xmrig | b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
Size

1.4MB
MD5

140d41909ba157695bb3a7cf5d5387a7
SHA1

32a0833898e2247467ed672680f5314d1c9172fb
SHA256

b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5
SHA512

0b12e9c5af29a8ae5266f142be3480f4d050379f9f3b8ee034a4c01c78f3adb715a2e8b0b94e97201b32ba4634733be95af25aca5bbd68c3807137161da1cfed
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc6:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5E

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b6d-3.dat	xmrig
behavioral2/files/0x0008000000023c50-12.dat	xmrig
behavioral2/files/0x0008000000023c52-28.dat	xmrig
behavioral2/files/0x0008000000023c55-37.dat	xmrig
behavioral2/files/0x0008000000023c54-32.dat	xmrig
behavioral2/files/0x0008000000023c53-31.dat	xmrig
behavioral2/files/0x0008000000023c51-19.dat	xmrig
behavioral2/files/0x0008000000023c44-13.dat	xmrig
behavioral2/files/0x0008000000023c59-58.dat	xmrig
behavioral2/files/0x0007000000023c64-75.dat	xmrig
behavioral2/files/0x0008000000023c5a-82.dat	xmrig
behavioral2/files/0x0007000000023c66-88.dat	xmrig
behavioral2/files/0x0007000000023c65-86.dat	xmrig
behavioral2/files/0x0007000000023c63-84.dat	xmrig
behavioral2/files/0x000c000000023c39-80.dat	xmrig
behavioral2/files/0x0008000000023c58-68.dat	xmrig
behavioral2/files/0x0008000000023c57-49.dat	xmrig
behavioral2/files/0x0008000000023c56-43.dat	xmrig
behavioral2/files/0x0007000000023c67-94.dat	xmrig
behavioral2/files/0x0007000000023c68-97.dat	xmrig
behavioral2/files/0x0007000000023c6a-109.dat	xmrig
behavioral2/files/0x0007000000023c6b-114.dat	xmrig
behavioral2/files/0x0007000000023c69-104.dat	xmrig
behavioral2/files/0x0007000000023c6c-119.dat	xmrig
behavioral2/files/0x0007000000023c73-147.dat	xmrig
behavioral2/files/0x0007000000023c71-157.dat	xmrig
behavioral2/files/0x0007000000023c74-166.dat	xmrig
behavioral2/files/0x0007000000023c76-165.dat	xmrig
behavioral2/files/0x0007000000023c6f-159.dat	xmrig
behavioral2/files/0x0007000000023c75-158.dat	xmrig
behavioral2/files/0x0007000000023c72-153.dat	xmrig
behavioral2/files/0x0007000000023c70-151.dat	xmrig
behavioral2/files/0x0007000000023c6e-143.dat	xmrig
behavioral2/files/0x0007000000023c6d-125.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3544	fdLGfGx.exe
5064	vFaoNcp.exe
4440	YaDdAbF.exe
1084	DMatOgW.exe
1524	kUbEaNW.exe
2216	QeTfrrY.exe
3972	WaZDQTW.exe
2156	dMzGHjU.exe
1396	SWdlDft.exe
1872	yxVTnFn.exe
2420	VXuQLAG.exe
5100	RHcXqfx.exe
3076	aDdakQU.exe
3180	AShGUfT.exe
4056	fUWuSax.exe
3956	gHInqjf.exe
2644	SMDUlwO.exe
2900	mImzGEY.exe
1964	IGzSGti.exe
4216	yDAxXZB.exe
1652	oUqgzgj.exe
4956	yBiMLFh.exe
2124	QdZXyLE.exe
2728	jaYRzNQ.exe
2460	hhFTHAK.exe
4680	uTpwtfm.exe
1960	yxnEynB.exe
4776	faoHubS.exe
2008	vTIFMcD.exe
1848	UTqXQSw.exe
4024	swiSKth.exe
2660	vpBFIft.exe
4540	DcsCwdj.exe
1012	NlwMFli.exe
4308	oJUPhjG.exe
4772	iwrEgVo.exe
3760	papZFUZ.exe
1800	lWiDeMr.exe
1432	QueAxQt.exe
2176	iCPXMZf.exe
3588	GqWagxS.exe
4348	FtsgwAK.exe
2704	MXGUKIV.exe
3420	DcjAItP.exe
3308	yVmcWVO.exe
3464	WWTZAZZ.exe
1316	WvKcItB.exe
4492	tRlSpdZ.exe
2772	aaMSWfQ.exe
1892	etvqCyH.exe
3648	lcTetUZ.exe
4072	nXUlQzM.exe
4332	OPWpvYS.exe
4804	LHtYCJi.exe
1812	JMpEOqR.exe
2428	kfLbVkX.exe
208	KKvvxmm.exe
4780	HDDELFy.exe
2696	IuGbFiD.exe
1528	VMrqJae.exe
1612	YDIwuKl.exe
4372	ISCrTGj.exe
3612	EmZbxnb.exe
1228	YscQbAf.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dNpBwnZ.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\JjFFaiI.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\UkYBBcF.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\mDnDqsL.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\EguFaba.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\nuJyVWA.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\ZChOIDz.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\sJLtvFJ.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\mImCBQK.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\mmKJqnp.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\kYELnms.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\wpWROMS.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\cVyMFAl.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\QDOqrLu.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\pSPWaFz.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\MCDPNoB.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\papZFUZ.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\oExkpUH.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\CJZFZOn.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\uMdQGgq.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\HtrRnVi.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\RWGyxlS.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\bGkDhcZ.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\vpBFIft.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\HQTHUXP.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\fvoTIIA.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\vFaoNcp.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\tRlSpdZ.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\NByvrNT.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\VZYciYP.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\jOYSkQN.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\olQwxSs.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\isUGffk.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\tdaISBE.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\NGzBjpS.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\iioWnuk.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\dYXEcsu.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\irfnjbk.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\LKwsGkC.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\CwEipsq.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\wVwAQiQ.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\vVZQzpw.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\JkxewaQ.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\aUhWrIx.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\HenfuRT.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\rRKRvFy.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\REEWtvj.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\EccqwEB.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\nNaZbbu.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\XdQlFrW.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\YLYzhpt.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\jyycSSO.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\STpDWRe.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\nEpNKTC.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\lGDXfPo.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\mLzNFbZ.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\HdWAJmE.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\TCvElMI.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\gfzpTRl.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\qsYnvyp.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\ZktSDyz.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\pVYKQJh.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\qfhmhys.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
File created	C:\Windows\System\rLxPqlH.exe	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 3544	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	84
PID 1716 wrote to memory of 3544	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	84
PID 1716 wrote to memory of 5064	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	85
PID 1716 wrote to memory of 5064	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	85
PID 1716 wrote to memory of 4440	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	86
PID 1716 wrote to memory of 4440	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	86
PID 1716 wrote to memory of 1084	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	87
PID 1716 wrote to memory of 1084	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	87
PID 1716 wrote to memory of 1524	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	88
PID 1716 wrote to memory of 1524	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	88
PID 1716 wrote to memory of 2216	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	89
PID 1716 wrote to memory of 2216	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	89
PID 1716 wrote to memory of 3972	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	90
PID 1716 wrote to memory of 3972	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	90
PID 1716 wrote to memory of 2156	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	91
PID 1716 wrote to memory of 2156	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	91
PID 1716 wrote to memory of 1396	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	92
PID 1716 wrote to memory of 1396	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	92
PID 1716 wrote to memory of 1872	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	93
PID 1716 wrote to memory of 1872	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	93
PID 1716 wrote to memory of 2420	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	94
PID 1716 wrote to memory of 2420	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	94
PID 1716 wrote to memory of 5100	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	95
PID 1716 wrote to memory of 5100	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	95
PID 1716 wrote to memory of 3076	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	96
PID 1716 wrote to memory of 3076	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	96
PID 1716 wrote to memory of 3180	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	97
PID 1716 wrote to memory of 3180	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	97
PID 1716 wrote to memory of 4056	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	98
PID 1716 wrote to memory of 4056	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	98
PID 1716 wrote to memory of 3956	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	99
PID 1716 wrote to memory of 3956	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	99
PID 1716 wrote to memory of 2644	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	100
PID 1716 wrote to memory of 2644	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	100
PID 1716 wrote to memory of 2900	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	101
PID 1716 wrote to memory of 2900	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	101
PID 1716 wrote to memory of 1964	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	102
PID 1716 wrote to memory of 1964	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	102
PID 1716 wrote to memory of 4216	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	103
PID 1716 wrote to memory of 4216	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	103
PID 1716 wrote to memory of 1652	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	104
PID 1716 wrote to memory of 1652	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	104
PID 1716 wrote to memory of 4956	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	105
PID 1716 wrote to memory of 4956	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	105
PID 1716 wrote to memory of 2124	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	106
PID 1716 wrote to memory of 2124	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	106
PID 1716 wrote to memory of 2728	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	107
PID 1716 wrote to memory of 2728	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	107
PID 1716 wrote to memory of 2460	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	108
PID 1716 wrote to memory of 2460	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	108
PID 1716 wrote to memory of 4680	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	109
PID 1716 wrote to memory of 4680	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	109
PID 1716 wrote to memory of 4776	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	110
PID 1716 wrote to memory of 4776	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	110
PID 1716 wrote to memory of 1960	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	111
PID 1716 wrote to memory of 1960	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	111
PID 1716 wrote to memory of 2008	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	112
PID 1716 wrote to memory of 2008	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	112
PID 1716 wrote to memory of 1848	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	113
PID 1716 wrote to memory of 1848	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	113
PID 1716 wrote to memory of 4024	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	114
PID 1716 wrote to memory of 4024	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	114
PID 1716 wrote to memory of 1012	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	115
PID 1716 wrote to memory of 1012	1716	b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe	115

C:\Users\Admin\AppData\Local\Temp\b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe
"C:\Users\Admin\AppData\Local\Temp\b0e0cfe520a911f16789e38d49f4c31ffc6bf1a6fc07964b9099c8cec51988b5.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\System\fdLGfGx.exe
  C:\Windows\System\fdLGfGx.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\vFaoNcp.exe
  C:\Windows\System\vFaoNcp.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\YaDdAbF.exe
  C:\Windows\System\YaDdAbF.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\DMatOgW.exe
  C:\Windows\System\DMatOgW.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\kUbEaNW.exe
  C:\Windows\System\kUbEaNW.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\QeTfrrY.exe
  C:\Windows\System\QeTfrrY.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\WaZDQTW.exe
  C:\Windows\System\WaZDQTW.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\dMzGHjU.exe
  C:\Windows\System\dMzGHjU.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\SWdlDft.exe
  C:\Windows\System\SWdlDft.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\yxVTnFn.exe
  C:\Windows\System\yxVTnFn.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\VXuQLAG.exe
  C:\Windows\System\VXuQLAG.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\RHcXqfx.exe
  C:\Windows\System\RHcXqfx.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\aDdakQU.exe
  C:\Windows\System\aDdakQU.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\AShGUfT.exe
  C:\Windows\System\AShGUfT.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\fUWuSax.exe
  C:\Windows\System\fUWuSax.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\gHInqjf.exe
  C:\Windows\System\gHInqjf.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\SMDUlwO.exe
  C:\Windows\System\SMDUlwO.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\mImzGEY.exe
  C:\Windows\System\mImzGEY.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\IGzSGti.exe
  C:\Windows\System\IGzSGti.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\yDAxXZB.exe
  C:\Windows\System\yDAxXZB.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\oUqgzgj.exe
  C:\Windows\System\oUqgzgj.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\yBiMLFh.exe
  C:\Windows\System\yBiMLFh.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\QdZXyLE.exe
  C:\Windows\System\QdZXyLE.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\jaYRzNQ.exe
  C:\Windows\System\jaYRzNQ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\hhFTHAK.exe
  C:\Windows\System\hhFTHAK.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\uTpwtfm.exe
  C:\Windows\System\uTpwtfm.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\faoHubS.exe
  C:\Windows\System\faoHubS.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\yxnEynB.exe
  C:\Windows\System\yxnEynB.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\vTIFMcD.exe
  C:\Windows\System\vTIFMcD.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\UTqXQSw.exe
  C:\Windows\System\UTqXQSw.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\swiSKth.exe
  C:\Windows\System\swiSKth.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\NlwMFli.exe
  C:\Windows\System\NlwMFli.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\vpBFIft.exe
  C:\Windows\System\vpBFIft.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\DcsCwdj.exe
  C:\Windows\System\DcsCwdj.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\oJUPhjG.exe
  C:\Windows\System\oJUPhjG.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\iwrEgVo.exe
  C:\Windows\System\iwrEgVo.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\papZFUZ.exe
  C:\Windows\System\papZFUZ.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\lWiDeMr.exe
  C:\Windows\System\lWiDeMr.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\QueAxQt.exe
  C:\Windows\System\QueAxQt.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\iCPXMZf.exe
  C:\Windows\System\iCPXMZf.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\GqWagxS.exe
  C:\Windows\System\GqWagxS.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\FtsgwAK.exe
  C:\Windows\System\FtsgwAK.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\MXGUKIV.exe
  C:\Windows\System\MXGUKIV.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\DcjAItP.exe
  C:\Windows\System\DcjAItP.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\yVmcWVO.exe
  C:\Windows\System\yVmcWVO.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\WWTZAZZ.exe
  C:\Windows\System\WWTZAZZ.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\WvKcItB.exe
  C:\Windows\System\WvKcItB.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\tRlSpdZ.exe
  C:\Windows\System\tRlSpdZ.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\aaMSWfQ.exe
  C:\Windows\System\aaMSWfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\etvqCyH.exe
  C:\Windows\System\etvqCyH.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\lcTetUZ.exe
  C:\Windows\System\lcTetUZ.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\OPWpvYS.exe
  C:\Windows\System\OPWpvYS.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\nXUlQzM.exe
  C:\Windows\System\nXUlQzM.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\LHtYCJi.exe
  C:\Windows\System\LHtYCJi.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\JMpEOqR.exe
  C:\Windows\System\JMpEOqR.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\kfLbVkX.exe
  C:\Windows\System\kfLbVkX.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\KKvvxmm.exe
  C:\Windows\System\KKvvxmm.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\HDDELFy.exe
  C:\Windows\System\HDDELFy.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\IuGbFiD.exe
  C:\Windows\System\IuGbFiD.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\VMrqJae.exe
  C:\Windows\System\VMrqJae.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\YDIwuKl.exe
  C:\Windows\System\YDIwuKl.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ISCrTGj.exe
  C:\Windows\System\ISCrTGj.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\EmZbxnb.exe
  C:\Windows\System\EmZbxnb.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\YscQbAf.exe
  C:\Windows\System\YscQbAf.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\imnsXVn.exe
  C:\Windows\System\imnsXVn.exe
  2⤵
  PID:4556
- C:\Windows\System\NoAKCEL.exe
  C:\Windows\System\NoAKCEL.exe
  2⤵
  PID:512
- C:\Windows\System\ahyJUKt.exe
  C:\Windows\System\ahyJUKt.exe
  2⤵
  PID:1876
- C:\Windows\System\TnVvFqR.exe
  C:\Windows\System\TnVvFqR.exe
  2⤵
  PID:3348
- C:\Windows\System\bPffSRJ.exe
  C:\Windows\System\bPffSRJ.exe
  2⤵
  PID:1016
- C:\Windows\System\LvvQQGH.exe
  C:\Windows\System\LvvQQGH.exe
  2⤵
  PID:664
- C:\Windows\System\nkPMboO.exe
  C:\Windows\System\nkPMboO.exe
  2⤵
  PID:1780
- C:\Windows\System\CQThNUy.exe
  C:\Windows\System\CQThNUy.exe
  2⤵
  PID:3332
- C:\Windows\System\ReuNksf.exe
  C:\Windows\System\ReuNksf.exe
  2⤵
  PID:3104
- C:\Windows\System\QCjJFTo.exe
  C:\Windows\System\QCjJFTo.exe
  2⤵
  PID:5008
- C:\Windows\System\BDviuhC.exe
  C:\Windows\System\BDviuhC.exe
  2⤵
  PID:2684
- C:\Windows\System\WkLfbnl.exe
  C:\Windows\System\WkLfbnl.exe
  2⤵
  PID:3148
- C:\Windows\System\ejWgaFi.exe
  C:\Windows\System\ejWgaFi.exe
  2⤵
  PID:3132
- C:\Windows\System\jKnKgIy.exe
  C:\Windows\System\jKnKgIy.exe
  2⤵
  PID:752
- C:\Windows\System\OGwkTXv.exe
  C:\Windows\System\OGwkTXv.exe
  2⤵
  PID:3212
- C:\Windows\System\FQYSQYX.exe
  C:\Windows\System\FQYSQYX.exe
  2⤵
  PID:4476
- C:\Windows\System\XMQbFxu.exe
  C:\Windows\System\XMQbFxu.exe
  2⤵
  PID:768
- C:\Windows\System\rVPCXIe.exe
  C:\Windows\System\rVPCXIe.exe
  2⤵
  PID:3976
- C:\Windows\System\PUbLRfD.exe
  C:\Windows\System\PUbLRfD.exe
  2⤵
  PID:4100
- C:\Windows\System\irfnjbk.exe
  C:\Windows\System\irfnjbk.exe
  2⤵
  PID:4264
- C:\Windows\System\ekoSKHQ.exe
  C:\Windows\System\ekoSKHQ.exe
  2⤵
  PID:2392
- C:\Windows\System\IWszCnP.exe
  C:\Windows\System\IWszCnP.exe
  2⤵
  PID:3932
- C:\Windows\System\lXzLZPg.exe
  C:\Windows\System\lXzLZPg.exe
  2⤵
  PID:4200
- C:\Windows\System\sQfnJWR.exe
  C:\Windows\System\sQfnJWR.exe
  2⤵
  PID:1956
- C:\Windows\System\nVpmccr.exe
  C:\Windows\System\nVpmccr.exe
  2⤵
  PID:3416
- C:\Windows\System\JPGvgpX.exe
  C:\Windows\System\JPGvgpX.exe
  2⤵
  PID:5088
- C:\Windows\System\gZEDppX.exe
  C:\Windows\System\gZEDppX.exe
  2⤵
  PID:2060
- C:\Windows\System\ruJSTix.exe
  C:\Windows\System\ruJSTix.exe
  2⤵
  PID:924
- C:\Windows\System\OpUvJFA.exe
  C:\Windows\System\OpUvJFA.exe
  2⤵
  PID:4016
- C:\Windows\System\aLaxcWm.exe
  C:\Windows\System\aLaxcWm.exe
  2⤵
  PID:3592
- C:\Windows\System\miqdKtG.exe
  C:\Windows\System\miqdKtG.exe
  2⤵
  PID:2844
- C:\Windows\System\MCtCnBw.exe
  C:\Windows\System\MCtCnBw.exe
  2⤵
  PID:3352
- C:\Windows\System\yiGQpPe.exe
  C:\Windows\System\yiGQpPe.exe
  2⤵
  PID:4364
- C:\Windows\System\dchCjDS.exe
  C:\Windows\System\dchCjDS.exe
  2⤵
  PID:2244
- C:\Windows\System\rRKRvFy.exe
  C:\Windows\System\rRKRvFy.exe
  2⤵
  PID:2720
- C:\Windows\System\tfdHANm.exe
  C:\Windows\System\tfdHANm.exe
  2⤵
  PID:2036
- C:\Windows\System\HBacVMS.exe
  C:\Windows\System\HBacVMS.exe
  2⤵
  PID:4768
- C:\Windows\System\AYhifVy.exe
  C:\Windows\System\AYhifVy.exe
  2⤵
  PID:1532
- C:\Windows\System\LKwsGkC.exe
  C:\Windows\System\LKwsGkC.exe
  2⤵
  PID:184
- C:\Windows\System\ToXgEgN.exe
  C:\Windows\System\ToXgEgN.exe
  2⤵
  PID:1176
- C:\Windows\System\TVIOEmS.exe
  C:\Windows\System\TVIOEmS.exe
  2⤵
  PID:4392
- C:\Windows\System\qRHPqCt.exe
  C:\Windows\System\qRHPqCt.exe
  2⤵
  PID:1588
- C:\Windows\System\nTwXQhL.exe
  C:\Windows\System\nTwXQhL.exe
  2⤵
  PID:4632
- C:\Windows\System\CcSvslU.exe
  C:\Windows\System\CcSvslU.exe
  2⤵
  PID:740
- C:\Windows\System\bbPvVIo.exe
  C:\Windows\System\bbPvVIo.exe
  2⤵
  PID:3452
- C:\Windows\System\CJRcDSR.exe
  C:\Windows\System\CJRcDSR.exe
  2⤵
  PID:1744
- C:\Windows\System\VuyPCcG.exe
  C:\Windows\System\VuyPCcG.exe
  2⤵
  PID:2556
- C:\Windows\System\hxGmPGX.exe
  C:\Windows\System\hxGmPGX.exe
  2⤵
  PID:3184
- C:\Windows\System\AOIfHBg.exe
  C:\Windows\System\AOIfHBg.exe
  2⤵
  PID:876
- C:\Windows\System\YjqTxAp.exe
  C:\Windows\System\YjqTxAp.exe
  2⤵
  PID:5132
- C:\Windows\System\FzOVxIa.exe
  C:\Windows\System\FzOVxIa.exe
  2⤵
  PID:5168
- C:\Windows\System\WDQAkwJ.exe
  C:\Windows\System\WDQAkwJ.exe
  2⤵
  PID:5196
- C:\Windows\System\PXDkvfE.exe
  C:\Windows\System\PXDkvfE.exe
  2⤵
  PID:5224
- C:\Windows\System\ZMaUDHY.exe
  C:\Windows\System\ZMaUDHY.exe
  2⤵
  PID:5264
- C:\Windows\System\sEfnkGJ.exe
  C:\Windows\System\sEfnkGJ.exe
  2⤵
  PID:5288
- C:\Windows\System\BitbMIZ.exe
  C:\Windows\System\BitbMIZ.exe
  2⤵
  PID:5308
- C:\Windows\System\GScthCh.exe
  C:\Windows\System\GScthCh.exe
  2⤵
  PID:5336
- C:\Windows\System\AqxIeUR.exe
  C:\Windows\System\AqxIeUR.exe
  2⤵
  PID:5352
- C:\Windows\System\bNoTJlF.exe
  C:\Windows\System\bNoTJlF.exe
  2⤵
  PID:5392
- C:\Windows\System\oExkpUH.exe
  C:\Windows\System\oExkpUH.exe
  2⤵
  PID:5408
- C:\Windows\System\FrvvJdG.exe
  C:\Windows\System\FrvvJdG.exe
  2⤵
  PID:5444
- C:\Windows\System\NBbnmeK.exe
  C:\Windows\System\NBbnmeK.exe
  2⤵
  PID:5472
- C:\Windows\System\GIkXqju.exe
  C:\Windows\System\GIkXqju.exe
  2⤵
  PID:5504
- C:\Windows\System\yhXHMUL.exe
  C:\Windows\System\yhXHMUL.exe
  2⤵
  PID:5520
- C:\Windows\System\EFbBZbD.exe
  C:\Windows\System\EFbBZbD.exe
  2⤵
  PID:5556
- C:\Windows\System\ICkpnxy.exe
  C:\Windows\System\ICkpnxy.exe
  2⤵
  PID:5588
- C:\Windows\System\qqkMMPK.exe
  C:\Windows\System\qqkMMPK.exe
  2⤵
  PID:5608
- C:\Windows\System\FSloywO.exe
  C:\Windows\System\FSloywO.exe
  2⤵
  PID:5636
- C:\Windows\System\AaOTKuN.exe
  C:\Windows\System\AaOTKuN.exe
  2⤵
  PID:5668
- C:\Windows\System\WWsUNUd.exe
  C:\Windows\System\WWsUNUd.exe
  2⤵
  PID:5692
- C:\Windows\System\USyUnQg.exe
  C:\Windows\System\USyUnQg.exe
  2⤵
  PID:5728
- C:\Windows\System\JjmcHus.exe
  C:\Windows\System\JjmcHus.exe
  2⤵
  PID:5760
- C:\Windows\System\TLUMjVz.exe
  C:\Windows\System\TLUMjVz.exe
  2⤵
  PID:5796
- C:\Windows\System\varISJO.exe
  C:\Windows\System\varISJO.exe
  2⤵
  PID:5812
- C:\Windows\System\mfOVUTy.exe
  C:\Windows\System\mfOVUTy.exe
  2⤵
  PID:5852
- C:\Windows\System\nOeuqfU.exe
  C:\Windows\System\nOeuqfU.exe
  2⤵
  PID:5896
- C:\Windows\System\jfNyDeI.exe
  C:\Windows\System\jfNyDeI.exe
  2⤵
  PID:5912
- C:\Windows\System\JvlnFlv.exe
  C:\Windows\System\JvlnFlv.exe
  2⤵
  PID:5928
- C:\Windows\System\NajIGgU.exe
  C:\Windows\System\NajIGgU.exe
  2⤵
  PID:5956
- C:\Windows\System\kMXWORL.exe
  C:\Windows\System\kMXWORL.exe
  2⤵
  PID:5984
- C:\Windows\System\wpWROMS.exe
  C:\Windows\System\wpWROMS.exe
  2⤵
  PID:6012
- C:\Windows\System\qUNxIBU.exe
  C:\Windows\System\qUNxIBU.exe
  2⤵
  PID:6040
- C:\Windows\System\opNBuml.exe
  C:\Windows\System\opNBuml.exe
  2⤵
  PID:6068
- C:\Windows\System\FbPLqcS.exe
  C:\Windows\System\FbPLqcS.exe
  2⤵
  PID:6100
- C:\Windows\System\xDJxNru.exe
  C:\Windows\System\xDJxNru.exe
  2⤵
  PID:6128
- C:\Windows\System\CQUcznQ.exe
  C:\Windows\System\CQUcznQ.exe
  2⤵
  PID:2160
- C:\Windows\System\eFRBOWu.exe
  C:\Windows\System\eFRBOWu.exe
  2⤵
  PID:2464
- C:\Windows\System\OJBqnND.exe
  C:\Windows\System\OJBqnND.exe
  2⤵
  PID:5208
- C:\Windows\System\qLHrfYj.exe
  C:\Windows\System\qLHrfYj.exe
  2⤵
  PID:5244
- C:\Windows\System\BaibuFd.exe
  C:\Windows\System\BaibuFd.exe
  2⤵
  PID:5296
- C:\Windows\System\ucvCoQb.exe
  C:\Windows\System\ucvCoQb.exe
  2⤵
  PID:5376
- C:\Windows\System\cxTfyEM.exe
  C:\Windows\System\cxTfyEM.exe
  2⤵
  PID:5460
- C:\Windows\System\bfeliCJ.exe
  C:\Windows\System\bfeliCJ.exe
  2⤵
  PID:5512
- C:\Windows\System\MtjFVdL.exe
  C:\Windows\System\MtjFVdL.exe
  2⤵
  PID:5564
- C:\Windows\System\kxTCkvN.exe
  C:\Windows\System\kxTCkvN.exe
  2⤵
  PID:5620
- C:\Windows\System\VjZJwer.exe
  C:\Windows\System\VjZJwer.exe
  2⤵
  PID:5680
- C:\Windows\System\IRlhMjy.exe
  C:\Windows\System\IRlhMjy.exe
  2⤵
  PID:5748
- C:\Windows\System\FgZnGad.exe
  C:\Windows\System\FgZnGad.exe
  2⤵
  PID:5828
- C:\Windows\System\jUTHBsn.exe
  C:\Windows\System\jUTHBsn.exe
  2⤵
  PID:5904
- C:\Windows\System\TvLNOkX.exe
  C:\Windows\System\TvLNOkX.exe
  2⤵
  PID:5940
- C:\Windows\System\GPjcsaI.exe
  C:\Windows\System\GPjcsaI.exe
  2⤵
  PID:6052
- C:\Windows\System\rLxPqlH.exe
  C:\Windows\System\rLxPqlH.exe
  2⤵
  PID:6108
- C:\Windows\System\pXIDdwy.exe
  C:\Windows\System\pXIDdwy.exe
  2⤵
  PID:5180
- C:\Windows\System\vVZQzpw.exe
  C:\Windows\System\vVZQzpw.exe
  2⤵
  PID:3848
- C:\Windows\System\HdWAJmE.exe
  C:\Windows\System\HdWAJmE.exe
  2⤵
  PID:5404
- C:\Windows\System\QFhFDlJ.exe
  C:\Windows\System\QFhFDlJ.exe
  2⤵
  PID:5624
- C:\Windows\System\HPIGikK.exe
  C:\Windows\System\HPIGikK.exe
  2⤵
  PID:5540
- C:\Windows\System\cVyMFAl.exe
  C:\Windows\System\cVyMFAl.exe
  2⤵
  PID:5736
- C:\Windows\System\WgZTMIa.exe
  C:\Windows\System\WgZTMIa.exe
  2⤵
  PID:5920
- C:\Windows\System\SRXsrls.exe
  C:\Windows\System\SRXsrls.exe
  2⤵
  PID:6000
- C:\Windows\System\UPPYuqp.exe
  C:\Windows\System\UPPYuqp.exe
  2⤵
  PID:5216
- C:\Windows\System\mImCBQK.exe
  C:\Windows\System\mImCBQK.exe
  2⤵
  PID:5892
- C:\Windows\System\REEWtvj.exe
  C:\Windows\System\REEWtvj.exe
  2⤵
  PID:6088
- C:\Windows\System\QcEMgQL.exe
  C:\Windows\System\QcEMgQL.exe
  2⤵
  PID:5156
- C:\Windows\System\HuIRBdh.exe
  C:\Windows\System\HuIRBdh.exe
  2⤵
  PID:6172
- C:\Windows\System\FMqlrDb.exe
  C:\Windows\System\FMqlrDb.exe
  2⤵
  PID:6200
- C:\Windows\System\tmRKiAn.exe
  C:\Windows\System\tmRKiAn.exe
  2⤵
  PID:6232
- C:\Windows\System\iXkjFBs.exe
  C:\Windows\System\iXkjFBs.exe
  2⤵
  PID:6260
- C:\Windows\System\yiVgTgl.exe
  C:\Windows\System\yiVgTgl.exe
  2⤵
  PID:6292
- C:\Windows\System\oNSEwFn.exe
  C:\Windows\System\oNSEwFn.exe
  2⤵
  PID:6320
- C:\Windows\System\iShlvVy.exe
  C:\Windows\System\iShlvVy.exe
  2⤵
  PID:6344
- C:\Windows\System\HlfIQZF.exe
  C:\Windows\System\HlfIQZF.exe
  2⤵
  PID:6372
- C:\Windows\System\EccqwEB.exe
  C:\Windows\System\EccqwEB.exe
  2⤵
  PID:6404
- C:\Windows\System\KZLYjqr.exe
  C:\Windows\System\KZLYjqr.exe
  2⤵
  PID:6432
- C:\Windows\System\KiorwpE.exe
  C:\Windows\System\KiorwpE.exe
  2⤵
  PID:6460
- C:\Windows\System\MhovewN.exe
  C:\Windows\System\MhovewN.exe
  2⤵
  PID:6496
- C:\Windows\System\gQfyZIF.exe
  C:\Windows\System\gQfyZIF.exe
  2⤵
  PID:6516
- C:\Windows\System\uhgexeE.exe
  C:\Windows\System\uhgexeE.exe
  2⤵
  PID:6552
- C:\Windows\System\BoMXhYq.exe
  C:\Windows\System\BoMXhYq.exe
  2⤵
  PID:6584
- C:\Windows\System\xinwUfi.exe
  C:\Windows\System\xinwUfi.exe
  2⤵
  PID:6612
- C:\Windows\System\bngQoJP.exe
  C:\Windows\System\bngQoJP.exe
  2⤵
  PID:6636
- C:\Windows\System\YuOSEoO.exe
  C:\Windows\System\YuOSEoO.exe
  2⤵
  PID:6676
- C:\Windows\System\efAPlkt.exe
  C:\Windows\System\efAPlkt.exe
  2⤵
  PID:6700
- C:\Windows\System\ZGySlWq.exe
  C:\Windows\System\ZGySlWq.exe
  2⤵
  PID:6724
- C:\Windows\System\ACaZBcF.exe
  C:\Windows\System\ACaZBcF.exe
  2⤵
  PID:6752
- C:\Windows\System\tuQOsJw.exe
  C:\Windows\System\tuQOsJw.exe
  2⤵
  PID:6780
- C:\Windows\System\NGzBjpS.exe
  C:\Windows\System\NGzBjpS.exe
  2⤵
  PID:6804
- C:\Windows\System\FiGjUNs.exe
  C:\Windows\System\FiGjUNs.exe
  2⤵
  PID:6832
- C:\Windows\System\xmQkauI.exe
  C:\Windows\System\xmQkauI.exe
  2⤵
  PID:6856
- C:\Windows\System\zVJGqta.exe
  C:\Windows\System\zVJGqta.exe
  2⤵
  PID:6880
- C:\Windows\System\yWfgwpD.exe
  C:\Windows\System\yWfgwpD.exe
  2⤵
  PID:6908
- C:\Windows\System\XVDrsMn.exe
  C:\Windows\System\XVDrsMn.exe
  2⤵
  PID:6944
- C:\Windows\System\XTzeeAf.exe
  C:\Windows\System\XTzeeAf.exe
  2⤵
  PID:6972
- C:\Windows\System\oSQCbkR.exe
  C:\Windows\System\oSQCbkR.exe
  2⤵
  PID:7004
- C:\Windows\System\pktZFjr.exe
  C:\Windows\System\pktZFjr.exe
  2⤵
  PID:7024
- C:\Windows\System\SLvQUYj.exe
  C:\Windows\System\SLvQUYj.exe
  2⤵
  PID:7052
- C:\Windows\System\DOeWYmM.exe
  C:\Windows\System\DOeWYmM.exe
  2⤵
  PID:7080
- C:\Windows\System\FxQBRYv.exe
  C:\Windows\System\FxQBRYv.exe
  2⤵
  PID:7108
- C:\Windows\System\tCYELNY.exe
  C:\Windows\System\tCYELNY.exe
  2⤵
  PID:7140
- C:\Windows\System\DDcYyWL.exe
  C:\Windows\System\DDcYyWL.exe
  2⤵
  PID:5604
- C:\Windows\System\WFwhkAC.exe
  C:\Windows\System\WFwhkAC.exe
  2⤵
  PID:6160
- C:\Windows\System\xWFNssm.exe
  C:\Windows\System\xWFNssm.exe
  2⤵
  PID:6248
- C:\Windows\System\LGAvoKO.exe
  C:\Windows\System\LGAvoKO.exe
  2⤵
  PID:6308
- C:\Windows\System\HUYbwiH.exe
  C:\Windows\System\HUYbwiH.exe
  2⤵
  PID:6364
- C:\Windows\System\ZxEGHNp.exe
  C:\Windows\System\ZxEGHNp.exe
  2⤵
  PID:6508
- C:\Windows\System\kgmSPSN.exe
  C:\Windows\System\kgmSPSN.exe
  2⤵
  PID:6472
- C:\Windows\System\SHXLbdH.exe
  C:\Windows\System\SHXLbdH.exe
  2⤵
  PID:6572
- C:\Windows\System\qLNTQHn.exe
  C:\Windows\System\qLNTQHn.exe
  2⤵
  PID:6664
- C:\Windows\System\mJVWodK.exe
  C:\Windows\System\mJVWodK.exe
  2⤵
  PID:6740
- C:\Windows\System\sGYowcL.exe
  C:\Windows\System\sGYowcL.exe
  2⤵
  PID:6800
- C:\Windows\System\VhYBpKI.exe
  C:\Windows\System\VhYBpKI.exe
  2⤵
  PID:6892
- C:\Windows\System\zCfgkHx.exe
  C:\Windows\System\zCfgkHx.exe
  2⤵
  PID:6876
- C:\Windows\System\BfLgSMJ.exe
  C:\Windows\System\BfLgSMJ.exe
  2⤵
  PID:7000
- C:\Windows\System\GMakRiG.exe
  C:\Windows\System\GMakRiG.exe
  2⤵
  PID:7060
- C:\Windows\System\jQOIUFm.exe
  C:\Windows\System\jQOIUFm.exe
  2⤵
  PID:7064
- C:\Windows\System\lkBSyIv.exe
  C:\Windows\System\lkBSyIv.exe
  2⤵
  PID:7124
- C:\Windows\System\zOcDyzM.exe
  C:\Windows\System\zOcDyzM.exe
  2⤵
  PID:6184
- C:\Windows\System\MGWlqLI.exe
  C:\Windows\System\MGWlqLI.exe
  2⤵
  PID:6280
- C:\Windows\System\DOFkEBs.exe
  C:\Windows\System\DOFkEBs.exe
  2⤵
  PID:6424
- C:\Windows\System\wEdwUVZ.exe
  C:\Windows\System\wEdwUVZ.exe
  2⤵
  PID:6648
- C:\Windows\System\xpYtkjS.exe
  C:\Windows\System\xpYtkjS.exe
  2⤵
  PID:6776
- C:\Windows\System\inqYsaw.exe
  C:\Windows\System\inqYsaw.exe
  2⤵
  PID:6996
- C:\Windows\System\Kobrmpp.exe
  C:\Windows\System\Kobrmpp.exe
  2⤵
  PID:7088
- C:\Windows\System\SBODIol.exe
  C:\Windows\System\SBODIol.exe
  2⤵
  PID:6484
- C:\Windows\System\iUVnfww.exe
  C:\Windows\System\iUVnfww.exe
  2⤵
  PID:6932
- C:\Windows\System\dqZiWIK.exe
  C:\Windows\System\dqZiWIK.exe
  2⤵
  PID:5836
- C:\Windows\System\hbKTxrg.exe
  C:\Windows\System\hbKTxrg.exe
  2⤵
  PID:7172
- C:\Windows\System\BolFGhm.exe
  C:\Windows\System\BolFGhm.exe
  2⤵
  PID:7192
- C:\Windows\System\jUYNIcg.exe
  C:\Windows\System\jUYNIcg.exe
  2⤵
  PID:7220
- C:\Windows\System\sehoUsH.exe
  C:\Windows\System\sehoUsH.exe
  2⤵
  PID:7256
- C:\Windows\System\hsxdUCI.exe
  C:\Windows\System\hsxdUCI.exe
  2⤵
  PID:7288
- C:\Windows\System\kXGUUui.exe
  C:\Windows\System\kXGUUui.exe
  2⤵
  PID:7308
- C:\Windows\System\IkUTIuz.exe
  C:\Windows\System\IkUTIuz.exe
  2⤵
  PID:7328
- C:\Windows\System\JzSpnvi.exe
  C:\Windows\System\JzSpnvi.exe
  2⤵
  PID:7352
- C:\Windows\System\yDvsHXf.exe
  C:\Windows\System\yDvsHXf.exe
  2⤵
  PID:7376
- C:\Windows\System\cnDIuKG.exe
  C:\Windows\System\cnDIuKG.exe
  2⤵
  PID:7404
- C:\Windows\System\aVHuKZs.exe
  C:\Windows\System\aVHuKZs.exe
  2⤵
  PID:7428
- C:\Windows\System\QDOqrLu.exe
  C:\Windows\System\QDOqrLu.exe
  2⤵
  PID:7452
- C:\Windows\System\WMxvGOG.exe
  C:\Windows\System\WMxvGOG.exe
  2⤵
  PID:7480
- C:\Windows\System\ISSoQeV.exe
  C:\Windows\System\ISSoQeV.exe
  2⤵
  PID:7512
- C:\Windows\System\BtjThfW.exe
  C:\Windows\System\BtjThfW.exe
  2⤵
  PID:7540
- C:\Windows\System\fotVZBi.exe
  C:\Windows\System\fotVZBi.exe
  2⤵
  PID:7556
- C:\Windows\System\noNfCYc.exe
  C:\Windows\System\noNfCYc.exe
  2⤵
  PID:7580
- C:\Windows\System\riQfcuO.exe
  C:\Windows\System\riQfcuO.exe
  2⤵
  PID:7608
- C:\Windows\System\eTHcLoV.exe
  C:\Windows\System\eTHcLoV.exe
  2⤵
  PID:7644
- C:\Windows\System\qYLbUMp.exe
  C:\Windows\System\qYLbUMp.exe
  2⤵
  PID:7664
- C:\Windows\System\KsgrEfx.exe
  C:\Windows\System\KsgrEfx.exe
  2⤵
  PID:7692
- C:\Windows\System\fHFrBvO.exe
  C:\Windows\System\fHFrBvO.exe
  2⤵
  PID:7720
- C:\Windows\System\AXypQmc.exe
  C:\Windows\System\AXypQmc.exe
  2⤵
  PID:7752
- C:\Windows\System\LUklNKs.exe
  C:\Windows\System\LUklNKs.exe
  2⤵
  PID:7780
- C:\Windows\System\XaCEZEI.exe
  C:\Windows\System\XaCEZEI.exe
  2⤵
  PID:7808
- C:\Windows\System\QtTWNyq.exe
  C:\Windows\System\QtTWNyq.exe
  2⤵
  PID:7832
- C:\Windows\System\qsYnvyp.exe
  C:\Windows\System\qsYnvyp.exe
  2⤵
  PID:7860
- C:\Windows\System\eRmNkDC.exe
  C:\Windows\System\eRmNkDC.exe
  2⤵
  PID:7888
- C:\Windows\System\TscCgIS.exe
  C:\Windows\System\TscCgIS.exe
  2⤵
  PID:7916
- C:\Windows\System\khrgkKt.exe
  C:\Windows\System\khrgkKt.exe
  2⤵
  PID:7944
- C:\Windows\System\RJXKYTI.exe
  C:\Windows\System\RJXKYTI.exe
  2⤵
  PID:7972
- C:\Windows\System\CwEipsq.exe
  C:\Windows\System\CwEipsq.exe
  2⤵
  PID:8000
- C:\Windows\System\xTpvOZg.exe
  C:\Windows\System\xTpvOZg.exe
  2⤵
  PID:8024
- C:\Windows\System\wJPDAHC.exe
  C:\Windows\System\wJPDAHC.exe
  2⤵
  PID:8048
- C:\Windows\System\LOlwVfb.exe
  C:\Windows\System\LOlwVfb.exe
  2⤵
  PID:8080
- C:\Windows\System\UIhdTMS.exe
  C:\Windows\System\UIhdTMS.exe
  2⤵
  PID:8104
- C:\Windows\System\ATqPJjj.exe
  C:\Windows\System\ATqPJjj.exe
  2⤵
  PID:8140
- C:\Windows\System\YTEyONZ.exe
  C:\Windows\System\YTEyONZ.exe
  2⤵
  PID:8172
- C:\Windows\System\iGjTQlt.exe
  C:\Windows\System\iGjTQlt.exe
  2⤵
  PID:6828
- C:\Windows\System\DxAkpJF.exe
  C:\Windows\System\DxAkpJF.exe
  2⤵
  PID:7096
- C:\Windows\System\VCjwmcE.exe
  C:\Windows\System\VCjwmcE.exe
  2⤵
  PID:7296
- C:\Windows\System\yySHmJe.exe
  C:\Windows\System\yySHmJe.exe
  2⤵
  PID:7284
- C:\Windows\System\XCoeZiL.exe
  C:\Windows\System\XCoeZiL.exe
  2⤵
  PID:7388
- C:\Windows\System\fZFTpmd.exe
  C:\Windows\System\fZFTpmd.exe
  2⤵
  PID:7476
- C:\Windows\System\enmZDlO.exe
  C:\Windows\System\enmZDlO.exe
  2⤵
  PID:7524
- C:\Windows\System\jjMExQR.exe
  C:\Windows\System\jjMExQR.exe
  2⤵
  PID:7552
- C:\Windows\System\zTLMtRL.exe
  C:\Windows\System\zTLMtRL.exe
  2⤵
  PID:7628
- C:\Windows\System\YleLAHb.exe
  C:\Windows\System\YleLAHb.exe
  2⤵
  PID:7568
- C:\Windows\System\WuMefXx.exe
  C:\Windows\System\WuMefXx.exe
  2⤵
  PID:7732
- C:\Windows\System\qkwmaUK.exe
  C:\Windows\System\qkwmaUK.exe
  2⤵
  PID:7800
- C:\Windows\System\ZktSDyz.exe
  C:\Windows\System\ZktSDyz.exe
  2⤵
  PID:7876
- C:\Windows\System\LatehnY.exe
  C:\Windows\System\LatehnY.exe
  2⤵
  PID:7828
- C:\Windows\System\msjvDgZ.exe
  C:\Windows\System\msjvDgZ.exe
  2⤵
  PID:7928
- C:\Windows\System\nBGIciG.exe
  C:\Windows\System\nBGIciG.exe
  2⤵
  PID:8128
- C:\Windows\System\pVYKQJh.exe
  C:\Windows\System\pVYKQJh.exe
  2⤵
  PID:8040
- C:\Windows\System\jhayNSI.exe
  C:\Windows\System\jhayNSI.exe
  2⤵
  PID:7268
- C:\Windows\System\OdhxRsf.exe
  C:\Windows\System\OdhxRsf.exe
  2⤵
  PID:8116
- C:\Windows\System\uXgPFvu.exe
  C:\Windows\System\uXgPFvu.exe
  2⤵
  PID:7280
- C:\Windows\System\FfxgRwa.exe
  C:\Windows\System\FfxgRwa.exe
  2⤵
  PID:7684
- C:\Windows\System\QtyhlsJ.exe
  C:\Windows\System\QtyhlsJ.exe
  2⤵
  PID:7604
- C:\Windows\System\rQLDgLJ.exe
  C:\Windows\System\rQLDgLJ.exe
  2⤵
  PID:7908
- C:\Windows\System\dfWQDyF.exe
  C:\Windows\System\dfWQDyF.exe
  2⤵
  PID:8156
- C:\Windows\System\AroExUV.exe
  C:\Windows\System\AroExUV.exe
  2⤵
  PID:7200
- C:\Windows\System\qUSenUy.exe
  C:\Windows\System\qUSenUy.exe
  2⤵
  PID:8164
- C:\Windows\System\FwTePHL.exe
  C:\Windows\System\FwTePHL.exe
  2⤵
  PID:7904
- C:\Windows\System\gclGYfO.exe
  C:\Windows\System\gclGYfO.exe
  2⤵
  PID:8224
- C:\Windows\System\QqTdDjv.exe
  C:\Windows\System\QqTdDjv.exe
  2⤵
  PID:8248
- C:\Windows\System\LugZWtZ.exe
  C:\Windows\System\LugZWtZ.exe
  2⤵
  PID:8276
- C:\Windows\System\ahRkWxZ.exe
  C:\Windows\System\ahRkWxZ.exe
  2⤵
  PID:8292
- C:\Windows\System\IoxeZms.exe
  C:\Windows\System\IoxeZms.exe
  2⤵
  PID:8324
- C:\Windows\System\WIYoHuf.exe
  C:\Windows\System\WIYoHuf.exe
  2⤵
  PID:8360
- C:\Windows\System\XkEGKKS.exe
  C:\Windows\System\XkEGKKS.exe
  2⤵
  PID:8380
- C:\Windows\System\FaOsYoN.exe
  C:\Windows\System\FaOsYoN.exe
  2⤵
  PID:8400
- C:\Windows\System\WkxcApz.exe
  C:\Windows\System\WkxcApz.exe
  2⤵
  PID:8432
- C:\Windows\System\yRcCAzd.exe
  C:\Windows\System\yRcCAzd.exe
  2⤵
  PID:8460
- C:\Windows\System\FOSqYfz.exe
  C:\Windows\System\FOSqYfz.exe
  2⤵
  PID:8480
- C:\Windows\System\zZLUURJ.exe
  C:\Windows\System\zZLUURJ.exe
  2⤵
  PID:8504
- C:\Windows\System\jplHQyV.exe
  C:\Windows\System\jplHQyV.exe
  2⤵
  PID:8520
- C:\Windows\System\uzglQpt.exe
  C:\Windows\System\uzglQpt.exe
  2⤵
  PID:8544
- C:\Windows\System\TCvElMI.exe
  C:\Windows\System\TCvElMI.exe
  2⤵
  PID:8564
- C:\Windows\System\syDKGEo.exe
  C:\Windows\System\syDKGEo.exe
  2⤵
  PID:8588
- C:\Windows\System\zOUjgaz.exe
  C:\Windows\System\zOUjgaz.exe
  2⤵
  PID:8612
- C:\Windows\System\yqQTibY.exe
  C:\Windows\System\yqQTibY.exe
  2⤵
  PID:8644
- C:\Windows\System\TOsttzm.exe
  C:\Windows\System\TOsttzm.exe
  2⤵
  PID:8668
- C:\Windows\System\osDWnMb.exe
  C:\Windows\System\osDWnMb.exe
  2⤵
  PID:8688
- C:\Windows\System\BhkFYbs.exe
  C:\Windows\System\BhkFYbs.exe
  2⤵
  PID:8724
- C:\Windows\System\fcvLZTP.exe
  C:\Windows\System\fcvLZTP.exe
  2⤵
  PID:8740
- C:\Windows\System\nlvAigM.exe
  C:\Windows\System\nlvAigM.exe
  2⤵
  PID:8768
- C:\Windows\System\oryRdSR.exe
  C:\Windows\System\oryRdSR.exe
  2⤵
  PID:8804
- C:\Windows\System\UCjNpoJ.exe
  C:\Windows\System\UCjNpoJ.exe
  2⤵
  PID:8836
- C:\Windows\System\lFLSEMs.exe
  C:\Windows\System\lFLSEMs.exe
  2⤵
  PID:8868
- C:\Windows\System\KfThTwR.exe
  C:\Windows\System\KfThTwR.exe
  2⤵
  PID:8896
- C:\Windows\System\GRksgdG.exe
  C:\Windows\System\GRksgdG.exe
  2⤵
  PID:8928
- C:\Windows\System\NdDwKMi.exe
  C:\Windows\System\NdDwKMi.exe
  2⤵
  PID:8956
- C:\Windows\System\LdwxfZQ.exe
  C:\Windows\System\LdwxfZQ.exe
  2⤵
  PID:8992
- C:\Windows\System\RhuuRJB.exe
  C:\Windows\System\RhuuRJB.exe
  2⤵
  PID:9020
- C:\Windows\System\BQFXlLr.exe
  C:\Windows\System\BQFXlLr.exe
  2⤵
  PID:9048
- C:\Windows\System\MqKPsHG.exe
  C:\Windows\System\MqKPsHG.exe
  2⤵
  PID:9080
- C:\Windows\System\dIoquNv.exe
  C:\Windows\System\dIoquNv.exe
  2⤵
  PID:9108
- C:\Windows\System\agHbaWU.exe
  C:\Windows\System\agHbaWU.exe
  2⤵
  PID:9144
- C:\Windows\System\EguFaba.exe
  C:\Windows\System\EguFaba.exe
  2⤵
  PID:9176
- C:\Windows\System\dNliUOS.exe
  C:\Windows\System\dNliUOS.exe
  2⤵
  PID:9204
- C:\Windows\System\ZYzvZdL.exe
  C:\Windows\System\ZYzvZdL.exe
  2⤵
  PID:8152
- C:\Windows\System\KMuXJbQ.exe
  C:\Windows\System\KMuXJbQ.exe
  2⤵
  PID:8236
- C:\Windows\System\efGImxM.exe
  C:\Windows\System\efGImxM.exe
  2⤵
  PID:8312
- C:\Windows\System\DKJDbUx.exe
  C:\Windows\System\DKJDbUx.exe
  2⤵
  PID:8260
- C:\Windows\System\ZCjLrZq.exe
  C:\Windows\System\ZCjLrZq.exe
  2⤵
  PID:8412
- C:\Windows\System\qfhmhys.exe
  C:\Windows\System\qfhmhys.exe
  2⤵
  PID:8340
- C:\Windows\System\ciwfDKB.exe
  C:\Windows\System\ciwfDKB.exe
  2⤵
  PID:8476
- C:\Windows\System\EEbCMMC.exe
  C:\Windows\System\EEbCMMC.exe
  2⤵
  PID:8268
- C:\Windows\System\PpekEFO.exe
  C:\Windows\System\PpekEFO.exe
  2⤵
  PID:8344
- C:\Windows\System\yriLcED.exe
  C:\Windows\System\yriLcED.exe
  2⤵
  PID:8516
- C:\Windows\System\nwYWfgF.exe
  C:\Windows\System\nwYWfgF.exe
  2⤵
  PID:8572
- C:\Windows\System\HQTHUXP.exe
  C:\Windows\System\HQTHUXP.exe
  2⤵
  PID:8752
- C:\Windows\System\WlisEoO.exe
  C:\Windows\System\WlisEoO.exe
  2⤵
  PID:8732
- C:\Windows\System\dNpBwnZ.exe
  C:\Windows\System\dNpBwnZ.exe
  2⤵
  PID:8848
- C:\Windows\System\jgzTdtR.exe
  C:\Windows\System\jgzTdtR.exe
  2⤵
  PID:9044
- C:\Windows\System\BsvjbIz.exe
  C:\Windows\System\BsvjbIz.exe
  2⤵
  PID:9104
- C:\Windows\System\qNNjgOR.exe
  C:\Windows\System\qNNjgOR.exe
  2⤵
  PID:9032
- C:\Windows\System\HrYDgWN.exe
  C:\Windows\System\HrYDgWN.exe
  2⤵
  PID:9188
- C:\Windows\System\JEhizxN.exe
  C:\Windows\System\JEhizxN.exe
  2⤵
  PID:7984
- C:\Windows\System\asliNqg.exe
  C:\Windows\System\asliNqg.exe
  2⤵
  PID:8288
- C:\Windows\System\yLGnemj.exe
  C:\Windows\System\yLGnemj.exe
  2⤵
  PID:8392
- C:\Windows\System\BObhbox.exe
  C:\Windows\System\BObhbox.exe
  2⤵
  PID:8368
- C:\Windows\System\jyycSSO.exe
  C:\Windows\System\jyycSSO.exe
  2⤵
  PID:8440
- C:\Windows\System\IGezETT.exe
  C:\Windows\System\IGezETT.exe
  2⤵
  PID:9040
- C:\Windows\System\WbnMWcE.exe
  C:\Windows\System\WbnMWcE.exe
  2⤵
  PID:9128
- C:\Windows\System\wVlLUen.exe
  C:\Windows\System\wVlLUen.exe
  2⤵
  PID:9136
- C:\Windows\System\hlOPaNW.exe
  C:\Windows\System\hlOPaNW.exe
  2⤵
  PID:8580
- C:\Windows\System\ICDoFCH.exe
  C:\Windows\System\ICDoFCH.exe
  2⤵
  PID:9232
- C:\Windows\System\nKAFikH.exe
  C:\Windows\System\nKAFikH.exe
  2⤵
  PID:9260
- C:\Windows\System\JuwEqyy.exe
  C:\Windows\System\JuwEqyy.exe
  2⤵
  PID:9288
- C:\Windows\System\NByvrNT.exe
  C:\Windows\System\NByvrNT.exe
  2⤵
  PID:9320
- C:\Windows\System\lCdXoVE.exe
  C:\Windows\System\lCdXoVE.exe
  2⤵
  PID:9356
- C:\Windows\System\TMhQrii.exe
  C:\Windows\System\TMhQrii.exe
  2⤵
  PID:9384
- C:\Windows\System\fsBbILq.exe
  C:\Windows\System\fsBbILq.exe
  2⤵
  PID:9412
- C:\Windows\System\IKRPCBH.exe
  C:\Windows\System\IKRPCBH.exe
  2⤵
  PID:9436
- C:\Windows\System\aICQFJU.exe
  C:\Windows\System\aICQFJU.exe
  2⤵
  PID:9464
- C:\Windows\System\AZZbmvK.exe
  C:\Windows\System\AZZbmvK.exe
  2⤵
  PID:9488
- C:\Windows\System\izbQSGP.exe
  C:\Windows\System\izbQSGP.exe
  2⤵
  PID:9516
- C:\Windows\System\GxVQiRN.exe
  C:\Windows\System\GxVQiRN.exe
  2⤵
  PID:9536
- C:\Windows\System\iswYZWj.exe
  C:\Windows\System\iswYZWj.exe
  2⤵
  PID:9560
- C:\Windows\System\SOdyrGg.exe
  C:\Windows\System\SOdyrGg.exe
  2⤵
  PID:9580
- C:\Windows\System\zoRTdlb.exe
  C:\Windows\System\zoRTdlb.exe
  2⤵
  PID:9616
- C:\Windows\System\QQGSuir.exe
  C:\Windows\System\QQGSuir.exe
  2⤵
  PID:9632
- C:\Windows\System\pUjmTnZ.exe
  C:\Windows\System\pUjmTnZ.exe
  2⤵
  PID:9664
- C:\Windows\System\YoVfBAb.exe
  C:\Windows\System\YoVfBAb.exe
  2⤵
  PID:9692
- C:\Windows\System\RWGyxlS.exe
  C:\Windows\System\RWGyxlS.exe
  2⤵
  PID:9716
- C:\Windows\System\PbwnZxF.exe
  C:\Windows\System\PbwnZxF.exe
  2⤵
  PID:9744
- C:\Windows\System\qlPtcVg.exe
  C:\Windows\System\qlPtcVg.exe
  2⤵
  PID:9764
- C:\Windows\System\DrwnUUr.exe
  C:\Windows\System\DrwnUUr.exe
  2⤵
  PID:9800
- C:\Windows\System\YtQrCCO.exe
  C:\Windows\System\YtQrCCO.exe
  2⤵
  PID:9828
- C:\Windows\System\JBmMeTM.exe
  C:\Windows\System\JBmMeTM.exe
  2⤵
  PID:9856
- C:\Windows\System\qjOwhrF.exe
  C:\Windows\System\qjOwhrF.exe
  2⤵
  PID:9880
- C:\Windows\System\ZpdKdSv.exe
  C:\Windows\System\ZpdKdSv.exe
  2⤵
  PID:9908
- C:\Windows\System\RGkwQEy.exe
  C:\Windows\System\RGkwQEy.exe
  2⤵
  PID:9940
- C:\Windows\System\eNmqDPz.exe
  C:\Windows\System\eNmqDPz.exe
  2⤵
  PID:9964
- C:\Windows\System\KDvuSUK.exe
  C:\Windows\System\KDvuSUK.exe
  2⤵
  PID:9992
- C:\Windows\System\ctthUeD.exe
  C:\Windows\System\ctthUeD.exe
  2⤵
  PID:10032
- C:\Windows\System\HtzTqro.exe
  C:\Windows\System\HtzTqro.exe
  2⤵
  PID:10052
- C:\Windows\System\BqmdVvg.exe
  C:\Windows\System\BqmdVvg.exe
  2⤵
  PID:10084
- C:\Windows\System\FSbiXFD.exe
  C:\Windows\System\FSbiXFD.exe
  2⤵
  PID:10108
- C:\Windows\System\BCoIORs.exe
  C:\Windows\System\BCoIORs.exe
  2⤵
  PID:6840
- C:\Windows\System\kxFbWcR.exe
  C:\Windows\System\kxFbWcR.exe
  2⤵
  PID:8860
- C:\Windows\System\JwZxUML.exe
  C:\Windows\System\JwZxUML.exe
  2⤵
  PID:8512
- C:\Windows\System\xHbUYfp.exe
  C:\Windows\System\xHbUYfp.exe
  2⤵
  PID:8948
- C:\Windows\System\IgAuIJk.exe
  C:\Windows\System\IgAuIJk.exe
  2⤵
  PID:9220
- C:\Windows\System\emiqGSp.exe
  C:\Windows\System\emiqGSp.exe
  2⤵
  PID:9284
- C:\Windows\System\LeBxUcy.exe
  C:\Windows\System\LeBxUcy.exe
  2⤵
  PID:9424
- C:\Windows\System\eKgPAxR.exe
  C:\Windows\System\eKgPAxR.exe
  2⤵
  PID:9596
- C:\Windows\System\itRDplN.exe
  C:\Windows\System\itRDplN.exe
  2⤵
  PID:9648
- C:\Windows\System\FKGgvRd.exe
  C:\Windows\System\FKGgvRd.exe
  2⤵
  PID:9508
- C:\Windows\System\kIdhewF.exe
  C:\Windows\System\kIdhewF.exe
  2⤵
  PID:9776
- C:\Windows\System\IWauUkt.exe
  C:\Windows\System\IWauUkt.exe
  2⤵
  PID:9844
- C:\Windows\System\cNRGlYP.exe
  C:\Windows\System\cNRGlYP.exe
  2⤵
  PID:9628
- C:\Windows\System\SgcGDFc.exe
  C:\Windows\System\SgcGDFc.exe
  2⤵
  PID:9872
- C:\Windows\System\IPxDcAr.exe
  C:\Windows\System\IPxDcAr.exe
  2⤵
  PID:10128
- C:\Windows\System\eUlsVjV.exe
  C:\Windows\System\eUlsVjV.exe
  2⤵
  PID:9976
- C:\Windows\System\lkVyUQG.exe
  C:\Windows\System\lkVyUQG.exe
  2⤵
  PID:9820
- C:\Windows\System\mNRzUPo.exe
  C:\Windows\System\mNRzUPo.exe
  2⤵
  PID:10216
- C:\Windows\System\YSSoDzd.exe
  C:\Windows\System\YSSoDzd.exe
  2⤵
  PID:9348
- C:\Windows\System\mMhIcAL.exe
  C:\Windows\System\mMhIcAL.exe
  2⤵
  PID:9552
- C:\Windows\System\nTrONCD.exe
  C:\Windows\System\nTrONCD.exe
  2⤵
  PID:9364
- C:\Windows\System\VZYciYP.exe
  C:\Windows\System\VZYciYP.exe
  2⤵
  PID:9760
- C:\Windows\System\UVaMTOh.exe
  C:\Windows\System\UVaMTOh.exe
  2⤵
  PID:10096
- C:\Windows\System\bMOZJZW.exe
  C:\Windows\System\bMOZJZW.exe
  2⤵
  PID:10000
- C:\Windows\System\BHxyaZl.exe
  C:\Windows\System\BHxyaZl.exe
  2⤵
  PID:10020
- C:\Windows\System\SfZrTQs.exe
  C:\Windows\System\SfZrTQs.exe
  2⤵
  PID:9484
- C:\Windows\System\ggvkbLb.exe
  C:\Windows\System\ggvkbLb.exe
  2⤵
  PID:9600
- C:\Windows\System\SbDsnDk.exe
  C:\Windows\System\SbDsnDk.exe
  2⤵
  PID:9936
- C:\Windows\System\bcCtorO.exe
  C:\Windows\System\bcCtorO.exe
  2⤵
  PID:10260
- C:\Windows\System\MYknQZs.exe
  C:\Windows\System\MYknQZs.exe
  2⤵
  PID:10288
- C:\Windows\System\ADVaXLf.exe
  C:\Windows\System\ADVaXLf.exe
  2⤵
  PID:10316
- C:\Windows\System\KUPhuKo.exe
  C:\Windows\System\KUPhuKo.exe
  2⤵
  PID:10344
- C:\Windows\System\XRMtYyo.exe
  C:\Windows\System\XRMtYyo.exe
  2⤵
  PID:10368
- C:\Windows\System\voJlLZq.exe
  C:\Windows\System\voJlLZq.exe
  2⤵
  PID:10396
- C:\Windows\System\VATSUfx.exe
  C:\Windows\System\VATSUfx.exe
  2⤵
  PID:10420
- C:\Windows\System\pdFiYcy.exe
  C:\Windows\System\pdFiYcy.exe
  2⤵
  PID:10452
- C:\Windows\System\sqqRJxI.exe
  C:\Windows\System\sqqRJxI.exe
  2⤵
  PID:10488
- C:\Windows\System\okAQmdy.exe
  C:\Windows\System\okAQmdy.exe
  2⤵
  PID:10508
- C:\Windows\System\GrhHrAn.exe
  C:\Windows\System\GrhHrAn.exe
  2⤵
  PID:10536
- C:\Windows\System\brGYWCb.exe
  C:\Windows\System\brGYWCb.exe
  2⤵
  PID:10564
- C:\Windows\System\fTXbTvD.exe
  C:\Windows\System\fTXbTvD.exe
  2⤵
  PID:10584
- C:\Windows\System\nYopTRN.exe
  C:\Windows\System\nYopTRN.exe
  2⤵
  PID:10612
- C:\Windows\System\qVxQHNJ.exe
  C:\Windows\System\qVxQHNJ.exe
  2⤵
  PID:10632
- C:\Windows\System\YpIIMBY.exe
  C:\Windows\System\YpIIMBY.exe
  2⤵
  PID:10660
- C:\Windows\System\raDVxzA.exe
  C:\Windows\System\raDVxzA.exe
  2⤵
  PID:10684
- C:\Windows\System\awhXgjv.exe
  C:\Windows\System\awhXgjv.exe
  2⤵
  PID:10716
- C:\Windows\System\tURZkIB.exe
  C:\Windows\System\tURZkIB.exe
  2⤵
  PID:10740
- C:\Windows\System\Etsmmqn.exe
  C:\Windows\System\Etsmmqn.exe
  2⤵
  PID:10768
- C:\Windows\System\oRzgDPb.exe
  C:\Windows\System\oRzgDPb.exe
  2⤵
  PID:10800
- C:\Windows\System\JjFFaiI.exe
  C:\Windows\System\JjFFaiI.exe
  2⤵
  PID:10828
- C:\Windows\System\gtUvbMf.exe
  C:\Windows\System\gtUvbMf.exe
  2⤵
  PID:10856
- C:\Windows\System\vdUwKMM.exe
  C:\Windows\System\vdUwKMM.exe
  2⤵
  PID:10880
- C:\Windows\System\dEmpUsT.exe
  C:\Windows\System\dEmpUsT.exe
  2⤵
  PID:10908
- C:\Windows\System\bwsCiCY.exe
  C:\Windows\System\bwsCiCY.exe
  2⤵
  PID:10932
- C:\Windows\System\Ncrdgvd.exe
  C:\Windows\System\Ncrdgvd.exe
  2⤵
  PID:10960
- C:\Windows\System\OHMvJUe.exe
  C:\Windows\System\OHMvJUe.exe
  2⤵
  PID:10984
- C:\Windows\System\CJZFZOn.exe
  C:\Windows\System\CJZFZOn.exe
  2⤵
  PID:11012
- C:\Windows\System\nNaZbbu.exe
  C:\Windows\System\nNaZbbu.exe
  2⤵
  PID:11040
- C:\Windows\System\owuxCmp.exe
  C:\Windows\System\owuxCmp.exe
  2⤵
  PID:11072
- C:\Windows\System\qeACTMk.exe
  C:\Windows\System\qeACTMk.exe
  2⤵
  PID:11096
- C:\Windows\System\ZbzIbSp.exe
  C:\Windows\System\ZbzIbSp.exe
  2⤵
  PID:11120
- C:\Windows\System\tJjLOWs.exe
  C:\Windows\System\tJjLOWs.exe
  2⤵
  PID:11156
- C:\Windows\System\AtThKyZ.exe
  C:\Windows\System\AtThKyZ.exe
  2⤵
  PID:11184
- C:\Windows\System\LFvKiAY.exe
  C:\Windows\System\LFvKiAY.exe
  2⤵
  PID:11212
- C:\Windows\System\eLkKOhp.exe
  C:\Windows\System\eLkKOhp.exe
  2⤵
  PID:11236
- C:\Windows\System\WPYOMBw.exe
  C:\Windows\System\WPYOMBw.exe
  2⤵
  PID:11256
- C:\Windows\System\Arvsxer.exe
  C:\Windows\System\Arvsxer.exe
  2⤵
  PID:10064
- C:\Windows\System\FzmchDL.exe
  C:\Windows\System\FzmchDL.exe
  2⤵
  PID:9404
- C:\Windows\System\nYFudPr.exe
  C:\Windows\System\nYFudPr.exe
  2⤵
  PID:10160
- C:\Windows\System\YnEFxam.exe
  C:\Windows\System\YnEFxam.exe
  2⤵
  PID:10272
- C:\Windows\System\HVCVTAc.exe
  C:\Windows\System\HVCVTAc.exe
  2⤵
  PID:10432
- C:\Windows\System\mNFXxSS.exe
  C:\Windows\System\mNFXxSS.exe
  2⤵
  PID:10380
- C:\Windows\System\MrFjedN.exe
  C:\Windows\System\MrFjedN.exe
  2⤵
  PID:10444
- C:\Windows\System\MSXTSLB.exe
  C:\Windows\System\MSXTSLB.exe
  2⤵
  PID:10628
- C:\Windows\System\NJkMBQC.exe
  C:\Windows\System\NJkMBQC.exe
  2⤵
  PID:10556
- C:\Windows\System\sJzFZmf.exe
  C:\Windows\System\sJzFZmf.exe
  2⤵
  PID:10652
- C:\Windows\System\DqWaLKz.exe
  C:\Windows\System\DqWaLKz.exe
  2⤵
  PID:10764
- C:\Windows\System\vACKmMe.exe
  C:\Windows\System\vACKmMe.exe
  2⤵
  PID:10732
- C:\Windows\System\gjeXPoI.exe
  C:\Windows\System\gjeXPoI.exe
  2⤵
  PID:10920
- C:\Windows\System\avWuGsD.exe
  C:\Windows\System\avWuGsD.exe
  2⤵
  PID:11020
- C:\Windows\System\ufzYgNO.exe
  C:\Windows\System\ufzYgNO.exe
  2⤵
  PID:11060
- C:\Windows\System\bXvPSZG.exe
  C:\Windows\System\bXvPSZG.exe
  2⤵
  PID:11112
- C:\Windows\System\IYPYtfe.exe
  C:\Windows\System\IYPYtfe.exe
  2⤵
  PID:11052
- C:\Windows\System\bdAMXom.exe
  C:\Windows\System\bdAMXom.exe
  2⤵
  PID:10312
- C:\Windows\System\wuKPoJk.exe
  C:\Windows\System\wuKPoJk.exe
  2⤵
  PID:11152
- C:\Windows\System\RyoFPKp.exe
  C:\Windows\System\RyoFPKp.exe
  2⤵
  PID:9576
- C:\Windows\System\aCfEZeI.exe
  C:\Windows\System\aCfEZeI.exe
  2⤵
  PID:10364
- C:\Windows\System\FoItpSd.exe
  C:\Windows\System\FoItpSd.exe
  2⤵
  PID:10356
- C:\Windows\System\pSPWaFz.exe
  C:\Windows\System\pSPWaFz.exe
  2⤵
  PID:10608
- C:\Windows\System\mRkfBuV.exe
  C:\Windows\System\mRkfBuV.exe
  2⤵
  PID:10524
- C:\Windows\System\WtLsUlh.exe
  C:\Windows\System\WtLsUlh.exe
  2⤵
  PID:11108
- C:\Windows\System\kYELnms.exe
  C:\Windows\System\kYELnms.exe
  2⤵
  PID:10752
- C:\Windows\System\AunFPBb.exe
  C:\Windows\System\AunFPBb.exe
  2⤵
  PID:8500
- C:\Windows\System\qbNoUQy.exe
  C:\Windows\System\qbNoUQy.exe
  2⤵
  PID:11280
- C:\Windows\System\DPRzaQm.exe
  C:\Windows\System\DPRzaQm.exe
  2⤵
  PID:11296
- C:\Windows\System\ZVHHHjB.exe
  C:\Windows\System\ZVHHHjB.exe
  2⤵
  PID:11324
- C:\Windows\System\pUDRyxq.exe
  C:\Windows\System\pUDRyxq.exe
  2⤵
  PID:11356
- C:\Windows\System\ZGOZWrJ.exe
  C:\Windows\System\ZGOZWrJ.exe
  2⤵
  PID:11384
- C:\Windows\System\jDaRxpg.exe
  C:\Windows\System\jDaRxpg.exe
  2⤵
  PID:11412
- C:\Windows\System\tdaISBE.exe
  C:\Windows\System\tdaISBE.exe
  2⤵
  PID:11432
- C:\Windows\System\tBTxNzA.exe
  C:\Windows\System\tBTxNzA.exe
  2⤵
  PID:11464
- C:\Windows\System\XaeZgHo.exe
  C:\Windows\System\XaeZgHo.exe
  2⤵
  PID:11488
- C:\Windows\System\lpWilTR.exe
  C:\Windows\System\lpWilTR.exe
  2⤵
  PID:11512
- C:\Windows\System\CGQoOEK.exe
  C:\Windows\System\CGQoOEK.exe
  2⤵
  PID:11540
- C:\Windows\System\sptYsMO.exe
  C:\Windows\System\sptYsMO.exe
  2⤵
  PID:11564
- C:\Windows\System\TnFvJKa.exe
  C:\Windows\System\TnFvJKa.exe
  2⤵
  PID:11604
- C:\Windows\System\MDjZcLe.exe
  C:\Windows\System\MDjZcLe.exe
  2⤵
  PID:11624
- C:\Windows\System\iWZeAjD.exe
  C:\Windows\System\iWZeAjD.exe
  2⤵
  PID:11660
- C:\Windows\System\GENXkTU.exe
  C:\Windows\System\GENXkTU.exe
  2⤵
  PID:11684
- C:\Windows\System\asPeXOH.exe
  C:\Windows\System\asPeXOH.exe
  2⤵
  PID:11708
- C:\Windows\System\xtFewod.exe
  C:\Windows\System\xtFewod.exe
  2⤵
  PID:11740
- C:\Windows\System\hOgBJJa.exe
  C:\Windows\System\hOgBJJa.exe
  2⤵
  PID:11776
- C:\Windows\System\RqRwcqE.exe
  C:\Windows\System\RqRwcqE.exe
  2⤵
  PID:11804
- C:\Windows\System\SFZasaR.exe
  C:\Windows\System\SFZasaR.exe
  2⤵
  PID:11828
- C:\Windows\System\CyTvdQK.exe
  C:\Windows\System\CyTvdQK.exe
  2⤵
  PID:11856
- C:\Windows\System\wftlZtl.exe
  C:\Windows\System\wftlZtl.exe
  2⤵
  PID:11884
- C:\Windows\System\ohhNCOV.exe
  C:\Windows\System\ohhNCOV.exe
  2⤵
  PID:11920
- C:\Windows\System\rCTKWvu.exe
  C:\Windows\System\rCTKWvu.exe
  2⤵
  PID:11944
- C:\Windows\System\tslQJmS.exe
  C:\Windows\System\tslQJmS.exe
  2⤵
  PID:11980
- C:\Windows\System\wbYmAJH.exe
  C:\Windows\System\wbYmAJH.exe
  2⤵
  PID:12000
- C:\Windows\System\OzIUFfH.exe
  C:\Windows\System\OzIUFfH.exe
  2⤵
  PID:12032
- C:\Windows\System\xitgMdh.exe
  C:\Windows\System\xitgMdh.exe
  2⤵
  PID:12064
- C:\Windows\System\zeqrpKv.exe
  C:\Windows\System\zeqrpKv.exe
  2⤵
  PID:12112
- C:\Windows\System\mmKJqnp.exe
  C:\Windows\System\mmKJqnp.exe
  2⤵
  PID:12144
- C:\Windows\System\CRdELyB.exe
  C:\Windows\System\CRdELyB.exe
  2⤵
  PID:12168
- C:\Windows\System\GXxoyPA.exe
  C:\Windows\System\GXxoyPA.exe
  2⤵
  PID:12192
- C:\Windows\System\mptQCRg.exe
  C:\Windows\System\mptQCRg.exe
  2⤵
  PID:12216
- C:\Windows\System\QDqRVoK.exe
  C:\Windows\System\QDqRVoK.exe
  2⤵
  PID:12232
- C:\Windows\System\tbGpOXm.exe
  C:\Windows\System\tbGpOXm.exe
  2⤵
  PID:12248
- C:\Windows\System\jOYSkQN.exe
  C:\Windows\System\jOYSkQN.exe
  2⤵
  PID:12280
- C:\Windows\System\dJkLxlF.exe
  C:\Windows\System\dJkLxlF.exe
  2⤵
  PID:11144
- C:\Windows\System\JkxewaQ.exe
  C:\Windows\System\JkxewaQ.exe
  2⤵
  PID:10528
- C:\Windows\System\BOfZfJp.exe
  C:\Windows\System\BOfZfJp.exe
  2⤵
  PID:11244
- C:\Windows\System\kXKQlgI.exe
  C:\Windows\System\kXKQlgI.exe
  2⤵
  PID:11312
- C:\Windows\System\feunMyY.exe
  C:\Windows\System\feunMyY.exe
  2⤵
  PID:11396
- C:\Windows\System\cTFzJtD.exe
  C:\Windows\System\cTFzJtD.exe
  2⤵
  PID:11408
- C:\Windows\System\wIjwzPJ.exe
  C:\Windows\System\wIjwzPJ.exe
  2⤵
  PID:11288
- C:\Windows\System\WrtlXgf.exe
  C:\Windows\System\WrtlXgf.exe
  2⤵
  PID:11524
- C:\Windows\System\YVqPcgX.exe
  C:\Windows\System\YVqPcgX.exe
  2⤵
  PID:11760
- C:\Windows\System\QNYaJwg.exe
  C:\Windows\System\QNYaJwg.exe
  2⤵
  PID:11508
- C:\Windows\System\fACMvEq.exe
  C:\Windows\System\fACMvEq.exe
  2⤵
  PID:11908
- C:\Windows\System\OzehJnp.exe
  C:\Windows\System\OzehJnp.exe
  2⤵
  PID:11680
- C:\Windows\System\jpxxMmw.exe
  C:\Windows\System\jpxxMmw.exe
  2⤵
  PID:11940
- C:\Windows\System\TpNbGyy.exe
  C:\Windows\System\TpNbGyy.exe
  2⤵
  PID:12048
- C:\Windows\System\YVMrQbD.exe
  C:\Windows\System\YVMrQbD.exe
  2⤵
  PID:12108
- C:\Windows\System\XdQlFrW.exe
  C:\Windows\System\XdQlFrW.exe
  2⤵
  PID:11936
- C:\Windows\System\RNwMmTY.exe
  C:\Windows\System\RNwMmTY.exe
  2⤵
  PID:12180
- C:\Windows\System\PjfuLnD.exe
  C:\Windows\System\PjfuLnD.exe
  2⤵
  PID:12156
- C:\Windows\System\IFNHlbj.exe
  C:\Windows\System\IFNHlbj.exe
  2⤵
  PID:12228
- C:\Windows\System\edOXxiw.exe
  C:\Windows\System\edOXxiw.exe
  2⤵
  PID:12256
- C:\Windows\System\gNxaERW.exe
  C:\Windows\System\gNxaERW.exe
  2⤵
  PID:11576
- C:\Windows\System\tPKIwUQ.exe
  C:\Windows\System\tPKIwUQ.exe
  2⤵
  PID:11692
- C:\Windows\System\QUHVaWJ.exe
  C:\Windows\System\QUHVaWJ.exe
  2⤵
  PID:11728
- C:\Windows\System\atftQkB.exe
  C:\Windows\System\atftQkB.exe
  2⤵
  PID:11440
- C:\Windows\System\qdyJJTL.exe
  C:\Windows\System\qdyJJTL.exe
  2⤵
  PID:11420
- C:\Windows\System\mzqgJly.exe
  C:\Windows\System\mzqgJly.exe
  2⤵
  PID:12164
- C:\Windows\System\IdjjIaH.exe
  C:\Windows\System\IdjjIaH.exe
  2⤵
  PID:11528
- C:\Windows\System\lBMITVJ.exe
  C:\Windows\System\lBMITVJ.exe
  2⤵
  PID:12292
- C:\Windows\System\SEJfWMk.exe
  C:\Windows\System\SEJfWMk.exe
  2⤵
  PID:12320
- C:\Windows\System\XgwpDRU.exe
  C:\Windows\System\XgwpDRU.exe
  2⤵
  PID:12348
- C:\Windows\System\heJlThc.exe
  C:\Windows\System\heJlThc.exe
  2⤵
  PID:12380
- C:\Windows\System\ayoSnVS.exe
  C:\Windows\System\ayoSnVS.exe
  2⤵
  PID:12404
- C:\Windows\System\TsYtttQ.exe
  C:\Windows\System\TsYtttQ.exe
  2⤵
  PID:12432
- C:\Windows\System\wOfLipj.exe
  C:\Windows\System\wOfLipj.exe
  2⤵
  PID:12460
- C:\Windows\System\VRxXqsL.exe
  C:\Windows\System\VRxXqsL.exe
  2⤵
  PID:12484
- C:\Windows\System\scTDpru.exe
  C:\Windows\System\scTDpru.exe
  2⤵
  PID:12512
- C:\Windows\System\agzrcwv.exe
  C:\Windows\System\agzrcwv.exe
  2⤵
  PID:12544
- C:\Windows\System\jPNJeox.exe
  C:\Windows\System\jPNJeox.exe
  2⤵
  PID:12564
- C:\Windows\System\nCxoJbw.exe
  C:\Windows\System\nCxoJbw.exe
  2⤵
  PID:12600
- C:\Windows\System\vSQAcPO.exe
  C:\Windows\System\vSQAcPO.exe
  2⤵
  PID:12628
- C:\Windows\System\ANVVtKE.exe
  C:\Windows\System\ANVVtKE.exe
  2⤵
  PID:12660
- C:\Windows\System\fZmtCcd.exe
  C:\Windows\System\fZmtCcd.exe
  2⤵
  PID:12684
- C:\Windows\System\iiwGYda.exe
  C:\Windows\System\iiwGYda.exe
  2⤵
  PID:12708
- C:\Windows\System\nuJyVWA.exe
  C:\Windows\System\nuJyVWA.exe
  2⤵
  PID:12740
- C:\Windows\System\AHxtyYc.exe
  C:\Windows\System\AHxtyYc.exe
  2⤵
  PID:12764
- C:\Windows\System\IZTBfqF.exe
  C:\Windows\System\IZTBfqF.exe
  2⤵
  PID:12784
- C:\Windows\System\kBlcyOp.exe
  C:\Windows\System\kBlcyOp.exe
  2⤵
  PID:12816
- C:\Windows\System\GQFZcJJ.exe
  C:\Windows\System\GQFZcJJ.exe
  2⤵
  PID:12836
- C:\Windows\System\STpDWRe.exe
  C:\Windows\System\STpDWRe.exe
  2⤵
  PID:12864
- C:\Windows\System\oFKvTlO.exe
  C:\Windows\System\oFKvTlO.exe
  2⤵
  PID:12892
- C:\Windows\System\eDtXlAa.exe
  C:\Windows\System\eDtXlAa.exe
  2⤵
  PID:12924
- C:\Windows\System\RscpJtl.exe
  C:\Windows\System\RscpJtl.exe
  2⤵
  PID:12952
- C:\Windows\System\FOnGDRB.exe
  C:\Windows\System\FOnGDRB.exe
  2⤵
  PID:12976
- C:\Windows\System\zNmqTUZ.exe
  C:\Windows\System\zNmqTUZ.exe
  2⤵
  PID:13000
- C:\Windows\System\fFykdIM.exe
  C:\Windows\System\fFykdIM.exe
  2⤵
  PID:13028
- C:\Windows\System\nEpNKTC.exe
  C:\Windows\System\nEpNKTC.exe
  2⤵
  PID:13056
- C:\Windows\System\sMYaswF.exe
  C:\Windows\System\sMYaswF.exe
  2⤵
  PID:13076
- C:\Windows\System\xvwluxt.exe
  C:\Windows\System\xvwluxt.exe
  2⤵
  PID:13100
- C:\Windows\System\Chtvdsk.exe
  C:\Windows\System\Chtvdsk.exe
  2⤵
  PID:13128
- C:\Windows\System\wxKJlkx.exe
  C:\Windows\System\wxKJlkx.exe
  2⤵
  PID:13156
- C:\Windows\System\VPcQTmF.exe
  C:\Windows\System\VPcQTmF.exe
  2⤵
  PID:13172
- C:\Windows\System\WJrdbZV.exe
  C:\Windows\System\WJrdbZV.exe
  2⤵
  PID:13204
- C:\Windows\System\VDrvhht.exe
  C:\Windows\System\VDrvhht.exe
  2⤵
  PID:13232
- C:\Windows\System\kvgtiXu.exe
  C:\Windows\System\kvgtiXu.exe
  2⤵
  PID:13256
- C:\Windows\System\IKDrRVj.exe
  C:\Windows\System\IKDrRVj.exe
  2⤵
  PID:13292
- C:\Windows\System\YFdqJUz.exe
  C:\Windows\System\YFdqJUz.exe
  2⤵
  PID:11368
- C:\Windows\System\nsGmDRN.exe
  C:\Windows\System\nsGmDRN.exe
  2⤵
  PID:11556
- C:\Windows\System\OqSYUKe.exe
  C:\Windows\System\OqSYUKe.exe
  2⤵
  PID:11248
- C:\Windows\System\DTsnevu.exe
  C:\Windows\System\DTsnevu.exe
  2⤵
  PID:12332
- C:\Windows\System\vonQBhF.exe
  C:\Windows\System\vonQBhF.exe
  2⤵
  PID:12420
- C:\Windows\System\BpBxDmn.exe
  C:\Windows\System\BpBxDmn.exe
  2⤵
  PID:12336
- C:\Windows\System\MdMkNwU.exe
  C:\Windows\System\MdMkNwU.exe
  2⤵
  PID:12540
- C:\Windows\System\IgnVyeJ.exe
  C:\Windows\System\IgnVyeJ.exe
  2⤵
  PID:12452
- C:\Windows\System\suxBRwj.exe
  C:\Windows\System\suxBRwj.exe
  2⤵
  PID:12480
- C:\Windows\System\ajAgowg.exe
  C:\Windows\System\ajAgowg.exe
  2⤵
  PID:12696
- C:\Windows\System\aRUdHMs.exe
  C:\Windows\System\aRUdHMs.exe
  2⤵
  PID:12476
- C:\Windows\System\XrzByvm.exe
  C:\Windows\System\XrzByvm.exe
  2⤵
  PID:12496
- C:\Windows\System\HiblOla.exe
  C:\Windows\System\HiblOla.exe
  2⤵
  PID:12884
- C:\Windows\System\kijVLuV.exe
  C:\Windows\System\kijVLuV.exe
  2⤵
  PID:12652
- C:\Windows\System\fNfhmYe.exe
  C:\Windows\System\fNfhmYe.exe
  2⤵
  PID:12704
- C:\Windows\System\opaRvES.exe
  C:\Windows\System\opaRvES.exe
  2⤵
  PID:12936
- C:\Windows\System\bmzalcj.exe
  C:\Windows\System\bmzalcj.exe
  2⤵
  PID:13124
- C:\Windows\System\IqdsHxd.exe
  C:\Windows\System\IqdsHxd.exe
  2⤵
  PID:13280
- C:\Windows\System\ZkHoWWH.exe
  C:\Windows\System\ZkHoWWH.exe
  2⤵
  PID:13164
- C:\Windows\System\xdsnFzC.exe
  C:\Windows\System\xdsnFzC.exe
  2⤵
  PID:13228
- C:\Windows\System\bBGMSnY.exe
  C:\Windows\System\bBGMSnY.exe
  2⤵
  PID:13268
- C:\Windows\System\ntKBuJl.exe
  C:\Windows\System\ntKBuJl.exe
  2⤵
  PID:13140
- C:\Windows\System\uRHJZls.exe
  C:\Windows\System\uRHJZls.exe
  2⤵
  PID:12524
- C:\Windows\System\gAvqtjC.exe
  C:\Windows\System\gAvqtjC.exe
  2⤵
  PID:12584
- C:\Windows\System\bSRrUGb.exe
  C:\Windows\System\bSRrUGb.exe
  2⤵
  PID:13324
- C:\Windows\System\sthXbah.exe
  C:\Windows\System\sthXbah.exe
  2⤵
  PID:13348
- C:\Windows\System\ienJTrU.exe
  C:\Windows\System\ienJTrU.exe
  2⤵
  PID:13376
- C:\Windows\System\QWWwMHV.exe
  C:\Windows\System\QWWwMHV.exe
  2⤵
  PID:13408
- C:\Windows\System\aHNOHli.exe
  C:\Windows\System\aHNOHli.exe
  2⤵
  PID:13432
- C:\Windows\System\SqxyIXi.exe
  C:\Windows\System\SqxyIXi.exe
  2⤵
  PID:13456
- C:\Windows\System\zXLytxi.exe
  C:\Windows\System\zXLytxi.exe
  2⤵
  PID:13484
- C:\Windows\System\olQwxSs.exe
  C:\Windows\System\olQwxSs.exe
  2⤵
  PID:13520
- C:\Windows\System\HVRkHlu.exe
  C:\Windows\System\HVRkHlu.exe
  2⤵
  PID:13552
- C:\Windows\System\sbErgUd.exe
  C:\Windows\System\sbErgUd.exe
  2⤵
  PID:13572
- C:\Windows\System\KZKsmss.exe
  C:\Windows\System\KZKsmss.exe
  2⤵
  PID:13596
- C:\Windows\System\sEZellX.exe
  C:\Windows\System\sEZellX.exe
  2⤵
  PID:13620
- C:\Windows\System\hUFBiUS.exe
  C:\Windows\System\hUFBiUS.exe
  2⤵
  PID:13652
- C:\Windows\System\DiLhpWU.exe
  C:\Windows\System\DiLhpWU.exe
  2⤵
  PID:13684
- C:\Windows\System\HPHXSzU.exe
  C:\Windows\System\HPHXSzU.exe
  2⤵
  PID:13708
- C:\Windows\System\tKBeVqK.exe
  C:\Windows\System\tKBeVqK.exe
  2⤵
  PID:13736
- C:\Windows\System\dlkDiJp.exe
  C:\Windows\System\dlkDiJp.exe
  2⤵
  PID:13820
- C:\Windows\System\hGEXSLb.exe
  C:\Windows\System\hGEXSLb.exe
  2⤵
  PID:13840
- C:\Windows\System\aUhWrIx.exe
  C:\Windows\System\aUhWrIx.exe
  2⤵
  PID:13864
- C:\Windows\System\fWvuxra.exe
  C:\Windows\System\fWvuxra.exe
  2⤵
  PID:13888
- C:\Windows\System\UkYBBcF.exe
  C:\Windows\System\UkYBBcF.exe
  2⤵
  PID:13912
- C:\Windows\System\BMopDEz.exe
  C:\Windows\System\BMopDEz.exe
  2⤵
  PID:13936
- C:\Windows\System\KoWqSvQ.exe
  C:\Windows\System\KoWqSvQ.exe
  2⤵
  PID:13960
- C:\Windows\System\oygwXLj.exe
  C:\Windows\System\oygwXLj.exe
  2⤵
  PID:13984
- C:\Windows\System\oFIYdRh.exe
  C:\Windows\System\oFIYdRh.exe
  2⤵
  PID:14012
- C:\Windows\System\nLdwiJB.exe
  C:\Windows\System\nLdwiJB.exe
  2⤵
  PID:14044
- C:\Windows\System\dAQFnFh.exe
  C:\Windows\System\dAQFnFh.exe
  2⤵
  PID:14060
- C:\Windows\System\lwSaSzS.exe
  C:\Windows\System\lwSaSzS.exe
  2⤵
  PID:14088
- C:\Windows\System\XCsFWTX.exe
  C:\Windows\System\XCsFWTX.exe
  2⤵
  PID:14108
- C:\Windows\System\tKuEgLi.exe
  C:\Windows\System\tKuEgLi.exe
  2⤵
  PID:14136
- C:\Windows\System\NXxcFnG.exe
  C:\Windows\System\NXxcFnG.exe
  2⤵
  PID:14164
- C:\Windows\System\XZEpaeN.exe
  C:\Windows\System\XZEpaeN.exe
  2⤵
  PID:14188
- C:\Windows\System\oRvDlWn.exe
  C:\Windows\System\oRvDlWn.exe
  2⤵
  PID:14212
- C:\Windows\System\SuAQpaZ.exe
  C:\Windows\System\SuAQpaZ.exe
  2⤵
  PID:14240
- C:\Windows\System\XVCFsbu.exe
  C:\Windows\System\XVCFsbu.exe
  2⤵
  PID:14256
- C:\Windows\System\LJrPlzx.exe
  C:\Windows\System\LJrPlzx.exe
  2⤵
  PID:14272
- C:\Windows\System\WRzNhzo.exe
  C:\Windows\System\WRzNhzo.exe
  2⤵
  PID:14288
- C:\Windows\System\zNOuIxA.exe
  C:\Windows\System\zNOuIxA.exe
  2⤵
  PID:14312
- C:\Windows\System\NIpOReh.exe
  C:\Windows\System\NIpOReh.exe
  2⤵
  PID:12908
- C:\Windows\System\UmAehSZ.exe
  C:\Windows\System\UmAehSZ.exe
  2⤵
  PID:13096
- C:\Windows\System\rxVhDhh.exe
  C:\Windows\System\rxVhDhh.exe
  2⤵
  PID:11348
- C:\Windows\System\lMhFlhw.exe
  C:\Windows\System\lMhFlhw.exe
  2⤵
  PID:11620
- C:\Windows\System\xAILWNN.exe
  C:\Windows\System\xAILWNN.exe
  2⤵
  PID:12728
- C:\Windows\System\iqeZWLI.exe
  C:\Windows\System\iqeZWLI.exe
  2⤵
  PID:12616
- C:\Windows\System\sEcxBqf.exe
  C:\Windows\System\sEcxBqf.exe
  2⤵
  PID:13308
- C:\Windows\System\oQYhznI.exe
  C:\Windows\System\oQYhznI.exe
  2⤵
  PID:13480
- C:\Windows\System\htbutjU.exe
  C:\Windows\System\htbutjU.exe
  2⤵
  PID:13088
- C:\Windows\System\SbewMIn.exe
  C:\Windows\System\SbewMIn.exe
  2⤵
  PID:13668
- C:\Windows\System\fhrOYEJ.exe
  C:\Windows\System\fhrOYEJ.exe
  2⤵
  PID:13336
- C:\Windows\System\JzarHfU.exe
  C:\Windows\System\JzarHfU.exe
  2⤵
  PID:13608
- C:\Windows\System\Inttlyc.exe
  C:\Windows\System\Inttlyc.exe
  2⤵
  PID:13680
- C:\Windows\System\mDnDqsL.exe
  C:\Windows\System\mDnDqsL.exe
  2⤵
  PID:13512
- C:\Windows\System\obTjemC.exe
  C:\Windows\System\obTjemC.exe
  2⤵
  PID:13588
- C:\Windows\System\FGtoeCX.exe
  C:\Windows\System\FGtoeCX.exe
  2⤵
  PID:13648
- C:\Windows\System\mqakkML.exe
  C:\Windows\System\mqakkML.exe
  2⤵
  PID:13732
- C:\Windows\System\JcfRozF.exe
  C:\Windows\System\JcfRozF.exe
  2⤵
  PID:14036
- C:\Windows\System\rCfsgpx.exe
  C:\Windows\System\rCfsgpx.exe
  2⤵
  PID:14124
- C:\Windows\System\YMlXXKh.exe
  C:\Windows\System\YMlXXKh.exe
  2⤵
  PID:13932
- C:\Windows\System\haCauET.exe
  C:\Windows\System\haCauET.exe
  2⤵
  PID:14268
- C:\Windows\System\bunqDAp.exe
  C:\Windows\System\bunqDAp.exe
  2⤵
  PID:13880
- C:\Windows\System\bGkDhcZ.exe
  C:\Windows\System\bGkDhcZ.exe
  2⤵
  PID:13968
- C:\Windows\System\ByHRxUh.exe
  C:\Windows\System\ByHRxUh.exe
  2⤵
  PID:14252
- C:\Windows\System\pzTrXhB.exe
  C:\Windows\System\pzTrXhB.exe
  2⤵
  PID:12996
- C:\Windows\System\zWDfhIi.exe
  C:\Windows\System\zWDfhIi.exe
  2⤵
  PID:13696
- C:\Windows\System\QLYRRnS.exe
  C:\Windows\System\QLYRRnS.exe
  2⤵
  PID:14368
- C:\Windows\System\gfzpTRl.exe
  C:\Windows\System\gfzpTRl.exe
  2⤵
  PID:14384
- C:\Windows\System\wSnWVvA.exe
  C:\Windows\System\wSnWVvA.exe
  2⤵
  PID:14412
- C:\Windows\System\OJAkPOh.exe
  C:\Windows\System\OJAkPOh.exe
  2⤵
  PID:14436
- C:\Windows\System\uyQMPee.exe
  C:\Windows\System\uyQMPee.exe
  2⤵
  PID:14460
- C:\Windows\System\pODmFxa.exe
  C:\Windows\System\pODmFxa.exe
  2⤵
  PID:14480
- C:\Windows\System\PluAdlQ.exe
  C:\Windows\System\PluAdlQ.exe
  2⤵
  PID:14504
- C:\Windows\System\zJnURLF.exe
  C:\Windows\System\zJnURLF.exe
  2⤵
  PID:14536
- C:\Windows\System\aMEcOoz.exe
  C:\Windows\System\aMEcOoz.exe
  2⤵
  PID:14564
- C:\Windows\System\EpEBRwN.exe
  C:\Windows\System\EpEBRwN.exe
  2⤵
  PID:14584
- C:\Windows\System\KUgmCuH.exe
  C:\Windows\System\KUgmCuH.exe
  2⤵
  PID:14604
- C:\Windows\System\dlrgsdl.exe
  C:\Windows\System\dlrgsdl.exe
  2⤵
  PID:14636
- C:\Windows\System\NgzCpiu.exe
  C:\Windows\System\NgzCpiu.exe
  2⤵
  PID:14664
- C:\Windows\System\ZdQyVLE.exe
  C:\Windows\System\ZdQyVLE.exe
  2⤵
  PID:14684
- C:\Windows\System\CFqLdpV.exe
  C:\Windows\System\CFqLdpV.exe
  2⤵
  PID:14708
- C:\Windows\System\MCDPNoB.exe
  C:\Windows\System\MCDPNoB.exe
  2⤵
  PID:14736
- C:\Windows\System\WmvDfIt.exe
  C:\Windows\System\WmvDfIt.exe
  2⤵
  PID:14764
- C:\Windows\System\PCgfWcK.exe
  C:\Windows\System\PCgfWcK.exe
  2⤵
  PID:14796
- C:\Windows\System\fFXytCr.exe
  C:\Windows\System\fFXytCr.exe
  2⤵
  PID:14816
- C:\Windows\System\aGclmhe.exe
  C:\Windows\System\aGclmhe.exe
  2⤵
  PID:14840
- C:\Windows\System\mmARKTm.exe
  C:\Windows\System\mmARKTm.exe
  2⤵
  PID:14864
- C:\Windows\System\TlxVbjF.exe
  C:\Windows\System\TlxVbjF.exe
  2⤵
  PID:14896
- C:\Windows\System\xyLithx.exe
  C:\Windows\System\xyLithx.exe
  2⤵
  PID:14924
- C:\Windows\System\bJPhTyE.exe
  C:\Windows\System\bJPhTyE.exe
  2⤵
  PID:14960
- C:\Windows\System\kSfzurj.exe
  C:\Windows\System\kSfzurj.exe
  2⤵
  PID:14984
- C:\Windows\System\pTpexeb.exe
  C:\Windows\System\pTpexeb.exe
  2⤵
  PID:15000
- C:\Windows\System\KQrQaZl.exe
  C:\Windows\System\KQrQaZl.exe
  2⤵
  PID:15028
- C:\Windows\System\bsKDkHm.exe
  C:\Windows\System\bsKDkHm.exe
  2⤵
  PID:15044
- C:\Windows\System\ePMxMMy.exe
  C:\Windows\System\ePMxMMy.exe
  2⤵
  PID:15068
- C:\Windows\System\FBRwHLM.exe
  C:\Windows\System\FBRwHLM.exe
  2⤵
  PID:15092
- C:\Windows\System\mMyOjfR.exe
  C:\Windows\System\mMyOjfR.exe
  2⤵
  PID:15124
- C:\Windows\System\zQPknFt.exe
  C:\Windows\System\zQPknFt.exe
  2⤵
  PID:15148
- C:\Windows\System\TIPQIWk.exe
  C:\Windows\System\TIPQIWk.exe
  2⤵
  PID:15172
- C:\Windows\System\iQpDiPt.exe
  C:\Windows\System\iQpDiPt.exe
  2⤵
  PID:15188
- C:\Windows\System\lFgmbLR.exe
  C:\Windows\System\lFgmbLR.exe
  2⤵
  PID:15216
- C:\Windows\System\xRzkRrA.exe
  C:\Windows\System\xRzkRrA.exe
  2⤵
  PID:15240
- C:\Windows\System\vFlpGiY.exe
  C:\Windows\System\vFlpGiY.exe
  2⤵
  PID:15264
- C:\Windows\System\jHwoTCz.exe
  C:\Windows\System\jHwoTCz.exe
  2⤵
  PID:15284
- C:\Windows\System\JvOZabb.exe
  C:\Windows\System\JvOZabb.exe
  2⤵
  PID:15312
- C:\Windows\System\ZOcGkJd.exe
  C:\Windows\System\ZOcGkJd.exe
  2⤵
  PID:15328
- C:\Windows\System\VhChWKJ.exe
  C:\Windows\System\VhChWKJ.exe
  2⤵
  PID:15348
- C:\Windows\System\SlxWAkB.exe
  C:\Windows\System\SlxWAkB.exe
  2⤵
  PID:14152
- C:\Windows\System\ZOiXFaY.exe
  C:\Windows\System\ZOiXFaY.exe
  2⤵
  PID:11996
- C:\Windows\System\ZChOIDz.exe
  C:\Windows\System\ZChOIDz.exe
  2⤵
  PID:14172
- C:\Windows\System\jXHlQYT.exe
  C:\Windows\System\jXHlQYT.exe
  2⤵
  PID:14248
- C:\Windows\System\JHrirwT.exe
  C:\Windows\System\JHrirwT.exe
  2⤵
  PID:13052
- C:\Windows\System\qZTmXye.exe
  C:\Windows\System\qZTmXye.exe
  2⤵
  PID:14308
- C:\Windows\System\icwPGQq.exe
  C:\Windows\System\icwPGQq.exe
  2⤵
  PID:14404
- C:\Windows\System\VYGxAzN.exe
  C:\Windows\System\VYGxAzN.exe
  2⤵
  PID:14432
- C:\Windows\System\TckMsOa.exe
  C:\Windows\System\TckMsOa.exe
  2⤵
  PID:13928
- C:\Windows\System\wrZRmJY.exe
  C:\Windows\System\wrZRmJY.exe
  2⤵
  PID:13388
- C:\Windows\System\ckHMIUm.exe
  C:\Windows\System\ckHMIUm.exe
  2⤵
  PID:14552
- C:\Windows\System\bWGFVfr.exe
  C:\Windows\System\bWGFVfr.exe
  2⤵
  PID:13644
- C:\Windows\System\QFCmkLa.exe
  C:\Windows\System\QFCmkLa.exe
  2⤵
  PID:13724
- C:\Windows\System\WshEYPs.exe
  C:\Windows\System\WshEYPs.exe
  2⤵
  PID:14724
- C:\Windows\System\nGfKQTo.exe
  C:\Windows\System\nGfKQTo.exe
  2⤵
  PID:14752
- C:\Windows\System\assMZuS.exe
  C:\Windows\System\assMZuS.exe
  2⤵
  PID:14848
- C:\Windows\System\fnGxdJR.exe
  C:\Windows\System\fnGxdJR.exe
  2⤵
  PID:14908
- C:\Windows\System\zwosqDc.exe
  C:\Windows\System\zwosqDc.exe
  2⤵
  PID:14956
- C:\Windows\System\PIvXbcL.exe
  C:\Windows\System\PIvXbcL.exe
  2⤵
  PID:15040
- C:\Windows\System\MmVPLJq.exe
  C:\Windows\System\MmVPLJq.exe
  2⤵
  PID:14728
- C:\Windows\System\sJLtvFJ.exe
  C:\Windows\System\sJLtvFJ.exe
  2⤵
  PID:15136
- C:\Windows\System\MasMDhZ.exe
  C:\Windows\System\MasMDhZ.exe
  2⤵
  PID:14852
- C:\Windows\System\dHxUxGO.exe
  C:\Windows\System\dHxUxGO.exe
  2⤵
  PID:15252
- C:\Windows\System\thAgvzp.exe
  C:\Windows\System\thAgvzp.exe
  2⤵
  PID:14600
- C:\Windows\System\HNKRuPZ.exe
  C:\Windows\System\HNKRuPZ.exe
  2⤵
  PID:12852
- C:\Windows\System\kGPzMLk.exe
  C:\Windows\System\kGPzMLk.exe
  2⤵
  PID:15080
- C:\Windows\System\flqKcff.exe
  C:\Windows\System\flqKcff.exe
  2⤵
  PID:12200
- C:\Windows\System\gvCGify.exe
  C:\Windows\System\gvCGify.exe
  2⤵
  PID:13884
- C:\Windows\System\lagDRZV.exe
  C:\Windows\System\lagDRZV.exe
  2⤵
  PID:15372
- C:\Windows\System\DQGMXgt.exe
  C:\Windows\System\DQGMXgt.exe
  2⤵
  PID:15400
- C:\Windows\System\DMZgMmj.exe
  C:\Windows\System\DMZgMmj.exe
  2⤵
  PID:15420
- C:\Windows\System\kNfZrGv.exe
  C:\Windows\System\kNfZrGv.exe
  2⤵
  PID:15448
- C:\Windows\System\fAsZbmw.exe
  C:\Windows\System\fAsZbmw.exe
  2⤵
  PID:15472
- C:\Windows\System\rzdUyVv.exe
  C:\Windows\System\rzdUyVv.exe
  2⤵
  PID:15500
- C:\Windows\System\WQGjFAi.exe
  C:\Windows\System\WQGjFAi.exe
  2⤵
  PID:15524
- C:\Windows\System\fvoTIIA.exe
  C:\Windows\System\fvoTIIA.exe
  2⤵
  PID:15560
- C:\Windows\System\YLYzhpt.exe
  C:\Windows\System\YLYzhpt.exe
  2⤵
  PID:15592
- C:\Windows\System\ZACepjx.exe
  C:\Windows\System\ZACepjx.exe
  2⤵
  PID:15616
- C:\Windows\System\wVwAQiQ.exe
  C:\Windows\System\wVwAQiQ.exe
  2⤵
  PID:15640
- C:\Windows\System\GwiaKPG.exe
  C:\Windows\System\GwiaKPG.exe
  2⤵
  PID:15660
- C:\Windows\System\lMFJQxM.exe
  C:\Windows\System\lMFJQxM.exe
  2⤵
  PID:15676
- C:\Windows\System\CRoOeie.exe
  C:\Windows\System\CRoOeie.exe
  2⤵
  PID:15704
- C:\Windows\System\AQbfcbE.exe
  C:\Windows\System\AQbfcbE.exe
  2⤵
  PID:16112
- C:\Windows\System\SLLdznL.exe
  C:\Windows\System\SLLdznL.exe
  2⤵
  PID:16152
- C:\Windows\System\DilaIuQ.exe
  C:\Windows\System\DilaIuQ.exe
  2⤵
  PID:16188
- C:\Windows\System\sINXqFY.exe
  C:\Windows\System\sINXqFY.exe
  2⤵
  PID:16224
- C:\Windows\System\oXcVPKS.exe
  C:\Windows\System\oXcVPKS.exe
  2⤵
  PID:16260
- C:\Windows\System\bMPJfdP.exe
  C:\Windows\System\bMPJfdP.exe
  2⤵
  PID:16292
- C:\Windows\System\ORPnSNf.exe
  C:\Windows\System\ORPnSNf.exe
  2⤵
  PID:16332
- C:\Windows\System\VGokICO.exe
  C:\Windows\System\VGokICO.exe
  2⤵
  PID:16368
- C:\Windows\System\GImDCrV.exe
  C:\Windows\System\GImDCrV.exe
  2⤵
  PID:13996
- C:\Windows\System\uGaxiym.exe
  C:\Windows\System\uGaxiym.exe
  2⤵
  PID:15336
- C:\Windows\System\rgjEtRP.exe
  C:\Windows\System\rgjEtRP.exe
  2⤵
  PID:15060
- C:\Windows\System\TdXFieu.exe
  C:\Windows\System\TdXFieu.exe
  2⤵
  PID:14176
- C:\Windows\System\ZTdDdal.exe
  C:\Windows\System\ZTdDdal.exe
  2⤵
  PID:13344
- C:\Windows\System\ddHnSBs.exe
  C:\Windows\System\ddHnSBs.exe
  2⤵
  PID:15412
- C:\Windows\System\ZHahNnU.exe
  C:\Windows\System\ZHahNnU.exe
  2⤵
  PID:15432
- C:\Windows\System\XAJXxsb.exe
  C:\Windows\System\XAJXxsb.exe
  2⤵
  PID:15512
- C:\Windows\System\mxMirmB.exe
  C:\Windows\System\mxMirmB.exe
  2⤵
  PID:14656
- C:\Windows\System\eICJfWk.exe
  C:\Windows\System\eICJfWk.exe
  2⤵
  PID:15572
- C:\Windows\System\EnFblUc.exe
  C:\Windows\System\EnFblUc.exe
  2⤵
  PID:15624
- C:\Windows\System\BGtiQHH.exe
  C:\Windows\System\BGtiQHH.exe
  2⤵
  PID:14808
- C:\Windows\System\tovKjUc.exe
  C:\Windows\System\tovKjUc.exe
  2⤵
  PID:14872
- C:\Windows\System\fqzIUlk.exe
  C:\Windows\System\fqzIUlk.exe
  2⤵
  PID:15712
- C:\Windows\System\HLdpVyW.exe
  C:\Windows\System\HLdpVyW.exe
  2⤵
  PID:13368
- C:\Windows\System\ICabXYE.exe
  C:\Windows\System\ICabXYE.exe
  2⤵
  PID:13856
- C:\Windows\System\PvgAjqa.exe
  C:\Windows\System\PvgAjqa.exe
  2⤵
  PID:15896
- C:\Windows\System\MqmqyDK.exe
  C:\Windows\System\MqmqyDK.exe
  2⤵
  PID:14784
- C:\Windows\System\XRIjOve.exe
  C:\Windows\System\XRIjOve.exe
  2⤵
  PID:15464
- C:\Windows\System\qvUEiHP.exe
  C:\Windows\System\qvUEiHP.exe
  2⤵
  PID:15744
- C:\Windows\System\rFoiHRi.exe
  C:\Windows\System\rFoiHRi.exe
  2⤵
  PID:15852
- C:\Windows\System\YtlOWNI.exe
  C:\Windows\System\YtlOWNI.exe
  2⤵
  PID:15992
- C:\Windows\System\ZPsWWcQ.exe
  C:\Windows\System\ZPsWWcQ.exe
  2⤵
  PID:16024
- C:\Windows\System\FjgdEtZ.exe
  C:\Windows\System\FjgdEtZ.exe
  2⤵
  PID:16032
- C:\Windows\System\iioWnuk.exe
  C:\Windows\System\iioWnuk.exe
  2⤵
  PID:16304
- C:\Windows\System\nRoroex.exe
  C:\Windows\System\nRoroex.exe
  2⤵
  PID:13116
- C:\Windows\System\tAdZaJl.exe
  C:\Windows\System\tAdZaJl.exe
  2⤵
  PID:13904
- C:\Windows\System\IbWHGJD.exe
  C:\Windows\System\IbWHGJD.exe
  2⤵
  PID:14788
- C:\Windows\System\qbqLkgk.exe
  C:\Windows\System\qbqLkgk.exe
  2⤵
  PID:14772
- C:\Windows\System\tSeuAZi.exe
  C:\Windows\System\tSeuAZi.exe
  2⤵
  PID:16236
- C:\Windows\System\FMLFUIf.exe
  C:\Windows\System\FMLFUIf.exe
  2⤵
  PID:16280
- C:\Windows\System\vwomOXp.exe
  C:\Windows\System\vwomOXp.exe
  2⤵
  PID:14200
- C:\Windows\System\MYbhxgH.exe
  C:\Windows\System\MYbhxgH.exe
  2⤵
  PID:14824
- C:\Windows\System\zpdjZsY.exe
  C:\Windows\System\zpdjZsY.exe
  2⤵
  PID:15836
- C:\Windows\System\MYqpxHW.exe
  C:\Windows\System\MYqpxHW.exe
  2⤵
  PID:15668
- C:\Windows\System\uGmiBvI.exe
  C:\Windows\System\uGmiBvI.exe
  2⤵
  PID:13828
- C:\Windows\System\TMCtkhL.exe
  C:\Windows\System\TMCtkhL.exe
  2⤵
  PID:16012
- C:\Windows\System\NQhyESR.exe
  C:\Windows\System\NQhyESR.exe
  2⤵
  PID:16084
- C:\Windows\System\qxZLVtn.exe
  C:\Windows\System\qxZLVtn.exe
  2⤵
  PID:16408
- C:\Windows\System\uMdQGgq.exe
  C:\Windows\System\uMdQGgq.exe
  2⤵
  PID:16436
- C:\Windows\System\EelazUA.exe
  C:\Windows\System\EelazUA.exe
  2⤵
  PID:16452
- C:\Windows\System\oviJtqT.exe
  C:\Windows\System\oviJtqT.exe
  2⤵
  PID:16472
- C:\Windows\System\rUAcpFO.exe
  C:\Windows\System\rUAcpFO.exe
  2⤵
  PID:16488
- C:\Windows\System\XFyuKOl.exe
  C:\Windows\System\XFyuKOl.exe
  2⤵
  PID:16512
- C:\Windows\System\uyNYDeJ.exe
  C:\Windows\System\uyNYDeJ.exe
  2⤵
  PID:16528
- C:\Windows\System\mLzNFbZ.exe
  C:\Windows\System\mLzNFbZ.exe
  2⤵
  PID:16544
- C:\Windows\System\ZtlLawG.exe
  C:\Windows\System\ZtlLawG.exe
  2⤵
  PID:16576
- C:\Windows\System\musKuyk.exe
  C:\Windows\System\musKuyk.exe
  2⤵
  PID:16604
- C:\Windows\System\CfmAHfi.exe
  C:\Windows\System\CfmAHfi.exe
  2⤵
  PID:16636
- C:\Windows\System\iFIYDMm.exe
  C:\Windows\System\iFIYDMm.exe
  2⤵
  PID:16672
- C:\Windows\System\dYXEcsu.exe
  C:\Windows\System\dYXEcsu.exe
  2⤵
  PID:16692
- C:\Windows\System\DdzDbBf.exe
  C:\Windows\System\DdzDbBf.exe
  2⤵
  PID:16708
- C:\Windows\System\qXMtPlY.exe
  C:\Windows\System\qXMtPlY.exe
  2⤵
  PID:16732
- C:\Windows\System\ebpKnYT.exe
  C:\Windows\System\ebpKnYT.exe
  2⤵
  PID:16760
- C:\Windows\System\rnHovEF.exe
  C:\Windows\System\rnHovEF.exe
  2⤵
  PID:16784
- C:\Windows\System\ytsuvnp.exe
  C:\Windows\System\ytsuvnp.exe
  2⤵
  PID:16800
- C:\Windows\System\GeCWsny.exe
  C:\Windows\System\GeCWsny.exe
  2⤵
  PID:16832
- C:\Windows\System\nfsxkYZ.exe
  C:\Windows\System\nfsxkYZ.exe
  2⤵
  PID:16852
- C:\Windows\System\lGDXfPo.exe
  C:\Windows\System\lGDXfPo.exe
  2⤵
  PID:16884
- C:\Windows\System\ncULNFv.exe
  C:\Windows\System\ncULNFv.exe
  2⤵
  PID:16900
- C:\Windows\System\isUGffk.exe
  C:\Windows\System\isUGffk.exe
  2⤵
  PID:16928
- C:\Windows\System\ernUTem.exe
  C:\Windows\System\ernUTem.exe
  2⤵
  PID:16952
- C:\Windows\System\KQEOwnz.exe
  C:\Windows\System\KQEOwnz.exe
  2⤵
  PID:16980
- C:\Windows\System\poEIpNI.exe
  C:\Windows\System\poEIpNI.exe
  2⤵
  PID:16996
- C:\Windows\System\MOPprCb.exe
  C:\Windows\System\MOPprCb.exe
  2⤵
  PID:17024
- C:\Windows\System\HtrRnVi.exe
  C:\Windows\System\HtrRnVi.exe
  2⤵
  PID:17052
- C:\Windows\System\DrPcLvj.exe
  C:\Windows\System\DrPcLvj.exe
  2⤵
  PID:17088
- C:\Windows\System\DDZzCUm.exe
  C:\Windows\System\DDZzCUm.exe
  2⤵
  PID:17112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AShGUfT.exe

Filesize
1.4MB

MD5
7e811260147c4b1571ac0feaf8fbbad7

SHA1
a75c7318abd41f866e5f2ce74b81025610235c85

SHA256
4937d77494d2f8420c5737d15493d6f92251f6effb10224c21f3bf520a9cf80a

SHA512
4d845395f099462a2e60fa40c4bebf417afa3fc7eab1408afb84a14c62c53051b22703978e260342b62ca214397bf83cca1cf1552576299c1d42e1ba523c2609

Download Submit
C:\Windows\System\DMatOgW.exe

Filesize
1.4MB

MD5
b92efc56a07f4c309f5a4be74884682e

SHA1
8ca728d997fc952e58a561da1a715011ded1ecf3

SHA256
c6850518aca7a43dbfa9f9db2eeb0a4ad5e4c9b98356ac2b67145450801456e8

SHA512
8fba0852552a430c22a410aa3c5f97a9e9541a85e316ea5ab798400401a4c0b536deebe95bb478acd03ae5ed63db8772cbab84c62b2e94771ce2b62fbed709e9

Download Submit
C:\Windows\System\DcsCwdj.exe

Filesize
1.4MB

MD5
94a0b297577fc254f7a6de0b9c6aac94

SHA1
f7fd6dbfdd31c12c1eaadf22fc3439b28ff712a7

SHA256
bccc50596c898cb366bd7f1e1201966f70d4bc03cfdbb57afd3b27342bedcf9c

SHA512
8046256d6b7aada637b1d98ba45612ee0d68162257fbed8b28aa69cb480c2b148772f838b6edd7ad40e3b293ac6343738fbf16b2b010fb0077f50f8e299e15b6

Download Submit
C:\Windows\System\IGzSGti.exe

Filesize
1.4MB

MD5
3e21cc5882fd14f4851ec10789e0b218

SHA1
75e20955e2906b8788865c88e791e87f97ab6411

SHA256
bb352a1d893d6cbacdf3d76042d852b4015f9d579b09e3c30741adcb3d30d51a

SHA512
4abc799a8ead41431ef779be3da720c04d9b40d4fbe5ed87048f8745bceefc0dd8e0a7a2812648560fb749c37717b5e07eba8389daa27889d745d52bb2c8aea3

Download Submit
C:\Windows\System\NlwMFli.exe

Filesize
1.4MB

MD5
b48ac9f08539f0b162cfad565da859bd

SHA1
ddba642e7bf6c56cecaff3dc53cdbce425406741

SHA256
ca00c4de61cef91ad84b29c1e825ffc41c1e671ac028b21e369bcd7481050d7e

SHA512
1c5bdb9e0b50a1b708c8815e7ae964caf0a928545538a748568d7c959a5989307e3557424c66a97e88b69bfaf9ab3b53965137dbef97ae10ff3f7dbad7c69f52

Download Submit
C:\Windows\System\QdZXyLE.exe

Filesize
1.4MB

MD5
5b14abc72b251e4f6c9c53c3a37239a6

SHA1
9d6f2c23cb4cb280c3261704c81fb04f74fb2efe

SHA256
354da70fa9fd2b64070fb27d7fa31e7b85fc15b4534e12579f14477ec0c5a930

SHA512
8dae65461e47b28c6dfb6b3194ea1fe66bb79dcabae3058a50d2d3dbc500c329a414e20d098ac85f7e3d7e9a6a767beb4db436b69332b0c1a67c5fa3f1def95c

Download Submit
C:\Windows\System\QeTfrrY.exe

Filesize
1.4MB

MD5
8c7bdd663c5f8ae7d2df99367b785206

SHA1
71d66f4cd32df90c59d12cc90e13c41cfbc0d9a4

SHA256
6f508f3a76bc909eb291ed1b1cdd289066dc9a6a069267a509562a1a2c430c4b

SHA512
f9357def5c26de16fc184ae01bec423a7e8d15f4e2dac698f624af7de1e105b161308a3a10b71ab52069b538d7e26150185d1893bcd12ef16bca5a3956a3f61c

Download Submit
C:\Windows\System\RHcXqfx.exe

Filesize
1.4MB

MD5
f756db68ffbd9bb197db6aa01b1b7d80

SHA1
0ba25c8aa2d683d73a8bb02676c711f8e9d4e049

SHA256
da7da31003e1347533b156acfe8c0f38c70161e051898911830579bcdce5cc40

SHA512
acee759ba09c6900e48a61d25a96b9f0b54b4b195d00da6296f6f257995c28585d4c48bfe73c85727023cde38d0128e0dc23e753dc58c9edaeab50d28f5ad295

Download Submit
C:\Windows\System\SMDUlwO.exe

Filesize
1.4MB

MD5
ecd989a5d4429c6eb9107fcc87010633

SHA1
8652b73613ddd50892788802dee66571366d4ac2

SHA256
b1b053483bc437a54970bf227f966db42b772367eb194726175468df183f7e2d

SHA512
7d8d18151633cf0119409107904df5302cfb3356333535af240a9689675f412cc54c5cec637b0edb13ecfb39c8417cbf6f5a886c130947b349d1f469d9d3295f

Download Submit
C:\Windows\System\SWdlDft.exe

Filesize
1.4MB

MD5
aba8ba24fd330da58186a0e3a3070bfc

SHA1
77b075f6b9111f1f1d99b17cf332daeb066097cf

SHA256
d2bc98218fcdd3b5a9eadeadd2dca4b53b187340c8f5b705a8b3a0658fe77461

SHA512
c8bc7bc4393e89cde26539de61ebae4184a32362f5d64c253df47cc361483deff7d914a769e44ab213d0e98e7585b9c069fe80fcfb982201cf73a07ae8d24b8c

Download Submit
C:\Windows\System\UTqXQSw.exe

Filesize
1.4MB

MD5
5b958aab4e5c469252b5b1781499fc91

SHA1
4aabfdc77483c6d474fc627879d0045f1bc9fc22

SHA256
1ff2f1932df8e12d74289caff272165c3948b2f6525f29966c6ad3c76565114f

SHA512
edc9cfd74228c6f994957cb169a1d2acf206d039de2ede5d5d6889c72e39d1a544f7fa112ee39ec01e43047895cbe4747a0cc3de102d4466711717d9b3774db4

Download Submit
C:\Windows\System\VXuQLAG.exe

Filesize
1.4MB

MD5
e62674a089218e97b950f8454cc9c12d

SHA1
bcfdb3785fa7574adffa2006c0c53b3709476046

SHA256
6d63cbc503f3d5b15e7a93efa07b6ceb6b41e7df13cb0a691deae041f8b88227

SHA512
124ca8801611bd73cfafcf142b80028d1f3b784006a5c2db47be2ee4d4cfd43f8a1ebad424ad38d45a0ce2673c82d37ac9a006e06e79cd2c62967b293840f687

Download Submit
C:\Windows\System\WaZDQTW.exe

Filesize
1.4MB

MD5
aa88614913ed9e85685b85df18f72f79

SHA1
f855f928247f81254aefa9f9771a278e546f1b42

SHA256
0c47081018d5ca48b93aff89bb632f0d8f793dfabd4bd6f8b8e7512e2796803e

SHA512
4f795e4c30981687e441ed79da2205fa1c3001729971335603ebcb637e7ef0f26ec05567e1235acb217abcf947151e74fcb7a10c3c46b2a14b22844664d4d85d

Download Submit
C:\Windows\System\YaDdAbF.exe

Filesize
1.4MB

MD5
1ebb0f1436c6b19d27edb9370ae60453

SHA1
33b335984d12e9a5bf2310e654e0393810ad4abe

SHA256
4d3c0d1de88a6611e97ea2be8ac4dcce981f65ca1ad83e3a4950ce53d7451798

SHA512
3de7803b1fadcddd7d78cde20755e6efdc89f268ca784ecf5f16ad9d84566ac0e3188093fe7bfa04283f438859f791503a2aeef7e135183246ec7b006be9aec6

Download Submit
C:\Windows\System\aDdakQU.exe

Filesize
1.4MB

MD5
88551799c299cbd3e647293c6316acf2

SHA1
ff2332172fbb2bbb7b53e41a2c47bbb1d9c8e4d7

SHA256
14c7c9a0e1b4eddab5736f7233c3fea83890294cc6aa898e6f6520d4f3792313

SHA512
851d072a86f9c1840d7dedb89cb32ae5004ca80e8a6d60275e2bd120dd63cb7e4e28ae03c9eeb632e7efbb4dfc8cc365855ccdc3c5849de4d6dd6e883d66a6fb

Download Submit
C:\Windows\System\dMzGHjU.exe

Filesize
1.4MB

MD5
c1e4da7c1152faedddd29853d7ee0cbd

SHA1
1ab3e13544e1086e6660fecd5066311021884227

SHA256
5f27cf3742855366795e231500cd1dcb07d422951f10e9b28d50d5351f29f2af

SHA512
1554eb7290482c3f7e346bdca060c06b8a798e492da3aee928f622286107b9f9a7ac6f27317e92494b25387cd87825af9278966e944c9aaead32983060a45df0

Download Submit
C:\Windows\System\fUWuSax.exe

Filesize
1.4MB

MD5
8a683cf647e001250262e6db53ed60da

SHA1
6040711e021f905a68f29197e69bfe34448fa520

SHA256
9abb2ab460ba104220179795d77052c8093ed975e32622024d7c2037aa1ea30d

SHA512
bcf79633a05b850f5e68848457e65876bca0d581a9a5fc9982a24688ea3d100bd8c1e4e31d376b7eacff82569efa10a6cc8547dc57204e39ff82066e634ce31b

Download Submit
C:\Windows\System\faoHubS.exe

Filesize
1.4MB

MD5
6a272c5dbfc9d81ac63ae099caed8ecb

SHA1
a3e38f21766b6f3665e122114b7c92ab5f008717

SHA256
45e07b2ffe014e67f7d8ccc746de54050933d803cbb686e730763fbfb75d5892

SHA512
293a437d6c8806ef77b39b87869a88493d586c8a5154dab0fd3f87f74fd6b6ee04e33fd119a47750db44dbc4033afc751a46919ea935ede79b4ede42c1d2b52e

Download Submit
C:\Windows\System\fdLGfGx.exe

Filesize
1.4MB

MD5
34865dc8db77b09541f80fb7cdf05649

SHA1
72679474dc47736c23b37b385e0e2242c42c1fa3

SHA256
ed14dad9f980f6a6cf17e881ee908867c61fa2dbcb299b9357b6c43353547e69

SHA512
a46eb1752ae598d0bcc25db3d285d5f65f0e03b4d7ce8335c32540b6edb893be401a363175b00eab7be8cef105b51839e006a0759fe385b26634864fa6f6f09b

Download Submit
C:\Windows\System\gHInqjf.exe

Filesize
1.4MB

MD5
08aadf077bc2559465dd6a01758e2e4d

SHA1
1a2cc72ce9d1b7b50b723b3c6e6641c4645464db

SHA256
e87fa95806b1934858c115c02caab36d9258f2b861034a983ef922a842fc1fc4

SHA512
dd5151dd58f28ea2ef3e6e735ebe5829a42e69d95625c781681c835862fe3c6ce57155e6419b442b220b76449d11ad96ccfe69f0c300de262d52fcdbc700092d

Download Submit
C:\Windows\System\hhFTHAK.exe

Filesize
1.4MB

MD5
7bb9a0bf259b758e0c78cfb0a540edf0

SHA1
aeae7fdc82ca43fbd4cf0d4cbced1a03816cb7f6

SHA256
d6c476138e789bcb264164c3ef5f4d75fc56914a66b246700d6af48fa0496a19

SHA512
af221e8222c3cb30f1065f486c93beee37a75d37a6c68fec33aa75a0f6ffe1f34eec3f669a6540403f99d7c49446f478c9bcbbd67e707420f298dfa74cbec712

Download Submit
C:\Windows\System\jaYRzNQ.exe

Filesize
1.4MB

MD5
c2015ee93507f3a4621047c23c8caa81

SHA1
fa76b78ad09de41ca5ddd5b7563cf5f7821ddb54

SHA256
9b4a4c8811cbf5aae2a1af254525a2b509b13a590fcb3beecc19fd7f2a75697d

SHA512
b6f484f4a456661c3e960af9720d76e74677c9dc4eb09510804ae9462ad83c54f92d9248994296803b4d5d9d38230ad1af355a1aa2ab0862042c73cb3ee44f40

Download Submit
C:\Windows\System\kUbEaNW.exe

Filesize
1.4MB

MD5
46b9b2f359031f67c599b850d5000a6d

SHA1
9df67b84b714d715d7f96f067f575db333b9b3c1

SHA256
89f32a7460385f81560faea438a2391028fa190731c0a6a96c9ed693371c38ed

SHA512
8de1a3fc1a688fb5173128c4855e68eb4b8d3b9bc824e9cdcbc67430f9775cfea839470858ae39f04f1ac0a2d60b7c489c92ba24dfc1d8e17f5bddf50b9a53b8

Download Submit
C:\Windows\System\mImzGEY.exe

Filesize
1.4MB

MD5
140417e9aa6de53bef1ede362637335f

SHA1
db13082ee585acbd6958f577e41bd7a8e4307070

SHA256
5935729c2dd8c9d2f572b98441cb7c6861fe8bc30aee1dd16298b24d57c7a420

SHA512
0c4b499b99c52fd74ccc48b2127d5c751f2f9a61092f109ebf0b2c10c0f7f678c26fab1239587b7110bc655194528606a80d6e07e6a0795bd034f4360bb6c8b0

Download Submit
C:\Windows\System\oUqgzgj.exe

Filesize
1.4MB

MD5
6190e2d6a3cfb4a2c682ea3cfa441557

SHA1
e4e8aa272c685ff8fabcf622458608801aa57c39

SHA256
12caf44d038c4a125d8d4e80befb939b158c928659bc5a61327e14c45fb8626f

SHA512
a54d8c21d59003b0e11de12ee6a9c60d13ead95387e714eb43dfb789065f73b14da98fe5292f793f2a249db6decc35f01c998dd7c97763039b4c15ed293026a6

Download Submit
C:\Windows\System\swiSKth.exe

Filesize
1.4MB

MD5
f97c04a27f2e631ae18274158614aeb4

SHA1
d9281978c925f2e72358e8e6bb60370fadc9695f

SHA256
25c680415f65f02ef28f08e6a9f0672ffc44b206eca29a820ca6e834c2c2a513

SHA512
5bb9358891133de136099af727dac485048a33c2c40af8cb6ad1448608f5f59cf42f20c35d67b07717adc9c9c0ba28d35952d715c53708fc67a8267bb51c8239

Download Submit
C:\Windows\System\uTpwtfm.exe

Filesize
1.4MB

MD5
64349fe898af1fa9976dee9f860dced7

SHA1
b6479ba0cc6f90d496c6aa942061ddb40ab00680

SHA256
28e110ecedacd0d39d74d2a8d7e278d64b8d037d7dc55dedc89fabb70e2a9d34

SHA512
852c07160d479756a3faa9717d629b3d9c1aa2fc9015f9c1ab32a1f28f0d93f52a56cded7c5b6f4ca66b2222f4e006b0b81c81170e7ee200786577d81df14c56

Download Submit
C:\Windows\System\vFaoNcp.exe

Filesize
1.4MB

MD5
21d8a2f179ab8e3aff62005e0d1390dd

SHA1
75efa2a1500103c82f5cacf66ec28253bee67167

SHA256
5218a07202c02488aa9c0bf949895352fd2770e4b043ecb996798cd63f1a6180

SHA512
405b1802f1114eb1eb3505f0de3b5431f013134f9823498dbef7604f5721c69d4cae411e8e7c720b0ba089e5ab439f2f4b79a632ae8dd03ee78580d54771f7ee

Download Submit
C:\Windows\System\vTIFMcD.exe

Filesize
1.4MB

MD5
878b8d3978fb4a8d1a184bf79afaf002

SHA1
e18c94a28633ec561fedcd03a928c87eed87272e

SHA256
7981518976a15ab1cbd9f3fd08b04175d350b91a1ba5277de743c32376545094

SHA512
338fa91dd2fb498a782872d292d577e009c2d0d8601b57a5f3eb66af0620b349f384d3dcd59f35e7477ef1a88f822e38413f681af647c2a23b0dc4c451f37da7

Download Submit
C:\Windows\System\vpBFIft.exe

Filesize
1.4MB

MD5
d5d5c5c88006b03eddf37f439a545dae

SHA1
f70039fba1e10d0656057aadd5fc48233bc2f0ed

SHA256
1713803269d4dac0f2326975dd28c1dd5d739717f2ba668fd13093f807e0437f

SHA512
4df8536f8e0df8a4e645e809f8f91e36fe079cce0c594245c94c42c18e5ab12216887f2d3efe15dd02035ac7ebdda7bc94c194eb825c0143a0f719229d4e90f2

Download Submit
C:\Windows\System\yBiMLFh.exe

Filesize
1.4MB

MD5
608483a30d116dc3ccbd247b9faee754

SHA1
6310b306e5eae6de72aa9ee0679600ecab940fed

SHA256
1982c93b1dbb5f2cd10064952e3ea10e1e53a22223befc9ccccffb1a7d109e56

SHA512
f29318e42e0b05a4aed2262a39ad4d7fb1b594f27bdba6bc16e4838f72ad39fcab08f81b1143f01c5952aefe26a9c507675d6aa2babed0f62339a6d3d03446d4

Download Submit
C:\Windows\System\yDAxXZB.exe

Filesize
1.4MB

MD5
22d016802d30ba1bafa5d3003eb52645

SHA1
e7ca325ed4a825e8795dda1913694145e339f616

SHA256
d36027e2576c384dace9d3a4918f81a9018e922c58d474242ea88bcabe5b03c2

SHA512
efdd3423f4648352317d5bd30f0f2a8931fa5a1dab5745c2ef9ab5cb5b7235145640fe5163fa1ba6098386bbda121aedf215500e376d3bfd4e51c07e2c3e4914

Download Submit
C:\Windows\System\yxVTnFn.exe

Filesize
1.4MB

MD5
5b0cfc393b41e7348585fd279ba14298

SHA1
03efe4994a1ece634e11def7b416c6fb85c314c2

SHA256
0251c578b5b2a16e38026e92b1b04702a41e890ff288f7b6b6f814f5709ca47b

SHA512
114ffa19c10a8e2bb790d45c9fddc5899603618e330ecdd60f4264cf20b58ee4023396a11ecedd22034fd896af62ac5356d455a21c893bc8a78d69917fac2659

Download Submit
C:\Windows\System\yxnEynB.exe

Filesize
1.4MB

MD5
2a8bce46392331d2ee1cfb5c2e96bda5

SHA1
c4babbfbe56881a8dc8fc850769bb46241801789

SHA256
479fc4fd4b43b821f0edf41a02e06d36fedb14a076307177503926be0bc2bd8c

SHA512
328e992ebc8c6dd2df800c10ddb11fa0a2a8674c8b890781f240e6354d4a6405a58387799668fec78824179ddb63538f26936a344a15d949ac27ec347f35fe28

Download Submit
memory/1716-0-0x000001D458FD0000-0x000001D458FE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads