xmrig | afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
Size

1.7MB
MD5

d00d08034aaa47c7bf8984e8a1d811ed
SHA1

4947d599d3c23dd834e95ccafe1d4dd5c7e9de0c
SHA256

afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c
SHA512

ed8f0cc5dde83584f738144e212085da7d837e16dbfeb08192f3a2e5373b8eb35b0a6b059cd8632dea18f6609c72f680a0fc59135c8ab9c0d2211e30f30a39d8
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYgDpHBxWF:GemTLkNdfE0pZyu

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c08-4.dat	xmrig
behavioral2/files/0x0008000000023caa-7.dat	xmrig
behavioral2/files/0x0007000000023cae-6.dat	xmrig
behavioral2/files/0x0007000000023caf-17.dat	xmrig
behavioral2/files/0x0007000000023cb1-27.dat	xmrig
behavioral2/files/0x0007000000023cb0-31.dat	xmrig
behavioral2/files/0x0007000000023cb2-34.dat	xmrig
behavioral2/files/0x0007000000023cb3-40.dat	xmrig
behavioral2/files/0x0007000000023cb6-47.dat	xmrig
behavioral2/files/0x0007000000023cb5-48.dat	xmrig
behavioral2/files/0x0007000000023cb7-53.dat	xmrig
behavioral2/files/0x0008000000023cab-80.dat	xmrig
behavioral2/files/0x0007000000023cbc-82.dat	xmrig
behavioral2/files/0x0007000000023cbb-78.dat	xmrig
behavioral2/files/0x0007000000023cba-75.dat	xmrig
behavioral2/files/0x0007000000023cc1-102.dat	xmrig
behavioral2/files/0x0007000000023cc3-111.dat	xmrig
behavioral2/files/0x0007000000023cc5-118.dat	xmrig
behavioral2/files/0x0007000000023cc6-130.dat	xmrig
behavioral2/files/0x0007000000023cc2-123.dat	xmrig
behavioral2/files/0x0007000000023cc4-121.dat	xmrig
behavioral2/files/0x0007000000023cc0-107.dat	xmrig
behavioral2/files/0x0007000000023cbf-100.dat	xmrig
behavioral2/files/0x0007000000023cbd-90.dat	xmrig
behavioral2/files/0x0007000000023cb9-73.dat	xmrig
behavioral2/files/0x0007000000023cb8-63.dat	xmrig
behavioral2/files/0x0007000000023cc7-135.dat	xmrig
behavioral2/files/0x0007000000023cc8-138.dat	xmrig
behavioral2/files/0x0007000000023cc9-144.dat	xmrig
behavioral2/files/0x0007000000023cca-150.dat	xmrig
behavioral2/files/0x0007000000023ccb-154.dat	xmrig
behavioral2/files/0x0007000000023ccc-159.dat	xmrig
behavioral2/files/0x0007000000023ccd-162.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3136	SLqkEJH.exe
3332	ZdYOQiy.exe
4708	clyxDnC.exe
4660	YcjXDqP.exe
4568	TWMPrJR.exe
552	NFFhPXn.exe
2312	ldLdsFv.exe
2620	ZkTfHQU.exe
4268	uHIqmnO.exe
540	mlNEzWn.exe
3936	AasfckS.exe
4316	yWMwCcR.exe
4084	xTHnPCA.exe
2584	IjCAPEB.exe
1920	eGrCEBv.exe
2948	tQKqwBK.exe
4212	ipVsuUM.exe
2244	JPjeAcb.exe
2684	fEfBmUe.exe
3360	fjOKZRW.exe
4320	yDjBAqv.exe
2436	IIjshRy.exe
3708	hYBwspR.exe
4848	fIQyChs.exe
1864	TCbGcZT.exe
1396	SOQoQBN.exe
1688	YTKTNXi.exe
4800	wTBZFdN.exe
4488	DzOeaWl.exe
1916	Mergmpa.exe
4056	NuFSZuo.exe
4176	zGxqOhO.exe
4044	SmExgvj.exe
4048	qlLVhFN.exe
1992	ouMHYvW.exe
1728	lkDVLlF.exe
4380	VaUuYkT.exe
3404	GlFjsav.exe
3628	TAqgZrT.exe
4324	akvpWCt.exe
1584	KBCqCTL.exe
232	ichFpMR.exe
2468	ADboOtI.exe
3356	hwblIsj.exe
3420	AvgkSxd.exe
4332	rOwkJRq.exe
4540	WfQKqfJ.exe
1632	rDQttNW.exe
3540	VttPrxP.exe
3296	cbNDaMY.exe
2148	uRBdfud.exe
2292	kikyQgn.exe
4836	LGjRHJZ.exe
4300	xqVksYc.exe
2680	xloNlXV.exe
832	FAjlFvY.exe
1116	yRUzibP.exe
3308	cvDpezt.exe
2360	TKMYoAv.exe
4844	KiHDpjZ.exe
756	IqRchWt.exe
2336	xFJzMVV.exe
4564	oQkkdLk.exe
3336	AUfdVhD.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OFNSdxr.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\nSOTlLj.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\SxlLMve.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\BJWHCvh.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\EaHoWyE.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\xiPVYhP.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\haFvDCs.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\AVBeDKz.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\tdobVod.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\yEvHwBy.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\GRnUziv.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\pxBzjEH.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\MLxOyom.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\giRvTCd.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\IqRchWt.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\BuaXFkz.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\errEErl.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\mIkxwpV.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\IjCAPEB.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\PdmTWgy.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\DCCiRRH.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\yggMwoJ.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\NTmMaMA.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\kCzwYxD.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\SCrdYbW.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\HczEOVO.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\VvtyOmQ.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\atetWHv.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\XTyriLC.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\QHsSOCa.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\xKcDdhj.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\uVHZKPd.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\OfBmEEQ.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\hwblIsj.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\RuvfpnD.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\ubMMDdC.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\dXtqvnh.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\XzqhSFt.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\WujOYKC.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\wSFmAtR.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\ZkTfHQU.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\kikyQgn.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\zcjxWVm.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\yAGpbcL.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\kWGcOQC.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\aMXLBNV.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\ldLdsFv.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\KtEtKdh.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\qaOPSUn.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\tSMQlSI.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\XAnkWrn.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\FHIquyy.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\tQKqwBK.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\vvYUyOy.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\sRdBJiT.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\sYDqpKT.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\HuNALcO.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\GhAqgEk.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\XZvejob.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\jIvCNCt.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\iLNkjqr.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\ZnWPYyy.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\XOssuyx.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
File created	C:\Windows\System\ZlyhHcK.exe	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 3136	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	83
PID 2124 wrote to memory of 3136	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	83
PID 2124 wrote to memory of 3332	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	84
PID 2124 wrote to memory of 3332	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	84
PID 2124 wrote to memory of 4708	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	85
PID 2124 wrote to memory of 4708	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	85
PID 2124 wrote to memory of 4660	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	86
PID 2124 wrote to memory of 4660	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	86
PID 2124 wrote to memory of 4568	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	87
PID 2124 wrote to memory of 4568	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	87
PID 2124 wrote to memory of 552	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	88
PID 2124 wrote to memory of 552	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	88
PID 2124 wrote to memory of 2312	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	89
PID 2124 wrote to memory of 2312	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	89
PID 2124 wrote to memory of 2620	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	90
PID 2124 wrote to memory of 2620	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	90
PID 2124 wrote to memory of 4268	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	91
PID 2124 wrote to memory of 4268	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	91
PID 2124 wrote to memory of 540	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	92
PID 2124 wrote to memory of 540	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	92
PID 2124 wrote to memory of 3936	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	93
PID 2124 wrote to memory of 3936	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	93
PID 2124 wrote to memory of 4316	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	94
PID 2124 wrote to memory of 4316	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	94
PID 2124 wrote to memory of 4084	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	95
PID 2124 wrote to memory of 4084	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	95
PID 2124 wrote to memory of 2584	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	96
PID 2124 wrote to memory of 2584	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	96
PID 2124 wrote to memory of 1920	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	97
PID 2124 wrote to memory of 1920	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	97
PID 2124 wrote to memory of 2948	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	98
PID 2124 wrote to memory of 2948	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	98
PID 2124 wrote to memory of 4212	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	99
PID 2124 wrote to memory of 4212	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	99
PID 2124 wrote to memory of 2244	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	100
PID 2124 wrote to memory of 2244	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	100
PID 2124 wrote to memory of 2684	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	101
PID 2124 wrote to memory of 2684	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	101
PID 2124 wrote to memory of 3360	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	102
PID 2124 wrote to memory of 3360	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	102
PID 2124 wrote to memory of 4320	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	103
PID 2124 wrote to memory of 4320	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	103
PID 2124 wrote to memory of 2436	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	104
PID 2124 wrote to memory of 2436	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	104
PID 2124 wrote to memory of 3708	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	105
PID 2124 wrote to memory of 3708	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	105
PID 2124 wrote to memory of 4848	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	106
PID 2124 wrote to memory of 4848	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	106
PID 2124 wrote to memory of 1864	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	107
PID 2124 wrote to memory of 1864	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	107
PID 2124 wrote to memory of 1396	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	108
PID 2124 wrote to memory of 1396	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	108
PID 2124 wrote to memory of 1688	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	109
PID 2124 wrote to memory of 1688	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	109
PID 2124 wrote to memory of 4800	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	110
PID 2124 wrote to memory of 4800	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	110
PID 2124 wrote to memory of 4488	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	111
PID 2124 wrote to memory of 4488	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	111
PID 2124 wrote to memory of 1916	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	112
PID 2124 wrote to memory of 1916	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	112
PID 2124 wrote to memory of 4056	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	113
PID 2124 wrote to memory of 4056	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	113
PID 2124 wrote to memory of 4176	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	114
PID 2124 wrote to memory of 4176	2124	afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe	114

C:\Users\Admin\AppData\Local\Temp\afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe
"C:\Users\Admin\AppData\Local\Temp\afab3f8d03c3da9408e3ce2773c76ac4853f2462ad2bc12c57bb15ad1ef0091c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\System\SLqkEJH.exe
  C:\Windows\System\SLqkEJH.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\ZdYOQiy.exe
  C:\Windows\System\ZdYOQiy.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\clyxDnC.exe
  C:\Windows\System\clyxDnC.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\YcjXDqP.exe
  C:\Windows\System\YcjXDqP.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\TWMPrJR.exe
  C:\Windows\System\TWMPrJR.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\NFFhPXn.exe
  C:\Windows\System\NFFhPXn.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\ldLdsFv.exe
  C:\Windows\System\ldLdsFv.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ZkTfHQU.exe
  C:\Windows\System\ZkTfHQU.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\uHIqmnO.exe
  C:\Windows\System\uHIqmnO.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\mlNEzWn.exe
  C:\Windows\System\mlNEzWn.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\AasfckS.exe
  C:\Windows\System\AasfckS.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\yWMwCcR.exe
  C:\Windows\System\yWMwCcR.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\xTHnPCA.exe
  C:\Windows\System\xTHnPCA.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\IjCAPEB.exe
  C:\Windows\System\IjCAPEB.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\eGrCEBv.exe
  C:\Windows\System\eGrCEBv.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\tQKqwBK.exe
  C:\Windows\System\tQKqwBK.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\ipVsuUM.exe
  C:\Windows\System\ipVsuUM.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\JPjeAcb.exe
  C:\Windows\System\JPjeAcb.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\fEfBmUe.exe
  C:\Windows\System\fEfBmUe.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\fjOKZRW.exe
  C:\Windows\System\fjOKZRW.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\yDjBAqv.exe
  C:\Windows\System\yDjBAqv.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\IIjshRy.exe
  C:\Windows\System\IIjshRy.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\hYBwspR.exe
  C:\Windows\System\hYBwspR.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\fIQyChs.exe
  C:\Windows\System\fIQyChs.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\TCbGcZT.exe
  C:\Windows\System\TCbGcZT.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\SOQoQBN.exe
  C:\Windows\System\SOQoQBN.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\YTKTNXi.exe
  C:\Windows\System\YTKTNXi.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\wTBZFdN.exe
  C:\Windows\System\wTBZFdN.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\DzOeaWl.exe
  C:\Windows\System\DzOeaWl.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\Mergmpa.exe
  C:\Windows\System\Mergmpa.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\NuFSZuo.exe
  C:\Windows\System\NuFSZuo.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\zGxqOhO.exe
  C:\Windows\System\zGxqOhO.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\SmExgvj.exe
  C:\Windows\System\SmExgvj.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\qlLVhFN.exe
  C:\Windows\System\qlLVhFN.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\ouMHYvW.exe
  C:\Windows\System\ouMHYvW.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\lkDVLlF.exe
  C:\Windows\System\lkDVLlF.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\VaUuYkT.exe
  C:\Windows\System\VaUuYkT.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\GlFjsav.exe
  C:\Windows\System\GlFjsav.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\TAqgZrT.exe
  C:\Windows\System\TAqgZrT.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\akvpWCt.exe
  C:\Windows\System\akvpWCt.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\KBCqCTL.exe
  C:\Windows\System\KBCqCTL.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\ichFpMR.exe
  C:\Windows\System\ichFpMR.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\ADboOtI.exe
  C:\Windows\System\ADboOtI.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\hwblIsj.exe
  C:\Windows\System\hwblIsj.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\AvgkSxd.exe
  C:\Windows\System\AvgkSxd.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\rOwkJRq.exe
  C:\Windows\System\rOwkJRq.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\WfQKqfJ.exe
  C:\Windows\System\WfQKqfJ.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\rDQttNW.exe
  C:\Windows\System\rDQttNW.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\VttPrxP.exe
  C:\Windows\System\VttPrxP.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\cbNDaMY.exe
  C:\Windows\System\cbNDaMY.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\uRBdfud.exe
  C:\Windows\System\uRBdfud.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\kikyQgn.exe
  C:\Windows\System\kikyQgn.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\LGjRHJZ.exe
  C:\Windows\System\LGjRHJZ.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\xqVksYc.exe
  C:\Windows\System\xqVksYc.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\xloNlXV.exe
  C:\Windows\System\xloNlXV.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\FAjlFvY.exe
  C:\Windows\System\FAjlFvY.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\yRUzibP.exe
  C:\Windows\System\yRUzibP.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\cvDpezt.exe
  C:\Windows\System\cvDpezt.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\TKMYoAv.exe
  C:\Windows\System\TKMYoAv.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\KiHDpjZ.exe
  C:\Windows\System\KiHDpjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\IqRchWt.exe
  C:\Windows\System\IqRchWt.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\xFJzMVV.exe
  C:\Windows\System\xFJzMVV.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\oQkkdLk.exe
  C:\Windows\System\oQkkdLk.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\AUfdVhD.exe
  C:\Windows\System\AUfdVhD.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\ChTDNAt.exe
  C:\Windows\System\ChTDNAt.exe
  2⤵
  PID:2924
- C:\Windows\System\cFwozei.exe
  C:\Windows\System\cFwozei.exe
  2⤵
  PID:2992
- C:\Windows\System\AdFAMoQ.exe
  C:\Windows\System\AdFAMoQ.exe
  2⤵
  PID:1744
- C:\Windows\System\JFDbdMw.exe
  C:\Windows\System\JFDbdMw.exe
  2⤵
  PID:2812
- C:\Windows\System\KZVcdnW.exe
  C:\Windows\System\KZVcdnW.exe
  2⤵
  PID:4452
- C:\Windows\System\vCiauJY.exe
  C:\Windows\System\vCiauJY.exe
  2⤵
  PID:3324
- C:\Windows\System\PvITOXT.exe
  C:\Windows\System\PvITOXT.exe
  2⤵
  PID:436
- C:\Windows\System\crHBLrS.exe
  C:\Windows\System\crHBLrS.exe
  2⤵
  PID:4448
- C:\Windows\System\nJPUuQe.exe
  C:\Windows\System\nJPUuQe.exe
  2⤵
  PID:3476
- C:\Windows\System\szcoYOF.exe
  C:\Windows\System\szcoYOF.exe
  2⤵
  PID:4060
- C:\Windows\System\BLSIsEM.exe
  C:\Windows\System\BLSIsEM.exe
  2⤵
  PID:4904
- C:\Windows\System\quzGlnp.exe
  C:\Windows\System\quzGlnp.exe
  2⤵
  PID:2548
- C:\Windows\System\sDyBXyc.exe
  C:\Windows\System\sDyBXyc.exe
  2⤵
  PID:4596
- C:\Windows\System\yUwOQjf.exe
  C:\Windows\System\yUwOQjf.exe
  2⤵
  PID:4796
- C:\Windows\System\XDYNeyu.exe
  C:\Windows\System\XDYNeyu.exe
  2⤵
  PID:3872
- C:\Windows\System\GbEchJu.exe
  C:\Windows\System\GbEchJu.exe
  2⤵
  PID:1760
- C:\Windows\System\axNafTN.exe
  C:\Windows\System\axNafTN.exe
  2⤵
  PID:2572
- C:\Windows\System\ZsqNOAB.exe
  C:\Windows\System\ZsqNOAB.exe
  2⤵
  PID:3668
- C:\Windows\System\rHWHqXF.exe
  C:\Windows\System\rHWHqXF.exe
  2⤵
  PID:1672
- C:\Windows\System\ncJuCxj.exe
  C:\Windows\System\ncJuCxj.exe
  2⤵
  PID:1540
- C:\Windows\System\JCaaPuG.exe
  C:\Windows\System\JCaaPuG.exe
  2⤵
  PID:2320
- C:\Windows\System\XTyriLC.exe
  C:\Windows\System\XTyriLC.exe
  2⤵
  PID:2304
- C:\Windows\System\JdpdvET.exe
  C:\Windows\System\JdpdvET.exe
  2⤵
  PID:2748
- C:\Windows\System\DnTwkUR.exe
  C:\Windows\System\DnTwkUR.exe
  2⤵
  PID:2240
- C:\Windows\System\tfVfiXX.exe
  C:\Windows\System\tfVfiXX.exe
  2⤵
  PID:3616
- C:\Windows\System\muCtoNq.exe
  C:\Windows\System\muCtoNq.exe
  2⤵
  PID:888
- C:\Windows\System\bugCQUf.exe
  C:\Windows\System\bugCQUf.exe
  2⤵
  PID:4656
- C:\Windows\System\dTrfeNM.exe
  C:\Windows\System\dTrfeNM.exe
  2⤵
  PID:5100
- C:\Windows\System\QHwYwhw.exe
  C:\Windows\System\QHwYwhw.exe
  2⤵
  PID:3220
- C:\Windows\System\kPnuCZY.exe
  C:\Windows\System\kPnuCZY.exe
  2⤵
  PID:1248
- C:\Windows\System\jsIXlYK.exe
  C:\Windows\System\jsIXlYK.exe
  2⤵
  PID:4788
- C:\Windows\System\VQtPkXE.exe
  C:\Windows\System\VQtPkXE.exe
  2⤵
  PID:4724
- C:\Windows\System\tdobVod.exe
  C:\Windows\System\tdobVod.exe
  2⤵
  PID:716
- C:\Windows\System\FIfvSyw.exe
  C:\Windows\System\FIfvSyw.exe
  2⤵
  PID:4804
- C:\Windows\System\woCFmkc.exe
  C:\Windows\System\woCFmkc.exe
  2⤵
  PID:3756
- C:\Windows\System\lagjOKV.exe
  C:\Windows\System\lagjOKV.exe
  2⤵
  PID:4972
- C:\Windows\System\yTWFRox.exe
  C:\Windows\System\yTWFRox.exe
  2⤵
  PID:2676
- C:\Windows\System\cQLOEfO.exe
  C:\Windows\System\cQLOEfO.exe
  2⤵
  PID:1980
- C:\Windows\System\COTWxBz.exe
  C:\Windows\System\COTWxBz.exe
  2⤵
  PID:3416
- C:\Windows\System\ZiDGzVg.exe
  C:\Windows\System\ZiDGzVg.exe
  2⤵
  PID:4808
- C:\Windows\System\Yoihcxc.exe
  C:\Windows\System\Yoihcxc.exe
  2⤵
  PID:4304
- C:\Windows\System\mzorRKI.exe
  C:\Windows\System\mzorRKI.exe
  2⤵
  PID:1028
- C:\Windows\System\oCWuZbk.exe
  C:\Windows\System\oCWuZbk.exe
  2⤵
  PID:2904
- C:\Windows\System\JdOsJYg.exe
  C:\Windows\System\JdOsJYg.exe
  2⤵
  PID:2064
- C:\Windows\System\MGuOIJZ.exe
  C:\Windows\System\MGuOIJZ.exe
  2⤵
  PID:1128
- C:\Windows\System\ispvhlp.exe
  C:\Windows\System\ispvhlp.exe
  2⤵
  PID:4312
- C:\Windows\System\yCjHBrP.exe
  C:\Windows\System\yCjHBrP.exe
  2⤵
  PID:2808
- C:\Windows\System\nfPMyEV.exe
  C:\Windows\System\nfPMyEV.exe
  2⤵
  PID:3984
- C:\Windows\System\hvXHxbW.exe
  C:\Windows\System\hvXHxbW.exe
  2⤵
  PID:208
- C:\Windows\System\wPipAoe.exe
  C:\Windows\System\wPipAoe.exe
  2⤵
  PID:4340
- C:\Windows\System\OSzLlcg.exe
  C:\Windows\System\OSzLlcg.exe
  2⤵
  PID:5112
- C:\Windows\System\bQetePD.exe
  C:\Windows\System\bQetePD.exe
  2⤵
  PID:4168
- C:\Windows\System\BWeAVXF.exe
  C:\Windows\System\BWeAVXF.exe
  2⤵
  PID:2428
- C:\Windows\System\PMmpJFy.exe
  C:\Windows\System\PMmpJFy.exe
  2⤵
  PID:4480
- C:\Windows\System\WmYviGo.exe
  C:\Windows\System\WmYviGo.exe
  2⤵
  PID:1676
- C:\Windows\System\RepfUqh.exe
  C:\Windows\System\RepfUqh.exe
  2⤵
  PID:5148
- C:\Windows\System\uGSJaKU.exe
  C:\Windows\System\uGSJaKU.exe
  2⤵
  PID:5172
- C:\Windows\System\LYiFVxd.exe
  C:\Windows\System\LYiFVxd.exe
  2⤵
  PID:5196
- C:\Windows\System\ombImaD.exe
  C:\Windows\System\ombImaD.exe
  2⤵
  PID:5220
- C:\Windows\System\BKdNMke.exe
  C:\Windows\System\BKdNMke.exe
  2⤵
  PID:5244
- C:\Windows\System\BuaXFkz.exe
  C:\Windows\System\BuaXFkz.exe
  2⤵
  PID:5272
- C:\Windows\System\atetWHv.exe
  C:\Windows\System\atetWHv.exe
  2⤵
  PID:5308
- C:\Windows\System\BdAjhAM.exe
  C:\Windows\System\BdAjhAM.exe
  2⤵
  PID:5336
- C:\Windows\System\JbnQSGP.exe
  C:\Windows\System\JbnQSGP.exe
  2⤵
  PID:5364
- C:\Windows\System\MXhQaYh.exe
  C:\Windows\System\MXhQaYh.exe
  2⤵
  PID:5396
- C:\Windows\System\jzDpqTt.exe
  C:\Windows\System\jzDpqTt.exe
  2⤵
  PID:5424
- C:\Windows\System\pTZWAyW.exe
  C:\Windows\System\pTZWAyW.exe
  2⤵
  PID:5448
- C:\Windows\System\FZrEzzL.exe
  C:\Windows\System\FZrEzzL.exe
  2⤵
  PID:5476
- C:\Windows\System\lmfhKhG.exe
  C:\Windows\System\lmfhKhG.exe
  2⤵
  PID:5504
- C:\Windows\System\swmwmAC.exe
  C:\Windows\System\swmwmAC.exe
  2⤵
  PID:5532
- C:\Windows\System\AVBeDKz.exe
  C:\Windows\System\AVBeDKz.exe
  2⤵
  PID:5564
- C:\Windows\System\EUtWOLd.exe
  C:\Windows\System\EUtWOLd.exe
  2⤵
  PID:5588
- C:\Windows\System\iYazLPR.exe
  C:\Windows\System\iYazLPR.exe
  2⤵
  PID:5616
- C:\Windows\System\aQsHgWO.exe
  C:\Windows\System\aQsHgWO.exe
  2⤵
  PID:5656
- C:\Windows\System\STDcSQx.exe
  C:\Windows\System\STDcSQx.exe
  2⤵
  PID:5680
- C:\Windows\System\oTNuJQk.exe
  C:\Windows\System\oTNuJQk.exe
  2⤵
  PID:5704
- C:\Windows\System\wpnSCmr.exe
  C:\Windows\System\wpnSCmr.exe
  2⤵
  PID:5728
- C:\Windows\System\XJZejky.exe
  C:\Windows\System\XJZejky.exe
  2⤵
  PID:5760
- C:\Windows\System\DIMBJJP.exe
  C:\Windows\System\DIMBJJP.exe
  2⤵
  PID:5784
- C:\Windows\System\VjckoWG.exe
  C:\Windows\System\VjckoWG.exe
  2⤵
  PID:5800
- C:\Windows\System\NUAUqVL.exe
  C:\Windows\System\NUAUqVL.exe
  2⤵
  PID:5828
- C:\Windows\System\dLWbpsz.exe
  C:\Windows\System\dLWbpsz.exe
  2⤵
  PID:5856
- C:\Windows\System\HXTkOFo.exe
  C:\Windows\System\HXTkOFo.exe
  2⤵
  PID:5884
- C:\Windows\System\RchTsXu.exe
  C:\Windows\System\RchTsXu.exe
  2⤵
  PID:5924
- C:\Windows\System\ZHSiwCI.exe
  C:\Windows\System\ZHSiwCI.exe
  2⤵
  PID:5952
- C:\Windows\System\cnlrbgv.exe
  C:\Windows\System\cnlrbgv.exe
  2⤵
  PID:5988
- C:\Windows\System\cmtXrdv.exe
  C:\Windows\System\cmtXrdv.exe
  2⤵
  PID:6020
- C:\Windows\System\vNomEGn.exe
  C:\Windows\System\vNomEGn.exe
  2⤵
  PID:6036
- C:\Windows\System\SlPmhwV.exe
  C:\Windows\System\SlPmhwV.exe
  2⤵
  PID:6076
- C:\Windows\System\egqbDdw.exe
  C:\Windows\System\egqbDdw.exe
  2⤵
  PID:6092
- C:\Windows\System\jPAUhkR.exe
  C:\Windows\System\jPAUhkR.exe
  2⤵
  PID:6120
- C:\Windows\System\RHBtIIW.exe
  C:\Windows\System\RHBtIIW.exe
  2⤵
  PID:5124
- C:\Windows\System\UyLCEsC.exe
  C:\Windows\System\UyLCEsC.exe
  2⤵
  PID:5188
- C:\Windows\System\unUtqbH.exe
  C:\Windows\System\unUtqbH.exe
  2⤵
  PID:5232
- C:\Windows\System\XLWZxQF.exe
  C:\Windows\System\XLWZxQF.exe
  2⤵
  PID:4784
- C:\Windows\System\zZyzMhn.exe
  C:\Windows\System\zZyzMhn.exe
  2⤵
  PID:5372
- C:\Windows\System\XZvejob.exe
  C:\Windows\System\XZvejob.exe
  2⤵
  PID:5432
- C:\Windows\System\AOovmrf.exe
  C:\Windows\System\AOovmrf.exe
  2⤵
  PID:5464
- C:\Windows\System\htSjLeq.exe
  C:\Windows\System\htSjLeq.exe
  2⤵
  PID:5560
- C:\Windows\System\ERaudwS.exe
  C:\Windows\System\ERaudwS.exe
  2⤵
  PID:5604
- C:\Windows\System\ENBLdQI.exe
  C:\Windows\System\ENBLdQI.exe
  2⤵
  PID:5688
- C:\Windows\System\oQyKsRs.exe
  C:\Windows\System\oQyKsRs.exe
  2⤵
  PID:5720
- C:\Windows\System\sMPdRhY.exe
  C:\Windows\System\sMPdRhY.exe
  2⤵
  PID:5812
- C:\Windows\System\EPEzPxy.exe
  C:\Windows\System\EPEzPxy.exe
  2⤵
  PID:5900
- C:\Windows\System\hqZtztP.exe
  C:\Windows\System\hqZtztP.exe
  2⤵
  PID:5940
- C:\Windows\System\LdJosQv.exe
  C:\Windows\System\LdJosQv.exe
  2⤵
  PID:6008
- C:\Windows\System\wejAjaz.exe
  C:\Windows\System\wejAjaz.exe
  2⤵
  PID:6072
- C:\Windows\System\RSBgvvj.exe
  C:\Windows\System\RSBgvvj.exe
  2⤵
  PID:1856
- C:\Windows\System\cLCioJQ.exe
  C:\Windows\System\cLCioJQ.exe
  2⤵
  PID:5164
- C:\Windows\System\UdiYxbF.exe
  C:\Windows\System\UdiYxbF.exe
  2⤵
  PID:5416
- C:\Windows\System\Shxlgpq.exe
  C:\Windows\System\Shxlgpq.exe
  2⤵
  PID:5544
- C:\Windows\System\sYDqpKT.exe
  C:\Windows\System\sYDqpKT.exe
  2⤵
  PID:5740
- C:\Windows\System\zpkBAwQ.exe
  C:\Windows\System\zpkBAwQ.exe
  2⤵
  PID:3808
- C:\Windows\System\UtiPlMQ.exe
  C:\Windows\System\UtiPlMQ.exe
  2⤵
  PID:5912
- C:\Windows\System\KKTfpnj.exe
  C:\Windows\System\KKTfpnj.exe
  2⤵
  PID:6060
- C:\Windows\System\RvXNIQl.exe
  C:\Windows\System\RvXNIQl.exe
  2⤵
  PID:5240
- C:\Windows\System\zcjxWVm.exe
  C:\Windows\System\zcjxWVm.exe
  2⤵
  PID:5584
- C:\Windows\System\rKaMWEm.exe
  C:\Windows\System\rKaMWEm.exe
  2⤵
  PID:5724
- C:\Windows\System\uvHyxEt.exe
  C:\Windows\System\uvHyxEt.exe
  2⤵
  PID:6108
- C:\Windows\System\unwRNdO.exe
  C:\Windows\System\unwRNdO.exe
  2⤵
  PID:5292
- C:\Windows\System\IckgvMe.exe
  C:\Windows\System\IckgvMe.exe
  2⤵
  PID:6168
- C:\Windows\System\FfGrDnM.exe
  C:\Windows\System\FfGrDnM.exe
  2⤵
  PID:6188
- C:\Windows\System\HczEOVO.exe
  C:\Windows\System\HczEOVO.exe
  2⤵
  PID:6224
- C:\Windows\System\SyiwgIU.exe
  C:\Windows\System\SyiwgIU.exe
  2⤵
  PID:6256
- C:\Windows\System\uDsgfHZ.exe
  C:\Windows\System\uDsgfHZ.exe
  2⤵
  PID:6280
- C:\Windows\System\ZBmBleT.exe
  C:\Windows\System\ZBmBleT.exe
  2⤵
  PID:6308
- C:\Windows\System\dqMMqbi.exe
  C:\Windows\System\dqMMqbi.exe
  2⤵
  PID:6336
- C:\Windows\System\tkNmWaP.exe
  C:\Windows\System\tkNmWaP.exe
  2⤵
  PID:6368
- C:\Windows\System\pgSZobL.exe
  C:\Windows\System\pgSZobL.exe
  2⤵
  PID:6404
- C:\Windows\System\yAGpbcL.exe
  C:\Windows\System\yAGpbcL.exe
  2⤵
  PID:6420
- C:\Windows\System\SfIwGIE.exe
  C:\Windows\System\SfIwGIE.exe
  2⤵
  PID:6440
- C:\Windows\System\PCCmihb.exe
  C:\Windows\System\PCCmihb.exe
  2⤵
  PID:6472
- C:\Windows\System\iisYJve.exe
  C:\Windows\System\iisYJve.exe
  2⤵
  PID:6492
- C:\Windows\System\fKqnOqb.exe
  C:\Windows\System\fKqnOqb.exe
  2⤵
  PID:6516
- C:\Windows\System\LvVmmTy.exe
  C:\Windows\System\LvVmmTy.exe
  2⤵
  PID:6552
- C:\Windows\System\sjdyPPb.exe
  C:\Windows\System\sjdyPPb.exe
  2⤵
  PID:6576
- C:\Windows\System\YqdEwwY.exe
  C:\Windows\System\YqdEwwY.exe
  2⤵
  PID:6600
- C:\Windows\System\tWphmuz.exe
  C:\Windows\System\tWphmuz.exe
  2⤵
  PID:6644
- C:\Windows\System\dooTcky.exe
  C:\Windows\System\dooTcky.exe
  2⤵
  PID:6660
- C:\Windows\System\loAGtQf.exe
  C:\Windows\System\loAGtQf.exe
  2⤵
  PID:6688
- C:\Windows\System\IJqODKu.exe
  C:\Windows\System\IJqODKu.exe
  2⤵
  PID:6720
- C:\Windows\System\GnqXuaL.exe
  C:\Windows\System\GnqXuaL.exe
  2⤵
  PID:6748
- C:\Windows\System\qtgeVHl.exe
  C:\Windows\System\qtgeVHl.exe
  2⤵
  PID:6772
- C:\Windows\System\wWRcLWS.exe
  C:\Windows\System\wWRcLWS.exe
  2⤵
  PID:6796
- C:\Windows\System\fgbIxoU.exe
  C:\Windows\System\fgbIxoU.exe
  2⤵
  PID:6832
- C:\Windows\System\yggMwoJ.exe
  C:\Windows\System\yggMwoJ.exe
  2⤵
  PID:6860
- C:\Windows\System\TCiAwcm.exe
  C:\Windows\System\TCiAwcm.exe
  2⤵
  PID:6888
- C:\Windows\System\yZcWyTr.exe
  C:\Windows\System\yZcWyTr.exe
  2⤵
  PID:6916
- C:\Windows\System\WujOYKC.exe
  C:\Windows\System\WujOYKC.exe
  2⤵
  PID:6936
- C:\Windows\System\QvPsAKN.exe
  C:\Windows\System\QvPsAKN.exe
  2⤵
  PID:6956
- C:\Windows\System\hHEbroV.exe
  C:\Windows\System\hHEbroV.exe
  2⤵
  PID:6984
- C:\Windows\System\tgiTrVI.exe
  C:\Windows\System\tgiTrVI.exe
  2⤵
  PID:7012
- C:\Windows\System\aPNCYuU.exe
  C:\Windows\System\aPNCYuU.exe
  2⤵
  PID:7044
- C:\Windows\System\sgrjMOU.exe
  C:\Windows\System\sgrjMOU.exe
  2⤵
  PID:7076
- C:\Windows\System\TiFAtwW.exe
  C:\Windows\System\TiFAtwW.exe
  2⤵
  PID:7104
- C:\Windows\System\XzqhSFt.exe
  C:\Windows\System\XzqhSFt.exe
  2⤵
  PID:7136
- C:\Windows\System\emgwDnE.exe
  C:\Windows\System\emgwDnE.exe
  2⤵
  PID:7164
- C:\Windows\System\nQbRbzv.exe
  C:\Windows\System\nQbRbzv.exe
  2⤵
  PID:6204
- C:\Windows\System\XOssuyx.exe
  C:\Windows\System\XOssuyx.exe
  2⤵
  PID:6248
- C:\Windows\System\GbgXvYc.exe
  C:\Windows\System\GbgXvYc.exe
  2⤵
  PID:6296
- C:\Windows\System\HVKuZqE.exe
  C:\Windows\System\HVKuZqE.exe
  2⤵
  PID:6352
- C:\Windows\System\oiuHYQq.exe
  C:\Windows\System\oiuHYQq.exe
  2⤵
  PID:6484
- C:\Windows\System\LwbcuYT.exe
  C:\Windows\System\LwbcuYT.exe
  2⤵
  PID:6504
- C:\Windows\System\OobbEBS.exe
  C:\Windows\System\OobbEBS.exe
  2⤵
  PID:6592
- C:\Windows\System\vhKMAom.exe
  C:\Windows\System\vhKMAom.exe
  2⤵
  PID:6588
- C:\Windows\System\iwMYZOL.exe
  C:\Windows\System\iwMYZOL.exe
  2⤵
  PID:6656
- C:\Windows\System\VGfGusj.exe
  C:\Windows\System\VGfGusj.exe
  2⤵
  PID:6732
- C:\Windows\System\RhaiGxY.exe
  C:\Windows\System\RhaiGxY.exe
  2⤵
  PID:6816
- C:\Windows\System\sNTCSHw.exe
  C:\Windows\System\sNTCSHw.exe
  2⤵
  PID:6908
- C:\Windows\System\QkoAiDS.exe
  C:\Windows\System\QkoAiDS.exe
  2⤵
  PID:6904
- C:\Windows\System\oxmQIsm.exe
  C:\Windows\System\oxmQIsm.exe
  2⤵
  PID:7024
- C:\Windows\System\nfbRubU.exe
  C:\Windows\System\nfbRubU.exe
  2⤵
  PID:7000
- C:\Windows\System\gCXOrpD.exe
  C:\Windows\System\gCXOrpD.exe
  2⤵
  PID:6164
- C:\Windows\System\FbLNXfj.exe
  C:\Windows\System\FbLNXfj.exe
  2⤵
  PID:4428
- C:\Windows\System\MgOBciP.exe
  C:\Windows\System\MgOBciP.exe
  2⤵
  PID:6548
- C:\Windows\System\xsuDahl.exe
  C:\Windows\System\xsuDahl.exe
  2⤵
  PID:6540
- C:\Windows\System\UHNbEyr.exe
  C:\Windows\System\UHNbEyr.exe
  2⤵
  PID:6596
- C:\Windows\System\ZpbnRUt.exe
  C:\Windows\System\ZpbnRUt.exe
  2⤵
  PID:6788
- C:\Windows\System\TzpPpKp.exe
  C:\Windows\System\TzpPpKp.exe
  2⤵
  PID:6952
- C:\Windows\System\hysazvI.exe
  C:\Windows\System\hysazvI.exe
  2⤵
  PID:7156
- C:\Windows\System\WkmTVbu.exe
  C:\Windows\System\WkmTVbu.exe
  2⤵
  PID:6320
- C:\Windows\System\uPGowZw.exe
  C:\Windows\System\uPGowZw.exe
  2⤵
  PID:6652
- C:\Windows\System\IFWeboQ.exe
  C:\Windows\System\IFWeboQ.exe
  2⤵
  PID:7072
- C:\Windows\System\YWRtqkX.exe
  C:\Windows\System\YWRtqkX.exe
  2⤵
  PID:7124
- C:\Windows\System\hCaYxDi.exe
  C:\Windows\System\hCaYxDi.exe
  2⤵
  PID:7192
- C:\Windows\System\VcQpoJO.exe
  C:\Windows\System\VcQpoJO.exe
  2⤵
  PID:7224
- C:\Windows\System\xolWKfl.exe
  C:\Windows\System\xolWKfl.exe
  2⤵
  PID:7244
- C:\Windows\System\tSMQlSI.exe
  C:\Windows\System\tSMQlSI.exe
  2⤵
  PID:7276
- C:\Windows\System\cvoZjOT.exe
  C:\Windows\System\cvoZjOT.exe
  2⤵
  PID:7312
- C:\Windows\System\oWdNkPA.exe
  C:\Windows\System\oWdNkPA.exe
  2⤵
  PID:7340
- C:\Windows\System\crsKrIq.exe
  C:\Windows\System\crsKrIq.exe
  2⤵
  PID:7356
- C:\Windows\System\HkoXArO.exe
  C:\Windows\System\HkoXArO.exe
  2⤵
  PID:7384
- C:\Windows\System\kWGcOQC.exe
  C:\Windows\System\kWGcOQC.exe
  2⤵
  PID:7412
- C:\Windows\System\jvkZeVe.exe
  C:\Windows\System\jvkZeVe.exe
  2⤵
  PID:7444
- C:\Windows\System\sZQcTmB.exe
  C:\Windows\System\sZQcTmB.exe
  2⤵
  PID:7468
- C:\Windows\System\gzRFKxZ.exe
  C:\Windows\System\gzRFKxZ.exe
  2⤵
  PID:7496
- C:\Windows\System\DrGHDqG.exe
  C:\Windows\System\DrGHDqG.exe
  2⤵
  PID:7536
- C:\Windows\System\BTirUyc.exe
  C:\Windows\System\BTirUyc.exe
  2⤵
  PID:7552
- C:\Windows\System\VRFHpvO.exe
  C:\Windows\System\VRFHpvO.exe
  2⤵
  PID:7584
- C:\Windows\System\sMTdbTN.exe
  C:\Windows\System\sMTdbTN.exe
  2⤵
  PID:7612
- C:\Windows\System\htHpGbe.exe
  C:\Windows\System\htHpGbe.exe
  2⤵
  PID:7636
- C:\Windows\System\MTpzfOc.exe
  C:\Windows\System\MTpzfOc.exe
  2⤵
  PID:7664
- C:\Windows\System\sEIhsZL.exe
  C:\Windows\System\sEIhsZL.exe
  2⤵
  PID:7692
- C:\Windows\System\YxaEVVB.exe
  C:\Windows\System\YxaEVVB.exe
  2⤵
  PID:7724
- C:\Windows\System\ZbmiwCZ.exe
  C:\Windows\System\ZbmiwCZ.exe
  2⤵
  PID:7752
- C:\Windows\System\IBSllPy.exe
  C:\Windows\System\IBSllPy.exe
  2⤵
  PID:7772
- C:\Windows\System\jCosyqZ.exe
  C:\Windows\System\jCosyqZ.exe
  2⤵
  PID:7808
- C:\Windows\System\XnsLgHC.exe
  C:\Windows\System\XnsLgHC.exe
  2⤵
  PID:7828
- C:\Windows\System\HMJxwmZ.exe
  C:\Windows\System\HMJxwmZ.exe
  2⤵
  PID:7852
- C:\Windows\System\TfgYdwq.exe
  C:\Windows\System\TfgYdwq.exe
  2⤵
  PID:7880
- C:\Windows\System\NiWXYzk.exe
  C:\Windows\System\NiWXYzk.exe
  2⤵
  PID:7896
- C:\Windows\System\FSTFZpZ.exe
  C:\Windows\System\FSTFZpZ.exe
  2⤵
  PID:7928
- C:\Windows\System\DvPAjuU.exe
  C:\Windows\System\DvPAjuU.exe
  2⤵
  PID:7964
- C:\Windows\System\iTYrHOx.exe
  C:\Windows\System\iTYrHOx.exe
  2⤵
  PID:7988
- C:\Windows\System\sIyrVFp.exe
  C:\Windows\System\sIyrVFp.exe
  2⤵
  PID:8012
- C:\Windows\System\feaXVwF.exe
  C:\Windows\System\feaXVwF.exe
  2⤵
  PID:8036
- C:\Windows\System\YIOnYHR.exe
  C:\Windows\System\YIOnYHR.exe
  2⤵
  PID:8056
- C:\Windows\System\tiFSLmt.exe
  C:\Windows\System\tiFSLmt.exe
  2⤵
  PID:8088
- C:\Windows\System\ojAQwZH.exe
  C:\Windows\System\ojAQwZH.exe
  2⤵
  PID:8108
- C:\Windows\System\gAHelUO.exe
  C:\Windows\System\gAHelUO.exe
  2⤵
  PID:8140
- C:\Windows\System\INnUtOJ.exe
  C:\Windows\System\INnUtOJ.exe
  2⤵
  PID:8168
- C:\Windows\System\jIvCNCt.exe
  C:\Windows\System\jIvCNCt.exe
  2⤵
  PID:7176
- C:\Windows\System\UlJckyU.exe
  C:\Windows\System\UlJckyU.exe
  2⤵
  PID:7240
- C:\Windows\System\yLlxRzy.exe
  C:\Windows\System\yLlxRzy.exe
  2⤵
  PID:7332
- C:\Windows\System\SBkbUqK.exe
  C:\Windows\System\SBkbUqK.exe
  2⤵
  PID:7376
- C:\Windows\System\RTnONxk.exe
  C:\Windows\System\RTnONxk.exe
  2⤵
  PID:7492
- C:\Windows\System\yCCQRFQ.exe
  C:\Windows\System\yCCQRFQ.exe
  2⤵
  PID:7544
- C:\Windows\System\STnBxYa.exe
  C:\Windows\System\STnBxYa.exe
  2⤵
  PID:7628
- C:\Windows\System\OIFFuQb.exe
  C:\Windows\System\OIFFuQb.exe
  2⤵
  PID:7676
- C:\Windows\System\jYZbuhf.exe
  C:\Windows\System\jYZbuhf.exe
  2⤵
  PID:7740
- C:\Windows\System\cAiQPow.exe
  C:\Windows\System\cAiQPow.exe
  2⤵
  PID:7872
- C:\Windows\System\KhmlHNO.exe
  C:\Windows\System\KhmlHNO.exe
  2⤵
  PID:7868
- C:\Windows\System\CcJMWLC.exe
  C:\Windows\System\CcJMWLC.exe
  2⤵
  PID:7980
- C:\Windows\System\GCUzSJo.exe
  C:\Windows\System\GCUzSJo.exe
  2⤵
  PID:8100
- C:\Windows\System\aiiQTbN.exe
  C:\Windows\System\aiiQTbN.exe
  2⤵
  PID:8148
- C:\Windows\System\gspHFha.exe
  C:\Windows\System\gspHFha.exe
  2⤵
  PID:8176
- C:\Windows\System\NrrtZdp.exe
  C:\Windows\System\NrrtZdp.exe
  2⤵
  PID:7324
- C:\Windows\System\YYPLBtz.exe
  C:\Windows\System\YYPLBtz.exe
  2⤵
  PID:7436
- C:\Windows\System\wnAeBoO.exe
  C:\Windows\System\wnAeBoO.exe
  2⤵
  PID:7528
- C:\Windows\System\HuNALcO.exe
  C:\Windows\System\HuNALcO.exe
  2⤵
  PID:7572
- C:\Windows\System\TRxjDHH.exe
  C:\Windows\System\TRxjDHH.exe
  2⤵
  PID:7892
- C:\Windows\System\nXJHUwy.exe
  C:\Windows\System\nXJHUwy.exe
  2⤵
  PID:8004
- C:\Windows\System\hrwiGcr.exe
  C:\Windows\System\hrwiGcr.exe
  2⤵
  PID:8136
- C:\Windows\System\QhsMGFG.exe
  C:\Windows\System\QhsMGFG.exe
  2⤵
  PID:7272
- C:\Windows\System\BiSXzpx.exe
  C:\Windows\System\BiSXzpx.exe
  2⤵
  PID:7684
- C:\Windows\System\cBaJvhz.exe
  C:\Windows\System\cBaJvhz.exe
  2⤵
  PID:7840
- C:\Windows\System\haFvDCs.exe
  C:\Windows\System\haFvDCs.exe
  2⤵
  PID:6460
- C:\Windows\System\OTARMfI.exe
  C:\Windows\System\OTARMfI.exe
  2⤵
  PID:7408
- C:\Windows\System\ZrPlPxg.exe
  C:\Windows\System\ZrPlPxg.exe
  2⤵
  PID:8224
- C:\Windows\System\FHrWHQs.exe
  C:\Windows\System\FHrWHQs.exe
  2⤵
  PID:8260
- C:\Windows\System\BLVUMGz.exe
  C:\Windows\System\BLVUMGz.exe
  2⤵
  PID:8292
- C:\Windows\System\QHsSOCa.exe
  C:\Windows\System\QHsSOCa.exe
  2⤵
  PID:8308
- C:\Windows\System\WoGpWRw.exe
  C:\Windows\System\WoGpWRw.exe
  2⤵
  PID:8332
- C:\Windows\System\dHkfUTv.exe
  C:\Windows\System\dHkfUTv.exe
  2⤵
  PID:8360
- C:\Windows\System\BMfUdjv.exe
  C:\Windows\System\BMfUdjv.exe
  2⤵
  PID:8392
- C:\Windows\System\lxJfdLG.exe
  C:\Windows\System\lxJfdLG.exe
  2⤵
  PID:8416
- C:\Windows\System\uIjECYc.exe
  C:\Windows\System\uIjECYc.exe
  2⤵
  PID:8448
- C:\Windows\System\bovDgWc.exe
  C:\Windows\System\bovDgWc.exe
  2⤵
  PID:8488
- C:\Windows\System\fOZobzq.exe
  C:\Windows\System\fOZobzq.exe
  2⤵
  PID:8524
- C:\Windows\System\oQTaTzx.exe
  C:\Windows\System\oQTaTzx.exe
  2⤵
  PID:8552
- C:\Windows\System\UvJNoca.exe
  C:\Windows\System\UvJNoca.exe
  2⤵
  PID:8572
- C:\Windows\System\JCmERUA.exe
  C:\Windows\System\JCmERUA.exe
  2⤵
  PID:8600
- C:\Windows\System\aPkNksL.exe
  C:\Windows\System\aPkNksL.exe
  2⤵
  PID:8628
- C:\Windows\System\awKndPC.exe
  C:\Windows\System\awKndPC.exe
  2⤵
  PID:8656
- C:\Windows\System\MIZQYId.exe
  C:\Windows\System\MIZQYId.exe
  2⤵
  PID:8692
- C:\Windows\System\hiyTbbY.exe
  C:\Windows\System\hiyTbbY.exe
  2⤵
  PID:8720
- C:\Windows\System\PCtOOmj.exe
  C:\Windows\System\PCtOOmj.exe
  2⤵
  PID:8744
- C:\Windows\System\azXqvkQ.exe
  C:\Windows\System\azXqvkQ.exe
  2⤵
  PID:8776
- C:\Windows\System\iPYkaGT.exe
  C:\Windows\System\iPYkaGT.exe
  2⤵
  PID:8800
- C:\Windows\System\hmCcNCi.exe
  C:\Windows\System\hmCcNCi.exe
  2⤵
  PID:8832
- C:\Windows\System\XTrrCYL.exe
  C:\Windows\System\XTrrCYL.exe
  2⤵
  PID:8864
- C:\Windows\System\zyhhLYF.exe
  C:\Windows\System\zyhhLYF.exe
  2⤵
  PID:8880
- C:\Windows\System\aMXLBNV.exe
  C:\Windows\System\aMXLBNV.exe
  2⤵
  PID:8912
- C:\Windows\System\BtSrJwT.exe
  C:\Windows\System\BtSrJwT.exe
  2⤵
  PID:8940
- C:\Windows\System\fNoifSi.exe
  C:\Windows\System\fNoifSi.exe
  2⤵
  PID:8968
- C:\Windows\System\HvpShqF.exe
  C:\Windows\System\HvpShqF.exe
  2⤵
  PID:9008
- C:\Windows\System\lWLiJDF.exe
  C:\Windows\System\lWLiJDF.exe
  2⤵
  PID:9036
- C:\Windows\System\IDSqSJr.exe
  C:\Windows\System\IDSqSJr.exe
  2⤵
  PID:9064
- C:\Windows\System\buFFWsa.exe
  C:\Windows\System\buFFWsa.exe
  2⤵
  PID:9084
- C:\Windows\System\tyDKBvN.exe
  C:\Windows\System\tyDKBvN.exe
  2⤵
  PID:9108
- C:\Windows\System\dOThVZP.exe
  C:\Windows\System\dOThVZP.exe
  2⤵
  PID:9132
- C:\Windows\System\YjmQybt.exe
  C:\Windows\System\YjmQybt.exe
  2⤵
  PID:9164
- C:\Windows\System\mDYjVKf.exe
  C:\Windows\System\mDYjVKf.exe
  2⤵
  PID:9188
- C:\Windows\System\kArAklR.exe
  C:\Windows\System\kArAklR.exe
  2⤵
  PID:9212
- C:\Windows\System\OhjvSpq.exe
  C:\Windows\System\OhjvSpq.exe
  2⤵
  PID:7760
- C:\Windows\System\xNKVHaF.exe
  C:\Windows\System\xNKVHaF.exe
  2⤵
  PID:8276
- C:\Windows\System\BgmmeYk.exe
  C:\Windows\System\BgmmeYk.exe
  2⤵
  PID:8304
- C:\Windows\System\SCbfpVL.exe
  C:\Windows\System\SCbfpVL.exe
  2⤵
  PID:8400
- C:\Windows\System\DpuGbMG.exe
  C:\Windows\System\DpuGbMG.exe
  2⤵
  PID:8380
- C:\Windows\System\WzAMgOR.exe
  C:\Windows\System\WzAMgOR.exe
  2⤵
  PID:8476
- C:\Windows\System\BJWHCvh.exe
  C:\Windows\System\BJWHCvh.exe
  2⤵
  PID:8560
- C:\Windows\System\Furkttd.exe
  C:\Windows\System\Furkttd.exe
  2⤵
  PID:8652
- C:\Windows\System\WNhYqpd.exe
  C:\Windows\System\WNhYqpd.exe
  2⤵
  PID:8684
- C:\Windows\System\LwTqpuK.exe
  C:\Windows\System\LwTqpuK.exe
  2⤵
  PID:8736
- C:\Windows\System\uvurprL.exe
  C:\Windows\System\uvurprL.exe
  2⤵
  PID:8844
- C:\Windows\System\gwgHDtj.exe
  C:\Windows\System\gwgHDtj.exe
  2⤵
  PID:8896
- C:\Windows\System\yXrTrZm.exe
  C:\Windows\System\yXrTrZm.exe
  2⤵
  PID:8992
- C:\Windows\System\liitFYi.exe
  C:\Windows\System\liitFYi.exe
  2⤵
  PID:9020
- C:\Windows\System\EsYHRKL.exe
  C:\Windows\System\EsYHRKL.exe
  2⤵
  PID:9080
- C:\Windows\System\rFumciS.exe
  C:\Windows\System\rFumciS.exe
  2⤵
  PID:9152
- C:\Windows\System\fyXHNZX.exe
  C:\Windows\System\fyXHNZX.exe
  2⤵
  PID:9204
- C:\Windows\System\GuPnTFY.exe
  C:\Windows\System\GuPnTFY.exe
  2⤵
  PID:8328
- C:\Windows\System\zuFLSFy.exe
  C:\Windows\System\zuFLSFy.exe
  2⤵
  PID:8388
- C:\Windows\System\RuvfpnD.exe
  C:\Windows\System\RuvfpnD.exe
  2⤵
  PID:8668
- C:\Windows\System\xbBfcxG.exe
  C:\Windows\System\xbBfcxG.exe
  2⤵
  PID:8732
- C:\Windows\System\VIpmVUb.exe
  C:\Windows\System\VIpmVUb.exe
  2⤵
  PID:8848
- C:\Windows\System\jpNIXnM.exe
  C:\Windows\System\jpNIXnM.exe
  2⤵
  PID:8904
- C:\Windows\System\hIgTewY.exe
  C:\Windows\System\hIgTewY.exe
  2⤵
  PID:8272
- C:\Windows\System\liMKAMM.exe
  C:\Windows\System\liMKAMM.exe
  2⤵
  PID:8676
- C:\Windows\System\NvVzaSj.exe
  C:\Windows\System\NvVzaSj.exe
  2⤵
  PID:8796
- C:\Windows\System\lnPtLyy.exe
  C:\Windows\System\lnPtLyy.exe
  2⤵
  PID:8820
- C:\Windows\System\hSgjmiM.exe
  C:\Windows\System\hSgjmiM.exe
  2⤵
  PID:9236
- C:\Windows\System\HNXsqJr.exe
  C:\Windows\System\HNXsqJr.exe
  2⤵
  PID:9268
- C:\Windows\System\KdxeMGm.exe
  C:\Windows\System\KdxeMGm.exe
  2⤵
  PID:9304
- C:\Windows\System\dvywIxh.exe
  C:\Windows\System\dvywIxh.exe
  2⤵
  PID:9328
- C:\Windows\System\xbNwsUd.exe
  C:\Windows\System\xbNwsUd.exe
  2⤵
  PID:9364
- C:\Windows\System\pwRPAVx.exe
  C:\Windows\System\pwRPAVx.exe
  2⤵
  PID:9392
- C:\Windows\System\cofiFEA.exe
  C:\Windows\System\cofiFEA.exe
  2⤵
  PID:9428
- C:\Windows\System\ZlyhHcK.exe
  C:\Windows\System\ZlyhHcK.exe
  2⤵
  PID:9452
- C:\Windows\System\TFMiMkU.exe
  C:\Windows\System\TFMiMkU.exe
  2⤵
  PID:9476
- C:\Windows\System\PfCttpm.exe
  C:\Windows\System\PfCttpm.exe
  2⤵
  PID:9504
- C:\Windows\System\RWHBFUh.exe
  C:\Windows\System\RWHBFUh.exe
  2⤵
  PID:9532
- C:\Windows\System\mohXtWm.exe
  C:\Windows\System\mohXtWm.exe
  2⤵
  PID:9560
- C:\Windows\System\SxlLMve.exe
  C:\Windows\System\SxlLMve.exe
  2⤵
  PID:9588
- C:\Windows\System\rRqCnux.exe
  C:\Windows\System\rRqCnux.exe
  2⤵
  PID:9616
- C:\Windows\System\pYZGUMN.exe
  C:\Windows\System\pYZGUMN.exe
  2⤵
  PID:9644
- C:\Windows\System\hqLAtEb.exe
  C:\Windows\System\hqLAtEb.exe
  2⤵
  PID:9680
- C:\Windows\System\cdyZmfL.exe
  C:\Windows\System\cdyZmfL.exe
  2⤵
  PID:9700
- C:\Windows\System\CPjgzbd.exe
  C:\Windows\System\CPjgzbd.exe
  2⤵
  PID:9728
- C:\Windows\System\mncfhjD.exe
  C:\Windows\System\mncfhjD.exe
  2⤵
  PID:9748
- C:\Windows\System\juMLAXQ.exe
  C:\Windows\System\juMLAXQ.exe
  2⤵
  PID:9772
- C:\Windows\System\nExGlmU.exe
  C:\Windows\System\nExGlmU.exe
  2⤵
  PID:9788
- C:\Windows\System\cpUWsqx.exe
  C:\Windows\System\cpUWsqx.exe
  2⤵
  PID:9816
- C:\Windows\System\AYCUysw.exe
  C:\Windows\System\AYCUysw.exe
  2⤵
  PID:9848
- C:\Windows\System\xApbUUC.exe
  C:\Windows\System\xApbUUC.exe
  2⤵
  PID:9872
- C:\Windows\System\gnziBZE.exe
  C:\Windows\System\gnziBZE.exe
  2⤵
  PID:9900
- C:\Windows\System\nNRqKPS.exe
  C:\Windows\System\nNRqKPS.exe
  2⤵
  PID:9928
- C:\Windows\System\QktKDlD.exe
  C:\Windows\System\QktKDlD.exe
  2⤵
  PID:9956
- C:\Windows\System\xKcDdhj.exe
  C:\Windows\System\xKcDdhj.exe
  2⤵
  PID:9988
- C:\Windows\System\IknwdIf.exe
  C:\Windows\System\IknwdIf.exe
  2⤵
  PID:10008
- C:\Windows\System\vTCXZXO.exe
  C:\Windows\System\vTCXZXO.exe
  2⤵
  PID:10040
- C:\Windows\System\TXzTJVP.exe
  C:\Windows\System\TXzTJVP.exe
  2⤵
  PID:10060
- C:\Windows\System\APjXVBk.exe
  C:\Windows\System\APjXVBk.exe
  2⤵
  PID:10084
- C:\Windows\System\cReMoex.exe
  C:\Windows\System\cReMoex.exe
  2⤵
  PID:10116
- C:\Windows\System\cIQwSeP.exe
  C:\Windows\System\cIQwSeP.exe
  2⤵
  PID:10148
- C:\Windows\System\jtcCLHA.exe
  C:\Windows\System\jtcCLHA.exe
  2⤵
  PID:10184
- C:\Windows\System\NUOWFbv.exe
  C:\Windows\System\NUOWFbv.exe
  2⤵
  PID:10204
- C:\Windows\System\GMIfYch.exe
  C:\Windows\System\GMIfYch.exe
  2⤵
  PID:8468
- C:\Windows\System\BwxSNMv.exe
  C:\Windows\System\BwxSNMv.exe
  2⤵
  PID:8460
- C:\Windows\System\GegEORj.exe
  C:\Windows\System\GegEORj.exe
  2⤵
  PID:9316
- C:\Windows\System\gnPQVgB.exe
  C:\Windows\System\gnPQVgB.exe
  2⤵
  PID:9380
- C:\Windows\System\bWacQcj.exe
  C:\Windows\System\bWacQcj.exe
  2⤵
  PID:9468
- C:\Windows\System\HFQxDJY.exe
  C:\Windows\System\HFQxDJY.exe
  2⤵
  PID:9516
- C:\Windows\System\sRQBiPf.exe
  C:\Windows\System\sRQBiPf.exe
  2⤵
  PID:9580
- C:\Windows\System\cnUmVeN.exe
  C:\Windows\System\cnUmVeN.exe
  2⤵
  PID:9640
- C:\Windows\System\SVnkfwd.exe
  C:\Windows\System\SVnkfwd.exe
  2⤵
  PID:9724
- C:\Windows\System\yEvHwBy.exe
  C:\Windows\System\yEvHwBy.exe
  2⤵
  PID:9812
- C:\Windows\System\WcsfLtu.exe
  C:\Windows\System\WcsfLtu.exe
  2⤵
  PID:9832
- C:\Windows\System\rRorDoT.exe
  C:\Windows\System\rRorDoT.exe
  2⤵
  PID:9948
- C:\Windows\System\KxYIZRo.exe
  C:\Windows\System\KxYIZRo.exe
  2⤵
  PID:10020
- C:\Windows\System\CqYbxWT.exe
  C:\Windows\System\CqYbxWT.exe
  2⤵
  PID:10080
- C:\Windows\System\kENeTek.exe
  C:\Windows\System\kENeTek.exe
  2⤵
  PID:10076
- C:\Windows\System\KtEtKdh.exe
  C:\Windows\System\KtEtKdh.exe
  2⤵
  PID:10216
- C:\Windows\System\BXvzAlf.exe
  C:\Windows\System\BXvzAlf.exe
  2⤵
  PID:9300
- C:\Windows\System\ZUqNnhk.exe
  C:\Windows\System\ZUqNnhk.exe
  2⤵
  PID:9384
- C:\Windows\System\XAnkWrn.exe
  C:\Windows\System\XAnkWrn.exe
  2⤵
  PID:9576
- C:\Windows\System\VdVOEEo.exe
  C:\Windows\System\VdVOEEo.exe
  2⤵
  PID:9836
- C:\Windows\System\UUGePWb.exe
  C:\Windows\System\UUGePWb.exe
  2⤵
  PID:9884
- C:\Windows\System\WxMhZma.exe
  C:\Windows\System\WxMhZma.exe
  2⤵
  PID:10056
- C:\Windows\System\kCzwYxD.exe
  C:\Windows\System\kCzwYxD.exe
  2⤵
  PID:10200
- C:\Windows\System\uVHZKPd.exe
  C:\Windows\System\uVHZKPd.exe
  2⤵
  PID:9500
- C:\Windows\System\NkQbKOt.exe
  C:\Windows\System\NkQbKOt.exe
  2⤵
  PID:9824
- C:\Windows\System\GRnUziv.exe
  C:\Windows\System\GRnUziv.exe
  2⤵
  PID:10036
- C:\Windows\System\gSweaCa.exe
  C:\Windows\System\gSweaCa.exe
  2⤵
  PID:9660
- C:\Windows\System\PdQkQRh.exe
  C:\Windows\System\PdQkQRh.exe
  2⤵
  PID:10272
- C:\Windows\System\UritiFI.exe
  C:\Windows\System\UritiFI.exe
  2⤵
  PID:10292
- C:\Windows\System\AbwMxqM.exe
  C:\Windows\System\AbwMxqM.exe
  2⤵
  PID:10320
- C:\Windows\System\TUvJVZE.exe
  C:\Windows\System\TUvJVZE.exe
  2⤵
  PID:10348
- C:\Windows\System\RepIXkX.exe
  C:\Windows\System\RepIXkX.exe
  2⤵
  PID:10376
- C:\Windows\System\FIIkGQC.exe
  C:\Windows\System\FIIkGQC.exe
  2⤵
  PID:10396
- C:\Windows\System\sWmaEMh.exe
  C:\Windows\System\sWmaEMh.exe
  2⤵
  PID:10416
- C:\Windows\System\aJeKSQS.exe
  C:\Windows\System\aJeKSQS.exe
  2⤵
  PID:10448
- C:\Windows\System\TbUaeIu.exe
  C:\Windows\System\TbUaeIu.exe
  2⤵
  PID:10472
- C:\Windows\System\znVJfpP.exe
  C:\Windows\System\znVJfpP.exe
  2⤵
  PID:10496
- C:\Windows\System\PdmTWgy.exe
  C:\Windows\System\PdmTWgy.exe
  2⤵
  PID:10516
- C:\Windows\System\rgORQRK.exe
  C:\Windows\System\rgORQRK.exe
  2⤵
  PID:10532
- C:\Windows\System\GBGpCEC.exe
  C:\Windows\System\GBGpCEC.exe
  2⤵
  PID:10556
- C:\Windows\System\yerWqpB.exe
  C:\Windows\System\yerWqpB.exe
  2⤵
  PID:10592
- C:\Windows\System\OFNSdxr.exe
  C:\Windows\System\OFNSdxr.exe
  2⤵
  PID:10616
- C:\Windows\System\eaDSjmA.exe
  C:\Windows\System\eaDSjmA.exe
  2⤵
  PID:10652
- C:\Windows\System\noOhVqH.exe
  C:\Windows\System\noOhVqH.exe
  2⤵
  PID:10700
- C:\Windows\System\OVVxOPI.exe
  C:\Windows\System\OVVxOPI.exe
  2⤵
  PID:10720
- C:\Windows\System\CaMdHlX.exe
  C:\Windows\System\CaMdHlX.exe
  2⤵
  PID:10756
- C:\Windows\System\jOdaGYH.exe
  C:\Windows\System\jOdaGYH.exe
  2⤵
  PID:10780
- C:\Windows\System\wIgOzYn.exe
  C:\Windows\System\wIgOzYn.exe
  2⤵
  PID:10808
- C:\Windows\System\GCNfrGn.exe
  C:\Windows\System\GCNfrGn.exe
  2⤵
  PID:10836
- C:\Windows\System\TmBXYiu.exe
  C:\Windows\System\TmBXYiu.exe
  2⤵
  PID:10856
- C:\Windows\System\mexavPw.exe
  C:\Windows\System\mexavPw.exe
  2⤵
  PID:10880
- C:\Windows\System\yVUMmtz.exe
  C:\Windows\System\yVUMmtz.exe
  2⤵
  PID:10900
- C:\Windows\System\GODKCqK.exe
  C:\Windows\System\GODKCqK.exe
  2⤵
  PID:10928
- C:\Windows\System\PpLvHbF.exe
  C:\Windows\System\PpLvHbF.exe
  2⤵
  PID:10952
- C:\Windows\System\HeZnUZv.exe
  C:\Windows\System\HeZnUZv.exe
  2⤵
  PID:10980
- C:\Windows\System\cJpwuco.exe
  C:\Windows\System\cJpwuco.exe
  2⤵
  PID:11000
- C:\Windows\System\QSAGOFG.exe
  C:\Windows\System\QSAGOFG.exe
  2⤵
  PID:11028
- C:\Windows\System\CDmjbIf.exe
  C:\Windows\System\CDmjbIf.exe
  2⤵
  PID:11060
- C:\Windows\System\mLjRyos.exe
  C:\Windows\System\mLjRyos.exe
  2⤵
  PID:11088
- C:\Windows\System\PFEDotl.exe
  C:\Windows\System\PFEDotl.exe
  2⤵
  PID:11116
- C:\Windows\System\QJnaxKw.exe
  C:\Windows\System\QJnaxKw.exe
  2⤵
  PID:11160
- C:\Windows\System\iWcMAxt.exe
  C:\Windows\System\iWcMAxt.exe
  2⤵
  PID:11184
- C:\Windows\System\GOPSWwc.exe
  C:\Windows\System\GOPSWwc.exe
  2⤵
  PID:11220
- C:\Windows\System\IAebPEK.exe
  C:\Windows\System\IAebPEK.exe
  2⤵
  PID:11240
- C:\Windows\System\bFHDNFa.exe
  C:\Windows\System\bFHDNFa.exe
  2⤵
  PID:9800
- C:\Windows\System\JdNPCcj.exe
  C:\Windows\System\JdNPCcj.exe
  2⤵
  PID:10284
- C:\Windows\System\BzfFaqC.exe
  C:\Windows\System\BzfFaqC.exe
  2⤵
  PID:10340
- C:\Windows\System\errEErl.exe
  C:\Windows\System\errEErl.exe
  2⤵
  PID:10364
- C:\Windows\System\xtDAprE.exe
  C:\Windows\System\xtDAprE.exe
  2⤵
  PID:10468
- C:\Windows\System\aGZqgnL.exe
  C:\Windows\System\aGZqgnL.exe
  2⤵
  PID:10544
- C:\Windows\System\KVRRfRU.exe
  C:\Windows\System\KVRRfRU.exe
  2⤵
  PID:10680
- C:\Windows\System\FaYrrMd.exe
  C:\Windows\System\FaYrrMd.exe
  2⤵
  PID:10696
- C:\Windows\System\qNnJpGG.exe
  C:\Windows\System\qNnJpGG.exe
  2⤵
  PID:10764
- C:\Windows\System\oxPgaCa.exe
  C:\Windows\System\oxPgaCa.exe
  2⤵
  PID:10736
- C:\Windows\System\TpMVXjr.exe
  C:\Windows\System\TpMVXjr.exe
  2⤵
  PID:10944
- C:\Windows\System\qUHofXw.exe
  C:\Windows\System\qUHofXw.exe
  2⤵
  PID:10964
- C:\Windows\System\pHJgmJg.exe
  C:\Windows\System\pHJgmJg.exe
  2⤵
  PID:11076
- C:\Windows\System\vdNZHUy.exe
  C:\Windows\System\vdNZHUy.exe
  2⤵
  PID:11052
- C:\Windows\System\HQaLzNh.exe
  C:\Windows\System\HQaLzNh.exe
  2⤵
  PID:11112
- C:\Windows\System\tZJWhMC.exe
  C:\Windows\System\tZJWhMC.exe
  2⤵
  PID:9920
- C:\Windows\System\mJskddL.exe
  C:\Windows\System\mJskddL.exe
  2⤵
  PID:10392
- C:\Windows\System\kPqdZmO.exe
  C:\Windows\System\kPqdZmO.exe
  2⤵
  PID:10444
- C:\Windows\System\uuuuefs.exe
  C:\Windows\System\uuuuefs.exe
  2⤵
  PID:10640
- C:\Windows\System\VVxKDFY.exe
  C:\Windows\System\VVxKDFY.exe
  2⤵
  PID:10796
- C:\Windows\System\kdaovxn.exe
  C:\Windows\System\kdaovxn.exe
  2⤵
  PID:10820
- C:\Windows\System\dYYgDln.exe
  C:\Windows\System\dYYgDln.exe
  2⤵
  PID:10976
- C:\Windows\System\kvfprBL.exe
  C:\Windows\System\kvfprBL.exe
  2⤵
  PID:11256
- C:\Windows\System\hbnBkaW.exe
  C:\Windows\System\hbnBkaW.exe
  2⤵
  PID:10264
- C:\Windows\System\EzrJYuz.exe
  C:\Windows\System\EzrJYuz.exe
  2⤵
  PID:10664
- C:\Windows\System\vNMudpC.exe
  C:\Windows\System\vNMudpC.exe
  2⤵
  PID:11268
- C:\Windows\System\hgaOnsu.exe
  C:\Windows\System\hgaOnsu.exe
  2⤵
  PID:11292
- C:\Windows\System\wPawtxS.exe
  C:\Windows\System\wPawtxS.exe
  2⤵
  PID:11308
- C:\Windows\System\oGCOFsj.exe
  C:\Windows\System\oGCOFsj.exe
  2⤵
  PID:11340
- C:\Windows\System\zScAKmq.exe
  C:\Windows\System\zScAKmq.exe
  2⤵
  PID:11368
- C:\Windows\System\ZeArckh.exe
  C:\Windows\System\ZeArckh.exe
  2⤵
  PID:11400
- C:\Windows\System\zmZbVHh.exe
  C:\Windows\System\zmZbVHh.exe
  2⤵
  PID:11424
- C:\Windows\System\zoUVxSd.exe
  C:\Windows\System\zoUVxSd.exe
  2⤵
  PID:11452
- C:\Windows\System\oKcHnvN.exe
  C:\Windows\System\oKcHnvN.exe
  2⤵
  PID:11468
- C:\Windows\System\zWEYYqO.exe
  C:\Windows\System\zWEYYqO.exe
  2⤵
  PID:11492
- C:\Windows\System\sUCUulE.exe
  C:\Windows\System\sUCUulE.exe
  2⤵
  PID:11524
- C:\Windows\System\mmKWDTt.exe
  C:\Windows\System\mmKWDTt.exe
  2⤵
  PID:11552
- C:\Windows\System\drluXiw.exe
  C:\Windows\System\drluXiw.exe
  2⤵
  PID:11580
- C:\Windows\System\avRVGzX.exe
  C:\Windows\System\avRVGzX.exe
  2⤵
  PID:11612
- C:\Windows\System\ffkWtCt.exe
  C:\Windows\System\ffkWtCt.exe
  2⤵
  PID:11648
- C:\Windows\System\mIkxwpV.exe
  C:\Windows\System\mIkxwpV.exe
  2⤵
  PID:11672
- C:\Windows\System\hTRNWAC.exe
  C:\Windows\System\hTRNWAC.exe
  2⤵
  PID:11700
- C:\Windows\System\HkiOPHY.exe
  C:\Windows\System\HkiOPHY.exe
  2⤵
  PID:11736
- C:\Windows\System\cHkjfGa.exe
  C:\Windows\System\cHkjfGa.exe
  2⤵
  PID:11776
- C:\Windows\System\NzRpNgM.exe
  C:\Windows\System\NzRpNgM.exe
  2⤵
  PID:11792
- C:\Windows\System\pxBzjEH.exe
  C:\Windows\System\pxBzjEH.exe
  2⤵
  PID:11808
- C:\Windows\System\tPmQGty.exe
  C:\Windows\System\tPmQGty.exe
  2⤵
  PID:11828
- C:\Windows\System\icStOVi.exe
  C:\Windows\System\icStOVi.exe
  2⤵
  PID:11848
- C:\Windows\System\QLOBPMD.exe
  C:\Windows\System\QLOBPMD.exe
  2⤵
  PID:11876
- C:\Windows\System\ucsnODT.exe
  C:\Windows\System\ucsnODT.exe
  2⤵
  PID:11900
- C:\Windows\System\ycwwFUx.exe
  C:\Windows\System\ycwwFUx.exe
  2⤵
  PID:11924
- C:\Windows\System\mzWvZBR.exe
  C:\Windows\System\mzWvZBR.exe
  2⤵
  PID:11968
- C:\Windows\System\oMgiSLE.exe
  C:\Windows\System\oMgiSLE.exe
  2⤵
  PID:12000
- C:\Windows\System\ORcQhdh.exe
  C:\Windows\System\ORcQhdh.exe
  2⤵
  PID:12036
- C:\Windows\System\neQIQyr.exe
  C:\Windows\System\neQIQyr.exe
  2⤵
  PID:12064
- C:\Windows\System\wKwYhks.exe
  C:\Windows\System\wKwYhks.exe
  2⤵
  PID:12096
- C:\Windows\System\eDNecgv.exe
  C:\Windows\System\eDNecgv.exe
  2⤵
  PID:12132
- C:\Windows\System\ecQmwZv.exe
  C:\Windows\System\ecQmwZv.exe
  2⤵
  PID:12156
- C:\Windows\System\bgUACVn.exe
  C:\Windows\System\bgUACVn.exe
  2⤵
  PID:12192
- C:\Windows\System\iLNkjqr.exe
  C:\Windows\System\iLNkjqr.exe
  2⤵
  PID:12220
- C:\Windows\System\EvVWFhH.exe
  C:\Windows\System\EvVWFhH.exe
  2⤵
  PID:12256
- C:\Windows\System\PRnhuuo.exe
  C:\Windows\System\PRnhuuo.exe
  2⤵
  PID:12272
- C:\Windows\System\XBdiEhf.exe
  C:\Windows\System\XBdiEhf.exe
  2⤵
  PID:10608
- C:\Windows\System\zxPDRxG.exe
  C:\Windows\System\zxPDRxG.exe
  2⤵
  PID:11280
- C:\Windows\System\PSrFPka.exe
  C:\Windows\System\PSrFPka.exe
  2⤵
  PID:11364
- C:\Windows\System\eEmAXfr.exe
  C:\Windows\System\eEmAXfr.exe
  2⤵
  PID:11420
- C:\Windows\System\vNRnWpG.exe
  C:\Windows\System\vNRnWpG.exe
  2⤵
  PID:11484
- C:\Windows\System\SCrdYbW.exe
  C:\Windows\System\SCrdYbW.exe
  2⤵
  PID:11480
- C:\Windows\System\nSOTlLj.exe
  C:\Windows\System\nSOTlLj.exe
  2⤵
  PID:11628
- C:\Windows\System\DKmrNYv.exe
  C:\Windows\System\DKmrNYv.exe
  2⤵
  PID:11668
- C:\Windows\System\GsEViXU.exe
  C:\Windows\System\GsEViXU.exe
  2⤵
  PID:11720
- C:\Windows\System\iEJocSQ.exe
  C:\Windows\System\iEJocSQ.exe
  2⤵
  PID:11768
- C:\Windows\System\xYezgpG.exe
  C:\Windows\System\xYezgpG.exe
  2⤵
  PID:11840
- C:\Windows\System\RAoNeLO.exe
  C:\Windows\System\RAoNeLO.exe
  2⤵
  PID:11948
- C:\Windows\System\SpkxLuS.exe
  C:\Windows\System\SpkxLuS.exe
  2⤵
  PID:11980
- C:\Windows\System\wLZOuco.exe
  C:\Windows\System\wLZOuco.exe
  2⤵
  PID:12120
- C:\Windows\System\YAcXCOw.exe
  C:\Windows\System\YAcXCOw.exe
  2⤵
  PID:12148
- C:\Windows\System\EMyrVFb.exe
  C:\Windows\System\EMyrVFb.exe
  2⤵
  PID:12176
- C:\Windows\System\MLxOyom.exe
  C:\Windows\System\MLxOyom.exe
  2⤵
  PID:12236
- C:\Windows\System\pmTirbH.exe
  C:\Windows\System\pmTirbH.exe
  2⤵
  PID:10688
- C:\Windows\System\hmEHXMn.exe
  C:\Windows\System\hmEHXMn.exe
  2⤵
  PID:11508
- C:\Windows\System\kZkMpyW.exe
  C:\Windows\System\kZkMpyW.exe
  2⤵
  PID:11520
- C:\Windows\System\jtpNOCu.exe
  C:\Windows\System\jtpNOCu.exe
  2⤵
  PID:11824
- C:\Windows\System\AUFLSMF.exe
  C:\Windows\System\AUFLSMF.exe
  2⤵
  PID:11984
- C:\Windows\System\IvAcmIz.exe
  C:\Windows\System\IvAcmIz.exe
  2⤵
  PID:12108
- C:\Windows\System\HGSEuCm.exe
  C:\Windows\System\HGSEuCm.exe
  2⤵
  PID:12248
- C:\Windows\System\QyEZkmS.exe
  C:\Windows\System\QyEZkmS.exe
  2⤵
  PID:10992
- C:\Windows\System\BXRVopu.exe
  C:\Windows\System\BXRVopu.exe
  2⤵
  PID:11644
- C:\Windows\System\hKqnOQD.exe
  C:\Windows\System\hKqnOQD.exe
  2⤵
  PID:12056
- C:\Windows\System\JwzGCQk.exe
  C:\Windows\System\JwzGCQk.exe
  2⤵
  PID:11380
- C:\Windows\System\GfgMAEz.exe
  C:\Windows\System\GfgMAEz.exe
  2⤵
  PID:12312
- C:\Windows\System\wljevEF.exe
  C:\Windows\System\wljevEF.exe
  2⤵
  PID:12328
- C:\Windows\System\NkriaAC.exe
  C:\Windows\System\NkriaAC.exe
  2⤵
  PID:12344
- C:\Windows\System\xozmmlO.exe
  C:\Windows\System\xozmmlO.exe
  2⤵
  PID:12368
- C:\Windows\System\vaSchrp.exe
  C:\Windows\System\vaSchrp.exe
  2⤵
  PID:12404
- C:\Windows\System\NlgJSaa.exe
  C:\Windows\System\NlgJSaa.exe
  2⤵
  PID:12436
- C:\Windows\System\klfjNHV.exe
  C:\Windows\System\klfjNHV.exe
  2⤵
  PID:12460
- C:\Windows\System\VQILZLp.exe
  C:\Windows\System\VQILZLp.exe
  2⤵
  PID:12492
- C:\Windows\System\XXFybSr.exe
  C:\Windows\System\XXFybSr.exe
  2⤵
  PID:12524
- C:\Windows\System\UCEjOVk.exe
  C:\Windows\System\UCEjOVk.exe
  2⤵
  PID:12544
- C:\Windows\System\HcCzzwj.exe
  C:\Windows\System\HcCzzwj.exe
  2⤵
  PID:12572
- C:\Windows\System\NyEuQBk.exe
  C:\Windows\System\NyEuQBk.exe
  2⤵
  PID:12600
- C:\Windows\System\pEvcrYU.exe
  C:\Windows\System\pEvcrYU.exe
  2⤵
  PID:12624
- C:\Windows\System\AYgSjQJ.exe
  C:\Windows\System\AYgSjQJ.exe
  2⤵
  PID:12664
- C:\Windows\System\IBlqDkY.exe
  C:\Windows\System\IBlqDkY.exe
  2⤵
  PID:12700
- C:\Windows\System\hHDgpzA.exe
  C:\Windows\System\hHDgpzA.exe
  2⤵
  PID:12720
- C:\Windows\System\ubMMDdC.exe
  C:\Windows\System\ubMMDdC.exe
  2⤵
  PID:12748
- C:\Windows\System\vmiVFAG.exe
  C:\Windows\System\vmiVFAG.exe
  2⤵
  PID:12776
- C:\Windows\System\NTmMaMA.exe
  C:\Windows\System\NTmMaMA.exe
  2⤵
  PID:12808
- C:\Windows\System\vtZOkOx.exe
  C:\Windows\System\vtZOkOx.exe
  2⤵
  PID:12844
- C:\Windows\System\sLyxQSI.exe
  C:\Windows\System\sLyxQSI.exe
  2⤵
  PID:12860
- C:\Windows\System\giRvTCd.exe
  C:\Windows\System\giRvTCd.exe
  2⤵
  PID:12896
- C:\Windows\System\JxKlqUU.exe
  C:\Windows\System\JxKlqUU.exe
  2⤵
  PID:12916
- C:\Windows\System\GhAqgEk.exe
  C:\Windows\System\GhAqgEk.exe
  2⤵
  PID:12952
- C:\Windows\System\JbrUYMA.exe
  C:\Windows\System\JbrUYMA.exe
  2⤵
  PID:12976
- C:\Windows\System\sQXnFgx.exe
  C:\Windows\System\sQXnFgx.exe
  2⤵
  PID:13016
- C:\Windows\System\qHDoUIl.exe
  C:\Windows\System\qHDoUIl.exe
  2⤵
  PID:13040
- C:\Windows\System\rGonYFT.exe
  C:\Windows\System\rGonYFT.exe
  2⤵
  PID:13060
- C:\Windows\System\vvYUyOy.exe
  C:\Windows\System\vvYUyOy.exe
  2⤵
  PID:13096
- C:\Windows\System\Iulrubg.exe
  C:\Windows\System\Iulrubg.exe
  2⤵
  PID:13128
- C:\Windows\System\mZmgWpK.exe
  C:\Windows\System\mZmgWpK.exe
  2⤵
  PID:13156
- C:\Windows\System\CsjYcSz.exe
  C:\Windows\System\CsjYcSz.exe
  2⤵
  PID:13184
- C:\Windows\System\qETAgAL.exe
  C:\Windows\System\qETAgAL.exe
  2⤵
  PID:13208
- C:\Windows\System\eFGWgCu.exe
  C:\Windows\System\eFGWgCu.exe
  2⤵
  PID:13236
- C:\Windows\System\BgtyYtq.exe
  C:\Windows\System\BgtyYtq.exe
  2⤵
  PID:13264
- C:\Windows\System\WXLQihJ.exe
  C:\Windows\System\WXLQihJ.exe
  2⤵
  PID:13292
- C:\Windows\System\LNvNhKN.exe
  C:\Windows\System\LNvNhKN.exe
  2⤵
  PID:12072
- C:\Windows\System\XpWjYiY.exe
  C:\Windows\System\XpWjYiY.exe
  2⤵
  PID:12340
- C:\Windows\System\paevFyT.exe
  C:\Windows\System\paevFyT.exe
  2⤵
  PID:12416
- C:\Windows\System\vhBoivb.exe
  C:\Windows\System\vhBoivb.exe
  2⤵
  PID:12480
- C:\Windows\System\YiuxnaV.exe
  C:\Windows\System\YiuxnaV.exe
  2⤵
  PID:12552
- C:\Windows\System\tKGfIuQ.exe
  C:\Windows\System\tKGfIuQ.exe
  2⤵
  PID:12592
- C:\Windows\System\CJzlwGr.exe
  C:\Windows\System\CJzlwGr.exe
  2⤵
  PID:12612
- C:\Windows\System\vTKSbXK.exe
  C:\Windows\System\vTKSbXK.exe
  2⤵
  PID:12732
- C:\Windows\System\lkoLoUF.exe
  C:\Windows\System\lkoLoUF.exe
  2⤵
  PID:12764
- C:\Windows\System\vMQMXtD.exe
  C:\Windows\System\vMQMXtD.exe
  2⤵
  PID:12824
- C:\Windows\System\SMNzrOf.exe
  C:\Windows\System\SMNzrOf.exe
  2⤵
  PID:12852
- C:\Windows\System\IxjVALq.exe
  C:\Windows\System\IxjVALq.exe
  2⤵
  PID:12984
- C:\Windows\System\BqEZfcn.exe
  C:\Windows\System\BqEZfcn.exe
  2⤵
  PID:13048
- C:\Windows\System\ZhXtfrF.exe
  C:\Windows\System\ZhXtfrF.exe
  2⤵
  PID:13084
- C:\Windows\System\IjEKYbc.exe
  C:\Windows\System\IjEKYbc.exe
  2⤵
  PID:13180
- C:\Windows\System\bXCLNwp.exe
  C:\Windows\System\bXCLNwp.exe
  2⤵
  PID:13256
- C:\Windows\System\trdhAnW.exe
  C:\Windows\System\trdhAnW.exe
  2⤵
  PID:13304
- C:\Windows\System\BJcOzaA.exe
  C:\Windows\System\BJcOzaA.exe
  2⤵
  PID:12352
- C:\Windows\System\vAczRZq.exe
  C:\Windows\System\vAczRZq.exe
  2⤵
  PID:12568
- C:\Windows\System\QsHLnPr.exe
  C:\Windows\System\QsHLnPr.exe
  2⤵
  PID:12684
- C:\Windows\System\AXjNDyJ.exe
  C:\Windows\System\AXjNDyJ.exe
  2⤵
  PID:12936
- C:\Windows\System\qMlVxxg.exe
  C:\Windows\System\qMlVxxg.exe
  2⤵
  PID:12928
- C:\Windows\System\pAAhnPn.exe
  C:\Windows\System\pAAhnPn.exe
  2⤵
  PID:13072
- C:\Windows\System\sRdBJiT.exe
  C:\Windows\System\sRdBJiT.exe
  2⤵
  PID:13248
- C:\Windows\System\Zvzsjzq.exe
  C:\Windows\System\Zvzsjzq.exe
  2⤵
  PID:12360
- C:\Windows\System\WqsXnZO.exe
  C:\Windows\System\WqsXnZO.exe
  2⤵
  PID:12620
- C:\Windows\System\piFfcIk.exe
  C:\Windows\System\piFfcIk.exe
  2⤵
  PID:13120
- C:\Windows\System\covqpnV.exe
  C:\Windows\System\covqpnV.exe
  2⤵
  PID:13320
- C:\Windows\System\dRmiqiq.exe
  C:\Windows\System\dRmiqiq.exe
  2⤵
  PID:13348
- C:\Windows\System\yirhqgl.exe
  C:\Windows\System\yirhqgl.exe
  2⤵
  PID:13372
- C:\Windows\System\qbdVeHp.exe
  C:\Windows\System\qbdVeHp.exe
  2⤵
  PID:13396
- C:\Windows\System\CampAdc.exe
  C:\Windows\System\CampAdc.exe
  2⤵
  PID:13428
- C:\Windows\System\TsmNRyS.exe
  C:\Windows\System\TsmNRyS.exe
  2⤵
  PID:13468
- C:\Windows\System\XyzKNZO.exe
  C:\Windows\System\XyzKNZO.exe
  2⤵
  PID:13492
- C:\Windows\System\DCCiRRH.exe
  C:\Windows\System\DCCiRRH.exe
  2⤵
  PID:13528
- C:\Windows\System\rUOSxXU.exe
  C:\Windows\System\rUOSxXU.exe
  2⤵
  PID:13548
- C:\Windows\System\NxjtigK.exe
  C:\Windows\System\NxjtigK.exe
  2⤵
  PID:13572
- C:\Windows\System\izZcDCZ.exe
  C:\Windows\System\izZcDCZ.exe
  2⤵
  PID:13608
- C:\Windows\System\QJvrBtU.exe
  C:\Windows\System\QJvrBtU.exe
  2⤵
  PID:13632
- C:\Windows\System\AVeMfzt.exe
  C:\Windows\System\AVeMfzt.exe
  2⤵
  PID:13656
- C:\Windows\System\BEmKOqU.exe
  C:\Windows\System\BEmKOqU.exe
  2⤵
  PID:13680
- C:\Windows\System\mrupgfv.exe
  C:\Windows\System\mrupgfv.exe
  2⤵
  PID:13704
- C:\Windows\System\Ebhcrtn.exe
  C:\Windows\System\Ebhcrtn.exe
  2⤵
  PID:13744
- C:\Windows\System\yVvRbJR.exe
  C:\Windows\System\yVvRbJR.exe
  2⤵
  PID:13772
- C:\Windows\System\LOZTweZ.exe
  C:\Windows\System\LOZTweZ.exe
  2⤵
  PID:13796
- C:\Windows\System\NxztsAk.exe
  C:\Windows\System\NxztsAk.exe
  2⤵
  PID:13820
- C:\Windows\System\mxdWlNo.exe
  C:\Windows\System\mxdWlNo.exe
  2⤵
  PID:13852
- C:\Windows\System\zwFGuqk.exe
  C:\Windows\System\zwFGuqk.exe
  2⤵
  PID:13872
- C:\Windows\System\HszVVjn.exe
  C:\Windows\System\HszVVjn.exe
  2⤵
  PID:13904
- C:\Windows\System\yHnUrfo.exe
  C:\Windows\System\yHnUrfo.exe
  2⤵
  PID:13928
- C:\Windows\System\AHaFDyD.exe
  C:\Windows\System\AHaFDyD.exe
  2⤵
  PID:13956
- C:\Windows\System\XIfAAoo.exe
  C:\Windows\System\XIfAAoo.exe
  2⤵
  PID:13988
- C:\Windows\System\DlFJrlx.exe
  C:\Windows\System\DlFJrlx.exe
  2⤵
  PID:14012
- C:\Windows\System\leBIxgT.exe
  C:\Windows\System\leBIxgT.exe
  2⤵
  PID:14040
- C:\Windows\System\KdwqIFL.exe
  C:\Windows\System\KdwqIFL.exe
  2⤵
  PID:14072
- C:\Windows\System\PPJnjQS.exe
  C:\Windows\System\PPJnjQS.exe
  2⤵
  PID:14096
- C:\Windows\System\dXtqvnh.exe
  C:\Windows\System\dXtqvnh.exe
  2⤵
  PID:14124
- C:\Windows\System\JHblnfk.exe
  C:\Windows\System\JHblnfk.exe
  2⤵
  PID:14152
- C:\Windows\System\eSvaBgy.exe
  C:\Windows\System\eSvaBgy.exe
  2⤵
  PID:14188
- C:\Windows\System\zeppfvG.exe
  C:\Windows\System\zeppfvG.exe
  2⤵
  PID:14208
- C:\Windows\System\phzNehR.exe
  C:\Windows\System\phzNehR.exe
  2⤵
  PID:14232
- C:\Windows\System\KPnpFwn.exe
  C:\Windows\System\KPnpFwn.exe
  2⤵
  PID:14256
- C:\Windows\System\zSDpRgx.exe
  C:\Windows\System\zSDpRgx.exe
  2⤵
  PID:14284
- C:\Windows\System\UmSzlbv.exe
  C:\Windows\System\UmSzlbv.exe
  2⤵
  PID:14300
- C:\Windows\System\pMYzFrj.exe
  C:\Windows\System\pMYzFrj.exe
  2⤵
  PID:12884
- C:\Windows\System\oLPafnn.exe
  C:\Windows\System\oLPafnn.exe
  2⤵
  PID:12740
- C:\Windows\System\mvYvrKl.exe
  C:\Windows\System\mvYvrKl.exe
  2⤵
  PID:13440
- C:\Windows\System\hhKzHvC.exe
  C:\Windows\System\hhKzHvC.exe
  2⤵
  PID:13464
- C:\Windows\System\onLyEVR.exe
  C:\Windows\System\onLyEVR.exe
  2⤵
  PID:13516
- C:\Windows\System\POBKuPw.exe
  C:\Windows\System\POBKuPw.exe
  2⤵
  PID:13596
- C:\Windows\System\lKRfZlm.exe
  C:\Windows\System\lKRfZlm.exe
  2⤵
  PID:13668
- C:\Windows\System\CUzSyHS.exe
  C:\Windows\System\CUzSyHS.exe
  2⤵
  PID:13760
- C:\Windows\System\avuhdCA.exe
  C:\Windows\System\avuhdCA.exe
  2⤵
  PID:13864
- C:\Windows\System\NqtGZrq.exe
  C:\Windows\System\NqtGZrq.exe
  2⤵
  PID:13840
- C:\Windows\System\OHPrTqJ.exe
  C:\Windows\System\OHPrTqJ.exe
  2⤵
  PID:13828
- C:\Windows\System\TgQEZZx.exe
  C:\Windows\System\TgQEZZx.exe
  2⤵
  PID:13980
- C:\Windows\System\KeLixrt.exe
  C:\Windows\System\KeLixrt.exe
  2⤵
  PID:14108
- C:\Windows\System\UpoqggP.exe
  C:\Windows\System\UpoqggP.exe
  2⤵
  PID:14172
- C:\Windows\System\VAqfJPn.exe
  C:\Windows\System\VAqfJPn.exe
  2⤵
  PID:14148
- C:\Windows\System\YXiEUcV.exe
  C:\Windows\System\YXiEUcV.exe
  2⤵
  PID:14200
- C:\Windows\System\viXnwyi.exe
  C:\Windows\System\viXnwyi.exe
  2⤵
  PID:14268
- C:\Windows\System\Wjisylh.exe
  C:\Windows\System\Wjisylh.exe
  2⤵
  PID:13380
- C:\Windows\System\rebYcBW.exe
  C:\Windows\System\rebYcBW.exe
  2⤵
  PID:13540
- C:\Windows\System\ZCQZlob.exe
  C:\Windows\System\ZCQZlob.exe
  2⤵
  PID:13724
- C:\Windows\System\ndRexpP.exe
  C:\Windows\System\ndRexpP.exe
  2⤵
  PID:13880
- C:\Windows\System\qkspaEh.exe
  C:\Windows\System\qkspaEh.exe
  2⤵
  PID:14000
- C:\Windows\System\PKSojnC.exe
  C:\Windows\System\PKSojnC.exe
  2⤵
  PID:14196
- C:\Windows\System\TILjALN.exe
  C:\Windows\System\TILjALN.exe
  2⤵
  PID:13488
- C:\Windows\System\qOPrtgY.exe
  C:\Windows\System\qOPrtgY.exe
  2⤵
  PID:13896
- C:\Windows\System\nqNlRUi.exe
  C:\Windows\System\nqNlRUi.exe
  2⤵
  PID:14036
- C:\Windows\System\UKDsHan.exe
  C:\Windows\System\UKDsHan.exe
  2⤵
  PID:14048
- C:\Windows\System\zHNFvSC.exe
  C:\Windows\System\zHNFvSC.exe
  2⤵
  PID:14352
- C:\Windows\System\WYHSgib.exe
  C:\Windows\System\WYHSgib.exe
  2⤵
  PID:14380
- C:\Windows\System\vlsAVPD.exe
  C:\Windows\System\vlsAVPD.exe
  2⤵
  PID:14404
- C:\Windows\System\spGkVTv.exe
  C:\Windows\System\spGkVTv.exe
  2⤵
  PID:14420
- C:\Windows\System\lBVlqvf.exe
  C:\Windows\System\lBVlqvf.exe
  2⤵
  PID:14452
- C:\Windows\System\mgzkgZa.exe
  C:\Windows\System\mgzkgZa.exe
  2⤵
  PID:14484
- C:\Windows\System\CtJSOFq.exe
  C:\Windows\System\CtJSOFq.exe
  2⤵
  PID:14512
- C:\Windows\System\FHIquyy.exe
  C:\Windows\System\FHIquyy.exe
  2⤵
  PID:14540
- C:\Windows\System\RDBNcKj.exe
  C:\Windows\System\RDBNcKj.exe
  2⤵
  PID:14560
- C:\Windows\System\dWoaisr.exe
  C:\Windows\System\dWoaisr.exe
  2⤵
  PID:14592
- C:\Windows\System\ztOOteE.exe
  C:\Windows\System\ztOOteE.exe
  2⤵
  PID:14616
- C:\Windows\System\aPGCqfB.exe
  C:\Windows\System\aPGCqfB.exe
  2⤵
  PID:14648
- C:\Windows\System\ecMCFTI.exe
  C:\Windows\System\ecMCFTI.exe
  2⤵
  PID:14672
- C:\Windows\System\aVTYIwz.exe
  C:\Windows\System\aVTYIwz.exe
  2⤵
  PID:14696
- C:\Windows\System\RMtTLau.exe
  C:\Windows\System\RMtTLau.exe
  2⤵
  PID:14724
- C:\Windows\System\sBhzXTx.exe
  C:\Windows\System\sBhzXTx.exe
  2⤵
  PID:14752
- C:\Windows\System\LmYirxy.exe
  C:\Windows\System\LmYirxy.exe
  2⤵
  PID:14792
- C:\Windows\System\HAWXVNv.exe
  C:\Windows\System\HAWXVNv.exe
  2⤵
  PID:14820
- C:\Windows\System\ukdGbLP.exe
  C:\Windows\System\ukdGbLP.exe
  2⤵
  PID:14848
- C:\Windows\System\DZmHHCz.exe
  C:\Windows\System\DZmHHCz.exe
  2⤵
  PID:14876
- C:\Windows\System\yEFowsZ.exe
  C:\Windows\System\yEFowsZ.exe
  2⤵
  PID:14916
- C:\Windows\System\zMKxMoA.exe
  C:\Windows\System\zMKxMoA.exe
  2⤵
  PID:14948
- C:\Windows\System\SBJARha.exe
  C:\Windows\System\SBJARha.exe
  2⤵
  PID:14972
- C:\Windows\System\eNJakiE.exe
  C:\Windows\System\eNJakiE.exe
  2⤵
  PID:14992
- C:\Windows\System\oQihiFk.exe
  C:\Windows\System\oQihiFk.exe
  2⤵
  PID:15016
- C:\Windows\System\voHfrtv.exe
  C:\Windows\System\voHfrtv.exe
  2⤵
  PID:15044
- C:\Windows\System\JYZNJmO.exe
  C:\Windows\System\JYZNJmO.exe
  2⤵
  PID:15076
- C:\Windows\System\CluCgLn.exe
  C:\Windows\System\CluCgLn.exe
  2⤵
  PID:15100
- C:\Windows\System\BEgjrkY.exe
  C:\Windows\System\BEgjrkY.exe
  2⤵
  PID:15124
- C:\Windows\System\yJwUGIk.exe
  C:\Windows\System\yJwUGIk.exe
  2⤵
  PID:15144
- C:\Windows\System\LDjSyGX.exe
  C:\Windows\System\LDjSyGX.exe
  2⤵
  PID:15176
- C:\Windows\System\XsvNIBw.exe
  C:\Windows\System\XsvNIBw.exe
  2⤵
  PID:15204
- C:\Windows\System\smzmUgd.exe
  C:\Windows\System\smzmUgd.exe
  2⤵
  PID:15232
- C:\Windows\System\KSaHpht.exe
  C:\Windows\System\KSaHpht.exe
  2⤵
  PID:15268
- C:\Windows\System\ABfimMO.exe
  C:\Windows\System\ABfimMO.exe
  2⤵
  PID:15288
- C:\Windows\System\dLmiVcT.exe
  C:\Windows\System\dLmiVcT.exe
  2⤵
  PID:15312
- C:\Windows\System\hIAsCOn.exe
  C:\Windows\System\hIAsCOn.exe
  2⤵
  PID:15336
- C:\Windows\System\PKqcvUZ.exe
  C:\Windows\System\PKqcvUZ.exe
  2⤵
  PID:15356
- C:\Windows\System\STlokdh.exe
  C:\Windows\System\STlokdh.exe
  2⤵
  PID:14364
- C:\Windows\System\morQqzp.exe
  C:\Windows\System\morQqzp.exe
  2⤵
  PID:14432
- C:\Windows\System\LmYRgSJ.exe
  C:\Windows\System\LmYRgSJ.exe
  2⤵
  PID:14528
- C:\Windows\System\KxEHiSC.exe
  C:\Windows\System\KxEHiSC.exe
  2⤵
  PID:14584
- C:\Windows\System\Liwyoay.exe
  C:\Windows\System\Liwyoay.exe
  2⤵
  PID:14492
- C:\Windows\System\ZOoPRZZ.exe
  C:\Windows\System\ZOoPRZZ.exe
  2⤵
  PID:14604
- C:\Windows\System\PxyrByv.exe
  C:\Windows\System\PxyrByv.exe
  2⤵
  PID:14684
- C:\Windows\System\OfBmEEQ.exe
  C:\Windows\System\OfBmEEQ.exe
  2⤵
  PID:14784
- C:\Windows\System\EaHoWyE.exe
  C:\Windows\System\EaHoWyE.exe
  2⤵
  PID:14776
- C:\Windows\System\pDRFPMt.exe
  C:\Windows\System\pDRFPMt.exe
  2⤵
  PID:14912
- C:\Windows\System\TmCbxKk.exe
  C:\Windows\System\TmCbxKk.exe
  2⤵
  PID:15004
- C:\Windows\System\ZPiVXld.exe
  C:\Windows\System\ZPiVXld.exe
  2⤵
  PID:15108
- C:\Windows\System\SoVTWYf.exe
  C:\Windows\System\SoVTWYf.exe
  2⤵
  PID:15060
- C:\Windows\System\vQeEssa.exe
  C:\Windows\System\vQeEssa.exe
  2⤵
  PID:15172
- C:\Windows\System\JbmepfT.exe
  C:\Windows\System\JbmepfT.exe
  2⤵
  PID:15156
- C:\Windows\System\xanwOpm.exe
  C:\Windows\System\xanwOpm.exe
  2⤵
  PID:15328
- C:\Windows\System\wSFmAtR.exe
  C:\Windows\System\wSFmAtR.exe
  2⤵
  PID:15348
- C:\Windows\System\TsXijyT.exe
  C:\Windows\System\TsXijyT.exe
  2⤵
  PID:14340
- C:\Windows\System\raaiJZv.exe
  C:\Windows\System\raaiJZv.exe
  2⤵
  PID:14448
- C:\Windows\System\oAbZHOC.exe
  C:\Windows\System\oAbZHOC.exe
  2⤵
  PID:14640
- C:\Windows\System\REKZben.exe
  C:\Windows\System\REKZben.exe
  2⤵
  PID:14964
- C:\Windows\System\VvtyOmQ.exe
  C:\Windows\System\VvtyOmQ.exe
  2⤵
  PID:15028
- C:\Windows\System\tjlnVjV.exe
  C:\Windows\System\tjlnVjV.exe
  2⤵
  PID:15192
- C:\Windows\System\FblAmZj.exe
  C:\Windows\System\FblAmZj.exe
  2⤵
  PID:14668
- C:\Windows\System\ptMxZgl.exe
  C:\Windows\System\ptMxZgl.exe
  2⤵
  PID:14816
- C:\Windows\System\JGJanqg.exe
  C:\Windows\System\JGJanqg.exe
  2⤵
  PID:14612
- C:\Windows\System\fAcbLRD.exe
  C:\Windows\System\fAcbLRD.exe
  2⤵
  PID:14864
- C:\Windows\System\GHAHjpp.exe
  C:\Windows\System\GHAHjpp.exe
  2⤵
  PID:15464
- C:\Windows\System\qfDpZor.exe
  C:\Windows\System\qfDpZor.exe
  2⤵
  PID:15480
- C:\Windows\System\zRotWrd.exe
  C:\Windows\System\zRotWrd.exe
  2⤵
  PID:15508
- C:\Windows\System\nALvJAg.exe
  C:\Windows\System\nALvJAg.exe
  2⤵
  PID:15524
- C:\Windows\System\fGmDZMd.exe
  C:\Windows\System\fGmDZMd.exe
  2⤵
  PID:15552
- C:\Windows\System\KSkiPgC.exe
  C:\Windows\System\KSkiPgC.exe
  2⤵
  PID:15580
- C:\Windows\System\OEPzQVD.exe
  C:\Windows\System\OEPzQVD.exe
  2⤵
  PID:15620
- C:\Windows\System\vnuTmym.exe
  C:\Windows\System\vnuTmym.exe
  2⤵
  PID:15636
- C:\Windows\System\ZcwgarC.exe
  C:\Windows\System\ZcwgarC.exe
  2⤵
  PID:15652
- C:\Windows\System\ujHgroF.exe
  C:\Windows\System\ujHgroF.exe
  2⤵
  PID:15680
- C:\Windows\System\gnXYhIB.exe
  C:\Windows\System\gnXYhIB.exe
  2⤵
  PID:15708
- C:\Windows\System\TjOKZVo.exe
  C:\Windows\System\TjOKZVo.exe
  2⤵
  PID:15744
- C:\Windows\System\vxNMAmH.exe
  C:\Windows\System\vxNMAmH.exe
  2⤵
  PID:15776
- C:\Windows\System\ArWdZog.exe
  C:\Windows\System\ArWdZog.exe
  2⤵
  PID:15816
- C:\Windows\System\CrFkgIU.exe
  C:\Windows\System\CrFkgIU.exe
  2⤵
  PID:15832
- C:\Windows\System\VoHKScP.exe
  C:\Windows\System\VoHKScP.exe
  2⤵
  PID:15860
- C:\Windows\System\urfsItJ.exe
  C:\Windows\System\urfsItJ.exe
  2⤵
  PID:15888
- C:\Windows\System\JrdNvfA.exe
  C:\Windows\System\JrdNvfA.exe
  2⤵
  PID:15912
- C:\Windows\System\hwhjoLe.exe
  C:\Windows\System\hwhjoLe.exe
  2⤵
  PID:15932
- C:\Windows\System\UAkeHgv.exe
  C:\Windows\System\UAkeHgv.exe
  2⤵
  PID:15964
- C:\Windows\System\gFCnKaq.exe
  C:\Windows\System\gFCnKaq.exe
  2⤵
  PID:15988
- C:\Windows\System\eeaTGOw.exe
  C:\Windows\System\eeaTGOw.exe
  2⤵
  PID:16024
- C:\Windows\System\ingxGkj.exe
  C:\Windows\System\ingxGkj.exe
  2⤵
  PID:16056
- C:\Windows\System\OswGnyH.exe
  C:\Windows\System\OswGnyH.exe
  2⤵
  PID:16076
- C:\Windows\System\GypVsDP.exe
  C:\Windows\System\GypVsDP.exe
  2⤵
  PID:16112
- C:\Windows\System\XuGVDfT.exe
  C:\Windows\System\XuGVDfT.exe
  2⤵
  PID:16132
- C:\Windows\System\KyWWiho.exe
  C:\Windows\System\KyWWiho.exe
  2⤵
  PID:16156
- C:\Windows\System\HRYNEPa.exe
  C:\Windows\System\HRYNEPa.exe
  2⤵
  PID:16180
- C:\Windows\System\FWdyBte.exe
  C:\Windows\System\FWdyBte.exe
  2⤵
  PID:16204
- C:\Windows\System\lIUvHyK.exe
  C:\Windows\System\lIUvHyK.exe
  2⤵
  PID:16236
- C:\Windows\System\EmGCAVz.exe
  C:\Windows\System\EmGCAVz.exe
  2⤵
  PID:16288
- C:\Windows\System\igHtEZA.exe
  C:\Windows\System\igHtEZA.exe
  2⤵
  PID:16308
- C:\Windows\System\trpSAim.exe
  C:\Windows\System\trpSAim.exe
  2⤵
  PID:16336
- C:\Windows\System\ZnWPYyy.exe
  C:\Windows\System\ZnWPYyy.exe
  2⤵
  PID:16364
- C:\Windows\System\cGnPDEs.exe
  C:\Windows\System\cGnPDEs.exe
  2⤵
  PID:16380
- C:\Windows\System\creCzwJ.exe
  C:\Windows\System\creCzwJ.exe
  2⤵
  PID:15252
- C:\Windows\System\uZmNoCS.exe
  C:\Windows\System\uZmNoCS.exe
  2⤵
  PID:15416
- C:\Windows\System\UtBNniH.exe
  C:\Windows\System\UtBNniH.exe
  2⤵
  PID:15516
- C:\Windows\System\EWIKqvz.exe
  C:\Windows\System\EWIKqvz.exe
  2⤵
  PID:15564
- C:\Windows\System\uaUKeGz.exe
  C:\Windows\System\uaUKeGz.exe
  2⤵
  PID:15612
- C:\Windows\System\SbNZput.exe
  C:\Windows\System\SbNZput.exe
  2⤵
  PID:15700
- C:\Windows\System\iGjsKrp.exe
  C:\Windows\System\iGjsKrp.exe
  2⤵
  PID:15728
- C:\Windows\System\KvNTAVn.exe
  C:\Windows\System\KvNTAVn.exe
  2⤵
  PID:15772
- C:\Windows\System\HyCSBUa.exe
  C:\Windows\System\HyCSBUa.exe
  2⤵
  PID:15824
- C:\Windows\System\MaDyiyT.exe
  C:\Windows\System\MaDyiyT.exe
  2⤵
  PID:15856
- C:\Windows\System\oQTRBNe.exe
  C:\Windows\System\oQTRBNe.exe
  2⤵
  PID:15884
- C:\Windows\System\ufiIhYL.exe
  C:\Windows\System\ufiIhYL.exe
  2⤵
  PID:15928
- C:\Windows\System\DppcjXr.exe
  C:\Windows\System\DppcjXr.exe
  2⤵
  PID:16020
- C:\Windows\System\XYxwFBr.exe
  C:\Windows\System\XYxwFBr.exe
  2⤵
  PID:16064
- C:\Windows\System\OnieoNN.exe
  C:\Windows\System\OnieoNN.exe
  2⤵
  PID:16092
- C:\Windows\System\Vxzwfxl.exe
  C:\Windows\System\Vxzwfxl.exe
  2⤵
  PID:16228
- C:\Windows\System\ImBJqpW.exe
  C:\Windows\System\ImBJqpW.exe
  2⤵
  PID:16248
- C:\Windows\System\ApMcQpV.exe
  C:\Windows\System\ApMcQpV.exe
  2⤵
  PID:16348
- C:\Windows\System\uADOYMo.exe
  C:\Windows\System\uADOYMo.exe
  2⤵
  PID:15364
- C:\Windows\System\kPhZLJS.exe
  C:\Windows\System\kPhZLJS.exe
  2⤵
  PID:15448
- C:\Windows\System\BkSWbui.exe
  C:\Windows\System\BkSWbui.exe
  2⤵
  PID:15592
- C:\Windows\System\BHAMadG.exe
  C:\Windows\System\BHAMadG.exe
  2⤵
  PID:15852
- C:\Windows\System\CwdrhBP.exe
  C:\Windows\System\CwdrhBP.exe
  2⤵
  PID:16044
- C:\Windows\System\QKJbzST.exe
  C:\Windows\System\QKJbzST.exe
  2⤵
  PID:15952
- C:\Windows\System\qaOPSUn.exe
  C:\Windows\System\qaOPSUn.exe
  2⤵
  PID:15492
- C:\Windows\System\PWpFuCR.exe
  C:\Windows\System\PWpFuCR.exe
  2⤵
  PID:16004
- C:\Windows\System\QaUBgMU.exe
  C:\Windows\System\QaUBgMU.exe
  2⤵
  PID:15808
- C:\Windows\System\xqnVrJu.exe
  C:\Windows\System\xqnVrJu.exe
  2⤵
  PID:15688
- C:\Windows\System\HTpwuww.exe
  C:\Windows\System\HTpwuww.exe
  2⤵
  PID:16404
- C:\Windows\System\xWIlPdh.exe
  C:\Windows\System\xWIlPdh.exe
  2⤵
  PID:16436
- C:\Windows\System\sRLLtzc.exe
  C:\Windows\System\sRLLtzc.exe
  2⤵
  PID:16468
- C:\Windows\System\SzIyaHi.exe
  C:\Windows\System\SzIyaHi.exe
  2⤵
  PID:16500
- C:\Windows\System\ceVNsGL.exe
  C:\Windows\System\ceVNsGL.exe
  2⤵
  PID:16528
- C:\Windows\System\seaVxso.exe
  C:\Windows\System\seaVxso.exe
  2⤵
  PID:16544
- C:\Windows\System\DNpgysq.exe
  C:\Windows\System\DNpgysq.exe
  2⤵
  PID:16568
- C:\Windows\System\SNQieqO.exe
  C:\Windows\System\SNQieqO.exe
  2⤵
  PID:16600
- C:\Windows\System\jypvKno.exe
  C:\Windows\System\jypvKno.exe
  2⤵
  PID:16632
- C:\Windows\System\ydBGzLi.exe
  C:\Windows\System\ydBGzLi.exe
  2⤵
  PID:16664
- C:\Windows\System\MxfceYz.exe
  C:\Windows\System\MxfceYz.exe
  2⤵
  PID:16684
- C:\Windows\System\jWptTiS.exe
  C:\Windows\System\jWptTiS.exe
  2⤵
  PID:16716
- C:\Windows\System\uefbJpS.exe
  C:\Windows\System\uefbJpS.exe
  2⤵
  PID:16744
- C:\Windows\System\dHZrbwR.exe
  C:\Windows\System\dHZrbwR.exe
  2⤵
  PID:16780
- C:\Windows\System\HwZWxbe.exe
  C:\Windows\System\HwZWxbe.exe
  2⤵
  PID:16808
- C:\Windows\System\WlFltzQ.exe
  C:\Windows\System\WlFltzQ.exe
  2⤵
  PID:16836
- C:\Windows\System\OLCgECv.exe
  C:\Windows\System\OLCgECv.exe
  2⤵
  PID:16880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AasfckS.exe

Filesize
1.7MB

MD5
c7777c6dd0ff8718949bb8736c03f611

SHA1
d625a01c25c5ab5a6a87bb5ac597818c7c98ee96

SHA256
7c3c39532dbf79578ed4ea9618ad8e7ba3dc0425a0eba28f30d40ec020c3d2a2

SHA512
0f8e3e5cea058d7fa0b1f8a3bc60bcd86f0f102f907a8f74200c9735a4344baadf6ff1aacc187593c0b5b41170d3016af9e7654d12b019ee42430dd32dcef97f

Download Submit
C:\Windows\System\DzOeaWl.exe

Filesize
1.7MB

MD5
07e2cb2da6945724a0f516f5a323a595

SHA1
d43d7acb2118e5a803a8f10a441d57c35c4da121

SHA256
33ba8fd666f7a72c2a20fd024d4384e405a7c0fc04a5f9490a683367327dd4c7

SHA512
a4a83f44c3301177e2950cd133a9743d9457a5f0335f399d7a6ea5ff00012a74244a9d1bbc80ad8b71c87b2747dd22657c92b7f0c0c27e9bfdc803ebb169dfab

Download Submit
C:\Windows\System\IIjshRy.exe

Filesize
1.7MB

MD5
523cab7d25f705fc04c75eab3929bb23

SHA1
f3bb8ebb45eec0c5a600ce40260ff1ece29a72db

SHA256
37e94bb3d5c81d6d7a971e7a07bbfe3ff551a6ed2761903133b4969aa26c8451

SHA512
cdd4a6229f6ed44d399e80d96d88503ccc4d0b13ad19f896786bb7a6c63e7e56605ee4955a554adfbe321b04715cbd4483d5bd5268c8e74db508529f9d0189e5

Download Submit
C:\Windows\System\IjCAPEB.exe

Filesize
1.7MB

MD5
96ef34e65c33a03f569b54037c190534

SHA1
848a7095361fb1e297ea8d8690742caf47af290f

SHA256
8b58757759c76ebb0d18ad121770ba8725ff79936c38a2d7be32e74a979ce6e4

SHA512
ad87c67dd056caf5a08270083e3336ded88d1228bcd1638ec1cfa960dc5e98d56e5279f4733814eb160668453662457c3931c142e16673dd8846652daf4c4f2c

Download Submit
C:\Windows\System\JPjeAcb.exe

Filesize
1.7MB

MD5
9639e3737fd8dc87c424cecbbaa59ec9

SHA1
fb335eeb23eb346b91c16d6c0b1969e9f4ca2e11

SHA256
376ab4981ba29021001e07bb2651d084c045d4b6e2843aadadd4d2f3ba14bb58

SHA512
4c8e55d58f93024dcea440fbadd16c74ccc8e6c7ce729a67dd1b1792d0bebf00c9f8e355956be5fde5b6c7d1470b905cde02f03be4a5387f1765adbc970654ea

Download Submit
C:\Windows\System\Mergmpa.exe

Filesize
1.7MB

MD5
6f66d8e678c1dda498db1ec262c06299

SHA1
f9818e3e39bfcaea59ef60cebda32b6a0b0ea199

SHA256
3fdb5e43592c63764090c5fe57f7b2eec8f316baf660f456109eb91179e0a8b8

SHA512
7c456141cf4c3050771f5697e4c20fc6903630f4c44b487764b2a85f25453766f59b87675ade857b111f32ab4fd06a0c0489d6df8736dbe6475b46c033296aa3

Download Submit
C:\Windows\System\NFFhPXn.exe

Filesize
1.7MB

MD5
97099baee8612f16333db8fef7176e7f

SHA1
5a6b2bcd5e3c003a11e6f3ca0408ed6f86624435

SHA256
7f0d34c8af903d6f44a66e15cbafd619252f7e9a0fd6588f42d5c76564878496

SHA512
d6bc36c16908585e41dc79a4048fb7ab774b7c212b805f6984f6f0b31caf481714131dbe8924917b9a07e46fbe291fdca4852651c6d310de827a436c71786af4

Download Submit
C:\Windows\System\NuFSZuo.exe

Filesize
1.7MB

MD5
344f59abb74ae58d9eb10f0eb187e2ef

SHA1
64ed93ddeadac92daa0e63ec20b15e8c07fd9463

SHA256
e9c85a4f0ec3e641de598e17b8c140a007c5ca99ee2a05c75fd0762b8e547ddc

SHA512
e1ebb3fac6c53354af4944faa574ac816725531497f0720b99014a4692c14205ed17d5b2186eaafa9ff7f4a6a1f16ada3b54ee113e87f7d40911d85a42774edb

Download Submit
C:\Windows\System\SLqkEJH.exe

Filesize
1.7MB

MD5
4dcce3d3259dea9c6f087773d0546243

SHA1
5170cfbb6aa4f468db7f3b93314915ee42fea227

SHA256
e6f040e211c2fcc23a6767ca2def4ac67003624de71ccd424f512fbf56461165

SHA512
d6636e7f9779bccabafed4b76381d9b658bd985e4c3eeb93bf0a62e0b8e65573c0570ab9e6a80953f5bf2eec5e518860f6e9de3d65eedc0f17a1fd1ce17c8380

Download Submit
C:\Windows\System\SOQoQBN.exe

Filesize
1.7MB

MD5
d67b6400785ecc0c91acb9ef426ddfd3

SHA1
a389165c59ca69197a8aa2655205296d08c0da83

SHA256
b7c2bb6ea70355676c0948a495156f0ce6ccdba78616390cd884547ba22e8c69

SHA512
00a3750d70333383956027febd175451b48c40447830aa6381aa75ee1ded65abd9b06aa3c7c377d4e07e548be262f5d904055b64cd118bf0c7fa0c25bc55795b

Download Submit
C:\Windows\System\SmExgvj.exe

Filesize
1.7MB

MD5
b7eec51dfd58449cb6aff95d69b1257f

SHA1
32fa2f40829b701bfdcc875395b34f336810e9f3

SHA256
ef71a75f4de0d76f78c66a69c788be336d3a20b0246bdc21f668194094fcd316

SHA512
6a99b5ad885761512ecab861dc27773d4cd9a53adfd3b6cc1362af824f9298c1c2c444ea3eecb84cbf67372da02e901c9ec7651b4464bc5f7536789d1012ba97

Download Submit
C:\Windows\System\TCbGcZT.exe

Filesize
1.7MB

MD5
b4af2dff3ee725c3f589532232792621

SHA1
36ce57461f9053afbd71db7da0eaa4ee7fedfa96

SHA256
4e83e775c7fc9b7a9a4caef272552762bfef966f00c12da072011acae7e7352a

SHA512
a84442c2cd6b7fee007a3ada24970c0fd4719f395d228f52a26453748106875c14abc9172fd4bfbb4e08109919b876e5073f313c8f251ccac74907adb66a774b

Download Submit
C:\Windows\System\TWMPrJR.exe

Filesize
1.7MB

MD5
9c35f15383f58ca564ea0bf2fa25f18e

SHA1
e68e6287c02ee96a1a021a1e6028793c618eb7b7

SHA256
f0967e68166dc9e1bc3b14d170c4312156216f4cfec10b68095ca8b91864cf34

SHA512
82e37a95e0fac21f4f4facc451a13dad52fbbcd8900f4eaee5167dd44b0649c36f8d3f03659b36f767e39096c2ea92bcb7ae85f6f5e870041b345fe1dce8c0ac

Download Submit
C:\Windows\System\YTKTNXi.exe

Filesize
1.7MB

MD5
d41013f6f82e444c8ca3d04ce54042d2

SHA1
efcb61bde2a07b5dfab4c24c74221fbb23e34fe7

SHA256
7cdfcc9c6ac959a34a61bc61653bf57887f67c2440065371760f9c3f5d0f5851

SHA512
dc93f5a3fc1acbb339e5779e8b2dcfe9ec5b320eba68fa3fef337743c29cc7be987196de66ced5944edeef542e2d389c794669d362680cd695220a1ae2e840ca

Download Submit
C:\Windows\System\YcjXDqP.exe

Filesize
1.7MB

MD5
de3d1f094f567477a2287428c1da9a16

SHA1
6f2d77d8d945bc9de1e23f304193417e35e1408a

SHA256
2cb1dd48ae0bea2b7fa0383bb5128e1226ff268c356885e480ad44b15452b76a

SHA512
b02585893816bfe01bcba7f2f384da7ffb1828410d425992404a0dee80626ffd4a1a80bed2797c41459cf18efd72ee17abbdf81d76f030e2b5fdadca0f46d9b0

Download Submit
C:\Windows\System\ZdYOQiy.exe

Filesize
1.7MB

MD5
8e8bd66fc1feb4555c021c4508729868

SHA1
4cd000705840f5816fe9589734c84ca794db442b

SHA256
4d6bfd1908f0a4e110495e14c3700d3bee287c6048dd84179626f1d9b1e59c2a

SHA512
8f5e77b00b3ae97ba53182144a13ba9d877bd1cd3a40f0404570c27d7ab60ae79c91380366d3ec34ce3b2192ee62c54b43171d9cf7a697910a48982940cde441

Download Submit
C:\Windows\System\ZkTfHQU.exe

Filesize
1.7MB

MD5
343abfb4a81da8c97d4e932e0f468ed2

SHA1
ceb0e45d3d583d42984d34b4f59b39a802a1d526

SHA256
89a49027dfe6c94b36080965ca1085f32670a2e993cfe66b6947f2c1d47862a2

SHA512
1dad77e84b840e9b94b30cabe9c684413cc870dfdde35ffca2e4734c03a17bb508593b801dbb9ddebd413e4704dd725d480f2bee0799e07cce6d955ddc2c339a

Download Submit
C:\Windows\System\clyxDnC.exe

Filesize
1.7MB

MD5
f5860d68e9f82c0274ceb04f61dcd382

SHA1
c27ed72145912e55a1aa3cb2f17a4371c4d4bcec

SHA256
7664570a14c35d2d7c474038cd9322d616d48b1bfbd8d5450c380a2e04479708

SHA512
79b1e0c792cc319e3609e296aaf78390522ab7916f349368e5ea1822fd5ebd45d89f11aac5dd7d334d2bc47b48676ae4469cba7cd1c708324b5d289f809ee947

Download Submit
C:\Windows\System\eGrCEBv.exe

Filesize
1.7MB

MD5
84d04a1bfb9021ce5f873bf8af767e77

SHA1
753316ca06ac7904cd8f6a15907f94cefb9b5e09

SHA256
12405a246c90f4cd3d1d070397d26136a5809c1e047c4671433c1e7944eda46a

SHA512
af112bf7c9c06aab063b8c93f28a3e93c9f4f33b7155621d4d32c88ddf6a96676fc90cb94aac29d2ae24cdb11b1835840c3539e83fe90d77f053f0cdaa873c64

Download Submit
C:\Windows\System\fEfBmUe.exe

Filesize
1.7MB

MD5
ad2bf4f71acbafa8a81086c52c9763f6

SHA1
4b5b226ae71d3e7d538927a4555c0bf9a4e70b07

SHA256
532eeb615c6c8611b6cfea5742d06c5fd5ab45234f4e25b96416154246468ac5

SHA512
85c9e6aac2870657efe473b5cac43b06e9362886451b17c923203f8aa291d8e6e74eaf673156a2975913d504ff502850ad006c06ef4be8e72481d33c3552fdc7

Download Submit
C:\Windows\System\fIQyChs.exe

Filesize
1.7MB

MD5
ecf6afba74c065da800d72c054e9500d

SHA1
1c0c07f2dc52be9dff5881962fddbb1dda774b69

SHA256
096efb2b369bc6d4fe146d52d2ea9df133b6f28466492e89f7eb2604d593694d

SHA512
63eea66ed79610dab7d19937f6177fc01c5a2c7ae57ca712e40ba8ffcfb3fe70038e36f203142079d360129e3c476b40ae612d4eac34d2aa6939c7f111f2cc85

Download Submit
C:\Windows\System\fjOKZRW.exe

Filesize
1.7MB

MD5
d8f69cf4f607f3535e68a19351a4e076

SHA1
d151b153398b1f5e3b9eb5de136bfb8954c07802

SHA256
14d61e4e70606f2827dfadec6abe1106dbcafc6a02915adbefa9a5b9ca395190

SHA512
54770f808a5df00bea1d6dba2a9d4c34e126da10d3cc49ba6d9ac952568964483653dde86734875282cac032396d774e3eafde906ebd5ff73a2fe4156a5cec7c

Download Submit
C:\Windows\System\hYBwspR.exe

Filesize
1.7MB

MD5
1cb6c031b6bcdfd8ff8809389f36924b

SHA1
8d66a3d833cb12f14ffc8ccb1c7c148848db5a8f

SHA256
bffd186ee9d58127a3af6bc2a8a56bdbaa13b2c1503c35bc66dfd74bc40ed36d

SHA512
4b4a94300a5dbc2719adfd2407f7ea7710ab6787a788cb4279a9a53fbf2cdd760beed8bc4136087f4807e5eba29a5b90400c067e31897133997deabb82e84092

Download Submit
C:\Windows\System\ipVsuUM.exe

Filesize
1.7MB

MD5
73e7349e370f4cd2bea9b951443e8cc7

SHA1
8feeaf5545c43e0cf58b2cda6aadcba4554ebaca

SHA256
78ad9656453602cd88372f39f6bdca74a44642b42b6510b0c12aeb2065f0d0dd

SHA512
5e5a44e9a13f80504c4426d3ff0058b4f01ceebfb4bc6c117bb589d13b18d5b9a5f7c5f97b1b6747563928558db006bd72fcf0bad568cf55b4ab1a9d721d3c6d

Download Submit
C:\Windows\System\ldLdsFv.exe

Filesize
1.7MB

MD5
589661c499f24af7d894854988ebdbe9

SHA1
e20c0a7463e5077eb804d4216e1671d3e9353e4d

SHA256
ff3e75594533b136e2d9de29bd4b7db034a34f31b0d340b4c10318f77e3bc5e7

SHA512
4a2f78b0a7a24d41bc58499e2b7de20057347770776dad81f3daca5a55c6b1dad2a82580772a67b667c3358503dbf5acde49059f94de7f98f86a1f085a96d39e

Download Submit
C:\Windows\System\mlNEzWn.exe

Filesize
1.7MB

MD5
9df4229aef99f7fcb7f18f1505f33beb

SHA1
a6595d6a312bd7e49809d46d2910e63d42a5a977

SHA256
4dc153f7b052b07820a3e2dcbcddc074dd667bb565d3a643c788d48e0f0fb8e3

SHA512
0a999380a0329a51ec7dbd5c46421243664bd5ae343e10549d618c6f3e5d05051b022ab829f2ddad289d1d272189f08c306975620d5457d44e65e65bd8b49884

Download Submit
C:\Windows\System\tQKqwBK.exe

Filesize
1.7MB

MD5
ab077fbce819a2601adeb2892bd49e62

SHA1
79793f161d4c71da79bbda3f551b3f154b3abe00

SHA256
ffd798378277771ae6125ee9b7ef8c74151da79d1157cd30ce9845678debbf03

SHA512
191856ec73a97eafc700836ba814bb5e09fe44e2d9c9f4e87aff3a11f2ac6365027f6ceca8a97ebd17c5cf9df818187855695454f5fad170aa6c1c8bc644ee17

Download Submit
C:\Windows\System\uHIqmnO.exe

Filesize
1.7MB

MD5
e69c8902dc157ebe4a223a2af5c78ed9

SHA1
4395efe80900d49259330a9377e7418c705c53d9

SHA256
149413088ac4c426ca5f424d315e4a944179f169694eaa6c68c5734cec4ae209

SHA512
f704185109858905c3a739df17be2b655c2fd1fffc5da2ac1ea15091bd3e339aef68971ae16acf67cc938aefc08bf2b6f6637aed3a40b748421e8770a9d68e3e

Download Submit
C:\Windows\System\wTBZFdN.exe

Filesize
1.7MB

MD5
fa9781411996103b683526d0a86e347f

SHA1
df6de2b77b7bfcc4adffd486c43d1c30b660c707

SHA256
1b3fa33462c77af66953ccfe8104553c9f3bdee0672fe18529afe4511e79f8d7

SHA512
dee5f54131790a11cf2776472662c9b61a625762adcf9e9c3156db8d187e5631a65535a0dc778252cffd02b9327bf86c544a8649a229613aeb9fee52e21fee01

Download Submit
C:\Windows\System\xTHnPCA.exe

Filesize
1.7MB

MD5
fbc4dd054e99f3f8f7b49593c837cee8

SHA1
5a45e673d68b3feb326fa14064f87fc75f22dc2c

SHA256
f783a0784908d988b059b8556b6c2b513b03b7b29d350f630c1354a664ac52b8

SHA512
af44c05660671aa32ef7fdef4b4fa42aaad1af8f6bf4c8173449e429ef14962ed27034cfa1951c4d958e9929fc7135fad3430a5de025fd52648597980413453e

Download Submit
C:\Windows\System\yDjBAqv.exe

Filesize
1.7MB

MD5
6c4efd8003983d487f22ea9d446d499a

SHA1
9d9e37def15f0027d95fbfd7331a9803497eda3c

SHA256
cb28d4bd3c5b63bfb8552775a5b9ec0a9bc557adbb536e46722f0fb4a3a47ea7

SHA512
2c1efc4adf339a65694e55f4e92f4704b0b79ed12db938e399578c6b791291b2a88be245e5d60aa73e7b409d15358e63d381ca6027d0a4967d40181637001aee

Download Submit
C:\Windows\System\yWMwCcR.exe

Filesize
1.7MB

MD5
1e18e3854a506b86597ac1d5bc57efba

SHA1
49f6951e082bdc37c9cd7717555fa4f0db44046f

SHA256
e6c9de1920c541d7ba0376274b432ab53617e4dae63b82e7125ac38d41d4df97

SHA512
c7bff1f330af5350277ca6a5dd0afb5a56a1c2f2ef8b38eea8b5078e0f0754b3d1e83d1e73fec2c594512ea6b29c37cde1fe8749e04ed8924ac754f750cce7de

Download Submit
C:\Windows\System\zGxqOhO.exe

Filesize
1.7MB

MD5
c95a40b979657b2f8d64b5b5f435c0ec

SHA1
43e8779f96cf0cd5b1e591398f49a1805674c8cf

SHA256
ac5f9adfa91daa2caac94321f4f4d50058c333cd6484acc4eba883a501edc1d6

SHA512
c51896e4886743bb7151651ca99155c981cefa3719c10705481a63af846319403ab13273911065427e6ac7b4f97c961ca28fb18b2b787db4fd730d4b5d0cc3ac

Download Submit
memory/2124-0-0x0000021F088A0000-0x0000021F088B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads