xmrig | 2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
Size

1.7MB
MD5

335a035fd1d5a077eaec13b350667f38
SHA1

a4b001364848dab4c48a5efa79694c14b4c3bca0
SHA256

2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f
SHA512

20f9dfe54f3cc8d7124b608382cf14d26870b8b537f2bb0eb3864d90603d5af00ec188d0a14aaa2bf5ddcdd9052528692bcf1734ef7b36d2bff0c54c05f73961
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRakGn38yJP5zsOl:GemTLkNdfE0pZya

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c54-3.dat	xmrig
behavioral2/files/0x0007000000023c60-7.dat	xmrig
behavioral2/files/0x0007000000023c61-6.dat	xmrig
behavioral2/files/0x0007000000023c62-17.dat	xmrig
behavioral2/files/0x0007000000023c63-23.dat	xmrig
behavioral2/files/0x0007000000023c64-31.dat	xmrig
behavioral2/files/0x0007000000023c65-35.dat	xmrig
behavioral2/files/0x0007000000023c66-40.dat	xmrig
behavioral2/files/0x0007000000023c67-48.dat	xmrig
behavioral2/files/0x0009000000023c55-47.dat	xmrig
behavioral2/files/0x0007000000023c6a-61.dat	xmrig
behavioral2/files/0x0007000000023c6b-66.dat	xmrig
behavioral2/files/0x0007000000023c6c-75.dat	xmrig
behavioral2/files/0x0007000000023c69-64.dat	xmrig
behavioral2/files/0x0007000000023c68-59.dat	xmrig
behavioral2/files/0x0007000000023c6d-81.dat	xmrig
behavioral2/files/0x0007000000023c72-97.dat	xmrig
behavioral2/files/0x0007000000023c71-108.dat	xmrig
behavioral2/files/0x0007000000023c77-118.dat	xmrig
behavioral2/files/0x0007000000023c79-129.dat	xmrig
behavioral2/files/0x0007000000023c7e-153.dat	xmrig
behavioral2/files/0x0007000000023c7c-160.dat	xmrig
behavioral2/files/0x0007000000023c7d-156.dat	xmrig
behavioral2/files/0x0007000000023c7b-154.dat	xmrig
behavioral2/files/0x0007000000023c7a-151.dat	xmrig
behavioral2/files/0x0007000000023c78-146.dat	xmrig
behavioral2/files/0x0007000000023c76-136.dat	xmrig
behavioral2/files/0x0007000000023c74-130.dat	xmrig
behavioral2/files/0x0007000000023c75-123.dat	xmrig
behavioral2/files/0x0007000000023c73-113.dat	xmrig
behavioral2/files/0x0007000000023c70-103.dat	xmrig
behavioral2/files/0x0007000000023c6f-92.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4872	zqAxTkr.exe
4328	sXmfWLd.exe
612	mFMOQSz.exe
3732	sXSXmoF.exe
2280	wAlHPQu.exe
1176	ztCVezl.exe
804	gaasHns.exe
1856	NixFKkB.exe
2040	YYwAaYP.exe
2432	RahzdJR.exe
4396	GqKlieK.exe
3664	GQNCURy.exe
4172	MRHVoIC.exe
4692	ysHwtBb.exe
2308	XjRpQzx.exe
3412	eRnuGtk.exe
3612	yxCKCgs.exe
3652	rlkNUem.exe
3552	YBJtVBe.exe
4428	zezlkbm.exe
4444	lrgoZBv.exe
1688	jfOmWDz.exe
2596	pvhUEOk.exe
3676	aWasuEU.exe
5096	aczEVzR.exe
5112	nXvakpk.exe
4812	rRYqVsc.exe
4744	Iudqpar.exe
1500	oMwngSe.exe
4844	eXgKlYZ.exe
4788	MzJwkal.exe
2604	IUFzQIu.exe
716	tMGwtWG.exe
4440	RplzHSy.exe
2480	iOBnqrv.exe
2740	dNmsqmu.exe
4604	mBzFUbF.exe
1040	eHcnsEI.exe
996	vGOEPoa.exe
1712	QKthRpy.exe
1676	GZfqmCp.exe
1564	MzTVTcT.exe
1800	NQlsjRF.exe
1864	MvzlGTx.exe
1680	kiVdJVO.exe
3360	drlqgeA.exe
3508	htctAIA.exe
3348	wUWyYQh.exe
452	llzfcIT.exe
4368	shzfwRt.exe
4364	xQLtDie.exe
4448	ucmFRKl.exe
1988	yWiBzMf.exe
4580	uMgWAhK.exe
2468	VpKJQLL.exe
2948	ITnCcIL.exe
2300	rcQomuP.exe
4592	wutXDEu.exe
2748	gsWYfLk.exe
4980	sppblWp.exe
3644	fLaZrGk.exe
3696	ljegFEo.exe
2996	mcUaYZI.exe
4416	CBEKckw.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IOYXUqk.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\sXmfWLd.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\SSYtsEI.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\oSPCmsb.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\zWvnQHN.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\jNbjfRG.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\FfHZNLJ.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\ilVtrVs.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\QAbnnqG.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\BxYIABn.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\FBVVqhf.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\vaEAtlb.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\vcMbJFX.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\bqSQDum.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\flvwQOS.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\nWJDNnM.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\EOwNEko.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\qwpmoNX.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\nKIWujA.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\AJOBOMg.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\wOtiqru.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\YxwDLuV.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\RfQLTjc.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\zNxkjXB.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\PCSefRv.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\QITyHOb.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\aKdwZuo.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\cNMWLgh.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\SXErHGd.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\CBEKckw.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\tCZMIkJ.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\hHHjKoK.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\wsRJYKU.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\xQLtDie.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\wutXDEu.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\QOrdLia.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\LjBqqJB.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\XkbzivJ.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\Dpdkbas.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\TtglhwK.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\aJjfcBd.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\PQVMkvW.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\ytEPFFP.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\HtcyRJQ.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\BrOKiSt.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\tLjfQha.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\VVTyZbY.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\PKiCbDc.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\kiVdJVO.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\DlskevQ.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\ylxOnkS.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\lyoRngT.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\AywuYWU.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\LWMfkRz.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\NNhZAZB.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\nSNsiWZ.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\tnKBbJQ.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\JAJlpIW.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\PqtGHQp.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\bfQnUqn.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\ymlULIj.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\IdyfvnJ.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\oFCqLaq.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
File created	C:\Windows\System\mnOKYVl.exe	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4872	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	83
PID 912 wrote to memory of 4872	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	83
PID 912 wrote to memory of 4328	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	84
PID 912 wrote to memory of 4328	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	84
PID 912 wrote to memory of 612	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	85
PID 912 wrote to memory of 612	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	85
PID 912 wrote to memory of 3732	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	86
PID 912 wrote to memory of 3732	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	86
PID 912 wrote to memory of 2280	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	87
PID 912 wrote to memory of 2280	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	87
PID 912 wrote to memory of 1176	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	88
PID 912 wrote to memory of 1176	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	88
PID 912 wrote to memory of 804	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	89
PID 912 wrote to memory of 804	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	89
PID 912 wrote to memory of 1856	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	90
PID 912 wrote to memory of 1856	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	90
PID 912 wrote to memory of 2040	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	91
PID 912 wrote to memory of 2040	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	91
PID 912 wrote to memory of 2432	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	92
PID 912 wrote to memory of 2432	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	92
PID 912 wrote to memory of 4396	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	93
PID 912 wrote to memory of 4396	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	93
PID 912 wrote to memory of 3664	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	94
PID 912 wrote to memory of 3664	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	94
PID 912 wrote to memory of 4172	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	95
PID 912 wrote to memory of 4172	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	95
PID 912 wrote to memory of 4692	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	96
PID 912 wrote to memory of 4692	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	96
PID 912 wrote to memory of 2308	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	97
PID 912 wrote to memory of 2308	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	97
PID 912 wrote to memory of 3412	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	98
PID 912 wrote to memory of 3412	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	98
PID 912 wrote to memory of 3612	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	99
PID 912 wrote to memory of 3612	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	99
PID 912 wrote to memory of 3652	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	100
PID 912 wrote to memory of 3652	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	100
PID 912 wrote to memory of 3552	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	101
PID 912 wrote to memory of 3552	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	101
PID 912 wrote to memory of 4428	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	102
PID 912 wrote to memory of 4428	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	102
PID 912 wrote to memory of 4444	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	103
PID 912 wrote to memory of 4444	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	103
PID 912 wrote to memory of 1688	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	104
PID 912 wrote to memory of 1688	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	104
PID 912 wrote to memory of 2596	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	105
PID 912 wrote to memory of 2596	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	105
PID 912 wrote to memory of 3676	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	106
PID 912 wrote to memory of 3676	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	106
PID 912 wrote to memory of 5096	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	107
PID 912 wrote to memory of 5096	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	107
PID 912 wrote to memory of 5112	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	108
PID 912 wrote to memory of 5112	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	108
PID 912 wrote to memory of 4812	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	109
PID 912 wrote to memory of 4812	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	109
PID 912 wrote to memory of 4744	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	110
PID 912 wrote to memory of 4744	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	110
PID 912 wrote to memory of 1500	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	111
PID 912 wrote to memory of 1500	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	111
PID 912 wrote to memory of 4844	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	112
PID 912 wrote to memory of 4844	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	112
PID 912 wrote to memory of 4788	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	113
PID 912 wrote to memory of 4788	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	113
PID 912 wrote to memory of 2604	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	114
PID 912 wrote to memory of 2604	912	2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe	114

C:\Users\Admin\AppData\Local\Temp\2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe
"C:\Users\Admin\AppData\Local\Temp\2fed97b1447d21c50a6f3ee3031bda961b4d6c424fe5df7d31426656d96fcd7f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\System\zqAxTkr.exe
  C:\Windows\System\zqAxTkr.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\sXmfWLd.exe
  C:\Windows\System\sXmfWLd.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\mFMOQSz.exe
  C:\Windows\System\mFMOQSz.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\sXSXmoF.exe
  C:\Windows\System\sXSXmoF.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\wAlHPQu.exe
  C:\Windows\System\wAlHPQu.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ztCVezl.exe
  C:\Windows\System\ztCVezl.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\gaasHns.exe
  C:\Windows\System\gaasHns.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\NixFKkB.exe
  C:\Windows\System\NixFKkB.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\YYwAaYP.exe
  C:\Windows\System\YYwAaYP.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\RahzdJR.exe
  C:\Windows\System\RahzdJR.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\GqKlieK.exe
  C:\Windows\System\GqKlieK.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\GQNCURy.exe
  C:\Windows\System\GQNCURy.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\MRHVoIC.exe
  C:\Windows\System\MRHVoIC.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\ysHwtBb.exe
  C:\Windows\System\ysHwtBb.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\XjRpQzx.exe
  C:\Windows\System\XjRpQzx.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\eRnuGtk.exe
  C:\Windows\System\eRnuGtk.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\yxCKCgs.exe
  C:\Windows\System\yxCKCgs.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\rlkNUem.exe
  C:\Windows\System\rlkNUem.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\YBJtVBe.exe
  C:\Windows\System\YBJtVBe.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\zezlkbm.exe
  C:\Windows\System\zezlkbm.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\lrgoZBv.exe
  C:\Windows\System\lrgoZBv.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\jfOmWDz.exe
  C:\Windows\System\jfOmWDz.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\pvhUEOk.exe
  C:\Windows\System\pvhUEOk.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\aWasuEU.exe
  C:\Windows\System\aWasuEU.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\aczEVzR.exe
  C:\Windows\System\aczEVzR.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\nXvakpk.exe
  C:\Windows\System\nXvakpk.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\rRYqVsc.exe
  C:\Windows\System\rRYqVsc.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\Iudqpar.exe
  C:\Windows\System\Iudqpar.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\oMwngSe.exe
  C:\Windows\System\oMwngSe.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\eXgKlYZ.exe
  C:\Windows\System\eXgKlYZ.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\MzJwkal.exe
  C:\Windows\System\MzJwkal.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\IUFzQIu.exe
  C:\Windows\System\IUFzQIu.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\tMGwtWG.exe
  C:\Windows\System\tMGwtWG.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\RplzHSy.exe
  C:\Windows\System\RplzHSy.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\iOBnqrv.exe
  C:\Windows\System\iOBnqrv.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\dNmsqmu.exe
  C:\Windows\System\dNmsqmu.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\mBzFUbF.exe
  C:\Windows\System\mBzFUbF.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\eHcnsEI.exe
  C:\Windows\System\eHcnsEI.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\vGOEPoa.exe
  C:\Windows\System\vGOEPoa.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\QKthRpy.exe
  C:\Windows\System\QKthRpy.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\GZfqmCp.exe
  C:\Windows\System\GZfqmCp.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\MzTVTcT.exe
  C:\Windows\System\MzTVTcT.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\NQlsjRF.exe
  C:\Windows\System\NQlsjRF.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\MvzlGTx.exe
  C:\Windows\System\MvzlGTx.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\kiVdJVO.exe
  C:\Windows\System\kiVdJVO.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\drlqgeA.exe
  C:\Windows\System\drlqgeA.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\htctAIA.exe
  C:\Windows\System\htctAIA.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\wUWyYQh.exe
  C:\Windows\System\wUWyYQh.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\llzfcIT.exe
  C:\Windows\System\llzfcIT.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\shzfwRt.exe
  C:\Windows\System\shzfwRt.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\xQLtDie.exe
  C:\Windows\System\xQLtDie.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\ucmFRKl.exe
  C:\Windows\System\ucmFRKl.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\yWiBzMf.exe
  C:\Windows\System\yWiBzMf.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\uMgWAhK.exe
  C:\Windows\System\uMgWAhK.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\VpKJQLL.exe
  C:\Windows\System\VpKJQLL.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\ITnCcIL.exe
  C:\Windows\System\ITnCcIL.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\rcQomuP.exe
  C:\Windows\System\rcQomuP.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\wutXDEu.exe
  C:\Windows\System\wutXDEu.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\gsWYfLk.exe
  C:\Windows\System\gsWYfLk.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\sppblWp.exe
  C:\Windows\System\sppblWp.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\fLaZrGk.exe
  C:\Windows\System\fLaZrGk.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\ljegFEo.exe
  C:\Windows\System\ljegFEo.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\mcUaYZI.exe
  C:\Windows\System\mcUaYZI.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\CBEKckw.exe
  C:\Windows\System\CBEKckw.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\tskEXAn.exe
  C:\Windows\System\tskEXAn.exe
  2⤵
  PID:1992
- C:\Windows\System\jwncnVc.exe
  C:\Windows\System\jwncnVc.exe
  2⤵
  PID:4532
- C:\Windows\System\mqYVcgp.exe
  C:\Windows\System\mqYVcgp.exe
  2⤵
  PID:2840
- C:\Windows\System\EGlJOCu.exe
  C:\Windows\System\EGlJOCu.exe
  2⤵
  PID:3532
- C:\Windows\System\gDdBioA.exe
  C:\Windows\System\gDdBioA.exe
  2⤵
  PID:2672
- C:\Windows\System\bMWeHLZ.exe
  C:\Windows\System\bMWeHLZ.exe
  2⤵
  PID:3984
- C:\Windows\System\vDOwXHZ.exe
  C:\Windows\System\vDOwXHZ.exe
  2⤵
  PID:1172
- C:\Windows\System\ZgZQkCG.exe
  C:\Windows\System\ZgZQkCG.exe
  2⤵
  PID:1828
- C:\Windows\System\XCGNmDi.exe
  C:\Windows\System\XCGNmDi.exe
  2⤵
  PID:400
- C:\Windows\System\EKZhpQa.exe
  C:\Windows\System\EKZhpQa.exe
  2⤵
  PID:5052
- C:\Windows\System\nsdfqPM.exe
  C:\Windows\System\nsdfqPM.exe
  2⤵
  PID:3868
- C:\Windows\System\iVdHQIt.exe
  C:\Windows\System\iVdHQIt.exe
  2⤵
  PID:4732
- C:\Windows\System\bjyBJiP.exe
  C:\Windows\System\bjyBJiP.exe
  2⤵
  PID:2952
- C:\Windows\System\iWslRDx.exe
  C:\Windows\System\iWslRDx.exe
  2⤵
  PID:4196
- C:\Windows\System\yLGQmXT.exe
  C:\Windows\System\yLGQmXT.exe
  2⤵
  PID:1656
- C:\Windows\System\nKIWujA.exe
  C:\Windows\System\nKIWujA.exe
  2⤵
  PID:4264
- C:\Windows\System\XWmaPZD.exe
  C:\Windows\System\XWmaPZD.exe
  2⤵
  PID:2976
- C:\Windows\System\HXPvFVw.exe
  C:\Windows\System\HXPvFVw.exe
  2⤵
  PID:3472
- C:\Windows\System\ItuIbKF.exe
  C:\Windows\System\ItuIbKF.exe
  2⤵
  PID:3796
- C:\Windows\System\EHsfHXg.exe
  C:\Windows\System\EHsfHXg.exe
  2⤵
  PID:1684
- C:\Windows\System\phLbyQy.exe
  C:\Windows\System\phLbyQy.exe
  2⤵
  PID:1284
- C:\Windows\System\uFTwszq.exe
  C:\Windows\System\uFTwszq.exe
  2⤵
  PID:3076
- C:\Windows\System\MZIOtcN.exe
  C:\Windows\System\MZIOtcN.exe
  2⤵
  PID:3456
- C:\Windows\System\zEJAAzD.exe
  C:\Windows\System\zEJAAzD.exe
  2⤵
  PID:3296
- C:\Windows\System\cSbbHYF.exe
  C:\Windows\System\cSbbHYF.exe
  2⤵
  PID:4140
- C:\Windows\System\NYQbRuo.exe
  C:\Windows\System\NYQbRuo.exe
  2⤵
  PID:1144
- C:\Windows\System\xEPypaq.exe
  C:\Windows\System\xEPypaq.exe
  2⤵
  PID:624
- C:\Windows\System\QITyHOb.exe
  C:\Windows\System\QITyHOb.exe
  2⤵
  PID:2200
- C:\Windows\System\AGpkgwh.exe
  C:\Windows\System\AGpkgwh.exe
  2⤵
  PID:2568
- C:\Windows\System\RZjlLzw.exe
  C:\Windows\System\RZjlLzw.exe
  2⤵
  PID:1720
- C:\Windows\System\dPzgTzf.exe
  C:\Windows\System\dPzgTzf.exe
  2⤵
  PID:3012
- C:\Windows\System\ScoQmey.exe
  C:\Windows\System\ScoQmey.exe
  2⤵
  PID:1468
- C:\Windows\System\afunFlC.exe
  C:\Windows\System\afunFlC.exe
  2⤵
  PID:5076
- C:\Windows\System\AJOBOMg.exe
  C:\Windows\System\AJOBOMg.exe
  2⤵
  PID:1972
- C:\Windows\System\LSqDIVc.exe
  C:\Windows\System\LSqDIVc.exe
  2⤵
  PID:4476
- C:\Windows\System\QmcqeeU.exe
  C:\Windows\System\QmcqeeU.exe
  2⤵
  PID:3572
- C:\Windows\System\lkmaFgP.exe
  C:\Windows\System\lkmaFgP.exe
  2⤵
  PID:2096
- C:\Windows\System\FHNEJWM.exe
  C:\Windows\System\FHNEJWM.exe
  2⤵
  PID:3636
- C:\Windows\System\sehOhAd.exe
  C:\Windows\System\sehOhAd.exe
  2⤵
  PID:3888
- C:\Windows\System\kTJVxqa.exe
  C:\Windows\System\kTJVxqa.exe
  2⤵
  PID:1556
- C:\Windows\System\LvjwMFP.exe
  C:\Windows\System\LvjwMFP.exe
  2⤵
  PID:1640
- C:\Windows\System\agiTDlv.exe
  C:\Windows\System\agiTDlv.exe
  2⤵
  PID:4504
- C:\Windows\System\kyvoirU.exe
  C:\Windows\System\kyvoirU.exe
  2⤵
  PID:3980
- C:\Windows\System\tYKElyX.exe
  C:\Windows\System\tYKElyX.exe
  2⤵
  PID:1376
- C:\Windows\System\XXkCzWx.exe
  C:\Windows\System\XXkCzWx.exe
  2⤵
  PID:1772
- C:\Windows\System\WBJxjQB.exe
  C:\Windows\System\WBJxjQB.exe
  2⤵
  PID:4888
- C:\Windows\System\OCJNKXX.exe
  C:\Windows\System\OCJNKXX.exe
  2⤵
  PID:4564
- C:\Windows\System\YpBdLEB.exe
  C:\Windows\System\YpBdLEB.exe
  2⤵
  PID:4076
- C:\Windows\System\pgEXFPc.exe
  C:\Windows\System\pgEXFPc.exe
  2⤵
  PID:2084
- C:\Windows\System\YhcSODZ.exe
  C:\Windows\System\YhcSODZ.exe
  2⤵
  PID:2236
- C:\Windows\System\ZqKgLeq.exe
  C:\Windows\System\ZqKgLeq.exe
  2⤵
  PID:1928
- C:\Windows\System\FLMioJU.exe
  C:\Windows\System\FLMioJU.exe
  2⤵
  PID:5084
- C:\Windows\System\tcIegZm.exe
  C:\Windows\System\tcIegZm.exe
  2⤵
  PID:4992
- C:\Windows\System\BnNMmDG.exe
  C:\Windows\System\BnNMmDG.exe
  2⤵
  PID:4136
- C:\Windows\System\KSPREIb.exe
  C:\Windows\System\KSPREIb.exe
  2⤵
  PID:5132
- C:\Windows\System\hdrbryA.exe
  C:\Windows\System\hdrbryA.exe
  2⤵
  PID:5160
- C:\Windows\System\DuqMjjB.exe
  C:\Windows\System\DuqMjjB.exe
  2⤵
  PID:5188
- C:\Windows\System\MEIucji.exe
  C:\Windows\System\MEIucji.exe
  2⤵
  PID:5216
- C:\Windows\System\FksLzWt.exe
  C:\Windows\System\FksLzWt.exe
  2⤵
  PID:5244
- C:\Windows\System\aKdwZuo.exe
  C:\Windows\System\aKdwZuo.exe
  2⤵
  PID:5272
- C:\Windows\System\LPljhfp.exe
  C:\Windows\System\LPljhfp.exe
  2⤵
  PID:5304
- C:\Windows\System\KNbBBAB.exe
  C:\Windows\System\KNbBBAB.exe
  2⤵
  PID:5328
- C:\Windows\System\KgaqrYL.exe
  C:\Windows\System\KgaqrYL.exe
  2⤵
  PID:5356
- C:\Windows\System\WdKlWrk.exe
  C:\Windows\System\WdKlWrk.exe
  2⤵
  PID:5384
- C:\Windows\System\acMiHdY.exe
  C:\Windows\System\acMiHdY.exe
  2⤵
  PID:5408
- C:\Windows\System\ilxCfeY.exe
  C:\Windows\System\ilxCfeY.exe
  2⤵
  PID:5440
- C:\Windows\System\LUOFHpD.exe
  C:\Windows\System\LUOFHpD.exe
  2⤵
  PID:5468
- C:\Windows\System\eYPfCBc.exe
  C:\Windows\System\eYPfCBc.exe
  2⤵
  PID:5496
- C:\Windows\System\VHARDuK.exe
  C:\Windows\System\VHARDuK.exe
  2⤵
  PID:5524
- C:\Windows\System\eNzGAUK.exe
  C:\Windows\System\eNzGAUK.exe
  2⤵
  PID:5552
- C:\Windows\System\dPrIrjc.exe
  C:\Windows\System\dPrIrjc.exe
  2⤵
  PID:5572
- C:\Windows\System\dcGNSvU.exe
  C:\Windows\System\dcGNSvU.exe
  2⤵
  PID:5596
- C:\Windows\System\NrRxjrY.exe
  C:\Windows\System\NrRxjrY.exe
  2⤵
  PID:5624
- C:\Windows\System\wunNRnP.exe
  C:\Windows\System\wunNRnP.exe
  2⤵
  PID:5660
- C:\Windows\System\ciOWcaX.exe
  C:\Windows\System\ciOWcaX.exe
  2⤵
  PID:5692
- C:\Windows\System\FMBoJfz.exe
  C:\Windows\System\FMBoJfz.exe
  2⤵
  PID:5708
- C:\Windows\System\jhirYaA.exe
  C:\Windows\System\jhirYaA.exe
  2⤵
  PID:5736
- C:\Windows\System\BrOKiSt.exe
  C:\Windows\System\BrOKiSt.exe
  2⤵
  PID:5764
- C:\Windows\System\nCHLVpQ.exe
  C:\Windows\System\nCHLVpQ.exe
  2⤵
  PID:5804
- C:\Windows\System\KsDsMRr.exe
  C:\Windows\System\KsDsMRr.exe
  2⤵
  PID:5828
- C:\Windows\System\WCjVxSZ.exe
  C:\Windows\System\WCjVxSZ.exe
  2⤵
  PID:5848
- C:\Windows\System\sgRPVPW.exe
  C:\Windows\System\sgRPVPW.exe
  2⤵
  PID:5876
- C:\Windows\System\BFCvkZb.exe
  C:\Windows\System\BFCvkZb.exe
  2⤵
  PID:5904
- C:\Windows\System\zHCkcQA.exe
  C:\Windows\System\zHCkcQA.exe
  2⤵
  PID:5936
- C:\Windows\System\mAgrCyA.exe
  C:\Windows\System\mAgrCyA.exe
  2⤵
  PID:5952
- C:\Windows\System\XmFpTEL.exe
  C:\Windows\System\XmFpTEL.exe
  2⤵
  PID:5984
- C:\Windows\System\eejYYJI.exe
  C:\Windows\System\eejYYJI.exe
  2⤵
  PID:6020
- C:\Windows\System\xsOmiJC.exe
  C:\Windows\System\xsOmiJC.exe
  2⤵
  PID:6048
- C:\Windows\System\OcjQSAf.exe
  C:\Windows\System\OcjQSAf.exe
  2⤵
  PID:6084
- C:\Windows\System\jaOJmyv.exe
  C:\Windows\System\jaOJmyv.exe
  2⤵
  PID:6104
- C:\Windows\System\pfxwRjj.exe
  C:\Windows\System\pfxwRjj.exe
  2⤵
  PID:6132
- C:\Windows\System\zwdManR.exe
  C:\Windows\System\zwdManR.exe
  2⤵
  PID:5144
- C:\Windows\System\NdRADhM.exe
  C:\Windows\System\NdRADhM.exe
  2⤵
  PID:5228
- C:\Windows\System\gLfYLfw.exe
  C:\Windows\System\gLfYLfw.exe
  2⤵
  PID:5296
- C:\Windows\System\lthIkdC.exe
  C:\Windows\System\lthIkdC.exe
  2⤵
  PID:5372
- C:\Windows\System\NNNWYDL.exe
  C:\Windows\System\NNNWYDL.exe
  2⤵
  PID:5424
- C:\Windows\System\HwaqmAJ.exe
  C:\Windows\System\HwaqmAJ.exe
  2⤵
  PID:5452
- C:\Windows\System\pleYXkS.exe
  C:\Windows\System\pleYXkS.exe
  2⤵
  PID:5516
- C:\Windows\System\pWxkZFQ.exe
  C:\Windows\System\pWxkZFQ.exe
  2⤵
  PID:5592
- C:\Windows\System\OpaYTIA.exe
  C:\Windows\System\OpaYTIA.exe
  2⤵
  PID:5680
- C:\Windows\System\QcHQWXd.exe
  C:\Windows\System\QcHQWXd.exe
  2⤵
  PID:5752
- C:\Windows\System\IdtBHBP.exe
  C:\Windows\System\IdtBHBP.exe
  2⤵
  PID:5792
- C:\Windows\System\vaEAtlb.exe
  C:\Windows\System\vaEAtlb.exe
  2⤵
  PID:5820
- C:\Windows\System\xVMuEuV.exe
  C:\Windows\System\xVMuEuV.exe
  2⤵
  PID:5928
- C:\Windows\System\iXLSURA.exe
  C:\Windows\System\iXLSURA.exe
  2⤵
  PID:5968
- C:\Windows\System\phnFPhM.exe
  C:\Windows\System\phnFPhM.exe
  2⤵
  PID:6032
- C:\Windows\System\EJfvgAq.exe
  C:\Windows\System\EJfvgAq.exe
  2⤵
  PID:6092
- C:\Windows\System\KjkrYWI.exe
  C:\Windows\System\KjkrYWI.exe
  2⤵
  PID:5200
- C:\Windows\System\IcCVAFw.exe
  C:\Windows\System\IcCVAFw.exe
  2⤵
  PID:5340
- C:\Windows\System\DlskevQ.exe
  C:\Windows\System\DlskevQ.exe
  2⤵
  PID:5492
- C:\Windows\System\vWXgufZ.exe
  C:\Windows\System\vWXgufZ.exe
  2⤵
  PID:5688
- C:\Windows\System\RDbZduk.exe
  C:\Windows\System\RDbZduk.exe
  2⤵
  PID:5900
- C:\Windows\System\oFVGfum.exe
  C:\Windows\System\oFVGfum.exe
  2⤵
  PID:5964
- C:\Windows\System\aJjfcBd.exe
  C:\Windows\System\aJjfcBd.exe
  2⤵
  PID:6140
- C:\Windows\System\HVGZORX.exe
  C:\Windows\System\HVGZORX.exe
  2⤵
  PID:5284
- C:\Windows\System\QPZXVRF.exe
  C:\Windows\System\QPZXVRF.exe
  2⤵
  PID:5488
- C:\Windows\System\VDcpEkF.exe
  C:\Windows\System\VDcpEkF.exe
  2⤵
  PID:5892
- C:\Windows\System\yZCBJuU.exe
  C:\Windows\System\yZCBJuU.exe
  2⤵
  PID:880
- C:\Windows\System\ZqAkyCh.exe
  C:\Windows\System\ZqAkyCh.exe
  2⤵
  PID:6156
- C:\Windows\System\wOtiqru.exe
  C:\Windows\System\wOtiqru.exe
  2⤵
  PID:6180
- C:\Windows\System\yLcMUUa.exe
  C:\Windows\System\yLcMUUa.exe
  2⤵
  PID:6200
- C:\Windows\System\tCZMIkJ.exe
  C:\Windows\System\tCZMIkJ.exe
  2⤵
  PID:6232
- C:\Windows\System\DoZDmpD.exe
  C:\Windows\System\DoZDmpD.exe
  2⤵
  PID:6268
- C:\Windows\System\uuiJLjW.exe
  C:\Windows\System\uuiJLjW.exe
  2⤵
  PID:6308
- C:\Windows\System\FROjGDG.exe
  C:\Windows\System\FROjGDG.exe
  2⤵
  PID:6340
- C:\Windows\System\PqtGHQp.exe
  C:\Windows\System\PqtGHQp.exe
  2⤵
  PID:6360
- C:\Windows\System\icgyMgk.exe
  C:\Windows\System\icgyMgk.exe
  2⤵
  PID:6392
- C:\Windows\System\PmqunGR.exe
  C:\Windows\System\PmqunGR.exe
  2⤵
  PID:6420
- C:\Windows\System\CDcdFqc.exe
  C:\Windows\System\CDcdFqc.exe
  2⤵
  PID:6448
- C:\Windows\System\YQxeCqN.exe
  C:\Windows\System\YQxeCqN.exe
  2⤵
  PID:6480
- C:\Windows\System\uvGrBYG.exe
  C:\Windows\System\uvGrBYG.exe
  2⤵
  PID:6512
- C:\Windows\System\oUStAhJ.exe
  C:\Windows\System\oUStAhJ.exe
  2⤵
  PID:6536
- C:\Windows\System\jvIuAnI.exe
  C:\Windows\System\jvIuAnI.exe
  2⤵
  PID:6588
- C:\Windows\System\ktbHntu.exe
  C:\Windows\System\ktbHntu.exe
  2⤵
  PID:6604
- C:\Windows\System\uqgXpBJ.exe
  C:\Windows\System\uqgXpBJ.exe
  2⤵
  PID:6624
- C:\Windows\System\PLObDWN.exe
  C:\Windows\System\PLObDWN.exe
  2⤵
  PID:6648
- C:\Windows\System\uWTwZMb.exe
  C:\Windows\System\uWTwZMb.exe
  2⤵
  PID:6676
- C:\Windows\System\qfffMPU.exe
  C:\Windows\System\qfffMPU.exe
  2⤵
  PID:6696
- C:\Windows\System\mVxrSkq.exe
  C:\Windows\System\mVxrSkq.exe
  2⤵
  PID:6728
- C:\Windows\System\sTpdGLi.exe
  C:\Windows\System\sTpdGLi.exe
  2⤵
  PID:6748
- C:\Windows\System\cNMWLgh.exe
  C:\Windows\System\cNMWLgh.exe
  2⤵
  PID:6784
- C:\Windows\System\LWMfkRz.exe
  C:\Windows\System\LWMfkRz.exe
  2⤵
  PID:6816
- C:\Windows\System\zncmxry.exe
  C:\Windows\System\zncmxry.exe
  2⤵
  PID:6844
- C:\Windows\System\OuXzqVT.exe
  C:\Windows\System\OuXzqVT.exe
  2⤵
  PID:6872
- C:\Windows\System\ZQIpMPQ.exe
  C:\Windows\System\ZQIpMPQ.exe
  2⤵
  PID:6900
- C:\Windows\System\SzhFcwM.exe
  C:\Windows\System\SzhFcwM.exe
  2⤵
  PID:6932
- C:\Windows\System\POrpUjS.exe
  C:\Windows\System\POrpUjS.exe
  2⤵
  PID:6968
- C:\Windows\System\pQPMJWz.exe
  C:\Windows\System\pQPMJWz.exe
  2⤵
  PID:6988
- C:\Windows\System\pTTFFKj.exe
  C:\Windows\System\pTTFFKj.exe
  2⤵
  PID:7012
- C:\Windows\System\oFCqLaq.exe
  C:\Windows\System\oFCqLaq.exe
  2⤵
  PID:7044
- C:\Windows\System\nhSBYka.exe
  C:\Windows\System\nhSBYka.exe
  2⤵
  PID:7068
- C:\Windows\System\ksGeKhq.exe
  C:\Windows\System\ksGeKhq.exe
  2⤵
  PID:7096
- C:\Windows\System\rgkWKWT.exe
  C:\Windows\System\rgkWKWT.exe
  2⤵
  PID:7124
- C:\Windows\System\TMjFBxb.exe
  C:\Windows\System\TMjFBxb.exe
  2⤵
  PID:7152
- C:\Windows\System\qMsrLbl.exe
  C:\Windows\System\qMsrLbl.exe
  2⤵
  PID:6100
- C:\Windows\System\trvLuoi.exe
  C:\Windows\System\trvLuoi.exe
  2⤵
  PID:6212
- C:\Windows\System\nlLIWUn.exe
  C:\Windows\System\nlLIWUn.exe
  2⤵
  PID:6248
- C:\Windows\System\KWyqTvP.exe
  C:\Windows\System\KWyqTvP.exe
  2⤵
  PID:6356
- C:\Windows\System\tCEQRzg.exe
  C:\Windows\System\tCEQRzg.exe
  2⤵
  PID:6412
- C:\Windows\System\NmElQjc.exe
  C:\Windows\System\NmElQjc.exe
  2⤵
  PID:6444
- C:\Windows\System\egacMgG.exe
  C:\Windows\System\egacMgG.exe
  2⤵
  PID:6520
- C:\Windows\System\SejJYYI.exe
  C:\Windows\System\SejJYYI.exe
  2⤵
  PID:6600
- C:\Windows\System\kXCbdHx.exe
  C:\Windows\System\kXCbdHx.exe
  2⤵
  PID:6672
- C:\Windows\System\YWRmOap.exe
  C:\Windows\System\YWRmOap.exe
  2⤵
  PID:6716
- C:\Windows\System\lULkDar.exe
  C:\Windows\System\lULkDar.exe
  2⤵
  PID:6808
- C:\Windows\System\pqtBXhP.exe
  C:\Windows\System\pqtBXhP.exe
  2⤵
  PID:6860
- C:\Windows\System\WzLGpyz.exe
  C:\Windows\System\WzLGpyz.exe
  2⤵
  PID:6956
- C:\Windows\System\LjBqqJB.exe
  C:\Windows\System\LjBqqJB.exe
  2⤵
  PID:6996
- C:\Windows\System\BmQnMea.exe
  C:\Windows\System\BmQnMea.exe
  2⤵
  PID:7052
- C:\Windows\System\RyWuZjR.exe
  C:\Windows\System\RyWuZjR.exe
  2⤵
  PID:7116
- C:\Windows\System\BQRGxnd.exe
  C:\Windows\System\BQRGxnd.exe
  2⤵
  PID:6196
- C:\Windows\System\WNiNgCL.exe
  C:\Windows\System\WNiNgCL.exe
  2⤵
  PID:6380
- C:\Windows\System\JRphwHz.exe
  C:\Windows\System\JRphwHz.exe
  2⤵
  PID:6432
- C:\Windows\System\mHsSXWa.exe
  C:\Windows\System\mHsSXWa.exe
  2⤵
  PID:6664
- C:\Windows\System\TcEKarA.exe
  C:\Windows\System\TcEKarA.exe
  2⤵
  PID:6712
- C:\Windows\System\bevfLco.exe
  C:\Windows\System\bevfLco.exe
  2⤵
  PID:6856
- C:\Windows\System\WheFzKf.exe
  C:\Windows\System\WheFzKf.exe
  2⤵
  PID:6984
- C:\Windows\System\xqUlgEK.exe
  C:\Windows\System\xqUlgEK.exe
  2⤵
  PID:7140
- C:\Windows\System\BoNHLWr.exe
  C:\Windows\System\BoNHLWr.exe
  2⤵
  PID:6496
- C:\Windows\System\aGfIjFJ.exe
  C:\Windows\System\aGfIjFJ.exe
  2⤵
  PID:6864
- C:\Windows\System\WDaSWiE.exe
  C:\Windows\System\WDaSWiE.exe
  2⤵
  PID:6704
- C:\Windows\System\qSUGmyg.exe
  C:\Windows\System\qSUGmyg.exe
  2⤵
  PID:7172
- C:\Windows\System\UARIwhy.exe
  C:\Windows\System\UARIwhy.exe
  2⤵
  PID:7208
- C:\Windows\System\cVxCQKf.exe
  C:\Windows\System\cVxCQKf.exe
  2⤵
  PID:7228
- C:\Windows\System\sSnbPut.exe
  C:\Windows\System\sSnbPut.exe
  2⤵
  PID:7244
- C:\Windows\System\AcNKAMJ.exe
  C:\Windows\System\AcNKAMJ.exe
  2⤵
  PID:7276
- C:\Windows\System\qQIxANh.exe
  C:\Windows\System\qQIxANh.exe
  2⤵
  PID:7300
- C:\Windows\System\CYSFikd.exe
  C:\Windows\System\CYSFikd.exe
  2⤵
  PID:7332
- C:\Windows\System\AqZUmun.exe
  C:\Windows\System\AqZUmun.exe
  2⤵
  PID:7368
- C:\Windows\System\etvSKgG.exe
  C:\Windows\System\etvSKgG.exe
  2⤵
  PID:7396
- C:\Windows\System\FuvVaFr.exe
  C:\Windows\System\FuvVaFr.exe
  2⤵
  PID:7436
- C:\Windows\System\KcgEPXq.exe
  C:\Windows\System\KcgEPXq.exe
  2⤵
  PID:7464
- C:\Windows\System\NAMrYMa.exe
  C:\Windows\System\NAMrYMa.exe
  2⤵
  PID:7480
- C:\Windows\System\urkMVRF.exe
  C:\Windows\System\urkMVRF.exe
  2⤵
  PID:7516
- C:\Windows\System\SXErHGd.exe
  C:\Windows\System\SXErHGd.exe
  2⤵
  PID:7536
- C:\Windows\System\NXAzwFc.exe
  C:\Windows\System\NXAzwFc.exe
  2⤵
  PID:7552
- C:\Windows\System\KjvJjTO.exe
  C:\Windows\System\KjvJjTO.exe
  2⤵
  PID:7584
- C:\Windows\System\RfQLTjc.exe
  C:\Windows\System\RfQLTjc.exe
  2⤵
  PID:7608
- C:\Windows\System\rbNLwqw.exe
  C:\Windows\System\rbNLwqw.exe
  2⤵
  PID:7640
- C:\Windows\System\KgAvKUn.exe
  C:\Windows\System\KgAvKUn.exe
  2⤵
  PID:7668
- C:\Windows\System\mMFPghp.exe
  C:\Windows\System\mMFPghp.exe
  2⤵
  PID:7696
- C:\Windows\System\oZtimvx.exe
  C:\Windows\System\oZtimvx.exe
  2⤵
  PID:7724
- C:\Windows\System\ylbJCgx.exe
  C:\Windows\System\ylbJCgx.exe
  2⤵
  PID:7756
- C:\Windows\System\FMeRBAU.exe
  C:\Windows\System\FMeRBAU.exe
  2⤵
  PID:7788
- C:\Windows\System\KtRTBhO.exe
  C:\Windows\System\KtRTBhO.exe
  2⤵
  PID:7820
- C:\Windows\System\ssJPXkk.exe
  C:\Windows\System\ssJPXkk.exe
  2⤵
  PID:7840
- C:\Windows\System\fuCwatr.exe
  C:\Windows\System\fuCwatr.exe
  2⤵
  PID:7876
- C:\Windows\System\mRCAbvX.exe
  C:\Windows\System\mRCAbvX.exe
  2⤵
  PID:7896
- C:\Windows\System\ziOTwWm.exe
  C:\Windows\System\ziOTwWm.exe
  2⤵
  PID:7924
- C:\Windows\System\OaHgOPS.exe
  C:\Windows\System\OaHgOPS.exe
  2⤵
  PID:7952
- C:\Windows\System\CwbQXMQ.exe
  C:\Windows\System\CwbQXMQ.exe
  2⤵
  PID:7972
- C:\Windows\System\HFZlrsn.exe
  C:\Windows\System\HFZlrsn.exe
  2⤵
  PID:8008
- C:\Windows\System\orkQgKe.exe
  C:\Windows\System\orkQgKe.exe
  2⤵
  PID:8044
- C:\Windows\System\YPMzEgn.exe
  C:\Windows\System\YPMzEgn.exe
  2⤵
  PID:8072
- C:\Windows\System\YLtLiGW.exe
  C:\Windows\System\YLtLiGW.exe
  2⤵
  PID:8104
- C:\Windows\System\sJrbyHO.exe
  C:\Windows\System\sJrbyHO.exe
  2⤵
  PID:8128
- C:\Windows\System\LfQnQMB.exe
  C:\Windows\System\LfQnQMB.exe
  2⤵
  PID:8156
- C:\Windows\System\gzpbMuX.exe
  C:\Windows\System\gzpbMuX.exe
  2⤵
  PID:8188
- C:\Windows\System\sNGpwBv.exe
  C:\Windows\System\sNGpwBv.exe
  2⤵
  PID:7200
- C:\Windows\System\qhqVXJQ.exe
  C:\Windows\System\qhqVXJQ.exe
  2⤵
  PID:7268
- C:\Windows\System\jNbjfRG.exe
  C:\Windows\System\jNbjfRG.exe
  2⤵
  PID:7340
- C:\Windows\System\PZWItII.exe
  C:\Windows\System\PZWItII.exe
  2⤵
  PID:7380
- C:\Windows\System\LtCbgFN.exe
  C:\Windows\System\LtCbgFN.exe
  2⤵
  PID:7448
- C:\Windows\System\iwqCYBl.exe
  C:\Windows\System\iwqCYBl.exe
  2⤵
  PID:7508
- C:\Windows\System\xTzpwQN.exe
  C:\Windows\System\xTzpwQN.exe
  2⤵
  PID:7580
- C:\Windows\System\tLjfQha.exe
  C:\Windows\System\tLjfQha.exe
  2⤵
  PID:7648
- C:\Windows\System\gZRPkEO.exe
  C:\Windows\System\gZRPkEO.exe
  2⤵
  PID:7684
- C:\Windows\System\kGgvSkJ.exe
  C:\Windows\System\kGgvSkJ.exe
  2⤵
  PID:7720
- C:\Windows\System\jxwqmmF.exe
  C:\Windows\System\jxwqmmF.exe
  2⤵
  PID:7920
- C:\Windows\System\GuGALhy.exe
  C:\Windows\System\GuGALhy.exe
  2⤵
  PID:8020
- C:\Windows\System\wUuvOhV.exe
  C:\Windows\System\wUuvOhV.exe
  2⤵
  PID:7984
- C:\Windows\System\nqkGYyR.exe
  C:\Windows\System\nqkGYyR.exe
  2⤵
  PID:8084
- C:\Windows\System\qfQESHf.exe
  C:\Windows\System\qfQESHf.exe
  2⤵
  PID:8120
- C:\Windows\System\WcDsDEa.exe
  C:\Windows\System\WcDsDEa.exe
  2⤵
  PID:7028
- C:\Windows\System\HwOQxNM.exe
  C:\Windows\System\HwOQxNM.exe
  2⤵
  PID:7164
- C:\Windows\System\xhdvGDU.exe
  C:\Windows\System\xhdvGDU.exe
  2⤵
  PID:7348
- C:\Windows\System\AwTmIvW.exe
  C:\Windows\System\AwTmIvW.exe
  2⤵
  PID:7500
- C:\Windows\System\NAoMhCF.exe
  C:\Windows\System\NAoMhCF.exe
  2⤵
  PID:7776
- C:\Windows\System\TxlNcsS.exe
  C:\Windows\System\TxlNcsS.exe
  2⤵
  PID:7996
- C:\Windows\System\XFBTDLA.exe
  C:\Windows\System\XFBTDLA.exe
  2⤵
  PID:8168
- C:\Windows\System\vHHoPXp.exe
  C:\Windows\System\vHHoPXp.exe
  2⤵
  PID:7532
- C:\Windows\System\JTXNkDu.exe
  C:\Windows\System\JTXNkDu.exe
  2⤵
  PID:7620
- C:\Windows\System\tQWbwyQ.exe
  C:\Windows\System\tQWbwyQ.exe
  2⤵
  PID:7716
- C:\Windows\System\cQtAmda.exe
  C:\Windows\System\cQtAmda.exe
  2⤵
  PID:7476
- C:\Windows\System\cjWUsaL.exe
  C:\Windows\System\cjWUsaL.exe
  2⤵
  PID:8212
- C:\Windows\System\pJBLEDT.exe
  C:\Windows\System\pJBLEDT.exe
  2⤵
  PID:8236
- C:\Windows\System\eJiyAol.exe
  C:\Windows\System\eJiyAol.exe
  2⤵
  PID:8256
- C:\Windows\System\hsswywp.exe
  C:\Windows\System\hsswywp.exe
  2⤵
  PID:8280
- C:\Windows\System\eQNefYK.exe
  C:\Windows\System\eQNefYK.exe
  2⤵
  PID:8312
- C:\Windows\System\XkbzivJ.exe
  C:\Windows\System\XkbzivJ.exe
  2⤵
  PID:8344
- C:\Windows\System\vlAFJtL.exe
  C:\Windows\System\vlAFJtL.exe
  2⤵
  PID:8360
- C:\Windows\System\ZBWhCub.exe
  C:\Windows\System\ZBWhCub.exe
  2⤵
  PID:8392
- C:\Windows\System\YJSbRPo.exe
  C:\Windows\System\YJSbRPo.exe
  2⤵
  PID:8424
- C:\Windows\System\ZPhumxG.exe
  C:\Windows\System\ZPhumxG.exe
  2⤵
  PID:8452
- C:\Windows\System\bTNpxON.exe
  C:\Windows\System\bTNpxON.exe
  2⤵
  PID:8488
- C:\Windows\System\KitQTqb.exe
  C:\Windows\System\KitQTqb.exe
  2⤵
  PID:8516
- C:\Windows\System\PQVMkvW.exe
  C:\Windows\System\PQVMkvW.exe
  2⤵
  PID:8544
- C:\Windows\System\JmVHSmN.exe
  C:\Windows\System\JmVHSmN.exe
  2⤵
  PID:8572
- C:\Windows\System\LvNoAvf.exe
  C:\Windows\System\LvNoAvf.exe
  2⤵
  PID:8596
- C:\Windows\System\pIDcsqd.exe
  C:\Windows\System\pIDcsqd.exe
  2⤵
  PID:8628
- C:\Windows\System\vpDqONE.exe
  C:\Windows\System\vpDqONE.exe
  2⤵
  PID:8648
- C:\Windows\System\hwYqIuv.exe
  C:\Windows\System\hwYqIuv.exe
  2⤵
  PID:8676
- C:\Windows\System\mnOKYVl.exe
  C:\Windows\System\mnOKYVl.exe
  2⤵
  PID:8704
- C:\Windows\System\CtMYVtB.exe
  C:\Windows\System\CtMYVtB.exe
  2⤵
  PID:8732
- C:\Windows\System\RpwqNOg.exe
  C:\Windows\System\RpwqNOg.exe
  2⤵
  PID:8752
- C:\Windows\System\cTBnzFG.exe
  C:\Windows\System\cTBnzFG.exe
  2⤵
  PID:8780
- C:\Windows\System\DlCimgQ.exe
  C:\Windows\System\DlCimgQ.exe
  2⤵
  PID:8812
- C:\Windows\System\OQaZCxc.exe
  C:\Windows\System\OQaZCxc.exe
  2⤵
  PID:8840
- C:\Windows\System\SpvuOVD.exe
  C:\Windows\System\SpvuOVD.exe
  2⤵
  PID:8868
- C:\Windows\System\lJvakxW.exe
  C:\Windows\System\lJvakxW.exe
  2⤵
  PID:8884
- C:\Windows\System\GhTDJZu.exe
  C:\Windows\System\GhTDJZu.exe
  2⤵
  PID:8908
- C:\Windows\System\Qlrbzcf.exe
  C:\Windows\System\Qlrbzcf.exe
  2⤵
  PID:8940
- C:\Windows\System\QJjqpdF.exe
  C:\Windows\System\QJjqpdF.exe
  2⤵
  PID:8964
- C:\Windows\System\mCQMfMl.exe
  C:\Windows\System\mCQMfMl.exe
  2⤵
  PID:9000
- C:\Windows\System\OWNZGHb.exe
  C:\Windows\System\OWNZGHb.exe
  2⤵
  PID:9028
- C:\Windows\System\wYbpTTy.exe
  C:\Windows\System\wYbpTTy.exe
  2⤵
  PID:9052
- C:\Windows\System\FfHZNLJ.exe
  C:\Windows\System\FfHZNLJ.exe
  2⤵
  PID:9088
- C:\Windows\System\zoBYqeX.exe
  C:\Windows\System\zoBYqeX.exe
  2⤵
  PID:9116
- C:\Windows\System\bfQnUqn.exe
  C:\Windows\System\bfQnUqn.exe
  2⤵
  PID:9140
- C:\Windows\System\VezmAYu.exe
  C:\Windows\System\VezmAYu.exe
  2⤵
  PID:9168
- C:\Windows\System\WYpzSbh.exe
  C:\Windows\System\WYpzSbh.exe
  2⤵
  PID:9204
- C:\Windows\System\iWyuOGc.exe
  C:\Windows\System\iWyuOGc.exe
  2⤵
  PID:8196
- C:\Windows\System\Xyynpud.exe
  C:\Windows\System\Xyynpud.exe
  2⤵
  PID:8296
- C:\Windows\System\TdkfJQl.exe
  C:\Windows\System\TdkfJQl.exe
  2⤵
  PID:8324
- C:\Windows\System\DyRGESO.exe
  C:\Windows\System\DyRGESO.exe
  2⤵
  PID:8404
- C:\Windows\System\PCSefRv.exe
  C:\Windows\System\PCSefRv.exe
  2⤵
  PID:8464
- C:\Windows\System\BbMWjVD.exe
  C:\Windows\System\BbMWjVD.exe
  2⤵
  PID:8528
- C:\Windows\System\tPhdniS.exe
  C:\Windows\System\tPhdniS.exe
  2⤵
  PID:8560
- C:\Windows\System\eQHzEhm.exe
  C:\Windows\System\eQHzEhm.exe
  2⤵
  PID:8656
- C:\Windows\System\RhpXbql.exe
  C:\Windows\System\RhpXbql.exe
  2⤵
  PID:8712
- C:\Windows\System\pHLGWIe.exe
  C:\Windows\System\pHLGWIe.exe
  2⤵
  PID:8800
- C:\Windows\System\khvsunL.exe
  C:\Windows\System\khvsunL.exe
  2⤵
  PID:8852
- C:\Windows\System\CrslsOz.exe
  C:\Windows\System\CrslsOz.exe
  2⤵
  PID:8928
- C:\Windows\System\ykjIFin.exe
  C:\Windows\System\ykjIFin.exe
  2⤵
  PID:8956
- C:\Windows\System\hTqDhfK.exe
  C:\Windows\System\hTqDhfK.exe
  2⤵
  PID:9044
- C:\Windows\System\cyxJYSQ.exe
  C:\Windows\System\cyxJYSQ.exe
  2⤵
  PID:9048
- C:\Windows\System\ffJhphV.exe
  C:\Windows\System\ffJhphV.exe
  2⤵
  PID:9188
- C:\Windows\System\gHSLDvL.exe
  C:\Windows\System\gHSLDvL.exe
  2⤵
  PID:8272
- C:\Windows\System\iFkLhxn.exe
  C:\Windows\System\iFkLhxn.exe
  2⤵
  PID:8460
- C:\Windows\System\jwLBlBL.exe
  C:\Windows\System\jwLBlBL.exe
  2⤵
  PID:8588
- C:\Windows\System\sWjqKeu.exe
  C:\Windows\System\sWjqKeu.exe
  2⤵
  PID:8692
- C:\Windows\System\jEoSkTr.exe
  C:\Windows\System\jEoSkTr.exe
  2⤵
  PID:8668
- C:\Windows\System\hdvSTeC.exe
  C:\Windows\System\hdvSTeC.exe
  2⤵
  PID:8988
- C:\Windows\System\Dpdkbas.exe
  C:\Windows\System\Dpdkbas.exe
  2⤵
  PID:9104
- C:\Windows\System\ckNaJgq.exe
  C:\Windows\System\ckNaJgq.exe
  2⤵
  PID:8228
- C:\Windows\System\ylxOnkS.exe
  C:\Windows\System\ylxOnkS.exe
  2⤵
  PID:8660
- C:\Windows\System\NNhZAZB.exe
  C:\Windows\System\NNhZAZB.exe
  2⤵
  PID:8828
- C:\Windows\System\EhbgCzO.exe
  C:\Windows\System\EhbgCzO.exe
  2⤵
  PID:9224
- C:\Windows\System\PYUMyFu.exe
  C:\Windows\System\PYUMyFu.exe
  2⤵
  PID:9256
- C:\Windows\System\onzfbcr.exe
  C:\Windows\System\onzfbcr.exe
  2⤵
  PID:9284
- C:\Windows\System\TtglhwK.exe
  C:\Windows\System\TtglhwK.exe
  2⤵
  PID:9304
- C:\Windows\System\XDgcWEn.exe
  C:\Windows\System\XDgcWEn.exe
  2⤵
  PID:9336
- C:\Windows\System\ydAgVwC.exe
  C:\Windows\System\ydAgVwC.exe
  2⤵
  PID:9372
- C:\Windows\System\IDHBbQi.exe
  C:\Windows\System\IDHBbQi.exe
  2⤵
  PID:9400
- C:\Windows\System\MDjPtXx.exe
  C:\Windows\System\MDjPtXx.exe
  2⤵
  PID:9428
- C:\Windows\System\npnFHpq.exe
  C:\Windows\System\npnFHpq.exe
  2⤵
  PID:9452
- C:\Windows\System\xIRobWG.exe
  C:\Windows\System\xIRobWG.exe
  2⤵
  PID:9484
- C:\Windows\System\qrflYng.exe
  C:\Windows\System\qrflYng.exe
  2⤵
  PID:9504
- C:\Windows\System\UeQbCzg.exe
  C:\Windows\System\UeQbCzg.exe
  2⤵
  PID:9540
- C:\Windows\System\rtnCdoY.exe
  C:\Windows\System\rtnCdoY.exe
  2⤵
  PID:9560
- C:\Windows\System\gLBZFbJ.exe
  C:\Windows\System\gLBZFbJ.exe
  2⤵
  PID:9592
- C:\Windows\System\FCoMHpm.exe
  C:\Windows\System\FCoMHpm.exe
  2⤵
  PID:9624
- C:\Windows\System\RvfvzOi.exe
  C:\Windows\System\RvfvzOi.exe
  2⤵
  PID:9648
- C:\Windows\System\QdiZNwk.exe
  C:\Windows\System\QdiZNwk.exe
  2⤵
  PID:9680
- C:\Windows\System\EfSUASq.exe
  C:\Windows\System\EfSUASq.exe
  2⤵
  PID:9696
- C:\Windows\System\kTJVuRp.exe
  C:\Windows\System\kTJVuRp.exe
  2⤵
  PID:9732
- C:\Windows\System\ZVwINsc.exe
  C:\Windows\System\ZVwINsc.exe
  2⤵
  PID:9768
- C:\Windows\System\LrmvEkL.exe
  C:\Windows\System\LrmvEkL.exe
  2⤵
  PID:9800
- C:\Windows\System\wEjQSIa.exe
  C:\Windows\System\wEjQSIa.exe
  2⤵
  PID:9816
- C:\Windows\System\pjzVbiz.exe
  C:\Windows\System\pjzVbiz.exe
  2⤵
  PID:9848
- C:\Windows\System\NWUYBxH.exe
  C:\Windows\System\NWUYBxH.exe
  2⤵
  PID:9876
- C:\Windows\System\FiTojzy.exe
  C:\Windows\System\FiTojzy.exe
  2⤵
  PID:9908
- C:\Windows\System\eLAqGzZ.exe
  C:\Windows\System\eLAqGzZ.exe
  2⤵
  PID:9940
- C:\Windows\System\QchKBOb.exe
  C:\Windows\System\QchKBOb.exe
  2⤵
  PID:9964
- C:\Windows\System\gKJsAgL.exe
  C:\Windows\System\gKJsAgL.exe
  2⤵
  PID:9992
- C:\Windows\System\Ihafzob.exe
  C:\Windows\System\Ihafzob.exe
  2⤵
  PID:10016
- C:\Windows\System\kcJgXcz.exe
  C:\Windows\System\kcJgXcz.exe
  2⤵
  PID:10044
- C:\Windows\System\QqqHvZD.exe
  C:\Windows\System\QqqHvZD.exe
  2⤵
  PID:10068
- C:\Windows\System\jtRTHli.exe
  C:\Windows\System\jtRTHli.exe
  2⤵
  PID:10088
- C:\Windows\System\oWhILzG.exe
  C:\Windows\System\oWhILzG.exe
  2⤵
  PID:10108
- C:\Windows\System\XAYUuMR.exe
  C:\Windows\System\XAYUuMR.exe
  2⤵
  PID:10140
- C:\Windows\System\NXDwliY.exe
  C:\Windows\System\NXDwliY.exe
  2⤵
  PID:10172
- C:\Windows\System\OuAYTaf.exe
  C:\Windows\System\OuAYTaf.exe
  2⤵
  PID:10208
- C:\Windows\System\sEkyiQN.exe
  C:\Windows\System\sEkyiQN.exe
  2⤵
  PID:10228
- C:\Windows\System\QAOcqeT.exe
  C:\Windows\System\QAOcqeT.exe
  2⤵
  PID:8760
- C:\Windows\System\VHVXncM.exe
  C:\Windows\System\VHVXncM.exe
  2⤵
  PID:9268
- C:\Windows\System\vcMbJFX.exe
  C:\Windows\System\vcMbJFX.exe
  2⤵
  PID:9360
- C:\Windows\System\CAHoZvL.exe
  C:\Windows\System\CAHoZvL.exe
  2⤵
  PID:9332
- C:\Windows\System\hPuYgZF.exe
  C:\Windows\System\hPuYgZF.exe
  2⤵
  PID:3952
- C:\Windows\System\SWiHTrY.exe
  C:\Windows\System\SWiHTrY.exe
  2⤵
  PID:9444
- C:\Windows\System\FonRYdn.exe
  C:\Windows\System\FonRYdn.exe
  2⤵
  PID:9580
- C:\Windows\System\sSjuJhD.exe
  C:\Windows\System\sSjuJhD.exe
  2⤵
  PID:9584
- C:\Windows\System\fEfcCHy.exe
  C:\Windows\System\fEfcCHy.exe
  2⤵
  PID:9708
- C:\Windows\System\OzJBlhP.exe
  C:\Windows\System\OzJBlhP.exe
  2⤵
  PID:9752
- C:\Windows\System\USiljXb.exe
  C:\Windows\System\USiljXb.exe
  2⤵
  PID:9808
- C:\Windows\System\yTKpAjP.exe
  C:\Windows\System\yTKpAjP.exe
  2⤵
  PID:9856
- C:\Windows\System\OBaSKkh.exe
  C:\Windows\System\OBaSKkh.exe
  2⤵
  PID:9984
- C:\Windows\System\QFIDrvq.exe
  C:\Windows\System\QFIDrvq.exe
  2⤵
  PID:10012
- C:\Windows\System\WVVQxXM.exe
  C:\Windows\System\WVVQxXM.exe
  2⤵
  PID:10076
- C:\Windows\System\SSYtsEI.exe
  C:\Windows\System\SSYtsEI.exe
  2⤵
  PID:10184
- C:\Windows\System\fBypZIC.exe
  C:\Windows\System\fBypZIC.exe
  2⤵
  PID:10156
- C:\Windows\System\PaIkrNl.exe
  C:\Windows\System\PaIkrNl.exe
  2⤵
  PID:10224
- C:\Windows\System\ymlULIj.exe
  C:\Windows\System\ymlULIj.exe
  2⤵
  PID:9232
- C:\Windows\System\dtOuQXQ.exe
  C:\Windows\System\dtOuQXQ.exe
  2⤵
  PID:9532
- C:\Windows\System\luonAYZ.exe
  C:\Windows\System\luonAYZ.exe
  2⤵
  PID:9468
- C:\Windows\System\cnwjwcO.exe
  C:\Windows\System\cnwjwcO.exe
  2⤵
  PID:9672
- C:\Windows\System\yDdoDsA.exe
  C:\Windows\System\yDdoDsA.exe
  2⤵
  PID:9888
- C:\Windows\System\ttTbKjx.exe
  C:\Windows\System\ttTbKjx.exe
  2⤵
  PID:9932
- C:\Windows\System\fAOoEmJ.exe
  C:\Windows\System\fAOoEmJ.exe
  2⤵
  PID:10148
- C:\Windows\System\gMUKtfn.exe
  C:\Windows\System\gMUKtfn.exe
  2⤵
  PID:10104
- C:\Windows\System\bqSQDum.exe
  C:\Windows\System\bqSQDum.exe
  2⤵
  PID:9716
- C:\Windows\System\bgdzfRD.exe
  C:\Windows\System\bgdzfRD.exe
  2⤵
  PID:10252
- C:\Windows\System\kZQhWDB.exe
  C:\Windows\System\kZQhWDB.exe
  2⤵
  PID:10280
- C:\Windows\System\CPRzSRS.exe
  C:\Windows\System\CPRzSRS.exe
  2⤵
  PID:10316
- C:\Windows\System\vjRLnRE.exe
  C:\Windows\System\vjRLnRE.exe
  2⤵
  PID:10344
- C:\Windows\System\OontJQF.exe
  C:\Windows\System\OontJQF.exe
  2⤵
  PID:10364
- C:\Windows\System\usTKfPz.exe
  C:\Windows\System\usTKfPz.exe
  2⤵
  PID:10400
- C:\Windows\System\lQVIQnK.exe
  C:\Windows\System\lQVIQnK.exe
  2⤵
  PID:10428
- C:\Windows\System\HWpWMcE.exe
  C:\Windows\System\HWpWMcE.exe
  2⤵
  PID:10460
- C:\Windows\System\MnUYVcg.exe
  C:\Windows\System\MnUYVcg.exe
  2⤵
  PID:10484
- C:\Windows\System\jgzOlJb.exe
  C:\Windows\System\jgzOlJb.exe
  2⤵
  PID:10508
- C:\Windows\System\nSNsiWZ.exe
  C:\Windows\System\nSNsiWZ.exe
  2⤵
  PID:10536
- C:\Windows\System\oomGHKZ.exe
  C:\Windows\System\oomGHKZ.exe
  2⤵
  PID:10572
- C:\Windows\System\thUBnxu.exe
  C:\Windows\System\thUBnxu.exe
  2⤵
  PID:10604
- C:\Windows\System\EkCGjfJ.exe
  C:\Windows\System\EkCGjfJ.exe
  2⤵
  PID:10628
- C:\Windows\System\bnpTDIq.exe
  C:\Windows\System\bnpTDIq.exe
  2⤵
  PID:10644
- C:\Windows\System\gFAwuEd.exe
  C:\Windows\System\gFAwuEd.exe
  2⤵
  PID:10668
- C:\Windows\System\yMNJoml.exe
  C:\Windows\System\yMNJoml.exe
  2⤵
  PID:10692
- C:\Windows\System\zBHoVpk.exe
  C:\Windows\System\zBHoVpk.exe
  2⤵
  PID:10728
- C:\Windows\System\nGiYphu.exe
  C:\Windows\System\nGiYphu.exe
  2⤵
  PID:10768
- C:\Windows\System\nSRCAgG.exe
  C:\Windows\System\nSRCAgG.exe
  2⤵
  PID:10796
- C:\Windows\System\ulGMJGt.exe
  C:\Windows\System\ulGMJGt.exe
  2⤵
  PID:10820
- C:\Windows\System\leVSxXy.exe
  C:\Windows\System\leVSxXy.exe
  2⤵
  PID:10852
- C:\Windows\System\HSAFfhg.exe
  C:\Windows\System\HSAFfhg.exe
  2⤵
  PID:10876
- C:\Windows\System\QAbnnqG.exe
  C:\Windows\System\QAbnnqG.exe
  2⤵
  PID:10904
- C:\Windows\System\UbYTplv.exe
  C:\Windows\System\UbYTplv.exe
  2⤵
  PID:10924
- C:\Windows\System\gZfopIj.exe
  C:\Windows\System\gZfopIj.exe
  2⤵
  PID:10952
- C:\Windows\System\DtoVkzB.exe
  C:\Windows\System\DtoVkzB.exe
  2⤵
  PID:10972
- C:\Windows\System\dtGNtde.exe
  C:\Windows\System\dtGNtde.exe
  2⤵
  PID:11000
- C:\Windows\System\oVYYZCg.exe
  C:\Windows\System\oVYYZCg.exe
  2⤵
  PID:11024
- C:\Windows\System\DJOSjsX.exe
  C:\Windows\System\DJOSjsX.exe
  2⤵
  PID:11056
- C:\Windows\System\nbDTHUq.exe
  C:\Windows\System\nbDTHUq.exe
  2⤵
  PID:11080
- C:\Windows\System\JgTPMxl.exe
  C:\Windows\System\JgTPMxl.exe
  2⤵
  PID:11096
- C:\Windows\System\zfXINTF.exe
  C:\Windows\System\zfXINTF.exe
  2⤵
  PID:11132
- C:\Windows\System\eWEwCzY.exe
  C:\Windows\System\eWEwCzY.exe
  2⤵
  PID:11152
- C:\Windows\System\qRZTWaQ.exe
  C:\Windows\System\qRZTWaQ.exe
  2⤵
  PID:11168
- C:\Windows\System\PUnEgDF.exe
  C:\Windows\System\PUnEgDF.exe
  2⤵
  PID:11192
- C:\Windows\System\sSUJjDW.exe
  C:\Windows\System\sSUJjDW.exe
  2⤵
  PID:11224
- C:\Windows\System\VyzQTeg.exe
  C:\Windows\System\VyzQTeg.exe
  2⤵
  PID:11256
- C:\Windows\System\tnKBbJQ.exe
  C:\Windows\System\tnKBbJQ.exe
  2⤵
  PID:10136
- C:\Windows\System\UjwxjLq.exe
  C:\Windows\System\UjwxjLq.exe
  2⤵
  PID:9568
- C:\Windows\System\FGyRSCo.exe
  C:\Windows\System\FGyRSCo.exe
  2⤵
  PID:10376
- C:\Windows\System\YxwDLuV.exe
  C:\Windows\System\YxwDLuV.exe
  2⤵
  PID:10420
- C:\Windows\System\RkyYUKz.exe
  C:\Windows\System\RkyYUKz.exe
  2⤵
  PID:10408
- C:\Windows\System\JfSjSeO.exe
  C:\Windows\System\JfSjSeO.exe
  2⤵
  PID:10440
- C:\Windows\System\suzwynQ.exe
  C:\Windows\System\suzwynQ.exe
  2⤵
  PID:10588
- C:\Windows\System\LXoYYhv.exe
  C:\Windows\System\LXoYYhv.exe
  2⤵
  PID:10560
- C:\Windows\System\QOrdLia.exe
  C:\Windows\System\QOrdLia.exe
  2⤵
  PID:10712
- C:\Windows\System\MeADwAQ.exe
  C:\Windows\System\MeADwAQ.exe
  2⤵
  PID:10656
- C:\Windows\System\EjtBzLu.exe
  C:\Windows\System\EjtBzLu.exe
  2⤵
  PID:10740
- C:\Windows\System\vMeVqBD.exe
  C:\Windows\System\vMeVqBD.exe
  2⤵
  PID:10864
- C:\Windows\System\ilVtrVs.exe
  C:\Windows\System\ilVtrVs.exe
  2⤵
  PID:10896
- C:\Windows\System\llBXGvt.exe
  C:\Windows\System\llBXGvt.exe
  2⤵
  PID:10888
- C:\Windows\System\ACNGTJU.exe
  C:\Windows\System\ACNGTJU.exe
  2⤵
  PID:10912
- C:\Windows\System\uTGxKDJ.exe
  C:\Windows\System\uTGxKDJ.exe
  2⤵
  PID:11036
- C:\Windows\System\gyvvuuS.exe
  C:\Windows\System\gyvvuuS.exe
  2⤵
  PID:11068
- C:\Windows\System\EwLGRua.exe
  C:\Windows\System\EwLGRua.exe
  2⤵
  PID:11248
- C:\Windows\System\RSpTNpD.exe
  C:\Windows\System\RSpTNpD.exe
  2⤵
  PID:10124
- C:\Windows\System\rugxpgl.exe
  C:\Windows\System\rugxpgl.exe
  2⤵
  PID:10268
- C:\Windows\System\cYIDZCQ.exe
  C:\Windows\System\cYIDZCQ.exe
  2⤵
  PID:10524
- C:\Windows\System\HoGxhrc.exe
  C:\Windows\System\HoGxhrc.exe
  2⤵
  PID:10620
- C:\Windows\System\AOkbgnl.exe
  C:\Windows\System\AOkbgnl.exe
  2⤵
  PID:10808
- C:\Windows\System\yKEFocC.exe
  C:\Windows\System\yKEFocC.exe
  2⤵
  PID:10680
- C:\Windows\System\cPiWaOk.exe
  C:\Windows\System\cPiWaOk.exe
  2⤵
  PID:10996
- C:\Windows\System\aEZlhOr.exe
  C:\Windows\System\aEZlhOr.exe
  2⤵
  PID:11044
- C:\Windows\System\WqvaVXX.exe
  C:\Windows\System\WqvaVXX.exe
  2⤵
  PID:11272
- C:\Windows\System\NDXslrt.exe
  C:\Windows\System\NDXslrt.exe
  2⤵
  PID:11312
- C:\Windows\System\ufHCcTv.exe
  C:\Windows\System\ufHCcTv.exe
  2⤵
  PID:11336
- C:\Windows\System\OILJWea.exe
  C:\Windows\System\OILJWea.exe
  2⤵
  PID:11368
- C:\Windows\System\msIEYNz.exe
  C:\Windows\System\msIEYNz.exe
  2⤵
  PID:11392
- C:\Windows\System\tOGQGQe.exe
  C:\Windows\System\tOGQGQe.exe
  2⤵
  PID:11420
- C:\Windows\System\stZmIuW.exe
  C:\Windows\System\stZmIuW.exe
  2⤵
  PID:11448
- C:\Windows\System\PlsGqri.exe
  C:\Windows\System\PlsGqri.exe
  2⤵
  PID:11468
- C:\Windows\System\QwdroII.exe
  C:\Windows\System\QwdroII.exe
  2⤵
  PID:11496
- C:\Windows\System\zwGqBeh.exe
  C:\Windows\System\zwGqBeh.exe
  2⤵
  PID:11512
- C:\Windows\System\XgvzpdP.exe
  C:\Windows\System\XgvzpdP.exe
  2⤵
  PID:11544
- C:\Windows\System\fMFcalZ.exe
  C:\Windows\System\fMFcalZ.exe
  2⤵
  PID:11572
- C:\Windows\System\cZrSToH.exe
  C:\Windows\System\cZrSToH.exe
  2⤵
  PID:11604
- C:\Windows\System\sgGfWPs.exe
  C:\Windows\System\sgGfWPs.exe
  2⤵
  PID:11636
- C:\Windows\System\ytEPFFP.exe
  C:\Windows\System\ytEPFFP.exe
  2⤵
  PID:11668
- C:\Windows\System\kKDWcIh.exe
  C:\Windows\System\kKDWcIh.exe
  2⤵
  PID:11692
- C:\Windows\System\chkJrsZ.exe
  C:\Windows\System\chkJrsZ.exe
  2⤵
  PID:11720
- C:\Windows\System\PEGRdfb.exe
  C:\Windows\System\PEGRdfb.exe
  2⤵
  PID:11752
- C:\Windows\System\QLLqFZM.exe
  C:\Windows\System\QLLqFZM.exe
  2⤵
  PID:11772
- C:\Windows\System\QSjAHYR.exe
  C:\Windows\System\QSjAHYR.exe
  2⤵
  PID:11808
- C:\Windows\System\NsJexCz.exe
  C:\Windows\System\NsJexCz.exe
  2⤵
  PID:11844
- C:\Windows\System\yvkcsnI.exe
  C:\Windows\System\yvkcsnI.exe
  2⤵
  PID:11872
- C:\Windows\System\uienRrm.exe
  C:\Windows\System\uienRrm.exe
  2⤵
  PID:11900
- C:\Windows\System\EOhIYJG.exe
  C:\Windows\System\EOhIYJG.exe
  2⤵
  PID:11928
- C:\Windows\System\KmViFsB.exe
  C:\Windows\System\KmViFsB.exe
  2⤵
  PID:11952
- C:\Windows\System\uLULPgw.exe
  C:\Windows\System\uLULPgw.exe
  2⤵
  PID:11984
- C:\Windows\System\MKWnkKu.exe
  C:\Windows\System\MKWnkKu.exe
  2⤵
  PID:12028
- C:\Windows\System\xXImfWz.exe
  C:\Windows\System\xXImfWz.exe
  2⤵
  PID:12052
- C:\Windows\System\JXLsWvU.exe
  C:\Windows\System\JXLsWvU.exe
  2⤵
  PID:12080
- C:\Windows\System\ZYoHfFJ.exe
  C:\Windows\System\ZYoHfFJ.exe
  2⤵
  PID:12112
- C:\Windows\System\LdBwWho.exe
  C:\Windows\System\LdBwWho.exe
  2⤵
  PID:12140
- C:\Windows\System\FQQAEks.exe
  C:\Windows\System\FQQAEks.exe
  2⤵
  PID:12176
- C:\Windows\System\JeRDYkW.exe
  C:\Windows\System\JeRDYkW.exe
  2⤵
  PID:12200
- C:\Windows\System\SMlSNYY.exe
  C:\Windows\System\SMlSNYY.exe
  2⤵
  PID:12224
- C:\Windows\System\CRbLIKK.exe
  C:\Windows\System\CRbLIKK.exe
  2⤵
  PID:12248
- C:\Windows\System\csrveVV.exe
  C:\Windows\System\csrveVV.exe
  2⤵
  PID:12284
- C:\Windows\System\cCmsnIq.exe
  C:\Windows\System\cCmsnIq.exe
  2⤵
  PID:11244
- C:\Windows\System\WvozlHK.exe
  C:\Windows\System\WvozlHK.exe
  2⤵
  PID:10352
- C:\Windows\System\mlJlqZB.exe
  C:\Windows\System\mlJlqZB.exe
  2⤵
  PID:11268
- C:\Windows\System\OabhpoA.exe
  C:\Windows\System\OabhpoA.exe
  2⤵
  PID:11356
- C:\Windows\System\nKVJzOD.exe
  C:\Windows\System\nKVJzOD.exe
  2⤵
  PID:11428
- C:\Windows\System\oAFoRnp.exe
  C:\Windows\System\oAFoRnp.exe
  2⤵
  PID:11364
- C:\Windows\System\OCrhihA.exe
  C:\Windows\System\OCrhihA.exe
  2⤵
  PID:11564
- C:\Windows\System\AhtZlzv.exe
  C:\Windows\System\AhtZlzv.exe
  2⤵
  PID:11624
- C:\Windows\System\ebZEGsO.exe
  C:\Windows\System\ebZEGsO.exe
  2⤵
  PID:11556
- C:\Windows\System\SghRcgT.exe
  C:\Windows\System\SghRcgT.exe
  2⤵
  PID:11620
- C:\Windows\System\XKbSTXJ.exe
  C:\Windows\System\XKbSTXJ.exe
  2⤵
  PID:11800
- C:\Windows\System\kOkOjYK.exe
  C:\Windows\System\kOkOjYK.exe
  2⤵
  PID:11840
- C:\Windows\System\NuwdzAa.exe
  C:\Windows\System\NuwdzAa.exe
  2⤵
  PID:11948
- C:\Windows\System\VTYtKgO.exe
  C:\Windows\System\VTYtKgO.exe
  2⤵
  PID:11896
- C:\Windows\System\oDingUX.exe
  C:\Windows\System\oDingUX.exe
  2⤵
  PID:11912
- C:\Windows\System\sYAnkTn.exe
  C:\Windows\System\sYAnkTn.exe
  2⤵
  PID:12020
- C:\Windows\System\AwVRMRt.exe
  C:\Windows\System\AwVRMRt.exe
  2⤵
  PID:12072
- C:\Windows\System\djvUsLW.exe
  C:\Windows\System\djvUsLW.exe
  2⤵
  PID:12244
- C:\Windows\System\tHdsglc.exe
  C:\Windows\System\tHdsglc.exe
  2⤵
  PID:11712
- C:\Windows\System\rfoyxGV.exe
  C:\Windows\System\rfoyxGV.exe
  2⤵
  PID:11892
- C:\Windows\System\xAUbHVx.exe
  C:\Windows\System\xAUbHVx.exe
  2⤵
  PID:11944
- C:\Windows\System\mLidZjN.exe
  C:\Windows\System\mLidZjN.exe
  2⤵
  PID:11828
- C:\Windows\System\HgZUXNg.exe
  C:\Windows\System\HgZUXNg.exe
  2⤵
  PID:12104
- C:\Windows\System\GUgqTSa.exe
  C:\Windows\System\GUgqTSa.exe
  2⤵
  PID:12152
- C:\Windows\System\oQClppR.exe
  C:\Windows\System\oQClppR.exe
  2⤵
  PID:11344
- C:\Windows\System\QPeKVzZ.exe
  C:\Windows\System\QPeKVzZ.exe
  2⤵
  PID:12016
- C:\Windows\System\oHtdaHw.exe
  C:\Windows\System\oHtdaHw.exe
  2⤵
  PID:10568
- C:\Windows\System\OyXrjEc.exe
  C:\Windows\System\OyXrjEc.exe
  2⤵
  PID:12296
- C:\Windows\System\ISNpJGR.exe
  C:\Windows\System\ISNpJGR.exe
  2⤵
  PID:12324
- C:\Windows\System\AubNcGI.exe
  C:\Windows\System\AubNcGI.exe
  2⤵
  PID:12356
- C:\Windows\System\OcdROOm.exe
  C:\Windows\System\OcdROOm.exe
  2⤵
  PID:12388
- C:\Windows\System\coQyagB.exe
  C:\Windows\System\coQyagB.exe
  2⤵
  PID:12404
- C:\Windows\System\zOzpuid.exe
  C:\Windows\System\zOzpuid.exe
  2⤵
  PID:12428
- C:\Windows\System\XSZpfZQ.exe
  C:\Windows\System\XSZpfZQ.exe
  2⤵
  PID:12464
- C:\Windows\System\oTXFDrL.exe
  C:\Windows\System\oTXFDrL.exe
  2⤵
  PID:12488
- C:\Windows\System\okVBUld.exe
  C:\Windows\System\okVBUld.exe
  2⤵
  PID:12520
- C:\Windows\System\MnCZcdW.exe
  C:\Windows\System\MnCZcdW.exe
  2⤵
  PID:12544
- C:\Windows\System\vJoAlNv.exe
  C:\Windows\System\vJoAlNv.exe
  2⤵
  PID:12568
- C:\Windows\System\yJixyUb.exe
  C:\Windows\System\yJixyUb.exe
  2⤵
  PID:12596
- C:\Windows\System\uwAxpIf.exe
  C:\Windows\System\uwAxpIf.exe
  2⤵
  PID:12620
- C:\Windows\System\Iikdzih.exe
  C:\Windows\System\Iikdzih.exe
  2⤵
  PID:12652
- C:\Windows\System\fXvLDVo.exe
  C:\Windows\System\fXvLDVo.exe
  2⤵
  PID:12680
- C:\Windows\System\tnNdbEw.exe
  C:\Windows\System\tnNdbEw.exe
  2⤵
  PID:12700
- C:\Windows\System\VVTyZbY.exe
  C:\Windows\System\VVTyZbY.exe
  2⤵
  PID:12724
- C:\Windows\System\ARQowUu.exe
  C:\Windows\System\ARQowUu.exe
  2⤵
  PID:12756
- C:\Windows\System\EQTVIcR.exe
  C:\Windows\System\EQTVIcR.exe
  2⤵
  PID:12780
- C:\Windows\System\VqIwrKg.exe
  C:\Windows\System\VqIwrKg.exe
  2⤵
  PID:12808
- C:\Windows\System\gwtpXNj.exe
  C:\Windows\System\gwtpXNj.exe
  2⤵
  PID:12828
- C:\Windows\System\aEJeVhx.exe
  C:\Windows\System\aEJeVhx.exe
  2⤵
  PID:12844
- C:\Windows\System\WOQthzI.exe
  C:\Windows\System\WOQthzI.exe
  2⤵
  PID:12876
- C:\Windows\System\ezninAH.exe
  C:\Windows\System\ezninAH.exe
  2⤵
  PID:12904
- C:\Windows\System\NFZjguN.exe
  C:\Windows\System\NFZjguN.exe
  2⤵
  PID:12932
- C:\Windows\System\zIKkhEG.exe
  C:\Windows\System\zIKkhEG.exe
  2⤵
  PID:12960
- C:\Windows\System\amDMduG.exe
  C:\Windows\System\amDMduG.exe
  2⤵
  PID:12988
- C:\Windows\System\JxYBksF.exe
  C:\Windows\System\JxYBksF.exe
  2⤵
  PID:13024
- C:\Windows\System\coCDisq.exe
  C:\Windows\System\coCDisq.exe
  2⤵
  PID:13044
- C:\Windows\System\YhIBbHp.exe
  C:\Windows\System\YhIBbHp.exe
  2⤵
  PID:13060
- C:\Windows\System\nymIdjp.exe
  C:\Windows\System\nymIdjp.exe
  2⤵
  PID:13092
- C:\Windows\System\UrKYPSH.exe
  C:\Windows\System\UrKYPSH.exe
  2⤵
  PID:13116
- C:\Windows\System\NJiEPqs.exe
  C:\Windows\System\NJiEPqs.exe
  2⤵
  PID:13140
- C:\Windows\System\avXFcup.exe
  C:\Windows\System\avXFcup.exe
  2⤵
  PID:13156
- C:\Windows\System\DfBRvFH.exe
  C:\Windows\System\DfBRvFH.exe
  2⤵
  PID:13180
- C:\Windows\System\OINGOPS.exe
  C:\Windows\System\OINGOPS.exe
  2⤵
  PID:13196
- C:\Windows\System\cHjeADY.exe
  C:\Windows\System\cHjeADY.exe
  2⤵
  PID:13232
- C:\Windows\System\aNymrfO.exe
  C:\Windows\System\aNymrfO.exe
  2⤵
  PID:13256
- C:\Windows\System\dblWcYn.exe
  C:\Windows\System\dblWcYn.exe
  2⤵
  PID:13280
- C:\Windows\System\pTKDFft.exe
  C:\Windows\System\pTKDFft.exe
  2⤵
  PID:12232
- C:\Windows\System\SmvGmzv.exe
  C:\Windows\System\SmvGmzv.exe
  2⤵
  PID:12320
- C:\Windows\System\LlYayPU.exe
  C:\Windows\System\LlYayPU.exe
  2⤵
  PID:12348
- C:\Windows\System\ZDHmyxc.exe
  C:\Windows\System\ZDHmyxc.exe
  2⤵
  PID:12440
- C:\Windows\System\rRXFJdY.exe
  C:\Windows\System\rRXFJdY.exe
  2⤵
  PID:12528
- C:\Windows\System\SVkmlhh.exe
  C:\Windows\System\SVkmlhh.exe
  2⤵
  PID:12608
- C:\Windows\System\pwhBeHL.exe
  C:\Windows\System\pwhBeHL.exe
  2⤵
  PID:12672
- C:\Windows\System\hYespkQ.exe
  C:\Windows\System\hYespkQ.exe
  2⤵
  PID:12776
- C:\Windows\System\MXJYPBY.exe
  C:\Windows\System\MXJYPBY.exe
  2⤵
  PID:12796
- C:\Windows\System\GnqWKur.exe
  C:\Windows\System\GnqWKur.exe
  2⤵
  PID:12896
- C:\Windows\System\tHHghWB.exe
  C:\Windows\System\tHHghWB.exe
  2⤵
  PID:12888
- C:\Windows\System\BXMvNOF.exe
  C:\Windows\System\BXMvNOF.exe
  2⤵
  PID:12984
- C:\Windows\System\sordajM.exe
  C:\Windows\System\sordajM.exe
  2⤵
  PID:13016
- C:\Windows\System\BlYmbJk.exe
  C:\Windows\System\BlYmbJk.exe
  2⤵
  PID:12448
- C:\Windows\System\uaWqxzF.exe
  C:\Windows\System\uaWqxzF.exe
  2⤵
  PID:13252
- C:\Windows\System\SJZzvfS.exe
  C:\Windows\System\SJZzvfS.exe
  2⤵
  PID:12632
- C:\Windows\System\AQJiJDt.exe
  C:\Windows\System\AQJiJDt.exe
  2⤵
  PID:11884
- C:\Windows\System\OKbvhlt.exe
  C:\Windows\System\OKbvhlt.exe
  2⤵
  PID:12484
- C:\Windows\System\rSHzXZA.exe
  C:\Windows\System\rSHzXZA.exe
  2⤵
  PID:12564
- C:\Windows\System\ScbfAgV.exe
  C:\Windows\System\ScbfAgV.exe
  2⤵
  PID:13040
- C:\Windows\System\yaNAvoy.exe
  C:\Windows\System\yaNAvoy.exe
  2⤵
  PID:13172
- C:\Windows\System\huyaeWq.exe
  C:\Windows\System\huyaeWq.exe
  2⤵
  PID:12372
- C:\Windows\System\labNFey.exe
  C:\Windows\System\labNFey.exe
  2⤵
  PID:12588
- C:\Windows\System\pSoLHPi.exe
  C:\Windows\System\pSoLHPi.exe
  2⤵
  PID:12792
- C:\Windows\System\aAblNSB.exe
  C:\Windows\System\aAblNSB.exe
  2⤵
  PID:12956
- C:\Windows\System\rFWvndC.exe
  C:\Windows\System\rFWvndC.exe
  2⤵
  PID:11532
- C:\Windows\System\wlDztqh.exe
  C:\Windows\System\wlDztqh.exe
  2⤵
  PID:13320
- C:\Windows\System\ABCjBAA.exe
  C:\Windows\System\ABCjBAA.exe
  2⤵
  PID:13340
- C:\Windows\System\lhrUNGX.exe
  C:\Windows\System\lhrUNGX.exe
  2⤵
  PID:13368
- C:\Windows\System\WmirAei.exe
  C:\Windows\System\WmirAei.exe
  2⤵
  PID:13400
- C:\Windows\System\SksDKpk.exe
  C:\Windows\System\SksDKpk.exe
  2⤵
  PID:13424
- C:\Windows\System\AywuYWU.exe
  C:\Windows\System\AywuYWU.exe
  2⤵
  PID:13452
- C:\Windows\System\NhjddWw.exe
  C:\Windows\System\NhjddWw.exe
  2⤵
  PID:13484
- C:\Windows\System\KJhNFWn.exe
  C:\Windows\System\KJhNFWn.exe
  2⤵
  PID:13508
- C:\Windows\System\uCDfuia.exe
  C:\Windows\System\uCDfuia.exe
  2⤵
  PID:13540
- C:\Windows\System\ZDITwvx.exe
  C:\Windows\System\ZDITwvx.exe
  2⤵
  PID:13564
- C:\Windows\System\UIcPMpm.exe
  C:\Windows\System\UIcPMpm.exe
  2⤵
  PID:13592
- C:\Windows\System\PFPLSwS.exe
  C:\Windows\System\PFPLSwS.exe
  2⤵
  PID:13620
- C:\Windows\System\FQnZCjO.exe
  C:\Windows\System\FQnZCjO.exe
  2⤵
  PID:13648
- C:\Windows\System\IEESMbL.exe
  C:\Windows\System\IEESMbL.exe
  2⤵
  PID:13676
- C:\Windows\System\mWcgpOV.exe
  C:\Windows\System\mWcgpOV.exe
  2⤵
  PID:13696
- C:\Windows\System\sATzSlz.exe
  C:\Windows\System\sATzSlz.exe
  2⤵
  PID:13716
- C:\Windows\System\kkXIusi.exe
  C:\Windows\System\kkXIusi.exe
  2⤵
  PID:13736
- C:\Windows\System\mwGVbDo.exe
  C:\Windows\System\mwGVbDo.exe
  2⤵
  PID:13756
- C:\Windows\System\hkmSGQn.exe
  C:\Windows\System\hkmSGQn.exe
  2⤵
  PID:13780
- C:\Windows\System\Ddietur.exe
  C:\Windows\System\Ddietur.exe
  2⤵
  PID:13812
- C:\Windows\System\UoYYHXQ.exe
  C:\Windows\System\UoYYHXQ.exe
  2⤵
  PID:13828
- C:\Windows\System\BEfCzUq.exe
  C:\Windows\System\BEfCzUq.exe
  2⤵
  PID:13860
- C:\Windows\System\IdyfvnJ.exe
  C:\Windows\System\IdyfvnJ.exe
  2⤵
  PID:13884
- C:\Windows\System\XtXnczR.exe
  C:\Windows\System\XtXnczR.exe
  2⤵
  PID:13916
- C:\Windows\System\Udzarcs.exe
  C:\Windows\System\Udzarcs.exe
  2⤵
  PID:13936
- C:\Windows\System\nWJDNnM.exe
  C:\Windows\System\nWJDNnM.exe
  2⤵
  PID:13964
- C:\Windows\System\hHHjKoK.exe
  C:\Windows\System\hHHjKoK.exe
  2⤵
  PID:13984
- C:\Windows\System\mgQbiiz.exe
  C:\Windows\System\mgQbiiz.exe
  2⤵
  PID:14008
- C:\Windows\System\XPMPLBB.exe
  C:\Windows\System\XPMPLBB.exe
  2⤵
  PID:14028
- C:\Windows\System\XbYgAxk.exe
  C:\Windows\System\XbYgAxk.exe
  2⤵
  PID:14056
- C:\Windows\System\SmZpssK.exe
  C:\Windows\System\SmZpssK.exe
  2⤵
  PID:14088
- C:\Windows\System\nqPVBqv.exe
  C:\Windows\System\nqPVBqv.exe
  2⤵
  PID:14120
- C:\Windows\System\HQuDJAG.exe
  C:\Windows\System\HQuDJAG.exe
  2⤵
  PID:14152
- C:\Windows\System\NTvKMYT.exe
  C:\Windows\System\NTvKMYT.exe
  2⤵
  PID:14176
- C:\Windows\System\wWkYaVo.exe
  C:\Windows\System\wWkYaVo.exe
  2⤵
  PID:14208
- C:\Windows\System\rtPNIRA.exe
  C:\Windows\System\rtPNIRA.exe
  2⤵
  PID:14236
- C:\Windows\System\lmgpNiz.exe
  C:\Windows\System\lmgpNiz.exe
  2⤵
  PID:14268
- C:\Windows\System\UiKFcqG.exe
  C:\Windows\System\UiKFcqG.exe
  2⤵
  PID:14292
- C:\Windows\System\QqCGakm.exe
  C:\Windows\System\QqCGakm.exe
  2⤵
  PID:14324
- C:\Windows\System\fnKdfVi.exe
  C:\Windows\System\fnKdfVi.exe
  2⤵
  PID:12952
- C:\Windows\System\XCvxaVH.exe
  C:\Windows\System\XCvxaVH.exe
  2⤵
  PID:13364
- C:\Windows\System\jjcOOHI.exe
  C:\Windows\System\jjcOOHI.exe
  2⤵
  PID:13392
- C:\Windows\System\igQQNex.exe
  C:\Windows\System\igQQNex.exe
  2⤵
  PID:13440
- C:\Windows\System\PUfXjfO.exe
  C:\Windows\System\PUfXjfO.exe
  2⤵
  PID:13532
- C:\Windows\System\BRboINJ.exe
  C:\Windows\System\BRboINJ.exe
  2⤵
  PID:13604
- C:\Windows\System\irPwDEU.exe
  C:\Windows\System\irPwDEU.exe
  2⤵
  PID:13636
- C:\Windows\System\NcShFbH.exe
  C:\Windows\System\NcShFbH.exe
  2⤵
  PID:13744
- C:\Windows\System\hQmMofl.exe
  C:\Windows\System\hQmMofl.exe
  2⤵
  PID:13808
- C:\Windows\System\sLbjnIh.exe
  C:\Windows\System\sLbjnIh.exe
  2⤵
  PID:13776
- C:\Windows\System\mIyPzzL.exe
  C:\Windows\System\mIyPzzL.exe
  2⤵
  PID:14016
- C:\Windows\System\XDgXhvg.exe
  C:\Windows\System\XDgXhvg.exe
  2⤵
  PID:13872
- C:\Windows\System\aSUhDSX.exe
  C:\Windows\System\aSUhDSX.exe
  2⤵
  PID:13908
- C:\Windows\System\EAmNCoS.exe
  C:\Windows\System\EAmNCoS.exe
  2⤵
  PID:14168
- C:\Windows\System\CeeqAsT.exe
  C:\Windows\System\CeeqAsT.exe
  2⤵
  PID:14220
- C:\Windows\System\oSPCmsb.exe
  C:\Windows\System\oSPCmsb.exe
  2⤵
  PID:14280
- C:\Windows\System\vSgTsTh.exe
  C:\Windows\System\vSgTsTh.exe
  2⤵
  PID:14312
- C:\Windows\System\RqunPFW.exe
  C:\Windows\System\RqunPFW.exe
  2⤵
  PID:14112
- C:\Windows\System\MGxjiBl.exe
  C:\Windows\System\MGxjiBl.exe
  2⤵
  PID:14308
- C:\Windows\System\nveXTkS.exe
  C:\Windows\System\nveXTkS.exe
  2⤵
  PID:13504
- C:\Windows\System\ziwabXp.exe
  C:\Windows\System\ziwabXp.exe
  2⤵
  PID:13852
- C:\Windows\System\HxRnMyn.exe
  C:\Windows\System\HxRnMyn.exe
  2⤵
  PID:13472
- C:\Windows\System\pROPPIZ.exe
  C:\Windows\System\pROPPIZ.exe
  2⤵
  PID:13556
- C:\Windows\System\VxrHUwa.exe
  C:\Windows\System\VxrHUwa.exe
  2⤵
  PID:14136
- C:\Windows\System\RdoFftH.exe
  C:\Windows\System\RdoFftH.exe
  2⤵
  PID:13108
- C:\Windows\System\cjKZnLH.exe
  C:\Windows\System\cjKZnLH.exe
  2⤵
  PID:14344
- C:\Windows\System\oxvnOok.exe
  C:\Windows\System\oxvnOok.exe
  2⤵
  PID:14380
- C:\Windows\System\fgKmaeC.exe
  C:\Windows\System\fgKmaeC.exe
  2⤵
  PID:14400
- C:\Windows\System\mDwAuVS.exe
  C:\Windows\System\mDwAuVS.exe
  2⤵
  PID:14432
- C:\Windows\System\pTnzWqa.exe
  C:\Windows\System\pTnzWqa.exe
  2⤵
  PID:14456
- C:\Windows\System\gbbDbgy.exe
  C:\Windows\System\gbbDbgy.exe
  2⤵
  PID:14476
- C:\Windows\System\zQeLGBk.exe
  C:\Windows\System\zQeLGBk.exe
  2⤵
  PID:14504
- C:\Windows\System\FeiWoRm.exe
  C:\Windows\System\FeiWoRm.exe
  2⤵
  PID:14532
- C:\Windows\System\EOwNEko.exe
  C:\Windows\System\EOwNEko.exe
  2⤵
  PID:14552
- C:\Windows\System\QVpgewv.exe
  C:\Windows\System\QVpgewv.exe
  2⤵
  PID:14576
- C:\Windows\System\OxfVPyy.exe
  C:\Windows\System\OxfVPyy.exe
  2⤵
  PID:14608
- C:\Windows\System\QeTPgpU.exe
  C:\Windows\System\QeTPgpU.exe
  2⤵
  PID:14640
- C:\Windows\System\MeoXgGI.exe
  C:\Windows\System\MeoXgGI.exe
  2⤵
  PID:14672
- C:\Windows\System\FgxijJA.exe
  C:\Windows\System\FgxijJA.exe
  2⤵
  PID:14700
- C:\Windows\System\wxattrO.exe
  C:\Windows\System\wxattrO.exe
  2⤵
  PID:14740
- C:\Windows\System\vQceVVf.exe
  C:\Windows\System\vQceVVf.exe
  2⤵
  PID:14756
- C:\Windows\System\fdXTBEE.exe
  C:\Windows\System\fdXTBEE.exe
  2⤵
  PID:14776
- C:\Windows\System\BxYIABn.exe
  C:\Windows\System\BxYIABn.exe
  2⤵
  PID:14808
- C:\Windows\System\QdjDVGQ.exe
  C:\Windows\System\QdjDVGQ.exe
  2⤵
  PID:14840
- C:\Windows\System\RgwboFt.exe
  C:\Windows\System\RgwboFt.exe
  2⤵
  PID:14864
- C:\Windows\System\vVJfJLe.exe
  C:\Windows\System\vVJfJLe.exe
  2⤵
  PID:14888
- C:\Windows\System\bQKqGxL.exe
  C:\Windows\System\bQKqGxL.exe
  2⤵
  PID:14916
- C:\Windows\System\mXjeHNX.exe
  C:\Windows\System\mXjeHNX.exe
  2⤵
  PID:14948
- C:\Windows\System\rVnFeqV.exe
  C:\Windows\System\rVnFeqV.exe
  2⤵
  PID:14968
- C:\Windows\System\blhnCdt.exe
  C:\Windows\System\blhnCdt.exe
  2⤵
  PID:14988
- C:\Windows\System\lKErBCy.exe
  C:\Windows\System\lKErBCy.exe
  2⤵
  PID:15012
- C:\Windows\System\sDmJygF.exe
  C:\Windows\System\sDmJygF.exe
  2⤵
  PID:15036
- C:\Windows\System\gibXzhT.exe
  C:\Windows\System\gibXzhT.exe
  2⤵
  PID:15068
- C:\Windows\System\EHqfuWC.exe
  C:\Windows\System\EHqfuWC.exe
  2⤵
  PID:15088
- C:\Windows\System\TXKBgnI.exe
  C:\Windows\System\TXKBgnI.exe
  2⤵
  PID:15112
- C:\Windows\System\NBqbMyt.exe
  C:\Windows\System\NBqbMyt.exe
  2⤵
  PID:15132
- C:\Windows\System\ukJTiNP.exe
  C:\Windows\System\ukJTiNP.exe
  2⤵
  PID:15156
- C:\Windows\System\uXYNvHF.exe
  C:\Windows\System\uXYNvHF.exe
  2⤵
  PID:15192
- C:\Windows\System\NnbFQBb.exe
  C:\Windows\System\NnbFQBb.exe
  2⤵
  PID:15220
- C:\Windows\System\qaiizEY.exe
  C:\Windows\System\qaiizEY.exe
  2⤵
  PID:15236
- C:\Windows\System\ttnEdpv.exe
  C:\Windows\System\ttnEdpv.exe
  2⤵
  PID:15272
- C:\Windows\System\NbgpTLf.exe
  C:\Windows\System\NbgpTLf.exe
  2⤵
  PID:15304
- C:\Windows\System\yDHXxRn.exe
  C:\Windows\System\yDHXxRn.exe
  2⤵
  PID:15336
- C:\Windows\System\tNPHXQv.exe
  C:\Windows\System\tNPHXQv.exe
  2⤵
  PID:13388
- C:\Windows\System\sMDRaqI.exe
  C:\Windows\System\sMDRaqI.exe
  2⤵
  PID:14048
- C:\Windows\System\TWORrLY.exe
  C:\Windows\System\TWORrLY.exe
  2⤵
  PID:13496
- C:\Windows\System\rMfYqPp.exe
  C:\Windows\System\rMfYqPp.exe
  2⤵
  PID:13820
- C:\Windows\System\ZYVwHDB.exe
  C:\Windows\System\ZYVwHDB.exe
  2⤵
  PID:14396
- C:\Windows\System\TyWIRed.exe
  C:\Windows\System\TyWIRed.exe
  2⤵
  PID:14448
- C:\Windows\System\CwXpiKz.exe
  C:\Windows\System\CwXpiKz.exe
  2⤵
  PID:14492
- C:\Windows\System\KQkLmJG.exe
  C:\Windows\System\KQkLmJG.exe
  2⤵
  PID:14528
- C:\Windows\System\AtUmbHy.exe
  C:\Windows\System\AtUmbHy.exe
  2⤵
  PID:14708
- C:\Windows\System\RHIgVLO.exe
  C:\Windows\System\RHIgVLO.exe
  2⤵
  PID:14800
- C:\Windows\System\PKiCbDc.exe
  C:\Windows\System\PKiCbDc.exe
  2⤵
  PID:14588
- C:\Windows\System\flvwQOS.exe
  C:\Windows\System\flvwQOS.exe
  2⤵
  PID:14816
- C:\Windows\System\WFuoqEi.exe
  C:\Windows\System\WFuoqEi.exe
  2⤵
  PID:14884
- C:\Windows\System\yMYboNk.exe
  C:\Windows\System\yMYboNk.exe
  2⤵
  PID:14944
- C:\Windows\System\jgUlRoy.exe
  C:\Windows\System\jgUlRoy.exe
  2⤵
  PID:15168
- C:\Windows\System\eCDQWCu.exe
  C:\Windows\System\eCDQWCu.exe
  2⤵
  PID:15028
- C:\Windows\System\BcvzJDd.exe
  C:\Windows\System\BcvzJDd.exe
  2⤵
  PID:15260
- C:\Windows\System\laszCfx.exe
  C:\Windows\System\laszCfx.exe
  2⤵
  PID:14976
- C:\Windows\System\CZmDkHy.exe
  C:\Windows\System\CZmDkHy.exe
  2⤵
  PID:15216
- C:\Windows\System\zNxkjXB.exe
  C:\Windows\System\zNxkjXB.exe
  2⤵
  PID:15268
- C:\Windows\System\wqWPBYg.exe
  C:\Windows\System\wqWPBYg.exe
  2⤵
  PID:15312
- C:\Windows\System\omLyNUl.exe
  C:\Windows\System\omLyNUl.exe
  2⤵
  PID:15208
- C:\Windows\System\WpWWXQc.exe
  C:\Windows\System\WpWWXQc.exe
  2⤵
  PID:14772
- C:\Windows\System\sdYrjtr.exe
  C:\Windows\System\sdYrjtr.exe
  2⤵
  PID:14792
- C:\Windows\System\cftilBc.exe
  C:\Windows\System\cftilBc.exe
  2⤵
  PID:15144
- C:\Windows\System\tZnIefx.exe
  C:\Windows\System\tZnIefx.exe
  2⤵
  PID:14140
- C:\Windows\System\LXpTacg.exe
  C:\Windows\System\LXpTacg.exe
  2⤵
  PID:15376
- C:\Windows\System\OhWgeXA.exe
  C:\Windows\System\OhWgeXA.exe
  2⤵
  PID:15404
- C:\Windows\System\xhgIXDn.exe
  C:\Windows\System\xhgIXDn.exe
  2⤵
  PID:15432
- C:\Windows\System\qyCkWpz.exe
  C:\Windows\System\qyCkWpz.exe
  2⤵
  PID:15452
- C:\Windows\System\iuAUiPl.exe
  C:\Windows\System\iuAUiPl.exe
  2⤵
  PID:15476
- C:\Windows\System\ckXPvzy.exe
  C:\Windows\System\ckXPvzy.exe
  2⤵
  PID:15508
- C:\Windows\System\awODmFB.exe
  C:\Windows\System\awODmFB.exe
  2⤵
  PID:15532
- C:\Windows\System\tDedTTN.exe
  C:\Windows\System\tDedTTN.exe
  2⤵
  PID:15560
- C:\Windows\System\ACmSYiI.exe
  C:\Windows\System\ACmSYiI.exe
  2⤵
  PID:15584
- C:\Windows\System\MAFnTox.exe
  C:\Windows\System\MAFnTox.exe
  2⤵
  PID:15604
- C:\Windows\System\mthiPnl.exe
  C:\Windows\System\mthiPnl.exe
  2⤵
  PID:15628
- C:\Windows\System\stGwbjB.exe
  C:\Windows\System\stGwbjB.exe
  2⤵
  PID:15656
- C:\Windows\System\fUwCCkK.exe
  C:\Windows\System\fUwCCkK.exe
  2⤵
  PID:15684
- C:\Windows\System\xemUfET.exe
  C:\Windows\System\xemUfET.exe
  2⤵
  PID:15716
- C:\Windows\System\MJFYIXj.exe
  C:\Windows\System\MJFYIXj.exe
  2⤵
  PID:15736
- C:\Windows\System\QInLMsy.exe
  C:\Windows\System\QInLMsy.exe
  2⤵
  PID:15764
- C:\Windows\System\cNKRJFj.exe
  C:\Windows\System\cNKRJFj.exe
  2⤵
  PID:15784
- C:\Windows\System\RTPAFhW.exe
  C:\Windows\System\RTPAFhW.exe
  2⤵
  PID:15812
- C:\Windows\System\yIAoyVm.exe
  C:\Windows\System\yIAoyVm.exe
  2⤵
  PID:15836
- C:\Windows\System\zWvnQHN.exe
  C:\Windows\System\zWvnQHN.exe
  2⤵
  PID:15872
- C:\Windows\System\bzYsqGl.exe
  C:\Windows\System\bzYsqGl.exe
  2⤵
  PID:15892
- C:\Windows\System\UHKbejB.exe
  C:\Windows\System\UHKbejB.exe
  2⤵
  PID:15916
- C:\Windows\System\SmOKmyJ.exe
  C:\Windows\System\SmOKmyJ.exe
  2⤵
  PID:15944
- C:\Windows\System\DhOBcLl.exe
  C:\Windows\System\DhOBcLl.exe
  2⤵
  PID:15976
- C:\Windows\System\urWVCKM.exe
  C:\Windows\System\urWVCKM.exe
  2⤵
  PID:16000
- C:\Windows\System\ELKVUYA.exe
  C:\Windows\System\ELKVUYA.exe
  2⤵
  PID:16020
- C:\Windows\System\SyciKJz.exe
  C:\Windows\System\SyciKJz.exe
  2⤵
  PID:16040
- C:\Windows\System\QDFqtBg.exe
  C:\Windows\System\QDFqtBg.exe
  2⤵
  PID:16060
- C:\Windows\System\uDaJAWf.exe
  C:\Windows\System\uDaJAWf.exe
  2⤵
  PID:16088
- C:\Windows\System\iZogdXX.exe
  C:\Windows\System\iZogdXX.exe
  2⤵
  PID:16112
- C:\Windows\System\yatvHeV.exe
  C:\Windows\System\yatvHeV.exe
  2⤵
  PID:16128
- C:\Windows\System\aXyPGjy.exe
  C:\Windows\System\aXyPGjy.exe
  2⤵
  PID:16148
- C:\Windows\System\pEHCPWb.exe
  C:\Windows\System\pEHCPWb.exe
  2⤵
  PID:16184
- C:\Windows\System\FMhFUtP.exe
  C:\Windows\System\FMhFUtP.exe
  2⤵
  PID:16204
- C:\Windows\System\HtpgZPK.exe
  C:\Windows\System\HtpgZPK.exe
  2⤵
  PID:16220
- C:\Windows\System\yQzCEdb.exe
  C:\Windows\System\yQzCEdb.exe
  2⤵
  PID:16252
- C:\Windows\System\zhLcjWs.exe
  C:\Windows\System\zhLcjWs.exe
  2⤵
  PID:16268
- C:\Windows\System\TSxBAkS.exe
  C:\Windows\System\TSxBAkS.exe
  2⤵
  PID:16308
- C:\Windows\System\jZLebeA.exe
  C:\Windows\System\jZLebeA.exe
  2⤵
  PID:16332
- C:\Windows\System\fWRfQVL.exe
  C:\Windows\System\fWRfQVL.exe
  2⤵
  PID:16352
- C:\Windows\System\dlKEmhg.exe
  C:\Windows\System\dlKEmhg.exe
  2⤵
  PID:16380
- C:\Windows\System\zJoTkiV.exe
  C:\Windows\System\zJoTkiV.exe
  2⤵
  PID:14284
- C:\Windows\System\XQpvlZf.exe
  C:\Windows\System\XQpvlZf.exe
  2⤵
  PID:14824
- C:\Windows\System\nGucZiC.exe
  C:\Windows\System\nGucZiC.exe
  2⤵
  PID:14620
- C:\Windows\System\wrmzPZh.exe
  C:\Windows\System\wrmzPZh.exe
  2⤵
  PID:14908
- C:\Windows\System\WLhiLzq.exe
  C:\Windows\System\WLhiLzq.exe
  2⤵
  PID:14604
- C:\Windows\System\skpaoiR.exe
  C:\Windows\System\skpaoiR.exe
  2⤵
  PID:14420
- C:\Windows\System\HtcyRJQ.exe
  C:\Windows\System\HtcyRJQ.exe
  2⤵
  PID:15232
- C:\Windows\System\EfyonnJ.exe
  C:\Windows\System\EfyonnJ.exe
  2⤵
  PID:13840
- C:\Windows\System\iXhbowd.exe
  C:\Windows\System\iXhbowd.exe
  2⤵
  PID:15544
- C:\Windows\System\LyDULZi.exe
  C:\Windows\System\LyDULZi.exe
  2⤵
  PID:15888
- C:\Windows\System\lyoRngT.exe
  C:\Windows\System\lyoRngT.exe
  2⤵
  PID:15492
- C:\Windows\System\ArIyvSL.exe
  C:\Windows\System\ArIyvSL.exe
  2⤵
  PID:15756
- C:\Windows\System\NsliQEo.exe
  C:\Windows\System\NsliQEo.exe
  2⤵
  PID:15580
- C:\Windows\System\HoJuQBD.exe
  C:\Windows\System\HoJuQBD.exe
  2⤵
  PID:15832
- C:\Windows\System\oHFmYGR.exe
  C:\Windows\System\oHFmYGR.exe
  2⤵
  PID:15956
- C:\Windows\System\yCJarcY.exe
  C:\Windows\System\yCJarcY.exe
  2⤵
  PID:15780
- C:\Windows\System\iMALvFl.exe
  C:\Windows\System\iMALvFl.exe
  2⤵
  PID:15800
- C:\Windows\System\QJbWslU.exe
  C:\Windows\System\QJbWslU.exe
  2⤵
  PID:15880
- C:\Windows\System\wsRJYKU.exe
  C:\Windows\System\wsRJYKU.exe
  2⤵
  PID:16172
- C:\Windows\System\fllaEdB.exe
  C:\Windows\System\fllaEdB.exe
  2⤵
  PID:16196
- C:\Windows\System\TNyfRez.exe
  C:\Windows\System\TNyfRez.exe
  2⤵
  PID:16228
- C:\Windows\System\OtZTqYV.exe
  C:\Windows\System\OtZTqYV.exe
  2⤵
  PID:16096
- C:\Windows\System\tSBxAEL.exe
  C:\Windows\System\tSBxAEL.exe
  2⤵
  PID:15848
- C:\Windows\System\emLgSFS.exe
  C:\Windows\System\emLgSFS.exe
  2⤵
  PID:16392
- C:\Windows\System\KKnklMM.exe
  C:\Windows\System\KKnklMM.exe
  2⤵
  PID:16416
- C:\Windows\System\ZazCeoS.exe
  C:\Windows\System\ZazCeoS.exe
  2⤵
  PID:16440
- C:\Windows\System\VJYsTZX.exe
  C:\Windows\System\VJYsTZX.exe
  2⤵
  PID:16464
- C:\Windows\System\IOYXUqk.exe
  C:\Windows\System\IOYXUqk.exe
  2⤵
  PID:16484
- C:\Windows\System\qTWjoDU.exe
  C:\Windows\System\qTWjoDU.exe
  2⤵
  PID:16516
- C:\Windows\System\XgFkFly.exe
  C:\Windows\System\XgFkFly.exe
  2⤵
  PID:16540
- C:\Windows\System\HVQyBXc.exe
  C:\Windows\System\HVQyBXc.exe
  2⤵
  PID:16568
- C:\Windows\System\sIXXdlL.exe
  C:\Windows\System\sIXXdlL.exe
  2⤵
  PID:16584
- C:\Windows\System\tPQLveE.exe
  C:\Windows\System\tPQLveE.exe
  2⤵
  PID:16608
- C:\Windows\System\xkQHkpq.exe
  C:\Windows\System\xkQHkpq.exe
  2⤵
  PID:16644
- C:\Windows\System\rvdYPlf.exe
  C:\Windows\System\rvdYPlf.exe
  2⤵
  PID:16668
- C:\Windows\System\wUpLuYI.exe
  C:\Windows\System\wUpLuYI.exe
  2⤵
  PID:16684
- C:\Windows\System\EHgHjEI.exe
  C:\Windows\System\EHgHjEI.exe
  2⤵
  PID:16712
- C:\Windows\System\EtjYXNM.exe
  C:\Windows\System\EtjYXNM.exe
  2⤵
  PID:16728
- C:\Windows\System\edQpdWG.exe
  C:\Windows\System\edQpdWG.exe
  2⤵
  PID:16752
- C:\Windows\System\VcCvCrh.exe
  C:\Windows\System\VcCvCrh.exe
  2⤵
  PID:16788
- C:\Windows\System\yxVRBMV.exe
  C:\Windows\System\yxVRBMV.exe
  2⤵
  PID:16804
- C:\Windows\System\zCOBsYD.exe
  C:\Windows\System\zCOBsYD.exe
  2⤵
  PID:16836
- C:\Windows\System\SQfVssV.exe
  C:\Windows\System\SQfVssV.exe
  2⤵
  PID:17236
- C:\Windows\System\FIGEArc.exe
  C:\Windows\System\FIGEArc.exe
  2⤵
  PID:17268
- C:\Windows\System\swGvhZX.exe
  C:\Windows\System\swGvhZX.exe
  2⤵
  PID:17376
- C:\Windows\System\RMTbMon.exe
  C:\Windows\System\RMTbMon.exe
  2⤵
  PID:14984
- C:\Windows\System\PzWilxr.exe
  C:\Windows\System\PzWilxr.exe
  2⤵
  PID:16348
- C:\Windows\System\tJpfXRa.exe
  C:\Windows\System\tJpfXRa.exe
  2⤵
  PID:16408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\GQNCURy.exe

Filesize
1.7MB

MD5
4c9993f0f66b1e7895f82e080d76c7d3

SHA1
81b11aad97f2ab5940b1125d4d1d0bb976976f07

SHA256
f794dba957fde4901bbcd10ce99f2fd12cba29f6b7450cbb3c701ecf27cf3d6c

SHA512
9560d47d84c595b4c69fe794e467b20d9417304df9d59a44f9ed82fb8408dc9426554295bbb71c52c71329969819b2070d7f45d8e260b629051dd1a55089f8d2

Download Submit
C:\Windows\System\GqKlieK.exe

Filesize
1.7MB

MD5
10f5b742fba105b40beb870246d316cd

SHA1
48ee775aa0c47ef5ec8481d8528f11b25b976a32

SHA256
6fe06845a5081bcbd532527c7332cd6afd7342cf16e20acba1c00e5fa755b2c0

SHA512
13c213c0b39c1958d1d11c43dd6b8a7812c53294bbd65601037d8346a008a2a511a11f5942375fdf441e54d9d06d21a49150a22ecddc390c2bc6a305189ca150

Download Submit
C:\Windows\System\IUFzQIu.exe

Filesize
1.7MB

MD5
b6ad1df9e2226e50aa9967d9b471add4

SHA1
4b21e2fad40d7141b1b6e36925aab470be1cb9b2

SHA256
1cfaebdd8e8c2bce260663bc7a6f027ab3cbe4d600c942f56739df34bad5ad06

SHA512
beb43c5190235a4ca5bbbd8a1b48dcbd84d11ec99d7f575ebe7b4e9a4552c0799ba50dfba2b9121d915cd83b1f207817591950dc30adceff9f982980b49b5c5d

Download Submit
C:\Windows\System\Iudqpar.exe

Filesize
1.7MB

MD5
21b286d46b7d39bba6e6241d13969d9b

SHA1
f822a4785d0fec6a10cd3773f19772cf697d0ab2

SHA256
13542a037928aea6a4e5f2fbb726ed1185c52c9dd1158a18b700a7ba1adf68a0

SHA512
511abc25c40ea3219044e325f72b3f6aa2864003fe062a45c7501479b8bfad66f8db4107de5a47d477d16b46402cf8fa01b1c0e4bbc14c4e0f3b7a31f9136416

Download Submit
C:\Windows\System\MRHVoIC.exe

Filesize
1.7MB

MD5
243dc0f8c3983c3f2f6482249e314c09

SHA1
5b37c878a5b6c43cbbdd99612479d348792e2cd6

SHA256
550863b57df68a864626bad42fbac15973c29225d12f461b8eb2cf3a250dbabf

SHA512
be6d4dfb992d947a4eb62eeec530b4b3921c59e8a7cde418acfd1dfb579a5c782f77eebf881c9d4437419b8dfdaa027b6ee77caaa809212c372ad787b7595f26

Download Submit
C:\Windows\System\MzJwkal.exe

Filesize
1.7MB

MD5
4f9d329de77daed2309544e7a493bbe2

SHA1
3af877a6a1aa55ebc864968fa5a77881e1f6d616

SHA256
ddce27932db41798e5cfb7cc172588f1b13ab2a90f6aae9f3ebeb5692315c1e4

SHA512
04b3287cef6b89a6f033b60d72c3d82ef5434d63dddabf962a2bc3a7d7022846cbbe82b7911d65719876432e14f04b082a430dedb1f4a6b9fd64c5adcbe0a0c3

Download Submit
C:\Windows\System\NixFKkB.exe

Filesize
1.7MB

MD5
b5c661ff547f2f841568316fc282a567

SHA1
bebe9800b41edfff14e024befe3513c2ed794eef

SHA256
8dc7f740269a266db9dc1d530b51551be97a9adea0383e14423c9bff9d207848

SHA512
91cc21d1d99ec4f7bf763d930ca8a8675c2c242c5404f856ec99b717661c6d9cabada0f9938175b59dd23f9099fe818bcf7735cb8d38fcf0292eebad9fc87ca5

Download Submit
C:\Windows\System\RahzdJR.exe

Filesize
1.7MB

MD5
f115dd42fb79eb01fc8ee8ec63666673

SHA1
1384ee585aa241d58707673916c0f5885fd8e82b

SHA256
25e1ee1f09786783996b13844ecbae6836c0382559151d5db99787116a10258c

SHA512
88e59b22dfb55957b5fbcf58741813173965bdf807a596b64a838f9cf39694ffee8ef0ed082be2c013b1e6887d0609bc44366d667f70201a7465aa1849cf3390

Download Submit
C:\Windows\System\XjRpQzx.exe

Filesize
1.7MB

MD5
45f5662d8f69852ba7026d8f4558cda2

SHA1
42ca89ab283fc44b9127a860d089d0aeee109708

SHA256
bed3803ca8d5c9d6694f4bc8412b3249b41607666cd4f48a822c2d17435bb2e7

SHA512
2d86bb850d304d1a4c6691fa82e16f5123e2e0cc1c19cfa641b3e292d84a8dab1e654288491ddc5fc596ac45fabb3a882368bdded570494f932f7aa2a2e21b8d

Download Submit
C:\Windows\System\YBJtVBe.exe

Filesize
1.7MB

MD5
41780509624ada64e0d7afb44b52da98

SHA1
2e0cef08ed8892c214897267e2928b179180d628

SHA256
e15b52986b10374c1fb338070af11f1f4261bfab1757ab558c53e6b0795463b8

SHA512
d4db58e635f99e99d71c6156c0a0db2979d6592d38ea6aa61124f09aa31250b0a062e5568fe2469c0a01f6763d0075e7cc15f517417557eacf24b60773c60140

Download Submit
C:\Windows\System\YYwAaYP.exe

Filesize
1.7MB

MD5
7a30dd51958fae8afdc29a51a8bba399

SHA1
58c7dbff50e44cef0659570c7b2a5cdfc60c9fe7

SHA256
f43c216f3c4069959bdacdeeea53d8f750ec609f7dd368964580189d62df4c90

SHA512
6f282b821ff8b88628eb9eced9582164f8f982924522e79bc478030bdbfc7fd9e1fdede5c87b03eee7269c4e3e8ad9b8d8d9087f1e44003210d0019f6daa865b

Download Submit
C:\Windows\System\aWasuEU.exe

Filesize
1.7MB

MD5
7d9ef33eed37918db53ae3aacea937e9

SHA1
ace92a4db3434077c1bfebc4b6948f2b500859e6

SHA256
2854df7391d2878d0715efcf4defc9a36870faa4d078089d9c25027cd0f17278

SHA512
8bc4782694e511042be8e49d88a4a7dde57e89c96501e173595d5f53edf9af82c6f941b861ebf0dccccc90a259b599a157a242f7845cdde6b39e153080d8edb1

Download Submit
C:\Windows\System\aczEVzR.exe

Filesize
1.7MB

MD5
9e8f78501364410622d356b003c6ccaa

SHA1
067cb724c23343613b370a5d66e6254bbd6ab4f6

SHA256
30ebe27fdac72a83c98f6660a5ab61edd33771d105c5f2808c05678e27afa0d9

SHA512
1a234ea99deaf317893ccb5e2cd75ad53d05b7de20a49b6d31e9c1eabb95d64066ea9c25a699493f64a46e9b0bade8365b1d325862dd1dc05d79b9ee6acd7015

Download Submit
C:\Windows\System\eRnuGtk.exe

Filesize
1.7MB

MD5
dbb3466722c1897892a214508e65d794

SHA1
8b2b84ff1535a65062caa4504f03a8cacbc6bc7f

SHA256
404137d17644d0f9e21f48bb1fac1755accc59ac6b735a74e08714791c0df2f0

SHA512
eb83434444639525d96cc6dd1c2f3b77ba81a5fa32cabf0998112c5b5ec63ed03a3d3678db406d47f46b68917dfcf78f1ec1e11ba02559f63fbce8d1a0b98186

Download Submit
C:\Windows\System\eXgKlYZ.exe

Filesize
1.7MB

MD5
40762b3ba318b2b0780169f0278a3d79

SHA1
2be3751fdaece0e9c7205a0ae4b8dfa270c7c368

SHA256
d6bd306a9cd78ae7516af0a6cac9e36cae1ed198c947f39402aca2b858718dc1

SHA512
7ca8f7e69b43c8d5cf2144531fe7b030af34452ead4c637d6e120aff7b61e11f099c335926208f2664349d4e7c2da170ae459dcc394f1a7c5e1ed7673f06f55c

Download Submit
C:\Windows\System\gaasHns.exe

Filesize
1.7MB

MD5
0f0699d60321678f94c096fa143d4629

SHA1
a789cbdf8d843e5e93755f04ebf178c0489d6c7b

SHA256
02f7c7cddb5effc985004fe7d4c39598251df9c576f7c7bcdf175cd6adab6392

SHA512
bea33418880f1c66080c68d408b2fb679f19cede1e374795e4aa0e2ac1e86f4d1e4265d0870f859071b9ac5a55c8899472597379c3d2bf61c13800fa9f8333ce

Download Submit
C:\Windows\System\jfOmWDz.exe

Filesize
1.7MB

MD5
fc79a688a0e997115f3c0be87531ac08

SHA1
18900ccad7cadabec52747df4ffbed32ab6ab1a1

SHA256
f4bec0d27073d1b06d2c69bc728384d78fbd9e01e9aaf5daf1ec142a834301cd

SHA512
fe59f03d6873978a69719e910e8729b5836236cd738a15d6741f32759adab52fed594bd797e64a339962d41c5b713ead4f012e1916c2921ec2d59ed87d882e0d

Download Submit
C:\Windows\System\lrgoZBv.exe

Filesize
1.7MB

MD5
d575e6a5890ec9a4d70331db9dae311f

SHA1
5e1683e2108ceea0e0a32502549278f23d9b9629

SHA256
6c0c99cb6e4a04fc8c058ce726cd3d055d9c3b75916c04aa091293dcebf5eba8

SHA512
f11aba09a98aa41de3ec7826424651caac9704686d8d789f7c557849f322c81b83f716e2972c8679fb383390fdd932f655e79af3518ea652bfdde626cf1543cb

Download Submit
C:\Windows\System\mFMOQSz.exe

Filesize
1.7MB

MD5
704f25d7df9c965961b0b6c6306d8f44

SHA1
4020f724e461b0b30b0c1a53d3662a1d38ecdadb

SHA256
61bf8d67e59158edf5655d04c8532389ebc34d1940de428c04a2d00ef70045c7

SHA512
f72c19028625ba566bb167dd067e342297f5acd9be5a686fb3fd485ca47520f7a795cc241216bebf8e7357c24244448a4351528544580c28d4c6c8f53f813b95

Download Submit
C:\Windows\System\nXvakpk.exe

Filesize
1.7MB

MD5
a4c1c30052cc5b7dfa36984c1e6ec566

SHA1
3ea559653e9498783c36fa484422911b8167a3cf

SHA256
d9bf521910084f2ac088e240abcbe998348cfe0dc4aaa0979afb2fd46d0a94d7

SHA512
220564ceddc2d9e50e5d3f69209165dcef62b343f02865f15fa9086a9195f65b88eebc2e22b12126f662ba2968ae60c47096f2f76cb3589071625963d296a803

Download Submit
C:\Windows\System\oMwngSe.exe

Filesize
1.7MB

MD5
109e4fb57de02926459de4c971d4461e

SHA1
1ff43029763c39313d8550e9591c4ed94fea34f7

SHA256
e133dce34d0b6930d4a74829dbdf6e6861cc51141a9983e603fa2673a76e7c67

SHA512
5eaa66d777652a0bcc51c8641a698894e1803b1926af66924be0e9864c2d544380a01f01dd750f533e29bff5c75ae65674e63968ae9c9b503672a68c3b766a7f

Download Submit
C:\Windows\System\pvhUEOk.exe

Filesize
1.7MB

MD5
ef3b0a78641438ffab937ba8f02dc10f

SHA1
a33e6d61b1c1bde4005946e5d1536d6a3084f68d

SHA256
ae02a939fb300343c6e94e62f3077e328b20454cfa46573618892624b237068b

SHA512
7fb6c415b1a0df5f1be45835dd7c0702ba8f25c7116c5b6c146ae64c88da32cd3034ac0df83c6ab84f5308e30c0df870c999f0742cda0e6345e99e15c140d8d4

Download Submit
C:\Windows\System\rRYqVsc.exe

Filesize
1.7MB

MD5
622a6cd1b16395b12e1643a03451715d

SHA1
f171d97877d57bee46c0fedb81409e40779192aa

SHA256
f79c1e9449620db6948c07b559700cdc58810667776004494d086d6e6d19482d

SHA512
3eb42d939c404b17224a1c6ad8932e2136cad041309bfac6ae476c24e46cc7b8669742db93ae9249fc23f27a9a2684c9e2b434efec7e4808e697528ca61fea31

Download Submit
C:\Windows\System\rlkNUem.exe

Filesize
1.7MB

MD5
9098d94c12cf8afeacaee48db41fa8e1

SHA1
2063833859693dbb0a754dfcfe067b2e7f2ac47c

SHA256
50d36d16446f6b49b3d6a091f8bea0f83568c91b8a67b164a8c27b7d63d4e3b3

SHA512
451f74533fd4569e7f4b36df35759e68cdcfc2e785783086e6d0b9306407c19220166a300ce698460892d410b22518766d054139921cb2c2322265fe9597a895

Download Submit
C:\Windows\System\sXSXmoF.exe

Filesize
1.7MB

MD5
0d0db6c270e8651797e7ca5c4ed49447

SHA1
34637693861ced1fcf88cd912264b17cd52eef05

SHA256
19621851843fe4a98d29bbc0f94629796f774844347a7bd2e09e627118310004

SHA512
e80ba20d360ddda3fb7c7282ccd868bbfe2187c89b04e9a09063f24637d30b2b7a1291e144eefd9976222a28c56cdc32633b169a9286a6dae107d2507dc5e7f6

Download Submit
C:\Windows\System\sXmfWLd.exe

Filesize
1.7MB

MD5
3f1945fadb535831b6cd0e351580e431

SHA1
e08da0a6806afc978e7b99f973b4b9002110dc1e

SHA256
cf86170adf23e55ba502c0c0bcef783bd8f8c6f94f710e2c19757da7eac7ff7e

SHA512
6022744f8bf74da0d67fae672d9f4d534304b64eb2001b8ffc7dd37c5aebb74a9809a4e1b72740b7d37f5f2a9715fd8b1e6110a7997b5d1468a3fa80504c71b8

Download Submit
C:\Windows\System\wAlHPQu.exe

Filesize
1.7MB

MD5
58227738af6035fe2f28d3216f1aed2e

SHA1
c670fe481c166286959561c8f9a2dcf40dbbbce7

SHA256
66a767b1236be3a71c848e90eb5a360583da4df59255e7a0df51ade728688ad1

SHA512
3b77b3cffea5e19608fc59e453eaeb87e6e9dfb171113df1f8ef25373de172a0847de3bf69cd4a3f14471a34013ee014dfc2c5b6ff80092cbc1f7eb76f143aa9

Download Submit
C:\Windows\System\ysHwtBb.exe

Filesize
1.7MB

MD5
092da98da498b77b45fe8392e62653dc

SHA1
acde8c9fe98c4e9b9514c8f76cfc9d0205d76c45

SHA256
64f194bfcd8870be22c11eed00aeb3dd1eb18faab0fc5a222dbfb40a0f78d34f

SHA512
40afcc5f624c981cbacf01afc5991e5c19478f852d50d3b449f05e8c6538bf72adc3e8e1c8396be91690c1772171fff7bc165c6db5b0630f787612f1b2e45ff2

Download Submit
C:\Windows\System\yxCKCgs.exe

Filesize
1.7MB

MD5
3e085f52316aa402145c7fd1ba9b2c98

SHA1
a961615adf82ea3703ca6d6b715d7784e767b2b5

SHA256
8ca527d9b57f3421b007320aa52df79de21e0ce99e830fedb0346e68e2c94924

SHA512
36c361023fde0ebedeee9af96aaec10bd103fb0ef41299bc9f32b89da5d5d25c0acbbaa22a4a5376ddc18cd4e8ad53cb234d4a329c567feed83f42218e279c51

Download Submit
C:\Windows\System\zezlkbm.exe

Filesize
1.7MB

MD5
00c21c52b8fa9c09f26fdcfd88adca93

SHA1
534e9ba80157a4327bc24b21329cb2a7b37d059c

SHA256
bf9785ee2b1b5603d2795d6f314657e6b9a58cbda6e4535b124519057b062451

SHA512
d57796024468b2cf0211775702a1ee113383175c627644bc64407ef5ee797c9c6712b7dbced40d40bf5afeb38a3c8dda5cf2510fadf73257966824d55a3378e4

Download Submit
C:\Windows\System\zqAxTkr.exe

Filesize
1.7MB

MD5
9bee67dd6d0e5b39746ee57b208a9441

SHA1
05940f75d4415c5b2573e9f0ecff664e6c40bc41

SHA256
1f7197828baf6426e7303eb8ec7c6260d45c0043fecab4072bbca33ae5444440

SHA512
0e44e9a0c8a1fd7195c2b2b5e3c34436dff9ffa489d977758af19926dce8381d941d4e857895dc97cf66f81fbef887e5cd6ae5d534f155195b6c44f2dd254b3d

Download Submit
C:\Windows\System\ztCVezl.exe

Filesize
1.7MB

MD5
ac6059eb76df613c6800b5025db4e91b

SHA1
283a3b14f1dc9e2b669e5c519fc743612882be48

SHA256
5a84e25e9201b50a2c7ca0e132f9f7baec87976af318ebe4d1d9a7a886f90fae

SHA512
9a6e5c8f7e2c6b481a4cc5dc7634a4745fad29402cca8f49f8c1ee39f19bf7e6cb3948903414106c5704ad62c9e01d7ac2e06d0a0704c58cc6039e9c77ace7c5

Download Submit
memory/912-0-0x0000014A04110000-0x0000014A04120000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads