xmrig | 9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
Size

1.3MB
MD5

f561a5a7b081bb4e04988f541296ed25
SHA1

472ce9e1595148a09a624b6e838671079fe602f7
SHA256

9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997
SHA512

bf54ca2b835839ed33964c6a20eba96886fcf37de7349fe355f8d0ea603d37d05a3843d240a0d25e1954df5c7f3e15f74d25f3fa5e80d98e9986e5c8c87530ea
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BcYC8qKswr+WvmC:GezaTF8FcNkNdfE0pZ9ozttwIRakG37R

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b8f-4.dat	xmrig
behavioral2/files/0x000a000000023c7e-9.dat	xmrig
behavioral2/files/0x0007000000023c86-13.dat	xmrig
behavioral2/files/0x0007000000023c89-35.dat	xmrig
behavioral2/files/0x0007000000023c8a-45.dat	xmrig
behavioral2/files/0x0007000000023c8c-58.dat	xmrig
behavioral2/files/0x0007000000023c92-65.dat	xmrig
behavioral2/files/0x0007000000023c95-94.dat	xmrig
behavioral2/files/0x0007000000023c97-100.dat	xmrig
behavioral2/files/0x0007000000023c96-98.dat	xmrig
behavioral2/files/0x0007000000023c94-96.dat	xmrig
behavioral2/files/0x0007000000023c93-92.dat	xmrig
behavioral2/files/0x0007000000023c91-88.dat	xmrig
behavioral2/files/0x0007000000023c90-82.dat	xmrig
behavioral2/files/0x0007000000023c8f-79.dat	xmrig
behavioral2/files/0x0007000000023c8e-76.dat	xmrig
behavioral2/files/0x0007000000023c8d-70.dat	xmrig
behavioral2/files/0x0007000000023c8b-51.dat	xmrig
behavioral2/files/0x0007000000023c88-29.dat	xmrig
behavioral2/files/0x0007000000023c87-25.dat	xmrig
behavioral2/files/0x0007000000023c98-104.dat	xmrig
behavioral2/files/0x0007000000023c9b-108.dat	xmrig
behavioral2/files/0x0009000000023c7f-116.dat	xmrig
behavioral2/files/0x0007000000023ca1-139.dat	xmrig
behavioral2/files/0x0007000000023ca4-164.dat	xmrig
behavioral2/files/0x0007000000023ca3-162.dat	xmrig
behavioral2/files/0x0007000000023c9f-158.dat	xmrig
behavioral2/files/0x0007000000023ca0-152.dat	xmrig
behavioral2/files/0x0007000000023ca5-159.dat	xmrig
behavioral2/files/0x0007000000023ca2-147.dat	xmrig
behavioral2/files/0x0007000000023c9e-137.dat	xmrig
behavioral2/files/0x0007000000023c9d-130.dat	xmrig
behavioral2/files/0x0007000000023c9c-126.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3288	GiqKqQV.exe
3336	TzxtqWc.exe
2384	RNXajOf.exe
3648	KLcBMbI.exe
1664	sTkkWot.exe
1260	vIIBKqf.exe
3660	FdEjWOD.exe
1944	otkNWNY.exe
2832	nUmXhik.exe
4872	LKNZIrh.exe
3520	JAgdnRo.exe
540	tMTbiNX.exe
2240	BpuqyRR.exe
924	DnWHifP.exe
1864	gCcimyW.exe
4644	rUFqBdL.exe
3116	fMjaYZN.exe
2908	QRMvFLP.exe
4980	uAOtySs.exe
2944	wLwucqi.exe
4476	rKWcjIC.exe
2952	GgfPHOW.exe
2464	NPBwTqP.exe
4804	YCIPWxR.exe
1552	LrdfqXS.exe
3668	AXizBOU.exe
4708	UnJPQfs.exe
4136	WZaVAhX.exe
2904	hqQuwIv.exe
2288	afWZgOf.exe
5064	arCYEPM.exe
4284	Nejozvt.exe
216	zZlAshB.exe
2388	kdvbgvh.exe
728	VsJalsb.exe
3260	gWRJmGc.exe
2612	nbkwizi.exe
1480	WaBwzqy.exe
1752	mcwGmaX.exe
1820	amokBnB.exe
4316	KoRsEaH.exe
1780	dCniTYV.exe
1572	NlfiRQi.exe
1824	OtrwlLQ.exe
4128	lKfRTDk.exe
2256	ADqOTww.exe
4904	dMqkzvF.exe
2416	CFXRKAY.exe
4900	WzKCSwc.exe
4928	ClaCeTT.exe
4364	DxBMlQK.exe
2400	RYeegbb.exe
1168	xMjxnBl.exe
4616	vCCeRNQ.exe
748	fFsQebR.exe
4508	ayTlFRL.exe
536	VEjcwUc.exe
1096	Utuupbu.exe
1860	xVgQxvi.exe
3308	HZuyoLw.exe
1720	GsVfrha.exe
1964	wgfnINa.exe
4412	NVnMGuL.exe
720	SEhgEBf.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vMbxNMD.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\vnOWCZy.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\VTgnSjn.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\SjbSLDi.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\XdPsHsR.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\ElLaTyn.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\NIvpstm.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\hROmmLw.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\zxlShTD.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\hHwuuug.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\cPPvKId.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\pTCJNis.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\YTZBshK.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\YCIPWxR.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\VXhAeSj.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\CVXCPUg.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\aVSugpq.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\fjjRpyc.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\WpntfTN.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\qVqWsiF.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\FBCuSnA.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\GaUjVUD.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\UMyCDnJ.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\lhIJGFv.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\uWtTeoC.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\fEJNOaQ.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\avBoqJH.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\KVpMKhb.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\elnqBZr.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\uTutOFV.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\JzJEVzh.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\yCJjBsu.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\VEjcwUc.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\QCshBNL.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\PlmUEaU.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\GgfPHOW.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\HtATzDD.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\VHOEYaW.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\ysqPtrk.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\vFwJZkJ.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\MKQYBsI.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\OZQneRi.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\ZGcAErI.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\gSXwaUT.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\BpuqyRR.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\dMqkzvF.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\LVsfPRQ.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\wLwucqi.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\AClQNNr.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\RRxwxZj.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\JAgdnRo.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\YMFsIhW.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\TPAnrHZ.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\zTsVMGg.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\UnJPQfs.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\NPyeNtj.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\KaNHSyn.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\VYFPVzj.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\RLJTrQV.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\piJCIFz.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\yqmGVYS.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\bmVotXM.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\fWoDxZP.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
File created	C:\Windows\System\XAxsGTF.exe	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3288	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	86
PID 2796 wrote to memory of 3288	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	86
PID 2796 wrote to memory of 3336	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	87
PID 2796 wrote to memory of 3336	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	87
PID 2796 wrote to memory of 2384	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	88
PID 2796 wrote to memory of 2384	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	88
PID 2796 wrote to memory of 3648	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	89
PID 2796 wrote to memory of 3648	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	89
PID 2796 wrote to memory of 1664	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	90
PID 2796 wrote to memory of 1664	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	90
PID 2796 wrote to memory of 1260	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	91
PID 2796 wrote to memory of 1260	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	91
PID 2796 wrote to memory of 3660	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	92
PID 2796 wrote to memory of 3660	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	92
PID 2796 wrote to memory of 1944	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	93
PID 2796 wrote to memory of 1944	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	93
PID 2796 wrote to memory of 2832	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	94
PID 2796 wrote to memory of 2832	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	94
PID 2796 wrote to memory of 4872	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	95
PID 2796 wrote to memory of 4872	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	95
PID 2796 wrote to memory of 3520	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	96
PID 2796 wrote to memory of 3520	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	96
PID 2796 wrote to memory of 540	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	97
PID 2796 wrote to memory of 540	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	97
PID 2796 wrote to memory of 2240	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	98
PID 2796 wrote to memory of 2240	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	98
PID 2796 wrote to memory of 924	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	99
PID 2796 wrote to memory of 924	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	99
PID 2796 wrote to memory of 1864	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	100
PID 2796 wrote to memory of 1864	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	100
PID 2796 wrote to memory of 4644	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	101
PID 2796 wrote to memory of 4644	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	101
PID 2796 wrote to memory of 3116	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	102
PID 2796 wrote to memory of 3116	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	102
PID 2796 wrote to memory of 2908	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	103
PID 2796 wrote to memory of 2908	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	103
PID 2796 wrote to memory of 4980	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	104
PID 2796 wrote to memory of 4980	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	104
PID 2796 wrote to memory of 2944	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	105
PID 2796 wrote to memory of 2944	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	105
PID 2796 wrote to memory of 4476	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	106
PID 2796 wrote to memory of 4476	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	106
PID 2796 wrote to memory of 2952	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	107
PID 2796 wrote to memory of 2952	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	107
PID 2796 wrote to memory of 2464	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	108
PID 2796 wrote to memory of 2464	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	108
PID 2796 wrote to memory of 4804	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	109
PID 2796 wrote to memory of 4804	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	109
PID 2796 wrote to memory of 1552	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	110
PID 2796 wrote to memory of 1552	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	110
PID 2796 wrote to memory of 3668	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	111
PID 2796 wrote to memory of 3668	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	111
PID 2796 wrote to memory of 4708	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	112
PID 2796 wrote to memory of 4708	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	112
PID 2796 wrote to memory of 4136	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	113
PID 2796 wrote to memory of 4136	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	113
PID 2796 wrote to memory of 2904	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	114
PID 2796 wrote to memory of 2904	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	114
PID 2796 wrote to memory of 2288	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	115
PID 2796 wrote to memory of 2288	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	115
PID 2796 wrote to memory of 5064	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	116
PID 2796 wrote to memory of 5064	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	116
PID 2796 wrote to memory of 4284	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	117
PID 2796 wrote to memory of 4284	2796	9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe	117

C:\Users\Admin\AppData\Local\Temp\9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe
"C:\Users\Admin\AppData\Local\Temp\9da42fe8dc5fc008c7925709e4dacf5ba16b1123fb75b69b5fc6fe918f919997.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\System\GiqKqQV.exe
  C:\Windows\System\GiqKqQV.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\TzxtqWc.exe
  C:\Windows\System\TzxtqWc.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\RNXajOf.exe
  C:\Windows\System\RNXajOf.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\KLcBMbI.exe
  C:\Windows\System\KLcBMbI.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\sTkkWot.exe
  C:\Windows\System\sTkkWot.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\vIIBKqf.exe
  C:\Windows\System\vIIBKqf.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\FdEjWOD.exe
  C:\Windows\System\FdEjWOD.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\otkNWNY.exe
  C:\Windows\System\otkNWNY.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\nUmXhik.exe
  C:\Windows\System\nUmXhik.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\LKNZIrh.exe
  C:\Windows\System\LKNZIrh.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\JAgdnRo.exe
  C:\Windows\System\JAgdnRo.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\tMTbiNX.exe
  C:\Windows\System\tMTbiNX.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\BpuqyRR.exe
  C:\Windows\System\BpuqyRR.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\DnWHifP.exe
  C:\Windows\System\DnWHifP.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\gCcimyW.exe
  C:\Windows\System\gCcimyW.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\rUFqBdL.exe
  C:\Windows\System\rUFqBdL.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\fMjaYZN.exe
  C:\Windows\System\fMjaYZN.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\QRMvFLP.exe
  C:\Windows\System\QRMvFLP.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\uAOtySs.exe
  C:\Windows\System\uAOtySs.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\wLwucqi.exe
  C:\Windows\System\wLwucqi.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\rKWcjIC.exe
  C:\Windows\System\rKWcjIC.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\GgfPHOW.exe
  C:\Windows\System\GgfPHOW.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\NPBwTqP.exe
  C:\Windows\System\NPBwTqP.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\YCIPWxR.exe
  C:\Windows\System\YCIPWxR.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\LrdfqXS.exe
  C:\Windows\System\LrdfqXS.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\AXizBOU.exe
  C:\Windows\System\AXizBOU.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\UnJPQfs.exe
  C:\Windows\System\UnJPQfs.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\WZaVAhX.exe
  C:\Windows\System\WZaVAhX.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\hqQuwIv.exe
  C:\Windows\System\hqQuwIv.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\afWZgOf.exe
  C:\Windows\System\afWZgOf.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\arCYEPM.exe
  C:\Windows\System\arCYEPM.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\Nejozvt.exe
  C:\Windows\System\Nejozvt.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\zZlAshB.exe
  C:\Windows\System\zZlAshB.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\kdvbgvh.exe
  C:\Windows\System\kdvbgvh.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\VsJalsb.exe
  C:\Windows\System\VsJalsb.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\gWRJmGc.exe
  C:\Windows\System\gWRJmGc.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\nbkwizi.exe
  C:\Windows\System\nbkwizi.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\dCniTYV.exe
  C:\Windows\System\dCniTYV.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\WaBwzqy.exe
  C:\Windows\System\WaBwzqy.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\mcwGmaX.exe
  C:\Windows\System\mcwGmaX.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\amokBnB.exe
  C:\Windows\System\amokBnB.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\KoRsEaH.exe
  C:\Windows\System\KoRsEaH.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\NlfiRQi.exe
  C:\Windows\System\NlfiRQi.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\OtrwlLQ.exe
  C:\Windows\System\OtrwlLQ.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\lKfRTDk.exe
  C:\Windows\System\lKfRTDk.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\ADqOTww.exe
  C:\Windows\System\ADqOTww.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\dMqkzvF.exe
  C:\Windows\System\dMqkzvF.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\CFXRKAY.exe
  C:\Windows\System\CFXRKAY.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\WzKCSwc.exe
  C:\Windows\System\WzKCSwc.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\ClaCeTT.exe
  C:\Windows\System\ClaCeTT.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\DxBMlQK.exe
  C:\Windows\System\DxBMlQK.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\RYeegbb.exe
  C:\Windows\System\RYeegbb.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\xMjxnBl.exe
  C:\Windows\System\xMjxnBl.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\vCCeRNQ.exe
  C:\Windows\System\vCCeRNQ.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\fFsQebR.exe
  C:\Windows\System\fFsQebR.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\ayTlFRL.exe
  C:\Windows\System\ayTlFRL.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\VEjcwUc.exe
  C:\Windows\System\VEjcwUc.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\Utuupbu.exe
  C:\Windows\System\Utuupbu.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\xVgQxvi.exe
  C:\Windows\System\xVgQxvi.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\HZuyoLw.exe
  C:\Windows\System\HZuyoLw.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\GsVfrha.exe
  C:\Windows\System\GsVfrha.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\wgfnINa.exe
  C:\Windows\System\wgfnINa.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\NVnMGuL.exe
  C:\Windows\System\NVnMGuL.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\SEhgEBf.exe
  C:\Windows\System\SEhgEBf.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\SOIsYXV.exe
  C:\Windows\System\SOIsYXV.exe
  2⤵
  PID:100
- C:\Windows\System\bDeFFLO.exe
  C:\Windows\System\bDeFFLO.exe
  2⤵
  PID:2824
- C:\Windows\System\KvzCSVd.exe
  C:\Windows\System\KvzCSVd.exe
  2⤵
  PID:2776
- C:\Windows\System\ZbtsTpE.exe
  C:\Windows\System\ZbtsTpE.exe
  2⤵
  PID:3656
- C:\Windows\System\EbrbInL.exe
  C:\Windows\System\EbrbInL.exe
  2⤵
  PID:4808
- C:\Windows\System\JCZteqf.exe
  C:\Windows\System\JCZteqf.exe
  2⤵
  PID:368
- C:\Windows\System\JoAdcAt.exe
  C:\Windows\System\JoAdcAt.exe
  2⤵
  PID:3992
- C:\Windows\System\zURsPwF.exe
  C:\Windows\System\zURsPwF.exe
  2⤵
  PID:2544
- C:\Windows\System\kfLAVeE.exe
  C:\Windows\System\kfLAVeE.exe
  2⤵
  PID:4448
- C:\Windows\System\xDJPsqS.exe
  C:\Windows\System\xDJPsqS.exe
  2⤵
  PID:1620
- C:\Windows\System\KSJKUBT.exe
  C:\Windows\System\KSJKUBT.exe
  2⤵
  PID:1272
- C:\Windows\System\xHZddgY.exe
  C:\Windows\System\xHZddgY.exe
  2⤵
  PID:940
- C:\Windows\System\szVJOQA.exe
  C:\Windows\System\szVJOQA.exe
  2⤵
  PID:3436
- C:\Windows\System\ImmwHja.exe
  C:\Windows\System\ImmwHja.exe
  2⤵
  PID:4272
- C:\Windows\System\yNBtZnq.exe
  C:\Windows\System\yNBtZnq.exe
  2⤵
  PID:3244
- C:\Windows\System\kMidqrS.exe
  C:\Windows\System\kMidqrS.exe
  2⤵
  PID:2408
- C:\Windows\System\mymWhRK.exe
  C:\Windows\System\mymWhRK.exe
  2⤵
  PID:4700
- C:\Windows\System\UKaDUoO.exe
  C:\Windows\System\UKaDUoO.exe
  2⤵
  PID:2696
- C:\Windows\System\oZWcMrm.exe
  C:\Windows\System\oZWcMrm.exe
  2⤵
  PID:5092
- C:\Windows\System\vgAKJne.exe
  C:\Windows\System\vgAKJne.exe
  2⤵
  PID:3348
- C:\Windows\System\WmRvgJx.exe
  C:\Windows\System\WmRvgJx.exe
  2⤵
  PID:4864
- C:\Windows\System\jsJZbHI.exe
  C:\Windows\System\jsJZbHI.exe
  2⤵
  PID:864
- C:\Windows\System\tJSOVmr.exe
  C:\Windows\System\tJSOVmr.exe
  2⤵
  PID:2844
- C:\Windows\System\WSuPbcn.exe
  C:\Windows\System\WSuPbcn.exe
  2⤵
  PID:2644
- C:\Windows\System\YlDDzlc.exe
  C:\Windows\System\YlDDzlc.exe
  2⤵
  PID:3840
- C:\Windows\System\XKxoKCk.exe
  C:\Windows\System\XKxoKCk.exe
  2⤵
  PID:4060
- C:\Windows\System\xnIPfjJ.exe
  C:\Windows\System\xnIPfjJ.exe
  2⤵
  PID:2816
- C:\Windows\System\bfOzgZi.exe
  C:\Windows\System\bfOzgZi.exe
  2⤵
  PID:4360
- C:\Windows\System\URTrvGH.exe
  C:\Windows\System\URTrvGH.exe
  2⤵
  PID:2428
- C:\Windows\System\kZHKKbo.exe
  C:\Windows\System\kZHKKbo.exe
  2⤵
  PID:2812
- C:\Windows\System\zNHNXht.exe
  C:\Windows\System\zNHNXht.exe
  2⤵
  PID:4480
- C:\Windows\System\AKXfcIt.exe
  C:\Windows\System\AKXfcIt.exe
  2⤵
  PID:2856
- C:\Windows\System\MtKZnUe.exe
  C:\Windows\System\MtKZnUe.exe
  2⤵
  PID:4012
- C:\Windows\System\hpRrOJj.exe
  C:\Windows\System\hpRrOJj.exe
  2⤵
  PID:3980
- C:\Windows\System\XKlmnsm.exe
  C:\Windows\System\XKlmnsm.exe
  2⤵
  PID:2112
- C:\Windows\System\blJYalZ.exe
  C:\Windows\System\blJYalZ.exe
  2⤵
  PID:3500
- C:\Windows\System\HZlNoQE.exe
  C:\Windows\System\HZlNoQE.exe
  2⤵
  PID:3184
- C:\Windows\System\rbrZYgi.exe
  C:\Windows\System\rbrZYgi.exe
  2⤵
  PID:768
- C:\Windows\System\MWaDYCX.exe
  C:\Windows\System\MWaDYCX.exe
  2⤵
  PID:3664
- C:\Windows\System\yaZFWug.exe
  C:\Windows\System\yaZFWug.exe
  2⤵
  PID:4344
- C:\Windows\System\NPyeNtj.exe
  C:\Windows\System\NPyeNtj.exe
  2⤵
  PID:4588
- C:\Windows\System\wafcBEL.exe
  C:\Windows\System\wafcBEL.exe
  2⤵
  PID:1396
- C:\Windows\System\hROmmLw.exe
  C:\Windows\System\hROmmLw.exe
  2⤵
  PID:1920
- C:\Windows\System\lhFHfgA.exe
  C:\Windows\System\lhFHfgA.exe
  2⤵
  PID:1652
- C:\Windows\System\aZyeUDw.exe
  C:\Windows\System\aZyeUDw.exe
  2⤵
  PID:4008
- C:\Windows\System\XIyxjqZ.exe
  C:\Windows\System\XIyxjqZ.exe
  2⤵
  PID:1604
- C:\Windows\System\DSpSzEc.exe
  C:\Windows\System\DSpSzEc.exe
  2⤵
  PID:2512
- C:\Windows\System\uYpGQhS.exe
  C:\Windows\System\uYpGQhS.exe
  2⤵
  PID:1412
- C:\Windows\System\GNDWlxi.exe
  C:\Windows\System\GNDWlxi.exe
  2⤵
  PID:5144
- C:\Windows\System\iqwHwZv.exe
  C:\Windows\System\iqwHwZv.exe
  2⤵
  PID:5168
- C:\Windows\System\bHMLsKE.exe
  C:\Windows\System\bHMLsKE.exe
  2⤵
  PID:5196
- C:\Windows\System\dXUmmVT.exe
  C:\Windows\System\dXUmmVT.exe
  2⤵
  PID:5224
- C:\Windows\System\fWoDxZP.exe
  C:\Windows\System\fWoDxZP.exe
  2⤵
  PID:5260
- C:\Windows\System\kNuUpfZ.exe
  C:\Windows\System\kNuUpfZ.exe
  2⤵
  PID:5288
- C:\Windows\System\pkRekWz.exe
  C:\Windows\System\pkRekWz.exe
  2⤵
  PID:5308
- C:\Windows\System\CKhClpS.exe
  C:\Windows\System\CKhClpS.exe
  2⤵
  PID:5340
- C:\Windows\System\wHifUwT.exe
  C:\Windows\System\wHifUwT.exe
  2⤵
  PID:5364
- C:\Windows\System\jpakqeZ.exe
  C:\Windows\System\jpakqeZ.exe
  2⤵
  PID:5392
- C:\Windows\System\antnEzO.exe
  C:\Windows\System\antnEzO.exe
  2⤵
  PID:5420
- C:\Windows\System\qwiyDBW.exe
  C:\Windows\System\qwiyDBW.exe
  2⤵
  PID:5456
- C:\Windows\System\qMsdxEP.exe
  C:\Windows\System\qMsdxEP.exe
  2⤵
  PID:5476
- C:\Windows\System\UMlKBdd.exe
  C:\Windows\System\UMlKBdd.exe
  2⤵
  PID:5504
- C:\Windows\System\ySzhuAL.exe
  C:\Windows\System\ySzhuAL.exe
  2⤵
  PID:5532
- C:\Windows\System\BDrphhu.exe
  C:\Windows\System\BDrphhu.exe
  2⤵
  PID:5560
- C:\Windows\System\vUUVYGm.exe
  C:\Windows\System\vUUVYGm.exe
  2⤵
  PID:5588
- C:\Windows\System\WcTJNuV.exe
  C:\Windows\System\WcTJNuV.exe
  2⤵
  PID:5616
- C:\Windows\System\eZvHyKQ.exe
  C:\Windows\System\eZvHyKQ.exe
  2⤵
  PID:5648
- C:\Windows\System\UVszcUp.exe
  C:\Windows\System\UVszcUp.exe
  2⤵
  PID:5672
- C:\Windows\System\PfSTjzQ.exe
  C:\Windows\System\PfSTjzQ.exe
  2⤵
  PID:5700
- C:\Windows\System\DNETces.exe
  C:\Windows\System\DNETces.exe
  2⤵
  PID:5724
- C:\Windows\System\lgZCxvj.exe
  C:\Windows\System\lgZCxvj.exe
  2⤵
  PID:5752
- C:\Windows\System\pHHEtFb.exe
  C:\Windows\System\pHHEtFb.exe
  2⤵
  PID:5784
- C:\Windows\System\xQGYwRn.exe
  C:\Windows\System\xQGYwRn.exe
  2⤵
  PID:5812
- C:\Windows\System\qvOaNLB.exe
  C:\Windows\System\qvOaNLB.exe
  2⤵
  PID:5848
- C:\Windows\System\NUepHvM.exe
  C:\Windows\System\NUepHvM.exe
  2⤵
  PID:5868
- C:\Windows\System\yLsGfmy.exe
  C:\Windows\System\yLsGfmy.exe
  2⤵
  PID:5908
- C:\Windows\System\uOLyahw.exe
  C:\Windows\System\uOLyahw.exe
  2⤵
  PID:5924
- C:\Windows\System\uQTlfiV.exe
  C:\Windows\System\uQTlfiV.exe
  2⤵
  PID:5952
- C:\Windows\System\cPPvKId.exe
  C:\Windows\System\cPPvKId.exe
  2⤵
  PID:5968
- C:\Windows\System\UdatpLz.exe
  C:\Windows\System\UdatpLz.exe
  2⤵
  PID:5996
- C:\Windows\System\ivqqFaM.exe
  C:\Windows\System\ivqqFaM.exe
  2⤵
  PID:6028
- C:\Windows\System\yjgtNfb.exe
  C:\Windows\System\yjgtNfb.exe
  2⤵
  PID:6064
- C:\Windows\System\tusIill.exe
  C:\Windows\System\tusIill.exe
  2⤵
  PID:6092
- C:\Windows\System\ICpqwFx.exe
  C:\Windows\System\ICpqwFx.exe
  2⤵
  PID:6120
- C:\Windows\System\PqYbOxm.exe
  C:\Windows\System\PqYbOxm.exe
  2⤵
  PID:4960
- C:\Windows\System\hitiZYV.exe
  C:\Windows\System\hitiZYV.exe
  2⤵
  PID:5180
- C:\Windows\System\hxJaWLL.exe
  C:\Windows\System\hxJaWLL.exe
  2⤵
  PID:5220
- C:\Windows\System\omUZSMK.exe
  C:\Windows\System\omUZSMK.exe
  2⤵
  PID:5268
- C:\Windows\System\VKIbPiC.exe
  C:\Windows\System\VKIbPiC.exe
  2⤵
  PID:5356
- C:\Windows\System\gALxobx.exe
  C:\Windows\System\gALxobx.exe
  2⤵
  PID:5432
- C:\Windows\System\Fnigyas.exe
  C:\Windows\System\Fnigyas.exe
  2⤵
  PID:5492
- C:\Windows\System\ojmgiyW.exe
  C:\Windows\System\ojmgiyW.exe
  2⤵
  PID:5576
- C:\Windows\System\WpntfTN.exe
  C:\Windows\System\WpntfTN.exe
  2⤵
  PID:5664
- C:\Windows\System\qTdHmNx.exe
  C:\Windows\System\qTdHmNx.exe
  2⤵
  PID:5716
- C:\Windows\System\kdWiDHR.exe
  C:\Windows\System\kdWiDHR.exe
  2⤵
  PID:5796
- C:\Windows\System\bjzrZfG.exe
  C:\Windows\System\bjzrZfG.exe
  2⤵
  PID:5860
- C:\Windows\System\BateBwa.exe
  C:\Windows\System\BateBwa.exe
  2⤵
  PID:5936
- C:\Windows\System\xiNUIOX.exe
  C:\Windows\System\xiNUIOX.exe
  2⤵
  PID:5992
- C:\Windows\System\jRRERSL.exe
  C:\Windows\System\jRRERSL.exe
  2⤵
  PID:6036
- C:\Windows\System\CKezNgV.exe
  C:\Windows\System\CKezNgV.exe
  2⤵
  PID:6104
- C:\Windows\System\JvKwjcP.exe
  C:\Windows\System\JvKwjcP.exe
  2⤵
  PID:5248
- C:\Windows\System\CptXvsW.exe
  C:\Windows\System\CptXvsW.exe
  2⤵
  PID:5244
- C:\Windows\System\SPkBwPH.exe
  C:\Windows\System\SPkBwPH.exe
  2⤵
  PID:5348
- C:\Windows\System\dFeJSgf.exe
  C:\Windows\System\dFeJSgf.exe
  2⤵
  PID:5628
- C:\Windows\System\YFSInXZ.exe
  C:\Windows\System\YFSInXZ.exe
  2⤵
  PID:5692
- C:\Windows\System\cBFpiAo.exe
  C:\Windows\System\cBFpiAo.exe
  2⤵
  PID:5828
- C:\Windows\System\YlgXlIr.exe
  C:\Windows\System\YlgXlIr.exe
  2⤵
  PID:5980
- C:\Windows\System\UHqWgEf.exe
  C:\Windows\System\UHqWgEf.exe
  2⤵
  PID:6088
- C:\Windows\System\xLMzyRF.exe
  C:\Windows\System\xLMzyRF.exe
  2⤵
  PID:5216
- C:\Windows\System\oGYbvQx.exe
  C:\Windows\System\oGYbvQx.exe
  2⤵
  PID:5376
- C:\Windows\System\anWLRtD.exe
  C:\Windows\System\anWLRtD.exe
  2⤵
  PID:5984
- C:\Windows\System\VKvEaVy.exe
  C:\Windows\System\VKvEaVy.exe
  2⤵
  PID:6160
- C:\Windows\System\OtupKJj.exe
  C:\Windows\System\OtupKJj.exe
  2⤵
  PID:6188
- C:\Windows\System\uTutOFV.exe
  C:\Windows\System\uTutOFV.exe
  2⤵
  PID:6220
- C:\Windows\System\pATwhFo.exe
  C:\Windows\System\pATwhFo.exe
  2⤵
  PID:6252
- C:\Windows\System\uBkBWMu.exe
  C:\Windows\System\uBkBWMu.exe
  2⤵
  PID:6276
- C:\Windows\System\cwBOrYv.exe
  C:\Windows\System\cwBOrYv.exe
  2⤵
  PID:6308
- C:\Windows\System\eudcFgX.exe
  C:\Windows\System\eudcFgX.exe
  2⤵
  PID:6336
- C:\Windows\System\spxkpJF.exe
  C:\Windows\System\spxkpJF.exe
  2⤵
  PID:6364
- C:\Windows\System\cCnzOGO.exe
  C:\Windows\System\cCnzOGO.exe
  2⤵
  PID:6404
- C:\Windows\System\YdfkDUb.exe
  C:\Windows\System\YdfkDUb.exe
  2⤵
  PID:6424
- C:\Windows\System\UWaEhOp.exe
  C:\Windows\System\UWaEhOp.exe
  2⤵
  PID:6452
- C:\Windows\System\ZBxSQQQ.exe
  C:\Windows\System\ZBxSQQQ.exe
  2⤵
  PID:6472
- C:\Windows\System\xtXJpMD.exe
  C:\Windows\System\xtXJpMD.exe
  2⤵
  PID:6492
- C:\Windows\System\NEgTDyd.exe
  C:\Windows\System\NEgTDyd.exe
  2⤵
  PID:6516
- C:\Windows\System\UWYQNgL.exe
  C:\Windows\System\UWYQNgL.exe
  2⤵
  PID:6548
- C:\Windows\System\AdcZYCz.exe
  C:\Windows\System\AdcZYCz.exe
  2⤵
  PID:6572
- C:\Windows\System\eRRUbuC.exe
  C:\Windows\System\eRRUbuC.exe
  2⤵
  PID:6608
- C:\Windows\System\VdJpTmy.exe
  C:\Windows\System\VdJpTmy.exe
  2⤵
  PID:6632
- C:\Windows\System\rUQDOUS.exe
  C:\Windows\System\rUQDOUS.exe
  2⤵
  PID:6664
- C:\Windows\System\UMjZbFF.exe
  C:\Windows\System\UMjZbFF.exe
  2⤵
  PID:6692
- C:\Windows\System\vFwJZkJ.exe
  C:\Windows\System\vFwJZkJ.exe
  2⤵
  PID:6724
- C:\Windows\System\AHlkSmO.exe
  C:\Windows\System\AHlkSmO.exe
  2⤵
  PID:6760
- C:\Windows\System\frVRJvM.exe
  C:\Windows\System\frVRJvM.exe
  2⤵
  PID:6776
- C:\Windows\System\JLoZYid.exe
  C:\Windows\System\JLoZYid.exe
  2⤵
  PID:6804
- C:\Windows\System\tavZUoC.exe
  C:\Windows\System\tavZUoC.exe
  2⤵
  PID:6840
- C:\Windows\System\aYeHShr.exe
  C:\Windows\System\aYeHShr.exe
  2⤵
  PID:6856
- C:\Windows\System\KQBavup.exe
  C:\Windows\System\KQBavup.exe
  2⤵
  PID:6884
- C:\Windows\System\vKyVBHW.exe
  C:\Windows\System\vKyVBHW.exe
  2⤵
  PID:6908
- C:\Windows\System\ICtPLhX.exe
  C:\Windows\System\ICtPLhX.exe
  2⤵
  PID:6936
- C:\Windows\System\XVlUizK.exe
  C:\Windows\System\XVlUizK.exe
  2⤵
  PID:6964
- C:\Windows\System\VXhAeSj.exe
  C:\Windows\System\VXhAeSj.exe
  2⤵
  PID:6996
- C:\Windows\System\LmTASVo.exe
  C:\Windows\System\LmTASVo.exe
  2⤵
  PID:7028
- C:\Windows\System\aNhKUii.exe
  C:\Windows\System\aNhKUii.exe
  2⤵
  PID:7056
- C:\Windows\System\ryoYQOM.exe
  C:\Windows\System\ryoYQOM.exe
  2⤵
  PID:7084
- C:\Windows\System\aFGAlkF.exe
  C:\Windows\System\aFGAlkF.exe
  2⤵
  PID:7116
- C:\Windows\System\tMHisGt.exe
  C:\Windows\System\tMHisGt.exe
  2⤵
  PID:7144
- C:\Windows\System\UvsIhog.exe
  C:\Windows\System\UvsIhog.exe
  2⤵
  PID:6024
- C:\Windows\System\MimJwCF.exe
  C:\Windows\System\MimJwCF.exe
  2⤵
  PID:5760
- C:\Windows\System\IWiChGq.exe
  C:\Windows\System\IWiChGq.exe
  2⤵
  PID:6204
- C:\Windows\System\yjlqegL.exe
  C:\Windows\System\yjlqegL.exe
  2⤵
  PID:6264
- C:\Windows\System\vyqXVrv.exe
  C:\Windows\System\vyqXVrv.exe
  2⤵
  PID:6328
- C:\Windows\System\PhpyZIf.exe
  C:\Windows\System\PhpyZIf.exe
  2⤵
  PID:6380
- C:\Windows\System\tLJHPvA.exe
  C:\Windows\System\tLJHPvA.exe
  2⤵
  PID:6532
- C:\Windows\System\kXImyTN.exe
  C:\Windows\System\kXImyTN.exe
  2⤵
  PID:6464
- C:\Windows\System\ZutcDLg.exe
  C:\Windows\System\ZutcDLg.exe
  2⤵
  PID:6568
- C:\Windows\System\yRaQYZU.exe
  C:\Windows\System\yRaQYZU.exe
  2⤵
  PID:6716
- C:\Windows\System\YuhWqnp.exe
  C:\Windows\System\YuhWqnp.exe
  2⤵
  PID:6700
- C:\Windows\System\aXutXiF.exe
  C:\Windows\System\aXutXiF.exe
  2⤵
  PID:6768
- C:\Windows\System\wDygwst.exe
  C:\Windows\System\wDygwst.exe
  2⤵
  PID:6832
- C:\Windows\System\XRNFFMa.exe
  C:\Windows\System\XRNFFMa.exe
  2⤵
  PID:6904
- C:\Windows\System\HSCWPEB.exe
  C:\Windows\System\HSCWPEB.exe
  2⤵
  PID:6992
- C:\Windows\System\HTEiIiF.exe
  C:\Windows\System\HTEiIiF.exe
  2⤵
  PID:7040
- C:\Windows\System\bieEDTJ.exe
  C:\Windows\System\bieEDTJ.exe
  2⤵
  PID:7092
- C:\Windows\System\WxarbCY.exe
  C:\Windows\System\WxarbCY.exe
  2⤵
  PID:7160
- C:\Windows\System\WeoAWlK.exe
  C:\Windows\System\WeoAWlK.exe
  2⤵
  PID:6148
- C:\Windows\System\VrTKmEK.exe
  C:\Windows\System\VrTKmEK.exe
  2⤵
  PID:6348
- C:\Windows\System\aMbPnZg.exe
  C:\Windows\System\aMbPnZg.exe
  2⤵
  PID:6688
- C:\Windows\System\EVrwAVm.exe
  C:\Windows\System\EVrwAVm.exe
  2⤵
  PID:6796
- C:\Windows\System\XrXAIiP.exe
  C:\Windows\System\XrXAIiP.exe
  2⤵
  PID:6976
- C:\Windows\System\NFKOMbM.exe
  C:\Windows\System\NFKOMbM.exe
  2⤵
  PID:7052
- C:\Windows\System\ojPArJt.exe
  C:\Windows\System\ojPArJt.exe
  2⤵
  PID:6244
- C:\Windows\System\PCOSxpc.exe
  C:\Windows\System\PCOSxpc.exe
  2⤵
  PID:6296
- C:\Windows\System\FfnMFJp.exe
  C:\Windows\System\FfnMFJp.exe
  2⤵
  PID:6820
- C:\Windows\System\xVxobye.exe
  C:\Windows\System\xVxobye.exe
  2⤵
  PID:7188
- C:\Windows\System\DRUQKuz.exe
  C:\Windows\System\DRUQKuz.exe
  2⤵
  PID:7212
- C:\Windows\System\TzbLieA.exe
  C:\Windows\System\TzbLieA.exe
  2⤵
  PID:7236
- C:\Windows\System\MoLtuTA.exe
  C:\Windows\System\MoLtuTA.exe
  2⤵
  PID:7268
- C:\Windows\System\ipdKBzt.exe
  C:\Windows\System\ipdKBzt.exe
  2⤵
  PID:7300
- C:\Windows\System\LhKXxmt.exe
  C:\Windows\System\LhKXxmt.exe
  2⤵
  PID:7328
- C:\Windows\System\buhRask.exe
  C:\Windows\System\buhRask.exe
  2⤵
  PID:7360
- C:\Windows\System\NlUMPqf.exe
  C:\Windows\System\NlUMPqf.exe
  2⤵
  PID:7388
- C:\Windows\System\HMCpAUa.exe
  C:\Windows\System\HMCpAUa.exe
  2⤵
  PID:7416
- C:\Windows\System\NGdmXuY.exe
  C:\Windows\System\NGdmXuY.exe
  2⤵
  PID:7444
- C:\Windows\System\IByABzG.exe
  C:\Windows\System\IByABzG.exe
  2⤵
  PID:7472
- C:\Windows\System\LDOxjty.exe
  C:\Windows\System\LDOxjty.exe
  2⤵
  PID:7496
- C:\Windows\System\DvBHEQH.exe
  C:\Windows\System\DvBHEQH.exe
  2⤵
  PID:7512
- C:\Windows\System\NxjGJjH.exe
  C:\Windows\System\NxjGJjH.exe
  2⤵
  PID:7536
- C:\Windows\System\fcuDSpl.exe
  C:\Windows\System\fcuDSpl.exe
  2⤵
  PID:7560
- C:\Windows\System\KyhVMIp.exe
  C:\Windows\System\KyhVMIp.exe
  2⤵
  PID:7588
- C:\Windows\System\nnjMYhr.exe
  C:\Windows\System\nnjMYhr.exe
  2⤵
  PID:7620
- C:\Windows\System\vwKzWqY.exe
  C:\Windows\System\vwKzWqY.exe
  2⤵
  PID:7648
- C:\Windows\System\TvpftBt.exe
  C:\Windows\System\TvpftBt.exe
  2⤵
  PID:7676
- C:\Windows\System\CEAtbok.exe
  C:\Windows\System\CEAtbok.exe
  2⤵
  PID:7696
- C:\Windows\System\kiGUsuo.exe
  C:\Windows\System\kiGUsuo.exe
  2⤵
  PID:7720
- C:\Windows\System\AYzRHTt.exe
  C:\Windows\System\AYzRHTt.exe
  2⤵
  PID:7748
- C:\Windows\System\InraGTd.exe
  C:\Windows\System\InraGTd.exe
  2⤵
  PID:7780
- C:\Windows\System\jrfFRTI.exe
  C:\Windows\System\jrfFRTI.exe
  2⤵
  PID:7808
- C:\Windows\System\rrRgaRW.exe
  C:\Windows\System\rrRgaRW.exe
  2⤵
  PID:7832
- C:\Windows\System\AdQbfqH.exe
  C:\Windows\System\AdQbfqH.exe
  2⤵
  PID:7860
- C:\Windows\System\VNsVOxl.exe
  C:\Windows\System\VNsVOxl.exe
  2⤵
  PID:7888
- C:\Windows\System\gwhLtHf.exe
  C:\Windows\System\gwhLtHf.exe
  2⤵
  PID:7916
- C:\Windows\System\kQeSZJO.exe
  C:\Windows\System\kQeSZJO.exe
  2⤵
  PID:7936
- C:\Windows\System\SDcGacb.exe
  C:\Windows\System\SDcGacb.exe
  2⤵
  PID:7964
- C:\Windows\System\SAvnPoK.exe
  C:\Windows\System\SAvnPoK.exe
  2⤵
  PID:7996
- C:\Windows\System\gdmTret.exe
  C:\Windows\System\gdmTret.exe
  2⤵
  PID:8032
- C:\Windows\System\nQlsIqa.exe
  C:\Windows\System\nQlsIqa.exe
  2⤵
  PID:8060
- C:\Windows\System\bCEvQma.exe
  C:\Windows\System\bCEvQma.exe
  2⤵
  PID:8084
- C:\Windows\System\ITAyRvd.exe
  C:\Windows\System\ITAyRvd.exe
  2⤵
  PID:8112
- C:\Windows\System\imPUvPN.exe
  C:\Windows\System\imPUvPN.exe
  2⤵
  PID:8144
- C:\Windows\System\gFdgsMb.exe
  C:\Windows\System\gFdgsMb.exe
  2⤵
  PID:8168
- C:\Windows\System\CidKiyH.exe
  C:\Windows\System\CidKiyH.exe
  2⤵
  PID:6180
- C:\Windows\System\qKoDXWB.exe
  C:\Windows\System\qKoDXWB.exe
  2⤵
  PID:7196
- C:\Windows\System\XgJulIj.exe
  C:\Windows\System\XgJulIj.exe
  2⤵
  PID:7256
- C:\Windows\System\bTTIxFm.exe
  C:\Windows\System\bTTIxFm.exe
  2⤵
  PID:7324
- C:\Windows\System\uqrCwEl.exe
  C:\Windows\System\uqrCwEl.exe
  2⤵
  PID:7372
- C:\Windows\System\KaNHSyn.exe
  C:\Windows\System\KaNHSyn.exe
  2⤵
  PID:7452
- C:\Windows\System\kNWyapY.exe
  C:\Windows\System\kNWyapY.exe
  2⤵
  PID:7488
- C:\Windows\System\usKKbJD.exe
  C:\Windows\System\usKKbJD.exe
  2⤵
  PID:7508
- C:\Windows\System\oepgbgP.exe
  C:\Windows\System\oepgbgP.exe
  2⤵
  PID:7616
- C:\Windows\System\xNBlRyt.exe
  C:\Windows\System\xNBlRyt.exe
  2⤵
  PID:7636
- C:\Windows\System\MPjFXVl.exe
  C:\Windows\System\MPjFXVl.exe
  2⤵
  PID:7740
- C:\Windows\System\ZXkgJMp.exe
  C:\Windows\System\ZXkgJMp.exe
  2⤵
  PID:7884
- C:\Windows\System\vgtCWni.exe
  C:\Windows\System\vgtCWni.exe
  2⤵
  PID:7912
- C:\Windows\System\tLPgMDp.exe
  C:\Windows\System\tLPgMDp.exe
  2⤵
  PID:7948
- C:\Windows\System\gWmBvJM.exe
  C:\Windows\System\gWmBvJM.exe
  2⤵
  PID:8104
- C:\Windows\System\ZGPuDlo.exe
  C:\Windows\System\ZGPuDlo.exe
  2⤵
  PID:8040
- C:\Windows\System\HfjZrOB.exe
  C:\Windows\System\HfjZrOB.exe
  2⤵
  PID:8128
- C:\Windows\System\RXqQHmK.exe
  C:\Windows\System\RXqQHmK.exe
  2⤵
  PID:7312
- C:\Windows\System\WpFQPOR.exe
  C:\Windows\System\WpFQPOR.exe
  2⤵
  PID:7252
- C:\Windows\System\pMRfbBK.exe
  C:\Windows\System\pMRfbBK.exe
  2⤵
  PID:7404
- C:\Windows\System\aPvVFTS.exe
  C:\Windows\System\aPvVFTS.exe
  2⤵
  PID:7604
- C:\Windows\System\hEOEXvu.exe
  C:\Windows\System\hEOEXvu.exe
  2⤵
  PID:7820
- C:\Windows\System\BGYoyXI.exe
  C:\Windows\System\BGYoyXI.exe
  2⤵
  PID:7800
- C:\Windows\System\NSoZYAf.exe
  C:\Windows\System\NSoZYAf.exe
  2⤵
  PID:7980
- C:\Windows\System\FBrZJKY.exe
  C:\Windows\System\FBrZJKY.exe
  2⤵
  PID:5520
- C:\Windows\System\stEJNfs.exe
  C:\Windows\System\stEJNfs.exe
  2⤵
  PID:8160
- C:\Windows\System\yWsNVzZ.exe
  C:\Windows\System\yWsNVzZ.exe
  2⤵
  PID:6592
- C:\Windows\System\dCVXKQt.exe
  C:\Windows\System\dCVXKQt.exe
  2⤵
  PID:7928
- C:\Windows\System\zIpYaum.exe
  C:\Windows\System\zIpYaum.exe
  2⤵
  PID:7692
- C:\Windows\System\pTCJNis.exe
  C:\Windows\System\pTCJNis.exe
  2⤵
  PID:8212
- C:\Windows\System\wmsZhjp.exe
  C:\Windows\System\wmsZhjp.exe
  2⤵
  PID:8240
- C:\Windows\System\KLXNTbw.exe
  C:\Windows\System\KLXNTbw.exe
  2⤵
  PID:8272
- C:\Windows\System\FXZVjEH.exe
  C:\Windows\System\FXZVjEH.exe
  2⤵
  PID:8300
- C:\Windows\System\VYFPVzj.exe
  C:\Windows\System\VYFPVzj.exe
  2⤵
  PID:8324
- C:\Windows\System\RDiDbHQ.exe
  C:\Windows\System\RDiDbHQ.exe
  2⤵
  PID:8340
- C:\Windows\System\zxlShTD.exe
  C:\Windows\System\zxlShTD.exe
  2⤵
  PID:8380
- C:\Windows\System\ZCSalEH.exe
  C:\Windows\System\ZCSalEH.exe
  2⤵
  PID:8408
- C:\Windows\System\ZPuIZnc.exe
  C:\Windows\System\ZPuIZnc.exe
  2⤵
  PID:8428
- C:\Windows\System\KXhPruV.exe
  C:\Windows\System\KXhPruV.exe
  2⤵
  PID:8460
- C:\Windows\System\wtkRFyM.exe
  C:\Windows\System\wtkRFyM.exe
  2⤵
  PID:8476
- C:\Windows\System\CyTLwGb.exe
  C:\Windows\System\CyTLwGb.exe
  2⤵
  PID:8512
- C:\Windows\System\vEVUSzX.exe
  C:\Windows\System\vEVUSzX.exe
  2⤵
  PID:8536
- C:\Windows\System\vMbxNMD.exe
  C:\Windows\System\vMbxNMD.exe
  2⤵
  PID:8564
- C:\Windows\System\ayQqIPC.exe
  C:\Windows\System\ayQqIPC.exe
  2⤵
  PID:8596
- C:\Windows\System\SHzIlcz.exe
  C:\Windows\System\SHzIlcz.exe
  2⤵
  PID:8628
- C:\Windows\System\JkRaNNB.exe
  C:\Windows\System\JkRaNNB.exe
  2⤵
  PID:8656
- C:\Windows\System\VdsJdlt.exe
  C:\Windows\System\VdsJdlt.exe
  2⤵
  PID:8680
- C:\Windows\System\AJBQhax.exe
  C:\Windows\System\AJBQhax.exe
  2⤵
  PID:8716
- C:\Windows\System\dsKhtCc.exe
  C:\Windows\System\dsKhtCc.exe
  2⤵
  PID:8732
- C:\Windows\System\DrhNOiz.exe
  C:\Windows\System\DrhNOiz.exe
  2⤵
  PID:8760
- C:\Windows\System\HBzdncv.exe
  C:\Windows\System\HBzdncv.exe
  2⤵
  PID:8784
- C:\Windows\System\gSDeeUg.exe
  C:\Windows\System\gSDeeUg.exe
  2⤵
  PID:8808
- C:\Windows\System\ZUMWjtu.exe
  C:\Windows\System\ZUMWjtu.exe
  2⤵
  PID:8836
- C:\Windows\System\URkWZxY.exe
  C:\Windows\System\URkWZxY.exe
  2⤵
  PID:8872
- C:\Windows\System\RNYFMmX.exe
  C:\Windows\System\RNYFMmX.exe
  2⤵
  PID:8888
- C:\Windows\System\AClQNNr.exe
  C:\Windows\System\AClQNNr.exe
  2⤵
  PID:8912
- C:\Windows\System\tycNjXL.exe
  C:\Windows\System\tycNjXL.exe
  2⤵
  PID:8936
- C:\Windows\System\krMARUn.exe
  C:\Windows\System\krMARUn.exe
  2⤵
  PID:8952
- C:\Windows\System\UxXNnCa.exe
  C:\Windows\System\UxXNnCa.exe
  2⤵
  PID:8976
- C:\Windows\System\jcQHpEV.exe
  C:\Windows\System\jcQHpEV.exe
  2⤵
  PID:9008
- C:\Windows\System\zrfToxc.exe
  C:\Windows\System\zrfToxc.exe
  2⤵
  PID:9036
- C:\Windows\System\eudHVcl.exe
  C:\Windows\System\eudHVcl.exe
  2⤵
  PID:9068
- C:\Windows\System\kkcRtQv.exe
  C:\Windows\System\kkcRtQv.exe
  2⤵
  PID:9096
- C:\Windows\System\EPqMwpf.exe
  C:\Windows\System\EPqMwpf.exe
  2⤵
  PID:9116
- C:\Windows\System\YTLDFQp.exe
  C:\Windows\System\YTLDFQp.exe
  2⤵
  PID:9136
- C:\Windows\System\gTqbvTy.exe
  C:\Windows\System\gTqbvTy.exe
  2⤵
  PID:9168
- C:\Windows\System\aVFQzRP.exe
  C:\Windows\System\aVFQzRP.exe
  2⤵
  PID:9196
- C:\Windows\System\FlDSyiV.exe
  C:\Windows\System\FlDSyiV.exe
  2⤵
  PID:7556
- C:\Windows\System\feUeMvi.exe
  C:\Windows\System\feUeMvi.exe
  2⤵
  PID:8228
- C:\Windows\System\ptywdgw.exe
  C:\Windows\System\ptywdgw.exe
  2⤵
  PID:8256
- C:\Windows\System\xoTjyou.exe
  C:\Windows\System\xoTjyou.exe
  2⤵
  PID:8332
- C:\Windows\System\SswCkuv.exe
  C:\Windows\System\SswCkuv.exe
  2⤵
  PID:8396
- C:\Windows\System\rxDuBhx.exe
  C:\Windows\System\rxDuBhx.exe
  2⤵
  PID:8360
- C:\Windows\System\CVXCPUg.exe
  C:\Windows\System\CVXCPUg.exe
  2⤵
  PID:8440
- C:\Windows\System\kKOSUzE.exe
  C:\Windows\System\kKOSUzE.exe
  2⤵
  PID:8612
- C:\Windows\System\JKkCFiU.exe
  C:\Windows\System\JKkCFiU.exe
  2⤵
  PID:8500
- C:\Windows\System\NdINCgg.exe
  C:\Windows\System\NdINCgg.exe
  2⤵
  PID:8668
- C:\Windows\System\ImrppfA.exe
  C:\Windows\System\ImrppfA.exe
  2⤵
  PID:8880
- C:\Windows\System\wLKSbMB.exe
  C:\Windows\System\wLKSbMB.exe
  2⤵
  PID:8756
- C:\Windows\System\dYubntm.exe
  C:\Windows\System\dYubntm.exe
  2⤵
  PID:8804
- C:\Windows\System\kbpkVeM.exe
  C:\Windows\System\kbpkVeM.exe
  2⤵
  PID:8972
- C:\Windows\System\LWOWQcm.exe
  C:\Windows\System\LWOWQcm.exe
  2⤵
  PID:8904
- C:\Windows\System\PmgfWGQ.exe
  C:\Windows\System\PmgfWGQ.exe
  2⤵
  PID:8948
- C:\Windows\System\VsIaTOg.exe
  C:\Windows\System\VsIaTOg.exe
  2⤵
  PID:9000
- C:\Windows\System\puzBvwF.exe
  C:\Windows\System\puzBvwF.exe
  2⤵
  PID:9156
- C:\Windows\System\qATzRda.exe
  C:\Windows\System\qATzRda.exe
  2⤵
  PID:9148
- C:\Windows\System\RRxwxZj.exe
  C:\Windows\System\RRxwxZj.exe
  2⤵
  PID:8080
- C:\Windows\System\setCMoX.exe
  C:\Windows\System\setCMoX.exe
  2⤵
  PID:7856
- C:\Windows\System\eJcqSsC.exe
  C:\Windows\System\eJcqSsC.exe
  2⤵
  PID:8468
- C:\Windows\System\XANyhLq.exe
  C:\Windows\System\XANyhLq.exe
  2⤵
  PID:8532
- C:\Windows\System\UPXsoFY.exe
  C:\Windows\System\UPXsoFY.exe
  2⤵
  PID:8472
- C:\Windows\System\elnqBZr.exe
  C:\Windows\System\elnqBZr.exe
  2⤵
  PID:8452
- C:\Windows\System\WrqSOjj.exe
  C:\Windows\System\WrqSOjj.exe
  2⤵
  PID:9232
- C:\Windows\System\ftmFWLU.exe
  C:\Windows\System\ftmFWLU.exe
  2⤵
  PID:9252
- C:\Windows\System\kTZHayv.exe
  C:\Windows\System\kTZHayv.exe
  2⤵
  PID:9280
- C:\Windows\System\kVItpVd.exe
  C:\Windows\System\kVItpVd.exe
  2⤵
  PID:9308
- C:\Windows\System\TvuNzDF.exe
  C:\Windows\System\TvuNzDF.exe
  2⤵
  PID:9340
- C:\Windows\System\eSUtVff.exe
  C:\Windows\System\eSUtVff.exe
  2⤵
  PID:9368
- C:\Windows\System\RmFNnlA.exe
  C:\Windows\System\RmFNnlA.exe
  2⤵
  PID:9388
- C:\Windows\System\fEJNOaQ.exe
  C:\Windows\System\fEJNOaQ.exe
  2⤵
  PID:9420
- C:\Windows\System\EGvHTNE.exe
  C:\Windows\System\EGvHTNE.exe
  2⤵
  PID:9448
- C:\Windows\System\CnYqHgu.exe
  C:\Windows\System\CnYqHgu.exe
  2⤵
  PID:9476
- C:\Windows\System\qUcKLRq.exe
  C:\Windows\System\qUcKLRq.exe
  2⤵
  PID:9504
- C:\Windows\System\DsAkTWj.exe
  C:\Windows\System\DsAkTWj.exe
  2⤵
  PID:9532
- C:\Windows\System\XemjRyH.exe
  C:\Windows\System\XemjRyH.exe
  2⤵
  PID:9560
- C:\Windows\System\yMXuqmv.exe
  C:\Windows\System\yMXuqmv.exe
  2⤵
  PID:9588
- C:\Windows\System\SpfsVgI.exe
  C:\Windows\System\SpfsVgI.exe
  2⤵
  PID:9616
- C:\Windows\System\abiYqmp.exe
  C:\Windows\System\abiYqmp.exe
  2⤵
  PID:9640
- C:\Windows\System\byUSRFg.exe
  C:\Windows\System\byUSRFg.exe
  2⤵
  PID:9668
- C:\Windows\System\tCIDAtn.exe
  C:\Windows\System\tCIDAtn.exe
  2⤵
  PID:9696
- C:\Windows\System\atPeoxq.exe
  C:\Windows\System\atPeoxq.exe
  2⤵
  PID:9752
- C:\Windows\System\uUviIPf.exe
  C:\Windows\System\uUviIPf.exe
  2⤵
  PID:9780
- C:\Windows\System\qjwtdWf.exe
  C:\Windows\System\qjwtdWf.exe
  2⤵
  PID:9804
- C:\Windows\System\lziSrjm.exe
  C:\Windows\System\lziSrjm.exe
  2⤵
  PID:9840
- C:\Windows\System\YMFsIhW.exe
  C:\Windows\System\YMFsIhW.exe
  2⤵
  PID:9868
- C:\Windows\System\brHracI.exe
  C:\Windows\System\brHracI.exe
  2⤵
  PID:9896
- C:\Windows\System\KvEaAjT.exe
  C:\Windows\System\KvEaAjT.exe
  2⤵
  PID:9924
- C:\Windows\System\vnOWCZy.exe
  C:\Windows\System\vnOWCZy.exe
  2⤵
  PID:9952
- C:\Windows\System\UmjtDwg.exe
  C:\Windows\System\UmjtDwg.exe
  2⤵
  PID:9984
- C:\Windows\System\CNILOgy.exe
  C:\Windows\System\CNILOgy.exe
  2⤵
  PID:10012
- C:\Windows\System\AwOnXPL.exe
  C:\Windows\System\AwOnXPL.exe
  2⤵
  PID:10040
- C:\Windows\System\ECKxwRu.exe
  C:\Windows\System\ECKxwRu.exe
  2⤵
  PID:10076
- C:\Windows\System\IDbGhqk.exe
  C:\Windows\System\IDbGhqk.exe
  2⤵
  PID:10092
- C:\Windows\System\QCshBNL.exe
  C:\Windows\System\QCshBNL.exe
  2⤵
  PID:10120
- C:\Windows\System\xcGvFtr.exe
  C:\Windows\System\xcGvFtr.exe
  2⤵
  PID:10144
- C:\Windows\System\wfYLDFp.exe
  C:\Windows\System\wfYLDFp.exe
  2⤵
  PID:10164
- C:\Windows\System\wJsjMIW.exe
  C:\Windows\System\wJsjMIW.exe
  2⤵
  PID:10184
- C:\Windows\System\kJwkwwx.exe
  C:\Windows\System\kJwkwwx.exe
  2⤵
  PID:10200
- C:\Windows\System\rKzTDTv.exe
  C:\Windows\System\rKzTDTv.exe
  2⤵
  PID:10224
- C:\Windows\System\cDboDTu.exe
  C:\Windows\System\cDboDTu.exe
  2⤵
  PID:8996
- C:\Windows\System\HrfSHTj.exe
  C:\Windows\System\HrfSHTj.exe
  2⤵
  PID:8728
- C:\Windows\System\cqIXOUs.exe
  C:\Windows\System\cqIXOUs.exe
  2⤵
  PID:9048
- C:\Windows\System\jmxoRYs.exe
  C:\Windows\System\jmxoRYs.exe
  2⤵
  PID:8744
- C:\Windows\System\EeNZrmc.exe
  C:\Windows\System\EeNZrmc.exe
  2⤵
  PID:9304
- C:\Windows\System\JPYhHym.exe
  C:\Windows\System\JPYhHym.exe
  2⤵
  PID:8524
- C:\Windows\System\oNdnWBg.exe
  C:\Windows\System\oNdnWBg.exe
  2⤵
  PID:9416
- C:\Windows\System\KteglvK.exe
  C:\Windows\System\KteglvK.exe
  2⤵
  PID:9520
- C:\Windows\System\qxplOpA.exe
  C:\Windows\System\qxplOpA.exe
  2⤵
  PID:9436
- C:\Windows\System\NYnzLxP.exe
  C:\Windows\System\NYnzLxP.exe
  2⤵
  PID:9660
- C:\Windows\System\RiBfJxC.exe
  C:\Windows\System\RiBfJxC.exe
  2⤵
  PID:9584
- C:\Windows\System\WyCCOzn.exe
  C:\Windows\System\WyCCOzn.exe
  2⤵
  PID:9824
- C:\Windows\System\fQkCSPr.exe
  C:\Windows\System\fQkCSPr.exe
  2⤵
  PID:9656
- C:\Windows\System\ysBvUNo.exe
  C:\Windows\System\ysBvUNo.exe
  2⤵
  PID:9892
- C:\Windows\System\pjItQks.exe
  C:\Windows\System\pjItQks.exe
  2⤵
  PID:9916
- C:\Windows\System\CRyHrFj.exe
  C:\Windows\System\CRyHrFj.exe
  2⤵
  PID:10008
- C:\Windows\System\IchtZcY.exe
  C:\Windows\System\IchtZcY.exe
  2⤵
  PID:9860
- C:\Windows\System\sFMGJrn.exe
  C:\Windows\System\sFMGJrn.exe
  2⤵
  PID:10060
- C:\Windows\System\SiIVmUT.exe
  C:\Windows\System\SiIVmUT.exe
  2⤵
  PID:9960
- C:\Windows\System\TOGyeXL.exe
  C:\Windows\System\TOGyeXL.exe
  2⤵
  PID:9064
- C:\Windows\System\gvlJCDS.exe
  C:\Windows\System\gvlJCDS.exe
  2⤵
  PID:10108
- C:\Windows\System\YMVKFqv.exe
  C:\Windows\System\YMVKFqv.exe
  2⤵
  PID:9472
- C:\Windows\System\NXyAdVF.exe
  C:\Windows\System\NXyAdVF.exe
  2⤵
  PID:9124
- C:\Windows\System\DvXlKVr.exe
  C:\Windows\System\DvXlKVr.exe
  2⤵
  PID:10236
- C:\Windows\System\QomEGxy.exe
  C:\Windows\System\QomEGxy.exe
  2⤵
  PID:9636
- C:\Windows\System\nqTruIv.exe
  C:\Windows\System\nqTruIv.exe
  2⤵
  PID:9316
- C:\Windows\System\bunMSLw.exe
  C:\Windows\System\bunMSLw.exe
  2⤵
  PID:9060
- C:\Windows\System\HKmhEvl.exe
  C:\Windows\System\HKmhEvl.exe
  2⤵
  PID:10256
- C:\Windows\System\hVvZygX.exe
  C:\Windows\System\hVvZygX.exe
  2⤵
  PID:10280
- C:\Windows\System\OBVqLKH.exe
  C:\Windows\System\OBVqLKH.exe
  2⤵
  PID:10308
- C:\Windows\System\piJCIFz.exe
  C:\Windows\System\piJCIFz.exe
  2⤵
  PID:10336
- C:\Windows\System\KVpMKhb.exe
  C:\Windows\System\KVpMKhb.exe
  2⤵
  PID:10360
- C:\Windows\System\pNnYluV.exe
  C:\Windows\System\pNnYluV.exe
  2⤵
  PID:10388
- C:\Windows\System\NcqCYXb.exe
  C:\Windows\System\NcqCYXb.exe
  2⤵
  PID:10412
- C:\Windows\System\ISLgZmg.exe
  C:\Windows\System\ISLgZmg.exe
  2⤵
  PID:10432
- C:\Windows\System\ViPVqnH.exe
  C:\Windows\System\ViPVqnH.exe
  2⤵
  PID:10456
- C:\Windows\System\MKQYBsI.exe
  C:\Windows\System\MKQYBsI.exe
  2⤵
  PID:10476
- C:\Windows\System\qVqWsiF.exe
  C:\Windows\System\qVqWsiF.exe
  2⤵
  PID:10500
- C:\Windows\System\teSUlYX.exe
  C:\Windows\System\teSUlYX.exe
  2⤵
  PID:10520
- C:\Windows\System\lIWntxv.exe
  C:\Windows\System\lIWntxv.exe
  2⤵
  PID:10544
- C:\Windows\System\nIRRTYU.exe
  C:\Windows\System\nIRRTYU.exe
  2⤵
  PID:10572
- C:\Windows\System\RLJTrQV.exe
  C:\Windows\System\RLJTrQV.exe
  2⤵
  PID:10592
- C:\Windows\System\CzKkiMM.exe
  C:\Windows\System\CzKkiMM.exe
  2⤵
  PID:10620
- C:\Windows\System\fNspxHr.exe
  C:\Windows\System\fNspxHr.exe
  2⤵
  PID:10644
- C:\Windows\System\kfAXKpm.exe
  C:\Windows\System\kfAXKpm.exe
  2⤵
  PID:10668
- C:\Windows\System\JmXkTDq.exe
  C:\Windows\System\JmXkTDq.exe
  2⤵
  PID:10696
- C:\Windows\System\GWpIvPu.exe
  C:\Windows\System\GWpIvPu.exe
  2⤵
  PID:10728
- C:\Windows\System\psPzXFK.exe
  C:\Windows\System\psPzXFK.exe
  2⤵
  PID:10760
- C:\Windows\System\BsvLVDa.exe
  C:\Windows\System\BsvLVDa.exe
  2⤵
  PID:10788
- C:\Windows\System\aLEOsyQ.exe
  C:\Windows\System\aLEOsyQ.exe
  2⤵
  PID:10816
- C:\Windows\System\aCQsDzE.exe
  C:\Windows\System\aCQsDzE.exe
  2⤵
  PID:10836
- C:\Windows\System\AuLcRXd.exe
  C:\Windows\System\AuLcRXd.exe
  2⤵
  PID:10860
- C:\Windows\System\kyFGqyA.exe
  C:\Windows\System\kyFGqyA.exe
  2⤵
  PID:10896
- C:\Windows\System\nfJVHvH.exe
  C:\Windows\System\nfJVHvH.exe
  2⤵
  PID:10920
- C:\Windows\System\mHDUXEP.exe
  C:\Windows\System\mHDUXEP.exe
  2⤵
  PID:10948
- C:\Windows\System\AHuEGWO.exe
  C:\Windows\System\AHuEGWO.exe
  2⤵
  PID:10976
- C:\Windows\System\LNGjfcK.exe
  C:\Windows\System\LNGjfcK.exe
  2⤵
  PID:11000
- C:\Windows\System\hHwuuug.exe
  C:\Windows\System\hHwuuug.exe
  2⤵
  PID:11024
- C:\Windows\System\CyLjjzU.exe
  C:\Windows\System\CyLjjzU.exe
  2⤵
  PID:11048
- C:\Windows\System\dNkMecQ.exe
  C:\Windows\System\dNkMecQ.exe
  2⤵
  PID:11076
- C:\Windows\System\DbMmheM.exe
  C:\Windows\System\DbMmheM.exe
  2⤵
  PID:11108
- C:\Windows\System\UDIbnxz.exe
  C:\Windows\System\UDIbnxz.exe
  2⤵
  PID:11128
- C:\Windows\System\qWxilpQ.exe
  C:\Windows\System\qWxilpQ.exe
  2⤵
  PID:11156
- C:\Windows\System\WopWvxt.exe
  C:\Windows\System\WopWvxt.exe
  2⤵
  PID:11180
- C:\Windows\System\Swwiglr.exe
  C:\Windows\System\Swwiglr.exe
  2⤵
  PID:11204
- C:\Windows\System\AASfCpy.exe
  C:\Windows\System\AASfCpy.exe
  2⤵
  PID:11224
- C:\Windows\System\PwHrslK.exe
  C:\Windows\System\PwHrslK.exe
  2⤵
  PID:11240
- C:\Windows\System\NXBfOUb.exe
  C:\Windows\System\NXBfOUb.exe
  2⤵
  PID:9456
- C:\Windows\System\NeJggVn.exe
  C:\Windows\System\NeJggVn.exe
  2⤵
  PID:9976
- C:\Windows\System\oKgHMKT.exe
  C:\Windows\System\oKgHMKT.exe
  2⤵
  PID:9128
- C:\Windows\System\mNVuIWb.exe
  C:\Windows\System\mNVuIWb.exe
  2⤵
  PID:9576
- C:\Windows\System\LUrIVkU.exe
  C:\Windows\System\LUrIVkU.exe
  2⤵
  PID:9664
- C:\Windows\System\tVHkpQe.exe
  C:\Windows\System\tVHkpQe.exe
  2⤵
  PID:8236
- C:\Windows\System\CIFjJjO.exe
  C:\Windows\System\CIFjJjO.exe
  2⤵
  PID:10176
- C:\Windows\System\hNMvfIF.exe
  C:\Windows\System\hNMvfIF.exe
  2⤵
  PID:9764
- C:\Windows\System\OXwLfAJ.exe
  C:\Windows\System\OXwLfAJ.exe
  2⤵
  PID:10604
- C:\Windows\System\cMjeIjZ.exe
  C:\Windows\System\cMjeIjZ.exe
  2⤵
  PID:10468
- C:\Windows\System\HFUilkM.exe
  C:\Windows\System\HFUilkM.exe
  2⤵
  PID:10656
- C:\Windows\System\imeYVIB.exe
  C:\Windows\System\imeYVIB.exe
  2⤵
  PID:10688
- C:\Windows\System\BZAtTpt.exe
  C:\Windows\System\BZAtTpt.exe
  2⤵
  PID:10740
- C:\Windows\System\DjIdbTL.exe
  C:\Windows\System\DjIdbTL.exe
  2⤵
  PID:10488
- C:\Windows\System\aymbVgN.exe
  C:\Windows\System\aymbVgN.exe
  2⤵
  PID:10960
- C:\Windows\System\DurLLFZ.exe
  C:\Windows\System\DurLLFZ.exe
  2⤵
  PID:10752
- C:\Windows\System\TtKcdbd.exe
  C:\Windows\System\TtKcdbd.exe
  2⤵
  PID:10580
- C:\Windows\System\aUZSOJu.exe
  C:\Windows\System\aUZSOJu.exe
  2⤵
  PID:10848
- C:\Windows\System\ZDKtFIA.exe
  C:\Windows\System\ZDKtFIA.exe
  2⤵
  PID:10712
- C:\Windows\System\VjXTrto.exe
  C:\Windows\System\VjXTrto.exe
  2⤵
  PID:11200
- C:\Windows\System\enfrAiQ.exe
  C:\Windows\System\enfrAiQ.exe
  2⤵
  PID:11248
- C:\Windows\System\xXerniz.exe
  C:\Windows\System\xXerniz.exe
  2⤵
  PID:11036
- C:\Windows\System\nzJUayy.exe
  C:\Windows\System\nzJUayy.exe
  2⤵
  PID:10244
- C:\Windows\System\ZNIdZdi.exe
  C:\Windows\System\ZNIdZdi.exe
  2⤵
  PID:11116
- C:\Windows\System\zFuhJdN.exe
  C:\Windows\System\zFuhJdN.exe
  2⤵
  PID:10196
- C:\Windows\System\FUTfMBz.exe
  C:\Windows\System\FUTfMBz.exe
  2⤵
  PID:10680
- C:\Windows\System\unJaUVB.exe
  C:\Windows\System\unJaUVB.exe
  2⤵
  PID:11144
- C:\Windows\System\wwCAHvb.exe
  C:\Windows\System\wwCAHvb.exe
  2⤵
  PID:10252
- C:\Windows\System\CWNvoQU.exe
  C:\Windows\System\CWNvoQU.exe
  2⤵
  PID:11284
- C:\Windows\System\LrysHzh.exe
  C:\Windows\System\LrysHzh.exe
  2⤵
  PID:11316
- C:\Windows\System\iDMPhBv.exe
  C:\Windows\System\iDMPhBv.exe
  2⤵
  PID:11336
- C:\Windows\System\exfFTBU.exe
  C:\Windows\System\exfFTBU.exe
  2⤵
  PID:11364
- C:\Windows\System\EznJGzH.exe
  C:\Windows\System\EznJGzH.exe
  2⤵
  PID:11384
- C:\Windows\System\filZVwJ.exe
  C:\Windows\System\filZVwJ.exe
  2⤵
  PID:11412
- C:\Windows\System\MSoIOZF.exe
  C:\Windows\System\MSoIOZF.exe
  2⤵
  PID:11444
- C:\Windows\System\CxZhkAh.exe
  C:\Windows\System\CxZhkAh.exe
  2⤵
  PID:11472
- C:\Windows\System\nzMhQYS.exe
  C:\Windows\System\nzMhQYS.exe
  2⤵
  PID:11496
- C:\Windows\System\rcqONEq.exe
  C:\Windows\System\rcqONEq.exe
  2⤵
  PID:11532
- C:\Windows\System\YMEYYVp.exe
  C:\Windows\System\YMEYYVp.exe
  2⤵
  PID:11556
- C:\Windows\System\nkkkeHS.exe
  C:\Windows\System\nkkkeHS.exe
  2⤵
  PID:11588
- C:\Windows\System\iAsxWjr.exe
  C:\Windows\System\iAsxWjr.exe
  2⤵
  PID:11612
- C:\Windows\System\haqHKJg.exe
  C:\Windows\System\haqHKJg.exe
  2⤵
  PID:11632
- C:\Windows\System\fzdwfbr.exe
  C:\Windows\System\fzdwfbr.exe
  2⤵
  PID:11656
- C:\Windows\System\ldTIOgc.exe
  C:\Windows\System\ldTIOgc.exe
  2⤵
  PID:11680
- C:\Windows\System\fvUQxJo.exe
  C:\Windows\System\fvUQxJo.exe
  2⤵
  PID:11700
- C:\Windows\System\PIjqnkY.exe
  C:\Windows\System\PIjqnkY.exe
  2⤵
  PID:11728
- C:\Windows\System\VTgnSjn.exe
  C:\Windows\System\VTgnSjn.exe
  2⤵
  PID:11748
- C:\Windows\System\ujnHYbs.exe
  C:\Windows\System\ujnHYbs.exe
  2⤵
  PID:11768
- C:\Windows\System\eyyqHdQ.exe
  C:\Windows\System\eyyqHdQ.exe
  2⤵
  PID:11800
- C:\Windows\System\MoFdpKd.exe
  C:\Windows\System\MoFdpKd.exe
  2⤵
  PID:11836
- C:\Windows\System\PEzLMlP.exe
  C:\Windows\System\PEzLMlP.exe
  2⤵
  PID:11860
- C:\Windows\System\SStxFjh.exe
  C:\Windows\System\SStxFjh.exe
  2⤵
  PID:11884
- C:\Windows\System\FYTszqd.exe
  C:\Windows\System\FYTszqd.exe
  2⤵
  PID:11916
- C:\Windows\System\pZHXeGo.exe
  C:\Windows\System\pZHXeGo.exe
  2⤵
  PID:11944
- C:\Windows\System\HFvhazd.exe
  C:\Windows\System\HFvhazd.exe
  2⤵
  PID:11964
- C:\Windows\System\IkDfkFV.exe
  C:\Windows\System\IkDfkFV.exe
  2⤵
  PID:11996
- C:\Windows\System\lmZWBVb.exe
  C:\Windows\System\lmZWBVb.exe
  2⤵
  PID:12020
- C:\Windows\System\HsygMfn.exe
  C:\Windows\System\HsygMfn.exe
  2⤵
  PID:12048
- C:\Windows\System\JRQPDBp.exe
  C:\Windows\System\JRQPDBp.exe
  2⤵
  PID:12072
- C:\Windows\System\rwtNHZN.exe
  C:\Windows\System\rwtNHZN.exe
  2⤵
  PID:12108
- C:\Windows\System\CLMEKQO.exe
  C:\Windows\System\CLMEKQO.exe
  2⤵
  PID:12128
- C:\Windows\System\gURVyVZ.exe
  C:\Windows\System\gURVyVZ.exe
  2⤵
  PID:12156
- C:\Windows\System\BnEHELJ.exe
  C:\Windows\System\BnEHELJ.exe
  2⤵
  PID:12184
- C:\Windows\System\fpvCJjw.exe
  C:\Windows\System\fpvCJjw.exe
  2⤵
  PID:12208
- C:\Windows\System\OHJHcFQ.exe
  C:\Windows\System\OHJHcFQ.exe
  2⤵
  PID:12224
- C:\Windows\System\SjbSLDi.exe
  C:\Windows\System\SjbSLDi.exe
  2⤵
  PID:12244
- C:\Windows\System\OZQneRi.exe
  C:\Windows\System\OZQneRi.exe
  2⤵
  PID:12272
- C:\Windows\System\eeNqbOI.exe
  C:\Windows\System\eeNqbOI.exe
  2⤵
  PID:11252
- C:\Windows\System\zNJIHaJ.exe
  C:\Windows\System\zNJIHaJ.exe
  2⤵
  PID:10856
- C:\Windows\System\aiEhdxZ.exe
  C:\Windows\System\aiEhdxZ.exe
  2⤵
  PID:10780
- C:\Windows\System\QJRWBWM.exe
  C:\Windows\System\QJRWBWM.exe
  2⤵
  PID:9548
- C:\Windows\System\HtATzDD.exe
  C:\Windows\System\HtATzDD.exe
  2⤵
  PID:11352
- C:\Windows\System\kxiOQwg.exe
  C:\Windows\System\kxiOQwg.exe
  2⤵
  PID:10636
- C:\Windows\System\AuEZmTn.exe
  C:\Windows\System\AuEZmTn.exe
  2⤵
  PID:10552
- C:\Windows\System\DKWufhq.exe
  C:\Windows\System\DKWufhq.exe
  2⤵
  PID:11064
- C:\Windows\System\fZrEHnP.exe
  C:\Windows\System\fZrEHnP.exe
  2⤵
  PID:11568
- C:\Windows\System\wvjyhhH.exe
  C:\Windows\System\wvjyhhH.exe
  2⤵
  PID:10056
- C:\Windows\System\FBCuSnA.exe
  C:\Windows\System\FBCuSnA.exe
  2⤵
  PID:10888
- C:\Windows\System\ppusBFH.exe
  C:\Windows\System\ppusBFH.exe
  2⤵
  PID:11740
- C:\Windows\System\aBOYGvL.exe
  C:\Windows\System\aBOYGvL.exe
  2⤵
  PID:11756
- C:\Windows\System\lRQPmKe.exe
  C:\Windows\System\lRQPmKe.exe
  2⤵
  PID:11140
- C:\Windows\System\OraWQIh.exe
  C:\Windows\System\OraWQIh.exe
  2⤵
  PID:11604
- C:\Windows\System\BShWapg.exe
  C:\Windows\System\BShWapg.exe
  2⤵
  PID:11372
- C:\Windows\System\McPbtTi.exe
  C:\Windows\System\McPbtTi.exe
  2⤵
  PID:11676
- C:\Windows\System\lSZhUEh.exe
  C:\Windows\System\lSZhUEh.exe
  2⤵
  PID:12004
- C:\Windows\System\gSbPRgC.exe
  C:\Windows\System\gSbPRgC.exe
  2⤵
  PID:11812
- C:\Windows\System\PSdpKEg.exe
  C:\Windows\System\PSdpKEg.exe
  2⤵
  PID:12280
- C:\Windows\System\juXFbOO.exe
  C:\Windows\System\juXFbOO.exe
  2⤵
  PID:12060
- C:\Windows\System\aVSugpq.exe
  C:\Windows\System\aVSugpq.exe
  2⤵
  PID:12312
- C:\Windows\System\VUIRhjd.exe
  C:\Windows\System\VUIRhjd.exe
  2⤵
  PID:12344
- C:\Windows\System\RpEXiBg.exe
  C:\Windows\System\RpEXiBg.exe
  2⤵
  PID:12368
- C:\Windows\System\WWKsgvx.exe
  C:\Windows\System\WWKsgvx.exe
  2⤵
  PID:12392
- C:\Windows\System\yIntYfF.exe
  C:\Windows\System\yIntYfF.exe
  2⤵
  PID:12420
- C:\Windows\System\UiAyRuy.exe
  C:\Windows\System\UiAyRuy.exe
  2⤵
  PID:12444
- C:\Windows\System\UJQGoAy.exe
  C:\Windows\System\UJQGoAy.exe
  2⤵
  PID:12472
- C:\Windows\System\kLMWvFA.exe
  C:\Windows\System\kLMWvFA.exe
  2⤵
  PID:12492
- C:\Windows\System\zEHBOKd.exe
  C:\Windows\System\zEHBOKd.exe
  2⤵
  PID:12524
- C:\Windows\System\qRwtUlC.exe
  C:\Windows\System\qRwtUlC.exe
  2⤵
  PID:12544
- C:\Windows\System\pUWuIKW.exe
  C:\Windows\System\pUWuIKW.exe
  2⤵
  PID:12572
- C:\Windows\System\pgjczXw.exe
  C:\Windows\System\pgjczXw.exe
  2⤵
  PID:12596
- C:\Windows\System\HafyBcs.exe
  C:\Windows\System\HafyBcs.exe
  2⤵
  PID:12620
- C:\Windows\System\ypPjjiP.exe
  C:\Windows\System\ypPjjiP.exe
  2⤵
  PID:12644
- C:\Windows\System\YTZBshK.exe
  C:\Windows\System\YTZBshK.exe
  2⤵
  PID:12664
- C:\Windows\System\oAnnYaA.exe
  C:\Windows\System\oAnnYaA.exe
  2⤵
  PID:12688
- C:\Windows\System\fgXmEyV.exe
  C:\Windows\System\fgXmEyV.exe
  2⤵
  PID:12720
- C:\Windows\System\mTVxVpy.exe
  C:\Windows\System\mTVxVpy.exe
  2⤵
  PID:12748
- C:\Windows\System\gEoQLWh.exe
  C:\Windows\System\gEoQLWh.exe
  2⤵
  PID:12772
- C:\Windows\System\PAYQToj.exe
  C:\Windows\System\PAYQToj.exe
  2⤵
  PID:12792
- C:\Windows\System\fQytAFO.exe
  C:\Windows\System\fQytAFO.exe
  2⤵
  PID:12832
- C:\Windows\System\kNgWeEg.exe
  C:\Windows\System\kNgWeEg.exe
  2⤵
  PID:12856
- C:\Windows\System\kBHrrkQ.exe
  C:\Windows\System\kBHrrkQ.exe
  2⤵
  PID:12880
- C:\Windows\System\iygGKqg.exe
  C:\Windows\System\iygGKqg.exe
  2⤵
  PID:12908
- C:\Windows\System\WlZqpNG.exe
  C:\Windows\System\WlZqpNG.exe
  2⤵
  PID:12932
- C:\Windows\System\eIgOOOK.exe
  C:\Windows\System\eIgOOOK.exe
  2⤵
  PID:12960
- C:\Windows\System\rCVGpZJ.exe
  C:\Windows\System\rCVGpZJ.exe
  2⤵
  PID:12984
- C:\Windows\System\XdPsHsR.exe
  C:\Windows\System\XdPsHsR.exe
  2⤵
  PID:13012
- C:\Windows\System\qIyTzho.exe
  C:\Windows\System\qIyTzho.exe
  2⤵
  PID:13040
- C:\Windows\System\xkKQDxc.exe
  C:\Windows\System\xkKQDxc.exe
  2⤵
  PID:13060
- C:\Windows\System\ByPUcPF.exe
  C:\Windows\System\ByPUcPF.exe
  2⤵
  PID:13096
- C:\Windows\System\eIorfie.exe
  C:\Windows\System\eIorfie.exe
  2⤵
  PID:13116
- C:\Windows\System\fgLSXYP.exe
  C:\Windows\System\fgLSXYP.exe
  2⤵
  PID:13144
- C:\Windows\System\LYqGrke.exe
  C:\Windows\System\LYqGrke.exe
  2⤵
  PID:13172
- C:\Windows\System\uHvlXjB.exe
  C:\Windows\System\uHvlXjB.exe
  2⤵
  PID:13200
- C:\Windows\System\zGptlCb.exe
  C:\Windows\System\zGptlCb.exe
  2⤵
  PID:13228
- C:\Windows\System\nBgZvPX.exe
  C:\Windows\System\nBgZvPX.exe
  2⤵
  PID:13248
- C:\Windows\System\kFZdkXt.exe
  C:\Windows\System\kFZdkXt.exe
  2⤵
  PID:13272
- C:\Windows\System\ggOKFqs.exe
  C:\Windows\System\ggOKFqs.exe
  2⤵
  PID:13296
- C:\Windows\System\EgNcFYJ.exe
  C:\Windows\System\EgNcFYJ.exe
  2⤵
  PID:11788
- C:\Windows\System\aUNkPRL.exe
  C:\Windows\System\aUNkPRL.exe
  2⤵
  PID:11828
- C:\Windows\System\PbXMtpJ.exe
  C:\Windows\System\PbXMtpJ.exe
  2⤵
  PID:11640
- C:\Windows\System\mhHAEhy.exe
  C:\Windows\System\mhHAEhy.exe
  2⤵
  PID:11088
- C:\Windows\System\sTprPHa.exe
  C:\Windows\System\sTprPHa.exe
  2⤵
  PID:10448
- C:\Windows\System\ZAtjXPR.exe
  C:\Windows\System\ZAtjXPR.exe
  2⤵
  PID:12264
- C:\Windows\System\yCJjBsu.exe
  C:\Windows\System\yCJjBsu.exe
  2⤵
  PID:12064
- C:\Windows\System\uVfMcYq.exe
  C:\Windows\System\uVfMcYq.exe
  2⤵
  PID:12308
- C:\Windows\System\YkmZexo.exe
  C:\Windows\System\YkmZexo.exe
  2⤵
  PID:12332
- C:\Windows\System\ACLuylh.exe
  C:\Windows\System\ACLuylh.exe
  2⤵
  PID:12360
- C:\Windows\System\OWWzGoY.exe
  C:\Windows\System\OWWzGoY.exe
  2⤵
  PID:12504
- C:\Windows\System\prlPyJh.exe
  C:\Windows\System\prlPyJh.exe
  2⤵
  PID:12532
- C:\Windows\System\acsJdET.exe
  C:\Windows\System\acsJdET.exe
  2⤵
  PID:10352
- C:\Windows\System\cXYauFp.exe
  C:\Windows\System\cXYauFp.exe
  2⤵
  PID:11692
- C:\Windows\System\qIQhluf.exe
  C:\Windows\System\qIQhluf.exe
  2⤵
  PID:10940
- C:\Windows\System\gXzcfHl.exe
  C:\Windows\System\gXzcfHl.exe
  2⤵
  PID:12732
- C:\Windows\System\wJcsERo.exe
  C:\Windows\System\wJcsERo.exe
  2⤵
  PID:12388
- C:\Windows\System\uMPTWwg.exe
  C:\Windows\System\uMPTWwg.exe
  2⤵
  PID:12440
- C:\Windows\System\VkdhgWs.exe
  C:\Windows\System\VkdhgWs.exe
  2⤵
  PID:12892
- C:\Windows\System\AGxLIok.exe
  C:\Windows\System\AGxLIok.exe
  2⤵
  PID:11572
- C:\Windows\System\htecEnY.exe
  C:\Windows\System\htecEnY.exe
  2⤵
  PID:12592
- C:\Windows\System\UuFOYOm.exe
  C:\Windows\System\UuFOYOm.exe
  2⤵
  PID:11900
- C:\Windows\System\OKaZsVW.exe
  C:\Windows\System\OKaZsVW.exe
  2⤵
  PID:13156
- C:\Windows\System\LAmBLze.exe
  C:\Windows\System\LAmBLze.exe
  2⤵
  PID:13216
- C:\Windows\System\uOLgYMP.exe
  C:\Windows\System\uOLgYMP.exe
  2⤵
  PID:13292
- C:\Windows\System\XgJUnnd.exe
  C:\Windows\System\XgJUnnd.exe
  2⤵
  PID:12192
- C:\Windows\System\hbqyRkE.exe
  C:\Windows\System\hbqyRkE.exe
  2⤵
  PID:12500
- C:\Windows\System\jbLFRsB.exe
  C:\Windows\System\jbLFRsB.exe
  2⤵
  PID:12216
- C:\Windows\System\PlmUEaU.exe
  C:\Windows\System\PlmUEaU.exe
  2⤵
  PID:11936
- C:\Windows\System\DhjSbym.exe
  C:\Windows\System\DhjSbym.exe
  2⤵
  PID:13008
- C:\Windows\System\LxWVrvl.exe
  C:\Windows\System\LxWVrvl.exe
  2⤵
  PID:13320
- C:\Windows\System\bpSBKGU.exe
  C:\Windows\System\bpSBKGU.exe
  2⤵
  PID:13344
- C:\Windows\System\PzXSaBL.exe
  C:\Windows\System\PzXSaBL.exe
  2⤵
  PID:13368
- C:\Windows\System\XouKHWB.exe
  C:\Windows\System\XouKHWB.exe
  2⤵
  PID:13404
- C:\Windows\System\aVlQlhv.exe
  C:\Windows\System\aVlQlhv.exe
  2⤵
  PID:13424
- C:\Windows\System\MFnWCBa.exe
  C:\Windows\System\MFnWCBa.exe
  2⤵
  PID:13464
- C:\Windows\System\bvQDzfx.exe
  C:\Windows\System\bvQDzfx.exe
  2⤵
  PID:13488
- C:\Windows\System\GaUjVUD.exe
  C:\Windows\System\GaUjVUD.exe
  2⤵
  PID:13512
- C:\Windows\System\PWQGxqZ.exe
  C:\Windows\System\PWQGxqZ.exe
  2⤵
  PID:13540
- C:\Windows\System\hUMZuCd.exe
  C:\Windows\System\hUMZuCd.exe
  2⤵
  PID:13568
- C:\Windows\System\fukhIVl.exe
  C:\Windows\System\fukhIVl.exe
  2⤵
  PID:13592
- C:\Windows\System\nvuBabc.exe
  C:\Windows\System\nvuBabc.exe
  2⤵
  PID:13624
- C:\Windows\System\UeCDOiL.exe
  C:\Windows\System\UeCDOiL.exe
  2⤵
  PID:13648
- C:\Windows\System\wpeJIOG.exe
  C:\Windows\System\wpeJIOG.exe
  2⤵
  PID:13672
- C:\Windows\System\cIReDyb.exe
  C:\Windows\System\cIReDyb.exe
  2⤵
  PID:13700
- C:\Windows\System\rXKZzxY.exe
  C:\Windows\System\rXKZzxY.exe
  2⤵
  PID:13728
- C:\Windows\System\QeYrGZB.exe
  C:\Windows\System\QeYrGZB.exe
  2⤵
  PID:13752
- C:\Windows\System\LmPnapC.exe
  C:\Windows\System\LmPnapC.exe
  2⤵
  PID:13768
- C:\Windows\System\zsmfYOb.exe
  C:\Windows\System\zsmfYOb.exe
  2⤵
  PID:13796
- C:\Windows\System\EhjbdXt.exe
  C:\Windows\System\EhjbdXt.exe
  2⤵
  PID:13816
- C:\Windows\System\ADzDCnK.exe
  C:\Windows\System\ADzDCnK.exe
  2⤵
  PID:13844
- C:\Windows\System\xPeJPyV.exe
  C:\Windows\System\xPeJPyV.exe
  2⤵
  PID:13868
- C:\Windows\System\sopcejv.exe
  C:\Windows\System\sopcejv.exe
  2⤵
  PID:13884
- C:\Windows\System\QuGpKVy.exe
  C:\Windows\System\QuGpKVy.exe
  2⤵
  PID:13916
- C:\Windows\System\IwiKszZ.exe
  C:\Windows\System\IwiKszZ.exe
  2⤵
  PID:13932
- C:\Windows\System\QcBxtII.exe
  C:\Windows\System\QcBxtII.exe
  2⤵
  PID:13948
- C:\Windows\System\KboBmZK.exe
  C:\Windows\System\KboBmZK.exe
  2⤵
  PID:13972
- C:\Windows\System\cJQfndp.exe
  C:\Windows\System\cJQfndp.exe
  2⤵
  PID:14000
- C:\Windows\System\EFXGYiQ.exe
  C:\Windows\System\EFXGYiQ.exe
  2⤵
  PID:14024
- C:\Windows\System\hlqQdHf.exe
  C:\Windows\System\hlqQdHf.exe
  2⤵
  PID:14044
- C:\Windows\System\RhFeIuL.exe
  C:\Windows\System\RhFeIuL.exe
  2⤵
  PID:14072
- C:\Windows\System\ElLaTyn.exe
  C:\Windows\System\ElLaTyn.exe
  2⤵
  PID:14092
- C:\Windows\System\uCZmqzH.exe
  C:\Windows\System\uCZmqzH.exe
  2⤵
  PID:14128
- C:\Windows\System\ubbYAoi.exe
  C:\Windows\System\ubbYAoi.exe
  2⤵
  PID:14148
- C:\Windows\System\hBRiDmy.exe
  C:\Windows\System\hBRiDmy.exe
  2⤵
  PID:14164
- C:\Windows\System\MRsCmbn.exe
  C:\Windows\System\MRsCmbn.exe
  2⤵
  PID:14192
- C:\Windows\System\ihYoqYI.exe
  C:\Windows\System\ihYoqYI.exe
  2⤵
  PID:14216
- C:\Windows\System\UMyCDnJ.exe
  C:\Windows\System\UMyCDnJ.exe
  2⤵
  PID:14240
- C:\Windows\System\ZwFxfzq.exe
  C:\Windows\System\ZwFxfzq.exe
  2⤵
  PID:14268
- C:\Windows\System\fOLZvdR.exe
  C:\Windows\System\fOLZvdR.exe
  2⤵
  PID:14292
- C:\Windows\System\RHVHbVd.exe
  C:\Windows\System\RHVHbVd.exe
  2⤵
  PID:14316
- C:\Windows\System\lTXuCbE.exe
  C:\Windows\System\lTXuCbE.exe
  2⤵
  PID:12652
- C:\Windows\System\bFqHcFG.exe
  C:\Windows\System\bFqHcFG.exe
  2⤵
  PID:11484
- C:\Windows\System\UEMTRRD.exe
  C:\Windows\System\UEMTRRD.exe
  2⤵
  PID:3976
- C:\Windows\System\AopsNsK.exe
  C:\Windows\System\AopsNsK.exe
  2⤵
  PID:13240
- C:\Windows\System\pcixdyy.exe
  C:\Windows\System\pcixdyy.exe
  2⤵
  PID:13280
- C:\Windows\System\YjlYhbk.exe
  C:\Windows\System\YjlYhbk.exe
  2⤵
  PID:13260
- C:\Windows\System\wlDNatu.exe
  C:\Windows\System\wlDNatu.exe
  2⤵
  PID:13004
- C:\Windows\System\NXGARTn.exe
  C:\Windows\System\NXGARTn.exe
  2⤵
  PID:12096
- C:\Windows\System\cGibkEy.exe
  C:\Windows\System\cGibkEy.exe
  2⤵
  PID:13412
- C:\Windows\System\AXvTpON.exe
  C:\Windows\System\AXvTpON.exe
  2⤵
  PID:14088
- C:\Windows\System\uottYTs.exe
  C:\Windows\System\uottYTs.exe
  2⤵
  PID:13760
- C:\Windows\System\KMyEPFi.exe
  C:\Windows\System\KMyEPFi.exe
  2⤵
  PID:13984
- C:\Windows\System\lhIJGFv.exe
  C:\Windows\System\lhIJGFv.exe
  2⤵
  PID:13476
- C:\Windows\System\FiaXjBF.exe
  C:\Windows\System\FiaXjBF.exe
  2⤵
  PID:14176
- C:\Windows\System\llaudLi.exe
  C:\Windows\System\llaudLi.exe
  2⤵
  PID:14344
- C:\Windows\System\yGCHzsF.exe
  C:\Windows\System\yGCHzsF.exe
  2⤵
  PID:14364
- C:\Windows\System\tvFMHpk.exe
  C:\Windows\System\tvFMHpk.exe
  2⤵
  PID:14388
- C:\Windows\System\abhDUjb.exe
  C:\Windows\System\abhDUjb.exe
  2⤵
  PID:14416
- C:\Windows\System\HILTLHy.exe
  C:\Windows\System\HILTLHy.exe
  2⤵
  PID:14448
- C:\Windows\System\vMCSfBe.exe
  C:\Windows\System\vMCSfBe.exe
  2⤵
  PID:14484
- C:\Windows\System\UOmRdFr.exe
  C:\Windows\System\UOmRdFr.exe
  2⤵
  PID:14528
- C:\Windows\System\jnGaySh.exe
  C:\Windows\System\jnGaySh.exe
  2⤵
  PID:14560
- C:\Windows\System\JwMGhZW.exe
  C:\Windows\System\JwMGhZW.exe
  2⤵
  PID:14600
- C:\Windows\System\lEkFOfC.exe
  C:\Windows\System\lEkFOfC.exe
  2⤵
  PID:14628
- C:\Windows\System\mjpCGcu.exe
  C:\Windows\System\mjpCGcu.exe
  2⤵
  PID:14644
- C:\Windows\System\CZrJjFG.exe
  C:\Windows\System\CZrJjFG.exe
  2⤵
  PID:14676
- C:\Windows\System\PFJRZpe.exe
  C:\Windows\System\PFJRZpe.exe
  2⤵
  PID:14708
- C:\Windows\System\PoTKNGf.exe
  C:\Windows\System\PoTKNGf.exe
  2⤵
  PID:14736
- C:\Windows\System\qHImKzf.exe
  C:\Windows\System\qHImKzf.exe
  2⤵
  PID:14768
- C:\Windows\System\POOwwqU.exe
  C:\Windows\System\POOwwqU.exe
  2⤵
  PID:14792
- C:\Windows\System\nMjSoAx.exe
  C:\Windows\System\nMjSoAx.exe
  2⤵
  PID:14816
- C:\Windows\System\TqAWFZU.exe
  C:\Windows\System\TqAWFZU.exe
  2⤵
  PID:14840
- C:\Windows\System\TPAnrHZ.exe
  C:\Windows\System\TPAnrHZ.exe
  2⤵
  PID:14872
- C:\Windows\System\tezWHsC.exe
  C:\Windows\System\tezWHsC.exe
  2⤵
  PID:14900
- C:\Windows\System\aHtkFtF.exe
  C:\Windows\System\aHtkFtF.exe
  2⤵
  PID:14924
- C:\Windows\System\WggIyKk.exe
  C:\Windows\System\WggIyKk.exe
  2⤵
  PID:14940
- C:\Windows\System\KvDcKpk.exe
  C:\Windows\System\KvDcKpk.exe
  2⤵
  PID:14960
- C:\Windows\System\nPZNZGy.exe
  C:\Windows\System\nPZNZGy.exe
  2⤵
  PID:14976
- C:\Windows\System\cQHrgdZ.exe
  C:\Windows\System\cQHrgdZ.exe
  2⤵
  PID:15004
- C:\Windows\System\nHDtqNY.exe
  C:\Windows\System\nHDtqNY.exe
  2⤵
  PID:15028
- C:\Windows\System\MMRhUzD.exe
  C:\Windows\System\MMRhUzD.exe
  2⤵
  PID:15060
- C:\Windows\System\VHOEYaW.exe
  C:\Windows\System\VHOEYaW.exe
  2⤵
  PID:15088
- C:\Windows\System\BlpFUTZ.exe
  C:\Windows\System\BlpFUTZ.exe
  2⤵
  PID:15112
- C:\Windows\System\XzhHRUC.exe
  C:\Windows\System\XzhHRUC.exe
  2⤵
  PID:15132
- C:\Windows\System\FpbKRzm.exe
  C:\Windows\System\FpbKRzm.exe
  2⤵
  PID:15168
- C:\Windows\System\PruJuMi.exe
  C:\Windows\System\PruJuMi.exe
  2⤵
  PID:15204
- C:\Windows\System\LVsfPRQ.exe
  C:\Windows\System\LVsfPRQ.exe
  2⤵
  PID:15224
- C:\Windows\System\aIplBbg.exe
  C:\Windows\System\aIplBbg.exe
  2⤵
  PID:15240
- C:\Windows\System\wZRqFMU.exe
  C:\Windows\System\wZRqFMU.exe
  2⤵
  PID:15264
- C:\Windows\System\uPVjWTy.exe
  C:\Windows\System\uPVjWTy.exe
  2⤵
  PID:15288
- C:\Windows\System\bDslPVo.exe
  C:\Windows\System\bDslPVo.exe
  2⤵
  PID:15312
- C:\Windows\System\NZGWrbi.exe
  C:\Windows\System\NZGWrbi.exe
  2⤵
  PID:15336
- C:\Windows\System\jsQUSxK.exe
  C:\Windows\System\jsQUSxK.exe
  2⤵
  PID:13684
- C:\Windows\System\xrUVUHh.exe
  C:\Windows\System\xrUVUHh.exe
  2⤵
  PID:13716
- C:\Windows\System\umnpilP.exe
  C:\Windows\System\umnpilP.exe
  2⤵
  PID:12512
- C:\Windows\System\bjsguVK.exe
  C:\Windows\System\bjsguVK.exe
  2⤵
  PID:11952
- C:\Windows\System\egtFRLQ.exe
  C:\Windows\System\egtFRLQ.exe
  2⤵
  PID:13812
- C:\Windows\System\PcmOIgH.exe
  C:\Windows\System\PcmOIgH.exe
  2⤵
  PID:12136
- C:\Windows\System\dqXtaSV.exe
  C:\Windows\System\dqXtaSV.exe
  2⤵
  PID:12928
- C:\Windows\System\NQTUdzO.exe
  C:\Windows\System\NQTUdzO.exe
  2⤵
  PID:13928
- C:\Windows\System\CUlCjws.exe
  C:\Windows\System\CUlCjws.exe
  2⤵
  PID:13388
- C:\Windows\System\tJUcgIM.exe
  C:\Windows\System\tJUcgIM.exe
  2⤵
  PID:14008
- C:\Windows\System\KVLCwjt.exe
  C:\Windows\System\KVLCwjt.exe
  2⤵
  PID:13500
- C:\Windows\System\eAhjMRu.exe
  C:\Windows\System\eAhjMRu.exe
  2⤵
  PID:13604
- C:\Windows\System\ZrkWOhR.exe
  C:\Windows\System\ZrkWOhR.exe
  2⤵
  PID:13560
- C:\Windows\System\aQXfFUP.exe
  C:\Windows\System\aQXfFUP.exe
  2⤵
  PID:14352
- C:\Windows\System\ChhpcPD.exe
  C:\Windows\System\ChhpcPD.exe
  2⤵
  PID:14380
- C:\Windows\System\LprtyBa.exe
  C:\Windows\System\LprtyBa.exe
  2⤵
  PID:12876
- C:\Windows\System\BpUQBCx.exe
  C:\Windows\System\BpUQBCx.exe
  2⤵
  PID:14640
- C:\Windows\System\cPlrEQr.exe
  C:\Windows\System\cPlrEQr.exe
  2⤵
  PID:14692
- C:\Windows\System\ZlbzZVT.exe
  C:\Windows\System\ZlbzZVT.exe
  2⤵
  PID:12040
- C:\Windows\System\XivRVSl.exe
  C:\Windows\System\XivRVSl.exe
  2⤵
  PID:13052
- C:\Windows\System\tQDlnWv.exe
  C:\Windows\System\tQDlnWv.exe
  2⤵
  PID:14896
- C:\Windows\System\UwwilMV.exe
  C:\Windows\System\UwwilMV.exe
  2⤵
  PID:14404
- C:\Windows\System\pUXnacl.exe
  C:\Windows\System\pUXnacl.exe
  2⤵
  PID:14476
- C:\Windows\System\nVUhdQE.exe
  C:\Windows\System\nVUhdQE.exe
  2⤵
  PID:15184
- C:\Windows\System\pVGRpwn.exe
  C:\Windows\System\pVGRpwn.exe
  2⤵
  PID:14588
- C:\Windows\System\LDZmvhX.exe
  C:\Windows\System\LDZmvhX.exe
  2⤵
  PID:14616
- C:\Windows\System\auhpWNN.exe
  C:\Windows\System\auhpWNN.exe
  2⤵
  PID:15436
- C:\Windows\System\VhtzLYU.exe
  C:\Windows\System\VhtzLYU.exe
  2⤵
  PID:15632
- C:\Windows\System\vpdKyMZ.exe
  C:\Windows\System\vpdKyMZ.exe
  2⤵
  PID:15664
- C:\Windows\System\avBoqJH.exe
  C:\Windows\System\avBoqJH.exe
  2⤵
  PID:15700
- C:\Windows\System\yLKrPiY.exe
  C:\Windows\System\yLKrPiY.exe
  2⤵
  PID:15744
- C:\Windows\System\kegBUTs.exe
  C:\Windows\System\kegBUTs.exe
  2⤵
  PID:15780
- C:\Windows\System\DIUZhYP.exe
  C:\Windows\System\DIUZhYP.exe
  2⤵
  PID:15800
- C:\Windows\System\VlNpPhb.exe
  C:\Windows\System\VlNpPhb.exe
  2⤵
  PID:15816
- C:\Windows\System\XtvpZYm.exe
  C:\Windows\System\XtvpZYm.exe
  2⤵
  PID:15832
- C:\Windows\System\tzVBqgI.exe
  C:\Windows\System\tzVBqgI.exe
  2⤵
  PID:15868
- C:\Windows\System\ysqPtrk.exe
  C:\Windows\System\ysqPtrk.exe
  2⤵
  PID:15896
- C:\Windows\System\PReHbth.exe
  C:\Windows\System\PReHbth.exe
  2⤵
  PID:15956
- C:\Windows\System\hmMRDup.exe
  C:\Windows\System\hmMRDup.exe
  2⤵
  PID:15972
- C:\Windows\System\ERWnjXT.exe
  C:\Windows\System\ERWnjXT.exe
  2⤵
  PID:15988
- C:\Windows\System\XAxsGTF.exe
  C:\Windows\System\XAxsGTF.exe
  2⤵
  PID:16012
- C:\Windows\System\CxvutKd.exe
  C:\Windows\System\CxvutKd.exe
  2⤵
  PID:16028
- C:\Windows\System\EMnhVPC.exe
  C:\Windows\System\EMnhVPC.exe
  2⤵
  PID:16044
- C:\Windows\System\OLUatxJ.exe
  C:\Windows\System\OLUatxJ.exe
  2⤵
  PID:16060
- C:\Windows\System\hYSFPrg.exe
  C:\Windows\System\hYSFPrg.exe
  2⤵
  PID:16076
- C:\Windows\System\NcfjxLj.exe
  C:\Windows\System\NcfjxLj.exe
  2⤵
  PID:16092
- C:\Windows\System\fjjRpyc.exe
  C:\Windows\System\fjjRpyc.exe
  2⤵
  PID:16108
- C:\Windows\System\JzJEVzh.exe
  C:\Windows\System\JzJEVzh.exe
  2⤵
  PID:16132
- C:\Windows\System\yMpQwNn.exe
  C:\Windows\System\yMpQwNn.exe
  2⤵
  PID:16152
- C:\Windows\System\ouBJDNJ.exe
  C:\Windows\System\ouBJDNJ.exe
  2⤵
  PID:16180
- C:\Windows\System\NIvpstm.exe
  C:\Windows\System\NIvpstm.exe
  2⤵
  PID:16212
- C:\Windows\System\AMqYrjp.exe
  C:\Windows\System\AMqYrjp.exe
  2⤵
  PID:16236
- C:\Windows\System\dtYzVZE.exe
  C:\Windows\System\dtYzVZE.exe
  2⤵
  PID:16256
- C:\Windows\System\DVwIDqI.exe
  C:\Windows\System\DVwIDqI.exe
  2⤵
  PID:16280
- C:\Windows\System\FVCMRij.exe
  C:\Windows\System\FVCMRij.exe
  2⤵
  PID:16296
- C:\Windows\System\yVcOSlG.exe
  C:\Windows\System\yVcOSlG.exe
  2⤵
  PID:16316
- C:\Windows\System\xGvtoBJ.exe
  C:\Windows\System\xGvtoBJ.exe
  2⤵
  PID:16332
- C:\Windows\System\FifrDLj.exe
  C:\Windows\System\FifrDLj.exe
  2⤵
  PID:16352
- C:\Windows\System\yHUXPVp.exe
  C:\Windows\System\yHUXPVp.exe
  2⤵
  PID:16376
- C:\Windows\System\unkxLRF.exe
  C:\Windows\System\unkxLRF.exe
  2⤵
  PID:14412
- C:\Windows\System\IUeuDpb.exe
  C:\Windows\System\IUeuDpb.exe
  2⤵
  PID:15108
- C:\Windows\System\aWvMCtC.exe
  C:\Windows\System\aWvMCtC.exe
  2⤵
  PID:15652
- C:\Windows\System\pdorAqK.exe
  C:\Windows\System\pdorAqK.exe
  2⤵
  PID:15444
- C:\Windows\System\ovPpqhz.exe
  C:\Windows\System\ovPpqhz.exe
  2⤵
  PID:14556
- C:\Windows\System\jSrFBhn.exe
  C:\Windows\System\jSrFBhn.exe
  2⤵
  PID:12456
- C:\Windows\System\ZGcAErI.exe
  C:\Windows\System\ZGcAErI.exe
  2⤵
  PID:12232
- C:\Windows\System\JaMMcZT.exe
  C:\Windows\System\JaMMcZT.exe
  2⤵
  PID:15676
- C:\Windows\System\jsXcamz.exe
  C:\Windows\System\jsXcamz.exe
  2⤵
  PID:15696
- C:\Windows\System\SftduNC.exe
  C:\Windows\System\SftduNC.exe
  2⤵
  PID:15756
- C:\Windows\System\Nlhijab.exe
  C:\Windows\System\Nlhijab.exe
  2⤵
  PID:15796
- C:\Windows\System\UDVxvkp.exe
  C:\Windows\System\UDVxvkp.exe
  2⤵
  PID:16040
- C:\Windows\System\UqYffKI.exe
  C:\Windows\System\UqYffKI.exe
  2⤵
  PID:15504
- C:\Windows\System\egvCLbu.exe
  C:\Windows\System\egvCLbu.exe
  2⤵
  PID:15528
- C:\Windows\System\gSXwaUT.exe
  C:\Windows\System\gSXwaUT.exe
  2⤵
  PID:16072
- C:\Windows\System\FmorBps.exe
  C:\Windows\System\FmorBps.exe
  2⤵
  PID:15604
- C:\Windows\System\eBhoHGE.exe
  C:\Windows\System\eBhoHGE.exe
  2⤵
  PID:15640
- C:\Windows\System\yqmGVYS.exe
  C:\Windows\System\yqmGVYS.exe
  2⤵
  PID:16160
- C:\Windows\System\GRmrEzr.exe
  C:\Windows\System\GRmrEzr.exe
  2⤵
  PID:16220
- C:\Windows\System\OnhgYjU.exe
  C:\Windows\System\OnhgYjU.exe
  2⤵
  PID:16036
- C:\Windows\System\SDuoOxX.exe
  C:\Windows\System\SDuoOxX.exe
  2⤵
  PID:15884
- C:\Windows\System\fLtMyjK.exe
  C:\Windows\System\fLtMyjK.exe
  2⤵
  PID:15964
- C:\Windows\System\bmVotXM.exe
  C:\Windows\System\bmVotXM.exe
  2⤵
  PID:14728
- C:\Windows\System\LgRRypU.exe
  C:\Windows\System\LgRRypU.exe
  2⤵
  PID:16140
- C:\Windows\System\LJwbnzY.exe
  C:\Windows\System\LJwbnzY.exe
  2⤵
  PID:15908
- C:\Windows\System\GARyJXU.exe
  C:\Windows\System\GARyJXU.exe
  2⤵
  PID:13896
- C:\Windows\System\APOfTuu.exe
  C:\Windows\System\APOfTuu.exe
  2⤵
  PID:16068
- C:\Windows\System\awkzVQk.exe
  C:\Windows\System\awkzVQk.exe
  2⤵
  PID:16024
- C:\Windows\System\UIEGGzK.exe
  C:\Windows\System\UIEGGzK.exe
  2⤵
  PID:16204
- C:\Windows\System\UphaUlV.exe
  C:\Windows\System\UphaUlV.exe
  2⤵
  PID:16408
- C:\Windows\System\YIUjALu.exe
  C:\Windows\System\YIUjALu.exe
  2⤵
  PID:16428
- C:\Windows\System\XVJzRLF.exe
  C:\Windows\System\XVJzRLF.exe
  2⤵
  PID:16452
- C:\Windows\System\WhDnrrm.exe
  C:\Windows\System\WhDnrrm.exe
  2⤵
  PID:16476
- C:\Windows\System\ZlTkovh.exe
  C:\Windows\System\ZlTkovh.exe
  2⤵
  PID:16496
- C:\Windows\System\PlapaDy.exe
  C:\Windows\System\PlapaDy.exe
  2⤵
  PID:16520
- C:\Windows\System\zTsVMGg.exe
  C:\Windows\System\zTsVMGg.exe
  2⤵
  PID:16544
- C:\Windows\System\TYTsYZl.exe
  C:\Windows\System\TYTsYZl.exe
  2⤵
  PID:16572
- C:\Windows\System\AyCLeqV.exe
  C:\Windows\System\AyCLeqV.exe
  2⤵
  PID:16608
- C:\Windows\System\JUAdiqL.exe
  C:\Windows\System\JUAdiqL.exe
  2⤵
  PID:16624
- C:\Windows\System\CEbzbre.exe
  C:\Windows\System\CEbzbre.exe
  2⤵
  PID:16652
- C:\Windows\System\YmqAyjQ.exe
  C:\Windows\System\YmqAyjQ.exe
  2⤵
  PID:16676
- C:\Windows\System\WKdXTma.exe
  C:\Windows\System\WKdXTma.exe
  2⤵
  PID:16696
- C:\Windows\System\bLxoOlb.exe
  C:\Windows\System\bLxoOlb.exe
  2⤵
  PID:16716
- C:\Windows\System\mDOaOhZ.exe
  C:\Windows\System\mDOaOhZ.exe
  2⤵
  PID:16740
- C:\Windows\System\egkcZkr.exe
  C:\Windows\System\egkcZkr.exe
  2⤵
  PID:16756
- C:\Windows\System\uWtTeoC.exe
  C:\Windows\System\uWtTeoC.exe
  2⤵
  PID:16788
- C:\Windows\System\sIndvBr.exe
  C:\Windows\System\sIndvBr.exe
  2⤵
  PID:16812
- C:\Windows\System\tXprxAz.exe
  C:\Windows\System\tXprxAz.exe
  2⤵
  PID:16828
- C:\Windows\System\zsUUKkY.exe
  C:\Windows\System\zsUUKkY.exe
  2⤵
  PID:16856
- C:\Windows\System\sApuZAS.exe
  C:\Windows\System\sApuZAS.exe
  2⤵
  PID:16880
- C:\Windows\System\pocKtfj.exe
  C:\Windows\System\pocKtfj.exe
  2⤵
  PID:16912
- C:\Windows\System\jepjtJg.exe
  C:\Windows\System\jepjtJg.exe
  2⤵
  PID:16932
- C:\Windows\System\FdCTqYx.exe
  C:\Windows\System\FdCTqYx.exe
  2⤵
  PID:16964
- C:\Windows\System\qSBxrAw.exe
  C:\Windows\System\qSBxrAw.exe
  2⤵
  PID:17000
- C:\Windows\System\JeZXmRf.exe
  C:\Windows\System\JeZXmRf.exe
  2⤵
  PID:17020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AXizBOU.exe

Filesize
1.3MB

MD5
60f4c1ff52a665094b72d67e93945a08

SHA1
f883bfd791f30a4cfb52896a24e1392a3f06e89e

SHA256
b530cef12af75109a9a4aee2d96f4b2a4ab9e8a125c6b311907c5317f4a1f587

SHA512
54e0bbaac20a453879f217c132618552dcd58d70cc7b8bbffcaedfb806e21e0128c60e1501691b992303ccea2b7f66101339319522c195e8beaa8da2caa967c4

Download Submit
C:\Windows\System\BpuqyRR.exe

Filesize
1.3MB

MD5
2dd96b63ad04e4f1583ce65b7dc01242

SHA1
c39b94c09643db473d8fd83e429579542886c1cd

SHA256
6e8de908a8addd9e21a891fe4123a2c1921cefbe92debef47641d85102fc9ff3

SHA512
30e58962b6b447891685dbab60107326dbdf3c4c97c8b446277a52416fb95de94a0dbfcff7cedcbfa0af22119fc6e17f8a59dd87f00376f55aee42deb115d929

Download Submit
C:\Windows\System\DnWHifP.exe

Filesize
1.3MB

MD5
80d8ec3fbe5bc996d83e9c88feb3749e

SHA1
ddab948a7dfce8b24b72ee84d484a70f0720b527

SHA256
f5743d8bb6ba8925596997702503374d80c87955cdbe35b6b56422bc813b558a

SHA512
91b5898027e869f2af74061debbbede5db6c42c157d5bdcf0614780d6a962dc96cde8bdd98e724c703765cc0511537e96182a7257c578b6d6eb940ac0009e3e1

Download Submit
C:\Windows\System\FdEjWOD.exe

Filesize
1.3MB

MD5
037751c1f37e86c014a33334b6ea3159

SHA1
ca1323e4e2234871c153a2eeec9bbbce4d3c249a

SHA256
b9149fab5cde197eb0d93f4ba34fe1708fd114a6169656868cf40960cb62c7e4

SHA512
a873babde44f40c676ce33a1d75df3e689c310bd28ebf33f1b745c49834483cddfdfb179f49fb999dfe58d2a45bae4d118bbbd3cd52cfcd64cc8f8102b371407

Download Submit
C:\Windows\System\GgfPHOW.exe

Filesize
1.3MB

MD5
620b15e30725dabd34d123762a95d545

SHA1
74392cd5661d6d2f1fcc41b68600e3b649e549ca

SHA256
a05860e34396beb2fda4516e8a5dbed0f9f0a75dd78d0e2b6a51645ae0a4c199

SHA512
68eb69b6e7979130aa2e317adf00091cd7711a914074279fd1362765c74071b96e88f4c2cc46f4bedc952fbc475e900dbe089a249c38cb3c2f33247303feaa81

Download Submit
C:\Windows\System\GiqKqQV.exe

Filesize
1.3MB

MD5
59b40e7e1fdc67c7a3ffa82c5827da0d

SHA1
6c7c1d8903a28ef6f36e429aae2e67558644d866

SHA256
31f7c4a4ff03fbe5be9c9e3a98b0a394f625b00bdecc55c8489927308ae255cf

SHA512
6344ce95255d233147c763b2cd39a7a8747df0443a5ca948cb270165318efef312736d227270510696e5cc313fbe91f0c21086fb7b72279310e757a3ea4ffe82

Download Submit
C:\Windows\System\JAgdnRo.exe

Filesize
1.3MB

MD5
4703cfa40373ae6ec3af9deafb64a829

SHA1
c2034c6cd969c33d6082e98d8af7c726d4b39a28

SHA256
3cf02d6160958ac25f9940d942fcfd7669a5b938c137b472e8c606f4cc480862

SHA512
e977c00bb6478cbdaf6273be0846c750a35d5f0b1047c6c3fa8565b026b614cafe4cba5e214f9786e1937b9e27992b4a857b6684e323671901253a042be039c8

Download Submit
C:\Windows\System\KLcBMbI.exe

Filesize
1.3MB

MD5
342348675eb64efdf367e945cd9c23f5

SHA1
1dc7586f74581620b6889176c7bd9648c8bdd63f

SHA256
4d32658dbfdcaee7baa77bf0721403d7a89636195883fa556b73ef37763dd471

SHA512
f7747bae7b6d070576bf6fa16d0d2d60000f3eadab990c2c705e658b73fd9eaed2a89b878f9cddea8ccd1a9bc72496dc58edc23fab5a5c8a8b4881e7d284f370

Download Submit
C:\Windows\System\LKNZIrh.exe

Filesize
1.3MB

MD5
96f8f34a33d65eb31a6007f55c2afb58

SHA1
87db51960797be23d6ed3ef518f7e5ec02b4a7af

SHA256
191ccdc2dedff3306e527eb1f02694bcfd9df354ead77165eaf8aa0d36e43714

SHA512
6cf228778cf9ad1616fa515f6e3f8408ae24d6bc0a97ff740a76ac5e88245c2df0311d8bed93249b3022f154aa322384fa551d437650af2ac5a09c0dea3bc1bf

Download Submit
C:\Windows\System\LrdfqXS.exe

Filesize
1.3MB

MD5
aeb09e6363d3736156fca22bebf5c885

SHA1
a7d2050f6f4a9ad8d5327ce8de91756f26f0d658

SHA256
d6539d3d223ced08f824ac2175310f8bcc1189ef1ec77b78ff81d3773ffb2fb8

SHA512
b81add012474bfe616db2a163704c586dc1c7bba9d5fc9cfca8ea238624e3869432428f9b93fbd1b3538cea9b8e0b914e88c447a3e33aa1f2e93b9a7abeaed62

Download Submit
C:\Windows\System\NPBwTqP.exe

Filesize
1.3MB

MD5
8b863793908d6147f559f3c498f4940b

SHA1
a68e0e1cc24cedeb9372709fe815e12e8f5f87df

SHA256
778408c41812753acc768df30c0499c247bc463fd63eff843087e502a8909e9b

SHA512
743e8bddce594a1f6678464032a34321f080ce17084c14d60f40b6e6c8d97b78f2898e5423f77dbe316f466e946f8178f31ea4e7bf0ceea248f19e1f8f1a9bba

Download Submit
C:\Windows\System\Nejozvt.exe

Filesize
1.3MB

MD5
a75566f3065df3af2ff671bea146fce5

SHA1
92ebecf73c2dcfbbce3219e06f333dbd4a338800

SHA256
567ef2ca4ff142b43fdbcc3351ea5f0837a115917e3f161842e20c5b72050cbe

SHA512
1179d449632da9424f645c74fb199a8f9de715332ec48e21eb562f0f1eb20ff80a8f714b58e862d6e8f095648209ac6bc59ca5adeaf3b6f557fa1f667cb59eac

Download Submit
C:\Windows\System\QRMvFLP.exe

Filesize
1.3MB

MD5
a522b89f16c5ba9bfe0ca88e7111cbc2

SHA1
e5a825f6f0f0ce8d57b3013012e25825c62f75af

SHA256
c538004a63b6a3fadcb5c38440f8ee842d161314ae37f5125c3d4b56d8c792c6

SHA512
45e1a164b3111af7badf6acd50b81b872c3c29d293bfc6f4948650cf0b01059ca036d52d67f9d2f049c7212c553fd9b5259c963743e6eaa4d4acb3df592a1ceb

Download Submit
C:\Windows\System\RNXajOf.exe

Filesize
1.3MB

MD5
ad5fd62faf5a9ff8a94056123f5d6844

SHA1
d257156cd83a233ba8d5094734e2374110f9ab0f

SHA256
3be8faa113a7316262a3e41cce9734d986e4d882c4632604e28a1d82b120bb18

SHA512
856f366619ee1b19be4fd52db6431cc32e802d8822fade8a2741eced927f4573711837755fc3ea2cb47004671e31905a4fdc827ea5302e192255ef0f78342858

Download Submit
C:\Windows\System\TzxtqWc.exe

Filesize
1.3MB

MD5
201bbef4700114ed9a95371d44e322ad

SHA1
0909d93a122784209b426f5610f10ca3caacfe44

SHA256
f19f8b63be8ff3109d1fc0d4b9e232989335bca67e67abb33ac4abf9e0e9de3f

SHA512
7b566e9ee63157f1328ff1326b4a83799cc2240d6cc47cde905492c1357a9ff84e50f9d863f38e80fd37184bd787ad89d371f1d5195ed74992e6e2a4ba68857e

Download Submit
C:\Windows\System\UnJPQfs.exe

Filesize
1.3MB

MD5
d879ba97457abf5c75aa0cbebff03db5

SHA1
8fdb0efb6ab1964c69aaada33aceb408deb0f49c

SHA256
8c56d3bea202eb918caeddc20d7737f3d9a82bfc069043161cdc4f33982f7fdd

SHA512
1f1fd31722e25efbe511c6c38a9a9e95f9e42ebeb1d11f28fdb7d1fc11cd32c62b1167b9c067a3965ede3b29384a99a096cd590d5e9da8e7b854fcaca5fe3881

Download Submit
C:\Windows\System\WZaVAhX.exe

Filesize
1.3MB

MD5
ecf8d412edfcdbd4c175e88e09e01ff7

SHA1
564c6b6152336d58355699c540a80623e37fe351

SHA256
9368ff9fe076e55464b15ee8f68c473f53e13bc81effd4798a2be74a6100ab42

SHA512
dac063f9c98f29aa3a4fd0fae1ba93549632faf74b33bc2520f3817a7adfb466bb499909880910a0fa63a3bc88b312f4ec27a3d58fd8b575e9ef0f420ee6f594

Download Submit
C:\Windows\System\YCIPWxR.exe

Filesize
1.3MB

MD5
ce3e747cf45baf1ff19915065119a962

SHA1
c2f9ef2812cbcad1638eb19e7680fd87353b2d80

SHA256
54b2f7bf269f46de45bd6e5d45100e9cedee2dc9c59f76ef8b94af90049ea4b4

SHA512
09e644cd5b89f52882f680907c358a08fe363a35420ebcbfcfd509745336b6f317a330af916cfd9afb4ecc8259931af6d73ac0914b068cf976932ab0c32546d7

Download Submit
C:\Windows\System\afWZgOf.exe

Filesize
1.3MB

MD5
c45d20f828b142570ff7af3f4b98403f

SHA1
ee6abed1b3020cfb7981bbfb5af2033f114f3ac5

SHA256
eeee35984048ad3b5dcaba7b5515ca32f79fbd87a9bad235af6cf6ce3f3022dc

SHA512
228d529e6eb06d3eb8a8468a0ac486535a7c0f400b7ebe155f2e7c725c5657c44f27bf24ee64d56ab68972af79345353b62db0cbf7c3e2654553f7a3c591289c

Download Submit
C:\Windows\System\arCYEPM.exe

Filesize
1.3MB

MD5
7f56d68c3a3f4efb2dbf88b2da857226

SHA1
6b7bd52cf3ed5d24a5b55ab952fe9b907c9f9934

SHA256
6d09647f30e9ff3cfa26f87a0adf18ede535381957ac5d30516902d961e25fd5

SHA512
f3d739b5c697ad4f5157988476e7f162923ac0b19bbf3b1714322db90133288bb3d76719ed8583afb21abc1d55232028de41da8d202bd3cb035d4e70722f2e02

Download Submit
C:\Windows\System\fMjaYZN.exe

Filesize
1.3MB

MD5
f1ff1e4cd4ce7c61dea56e1596fb6f9d

SHA1
a17256d458d7b3b7565742f35a21fed44a0750ca

SHA256
7b7d1cd0f919dfdba0e210d72fbee2effa789e702b0ccf62bd957c07209a5fd2

SHA512
03050fccf384297556e8b107a139ab96366b0e7b92dbf1178310dd7a5c6219fae82d62007314648dff547887ea55dd5f44e824c0a83c9ca17ebd1d55802f7b62

Download Submit
C:\Windows\System\gCcimyW.exe

Filesize
1.3MB

MD5
fed8a371837ea73f5030d48d3f116ef2

SHA1
7c570c9c60fede28562750726e0ff97c42fabf1a

SHA256
cd7ab16dd7b26887362281bd09ecccf31ec6a48752d45cd6dd4f9a7c78fd36c5

SHA512
3d706bd4f4da5e55ed49d896eb507fefff6c5295aca28ea297692e3d7e51380d77c1369dc96ca9285ddcbb003ee911d300a7d70767e136809afb7e1e17147cd9

Download Submit
C:\Windows\System\hqQuwIv.exe

Filesize
1.3MB

MD5
82c3e3e52f292bff5b39206a0dc40c1f

SHA1
935d347aa11a89cf6a9fca1d50f39b3520df36d6

SHA256
2707ba8aa615fbf344c3d3cca61d352cb0747277cf5aa33d3e2466c98e7afa4a

SHA512
898a6eec32495fb688abc0981e624cfa659f0b6b2fbfd562b854484cc51258619ae504e677f37abac8ed457c67d1d1ad23f3bfc8ff30348e877a38e2feac972c

Download Submit
C:\Windows\System\nUmXhik.exe

Filesize
1.3MB

MD5
758389f1f51f4e56fff7d7733efd095a

SHA1
a72f3f14b6e37f5204eb4099986f5b3a9b1cd5b2

SHA256
f6112a2ba9b86e1defe2bdc5e42715bf8c456f5f94fa7a56b6933c38b9db6542

SHA512
eca3aa13133be4b9da085d68380128052e7812faf07cde0c6a92b442b69f634f6ae329e17905919eb30d605532f642ba24166b30f206a3e50d8d241d7323a393

Download Submit
C:\Windows\System\otkNWNY.exe

Filesize
1.3MB

MD5
0b024ca620f6f90e9aaa872dbcafa101

SHA1
051a15b9b02180dd40efff7104b81ef55629ec34

SHA256
6e87366ad6371ab54f8b9afe4b76f48bc32d11b12f29c2507b7810eb77d3b88f

SHA512
c32063ab4ca9a854a800a276b0f7af008fbeb0e5eeb35dfb31fc5f0c03d75acf05e692ca01721f31bc6eda23566c06adcd3e09fa7cb5cad40e0237eae96e5813

Download Submit
C:\Windows\System\rKWcjIC.exe

Filesize
1.3MB

MD5
87ffb5a79adca12055defc0b3b255255

SHA1
2285f2457cf870ad7730a9c6de2b1fdac3b86704

SHA256
5d98366701f98e8130bd6ac94c829f290b793df01b384443f08ff6f6b53bd6c8

SHA512
d643d19de008fba247ada120a07c9dd5437ebc6daf513e6a7f2071355cc53a618662952b833bde3895fcd0327efd9d898b20e9db14036ac5410c174506675848

Download Submit
C:\Windows\System\rUFqBdL.exe

Filesize
1.3MB

MD5
8976ff3b04e3775487eeab2efee45c3e

SHA1
666fe68fd595f3db86922588e01b2729d409831a

SHA256
38df3b5cf94c51c8cbc9f00ac2385e3211d5c8c7cb2fbad22a886f2cb3d83940

SHA512
7fbd474f7b55e5f937bc3ac9d89f78b23ef272c58a81d9ccfd2094ff8409a5028953ec8cefda9af47c4215a7f7444b65ce8872b56cdaacfdd4d984cae5e4c12a

Download Submit
C:\Windows\System\sTkkWot.exe

Filesize
1.3MB

MD5
7bb68fd6dd5cf98fe0b02dc1504a99c4

SHA1
f928f6ed9361bfd6a1a0ec53756afaf788f0d784

SHA256
5c523276defe3c319acd149f77592dc4e62a13e201698586b8d02b13175b8b42

SHA512
4dedd5ea02fb377fb5469f3ffc57e0c9aadbcaa39f0e6a67b27caf4fe07c3b15331a49faf11d4d2021f2779a691d51efc484eb9c4d6094ce2f1a54111cc020df

Download Submit
C:\Windows\System\tMTbiNX.exe

Filesize
1.3MB

MD5
42b47de3b0cc1be5f95a7a4241aedd72

SHA1
313ffdcbcff3c8ddd0d684d745f89f6f548915b2

SHA256
def4c56322de2fd6af2215178ecc3afd90161c5707f427b009e5f574fcf1566d

SHA512
eacb5f3c83532b1634650182c795e274d68674db8b487b174003d2923e947d27da4e8557a903f5c340bdb70b605a5dda7dd7a005d3bd2ce7e4795c5ca14452b3

Download Submit
C:\Windows\System\uAOtySs.exe

Filesize
1.3MB

MD5
b3c1c1a4316c71fbcde6dc6c26a42889

SHA1
16f62d1a60d5ee8b664f03d475587677c0829120

SHA256
0d8de4a17237170cba06c66a9cf313ff0c6a03d37749c03aab0c8cefed9fcd8d

SHA512
c7e5dbf0d811242701923151b92ee2659683722f948875956776149255a7b11675d3d86a4b310c5b008380d1324d74c774023aacbd3029a2a4417d5cabfe5ba4

Download Submit
C:\Windows\System\vIIBKqf.exe

Filesize
1.3MB

MD5
c8b232254f283fed17ae0ed5828e14ee

SHA1
927b1d6d98f29d93b39045e20fe652cab23d147c

SHA256
232552e21dd872e7b7bea56b31c310887d18c8fe1bb27109a04fa9f5ba065665

SHA512
f78edc1fa3696313916939c463849025fd224a60f8b9358d3eca362a2c2cd023bfcf0763043df47edde978b36319f059ce4737c5f99d194f028893af5facac2d

Download Submit
C:\Windows\System\wLwucqi.exe

Filesize
1.3MB

MD5
4cbe8480e8e5b2832fac3320f80e67f0

SHA1
2a6275ae774ea9d70eeb189dfd8a61fbe2ba6902

SHA256
638ff9321a0f02506549850aebcbcf70423cd735e7024186dd8c328bf525f026

SHA512
44901a951212eded4aae3b30ddd9cce853564ed43e2a71a5cd01f7a9eba422eea428e6c201dfe900abde152db6fe4a922427dc0097cb4e680ac1f1136cff3820

Download Submit
C:\Windows\System\zZlAshB.exe

Filesize
1.3MB

MD5
ffd4f7e6fbd25a2f34c2571a7dc8c05e

SHA1
7f8b1cd7790c29210b4210a797035bc92a893caa

SHA256
6a1d0b786c202b57824d344a38c629e1ef4cecab63cab785ec306e1f129cf0e3

SHA512
bfa3a54c91cc2fd9d035a0db2e38c9f1048b59595aef1dd6e4a09d8d91779e834169a9f63bebfed0af54c05bc0e8f8931e3b7af2092aa9b1378c63ffbb156356

Download Submit
memory/2796-0-0x000001C03E7B0000-0x000001C03E7C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads