xmrig | af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
Size

1.4MB
MD5

9678cc7e5ff09215d7bcbce83336829c
SHA1

3a96b85339cb4cfee7e941b9f09f0512eeafc11c
SHA256

af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc
SHA512

877604fff65003016fe006c9656c8d1ae4657c673c76268f4b7832b85705d3d9996a259f1f5e55e10979414311edc4c6d09b37b6255d9ea45419a6dba79ce25b
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbci:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5w

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023cce-4.dat	xmrig
behavioral2/files/0x0007000000023cd5-12.dat	xmrig
behavioral2/files/0x0008000000023cd1-11.dat	xmrig
behavioral2/files/0x0007000000023cd6-17.dat	xmrig
behavioral2/files/0x0007000000023cd8-30.dat	xmrig
behavioral2/files/0x0007000000023cd9-35.dat	xmrig
behavioral2/files/0x0007000000023cde-60.dat	xmrig
behavioral2/files/0x0007000000023cdd-58.dat	xmrig
behavioral2/files/0x0007000000023cda-56.dat	xmrig
behavioral2/files/0x0007000000023cdc-54.dat	xmrig
behavioral2/files/0x0007000000023cdb-52.dat	xmrig
behavioral2/files/0x0007000000023cd7-25.dat	xmrig
behavioral2/files/0x0007000000023cdf-64.dat	xmrig
behavioral2/files/0x0008000000023cd2-67.dat	xmrig
behavioral2/files/0x0007000000023ce2-74.dat	xmrig
behavioral2/files/0x0007000000023ce3-79.dat	xmrig
behavioral2/files/0x0007000000023ce4-85.dat	xmrig
behavioral2/files/0x0007000000023ce5-93.dat	xmrig
behavioral2/files/0x0007000000023ce7-102.dat	xmrig
behavioral2/files/0x0007000000023cea-108.dat	xmrig
behavioral2/files/0x0007000000023ceb-114.dat	xmrig
behavioral2/files/0x0007000000023ce9-112.dat	xmrig
behavioral2/files/0x0007000000023ce8-111.dat	xmrig
behavioral2/files/0x0007000000023ce6-101.dat	xmrig
behavioral2/files/0x0007000000023cec-124.dat	xmrig
behavioral2/files/0x0007000000023ced-129.dat	xmrig
behavioral2/files/0x0007000000023cee-135.dat	xmrig
behavioral2/files/0x0007000000023cef-138.dat	xmrig
behavioral2/files/0x0007000000023cf3-165.dat	xmrig
behavioral2/files/0x0007000000023cf5-166.dat	xmrig
behavioral2/files/0x0007000000023cf1-162.dat	xmrig
behavioral2/files/0x0007000000023cf4-159.dat	xmrig
behavioral2/files/0x0007000000023cf0-150.dat	xmrig
behavioral2/files/0x0007000000023cf2-153.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1984	EuEqYzD.exe
4864	AdqIKOW.exe
3884	FZaGjQr.exe
5040	EhuFplh.exe
4168	JeMdkto.exe
2808	NyaMZtR.exe
1816	gLzkaMJ.exe
4948	UVSMljv.exe
3160	OdYsotk.exe
3536	rzwDCxx.exe
4724	RKSoOkg.exe
2012	OIhgzsl.exe
3564	OKQFlyD.exe
916	XuzcLML.exe
3416	ctCeggs.exe
1740	DdCUVZu.exe
3668	CplsAzp.exe
1812	sDBqNlo.exe
4576	nZkmxIW.exe
4328	YqlNMak.exe
456	fUIMbQR.exe
1360	QNuyIjR.exe
2740	eLWVUzM.exe
2936	vvvrnSA.exe
1104	YRxzFHK.exe
3396	MbbRVqU.exe
2692	DdJCxpu.exe
2648	bxmjqwB.exe
4856	cWVRRes.exe
4292	VNhKmxs.exe
1200	cnSVlkn.exe
3552	jijrDYu.exe
2716	SSAmHyD.exe
2876	wljamIw.exe
2568	QdgDcPi.exe
4308	lFDPJPB.exe
3968	nfIYDcR.exe
1668	FqTrOAz.exe
208	iltjYVx.exe
400	yFalEdu.exe
60	qPLszQk.exe
4492	JlYypMV.exe
4888	yqSpYlR.exe
2928	hgjzueO.exe
2980	vfzPWHn.exe
4412	rImtDOd.exe
2396	gViWvNA.exe
1712	cvqqViA.exe
2284	sYXcjUT.exe
1900	lewtHbA.exe
2140	jhGdwHf.exe
2112	diiSFJn.exe
3016	sfSSkcn.exe
2192	LlGYltl.exe
3164	vkUtbhm.exe
2744	dHulcbd.exe
4572	SubHdmP.exe
1544	OrMhrhX.exe
4564	JjxMqRh.exe
3708	iOyDjlj.exe
1708	kYSJBwF.exe
3904	cnEaRKj.exe
1548	vhEbplW.exe
4472	LaTmTKq.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tswKUhq.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\uVAGIXa.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\UJfnTOR.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\WMFUGHH.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\PNRApyV.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\lZNHzuf.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\ZfBpDbF.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\QdgDcPi.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\sYaSQoj.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\YZIvSNK.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\SjyEXOI.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\LfWqDXv.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\aaHGNtR.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\KSQUdBg.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\xxSxYMk.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\YFdMQTo.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\eyhcxzz.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\azuyAIR.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\MtQoEgf.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\pkeUvAq.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\BjYGXPu.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\TdaxPeK.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\eJakyNf.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\dhHyawU.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\LYLNSuL.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\tmKkUsX.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\pDZLroj.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\OpRXmKI.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\xjhByEC.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\UVSMljv.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\oUjDTdF.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\agMuUHJ.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\tPdrvJB.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\WtNIHSk.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\sLzQdGw.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\KbsUall.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\LMcXVII.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\dcFnifE.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\SubHdmP.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\MUwjFPa.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\iPoDRko.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\YUUkUKs.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\DzfKqSX.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\nwOqfAe.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\rYrxYGL.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\gsQYYzc.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\Emahzal.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\LllXzZq.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\LQvIxyo.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\NTQYbFs.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\rVffJMY.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\qQXVAGY.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\cnSVlkn.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\WYbNHWq.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\vGhyXys.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\grBzyLy.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\FEmRUBU.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\ORTmXvn.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\rhHVfpa.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\QajThOW.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\xNsXLON.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\vfzPWHn.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\RTAeyVK.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\nwSvTCt.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1984	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	86
PID 2508 wrote to memory of 1984	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	86
PID 2508 wrote to memory of 4864	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	87
PID 2508 wrote to memory of 4864	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	87
PID 2508 wrote to memory of 3884	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	88
PID 2508 wrote to memory of 3884	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	88
PID 2508 wrote to memory of 5040	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	89
PID 2508 wrote to memory of 5040	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	89
PID 2508 wrote to memory of 4168	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	90
PID 2508 wrote to memory of 4168	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	90
PID 2508 wrote to memory of 2808	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	91
PID 2508 wrote to memory of 2808	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	91
PID 2508 wrote to memory of 1816	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	92
PID 2508 wrote to memory of 1816	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	92
PID 2508 wrote to memory of 4948	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	93
PID 2508 wrote to memory of 4948	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	93
PID 2508 wrote to memory of 3160	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	94
PID 2508 wrote to memory of 3160	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	94
PID 2508 wrote to memory of 3536	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	95
PID 2508 wrote to memory of 3536	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	95
PID 2508 wrote to memory of 4724	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	96
PID 2508 wrote to memory of 4724	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	96
PID 2508 wrote to memory of 2012	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	97
PID 2508 wrote to memory of 2012	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	97
PID 2508 wrote to memory of 3564	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	98
PID 2508 wrote to memory of 3564	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	98
PID 2508 wrote to memory of 916	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	99
PID 2508 wrote to memory of 916	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	99
PID 2508 wrote to memory of 3416	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	100
PID 2508 wrote to memory of 3416	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	100
PID 2508 wrote to memory of 1740	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	101
PID 2508 wrote to memory of 1740	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	101
PID 2508 wrote to memory of 3668	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	102
PID 2508 wrote to memory of 3668	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	102
PID 2508 wrote to memory of 1812	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	103
PID 2508 wrote to memory of 1812	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	103
PID 2508 wrote to memory of 4576	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	104
PID 2508 wrote to memory of 4576	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	104
PID 2508 wrote to memory of 4328	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	105
PID 2508 wrote to memory of 4328	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	105
PID 2508 wrote to memory of 456	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	106
PID 2508 wrote to memory of 456	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	106
PID 2508 wrote to memory of 1360	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	107
PID 2508 wrote to memory of 1360	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	107
PID 2508 wrote to memory of 2740	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	108
PID 2508 wrote to memory of 2740	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	108
PID 2508 wrote to memory of 2936	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	109
PID 2508 wrote to memory of 2936	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	109
PID 2508 wrote to memory of 1104	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	110
PID 2508 wrote to memory of 1104	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	110
PID 2508 wrote to memory of 3396	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	111
PID 2508 wrote to memory of 3396	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	111
PID 2508 wrote to memory of 2692	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	115
PID 2508 wrote to memory of 2692	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	115
PID 2508 wrote to memory of 2648	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	116
PID 2508 wrote to memory of 2648	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	116
PID 2508 wrote to memory of 4856	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	117
PID 2508 wrote to memory of 4856	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	117
PID 2508 wrote to memory of 4292	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	118
PID 2508 wrote to memory of 4292	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	118
PID 2508 wrote to memory of 1200	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	119
PID 2508 wrote to memory of 1200	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	119
PID 2508 wrote to memory of 2716	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	120
PID 2508 wrote to memory of 2716	2508	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	120

C:\Users\Admin\AppData\Local\Temp\af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
"C:\Users\Admin\AppData\Local\Temp\af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System\EuEqYzD.exe
  C:\Windows\System\EuEqYzD.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\AdqIKOW.exe
  C:\Windows\System\AdqIKOW.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\FZaGjQr.exe
  C:\Windows\System\FZaGjQr.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\EhuFplh.exe
  C:\Windows\System\EhuFplh.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\JeMdkto.exe
  C:\Windows\System\JeMdkto.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\NyaMZtR.exe
  C:\Windows\System\NyaMZtR.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\gLzkaMJ.exe
  C:\Windows\System\gLzkaMJ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\UVSMljv.exe
  C:\Windows\System\UVSMljv.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\OdYsotk.exe
  C:\Windows\System\OdYsotk.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\rzwDCxx.exe
  C:\Windows\System\rzwDCxx.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\RKSoOkg.exe
  C:\Windows\System\RKSoOkg.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\OIhgzsl.exe
  C:\Windows\System\OIhgzsl.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\OKQFlyD.exe
  C:\Windows\System\OKQFlyD.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\XuzcLML.exe
  C:\Windows\System\XuzcLML.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\ctCeggs.exe
  C:\Windows\System\ctCeggs.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\DdCUVZu.exe
  C:\Windows\System\DdCUVZu.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\CplsAzp.exe
  C:\Windows\System\CplsAzp.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\sDBqNlo.exe
  C:\Windows\System\sDBqNlo.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\nZkmxIW.exe
  C:\Windows\System\nZkmxIW.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\YqlNMak.exe
  C:\Windows\System\YqlNMak.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\fUIMbQR.exe
  C:\Windows\System\fUIMbQR.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\QNuyIjR.exe
  C:\Windows\System\QNuyIjR.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\eLWVUzM.exe
  C:\Windows\System\eLWVUzM.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\vvvrnSA.exe
  C:\Windows\System\vvvrnSA.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\YRxzFHK.exe
  C:\Windows\System\YRxzFHK.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\MbbRVqU.exe
  C:\Windows\System\MbbRVqU.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\DdJCxpu.exe
  C:\Windows\System\DdJCxpu.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\bxmjqwB.exe
  C:\Windows\System\bxmjqwB.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\cWVRRes.exe
  C:\Windows\System\cWVRRes.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\VNhKmxs.exe
  C:\Windows\System\VNhKmxs.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\cnSVlkn.exe
  C:\Windows\System\cnSVlkn.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\SSAmHyD.exe
  C:\Windows\System\SSAmHyD.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\jijrDYu.exe
  C:\Windows\System\jijrDYu.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\wljamIw.exe
  C:\Windows\System\wljamIw.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\QdgDcPi.exe
  C:\Windows\System\QdgDcPi.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\lFDPJPB.exe
  C:\Windows\System\lFDPJPB.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\nfIYDcR.exe
  C:\Windows\System\nfIYDcR.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\FqTrOAz.exe
  C:\Windows\System\FqTrOAz.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\iltjYVx.exe
  C:\Windows\System\iltjYVx.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\yFalEdu.exe
  C:\Windows\System\yFalEdu.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\hgjzueO.exe
  C:\Windows\System\hgjzueO.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\qPLszQk.exe
  C:\Windows\System\qPLszQk.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\JlYypMV.exe
  C:\Windows\System\JlYypMV.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\yqSpYlR.exe
  C:\Windows\System\yqSpYlR.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\cvqqViA.exe
  C:\Windows\System\cvqqViA.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\vfzPWHn.exe
  C:\Windows\System\vfzPWHn.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\rImtDOd.exe
  C:\Windows\System\rImtDOd.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\gViWvNA.exe
  C:\Windows\System\gViWvNA.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\sYXcjUT.exe
  C:\Windows\System\sYXcjUT.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\lewtHbA.exe
  C:\Windows\System\lewtHbA.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\jhGdwHf.exe
  C:\Windows\System\jhGdwHf.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\diiSFJn.exe
  C:\Windows\System\diiSFJn.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\sfSSkcn.exe
  C:\Windows\System\sfSSkcn.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\LlGYltl.exe
  C:\Windows\System\LlGYltl.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\vkUtbhm.exe
  C:\Windows\System\vkUtbhm.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\dHulcbd.exe
  C:\Windows\System\dHulcbd.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\kYSJBwF.exe
  C:\Windows\System\kYSJBwF.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\SubHdmP.exe
  C:\Windows\System\SubHdmP.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\OrMhrhX.exe
  C:\Windows\System\OrMhrhX.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\JjxMqRh.exe
  C:\Windows\System\JjxMqRh.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\iOyDjlj.exe
  C:\Windows\System\iOyDjlj.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\cnEaRKj.exe
  C:\Windows\System\cnEaRKj.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\vhEbplW.exe
  C:\Windows\System\vhEbplW.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\LaTmTKq.exe
  C:\Windows\System\LaTmTKq.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\BWuiHeb.exe
  C:\Windows\System\BWuiHeb.exe
  2⤵
  PID:4764
- C:\Windows\System\GVoPfbD.exe
  C:\Windows\System\GVoPfbD.exe
  2⤵
  PID:4212
- C:\Windows\System\oYpHMVJ.exe
  C:\Windows\System\oYpHMVJ.exe
  2⤵
  PID:3872
- C:\Windows\System\FfcjXaG.exe
  C:\Windows\System\FfcjXaG.exe
  2⤵
  PID:4088
- C:\Windows\System\RTAeyVK.exe
  C:\Windows\System\RTAeyVK.exe
  2⤵
  PID:3644
- C:\Windows\System\sFzVYCm.exe
  C:\Windows\System\sFzVYCm.exe
  2⤵
  PID:2052
- C:\Windows\System\ZSCoeUR.exe
  C:\Windows\System\ZSCoeUR.exe
  2⤵
  PID:796
- C:\Windows\System\UzZvqgX.exe
  C:\Windows\System\UzZvqgX.exe
  2⤵
  PID:3896
- C:\Windows\System\tXyNOzH.exe
  C:\Windows\System\tXyNOzH.exe
  2⤵
  PID:2216
- C:\Windows\System\TvZtwRk.exe
  C:\Windows\System\TvZtwRk.exe
  2⤵
  PID:3504
- C:\Windows\System\SKANTCA.exe
  C:\Windows\System\SKANTCA.exe
  2⤵
  PID:4620
- C:\Windows\System\hmGkDhh.exe
  C:\Windows\System\hmGkDhh.exe
  2⤵
  PID:1324
- C:\Windows\System\nvyVCOe.exe
  C:\Windows\System\nvyVCOe.exe
  2⤵
  PID:5112
- C:\Windows\System\DPzlnSK.exe
  C:\Windows\System\DPzlnSK.exe
  2⤵
  PID:1940
- C:\Windows\System\UZaZJBl.exe
  C:\Windows\System\UZaZJBl.exe
  2⤵
  PID:3300
- C:\Windows\System\sBGdvJi.exe
  C:\Windows\System\sBGdvJi.exe
  2⤵
  PID:2736
- C:\Windows\System\bljohvs.exe
  C:\Windows\System\bljohvs.exe
  2⤵
  PID:116
- C:\Windows\System\Yculnjy.exe
  C:\Windows\System\Yculnjy.exe
  2⤵
  PID:2088
- C:\Windows\System\KvodgXn.exe
  C:\Windows\System\KvodgXn.exe
  2⤵
  PID:1744
- C:\Windows\System\LqIIqSS.exe
  C:\Windows\System\LqIIqSS.exe
  2⤵
  PID:4348
- C:\Windows\System\bRWvpoj.exe
  C:\Windows\System\bRWvpoj.exe
  2⤵
  PID:3528
- C:\Windows\System\LdQHmEx.exe
  C:\Windows\System\LdQHmEx.exe
  2⤵
  PID:1384
- C:\Windows\System\MoJVYgQ.exe
  C:\Windows\System\MoJVYgQ.exe
  2⤵
  PID:1864
- C:\Windows\System\VFuSMkB.exe
  C:\Windows\System\VFuSMkB.exe
  2⤵
  PID:4496
- C:\Windows\System\PkowWTB.exe
  C:\Windows\System\PkowWTB.exe
  2⤵
  PID:1048
- C:\Windows\System\AbwvwUl.exe
  C:\Windows\System\AbwvwUl.exe
  2⤵
  PID:4344
- C:\Windows\System\gOyEPRp.exe
  C:\Windows\System\gOyEPRp.exe
  2⤵
  PID:3460
- C:\Windows\System\adsvNbg.exe
  C:\Windows\System\adsvNbg.exe
  2⤵
  PID:2236
- C:\Windows\System\oHKprCE.exe
  C:\Windows\System\oHKprCE.exe
  2⤵
  PID:4128
- C:\Windows\System\KXKHeBX.exe
  C:\Windows\System\KXKHeBX.exe
  2⤵
  PID:3672
- C:\Windows\System\FfuzStr.exe
  C:\Windows\System\FfuzStr.exe
  2⤵
  PID:2872
- C:\Windows\System\RtqFpBL.exe
  C:\Windows\System\RtqFpBL.exe
  2⤵
  PID:1288
- C:\Windows\System\SkckRCS.exe
  C:\Windows\System\SkckRCS.exe
  2⤵
  PID:4304
- C:\Windows\System\NQwHUdO.exe
  C:\Windows\System\NQwHUdO.exe
  2⤵
  PID:5128
- C:\Windows\System\BzDaEzl.exe
  C:\Windows\System\BzDaEzl.exe
  2⤵
  PID:5148
- C:\Windows\System\kFruKPp.exe
  C:\Windows\System\kFruKPp.exe
  2⤵
  PID:5184
- C:\Windows\System\nFioMtx.exe
  C:\Windows\System\nFioMtx.exe
  2⤵
  PID:5224
- C:\Windows\System\KzHhQTz.exe
  C:\Windows\System\KzHhQTz.exe
  2⤵
  PID:5244
- C:\Windows\System\fxwpqKG.exe
  C:\Windows\System\fxwpqKG.exe
  2⤵
  PID:5272
- C:\Windows\System\mdtVxqq.exe
  C:\Windows\System\mdtVxqq.exe
  2⤵
  PID:5352
- C:\Windows\System\giRfkdH.exe
  C:\Windows\System\giRfkdH.exe
  2⤵
  PID:5384
- C:\Windows\System\sPyljmm.exe
  C:\Windows\System\sPyljmm.exe
  2⤵
  PID:5400
- C:\Windows\System\LlUnjDb.exe
  C:\Windows\System\LlUnjDb.exe
  2⤵
  PID:5436
- C:\Windows\System\NIrPCzO.exe
  C:\Windows\System\NIrPCzO.exe
  2⤵
  PID:5460
- C:\Windows\System\LOMPGNb.exe
  C:\Windows\System\LOMPGNb.exe
  2⤵
  PID:5488
- C:\Windows\System\vYcSofj.exe
  C:\Windows\System\vYcSofj.exe
  2⤵
  PID:5524
- C:\Windows\System\SagIkeJ.exe
  C:\Windows\System\SagIkeJ.exe
  2⤵
  PID:5548
- C:\Windows\System\GtYajeS.exe
  C:\Windows\System\GtYajeS.exe
  2⤵
  PID:5568
- C:\Windows\System\PGIknip.exe
  C:\Windows\System\PGIknip.exe
  2⤵
  PID:5604
- C:\Windows\System\smcBmkS.exe
  C:\Windows\System\smcBmkS.exe
  2⤵
  PID:5636
- C:\Windows\System\RlGJHeZ.exe
  C:\Windows\System\RlGJHeZ.exe
  2⤵
  PID:5660
- C:\Windows\System\qwUKKXs.exe
  C:\Windows\System\qwUKKXs.exe
  2⤵
  PID:5684
- C:\Windows\System\FEmRUBU.exe
  C:\Windows\System\FEmRUBU.exe
  2⤵
  PID:5708
- C:\Windows\System\cOCxepM.exe
  C:\Windows\System\cOCxepM.exe
  2⤵
  PID:5736
- C:\Windows\System\JQssAwk.exe
  C:\Windows\System\JQssAwk.exe
  2⤵
  PID:5760
- C:\Windows\System\vrQtdJn.exe
  C:\Windows\System\vrQtdJn.exe
  2⤵
  PID:5788
- C:\Windows\System\cfRgXwC.exe
  C:\Windows\System\cfRgXwC.exe
  2⤵
  PID:5816
- C:\Windows\System\HHJRrCj.exe
  C:\Windows\System\HHJRrCj.exe
  2⤵
  PID:5840
- C:\Windows\System\QlzfQqQ.exe
  C:\Windows\System\QlzfQqQ.exe
  2⤵
  PID:5876
- C:\Windows\System\MajGXMW.exe
  C:\Windows\System\MajGXMW.exe
  2⤵
  PID:5908
- C:\Windows\System\kiqXBxf.exe
  C:\Windows\System\kiqXBxf.exe
  2⤵
  PID:5932
- C:\Windows\System\ORTmXvn.exe
  C:\Windows\System\ORTmXvn.exe
  2⤵
  PID:5964
- C:\Windows\System\yPLgcJm.exe
  C:\Windows\System\yPLgcJm.exe
  2⤵
  PID:5996
- C:\Windows\System\OeaRXYt.exe
  C:\Windows\System\OeaRXYt.exe
  2⤵
  PID:6032
- C:\Windows\System\mVpLsWe.exe
  C:\Windows\System\mVpLsWe.exe
  2⤵
  PID:6068
- C:\Windows\System\WTWFpvR.exe
  C:\Windows\System\WTWFpvR.exe
  2⤵
  PID:6092
- C:\Windows\System\IZbfNds.exe
  C:\Windows\System\IZbfNds.exe
  2⤵
  PID:6124
- C:\Windows\System\nRqOKYm.exe
  C:\Windows\System\nRqOKYm.exe
  2⤵
  PID:1868
- C:\Windows\System\aeAdscU.exe
  C:\Windows\System\aeAdscU.exe
  2⤵
  PID:3916
- C:\Windows\System\IEBkVEW.exe
  C:\Windows\System\IEBkVEW.exe
  2⤵
  PID:1524
- C:\Windows\System\SNhEBmE.exe
  C:\Windows\System\SNhEBmE.exe
  2⤵
  PID:5168
- C:\Windows\System\iacYCxw.exe
  C:\Windows\System\iacYCxw.exe
  2⤵
  PID:3312
- C:\Windows\System\cddXijC.exe
  C:\Windows\System\cddXijC.exe
  2⤵
  PID:5088
- C:\Windows\System\ewiZuhJ.exe
  C:\Windows\System\ewiZuhJ.exe
  2⤵
  PID:5140
- C:\Windows\System\tjoFrPW.exe
  C:\Windows\System\tjoFrPW.exe
  2⤵
  PID:5260
- C:\Windows\System\XAnYJoE.exe
  C:\Windows\System\XAnYJoE.exe
  2⤵
  PID:5360
- C:\Windows\System\hhAfnZB.exe
  C:\Windows\System\hhAfnZB.exe
  2⤵
  PID:5416
- C:\Windows\System\TEFqGPk.exe
  C:\Windows\System\TEFqGPk.exe
  2⤵
  PID:5280
- C:\Windows\System\RlkkZQZ.exe
  C:\Windows\System\RlkkZQZ.exe
  2⤵
  PID:5564
- C:\Windows\System\vGRQttU.exe
  C:\Windows\System\vGRQttU.exe
  2⤵
  PID:5452
- C:\Windows\System\YUuMcfe.exe
  C:\Windows\System\YUuMcfe.exe
  2⤵
  PID:5412
- C:\Windows\System\XmGeqAF.exe
  C:\Windows\System\XmGeqAF.exe
  2⤵
  PID:5724
- C:\Windows\System\TGfaMTy.exe
  C:\Windows\System\TGfaMTy.exe
  2⤵
  PID:5616
- C:\Windows\System\yutQWmX.exe
  C:\Windows\System\yutQWmX.exe
  2⤵
  PID:5924
- C:\Windows\System\WfQesLm.exe
  C:\Windows\System\WfQesLm.exe
  2⤵
  PID:5800
- C:\Windows\System\LcqcJfj.exe
  C:\Windows\System\LcqcJfj.exe
  2⤵
  PID:5972
- C:\Windows\System\nwOqfAe.exe
  C:\Windows\System\nwOqfAe.exe
  2⤵
  PID:4968
- C:\Windows\System\CIgyBqc.exe
  C:\Windows\System\CIgyBqc.exe
  2⤵
  PID:5904
- C:\Windows\System\LDFeNrf.exe
  C:\Windows\System\LDFeNrf.exe
  2⤵
  PID:1632
- C:\Windows\System\OaQYIGQ.exe
  C:\Windows\System\OaQYIGQ.exe
  2⤵
  PID:228
- C:\Windows\System\mJnJhoc.exe
  C:\Windows\System\mJnJhoc.exe
  2⤵
  PID:5160
- C:\Windows\System\ivDMrDX.exe
  C:\Windows\System\ivDMrDX.exe
  2⤵
  PID:5300
- C:\Windows\System\VGCDxGQ.exe
  C:\Windows\System\VGCDxGQ.exe
  2⤵
  PID:5392
- C:\Windows\System\zhldIjA.exe
  C:\Windows\System\zhldIjA.exe
  2⤵
  PID:1248
- C:\Windows\System\KWEJUQC.exe
  C:\Windows\System\KWEJUQC.exe
  2⤵
  PID:5732
- C:\Windows\System\hqLPnlZ.exe
  C:\Windows\System\hqLPnlZ.exe
  2⤵
  PID:5536
- C:\Windows\System\xZhdgVB.exe
  C:\Windows\System\xZhdgVB.exe
  2⤵
  PID:5328
- C:\Windows\System\ApByqFU.exe
  C:\Windows\System\ApByqFU.exe
  2⤵
  PID:4768
- C:\Windows\System\hCBzBTd.exe
  C:\Windows\System\hCBzBTd.exe
  2⤵
  PID:6136
- C:\Windows\System\QEskIIF.exe
  C:\Windows\System\QEskIIF.exe
  2⤵
  PID:6164
- C:\Windows\System\dZDHgim.exe
  C:\Windows\System\dZDHgim.exe
  2⤵
  PID:6192
- C:\Windows\System\kokosNr.exe
  C:\Windows\System\kokosNr.exe
  2⤵
  PID:6224
- C:\Windows\System\krAouMD.exe
  C:\Windows\System\krAouMD.exe
  2⤵
  PID:6252
- C:\Windows\System\fbnbFuo.exe
  C:\Windows\System\fbnbFuo.exe
  2⤵
  PID:6288
- C:\Windows\System\XktvFFz.exe
  C:\Windows\System\XktvFFz.exe
  2⤵
  PID:6312
- C:\Windows\System\jRIFHol.exe
  C:\Windows\System\jRIFHol.exe
  2⤵
  PID:6344
- C:\Windows\System\LXiCGWz.exe
  C:\Windows\System\LXiCGWz.exe
  2⤵
  PID:6368
- C:\Windows\System\LqmuFLC.exe
  C:\Windows\System\LqmuFLC.exe
  2⤵
  PID:6396
- C:\Windows\System\pDZLroj.exe
  C:\Windows\System\pDZLroj.exe
  2⤵
  PID:6416
- C:\Windows\System\sYaSQoj.exe
  C:\Windows\System\sYaSQoj.exe
  2⤵
  PID:6440
- C:\Windows\System\NwwbXbR.exe
  C:\Windows\System\NwwbXbR.exe
  2⤵
  PID:6468
- C:\Windows\System\yDhFvsK.exe
  C:\Windows\System\yDhFvsK.exe
  2⤵
  PID:6516
- C:\Windows\System\ifaJBCb.exe
  C:\Windows\System\ifaJBCb.exe
  2⤵
  PID:6548
- C:\Windows\System\pvDsYmm.exe
  C:\Windows\System\pvDsYmm.exe
  2⤵
  PID:6576
- C:\Windows\System\xbQwrJM.exe
  C:\Windows\System\xbQwrJM.exe
  2⤵
  PID:6608
- C:\Windows\System\fNfKhHh.exe
  C:\Windows\System\fNfKhHh.exe
  2⤵
  PID:6640
- C:\Windows\System\BDlCcuR.exe
  C:\Windows\System\BDlCcuR.exe
  2⤵
  PID:6664
- C:\Windows\System\CyMfwfS.exe
  C:\Windows\System\CyMfwfS.exe
  2⤵
  PID:6692
- C:\Windows\System\oINrUYs.exe
  C:\Windows\System\oINrUYs.exe
  2⤵
  PID:6716
- C:\Windows\System\npRzSWG.exe
  C:\Windows\System\npRzSWG.exe
  2⤵
  PID:6748
- C:\Windows\System\gFmknRB.exe
  C:\Windows\System\gFmknRB.exe
  2⤵
  PID:6772
- C:\Windows\System\mXzFZpk.exe
  C:\Windows\System\mXzFZpk.exe
  2⤵
  PID:6808
- C:\Windows\System\DBxroWq.exe
  C:\Windows\System\DBxroWq.exe
  2⤵
  PID:6836
- C:\Windows\System\whnxiSy.exe
  C:\Windows\System\whnxiSy.exe
  2⤵
  PID:6864
- C:\Windows\System\Jbevvlc.exe
  C:\Windows\System\Jbevvlc.exe
  2⤵
  PID:6892
- C:\Windows\System\zbCWHuS.exe
  C:\Windows\System\zbCWHuS.exe
  2⤵
  PID:6916
- C:\Windows\System\FNHbCfE.exe
  C:\Windows\System\FNHbCfE.exe
  2⤵
  PID:6940
- C:\Windows\System\szxyTxF.exe
  C:\Windows\System\szxyTxF.exe
  2⤵
  PID:6972
- C:\Windows\System\jspVGUJ.exe
  C:\Windows\System\jspVGUJ.exe
  2⤵
  PID:6996
- C:\Windows\System\krGKnHA.exe
  C:\Windows\System\krGKnHA.exe
  2⤵
  PID:7020
- C:\Windows\System\nnQeiVN.exe
  C:\Windows\System\nnQeiVN.exe
  2⤵
  PID:7048
- C:\Windows\System\AiNJIwG.exe
  C:\Windows\System\AiNJIwG.exe
  2⤵
  PID:7080
- C:\Windows\System\RaDLnfI.exe
  C:\Windows\System\RaDLnfI.exe
  2⤵
  PID:7108
- C:\Windows\System\fHxKAJR.exe
  C:\Windows\System\fHxKAJR.exe
  2⤵
  PID:7132
- C:\Windows\System\QsxNuZr.exe
  C:\Windows\System\QsxNuZr.exe
  2⤵
  PID:7152
- C:\Windows\System\Xmigihe.exe
  C:\Windows\System\Xmigihe.exe
  2⤵
  PID:5952
- C:\Windows\System\TSBxbwb.exe
  C:\Windows\System\TSBxbwb.exe
  2⤵
  PID:5672
- C:\Windows\System\LCZQgwu.exe
  C:\Windows\System\LCZQgwu.exe
  2⤵
  PID:412
- C:\Windows\System\aiQcofY.exe
  C:\Windows\System\aiQcofY.exe
  2⤵
  PID:6240
- C:\Windows\System\OCiBlsq.exe
  C:\Windows\System\OCiBlsq.exe
  2⤵
  PID:6276
- C:\Windows\System\SxgQoQq.exe
  C:\Windows\System\SxgQoQq.exe
  2⤵
  PID:6380
- C:\Windows\System\AUTBIBF.exe
  C:\Windows\System\AUTBIBF.exe
  2⤵
  PID:6328
- C:\Windows\System\OcuDzYd.exe
  C:\Windows\System\OcuDzYd.exe
  2⤵
  PID:6364
- C:\Windows\System\cZIFjUS.exe
  C:\Windows\System\cZIFjUS.exe
  2⤵
  PID:6480
- C:\Windows\System\JeLJRGr.exe
  C:\Windows\System\JeLJRGr.exe
  2⤵
  PID:6588
- C:\Windows\System\PCZmdxe.exe
  C:\Windows\System\PCZmdxe.exe
  2⤵
  PID:6652
- C:\Windows\System\PfxCoVO.exe
  C:\Windows\System\PfxCoVO.exe
  2⤵
  PID:6728
- C:\Windows\System\RRTgoVf.exe
  C:\Windows\System\RRTgoVf.exe
  2⤵
  PID:6680
- C:\Windows\System\TrgGeGx.exe
  C:\Windows\System\TrgGeGx.exe
  2⤵
  PID:6796
- C:\Windows\System\WCiaXLp.exe
  C:\Windows\System\WCiaXLp.exe
  2⤵
  PID:6876
- C:\Windows\System\trwrzQV.exe
  C:\Windows\System\trwrzQV.exe
  2⤵
  PID:6992
- C:\Windows\System\tBgaLTg.exe
  C:\Windows\System\tBgaLTg.exe
  2⤵
  PID:7012
- C:\Windows\System\zJmcyeN.exe
  C:\Windows\System\zJmcyeN.exe
  2⤵
  PID:7096
- C:\Windows\System\vizIdbo.exe
  C:\Windows\System\vizIdbo.exe
  2⤵
  PID:5296
- C:\Windows\System\ztTgsmZ.exe
  C:\Windows\System\ztTgsmZ.exe
  2⤵
  PID:7120
- C:\Windows\System\lmTdrRI.exe
  C:\Windows\System\lmTdrRI.exe
  2⤵
  PID:6308
- C:\Windows\System\AKmMIdK.exe
  C:\Windows\System\AKmMIdK.exe
  2⤵
  PID:6572
- C:\Windows\System\lmhTJbt.exe
  C:\Windows\System\lmhTJbt.exe
  2⤵
  PID:7164
- C:\Windows\System\PeSrlZw.exe
  C:\Windows\System\PeSrlZw.exe
  2⤵
  PID:6852
- C:\Windows\System\LMcXVII.exe
  C:\Windows\System\LMcXVII.exe
  2⤵
  PID:6148
- C:\Windows\System\cZAceyu.exe
  C:\Windows\System\cZAceyu.exe
  2⤵
  PID:6208
- C:\Windows\System\NwhckVs.exe
  C:\Windows\System\NwhckVs.exe
  2⤵
  PID:7176
- C:\Windows\System\fjSbKrS.exe
  C:\Windows\System\fjSbKrS.exe
  2⤵
  PID:7204
- C:\Windows\System\rzaEdDE.exe
  C:\Windows\System\rzaEdDE.exe
  2⤵
  PID:7224
- C:\Windows\System\pSIgFPg.exe
  C:\Windows\System\pSIgFPg.exe
  2⤵
  PID:7244
- C:\Windows\System\SFifOUp.exe
  C:\Windows\System\SFifOUp.exe
  2⤵
  PID:7272
- C:\Windows\System\NWtcchP.exe
  C:\Windows\System\NWtcchP.exe
  2⤵
  PID:7300
- C:\Windows\System\eyhcxzz.exe
  C:\Windows\System\eyhcxzz.exe
  2⤵
  PID:7328
- C:\Windows\System\eBhzIrq.exe
  C:\Windows\System\eBhzIrq.exe
  2⤵
  PID:7352
- C:\Windows\System\BQZTLJJ.exe
  C:\Windows\System\BQZTLJJ.exe
  2⤵
  PID:7372
- C:\Windows\System\CbvUJQc.exe
  C:\Windows\System\CbvUJQc.exe
  2⤵
  PID:7400
- C:\Windows\System\ObBuyEC.exe
  C:\Windows\System\ObBuyEC.exe
  2⤵
  PID:7428
- C:\Windows\System\tSNpJnM.exe
  C:\Windows\System\tSNpJnM.exe
  2⤵
  PID:7456
- C:\Windows\System\IsZmaje.exe
  C:\Windows\System\IsZmaje.exe
  2⤵
  PID:7488
- C:\Windows\System\odpngKI.exe
  C:\Windows\System\odpngKI.exe
  2⤵
  PID:7520
- C:\Windows\System\gLJagNf.exe
  C:\Windows\System\gLJagNf.exe
  2⤵
  PID:7544
- C:\Windows\System\tfhmhDP.exe
  C:\Windows\System\tfhmhDP.exe
  2⤵
  PID:7588
- C:\Windows\System\xSWRDWH.exe
  C:\Windows\System\xSWRDWH.exe
  2⤵
  PID:7620
- C:\Windows\System\jnCtTEd.exe
  C:\Windows\System\jnCtTEd.exe
  2⤵
  PID:7644
- C:\Windows\System\JWHObwY.exe
  C:\Windows\System\JWHObwY.exe
  2⤵
  PID:7668
- C:\Windows\System\bgjWZrb.exe
  C:\Windows\System\bgjWZrb.exe
  2⤵
  PID:7700
- C:\Windows\System\ITCxdaE.exe
  C:\Windows\System\ITCxdaE.exe
  2⤵
  PID:7732
- C:\Windows\System\evPSRZc.exe
  C:\Windows\System\evPSRZc.exe
  2⤵
  PID:7760
- C:\Windows\System\FdxHkIG.exe
  C:\Windows\System\FdxHkIG.exe
  2⤵
  PID:7788
- C:\Windows\System\gXstyxU.exe
  C:\Windows\System\gXstyxU.exe
  2⤵
  PID:7812
- C:\Windows\System\gIAQrUz.exe
  C:\Windows\System\gIAQrUz.exe
  2⤵
  PID:7840
- C:\Windows\System\xqvBFbh.exe
  C:\Windows\System\xqvBFbh.exe
  2⤵
  PID:7864
- C:\Windows\System\jzvEbIh.exe
  C:\Windows\System\jzvEbIh.exe
  2⤵
  PID:7892
- C:\Windows\System\jiZlSMS.exe
  C:\Windows\System\jiZlSMS.exe
  2⤵
  PID:7924
- C:\Windows\System\Ygqakup.exe
  C:\Windows\System\Ygqakup.exe
  2⤵
  PID:7948
- C:\Windows\System\caomFvG.exe
  C:\Windows\System\caomFvG.exe
  2⤵
  PID:7964
- C:\Windows\System\jHzSPuO.exe
  C:\Windows\System\jHzSPuO.exe
  2⤵
  PID:7992
- C:\Windows\System\lqSQHcC.exe
  C:\Windows\System\lqSQHcC.exe
  2⤵
  PID:8016
- C:\Windows\System\IwVBFzE.exe
  C:\Windows\System\IwVBFzE.exe
  2⤵
  PID:8048
- C:\Windows\System\IPlbHpz.exe
  C:\Windows\System\IPlbHpz.exe
  2⤵
  PID:8076
- C:\Windows\System\pPqtguI.exe
  C:\Windows\System\pPqtguI.exe
  2⤵
  PID:8092
- C:\Windows\System\OpRXmKI.exe
  C:\Windows\System\OpRXmKI.exe
  2⤵
  PID:8108
- C:\Windows\System\DJGmqej.exe
  C:\Windows\System\DJGmqej.exe
  2⤵
  PID:8132
- C:\Windows\System\ZqzDiOM.exe
  C:\Windows\System\ZqzDiOM.exe
  2⤵
  PID:8168
- C:\Windows\System\ZgnGDJu.exe
  C:\Windows\System\ZgnGDJu.exe
  2⤵
  PID:8188
- C:\Windows\System\SjyEXOI.exe
  C:\Windows\System\SjyEXOI.exe
  2⤵
  PID:6684
- C:\Windows\System\CrImqrp.exe
  C:\Windows\System\CrImqrp.exe
  2⤵
  PID:6792
- C:\Windows\System\SmrVlMn.exe
  C:\Windows\System\SmrVlMn.exe
  2⤵
  PID:6160
- C:\Windows\System\dPWbQTT.exe
  C:\Windows\System\dPWbQTT.exe
  2⤵
  PID:7268
- C:\Windows\System\VHAMlev.exe
  C:\Windows\System\VHAMlev.exe
  2⤵
  PID:7172
- C:\Windows\System\oUjDTdF.exe
  C:\Windows\System\oUjDTdF.exe
  2⤵
  PID:7312
- C:\Windows\System\wzNLAif.exe
  C:\Windows\System\wzNLAif.exe
  2⤵
  PID:7256
- C:\Windows\System\DKqOVuN.exe
  C:\Windows\System\DKqOVuN.exe
  2⤵
  PID:7316
- C:\Windows\System\LRgvtGP.exe
  C:\Windows\System\LRgvtGP.exe
  2⤵
  PID:7480
- C:\Windows\System\uEvxgyP.exe
  C:\Windows\System\uEvxgyP.exe
  2⤵
  PID:7540
- C:\Windows\System\wlqlcMO.exe
  C:\Windows\System\wlqlcMO.exe
  2⤵
  PID:7600
- C:\Windows\System\tcRJtdW.exe
  C:\Windows\System\tcRJtdW.exe
  2⤵
  PID:7664
- C:\Windows\System\ONklVdu.exe
  C:\Windows\System\ONklVdu.exe
  2⤵
  PID:7416
- C:\Windows\System\WYbNHWq.exe
  C:\Windows\System\WYbNHWq.exe
  2⤵
  PID:7808
- C:\Windows\System\bjbZaru.exe
  C:\Windows\System\bjbZaru.exe
  2⤵
  PID:7848
- C:\Windows\System\ygAYUcx.exe
  C:\Windows\System\ygAYUcx.exe
  2⤵
  PID:7912
- C:\Windows\System\jDUbeyd.exe
  C:\Windows\System\jDUbeyd.exe
  2⤵
  PID:7768
- C:\Windows\System\dsNbNUd.exe
  C:\Windows\System\dsNbNUd.exe
  2⤵
  PID:8060
- C:\Windows\System\SvRyDoz.exe
  C:\Windows\System\SvRyDoz.exe
  2⤵
  PID:8104
- C:\Windows\System\lgYbZgR.exe
  C:\Windows\System\lgYbZgR.exe
  2⤵
  PID:7696
- C:\Windows\System\yUEDmVx.exe
  C:\Windows\System\yUEDmVx.exe
  2⤵
  PID:7364
- C:\Windows\System\azuyAIR.exe
  C:\Windows\System\azuyAIR.exe
  2⤵
  PID:8160
- C:\Windows\System\cZyKccC.exe
  C:\Windows\System\cZyKccC.exe
  2⤵
  PID:7824
- C:\Windows\System\IsfOsSX.exe
  C:\Windows\System\IsfOsSX.exe
  2⤵
  PID:8036
- C:\Windows\System\QmwGKZb.exe
  C:\Windows\System\QmwGKZb.exe
  2⤵
  PID:7988
- C:\Windows\System\kUUVWNN.exe
  C:\Windows\System\kUUVWNN.exe
  2⤵
  PID:8212
- C:\Windows\System\jOOGbjQ.exe
  C:\Windows\System\jOOGbjQ.exe
  2⤵
  PID:8228
- C:\Windows\System\bGtowUy.exe
  C:\Windows\System\bGtowUy.exe
  2⤵
  PID:8256
- C:\Windows\System\oRnApEw.exe
  C:\Windows\System\oRnApEw.exe
  2⤵
  PID:8284
- C:\Windows\System\vBVXiQT.exe
  C:\Windows\System\vBVXiQT.exe
  2⤵
  PID:8316
- C:\Windows\System\fILYkqi.exe
  C:\Windows\System\fILYkqi.exe
  2⤵
  PID:8348
- C:\Windows\System\kvlAWGz.exe
  C:\Windows\System\kvlAWGz.exe
  2⤵
  PID:8372
- C:\Windows\System\dubEtmI.exe
  C:\Windows\System\dubEtmI.exe
  2⤵
  PID:8400
- C:\Windows\System\ChdwvGO.exe
  C:\Windows\System\ChdwvGO.exe
  2⤵
  PID:8420
- C:\Windows\System\qAgIjKK.exe
  C:\Windows\System\qAgIjKK.exe
  2⤵
  PID:8436
- C:\Windows\System\FYNaebs.exe
  C:\Windows\System\FYNaebs.exe
  2⤵
  PID:8464
- C:\Windows\System\XDIaeRu.exe
  C:\Windows\System\XDIaeRu.exe
  2⤵
  PID:8492
- C:\Windows\System\dcFnifE.exe
  C:\Windows\System\dcFnifE.exe
  2⤵
  PID:8524
- C:\Windows\System\kyrXnje.exe
  C:\Windows\System\kyrXnje.exe
  2⤵
  PID:8544
- C:\Windows\System\cxlmUJN.exe
  C:\Windows\System\cxlmUJN.exe
  2⤵
  PID:8564
- C:\Windows\System\xvpYsqv.exe
  C:\Windows\System\xvpYsqv.exe
  2⤵
  PID:8584
- C:\Windows\System\OngeCnd.exe
  C:\Windows\System\OngeCnd.exe
  2⤵
  PID:8612
- C:\Windows\System\AQzafKq.exe
  C:\Windows\System\AQzafKq.exe
  2⤵
  PID:8664
- C:\Windows\System\SXNsSXL.exe
  C:\Windows\System\SXNsSXL.exe
  2⤵
  PID:8692
- C:\Windows\System\TyQZCHz.exe
  C:\Windows\System\TyQZCHz.exe
  2⤵
  PID:8724
- C:\Windows\System\RzKognQ.exe
  C:\Windows\System\RzKognQ.exe
  2⤵
  PID:8744
- C:\Windows\System\pSufpdC.exe
  C:\Windows\System\pSufpdC.exe
  2⤵
  PID:8760
- C:\Windows\System\pedjRgb.exe
  C:\Windows\System\pedjRgb.exe
  2⤵
  PID:8784
- C:\Windows\System\RhXOilO.exe
  C:\Windows\System\RhXOilO.exe
  2⤵
  PID:8808
- C:\Windows\System\zuIiZba.exe
  C:\Windows\System\zuIiZba.exe
  2⤵
  PID:8828
- C:\Windows\System\twjSerR.exe
  C:\Windows\System\twjSerR.exe
  2⤵
  PID:8844
- C:\Windows\System\nJFsWhA.exe
  C:\Windows\System\nJFsWhA.exe
  2⤵
  PID:8864
- C:\Windows\System\MXrygbq.exe
  C:\Windows\System\MXrygbq.exe
  2⤵
  PID:8888
- C:\Windows\System\eYTHsca.exe
  C:\Windows\System\eYTHsca.exe
  2⤵
  PID:8916
- C:\Windows\System\viTVjIf.exe
  C:\Windows\System\viTVjIf.exe
  2⤵
  PID:8936
- C:\Windows\System\dsUITqw.exe
  C:\Windows\System\dsUITqw.exe
  2⤵
  PID:8960
- C:\Windows\System\OwZfGJb.exe
  C:\Windows\System\OwZfGJb.exe
  2⤵
  PID:8988
- C:\Windows\System\inovXiN.exe
  C:\Windows\System\inovXiN.exe
  2⤵
  PID:9020
- C:\Windows\System\HJobMYB.exe
  C:\Windows\System\HJobMYB.exe
  2⤵
  PID:9056
- C:\Windows\System\bYUlSNK.exe
  C:\Windows\System\bYUlSNK.exe
  2⤵
  PID:9076
- C:\Windows\System\qAKnUku.exe
  C:\Windows\System\qAKnUku.exe
  2⤵
  PID:9100
- C:\Windows\System\PPgyFSY.exe
  C:\Windows\System\PPgyFSY.exe
  2⤵
  PID:9128
- C:\Windows\System\WEqyHtR.exe
  C:\Windows\System\WEqyHtR.exe
  2⤵
  PID:9152
- C:\Windows\System\ucrXHhL.exe
  C:\Windows\System\ucrXHhL.exe
  2⤵
  PID:9176
- C:\Windows\System\losYtSv.exe
  C:\Windows\System\losYtSv.exe
  2⤵
  PID:9196
- C:\Windows\System\XNBypWJ.exe
  C:\Windows\System\XNBypWJ.exe
  2⤵
  PID:7484
- C:\Windows\System\fwOhhYs.exe
  C:\Windows\System\fwOhhYs.exe
  2⤵
  PID:8324
- C:\Windows\System\rYrxYGL.exe
  C:\Windows\System\rYrxYGL.exe
  2⤵
  PID:8244
- C:\Windows\System\CKuWDoe.exe
  C:\Windows\System\CKuWDoe.exe
  2⤵
  PID:8384
- C:\Windows\System\FwHzUuB.exe
  C:\Windows\System\FwHzUuB.exe
  2⤵
  PID:8392
- C:\Windows\System\xeukWCZ.exe
  C:\Windows\System\xeukWCZ.exe
  2⤵
  PID:5540
- C:\Windows\System\wQWZQtO.exe
  C:\Windows\System\wQWZQtO.exe
  2⤵
  PID:8484
- C:\Windows\System\cHTFOET.exe
  C:\Windows\System\cHTFOET.exe
  2⤵
  PID:8532
- C:\Windows\System\bLMTvOm.exe
  C:\Windows\System\bLMTvOm.exe
  2⤵
  PID:8576
- C:\Windows\System\vRXTouk.exe
  C:\Windows\System\vRXTouk.exe
  2⤵
  PID:8684
- C:\Windows\System\tPRbvrU.exe
  C:\Windows\System\tPRbvrU.exe
  2⤵
  PID:8752
- C:\Windows\System\DULDwXt.exe
  C:\Windows\System\DULDwXt.exe
  2⤵
  PID:8780
- C:\Windows\System\yKdgUCO.exe
  C:\Windows\System\yKdgUCO.exe
  2⤵
  PID:8776
- C:\Windows\System\etfUHna.exe
  C:\Windows\System\etfUHna.exe
  2⤵
  PID:8952
- C:\Windows\System\FgHMmwr.exe
  C:\Windows\System\FgHMmwr.exe
  2⤵
  PID:8912
- C:\Windows\System\gVQnfQU.exe
  C:\Windows\System\gVQnfQU.exe
  2⤵
  PID:9048
- C:\Windows\System\CHbURwT.exe
  C:\Windows\System\CHbURwT.exe
  2⤵
  PID:8948
- C:\Windows\System\fmHSuKW.exe
  C:\Windows\System\fmHSuKW.exe
  2⤵
  PID:9032
- C:\Windows\System\xeDZFZR.exe
  C:\Windows\System\xeDZFZR.exe
  2⤵
  PID:8956
- C:\Windows\System\RQtdVPt.exe
  C:\Windows\System\RQtdVPt.exe
  2⤵
  PID:9116
- C:\Windows\System\UQUGpvA.exe
  C:\Windows\System\UQUGpvA.exe
  2⤵
  PID:9172
- C:\Windows\System\uHHqgIa.exe
  C:\Windows\System\uHHqgIa.exe
  2⤵
  PID:7260
- C:\Windows\System\CaekWNM.exe
  C:\Windows\System\CaekWNM.exe
  2⤵
  PID:8592
- C:\Windows\System\HddCoFY.exe
  C:\Windows\System\HddCoFY.exe
  2⤵
  PID:8428
- C:\Windows\System\tGuoAoD.exe
  C:\Windows\System\tGuoAoD.exe
  2⤵
  PID:8512
- C:\Windows\System\NHtzoiL.exe
  C:\Windows\System\NHtzoiL.exe
  2⤵
  PID:8924
- C:\Windows\System\SBlJdKX.exe
  C:\Windows\System\SBlJdKX.exe
  2⤵
  PID:8716
- C:\Windows\System\FaaPeAk.exe
  C:\Windows\System\FaaPeAk.exe
  2⤵
  PID:9240
- C:\Windows\System\pIZjRrg.exe
  C:\Windows\System\pIZjRrg.exe
  2⤵
  PID:9268
- C:\Windows\System\oumIyeQ.exe
  C:\Windows\System\oumIyeQ.exe
  2⤵
  PID:9292
- C:\Windows\System\vGhyXys.exe
  C:\Windows\System\vGhyXys.exe
  2⤵
  PID:9312
- C:\Windows\System\tSuKATu.exe
  C:\Windows\System\tSuKATu.exe
  2⤵
  PID:9332
- C:\Windows\System\AEksjuR.exe
  C:\Windows\System\AEksjuR.exe
  2⤵
  PID:9360
- C:\Windows\System\RLIoygJ.exe
  C:\Windows\System\RLIoygJ.exe
  2⤵
  PID:9380
- C:\Windows\System\gBzGnAe.exe
  C:\Windows\System\gBzGnAe.exe
  2⤵
  PID:9416
- C:\Windows\System\ztOKszO.exe
  C:\Windows\System\ztOKszO.exe
  2⤵
  PID:9448
- C:\Windows\System\pomttNo.exe
  C:\Windows\System\pomttNo.exe
  2⤵
  PID:9476
- C:\Windows\System\HqyEECj.exe
  C:\Windows\System\HqyEECj.exe
  2⤵
  PID:9504
- C:\Windows\System\ewvAERE.exe
  C:\Windows\System\ewvAERE.exe
  2⤵
  PID:9532
- C:\Windows\System\ATqfJvq.exe
  C:\Windows\System\ATqfJvq.exe
  2⤵
  PID:9560
- C:\Windows\System\WBZEdLw.exe
  C:\Windows\System\WBZEdLw.exe
  2⤵
  PID:9592
- C:\Windows\System\qnSkTMh.exe
  C:\Windows\System\qnSkTMh.exe
  2⤵
  PID:9616
- C:\Windows\System\EHfmwsx.exe
  C:\Windows\System\EHfmwsx.exe
  2⤵
  PID:9636
- C:\Windows\System\hydODzQ.exe
  C:\Windows\System\hydODzQ.exe
  2⤵
  PID:9656
- C:\Windows\System\HmGQFyA.exe
  C:\Windows\System\HmGQFyA.exe
  2⤵
  PID:9692
- C:\Windows\System\LljwDVY.exe
  C:\Windows\System\LljwDVY.exe
  2⤵
  PID:9716
- C:\Windows\System\rhHVfpa.exe
  C:\Windows\System\rhHVfpa.exe
  2⤵
  PID:9732
- C:\Windows\System\Vfzkdwr.exe
  C:\Windows\System\Vfzkdwr.exe
  2⤵
  PID:9752
- C:\Windows\System\lmfjUNb.exe
  C:\Windows\System\lmfjUNb.exe
  2⤵
  PID:9776
- C:\Windows\System\rZzSHTj.exe
  C:\Windows\System\rZzSHTj.exe
  2⤵
  PID:9800
- C:\Windows\System\zmYlPvF.exe
  C:\Windows\System\zmYlPvF.exe
  2⤵
  PID:9824
- C:\Windows\System\yOcNfWm.exe
  C:\Windows\System\yOcNfWm.exe
  2⤵
  PID:9852
- C:\Windows\System\kFaNGsn.exe
  C:\Windows\System\kFaNGsn.exe
  2⤵
  PID:9876
- C:\Windows\System\LfWqDXv.exe
  C:\Windows\System\LfWqDXv.exe
  2⤵
  PID:9900
- C:\Windows\System\EGAdoeT.exe
  C:\Windows\System\EGAdoeT.exe
  2⤵
  PID:9920
- C:\Windows\System\gSQXEQa.exe
  C:\Windows\System\gSQXEQa.exe
  2⤵
  PID:9940
- C:\Windows\System\ugCPJpI.exe
  C:\Windows\System\ugCPJpI.exe
  2⤵
  PID:9964
- C:\Windows\System\MMHBNjN.exe
  C:\Windows\System\MMHBNjN.exe
  2⤵
  PID:9992
- C:\Windows\System\xQurCqi.exe
  C:\Windows\System\xQurCqi.exe
  2⤵
  PID:10012
- C:\Windows\System\Emahzal.exe
  C:\Windows\System\Emahzal.exe
  2⤵
  PID:10036
- C:\Windows\System\vxWqKfl.exe
  C:\Windows\System\vxWqKfl.exe
  2⤵
  PID:10072
- C:\Windows\System\MeClWlc.exe
  C:\Windows\System\MeClWlc.exe
  2⤵
  PID:10096
- C:\Windows\System\URjOkMk.exe
  C:\Windows\System\URjOkMk.exe
  2⤵
  PID:10120
- C:\Windows\System\BwIsCYK.exe
  C:\Windows\System\BwIsCYK.exe
  2⤵
  PID:10144
- C:\Windows\System\zMKFPAe.exe
  C:\Windows\System\zMKFPAe.exe
  2⤵
  PID:10168
- C:\Windows\System\PkvwCDi.exe
  C:\Windows\System\PkvwCDi.exe
  2⤵
  PID:10184
- C:\Windows\System\WoJwbEO.exe
  C:\Windows\System\WoJwbEO.exe
  2⤵
  PID:10208
- C:\Windows\System\CvIbdZi.exe
  C:\Windows\System\CvIbdZi.exe
  2⤵
  PID:10228
- C:\Windows\System\mzNLUBP.exe
  C:\Windows\System\mzNLUBP.exe
  2⤵
  PID:9088
- C:\Windows\System\yssxSPa.exe
  C:\Windows\System\yssxSPa.exe
  2⤵
  PID:9192
- C:\Windows\System\HUGrWTY.exe
  C:\Windows\System\HUGrWTY.exe
  2⤵
  PID:9040
- C:\Windows\System\OwHAyXl.exe
  C:\Windows\System\OwHAyXl.exe
  2⤵
  PID:9164
- C:\Windows\System\hoVPaul.exe
  C:\Windows\System\hoVPaul.exe
  2⤵
  PID:9264
- C:\Windows\System\RzubckM.exe
  C:\Windows\System\RzubckM.exe
  2⤵
  PID:9372
- C:\Windows\System\ctmpEmy.exe
  C:\Windows\System\ctmpEmy.exe
  2⤵
  PID:9664
- C:\Windows\System\SxZULho.exe
  C:\Windows\System\SxZULho.exe
  2⤵
  PID:9728
- C:\Windows\System\aQokYDp.exe
  C:\Windows\System\aQokYDp.exe
  2⤵
  PID:9572
- C:\Windows\System\VAQTiBh.exe
  C:\Windows\System\VAQTiBh.exe
  2⤵
  PID:9844
- C:\Windows\System\CeZIIJi.exe
  C:\Windows\System\CeZIIJi.exe
  2⤵
  PID:9928
- C:\Windows\System\kyBbnfD.exe
  C:\Windows\System\kyBbnfD.exe
  2⤵
  PID:9464
- C:\Windows\System\hEjXmZy.exe
  C:\Windows\System\hEjXmZy.exe
  2⤵
  PID:9496
- C:\Windows\System\ifNSNEq.exe
  C:\Windows\System\ifNSNEq.exe
  2⤵
  PID:9956
- C:\Windows\System\FXKAnsU.exe
  C:\Windows\System\FXKAnsU.exe
  2⤵
  PID:9588
- C:\Windows\System\TdaxPeK.exe
  C:\Windows\System\TdaxPeK.exe
  2⤵
  PID:10080
- C:\Windows\System\OYrCsLP.exe
  C:\Windows\System\OYrCsLP.exe
  2⤵
  PID:9684
- C:\Windows\System\LllXzZq.exe
  C:\Windows\System\LllXzZq.exe
  2⤵
  PID:9248
- C:\Windows\System\LRrIxeW.exe
  C:\Windows\System\LRrIxeW.exe
  2⤵
  PID:9792
- C:\Windows\System\nhnWBTL.exe
  C:\Windows\System\nhnWBTL.exe
  2⤵
  PID:10264
- C:\Windows\System\xJTBufa.exe
  C:\Windows\System\xJTBufa.exe
  2⤵
  PID:10288
- C:\Windows\System\dhHyawU.exe
  C:\Windows\System\dhHyawU.exe
  2⤵
  PID:10308
- C:\Windows\System\WvrqBin.exe
  C:\Windows\System\WvrqBin.exe
  2⤵
  PID:10336
- C:\Windows\System\nUwsPzi.exe
  C:\Windows\System\nUwsPzi.exe
  2⤵
  PID:10360
- C:\Windows\System\LQvIxyo.exe
  C:\Windows\System\LQvIxyo.exe
  2⤵
  PID:10384
- C:\Windows\System\ennCLLB.exe
  C:\Windows\System\ennCLLB.exe
  2⤵
  PID:10420
- C:\Windows\System\hSgnERH.exe
  C:\Windows\System\hSgnERH.exe
  2⤵
  PID:10452
- C:\Windows\System\keqAWaS.exe
  C:\Windows\System\keqAWaS.exe
  2⤵
  PID:10488
- C:\Windows\System\sAvSICk.exe
  C:\Windows\System\sAvSICk.exe
  2⤵
  PID:10512
- C:\Windows\System\ZEfFRJO.exe
  C:\Windows\System\ZEfFRJO.exe
  2⤵
  PID:10536
- C:\Windows\System\jFmPHSz.exe
  C:\Windows\System\jFmPHSz.exe
  2⤵
  PID:10556
- C:\Windows\System\JoMEOge.exe
  C:\Windows\System\JoMEOge.exe
  2⤵
  PID:10584
- C:\Windows\System\azFrBRJ.exe
  C:\Windows\System\azFrBRJ.exe
  2⤵
  PID:10608
- C:\Windows\System\iqnyoCA.exe
  C:\Windows\System\iqnyoCA.exe
  2⤵
  PID:10744
- C:\Windows\System\KIFFdlY.exe
  C:\Windows\System\KIFFdlY.exe
  2⤵
  PID:10772
- C:\Windows\System\wiFyTBQ.exe
  C:\Windows\System\wiFyTBQ.exe
  2⤵
  PID:10792
- C:\Windows\System\AthqFXd.exe
  C:\Windows\System\AthqFXd.exe
  2⤵
  PID:10820
- C:\Windows\System\DkZyIqB.exe
  C:\Windows\System\DkZyIqB.exe
  2⤵
  PID:10848
- C:\Windows\System\CPXMgyK.exe
  C:\Windows\System\CPXMgyK.exe
  2⤵
  PID:10864
- C:\Windows\System\agMuUHJ.exe
  C:\Windows\System\agMuUHJ.exe
  2⤵
  PID:10888
- C:\Windows\System\ZKQAoaj.exe
  C:\Windows\System\ZKQAoaj.exe
  2⤵
  PID:10912
- C:\Windows\System\qvJRjIl.exe
  C:\Windows\System\qvJRjIl.exe
  2⤵
  PID:10952
- C:\Windows\System\faZtpVi.exe
  C:\Windows\System\faZtpVi.exe
  2⤵
  PID:10988
- C:\Windows\System\JEZbyIM.exe
  C:\Windows\System\JEZbyIM.exe
  2⤵
  PID:11012
- C:\Windows\System\RIdKCPo.exe
  C:\Windows\System\RIdKCPo.exe
  2⤵
  PID:11040
- C:\Windows\System\zHVtsWa.exe
  C:\Windows\System\zHVtsWa.exe
  2⤵
  PID:11080
- C:\Windows\System\PMgXSaS.exe
  C:\Windows\System\PMgXSaS.exe
  2⤵
  PID:11096
- C:\Windows\System\vWwfGUg.exe
  C:\Windows\System\vWwfGUg.exe
  2⤵
  PID:11116
- C:\Windows\System\eJakyNf.exe
  C:\Windows\System\eJakyNf.exe
  2⤵
  PID:11140
- C:\Windows\System\qfzKxbe.exe
  C:\Windows\System\qfzKxbe.exe
  2⤵
  PID:11168
- C:\Windows\System\CWXBRKA.exe
  C:\Windows\System\CWXBRKA.exe
  2⤵
  PID:11188
- C:\Windows\System\tPdrvJB.exe
  C:\Windows\System\tPdrvJB.exe
  2⤵
  PID:11220
- C:\Windows\System\RWWKjgU.exe
  C:\Windows\System\RWWKjgU.exe
  2⤵
  PID:11252
- C:\Windows\System\HFZiiCG.exe
  C:\Windows\System\HFZiiCG.exe
  2⤵
  PID:9820
- C:\Windows\System\XkGApNu.exe
  C:\Windows\System\XkGApNu.exe
  2⤵
  PID:9724
- C:\Windows\System\MZSRygN.exe
  C:\Windows\System\MZSRygN.exe
  2⤵
  PID:9908
- C:\Windows\System\XufkSJA.exe
  C:\Windows\System\XufkSJA.exe
  2⤵
  PID:9936
- C:\Windows\System\STKAAHr.exe
  C:\Windows\System\STKAAHr.exe
  2⤵
  PID:10008
- C:\Windows\System\hAplhbX.exe
  C:\Windows\System\hAplhbX.exe
  2⤵
  PID:8452
- C:\Windows\System\IQtYMsc.exe
  C:\Windows\System\IQtYMsc.exe
  2⤵
  PID:10316
- C:\Windows\System\oxGLySM.exe
  C:\Windows\System\oxGLySM.exe
  2⤵
  PID:10396
- C:\Windows\System\kWXBTDp.exe
  C:\Windows\System\kWXBTDp.exe
  2⤵
  PID:9768
- C:\Windows\System\OspMcjJ.exe
  C:\Windows\System\OspMcjJ.exe
  2⤵
  PID:9520
- C:\Windows\System\nhdbKqv.exe
  C:\Windows\System\nhdbKqv.exe
  2⤵
  PID:8736
- C:\Windows\System\jOgPVSB.exe
  C:\Windows\System\jOgPVSB.exe
  2⤵
  PID:8220
- C:\Windows\System\QajThOW.exe
  C:\Windows\System\QajThOW.exe
  2⤵
  PID:10628
- C:\Windows\System\ktVfdgy.exe
  C:\Windows\System\ktVfdgy.exe
  2⤵
  PID:9352
- C:\Windows\System\MtQoEgf.exe
  C:\Windows\System\MtQoEgf.exe
  2⤵
  PID:10064
- C:\Windows\System\KrRCVtK.exe
  C:\Windows\System\KrRCVtK.exe
  2⤵
  PID:10524
- C:\Windows\System\VKJdVlQ.exe
  C:\Windows\System\VKJdVlQ.exe
  2⤵
  PID:9284
- C:\Windows\System\ErZQHrW.exe
  C:\Windows\System\ErZQHrW.exe
  2⤵
  PID:10596
- C:\Windows\System\wbezeGo.exe
  C:\Windows\System\wbezeGo.exe
  2⤵
  PID:10332
- C:\Windows\System\WtNIHSk.exe
  C:\Windows\System\WtNIHSk.exe
  2⤵
  PID:10856
- C:\Windows\System\fKGvbcM.exe
  C:\Windows\System\fKGvbcM.exe
  2⤵
  PID:10508
- C:\Windows\System\NxeRSou.exe
  C:\Windows\System\NxeRSou.exe
  2⤵
  PID:11024
- C:\Windows\System\xDfAxUN.exe
  C:\Windows\System\xDfAxUN.exe
  2⤵
  PID:10624
- C:\Windows\System\mPfyWcy.exe
  C:\Windows\System\mPfyWcy.exe
  2⤵
  PID:11092
- C:\Windows\System\fqtPUlH.exe
  C:\Windows\System\fqtPUlH.exe
  2⤵
  PID:10812
- C:\Windows\System\ZsfUItW.exe
  C:\Windows\System\ZsfUItW.exe
  2⤵
  PID:11204
- C:\Windows\System\jUWBGAo.exe
  C:\Windows\System\jUWBGAo.exe
  2⤵
  PID:10900
- C:\Windows\System\gLDvFFc.exe
  C:\Windows\System\gLDvFFc.exe
  2⤵
  PID:9860
- C:\Windows\System\VLAYANc.exe
  C:\Windows\System\VLAYANc.exe
  2⤵
  PID:11000
- C:\Windows\System\eyMLPEl.exe
  C:\Windows\System\eyMLPEl.exe
  2⤵
  PID:11088
- C:\Windows\System\nwSvTCt.exe
  C:\Windows\System\nwSvTCt.exe
  2⤵
  PID:11132
- C:\Windows\System\iCEysdq.exe
  C:\Windows\System\iCEysdq.exe
  2⤵
  PID:10844
- C:\Windows\System\vEgZLXZ.exe
  C:\Windows\System\vEgZLXZ.exe
  2⤵
  PID:9492
- C:\Windows\System\WMFUGHH.exe
  C:\Windows\System\WMFUGHH.exe
  2⤵
  PID:9544
- C:\Windows\System\gsQYYzc.exe
  C:\Windows\System\gsQYYzc.exe
  2⤵
  PID:11284
- C:\Windows\System\hvpGgcb.exe
  C:\Windows\System\hvpGgcb.exe
  2⤵
  PID:11320
- C:\Windows\System\AQsUZKm.exe
  C:\Windows\System\AQsUZKm.exe
  2⤵
  PID:11348
- C:\Windows\System\dsaLovG.exe
  C:\Windows\System\dsaLovG.exe
  2⤵
  PID:11380
- C:\Windows\System\EOjPlOF.exe
  C:\Windows\System\EOjPlOF.exe
  2⤵
  PID:11412
- C:\Windows\System\ruoLsSB.exe
  C:\Windows\System\ruoLsSB.exe
  2⤵
  PID:11440
- C:\Windows\System\seFWtyf.exe
  C:\Windows\System\seFWtyf.exe
  2⤵
  PID:11464
- C:\Windows\System\mtmZdaT.exe
  C:\Windows\System\mtmZdaT.exe
  2⤵
  PID:11488
- C:\Windows\System\KqohzhA.exe
  C:\Windows\System\KqohzhA.exe
  2⤵
  PID:11516
- C:\Windows\System\TxAqIjg.exe
  C:\Windows\System\TxAqIjg.exe
  2⤵
  PID:11540
- C:\Windows\System\CKskpPb.exe
  C:\Windows\System\CKskpPb.exe
  2⤵
  PID:11568
- C:\Windows\System\xjhByEC.exe
  C:\Windows\System\xjhByEC.exe
  2⤵
  PID:11588
- C:\Windows\System\AtkuIld.exe
  C:\Windows\System\AtkuIld.exe
  2⤵
  PID:11612
- C:\Windows\System\MucycqG.exe
  C:\Windows\System\MucycqG.exe
  2⤵
  PID:11628
- C:\Windows\System\OScesfZ.exe
  C:\Windows\System\OScesfZ.exe
  2⤵
  PID:11656
- C:\Windows\System\sDssuWK.exe
  C:\Windows\System\sDssuWK.exe
  2⤵
  PID:11684
- C:\Windows\System\sLzQdGw.exe
  C:\Windows\System\sLzQdGw.exe
  2⤵
  PID:11708
- C:\Windows\System\cFbFNks.exe
  C:\Windows\System\cFbFNks.exe
  2⤵
  PID:11740
- C:\Windows\System\BlvvtUZ.exe
  C:\Windows\System\BlvvtUZ.exe
  2⤵
  PID:11768
- C:\Windows\System\pkeUvAq.exe
  C:\Windows\System\pkeUvAq.exe
  2⤵
  PID:11788
- C:\Windows\System\KwDGNWH.exe
  C:\Windows\System\KwDGNWH.exe
  2⤵
  PID:11816
- C:\Windows\System\fvGXRVP.exe
  C:\Windows\System\fvGXRVP.exe
  2⤵
  PID:11844
- C:\Windows\System\aaHGNtR.exe
  C:\Windows\System\aaHGNtR.exe
  2⤵
  PID:11868
- C:\Windows\System\kwlNwkq.exe
  C:\Windows\System\kwlNwkq.exe
  2⤵
  PID:11892
- C:\Windows\System\CDfjtaz.exe
  C:\Windows\System\CDfjtaz.exe
  2⤵
  PID:11920
- C:\Windows\System\UUmLMwu.exe
  C:\Windows\System\UUmLMwu.exe
  2⤵
  PID:11944
- C:\Windows\System\KSQUdBg.exe
  C:\Windows\System\KSQUdBg.exe
  2⤵
  PID:11964
- C:\Windows\System\WcOnBdy.exe
  C:\Windows\System\WcOnBdy.exe
  2⤵
  PID:12000
- C:\Windows\System\PcDsYDT.exe
  C:\Windows\System\PcDsYDT.exe
  2⤵
  PID:12020
- C:\Windows\System\leeoFGI.exe
  C:\Windows\System\leeoFGI.exe
  2⤵
  PID:12048
- C:\Windows\System\JXCmcgM.exe
  C:\Windows\System\JXCmcgM.exe
  2⤵
  PID:12072
- C:\Windows\System\JkrXpxt.exe
  C:\Windows\System\JkrXpxt.exe
  2⤵
  PID:12096
- C:\Windows\System\NecIxRX.exe
  C:\Windows\System\NecIxRX.exe
  2⤵
  PID:12120
- C:\Windows\System\XfsCYaz.exe
  C:\Windows\System\XfsCYaz.exe
  2⤵
  PID:12148
- C:\Windows\System\QvBozXF.exe
  C:\Windows\System\QvBozXF.exe
  2⤵
  PID:12168
- C:\Windows\System\wJzKmiP.exe
  C:\Windows\System\wJzKmiP.exe
  2⤵
  PID:12188
- C:\Windows\System\cIWKMlR.exe
  C:\Windows\System\cIWKMlR.exe
  2⤵
  PID:12216
- C:\Windows\System\IARLgXX.exe
  C:\Windows\System\IARLgXX.exe
  2⤵
  PID:12236
- C:\Windows\System\AdjtBBx.exe
  C:\Windows\System\AdjtBBx.exe
  2⤵
  PID:12252
- C:\Windows\System\hcFUjna.exe
  C:\Windows\System\hcFUjna.exe
  2⤵
  PID:12280
- C:\Windows\System\qapRIHB.exe
  C:\Windows\System\qapRIHB.exe
  2⤵
  PID:11236
- C:\Windows\System\gRgdlkO.exe
  C:\Windows\System\gRgdlkO.exe
  2⤵
  PID:10840
- C:\Windows\System\ZvTypiZ.exe
  C:\Windows\System\ZvTypiZ.exe
  2⤵
  PID:10116
- C:\Windows\System\YoUSoZe.exe
  C:\Windows\System\YoUSoZe.exe
  2⤵
  PID:11136
- C:\Windows\System\RaycUjL.exe
  C:\Windows\System\RaycUjL.exe
  2⤵
  PID:10380
- C:\Windows\System\lTzHZxg.exe
  C:\Windows\System\lTzHZxg.exe
  2⤵
  PID:10196
- C:\Windows\System\HDyDZGF.exe
  C:\Windows\System\HDyDZGF.exe
  2⤵
  PID:11304
- C:\Windows\System\kEwrwmy.exe
  C:\Windows\System\kEwrwmy.exe
  2⤵
  PID:10248
- C:\Windows\System\vYatxDq.exe
  C:\Windows\System\vYatxDq.exe
  2⤵
  PID:10784
- C:\Windows\System\yFuhbfB.exe
  C:\Windows\System\yFuhbfB.exe
  2⤵
  PID:11508
- C:\Windows\System\SAFLWFW.exe
  C:\Windows\System\SAFLWFW.exe
  2⤵
  PID:11556
- C:\Windows\System\bKfCwIf.exe
  C:\Windows\System\bKfCwIf.exe
  2⤵
  PID:9280
- C:\Windows\System\xMOxBOy.exe
  C:\Windows\System\xMOxBOy.exe
  2⤵
  PID:11680
- C:\Windows\System\tPGXzsE.exe
  C:\Windows\System\tPGXzsE.exe
  2⤵
  PID:11736
- C:\Windows\System\HXwEHmR.exe
  C:\Windows\System\HXwEHmR.exe
  2⤵
  PID:11008
- C:\Windows\System\SFIwCTc.exe
  C:\Windows\System\SFIwCTc.exe
  2⤵
  PID:10756
- C:\Windows\System\RQBDVSc.exe
  C:\Windows\System\RQBDVSc.exe
  2⤵
  PID:11860
- C:\Windows\System\GDcwYdh.exe
  C:\Windows\System\GDcwYdh.exe
  2⤵
  PID:11884
- C:\Windows\System\qZQagpG.exe
  C:\Windows\System\qZQagpG.exe
  2⤵
  PID:11476
- C:\Windows\System\zgkxONB.exe
  C:\Windows\System\zgkxONB.exe
  2⤵
  PID:11576
- C:\Windows\System\jzDUnfj.exe
  C:\Windows\System\jzDUnfj.exe
  2⤵
  PID:12088
- C:\Windows\System\qFPhHHP.exe
  C:\Windows\System\qFPhHHP.exe
  2⤵
  PID:12184
- C:\Windows\System\YONmEdI.exe
  C:\Windows\System\YONmEdI.exe
  2⤵
  PID:12292
- C:\Windows\System\WuBbyuh.exe
  C:\Windows\System\WuBbyuh.exe
  2⤵
  PID:12316
- C:\Windows\System\zKMWiaM.exe
  C:\Windows\System\zKMWiaM.exe
  2⤵
  PID:12332
- C:\Windows\System\wdFUpzt.exe
  C:\Windows\System\wdFUpzt.exe
  2⤵
  PID:12356
- C:\Windows\System\eVrOeip.exe
  C:\Windows\System\eVrOeip.exe
  2⤵
  PID:12384
- C:\Windows\System\LYLNSuL.exe
  C:\Windows\System\LYLNSuL.exe
  2⤵
  PID:12404
- C:\Windows\System\MKWjOUU.exe
  C:\Windows\System\MKWjOUU.exe
  2⤵
  PID:12436
- C:\Windows\System\XipLBlO.exe
  C:\Windows\System\XipLBlO.exe
  2⤵
  PID:12460
- C:\Windows\System\pSaZoXe.exe
  C:\Windows\System\pSaZoXe.exe
  2⤵
  PID:12476
- C:\Windows\System\KADsRDS.exe
  C:\Windows\System\KADsRDS.exe
  2⤵
  PID:12504
- C:\Windows\System\ktUsBee.exe
  C:\Windows\System\ktUsBee.exe
  2⤵
  PID:12532
- C:\Windows\System\gIFepia.exe
  C:\Windows\System\gIFepia.exe
  2⤵
  PID:12560
- C:\Windows\System\eRWrFXe.exe
  C:\Windows\System\eRWrFXe.exe
  2⤵
  PID:12584
- C:\Windows\System\pDlPjLA.exe
  C:\Windows\System\pDlPjLA.exe
  2⤵
  PID:12608
- C:\Windows\System\YABazWu.exe
  C:\Windows\System\YABazWu.exe
  2⤵
  PID:12632
- C:\Windows\System\aRuZIhJ.exe
  C:\Windows\System\aRuZIhJ.exe
  2⤵
  PID:12660
- C:\Windows\System\XBdklEr.exe
  C:\Windows\System\XBdklEr.exe
  2⤵
  PID:12676
- C:\Windows\System\uOmPqru.exe
  C:\Windows\System\uOmPqru.exe
  2⤵
  PID:12700
- C:\Windows\System\BAJFqBw.exe
  C:\Windows\System\BAJFqBw.exe
  2⤵
  PID:12720
- C:\Windows\System\OTPeEXt.exe
  C:\Windows\System\OTPeEXt.exe
  2⤵
  PID:12740
- C:\Windows\System\cmDaFCp.exe
  C:\Windows\System\cmDaFCp.exe
  2⤵
  PID:12780
- C:\Windows\System\iwCyVXo.exe
  C:\Windows\System\iwCyVXo.exe
  2⤵
  PID:12808
- C:\Windows\System\fdDaeNN.exe
  C:\Windows\System\fdDaeNN.exe
  2⤵
  PID:12832
- C:\Windows\System\rBXjMyX.exe
  C:\Windows\System\rBXjMyX.exe
  2⤵
  PID:12860
- C:\Windows\System\WrsqCzy.exe
  C:\Windows\System\WrsqCzy.exe
  2⤵
  PID:12884
- C:\Windows\System\oBwrTeN.exe
  C:\Windows\System\oBwrTeN.exe
  2⤵
  PID:12908
- C:\Windows\System\DHOGUrz.exe
  C:\Windows\System\DHOGUrz.exe
  2⤵
  PID:12924
- C:\Windows\System\iPoDRko.exe
  C:\Windows\System\iPoDRko.exe
  2⤵
  PID:12948
- C:\Windows\System\imLKTVS.exe
  C:\Windows\System\imLKTVS.exe
  2⤵
  PID:12964
- C:\Windows\System\sjvUOYY.exe
  C:\Windows\System\sjvUOYY.exe
  2⤵
  PID:12980
- C:\Windows\System\lUaWcXk.exe
  C:\Windows\System\lUaWcXk.exe
  2⤵
  PID:13000
- C:\Windows\System\IHpkoUu.exe
  C:\Windows\System\IHpkoUu.exe
  2⤵
  PID:13016
- C:\Windows\System\ooeMxls.exe
  C:\Windows\System\ooeMxls.exe
  2⤵
  PID:13036
- C:\Windows\System\TnKmkbn.exe
  C:\Windows\System\TnKmkbn.exe
  2⤵
  PID:13056
- C:\Windows\System\uIuOVxN.exe
  C:\Windows\System\uIuOVxN.exe
  2⤵
  PID:13084
- C:\Windows\System\LbqwUUJ.exe
  C:\Windows\System\LbqwUUJ.exe
  2⤵
  PID:13100
- C:\Windows\System\aIodRoC.exe
  C:\Windows\System\aIodRoC.exe
  2⤵
  PID:13116
- C:\Windows\System\tfPVHwJ.exe
  C:\Windows\System\tfPVHwJ.exe
  2⤵
  PID:13132
- C:\Windows\System\fDdALMi.exe
  C:\Windows\System\fDdALMi.exe
  2⤵
  PID:13148
- C:\Windows\System\txDujwD.exe
  C:\Windows\System\txDujwD.exe
  2⤵
  PID:13168
- C:\Windows\System\eJSbSsS.exe
  C:\Windows\System\eJSbSsS.exe
  2⤵
  PID:12576
- C:\Windows\System\QLzFkeX.exe
  C:\Windows\System\QLzFkeX.exe
  2⤵
  PID:11208
- C:\Windows\System\AfBCmQY.exe
  C:\Windows\System\AfBCmQY.exe
  2⤵
  PID:9548
- C:\Windows\System\BjqaPQt.exe
  C:\Windows\System\BjqaPQt.exe
  2⤵
  PID:12308
- C:\Windows\System\XAExgsv.exe
  C:\Windows\System\XAExgsv.exe
  2⤵
  PID:12804
- C:\Windows\System\FJdXLqP.exe
  C:\Windows\System\FJdXLqP.exe
  2⤵
  PID:12996
- C:\Windows\System\PuRFCnb.exe
  C:\Windows\System\PuRFCnb.exe
  2⤵
  PID:12312
- C:\Windows\System\fJhvQrA.exe
  C:\Windows\System\fJhvQrA.exe
  2⤵
  PID:12380
- C:\Windows\System\TFDvGjI.exe
  C:\Windows\System\TFDvGjI.exe
  2⤵
  PID:12520
- C:\Windows\System\xNsXLON.exe
  C:\Windows\System\xNsXLON.exe
  2⤵
  PID:12628
- C:\Windows\System\xxSxYMk.exe
  C:\Windows\System\xxSxYMk.exe
  2⤵
  PID:12672
- C:\Windows\System\XaVbBJB.exe
  C:\Windows\System\XaVbBJB.exe
  2⤵
  PID:12732
- C:\Windows\System\JxKwfHK.exe
  C:\Windows\System\JxKwfHK.exe
  2⤵
  PID:13048
- C:\Windows\System\rNelWXi.exe
  C:\Windows\System\rNelWXi.exe
  2⤵
  PID:12736
- C:\Windows\System\ekqfnWm.exe
  C:\Windows\System\ekqfnWm.exe
  2⤵
  PID:12828
- C:\Windows\System\uVAGIXa.exe
  C:\Windows\System\uVAGIXa.exe
  2⤵
  PID:12944
- C:\Windows\System\UJfnTOR.exe
  C:\Windows\System\UJfnTOR.exe
  2⤵
  PID:13096
- C:\Windows\System\qBPNPWg.exe
  C:\Windows\System\qBPNPWg.exe
  2⤵
  PID:13144
- C:\Windows\System\pbPPAPY.exe
  C:\Windows\System\pbPPAPY.exe
  2⤵
  PID:13236
- C:\Windows\System\AWnGqms.exe
  C:\Windows\System\AWnGqms.exe
  2⤵
  PID:13296
- C:\Windows\System\UKlgpsL.exe
  C:\Windows\System\UKlgpsL.exe
  2⤵
  PID:8236
- C:\Windows\System\CUTxRWX.exe
  C:\Windows\System\CUTxRWX.exe
  2⤵
  PID:10032
- C:\Windows\System\HdUGaer.exe
  C:\Windows\System\HdUGaer.exe
  2⤵
  PID:12368
- C:\Windows\System\nJezFlZ.exe
  C:\Windows\System\nJezFlZ.exe
  2⤵
  PID:13340
- C:\Windows\System\yJRFmuA.exe
  C:\Windows\System\yJRFmuA.exe
  2⤵
  PID:13376
- C:\Windows\System\inuybLL.exe
  C:\Windows\System\inuybLL.exe
  2⤵
  PID:13416
- C:\Windows\System\MBkHLct.exe
  C:\Windows\System\MBkHLct.exe
  2⤵
  PID:13436
- C:\Windows\System\WYuXQwW.exe
  C:\Windows\System\WYuXQwW.exe
  2⤵
  PID:13560
- C:\Windows\System\MdLmRow.exe
  C:\Windows\System\MdLmRow.exe
  2⤵
  PID:13576
- C:\Windows\System\jJvqLst.exe
  C:\Windows\System\jJvqLst.exe
  2⤵
  PID:13592
- C:\Windows\System\zpFbeoO.exe
  C:\Windows\System\zpFbeoO.exe
  2⤵
  PID:13608
- C:\Windows\System\ufxNqYJ.exe
  C:\Windows\System\ufxNqYJ.exe
  2⤵
  PID:13624
- C:\Windows\System\oDuLfTN.exe
  C:\Windows\System\oDuLfTN.exe
  2⤵
  PID:13644
- C:\Windows\System\hgpfrCM.exe
  C:\Windows\System\hgpfrCM.exe
  2⤵
  PID:13664
- C:\Windows\System\VtbGjWi.exe
  C:\Windows\System\VtbGjWi.exe
  2⤵
  PID:13688
- C:\Windows\System\tKHysac.exe
  C:\Windows\System\tKHysac.exe
  2⤵
  PID:13708
- C:\Windows\System\qYqrHwo.exe
  C:\Windows\System\qYqrHwo.exe
  2⤵
  PID:13736
- C:\Windows\System\YUUkUKs.exe
  C:\Windows\System\YUUkUKs.exe
  2⤵
  PID:13780
- C:\Windows\System\QurEwJN.exe
  C:\Windows\System\QurEwJN.exe
  2⤵
  PID:13804
- C:\Windows\System\zqoGfAt.exe
  C:\Windows\System\zqoGfAt.exe
  2⤵
  PID:13820
- C:\Windows\System\CzJqNQD.exe
  C:\Windows\System\CzJqNQD.exe
  2⤵
  PID:13836
- C:\Windows\System\YBJIceI.exe
  C:\Windows\System\YBJIceI.exe
  2⤵
  PID:13852
- C:\Windows\System\HvOBzHa.exe
  C:\Windows\System\HvOBzHa.exe
  2⤵
  PID:13880
- C:\Windows\System\gxQMiEJ.exe
  C:\Windows\System\gxQMiEJ.exe
  2⤵
  PID:13900
- C:\Windows\System\fYwlEVv.exe
  C:\Windows\System\fYwlEVv.exe
  2⤵
  PID:13916
- C:\Windows\System\lZNHzuf.exe
  C:\Windows\System\lZNHzuf.exe
  2⤵
  PID:13932
- C:\Windows\System\QdHyJWP.exe
  C:\Windows\System\QdHyJWP.exe
  2⤵
  PID:13964
- C:\Windows\System\OLKGbXQ.exe
  C:\Windows\System\OLKGbXQ.exe
  2⤵
  PID:13988
- C:\Windows\System\tuQAcuk.exe
  C:\Windows\System\tuQAcuk.exe
  2⤵
  PID:14012
- C:\Windows\System\MdLDlvX.exe
  C:\Windows\System\MdLDlvX.exe
  2⤵
  PID:14036
- C:\Windows\System\ikjETEA.exe
  C:\Windows\System\ikjETEA.exe
  2⤵
  PID:14068
- C:\Windows\System\IGHzHOV.exe
  C:\Windows\System\IGHzHOV.exe
  2⤵
  PID:14104
- C:\Windows\System\dMnVMGq.exe
  C:\Windows\System\dMnVMGq.exe
  2⤵
  PID:14128
- C:\Windows\System\IcgTfWU.exe
  C:\Windows\System\IcgTfWU.exe
  2⤵
  PID:14148
- C:\Windows\System\vEWEaMA.exe
  C:\Windows\System\vEWEaMA.exe
  2⤵
  PID:14176
- C:\Windows\System\JSQrXOd.exe
  C:\Windows\System\JSQrXOd.exe
  2⤵
  PID:14200
- C:\Windows\System\eNphnHQ.exe
  C:\Windows\System\eNphnHQ.exe
  2⤵
  PID:14236
- C:\Windows\System\JtxhsGc.exe
  C:\Windows\System\JtxhsGc.exe
  2⤵
  PID:14268
- C:\Windows\System\EICegCw.exe
  C:\Windows\System\EICegCw.exe
  2⤵
  PID:14288
- C:\Windows\System\grBzyLy.exe
  C:\Windows\System\grBzyLy.exe
  2⤵
  PID:14308
- C:\Windows\System\MUwjFPa.exe
  C:\Windows\System\MUwjFPa.exe
  2⤵
  PID:14332
- C:\Windows\System\ZbDngGf.exe
  C:\Windows\System\ZbDngGf.exe
  2⤵
  PID:12648
- C:\Windows\System\nKFKood.exe
  C:\Windows\System\nKFKood.exe
  2⤵
  PID:11852
- C:\Windows\System\JThkeZI.exe
  C:\Windows\System\JThkeZI.exe
  2⤵
  PID:13364
- C:\Windows\System\SXsoEiY.exe
  C:\Windows\System\SXsoEiY.exe
  2⤵
  PID:12444
- C:\Windows\System\AadSfmX.exe
  C:\Windows\System\AadSfmX.exe
  2⤵
  PID:12844
- C:\Windows\System\oHvRpgo.exe
  C:\Windows\System\oHvRpgo.exe
  2⤵
  PID:11296
- C:\Windows\System\akAJjlk.exe
  C:\Windows\System\akAJjlk.exe
  2⤵
  PID:12652
- C:\Windows\System\ZJmJNUk.exe
  C:\Windows\System\ZJmJNUk.exe
  2⤵
  PID:13068
- C:\Windows\System\ZHdTqTe.exe
  C:\Windows\System\ZHdTqTe.exe
  2⤵
  PID:13080
- C:\Windows\System\eTSaqlm.exe
  C:\Windows\System\eTSaqlm.exe
  2⤵
  PID:11676
- C:\Windows\System\ONClcWU.exe
  C:\Windows\System\ONClcWU.exe
  2⤵
  PID:10392
- C:\Windows\System\dGvRLvM.exe
  C:\Windows\System\dGvRLvM.exe
  2⤵
  PID:12796
- C:\Windows\System\tmKkUsX.exe
  C:\Windows\System\tmKkUsX.exe
  2⤵
  PID:13324
- C:\Windows\System\ANwAgAw.exe
  C:\Windows\System\ANwAgAw.exe
  2⤵
  PID:13524
- C:\Windows\System\byZNehd.exe
  C:\Windows\System\byZNehd.exe
  2⤵
  PID:13796
- C:\Windows\System\AmTybQC.exe
  C:\Windows\System\AmTybQC.exe
  2⤵
  PID:13636
- C:\Windows\System\ghdjIpF.exe
  C:\Windows\System\ghdjIpF.exe
  2⤵
  PID:13660
- C:\Windows\System\PfHSLUF.exe
  C:\Windows\System\PfHSLUF.exe
  2⤵
  PID:13484
- C:\Windows\System\yAdwVRm.exe
  C:\Windows\System\yAdwVRm.exe
  2⤵
  PID:13556
- C:\Windows\System\kwcVayZ.exe
  C:\Windows\System\kwcVayZ.exe
  2⤵
  PID:14208
- C:\Windows\System\rVffJMY.exe
  C:\Windows\System\rVffJMY.exe
  2⤵
  PID:14260
- C:\Windows\System\zyYizUu.exe
  C:\Windows\System\zyYizUu.exe
  2⤵
  PID:12160
- C:\Windows\System\ugmVpJr.exe
  C:\Windows\System\ugmVpJr.exe
  2⤵
  PID:14020
- C:\Windows\System\GmYHMgT.exe
  C:\Windows\System\GmYHMgT.exe
  2⤵
  PID:14044
- C:\Windows\System\fOuwMKl.exe
  C:\Windows\System\fOuwMKl.exe
  2⤵
  PID:12544
- C:\Windows\System\DrnxjKz.exe
  C:\Windows\System\DrnxjKz.exe
  2⤵
  PID:14084
- C:\Windows\System\LbHfomZ.exe
  C:\Windows\System\LbHfomZ.exe
  2⤵
  PID:14360
- C:\Windows\System\TdTMwHV.exe
  C:\Windows\System\TdTMwHV.exe
  2⤵
  PID:14384
- C:\Windows\System\vfHaXhn.exe
  C:\Windows\System\vfHaXhn.exe
  2⤵
  PID:14408
- C:\Windows\System\UNmbcyH.exe
  C:\Windows\System\UNmbcyH.exe
  2⤵
  PID:14436
- C:\Windows\System\ZtcONqr.exe
  C:\Windows\System\ZtcONqr.exe
  2⤵
  PID:14456
- C:\Windows\System\qRchGUN.exe
  C:\Windows\System\qRchGUN.exe
  2⤵
  PID:14480
- C:\Windows\System\RXDNktA.exe
  C:\Windows\System\RXDNktA.exe
  2⤵
  PID:14496
- C:\Windows\System\rvZUklr.exe
  C:\Windows\System\rvZUklr.exe
  2⤵
  PID:14520
- C:\Windows\System\PiIqbjh.exe
  C:\Windows\System\PiIqbjh.exe
  2⤵
  PID:14540
- C:\Windows\System\FSmDbna.exe
  C:\Windows\System\FSmDbna.exe
  2⤵
  PID:14560
- C:\Windows\System\BqAjbbC.exe
  C:\Windows\System\BqAjbbC.exe
  2⤵
  PID:14588
- C:\Windows\System\sLJDqaj.exe
  C:\Windows\System\sLJDqaj.exe
  2⤵
  PID:14612
- C:\Windows\System\jLBPhpI.exe
  C:\Windows\System\jLBPhpI.exe
  2⤵
  PID:14628
- C:\Windows\System\ijLLDCA.exe
  C:\Windows\System\ijLLDCA.exe
  2⤵
  PID:14652
- C:\Windows\System\ZDiThAR.exe
  C:\Windows\System\ZDiThAR.exe
  2⤵
  PID:14680
- C:\Windows\System\YYShgKc.exe
  C:\Windows\System\YYShgKc.exe
  2⤵
  PID:14712
- C:\Windows\System\hMgSfuR.exe
  C:\Windows\System\hMgSfuR.exe
  2⤵
  PID:14736
- C:\Windows\System\bCVeSYr.exe
  C:\Windows\System\bCVeSYr.exe
  2⤵
  PID:14760
- C:\Windows\System\iXxxADp.exe
  C:\Windows\System\iXxxADp.exe
  2⤵
  PID:14780
- C:\Windows\System\UXabthc.exe
  C:\Windows\System\UXabthc.exe
  2⤵
  PID:14812
- C:\Windows\System\DPOLdDl.exe
  C:\Windows\System\DPOLdDl.exe
  2⤵
  PID:14840
- C:\Windows\System\qQXVAGY.exe
  C:\Windows\System\qQXVAGY.exe
  2⤵
  PID:14872
- C:\Windows\System\BlzaZpv.exe
  C:\Windows\System\BlzaZpv.exe
  2⤵
  PID:14888
- C:\Windows\System\ZMJPexo.exe
  C:\Windows\System\ZMJPexo.exe
  2⤵
  PID:14904
- C:\Windows\System\WTRsqDD.exe
  C:\Windows\System\WTRsqDD.exe
  2⤵
  PID:14940
- C:\Windows\System\ZfjpRrD.exe
  C:\Windows\System\ZfjpRrD.exe
  2⤵
  PID:14956
- C:\Windows\System\FggLBBI.exe
  C:\Windows\System\FggLBBI.exe
  2⤵
  PID:14980
- C:\Windows\System\EGUNCFC.exe
  C:\Windows\System\EGUNCFC.exe
  2⤵
  PID:15004
- C:\Windows\System\KFYMcqm.exe
  C:\Windows\System\KFYMcqm.exe
  2⤵
  PID:15036
- C:\Windows\System\lXQkShq.exe
  C:\Windows\System\lXQkShq.exe
  2⤵
  PID:15052
- C:\Windows\System\jrUxkBZ.exe
  C:\Windows\System\jrUxkBZ.exe
  2⤵
  PID:15084
- C:\Windows\System\ucDjyTA.exe
  C:\Windows\System\ucDjyTA.exe
  2⤵
  PID:15100
- C:\Windows\System\nrttBTR.exe
  C:\Windows\System\nrttBTR.exe
  2⤵
  PID:15128
- C:\Windows\System\FNLppAq.exe
  C:\Windows\System\FNLppAq.exe
  2⤵
  PID:15152
- C:\Windows\System\TQxdPzw.exe
  C:\Windows\System\TQxdPzw.exe
  2⤵
  PID:15168
- C:\Windows\System\MhKBwaB.exe
  C:\Windows\System\MhKBwaB.exe
  2⤵
  PID:15192
- C:\Windows\System\JburqUa.exe
  C:\Windows\System\JburqUa.exe
  2⤵
  PID:15208
- C:\Windows\System\SEOhzrx.exe
  C:\Windows\System\SEOhzrx.exe
  2⤵
  PID:14224
- C:\Windows\System\KZikSfK.exe
  C:\Windows\System\KZikSfK.exe
  2⤵
  PID:14256
- C:\Windows\System\PpCWnmH.exe
  C:\Windows\System\PpCWnmH.exe
  2⤵
  PID:14296
- C:\Windows\System\niBMhlb.exe
  C:\Windows\System\niBMhlb.exe
  2⤵
  PID:13764
- C:\Windows\System\IPUwZII.exe
  C:\Windows\System\IPUwZII.exe
  2⤵
  PID:14220
- C:\Windows\System\PVlYADa.exe
  C:\Windows\System\PVlYADa.exe
  2⤵
  PID:14028
- C:\Windows\System\lcQnzbO.exe
  C:\Windows\System\lcQnzbO.exe
  2⤵
  PID:14076
- C:\Windows\System\XajYptT.exe
  C:\Windows\System\XajYptT.exe
  2⤵
  PID:14356
- C:\Windows\System\HKNVcZB.exe
  C:\Windows\System\HKNVcZB.exe
  2⤵
  PID:14396
- C:\Windows\System\jLZytfF.exe
  C:\Windows\System\jLZytfF.exe
  2⤵
  PID:14448
- C:\Windows\System\cWvQNYQ.exe
  C:\Windows\System\cWvQNYQ.exe
  2⤵
  PID:14488
- C:\Windows\System\vuaXUkV.exe
  C:\Windows\System\vuaXUkV.exe
  2⤵
  PID:11196
- C:\Windows\System\hPKPkfY.exe
  C:\Windows\System\hPKPkfY.exe
  2⤵
  PID:13616
- C:\Windows\System\tulOwTM.exe
  C:\Windows\System\tulOwTM.exe
  2⤵
  PID:8328
- C:\Windows\System\GSmCbgJ.exe
  C:\Windows\System\GSmCbgJ.exe
  2⤵
  PID:14896
- C:\Windows\System\YFdMQTo.exe
  C:\Windows\System\YFdMQTo.exe
  2⤵
  PID:14928
- C:\Windows\System\sfKYstt.exe
  C:\Windows\System\sfKYstt.exe
  2⤵
  PID:13632
- C:\Windows\System\onOPjQq.exe
  C:\Windows\System\onOPjQq.exe
  2⤵
  PID:14516
- C:\Windows\System\YztKKwn.exe
  C:\Windows\System\YztKKwn.exe
  2⤵
  PID:13828
- C:\Windows\System\jxhxqAf.exe
  C:\Windows\System\jxhxqAf.exe
  2⤵
  PID:14788
- C:\Windows\System\yVlNaKT.exe
  C:\Windows\System\yVlNaKT.exe
  2⤵
  PID:14972
- C:\Windows\System\TkAhWva.exe
  C:\Windows\System\TkAhWva.exe
  2⤵
  PID:15096
- C:\Windows\System\woUYnFZ.exe
  C:\Windows\System\woUYnFZ.exe
  2⤵
  PID:13228
- C:\Windows\System\ozDQnlp.exe
  C:\Windows\System\ozDQnlp.exe
  2⤵
  PID:14284
- C:\Windows\System\cjMzuaK.exe
  C:\Windows\System\cjMzuaK.exe
  2⤵
  PID:14556
- C:\Windows\System\jVnFHSp.exe
  C:\Windows\System\jVnFHSp.exe
  2⤵
  PID:14596
- C:\Windows\System\nQjcygC.exe
  C:\Windows\System\nQjcygC.exe
  2⤵
  PID:14648
- C:\Windows\System\BjYGXPu.exe
  C:\Windows\System\BjYGXPu.exe
  2⤵
  PID:14676
- C:\Windows\System\JIZZmYf.exe
  C:\Windows\System\JIZZmYf.exe
  2⤵
  PID:14720
- C:\Windows\System\LXqrVVD.exe
  C:\Windows\System\LXqrVVD.exe
  2⤵
  PID:14756
- C:\Windows\System\pQLBekC.exe
  C:\Windows\System\pQLBekC.exe
  2⤵
  PID:14512
- C:\Windows\System\TjDuUqO.exe
  C:\Windows\System\TjDuUqO.exe
  2⤵
  PID:15388
- C:\Windows\System\IoymlZG.exe
  C:\Windows\System\IoymlZG.exe
  2⤵
  PID:15432
- C:\Windows\System\OEJPxKf.exe
  C:\Windows\System\OEJPxKf.exe
  2⤵
  PID:15448
- C:\Windows\System\niLOowz.exe
  C:\Windows\System\niLOowz.exe
  2⤵
  PID:15476
- C:\Windows\System\ejKKoRi.exe
  C:\Windows\System\ejKKoRi.exe
  2⤵
  PID:15496
- C:\Windows\System\sXcqqbQ.exe
  C:\Windows\System\sXcqqbQ.exe
  2⤵
  PID:15524
- C:\Windows\System\YZIvSNK.exe
  C:\Windows\System\YZIvSNK.exe
  2⤵
  PID:15544
- C:\Windows\System\Nnyqwlh.exe
  C:\Windows\System\Nnyqwlh.exe
  2⤵
  PID:15568
- C:\Windows\System\kURUcds.exe
  C:\Windows\System\kURUcds.exe
  2⤵
  PID:15592
- C:\Windows\System\eddAFys.exe
  C:\Windows\System\eddAFys.exe
  2⤵
  PID:15624
- C:\Windows\System\MgHliSe.exe
  C:\Windows\System\MgHliSe.exe
  2⤵
  PID:15656
- C:\Windows\System\FJKwpcV.exe
  C:\Windows\System\FJKwpcV.exe
  2⤵
  PID:15676
- C:\Windows\System\NoQEvUr.exe
  C:\Windows\System\NoQEvUr.exe
  2⤵
  PID:15708
- C:\Windows\System\qGfIPoo.exe
  C:\Windows\System\qGfIPoo.exe
  2⤵
  PID:15732
- C:\Windows\System\xdajLVm.exe
  C:\Windows\System\xdajLVm.exe
  2⤵
  PID:15748
- C:\Windows\System\nhJAyHT.exe
  C:\Windows\System\nhJAyHT.exe
  2⤵
  PID:15772
- C:\Windows\System\OAGybbr.exe
  C:\Windows\System\OAGybbr.exe
  2⤵
  PID:15788
- C:\Windows\System\tZimbZl.exe
  C:\Windows\System\tZimbZl.exe
  2⤵
  PID:15812
- C:\Windows\System\cpIDgLp.exe
  C:\Windows\System\cpIDgLp.exe
  2⤵
  PID:15844
- C:\Windows\System\CrsVChD.exe
  C:\Windows\System\CrsVChD.exe
  2⤵
  PID:15864
- C:\Windows\System\tpPoZrK.exe
  C:\Windows\System\tpPoZrK.exe
  2⤵
  PID:15884
- C:\Windows\System\INxMbpA.exe
  C:\Windows\System\INxMbpA.exe
  2⤵
  PID:15920
- C:\Windows\System\KEhLrFs.exe
  C:\Windows\System\KEhLrFs.exe
  2⤵
  PID:15936
- C:\Windows\System\zfccZKK.exe
  C:\Windows\System\zfccZKK.exe
  2⤵
  PID:15960
- C:\Windows\System\ZfBpDbF.exe
  C:\Windows\System\ZfBpDbF.exe
  2⤵
  PID:15984
- C:\Windows\System\etuMTqt.exe
  C:\Windows\System\etuMTqt.exe
  2⤵
  PID:16020
- C:\Windows\System\DzfKqSX.exe
  C:\Windows\System\DzfKqSX.exe
  2⤵
  PID:16048
- C:\Windows\System\wEhTzki.exe
  C:\Windows\System\wEhTzki.exe
  2⤵
  PID:16064
- C:\Windows\System\pihJwky.exe
  C:\Windows\System\pihJwky.exe
  2⤵
  PID:16108
- C:\Windows\System\DqRbjoI.exe
  C:\Windows\System\DqRbjoI.exe
  2⤵
  PID:16128
- C:\Windows\System\iijCMCY.exe
  C:\Windows\System\iijCMCY.exe
  2⤵
  PID:16148
- C:\Windows\System\CRtPPRP.exe
  C:\Windows\System\CRtPPRP.exe
  2⤵
  PID:16184
- C:\Windows\System\ZmcYUHF.exe
  C:\Windows\System\ZmcYUHF.exe
  2⤵
  PID:16212
- C:\Windows\System\NTQYbFs.exe
  C:\Windows\System\NTQYbFs.exe
  2⤵
  PID:16236
- C:\Windows\System\lowLfYT.exe
  C:\Windows\System\lowLfYT.exe
  2⤵
  PID:16264
- C:\Windows\System\zvwJYOR.exe
  C:\Windows\System\zvwJYOR.exe
  2⤵
  PID:16292
- C:\Windows\System\HIJrgly.exe
  C:\Windows\System\HIJrgly.exe
  2⤵
  PID:16316
- C:\Windows\System\JdpeLRw.exe
  C:\Windows\System\JdpeLRw.exe
  2⤵
  PID:16332
- C:\Windows\System\vXGbYyo.exe
  C:\Windows\System\vXGbYyo.exe
  2⤵
  PID:16352
- C:\Windows\System\RCZEBzJ.exe
  C:\Windows\System\RCZEBzJ.exe
  2⤵
  PID:16376
- C:\Windows\System\pPYUFFg.exe
  C:\Windows\System\pPYUFFg.exe
  2⤵
  PID:14828
- C:\Windows\System\ZGKaFMY.exe
  C:\Windows\System\ZGKaFMY.exe
  2⤵
  PID:14992
- C:\Windows\System\TNwQcCJ.exe
  C:\Windows\System\TNwQcCJ.exe
  2⤵
  PID:14348
- C:\Windows\System\iSaTxZK.exe
  C:\Windows\System\iSaTxZK.exe
  2⤵
  PID:15072
- C:\Windows\System\XpVXUZM.exe
  C:\Windows\System\XpVXUZM.exe
  2⤵
  PID:15120
- C:\Windows\System\zzsiFPe.exe
  C:\Windows\System\zzsiFPe.exe
  2⤵
  PID:15180
- C:\Windows\System\eusgJsI.exe
  C:\Windows\System\eusgJsI.exe
  2⤵
  PID:15240
- C:\Windows\System\eMXGDDn.exe
  C:\Windows\System\eMXGDDn.exe
  2⤵
  PID:14536
- C:\Windows\System\lUzYFWy.exe
  C:\Windows\System\lUzYFWy.exe
  2⤵
  PID:14668
- C:\Windows\System\LfWTIJE.exe
  C:\Windows\System\LfWTIJE.exe
  2⤵
  PID:11212
- C:\Windows\System\eDnKZmE.exe
  C:\Windows\System\eDnKZmE.exe
  2⤵
  PID:15368
- C:\Windows\System\VmxOuJg.exe
  C:\Windows\System\VmxOuJg.exe
  2⤵
  PID:15400
- C:\Windows\System\PYBwDxQ.exe
  C:\Windows\System\PYBwDxQ.exe
  2⤵
  PID:15316
- C:\Windows\System\xMdMdle.exe
  C:\Windows\System\xMdMdle.exe
  2⤵
  PID:15532
- C:\Windows\System\EvWEBLM.exe
  C:\Windows\System\EvWEBLM.exe
  2⤵
  PID:15584
- C:\Windows\System\KbsUall.exe
  C:\Windows\System\KbsUall.exe
  2⤵
  PID:15160
- C:\Windows\System\vZVYPnq.exe
  C:\Windows\System\vZVYPnq.exe
  2⤵
  PID:14196
- C:\Windows\System\maszCVZ.exe
  C:\Windows\System\maszCVZ.exe
  2⤵
  PID:13924
- C:\Windows\System\EGXNTOx.exe
  C:\Windows\System\EGXNTOx.exe
  2⤵
  PID:16392
- C:\Windows\System\QGLkHjo.exe
  C:\Windows\System\QGLkHjo.exe
  2⤵
  PID:16428
- C:\Windows\System\pcUzecU.exe
  C:\Windows\System\pcUzecU.exe
  2⤵
  PID:16448
- C:\Windows\System\ObGYAFC.exe
  C:\Windows\System\ObGYAFC.exe
  2⤵
  PID:16480
- C:\Windows\System\EbKgBye.exe
  C:\Windows\System\EbKgBye.exe
  2⤵
  PID:16496
- C:\Windows\System\tswKUhq.exe
  C:\Windows\System\tswKUhq.exe
  2⤵
  PID:16528
- C:\Windows\System\KAYzVMZ.exe
  C:\Windows\System\KAYzVMZ.exe
  2⤵
  PID:16552
- C:\Windows\System\DHFnGge.exe
  C:\Windows\System\DHFnGge.exe
  2⤵
  PID:16580
- C:\Windows\System\MGvUHjh.exe
  C:\Windows\System\MGvUHjh.exe
  2⤵
  PID:16608
- C:\Windows\System\EQmYuYS.exe
  C:\Windows\System\EQmYuYS.exe
  2⤵
  PID:16640
- C:\Windows\System\jNfkpCE.exe
  C:\Windows\System\jNfkpCE.exe
  2⤵
  PID:16668
- C:\Windows\System\ypuoOKX.exe
  C:\Windows\System\ypuoOKX.exe
  2⤵
  PID:16688
- C:\Windows\System\MrSIONO.exe
  C:\Windows\System\MrSIONO.exe
  2⤵
  PID:16716
- C:\Windows\System\IhWxmAA.exe
  C:\Windows\System\IhWxmAA.exe
  2⤵
  PID:16740
- C:\Windows\System\OlLGpej.exe
  C:\Windows\System\OlLGpej.exe
  2⤵
  PID:16760
- C:\Windows\System\OTkdlsA.exe
  C:\Windows\System\OTkdlsA.exe
  2⤵
  PID:16788
- C:\Windows\System\xSryrsV.exe
  C:\Windows\System\xSryrsV.exe
  2⤵
  PID:16804
- C:\Windows\System\pnHnZEe.exe
  C:\Windows\System\pnHnZEe.exe
  2⤵
  PID:16832
- C:\Windows\System\oSvZzBq.exe
  C:\Windows\System\oSvZzBq.exe
  2⤵
  PID:16856
- C:\Windows\System\gxdFADb.exe
  C:\Windows\System\gxdFADb.exe
  2⤵
  PID:16888
- C:\Windows\System\oPgpnhO.exe
  C:\Windows\System\oPgpnhO.exe
  2⤵
  PID:16916
- C:\Windows\System\MEvcwsY.exe
  C:\Windows\System\MEvcwsY.exe
  2⤵
  PID:16936
- C:\Windows\System\pdOKvhE.exe
  C:\Windows\System\pdOKvhE.exe
  2⤵
  PID:16964
- C:\Windows\System\RVGLYZB.exe
  C:\Windows\System\RVGLYZB.exe
  2⤵
  PID:16988
- C:\Windows\System\JkMcuUL.exe
  C:\Windows\System\JkMcuUL.exe
  2⤵
  PID:17004
- C:\Windows\System\bGUrDPO.exe
  C:\Windows\System\bGUrDPO.exe
  2⤵
  PID:17020
- C:\Windows\System\JBfTUzi.exe
  C:\Windows\System\JBfTUzi.exe
  2⤵
  PID:17036
- C:\Windows\System\RoDHZup.exe
  C:\Windows\System\RoDHZup.exe
  2⤵
  PID:17056
- C:\Windows\System\LPIALOz.exe
  C:\Windows\System\LPIALOz.exe
  2⤵
  PID:17308
- C:\Windows\System\ZFTFxOy.exe
  C:\Windows\System\ZFTFxOy.exe
  2⤵
  PID:17324
- C:\Windows\System\nUvofyE.exe
  C:\Windows\System\nUvofyE.exe
  2⤵
  PID:17340
- C:\Windows\System\SfakGwG.exe
  C:\Windows\System\SfakGwG.exe
  2⤵
  PID:17372
- C:\Windows\System\KhxWzwv.exe
  C:\Windows\System\KhxWzwv.exe
  2⤵
  PID:17388
- C:\Windows\System\fTdvECM.exe
  C:\Windows\System\fTdvECM.exe
  2⤵
  PID:17404
- C:\Windows\System\QORQPUN.exe
  C:\Windows\System\QORQPUN.exe
  2⤵
  PID:15916
- C:\Windows\System\HEdcBRQ.exe
  C:\Windows\System\HEdcBRQ.exe
  2⤵
  PID:15932
- C:\Windows\System\FnpEbOi.exe
  C:\Windows\System\FnpEbOi.exe
  2⤵
  PID:14464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AdqIKOW.exe

Filesize
1.4MB

MD5
681cf295ca643227badc1d6175fe1479

SHA1
ae5a34bbb544df3e4a8afb1828c95faeabcb8838

SHA256
dcf34d456ffeafffad7a77d6a837cfcd5a9f7605ad947fc7a88b3d5c695b14dd

SHA512
5dc0e651cfad087ab75be9c0549ac4d2ab959f4487c665b7243179869bf578f4b48c47fcd7699640df5c76ddac798fc0a02c9acf0f7e93e14501a142d956f79b

Download Submit
C:\Windows\System\CplsAzp.exe

Filesize
1.5MB

MD5
2b56837b904ac00d2463b2dd4b89cbb5

SHA1
b55b05b6e2e782dc379b5503dc929892be24e916

SHA256
883ccaa4baedd056f95ce27ef390d6a8819a0bd7b8f221c01e1e0d29f946c772

SHA512
8904757560ce8c050a839154a8df3f75b948baecddb2e7a4ce2eda04385ee3ed907823eaf2c6ee67df2641d2dc0958af42a404a9e0e61ad80010ec09a520ae30

Download Submit
C:\Windows\System\DdCUVZu.exe

Filesize
1.5MB

MD5
555d1ec0e1f2312e79be23a6fdb47ca5

SHA1
3735e1dabfe135f0818449ccc17aecb5187d2103

SHA256
4d73b818bb92c131dcef219923a8b51d3b41dae702024b972ad764a2da66b30f

SHA512
4c4c7e795b660b775c7eb8cc2f43ebd619ea3442c6ea4e94ddb2c559e77450345c41b81db8203c6f71fa27a6c6105e2f6910561293ae4f9de4e595bc3a3cc728

Download Submit
C:\Windows\System\DdJCxpu.exe

Filesize
1.5MB

MD5
3aebdaa974d4a4b168a9e005d0a313e3

SHA1
00f48cab36bb32e6f57dd61de76d9550620193bc

SHA256
27bb05155be556d5c30434f649dd8e941e95477dbbaca08260d4b7d28669cca4

SHA512
97f09a788a0dc0ed3af5ec41125ae0e2d300ab54f9058357d6c24212dae7a9c82ede11e39c7e5f6cb862b54b6e0defd47265605b42b931743eb3c5b75cb74b7a

Download Submit
C:\Windows\System\EhuFplh.exe

Filesize
1.4MB

MD5
7a192793e7c3e611103a5271e5702873

SHA1
b0c6ee40e77dd7f3653f9c01124063db09602bd4

SHA256
d1003e338d83d091a91d4a2dc4f7a376e1c8f96522d8db91a4fc1728eda394ce

SHA512
c5f5c1cc1e891de46e81c0168bc93f8a8c17ce40d04d4e77cbb6faab80f414e9cc584f66e46b048a673f39f20b1c25e9315785090e2601cf13c513ac1e372495

Download Submit
C:\Windows\System\EuEqYzD.exe

Filesize
1.4MB

MD5
aec4988c1bb11b1ceb3160f0ca23be1b

SHA1
2894cd9c7a1bc36452a4cd94fc3e7be3a122470b

SHA256
c49fc2eb1fab1f1b6fee9c2e4b0199df0edbd2bcf53c6fc3a92b07d7f9d533bd

SHA512
2cdd4c952569adc1282cb25847dbd0d6337e5e964c9b0e7b885147572bf8e61bdfd862f516e74257fcf60e38aa43a78b2f598858cef534b2ccdc9820621770d3

Download Submit
C:\Windows\System\FZaGjQr.exe

Filesize
1.4MB

MD5
ae48f1191e596a00f645d06bae257d0b

SHA1
603274c08f76f9543548f271034aa60aea5f924e

SHA256
dadb8c91603e00a0e1381edbf944bae399bc085ee0e90abaae8bf7da1c9b4885

SHA512
2860bb6d23ee826e05546015d47c7b73cae9a9929e79d740e3e01689b0ea6c1eb87551247cf68ae5b2a4cd551b09ed123baa6136d7d2ce070a9cd205921139ac

Download Submit
C:\Windows\System\JeMdkto.exe

Filesize
1.4MB

MD5
1e4264c046f0355a2eb9838726bf02cc

SHA1
ac62c99bed9026f6ce91512cda43e14da5ff3c84

SHA256
6f68ae43a9af91ed1601c09a36b2f90de2792eee2e64ec1dd1ece3f1983953b4

SHA512
4f0407ec9a3418412fc6e7dcdc6c207bd60d8601bbbdd7332cf7ab7bb6c6e7f772da3c091465f6437b4d75a4db37e207c93a35f885922791730c063661f863d9

Download Submit
C:\Windows\System\MbbRVqU.exe

Filesize
1.5MB

MD5
06f0d4c01560507b95a02256466d2a74

SHA1
857dc1fe950f8b6ae78e20dcc5c3c226c7c9fb0e

SHA256
dde74636140297e7efcfe0b0157f5542861d04e93956e428772a28b43650da2e

SHA512
01cd8ee8d622757a62bfbfb2e385911d60627dc6b1cc012f0246a659c965f0dc43f991da3a1f3533b2aea806fc20aac1913a33e89d83b5d399455e82799275af

Download Submit
C:\Windows\System\NyaMZtR.exe

Filesize
1.4MB

MD5
4c59f6cc75bcf415a91a10092918adcc

SHA1
9260133a7ef2d18cd60b8049f5df078629da4484

SHA256
167c67ff7e2fa25a742a8a574c04306a573fdf1eb04caf7d6fd9fe1398191e1b

SHA512
e84df0972badcf4c51eff1caa2cb9f9007fb651a614fae80883e7b92662a7387429f70bbe8313552ba2553c3b64f9a23945dba152a3dd0ff24825743742df24e

Download Submit
C:\Windows\System\OIhgzsl.exe

Filesize
1.4MB

MD5
7e447ea5265ec2b50969a5bb3f9b9f04

SHA1
657d6d5f2591c5c0977f49e6d06720c11084b714

SHA256
2cbda0319ffcf2a00e6970904cdb4cd1d1577f8c202840d1735a4feeee41e372

SHA512
cced3f66a28b0850edf3551ac6685ee4e6a0888dd4f1fc2c4442a0e1e65cb218f237151cf8a4685d426d3998b4398e9328b6a93dd94b3d8d4ed16876fb7f9299

Download Submit
C:\Windows\System\OKQFlyD.exe

Filesize
1.4MB

MD5
ff85f160354262b35bbd86848825a430

SHA1
fbfc48a2136fb42590be661e40ee53b432bb9936

SHA256
111598d5b87f6e4a6c73f592be7bb75428dc80ff9b71420841fdd36f9f502637

SHA512
6f6c08e35b7fc98dcf06fd1da6ad57775a70d548bce5d7949820d1de0f169c97c3e4085553f30a345a64638c47560c1731594c079f9044811fd6c70904f1f996

Download Submit
C:\Windows\System\OdYsotk.exe

Filesize
1.4MB

MD5
ae162481d4aa12e1e2cc2e11c1095b30

SHA1
5e3d20c12909e75cc0800c7d07a0bffaa0581814

SHA256
8e9d06db7316157ccca5f90272e83bae8fdadcce5d0ffcca8153acd298e9105e

SHA512
c97d5220bd9c95b54a1e60ed841a37670071470ee93d3657ec07027f5a2eca0b762092b61b7ace4a618d6e2af62ca7fd57d920821abb1141ea98bff232f5e78d

Download Submit
C:\Windows\System\QNuyIjR.exe

Filesize
1.5MB

MD5
6187daba55bb780b4a51a7f9bd333a1f

SHA1
cba8d3e96eeb93f713dac4176d3cf1cb439bd12f

SHA256
0cb7b5860b51251ac10248bde4383cc38fdb0fabf07344821cb02873a7daf6bd

SHA512
8fa6182fdb9265ee0c2d039132b52cb7073d9021576ceb0117de7f2db55f0fb40205efa2376315db9bb5d45bf240ec98da6be19d13b2dccf8c0959f75677a560

Download Submit
C:\Windows\System\RKSoOkg.exe

Filesize
1.4MB

MD5
309d62b9b3baff4fce072d389be86563

SHA1
d37e599136a928033fcd44722e8c78e30c99441a

SHA256
6c6aa9ae9e4618814efb01eb37553512768f307136f4e192fa825718b789bceb

SHA512
7d4157dfe7b89149a43e7aa27777795ed73fce41bf8b232e1accdea13864a8395c0caf9bd6127d85cac4e26df4f0d1ae81183f02f254257c8d04cee4e44575df

Download Submit
C:\Windows\System\SSAmHyD.exe

Filesize
1.5MB

MD5
add9f7a66c89e8451af0d0d3de6c9d03

SHA1
ed7b568c51642a8423221b9a3d18d31e067e83db

SHA256
3ed84e7731a9596ccecc0de19e7c042bbb5d0b00e8e2d422971cba985acaec47

SHA512
56896cce6595ce8395fb670cc3c262e4dcdb4483b25db6dbb7a185cc4cec02803eb67101117b06a1da40bc759baaaa0dfdca1e5a9da980f9e5ed366ca7131317

Download Submit
C:\Windows\System\UVSMljv.exe

Filesize
1.4MB

MD5
1008b2bd2e9789b3da68c3eef00b9718

SHA1
48173262d35c82cf7e663bc32f3de91dc0acef38

SHA256
0ece8c3bca6c5b2dda1bd8b4e3b102297a219d0361ab6adfe4075ae1c5229ea0

SHA512
93c7b4efbbeea16b7e6ebe73588a2abe43f4fa110bb074394199f78b1c7334ef4bb65008a7109be2c9fa9d2d58b7ab3324bc03c832f3c27f102f4cb3b6e9852b

Download Submit
C:\Windows\System\VNhKmxs.exe

Filesize
1.5MB

MD5
8bb44d2e51952988a4b1b05f4e2a3f9b

SHA1
4c88012f72d038bf895c3e927f5ade863b5464a1

SHA256
0b3d1da2cc33f5e4873120d8444906a438258dfc557a8bbbe8d5b0129a2474d6

SHA512
66efd40bc1a3a156d14a45d69f4398c8f1001f0f5196084103631fd3177722c4dbaa634a0d3bc5b88f137f2b80ea1ebd1384f8f6052a580bef1b499885bf62a4

Download Submit
C:\Windows\System\XuzcLML.exe

Filesize
1.5MB

MD5
1921da26347e94d56100c64282ae87d1

SHA1
e2dda030d458e192e5727f9771af223c1b3ed843

SHA256
40835cd9666ef46f2056b2606d403266dca0f5bf3eea4d72ef69d08cfc33981d

SHA512
ae487ce9ec9c0bc21298e6070b489357171db55905529c5c9998ed21af964d08bd73a1bdac22cad50d95ae96ba6d84e4c5b72726b6e98a73a55993702838869f

Download Submit
C:\Windows\System\YRxzFHK.exe

Filesize
1.5MB

MD5
0beea5ca0f13a45e223ea173a2300253

SHA1
6c4c087555b376b88b3aa236233061f0fd6f856d

SHA256
f66e1d075df4c60f4b6de173a81325aa3c2252086258f9a4d0921fbfcea2093c

SHA512
2281d17d4c9e70f44d478028c8781b957365b6c96d1196ad1cdb7607616650c6babee4507dbe366fb7f60374cdc3fe1963235df30d19f3b2952c74ebcc1a08c1

Download Submit
C:\Windows\System\YqlNMak.exe

Filesize
1.5MB

MD5
3e7b7fb56ee016dca54bf56aa394e754

SHA1
ecdf5e9f54943c9c01aa6790ff731515ca42a6ef

SHA256
22b94dd0691d18d37b5beed962373795c3e7569640fcd7b737a0673f39242146

SHA512
a7a3be13b5431186ab6f604c92aef4dac11a35a9a3377c2e573e9a736aa370817bba823fca56decb3e70823d5c23c5ab44234b2a0e32677f339e419dee6ef326

Download Submit
C:\Windows\System\bxmjqwB.exe

Filesize
1.5MB

MD5
e160f9e9328dd771b80741af7daf3273

SHA1
92df99a1966ec4765fb19e20e5270782a1cda0dc

SHA256
0f16c8c80725011ea9cd9d487cc4fe557bb3bde11e0adfe52210b2579e01ccb8

SHA512
80e38ec7584ff335907b88cc1e30c2644d14dea0ac1a3e00a8f3d3d7da631eca3ba10363a59e0f08ab4695739042fceafcd02095103eec6dc63e284ca56aac0a

Download Submit
C:\Windows\System\cWVRRes.exe

Filesize
1.5MB

MD5
95bbd1fc0341d1ef0aca88083cf28602

SHA1
464c27cc6738102000a367db06cab42189b9e24a

SHA256
e2d2f00421aded41e6fe6c4aa8f3e52928d6c42076fc245f22454bb2b990c678

SHA512
49d28a623ad56bda22514ae10b20d4851d180576315da01dabdeb78d05a03299d9069e0e0c9531e8a1b924228c72d72804e3480f040182c1f74261e6d99c833f

Download Submit
C:\Windows\System\cnSVlkn.exe

Filesize
1.5MB

MD5
55c57e29efeb237b55776eaa9c438fda

SHA1
99785ad9f5c78d0af962a3f20cc64c58e8ee7029

SHA256
37be31d09feb969b1bd9b4e09570c07272932447101d00d0288107e9921bcc8e

SHA512
89042e2fb6095ec4c066396f88aec4196b4a168c703e14c5c92ce26cc535c5fbe745fe960a822915b0ceb7a8e465de711d8ba492023003e4a81bb8c8092a6c87

Download Submit
C:\Windows\System\ctCeggs.exe

Filesize
1.5MB

MD5
e16d8d4e9ca935b8113e0904f268cef9

SHA1
878b5c2f5f0948f19c01533deed1072c45a27460

SHA256
245fbbb0e03c545cab5976064d8fd464a1bfe5ff6038f08b810c0f755521f12a

SHA512
4de77c722f119be1ae354f879c655d521f423f5e90fed665cc4d3680e61b282dbcb7cbfb5bd808215d3f922cce82ff7ab937d3df46ed4d033985d51b027ad9b7

Download Submit
C:\Windows\System\eLWVUzM.exe

Filesize
1.5MB

MD5
86b6ebcffb8fc920ae692efbebe3bc0c

SHA1
a081025ec7c536f25362af0b74b4d30f1ddf4b28

SHA256
be189c30e9038484cac9c48308b76ff7a31edcce9bdfe091b746bca08079f282

SHA512
91c00f264ea773c3c053ebb7d567bc57f750f5e40d5da542151b5f00fd849d6d2a9079a6dbfbcefd4e20129e7dbabaf754fa9065a458d9fba62960ba8cc54bf6

Download Submit
C:\Windows\System\fUIMbQR.exe

Filesize
1.5MB

MD5
0927e20cb86d2a37128e41d54afd41c7

SHA1
f151d03e6d99317694020766313b533f2cc1523a

SHA256
5b0a7100300f5a3af22d1c2d456a80213b32da07ead17e9328d65120dcc7647f

SHA512
4531542b0a9f94cc70119c9eed73263b5c58d73791b56ce88cbda5f8fc8a63bd0053c9ebc853604ee12143e920c0f0c9975c1cb49048f61cc2dabe44ddefde3a

Download Submit
C:\Windows\System\gLzkaMJ.exe

Filesize
1.4MB

MD5
d69d825cb3be331371405ad8eac6226a

SHA1
f844744f7bf085e5e7da4c592d23be8e07e66549

SHA256
0ec9e0bda16dc95607f377b7e47b27c753e301eced7f5287e2d596f8761dfbb3

SHA512
9586c5fdf4f7d77727343c140cd09e3d79e09eea429f62e9d46bd160651b5a3c5c6424d4d85f420be41683c0af5a6d73beb98bed3aec7f8bfd7ff430067edfb0

Download Submit
C:\Windows\System\jijrDYu.exe

Filesize
1.5MB

MD5
c00b500c69cf0e5b741d0f379b01d138

SHA1
7494448490ad450ce247b46c0f7997100dcc7b32

SHA256
68e84ae04262f36fdb137ffd4b085c5aa650a674cd74e81854402524656d1b8e

SHA512
cc6b4a4321d6317cbb4d41e30e9438f4c597e89bdb9bfc856d1042a555900867734ece4c4d197b642bb15e67464d4aa4bfeb7ea056e57c1f12dce30c869b1798

Download Submit
C:\Windows\System\nZkmxIW.exe

Filesize
1.5MB

MD5
f71f11d0a3f578ecebb90d5ee523ee47

SHA1
9a41a51efac7653d029351ccc2b4ca07296bc130

SHA256
7e586b191e10b01275535703aed56b662807e61546f44f40a86455484779f67c

SHA512
0baf44820c2fd8f8bfbf1aa9511dc04e1b80c0f2d6156ef817c82803ece0b01b83501e8fb3af7cabda3c0716096dc1ed78448fe5679acedb1d6dc2f98cad0112

Download Submit
C:\Windows\System\rzwDCxx.exe

Filesize
1.4MB

MD5
87d684273fc8e7c0a48fb1b847d0ccf2

SHA1
a96833ffe1c20564633c4ed9f0e71cfa67ab5bbe

SHA256
c789cc6511953e3536df5b5274b3474d8381df863888065b055c8cb1458e5ce3

SHA512
3f3b204479741a5dd817b17ff60761ccd2738203e54f77c0a54b19dbc6607e19623131c363337603934f4911bb88b2ffa9df1d08a8f23fb02b99673b292e2b35

Download Submit
C:\Windows\System\sDBqNlo.exe

Filesize
1.5MB

MD5
6303cdcf1e1dfd500c84da54dfc4c7e6

SHA1
c6fead9de60848d3ba3aa9bc43e3d55a63106b5d

SHA256
388a95dc386aa5311385b7514a2cba281e1a115575ce29c2351499735cfb1c47

SHA512
6608a7e326d7a2f27d78ecffb2c8bd4dd290ac008f0b36512a0693aac43be256bc87508864f9a93caee5bcd594ee2b71a3c443aa56aafbe851a03f9e42a04d45

Download Submit
C:\Windows\System\vvvrnSA.exe

Filesize
1.5MB

MD5
81086490e1e2df32539b219d58b3bddd

SHA1
55e3def6b900c9817aba00104a187f8b3cc7c898

SHA256
9beb4145ab26b3eac537cab12d4986d4f189e47674b7bf1319e85ccfaa47b438

SHA512
3c88da6ffaae11d805a246dd560b40b1d512db17a27e26fc6d0f68e8b520c7156214bd4c5a8f6f42eda5dbd327725425dd4ae4902856bfadf404485484fb5afd

Download Submit
C:\Windows\System\wljamIw.exe

Filesize
1.5MB

MD5
f34a757328e858ac79390c22b2db6647

SHA1
ff7dcf23c3adccfcdd4d47e790503987419d5d32

SHA256
c59d4b38f791913a22538950083c7f6e38080a99fd9a2b402a8e02b9ae443657

SHA512
5392e149ba4869b7a1e1083af1e9924db4bd9d5e29b874b1a0f74d5ee0956c9130e3f860e0a7bd028c100bc88f39c7573f1e93c7f19a4cc8d4cfcd4f435b397e

Download Submit
memory/2508-0-0x000001E3CE840000-0x000001E3CE850000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads