xmrig | 5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
Size 1.7MB
Sample250125-arvbsawncs
SHA256 5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12
MD5 1fd40b91427f7e676485689401c6f38a
SHA1 376c4456d1eb379512f3f8da4f952309ff3ab132
SHA512 11a3617ba4ea995927438492c9c3aa623a4da2b621837b2a64c39a6fd3c63ac47aad6e814d607ede727504bf2de884b3792e65d3b675eff9f8787bb7ad5fb91a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQX:GemTLkNdfE0pZyf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c91-4.dat	xmrig
behavioral2/files/0x0007000000023c95-9.dat	xmrig
behavioral2/files/0x0007000000023c96-12.dat	xmrig
behavioral2/files/0x0007000000023c97-20.dat	xmrig
behavioral2/files/0x0007000000023c98-25.dat	xmrig
behavioral2/files/0x0007000000023c99-33.dat	xmrig
behavioral2/files/0x0007000000023c9b-39.dat	xmrig
behavioral2/files/0x0007000000023c9c-47.dat	xmrig
behavioral2/files/0x0008000000023c9f-59.dat	xmrig
behavioral2/files/0x0007000000023ca2-67.dat	xmrig
behavioral2/files/0x0007000000023ca4-83.dat	xmrig
behavioral2/files/0x0007000000023ca7-97.dat	xmrig
behavioral2/files/0x0007000000023cac-119.dat	xmrig
behavioral2/files/0x0007000000023cb0-139.dat	xmrig
behavioral2/files/0x0007000000023cb5-162.dat	xmrig
behavioral2/files/0x0007000000023cb4-159.dat	xmrig
behavioral2/files/0x0007000000023cb3-157.dat	xmrig
behavioral2/files/0x0007000000023cb2-153.dat	xmrig
behavioral2/files/0x0007000000023cb1-147.dat	xmrig
behavioral2/files/0x0007000000023caf-137.dat	xmrig
behavioral2/files/0x0007000000023cae-133.dat	xmrig
behavioral2/files/0x0007000000023cad-127.dat	xmrig
behavioral2/files/0x0007000000023cab-117.dat	xmrig
behavioral2/files/0x0007000000023caa-113.dat	xmrig
behavioral2/files/0x0007000000023ca9-107.dat	xmrig
behavioral2/files/0x0007000000023ca8-103.dat	xmrig
behavioral2/files/0x0007000000023ca6-93.dat	xmrig
behavioral2/files/0x0007000000023ca5-87.dat	xmrig
behavioral2/files/0x0007000000023ca3-77.dat	xmrig
behavioral2/files/0x0007000000023ca0-68.dat	xmrig
behavioral2/files/0x0007000000023c9e-57.dat	xmrig
behavioral2/files/0x0007000000023c9d-53.dat	xmrig
behavioral2/files/0x0007000000023c9a-37.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1192	UXOxHDI.exe
2216	sbrJVPH.exe
316	hHfBcOp.exe
1548	lFlFTDp.exe
3404	MSKRcGn.exe
3868	yHGJrFd.exe
1388	ZyiniFJ.exe
1140	PUmcPJS.exe
2128	JjHjJGl.exe
5096	dyMiWwy.exe
2308	xbJxGeQ.exe
2100	ScQCysH.exe
3896	NEixvVx.exe
2808	PsWJayb.exe
4464	XTEOKHT.exe
3420	VFFHhYl.exe
2248	LVUrKVz.exe
4484	uuPNLch.exe
2408	esNlcZb.exe
3988	cDngDAR.exe
2332	aaXjhzW.exe
3888	FwxiWog.exe
2312	tKkgaYH.exe
3320	NvfeNCw.exe
988	nMZRTLW.exe
264	zIfPECh.exe
1144	JZjFZRi.exe
2780	CBeWpOT.exe
1888	DETpPqW.exe
4944	rcgAKcv.exe
3596	vEBDFTv.exe
332	mOyRBmc.exe
628	hljLGAD.exe
656	NCMUpfk.exe
2948	agzPMJY.exe
2072	trmkLds.exe
956	YdfzExN.exe
640	XuSoCna.exe
2744	NwrDeKU.exe
2168	FbdRcMR.exe
1724	vISGKwJ.exe
3308	gVXUqNz.exe
4792	cvZlKaB.exe
4568	MjltjdS.exe
4148	mGaeFmF.exe
2024	lUeKOyh.exe
4040	mjsAZyS.exe
1084	SQijbPQ.exe
2812	OtFcQvP.exe
4140	OxxTZIk.exe
4204	qzgzrAB.exe
4584	HktnCcS.exe
1240	ccONaLv.exe
2856	uNNPITa.exe
2644	lduNFws.exe
3960	BsQiwMH.exe
5056	HgqIVfK.exe
2032	iEdhHvT.exe
4904	BCcGJmx.exe
1328	CvitXAS.exe
2356	ZHtOTCk.exe
5000	xRdWYcX.exe
2088	lmywfvX.exe
4184	RnwiYBO.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cdmoNrH.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\oSaUlfs.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\CDJFowV.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\WmyOakb.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\FAiskdO.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\ojwcZSw.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\iCAaQrD.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\dnriOsw.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\jqZadkQ.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\oHBLKkP.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\JALMmLm.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\juybhob.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\FudpIWU.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\puqnBtU.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\ihwVplZ.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\XofXzny.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\wrvLxwt.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\agzPMJY.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\XYDsjWE.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\fXTpsqY.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\ZysSskg.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\trmkLds.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\VLJGUsv.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\gxCQYfT.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\ygAMUWc.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\HiQprnv.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\dTWZohQ.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\JZjFZRi.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\vdZlxtl.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\obFfXTd.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\nfMFEfQ.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\LrkSNjy.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\ftOquEa.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\AHcVVwo.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\BacXret.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\FCHhFmt.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\rDUiwpJ.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\JjfhhQI.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\OsnRtUV.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\IRSocTv.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\APJxHeX.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\qYFwGKa.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\wIPjzbv.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\LIpQBtR.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\gFqllMf.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\LTbOOZg.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\ntxgxHX.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\wsnnsvp.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\deEhiPw.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\TRoRRwK.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\OGpWeTM.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\fevozez.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\QfhTMoa.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\mCJVGdi.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\LVUrKVz.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\WiPzFXI.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\rcgAKcv.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\fpLyrAw.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\kJfhugE.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\upNyqTV.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\kXIsaAs.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\rfAmeWW.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\IDeQvvj.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
File created	C:\Windows\System\PZLJQnW.exe	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1192	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	84
PID 1884 wrote to memory of 1192	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	84
PID 1884 wrote to memory of 2216	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	85
PID 1884 wrote to memory of 2216	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	85
PID 1884 wrote to memory of 316	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	86
PID 1884 wrote to memory of 316	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	86
PID 1884 wrote to memory of 1548	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	87
PID 1884 wrote to memory of 1548	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	87
PID 1884 wrote to memory of 3404	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	88
PID 1884 wrote to memory of 3404	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	88
PID 1884 wrote to memory of 3868	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	89
PID 1884 wrote to memory of 3868	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	89
PID 1884 wrote to memory of 1388	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	90
PID 1884 wrote to memory of 1388	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	90
PID 1884 wrote to memory of 1140	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	91
PID 1884 wrote to memory of 1140	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	91
PID 1884 wrote to memory of 2128	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	92
PID 1884 wrote to memory of 2128	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	92
PID 1884 wrote to memory of 5096	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	93
PID 1884 wrote to memory of 5096	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	93
PID 1884 wrote to memory of 2308	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	94
PID 1884 wrote to memory of 2308	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	94
PID 1884 wrote to memory of 2100	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	95
PID 1884 wrote to memory of 2100	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	95
PID 1884 wrote to memory of 3896	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	96
PID 1884 wrote to memory of 3896	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	96
PID 1884 wrote to memory of 2808	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	97
PID 1884 wrote to memory of 2808	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	97
PID 1884 wrote to memory of 4464	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	98
PID 1884 wrote to memory of 4464	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	98
PID 1884 wrote to memory of 3420	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	99
PID 1884 wrote to memory of 3420	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	99
PID 1884 wrote to memory of 2248	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	100
PID 1884 wrote to memory of 2248	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	100
PID 1884 wrote to memory of 4484	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	101
PID 1884 wrote to memory of 4484	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	101
PID 1884 wrote to memory of 2408	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	102
PID 1884 wrote to memory of 2408	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	102
PID 1884 wrote to memory of 3988	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	103
PID 1884 wrote to memory of 3988	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	103
PID 1884 wrote to memory of 2332	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	104
PID 1884 wrote to memory of 2332	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	104
PID 1884 wrote to memory of 3888	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	105
PID 1884 wrote to memory of 3888	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	105
PID 1884 wrote to memory of 2312	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	106
PID 1884 wrote to memory of 2312	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	106
PID 1884 wrote to memory of 3320	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	107
PID 1884 wrote to memory of 3320	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	107
PID 1884 wrote to memory of 988	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	108
PID 1884 wrote to memory of 988	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	108
PID 1884 wrote to memory of 264	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	109
PID 1884 wrote to memory of 264	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	109
PID 1884 wrote to memory of 1144	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	110
PID 1884 wrote to memory of 1144	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	110
PID 1884 wrote to memory of 2780	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	111
PID 1884 wrote to memory of 2780	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	111
PID 1884 wrote to memory of 1888	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	112
PID 1884 wrote to memory of 1888	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	112
PID 1884 wrote to memory of 4944	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	113
PID 1884 wrote to memory of 4944	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	113
PID 1884 wrote to memory of 3596	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	114
PID 1884 wrote to memory of 3596	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	114
PID 1884 wrote to memory of 332	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	115
PID 1884 wrote to memory of 332	1884	5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe	115

C:\Users\Admin\AppData\Local\Temp\5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe
"C:\Users\Admin\AppData\Local\Temp\5f49f0eabc238a5e184e451f0e71f9e96e9a8b72c39c7496ae31f0a2b7eecb12.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\System\UXOxHDI.exe
  C:\Windows\System\UXOxHDI.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\sbrJVPH.exe
  C:\Windows\System\sbrJVPH.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\hHfBcOp.exe
  C:\Windows\System\hHfBcOp.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\lFlFTDp.exe
  C:\Windows\System\lFlFTDp.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\MSKRcGn.exe
  C:\Windows\System\MSKRcGn.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\yHGJrFd.exe
  C:\Windows\System\yHGJrFd.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\ZyiniFJ.exe
  C:\Windows\System\ZyiniFJ.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\PUmcPJS.exe
  C:\Windows\System\PUmcPJS.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\JjHjJGl.exe
  C:\Windows\System\JjHjJGl.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\dyMiWwy.exe
  C:\Windows\System\dyMiWwy.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\xbJxGeQ.exe
  C:\Windows\System\xbJxGeQ.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\ScQCysH.exe
  C:\Windows\System\ScQCysH.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\NEixvVx.exe
  C:\Windows\System\NEixvVx.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\PsWJayb.exe
  C:\Windows\System\PsWJayb.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\XTEOKHT.exe
  C:\Windows\System\XTEOKHT.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\VFFHhYl.exe
  C:\Windows\System\VFFHhYl.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\LVUrKVz.exe
  C:\Windows\System\LVUrKVz.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\uuPNLch.exe
  C:\Windows\System\uuPNLch.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\esNlcZb.exe
  C:\Windows\System\esNlcZb.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\cDngDAR.exe
  C:\Windows\System\cDngDAR.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\aaXjhzW.exe
  C:\Windows\System\aaXjhzW.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\FwxiWog.exe
  C:\Windows\System\FwxiWog.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\tKkgaYH.exe
  C:\Windows\System\tKkgaYH.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\NvfeNCw.exe
  C:\Windows\System\NvfeNCw.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\nMZRTLW.exe
  C:\Windows\System\nMZRTLW.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\zIfPECh.exe
  C:\Windows\System\zIfPECh.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\JZjFZRi.exe
  C:\Windows\System\JZjFZRi.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\CBeWpOT.exe
  C:\Windows\System\CBeWpOT.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\DETpPqW.exe
  C:\Windows\System\DETpPqW.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\rcgAKcv.exe
  C:\Windows\System\rcgAKcv.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\vEBDFTv.exe
  C:\Windows\System\vEBDFTv.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\mOyRBmc.exe
  C:\Windows\System\mOyRBmc.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\hljLGAD.exe
  C:\Windows\System\hljLGAD.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\NCMUpfk.exe
  C:\Windows\System\NCMUpfk.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\agzPMJY.exe
  C:\Windows\System\agzPMJY.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\trmkLds.exe
  C:\Windows\System\trmkLds.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\YdfzExN.exe
  C:\Windows\System\YdfzExN.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\XuSoCna.exe
  C:\Windows\System\XuSoCna.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\NwrDeKU.exe
  C:\Windows\System\NwrDeKU.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\FbdRcMR.exe
  C:\Windows\System\FbdRcMR.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\vISGKwJ.exe
  C:\Windows\System\vISGKwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\gVXUqNz.exe
  C:\Windows\System\gVXUqNz.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\cvZlKaB.exe
  C:\Windows\System\cvZlKaB.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\MjltjdS.exe
  C:\Windows\System\MjltjdS.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\mGaeFmF.exe
  C:\Windows\System\mGaeFmF.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\lUeKOyh.exe
  C:\Windows\System\lUeKOyh.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\mjsAZyS.exe
  C:\Windows\System\mjsAZyS.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\SQijbPQ.exe
  C:\Windows\System\SQijbPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\OtFcQvP.exe
  C:\Windows\System\OtFcQvP.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\OxxTZIk.exe
  C:\Windows\System\OxxTZIk.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\qzgzrAB.exe
  C:\Windows\System\qzgzrAB.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\HktnCcS.exe
  C:\Windows\System\HktnCcS.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\ccONaLv.exe
  C:\Windows\System\ccONaLv.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\uNNPITa.exe
  C:\Windows\System\uNNPITa.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\lduNFws.exe
  C:\Windows\System\lduNFws.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\BsQiwMH.exe
  C:\Windows\System\BsQiwMH.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\HgqIVfK.exe
  C:\Windows\System\HgqIVfK.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\iEdhHvT.exe
  C:\Windows\System\iEdhHvT.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\BCcGJmx.exe
  C:\Windows\System\BCcGJmx.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\CvitXAS.exe
  C:\Windows\System\CvitXAS.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\ZHtOTCk.exe
  C:\Windows\System\ZHtOTCk.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\xRdWYcX.exe
  C:\Windows\System\xRdWYcX.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\lmywfvX.exe
  C:\Windows\System\lmywfvX.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\RnwiYBO.exe
  C:\Windows\System\RnwiYBO.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\QFugYUS.exe
  C:\Windows\System\QFugYUS.exe
  2⤵
  PID:3676
- C:\Windows\System\AfcLawD.exe
  C:\Windows\System\AfcLawD.exe
  2⤵
  PID:2800
- C:\Windows\System\NwUBZDF.exe
  C:\Windows\System\NwUBZDF.exe
  2⤵
  PID:4700
- C:\Windows\System\oWZOYWm.exe
  C:\Windows\System\oWZOYWm.exe
  2⤵
  PID:1404
- C:\Windows\System\BacXret.exe
  C:\Windows\System\BacXret.exe
  2⤵
  PID:2816
- C:\Windows\System\nLrlCEv.exe
  C:\Windows\System\nLrlCEv.exe
  2⤵
  PID:3980
- C:\Windows\System\vsNMULy.exe
  C:\Windows\System\vsNMULy.exe
  2⤵
  PID:1216
- C:\Windows\System\aHvzoxN.exe
  C:\Windows\System\aHvzoxN.exe
  2⤵
  PID:892
- C:\Windows\System\KhWdVmy.exe
  C:\Windows\System\KhWdVmy.exe
  2⤵
  PID:4852
- C:\Windows\System\FAqDWqM.exe
  C:\Windows\System\FAqDWqM.exe
  2⤵
  PID:2748
- C:\Windows\System\csNNSBJ.exe
  C:\Windows\System\csNNSBJ.exe
  2⤵
  PID:3936
- C:\Windows\System\MfnLpHw.exe
  C:\Windows\System\MfnLpHw.exe
  2⤵
  PID:1436
- C:\Windows\System\QLziguL.exe
  C:\Windows\System\QLziguL.exe
  2⤵
  PID:2272
- C:\Windows\System\QvcLIrQ.exe
  C:\Windows\System\QvcLIrQ.exe
  2⤵
  PID:2516
- C:\Windows\System\frYYcyn.exe
  C:\Windows\System\frYYcyn.exe
  2⤵
  PID:4480
- C:\Windows\System\dCcZLVv.exe
  C:\Windows\System\dCcZLVv.exe
  2⤵
  PID:4128
- C:\Windows\System\XSGKWua.exe
  C:\Windows\System\XSGKWua.exe
  2⤵
  PID:3904
- C:\Windows\System\RldwtNp.exe
  C:\Windows\System\RldwtNp.exe
  2⤵
  PID:4988
- C:\Windows\System\LrBQdIU.exe
  C:\Windows\System\LrBQdIU.exe
  2⤵
  PID:2664
- C:\Windows\System\hSkLEdt.exe
  C:\Windows\System\hSkLEdt.exe
  2⤵
  PID:4352
- C:\Windows\System\UllkRyP.exe
  C:\Windows\System\UllkRyP.exe
  2⤵
  PID:4196
- C:\Windows\System\LrkSNjy.exe
  C:\Windows\System\LrkSNjy.exe
  2⤵
  PID:3504
- C:\Windows\System\wIPjzbv.exe
  C:\Windows\System\wIPjzbv.exe
  2⤵
  PID:4552
- C:\Windows\System\ziJusGz.exe
  C:\Windows\System\ziJusGz.exe
  2⤵
  PID:4124
- C:\Windows\System\pybQvQC.exe
  C:\Windows\System\pybQvQC.exe
  2⤵
  PID:5128
- C:\Windows\System\qSOiqtf.exe
  C:\Windows\System\qSOiqtf.exe
  2⤵
  PID:5156
- C:\Windows\System\IDeQvvj.exe
  C:\Windows\System\IDeQvvj.exe
  2⤵
  PID:5184
- C:\Windows\System\ydQxkOO.exe
  C:\Windows\System\ydQxkOO.exe
  2⤵
  PID:5212
- C:\Windows\System\oCdMBrg.exe
  C:\Windows\System\oCdMBrg.exe
  2⤵
  PID:5240
- C:\Windows\System\RvejbGi.exe
  C:\Windows\System\RvejbGi.exe
  2⤵
  PID:5304
- C:\Windows\System\vLwVTZj.exe
  C:\Windows\System\vLwVTZj.exe
  2⤵
  PID:5320
- C:\Windows\System\QaJTvax.exe
  C:\Windows\System\QaJTvax.exe
  2⤵
  PID:5336
- C:\Windows\System\QLyIPTI.exe
  C:\Windows\System\QLyIPTI.exe
  2⤵
  PID:5352
- C:\Windows\System\pKpBbTZ.exe
  C:\Windows\System\pKpBbTZ.exe
  2⤵
  PID:5368
- C:\Windows\System\CDkKuxd.exe
  C:\Windows\System\CDkKuxd.exe
  2⤵
  PID:5384
- C:\Windows\System\qEFwbix.exe
  C:\Windows\System\qEFwbix.exe
  2⤵
  PID:5400
- C:\Windows\System\XATSygX.exe
  C:\Windows\System\XATSygX.exe
  2⤵
  PID:5416
- C:\Windows\System\DupTdQb.exe
  C:\Windows\System\DupTdQb.exe
  2⤵
  PID:5432
- C:\Windows\System\DNvUNbT.exe
  C:\Windows\System\DNvUNbT.exe
  2⤵
  PID:5448
- C:\Windows\System\QcCcTzO.exe
  C:\Windows\System\QcCcTzO.exe
  2⤵
  PID:5464
- C:\Windows\System\sNyYTjp.exe
  C:\Windows\System\sNyYTjp.exe
  2⤵
  PID:5480
- C:\Windows\System\pKqXUng.exe
  C:\Windows\System\pKqXUng.exe
  2⤵
  PID:5496
- C:\Windows\System\ULMvwDl.exe
  C:\Windows\System\ULMvwDl.exe
  2⤵
  PID:5512
- C:\Windows\System\LJdjQLh.exe
  C:\Windows\System\LJdjQLh.exe
  2⤵
  PID:5528
- C:\Windows\System\YOvbOJo.exe
  C:\Windows\System\YOvbOJo.exe
  2⤵
  PID:5544
- C:\Windows\System\zRloRPA.exe
  C:\Windows\System\zRloRPA.exe
  2⤵
  PID:5560
- C:\Windows\System\EokJfiy.exe
  C:\Windows\System\EokJfiy.exe
  2⤵
  PID:5576
- C:\Windows\System\fxPLDjl.exe
  C:\Windows\System\fxPLDjl.exe
  2⤵
  PID:5592
- C:\Windows\System\WGzNHJm.exe
  C:\Windows\System\WGzNHJm.exe
  2⤵
  PID:5608
- C:\Windows\System\NhvSkzZ.exe
  C:\Windows\System\NhvSkzZ.exe
  2⤵
  PID:5624
- C:\Windows\System\TLwKBan.exe
  C:\Windows\System\TLwKBan.exe
  2⤵
  PID:5640
- C:\Windows\System\DbVBPnO.exe
  C:\Windows\System\DbVBPnO.exe
  2⤵
  PID:5656
- C:\Windows\System\UxZZZRj.exe
  C:\Windows\System\UxZZZRj.exe
  2⤵
  PID:5672
- C:\Windows\System\mRzDJHo.exe
  C:\Windows\System\mRzDJHo.exe
  2⤵
  PID:5688
- C:\Windows\System\sCalYCC.exe
  C:\Windows\System\sCalYCC.exe
  2⤵
  PID:5704
- C:\Windows\System\qoKesfy.exe
  C:\Windows\System\qoKesfy.exe
  2⤵
  PID:5720
- C:\Windows\System\BYRUNiA.exe
  C:\Windows\System\BYRUNiA.exe
  2⤵
  PID:5736
- C:\Windows\System\DuWWIKt.exe
  C:\Windows\System\DuWWIKt.exe
  2⤵
  PID:5752
- C:\Windows\System\pnFGeDd.exe
  C:\Windows\System\pnFGeDd.exe
  2⤵
  PID:5768
- C:\Windows\System\mlFtgom.exe
  C:\Windows\System\mlFtgom.exe
  2⤵
  PID:5784
- C:\Windows\System\SnDcSxP.exe
  C:\Windows\System\SnDcSxP.exe
  2⤵
  PID:5800
- C:\Windows\System\zqgXjdU.exe
  C:\Windows\System\zqgXjdU.exe
  2⤵
  PID:5816
- C:\Windows\System\cWMFYjE.exe
  C:\Windows\System\cWMFYjE.exe
  2⤵
  PID:5832
- C:\Windows\System\EfYuJBO.exe
  C:\Windows\System\EfYuJBO.exe
  2⤵
  PID:5848
- C:\Windows\System\GjAYvUj.exe
  C:\Windows\System\GjAYvUj.exe
  2⤵
  PID:5864
- C:\Windows\System\ApJohVq.exe
  C:\Windows\System\ApJohVq.exe
  2⤵
  PID:5880
- C:\Windows\System\BklkMdn.exe
  C:\Windows\System\BklkMdn.exe
  2⤵
  PID:5896
- C:\Windows\System\YEvZIUk.exe
  C:\Windows\System\YEvZIUk.exe
  2⤵
  PID:5912
- C:\Windows\System\FAiskdO.exe
  C:\Windows\System\FAiskdO.exe
  2⤵
  PID:5928
- C:\Windows\System\LjxzNWk.exe
  C:\Windows\System\LjxzNWk.exe
  2⤵
  PID:5944
- C:\Windows\System\dGazYAo.exe
  C:\Windows\System\dGazYAo.exe
  2⤵
  PID:5636
- C:\Windows\System\xiIKHmf.exe
  C:\Windows\System\xiIKHmf.exe
  2⤵
  PID:5572
- C:\Windows\System\PTXQfII.exe
  C:\Windows\System\PTXQfII.exe
  2⤵
  PID:5520
- C:\Windows\System\wEPsjtA.exe
  C:\Windows\System\wEPsjtA.exe
  2⤵
  PID:5444
- C:\Windows\System\aomBaKD.exe
  C:\Windows\System\aomBaKD.exe
  2⤵
  PID:5380
- C:\Windows\System\rDUiwpJ.exe
  C:\Windows\System\rDUiwpJ.exe
  2⤵
  PID:5312
- C:\Windows\System\yknbefQ.exe
  C:\Windows\System\yknbefQ.exe
  2⤵
  PID:5744
- C:\Windows\System\ubpSRKV.exe
  C:\Windows\System\ubpSRKV.exe
  2⤵
  PID:5792
- C:\Windows\System\bUGvifz.exe
  C:\Windows\System\bUGvifz.exe
  2⤵
  PID:5860
- C:\Windows\System\oHLeZCX.exe
  C:\Windows\System\oHLeZCX.exe
  2⤵
  PID:5924
- C:\Windows\System\hbXaQhA.exe
  C:\Windows\System\hbXaQhA.exe
  2⤵
  PID:5992
- C:\Windows\System\EHMOZfv.exe
  C:\Windows\System\EHMOZfv.exe
  2⤵
  PID:6064
- C:\Windows\System\TgFmPVP.exe
  C:\Windows\System\TgFmPVP.exe
  2⤵
  PID:6108
- C:\Windows\System\TtasNNN.exe
  C:\Windows\System\TtasNNN.exe
  2⤵
  PID:4444
- C:\Windows\System\menyuVW.exe
  C:\Windows\System\menyuVW.exe
  2⤵
  PID:2876
- C:\Windows\System\nCysyoR.exe
  C:\Windows\System\nCysyoR.exe
  2⤵
  PID:5476
- C:\Windows\System\kyIfflW.exe
  C:\Windows\System\kyIfflW.exe
  2⤵
  PID:5344
- C:\Windows\System\IAmuIHI.exe
  C:\Windows\System\IAmuIHI.exe
  2⤵
  PID:4996
- C:\Windows\System\zYctNDN.exe
  C:\Windows\System\zYctNDN.exe
  2⤵
  PID:5648
- C:\Windows\System\lAOxlBk.exe
  C:\Windows\System\lAOxlBk.exe
  2⤵
  PID:2736
- C:\Windows\System\KrBpesX.exe
  C:\Windows\System\KrBpesX.exe
  2⤵
  PID:5080
- C:\Windows\System\qMtZLRQ.exe
  C:\Windows\System\qMtZLRQ.exe
  2⤵
  PID:3264
- C:\Windows\System\wjixwEI.exe
  C:\Windows\System\wjixwEI.exe
  2⤵
  PID:1416
- C:\Windows\System\cDqIAGl.exe
  C:\Windows\System\cDqIAGl.exe
  2⤵
  PID:4228
- C:\Windows\System\cHZBbXI.exe
  C:\Windows\System\cHZBbXI.exe
  2⤵
  PID:5764
- C:\Windows\System\JpXUeuM.exe
  C:\Windows\System\JpXUeuM.exe
  2⤵
  PID:5888
- C:\Windows\System\EVjHewh.exe
  C:\Windows\System\EVjHewh.exe
  2⤵
  PID:5092
- C:\Windows\System\JiqrqPB.exe
  C:\Windows\System\JiqrqPB.exe
  2⤵
  PID:1424
- C:\Windows\System\FEaNmpc.exe
  C:\Windows\System\FEaNmpc.exe
  2⤵
  PID:3760
- C:\Windows\System\oOPlmtm.exe
  C:\Windows\System\oOPlmtm.exe
  2⤵
  PID:6076
- C:\Windows\System\VqbFxBe.exe
  C:\Windows\System\VqbFxBe.exe
  2⤵
  PID:3004
- C:\Windows\System\lnbTvPl.exe
  C:\Windows\System\lnbTvPl.exe
  2⤵
  PID:1828
- C:\Windows\System\yBtAYnz.exe
  C:\Windows\System\yBtAYnz.exe
  2⤵
  PID:5360
- C:\Windows\System\ugPDGOE.exe
  C:\Windows\System\ugPDGOE.exe
  2⤵
  PID:1228
- C:\Windows\System\mRctHJo.exe
  C:\Windows\System\mRctHJo.exe
  2⤵
  PID:5680
- C:\Windows\System\SCCRsaH.exe
  C:\Windows\System\SCCRsaH.exe
  2⤵
  PID:5060
- C:\Windows\System\IHPJjTz.exe
  C:\Windows\System\IHPJjTz.exe
  2⤵
  PID:4056
- C:\Windows\System\mGzLYRU.exe
  C:\Windows\System\mGzLYRU.exe
  2⤵
  PID:5808
- C:\Windows\System\ddLjloe.exe
  C:\Windows\System\ddLjloe.exe
  2⤵
  PID:1164
- C:\Windows\System\VvbFnRn.exe
  C:\Windows\System\VvbFnRn.exe
  2⤵
  PID:4592
- C:\Windows\System\XZBzYpK.exe
  C:\Windows\System\XZBzYpK.exe
  2⤵
  PID:5524
- C:\Windows\System\sMIqllV.exe
  C:\Windows\System\sMIqllV.exe
  2⤵
  PID:4012
- C:\Windows\System\yceNhyM.exe
  C:\Windows\System\yceNhyM.exe
  2⤵
  PID:896
- C:\Windows\System\XMGwBfZ.exe
  C:\Windows\System\XMGwBfZ.exe
  2⤵
  PID:4868
- C:\Windows\System\rqBocZk.exe
  C:\Windows\System\rqBocZk.exe
  2⤵
  PID:6164
- C:\Windows\System\gKvZjYG.exe
  C:\Windows\System\gKvZjYG.exe
  2⤵
  PID:6192
- C:\Windows\System\HZhjFFt.exe
  C:\Windows\System\HZhjFFt.exe
  2⤵
  PID:6208
- C:\Windows\System\QkQguqb.exe
  C:\Windows\System\QkQguqb.exe
  2⤵
  PID:6228
- C:\Windows\System\deEhiPw.exe
  C:\Windows\System\deEhiPw.exe
  2⤵
  PID:6244
- C:\Windows\System\fXTpsqY.exe
  C:\Windows\System\fXTpsqY.exe
  2⤵
  PID:6272
- C:\Windows\System\wRfhiJy.exe
  C:\Windows\System\wRfhiJy.exe
  2⤵
  PID:6332
- C:\Windows\System\vLMDGeV.exe
  C:\Windows\System\vLMDGeV.exe
  2⤵
  PID:6360
- C:\Windows\System\xPyyfVs.exe
  C:\Windows\System\xPyyfVs.exe
  2⤵
  PID:6388
- C:\Windows\System\TnniUan.exe
  C:\Windows\System\TnniUan.exe
  2⤵
  PID:6416
- C:\Windows\System\ihwVplZ.exe
  C:\Windows\System\ihwVplZ.exe
  2⤵
  PID:6444
- C:\Windows\System\LIpQBtR.exe
  C:\Windows\System\LIpQBtR.exe
  2⤵
  PID:6472
- C:\Windows\System\riQckhx.exe
  C:\Windows\System\riQckhx.exe
  2⤵
  PID:6500
- C:\Windows\System\iRZZfNM.exe
  C:\Windows\System\iRZZfNM.exe
  2⤵
  PID:6528
- C:\Windows\System\ceYiuSA.exe
  C:\Windows\System\ceYiuSA.exe
  2⤵
  PID:6560
- C:\Windows\System\PZLJQnW.exe
  C:\Windows\System\PZLJQnW.exe
  2⤵
  PID:6592
- C:\Windows\System\gvKvkIv.exe
  C:\Windows\System\gvKvkIv.exe
  2⤵
  PID:6620
- C:\Windows\System\dmQdftN.exe
  C:\Windows\System\dmQdftN.exe
  2⤵
  PID:6648
- C:\Windows\System\htLJaqY.exe
  C:\Windows\System\htLJaqY.exe
  2⤵
  PID:6676
- C:\Windows\System\TQyCqja.exe
  C:\Windows\System\TQyCqja.exe
  2⤵
  PID:6704
- C:\Windows\System\dRJfIsi.exe
  C:\Windows\System\dRJfIsi.exe
  2⤵
  PID:6732
- C:\Windows\System\qyxBPPu.exe
  C:\Windows\System\qyxBPPu.exe
  2⤵
  PID:6760
- C:\Windows\System\mDfVVBO.exe
  C:\Windows\System\mDfVVBO.exe
  2⤵
  PID:6788
- C:\Windows\System\OUdIBoW.exe
  C:\Windows\System\OUdIBoW.exe
  2⤵
  PID:6816
- C:\Windows\System\TLLMozk.exe
  C:\Windows\System\TLLMozk.exe
  2⤵
  PID:6844
- C:\Windows\System\YrXrxGe.exe
  C:\Windows\System\YrXrxGe.exe
  2⤵
  PID:6876
- C:\Windows\System\nYMsYZK.exe
  C:\Windows\System\nYMsYZK.exe
  2⤵
  PID:6900
- C:\Windows\System\lHwkswt.exe
  C:\Windows\System\lHwkswt.exe
  2⤵
  PID:6928
- C:\Windows\System\FdLIzfj.exe
  C:\Windows\System\FdLIzfj.exe
  2⤵
  PID:6956
- C:\Windows\System\maJIRMq.exe
  C:\Windows\System\maJIRMq.exe
  2⤵
  PID:6988
- C:\Windows\System\ElFxRvO.exe
  C:\Windows\System\ElFxRvO.exe
  2⤵
  PID:7024
- C:\Windows\System\qLuYKdv.exe
  C:\Windows\System\qLuYKdv.exe
  2⤵
  PID:7052
- C:\Windows\System\LoKMSml.exe
  C:\Windows\System\LoKMSml.exe
  2⤵
  PID:7076
- C:\Windows\System\qEzLtPp.exe
  C:\Windows\System\qEzLtPp.exe
  2⤵
  PID:7108
- C:\Windows\System\HpVaMND.exe
  C:\Windows\System\HpVaMND.exe
  2⤵
  PID:7136
- C:\Windows\System\baNwehr.exe
  C:\Windows\System\baNwehr.exe
  2⤵
  PID:7164
- C:\Windows\System\hOnZvlS.exe
  C:\Windows\System\hOnZvlS.exe
  2⤵
  PID:6160
- C:\Windows\System\QZxxZQL.exe
  C:\Windows\System\QZxxZQL.exe
  2⤵
  PID:6200
- C:\Windows\System\jIbfTkd.exe
  C:\Windows\System\jIbfTkd.exe
  2⤵
  PID:6268
- C:\Windows\System\njtXSZT.exe
  C:\Windows\System\njtXSZT.exe
  2⤵
  PID:6344
- C:\Windows\System\zbMDCrY.exe
  C:\Windows\System\zbMDCrY.exe
  2⤵
  PID:6440
- C:\Windows\System\ApvLULT.exe
  C:\Windows\System\ApvLULT.exe
  2⤵
  PID:6512
- C:\Windows\System\gzQjViO.exe
  C:\Windows\System\gzQjViO.exe
  2⤵
  PID:6584
- C:\Windows\System\ELhjTtI.exe
  C:\Windows\System\ELhjTtI.exe
  2⤵
  PID:6644
- C:\Windows\System\qTMnDCl.exe
  C:\Windows\System\qTMnDCl.exe
  2⤵
  PID:6696
- C:\Windows\System\RimFCrV.exe
  C:\Windows\System\RimFCrV.exe
  2⤵
  PID:6756
- C:\Windows\System\BkLsIXP.exe
  C:\Windows\System\BkLsIXP.exe
  2⤵
  PID:6832
- C:\Windows\System\DEAUbzr.exe
  C:\Windows\System\DEAUbzr.exe
  2⤵
  PID:6896
- C:\Windows\System\MwLEyyV.exe
  C:\Windows\System\MwLEyyV.exe
  2⤵
  PID:7004
- C:\Windows\System\cdmoNrH.exe
  C:\Windows\System\cdmoNrH.exe
  2⤵
  PID:7036
- C:\Windows\System\tqrMumc.exe
  C:\Windows\System\tqrMumc.exe
  2⤵
  PID:7104
- C:\Windows\System\wobpAdD.exe
  C:\Windows\System\wobpAdD.exe
  2⤵
  PID:5296
- C:\Windows\System\WnyBFOz.exe
  C:\Windows\System\WnyBFOz.exe
  2⤵
  PID:6240
- C:\Windows\System\jeMVXdN.exe
  C:\Windows\System\jeMVXdN.exe
  2⤵
  PID:6436
- C:\Windows\System\tzQKGBs.exe
  C:\Windows\System\tzQKGBs.exe
  2⤵
  PID:6616
- C:\Windows\System\FxOIsVE.exe
  C:\Windows\System\FxOIsVE.exe
  2⤵
  PID:6744
- C:\Windows\System\HkOnoRn.exe
  C:\Windows\System\HkOnoRn.exe
  2⤵
  PID:6888
- C:\Windows\System\LlrdnJr.exe
  C:\Windows\System\LlrdnJr.exe
  2⤵
  PID:7068
- C:\Windows\System\CisUgBe.exe
  C:\Windows\System\CisUgBe.exe
  2⤵
  PID:6284
- C:\Windows\System\xKbfsjp.exe
  C:\Windows\System\xKbfsjp.exe
  2⤵
  PID:6580
- C:\Windows\System\kOUTxiO.exe
  C:\Windows\System\kOUTxiO.exe
  2⤵
  PID:7008
- C:\Windows\System\XTohvrS.exe
  C:\Windows\System\XTohvrS.exe
  2⤵
  PID:6496
- C:\Windows\System\bCUiCdb.exe
  C:\Windows\System\bCUiCdb.exe
  2⤵
  PID:6428
- C:\Windows\System\MmkmacC.exe
  C:\Windows\System\MmkmacC.exe
  2⤵
  PID:7196
- C:\Windows\System\uLhVvge.exe
  C:\Windows\System\uLhVvge.exe
  2⤵
  PID:7224
- C:\Windows\System\CSjmWzT.exe
  C:\Windows\System\CSjmWzT.exe
  2⤵
  PID:7252
- C:\Windows\System\iMRKtRd.exe
  C:\Windows\System\iMRKtRd.exe
  2⤵
  PID:7280
- C:\Windows\System\ftOquEa.exe
  C:\Windows\System\ftOquEa.exe
  2⤵
  PID:7308
- C:\Windows\System\iIcsLLq.exe
  C:\Windows\System\iIcsLLq.exe
  2⤵
  PID:7336
- C:\Windows\System\TZKkiGI.exe
  C:\Windows\System\TZKkiGI.exe
  2⤵
  PID:7364
- C:\Windows\System\MzDQJKn.exe
  C:\Windows\System\MzDQJKn.exe
  2⤵
  PID:7392
- C:\Windows\System\DCmvVra.exe
  C:\Windows\System\DCmvVra.exe
  2⤵
  PID:7420
- C:\Windows\System\PiTJiYA.exe
  C:\Windows\System\PiTJiYA.exe
  2⤵
  PID:7448
- C:\Windows\System\FNuZzzp.exe
  C:\Windows\System\FNuZzzp.exe
  2⤵
  PID:7476
- C:\Windows\System\OeOmSxU.exe
  C:\Windows\System\OeOmSxU.exe
  2⤵
  PID:7504
- C:\Windows\System\wnRQyPW.exe
  C:\Windows\System\wnRQyPW.exe
  2⤵
  PID:7532
- C:\Windows\System\wreJPaC.exe
  C:\Windows\System\wreJPaC.exe
  2⤵
  PID:7560
- C:\Windows\System\oSaUlfs.exe
  C:\Windows\System\oSaUlfs.exe
  2⤵
  PID:7588
- C:\Windows\System\UZDuYXW.exe
  C:\Windows\System\UZDuYXW.exe
  2⤵
  PID:7616
- C:\Windows\System\dZsitOh.exe
  C:\Windows\System\dZsitOh.exe
  2⤵
  PID:7644
- C:\Windows\System\OsnRtUV.exe
  C:\Windows\System\OsnRtUV.exe
  2⤵
  PID:7672
- C:\Windows\System\rVivFci.exe
  C:\Windows\System\rVivFci.exe
  2⤵
  PID:7700
- C:\Windows\System\LhxxVzR.exe
  C:\Windows\System\LhxxVzR.exe
  2⤵
  PID:7728
- C:\Windows\System\oalbnOD.exe
  C:\Windows\System\oalbnOD.exe
  2⤵
  PID:7756
- C:\Windows\System\uNHVTaE.exe
  C:\Windows\System\uNHVTaE.exe
  2⤵
  PID:7784
- C:\Windows\System\veSXNxM.exe
  C:\Windows\System\veSXNxM.exe
  2⤵
  PID:7812
- C:\Windows\System\lWccyVL.exe
  C:\Windows\System\lWccyVL.exe
  2⤵
  PID:7840
- C:\Windows\System\DmDwJbW.exe
  C:\Windows\System\DmDwJbW.exe
  2⤵
  PID:7868
- C:\Windows\System\MMwcHlM.exe
  C:\Windows\System\MMwcHlM.exe
  2⤵
  PID:7896
- C:\Windows\System\VQoVaWn.exe
  C:\Windows\System\VQoVaWn.exe
  2⤵
  PID:7924
- C:\Windows\System\WrgoELL.exe
  C:\Windows\System\WrgoELL.exe
  2⤵
  PID:7952
- C:\Windows\System\xIZSLdS.exe
  C:\Windows\System\xIZSLdS.exe
  2⤵
  PID:7980
- C:\Windows\System\ALxDvCr.exe
  C:\Windows\System\ALxDvCr.exe
  2⤵
  PID:8008
- C:\Windows\System\UzMsyaG.exe
  C:\Windows\System\UzMsyaG.exe
  2⤵
  PID:8036
- C:\Windows\System\wIWpiwJ.exe
  C:\Windows\System\wIWpiwJ.exe
  2⤵
  PID:8064
- C:\Windows\System\fuhWMcB.exe
  C:\Windows\System\fuhWMcB.exe
  2⤵
  PID:8092
- C:\Windows\System\VjGhvHc.exe
  C:\Windows\System\VjGhvHc.exe
  2⤵
  PID:8120
- C:\Windows\System\DgPnEMe.exe
  C:\Windows\System\DgPnEMe.exe
  2⤵
  PID:8148
- C:\Windows\System\bzLnMpX.exe
  C:\Windows\System\bzLnMpX.exe
  2⤵
  PID:8176
- C:\Windows\System\lnyBiEK.exe
  C:\Windows\System\lnyBiEK.exe
  2⤵
  PID:7192
- C:\Windows\System\jNwwdYi.exe
  C:\Windows\System\jNwwdYi.exe
  2⤵
  PID:7248
- C:\Windows\System\gofYwyI.exe
  C:\Windows\System\gofYwyI.exe
  2⤵
  PID:7300
- C:\Windows\System\ArEvPpJ.exe
  C:\Windows\System\ArEvPpJ.exe
  2⤵
  PID:7380
- C:\Windows\System\UeZNXqU.exe
  C:\Windows\System\UeZNXqU.exe
  2⤵
  PID:7440
- C:\Windows\System\XYDsjWE.exe
  C:\Windows\System\XYDsjWE.exe
  2⤵
  PID:7496
- C:\Windows\System\fycrQrL.exe
  C:\Windows\System\fycrQrL.exe
  2⤵
  PID:7572
- C:\Windows\System\flGcGBu.exe
  C:\Windows\System\flGcGBu.exe
  2⤵
  PID:7636
- C:\Windows\System\iUlHeuj.exe
  C:\Windows\System\iUlHeuj.exe
  2⤵
  PID:7696
- C:\Windows\System\JUxGZZz.exe
  C:\Windows\System\JUxGZZz.exe
  2⤵
  PID:7772
- C:\Windows\System\cDpKYQI.exe
  C:\Windows\System\cDpKYQI.exe
  2⤵
  PID:7832
- C:\Windows\System\nwAaRqY.exe
  C:\Windows\System\nwAaRqY.exe
  2⤵
  PID:7912
- C:\Windows\System\JgZVIJu.exe
  C:\Windows\System\JgZVIJu.exe
  2⤵
  PID:7972
- C:\Windows\System\ZysSskg.exe
  C:\Windows\System\ZysSskg.exe
  2⤵
  PID:8032
- C:\Windows\System\dEMtyAB.exe
  C:\Windows\System\dEMtyAB.exe
  2⤵
  PID:8108
- C:\Windows\System\tVfSULA.exe
  C:\Windows\System\tVfSULA.exe
  2⤵
  PID:8168
- C:\Windows\System\UWZRgRM.exe
  C:\Windows\System\UWZRgRM.exe
  2⤵
  PID:7220
- C:\Windows\System\UJowVoj.exe
  C:\Windows\System\UJowVoj.exe
  2⤵
  PID:7348
- C:\Windows\System\fTRLdmv.exe
  C:\Windows\System\fTRLdmv.exe
  2⤵
  PID:7544
- C:\Windows\System\FBCOZYg.exe
  C:\Windows\System\FBCOZYg.exe
  2⤵
  PID:7684
- C:\Windows\System\YmxZiyY.exe
  C:\Windows\System\YmxZiyY.exe
  2⤵
  PID:7828
- C:\Windows\System\JllodPN.exe
  C:\Windows\System\JllodPN.exe
  2⤵
  PID:8000
- C:\Windows\System\ukVQyUq.exe
  C:\Windows\System\ukVQyUq.exe
  2⤵
  PID:8164
- C:\Windows\System\FStMBdk.exe
  C:\Windows\System\FStMBdk.exe
  2⤵
  PID:7472
- C:\Windows\System\FttDpnh.exe
  C:\Windows\System\FttDpnh.exe
  2⤵
  PID:7808
- C:\Windows\System\FtCxQaa.exe
  C:\Windows\System\FtCxQaa.exe
  2⤵
  PID:8144
- C:\Windows\System\ejBoDBm.exe
  C:\Windows\System\ejBoDBm.exe
  2⤵
  PID:7968
- C:\Windows\System\yRoBenV.exe
  C:\Windows\System\yRoBenV.exe
  2⤵
  PID:8196
- C:\Windows\System\NGjAJSV.exe
  C:\Windows\System\NGjAJSV.exe
  2⤵
  PID:8224
- C:\Windows\System\ofJPwYT.exe
  C:\Windows\System\ofJPwYT.exe
  2⤵
  PID:8252
- C:\Windows\System\FmFNRGj.exe
  C:\Windows\System\FmFNRGj.exe
  2⤵
  PID:8280
- C:\Windows\System\DiRYzqA.exe
  C:\Windows\System\DiRYzqA.exe
  2⤵
  PID:8308
- C:\Windows\System\veyKdUR.exe
  C:\Windows\System\veyKdUR.exe
  2⤵
  PID:8336
- C:\Windows\System\RWSEPZE.exe
  C:\Windows\System\RWSEPZE.exe
  2⤵
  PID:8364
- C:\Windows\System\mtYPdiG.exe
  C:\Windows\System\mtYPdiG.exe
  2⤵
  PID:8392
- C:\Windows\System\mRxVflB.exe
  C:\Windows\System\mRxVflB.exe
  2⤵
  PID:8420
- C:\Windows\System\dAQnJUi.exe
  C:\Windows\System\dAQnJUi.exe
  2⤵
  PID:8448
- C:\Windows\System\tnIohfH.exe
  C:\Windows\System\tnIohfH.exe
  2⤵
  PID:8476
- C:\Windows\System\NxgRJWO.exe
  C:\Windows\System\NxgRJWO.exe
  2⤵
  PID:8504
- C:\Windows\System\wFcrMqJ.exe
  C:\Windows\System\wFcrMqJ.exe
  2⤵
  PID:8532
- C:\Windows\System\WSSRngT.exe
  C:\Windows\System\WSSRngT.exe
  2⤵
  PID:8560
- C:\Windows\System\dYaPdan.exe
  C:\Windows\System\dYaPdan.exe
  2⤵
  PID:8588
- C:\Windows\System\dNTTpYi.exe
  C:\Windows\System\dNTTpYi.exe
  2⤵
  PID:8616
- C:\Windows\System\VVXDlPD.exe
  C:\Windows\System\VVXDlPD.exe
  2⤵
  PID:8644
- C:\Windows\System\urCDPqe.exe
  C:\Windows\System\urCDPqe.exe
  2⤵
  PID:8672
- C:\Windows\System\ezpzfIB.exe
  C:\Windows\System\ezpzfIB.exe
  2⤵
  PID:8700
- C:\Windows\System\etzGiXU.exe
  C:\Windows\System\etzGiXU.exe
  2⤵
  PID:8728
- C:\Windows\System\kLEmhlc.exe
  C:\Windows\System\kLEmhlc.exe
  2⤵
  PID:8756
- C:\Windows\System\XUOCLIt.exe
  C:\Windows\System\XUOCLIt.exe
  2⤵
  PID:8784
- C:\Windows\System\kdXVgTK.exe
  C:\Windows\System\kdXVgTK.exe
  2⤵
  PID:8812
- C:\Windows\System\XAjpvUH.exe
  C:\Windows\System\XAjpvUH.exe
  2⤵
  PID:8840
- C:\Windows\System\CXbMebJ.exe
  C:\Windows\System\CXbMebJ.exe
  2⤵
  PID:8868
- C:\Windows\System\IqdktUc.exe
  C:\Windows\System\IqdktUc.exe
  2⤵
  PID:8896
- C:\Windows\System\TgNWrHx.exe
  C:\Windows\System\TgNWrHx.exe
  2⤵
  PID:8924
- C:\Windows\System\kJfhugE.exe
  C:\Windows\System\kJfhugE.exe
  2⤵
  PID:8952
- C:\Windows\System\eQtUxbC.exe
  C:\Windows\System\eQtUxbC.exe
  2⤵
  PID:8980
- C:\Windows\System\atsHtxA.exe
  C:\Windows\System\atsHtxA.exe
  2⤵
  PID:9008
- C:\Windows\System\ceWAqHT.exe
  C:\Windows\System\ceWAqHT.exe
  2⤵
  PID:9036
- C:\Windows\System\EjrdxJV.exe
  C:\Windows\System\EjrdxJV.exe
  2⤵
  PID:9064
- C:\Windows\System\ZrROWbI.exe
  C:\Windows\System\ZrROWbI.exe
  2⤵
  PID:9092
- C:\Windows\System\nErkkEy.exe
  C:\Windows\System\nErkkEy.exe
  2⤵
  PID:9120
- C:\Windows\System\vcTuYKu.exe
  C:\Windows\System\vcTuYKu.exe
  2⤵
  PID:9148
- C:\Windows\System\AdkZmMO.exe
  C:\Windows\System\AdkZmMO.exe
  2⤵
  PID:9176
- C:\Windows\System\fYdTgeQ.exe
  C:\Windows\System\fYdTgeQ.exe
  2⤵
  PID:9204
- C:\Windows\System\fUOooRh.exe
  C:\Windows\System\fUOooRh.exe
  2⤵
  PID:8220
- C:\Windows\System\DWvlvae.exe
  C:\Windows\System\DWvlvae.exe
  2⤵
  PID:8296
- C:\Windows\System\OStnfVH.exe
  C:\Windows\System\OStnfVH.exe
  2⤵
  PID:8356
- C:\Windows\System\icvJTXF.exe
  C:\Windows\System\icvJTXF.exe
  2⤵
  PID:8416
- C:\Windows\System\oHBLKkP.exe
  C:\Windows\System\oHBLKkP.exe
  2⤵
  PID:8472
- C:\Windows\System\WxSBpNC.exe
  C:\Windows\System\WxSBpNC.exe
  2⤵
  PID:8556
- C:\Windows\System\rTGUomi.exe
  C:\Windows\System\rTGUomi.exe
  2⤵
  PID:8612
- C:\Windows\System\Zaslscp.exe
  C:\Windows\System\Zaslscp.exe
  2⤵
  PID:8688
- C:\Windows\System\haAhkTi.exe
  C:\Windows\System\haAhkTi.exe
  2⤵
  PID:8748
- C:\Windows\System\legbDGE.exe
  C:\Windows\System\legbDGE.exe
  2⤵
  PID:8796
- C:\Windows\System\ylMqqul.exe
  C:\Windows\System\ylMqqul.exe
  2⤵
  PID:8880
- C:\Windows\System\mczuyrS.exe
  C:\Windows\System\mczuyrS.exe
  2⤵
  PID:8944
- C:\Windows\System\yAnRLqM.exe
  C:\Windows\System\yAnRLqM.exe
  2⤵
  PID:9004
- C:\Windows\System\uPukSDh.exe
  C:\Windows\System\uPukSDh.exe
  2⤵
  PID:9076
- C:\Windows\System\XofXzny.exe
  C:\Windows\System\XofXzny.exe
  2⤵
  PID:9140
- C:\Windows\System\gmPEylS.exe
  C:\Windows\System\gmPEylS.exe
  2⤵
  PID:9200
- C:\Windows\System\xcBKQtK.exe
  C:\Windows\System\xcBKQtK.exe
  2⤵
  PID:8320
- C:\Windows\System\LfJUVAn.exe
  C:\Windows\System\LfJUVAn.exe
  2⤵
  PID:8468
- C:\Windows\System\ieLgvPU.exe
  C:\Windows\System\ieLgvPU.exe
  2⤵
  PID:8580
- C:\Windows\System\fgzubBI.exe
  C:\Windows\System\fgzubBI.exe
  2⤵
  PID:8780
- C:\Windows\System\SORHdul.exe
  C:\Windows\System\SORHdul.exe
  2⤵
  PID:8940
- C:\Windows\System\KwJQsyS.exe
  C:\Windows\System\KwJQsyS.exe
  2⤵
  PID:9056
- C:\Windows\System\hkFZvBW.exe
  C:\Windows\System\hkFZvBW.exe
  2⤵
  PID:9192
- C:\Windows\System\YNSHGTA.exe
  C:\Windows\System\YNSHGTA.exe
  2⤵
  PID:8544
- C:\Windows\System\PtdYgOo.exe
  C:\Windows\System\PtdYgOo.exe
  2⤵
  PID:8864
- C:\Windows\System\skesTRv.exe
  C:\Windows\System\skesTRv.exe
  2⤵
  PID:9136
- C:\Windows\System\YHWWQlc.exe
  C:\Windows\System\YHWWQlc.exe
  2⤵
  PID:8664
- C:\Windows\System\dFCVBQI.exe
  C:\Windows\System\dFCVBQI.exe
  2⤵
  PID:9224
- C:\Windows\System\gFqllMf.exe
  C:\Windows\System\gFqllMf.exe
  2⤵
  PID:9252
- C:\Windows\System\GOKfWsW.exe
  C:\Windows\System\GOKfWsW.exe
  2⤵
  PID:9284
- C:\Windows\System\BwKmeLU.exe
  C:\Windows\System\BwKmeLU.exe
  2⤵
  PID:9312
- C:\Windows\System\wuhOyzw.exe
  C:\Windows\System\wuhOyzw.exe
  2⤵
  PID:9340
- C:\Windows\System\tzNQHHc.exe
  C:\Windows\System\tzNQHHc.exe
  2⤵
  PID:9368
- C:\Windows\System\dRaqKay.exe
  C:\Windows\System\dRaqKay.exe
  2⤵
  PID:9396
- C:\Windows\System\MBSeNzX.exe
  C:\Windows\System\MBSeNzX.exe
  2⤵
  PID:9424
- C:\Windows\System\QoNDsnH.exe
  C:\Windows\System\QoNDsnH.exe
  2⤵
  PID:9452
- C:\Windows\System\LwKqWCA.exe
  C:\Windows\System\LwKqWCA.exe
  2⤵
  PID:9480
- C:\Windows\System\OGpWeTM.exe
  C:\Windows\System\OGpWeTM.exe
  2⤵
  PID:9508
- C:\Windows\System\hpETucz.exe
  C:\Windows\System\hpETucz.exe
  2⤵
  PID:9528
- C:\Windows\System\JYaQfkV.exe
  C:\Windows\System\JYaQfkV.exe
  2⤵
  PID:9560
- C:\Windows\System\hamQujU.exe
  C:\Windows\System\hamQujU.exe
  2⤵
  PID:9580
- C:\Windows\System\AKojPQt.exe
  C:\Windows\System\AKojPQt.exe
  2⤵
  PID:9620
- C:\Windows\System\cToxiLK.exe
  C:\Windows\System\cToxiLK.exe
  2⤵
  PID:9648
- C:\Windows\System\nyOZtFV.exe
  C:\Windows\System\nyOZtFV.exe
  2⤵
  PID:9680
- C:\Windows\System\XzwXOSt.exe
  C:\Windows\System\XzwXOSt.exe
  2⤵
  PID:9708
- C:\Windows\System\nKrhqdk.exe
  C:\Windows\System\nKrhqdk.exe
  2⤵
  PID:9736
- C:\Windows\System\PlyLyjR.exe
  C:\Windows\System\PlyLyjR.exe
  2⤵
  PID:9764
- C:\Windows\System\lnGZvYJ.exe
  C:\Windows\System\lnGZvYJ.exe
  2⤵
  PID:9792
- C:\Windows\System\STNCqoP.exe
  C:\Windows\System\STNCqoP.exe
  2⤵
  PID:9820
- C:\Windows\System\PmsmxWM.exe
  C:\Windows\System\PmsmxWM.exe
  2⤵
  PID:9848
- C:\Windows\System\upNyqTV.exe
  C:\Windows\System\upNyqTV.exe
  2⤵
  PID:9876
- C:\Windows\System\oYNyOUf.exe
  C:\Windows\System\oYNyOUf.exe
  2⤵
  PID:9904
- C:\Windows\System\DRHLOBB.exe
  C:\Windows\System\DRHLOBB.exe
  2⤵
  PID:9932
- C:\Windows\System\iGDVIWE.exe
  C:\Windows\System\iGDVIWE.exe
  2⤵
  PID:9960
- C:\Windows\System\QPYGVwC.exe
  C:\Windows\System\QPYGVwC.exe
  2⤵
  PID:9988
- C:\Windows\System\QIuvcib.exe
  C:\Windows\System\QIuvcib.exe
  2⤵
  PID:10016
- C:\Windows\System\BjZRurR.exe
  C:\Windows\System\BjZRurR.exe
  2⤵
  PID:10044
- C:\Windows\System\ZZhSUbM.exe
  C:\Windows\System\ZZhSUbM.exe
  2⤵
  PID:10072
- C:\Windows\System\gCmtAci.exe
  C:\Windows\System\gCmtAci.exe
  2⤵
  PID:10100
- C:\Windows\System\XfSuRBm.exe
  C:\Windows\System\XfSuRBm.exe
  2⤵
  PID:10128
- C:\Windows\System\ycKBkcs.exe
  C:\Windows\System\ycKBkcs.exe
  2⤵
  PID:10156
- C:\Windows\System\sQjrqVW.exe
  C:\Windows\System\sQjrqVW.exe
  2⤵
  PID:10184
- C:\Windows\System\fevozez.exe
  C:\Windows\System\fevozez.exe
  2⤵
  PID:10216
- C:\Windows\System\dnriOsw.exe
  C:\Windows\System\dnriOsw.exe
  2⤵
  PID:8444
- C:\Windows\System\PaPpeFQ.exe
  C:\Windows\System\PaPpeFQ.exe
  2⤵
  PID:9268
- C:\Windows\System\PjsPMGm.exe
  C:\Windows\System\PjsPMGm.exe
  2⤵
  PID:9336
- C:\Windows\System\ISXxIlR.exe
  C:\Windows\System\ISXxIlR.exe
  2⤵
  PID:9408
- C:\Windows\System\hlgkStd.exe
  C:\Windows\System\hlgkStd.exe
  2⤵
  PID:9468
- C:\Windows\System\zTZMGSo.exe
  C:\Windows\System\zTZMGSo.exe
  2⤵
  PID:9540
- C:\Windows\System\xIdRNhG.exe
  C:\Windows\System\xIdRNhG.exe
  2⤵
  PID:9608
- C:\Windows\System\gNXLbnJ.exe
  C:\Windows\System\gNXLbnJ.exe
  2⤵
  PID:9668
- C:\Windows\System\mSqNQgC.exe
  C:\Windows\System\mSqNQgC.exe
  2⤵
  PID:9732
- C:\Windows\System\IkwpVRB.exe
  C:\Windows\System\IkwpVRB.exe
  2⤵
  PID:9808
- C:\Windows\System\boGawOV.exe
  C:\Windows\System\boGawOV.exe
  2⤵
  PID:9844
- C:\Windows\System\LTbOOZg.exe
  C:\Windows\System\LTbOOZg.exe
  2⤵
  PID:9900
- C:\Windows\System\XBRIBaY.exe
  C:\Windows\System\XBRIBaY.exe
  2⤵
  PID:10004
- C:\Windows\System\eBtNypg.exe
  C:\Windows\System\eBtNypg.exe
  2⤵
  PID:10068
- C:\Windows\System\FPLaayt.exe
  C:\Windows\System\FPLaayt.exe
  2⤵
  PID:10144
- C:\Windows\System\KcxLvZc.exe
  C:\Windows\System\KcxLvZc.exe
  2⤵
  PID:10204
- C:\Windows\System\WGMpyIy.exe
  C:\Windows\System\WGMpyIy.exe
  2⤵
  PID:9272
- C:\Windows\System\LvXFuDE.exe
  C:\Windows\System\LvXFuDE.exe
  2⤵
  PID:9440
- C:\Windows\System\eycevrH.exe
  C:\Windows\System\eycevrH.exe
  2⤵
  PID:9576
- C:\Windows\System\ZMAuPkb.exe
  C:\Windows\System\ZMAuPkb.exe
  2⤵
  PID:9700
- C:\Windows\System\BTWZDmg.exe
  C:\Windows\System\BTWZDmg.exe
  2⤵
  PID:9864
- C:\Windows\System\nwZcVTh.exe
  C:\Windows\System\nwZcVTh.exe
  2⤵
  PID:10040
- C:\Windows\System\iyoVEVs.exe
  C:\Windows\System\iyoVEVs.exe
  2⤵
  PID:10168
- C:\Windows\System\VEMHLhJ.exe
  C:\Windows\System\VEMHLhJ.exe
  2⤵
  PID:9364
- C:\Windows\System\CuDjhty.exe
  C:\Windows\System\CuDjhty.exe
  2⤵
  PID:9836
- C:\Windows\System\GdrXfTX.exe
  C:\Windows\System\GdrXfTX.exe
  2⤵
  PID:10124
- C:\Windows\System\zHslBCr.exe
  C:\Windows\System\zHslBCr.exe
  2⤵
  PID:9728
- C:\Windows\System\plcQlQo.exe
  C:\Windows\System\plcQlQo.exe
  2⤵
  PID:10244
- C:\Windows\System\KhmHgff.exe
  C:\Windows\System\KhmHgff.exe
  2⤵
  PID:10276
- C:\Windows\System\nbBGumu.exe
  C:\Windows\System\nbBGumu.exe
  2⤵
  PID:10292
- C:\Windows\System\uLbsVuf.exe
  C:\Windows\System\uLbsVuf.exe
  2⤵
  PID:10320
- C:\Windows\System\OVAMris.exe
  C:\Windows\System\OVAMris.exe
  2⤵
  PID:10360
- C:\Windows\System\ctmHjdX.exe
  C:\Windows\System\ctmHjdX.exe
  2⤵
  PID:10388
- C:\Windows\System\juybhob.exe
  C:\Windows\System\juybhob.exe
  2⤵
  PID:10404
- C:\Windows\System\eUFZUxo.exe
  C:\Windows\System\eUFZUxo.exe
  2⤵
  PID:10444
- C:\Windows\System\aSdIDJJ.exe
  C:\Windows\System\aSdIDJJ.exe
  2⤵
  PID:10472
- C:\Windows\System\wrvLxwt.exe
  C:\Windows\System\wrvLxwt.exe
  2⤵
  PID:10500
- C:\Windows\System\AHcVVwo.exe
  C:\Windows\System\AHcVVwo.exe
  2⤵
  PID:10528
- C:\Windows\System\qlnBIAX.exe
  C:\Windows\System\qlnBIAX.exe
  2⤵
  PID:10556
- C:\Windows\System\PpSTeJV.exe
  C:\Windows\System\PpSTeJV.exe
  2⤵
  PID:10584
- C:\Windows\System\SMIEbKn.exe
  C:\Windows\System\SMIEbKn.exe
  2⤵
  PID:10612
- C:\Windows\System\qLbkwpp.exe
  C:\Windows\System\qLbkwpp.exe
  2⤵
  PID:10640
- C:\Windows\System\YtxIjNa.exe
  C:\Windows\System\YtxIjNa.exe
  2⤵
  PID:10668
- C:\Windows\System\fEpbESk.exe
  C:\Windows\System\fEpbESk.exe
  2⤵
  PID:10696
- C:\Windows\System\KDCucGP.exe
  C:\Windows\System\KDCucGP.exe
  2⤵
  PID:10724
- C:\Windows\System\KCKTPfy.exe
  C:\Windows\System\KCKTPfy.exe
  2⤵
  PID:10752
- C:\Windows\System\qnAWrag.exe
  C:\Windows\System\qnAWrag.exe
  2⤵
  PID:10780
- C:\Windows\System\EanmCCb.exe
  C:\Windows\System\EanmCCb.exe
  2⤵
  PID:10808
- C:\Windows\System\hzQtFfh.exe
  C:\Windows\System\hzQtFfh.exe
  2⤵
  PID:10828
- C:\Windows\System\XGSsgDN.exe
  C:\Windows\System\XGSsgDN.exe
  2⤵
  PID:10852
- C:\Windows\System\oscNipq.exe
  C:\Windows\System\oscNipq.exe
  2⤵
  PID:10876
- C:\Windows\System\QUavXTF.exe
  C:\Windows\System\QUavXTF.exe
  2⤵
  PID:10896
- C:\Windows\System\bZRlAjR.exe
  C:\Windows\System\bZRlAjR.exe
  2⤵
  PID:10916
- C:\Windows\System\ejZupiA.exe
  C:\Windows\System\ejZupiA.exe
  2⤵
  PID:10944
- C:\Windows\System\ILgzGKe.exe
  C:\Windows\System\ILgzGKe.exe
  2⤵
  PID:10960
- C:\Windows\System\NWQmLwj.exe
  C:\Windows\System\NWQmLwj.exe
  2⤵
  PID:10980
- C:\Windows\System\lagevHT.exe
  C:\Windows\System\lagevHT.exe
  2⤵
  PID:11016
- C:\Windows\System\sOUxzDq.exe
  C:\Windows\System\sOUxzDq.exe
  2⤵
  PID:11052
- C:\Windows\System\vtWaFmM.exe
  C:\Windows\System\vtWaFmM.exe
  2⤵
  PID:11072
- C:\Windows\System\SEGdcBV.exe
  C:\Windows\System\SEGdcBV.exe
  2⤵
  PID:11092
- C:\Windows\System\rvOuTmd.exe
  C:\Windows\System\rvOuTmd.exe
  2⤵
  PID:11116
- C:\Windows\System\YvJpqBl.exe
  C:\Windows\System\YvJpqBl.exe
  2⤵
  PID:11140
- C:\Windows\System\EDQnOIs.exe
  C:\Windows\System\EDQnOIs.exe
  2⤵
  PID:11168
- C:\Windows\System\fUNNLDU.exe
  C:\Windows\System\fUNNLDU.exe
  2⤵
  PID:11256
- C:\Windows\System\qpyqhum.exe
  C:\Windows\System\qpyqhum.exe
  2⤵
  PID:10272
- C:\Windows\System\slHLPIT.exe
  C:\Windows\System\slHLPIT.exe
  2⤵
  PID:10304
- C:\Windows\System\VZosgkP.exe
  C:\Windows\System\VZosgkP.exe
  2⤵
  PID:10356
- C:\Windows\System\BBSzehU.exe
  C:\Windows\System\BBSzehU.exe
  2⤵
  PID:10440
- C:\Windows\System\pXXZlxF.exe
  C:\Windows\System\pXXZlxF.exe
  2⤵
  PID:10512
- C:\Windows\System\pNuBzRj.exe
  C:\Windows\System\pNuBzRj.exe
  2⤵
  PID:10580
- C:\Windows\System\uJhRVmk.exe
  C:\Windows\System\uJhRVmk.exe
  2⤵
  PID:10636
- C:\Windows\System\mImQJvJ.exe
  C:\Windows\System\mImQJvJ.exe
  2⤵
  PID:10708
- C:\Windows\System\GQINEdw.exe
  C:\Windows\System\GQINEdw.exe
  2⤵
  PID:10800
- C:\Windows\System\dXLalro.exe
  C:\Windows\System\dXLalro.exe
  2⤵
  PID:10836
- C:\Windows\System\VLJGUsv.exe
  C:\Windows\System\VLJGUsv.exe
  2⤵
  PID:10924
- C:\Windows\System\sLyquEO.exe
  C:\Windows\System\sLyquEO.exe
  2⤵
  PID:10968
- C:\Windows\System\QfhTMoa.exe
  C:\Windows\System\QfhTMoa.exe
  2⤵
  PID:11044
- C:\Windows\System\VOvgboz.exe
  C:\Windows\System\VOvgboz.exe
  2⤵
  PID:11124
- C:\Windows\System\UVxLDRq.exe
  C:\Windows\System\UVxLDRq.exe
  2⤵
  PID:11200
- C:\Windows\System\OyZMqCK.exe
  C:\Windows\System\OyZMqCK.exe
  2⤵
  PID:11136
- C:\Windows\System\oZcDfAw.exe
  C:\Windows\System\oZcDfAw.exe
  2⤵
  PID:10268
- C:\Windows\System\GnPGcHe.exe
  C:\Windows\System\GnPGcHe.exe
  2⤵
  PID:10400
- C:\Windows\System\jqZadkQ.exe
  C:\Windows\System\jqZadkQ.exe
  2⤵
  PID:10552
- C:\Windows\System\edCKByQ.exe
  C:\Windows\System\edCKByQ.exe
  2⤵
  PID:10824
- C:\Windows\System\xTOhHkU.exe
  C:\Windows\System\xTOhHkU.exe
  2⤵
  PID:11024
- C:\Windows\System\TFGRelW.exe
  C:\Windows\System\TFGRelW.exe
  2⤵
  PID:11064
- C:\Windows\System\eekogtd.exe
  C:\Windows\System\eekogtd.exe
  2⤵
  PID:11160
- C:\Windows\System\zVkvfoB.exe
  C:\Windows\System\zVkvfoB.exe
  2⤵
  PID:10332
- C:\Windows\System\TRoRRwK.exe
  C:\Windows\System\TRoRRwK.exe
  2⤵
  PID:10632
- C:\Windows\System\nWXzVHG.exe
  C:\Windows\System\nWXzVHG.exe
  2⤵
  PID:10996
- C:\Windows\System\ojwcZSw.exe
  C:\Windows\System\ojwcZSw.exe
  2⤵
  PID:10656
- C:\Windows\System\aGdWQRy.exe
  C:\Windows\System\aGdWQRy.exe
  2⤵
  PID:11324
- C:\Windows\System\clcDxRi.exe
  C:\Windows\System\clcDxRi.exe
  2⤵
  PID:11340
- C:\Windows\System\dncDApY.exe
  C:\Windows\System\dncDApY.exe
  2⤵
  PID:11360
- C:\Windows\System\aPfoRLm.exe
  C:\Windows\System\aPfoRLm.exe
  2⤵
  PID:11384
- C:\Windows\System\hUFErhx.exe
  C:\Windows\System\hUFErhx.exe
  2⤵
  PID:11424
- C:\Windows\System\rSepInA.exe
  C:\Windows\System\rSepInA.exe
  2⤵
  PID:11444
- C:\Windows\System\nwswZUm.exe
  C:\Windows\System\nwswZUm.exe
  2⤵
  PID:11468
- C:\Windows\System\QMlWOfC.exe
  C:\Windows\System\QMlWOfC.exe
  2⤵
  PID:11496
- C:\Windows\System\WSnGBby.exe
  C:\Windows\System\WSnGBby.exe
  2⤵
  PID:11520
- C:\Windows\System\JjfhhQI.exe
  C:\Windows\System\JjfhhQI.exe
  2⤵
  PID:11564
- C:\Windows\System\IRSocTv.exe
  C:\Windows\System\IRSocTv.exe
  2⤵
  PID:11580
- C:\Windows\System\RmEmXlE.exe
  C:\Windows\System\RmEmXlE.exe
  2⤵
  PID:11604
- C:\Windows\System\mCyFCwy.exe
  C:\Windows\System\mCyFCwy.exe
  2⤵
  PID:11636
- C:\Windows\System\GQyUAhC.exe
  C:\Windows\System\GQyUAhC.exe
  2⤵
  PID:11676
- C:\Windows\System\XkDWaaX.exe
  C:\Windows\System\XkDWaaX.exe
  2⤵
  PID:11692
- C:\Windows\System\xoPTHJM.exe
  C:\Windows\System\xoPTHJM.exe
  2⤵
  PID:11708
- C:\Windows\System\FXzcwhV.exe
  C:\Windows\System\FXzcwhV.exe
  2⤵
  PID:11752
- C:\Windows\System\mppYaaJ.exe
  C:\Windows\System\mppYaaJ.exe
  2⤵
  PID:11784
- C:\Windows\System\NIgegwG.exe
  C:\Windows\System\NIgegwG.exe
  2⤵
  PID:11812
- C:\Windows\System\cCizQoj.exe
  C:\Windows\System\cCizQoj.exe
  2⤵
  PID:11832
- C:\Windows\System\HnGOUgl.exe
  C:\Windows\System\HnGOUgl.exe
  2⤵
  PID:11860
- C:\Windows\System\ohXQxCO.exe
  C:\Windows\System\ohXQxCO.exe
  2⤵
  PID:11880
- C:\Windows\System\puqnBtU.exe
  C:\Windows\System\puqnBtU.exe
  2⤵
  PID:11900
- C:\Windows\System\RSuhRdE.exe
  C:\Windows\System\RSuhRdE.exe
  2⤵
  PID:11932
- C:\Windows\System\digQZLz.exe
  C:\Windows\System\digQZLz.exe
  2⤵
  PID:11976
- C:\Windows\System\vTOChRk.exe
  C:\Windows\System\vTOChRk.exe
  2⤵
  PID:12000
- C:\Windows\System\ITPBZlp.exe
  C:\Windows\System\ITPBZlp.exe
  2⤵
  PID:12040
- C:\Windows\System\ZjWROGF.exe
  C:\Windows\System\ZjWROGF.exe
  2⤵
  PID:12068
- C:\Windows\System\DRZyIWJ.exe
  C:\Windows\System\DRZyIWJ.exe
  2⤵
  PID:12096
- C:\Windows\System\GTplcQE.exe
  C:\Windows\System\GTplcQE.exe
  2⤵
  PID:12124
- C:\Windows\System\tdpGaPo.exe
  C:\Windows\System\tdpGaPo.exe
  2⤵
  PID:12144
- C:\Windows\System\KWdTOfp.exe
  C:\Windows\System\KWdTOfp.exe
  2⤵
  PID:12168
- C:\Windows\System\QsVsKBi.exe
  C:\Windows\System\QsVsKBi.exe
  2⤵
  PID:12192
- C:\Windows\System\PkXlMtc.exe
  C:\Windows\System\PkXlMtc.exe
  2⤵
  PID:12220
- C:\Windows\System\lgMKEno.exe
  C:\Windows\System\lgMKEno.exe
  2⤵
  PID:12240
- C:\Windows\System\jchbLUg.exe
  C:\Windows\System\jchbLUg.exe
  2⤵
  PID:12260
- C:\Windows\System\YPMUOnx.exe
  C:\Windows\System\YPMUOnx.exe
  2⤵
  PID:3744
- C:\Windows\System\zuQAwVZ.exe
  C:\Windows\System\zuQAwVZ.exe
  2⤵
  PID:10252
- C:\Windows\System\GEVLHCu.exe
  C:\Windows\System\GEVLHCu.exe
  2⤵
  PID:11356
- C:\Windows\System\APJxHeX.exe
  C:\Windows\System\APJxHeX.exe
  2⤵
  PID:11420
- C:\Windows\System\tPFoZJa.exe
  C:\Windows\System\tPFoZJa.exe
  2⤵
  PID:11480
- C:\Windows\System\bpkfeYZ.exe
  C:\Windows\System\bpkfeYZ.exe
  2⤵
  PID:11512
- C:\Windows\System\LaqCFco.exe
  C:\Windows\System\LaqCFco.exe
  2⤵
  PID:11644
- C:\Windows\System\XGoZDcY.exe
  C:\Windows\System\XGoZDcY.exe
  2⤵
  PID:11704
- C:\Windows\System\yoPmCxF.exe
  C:\Windows\System\yoPmCxF.exe
  2⤵
  PID:11748
- C:\Windows\System\ZICNOKF.exe
  C:\Windows\System\ZICNOKF.exe
  2⤵
  PID:11824
- C:\Windows\System\nfMFEfQ.exe
  C:\Windows\System\nfMFEfQ.exe
  2⤵
  PID:11916
- C:\Windows\System\VnHXDtt.exe
  C:\Windows\System\VnHXDtt.exe
  2⤵
  PID:11984
- C:\Windows\System\PuuhIce.exe
  C:\Windows\System\PuuhIce.exe
  2⤵
  PID:12052
- C:\Windows\System\bhvgWdk.exe
  C:\Windows\System\bhvgWdk.exe
  2⤵
  PID:10768
- C:\Windows\System\bFdUFQj.exe
  C:\Windows\System\bFdUFQj.exe
  2⤵
  PID:12140
- C:\Windows\System\CmvwhyS.exe
  C:\Windows\System\CmvwhyS.exe
  2⤵
  PID:12232
- C:\Windows\System\jrHzslQ.exe
  C:\Windows\System\jrHzslQ.exe
  2⤵
  PID:2208
- C:\Windows\System\omFjBYh.exe
  C:\Windows\System\omFjBYh.exe
  2⤵
  PID:11300
- C:\Windows\System\ujaglWx.exe
  C:\Windows\System\ujaglWx.exe
  2⤵
  PID:11416
- C:\Windows\System\pnYjOAo.exe
  C:\Windows\System\pnYjOAo.exe
  2⤵
  PID:11596
- C:\Windows\System\fAYPjhP.exe
  C:\Windows\System\fAYPjhP.exe
  2⤵
  PID:11848
- C:\Windows\System\JjlbeuI.exe
  C:\Windows\System\JjlbeuI.exe
  2⤵
  PID:11868
- C:\Windows\System\rJSRlUi.exe
  C:\Windows\System\rJSRlUi.exe
  2⤵
  PID:12028
- C:\Windows\System\sFjIeen.exe
  C:\Windows\System\sFjIeen.exe
  2⤵
  PID:12164
- C:\Windows\System\NjrwSdI.exe
  C:\Windows\System\NjrwSdI.exe
  2⤵
  PID:11296
- C:\Windows\System\vEGgmfQ.exe
  C:\Windows\System\vEGgmfQ.exe
  2⤵
  PID:11552
- C:\Windows\System\MAGymui.exe
  C:\Windows\System\MAGymui.exe
  2⤵
  PID:11956
- C:\Windows\System\mEmYxBQ.exe
  C:\Windows\System\mEmYxBQ.exe
  2⤵
  PID:12112
- C:\Windows\System\NNmvByq.exe
  C:\Windows\System\NNmvByq.exe
  2⤵
  PID:11896
- C:\Windows\System\PPdMapt.exe
  C:\Windows\System\PPdMapt.exe
  2⤵
  PID:12296
- C:\Windows\System\KKTPnZk.exe
  C:\Windows\System\KKTPnZk.exe
  2⤵
  PID:12316
- C:\Windows\System\sKwcriX.exe
  C:\Windows\System\sKwcriX.exe
  2⤵
  PID:12356
- C:\Windows\System\sGjVJVC.exe
  C:\Windows\System\sGjVJVC.exe
  2⤵
  PID:12396
- C:\Windows\System\FKTBOnT.exe
  C:\Windows\System\FKTBOnT.exe
  2⤵
  PID:12412
- C:\Windows\System\noNnJzt.exe
  C:\Windows\System\noNnJzt.exe
  2⤵
  PID:12432
- C:\Windows\System\XxExLIJ.exe
  C:\Windows\System\XxExLIJ.exe
  2⤵
  PID:12456
- C:\Windows\System\ZNibRus.exe
  C:\Windows\System\ZNibRus.exe
  2⤵
  PID:12508
- C:\Windows\System\bgWAEqW.exe
  C:\Windows\System\bgWAEqW.exe
  2⤵
  PID:12528
- C:\Windows\System\fadmtbL.exe
  C:\Windows\System\fadmtbL.exe
  2⤵
  PID:12564
- C:\Windows\System\gxCQYfT.exe
  C:\Windows\System\gxCQYfT.exe
  2⤵
  PID:12584
- C:\Windows\System\ygAMUWc.exe
  C:\Windows\System\ygAMUWc.exe
  2⤵
  PID:12608
- C:\Windows\System\YKxLycc.exe
  C:\Windows\System\YKxLycc.exe
  2⤵
  PID:12628
- C:\Windows\System\mGRqnxc.exe
  C:\Windows\System\mGRqnxc.exe
  2⤵
  PID:12656
- C:\Windows\System\nYAzaTq.exe
  C:\Windows\System\nYAzaTq.exe
  2⤵
  PID:12684
- C:\Windows\System\mZURgmU.exe
  C:\Windows\System\mZURgmU.exe
  2⤵
  PID:12720
- C:\Windows\System\ksuccMX.exe
  C:\Windows\System\ksuccMX.exe
  2⤵
  PID:12756
- C:\Windows\System\KpyZbKz.exe
  C:\Windows\System\KpyZbKz.exe
  2⤵
  PID:12780
- C:\Windows\System\FMcIjzr.exe
  C:\Windows\System\FMcIjzr.exe
  2⤵
  PID:12804
- C:\Windows\System\XaTAmhv.exe
  C:\Windows\System\XaTAmhv.exe
  2⤵
  PID:12844
- C:\Windows\System\ZJtCBPB.exe
  C:\Windows\System\ZJtCBPB.exe
  2⤵
  PID:12860
- C:\Windows\System\YTbgmqK.exe
  C:\Windows\System\YTbgmqK.exe
  2⤵
  PID:12896
- C:\Windows\System\cBafDlX.exe
  C:\Windows\System\cBafDlX.exe
  2⤵
  PID:12928
- C:\Windows\System\tHdADsj.exe
  C:\Windows\System\tHdADsj.exe
  2⤵
  PID:12948
- C:\Windows\System\cueduyS.exe
  C:\Windows\System\cueduyS.exe
  2⤵
  PID:12988
- C:\Windows\System\AauziDz.exe
  C:\Windows\System\AauziDz.exe
  2⤵
  PID:13008
- C:\Windows\System\RZUaubr.exe
  C:\Windows\System\RZUaubr.exe
  2⤵
  PID:13032
- C:\Windows\System\WxZZMCX.exe
  C:\Windows\System\WxZZMCX.exe
  2⤵
  PID:13064
- C:\Windows\System\VrmPJGv.exe
  C:\Windows\System\VrmPJGv.exe
  2⤵
  PID:13084
- C:\Windows\System\vdZlxtl.exe
  C:\Windows\System\vdZlxtl.exe
  2⤵
  PID:13112
- C:\Windows\System\LfKKFba.exe
  C:\Windows\System\LfKKFba.exe
  2⤵
  PID:13136
- C:\Windows\System\lGhPBDp.exe
  C:\Windows\System\lGhPBDp.exe
  2⤵
  PID:13160
- C:\Windows\System\dKaFYbr.exe
  C:\Windows\System\dKaFYbr.exe
  2⤵
  PID:13184
- C:\Windows\System\mIHmsZp.exe
  C:\Windows\System\mIHmsZp.exe
  2⤵
  PID:13212
- C:\Windows\System\xciGlhK.exe
  C:\Windows\System\xciGlhK.exe
  2⤵
  PID:13252
- C:\Windows\System\imuUlRK.exe
  C:\Windows\System\imuUlRK.exe
  2⤵
  PID:13276
- C:\Windows\System\ftbLhor.exe
  C:\Windows\System\ftbLhor.exe
  2⤵
  PID:12348
- C:\Windows\System\qYFwGKa.exe
  C:\Windows\System\qYFwGKa.exe
  2⤵
  PID:12380
- C:\Windows\System\TONZZqI.exe
  C:\Windows\System\TONZZqI.exe
  2⤵
  PID:12440
- C:\Windows\System\IXLtNvB.exe
  C:\Windows\System\IXLtNvB.exe
  2⤵
  PID:12480
- C:\Windows\System\RQYrGNe.exe
  C:\Windows\System\RQYrGNe.exe
  2⤵
  PID:12544
- C:\Windows\System\oyuqQMk.exe
  C:\Windows\System\oyuqQMk.exe
  2⤵
  PID:12616
- C:\Windows\System\PdUAuKe.exe
  C:\Windows\System\PdUAuKe.exe
  2⤵
  PID:12732
- C:\Windows\System\mkTGmrs.exe
  C:\Windows\System\mkTGmrs.exe
  2⤵
  PID:12768
- C:\Windows\System\YohEZos.exe
  C:\Windows\System\YohEZos.exe
  2⤵
  PID:12852
- C:\Windows\System\qXPBWRs.exe
  C:\Windows\System\qXPBWRs.exe
  2⤵
  PID:12924
- C:\Windows\System\pHifKEb.exe
  C:\Windows\System\pHifKEb.exe
  2⤵
  PID:12944
- C:\Windows\System\yLVYzxf.exe
  C:\Windows\System\yLVYzxf.exe
  2⤵
  PID:13028
- C:\Windows\System\vsfnzFu.exe
  C:\Windows\System\vsfnzFu.exe
  2⤵
  PID:13076
- C:\Windows\System\EvzScoW.exe
  C:\Windows\System\EvzScoW.exe
  2⤵
  PID:13132
- C:\Windows\System\ntxgxHX.exe
  C:\Windows\System\ntxgxHX.exe
  2⤵
  PID:13236
- C:\Windows\System\NKAYpzu.exe
  C:\Windows\System\NKAYpzu.exe
  2⤵
  PID:13272
- C:\Windows\System\wuBQRwr.exe
  C:\Windows\System\wuBQRwr.exe
  2⤵
  PID:12404
- C:\Windows\System\wgaUhQX.exe
  C:\Windows\System\wgaUhQX.exe
  2⤵
  PID:12592
- C:\Windows\System\AgdiGDx.exe
  C:\Windows\System\AgdiGDx.exe
  2⤵
  PID:12708
- C:\Windows\System\nmFXGhI.exe
  C:\Windows\System\nmFXGhI.exe
  2⤵
  PID:12816
- C:\Windows\System\zQSjwKl.exe
  C:\Windows\System\zQSjwKl.exe
  2⤵
  PID:12980
- C:\Windows\System\lTjZgDI.exe
  C:\Windows\System\lTjZgDI.exe
  2⤵
  PID:13172
- C:\Windows\System\WiPzFXI.exe
  C:\Windows\System\WiPzFXI.exe
  2⤵
  PID:13304
- C:\Windows\System\VRMgIpM.exe
  C:\Windows\System\VRMgIpM.exe
  2⤵
  PID:12448
- C:\Windows\System\KxbiQjh.exe
  C:\Windows\System\KxbiQjh.exe
  2⤵
  PID:12972
- C:\Windows\System\qOaZCLG.exe
  C:\Windows\System\qOaZCLG.exe
  2⤵
  PID:13156
- C:\Windows\System\BaOaNWN.exe
  C:\Windows\System\BaOaNWN.exe
  2⤵
  PID:13316
- C:\Windows\System\kXIsaAs.exe
  C:\Windows\System\kXIsaAs.exe
  2⤵
  PID:13336
- C:\Windows\System\HlnHuQk.exe
  C:\Windows\System\HlnHuQk.exe
  2⤵
  PID:13372
- C:\Windows\System\CTaSDuq.exe
  C:\Windows\System\CTaSDuq.exe
  2⤵
  PID:13400
- C:\Windows\System\qflfNda.exe
  C:\Windows\System\qflfNda.exe
  2⤵
  PID:13420
- C:\Windows\System\xWsBLZr.exe
  C:\Windows\System\xWsBLZr.exe
  2⤵
  PID:13444
- C:\Windows\System\rEgaiiA.exe
  C:\Windows\System\rEgaiiA.exe
  2⤵
  PID:13468
- C:\Windows\System\BgsDnZZ.exe
  C:\Windows\System\BgsDnZZ.exe
  2⤵
  PID:13516
- C:\Windows\System\kyttuDQ.exe
  C:\Windows\System\kyttuDQ.exe
  2⤵
  PID:13544
- C:\Windows\System\gHZEBaJ.exe
  C:\Windows\System\gHZEBaJ.exe
  2⤵
  PID:13564
- C:\Windows\System\OdelOOg.exe
  C:\Windows\System\OdelOOg.exe
  2⤵
  PID:13588
- C:\Windows\System\JALMmLm.exe
  C:\Windows\System\JALMmLm.exe
  2⤵
  PID:13612
- C:\Windows\System\NAYpJNN.exe
  C:\Windows\System\NAYpJNN.exe
  2⤵
  PID:13632
- C:\Windows\System\LnssGnu.exe
  C:\Windows\System\LnssGnu.exe
  2⤵
  PID:13668
- C:\Windows\System\iKvWqkY.exe
  C:\Windows\System\iKvWqkY.exe
  2⤵
  PID:13688
- C:\Windows\System\pcVHvTe.exe
  C:\Windows\System\pcVHvTe.exe
  2⤵
  PID:13712
- C:\Windows\System\LpOCLok.exe
  C:\Windows\System\LpOCLok.exe
  2⤵
  PID:13728
- C:\Windows\System\PKGqeHc.exe
  C:\Windows\System\PKGqeHc.exe
  2⤵
  PID:13756
- C:\Windows\System\CDJFowV.exe
  C:\Windows\System\CDJFowV.exe
  2⤵
  PID:13772
- C:\Windows\System\vUQcKZf.exe
  C:\Windows\System\vUQcKZf.exe
  2⤵
  PID:13796
- C:\Windows\System\CtuEDme.exe
  C:\Windows\System\CtuEDme.exe
  2⤵
  PID:13820
- C:\Windows\System\zAGgPMV.exe
  C:\Windows\System\zAGgPMV.exe
  2⤵
  PID:13840
- C:\Windows\System\jZEonsj.exe
  C:\Windows\System\jZEonsj.exe
  2⤵
  PID:13860
- C:\Windows\System\gITnllw.exe
  C:\Windows\System\gITnllw.exe
  2⤵
  PID:13884
- C:\Windows\System\bIdrNnq.exe
  C:\Windows\System\bIdrNnq.exe
  2⤵
  PID:13912
- C:\Windows\System\hOTIPmy.exe
  C:\Windows\System\hOTIPmy.exe
  2⤵
  PID:13940
- C:\Windows\System\eqYdOxJ.exe
  C:\Windows\System\eqYdOxJ.exe
  2⤵
  PID:13980
- C:\Windows\System\UIspAjA.exe
  C:\Windows\System\UIspAjA.exe
  2⤵
  PID:14000
- C:\Windows\System\EGBbIFv.exe
  C:\Windows\System\EGBbIFv.exe
  2⤵
  PID:14020
- C:\Windows\System\uGbNQVZ.exe
  C:\Windows\System\uGbNQVZ.exe
  2⤵
  PID:14040
- C:\Windows\System\YJENskV.exe
  C:\Windows\System\YJENskV.exe
  2⤵
  PID:14068
- C:\Windows\System\emWmmVf.exe
  C:\Windows\System\emWmmVf.exe
  2⤵
  PID:14092
- C:\Windows\System\EpZfsSj.exe
  C:\Windows\System\EpZfsSj.exe
  2⤵
  PID:14116
- C:\Windows\System\loolYhS.exe
  C:\Windows\System\loolYhS.exe
  2⤵
  PID:14132
- C:\Windows\System\rokLXTb.exe
  C:\Windows\System\rokLXTb.exe
  2⤵
  PID:14156
- C:\Windows\System\dTPVpIY.exe
  C:\Windows\System\dTPVpIY.exe
  2⤵
  PID:14188
- C:\Windows\System\nibyMir.exe
  C:\Windows\System\nibyMir.exe
  2⤵
  PID:14216
- C:\Windows\System\ZyOKmaP.exe
  C:\Windows\System\ZyOKmaP.exe
  2⤵
  PID:14252
- C:\Windows\System\qjiNsRv.exe
  C:\Windows\System\qjiNsRv.exe
  2⤵
  PID:14272
- C:\Windows\System\SofMVIB.exe
  C:\Windows\System\SofMVIB.exe
  2⤵
  PID:14304
- C:\Windows\System\wtXeqEc.exe
  C:\Windows\System\wtXeqEc.exe
  2⤵
  PID:14324
- C:\Windows\System\WmyOakb.exe
  C:\Windows\System\WmyOakb.exe
  2⤵
  PID:12788
- C:\Windows\System\ZQtBita.exe
  C:\Windows\System\ZQtBita.exe
  2⤵
  PID:13324
- C:\Windows\System\LIbpURZ.exe
  C:\Windows\System\LIbpURZ.exe
  2⤵
  PID:13388
- C:\Windows\System\yOYLWUi.exe
  C:\Windows\System\yOYLWUi.exe
  2⤵
  PID:13440
- C:\Windows\System\kUwHVno.exe
  C:\Windows\System\kUwHVno.exe
  2⤵
  PID:13496
- C:\Windows\System\davDhmh.exe
  C:\Windows\System\davDhmh.exe
  2⤵
  PID:14016
- C:\Windows\System\WTUfcjL.exe
  C:\Windows\System\WTUfcjL.exe
  2⤵
  PID:13948
- C:\Windows\System\bEsQzLN.exe
  C:\Windows\System\bEsQzLN.exe
  2⤵
  PID:14112
- C:\Windows\System\InVGDWX.exe
  C:\Windows\System\InVGDWX.exe
  2⤵
  PID:14184
- C:\Windows\System\obFfXTd.exe
  C:\Windows\System\obFfXTd.exe
  2⤵
  PID:14084
- C:\Windows\System\YvRZkVa.exe
  C:\Windows\System\YvRZkVa.exe
  2⤵
  PID:14268
- C:\Windows\System\fYTURgL.exe
  C:\Windows\System\fYTURgL.exe
  2⤵
  PID:14172
- C:\Windows\System\lxSeyvA.exe
  C:\Windows\System\lxSeyvA.exe
  2⤵
  PID:14260
- C:\Windows\System\mRCURlg.exe
  C:\Windows\System\mRCURlg.exe
  2⤵
  PID:14300
- C:\Windows\System\LulRMgq.exe
  C:\Windows\System\LulRMgq.exe
  2⤵
  PID:12596
- C:\Windows\System\NVtGxwN.exe
  C:\Windows\System\NVtGxwN.exe
  2⤵
  PID:13248
- C:\Windows\System\KGzrzpg.exe
  C:\Windows\System\KGzrzpg.exe
  2⤵
  PID:13676
- C:\Windows\System\mGJkeAC.exe
  C:\Windows\System\mGJkeAC.exe
  2⤵
  PID:13856
- C:\Windows\System\WorBtnM.exe
  C:\Windows\System\WorBtnM.exe
  2⤵
  PID:13936
- C:\Windows\System\rffiSxz.exe
  C:\Windows\System\rffiSxz.exe
  2⤵
  PID:13988
- C:\Windows\System\KIvkdMg.exe
  C:\Windows\System\KIvkdMg.exe
  2⤵
  PID:14124
- C:\Windows\System\MIhcgsI.exe
  C:\Windows\System\MIhcgsI.exe
  2⤵
  PID:14228
- C:\Windows\System\KRNPNPF.exe
  C:\Windows\System\KRNPNPF.exe
  2⤵
  PID:14148
- C:\Windows\System\xsgZzui.exe
  C:\Windows\System\xsgZzui.exe
  2⤵
  PID:13408
- C:\Windows\System\JMuQMuY.exe
  C:\Windows\System\JMuQMuY.exe
  2⤵
  PID:14348
- C:\Windows\System\Rrggdiz.exe
  C:\Windows\System\Rrggdiz.exe
  2⤵
  PID:14372
- C:\Windows\System\JLNCdPS.exe
  C:\Windows\System\JLNCdPS.exe
  2⤵
  PID:14392
- C:\Windows\System\vKbytlQ.exe
  C:\Windows\System\vKbytlQ.exe
  2⤵
  PID:14436
- C:\Windows\System\TabpNLw.exe
  C:\Windows\System\TabpNLw.exe
  2⤵
  PID:14456
- C:\Windows\System\HiQprnv.exe
  C:\Windows\System\HiQprnv.exe
  2⤵
  PID:14472
- C:\Windows\System\AFmhhdA.exe
  C:\Windows\System\AFmhhdA.exe
  2⤵
  PID:14496
- C:\Windows\System\hMULhlW.exe
  C:\Windows\System\hMULhlW.exe
  2⤵
  PID:14520
- C:\Windows\System\qzoEric.exe
  C:\Windows\System\qzoEric.exe
  2⤵
  PID:14544
- C:\Windows\System\unlbLuf.exe
  C:\Windows\System\unlbLuf.exe
  2⤵
  PID:14568
- C:\Windows\System\eeWGxgm.exe
  C:\Windows\System\eeWGxgm.exe
  2⤵
  PID:14584
- C:\Windows\System\GoaWcok.exe
  C:\Windows\System\GoaWcok.exe
  2⤵
  PID:14608
- C:\Windows\System\BeyuTWU.exe
  C:\Windows\System\BeyuTWU.exe
  2⤵
  PID:14624
- C:\Windows\System\jiuZWVL.exe
  C:\Windows\System\jiuZWVL.exe
  2⤵
  PID:14648
- C:\Windows\System\ecEmKoc.exe
  C:\Windows\System\ecEmKoc.exe
  2⤵
  PID:14680
- C:\Windows\System\jGDRoAW.exe
  C:\Windows\System\jGDRoAW.exe
  2⤵
  PID:14700
- C:\Windows\System\WRMCMwr.exe
  C:\Windows\System\WRMCMwr.exe
  2⤵
  PID:14728
- C:\Windows\System\auuMscI.exe
  C:\Windows\System\auuMscI.exe
  2⤵
  PID:14744
- C:\Windows\System\fpLyrAw.exe
  C:\Windows\System\fpLyrAw.exe
  2⤵
  PID:14768
- C:\Windows\System\yJUQfKj.exe
  C:\Windows\System\yJUQfKj.exe
  2⤵
  PID:14784
- C:\Windows\System\SMMtOGn.exe
  C:\Windows\System\SMMtOGn.exe
  2⤵
  PID:14808
- C:\Windows\System\bXrKWpP.exe
  C:\Windows\System\bXrKWpP.exe
  2⤵
  PID:14828
- C:\Windows\System\FqkboCD.exe
  C:\Windows\System\FqkboCD.exe
  2⤵
  PID:14868
- C:\Windows\System\oUtUlPI.exe
  C:\Windows\System\oUtUlPI.exe
  2⤵
  PID:14892
- C:\Windows\System\nMdjYsG.exe
  C:\Windows\System\nMdjYsG.exe
  2⤵
  PID:14908
- C:\Windows\System\aSFXZzj.exe
  C:\Windows\System\aSFXZzj.exe
  2⤵
  PID:14924
- C:\Windows\System\XkPSffE.exe
  C:\Windows\System\XkPSffE.exe
  2⤵
  PID:14940
- C:\Windows\System\SlvQfjF.exe
  C:\Windows\System\SlvQfjF.exe
  2⤵
  PID:14960
- C:\Windows\System\kbvqufn.exe
  C:\Windows\System\kbvqufn.exe
  2⤵
  PID:14984
- C:\Windows\System\ueFigfZ.exe
  C:\Windows\System\ueFigfZ.exe
  2⤵
  PID:15024
- C:\Windows\System\qfKsrtl.exe
  C:\Windows\System\qfKsrtl.exe
  2⤵
  PID:15048
- C:\Windows\System\XXLhKrc.exe
  C:\Windows\System\XXLhKrc.exe
  2⤵
  PID:15068
- C:\Windows\System\EPsgJUW.exe
  C:\Windows\System\EPsgJUW.exe
  2⤵
  PID:15092
- C:\Windows\System\rfAmeWW.exe
  C:\Windows\System\rfAmeWW.exe
  2⤵
  PID:15120
- C:\Windows\System\ssSIzbp.exe
  C:\Windows\System\ssSIzbp.exe
  2⤵
  PID:15148
- C:\Windows\System\HLsAIUt.exe
  C:\Windows\System\HLsAIUt.exe
  2⤵
  PID:15164
- C:\Windows\System\NDMynlg.exe
  C:\Windows\System\NDMynlg.exe
  2⤵
  PID:15192
- C:\Windows\System\AgIzbJK.exe
  C:\Windows\System\AgIzbJK.exe
  2⤵
  PID:15216
- C:\Windows\System\jmcwext.exe
  C:\Windows\System\jmcwext.exe
  2⤵
  PID:15240
- C:\Windows\System\DirxXaB.exe
  C:\Windows\System\DirxXaB.exe
  2⤵
  PID:15268
- C:\Windows\System\zLlHQfb.exe
  C:\Windows\System\zLlHQfb.exe
  2⤵
  PID:15292
- C:\Windows\System\Kolcsgr.exe
  C:\Windows\System\Kolcsgr.exe
  2⤵
  PID:15316
- C:\Windows\System\mhExqeB.exe
  C:\Windows\System\mhExqeB.exe
  2⤵
  PID:15356
- C:\Windows\System\YuQRXIJ.exe
  C:\Windows\System\YuQRXIJ.exe
  2⤵
  PID:14288
- C:\Windows\System\yynSDdg.exe
  C:\Windows\System\yynSDdg.exe
  2⤵
  PID:14448
- C:\Windows\System\OOWxmNR.exe
  C:\Windows\System\OOWxmNR.exe
  2⤵
  PID:14400
- C:\Windows\System\YtnzEyP.exe
  C:\Windows\System\YtnzEyP.exe
  2⤵
  PID:14516
- C:\Windows\System\iCAaQrD.exe
  C:\Windows\System\iCAaQrD.exe
  2⤵
  PID:14468
- C:\Windows\System\pxtERkl.exe
  C:\Windows\System\pxtERkl.exe
  2⤵
  PID:3492
- C:\Windows\System\iIJwvTb.exe
  C:\Windows\System\iIJwvTb.exe
  2⤵
  PID:14536
- C:\Windows\System\wKkXSfN.exe
  C:\Windows\System\wKkXSfN.exe
  2⤵
  PID:14576
- C:\Windows\System\SoxwGWN.exe
  C:\Windows\System\SoxwGWN.exe
  2⤵
  PID:14668
- C:\Windows\System\BlPOZva.exe
  C:\Windows\System\BlPOZva.exe
  2⤵
  PID:14600
- C:\Windows\System\kijAjTX.exe
  C:\Windows\System\kijAjTX.exe
  2⤵
  PID:14948
- C:\Windows\System\SUaNaXM.exe
  C:\Windows\System\SUaNaXM.exe
  2⤵
  PID:14856
- C:\Windows\System\KkaIXoW.exe
  C:\Windows\System\KkaIXoW.exe
  2⤵
  PID:14752
- C:\Windows\System\AppSoxt.exe
  C:\Windows\System\AppSoxt.exe
  2⤵
  PID:15060
- C:\Windows\System\aljmKSO.exe
  C:\Windows\System\aljmKSO.exe
  2⤵
  PID:15088
- C:\Windows\System\DIEUCPb.exe
  C:\Windows\System\DIEUCPb.exe
  2⤵
  PID:15176
- C:\Windows\System\ftngvPM.exe
  C:\Windows\System\ftngvPM.exe
  2⤵
  PID:15256
- C:\Windows\System\gLILNNI.exe
  C:\Windows\System\gLILNNI.exe
  2⤵
  PID:15312
- C:\Windows\System\dTWZohQ.exe
  C:\Windows\System\dTWZohQ.exe
  2⤵
  PID:14012
- C:\Windows\System\KRSmQep.exe
  C:\Windows\System\KRSmQep.exe
  2⤵
  PID:15036
- C:\Windows\System\OqByMFj.exe
  C:\Windows\System\OqByMFj.exe
  2⤵
  PID:14484
- C:\Windows\System\CrckwBf.exe
  C:\Windows\System\CrckwBf.exe
  2⤵
  PID:15376
- C:\Windows\System\DjzCjTf.exe
  C:\Windows\System\DjzCjTf.exe
  2⤵
  PID:15396
- C:\Windows\System\DytVvpg.exe
  C:\Windows\System\DytVvpg.exe
  2⤵
  PID:15412
- C:\Windows\System\LFApytT.exe
  C:\Windows\System\LFApytT.exe
  2⤵
  PID:15440
- C:\Windows\System\NvoYdsK.exe
  C:\Windows\System\NvoYdsK.exe
  2⤵
  PID:15464
- C:\Windows\System\TuBRcQk.exe
  C:\Windows\System\TuBRcQk.exe
  2⤵
  PID:15484
- C:\Windows\System\oGJFiHg.exe
  C:\Windows\System\oGJFiHg.exe
  2⤵
  PID:15512
- C:\Windows\System\ouxrDWp.exe
  C:\Windows\System\ouxrDWp.exe
  2⤵
  PID:15540
- C:\Windows\System\raXlSbN.exe
  C:\Windows\System\raXlSbN.exe
  2⤵
  PID:15572
- C:\Windows\System\TmuPvnG.exe
  C:\Windows\System\TmuPvnG.exe
  2⤵
  PID:15588
- C:\Windows\System\nWRzROB.exe
  C:\Windows\System\nWRzROB.exe
  2⤵
  PID:15608
- C:\Windows\System\FggyHoW.exe
  C:\Windows\System\FggyHoW.exe
  2⤵
  PID:15628
- C:\Windows\System\gxnSHQS.exe
  C:\Windows\System\gxnSHQS.exe
  2⤵
  PID:15656
- C:\Windows\System\IokXETj.exe
  C:\Windows\System\IokXETj.exe
  2⤵
  PID:15684
- C:\Windows\System\ArIeQDq.exe
  C:\Windows\System\ArIeQDq.exe
  2⤵
  PID:15708
- C:\Windows\System\FQSnNiE.exe
  C:\Windows\System\FQSnNiE.exe
  2⤵
  PID:15744
- C:\Windows\System\xbJukWA.exe
  C:\Windows\System\xbJukWA.exe
  2⤵
  PID:15764
- C:\Windows\System\uPmcvOi.exe
  C:\Windows\System\uPmcvOi.exe
  2⤵
  PID:15780
- C:\Windows\System\KKpwxIw.exe
  C:\Windows\System\KKpwxIw.exe
  2⤵
  PID:15804
- C:\Windows\System\JrnIVqS.exe
  C:\Windows\System\JrnIVqS.exe
  2⤵
  PID:15832
- C:\Windows\System\JMzEySe.exe
  C:\Windows\System\JMzEySe.exe
  2⤵
  PID:15852
- C:\Windows\System\mbugGoQ.exe
  C:\Windows\System\mbugGoQ.exe
  2⤵
  PID:15876
- C:\Windows\System\joQFaKO.exe
  C:\Windows\System\joQFaKO.exe
  2⤵
  PID:15896
- C:\Windows\System\mVwzhuT.exe
  C:\Windows\System\mVwzhuT.exe
  2⤵
  PID:15924
- C:\Windows\System\hczaLPh.exe
  C:\Windows\System\hczaLPh.exe
  2⤵
  PID:15940
- C:\Windows\System\OTbGfoe.exe
  C:\Windows\System\OTbGfoe.exe
  2⤵
  PID:15960
- C:\Windows\System\CfWjnYJ.exe
  C:\Windows\System\CfWjnYJ.exe
  2⤵
  PID:15984
- C:\Windows\System\IzCczyp.exe
  C:\Windows\System\IzCczyp.exe
  2⤵
  PID:16000
- C:\Windows\System\CplGUAF.exe
  C:\Windows\System\CplGUAF.exe
  2⤵
  PID:16024
- C:\Windows\System\LOzoluL.exe
  C:\Windows\System\LOzoluL.exe
  2⤵
  PID:16052
- C:\Windows\System\bhUYfaf.exe
  C:\Windows\System\bhUYfaf.exe
  2⤵
  PID:16068
- C:\Windows\System\LiqpOjR.exe
  C:\Windows\System\LiqpOjR.exe
  2⤵
  PID:16084
- C:\Windows\System\bSklXvT.exe
  C:\Windows\System\bSklXvT.exe
  2⤵
  PID:16108
- C:\Windows\System\YriXDQS.exe
  C:\Windows\System\YriXDQS.exe
  2⤵
  PID:16124
- C:\Windows\System\uQSjCDo.exe
  C:\Windows\System\uQSjCDo.exe
  2⤵
  PID:16156
- C:\Windows\System\vjmTBXK.exe
  C:\Windows\System\vjmTBXK.exe
  2⤵
  PID:16184
- C:\Windows\System\HIcbjfJ.exe
  C:\Windows\System\HIcbjfJ.exe
  2⤵
  PID:16204
- C:\Windows\System\BrbsnXi.exe
  C:\Windows\System\BrbsnXi.exe
  2⤵
  PID:16236
- C:\Windows\System\uLKfmph.exe
  C:\Windows\System\uLKfmph.exe
  2⤵
  PID:16264
- C:\Windows\System\mCJVGdi.exe
  C:\Windows\System\mCJVGdi.exe
  2⤵
  PID:16280
- C:\Windows\System\MLUDsON.exe
  C:\Windows\System\MLUDsON.exe
  2⤵
  PID:16296
- C:\Windows\System\rpjReFs.exe
  C:\Windows\System\rpjReFs.exe
  2⤵
  PID:16312
- C:\Windows\System\spscUoH.exe
  C:\Windows\System\spscUoH.exe
  2⤵
  PID:16332
- C:\Windows\System\plkDFka.exe
  C:\Windows\System\plkDFka.exe
  2⤵
  PID:16352
- C:\Windows\System\molTlyU.exe
  C:\Windows\System\molTlyU.exe
  2⤵
  PID:16372
- C:\Windows\System\xytbslu.exe
  C:\Windows\System\xytbslu.exe
  2⤵
  PID:15348
- C:\Windows\System\CjJIElz.exe
  C:\Windows\System\CjJIElz.exe
  2⤵
  PID:15136
- C:\Windows\System\ecybPTp.exe
  C:\Windows\System\ecybPTp.exe
  2⤵
  PID:14740
- C:\Windows\System\BHROPHB.exe
  C:\Windows\System\BHROPHB.exe
  2⤵
  PID:14864
- C:\Windows\System\OgfElnO.exe
  C:\Windows\System\OgfElnO.exe
  2⤵
  PID:2252
- C:\Windows\System\mcztwFe.exe
  C:\Windows\System\mcztwFe.exe
  2⤵
  PID:13552
- C:\Windows\System\lQwHRBO.exe
  C:\Windows\System\lQwHRBO.exe
  2⤵
  PID:14380
- C:\Windows\System\fBFMcgZ.exe
  C:\Windows\System\fBFMcgZ.exe
  2⤵
  PID:15424
- C:\Windows\System\JSYjBOE.exe
  C:\Windows\System\JSYjBOE.exe
  2⤵
  PID:15456
- C:\Windows\System\rrQBPhT.exe
  C:\Windows\System\rrQBPhT.exe
  2⤵
  PID:15284
- C:\Windows\System\tXCAEar.exe
  C:\Windows\System\tXCAEar.exe
  2⤵
  PID:15564
- C:\Windows\System\RDEVjnJ.exe
  C:\Windows\System\RDEVjnJ.exe
  2⤵
  PID:15664
- C:\Windows\System\bsSruBP.exe
  C:\Windows\System\bsSruBP.exe
  2⤵
  PID:15676
- C:\Windows\System\DWxHZMD.exe
  C:\Windows\System\DWxHZMD.exe
  2⤵
  PID:14644
- C:\Windows\System\abvGliT.exe
  C:\Windows\System\abvGliT.exe
  2⤵
  PID:14736
- C:\Windows\System\zvjroUw.exe
  C:\Windows\System\zvjroUw.exe
  2⤵
  PID:15452
- C:\Windows\System\uUECuTj.exe
  C:\Windows\System\uUECuTj.exe
  2⤵
  PID:15520
- C:\Windows\System\QBZitfV.exe
  C:\Windows\System\QBZitfV.exe
  2⤵
  PID:16020
- C:\Windows\System\FCHhFmt.exe
  C:\Windows\System\FCHhFmt.exe
  2⤵
  PID:15648
- C:\Windows\System\adBAcZn.exe
  C:\Windows\System\adBAcZn.exe
  2⤵
  PID:16172
- C:\Windows\System\njACcqu.exe
  C:\Windows\System\njACcqu.exe
  2⤵
  PID:16212
- C:\Windows\System\ELMDTrx.exe
  C:\Windows\System\ELMDTrx.exe
  2⤵
  PID:16248
- C:\Windows\System\mqRvLqd.exe
  C:\Windows\System\mqRvLqd.exe
  2⤵
  PID:16388
- C:\Windows\System\phvUITD.exe
  C:\Windows\System\phvUITD.exe
  2⤵
  PID:16404
- C:\Windows\System\JYHYviM.exe
  C:\Windows\System\JYHYviM.exe
  2⤵
  PID:16420
- C:\Windows\System\VACSyYc.exe
  C:\Windows\System\VACSyYc.exe
  2⤵
  PID:16452
- C:\Windows\System\QmEUEVA.exe
  C:\Windows\System\QmEUEVA.exe
  2⤵
  PID:16472
- C:\Windows\System\TfusWAY.exe
  C:\Windows\System\TfusWAY.exe
  2⤵
  PID:16496
- C:\Windows\System\uJdlusB.exe
  C:\Windows\System\uJdlusB.exe
  2⤵
  PID:16532
- C:\Windows\System\qFnMesi.exe
  C:\Windows\System\qFnMesi.exe
  2⤵
  PID:16552
- C:\Windows\System\AqmqccJ.exe
  C:\Windows\System\AqmqccJ.exe
  2⤵
  PID:16576
- C:\Windows\System\xpSQWsI.exe
  C:\Windows\System\xpSQWsI.exe
  2⤵
  PID:16592
- C:\Windows\System\DgfdLhp.exe
  C:\Windows\System\DgfdLhp.exe
  2⤵
  PID:16612
- C:\Windows\System\nACsVxs.exe
  C:\Windows\System\nACsVxs.exe
  2⤵
  PID:16632
- C:\Windows\System\XObSsny.exe
  C:\Windows\System\XObSsny.exe
  2⤵
  PID:16664
- C:\Windows\System\mQvBFZU.exe
  C:\Windows\System\mQvBFZU.exe
  2⤵
  PID:16708
- C:\Windows\System\wAPLFGt.exe
  C:\Windows\System\wAPLFGt.exe
  2⤵
  PID:16736
- C:\Windows\System\UdURYli.exe
  C:\Windows\System\UdURYli.exe
  2⤵
  PID:16764
- C:\Windows\System\SvNjNfP.exe
  C:\Windows\System\SvNjNfP.exe
  2⤵
  PID:16784
- C:\Windows\System\BcFwUVo.exe
  C:\Windows\System\BcFwUVo.exe
  2⤵
  PID:16808
- C:\Windows\System\FudpIWU.exe
  C:\Windows\System\FudpIWU.exe
  2⤵
  PID:16824
- C:\Windows\System\HYStPRF.exe
  C:\Windows\System\HYStPRF.exe
  2⤵
  PID:16844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CBeWpOT.exe

Path C:\Windows\System\CBeWpOT.exe
Size 1.7MB
SHA256 b3e74ccac178a45921b0af910fc754c4f99120aa1cc8821a478f77a2bef3ac5b
MD5 59aa6f2ade08043a2afd6c1c49964344
SHA1 89b22a5aa12ef3466aba301538637e719361fa7e
SHA512 f163441f2d998481e315c5c2f6a52af5a9a1daf337e8c3fa525b65d065ad561377623b05f14c96307ab103188294427ce2c88692632815b521a7e74b91a61ff8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQH:GemTLkNdfE0pZyP
MD5 SHA1 SHA512 SSDEEP

Submit Download

DETpPqW.exe

Path C:\Windows\System\DETpPqW.exe
Size 1.7MB
SHA256 2ac99d0de6932d63a1478227661d69010538b573b072da2c29033fdb2524bf51
MD5 81a8a136f624d5d8c1eb2dd461da16ec
SHA1 9af61ead136ab8a42d38b2834b0b7a6b5e378e01
SHA512 dbd2cc4ef673b4946a1c601ceccc53a18137463a3be1de00e69d4607db7b6ff225488f467aa92b14450d787c6545709a04c2733d3cf7722d07d9ff93b6f58166
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQV:GemTLkNdfE0pZyN
MD5 SHA1 SHA512 SSDEEP

Submit Download

FwxiWog.exe

Path C:\Windows\System\FwxiWog.exe
Size 1.7MB
SHA256 a8d4b1863c08964a3cf1d758d17f4d3d33f911186b3006e220c9e9dace84f4cf
MD5 36a3c9b511bf1fa782b573eb45aa0172
SHA1 22b9b8eaf8f0572fc04906f9171563d85437daca
SHA512 6823fea886306f985983ddb389f5c3c2ebf4ee94c7675884d102d317dca64df14f99fc33d45807f727f127358473d7fe266dcd9e7e8f69e7c235f0ccbfd6ab7d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQy0:GemTLkNdfE0pZyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

JZjFZRi.exe

Path C:\Windows\System\JZjFZRi.exe
Size 1.7MB
SHA256 84466162bcae6cb27fe5274e420b66e10e55df8b49980d77c7cb28e1aa2f0483
MD5 f82e09d589274f7a69df13a9ff9700e7
SHA1 c8956606fa09a3e318bb13dad1897fe43c2d2dd5
SHA512 c3149d224d73d18c2d22586735d6ae0ff0d43d937b7383a03379b7629ada0f8ee76b4e95ea3ae6d834ae520ed6567d947fd8d91bbe10101a3dff3d8f8a3e5c98
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQz:GemTLkNdfE0pZyb
MD5 SHA1 SHA512 SSDEEP

Submit Download

JjHjJGl.exe

Path C:\Windows\System\JjHjJGl.exe
Size 1.7MB
SHA256 ccbda2490c0418fa9913a78de4b82d2f5f74371e09c12f485a557d2ddb681327
MD5 d5655397097ecbc5864d67d1ff51ac75
SHA1 b85041c7d2ddbe26156402c6a9d9ef8c63b7d817
SHA512 fe33ab85f5034c85a8fa2b85c7da12c8ca69397036d599c5430b0c8e5aa530326d8f6fea334a5a21883148203ac4c8bc947c5e476c6d2084117f93e5bf6cd177
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQB:GemTLkNdfE0pZyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

LVUrKVz.exe

Path C:\Windows\System\LVUrKVz.exe
Size 1.7MB
SHA256 ae715bb40838193541d8a758aa6311ee438d8c296902a815ef375b7d12676c38
MD5 4a90a0d3c880f24583432553eda8c62a
SHA1 a843ba87b1b3f6e901364954385e141662dfabfe
SHA512 8a05de40a40600b98cf2442be7084337dd815f7974a3b02d67016b1e99c055767de18790e8330f7c52d8aac853948f96c3384fc5b571768957cd8950fcd698ea
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQu:GemTLkNdfE0pZy2
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSKRcGn.exe

Path C:\Windows\System\MSKRcGn.exe
Size 1.7MB
SHA256 5a47de29de17cbd748c89d179716459da6f0dbe80786e85b6868459b7ba3adde
MD5 0204ec6fe531c2758dd76570d1743382
SHA1 1c7fa4abb784fff03091b30a1b60f174f40bb989
SHA512 6a357d2d6f97364f55792ad78c1482615415b6212cc6478d820da7eb2fd88ec3c4af0d3d8bcd267b3de55ac6b5360c580caf9e2938ed78ab76fc3e477f924658
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQ8:GemTLkNdfE0pZyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

NEixvVx.exe

Path C:\Windows\System\NEixvVx.exe
Size 1.7MB
SHA256 ad7ec9cf7243e7be86a2e849c4118f5e8e7e967d2b248d263064d7539ebd3053
MD5 41de6257fbeb6cd5c3f978ef7422c8bb
SHA1 08a29672921cac6073ad026cdbb3af9cef1923d0
SHA512 a89f5c803be22f565e02a7d1bca1d9d6ab3b765a5373af01465df2a26aa71e6a278ef0ab02bfdbe2ab62b6e0546b234275df96b1e507b35f43e85b29c5c00ff3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQm:GemTLkNdfE0pZye
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvfeNCw.exe

Path C:\Windows\System\NvfeNCw.exe
Size 1.7MB
SHA256 7e1a29a95b835a9d2a3ac36a527859401adcee4c3ca6e88b729219c2afaaa28e
MD5 9cd3ec323a3ebcc6c9a7089439f80c08
SHA1 9b063be1eb6dfbc308a04daecae677624ef7df58
SHA512 4600d006c32a389db4520741c0020f3e2bc580d4c08d0cb2b15585257f6b8d70328393de0a3b724477996a358985f0519904cb586f6707aa927d1ebad4f4794a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQh:GemTLkNdfE0pZyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

PUmcPJS.exe

Path C:\Windows\System\PUmcPJS.exe
Size 1.7MB
SHA256 5b6986b667a195f59c1b28f27cd3591ececf5cd2b6ad6ebfbe5f2c329c8fd760
MD5 264313f5c135d4676dced51eaba235ef
SHA1 613f50fd64d9050aff03593028a1008f6fcea58f
SHA512 b03a587c4c6c153b02606c0acb277691c172ee0c781b7a71e7a55fbc0ce6469181fdca8b7e7707d264a120964f95a25cf7659f1f2823dc777f6f12ff9da1e512
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQ8:GemTLkNdfE0pZyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

PsWJayb.exe

Path C:\Windows\System\PsWJayb.exe
Size 1.7MB
SHA256 ecec75ab01100faa532850a6bd63d6382e539c98e9cc61086a647fe6a9138472
MD5 37ef943534fd39f54537950c2fda20fc
SHA1 cc0d2a38fcb9e4f3b481d701cbee3a2479606d8c
SHA512 65a14d37830cdb6b96b215cc87c3e674bd299f6dafad13da68221cf3d97caff002e5409b247de23ac51cfbde84d79149730e47ce7fba34e28ef63121b96cc1a4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQfi:GemTLkNdfE0pZyy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScQCysH.exe

Path C:\Windows\System\ScQCysH.exe
Size 1.7MB
SHA256 fab29a7387cba75432006f882be435baf0baa39fe448e0a7dda1e013e62396b9
MD5 373a608d33aa8d4f58d360868a38091b
SHA1 3e7b45ac808141dfd7c3a628ab0ef46775331e14
SHA512 253d4684faaceb0ff0281f1c4f3748c420a9546d10450fda99b6f34ba13bc2544c86f0ac170c5e189489d7c23bd804cfa317d17908e7432ead12ea960ad5b8e4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQt:GemTLkNdfE0pZyF
MD5 SHA1 SHA512 SSDEEP

Submit Download

UXOxHDI.exe

Path C:\Windows\System\UXOxHDI.exe
Size 1.7MB
SHA256 9bbd617d43ee6e53c8352e35a29ad049ccb986e15bf332769188bf08db5e49e9
MD5 e02ca97bde7e03835d3767377143ca45
SHA1 863a06b163aed0447ef009b51c85165094df2b65
SHA512 1784f8d5eb577d78da6a67a5da8a86a26d235d900b761ab828a41a84e3fef6d6a6d3ebec98a83322666c862e2d8619e3033a36d21d9c59ba646e8b2c939f64f4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQ+:GemTLkNdfE0pZyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

VFFHhYl.exe

Path C:\Windows\System\VFFHhYl.exe
Size 1.7MB
SHA256 ff8fc28829414d6186f5ec492e5e7c97cf313cfecb108844ceac544ee71e63a8
MD5 b017e1ac82df8191f019ab3f522a5505
SHA1 f66baec18c2137130731d2d5e655acbaca10180e
SHA512 2cc0edc8eeda18a96e45828058e45bec327a160125757dfba995745667f80e1a969498bc37fd5495bf8e5e634fa1dafa3bdcf28e65b318cf0cf28796ebb47414
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQ7:GemTLkNdfE0pZyz
MD5 SHA1 SHA512 SSDEEP

Submit Download

XTEOKHT.exe

Path C:\Windows\System\XTEOKHT.exe
Size 1.7MB
SHA256 01509a9f5c9931b3b7a0de5220de216517b429cac361d743b7bfe8cbbc191313
MD5 4a927cc1f637688e00a38c6165562964
SHA1 6919b2269e8b04369129567d2e97d12de5e157d3
SHA512 2530723d7402a471e71dc6556aebfa0ebc0556b80e18b70367cbea2d95eed858cfe8c87e2eccea74e278479e3026e2599aee68d09fa56efe636dc24b34d4a917
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQ5:GemTLkNdfE0pZyB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZyiniFJ.exe

Path C:\Windows\System\ZyiniFJ.exe
Size 1.7MB
SHA256 192e506a254ef1db6d52909a3f3fa6607e59fae1ea9c7991dfbe159b3d8b3c94
MD5 f39584bde7ea8c2710197e370020b18a
SHA1 ced7daecbda7355e2845c81e06429c3da522de60
SHA512 78095dc43c989b4b2999a679bff25dbb99c5d19266997ff74f60c36b7f7fcd662ccaf5cfcdd016c524ff7544a4a8de9744f65bca9981e684b31e1b93c5e89a6c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQV:GemTLkNdfE0pZy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

aaXjhzW.exe

Path C:\Windows\System\aaXjhzW.exe
Size 1.7MB
SHA256 6914b48f205447f621c48004f94c7d681f3297e00513e4531f8339b973c7e1e3
MD5 4d0acb1af161673b8085cf039784e7ea
SHA1 bbf8b349ecfd3227ecbe35dec9bf2ba304547945
SHA512 eaf88fd315db0fa0a1d16480001c2772bf01c7f0460f5aa2db01fa8772e7a2c4e57fdda9ff910bf6170a24075ba2ed92f05609cb16deedd727d231a01c8590e2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQK:GemTLkNdfE0pZyC
MD5 SHA1 SHA512 SSDEEP

Submit Download

cDngDAR.exe

Path C:\Windows\System\cDngDAR.exe
Size 1.7MB
SHA256 85dc464d7823b67ab52113c60e032672036cdceb506d7fdcb1eab1c41d8b4d1c
MD5 a79ae7881be671a8bd765e027e4a44e9
SHA1 4e75832a2b1390c42567697206295538962af98e
SHA512 10151dc7d43c18a4793da1ddd78655a54810b5976e91239108056bc0aa915eb71248788a0b4eda24a20335f733b721951757f5e21af06bfab7fb9720eff76953
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQ4:GemTLkNdfE0pZyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dyMiWwy.exe

Path C:\Windows\System\dyMiWwy.exe
Size 1.7MB
SHA256 6b39820cad9d1aa45f808d667cec4a40acef3fa331c80f14c9b59489dce7bf5a
MD5 c6d7167f3b05f6f965b25f90485f69e9
SHA1 58cf89ba7565107182a04a58729cd1e62e65471f
SHA512 5f40fe38e5d713e12679ba61548b14027bd2e5ada85c0df7b8f4193bdfac1f6da3651a4c7e665e3e39e10d378672b944bc104502923f4b1bfe780ecf13cbf3c5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQC:GemTLkNdfE0pZya
MD5 SHA1 SHA512 SSDEEP

Submit Download

esNlcZb.exe

Path C:\Windows\System\esNlcZb.exe
Size 1.7MB
SHA256 c11e6e90a83b9452ef8a3e98b73ff5791c768d8de1569f8e38e5e8e1d69e63df
MD5 baedce9301cdd6fdc9d8ec598af1b5da
SHA1 cfb3d6663dd57f61b661f3268b7dc3aa05bc9556
SHA512 26ae49bedef83c06215f35541e8422ac7db74f083ffe127ab65213a474560f39388d2f793e30f07bca9fc78f9c02fc7bc2d4bb5da666829f418ae1521398d11c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQx:GemTLkNdfE0pZyJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hHfBcOp.exe

Path C:\Windows\System\hHfBcOp.exe
Size 1.7MB
SHA256 e2c576804104d4fac2b6855f2faa2332fd2277d62b4202cad106696a8fb27b5d
MD5 c8517d294caa148f4f149f08420cfd19
SHA1 334bb06798ab5a32da20cdce3f8ac128b5fe33d5
SHA512 41467a8da0e84b4f7864f937f7fbb94dd1cc7a794f8a887295a9c912bddbe87ef1f9f67f5f5b5c0a964dc490a508476a9622f7b3917a1b8e34e4721b3e64ad80
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQq:GemTLkNdfE0pZyC
MD5 SHA1 SHA512 SSDEEP

Submit Download

hljLGAD.exe

Path C:\Windows\System\hljLGAD.exe
Size 1.7MB
SHA256 abb92afd7c7f5731fa1ee3c1971e0eb39734d50e2c3fccdfaaa873b555209587
MD5 df1ad4d6d71ac8527f152a279c1f2a15
SHA1 7845eb61d78e1b216050102b3c6228b6924ee0e2
SHA512 3720b6fd5c5ef3940673e3978b94dbfe0b54439baa8b840def047742f6b23a315ff6e1f2a4dbb41005283f790732aec2d6f41c80cb463c495982676e4f66dedf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQ6:GemTLkNdfE0pZyS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lFlFTDp.exe

Path C:\Windows\System\lFlFTDp.exe
Size 1.7MB
SHA256 626cdadf806e2bb355c4c51afd72578466c2bcc5b688a992a43da6623cab9f7b
MD5 f95d50c759279c980f8ffd016d7d6404
SHA1 0a4fc91c35fd8627a5316d3358c04f8578382d2a
SHA512 d642ea397fbd8ee2282e251d0b1a75c880aa5f49b5ced57041e58424f384f2900fd9e2414de5ea70384f3ef9ad0365109e5aebfb12075e26588c67702dcce839
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQQ:GemTLkNdfE0pZyI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mOyRBmc.exe

Path C:\Windows\System\mOyRBmc.exe
Size 1.7MB
SHA256 81ef2f9ee54b61cb49c532a413d733641eeed800eb324591e99d125b1c3b096a
MD5 e836247da11ffd7f45950ba0a1927e27
SHA1 2ee81a0a5047413e1d276661e25514a21683212d
SHA512 54599f691d03e00aa82099ed1d0b778dd52a5a180b1708a95be1caef65755b0e0e7180fe4a5a1371219fdfe820a49b85a422e268088e751500b2073f67adc0e7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQoo:GemTLkNdfE0pZyb
MD5 SHA1 SHA512 SSDEEP

Submit Download

nMZRTLW.exe

Path C:\Windows\System\nMZRTLW.exe
Size 1.7MB
SHA256 b963d14929055833db704da8c9281dd63bcada3af8a376ee7e10c125f8c647d7
MD5 db209d96e4544b2aa422e8e6a6ebbbfa
SHA1 a0150a10b86b958bd58fa07312f6a77fe1c348fb
SHA512 f4d8af04b2070171b11968e265cffddc42372b1835b00c9d59e3af6b617de2c367b6888ba8dba911ce9c3a03e54e9ff9190728122283ed64944ab11917681c41
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQt:GemTLkNdfE0pZyF
MD5 SHA1 SHA512 SSDEEP

Submit Download

rcgAKcv.exe

Path C:\Windows\System\rcgAKcv.exe
Size 1.7MB
SHA256 33b2edd541caf07540d3a11d8cfc3d643b0e933813166c6b22320a37dbb04c14
MD5 aac7b6f0436a1b00cee7c19622a1e114
SHA1 37fede23ba65097c487441dc5d1079d1b53c6830
SHA512 c59808a8bbdbfec31fdaa9a7089041b5688e488704372cde9040e1f253d3b5bf1a1235182f14a090485f3f7dc6e36f1d59da08d6b8c3fed662629f31efa38f79
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQs:GemTLkNdfE0pZyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

sbrJVPH.exe

Path C:\Windows\System\sbrJVPH.exe
Size 1.7MB
SHA256 c809ebcd61e54cc1897aac4370552493f08bdd0db7780c8a5ec1b4b26eeb0b7c
MD5 7f8451e5a3b031e44a5f95eec40c53de
SHA1 c0d676daf8f46319dc42da408fa2afa64b39cbe6
SHA512 2e25f9120acfb40e79b129d5805b53c1f6e1d273f411e44b6daffb76988bb0e4d2c9911206d8c45850b9ad54a0e01dfaf630c06412b781e79e5b22b4ccbd72e2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQR:GemTLkNdfE0pZyZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tKkgaYH.exe

Path C:\Windows\System\tKkgaYH.exe
Size 1.7MB
SHA256 a9b54c36631c6ebd02fc7152ea95bf4038c9f3e2576d12dff8a03cdfa64f3d07
MD5 45cd097af237939ac444bb2269d3b7d6
SHA1 8d81ed44010adcc6d92e57010ab0789210cef9b3
SHA512 a6a4b7ee0a7fe25eebd8f2eb066ec02703688c6ec1d140c9e895fb0497e107f73963525088496d331496697d4ad8cef29d80cc2c610061b3bc6a1598ce15e17c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQr:GemTLkNdfE0pZyT
MD5 SHA1 SHA512 SSDEEP

Submit Download

uuPNLch.exe

Path C:\Windows\System\uuPNLch.exe
Size 1.7MB
SHA256 7435a794917f987c698f26c51266938498845775422717330d5e8d93af9016b2
MD5 beb2abc6f0d46aea50ba1fa1ba72da0b
SHA1 1b63ac82c33c04639cdff4c37754ab785820ebe3
SHA512 d8365bb13a012eec6459504b23fadfa15aff62369cf7e7fcc45d828d3265bbf8778135262c1603f0511126b0ed442ab2729e9e696484b14a2dc2f66af2522e24
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQH:GemTLkNdfE0pZyv
MD5 SHA1 SHA512 SSDEEP

Submit Download

vEBDFTv.exe

Path C:\Windows\System\vEBDFTv.exe
Size 1.7MB
SHA256 6afdedec4865dedc901ff0550dd8801a7c0e9941697c71bd92bf8a4b6d59346e
MD5 ec4a595a379c16c401e0492bac42107e
SHA1 c4c3f0a75137c152a812023a178297a43a81c25b
SHA512 cc5b4275f7a7eaaf7b702516cf264c770ac413c79ce14c5c65c19097a49ffe6bdfdf44eef433f7c755db7856073f34c5bc2db2addc0bdc06e5858e8db771f5ed
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQu:GemTLkNdfE0pZym
MD5 SHA1 SHA512 SSDEEP

Submit Download

xbJxGeQ.exe

Path C:\Windows\System\xbJxGeQ.exe
Size 1.7MB
SHA256 8b47a2ea56c18196c036ccedb63c386c590e195c3f0d51b9e9a21292d99cad47
MD5 2322fe6d4dc1b4f0cf55ea98a5780770
SHA1 627f133868ffcec541095950a02ede668932c2c1
SHA512 3cbc63010e27942dfdff136788606be8e559db7716792cac7d7460d71f67903709ab1f43b29cbbca4eeee7bcbc68ebc98d692e7039d0eaef451d0d7966afa58e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQP:GemTLkNdfE0pZyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

yHGJrFd.exe

Path C:\Windows\System\yHGJrFd.exe
Size 1.7MB
SHA256 f271368f267c05239db1b95ad7db1c5bf784669e8bee24a12e4f219bf920a3b7
MD5 ec5fc7c28e17ef1e38297c66fe8c68fe
SHA1 efa86b3dde4bb8f233a91d65d07f0c82ad481fbd
SHA512 950b0d208f0d84b559e04f83ecfa3babc8f7b96b0d6bd12ce9226848a933cce646af3449b554e0bd0d0ec75169b7b76e0d23762c0d064eb9b928e5a17141e457
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQo:GemTLkNdfE0pZyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zIfPECh.exe

Path C:\Windows\System\zIfPECh.exe
Size 1.7MB
SHA256 2651ace6b19c9a9804c18dca665e0c83024d0ca07cb040022b8b8cf6cca26857
MD5 062b9cbc0559027c72e4852947d236f3
SHA1 3579280c6a2bdf937b8649ba8d5df5e96b95614f
SHA512 135e4e9435a7c439619c1c3dc4cf6cbc92f30ff58737208046cd1291a772a8a7e70d9a4da654b0ec76f783aac9f76f4fb3bd90dc7aa0b6988ad5f2e4f3910363
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGQX:GemTLkNdfE0pZyf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1884-0-0x0000026F17C80000-0x0000026F17C90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads