xmrig | e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9

Analysis

max time kernel
94s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
Size

1.6MB
MD5

037c3d9480c701f6333d1e35d951e57b
SHA1

f4fda6035413b6f666059e9a79b6d2c63d8e3017
SHA256

e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9
SHA512

3d1f444f55a2a0273493755ff39a6c8ee12a9ab8de7e241cfb23b0b4f78f94f3503b9ef575d4714a532c058bf1db5dcb57a83e4b0140c4e31e88d2cb88ebf9ec
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQmnVwYCA:GemTLkNdfE0pZy7

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b80-4.dat	xmrig
behavioral2/files/0x000a000000023b85-6.dat	xmrig
behavioral2/files/0x000a000000023b84-14.dat	xmrig
behavioral2/files/0x000a000000023b87-25.dat	xmrig
behavioral2/files/0x000a000000023b86-23.dat	xmrig
behavioral2/files/0x000a000000023b88-29.dat	xmrig
behavioral2/files/0x000a000000023b8a-36.dat	xmrig
behavioral2/files/0x000a000000023b8b-42.dat	xmrig
behavioral2/files/0x000a000000023b8c-47.dat	xmrig
behavioral2/files/0x000a000000023b89-38.dat	xmrig
behavioral2/files/0x000a000000023b91-69.dat	xmrig
behavioral2/files/0x000a000000023b93-84.dat	xmrig
behavioral2/files/0x000a000000023b99-104.dat	xmrig
behavioral2/files/0x000a000000023b98-103.dat	xmrig
behavioral2/files/0x000a000000023b97-111.dat	xmrig
behavioral2/files/0x000a000000023b96-109.dat	xmrig
behavioral2/files/0x000a000000023b95-107.dat	xmrig
behavioral2/files/0x000a000000023b94-105.dat	xmrig
behavioral2/files/0x000a000000023b92-99.dat	xmrig
behavioral2/files/0x000a000000023b90-73.dat	xmrig
behavioral2/files/0x000b000000023b81-71.dat	xmrig
behavioral2/files/0x000a000000023b8f-67.dat	xmrig
behavioral2/files/0x000a000000023b8d-55.dat	xmrig
behavioral2/files/0x000a000000023b9a-119.dat	xmrig
behavioral2/files/0x000a000000023b9c-122.dat	xmrig
behavioral2/files/0x000b000000023ba0-140.dat	xmrig
behavioral2/files/0x000a000000023b9e-133.dat	xmrig
behavioral2/files/0x000a000000023b9f-137.dat	xmrig
behavioral2/files/0x000a000000023b9d-128.dat	xmrig
behavioral2/files/0x000e000000023bb1-159.dat	xmrig
behavioral2/files/0x0008000000023bba-163.dat	xmrig
behavioral2/files/0x000b000000023ba1-162.dat	xmrig
behavioral2/files/0x000a000000023baa-155.dat	xmrig
behavioral2/files/0x000b000000023ba2-151.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3984	aOFOPyL.exe
4240	LEbJDSG.exe
4464	FClDvBL.exe
2024	ZonAlvP.exe
3616	UxEkUXa.exe
1432	DTXFMsb.exe
1128	EfjpRaT.exe
2468	FAnaQzQ.exe
4964	NSAeOeh.exe
64	HwUpKTm.exe
1324	tZfSNtp.exe
1720	soxFiGO.exe
3228	kkEITHE.exe
3596	ytKgRdY.exe
1408	rFhdIXy.exe
800	OHvbzSA.exe
1816	UEfIfeb.exe
4076	RnmEebW.exe
4488	TGrpofs.exe
1560	xTvEJLM.exe
1972	yrGQVJy.exe
2144	BEZVoed.exe
4460	DbWClDK.exe
1808	OoYQtOX.exe
3784	ENYoJPR.exe
1920	TBvrCUt.exe
996	ufsBDCq.exe
4276	ueXpaIi.exe
3744	EMXBvsS.exe
4376	SemaBoO.exe
4324	KSDLFWz.exe
1296	KxCSxsG.exe
688	PnUzJnO.exe
2440	xUAyzRu.exe
1976	TzqaWqd.exe
4568	reGYGrb.exe
4896	qsNqQRU.exe
4000	iTuUdHV.exe
2012	oEmZtaJ.exe
1892	NjWukDF.exe
4800	iuBPFum.exe
3208	VaXeFSI.exe
3160	upvQoxv.exe
3212	DfhfHjm.exe
2796	TeAmAZe.exe
4060	ieHeeTQ.exe
3108	XBRovGX.exe
2852	rSPYrXl.exe
3884	wmwTEje.exe
4040	pgbQCZZ.exe
2720	FgeUTUn.exe
2932	GnpwWku.exe
1500	sZkgaWA.exe
412	nYatrYP.exe
1336	MJawhvD.exe
2156	pzvAghT.exe
1624	kLjtbtP.exe
4408	UyDTpVj.exe
4884	YFrlcZv.exe
5024	AaMQHFT.exe
2052	CnwnePP.exe
3624	wQcGedr.exe
4768	XcUvKCB.exe
3560	oMcGdTg.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GkTsNDu.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\tLdzHyn.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\oBJIVJm.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\kHSePCf.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\sYpFLnO.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\UXqNBpo.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\oEmZtaJ.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\EhgcgRS.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\OvoBtDU.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\PSYozLC.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\vajejKH.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\wwlJpWn.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\TXlisKA.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\qSJPuRD.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\NmuMiHK.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\kDCXUuv.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\cwERayI.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\wEAypxu.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\KTFdrVf.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\dauuhOa.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\vhDwUpy.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\WyCHWUT.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\guiJDKG.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\VOSgeDO.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\ZXrTOqX.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\lBbqneC.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\FuXGnAc.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\FhUhMCV.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\foZJQjc.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\NmVlaid.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\crJRJir.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\durPaXT.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\dPwSWgW.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\zgeCjCS.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\MkseNWX.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\xltJOJJ.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\idIHPnO.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\fiGyKeW.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\PmbtdLJ.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\ZtorKwQ.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\BexTdEg.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\qShJkdH.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\eVnQYZA.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\HCrByfW.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\FOkciWa.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\XTKlNzl.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\UrvQvQD.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\bsayYOc.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\XHOOtov.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\CbqQHbo.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\TcGFWOe.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\HGLUGKv.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\BpsbepF.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\SUJsxsp.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\jdIxhYL.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\NxlAOuU.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\KtJkooW.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\VKpMmHX.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\YVWmOBN.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\QFUjhUB.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\vEcoggT.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\RyymSOE.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\DqdNiAm.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
File created	C:\Windows\System\iClCZra.exe	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 3984	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	84
PID 2588 wrote to memory of 3984	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	84
PID 2588 wrote to memory of 4240	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	85
PID 2588 wrote to memory of 4240	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	85
PID 2588 wrote to memory of 4464	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	86
PID 2588 wrote to memory of 4464	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	86
PID 2588 wrote to memory of 2024	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	87
PID 2588 wrote to memory of 2024	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	87
PID 2588 wrote to memory of 3616	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	88
PID 2588 wrote to memory of 3616	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	88
PID 2588 wrote to memory of 1432	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	89
PID 2588 wrote to memory of 1432	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	89
PID 2588 wrote to memory of 1128	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	90
PID 2588 wrote to memory of 1128	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	90
PID 2588 wrote to memory of 2468	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	91
PID 2588 wrote to memory of 2468	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	91
PID 2588 wrote to memory of 4964	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	92
PID 2588 wrote to memory of 4964	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	92
PID 2588 wrote to memory of 64	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	93
PID 2588 wrote to memory of 64	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	93
PID 2588 wrote to memory of 1324	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	94
PID 2588 wrote to memory of 1324	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	94
PID 2588 wrote to memory of 1720	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	95
PID 2588 wrote to memory of 1720	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	95
PID 2588 wrote to memory of 3228	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	96
PID 2588 wrote to memory of 3228	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	96
PID 2588 wrote to memory of 3596	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	97
PID 2588 wrote to memory of 3596	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	97
PID 2588 wrote to memory of 1408	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	98
PID 2588 wrote to memory of 1408	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	98
PID 2588 wrote to memory of 800	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	99
PID 2588 wrote to memory of 800	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	99
PID 2588 wrote to memory of 1816	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	100
PID 2588 wrote to memory of 1816	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	100
PID 2588 wrote to memory of 4076	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	101
PID 2588 wrote to memory of 4076	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	101
PID 2588 wrote to memory of 4488	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	102
PID 2588 wrote to memory of 4488	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	102
PID 2588 wrote to memory of 1560	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	103
PID 2588 wrote to memory of 1560	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	103
PID 2588 wrote to memory of 1972	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	104
PID 2588 wrote to memory of 1972	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	104
PID 2588 wrote to memory of 2144	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	105
PID 2588 wrote to memory of 2144	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	105
PID 2588 wrote to memory of 4460	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	106
PID 2588 wrote to memory of 4460	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	106
PID 2588 wrote to memory of 1808	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	107
PID 2588 wrote to memory of 1808	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	107
PID 2588 wrote to memory of 3784	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	108
PID 2588 wrote to memory of 3784	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	108
PID 2588 wrote to memory of 1920	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	109
PID 2588 wrote to memory of 1920	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	109
PID 2588 wrote to memory of 996	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	110
PID 2588 wrote to memory of 996	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	110
PID 2588 wrote to memory of 4276	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	111
PID 2588 wrote to memory of 4276	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	111
PID 2588 wrote to memory of 3744	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	112
PID 2588 wrote to memory of 3744	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	112
PID 2588 wrote to memory of 4376	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	113
PID 2588 wrote to memory of 4376	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	113
PID 2588 wrote to memory of 4324	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	114
PID 2588 wrote to memory of 4324	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	114
PID 2588 wrote to memory of 1296	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	115
PID 2588 wrote to memory of 1296	2588	e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe	115

C:\Users\Admin\AppData\Local\Temp\e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe
"C:\Users\Admin\AppData\Local\Temp\e4f1af92d2262db8e8ea47f240ad1f41a1c303c0dd1f02c3c0c76f54c88cc1f9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\System\aOFOPyL.exe
  C:\Windows\System\aOFOPyL.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\LEbJDSG.exe
  C:\Windows\System\LEbJDSG.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\FClDvBL.exe
  C:\Windows\System\FClDvBL.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\ZonAlvP.exe
  C:\Windows\System\ZonAlvP.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\UxEkUXa.exe
  C:\Windows\System\UxEkUXa.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\DTXFMsb.exe
  C:\Windows\System\DTXFMsb.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\EfjpRaT.exe
  C:\Windows\System\EfjpRaT.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\FAnaQzQ.exe
  C:\Windows\System\FAnaQzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\NSAeOeh.exe
  C:\Windows\System\NSAeOeh.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\HwUpKTm.exe
  C:\Windows\System\HwUpKTm.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\tZfSNtp.exe
  C:\Windows\System\tZfSNtp.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\soxFiGO.exe
  C:\Windows\System\soxFiGO.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\kkEITHE.exe
  C:\Windows\System\kkEITHE.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\ytKgRdY.exe
  C:\Windows\System\ytKgRdY.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\rFhdIXy.exe
  C:\Windows\System\rFhdIXy.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\OHvbzSA.exe
  C:\Windows\System\OHvbzSA.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\UEfIfeb.exe
  C:\Windows\System\UEfIfeb.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\RnmEebW.exe
  C:\Windows\System\RnmEebW.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\TGrpofs.exe
  C:\Windows\System\TGrpofs.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\xTvEJLM.exe
  C:\Windows\System\xTvEJLM.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\yrGQVJy.exe
  C:\Windows\System\yrGQVJy.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\BEZVoed.exe
  C:\Windows\System\BEZVoed.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\DbWClDK.exe
  C:\Windows\System\DbWClDK.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\OoYQtOX.exe
  C:\Windows\System\OoYQtOX.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\ENYoJPR.exe
  C:\Windows\System\ENYoJPR.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\TBvrCUt.exe
  C:\Windows\System\TBvrCUt.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\ufsBDCq.exe
  C:\Windows\System\ufsBDCq.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\ueXpaIi.exe
  C:\Windows\System\ueXpaIi.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\EMXBvsS.exe
  C:\Windows\System\EMXBvsS.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\SemaBoO.exe
  C:\Windows\System\SemaBoO.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\KSDLFWz.exe
  C:\Windows\System\KSDLFWz.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\KxCSxsG.exe
  C:\Windows\System\KxCSxsG.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\PnUzJnO.exe
  C:\Windows\System\PnUzJnO.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\xUAyzRu.exe
  C:\Windows\System\xUAyzRu.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\TzqaWqd.exe
  C:\Windows\System\TzqaWqd.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\reGYGrb.exe
  C:\Windows\System\reGYGrb.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\qsNqQRU.exe
  C:\Windows\System\qsNqQRU.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\iTuUdHV.exe
  C:\Windows\System\iTuUdHV.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\oEmZtaJ.exe
  C:\Windows\System\oEmZtaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\NjWukDF.exe
  C:\Windows\System\NjWukDF.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\iuBPFum.exe
  C:\Windows\System\iuBPFum.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\VaXeFSI.exe
  C:\Windows\System\VaXeFSI.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\XBRovGX.exe
  C:\Windows\System\XBRovGX.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\upvQoxv.exe
  C:\Windows\System\upvQoxv.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\DfhfHjm.exe
  C:\Windows\System\DfhfHjm.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\TeAmAZe.exe
  C:\Windows\System\TeAmAZe.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ieHeeTQ.exe
  C:\Windows\System\ieHeeTQ.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\rSPYrXl.exe
  C:\Windows\System\rSPYrXl.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\wmwTEje.exe
  C:\Windows\System\wmwTEje.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\pgbQCZZ.exe
  C:\Windows\System\pgbQCZZ.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\FgeUTUn.exe
  C:\Windows\System\FgeUTUn.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\GnpwWku.exe
  C:\Windows\System\GnpwWku.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\sZkgaWA.exe
  C:\Windows\System\sZkgaWA.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\nYatrYP.exe
  C:\Windows\System\nYatrYP.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\MJawhvD.exe
  C:\Windows\System\MJawhvD.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\pzvAghT.exe
  C:\Windows\System\pzvAghT.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\kLjtbtP.exe
  C:\Windows\System\kLjtbtP.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\UyDTpVj.exe
  C:\Windows\System\UyDTpVj.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\YFrlcZv.exe
  C:\Windows\System\YFrlcZv.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\AaMQHFT.exe
  C:\Windows\System\AaMQHFT.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\CnwnePP.exe
  C:\Windows\System\CnwnePP.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\wQcGedr.exe
  C:\Windows\System\wQcGedr.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\XcUvKCB.exe
  C:\Windows\System\XcUvKCB.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\oMcGdTg.exe
  C:\Windows\System\oMcGdTg.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\GXMsyCa.exe
  C:\Windows\System\GXMsyCa.exe
  2⤵
  PID:2540
- C:\Windows\System\FOqeHIJ.exe
  C:\Windows\System\FOqeHIJ.exe
  2⤵
  PID:1364
- C:\Windows\System\jhWgIKy.exe
  C:\Windows\System\jhWgIKy.exe
  2⤵
  PID:1900
- C:\Windows\System\TuyRKAB.exe
  C:\Windows\System\TuyRKAB.exe
  2⤵
  PID:1812
- C:\Windows\System\BWJlTdP.exe
  C:\Windows\System\BWJlTdP.exe
  2⤵
  PID:2384
- C:\Windows\System\IRaDkXg.exe
  C:\Windows\System\IRaDkXg.exe
  2⤵
  PID:2928
- C:\Windows\System\qOptKNL.exe
  C:\Windows\System\qOptKNL.exe
  2⤵
  PID:1056
- C:\Windows\System\OqFYdQj.exe
  C:\Windows\System\OqFYdQj.exe
  2⤵
  PID:3004
- C:\Windows\System\nBAJUDq.exe
  C:\Windows\System\nBAJUDq.exe
  2⤵
  PID:4948
- C:\Windows\System\rvVsFZp.exe
  C:\Windows\System\rvVsFZp.exe
  2⤵
  PID:4988
- C:\Windows\System\mMYArda.exe
  C:\Windows\System\mMYArda.exe
  2⤵
  PID:2864
- C:\Windows\System\BzWDPnA.exe
  C:\Windows\System\BzWDPnA.exe
  2⤵
  PID:1748
- C:\Windows\System\UbsVFnh.exe
  C:\Windows\System\UbsVFnh.exe
  2⤵
  PID:1072
- C:\Windows\System\LvsxKjS.exe
  C:\Windows\System\LvsxKjS.exe
  2⤵
  PID:2336
- C:\Windows\System\VoYmdNG.exe
  C:\Windows\System\VoYmdNG.exe
  2⤵
  PID:3668
- C:\Windows\System\cLmtGJa.exe
  C:\Windows\System\cLmtGJa.exe
  2⤵
  PID:4380
- C:\Windows\System\HBwwZck.exe
  C:\Windows\System\HBwwZck.exe
  2⤵
  PID:2820
- C:\Windows\System\ifkRaVw.exe
  C:\Windows\System\ifkRaVw.exe
  2⤵
  PID:2264
- C:\Windows\System\SlZEzXp.exe
  C:\Windows\System\SlZEzXp.exe
  2⤵
  PID:1956
- C:\Windows\System\DyPlXgD.exe
  C:\Windows\System\DyPlXgD.exe
  2⤵
  PID:4356
- C:\Windows\System\mlhEcKd.exe
  C:\Windows\System\mlhEcKd.exe
  2⤵
  PID:3452
- C:\Windows\System\hZCsveJ.exe
  C:\Windows\System\hZCsveJ.exe
  2⤵
  PID:1320
- C:\Windows\System\onjUaNq.exe
  C:\Windows\System\onjUaNq.exe
  2⤵
  PID:2560
- C:\Windows\System\LjcjCbI.exe
  C:\Windows\System\LjcjCbI.exe
  2⤵
  PID:4348
- C:\Windows\System\FjeRGnO.exe
  C:\Windows\System\FjeRGnO.exe
  2⤵
  PID:3968
- C:\Windows\System\XKEEaQZ.exe
  C:\Windows\System\XKEEaQZ.exe
  2⤵
  PID:3672
- C:\Windows\System\sFQUxgA.exe
  C:\Windows\System\sFQUxgA.exe
  2⤵
  PID:2616
- C:\Windows\System\YVbtTUb.exe
  C:\Windows\System\YVbtTUb.exe
  2⤵
  PID:1484
- C:\Windows\System\IhxGucT.exe
  C:\Windows\System\IhxGucT.exe
  2⤵
  PID:4920
- C:\Windows\System\UofmDOU.exe
  C:\Windows\System\UofmDOU.exe
  2⤵
  PID:4144
- C:\Windows\System\PAlfVql.exe
  C:\Windows\System\PAlfVql.exe
  2⤵
  PID:860
- C:\Windows\System\MyCDfhS.exe
  C:\Windows\System\MyCDfhS.exe
  2⤵
  PID:1960
- C:\Windows\System\GtijZlo.exe
  C:\Windows\System\GtijZlo.exe
  2⤵
  PID:2008
- C:\Windows\System\ncOmemJ.exe
  C:\Windows\System\ncOmemJ.exe
  2⤵
  PID:3132
- C:\Windows\System\pQfkFaZ.exe
  C:\Windows\System\pQfkFaZ.exe
  2⤵
  PID:1052
- C:\Windows\System\BcUPoOF.exe
  C:\Windows\System\BcUPoOF.exe
  2⤵
  PID:1160
- C:\Windows\System\OgPbUMz.exe
  C:\Windows\System\OgPbUMz.exe
  2⤵
  PID:2640
- C:\Windows\System\LyvbuMR.exe
  C:\Windows\System\LyvbuMR.exe
  2⤵
  PID:3916
- C:\Windows\System\EhgcgRS.exe
  C:\Windows\System\EhgcgRS.exe
  2⤵
  PID:3320
- C:\Windows\System\TmDPHvs.exe
  C:\Windows\System\TmDPHvs.exe
  2⤵
  PID:4836
- C:\Windows\System\GzQBxGZ.exe
  C:\Windows\System\GzQBxGZ.exe
  2⤵
  PID:1700
- C:\Windows\System\sNWWIZl.exe
  C:\Windows\System\sNWWIZl.exe
  2⤵
  PID:3192
- C:\Windows\System\jLgaITO.exe
  C:\Windows\System\jLgaITO.exe
  2⤵
  PID:5152
- C:\Windows\System\NfApIuS.exe
  C:\Windows\System\NfApIuS.exe
  2⤵
  PID:5180
- C:\Windows\System\oUwyXqX.exe
  C:\Windows\System\oUwyXqX.exe
  2⤵
  PID:5208
- C:\Windows\System\yLySAbV.exe
  C:\Windows\System\yLySAbV.exe
  2⤵
  PID:5240
- C:\Windows\System\wRxJsej.exe
  C:\Windows\System\wRxJsej.exe
  2⤵
  PID:5264
- C:\Windows\System\JxkKWqe.exe
  C:\Windows\System\JxkKWqe.exe
  2⤵
  PID:5304
- C:\Windows\System\OvwwvPn.exe
  C:\Windows\System\OvwwvPn.exe
  2⤵
  PID:5320
- C:\Windows\System\DVMIcWn.exe
  C:\Windows\System\DVMIcWn.exe
  2⤵
  PID:5344
- C:\Windows\System\dMvBsag.exe
  C:\Windows\System\dMvBsag.exe
  2⤵
  PID:5372
- C:\Windows\System\BHjiVvE.exe
  C:\Windows\System\BHjiVvE.exe
  2⤵
  PID:5412
- C:\Windows\System\rmEsJwl.exe
  C:\Windows\System\rmEsJwl.exe
  2⤵
  PID:5432
- C:\Windows\System\aSCmIXq.exe
  C:\Windows\System\aSCmIXq.exe
  2⤵
  PID:5456
- C:\Windows\System\oPrtpJY.exe
  C:\Windows\System\oPrtpJY.exe
  2⤵
  PID:5492
- C:\Windows\System\usaRHxI.exe
  C:\Windows\System\usaRHxI.exe
  2⤵
  PID:5520
- C:\Windows\System\YZphXUR.exe
  C:\Windows\System\YZphXUR.exe
  2⤵
  PID:5544
- C:\Windows\System\IzRfBhp.exe
  C:\Windows\System\IzRfBhp.exe
  2⤵
  PID:5580
- C:\Windows\System\dboMeTz.exe
  C:\Windows\System\dboMeTz.exe
  2⤵
  PID:5612
- C:\Windows\System\zkALLcV.exe
  C:\Windows\System\zkALLcV.exe
  2⤵
  PID:5648
- C:\Windows\System\uCSnSzX.exe
  C:\Windows\System\uCSnSzX.exe
  2⤵
  PID:5676
- C:\Windows\System\ouylSWa.exe
  C:\Windows\System\ouylSWa.exe
  2⤵
  PID:5704
- C:\Windows\System\wewjrLL.exe
  C:\Windows\System\wewjrLL.exe
  2⤵
  PID:5724
- C:\Windows\System\EfOTTaS.exe
  C:\Windows\System\EfOTTaS.exe
  2⤵
  PID:5760
- C:\Windows\System\hFAZChz.exe
  C:\Windows\System\hFAZChz.exe
  2⤵
  PID:5788
- C:\Windows\System\oToAzTc.exe
  C:\Windows\System\oToAzTc.exe
  2⤵
  PID:5812
- C:\Windows\System\qDuoZQW.exe
  C:\Windows\System\qDuoZQW.exe
  2⤵
  PID:5844
- C:\Windows\System\kZmlEBG.exe
  C:\Windows\System\kZmlEBG.exe
  2⤵
  PID:5872
- C:\Windows\System\oOViuog.exe
  C:\Windows\System\oOViuog.exe
  2⤵
  PID:5900
- C:\Windows\System\ElGLetU.exe
  C:\Windows\System\ElGLetU.exe
  2⤵
  PID:5920
- C:\Windows\System\PyjikEO.exe
  C:\Windows\System\PyjikEO.exe
  2⤵
  PID:5960
- C:\Windows\System\YGxzCbJ.exe
  C:\Windows\System\YGxzCbJ.exe
  2⤵
  PID:5984
- C:\Windows\System\lBbqneC.exe
  C:\Windows\System\lBbqneC.exe
  2⤵
  PID:6012
- C:\Windows\System\hppwYsl.exe
  C:\Windows\System\hppwYsl.exe
  2⤵
  PID:6036
- C:\Windows\System\KHUmgzo.exe
  C:\Windows\System\KHUmgzo.exe
  2⤵
  PID:6068
- C:\Windows\System\GbfzBEU.exe
  C:\Windows\System\GbfzBEU.exe
  2⤵
  PID:6096
- C:\Windows\System\GyeiUYk.exe
  C:\Windows\System\GyeiUYk.exe
  2⤵
  PID:6124
- C:\Windows\System\tPXIqBb.exe
  C:\Windows\System\tPXIqBb.exe
  2⤵
  PID:6140
- C:\Windows\System\XzFaHal.exe
  C:\Windows\System\XzFaHal.exe
  2⤵
  PID:5172
- C:\Windows\System\JVIXxoY.exe
  C:\Windows\System\JVIXxoY.exe
  2⤵
  PID:5232
- C:\Windows\System\FSauRwQ.exe
  C:\Windows\System\FSauRwQ.exe
  2⤵
  PID:5288
- C:\Windows\System\hyIzitb.exe
  C:\Windows\System\hyIzitb.exe
  2⤵
  PID:5380
- C:\Windows\System\jrVjqDK.exe
  C:\Windows\System\jrVjqDK.exe
  2⤵
  PID:5404
- C:\Windows\System\uHzxroQ.exe
  C:\Windows\System\uHzxroQ.exe
  2⤵
  PID:5444
- C:\Windows\System\XpmQKtk.exe
  C:\Windows\System\XpmQKtk.exe
  2⤵
  PID:5540
- C:\Windows\System\MkseNWX.exe
  C:\Windows\System\MkseNWX.exe
  2⤵
  PID:5608
- C:\Windows\System\GbdcovM.exe
  C:\Windows\System\GbdcovM.exe
  2⤵
  PID:5672
- C:\Windows\System\YynqHiT.exe
  C:\Windows\System\YynqHiT.exe
  2⤵
  PID:5756
- C:\Windows\System\XDxlWlp.exe
  C:\Windows\System\XDxlWlp.exe
  2⤵
  PID:5808
- C:\Windows\System\eTDAuUZ.exe
  C:\Windows\System\eTDAuUZ.exe
  2⤵
  PID:5868
- C:\Windows\System\MWjHnGS.exe
  C:\Windows\System\MWjHnGS.exe
  2⤵
  PID:5940
- C:\Windows\System\durPaXT.exe
  C:\Windows\System\durPaXT.exe
  2⤵
  PID:6000
- C:\Windows\System\BSWYMmg.exe
  C:\Windows\System\BSWYMmg.exe
  2⤵
  PID:6064
- C:\Windows\System\tIBHvmR.exe
  C:\Windows\System\tIBHvmR.exe
  2⤵
  PID:6132
- C:\Windows\System\jvbkzZT.exe
  C:\Windows\System\jvbkzZT.exe
  2⤵
  PID:5204
- C:\Windows\System\uVKNAMb.exe
  C:\Windows\System\uVKNAMb.exe
  2⤵
  PID:5428
- C:\Windows\System\KvUAumE.exe
  C:\Windows\System\KvUAumE.exe
  2⤵
  PID:5576
- C:\Windows\System\jvbiMzC.exe
  C:\Windows\System\jvbiMzC.exe
  2⤵
  PID:5660
- C:\Windows\System\xfKDsSJ.exe
  C:\Windows\System\xfKDsSJ.exe
  2⤵
  PID:5840
- C:\Windows\System\GMGIXYc.exe
  C:\Windows\System\GMGIXYc.exe
  2⤵
  PID:5976
- C:\Windows\System\EfQYDLm.exe
  C:\Windows\System\EfQYDLm.exe
  2⤵
  PID:5136
- C:\Windows\System\fedIMrM.exe
  C:\Windows\System\fedIMrM.exe
  2⤵
  PID:5400
- C:\Windows\System\HMLQFfS.exe
  C:\Windows\System\HMLQFfS.exe
  2⤵
  PID:5732
- C:\Windows\System\igLJlcb.exe
  C:\Windows\System\igLJlcb.exe
  2⤵
  PID:5276
- C:\Windows\System\GdxJbxl.exe
  C:\Windows\System\GdxJbxl.exe
  2⤵
  PID:5368
- C:\Windows\System\FuXGnAc.exe
  C:\Windows\System\FuXGnAc.exe
  2⤵
  PID:6164
- C:\Windows\System\ytpbtlP.exe
  C:\Windows\System\ytpbtlP.exe
  2⤵
  PID:6200
- C:\Windows\System\UFCsRaL.exe
  C:\Windows\System\UFCsRaL.exe
  2⤵
  PID:6228
- C:\Windows\System\zxiuLue.exe
  C:\Windows\System\zxiuLue.exe
  2⤵
  PID:6256
- C:\Windows\System\aJxIDgD.exe
  C:\Windows\System\aJxIDgD.exe
  2⤵
  PID:6284
- C:\Windows\System\FRjifFd.exe
  C:\Windows\System\FRjifFd.exe
  2⤵
  PID:6312
- C:\Windows\System\IzLAEPv.exe
  C:\Windows\System\IzLAEPv.exe
  2⤵
  PID:6340
- C:\Windows\System\MxgTgJe.exe
  C:\Windows\System\MxgTgJe.exe
  2⤵
  PID:6368
- C:\Windows\System\HekoioT.exe
  C:\Windows\System\HekoioT.exe
  2⤵
  PID:6388
- C:\Windows\System\WUPJIZZ.exe
  C:\Windows\System\WUPJIZZ.exe
  2⤵
  PID:6424
- C:\Windows\System\rkOSVkU.exe
  C:\Windows\System\rkOSVkU.exe
  2⤵
  PID:6452
- C:\Windows\System\HGLUGKv.exe
  C:\Windows\System\HGLUGKv.exe
  2⤵
  PID:6480
- C:\Windows\System\NtukukE.exe
  C:\Windows\System\NtukukE.exe
  2⤵
  PID:6508
- C:\Windows\System\DetMueD.exe
  C:\Windows\System\DetMueD.exe
  2⤵
  PID:6532
- C:\Windows\System\RMsitaT.exe
  C:\Windows\System\RMsitaT.exe
  2⤵
  PID:6556
- C:\Windows\System\rzNMxSl.exe
  C:\Windows\System\rzNMxSl.exe
  2⤵
  PID:6580
- C:\Windows\System\FnKAJaj.exe
  C:\Windows\System\FnKAJaj.exe
  2⤵
  PID:6608
- C:\Windows\System\TXlisKA.exe
  C:\Windows\System\TXlisKA.exe
  2⤵
  PID:6640
- C:\Windows\System\eLJUIvz.exe
  C:\Windows\System\eLJUIvz.exe
  2⤵
  PID:6672
- C:\Windows\System\kYiGWXd.exe
  C:\Windows\System\kYiGWXd.exe
  2⤵
  PID:6692
- C:\Windows\System\TMQehOg.exe
  C:\Windows\System\TMQehOg.exe
  2⤵
  PID:6720
- C:\Windows\System\QxMCGwo.exe
  C:\Windows\System\QxMCGwo.exe
  2⤵
  PID:6748
- C:\Windows\System\iGWwIVa.exe
  C:\Windows\System\iGWwIVa.exe
  2⤵
  PID:6780
- C:\Windows\System\kUlkEXr.exe
  C:\Windows\System\kUlkEXr.exe
  2⤵
  PID:6812
- C:\Windows\System\pjQSbHB.exe
  C:\Windows\System\pjQSbHB.exe
  2⤵
  PID:6848
- C:\Windows\System\fIsVtMv.exe
  C:\Windows\System\fIsVtMv.exe
  2⤵
  PID:6868
- C:\Windows\System\tFzDQUF.exe
  C:\Windows\System\tFzDQUF.exe
  2⤵
  PID:6904
- C:\Windows\System\xsUURZm.exe
  C:\Windows\System\xsUURZm.exe
  2⤵
  PID:6932
- C:\Windows\System\vpCBlyX.exe
  C:\Windows\System\vpCBlyX.exe
  2⤵
  PID:6960
- C:\Windows\System\kHSePCf.exe
  C:\Windows\System\kHSePCf.exe
  2⤵
  PID:6988
- C:\Windows\System\geAnWqJ.exe
  C:\Windows\System\geAnWqJ.exe
  2⤵
  PID:7016
- C:\Windows\System\OxYmbFU.exe
  C:\Windows\System\OxYmbFU.exe
  2⤵
  PID:7044
- C:\Windows\System\YWkvCRe.exe
  C:\Windows\System\YWkvCRe.exe
  2⤵
  PID:7072
- C:\Windows\System\HsCPoqC.exe
  C:\Windows\System\HsCPoqC.exe
  2⤵
  PID:7100
- C:\Windows\System\nNxAdHT.exe
  C:\Windows\System\nNxAdHT.exe
  2⤵
  PID:7124
- C:\Windows\System\SUboGfS.exe
  C:\Windows\System\SUboGfS.exe
  2⤵
  PID:7156
- C:\Windows\System\ZrSCHZq.exe
  C:\Windows\System\ZrSCHZq.exe
  2⤵
  PID:5932
- C:\Windows\System\sYpFLnO.exe
  C:\Windows\System\sYpFLnO.exe
  2⤵
  PID:6224
- C:\Windows\System\jXMWHFg.exe
  C:\Windows\System\jXMWHFg.exe
  2⤵
  PID:6308
- C:\Windows\System\ntNfuIL.exe
  C:\Windows\System\ntNfuIL.exe
  2⤵
  PID:6360
- C:\Windows\System\lQPheBm.exe
  C:\Windows\System\lQPheBm.exe
  2⤵
  PID:6416
- C:\Windows\System\ucUVwxU.exe
  C:\Windows\System\ucUVwxU.exe
  2⤵
  PID:6476
- C:\Windows\System\MxnScvo.exe
  C:\Windows\System\MxnScvo.exe
  2⤵
  PID:6544
- C:\Windows\System\OkmQjgg.exe
  C:\Windows\System\OkmQjgg.exe
  2⤵
  PID:6596
- C:\Windows\System\GTnJDto.exe
  C:\Windows\System\GTnJDto.exe
  2⤵
  PID:6688
- C:\Windows\System\nYvKMnZ.exe
  C:\Windows\System\nYvKMnZ.exe
  2⤵
  PID:6736
- C:\Windows\System\wPYNGJl.exe
  C:\Windows\System\wPYNGJl.exe
  2⤵
  PID:6800
- C:\Windows\System\IIUHzra.exe
  C:\Windows\System\IIUHzra.exe
  2⤵
  PID:6876
- C:\Windows\System\KPmNBSK.exe
  C:\Windows\System\KPmNBSK.exe
  2⤵
  PID:6924
- C:\Windows\System\CqRmtmd.exe
  C:\Windows\System\CqRmtmd.exe
  2⤵
  PID:6980
- C:\Windows\System\RrAvShp.exe
  C:\Windows\System\RrAvShp.exe
  2⤵
  PID:7032
- C:\Windows\System\oaWBiBy.exe
  C:\Windows\System\oaWBiBy.exe
  2⤵
  PID:7084
- C:\Windows\System\eVnQYZA.exe
  C:\Windows\System\eVnQYZA.exe
  2⤵
  PID:7144
- C:\Windows\System\TGConLr.exe
  C:\Windows\System\TGConLr.exe
  2⤵
  PID:6160
- C:\Windows\System\HDIyiQJ.exe
  C:\Windows\System\HDIyiQJ.exe
  2⤵
  PID:6328
- C:\Windows\System\kDfgxNY.exe
  C:\Windows\System\kDfgxNY.exe
  2⤵
  PID:6520
- C:\Windows\System\ZZXCBKi.exe
  C:\Windows\System\ZZXCBKi.exe
  2⤵
  PID:6636
- C:\Windows\System\nGYiGkX.exe
  C:\Windows\System\nGYiGkX.exe
  2⤵
  PID:6776
- C:\Windows\System\PRNzYhL.exe
  C:\Windows\System\PRNzYhL.exe
  2⤵
  PID:6864
- C:\Windows\System\jdIxhYL.exe
  C:\Windows\System\jdIxhYL.exe
  2⤵
  PID:7040
- C:\Windows\System\ujsHxuC.exe
  C:\Windows\System\ujsHxuC.exe
  2⤵
  PID:7164
- C:\Windows\System\WkGjvsZ.exe
  C:\Windows\System\WkGjvsZ.exe
  2⤵
  PID:6604
- C:\Windows\System\PeRmHVz.exe
  C:\Windows\System\PeRmHVz.exe
  2⤵
  PID:6972
- C:\Windows\System\JQRgvHl.exe
  C:\Windows\System\JQRgvHl.exe
  2⤵
  PID:7184
- C:\Windows\System\bvbBJBX.exe
  C:\Windows\System\bvbBJBX.exe
  2⤵
  PID:7208
- C:\Windows\System\JWcFWkk.exe
  C:\Windows\System\JWcFWkk.exe
  2⤵
  PID:7236
- C:\Windows\System\npIpgBf.exe
  C:\Windows\System\npIpgBf.exe
  2⤵
  PID:7268
- C:\Windows\System\vEydjvN.exe
  C:\Windows\System\vEydjvN.exe
  2⤵
  PID:7296
- C:\Windows\System\oVRVyso.exe
  C:\Windows\System\oVRVyso.exe
  2⤵
  PID:7332
- C:\Windows\System\GPLxMrG.exe
  C:\Windows\System\GPLxMrG.exe
  2⤵
  PID:7352
- C:\Windows\System\ZtorKwQ.exe
  C:\Windows\System\ZtorKwQ.exe
  2⤵
  PID:7376
- C:\Windows\System\KIpFyrA.exe
  C:\Windows\System\KIpFyrA.exe
  2⤵
  PID:7404
- C:\Windows\System\QdyknXq.exe
  C:\Windows\System\QdyknXq.exe
  2⤵
  PID:7436
- C:\Windows\System\aHOyglj.exe
  C:\Windows\System\aHOyglj.exe
  2⤵
  PID:7464
- C:\Windows\System\gSJsUFT.exe
  C:\Windows\System\gSJsUFT.exe
  2⤵
  PID:7492
- C:\Windows\System\FhUhMCV.exe
  C:\Windows\System\FhUhMCV.exe
  2⤵
  PID:7528
- C:\Windows\System\nJHFmUg.exe
  C:\Windows\System\nJHFmUg.exe
  2⤵
  PID:7552
- C:\Windows\System\mmTyRCt.exe
  C:\Windows\System\mmTyRCt.exe
  2⤵
  PID:7572
- C:\Windows\System\hPpHXUS.exe
  C:\Windows\System\hPpHXUS.exe
  2⤵
  PID:7596
- C:\Windows\System\OvoBtDU.exe
  C:\Windows\System\OvoBtDU.exe
  2⤵
  PID:7620
- C:\Windows\System\AiaIokW.exe
  C:\Windows\System\AiaIokW.exe
  2⤵
  PID:7648
- C:\Windows\System\sHIaFHx.exe
  C:\Windows\System\sHIaFHx.exe
  2⤵
  PID:7684
- C:\Windows\System\YjeILpK.exe
  C:\Windows\System\YjeILpK.exe
  2⤵
  PID:7712
- C:\Windows\System\EyBmiQb.exe
  C:\Windows\System\EyBmiQb.exe
  2⤵
  PID:7740
- C:\Windows\System\OAjtRlo.exe
  C:\Windows\System\OAjtRlo.exe
  2⤵
  PID:7764
- C:\Windows\System\geyvCcf.exe
  C:\Windows\System\geyvCcf.exe
  2⤵
  PID:7792
- C:\Windows\System\NomiNOp.exe
  C:\Windows\System\NomiNOp.exe
  2⤵
  PID:7816
- C:\Windows\System\fBGxscu.exe
  C:\Windows\System\fBGxscu.exe
  2⤵
  PID:7852
- C:\Windows\System\IDMQyZi.exe
  C:\Windows\System\IDMQyZi.exe
  2⤵
  PID:7884
- C:\Windows\System\SBqidAI.exe
  C:\Windows\System\SBqidAI.exe
  2⤵
  PID:7912
- C:\Windows\System\iPormzb.exe
  C:\Windows\System\iPormzb.exe
  2⤵
  PID:7932
- C:\Windows\System\PSJFjGM.exe
  C:\Windows\System\PSJFjGM.exe
  2⤵
  PID:7960
- C:\Windows\System\najtCCI.exe
  C:\Windows\System\najtCCI.exe
  2⤵
  PID:7984
- C:\Windows\System\NBCwtjv.exe
  C:\Windows\System\NBCwtjv.exe
  2⤵
  PID:8004
- C:\Windows\System\OAtqdSJ.exe
  C:\Windows\System\OAtqdSJ.exe
  2⤵
  PID:8040
- C:\Windows\System\TXhDlbE.exe
  C:\Windows\System\TXhDlbE.exe
  2⤵
  PID:8072
- C:\Windows\System\lSNbsyP.exe
  C:\Windows\System\lSNbsyP.exe
  2⤵
  PID:8096
- C:\Windows\System\xFHiNVi.exe
  C:\Windows\System\xFHiNVi.exe
  2⤵
  PID:8116
- C:\Windows\System\Drbwrus.exe
  C:\Windows\System\Drbwrus.exe
  2⤵
  PID:8140
- C:\Windows\System\LFvpzrC.exe
  C:\Windows\System\LFvpzrC.exe
  2⤵
  PID:8160
- C:\Windows\System\uVOmVBl.exe
  C:\Windows\System\uVOmVBl.exe
  2⤵
  PID:6916
- C:\Windows\System\NWbNpqW.exe
  C:\Windows\System\NWbNpqW.exe
  2⤵
  PID:7172
- C:\Windows\System\CongBbI.exe
  C:\Windows\System\CongBbI.exe
  2⤵
  PID:7244
- C:\Windows\System\xcEhifk.exe
  C:\Windows\System\xcEhifk.exe
  2⤵
  PID:7340
- C:\Windows\System\PxhfVfz.exe
  C:\Windows\System\PxhfVfz.exe
  2⤵
  PID:7388
- C:\Windows\System\eYuoWTL.exe
  C:\Windows\System\eYuoWTL.exe
  2⤵
  PID:7516
- C:\Windows\System\NXVtfGL.exe
  C:\Windows\System\NXVtfGL.exe
  2⤵
  PID:7560
- C:\Windows\System\LrZVNlh.exe
  C:\Windows\System\LrZVNlh.exe
  2⤵
  PID:7588
- C:\Windows\System\FIKjsXA.exe
  C:\Windows\System\FIKjsXA.exe
  2⤵
  PID:7672
- C:\Windows\System\UraLdXg.exe
  C:\Windows\System\UraLdXg.exe
  2⤵
  PID:7708
- C:\Windows\System\JzIIaWJ.exe
  C:\Windows\System\JzIIaWJ.exe
  2⤵
  PID:7760
- C:\Windows\System\lWhHNcb.exe
  C:\Windows\System\lWhHNcb.exe
  2⤵
  PID:7824
- C:\Windows\System\bGXmAcg.exe
  C:\Windows\System\bGXmAcg.exe
  2⤵
  PID:7924
- C:\Windows\System\heaZezk.exe
  C:\Windows\System\heaZezk.exe
  2⤵
  PID:7980
- C:\Windows\System\CqWiwXO.exe
  C:\Windows\System\CqWiwXO.exe
  2⤵
  PID:8028
- C:\Windows\System\NQMzPVB.exe
  C:\Windows\System\NQMzPVB.exe
  2⤵
  PID:8104
- C:\Windows\System\WTiyPIe.exe
  C:\Windows\System\WTiyPIe.exe
  2⤵
  PID:8156
- C:\Windows\System\jnmCwhJ.exe
  C:\Windows\System\jnmCwhJ.exe
  2⤵
  PID:7132
- C:\Windows\System\ZhAACtb.exe
  C:\Windows\System\ZhAACtb.exe
  2⤵
  PID:7428
- C:\Windows\System\XsSaxYF.exe
  C:\Windows\System\XsSaxYF.exe
  2⤵
  PID:7512
- C:\Windows\System\liuiqak.exe
  C:\Windows\System\liuiqak.exe
  2⤵
  PID:7632
- C:\Windows\System\foZJQjc.exe
  C:\Windows\System\foZJQjc.exe
  2⤵
  PID:7660
- C:\Windows\System\DLYAStI.exe
  C:\Windows\System\DLYAStI.exe
  2⤵
  PID:7728
- C:\Windows\System\kDCXUuv.exe
  C:\Windows\System\kDCXUuv.exe
  2⤵
  PID:8124
- C:\Windows\System\JZkAXnX.exe
  C:\Windows\System\JZkAXnX.exe
  2⤵
  PID:8148
- C:\Windows\System\dIusnZW.exe
  C:\Windows\System\dIusnZW.exe
  2⤵
  PID:6280
- C:\Windows\System\BexTdEg.exe
  C:\Windows\System\BexTdEg.exe
  2⤵
  PID:7644
- C:\Windows\System\vhDwUpy.exe
  C:\Windows\System\vhDwUpy.exe
  2⤵
  PID:8196
- C:\Windows\System\zGptbPe.exe
  C:\Windows\System\zGptbPe.exe
  2⤵
  PID:8216
- C:\Windows\System\bCeAWNt.exe
  C:\Windows\System\bCeAWNt.exe
  2⤵
  PID:8252
- C:\Windows\System\BOLIsvu.exe
  C:\Windows\System\BOLIsvu.exe
  2⤵
  PID:8280
- C:\Windows\System\NmVlaid.exe
  C:\Windows\System\NmVlaid.exe
  2⤵
  PID:8304
- C:\Windows\System\LFtAYQk.exe
  C:\Windows\System\LFtAYQk.exe
  2⤵
  PID:8332
- C:\Windows\System\fdyTaUd.exe
  C:\Windows\System\fdyTaUd.exe
  2⤵
  PID:8352
- C:\Windows\System\PNBdkCj.exe
  C:\Windows\System\PNBdkCj.exe
  2⤵
  PID:8372
- C:\Windows\System\olrEqbc.exe
  C:\Windows\System\olrEqbc.exe
  2⤵
  PID:8408
- C:\Windows\System\vEcoggT.exe
  C:\Windows\System\vEcoggT.exe
  2⤵
  PID:8432
- C:\Windows\System\mQLvYru.exe
  C:\Windows\System\mQLvYru.exe
  2⤵
  PID:8460
- C:\Windows\System\eRgpQVJ.exe
  C:\Windows\System\eRgpQVJ.exe
  2⤵
  PID:8484
- C:\Windows\System\AvsphIA.exe
  C:\Windows\System\AvsphIA.exe
  2⤵
  PID:8512
- C:\Windows\System\avEffIE.exe
  C:\Windows\System\avEffIE.exe
  2⤵
  PID:8532
- C:\Windows\System\UTOJFpK.exe
  C:\Windows\System\UTOJFpK.exe
  2⤵
  PID:8556
- C:\Windows\System\TplIQHm.exe
  C:\Windows\System\TplIQHm.exe
  2⤵
  PID:8584
- C:\Windows\System\FXpQXsG.exe
  C:\Windows\System\FXpQXsG.exe
  2⤵
  PID:8616
- C:\Windows\System\cRwRPzG.exe
  C:\Windows\System\cRwRPzG.exe
  2⤵
  PID:8644
- C:\Windows\System\ZqCpCMO.exe
  C:\Windows\System\ZqCpCMO.exe
  2⤵
  PID:8676
- C:\Windows\System\CkcVsaB.exe
  C:\Windows\System\CkcVsaB.exe
  2⤵
  PID:8700
- C:\Windows\System\hCjdJjy.exe
  C:\Windows\System\hCjdJjy.exe
  2⤵
  PID:8728
- C:\Windows\System\IkSOjjD.exe
  C:\Windows\System\IkSOjjD.exe
  2⤵
  PID:8752
- C:\Windows\System\QzDRYTV.exe
  C:\Windows\System\QzDRYTV.exe
  2⤵
  PID:8780
- C:\Windows\System\CigbGji.exe
  C:\Windows\System\CigbGji.exe
  2⤵
  PID:8812
- C:\Windows\System\dikQpJn.exe
  C:\Windows\System\dikQpJn.exe
  2⤵
  PID:8832
- C:\Windows\System\gVNehHL.exe
  C:\Windows\System\gVNehHL.exe
  2⤵
  PID:8860
- C:\Windows\System\OMKnFFa.exe
  C:\Windows\System\OMKnFFa.exe
  2⤵
  PID:8880
- C:\Windows\System\SVGZlwb.exe
  C:\Windows\System\SVGZlwb.exe
  2⤵
  PID:8896
- C:\Windows\System\fjACyUz.exe
  C:\Windows\System\fjACyUz.exe
  2⤵
  PID:8924
- C:\Windows\System\SxZzxdr.exe
  C:\Windows\System\SxZzxdr.exe
  2⤵
  PID:8952
- C:\Windows\System\xtuArTx.exe
  C:\Windows\System\xtuArTx.exe
  2⤵
  PID:8976
- C:\Windows\System\FCBVxEW.exe
  C:\Windows\System\FCBVxEW.exe
  2⤵
  PID:9000
- C:\Windows\System\POSnFoz.exe
  C:\Windows\System\POSnFoz.exe
  2⤵
  PID:9032
- C:\Windows\System\ABZPCox.exe
  C:\Windows\System\ABZPCox.exe
  2⤵
  PID:9056
- C:\Windows\System\GYCQlWu.exe
  C:\Windows\System\GYCQlWu.exe
  2⤵
  PID:9080
- C:\Windows\System\XqeuOEc.exe
  C:\Windows\System\XqeuOEc.exe
  2⤵
  PID:9108
- C:\Windows\System\qhdfsYq.exe
  C:\Windows\System\qhdfsYq.exe
  2⤵
  PID:9132
- C:\Windows\System\iQOnaIB.exe
  C:\Windows\System\iQOnaIB.exe
  2⤵
  PID:9164
- C:\Windows\System\dAVHsls.exe
  C:\Windows\System\dAVHsls.exe
  2⤵
  PID:9188
- C:\Windows\System\XgtvDqd.exe
  C:\Windows\System\XgtvDqd.exe
  2⤵
  PID:9212
- C:\Windows\System\ClcWGKc.exe
  C:\Windows\System\ClcWGKc.exe
  2⤵
  PID:7756
- C:\Windows\System\LOuFwKX.exe
  C:\Windows\System\LOuFwKX.exe
  2⤵
  PID:8248
- C:\Windows\System\APTjTXa.exe
  C:\Windows\System\APTjTXa.exe
  2⤵
  PID:8276
- C:\Windows\System\enPrsHk.exe
  C:\Windows\System\enPrsHk.exe
  2⤵
  PID:8292
- C:\Windows\System\tJStpPW.exe
  C:\Windows\System\tJStpPW.exe
  2⤵
  PID:8400
- C:\Windows\System\WyCHWUT.exe
  C:\Windows\System\WyCHWUT.exe
  2⤵
  PID:8368
- C:\Windows\System\crJRJir.exe
  C:\Windows\System\crJRJir.exe
  2⤵
  PID:8656
- C:\Windows\System\HXPMZgJ.exe
  C:\Windows\System\HXPMZgJ.exe
  2⤵
  PID:8692
- C:\Windows\System\xaVZdru.exe
  C:\Windows\System\xaVZdru.exe
  2⤵
  PID:8696
- C:\Windows\System\uECHToe.exe
  C:\Windows\System\uECHToe.exe
  2⤵
  PID:8740
- C:\Windows\System\JExgayA.exe
  C:\Windows\System\JExgayA.exe
  2⤵
  PID:8748
- C:\Windows\System\mRQmQHK.exe
  C:\Windows\System\mRQmQHK.exe
  2⤵
  PID:8856
- C:\Windows\System\HqJBoSE.exe
  C:\Windows\System\HqJBoSE.exe
  2⤵
  PID:8892
- C:\Windows\System\ezueAya.exe
  C:\Windows\System\ezueAya.exe
  2⤵
  PID:8972
- C:\Windows\System\vhqiONn.exe
  C:\Windows\System\vhqiONn.exe
  2⤵
  PID:9048
- C:\Windows\System\omMNfPC.exe
  C:\Windows\System\omMNfPC.exe
  2⤵
  PID:9044
- C:\Windows\System\lyfOwam.exe
  C:\Windows\System\lyfOwam.exe
  2⤵
  PID:8320
- C:\Windows\System\iKbebwJ.exe
  C:\Windows\System\iKbebwJ.exe
  2⤵
  PID:7892
- C:\Windows\System\UtwgdLr.exe
  C:\Windows\System\UtwgdLr.exe
  2⤵
  PID:7264
- C:\Windows\System\LOobKEg.exe
  C:\Windows\System\LOobKEg.exe
  2⤵
  PID:8424
- C:\Windows\System\bbfwhJJ.exe
  C:\Windows\System\bbfwhJJ.exe
  2⤵
  PID:8744
- C:\Windows\System\MMEDmQa.exe
  C:\Windows\System\MMEDmQa.exe
  2⤵
  PID:8848
- C:\Windows\System\PyGnxIC.exe
  C:\Windows\System\PyGnxIC.exe
  2⤵
  PID:8020
- C:\Windows\System\xltJOJJ.exe
  C:\Windows\System\xltJOJJ.exe
  2⤵
  PID:8776
- C:\Windows\System\qKRTaRD.exe
  C:\Windows\System\qKRTaRD.exe
  2⤵
  PID:9228
- C:\Windows\System\dxXZgyj.exe
  C:\Windows\System\dxXZgyj.exe
  2⤵
  PID:9256
- C:\Windows\System\eeHKpqn.exe
  C:\Windows\System\eeHKpqn.exe
  2⤵
  PID:9276
- C:\Windows\System\XQGFqMn.exe
  C:\Windows\System\XQGFqMn.exe
  2⤵
  PID:9300
- C:\Windows\System\RQvdBNF.exe
  C:\Windows\System\RQvdBNF.exe
  2⤵
  PID:9328
- C:\Windows\System\ZjaNfqm.exe
  C:\Windows\System\ZjaNfqm.exe
  2⤵
  PID:9360
- C:\Windows\System\AobeaZn.exe
  C:\Windows\System\AobeaZn.exe
  2⤵
  PID:9388
- C:\Windows\System\npYAdWa.exe
  C:\Windows\System\npYAdWa.exe
  2⤵
  PID:9412
- C:\Windows\System\hmdOTHv.exe
  C:\Windows\System\hmdOTHv.exe
  2⤵
  PID:9432
- C:\Windows\System\nKHIpFM.exe
  C:\Windows\System\nKHIpFM.exe
  2⤵
  PID:9460
- C:\Windows\System\NpbIcpq.exe
  C:\Windows\System\NpbIcpq.exe
  2⤵
  PID:9484
- C:\Windows\System\jNAkVIG.exe
  C:\Windows\System\jNAkVIG.exe
  2⤵
  PID:9508
- C:\Windows\System\ZwzOqGY.exe
  C:\Windows\System\ZwzOqGY.exe
  2⤵
  PID:9544
- C:\Windows\System\fNjImmF.exe
  C:\Windows\System\fNjImmF.exe
  2⤵
  PID:9568
- C:\Windows\System\aiCPPMm.exe
  C:\Windows\System\aiCPPMm.exe
  2⤵
  PID:9588
- C:\Windows\System\iWTetUa.exe
  C:\Windows\System\iWTetUa.exe
  2⤵
  PID:9612
- C:\Windows\System\rRqBWzm.exe
  C:\Windows\System\rRqBWzm.exe
  2⤵
  PID:9636
- C:\Windows\System\iClCZra.exe
  C:\Windows\System\iClCZra.exe
  2⤵
  PID:9656
- C:\Windows\System\poGQzPt.exe
  C:\Windows\System\poGQzPt.exe
  2⤵
  PID:9684
- C:\Windows\System\guiJDKG.exe
  C:\Windows\System\guiJDKG.exe
  2⤵
  PID:9712
- C:\Windows\System\otbZwTu.exe
  C:\Windows\System\otbZwTu.exe
  2⤵
  PID:9740
- C:\Windows\System\eCGtOUx.exe
  C:\Windows\System\eCGtOUx.exe
  2⤵
  PID:9768
- C:\Windows\System\LuSCTtq.exe
  C:\Windows\System\LuSCTtq.exe
  2⤵
  PID:9784
- C:\Windows\System\cCUFKSX.exe
  C:\Windows\System\cCUFKSX.exe
  2⤵
  PID:9824
- C:\Windows\System\jBGFgUL.exe
  C:\Windows\System\jBGFgUL.exe
  2⤵
  PID:9852
- C:\Windows\System\KTCponS.exe
  C:\Windows\System\KTCponS.exe
  2⤵
  PID:9884
- C:\Windows\System\crIQMkp.exe
  C:\Windows\System\crIQMkp.exe
  2⤵
  PID:9920
- C:\Windows\System\StIBupm.exe
  C:\Windows\System\StIBupm.exe
  2⤵
  PID:9936
- C:\Windows\System\UrvQvQD.exe
  C:\Windows\System\UrvQvQD.exe
  2⤵
  PID:9960
- C:\Windows\System\oxjUSYm.exe
  C:\Windows\System\oxjUSYm.exe
  2⤵
  PID:9984
- C:\Windows\System\tJbuEem.exe
  C:\Windows\System\tJbuEem.exe
  2⤵
  PID:10008
- C:\Windows\System\eLAxQzD.exe
  C:\Windows\System\eLAxQzD.exe
  2⤵
  PID:10032
- C:\Windows\System\LmVoPIx.exe
  C:\Windows\System\LmVoPIx.exe
  2⤵
  PID:10060
- C:\Windows\System\VXbbHoQ.exe
  C:\Windows\System\VXbbHoQ.exe
  2⤵
  PID:10096
- C:\Windows\System\sPQGwke.exe
  C:\Windows\System\sPQGwke.exe
  2⤵
  PID:10112
- C:\Windows\System\jfGbvZP.exe
  C:\Windows\System\jfGbvZP.exe
  2⤵
  PID:10132
- C:\Windows\System\asKFtmy.exe
  C:\Windows\System\asKFtmy.exe
  2⤵
  PID:10160
- C:\Windows\System\yYwnXux.exe
  C:\Windows\System\yYwnXux.exe
  2⤵
  PID:10184
- C:\Windows\System\GkTsNDu.exe
  C:\Windows\System\GkTsNDu.exe
  2⤵
  PID:10216
- C:\Windows\System\aHpyAuy.exe
  C:\Windows\System\aHpyAuy.exe
  2⤵
  PID:8964
- C:\Windows\System\bTpcNHS.exe
  C:\Windows\System\bTpcNHS.exe
  2⤵
  PID:8188
- C:\Windows\System\ABlMXON.exe
  C:\Windows\System\ABlMXON.exe
  2⤵
  PID:9072
- C:\Windows\System\fWyKVEq.exe
  C:\Windows\System\fWyKVEq.exe
  2⤵
  PID:8288
- C:\Windows\System\rQxHKov.exe
  C:\Windows\System\rQxHKov.exe
  2⤵
  PID:9356
- C:\Windows\System\RyymSOE.exe
  C:\Windows\System\RyymSOE.exe
  2⤵
  PID:8904
- C:\Windows\System\QtfYGIs.exe
  C:\Windows\System\QtfYGIs.exe
  2⤵
  PID:9264
- C:\Windows\System\YYVWmwz.exe
  C:\Windows\System\YYVWmwz.exe
  2⤵
  PID:9312
- C:\Windows\System\MqwjInd.exe
  C:\Windows\System\MqwjInd.exe
  2⤵
  PID:9492
- C:\Windows\System\xibtrCP.exe
  C:\Windows\System\xibtrCP.exe
  2⤵
  PID:9452
- C:\Windows\System\LNoIBBg.exe
  C:\Windows\System\LNoIBBg.exe
  2⤵
  PID:9764
- C:\Windows\System\geuUzpN.exe
  C:\Windows\System\geuUzpN.exe
  2⤵
  PID:9820
- C:\Windows\System\VqbpNDE.exe
  C:\Windows\System\VqbpNDE.exe
  2⤵
  PID:9736
- C:\Windows\System\DnhrtUr.exe
  C:\Windows\System\DnhrtUr.exe
  2⤵
  PID:9928
- C:\Windows\System\ajPAiGh.exe
  C:\Windows\System\ajPAiGh.exe
  2⤵
  PID:9724
- C:\Windows\System\uZPgnRe.exe
  C:\Windows\System\uZPgnRe.exe
  2⤵
  PID:10068
- C:\Windows\System\BeaTPnV.exe
  C:\Windows\System\BeaTPnV.exe
  2⤵
  PID:9800
- C:\Windows\System\nGrYTTR.exe
  C:\Windows\System\nGrYTTR.exe
  2⤵
  PID:10020
- C:\Windows\System\tNmKTaY.exe
  C:\Windows\System\tNmKTaY.exe
  2⤵
  PID:10200
- C:\Windows\System\bquHOMG.exe
  C:\Windows\System\bquHOMG.exe
  2⤵
  PID:9972
- C:\Windows\System\DmJwYDW.exe
  C:\Windows\System\DmJwYDW.exe
  2⤵
  PID:10000
- C:\Windows\System\bTjmPFH.exe
  C:\Windows\System\bTjmPFH.exe
  2⤵
  PID:10148
- C:\Windows\System\rwQZjkf.exe
  C:\Windows\System\rwQZjkf.exe
  2⤵
  PID:9016
- C:\Windows\System\hKEEYjc.exe
  C:\Windows\System\hKEEYjc.exe
  2⤵
  PID:8768
- C:\Windows\System\HAbKami.exe
  C:\Windows\System\HAbKami.exe
  2⤵
  PID:4176
- C:\Windows\System\UVHMqde.exe
  C:\Windows\System\UVHMqde.exe
  2⤵
  PID:10260
- C:\Windows\System\oHyJeWk.exe
  C:\Windows\System\oHyJeWk.exe
  2⤵
  PID:10296
- C:\Windows\System\DYmMtxe.exe
  C:\Windows\System\DYmMtxe.exe
  2⤵
  PID:10324
- C:\Windows\System\YvaAOhL.exe
  C:\Windows\System\YvaAOhL.exe
  2⤵
  PID:10352
- C:\Windows\System\OlnRUBC.exe
  C:\Windows\System\OlnRUBC.exe
  2⤵
  PID:10372
- C:\Windows\System\qVbbDUm.exe
  C:\Windows\System\qVbbDUm.exe
  2⤵
  PID:10400
- C:\Windows\System\ENAsAgo.exe
  C:\Windows\System\ENAsAgo.exe
  2⤵
  PID:10428
- C:\Windows\System\pPRnqmF.exe
  C:\Windows\System\pPRnqmF.exe
  2⤵
  PID:10452
- C:\Windows\System\ZNASXiV.exe
  C:\Windows\System\ZNASXiV.exe
  2⤵
  PID:10480
- C:\Windows\System\aTOQVca.exe
  C:\Windows\System\aTOQVca.exe
  2⤵
  PID:10508
- C:\Windows\System\VZVBnQG.exe
  C:\Windows\System\VZVBnQG.exe
  2⤵
  PID:10524
- C:\Windows\System\knRAYKx.exe
  C:\Windows\System\knRAYKx.exe
  2⤵
  PID:10560
- C:\Windows\System\oBoyaJI.exe
  C:\Windows\System\oBoyaJI.exe
  2⤵
  PID:10584
- C:\Windows\System\dRmvuUt.exe
  C:\Windows\System\dRmvuUt.exe
  2⤵
  PID:10604
- C:\Windows\System\UpeSnJg.exe
  C:\Windows\System\UpeSnJg.exe
  2⤵
  PID:10632
- C:\Windows\System\zyLvSpT.exe
  C:\Windows\System\zyLvSpT.exe
  2⤵
  PID:10652
- C:\Windows\System\FosQaip.exe
  C:\Windows\System\FosQaip.exe
  2⤵
  PID:10676
- C:\Windows\System\WbUYzFM.exe
  C:\Windows\System\WbUYzFM.exe
  2⤵
  PID:10700
- C:\Windows\System\WlZvPHA.exe
  C:\Windows\System\WlZvPHA.exe
  2⤵
  PID:10728
- C:\Windows\System\JOujDCt.exe
  C:\Windows\System\JOujDCt.exe
  2⤵
  PID:10756
- C:\Windows\System\BAeBrXa.exe
  C:\Windows\System\BAeBrXa.exe
  2⤵
  PID:10784
- C:\Windows\System\ftrHTVK.exe
  C:\Windows\System\ftrHTVK.exe
  2⤵
  PID:10816
- C:\Windows\System\aWBmRiZ.exe
  C:\Windows\System\aWBmRiZ.exe
  2⤵
  PID:10836
- C:\Windows\System\cVHLuuZ.exe
  C:\Windows\System\cVHLuuZ.exe
  2⤵
  PID:10856
- C:\Windows\System\pRpEFHp.exe
  C:\Windows\System\pRpEFHp.exe
  2⤵
  PID:10880
- C:\Windows\System\ioBDSAg.exe
  C:\Windows\System\ioBDSAg.exe
  2⤵
  PID:10896
- C:\Windows\System\olJBjsg.exe
  C:\Windows\System\olJBjsg.exe
  2⤵
  PID:10920
- C:\Windows\System\muvvUdo.exe
  C:\Windows\System\muvvUdo.exe
  2⤵
  PID:10948
- C:\Windows\System\TesGYxU.exe
  C:\Windows\System\TesGYxU.exe
  2⤵
  PID:10972
- C:\Windows\System\bKOuAFz.exe
  C:\Windows\System\bKOuAFz.exe
  2⤵
  PID:11088
- C:\Windows\System\dPwSWgW.exe
  C:\Windows\System\dPwSWgW.exe
  2⤵
  PID:11104
- C:\Windows\System\sbtAeiG.exe
  C:\Windows\System\sbtAeiG.exe
  2⤵
  PID:11128
- C:\Windows\System\LHsoygW.exe
  C:\Windows\System\LHsoygW.exe
  2⤵
  PID:11152
- C:\Windows\System\TJEjgBz.exe
  C:\Windows\System\TJEjgBz.exe
  2⤵
  PID:11168
- C:\Windows\System\HFRxXfv.exe
  C:\Windows\System\HFRxXfv.exe
  2⤵
  PID:11192
- C:\Windows\System\KVHZadU.exe
  C:\Windows\System\KVHZadU.exe
  2⤵
  PID:11220
- C:\Windows\System\syubipL.exe
  C:\Windows\System\syubipL.exe
  2⤵
  PID:11256
- C:\Windows\System\VxpJrLz.exe
  C:\Windows\System\VxpJrLz.exe
  2⤵
  PID:9632
- C:\Windows\System\ZFzOkot.exe
  C:\Windows\System\ZFzOkot.exe
  2⤵
  PID:9456
- C:\Windows\System\HdgRNTo.exe
  C:\Windows\System\HdgRNTo.exe
  2⤵
  PID:1912
- C:\Windows\System\jSixZEr.exe
  C:\Windows\System\jSixZEr.exe
  2⤵
  PID:10192
- C:\Windows\System\LcSyNbX.exe
  C:\Windows\System\LcSyNbX.exe
  2⤵
  PID:10304
- C:\Windows\System\IQAttWq.exe
  C:\Windows\System\IQAttWq.exe
  2⤵
  PID:10344
- C:\Windows\System\kudhOvu.exe
  C:\Windows\System\kudhOvu.exe
  2⤵
  PID:10424
- C:\Windows\System\qSJPuRD.exe
  C:\Windows\System\qSJPuRD.exe
  2⤵
  PID:9948
- C:\Windows\System\BVMcXnD.exe
  C:\Windows\System\BVMcXnD.exe
  2⤵
  PID:9516
- C:\Windows\System\juuYYVj.exe
  C:\Windows\System\juuYYVj.exe
  2⤵
  PID:10644
- C:\Windows\System\qAQTLnO.exe
  C:\Windows\System\qAQTLnO.exe
  2⤵
  PID:10556
- C:\Windows\System\ZTtfrJn.exe
  C:\Windows\System\ZTtfrJn.exe
  2⤵
  PID:10616
- C:\Windows\System\RptpLro.exe
  C:\Windows\System\RptpLro.exe
  2⤵
  PID:10716
- C:\Windows\System\objXXRq.exe
  C:\Windows\System\objXXRq.exe
  2⤵
  PID:10740
- C:\Windows\System\wgbSoCZ.exe
  C:\Windows\System\wgbSoCZ.exe
  2⤵
  PID:10848
- C:\Windows\System\ozTFhkU.exe
  C:\Windows\System\ozTFhkU.exe
  2⤵
  PID:10628
- C:\Windows\System\htzJuqX.exe
  C:\Windows\System\htzJuqX.exe
  2⤵
  PID:10916
- C:\Windows\System\ZdEsFPt.exe
  C:\Windows\System\ZdEsFPt.exe
  2⤵
  PID:11124
- C:\Windows\System\ApCxmrt.exe
  C:\Windows\System\ApCxmrt.exe
  2⤵
  PID:10776
- C:\Windows\System\gKpdxob.exe
  C:\Windows\System\gKpdxob.exe
  2⤵
  PID:11208
- C:\Windows\System\JcFbQdH.exe
  C:\Windows\System\JcFbQdH.exe
  2⤵
  PID:10956
- C:\Windows\System\PheSHft.exe
  C:\Windows\System\PheSHft.exe
  2⤵
  PID:10084
- C:\Windows\System\PsXDzMX.exe
  C:\Windows\System\PsXDzMX.exe
  2⤵
  PID:11184
- C:\Windows\System\llpcQKC.exe
  C:\Windows\System\llpcQKC.exe
  2⤵
  PID:11024
- C:\Windows\System\ddOYGLU.exe
  C:\Windows\System\ddOYGLU.exe
  2⤵
  PID:8872
- C:\Windows\System\CClblRF.exe
  C:\Windows\System\CClblRF.exe
  2⤵
  PID:9324
- C:\Windows\System\eBXUTEp.exe
  C:\Windows\System\eBXUTEp.exe
  2⤵
  PID:10172
- C:\Windows\System\NRqugwA.exe
  C:\Windows\System\NRqugwA.exe
  2⤵
  PID:10532
- C:\Windows\System\dsduCQt.exe
  C:\Windows\System\dsduCQt.exe
  2⤵
  PID:10520
- C:\Windows\System\tKYvckF.exe
  C:\Windows\System\tKYvckF.exe
  2⤵
  PID:10824
- C:\Windows\System\FjvlDdm.exe
  C:\Windows\System\FjvlDdm.exe
  2⤵
  PID:11268
- C:\Windows\System\RJixijf.exe
  C:\Windows\System\RJixijf.exe
  2⤵
  PID:11288
- C:\Windows\System\YRupyYa.exe
  C:\Windows\System\YRupyYa.exe
  2⤵
  PID:11320
- C:\Windows\System\HChYXqz.exe
  C:\Windows\System\HChYXqz.exe
  2⤵
  PID:11344
- C:\Windows\System\gNNWfop.exe
  C:\Windows\System\gNNWfop.exe
  2⤵
  PID:11368
- C:\Windows\System\ywXvzwa.exe
  C:\Windows\System\ywXvzwa.exe
  2⤵
  PID:11396
- C:\Windows\System\RfLRlcE.exe
  C:\Windows\System\RfLRlcE.exe
  2⤵
  PID:11420
- C:\Windows\System\rUqXpJT.exe
  C:\Windows\System\rUqXpJT.exe
  2⤵
  PID:11440
- C:\Windows\System\UmfHpTm.exe
  C:\Windows\System\UmfHpTm.exe
  2⤵
  PID:11472
- C:\Windows\System\ccwryqh.exe
  C:\Windows\System\ccwryqh.exe
  2⤵
  PID:11496
- C:\Windows\System\SxJsBhg.exe
  C:\Windows\System\SxJsBhg.exe
  2⤵
  PID:11516
- C:\Windows\System\RJvUMyE.exe
  C:\Windows\System\RJvUMyE.exe
  2⤵
  PID:11552
- C:\Windows\System\OiSVmsw.exe
  C:\Windows\System\OiSVmsw.exe
  2⤵
  PID:11572
- C:\Windows\System\asSGNTe.exe
  C:\Windows\System\asSGNTe.exe
  2⤵
  PID:11596
- C:\Windows\System\XTKlNzl.exe
  C:\Windows\System\XTKlNzl.exe
  2⤵
  PID:11620
- C:\Windows\System\dmnXHQL.exe
  C:\Windows\System\dmnXHQL.exe
  2⤵
  PID:11644
- C:\Windows\System\yOuXYAY.exe
  C:\Windows\System\yOuXYAY.exe
  2⤵
  PID:11660
- C:\Windows\System\DeLlNhm.exe
  C:\Windows\System\DeLlNhm.exe
  2⤵
  PID:11688
- C:\Windows\System\YhUfOsF.exe
  C:\Windows\System\YhUfOsF.exe
  2⤵
  PID:11716
- C:\Windows\System\tLdzHyn.exe
  C:\Windows\System\tLdzHyn.exe
  2⤵
  PID:11744
- C:\Windows\System\agFNlTf.exe
  C:\Windows\System\agFNlTf.exe
  2⤵
  PID:11768
- C:\Windows\System\eyBWrBC.exe
  C:\Windows\System\eyBWrBC.exe
  2⤵
  PID:11788
- C:\Windows\System\bsayYOc.exe
  C:\Windows\System\bsayYOc.exe
  2⤵
  PID:11824
- C:\Windows\System\FqFmmRU.exe
  C:\Windows\System\FqFmmRU.exe
  2⤵
  PID:11844
- C:\Windows\System\pcnspoI.exe
  C:\Windows\System\pcnspoI.exe
  2⤵
  PID:11868
- C:\Windows\System\khfMtWp.exe
  C:\Windows\System\khfMtWp.exe
  2⤵
  PID:11892
- C:\Windows\System\QISXrCS.exe
  C:\Windows\System\QISXrCS.exe
  2⤵
  PID:11916
- C:\Windows\System\EiekWVl.exe
  C:\Windows\System\EiekWVl.exe
  2⤵
  PID:11944
- C:\Windows\System\IaFkIjg.exe
  C:\Windows\System\IaFkIjg.exe
  2⤵
  PID:11980
- C:\Windows\System\viLOaGJ.exe
  C:\Windows\System\viLOaGJ.exe
  2⤵
  PID:12008
- C:\Windows\System\yxsAUzf.exe
  C:\Windows\System\yxsAUzf.exe
  2⤵
  PID:12028
- C:\Windows\System\MyAjewd.exe
  C:\Windows\System\MyAjewd.exe
  2⤵
  PID:12060
- C:\Windows\System\dgwFiwY.exe
  C:\Windows\System\dgwFiwY.exe
  2⤵
  PID:12096
- C:\Windows\System\AkopOdZ.exe
  C:\Windows\System\AkopOdZ.exe
  2⤵
  PID:12112
- C:\Windows\System\sQYdkvI.exe
  C:\Windows\System\sQYdkvI.exe
  2⤵
  PID:12132
- C:\Windows\System\tQrnkEk.exe
  C:\Windows\System\tQrnkEk.exe
  2⤵
  PID:12164
- C:\Windows\System\lnJcRJW.exe
  C:\Windows\System\lnJcRJW.exe
  2⤵
  PID:12184
- C:\Windows\System\gbMoavb.exe
  C:\Windows\System\gbMoavb.exe
  2⤵
  PID:12200
- C:\Windows\System\oCTRSBx.exe
  C:\Windows\System\oCTRSBx.exe
  2⤵
  PID:12228
- C:\Windows\System\GEYtqBv.exe
  C:\Windows\System\GEYtqBv.exe
  2⤵
  PID:12252
- C:\Windows\System\UxcxwCn.exe
  C:\Windows\System\UxcxwCn.exe
  2⤵
  PID:12276
- C:\Windows\System\tFaweXK.exe
  C:\Windows\System\tFaweXK.exe
  2⤵
  PID:10368
- C:\Windows\System\WWxvONl.exe
  C:\Windows\System\WWxvONl.exe
  2⤵
  PID:11032
- C:\Windows\System\GVvNYVp.exe
  C:\Windows\System\GVvNYVp.exe
  2⤵
  PID:10412
- C:\Windows\System\JJXTpgw.exe
  C:\Windows\System\JJXTpgw.exe
  2⤵
  PID:10688
- C:\Windows\System\UiQEkCu.exe
  C:\Windows\System\UiQEkCu.exe
  2⤵
  PID:9720
- C:\Windows\System\JUkjUyM.exe
  C:\Windows\System\JUkjUyM.exe
  2⤵
  PID:11300
- C:\Windows\System\VWKHnbI.exe
  C:\Windows\System\VWKHnbI.exe
  2⤵
  PID:10592
- C:\Windows\System\vjfNEMB.exe
  C:\Windows\System\vjfNEMB.exe
  2⤵
  PID:11356
- C:\Windows\System\LrcLpgJ.exe
  C:\Windows\System\LrcLpgJ.exe
  2⤵
  PID:11392
- C:\Windows\System\ALFkQtP.exe
  C:\Windows\System\ALFkQtP.exe
  2⤵
  PID:9408
- C:\Windows\System\jrCyYRS.exe
  C:\Windows\System\jrCyYRS.exe
  2⤵
  PID:1252
- C:\Windows\System\hHJXOdu.exe
  C:\Windows\System\hHJXOdu.exe
  2⤵
  PID:11316
- C:\Windows\System\ZwDnYjv.exe
  C:\Windows\System\ZwDnYjv.exe
  2⤵
  PID:11640
- C:\Windows\System\rpybTOb.exe
  C:\Windows\System\rpybTOb.exe
  2⤵
  PID:11780
- C:\Windows\System\prxRTah.exe
  C:\Windows\System\prxRTah.exe
  2⤵
  PID:11832
- C:\Windows\System\qShJkdH.exe
  C:\Windows\System\qShJkdH.exe
  2⤵
  PID:2592
- C:\Windows\System\VjeSJFZ.exe
  C:\Windows\System\VjeSJFZ.exe
  2⤵
  PID:11932
- C:\Windows\System\CoEGnyC.exe
  C:\Windows\System\CoEGnyC.exe
  2⤵
  PID:12024
- C:\Windows\System\jLgkkKR.exe
  C:\Windows\System\jLgkkKR.exe
  2⤵
  PID:11652
- C:\Windows\System\XivajQI.exe
  C:\Windows\System\XivajQI.exe
  2⤵
  PID:11684
- C:\Windows\System\vKGDomU.exe
  C:\Windows\System\vKGDomU.exe
  2⤵
  PID:11740
- C:\Windows\System\zQeibCD.exe
  C:\Windows\System\zQeibCD.exe
  2⤵
  PID:12140
- C:\Windows\System\FWlZqVF.exe
  C:\Windows\System\FWlZqVF.exe
  2⤵
  PID:11800
- C:\Windows\System\mRsRGPT.exe
  C:\Windows\System\mRsRGPT.exe
  2⤵
  PID:12248
- C:\Windows\System\VITRwqV.exe
  C:\Windows\System\VITRwqV.exe
  2⤵
  PID:11212
- C:\Windows\System\YScQKsc.exe
  C:\Windows\System\YScQKsc.exe
  2⤵
  PID:744
- C:\Windows\System\KdXNgsJ.exe
  C:\Windows\System\KdXNgsJ.exe
  2⤵
  PID:10708
- C:\Windows\System\hCoJHDq.exe
  C:\Windows\System\hCoJHDq.exe
  2⤵
  PID:11388
- C:\Windows\System\BpsbepF.exe
  C:\Windows\System\BpsbepF.exe
  2⤵
  PID:12272
- C:\Windows\System\XHOOtov.exe
  C:\Windows\System\XHOOtov.exe
  2⤵
  PID:12320
- C:\Windows\System\CbqQHbo.exe
  C:\Windows\System\CbqQHbo.exe
  2⤵
  PID:12352
- C:\Windows\System\gZlwfoL.exe
  C:\Windows\System\gZlwfoL.exe
  2⤵
  PID:12376
- C:\Windows\System\aHroCEK.exe
  C:\Windows\System\aHroCEK.exe
  2⤵
  PID:12400
- C:\Windows\System\qXVEsZi.exe
  C:\Windows\System\qXVEsZi.exe
  2⤵
  PID:12416
- C:\Windows\System\abhEPKQ.exe
  C:\Windows\System\abhEPKQ.exe
  2⤵
  PID:12448
- C:\Windows\System\eEIXSYa.exe
  C:\Windows\System\eEIXSYa.exe
  2⤵
  PID:12468
- C:\Windows\System\XxxFNQu.exe
  C:\Windows\System\XxxFNQu.exe
  2⤵
  PID:12488
- C:\Windows\System\yKvmWrn.exe
  C:\Windows\System\yKvmWrn.exe
  2⤵
  PID:12520
- C:\Windows\System\VNbLeeb.exe
  C:\Windows\System\VNbLeeb.exe
  2⤵
  PID:12540
- C:\Windows\System\fwKNgqI.exe
  C:\Windows\System\fwKNgqI.exe
  2⤵
  PID:12564
- C:\Windows\System\bibyDcg.exe
  C:\Windows\System\bibyDcg.exe
  2⤵
  PID:12588
- C:\Windows\System\VOSgeDO.exe
  C:\Windows\System\VOSgeDO.exe
  2⤵
  PID:12616
- C:\Windows\System\zBRyEZz.exe
  C:\Windows\System\zBRyEZz.exe
  2⤵
  PID:12640
- C:\Windows\System\pVOXkNS.exe
  C:\Windows\System\pVOXkNS.exe
  2⤵
  PID:12656
- C:\Windows\System\HQFdbqq.exe
  C:\Windows\System\HQFdbqq.exe
  2⤵
  PID:12672
- C:\Windows\System\OLbcptU.exe
  C:\Windows\System\OLbcptU.exe
  2⤵
  PID:12704
- C:\Windows\System\sGnggPV.exe
  C:\Windows\System\sGnggPV.exe
  2⤵
  PID:12720
- C:\Windows\System\EfXGqqP.exe
  C:\Windows\System\EfXGqqP.exe
  2⤵
  PID:12736
- C:\Windows\System\iWpWqdi.exe
  C:\Windows\System\iWpWqdi.exe
  2⤵
  PID:12760
- C:\Windows\System\SXeqgek.exe
  C:\Windows\System\SXeqgek.exe
  2⤵
  PID:12784
- C:\Windows\System\juJAvCm.exe
  C:\Windows\System\juJAvCm.exe
  2⤵
  PID:12816
- C:\Windows\System\mJMgKpM.exe
  C:\Windows\System\mJMgKpM.exe
  2⤵
  PID:12856
- C:\Windows\System\OVLmVQn.exe
  C:\Windows\System\OVLmVQn.exe
  2⤵
  PID:12880
- C:\Windows\System\vpKUpiP.exe
  C:\Windows\System\vpKUpiP.exe
  2⤵
  PID:12912
- C:\Windows\System\zCeqkpL.exe
  C:\Windows\System\zCeqkpL.exe
  2⤵
  PID:12936
- C:\Windows\System\sAlwbuf.exe
  C:\Windows\System\sAlwbuf.exe
  2⤵
  PID:12960
- C:\Windows\System\NxlAOuU.exe
  C:\Windows\System\NxlAOuU.exe
  2⤵
  PID:12988
- C:\Windows\System\XTLIrvb.exe
  C:\Windows\System\XTLIrvb.exe
  2⤵
  PID:13008
- C:\Windows\System\cznahbl.exe
  C:\Windows\System\cznahbl.exe
  2⤵
  PID:13032
- C:\Windows\System\EXKzNJF.exe
  C:\Windows\System\EXKzNJF.exe
  2⤵
  PID:13056
- C:\Windows\System\TcGFWOe.exe
  C:\Windows\System\TcGFWOe.exe
  2⤵
  PID:13076
- C:\Windows\System\auioMxV.exe
  C:\Windows\System\auioMxV.exe
  2⤵
  PID:13104
- C:\Windows\System\zADYOpR.exe
  C:\Windows\System\zADYOpR.exe
  2⤵
  PID:13136
- C:\Windows\System\UGdnDgW.exe
  C:\Windows\System\UGdnDgW.exe
  2⤵
  PID:13156
- C:\Windows\System\yvepZFu.exe
  C:\Windows\System\yvepZFu.exe
  2⤵
  PID:13176
- C:\Windows\System\idIHPnO.exe
  C:\Windows\System\idIHPnO.exe
  2⤵
  PID:13208
- C:\Windows\System\BNdwqAd.exe
  C:\Windows\System\BNdwqAd.exe
  2⤵
  PID:13224
- C:\Windows\System\axAuSyb.exe
  C:\Windows\System\axAuSyb.exe
  2⤵
  PID:13244
- C:\Windows\System\vajejKH.exe
  C:\Windows\System\vajejKH.exe
  2⤵
  PID:13264
- C:\Windows\System\fzCsxuc.exe
  C:\Windows\System\fzCsxuc.exe
  2⤵
  PID:12308
- C:\Windows\System\MtvvKxu.exe
  C:\Windows\System\MtvvKxu.exe
  2⤵
  PID:13004
- C:\Windows\System\yEAuyJH.exe
  C:\Windows\System\yEAuyJH.exe
  2⤵
  PID:13144
- C:\Windows\System\EFrlRCm.exe
  C:\Windows\System\EFrlRCm.exe
  2⤵
  PID:12836
- C:\Windows\System\XnnEbEa.exe
  C:\Windows\System\XnnEbEa.exe
  2⤵
  PID:12612
- C:\Windows\System\tRxjhCm.exe
  C:\Windows\System\tRxjhCm.exe
  2⤵
  PID:13348
- C:\Windows\System\HoDBNkf.exe
  C:\Windows\System\HoDBNkf.exe
  2⤵
  PID:13384
- C:\Windows\System\uSpUoau.exe
  C:\Windows\System\uSpUoau.exe
  2⤵
  PID:13408
- C:\Windows\System\rSFsukv.exe
  C:\Windows\System\rSFsukv.exe
  2⤵
  PID:13444
- C:\Windows\System\ZxnZTDW.exe
  C:\Windows\System\ZxnZTDW.exe
  2⤵
  PID:13464
- C:\Windows\System\waHpTBV.exe
  C:\Windows\System\waHpTBV.exe
  2⤵
  PID:13484
- C:\Windows\System\SUJsxsp.exe
  C:\Windows\System\SUJsxsp.exe
  2⤵
  PID:13500
- C:\Windows\System\YQOWVzE.exe
  C:\Windows\System\YQOWVzE.exe
  2⤵
  PID:13524
- C:\Windows\System\ceHowqL.exe
  C:\Windows\System\ceHowqL.exe
  2⤵
  PID:13560
- C:\Windows\System\uKQIGMD.exe
  C:\Windows\System\uKQIGMD.exe
  2⤵
  PID:13580
- C:\Windows\System\HErzhzz.exe
  C:\Windows\System\HErzhzz.exe
  2⤵
  PID:13600
- C:\Windows\System\zgeCjCS.exe
  C:\Windows\System\zgeCjCS.exe
  2⤵
  PID:13616
- C:\Windows\System\LGEUIvC.exe
  C:\Windows\System\LGEUIvC.exe
  2⤵
  PID:13636
- C:\Windows\System\qzajCJL.exe
  C:\Windows\System\qzajCJL.exe
  2⤵
  PID:13656
- C:\Windows\System\MubdmSw.exe
  C:\Windows\System\MubdmSw.exe
  2⤵
  PID:13672
- C:\Windows\System\xUQxrfY.exe
  C:\Windows\System\xUQxrfY.exe
  2⤵
  PID:13712
- C:\Windows\System\VJaRbRl.exe
  C:\Windows\System\VJaRbRl.exe
  2⤵
  PID:13732
- C:\Windows\System\rqOgbvw.exe
  C:\Windows\System\rqOgbvw.exe
  2⤵
  PID:13768
- C:\Windows\System\NLciqhe.exe
  C:\Windows\System\NLciqhe.exe
  2⤵
  PID:13784
- C:\Windows\System\CdZGwKf.exe
  C:\Windows\System\CdZGwKf.exe
  2⤵
  PID:13824
- C:\Windows\System\LoQSRCm.exe
  C:\Windows\System\LoQSRCm.exe
  2⤵
  PID:13840
- C:\Windows\System\PSYozLC.exe
  C:\Windows\System\PSYozLC.exe
  2⤵
  PID:13860
- C:\Windows\System\ydYNVyk.exe
  C:\Windows\System\ydYNVyk.exe
  2⤵
  PID:13880
- C:\Windows\System\qyKtmMe.exe
  C:\Windows\System\qyKtmMe.exe
  2⤵
  PID:13908
- C:\Windows\System\fqXacwK.exe
  C:\Windows\System\fqXacwK.exe
  2⤵
  PID:13932
- C:\Windows\System\YaZFiFZ.exe
  C:\Windows\System\YaZFiFZ.exe
  2⤵
  PID:13956
- C:\Windows\System\ArtvqAR.exe
  C:\Windows\System\ArtvqAR.exe
  2⤵
  PID:13988
- C:\Windows\System\qUugHgS.exe
  C:\Windows\System\qUugHgS.exe
  2⤵
  PID:14012
- C:\Windows\System\zQGqpxQ.exe
  C:\Windows\System\zQGqpxQ.exe
  2⤵
  PID:14044
- C:\Windows\System\LLzZdWE.exe
  C:\Windows\System\LLzZdWE.exe
  2⤵
  PID:14060
- C:\Windows\System\ByiyMda.exe
  C:\Windows\System\ByiyMda.exe
  2⤵
  PID:14076
- C:\Windows\System\KtJkooW.exe
  C:\Windows\System\KtJkooW.exe
  2⤵
  PID:14096
- C:\Windows\System\VUacqEa.exe
  C:\Windows\System\VUacqEa.exe
  2⤵
  PID:14128
- C:\Windows\System\iCRJrgC.exe
  C:\Windows\System\iCRJrgC.exe
  2⤵
  PID:14148
- C:\Windows\System\XHiLUOc.exe
  C:\Windows\System\XHiLUOc.exe
  2⤵
  PID:14164
- C:\Windows\System\OlSjGxJ.exe
  C:\Windows\System\OlSjGxJ.exe
  2⤵
  PID:14184
- C:\Windows\System\kBIViGK.exe
  C:\Windows\System\kBIViGK.exe
  2⤵
  PID:14224
- C:\Windows\System\qzsHiEJ.exe
  C:\Windows\System\qzsHiEJ.exe
  2⤵
  PID:14244
- C:\Windows\System\STyQWJp.exe
  C:\Windows\System\STyQWJp.exe
  2⤵
  PID:14264
- C:\Windows\System\DPvjbtx.exe
  C:\Windows\System\DPvjbtx.exe
  2⤵
  PID:14284
- C:\Windows\System\yLsbORd.exe
  C:\Windows\System\yLsbORd.exe
  2⤵
  PID:14308
- C:\Windows\System\OOZUcxn.exe
  C:\Windows\System\OOZUcxn.exe
  2⤵
  PID:14324
- C:\Windows\System\kOQkhJL.exe
  C:\Windows\System\kOQkhJL.exe
  2⤵
  PID:13096
- C:\Windows\System\OMzBUyc.exe
  C:\Windows\System\OMzBUyc.exe
  2⤵
  PID:13220
- C:\Windows\System\HCrByfW.exe
  C:\Windows\System\HCrByfW.exe
  2⤵
  PID:13132
- C:\Windows\System\KpgFDgI.exe
  C:\Windows\System\KpgFDgI.exe
  2⤵
  PID:13356
- C:\Windows\System\UUoeBdX.exe
  C:\Windows\System\UUoeBdX.exe
  2⤵
  PID:12812
- C:\Windows\System\JYHwXdF.exe
  C:\Windows\System\JYHwXdF.exe
  2⤵
  PID:13420
- C:\Windows\System\TzoXxVp.exe
  C:\Windows\System\TzoXxVp.exe
  2⤵
  PID:13028
- C:\Windows\System\GTkeZdZ.exe
  C:\Windows\System\GTkeZdZ.exe
  2⤵
  PID:13476
- C:\Windows\System\zyCozge.exe
  C:\Windows\System\zyCozge.exe
  2⤵
  PID:1588
- C:\Windows\System\uOXKFNl.exe
  C:\Windows\System\uOXKFNl.exe
  2⤵
  PID:12312
- C:\Windows\System\lzpIODP.exe
  C:\Windows\System\lzpIODP.exe
  2⤵
  PID:4640
- C:\Windows\System\jbyjgpt.exe
  C:\Windows\System\jbyjgpt.exe
  2⤵
  PID:13392
- C:\Windows\System\NUkOsoW.exe
  C:\Windows\System\NUkOsoW.exe
  2⤵
  PID:12840
- C:\Windows\System\OEbltoW.exe
  C:\Windows\System\OEbltoW.exe
  2⤵
  PID:13652
- C:\Windows\System\HaHRdHh.exe
  C:\Windows\System\HaHRdHh.exe
  2⤵
  PID:13496
- C:\Windows\System\lAEDcaG.exe
  C:\Windows\System\lAEDcaG.exe
  2⤵
  PID:13552
- C:\Windows\System\yvPvraw.exe
  C:\Windows\System\yvPvraw.exe
  2⤵
  PID:13812
- C:\Windows\System\mAzWusq.exe
  C:\Windows\System\mAzWusq.exe
  2⤵
  PID:13644
- C:\Windows\System\dzQaRRp.exe
  C:\Windows\System\dzQaRRp.exe
  2⤵
  PID:13696
- C:\Windows\System\gtpFedo.exe
  C:\Windows\System\gtpFedo.exe
  2⤵
  PID:13820
- C:\Windows\System\KyBckJZ.exe
  C:\Windows\System\KyBckJZ.exe
  2⤵
  PID:13868
- C:\Windows\System\FguvbRI.exe
  C:\Windows\System\FguvbRI.exe
  2⤵
  PID:13928
- C:\Windows\System\mhQRoqo.exe
  C:\Windows\System\mhQRoqo.exe
  2⤵
  PID:13972
- C:\Windows\System\KonsLgF.exe
  C:\Windows\System\KonsLgF.exe
  2⤵
  PID:14028
- C:\Windows\System\COVbjfA.exe
  C:\Windows\System\COVbjfA.exe
  2⤵
  PID:13900
- C:\Windows\System\gtodFXY.exe
  C:\Windows\System\gtodFXY.exe
  2⤵
  PID:13472
- C:\Windows\System\yCvpDEo.exe
  C:\Windows\System\yCvpDEo.exe
  2⤵
  PID:14296
- C:\Windows\System\aeiijES.exe
  C:\Windows\System\aeiijES.exe
  2⤵
  PID:2732
- C:\Windows\System\RZHWthB.exe
  C:\Windows\System\RZHWthB.exe
  2⤵
  PID:14352
- C:\Windows\System\McloIHc.exe
  C:\Windows\System\McloIHc.exe
  2⤵
  PID:14368
- C:\Windows\System\QdiVaBE.exe
  C:\Windows\System\QdiVaBE.exe
  2⤵
  PID:14384
- C:\Windows\System\GJVySiM.exe
  C:\Windows\System\GJVySiM.exe
  2⤵
  PID:14416
- C:\Windows\System\ofYIsIp.exe
  C:\Windows\System\ofYIsIp.exe
  2⤵
  PID:14432
- C:\Windows\System\RmEDiKx.exe
  C:\Windows\System\RmEDiKx.exe
  2⤵
  PID:14456
- C:\Windows\System\WdizWWj.exe
  C:\Windows\System\WdizWWj.exe
  2⤵
  PID:14488
- C:\Windows\System\ijJKJSp.exe
  C:\Windows\System\ijJKJSp.exe
  2⤵
  PID:14516
- C:\Windows\System\fLqGvnU.exe
  C:\Windows\System\fLqGvnU.exe
  2⤵
  PID:14540
- C:\Windows\System\hrkpiNk.exe
  C:\Windows\System\hrkpiNk.exe
  2⤵
  PID:14560
- C:\Windows\System\EKignYE.exe
  C:\Windows\System\EKignYE.exe
  2⤵
  PID:14576
- C:\Windows\System\jpaoGkO.exe
  C:\Windows\System\jpaoGkO.exe
  2⤵
  PID:14600
- C:\Windows\System\UmqiItS.exe
  C:\Windows\System\UmqiItS.exe
  2⤵
  PID:14628
- C:\Windows\System\Gvpnfen.exe
  C:\Windows\System\Gvpnfen.exe
  2⤵
  PID:14660
- C:\Windows\System\mhxTrhR.exe
  C:\Windows\System\mhxTrhR.exe
  2⤵
  PID:14684
- C:\Windows\System\KYDRNaj.exe
  C:\Windows\System\KYDRNaj.exe
  2⤵
  PID:14704
- C:\Windows\System\jOAukWj.exe
  C:\Windows\System\jOAukWj.exe
  2⤵
  PID:14740
- C:\Windows\System\KefMFid.exe
  C:\Windows\System\KefMFid.exe
  2⤵
  PID:14768
- C:\Windows\System\fiGyKeW.exe
  C:\Windows\System\fiGyKeW.exe
  2⤵
  PID:14796
- C:\Windows\System\EnQPtjF.exe
  C:\Windows\System\EnQPtjF.exe
  2⤵
  PID:14816
- C:\Windows\System\hXZLJHf.exe
  C:\Windows\System\hXZLJHf.exe
  2⤵
  PID:14836
- C:\Windows\System\URoevmq.exe
  C:\Windows\System\URoevmq.exe
  2⤵
  PID:14852
- C:\Windows\System\LxsaUyy.exe
  C:\Windows\System\LxsaUyy.exe
  2⤵
  PID:14876
- C:\Windows\System\vrBfTWO.exe
  C:\Windows\System\vrBfTWO.exe
  2⤵
  PID:14900
- C:\Windows\System\gVQGdOQ.exe
  C:\Windows\System\gVQGdOQ.exe
  2⤵
  PID:14936
- C:\Windows\System\uwUiIFR.exe
  C:\Windows\System\uwUiIFR.exe
  2⤵
  PID:14952
- C:\Windows\System\ikIPNBM.exe
  C:\Windows\System\ikIPNBM.exe
  2⤵
  PID:14980
- C:\Windows\System\MyLcJhq.exe
  C:\Windows\System\MyLcJhq.exe
  2⤵
  PID:14996
- C:\Windows\System\bbMrvVJ.exe
  C:\Windows\System\bbMrvVJ.exe
  2⤵
  PID:15024
- C:\Windows\System\cmzaznC.exe
  C:\Windows\System\cmzaznC.exe
  2⤵
  PID:15044
- C:\Windows\System\GPAvvWI.exe
  C:\Windows\System\GPAvvWI.exe
  2⤵
  PID:15072
- C:\Windows\System\QQimHoN.exe
  C:\Windows\System\QQimHoN.exe
  2⤵
  PID:15100
- C:\Windows\System\AuZaSvP.exe
  C:\Windows\System\AuZaSvP.exe
  2⤵
  PID:15120
- C:\Windows\System\gMlGQzR.exe
  C:\Windows\System\gMlGQzR.exe
  2⤵
  PID:15136
- C:\Windows\System\sZIMmIb.exe
  C:\Windows\System\sZIMmIb.exe
  2⤵
  PID:15156
- C:\Windows\System\nrRgFtY.exe
  C:\Windows\System\nrRgFtY.exe
  2⤵
  PID:15176
- C:\Windows\System\qDpJWku.exe
  C:\Windows\System\qDpJWku.exe
  2⤵
  PID:15216
- C:\Windows\System\fKHdMri.exe
  C:\Windows\System\fKHdMri.exe
  2⤵
  PID:15236
- C:\Windows\System\NIakgHm.exe
  C:\Windows\System\NIakgHm.exe
  2⤵
  PID:15252
- C:\Windows\System\YXGkIEA.exe
  C:\Windows\System\YXGkIEA.exe
  2⤵
  PID:15268
- C:\Windows\System\ZTWQAED.exe
  C:\Windows\System\ZTWQAED.exe
  2⤵
  PID:15296
- C:\Windows\System\nKTvBfh.exe
  C:\Windows\System\nKTvBfh.exe
  2⤵
  PID:15316
- C:\Windows\System\RZOCyCb.exe
  C:\Windows\System\RZOCyCb.exe
  2⤵
  PID:15332
- C:\Windows\System\VFutofJ.exe
  C:\Windows\System\VFutofJ.exe
  2⤵
  PID:15352
- C:\Windows\System\yKZOlVK.exe
  C:\Windows\System\yKZOlVK.exe
  2⤵
  PID:13724
- C:\Windows\System\PmbtdLJ.exe
  C:\Windows\System\PmbtdLJ.exe
  2⤵
  PID:12696
- C:\Windows\System\oBJIVJm.exe
  C:\Windows\System\oBJIVJm.exe
  2⤵
  PID:13808
- C:\Windows\System\aKQxGtV.exe
  C:\Windows\System\aKQxGtV.exe
  2⤵
  PID:12956
- C:\Windows\System\pNOvDlH.exe
  C:\Windows\System\pNOvDlH.exe
  2⤵
  PID:12728
- C:\Windows\System\GVzCVHI.exe
  C:\Windows\System\GVzCVHI.exe
  2⤵
  PID:14316
- C:\Windows\System\NtWcaYD.exe
  C:\Windows\System\NtWcaYD.exe
  2⤵
  PID:13092
- C:\Windows\System\tyinlTa.exe
  C:\Windows\System\tyinlTa.exe
  2⤵
  PID:14548
- C:\Windows\System\UdnKBYm.exe
  C:\Windows\System\UdnKBYm.exe
  2⤵
  PID:14084
- C:\Windows\System\PBGDWuL.exe
  C:\Windows\System\PBGDWuL.exe
  2⤵
  PID:14196
- C:\Windows\System\oFSKXCB.exe
  C:\Windows\System\oFSKXCB.exe
  2⤵
  PID:14700
- C:\Windows\System\FbrjQFX.exe
  C:\Windows\System\FbrjQFX.exe
  2⤵
  PID:14736
- C:\Windows\System\mrWubkk.exe
  C:\Windows\System\mrWubkk.exe
  2⤵
  PID:13376
- C:\Windows\System\beKoyBU.exe
  C:\Windows\System\beKoyBU.exe
  2⤵
  PID:13440
- C:\Windows\System\cOoeBtt.exe
  C:\Windows\System\cOoeBtt.exe
  2⤵
  PID:14380
- C:\Windows\System\AsCKlxI.exe
  C:\Windows\System\AsCKlxI.exe
  2⤵
  PID:14440
- C:\Windows\System\GfwrHkM.exe
  C:\Windows\System\GfwrHkM.exe
  2⤵
  PID:14468
- C:\Windows\System\DYsusiC.exe
  C:\Windows\System\DYsusiC.exe
  2⤵
  PID:14916
- C:\Windows\System\NmuMiHK.exe
  C:\Windows\System\NmuMiHK.exe
  2⤵
  PID:14968
- C:\Windows\System\ocSaJta.exe
  C:\Windows\System\ocSaJta.exe
  2⤵
  PID:14992
- C:\Windows\System\JoEwgjX.exe
  C:\Windows\System\JoEwgjX.exe
  2⤵
  PID:15060
- C:\Windows\System\VKpMmHX.exe
  C:\Windows\System\VKpMmHX.exe
  2⤵
  PID:14036
- C:\Windows\System\sGXVxrX.exe
  C:\Windows\System\sGXVxrX.exe
  2⤵
  PID:15232
- C:\Windows\System\MnUMNNd.exe
  C:\Windows\System\MnUMNNd.exe
  2⤵
  PID:13568
- C:\Windows\System\MjtbMnh.exe
  C:\Windows\System\MjtbMnh.exe
  2⤵
  PID:15376
- C:\Windows\System\YbBctsx.exe
  C:\Windows\System\YbBctsx.exe
  2⤵
  PID:15400
- C:\Windows\System\vfDyEWR.exe
  C:\Windows\System\vfDyEWR.exe
  2⤵
  PID:15428
- C:\Windows\System\SwwoUqG.exe
  C:\Windows\System\SwwoUqG.exe
  2⤵
  PID:15448
- C:\Windows\System\JUXewxc.exe
  C:\Windows\System\JUXewxc.exe
  2⤵
  PID:15472
- C:\Windows\System\RrYyXrR.exe
  C:\Windows\System\RrYyXrR.exe
  2⤵
  PID:15496
- C:\Windows\System\eESoZzS.exe
  C:\Windows\System\eESoZzS.exe
  2⤵
  PID:15516
- C:\Windows\System\ZzQXFec.exe
  C:\Windows\System\ZzQXFec.exe
  2⤵
  PID:15532
- C:\Windows\System\neoUzzt.exe
  C:\Windows\System\neoUzzt.exe
  2⤵
  PID:15556
- C:\Windows\System\hbFghWk.exe
  C:\Windows\System\hbFghWk.exe
  2⤵
  PID:15580
- C:\Windows\System\mwJVsbQ.exe
  C:\Windows\System\mwJVsbQ.exe
  2⤵
  PID:15596
- C:\Windows\System\RzjcoIf.exe
  C:\Windows\System\RzjcoIf.exe
  2⤵
  PID:15612
- C:\Windows\System\WCiAaHe.exe
  C:\Windows\System\WCiAaHe.exe
  2⤵
  PID:15636
- C:\Windows\System\ajFWWsK.exe
  C:\Windows\System\ajFWWsK.exe
  2⤵
  PID:15660
- C:\Windows\System\TrlImzq.exe
  C:\Windows\System\TrlImzq.exe
  2⤵
  PID:15680
- C:\Windows\System\dDmxECZ.exe
  C:\Windows\System\dDmxECZ.exe
  2⤵
  PID:15696
- C:\Windows\System\JTqBWxC.exe
  C:\Windows\System\JTqBWxC.exe
  2⤵
  PID:15728
- C:\Windows\System\MJJnLhO.exe
  C:\Windows\System\MJJnLhO.exe
  2⤵
  PID:15760
- C:\Windows\System\wqIaCbI.exe
  C:\Windows\System\wqIaCbI.exe
  2⤵
  PID:15788
- C:\Windows\System\vYDsDBH.exe
  C:\Windows\System\vYDsDBH.exe
  2⤵
  PID:15804
- C:\Windows\System\djLTqwL.exe
  C:\Windows\System\djLTqwL.exe
  2⤵
  PID:15832
- C:\Windows\System\pZsullT.exe
  C:\Windows\System\pZsullT.exe
  2⤵
  PID:15852
- C:\Windows\System\HyydbGA.exe
  C:\Windows\System\HyydbGA.exe
  2⤵
  PID:15876
- C:\Windows\System\lVLWTuv.exe
  C:\Windows\System\lVLWTuv.exe
  2⤵
  PID:15892
- C:\Windows\System\PVupwjh.exe
  C:\Windows\System\PVupwjh.exe
  2⤵
  PID:15908
- C:\Windows\System\YLzZjBs.exe
  C:\Windows\System\YLzZjBs.exe
  2⤵
  PID:15924
- C:\Windows\System\KFihUjG.exe
  C:\Windows\System\KFihUjG.exe
  2⤵
  PID:15948
- C:\Windows\System\eTYHtsQ.exe
  C:\Windows\System\eTYHtsQ.exe
  2⤵
  PID:15976
- C:\Windows\System\HpsIJFn.exe
  C:\Windows\System\HpsIJFn.exe
  2⤵
  PID:16004
- C:\Windows\System\ArfnGsf.exe
  C:\Windows\System\ArfnGsf.exe
  2⤵
  PID:16024
- C:\Windows\System\NUxqlyU.exe
  C:\Windows\System\NUxqlyU.exe
  2⤵
  PID:16052
- C:\Windows\System\hevZhKN.exe
  C:\Windows\System\hevZhKN.exe
  2⤵
  PID:16072
- C:\Windows\System\wSnTlno.exe
  C:\Windows\System\wSnTlno.exe
  2⤵
  PID:16092
- C:\Windows\System\ZHtaDGQ.exe
  C:\Windows\System\ZHtaDGQ.exe
  2⤵
  PID:16128
- C:\Windows\System\xuUrRsa.exe
  C:\Windows\System\xuUrRsa.exe
  2⤵
  PID:16156
- C:\Windows\System\luWBaQG.exe
  C:\Windows\System\luWBaQG.exe
  2⤵
  PID:16172
- C:\Windows\System\TNTriFr.exe
  C:\Windows\System\TNTriFr.exe
  2⤵
  PID:16188
- C:\Windows\System\tYAHQAs.exe
  C:\Windows\System\tYAHQAs.exe
  2⤵
  PID:16212
- C:\Windows\System\HENsZLg.exe
  C:\Windows\System\HENsZLg.exe
  2⤵
  PID:16240
- C:\Windows\System\tDWRLSS.exe
  C:\Windows\System\tDWRLSS.exe
  2⤵
  PID:16256
- C:\Windows\System\UXqNBpo.exe
  C:\Windows\System\UXqNBpo.exe
  2⤵
  PID:16272
- C:\Windows\System\CYyQWGG.exe
  C:\Windows\System\CYyQWGG.exe
  2⤵
  PID:16292
- C:\Windows\System\tagrUdu.exe
  C:\Windows\System\tagrUdu.exe
  2⤵
  PID:16312
- C:\Windows\System\YVWmOBN.exe
  C:\Windows\System\YVWmOBN.exe
  2⤵
  PID:16332
- C:\Windows\System\agJFxKF.exe
  C:\Windows\System\agJFxKF.exe
  2⤵
  PID:16348
- C:\Windows\System\VmDBPKt.exe
  C:\Windows\System\VmDBPKt.exe
  2⤵
  PID:16380
- C:\Windows\System\HYOBFJH.exe
  C:\Windows\System\HYOBFJH.exe
  2⤵
  PID:14828
- C:\Windows\System\jUvvNMa.exe
  C:\Windows\System\jUvvNMa.exe
  2⤵
  PID:14484
- C:\Windows\System\mIJLEKP.exe
  C:\Windows\System\mIJLEKP.exe
  2⤵
  PID:14332
- C:\Windows\System\WNUxGau.exe
  C:\Windows\System\WNUxGau.exe
  2⤵
  PID:14568
- C:\Windows\System\QFUjhUB.exe
  C:\Windows\System\QFUjhUB.exe
  2⤵
  PID:15040
- C:\Windows\System\nrOWDzt.exe
  C:\Windows\System\nrOWDzt.exe
  2⤵
  PID:15088
- C:\Windows\System\YbltmNT.exe
  C:\Windows\System\YbltmNT.exe
  2⤵
  PID:14668
- C:\Windows\System\cteUilr.exe
  C:\Windows\System\cteUilr.exe
  2⤵
  PID:15164
- C:\Windows\System\gkVNbUR.exe
  C:\Windows\System\gkVNbUR.exe
  2⤵
  PID:14480
- C:\Windows\System\zWwpTvn.exe
  C:\Windows\System\zWwpTvn.exe
  2⤵
  PID:14988
- C:\Windows\System\xNNWskf.exe
  C:\Windows\System\xNNWskf.exe
  2⤵
  PID:15184
- C:\Windows\System\fWIbCgY.exe
  C:\Windows\System\fWIbCgY.exe
  2⤵
  PID:15340
- C:\Windows\System\FlQQpHE.exe
  C:\Windows\System\FlQQpHE.exe
  2⤵
  PID:15436
- C:\Windows\System\CrjgIPs.exe
  C:\Windows\System\CrjgIPs.exe
  2⤵
  PID:15492
- C:\Windows\System\PmYPEys.exe
  C:\Windows\System\PmYPEys.exe
  2⤵
  PID:14304
- C:\Windows\System\xNKyBec.exe
  C:\Windows\System\xNKyBec.exe
  2⤵
  PID:14932
- C:\Windows\System\sQLDSBy.exe
  C:\Windows\System\sQLDSBy.exe
  2⤵
  PID:15588
- C:\Windows\System\vIuWfhS.exe
  C:\Windows\System\vIuWfhS.exe
  2⤵
  PID:15692
- C:\Windows\System\cwERayI.exe
  C:\Windows\System\cwERayI.exe
  2⤵
  PID:13068
- C:\Windows\System\RgodQre.exe
  C:\Windows\System\RgodQre.exe
  2⤵
  PID:15132
- C:\Windows\System\VYupRwI.exe
  C:\Windows\System\VYupRwI.exe
  2⤵
  PID:15784
- C:\Windows\System\FOkciWa.exe
  C:\Windows\System\FOkciWa.exe
  2⤵
  PID:15900
- C:\Windows\System\cDnXcoA.exe
  C:\Windows\System\cDnXcoA.exe
  2⤵
  PID:16016
- C:\Windows\System\YNmapna.exe
  C:\Windows\System\YNmapna.exe
  2⤵
  PID:16080
- C:\Windows\System\EXOKVli.exe
  C:\Windows\System\EXOKVli.exe
  2⤵
  PID:16140
- C:\Windows\System\hJOrgic.exe
  C:\Windows\System\hJOrgic.exe
  2⤵
  PID:16400
- C:\Windows\System\tPnFMxP.exe
  C:\Windows\System\tPnFMxP.exe
  2⤵
  PID:16428
- C:\Windows\System\NLLanHB.exe
  C:\Windows\System\NLLanHB.exe
  2⤵
  PID:16456
- C:\Windows\System\snfbNZo.exe
  C:\Windows\System\snfbNZo.exe
  2⤵
  PID:16484
- C:\Windows\System\wEAypxu.exe
  C:\Windows\System\wEAypxu.exe
  2⤵
  PID:16504
- C:\Windows\System\udnJwCe.exe
  C:\Windows\System\udnJwCe.exe
  2⤵
  PID:16524
- C:\Windows\System\FawCsIC.exe
  C:\Windows\System\FawCsIC.exe
  2⤵
  PID:16540
- C:\Windows\System\GltYvIz.exe
  C:\Windows\System\GltYvIz.exe
  2⤵
  PID:16568
- C:\Windows\System\kOmsOGR.exe
  C:\Windows\System\kOmsOGR.exe
  2⤵
  PID:16596
- C:\Windows\System\UVHtkrB.exe
  C:\Windows\System\UVHtkrB.exe
  2⤵
  PID:16612
- C:\Windows\System\NpAJXZX.exe
  C:\Windows\System\NpAJXZX.exe
  2⤵
  PID:16632
- C:\Windows\System\fCnjcyq.exe
  C:\Windows\System\fCnjcyq.exe
  2⤵
  PID:16660
- C:\Windows\System\uySaRvq.exe
  C:\Windows\System\uySaRvq.exe
  2⤵
  PID:16676
- C:\Windows\System\zVCYKkv.exe
  C:\Windows\System\zVCYKkv.exe
  2⤵
  PID:16704
- C:\Windows\System\siEAoYj.exe
  C:\Windows\System\siEAoYj.exe
  2⤵
  PID:16740
- C:\Windows\System\wwlJpWn.exe
  C:\Windows\System\wwlJpWn.exe
  2⤵
  PID:16764
- C:\Windows\System\ibCpFNM.exe
  C:\Windows\System\ibCpFNM.exe
  2⤵
  PID:16792
- C:\Windows\System\KTFdrVf.exe
  C:\Windows\System\KTFdrVf.exe
  2⤵
  PID:16812
- C:\Windows\System\tzSknhf.exe
  C:\Windows\System\tzSknhf.exe
  2⤵
  PID:16836
- C:\Windows\System\TpbHlOB.exe
  C:\Windows\System\TpbHlOB.exe
  2⤵
  PID:16860
- C:\Windows\System\bOvKiaN.exe
  C:\Windows\System\bOvKiaN.exe
  2⤵
  PID:16884
- C:\Windows\System\gbsnIMv.exe
  C:\Windows\System\gbsnIMv.exe
  2⤵
  PID:17176
- C:\Windows\System\MayeyQr.exe
  C:\Windows\System\MayeyQr.exe
  2⤵
  PID:17196
- C:\Windows\System\TNWLFTs.exe
  C:\Windows\System\TNWLFTs.exe
  2⤵
  PID:17212
- C:\Windows\System\lxIFeNr.exe
  C:\Windows\System\lxIFeNr.exe
  2⤵
  PID:17228
- C:\Windows\System\WqeQKRo.exe
  C:\Windows\System\WqeQKRo.exe
  2⤵
  PID:17244
- C:\Windows\System\ZXevGJj.exe
  C:\Windows\System\ZXevGJj.exe
  2⤵
  PID:17260
- C:\Windows\System\emECCOj.exe
  C:\Windows\System\emECCOj.exe
  2⤵
  PID:17276
- C:\Windows\System\WXycrzP.exe
  C:\Windows\System\WXycrzP.exe
  2⤵
  PID:17292
- C:\Windows\System\naqWhrY.exe
  C:\Windows\System\naqWhrY.exe
  2⤵
  PID:17308
- C:\Windows\System\CAmGycS.exe
  C:\Windows\System\CAmGycS.exe
  2⤵
  PID:17328
- C:\Windows\System\orwvdzb.exe
  C:\Windows\System\orwvdzb.exe
  2⤵
  PID:17352
- C:\Windows\System\fkcJRus.exe
  C:\Windows\System\fkcJRus.exe
  2⤵
  PID:17376
- C:\Windows\System\OFXTjEB.exe
  C:\Windows\System\OFXTjEB.exe
  2⤵
  PID:17392

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:15832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BEZVoed.exe

Filesize
1.6MB

MD5
ec7764a0363bb057a2a757e0af81d247

SHA1
12d1da3f144f36c441fb44b5b832272ff1dae1d0

SHA256
5c573573a2811f30fb24522a2bf1ffa7a64396726940c8f1c09097c2b8f53444

SHA512
46d833c38ea0cfc6d16c8bf291406ce0594305c1b7ac22b1abe6a59514eb9a9a8249d9142090a0baf90ad2c93eb912ac72731d6096424ccab8ee2bdca95e268e

Download Submit
C:\Windows\System\DTXFMsb.exe

Filesize
1.6MB

MD5
c3d505d8b387485c85a228b42b7a6583

SHA1
2030eeadfc31462ef8c9666a0559448e3ca6e811

SHA256
f16b4535739f7cb21390cfdacc7a2244c1020016f4073d659ac96b5815b450ea

SHA512
5cdc11de470cea769e6790a8952d75b76aa68e81007d1d85d911cdabf7453a0d803511880ec5c5cd0e8cd3359630e748e256f71bf0cc09c3e025fcb486948df6

Download Submit
C:\Windows\System\DbWClDK.exe

Filesize
1.6MB

MD5
02a133c2326913e179974a8a6fe14575

SHA1
c9f718f63cdd6b7fcfc27d5ea1ca698a1fd2bf96

SHA256
5119ec4e765f0c36aadd7cc92141f55f5eacf6ffbdbe2fca858273cb2dc01adc

SHA512
f6884b06afc98696d2b8677fcc495660383689cf7c8caad6ea846efd046a9064db34219f8529ace7c2931e767d0345642b1e863c33ed358371703474525b3845

Download Submit
C:\Windows\System\EMXBvsS.exe

Filesize
1.6MB

MD5
6d9f94f81fbdcd0f51e26b62b9c2dc04

SHA1
9a15068d4284df5e8b01576b14c1782263c32fee

SHA256
1fb3705429957189f1033f141be299bca9dbc9b1bbf302ac8bf440808870bc45

SHA512
08ba7342a13c89077506a6d3f6b2477c6849837e4e6ca721d7ba58fa00a921b5d23fdfd89e46bb3cc2277aa253de29ed562ded84167c424994db4bb52af5236a

Download Submit
C:\Windows\System\ENYoJPR.exe

Filesize
1.6MB

MD5
e6225eb07b3e57e47e13f78154c6aff7

SHA1
04dd56b1f60e57737213a6636817cfd91c0b9d9c

SHA256
8733dd008cbb671a2ba5202b5bf7f26547fa50e8e44e9b4e94247a1ce023eb94

SHA512
5d5b438ebf266d4a65c057532e1fe2bed8160dc1fe49019551a94ddcb586de165d1251b9e3b24032b49415162ce3794569d4789084cba26f07345db52e9bc3c3

Download Submit
C:\Windows\System\EfjpRaT.exe

Filesize
1.6MB

MD5
edb9a8068ad4059e202e672bf03a13a8

SHA1
d7344aca49b6ff50a3e59f0cd5dfbd91f38d016d

SHA256
5ed1e4ea174d6027f3dbfb736cff34c81e50ca809bb386976783d502a79d265e

SHA512
8243f047d8fd4583b71bd4c2d32ad3b215a36b2c8cbf7f6bd4510469e44749e4957970f9ae0fad38d3dab3e10de2df8fae359df3d18e2c9cbfc76af6b9d7df01

Download Submit
C:\Windows\System\FAnaQzQ.exe

Filesize
1.6MB

MD5
0f9ffb24bf2a41ac92b4f8a4cbba985d

SHA1
686d40740e00fa7905fa84428531be6164e1f0fc

SHA256
28752ee408f75ef6cfa5501da77f9a61518860fefd605ca8a9cdf238ef1f6c93

SHA512
48ccf68f93051e3008921c2e5cfd3405bf6635527b00c8fda95fd08945cc5e8c214953828f71553f2cc6e8f370847ff68cc788265d4d46e0e862c1c37e9287a8

Download Submit
C:\Windows\System\FClDvBL.exe

Filesize
1.6MB

MD5
98f7679693306951bc385118a1bad418

SHA1
4829ca8f082201c0b07ae6d85ccf45e472febd5c

SHA256
59e33cd2e6f5d1ee5540757bf8624cac3c3cf62dc57f2be806c6216235431eb3

SHA512
34a65459facabea0d499606f36bd9244319d2b072e3b1c269007a908d5e0c3692fbe28494f31fa3660fa6e1958359fc01fa25a1dafd8cca39808f5ba6c450aa1

Download Submit
C:\Windows\System\HwUpKTm.exe

Filesize
1.6MB

MD5
0de26159f0a2b8abc0bd48006b630632

SHA1
7f358f489d5f96fa2156d7a5f89deb0d107eb33b

SHA256
435b8968903d08718fc58291574d46ee3596031d25ef3dcff5403a922d910037

SHA512
cde070317a37c00512e77a1b83ffdaa595dd4262ed1e19b8e96ffdb6e0dd077fb783b4430720072915553051b32a274939d5d4f70bf245c2f0816cc198144730

Download Submit
C:\Windows\System\KSDLFWz.exe

Filesize
1.6MB

MD5
f6ecd7555ab745cea082e157ac545c61

SHA1
7682cae87a811a11eb93afbee6427478db924cfb

SHA256
85f7684e269f229b00be51dfd9573ac0bdeed4ff3075378b258823d4a08f331f

SHA512
d2afd2e9ddb20fbfe8015cc74df4d11cbb70c7362d5a7ebbe1f185132be91fbfbc956f606579f65ec4ef5bc7394f231912c14067bfe1c80575def5c02d380f9c

Download Submit
C:\Windows\System\KxCSxsG.exe

Filesize
1.6MB

MD5
61eff8d43dfd69d85051146106d76bb4

SHA1
2c8c41afa40f677f41654e5de8918fe8c99e9d78

SHA256
284c21ba788507e613c9935bf14ee7abe44db5658ec1ee737e6ca70f69831a48

SHA512
ef6c72ec02df3570cc773cec5f2fe683107d5f0daafca23b2162d05f13b003cb788d551cf07b669e7420bdd0208edf3ab57a72724f46fd1be74196dacffe6dc4

Download Submit
C:\Windows\System\LEbJDSG.exe

Filesize
1.6MB

MD5
119d3ee3596a74fb55e70addf1f5c9a4

SHA1
8b6422b03ba374f34ef13ff205ab6fbdc18224f5

SHA256
0512b31ea08c38c2327cf4f9eb9eeaabc1689e7d282551beb5710c34c82f81f5

SHA512
21efb910552c765d58837ba1fdaad747e1e6977152950ef95660fd7c6da9c1798bf96a2a6dd7c9b3e22150faf9c14c0da7968a63808cb164b928b11d494028e6

Download Submit
C:\Windows\System\NSAeOeh.exe

Filesize
1.6MB

MD5
87e7a3bfb0c97bb31ff05a9137c6e1c5

SHA1
413ace203cbb3b9bddceb14e1475a0e54d1251cd

SHA256
4cdc3a997690ccf194a39e01da7ce03cc2fc1980e063444004959c049a98230a

SHA512
7139c5a3249cf09266d54ea8f0ea09e07cccefd3230689fceea7b5f7e31fd6ee5c34f96be2937647314f4e140eea34d033f72429b777095f7c5cb3fdca2d1d95

Download Submit
C:\Windows\System\OHvbzSA.exe

Filesize
1.6MB

MD5
709766603f1690ff62a22f0b8b73bf5a

SHA1
9eaa4a38133b8f3893cbc8533a25d498be878c1d

SHA256
b366fa07d7c19c4f24e4bad1697557cf56244d1a84793895b8990e108fba891d

SHA512
3afde214aab71099265aadb37ee58ce4af6eb4bb6254aa7bbd5558b33d863da39817f2accbedc35ac0bc1f7492f762e28e296581f968c3efb3d2bbe6acea68f7

Download Submit
C:\Windows\System\OoYQtOX.exe

Filesize
1.6MB

MD5
093c46cdf4dd7aa532d3e0336d39ed97

SHA1
0a7ac4d76d1506d6d84ae2b41ef4c474437b742d

SHA256
61fd871636fdab5e4831e48a815e9034f315f931dce90ebc420a10b3a1c50218

SHA512
5583e7e0ab35e81db5551d88dbc1abb6341bfdaff7e1ed468c6ee6e6ce441305cd63738463d9efe2d928a74b89820244c009e17a4b09b99c41bcbbac7d3f6c9d

Download Submit
C:\Windows\System\PnUzJnO.exe

Filesize
1.6MB

MD5
da2ae593327ab122e240ba891aa81d3b

SHA1
0701a7620632a645d03062b2cb036bbfd3dcb361

SHA256
0246b84d62547ba180b9513d2d89681bd8351c8aec0443ad22e4d53972efce25

SHA512
36af47e6487db06063eb48ad43668b1b07d33907ca718da34bc39fb6d5d0aec9f9b112a1286d5f65ade6876912ef88965f931492ec98f29a586466ec5e97fe84

Download Submit
C:\Windows\System\RnmEebW.exe

Filesize
1.6MB

MD5
01c68455cebfcfe1ad8b137facba1558

SHA1
78772b23b86910105db26e16e6692dd8902daba6

SHA256
956bf901fa0f93d1a52d9d60def3aa2d77b14e6659ef6cb0dcdf522d9c25558a

SHA512
78227d75a68bc0b2874a81143f538ad97e220eac5521dd23e3cdb654ef6e50db0fa4714d0348041c838ad4814660c0f9c3b028ae1322de9c34818d2f4a3f84d7

Download Submit
C:\Windows\System\SemaBoO.exe

Filesize
1.6MB

MD5
6c015d48a06e55a4f2723798ced95514

SHA1
085729a159d5a2ea83d0b1a54771658c564d78e2

SHA256
714fbfe40363a4b85bbe2d1d530814cf402857791c8c9503910b1b9da273417d

SHA512
be1e3bd7a8d97f9d42d2a9766841912055f8eca15c73f3d704dedc8e3b212e503c5d7df73ed5bde807db742925f33a39d14749182517bf414fbaaf034e51b884

Download Submit
C:\Windows\System\TBvrCUt.exe

Filesize
1.6MB

MD5
ac99d43f4376e716a840bc349919d9e2

SHA1
1e180a171c90af2dda00d2c0027465f0930f43ff

SHA256
708be27be4238aa24b83a2a41042290a59072630ac6a87eb9928ffe1b7abe374

SHA512
6578b8e8dc2a95c52e2742b5fc072731ffd3e79fcb3a81355c45ac4c71dafd8e79059638b992224ae632f1a22c2bc08d278aa9b3fc696b0e99abd6cdbb5086aa

Download Submit
C:\Windows\System\TGrpofs.exe

Filesize
1.6MB

MD5
dc396032550860effdfcd4e7f8f88eb2

SHA1
dba22fdc787423b0e90e920c4580b0862db0d987

SHA256
a35979abb134c722db081f16f16cca6607ca65103357dab60890bb1158b39e61

SHA512
aac7790a65052ea944f2fdf372d5639bb53178165e16002a37a41a6d8f08c7e53e0cc75020b72d97090964c058a7ca5d9ac90a07f9785e2ab48ddddd5d376a2a

Download Submit
C:\Windows\System\UEfIfeb.exe

Filesize
1.6MB

MD5
5fad98e73374271d658637d67b5e8897

SHA1
5dba20dbfd1ef14bd831c4afd08a4fe4544c6b8c

SHA256
aa0677f6c2a3435f19d73455f40d6a602eaebc4e6a0c9999651f3dc9352a79ef

SHA512
444c278a25c833373f18c45cdab1444f0b70892201ff9f62f0001c35098ce6308d03ba5924da0bbd28befe7b34890232baf652d03f2a0caf8336b2cd12c2775f

Download Submit
C:\Windows\System\UxEkUXa.exe

Filesize
1.6MB

MD5
d95639dbab996e51acece1c49e1c2878

SHA1
f76ef7be7b8fd4293adfb1ac9af4f8259b6286fa

SHA256
4273c9112737d7591eb09670af35a8c26704c91a6cfa94b2d05c3a7fd6ff051d

SHA512
d3740277735e0cda0a960f7d09e54921f8d332f53ab8a15ed1a17b5fd65412826783c022613ef9164bdc3049835a26bfb879c0463f8ff9f2875a29577f9a9fe6

Download Submit
C:\Windows\System\ZonAlvP.exe

Filesize
1.6MB

MD5
8dc4230420e199ec0af747298eb66254

SHA1
965bf9fd9c945edbafde3fec55ded97751450f4d

SHA256
69e971ae3bfc90889d596dcf22330740fb05ba1f7b803e36edaa45a0899b0f54

SHA512
53927db434c03f30bee732e9dde3e8ce8e15a7c6ac6e12643a9a6601cbfca32c6175e0e9116436edb947dec1aea598cec537bbaceb0429f5c8e66ee8f78568b7

Download Submit
C:\Windows\System\aOFOPyL.exe

Filesize
1.6MB

MD5
2a5ee2dd6d61760236b270332f3a9824

SHA1
358bb85b41c84385af2969b744ebd2af32b9b823

SHA256
4f273095a17e3eaf31f6a37cb0d2d97cc7b84b20e14c430bb8d4ec7e2246a6fc

SHA512
1dc0476e50e4e8a6a1d0e00791bbc274f4aa86a27e9a3f4567585725f4ce7e5c940feb3757efdb2174a3ac5b8b82757a38f1d9be2aa6603e97844fe21911148a

Download Submit
C:\Windows\System\kkEITHE.exe

Filesize
1.6MB

MD5
e10a7ba8cc66262f00803f477e28b2d3

SHA1
76a19d18bdba2093ed48d2797f911f207b7b93cb

SHA256
d29a0d63dff91b7b9a386d9cbf2a7a14b765673339a98ca94aa84f34bad4d842

SHA512
f4c7d145c6cbbc3ebe2f9f0eed4942d17525976079c62b1d86c11299e5de45b574c632b617f226b36e0049d357e599325b21333e6c90934cbfea7488e95266a3

Download Submit
C:\Windows\System\rFhdIXy.exe

Filesize
1.6MB

MD5
94aa6871b2dd2bf2eba3ab8abaf86684

SHA1
8f28f0a0b9eea04fa10d4cdab2331d3f7f845d44

SHA256
b0f1b5c124f2ccff71fd5e742fe6128ac2b29d1735ffaa0845d9f7d017c1b723

SHA512
2c9789d401ed2f4ccfe3ba00af6b5cc487d09d3a4735d44845387830f4a700391a35a10a5a2d2476552d1896f983c3c175604ec0cb05e92434589d43d974e742

Download Submit
C:\Windows\System\soxFiGO.exe

Filesize
1.6MB

MD5
ae70f70df902501ff74899fcfc041ad2

SHA1
999dbefdddd565c6607cbd7e4a48d753409b3080

SHA256
eb7caa46584652eed04c1901bd6d44a47cc9e3ed9ed348710d3c78f1024f1302

SHA512
7f4f4a6c9a0b6edab017c1249c595938b1c858ad590c3e0e054e48873d36c95eca7d62a72bf57391267e626a608b44402bbc7d3feb3d954a2922b7f394df3c22

Download Submit
C:\Windows\System\tZfSNtp.exe

Filesize
1.6MB

MD5
ddf56520b2523a2a0f965b791fcb9204

SHA1
53e48943809c702524e96037f836b59a8a77cabb

SHA256
38197e822eaa1df8e74609a28670a982ff6c428beaaaab77920f2e9a689f7b2c

SHA512
63d7bad8513d8a6aff0d50eba9419bb2791da3df7d348b1e17d831a14d18becfb6a16c9bb8a1ad987c8cb9cf589eb7b5c65bf0ea9e10f416123cf80857503cb6

Download Submit
C:\Windows\System\ueXpaIi.exe

Filesize
1.6MB

MD5
bfc3501322f5dd3d68bb2eba294d2018

SHA1
fd495849172259f49f6a784376974ad33307a64f

SHA256
16f9e24444224329e52dbead3dc18b009eb773d2fda9968ab2c24d7b9d027bab

SHA512
cf8d0484c953f07603976e40712c3b6fd45c35080dca44088d2aa31a68d930514178cb2638dc6b6f10819b7bd256ac0fe59eee4f0d5656a3dfdd41464537b2ee

Download Submit
C:\Windows\System\ufsBDCq.exe

Filesize
1.6MB

MD5
572a0ffa2e3831f97dbe18200d5147e8

SHA1
ffbd74ce2ea709bfcf2b0515f0d8ddb29446d553

SHA256
37b718941daeb00c8fc4573c771a8ca004ccea907ed9257ac809241bde793772

SHA512
bbb7e44ea64e26d79af3ff6880a586fc54d817d18f6dd8cd6b1a173abf04edd853868349fd660a375993e568af41293251c9192d1f7f2402073793a2dfd726cd

Download Submit
C:\Windows\System\xTvEJLM.exe

Filesize
1.6MB

MD5
209f5ab8261c295308d226ae48794ba3

SHA1
4dbb751727feea5e41c0d8d0596bffd5198704a0

SHA256
b3672167cae339dd892c8e7ffcdecbdb4d54a2f2750ba85cd5c8e857dba61686

SHA512
7acdf0870834988182adb4d796c30fff7203ba0da2a84544eee56bd884e2cfcd8176aaf0cf59569fb7f6fc9bc82c5c6727281adf57c10e77e7d38f3e310d518c

Download Submit
C:\Windows\System\xUAyzRu.exe

Filesize
1.6MB

MD5
764e9419e1a82fc2067522f03e5ab758

SHA1
e4bce58abf6772f387d3e8fb5f60122c86342a5a

SHA256
31e4f8942dbd7e03331eda44f1a9e2476f708de63cf8e0023f76c836564cb0af

SHA512
5d35e11409c398627640380c3aceceaffc928398eaa220b93a48527e9d32242df481b77b4d28107ae52d384c4ed04c53d7201513f2b9704901b6c8571e58b579

Download Submit
C:\Windows\System\yrGQVJy.exe

Filesize
1.6MB

MD5
76697808b99764a46f8a3d06fd1ea242

SHA1
3b3c475ad457772195a6bdfe3698b2f58cb452ac

SHA256
26ede561a43dc0159f750846ba73da230ef0d735def76effbb6978f5004f8b05

SHA512
b47b4f613f77a62b9916a57e5232d0962b67e078328e7993fe3eb26865ceb198ecd72604d85505a908f379e9cf1a24038752ea585d8067e4a7dfe5aaf1872381

Download Submit
C:\Windows\System\ytKgRdY.exe

Filesize
1.6MB

MD5
f413732b4a175cd877dd2601f2387974

SHA1
055a80b718eca91bccdbe79b6258b11e417d90af

SHA256
0d3046bf369982fa34d7f137828fede715099d2cdb2ac196f7eda7bcdc5fb92d

SHA512
81c17e7a610f51d27dd0d5487f793415e0a685cacc1c45c846d456887c087b00cb5ec4336d0b53830946b4a8ecec071fb264a46511ed498c4bb21d81ad749c04

Download Submit
memory/2588-0-0x00000256CF420000-0x00000256CF430000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads