System\kiYJhNJ.exe
  C:\Windows\System\kiYJhNJ.exe
  2⤵
  PID:10368
- C:\Windows\System\lerIPhi.exe
  C:\Windows\System\lerIPhi.exe
  2⤵
  PID:10392
- C:\Windows\System\QIdDvQi.exe
  C:\Windows\System\QIdDvQi.exe
  2⤵
  PID:10412
- C:\Windows\System\WZxUfWR.exe
  C:\Windows\System\WZxUfWR.exe
  2⤵
  PID:10428
- C:\Windows\System\HNoklTI.exe
  C:\Windows\System\HNoklTI.exe
  2⤵
  PID:10444
- C:\Windows\System\BZirwaQ.exe
  C:\Windows\System\BZirwaQ.exe
  2⤵
  PID:10468
- C:\Windows\System\jiRlZao.exe
  C:\Windows\System\jiRlZao.exe
  2⤵
  PID:10496
- C:\Windows\System\dxHAtiW.exe
  C:\Windows\System\dxHAtiW.exe
  2⤵
  PID:10528
- C:\Windows\System\DjRUaIJ.exe
  C:\Windows\System\DjRUaIJ.exe
  2⤵
  PID:10552
- C:\Windows\System\QZAEOMc.exe
  C:\Windows\System\QZAEOMc.exe
  2⤵
  PID:10572
- C:\Windows\System\tHJKWua.exe
  C:\Windows\System\tHJKWua.exe
  2⤵
  PID:10616
- C:\Windows\System\UhEEnSy.exe
  C:\Windows\System\UhEEnSy.exe
  2⤵
  PID:10636
- C:\Windows\System\iQxObaX.exe
  C:\Windows\System\iQxObaX.exe
  2⤵
  PID:10660
- C:\Windows\System\NPecoHo.exe
  C:\Windows\System\NPecoHo.exe
  2⤵
  PID:10680
- C:\Windows\System\roKZtut.exe
  C:\Windows\System\roKZtut.exe
  2⤵
  PID:10704
- C:\Windows\System\lHVZTtV.exe
  C:\Windows\System\lHVZTtV.exe
  2⤵
  PID:10740
- C:\Windows\System\xeNEvac.exe
  C:\Windows\System\xeNEvac.exe
  2⤵
  PID:10760
- C:\Windows\System\lGYKCaO.exe
  C:\Windows\System\lGYKCaO.exe
  2⤵
  PID:10796
- C:\Windows\System\LYOiqAG.exe
  C:\Windows\System\LYOiqAG.exe
  2⤵
  PID:10820
- C:\Windows\System\ovBWZlz.exe
  C:\Windows\System\ovBWZlz.exe
  2⤵
  PID:10844
- C:\Windows\System\EjhpKPM.exe
  C:\Windows\System\EjhpKPM.exe
  2⤵
  PID:10864
- C:\Windows\System\tUyKOsO.exe
  C:\Windows\System\tUyKOsO.exe
  2⤵
  PID:10892
- C:\Windows\System\lxMrTQT.exe
  C:\Windows\System\lxMrTQT.exe
  2⤵
  PID:10908
- C:\Windows\System\IyBaKXh.exe
  C:\Windows\System\IyBaKXh.exe
  2⤵
  PID:10928
- C:\Windows\System\zFEzRFH.exe
  C:\Windows\System\zFEzRFH.exe
  2⤵
  PID:10956
- C:\Windows\System\mwPuHJJ.exe
  C:\Windows\System\mwPuHJJ.exe
  2⤵
  PID:10976
- C:\Windows\System\zjAauCF.exe
  C:\Windows\System\zjAauCF.exe
  2⤵
  PID:11004
- C:\Windows\System\sxCKXDz.exe
  C:\Windows\System\sxCKXDz.exe
  2⤵
  PID:11024
- C:\Windows\System\PQSmfmg.exe
  C:\Windows\System\PQSmfmg.exe
  2⤵
  PID:9724
- C:\Windows\System\etMkxVt.exe
  C:\Windows\System\etMkxVt.exe
  2⤵
  PID:9424
- C:\Windows\System\fltAPeZ.exe
  C:\Windows\System\fltAPeZ.exe
  2⤵
  PID:10676
- C:\Windows\System\ryMLeZu.exe
  C:\Windows\System\ryMLeZu.exe
  2⤵
  PID:9400
- C:\Windows\System\OnaGOFE.exe
  C:\Windows\System\OnaGOFE.exe
  2⤵
  PID:10580
- C:\Windows\System\DcYQkww.exe
  C:\Windows\System\DcYQkww.exe
  2⤵
  PID:10632
- C:\Windows\System\ePAwHcD.exe
  C:\Windows\System\ePAwHcD.exe
  2⤵
  PID:10732
- C:\Windows\System\nrTosTc.exe
  C:\Windows\System\nrTosTc.exe
  2⤵
  PID:10784
- C:\Windows\System\CYbLJuO.exe
  C:\Windows\System\CYbLJuO.exe
  2⤵
  PID:10832
- C:\Windows\System\gTyUTxB.exe
  C:\Windows\System\gTyUTxB.exe
  2⤵
  PID:10648
- C:\Windows\System\dGsiypc.exe
  C:\Windows\System\dGsiypc.exe
  2⤵
  PID:10900
- C:\Windows\System\TTzhdVg.exe
  C:\Windows\System\TTzhdVg.exe
  2⤵
  PID:10644
- C:\Windows\System\JAnaxjw.exe
  C:\Windows\System\JAnaxjw.exe
  2⤵
  PID:11284
- C:\Windows\System\YPEUpnZ.exe
  C:\Windows\System\YPEUpnZ.exe
  2⤵
  PID:11304
- C:\Windows\System\QJMukHT.exe
  C:\Windows\System\QJMukHT.exe
  2⤵
  PID:11332
- C:\Windows\System\vPPlwMM.exe
  C:\Windows\System\vPPlwMM.exe
  2⤵
  PID:11352
- C:\Windows\System\EimWBqI.exe
  C:\Windows\System\EimWBqI.exe
  2⤵
  PID:11368
- C:\Windows\System\fnAMNKM.exe
  C:\Windows\System\fnAMNKM.exe
  2⤵
  PID:11392
- C:\Windows\System\ODWDgtX.exe
  C:\Windows\System\ODWDgtX.exe
  2⤵
  PID:11416
- C:\Windows\System\qNqKixY.exe
  C:\Windows\System\qNqKixY.exe
  2⤵
  PID:11436
- C:\Windows\System\JrIEahO.exe
  C:\Windows\System\JrIEahO.exe
  2⤵
  PID:11452
- C:\Windows\System\kDggefp.exe
  C:\Windows\System\kDggefp.exe
  2⤵
  PID:11468
- C:\Windows\System\qQbozUL.exe
  C:\Windows\System\qQbozUL.exe
  2⤵
  PID:11492
- C:\Windows\System\xRmwVVi.exe
  C:\Windows\System\xRmwVVi.exe
  2⤵
  PID:11516
- C:\Windows\System\kOHOidh.exe
  C:\Windows\System\kOHOidh.exe
  2⤵
  PID:11540
- C:\Windows\System\zqHgXmM.exe
  C:\Windows\System\zqHgXmM.exe
  2⤵
  PID:11560
- C:\Windows\System\kosnMRN.exe
  C:\Windows\System\kosnMRN.exe
  2⤵
  PID:11576
- C:\Windows\System\XkbfLbD.exe
  C:\Windows\System\XkbfLbD.exe
  2⤵
  PID:11596
- C:\Windows\System\lnGJvvP.exe
  C:\Windows\System\lnGJvvP.exe
  2⤵
  PID:11616
- C:\Windows\System\bpEQsMo.exe
  C:\Windows\System\bpEQsMo.exe
  2⤵
  PID:11644
- C:\Windows\System\ZibiuJn.exe
  C:\Windows\System\ZibiuJn.exe
  2⤵
  PID:11668
- C:\Windows\System\bqIxPBG.exe
  C:\Windows\System\bqIxPBG.exe
  2⤵
  PID:11684
- C:\Windows\System\rOuOrnl.exe
  C:\Windows\System\rOuOrnl.exe
  2⤵
  PID:11716
- C:\Windows\System\loBzHsl.exe
  C:\Windows\System\loBzHsl.exe
  2⤵
  PID:11732
- C:\Windows\System\PmQVWMR.exe
  C:\Windows\System\PmQVWMR.exe
  2⤵
  PID:11748
- C:\Windows\System\AIiwYng.exe
  C:\Windows\System\AIiwYng.exe
  2⤵
  PID:11768
- C:\Windows\System\KmnSLIq.exe
  C:\Windows\System\KmnSLIq.exe
  2⤵
  PID:11792
- C:\Windows\System\NTbHzli.exe
  C:\Windows\System\NTbHzli.exe
  2⤵
  PID:11820
- C:\Windows\System\ZzjTvdK.exe
  C:\Windows\System\ZzjTvdK.exe
  2⤵
  PID:11852
- C:\Windows\System\QaQXwKo.exe
  C:\Windows\System\QaQXwKo.exe
  2⤵
  PID:11872
- C:\Windows\System\UVbiHsc.exe
  C:\Windows\System\UVbiHsc.exe
  2⤵
  PID:11900
- C:\Windows\System\sFOddhY.exe
  C:\Windows\System\sFOddhY.exe
  2⤵
  PID:11924
- C:\Windows\System\UgIDvIX.exe
  C:\Windows\System\UgIDvIX.exe
  2⤵
  PID:11940
- C:\Windows\System\RUOjYjj.exe
  C:\Windows\System\RUOjYjj.exe
  2⤵
  PID:11960
- C:\Windows\System\dkOVFij.exe
  C:\Windows\System\dkOVFij.exe
  2⤵
  PID:11984
- C:\Windows\System\CFimaSx.exe
  C:\Windows\System\CFimaSx.exe
  2⤵
  PID:12008
- C:\Windows\System\UXpNECt.exe
  C:\Windows\System\UXpNECt.exe
  2⤵
  PID:12028
- C:\Windows\System\clZmFkR.exe
  C:\Windows\System\clZmFkR.exe
  2⤵
  PID:12056
- C:\Windows\System\evLCSVO.exe
  C:\Windows\System\evLCSVO.exe
  2⤵
  PID:12072
- C:\Windows\System\HiYMfXv.exe
  C:\Windows\System\HiYMfXv.exe
  2⤵
  PID:12108
- C:\Windows\System\WtsTfFn.exe
  C:\Windows\System\WtsTfFn.exe
  2⤵
  PID:12136
- C:\Windows\System\zbZsElR.exe
  C:\Windows\System\zbZsElR.exe
  2⤵
  PID:12168
- C:\Windows\System\qxhenBZ.exe
  C:\Windows\System\qxhenBZ.exe
  2⤵
  PID:12188
- C:\Windows\System\RbJuCLe.exe
  C:\Windows\System\RbJuCLe.exe
  2⤵
  PID:12216
- C:\Windows\System\ESGCxpn.exe
  C:\Windows\System\ESGCxpn.exe
  2⤵
  PID:12236
- C:\Windows\System\waQoOgZ.exe
  C:\Windows\System\waQoOgZ.exe
  2⤵
  PID:12256
- C:\Windows\System\RegfasR.exe
  C:\Windows\System\RegfasR.exe
  2⤵
  PID:12272
- C:\Windows\System\EGoYJZq.exe
  C:\Windows\System\EGoYJZq.exe
  2⤵
  PID:10560
- C:\Windows\System\bUCIXwP.exe
  C:\Windows\System\bUCIXwP.exe
  2⤵
  PID:10484
- C:\Windows\System\lKLTUts.exe
  C:\Windows\System\lKLTUts.exe
  2⤵
  PID:9304
- C:\Windows\System\higqRAA.exe
  C:\Windows\System\higqRAA.exe
  2⤵
  PID:9088
- C:\Windows\System\ZrVJUVM.exe
  C:\Windows\System\ZrVJUVM.exe
  2⤵
  PID:10208
- C:\Windows\System\hSFhqJw.exe
  C:\Windows\System\hSFhqJw.exe
  2⤵
  PID:10888
- C:\Windows\System\DgURVFS.exe
  C:\Windows\System\DgURVFS.exe
  2⤵
  PID:10264
- C:\Windows\System\Agrobtm.exe
  C:\Windows\System\Agrobtm.exe
  2⤵
  PID:9820
- C:\Windows\System\eWSXZjE.exe
  C:\Windows\System\eWSXZjE.exe
  2⤵
  PID:9844
- C:\Windows\System\WbdcXSI.exe
  C:\Windows\System\WbdcXSI.exe
  2⤵
  PID:10720
- C:\Windows\System\EvtIXXp.exe
  C:\Windows\System\EvtIXXp.exe
  2⤵
  PID:11400
- C:\Windows\System\IkhKRen.exe
  C:\Windows\System\IkhKRen.exe
  2⤵
  PID:10420
- C:\Windows\System\vnwDEGN.exe
  C:\Windows\System\vnwDEGN.exe
  2⤵
  PID:11508
- C:\Windows\System\BDJDSeD.exe
  C:\Windows\System\BDJDSeD.exe
  2⤵
  PID:10788
- C:\Windows\System\fvIFLAu.exe
  C:\Windows\System\fvIFLAu.exe
  2⤵
  PID:11604
- C:\Windows\System\poqAqpy.exe
  C:\Windows\System\poqAqpy.exe
  2⤵
  PID:11656
- C:\Windows\System\gabjSTI.exe
  C:\Windows\System\gabjSTI.exe
  2⤵
  PID:11700
- C:\Windows\System\tdfAAlg.exe
  C:\Windows\System\tdfAAlg.exe
  2⤵
  PID:11784
- C:\Windows\System\zMndJFb.exe
  C:\Windows\System\zMndJFb.exe
  2⤵
  PID:11808
- C:\Windows\System\BQbeaCJ.exe
  C:\Windows\System\BQbeaCJ.exe
  2⤵
  PID:11632
- C:\Windows\System\HTNBMVp.exe
  C:\Windows\System\HTNBMVp.exe
  2⤵
  PID:11916
- C:\Windows\System\AkUqLyw.exe
  C:\Windows\System\AkUqLyw.exe
  2⤵
  PID:11756
- C:\Windows\System\apArWAR.exe
  C:\Windows\System\apArWAR.exe
  2⤵
  PID:11556
- C:\Windows\System\YcVfmAe.exe
  C:\Windows\System\YcVfmAe.exe
  2⤵
  PID:12164
- C:\Windows\System\rvdjYTj.exe
  C:\Windows\System\rvdjYTj.exe
  2⤵
  PID:11588
- C:\Windows\System\LIdblsJ.exe
  C:\Windows\System\LIdblsJ.exe
  2⤵
  PID:11892
- C:\Windows\System\qWpPyeY.exe
  C:\Windows\System\qWpPyeY.exe
  2⤵
  PID:12248
- C:\Windows\System\dEcFuqd.exe
  C:\Windows\System\dEcFuqd.exe
  2⤵
  PID:12000
- C:\Windows\System\PtVEXpe.exe
  C:\Windows\System\PtVEXpe.exe
  2⤵
  PID:10244
- C:\Windows\System\GKHXJuA.exe
  C:\Windows\System\GKHXJuA.exe
  2⤵
  PID:10816
- C:\Windows\System\SsahZoX.exe
  C:\Windows\System\SsahZoX.exe
  2⤵
  PID:11896
- C:\Windows\System\nxcjCTX.exe
  C:\Windows\System\nxcjCTX.exe
  2⤵
  PID:10688
- C:\Windows\System\rLSiLqj.exe
  C:\Windows\System\rLSiLqj.exe
  2⤵
  PID:11968
- C:\Windows\System\ltVAZfK.exe
  C:\Windows\System\ltVAZfK.exe
  2⤵
  PID:12308
- C:\Windows\System\ldCxXUo.exe
  C:\Windows\System\ldCxXUo.exe
  2⤵
  PID:12332
- C:\Windows\System\WfoezLA.exe
  C:\Windows\System\WfoezLA.exe
  2⤵
  PID:12356
- C:\Windows\System\wfhczBS.exe
  C:\Windows\System\wfhczBS.exe
  2⤵
  PID:12384
- C:\Windows\System\sGpuLPJ.exe
  C:\Windows\System\sGpuLPJ.exe
  2⤵
  PID:12412
- C:\Windows\System\BnvgGpf.exe
  C:\Windows\System\BnvgGpf.exe
  2⤵
  PID:12436
- C:\Windows\System\YDIEMRd.exe
  C:\Windows\System\YDIEMRd.exe
  2⤵
  PID:12456
- C:\Windows\System\kxTlXXE.exe
  C:\Windows\System\kxTlXXE.exe
  2⤵
  PID:12480
- C:\Windows\System\jHOzdtf.exe
  C:\Windows\System\jHOzdtf.exe
  2⤵
  PID:12504
- C:\Windows\System\nVdkVCi.exe
  C:\Windows\System\nVdkVCi.exe
  2⤵
  PID:12536
- C:\Windows\System\vlyuWMW.exe
  C:\Windows\System\vlyuWMW.exe
  2⤵
  PID:12556
- C:\Windows\System\UIPJLxR.exe
  C:\Windows\System\UIPJLxR.exe
  2⤵
  PID:12576
- C:\Windows\System\nrrQaNu.exe
  C:\Windows\System\nrrQaNu.exe
  2⤵
  PID:12608
- C:\Windows\System\xJXdezG.exe
  C:\Windows\System\xJXdezG.exe
  2⤵
  PID:12636
- C:\Windows\System\pOBFDst.exe
  C:\Windows\System\pOBFDst.exe
  2⤵
  PID:12664
- C:\Windows\System\pWQtWqh.exe
  C:\Windows\System\pWQtWqh.exe
  2⤵
  PID:12688
- C:\Windows\System\kYSktun.exe
  C:\Windows\System\kYSktun.exe
  2⤵
  PID:12708
- C:\Windows\System\eESAuzA.exe
  C:\Windows\System\eESAuzA.exe
  2⤵
  PID:12732
- C:\Windows\System\UPkbYte.exe
  C:\Windows\System\UPkbYte.exe
  2⤵
  PID:12760
- C:\Windows\System\HtNNUYI.exe
  C:\Windows\System\HtNNUYI.exe
  2⤵
  PID:12780
- C:\Windows\System\Mzmahlw.exe
  C:\Windows\System\Mzmahlw.exe
  2⤵
  PID:12808
- C:\Windows\System\ffLUUOL.exe
  C:\Windows\System\ffLUUOL.exe
  2⤵
  PID:12832
- C:\Windows\System\mXrMpSy.exe
  C:\Windows\System\mXrMpSy.exe
  2⤵
  PID:12868
- C:\Windows\System\TWoSCmX.exe
  C:\Windows\System\TWoSCmX.exe
  2⤵
  PID:12888
- C:\Windows\System\oIxNupQ.exe
  C:\Windows\System\oIxNupQ.exe
  2⤵
  PID:12916
- C:\Windows\System\GUjooUN.exe
  C:\Windows\System\GUjooUN.exe
  2⤵
  PID:12940
- C:\Windows\System\hsNjnJJ.exe
  C:\Windows\System\hsNjnJJ.exe
  2⤵
  PID:12960
- C:\Windows\System\bbmKAjt.exe
  C:\Windows\System\bbmKAjt.exe
  2⤵
  PID:12984
- C:\Windows\System\bZVsTxF.exe
  C:\Windows\System\bZVsTxF.exe
  2⤵
  PID:13020
- C:\Windows\System\fweKAkF.exe
  C:\Windows\System\fweKAkF.exe
  2⤵
  PID:13044
- C:\Windows\System\fdkPVLW.exe
  C:\Windows\System\fdkPVLW.exe
  2⤵
  PID:13064
- C:\Windows\System\MJgTbxz.exe
  C:\Windows\System\MJgTbxz.exe
  2⤵
  PID:13088
- C:\Windows\System\UmvJRsh.exe
  C:\Windows\System\UmvJRsh.exe
  2⤵
  PID:13112
- C:\Windows\System\nGXleFr.exe
  C:\Windows\System\nGXleFr.exe
  2⤵
  PID:13136
- C:\Windows\System\DOLVzsI.exe
  C:\Windows\System\DOLVzsI.exe
  2⤵
  PID:13164
- C:\Windows\System\kFwveSZ.exe
  C:\Windows\System\kFwveSZ.exe
  2⤵
  PID:13184
- C:\Windows\System\loUVFfY.exe
  C:\Windows\System\loUVFfY.exe
  2⤵
  PID:13220
- C:\Windows\System\IubQZHz.exe
  C:\Windows\System\IubQZHz.exe
  2⤵
  PID:13236
- C:\Windows\System\OYanxHH.exe
  C:\Windows\System\OYanxHH.exe
  2⤵
  PID:13264
- C:\Windows\System\QvHPNIe.exe
  C:\Windows\System\QvHPNIe.exe
  2⤵
  PID:13288
- C:\Windows\System\bbcjpzt.exe
  C:\Windows\System\bbcjpzt.exe
  2⤵
  PID:13308
- C:\Windows\System\FhHvcLM.exe
  C:\Windows\System\FhHvcLM.exe
  2⤵
  PID:11532
- C:\Windows\System\IMkmNso.exe
  C:\Windows\System\IMkmNso.exe
  2⤵
  PID:9428
- C:\Windows\System\CZomlBJ.exe
  C:\Windows\System\CZomlBJ.exe
  2⤵
  PID:12100
- C:\Windows\System\anovxLj.exe
  C:\Windows\System\anovxLj.exe
  2⤵
  PID:11312
- C:\Windows\System\RtoxnxX.exe
  C:\Windows\System\RtoxnxX.exe
  2⤵
  PID:10188
- C:\Windows\System\lBTiqGv.exe
  C:\Windows\System\lBTiqGv.exe
  2⤵
  PID:11956
- C:\Windows\System\ddvMQUW.exe
  C:\Windows\System\ddvMQUW.exe
  2⤵
  PID:12364
- C:\Windows\System\VimNfeJ.exe
  C:\Windows\System\VimNfeJ.exe
  2⤵
  PID:11936
- C:\Windows\System\ZjknFpq.exe
  C:\Windows\System\ZjknFpq.exe
  2⤵
  PID:11976
- C:\Windows\System\xuKFYlP.exe
  C:\Windows\System\xuKFYlP.exe
  2⤵
  PID:12592
- C:\Windows\System\eSKFwPW.exe
  C:\Windows\System\eSKFwPW.exe
  2⤵
  PID:12196
- C:\Windows\System\NvPjhUK.exe
  C:\Windows\System\NvPjhUK.exe
  2⤵
  PID:9360
- C:\Windows\System\FwOJOYz.exe
  C:\Windows\System\FwOJOYz.exe
  2⤵
  PID:10300
- C:\Windows\System\hmCxLJf.exe
  C:\Windows\System\hmCxLJf.exe
  2⤵
  PID:12704
- C:\Windows\System\tcxsWPH.exe
  C:\Windows\System\tcxsWPH.exe
  2⤵
  PID:12744
- C:\Windows\System\eGcibEg.exe
  C:\Windows\System\eGcibEg.exe
  2⤵
  PID:12776
- C:\Windows\System\MDGyRus.exe
  C:\Windows\System\MDGyRus.exe
  2⤵
  PID:12860
- C:\Windows\System\lEoiLld.exe
  C:\Windows\System\lEoiLld.exe
  2⤵
  PID:12324
- C:\Windows\System\hXKvqkq.exe
  C:\Windows\System\hXKvqkq.exe
  2⤵
  PID:12380
- C:\Windows\System\rCBYfia.exe
  C:\Windows\System\rCBYfia.exe
  2⤵
  PID:12492
- C:\Windows\System\XdLVBRO.exe
  C:\Windows\System\XdLVBRO.exe
  2⤵
  PID:13128
- C:\Windows\System\EtIKFQg.exe
  C:\Windows\System\EtIKFQg.exe
  2⤵
  PID:13172
- C:\Windows\System\TIujTWy.exe
  C:\Windows\System\TIujTWy.exe
  2⤵
  PID:13260
- C:\Windows\System\GIjkryp.exe
  C:\Windows\System\GIjkryp.exe
  2⤵
  PID:12724
- C:\Windows\System\ggnkbIx.exe
  C:\Windows\System\ggnkbIx.exe
  2⤵
  PID:13332
- C:\Windows\System\NnxHnzH.exe
  C:\Windows\System\NnxHnzH.exe
  2⤵
  PID:13364
- C:\Windows\System\FAKQoqi.exe
  C:\Windows\System\FAKQoqi.exe
  2⤵
  PID:13380
- C:\Windows\System\IEhjrkS.exe
  C:\Windows\System\IEhjrkS.exe
  2⤵
  PID:13412
- C:\Windows\System\qGVWTex.exe
  C:\Windows\System\qGVWTex.exe
  2⤵
  PID:13432
- C:\Windows\System\CmBgQjN.exe
  C:\Windows\System\CmBgQjN.exe
  2⤵
  PID:13456
- C:\Windows\System\lavQKRv.exe
  C:\Windows\System\lavQKRv.exe
  2⤵
  PID:13488
- C:\Windows\System\rOXgVuX.exe
  C:\Windows\System\rOXgVuX.exe
  2⤵
  PID:13504
- C:\Windows\System\jsPFpMZ.exe
  C:\Windows\System\jsPFpMZ.exe
  2⤵
  PID:13528
- C:\Windows\System\LqGGzUQ.exe
  C:\Windows\System\LqGGzUQ.exe
  2⤵
  PID:13544
- C:\Windows\System\HKrghmO.exe
  C:\Windows\System\HKrghmO.exe
  2⤵
  PID:13560
- C:\Windows\System\OjpnMjT.exe
  C:\Windows\System\OjpnMjT.exe
  2⤵
  PID:13592
- C:\Windows\System\OjJjhJS.exe
  C:\Windows\System\OjJjhJS.exe
  2⤵
  PID:13620
- C:\Windows\System\sPCOjCJ.exe
  C:\Windows\System\sPCOjCJ.exe
  2⤵
  PID:13648
- C:\Windows\System\mrEXBWh.exe
  C:\Windows\System\mrEXBWh.exe
  2⤵
  PID:13688
- C:\Windows\System\UrhOQda.exe
  C:\Windows\System\UrhOQda.exe
  2⤵
  PID:13704
- C:\Windows\System\IkpKjWR.exe
  C:\Windows\System\IkpKjWR.exe
  2⤵
  PID:13732
- C:\Windows\System\dBFgVQI.exe
  C:\Windows\System\dBFgVQI.exe
  2⤵
  PID:13748
- C:\Windows\System\MmUXamN.exe
  C:\Windows\System\MmUXamN.exe
  2⤵
  PID:13780
- C:\Windows\System\OxWxVbs.exe
  C:\Windows\System\OxWxVbs.exe
  2⤵
  PID:13804
- C:\Windows\System\MwwBoha.exe
  C:\Windows\System\MwwBoha.exe
  2⤵
  PID:13824
- C:\Windows\System\sQBzfKe.exe
  C:\Windows\System\sQBzfKe.exe
  2⤵
  PID:13852
- C:\Windows\System\nnqSTMj.exe
  C:\Windows\System\nnqSTMj.exe
  2⤵
  PID:13876
- C:\Windows\System\dmrKmFL.exe
  C:\Windows\System\dmrKmFL.exe
  2⤵
  PID:13908
- C:\Windows\System\raYKfWh.exe
  C:\Windows\System\raYKfWh.exe
  2⤵
  PID:13944
- C:\Windows\System\IpVrRWm.exe
  C:\Windows\System\IpVrRWm.exe
  2⤵
  PID:13992
- C:\Windows\System\AlnJfZl.exe
  C:\Windows\System\AlnJfZl.exe
  2⤵
  PID:14020
- C:\Windows\System\mpKvVbC.exe
  C:\Windows\System\mpKvVbC.exe
  2⤵
  PID:14056
- C:\Windows\System\Bxpgkpf.exe
  C:\Windows\System\Bxpgkpf.exe
  2⤵
  PID:14072
- C:\Windows\System\mubdsFA.exe
  C:\Windows\System\mubdsFA.exe
  2⤵
  PID:14096
- C:\Windows\System\tNtgIIj.exe
  C:\Windows\System\tNtgIIj.exe
  2⤵
  PID:14124
- C:\Windows\System\szdRYdt.exe
  C:\Windows\System\szdRYdt.exe
  2⤵
  PID:14140
- C:\Windows\System\ujdJAsC.exe
  C:\Windows\System\ujdJAsC.exe
  2⤵
  PID:14160
- C:\Windows\System\YNToCoG.exe
  C:\Windows\System\YNToCoG.exe
  2⤵
  PID:14176
- C:\Windows\System\ClnZFsd.exe
  C:\Windows\System\ClnZFsd.exe
  2⤵
  PID:14192
- C:\Windows\System\OciPGzf.exe
  C:\Windows\System\OciPGzf.exe
  2⤵
  PID:14208
- C:\Windows\System\NHSCfmX.exe
  C:\Windows\System\NHSCfmX.exe
  2⤵
  PID:14224
- C:\Windows\System\ZQMnfsF.exe
  C:\Windows\System\ZQMnfsF.exe
  2⤵
  PID:14256
- C:\Windows\System\DhOlvfV.exe
  C:\Windows\System\DhOlvfV.exe
  2⤵
  PID:14272
- C:\Windows\System\ExwWXVI.exe
  C:\Windows\System\ExwWXVI.exe
  2⤵
  PID:14292
- C:\Windows\System\wYofEDX.exe
  C:\Windows\System\wYofEDX.exe
  2⤵
  PID:14308
- C:\Windows\System\gfrVtfD.exe
  C:\Windows\System\gfrVtfD.exe
  2⤵
  PID:14324
- C:\Windows\System\UtsIIhT.exe
  C:\Windows\System\UtsIIhT.exe
  2⤵
  PID:11388
- C:\Windows\System\DIudfvE.exe
  C:\Windows\System\DIudfvE.exe
  2⤵
  PID:12900
- C:\Windows\System\HrpUZPy.exe
  C:\Windows\System\HrpUZPy.exe
  2⤵
  PID:12344
- C:\Windows\System\TyKeqFj.exe
  C:\Windows\System\TyKeqFj.exe
  2⤵
  PID:12432
- C:\Windows\System\chgSdzp.exe
  C:\Windows\System\chgSdzp.exe
  2⤵
  PID:11888
- C:\Windows\System\ovQyjbB.exe
  C:\Windows\System\ovQyjbB.exe
  2⤵
  PID:12620
- C:\Windows\System\jFweoSt.exe
  C:\Windows\System\jFweoSt.exe
  2⤵
  PID:13096
- C:\Windows\System\LwefbcA.exe
  C:\Windows\System\LwefbcA.exe
  2⤵
  PID:8960
- C:\Windows\System\wXvxGWa.exe
  C:\Windows\System\wXvxGWa.exe
  2⤵
  PID:11428
- C:\Windows\System\LOcbDNn.exe
  C:\Windows\System\LOcbDNn.exe
  2⤵
  PID:12932
- C:\Windows\System\eKjyCOI.exe
  C:\Windows\System\eKjyCOI.exe
  2⤵
  PID:12320
- C:\Windows\System\rRetWIN.exe
  C:\Windows\System\rRetWIN.exe
  2⤵
  PID:13772
- C:\Windows\System\xVaDfmn.exe
  C:\Windows\System\xVaDfmn.exe
  2⤵
  PID:12652
- C:\Windows\System\dIMlOMe.exe
  C:\Windows\System\dIMlOMe.exe
  2⤵
  PID:11360
- C:\Windows\System\jtNnolI.exe
  C:\Windows\System\jtNnolI.exe
  2⤵
  PID:12352
- C:\Windows\System\XiQWVsM.exe
  C:\Windows\System\XiQWVsM.exe
  2⤵
  PID:12528
- C:\Windows\System\SSnyloH.exe
  C:\Windows\System\SSnyloH.exe
  2⤵
  PID:13636
- C:\Windows\System\xyIOEyH.exe
  C:\Windows\System\xyIOEyH.exe
  2⤵
  PID:10548
- C:\Windows\System\WBwAnWQ.exe
  C:\Windows\System\WBwAnWQ.exe
  2⤵
  PID:13680
- C:\Windows\System\NWZqPvS.exe
  C:\Windows\System\NWZqPvS.exe
  2⤵
  PID:11608
- C:\Windows\System\ROBgGUo.exe
  C:\Windows\System\ROBgGUo.exe
  2⤵
  PID:14012
- C:\Windows\System\yKdcvSS.exe
  C:\Windows\System\yKdcvSS.exe
  2⤵
  PID:13444
- C:\Windows\System\nfnQlmK.exe
  C:\Windows\System\nfnQlmK.exe
  2⤵
  PID:13476
- C:\Windows\System\ktjApMs.exe
  C:\Windows\System\ktjApMs.exe
  2⤵
  PID:13556
- C:\Windows\System\sUfotgp.exe
  C:\Windows\System\sUfotgp.exe
  2⤵
  PID:13600
- C:\Windows\System\hhTmSXL.exe
  C:\Windows\System\hhTmSXL.exe
  2⤵
  PID:13632
- C:\Windows\System\DcsMVsB.exe
  C:\Windows\System\DcsMVsB.exe
  2⤵
  PID:11444
- C:\Windows\System\OcsJzTY.exe
  C:\Windows\System\OcsJzTY.exe
  2⤵
  PID:10440
- C:\Windows\System\yUwhcRS.exe
  C:\Windows\System\yUwhcRS.exe
  2⤵
  PID:13812
- C:\Windows\System\RshJjMZ.exe
  C:\Windows\System\RshJjMZ.exe
  2⤵
  PID:12064
- C:\Windows\System\UGXEsIs.exe
  C:\Windows\System\UGXEsIs.exe
  2⤵
  PID:14352
- C:\Windows\System\CWhpExY.exe
  C:\Windows\System\CWhpExY.exe
  2⤵
  PID:14388
- C:\Windows\System\lMXyosF.exe
  C:\Windows\System\lMXyosF.exe
  2⤵
  PID:14424
- C:\Windows\System\KkFUGgz.exe
  C:\Windows\System\KkFUGgz.exe
  2⤵
  PID:14452
- C:\Windows\System\tMwIhbP.exe
  C:\Windows\System\tMwIhbP.exe
  2⤵
  PID:14480
- C:\Windows\System\YsAFWvO.exe
  C:\Windows\System\YsAFWvO.exe
  2⤵
  PID:14508
- C:\Windows\System\xZyacoC.exe
  C:\Windows\System\xZyacoC.exe
  2⤵
  PID:14556
- C:\Windows\System\ndsTpEP.exe
  C:\Windows\System\ndsTpEP.exe
  2⤵
  PID:14624
- C:\Windows\System\nKCaEHS.exe
  C:\Windows\System\nKCaEHS.exe
  2⤵
  PID:14664
- C:\Windows\System\FGTsvcT.exe
  C:\Windows\System\FGTsvcT.exe
  2⤵
  PID:14684
- C:\Windows\System\zDzgehY.exe
  C:\Windows\System\zDzgehY.exe
  2⤵
  PID:14716
- C:\Windows\System\QnAZsbj.exe
  C:\Windows\System\QnAZsbj.exe
  2⤵
  PID:14740
- C:\Windows\System\xkizJtY.exe
  C:\Windows\System\xkizJtY.exe
  2⤵
  PID:14768
- C:\Windows\System\XNFgsNu.exe
  C:\Windows\System\XNFgsNu.exe
  2⤵
  PID:15016
- C:\Windows\System\hYnjMUz.exe
  C:\Windows\System\hYnjMUz.exe
  2⤵
  PID:15040
- C:\Windows\System\GLoCwWP.exe
  C:\Windows\System\GLoCwWP.exe
  2⤵
  PID:15080
- C:\Windows\System\gYmJNeV.exe
  C:\Windows\System\gYmJNeV.exe
  2⤵
  PID:15104
- C:\Windows\System\qZKHoTq.exe
  C:\Windows\System\qZKHoTq.exe
  2⤵
  PID:15132
- C:\Windows\System\JOkDwTw.exe
  C:\Windows\System\JOkDwTw.exe
  2⤵
  PID:15156
- C:\Windows\System\ahFgJnY.exe
  C:\Windows\System\ahFgJnY.exe
  2⤵
  PID:15184
- C:\Windows\System\CIIFMjw.exe
  C:\Windows\System\CIIFMjw.exe
  2⤵
  PID:15208
- C:\Windows\System\maLEmyB.exe
  C:\Windows\System\maLEmyB.exe
  2⤵
  PID:15268
- C:\Windows\System\rhhPxxE.exe
  C:\Windows\System\rhhPxxE.exe
  2⤵
  PID:15292
- C:\Windows\System\EyzVEDA.exe
  C:\Windows\System\EyzVEDA.exe
  2⤵
  PID:15324
- C:\Windows\System\XoBCsOe.exe
  C:\Windows\System\XoBCsOe.exe
  2⤵
  PID:15340
- C:\Windows\System\YmOTahb.exe
  C:\Windows\System\YmOTahb.exe
  2⤵
  PID:14120
- C:\Windows\System\DRqadWS.exe
  C:\Windows\System\DRqadWS.exe
  2⤵
  PID:13176
- C:\Windows\System\zMNrHZK.exe
  C:\Windows\System\zMNrHZK.exe
  2⤵
  PID:13940
- C:\Windows\System\QagEViE.exe
  C:\Windows\System\QagEViE.exe
  2⤵
  PID:13968
- C:\Windows\System\lKgKwLL.exe
  C:\Windows\System\lKgKwLL.exe
  2⤵
  PID:14148
- C:\Windows\System\zcLVhNt.exe
  C:\Windows\System\zcLVhNt.exe
  2⤵
  PID:14184
- C:\Windows\System\QHzxTjC.exe
  C:\Windows\System\QHzxTjC.exe
  2⤵
  PID:14280
- C:\Windows\System\wfrpvMm.exe
  C:\Windows\System\wfrpvMm.exe
  2⤵
  PID:14412
- C:\Windows\System\LsbkrTY.exe
  C:\Windows\System\LsbkrTY.exe
  2⤵
  PID:14732
- C:\Windows\System\hngNnxj.exe
  C:\Windows\System\hngNnxj.exe
  2⤵
  PID:13744
- C:\Windows\System\ShRAIlB.exe
  C:\Windows\System\ShRAIlB.exe
  2⤵
  PID:13860
- C:\Windows\System\QmWIgZb.exe
  C:\Windows\System\QmWIgZb.exe
  2⤵
  PID:14380
- C:\Windows\System\JRvAUYg.exe
  C:\Windows\System\JRvAUYg.exe
  2⤵
  PID:14492
- C:\Windows\System\DxLSZZU.exe
  C:\Windows\System\DxLSZZU.exe
  2⤵
  PID:10288
- C:\Windows\System\DxrPUdf.exe
  C:\Windows\System\DxrPUdf.exe
  2⤵
  PID:12792
- C:\Windows\System\XJObSDd.exe
  C:\Windows\System\XJObSDd.exe
  2⤵
  PID:13428
- C:\Windows\System\tktWIpO.exe
  C:\Windows\System\tktWIpO.exe
  2⤵
  PID:14964
- C:\Windows\System\lDkoUNk.exe
  C:\Windows\System\lDkoUNk.exe
  2⤵
  PID:15124
- C:\Windows\System\eeyoIUA.exe
  C:\Windows\System\eeyoIUA.exe
  2⤵
  PID:15168
- C:\Windows\System\OHZXQfn.exe
  C:\Windows\System\OHZXQfn.exe
  2⤵
  PID:14852
- C:\Windows\System\TIHfdmv.exe
  C:\Windows\System\TIHfdmv.exe
  2⤵
  PID:15352
- C:\Windows\System\ValnnUP.exe
  C:\Windows\System\ValnnUP.exe
  2⤵
  PID:15372
- C:\Windows\System\nXvjmOy.exe
  C:\Windows\System\nXvjmOy.exe
  2⤵
  PID:15396
- C:\Windows\System\DHnZyrA.exe
  C:\Windows\System\DHnZyrA.exe
  2⤵
  PID:15420
- C:\Windows\System\RLlCYfU.exe
  C:\Windows\System\RLlCYfU.exe
  2⤵
  PID:15448
- C:\Windows\System\GxlhGcf.exe
  C:\Windows\System\GxlhGcf.exe
  2⤵
  PID:15468
- C:\Windows\System\QGSuwQJ.exe
  C:\Windows\System\QGSuwQJ.exe
  2⤵
  PID:15496
- C:\Windows\System\xHljykT.exe
  C:\Windows\System\xHljykT.exe
  2⤵
  PID:15528
- C:\Windows\System\svJoQBX.exe
  C:\Windows\System\svJoQBX.exe
  2⤵
  PID:15560
- C:\Windows\System\rdCIckv.exe
  C:\Windows\System\rdCIckv.exe
  2⤵
  PID:15584
- C:\Windows\System\ZTbsbiu.exe
  C:\Windows\System\ZTbsbiu.exe
  2⤵
  PID:15604
- C:\Windows\System\QDsiTbU.exe
  C:\Windows\System\QDsiTbU.exe
  2⤵
  PID:15628
- C:\Windows\System\ZtxUrpv.exe
  C:\Windows\System\ZtxUrpv.exe
  2⤵
  PID:15652
- C:\Windows\System\HrgbAjp.exe
  C:\Windows\System\HrgbAjp.exe
  2⤵
  PID:15668
- C:\Windows\System\sInehhU.exe
  C:\Windows\System\sInehhU.exe
  2⤵
  PID:15688
- C:\Windows\System\GADGTqv.exe
  C:\Windows\System\GADGTqv.exe
  2⤵
  PID:15708
- C:\Windows\System\boFEpxg.exe
  C:\Windows\System\boFEpxg.exe
  2⤵
  PID:15744
- C:\Windows\System\tjcrhVp.exe
  C:\Windows\System\tjcrhVp.exe
  2⤵
  PID:15760
- C:\Windows\System\DxXVxai.exe
  C:\Windows\System\DxXVxai.exe
  2⤵
  PID:15776
- C:\Windows\System\bmxFHjf.exe
  C:\Windows\System\bmxFHjf.exe
  2⤵
  PID:15796
- C:\Windows\System\thBoDbj.exe
  C:\Windows\System\thBoDbj.exe
  2⤵
  PID:15816
- C:\Windows\System\lEYjUjm.exe
  C:\Windows\System\lEYjUjm.exe
  2⤵
  PID:15848
- C:\Windows\System\vSMibXU.exe
  C:\Windows\System\vSMibXU.exe
  2⤵
  PID:15868
- C:\Windows\System\TDEmSCj.exe
  C:\Windows\System\TDEmSCj.exe
  2⤵
  PID:15892
- C:\Windows\System\JzYqMjy.exe
  C:\Windows\System\JzYqMjy.exe
  2⤵
  PID:15912
- C:\Windows\System\FYDPGiv.exe
  C:\Windows\System\FYDPGiv.exe
  2⤵
  PID:15936
- C:\Windows\System\UZbTnNe.exe
  C:\Windows\System\UZbTnNe.exe
  2⤵
  PID:15956
- C:\Windows\System\DQJwzeM.exe
  C:\Windows\System\DQJwzeM.exe
  2⤵
  PID:15976
- C:\Windows\System\sxNsixx.exe
  C:\Windows\System\sxNsixx.exe
  2⤵
  PID:16008
- C:\Windows\System\pOuhHBh.exe
  C:\Windows\System\pOuhHBh.exe
  2⤵
  PID:16032
- C:\Windows\System\EhsvGxO.exe
  C:\Windows\System\EhsvGxO.exe
  2⤵
  PID:16056
- C:\Windows\System\dWMrXFs.exe
  C:\Windows\System\dWMrXFs.exe
  2⤵
  PID:16072
- C:\Windows\System\HaTWUuC.exe
  C:\Windows\System\HaTWUuC.exe
  2⤵
  PID:16096
- C:\Windows\System\YWZisyP.exe
  C:\Windows\System\YWZisyP.exe
  2⤵
  PID:16124
- C:\Windows\System\pmSzXjG.exe
  C:\Windows\System\pmSzXjG.exe
  2⤵
  PID:16144
- C:\Windows\System\TyTeeIV.exe
  C:\Windows\System\TyTeeIV.exe
  2⤵
  PID:16164
- C:\Windows\System\DfqnDZs.exe
  C:\Windows\System\DfqnDZs.exe
  2⤵
  PID:16196
- C:\Windows\System\QipqFVc.exe
  C:\Windows\System\QipqFVc.exe
  2⤵
  PID:16216
- C:\Windows\System\oWBfsTy.exe
  C:\Windows\System\oWBfsTy.exe
  2⤵
  PID:16236
- C:\Windows\System\WGPmiFi.exe
  C:\Windows\System\WGPmiFi.exe
  2⤵
  PID:16252
- C:\Windows\System\DEaNepv.exe
  C:\Windows\System\DEaNepv.exe
  2⤵
  PID:16276
- C:\Windows\System\emvnYNt.exe
  C:\Windows\System\emvnYNt.exe
  2⤵
  PID:16300
- C:\Windows\System\yAdhhtA.exe
  C:\Windows\System\yAdhhtA.exe
  2⤵
  PID:16316
- C:\Windows\System\MGcBbGt.exe
  C:\Windows\System\MGcBbGt.exe
  2⤵
  PID:16340
- C:\Windows\System\DSSlwHx.exe
  C:\Windows\System\DSSlwHx.exe
  2⤵
  PID:16364
- C:\Windows\System\MmxTOhG.exe
  C:\Windows\System\MmxTOhG.exe
  2⤵
  PID:13472
- C:\Windows\System\iBiwbnu.exe
  C:\Windows\System\iBiwbnu.exe
  2⤵
  PID:14672
- C:\Windows\System\rsPGUKP.exe
  C:\Windows\System\rsPGUKP.exe
  2⤵
  PID:13724
- C:\Windows\System\GUyNcFR.exe
  C:\Windows\System\GUyNcFR.exe
  2⤵
  PID:13668
- C:\Windows\System\knGKJNs.exe
  C:\Windows\System\knGKJNs.exe
  2⤵
  PID:14708
- C:\Windows\System\UDLrcht.exe
  C:\Windows\System\UDLrcht.exe
  2⤵
  PID:15288
- C:\Windows\System\pXscppR.exe
  C:\Windows\System\pXscppR.exe
  2⤵
  PID:15204
- C:\Windows\System\sMirPbc.exe
  C:\Windows\System\sMirPbc.exe
  2⤵
  PID:15336
- C:\Windows\System\RltvYGV.exe
  C:\Windows\System\RltvYGV.exe
  2⤵
  PID:15752
- C:\Windows\System\WvuiICZ.exe
  C:\Windows\System\WvuiICZ.exe
  2⤵
  PID:13304
- C:\Windows\System\cJMCXEe.exe
  C:\Windows\System\cJMCXEe.exe
  2⤵
  PID:15828
- C:\Windows\System\RjGbaxl.exe
  C:\Windows\System\RjGbaxl.exe
  2⤵
  PID:15388
- C:\Windows\System\zGJcZef.exe
  C:\Windows\System\zGJcZef.exe
  2⤵
  PID:15428
- C:\Windows\System\sDmLivb.exe
  C:\Windows\System\sDmLivb.exe
  2⤵
  PID:15580
- C:\Windows\System\IxKdrmo.exe
  C:\Windows\System\IxKdrmo.exe
  2⤵
  PID:14932
- C:\Windows\System\GShoxqP.exe
  C:\Windows\System\GShoxqP.exe
  2⤵
  PID:15140
- C:\Windows\System\tFJXfZl.exe
  C:\Windows\System\tFJXfZl.exe
  2⤵
  PID:15756
- C:\Windows\System\uDTKsmW.exe
  C:\Windows\System\uDTKsmW.exe
  2⤵
  PID:15480
- C:\Windows\System\yHzoKCk.exe
  C:\Windows\System\yHzoKCk.exe
  2⤵
  PID:15972
- C:\Windows\System\bAeKiCZ.exe
  C:\Windows\System\bAeKiCZ.exe
  2⤵
  PID:16064
- C:\Windows\System\yZXUHkk.exe
  C:\Windows\System\yZXUHkk.exe
  2⤵
  PID:16092
- C:\Windows\System\IqPtjnE.exe
  C:\Windows\System\IqPtjnE.exe
  2⤵
  PID:16228
- C:\Windows\System\kSKpezo.exe
  C:\Windows\System\kSKpezo.exe
  2⤵
  PID:16272
- C:\Windows\System\NfKCFTv.exe
  C:\Windows\System\NfKCFTv.exe
  2⤵
  PID:12264
- C:\Windows\System\ZamvsRY.exe
  C:\Windows\System\ZamvsRY.exe
  2⤵
  PID:15808
- C:\Windows\System\onqbPkf.exe
  C:\Windows\System\onqbPkf.exe
  2⤵
  PID:15704
- C:\Windows\System\DUTGuWl.exe
  C:\Windows\System\DUTGuWl.exe
  2⤵
  PID:15284
- C:\Windows\System\Mtjokml.exe
  C:\Windows\System\Mtjokml.exe
  2⤵
  PID:13372
- C:\Windows\System\LgNFJfy.exe
  C:\Windows\System\LgNFJfy.exe
  2⤵
  PID:16400
- C:\Windows\System\fqRvRmL.exe
  C:\Windows\System\fqRvRmL.exe
  2⤵
  PID:16420
- C:\Windows\System\ObQOYbF.exe
  C:\Windows\System\ObQOYbF.exe
  2⤵
  PID:16456
- C:\Windows\System\uAjADbo.exe
  C:\Windows\System\uAjADbo.exe
  2⤵
  PID:16480
- C:\Windows\System\xcdWvqM.exe
  C:\Windows\System\xcdWvqM.exe
  2⤵
  PID:16500
- C:\Windows\System\jLikHOi.exe
  C:\Windows\System\jLikHOi.exe
  2⤵
  PID:16516
- C:\Windows\System\QEWkLcI.exe
  C:\Windows\System\QEWkLcI.exe
  2⤵
  PID:16544
- C:\Windows\System\oMvJnCI.exe
  C:\Windows\System\oMvJnCI.exe
  2⤵
  PID:16564
- C:\Windows\System\UHrXdCQ.exe
  C:\Windows\System\UHrXdCQ.exe
  2⤵
  PID:16600
- C:\Windows\System\XQAFhdM.exe
  C:\Windows\System\XQAFhdM.exe
  2⤵
  PID:16624
- C:\Windows\System\SGNTkdT.exe
  C:\Windows\System\SGNTkdT.exe
  2⤵
  PID:16660
- C:\Windows\System\CKgqDWz.exe
  C:\Windows\System\CKgqDWz.exe
  2⤵
  PID:16688
- C:\Windows\System\hXwsNit.exe
  C:\Windows\System\hXwsNit.exe
  2⤵
  PID:16720
- C:\Windows\System\dcMCGex.exe
  C:\Windows\System\dcMCGex.exe
  2⤵
  PID:16748
- C:\Windows\System\xIHqIVR.exe
  C:\Windows\System\xIHqIVR.exe
  2⤵
  PID:16772
- C:\Windows\System\LeaQRhr.exe
  C:\Windows\System\LeaQRhr.exe
  2⤵
  PID:16808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CMFBWYH.exe

Filesize
1.1MB

MD5
b346756b17f3c95f0e589224899c0e78

SHA1
5ad2b62180f69d15cd17b90b6b8e0fbabb1fa480

SHA256
f08bf2936a15a2f2a71e4277cc9e82f97f30d5178aaf5263e66e22805e11f82d

SHA512
4e28f78dc2841bae95daf71da4c45b73be0fca1747a0fff663e8389d155ff1c8ffe83ba48cc54bd2d931cda12da847f41f6aedfa374a61db5f2cdb002cf73056

Download Submit
C:\Windows\System\CSCupjH.exe

Filesize
1.1MB

MD5
a78bbb1c744145357b8e1010262166de

SHA1
38d0c8b9d9120972afd8255d8181daeba7189766

SHA256
1181649aea93d2e72f39b3f7dc4b928956fb3218ee8b8ffa671cd631ba00581c

SHA512
0732a521bdbb04419fcb6949a1bdd72d7443e843158873baf3461aeaf33bb42477e4bfab0e1b0fedb353a8d760f9ece283fdb3c401689a0090ab2f47facdc11b

Download Submit
C:\Windows\System\Diwubmg.exe

Filesize
1.1MB

MD5
f35cd4e29768f454cdf22d9f942fe1cf

SHA1
f4953dd0def394ba99a977e14fe9cf86f2534308

SHA256
5c96088f940c683709bc39c0d0cef9f91ea8f8abdaa657c01269d9e9f1470878

SHA512
1874d35ddf5829793b073678eadc4db51f22b0c1938a67edab46b18f5b533928d9913d14fee4b47cff4ffe583c5086bf1b9ecce4a10b8a4cd095d1ab199eb1ce

Download Submit
C:\Windows\System\EzmvDRc.exe

Filesize
1.1MB

MD5
9b12950940b393ed1dab27e9d55e8a28

SHA1
8975e2645e02fb60392f46a3b7ae54f454c28ece

SHA256
ee2e1e3b25a8d0350b54918505ae2baeade77ab7e2a760f4723f45cfb224f3de

SHA512
ea3afaaad35c255fc17de5e2e19aec2e90f257c63ffe2eaab74b877e0191c467c135b08faef2b986577bf68b69a35c5e1af3b1d90ed0520e6ad76d5cb04c9e4a

Download Submit
C:\Windows\System\FlvnAIS.exe

Filesize
1.1MB

MD5
afe0ed7b92e119b5f3d8607e42e305ef

SHA1
f2da689e0602ceaab47aef7239fab67c896b94be

SHA256
70ed0af2ae3cee7f0976984e2e8d5d336b826af509f1ad5905ca29202089563b

SHA512
59762fb33e359bb67046af796c1839d5a3c2784c4c295a6b4b5c1cfae470104f1c5484cbc3f2f3e1d3716488978f1dc2130bd319e4911003697ec06277ddbc53

Download Submit
C:\Windows\System\IsPvfym.exe

Filesize
1.1MB

MD5
8cda682be01540b8685ceb0b0b5a3620

SHA1
43d1cdb14be488a5bc9189785837ef5a8120607b

SHA256
92a5b33c5c15129f012fd767860a4620b3f47c01fddab77714c844047a4abf2c

SHA512
c187f6033fc90b2c4771bc707f8c67d60112532ec497d1442edb2067a67bec88ea9749d819a2d2c779c0d022dd08fdcc77f51a20a31abb7605c1ccedc03afa0b

Download Submit
C:\Windows\System\KhSnQQS.exe

Filesize
1.1MB

MD5
39beeb66f69cc3e63f2b85d0b8658b59

SHA1
98923448d7c3a8276e563d0c4fc82c896b6aa6dd

SHA256
d12983999d758ed11fa0928df8a366b91a7e9981ac7b98f632c49e3ce4348dbd

SHA512
7229bb150fdc91dc3249420e2d34081ec6e6e0a52d643df0be315b0b8e71ae70a65fa79b1b5d6f64361c35d881f7ce2e4204189f5c18d6e6ef4c65b4808530eb

Download Submit
C:\Windows\System\MmQmnFb.exe

Filesize
1.1MB

MD5
b16c1d46bb320c9c50ea4481f1aa6a72

SHA1
ea9bee3d8dab4bae0e52bcc5d2e73fbb808fc708

SHA256
beecc693599af15f193ddb43aeb75c2b5e245a0a9df9238cbff3c1b0820ab22b

SHA512
72304fe62cbaab048101168d64d8c6fb94f2a28ebc49b11ac072039874b40ac52a9e41f94f154e70bead50fa3388e118d5b4aef24f11f8465dd52e547a8c08bf

Download Submit
C:\Windows\System\OoBrFWA.exe

Filesize
1.1MB

MD5
5fba189d7203633fbafc48e719e847f1

SHA1
b08149fee010b8cc960c7e33bc617dd5ee259573

SHA256
5743bd2371e11af03ea4b3d9fd9898d759bfe48075cf235ee59b98c00fc820b6

SHA512
2bd9d6fa3af5c66359656731ddf9f4c46af33fe2cff2f95d73ce8d68f4e89b87652186c748103ebf0c774b4fc18f89587257c7f58f26a46366e864f1069172a0

Download Submit
C:\Windows\System\PjBTOzn.exe

Filesize
1.1MB

MD5
3b3b9548825d29886bc43f0d2ff2bb00

SHA1
1d0902c6cdf688e4404e213c589c8fe25122ddd6

SHA256
31ece62de73f6af541e2b0bd725877312121de76eb0d5249d0b9f77bcf9205bb

SHA512
a06f3902da1dc9f77d5251aff9ea71d018830055cfae739a2f2fe918a964b1dcdf9bc09179e2cd697214aa1462dc95b39061172d2860b0da73006b0bf92f53a3

Download Submit
C:\Windows\System\RigRnPI.exe

Filesize
1.1MB

MD5
ec0be5a9b3013e8a88139db174b7b8b1

SHA1
b99d0d48f196ddc6ada21f62d7d06aa4b35887b2

SHA256
b3685c2e6907ee06f8e7c7b78001cbaed37aad6787f434c1e8a728ff98abdc37

SHA512
dc9c349d61f283d158670d30cf4d4bfd2c8a9c5631fabed7a2b39384f2ce3e7e60ac06d2e1c984a2810c5ff4a9584590617b3026864ddbb850dbfe9e716dcaca

Download Submit
C:\Windows\System\SIVwANU.exe

Filesize
1.1MB

MD5
b36e8ccc9afcae25960a9715686a6aa4

SHA1
f8b2a9fbefe5b48f332dbd70e606f189ef3ef5d2

SHA256
3bd6d7d7dea8a3227240a8371874b073924cdd7b5343bf356fe425b46f8ebdcb

SHA512
9dc8222211db56586df0a64536332e806e9527a663fabb4071a9557ee4a4b5943c72727f3178f578bc3f2526a663a2ab360fbbca8f45f87adb0990ed0ff99450

Download Submit
C:\Windows\System\SPZCaWb.exe

Filesize
1.1MB

MD5
d5810ffb772b31d5a21971f53735d360

SHA1
607163b5423ee59e1727e40b3f8642a4ca2237aa

SHA256
b7815c5415f7b54896cdf90044681c297c518fccd511e8132a7b40123237bd62

SHA512
45be0794260d236860f172d5be744080f28a5fc181aa10cbfbb5e5619f5a91ac5fa9ae4a02a8fe2cd232b7a3b9ea0276bfc16aa9494871355a536bd3bcd7407a

Download Submit
C:\Windows\System\SrXUNpC.exe

Filesize
1.1MB

MD5
e2f2a316f81ddc5d69c4f186c78351eb

SHA1
9459c8138402361dda1b7db4c50e06ec816bbbe5

SHA256
508bc6709c0c6c5ce7fc032b48dae9d12871a2c3b13759314472aaf5aaf17f09

SHA512
8f9b142a2457029d96eca44c0f4147a0e493f981d88c303d3f99f6108ae64ee79755fa7db3e5e20f21b3fb54a885cf2c39e55152fa6541f8f6995a61617263d8

Download Submit
C:\Windows\System\UJiaqZd.exe

Filesize
1.1MB

MD5
56346663acb6d15002090f2b71075353

SHA1
970ad879f45f817acdcffa7255e1577a0edc9318

SHA256
744ed20c385fa054ad2ec874c204a1bbe79c4fc64e5aeed8d694b0a75ef64914

SHA512
260e21cbf7ab740c6d5d667604eed31d4b562a5cb4e0e4a1514202439ed02afdc32cf7b7ee07a908d197e3e657b3ba8e5b9ad4aabbeffb9ac489c91aede6fe05

Download Submit
C:\Windows\System\UUirGPY.exe

Filesize
1.1MB

MD5
a16c80edae9df63b2c7711cfbf9d4cf5

SHA1
e7b8760c077a389ebc7eeaa165f1782461b92962

SHA256
8207ef514d1b07d072295f79200e743aed85fc3825375a249e55eda86366b859

SHA512
f165c1a5a9e2ef2a4900f1dbbaa3410d9e1eb346630f482db8068a421e06a7146ca537fa95543473048b308067dca5956e5dd7d1792533aa00a19c68bd13fcd1

Download Submit
C:\Windows\System\VccQHXu.exe

Filesize
1.1MB

MD5
31f8e63110aad7f78447a4917fb360eb

SHA1
fcc984acd96aa3325deb21ae394014a96d33e0e5

SHA256
71dee5b3be6110281f7846f8246590a763505f1ef0039f14bf05ebe0ad7beac9

SHA512
0d62e2f61581c558534769557b0a084a3d38a96588a6ceba8fdbd62291ce7f73134bff669f66fb3603bf3df0ecfdf79c79d59511153582f418055db21a3fcd4c

Download Submit
C:\Windows\System\WnsGEHz.exe

Filesize
1.1MB

MD5
eabcd1b54f9d684f906d9d21eeda94ad

SHA1
2da9da31770a1b729390b99040f4cba4c75b3ddb

SHA256
4e8c40608f0001545407f6e1bf66e76e00cc7da15d7f9acc0130089bc212917c

SHA512
a34c2081fd51daad8fef53f2c9e85b1b8d059f896dea18ca1c2dd247a2435fc6f9f4c28d253b00a37913f8e40c2cd69c0432776e6d9b5213ccf3a0c3e7a1b8cd

Download Submit
C:\Windows\System\aeRiDRI.exe

Filesize
1.1MB

MD5
a6545f39c406f573d8c5d1825baea8c5

SHA1
935ee8e76875d42d13e15227c5f7be593a5386f2

SHA256
0915a5449ad5752aca40fcd59493f52e9ea9dd54e22e968627d18a8cfe287989

SHA512
8aa6e5dad972e5a0597eea96aeaabaabe600b16bd9ba27e1fa27751675c7221923169024df2ada1e455378e3104ab8e55c7b29a95b3ce87bd7ab5d2999c36988

Download Submit
C:\Windows\System\dihhJkM.exe

Filesize
1.1MB

MD5
91066d45ee84e26c997be7dc983b1911

SHA1
8fcf25d06c4c2585d82f63ab2a7fbb49c633e940

SHA256
bf8e6f5ba0c1e8dc1bbd7c814f9f7c0643270809c57ee7b12b94221fc8c9f6ba

SHA512
3e9af4fb6b217104f30a51dc8fd7d44feead8418264e27e03a85ba31f6d8c424c73097c828b83eea14a599bdf8cd286d9d9ba8363bc34b88a47e16b99c03443a

Download Submit
C:\Windows\System\hfuIpLw.exe

Filesize
1.1MB

MD5
7cefccffb053354d8e3fa8a35e63ecc0

SHA1
60fcde0eeafb680f509b10eb6a0522b51b2ff70f

SHA256
7e664a09e5e12e18452399433061e7b3e2efc4b8efeb5965ca9809db28c18798

SHA512
8d38059aac36b49d66a17002b2bf969154aac0172f0b466654dedfab2f9d266e6c575892ba3e0766b138969797b3e01f72d04ee3e3ccf77973a8f71c4e53f22d

Download Submit
C:\Windows\System\iSTSTsl.exe

Filesize
1.1MB

MD5
b32fbce1867e28df56fbcc78c380220e

SHA1
aa272e444f87dd6820bee89ea737415bf117db58

SHA256
17356951a6203fe746e1d91f55cd3a3cf10d1857e6a0265ff99b2e11692e7f99

SHA512
2da5f2b1bff20c88e85a59e59d630fd69b5cb010252110a98397c0c6b1df7cd3c37c75a5a212a09670c362a6f0d0c9ffdd6b2ea25fed4b531b8c9a74d18d51cb

Download Submit
C:\Windows\System\mRCRskp.exe

Filesize
1.1MB

MD5
a47bf568fa0cf23823ca2c60b7a93465

SHA1
9db15c431c40723e3c23719d212c011d3ace8fdb

SHA256
5516c7dac9e8b5d3300e13089714816cc321f2215e7e13d5ba286bcb731ebdea

SHA512
604ed7d27675cb867244282feb2d59571ba0788d6546878ba5e637f10314a76b4e0237876a4e6280e5e666f04f10b713bc3c89819b3f0c4f8fa358b2abc3ab8e

Download Submit
C:\Windows\System\nWYRKnb.exe

Filesize
1.1MB

MD5
f790fb60cc0cb81909b12b559c569180

SHA1
81da4aa60772d190d990c0807a16ca0620dc87c1

SHA256
fd5a19207dfc00f2899979437eae7aa2a26ed028e36a9b27fd9b223b39408f2b

SHA512
35e40594bdaac3809aa6128c6b469d57629c9eea19d4ad0f66d33e6881820846ab4aafaef15e163718fda5b769b37ac2f13f04ad148c2c0c1f92dd0cc71154d5

Download Submit
C:\Windows\System\pbFirVl.exe

Filesize
1.1MB

MD5
da66746efb0ac5d40ac7eb61081d6c89

SHA1
abea406ad940a5fdb19cbeee18dfd4616da3eb70

SHA256
ae835eda53a6a2e9d858ac152951702d7a53227a6326519eae63770bf213cdec

SHA512
a8253fb367c319134f45e175c1c4126372a74cea30550ed69bbeb0c86ac3009fb828d7d532ae0b745df6e21abdf61464acb17b79f336972854c6f4e6375a0924

Download Submit
C:\Windows\System\rMRnrLp.exe

Filesize
1.1MB

MD5
b7bf9d534645e8c9ff7ebe8a8b002736

SHA1
4070f3da54b73a7da8b82926446bc49db5218e06

SHA256
3ac0730259af9af37da835de1926def0b32f80205eaa074d213a639161a51a02

SHA512
45cca0ff104aa147d2170869bd16edcc718dc3f828f652e453693abd4c6281f88adfc2ced0a01f431df09414f21ce2c8e97ea104244cb5baa01f7ae40b804818

Download Submit
C:\Windows\System\rPVEsDJ.exe

Filesize
1.1MB

MD5
d0d73df516255dec9d45e9a3056a937f

SHA1
38cd787cb0a4968618c5daaa4cfdbade1eec605a

SHA256
bc9baf130a530124d4b131bf4cea31ce436e56d99ddd67e110993db2496f50d4

SHA512
26d3516e569858abd0a2d3667b921579618c71b53a7b7ebc7972fdc43c41aa9deecd309136a120f3545b5710d1e1a03e0b2c8707c4dee2e01c6252bb80224564

Download Submit
C:\Windows\System\sByoTjA.exe

Filesize
1.1MB

MD5
724a7747ca5334a879c8656447654dae

SHA1
423acf1ce17c97bc45ec65284efb59bc6d3e11a2

SHA256
a1f78545f923fd2a95c31f2ccef7947dfe90a6ee61105b9681f38ab22dc8ed2a

SHA512
53cb8245e96ae6fbcf8fa6fe192cd5037f9674737f1c879c496364cd3f6e8b809f9db281a495753dab8035d73fcdd785c07f92741132708e369aa21f1cc5869b

Download Submit
C:\Windows\System\vHQROwi.exe

Filesize
1.1MB

MD5
505f694df6602393c28f56d018be5b5a

SHA1
315273ee8cef4cddbf33f5db1af685b983aa16dd

SHA256
02c8b3008ab9bef0f47491126e3d79eecf4224ceb0e6e6a6e5d5d8157c93e479

SHA512
5c0f1b46a98212197afca27398a17afec10e26f14d9dabdb4322da1d7fc4b52e91f998fbf31117116ef99f0ca3d530967ae32e271f26279fde701e5a025c25b8

Download Submit
C:\Windows\System\yExZBPN.exe

Filesize
1.1MB

MD5
6e8216a02d6d7504b24e324325031c30

SHA1
7ad5cd6bd0ffdd2f04bb0d5b018669d97ff67646

SHA256
ae926a4098e468bc10552cad850eba05a3c48c5c0fcc95d3fcc17c7d56677274

SHA512
dbe6fb03919c5799a684413fceb3d15aa9c5c8631443a7bc6dec1f33b53f455fac961aae55d4b122f53806f59cbb9001bb444472272491d67f2daf9f8eadd0cb

Download Submit
C:\Windows\System\yLgaUjA.exe

Filesize
1.1MB

MD5
2f5fadb496065ab1963556f7e493f04e

SHA1
d31ba1c687ed3ee412b2cc13a9c3187c758ab736

SHA256
ea9c20489ab1f7b8d9577d038ce28784b6a044587e6ecf3c3b062ecb4680de4e

SHA512
48272a6592746a440bb7a89f754a7a6cd2132fd09411e8bd8d9f5da49a8b046b090a63708e0f98a518ed147659e61e512241c0d2f0d7a60885bccc48510eabd7

Download Submit
C:\Windows\System\ySSGyGI.exe

Filesize
1.1MB

MD5
9b27b72352715ec5be3b96e92f37ff43

SHA1
b49c21ae4a0219ca1a26dab17c47c9858b931591

SHA256
a2391fa4ded6ea8eb4f85c7839e3ddb4520835126e9eac2b86c46e7cb03f8bca

SHA512
56318c5e456261b451c371af49eadad0d0245f5b2d55b16c79e6c0e869354d0e74ff3690fb7abad261837432034006713688d96674fc2d41a71f8a9a76f65710

Download Submit
memory/4176-0-0x000001CB6B0B0000-0x000001CB6B0C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads