xmrig | bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd

Analysis

max time kernel
123s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
Size

1.7MB
MD5

b28f2b2453ffa3391b426f244f3da6fe
SHA1

af4ba9692ca37e14883185778abc66c98e929560
SHA256

bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd
SHA512

3a174741ad6ceca90c6743d2264c3a6b51ade261c45d51f09b6d3ac14b1f5418d28d4cde454fe4827c7156cdbbd875b3975867236c4e56619497b1d6ed160d5e
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZlCpfwW:GemTLkNdfE0pZy4

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b0f-4.dat	xmrig
behavioral2/files/0x000b000000023b6d-9.dat	xmrig
behavioral2/files/0x000a000000023b71-8.dat	xmrig
behavioral2/files/0x000a000000023b73-18.dat	xmrig
behavioral2/files/0x000a000000023b74-23.dat	xmrig
behavioral2/files/0x000a000000023b75-28.dat	xmrig
behavioral2/files/0x000a000000023b76-35.dat	xmrig
behavioral2/files/0x000a000000023b77-40.dat	xmrig
behavioral2/files/0x000a000000023b78-45.dat	xmrig
behavioral2/files/0x000a000000023b7a-54.dat	xmrig
behavioral2/files/0x000a000000023b7b-60.dat	xmrig
behavioral2/files/0x000a000000023b79-50.dat	xmrig
behavioral2/files/0x000b000000023b6e-65.dat	xmrig
behavioral2/files/0x000a000000023b7e-80.dat	xmrig
behavioral2/files/0x000a000000023b81-93.dat	xmrig
behavioral2/files/0x000a000000023b83-105.dat	xmrig
behavioral2/files/0x000a000000023b8a-140.dat	xmrig
behavioral2/files/0x000a000000023b8c-150.dat	xmrig
behavioral2/files/0x000a000000023b8e-160.dat	xmrig
behavioral2/files/0x000a000000023b8d-155.dat	xmrig
behavioral2/files/0x000a000000023b8b-145.dat	xmrig
behavioral2/files/0x000a000000023b89-135.dat	xmrig
behavioral2/files/0x000a000000023b88-130.dat	xmrig
behavioral2/files/0x000a000000023b87-125.dat	xmrig
behavioral2/files/0x000a000000023b86-120.dat	xmrig
behavioral2/files/0x000a000000023b85-115.dat	xmrig
behavioral2/files/0x000a000000023b84-110.dat	xmrig
behavioral2/files/0x000a000000023b82-100.dat	xmrig
behavioral2/files/0x000a000000023b80-90.dat	xmrig
behavioral2/files/0x000a000000023b7f-85.dat	xmrig
behavioral2/files/0x000a000000023b7d-75.dat	xmrig
behavioral2/files/0x000a000000023b7c-70.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4420	RpZMxMO.exe
4460	sUYiAbP.exe
4272	cUFYTZE.exe
1776	TfVUAJP.exe
1968	JbWgIaV.exe
2632	ILnAvjU.exe
4168	eFJJVYe.exe
1640	gUmdioH.exe
4404	mMZnTCx.exe
2680	GOUEuPG.exe
4004	azMMMEx.exe
1660	XbdzrgM.exe
3872	GcbcVYM.exe
1268	IeTzPuJ.exe
1952	ZkGUjyb.exe
4160	KbEXfmi.exe
3584	aYJsobm.exe
3260	ogzUlaF.exe
4628	XgWxmSB.exe
2036	KQRDsVr.exe
2380	SYEFMrh.exe
4516	pswprpH.exe
116	WzNCTIg.exe
4656	OFDAnsb.exe
3836	FzKuGzm.exe
1616	GUMuwAb.exe
2348	WbanECT.exe
2692	prnyQQS.exe
1172	ohMUNvq.exe
5080	XSnBkhc.exe
3268	VkPiOaq.exe
2020	NrtYtkj.exe
5068	mCjNlSA.exe
1332	mDRSgqa.exe
216	ObVpbyi.exe
884	SpLeEEV.exe
1116	Kogmpws.exe
864	qRejsus.exe
1696	RobRCxf.exe
1836	xQyFirP.exe
4604	uOBGAai.exe
1512	lTjgOLh.exe
2220	bujkmQa.exe
4012	wYEzWLq.exe
4592	rQwUpwi.exe
4916	rtxXbqG.exe
1920	FiPjvbh.exe
4068	WEXDuGq.exe
3720	RGGQlnk.exe
4564	PkzyAEv.exe
4664	ncHsqaw.exe
4832	cHTwdiS.exe
1460	GWvcKIY.exe
1740	ZCuDGWa.exe
744	niddDbu.exe
1516	UCuObKa.exe
4108	ZAhdQjr.exe
4852	GEbKsBG.exe
1796	YpCXiuY.exe
2456	ErSmkfr.exe
4380	xXxZQhQ.exe
3744	jFLnDXH.exe
804	VXjzeBP.exe
1544	MteOFmo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QAlgbFb.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\hMTustM.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\VtcBrzo.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\ocXOpFD.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\RGWHtwL.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\SydqXyE.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\UBLEBuu.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\hiZouHI.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\YXmwvgA.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\BYMHXCg.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\nwiDtAq.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\UNVcVFb.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\QPTdBPO.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\zVIjUPl.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\oqMWBMD.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\KIzEOLG.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\mhdjrDt.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\VyKpswx.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\iBvFwhX.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\dodclXE.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\GAQXLWR.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\GUGqblw.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\ApaIXRp.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\UyuWOBk.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\FNzxfWx.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\XlphRuN.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\cSWglFE.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\iAmTdSf.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\fKCrbZF.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\iKPbotw.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\iiyqQPS.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\xQyFirP.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\pzgQMYF.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\EuJfGlT.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\pEcXmfB.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\wuLgXKu.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\fnAIyrZ.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\CsPcgOB.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\oKfAHdA.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\OcvrgxE.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\ogzUlaF.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\mCjNlSA.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\bfgdzJt.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\eZTasUm.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\hpwCeiQ.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\dWjscRi.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\KRGvhDy.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\owfROYt.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\kfJYfWj.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\ACBCerG.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\NumgWOG.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\jehpVxG.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\NrtYtkj.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\KvEnAPC.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\FtqRCTw.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\cMmvlQb.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\xkagNOM.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\fuelyXk.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\aHSRPhU.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\LRedLFm.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\WNxfXFm.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\bBbpHtx.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\GdXGPUx.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
File created	C:\Windows\System\bnPemFT.exe	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4420	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	84
PID 1336 wrote to memory of 4420	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	84
PID 1336 wrote to memory of 4460	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	85
PID 1336 wrote to memory of 4460	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	85
PID 1336 wrote to memory of 4272	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	86
PID 1336 wrote to memory of 4272	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	86
PID 1336 wrote to memory of 1776	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	87
PID 1336 wrote to memory of 1776	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	87
PID 1336 wrote to memory of 1968	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	88
PID 1336 wrote to memory of 1968	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	88
PID 1336 wrote to memory of 2632	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	89
PID 1336 wrote to memory of 2632	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	89
PID 1336 wrote to memory of 4168	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	90
PID 1336 wrote to memory of 4168	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	90
PID 1336 wrote to memory of 1640	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	91
PID 1336 wrote to memory of 1640	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	91
PID 1336 wrote to memory of 4404	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	92
PID 1336 wrote to memory of 4404	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	92
PID 1336 wrote to memory of 2680	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	93
PID 1336 wrote to memory of 2680	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	93
PID 1336 wrote to memory of 4004	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	94
PID 1336 wrote to memory of 4004	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	94
PID 1336 wrote to memory of 1660	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	95
PID 1336 wrote to memory of 1660	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	95
PID 1336 wrote to memory of 3872	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	96
PID 1336 wrote to memory of 3872	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	96
PID 1336 wrote to memory of 1268	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	97
PID 1336 wrote to memory of 1268	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	97
PID 1336 wrote to memory of 1952	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	98
PID 1336 wrote to memory of 1952	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	98
PID 1336 wrote to memory of 4160	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	99
PID 1336 wrote to memory of 4160	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	99
PID 1336 wrote to memory of 3584	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	100
PID 1336 wrote to memory of 3584	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	100
PID 1336 wrote to memory of 3260	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	101
PID 1336 wrote to memory of 3260	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	101
PID 1336 wrote to memory of 4628	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	102
PID 1336 wrote to memory of 4628	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	102
PID 1336 wrote to memory of 2036	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	103
PID 1336 wrote to memory of 2036	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	103
PID 1336 wrote to memory of 2380	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	104
PID 1336 wrote to memory of 2380	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	104
PID 1336 wrote to memory of 4516	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	105
PID 1336 wrote to memory of 4516	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	105
PID 1336 wrote to memory of 116	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	106
PID 1336 wrote to memory of 116	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	106
PID 1336 wrote to memory of 4656	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	107
PID 1336 wrote to memory of 4656	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	107
PID 1336 wrote to memory of 3836	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	108
PID 1336 wrote to memory of 3836	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	108
PID 1336 wrote to memory of 1616	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	109
PID 1336 wrote to memory of 1616	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	109
PID 1336 wrote to memory of 2348	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	110
PID 1336 wrote to memory of 2348	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	110
PID 1336 wrote to memory of 2692	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	111
PID 1336 wrote to memory of 2692	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	111
PID 1336 wrote to memory of 1172	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	112
PID 1336 wrote to memory of 1172	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	112
PID 1336 wrote to memory of 5080	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	113
PID 1336 wrote to memory of 5080	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	113
PID 1336 wrote to memory of 3268	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	114
PID 1336 wrote to memory of 3268	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	114
PID 1336 wrote to memory of 2020	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	115
PID 1336 wrote to memory of 2020	1336	bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe	115

C:\Users\Admin\AppData\Local\Temp\bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe
"C:\Users\Admin\AppData\Local\Temp\bec4ff925049402c9c60188e001fe37cbd3bc16adf19d9de7df6325f3bfe4cbd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\System\RpZMxMO.exe
  C:\Windows\System\RpZMxMO.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\sUYiAbP.exe
  C:\Windows\System\sUYiAbP.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\cUFYTZE.exe
  C:\Windows\System\cUFYTZE.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\TfVUAJP.exe
  C:\Windows\System\TfVUAJP.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\JbWgIaV.exe
  C:\Windows\System\JbWgIaV.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ILnAvjU.exe
  C:\Windows\System\ILnAvjU.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\eFJJVYe.exe
  C:\Windows\System\eFJJVYe.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\gUmdioH.exe
  C:\Windows\System\gUmdioH.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\mMZnTCx.exe
  C:\Windows\System\mMZnTCx.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\GOUEuPG.exe
  C:\Windows\System\GOUEuPG.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\azMMMEx.exe
  C:\Windows\System\azMMMEx.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\XbdzrgM.exe
  C:\Windows\System\XbdzrgM.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\GcbcVYM.exe
  C:\Windows\System\GcbcVYM.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\IeTzPuJ.exe
  C:\Windows\System\IeTzPuJ.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\ZkGUjyb.exe
  C:\Windows\System\ZkGUjyb.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\KbEXfmi.exe
  C:\Windows\System\KbEXfmi.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\aYJsobm.exe
  C:\Windows\System\aYJsobm.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\ogzUlaF.exe
  C:\Windows\System\ogzUlaF.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\XgWxmSB.exe
  C:\Windows\System\XgWxmSB.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\KQRDsVr.exe
  C:\Windows\System\KQRDsVr.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\SYEFMrh.exe
  C:\Windows\System\SYEFMrh.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\pswprpH.exe
  C:\Windows\System\pswprpH.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\WzNCTIg.exe
  C:\Windows\System\WzNCTIg.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\OFDAnsb.exe
  C:\Windows\System\OFDAnsb.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\FzKuGzm.exe
  C:\Windows\System\FzKuGzm.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\GUMuwAb.exe
  C:\Windows\System\GUMuwAb.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\WbanECT.exe
  C:\Windows\System\WbanECT.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\prnyQQS.exe
  C:\Windows\System\prnyQQS.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ohMUNvq.exe
  C:\Windows\System\ohMUNvq.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\XSnBkhc.exe
  C:\Windows\System\XSnBkhc.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\VkPiOaq.exe
  C:\Windows\System\VkPiOaq.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\NrtYtkj.exe
  C:\Windows\System\NrtYtkj.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\mCjNlSA.exe
  C:\Windows\System\mCjNlSA.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\mDRSgqa.exe
  C:\Windows\System\mDRSgqa.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\ObVpbyi.exe
  C:\Windows\System\ObVpbyi.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\SpLeEEV.exe
  C:\Windows\System\SpLeEEV.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\Kogmpws.exe
  C:\Windows\System\Kogmpws.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\qRejsus.exe
  C:\Windows\System\qRejsus.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\RobRCxf.exe
  C:\Windows\System\RobRCxf.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\xQyFirP.exe
  C:\Windows\System\xQyFirP.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\uOBGAai.exe
  C:\Windows\System\uOBGAai.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\lTjgOLh.exe
  C:\Windows\System\lTjgOLh.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\bujkmQa.exe
  C:\Windows\System\bujkmQa.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\wYEzWLq.exe
  C:\Windows\System\wYEzWLq.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\rQwUpwi.exe
  C:\Windows\System\rQwUpwi.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\rtxXbqG.exe
  C:\Windows\System\rtxXbqG.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\FiPjvbh.exe
  C:\Windows\System\FiPjvbh.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\WEXDuGq.exe
  C:\Windows\System\WEXDuGq.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\RGGQlnk.exe
  C:\Windows\System\RGGQlnk.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\PkzyAEv.exe
  C:\Windows\System\PkzyAEv.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\ncHsqaw.exe
  C:\Windows\System\ncHsqaw.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\cHTwdiS.exe
  C:\Windows\System\cHTwdiS.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\GWvcKIY.exe
  C:\Windows\System\GWvcKIY.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\ZCuDGWa.exe
  C:\Windows\System\ZCuDGWa.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\niddDbu.exe
  C:\Windows\System\niddDbu.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\UCuObKa.exe
  C:\Windows\System\UCuObKa.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\ZAhdQjr.exe
  C:\Windows\System\ZAhdQjr.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\GEbKsBG.exe
  C:\Windows\System\GEbKsBG.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\YpCXiuY.exe
  C:\Windows\System\YpCXiuY.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\ErSmkfr.exe
  C:\Windows\System\ErSmkfr.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\xXxZQhQ.exe
  C:\Windows\System\xXxZQhQ.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\jFLnDXH.exe
  C:\Windows\System\jFLnDXH.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\VXjzeBP.exe
  C:\Windows\System\VXjzeBP.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\MteOFmo.exe
  C:\Windows\System\MteOFmo.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\QAlgbFb.exe
  C:\Windows\System\QAlgbFb.exe
  2⤵
  PID:400
- C:\Windows\System\KqpjPcO.exe
  C:\Windows\System\KqpjPcO.exe
  2⤵
  PID:1380
- C:\Windows\System\XJWayBR.exe
  C:\Windows\System\XJWayBR.exe
  2⤵
  PID:3728
- C:\Windows\System\qIodSPk.exe
  C:\Windows\System\qIodSPk.exe
  2⤵
  PID:2612
- C:\Windows\System\ScJoVYm.exe
  C:\Windows\System\ScJoVYm.exe
  2⤵
  PID:1680
- C:\Windows\System\awFPspQ.exe
  C:\Windows\System\awFPspQ.exe
  2⤵
  PID:3412
- C:\Windows\System\WEISRdi.exe
  C:\Windows\System\WEISRdi.exe
  2⤵
  PID:4560
- C:\Windows\System\zVIjUPl.exe
  C:\Windows\System\zVIjUPl.exe
  2⤵
  PID:692
- C:\Windows\System\deIOgno.exe
  C:\Windows\System\deIOgno.exe
  2⤵
  PID:3016
- C:\Windows\System\PwzhTiR.exe
  C:\Windows\System\PwzhTiR.exe
  2⤵
  PID:1476
- C:\Windows\System\BMafRRn.exe
  C:\Windows\System\BMafRRn.exe
  2⤵
  PID:1892
- C:\Windows\System\ZadHhJq.exe
  C:\Windows\System\ZadHhJq.exe
  2⤵
  PID:1456
- C:\Windows\System\aYahneE.exe
  C:\Windows\System\aYahneE.exe
  2⤵
  PID:376
- C:\Windows\System\VtcBrzo.exe
  C:\Windows\System\VtcBrzo.exe
  2⤵
  PID:3472
- C:\Windows\System\GUGqblw.exe
  C:\Windows\System\GUGqblw.exe
  2⤵
  PID:2188
- C:\Windows\System\iGwNuRs.exe
  C:\Windows\System\iGwNuRs.exe
  2⤵
  PID:1100
- C:\Windows\System\EuJfGlT.exe
  C:\Windows\System\EuJfGlT.exe
  2⤵
  PID:5048
- C:\Windows\System\eqlzUad.exe
  C:\Windows\System\eqlzUad.exe
  2⤵
  PID:996
- C:\Windows\System\zrqBgWp.exe
  C:\Windows\System\zrqBgWp.exe
  2⤵
  PID:2616
- C:\Windows\System\iBvFwhX.exe
  C:\Windows\System\iBvFwhX.exe
  2⤵
  PID:2384
- C:\Windows\System\WtDckoK.exe
  C:\Windows\System\WtDckoK.exe
  2⤵
  PID:3536
- C:\Windows\System\mHPYpUw.exe
  C:\Windows\System\mHPYpUw.exe
  2⤵
  PID:1312
- C:\Windows\System\mhdjrDt.exe
  C:\Windows\System\mhdjrDt.exe
  2⤵
  PID:3292
- C:\Windows\System\ALqAGDr.exe
  C:\Windows\System\ALqAGDr.exe
  2⤵
  PID:2840
- C:\Windows\System\xpeVYCg.exe
  C:\Windows\System\xpeVYCg.exe
  2⤵
  PID:2444
- C:\Windows\System\DIFNyjA.exe
  C:\Windows\System\DIFNyjA.exe
  2⤵
  PID:1384
- C:\Windows\System\GpygvWD.exe
  C:\Windows\System\GpygvWD.exe
  2⤵
  PID:4236
- C:\Windows\System\HCINnLJ.exe
  C:\Windows\System\HCINnLJ.exe
  2⤵
  PID:3976
- C:\Windows\System\PqApwAw.exe
  C:\Windows\System\PqApwAw.exe
  2⤵
  PID:3668
- C:\Windows\System\JIxHYMY.exe
  C:\Windows\System\JIxHYMY.exe
  2⤵
  PID:4348
- C:\Windows\System\ueTKmnL.exe
  C:\Windows\System\ueTKmnL.exe
  2⤵
  PID:3492
- C:\Windows\System\wyFbvll.exe
  C:\Windows\System\wyFbvll.exe
  2⤵
  PID:1576
- C:\Windows\System\poShYXB.exe
  C:\Windows\System\poShYXB.exe
  2⤵
  PID:3604
- C:\Windows\System\JpZxOMG.exe
  C:\Windows\System\JpZxOMG.exe
  2⤵
  PID:1076
- C:\Windows\System\OHKnEeI.exe
  C:\Windows\System\OHKnEeI.exe
  2⤵
  PID:932
- C:\Windows\System\WNxfXFm.exe
  C:\Windows\System\WNxfXFm.exe
  2⤵
  PID:2024
- C:\Windows\System\XnlketH.exe
  C:\Windows\System\XnlketH.exe
  2⤵
  PID:3332
- C:\Windows\System\BRTifUv.exe
  C:\Windows\System\BRTifUv.exe
  2⤵
  PID:2416
- C:\Windows\System\LMyTOUk.exe
  C:\Windows\System\LMyTOUk.exe
  2⤵
  PID:1628
- C:\Windows\System\BZIQbwm.exe
  C:\Windows\System\BZIQbwm.exe
  2⤵
  PID:2748
- C:\Windows\System\HlRyghU.exe
  C:\Windows\System\HlRyghU.exe
  2⤵
  PID:3100
- C:\Windows\System\dvQLzMe.exe
  C:\Windows\System\dvQLzMe.exe
  2⤵
  PID:3208
- C:\Windows\System\RAHJfzr.exe
  C:\Windows\System\RAHJfzr.exe
  2⤵
  PID:4716
- C:\Windows\System\DZxonbB.exe
  C:\Windows\System\DZxonbB.exe
  2⤵
  PID:4424
- C:\Windows\System\kwjJxXL.exe
  C:\Windows\System\kwjJxXL.exe
  2⤵
  PID:4944
- C:\Windows\System\XxrWeVe.exe
  C:\Windows\System\XxrWeVe.exe
  2⤵
  PID:4712
- C:\Windows\System\XlphRuN.exe
  C:\Windows\System\XlphRuN.exe
  2⤵
  PID:436
- C:\Windows\System\SxuQVMv.exe
  C:\Windows\System\SxuQVMv.exe
  2⤵
  PID:4140
- C:\Windows\System\sjuqERV.exe
  C:\Windows\System\sjuqERV.exe
  2⤵
  PID:4044
- C:\Windows\System\CvQuedk.exe
  C:\Windows\System\CvQuedk.exe
  2⤵
  PID:4444
- C:\Windows\System\owfROYt.exe
  C:\Windows\System\owfROYt.exe
  2⤵
  PID:1780
- C:\Windows\System\JnAaanS.exe
  C:\Windows\System\JnAaanS.exe
  2⤵
  PID:5052
- C:\Windows\System\ZlQuHPY.exe
  C:\Windows\System\ZlQuHPY.exe
  2⤵
  PID:5148
- C:\Windows\System\jEAthBL.exe
  C:\Windows\System\jEAthBL.exe
  2⤵
  PID:5176
- C:\Windows\System\AGWojoJ.exe
  C:\Windows\System\AGWojoJ.exe
  2⤵
  PID:5204
- C:\Windows\System\fMxysbL.exe
  C:\Windows\System\fMxysbL.exe
  2⤵
  PID:5228
- C:\Windows\System\GLqOFQz.exe
  C:\Windows\System\GLqOFQz.exe
  2⤵
  PID:5264
- C:\Windows\System\GGPfCjB.exe
  C:\Windows\System\GGPfCjB.exe
  2⤵
  PID:5288
- C:\Windows\System\LijvkCb.exe
  C:\Windows\System\LijvkCb.exe
  2⤵
  PID:5320
- C:\Windows\System\ATEzyoE.exe
  C:\Windows\System\ATEzyoE.exe
  2⤵
  PID:5360
- C:\Windows\System\moUnJcX.exe
  C:\Windows\System\moUnJcX.exe
  2⤵
  PID:5388
- C:\Windows\System\XkJrSUh.exe
  C:\Windows\System\XkJrSUh.exe
  2⤵
  PID:5416
- C:\Windows\System\KMykMpU.exe
  C:\Windows\System\KMykMpU.exe
  2⤵
  PID:5444
- C:\Windows\System\OKwbret.exe
  C:\Windows\System\OKwbret.exe
  2⤵
  PID:5464
- C:\Windows\System\QCXfUJr.exe
  C:\Windows\System\QCXfUJr.exe
  2⤵
  PID:5496
- C:\Windows\System\zMVDjDO.exe
  C:\Windows\System\zMVDjDO.exe
  2⤵
  PID:5524
- C:\Windows\System\gduQqmD.exe
  C:\Windows\System\gduQqmD.exe
  2⤵
  PID:5556
- C:\Windows\System\bbZGfYl.exe
  C:\Windows\System\bbZGfYl.exe
  2⤵
  PID:5584
- C:\Windows\System\uKUkOIc.exe
  C:\Windows\System\uKUkOIc.exe
  2⤵
  PID:5604
- C:\Windows\System\dftyVTf.exe
  C:\Windows\System\dftyVTf.exe
  2⤵
  PID:5636
- C:\Windows\System\VEsOoax.exe
  C:\Windows\System\VEsOoax.exe
  2⤵
  PID:5668
- C:\Windows\System\rvlPIlt.exe
  C:\Windows\System\rvlPIlt.exe
  2⤵
  PID:5696
- C:\Windows\System\VbRZQsE.exe
  C:\Windows\System\VbRZQsE.exe
  2⤵
  PID:5724
- C:\Windows\System\GqvqkOR.exe
  C:\Windows\System\GqvqkOR.exe
  2⤵
  PID:5752
- C:\Windows\System\ykbjLLW.exe
  C:\Windows\System\ykbjLLW.exe
  2⤵
  PID:5784
- C:\Windows\System\zoryyDw.exe
  C:\Windows\System\zoryyDw.exe
  2⤵
  PID:5816
- C:\Windows\System\psICqGT.exe
  C:\Windows\System\psICqGT.exe
  2⤵
  PID:5848
- C:\Windows\System\fOeORkp.exe
  C:\Windows\System\fOeORkp.exe
  2⤵
  PID:5876
- C:\Windows\System\lVHwqRU.exe
  C:\Windows\System\lVHwqRU.exe
  2⤵
  PID:5904
- C:\Windows\System\ZZcMhOb.exe
  C:\Windows\System\ZZcMhOb.exe
  2⤵
  PID:5932
- C:\Windows\System\XiEFreF.exe
  C:\Windows\System\XiEFreF.exe
  2⤵
  PID:5956
- C:\Windows\System\exSzlpz.exe
  C:\Windows\System\exSzlpz.exe
  2⤵
  PID:5988
- C:\Windows\System\SHKjxFz.exe
  C:\Windows\System\SHKjxFz.exe
  2⤵
  PID:6016
- C:\Windows\System\IoqWySP.exe
  C:\Windows\System\IoqWySP.exe
  2⤵
  PID:6044
- C:\Windows\System\obKVJuw.exe
  C:\Windows\System\obKVJuw.exe
  2⤵
  PID:6072
- C:\Windows\System\wpPSpfE.exe
  C:\Windows\System\wpPSpfE.exe
  2⤵
  PID:6100
- C:\Windows\System\KZfTqOW.exe
  C:\Windows\System\KZfTqOW.exe
  2⤵
  PID:6128
- C:\Windows\System\ReAshVI.exe
  C:\Windows\System\ReAshVI.exe
  2⤵
  PID:5140
- C:\Windows\System\dCwDkhN.exe
  C:\Windows\System\dCwDkhN.exe
  2⤵
  PID:5224
- C:\Windows\System\bAPxYsW.exe
  C:\Windows\System\bAPxYsW.exe
  2⤵
  PID:5280
- C:\Windows\System\cztKmVB.exe
  C:\Windows\System\cztKmVB.exe
  2⤵
  PID:5380
- C:\Windows\System\pbzwpao.exe
  C:\Windows\System\pbzwpao.exe
  2⤵
  PID:5436
- C:\Windows\System\SjLMvsk.exe
  C:\Windows\System\SjLMvsk.exe
  2⤵
  PID:5504
- C:\Windows\System\jdIseMg.exe
  C:\Windows\System\jdIseMg.exe
  2⤵
  PID:5568
- C:\Windows\System\LnQGYnJ.exe
  C:\Windows\System\LnQGYnJ.exe
  2⤵
  PID:5632
- C:\Windows\System\lFtauYg.exe
  C:\Windows\System\lFtauYg.exe
  2⤵
  PID:5684
- C:\Windows\System\lZHbbEh.exe
  C:\Windows\System\lZHbbEh.exe
  2⤵
  PID:5772
- C:\Windows\System\zzRJsQL.exe
  C:\Windows\System\zzRJsQL.exe
  2⤵
  PID:5828
- C:\Windows\System\FsbxKlz.exe
  C:\Windows\System\FsbxKlz.exe
  2⤵
  PID:5872
- C:\Windows\System\eDxKZrn.exe
  C:\Windows\System\eDxKZrn.exe
  2⤵
  PID:5980
- C:\Windows\System\GLOvUYN.exe
  C:\Windows\System\GLOvUYN.exe
  2⤵
  PID:6008
- C:\Windows\System\QDSNFGf.exe
  C:\Windows\System\QDSNFGf.exe
  2⤵
  PID:6068
- C:\Windows\System\dmnNnUB.exe
  C:\Windows\System\dmnNnUB.exe
  2⤵
  PID:5132
- C:\Windows\System\zThAtHT.exe
  C:\Windows\System\zThAtHT.exe
  2⤵
  PID:5256
- C:\Windows\System\unKaUUV.exe
  C:\Windows\System\unKaUUV.exe
  2⤵
  PID:5432
- C:\Windows\System\zbSPcIJ.exe
  C:\Windows\System\zbSPcIJ.exe
  2⤵
  PID:5592
- C:\Windows\System\hTCkWoV.exe
  C:\Windows\System\hTCkWoV.exe
  2⤵
  PID:5748
- C:\Windows\System\sbndnKF.exe
  C:\Windows\System\sbndnKF.exe
  2⤵
  PID:5928
- C:\Windows\System\JkNbywW.exe
  C:\Windows\System\JkNbywW.exe
  2⤵
  PID:5984
- C:\Windows\System\zfFlngy.exe
  C:\Windows\System\zfFlngy.exe
  2⤵
  PID:6084
- C:\Windows\System\CyFStSN.exe
  C:\Windows\System\CyFStSN.exe
  2⤵
  PID:5552
- C:\Windows\System\cKzKFTg.exe
  C:\Windows\System\cKzKFTg.exe
  2⤵
  PID:5900
- C:\Windows\System\HGnHzuK.exe
  C:\Windows\System\HGnHzuK.exe
  2⤵
  PID:5692
- C:\Windows\System\TOVvthX.exe
  C:\Windows\System\TOVvthX.exe
  2⤵
  PID:6152
- C:\Windows\System\xgbvCvw.exe
  C:\Windows\System\xgbvCvw.exe
  2⤵
  PID:6188
- C:\Windows\System\TVmOePi.exe
  C:\Windows\System\TVmOePi.exe
  2⤵
  PID:6212
- C:\Windows\System\TRlJglK.exe
  C:\Windows\System\TRlJglK.exe
  2⤵
  PID:6244
- C:\Windows\System\BhAOqgv.exe
  C:\Windows\System\BhAOqgv.exe
  2⤵
  PID:6276
- C:\Windows\System\nLchCJQ.exe
  C:\Windows\System\nLchCJQ.exe
  2⤵
  PID:6304
- C:\Windows\System\xDrrqNh.exe
  C:\Windows\System\xDrrqNh.exe
  2⤵
  PID:6332
- C:\Windows\System\lcJtRpC.exe
  C:\Windows\System\lcJtRpC.exe
  2⤵
  PID:6360
- C:\Windows\System\ZEKBcrG.exe
  C:\Windows\System\ZEKBcrG.exe
  2⤵
  PID:6392
- C:\Windows\System\cGEMgwQ.exe
  C:\Windows\System\cGEMgwQ.exe
  2⤵
  PID:6424
- C:\Windows\System\lpbkjCF.exe
  C:\Windows\System\lpbkjCF.exe
  2⤵
  PID:6456
- C:\Windows\System\mRkOmRT.exe
  C:\Windows\System\mRkOmRT.exe
  2⤵
  PID:6488
- C:\Windows\System\kySFMSS.exe
  C:\Windows\System\kySFMSS.exe
  2⤵
  PID:6504
- C:\Windows\System\zbCPIGl.exe
  C:\Windows\System\zbCPIGl.exe
  2⤵
  PID:6532
- C:\Windows\System\LsGNusL.exe
  C:\Windows\System\LsGNusL.exe
  2⤵
  PID:6572
- C:\Windows\System\kBGlMSf.exe
  C:\Windows\System\kBGlMSf.exe
  2⤵
  PID:6600
- C:\Windows\System\WWZrgQR.exe
  C:\Windows\System\WWZrgQR.exe
  2⤵
  PID:6628
- C:\Windows\System\kSrzOav.exe
  C:\Windows\System\kSrzOav.exe
  2⤵
  PID:6656
- C:\Windows\System\YgktiSp.exe
  C:\Windows\System\YgktiSp.exe
  2⤵
  PID:6684
- C:\Windows\System\wPPZoOQ.exe
  C:\Windows\System\wPPZoOQ.exe
  2⤵
  PID:6712
- C:\Windows\System\psrlMFy.exe
  C:\Windows\System\psrlMFy.exe
  2⤵
  PID:6740
- C:\Windows\System\OndBdUn.exe
  C:\Windows\System\OndBdUn.exe
  2⤵
  PID:6768
- C:\Windows\System\HoqfbNX.exe
  C:\Windows\System\HoqfbNX.exe
  2⤵
  PID:6812
- C:\Windows\System\dOgGDRT.exe
  C:\Windows\System\dOgGDRT.exe
  2⤵
  PID:6828
- C:\Windows\System\gFGplpu.exe
  C:\Windows\System\gFGplpu.exe
  2⤵
  PID:6848
- C:\Windows\System\mJQwiXn.exe
  C:\Windows\System\mJQwiXn.exe
  2⤵
  PID:6880
- C:\Windows\System\mjGEpwh.exe
  C:\Windows\System\mjGEpwh.exe
  2⤵
  PID:6900
- C:\Windows\System\fEyoSUv.exe
  C:\Windows\System\fEyoSUv.exe
  2⤵
  PID:6924
- C:\Windows\System\KGWvGGP.exe
  C:\Windows\System\KGWvGGP.exe
  2⤵
  PID:6948
- C:\Windows\System\PxJgcoM.exe
  C:\Windows\System\PxJgcoM.exe
  2⤵
  PID:6976
- C:\Windows\System\OcYNlBv.exe
  C:\Windows\System\OcYNlBv.exe
  2⤵
  PID:7012
- C:\Windows\System\btPqbwN.exe
  C:\Windows\System\btPqbwN.exe
  2⤵
  PID:7040
- C:\Windows\System\BgCtaGm.exe
  C:\Windows\System\BgCtaGm.exe
  2⤵
  PID:7056
- C:\Windows\System\ovpKQaT.exe
  C:\Windows\System\ovpKQaT.exe
  2⤵
  PID:7092
- C:\Windows\System\yKHKDjm.exe
  C:\Windows\System\yKHKDjm.exe
  2⤵
  PID:7124
- C:\Windows\System\pEcXmfB.exe
  C:\Windows\System\pEcXmfB.exe
  2⤵
  PID:7140
- C:\Windows\System\rotrMmc.exe
  C:\Windows\System\rotrMmc.exe
  2⤵
  PID:5860
- C:\Windows\System\fsOiYFf.exe
  C:\Windows\System\fsOiYFf.exe
  2⤵
  PID:6204
- C:\Windows\System\UYmulIX.exe
  C:\Windows\System\UYmulIX.exe
  2⤵
  PID:6288
- C:\Windows\System\KUcwvEe.exe
  C:\Windows\System\KUcwvEe.exe
  2⤵
  PID:6352
- C:\Windows\System\FUwJXHy.exe
  C:\Windows\System\FUwJXHy.exe
  2⤵
  PID:6416
- C:\Windows\System\MKMCSic.exe
  C:\Windows\System\MKMCSic.exe
  2⤵
  PID:6472
- C:\Windows\System\EesKJKH.exe
  C:\Windows\System\EesKJKH.exe
  2⤵
  PID:6528
- C:\Windows\System\fcmnGat.exe
  C:\Windows\System\fcmnGat.exe
  2⤵
  PID:6616
- C:\Windows\System\ukpokLP.exe
  C:\Windows\System\ukpokLP.exe
  2⤵
  PID:6700
- C:\Windows\System\NdbJuwF.exe
  C:\Windows\System\NdbJuwF.exe
  2⤵
  PID:6752
- C:\Windows\System\uRVzVaJ.exe
  C:\Windows\System\uRVzVaJ.exe
  2⤵
  PID:6780
- C:\Windows\System\tkRNEBA.exe
  C:\Windows\System\tkRNEBA.exe
  2⤵
  PID:4784
- C:\Windows\System\HRgBTWa.exe
  C:\Windows\System\HRgBTWa.exe
  2⤵
  PID:6844
- C:\Windows\System\ygXxFhQ.exe
  C:\Windows\System\ygXxFhQ.exe
  2⤵
  PID:6912
- C:\Windows\System\HbWZSZr.exe
  C:\Windows\System\HbWZSZr.exe
  2⤵
  PID:6972
- C:\Windows\System\EemDiWv.exe
  C:\Windows\System\EemDiWv.exe
  2⤵
  PID:7020
- C:\Windows\System\krLuaUm.exe
  C:\Windows\System\krLuaUm.exe
  2⤵
  PID:7076
- C:\Windows\System\ciKuQbp.exe
  C:\Windows\System\ciKuQbp.exe
  2⤵
  PID:7132
- C:\Windows\System\jMGFPEx.exe
  C:\Windows\System\jMGFPEx.exe
  2⤵
  PID:6180
- C:\Windows\System\ZvBBBvy.exe
  C:\Windows\System\ZvBBBvy.exe
  2⤵
  PID:6432
- C:\Windows\System\IbOMuSR.exe
  C:\Windows\System\IbOMuSR.exe
  2⤵
  PID:6596
- C:\Windows\System\dVhUBYR.exe
  C:\Windows\System\dVhUBYR.exe
  2⤵
  PID:4668
- C:\Windows\System\FIfoWSH.exe
  C:\Windows\System\FIfoWSH.exe
  2⤵
  PID:6872
- C:\Windows\System\fAzakPv.exe
  C:\Windows\System\fAzakPv.exe
  2⤵
  PID:7068
- C:\Windows\System\svOXvkB.exe
  C:\Windows\System\svOXvkB.exe
  2⤵
  PID:7164
- C:\Windows\System\ZdzyANx.exe
  C:\Windows\System\ZdzyANx.exe
  2⤵
  PID:6348
- C:\Windows\System\ArNteCU.exe
  C:\Windows\System\ArNteCU.exe
  2⤵
  PID:6652
- C:\Windows\System\HfBcTcL.exe
  C:\Windows\System\HfBcTcL.exe
  2⤵
  PID:6808
- C:\Windows\System\fZthUTf.exe
  C:\Windows\System\fZthUTf.exe
  2⤵
  PID:7108
- C:\Windows\System\kjWqriw.exe
  C:\Windows\System\kjWqriw.exe
  2⤵
  PID:2904
- C:\Windows\System\lWSSUEN.exe
  C:\Windows\System\lWSSUEN.exe
  2⤵
  PID:7208
- C:\Windows\System\HIFFJhF.exe
  C:\Windows\System\HIFFJhF.exe
  2⤵
  PID:7236
- C:\Windows\System\kwVLKHL.exe
  C:\Windows\System\kwVLKHL.exe
  2⤵
  PID:7260
- C:\Windows\System\mDkmTua.exe
  C:\Windows\System\mDkmTua.exe
  2⤵
  PID:7284
- C:\Windows\System\taFdAqp.exe
  C:\Windows\System\taFdAqp.exe
  2⤵
  PID:7316
- C:\Windows\System\IQGsLqh.exe
  C:\Windows\System\IQGsLqh.exe
  2⤵
  PID:7336
- C:\Windows\System\bfgdzJt.exe
  C:\Windows\System\bfgdzJt.exe
  2⤵
  PID:7368
- C:\Windows\System\sXZGogm.exe
  C:\Windows\System\sXZGogm.exe
  2⤵
  PID:7400
- C:\Windows\System\WVZDmfu.exe
  C:\Windows\System\WVZDmfu.exe
  2⤵
  PID:7424
- C:\Windows\System\UCaawHp.exe
  C:\Windows\System\UCaawHp.exe
  2⤵
  PID:7460
- C:\Windows\System\NqobNPL.exe
  C:\Windows\System\NqobNPL.exe
  2⤵
  PID:7500
- C:\Windows\System\WVsqaiO.exe
  C:\Windows\System\WVsqaiO.exe
  2⤵
  PID:7516
- C:\Windows\System\WRvoGNX.exe
  C:\Windows\System\WRvoGNX.exe
  2⤵
  PID:7556
- C:\Windows\System\RnPDbru.exe
  C:\Windows\System\RnPDbru.exe
  2⤵
  PID:7584
- C:\Windows\System\gAMwyzI.exe
  C:\Windows\System\gAMwyzI.exe
  2⤵
  PID:7604
- C:\Windows\System\jXPkffF.exe
  C:\Windows\System\jXPkffF.exe
  2⤵
  PID:7640
- C:\Windows\System\pzgQMYF.exe
  C:\Windows\System\pzgQMYF.exe
  2⤵
  PID:7656
- C:\Windows\System\tMpQPbG.exe
  C:\Windows\System\tMpQPbG.exe
  2⤵
  PID:7700
- C:\Windows\System\lEeSaop.exe
  C:\Windows\System\lEeSaop.exe
  2⤵
  PID:7720
- C:\Windows\System\vohjIpm.exe
  C:\Windows\System\vohjIpm.exe
  2⤵
  PID:7744
- C:\Windows\System\ZqfZAPO.exe
  C:\Windows\System\ZqfZAPO.exe
  2⤵
  PID:7784
- C:\Windows\System\zjkToyl.exe
  C:\Windows\System\zjkToyl.exe
  2⤵
  PID:7800
- C:\Windows\System\gnkosGV.exe
  C:\Windows\System\gnkosGV.exe
  2⤵
  PID:7840
- C:\Windows\System\xdZLVue.exe
  C:\Windows\System\xdZLVue.exe
  2⤵
  PID:7864
- C:\Windows\System\FNzxfWx.exe
  C:\Windows\System\FNzxfWx.exe
  2⤵
  PID:7880
- C:\Windows\System\LMwQKVU.exe
  C:\Windows\System\LMwQKVU.exe
  2⤵
  PID:7912
- C:\Windows\System\mTbCFHc.exe
  C:\Windows\System\mTbCFHc.exe
  2⤵
  PID:7952
- C:\Windows\System\LDqrIUD.exe
  C:\Windows\System\LDqrIUD.exe
  2⤵
  PID:7984
- C:\Windows\System\mvLSSmW.exe
  C:\Windows\System\mvLSSmW.exe
  2⤵
  PID:8000
- C:\Windows\System\jplmBWi.exe
  C:\Windows\System\jplmBWi.exe
  2⤵
  PID:8016
- C:\Windows\System\yDPrXtz.exe
  C:\Windows\System\yDPrXtz.exe
  2⤵
  PID:8036
- C:\Windows\System\gOYBjdo.exe
  C:\Windows\System\gOYBjdo.exe
  2⤵
  PID:8068
- C:\Windows\System\tNqeCsl.exe
  C:\Windows\System\tNqeCsl.exe
  2⤵
  PID:8108
- C:\Windows\System\dNahkyK.exe
  C:\Windows\System\dNahkyK.exe
  2⤵
  PID:8148
- C:\Windows\System\OuZDFJU.exe
  C:\Windows\System\OuZDFJU.exe
  2⤵
  PID:8164
- C:\Windows\System\IcLwNtr.exe
  C:\Windows\System\IcLwNtr.exe
  2⤵
  PID:8184
- C:\Windows\System\VLjRqio.exe
  C:\Windows\System\VLjRqio.exe
  2⤵
  PID:7192
- C:\Windows\System\jgGhhvC.exe
  C:\Windows\System\jgGhhvC.exe
  2⤵
  PID:7220
- C:\Windows\System\ycMvOQA.exe
  C:\Windows\System\ycMvOQA.exe
  2⤵
  PID:7332
- C:\Windows\System\wczbKpR.exe
  C:\Windows\System\wczbKpR.exe
  2⤵
  PID:7412
- C:\Windows\System\PrWzrJq.exe
  C:\Windows\System\PrWzrJq.exe
  2⤵
  PID:7480
- C:\Windows\System\PaNMuuc.exe
  C:\Windows\System\PaNMuuc.exe
  2⤵
  PID:7536
- C:\Windows\System\ONgjASa.exe
  C:\Windows\System\ONgjASa.exe
  2⤵
  PID:7580
- C:\Windows\System\AyAYeBe.exe
  C:\Windows\System\AyAYeBe.exe
  2⤵
  PID:7636
- C:\Windows\System\wwsdpSI.exe
  C:\Windows\System\wwsdpSI.exe
  2⤵
  PID:7712
- C:\Windows\System\HcBGcaA.exe
  C:\Windows\System\HcBGcaA.exe
  2⤵
  PID:7760
- C:\Windows\System\iPwvrPP.exe
  C:\Windows\System\iPwvrPP.exe
  2⤵
  PID:7856
- C:\Windows\System\eZTasUm.exe
  C:\Windows\System\eZTasUm.exe
  2⤵
  PID:7896
- C:\Windows\System\FlajxnX.exe
  C:\Windows\System\FlajxnX.exe
  2⤵
  PID:7996
- C:\Windows\System\cSWglFE.exe
  C:\Windows\System\cSWglFE.exe
  2⤵
  PID:8008
- C:\Windows\System\wuZjNXN.exe
  C:\Windows\System\wuZjNXN.exe
  2⤵
  PID:8092
- C:\Windows\System\TYehvWd.exe
  C:\Windows\System\TYehvWd.exe
  2⤵
  PID:8156
- C:\Windows\System\DKCbSnu.exe
  C:\Windows\System\DKCbSnu.exe
  2⤵
  PID:7032
- C:\Windows\System\whGrqKy.exe
  C:\Windows\System\whGrqKy.exe
  2⤵
  PID:7228
- C:\Windows\System\ocXOpFD.exe
  C:\Windows\System\ocXOpFD.exe
  2⤵
  PID:7552
- C:\Windows\System\HAEpwem.exe
  C:\Windows\System\HAEpwem.exe
  2⤵
  PID:7624
- C:\Windows\System\eiNDbxS.exe
  C:\Windows\System\eiNDbxS.exe
  2⤵
  PID:7876
- C:\Windows\System\FhROOhl.exe
  C:\Windows\System\FhROOhl.exe
  2⤵
  PID:8056
- C:\Windows\System\WaEwavI.exe
  C:\Windows\System\WaEwavI.exe
  2⤵
  PID:8180
- C:\Windows\System\RWuRpxo.exe
  C:\Windows\System\RWuRpxo.exe
  2⤵
  PID:7496
- C:\Windows\System\QVmBrCd.exe
  C:\Windows\System\QVmBrCd.exe
  2⤵
  PID:7964
- C:\Windows\System\biGwvmr.exe
  C:\Windows\System\biGwvmr.exe
  2⤵
  PID:8144
- C:\Windows\System\OkyMkPt.exe
  C:\Windows\System\OkyMkPt.exe
  2⤵
  PID:7908
- C:\Windows\System\RLoHYeO.exe
  C:\Windows\System\RLoHYeO.exe
  2⤵
  PID:8200
- C:\Windows\System\AAIpdRr.exe
  C:\Windows\System\AAIpdRr.exe
  2⤵
  PID:8228
- C:\Windows\System\GMEzfXy.exe
  C:\Windows\System\GMEzfXy.exe
  2⤵
  PID:8252
- C:\Windows\System\otDelKT.exe
  C:\Windows\System\otDelKT.exe
  2⤵
  PID:8284
- C:\Windows\System\FEaJqYs.exe
  C:\Windows\System\FEaJqYs.exe
  2⤵
  PID:8324
- C:\Windows\System\UkepnUH.exe
  C:\Windows\System\UkepnUH.exe
  2⤵
  PID:8340
- C:\Windows\System\EloOYXn.exe
  C:\Windows\System\EloOYXn.exe
  2⤵
  PID:8368
- C:\Windows\System\bBbpHtx.exe
  C:\Windows\System\bBbpHtx.exe
  2⤵
  PID:8392
- C:\Windows\System\jnRRtSq.exe
  C:\Windows\System\jnRRtSq.exe
  2⤵
  PID:8424
- C:\Windows\System\cXUmMFj.exe
  C:\Windows\System\cXUmMFj.exe
  2⤵
  PID:8452
- C:\Windows\System\WbJkWAJ.exe
  C:\Windows\System\WbJkWAJ.exe
  2⤵
  PID:8480
- C:\Windows\System\nMbIIFQ.exe
  C:\Windows\System\nMbIIFQ.exe
  2⤵
  PID:8516
- C:\Windows\System\pQbbEzu.exe
  C:\Windows\System\pQbbEzu.exe
  2⤵
  PID:8548
- C:\Windows\System\ciEJGQw.exe
  C:\Windows\System\ciEJGQw.exe
  2⤵
  PID:8576
- C:\Windows\System\Knujsht.exe
  C:\Windows\System\Knujsht.exe
  2⤵
  PID:8604
- C:\Windows\System\IabLsFp.exe
  C:\Windows\System\IabLsFp.exe
  2⤵
  PID:8632
- C:\Windows\System\IEeFBbE.exe
  C:\Windows\System\IEeFBbE.exe
  2⤵
  PID:8660
- C:\Windows\System\rEmNQqs.exe
  C:\Windows\System\rEmNQqs.exe
  2⤵
  PID:8688
- C:\Windows\System\heeMedZ.exe
  C:\Windows\System\heeMedZ.exe
  2⤵
  PID:8716
- C:\Windows\System\hpwCeiQ.exe
  C:\Windows\System\hpwCeiQ.exe
  2⤵
  PID:8732
- C:\Windows\System\ljCprnj.exe
  C:\Windows\System\ljCprnj.exe
  2⤵
  PID:8760
- C:\Windows\System\lQbcxvr.exe
  C:\Windows\System\lQbcxvr.exe
  2⤵
  PID:8788
- C:\Windows\System\NqFSrvg.exe
  C:\Windows\System\NqFSrvg.exe
  2⤵
  PID:8820
- C:\Windows\System\zBClCJK.exe
  C:\Windows\System\zBClCJK.exe
  2⤵
  PID:8856
- C:\Windows\System\aeleFPK.exe
  C:\Windows\System\aeleFPK.exe
  2⤵
  PID:8884
- C:\Windows\System\hUxCYEd.exe
  C:\Windows\System\hUxCYEd.exe
  2⤵
  PID:8900
- C:\Windows\System\RdNQuzH.exe
  C:\Windows\System\RdNQuzH.exe
  2⤵
  PID:8936
- C:\Windows\System\aHSRPhU.exe
  C:\Windows\System\aHSRPhU.exe
  2⤵
  PID:8952
- C:\Windows\System\TzUybEK.exe
  C:\Windows\System\TzUybEK.exe
  2⤵
  PID:8972
- C:\Windows\System\pTyNIVC.exe
  C:\Windows\System\pTyNIVC.exe
  2⤵
  PID:9000
- C:\Windows\System\fDkJule.exe
  C:\Windows\System\fDkJule.exe
  2⤵
  PID:9052
- C:\Windows\System\TiKrhlq.exe
  C:\Windows\System\TiKrhlq.exe
  2⤵
  PID:9072
- C:\Windows\System\PezefTT.exe
  C:\Windows\System\PezefTT.exe
  2⤵
  PID:9100
- C:\Windows\System\ofbcgtL.exe
  C:\Windows\System\ofbcgtL.exe
  2⤵
  PID:9124
- C:\Windows\System\DPghfDO.exe
  C:\Windows\System\DPghfDO.exe
  2⤵
  PID:9152
- C:\Windows\System\emnahRD.exe
  C:\Windows\System\emnahRD.exe
  2⤵
  PID:9180
- C:\Windows\System\KbRpsYz.exe
  C:\Windows\System\KbRpsYz.exe
  2⤵
  PID:9208
- C:\Windows\System\BitBDtq.exe
  C:\Windows\System\BitBDtq.exe
  2⤵
  PID:8248
- C:\Windows\System\JPlEtrT.exe
  C:\Windows\System\JPlEtrT.exe
  2⤵
  PID:8300
- C:\Windows\System\elEHqwb.exe
  C:\Windows\System\elEHqwb.exe
  2⤵
  PID:8364
- C:\Windows\System\afFovzM.exe
  C:\Windows\System\afFovzM.exe
  2⤵
  PID:8436
- C:\Windows\System\DyaDQBA.exe
  C:\Windows\System\DyaDQBA.exe
  2⤵
  PID:8508
- C:\Windows\System\trTWvoo.exe
  C:\Windows\System\trTWvoo.exe
  2⤵
  PID:8560
- C:\Windows\System\WYdxqmx.exe
  C:\Windows\System\WYdxqmx.exe
  2⤵
  PID:8616
- C:\Windows\System\HoGhwBe.exe
  C:\Windows\System\HoGhwBe.exe
  2⤵
  PID:8676
- C:\Windows\System\KADwOrM.exe
  C:\Windows\System\KADwOrM.exe
  2⤵
  PID:8780
- C:\Windows\System\wHqyurT.exe
  C:\Windows\System\wHqyurT.exe
  2⤵
  PID:8840
- C:\Windows\System\UJieLZp.exe
  C:\Windows\System\UJieLZp.exe
  2⤵
  PID:8896
- C:\Windows\System\kuuNssH.exe
  C:\Windows\System\kuuNssH.exe
  2⤵
  PID:8948
- C:\Windows\System\LRedLFm.exe
  C:\Windows\System\LRedLFm.exe
  2⤵
  PID:9024
- C:\Windows\System\rxNOxTd.exe
  C:\Windows\System\rxNOxTd.exe
  2⤵
  PID:9064
- C:\Windows\System\tylHSRj.exe
  C:\Windows\System\tylHSRj.exe
  2⤵
  PID:9148
- C:\Windows\System\EIEMQaF.exe
  C:\Windows\System\EIEMQaF.exe
  2⤵
  PID:9200
- C:\Windows\System\cMmvlQb.exe
  C:\Windows\System\cMmvlQb.exe
  2⤵
  PID:8352
- C:\Windows\System\URZwViW.exe
  C:\Windows\System\URZwViW.exe
  2⤵
  PID:8416
- C:\Windows\System\iQDCUny.exe
  C:\Windows\System\iQDCUny.exe
  2⤵
  PID:8596
- C:\Windows\System\rLWjdil.exe
  C:\Windows\System\rLWjdil.exe
  2⤵
  PID:8828
- C:\Windows\System\FnMlHxw.exe
  C:\Windows\System\FnMlHxw.exe
  2⤵
  PID:8964
- C:\Windows\System\xxavZkV.exe
  C:\Windows\System\xxavZkV.exe
  2⤵
  PID:9088
- C:\Windows\System\gSkEnry.exe
  C:\Windows\System\gSkEnry.exe
  2⤵
  PID:9172
- C:\Windows\System\JJPbWdD.exe
  C:\Windows\System\JJPbWdD.exe
  2⤵
  PID:8600
- C:\Windows\System\KebiEcQ.exe
  C:\Windows\System\KebiEcQ.exe
  2⤵
  PID:8996
- C:\Windows\System\IwUapNH.exe
  C:\Windows\System\IwUapNH.exe
  2⤵
  PID:9136
- C:\Windows\System\crZVANt.exe
  C:\Windows\System\crZVANt.exe
  2⤵
  PID:8472
- C:\Windows\System\BnrsSwq.exe
  C:\Windows\System\BnrsSwq.exe
  2⤵
  PID:9244
- C:\Windows\System\gRzjZqB.exe
  C:\Windows\System\gRzjZqB.exe
  2⤵
  PID:9264
- C:\Windows\System\QQoBans.exe
  C:\Windows\System\QQoBans.exe
  2⤵
  PID:9292
- C:\Windows\System\EYbNWSi.exe
  C:\Windows\System\EYbNWSi.exe
  2⤵
  PID:9332
- C:\Windows\System\SAdIRFm.exe
  C:\Windows\System\SAdIRFm.exe
  2⤵
  PID:9352
- C:\Windows\System\mbPuvNG.exe
  C:\Windows\System\mbPuvNG.exe
  2⤵
  PID:9376
- C:\Windows\System\ApIfUph.exe
  C:\Windows\System\ApIfUph.exe
  2⤵
  PID:9404
- C:\Windows\System\qgxPPcz.exe
  C:\Windows\System\qgxPPcz.exe
  2⤵
  PID:9444
- C:\Windows\System\UMtBGzH.exe
  C:\Windows\System\UMtBGzH.exe
  2⤵
  PID:9468
- C:\Windows\System\KvEnAPC.exe
  C:\Windows\System\KvEnAPC.exe
  2⤵
  PID:9488
- C:\Windows\System\JFPGxnq.exe
  C:\Windows\System\JFPGxnq.exe
  2⤵
  PID:9504
- C:\Windows\System\WUMTqiU.exe
  C:\Windows\System\WUMTqiU.exe
  2⤵
  PID:9536
- C:\Windows\System\UOtUjsO.exe
  C:\Windows\System\UOtUjsO.exe
  2⤵
  PID:9576
- C:\Windows\System\BMJOLkT.exe
  C:\Windows\System\BMJOLkT.exe
  2⤵
  PID:9612
- C:\Windows\System\phKbYSU.exe
  C:\Windows\System\phKbYSU.exe
  2⤵
  PID:9640
- C:\Windows\System\HoOuyEA.exe
  C:\Windows\System\HoOuyEA.exe
  2⤵
  PID:9656
- C:\Windows\System\ApaIXRp.exe
  C:\Windows\System\ApaIXRp.exe
  2⤵
  PID:9684
- C:\Windows\System\iHSeEYr.exe
  C:\Windows\System\iHSeEYr.exe
  2⤵
  PID:9712
- C:\Windows\System\TkrNqay.exe
  C:\Windows\System\TkrNqay.exe
  2⤵
  PID:9752
- C:\Windows\System\jJOWhYe.exe
  C:\Windows\System\jJOWhYe.exe
  2⤵
  PID:9772
- C:\Windows\System\PpFJsYp.exe
  C:\Windows\System\PpFJsYp.exe
  2⤵
  PID:9800
- C:\Windows\System\wuLgXKu.exe
  C:\Windows\System\wuLgXKu.exe
  2⤵
  PID:9824
- C:\Windows\System\LTIVGpe.exe
  C:\Windows\System\LTIVGpe.exe
  2⤵
  PID:9840
- C:\Windows\System\NkwvmqY.exe
  C:\Windows\System\NkwvmqY.exe
  2⤵
  PID:9868
- C:\Windows\System\SDZjmOI.exe
  C:\Windows\System\SDZjmOI.exe
  2⤵
  PID:9920
- C:\Windows\System\hyJZXKd.exe
  C:\Windows\System\hyJZXKd.exe
  2⤵
  PID:9948
- C:\Windows\System\DpuGEAw.exe
  C:\Windows\System\DpuGEAw.exe
  2⤵
  PID:9976
- C:\Windows\System\WsDyfzd.exe
  C:\Windows\System\WsDyfzd.exe
  2⤵
  PID:10004
- C:\Windows\System\wmPzxgp.exe
  C:\Windows\System\wmPzxgp.exe
  2⤵
  PID:10032
- C:\Windows\System\KTBlOuv.exe
  C:\Windows\System\KTBlOuv.exe
  2⤵
  PID:10060
- C:\Windows\System\JcBrNPV.exe
  C:\Windows\System\JcBrNPV.exe
  2⤵
  PID:10076
- C:\Windows\System\hGGAgdC.exe
  C:\Windows\System\hGGAgdC.exe
  2⤵
  PID:10092
- C:\Windows\System\kfJYfWj.exe
  C:\Windows\System\kfJYfWj.exe
  2⤵
  PID:10128
- C:\Windows\System\MnxGVSx.exe
  C:\Windows\System\MnxGVSx.exe
  2⤵
  PID:10156
- C:\Windows\System\slJXaif.exe
  C:\Windows\System\slJXaif.exe
  2⤵
  PID:10176
- C:\Windows\System\OROgUga.exe
  C:\Windows\System\OROgUga.exe
  2⤵
  PID:10204
- C:\Windows\System\wcqVlka.exe
  C:\Windows\System\wcqVlka.exe
  2⤵
  PID:8800
- C:\Windows\System\MZludHO.exe
  C:\Windows\System\MZludHO.exe
  2⤵
  PID:9236
- C:\Windows\System\IHxfwCe.exe
  C:\Windows\System\IHxfwCe.exe
  2⤵
  PID:9360
- C:\Windows\System\olUbXZX.exe
  C:\Windows\System\olUbXZX.exe
  2⤵
  PID:9368
- C:\Windows\System\aGDzpWY.exe
  C:\Windows\System\aGDzpWY.exe
  2⤵
  PID:9484
- C:\Windows\System\oXrSYZu.exe
  C:\Windows\System\oXrSYZu.exe
  2⤵
  PID:9496
- C:\Windows\System\KttJNMm.exe
  C:\Windows\System\KttJNMm.exe
  2⤵
  PID:9560
- C:\Windows\System\bZbPMWX.exe
  C:\Windows\System\bZbPMWX.exe
  2⤵
  PID:9596
- C:\Windows\System\btylpaZ.exe
  C:\Windows\System\btylpaZ.exe
  2⤵
  PID:9652
- C:\Windows\System\RjhMvDO.exe
  C:\Windows\System\RjhMvDO.exe
  2⤵
  PID:9704
- C:\Windows\System\vZlxXcV.exe
  C:\Windows\System\vZlxXcV.exe
  2⤵
  PID:9760
- C:\Windows\System\BwNvUSI.exe
  C:\Windows\System\BwNvUSI.exe
  2⤵
  PID:9836
- C:\Windows\System\dodclXE.exe
  C:\Windows\System\dodclXE.exe
  2⤵
  PID:9900
- C:\Windows\System\mHVJrTx.exe
  C:\Windows\System\mHVJrTx.exe
  2⤵
  PID:9960
- C:\Windows\System\MdQKVON.exe
  C:\Windows\System\MdQKVON.exe
  2⤵
  PID:10112
- C:\Windows\System\GdXGPUx.exe
  C:\Windows\System\GdXGPUx.exe
  2⤵
  PID:10216
- C:\Windows\System\UGUqVqg.exe
  C:\Windows\System\UGUqVqg.exe
  2⤵
  PID:9312
- C:\Windows\System\RGWHtwL.exe
  C:\Windows\System\RGWHtwL.exe
  2⤵
  PID:9424
- C:\Windows\System\RPhYade.exe
  C:\Windows\System\RPhYade.exe
  2⤵
  PID:9480
- C:\Windows\System\DdyKYEo.exe
  C:\Windows\System\DdyKYEo.exe
  2⤵
  PID:9600
- C:\Windows\System\eacKFjG.exe
  C:\Windows\System\eacKFjG.exe
  2⤵
  PID:9780
- C:\Windows\System\rWFuhBi.exe
  C:\Windows\System\rWFuhBi.exe
  2⤵
  PID:9904
- C:\Windows\System\renxxOr.exe
  C:\Windows\System\renxxOr.exe
  2⤵
  PID:10168
- C:\Windows\System\HVdHPjE.exe
  C:\Windows\System\HVdHPjE.exe
  2⤵
  PID:9400
- C:\Windows\System\OaZQpRh.exe
  C:\Windows\System\OaZQpRh.exe
  2⤵
  PID:9632
- C:\Windows\System\yoXJHUE.exe
  C:\Windows\System\yoXJHUE.exe
  2⤵
  PID:10140
- C:\Windows\System\KIzEOLG.exe
  C:\Windows\System\KIzEOLG.exe
  2⤵
  PID:9852
- C:\Windows\System\watulVy.exe
  C:\Windows\System\watulVy.exe
  2⤵
  PID:10244
- C:\Windows\System\oQlTBcP.exe
  C:\Windows\System\oQlTBcP.exe
  2⤵
  PID:10272
- C:\Windows\System\UIggjfH.exe
  C:\Windows\System\UIggjfH.exe
  2⤵
  PID:10300
- C:\Windows\System\obDNWZQ.exe
  C:\Windows\System\obDNWZQ.exe
  2⤵
  PID:10328
- C:\Windows\System\cVtvipB.exe
  C:\Windows\System\cVtvipB.exe
  2⤵
  PID:10356
- C:\Windows\System\OKSeBrv.exe
  C:\Windows\System\OKSeBrv.exe
  2⤵
  PID:10384
- C:\Windows\System\yqAPLAz.exe
  C:\Windows\System\yqAPLAz.exe
  2⤵
  PID:10408
- C:\Windows\System\ZWZPeXT.exe
  C:\Windows\System\ZWZPeXT.exe
  2⤵
  PID:10432
- C:\Windows\System\MiKWwpD.exe
  C:\Windows\System\MiKWwpD.exe
  2⤵
  PID:10468
- C:\Windows\System\oRVvwpP.exe
  C:\Windows\System\oRVvwpP.exe
  2⤵
  PID:10496
- C:\Windows\System\dujgoRC.exe
  C:\Windows\System\dujgoRC.exe
  2⤵
  PID:10524
- C:\Windows\System\HDguFph.exe
  C:\Windows\System\HDguFph.exe
  2⤵
  PID:10552
- C:\Windows\System\tCrujgE.exe
  C:\Windows\System\tCrujgE.exe
  2⤵
  PID:10580
- C:\Windows\System\wazYyVF.exe
  C:\Windows\System\wazYyVF.exe
  2⤵
  PID:10608
- C:\Windows\System\EWlBpbg.exe
  C:\Windows\System\EWlBpbg.exe
  2⤵
  PID:10636
- C:\Windows\System\HxwhmjS.exe
  C:\Windows\System\HxwhmjS.exe
  2⤵
  PID:10664
- C:\Windows\System\JjQDSuJ.exe
  C:\Windows\System\JjQDSuJ.exe
  2⤵
  PID:10692
- C:\Windows\System\SmRQqFU.exe
  C:\Windows\System\SmRQqFU.exe
  2⤵
  PID:10720
- C:\Windows\System\ZZjONeu.exe
  C:\Windows\System\ZZjONeu.exe
  2⤵
  PID:10748
- C:\Windows\System\oqsOjAk.exe
  C:\Windows\System\oqsOjAk.exe
  2⤵
  PID:10776
- C:\Windows\System\pTqkXzr.exe
  C:\Windows\System\pTqkXzr.exe
  2⤵
  PID:10804
- C:\Windows\System\mchJPeK.exe
  C:\Windows\System\mchJPeK.exe
  2⤵
  PID:10832
- C:\Windows\System\msmJxKq.exe
  C:\Windows\System\msmJxKq.exe
  2⤵
  PID:10860
- C:\Windows\System\OGJLXXr.exe
  C:\Windows\System\OGJLXXr.exe
  2⤵
  PID:10888
- C:\Windows\System\xXCnytM.exe
  C:\Windows\System\xXCnytM.exe
  2⤵
  PID:10916
- C:\Windows\System\wABZvTn.exe
  C:\Windows\System\wABZvTn.exe
  2⤵
  PID:10944
- C:\Windows\System\PmzgFsF.exe
  C:\Windows\System\PmzgFsF.exe
  2⤵
  PID:10972
- C:\Windows\System\jmbFuGq.exe
  C:\Windows\System\jmbFuGq.exe
  2⤵
  PID:11000
- C:\Windows\System\jcNLnEl.exe
  C:\Windows\System\jcNLnEl.exe
  2⤵
  PID:11028
- C:\Windows\System\ZqFEhAs.exe
  C:\Windows\System\ZqFEhAs.exe
  2⤵
  PID:11056
- C:\Windows\System\qSXOEKi.exe
  C:\Windows\System\qSXOEKi.exe
  2⤵
  PID:11084
- C:\Windows\System\HzbtnZN.exe
  C:\Windows\System\HzbtnZN.exe
  2⤵
  PID:11112
- C:\Windows\System\fdlCoyo.exe
  C:\Windows\System\fdlCoyo.exe
  2⤵
  PID:11140
- C:\Windows\System\wbrPwvB.exe
  C:\Windows\System\wbrPwvB.exe
  2⤵
  PID:11168
- C:\Windows\System\UJcqJzj.exe
  C:\Windows\System\UJcqJzj.exe
  2⤵
  PID:11196
- C:\Windows\System\APZJCju.exe
  C:\Windows\System\APZJCju.exe
  2⤵
  PID:11224
- C:\Windows\System\jlCZNoJ.exe
  C:\Windows\System\jlCZNoJ.exe
  2⤵
  PID:11252
- C:\Windows\System\UPLtxkp.exe
  C:\Windows\System\UPLtxkp.exe
  2⤵
  PID:10264
- C:\Windows\System\esupEHg.exe
  C:\Windows\System\esupEHg.exe
  2⤵
  PID:10320
- C:\Windows\System\TWcoeOC.exe
  C:\Windows\System\TWcoeOC.exe
  2⤵
  PID:10400
- C:\Windows\System\dWjscRi.exe
  C:\Windows\System\dWjscRi.exe
  2⤵
  PID:10464
- C:\Windows\System\BtcTzUK.exe
  C:\Windows\System\BtcTzUK.exe
  2⤵
  PID:10516
- C:\Windows\System\xjyJXhH.exe
  C:\Windows\System\xjyJXhH.exe
  2⤵
  PID:10596
- C:\Windows\System\aCyhTmO.exe
  C:\Windows\System\aCyhTmO.exe
  2⤵
  PID:10656
- C:\Windows\System\QIGTEWt.exe
  C:\Windows\System\QIGTEWt.exe
  2⤵
  PID:10716
- C:\Windows\System\MAEldLJ.exe
  C:\Windows\System\MAEldLJ.exe
  2⤵
  PID:10788
- C:\Windows\System\wXcBtdO.exe
  C:\Windows\System\wXcBtdO.exe
  2⤵
  PID:10844
- C:\Windows\System\GYWnjSH.exe
  C:\Windows\System\GYWnjSH.exe
  2⤵
  PID:10908
- C:\Windows\System\EmjcCFi.exe
  C:\Windows\System\EmjcCFi.exe
  2⤵
  PID:10984
- C:\Windows\System\xJkgaMA.exe
  C:\Windows\System\xJkgaMA.exe
  2⤵
  PID:11044
- C:\Windows\System\CstJatz.exe
  C:\Windows\System\CstJatz.exe
  2⤵
  PID:11124
- C:\Windows\System\lhPmOMW.exe
  C:\Windows\System\lhPmOMW.exe
  2⤵
  PID:11180
- C:\Windows\System\NumgWOG.exe
  C:\Windows\System\NumgWOG.exe
  2⤵
  PID:11244
- C:\Windows\System\SHhkXiv.exe
  C:\Windows\System\SHhkXiv.exe
  2⤵
  PID:10324
- C:\Windows\System\QsJNyNw.exe
  C:\Windows\System\QsJNyNw.exe
  2⤵
  PID:10488
- C:\Windows\System\yXCYfJJ.exe
  C:\Windows\System\yXCYfJJ.exe
  2⤵
  PID:10624
- C:\Windows\System\jZOIIOu.exe
  C:\Windows\System\jZOIIOu.exe
  2⤵
  PID:10704
- C:\Windows\System\sBRKzPU.exe
  C:\Windows\System\sBRKzPU.exe
  2⤵
  PID:10940
- C:\Windows\System\bnPemFT.exe
  C:\Windows\System\bnPemFT.exe
  2⤵
  PID:11096
- C:\Windows\System\tWvZRyG.exe
  C:\Windows\System\tWvZRyG.exe
  2⤵
  PID:11236
- C:\Windows\System\HWkqKnW.exe
  C:\Windows\System\HWkqKnW.exe
  2⤵
  PID:10380
- C:\Windows\System\EyhEWts.exe
  C:\Windows\System\EyhEWts.exe
  2⤵
  PID:10576
- C:\Windows\System\tSTEGPi.exe
  C:\Windows\System\tSTEGPi.exe
  2⤵
  PID:11040
- C:\Windows\System\cpgdtOZ.exe
  C:\Windows\System\cpgdtOZ.exe
  2⤵
  PID:10856
- C:\Windows\System\qOwBDTR.exe
  C:\Windows\System\qOwBDTR.exe
  2⤵
  PID:11284
- C:\Windows\System\NQSmcfe.exe
  C:\Windows\System\NQSmcfe.exe
  2⤵
  PID:11312
- C:\Windows\System\JhqUzlt.exe
  C:\Windows\System\JhqUzlt.exe
  2⤵
  PID:11340
- C:\Windows\System\XnxmedR.exe
  C:\Windows\System\XnxmedR.exe
  2⤵
  PID:11356
- C:\Windows\System\mgZshJn.exe
  C:\Windows\System\mgZshJn.exe
  2⤵
  PID:11384
- C:\Windows\System\MGJLVhQ.exe
  C:\Windows\System\MGJLVhQ.exe
  2⤵
  PID:11412
- C:\Windows\System\xNgGQtF.exe
  C:\Windows\System\xNgGQtF.exe
  2⤵
  PID:11440
- C:\Windows\System\aiEqroo.exe
  C:\Windows\System\aiEqroo.exe
  2⤵
  PID:11456
- C:\Windows\System\oBbiKPg.exe
  C:\Windows\System\oBbiKPg.exe
  2⤵
  PID:11480
- C:\Windows\System\CGslTGb.exe
  C:\Windows\System\CGslTGb.exe
  2⤵
  PID:11504
- C:\Windows\System\dKWwFHB.exe
  C:\Windows\System\dKWwFHB.exe
  2⤵
  PID:11528
- C:\Windows\System\QkuqCwK.exe
  C:\Windows\System\QkuqCwK.exe
  2⤵
  PID:11580
- C:\Windows\System\AzwByiI.exe
  C:\Windows\System\AzwByiI.exe
  2⤵
  PID:11600
- C:\Windows\System\BYMHXCg.exe
  C:\Windows\System\BYMHXCg.exe
  2⤵
  PID:11636
- C:\Windows\System\qgBxnAP.exe
  C:\Windows\System\qgBxnAP.exe
  2⤵
  PID:11660
- C:\Windows\System\LsYjbFU.exe
  C:\Windows\System\LsYjbFU.exe
  2⤵
  PID:11692
- C:\Windows\System\dhGdKeD.exe
  C:\Windows\System\dhGdKeD.exe
  2⤵
  PID:11712
- C:\Windows\System\vUTFtrw.exe
  C:\Windows\System\vUTFtrw.exe
  2⤵
  PID:11736
- C:\Windows\System\tAitqxd.exe
  C:\Windows\System\tAitqxd.exe
  2⤵
  PID:11764
- C:\Windows\System\nsVmMBI.exe
  C:\Windows\System\nsVmMBI.exe
  2⤵
  PID:11816
- C:\Windows\System\vfAyHiB.exe
  C:\Windows\System\vfAyHiB.exe
  2⤵
  PID:11844
- C:\Windows\System\aCLbBUX.exe
  C:\Windows\System\aCLbBUX.exe
  2⤵
  PID:11868
- C:\Windows\System\zCynIlA.exe
  C:\Windows\System\zCynIlA.exe
  2⤵
  PID:11888
- C:\Windows\System\ufUweAs.exe
  C:\Windows\System\ufUweAs.exe
  2⤵
  PID:11916
- C:\Windows\System\YxTHPqW.exe
  C:\Windows\System\YxTHPqW.exe
  2⤵
  PID:11940
- C:\Windows\System\mJoMZyx.exe
  C:\Windows\System\mJoMZyx.exe
  2⤵
  PID:11972
- C:\Windows\System\gEWFdSI.exe
  C:\Windows\System\gEWFdSI.exe
  2⤵
  PID:12012
- C:\Windows\System\tPzVknC.exe
  C:\Windows\System\tPzVknC.exe
  2⤵
  PID:12028
- C:\Windows\System\JmhvZyc.exe
  C:\Windows\System\JmhvZyc.exe
  2⤵
  PID:12060
- C:\Windows\System\vRbsMYK.exe
  C:\Windows\System\vRbsMYK.exe
  2⤵
  PID:12080
- C:\Windows\System\laJMUrL.exe
  C:\Windows\System\laJMUrL.exe
  2⤵
  PID:12112
- C:\Windows\System\NoviYcD.exe
  C:\Windows\System\NoviYcD.exe
  2⤵
  PID:12148
- C:\Windows\System\rpABsdU.exe
  C:\Windows\System\rpABsdU.exe
  2⤵
  PID:12180
- C:\Windows\System\fnAIyrZ.exe
  C:\Windows\System\fnAIyrZ.exe
  2⤵
  PID:12208
- C:\Windows\System\FFZazck.exe
  C:\Windows\System\FFZazck.exe
  2⤵
  PID:12236
- C:\Windows\System\qdiceXO.exe
  C:\Windows\System\qdiceXO.exe
  2⤵
  PID:12252
- C:\Windows\System\lbdqhsL.exe
  C:\Windows\System\lbdqhsL.exe
  2⤵
  PID:12280
- C:\Windows\System\XAnTIsI.exe
  C:\Windows\System\XAnTIsI.exe
  2⤵
  PID:11296
- C:\Windows\System\qHWQnlX.exe
  C:\Windows\System\qHWQnlX.exe
  2⤵
  PID:11352
- C:\Windows\System\LPsxuWd.exe
  C:\Windows\System\LPsxuWd.exe
  2⤵
  PID:11436
- C:\Windows\System\xXmPCXe.exe
  C:\Windows\System\xXmPCXe.exe
  2⤵
  PID:11500
- C:\Windows\System\jwBdqbK.exe
  C:\Windows\System\jwBdqbK.exe
  2⤵
  PID:11548
- C:\Windows\System\PwHOkFs.exe
  C:\Windows\System\PwHOkFs.exe
  2⤵
  PID:11616
- C:\Windows\System\UcDaOes.exe
  C:\Windows\System\UcDaOes.exe
  2⤵
  PID:11656
- C:\Windows\System\CuszOGO.exe
  C:\Windows\System\CuszOGO.exe
  2⤵
  PID:11720
- C:\Windows\System\NhbkwRj.exe
  C:\Windows\System\NhbkwRj.exe
  2⤵
  PID:11812
- C:\Windows\System\FfxHrNz.exe
  C:\Windows\System\FfxHrNz.exe
  2⤵
  PID:11856
- C:\Windows\System\qpVxhXZ.exe
  C:\Windows\System\qpVxhXZ.exe
  2⤵
  PID:11968
- C:\Windows\System\FZBGUpx.exe
  C:\Windows\System\FZBGUpx.exe
  2⤵
  PID:12008
- C:\Windows\System\wyaqsUJ.exe
  C:\Windows\System\wyaqsUJ.exe
  2⤵
  PID:12044
- C:\Windows\System\qCezkku.exe
  C:\Windows\System\qCezkku.exe
  2⤵
  PID:12140
- C:\Windows\System\zlBEMQl.exe
  C:\Windows\System\zlBEMQl.exe
  2⤵
  PID:12200
- C:\Windows\System\URqWLxH.exe
  C:\Windows\System\URqWLxH.exe
  2⤵
  PID:12228
- C:\Windows\System\UBLEBuu.exe
  C:\Windows\System\UBLEBuu.exe
  2⤵
  PID:11308
- C:\Windows\System\eWAHLJm.exe
  C:\Windows\System\eWAHLJm.exe
  2⤵
  PID:11468
- C:\Windows\System\UyuWOBk.exe
  C:\Windows\System\UyuWOBk.exe
  2⤵
  PID:11648
- C:\Windows\System\depTZuv.exe
  C:\Windows\System\depTZuv.exe
  2⤵
  PID:11864
- C:\Windows\System\xkagNOM.exe
  C:\Windows\System\xkagNOM.exe
  2⤵
  PID:11936
- C:\Windows\System\zuzpmVg.exe
  C:\Windows\System\zuzpmVg.exe
  2⤵
  PID:12100
- C:\Windows\System\ZzzBmMv.exe
  C:\Windows\System\ZzzBmMv.exe
  2⤵
  PID:11332
- C:\Windows\System\PVFvXDH.exe
  C:\Windows\System\PVFvXDH.exe
  2⤵
  PID:11524
- C:\Windows\System\SrvsGJJ.exe
  C:\Windows\System\SrvsGJJ.exe
  2⤵
  PID:12108
- C:\Windows\System\HUnhVnO.exe
  C:\Windows\System\HUnhVnO.exe
  2⤵
  PID:11632
- C:\Windows\System\rhbVDMA.exe
  C:\Windows\System\rhbVDMA.exe
  2⤵
  PID:11992
- C:\Windows\System\wqOYyLJ.exe
  C:\Windows\System\wqOYyLJ.exe
  2⤵
  PID:12300
- C:\Windows\System\iEvPYUy.exe
  C:\Windows\System\iEvPYUy.exe
  2⤵
  PID:12316
- C:\Windows\System\OMOYvSy.exe
  C:\Windows\System\OMOYvSy.exe
  2⤵
  PID:12352
- C:\Windows\System\APXIOIx.exe
  C:\Windows\System\APXIOIx.exe
  2⤵
  PID:12376
- C:\Windows\System\UOekaJJ.exe
  C:\Windows\System\UOekaJJ.exe
  2⤵
  PID:12408
- C:\Windows\System\eoJnHXc.exe
  C:\Windows\System\eoJnHXc.exe
  2⤵
  PID:12432
- C:\Windows\System\KUUalYZ.exe
  C:\Windows\System\KUUalYZ.exe
  2⤵
  PID:12452
- C:\Windows\System\lwxQTqd.exe
  C:\Windows\System\lwxQTqd.exe
  2⤵
  PID:12496
- C:\Windows\System\HgoHcQf.exe
  C:\Windows\System\HgoHcQf.exe
  2⤵
  PID:12524
- C:\Windows\System\IHDpisW.exe
  C:\Windows\System\IHDpisW.exe
  2⤵
  PID:12552
- C:\Windows\System\NZUHqNw.exe
  C:\Windows\System\NZUHqNw.exe
  2⤵
  PID:12568
- C:\Windows\System\oKfAHdA.exe
  C:\Windows\System\oKfAHdA.exe
  2⤵
  PID:12584
- C:\Windows\System\BlqSIIn.exe
  C:\Windows\System\BlqSIIn.exe
  2⤵
  PID:12616
- C:\Windows\System\vQOWPzL.exe
  C:\Windows\System\vQOWPzL.exe
  2⤵
  PID:12656
- C:\Windows\System\SCVpmUz.exe
  C:\Windows\System\SCVpmUz.exe
  2⤵
  PID:12680
- C:\Windows\System\rcpMryC.exe
  C:\Windows\System\rcpMryC.exe
  2⤵
  PID:12696
- C:\Windows\System\ooTEScn.exe
  C:\Windows\System\ooTEScn.exe
  2⤵
  PID:12728
- C:\Windows\System\jRZvNLy.exe
  C:\Windows\System\jRZvNLy.exe
  2⤵
  PID:12764
- C:\Windows\System\yuWvNLn.exe
  C:\Windows\System\yuWvNLn.exe
  2⤵
  PID:12792
- C:\Windows\System\pulaagO.exe
  C:\Windows\System\pulaagO.exe
  2⤵
  PID:12820
- C:\Windows\System\CZkLaRu.exe
  C:\Windows\System\CZkLaRu.exe
  2⤵
  PID:12840
- C:\Windows\System\SJiROGT.exe
  C:\Windows\System\SJiROGT.exe
  2⤵
  PID:12888
- C:\Windows\System\KociIRX.exe
  C:\Windows\System\KociIRX.exe
  2⤵
  PID:12916
- C:\Windows\System\SzUwQKZ.exe
  C:\Windows\System\SzUwQKZ.exe
  2⤵
  PID:12944
- C:\Windows\System\CsPcgOB.exe
  C:\Windows\System\CsPcgOB.exe
  2⤵
  PID:12972
- C:\Windows\System\BSjcnLr.exe
  C:\Windows\System\BSjcnLr.exe
  2⤵
  PID:12996
- C:\Windows\System\nYXOtYj.exe
  C:\Windows\System\nYXOtYj.exe
  2⤵
  PID:13016
- C:\Windows\System\DwfyfeY.exe
  C:\Windows\System\DwfyfeY.exe
  2⤵
  PID:13048
- C:\Windows\System\gmKSJRH.exe
  C:\Windows\System\gmKSJRH.exe
  2⤵
  PID:13080
- C:\Windows\System\adsTRoj.exe
  C:\Windows\System\adsTRoj.exe
  2⤵
  PID:13104
- C:\Windows\System\iyCrHTp.exe
  C:\Windows\System\iyCrHTp.exe
  2⤵
  PID:13128
- C:\Windows\System\YbptXmm.exe
  C:\Windows\System\YbptXmm.exe
  2⤵
  PID:13156
- C:\Windows\System\RcaGweZ.exe
  C:\Windows\System\RcaGweZ.exe
  2⤵
  PID:13196
- C:\Windows\System\hQRVgxC.exe
  C:\Windows\System\hQRVgxC.exe
  2⤵
  PID:13224
- C:\Windows\System\PjYVTWt.exe
  C:\Windows\System\PjYVTWt.exe
  2⤵
  PID:13252
- C:\Windows\System\zzudjsM.exe
  C:\Windows\System\zzudjsM.exe
  2⤵
  PID:13268
- C:\Windows\System\bohOQoN.exe
  C:\Windows\System\bohOQoN.exe
  2⤵
  PID:13308
- C:\Windows\System\sXThyoq.exe
  C:\Windows\System\sXThyoq.exe
  2⤵
  PID:12348
- C:\Windows\System\xmtBzdc.exe
  C:\Windows\System\xmtBzdc.exe
  2⤵
  PID:12404
- C:\Windows\System\TGRFVuc.exe
  C:\Windows\System\TGRFVuc.exe
  2⤵
  PID:12440
- C:\Windows\System\fkxrIDD.exe
  C:\Windows\System\fkxrIDD.exe
  2⤵
  PID:12476
- C:\Windows\System\czuTyBH.exe
  C:\Windows\System\czuTyBH.exe
  2⤵
  PID:12544
- C:\Windows\System\OQxzQyZ.exe
  C:\Windows\System\OQxzQyZ.exe
  2⤵
  PID:12628
- C:\Windows\System\tSIxtdb.exe
  C:\Windows\System\tSIxtdb.exe
  2⤵
  PID:12672
- C:\Windows\System\hpOeTeT.exe
  C:\Windows\System\hpOeTeT.exe
  2⤵
  PID:12712
- C:\Windows\System\LREepiW.exe
  C:\Windows\System\LREepiW.exe
  2⤵
  PID:12828
- C:\Windows\System\JHnjmLS.exe
  C:\Windows\System\JHnjmLS.exe
  2⤵
  PID:12900
- C:\Windows\System\yFxBudD.exe
  C:\Windows\System\yFxBudD.exe
  2⤵
  PID:12964
- C:\Windows\System\ZrWGPQp.exe
  C:\Windows\System\ZrWGPQp.exe
  2⤵
  PID:13056
- C:\Windows\System\xssxKJz.exe
  C:\Windows\System\xssxKJz.exe
  2⤵
  PID:13040
- C:\Windows\System\bHWNkOI.exe
  C:\Windows\System\bHWNkOI.exe
  2⤵
  PID:13144
- C:\Windows\System\NGzPCeK.exe
  C:\Windows\System\NGzPCeK.exe
  2⤵
  PID:13212
- C:\Windows\System\nupOfAo.exe
  C:\Windows\System\nupOfAo.exe
  2⤵
  PID:12308
- C:\Windows\System\CiIvVes.exe
  C:\Windows\System\CiIvVes.exe
  2⤵
  PID:12520
- C:\Windows\System\iAmTdSf.exe
  C:\Windows\System\iAmTdSf.exe
  2⤵
  PID:12448
- C:\Windows\System\XWjEfJb.exe
  C:\Windows\System\XWjEfJb.exe
  2⤵
  PID:12580
- C:\Windows\System\Ozzznpx.exe
  C:\Windows\System\Ozzznpx.exe
  2⤵
  PID:12864
- C:\Windows\System\QfbfciG.exe
  C:\Windows\System\QfbfciG.exe
  2⤵
  PID:12932
- C:\Windows\System\sfdUxeI.exe
  C:\Windows\System\sfdUxeI.exe
  2⤵
  PID:13124
- C:\Windows\System\bsmvwcN.exe
  C:\Windows\System\bsmvwcN.exe
  2⤵
  PID:12384
- C:\Windows\System\gmfwrrs.exe
  C:\Windows\System\gmfwrrs.exe
  2⤵
  PID:12564
- C:\Windows\System\dfOedqb.exe
  C:\Windows\System\dfOedqb.exe
  2⤵
  PID:13012
- C:\Windows\System\wGKLqaP.exe
  C:\Windows\System\wGKLqaP.exe
  2⤵
  PID:12708
- C:\Windows\System\mjPFAfO.exe
  C:\Windows\System\mjPFAfO.exe
  2⤵
  PID:13168
- C:\Windows\System\XVgRRCT.exe
  C:\Windows\System\XVgRRCT.exe
  2⤵
  PID:13324
- C:\Windows\System\IJIddqA.exe
  C:\Windows\System\IJIddqA.exe
  2⤵
  PID:13360
- C:\Windows\System\oqMWBMD.exe
  C:\Windows\System\oqMWBMD.exe
  2⤵
  PID:13388
- C:\Windows\System\IstXcAC.exe
  C:\Windows\System\IstXcAC.exe
  2⤵
  PID:13404
- C:\Windows\System\vJxbuJf.exe
  C:\Windows\System\vJxbuJf.exe
  2⤵
  PID:13432
- C:\Windows\System\hMTustM.exe
  C:\Windows\System\hMTustM.exe
  2⤵
  PID:13468
- C:\Windows\System\aorTjNH.exe
  C:\Windows\System\aorTjNH.exe
  2⤵
  PID:13500
- C:\Windows\System\rwPytgh.exe
  C:\Windows\System\rwPytgh.exe
  2⤵
  PID:13528
- C:\Windows\System\JbBFbzH.exe
  C:\Windows\System\JbBFbzH.exe
  2⤵
  PID:13544
- C:\Windows\System\jxqGedq.exe
  C:\Windows\System\jxqGedq.exe
  2⤵
  PID:13568
- C:\Windows\System\CWndxXf.exe
  C:\Windows\System\CWndxXf.exe
  2⤵
  PID:13612
- C:\Windows\System\OcvrgxE.exe
  C:\Windows\System\OcvrgxE.exe
  2⤵
  PID:13640
- C:\Windows\System\iiyqQPS.exe
  C:\Windows\System\iiyqQPS.exe
  2⤵
  PID:13656
- C:\Windows\System\lOWXtFF.exe
  C:\Windows\System\lOWXtFF.exe
  2⤵
  PID:13696
- C:\Windows\System\dYosxVw.exe
  C:\Windows\System\dYosxVw.exe
  2⤵
  PID:13724
- C:\Windows\System\rDEodoj.exe
  C:\Windows\System\rDEodoj.exe
  2⤵
  PID:13752
- C:\Windows\System\GzMUvEc.exe
  C:\Windows\System\GzMUvEc.exe
  2⤵
  PID:13780
- C:\Windows\System\tzHCeBN.exe
  C:\Windows\System\tzHCeBN.exe
  2⤵
  PID:13804
- C:\Windows\System\DmUoOCY.exe
  C:\Windows\System\DmUoOCY.exe
  2⤵
  PID:13836
- C:\Windows\System\WkIjQlN.exe
  C:\Windows\System\WkIjQlN.exe
  2⤵
  PID:13864
- C:\Windows\System\ittPvwu.exe
  C:\Windows\System\ittPvwu.exe
  2⤵
  PID:13884
- C:\Windows\System\fzTqOcT.exe
  C:\Windows\System\fzTqOcT.exe
  2⤵
  PID:13908
- C:\Windows\System\zCrrMkQ.exe
  C:\Windows\System\zCrrMkQ.exe
  2⤵
  PID:13948
- C:\Windows\System\nwiDtAq.exe
  C:\Windows\System\nwiDtAq.exe
  2⤵
  PID:13964
- C:\Windows\System\mPATuXa.exe
  C:\Windows\System\mPATuXa.exe
  2⤵
  PID:13984
- C:\Windows\System\IDtVOOU.exe
  C:\Windows\System\IDtVOOU.exe
  2⤵
  PID:14004
- C:\Windows\System\KPBaCKF.exe
  C:\Windows\System\KPBaCKF.exe
  2⤵
  PID:14036
- C:\Windows\System\axOonbL.exe
  C:\Windows\System\axOonbL.exe
  2⤵
  PID:14064
- C:\Windows\System\nspsIvC.exe
  C:\Windows\System\nspsIvC.exe
  2⤵
  PID:14112
- C:\Windows\System\xMqlNNI.exe
  C:\Windows\System\xMqlNNI.exe
  2⤵
  PID:14132
- C:\Windows\System\aunbERd.exe
  C:\Windows\System\aunbERd.exe
  2⤵
  PID:14160
- C:\Windows\System\oIQwVtQ.exe
  C:\Windows\System\oIQwVtQ.exe
  2⤵
  PID:14192
- C:\Windows\System\mMMzyWg.exe
  C:\Windows\System\mMMzyWg.exe
  2⤵
  PID:14216
- C:\Windows\System\YYuUHRZ.exe
  C:\Windows\System\YYuUHRZ.exe
  2⤵
  PID:14244
- C:\Windows\System\lAFLLwy.exe
  C:\Windows\System\lAFLLwy.exe
  2⤵
  PID:14272
- C:\Windows\System\WpdehEc.exe
  C:\Windows\System\WpdehEc.exe
  2⤵
  PID:14312
- C:\Windows\System\CqWIRMP.exe
  C:\Windows\System\CqWIRMP.exe
  2⤵
  PID:12360
- C:\Windows\System\ZgOiioY.exe
  C:\Windows\System\ZgOiioY.exe
  2⤵
  PID:13348
- C:\Windows\System\qRNSbMe.exe
  C:\Windows\System\qRNSbMe.exe
  2⤵
  PID:13444
- C:\Windows\System\dnIcrOW.exe
  C:\Windows\System\dnIcrOW.exe
  2⤵
  PID:13484
- C:\Windows\System\wNXDrNH.exe
  C:\Windows\System\wNXDrNH.exe
  2⤵
  PID:13536
- C:\Windows\System\LvPaeRi.exe
  C:\Windows\System\LvPaeRi.exe
  2⤵
  PID:13636
- C:\Windows\System\ZGNOaKB.exe
  C:\Windows\System\ZGNOaKB.exe
  2⤵
  PID:13676
- C:\Windows\System\QQUIxZb.exe
  C:\Windows\System\QQUIxZb.exe
  2⤵
  PID:13776
- C:\Windows\System\QDXcPqU.exe
  C:\Windows\System\QDXcPqU.exe
  2⤵
  PID:13832
- C:\Windows\System\xGrmArg.exe
  C:\Windows\System\xGrmArg.exe
  2⤵
  PID:13872
- C:\Windows\System\ULoXCUW.exe
  C:\Windows\System\ULoXCUW.exe
  2⤵
  PID:13936
- C:\Windows\System\fuelyXk.exe
  C:\Windows\System\fuelyXk.exe
  2⤵
  PID:13976
- C:\Windows\System\IeTnrxv.exe
  C:\Windows\System\IeTnrxv.exe
  2⤵
  PID:14056
- C:\Windows\System\gVyMJEY.exe
  C:\Windows\System\gVyMJEY.exe
  2⤵
  PID:14144
- C:\Windows\System\ZGWOfdd.exe
  C:\Windows\System\ZGWOfdd.exe
  2⤵
  PID:14176
- C:\Windows\System\tSpvZiU.exe
  C:\Windows\System\tSpvZiU.exe
  2⤵
  PID:14260
- C:\Windows\System\jNdeuzQ.exe
  C:\Windows\System\jNdeuzQ.exe
  2⤵
  PID:13356
- C:\Windows\System\hZaukKe.exe
  C:\Windows\System\hZaukKe.exe
  2⤵
  PID:13476
- C:\Windows\System\NXBsQSA.exe
  C:\Windows\System\NXBsQSA.exe
  2⤵
  PID:13652
- C:\Windows\System\OtBFzRd.exe
  C:\Windows\System\OtBFzRd.exe
  2⤵
  PID:13820
- C:\Windows\System\dgdMhNM.exe
  C:\Windows\System\dgdMhNM.exe
  2⤵
  PID:13972
- C:\Windows\System\xPnyDAV.exe
  C:\Windows\System\xPnyDAV.exe
  2⤵
  PID:14052
- C:\Windows\System\lnoBeiQ.exe
  C:\Windows\System\lnoBeiQ.exe
  2⤵
  PID:14148
- C:\Windows\System\ERqiemV.exe
  C:\Windows\System\ERqiemV.exe
  2⤵
  PID:14256
- C:\Windows\System\JJDfZbd.exe
  C:\Windows\System\JJDfZbd.exe
  2⤵
  PID:13736
- C:\Windows\System\JJXouic.exe
  C:\Windows\System\JJXouic.exe
  2⤵
  PID:13924
- C:\Windows\System\vYFlnfu.exe
  C:\Windows\System\vYFlnfu.exe
  2⤵
  PID:14204
- C:\Windows\System\yTZLnmA.exe
  C:\Windows\System\yTZLnmA.exe
  2⤵
  PID:13316
- C:\Windows\System\SVevojr.exe
  C:\Windows\System\SVevojr.exe
  2⤵
  PID:14356
- C:\Windows\System\hiZouHI.exe
  C:\Windows\System\hiZouHI.exe
  2⤵
  PID:14388
- C:\Windows\System\nhHYdNb.exe
  C:\Windows\System\nhHYdNb.exe
  2⤵
  PID:14416
- C:\Windows\System\TEHzWXk.exe
  C:\Windows\System\TEHzWXk.exe
  2⤵
  PID:14440
- C:\Windows\System\eXhtwhA.exe
  C:\Windows\System\eXhtwhA.exe
  2⤵
  PID:14472
- C:\Windows\System\YXmwvgA.exe
  C:\Windows\System\YXmwvgA.exe
  2⤵
  PID:14500
- C:\Windows\System\JfOeitq.exe
  C:\Windows\System\JfOeitq.exe
  2⤵
  PID:14520
- C:\Windows\System\HGDmaKC.exe
  C:\Windows\System\HGDmaKC.exe
  2⤵
  PID:14576
- C:\Windows\System\FyxJOgJ.exe
  C:\Windows\System\FyxJOgJ.exe
  2⤵
  PID:14600
- C:\Windows\System\WioQnYD.exe
  C:\Windows\System\WioQnYD.exe
  2⤵
  PID:14628
- C:\Windows\System\fZIKvOt.exe
  C:\Windows\System\fZIKvOt.exe
  2⤵
  PID:14668
- C:\Windows\System\HWPvbPB.exe
  C:\Windows\System\HWPvbPB.exe
  2⤵
  PID:14696
- C:\Windows\System\vMbqXRN.exe
  C:\Windows\System\vMbqXRN.exe
  2⤵
  PID:14712
- C:\Windows\System\jHLsSKT.exe
  C:\Windows\System\jHLsSKT.exe
  2⤵
  PID:14740
- C:\Windows\System\LGSbpIb.exe
  C:\Windows\System\LGSbpIb.exe
  2⤵
  PID:14756
- C:\Windows\System\dPcXaWw.exe
  C:\Windows\System\dPcXaWw.exe
  2⤵
  PID:14784
- C:\Windows\System\myFpVKb.exe
  C:\Windows\System\myFpVKb.exe
  2⤵
  PID:14816
- C:\Windows\System\SskTHCK.exe
  C:\Windows\System\SskTHCK.exe
  2⤵
  PID:14844
- C:\Windows\System\xcYlTwe.exe
  C:\Windows\System\xcYlTwe.exe
  2⤵
  PID:14864
- C:\Windows\System\lDomnMi.exe
  C:\Windows\System\lDomnMi.exe
  2⤵
  PID:14904
- C:\Windows\System\OPUyAvy.exe
  C:\Windows\System\OPUyAvy.exe
  2⤵
  PID:14924
- C:\Windows\System\tPuyEGH.exe
  C:\Windows\System\tPuyEGH.exe
  2⤵
  PID:14964
- C:\Windows\System\UNVcVFb.exe
  C:\Windows\System\UNVcVFb.exe
  2⤵
  PID:14992
- C:\Windows\System\JIddxqm.exe
  C:\Windows\System\JIddxqm.exe
  2⤵
  PID:15012
- C:\Windows\System\gjUyBnk.exe
  C:\Windows\System\gjUyBnk.exe
  2⤵
  PID:15060
- C:\Windows\System\FtzLCMO.exe
  C:\Windows\System\FtzLCMO.exe
  2⤵
  PID:15080
- C:\Windows\System\yjdhDBX.exe
  C:\Windows\System\yjdhDBX.exe
  2⤵
  PID:15100
- C:\Windows\System\NipnkrE.exe
  C:\Windows\System\NipnkrE.exe
  2⤵
  PID:15120
- C:\Windows\System\zYOZqBY.exe
  C:\Windows\System\zYOZqBY.exe
  2⤵
  PID:15148
- C:\Windows\System\VVSvgFt.exe
  C:\Windows\System\VVSvgFt.exe
  2⤵
  PID:15184
- C:\Windows\System\gHoxFpL.exe
  C:\Windows\System\gHoxFpL.exe
  2⤵
  PID:15216
- C:\Windows\System\lHRSRoG.exe
  C:\Windows\System\lHRSRoG.exe
  2⤵
  PID:15256
- C:\Windows\System\ucGCUME.exe
  C:\Windows\System\ucGCUME.exe
  2⤵
  PID:15284
- C:\Windows\System\fdyXGTh.exe
  C:\Windows\System\fdyXGTh.exe
  2⤵
  PID:15304
- C:\Windows\System\ouzsxNe.exe
  C:\Windows\System\ouzsxNe.exe
  2⤵
  PID:15340
- C:\Windows\System\gQthXWV.exe
  C:\Windows\System\gQthXWV.exe
  2⤵
  PID:14156
- C:\Windows\System\qXZyJgQ.exe
  C:\Windows\System\qXZyJgQ.exe
  2⤵
  PID:14268
- C:\Windows\System\noWetMZ.exe
  C:\Windows\System\noWetMZ.exe
  2⤵
  PID:14380
- C:\Windows\System\CBkVkEW.exe
  C:\Windows\System\CBkVkEW.exe
  2⤵
  PID:14496
- C:\Windows\System\SydqXyE.exe
  C:\Windows\System\SydqXyE.exe
  2⤵
  PID:14568
- C:\Windows\System\fqhprVY.exe
  C:\Windows\System\fqhprVY.exe
  2⤵
  PID:14612
- C:\Windows\System\IqPXDLO.exe
  C:\Windows\System\IqPXDLO.exe
  2⤵
  PID:14680
- C:\Windows\System\ByXZznV.exe
  C:\Windows\System\ByXZznV.exe
  2⤵
  PID:14724
- C:\Windows\System\aGktRsV.exe
  C:\Windows\System\aGktRsV.exe
  2⤵
  PID:14796
- C:\Windows\System\MvpNNjU.exe
  C:\Windows\System\MvpNNjU.exe
  2⤵
  PID:14800
- C:\Windows\System\wRTDnRC.exe
  C:\Windows\System\wRTDnRC.exe
  2⤵
  PID:14916
- C:\Windows\System\ZcgVOaM.exe
  C:\Windows\System\ZcgVOaM.exe
  2⤵
  PID:15032
- C:\Windows\System\ZSNwIho.exe
  C:\Windows\System\ZSNwIho.exe
  2⤵
  PID:15096
- C:\Windows\System\aJrEDBD.exe
  C:\Windows\System\aJrEDBD.exe
  2⤵
  PID:15144
- C:\Windows\System\WHTRFKa.exe
  C:\Windows\System\WHTRFKa.exe
  2⤵
  PID:15200
- C:\Windows\System\vTVKxUe.exe
  C:\Windows\System\vTVKxUe.exe
  2⤵
  PID:15252
- C:\Windows\System\YGaAwQz.exe
  C:\Windows\System\YGaAwQz.exe
  2⤵
  PID:15328
- C:\Windows\System\wimAAOk.exe
  C:\Windows\System\wimAAOk.exe
  2⤵
  PID:14372
- C:\Windows\System\dypABmT.exe
  C:\Windows\System\dypABmT.exe
  2⤵
  PID:14596
- C:\Windows\System\zVWqjMA.exe
  C:\Windows\System\zVWqjMA.exe
  2⤵
  PID:14708
- C:\Windows\System\CmVtWxz.exe
  C:\Windows\System\CmVtWxz.exe
  2⤵
  PID:14828
- C:\Windows\System\bmzuAwi.exe
  C:\Windows\System\bmzuAwi.exe
  2⤵
  PID:14944
- C:\Windows\System\CebrPRO.exe
  C:\Windows\System\CebrPRO.exe
  2⤵
  PID:15140
- C:\Windows\System\jwhOdzY.exe
  C:\Windows\System\jwhOdzY.exe
  2⤵
  PID:15276
- C:\Windows\System\EmdeMOL.exe
  C:\Windows\System\EmdeMOL.exe
  2⤵
  PID:14516
- C:\Windows\System\ruBuuQd.exe
  C:\Windows\System\ruBuuQd.exe
  2⤵
  PID:14892
- C:\Windows\System\BhGZafg.exe
  C:\Windows\System\BhGZafg.exe
  2⤵
  PID:14544
- C:\Windows\System\JKjVYeC.exe
  C:\Windows\System\JKjVYeC.exe
  2⤵
  PID:15088
- C:\Windows\System\jehpVxG.exe
  C:\Windows\System\jehpVxG.exe
  2⤵
  PID:15368
- C:\Windows\System\zdcKMNM.exe
  C:\Windows\System\zdcKMNM.exe
  2⤵
  PID:15396
- C:\Windows\System\JahxECR.exe
  C:\Windows\System\JahxECR.exe
  2⤵
  PID:15424
- C:\Windows\System\mHAlozn.exe
  C:\Windows\System\mHAlozn.exe
  2⤵
  PID:15452
- C:\Windows\System\wlYUkgA.exe
  C:\Windows\System\wlYUkgA.exe
  2⤵
  PID:15480
- C:\Windows\System\aLPPFtN.exe
  C:\Windows\System\aLPPFtN.exe
  2⤵
  PID:15496
- C:\Windows\System\wbHSZuA.exe
  C:\Windows\System\wbHSZuA.exe
  2⤵
  PID:15524
- C:\Windows\System\uHBtheP.exe
  C:\Windows\System\uHBtheP.exe
  2⤵
  PID:15552
- C:\Windows\System\znxadRl.exe
  C:\Windows\System\znxadRl.exe
  2⤵
  PID:15592
- C:\Windows\System\fpQZaIF.exe
  C:\Windows\System\fpQZaIF.exe
  2⤵
  PID:15608
- C:\Windows\System\jwePMtv.exe
  C:\Windows\System\jwePMtv.exe
  2⤵
  PID:15648
- C:\Windows\System\emeLrsS.exe
  C:\Windows\System\emeLrsS.exe
  2⤵
  PID:15676
- C:\Windows\System\Wdbwhqg.exe
  C:\Windows\System\Wdbwhqg.exe
  2⤵
  PID:15692
- C:\Windows\System\ehiAhbP.exe
  C:\Windows\System\ehiAhbP.exe
  2⤵
  PID:15708
- C:\Windows\System\rJSriUF.exe
  C:\Windows\System\rJSriUF.exe
  2⤵
  PID:15776
- C:\Windows\System\wotvmGo.exe
  C:\Windows\System\wotvmGo.exe
  2⤵
  PID:15792
- C:\Windows\System\vOiutEY.exe
  C:\Windows\System\vOiutEY.exe
  2⤵
  PID:15820
- C:\Windows\System\hlGAfak.exe
  C:\Windows\System\hlGAfak.exe
  2⤵
  PID:15848
- C:\Windows\System\RiZMNQd.exe
  C:\Windows\System\RiZMNQd.exe
  2⤵
  PID:15876
- C:\Windows\System\rYxohLi.exe
  C:\Windows\System\rYxohLi.exe
  2⤵
  PID:15904
- C:\Windows\System\XVrBPig.exe
  C:\Windows\System\XVrBPig.exe
  2⤵
  PID:15932
- C:\Windows\System\UjEAOOW.exe
  C:\Windows\System\UjEAOOW.exe
  2⤵
  PID:15960
- C:\Windows\System\rlfyoNm.exe
  C:\Windows\System\rlfyoNm.exe
  2⤵
  PID:15988
- C:\Windows\System\nbanCIz.exe
  C:\Windows\System\nbanCIz.exe
  2⤵
  PID:16016
- C:\Windows\System\fKCrbZF.exe
  C:\Windows\System\fKCrbZF.exe
  2⤵
  PID:16032
- C:\Windows\System\iKPbotw.exe
  C:\Windows\System\iKPbotw.exe
  2⤵
  PID:16072
- C:\Windows\System\ACBCerG.exe
  C:\Windows\System\ACBCerG.exe
  2⤵
  PID:16096
- C:\Windows\System\KmzDWnx.exe
  C:\Windows\System\KmzDWnx.exe
  2⤵
  PID:16128
- C:\Windows\System\absYZka.exe
  C:\Windows\System\absYZka.exe
  2⤵
  PID:16156
- C:\Windows\System\nTAiGUK.exe
  C:\Windows\System\nTAiGUK.exe
  2⤵
  PID:16184
- C:\Windows\System\FcvnNOS.exe
  C:\Windows\System\FcvnNOS.exe
  2⤵
  PID:16212
- C:\Windows\System\xLsLLHS.exe
  C:\Windows\System\xLsLLHS.exe
  2⤵
  PID:16240
- C:\Windows\System\uMXvtTr.exe
  C:\Windows\System\uMXvtTr.exe
  2⤵
  PID:16268
- C:\Windows\System\pQzVyAG.exe
  C:\Windows\System\pQzVyAG.exe
  2⤵
  PID:16288
- C:\Windows\System\QySAbnP.exe
  C:\Windows\System\QySAbnP.exe
  2⤵
  PID:16316
- C:\Windows\System\QPTdBPO.exe
  C:\Windows\System\QPTdBPO.exe
  2⤵
  PID:16348
- C:\Windows\System\dGMZaBU.exe
  C:\Windows\System\dGMZaBU.exe
  2⤵
  PID:16376
- C:\Windows\System\miannkQ.exe
  C:\Windows\System\miannkQ.exe
  2⤵
  PID:15416
- C:\Windows\System\xhMZONP.exe
  C:\Windows\System\xhMZONP.exe
  2⤵
  PID:15448
- C:\Windows\System\FtqRCTw.exe
  C:\Windows\System\FtqRCTw.exe
  2⤵
  PID:15544
- C:\Windows\System\doHLtyC.exe
  C:\Windows\System\doHLtyC.exe
  2⤵
  PID:15628
- C:\Windows\System\tUicwsK.exe
  C:\Windows\System\tUicwsK.exe
  2⤵
  PID:15668
- C:\Windows\System\BimZMDQ.exe
  C:\Windows\System\BimZMDQ.exe
  2⤵
  PID:15748
- C:\Windows\System\FkGfvfV.exe
  C:\Windows\System\FkGfvfV.exe
  2⤵
  PID:15804
- C:\Windows\System\XpsPfRR.exe
  C:\Windows\System\XpsPfRR.exe
  2⤵
  PID:15864
- C:\Windows\System\YxBdmDQ.exe
  C:\Windows\System\YxBdmDQ.exe
  2⤵
  PID:15900
- C:\Windows\System\UzZiszn.exe
  C:\Windows\System\UzZiszn.exe
  2⤵
  PID:16008
- C:\Windows\System\YowErLo.exe
  C:\Windows\System\YowErLo.exe
  2⤵
  PID:16068
- C:\Windows\System\TIGKxnh.exe
  C:\Windows\System\TIGKxnh.exe
  2⤵
  PID:16124
- C:\Windows\System\GAQXLWR.exe
  C:\Windows\System\GAQXLWR.exe
  2⤵
  PID:16200
- C:\Windows\System\jVAvFtx.exe
  C:\Windows\System\jVAvFtx.exe
  2⤵
  PID:16260
- C:\Windows\System\umJJNjn.exe
  C:\Windows\System\umJJNjn.exe
  2⤵
  PID:16308
- C:\Windows\System\RzjGgZB.exe
  C:\Windows\System\RzjGgZB.exe
  2⤵
  PID:16360
- C:\Windows\System\ReymgSw.exe
  C:\Windows\System\ReymgSw.exe
  2⤵
  PID:15472
- C:\Windows\System\ypHdJPM.exe
  C:\Windows\System\ypHdJPM.exe
  2⤵
  PID:15588
- C:\Windows\System\HQcuncd.exe
  C:\Windows\System\HQcuncd.exe
  2⤵
  PID:15700
- C:\Windows\System\zcLQvdh.exe
  C:\Windows\System\zcLQvdh.exe
  2⤵
  PID:15896
- C:\Windows\System\wzYFcBF.exe
  C:\Windows\System\wzYFcBF.exe
  2⤵
  PID:16028
- C:\Windows\System\VyKpswx.exe
  C:\Windows\System\VyKpswx.exe
  2⤵
  PID:16168
- C:\Windows\System\OcsavXk.exe
  C:\Windows\System\OcsavXk.exe
  2⤵
  PID:16264
- C:\Windows\System\CMbXUAi.exe
  C:\Windows\System\CMbXUAi.exe
  2⤵
  PID:15444
- C:\Windows\System\qOIQeMl.exe
  C:\Windows\System\qOIQeMl.exe
  2⤵
  PID:15732
- C:\Windows\System\uHyFVPJ.exe
  C:\Windows\System\uHyFVPJ.exe
  2⤵
  PID:15972
- C:\Windows\System\RFGnSTk.exe
  C:\Windows\System\RFGnSTk.exe
  2⤵
  PID:16340
- C:\Windows\System\QWKFhgD.exe
  C:\Windows\System\QWKFhgD.exe
  2⤵
  PID:15832
- C:\Windows\System\HVpytGT.exe
  C:\Windows\System\HVpytGT.exe
  2⤵
  PID:16444
- C:\Windows\System\YvtKucA.exe
  C:\Windows\System\YvtKucA.exe
  2⤵
  PID:16460
- C:\Windows\System\eWCQiBL.exe
  C:\Windows\System\eWCQiBL.exe
  2⤵
  PID:16484
- C:\Windows\System\MNMvTby.exe
  C:\Windows\System\MNMvTby.exe
  2⤵
  PID:16504
- C:\Windows\System\qZbDxFa.exe
  C:\Windows\System\qZbDxFa.exe
  2⤵
  PID:16536
- C:\Windows\System\FmGTqYa.exe
  C:\Windows\System\FmGTqYa.exe
  2⤵
  PID:16580
- C:\Windows\System\ePziteG.exe
  C:\Windows\System\ePziteG.exe
  2⤵
  PID:16612
- C:\Windows\System\cxgxrbR.exe
  C:\Windows\System\cxgxrbR.exe
  2⤵
  PID:16640
- C:\Windows\System\pRUfvhq.exe
  C:\Windows\System\pRUfvhq.exe
  2⤵
  PID:16656
- C:\Windows\System\uRPfJME.exe
  C:\Windows\System\uRPfJME.exe
  2⤵
  PID:16692
- C:\Windows\System\EpOeenc.exe
  C:\Windows\System\EpOeenc.exe
  2⤵
  PID:16712
- C:\Windows\System\EfqvpIF.exe
  C:\Windows\System\EfqvpIF.exe
  2⤵
  PID:16732
- C:\Windows\System\sESWVah.exe
  C:\Windows\System\sESWVah.exe
  2⤵
  PID:16760
- C:\Windows\System\fabaoqm.exe
  C:\Windows\System\fabaoqm.exe
  2⤵
  PID:16796
- C:\Windows\System\TvzIPtr.exe
  C:\Windows\System\TvzIPtr.exe
  2⤵
  PID:16824
- C:\Windows\System\xXWnTit.exe
  C:\Windows\System\xXWnTit.exe
  2⤵
  PID:16852
- C:\Windows\System\ikKvmVq.exe
  C:\Windows\System\ikKvmVq.exe
  2⤵
  PID:16880
- C:\Windows\System\wsePwdO.exe
  C:\Windows\System\wsePwdO.exe
  2⤵
  PID:16908
- C:\Windows\System\GSkTLGL.exe
  C:\Windows\System\GSkTLGL.exe
  2⤵
  PID:16932
- C:\Windows\System\IUxOnlY.exe
  C:\Windows\System\IUxOnlY.exe
  2⤵
  PID:16968
- C:\Windows\System\JuaioNW.exe
  C:\Windows\System\JuaioNW.exe
  2⤵
  PID:16996
- C:\Windows\System\GlNMIrV.exe
  C:\Windows\System\GlNMIrV.exe
  2⤵
  PID:17028
- C:\Windows\System\IyLHYtF.exe
  C:\Windows\System\IyLHYtF.exe
  2⤵
  PID:17068
- C:\Windows\System\eeNLwvJ.exe
  C:\Windows\System\eeNLwvJ.exe
  2⤵
  PID:17084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\FzKuGzm.exe

Filesize
1.7MB

MD5
fdf8eb96b1e79f12277aa0aef21cbfde

SHA1
ec428bdd0f34270f43660850971a5e3e89f03cfe

SHA256
64c31e5cc2718124b8719d6a7bad6ff73c77c54dc01a68f3429277f3f939709a

SHA512
f8d5d1b1104ba26b007800479047a76d3fdd5af3ffb19172b1ca34d18493be06304e670b59022474e512d36c67aa85381367074c451cbff6dc50ad8d8cd55fb9

Download Submit
C:\Windows\System\GOUEuPG.exe

Filesize
1.7MB

MD5
79a8e3638454f6918a22ae93970e5dbe

SHA1
5d7d869899ed808e8c6a59f8979b4a8679b52529

SHA256
3a1666a038f71ca37a43c4bad3c633a8261273bfcaaccaba2928e4eb7a0939be

SHA512
b6a743409d03fc39cdf99381b4dd3b0c612c709492d0c49ac7cba1a4067bbe15125942866699d5c98b7daf3f0532e397d4ac1db8ad67b57189e5b40d8edbfee9

Download Submit
C:\Windows\System\GUMuwAb.exe

Filesize
1.7MB

MD5
5e2879a70ddcbfad5a0b220d9e0bf760

SHA1
ca6957da005802c917ade337a86493eb9c6eb5a0

SHA256
e3d1298b6645d93b76364172f2f859e0c9d03f96db7bebce0a508d001d8a0bb6

SHA512
6ca1e9998f8423a350c8e36f27ab31121cf47cd54ce9118c32efa53db1f33f1a3573fc2dd0021077a2c1f9a866d344f07e33c93d2cb8d1fb09a4b4f8f24940ec

Download Submit
C:\Windows\System\GcbcVYM.exe

Filesize
1.7MB

MD5
18af37b205d439ad3c635b2a7e2efe66

SHA1
fdd32dc5a5062b8d0fb587ed792632da7724fc9a

SHA256
351c1a26a4b84a295b82e05f400253800bac125081f17d39a991f8fc2e7df438

SHA512
36c6cdaa5cc073434b8266fc4dd583407be32473ce07ae529510392e1bf4912eecfea7e62c858c380a716aeae35fd1975087315bef24bbb33fc3807f6ab7b175

Download Submit
C:\Windows\System\ILnAvjU.exe

Filesize
1.7MB

MD5
6b0b66dd6555615224c8c374c5b72c7d

SHA1
d97c68ff582621da763553ac8ded1e2633a8c1c0

SHA256
ebfeb5c4aaadececc2f239d364d12f81ee90b93400b62e7457b54d4780c6a03a

SHA512
78af281736901e4e594088a49dae19775a474da2c1e33da9db7e9f8630e3ef9b6a03f19b47430e5dfe6d591ba1601a511f00516939b306edcf430ce523862aa7

Download Submit
C:\Windows\System\IeTzPuJ.exe

Filesize
1.7MB

MD5
563a8f250ff94fd3cb1e5875247ac3d1

SHA1
cb3177adea4799ee9add711edd3d2ff343370a36

SHA256
d3f581e5aa2b4810771f555e0b0c5d202f47d2210cc2e74ad0afd20b93239fda

SHA512
0861083f52980e8084422504cd33f5c28c4c1d7fceed02c7f41e1368ff242427c1d134e107e5682cc4e0625017b8574cf54f81becfe3156290a1aff7ece7a8ee

Download Submit
C:\Windows\System\JbWgIaV.exe

Filesize
1.7MB

MD5
279ee0f4c88c2ba6e25500fc3c0169d5

SHA1
4db925d1bd22003c02581ed3482bcaa184ec270d

SHA256
7a32092591afd4b9b8027c078f5770000b80dae7e2d95239a10e198dc550924b

SHA512
fe8d2a69ac560702d6543dd5291eca590ea1944501365052e650f3e4bd6c61c86b88c85a467b0846330aef4fa5ec77872674853d25d7666e5c13d113698e4794

Download Submit
C:\Windows\System\KQRDsVr.exe

Filesize
1.7MB

MD5
1b959c67dbfe099165c54445b384810d

SHA1
e7a94d566af7d6f9b9336405fb9db85add949570

SHA256
cac6b60884c0cf0c3236a52bf4b05f12048f42b4e4d8531d2616b4a7501a9564

SHA512
8decfec0864c70c6c84faf586222e1aecb724548a1bc4d03e22664c7c64eaaffb0d73fbb2edac11eac114a05ae72ca59630c1cac5f4711c176f4d2a0164a4801

Download Submit
C:\Windows\System\KbEXfmi.exe

Filesize
1.7MB

MD5
58ffc105440bab6397ecbffa32be6c0b

SHA1
facef31c3ca5bd76ce34d0ed0ef5ced075b28f80

SHA256
fa6b13f3027e1889b1b61e03929298ce06355214eea46052ac37e8928ef54c42

SHA512
ad3d98bf8861697b784ff61aee9872006a7bb37171ba07d3130715707ea5673ab671ddaceeabbdad9a6086d16e76ab964af75635d0e57d5401516fcfd4792251

Download Submit
C:\Windows\System\NrtYtkj.exe

Filesize
1.7MB

MD5
f0bbff66b815534d4eb4e631be54b66b

SHA1
f5e9c65343b5c7a03d953eae6c688f6ded093136

SHA256
d08476be43c488932f2a315ed7ae055635e405a9bcf7d65d54862514fce2762d

SHA512
891d6bf2fef90b5320c844a1468ec887cf16747dae1942f9ddf4405b6c9ff313e4c04300e59b88baa749301045c382c67930633ff9cb4f2c42efcc1f0014fa27

Download Submit
C:\Windows\System\OFDAnsb.exe

Filesize
1.7MB

MD5
8e4f36e0481f4c39ecc6bdc960b4110c

SHA1
26f3d9d3b9ef582243668b0666a97b65f2e97279

SHA256
80233383a85aabc6cd66aa655016be677dea69ad0b42737578e058daee5856ab

SHA512
7c00d15fd6738fbb3affedbc6b05b4796c577b15b8ba63d79cd0ad7e358c7f0a6ece979e48af9d8b129c46ac6eeae9f08f866259deb575528bcacfa974eba5cd

Download Submit
C:\Windows\System\RpZMxMO.exe

Filesize
1.7MB

MD5
bda11e0bbcf31ba89e0968269afc46f5

SHA1
c68caf16da1c832628d743b696026426f606f3bd

SHA256
7cc22d6d6f9e2f12d8a98b8f87fc23c9fb069d35c476a27ac091ac6e3ca437a4

SHA512
97246d21a8ae92189c4f0a325fe5ed1e27700db0aa27fe6cfd4492edce577d2f412dd93a9a76c6bd1f1af21d0f88bfd57e791ad9ef209a169516a0d8b3040ab7

Download Submit
C:\Windows\System\SYEFMrh.exe

Filesize
1.7MB

MD5
c112527d58416b928fabfda42c32ff47

SHA1
e3f529fae74033d38b1be1bb1db04674598c181c

SHA256
c9506b12ff696092eb0671fa982820958278c268fb0873c7123745238ce57e43

SHA512
811cfe7836472385d074aed533d852f53d28fb635daf6098ca88760dc61f74c93121a33135ba269e5cb6b68df08bcc9a74a8305c34a3e06cb26078c006bbadb5

Download Submit
C:\Windows\System\TfVUAJP.exe

Filesize
1.7MB

MD5
c59b14da48231904cf110398ede086ae

SHA1
13b53d6ed5e80a11eedc1ba1cf47bd4db94b5957

SHA256
0f063257929814b019bd1b7293c65e82b19ae6a3911dbb1a8da63cd2ebfde2f5

SHA512
6f86efff35e8cca6860f74d3711e5c35bc488ceb04bae6bac52525582a6f7bcef390a22ead2a30f9879157d173038ab8b700b4184b33ab919929e0afdcc1c354

Download Submit
C:\Windows\System\VkPiOaq.exe

Filesize
1.7MB

MD5
fd0aa3420f832eff96bf1ba4f1e52599

SHA1
d60b4fa365155f22bd804aabb426cf878be7b40b

SHA256
d5a47d5109abbd1ff0af7a4ef89ee219a2bec19c25b5eddf3eb7fc9dfa126171

SHA512
4b8c877c3a5abb90105ac5686492a962eed520de7e6e0bd943e945e9f137b62e79facf57e48e1e25bb61791321c4c3313922969e2971ce46f4c116000bacf816

Download Submit
C:\Windows\System\WbanECT.exe

Filesize
1.7MB

MD5
2dee76f5fab1f9d7e7234a99ccba0ce8

SHA1
249bae68dfbf71f5a8aaf0e1048440a99bf5898e

SHA256
86c92a80ee0485c6a9c63d2906d95f41aaccbe6568786b77443ed93149058cd1

SHA512
43565843be5f83f8316ec7adad667978b616098310d0abf27fcfc5719d802e06dd3f834b1737f49aff730f7ebfca6077f936b9184ef6346e12988aadecbafc79

Download Submit
C:\Windows\System\WzNCTIg.exe

Filesize
1.7MB

MD5
8b7d8880ca8c56f8d232d3a7a4b68c8b

SHA1
e2a06da9a67a68d9ecf02148659e2a305d62082e

SHA256
f2426bac7fe81b4f8fe03504b27411736b5966bf466637f4f498b9500b918e06

SHA512
b05133662cbcf8b3fee1c6ab2eaa6577bfa081505eb11d5f0b79f12fb132b691d07b264c9b7664a009da80e8ce409754fb585af4aaa5220508053db083b91d4d

Download Submit
C:\Windows\System\XSnBkhc.exe

Filesize
1.7MB

MD5
84b8f6dac30aaac1588471ff99516507

SHA1
8f02f5f1d71db6aa8f5a9b588204702c91179c28

SHA256
bd34fbcb5761d96f432dc72830b73ae592f769038b72fdd4fc23e741be0183d1

SHA512
7829d28779e8120693b02232aae36d6b08b36fe693f45b26c310b59bf3426de89d2661424b64764950f28edd66523d1510485c161734efd4ca5b61634827121d

Download Submit
C:\Windows\System\XbdzrgM.exe

Filesize
1.7MB

MD5
3a0e7429aeaf8b6e1cc1010c56d72b1c

SHA1
93707f6af0f11e780c6ae966be350d8f54f5a169

SHA256
6f5fdcc327b21b3624d615c686f52e097d8a81afdd0c281c355534ab8432b183

SHA512
56ce1cd953e99ea08e975e1346f6dde705c0d603d960d433a7b31151076951bbd25336970b89394a934bebe86171049bf26170472ca974f65bc185038505bf99

Download Submit
C:\Windows\System\XgWxmSB.exe

Filesize
1.7MB

MD5
7fc4ffd9d56bc50fb16f47095a2ead9f

SHA1
c6194f04a17c8bf6ca8d0e442cd540cfb2888d18

SHA256
7b25b8438a61ffeffb6106995ef3b1626679be7e4f43dfb3e98cd09eb66d29a7

SHA512
a0b3dcffb12467305c23212aa31d1ede1dadb11d0c93d5e5450a417659074dee659624228466f787b4741cc54fa49bfa599e6c2f282eef0980da66260657c906

Download Submit
C:\Windows\System\ZkGUjyb.exe

Filesize
1.7MB

MD5
c9c02901b00b299f6025a59e3d982935

SHA1
334bf6f2385d02917e37259e170004c3230d77a9

SHA256
bd6afbd9c611e2dee567dfb7e0babeca4dd0988c010049ddab1b03b5e0973c12

SHA512
3eabd3bc856259f9baabcd44887d6d81ec3baa470d0545229815cc220eaf0f108720940bf06a4e2b86b2c43e1244ece9bdb3ccc1f9537ad2aeb4a4048077b9a1

Download Submit
C:\Windows\System\aYJsobm.exe

Filesize
1.7MB

MD5
176ab3be04f2efa81177965f7bb33b89

SHA1
2606d68eb030e03d0170b290c2aac8fcebf2d803

SHA256
bcb423ede3842950bb1a8e80990226be6d32c53b45fef64b10dad0295e315939

SHA512
cd1f54824bfe10527ed9bf870efbfeaa29440ecd0a8c5cd021c2d52095aec3fea2cf427ebfeb35228f74469fc4f77c3e435fa1bb98c16ec3a0b276a8cb45326c

Download Submit
C:\Windows\System\azMMMEx.exe

Filesize
1.7MB

MD5
880870ee82b8876d9f359970a6b5deb5

SHA1
1e2b9817676c3bcc7bc94497337ca79e1078a428

SHA256
92c585a95184b1bbc61cb4c00c98a079e3ea4c9d9ca62cea981029aece66860a

SHA512
675b99d2591ed6dd47df9b8730581fd7c2e526edb619a3157717e3f22c0ce9ca55eda1d60a2e712ca28f2737861f65a0bd31bf455f96ef90dee5431db4a4d134

Download Submit
C:\Windows\System\cUFYTZE.exe

Filesize
1.7MB

MD5
fbe9ba3d424fb3d356b7806f1a1da3d0

SHA1
feeb3e9f765fe753ef213ce39bb5d7f35d98fcb6

SHA256
f2cebb3fa330b3b18e66688f66c9974e27bd80c623f19f5e6576e3ffb71d5510

SHA512
8c9e82cf477ccd79401c3a3726e9542cf724a2e7b9803bfb342b7f1a8620eed9a920d324b78140703cb41c9b18fd805644a4236ef30f5314d964307f9aeb6f17

Download Submit
C:\Windows\System\eFJJVYe.exe

Filesize
1.7MB

MD5
33889453e05e53cd1ba93a828be7e3a6

SHA1
ac908747ed353ed39a60009d827c34fe8c464b82

SHA256
41e43a372534b63bd306a54c118a6fa1b3a123c2e3cebe26dbafba38a06ba2bb

SHA512
dc5878618649f525867e965770d82d1a87051dd909fa708189a09ccca1937300df79d216263e65c346e93fe7de10ed6a8e5cbb6d76c4b43bc58dade6be1deced

Download Submit
C:\Windows\System\gUmdioH.exe

Filesize
1.7MB

MD5
66f6ca4f7cfd3decf5cee6fc8370b312

SHA1
6ecc4eaa21a67a52903887419d697f87a3532d3c

SHA256
76288defeaaf91f78a70d6e4e47d01a5ec60aa5aafe008bff27594bd7492866b

SHA512
578621b379c12e13232ec779fdc32c1dc15164bb34f405f1f6a700eb178faf7d68817356b5f99667e14a53039c4dddabbb774f941f54a2edb832c7d250d2c532

Download Submit
C:\Windows\System\mMZnTCx.exe

Filesize
1.7MB

MD5
69ca2267521c7a17896c08902a37b13e

SHA1
f089b3685acf3b87313be68243248c52cf22ae19

SHA256
3f06478896a7a31956fd4198518d5cc76b9af5215f19e47c5c7a8ddb8c64235f

SHA512
1cf0c2e9c67eede68ed11f94260ebd07abb8da7873122db516ebcbb9a0b2eacfe9a71b6244c226eea7152e1558b7d895df85516109436f02de2d76ac42f30ea7

Download Submit
C:\Windows\System\ogzUlaF.exe

Filesize
1.7MB

MD5
7a7b69bd6676376bbe0c8c607a5c43a9

SHA1
37e3ca2e900accb45cda4e412b501f94cb92d444

SHA256
3aef7edea66d4dd81e4b72d577f3ed95c97b0659bc0bb94f994effd132294243

SHA512
cee4cb3865136a6cef58dba7b79be2f95af60c2e10973eef968322e676adbcd37ed42f3c88ce7c4aaac480bd99fc71c3faebc16a9cb34b7599c2cad26f8bc779

Download Submit
C:\Windows\System\ohMUNvq.exe

Filesize
1.7MB

MD5
4c58bd47bc790cd36e5ab9508c20a64d

SHA1
9adc988aca0bbcab4cb6cc03782b0b35bb35f880

SHA256
28e44190290bbad2432ec5e8c7742230c89433598c549c010dff5500bae52702

SHA512
3d5a4ae79195039f061ebf067130ea8415f0e4518df4205e7111b2d7d88078288eb163d654fcbf57fb2c131538e074b7712ff8ead3dc9f45032166b3cfacf7c7

Download Submit
C:\Windows\System\prnyQQS.exe

Filesize
1.7MB

MD5
8403470a42ce30e63557b11db09a9b9d

SHA1
2c512694140f314bea87f6739385458c72fb5857

SHA256
94b556bb116fcfebe4d0afb0c34f8da73279fdf6d8dd00e4de461f35884df57c

SHA512
3e2273195eadcbf486d47e6caba17f11a9567988d849094d864063a961703376e2fcb1140ec06ba80f4af34f37f5c29c433dbf84352efa992c936f1ebe6505a3

Download Submit
C:\Windows\System\pswprpH.exe

Filesize
1.7MB

MD5
449704dc287b7b732593df5352e66a43

SHA1
93e1765ce5cd5f0b224cb770cb022b5297e11d89

SHA256
1e60ca42aac233800dca760bfed904f69dbfb1afbbdf9f0f2e8d2564069b8d0d

SHA512
37138c3d5668ad4bf3c13cccf615e3a91e92a38836b4c0cfe5a9715cce03b080c023a60194b17f662e96f5aadf90074019499e09a3f794a6d50d05a653ee5bfc

Download Submit
C:\Windows\System\sUYiAbP.exe

Filesize
1.7MB

MD5
52c8fa50696dd7fc5c48df9221fc4625

SHA1
16658e65453791c9c02c43802f405486a7a266a0

SHA256
0d33613c53b296c5ea9dcd89cf01ae561924ae7676d4e4bdc6a90dca25f7ef33

SHA512
9dbe27a99f238e506fd087b96c9dce3ab3afaff8e085dd9cfcfe8316a1f88c473fa16406a5362c7a170c9e4b1ef5a088474352c17e69dcc46240537a476a3117

Download Submit
memory/1336-0-0x0000021259940000-0x0000021259950000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads