xmrig | 7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a

Analysis

max time kernel
96s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 23:47 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
Size

1.4MB
MD5

74f78b88804488d351804834c0f95bca
SHA1

681bf7018366bd04706f7d9d7ceff3d2e53f898b
SHA256

7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a
SHA512

f953861b5bb049166aeb7e90adfb534f76aba28678bec237f243b6c3c93877ccb43bc001ab7e010cd345e4777e2f113fa1be2b90ecd6ec02917effeba10ab047
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IsSAN0zZ1C:GezaTF8FcNkNdfE0pZ9ozttwIRakGNrN

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023ca2-4.dat	xmrig
behavioral2/files/0x0007000000023ca6-9.dat	xmrig
behavioral2/files/0x0007000000023ca7-8.dat	xmrig
behavioral2/files/0x0007000000023ca8-17.dat	xmrig
behavioral2/files/0x0007000000023ca9-23.dat	xmrig
behavioral2/files/0x0007000000023caa-33.dat	xmrig
behavioral2/files/0x0007000000023cab-38.dat	xmrig
behavioral2/files/0x0007000000023cac-37.dat	xmrig
behavioral2/files/0x0007000000023cae-47.dat	xmrig
behavioral2/files/0x0007000000023cb0-63.dat	xmrig
behavioral2/files/0x0007000000023cb3-74.dat	xmrig
behavioral2/files/0x0007000000023cb4-82.dat	xmrig
behavioral2/files/0x0007000000023cb7-98.dat	xmrig
behavioral2/files/0x0007000000023cbd-122.dat	xmrig
behavioral2/files/0x0007000000023cc0-137.dat	xmrig
behavioral2/files/0x0007000000023cc3-152.dat	xmrig
behavioral2/files/0x0007000000023cc5-162.dat	xmrig
behavioral2/files/0x0007000000023cc4-157.dat	xmrig
behavioral2/files/0x0007000000023cc2-155.dat	xmrig
behavioral2/files/0x0007000000023cc1-150.dat	xmrig
behavioral2/files/0x0007000000023cbf-140.dat	xmrig
behavioral2/files/0x0007000000023cbe-135.dat	xmrig
behavioral2/files/0x0007000000023cbc-125.dat	xmrig
behavioral2/files/0x0007000000023cbb-120.dat	xmrig
behavioral2/files/0x0007000000023cba-113.dat	xmrig
behavioral2/files/0x0007000000023cb9-108.dat	xmrig
behavioral2/files/0x0007000000023cb8-102.dat	xmrig
behavioral2/files/0x0007000000023cb6-90.dat	xmrig
behavioral2/files/0x0007000000023cb5-88.dat	xmrig
behavioral2/files/0x0007000000023cb2-72.dat	xmrig
behavioral2/files/0x0007000000023cb1-68.dat	xmrig
behavioral2/files/0x0007000000023caf-58.dat	xmrig
behavioral2/files/0x0007000000023cad-48.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4992	GghakFu.exe
4204	ioJFgZT.exe
5032	uEuqodF.exe
4584	MZZmbQy.exe
2732	MRZslzE.exe
1612	FQHYTLe.exe
4908	UfEGtYR.exe
1800	IFuywOi.exe
2380	mzjLyNI.exe
2204	fAsnnCl.exe
1908	ooExBKo.exe
2664	bHeNfCN.exe
3348	bCyOqhm.exe
60	LZmxlGU.exe
1088	Rnlopii.exe
4844	TLTMrwk.exe
1952	lzPmhig.exe
5080	rzhcKKw.exe
1688	BJdAXhu.exe
5092	hisPDmK.exe
1888	vgBsxfb.exe
4260	ZhqnXSj.exe
4288	TgyMlxP.exe
1804	kPRCZUi.exe
2456	LkVLHDS.exe
2984	aaPkrOq.exe
5064	oruAPzv.exe
2956	YuLfsnh.exe
8	YJUDfaC.exe
2060	QRlSlRx.exe
2944	yHtgiEK.exe
2764	UjtlKqX.exe
4808	uIzFThq.exe
3712	DzsECVT.exe
3772	daXJukh.exe
916	cDNPJod.exe
3516	rySOFfG.exe
1444	GDPIMgs.exe
4792	nIDYObz.exe
4988	ufPMdut.exe
1424	vNszzVG.exe
1788	XmcVUxA.exe
3308	SqMiCJw.exe
2088	HvPpDjv.exe
664	gdDwdUB.exe
4920	bdScXJE.exe
852	jodMvOE.exe
3812	FtMxYAQ.exe
2004	wMVQKJy.exe
1592	nlCEkYE.exe
2896	sGpUaAM.exe
4088	FMWYwyV.exe
3328	SomKRBr.exe
2668	JXzyEhX.exe
4164	HVEaUHu.exe
4636	xjRcByF.exe
1176	boKEEMa.exe
3584	dmmtLiy.exe
4300	VHlvUPp.exe
4436	DwRprJH.exe
4704	BjgdNzO.exe
1460	UxEhxYK.exe
3836	jrlUrvq.exe
3448	KDzdogd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TCHhBsN.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\cpunviA.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\iXySwfi.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\hWrKnKC.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\HDsdsnk.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\gTxFxKB.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\hsbdrTG.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\xwqvhbv.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\Nejfpym.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\BLUJxBv.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\ozLYwGz.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\GeItlmK.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\cLgGuqm.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\fDqQllb.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\AFfxzNl.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\SWwUFxm.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\kEIOGUP.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\QhqmIrs.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\uEuqodF.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\VFlRtSi.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\sNavRDv.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\QgFwdfZ.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\riILEoI.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\WjbSHqk.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\owlyqTR.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\Mhthxow.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\uHhoYPO.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\ooExBKo.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\RgYEyca.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\JSGwpXI.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\GDPvAzC.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\EWGGTqT.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\NejFTFN.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\UXxmCZL.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\DLaOYPl.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\DZGQqzd.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\ZeOCXwn.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\hZPSsgI.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\gUQqibd.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\qzbnWKY.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\EPTFkwB.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\RKuGWmb.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\WgcUNkL.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\ZhWNgwr.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\uWoWOue.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\wzqtVDP.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\FMjiMSM.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\XzVChSI.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\KrIMiuS.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\RUCqZeC.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\UyyMERd.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\yNXPBju.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\UjtlKqX.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\ULWsrTo.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\XJeMiBH.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\JmICoWb.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\AfloAUT.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\hjandww.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\uPtxDOa.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\YuWbylL.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\BwDKvLe.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\iOrGtfF.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\wdOaLFJ.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
File created	C:\Windows\System\QrSAvga.exe	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4992	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	83
PID 4956 wrote to memory of 4992	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	83
PID 4956 wrote to memory of 4204	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	84
PID 4956 wrote to memory of 4204	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	84
PID 4956 wrote to memory of 5032	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	85
PID 4956 wrote to memory of 5032	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	85
PID 4956 wrote to memory of 4584	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	86
PID 4956 wrote to memory of 4584	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	86
PID 4956 wrote to memory of 2732	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	87
PID 4956 wrote to memory of 2732	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	87
PID 4956 wrote to memory of 1612	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	88
PID 4956 wrote to memory of 1612	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	88
PID 4956 wrote to memory of 4908	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	89
PID 4956 wrote to memory of 4908	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	89
PID 4956 wrote to memory of 1800	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	90
PID 4956 wrote to memory of 1800	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	90
PID 4956 wrote to memory of 2380	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	91
PID 4956 wrote to memory of 2380	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	91
PID 4956 wrote to memory of 2204	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	92
PID 4956 wrote to memory of 2204	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	92
PID 4956 wrote to memory of 1908	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	93
PID 4956 wrote to memory of 1908	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	93
PID 4956 wrote to memory of 2664	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	94
PID 4956 wrote to memory of 2664	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	94
PID 4956 wrote to memory of 3348	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	95
PID 4956 wrote to memory of 3348	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	95
PID 4956 wrote to memory of 60	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	96
PID 4956 wrote to memory of 60	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	96
PID 4956 wrote to memory of 1088	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	97
PID 4956 wrote to memory of 1088	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	97
PID 4956 wrote to memory of 4844	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	98
PID 4956 wrote to memory of 4844	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	98
PID 4956 wrote to memory of 1952	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	99
PID 4956 wrote to memory of 1952	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	99
PID 4956 wrote to memory of 5080	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	100
PID 4956 wrote to memory of 5080	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	100
PID 4956 wrote to memory of 1688	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	101
PID 4956 wrote to memory of 1688	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	101
PID 4956 wrote to memory of 5092	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	102
PID 4956 wrote to memory of 5092	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	102
PID 4956 wrote to memory of 1888	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	103
PID 4956 wrote to memory of 1888	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	103
PID 4956 wrote to memory of 4260	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	104
PID 4956 wrote to memory of 4260	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	104
PID 4956 wrote to memory of 4288	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	105
PID 4956 wrote to memory of 4288	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	105
PID 4956 wrote to memory of 1804	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	106
PID 4956 wrote to memory of 1804	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	106
PID 4956 wrote to memory of 2456	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	107
PID 4956 wrote to memory of 2456	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	107
PID 4956 wrote to memory of 2984	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	108
PID 4956 wrote to memory of 2984	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	108
PID 4956 wrote to memory of 5064	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	109
PID 4956 wrote to memory of 5064	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	109
PID 4956 wrote to memory of 2956	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	110
PID 4956 wrote to memory of 2956	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	110
PID 4956 wrote to memory of 8	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	111
PID 4956 wrote to memory of 8	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	111
PID 4956 wrote to memory of 2060	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	112
PID 4956 wrote to memory of 2060	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	112
PID 4956 wrote to memory of 2944	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	113
PID 4956 wrote to memory of 2944	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	113
PID 4956 wrote to memory of 2764	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	114
PID 4956 wrote to memory of 2764	4956	7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe	114

C:\Users\Admin\AppData\Local\Temp\7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe
"C:\Users\Admin\AppData\Local\Temp\7c0b6243c3e3f6bf236ee23954f0c262bc6fa23142c69d3f24477344a98fa01a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\System\GghakFu.exe
  C:\Windows\System\GghakFu.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\ioJFgZT.exe
  C:\Windows\System\ioJFgZT.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\uEuqodF.exe
  C:\Windows\System\uEuqodF.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\MZZmbQy.exe
  C:\Windows\System\MZZmbQy.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\MRZslzE.exe
  C:\Windows\System\MRZslzE.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\FQHYTLe.exe
  C:\Windows\System\FQHYTLe.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\UfEGtYR.exe
  C:\Windows\System\UfEGtYR.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\IFuywOi.exe
  C:\Windows\System\IFuywOi.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\mzjLyNI.exe
  C:\Windows\System\mzjLyNI.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\fAsnnCl.exe
  C:\Windows\System\fAsnnCl.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ooExBKo.exe
  C:\Windows\System\ooExBKo.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\bHeNfCN.exe
  C:\Windows\System\bHeNfCN.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\bCyOqhm.exe
  C:\Windows\System\bCyOqhm.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\LZmxlGU.exe
  C:\Windows\System\LZmxlGU.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\Rnlopii.exe
  C:\Windows\System\Rnlopii.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\TLTMrwk.exe
  C:\Windows\System\TLTMrwk.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\lzPmhig.exe
  C:\Windows\System\lzPmhig.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\rzhcKKw.exe
  C:\Windows\System\rzhcKKw.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\BJdAXhu.exe
  C:\Windows\System\BJdAXhu.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\hisPDmK.exe
  C:\Windows\System\hisPDmK.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\vgBsxfb.exe
  C:\Windows\System\vgBsxfb.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\ZhqnXSj.exe
  C:\Windows\System\ZhqnXSj.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\TgyMlxP.exe
  C:\Windows\System\TgyMlxP.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\kPRCZUi.exe
  C:\Windows\System\kPRCZUi.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\LkVLHDS.exe
  C:\Windows\System\LkVLHDS.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\aaPkrOq.exe
  C:\Windows\System\aaPkrOq.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\oruAPzv.exe
  C:\Windows\System\oruAPzv.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\YuLfsnh.exe
  C:\Windows\System\YuLfsnh.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\YJUDfaC.exe
  C:\Windows\System\YJUDfaC.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\QRlSlRx.exe
  C:\Windows\System\QRlSlRx.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\yHtgiEK.exe
  C:\Windows\System\yHtgiEK.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\UjtlKqX.exe
  C:\Windows\System\UjtlKqX.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\uIzFThq.exe
  C:\Windows\System\uIzFThq.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\DzsECVT.exe
  C:\Windows\System\DzsECVT.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\daXJukh.exe
  C:\Windows\System\daXJukh.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\cDNPJod.exe
  C:\Windows\System\cDNPJod.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\rySOFfG.exe
  C:\Windows\System\rySOFfG.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\GDPIMgs.exe
  C:\Windows\System\GDPIMgs.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\nIDYObz.exe
  C:\Windows\System\nIDYObz.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\ufPMdut.exe
  C:\Windows\System\ufPMdut.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\vNszzVG.exe
  C:\Windows\System\vNszzVG.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\XmcVUxA.exe
  C:\Windows\System\XmcVUxA.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\SqMiCJw.exe
  C:\Windows\System\SqMiCJw.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\HvPpDjv.exe
  C:\Windows\System\HvPpDjv.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\gdDwdUB.exe
  C:\Windows\System\gdDwdUB.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\bdScXJE.exe
  C:\Windows\System\bdScXJE.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\jodMvOE.exe
  C:\Windows\System\jodMvOE.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\FtMxYAQ.exe
  C:\Windows\System\FtMxYAQ.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\wMVQKJy.exe
  C:\Windows\System\wMVQKJy.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\nlCEkYE.exe
  C:\Windows\System\nlCEkYE.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\sGpUaAM.exe
  C:\Windows\System\sGpUaAM.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\FMWYwyV.exe
  C:\Windows\System\FMWYwyV.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\SomKRBr.exe
  C:\Windows\System\SomKRBr.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\JXzyEhX.exe
  C:\Windows\System\JXzyEhX.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\HVEaUHu.exe
  C:\Windows\System\HVEaUHu.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\xjRcByF.exe
  C:\Windows\System\xjRcByF.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\boKEEMa.exe
  C:\Windows\System\boKEEMa.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\dmmtLiy.exe
  C:\Windows\System\dmmtLiy.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\VHlvUPp.exe
  C:\Windows\System\VHlvUPp.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\DwRprJH.exe
  C:\Windows\System\DwRprJH.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\BjgdNzO.exe
  C:\Windows\System\BjgdNzO.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\UxEhxYK.exe
  C:\Windows\System\UxEhxYK.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\jrlUrvq.exe
  C:\Windows\System\jrlUrvq.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\KDzdogd.exe
  C:\Windows\System\KDzdogd.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\sNHodQM.exe
  C:\Windows\System\sNHodQM.exe
  2⤵
  PID:1344
- C:\Windows\System\DRphvSm.exe
  C:\Windows\System\DRphvSm.exe
  2⤵
  PID:1108
- C:\Windows\System\DSJJItI.exe
  C:\Windows\System\DSJJItI.exe
  2⤵
  PID:2940
- C:\Windows\System\SZPqRsP.exe
  C:\Windows\System\SZPqRsP.exe
  2⤵
  PID:3820
- C:\Windows\System\bFBhzoK.exe
  C:\Windows\System\bFBhzoK.exe
  2⤵
  PID:3740
- C:\Windows\System\OytPpcX.exe
  C:\Windows\System\OytPpcX.exe
  2⤵
  PID:2560
- C:\Windows\System\gAbIdke.exe
  C:\Windows\System\gAbIdke.exe
  2⤵
  PID:3996
- C:\Windows\System\FlxdIZU.exe
  C:\Windows\System\FlxdIZU.exe
  2⤵
  PID:2220
- C:\Windows\System\jNDLFcu.exe
  C:\Windows\System\jNDLFcu.exe
  2⤵
  PID:464
- C:\Windows\System\OckPROW.exe
  C:\Windows\System\OckPROW.exe
  2⤵
  PID:2052
- C:\Windows\System\leNjKFO.exe
  C:\Windows\System\leNjKFO.exe
  2⤵
  PID:3080
- C:\Windows\System\wPgqVKH.exe
  C:\Windows\System\wPgqVKH.exe
  2⤵
  PID:2164
- C:\Windows\System\FoHgzQX.exe
  C:\Windows\System\FoHgzQX.exe
  2⤵
  PID:4076
- C:\Windows\System\lGwcdxE.exe
  C:\Windows\System\lGwcdxE.exe
  2⤵
  PID:2824
- C:\Windows\System\xPpxCEl.exe
  C:\Windows\System\xPpxCEl.exe
  2⤵
  PID:3104
- C:\Windows\System\DAFkKjU.exe
  C:\Windows\System\DAFkKjU.exe
  2⤵
  PID:1724
- C:\Windows\System\bzXgpNR.exe
  C:\Windows\System\bzXgpNR.exe
  2⤵
  PID:4964
- C:\Windows\System\wMkkWtO.exe
  C:\Windows\System\wMkkWtO.exe
  2⤵
  PID:3756
- C:\Windows\System\PZNomCy.exe
  C:\Windows\System\PZNomCy.exe
  2⤵
  PID:3352
- C:\Windows\System\sJndqcY.exe
  C:\Windows\System\sJndqcY.exe
  2⤵
  PID:4516
- C:\Windows\System\JvniSCP.exe
  C:\Windows\System\JvniSCP.exe
  2⤵
  PID:2260
- C:\Windows\System\poXCtef.exe
  C:\Windows\System\poXCtef.exe
  2⤵
  PID:4952
- C:\Windows\System\jItceec.exe
  C:\Windows\System\jItceec.exe
  2⤵
  PID:220
- C:\Windows\System\RGLsNpv.exe
  C:\Windows\System\RGLsNpv.exe
  2⤵
  PID:556
- C:\Windows\System\IQFgbDs.exe
  C:\Windows\System\IQFgbDs.exe
  2⤵
  PID:3728
- C:\Windows\System\ukPDbmY.exe
  C:\Windows\System\ukPDbmY.exe
  2⤵
  PID:552
- C:\Windows\System\NajNtFa.exe
  C:\Windows\System\NajNtFa.exe
  2⤵
  PID:2064
- C:\Windows\System\ZQJiqgI.exe
  C:\Windows\System\ZQJiqgI.exe
  2⤵
  PID:2672
- C:\Windows\System\WDYXBYC.exe
  C:\Windows\System\WDYXBYC.exe
  2⤵
  PID:1308
- C:\Windows\System\qgbummF.exe
  C:\Windows\System\qgbummF.exe
  2⤵
  PID:1236
- C:\Windows\System\OUnCjVl.exe
  C:\Windows\System\OUnCjVl.exe
  2⤵
  PID:388
- C:\Windows\System\enmGArV.exe
  C:\Windows\System\enmGArV.exe
  2⤵
  PID:4256
- C:\Windows\System\BLVpSKc.exe
  C:\Windows\System\BLVpSKc.exe
  2⤵
  PID:1292
- C:\Windows\System\mGcsYyP.exe
  C:\Windows\System\mGcsYyP.exe
  2⤵
  PID:4248
- C:\Windows\System\TfKzJvF.exe
  C:\Windows\System\TfKzJvF.exe
  2⤵
  PID:1516
- C:\Windows\System\SMvNUbK.exe
  C:\Windows\System\SMvNUbK.exe
  2⤵
  PID:3164
- C:\Windows\System\OOFPgKD.exe
  C:\Windows\System\OOFPgKD.exe
  2⤵
  PID:316
- C:\Windows\System\YFEVVXY.exe
  C:\Windows\System\YFEVVXY.exe
  2⤵
  PID:1220
- C:\Windows\System\ecMWuTm.exe
  C:\Windows\System\ecMWuTm.exe
  2⤵
  PID:1620
- C:\Windows\System\hZPSsgI.exe
  C:\Windows\System\hZPSsgI.exe
  2⤵
  PID:3260
- C:\Windows\System\CvFrWwG.exe
  C:\Windows\System\CvFrWwG.exe
  2⤵
  PID:404
- C:\Windows\System\WjbSHqk.exe
  C:\Windows\System\WjbSHqk.exe
  2⤵
  PID:3980
- C:\Windows\System\XQXdrRK.exe
  C:\Windows\System\XQXdrRK.exe
  2⤵
  PID:4308
- C:\Windows\System\DLaOYPl.exe
  C:\Windows\System\DLaOYPl.exe
  2⤵
  PID:2680
- C:\Windows\System\sOsllew.exe
  C:\Windows\System\sOsllew.exe
  2⤵
  PID:2936
- C:\Windows\System\YlqHDZf.exe
  C:\Windows\System\YlqHDZf.exe
  2⤵
  PID:1452
- C:\Windows\System\kpIUyub.exe
  C:\Windows\System\kpIUyub.exe
  2⤵
  PID:4092
- C:\Windows\System\UWhtEhr.exe
  C:\Windows\System\UWhtEhr.exe
  2⤵
  PID:1384
- C:\Windows\System\mgVUNLj.exe
  C:\Windows\System\mgVUNLj.exe
  2⤵
  PID:980
- C:\Windows\System\SMtWaHA.exe
  C:\Windows\System\SMtWaHA.exe
  2⤵
  PID:4508
- C:\Windows\System\QGevTUB.exe
  C:\Windows\System\QGevTUB.exe
  2⤵
  PID:540
- C:\Windows\System\ERsQxnL.exe
  C:\Windows\System\ERsQxnL.exe
  2⤵
  PID:3044
- C:\Windows\System\PvTUUCj.exe
  C:\Windows\System\PvTUUCj.exe
  2⤵
  PID:2284
- C:\Windows\System\CYiGIQb.exe
  C:\Windows\System\CYiGIQb.exe
  2⤵
  PID:516
- C:\Windows\System\OZolZkK.exe
  C:\Windows\System\OZolZkK.exe
  2⤵
  PID:3644
- C:\Windows\System\AJvdxnI.exe
  C:\Windows\System\AJvdxnI.exe
  2⤵
  PID:2316
- C:\Windows\System\DIYpEIz.exe
  C:\Windows\System\DIYpEIz.exe
  2⤵
  PID:4108
- C:\Windows\System\JtBlwLb.exe
  C:\Windows\System\JtBlwLb.exe
  2⤵
  PID:5168
- C:\Windows\System\aKtWTbL.exe
  C:\Windows\System\aKtWTbL.exe
  2⤵
  PID:5196
- C:\Windows\System\vKwbZvc.exe
  C:\Windows\System\vKwbZvc.exe
  2⤵
  PID:5228
- C:\Windows\System\NQkUSJv.exe
  C:\Windows\System\NQkUSJv.exe
  2⤵
  PID:5248
- C:\Windows\System\aUANKJF.exe
  C:\Windows\System\aUANKJF.exe
  2⤵
  PID:5284
- C:\Windows\System\fyfEKDJ.exe
  C:\Windows\System\fyfEKDJ.exe
  2⤵
  PID:5304
- C:\Windows\System\YMeXznO.exe
  C:\Windows\System\YMeXznO.exe
  2⤵
  PID:5344
- C:\Windows\System\QGkOJAy.exe
  C:\Windows\System\QGkOJAy.exe
  2⤵
  PID:5372
- C:\Windows\System\LftYIDz.exe
  C:\Windows\System\LftYIDz.exe
  2⤵
  PID:5392
- C:\Windows\System\PCZzOEt.exe
  C:\Windows\System\PCZzOEt.exe
  2⤵
  PID:5424
- C:\Windows\System\IoQGddA.exe
  C:\Windows\System\IoQGddA.exe
  2⤵
  PID:5476
- C:\Windows\System\qNaHHlP.exe
  C:\Windows\System\qNaHHlP.exe
  2⤵
  PID:5492
- C:\Windows\System\MuBdTpo.exe
  C:\Windows\System\MuBdTpo.exe
  2⤵
  PID:5508
- C:\Windows\System\NAhOZgL.exe
  C:\Windows\System\NAhOZgL.exe
  2⤵
  PID:5536
- C:\Windows\System\mGwuerQ.exe
  C:\Windows\System\mGwuerQ.exe
  2⤵
  PID:5564
- C:\Windows\System\FyeHIsZ.exe
  C:\Windows\System\FyeHIsZ.exe
  2⤵
  PID:5592
- C:\Windows\System\SWwUFxm.exe
  C:\Windows\System\SWwUFxm.exe
  2⤵
  PID:5612
- C:\Windows\System\aNKXIKr.exe
  C:\Windows\System\aNKXIKr.exe
  2⤵
  PID:5632
- C:\Windows\System\TKxwiin.exe
  C:\Windows\System\TKxwiin.exe
  2⤵
  PID:5660
- C:\Windows\System\rzQoDrP.exe
  C:\Windows\System\rzQoDrP.exe
  2⤵
  PID:5680
- C:\Windows\System\ZiazZpo.exe
  C:\Windows\System\ZiazZpo.exe
  2⤵
  PID:5704
- C:\Windows\System\bOXvHql.exe
  C:\Windows\System\bOXvHql.exe
  2⤵
  PID:5740
- C:\Windows\System\WWgBmOO.exe
  C:\Windows\System\WWgBmOO.exe
  2⤵
  PID:5772
- C:\Windows\System\uVLSpeS.exe
  C:\Windows\System\uVLSpeS.exe
  2⤵
  PID:5800
- C:\Windows\System\lGfZIAm.exe
  C:\Windows\System\lGfZIAm.exe
  2⤵
  PID:5832
- C:\Windows\System\enWmmWp.exe
  C:\Windows\System\enWmmWp.exe
  2⤵
  PID:5860
- C:\Windows\System\AchMtwP.exe
  C:\Windows\System\AchMtwP.exe
  2⤵
  PID:5880
- C:\Windows\System\mvCRSpq.exe
  C:\Windows\System\mvCRSpq.exe
  2⤵
  PID:5928
- C:\Windows\System\zaywbcT.exe
  C:\Windows\System\zaywbcT.exe
  2⤵
  PID:5968
- C:\Windows\System\pnPTfnW.exe
  C:\Windows\System\pnPTfnW.exe
  2⤵
  PID:5996
- C:\Windows\System\WXCQEOj.exe
  C:\Windows\System\WXCQEOj.exe
  2⤵
  PID:6024
- C:\Windows\System\PgvZbsv.exe
  C:\Windows\System\PgvZbsv.exe
  2⤵
  PID:6052
- C:\Windows\System\ePAogho.exe
  C:\Windows\System\ePAogho.exe
  2⤵
  PID:6068
- C:\Windows\System\zjNlJnE.exe
  C:\Windows\System\zjNlJnE.exe
  2⤵
  PID:6084
- C:\Windows\System\VKOAcyH.exe
  C:\Windows\System\VKOAcyH.exe
  2⤵
  PID:6128
- C:\Windows\System\IepdhdJ.exe
  C:\Windows\System\IepdhdJ.exe
  2⤵
  PID:1540
- C:\Windows\System\HDljLLe.exe
  C:\Windows\System\HDljLLe.exe
  2⤵
  PID:5220
- C:\Windows\System\rZkgkoU.exe
  C:\Windows\System\rZkgkoU.exe
  2⤵
  PID:5260
- C:\Windows\System\wsclsDK.exe
  C:\Windows\System\wsclsDK.exe
  2⤵
  PID:5360
- C:\Windows\System\qpVJLVi.exe
  C:\Windows\System\qpVJLVi.exe
  2⤵
  PID:5400
- C:\Windows\System\UaJWgpp.exe
  C:\Windows\System\UaJWgpp.exe
  2⤵
  PID:5464
- C:\Windows\System\JdWwyqz.exe
  C:\Windows\System\JdWwyqz.exe
  2⤵
  PID:5484
- C:\Windows\System\NgTXeLY.exe
  C:\Windows\System\NgTXeLY.exe
  2⤵
  PID:5504
- C:\Windows\System\kDIzhIn.exe
  C:\Windows\System\kDIzhIn.exe
  2⤵
  PID:5600
- C:\Windows\System\HDcZYXy.exe
  C:\Windows\System\HDcZYXy.exe
  2⤵
  PID:5652
- C:\Windows\System\ysooiEa.exe
  C:\Windows\System\ysooiEa.exe
  2⤵
  PID:5692
- C:\Windows\System\oAKudpZ.exe
  C:\Windows\System\oAKudpZ.exe
  2⤵
  PID:5760
- C:\Windows\System\MfubtFn.exe
  C:\Windows\System\MfubtFn.exe
  2⤵
  PID:5788
- C:\Windows\System\NdJBYjj.exe
  C:\Windows\System\NdJBYjj.exe
  2⤵
  PID:5904
- C:\Windows\System\jQzWygi.exe
  C:\Windows\System\jQzWygi.exe
  2⤵
  PID:5960
- C:\Windows\System\pRkcpge.exe
  C:\Windows\System\pRkcpge.exe
  2⤵
  PID:6020
- C:\Windows\System\UTaoYoo.exe
  C:\Windows\System\UTaoYoo.exe
  2⤵
  PID:6060
- C:\Windows\System\ClwjbOF.exe
  C:\Windows\System\ClwjbOF.exe
  2⤵
  PID:6140
- C:\Windows\System\LRZgQTT.exe
  C:\Windows\System\LRZgQTT.exe
  2⤵
  PID:5164
- C:\Windows\System\HtLMFhZ.exe
  C:\Windows\System\HtLMFhZ.exe
  2⤵
  PID:5324
- C:\Windows\System\OMQxTaR.exe
  C:\Windows\System\OMQxTaR.exe
  2⤵
  PID:5444
- C:\Windows\System\oJBvXyK.exe
  C:\Windows\System\oJBvXyK.exe
  2⤵
  PID:5500
- C:\Windows\System\EuPsuMF.exe
  C:\Windows\System\EuPsuMF.exe
  2⤵
  PID:5812
- C:\Windows\System\ttVUOii.exe
  C:\Windows\System\ttVUOii.exe
  2⤵
  PID:6008
- C:\Windows\System\dbEBYaR.exe
  C:\Windows\System\dbEBYaR.exe
  2⤵
  PID:5132
- C:\Windows\System\NwVjXlM.exe
  C:\Windows\System\NwVjXlM.exe
  2⤵
  PID:6124
- C:\Windows\System\fboUqye.exe
  C:\Windows\System\fboUqye.exe
  2⤵
  PID:5700
- C:\Windows\System\DZGQqzd.exe
  C:\Windows\System\DZGQqzd.exe
  2⤵
  PID:6116
- C:\Windows\System\FMjiMSM.exe
  C:\Windows\System\FMjiMSM.exe
  2⤵
  PID:5876
- C:\Windows\System\RgYEyca.exe
  C:\Windows\System\RgYEyca.exe
  2⤵
  PID:6164
- C:\Windows\System\nzZnHqc.exe
  C:\Windows\System\nzZnHqc.exe
  2⤵
  PID:6192
- C:\Windows\System\BEiCHtq.exe
  C:\Windows\System\BEiCHtq.exe
  2⤵
  PID:6220
- C:\Windows\System\EpRGtKE.exe
  C:\Windows\System\EpRGtKE.exe
  2⤵
  PID:6260
- C:\Windows\System\BCqGiIQ.exe
  C:\Windows\System\BCqGiIQ.exe
  2⤵
  PID:6292
- C:\Windows\System\WwXYscs.exe
  C:\Windows\System\WwXYscs.exe
  2⤵
  PID:6316
- C:\Windows\System\SiykAFn.exe
  C:\Windows\System\SiykAFn.exe
  2⤵
  PID:6332
- C:\Windows\System\mWPoNRt.exe
  C:\Windows\System\mWPoNRt.exe
  2⤵
  PID:6348
- C:\Windows\System\oSipnOm.exe
  C:\Windows\System\oSipnOm.exe
  2⤵
  PID:6368
- C:\Windows\System\XzVChSI.exe
  C:\Windows\System\XzVChSI.exe
  2⤵
  PID:6388
- C:\Windows\System\Zqorukm.exe
  C:\Windows\System\Zqorukm.exe
  2⤵
  PID:6412
- C:\Windows\System\oDrPRZe.exe
  C:\Windows\System\oDrPRZe.exe
  2⤵
  PID:6436
- C:\Windows\System\UxMgJYu.exe
  C:\Windows\System\UxMgJYu.exe
  2⤵
  PID:6464
- C:\Windows\System\wDSUJNd.exe
  C:\Windows\System\wDSUJNd.exe
  2⤵
  PID:6520
- C:\Windows\System\ejQCaYH.exe
  C:\Windows\System\ejQCaYH.exe
  2⤵
  PID:6552
- C:\Windows\System\hbIbWFY.exe
  C:\Windows\System\hbIbWFY.exe
  2⤵
  PID:6596
- C:\Windows\System\BBqkjsA.exe
  C:\Windows\System\BBqkjsA.exe
  2⤵
  PID:6616
- C:\Windows\System\GpMSMbz.exe
  C:\Windows\System\GpMSMbz.exe
  2⤵
  PID:6652
- C:\Windows\System\kEIOGUP.exe
  C:\Windows\System\kEIOGUP.exe
  2⤵
  PID:6676
- C:\Windows\System\EPTFkwB.exe
  C:\Windows\System\EPTFkwB.exe
  2⤵
  PID:6696
- C:\Windows\System\DCGeZnZ.exe
  C:\Windows\System\DCGeZnZ.exe
  2⤵
  PID:6724
- C:\Windows\System\TEMNDta.exe
  C:\Windows\System\TEMNDta.exe
  2⤵
  PID:6752
- C:\Windows\System\RVEBEPH.exe
  C:\Windows\System\RVEBEPH.exe
  2⤵
  PID:6772
- C:\Windows\System\vilklXA.exe
  C:\Windows\System\vilklXA.exe
  2⤵
  PID:6816
- C:\Windows\System\VpvgDrp.exe
  C:\Windows\System\VpvgDrp.exe
  2⤵
  PID:6836
- C:\Windows\System\jWDWwdK.exe
  C:\Windows\System\jWDWwdK.exe
  2⤵
  PID:6852
- C:\Windows\System\CipKLsu.exe
  C:\Windows\System\CipKLsu.exe
  2⤵
  PID:6876
- C:\Windows\System\boarzqs.exe
  C:\Windows\System\boarzqs.exe
  2⤵
  PID:6920
- C:\Windows\System\SwfnpXI.exe
  C:\Windows\System\SwfnpXI.exe
  2⤵
  PID:6936
- C:\Windows\System\dJbOMOs.exe
  C:\Windows\System\dJbOMOs.exe
  2⤵
  PID:6964
- C:\Windows\System\OhZJUSd.exe
  C:\Windows\System\OhZJUSd.exe
  2⤵
  PID:6992
- C:\Windows\System\cLgGuqm.exe
  C:\Windows\System\cLgGuqm.exe
  2⤵
  PID:7020
- C:\Windows\System\mHdkTnv.exe
  C:\Windows\System\mHdkTnv.exe
  2⤵
  PID:7056
- C:\Windows\System\AwPLiEg.exe
  C:\Windows\System\AwPLiEg.exe
  2⤵
  PID:7088
- C:\Windows\System\aroXFJv.exe
  C:\Windows\System\aroXFJv.exe
  2⤵
  PID:7104
- C:\Windows\System\RKuGWmb.exe
  C:\Windows\System\RKuGWmb.exe
  2⤵
  PID:7132
- C:\Windows\System\IpAXbyf.exe
  C:\Windows\System\IpAXbyf.exe
  2⤵
  PID:6148
- C:\Windows\System\CtryQnL.exe
  C:\Windows\System\CtryQnL.exe
  2⤵
  PID:6216
- C:\Windows\System\KjOfpHp.exe
  C:\Windows\System\KjOfpHp.exe
  2⤵
  PID:6252
- C:\Windows\System\ATLCZNl.exe
  C:\Windows\System\ATLCZNl.exe
  2⤵
  PID:6324
- C:\Windows\System\qcyCdYO.exe
  C:\Windows\System\qcyCdYO.exe
  2⤵
  PID:6400
- C:\Windows\System\PcPfIMQ.exe
  C:\Windows\System\PcPfIMQ.exe
  2⤵
  PID:6460
- C:\Windows\System\ngqCAEz.exe
  C:\Windows\System\ngqCAEz.exe
  2⤵
  PID:6532
- C:\Windows\System\mZMwXmV.exe
  C:\Windows\System\mZMwXmV.exe
  2⤵
  PID:6580
- C:\Windows\System\QAeiEUk.exe
  C:\Windows\System\QAeiEUk.exe
  2⤵
  PID:6636
- C:\Windows\System\czyjKuC.exe
  C:\Windows\System\czyjKuC.exe
  2⤵
  PID:6720
- C:\Windows\System\ywnBbSt.exe
  C:\Windows\System\ywnBbSt.exe
  2⤵
  PID:6760
- C:\Windows\System\jXUrzmV.exe
  C:\Windows\System\jXUrzmV.exe
  2⤵
  PID:6864
- C:\Windows\System\owlyqTR.exe
  C:\Windows\System\owlyqTR.exe
  2⤵
  PID:6928
- C:\Windows\System\PQvqnjB.exe
  C:\Windows\System\PQvqnjB.exe
  2⤵
  PID:6984
- C:\Windows\System\gTxFxKB.exe
  C:\Windows\System\gTxFxKB.exe
  2⤵
  PID:7068
- C:\Windows\System\XCBlTpc.exe
  C:\Windows\System\XCBlTpc.exe
  2⤵
  PID:7096
- C:\Windows\System\zQOmCsF.exe
  C:\Windows\System\zQOmCsF.exe
  2⤵
  PID:7152
- C:\Windows\System\zltAzBs.exe
  C:\Windows\System\zltAzBs.exe
  2⤵
  PID:5620
- C:\Windows\System\GVVJAkt.exe
  C:\Windows\System\GVVJAkt.exe
  2⤵
  PID:6396
- C:\Windows\System\AbJBEmj.exe
  C:\Windows\System\AbJBEmj.exe
  2⤵
  PID:6612
- C:\Windows\System\mfltNjK.exe
  C:\Windows\System\mfltNjK.exe
  2⤵
  PID:6844
- C:\Windows\System\YAMUvqc.exe
  C:\Windows\System\YAMUvqc.exe
  2⤵
  PID:6904
- C:\Windows\System\UBFpaJq.exe
  C:\Windows\System\UBFpaJq.exe
  2⤵
  PID:7008
- C:\Windows\System\GlmAaRG.exe
  C:\Windows\System\GlmAaRG.exe
  2⤵
  PID:6312
- C:\Windows\System\JqukjKV.exe
  C:\Windows\System\JqukjKV.exe
  2⤵
  PID:6508
- C:\Windows\System\xRtQWyW.exe
  C:\Windows\System\xRtQWyW.exe
  2⤵
  PID:6976
- C:\Windows\System\lZixhOF.exe
  C:\Windows\System\lZixhOF.exe
  2⤵
  PID:7120
- C:\Windows\System\gPijrVe.exe
  C:\Windows\System\gPijrVe.exe
  2⤵
  PID:6956
- C:\Windows\System\VBskCsY.exe
  C:\Windows\System\VBskCsY.exe
  2⤵
  PID:7192
- C:\Windows\System\Mhthxow.exe
  C:\Windows\System\Mhthxow.exe
  2⤵
  PID:7216
- C:\Windows\System\pAOgkBg.exe
  C:\Windows\System\pAOgkBg.exe
  2⤵
  PID:7240
- C:\Windows\System\TovBdmf.exe
  C:\Windows\System\TovBdmf.exe
  2⤵
  PID:7276
- C:\Windows\System\tUziaLL.exe
  C:\Windows\System\tUziaLL.exe
  2⤵
  PID:7292
- C:\Windows\System\xOKwGGU.exe
  C:\Windows\System\xOKwGGU.exe
  2⤵
  PID:7344
- C:\Windows\System\IJOKKiF.exe
  C:\Windows\System\IJOKKiF.exe
  2⤵
  PID:7360
- C:\Windows\System\RVpyAoA.exe
  C:\Windows\System\RVpyAoA.exe
  2⤵
  PID:7376
- C:\Windows\System\DqwkzEY.exe
  C:\Windows\System\DqwkzEY.exe
  2⤵
  PID:7404
- C:\Windows\System\eNOIOcG.exe
  C:\Windows\System\eNOIOcG.exe
  2⤵
  PID:7424
- C:\Windows\System\PfiTifp.exe
  C:\Windows\System\PfiTifp.exe
  2⤵
  PID:7452
- C:\Windows\System\yOpVIEX.exe
  C:\Windows\System\yOpVIEX.exe
  2⤵
  PID:7484
- C:\Windows\System\GQuHOok.exe
  C:\Windows\System\GQuHOok.exe
  2⤵
  PID:7528
- C:\Windows\System\hCizcgs.exe
  C:\Windows\System\hCizcgs.exe
  2⤵
  PID:7548
- C:\Windows\System\beZvzQo.exe
  C:\Windows\System\beZvzQo.exe
  2⤵
  PID:7584
- C:\Windows\System\riILEoI.exe
  C:\Windows\System\riILEoI.exe
  2⤵
  PID:7616
- C:\Windows\System\jcTGGNh.exe
  C:\Windows\System\jcTGGNh.exe
  2⤵
  PID:7644
- C:\Windows\System\iOrGtfF.exe
  C:\Windows\System\iOrGtfF.exe
  2⤵
  PID:7672
- C:\Windows\System\ilaHezg.exe
  C:\Windows\System\ilaHezg.exe
  2⤵
  PID:7692
- C:\Windows\System\NMxJCFJ.exe
  C:\Windows\System\NMxJCFJ.exe
  2⤵
  PID:7720
- C:\Windows\System\WIVizxP.exe
  C:\Windows\System\WIVizxP.exe
  2⤵
  PID:7748
- C:\Windows\System\QdDIbmb.exe
  C:\Windows\System\QdDIbmb.exe
  2⤵
  PID:7772
- C:\Windows\System\vRVrskG.exe
  C:\Windows\System\vRVrskG.exe
  2⤵
  PID:7800
- C:\Windows\System\mrGvMuT.exe
  C:\Windows\System\mrGvMuT.exe
  2⤵
  PID:7832
- C:\Windows\System\QpIqgoL.exe
  C:\Windows\System\QpIqgoL.exe
  2⤵
  PID:7864
- C:\Windows\System\NSRYjPK.exe
  C:\Windows\System\NSRYjPK.exe
  2⤵
  PID:7892
- C:\Windows\System\GeItlmK.exe
  C:\Windows\System\GeItlmK.exe
  2⤵
  PID:7924
- C:\Windows\System\ImmTBXs.exe
  C:\Windows\System\ImmTBXs.exe
  2⤵
  PID:7948
- C:\Windows\System\MEclCra.exe
  C:\Windows\System\MEclCra.exe
  2⤵
  PID:7976
- C:\Windows\System\iSqlYiz.exe
  C:\Windows\System\iSqlYiz.exe
  2⤵
  PID:8000
- C:\Windows\System\bJRlVoO.exe
  C:\Windows\System\bJRlVoO.exe
  2⤵
  PID:8040
- C:\Windows\System\qWsvxqO.exe
  C:\Windows\System\qWsvxqO.exe
  2⤵
  PID:8068
- C:\Windows\System\OYrZYNk.exe
  C:\Windows\System\OYrZYNk.exe
  2⤵
  PID:8112
- C:\Windows\System\ZbmvtYz.exe
  C:\Windows\System\ZbmvtYz.exe
  2⤵
  PID:8152
- C:\Windows\System\gzaqeNU.exe
  C:\Windows\System\gzaqeNU.exe
  2⤵
  PID:8168
- C:\Windows\System\GwcINxr.exe
  C:\Windows\System\GwcINxr.exe
  2⤵
  PID:8184
- C:\Windows\System\QuncXCd.exe
  C:\Windows\System\QuncXCd.exe
  2⤵
  PID:7208
- C:\Windows\System\jXtokYQ.exe
  C:\Windows\System\jXtokYQ.exe
  2⤵
  PID:7236
- C:\Windows\System\nScaEdn.exe
  C:\Windows\System\nScaEdn.exe
  2⤵
  PID:7328
- C:\Windows\System\cvxqOSp.exe
  C:\Windows\System\cvxqOSp.exe
  2⤵
  PID:7388
- C:\Windows\System\IKkwleN.exe
  C:\Windows\System\IKkwleN.exe
  2⤵
  PID:7460
- C:\Windows\System\EdcoIln.exe
  C:\Windows\System\EdcoIln.exe
  2⤵
  PID:7508
- C:\Windows\System\KrIMiuS.exe
  C:\Windows\System\KrIMiuS.exe
  2⤵
  PID:7608
- C:\Windows\System\gIkfrei.exe
  C:\Windows\System\gIkfrei.exe
  2⤵
  PID:7656
- C:\Windows\System\eRDDfaH.exe
  C:\Windows\System\eRDDfaH.exe
  2⤵
  PID:7716
- C:\Windows\System\PpKVJtv.exe
  C:\Windows\System\PpKVJtv.exe
  2⤵
  PID:7812
- C:\Windows\System\cqQdLSA.exe
  C:\Windows\System\cqQdLSA.exe
  2⤵
  PID:7940
- C:\Windows\System\jKKzZNH.exe
  C:\Windows\System\jKKzZNH.exe
  2⤵
  PID:7968
- C:\Windows\System\SNFRCiB.exe
  C:\Windows\System\SNFRCiB.exe
  2⤵
  PID:7996
- C:\Windows\System\uOwHVpb.exe
  C:\Windows\System\uOwHVpb.exe
  2⤵
  PID:8060
- C:\Windows\System\NEgbxmE.exe
  C:\Windows\System\NEgbxmE.exe
  2⤵
  PID:8164
- C:\Windows\System\mCgctyi.exe
  C:\Windows\System\mCgctyi.exe
  2⤵
  PID:6540
- C:\Windows\System\ouqudHx.exe
  C:\Windows\System\ouqudHx.exe
  2⤵
  PID:7252
- C:\Windows\System\VzMYYIy.exe
  C:\Windows\System\VzMYYIy.exe
  2⤵
  PID:7352
- C:\Windows\System\kCUIQXj.exe
  C:\Windows\System\kCUIQXj.exe
  2⤵
  PID:7504
- C:\Windows\System\whVZJvi.exe
  C:\Windows\System\whVZJvi.exe
  2⤵
  PID:7708
- C:\Windows\System\chaiEYV.exe
  C:\Windows\System\chaiEYV.exe
  2⤵
  PID:7844
- C:\Windows\System\TCHhBsN.exe
  C:\Windows\System\TCHhBsN.exe
  2⤵
  PID:8136
- C:\Windows\System\QnnZytC.exe
  C:\Windows\System\QnnZytC.exe
  2⤵
  PID:7336
- C:\Windows\System\yrNVlsS.exe
  C:\Windows\System\yrNVlsS.exe
  2⤵
  PID:7756
- C:\Windows\System\vYVQChT.exe
  C:\Windows\System\vYVQChT.exe
  2⤵
  PID:7284
- C:\Windows\System\tyeveWM.exe
  C:\Windows\System\tyeveWM.exe
  2⤵
  PID:8104
- C:\Windows\System\fDqQllb.exe
  C:\Windows\System\fDqQllb.exe
  2⤵
  PID:8200
- C:\Windows\System\lhXYmxA.exe
  C:\Windows\System\lhXYmxA.exe
  2⤵
  PID:8216
- C:\Windows\System\syMjYDd.exe
  C:\Windows\System\syMjYDd.exe
  2⤵
  PID:8244
- C:\Windows\System\RUCqZeC.exe
  C:\Windows\System\RUCqZeC.exe
  2⤵
  PID:8288
- C:\Windows\System\aXlbpGz.exe
  C:\Windows\System\aXlbpGz.exe
  2⤵
  PID:8324
- C:\Windows\System\WQlPrwt.exe
  C:\Windows\System\WQlPrwt.exe
  2⤵
  PID:8352
- C:\Windows\System\IYDDCLk.exe
  C:\Windows\System\IYDDCLk.exe
  2⤵
  PID:8368
- C:\Windows\System\LGjoYBF.exe
  C:\Windows\System\LGjoYBF.exe
  2⤵
  PID:8396
- C:\Windows\System\BdbfOSP.exe
  C:\Windows\System\BdbfOSP.exe
  2⤵
  PID:8424
- C:\Windows\System\GOyJLHM.exe
  C:\Windows\System\GOyJLHM.exe
  2⤵
  PID:8452
- C:\Windows\System\XTetFOp.exe
  C:\Windows\System\XTetFOp.exe
  2⤵
  PID:8480
- C:\Windows\System\WgcUNkL.exe
  C:\Windows\System\WgcUNkL.exe
  2⤵
  PID:8500
- C:\Windows\System\jzroxwd.exe
  C:\Windows\System\jzroxwd.exe
  2⤵
  PID:8548
- C:\Windows\System\sOwyduD.exe
  C:\Windows\System\sOwyduD.exe
  2⤵
  PID:8576
- C:\Windows\System\ZeOCXwn.exe
  C:\Windows\System\ZeOCXwn.exe
  2⤵
  PID:8604
- C:\Windows\System\jPQVzgE.exe
  C:\Windows\System\jPQVzgE.exe
  2⤵
  PID:8636
- C:\Windows\System\ymqXVTU.exe
  C:\Windows\System\ymqXVTU.exe
  2⤵
  PID:8660
- C:\Windows\System\mJOPCPB.exe
  C:\Windows\System\mJOPCPB.exe
  2⤵
  PID:8676
- C:\Windows\System\xCOnnms.exe
  C:\Windows\System\xCOnnms.exe
  2⤵
  PID:8708
- C:\Windows\System\pRGYoTe.exe
  C:\Windows\System\pRGYoTe.exe
  2⤵
  PID:8736
- C:\Windows\System\uCaxmLB.exe
  C:\Windows\System\uCaxmLB.exe
  2⤵
  PID:8776
- C:\Windows\System\CytDPEB.exe
  C:\Windows\System\CytDPEB.exe
  2⤵
  PID:8804
- C:\Windows\System\qVCWeFm.exe
  C:\Windows\System\qVCWeFm.exe
  2⤵
  PID:8832
- C:\Windows\System\btZybPR.exe
  C:\Windows\System\btZybPR.exe
  2⤵
  PID:8860
- C:\Windows\System\hjandww.exe
  C:\Windows\System\hjandww.exe
  2⤵
  PID:8888
- C:\Windows\System\uPtxDOa.exe
  C:\Windows\System\uPtxDOa.exe
  2⤵
  PID:8904
- C:\Windows\System\UvdSSsI.exe
  C:\Windows\System\UvdSSsI.exe
  2⤵
  PID:8932
- C:\Windows\System\qMwJAJQ.exe
  C:\Windows\System\qMwJAJQ.exe
  2⤵
  PID:8960
- C:\Windows\System\DWyjrxD.exe
  C:\Windows\System\DWyjrxD.exe
  2⤵
  PID:9004
- C:\Windows\System\BxOdJLb.exe
  C:\Windows\System\BxOdJLb.exe
  2⤵
  PID:9032
- C:\Windows\System\msyEjkw.exe
  C:\Windows\System\msyEjkw.exe
  2⤵
  PID:9048
- C:\Windows\System\YbAlgfX.exe
  C:\Windows\System\YbAlgfX.exe
  2⤵
  PID:9076
- C:\Windows\System\CNJjkWC.exe
  C:\Windows\System\CNJjkWC.exe
  2⤵
  PID:9104
- C:\Windows\System\ijzAwDL.exe
  C:\Windows\System\ijzAwDL.exe
  2⤵
  PID:9132
- C:\Windows\System\lLqpGZk.exe
  C:\Windows\System\lLqpGZk.exe
  2⤵
  PID:9160
- C:\Windows\System\ZiGNNbB.exe
  C:\Windows\System\ZiGNNbB.exe
  2⤵
  PID:9200
- C:\Windows\System\Iaadrey.exe
  C:\Windows\System\Iaadrey.exe
  2⤵
  PID:8212
- C:\Windows\System\rSTNeky.exe
  C:\Windows\System\rSTNeky.exe
  2⤵
  PID:8228
- C:\Windows\System\RyUgKTD.exe
  C:\Windows\System\RyUgKTD.exe
  2⤵
  PID:8336
- C:\Windows\System\pZqXHOA.exe
  C:\Windows\System\pZqXHOA.exe
  2⤵
  PID:8380
- C:\Windows\System\AHIMtjI.exe
  C:\Windows\System\AHIMtjI.exe
  2⤵
  PID:8444
- C:\Windows\System\OndHjUm.exe
  C:\Windows\System\OndHjUm.exe
  2⤵
  PID:8488
- C:\Windows\System\JSGwpXI.exe
  C:\Windows\System\JSGwpXI.exe
  2⤵
  PID:8544
- C:\Windows\System\tyKjdtu.exe
  C:\Windows\System\tyKjdtu.exe
  2⤵
  PID:8624
- C:\Windows\System\ygwbblq.exe
  C:\Windows\System\ygwbblq.exe
  2⤵
  PID:8696
- C:\Windows\System\VFlRtSi.exe
  C:\Windows\System\VFlRtSi.exe
  2⤵
  PID:8752
- C:\Windows\System\icvTSaS.exe
  C:\Windows\System\icvTSaS.exe
  2⤵
  PID:8796
- C:\Windows\System\UyyMERd.exe
  C:\Windows\System\UyyMERd.exe
  2⤵
  PID:8880
- C:\Windows\System\qwhcpUp.exe
  C:\Windows\System\qwhcpUp.exe
  2⤵
  PID:8984
- C:\Windows\System\xpqfPRh.exe
  C:\Windows\System\xpqfPRh.exe
  2⤵
  PID:9020
- C:\Windows\System\sqKewBz.exe
  C:\Windows\System\sqKewBz.exe
  2⤵
  PID:8080
- C:\Windows\System\eRiCFZj.exe
  C:\Windows\System\eRiCFZj.exe
  2⤵
  PID:9184
- C:\Windows\System\oUOlRnH.exe
  C:\Windows\System\oUOlRnH.exe
  2⤵
  PID:8276
- C:\Windows\System\dLwVQpy.exe
  C:\Windows\System\dLwVQpy.exe
  2⤵
  PID:8464
- C:\Windows\System\sPYJHbi.exe
  C:\Windows\System\sPYJHbi.exe
  2⤵
  PID:8508
- C:\Windows\System\FluAqAw.exe
  C:\Windows\System\FluAqAw.exe
  2⤵
  PID:8728
- C:\Windows\System\ekLJOcZ.exe
  C:\Windows\System\ekLJOcZ.exe
  2⤵
  PID:8916
- C:\Windows\System\VnkiiFi.exe
  C:\Windows\System\VnkiiFi.exe
  2⤵
  PID:8996
- C:\Windows\System\BlYVtIv.exe
  C:\Windows\System\BlYVtIv.exe
  2⤵
  PID:9044
- C:\Windows\System\qKalFdc.exe
  C:\Windows\System\qKalFdc.exe
  2⤵
  PID:8348
- C:\Windows\System\SEsWJPL.exe
  C:\Windows\System\SEsWJPL.exe
  2⤵
  PID:8692
- C:\Windows\System\fbwkyhU.exe
  C:\Windows\System\fbwkyhU.exe
  2⤵
  PID:8232
- C:\Windows\System\ayjNEIq.exe
  C:\Windows\System\ayjNEIq.exe
  2⤵
  PID:8592
- C:\Windows\System\vpVvSIC.exe
  C:\Windows\System\vpVvSIC.exe
  2⤵
  PID:9224
- C:\Windows\System\oqvNbOc.exe
  C:\Windows\System\oqvNbOc.exe
  2⤵
  PID:9240
- C:\Windows\System\AVPmQGn.exe
  C:\Windows\System\AVPmQGn.exe
  2⤵
  PID:9256
- C:\Windows\System\vhVkXJR.exe
  C:\Windows\System\vhVkXJR.exe
  2⤵
  PID:9328
- C:\Windows\System\hlYpyOn.exe
  C:\Windows\System\hlYpyOn.exe
  2⤵
  PID:9348
- C:\Windows\System\ReCuxPb.exe
  C:\Windows\System\ReCuxPb.exe
  2⤵
  PID:9364
- C:\Windows\System\tGwSKnh.exe
  C:\Windows\System\tGwSKnh.exe
  2⤵
  PID:9396
- C:\Windows\System\wUBcxhg.exe
  C:\Windows\System\wUBcxhg.exe
  2⤵
  PID:9428
- C:\Windows\System\CFbIuGC.exe
  C:\Windows\System\CFbIuGC.exe
  2⤵
  PID:9448
- C:\Windows\System\CbpZbtL.exe
  C:\Windows\System\CbpZbtL.exe
  2⤵
  PID:9472
- C:\Windows\System\pQlouoN.exe
  C:\Windows\System\pQlouoN.exe
  2⤵
  PID:9512
- C:\Windows\System\yJEIxbt.exe
  C:\Windows\System\yJEIxbt.exe
  2⤵
  PID:9544
- C:\Windows\System\soaGFQL.exe
  C:\Windows\System\soaGFQL.exe
  2⤵
  PID:9568
- C:\Windows\System\cqvRNuF.exe
  C:\Windows\System\cqvRNuF.exe
  2⤵
  PID:9600
- C:\Windows\System\tLnNvDG.exe
  C:\Windows\System\tLnNvDG.exe
  2⤵
  PID:9628
- C:\Windows\System\ejhxXyr.exe
  C:\Windows\System\ejhxXyr.exe
  2⤵
  PID:9648
- C:\Windows\System\vIAwWIQ.exe
  C:\Windows\System\vIAwWIQ.exe
  2⤵
  PID:9684
- C:\Windows\System\eAgMiVq.exe
  C:\Windows\System\eAgMiVq.exe
  2⤵
  PID:9704
- C:\Windows\System\ricgnPG.exe
  C:\Windows\System\ricgnPG.exe
  2⤵
  PID:9740
- C:\Windows\System\LgldSSC.exe
  C:\Windows\System\LgldSSC.exe
  2⤵
  PID:9768
- C:\Windows\System\IEGxtFq.exe
  C:\Windows\System\IEGxtFq.exe
  2⤵
  PID:9796
- C:\Windows\System\DpKPqMz.exe
  C:\Windows\System\DpKPqMz.exe
  2⤵
  PID:9836
- C:\Windows\System\vClsJfz.exe
  C:\Windows\System\vClsJfz.exe
  2⤵
  PID:9864
- C:\Windows\System\hyShcql.exe
  C:\Windows\System\hyShcql.exe
  2⤵
  PID:9884
- C:\Windows\System\jYiYWij.exe
  C:\Windows\System\jYiYWij.exe
  2⤵
  PID:9920
- C:\Windows\System\XxEqwnh.exe
  C:\Windows\System\XxEqwnh.exe
  2⤵
  PID:9948
- C:\Windows\System\YqDwyGG.exe
  C:\Windows\System\YqDwyGG.exe
  2⤵
  PID:9976
- C:\Windows\System\XdLrGAv.exe
  C:\Windows\System\XdLrGAv.exe
  2⤵
  PID:9992
- C:\Windows\System\jibgzFV.exe
  C:\Windows\System\jibgzFV.exe
  2⤵
  PID:10020
- C:\Windows\System\yxmmABQ.exe
  C:\Windows\System\yxmmABQ.exe
  2⤵
  PID:10052
- C:\Windows\System\pSUBPOp.exe
  C:\Windows\System\pSUBPOp.exe
  2⤵
  PID:10076
- C:\Windows\System\uCYzDSb.exe
  C:\Windows\System\uCYzDSb.exe
  2⤵
  PID:10092
- C:\Windows\System\laQZTNv.exe
  C:\Windows\System\laQZTNv.exe
  2⤵
  PID:10120
- C:\Windows\System\GmmkFYQ.exe
  C:\Windows\System\GmmkFYQ.exe
  2⤵
  PID:10144
- C:\Windows\System\fssRuEk.exe
  C:\Windows\System\fssRuEk.exe
  2⤵
  PID:10184
- C:\Windows\System\zSJTuFf.exe
  C:\Windows\System\zSJTuFf.exe
  2⤵
  PID:10216
- C:\Windows\System\BbKBLVd.exe
  C:\Windows\System\BbKBLVd.exe
  2⤵
  PID:8844
- C:\Windows\System\mAZUblQ.exe
  C:\Windows\System\mAZUblQ.exe
  2⤵
  PID:9280
- C:\Windows\System\bmmzIZY.exe
  C:\Windows\System\bmmzIZY.exe
  2⤵
  PID:9340
- C:\Windows\System\QunxWhL.exe
  C:\Windows\System\QunxWhL.exe
  2⤵
  PID:9436
- C:\Windows\System\JitljJW.exe
  C:\Windows\System\JitljJW.exe
  2⤵
  PID:9424
- C:\Windows\System\FJnMHkP.exe
  C:\Windows\System\FJnMHkP.exe
  2⤵
  PID:9536
- C:\Windows\System\dlvrgjr.exe
  C:\Windows\System\dlvrgjr.exe
  2⤵
  PID:9560
- C:\Windows\System\OLlSUgA.exe
  C:\Windows\System\OLlSUgA.exe
  2⤵
  PID:9612
- C:\Windows\System\uFcsYAa.exe
  C:\Windows\System\uFcsYAa.exe
  2⤵
  PID:9760
- C:\Windows\System\VRraVZC.exe
  C:\Windows\System\VRraVZC.exe
  2⤵
  PID:9780
- C:\Windows\System\GDeNwVo.exe
  C:\Windows\System\GDeNwVo.exe
  2⤵
  PID:9876
- C:\Windows\System\kyhBUKa.exe
  C:\Windows\System\kyhBUKa.exe
  2⤵
  PID:9908
- C:\Windows\System\bqzeeyT.exe
  C:\Windows\System\bqzeeyT.exe
  2⤵
  PID:9960
- C:\Windows\System\rkwYQet.exe
  C:\Windows\System\rkwYQet.exe
  2⤵
  PID:10064
- C:\Windows\System\diBwUuN.exe
  C:\Windows\System\diBwUuN.exe
  2⤵
  PID:10112
- C:\Windows\System\KtjijiJ.exe
  C:\Windows\System\KtjijiJ.exe
  2⤵
  PID:10140
- C:\Windows\System\QJYYDtW.exe
  C:\Windows\System\QJYYDtW.exe
  2⤵
  PID:10208
- C:\Windows\System\YvCbsoE.exe
  C:\Windows\System\YvCbsoE.exe
  2⤵
  PID:10236
- C:\Windows\System\DRogdfu.exe
  C:\Windows\System\DRogdfu.exe
  2⤵
  PID:9500
- C:\Windows\System\dLGxVdX.exe
  C:\Windows\System\dLGxVdX.exe
  2⤵
  PID:9564
- C:\Windows\System\yOOJTxe.exe
  C:\Windows\System\yOOJTxe.exe
  2⤵
  PID:9752
- C:\Windows\System\nLjdmRB.exe
  C:\Windows\System\nLjdmRB.exe
  2⤵
  PID:9968
- C:\Windows\System\vjZLKJS.exe
  C:\Windows\System\vjZLKJS.exe
  2⤵
  PID:10200
- C:\Windows\System\SCqCATL.exe
  C:\Windows\System\SCqCATL.exe
  2⤵
  PID:10232
- C:\Windows\System\kjRiWVT.exe
  C:\Windows\System\kjRiWVT.exe
  2⤵
  PID:9656
- C:\Windows\System\ylIHwhZ.exe
  C:\Windows\System\ylIHwhZ.exe
  2⤵
  PID:9896
- C:\Windows\System\vQnxVet.exe
  C:\Windows\System\vQnxVet.exe
  2⤵
  PID:9856
- C:\Windows\System\vSAGndt.exe
  C:\Windows\System\vSAGndt.exe
  2⤵
  PID:10132
- C:\Windows\System\OAivhaA.exe
  C:\Windows\System\OAivhaA.exe
  2⤵
  PID:10256
- C:\Windows\System\yGYQHvT.exe
  C:\Windows\System\yGYQHvT.exe
  2⤵
  PID:10284
- C:\Windows\System\YqJvuVm.exe
  C:\Windows\System\YqJvuVm.exe
  2⤵
  PID:10304
- C:\Windows\System\eJGnQeH.exe
  C:\Windows\System\eJGnQeH.exe
  2⤵
  PID:10320
- C:\Windows\System\Nejfpym.exe
  C:\Windows\System\Nejfpym.exe
  2⤵
  PID:10344
- C:\Windows\System\KcOZdSs.exe
  C:\Windows\System\KcOZdSs.exe
  2⤵
  PID:10412
- C:\Windows\System\nUwEjYo.exe
  C:\Windows\System\nUwEjYo.exe
  2⤵
  PID:10428
- C:\Windows\System\prGswEC.exe
  C:\Windows\System\prGswEC.exe
  2⤵
  PID:10456
- C:\Windows\System\OseZTvU.exe
  C:\Windows\System\OseZTvU.exe
  2⤵
  PID:10472
- C:\Windows\System\GZTaGHl.exe
  C:\Windows\System\GZTaGHl.exe
  2⤵
  PID:10492
- C:\Windows\System\lEzCMRj.exe
  C:\Windows\System\lEzCMRj.exe
  2⤵
  PID:10512
- C:\Windows\System\xUMCeKj.exe
  C:\Windows\System\xUMCeKj.exe
  2⤵
  PID:10532
- C:\Windows\System\HNtDnDV.exe
  C:\Windows\System\HNtDnDV.exe
  2⤵
  PID:10592
- C:\Windows\System\DxhWLxO.exe
  C:\Windows\System\DxhWLxO.exe
  2⤵
  PID:10616
- C:\Windows\System\GJnGfbs.exe
  C:\Windows\System\GJnGfbs.exe
  2⤵
  PID:10660
- C:\Windows\System\Izycwtf.exe
  C:\Windows\System\Izycwtf.exe
  2⤵
  PID:10684
- C:\Windows\System\JwTjoaE.exe
  C:\Windows\System\JwTjoaE.exe
  2⤵
  PID:10700
- C:\Windows\System\dGfMkHI.exe
  C:\Windows\System\dGfMkHI.exe
  2⤵
  PID:10752
- C:\Windows\System\GnUgUpT.exe
  C:\Windows\System\GnUgUpT.exe
  2⤵
  PID:10768
- C:\Windows\System\pLtVCNr.exe
  C:\Windows\System\pLtVCNr.exe
  2⤵
  PID:10784
- C:\Windows\System\XhjsTSk.exe
  C:\Windows\System\XhjsTSk.exe
  2⤵
  PID:10808
- C:\Windows\System\GYbxFjd.exe
  C:\Windows\System\GYbxFjd.exe
  2⤵
  PID:10840
- C:\Windows\System\WPueodD.exe
  C:\Windows\System\WPueodD.exe
  2⤵
  PID:10880
- C:\Windows\System\VxkJOsY.exe
  C:\Windows\System\VxkJOsY.exe
  2⤵
  PID:10904
- C:\Windows\System\ZWxrhSa.exe
  C:\Windows\System\ZWxrhSa.exe
  2⤵
  PID:10924
- C:\Windows\System\cJaGoJk.exe
  C:\Windows\System\cJaGoJk.exe
  2⤵
  PID:10956
- C:\Windows\System\nQDrMku.exe
  C:\Windows\System\nQDrMku.exe
  2⤵
  PID:10996
- C:\Windows\System\VZJDYGh.exe
  C:\Windows\System\VZJDYGh.exe
  2⤵
  PID:11020
- C:\Windows\System\LqbInFd.exe
  C:\Windows\System\LqbInFd.exe
  2⤵
  PID:11044
- C:\Windows\System\OoZRpLO.exe
  C:\Windows\System\OoZRpLO.exe
  2⤵
  PID:11072
- C:\Windows\System\gnakjAN.exe
  C:\Windows\System\gnakjAN.exe
  2⤵
  PID:11104
- C:\Windows\System\cQMrHlG.exe
  C:\Windows\System\cQMrHlG.exe
  2⤵
  PID:11132
- C:\Windows\System\fJHovEA.exe
  C:\Windows\System\fJHovEA.exe
  2⤵
  PID:11160
- C:\Windows\System\dlEagcF.exe
  C:\Windows\System\dlEagcF.exe
  2⤵
  PID:11200
- C:\Windows\System\GDPvAzC.exe
  C:\Windows\System\GDPvAzC.exe
  2⤵
  PID:11228
- C:\Windows\System\aHhHMUw.exe
  C:\Windows\System\aHhHMUw.exe
  2⤵
  PID:11256
- C:\Windows\System\cpunviA.exe
  C:\Windows\System\cpunviA.exe
  2⤵
  PID:10228
- C:\Windows\System\BKGXXsX.exe
  C:\Windows\System\BKGXXsX.exe
  2⤵
  PID:10336
- C:\Windows\System\PbegUqw.exe
  C:\Windows\System\PbegUqw.exe
  2⤵
  PID:10392
- C:\Windows\System\kIJqske.exe
  C:\Windows\System\kIJqske.exe
  2⤵
  PID:10444
- C:\Windows\System\WzDYNBo.exe
  C:\Windows\System\WzDYNBo.exe
  2⤵
  PID:10508
- C:\Windows\System\RMgFrgt.exe
  C:\Windows\System\RMgFrgt.exe
  2⤵
  PID:10608
- C:\Windows\System\KrZconU.exe
  C:\Windows\System\KrZconU.exe
  2⤵
  PID:10636
- C:\Windows\System\CNFjoPw.exe
  C:\Windows\System\CNFjoPw.exe
  2⤵
  PID:10692
- C:\Windows\System\yNXPBju.exe
  C:\Windows\System\yNXPBju.exe
  2⤵
  PID:10712
- C:\Windows\System\ABdJBrD.exe
  C:\Windows\System\ABdJBrD.exe
  2⤵
  PID:10804
- C:\Windows\System\vVdTJTx.exe
  C:\Windows\System\vVdTJTx.exe
  2⤵
  PID:10876
- C:\Windows\System\TEmGKEb.exe
  C:\Windows\System\TEmGKEb.exe
  2⤵
  PID:10920
- C:\Windows\System\cFgpcti.exe
  C:\Windows\System\cFgpcti.exe
  2⤵
  PID:11012
- C:\Windows\System\sNavRDv.exe
  C:\Windows\System\sNavRDv.exe
  2⤵
  PID:11084
- C:\Windows\System\OGyohYF.exe
  C:\Windows\System\OGyohYF.exe
  2⤵
  PID:11116
- C:\Windows\System\DJFfgzh.exe
  C:\Windows\System\DJFfgzh.exe
  2⤵
  PID:11124
- C:\Windows\System\TCHoyEr.exe
  C:\Windows\System\TCHoyEr.exe
  2⤵
  PID:10340
- C:\Windows\System\aFdWjvk.exe
  C:\Windows\System\aFdWjvk.exe
  2⤵
  PID:10448
- C:\Windows\System\BoltLRj.exe
  C:\Windows\System\BoltLRj.exe
  2⤵
  PID:10564
- C:\Windows\System\IWZBPLJ.exe
  C:\Windows\System\IWZBPLJ.exe
  2⤵
  PID:10740
- C:\Windows\System\ZyMukke.exe
  C:\Windows\System\ZyMukke.exe
  2⤵
  PID:10988
- C:\Windows\System\ALgGrQH.exe
  C:\Windows\System\ALgGrQH.exe
  2⤵
  PID:11036
- C:\Windows\System\oPxYmBD.exe
  C:\Windows\System\oPxYmBD.exe
  2⤵
  PID:11144
- C:\Windows\System\mxRhNlG.exe
  C:\Windows\System\mxRhNlG.exe
  2⤵
  PID:10488
- C:\Windows\System\eduCWMk.exe
  C:\Windows\System\eduCWMk.exe
  2⤵
  PID:10632
- C:\Windows\System\XJeMiBH.exe
  C:\Windows\System\XJeMiBH.exe
  2⤵
  PID:11064
- C:\Windows\System\GKsRRNw.exe
  C:\Windows\System\GKsRRNw.exe
  2⤵
  PID:11240
- C:\Windows\System\uRocFXo.exe
  C:\Windows\System\uRocFXo.exe
  2⤵
  PID:10780
- C:\Windows\System\bnWqECT.exe
  C:\Windows\System\bnWqECT.exe
  2⤵
  PID:11296
- C:\Windows\System\iXySwfi.exe
  C:\Windows\System\iXySwfi.exe
  2⤵
  PID:11320
- C:\Windows\System\ZhWNgwr.exe
  C:\Windows\System\ZhWNgwr.exe
  2⤵
  PID:11340
- C:\Windows\System\gSsAySb.exe
  C:\Windows\System\gSsAySb.exe
  2⤵
  PID:11400
- C:\Windows\System\YkyqmhN.exe
  C:\Windows\System\YkyqmhN.exe
  2⤵
  PID:11420
- C:\Windows\System\IJNJNPZ.exe
  C:\Windows\System\IJNJNPZ.exe
  2⤵
  PID:11444
- C:\Windows\System\grQImkp.exe
  C:\Windows\System\grQImkp.exe
  2⤵
  PID:11464
- C:\Windows\System\kpJRrfM.exe
  C:\Windows\System\kpJRrfM.exe
  2⤵
  PID:11500
- C:\Windows\System\hWrKnKC.exe
  C:\Windows\System\hWrKnKC.exe
  2⤵
  PID:11520
- C:\Windows\System\qtWxrVT.exe
  C:\Windows\System\qtWxrVT.exe
  2⤵
  PID:11548
- C:\Windows\System\mjoxCcF.exe
  C:\Windows\System\mjoxCcF.exe
  2⤵
  PID:11564
- C:\Windows\System\PFQNlFT.exe
  C:\Windows\System\PFQNlFT.exe
  2⤵
  PID:11600
- C:\Windows\System\tbERuZV.exe
  C:\Windows\System\tbERuZV.exe
  2⤵
  PID:11620
- C:\Windows\System\YuWbylL.exe
  C:\Windows\System\YuWbylL.exe
  2⤵
  PID:11664
- C:\Windows\System\qQEkxHc.exe
  C:\Windows\System\qQEkxHc.exe
  2⤵
  PID:11692
- C:\Windows\System\JuTDPGM.exe
  C:\Windows\System\JuTDPGM.exe
  2⤵
  PID:11728
- C:\Windows\System\Iqhaiia.exe
  C:\Windows\System\Iqhaiia.exe
  2⤵
  PID:11768
- C:\Windows\System\QhqmIrs.exe
  C:\Windows\System\QhqmIrs.exe
  2⤵
  PID:11784
- C:\Windows\System\afWBJoq.exe
  C:\Windows\System\afWBJoq.exe
  2⤵
  PID:11820
- C:\Windows\System\uHhoYPO.exe
  C:\Windows\System\uHhoYPO.exe
  2⤵
  PID:11852
- C:\Windows\System\FCopXLJ.exe
  C:\Windows\System\FCopXLJ.exe
  2⤵
  PID:11876
- C:\Windows\System\zRYMnit.exe
  C:\Windows\System\zRYMnit.exe
  2⤵
  PID:11896
- C:\Windows\System\mwXChaS.exe
  C:\Windows\System\mwXChaS.exe
  2⤵
  PID:11920
- C:\Windows\System\ukNlYfo.exe
  C:\Windows\System\ukNlYfo.exe
  2⤵
  PID:11940
- C:\Windows\System\hsbdrTG.exe
  C:\Windows\System\hsbdrTG.exe
  2⤵
  PID:11988
- C:\Windows\System\hWlcmya.exe
  C:\Windows\System\hWlcmya.exe
  2⤵
  PID:12012
- C:\Windows\System\hdfeWUY.exe
  C:\Windows\System\hdfeWUY.exe
  2⤵
  PID:12036
- C:\Windows\System\AWMdLMR.exe
  C:\Windows\System\AWMdLMR.exe
  2⤵
  PID:12060
- C:\Windows\System\fSgjxjX.exe
  C:\Windows\System\fSgjxjX.exe
  2⤵
  PID:12092
- C:\Windows\System\kRScFNs.exe
  C:\Windows\System\kRScFNs.exe
  2⤵
  PID:12120
- C:\Windows\System\AqRkENg.exe
  C:\Windows\System\AqRkENg.exe
  2⤵
  PID:12148
- C:\Windows\System\UNbyruL.exe
  C:\Windows\System\UNbyruL.exe
  2⤵
  PID:12168
- C:\Windows\System\COMolkF.exe
  C:\Windows\System\COMolkF.exe
  2⤵
  PID:12200
- C:\Windows\System\DBifAbh.exe
  C:\Windows\System\DBifAbh.exe
  2⤵
  PID:12232
- C:\Windows\System\aKiZyrs.exe
  C:\Windows\System\aKiZyrs.exe
  2⤵
  PID:12260
- C:\Windows\System\codpzBw.exe
  C:\Windows\System\codpzBw.exe
  2⤵
  PID:12280
- C:\Windows\System\DcIzMCt.exe
  C:\Windows\System\DcIzMCt.exe
  2⤵
  PID:10676
- C:\Windows\System\uCvODVi.exe
  C:\Windows\System\uCvODVi.exe
  2⤵
  PID:11332
- C:\Windows\System\rxbvhCb.exe
  C:\Windows\System\rxbvhCb.exe
  2⤵
  PID:11392
- C:\Windows\System\OOKvHtH.exe
  C:\Windows\System\OOKvHtH.exe
  2⤵
  PID:11452
- C:\Windows\System\JmICoWb.exe
  C:\Windows\System\JmICoWb.exe
  2⤵
  PID:11532
- C:\Windows\System\ZIRBtiy.exe
  C:\Windows\System\ZIRBtiy.exe
  2⤵
  PID:11612
- C:\Windows\System\JoBxzYb.exe
  C:\Windows\System\JoBxzYb.exe
  2⤵
  PID:11688
- C:\Windows\System\uQlxBZG.exe
  C:\Windows\System\uQlxBZG.exe
  2⤵
  PID:11756
- C:\Windows\System\CavQXgM.exe
  C:\Windows\System\CavQXgM.exe
  2⤵
  PID:11812
- C:\Windows\System\KstIpKB.exe
  C:\Windows\System\KstIpKB.exe
  2⤵
  PID:11860
- C:\Windows\System\DpUjfYA.exe
  C:\Windows\System\DpUjfYA.exe
  2⤵
  PID:11916
- C:\Windows\System\cpdrEvU.exe
  C:\Windows\System\cpdrEvU.exe
  2⤵
  PID:11968
- C:\Windows\System\GwXMqYi.exe
  C:\Windows\System\GwXMqYi.exe
  2⤵
  PID:12028
- C:\Windows\System\UjaMDns.exe
  C:\Windows\System\UjaMDns.exe
  2⤵
  PID:12056
- C:\Windows\System\pqudprO.exe
  C:\Windows\System\pqudprO.exe
  2⤵
  PID:12136
- C:\Windows\System\MKAHHOz.exe
  C:\Windows\System\MKAHHOz.exe
  2⤵
  PID:11280
- C:\Windows\System\dNWqfyz.exe
  C:\Windows\System\dNWqfyz.exe
  2⤵
  PID:11284
- C:\Windows\System\pOXEibq.exe
  C:\Windows\System\pOXEibq.exe
  2⤵
  PID:11472
- C:\Windows\System\yIbBfNc.exe
  C:\Windows\System\yIbBfNc.exe
  2⤵
  PID:11720
- C:\Windows\System\kcIhwzn.exe
  C:\Windows\System\kcIhwzn.exe
  2⤵
  PID:11836
- C:\Windows\System\VNWOkTW.exe
  C:\Windows\System\VNWOkTW.exe
  2⤵
  PID:11952
- C:\Windows\System\pNldabN.exe
  C:\Windows\System\pNldabN.exe
  2⤵
  PID:12072
- C:\Windows\System\KNQpeDM.exe
  C:\Windows\System\KNQpeDM.exe
  2⤵
  PID:12112
- C:\Windows\System\KEwerek.exe
  C:\Windows\System\KEwerek.exe
  2⤵
  PID:10852
- C:\Windows\System\UJSsaPA.exe
  C:\Windows\System\UJSsaPA.exe
  2⤵
  PID:12080
- C:\Windows\System\SszFxae.exe
  C:\Windows\System\SszFxae.exe
  2⤵
  PID:11436
- C:\Windows\System\pdhObMH.exe
  C:\Windows\System\pdhObMH.exe
  2⤵
  PID:11176
- C:\Windows\System\KoiJCSl.exe
  C:\Windows\System\KoiJCSl.exe
  2⤵
  PID:11868
- C:\Windows\System\dgBKWDb.exe
  C:\Windows\System\dgBKWDb.exe
  2⤵
  PID:12316
- C:\Windows\System\bCtNvhS.exe
  C:\Windows\System\bCtNvhS.exe
  2⤵
  PID:12344
- C:\Windows\System\lfaLtlb.exe
  C:\Windows\System\lfaLtlb.exe
  2⤵
  PID:12364
- C:\Windows\System\JFLLWim.exe
  C:\Windows\System\JFLLWim.exe
  2⤵
  PID:12388
- C:\Windows\System\bclLQzx.exe
  C:\Windows\System\bclLQzx.exe
  2⤵
  PID:12416
- C:\Windows\System\EZfktUq.exe
  C:\Windows\System\EZfktUq.exe
  2⤵
  PID:12444
- C:\Windows\System\CwFWyIh.exe
  C:\Windows\System\CwFWyIh.exe
  2⤵
  PID:12468
- C:\Windows\System\xmALtoL.exe
  C:\Windows\System\xmALtoL.exe
  2⤵
  PID:12512
- C:\Windows\System\JjzevWB.exe
  C:\Windows\System\JjzevWB.exe
  2⤵
  PID:12540
- C:\Windows\System\OptOJFm.exe
  C:\Windows\System\OptOJFm.exe
  2⤵
  PID:12560
- C:\Windows\System\KVvYgMf.exe
  C:\Windows\System\KVvYgMf.exe
  2⤵
  PID:12596
- C:\Windows\System\dmgDxDj.exe
  C:\Windows\System\dmgDxDj.exe
  2⤵
  PID:12624
- C:\Windows\System\WncdkuV.exe
  C:\Windows\System\WncdkuV.exe
  2⤵
  PID:12640
- C:\Windows\System\qLhkEyd.exe
  C:\Windows\System\qLhkEyd.exe
  2⤵
  PID:12680
- C:\Windows\System\aVxuUZD.exe
  C:\Windows\System\aVxuUZD.exe
  2⤵
  PID:12716
- C:\Windows\System\KsZyvnO.exe
  C:\Windows\System\KsZyvnO.exe
  2⤵
  PID:12740
- C:\Windows\System\VgGZreo.exe
  C:\Windows\System\VgGZreo.exe
  2⤵
  PID:12760
- C:\Windows\System\aKCKhDe.exe
  C:\Windows\System\aKCKhDe.exe
  2⤵
  PID:12776
- C:\Windows\System\gqMVlbV.exe
  C:\Windows\System\gqMVlbV.exe
  2⤵
  PID:12828
- C:\Windows\System\adSVPcI.exe
  C:\Windows\System\adSVPcI.exe
  2⤵
  PID:12848
- C:\Windows\System\LJGkhHI.exe
  C:\Windows\System\LJGkhHI.exe
  2⤵
  PID:12876
- C:\Windows\System\JCDuCLk.exe
  C:\Windows\System\JCDuCLk.exe
  2⤵
  PID:12892
- C:\Windows\System\tbBBYmo.exe
  C:\Windows\System\tbBBYmo.exe
  2⤵
  PID:12916
- C:\Windows\System\KeFJhPV.exe
  C:\Windows\System\KeFJhPV.exe
  2⤵
  PID:12952
- C:\Windows\System\aVYoxBm.exe
  C:\Windows\System\aVYoxBm.exe
  2⤵
  PID:12988
- C:\Windows\System\lAdhWjX.exe
  C:\Windows\System\lAdhWjX.exe
  2⤵
  PID:13016
- C:\Windows\System\HRplPMN.exe
  C:\Windows\System\HRplPMN.exe
  2⤵
  PID:13044
- C:\Windows\System\ZIIuIdk.exe
  C:\Windows\System\ZIIuIdk.exe
  2⤵
  PID:13060
- C:\Windows\System\mwtANxA.exe
  C:\Windows\System\mwtANxA.exe
  2⤵
  PID:13084
- C:\Windows\System\YVPDNcI.exe
  C:\Windows\System\YVPDNcI.exe
  2⤵
  PID:13108
- C:\Windows\System\TJUTPOF.exe
  C:\Windows\System\TJUTPOF.exe
  2⤵
  PID:13148
- C:\Windows\System\xxMdCLP.exe
  C:\Windows\System\xxMdCLP.exe
  2⤵
  PID:13168
- C:\Windows\System\gXJAcqb.exe
  C:\Windows\System\gXJAcqb.exe
  2⤵
  PID:13192
- C:\Windows\System\dOZNJyj.exe
  C:\Windows\System\dOZNJyj.exe
  2⤵
  PID:13240
- C:\Windows\System\BwqerkU.exe
  C:\Windows\System\BwqerkU.exe
  2⤵
  PID:13260
- C:\Windows\System\ZHSJIiz.exe
  C:\Windows\System\ZHSJIiz.exe
  2⤵
  PID:13292
- C:\Windows\System\uMemTuV.exe
  C:\Windows\System\uMemTuV.exe
  2⤵
  PID:13308
- C:\Windows\System\hWFmmPm.exe
  C:\Windows\System\hWFmmPm.exe
  2⤵
  PID:12328
- C:\Windows\System\GsUYxRp.exe
  C:\Windows\System\GsUYxRp.exe
  2⤵
  PID:12488
- C:\Windows\System\aaGgdus.exe
  C:\Windows\System\aaGgdus.exe
  2⤵
  PID:12508
- C:\Windows\System\ukzNuZC.exe
  C:\Windows\System\ukzNuZC.exe
  2⤵
  PID:12584
- C:\Windows\System\YlfXgVB.exe
  C:\Windows\System\YlfXgVB.exe
  2⤵
  PID:12636
- C:\Windows\System\BwDKvLe.exe
  C:\Windows\System\BwDKvLe.exe
  2⤵
  PID:12712
- C:\Windows\System\GoeORLC.exe
  C:\Windows\System\GoeORLC.exe
  2⤵
  PID:12768
- C:\Windows\System\qofkXJw.exe
  C:\Windows\System\qofkXJw.exe
  2⤵
  PID:12840
- C:\Windows\System\dfcPNBj.exe
  C:\Windows\System\dfcPNBj.exe
  2⤵
  PID:12904
- C:\Windows\System\rOvtrsi.exe
  C:\Windows\System\rOvtrsi.exe
  2⤵
  PID:12976
- C:\Windows\System\nQXMRWm.exe
  C:\Windows\System\nQXMRWm.exe
  2⤵
  PID:13036
- C:\Windows\System\pZJrfhK.exe
  C:\Windows\System\pZJrfhK.exe
  2⤵
  PID:13136
- C:\Windows\System\oqmAAbY.exe
  C:\Windows\System\oqmAAbY.exe
  2⤵
  PID:13180
- C:\Windows\System\akAGRMz.exe
  C:\Windows\System\akAGRMz.exe
  2⤵
  PID:13256
- C:\Windows\System\wInVLNI.exe
  C:\Windows\System\wInVLNI.exe
  2⤵
  PID:12304
- C:\Windows\System\bYzeZYS.exe
  C:\Windows\System\bYzeZYS.exe
  2⤵
  PID:12308
- C:\Windows\System\ymLakUI.exe
  C:\Windows\System\ymLakUI.exe
  2⤵
  PID:12504
- C:\Windows\System\PdJfoBj.exe
  C:\Windows\System\PdJfoBj.exe
  2⤵
  PID:12548
- C:\Windows\System\yilFFgD.exe
  C:\Windows\System\yilFFgD.exe
  2⤵
  PID:12732
- C:\Windows\System\vDRvEYu.exe
  C:\Windows\System\vDRvEYu.exe
  2⤵
  PID:12860
- C:\Windows\System\RfXfSBU.exe
  C:\Windows\System\RfXfSBU.exe
  2⤵
  PID:12972
- C:\Windows\System\FPhKFKr.exe
  C:\Windows\System\FPhKFKr.exe
  2⤵
  PID:13232
- C:\Windows\System\qdMBSTc.exe
  C:\Windows\System\qdMBSTc.exe
  2⤵
  PID:12356
- C:\Windows\System\SlYEZIW.exe
  C:\Windows\System\SlYEZIW.exe
  2⤵
  PID:12752
- C:\Windows\System\WWCKisl.exe
  C:\Windows\System\WWCKisl.exe
  2⤵
  PID:12980
- C:\Windows\System\EWGGTqT.exe
  C:\Windows\System\EWGGTqT.exe
  2⤵
  PID:12568
- C:\Windows\System\QFCybqW.exe
  C:\Windows\System\QFCybqW.exe
  2⤵
  PID:13336
- C:\Windows\System\RcLHJlb.exe
  C:\Windows\System\RcLHJlb.exe
  2⤵
  PID:13360
- C:\Windows\System\zJknvDu.exe
  C:\Windows\System\zJknvDu.exe
  2⤵
  PID:13396
- C:\Windows\System\WkYkGeZ.exe
  C:\Windows\System\WkYkGeZ.exe
  2⤵
  PID:13424
- C:\Windows\System\vwLYYIs.exe
  C:\Windows\System\vwLYYIs.exe
  2⤵
  PID:13452
- C:\Windows\System\NVaLkwx.exe
  C:\Windows\System\NVaLkwx.exe
  2⤵
  PID:13476
- C:\Windows\System\ZQvfoat.exe
  C:\Windows\System\ZQvfoat.exe
  2⤵
  PID:13500
- C:\Windows\System\PSqegeI.exe
  C:\Windows\System\PSqegeI.exe
  2⤵
  PID:13560
- C:\Windows\System\sWUcfeG.exe
  C:\Windows\System\sWUcfeG.exe
  2⤵
  PID:13588
- C:\Windows\System\mXBDbrx.exe
  C:\Windows\System\mXBDbrx.exe
  2⤵
  PID:13616
- C:\Windows\System\ZjaZVpR.exe
  C:\Windows\System\ZjaZVpR.exe
  2⤵
  PID:13644
- C:\Windows\System\rLtbJpm.exe
  C:\Windows\System\rLtbJpm.exe
  2⤵
  PID:13672
- C:\Windows\System\jRSjrZl.exe
  C:\Windows\System\jRSjrZl.exe
  2⤵
  PID:13700
- C:\Windows\System\AYNcqOT.exe
  C:\Windows\System\AYNcqOT.exe
  2⤵
  PID:13728
- C:\Windows\System\OzgFOsM.exe
  C:\Windows\System\OzgFOsM.exe
  2⤵
  PID:13756
- C:\Windows\System\iOORdPw.exe
  C:\Windows\System\iOORdPw.exe
  2⤵
  PID:13784
- C:\Windows\System\mCHOKBk.exe
  C:\Windows\System\mCHOKBk.exe
  2⤵
  PID:13800
- C:\Windows\System\fKJMgva.exe
  C:\Windows\System\fKJMgva.exe
  2⤵
  PID:13828
- C:\Windows\System\oAGwkGf.exe
  C:\Windows\System\oAGwkGf.exe
  2⤵
  PID:13868
- C:\Windows\System\fMIuBwQ.exe
  C:\Windows\System\fMIuBwQ.exe
  2⤵
  PID:13884
- C:\Windows\System\fjHTAQx.exe
  C:\Windows\System\fjHTAQx.exe
  2⤵
  PID:13900
- C:\Windows\System\EdEpwiW.exe
  C:\Windows\System\EdEpwiW.exe
  2⤵
  PID:13924
- C:\Windows\System\FmcpcgF.exe
  C:\Windows\System\FmcpcgF.exe
  2⤵
  PID:13972
- C:\Windows\System\AHQykqJ.exe
  C:\Windows\System\AHQykqJ.exe
  2⤵
  PID:13992
- C:\Windows\System\SrEeBNz.exe
  C:\Windows\System\SrEeBNz.exe
  2⤵
  PID:14012
- C:\Windows\System\ZMfXTwD.exe
  C:\Windows\System\ZMfXTwD.exe
  2⤵
  PID:14036
- C:\Windows\System\FTdULmy.exe
  C:\Windows\System\FTdULmy.exe
  2⤵
  PID:14072
- C:\Windows\System\oEFkgJc.exe
  C:\Windows\System\oEFkgJc.exe
  2⤵
  PID:14120
- C:\Windows\System\XLlQGBe.exe
  C:\Windows\System\XLlQGBe.exe
  2⤵
  PID:14136
- C:\Windows\System\qzbnWKY.exe
  C:\Windows\System\qzbnWKY.exe
  2⤵
  PID:14164
- C:\Windows\System\BBRqFdT.exe
  C:\Windows\System\BBRqFdT.exe
  2⤵
  PID:14188
- C:\Windows\System\NaAIrdR.exe
  C:\Windows\System\NaAIrdR.exe
  2⤵
  PID:14220
- C:\Windows\System\wMYZVet.exe
  C:\Windows\System\wMYZVet.exe
  2⤵
  PID:14260
- C:\Windows\System\mvTFehS.exe
  C:\Windows\System\mvTFehS.exe
  2⤵
  PID:14276
- C:\Windows\System\TIpadbE.exe
  C:\Windows\System\TIpadbE.exe
  2⤵
  PID:14316
- C:\Windows\System\dxCAwTH.exe
  C:\Windows\System\dxCAwTH.exe
  2⤵
  PID:12944
- C:\Windows\System\SDUXOvs.exe
  C:\Windows\System\SDUXOvs.exe
  2⤵
  PID:12400
- C:\Windows\System\VmgOocs.exe
  C:\Windows\System\VmgOocs.exe
  2⤵
  PID:13380
- C:\Windows\System\VIzllWC.exe
  C:\Windows\System\VIzllWC.exe
  2⤵
  PID:13420
- C:\Windows\System\QgFwdfZ.exe
  C:\Windows\System\QgFwdfZ.exe
  2⤵
  PID:13488
- C:\Windows\System\jGAVelZ.exe
  C:\Windows\System\jGAVelZ.exe
  2⤵
  PID:13580
- C:\Windows\System\kGJUHMa.exe
  C:\Windows\System\kGJUHMa.exe
  2⤵
  PID:13632
- C:\Windows\System\zfxEheD.exe
  C:\Windows\System\zfxEheD.exe
  2⤵
  PID:13716
- C:\Windows\System\TzsjijF.exe
  C:\Windows\System\TzsjijF.exe
  2⤵
  PID:13776
- C:\Windows\System\iFzRmUi.exe
  C:\Windows\System\iFzRmUi.exe
  2⤵
  PID:13880
- C:\Windows\System\BLUJxBv.exe
  C:\Windows\System\BLUJxBv.exe
  2⤵
  PID:13892
- C:\Windows\System\qEZutiG.exe
  C:\Windows\System\qEZutiG.exe
  2⤵
  PID:13916
- C:\Windows\System\GQjpxXr.exe
  C:\Windows\System\GQjpxXr.exe
  2⤵
  PID:14028
- C:\Windows\System\TDYyObM.exe
  C:\Windows\System\TDYyObM.exe
  2⤵
  PID:14080
- C:\Windows\System\rqlWofL.exe
  C:\Windows\System\rqlWofL.exe
  2⤵
  PID:14132
- C:\Windows\System\IeLNVpX.exe
  C:\Windows\System\IeLNVpX.exe
  2⤵
  PID:14236
- C:\Windows\System\syRvFFh.exe
  C:\Windows\System\syRvFFh.exe
  2⤵
  PID:14272
- C:\Windows\System\hHXVhHg.exe
  C:\Windows\System\hHXVhHg.exe
  2⤵
  PID:13332
- C:\Windows\System\oxDcVAr.exe
  C:\Windows\System\oxDcVAr.exe
  2⤵
  PID:13444
- C:\Windows\System\BiGFFnH.exe
  C:\Windows\System\BiGFFnH.exe
  2⤵
  PID:13556
- C:\Windows\System\sYEOQYt.exe
  C:\Windows\System\sYEOQYt.exe
  2⤵
  PID:13712
- C:\Windows\System\uedWyKS.exe
  C:\Windows\System\uedWyKS.exe
  2⤵
  PID:13848
- C:\Windows\System\PQIAXlL.exe
  C:\Windows\System\PQIAXlL.exe
  2⤵
  PID:14056
- C:\Windows\System\ZrGvxqX.exe
  C:\Windows\System\ZrGvxqX.exe
  2⤵
  PID:14212
- C:\Windows\System\iYpXcSt.exe
  C:\Windows\System\iYpXcSt.exe
  2⤵
  PID:14328
- C:\Windows\System\ditGoKf.exe
  C:\Windows\System\ditGoKf.exe
  2⤵
  PID:13440
- C:\Windows\System\nWqqpsz.exe
  C:\Windows\System\nWqqpsz.exe
  2⤵
  PID:14004
- C:\Windows\System\trEogzV.exe
  C:\Windows\System\trEogzV.exe
  2⤵
  PID:13416
- C:\Windows\System\OjlAUTz.exe
  C:\Windows\System\OjlAUTz.exe
  2⤵
  PID:14340
- C:\Windows\System\kyicszv.exe
  C:\Windows\System\kyicszv.exe
  2⤵
  PID:14360
- C:\Windows\System\nEzLmEw.exe
  C:\Windows\System\nEzLmEw.exe
  2⤵
  PID:14388
- C:\Windows\System\yqUvdts.exe
  C:\Windows\System\yqUvdts.exe
  2⤵
  PID:14424
- C:\Windows\System\BJVejNP.exe
  C:\Windows\System\BJVejNP.exe
  2⤵
  PID:14452
- C:\Windows\System\IMHPnqF.exe
  C:\Windows\System\IMHPnqF.exe
  2⤵
  PID:14468
- C:\Windows\System\YjHBVgX.exe
  C:\Windows\System\YjHBVgX.exe
  2⤵
  PID:14500
- C:\Windows\System\AuVLeiv.exe
  C:\Windows\System\AuVLeiv.exe
  2⤵
  PID:14520
- C:\Windows\System\zUVIEcK.exe
  C:\Windows\System\zUVIEcK.exe
  2⤵
  PID:14540
- C:\Windows\System\AyAZMCS.exe
  C:\Windows\System\AyAZMCS.exe
  2⤵
  PID:14560
- C:\Windows\System\FCvczhR.exe
  C:\Windows\System\FCvczhR.exe
  2⤵
  PID:14596
- C:\Windows\System\UKWXjQK.exe
  C:\Windows\System\UKWXjQK.exe
  2⤵
  PID:14624
- C:\Windows\System\VMNrhnS.exe
  C:\Windows\System\VMNrhnS.exe
  2⤵
  PID:14676
- C:\Windows\System\AFfxzNl.exe
  C:\Windows\System\AFfxzNl.exe
  2⤵
  PID:14704
- C:\Windows\System\ZNmZXJP.exe
  C:\Windows\System\ZNmZXJP.exe
  2⤵
  PID:14724
- C:\Windows\System\UmQSDjH.exe
  C:\Windows\System\UmQSDjH.exe
  2⤵
  PID:14748
- C:\Windows\System\VVFmjAQ.exe
  C:\Windows\System\VVFmjAQ.exe
  2⤵
  PID:14788
- C:\Windows\System\LSrJAZf.exe
  C:\Windows\System\LSrJAZf.exe
  2⤵
  PID:14804
- C:\Windows\System\rajfZdF.exe
  C:\Windows\System\rajfZdF.exe
  2⤵
  PID:14844
- C:\Windows\System\NSXpsEj.exe
  C:\Windows\System\NSXpsEj.exe
  2⤵
  PID:14872
- C:\Windows\System\kCCngbY.exe
  C:\Windows\System\kCCngbY.exe
  2⤵
  PID:14900
- C:\Windows\System\yzKUzgU.exe
  C:\Windows\System\yzKUzgU.exe
  2⤵
  PID:14928
- C:\Windows\System\hHTgFzf.exe
  C:\Windows\System\hHTgFzf.exe
  2⤵
  PID:14948
- C:\Windows\System\aNpbVPi.exe
  C:\Windows\System\aNpbVPi.exe
  2⤵
  PID:14972
- C:\Windows\System\zIbZqkw.exe
  C:\Windows\System\zIbZqkw.exe
  2⤵
  PID:14996
- C:\Windows\System\BzFWCXN.exe
  C:\Windows\System\BzFWCXN.exe
  2⤵
  PID:15028
- C:\Windows\System\ijlelQI.exe
  C:\Windows\System\ijlelQI.exe
  2⤵
  PID:15044
- C:\Windows\System\dbatSlw.exe
  C:\Windows\System\dbatSlw.exe
  2⤵
  PID:15060
- C:\Windows\System\aHQLhIj.exe
  C:\Windows\System\aHQLhIj.exe
  2⤵
  PID:15092
- C:\Windows\System\QrSAvga.exe
  C:\Windows\System\QrSAvga.exe
  2⤵
  PID:15116
- C:\Windows\System\MLpkdyu.exe
  C:\Windows\System\MLpkdyu.exe
  2⤵
  PID:15144
- C:\Windows\System\cQnScTk.exe
  C:\Windows\System\cQnScTk.exe
  2⤵
  PID:15204
- C:\Windows\System\DsQudwQ.exe
  C:\Windows\System\DsQudwQ.exe
  2⤵
  PID:15224
- C:\Windows\System\cqrocWH.exe
  C:\Windows\System\cqrocWH.exe
  2⤵
  PID:15248
- C:\Windows\System\bKxZbQl.exe
  C:\Windows\System\bKxZbQl.exe
  2⤵
  PID:15268
- C:\Windows\System\JHJphIT.exe
  C:\Windows\System\JHJphIT.exe
  2⤵
  PID:15296
- C:\Windows\System\OZkGwWs.exe
  C:\Windows\System\OZkGwWs.exe
  2⤵
  PID:15328
- C:\Windows\System\TQmcKOo.exe
  C:\Windows\System\TQmcKOo.exe
  2⤵
  PID:14092
- C:\Windows\System\vMolWWN.exe
  C:\Windows\System\vMolWWN.exe
  2⤵
  PID:14384
- C:\Windows\System\DaudXmA.exe
  C:\Windows\System\DaudXmA.exe
  2⤵
  PID:14440
- C:\Windows\System\TiIlQsn.exe
  C:\Windows\System\TiIlQsn.exe
  2⤵
  PID:14460
- C:\Windows\System\yJAHUlw.exe
  C:\Windows\System\yJAHUlw.exe
  2⤵
  PID:14528
- C:\Windows\System\wKGrxdj.exe
  C:\Windows\System\wKGrxdj.exe
  2⤵
  PID:14620
- C:\Windows\System\mzsKTuz.exe
  C:\Windows\System\mzsKTuz.exe
  2⤵
  PID:14716
- C:\Windows\System\qRUlwDG.exe
  C:\Windows\System\qRUlwDG.exe
  2⤵
  PID:14796
- C:\Windows\System\pYiOEgT.exe
  C:\Windows\System\pYiOEgT.exe
  2⤵
  PID:14884
- C:\Windows\System\LLihgMN.exe
  C:\Windows\System\LLihgMN.exe
  2⤵
  PID:14936
- C:\Windows\System\IwVKgUu.exe
  C:\Windows\System\IwVKgUu.exe
  2⤵
  PID:14984
- C:\Windows\System\psgrQWq.exe
  C:\Windows\System\psgrQWq.exe
  2⤵
  PID:15056
- C:\Windows\System\xSnAumT.exe
  C:\Windows\System\xSnAumT.exe
  2⤵
  PID:15104
- C:\Windows\System\lCJCMqd.exe
  C:\Windows\System\lCJCMqd.exe
  2⤵
  PID:15200
- C:\Windows\System\QkcExeI.exe
  C:\Windows\System\QkcExeI.exe
  2⤵
  PID:15264
- C:\Windows\System\AfloAUT.exe
  C:\Windows\System\AfloAUT.exe
  2⤵
  PID:15324
- C:\Windows\System\cYHDdUr.exe
  C:\Windows\System\cYHDdUr.exe
  2⤵
  PID:14420
- C:\Windows\System\xORongv.exe
  C:\Windows\System\xORongv.exe
  2⤵
  PID:14696
- C:\Windows\System\RIQAfKG.exe
  C:\Windows\System\RIQAfKG.exe
  2⤵
  PID:14744
- C:\Windows\System\EYQYBSN.exe
  C:\Windows\System\EYQYBSN.exe
  2⤵
  PID:14960
- C:\Windows\System\LuryiFL.exe
  C:\Windows\System\LuryiFL.exe
  2⤵
  PID:14992
- C:\Windows\System\ltNlvkd.exe
  C:\Windows\System\ltNlvkd.exe
  2⤵
  PID:15176
- C:\Windows\System\xoNlEqM.exe
  C:\Windows\System\xoNlEqM.exe
  2⤵
  PID:14196
- C:\Windows\System\dYnsSXN.exe
  C:\Windows\System\dYnsSXN.exe
  2⤵
  PID:14868
- C:\Windows\System\wdOaLFJ.exe
  C:\Windows\System\wdOaLFJ.exe
  2⤵
  PID:14548
- C:\Windows\System\zhpiuoa.exe
  C:\Windows\System\zhpiuoa.exe
  2⤵
  PID:14760
- C:\Windows\System\YXlhJji.exe
  C:\Windows\System\YXlhJji.exe
  2⤵
  PID:15368
- C:\Windows\System\AuroWnR.exe
  C:\Windows\System\AuroWnR.exe
  2⤵
  PID:15412
- C:\Windows\System\hWMeoSi.exe
  C:\Windows\System\hWMeoSi.exe
  2⤵
  PID:15432
- C:\Windows\System\mCpXYFK.exe
  C:\Windows\System\mCpXYFK.exe
  2⤵
  PID:15456
- C:\Windows\System\unUYxdV.exe
  C:\Windows\System\unUYxdV.exe
  2⤵
  PID:15492
- C:\Windows\System\VdYwndu.exe
  C:\Windows\System\VdYwndu.exe
  2⤵
  PID:15512
- C:\Windows\System\cqPVwnM.exe
  C:\Windows\System\cqPVwnM.exe
  2⤵
  PID:15532
- C:\Windows\System\qOkoQnL.exe
  C:\Windows\System\qOkoQnL.exe
  2⤵
  PID:15556
- C:\Windows\System\xwqvhbv.exe
  C:\Windows\System\xwqvhbv.exe
  2⤵
  PID:15604
- C:\Windows\System\vYrdZJi.exe
  C:\Windows\System\vYrdZJi.exe
  2⤵
  PID:15624
- C:\Windows\System\VkKntuD.exe
  C:\Windows\System\VkKntuD.exe
  2⤵
  PID:15648
- C:\Windows\System\qEmtqAi.exe
  C:\Windows\System\qEmtqAi.exe
  2⤵
  PID:15668
- C:\Windows\System\uWoWOue.exe
  C:\Windows\System\uWoWOue.exe
  2⤵
  PID:15696
- C:\Windows\System\ioQyaDn.exe
  C:\Windows\System\ioQyaDn.exe
  2⤵
  PID:15736
- C:\Windows\System\JyGRRcc.exe
  C:\Windows\System\JyGRRcc.exe
  2⤵
  PID:15772
- C:\Windows\System\BYMDZEK.exe
  C:\Windows\System\BYMDZEK.exe
  2⤵
  PID:15804
- C:\Windows\System\DMsgoYP.exe
  C:\Windows\System\DMsgoYP.exe
  2⤵
  PID:15844
- C:\Windows\System\sZwZYAb.exe
  C:\Windows\System\sZwZYAb.exe
  2⤵
  PID:15860
- C:\Windows\System\puBRbOq.exe
  C:\Windows\System\puBRbOq.exe
  2⤵
  PID:15900
- C:\Windows\System\Rtbilhd.exe
  C:\Windows\System\Rtbilhd.exe
  2⤵
  PID:15920
- C:\Windows\System\DSRvyxZ.exe
  C:\Windows\System\DSRvyxZ.exe
  2⤵
  PID:15944
- C:\Windows\System\bKTxQqF.exe
  C:\Windows\System\bKTxQqF.exe
  2⤵
  PID:15972
- C:\Windows\System\OYgPjaZ.exe
  C:\Windows\System\OYgPjaZ.exe
  2⤵
  PID:15992
- C:\Windows\System\CtDhPpG.exe
  C:\Windows\System\CtDhPpG.exe
  2⤵
  PID:16028
- C:\Windows\System\FnoaCTs.exe
  C:\Windows\System\FnoaCTs.exe
  2⤵
  PID:16048
- C:\Windows\System\VCHtuax.exe
  C:\Windows\System\VCHtuax.exe
  2⤵
  PID:16068
- C:\Windows\System\xTkGezM.exe
  C:\Windows\System\xTkGezM.exe
  2⤵
  PID:16112
- C:\Windows\System\MhZFKWW.exe
  C:\Windows\System\MhZFKWW.exe
  2⤵
  PID:16140
- C:\Windows\System\RwrgzmU.exe
  C:\Windows\System\RwrgzmU.exe
  2⤵
  PID:16180
- C:\Windows\System\VgqOtnb.exe
  C:\Windows\System\VgqOtnb.exe
  2⤵
  PID:16208
- C:\Windows\System\tYbDkuJ.exe
  C:\Windows\System\tYbDkuJ.exe
  2⤵
  PID:16236
- C:\Windows\System\DcQMVan.exe
  C:\Windows\System\DcQMVan.exe
  2⤵
  PID:16252
- C:\Windows\System\NejFTFN.exe
  C:\Windows\System\NejFTFN.exe
  2⤵
  PID:16292
- C:\Windows\System\pbefYCF.exe
  C:\Windows\System\pbefYCF.exe
  2⤵
  PID:16308
- C:\Windows\System\KsMECLN.exe
  C:\Windows\System\KsMECLN.exe
  2⤵
  PID:16324
- C:\Windows\System\dYJlQRV.exe
  C:\Windows\System\dYJlQRV.exe
  2⤵
  PID:16356
- C:\Windows\System\CXqyokR.exe
  C:\Windows\System\CXqyokR.exe
  2⤵
  PID:16376
- C:\Windows\System\dMpFEaF.exe
  C:\Windows\System\dMpFEaF.exe
  2⤵
  PID:15388
- C:\Windows\System\USJDAki.exe
  C:\Windows\System\USJDAki.exe
  2⤵
  PID:13852
- C:\Windows\System\gUQqibd.exe
  C:\Windows\System\gUQqibd.exe
  2⤵
  PID:15508
- C:\Windows\System\DrddSrV.exe
  C:\Windows\System\DrddSrV.exe
  2⤵
  PID:15616
- C:\Windows\System\JsjAEBZ.exe
  C:\Windows\System\JsjAEBZ.exe
  2⤵
  PID:15644
- C:\Windows\System\iToQElv.exe
  C:\Windows\System\iToQElv.exe
  2⤵
  PID:15684
- C:\Windows\System\WGVaiPs.exe
  C:\Windows\System\WGVaiPs.exe
  2⤵
  PID:15768
- C:\Windows\System\AMgbPye.exe
  C:\Windows\System\AMgbPye.exe
  2⤵
  PID:15816
- C:\Windows\System\fvGuaZK.exe
  C:\Windows\System\fvGuaZK.exe
  2⤵
  PID:15876
- C:\Windows\System\HDsdsnk.exe
  C:\Windows\System\HDsdsnk.exe
  2⤵
  PID:15916
- C:\Windows\System\ekgnpGW.exe
  C:\Windows\System\ekgnpGW.exe
  2⤵
  PID:15988
- C:\Windows\System\csQhnLi.exe
  C:\Windows\System\csQhnLi.exe
  2⤵
  PID:16016
- C:\Windows\System\sklUhLQ.exe
  C:\Windows\System\sklUhLQ.exe
  2⤵
  PID:16060
- C:\Windows\System\UXxmCZL.exe
  C:\Windows\System\UXxmCZL.exe
  2⤵
  PID:16108
- C:\Windows\System\ehGNcWr.exe
  C:\Windows\System\ehGNcWr.exe
  2⤵
  PID:16204
- C:\Windows\System\XWaWGDL.exe
  C:\Windows\System\XWaWGDL.exe
  2⤵
  PID:16244
- C:\Windows\System\JXwJjka.exe
  C:\Windows\System\JXwJjka.exe
  2⤵
  PID:16300
- C:\Windows\System\kpFXWAw.exe
  C:\Windows\System\kpFXWAw.exe
  2⤵
  PID:15444
- C:\Windows\System\VRDTaKC.exe
  C:\Windows\System\VRDTaKC.exe
  2⤵
  PID:15520
- C:\Windows\System\jqMGMaO.exe
  C:\Windows\System\jqMGMaO.exe
  2⤵
  PID:15940
- C:\Windows\System\gsAUvDE.exe
  C:\Windows\System\gsAUvDE.exe
  2⤵
  PID:16124
- C:\Windows\System\WJoTKZE.exe
  C:\Windows\System\WJoTKZE.exe
  2⤵
  PID:16136
- C:\Windows\System\QkhmJoI.exe
  C:\Windows\System\QkhmJoI.exe
  2⤵
  PID:16304
- C:\Windows\System\IhpVidc.exe
  C:\Windows\System\IhpVidc.exe
  2⤵
  PID:15380
- C:\Windows\System\eTsuNFp.exe
  C:\Windows\System\eTsuNFp.exe
  2⤵
  PID:16040
- C:\Windows\System\XZwUnPl.exe
  C:\Windows\System\XZwUnPl.exe
  2⤵
  PID:15364
- C:\Windows\System\LtsZpjs.exe
  C:\Windows\System\LtsZpjs.exe
  2⤵
  PID:15680
- C:\Windows\System\KLAvmFn.exe
  C:\Windows\System\KLAvmFn.exe
  2⤵
  PID:16404
- C:\Windows\System\aFbezTh.exe
  C:\Windows\System\aFbezTh.exe
  2⤵
  PID:16468
- C:\Windows\System\YJIQghZ.exe
  C:\Windows\System\YJIQghZ.exe
  2⤵
  PID:16484
- C:\Windows\System\nYLEROc.exe
  C:\Windows\System\nYLEROc.exe
  2⤵
  PID:16512
- C:\Windows\System\dqGlGIE.exe
  C:\Windows\System\dqGlGIE.exe
  2⤵
  PID:16528
- C:\Windows\System\fLSfXup.exe
  C:\Windows\System\fLSfXup.exe
  2⤵
  PID:16548
- C:\Windows\System\RZNFLGC.exe
  C:\Windows\System\RZNFLGC.exe
  2⤵
  PID:16584
- C:\Windows\System\DaWyhWa.exe
  C:\Windows\System\DaWyhWa.exe
  2⤵
  PID:16600
- C:\Windows\System\rwyrGof.exe
  C:\Windows\System\rwyrGof.exe
  2⤵
  PID:16616
- C:\Windows\System\Pdzjstk.exe
  C:\Windows\System\Pdzjstk.exe
  2⤵
  PID:16632
- C:\Windows\System\xqOMmvQ.exe
  C:\Windows\System\xqOMmvQ.exe
  2⤵
  PID:16652
- C:\Windows\System\YpRDxEQ.exe
  C:\Windows\System\YpRDxEQ.exe
  2⤵
  PID:16684
- C:\Windows\System\ULWsrTo.exe
  C:\Windows\System\ULWsrTo.exe
  2⤵
  PID:16728
- C:\Windows\System\DHeJODU.exe
  C:\Windows\System\DHeJODU.exe
  2⤵
  PID:16760
- C:\Windows\System\VotXQvW.exe
  C:\Windows\System\VotXQvW.exe
  2⤵
  PID:16784
- C:\Windows\System\NgOQwFo.exe
  C:\Windows\System\NgOQwFo.exe
  2⤵
  PID:16840
- C:\Windows\System\wlySdSj.exe
  C:\Windows\System\wlySdSj.exe
  2⤵
  PID:16860
- C:\Windows\System\uiczlPo.exe
  C:\Windows\System\uiczlPo.exe
  2⤵
  PID:16876

Network

DNS

232.168.11.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.168.11.51.in-addr.arpa

IN PTR

Response
DNS

232.168.11.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.168.11.51.in-addr.arpa

IN PTR
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR
DNS

71.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

71.159.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

206.221.208.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.221.208.4.in-addr.arpa

IN PTR

Response
DNS

156.33.209.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

156.33.209.4.in-addr.arpa

IN PTR

Response
DNS

81.144.22.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

81.144.22.2.in-addr.arpa

IN PTR

Response

81.144.22.2.in-addr.arpa

IN PTR

a2-22-144-81deploystaticakamaitechnologiescom
DNS

11.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

11.227.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

232.168.11.51.in-addr.arpa

dns

144 B
158 B
2
1

DNS Request

232.168.11.51.in-addr.arpa

DNS Request

232.168.11.51.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

148 B
128 B
2
1

DNS Request

172.210.232.199.in-addr.arpa

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

71.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

71.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

206.221.208.4.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

206.221.208.4.in-addr.arpa
8.8.8.8:53

156.33.209.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

156.33.209.4.in-addr.arpa
8.8.8.8:53

81.144.22.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

81.144.22.2.in-addr.arpa
8.8.8.8:53

11.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

11.227.111.52.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BJdAXhu.exe

Filesize
1.4MB

MD5
7c63cdd547a9f46501a6b86aa8f00d03

SHA1
3d07929996f1c044d469a45d3d8a58bbd5329d45

SHA256
cfcc4ccc9184c431d4b8175ceab9c1eb73de3e4b850477bc982efbdc328604c6

SHA512
37c06151f72cc06147f4d59e1233f1f8e35c483709cb8919e265810a5438ad3102e13908e3223c6a8f4f4e6ec16ef76c36099d5b20fac9097985c0befb78db71

Download Submit
C:\Windows\System\FQHYTLe.exe

Filesize
1.4MB

MD5
0370da08004ae491b1a03e478fb783f4

SHA1
9a88c8a0928dbafb41d215eb5f70bcaf9d263a86

SHA256
df0e2d2a2954437a864b1d09ac959fbd9f859c47f06787d492b5045a106cdf80

SHA512
e87e58f78bcb2b73e377027d3e7c31eba8528382d80ce1e119c98bda7e1befe60cadcb6ee660a4beace291bcbd66d21de0ce8199088d6b32bf84f9cda5f10ff0

Download Submit
C:\Windows\System\GghakFu.exe

Filesize
1.4MB

MD5
06a37b79f386de3160d40a4140dcc643

SHA1
be304755dc52cd3e32daa867dd5c2ba19ee466be

SHA256
c43486b8d55abf27f6acae364f0e9385b1361b269e759c168da54358807b9606

SHA512
4d34e8aa36783007744550b82c11727adca48cecb0b6427255fb705b0d89fb6d7b82063b727fc41f063992479350313a24fdf20525c480077349888fb981863c

Download Submit
C:\Windows\System\IFuywOi.exe

Filesize
1.4MB

MD5
ac672c24b2a97bb36d31e7e99af82700

SHA1
ef093733b77f113546f127015acde9b941f06d26

SHA256
a7d5169c0436356f317dc39f705ed4da7a5937c7b04650e1e43131b5b20cb488

SHA512
6954d42c0ddd0b4f1ee4d45319fe2aac6d67f65102f3ffc50261a8a0bb3fa43b0a354a365bc812dee5a550a790bbc0b74172b9d61eb9bc925d10980882b19c86

Download Submit
C:\Windows\System\LZmxlGU.exe

Filesize
1.4MB

MD5
cb645a7c19cb5fbcaab96f5446617906

SHA1
3219e78b8f9d2ca54878d855bcee881ecafac471

SHA256
6558ec1db9cd6d466ab702c05255f3dd833d44237ff1ba585c626450092cde25

SHA512
ad384b762e9a111a9916a619057d936a06e7f119ae44f36f0de19f2e83b9400013621928202f1172b41eb67ebc6ead0027a405a3483fbebcc528589b8a7a6fc2

Download Submit
C:\Windows\System\LkVLHDS.exe

Filesize
1.4MB

MD5
5c4ad3770f48747a8d1aba06788d0524

SHA1
acd3fa40bb44d00364eca8eac0ca9e3402413106

SHA256
f8882a67070d7adee22186a5e7615be61d15344973acea9dd385e94175d72510

SHA512
b07653ee8cfda1fb7ffacdda9bf261257735ab7ea2e7e48fdb213be64b1a9f4156b867157019605a5441ac49e0d1adfb3d9a94378b2269d2aa218e7dfe220df7

Download Submit
C:\Windows\System\MRZslzE.exe

Filesize
1.4MB

MD5
41c48149dfd66fc44773bacecb94329e

SHA1
2f7d83f673a42e6ee1e58a15d72e8d8c360897dc

SHA256
42d8b9826e27bf350c84f81d659c9cb04f5458270f3da8b75fc07b53b2f66ada

SHA512
d3fc5b5b0f915990a63e4ea5f9947707e03063b44fa1005b4e11e79dacf365afa1633d754bc9669679e7a40775cf64251de0c1392598a8ad42e13473b738692a

Download Submit
C:\Windows\System\MZZmbQy.exe

Filesize
1.4MB

MD5
8626130f96f633ac0692838366bbc35d

SHA1
a9f18f0869ce7f3c46c6f58fb462a9adc522ee0c

SHA256
41373c71028fa05bd3014713487271f750ec2a5f052953fc50ff7e526d9ff389

SHA512
77f99ad6d18fd1cf4bbd74bc245cefb7140dcdca04c22c7c5c213a5251b54a2296c9e3d7c2262b524440508a625e88ddde2f2312cb9360c9108c0fcc6f2e03a1

Download Submit
C:\Windows\System\QRlSlRx.exe

Filesize
1.4MB

MD5
420b4818e3bb454b5f024c51c8a8f637

SHA1
fdc2278999723360a442bc94d02eb2dcb819010b

SHA256
5e748f8ec89ecf7e8ec28728678d1fe2a86ee626a69aea7e4a36ea18b8af9a1e

SHA512
296246bce3c412006d24e51e37776b449c53e1738e119ab0b5d6127b635159b5060a38c0d1c89f5b9562f5adece79d9d910a8295228e38b93b3a271eb0fac33e

Download Submit
C:\Windows\System\Rnlopii.exe

Filesize
1.4MB

MD5
7854a1c97c9d3f5c5b540f2e34392fa1

SHA1
00592f6af7a6fec40406917f574b280851f0e04a

SHA256
a8c3bd52202459802d4db4dbc2c75928f3ebcdd1763163e5db4636f52f7804db

SHA512
22b318a847c900047a7b66173c342b733109d4db78b59c47f3d61f64304d2a9fe8998372640f8c2595766a75684aaa97abad265b8f68331c442976a413e5e903

Download Submit
C:\Windows\System\TLTMrwk.exe

Filesize
1.4MB

MD5
7093f6786f66bda36f2d237e81950e23

SHA1
9c442337ffaecd2508cde00e2c8ad54c7eea4d9e

SHA256
0cab60270dc5040cc1d1cc271c566096ede21a1bd2c27b821f00dc8fcda3a4b5

SHA512
6b097eb9c8b1d4612f34d4b051d0359ea9a943b320677d72531ab1250e568326f7d1c39cacdc53c0757b2a174c0adbc7e8a2056743f83bd9ba1358cfb4d5c437

Download Submit
C:\Windows\System\TgyMlxP.exe

Filesize
1.4MB

MD5
c478a1bb303de149301672b97bb4bf0b

SHA1
0c566a593d9512524c1c5753c5431d3e62733608

SHA256
b75612184489ca5c4320ae740dc2cef0d877d6b913e22571cfd0005d9eb7dc10

SHA512
a5a7e82cc7664aabbe7d591cb85605aa31216c3d5a00b2d1ae19d938c1f7dfc2eed871ebd78424a14737a81008fb19ecad31416d3fe558f8de56e721ab56ca0c

Download Submit
C:\Windows\System\UfEGtYR.exe

Filesize
1.4MB

MD5
a5d64d80ca52b7a0f2316b3e8d488e77

SHA1
876700cd8f35bfc25700e289023fc87414a74bb3

SHA256
3a32c8f30b0020c993e2428035b45c507bc508cf20ee59c5ab8fe9bd9c16a7c5

SHA512
e3b1e38d4298c5bbbbb8904b5359c0e3adcefc1715084db4b10947f47b3b1f13ea5e9a733d0cbf44eaa06150988243b907347a085148b9cc9322136fd1ff6bae

Download Submit
C:\Windows\System\UjtlKqX.exe

Filesize
1.4MB

MD5
664ca8252000539e7fd52913a6b1eb85

SHA1
15666b456c23f083bf5d10ceb464b2b457f72c3a

SHA256
4a647d9f0897df262efa53fc41cfd04d27a0e3aa6366a1f32ddfde0aadfeccec

SHA512
4ae1cd960a84e5671fa0ce86560c583c5a98bd963d6d01a2c272dd2e82422e025939b32c43f88d9330280afcb54bc99cdd1c41e80b170565eec901c109cae8c3

Download Submit
C:\Windows\System\YJUDfaC.exe

Filesize
1.4MB

MD5
202a01aceba1bfc44bf8a4d7283e9434

SHA1
c819e1f8f1870234bfbc654a82f1f16ad79fc285

SHA256
4d13dd11795e7a7d7388ecea551033a268ef7e11f3182a379ca41eabde20b785

SHA512
464eb45b32f21970d02ca757d341f4f6526a9e747766ea263047f8bbab805f38ab47ed976fb04d7cf17623061c268a30d3a8b9d878267dd51354172fbc1d1ec0

Download Submit
C:\Windows\System\YuLfsnh.exe

Filesize
1.4MB

MD5
77c8b6c49714e25915c1e68e047a307e

SHA1
76cee2f204b5cd60d68ff1c98ed2da2bca4f122b

SHA256
4ea01263d4331dfb6333a719303013fa026cc5b51cee07cecc2e32be03d893fc

SHA512
fb2b096751672e8a083a654a72201404ba621ee11b77957c6d535f1e4fb4b930ab684093c877e87dc98be6d71cd17649126a80a52d1f4e962db3840e71c4db51

Download Submit
C:\Windows\System\ZhqnXSj.exe

Filesize
1.4MB

MD5
71307242bd5a7848ce19d9054209dc0e

SHA1
d6a4a1446e46f50315b4e8590e35b69c205115df

SHA256
b87dda43cddc2f4bc513b21d8270ba3cb481ff21715068efd471fe9db5804c26

SHA512
1da3c82e17814e2e263e83053db330b3864567b7fd5007e456b4f51ff3e437bbd801baebde596d6e5a1a6f0ae4a0764a4852b22a7109a8a5470a017d599625f5

Download Submit
C:\Windows\System\aaPkrOq.exe

Filesize
1.4MB

MD5
4f05d120664c39503b78b7f04d7820d4

SHA1
3a2014b0b429883754932ff92b7c0bbd8079aea6

SHA256
6428645d23454598b7cba60246668995e1df4dee59fb694bc05f4d02be456cb3

SHA512
c7d721a6f9918d88bc3eeb23b423b567264988d2c133d9b4bb34678c46792cfd5e352a7cd9bc2bcf8ac6521a8b03c3c9823abbd6a53965951cbc58aa22116f5d

Download Submit
C:\Windows\System\bCyOqhm.exe

Filesize
1.4MB

MD5
ff9903c3dfed0c62bb65dbdf3699f440

SHA1
0f281fb33ecc52e09a8aa98f31a9c6bfdd5e7030

SHA256
28b8758e8cc69104636a397efac8b1474729108329010a7b0f4b5f6167bd5369

SHA512
cfef85f444ad8e9394f24c9fc3de03c5168a5e6fa63871aef421fe1c389690e05fea670805ca2cc9c307c1ec5c9d30639914a0af24a671acb9abe998acc77775

Download Submit
C:\Windows\System\bHeNfCN.exe

Filesize
1.4MB

MD5
7dff5511d3401763e4a5c34a609dd281

SHA1
0eee52ef8b301ec647797b951ce28646ee6ac41b

SHA256
ae893d360039f1a9de32d7a13208a30f98ddb9471aee2e44750edd52006b1407

SHA512
929b03b9f1050f1d2806061c8923dda1cf54770049fb5b595f6eacdbff1b2c9d74e6584c5de50b64e99627f52614dc738a400d0c104378acd1c39965c3087f0c

Download Submit
C:\Windows\System\fAsnnCl.exe

Filesize
1.4MB

MD5
6bc6d9526eaca81512ddd2061f087d0d

SHA1
4f5c3ff69a415c8d9f0a55d1132fd348dd19fb54

SHA256
7ba902edb533a24c2d182d3e483175dac7a3ae2db2d9aa5cf6cc912e1e7a2bad

SHA512
12cbb0642e1bb3995d610f6db7ecdc1de0b9552a3b2c955585fba401048d3e48b8e4bf380f8667d2b603a5837fbf7e4e10f0d66a960b09e8f8e64c871fe6fae7

Download Submit
C:\Windows\System\hisPDmK.exe

Filesize
1.4MB

MD5
6bbdb3e970e98011e8b94302dde81b2d

SHA1
f67501906aeb460c425c8783fcbdc426791d5d1e

SHA256
7791d82d5e7c02193cd2e48385d4980f99cfeddf6662aaed6143500ff77b3e78

SHA512
e58c7e31a5d0db83861d5dcad66f71b71c987eff15a1e47c1f9f9d77334b6e4efbef6185134e36bf74432ede1d1ee99ea4a3cc64904fd4034444f35c25e2c6aa

Download Submit
C:\Windows\System\ioJFgZT.exe

Filesize
1.4MB

MD5
bdbf7cc463a5f7f86beae87c6954ee94

SHA1
4502e3494383acdc4ff661b845e4642c00b799c5

SHA256
ed5bd6456667b784f9d8235e532512da3c804b2f79aa5556d31a8dc323dfd3aa

SHA512
88a471f87b3fc9b9e7864a3d5ee62dbf689c71ca8a464e503bf9cbdf6642e7d55de1821595ea5e89ef026db064cb0952a51dc30ca24a4162d6524a67e510495a

Download Submit
C:\Windows\System\kPRCZUi.exe

Filesize
1.4MB

MD5
aa912c3d329465a30418aea04f7e6d73

SHA1
fd504d145e76450e1ff5422f8f339c5118822c45

SHA256
bf26b5896a72bcf4ca697fe88793ad90a2c6f7ab069c2488405291a4c906048b

SHA512
de6a2b768701b711080954c5d2aeef479833c9be2b6fcc5e018803417b591c9b8cc8a2b635ed1ccc10cea70c09bcbbd29a4e611102562fec6b3c6c0313e8a2fa

Download Submit
C:\Windows\System\lzPmhig.exe

Filesize
1.4MB

MD5
d97c7adf91afeea65899e07043f62c4a

SHA1
79ca97c1e48cb0e1332a10578bba3571cfaf547a

SHA256
4738cdb82aaace2bc5ecb25274ada332fa48154f1fc922d02eac1cb11195a417

SHA512
4327f427481fdaf0ebfa985489a33388cdbfb3b91de6ca26dae20c03f77615204f6318fcc70ea7afc1885a480e861e4734903708994975ed0e6364ffe7b7ed34

Download Submit
C:\Windows\System\mzjLyNI.exe

Filesize
1.4MB

MD5
fe47eb6a1bf3001adc80d834429347f7

SHA1
158c313385623cdbc95f269c8368217cb1c471e3

SHA256
8b1a148dcb145516b4b8cf66acbd9b39f88d1d6f827c39b8d5beff3f1a145050

SHA512
b0115e94ad8f87a376dcacdf053b6885bdd9547ff8c616c887765c8ec8670203aec7e18ef48ba22462dd5be3a2c3b5567cb1cf07edb6484af7bc9a1a8fee0d23

Download Submit
C:\Windows\System\ooExBKo.exe

Filesize
1.4MB

MD5
990ade6e2448c2a9cb06a7fec3bd21a2

SHA1
80355914144b11df5ad48d65e728199da1d3c680

SHA256
1fd22a57cbbc7317a4ff603fa84385ad55c200197b0a0c40a36e71052449d989

SHA512
34bb63c495e59cdba841d7a33f18752b990b9823c57d4c87e2bc63f8848422c2d043466f0d5d3932e2cb3bd2ddf1d60d872660a3d139783718b15ccfc86b4086

Download Submit
C:\Windows\System\oruAPzv.exe

Filesize
1.4MB

MD5
fcb8b58ae0c3dcfddc630becbfbf955a

SHA1
a005957a086a97651b1c3254bce6e648f2374de8

SHA256
f01ac8aeb49596d69def8d825dd7eedda6a26ca81db828fc5fe2912a60756b88

SHA512
6fea4d77d3f218a0ca23563585a1e999208171535e977b8a664855822bf5093ca6de9e10120e0df49c8916de0a3d9f91cf600655ca80eba573b45de51a82c948

Download Submit
C:\Windows\System\rzhcKKw.exe

Filesize
1.4MB

MD5
f1c67de96d6e9362217559c490b95772

SHA1
8352c561fffc3a9a28c6b0d86c18ddac64012bd4

SHA256
f105fab18e048efe48754b651fc07db64531d2e9a3bb1fb8e5e97ab5671aed3c

SHA512
b686fdf5ce212c5e3553be5014ef33b74484ec40f9c3887e079f30c10d1d3e6a809cc0d9423246534769c80bccac19067bf7fa5e791a4122a42b1ce9dd605e2e

Download Submit
C:\Windows\System\uEuqodF.exe

Filesize
1.4MB

MD5
00d6dd07a760057b6c8bb35bd7ff5764

SHA1
29a833873653f57431a50968cee602746944a27b

SHA256
6b3b0c2a23754918d72bf5cc88cf252b4d42e9fe808184ef7a1e42c77c164e71

SHA512
428d18bfb227a7b60cd7f54f7346922d21cd8e73c8f57f38cdedcde65c4d94e7944457eeccd634dd67f7c521c82e6e7d69a7c99ccb7a7dc1f87313c811bc16fc

Download Submit
C:\Windows\System\uIzFThq.exe

Filesize
1.4MB

MD5
09e7cec1ee3e151fb9d25ecb7359acaa

SHA1
f8b190a89bb69b2143bb6afd3b3beef12b204ec6

SHA256
07d5279237526edc497a645bc2e0007620835f951dfe5570081b937403da1265

SHA512
5645d7bfb6be727224eca1ccca358499b4731533b4c22f80152e047c3de629e4cff7ed5b1a2d46cb27d9ca635016b707f43d233a7ea517b870f4321c3213bde1

Download Submit
C:\Windows\System\vgBsxfb.exe

Filesize
1.4MB

MD5
f090d0ef879a82971c173c9f08b046ff

SHA1
9c7f4a4d4e3636d2dc9cfdaf009012fd480e3422

SHA256
ec769d642ae6ba979c6c076819de36d2eb77e6723a548e7e611c78201a2c8a3e

SHA512
68c0dcfbab9b20443d0d9c63d9041c34f86fadc2e67074240ca9bad3ddd2f0e33d8fab148349a37cce9dab5cf2fb3304ca5243e89b25f5d1273ea7b676553bd3

Download Submit
C:\Windows\System\yHtgiEK.exe

Filesize
1.4MB

MD5
1777ed8abcad07a950a58fa588f00a4f

SHA1
af4d138f039006f3b516ded44788f2be1a2b367a

SHA256
ed54fe20151534cf7caa0f9eb831bde695204be2dbfbe071bd9eae8d24ee4f33

SHA512
f649ee2fd52eb22f3f77ff292b81f5d957c22b92f96dc7776ae7ccdac3c12c01b113a4ecb4bbd70202837f1c6425798585051c6a3b48f512c25256fe340140f8

Download Submit
memory/4956-0-0x000001BBBC4C0000-0x000001BBBC4D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.