xmrig | 5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
Size

1.2MB
MD5

2dc496044aea24992075eaf2c133eaaf
SHA1

312d4a626f952bc0c196e2890629328f64c97860
SHA256

5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682
SHA512

08b2f51091fc8192632e4d63c08a0a4a113c3dc4a3d23d5360ae2a3fd7f022953008b7f7c49ce4b7659f5e259d5392a934ccc81bd88254525c368d3647237674
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5pLl6Ot9:GezaTF8FcNkNdfE0pZ9ozttwIRxvUM

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b23-4.dat	xmrig
behavioral2/files/0x000c000000023b79-9.dat	xmrig
behavioral2/files/0x000a000000023b83-22.dat	xmrig
behavioral2/files/0x000a000000023b86-36.dat	xmrig
behavioral2/files/0x000a000000023b85-35.dat	xmrig
behavioral2/files/0x000a000000023b88-59.dat	xmrig
behavioral2/files/0x000a000000023b8b-65.dat	xmrig
behavioral2/files/0x000a000000023b8a-63.dat	xmrig
behavioral2/files/0x000a000000023b89-61.dat	xmrig
behavioral2/files/0x000a000000023b87-57.dat	xmrig
behavioral2/files/0x000a000000023b84-45.dat	xmrig
behavioral2/files/0x000a000000023b82-28.dat	xmrig
behavioral2/files/0x000a000000023b81-20.dat	xmrig
behavioral2/files/0x000a000000023b8d-72.dat	xmrig
behavioral2/files/0x000a000000023b8f-83.dat	xmrig
behavioral2/files/0x000a000000023b93-105.dat	xmrig
behavioral2/files/0x000a000000023b92-116.dat	xmrig
behavioral2/files/0x000a000000023b97-144.dat	xmrig
behavioral2/files/0x000a000000023b98-161.dat	xmrig
behavioral2/files/0x000a000000023ba4-164.dat	xmrig
behavioral2/files/0x0009000000023bbb-163.dat	xmrig
behavioral2/files/0x0009000000023bba-160.dat	xmrig
behavioral2/files/0x0009000000023bb9-159.dat	xmrig
behavioral2/files/0x0008000000023bb4-158.dat	xmrig
behavioral2/files/0x000b000000023b9a-156.dat	xmrig
behavioral2/files/0x000e000000023bab-155.dat	xmrig
behavioral2/files/0x000b000000023b9c-142.dat	xmrig
behavioral2/files/0x000a000000023b96-140.dat	xmrig
behavioral2/files/0x000a000000023b95-139.dat	xmrig
behavioral2/files/0x000b000000023b9b-136.dat	xmrig
behavioral2/files/0x000a000000023b99-131.dat	xmrig
behavioral2/files/0x000a000000023b94-128.dat	xmrig
behavioral2/files/0x000a000000023b91-106.dat	xmrig
behavioral2/files/0x000a000000023b90-95.dat	xmrig
behavioral2/files/0x000a000000023b8e-94.dat	xmrig
behavioral2/files/0x000a000000023b8c-73.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2280	BAhKEvD.exe
4460	EdNJVWs.exe
4808	VOZaivc.exe
400	hmkAEmq.exe
912	oncUJRJ.exe
3068	IFjgFhG.exe
4224	pDqXNCD.exe
1240	JdVtkem.exe
3048	WEeliqX.exe
2148	ECTiWac.exe
1544	rROgXZL.exe
4432	zVgQZPK.exe
4804	TNygzjr.exe
1624	cuUwwWT.exe
1324	IXYOuxF.exe
1388	PKtZzzH.exe
212	OmvJXlD.exe
1668	zzFxTYC.exe
2156	fJdYTvm.exe
5028	VFaauZO.exe
3292	NOCUrSb.exe
3944	liRjPNR.exe
116	QhXyuLM.exe
2880	OAdwUXY.exe
4596	pWsCxVF.exe
3948	XRdPaAO.exe
4508	MkTKycP.exe
1616	dFwluNV.exe
2752	WFdZARI.exe
4408	WpHGvIp.exe
3176	OhvhavD.exe
4412	vdfFaSU.exe
956	WXrvAqO.exe
3416	BEFxjcV.exe
2304	DqDwwrd.exe
3692	nPlqvjg.exe
1260	hGZTmGh.exe
4920	oGHhzDh.exe
3284	oabGhLc.exe
3004	tYEsgaw.exe
4724	UTRHmmn.exe
1860	obolnZX.exe
3596	NrWrUrw.exe
3904	aDXMTmT.exe
3816	bRWmUln.exe
388	namZEOt.exe
3100	gTdgUCp.exe
2060	ngEHMhl.exe
4368	DtTlECm.exe
224	ctCNhMi.exe
3936	vgkenOr.exe
5068	IXVPWuq.exe
648	zAtODRb.exe
3116	WmevqWo.exe
1900	WwNhNPA.exe
516	KyJDdpB.exe
4292	srRIWCp.exe
5100	IXiMMbU.exe
2200	vXYvNrq.exe
3272	XVImtWN.exe
3028	OMUvQYk.exe
3516	AJooPbs.exe
5000	VVOaxPh.exe
4072	txbWlmR.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MzFuSpW.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\jGPYjLv.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\pvgjilv.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\xDyEYft.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\oncUJRJ.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\HzxIrzg.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\WFXtmuI.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\wLBelFn.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\DkdMabd.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\vJXyYCM.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\yQDkjkj.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\WRSnTnu.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\OoLLABS.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\WznMTsa.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\wEgvWUG.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\sljvBah.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\PpDfnes.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\fpjLMvB.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\vGtIaFn.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\LvwCCXp.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\lGEADiT.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\lzsPWpy.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\hYwozED.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\QVTsoNb.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\IswCTDd.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\kGSsmOU.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\mgYkkrz.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\WXrvAqO.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\QhXyuLM.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\bSsTSpv.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\tSBJTMv.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\PhJceUn.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\KkbFKAb.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\zOCMTrI.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\BzJuJBj.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\WucFuwI.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\dqmpYVV.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\hmkAEmq.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\QnCblpR.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\ejCNtVw.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\GJEjxpg.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\vNvHaAj.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\IxKTvyb.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\IFjgFhG.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\FPhbwQV.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\gwSHaEx.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\BdekglO.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\simlesI.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\qfdtDXv.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\VgxhXrt.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\wzSBwqt.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\pMGEmwz.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\GBSnAXq.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\DSlkKkU.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\Vtcolwf.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\NUZZrCn.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\gTdgUCp.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\tQvZplZ.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\qqcOYkS.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\rgPpBkU.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\rOFhzlA.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\rHkzRkr.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\goDAjqu.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
File created	C:\Windows\System\CfrXHsE.exe	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2280	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	83
PID 3440 wrote to memory of 2280	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	83
PID 3440 wrote to memory of 4460	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	84
PID 3440 wrote to memory of 4460	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	84
PID 3440 wrote to memory of 4808	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	85
PID 3440 wrote to memory of 4808	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	85
PID 3440 wrote to memory of 400	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	86
PID 3440 wrote to memory of 400	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	86
PID 3440 wrote to memory of 912	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	87
PID 3440 wrote to memory of 912	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	87
PID 3440 wrote to memory of 3068	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	88
PID 3440 wrote to memory of 3068	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	88
PID 3440 wrote to memory of 4224	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	89
PID 3440 wrote to memory of 4224	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	89
PID 3440 wrote to memory of 1240	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	90
PID 3440 wrote to memory of 1240	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	90
PID 3440 wrote to memory of 3048	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	91
PID 3440 wrote to memory of 3048	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	91
PID 3440 wrote to memory of 2148	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	92
PID 3440 wrote to memory of 2148	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	92
PID 3440 wrote to memory of 1544	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	93
PID 3440 wrote to memory of 1544	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	93
PID 3440 wrote to memory of 4432	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	94
PID 3440 wrote to memory of 4432	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	94
PID 3440 wrote to memory of 4804	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	95
PID 3440 wrote to memory of 4804	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	95
PID 3440 wrote to memory of 1624	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	96
PID 3440 wrote to memory of 1624	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	96
PID 3440 wrote to memory of 1324	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	97
PID 3440 wrote to memory of 1324	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	97
PID 3440 wrote to memory of 1388	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	98
PID 3440 wrote to memory of 1388	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	98
PID 3440 wrote to memory of 212	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	99
PID 3440 wrote to memory of 212	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	99
PID 3440 wrote to memory of 1668	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	100
PID 3440 wrote to memory of 1668	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	100
PID 3440 wrote to memory of 2156	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	101
PID 3440 wrote to memory of 2156	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	101
PID 3440 wrote to memory of 5028	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	102
PID 3440 wrote to memory of 5028	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	102
PID 3440 wrote to memory of 3292	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	103
PID 3440 wrote to memory of 3292	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	103
PID 3440 wrote to memory of 3944	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	104
PID 3440 wrote to memory of 3944	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	104
PID 3440 wrote to memory of 116	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	105
PID 3440 wrote to memory of 116	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	105
PID 3440 wrote to memory of 2880	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	106
PID 3440 wrote to memory of 2880	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	106
PID 3440 wrote to memory of 4596	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	107
PID 3440 wrote to memory of 4596	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	107
PID 3440 wrote to memory of 3948	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	108
PID 3440 wrote to memory of 3948	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	108
PID 3440 wrote to memory of 4508	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	109
PID 3440 wrote to memory of 4508	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	109
PID 3440 wrote to memory of 4412	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	110
PID 3440 wrote to memory of 4412	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	110
PID 3440 wrote to memory of 1616	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	111
PID 3440 wrote to memory of 1616	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	111
PID 3440 wrote to memory of 2752	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	112
PID 3440 wrote to memory of 2752	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	112
PID 3440 wrote to memory of 4408	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	113
PID 3440 wrote to memory of 4408	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	113
PID 3440 wrote to memory of 3176	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	114
PID 3440 wrote to memory of 3176	3440	5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe	114

C:\Users\Admin\AppData\Local\Temp\5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe
"C:\Users\Admin\AppData\Local\Temp\5920af678b91adf195d84865e484e668cf6e3f5523c37c81a4224e6bb1671682.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\System\BAhKEvD.exe
  C:\Windows\System\BAhKEvD.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\EdNJVWs.exe
  C:\Windows\System\EdNJVWs.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\VOZaivc.exe
  C:\Windows\System\VOZaivc.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\hmkAEmq.exe
  C:\Windows\System\hmkAEmq.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\oncUJRJ.exe
  C:\Windows\System\oncUJRJ.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\IFjgFhG.exe
  C:\Windows\System\IFjgFhG.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\pDqXNCD.exe
  C:\Windows\System\pDqXNCD.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\JdVtkem.exe
  C:\Windows\System\JdVtkem.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\WEeliqX.exe
  C:\Windows\System\WEeliqX.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\ECTiWac.exe
  C:\Windows\System\ECTiWac.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\rROgXZL.exe
  C:\Windows\System\rROgXZL.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\zVgQZPK.exe
  C:\Windows\System\zVgQZPK.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\TNygzjr.exe
  C:\Windows\System\TNygzjr.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\cuUwwWT.exe
  C:\Windows\System\cuUwwWT.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\IXYOuxF.exe
  C:\Windows\System\IXYOuxF.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\PKtZzzH.exe
  C:\Windows\System\PKtZzzH.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\OmvJXlD.exe
  C:\Windows\System\OmvJXlD.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\zzFxTYC.exe
  C:\Windows\System\zzFxTYC.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\fJdYTvm.exe
  C:\Windows\System\fJdYTvm.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\VFaauZO.exe
  C:\Windows\System\VFaauZO.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\NOCUrSb.exe
  C:\Windows\System\NOCUrSb.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\liRjPNR.exe
  C:\Windows\System\liRjPNR.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\QhXyuLM.exe
  C:\Windows\System\QhXyuLM.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\OAdwUXY.exe
  C:\Windows\System\OAdwUXY.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\pWsCxVF.exe
  C:\Windows\System\pWsCxVF.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\XRdPaAO.exe
  C:\Windows\System\XRdPaAO.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\MkTKycP.exe
  C:\Windows\System\MkTKycP.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\vdfFaSU.exe
  C:\Windows\System\vdfFaSU.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\dFwluNV.exe
  C:\Windows\System\dFwluNV.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\WFdZARI.exe
  C:\Windows\System\WFdZARI.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\WpHGvIp.exe
  C:\Windows\System\WpHGvIp.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\OhvhavD.exe
  C:\Windows\System\OhvhavD.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\WXrvAqO.exe
  C:\Windows\System\WXrvAqO.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\BEFxjcV.exe
  C:\Windows\System\BEFxjcV.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\DqDwwrd.exe
  C:\Windows\System\DqDwwrd.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\nPlqvjg.exe
  C:\Windows\System\nPlqvjg.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\hGZTmGh.exe
  C:\Windows\System\hGZTmGh.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\oGHhzDh.exe
  C:\Windows\System\oGHhzDh.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\oabGhLc.exe
  C:\Windows\System\oabGhLc.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\tYEsgaw.exe
  C:\Windows\System\tYEsgaw.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\UTRHmmn.exe
  C:\Windows\System\UTRHmmn.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\obolnZX.exe
  C:\Windows\System\obolnZX.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\NrWrUrw.exe
  C:\Windows\System\NrWrUrw.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\aDXMTmT.exe
  C:\Windows\System\aDXMTmT.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\bRWmUln.exe
  C:\Windows\System\bRWmUln.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\namZEOt.exe
  C:\Windows\System\namZEOt.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\gTdgUCp.exe
  C:\Windows\System\gTdgUCp.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\ngEHMhl.exe
  C:\Windows\System\ngEHMhl.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\DtTlECm.exe
  C:\Windows\System\DtTlECm.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\ctCNhMi.exe
  C:\Windows\System\ctCNhMi.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\vgkenOr.exe
  C:\Windows\System\vgkenOr.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\IXVPWuq.exe
  C:\Windows\System\IXVPWuq.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\zAtODRb.exe
  C:\Windows\System\zAtODRb.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\WmevqWo.exe
  C:\Windows\System\WmevqWo.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\WwNhNPA.exe
  C:\Windows\System\WwNhNPA.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\KyJDdpB.exe
  C:\Windows\System\KyJDdpB.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\srRIWCp.exe
  C:\Windows\System\srRIWCp.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\IXiMMbU.exe
  C:\Windows\System\IXiMMbU.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\vXYvNrq.exe
  C:\Windows\System\vXYvNrq.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\XVImtWN.exe
  C:\Windows\System\XVImtWN.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\OMUvQYk.exe
  C:\Windows\System\OMUvQYk.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\AJooPbs.exe
  C:\Windows\System\AJooPbs.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\VVOaxPh.exe
  C:\Windows\System\VVOaxPh.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\txbWlmR.exe
  C:\Windows\System\txbWlmR.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\ESRTvbr.exe
  C:\Windows\System\ESRTvbr.exe
  2⤵
  PID:3872
- C:\Windows\System\wquBqWV.exe
  C:\Windows\System\wquBqWV.exe
  2⤵
  PID:1884
- C:\Windows\System\foCGVkw.exe
  C:\Windows\System\foCGVkw.exe
  2⤵
  PID:2956
- C:\Windows\System\qttVzGc.exe
  C:\Windows\System\qttVzGc.exe
  2⤵
  PID:1484
- C:\Windows\System\aHeptyR.exe
  C:\Windows\System\aHeptyR.exe
  2⤵
  PID:1412
- C:\Windows\System\WznMTsa.exe
  C:\Windows\System\WznMTsa.exe
  2⤵
  PID:4964
- C:\Windows\System\lzsPWpy.exe
  C:\Windows\System\lzsPWpy.exe
  2⤵
  PID:2460
- C:\Windows\System\VMbGRYu.exe
  C:\Windows\System\VMbGRYu.exe
  2⤵
  PID:760
- C:\Windows\System\QnCblpR.exe
  C:\Windows\System\QnCblpR.exe
  2⤵
  PID:892
- C:\Windows\System\APGlwlZ.exe
  C:\Windows\System\APGlwlZ.exe
  2⤵
  PID:4252
- C:\Windows\System\jCjCzYQ.exe
  C:\Windows\System\jCjCzYQ.exe
  2⤵
  PID:2928
- C:\Windows\System\ugpxpiQ.exe
  C:\Windows\System\ugpxpiQ.exe
  2⤵
  PID:2388
- C:\Windows\System\ZPnSPiI.exe
  C:\Windows\System\ZPnSPiI.exe
  2⤵
  PID:4708
- C:\Windows\System\VXqwyAI.exe
  C:\Windows\System\VXqwyAI.exe
  2⤵
  PID:4068
- C:\Windows\System\uZgSeCg.exe
  C:\Windows\System\uZgSeCg.exe
  2⤵
  PID:208
- C:\Windows\System\vdAvMlW.exe
  C:\Windows\System\vdAvMlW.exe
  2⤵
  PID:2300
- C:\Windows\System\TlxNxAV.exe
  C:\Windows\System\TlxNxAV.exe
  2⤵
  PID:4288
- C:\Windows\System\NsxnMCh.exe
  C:\Windows\System\NsxnMCh.exe
  2⤵
  PID:2352
- C:\Windows\System\CAajrAX.exe
  C:\Windows\System\CAajrAX.exe
  2⤵
  PID:1128
- C:\Windows\System\PvHUWWN.exe
  C:\Windows\System\PvHUWWN.exe
  2⤵
  PID:3620
- C:\Windows\System\htqetpd.exe
  C:\Windows\System\htqetpd.exe
  2⤵
  PID:1496
- C:\Windows\System\dBzGILf.exe
  C:\Windows\System\dBzGILf.exe
  2⤵
  PID:1048
- C:\Windows\System\jHMXELi.exe
  C:\Windows\System\jHMXELi.exe
  2⤵
  PID:3544
- C:\Windows\System\lKxzwbf.exe
  C:\Windows\System\lKxzwbf.exe
  2⤵
  PID:3488
- C:\Windows\System\vSyQEcu.exe
  C:\Windows\System\vSyQEcu.exe
  2⤵
  PID:3412
- C:\Windows\System\GKrAMdz.exe
  C:\Windows\System\GKrAMdz.exe
  2⤵
  PID:1036
- C:\Windows\System\YxLWryA.exe
  C:\Windows\System\YxLWryA.exe
  2⤵
  PID:2664
- C:\Windows\System\pCHeOJl.exe
  C:\Windows\System\pCHeOJl.exe
  2⤵
  PID:4392
- C:\Windows\System\OyHomeZ.exe
  C:\Windows\System\OyHomeZ.exe
  2⤵
  PID:4868
- C:\Windows\System\qzCgWbc.exe
  C:\Windows\System\qzCgWbc.exe
  2⤵
  PID:1188
- C:\Windows\System\uYpoplC.exe
  C:\Windows\System\uYpoplC.exe
  2⤵
  PID:3076
- C:\Windows\System\oavjpxk.exe
  C:\Windows\System\oavjpxk.exe
  2⤵
  PID:4236
- C:\Windows\System\fRMhvWU.exe
  C:\Windows\System\fRMhvWU.exe
  2⤵
  PID:4552
- C:\Windows\System\gWsypRK.exe
  C:\Windows\System\gWsypRK.exe
  2⤵
  PID:3356
- C:\Windows\System\tUGZEaI.exe
  C:\Windows\System\tUGZEaI.exe
  2⤵
  PID:2740
- C:\Windows\System\DanTRTZ.exe
  C:\Windows\System\DanTRTZ.exe
  2⤵
  PID:3808
- C:\Windows\System\YRYnNzv.exe
  C:\Windows\System\YRYnNzv.exe
  2⤵
  PID:4324
- C:\Windows\System\JDkYSLc.exe
  C:\Windows\System\JDkYSLc.exe
  2⤵
  PID:2600
- C:\Windows\System\BUVZgNr.exe
  C:\Windows\System\BUVZgNr.exe
  2⤵
  PID:4684
- C:\Windows\System\pvgjilv.exe
  C:\Windows\System\pvgjilv.exe
  2⤵
  PID:2032
- C:\Windows\System\ufgPjXF.exe
  C:\Windows\System\ufgPjXF.exe
  2⤵
  PID:3036
- C:\Windows\System\uOTCAba.exe
  C:\Windows\System\uOTCAba.exe
  2⤵
  PID:2828
- C:\Windows\System\TKjMDte.exe
  C:\Windows\System\TKjMDte.exe
  2⤵
  PID:800
- C:\Windows\System\qvsotXd.exe
  C:\Windows\System\qvsotXd.exe
  2⤵
  PID:3696
- C:\Windows\System\lbhNdBE.exe
  C:\Windows\System\lbhNdBE.exe
  2⤵
  PID:1968
- C:\Windows\System\JBAzjue.exe
  C:\Windows\System\JBAzjue.exe
  2⤵
  PID:3984
- C:\Windows\System\lYjHAHW.exe
  C:\Windows\System\lYjHAHW.exe
  2⤵
  PID:2556
- C:\Windows\System\tWrczyS.exe
  C:\Windows\System\tWrczyS.exe
  2⤵
  PID:748
- C:\Windows\System\ifFytRL.exe
  C:\Windows\System\ifFytRL.exe
  2⤵
  PID:3912
- C:\Windows\System\WGrLHgN.exe
  C:\Windows\System\WGrLHgN.exe
  2⤵
  PID:2896
- C:\Windows\System\CwkfIpK.exe
  C:\Windows\System\CwkfIpK.exe
  2⤵
  PID:4564
- C:\Windows\System\pwXBSDb.exe
  C:\Windows\System\pwXBSDb.exe
  2⤵
  PID:1776
- C:\Windows\System\ZlpPvfb.exe
  C:\Windows\System\ZlpPvfb.exe
  2⤵
  PID:4836
- C:\Windows\System\hBRhDlZ.exe
  C:\Windows\System\hBRhDlZ.exe
  2⤵
  PID:5160
- C:\Windows\System\LTWLRmi.exe
  C:\Windows\System\LTWLRmi.exe
  2⤵
  PID:5176
- C:\Windows\System\FtLEiyH.exe
  C:\Windows\System\FtLEiyH.exe
  2⤵
  PID:5208
- C:\Windows\System\eBiBjfP.exe
  C:\Windows\System\eBiBjfP.exe
  2⤵
  PID:5224
- C:\Windows\System\NrcYZse.exe
  C:\Windows\System\NrcYZse.exe
  2⤵
  PID:5252
- C:\Windows\System\IaxjlwE.exe
  C:\Windows\System\IaxjlwE.exe
  2⤵
  PID:5292
- C:\Windows\System\azgufXS.exe
  C:\Windows\System\azgufXS.exe
  2⤵
  PID:5312
- C:\Windows\System\WNtIliT.exe
  C:\Windows\System\WNtIliT.exe
  2⤵
  PID:5332
- C:\Windows\System\JNUGCck.exe
  C:\Windows\System\JNUGCck.exe
  2⤵
  PID:5372
- C:\Windows\System\BDxFkQQ.exe
  C:\Windows\System\BDxFkQQ.exe
  2⤵
  PID:5392
- C:\Windows\System\ZhojilU.exe
  C:\Windows\System\ZhojilU.exe
  2⤵
  PID:5412
- C:\Windows\System\XEAExXn.exe
  C:\Windows\System\XEAExXn.exe
  2⤵
  PID:5444
- C:\Windows\System\bxMvlRU.exe
  C:\Windows\System\bxMvlRU.exe
  2⤵
  PID:5476
- C:\Windows\System\hCcopAK.exe
  C:\Windows\System\hCcopAK.exe
  2⤵
  PID:5496
- C:\Windows\System\WzlrJSf.exe
  C:\Windows\System\WzlrJSf.exe
  2⤵
  PID:5524
- C:\Windows\System\DkdMabd.exe
  C:\Windows\System\DkdMabd.exe
  2⤵
  PID:5556
- C:\Windows\System\xgGDCwr.exe
  C:\Windows\System\xgGDCwr.exe
  2⤵
  PID:5596
- C:\Windows\System\beGoPqt.exe
  C:\Windows\System\beGoPqt.exe
  2⤵
  PID:5620
- C:\Windows\System\xPdeLZg.exe
  C:\Windows\System\xPdeLZg.exe
  2⤵
  PID:5668
- C:\Windows\System\cAgSgVw.exe
  C:\Windows\System\cAgSgVw.exe
  2⤵
  PID:5688
- C:\Windows\System\vpGOrXB.exe
  C:\Windows\System\vpGOrXB.exe
  2⤵
  PID:5708
- C:\Windows\System\XMcKFqE.exe
  C:\Windows\System\XMcKFqE.exe
  2⤵
  PID:5740
- C:\Windows\System\ylaXlhW.exe
  C:\Windows\System\ylaXlhW.exe
  2⤵
  PID:5760
- C:\Windows\System\zuMKhJY.exe
  C:\Windows\System\zuMKhJY.exe
  2⤵
  PID:5788
- C:\Windows\System\vTfoQfa.exe
  C:\Windows\System\vTfoQfa.exe
  2⤵
  PID:5820
- C:\Windows\System\OCjVxpr.exe
  C:\Windows\System\OCjVxpr.exe
  2⤵
  PID:5836
- C:\Windows\System\OGsjqOQ.exe
  C:\Windows\System\OGsjqOQ.exe
  2⤵
  PID:5860
- C:\Windows\System\dbRaKjM.exe
  C:\Windows\System\dbRaKjM.exe
  2⤵
  PID:5876
- C:\Windows\System\XhJvuLY.exe
  C:\Windows\System\XhJvuLY.exe
  2⤵
  PID:5912
- C:\Windows\System\hoJtZAB.exe
  C:\Windows\System\hoJtZAB.exe
  2⤵
  PID:5940
- C:\Windows\System\HAWeBMc.exe
  C:\Windows\System\HAWeBMc.exe
  2⤵
  PID:5964
- C:\Windows\System\gsOZZHu.exe
  C:\Windows\System\gsOZZHu.exe
  2⤵
  PID:5996
- C:\Windows\System\XGXlufe.exe
  C:\Windows\System\XGXlufe.exe
  2⤵
  PID:6024
- C:\Windows\System\BMYXNME.exe
  C:\Windows\System\BMYXNME.exe
  2⤵
  PID:6068
- C:\Windows\System\wButyqU.exe
  C:\Windows\System\wButyqU.exe
  2⤵
  PID:6088
- C:\Windows\System\KOizPMT.exe
  C:\Windows\System\KOizPMT.exe
  2⤵
  PID:6116
- C:\Windows\System\xdujwyO.exe
  C:\Windows\System\xdujwyO.exe
  2⤵
  PID:5132
- C:\Windows\System\MnYBCTH.exe
  C:\Windows\System\MnYBCTH.exe
  2⤵
  PID:5168
- C:\Windows\System\dpnIWZW.exe
  C:\Windows\System\dpnIWZW.exe
  2⤵
  PID:5248
- C:\Windows\System\vJXyYCM.exe
  C:\Windows\System\vJXyYCM.exe
  2⤵
  PID:5300
- C:\Windows\System\shOIoKI.exe
  C:\Windows\System\shOIoKI.exe
  2⤵
  PID:5380
- C:\Windows\System\diSTYGg.exe
  C:\Windows\System\diSTYGg.exe
  2⤵
  PID:5400
- C:\Windows\System\SxEHhjc.exe
  C:\Windows\System\SxEHhjc.exe
  2⤵
  PID:5456
- C:\Windows\System\FiMauLj.exe
  C:\Windows\System\FiMauLj.exe
  2⤵
  PID:5516
- C:\Windows\System\rhkNUWR.exe
  C:\Windows\System\rhkNUWR.exe
  2⤵
  PID:5588
- C:\Windows\System\vjvgZXO.exe
  C:\Windows\System\vjvgZXO.exe
  2⤵
  PID:5676
- C:\Windows\System\BfgczEr.exe
  C:\Windows\System\BfgczEr.exe
  2⤵
  PID:5728
- C:\Windows\System\HYPpxIA.exe
  C:\Windows\System\HYPpxIA.exe
  2⤵
  PID:5800
- C:\Windows\System\nAEkMUb.exe
  C:\Windows\System\nAEkMUb.exe
  2⤵
  PID:5848
- C:\Windows\System\goGPnxD.exe
  C:\Windows\System\goGPnxD.exe
  2⤵
  PID:5928
- C:\Windows\System\tQdwBoh.exe
  C:\Windows\System\tQdwBoh.exe
  2⤵
  PID:5988
- C:\Windows\System\PylksyY.exe
  C:\Windows\System\PylksyY.exe
  2⤵
  PID:6048
- C:\Windows\System\nDfiypj.exe
  C:\Windows\System\nDfiypj.exe
  2⤵
  PID:6080
- C:\Windows\System\YiNfsfL.exe
  C:\Windows\System\YiNfsfL.exe
  2⤵
  PID:5192
- C:\Windows\System\HCcoDtg.exe
  C:\Windows\System\HCcoDtg.exe
  2⤵
  PID:5320
- C:\Windows\System\bDRTIhH.exe
  C:\Windows\System\bDRTIhH.exe
  2⤵
  PID:5488
- C:\Windows\System\sSklTPE.exe
  C:\Windows\System\sSklTPE.exe
  2⤵
  PID:5580
- C:\Windows\System\PpDfnes.exe
  C:\Windows\System\PpDfnes.exe
  2⤵
  PID:5856
- C:\Windows\System\fpjLMvB.exe
  C:\Windows\System\fpjLMvB.exe
  2⤵
  PID:5776
- C:\Windows\System\LhTmrWw.exe
  C:\Windows\System\LhTmrWw.exe
  2⤵
  PID:5960
- C:\Windows\System\QRdIyim.exe
  C:\Windows\System\QRdIyim.exe
  2⤵
  PID:6136
- C:\Windows\System\dMhpyWQ.exe
  C:\Windows\System\dMhpyWQ.exe
  2⤵
  PID:5540
- C:\Windows\System\rxvHIaJ.exe
  C:\Windows\System\rxvHIaJ.exe
  2⤵
  PID:5616
- C:\Windows\System\RvxBuUB.exe
  C:\Windows\System\RvxBuUB.exe
  2⤵
  PID:6156
- C:\Windows\System\BqzkoNC.exe
  C:\Windows\System\BqzkoNC.exe
  2⤵
  PID:6180
- C:\Windows\System\xRRGXCt.exe
  C:\Windows\System\xRRGXCt.exe
  2⤵
  PID:6204
- C:\Windows\System\oICyQmD.exe
  C:\Windows\System\oICyQmD.exe
  2⤵
  PID:6228
- C:\Windows\System\WdSufiM.exe
  C:\Windows\System\WdSufiM.exe
  2⤵
  PID:6256
- C:\Windows\System\qULKYwz.exe
  C:\Windows\System\qULKYwz.exe
  2⤵
  PID:6288
- C:\Windows\System\WiVhaFR.exe
  C:\Windows\System\WiVhaFR.exe
  2⤵
  PID:6320
- C:\Windows\System\bErWAaI.exe
  C:\Windows\System\bErWAaI.exe
  2⤵
  PID:6356
- C:\Windows\System\LgryTox.exe
  C:\Windows\System\LgryTox.exe
  2⤵
  PID:6376
- C:\Windows\System\QQTQqNR.exe
  C:\Windows\System\QQTQqNR.exe
  2⤵
  PID:6400
- C:\Windows\System\uhHTqfM.exe
  C:\Windows\System\uhHTqfM.exe
  2⤵
  PID:6424
- C:\Windows\System\gWZjySB.exe
  C:\Windows\System\gWZjySB.exe
  2⤵
  PID:6452
- C:\Windows\System\pQtKUBM.exe
  C:\Windows\System\pQtKUBM.exe
  2⤵
  PID:6472
- C:\Windows\System\pMGEmwz.exe
  C:\Windows\System\pMGEmwz.exe
  2⤵
  PID:6500
- C:\Windows\System\jGPYjLv.exe
  C:\Windows\System\jGPYjLv.exe
  2⤵
  PID:6528
- C:\Windows\System\yQDkjkj.exe
  C:\Windows\System\yQDkjkj.exe
  2⤵
  PID:6556
- C:\Windows\System\EONplYP.exe
  C:\Windows\System\EONplYP.exe
  2⤵
  PID:6580
- C:\Windows\System\iADDIWQ.exe
  C:\Windows\System\iADDIWQ.exe
  2⤵
  PID:6612
- C:\Windows\System\uNGEEhh.exe
  C:\Windows\System\uNGEEhh.exe
  2⤵
  PID:6640
- C:\Windows\System\VYQYXKR.exe
  C:\Windows\System\VYQYXKR.exe
  2⤵
  PID:6664
- C:\Windows\System\htwNrWP.exe
  C:\Windows\System\htwNrWP.exe
  2⤵
  PID:6688
- C:\Windows\System\KkiUIsA.exe
  C:\Windows\System\KkiUIsA.exe
  2⤵
  PID:6708
- C:\Windows\System\uauAJMz.exe
  C:\Windows\System\uauAJMz.exe
  2⤵
  PID:6732
- C:\Windows\System\RSVlRqq.exe
  C:\Windows\System\RSVlRqq.exe
  2⤵
  PID:6756
- C:\Windows\System\oODohyf.exe
  C:\Windows\System\oODohyf.exe
  2⤵
  PID:6784
- C:\Windows\System\XuvAJyg.exe
  C:\Windows\System\XuvAJyg.exe
  2⤵
  PID:6808
- C:\Windows\System\QWdNwsf.exe
  C:\Windows\System\QWdNwsf.exe
  2⤵
  PID:6840
- C:\Windows\System\qbJsqyt.exe
  C:\Windows\System\qbJsqyt.exe
  2⤵
  PID:6868
- C:\Windows\System\FcbiDlT.exe
  C:\Windows\System\FcbiDlT.exe
  2⤵
  PID:6892
- C:\Windows\System\BotYmEl.exe
  C:\Windows\System\BotYmEl.exe
  2⤵
  PID:6920
- C:\Windows\System\ABshgzf.exe
  C:\Windows\System\ABshgzf.exe
  2⤵
  PID:6944
- C:\Windows\System\kYUdgrk.exe
  C:\Windows\System\kYUdgrk.exe
  2⤵
  PID:6976
- C:\Windows\System\GRznqUG.exe
  C:\Windows\System\GRznqUG.exe
  2⤵
  PID:7004
- C:\Windows\System\zzuHToV.exe
  C:\Windows\System\zzuHToV.exe
  2⤵
  PID:7028
- C:\Windows\System\fEzIFjk.exe
  C:\Windows\System\fEzIFjk.exe
  2⤵
  PID:7056
- C:\Windows\System\udnURoo.exe
  C:\Windows\System\udnURoo.exe
  2⤵
  PID:7084
- C:\Windows\System\KEaFtma.exe
  C:\Windows\System\KEaFtma.exe
  2⤵
  PID:7112
- C:\Windows\System\QwJtdeM.exe
  C:\Windows\System\QwJtdeM.exe
  2⤵
  PID:7148
- C:\Windows\System\PytuaUl.exe
  C:\Windows\System\PytuaUl.exe
  2⤵
  PID:6148
- C:\Windows\System\HMBumap.exe
  C:\Windows\System\HMBumap.exe
  2⤵
  PID:5972
- C:\Windows\System\nIXqXtS.exe
  C:\Windows\System\nIXqXtS.exe
  2⤵
  PID:6200
- C:\Windows\System\UCMJpOW.exe
  C:\Windows\System\UCMJpOW.exe
  2⤵
  PID:6308
- C:\Windows\System\MzFuSpW.exe
  C:\Windows\System\MzFuSpW.exe
  2⤵
  PID:6332
- C:\Windows\System\bRGKHoG.exe
  C:\Windows\System\bRGKHoG.exe
  2⤵
  PID:6268
- C:\Windows\System\xyeckBz.exe
  C:\Windows\System\xyeckBz.exe
  2⤵
  PID:6440
- C:\Windows\System\daJnROm.exe
  C:\Windows\System\daJnROm.exe
  2⤵
  PID:6444
- C:\Windows\System\pIMRbwK.exe
  C:\Windows\System\pIMRbwK.exe
  2⤵
  PID:6588
- C:\Windows\System\BwLNhDp.exe
  C:\Windows\System\BwLNhDp.exe
  2⤵
  PID:6572
- C:\Windows\System\htTVmXv.exe
  C:\Windows\System\htTVmXv.exe
  2⤵
  PID:6628
- C:\Windows\System\DzLACeK.exe
  C:\Windows\System\DzLACeK.exe
  2⤵
  PID:6832
- C:\Windows\System\okduSmc.exe
  C:\Windows\System\okduSmc.exe
  2⤵
  PID:6704
- C:\Windows\System\sljvBah.exe
  C:\Windows\System\sljvBah.exe
  2⤵
  PID:6936
- C:\Windows\System\JwBokGs.exe
  C:\Windows\System\JwBokGs.exe
  2⤵
  PID:6884
- C:\Windows\System\HMjIxRb.exe
  C:\Windows\System\HMjIxRb.exe
  2⤵
  PID:7048
- C:\Windows\System\VEUxfQP.exe
  C:\Windows\System\VEUxfQP.exe
  2⤵
  PID:7132
- C:\Windows\System\SFSUIRz.exe
  C:\Windows\System\SFSUIRz.exe
  2⤵
  PID:7124
- C:\Windows\System\QcpuBoV.exe
  C:\Windows\System\QcpuBoV.exe
  2⤵
  PID:6192
- C:\Windows\System\RLcvORm.exe
  C:\Windows\System\RLcvORm.exe
  2⤵
  PID:6304
- C:\Windows\System\zBGTOie.exe
  C:\Windows\System\zBGTOie.exe
  2⤵
  PID:6576
- C:\Windows\System\clAMLXj.exe
  C:\Windows\System\clAMLXj.exe
  2⤵
  PID:6548
- C:\Windows\System\CyjyMDS.exe
  C:\Windows\System\CyjyMDS.exe
  2⤵
  PID:6348
- C:\Windows\System\xIYriAX.exe
  C:\Windows\System\xIYriAX.exe
  2⤵
  PID:6768
- C:\Windows\System\bKyGubh.exe
  C:\Windows\System\bKyGubh.exe
  2⤵
  PID:7092
- C:\Windows\System\nweeXFX.exe
  C:\Windows\System\nweeXFX.exe
  2⤵
  PID:6224
- C:\Windows\System\eGjiOxi.exe
  C:\Windows\System\eGjiOxi.exe
  2⤵
  PID:7040
- C:\Windows\System\IKjbdGA.exe
  C:\Windows\System\IKjbdGA.exe
  2⤵
  PID:6804
- C:\Windows\System\oPDsGrh.exe
  C:\Windows\System\oPDsGrh.exe
  2⤵
  PID:7180
- C:\Windows\System\qBmyoKi.exe
  C:\Windows\System\qBmyoKi.exe
  2⤵
  PID:7200
- C:\Windows\System\HdNiTCb.exe
  C:\Windows\System\HdNiTCb.exe
  2⤵
  PID:7224
- C:\Windows\System\uSnvQfa.exe
  C:\Windows\System\uSnvQfa.exe
  2⤵
  PID:7252
- C:\Windows\System\rgPpBkU.exe
  C:\Windows\System\rgPpBkU.exe
  2⤵
  PID:7268
- C:\Windows\System\RociulP.exe
  C:\Windows\System\RociulP.exe
  2⤵
  PID:7292
- C:\Windows\System\TservRe.exe
  C:\Windows\System\TservRe.exe
  2⤵
  PID:7328
- C:\Windows\System\crdWdsX.exe
  C:\Windows\System\crdWdsX.exe
  2⤵
  PID:7356
- C:\Windows\System\wFnGXaI.exe
  C:\Windows\System\wFnGXaI.exe
  2⤵
  PID:7376
- C:\Windows\System\DJHUTnY.exe
  C:\Windows\System\DJHUTnY.exe
  2⤵
  PID:7408
- C:\Windows\System\wEgvWUG.exe
  C:\Windows\System\wEgvWUG.exe
  2⤵
  PID:7432
- C:\Windows\System\rxpuMJQ.exe
  C:\Windows\System\rxpuMJQ.exe
  2⤵
  PID:7456
- C:\Windows\System\YTGjOWW.exe
  C:\Windows\System\YTGjOWW.exe
  2⤵
  PID:7480
- C:\Windows\System\NcEVQTw.exe
  C:\Windows\System\NcEVQTw.exe
  2⤵
  PID:7496
- C:\Windows\System\wROVVHE.exe
  C:\Windows\System\wROVVHE.exe
  2⤵
  PID:7524
- C:\Windows\System\BHzLVgi.exe
  C:\Windows\System\BHzLVgi.exe
  2⤵
  PID:7540
- C:\Windows\System\DioNRgS.exe
  C:\Windows\System\DioNRgS.exe
  2⤵
  PID:7572
- C:\Windows\System\ASckEBZ.exe
  C:\Windows\System\ASckEBZ.exe
  2⤵
  PID:7588
- C:\Windows\System\AwjvFET.exe
  C:\Windows\System\AwjvFET.exe
  2⤵
  PID:7616
- C:\Windows\System\AMnxaQZ.exe
  C:\Windows\System\AMnxaQZ.exe
  2⤵
  PID:7644
- C:\Windows\System\VmRliwY.exe
  C:\Windows\System\VmRliwY.exe
  2⤵
  PID:7664
- C:\Windows\System\UGbXkcF.exe
  C:\Windows\System\UGbXkcF.exe
  2⤵
  PID:7700
- C:\Windows\System\FYtcCeg.exe
  C:\Windows\System\FYtcCeg.exe
  2⤵
  PID:7724
- C:\Windows\System\dlidSTj.exe
  C:\Windows\System\dlidSTj.exe
  2⤵
  PID:7748
- C:\Windows\System\rOFhzlA.exe
  C:\Windows\System\rOFhzlA.exe
  2⤵
  PID:7776
- C:\Windows\System\JWmEvBU.exe
  C:\Windows\System\JWmEvBU.exe
  2⤵
  PID:7800
- C:\Windows\System\GdZPoTX.exe
  C:\Windows\System\GdZPoTX.exe
  2⤵
  PID:7824
- C:\Windows\System\CVOVTfI.exe
  C:\Windows\System\CVOVTfI.exe
  2⤵
  PID:7852
- C:\Windows\System\qPzuZFr.exe
  C:\Windows\System\qPzuZFr.exe
  2⤵
  PID:7880
- C:\Windows\System\HjIbqsN.exe
  C:\Windows\System\HjIbqsN.exe
  2⤵
  PID:7904
- C:\Windows\System\VuJjBAd.exe
  C:\Windows\System\VuJjBAd.exe
  2⤵
  PID:7924
- C:\Windows\System\ovDaTNt.exe
  C:\Windows\System\ovDaTNt.exe
  2⤵
  PID:7956
- C:\Windows\System\ArsECSo.exe
  C:\Windows\System\ArsECSo.exe
  2⤵
  PID:7980
- C:\Windows\System\kSJmaRK.exe
  C:\Windows\System\kSJmaRK.exe
  2⤵
  PID:8000
- C:\Windows\System\JWfAboZ.exe
  C:\Windows\System\JWfAboZ.exe
  2⤵
  PID:8024
- C:\Windows\System\qpdMQVh.exe
  C:\Windows\System\qpdMQVh.exe
  2⤵
  PID:8044
- C:\Windows\System\JyPdMze.exe
  C:\Windows\System\JyPdMze.exe
  2⤵
  PID:8072
- C:\Windows\System\qVdgRoo.exe
  C:\Windows\System\qVdgRoo.exe
  2⤵
  PID:8104
- C:\Windows\System\LJQbjje.exe
  C:\Windows\System\LJQbjje.exe
  2⤵
  PID:8152
- C:\Windows\System\dSZxWHI.exe
  C:\Windows\System\dSZxWHI.exe
  2⤵
  PID:8176
- C:\Windows\System\iDvdHtg.exe
  C:\Windows\System\iDvdHtg.exe
  2⤵
  PID:6672
- C:\Windows\System\IycWbdD.exe
  C:\Windows\System\IycWbdD.exe
  2⤵
  PID:7160
- C:\Windows\System\rBvVRJH.exe
  C:\Windows\System\rBvVRJH.exe
  2⤵
  PID:7172
- C:\Windows\System\zPiecVb.exe
  C:\Windows\System\zPiecVb.exe
  2⤵
  PID:7212
- C:\Windows\System\lxGNrcN.exe
  C:\Windows\System\lxGNrcN.exe
  2⤵
  PID:7188
- C:\Windows\System\aoFTeqc.exe
  C:\Windows\System\aoFTeqc.exe
  2⤵
  PID:7244
- C:\Windows\System\QPwkVyJ.exe
  C:\Windows\System\QPwkVyJ.exe
  2⤵
  PID:7308
- C:\Windows\System\hWoQjxT.exe
  C:\Windows\System\hWoQjxT.exe
  2⤵
  PID:7636
- C:\Windows\System\CzvFsjh.exe
  C:\Windows\System\CzvFsjh.exe
  2⤵
  PID:7552
- C:\Windows\System\HzxIrzg.exe
  C:\Windows\System\HzxIrzg.exe
  2⤵
  PID:7488
- C:\Windows\System\dRvhcuc.exe
  C:\Windows\System\dRvhcuc.exe
  2⤵
  PID:7512
- C:\Windows\System\oncITRF.exe
  C:\Windows\System\oncITRF.exe
  2⤵
  PID:7680
- C:\Windows\System\yGPkDAF.exe
  C:\Windows\System\yGPkDAF.exe
  2⤵
  PID:7768
- C:\Windows\System\TifAhVg.exe
  C:\Windows\System\TifAhVg.exe
  2⤵
  PID:8124
- C:\Windows\System\ZSenrOW.exe
  C:\Windows\System\ZSenrOW.exe
  2⤵
  PID:7864
- C:\Windows\System\APxJNRR.exe
  C:\Windows\System\APxJNRR.exe
  2⤵
  PID:7940
- C:\Windows\System\tAHrIsp.exe
  C:\Windows\System\tAHrIsp.exe
  2⤵
  PID:7992
- C:\Windows\System\gGKLfuQ.exe
  C:\Windows\System\gGKLfuQ.exe
  2⤵
  PID:6432
- C:\Windows\System\OmtzweE.exe
  C:\Windows\System\OmtzweE.exe
  2⤵
  PID:7216
- C:\Windows\System\ClIgFhK.exe
  C:\Windows\System\ClIgFhK.exe
  2⤵
  PID:7368
- C:\Windows\System\xZsZsKJ.exe
  C:\Windows\System\xZsZsKJ.exe
  2⤵
  PID:7468
- C:\Windows\System\VDQsdaC.exe
  C:\Windows\System\VDQsdaC.exe
  2⤵
  PID:8188
- C:\Windows\System\iWFpbEO.exe
  C:\Windows\System\iWFpbEO.exe
  2⤵
  PID:7844
- C:\Windows\System\UmGqJhq.exe
  C:\Windows\System\UmGqJhq.exe
  2⤵
  PID:7396
- C:\Windows\System\ebDroJJ.exe
  C:\Windows\System\ebDroJJ.exe
  2⤵
  PID:7772
- C:\Windows\System\simlesI.exe
  C:\Windows\System\simlesI.exe
  2⤵
  PID:8212
- C:\Windows\System\WRSnTnu.exe
  C:\Windows\System\WRSnTnu.exe
  2⤵
  PID:8240
- C:\Windows\System\TtLhFyw.exe
  C:\Windows\System\TtLhFyw.exe
  2⤵
  PID:8264
- C:\Windows\System\fzhfeTG.exe
  C:\Windows\System\fzhfeTG.exe
  2⤵
  PID:8296
- C:\Windows\System\tPUyveq.exe
  C:\Windows\System\tPUyveq.exe
  2⤵
  PID:8320
- C:\Windows\System\ztNKUUp.exe
  C:\Windows\System\ztNKUUp.exe
  2⤵
  PID:8348
- C:\Windows\System\epdIHnJ.exe
  C:\Windows\System\epdIHnJ.exe
  2⤵
  PID:8376
- C:\Windows\System\xJyRhaq.exe
  C:\Windows\System\xJyRhaq.exe
  2⤵
  PID:8396
- C:\Windows\System\uheQNev.exe
  C:\Windows\System\uheQNev.exe
  2⤵
  PID:8428
- C:\Windows\System\EbOhjcV.exe
  C:\Windows\System\EbOhjcV.exe
  2⤵
  PID:8464
- C:\Windows\System\VHpTTKD.exe
  C:\Windows\System\VHpTTKD.exe
  2⤵
  PID:8484
- C:\Windows\System\leejXnk.exe
  C:\Windows\System\leejXnk.exe
  2⤵
  PID:8520
- C:\Windows\System\lPTfmvh.exe
  C:\Windows\System\lPTfmvh.exe
  2⤵
  PID:8544
- C:\Windows\System\sWHOjBP.exe
  C:\Windows\System\sWHOjBP.exe
  2⤵
  PID:8568
- C:\Windows\System\qxCLnsI.exe
  C:\Windows\System\qxCLnsI.exe
  2⤵
  PID:8596
- C:\Windows\System\WyJqVwj.exe
  C:\Windows\System\WyJqVwj.exe
  2⤵
  PID:8624
- C:\Windows\System\PBZujTL.exe
  C:\Windows\System\PBZujTL.exe
  2⤵
  PID:8640
- C:\Windows\System\UDVOGsz.exe
  C:\Windows\System\UDVOGsz.exe
  2⤵
  PID:8668
- C:\Windows\System\WucFuwI.exe
  C:\Windows\System\WucFuwI.exe
  2⤵
  PID:8700
- C:\Windows\System\rHkzRkr.exe
  C:\Windows\System\rHkzRkr.exe
  2⤵
  PID:8728
- C:\Windows\System\uhXGzLi.exe
  C:\Windows\System\uhXGzLi.exe
  2⤵
  PID:8760
- C:\Windows\System\iSFjpak.exe
  C:\Windows\System\iSFjpak.exe
  2⤵
  PID:8788
- C:\Windows\System\YyrBmhC.exe
  C:\Windows\System\YyrBmhC.exe
  2⤵
  PID:8812
- C:\Windows\System\TgENVPd.exe
  C:\Windows\System\TgENVPd.exe
  2⤵
  PID:8832
- C:\Windows\System\jCwHyYu.exe
  C:\Windows\System\jCwHyYu.exe
  2⤵
  PID:8856
- C:\Windows\System\RoNzoGE.exe
  C:\Windows\System\RoNzoGE.exe
  2⤵
  PID:8884
- C:\Windows\System\bSsTSpv.exe
  C:\Windows\System\bSsTSpv.exe
  2⤵
  PID:8908
- C:\Windows\System\bnvvLCi.exe
  C:\Windows\System\bnvvLCi.exe
  2⤵
  PID:8940
- C:\Windows\System\PtbZIJS.exe
  C:\Windows\System\PtbZIJS.exe
  2⤵
  PID:8956
- C:\Windows\System\GZPtRTW.exe
  C:\Windows\System\GZPtRTW.exe
  2⤵
  PID:8992
- C:\Windows\System\zqHObUy.exe
  C:\Windows\System\zqHObUy.exe
  2⤵
  PID:9012
- C:\Windows\System\CdgBOXA.exe
  C:\Windows\System\CdgBOXA.exe
  2⤵
  PID:9040
- C:\Windows\System\WBIVwpj.exe
  C:\Windows\System\WBIVwpj.exe
  2⤵
  PID:9072
- C:\Windows\System\duQfIQI.exe
  C:\Windows\System\duQfIQI.exe
  2⤵
  PID:9096
- C:\Windows\System\kGCykPc.exe
  C:\Windows\System\kGCykPc.exe
  2⤵
  PID:9128
- C:\Windows\System\ULtmPdd.exe
  C:\Windows\System\ULtmPdd.exe
  2⤵
  PID:9152
- C:\Windows\System\HOQXvjb.exe
  C:\Windows\System\HOQXvjb.exe
  2⤵
  PID:9180
- C:\Windows\System\DSlkKkU.exe
  C:\Windows\System\DSlkKkU.exe
  2⤵
  PID:9200
- C:\Windows\System\oKBRWZG.exe
  C:\Windows\System\oKBRWZG.exe
  2⤵
  PID:8112
- C:\Windows\System\RXDQsaQ.exe
  C:\Windows\System\RXDQsaQ.exe
  2⤵
  PID:7660
- C:\Windows\System\kwbtJMj.exe
  C:\Windows\System\kwbtJMj.exe
  2⤵
  PID:7476
- C:\Windows\System\rwnHDRg.exe
  C:\Windows\System\rwnHDRg.exe
  2⤵
  PID:8224
- C:\Windows\System\lOkodve.exe
  C:\Windows\System\lOkodve.exe
  2⤵
  PID:8288
- C:\Windows\System\moEGpPW.exe
  C:\Windows\System\moEGpPW.exe
  2⤵
  PID:8344
- C:\Windows\System\hPqwbHj.exe
  C:\Windows\System\hPqwbHj.exe
  2⤵
  PID:8260
- C:\Windows\System\tuFUaEm.exe
  C:\Windows\System\tuFUaEm.exe
  2⤵
  PID:6776
- C:\Windows\System\kAMgkVX.exe
  C:\Windows\System\kAMgkVX.exe
  2⤵
  PID:8636
- C:\Windows\System\axwYWua.exe
  C:\Windows\System\axwYWua.exe
  2⤵
  PID:8404
- C:\Windows\System\eDwjTvK.exe
  C:\Windows\System\eDwjTvK.exe
  2⤵
  PID:8460
- C:\Windows\System\iSVegIQ.exe
  C:\Windows\System\iSVegIQ.exe
  2⤵
  PID:8772
- C:\Windows\System\LTOKSIq.exe
  C:\Windows\System\LTOKSIq.exe
  2⤵
  PID:8616
- C:\Windows\System\yuuipDq.exe
  C:\Windows\System\yuuipDq.exe
  2⤵
  PID:8868
- C:\Windows\System\FDDYaHs.exe
  C:\Windows\System\FDDYaHs.exe
  2⤵
  PID:8932
- C:\Windows\System\lxgTKLd.exe
  C:\Windows\System\lxgTKLd.exe
  2⤵
  PID:9000
- C:\Windows\System\MuKszRV.exe
  C:\Windows\System\MuKszRV.exe
  2⤵
  PID:9048
- C:\Windows\System\FuTfeKl.exe
  C:\Windows\System\FuTfeKl.exe
  2⤵
  PID:8692
- C:\Windows\System\Vtcolwf.exe
  C:\Windows\System\Vtcolwf.exe
  2⤵
  PID:9004
- C:\Windows\System\QpPcQWn.exe
  C:\Windows\System\QpPcQWn.exe
  2⤵
  PID:9052
- C:\Windows\System\DXcUspz.exe
  C:\Windows\System\DXcUspz.exe
  2⤵
  PID:7400
- C:\Windows\System\mhWOTtL.exe
  C:\Windows\System\mhWOTtL.exe
  2⤵
  PID:9148
- C:\Windows\System\QJoXrYO.exe
  C:\Windows\System\QJoXrYO.exe
  2⤵
  PID:8200
- C:\Windows\System\KDPmnDE.exe
  C:\Windows\System\KDPmnDE.exe
  2⤵
  PID:7312
- C:\Windows\System\FNfpNgd.exe
  C:\Windows\System\FNfpNgd.exe
  2⤵
  PID:9240
- C:\Windows\System\lHXiWQS.exe
  C:\Windows\System\lHXiWQS.exe
  2⤵
  PID:9264
- C:\Windows\System\mFXyNKI.exe
  C:\Windows\System\mFXyNKI.exe
  2⤵
  PID:9280
- C:\Windows\System\LPWYLSG.exe
  C:\Windows\System\LPWYLSG.exe
  2⤵
  PID:9304
- C:\Windows\System\ypUydHB.exe
  C:\Windows\System\ypUydHB.exe
  2⤵
  PID:9332
- C:\Windows\System\PTUHkNT.exe
  C:\Windows\System\PTUHkNT.exe
  2⤵
  PID:9356
- C:\Windows\System\XWmiXUO.exe
  C:\Windows\System\XWmiXUO.exe
  2⤵
  PID:9380
- C:\Windows\System\WLFDUbj.exe
  C:\Windows\System\WLFDUbj.exe
  2⤵
  PID:9404
- C:\Windows\System\OVFDGoE.exe
  C:\Windows\System\OVFDGoE.exe
  2⤵
  PID:9432
- C:\Windows\System\CQcVKwP.exe
  C:\Windows\System\CQcVKwP.exe
  2⤵
  PID:9456
- C:\Windows\System\YRBeZhP.exe
  C:\Windows\System\YRBeZhP.exe
  2⤵
  PID:9484
- C:\Windows\System\SIPPIBs.exe
  C:\Windows\System\SIPPIBs.exe
  2⤵
  PID:9512
- C:\Windows\System\fGRyECW.exe
  C:\Windows\System\fGRyECW.exe
  2⤵
  PID:9532
- C:\Windows\System\JlbCyoF.exe
  C:\Windows\System\JlbCyoF.exe
  2⤵
  PID:9564
- C:\Windows\System\vGtIaFn.exe
  C:\Windows\System\vGtIaFn.exe
  2⤵
  PID:9584
- C:\Windows\System\IswCTDd.exe
  C:\Windows\System\IswCTDd.exe
  2⤵
  PID:9608
- C:\Windows\System\ALHHUtc.exe
  C:\Windows\System\ALHHUtc.exe
  2⤵
  PID:9628
- C:\Windows\System\CyFrUKN.exe
  C:\Windows\System\CyFrUKN.exe
  2⤵
  PID:9652
- C:\Windows\System\FFirENo.exe
  C:\Windows\System\FFirENo.exe
  2⤵
  PID:9676
- C:\Windows\System\aNWBsgI.exe
  C:\Windows\System\aNWBsgI.exe
  2⤵
  PID:9708
- C:\Windows\System\YoeOYqz.exe
  C:\Windows\System\YoeOYqz.exe
  2⤵
  PID:9732
- C:\Windows\System\maIkaSN.exe
  C:\Windows\System\maIkaSN.exe
  2⤵
  PID:9760
- C:\Windows\System\RTyUtvn.exe
  C:\Windows\System\RTyUtvn.exe
  2⤵
  PID:9788
- C:\Windows\System\epRXmMH.exe
  C:\Windows\System\epRXmMH.exe
  2⤵
  PID:9820
- C:\Windows\System\VzuxyZO.exe
  C:\Windows\System\VzuxyZO.exe
  2⤵
  PID:9844
- C:\Windows\System\SCJRjaD.exe
  C:\Windows\System\SCJRjaD.exe
  2⤵
  PID:9872
- C:\Windows\System\xrGffSX.exe
  C:\Windows\System\xrGffSX.exe
  2⤵
  PID:9900
- C:\Windows\System\irTIoOZ.exe
  C:\Windows\System\irTIoOZ.exe
  2⤵
  PID:9928
- C:\Windows\System\jcbLzfj.exe
  C:\Windows\System\jcbLzfj.exe
  2⤵
  PID:9952
- C:\Windows\System\NrgRnfH.exe
  C:\Windows\System\NrgRnfH.exe
  2⤵
  PID:9968
- C:\Windows\System\xqVUCIQ.exe
  C:\Windows\System\xqVUCIQ.exe
  2⤵
  PID:9988
- C:\Windows\System\INRZjxp.exe
  C:\Windows\System\INRZjxp.exe
  2⤵
  PID:10012
- C:\Windows\System\LZeNXQP.exe
  C:\Windows\System\LZeNXQP.exe
  2⤵
  PID:10044
- C:\Windows\System\WKnWtVd.exe
  C:\Windows\System\WKnWtVd.exe
  2⤵
  PID:10076
- C:\Windows\System\QMTHswX.exe
  C:\Windows\System\QMTHswX.exe
  2⤵
  PID:10100
- C:\Windows\System\SyLmWpU.exe
  C:\Windows\System\SyLmWpU.exe
  2⤵
  PID:10128
- C:\Windows\System\OhPqCgW.exe
  C:\Windows\System\OhPqCgW.exe
  2⤵
  PID:10160
- C:\Windows\System\GmpNMDL.exe
  C:\Windows\System\GmpNMDL.exe
  2⤵
  PID:10188
- C:\Windows\System\JeqlOAk.exe
  C:\Windows\System\JeqlOAk.exe
  2⤵
  PID:10208
- C:\Windows\System\OhnKmpR.exe
  C:\Windows\System\OhnKmpR.exe
  2⤵
  PID:10236
- C:\Windows\System\IgoOeZB.exe
  C:\Windows\System\IgoOeZB.exe
  2⤵
  PID:9108
- C:\Windows\System\yRqHRoQ.exe
  C:\Windows\System\yRqHRoQ.exe
  2⤵
  PID:8424
- C:\Windows\System\gMbaMOZ.exe
  C:\Windows\System\gMbaMOZ.exe
  2⤵
  PID:9084
- C:\Windows\System\cNhpgTt.exe
  C:\Windows\System\cNhpgTt.exe
  2⤵
  PID:8756
- C:\Windows\System\WhLgzNj.exe
  C:\Windows\System\WhLgzNj.exe
  2⤵
  PID:9164
- C:\Windows\System\KwjSdVu.exe
  C:\Windows\System\KwjSdVu.exe
  2⤵
  PID:8852
- C:\Windows\System\ZJhSUFP.exe
  C:\Windows\System\ZJhSUFP.exe
  2⤵
  PID:9296
- C:\Windows\System\fGnXttt.exe
  C:\Windows\System\fGnXttt.exe
  2⤵
  PID:9416
- C:\Windows\System\pBGEtmx.exe
  C:\Windows\System\pBGEtmx.exe
  2⤵
  PID:9248
- C:\Windows\System\LKfXUCN.exe
  C:\Windows\System\LKfXUCN.exe
  2⤵
  PID:9036
- C:\Windows\System\IoDBluS.exe
  C:\Windows\System\IoDBluS.exe
  2⤵
  PID:7504
- C:\Windows\System\FpgrrPe.exe
  C:\Windows\System\FpgrrPe.exe
  2⤵
  PID:9392
- C:\Windows\System\DQZzyKu.exe
  C:\Windows\System\DQZzyKu.exe
  2⤵
  PID:9448
- C:\Windows\System\ubWBUqm.exe
  C:\Windows\System\ubWBUqm.exe
  2⤵
  PID:9784
- C:\Windows\System\FmhtypW.exe
  C:\Windows\System\FmhtypW.exe
  2⤵
  PID:9864
- C:\Windows\System\hlKxoXH.exe
  C:\Windows\System\hlKxoXH.exe
  2⤵
  PID:9320
- C:\Windows\System\ygdOBfV.exe
  C:\Windows\System\ygdOBfV.exe
  2⤵
  PID:10000
- C:\Windows\System\WfibAxZ.exe
  C:\Windows\System\WfibAxZ.exe
  2⤵
  PID:10040
- C:\Windows\System\llvTIlR.exe
  C:\Windows\System\llvTIlR.exe
  2⤵
  PID:9744
- C:\Windows\System\vrrZsvD.exe
  C:\Windows\System\vrrZsvD.exe
  2⤵
  PID:10184
- C:\Windows\System\buMFGcL.exe
  C:\Windows\System\buMFGcL.exe
  2⤵
  PID:7140
- C:\Windows\System\vGBiorf.exe
  C:\Windows\System\vGBiorf.exe
  2⤵
  PID:9344
- C:\Windows\System\FeHtFPu.exe
  C:\Windows\System\FeHtFPu.exe
  2⤵
  PID:10124
- C:\Windows\System\dqmpYVV.exe
  C:\Windows\System\dqmpYVV.exe
  2⤵
  PID:10264
- C:\Windows\System\dKLwNtd.exe
  C:\Windows\System\dKLwNtd.exe
  2⤵
  PID:10292
- C:\Windows\System\tSBJTMv.exe
  C:\Windows\System\tSBJTMv.exe
  2⤵
  PID:10320
- C:\Windows\System\jNdZWXb.exe
  C:\Windows\System\jNdZWXb.exe
  2⤵
  PID:10348
- C:\Windows\System\OEMRChW.exe
  C:\Windows\System\OEMRChW.exe
  2⤵
  PID:10380
- C:\Windows\System\WCCNWIU.exe
  C:\Windows\System\WCCNWIU.exe
  2⤵
  PID:10420
- C:\Windows\System\zQnhUCi.exe
  C:\Windows\System\zQnhUCi.exe
  2⤵
  PID:10444
- C:\Windows\System\uDHzzzL.exe
  C:\Windows\System\uDHzzzL.exe
  2⤵
  PID:10464
- C:\Windows\System\dLdndRj.exe
  C:\Windows\System\dLdndRj.exe
  2⤵
  PID:10488
- C:\Windows\System\PpOBHez.exe
  C:\Windows\System\PpOBHez.exe
  2⤵
  PID:10520
- C:\Windows\System\COREqrC.exe
  C:\Windows\System\COREqrC.exe
  2⤵
  PID:10544
- C:\Windows\System\qfdtDXv.exe
  C:\Windows\System\qfdtDXv.exe
  2⤵
  PID:10572
- C:\Windows\System\eJnNdjM.exe
  C:\Windows\System\eJnNdjM.exe
  2⤵
  PID:10604
- C:\Windows\System\UOSHjdu.exe
  C:\Windows\System\UOSHjdu.exe
  2⤵
  PID:10620
- C:\Windows\System\NRYrasM.exe
  C:\Windows\System\NRYrasM.exe
  2⤵
  PID:10652
- C:\Windows\System\CYyWTrZ.exe
  C:\Windows\System\CYyWTrZ.exe
  2⤵
  PID:10680
- C:\Windows\System\riyPQbe.exe
  C:\Windows\System\riyPQbe.exe
  2⤵
  PID:10700
- C:\Windows\System\vXGYEKD.exe
  C:\Windows\System\vXGYEKD.exe
  2⤵
  PID:10732
- C:\Windows\System\sNYYcAY.exe
  C:\Windows\System\sNYYcAY.exe
  2⤵
  PID:10764
- C:\Windows\System\nqLNuBE.exe
  C:\Windows\System\nqLNuBE.exe
  2⤵
  PID:10792
- C:\Windows\System\KSBZluB.exe
  C:\Windows\System\KSBZluB.exe
  2⤵
  PID:10816
- C:\Windows\System\JglNDbH.exe
  C:\Windows\System\JglNDbH.exe
  2⤵
  PID:10844
- C:\Windows\System\npdXEAm.exe
  C:\Windows\System\npdXEAm.exe
  2⤵
  PID:10872
- C:\Windows\System\CQIePdZ.exe
  C:\Windows\System\CQIePdZ.exe
  2⤵
  PID:10900
- C:\Windows\System\SOVmcys.exe
  C:\Windows\System\SOVmcys.exe
  2⤵
  PID:10920
- C:\Windows\System\QateahX.exe
  C:\Windows\System\QateahX.exe
  2⤵
  PID:10944
- C:\Windows\System\NTliwuC.exe
  C:\Windows\System\NTliwuC.exe
  2⤵
  PID:10976
- C:\Windows\System\vthhNSi.exe
  C:\Windows\System\vthhNSi.exe
  2⤵
  PID:10996
- C:\Windows\System\khspYIL.exe
  C:\Windows\System\khspYIL.exe
  2⤵
  PID:11020
- C:\Windows\System\LYmFRYH.exe
  C:\Windows\System\LYmFRYH.exe
  2⤵
  PID:11048
- C:\Windows\System\eZFRFSD.exe
  C:\Windows\System\eZFRFSD.exe
  2⤵
  PID:11072
- C:\Windows\System\dfBDnLv.exe
  C:\Windows\System\dfBDnLv.exe
  2⤵
  PID:11088
- C:\Windows\System\xydjnHr.exe
  C:\Windows\System\xydjnHr.exe
  2⤵
  PID:11120
- C:\Windows\System\ZeEcPyd.exe
  C:\Windows\System\ZeEcPyd.exe
  2⤵
  PID:11136
- C:\Windows\System\jPoroQr.exe
  C:\Windows\System\jPoroQr.exe
  2⤵
  PID:11164
- C:\Windows\System\gJXfamx.exe
  C:\Windows\System\gJXfamx.exe
  2⤵
  PID:11192
- C:\Windows\System\ZpdBHrx.exe
  C:\Windows\System\ZpdBHrx.exe
  2⤵
  PID:11216
- C:\Windows\System\PhJceUn.exe
  C:\Windows\System\PhJceUn.exe
  2⤵
  PID:11232
- C:\Windows\System\sJsujXE.exe
  C:\Windows\System\sJsujXE.exe
  2⤵
  PID:11260
- C:\Windows\System\WNuDsFI.exe
  C:\Windows\System\WNuDsFI.exe
  2⤵
  PID:9868
- C:\Windows\System\tBeGUQZ.exe
  C:\Windows\System\tBeGUQZ.exe
  2⤵
  PID:10232
- C:\Windows\System\qucaSdZ.exe
  C:\Windows\System\qucaSdZ.exe
  2⤵
  PID:8920
- C:\Windows\System\gvYXGYM.exe
  C:\Windows\System\gvYXGYM.exe
  2⤵
  PID:8552
- C:\Windows\System\IgnRsYO.exe
  C:\Windows\System\IgnRsYO.exe
  2⤵
  PID:9232
- C:\Windows\System\SqWTIyP.exe
  C:\Windows\System\SqWTIyP.exe
  2⤵
  PID:9272
- C:\Windows\System\vmOKKFf.exe
  C:\Windows\System\vmOKKFf.exe
  2⤵
  PID:10092
- C:\Windows\System\qBXYKbQ.exe
  C:\Windows\System\qBXYKbQ.exe
  2⤵
  PID:10260
- C:\Windows\System\AevUYgo.exe
  C:\Windows\System\AevUYgo.exe
  2⤵
  PID:9192
- C:\Windows\System\ckyQhNr.exe
  C:\Windows\System\ckyQhNr.exe
  2⤵
  PID:9556
- C:\Windows\System\rFfRxZz.exe
  C:\Windows\System\rFfRxZz.exe
  2⤵
  PID:10476
- C:\Windows\System\OGcudIs.exe
  C:\Windows\System\OGcudIs.exe
  2⤵
  PID:10532
- C:\Windows\System\SdrkMYZ.exe
  C:\Windows\System\SdrkMYZ.exe
  2⤵
  PID:9616
- C:\Windows\System\KkbFKAb.exe
  C:\Windows\System\KkbFKAb.exe
  2⤵
  PID:7916
- C:\Windows\System\OGoRwPE.exe
  C:\Windows\System\OGoRwPE.exe
  2⤵
  PID:10664
- C:\Windows\System\NATTFbk.exe
  C:\Windows\System\NATTFbk.exe
  2⤵
  PID:10772
- C:\Windows\System\ntuliFQ.exe
  C:\Windows\System\ntuliFQ.exe
  2⤵
  PID:10436
- C:\Windows\System\dSBMnmP.exe
  C:\Windows\System\dSBMnmP.exe
  2⤵
  PID:10868
- C:\Windows\System\NdqFCae.exe
  C:\Windows\System\NdqFCae.exe
  2⤵
  PID:10504
- C:\Windows\System\BwvANqu.exe
  C:\Windows\System\BwvANqu.exe
  2⤵
  PID:11016
- C:\Windows\System\URaRlpi.exe
  C:\Windows\System\URaRlpi.exe
  2⤵
  PID:11060
- C:\Windows\System\McdWUtT.exe
  C:\Windows\System\McdWUtT.exe
  2⤵
  PID:10752
- C:\Windows\System\feuMRmu.exe
  C:\Windows\System\feuMRmu.exe
  2⤵
  PID:10832
- C:\Windows\System\owRfWcC.exe
  C:\Windows\System\owRfWcC.exe
  2⤵
  PID:10960
- C:\Windows\System\ohBQeYj.exe
  C:\Windows\System\ohBQeYj.exe
  2⤵
  PID:9976
- C:\Windows\System\QtmrKCN.exe
  C:\Windows\System\QtmrKCN.exe
  2⤵
  PID:10668
- C:\Windows\System\xDyEYft.exe
  C:\Windows\System\xDyEYft.exe
  2⤵
  PID:10368
- C:\Windows\System\fItwYqd.exe
  C:\Windows\System\fItwYqd.exe
  2⤵
  PID:10460
- C:\Windows\System\sGDeUvZ.exe
  C:\Windows\System\sGDeUvZ.exe
  2⤵
  PID:11284
- C:\Windows\System\etJLctc.exe
  C:\Windows\System\etJLctc.exe
  2⤵
  PID:11316
- C:\Windows\System\BNwyMEi.exe
  C:\Windows\System\BNwyMEi.exe
  2⤵
  PID:11340
- C:\Windows\System\LCDplKE.exe
  C:\Windows\System\LCDplKE.exe
  2⤵
  PID:11368
- C:\Windows\System\PkffrTw.exe
  C:\Windows\System\PkffrTw.exe
  2⤵
  PID:11396
- C:\Windows\System\sTywLCT.exe
  C:\Windows\System\sTywLCT.exe
  2⤵
  PID:11412
- C:\Windows\System\uRaMpVz.exe
  C:\Windows\System\uRaMpVz.exe
  2⤵
  PID:11452
- C:\Windows\System\DPwbvXQ.exe
  C:\Windows\System\DPwbvXQ.exe
  2⤵
  PID:11468
- C:\Windows\System\DylLfgJ.exe
  C:\Windows\System\DylLfgJ.exe
  2⤵
  PID:11496
- C:\Windows\System\IqVzZLo.exe
  C:\Windows\System\IqVzZLo.exe
  2⤵
  PID:11524
- C:\Windows\System\BsvGoPC.exe
  C:\Windows\System\BsvGoPC.exe
  2⤵
  PID:11556
- C:\Windows\System\VbqCcyK.exe
  C:\Windows\System\VbqCcyK.exe
  2⤵
  PID:11580
- C:\Windows\System\HUBIDLM.exe
  C:\Windows\System\HUBIDLM.exe
  2⤵
  PID:11600
- C:\Windows\System\aCNbrvl.exe
  C:\Windows\System\aCNbrvl.exe
  2⤵
  PID:11624
- C:\Windows\System\dLpcgFA.exe
  C:\Windows\System\dLpcgFA.exe
  2⤵
  PID:11656
- C:\Windows\System\wSdVXov.exe
  C:\Windows\System\wSdVXov.exe
  2⤵
  PID:11684
- C:\Windows\System\ttSSWVG.exe
  C:\Windows\System\ttSSWVG.exe
  2⤵
  PID:11704
- C:\Windows\System\oDHAlxU.exe
  C:\Windows\System\oDHAlxU.exe
  2⤵
  PID:11732
- C:\Windows\System\ykgXAQf.exe
  C:\Windows\System\ykgXAQf.exe
  2⤵
  PID:11764
- C:\Windows\System\BdekglO.exe
  C:\Windows\System\BdekglO.exe
  2⤵
  PID:11788
- C:\Windows\System\ApAhlTv.exe
  C:\Windows\System\ApAhlTv.exe
  2⤵
  PID:11816
- C:\Windows\System\egmbcnQ.exe
  C:\Windows\System\egmbcnQ.exe
  2⤵
  PID:11844
- C:\Windows\System\UpujyeM.exe
  C:\Windows\System\UpujyeM.exe
  2⤵
  PID:11876
- C:\Windows\System\LvwCCXp.exe
  C:\Windows\System\LvwCCXp.exe
  2⤵
  PID:11900
- C:\Windows\System\oRhuJOU.exe
  C:\Windows\System\oRhuJOU.exe
  2⤵
  PID:11928
- C:\Windows\System\QaAOHfG.exe
  C:\Windows\System\QaAOHfG.exe
  2⤵
  PID:11952
- C:\Windows\System\vExyVDB.exe
  C:\Windows\System\vExyVDB.exe
  2⤵
  PID:11976
- C:\Windows\System\OoLLABS.exe
  C:\Windows\System\OoLLABS.exe
  2⤵
  PID:12000
- C:\Windows\System\qqcOYkS.exe
  C:\Windows\System\qqcOYkS.exe
  2⤵
  PID:12020
- C:\Windows\System\GYlYUnM.exe
  C:\Windows\System\GYlYUnM.exe
  2⤵
  PID:12048
- C:\Windows\System\xrEEicw.exe
  C:\Windows\System\xrEEicw.exe
  2⤵
  PID:12072
- C:\Windows\System\CqIRLUq.exe
  C:\Windows\System\CqIRLUq.exe
  2⤵
  PID:12104
- C:\Windows\System\NSkJlcS.exe
  C:\Windows\System\NSkJlcS.exe
  2⤵
  PID:12128
- C:\Windows\System\ujlBTuO.exe
  C:\Windows\System\ujlBTuO.exe
  2⤵
  PID:12160
- C:\Windows\System\EmLcQwy.exe
  C:\Windows\System\EmLcQwy.exe
  2⤵
  PID:12184
- C:\Windows\System\ZChOHPT.exe
  C:\Windows\System\ZChOHPT.exe
  2⤵
  PID:12200
- C:\Windows\System\jvtCRga.exe
  C:\Windows\System\jvtCRga.exe
  2⤵
  PID:12220
- C:\Windows\System\zOCMTrI.exe
  C:\Windows\System\zOCMTrI.exe
  2⤵
  PID:12236
- C:\Windows\System\WyAntjl.exe
  C:\Windows\System\WyAntjl.exe
  2⤵
  PID:12264
- C:\Windows\System\sYEGmEi.exe
  C:\Windows\System\sYEGmEi.exe
  2⤵
  PID:12284
- C:\Windows\System\bysuqpR.exe
  C:\Windows\System\bysuqpR.exe
  2⤵
  PID:9964
- C:\Windows\System\iJlpMSW.exe
  C:\Windows\System\iJlpMSW.exe
  2⤵
  PID:10304
- C:\Windows\System\UEqeUli.exe
  C:\Windows\System\UEqeUli.exe
  2⤵
  PID:8984
- C:\Windows\System\aXngkve.exe
  C:\Windows\System\aXngkve.exe
  2⤵
  PID:7240
- C:\Windows\System\HCjOogp.exe
  C:\Windows\System\HCjOogp.exe
  2⤵
  PID:11068
- C:\Windows\System\BSZfXBz.exe
  C:\Windows\System\BSZfXBz.exe
  2⤵
  PID:10828
- C:\Windows\System\vADpBQK.exe
  C:\Windows\System\vADpBQK.exe
  2⤵
  PID:9348
- C:\Windows\System\WFJZxiL.exe
  C:\Windows\System\WFJZxiL.exe
  2⤵
  PID:11272
- C:\Windows\System\wAoGxFj.exe
  C:\Windows\System\wAoGxFj.exe
  2⤵
  PID:11308
- C:\Windows\System\IWAOUZS.exe
  C:\Windows\System\IWAOUZS.exe
  2⤵
  PID:11228
- C:\Windows\System\FGnuIfZ.exe
  C:\Windows\System\FGnuIfZ.exe
  2⤵
  PID:11444
- C:\Windows\System\FPhbwQV.exe
  C:\Windows\System\FPhbwQV.exe
  2⤵
  PID:11520
- C:\Windows\System\iXSylKy.exe
  C:\Windows\System\iXSylKy.exe
  2⤵
  PID:10156
- C:\Windows\System\lMBKUZy.exe
  C:\Windows\System\lMBKUZy.exe
  2⤵
  PID:11596
- C:\Windows\System\CqGwICw.exe
  C:\Windows\System\CqGwICw.exe
  2⤵
  PID:11672
- C:\Windows\System\BTzYaov.exe
  C:\Windows\System\BTzYaov.exe
  2⤵
  PID:11720
- C:\Windows\System\DDyEoJV.exe
  C:\Windows\System\DDyEoJV.exe
  2⤵
  PID:11808
- C:\Windows\System\bZuDXYA.exe
  C:\Windows\System\bZuDXYA.exe
  2⤵
  PID:11380
- C:\Windows\System\SrgmCvM.exe
  C:\Windows\System\SrgmCvM.exe
  2⤵
  PID:9840
- C:\Windows\System\IoBmiEc.exe
  C:\Windows\System\IoBmiEc.exe
  2⤵
  PID:10708
- C:\Windows\System\kVRzCxA.exe
  C:\Windows\System\kVRzCxA.exe
  2⤵
  PID:8340
- C:\Windows\System\HOSGOSH.exe
  C:\Windows\System\HOSGOSH.exe
  2⤵
  PID:11780
- C:\Windows\System\EDoXLlC.exe
  C:\Windows\System\EDoXLlC.exe
  2⤵
  PID:11256
- C:\Windows\System\HNkclYo.exe
  C:\Windows\System\HNkclYo.exe
  2⤵
  PID:11896
- C:\Windows\System\sZGdEqp.exe
  C:\Windows\System\sZGdEqp.exe
  2⤵
  PID:11968
- C:\Windows\System\LopYbXN.exe
  C:\Windows\System\LopYbXN.exe
  2⤵
  PID:12320
- C:\Windows\System\XMTVojq.exe
  C:\Windows\System\XMTVojq.exe
  2⤵
  PID:12348
- C:\Windows\System\WtUYkSY.exe
  C:\Windows\System\WtUYkSY.exe
  2⤵
  PID:12380
- C:\Windows\System\yElgDcu.exe
  C:\Windows\System\yElgDcu.exe
  2⤵
  PID:12404
- C:\Windows\System\etUXrPw.exe
  C:\Windows\System\etUXrPw.exe
  2⤵
  PID:12428
- C:\Windows\System\eHxLOew.exe
  C:\Windows\System\eHxLOew.exe
  2⤵
  PID:12448
- C:\Windows\System\WglHGYw.exe
  C:\Windows\System\WglHGYw.exe
  2⤵
  PID:12476
- C:\Windows\System\sOSQAdO.exe
  C:\Windows\System\sOSQAdO.exe
  2⤵
  PID:12496
- C:\Windows\System\HdGlNrZ.exe
  C:\Windows\System\HdGlNrZ.exe
  2⤵
  PID:12520
- C:\Windows\System\JyxHKIM.exe
  C:\Windows\System\JyxHKIM.exe
  2⤵
  PID:12548
- C:\Windows\System\sOhrXIX.exe
  C:\Windows\System\sOhrXIX.exe
  2⤵
  PID:12580
- C:\Windows\System\RcTaKbQ.exe
  C:\Windows\System\RcTaKbQ.exe
  2⤵
  PID:12608
- C:\Windows\System\MnBZsaf.exe
  C:\Windows\System\MnBZsaf.exe
  2⤵
  PID:12632
- C:\Windows\System\DqipomR.exe
  C:\Windows\System\DqipomR.exe
  2⤵
  PID:12668
- C:\Windows\System\BzJuJBj.exe
  C:\Windows\System\BzJuJBj.exe
  2⤵
  PID:12688
- C:\Windows\System\aYxcwQf.exe
  C:\Windows\System\aYxcwQf.exe
  2⤵
  PID:12712
- C:\Windows\System\juHvGUW.exe
  C:\Windows\System\juHvGUW.exe
  2⤵
  PID:12740
- C:\Windows\System\micKLYx.exe
  C:\Windows\System\micKLYx.exe
  2⤵
  PID:12760
- C:\Windows\System\KPwjtSc.exe
  C:\Windows\System\KPwjtSc.exe
  2⤵
  PID:12784
- C:\Windows\System\goDAjqu.exe
  C:\Windows\System\goDAjqu.exe
  2⤵
  PID:12808
- C:\Windows\System\hHMaavq.exe
  C:\Windows\System\hHMaavq.exe
  2⤵
  PID:12832
- C:\Windows\System\WTZoQdO.exe
  C:\Windows\System\WTZoQdO.exe
  2⤵
  PID:12864
- C:\Windows\System\eyNvGRU.exe
  C:\Windows\System\eyNvGRU.exe
  2⤵
  PID:12892
- C:\Windows\System\NpRZuhs.exe
  C:\Windows\System\NpRZuhs.exe
  2⤵
  PID:12916
- C:\Windows\System\dCPXyWR.exe
  C:\Windows\System\dCPXyWR.exe
  2⤵
  PID:12952
- C:\Windows\System\GihdPqa.exe
  C:\Windows\System\GihdPqa.exe
  2⤵
  PID:12972
- C:\Windows\System\aUyotjX.exe
  C:\Windows\System\aUyotjX.exe
  2⤵
  PID:13004
- C:\Windows\System\xNpdNeS.exe
  C:\Windows\System\xNpdNeS.exe
  2⤵
  PID:13024
- C:\Windows\System\CbqiLDE.exe
  C:\Windows\System\CbqiLDE.exe
  2⤵
  PID:13044
- C:\Windows\System\WayTcnD.exe
  C:\Windows\System\WayTcnD.exe
  2⤵
  PID:13072
- C:\Windows\System\nFySqRV.exe
  C:\Windows\System\nFySqRV.exe
  2⤵
  PID:13088
- C:\Windows\System\xphFiJl.exe
  C:\Windows\System\xphFiJl.exe
  2⤵
  PID:13116
- C:\Windows\System\NgUYnGo.exe
  C:\Windows\System\NgUYnGo.exe
  2⤵
  PID:13140
- C:\Windows\System\UAyaHGc.exe
  C:\Windows\System\UAyaHGc.exe
  2⤵
  PID:13164
- C:\Windows\System\uYqnFqh.exe
  C:\Windows\System\uYqnFqh.exe
  2⤵
  PID:13192
- C:\Windows\System\LlvxrYM.exe
  C:\Windows\System\LlvxrYM.exe
  2⤵
  PID:13212
- C:\Windows\System\lwCZkFZ.exe
  C:\Windows\System\lwCZkFZ.exe
  2⤵
  PID:13236
- C:\Windows\System\LuqUguT.exe
  C:\Windows\System\LuqUguT.exe
  2⤵
  PID:13264
- C:\Windows\System\VXTKdhI.exe
  C:\Windows\System\VXTKdhI.exe
  2⤵
  PID:13288
- C:\Windows\System\mAxBKsb.exe
  C:\Windows\System\mAxBKsb.exe
  2⤵
  PID:11116
- C:\Windows\System\EcHnoTp.exe
  C:\Windows\System\EcHnoTp.exe
  2⤵
  PID:12032
- C:\Windows\System\InmYnbP.exe
  C:\Windows\System\InmYnbP.exe
  2⤵
  PID:11576
- C:\Windows\System\xGsyBzK.exe
  C:\Windows\System\xGsyBzK.exe
  2⤵
  PID:12096
- C:\Windows\System\RGvYDVj.exe
  C:\Windows\System\RGvYDVj.exe
  2⤵
  PID:12148
- C:\Windows\System\tCtYKLb.exe
  C:\Windows\System\tCtYKLb.exe
  2⤵
  PID:12208
- C:\Windows\System\FPZiNdp.exe
  C:\Windows\System\FPZiNdp.exe
  2⤵
  PID:12152
- C:\Windows\System\QAwkGRn.exe
  C:\Windows\System\QAwkGRn.exe
  2⤵
  PID:11132
- C:\Windows\System\NUZZrCn.exe
  C:\Windows\System\NUZZrCn.exe
  2⤵
  PID:11944
- C:\Windows\System\EjgESHJ.exe
  C:\Windows\System\EjgESHJ.exe
  2⤵
  PID:12012
- C:\Windows\System\jGvFJuk.exe
  C:\Windows\System\jGvFJuk.exe
  2⤵
  PID:12112
- C:\Windows\System\nArxMLs.exe
  C:\Windows\System\nArxMLs.exe
  2⤵
  PID:10992
- C:\Windows\System\rgYrlgS.exe
  C:\Windows\System\rgYrlgS.exe
  2⤵
  PID:11668
- C:\Windows\System\QwhWaOM.exe
  C:\Windows\System\QwhWaOM.exe
  2⤵
  PID:12640
- C:\Windows\System\FRNykbi.exe
  C:\Windows\System\FRNykbi.exe
  2⤵
  PID:12696
- C:\Windows\System\niiFXXJ.exe
  C:\Windows\System\niiFXXJ.exe
  2⤵
  PID:12732
- C:\Windows\System\iGOisnS.exe
  C:\Windows\System\iGOisnS.exe
  2⤵
  PID:12844
- C:\Windows\System\zAqkqdN.exe
  C:\Windows\System\zAqkqdN.exe
  2⤵
  PID:12904
- C:\Windows\System\FhuaUIo.exe
  C:\Windows\System\FhuaUIo.exe
  2⤵
  PID:12928
- C:\Windows\System\MEGQMkR.exe
  C:\Windows\System\MEGQMkR.exe
  2⤵
  PID:13032
- C:\Windows\System\yLYmLDm.exe
  C:\Windows\System\yLYmLDm.exe
  2⤵
  PID:11484
- C:\Windows\System\hUTEAxk.exe
  C:\Windows\System\hUTEAxk.exe
  2⤵
  PID:12564
- C:\Windows\System\AXXrSVH.exe
  C:\Windows\System\AXXrSVH.exe
  2⤵
  PID:11652
- C:\Windows\System\kWOHZYD.exe
  C:\Windows\System\kWOHZYD.exe
  2⤵
  PID:13336
- C:\Windows\System\QcxmCIY.exe
  C:\Windows\System\QcxmCIY.exe
  2⤵
  PID:13368
- C:\Windows\System\zbDiNeD.exe
  C:\Windows\System\zbDiNeD.exe
  2⤵
  PID:13392
- C:\Windows\System\mxiaGhS.exe
  C:\Windows\System\mxiaGhS.exe
  2⤵
  PID:13420
- C:\Windows\System\AiBMFsf.exe
  C:\Windows\System\AiBMFsf.exe
  2⤵
  PID:13448
- C:\Windows\System\CTyteDI.exe
  C:\Windows\System\CTyteDI.exe
  2⤵
  PID:13464
- C:\Windows\System\sguJZyt.exe
  C:\Windows\System\sguJZyt.exe
  2⤵
  PID:13492
- C:\Windows\System\Ycbmjbd.exe
  C:\Windows\System\Ycbmjbd.exe
  2⤵
  PID:13520
- C:\Windows\System\yTKyems.exe
  C:\Windows\System\yTKyems.exe
  2⤵
  PID:13544
- C:\Windows\System\FwMiaMV.exe
  C:\Windows\System\FwMiaMV.exe
  2⤵
  PID:13560
- C:\Windows\System\bztnNFv.exe
  C:\Windows\System\bztnNFv.exe
  2⤵
  PID:13584
- C:\Windows\System\hiMKWIB.exe
  C:\Windows\System\hiMKWIB.exe
  2⤵
  PID:13604
- C:\Windows\System\nFQqkae.exe
  C:\Windows\System\nFQqkae.exe
  2⤵
  PID:13632
- C:\Windows\System\lTPEilk.exe
  C:\Windows\System\lTPEilk.exe
  2⤵
  PID:13652
- C:\Windows\System\exlJOgT.exe
  C:\Windows\System\exlJOgT.exe
  2⤵
  PID:13672
- C:\Windows\System\QkZhHLP.exe
  C:\Windows\System\QkZhHLP.exe
  2⤵
  PID:13692
- C:\Windows\System\ozPMTfE.exe
  C:\Windows\System\ozPMTfE.exe
  2⤵
  PID:13716
- C:\Windows\System\DRoBvWH.exe
  C:\Windows\System\DRoBvWH.exe
  2⤵
  PID:13736
- C:\Windows\System\PVefZOW.exe
  C:\Windows\System\PVefZOW.exe
  2⤵
  PID:13764
- C:\Windows\System\ntJkrrG.exe
  C:\Windows\System\ntJkrrG.exe
  2⤵
  PID:13796
- C:\Windows\System\mWGwUVV.exe
  C:\Windows\System\mWGwUVV.exe
  2⤵
  PID:13816
- C:\Windows\System\aPxXbrF.exe
  C:\Windows\System\aPxXbrF.exe
  2⤵
  PID:13844
- C:\Windows\System\wLvbRCX.exe
  C:\Windows\System\wLvbRCX.exe
  2⤵
  PID:13872
- C:\Windows\System\uErUDww.exe
  C:\Windows\System\uErUDww.exe
  2⤵
  PID:13892
- C:\Windows\System\PopznAR.exe
  C:\Windows\System\PopznAR.exe
  2⤵
  PID:13916
- C:\Windows\System\iWKNFnz.exe
  C:\Windows\System\iWKNFnz.exe
  2⤵
  PID:13952
- C:\Windows\System\wVwNZrh.exe
  C:\Windows\System\wVwNZrh.exe
  2⤵
  PID:13980
- C:\Windows\System\hhqNqQB.exe
  C:\Windows\System\hhqNqQB.exe
  2⤵
  PID:14004
- C:\Windows\System\CJdLXoH.exe
  C:\Windows\System\CJdLXoH.exe
  2⤵
  PID:14024
- C:\Windows\System\WLVUtJe.exe
  C:\Windows\System\WLVUtJe.exe
  2⤵
  PID:14052
- C:\Windows\System\ycDPkua.exe
  C:\Windows\System\ycDPkua.exe
  2⤵
  PID:14072
- C:\Windows\System\pNvzrIr.exe
  C:\Windows\System\pNvzrIr.exe
  2⤵
  PID:14092
- C:\Windows\System\BfLfIHo.exe
  C:\Windows\System\BfLfIHo.exe
  2⤵
  PID:11716
- C:\Windows\System\pdKPpEH.exe
  C:\Windows\System\pdKPpEH.exe
  2⤵
  PID:12796
- C:\Windows\System\FgKgXjz.exe
  C:\Windows\System\FgKgXjz.exe
  2⤵
  PID:11828
- C:\Windows\System\ojaWnwQ.exe
  C:\Windows\System\ojaWnwQ.exe
  2⤵
  PID:8452
- C:\Windows\System\yHnngsp.exe
  C:\Windows\System\yHnngsp.exe
  2⤵
  PID:12316
- C:\Windows\System\QVTsoNb.exe
  C:\Windows\System\QVTsoNb.exe
  2⤵
  PID:12400
- C:\Windows\System\PfKIKqM.exe
  C:\Windows\System\PfKIKqM.exe
  2⤵
  PID:12460
- C:\Windows\System\WFXtmuI.exe
  C:\Windows\System\WFXtmuI.exe
  2⤵
  PID:12592
- C:\Windows\System\cOVZsIG.exe
  C:\Windows\System\cOVZsIG.exe
  2⤵
  PID:13224
- C:\Windows\System\pAfOUjg.exe
  C:\Windows\System\pAfOUjg.exe
  2⤵
  PID:9940
- C:\Windows\System\Qawlopt.exe
  C:\Windows\System\Qawlopt.exe
  2⤵
  PID:12624
- C:\Windows\System\gTjsXdr.exe
  C:\Windows\System\gTjsXdr.exe
  2⤵
  PID:13864
- C:\Windows\System\nbhWjZk.exe
  C:\Windows\System\nbhWjZk.exe
  2⤵
  PID:13108
- C:\Windows\System\gYcuGfm.exe
  C:\Windows\System\gYcuGfm.exe
  2⤵
  PID:14084
- C:\Windows\System\lSZTztE.exe
  C:\Windows\System\lSZTztE.exe
  2⤵
  PID:13248
- C:\Windows\System\sQqjcbd.exe
  C:\Windows\System\sQqjcbd.exe
  2⤵
  PID:13428
- C:\Windows\System\kGSsmOU.exe
  C:\Windows\System\kGSsmOU.exe
  2⤵
  PID:11384
- C:\Windows\System\mGfnrVm.exe
  C:\Windows\System\mGfnrVm.exe
  2⤵
  PID:11160
- C:\Windows\System\xjCFUvh.exe
  C:\Windows\System\xjCFUvh.exe
  2⤵
  PID:12684
- C:\Windows\System\xcUZgha.exe
  C:\Windows\System\xcUZgha.exe
  2⤵
  PID:13996
- C:\Windows\System\OpGOuWe.exe
  C:\Windows\System\OpGOuWe.exe
  2⤵
  PID:13480
- C:\Windows\System\pxdwLDa.exe
  C:\Windows\System\pxdwLDa.exe
  2⤵
  PID:12372
- C:\Windows\System\KYulmbo.exe
  C:\Windows\System\KYulmbo.exe
  2⤵
  PID:13596
- C:\Windows\System\tQvZplZ.exe
  C:\Windows\System\tQvZplZ.exe
  2⤵
  PID:13628
- C:\Windows\System\uEHWDWE.exe
  C:\Windows\System\uEHWDWE.exe
  2⤵
  PID:14376
- C:\Windows\System\dykuGdz.exe
  C:\Windows\System\dykuGdz.exe
  2⤵
  PID:14400
- C:\Windows\System\hLYlQiD.exe
  C:\Windows\System\hLYlQiD.exe
  2⤵
  PID:14416
- C:\Windows\System\YFucwXe.exe
  C:\Windows\System\YFucwXe.exe
  2⤵
  PID:14444
- C:\Windows\System\UCAMXCM.exe
  C:\Windows\System\UCAMXCM.exe
  2⤵
  PID:14480
- C:\Windows\System\VgxhXrt.exe
  C:\Windows\System\VgxhXrt.exe
  2⤵
  PID:14524
- C:\Windows\System\PLxkfwv.exe
  C:\Windows\System\PLxkfwv.exe
  2⤵
  PID:14548
- C:\Windows\System\atiDIjm.exe
  C:\Windows\System\atiDIjm.exe
  2⤵
  PID:14576
- C:\Windows\System\MNqHhdn.exe
  C:\Windows\System\MNqHhdn.exe
  2⤵
  PID:14600
- C:\Windows\System\YEBNxet.exe
  C:\Windows\System\YEBNxet.exe
  2⤵
  PID:14632
- C:\Windows\System\rVYrOam.exe
  C:\Windows\System\rVYrOam.exe
  2⤵
  PID:14652
- C:\Windows\System\EXWieST.exe
  C:\Windows\System\EXWieST.exe
  2⤵
  PID:14696
- C:\Windows\System\XfXnfil.exe
  C:\Windows\System\XfXnfil.exe
  2⤵
  PID:14720
- C:\Windows\System\gJdicWr.exe
  C:\Windows\System\gJdicWr.exe
  2⤵
  PID:14748
- C:\Windows\System\CnZZUEA.exe
  C:\Windows\System\CnZZUEA.exe
  2⤵
  PID:14784
- C:\Windows\System\oILVLuX.exe
  C:\Windows\System\oILVLuX.exe
  2⤵
  PID:14812
- C:\Windows\System\cmVKhBt.exe
  C:\Windows\System\cmVKhBt.exe
  2⤵
  PID:14836
- C:\Windows\System\JmLijuL.exe
  C:\Windows\System\JmLijuL.exe
  2⤵
  PID:14860
- C:\Windows\System\KJzucvx.exe
  C:\Windows\System\KJzucvx.exe
  2⤵
  PID:14880
- C:\Windows\System\NyMPrPg.exe
  C:\Windows\System\NyMPrPg.exe
  2⤵
  PID:14900
- C:\Windows\System\uWnvTeE.exe
  C:\Windows\System\uWnvTeE.exe
  2⤵
  PID:14924
- C:\Windows\System\nJeOgwR.exe
  C:\Windows\System\nJeOgwR.exe
  2⤵
  PID:14952
- C:\Windows\System\ExKwipO.exe
  C:\Windows\System\ExKwipO.exe
  2⤵
  PID:14972
- C:\Windows\System\ipcqLhV.exe
  C:\Windows\System\ipcqLhV.exe
  2⤵
  PID:14996
- C:\Windows\System\grcNhGB.exe
  C:\Windows\System\grcNhGB.exe
  2⤵
  PID:15028
- C:\Windows\System\ULtowTJ.exe
  C:\Windows\System\ULtowTJ.exe
  2⤵
  PID:15056
- C:\Windows\System\eyPflUS.exe
  C:\Windows\System\eyPflUS.exe
  2⤵
  PID:15228
- C:\Windows\System\WNWEFRV.exe
  C:\Windows\System\WNWEFRV.exe
  2⤵
  PID:15244
- C:\Windows\System\KZdPhbE.exe
  C:\Windows\System\KZdPhbE.exe
  2⤵
  PID:15264
- C:\Windows\System\xlNqYtS.exe
  C:\Windows\System\xlNqYtS.exe
  2⤵
  PID:15296
- C:\Windows\System\ekOydBz.exe
  C:\Windows\System\ekOydBz.exe
  2⤵
  PID:15336
- C:\Windows\System\bVICBtc.exe
  C:\Windows\System\bVICBtc.exe
  2⤵
  PID:13648
- C:\Windows\System\NlMYvtK.exe
  C:\Windows\System\NlMYvtK.exe
  2⤵
  PID:13228
- C:\Windows\System\GlcMOJp.exe
  C:\Windows\System\GlcMOJp.exe
  2⤵
  PID:13732
- C:\Windows\System\dDXSPBx.exe
  C:\Windows\System\dDXSPBx.exe
  2⤵
  PID:13804
- C:\Windows\System\jJgEfNf.exe
  C:\Windows\System\jJgEfNf.exe
  2⤵
  PID:13840
- C:\Windows\System\mnlvIIl.exe
  C:\Windows\System\mnlvIIl.exe
  2⤵
  PID:10512
- C:\Windows\System\EAQzRJb.exe
  C:\Windows\System\EAQzRJb.exe
  2⤵
  PID:13948
- C:\Windows\System\uxdeusb.exe
  C:\Windows\System\uxdeusb.exe
  2⤵
  PID:10452
- C:\Windows\System\mrzbhaX.exe
  C:\Windows\System\mrzbhaX.exe
  2⤵
  PID:12228
- C:\Windows\System\pUzRlON.exe
  C:\Windows\System\pUzRlON.exe
  2⤵
  PID:12908
- C:\Windows\System\BatQJTY.exe
  C:\Windows\System\BatQJTY.exe
  2⤵
  PID:13484
- C:\Windows\System\KcOgSlm.exe
  C:\Windows\System\KcOgSlm.exe
  2⤵
  PID:14220
- C:\Windows\System\sECpxBf.exe
  C:\Windows\System\sECpxBf.exe
  2⤵
  PID:10584
- C:\Windows\System\ejCNtVw.exe
  C:\Windows\System\ejCNtVw.exe
  2⤵
  PID:14328
- C:\Windows\System\GBSnAXq.exe
  C:\Windows\System\GBSnAXq.exe
  2⤵
  PID:12700
- C:\Windows\System\pcTIieT.exe
  C:\Windows\System\pcTIieT.exe
  2⤵
  PID:12068
- C:\Windows\System\qjHKMbf.exe
  C:\Windows\System\qjHKMbf.exe
  2⤵
  PID:14756
- C:\Windows\System\BItprUV.exe
  C:\Windows\System\BItprUV.exe
  2⤵
  PID:13644
- C:\Windows\System\PVmuTVD.exe
  C:\Windows\System\PVmuTVD.exe
  2⤵
  PID:14892
- C:\Windows\System\lDfMDIG.exe
  C:\Windows\System\lDfMDIG.exe
  2⤵
  PID:13176
- C:\Windows\System\fgFLFCO.exe
  C:\Windows\System\fgFLFCO.exe
  2⤵
  PID:15024
- C:\Windows\System\KADMevZ.exe
  C:\Windows\System\KADMevZ.exe
  2⤵
  PID:14460
- C:\Windows\System\IKJspjt.exe
  C:\Windows\System\IKJspjt.exe
  2⤵
  PID:13556
- C:\Windows\System\gUyIqBp.exe
  C:\Windows\System\gUyIqBp.exe
  2⤵
  PID:12988
- C:\Windows\System\FVugDOm.exe
  C:\Windows\System\FVugDOm.exe
  2⤵
  PID:14628
- C:\Windows\System\tmOPRIS.exe
  C:\Windows\System\tmOPRIS.exe
  2⤵
  PID:14104
- C:\Windows\System\aIpPtAD.exe
  C:\Windows\System\aIpPtAD.exe
  2⤵
  PID:14732
- C:\Windows\System\QqfnBsp.exe
  C:\Windows\System\QqfnBsp.exe
  2⤵
  PID:13900
- C:\Windows\System\niSYlyT.exe
  C:\Windows\System\niSYlyT.exe
  2⤵
  PID:14872
- C:\Windows\System\kvFchIr.exe
  C:\Windows\System\kvFchIr.exe
  2⤵
  PID:14932
- C:\Windows\System\JMdZWwy.exe
  C:\Windows\System\JMdZWwy.exe
  2⤵
  PID:15208
- C:\Windows\System\VGrZLLH.exe
  C:\Windows\System\VGrZLLH.exe
  2⤵
  PID:15308
- C:\Windows\System\HujhRlQ.exe
  C:\Windows\System\HujhRlQ.exe
  2⤵
  PID:14828
- C:\Windows\System\YFDDnAL.exe
  C:\Windows\System\YFDDnAL.exe
  2⤵
  PID:14964
- C:\Windows\System\HjqotSy.exe
  C:\Windows\System\HjqotSy.exe
  2⤵
  PID:15216
- C:\Windows\System\QZRPahi.exe
  C:\Windows\System\QZRPahi.exe
  2⤵
  PID:14392
- C:\Windows\System\WFVTaio.exe
  C:\Windows\System\WFVTaio.exe
  2⤵
  PID:15380
- C:\Windows\System\vZCioAK.exe
  C:\Windows\System\vZCioAK.exe
  2⤵
  PID:15400
- C:\Windows\System\utNNioA.exe
  C:\Windows\System\utNNioA.exe
  2⤵
  PID:15420
- C:\Windows\System\ITfZIdJ.exe
  C:\Windows\System\ITfZIdJ.exe
  2⤵
  PID:15440
- C:\Windows\System\BqDjKpM.exe
  C:\Windows\System\BqDjKpM.exe
  2⤵
  PID:15460
- C:\Windows\System\oHxWdfw.exe
  C:\Windows\System\oHxWdfw.exe
  2⤵
  PID:15484
- C:\Windows\System\zSiziCp.exe
  C:\Windows\System\zSiziCp.exe
  2⤵
  PID:15500
- C:\Windows\System\Sqodjra.exe
  C:\Windows\System\Sqodjra.exe
  2⤵
  PID:15532
- C:\Windows\System\ZOTTLXg.exe
  C:\Windows\System\ZOTTLXg.exe
  2⤵
  PID:15556
- C:\Windows\System\hKGMjTu.exe
  C:\Windows\System\hKGMjTu.exe
  2⤵
  PID:15584
- C:\Windows\System\PSErbLf.exe
  C:\Windows\System\PSErbLf.exe
  2⤵
  PID:15612
- C:\Windows\System\rwdnNud.exe
  C:\Windows\System\rwdnNud.exe
  2⤵
  PID:15636
- C:\Windows\System\VMqojtS.exe
  C:\Windows\System\VMqojtS.exe
  2⤵
  PID:15656
- C:\Windows\System\QPqaUpi.exe
  C:\Windows\System\QPqaUpi.exe
  2⤵
  PID:15708
- C:\Windows\System\xZGthUA.exe
  C:\Windows\System\xZGthUA.exe
  2⤵
  PID:15732
- C:\Windows\System\mRwEPjE.exe
  C:\Windows\System\mRwEPjE.exe
  2⤵
  PID:15752
- C:\Windows\System\IMUDCKq.exe
  C:\Windows\System\IMUDCKq.exe
  2⤵
  PID:15776
- C:\Windows\System\cMoSYNM.exe
  C:\Windows\System\cMoSYNM.exe
  2⤵
  PID:15808
- C:\Windows\System\XPgsfYO.exe
  C:\Windows\System\XPgsfYO.exe
  2⤵
  PID:15828
- C:\Windows\System\CdzkzZM.exe
  C:\Windows\System\CdzkzZM.exe
  2⤵
  PID:15844
- C:\Windows\System\GJEjxpg.exe
  C:\Windows\System\GJEjxpg.exe
  2⤵
  PID:15864
- C:\Windows\System\CVoLPuT.exe
  C:\Windows\System\CVoLPuT.exe
  2⤵
  PID:15888
- C:\Windows\System\YaVpWjV.exe
  C:\Windows\System\YaVpWjV.exe
  2⤵
  PID:15912
- C:\Windows\System\irwGQDb.exe
  C:\Windows\System\irwGQDb.exe
  2⤵
  PID:15940
- C:\Windows\System\CGcOcmX.exe
  C:\Windows\System\CGcOcmX.exe
  2⤵
  PID:15960
- C:\Windows\System\CORwjRG.exe
  C:\Windows\System\CORwjRG.exe
  2⤵
  PID:15992
- C:\Windows\System\KCElgMv.exe
  C:\Windows\System\KCElgMv.exe
  2⤵
  PID:16016
- C:\Windows\System\xyFMwWd.exe
  C:\Windows\System\xyFMwWd.exe
  2⤵
  PID:16044
- C:\Windows\System\hoPrLbP.exe
  C:\Windows\System\hoPrLbP.exe
  2⤵
  PID:16064
- C:\Windows\System\FKhlqzH.exe
  C:\Windows\System\FKhlqzH.exe
  2⤵
  PID:16084
- C:\Windows\System\eBeNkth.exe
  C:\Windows\System\eBeNkth.exe
  2⤵
  PID:16100
- C:\Windows\System\btOUVsq.exe
  C:\Windows\System\btOUVsq.exe
  2⤵
  PID:16124
- C:\Windows\System\VaCtJKc.exe
  C:\Windows\System\VaCtJKc.exe
  2⤵
  PID:16156
- C:\Windows\System\BOiKxLS.exe
  C:\Windows\System\BOiKxLS.exe
  2⤵
  PID:16172
- C:\Windows\System\QMliAWp.exe
  C:\Windows\System\QMliAWp.exe
  2⤵
  PID:16200
- C:\Windows\System\xAHbapK.exe
  C:\Windows\System\xAHbapK.exe
  2⤵
  PID:16220
- C:\Windows\System\gwSHaEx.exe
  C:\Windows\System\gwSHaEx.exe
  2⤵
  PID:16244
- C:\Windows\System\ysxzzjp.exe
  C:\Windows\System\ysxzzjp.exe
  2⤵
  PID:16260
- C:\Windows\System\QUAenRU.exe
  C:\Windows\System\QUAenRU.exe
  2⤵
  PID:16276
- C:\Windows\System\WmtbdxS.exe
  C:\Windows\System\WmtbdxS.exe
  2⤵
  PID:16292
- C:\Windows\System\zVrZVxF.exe
  C:\Windows\System\zVrZVxF.exe
  2⤵
  PID:16316
- C:\Windows\System\KkktwOy.exe
  C:\Windows\System\KkktwOy.exe
  2⤵
  PID:16336
- C:\Windows\System\vjbmgSu.exe
  C:\Windows\System\vjbmgSu.exe
  2⤵
  PID:16368
- C:\Windows\System\iJZbkZc.exe
  C:\Windows\System\iJZbkZc.exe
  2⤵
  PID:13832
- C:\Windows\System\gkRvqdV.exe
  C:\Windows\System\gkRvqdV.exe
  2⤵
  PID:14588
- C:\Windows\System\gyEdONd.exe
  C:\Windows\System\gyEdONd.exe
  2⤵
  PID:12468
- C:\Windows\System\BfZLInl.exe
  C:\Windows\System\BfZLInl.exe
  2⤵
  PID:15144
- C:\Windows\System\wLBelFn.exe
  C:\Windows\System\wLBelFn.exe
  2⤵
  PID:15236
- C:\Windows\System\CvXztmn.exe
  C:\Windows\System\CvXztmn.exe
  2⤵
  PID:13320
- C:\Windows\System\krKhrYp.exe
  C:\Windows\System\krKhrYp.exe
  2⤵
  PID:15356
- C:\Windows\System\abcGPfZ.exe
  C:\Windows\System\abcGPfZ.exe
  2⤵
  PID:15272
- C:\Windows\System\AzYzSVU.exe
  C:\Windows\System\AzYzSVU.exe
  2⤵
  PID:15368
- C:\Windows\System\QtYRxCH.exe
  C:\Windows\System\QtYRxCH.exe
  2⤵
  PID:15396
- C:\Windows\System\QOxHRaw.exe
  C:\Windows\System\QOxHRaw.exe
  2⤵
  PID:15436
- C:\Windows\System\mfslIGb.exe
  C:\Windows\System\mfslIGb.exe
  2⤵
  PID:15016
- C:\Windows\System\VJmZStK.exe
  C:\Windows\System\VJmZStK.exe
  2⤵
  PID:14672
- C:\Windows\System\cqEtnje.exe
  C:\Windows\System\cqEtnje.exe
  2⤵
  PID:12016
- C:\Windows\System\eHxILRO.exe
  C:\Windows\System\eHxILRO.exe
  2⤵
  PID:14164
- C:\Windows\System\HKriAdn.exe
  C:\Windows\System\HKriAdn.exe
  2⤵
  PID:13376
- C:\Windows\System\ihxvLWx.exe
  C:\Windows\System\ihxvLWx.exe
  2⤵
  PID:11408
- C:\Windows\System\CHqMMtt.exe
  C:\Windows\System\CHqMMtt.exe
  2⤵
  PID:14360
- C:\Windows\System\yZiYCqr.exe
  C:\Windows\System\yZiYCqr.exe
  2⤵
  PID:15860
- C:\Windows\System\lGEADiT.exe
  C:\Windows\System\lGEADiT.exe
  2⤵
  PID:13856
- C:\Windows\System\qehZYsV.exe
  C:\Windows\System\qehZYsV.exe
  2⤵
  PID:15976
- C:\Windows\System\YjaiZkb.exe
  C:\Windows\System\YjaiZkb.exe
  2⤵
  PID:16032
- C:\Windows\System\eBhVLYm.exe
  C:\Windows\System\eBhVLYm.exe
  2⤵
  PID:15472
- C:\Windows\System\JIUQuuw.exe
  C:\Windows\System\JIUQuuw.exe
  2⤵
  PID:15064
- C:\Windows\System\pcyBTye.exe
  C:\Windows\System\pcyBTye.exe
  2⤵
  PID:16240
- C:\Windows\System\CfrXHsE.exe
  C:\Windows\System\CfrXHsE.exe
  2⤵
  PID:14664
- C:\Windows\System\yZnCgmd.exe
  C:\Windows\System\yZnCgmd.exe
  2⤵
  PID:17288
- C:\Windows\System\ehDnxuU.exe
  C:\Windows\System\ehDnxuU.exe
  2⤵
  PID:17324
- C:\Windows\System\GeKXwhe.exe
  C:\Windows\System\GeKXwhe.exe
  2⤵
  PID:17340
- C:\Windows\System\uqojJCD.exe
  C:\Windows\System\uqojJCD.exe
  2⤵
  PID:17356
- C:\Windows\System\eetLkak.exe
  C:\Windows\System\eetLkak.exe
  2⤵
  PID:17376
- C:\Windows\System\wCQUVhf.exe
  C:\Windows\System\wCQUVhf.exe
  2⤵
  PID:17396
- C:\Windows\System\UzRaEnS.exe
  C:\Windows\System\UzRaEnS.exe
  2⤵
  PID:14432
- C:\Windows\System\QzznGKJ.exe
  C:\Windows\System\QzznGKJ.exe
  2⤵
  PID:15800
- C:\Windows\System\ZICqmPl.exe
  C:\Windows\System\ZICqmPl.exe
  2⤵
  PID:15876
- C:\Windows\System\VutRkpH.exe
  C:\Windows\System\VutRkpH.exe
  2⤵
  PID:14988
- C:\Windows\System\vNvHaAj.exe
  C:\Windows\System\vNvHaAj.exe
  2⤵
  PID:14740
- C:\Windows\System\vfQcHQr.exe
  C:\Windows\System\vfQcHQr.exe
  2⤵
  PID:16152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BAhKEvD.exe

Filesize
1.2MB

MD5
433016e8ab8cf761a999472f426c257e

SHA1
0631c7c2601679253b9ed8ac77c82434834ab196

SHA256
fb37aea6a20e5a0c8ac9e13fd14538695c6537f24a99c7c2c5365f0ceb3bc1ac

SHA512
cc477b0e3cf160238585e61c40dd08cabcbfeada53b53eb6d859795adab78a67440c754d93e9201a9248455c1ee13cf9fb4dc10fb578b02bdd1c209fc89878fe

Download Submit
C:\Windows\System\BEFxjcV.exe

Filesize
1.2MB

MD5
830082044d12236cc840915664d3b155

SHA1
7e1da19a58539174091f141433ea8d020d442dc1

SHA256
7baac39d1d9738c1e523830af0dc8f0229da46ce915fb4283b31ac5fd82adc6f

SHA512
97f48b10441b1a62546f33d56430579737ed00a6984c0e6fe555fe11579c9f2b276f2be3de70702c13573cd4b771ddfbb648cba7e915431823fce5db2d52aec6

Download Submit
C:\Windows\System\DqDwwrd.exe

Filesize
1.2MB

MD5
12a3ab537695fb983b2e158ba9b84ad1

SHA1
8a0ce4ab5d06aaa7443ddd45ca125cadceebbdc2

SHA256
d808d85f548b8b34652a9d6663f9a7ce1152ecff3c131d5c00b324583569e73a

SHA512
a5ac1faaef0e51f64850c70a943e62b5c1ee93e3cdd9b1c1de84e1591d392a14087109139bafc02cd863196fed6caf1840ae9f8ba616a1a47fba669832db1133

Download Submit
C:\Windows\System\ECTiWac.exe

Filesize
1.2MB

MD5
8a9ec4504ed29e761a3251e7a35b0f83

SHA1
4d3517e98ffaf278ac07215202f3b530361aea5e

SHA256
145bb455f9c8f8bc54ad6e4abdbb8962343bbf2c8ac07876ab118e799d0ae7f6

SHA512
8fec71aa144474824335cdacf9d4c5fb2f7fecc7cca98d40dd0901a4a05ba8f92987053c0f724af6e68533d9e2e3a2280d78729f4eb0e94611bb3639339e2514

Download Submit
C:\Windows\System\EdNJVWs.exe

Filesize
1.2MB

MD5
04a95664345411ab1566f2a2acb011bc

SHA1
c4dee3daa2f3bc0dbe4a7e5150ec224572ad4b30

SHA256
f3d796d28cd82d6c493af65c5dee36e7cd4a96d3e801662216d7004932e33868

SHA512
219492adda5bb3c22603fb1f549fef99aaef71cd1e5a43cb26dca44c7d29a966b56e5f127dd6194d256aa6292bd51cde0ccfa07315f036861939ac580f78344c

Download Submit
C:\Windows\System\IFjgFhG.exe

Filesize
1.2MB

MD5
fd6f38e55fe36b2234cff61b09efffa7

SHA1
cf3437afd6f2b152c025a187d364865d07646796

SHA256
d4dcf764b273a16d3760167bd07fc9d5de2d2b0ed2e4489585462025e76fda6b

SHA512
3594286a4eaa4c77eb4dee09c3770208df5c2269a4fd528c7a05be4efc29d67fa674403f3b6f7db202804d57f7d2bfd47d6fe2c57092e6daee6958e63ce1ef2e

Download Submit
C:\Windows\System\IXYOuxF.exe

Filesize
1.2MB

MD5
a37e60a79606f410e6306b8822ad3aaf

SHA1
9d29856eaa074fc11a97cf9d835961a02ab319ee

SHA256
2f2e349c0d5a96b9dcf6bed49c89d21434e13bac13cf57c25bee413803ace207

SHA512
fab139d5b1441f1f3e6a8a9d03724d8441b39319ada7716e0b7aad6757508accb94f5343ed57e809f50247bdbc40d585c68c91acf8ff16051bc06600704715de

Download Submit
C:\Windows\System\JdVtkem.exe

Filesize
1.2MB

MD5
20a7d6ad28007293c99e0e033e7800ef

SHA1
8d4500e31fa4c1dac2fb2c487904fedbaf5322bd

SHA256
f15a7e8b621a6d1fc784a49a7b2b222e2e62196a2c31948c075f02a2497aa4c9

SHA512
1f956c3609d4ac1e021efa74b75e2d4b3d2da412657cfd0d924b4d5fce35f9e08df031fe7a36f49f50f19dc61d47efe9ae3bea263ca9699e2d99ce2515167afa

Download Submit
C:\Windows\System\MkTKycP.exe

Filesize
1.2MB

MD5
2e9ff0d4722dc36744817d6f37876942

SHA1
3476db9ee9bf5dd5ddd07f344e93ff82ad1603f7

SHA256
b432f4f7720ce5778ecb5fcb947f63aaaae2a58edef8242b9a7adcd4ae24f772

SHA512
8d50aa0e12565d1c6b72c52934d9ac6219d99a7cae84cf70756f3ea999c09a7ff85101d9e6549d1431a5881d0851c6a95b01f0a8e92aeb3b64a9dc4364d4a6a0

Download Submit
C:\Windows\System\NOCUrSb.exe

Filesize
1.2MB

MD5
0f629fd35c23bf0477e3f06b33651d61

SHA1
a498ab0e7b1a91aeb46b515010e438499a63d046

SHA256
625d3e530eabe91685254b2610db4036df64f2c12f021de71f7c51c83a53ba77

SHA512
093eb05aa91297fefb58566ba7367277f688aac1b9079368070754b043f0d0fde47ad9b97c5e80f9849d59961226bfa19b0f5727c7a01671fdc2e7d2fb8c073b

Download Submit
C:\Windows\System\OAdwUXY.exe

Filesize
1.2MB

MD5
6121ae597176464313ad4af85cb41dc2

SHA1
953af2b7aece2237498dcc3d1f633660d504d98e

SHA256
7210e4bff8dcc52385006ecb00af33911275542b7131ea6c17a2aae5b29f44f5

SHA512
499f8e0e20dda677d329bd00f734ae737f5e76138713acd4d9f13fcab4e4b9f5eafa6de2c72fb42b1549471cef1a302f19037a94a7687f351e951787116c77bf

Download Submit
C:\Windows\System\OhvhavD.exe

Filesize
1.2MB

MD5
b297c04a98fa50bd33668cf9f0e052ef

SHA1
d12592ca55aac539bbd9b8cb39049513b48d2ba1

SHA256
3ce6d00fdd396a71bd0cb6f09370ee55f0020d7edf5374d17d9322f20bcba120

SHA512
a207d45c3138199fb43e8043f19f8b3bf6526d9c88ccd678dfcd0f754a9fef669168b5dff80da9199336daf99ad250409246a103122e85515d7479d47e54fd97

Download Submit
C:\Windows\System\OmvJXlD.exe

Filesize
1.2MB

MD5
f7e5582be7107de8fbe6a6c717ffb054

SHA1
6c1e1cc870562b040ae6a3475fb8d93343c11fd3

SHA256
40b1ad1ff6bee31a626dbbcc9e6ce7f7cb9364faadb19ee3c1bf4b972065d1ac

SHA512
802ca6d2334469f31a2875883f4463019a35e943cd494d846ac811e640cb9c50c5c9e1d4925c4241dc0216a760d3babe95c20d263f648a1df6ec36d6fca7c83e

Download Submit
C:\Windows\System\PKtZzzH.exe

Filesize
1.2MB

MD5
e284aebaa08cec96e391518dadee4dd9

SHA1
22a3ed61730b6c812dd69180fbd5d093713e062f

SHA256
fbe5ccbb3a881f92fb989fbd72be4cf1de5beed24ecc528d861dea0c1a83be74

SHA512
b403608a81fabb6d65fc9a7c75e4765d191e60f570c7064a3e7f8ff484e365af825acdaedff30a6244727763512f414ba177c8dbda215d2bf7c76d54ac02fc51

Download Submit
C:\Windows\System\QhXyuLM.exe

Filesize
1.2MB

MD5
1328fc1f4a8221115cec93908900a034

SHA1
c6ac4cdae362ae0611054205fe207043760e9362

SHA256
6e0a4747ebeab0bf8a2d3a3b22ceda44cea997e6df6dd543bff60b3495193830

SHA512
231e6c31b18548eb851faf9008a61a4900999d3b3e23b1abb53aa055931250ea035dd027f051a9be65af01489fbd2aed68c82730b1da87cff62cdd33827fee2b

Download Submit
C:\Windows\System\TNygzjr.exe

Filesize
1.2MB

MD5
92f907975934a74f65e652861fb6d8ec

SHA1
2bfc44ea34ad875fef624ba71953f009cf70539c

SHA256
88400d7ef4bc938c86bc091ca9e4aa815ce4a51323f850bd2b1ef23586b02f3c

SHA512
4755a6544b8c7017ced6594676e6cf2c3101a991d251ccc120597ddd18dedf59320ccef94f5c86f2a552a88a6375603ab8c41c0bdce74ad4cfa968160736de60

Download Submit
C:\Windows\System\VFaauZO.exe

Filesize
1.2MB

MD5
39347af6427433a76362e215a6580afd

SHA1
24dc19c7b660c4240194836f61203642c931f442

SHA256
15cf7986f4a546acdb4e5861ed3e544bfd90ee2ed8c9a43c058ab38b8ec0bba1

SHA512
52cb0ff7ffc454fd55c828bd6ff49a897e9da0a0a6cdccb83052311bbf6cd5470bc733dde4f71e1c4b8ed2b061fa9a4fd746e55a0427b2cfac8fd23c61227b1f

Download Submit
C:\Windows\System\VOZaivc.exe

Filesize
1.2MB

MD5
807f9ac75fda2094a6c7493743195e62

SHA1
dd920a7d5eeb812b83ea4c9009077ab5b21abbd3

SHA256
3990db9f2ae6fa3599b9a9a3f4319cd825aaf29abd6d16c23b1b8f5401cda1ee

SHA512
d1e92abafd2ba58044ee8538e2c9be898cbdafd5282caf9e6d076507ded51c4a7de47fc13c06057d1b96b91c36607d6e49702084539091bb32f4c4c4c9f161c0

Download Submit
C:\Windows\System\WEeliqX.exe

Filesize
1.2MB

MD5
ab44afa1a4f19fd1e6fd1f328ef2c946

SHA1
1cb7a08758f8893454928fcac12957cec4e89dd6

SHA256
64ce9ce909810d21ed7429c024141254e92ce68f88ac1285fafe280bac4e2aeb

SHA512
dcb141fcb22b279665c1b4b9a7b6fb39ed55c7db42c483be9d8d2cd35846e5010714c58174a69a1f4fb834032b7039c5b0e9f183f5d240edc49266f5c4bc587c

Download Submit
C:\Windows\System\WFdZARI.exe

Filesize
1.2MB

MD5
514af7efe9f38bef048b0c1deee44e08

SHA1
b8cb410b3deb036cee33cf45fd7f878787c9d023

SHA256
a398bdcad7738e4950545ce9b31389c46f9aba2d15d8a3fd5c6ba2f2d5f08193

SHA512
2b14b5591967c5b4b30fb63834f5ba05381da9dc3c05ee8bd081eaff51efa5dd9b6df0fdcddee0e8bd647d6236923c8ceef0bfd4685963ce60d569a66de6e37c

Download Submit
C:\Windows\System\WXrvAqO.exe

Filesize
1.2MB

MD5
dafd408697cc91350e8f739e6f75b8f2

SHA1
b87b6f0c0b260444d727206099a8fade27dee133

SHA256
8456de4fc743c63d84c152051a4ad64601185c76d49ff4671392fc7e51df7b37

SHA512
59418cb4280a3bb48362c87069f3eec7c9e26e61738dbc3ff331269fa0a3d0414599e73ff2e1f9294fd9aa1d52438747b3912d4e132f9adb4907f504da829eec

Download Submit
C:\Windows\System\WpHGvIp.exe

Filesize
1.2MB

MD5
9d44f5f566817fdb77078edc1e42757c

SHA1
c9e8bf34bf5d2b9194fe240fafc8242949e29607

SHA256
7fbc7553d47046bf90e2a5ae0c887f10993475e246b3fcc389f5e9af71459bc9

SHA512
eaea4e281f9a1110419bef78f12f05c051497789770ec1aa186f11207f2ec32508459e60a6482e8287b2a8066b9a685802ffb7dfa1da5827027cfb0acc6492ca

Download Submit
C:\Windows\System\XRdPaAO.exe

Filesize
1.2MB

MD5
d7b01002f63cd1363b384f1632b8248f

SHA1
cce3b07bb316e4ef8e09cd10196490ebe2c21ad4

SHA256
c45d2e0f0250945d8c7c1d11d9083859ab2b9cef495911f7865bc23a58fcd37d

SHA512
c3dea90e0ced6b8a8fb68653c67514479288c80493c8b3675ebdcf812d1e8c060a8103af19646c45b9cce6b9f7ea9e98d68edfcde8646e0be9b27bbd8568752c

Download Submit
C:\Windows\System\cuUwwWT.exe

Filesize
1.2MB

MD5
458b23f6ea51577bf616005fecf92385

SHA1
a3fca8af10473ca1534928204d7a01ec3bdaf0f5

SHA256
cbbc667fffb2c231143a284c273c2f7a48fe9062126738d57c6bfb2ad90e2643

SHA512
4a8546a83d3763d03af9685ed7792725eedde26780bd961c640cc36c74e07fc4ae57d1330121ebb895604a56e468929169ef89b725132b2d60f58eb24adc0845

Download Submit
C:\Windows\System\dFwluNV.exe

Filesize
1.2MB

MD5
392d27749ceb77aad1d01c2dbb1b5f48

SHA1
8b76beb30daac6a65e4d17b7eb06ed269b2376ef

SHA256
85a3a8d653e1905a049a8ce9199e9abb42f7cfe897f9e0b512b2a2cd66e07a49

SHA512
f69530335affbae384b1e495aba7ed07d88f59793231b4aec68e097e758993753ef153b5c40c459bfdb5fa69de165419a45c0871b71879220101daad22891ccc

Download Submit
C:\Windows\System\fJdYTvm.exe

Filesize
1.2MB

MD5
6cfe370708a315844f0d18cc618c1ce1

SHA1
bdbd372ac0b2ebbfb4b9c231bb14d691ac40bb29

SHA256
e7406ff5eab286b6d46277cf04e997c5353faab22e1251c80b4cc26cf16f6dfa

SHA512
a43a714f30d108c322099c268736ea79e3b2f89aad112906cf0b9f88850df26eacb87c247701af243f8ecb3a339c062b53b7d1930aec2c00adddb7b631e62527

Download Submit
C:\Windows\System\hmkAEmq.exe

Filesize
1.2MB

MD5
f125f701d8ce68440abe1b9713fba5a1

SHA1
cf566af243fa692661edd24d27d2e604c61b09e9

SHA256
9dfde7e54dc91a2bd305fb4a084f5ca5ee68077925357a6511930d88824ea86c

SHA512
6e4db17c2777b6e30a22a1633537ef9af043e01c592fc78071eafa4a8b0f098f9bc198e9be5a4eb970f9e9fc0ef8386729e69e7e3d9d9b28f76c557428ae2e5b

Download Submit
C:\Windows\System\liRjPNR.exe

Filesize
1.2MB

MD5
b4c233017e7a1a1b7691215141809d63

SHA1
755bf3d79f2c2e5f0536301602e98ccbe49fdcd0

SHA256
1a13e61cb2e04d3250aeb20d2108bf087002156099306e2102f36e3e1b49fe36

SHA512
765a48aec1992e26008051a01fc57eca69b1b958c2789bb5ef4b00b043b8528871e5ad45d28273150d29d2b5c0b07dde5e03ac4c7a371c136434c72a6968d083

Download Submit
C:\Windows\System\nPlqvjg.exe

Filesize
1.2MB

MD5
fe5b61679801278fe3e7d3eb7f914095

SHA1
84de7777d9a2564f87cbfc07119671e22829a061

SHA256
d4c232fce6032091aed7e576898672eb8449a3c76cda6d25b3ac331d55983df1

SHA512
7c1ff2970b1d79df81ce8f2df3c67028b10af4bb464e46cff1e1744f12bb005f3e04e5ef215d1bc6dc03ff7e31884063e89f2f09011866d2bfd1df977853d960

Download Submit
C:\Windows\System\oncUJRJ.exe

Filesize
1.2MB

MD5
0c4bb04eee49919688253cdf2677e5a1

SHA1
447367acb6a53083743480b56474fd29bfa39d54

SHA256
558e2a240f3f6107626ced9e7eea57d2bc687882b896587b0e4730fe24d18a5d

SHA512
ebb4e5c9af8834bac89dec022346ced09aabb4b99fa30ce2a0307725e98e8a8d5e054e534831e5d4d7e76db2eb941acc9b9a7ad21c71873d8c5a822887616f42

Download Submit
C:\Windows\System\pDqXNCD.exe

Filesize
1.2MB

MD5
824cf9d725199dfb234edb585c7862af

SHA1
6ea3c601bcf877bafd511235d764d744f18b4495

SHA256
da1e6ad3eec71c88ca68e0e6f21a8337eb480c57a2d14ada17d1ff6793180e6f

SHA512
c83f1de6ff618c27b2034d1f4786d1c4987bd9a6e84abdeca90bca54c3b39243db416816245104f71bf80cde05861652c6230e30a374af09d9edc74d1626a5b9

Download Submit
C:\Windows\System\pWsCxVF.exe

Filesize
1.2MB

MD5
28d5a3408e0028ddf0703dd95bae1216

SHA1
3e8b91ef076db808c70d487db4b885716d9f19b6

SHA256
e160b7c73f2f59cc058548fac81c081d0e502408a9babc99e177a119fcd6946f

SHA512
3a55a589ed22076bdab3c32e555c38aa219bbe589b689d60870497596d3453ad5f783211af613074cce04b68cc02a81a2cf6bb496e4e388cf84bc7e5a9114914

Download Submit
C:\Windows\System\rROgXZL.exe

Filesize
1.2MB

MD5
7c206b4680ef2ae97ea1013e5ea23ec0

SHA1
593a186a7139677e3fe58bd622fb7bcf11f39dc4

SHA256
e06879aef0e0e15457e4b292cc804fed6c38ea118c9ff3ff3dbf2c667fd6a3b0

SHA512
26bf68f5af89109b4705d4e6dce3d1e1db575c46cf9da123de77e91f91c77778a0f4817c47e80b091c6662ed564af5f0d4f0c850fc569a8cdcecf47a60914bc4

Download Submit
C:\Windows\System\vdfFaSU.exe

Filesize
1.2MB

MD5
50135045f5f9c96136bfc1059301ea80

SHA1
0a456d7fc78c1e27daf7d3dcb8db000442d1309a

SHA256
c37ab86d29868672c79fefb35ade26d65c14adf873835e4218e1d2bcbdf7cb5e

SHA512
7ea8c94a1ef5a77325057b45f69aec550e35b50b7063cda0d6e75e29c29502d18df4217c690619180c6adec3a90bcdc3a5e28e094b4f07bf3a5a24bbabd59275

Download Submit
C:\Windows\System\zVgQZPK.exe

Filesize
1.2MB

MD5
8d2dda7c6e112e552465e605b8ea1f7f

SHA1
d6863337abe63f6198076c1e81563688bba3a52c

SHA256
c30b9356f71cd3791b15eee0a36fa59d02ec194984b14ac5cfa4da1dd5ca86b6

SHA512
0745104f1f3826938ad7620c0ea9ff6dc220dfa1af8c905552d96a00a4edc5cac6acfd600e21e537271701e9685d55028b574744172e35e6ac4e8eae640e41ea

Download Submit
C:\Windows\System\zzFxTYC.exe

Filesize
1.2MB

MD5
f0e9dfe5db952546974f63ab21dcbd0e

SHA1
2ed66901edcfa9719f480bab2e57f770ecd1bdb6

SHA256
a5912a73c939fae2c72ba4c73acbecae783d8a543d7610add4e121cc1c51daa0

SHA512
4a19d11400108c0227c2d2e13c4b7392ff7dcc90778a88881454f15de85d1bbe36e1d7513533e2ccde73ef65682c5d4d29e5ada102d84a149a44f6b7088bf88c

Download Submit
memory/3440-0-0x000001CD2A500000-0x000001CD2A510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads