xmrig | 8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
Size

1.4MB
MD5

b30f520b9d42a7686f5e5fb831f92fff
SHA1

f0b5cd1213bcc88c27f2273eb815ac40c69f8a92
SHA256

8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb
SHA512

f495b8ef45c4a3a746e4ef79f79a9ff1784065bed354a8347f03439b92871f7da4bf623297aa26db8211235a9e7191c339ffcb49f6de97abfc5b156ea02439c8
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcw:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5u

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c84-6.dat	xmrig
behavioral2/files/0x0007000000023c8b-33.dat	xmrig
behavioral2/files/0x0007000000023c93-62.dat	xmrig
behavioral2/files/0x0007000000023c98-79.dat	xmrig
behavioral2/files/0x0007000000023c97-112.dat	xmrig
behavioral2/files/0x0007000000023ca0-130.dat	xmrig
behavioral2/files/0x0007000000023c9f-128.dat	xmrig
behavioral2/files/0x0007000000023c9e-126.dat	xmrig
behavioral2/files/0x0007000000023c9d-124.dat	xmrig
behavioral2/files/0x0007000000023c9b-122.dat	xmrig
behavioral2/files/0x0007000000023c9c-120.dat	xmrig
behavioral2/files/0x0007000000023c9a-118.dat	xmrig
behavioral2/files/0x0007000000023c99-116.dat	xmrig
behavioral2/files/0x0007000000023c90-108.dat	xmrig
behavioral2/files/0x0007000000023c96-106.dat	xmrig
behavioral2/files/0x0007000000023c95-103.dat	xmrig
behavioral2/files/0x0007000000023c94-101.dat	xmrig
behavioral2/files/0x0007000000023c92-98.dat	xmrig
behavioral2/files/0x0007000000023c91-88.dat	xmrig
behavioral2/files/0x0007000000023c8f-82.dat	xmrig
behavioral2/files/0x0007000000023c8e-58.dat	xmrig
behavioral2/files/0x0007000000023c8d-51.dat	xmrig
behavioral2/files/0x0007000000023c8c-43.dat	xmrig
behavioral2/files/0x0007000000023c89-37.dat	xmrig
behavioral2/files/0x0007000000023c8a-26.dat	xmrig
behavioral2/files/0x0007000000023c88-10.dat	xmrig
behavioral2/files/0x0007000000023ca1-134.dat	xmrig
behavioral2/files/0x0007000000023ca5-153.dat	xmrig
behavioral2/files/0x0007000000023ca9-170.dat	xmrig
behavioral2/files/0x0007000000023cad-177.dat	xmrig
behavioral2/files/0x0007000000023cac-176.dat	xmrig
behavioral2/files/0x0007000000023ca7-162.dat	xmrig
behavioral2/files/0x0007000000023ca6-159.dat	xmrig
behavioral2/files/0x0007000000023ca3-154.dat	xmrig
behavioral2/files/0x0007000000023ca8-167.dat	xmrig
behavioral2/files/0x0007000000023ca4-144.dat	xmrig
behavioral2/files/0x0008000000023c85-141.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3748	MSmXJvh.exe
4140	AMZoamK.exe
828	PzpZvIs.exe
908	JbjAFiJ.exe
4804	SsdDIcR.exe
4888	tTIWPyO.exe
2740	epkoZTi.exe
4736	iGHUygk.exe
3768	CTkIjMv.exe
1292	yVNhrpt.exe
400	ptKnwTw.exe
4880	yOJUquo.exe
2584	uCECcMD.exe
3224	vVqQIuJ.exe
2188	gjEUztl.exe
4956	sWtOZUK.exe
2320	ljCMlXq.exe
4984	WXhwOnK.exe
4424	mWHPQvn.exe
4968	ApGTmUX.exe
5092	oWfxsKO.exe
4132	bKxVxFH.exe
4972	XbpUvMv.exe
2864	Mmowkkk.exe
3676	qEwOULL.exe
1228	OCZovge.exe
1972	uxqoIoU.exe
4004	nETGGko.exe
3528	SUiPNIe.exe
948	OGjojmR.exe
4388	DItBoin.exe
2744	wqshanW.exe
4516	qYdZjIS.exe
3152	TxSPMdj.exe
1508	KxEOSlq.exe
3784	kpHPBow.exe
944	UCdEcxP.exe
4552	mQLrKhN.exe
3636	yknUgAN.exe
4616	XYKYUQU.exe
2832	UervNeu.exe
4684	XmyFBEk.exe
3004	FSgCzPU.exe
5108	jWDfxVU.exe
2380	XGepXXQ.exe
3392	RbpZkxU.exe
4308	IIogmRl.exe
528	IuWdfbr.exe
4080	lNhjJen.exe
3912	HrIugNI.exe
4836	xRangJw.exe
3204	MkrrcOk.exe
3240	MwbvIyy.exe
1696	UOvrseK.exe
4512	JrWLcfV.exe
4628	tGVoZWT.exe
2956	MmiApuA.exe
4740	MqOfGGR.exe
3252	dnROrGB.exe
4764	mwIeNCT.exe
4868	GagxwCS.exe
1544	GdZmrwG.exe
2564	BknYYEK.exe
624	WeZbBQd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kpHPBow.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\SeuQYcI.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\rtAgdne.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\jzCKizZ.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\mxFUbSM.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\XSpxwhS.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\dGjYtbb.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\YmCflKm.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\LCQyvzp.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\CYGpqSN.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\dmkctQa.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\CFnprBU.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\sNGkihB.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\dcBnwLz.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\SuFMnbx.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\BlVcbPr.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\jiFMmDS.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\ywwNALc.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\UHWqomq.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\GdZmrwG.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\sDrwpor.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\DIAMCxR.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\dIkJGMA.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\PnTzTig.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\QzthTsq.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\LEEgrGk.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\qdvBVBk.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\zMHtjDn.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\ChCRYdT.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\opapoIw.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\FrjFqhN.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\WhnEHYh.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\PfKemfZ.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\lWlZMUR.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\OJtMODt.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\kwBDnbK.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\HFlOOoT.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\FGdfTAd.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\eRlojiE.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\yIKnEDI.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\RpIMNUI.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\yhQeTFq.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\iNDAFPR.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\ZwpWazu.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\QZLPAUe.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\NsCkCoj.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\pxOveeG.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\TvVbvFK.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\AbqqyAx.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\hDiTBoQ.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\pzrCzwH.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\XCJyMiv.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\DOCPTYX.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\QMeFryL.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\OmsmSbs.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\nRdEmnO.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\bKxVxFH.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\eiYDSRM.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\qLPZnkj.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\TJSfRvx.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\gadYPUL.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\AHIEzlq.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\qUFqoDs.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\vUmTail.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3748	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	84
PID 4884 wrote to memory of 3748	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	84
PID 4884 wrote to memory of 4140	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	85
PID 4884 wrote to memory of 4140	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	85
PID 4884 wrote to memory of 828	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	86
PID 4884 wrote to memory of 828	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	86
PID 4884 wrote to memory of 908	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	87
PID 4884 wrote to memory of 908	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	87
PID 4884 wrote to memory of 4804	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	88
PID 4884 wrote to memory of 4804	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	88
PID 4884 wrote to memory of 4888	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	89
PID 4884 wrote to memory of 4888	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	89
PID 4884 wrote to memory of 2740	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	90
PID 4884 wrote to memory of 2740	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	90
PID 4884 wrote to memory of 4736	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	91
PID 4884 wrote to memory of 4736	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	91
PID 4884 wrote to memory of 3768	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	92
PID 4884 wrote to memory of 3768	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	92
PID 4884 wrote to memory of 1292	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	93
PID 4884 wrote to memory of 1292	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	93
PID 4884 wrote to memory of 400	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	94
PID 4884 wrote to memory of 400	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	94
PID 4884 wrote to memory of 4880	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	95
PID 4884 wrote to memory of 4880	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	95
PID 4884 wrote to memory of 2584	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	96
PID 4884 wrote to memory of 2584	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	96
PID 4884 wrote to memory of 3224	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	97
PID 4884 wrote to memory of 3224	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	97
PID 4884 wrote to memory of 2188	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	98
PID 4884 wrote to memory of 2188	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	98
PID 4884 wrote to memory of 4956	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	99
PID 4884 wrote to memory of 4956	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	99
PID 4884 wrote to memory of 2320	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	100
PID 4884 wrote to memory of 2320	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	100
PID 4884 wrote to memory of 4984	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	101
PID 4884 wrote to memory of 4984	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	101
PID 4884 wrote to memory of 4424	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	102
PID 4884 wrote to memory of 4424	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	102
PID 4884 wrote to memory of 4968	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	103
PID 4884 wrote to memory of 4968	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	103
PID 4884 wrote to memory of 5092	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	104
PID 4884 wrote to memory of 5092	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	104
PID 4884 wrote to memory of 4132	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	105
PID 4884 wrote to memory of 4132	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	105
PID 4884 wrote to memory of 4972	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	106
PID 4884 wrote to memory of 4972	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	106
PID 4884 wrote to memory of 2864	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	107
PID 4884 wrote to memory of 2864	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	107
PID 4884 wrote to memory of 3676	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	108
PID 4884 wrote to memory of 3676	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	108
PID 4884 wrote to memory of 1228	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	109
PID 4884 wrote to memory of 1228	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	109
PID 4884 wrote to memory of 1972	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	110
PID 4884 wrote to memory of 1972	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	110
PID 4884 wrote to memory of 4004	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	113
PID 4884 wrote to memory of 4004	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	113
PID 4884 wrote to memory of 4388	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	114
PID 4884 wrote to memory of 4388	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	114
PID 4884 wrote to memory of 3528	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	115
PID 4884 wrote to memory of 3528	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	115
PID 4884 wrote to memory of 948	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	116
PID 4884 wrote to memory of 948	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	116
PID 4884 wrote to memory of 2744	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	117
PID 4884 wrote to memory of 2744	4884	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	117

C:\Users\Admin\AppData\Local\Temp\8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
"C:\Users\Admin\AppData\Local\Temp\8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\System\MSmXJvh.exe
  C:\Windows\System\MSmXJvh.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\AMZoamK.exe
  C:\Windows\System\AMZoamK.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\PzpZvIs.exe
  C:\Windows\System\PzpZvIs.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\JbjAFiJ.exe
  C:\Windows\System\JbjAFiJ.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\SsdDIcR.exe
  C:\Windows\System\SsdDIcR.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\tTIWPyO.exe
  C:\Windows\System\tTIWPyO.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\epkoZTi.exe
  C:\Windows\System\epkoZTi.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\iGHUygk.exe
  C:\Windows\System\iGHUygk.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\CTkIjMv.exe
  C:\Windows\System\CTkIjMv.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\yVNhrpt.exe
  C:\Windows\System\yVNhrpt.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\ptKnwTw.exe
  C:\Windows\System\ptKnwTw.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\yOJUquo.exe
  C:\Windows\System\yOJUquo.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\uCECcMD.exe
  C:\Windows\System\uCECcMD.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\vVqQIuJ.exe
  C:\Windows\System\vVqQIuJ.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\gjEUztl.exe
  C:\Windows\System\gjEUztl.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\sWtOZUK.exe
  C:\Windows\System\sWtOZUK.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\ljCMlXq.exe
  C:\Windows\System\ljCMlXq.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\WXhwOnK.exe
  C:\Windows\System\WXhwOnK.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\mWHPQvn.exe
  C:\Windows\System\mWHPQvn.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\ApGTmUX.exe
  C:\Windows\System\ApGTmUX.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\oWfxsKO.exe
  C:\Windows\System\oWfxsKO.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\bKxVxFH.exe
  C:\Windows\System\bKxVxFH.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\XbpUvMv.exe
  C:\Windows\System\XbpUvMv.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\Mmowkkk.exe
  C:\Windows\System\Mmowkkk.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\qEwOULL.exe
  C:\Windows\System\qEwOULL.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\OCZovge.exe
  C:\Windows\System\OCZovge.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\uxqoIoU.exe
  C:\Windows\System\uxqoIoU.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\nETGGko.exe
  C:\Windows\System\nETGGko.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\DItBoin.exe
  C:\Windows\System\DItBoin.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\SUiPNIe.exe
  C:\Windows\System\SUiPNIe.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\OGjojmR.exe
  C:\Windows\System\OGjojmR.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\wqshanW.exe
  C:\Windows\System\wqshanW.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\qYdZjIS.exe
  C:\Windows\System\qYdZjIS.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\TxSPMdj.exe
  C:\Windows\System\TxSPMdj.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\KxEOSlq.exe
  C:\Windows\System\KxEOSlq.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\XmyFBEk.exe
  C:\Windows\System\XmyFBEk.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\FSgCzPU.exe
  C:\Windows\System\FSgCzPU.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\kpHPBow.exe
  C:\Windows\System\kpHPBow.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\UCdEcxP.exe
  C:\Windows\System\UCdEcxP.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\mQLrKhN.exe
  C:\Windows\System\mQLrKhN.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\yknUgAN.exe
  C:\Windows\System\yknUgAN.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\UervNeu.exe
  C:\Windows\System\UervNeu.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\XYKYUQU.exe
  C:\Windows\System\XYKYUQU.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\jWDfxVU.exe
  C:\Windows\System\jWDfxVU.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\XGepXXQ.exe
  C:\Windows\System\XGepXXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\RbpZkxU.exe
  C:\Windows\System\RbpZkxU.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\IIogmRl.exe
  C:\Windows\System\IIogmRl.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\IuWdfbr.exe
  C:\Windows\System\IuWdfbr.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\lNhjJen.exe
  C:\Windows\System\lNhjJen.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\UOvrseK.exe
  C:\Windows\System\UOvrseK.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\HrIugNI.exe
  C:\Windows\System\HrIugNI.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\xRangJw.exe
  C:\Windows\System\xRangJw.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\MkrrcOk.exe
  C:\Windows\System\MkrrcOk.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\MwbvIyy.exe
  C:\Windows\System\MwbvIyy.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\JrWLcfV.exe
  C:\Windows\System\JrWLcfV.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\tGVoZWT.exe
  C:\Windows\System\tGVoZWT.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\MqOfGGR.exe
  C:\Windows\System\MqOfGGR.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\MmiApuA.exe
  C:\Windows\System\MmiApuA.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\dnROrGB.exe
  C:\Windows\System\dnROrGB.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\mwIeNCT.exe
  C:\Windows\System\mwIeNCT.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\GagxwCS.exe
  C:\Windows\System\GagxwCS.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\GdZmrwG.exe
  C:\Windows\System\GdZmrwG.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\BknYYEK.exe
  C:\Windows\System\BknYYEK.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\WeZbBQd.exe
  C:\Windows\System\WeZbBQd.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\uALxSmu.exe
  C:\Windows\System\uALxSmu.exe
  2⤵
  PID:376
- C:\Windows\System\vgxgcdi.exe
  C:\Windows\System\vgxgcdi.exe
  2⤵
  PID:1064
- C:\Windows\System\dUmGkAh.exe
  C:\Windows\System\dUmGkAh.exe
  2⤵
  PID:4548
- C:\Windows\System\DXKtlID.exe
  C:\Windows\System\DXKtlID.exe
  2⤵
  PID:216
- C:\Windows\System\QhdbIqo.exe
  C:\Windows\System\QhdbIqo.exe
  2⤵
  PID:1252
- C:\Windows\System\OsebPLZ.exe
  C:\Windows\System\OsebPLZ.exe
  2⤵
  PID:2376
- C:\Windows\System\cwqmCop.exe
  C:\Windows\System\cwqmCop.exe
  2⤵
  PID:5024
- C:\Windows\System\UygKrbu.exe
  C:\Windows\System\UygKrbu.exe
  2⤵
  PID:5004
- C:\Windows\System\yHMXHHb.exe
  C:\Windows\System\yHMXHHb.exe
  2⤵
  PID:2276
- C:\Windows\System\oVtqfud.exe
  C:\Windows\System\oVtqfud.exe
  2⤵
  PID:1248
- C:\Windows\System\FnDPCjx.exe
  C:\Windows\System\FnDPCjx.exe
  2⤵
  PID:4760
- C:\Windows\System\CKNAYlB.exe
  C:\Windows\System\CKNAYlB.exe
  2⤵
  PID:2264
- C:\Windows\System\pobzVEW.exe
  C:\Windows\System\pobzVEW.exe
  2⤵
  PID:4300
- C:\Windows\System\qHJJtev.exe
  C:\Windows\System\qHJJtev.exe
  2⤵
  PID:1116
- C:\Windows\System\lNqMAMm.exe
  C:\Windows\System\lNqMAMm.exe
  2⤵
  PID:2480
- C:\Windows\System\mJzIJZK.exe
  C:\Windows\System\mJzIJZK.exe
  2⤵
  PID:3300
- C:\Windows\System\xntWoFm.exe
  C:\Windows\System\xntWoFm.exe
  2⤵
  PID:2052
- C:\Windows\System\PZGgEBx.exe
  C:\Windows\System\PZGgEBx.exe
  2⤵
  PID:4432
- C:\Windows\System\bMOOfkA.exe
  C:\Windows\System\bMOOfkA.exe
  2⤵
  PID:1936
- C:\Windows\System\fxdOOCX.exe
  C:\Windows\System\fxdOOCX.exe
  2⤵
  PID:4720
- C:\Windows\System\mtjkoSr.exe
  C:\Windows\System\mtjkoSr.exe
  2⤵
  PID:208
- C:\Windows\System\yhQeTFq.exe
  C:\Windows\System\yhQeTFq.exe
  2⤵
  PID:2192
- C:\Windows\System\GEVBWFc.exe
  C:\Windows\System\GEVBWFc.exe
  2⤵
  PID:2444
- C:\Windows\System\IstmNyQ.exe
  C:\Windows\System\IstmNyQ.exe
  2⤵
  PID:4772
- C:\Windows\System\PgXiztE.exe
  C:\Windows\System\PgXiztE.exe
  2⤵
  PID:2600
- C:\Windows\System\qieahlW.exe
  C:\Windows\System\qieahlW.exe
  2⤵
  PID:1400
- C:\Windows\System\BvcMjkY.exe
  C:\Windows\System\BvcMjkY.exe
  2⤵
  PID:3568
- C:\Windows\System\ofjaevi.exe
  C:\Windows\System\ofjaevi.exe
  2⤵
  PID:4100
- C:\Windows\System\HEQKhiA.exe
  C:\Windows\System\HEQKhiA.exe
  2⤵
  PID:2176
- C:\Windows\System\RpIMNUI.exe
  C:\Windows\System\RpIMNUI.exe
  2⤵
  PID:1728
- C:\Windows\System\qCjzKUL.exe
  C:\Windows\System\qCjzKUL.exe
  2⤵
  PID:5132
- C:\Windows\System\vDFGOGo.exe
  C:\Windows\System\vDFGOGo.exe
  2⤵
  PID:5156
- C:\Windows\System\QRvIiWw.exe
  C:\Windows\System\QRvIiWw.exe
  2⤵
  PID:5180
- C:\Windows\System\MkUZIvS.exe
  C:\Windows\System\MkUZIvS.exe
  2⤵
  PID:5208
- C:\Windows\System\JFItlWd.exe
  C:\Windows\System\JFItlWd.exe
  2⤵
  PID:5236
- C:\Windows\System\BtufmpQ.exe
  C:\Windows\System\BtufmpQ.exe
  2⤵
  PID:5276
- C:\Windows\System\qUFqoDs.exe
  C:\Windows\System\qUFqoDs.exe
  2⤵
  PID:5300
- C:\Windows\System\xgdlqZw.exe
  C:\Windows\System\xgdlqZw.exe
  2⤵
  PID:5328
- C:\Windows\System\iJSxkQa.exe
  C:\Windows\System\iJSxkQa.exe
  2⤵
  PID:5364
- C:\Windows\System\tLmbhVu.exe
  C:\Windows\System\tLmbhVu.exe
  2⤵
  PID:5388
- C:\Windows\System\qFaeDYl.exe
  C:\Windows\System\qFaeDYl.exe
  2⤵
  PID:5416
- C:\Windows\System\pHDcqVE.exe
  C:\Windows\System\pHDcqVE.exe
  2⤵
  PID:5440
- C:\Windows\System\PfPnmDW.exe
  C:\Windows\System\PfPnmDW.exe
  2⤵
  PID:5468
- C:\Windows\System\CendfGd.exe
  C:\Windows\System\CendfGd.exe
  2⤵
  PID:5492
- C:\Windows\System\zjnIuoi.exe
  C:\Windows\System\zjnIuoi.exe
  2⤵
  PID:5520
- C:\Windows\System\iNDAFPR.exe
  C:\Windows\System\iNDAFPR.exe
  2⤵
  PID:5556
- C:\Windows\System\ZoDNgox.exe
  C:\Windows\System\ZoDNgox.exe
  2⤵
  PID:5592
- C:\Windows\System\iKIfAeg.exe
  C:\Windows\System\iKIfAeg.exe
  2⤵
  PID:5620
- C:\Windows\System\OohtJju.exe
  C:\Windows\System\OohtJju.exe
  2⤵
  PID:5656
- C:\Windows\System\ukZCykn.exe
  C:\Windows\System\ukZCykn.exe
  2⤵
  PID:5684
- C:\Windows\System\mMWDybk.exe
  C:\Windows\System\mMWDybk.exe
  2⤵
  PID:5708
- C:\Windows\System\ZwpWazu.exe
  C:\Windows\System\ZwpWazu.exe
  2⤵
  PID:5736
- C:\Windows\System\aoPVoNy.exe
  C:\Windows\System\aoPVoNy.exe
  2⤵
  PID:5772
- C:\Windows\System\BJXpkRX.exe
  C:\Windows\System\BJXpkRX.exe
  2⤵
  PID:5800
- C:\Windows\System\CMdHLtq.exe
  C:\Windows\System\CMdHLtq.exe
  2⤵
  PID:5904
- C:\Windows\System\nPMQRZm.exe
  C:\Windows\System\nPMQRZm.exe
  2⤵
  PID:5936
- C:\Windows\System\bybGMKG.exe
  C:\Windows\System\bybGMKG.exe
  2⤵
  PID:5956
- C:\Windows\System\grkWXJh.exe
  C:\Windows\System\grkWXJh.exe
  2⤵
  PID:5980
- C:\Windows\System\jyHSbpa.exe
  C:\Windows\System\jyHSbpa.exe
  2⤵
  PID:5996
- C:\Windows\System\pnngNDJ.exe
  C:\Windows\System\pnngNDJ.exe
  2⤵
  PID:6020
- C:\Windows\System\wCdMbeq.exe
  C:\Windows\System\wCdMbeq.exe
  2⤵
  PID:6040
- C:\Windows\System\kauKfGY.exe
  C:\Windows\System\kauKfGY.exe
  2⤵
  PID:6056
- C:\Windows\System\hOAkdKC.exe
  C:\Windows\System\hOAkdKC.exe
  2⤵
  PID:6080
- C:\Windows\System\cELQNyY.exe
  C:\Windows\System\cELQNyY.exe
  2⤵
  PID:6104
- C:\Windows\System\cLTVaLu.exe
  C:\Windows\System\cLTVaLu.exe
  2⤵
  PID:6132
- C:\Windows\System\SeuQYcI.exe
  C:\Windows\System\SeuQYcI.exe
  2⤵
  PID:3904
- C:\Windows\System\uvMbKBX.exe
  C:\Windows\System\uvMbKBX.exe
  2⤵
  PID:5200
- C:\Windows\System\OQjgQwR.exe
  C:\Windows\System\OQjgQwR.exe
  2⤵
  PID:5260
- C:\Windows\System\BxCHikF.exe
  C:\Windows\System\BxCHikF.exe
  2⤵
  PID:5324
- C:\Windows\System\HFlOOoT.exe
  C:\Windows\System\HFlOOoT.exe
  2⤵
  PID:5256
- C:\Windows\System\cClltZF.exe
  C:\Windows\System\cClltZF.exe
  2⤵
  PID:5400
- C:\Windows\System\twVcdTm.exe
  C:\Windows\System\twVcdTm.exe
  2⤵
  PID:5488
- C:\Windows\System\EUmIGgX.exe
  C:\Windows\System\EUmIGgX.exe
  2⤵
  PID:5540
- C:\Windows\System\BLlyMvA.exe
  C:\Windows\System\BLlyMvA.exe
  2⤵
  PID:5664
- C:\Windows\System\ZwcaNfQ.exe
  C:\Windows\System\ZwcaNfQ.exe
  2⤵
  PID:5632
- C:\Windows\System\cqgIFTi.exe
  C:\Windows\System\cqgIFTi.exe
  2⤵
  PID:5608
- C:\Windows\System\TNWQPVb.exe
  C:\Windows\System\TNWQPVb.exe
  2⤵
  PID:5696
- C:\Windows\System\BhCrOCM.exe
  C:\Windows\System\BhCrOCM.exe
  2⤵
  PID:5788
- C:\Windows\System\WLbJMzY.exe
  C:\Windows\System\WLbJMzY.exe
  2⤵
  PID:5944
- C:\Windows\System\jzCKizZ.exe
  C:\Windows\System\jzCKizZ.exe
  2⤵
  PID:6012
- C:\Windows\System\TYyFmBW.exe
  C:\Windows\System\TYyFmBW.exe
  2⤵
  PID:6036
- C:\Windows\System\YKWksrx.exe
  C:\Windows\System\YKWksrx.exe
  2⤵
  PID:6068
- C:\Windows\System\sMCNPKr.exe
  C:\Windows\System\sMCNPKr.exe
  2⤵
  PID:6112
- C:\Windows\System\XWxiMXr.exe
  C:\Windows\System\XWxiMXr.exe
  2⤵
  PID:5644
- C:\Windows\System\IGHzgKG.exe
  C:\Windows\System\IGHzgKG.exe
  2⤵
  PID:5284
- C:\Windows\System\PktckYZ.exe
  C:\Windows\System\PktckYZ.exe
  2⤵
  PID:5564
- C:\Windows\System\yizJRFV.exe
  C:\Windows\System\yizJRFV.exe
  2⤵
  PID:5460
- C:\Windows\System\WAXcUty.exe
  C:\Windows\System\WAXcUty.exe
  2⤵
  PID:5900
- C:\Windows\System\RIrvNuN.exe
  C:\Windows\System\RIrvNuN.exe
  2⤵
  PID:5920
- C:\Windows\System\egjAfWZ.exe
  C:\Windows\System\egjAfWZ.exe
  2⤵
  PID:5140
- C:\Windows\System\rMqwoBv.exe
  C:\Windows\System\rMqwoBv.exe
  2⤵
  PID:6168
- C:\Windows\System\eiYDSRM.exe
  C:\Windows\System\eiYDSRM.exe
  2⤵
  PID:6192
- C:\Windows\System\PnTzTig.exe
  C:\Windows\System\PnTzTig.exe
  2⤵
  PID:6220
- C:\Windows\System\lqTysbH.exe
  C:\Windows\System\lqTysbH.exe
  2⤵
  PID:6240
- C:\Windows\System\afxUAxQ.exe
  C:\Windows\System\afxUAxQ.exe
  2⤵
  PID:6276
- C:\Windows\System\NuqjCWs.exe
  C:\Windows\System\NuqjCWs.exe
  2⤵
  PID:6304
- C:\Windows\System\bGjVUiz.exe
  C:\Windows\System\bGjVUiz.exe
  2⤵
  PID:6336
- C:\Windows\System\YCbfrrj.exe
  C:\Windows\System\YCbfrrj.exe
  2⤵
  PID:6364
- C:\Windows\System\AYQIpbG.exe
  C:\Windows\System\AYQIpbG.exe
  2⤵
  PID:6392
- C:\Windows\System\pkoTfRg.exe
  C:\Windows\System\pkoTfRg.exe
  2⤵
  PID:6412
- C:\Windows\System\vuKFyHv.exe
  C:\Windows\System\vuKFyHv.exe
  2⤵
  PID:6436
- C:\Windows\System\TcedLAF.exe
  C:\Windows\System\TcedLAF.exe
  2⤵
  PID:6468
- C:\Windows\System\EwRarGC.exe
  C:\Windows\System\EwRarGC.exe
  2⤵
  PID:6500
- C:\Windows\System\UMeHuVB.exe
  C:\Windows\System\UMeHuVB.exe
  2⤵
  PID:6532
- C:\Windows\System\eKPZmDl.exe
  C:\Windows\System\eKPZmDl.exe
  2⤵
  PID:6556
- C:\Windows\System\qznFbpQ.exe
  C:\Windows\System\qznFbpQ.exe
  2⤵
  PID:6572
- C:\Windows\System\SysOOpi.exe
  C:\Windows\System\SysOOpi.exe
  2⤵
  PID:6600
- C:\Windows\System\XSpxwhS.exe
  C:\Windows\System\XSpxwhS.exe
  2⤵
  PID:6632
- C:\Windows\System\TvVbvFK.exe
  C:\Windows\System\TvVbvFK.exe
  2⤵
  PID:6656
- C:\Windows\System\IzvBlLX.exe
  C:\Windows\System\IzvBlLX.exe
  2⤵
  PID:6680
- C:\Windows\System\DmozyNE.exe
  C:\Windows\System\DmozyNE.exe
  2⤵
  PID:6704
- C:\Windows\System\ntjBdGY.exe
  C:\Windows\System\ntjBdGY.exe
  2⤵
  PID:6736
- C:\Windows\System\cELWZyg.exe
  C:\Windows\System\cELWZyg.exe
  2⤵
  PID:6764
- C:\Windows\System\EsgPcez.exe
  C:\Windows\System\EsgPcez.exe
  2⤵
  PID:6788
- C:\Windows\System\ZoMjNBy.exe
  C:\Windows\System\ZoMjNBy.exe
  2⤵
  PID:6820
- C:\Windows\System\aLrnOLU.exe
  C:\Windows\System\aLrnOLU.exe
  2⤵
  PID:6840
- C:\Windows\System\vTrwBLG.exe
  C:\Windows\System\vTrwBLG.exe
  2⤵
  PID:6864
- C:\Windows\System\ebyYibf.exe
  C:\Windows\System\ebyYibf.exe
  2⤵
  PID:6896
- C:\Windows\System\dXbawjT.exe
  C:\Windows\System\dXbawjT.exe
  2⤵
  PID:6924
- C:\Windows\System\HrIvWok.exe
  C:\Windows\System\HrIvWok.exe
  2⤵
  PID:6944
- C:\Windows\System\YyLtVAb.exe
  C:\Windows\System\YyLtVAb.exe
  2⤵
  PID:6976
- C:\Windows\System\IGVfGdx.exe
  C:\Windows\System\IGVfGdx.exe
  2⤵
  PID:6996
- C:\Windows\System\VspGgMa.exe
  C:\Windows\System\VspGgMa.exe
  2⤵
  PID:7032
- C:\Windows\System\CLLgZWj.exe
  C:\Windows\System\CLLgZWj.exe
  2⤵
  PID:7060
- C:\Windows\System\hcmXQzR.exe
  C:\Windows\System\hcmXQzR.exe
  2⤵
  PID:7080
- C:\Windows\System\zfAcqOL.exe
  C:\Windows\System\zfAcqOL.exe
  2⤵
  PID:7096
- C:\Windows\System\eNjCoyu.exe
  C:\Windows\System\eNjCoyu.exe
  2⤵
  PID:7120
- C:\Windows\System\aFcdeoR.exe
  C:\Windows\System\aFcdeoR.exe
  2⤵
  PID:7136
- C:\Windows\System\szRDivD.exe
  C:\Windows\System\szRDivD.exe
  2⤵
  PID:5612
- C:\Windows\System\jXWIAQw.exe
  C:\Windows\System\jXWIAQw.exe
  2⤵
  PID:6096
- C:\Windows\System\aaicZqs.exe
  C:\Windows\System\aaicZqs.exe
  2⤵
  PID:5376
- C:\Windows\System\eBWsycv.exe
  C:\Windows\System\eBWsycv.exe
  2⤵
  PID:6216
- C:\Windows\System\VbTusvh.exe
  C:\Windows\System\VbTusvh.exe
  2⤵
  PID:6148
- C:\Windows\System\qjXiwyO.exe
  C:\Windows\System\qjXiwyO.exe
  2⤵
  PID:6212
- C:\Windows\System\JePxUnp.exe
  C:\Windows\System\JePxUnp.exe
  2⤵
  PID:6408
- C:\Windows\System\Zxbakjg.exe
  C:\Windows\System\Zxbakjg.exe
  2⤵
  PID:6352
- C:\Windows\System\LKSOQgb.exe
  C:\Windows\System\LKSOQgb.exe
  2⤵
  PID:6516
- C:\Windows\System\RBRnLFW.exe
  C:\Windows\System\RBRnLFW.exe
  2⤵
  PID:6424
- C:\Windows\System\XMatiZd.exe
  C:\Windows\System\XMatiZd.exe
  2⤵
  PID:6672
- C:\Windows\System\TLZXuww.exe
  C:\Windows\System\TLZXuww.exe
  2⤵
  PID:6692
- C:\Windows\System\IoKsSHm.exe
  C:\Windows\System\IoKsSHm.exe
  2⤵
  PID:6584
- C:\Windows\System\qQBfiki.exe
  C:\Windows\System\qQBfiki.exe
  2⤵
  PID:6776
- C:\Windows\System\QzthTsq.exe
  C:\Windows\System\QzthTsq.exe
  2⤵
  PID:6608
- C:\Windows\System\cPIIBFx.exe
  C:\Windows\System\cPIIBFx.exe
  2⤵
  PID:6676
- C:\Windows\System\COqungz.exe
  C:\Windows\System\COqungz.exe
  2⤵
  PID:6984
- C:\Windows\System\fOjwpOU.exe
  C:\Windows\System\fOjwpOU.exe
  2⤵
  PID:6748
- C:\Windows\System\ALqbMcg.exe
  C:\Windows\System\ALqbMcg.exe
  2⤵
  PID:7068
- C:\Windows\System\tAsYyjX.exe
  C:\Windows\System\tAsYyjX.exe
  2⤵
  PID:7128
- C:\Windows\System\JerJegw.exe
  C:\Windows\System\JerJegw.exe
  2⤵
  PID:6884
- C:\Windows\System\RBwcUaz.exe
  C:\Windows\System\RBwcUaz.exe
  2⤵
  PID:6232
- C:\Windows\System\nZAmanK.exe
  C:\Windows\System\nZAmanK.exe
  2⤵
  PID:6324
- C:\Windows\System\xswdnZD.exe
  C:\Windows\System\xswdnZD.exe
  2⤵
  PID:6328
- C:\Windows\System\gEypeWr.exe
  C:\Windows\System\gEypeWr.exe
  2⤵
  PID:5216
- C:\Windows\System\pRRFXxK.exe
  C:\Windows\System\pRRFXxK.exe
  2⤵
  PID:6724
- C:\Windows\System\YPYExyn.exe
  C:\Windows\System\YPYExyn.exe
  2⤵
  PID:6184
- C:\Windows\System\VSkWFtT.exe
  C:\Windows\System\VSkWFtT.exe
  2⤵
  PID:6596
- C:\Windows\System\iBmreHZ.exe
  C:\Windows\System\iBmreHZ.exe
  2⤵
  PID:7172
- C:\Windows\System\uAdjLVV.exe
  C:\Windows\System\uAdjLVV.exe
  2⤵
  PID:7200
- C:\Windows\System\gdhWdNO.exe
  C:\Windows\System\gdhWdNO.exe
  2⤵
  PID:7228
- C:\Windows\System\uwUoMXu.exe
  C:\Windows\System\uwUoMXu.exe
  2⤵
  PID:7256
- C:\Windows\System\LIWXpqS.exe
  C:\Windows\System\LIWXpqS.exe
  2⤵
  PID:7276
- C:\Windows\System\jiFMmDS.exe
  C:\Windows\System\jiFMmDS.exe
  2⤵
  PID:7304
- C:\Windows\System\FBseHwC.exe
  C:\Windows\System\FBseHwC.exe
  2⤵
  PID:7324
- C:\Windows\System\hwIsKIQ.exe
  C:\Windows\System\hwIsKIQ.exe
  2⤵
  PID:7348
- C:\Windows\System\qdvBVBk.exe
  C:\Windows\System\qdvBVBk.exe
  2⤵
  PID:7376
- C:\Windows\System\OYJuzCK.exe
  C:\Windows\System\OYJuzCK.exe
  2⤵
  PID:7396
- C:\Windows\System\kASKZSj.exe
  C:\Windows\System\kASKZSj.exe
  2⤵
  PID:7420
- C:\Windows\System\igdurCO.exe
  C:\Windows\System\igdurCO.exe
  2⤵
  PID:7452
- C:\Windows\System\ggPCgca.exe
  C:\Windows\System\ggPCgca.exe
  2⤵
  PID:7480
- C:\Windows\System\iNodWFC.exe
  C:\Windows\System\iNodWFC.exe
  2⤵
  PID:7504
- C:\Windows\System\gbJdnNQ.exe
  C:\Windows\System\gbJdnNQ.exe
  2⤵
  PID:7532
- C:\Windows\System\IXtuDLD.exe
  C:\Windows\System\IXtuDLD.exe
  2⤵
  PID:7556
- C:\Windows\System\WuClgDw.exe
  C:\Windows\System\WuClgDw.exe
  2⤵
  PID:7576
- C:\Windows\System\QmdsIfc.exe
  C:\Windows\System\QmdsIfc.exe
  2⤵
  PID:7604
- C:\Windows\System\mfIHTKs.exe
  C:\Windows\System\mfIHTKs.exe
  2⤵
  PID:7628
- C:\Windows\System\jDKjsjh.exe
  C:\Windows\System\jDKjsjh.exe
  2⤵
  PID:7656
- C:\Windows\System\goToAUj.exe
  C:\Windows\System\goToAUj.exe
  2⤵
  PID:7688
- C:\Windows\System\tjfJzKg.exe
  C:\Windows\System\tjfJzKg.exe
  2⤵
  PID:7704
- C:\Windows\System\qqCTVES.exe
  C:\Windows\System\qqCTVES.exe
  2⤵
  PID:7732
- C:\Windows\System\QHzaJvC.exe
  C:\Windows\System\QHzaJvC.exe
  2⤵
  PID:7768
- C:\Windows\System\QNjGvbU.exe
  C:\Windows\System\QNjGvbU.exe
  2⤵
  PID:7796
- C:\Windows\System\opapoIw.exe
  C:\Windows\System\opapoIw.exe
  2⤵
  PID:7820
- C:\Windows\System\JeiJxuR.exe
  C:\Windows\System\JeiJxuR.exe
  2⤵
  PID:7844
- C:\Windows\System\jqPHbwc.exe
  C:\Windows\System\jqPHbwc.exe
  2⤵
  PID:7872
- C:\Windows\System\iPRPeJI.exe
  C:\Windows\System\iPRPeJI.exe
  2⤵
  PID:7896
- C:\Windows\System\GAapWqP.exe
  C:\Windows\System\GAapWqP.exe
  2⤵
  PID:7924
- C:\Windows\System\ZhAJTDP.exe
  C:\Windows\System\ZhAJTDP.exe
  2⤵
  PID:7944
- C:\Windows\System\QnGqYUe.exe
  C:\Windows\System\QnGqYUe.exe
  2⤵
  PID:7968
- C:\Windows\System\uhPBeMK.exe
  C:\Windows\System\uhPBeMK.exe
  2⤵
  PID:7996
- C:\Windows\System\mKlnEhq.exe
  C:\Windows\System\mKlnEhq.exe
  2⤵
  PID:8016
- C:\Windows\System\ENYBXdq.exe
  C:\Windows\System\ENYBXdq.exe
  2⤵
  PID:8044
- C:\Windows\System\KMahIPM.exe
  C:\Windows\System\KMahIPM.exe
  2⤵
  PID:8068
- C:\Windows\System\VfQiFar.exe
  C:\Windows\System\VfQiFar.exe
  2⤵
  PID:8096
- C:\Windows\System\EHnLqoO.exe
  C:\Windows\System\EHnLqoO.exe
  2⤵
  PID:8120
- C:\Windows\System\dmkctQa.exe
  C:\Windows\System\dmkctQa.exe
  2⤵
  PID:8152
- C:\Windows\System\vYzmLpF.exe
  C:\Windows\System\vYzmLpF.exe
  2⤵
  PID:8180
- C:\Windows\System\Ysplwrb.exe
  C:\Windows\System\Ysplwrb.exe
  2⤵
  PID:6260
- C:\Windows\System\tmPAGAV.exe
  C:\Windows\System\tmPAGAV.exe
  2⤵
  PID:6816
- C:\Windows\System\rqHQNlK.exe
  C:\Windows\System\rqHQNlK.exe
  2⤵
  PID:7104
- C:\Windows\System\xIYzkco.exe
  C:\Windows\System\xIYzkco.exe
  2⤵
  PID:6512
- C:\Windows\System\YctSVDk.exe
  C:\Windows\System\YctSVDk.exe
  2⤵
  PID:7220
- C:\Windows\System\kYKbSwZ.exe
  C:\Windows\System\kYKbSwZ.exe
  2⤵
  PID:7264
- C:\Windows\System\YiTXbCQ.exe
  C:\Windows\System\YiTXbCQ.exe
  2⤵
  PID:7340
- C:\Windows\System\XgJTNnJ.exe
  C:\Windows\System\XgJTNnJ.exe
  2⤵
  PID:7412
- C:\Windows\System\QttEydA.exe
  C:\Windows\System\QttEydA.exe
  2⤵
  PID:7192
- C:\Windows\System\sDrwpor.exe
  C:\Windows\System\sDrwpor.exe
  2⤵
  PID:7528
- C:\Windows\System\Eripdrw.exe
  C:\Windows\System\Eripdrw.exe
  2⤵
  PID:7564
- C:\Windows\System\vyjeEQU.exe
  C:\Windows\System\vyjeEQU.exe
  2⤵
  PID:7624
- C:\Windows\System\CFnprBU.exe
  C:\Windows\System\CFnprBU.exe
  2⤵
  PID:7740
- C:\Windows\System\JcUPveB.exe
  C:\Windows\System\JcUPveB.exe
  2⤵
  PID:7784
- C:\Windows\System\zMHtjDn.exe
  C:\Windows\System\zMHtjDn.exe
  2⤵
  PID:7272
- C:\Windows\System\PukQfiD.exe
  C:\Windows\System\PukQfiD.exe
  2⤵
  PID:7360
- C:\Windows\System\JdLztZr.exe
  C:\Windows\System\JdLztZr.exe
  2⤵
  PID:7408
- C:\Windows\System\ExCZjqm.exe
  C:\Windows\System\ExCZjqm.exe
  2⤵
  PID:7720
- C:\Windows\System\mcyouMT.exe
  C:\Windows\System\mcyouMT.exe
  2⤵
  PID:7464
- C:\Windows\System\WSJqzpq.exe
  C:\Windows\System\WSJqzpq.exe
  2⤵
  PID:8140
- C:\Windows\System\VxfhCNw.exe
  C:\Windows\System\VxfhCNw.exe
  2⤵
  PID:8196
- C:\Windows\System\bYCOYoA.exe
  C:\Windows\System\bYCOYoA.exe
  2⤵
  PID:8216
- C:\Windows\System\QZLPAUe.exe
  C:\Windows\System\QZLPAUe.exe
  2⤵
  PID:8244
- C:\Windows\System\BDZukIN.exe
  C:\Windows\System\BDZukIN.exe
  2⤵
  PID:8264
- C:\Windows\System\sNGkihB.exe
  C:\Windows\System\sNGkihB.exe
  2⤵
  PID:8284
- C:\Windows\System\krhtpRA.exe
  C:\Windows\System\krhtpRA.exe
  2⤵
  PID:8316
- C:\Windows\System\jXzWNnM.exe
  C:\Windows\System\jXzWNnM.exe
  2⤵
  PID:8336
- C:\Windows\System\zoCUfgG.exe
  C:\Windows\System\zoCUfgG.exe
  2⤵
  PID:8360
- C:\Windows\System\AnnXNwo.exe
  C:\Windows\System\AnnXNwo.exe
  2⤵
  PID:8388
- C:\Windows\System\JpUFGEk.exe
  C:\Windows\System\JpUFGEk.exe
  2⤵
  PID:8404
- C:\Windows\System\qZcAyPY.exe
  C:\Windows\System\qZcAyPY.exe
  2⤵
  PID:8424
- C:\Windows\System\TMyDdps.exe
  C:\Windows\System\TMyDdps.exe
  2⤵
  PID:8448
- C:\Windows\System\xQUTlqb.exe
  C:\Windows\System\xQUTlqb.exe
  2⤵
  PID:8468
- C:\Windows\System\WFFptbT.exe
  C:\Windows\System\WFFptbT.exe
  2⤵
  PID:8492
- C:\Windows\System\oYVbSQj.exe
  C:\Windows\System\oYVbSQj.exe
  2⤵
  PID:8524
- C:\Windows\System\PPEtKva.exe
  C:\Windows\System\PPEtKva.exe
  2⤵
  PID:8628
- C:\Windows\System\TGsFEIS.exe
  C:\Windows\System\TGsFEIS.exe
  2⤵
  PID:8652
- C:\Windows\System\MqstLSK.exe
  C:\Windows\System\MqstLSK.exe
  2⤵
  PID:8672
- C:\Windows\System\ZzfTRxw.exe
  C:\Windows\System\ZzfTRxw.exe
  2⤵
  PID:8708
- C:\Windows\System\fhfdScp.exe
  C:\Windows\System\fhfdScp.exe
  2⤵
  PID:8736
- C:\Windows\System\gfnTbiB.exe
  C:\Windows\System\gfnTbiB.exe
  2⤵
  PID:8764
- C:\Windows\System\QmqEbQu.exe
  C:\Windows\System\QmqEbQu.exe
  2⤵
  PID:8796
- C:\Windows\System\SViADIQ.exe
  C:\Windows\System\SViADIQ.exe
  2⤵
  PID:8828
- C:\Windows\System\mPoYIgx.exe
  C:\Windows\System\mPoYIgx.exe
  2⤵
  PID:8848
- C:\Windows\System\cFlXqla.exe
  C:\Windows\System\cFlXqla.exe
  2⤵
  PID:8872
- C:\Windows\System\JRBycmQ.exe
  C:\Windows\System\JRBycmQ.exe
  2⤵
  PID:8904
- C:\Windows\System\rbwbGrU.exe
  C:\Windows\System\rbwbGrU.exe
  2⤵
  PID:8928
- C:\Windows\System\DEwqgQp.exe
  C:\Windows\System\DEwqgQp.exe
  2⤵
  PID:8952
- C:\Windows\System\zBvXjzw.exe
  C:\Windows\System\zBvXjzw.exe
  2⤵
  PID:8976
- C:\Windows\System\EEIvQQl.exe
  C:\Windows\System\EEIvQQl.exe
  2⤵
  PID:9000
- C:\Windows\System\uxIXZVq.exe
  C:\Windows\System\uxIXZVq.exe
  2⤵
  PID:9028
- C:\Windows\System\FrjFqhN.exe
  C:\Windows\System\FrjFqhN.exe
  2⤵
  PID:9060
- C:\Windows\System\FIxOxZO.exe
  C:\Windows\System\FIxOxZO.exe
  2⤵
  PID:7496
- C:\Windows\System\wtsFETr.exe
  C:\Windows\System\wtsFETr.exe
  2⤵
  PID:7600
- C:\Windows\System\NsCkCoj.exe
  C:\Windows\System\NsCkCoj.exe
  2⤵
  PID:7808
- C:\Windows\System\fkmxBsI.exe
  C:\Windows\System\fkmxBsI.exe
  2⤵
  PID:7892
- C:\Windows\System\lhpLxeU.exe
  C:\Windows\System\lhpLxeU.exe
  2⤵
  PID:7964
- C:\Windows\System\DAsUlCw.exe
  C:\Windows\System\DAsUlCw.exe
  2⤵
  PID:8464
- C:\Windows\System\ruPuUDC.exe
  C:\Windows\System\ruPuUDC.exe
  2⤵
  PID:7700
- C:\Windows\System\eaMxvmF.exe
  C:\Windows\System\eaMxvmF.exe
  2⤵
  PID:8344
- C:\Windows\System\isCTSfg.exe
  C:\Windows\System\isCTSfg.exe
  2⤵
  PID:8172
- C:\Windows\System\kxQqlNb.exe
  C:\Windows\System\kxQqlNb.exe
  2⤵
  PID:8260
- C:\Windows\System\wWLkSrv.exe
  C:\Windows\System\wWLkSrv.exe
  2⤵
  PID:7024
- C:\Windows\System\tOKGIKj.exe
  C:\Windows\System\tOKGIKj.exe
  2⤵
  PID:7760
- C:\Windows\System\ygKEFDv.exe
  C:\Windows\System\ygKEFDv.exe
  2⤵
  PID:8512
- C:\Windows\System\ORlsGok.exe
  C:\Windows\System\ORlsGok.exe
  2⤵
  PID:8744
- C:\Windows\System\LHmsSZW.exe
  C:\Windows\System\LHmsSZW.exe
  2⤵
  PID:8224
- C:\Windows\System\zGishGW.exe
  C:\Windows\System\zGishGW.exe
  2⤵
  PID:8788
- C:\Windows\System\ZXpzxYo.exe
  C:\Windows\System\ZXpzxYo.exe
  2⤵
  PID:8812
- C:\Windows\System\iemWnIK.exe
  C:\Windows\System\iemWnIK.exe
  2⤵
  PID:8868
- C:\Windows\System\tvpdupB.exe
  C:\Windows\System\tvpdupB.exe
  2⤵
  PID:8920
- C:\Windows\System\cemUEdT.exe
  C:\Windows\System\cemUEdT.exe
  2⤵
  PID:8972
- C:\Windows\System\gadYPUL.exe
  C:\Windows\System\gadYPUL.exe
  2⤵
  PID:9012
- C:\Windows\System\ffyHDnB.exe
  C:\Windows\System\ffyHDnB.exe
  2⤵
  PID:8484
- C:\Windows\System\AHIEzlq.exe
  C:\Windows\System\AHIEzlq.exe
  2⤵
  PID:8648
- C:\Windows\System\aTWGZQx.exe
  C:\Windows\System\aTWGZQx.exe
  2⤵
  PID:7912
- C:\Windows\System\PAqRrll.exe
  C:\Windows\System\PAqRrll.exe
  2⤵
  PID:8616
- C:\Windows\System\jFweCqn.exe
  C:\Windows\System\jFweCqn.exe
  2⤵
  PID:6384
- C:\Windows\System\loPzSnw.exe
  C:\Windows\System\loPzSnw.exe
  2⤵
  PID:6876
- C:\Windows\System\nZDRgvL.exe
  C:\Windows\System\nZDRgvL.exe
  2⤵
  PID:9068
- C:\Windows\System\ALHcBYY.exe
  C:\Windows\System\ALHcBYY.exe
  2⤵
  PID:9196
- C:\Windows\System\QjFRpNB.exe
  C:\Windows\System\QjFRpNB.exe
  2⤵
  PID:6892
- C:\Windows\System\lMHxSEd.exe
  C:\Windows\System\lMHxSEd.exe
  2⤵
  PID:9220
- C:\Windows\System\OuDPRiW.exe
  C:\Windows\System\OuDPRiW.exe
  2⤵
  PID:9240
- C:\Windows\System\CLqHlFS.exe
  C:\Windows\System\CLqHlFS.exe
  2⤵
  PID:9280
- C:\Windows\System\wGQCuXR.exe
  C:\Windows\System\wGQCuXR.exe
  2⤵
  PID:9296
- C:\Windows\System\XCJyMiv.exe
  C:\Windows\System\XCJyMiv.exe
  2⤵
  PID:9316
- C:\Windows\System\LIhkZCo.exe
  C:\Windows\System\LIhkZCo.exe
  2⤵
  PID:9336
- C:\Windows\System\dcBnwLz.exe
  C:\Windows\System\dcBnwLz.exe
  2⤵
  PID:9360
- C:\Windows\System\gifcKIH.exe
  C:\Windows\System\gifcKIH.exe
  2⤵
  PID:9384
- C:\Windows\System\Smfcgsu.exe
  C:\Windows\System\Smfcgsu.exe
  2⤵
  PID:9408
- C:\Windows\System\GAkoaZR.exe
  C:\Windows\System\GAkoaZR.exe
  2⤵
  PID:9432
- C:\Windows\System\DyCNMUr.exe
  C:\Windows\System\DyCNMUr.exe
  2⤵
  PID:9452
- C:\Windows\System\TzTqfZz.exe
  C:\Windows\System\TzTqfZz.exe
  2⤵
  PID:9480
- C:\Windows\System\aUgumBk.exe
  C:\Windows\System\aUgumBk.exe
  2⤵
  PID:9504
- C:\Windows\System\WhnEHYh.exe
  C:\Windows\System\WhnEHYh.exe
  2⤵
  PID:9532
- C:\Windows\System\XZiaepL.exe
  C:\Windows\System\XZiaepL.exe
  2⤵
  PID:9548
- C:\Windows\System\ECkBvjI.exe
  C:\Windows\System\ECkBvjI.exe
  2⤵
  PID:9736
- C:\Windows\System\ytyueuf.exe
  C:\Windows\System\ytyueuf.exe
  2⤵
  PID:9760
- C:\Windows\System\LUcDutz.exe
  C:\Windows\System\LUcDutz.exe
  2⤵
  PID:9788
- C:\Windows\System\yFHRkXT.exe
  C:\Windows\System\yFHRkXT.exe
  2⤵
  PID:9836
- C:\Windows\System\WSRcYEt.exe
  C:\Windows\System\WSRcYEt.exe
  2⤵
  PID:9856
- C:\Windows\System\dJAxdGT.exe
  C:\Windows\System\dJAxdGT.exe
  2⤵
  PID:9892
- C:\Windows\System\njsRYPz.exe
  C:\Windows\System\njsRYPz.exe
  2⤵
  PID:9928
- C:\Windows\System\RChEGNX.exe
  C:\Windows\System\RChEGNX.exe
  2⤵
  PID:9944
- C:\Windows\System\GyQeRNc.exe
  C:\Windows\System\GyQeRNc.exe
  2⤵
  PID:9968
- C:\Windows\System\bwVfeOY.exe
  C:\Windows\System\bwVfeOY.exe
  2⤵
  PID:9988
- C:\Windows\System\kibRWWj.exe
  C:\Windows\System\kibRWWj.exe
  2⤵
  PID:10028
- C:\Windows\System\GWycjwZ.exe
  C:\Windows\System\GWycjwZ.exe
  2⤵
  PID:10044
- C:\Windows\System\cVkCRGG.exe
  C:\Windows\System\cVkCRGG.exe
  2⤵
  PID:10076
- C:\Windows\System\eGrHEPE.exe
  C:\Windows\System\eGrHEPE.exe
  2⤵
  PID:10096
- C:\Windows\System\vlYcSFv.exe
  C:\Windows\System\vlYcSFv.exe
  2⤵
  PID:10124
- C:\Windows\System\qLPZnkj.exe
  C:\Windows\System\qLPZnkj.exe
  2⤵
  PID:10140
- C:\Windows\System\EwlToeD.exe
  C:\Windows\System\EwlToeD.exe
  2⤵
  PID:10164
- C:\Windows\System\wykedqH.exe
  C:\Windows\System\wykedqH.exe
  2⤵
  PID:10192
- C:\Windows\System\nLWAKeB.exe
  C:\Windows\System\nLWAKeB.exe
  2⤵
  PID:10216
- C:\Windows\System\VqmOQHI.exe
  C:\Windows\System\VqmOQHI.exe
  2⤵
  PID:10232
- C:\Windows\System\hwmSOBl.exe
  C:\Windows\System\hwmSOBl.exe
  2⤵
  PID:8960
- C:\Windows\System\EWFHjYN.exe
  C:\Windows\System\EWFHjYN.exe
  2⤵
  PID:8112
- C:\Windows\System\fyhSmbr.exe
  C:\Windows\System\fyhSmbr.exe
  2⤵
  PID:6644
- C:\Windows\System\YvXMNoh.exe
  C:\Windows\System\YvXMNoh.exe
  2⤵
  PID:8256
- C:\Windows\System\RglOyfb.exe
  C:\Windows\System\RglOyfb.exe
  2⤵
  PID:7864
- C:\Windows\System\sXQddPe.exe
  C:\Windows\System\sXQddPe.exe
  2⤵
  PID:7092
- C:\Windows\System\FGmxsOB.exe
  C:\Windows\System\FGmxsOB.exe
  2⤵
  PID:8860
- C:\Windows\System\pZmNfbF.exe
  C:\Windows\System\pZmNfbF.exe
  2⤵
  PID:9264
- C:\Windows\System\fKRlpTF.exe
  C:\Windows\System\fKRlpTF.exe
  2⤵
  PID:9152
- C:\Windows\System\pAhvJGi.exe
  C:\Windows\System\pAhvJGi.exe
  2⤵
  PID:8844
- C:\Windows\System\FGPvzZa.exe
  C:\Windows\System\FGPvzZa.exe
  2⤵
  PID:7728
- C:\Windows\System\fmbqTgx.exe
  C:\Windows\System\fmbqTgx.exe
  2⤵
  PID:9592
- C:\Windows\System\MZtRmfP.exe
  C:\Windows\System\MZtRmfP.exe
  2⤵
  PID:9352
- C:\Windows\System\zcOpOAf.exe
  C:\Windows\System\zcOpOAf.exe
  2⤵
  PID:9396
- C:\Windows\System\heXokEb.exe
  C:\Windows\System\heXokEb.exe
  2⤵
  PID:9516
- C:\Windows\System\DSDqRkF.exe
  C:\Windows\System\DSDqRkF.exe
  2⤵
  PID:9544
- C:\Windows\System\sDvulUu.exe
  C:\Windows\System\sDvulUu.exe
  2⤵
  PID:9804
- C:\Windows\System\AbqqyAx.exe
  C:\Windows\System\AbqqyAx.exe
  2⤵
  PID:9880
- C:\Windows\System\WFRkRqk.exe
  C:\Windows\System\WFRkRqk.exe
  2⤵
  PID:5948
- C:\Windows\System\KFYEFkZ.exe
  C:\Windows\System\KFYEFkZ.exe
  2⤵
  PID:10200
- C:\Windows\System\UMwMABb.exe
  C:\Windows\System\UMwMABb.exe
  2⤵
  PID:10040
- C:\Windows\System\mxFUbSM.exe
  C:\Windows\System\mxFUbSM.exe
  2⤵
  PID:9904
- C:\Windows\System\gIdHvYM.exe
  C:\Windows\System\gIdHvYM.exe
  2⤵
  PID:9292
- C:\Windows\System\drMzeHq.exe
  C:\Windows\System\drMzeHq.exe
  2⤵
  PID:9956
- C:\Windows\System\gQpYOnA.exe
  C:\Windows\System\gQpYOnA.exe
  2⤵
  PID:9752
- C:\Windows\System\iHngPgg.exe
  C:\Windows\System\iHngPgg.exe
  2⤵
  PID:8696
- C:\Windows\System\LEEgrGk.exe
  C:\Windows\System\LEEgrGk.exe
  2⤵
  PID:8292
- C:\Windows\System\WvgJyTY.exe
  C:\Windows\System\WvgJyTY.exe
  2⤵
  PID:10016
- C:\Windows\System\hlvheeR.exe
  C:\Windows\System\hlvheeR.exe
  2⤵
  PID:10272
- C:\Windows\System\mxiHtOG.exe
  C:\Windows\System\mxiHtOG.exe
  2⤵
  PID:10292
- C:\Windows\System\FGdfTAd.exe
  C:\Windows\System\FGdfTAd.exe
  2⤵
  PID:10324
- C:\Windows\System\hSLLTlw.exe
  C:\Windows\System\hSLLTlw.exe
  2⤵
  PID:10348
- C:\Windows\System\lbWvprk.exe
  C:\Windows\System\lbWvprk.exe
  2⤵
  PID:10376
- C:\Windows\System\KJQwBuu.exe
  C:\Windows\System\KJQwBuu.exe
  2⤵
  PID:10408
- C:\Windows\System\VGrotma.exe
  C:\Windows\System\VGrotma.exe
  2⤵
  PID:10428
- C:\Windows\System\mmJfmSP.exe
  C:\Windows\System\mmJfmSP.exe
  2⤵
  PID:10460
- C:\Windows\System\warNiKm.exe
  C:\Windows\System\warNiKm.exe
  2⤵
  PID:10484
- C:\Windows\System\zpKoLHB.exe
  C:\Windows\System\zpKoLHB.exe
  2⤵
  PID:10516
- C:\Windows\System\BaWHYQN.exe
  C:\Windows\System\BaWHYQN.exe
  2⤵
  PID:10544
- C:\Windows\System\imfojvO.exe
  C:\Windows\System\imfojvO.exe
  2⤵
  PID:10568
- C:\Windows\System\PfKemfZ.exe
  C:\Windows\System\PfKemfZ.exe
  2⤵
  PID:10588
- C:\Windows\System\xFhfPZq.exe
  C:\Windows\System\xFhfPZq.exe
  2⤵
  PID:10616
- C:\Windows\System\enxqoTp.exe
  C:\Windows\System\enxqoTp.exe
  2⤵
  PID:10644
- C:\Windows\System\UlbsJcz.exe
  C:\Windows\System\UlbsJcz.exe
  2⤵
  PID:10668
- C:\Windows\System\ecyLZxJ.exe
  C:\Windows\System\ecyLZxJ.exe
  2⤵
  PID:10700
- C:\Windows\System\hrZKyCU.exe
  C:\Windows\System\hrZKyCU.exe
  2⤵
  PID:10732
- C:\Windows\System\uYIiPYe.exe
  C:\Windows\System\uYIiPYe.exe
  2⤵
  PID:10752
- C:\Windows\System\nNNijkj.exe
  C:\Windows\System\nNNijkj.exe
  2⤵
  PID:10776
- C:\Windows\System\vUmTail.exe
  C:\Windows\System\vUmTail.exe
  2⤵
  PID:10800
- C:\Windows\System\IaaCRzv.exe
  C:\Windows\System\IaaCRzv.exe
  2⤵
  PID:10828
- C:\Windows\System\HimseNE.exe
  C:\Windows\System\HimseNE.exe
  2⤵
  PID:10848
- C:\Windows\System\BsfGvZw.exe
  C:\Windows\System\BsfGvZw.exe
  2⤵
  PID:10868
- C:\Windows\System\lbZiNsa.exe
  C:\Windows\System\lbZiNsa.exe
  2⤵
  PID:10884
- C:\Windows\System\BcbEEiZ.exe
  C:\Windows\System\BcbEEiZ.exe
  2⤵
  PID:10904
- C:\Windows\System\dgKRopP.exe
  C:\Windows\System\dgKRopP.exe
  2⤵
  PID:10928
- C:\Windows\System\FgkbTmw.exe
  C:\Windows\System\FgkbTmw.exe
  2⤵
  PID:10964
- C:\Windows\System\aEIHMzm.exe
  C:\Windows\System\aEIHMzm.exe
  2⤵
  PID:10984
- C:\Windows\System\FQdWfID.exe
  C:\Windows\System\FQdWfID.exe
  2⤵
  PID:11004
- C:\Windows\System\sTOYnIS.exe
  C:\Windows\System\sTOYnIS.exe
  2⤵
  PID:11028
- C:\Windows\System\oxoeFNf.exe
  C:\Windows\System\oxoeFNf.exe
  2⤵
  PID:11052
- C:\Windows\System\CEPsLnk.exe
  C:\Windows\System\CEPsLnk.exe
  2⤵
  PID:11076
- C:\Windows\System\TuabHpd.exe
  C:\Windows\System\TuabHpd.exe
  2⤵
  PID:11112
- C:\Windows\System\MKyuUMr.exe
  C:\Windows\System\MKyuUMr.exe
  2⤵
  PID:11140
- C:\Windows\System\OxjAekR.exe
  C:\Windows\System\OxjAekR.exe
  2⤵
  PID:11176
- C:\Windows\System\VGERaDd.exe
  C:\Windows\System\VGERaDd.exe
  2⤵
  PID:11192
- C:\Windows\System\SfDJgql.exe
  C:\Windows\System\SfDJgql.exe
  2⤵
  PID:11208
- C:\Windows\System\koaViUu.exe
  C:\Windows\System\koaViUu.exe
  2⤵
  PID:11236
- C:\Windows\System\CMEGOrp.exe
  C:\Windows\System\CMEGOrp.exe
  2⤵
  PID:11252
- C:\Windows\System\UogqBFa.exe
  C:\Windows\System\UogqBFa.exe
  2⤵
  PID:9332
- C:\Windows\System\dUMFBRG.exe
  C:\Windows\System\dUMFBRG.exe
  2⤵
  PID:9236
- C:\Windows\System\rtAgdne.exe
  C:\Windows\System\rtAgdne.exe
  2⤵
  PID:9328
- C:\Windows\System\OEoOLha.exe
  C:\Windows\System\OEoOLha.exe
  2⤵
  PID:9424
- C:\Windows\System\VJKniVW.exe
  C:\Windows\System\VJKniVW.exe
  2⤵
  PID:9584
- C:\Windows\System\iEYugKj.exe
  C:\Windows\System\iEYugKj.exe
  2⤵
  PID:8432
- C:\Windows\System\teHOimA.exe
  C:\Windows\System\teHOimA.exe
  2⤵
  PID:10088
- C:\Windows\System\kbVQitJ.exe
  C:\Windows\System\kbVQitJ.exe
  2⤵
  PID:10336
- C:\Windows\System\fFPkkEf.exe
  C:\Windows\System\fFPkkEf.exe
  2⤵
  PID:10344
- C:\Windows\System\hGAUZxX.exe
  C:\Windows\System\hGAUZxX.exe
  2⤵
  PID:9824
- C:\Windows\System\SuFMnbx.exe
  C:\Windows\System\SuFMnbx.exe
  2⤵
  PID:8504
- C:\Windows\System\fCovgnK.exe
  C:\Windows\System\fCovgnK.exe
  2⤵
  PID:10556
- C:\Windows\System\VXEkMwf.exe
  C:\Windows\System\VXEkMwf.exe
  2⤵
  PID:8276
- C:\Windows\System\jRcETsW.exe
  C:\Windows\System\jRcETsW.exe
  2⤵
  PID:10180
- C:\Windows\System\Wgfhuhy.exe
  C:\Windows\System\Wgfhuhy.exe
  2⤵
  PID:10500
- C:\Windows\System\kKUPUoM.exe
  C:\Windows\System\kKUPUoM.exe
  2⤵
  PID:10576
- C:\Windows\System\FJjTgOJ.exe
  C:\Windows\System\FJjTgOJ.exe
  2⤵
  PID:10916
- C:\Windows\System\RGUpPti.exe
  C:\Windows\System\RGUpPti.exe
  2⤵
  PID:10980
- C:\Windows\System\hWoDiVV.exe
  C:\Windows\System\hWoDiVV.exe
  2⤵
  PID:10740
- C:\Windows\System\hgrvfkH.exe
  C:\Windows\System\hgrvfkH.exe
  2⤵
  PID:10560
- C:\Windows\System\vePWwIQ.exe
  C:\Windows\System\vePWwIQ.exe
  2⤵
  PID:10836
- C:\Windows\System\rEIRtRN.exe
  C:\Windows\System\rEIRtRN.exe
  2⤵
  PID:11184
- C:\Windows\System\ldjENhk.exe
  C:\Windows\System\ldjENhk.exe
  2⤵
  PID:10208
- C:\Windows\System\XVAiMWx.exe
  C:\Windows\System\XVAiMWx.exe
  2⤵
  PID:10976
- C:\Windows\System\nnzMTSk.exe
  C:\Windows\System\nnzMTSk.exe
  2⤵
  PID:10108
- C:\Windows\System\MmbiXvI.exe
  C:\Windows\System\MmbiXvI.exe
  2⤵
  PID:10256
- C:\Windows\System\AITrLOW.exe
  C:\Windows\System\AITrLOW.exe
  2⤵
  PID:11292
- C:\Windows\System\FVugpfV.exe
  C:\Windows\System\FVugpfV.exe
  2⤵
  PID:11308
- C:\Windows\System\oeQCBAq.exe
  C:\Windows\System\oeQCBAq.exe
  2⤵
  PID:11340
- C:\Windows\System\DrLWQVP.exe
  C:\Windows\System\DrLWQVP.exe
  2⤵
  PID:11360
- C:\Windows\System\VMjVVtJ.exe
  C:\Windows\System\VMjVVtJ.exe
  2⤵
  PID:11376
- C:\Windows\System\lipBGdd.exe
  C:\Windows\System\lipBGdd.exe
  2⤵
  PID:11396
- C:\Windows\System\ueFUBiF.exe
  C:\Windows\System\ueFUBiF.exe
  2⤵
  PID:11420
- C:\Windows\System\KpWFgtv.exe
  C:\Windows\System\KpWFgtv.exe
  2⤵
  PID:11452
- C:\Windows\System\OmsmSbs.exe
  C:\Windows\System\OmsmSbs.exe
  2⤵
  PID:11472
- C:\Windows\System\HuihIxR.exe
  C:\Windows\System\HuihIxR.exe
  2⤵
  PID:11488
- C:\Windows\System\PlRuJmU.exe
  C:\Windows\System\PlRuJmU.exe
  2⤵
  PID:11512
- C:\Windows\System\XRdQBFu.exe
  C:\Windows\System\XRdQBFu.exe
  2⤵
  PID:11532
- C:\Windows\System\zZiGQge.exe
  C:\Windows\System\zZiGQge.exe
  2⤵
  PID:11560
- C:\Windows\System\wXdRIMY.exe
  C:\Windows\System\wXdRIMY.exe
  2⤵
  PID:11592
- C:\Windows\System\GvxHJln.exe
  C:\Windows\System\GvxHJln.exe
  2⤵
  PID:11624
- C:\Windows\System\RtrcEIY.exe
  C:\Windows\System\RtrcEIY.exe
  2⤵
  PID:11652
- C:\Windows\System\EfQDBHI.exe
  C:\Windows\System\EfQDBHI.exe
  2⤵
  PID:11688
- C:\Windows\System\VdJOWwE.exe
  C:\Windows\System\VdJOWwE.exe
  2⤵
  PID:11716
- C:\Windows\System\QZPumZo.exe
  C:\Windows\System\QZPumZo.exe
  2⤵
  PID:11748
- C:\Windows\System\ipwfHxC.exe
  C:\Windows\System\ipwfHxC.exe
  2⤵
  PID:11784
- C:\Windows\System\RGjDSmW.exe
  C:\Windows\System\RGjDSmW.exe
  2⤵
  PID:11816
- C:\Windows\System\wpVHNiy.exe
  C:\Windows\System\wpVHNiy.exe
  2⤵
  PID:11848
- C:\Windows\System\FxwHZqY.exe
  C:\Windows\System\FxwHZqY.exe
  2⤵
  PID:11884
- C:\Windows\System\xsnPtFF.exe
  C:\Windows\System\xsnPtFF.exe
  2⤵
  PID:11908
- C:\Windows\System\yslZHMp.exe
  C:\Windows\System\yslZHMp.exe
  2⤵
  PID:11936
- C:\Windows\System\FiRDKen.exe
  C:\Windows\System\FiRDKen.exe
  2⤵
  PID:12092
- C:\Windows\System\TRneQVA.exe
  C:\Windows\System\TRneQVA.exe
  2⤵
  PID:12116
- C:\Windows\System\vRIMINn.exe
  C:\Windows\System\vRIMINn.exe
  2⤵
  PID:12136
- C:\Windows\System\eRyBXto.exe
  C:\Windows\System\eRyBXto.exe
  2⤵
  PID:12152
- C:\Windows\System\EZxCAjS.exe
  C:\Windows\System\EZxCAjS.exe
  2⤵
  PID:12168
- C:\Windows\System\RFYLBqp.exe
  C:\Windows\System\RFYLBqp.exe
  2⤵
  PID:12184
- C:\Windows\System\nICdkkb.exe
  C:\Windows\System\nICdkkb.exe
  2⤵
  PID:12208
- C:\Windows\System\UbGcGmL.exe
  C:\Windows\System\UbGcGmL.exe
  2⤵
  PID:12224
- C:\Windows\System\BlVcbPr.exe
  C:\Windows\System\BlVcbPr.exe
  2⤵
  PID:12240
- C:\Windows\System\EaqBnqn.exe
  C:\Windows\System\EaqBnqn.exe
  2⤵
  PID:12256
- C:\Windows\System\DOCPTYX.exe
  C:\Windows\System\DOCPTYX.exe
  2⤵
  PID:12272
- C:\Windows\System\WztRJZF.exe
  C:\Windows\System\WztRJZF.exe
  2⤵
  PID:11096
- C:\Windows\System\fEiiMPa.exe
  C:\Windows\System\fEiiMPa.exe
  2⤵
  PID:11300
- C:\Windows\System\NBOcoLW.exe
  C:\Windows\System\NBOcoLW.exe
  2⤵
  PID:11384
- C:\Windows\System\gXNPQXX.exe
  C:\Windows\System\gXNPQXX.exe
  2⤵
  PID:11416
- C:\Windows\System\hveDwMe.exe
  C:\Windows\System\hveDwMe.exe
  2⤵
  PID:11460
- C:\Windows\System\vWEjmvb.exe
  C:\Windows\System\vWEjmvb.exe
  2⤵
  PID:8776
- C:\Windows\System\GvnlQMA.exe
  C:\Windows\System\GvnlQMA.exe
  2⤵
  PID:11744
- C:\Windows\System\asKUtiS.exe
  C:\Windows\System\asKUtiS.exe
  2⤵
  PID:11480
- C:\Windows\System\jeRDwbD.exe
  C:\Windows\System\jeRDwbD.exe
  2⤵
  PID:11556
- C:\Windows\System\vznlafX.exe
  C:\Windows\System\vznlafX.exe
  2⤵
  PID:11608
- C:\Windows\System\Tufxuoi.exe
  C:\Windows\System\Tufxuoi.exe
  2⤵
  PID:11164
- C:\Windows\System\vtNdDFk.exe
  C:\Windows\System\vtNdDFk.exe
  2⤵
  PID:11304
- C:\Windows\System\acjAAvS.exe
  C:\Windows\System\acjAAvS.exe
  2⤵
  PID:11832
- C:\Windows\System\rmjhRMb.exe
  C:\Windows\System\rmjhRMb.exe
  2⤵
  PID:11540
- C:\Windows\System\AFxzkNP.exe
  C:\Windows\System\AFxzkNP.exe
  2⤵
  PID:11676
- C:\Windows\System\BeGEFQK.exe
  C:\Windows\System\BeGEFQK.exe
  2⤵
  PID:12024
- C:\Windows\System\OwarePM.exe
  C:\Windows\System\OwarePM.exe
  2⤵
  PID:12060
- C:\Windows\System\hCEpxZO.exe
  C:\Windows\System\hCEpxZO.exe
  2⤵
  PID:12176
- C:\Windows\System\AvhbMdL.exe
  C:\Windows\System\AvhbMdL.exe
  2⤵
  PID:12104
- C:\Windows\System\JtZwyzx.exe
  C:\Windows\System\JtZwyzx.exe
  2⤵
  PID:12216
- C:\Windows\System\lgvbOqY.exe
  C:\Windows\System\lgvbOqY.exe
  2⤵
  PID:12252
- C:\Windows\System\xYloQgM.exe
  C:\Windows\System\xYloQgM.exe
  2⤵
  PID:10876
- C:\Windows\System\mjQAiqp.exe
  C:\Windows\System\mjQAiqp.exe
  2⤵
  PID:10900
- C:\Windows\System\OokVsep.exe
  C:\Windows\System\OokVsep.exe
  2⤵
  PID:11704
- C:\Windows\System\wxAenCV.exe
  C:\Windows\System\wxAenCV.exe
  2⤵
  PID:11896
- C:\Windows\System\TvRKIGF.exe
  C:\Windows\System\TvRKIGF.exe
  2⤵
  PID:11632
- C:\Windows\System\DCcUOtv.exe
  C:\Windows\System\DCcUOtv.exe
  2⤵
  PID:12316
- C:\Windows\System\yAGHArp.exe
  C:\Windows\System\yAGHArp.exe
  2⤵
  PID:12344
- C:\Windows\System\OkBLsBi.exe
  C:\Windows\System\OkBLsBi.exe
  2⤵
  PID:12372
- C:\Windows\System\iRrudMT.exe
  C:\Windows\System\iRrudMT.exe
  2⤵
  PID:12404
- C:\Windows\System\XMSieJx.exe
  C:\Windows\System\XMSieJx.exe
  2⤵
  PID:12428
- C:\Windows\System\QweIjCm.exe
  C:\Windows\System\QweIjCm.exe
  2⤵
  PID:12452
- C:\Windows\System\iPdIzfM.exe
  C:\Windows\System\iPdIzfM.exe
  2⤵
  PID:12468
- C:\Windows\System\kFFkrNO.exe
  C:\Windows\System\kFFkrNO.exe
  2⤵
  PID:12496
- C:\Windows\System\lntQzlg.exe
  C:\Windows\System\lntQzlg.exe
  2⤵
  PID:12512
- C:\Windows\System\tqFLRCF.exe
  C:\Windows\System\tqFLRCF.exe
  2⤵
  PID:12544
- C:\Windows\System\HdmBRic.exe
  C:\Windows\System\HdmBRic.exe
  2⤵
  PID:12580
- C:\Windows\System\JPLkByR.exe
  C:\Windows\System\JPLkByR.exe
  2⤵
  PID:12600
- C:\Windows\System\uHtaOtO.exe
  C:\Windows\System\uHtaOtO.exe
  2⤵
  PID:12628
- C:\Windows\System\dAeMUCY.exe
  C:\Windows\System\dAeMUCY.exe
  2⤵
  PID:12648
- C:\Windows\System\xwYboHr.exe
  C:\Windows\System\xwYboHr.exe
  2⤵
  PID:12680
- C:\Windows\System\joWDVMT.exe
  C:\Windows\System\joWDVMT.exe
  2⤵
  PID:12700
- C:\Windows\System\jSGFYtk.exe
  C:\Windows\System\jSGFYtk.exe
  2⤵
  PID:12732
- C:\Windows\System\mIfASWN.exe
  C:\Windows\System\mIfASWN.exe
  2⤵
  PID:12756
- C:\Windows\System\ywwNALc.exe
  C:\Windows\System\ywwNALc.exe
  2⤵
  PID:12776
- C:\Windows\System\FaarzKN.exe
  C:\Windows\System\FaarzKN.exe
  2⤵
  PID:12804
- C:\Windows\System\DIAMCxR.exe
  C:\Windows\System\DIAMCxR.exe
  2⤵
  PID:12832
- C:\Windows\System\AAyoRoi.exe
  C:\Windows\System\AAyoRoi.exe
  2⤵
  PID:12848
- C:\Windows\System\cKqdRxY.exe
  C:\Windows\System\cKqdRxY.exe
  2⤵
  PID:12872
- C:\Windows\System\CVrzIzP.exe
  C:\Windows\System\CVrzIzP.exe
  2⤵
  PID:12892
- C:\Windows\System\mrpuYOD.exe
  C:\Windows\System\mrpuYOD.exe
  2⤵
  PID:12912
- C:\Windows\System\pxOveeG.exe
  C:\Windows\System\pxOveeG.exe
  2⤵
  PID:12932
- C:\Windows\System\lWlZMUR.exe
  C:\Windows\System\lWlZMUR.exe
  2⤵
  PID:12956
- C:\Windows\System\eaAlxxO.exe
  C:\Windows\System\eaAlxxO.exe
  2⤵
  PID:12976
- C:\Windows\System\YJiytjN.exe
  C:\Windows\System\YJiytjN.exe
  2⤵
  PID:13000
- C:\Windows\System\EUujpPm.exe
  C:\Windows\System\EUujpPm.exe
  2⤵
  PID:13028
- C:\Windows\System\yVwESOr.exe
  C:\Windows\System\yVwESOr.exe
  2⤵
  PID:13048
- C:\Windows\System\ozNuMBv.exe
  C:\Windows\System\ozNuMBv.exe
  2⤵
  PID:13088
- C:\Windows\System\xXzcmkf.exe
  C:\Windows\System\xXzcmkf.exe
  2⤵
  PID:13108
- C:\Windows\System\VWQRRtA.exe
  C:\Windows\System\VWQRRtA.exe
  2⤵
  PID:13132
- C:\Windows\System\AbOhpZB.exe
  C:\Windows\System\AbOhpZB.exe
  2⤵
  PID:13164
- C:\Windows\System\IlNafOd.exe
  C:\Windows\System\IlNafOd.exe
  2⤵
  PID:13196
- C:\Windows\System\WBQgFeT.exe
  C:\Windows\System\WBQgFeT.exe
  2⤵
  PID:13216
- C:\Windows\System\vMllvfn.exe
  C:\Windows\System\vMllvfn.exe
  2⤵
  PID:13232
- C:\Windows\System\JePHTrg.exe
  C:\Windows\System\JePHTrg.exe
  2⤵
  PID:13252
- C:\Windows\System\fycjvDJ.exe
  C:\Windows\System\fycjvDJ.exe
  2⤵
  PID:13272
- C:\Windows\System\iaVrSnh.exe
  C:\Windows\System\iaVrSnh.exe
  2⤵
  PID:13288
- C:\Windows\System\UKdCybz.exe
  C:\Windows\System\UKdCybz.exe
  2⤵
  PID:11412
- C:\Windows\System\VYIRMKP.exe
  C:\Windows\System\VYIRMKP.exe
  2⤵
  PID:10476
- C:\Windows\System\luDvtWx.exe
  C:\Windows\System\luDvtWx.exe
  2⤵
  PID:10400
- C:\Windows\System\GMtyHQd.exe
  C:\Windows\System\GMtyHQd.exe
  2⤵
  PID:10824
- C:\Windows\System\UexzHMj.exe
  C:\Windows\System\UexzHMj.exe
  2⤵
  PID:10264
- C:\Windows\System\akcRciy.exe
  C:\Windows\System\akcRciy.exe
  2⤵
  PID:11804
- C:\Windows\System\WJkajyX.exe
  C:\Windows\System\WJkajyX.exe
  2⤵
  PID:12396
- C:\Windows\System\IQOzrXp.exe
  C:\Windows\System\IQOzrXp.exe
  2⤵
  PID:12484
- C:\Windows\System\nUkDlrB.exe
  C:\Windows\System\nUkDlrB.exe
  2⤵
  PID:12564
- C:\Windows\System\VoNHmnZ.exe
  C:\Windows\System\VoNHmnZ.exe
  2⤵
  PID:11464
- C:\Windows\System\dIkJGMA.exe
  C:\Windows\System\dIkJGMA.exe
  2⤵
  PID:12708
- C:\Windows\System\XOSVVLh.exe
  C:\Windows\System\XOSVVLh.exe
  2⤵
  PID:12752
- C:\Windows\System\macdUVU.exe
  C:\Windows\System\macdUVU.exe
  2⤵
  PID:12364
- C:\Windows\System\AxUnhsi.exe
  C:\Windows\System\AxUnhsi.exe
  2⤵
  PID:12900
- C:\Windows\System\oFIoPDu.exe
  C:\Windows\System\oFIoPDu.exe
  2⤵
  PID:11864
- C:\Windows\System\nRdEmnO.exe
  C:\Windows\System\nRdEmnO.exe
  2⤵
  PID:11328
- C:\Windows\System\yoElMsQ.exe
  C:\Windows\System\yoElMsQ.exe
  2⤵
  PID:13044
- C:\Windows\System\wYaDvMd.exe
  C:\Windows\System\wYaDvMd.exe
  2⤵
  PID:12284
- C:\Windows\System\zaNTMut.exe
  C:\Windows\System\zaNTMut.exe
  2⤵
  PID:13128
- C:\Windows\System\EiFRuBw.exe
  C:\Windows\System\EiFRuBw.exe
  2⤵
  PID:13324
- C:\Windows\System\pLFNUwn.exe
  C:\Windows\System\pLFNUwn.exe
  2⤵
  PID:13352
- C:\Windows\System\kvzizFK.exe
  C:\Windows\System\kvzizFK.exe
  2⤵
  PID:13368
- C:\Windows\System\vmqaMfL.exe
  C:\Windows\System\vmqaMfL.exe
  2⤵
  PID:13388
- C:\Windows\System\rOMdlSP.exe
  C:\Windows\System\rOMdlSP.exe
  2⤵
  PID:13416
- C:\Windows\System\KSfmghD.exe
  C:\Windows\System\KSfmghD.exe
  2⤵
  PID:13436
- C:\Windows\System\yLvWagj.exe
  C:\Windows\System\yLvWagj.exe
  2⤵
  PID:13464
- C:\Windows\System\oNHGJoF.exe
  C:\Windows\System\oNHGJoF.exe
  2⤵
  PID:13480
- C:\Windows\System\cUMpFnu.exe
  C:\Windows\System\cUMpFnu.exe
  2⤵
  PID:13496
- C:\Windows\System\ELxJjzn.exe
  C:\Windows\System\ELxJjzn.exe
  2⤵
  PID:13516
- C:\Windows\System\AjyFlzD.exe
  C:\Windows\System\AjyFlzD.exe
  2⤵
  PID:13540
- C:\Windows\System\BbBKtmA.exe
  C:\Windows\System\BbBKtmA.exe
  2⤵
  PID:13568
- C:\Windows\System\NxkPAWU.exe
  C:\Windows\System\NxkPAWU.exe
  2⤵
  PID:13592
- C:\Windows\System\NrCrMlk.exe
  C:\Windows\System\NrCrMlk.exe
  2⤵
  PID:13608
- C:\Windows\System\DDcAZPr.exe
  C:\Windows\System\DDcAZPr.exe
  2⤵
  PID:13632
- C:\Windows\System\wVTAllQ.exe
  C:\Windows\System\wVTAllQ.exe
  2⤵
  PID:13872
- C:\Windows\System\zDIlAtO.exe
  C:\Windows\System\zDIlAtO.exe
  2⤵
  PID:13900
- C:\Windows\System\JRXMUzc.exe
  C:\Windows\System\JRXMUzc.exe
  2⤵
  PID:13920
- C:\Windows\System\gEJiaeQ.exe
  C:\Windows\System\gEJiaeQ.exe
  2⤵
  PID:13936
- C:\Windows\System\ZfcsHZE.exe
  C:\Windows\System\ZfcsHZE.exe
  2⤵
  PID:13952
- C:\Windows\System\AuaUPni.exe
  C:\Windows\System\AuaUPni.exe
  2⤵
  PID:13968
- C:\Windows\System\JEcBfey.exe
  C:\Windows\System\JEcBfey.exe
  2⤵
  PID:13984
- C:\Windows\System\yQwWkMx.exe
  C:\Windows\System\yQwWkMx.exe
  2⤵
  PID:14000
- C:\Windows\System\RjyWHYr.exe
  C:\Windows\System\RjyWHYr.exe
  2⤵
  PID:14024
- C:\Windows\System\diJiwpI.exe
  C:\Windows\System\diJiwpI.exe
  2⤵
  PID:14040
- C:\Windows\System\YoEgJTZ.exe
  C:\Windows\System\YoEgJTZ.exe
  2⤵
  PID:14056
- C:\Windows\System\JvKMMXm.exe
  C:\Windows\System\JvKMMXm.exe
  2⤵
  PID:14072
- C:\Windows\System\QDRzslG.exe
  C:\Windows\System\QDRzslG.exe
  2⤵
  PID:14088
- C:\Windows\System\UCgeOZl.exe
  C:\Windows\System\UCgeOZl.exe
  2⤵
  PID:14104
- C:\Windows\System\nGeoNmK.exe
  C:\Windows\System\nGeoNmK.exe
  2⤵
  PID:14132
- C:\Windows\System\QsgMqEn.exe
  C:\Windows\System\QsgMqEn.exe
  2⤵
  PID:12644
- C:\Windows\System\smFhnvx.exe
  C:\Windows\System\smFhnvx.exe
  2⤵
  PID:13184
- C:\Windows\System\AgaJvOv.exe
  C:\Windows\System\AgaJvOv.exe
  2⤵
  PID:13224
- C:\Windows\System\oedNoaT.exe
  C:\Windows\System\oedNoaT.exe
  2⤵
  PID:13248
- C:\Windows\System\aEZkwQS.exe
  C:\Windows\System\aEZkwQS.exe
  2⤵
  PID:13296
- C:\Windows\System\DMaKZFG.exe
  C:\Windows\System\DMaKZFG.exe
  2⤵
  PID:12416
- C:\Windows\System\CBAbjNI.exe
  C:\Windows\System\CBAbjNI.exe
  2⤵
  PID:11828
- C:\Windows\System\PpUjEgm.exe
  C:\Windows\System\PpUjEgm.exe
  2⤵
  PID:13008
- C:\Windows\System\GdyCuNi.exe
  C:\Windows\System\GdyCuNi.exe
  2⤵
  PID:12616
- C:\Windows\System\ldgdGCM.exe
  C:\Windows\System\ldgdGCM.exe
  2⤵
  PID:13332
- C:\Windows\System\LPmvISW.exe
  C:\Windows\System\LPmvISW.exe
  2⤵
  PID:13408
- C:\Windows\System\OEEuoKG.exe
  C:\Windows\System\OEEuoKG.exe
  2⤵
  PID:13472
- C:\Windows\System\CuiaJNL.exe
  C:\Windows\System\CuiaJNL.exe
  2⤵
  PID:12824
- C:\Windows\System\CzjDMIL.exe
  C:\Windows\System\CzjDMIL.exe
  2⤵
  PID:10372
- C:\Windows\System\coLgLug.exe
  C:\Windows\System\coLgLug.exe
  2⤵
  PID:12528
- C:\Windows\System\NBPrPxY.exe
  C:\Windows\System\NBPrPxY.exe
  2⤵
  PID:12972
- C:\Windows\System\BnPAtgb.exe
  C:\Windows\System\BnPAtgb.exe
  2⤵
  PID:12740
- C:\Windows\System\dezkiNO.exe
  C:\Windows\System\dezkiNO.exe
  2⤵
  PID:13728
- C:\Windows\System\BHOzgQM.exe
  C:\Windows\System\BHOzgQM.exe
  2⤵
  PID:13752
- C:\Windows\System\GGsFBtT.exe
  C:\Windows\System\GGsFBtT.exe
  2⤵
  PID:13432
- C:\Windows\System\htWlIPx.exe
  C:\Windows\System\htWlIPx.exe
  2⤵
  PID:12232
- C:\Windows\System\YmCflKm.exe
  C:\Windows\System\YmCflKm.exe
  2⤵
  PID:11780
- C:\Windows\System\nuqTrgl.exe
  C:\Windows\System\nuqTrgl.exe
  2⤵
  PID:14064
- C:\Windows\System\sUNkNoC.exe
  C:\Windows\System\sUNkNoC.exe
  2⤵
  PID:12920
- C:\Windows\System\PnYKxgq.exe
  C:\Windows\System\PnYKxgq.exe
  2⤵
  PID:13504
- C:\Windows\System\cNHCCyx.exe
  C:\Windows\System\cNHCCyx.exe
  2⤵
  PID:13584
- C:\Windows\System\BREnkyZ.exe
  C:\Windows\System\BREnkyZ.exe
  2⤵
  PID:13668
- C:\Windows\System\eQOhAyw.exe
  C:\Windows\System\eQOhAyw.exe
  2⤵
  PID:13928
- C:\Windows\System\DaEZnzR.exe
  C:\Windows\System\DaEZnzR.exe
  2⤵
  PID:14300
- C:\Windows\System\UDFqBFc.exe
  C:\Windows\System\UDFqBFc.exe
  2⤵
  PID:13736
- C:\Windows\System\UYfvwPI.exe
  C:\Windows\System\UYfvwPI.exe
  2⤵
  PID:13148
- C:\Windows\System\sMWgdbK.exe
  C:\Windows\System\sMWgdbK.exe
  2⤵
  PID:14344
- C:\Windows\System\OHyShXc.exe
  C:\Windows\System\OHyShXc.exe
  2⤵
  PID:14372
- C:\Windows\System\uoTrojz.exe
  C:\Windows\System\uoTrojz.exe
  2⤵
  PID:14392
- C:\Windows\System\mQTauUi.exe
  C:\Windows\System\mQTauUi.exe
  2⤵
  PID:14408
- C:\Windows\System\TcKBBnj.exe
  C:\Windows\System\TcKBBnj.exe
  2⤵
  PID:14424
- C:\Windows\System\NNJDTTv.exe
  C:\Windows\System\NNJDTTv.exe
  2⤵
  PID:14444
- C:\Windows\System\aBrOiFz.exe
  C:\Windows\System\aBrOiFz.exe
  2⤵
  PID:14472
- C:\Windows\System\NDuEfOL.exe
  C:\Windows\System\NDuEfOL.exe
  2⤵
  PID:14488
- C:\Windows\System\QBHvrKl.exe
  C:\Windows\System\QBHvrKl.exe
  2⤵
  PID:14512
- C:\Windows\System\GRVRlcG.exe
  C:\Windows\System\GRVRlcG.exe
  2⤵
  PID:14536
- C:\Windows\System\LuYEEWs.exe
  C:\Windows\System\LuYEEWs.exe
  2⤵
  PID:14552
- C:\Windows\System\JjyPJae.exe
  C:\Windows\System\JjyPJae.exe
  2⤵
  PID:14576
- C:\Windows\System\TJYuNlv.exe
  C:\Windows\System\TJYuNlv.exe
  2⤵
  PID:14596
- C:\Windows\System\vwwjiGz.exe
  C:\Windows\System\vwwjiGz.exe
  2⤵
  PID:14628
- C:\Windows\System\uPpgsHx.exe
  C:\Windows\System\uPpgsHx.exe
  2⤵
  PID:14652
- C:\Windows\System\SbRalij.exe
  C:\Windows\System\SbRalij.exe
  2⤵
  PID:14668
- C:\Windows\System\TpohvfH.exe
  C:\Windows\System\TpohvfH.exe
  2⤵
  PID:14688
- C:\Windows\System\GrvWbbI.exe
  C:\Windows\System\GrvWbbI.exe
  2⤵
  PID:14716
- C:\Windows\System\EzgKcuX.exe
  C:\Windows\System\EzgKcuX.exe
  2⤵
  PID:14736
- C:\Windows\System\UGoQDtk.exe
  C:\Windows\System\UGoQDtk.exe
  2⤵
  PID:14764
- C:\Windows\System\pVEcWNX.exe
  C:\Windows\System\pVEcWNX.exe
  2⤵
  PID:14796
- C:\Windows\System\tgojMmB.exe
  C:\Windows\System\tgojMmB.exe
  2⤵
  PID:14820
- C:\Windows\System\rVOkSzQ.exe
  C:\Windows\System\rVOkSzQ.exe
  2⤵
  PID:14840
- C:\Windows\System\LXHYIvU.exe
  C:\Windows\System\LXHYIvU.exe
  2⤵
  PID:14876
- C:\Windows\System\UgUcjoD.exe
  C:\Windows\System\UgUcjoD.exe
  2⤵
  PID:14892
- C:\Windows\System\GiwPKpx.exe
  C:\Windows\System\GiwPKpx.exe
  2⤵
  PID:14928
- C:\Windows\System\ySQKrLY.exe
  C:\Windows\System\ySQKrLY.exe
  2⤵
  PID:14944
- C:\Windows\System\nnOXDOJ.exe
  C:\Windows\System\nnOXDOJ.exe
  2⤵
  PID:14972
- C:\Windows\System\gouAybC.exe
  C:\Windows\System\gouAybC.exe
  2⤵
  PID:14988
- C:\Windows\System\OJtMODt.exe
  C:\Windows\System\OJtMODt.exe
  2⤵
  PID:15012
- C:\Windows\System\cwbvCjz.exe
  C:\Windows\System\cwbvCjz.exe
  2⤵
  PID:15040
- C:\Windows\System\PltoInH.exe
  C:\Windows\System\PltoInH.exe
  2⤵
  PID:15060
- C:\Windows\System\yYQIgMf.exe
  C:\Windows\System\yYQIgMf.exe
  2⤵
  PID:15096
- C:\Windows\System\qEoDVBw.exe
  C:\Windows\System\qEoDVBw.exe
  2⤵
  PID:15116
- C:\Windows\System\LCQyvzp.exe
  C:\Windows\System\LCQyvzp.exe
  2⤵
  PID:15140
- C:\Windows\System\eRlojiE.exe
  C:\Windows\System\eRlojiE.exe
  2⤵
  PID:15160
- C:\Windows\System\kqUmEda.exe
  C:\Windows\System\kqUmEda.exe
  2⤵
  PID:15184
- C:\Windows\System\oprKpah.exe
  C:\Windows\System\oprKpah.exe
  2⤵
  PID:15200
- C:\Windows\System\aIbmbAH.exe
  C:\Windows\System\aIbmbAH.exe
  2⤵
  PID:15216
- C:\Windows\System\UQLvOwa.exe
  C:\Windows\System\UQLvOwa.exe
  2⤵
  PID:15240
- C:\Windows\System\LEDCruY.exe
  C:\Windows\System\LEDCruY.exe
  2⤵
  PID:15264
- C:\Windows\System\bmPDgRg.exe
  C:\Windows\System\bmPDgRg.exe
  2⤵
  PID:15292
- C:\Windows\System\vrwFdCu.exe
  C:\Windows\System\vrwFdCu.exe
  2⤵
  PID:15320
- C:\Windows\System\HoExMHK.exe
  C:\Windows\System\HoExMHK.exe
  2⤵
  PID:15336
- C:\Windows\System\ZfQfeiO.exe
  C:\Windows\System\ZfQfeiO.exe
  2⤵
  PID:15352
- C:\Windows\System\LrcjZVW.exe
  C:\Windows\System\LrcjZVW.exe
  2⤵
  PID:13980
- C:\Windows\System\NGxChWy.exe
  C:\Windows\System\NGxChWy.exe
  2⤵
  PID:14016
- C:\Windows\System\ArayHHk.exe
  C:\Windows\System\ArayHHk.exe
  2⤵
  PID:13476
- C:\Windows\System\LFLGwvx.exe
  C:\Windows\System\LFLGwvx.exe
  2⤵
  PID:12952
- C:\Windows\System\vgJtHgF.exe
  C:\Windows\System\vgJtHgF.exe
  2⤵
  PID:12748
- C:\Windows\System\FuGjKqI.exe
  C:\Windows\System\FuGjKqI.exe
  2⤵
  PID:14168
- C:\Windows\System\sJwQBxx.exe
  C:\Windows\System\sJwQBxx.exe
  2⤵
  PID:13628
- C:\Windows\System\shvymoQ.exe
  C:\Windows\System\shvymoQ.exe
  2⤵
  PID:13716
- C:\Windows\System\yIKnEDI.exe
  C:\Windows\System\yIKnEDI.exe
  2⤵
  PID:13552
- C:\Windows\System\taoDxhT.exe
  C:\Windows\System\taoDxhT.exe
  2⤵
  PID:14272
- C:\Windows\System\KNBQSQJ.exe
  C:\Windows\System\KNBQSQJ.exe
  2⤵
  PID:13084
- C:\Windows\System\mZsBtIv.exe
  C:\Windows\System\mZsBtIv.exe
  2⤵
  PID:14388
- C:\Windows\System\QZKkxqp.exe
  C:\Windows\System\QZKkxqp.exe
  2⤵
  PID:14436
- C:\Windows\System\UMohCzG.exe
  C:\Windows\System\UMohCzG.exe
  2⤵
  PID:12904
- C:\Windows\System\OLlcfZz.exe
  C:\Windows\System\OLlcfZz.exe
  2⤵
  PID:14532
- C:\Windows\System\JFUlGkO.exe
  C:\Windows\System\JFUlGkO.exe
  2⤵
  PID:14588
- C:\Windows\System\HImVQsv.exe
  C:\Windows\System\HImVQsv.exe
  2⤵
  PID:12864
- C:\Windows\System\mHJjNQc.exe
  C:\Windows\System\mHJjNQc.exe
  2⤵
  PID:13360
- C:\Windows\System\KMIchKX.exe
  C:\Windows\System\KMIchKX.exe
  2⤵
  PID:13776
- C:\Windows\System\QAxEdJZ.exe
  C:\Windows\System\QAxEdJZ.exe
  2⤵
  PID:12324
- C:\Windows\System\bQpEYWG.exe
  C:\Windows\System\bQpEYWG.exe
  2⤵
  PID:14696
- C:\Windows\System\yjPBqnA.exe
  C:\Windows\System\yjPBqnA.exe
  2⤵
  PID:13152
- C:\Windows\System\OFoikEB.exe
  C:\Windows\System\OFoikEB.exe
  2⤵
  PID:15376
- C:\Windows\System\UgPgbXt.exe
  C:\Windows\System\UgPgbXt.exe
  2⤵
  PID:15392
- C:\Windows\System\HbQyWUQ.exe
  C:\Windows\System\HbQyWUQ.exe
  2⤵
  PID:15408
- C:\Windows\System\LmoxZTV.exe
  C:\Windows\System\LmoxZTV.exe
  2⤵
  PID:15424
- C:\Windows\System\UMnxgVn.exe
  C:\Windows\System\UMnxgVn.exe
  2⤵
  PID:15444
- C:\Windows\System\ORERJxb.exe
  C:\Windows\System\ORERJxb.exe
  2⤵
  PID:15460
- C:\Windows\System\JNfjOZI.exe
  C:\Windows\System\JNfjOZI.exe
  2⤵
  PID:15508
- C:\Windows\System\XsogWOu.exe
  C:\Windows\System\XsogWOu.exe
  2⤵
  PID:15540
- C:\Windows\System\pVtqRRL.exe
  C:\Windows\System\pVtqRRL.exe
  2⤵
  PID:15580
- C:\Windows\System\NdfvAHA.exe
  C:\Windows\System\NdfvAHA.exe
  2⤵
  PID:15600
- C:\Windows\System\TthPWrC.exe
  C:\Windows\System\TthPWrC.exe
  2⤵
  PID:15636
- C:\Windows\System\ChCRYdT.exe
  C:\Windows\System\ChCRYdT.exe
  2⤵
  PID:15660
- C:\Windows\System\oOTfJJD.exe
  C:\Windows\System\oOTfJJD.exe
  2⤵
  PID:15680
- C:\Windows\System\CLVtBgG.exe
  C:\Windows\System\CLVtBgG.exe
  2⤵
  PID:15696
- C:\Windows\System\QeGjKlT.exe
  C:\Windows\System\QeGjKlT.exe
  2⤵
  PID:15712
- C:\Windows\System\JywWavb.exe
  C:\Windows\System\JywWavb.exe
  2⤵
  PID:15728
- C:\Windows\System\gvryveg.exe
  C:\Windows\System\gvryveg.exe
  2⤵
  PID:15744
- C:\Windows\System\DzBTUMn.exe
  C:\Windows\System\DzBTUMn.exe
  2⤵
  PID:15764
- C:\Windows\System\iBBVQKW.exe
  C:\Windows\System\iBBVQKW.exe
  2⤵
  PID:15784
- C:\Windows\System\TekEiVG.exe
  C:\Windows\System\TekEiVG.exe
  2⤵
  PID:15800
- C:\Windows\System\jsjKpPN.exe
  C:\Windows\System\jsjKpPN.exe
  2⤵
  PID:15816
- C:\Windows\System\RlKAKhU.exe
  C:\Windows\System\RlKAKhU.exe
  2⤵
  PID:15832
- C:\Windows\System\dflzQLD.exe
  C:\Windows\System\dflzQLD.exe
  2⤵
  PID:15848
- C:\Windows\System\NIhQyaZ.exe
  C:\Windows\System\NIhQyaZ.exe
  2⤵
  PID:15864
- C:\Windows\System\EqcdTzM.exe
  C:\Windows\System\EqcdTzM.exe
  2⤵
  PID:15888
- C:\Windows\System\jKgjUzR.exe
  C:\Windows\System\jKgjUzR.exe
  2⤵
  PID:15916
- C:\Windows\System\gDWGryD.exe
  C:\Windows\System\gDWGryD.exe
  2⤵
  PID:15932
- C:\Windows\System\UHWqomq.exe
  C:\Windows\System\UHWqomq.exe
  2⤵
  PID:15948
- C:\Windows\System\AFIsorO.exe
  C:\Windows\System\AFIsorO.exe
  2⤵
  PID:15964
- C:\Windows\System\KrpVKeE.exe
  C:\Windows\System\KrpVKeE.exe
  2⤵
  PID:15980
- C:\Windows\System\rKfiYjb.exe
  C:\Windows\System\rKfiYjb.exe
  2⤵
  PID:15996
- C:\Windows\System\krlxPuV.exe
  C:\Windows\System\krlxPuV.exe
  2⤵
  PID:16020
- C:\Windows\System\kttCnqP.exe
  C:\Windows\System\kttCnqP.exe
  2⤵
  PID:16036
- C:\Windows\System\CtnUMdf.exe
  C:\Windows\System\CtnUMdf.exe
  2⤵
  PID:16052
- C:\Windows\System\zasmOmE.exe
  C:\Windows\System\zasmOmE.exe
  2⤵
  PID:16068
- C:\Windows\System\jXoRvBi.exe
  C:\Windows\System\jXoRvBi.exe
  2⤵
  PID:16084
- C:\Windows\System\oDlwJOQ.exe
  C:\Windows\System\oDlwJOQ.exe
  2⤵
  PID:16100
- C:\Windows\System\cwHXVjD.exe
  C:\Windows\System\cwHXVjD.exe
  2⤵
  PID:16116
- C:\Windows\System\IKXHPOJ.exe
  C:\Windows\System\IKXHPOJ.exe
  2⤵
  PID:16132
- C:\Windows\System\dBHoCYo.exe
  C:\Windows\System\dBHoCYo.exe
  2⤵
  PID:16148
- C:\Windows\System\PLHMdhB.exe
  C:\Windows\System\PLHMdhB.exe
  2⤵
  PID:16164
- C:\Windows\System\aFzzazR.exe
  C:\Windows\System\aFzzazR.exe
  2⤵
  PID:16180
- C:\Windows\System\iQjyNsC.exe
  C:\Windows\System\iQjyNsC.exe
  2⤵
  PID:16200
- C:\Windows\System\mcHSoYU.exe
  C:\Windows\System\mcHSoYU.exe
  2⤵
  PID:16216
- C:\Windows\System\leUyibv.exe
  C:\Windows\System\leUyibv.exe
  2⤵
  PID:16232
- C:\Windows\System\eqFSnmC.exe
  C:\Windows\System\eqFSnmC.exe
  2⤵
  PID:16248
- C:\Windows\System\ZxMXOvR.exe
  C:\Windows\System\ZxMXOvR.exe
  2⤵
  PID:16264
- C:\Windows\System\vofLmJh.exe
  C:\Windows\System\vofLmJh.exe
  2⤵
  PID:16284
- C:\Windows\System\WCuogKZ.exe
  C:\Windows\System\WCuogKZ.exe
  2⤵
  PID:16300
- C:\Windows\System\gjuvfOI.exe
  C:\Windows\System\gjuvfOI.exe
  2⤵
  PID:16316
- C:\Windows\System\BHIyuCj.exe
  C:\Windows\System\BHIyuCj.exe
  2⤵
  PID:16332
- C:\Windows\System\lcDfeKt.exe
  C:\Windows\System\lcDfeKt.exe
  2⤵
  PID:16348
- C:\Windows\System\TJSfRvx.exe
  C:\Windows\System\TJSfRvx.exe
  2⤵
  PID:16364
- C:\Windows\System\tmtUHzI.exe
  C:\Windows\System\tmtUHzI.exe
  2⤵
  PID:16380
- C:\Windows\System\UlEGyQe.exe
  C:\Windows\System\UlEGyQe.exe
  2⤵
  PID:13064
- C:\Windows\System\NzfGcfc.exe
  C:\Windows\System\NzfGcfc.exe
  2⤵
  PID:15072
- C:\Windows\System\XAaFEZD.exe
  C:\Windows\System\XAaFEZD.exe
  2⤵
  PID:14368
- C:\Windows\System\wozwEHy.exe
  C:\Windows\System\wozwEHy.exe
  2⤵
  PID:15128
- C:\Windows\System\UKeSVpZ.exe
  C:\Windows\System\UKeSVpZ.exe
  2⤵
  PID:15308
- C:\Windows\System\vFtgeLm.exe
  C:\Windows\System\vFtgeLm.exe
  2⤵
  PID:15328
- C:\Windows\System\FJGTdXt.exe
  C:\Windows\System\FJGTdXt.exe
  2⤵
  PID:15348
- C:\Windows\System\UZbWJmk.exe
  C:\Windows\System\UZbWJmk.exe
  2⤵
  PID:12532
- C:\Windows\System\UwxvJey.exe
  C:\Windows\System\UwxvJey.exe
  2⤵
  PID:11640
- C:\Windows\System\DCZtPtu.exe
  C:\Windows\System\DCZtPtu.exe
  2⤵
  PID:14332
- C:\Windows\System\VwGvjFn.exe
  C:\Windows\System\VwGvjFn.exe
  2⤵
  PID:14572
- C:\Windows\System\YOIDTLp.exe
  C:\Windows\System\YOIDTLp.exe
  2⤵
  PID:13648
- C:\Windows\System\nDiCkYV.exe
  C:\Windows\System\nDiCkYV.exe
  2⤵
  PID:14936
- C:\Windows\System\MmdAleC.exe
  C:\Windows\System\MmdAleC.exe
  2⤵
  PID:5928
- C:\Windows\System\QxlIwev.exe
  C:\Windows\System\QxlIwev.exe
  2⤵
  PID:14464
- C:\Windows\System\VZEIPHK.exe
  C:\Windows\System\VZEIPHK.exe
  2⤵
  PID:15304
- C:\Windows\System\QMeFryL.exe
  C:\Windows\System\QMeFryL.exe
  2⤵
  PID:13308
- C:\Windows\System\xCOxLCJ.exe
  C:\Windows\System\xCOxLCJ.exe
  2⤵
  PID:13228
- C:\Windows\System\URrHjBr.exe
  C:\Windows\System\URrHjBr.exe
  2⤵
  PID:12508
- C:\Windows\System\ScXfomk.exe
  C:\Windows\System\ScXfomk.exe
  2⤵
  PID:14380
- C:\Windows\System\EGHQpzN.exe
  C:\Windows\System\EGHQpzN.exe
  2⤵
  PID:14660
- C:\Windows\System\hDiTBoQ.exe
  C:\Windows\System\hDiTBoQ.exe
  2⤵
  PID:14884
- C:\Windows\System\PmMqnie.exe
  C:\Windows\System\PmMqnie.exe
  2⤵
  PID:16392
- C:\Windows\System\tuxmmXl.exe
  C:\Windows\System\tuxmmXl.exe
  2⤵
  PID:16412
- C:\Windows\System\lsAstvw.exe
  C:\Windows\System\lsAstvw.exe
  2⤵
  PID:16428
- C:\Windows\System\vuivftT.exe
  C:\Windows\System\vuivftT.exe
  2⤵
  PID:16448
- C:\Windows\System\oDrZkUr.exe
  C:\Windows\System\oDrZkUr.exe
  2⤵
  PID:16464
- C:\Windows\System\xlyqIvm.exe
  C:\Windows\System\xlyqIvm.exe
  2⤵
  PID:16480
- C:\Windows\System\tCoZAMv.exe
  C:\Windows\System\tCoZAMv.exe
  2⤵
  PID:16496
- C:\Windows\System\PKLYnkm.exe
  C:\Windows\System\PKLYnkm.exe
  2⤵
  PID:16516
- C:\Windows\System\NmVWRUb.exe
  C:\Windows\System\NmVWRUb.exe
  2⤵
  PID:16532
- C:\Windows\System\SDemodC.exe
  C:\Windows\System\SDemodC.exe
  2⤵
  PID:16548
- C:\Windows\System\zrtjkJM.exe
  C:\Windows\System\zrtjkJM.exe
  2⤵
  PID:16564
- C:\Windows\System\lkTbkPH.exe
  C:\Windows\System\lkTbkPH.exe
  2⤵
  PID:16580
- C:\Windows\System\MgBhQtl.exe
  C:\Windows\System\MgBhQtl.exe
  2⤵
  PID:16604
- C:\Windows\System\pzrCzwH.exe
  C:\Windows\System\pzrCzwH.exe
  2⤵
  PID:16620
- C:\Windows\System\Qyuqqoi.exe
  C:\Windows\System\Qyuqqoi.exe
  2⤵
  PID:16640
- C:\Windows\System\jFYxYyk.exe
  C:\Windows\System\jFYxYyk.exe
  2⤵
  PID:16656
- C:\Windows\System\aSlRIud.exe
  C:\Windows\System\aSlRIud.exe
  2⤵
  PID:16672
- C:\Windows\System\byjDWFR.exe
  C:\Windows\System\byjDWFR.exe
  2⤵
  PID:16688
- C:\Windows\System\XAHMGRD.exe
  C:\Windows\System\XAHMGRD.exe
  2⤵
  PID:16704
- C:\Windows\System\ONIKCoQ.exe
  C:\Windows\System\ONIKCoQ.exe
  2⤵
  PID:16720
- C:\Windows\System\dnRkJDL.exe
  C:\Windows\System\dnRkJDL.exe
  2⤵
  PID:16736
- C:\Windows\System\IjjgSdG.exe
  C:\Windows\System\IjjgSdG.exe
  2⤵
  PID:16752
- C:\Windows\System\TjfThNr.exe
  C:\Windows\System\TjfThNr.exe
  2⤵
  PID:16772
- C:\Windows\System\XgOjvuM.exe
  C:\Windows\System\XgOjvuM.exe
  2⤵
  PID:16788
- C:\Windows\System\sPocmWa.exe
  C:\Windows\System\sPocmWa.exe
  2⤵
  PID:16804
- C:\Windows\System\aBKVGnJ.exe
  C:\Windows\System\aBKVGnJ.exe
  2⤵
  PID:16820
- C:\Windows\System\QgUTjIc.exe
  C:\Windows\System\QgUTjIc.exe
  2⤵
  PID:16836
- C:\Windows\System\pHUMfQj.exe
  C:\Windows\System\pHUMfQj.exe
  2⤵
  PID:16852
- C:\Windows\System\NohZwbG.exe
  C:\Windows\System\NohZwbG.exe
  2⤵
  PID:16868
- C:\Windows\System\XtTjCMG.exe
  C:\Windows\System\XtTjCMG.exe
  2⤵
  PID:16884
- C:\Windows\System\yCJKgBN.exe
  C:\Windows\System\yCJKgBN.exe
  2⤵
  PID:16900
- C:\Windows\System\rJCwwvk.exe
  C:\Windows\System\rJCwwvk.exe
  2⤵
  PID:16916
- C:\Windows\System\zuAMQVL.exe
  C:\Windows\System\zuAMQVL.exe
  2⤵
  PID:16932
- C:\Windows\System\zAxcKRP.exe
  C:\Windows\System\zAxcKRP.exe
  2⤵
  PID:16948
- C:\Windows\System\KXbIHcU.exe
  C:\Windows\System\KXbIHcU.exe
  2⤵
  PID:16964
- C:\Windows\System\aBSVJPL.exe
  C:\Windows\System\aBSVJPL.exe
  2⤵
  PID:16980
- C:\Windows\System\KNAoQQS.exe
  C:\Windows\System\KNAoQQS.exe
  2⤵
  PID:16996
- C:\Windows\System\bEdsVGO.exe
  C:\Windows\System\bEdsVGO.exe
  2⤵
  PID:17020
- C:\Windows\System\ovdiffa.exe
  C:\Windows\System\ovdiffa.exe
  2⤵
  PID:17044
- C:\Windows\System\kwBDnbK.exe
  C:\Windows\System\kwBDnbK.exe
  2⤵
  PID:17060
- C:\Windows\System\FFZIGcl.exe
  C:\Windows\System\FFZIGcl.exe
  2⤵
  PID:17076
- C:\Windows\System\dnkVJYd.exe
  C:\Windows\System\dnkVJYd.exe
  2⤵
  PID:17092
- C:\Windows\System\UUXEYKR.exe
  C:\Windows\System\UUXEYKR.exe
  2⤵
  PID:17108
- C:\Windows\System\nPMgBFp.exe
  C:\Windows\System\nPMgBFp.exe
  2⤵
  PID:17124
- C:\Windows\System\iPAqFha.exe
  C:\Windows\System\iPAqFha.exe
  2⤵
  PID:17140
- C:\Windows\System\BylTAjs.exe
  C:\Windows\System\BylTAjs.exe
  2⤵
  PID:17160
- C:\Windows\System\aVpIwcg.exe
  C:\Windows\System\aVpIwcg.exe
  2⤵
  PID:17176
- C:\Windows\System\vrCRhXP.exe
  C:\Windows\System\vrCRhXP.exe
  2⤵
  PID:17192
- C:\Windows\System\BuqfsYI.exe
  C:\Windows\System\BuqfsYI.exe
  2⤵
  PID:17208
- C:\Windows\System\CjbpvtP.exe
  C:\Windows\System\CjbpvtP.exe
  2⤵
  PID:17224
- C:\Windows\System\QGhdfrP.exe
  C:\Windows\System\QGhdfrP.exe
  2⤵
  PID:17240
- C:\Windows\System\RSCaQWY.exe
  C:\Windows\System\RSCaQWY.exe
  2⤵
  PID:17260
- C:\Windows\System\cyseXmj.exe
  C:\Windows\System\cyseXmj.exe
  2⤵
  PID:17284
- C:\Windows\System\nDCODAD.exe
  C:\Windows\System\nDCODAD.exe
  2⤵
  PID:17300
- C:\Windows\System\zXqMxmr.exe
  C:\Windows\System\zXqMxmr.exe
  2⤵
  PID:17316
- C:\Windows\System\YwOrGFc.exe
  C:\Windows\System\YwOrGFc.exe
  2⤵
  PID:17332
- C:\Windows\System\dgZkruT.exe
  C:\Windows\System\dgZkruT.exe
  2⤵
  PID:17348

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:14840

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:15160

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:14660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AMZoamK.exe

Filesize
1.4MB

MD5
2efaf26be43e526b4ede858114f86f48

SHA1
6c83246356450a075844d37ac378371f9a1d4868

SHA256
2271e078ade416feb9dfb356ca91efae67c73b8098bc060149061ccdcf23676f

SHA512
c8a6a0076d2d9968fe69450fdbac83a4360fd4aaa05074f5d56154f950b2fdabbb0a32da88682fb3ff5da142e1c8963fda8668c0bee1762db5fa5a0d031888bb

Download Submit
C:\Windows\System\ApGTmUX.exe

Filesize
1.4MB

MD5
2f4547a440d3f4870e4461655b16f7ee

SHA1
2d8e916b06fd1c27d16f0707ef0bf59cea38df16

SHA256
5676d3432bb87cc5f2db96aa834d86be1260ee9ce78ce188e341f66e8fd44277

SHA512
b853dfba23d66347efd46da319ff559b4049ed0107e537b6b4c927d9b50a2afaa5ad17f52c26571028c46080915ba8793382bb2d6f69f6ac667bdd468f98f925

Download Submit
C:\Windows\System\CTkIjMv.exe

Filesize
1.4MB

MD5
0194f506659b2eb67368e0a8785b39a9

SHA1
1926d67e35edbb930f59a29a9fba5dc4585a6192

SHA256
dc5bfdbfb41a9a2b5efeb03c0f829c766974673c46bbb6611dbc14f287a09f8c

SHA512
bf5ab751ee7c2e4857a4f86287611333a1c9a1920e82e3c429be818b1e48730b8bd6590c1b6a6c838fa8ba48f190275953a43710440add96359406f74c723aa3

Download Submit
C:\Windows\System\DItBoin.exe

Filesize
1.4MB

MD5
6c6318dbc7741dd919a758d3d81aa8db

SHA1
52ead588a96981a7729e688d7544394902a049bd

SHA256
31e0e1fcd1aa7e45e428995139880319882ccb2ee9116e3bd3ed17ee122d8e95

SHA512
fbd45442f1afdd95ac3c9dfce257430899726e7d8090b62c3818a4a3390a75ee46cd6813ba158d01fda9147aedbd743e3864718a870eeaa4a19a0c8c1a69ff47

Download Submit
C:\Windows\System\JbjAFiJ.exe

Filesize
1.4MB

MD5
92b38e3e45603472dd9fb3a00c3b7ddd

SHA1
015275f600c7b7da2bdf7a646ca526e6faf0c7eb

SHA256
e596449705aee31d770e02b2ef43df74ae092b832b37d492ec6f48897fc43edf

SHA512
2af4825331906e9982ea8f744edb7f65919a7ac0b0b2fd4e00cdef566d0de1d1890f619621858790fb72578288fd1a2200fd176345d35791a9050713a4bb0b2d

Download Submit
C:\Windows\System\KxEOSlq.exe

Filesize
1.4MB

MD5
9a453fcc143faa7c85563aa29dec78ec

SHA1
1e1d3ce73766a1a3f6fd0fc0d9f65c04da5fa501

SHA256
d2cb3525499a6e8c2d0a119f95b3c7daa88dc7f82d0ced8532ccc45b71cfef20

SHA512
aff311bdd5a04c8fb1f4a2e1f5b9ed7224f8aa445433805ba5aed738588886eba226261e3c6e654a55019a973f3e2cd23474ee80e7ad8aa613159fb8b3377202

Download Submit
C:\Windows\System\MSmXJvh.exe

Filesize
1.4MB

MD5
2631075ac4facdfc0b7565fbe5b2f9d0

SHA1
9d72d4333ea07516803474bac55d94bb3b7bae8f

SHA256
f1e4f7f9280fcb226f247ab157e7dcc9ce18b2b059093d553bd698a146c3e668

SHA512
319f905516d3e827e3a7c7f23ef0bb9c60b3aaab2951ce25406e29c11321a9148b8a9d968ac2046af2e517981c07244ce0bfe1ec1959a3519d3a9ab90e5b0e4d

Download Submit
C:\Windows\System\Mmowkkk.exe

Filesize
1.4MB

MD5
47b481e3d4b41aee1df62244038a9dc4

SHA1
bd1488fc862bf2252917681e86acb6ed34c0aae9

SHA256
92bc3ab6ddc73d8affeddf30cfc98de097a375448721dc2fb05f29712475d87d

SHA512
333dc546b8c1649ddf8519cf30a879b917b83d858ed9205dfa7c8100658bd6d3185632ff81ea358f5f1d35a85ae849ee7e2ebcc09b97277351fbdb1472d264ba

Download Submit
C:\Windows\System\OCZovge.exe

Filesize
1.4MB

MD5
feda4949e1571bbe0a9fb360709ae7c9

SHA1
3f1ef7e74f2497a80d90687ce9a71ecf1f22280a

SHA256
aac0afe89242026b20775019ba58958102a648cf84121adec08daa4d2ec27bb4

SHA512
b034fc40bae791ec449f4acf1a649e36285f1df2ea796072384c06778ba745b81228de3f5a3530e511b82cc7eeef90655eaa6c644ca1c2886097518ab5d8b933

Download Submit
C:\Windows\System\OGjojmR.exe

Filesize
1.4MB

MD5
b21281321b86526e036294b862a3fc1b

SHA1
a10f73f2b415b70bd5175fcf848260ad27e51090

SHA256
393ee3db8d27c9b0a184eed036866e880c3b1c4bcb6b40dff32b43e1c9b162ed

SHA512
e1be6d659eede8f230f935358e33efb4d7a9048a7b7a538977b5ae6d795d6aebe3fbb4e077a964f2ce7e17e790c703ac773fc23d41571fe2eaed992c16308cd6

Download Submit
C:\Windows\System\PzpZvIs.exe

Filesize
1.4MB

MD5
a09104c53b7de1252efba816f35a4387

SHA1
9add44ba731b1ff2ba83249379b5dcf022d898ed

SHA256
735ed86f6e4e8868d99a2cff74203eafecfb36f1dd8a31632aebb89499b17399

SHA512
7fd82935e3259453748f91d0acf21f7fce193e9099c783c3dafdf8431a0dfcf738ff7de008e997d2fa51f5567edf46ffc47d735916be13818f9aa7ea9269e407

Download Submit
C:\Windows\System\SUiPNIe.exe

Filesize
1.4MB

MD5
f9f67783fce8de4c59a4160243a934f0

SHA1
5a4b5e5c8f18ed3598306336ce91b83b93a0aa4d

SHA256
69814f930a0fb527385ec9e378165ebcf13b929943ba23a67ee2ad10e87db167

SHA512
055981b63e6ba308942c2b56f60ac6ba1d409e98494567b65067261e804576aa627a09e0870e122bfc63969eb6d825af4fe2bebbf3f34dc7b26feb4083477aa3

Download Submit
C:\Windows\System\SsdDIcR.exe

Filesize
1.4MB

MD5
ca16cdde8662525d4b175561bc5b83ea

SHA1
a6c86177aed35975ccfc480d60378b4f3e4a5110

SHA256
10ef5038db5fb6084de3542097a98ed0f8e9ddd6be2fe366fec25306d925c7e2

SHA512
3e19f5a798fb474d2a7019e8c52743e53004501f33d21d4b099a08c67ac31b8ff2c1e4f408614473d349b3d83b9738bf90dbd1bf70f22ac66cd395e2ec0fafa2

Download Submit
C:\Windows\System\TxSPMdj.exe

Filesize
1.4MB

MD5
f8f8152ee32afee2a32a32c69dd0599d

SHA1
a601e89a4f8b53c0011aa0ac79a6247966bfc380

SHA256
3e9106b2e126c867db84aee78e0ff09b837e1680330f19e51a67ece9f9436da5

SHA512
4325872518108b0f21e8fd872166e3c527df7d8b4a925bcb30e00d96759c26109d423fc2438204e3f1a88a28c2b1f46bdc3424485cb7434a35d38f5be2b47bb2

Download Submit
C:\Windows\System\UCdEcxP.exe

Filesize
1.4MB

MD5
29355d78f33378a9b9afca46bbe79091

SHA1
25fafba9d57c53e4145693a66c1c6959d66cbabb

SHA256
ae5c082a113eeaf39a9ca002e411262e18dd01dd38a1ea388a4cc2f20c45fa85

SHA512
1efea2738a2fb9ac7b2fbb1d85ecd2eb165fa70300c901a64f2abeacd7e48eb2186fdea241205902fe9f5049ee9f3c663d636caab4b7df868c9569105c897a46

Download Submit
C:\Windows\System\WXhwOnK.exe

Filesize
1.4MB

MD5
86c57ffde31e47e3feb5935dcc42bc07

SHA1
6dc7e3555d764292080a0f9e8080e0a77b01d1cd

SHA256
9ca9422d79aa386a863ef1f8455053b07ad0de56e7170abed833b1271f067fdf

SHA512
50dc48ec44b4bb04ca56c2e04b7ebafcfc3b2b05dfd3876598c2f639f025eadf763b1d9bc2cbda57bae81204510059eeb20989a8baa5de2b00e89b550a6b411f

Download Submit
C:\Windows\System\XbpUvMv.exe

Filesize
1.4MB

MD5
932b7f2816150efc77663560e0806537

SHA1
c6f52baae3f20319dd36adf6d3d7e2d86bb23a72

SHA256
17a8c8be4a0774755f4fca1491d065e7adcde2749732479126df63ca2441e701

SHA512
e42acf8519ce396bb32b54165c49c9acfa19af267915d8b64fa8465ad6e98f585d3ad15b159ab9dfc4d9941ec950937ce11c467c777bb049a849b11734a9514e

Download Submit
C:\Windows\System\bKxVxFH.exe

Filesize
1.4MB

MD5
9ae6271c929b9d21bd31324c17ed88ff

SHA1
15bdcf56560506d16019b8aa3833e1f9c1dfd8af

SHA256
916a89369be25f3efef17b286a1b4bed26d59faa3c4296d0e0b26128a8038dad

SHA512
52516be448a812b397434a4396a8c75fedf10cdf680bf2c075a01c05f556fa092a74d64a60062419ced00597fc35c75031b6c14dac54421ddd7055ba414e1ca8

Download Submit
C:\Windows\System\epkoZTi.exe

Filesize
1.4MB

MD5
f5cf78d4b1551380fd046e88421a129b

SHA1
8598cc65040d430bd1cd9eeae39453f16bd34ec9

SHA256
186e3c28e6e8be0f4493dcdc6965088772006a0f86b18fe2c4180cc77cd87443

SHA512
079818bd01c6a9eb0f9115f13c6bbaf658510a994957b0ac2b9a6df211785dfeec4d5b9848f03adada8a18e17a8ecd0beb60e4b3616f2ac70f4ec22c604d59ca

Download Submit
C:\Windows\System\gjEUztl.exe

Filesize
1.4MB

MD5
0866a589b9fbfe2c2e2f3effd6709319

SHA1
d50c18830f29f39bc7247c8d2f18cbfc6ce557ba

SHA256
0f578e362ab71182517775d584f73a9981ac6fa10634e646828936f2e48792e5

SHA512
2e59bb38edccd18e0339b5a4d4991ceb34b15e667ab7ae2d21e20b55ced41a7443f3599c9fc98c983dcf5f52a3925387f970cbfde2fb335e51f0733d57262fb1

Download Submit
C:\Windows\System\iGHUygk.exe

Filesize
1.4MB

MD5
6de2f0e95275dbd5ae0cfe54e8274dca

SHA1
f3dcc080b52faa385b1903d4b49f5b698bd9241d

SHA256
37eaf54ca4d8f7c5df6d9f0f5b230266abee2a4a7fcc0dc9ce15e15640ae729f

SHA512
e8eb20338535d209b41310ca7865ef0978bb2e4c75200ab1273683192c3abccbb2afc92666e96f9935153d1a3ecfb20172b8dabe1d57a2e10133ea8f73fab8f5

Download Submit
C:\Windows\System\kpHPBow.exe

Filesize
1.4MB

MD5
d15e8d393b9298db9a8c27f718f27139

SHA1
d94c8a8e24e4d4921c025b6aad03d76089589191

SHA256
26744613773cdfea4529e727cfee78a9af1742b2987b2d7f2840e52ed727343c

SHA512
920d9f30b9c9a64ced9417a2b57380bb05b500e171dd7cc0f19be04486b8dfad407a79bd8cddbc53af3aa423392f2ee08624e136af4c03c91070dc291916777e

Download Submit
C:\Windows\System\ljCMlXq.exe

Filesize
1.4MB

MD5
f397203a05df2458c2e65318c6c33997

SHA1
95eaab492aedef95c462b3592f3428f45d9dcb28

SHA256
4491d1b219b97375c863c09298ee40aee51a323edf309296c557a158b9d2f09b

SHA512
b1ce196e1703e75de5df8887635087a17a364db928de092ae485d3538016585c737a64cfe110dc708107015bce40f654499233aadbe18f786f1de230623fb767

Download Submit
C:\Windows\System\mWHPQvn.exe

Filesize
1.4MB

MD5
b66465014accf8264099a7adde683412

SHA1
0ec97278fa83bca5ec8ccbc3fb84cb0dac1a0343

SHA256
69859e1e78c9ec58a3f7b98e40e2fcaeb091470683821a1cc49fa062918550b6

SHA512
64fb8a56dbe20bac6ce058aaba741abb6c588e5a3e8ccfc426d94b3f9078e9ceba3bdb40f2f761b78f69157a9bf5d9a0f48d4666dc0093317b88aa927d34f336

Download Submit
C:\Windows\System\nETGGko.exe

Filesize
1.4MB

MD5
3a64b3b5ca5499496dd0e5b26b1fcbc3

SHA1
333703967d3c70cd77f42e51469d6eb3f95fb24a

SHA256
a2f39f66e09253d0016c860ca13469ccf1e1843820a0b9bfd06fce91930ab3af

SHA512
2b3d30f50ce46f95efdfa1e168eec0de839c5512502887440e56691a054a2a741d6f3998cf1a0d0131c2f8e8f9517b5ceec77457f2be1b3e04b5521a468cf591

Download Submit
C:\Windows\System\oWfxsKO.exe

Filesize
1.4MB

MD5
ae5dbbb32e61ccc60f41aa397fe715bf

SHA1
f1d87fc4987c456a412790fd1a3613870554e855

SHA256
d081453c182c09b137f5d51e8b3320ac13842c2120913664041d3dcae3d9d44e

SHA512
300a4fa4f88fd206739daf670e9af9423f13a4021de96629d9ecdeccb7991f66091938a9b2d5279d2dc267feb5888b7d6e23c12f920603fa0b99c577438ad31f

Download Submit
C:\Windows\System\ptKnwTw.exe

Filesize
1.4MB

MD5
78c255ab0e80cc4562b895681363a1a6

SHA1
cfd1bb9075f6e92b31f90b445cc018091c09f029

SHA256
508d8a4f40ca29b12e20b7201069d4366cda7e141a0c616f63027d970f18cf39

SHA512
0d744bead54a9f27d40f76a04ef867a08570258ef4411196c51737193c39a71723ecd1991ac897b7b52300bcfa4276fcd92d62ecb426f805bda20f341e05d3bf

Download Submit
C:\Windows\System\qEwOULL.exe

Filesize
1.4MB

MD5
c05121cbaf2a6c5e7f4942b85e5d6093

SHA1
76bd7d13b4b62f22822e4278b7ae2bbc8d916382

SHA256
a37dd2d6436f865568ebca4f778425fa95219da0bd2d1a2d61c345c56f068f3e

SHA512
c2cdac0ea9dde1a294457c938ecee49accf291e4847863d6e263b437d3366ea0f2aaba09c59455fe2d5eaef55f5820ee48ec38a1d1882ac92781f9845c4e38f0

Download Submit
C:\Windows\System\qYdZjIS.exe

Filesize
1.4MB

MD5
f24197e180eb77946241632a5b157c46

SHA1
8a4379923daa9c8d57d5c690eb67608da0b27c0b

SHA256
e07f6bebc1389202525c4a2dab2346ff08630f1163d9395ffc125534afb7371a

SHA512
6b18dd44855ac953b2031b14d77a528068b990a614ffc44385c6570d6f69ff2ad4dbe10c51e678a5f374abd162ba36a051c5c3306ecd8a1ab5b19a3143a3503f

Download Submit
C:\Windows\System\sWtOZUK.exe

Filesize
1.4MB

MD5
859f0a52e22cb2a3b34be9168cd26051

SHA1
ecc18f24c2ff5810149fdc1c6efcbb05cd11230f

SHA256
c41a2834dd83251c30f31b51d559d37b8682b4eccf90b204d0b6ba499a253c26

SHA512
53485a51e89ff6114f677fba6ae0013a4e87add90be1d6f5419d9d0fdd60ee2589d56c789763ca54012a4d79619eb3a0293a6dc8a13c782bebfbe4ba6c8fe50e

Download Submit
C:\Windows\System\tTIWPyO.exe

Filesize
1.4MB

MD5
e1c84f2ee01ff4cd09542313bd6ec4bc

SHA1
78599c59b7f669c56c9ade201b7c8f125c9a9b60

SHA256
c80f4e9605bca7bacf5b8f69817dbb39f4210660278d614bf80b322f143206f8

SHA512
1118651865adab96f27c3bef2b7eae51fd03c588040fb000614a4d1ed66f739e19cd57496db8464cffc8bc1642723c21e124c6e455e3d3ed9753e6b1fde8c46e

Download Submit
C:\Windows\System\uCECcMD.exe

Filesize
1.4MB

MD5
dc99fca325e5dc5db5030c70887f4f6b

SHA1
717cce338b2d6cf56fd742172ee7c28083bc89a0

SHA256
9c10eac3b36e68de666b06da4158448fb2386540a59750c5d37e808bb116d234

SHA512
1ded69277fa7923aef777449b7f0e4bd308039ecd6c9d9cb5968796c4ff879b1dff796b46eaad6099f71cd9c128b28dc78519f92bf69bdcd6855e5069a2c53a6

Download Submit
C:\Windows\System\uxqoIoU.exe

Filesize
1.4MB

MD5
ff43c4e0f9213f2edcccaf8768137327

SHA1
cb3ac57072d168f1083a1baba8414e30a9ba8d6a

SHA256
65e98cbc60884ab842107e1ca2d9329e71d3e593f0b886d86e00189a7b2e9488

SHA512
649f713ee647616ba567f616e2570e1c55cea858166351b386b554401e0b39c3820c9f0aa79c79881ef79218eee139a6eba1a122423d3ba6d8e698da3e775320

Download Submit
C:\Windows\System\vVqQIuJ.exe

Filesize
1.4MB

MD5
3550f252a475d27ad4b5e855e36fdfe2

SHA1
a90d75fd01cd229e553443e963669c58e8523f28

SHA256
594ec89a624e8d9b747e512e6ffdd5fccf67ef0eeb2993be2e5ecf548d965158

SHA512
9a6623b03d50bf346726ba5692eee5ed5a654c2053c5863012b0cc0db4739b2d075097da17ba72fd68b78cb2d8ab6a8f7eab2a74467517c0c06bf9aaee6f0b2a

Download Submit
C:\Windows\System\wqshanW.exe

Filesize
1.4MB

MD5
42357250b023c401876928b525d3c23f

SHA1
dd8252432f7f10ab5d61f033094e4a7195337a42

SHA256
7d3771f786a37ddbe9fe9557035b480b96100bf27c3d225a7f32d89cf3d3579e

SHA512
ebe1ce5eea8b3465c395da33b46e9e3bbe08fe82f148a4890a9a21b7785396b6e8a677e9ba04bfdc41c2571c45e811aa218ac1d4ad53dd858983a34498c55f53

Download Submit
C:\Windows\System\yOJUquo.exe

Filesize
1.4MB

MD5
4045c7c6b688fc0742f53c4f73b956c7

SHA1
e1abde1d424b4761322d0373302086322de317aa

SHA256
440cd5751109367fbbce07227f93a710da8334e159ac8ef66e1e44413a1083b0

SHA512
32abba5e6ac522396a3cc3316748124e5ec7c4c67dc091820d07fa4e70c7ec137fe8a06ab784f00bcb4af6c3f12dee7f168454827f91b88592ff43cc999b4545

Download Submit
C:\Windows\System\yVNhrpt.exe

Filesize
1.4MB

MD5
763cf845408726511d4e54bbbf50ffec

SHA1
768848835482d2f67aad4655befb22a2dfc8ff88

SHA256
00f9d91f4ab2a43dc2f28234996d85b8c22866bccd4180f7582e664f1b41c373

SHA512
d9f83255240f60ea0a86aa4e729e3d7048efad83efec41971ee7802819839125d290d5c65e3806e57b57b501e1eb07607ea1effde10d57f90826d4fc8478ea5b

Download Submit
memory/4884-0-0x00000216F2E60000-0x00000216F2E70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads