xmrig | a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c

Analysis

max time kernel
92s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
Size

1.5MB
MD5

2036ca521d78d676552b7022dce1f627
SHA1

3f0a3123c5cc6df51c5f568c8fdc2f6793223a76
SHA256

a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c
SHA512

5dfb9df6033cc6dfb8612e6b4b9296e7915bb240247618704d730d663cc37508d1537ead3652e3dd46258a21057e684c577b74e9cf5fb286299a0f25cd6b0495
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYFu4/qak:GemTLkNdfE0pZyR

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023cc2-3.dat	xmrig
behavioral2/files/0x0007000000023cc7-12.dat	xmrig
behavioral2/files/0x0007000000023cc8-27.dat	xmrig
behavioral2/files/0x0007000000023ccc-39.dat	xmrig
behavioral2/files/0x0007000000023ccf-48.dat	xmrig
behavioral2/files/0x0007000000023cca-57.dat	xmrig
behavioral2/files/0x0007000000023cce-71.dat	xmrig
behavioral2/files/0x0007000000023cd2-94.dat	xmrig
behavioral2/files/0x0007000000023cda-113.dat	xmrig
behavioral2/files/0x0007000000023cdd-122.dat	xmrig
behavioral2/files/0x0007000000023cde-136.dat	xmrig
behavioral2/files/0x0007000000023ce5-156.dat	xmrig
behavioral2/files/0x0007000000023ce8-172.dat	xmrig
behavioral2/files/0x0007000000023ce7-171.dat	xmrig
behavioral2/files/0x0007000000023cdf-164.dat	xmrig
behavioral2/files/0x0007000000023ce6-162.dat	xmrig
behavioral2/files/0x0007000000023ce4-155.dat	xmrig
behavioral2/files/0x0007000000023ce3-154.dat	xmrig
behavioral2/files/0x0007000000023ce2-153.dat	xmrig
behavioral2/files/0x0007000000023ce1-152.dat	xmrig
behavioral2/files/0x0007000000023ce0-150.dat	xmrig
behavioral2/files/0x0007000000023cdc-132.dat	xmrig
behavioral2/files/0x0007000000023cdb-115.dat	xmrig
behavioral2/files/0x0007000000023cd9-111.dat	xmrig
behavioral2/files/0x0007000000023cd3-109.dat	xmrig
behavioral2/files/0x0007000000023cd8-107.dat	xmrig
behavioral2/files/0x0007000000023cd7-105.dat	xmrig
behavioral2/files/0x0007000000023cd6-103.dat	xmrig
behavioral2/files/0x0007000000023cd5-101.dat	xmrig
behavioral2/files/0x0007000000023cd4-96.dat	xmrig
behavioral2/files/0x0007000000023cd1-83.dat	xmrig
behavioral2/files/0x0007000000023ccd-64.dat	xmrig
behavioral2/files/0x0007000000023ccb-52.dat	xmrig
behavioral2/files/0x0007000000023cd0-65.dat	xmrig
behavioral2/files/0x0007000000023cc9-35.dat	xmrig
behavioral2/files/0x0007000000023cc6-19.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3428	yVZWuKn.exe
2500	DqzRljr.exe
4172	aGpgIKC.exe
3376	oJafVzM.exe
4144	LbOIhrj.exe
1560	tKsGAYz.exe
992	qiRUhHx.exe
2272	KaynFjc.exe
1108	QuENMRD.exe
1692	Wzsuxag.exe
3508	VzHrsXn.exe
5016	ItGLuPq.exe
1020	wJfATws.exe
1588	RpSQpLZ.exe
4212	AGTBOwy.exe
3848	RWrovkM.exe
4236	ksQHxwS.exe
4868	lXmhhCh.exe
3284	YoBokJj.exe
4704	QKsJJFm.exe
4464	RvJLkTB.exe
4580	vEtZwoD.exe
3724	BDjtCyi.exe
2528	GCkLlvc.exe
2196	YdpTOOL.exe
4052	xNZEOFO.exe
5044	BXJorKL.exe
532	HMSTbrd.exe
3900	TLwQjGR.exe
3180	Tsnqawp.exe
3056	xUXlwgB.exe
1804	uRBBUvG.exe
4840	kTaaEbx.exe
916	trTjYTp.exe
1088	IcAQsUe.exe
3476	sgzmiWV.exe
2996	gcKQehw.exe
548	dzOkAEa.exe
4608	cKCQnFB.exe
3024	zZeLAnX.exe
3332	VBgkrUX.exe
3596	hnyRuNS.exe
2712	AdaWiUV.exe
3116	vuMPNSH.exe
4500	XMjCucr.exe
632	CPRPHCc.exe
1128	wujNWgb.exe
1028	DyImjRL.exe
784	LjGOMXu.exe
1628	uUQRUaG.exe
3112	EEKuDDV.exe
3576	VrBPjXM.exe
2412	EGCDrai.exe
1396	rBhKEPd.exe
3800	arJEXXp.exe
4304	UIbjYiN.exe
2908	KPAqqng.exe
4944	FiIVYYi.exe
4764	ZaVRWPQ.exe
2252	bfWsnPy.exe
3312	OKcKaMO.exe
2064	bySRzyi.exe
636	ErTYSdi.exe
4480	cDTRLBL.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UFIzIYn.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\KowOwfz.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\MjAHDJJ.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\zagIErp.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\kkEkcVu.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\xQhnRsR.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\vlQwovH.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\GCbZuNd.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\ZLDtQgB.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\KUXXCyr.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\oGhKzlh.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\xfiGHSL.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\WmjHTLt.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\IvHWBJH.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\fqtGQyH.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\XtpPkGT.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\EGCDrai.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\fhJrbip.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\FexhDvJ.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\PwfMynZ.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\qIybzuZ.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\Tsnqawp.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\UyUgvby.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\vorfuCS.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\VrBPjXM.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\xIzbcps.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\jbIwEsL.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\uSnHoCK.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\wdmgoyn.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\qgbSGsZ.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\JKiiKpu.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\RvJLkTB.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\SsotaTt.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\WIbJTNg.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\JJqmpbx.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\pwHUsNB.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\eWjpgcS.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\SzdeJoR.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\lEZiOps.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\FZMOPhO.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\aFVZunw.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\EHmXXxy.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\HlrbjAo.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\mHBMEPF.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\VJdKSIg.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\fGDzaNu.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\trEtSPL.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\GkidpwL.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\ikujTYm.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\GntMKsd.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\kBTIkYh.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\JHkKrfw.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\EbBCYzY.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\dKGOsbB.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\NutFWaq.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\gWWiPmd.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\vmLgALP.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\pUZqszJ.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\aNzrVfP.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\lGIpPvD.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\wXIrEHB.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\GwEWXJw.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\RuxljXh.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
File created	C:\Windows\System\ntPUGRE.exe	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3428	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	84
PID 4984 wrote to memory of 3428	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	84
PID 4984 wrote to memory of 2500	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	85
PID 4984 wrote to memory of 2500	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	85
PID 4984 wrote to memory of 4172	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	86
PID 4984 wrote to memory of 4172	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	86
PID 4984 wrote to memory of 3376	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	87
PID 4984 wrote to memory of 3376	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	87
PID 4984 wrote to memory of 4144	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	88
PID 4984 wrote to memory of 4144	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	88
PID 4984 wrote to memory of 1560	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	89
PID 4984 wrote to memory of 1560	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	89
PID 4984 wrote to memory of 992	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	90
PID 4984 wrote to memory of 992	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	90
PID 4984 wrote to memory of 2272	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	91
PID 4984 wrote to memory of 2272	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	91
PID 4984 wrote to memory of 1108	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	92
PID 4984 wrote to memory of 1108	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	92
PID 4984 wrote to memory of 1692	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	93
PID 4984 wrote to memory of 1692	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	93
PID 4984 wrote to memory of 3508	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	94
PID 4984 wrote to memory of 3508	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	94
PID 4984 wrote to memory of 5016	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	95
PID 4984 wrote to memory of 5016	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	95
PID 4984 wrote to memory of 1020	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	96
PID 4984 wrote to memory of 1020	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	96
PID 4984 wrote to memory of 1588	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	97
PID 4984 wrote to memory of 1588	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	97
PID 4984 wrote to memory of 4704	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	98
PID 4984 wrote to memory of 4704	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	98
PID 4984 wrote to memory of 4212	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	99
PID 4984 wrote to memory of 4212	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	99
PID 4984 wrote to memory of 3848	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	100
PID 4984 wrote to memory of 3848	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	100
PID 4984 wrote to memory of 4236	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	101
PID 4984 wrote to memory of 4236	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	101
PID 4984 wrote to memory of 4868	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	102
PID 4984 wrote to memory of 4868	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	102
PID 4984 wrote to memory of 3284	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	103
PID 4984 wrote to memory of 3284	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	103
PID 4984 wrote to memory of 4464	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	104
PID 4984 wrote to memory of 4464	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	104
PID 4984 wrote to memory of 4580	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	105
PID 4984 wrote to memory of 4580	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	105
PID 4984 wrote to memory of 3724	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	106
PID 4984 wrote to memory of 3724	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	106
PID 4984 wrote to memory of 2528	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	107
PID 4984 wrote to memory of 2528	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	107
PID 4984 wrote to memory of 2196	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	108
PID 4984 wrote to memory of 2196	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	108
PID 4984 wrote to memory of 4052	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	109
PID 4984 wrote to memory of 4052	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	109
PID 4984 wrote to memory of 5044	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	110
PID 4984 wrote to memory of 5044	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	110
PID 4984 wrote to memory of 532	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	111
PID 4984 wrote to memory of 532	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	111
PID 4984 wrote to memory of 3900	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	112
PID 4984 wrote to memory of 3900	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	112
PID 4984 wrote to memory of 3180	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	113
PID 4984 wrote to memory of 3180	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	113
PID 4984 wrote to memory of 3056	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	114
PID 4984 wrote to memory of 3056	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	114
PID 4984 wrote to memory of 1804	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	115
PID 4984 wrote to memory of 1804	4984	a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe	115

C:\Users\Admin\AppData\Local\Temp\a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe
"C:\Users\Admin\AppData\Local\Temp\a35a74dc7d74da0580c0079a34d0f8231952aa48ee2a0c764d07d4fe0b551d7c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\System\yVZWuKn.exe
  C:\Windows\System\yVZWuKn.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\DqzRljr.exe
  C:\Windows\System\DqzRljr.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\aGpgIKC.exe
  C:\Windows\System\aGpgIKC.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\oJafVzM.exe
  C:\Windows\System\oJafVzM.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\LbOIhrj.exe
  C:\Windows\System\LbOIhrj.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\tKsGAYz.exe
  C:\Windows\System\tKsGAYz.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\qiRUhHx.exe
  C:\Windows\System\qiRUhHx.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\KaynFjc.exe
  C:\Windows\System\KaynFjc.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\QuENMRD.exe
  C:\Windows\System\QuENMRD.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\Wzsuxag.exe
  C:\Windows\System\Wzsuxag.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\VzHrsXn.exe
  C:\Windows\System\VzHrsXn.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\ItGLuPq.exe
  C:\Windows\System\ItGLuPq.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\wJfATws.exe
  C:\Windows\System\wJfATws.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\RpSQpLZ.exe
  C:\Windows\System\RpSQpLZ.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\QKsJJFm.exe
  C:\Windows\System\QKsJJFm.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\AGTBOwy.exe
  C:\Windows\System\AGTBOwy.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\RWrovkM.exe
  C:\Windows\System\RWrovkM.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\ksQHxwS.exe
  C:\Windows\System\ksQHxwS.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\lXmhhCh.exe
  C:\Windows\System\lXmhhCh.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\YoBokJj.exe
  C:\Windows\System\YoBokJj.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\RvJLkTB.exe
  C:\Windows\System\RvJLkTB.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\vEtZwoD.exe
  C:\Windows\System\vEtZwoD.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\BDjtCyi.exe
  C:\Windows\System\BDjtCyi.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\GCkLlvc.exe
  C:\Windows\System\GCkLlvc.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\YdpTOOL.exe
  C:\Windows\System\YdpTOOL.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\xNZEOFO.exe
  C:\Windows\System\xNZEOFO.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\BXJorKL.exe
  C:\Windows\System\BXJorKL.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\HMSTbrd.exe
  C:\Windows\System\HMSTbrd.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\TLwQjGR.exe
  C:\Windows\System\TLwQjGR.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\Tsnqawp.exe
  C:\Windows\System\Tsnqawp.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\xUXlwgB.exe
  C:\Windows\System\xUXlwgB.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\uRBBUvG.exe
  C:\Windows\System\uRBBUvG.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\kTaaEbx.exe
  C:\Windows\System\kTaaEbx.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\trTjYTp.exe
  C:\Windows\System\trTjYTp.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\IcAQsUe.exe
  C:\Windows\System\IcAQsUe.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\sgzmiWV.exe
  C:\Windows\System\sgzmiWV.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\gcKQehw.exe
  C:\Windows\System\gcKQehw.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\dzOkAEa.exe
  C:\Windows\System\dzOkAEa.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\cKCQnFB.exe
  C:\Windows\System\cKCQnFB.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\zZeLAnX.exe
  C:\Windows\System\zZeLAnX.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\VBgkrUX.exe
  C:\Windows\System\VBgkrUX.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\hnyRuNS.exe
  C:\Windows\System\hnyRuNS.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\AdaWiUV.exe
  C:\Windows\System\AdaWiUV.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\vuMPNSH.exe
  C:\Windows\System\vuMPNSH.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\XMjCucr.exe
  C:\Windows\System\XMjCucr.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\CPRPHCc.exe
  C:\Windows\System\CPRPHCc.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\wujNWgb.exe
  C:\Windows\System\wujNWgb.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\DyImjRL.exe
  C:\Windows\System\DyImjRL.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\LjGOMXu.exe
  C:\Windows\System\LjGOMXu.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\uUQRUaG.exe
  C:\Windows\System\uUQRUaG.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\EEKuDDV.exe
  C:\Windows\System\EEKuDDV.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\VrBPjXM.exe
  C:\Windows\System\VrBPjXM.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\EGCDrai.exe
  C:\Windows\System\EGCDrai.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\rBhKEPd.exe
  C:\Windows\System\rBhKEPd.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\arJEXXp.exe
  C:\Windows\System\arJEXXp.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\UIbjYiN.exe
  C:\Windows\System\UIbjYiN.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\KPAqqng.exe
  C:\Windows\System\KPAqqng.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\FiIVYYi.exe
  C:\Windows\System\FiIVYYi.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\ZaVRWPQ.exe
  C:\Windows\System\ZaVRWPQ.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\bfWsnPy.exe
  C:\Windows\System\bfWsnPy.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\OKcKaMO.exe
  C:\Windows\System\OKcKaMO.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\bySRzyi.exe
  C:\Windows\System\bySRzyi.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\ErTYSdi.exe
  C:\Windows\System\ErTYSdi.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\cDTRLBL.exe
  C:\Windows\System\cDTRLBL.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\cBDcXWk.exe
  C:\Windows\System\cBDcXWk.exe
  2⤵
  PID:3140
- C:\Windows\System\MvPpFoV.exe
  C:\Windows\System\MvPpFoV.exe
  2⤵
  PID:2964
- C:\Windows\System\rMssieJ.exe
  C:\Windows\System\rMssieJ.exe
  2⤵
  PID:1984
- C:\Windows\System\OyJTqPD.exe
  C:\Windows\System\OyJTqPD.exe
  2⤵
  PID:3316
- C:\Windows\System\yDtTcPO.exe
  C:\Windows\System\yDtTcPO.exe
  2⤵
  PID:4892
- C:\Windows\System\CdQENme.exe
  C:\Windows\System\CdQENme.exe
  2⤵
  PID:3272
- C:\Windows\System\vxDepgZ.exe
  C:\Windows\System\vxDepgZ.exe
  2⤵
  PID:3324
- C:\Windows\System\NAsKyPG.exe
  C:\Windows\System\NAsKyPG.exe
  2⤵
  PID:1792
- C:\Windows\System\teGJIvJ.exe
  C:\Windows\System\teGJIvJ.exe
  2⤵
  PID:2480
- C:\Windows\System\nbipCia.exe
  C:\Windows\System\nbipCia.exe
  2⤵
  PID:1824
- C:\Windows\System\fttdpNM.exe
  C:\Windows\System\fttdpNM.exe
  2⤵
  PID:4324
- C:\Windows\System\bSuMtGc.exe
  C:\Windows\System\bSuMtGc.exe
  2⤵
  PID:4072
- C:\Windows\System\UaoVbVr.exe
  C:\Windows\System\UaoVbVr.exe
  2⤵
  PID:4780
- C:\Windows\System\SzdeJoR.exe
  C:\Windows\System\SzdeJoR.exe
  2⤵
  PID:948
- C:\Windows\System\TbEqDPK.exe
  C:\Windows\System\TbEqDPK.exe
  2⤵
  PID:4896
- C:\Windows\System\GROsUor.exe
  C:\Windows\System\GROsUor.exe
  2⤵
  PID:3620
- C:\Windows\System\xjXxyHu.exe
  C:\Windows\System\xjXxyHu.exe
  2⤵
  PID:5080
- C:\Windows\System\MEKVFnO.exe
  C:\Windows\System\MEKVFnO.exe
  2⤵
  PID:448
- C:\Windows\System\HeBFJGU.exe
  C:\Windows\System\HeBFJGU.exe
  2⤵
  PID:3468
- C:\Windows\System\yoHJOKV.exe
  C:\Windows\System\yoHJOKV.exe
  2⤵
  PID:5028
- C:\Windows\System\iZhIyLy.exe
  C:\Windows\System\iZhIyLy.exe
  2⤵
  PID:3980
- C:\Windows\System\HgICXun.exe
  C:\Windows\System\HgICXun.exe
  2⤵
  PID:4388
- C:\Windows\System\RoMbuDu.exe
  C:\Windows\System\RoMbuDu.exe
  2⤵
  PID:4880
- C:\Windows\System\oUMoCdI.exe
  C:\Windows\System\oUMoCdI.exe
  2⤵
  PID:4060
- C:\Windows\System\FPKTvJp.exe
  C:\Windows\System\FPKTvJp.exe
  2⤵
  PID:2560
- C:\Windows\System\KFmZLvs.exe
  C:\Windows\System\KFmZLvs.exe
  2⤵
  PID:1832
- C:\Windows\System\wdmgoyn.exe
  C:\Windows\System\wdmgoyn.exe
  2⤵
  PID:1828
- C:\Windows\System\eTADmWR.exe
  C:\Windows\System\eTADmWR.exe
  2⤵
  PID:3568
- C:\Windows\System\dtLuudb.exe
  C:\Windows\System\dtLuudb.exe
  2⤵
  PID:1348
- C:\Windows\System\XMMIpVY.exe
  C:\Windows\System\XMMIpVY.exe
  2⤵
  PID:5112
- C:\Windows\System\iVwldpv.exe
  C:\Windows\System\iVwldpv.exe
  2⤵
  PID:2952
- C:\Windows\System\mHBMEPF.exe
  C:\Windows\System\mHBMEPF.exe
  2⤵
  PID:1976
- C:\Windows\System\QjhEQHI.exe
  C:\Windows\System\QjhEQHI.exe
  2⤵
  PID:1136
- C:\Windows\System\qEFQheu.exe
  C:\Windows\System\qEFQheu.exe
  2⤵
  PID:3792
- C:\Windows\System\MTFFjZh.exe
  C:\Windows\System\MTFFjZh.exe
  2⤵
  PID:3304
- C:\Windows\System\VYnubyS.exe
  C:\Windows\System\VYnubyS.exe
  2⤵
  PID:4032
- C:\Windows\System\gLJbENR.exe
  C:\Windows\System\gLJbENR.exe
  2⤵
  PID:3108
- C:\Windows\System\tGEykDL.exe
  C:\Windows\System\tGEykDL.exe
  2⤵
  PID:3628
- C:\Windows\System\tCcUcMu.exe
  C:\Windows\System\tCcUcMu.exe
  2⤵
  PID:3736
- C:\Windows\System\WYVbqtY.exe
  C:\Windows\System\WYVbqtY.exe
  2⤵
  PID:2040
- C:\Windows\System\LLZlNCd.exe
  C:\Windows\System\LLZlNCd.exe
  2⤵
  PID:4084
- C:\Windows\System\sKETqRV.exe
  C:\Windows\System\sKETqRV.exe
  2⤵
  PID:2004
- C:\Windows\System\ERpPhOr.exe
  C:\Windows\System\ERpPhOr.exe
  2⤵
  PID:5008
- C:\Windows\System\QUjuybd.exe
  C:\Windows\System\QUjuybd.exe
  2⤵
  PID:2356
- C:\Windows\System\ezGQXjq.exe
  C:\Windows\System\ezGQXjq.exe
  2⤵
  PID:760
- C:\Windows\System\IXXvxJg.exe
  C:\Windows\System\IXXvxJg.exe
  2⤵
  PID:2644
- C:\Windows\System\hOwbIqt.exe
  C:\Windows\System\hOwbIqt.exe
  2⤵
  PID:716
- C:\Windows\System\gMDPfNF.exe
  C:\Windows\System\gMDPfNF.exe
  2⤵
  PID:2376
- C:\Windows\System\OgLfzrq.exe
  C:\Windows\System\OgLfzrq.exe
  2⤵
  PID:2660
- C:\Windows\System\xgAEhva.exe
  C:\Windows\System\xgAEhva.exe
  2⤵
  PID:5148
- C:\Windows\System\RdwqkAz.exe
  C:\Windows\System\RdwqkAz.exe
  2⤵
  PID:5176
- C:\Windows\System\rqcwdBV.exe
  C:\Windows\System\rqcwdBV.exe
  2⤵
  PID:5208
- C:\Windows\System\unKSrGk.exe
  C:\Windows\System\unKSrGk.exe
  2⤵
  PID:5240
- C:\Windows\System\SxVijRF.exe
  C:\Windows\System\SxVijRF.exe
  2⤵
  PID:5260
- C:\Windows\System\fttwUCN.exe
  C:\Windows\System\fttwUCN.exe
  2⤵
  PID:5300
- C:\Windows\System\aqNhWNU.exe
  C:\Windows\System\aqNhWNU.exe
  2⤵
  PID:5328
- C:\Windows\System\UOjcdlF.exe
  C:\Windows\System\UOjcdlF.exe
  2⤵
  PID:5344
- C:\Windows\System\AdJxYid.exe
  C:\Windows\System\AdJxYid.exe
  2⤵
  PID:5364
- C:\Windows\System\haWNmTt.exe
  C:\Windows\System\haWNmTt.exe
  2⤵
  PID:5392
- C:\Windows\System\HXcaDEX.exe
  C:\Windows\System\HXcaDEX.exe
  2⤵
  PID:5420
- C:\Windows\System\EPGlGZA.exe
  C:\Windows\System\EPGlGZA.exe
  2⤵
  PID:5448
- C:\Windows\System\YgDVoFR.exe
  C:\Windows\System\YgDVoFR.exe
  2⤵
  PID:5476
- C:\Windows\System\IMGJmjy.exe
  C:\Windows\System\IMGJmjy.exe
  2⤵
  PID:5504
- C:\Windows\System\KUXXCyr.exe
  C:\Windows\System\KUXXCyr.exe
  2⤵
  PID:5528
- C:\Windows\System\vhIqDKJ.exe
  C:\Windows\System\vhIqDKJ.exe
  2⤵
  PID:5568
- C:\Windows\System\FsnUgVd.exe
  C:\Windows\System\FsnUgVd.exe
  2⤵
  PID:5596
- C:\Windows\System\rELOLBm.exe
  C:\Windows\System\rELOLBm.exe
  2⤵
  PID:5624
- C:\Windows\System\VeOrXIi.exe
  C:\Windows\System\VeOrXIi.exe
  2⤵
  PID:5656
- C:\Windows\System\wAJZBOg.exe
  C:\Windows\System\wAJZBOg.exe
  2⤵
  PID:5688
- C:\Windows\System\NbEGlCp.exe
  C:\Windows\System\NbEGlCp.exe
  2⤵
  PID:5712
- C:\Windows\System\NvQMBei.exe
  C:\Windows\System\NvQMBei.exe
  2⤵
  PID:5744
- C:\Windows\System\zoaHJqG.exe
  C:\Windows\System\zoaHJqG.exe
  2⤵
  PID:5780
- C:\Windows\System\cpmgszc.exe
  C:\Windows\System\cpmgszc.exe
  2⤵
  PID:5816
- C:\Windows\System\IYECdBf.exe
  C:\Windows\System\IYECdBf.exe
  2⤵
  PID:5832
- C:\Windows\System\VPkBnKD.exe
  C:\Windows\System\VPkBnKD.exe
  2⤵
  PID:5860
- C:\Windows\System\ZWQZshu.exe
  C:\Windows\System\ZWQZshu.exe
  2⤵
  PID:5888
- C:\Windows\System\nNmAFdu.exe
  C:\Windows\System\nNmAFdu.exe
  2⤵
  PID:5904
- C:\Windows\System\UEbkkxV.exe
  C:\Windows\System\UEbkkxV.exe
  2⤵
  PID:5928
- C:\Windows\System\fnKodan.exe
  C:\Windows\System\fnKodan.exe
  2⤵
  PID:5952
- C:\Windows\System\hCaJCXz.exe
  C:\Windows\System\hCaJCXz.exe
  2⤵
  PID:5984
- C:\Windows\System\ynCSBHu.exe
  C:\Windows\System\ynCSBHu.exe
  2⤵
  PID:6016
- C:\Windows\System\zhldDtB.exe
  C:\Windows\System\zhldDtB.exe
  2⤵
  PID:6044
- C:\Windows\System\cLpinli.exe
  C:\Windows\System\cLpinli.exe
  2⤵
  PID:6080
- C:\Windows\System\PjMmAsQ.exe
  C:\Windows\System\PjMmAsQ.exe
  2⤵
  PID:6104
- C:\Windows\System\OoROVfx.exe
  C:\Windows\System\OoROVfx.exe
  2⤵
  PID:6136
- C:\Windows\System\IXQbGEF.exe
  C:\Windows\System\IXQbGEF.exe
  2⤵
  PID:5128
- C:\Windows\System\DQLdJhC.exe
  C:\Windows\System\DQLdJhC.exe
  2⤵
  PID:5192
- C:\Windows\System\KnIesWP.exe
  C:\Windows\System\KnIesWP.exe
  2⤵
  PID:5248
- C:\Windows\System\XUpSPGz.exe
  C:\Windows\System\XUpSPGz.exe
  2⤵
  PID:5340
- C:\Windows\System\XukFutA.exe
  C:\Windows\System\XukFutA.exe
  2⤵
  PID:5384
- C:\Windows\System\WHwfnKu.exe
  C:\Windows\System\WHwfnKu.exe
  2⤵
  PID:5436
- C:\Windows\System\aoRQEGf.exe
  C:\Windows\System\aoRQEGf.exe
  2⤵
  PID:5548
- C:\Windows\System\HzjDzvY.exe
  C:\Windows\System\HzjDzvY.exe
  2⤵
  PID:5612
- C:\Windows\System\hblfofj.exe
  C:\Windows\System\hblfofj.exe
  2⤵
  PID:5636
- C:\Windows\System\EyoiukO.exe
  C:\Windows\System\EyoiukO.exe
  2⤵
  PID:5736
- C:\Windows\System\zOeWlsm.exe
  C:\Windows\System\zOeWlsm.exe
  2⤵
  PID:5788
- C:\Windows\System\qiXekIz.exe
  C:\Windows\System\qiXekIz.exe
  2⤵
  PID:5900
- C:\Windows\System\SLfgssm.exe
  C:\Windows\System\SLfgssm.exe
  2⤵
  PID:5948
- C:\Windows\System\ITvQxOJ.exe
  C:\Windows\System\ITvQxOJ.exe
  2⤵
  PID:5976
- C:\Windows\System\vgtKsEr.exe
  C:\Windows\System\vgtKsEr.exe
  2⤵
  PID:6064
- C:\Windows\System\ROpgTHk.exe
  C:\Windows\System\ROpgTHk.exe
  2⤵
  PID:6116
- C:\Windows\System\PXIAEXB.exe
  C:\Windows\System\PXIAEXB.exe
  2⤵
  PID:2296
- C:\Windows\System\QSUxmtz.exe
  C:\Windows\System\QSUxmtz.exe
  2⤵
  PID:5228
- C:\Windows\System\wISZtKf.exe
  C:\Windows\System\wISZtKf.exe
  2⤵
  PID:5416
- C:\Windows\System\DwJqTwI.exe
  C:\Windows\System\DwJqTwI.exe
  2⤵
  PID:5676
- C:\Windows\System\PFWzjDH.exe
  C:\Windows\System\PFWzjDH.exe
  2⤵
  PID:5916
- C:\Windows\System\YqoizPc.exe
  C:\Windows\System\YqoizPc.exe
  2⤵
  PID:6032
- C:\Windows\System\muIRiRL.exe
  C:\Windows\System\muIRiRL.exe
  2⤵
  PID:5220
- C:\Windows\System\JqfgxYo.exe
  C:\Windows\System\JqfgxYo.exe
  2⤵
  PID:5700
- C:\Windows\System\LKlrqxY.exe
  C:\Windows\System\LKlrqxY.exe
  2⤵
  PID:5772
- C:\Windows\System\ECHZhiM.exe
  C:\Windows\System\ECHZhiM.exe
  2⤵
  PID:6132
- C:\Windows\System\oHTLxcm.exe
  C:\Windows\System\oHTLxcm.exe
  2⤵
  PID:5496
- C:\Windows\System\SzLcSPU.exe
  C:\Windows\System\SzLcSPU.exe
  2⤵
  PID:6172
- C:\Windows\System\VCpJwqE.exe
  C:\Windows\System\VCpJwqE.exe
  2⤵
  PID:6196
- C:\Windows\System\ueqhSEt.exe
  C:\Windows\System\ueqhSEt.exe
  2⤵
  PID:6216
- C:\Windows\System\OxORCfz.exe
  C:\Windows\System\OxORCfz.exe
  2⤵
  PID:6248
- C:\Windows\System\Flnodph.exe
  C:\Windows\System\Flnodph.exe
  2⤵
  PID:6280
- C:\Windows\System\yHXPucU.exe
  C:\Windows\System\yHXPucU.exe
  2⤵
  PID:6300
- C:\Windows\System\ZfsldnV.exe
  C:\Windows\System\ZfsldnV.exe
  2⤵
  PID:6328
- C:\Windows\System\bmQAhLv.exe
  C:\Windows\System\bmQAhLv.exe
  2⤵
  PID:6344
- C:\Windows\System\nROZKoE.exe
  C:\Windows\System\nROZKoE.exe
  2⤵
  PID:6368
- C:\Windows\System\PVGMCwn.exe
  C:\Windows\System\PVGMCwn.exe
  2⤵
  PID:6392
- C:\Windows\System\pUZqszJ.exe
  C:\Windows\System\pUZqszJ.exe
  2⤵
  PID:6416
- C:\Windows\System\MSwewTZ.exe
  C:\Windows\System\MSwewTZ.exe
  2⤵
  PID:6456
- C:\Windows\System\WGUrgQA.exe
  C:\Windows\System\WGUrgQA.exe
  2⤵
  PID:6484
- C:\Windows\System\OwrVxeF.exe
  C:\Windows\System\OwrVxeF.exe
  2⤵
  PID:6508
- C:\Windows\System\uIzJzSr.exe
  C:\Windows\System\uIzJzSr.exe
  2⤵
  PID:6544
- C:\Windows\System\cRMYypS.exe
  C:\Windows\System\cRMYypS.exe
  2⤵
  PID:6564
- C:\Windows\System\rznBKsu.exe
  C:\Windows\System\rznBKsu.exe
  2⤵
  PID:6596
- C:\Windows\System\VPcoIoM.exe
  C:\Windows\System\VPcoIoM.exe
  2⤵
  PID:6636
- C:\Windows\System\vJfWRXa.exe
  C:\Windows\System\vJfWRXa.exe
  2⤵
  PID:6656
- C:\Windows\System\fhJrbip.exe
  C:\Windows\System\fhJrbip.exe
  2⤵
  PID:6684
- C:\Windows\System\qadCrsh.exe
  C:\Windows\System\qadCrsh.exe
  2⤵
  PID:6712
- C:\Windows\System\uktwNaB.exe
  C:\Windows\System\uktwNaB.exe
  2⤵
  PID:6748
- C:\Windows\System\xIzbcps.exe
  C:\Windows\System\xIzbcps.exe
  2⤵
  PID:6764
- C:\Windows\System\VJdKSIg.exe
  C:\Windows\System\VJdKSIg.exe
  2⤵
  PID:6796
- C:\Windows\System\pYpIscT.exe
  C:\Windows\System\pYpIscT.exe
  2⤵
  PID:6828
- C:\Windows\System\oWvRxbm.exe
  C:\Windows\System\oWvRxbm.exe
  2⤵
  PID:6860
- C:\Windows\System\HXYbbbV.exe
  C:\Windows\System\HXYbbbV.exe
  2⤵
  PID:6888
- C:\Windows\System\Xdhemyh.exe
  C:\Windows\System\Xdhemyh.exe
  2⤵
  PID:6920
- C:\Windows\System\OpcdAoP.exe
  C:\Windows\System\OpcdAoP.exe
  2⤵
  PID:6944
- C:\Windows\System\YosivIe.exe
  C:\Windows\System\YosivIe.exe
  2⤵
  PID:6968
- C:\Windows\System\VfbaqGw.exe
  C:\Windows\System\VfbaqGw.exe
  2⤵
  PID:6996
- C:\Windows\System\yoagDGt.exe
  C:\Windows\System\yoagDGt.exe
  2⤵
  PID:7016
- C:\Windows\System\hKTvjnp.exe
  C:\Windows\System\hKTvjnp.exe
  2⤵
  PID:7040
- C:\Windows\System\uvwrqqn.exe
  C:\Windows\System\uvwrqqn.exe
  2⤵
  PID:7072
- C:\Windows\System\VtlSKHT.exe
  C:\Windows\System\VtlSKHT.exe
  2⤵
  PID:7116
- C:\Windows\System\UFbIRXA.exe
  C:\Windows\System\UFbIRXA.exe
  2⤵
  PID:7136
- C:\Windows\System\uEnbZSM.exe
  C:\Windows\System\uEnbZSM.exe
  2⤵
  PID:7164
- C:\Windows\System\vJAwBUL.exe
  C:\Windows\System\vJAwBUL.exe
  2⤵
  PID:6160
- C:\Windows\System\eTJcIgK.exe
  C:\Windows\System\eTJcIgK.exe
  2⤵
  PID:6240
- C:\Windows\System\TfFbcaM.exe
  C:\Windows\System\TfFbcaM.exe
  2⤵
  PID:6272
- C:\Windows\System\jxWKbfJ.exe
  C:\Windows\System\jxWKbfJ.exe
  2⤵
  PID:6356
- C:\Windows\System\jZVeXKW.exe
  C:\Windows\System\jZVeXKW.exe
  2⤵
  PID:6384
- C:\Windows\System\jnfQUBz.exe
  C:\Windows\System\jnfQUBz.exe
  2⤵
  PID:6552
- C:\Windows\System\dFQeKPF.exe
  C:\Windows\System\dFQeKPF.exe
  2⤵
  PID:6584
- C:\Windows\System\JqUyVQQ.exe
  C:\Windows\System\JqUyVQQ.exe
  2⤵
  PID:6668
- C:\Windows\System\cRMhrKr.exe
  C:\Windows\System\cRMhrKr.exe
  2⤵
  PID:6760
- C:\Windows\System\QuPfWTu.exe
  C:\Windows\System\QuPfWTu.exe
  2⤵
  PID:6812
- C:\Windows\System\iqLdovy.exe
  C:\Windows\System\iqLdovy.exe
  2⤵
  PID:6836
- C:\Windows\System\qsIxPCv.exe
  C:\Windows\System\qsIxPCv.exe
  2⤵
  PID:6932
- C:\Windows\System\uenFtFA.exe
  C:\Windows\System\uenFtFA.exe
  2⤵
  PID:6904
- C:\Windows\System\gAphsRF.exe
  C:\Windows\System\gAphsRF.exe
  2⤵
  PID:7028
- C:\Windows\System\ALiGMqV.exe
  C:\Windows\System\ALiGMqV.exe
  2⤵
  PID:7124
- C:\Windows\System\ZLRrApS.exe
  C:\Windows\System\ZLRrApS.exe
  2⤵
  PID:7132
- C:\Windows\System\jcfqzkj.exe
  C:\Windows\System\jcfqzkj.exe
  2⤵
  PID:5796
- C:\Windows\System\FQiFPGR.exe
  C:\Windows\System\FQiFPGR.exe
  2⤵
  PID:6404
- C:\Windows\System\GCbZuNd.exe
  C:\Windows\System\GCbZuNd.exe
  2⤵
  PID:6464
- C:\Windows\System\JwjoNcA.exe
  C:\Windows\System\JwjoNcA.exe
  2⤵
  PID:6576
- C:\Windows\System\RSdFfdb.exe
  C:\Windows\System\RSdFfdb.exe
  2⤵
  PID:6808
- C:\Windows\System\rlUDCOj.exe
  C:\Windows\System\rlUDCOj.exe
  2⤵
  PID:6928
- C:\Windows\System\laVAGhG.exe
  C:\Windows\System\laVAGhG.exe
  2⤵
  PID:7160
- C:\Windows\System\ozbjlxg.exe
  C:\Windows\System\ozbjlxg.exe
  2⤵
  PID:6212
- C:\Windows\System\TsEEarF.exe
  C:\Windows\System\TsEEarF.exe
  2⤵
  PID:6780
- C:\Windows\System\dNGiCrU.exe
  C:\Windows\System\dNGiCrU.exe
  2⤵
  PID:6604
- C:\Windows\System\IMHyYmG.exe
  C:\Windows\System\IMHyYmG.exe
  2⤵
  PID:6560
- C:\Windows\System\cOViMMK.exe
  C:\Windows\System\cOViMMK.exe
  2⤵
  PID:7188
- C:\Windows\System\wxKIgZR.exe
  C:\Windows\System\wxKIgZR.exe
  2⤵
  PID:7220
- C:\Windows\System\DJAyPYt.exe
  C:\Windows\System\DJAyPYt.exe
  2⤵
  PID:7248
- C:\Windows\System\WmjHTLt.exe
  C:\Windows\System\WmjHTLt.exe
  2⤵
  PID:7280
- C:\Windows\System\GQpUFUN.exe
  C:\Windows\System\GQpUFUN.exe
  2⤵
  PID:7304
- C:\Windows\System\kZcAwoh.exe
  C:\Windows\System\kZcAwoh.exe
  2⤵
  PID:7336
- C:\Windows\System\BjBZOlO.exe
  C:\Windows\System\BjBZOlO.exe
  2⤵
  PID:7352
- C:\Windows\System\IvHWBJH.exe
  C:\Windows\System\IvHWBJH.exe
  2⤵
  PID:7376
- C:\Windows\System\EbTfMTP.exe
  C:\Windows\System\EbTfMTP.exe
  2⤵
  PID:7404
- C:\Windows\System\pmlQyUn.exe
  C:\Windows\System\pmlQyUn.exe
  2⤵
  PID:7428
- C:\Windows\System\ICzejto.exe
  C:\Windows\System\ICzejto.exe
  2⤵
  PID:7452
- C:\Windows\System\LwPBYPD.exe
  C:\Windows\System\LwPBYPD.exe
  2⤵
  PID:7484
- C:\Windows\System\MyfPLiv.exe
  C:\Windows\System\MyfPLiv.exe
  2⤵
  PID:7508
- C:\Windows\System\eUFdisx.exe
  C:\Windows\System\eUFdisx.exe
  2⤵
  PID:7540
- C:\Windows\System\VsHivHN.exe
  C:\Windows\System\VsHivHN.exe
  2⤵
  PID:7568
- C:\Windows\System\uYWSXAT.exe
  C:\Windows\System\uYWSXAT.exe
  2⤵
  PID:7600
- C:\Windows\System\OktTeHJ.exe
  C:\Windows\System\OktTeHJ.exe
  2⤵
  PID:7636
- C:\Windows\System\ZLSHdTm.exe
  C:\Windows\System\ZLSHdTm.exe
  2⤵
  PID:7668
- C:\Windows\System\TWMAZYV.exe
  C:\Windows\System\TWMAZYV.exe
  2⤵
  PID:7692
- C:\Windows\System\yMgoPdZ.exe
  C:\Windows\System\yMgoPdZ.exe
  2⤵
  PID:7716
- C:\Windows\System\AhqcjJg.exe
  C:\Windows\System\AhqcjJg.exe
  2⤵
  PID:7752
- C:\Windows\System\ssmqsge.exe
  C:\Windows\System\ssmqsge.exe
  2⤵
  PID:7788
- C:\Windows\System\mMVFzJq.exe
  C:\Windows\System\mMVFzJq.exe
  2⤵
  PID:7808
- C:\Windows\System\PLkrwSa.exe
  C:\Windows\System\PLkrwSa.exe
  2⤵
  PID:7840
- C:\Windows\System\HKrLEib.exe
  C:\Windows\System\HKrLEib.exe
  2⤵
  PID:7864
- C:\Windows\System\NNmOfAD.exe
  C:\Windows\System\NNmOfAD.exe
  2⤵
  PID:7892
- C:\Windows\System\MkkjFyF.exe
  C:\Windows\System\MkkjFyF.exe
  2⤵
  PID:7912
- C:\Windows\System\gnUXIsI.exe
  C:\Windows\System\gnUXIsI.exe
  2⤵
  PID:7936
- C:\Windows\System\ouTRRKX.exe
  C:\Windows\System\ouTRRKX.exe
  2⤵
  PID:7964
- C:\Windows\System\VcvIREn.exe
  C:\Windows\System\VcvIREn.exe
  2⤵
  PID:7980
- C:\Windows\System\QRPzzIu.exe
  C:\Windows\System\QRPzzIu.exe
  2⤵
  PID:8012
- C:\Windows\System\ALzRRLS.exe
  C:\Windows\System\ALzRRLS.exe
  2⤵
  PID:8036
- C:\Windows\System\msixJFW.exe
  C:\Windows\System\msixJFW.exe
  2⤵
  PID:8064
- C:\Windows\System\hikvXLb.exe
  C:\Windows\System\hikvXLb.exe
  2⤵
  PID:8092
- C:\Windows\System\hBqYHEH.exe
  C:\Windows\System\hBqYHEH.exe
  2⤵
  PID:8128
- C:\Windows\System\QylBOYs.exe
  C:\Windows\System\QylBOYs.exe
  2⤵
  PID:8152
- C:\Windows\System\uCdGPAU.exe
  C:\Windows\System\uCdGPAU.exe
  2⤵
  PID:8188
- C:\Windows\System\ommpbxq.exe
  C:\Windows\System\ommpbxq.exe
  2⤵
  PID:7080
- C:\Windows\System\HoOafUU.exe
  C:\Windows\System\HoOafUU.exe
  2⤵
  PID:7228
- C:\Windows\System\PAihpVQ.exe
  C:\Windows\System\PAihpVQ.exe
  2⤵
  PID:7300
- C:\Windows\System\ZInReBU.exe
  C:\Windows\System\ZInReBU.exe
  2⤵
  PID:7372
- C:\Windows\System\rxEWqyM.exe
  C:\Windows\System\rxEWqyM.exe
  2⤵
  PID:7420
- C:\Windows\System\oAeSKPf.exe
  C:\Windows\System\oAeSKPf.exe
  2⤵
  PID:7500
- C:\Windows\System\NxGDgdL.exe
  C:\Windows\System\NxGDgdL.exe
  2⤵
  PID:7504
- C:\Windows\System\CuVOKce.exe
  C:\Windows\System\CuVOKce.exe
  2⤵
  PID:7628
- C:\Windows\System\ZyKTZnU.exe
  C:\Windows\System\ZyKTZnU.exe
  2⤵
  PID:7652
- C:\Windows\System\mZcgeMG.exe
  C:\Windows\System\mZcgeMG.exe
  2⤵
  PID:7800
- C:\Windows\System\SPVTkBV.exe
  C:\Windows\System\SPVTkBV.exe
  2⤵
  PID:7736
- C:\Windows\System\fxrzeNE.exe
  C:\Windows\System\fxrzeNE.exe
  2⤵
  PID:7932
- C:\Windows\System\CzbFoaF.exe
  C:\Windows\System\CzbFoaF.exe
  2⤵
  PID:8008
- C:\Windows\System\jbIwEsL.exe
  C:\Windows\System\jbIwEsL.exe
  2⤵
  PID:8028
- C:\Windows\System\qpSDUqv.exe
  C:\Windows\System\qpSDUqv.exe
  2⤵
  PID:8080
- C:\Windows\System\clKsLVO.exe
  C:\Windows\System\clKsLVO.exe
  2⤵
  PID:8180
- C:\Windows\System\IMloOme.exe
  C:\Windows\System\IMloOme.exe
  2⤵
  PID:8140
- C:\Windows\System\zKoGLJr.exe
  C:\Windows\System\zKoGLJr.exe
  2⤵
  PID:7416
- C:\Windows\System\oghDlcy.exe
  C:\Windows\System\oghDlcy.exe
  2⤵
  PID:7588
- C:\Windows\System\AskWaIl.exe
  C:\Windows\System\AskWaIl.exe
  2⤵
  PID:7660
- C:\Windows\System\PoJFLeW.exe
  C:\Windows\System\PoJFLeW.exe
  2⤵
  PID:7624
- C:\Windows\System\CEEjqpw.exe
  C:\Windows\System\CEEjqpw.exe
  2⤵
  PID:8100
- C:\Windows\System\fGDzaNu.exe
  C:\Windows\System\fGDzaNu.exe
  2⤵
  PID:7212
- C:\Windows\System\aYFXvVj.exe
  C:\Windows\System\aYFXvVj.exe
  2⤵
  PID:8120
- C:\Windows\System\ZVbsLtn.exe
  C:\Windows\System\ZVbsLtn.exe
  2⤵
  PID:7400
- C:\Windows\System\LXikTZQ.exe
  C:\Windows\System\LXikTZQ.exe
  2⤵
  PID:7776
- C:\Windows\System\vFAilrw.exe
  C:\Windows\System\vFAilrw.exe
  2⤵
  PID:8204
- C:\Windows\System\XEGjGHJ.exe
  C:\Windows\System\XEGjGHJ.exe
  2⤵
  PID:8236
- C:\Windows\System\SsotaTt.exe
  C:\Windows\System\SsotaTt.exe
  2⤵
  PID:8260
- C:\Windows\System\jlLxxac.exe
  C:\Windows\System\jlLxxac.exe
  2⤵
  PID:8304
- C:\Windows\System\BDywQYn.exe
  C:\Windows\System\BDywQYn.exe
  2⤵
  PID:8324
- C:\Windows\System\woPVKJr.exe
  C:\Windows\System\woPVKJr.exe
  2⤵
  PID:8352
- C:\Windows\System\cpjFSaW.exe
  C:\Windows\System\cpjFSaW.exe
  2⤵
  PID:8384
- C:\Windows\System\XPNKDUA.exe
  C:\Windows\System\XPNKDUA.exe
  2⤵
  PID:8412
- C:\Windows\System\BEnBLKv.exe
  C:\Windows\System\BEnBLKv.exe
  2⤵
  PID:8444
- C:\Windows\System\qwWthki.exe
  C:\Windows\System\qwWthki.exe
  2⤵
  PID:8472
- C:\Windows\System\qQYvngF.exe
  C:\Windows\System\qQYvngF.exe
  2⤵
  PID:8488
- C:\Windows\System\jGDcMTt.exe
  C:\Windows\System\jGDcMTt.exe
  2⤵
  PID:8520
- C:\Windows\System\UyUgvby.exe
  C:\Windows\System\UyUgvby.exe
  2⤵
  PID:8540
- C:\Windows\System\ZLDtQgB.exe
  C:\Windows\System\ZLDtQgB.exe
  2⤵
  PID:8572
- C:\Windows\System\cDqaKHq.exe
  C:\Windows\System\cDqaKHq.exe
  2⤵
  PID:8596
- C:\Windows\System\tjeHfUI.exe
  C:\Windows\System\tjeHfUI.exe
  2⤵
  PID:8628
- C:\Windows\System\bnsjOGf.exe
  C:\Windows\System\bnsjOGf.exe
  2⤵
  PID:8660
- C:\Windows\System\eNOKVio.exe
  C:\Windows\System\eNOKVio.exe
  2⤵
  PID:8676
- C:\Windows\System\FAIvhtq.exe
  C:\Windows\System\FAIvhtq.exe
  2⤵
  PID:8712
- C:\Windows\System\euSZShv.exe
  C:\Windows\System\euSZShv.exe
  2⤵
  PID:8740
- C:\Windows\System\LpVILZW.exe
  C:\Windows\System\LpVILZW.exe
  2⤵
  PID:8772
- C:\Windows\System\hWLkElO.exe
  C:\Windows\System\hWLkElO.exe
  2⤵
  PID:8800
- C:\Windows\System\MwFMvXb.exe
  C:\Windows\System\MwFMvXb.exe
  2⤵
  PID:8828
- C:\Windows\System\djSEdmZ.exe
  C:\Windows\System\djSEdmZ.exe
  2⤵
  PID:8856
- C:\Windows\System\dqISHGO.exe
  C:\Windows\System\dqISHGO.exe
  2⤵
  PID:8884
- C:\Windows\System\zePvjms.exe
  C:\Windows\System\zePvjms.exe
  2⤵
  PID:8912
- C:\Windows\System\wCmBjtQ.exe
  C:\Windows\System\wCmBjtQ.exe
  2⤵
  PID:8936
- C:\Windows\System\liUuxcs.exe
  C:\Windows\System\liUuxcs.exe
  2⤵
  PID:8968
- C:\Windows\System\KIeVZTI.exe
  C:\Windows\System\KIeVZTI.exe
  2⤵
  PID:8996
- C:\Windows\System\WpLuvod.exe
  C:\Windows\System\WpLuvod.exe
  2⤵
  PID:9028
- C:\Windows\System\MjAHDJJ.exe
  C:\Windows\System\MjAHDJJ.exe
  2⤵
  PID:9072
- C:\Windows\System\FexhDvJ.exe
  C:\Windows\System\FexhDvJ.exe
  2⤵
  PID:9088
- C:\Windows\System\FfQgUQx.exe
  C:\Windows\System\FfQgUQx.exe
  2⤵
  PID:9116
- C:\Windows\System\kppavNH.exe
  C:\Windows\System\kppavNH.exe
  2⤵
  PID:9140
- C:\Windows\System\jLEhySK.exe
  C:\Windows\System\jLEhySK.exe
  2⤵
  PID:9164
- C:\Windows\System\VxowWot.exe
  C:\Windows\System\VxowWot.exe
  2⤵
  PID:9188
- C:\Windows\System\FmGLvBN.exe
  C:\Windows\System\FmGLvBN.exe
  2⤵
  PID:7268
- C:\Windows\System\dRbrvNg.exe
  C:\Windows\System\dRbrvNg.exe
  2⤵
  PID:8228
- C:\Windows\System\bKrSlLB.exe
  C:\Windows\System\bKrSlLB.exe
  2⤵
  PID:8216
- C:\Windows\System\NutFWaq.exe
  C:\Windows\System\NutFWaq.exe
  2⤵
  PID:8368
- C:\Windows\System\wXxaEjX.exe
  C:\Windows\System\wXxaEjX.exe
  2⤵
  PID:8420
- C:\Windows\System\oPaRJhg.exe
  C:\Windows\System\oPaRJhg.exe
  2⤵
  PID:8464
- C:\Windows\System\ntPUGRE.exe
  C:\Windows\System\ntPUGRE.exe
  2⤵
  PID:8508
- C:\Windows\System\dDWzZhq.exe
  C:\Windows\System\dDWzZhq.exe
  2⤵
  PID:8564
- C:\Windows\System\ywLUdtq.exe
  C:\Windows\System\ywLUdtq.exe
  2⤵
  PID:8584
- C:\Windows\System\nsXBTXD.exe
  C:\Windows\System\nsXBTXD.exe
  2⤵
  PID:8648
- C:\Windows\System\vGairkd.exe
  C:\Windows\System\vGairkd.exe
  2⤵
  PID:8732
- C:\Windows\System\eUUBBOf.exe
  C:\Windows\System\eUUBBOf.exe
  2⤵
  PID:8816
- C:\Windows\System\lZQTeOO.exe
  C:\Windows\System\lZQTeOO.exe
  2⤵
  PID:8796
- C:\Windows\System\mRRiVGd.exe
  C:\Windows\System\mRRiVGd.exe
  2⤵
  PID:8896
- C:\Windows\System\tcfbklk.exe
  C:\Windows\System\tcfbklk.exe
  2⤵
  PID:9040
- C:\Windows\System\uGMqmKE.exe
  C:\Windows\System\uGMqmKE.exe
  2⤵
  PID:9044
- C:\Windows\System\lukQUbK.exe
  C:\Windows\System\lukQUbK.exe
  2⤵
  PID:9148
- C:\Windows\System\vEIEzZB.exe
  C:\Windows\System\vEIEzZB.exe
  2⤵
  PID:9204
- C:\Windows\System\nrViRZh.exe
  C:\Windows\System\nrViRZh.exe
  2⤵
  PID:8276
- C:\Windows\System\nzznMpC.exe
  C:\Windows\System\nzznMpC.exe
  2⤵
  PID:7888
- C:\Windows\System\xUPPaHF.exe
  C:\Windows\System\xUPPaHF.exe
  2⤵
  PID:8720
- C:\Windows\System\MGscHOi.exe
  C:\Windows\System\MGscHOi.exe
  2⤵
  PID:8876
- C:\Windows\System\wrhjKOc.exe
  C:\Windows\System\wrhjKOc.exe
  2⤵
  PID:9112
- C:\Windows\System\hdhYkXR.exe
  C:\Windows\System\hdhYkXR.exe
  2⤵
  PID:8848
- C:\Windows\System\iBJTBvO.exe
  C:\Windows\System\iBJTBvO.exe
  2⤵
  PID:7532
- C:\Windows\System\cLbhmMh.exe
  C:\Windows\System\cLbhmMh.exe
  2⤵
  PID:8364
- C:\Windows\System\NxAhLJd.exe
  C:\Windows\System\NxAhLJd.exe
  2⤵
  PID:9016
- C:\Windows\System\TIeWQEh.exe
  C:\Windows\System\TIeWQEh.exe
  2⤵
  PID:8588
- C:\Windows\System\GIqQDvF.exe
  C:\Windows\System\GIqQDvF.exe
  2⤵
  PID:9232
- C:\Windows\System\xtOtcTI.exe
  C:\Windows\System\xtOtcTI.exe
  2⤵
  PID:9256
- C:\Windows\System\olfgiYH.exe
  C:\Windows\System\olfgiYH.exe
  2⤵
  PID:9292
- C:\Windows\System\vGHyEId.exe
  C:\Windows\System\vGHyEId.exe
  2⤵
  PID:9324
- C:\Windows\System\xPUKtCC.exe
  C:\Windows\System\xPUKtCC.exe
  2⤵
  PID:9356
- C:\Windows\System\tNGRcuD.exe
  C:\Windows\System\tNGRcuD.exe
  2⤵
  PID:9380
- C:\Windows\System\hVhPwQf.exe
  C:\Windows\System\hVhPwQf.exe
  2⤵
  PID:9396
- C:\Windows\System\itzjnkO.exe
  C:\Windows\System\itzjnkO.exe
  2⤵
  PID:9420
- C:\Windows\System\tjUHnGJ.exe
  C:\Windows\System\tjUHnGJ.exe
  2⤵
  PID:9448
- C:\Windows\System\aodbaKe.exe
  C:\Windows\System\aodbaKe.exe
  2⤵
  PID:9480
- C:\Windows\System\gQfsein.exe
  C:\Windows\System\gQfsein.exe
  2⤵
  PID:9508
- C:\Windows\System\WHrIOsl.exe
  C:\Windows\System\WHrIOsl.exe
  2⤵
  PID:9544
- C:\Windows\System\WecLCpx.exe
  C:\Windows\System\WecLCpx.exe
  2⤵
  PID:9564
- C:\Windows\System\ulXRvJd.exe
  C:\Windows\System\ulXRvJd.exe
  2⤵
  PID:9584
- C:\Windows\System\fBGCujU.exe
  C:\Windows\System\fBGCujU.exe
  2⤵
  PID:9608
- C:\Windows\System\PgPUmWj.exe
  C:\Windows\System\PgPUmWj.exe
  2⤵
  PID:9624
- C:\Windows\System\sYHGzHm.exe
  C:\Windows\System\sYHGzHm.exe
  2⤵
  PID:9648
- C:\Windows\System\PxtcPXn.exe
  C:\Windows\System\PxtcPXn.exe
  2⤵
  PID:9668
- C:\Windows\System\EOjmtaZ.exe
  C:\Windows\System\EOjmtaZ.exe
  2⤵
  PID:9704
- C:\Windows\System\lKQHxIn.exe
  C:\Windows\System\lKQHxIn.exe
  2⤵
  PID:9720
- C:\Windows\System\lGIpPvD.exe
  C:\Windows\System\lGIpPvD.exe
  2⤵
  PID:9744
- C:\Windows\System\uXJXLJi.exe
  C:\Windows\System\uXJXLJi.exe
  2⤵
  PID:9776
- C:\Windows\System\qebeFTl.exe
  C:\Windows\System\qebeFTl.exe
  2⤵
  PID:9792
- C:\Windows\System\KaxnfJI.exe
  C:\Windows\System\KaxnfJI.exe
  2⤵
  PID:9820
- C:\Windows\System\uqdvVSA.exe
  C:\Windows\System\uqdvVSA.exe
  2⤵
  PID:9840
- C:\Windows\System\oGibSyF.exe
  C:\Windows\System\oGibSyF.exe
  2⤵
  PID:9860
- C:\Windows\System\oLjzEsy.exe
  C:\Windows\System\oLjzEsy.exe
  2⤵
  PID:9884
- C:\Windows\System\JhiSdiS.exe
  C:\Windows\System\JhiSdiS.exe
  2⤵
  PID:9916
- C:\Windows\System\qgbSGsZ.exe
  C:\Windows\System\qgbSGsZ.exe
  2⤵
  PID:9944
- C:\Windows\System\AwstvYq.exe
  C:\Windows\System\AwstvYq.exe
  2⤵
  PID:9968
- C:\Windows\System\hEdlhgg.exe
  C:\Windows\System\hEdlhgg.exe
  2⤵
  PID:9996
- C:\Windows\System\IHeTgqo.exe
  C:\Windows\System\IHeTgqo.exe
  2⤵
  PID:10032
- C:\Windows\System\WYOaOsI.exe
  C:\Windows\System\WYOaOsI.exe
  2⤵
  PID:10064
- C:\Windows\System\weeIJpY.exe
  C:\Windows\System\weeIJpY.exe
  2⤵
  PID:10084
- C:\Windows\System\lEZiOps.exe
  C:\Windows\System\lEZiOps.exe
  2⤵
  PID:10120
- C:\Windows\System\ZKOyTjt.exe
  C:\Windows\System\ZKOyTjt.exe
  2⤵
  PID:10148
- C:\Windows\System\UKJBPAT.exe
  C:\Windows\System\UKJBPAT.exe
  2⤵
  PID:10176
- C:\Windows\System\UcOeRJG.exe
  C:\Windows\System\UcOeRJG.exe
  2⤵
  PID:10204
- C:\Windows\System\DGSfiGN.exe
  C:\Windows\System\DGSfiGN.exe
  2⤵
  PID:10224
- C:\Windows\System\lOHkLFQ.exe
  C:\Windows\System\lOHkLFQ.exe
  2⤵
  PID:9224
- C:\Windows\System\IiQBdps.exe
  C:\Windows\System\IiQBdps.exe
  2⤵
  PID:9240
- C:\Windows\System\BMDhUhZ.exe
  C:\Windows\System\BMDhUhZ.exe
  2⤵
  PID:9252
- C:\Windows\System\KzTcIsm.exe
  C:\Windows\System\KzTcIsm.exe
  2⤵
  PID:9320
- C:\Windows\System\FOaCTRr.exe
  C:\Windows\System\FOaCTRr.exe
  2⤵
  PID:9412
- C:\Windows\System\JKiiKpu.exe
  C:\Windows\System\JKiiKpu.exe
  2⤵
  PID:9372
- C:\Windows\System\ITKmvZv.exe
  C:\Windows\System\ITKmvZv.exe
  2⤵
  PID:9532
- C:\Windows\System\juNYNjr.exe
  C:\Windows\System\juNYNjr.exe
  2⤵
  PID:9552
- C:\Windows\System\XheCshc.exe
  C:\Windows\System\XheCshc.exe
  2⤵
  PID:9600
- C:\Windows\System\wpfVyDq.exe
  C:\Windows\System\wpfVyDq.exe
  2⤵
  PID:9596
- C:\Windows\System\yMyJzDf.exe
  C:\Windows\System\yMyJzDf.exe
  2⤵
  PID:9784
- C:\Windows\System\kTszdTv.exe
  C:\Windows\System\kTszdTv.exe
  2⤵
  PID:9732
- C:\Windows\System\trEtSPL.exe
  C:\Windows\System\trEtSPL.exe
  2⤵
  PID:9848
- C:\Windows\System\iClErlC.exe
  C:\Windows\System\iClErlC.exe
  2⤵
  PID:9924
- C:\Windows\System\GkidpwL.exe
  C:\Windows\System\GkidpwL.exe
  2⤵
  PID:9960
- C:\Windows\System\PNtprqF.exe
  C:\Windows\System\PNtprqF.exe
  2⤵
  PID:10016
- C:\Windows\System\treQsSe.exe
  C:\Windows\System\treQsSe.exe
  2⤵
  PID:10168
- C:\Windows\System\SVGWsQj.exe
  C:\Windows\System\SVGWsQj.exe
  2⤵
  PID:9284
- C:\Windows\System\PLCiTtb.exe
  C:\Windows\System\PLCiTtb.exe
  2⤵
  PID:9432
- C:\Windows\System\OzLQuBk.exe
  C:\Windows\System\OzLQuBk.exe
  2⤵
  PID:9264
- C:\Windows\System\fqTMcdU.exe
  C:\Windows\System\fqTMcdU.exe
  2⤵
  PID:9680
- C:\Windows\System\GmZugOT.exe
  C:\Windows\System\GmZugOT.exe
  2⤵
  PID:9020
- C:\Windows\System\yntqHCN.exe
  C:\Windows\System\yntqHCN.exe
  2⤵
  PID:9572
- C:\Windows\System\SUzdimI.exe
  C:\Windows\System\SUzdimI.exe
  2⤵
  PID:10232
- C:\Windows\System\kkEkcVu.exe
  C:\Windows\System\kkEkcVu.exe
  2⤵
  PID:10076
- C:\Windows\System\tUEFjiN.exe
  C:\Windows\System\tUEFjiN.exe
  2⤵
  PID:10252
- C:\Windows\System\TpEblLc.exe
  C:\Windows\System\TpEblLc.exe
  2⤵
  PID:10280
- C:\Windows\System\KjDmjlI.exe
  C:\Windows\System\KjDmjlI.exe
  2⤵
  PID:10316
- C:\Windows\System\OUIFudR.exe
  C:\Windows\System\OUIFudR.exe
  2⤵
  PID:10348
- C:\Windows\System\KGZcFGC.exe
  C:\Windows\System\KGZcFGC.exe
  2⤵
  PID:10364
- C:\Windows\System\abZDIpL.exe
  C:\Windows\System\abZDIpL.exe
  2⤵
  PID:10384
- C:\Windows\System\UUGYlYy.exe
  C:\Windows\System\UUGYlYy.exe
  2⤵
  PID:10412
- C:\Windows\System\DDFgvlV.exe
  C:\Windows\System\DDFgvlV.exe
  2⤵
  PID:10448
- C:\Windows\System\xQhnRsR.exe
  C:\Windows\System\xQhnRsR.exe
  2⤵
  PID:10464
- C:\Windows\System\UjFxeuv.exe
  C:\Windows\System\UjFxeuv.exe
  2⤵
  PID:10500
- C:\Windows\System\RMTHjsC.exe
  C:\Windows\System\RMTHjsC.exe
  2⤵
  PID:10528
- C:\Windows\System\AhoKbcc.exe
  C:\Windows\System\AhoKbcc.exe
  2⤵
  PID:10556
- C:\Windows\System\uOPPBgd.exe
  C:\Windows\System\uOPPBgd.exe
  2⤵
  PID:10584
- C:\Windows\System\mUAPXlo.exe
  C:\Windows\System\mUAPXlo.exe
  2⤵
  PID:10608
- C:\Windows\System\gOoftYO.exe
  C:\Windows\System\gOoftYO.exe
  2⤵
  PID:10636
- C:\Windows\System\jtjtNeW.exe
  C:\Windows\System\jtjtNeW.exe
  2⤵
  PID:10664
- C:\Windows\System\wOXDyHD.exe
  C:\Windows\System\wOXDyHD.exe
  2⤵
  PID:10688
- C:\Windows\System\CEvfNqT.exe
  C:\Windows\System\CEvfNqT.exe
  2⤵
  PID:10704
- C:\Windows\System\uSnHoCK.exe
  C:\Windows\System\uSnHoCK.exe
  2⤵
  PID:10728
- C:\Windows\System\jfuEabN.exe
  C:\Windows\System\jfuEabN.exe
  2⤵
  PID:10756
- C:\Windows\System\xKjSOdB.exe
  C:\Windows\System\xKjSOdB.exe
  2⤵
  PID:10784
- C:\Windows\System\rmoHUPx.exe
  C:\Windows\System\rmoHUPx.exe
  2⤵
  PID:10812
- C:\Windows\System\RkPhrED.exe
  C:\Windows\System\RkPhrED.exe
  2⤵
  PID:10840
- C:\Windows\System\oXjOtwo.exe
  C:\Windows\System\oXjOtwo.exe
  2⤵
  PID:10872
- C:\Windows\System\ikujTYm.exe
  C:\Windows\System\ikujTYm.exe
  2⤵
  PID:10900
- C:\Windows\System\UFIzIYn.exe
  C:\Windows\System\UFIzIYn.exe
  2⤵
  PID:10924
- C:\Windows\System\iyUCzPw.exe
  C:\Windows\System\iyUCzPw.exe
  2⤵
  PID:10960
- C:\Windows\System\CJQFYTO.exe
  C:\Windows\System\CJQFYTO.exe
  2⤵
  PID:10984
- C:\Windows\System\fzGATJW.exe
  C:\Windows\System\fzGATJW.exe
  2⤵
  PID:11012
- C:\Windows\System\NVIvZwt.exe
  C:\Windows\System\NVIvZwt.exe
  2⤵
  PID:11032
- C:\Windows\System\HJcYiPP.exe
  C:\Windows\System\HJcYiPP.exe
  2⤵
  PID:11060
- C:\Windows\System\EbBCYzY.exe
  C:\Windows\System\EbBCYzY.exe
  2⤵
  PID:11096
- C:\Windows\System\WelxELM.exe
  C:\Windows\System\WelxELM.exe
  2⤵
  PID:11128
- C:\Windows\System\KWhyqaX.exe
  C:\Windows\System\KWhyqaX.exe
  2⤵
  PID:11156
- C:\Windows\System\DTrcwXc.exe
  C:\Windows\System\DTrcwXc.exe
  2⤵
  PID:11184
- C:\Windows\System\UNdyRhZ.exe
  C:\Windows\System\UNdyRhZ.exe
  2⤵
  PID:11212
- C:\Windows\System\kQjjzUJ.exe
  C:\Windows\System\kQjjzUJ.exe
  2⤵
  PID:11244
- C:\Windows\System\GpirUYi.exe
  C:\Windows\System\GpirUYi.exe
  2⤵
  PID:9620
- C:\Windows\System\sggdPKS.exe
  C:\Windows\System\sggdPKS.exe
  2⤵
  PID:9816
- C:\Windows\System\vBkrRYb.exe
  C:\Windows\System\vBkrRYb.exe
  2⤵
  PID:10264
- C:\Windows\System\LjnWXxM.exe
  C:\Windows\System\LjnWXxM.exe
  2⤵
  PID:9836
- C:\Windows\System\ohrRKHC.exe
  C:\Windows\System\ohrRKHC.exe
  2⤵
  PID:10456
- C:\Windows\System\lqgGPdX.exe
  C:\Windows\System\lqgGPdX.exe
  2⤵
  PID:10492
- C:\Windows\System\FuMMONn.exe
  C:\Windows\System\FuMMONn.exe
  2⤵
  PID:10544
- C:\Windows\System\mvkrjrv.exe
  C:\Windows\System\mvkrjrv.exe
  2⤵
  PID:10268
- C:\Windows\System\AedqQDZ.exe
  C:\Windows\System\AedqQDZ.exe
  2⤵
  PID:10460
- C:\Windows\System\NNDfaex.exe
  C:\Windows\System\NNDfaex.exe
  2⤵
  PID:10624
- C:\Windows\System\VprvHxO.exe
  C:\Windows\System\VprvHxO.exe
  2⤵
  PID:10432
- C:\Windows\System\ehDdrHR.exe
  C:\Windows\System\ehDdrHR.exe
  2⤵
  PID:10752
- C:\Windows\System\onBHFOl.exe
  C:\Windows\System\onBHFOl.exe
  2⤵
  PID:10832
- C:\Windows\System\njiJdxv.exe
  C:\Windows\System\njiJdxv.exe
  2⤵
  PID:10652
- C:\Windows\System\zhZLkPt.exe
  C:\Windows\System\zhZLkPt.exe
  2⤵
  PID:10864
- C:\Windows\System\xZNVWcK.exe
  C:\Windows\System\xZNVWcK.exe
  2⤵
  PID:11084
- C:\Windows\System\RVFVEmz.exe
  C:\Windows\System\RVFVEmz.exe
  2⤵
  PID:10972
- C:\Windows\System\JXijBLO.exe
  C:\Windows\System\JXijBLO.exe
  2⤵
  PID:10980
- C:\Windows\System\wazJfMy.exe
  C:\Windows\System\wazJfMy.exe
  2⤵
  PID:11044
- C:\Windows\System\zziarAQ.exe
  C:\Windows\System\zziarAQ.exe
  2⤵
  PID:9880
- C:\Windows\System\XYTMrpJ.exe
  C:\Windows\System\XYTMrpJ.exe
  2⤵
  PID:9964
- C:\Windows\System\KowOwfz.exe
  C:\Windows\System\KowOwfz.exe
  2⤵
  PID:10312
- C:\Windows\System\dFlKFhR.exe
  C:\Windows\System\dFlKFhR.exe
  2⤵
  PID:10356
- C:\Windows\System\wHfqPml.exe
  C:\Windows\System\wHfqPml.exe
  2⤵
  PID:10572
- C:\Windows\System\bsJZpvQ.exe
  C:\Windows\System\bsJZpvQ.exe
  2⤵
  PID:10616
- C:\Windows\System\SPBuNUk.exe
  C:\Windows\System\SPBuNUk.exe
  2⤵
  PID:10720
- C:\Windows\System\DbpzDad.exe
  C:\Windows\System\DbpzDad.exe
  2⤵
  PID:11236
- C:\Windows\System\zAPrBBn.exe
  C:\Windows\System\zAPrBBn.exe
  2⤵
  PID:10828
- C:\Windows\System\EANBGZx.exe
  C:\Windows\System\EANBGZx.exe
  2⤵
  PID:11280
- C:\Windows\System\MfuVRID.exe
  C:\Windows\System\MfuVRID.exe
  2⤵
  PID:11312
- C:\Windows\System\qLxKEFM.exe
  C:\Windows\System\qLxKEFM.exe
  2⤵
  PID:11336
- C:\Windows\System\RgcyFaL.exe
  C:\Windows\System\RgcyFaL.exe
  2⤵
  PID:11368
- C:\Windows\System\GntMKsd.exe
  C:\Windows\System\GntMKsd.exe
  2⤵
  PID:11392
- C:\Windows\System\gilGiZB.exe
  C:\Windows\System\gilGiZB.exe
  2⤵
  PID:11424
- C:\Windows\System\OUchuPQ.exe
  C:\Windows\System\OUchuPQ.exe
  2⤵
  PID:11456
- C:\Windows\System\gRbtwHI.exe
  C:\Windows\System\gRbtwHI.exe
  2⤵
  PID:11480
- C:\Windows\System\gWpDueh.exe
  C:\Windows\System\gWpDueh.exe
  2⤵
  PID:11508
- C:\Windows\System\uKIkRdp.exe
  C:\Windows\System\uKIkRdp.exe
  2⤵
  PID:11532
- C:\Windows\System\KERuUfx.exe
  C:\Windows\System\KERuUfx.exe
  2⤵
  PID:11568
- C:\Windows\System\MBsbclC.exe
  C:\Windows\System\MBsbclC.exe
  2⤵
  PID:11596
- C:\Windows\System\GNRLVwa.exe
  C:\Windows\System\GNRLVwa.exe
  2⤵
  PID:11624
- C:\Windows\System\mipoAas.exe
  C:\Windows\System\mipoAas.exe
  2⤵
  PID:11648
- C:\Windows\System\lJlzMfH.exe
  C:\Windows\System\lJlzMfH.exe
  2⤵
  PID:11668
- C:\Windows\System\YNPCKOD.exe
  C:\Windows\System\YNPCKOD.exe
  2⤵
  PID:11696
- C:\Windows\System\biEGTtg.exe
  C:\Windows\System\biEGTtg.exe
  2⤵
  PID:11724
- C:\Windows\System\NefKsRq.exe
  C:\Windows\System\NefKsRq.exe
  2⤵
  PID:11764
- C:\Windows\System\RNJaItn.exe
  C:\Windows\System\RNJaItn.exe
  2⤵
  PID:11784
- C:\Windows\System\ugzPEZU.exe
  C:\Windows\System\ugzPEZU.exe
  2⤵
  PID:11812
- C:\Windows\System\bVHuqRP.exe
  C:\Windows\System\bVHuqRP.exe
  2⤵
  PID:11840
- C:\Windows\System\OVqjhmW.exe
  C:\Windows\System\OVqjhmW.exe
  2⤵
  PID:11864
- C:\Windows\System\wsLdihR.exe
  C:\Windows\System\wsLdihR.exe
  2⤵
  PID:11892
- C:\Windows\System\TOcZUuN.exe
  C:\Windows\System\TOcZUuN.exe
  2⤵
  PID:11920
- C:\Windows\System\AjsPGGa.exe
  C:\Windows\System\AjsPGGa.exe
  2⤵
  PID:11952
- C:\Windows\System\FaKUIdU.exe
  C:\Windows\System\FaKUIdU.exe
  2⤵
  PID:11984
- C:\Windows\System\dKGOsbB.exe
  C:\Windows\System\dKGOsbB.exe
  2⤵
  PID:12012
- C:\Windows\System\GiINLcw.exe
  C:\Windows\System\GiINLcw.exe
  2⤵
  PID:12032
- C:\Windows\System\WKePczA.exe
  C:\Windows\System\WKePczA.exe
  2⤵
  PID:12064
- C:\Windows\System\zZJnLoT.exe
  C:\Windows\System\zZJnLoT.exe
  2⤵
  PID:12096
- C:\Windows\System\iNDIzhc.exe
  C:\Windows\System\iNDIzhc.exe
  2⤵
  PID:12124
- C:\Windows\System\uaIjZlQ.exe
  C:\Windows\System\uaIjZlQ.exe
  2⤵
  PID:12148
- C:\Windows\System\NMfQmta.exe
  C:\Windows\System\NMfQmta.exe
  2⤵
  PID:12176
- C:\Windows\System\gTJdTga.exe
  C:\Windows\System\gTJdTga.exe
  2⤵
  PID:12208
- C:\Windows\System\vlQwovH.exe
  C:\Windows\System\vlQwovH.exe
  2⤵
  PID:12228
- C:\Windows\System\emAZqsY.exe
  C:\Windows\System\emAZqsY.exe
  2⤵
  PID:12260
- C:\Windows\System\RjmKkmW.exe
  C:\Windows\System\RjmKkmW.exe
  2⤵
  PID:12284
- C:\Windows\System\cudHUsT.exe
  C:\Windows\System\cudHUsT.exe
  2⤵
  PID:10744
- C:\Windows\System\PUjiSVz.exe
  C:\Windows\System\PUjiSVz.exe
  2⤵
  PID:10248
- C:\Windows\System\rVzhrRO.exe
  C:\Windows\System\rVzhrRO.exe
  2⤵
  PID:10380
- C:\Windows\System\MNyeYuU.exe
  C:\Windows\System\MNyeYuU.exe
  2⤵
  PID:10912
- C:\Windows\System\fqtGQyH.exe
  C:\Windows\System\fqtGQyH.exe
  2⤵
  PID:11296
- C:\Windows\System\twxzyPS.exe
  C:\Windows\System\twxzyPS.exe
  2⤵
  PID:11524
- C:\Windows\System\AbBtDOo.exe
  C:\Windows\System\AbBtDOo.exe
  2⤵
  PID:11384
- C:\Windows\System\MDcnWnC.exe
  C:\Windows\System\MDcnWnC.exe
  2⤵
  PID:11324
- C:\Windows\System\IaHibjw.exe
  C:\Windows\System\IaHibjw.exe
  2⤵
  PID:11776
- C:\Windows\System\OlnwyHl.exe
  C:\Windows\System\OlnwyHl.exe
  2⤵
  PID:11608
- C:\Windows\System\YPrDCtq.exe
  C:\Windows\System\YPrDCtq.exe
  2⤵
  PID:11856
- C:\Windows\System\cEfqnew.exe
  C:\Windows\System\cEfqnew.exe
  2⤵
  PID:11488
- C:\Windows\System\lYdhWGb.exe
  C:\Windows\System\lYdhWGb.exe
  2⤵
  PID:11936
- C:\Windows\System\lQbbHnW.exe
  C:\Windows\System\lQbbHnW.exe
  2⤵
  PID:11860
- C:\Windows\System\xgfCcQD.exe
  C:\Windows\System\xgfCcQD.exe
  2⤵
  PID:12112
- C:\Windows\System\jPlrxrm.exe
  C:\Windows\System\jPlrxrm.exe
  2⤵
  PID:12120
- C:\Windows\System\xfiGHSL.exe
  C:\Windows\System\xfiGHSL.exe
  2⤵
  PID:12024
- C:\Windows\System\NwHOmPb.exe
  C:\Windows\System\NwHOmPb.exe
  2⤵
  PID:12276
- C:\Windows\System\HuqRtDf.exe
  C:\Windows\System\HuqRtDf.exe
  2⤵
  PID:12004
- C:\Windows\System\ssKajCU.exe
  C:\Windows\System\ssKajCU.exe
  2⤵
  PID:11300
- C:\Windows\System\PPCjTYM.exe
  C:\Windows\System\PPCjTYM.exe
  2⤵
  PID:12220
- C:\Windows\System\jJsdEQl.exe
  C:\Windows\System\jJsdEQl.exe
  2⤵
  PID:10676
- C:\Windows\System\EnMytrX.exe
  C:\Windows\System\EnMytrX.exe
  2⤵
  PID:12244
- C:\Windows\System\ECFBlzR.exe
  C:\Windows\System\ECFBlzR.exe
  2⤵
  PID:12312
- C:\Windows\System\WYmTQfY.exe
  C:\Windows\System\WYmTQfY.exe
  2⤵
  PID:12340
- C:\Windows\System\QdwVzFr.exe
  C:\Windows\System\QdwVzFr.exe
  2⤵
  PID:12372
- C:\Windows\System\RCnMsaA.exe
  C:\Windows\System\RCnMsaA.exe
  2⤵
  PID:12396
- C:\Windows\System\SahLepi.exe
  C:\Windows\System\SahLepi.exe
  2⤵
  PID:12412
- C:\Windows\System\lTDvqaB.exe
  C:\Windows\System\lTDvqaB.exe
  2⤵
  PID:12436
- C:\Windows\System\cTnVNsR.exe
  C:\Windows\System\cTnVNsR.exe
  2⤵
  PID:12464
- C:\Windows\System\WBuocnQ.exe
  C:\Windows\System\WBuocnQ.exe
  2⤵
  PID:12496
- C:\Windows\System\mTyGOax.exe
  C:\Windows\System\mTyGOax.exe
  2⤵
  PID:12532
- C:\Windows\System\mvjvSLw.exe
  C:\Windows\System\mvjvSLw.exe
  2⤵
  PID:12552
- C:\Windows\System\SEvKNPQ.exe
  C:\Windows\System\SEvKNPQ.exe
  2⤵
  PID:12584
- C:\Windows\System\DnNaJkq.exe
  C:\Windows\System\DnNaJkq.exe
  2⤵
  PID:12608
- C:\Windows\System\RnDVqQT.exe
  C:\Windows\System\RnDVqQT.exe
  2⤵
  PID:12636
- C:\Windows\System\WYmXYJu.exe
  C:\Windows\System\WYmXYJu.exe
  2⤵
  PID:12668
- C:\Windows\System\HQjhYBB.exe
  C:\Windows\System\HQjhYBB.exe
  2⤵
  PID:12696
- C:\Windows\System\fGMDKyk.exe
  C:\Windows\System\fGMDKyk.exe
  2⤵
  PID:12716
- C:\Windows\System\iCHNIee.exe
  C:\Windows\System\iCHNIee.exe
  2⤵
  PID:12740
- C:\Windows\System\ipgdzVo.exe
  C:\Windows\System\ipgdzVo.exe
  2⤵
  PID:12772
- C:\Windows\System\MQiwudM.exe
  C:\Windows\System\MQiwudM.exe
  2⤵
  PID:12812
- C:\Windows\System\oygzPRx.exe
  C:\Windows\System\oygzPRx.exe
  2⤵
  PID:12840
- C:\Windows\System\OjbxUhh.exe
  C:\Windows\System\OjbxUhh.exe
  2⤵
  PID:12872
- C:\Windows\System\PwfMynZ.exe
  C:\Windows\System\PwfMynZ.exe
  2⤵
  PID:12896
- C:\Windows\System\XtpPkGT.exe
  C:\Windows\System\XtpPkGT.exe
  2⤵
  PID:12916
- C:\Windows\System\iWrAWyr.exe
  C:\Windows\System\iWrAWyr.exe
  2⤵
  PID:12936
- C:\Windows\System\TKPXWeX.exe
  C:\Windows\System\TKPXWeX.exe
  2⤵
  PID:12968
- C:\Windows\System\FZMOPhO.exe
  C:\Windows\System\FZMOPhO.exe
  2⤵
  PID:13004
- C:\Windows\System\GMCEPSW.exe
  C:\Windows\System\GMCEPSW.exe
  2⤵
  PID:13028
- C:\Windows\System\XuHICDc.exe
  C:\Windows\System\XuHICDc.exe
  2⤵
  PID:13052
- C:\Windows\System\PJmwLmd.exe
  C:\Windows\System\PJmwLmd.exe
  2⤵
  PID:13080
- C:\Windows\System\PPFsOen.exe
  C:\Windows\System\PPFsOen.exe
  2⤵
  PID:13104
- C:\Windows\System\JBihmGi.exe
  C:\Windows\System\JBihmGi.exe
  2⤵
  PID:13140
- C:\Windows\System\HQRbvLD.exe
  C:\Windows\System\HQRbvLD.exe
  2⤵
  PID:13164
- C:\Windows\System\TVoZJxY.exe
  C:\Windows\System\TVoZJxY.exe
  2⤵
  PID:13188
- C:\Windows\System\sQBmMVD.exe
  C:\Windows\System\sQBmMVD.exe
  2⤵
  PID:13212
- C:\Windows\System\hjcimwR.exe
  C:\Windows\System\hjcimwR.exe
  2⤵
  PID:13232
- C:\Windows\System\CiMLTGe.exe
  C:\Windows\System\CiMLTGe.exe
  2⤵
  PID:13256
- C:\Windows\System\SGkqnJN.exe
  C:\Windows\System\SGkqnJN.exe
  2⤵
  PID:13280
- C:\Windows\System\tnIEQIc.exe
  C:\Windows\System\tnIEQIc.exe
  2⤵
  PID:11720
- C:\Windows\System\epgJiDr.exe
  C:\Windows\System\epgJiDr.exe
  2⤵
  PID:11332
- C:\Windows\System\hPrbNOX.exe
  C:\Windows\System\hPrbNOX.exe
  2⤵
  PID:10884
- C:\Windows\System\KPAzDcD.exe
  C:\Windows\System\KPAzDcD.exe
  2⤵
  PID:11380
- C:\Windows\System\kqAocSR.exe
  C:\Windows\System\kqAocSR.exe
  2⤵
  PID:12356
- C:\Windows\System\wRlZfPQ.exe
  C:\Windows\System\wRlZfPQ.exe
  2⤵
  PID:12388
- C:\Windows\System\VEUPVAn.exe
  C:\Windows\System\VEUPVAn.exe
  2⤵
  PID:12192
- C:\Windows\System\CcfOViS.exe
  C:\Windows\System\CcfOViS.exe
  2⤵
  PID:12448
- C:\Windows\System\VAHcmde.exe
  C:\Windows\System\VAHcmde.exe
  2⤵
  PID:12460
- C:\Windows\System\EDYwJxT.exe
  C:\Windows\System\EDYwJxT.exe
  2⤵
  PID:12088
- C:\Windows\System\onofzem.exe
  C:\Windows\System\onofzem.exe
  2⤵
  PID:11740
- C:\Windows\System\vhlqfjl.exe
  C:\Windows\System\vhlqfjl.exe
  2⤵
  PID:12644
- C:\Windows\System\VXSBMxk.exe
  C:\Windows\System\VXSBMxk.exe
  2⤵
  PID:12680
- C:\Windows\System\gUtqElI.exe
  C:\Windows\System\gUtqElI.exe
  2⤵
  PID:12832
- C:\Windows\System\xuoXSXB.exe
  C:\Windows\System\xuoXSXB.exe
  2⤵
  PID:12708
- C:\Windows\System\hBniIrc.exe
  C:\Windows\System\hBniIrc.exe
  2⤵
  PID:12792
- C:\Windows\System\bOoTcpx.exe
  C:\Windows\System\bOoTcpx.exe
  2⤵
  PID:13064
- C:\Windows\System\yYhZztx.exe
  C:\Windows\System\yYhZztx.exe
  2⤵
  PID:12956
- C:\Windows\System\vRkHqRB.exe
  C:\Windows\System\vRkHqRB.exe
  2⤵
  PID:13176
- C:\Windows\System\oTpfwoU.exe
  C:\Windows\System\oTpfwoU.exe
  2⤵
  PID:13224
- C:\Windows\System\OvRUcax.exe
  C:\Windows\System\OvRUcax.exe
  2⤵
  PID:13092
- C:\Windows\System\ratnprR.exe
  C:\Windows\System\ratnprR.exe
  2⤵
  PID:11444
- C:\Windows\System\fGLaYWN.exe
  C:\Windows\System\fGLaYWN.exe
  2⤵
  PID:10400
- C:\Windows\System\oasoHRg.exe
  C:\Windows\System\oasoHRg.exe
  2⤵
  PID:11796
- C:\Windows\System\HqRectU.exe
  C:\Windows\System\HqRectU.exe
  2⤵
  PID:11552
- C:\Windows\System\cmfTFDg.exe
  C:\Windows\System\cmfTFDg.exe
  2⤵
  PID:13272
- C:\Windows\System\OHgmzZe.exe
  C:\Windows\System\OHgmzZe.exe
  2⤵
  PID:13100
- C:\Windows\System\QaVcLDd.exe
  C:\Windows\System\QaVcLDd.exe
  2⤵
  PID:12408
- C:\Windows\System\sFKADPJ.exe
  C:\Windows\System\sFKADPJ.exe
  2⤵
  PID:12892
- C:\Windows\System\qLisiID.exe
  C:\Windows\System\qLisiID.exe
  2⤵
  PID:13324
- C:\Windows\System\aNzrVfP.exe
  C:\Windows\System\aNzrVfP.exe
  2⤵
  PID:13340
- C:\Windows\System\WIbJTNg.exe
  C:\Windows\System\WIbJTNg.exe
  2⤵
  PID:13360
- C:\Windows\System\FQYvAIm.exe
  C:\Windows\System\FQYvAIm.exe
  2⤵
  PID:13384
- C:\Windows\System\TIhDzGB.exe
  C:\Windows\System\TIhDzGB.exe
  2⤵
  PID:13408
- C:\Windows\System\gWWiPmd.exe
  C:\Windows\System\gWWiPmd.exe
  2⤵
  PID:13428
- C:\Windows\System\eFHKXLg.exe
  C:\Windows\System\eFHKXLg.exe
  2⤵
  PID:13444
- C:\Windows\System\GAYFOqE.exe
  C:\Windows\System\GAYFOqE.exe
  2⤵
  PID:13480
- C:\Windows\System\wXIrEHB.exe
  C:\Windows\System\wXIrEHB.exe
  2⤵
  PID:13508
- C:\Windows\System\WjwArwz.exe
  C:\Windows\System\WjwArwz.exe
  2⤵
  PID:13532
- C:\Windows\System\PAEQFet.exe
  C:\Windows\System\PAEQFet.exe
  2⤵
  PID:13560
- C:\Windows\System\WgAhqBy.exe
  C:\Windows\System\WgAhqBy.exe
  2⤵
  PID:13596
- C:\Windows\System\wtiVBfT.exe
  C:\Windows\System\wtiVBfT.exe
  2⤵
  PID:13620
- C:\Windows\System\EHmXXxy.exe
  C:\Windows\System\EHmXXxy.exe
  2⤵
  PID:13644
- C:\Windows\System\JJqmpbx.exe
  C:\Windows\System\JJqmpbx.exe
  2⤵
  PID:13668
- C:\Windows\System\UYqipOw.exe
  C:\Windows\System\UYqipOw.exe
  2⤵
  PID:13692
- C:\Windows\System\hzKCkIN.exe
  C:\Windows\System\hzKCkIN.exe
  2⤵
  PID:13716
- C:\Windows\System\Qztzvyi.exe
  C:\Windows\System\Qztzvyi.exe
  2⤵
  PID:13752
- C:\Windows\System\uHdkZjv.exe
  C:\Windows\System\uHdkZjv.exe
  2⤵
  PID:13784
- C:\Windows\System\UjBLhEC.exe
  C:\Windows\System\UjBLhEC.exe
  2⤵
  PID:13812
- C:\Windows\System\kqaWxKF.exe
  C:\Windows\System\kqaWxKF.exe
  2⤵
  PID:13832
- C:\Windows\System\yoBhsAv.exe
  C:\Windows\System\yoBhsAv.exe
  2⤵
  PID:13860
- C:\Windows\System\TczmEGS.exe
  C:\Windows\System\TczmEGS.exe
  2⤵
  PID:13896
- C:\Windows\System\NkQZIlG.exe
  C:\Windows\System\NkQZIlG.exe
  2⤵
  PID:13932
- C:\Windows\System\BHcHMho.exe
  C:\Windows\System\BHcHMho.exe
  2⤵
  PID:13960
- C:\Windows\System\inqWGMt.exe
  C:\Windows\System\inqWGMt.exe
  2⤵
  PID:13984
- C:\Windows\System\LVskdvF.exe
  C:\Windows\System\LVskdvF.exe
  2⤵
  PID:14016
- C:\Windows\System\xhouyaM.exe
  C:\Windows\System\xhouyaM.exe
  2⤵
  PID:14040
- C:\Windows\System\sIZGaoW.exe
  C:\Windows\System\sIZGaoW.exe
  2⤵
  PID:14068
- C:\Windows\System\pQYVvcS.exe
  C:\Windows\System\pQYVvcS.exe
  2⤵
  PID:14092
- C:\Windows\System\LlDZvSQ.exe
  C:\Windows\System\LlDZvSQ.exe
  2⤵
  PID:14116
- C:\Windows\System\jqANIMN.exe
  C:\Windows\System\jqANIMN.exe
  2⤵
  PID:14144
- C:\Windows\System\SMvtFdr.exe
  C:\Windows\System\SMvtFdr.exe
  2⤵
  PID:14176
- C:\Windows\System\VIVdHev.exe
  C:\Windows\System\VIVdHev.exe
  2⤵
  PID:14200
- C:\Windows\System\krYsaBF.exe
  C:\Windows\System\krYsaBF.exe
  2⤵
  PID:14220
- C:\Windows\System\ehkNvzc.exe
  C:\Windows\System\ehkNvzc.exe
  2⤵
  PID:14252
- C:\Windows\System\cndPxHm.exe
  C:\Windows\System\cndPxHm.exe
  2⤵
  PID:14276
- C:\Windows\System\vHJhguT.exe
  C:\Windows\System\vHJhguT.exe
  2⤵
  PID:14292
- C:\Windows\System\wfVbrJE.exe
  C:\Windows\System\wfVbrJE.exe
  2⤵
  PID:14328
- C:\Windows\System\TKeSMub.exe
  C:\Windows\System\TKeSMub.exe
  2⤵
  PID:12336
- C:\Windows\System\OmJUEbl.exe
  C:\Windows\System\OmJUEbl.exe
  2⤵
  PID:12960
- C:\Windows\System\AgFGIyz.exe
  C:\Windows\System\AgFGIyz.exe
  2⤵
  PID:13000
- C:\Windows\System\lGbOSLp.exe
  C:\Windows\System\lGbOSLp.exe
  2⤵
  PID:11904
- C:\Windows\System\PuNRfoL.exe
  C:\Windows\System\PuNRfoL.exe
  2⤵
  PID:11592
- C:\Windows\System\vLHQxuX.exe
  C:\Windows\System\vLHQxuX.exe
  2⤵
  PID:12144
- C:\Windows\System\CVOpPfI.exe
  C:\Windows\System\CVOpPfI.exe
  2⤵
  PID:12820
- C:\Windows\System\udOwdyL.exe
  C:\Windows\System\udOwdyL.exe
  2⤵
  PID:14136
- C:\Windows\System\brvEEMo.exe
  C:\Windows\System\brvEEMo.exe
  2⤵
  PID:13828
- C:\Windows\System\nWKXdFE.exe
  C:\Windows\System\nWKXdFE.exe
  2⤵
  PID:14236
- C:\Windows\System\nSaSlEw.exe
  C:\Windows\System\nSaSlEw.exe
  2⤵
  PID:14284
- C:\Windows\System\MZSdFtQ.exe
  C:\Windows\System\MZSdFtQ.exe
  2⤵
  PID:14312
- C:\Windows\System\kBTIkYh.exe
  C:\Windows\System\kBTIkYh.exe
  2⤵
  PID:12352
- C:\Windows\System\DxgdajT.exe
  C:\Windows\System\DxgdajT.exe
  2⤵
  PID:13616
- C:\Windows\System\ruPtMQT.exe
  C:\Windows\System\ruPtMQT.exe
  2⤵
  PID:14172
- C:\Windows\System\uLCRsHM.exe
  C:\Windows\System\uLCRsHM.exe
  2⤵
  PID:11636
- C:\Windows\System\FRLTtDk.exe
  C:\Windows\System\FRLTtDk.exe
  2⤵
  PID:14104
- C:\Windows\System\zmyQjZb.exe
  C:\Windows\System\zmyQjZb.exe
  2⤵
  PID:13792
- C:\Windows\System\OXVxwgJ.exe
  C:\Windows\System\OXVxwgJ.exe
  2⤵
  PID:13268
- C:\Windows\System\xYRzOQM.exe
  C:\Windows\System\xYRzOQM.exe
  2⤵
  PID:13316
- C:\Windows\System\GDdjTIj.exe
  C:\Windows\System\GDdjTIj.exe
  2⤵
  PID:14288
- C:\Windows\System\dYIfbVN.exe
  C:\Windows\System\dYIfbVN.exe
  2⤵
  PID:13016
- C:\Windows\System\FRLqEEK.exe
  C:\Windows\System\FRLqEEK.exe
  2⤵
  PID:13824
- C:\Windows\System\UWWNCxY.exe
  C:\Windows\System\UWWNCxY.exe
  2⤵
  PID:13548
- C:\Windows\System\AxsZZkG.exe
  C:\Windows\System\AxsZZkG.exe
  2⤵
  PID:13464
- C:\Windows\System\OAvuglH.exe
  C:\Windows\System\OAvuglH.exe
  2⤵
  PID:14348
- C:\Windows\System\zagIErp.exe
  C:\Windows\System\zagIErp.exe
  2⤵
  PID:14368
- C:\Windows\System\vorfuCS.exe
  C:\Windows\System\vorfuCS.exe
  2⤵
  PID:14388
- C:\Windows\System\qXeVfBt.exe
  C:\Windows\System\qXeVfBt.exe
  2⤵
  PID:14424
- C:\Windows\System\JHkKrfw.exe
  C:\Windows\System\JHkKrfw.exe
  2⤵
  PID:14448
- C:\Windows\System\otNEyqs.exe
  C:\Windows\System\otNEyqs.exe
  2⤵
  PID:14480
- C:\Windows\System\lUtZGIC.exe
  C:\Windows\System\lUtZGIC.exe
  2⤵
  PID:14504
- C:\Windows\System\zDHHKuZ.exe
  C:\Windows\System\zDHHKuZ.exe
  2⤵
  PID:14532
- C:\Windows\System\XZMReZW.exe
  C:\Windows\System\XZMReZW.exe
  2⤵
  PID:14548
- C:\Windows\System\YLcVzAO.exe
  C:\Windows\System\YLcVzAO.exe
  2⤵
  PID:14580
- C:\Windows\System\PovyoGV.exe
  C:\Windows\System\PovyoGV.exe
  2⤵
  PID:14608
- C:\Windows\System\dBeMNng.exe
  C:\Windows\System\dBeMNng.exe
  2⤵
  PID:14632
- C:\Windows\System\FLNUIvg.exe
  C:\Windows\System\FLNUIvg.exe
  2⤵
  PID:14648
- C:\Windows\System\fMrbBUY.exe
  C:\Windows\System\fMrbBUY.exe
  2⤵
  PID:14672
- C:\Windows\System\UFxgYLC.exe
  C:\Windows\System\UFxgYLC.exe
  2⤵
  PID:14700
- C:\Windows\System\HlrbjAo.exe
  C:\Windows\System\HlrbjAo.exe
  2⤵
  PID:14724
- C:\Windows\System\XcEHdMT.exe
  C:\Windows\System\XcEHdMT.exe
  2⤵
  PID:14748
- C:\Windows\System\jmnMEzS.exe
  C:\Windows\System\jmnMEzS.exe
  2⤵
  PID:14764
- C:\Windows\System\cWNvCxK.exe
  C:\Windows\System\cWNvCxK.exe
  2⤵
  PID:14784
- C:\Windows\System\mSvNWZu.exe
  C:\Windows\System\mSvNWZu.exe
  2⤵
  PID:14816
- C:\Windows\System\dLfLlxG.exe
  C:\Windows\System\dLfLlxG.exe
  2⤵
  PID:14840
- C:\Windows\System\tQuWynw.exe
  C:\Windows\System\tQuWynw.exe
  2⤵
  PID:14868
- C:\Windows\System\qLsLXFj.exe
  C:\Windows\System\qLsLXFj.exe
  2⤵
  PID:14884
- C:\Windows\System\vmLgALP.exe
  C:\Windows\System\vmLgALP.exe
  2⤵
  PID:14908
- C:\Windows\System\GNArIRq.exe
  C:\Windows\System\GNArIRq.exe
  2⤵
  PID:14932
- C:\Windows\System\WBOqzTN.exe
  C:\Windows\System\WBOqzTN.exe
  2⤵
  PID:14960
- C:\Windows\System\REgNdVN.exe
  C:\Windows\System\REgNdVN.exe
  2⤵
  PID:14980
- C:\Windows\System\GwEWXJw.exe
  C:\Windows\System\GwEWXJw.exe
  2⤵
  PID:15016
- C:\Windows\System\iluxjpd.exe
  C:\Windows\System\iluxjpd.exe
  2⤵
  PID:15044
- C:\Windows\System\hoeHSSi.exe
  C:\Windows\System\hoeHSSi.exe
  2⤵
  PID:15076
- C:\Windows\System\HmfPvKe.exe
  C:\Windows\System\HmfPvKe.exe
  2⤵
  PID:15104
- C:\Windows\System\cohUgsi.exe
  C:\Windows\System\cohUgsi.exe
  2⤵
  PID:15124
- C:\Windows\System\VdtQHGR.exe
  C:\Windows\System\VdtQHGR.exe
  2⤵
  PID:15144
- C:\Windows\System\AXmhYlq.exe
  C:\Windows\System\AXmhYlq.exe
  2⤵
  PID:15172
- C:\Windows\System\pzueePO.exe
  C:\Windows\System\pzueePO.exe
  2⤵
  PID:15196
- C:\Windows\System\eZMEUdG.exe
  C:\Windows\System\eZMEUdG.exe
  2⤵
  PID:15224
- C:\Windows\System\SvKUlak.exe
  C:\Windows\System\SvKUlak.exe
  2⤵
  PID:15252
- C:\Windows\System\dyRnPSE.exe
  C:\Windows\System\dyRnPSE.exe
  2⤵
  PID:15276
- C:\Windows\System\xULxMkD.exe
  C:\Windows\System\xULxMkD.exe
  2⤵
  PID:15292
- C:\Windows\System\ztHwwjq.exe
  C:\Windows\System\ztHwwjq.exe
  2⤵
  PID:15308
- C:\Windows\System\ySkAwDi.exe
  C:\Windows\System\ySkAwDi.exe
  2⤵
  PID:15336
- C:\Windows\System\yFHgVza.exe
  C:\Windows\System\yFHgVza.exe
  2⤵
  PID:13300
- C:\Windows\System\qIybzuZ.exe
  C:\Windows\System\qIybzuZ.exe
  2⤵
  PID:12516
- C:\Windows\System\QFwDNmq.exe
  C:\Windows\System\QFwDNmq.exe
  2⤵
  PID:14408
- C:\Windows\System\uAWRqSB.exe
  C:\Windows\System\uAWRqSB.exe
  2⤵
  PID:14360
- C:\Windows\System\BbXrahL.exe
  C:\Windows\System\BbXrahL.exe
  2⤵
  PID:14468
- C:\Windows\System\JhTPEkY.exe
  C:\Windows\System\JhTPEkY.exe
  2⤵
  PID:14540
- C:\Windows\System\LKTPkIp.exe
  C:\Windows\System\LKTPkIp.exe
  2⤵
  PID:14560
- C:\Windows\System\IuOZndQ.exe
  C:\Windows\System\IuOZndQ.exe
  2⤵
  PID:14712
- C:\Windows\System\zjoiQpJ.exe
  C:\Windows\System\zjoiQpJ.exe
  2⤵
  PID:14544
- C:\Windows\System\IEMclUR.exe
  C:\Windows\System\IEMclUR.exe
  2⤵
  PID:14684
- C:\Windows\System\BKomOyV.exe
  C:\Windows\System\BKomOyV.exe
  2⤵
  PID:14740
- C:\Windows\System\okvLqzf.exe
  C:\Windows\System\okvLqzf.exe
  2⤵
  PID:14900
- C:\Windows\System\smNKJLW.exe
  C:\Windows\System\smNKJLW.exe
  2⤵
  PID:14948
- C:\Windows\System\Tdjhmij.exe
  C:\Windows\System\Tdjhmij.exe
  2⤵
  PID:15000
- C:\Windows\System\qTfyKNz.exe
  C:\Windows\System\qTfyKNz.exe
  2⤵
  PID:15040
- C:\Windows\System\lyGuRPK.exe
  C:\Windows\System\lyGuRPK.exe
  2⤵
  PID:15088
- C:\Windows\System\lOvyvFs.exe
  C:\Windows\System\lOvyvFs.exe
  2⤵
  PID:14968
- C:\Windows\System\bNUNwdZ.exe
  C:\Windows\System\bNUNwdZ.exe
  2⤵
  PID:15244
- C:\Windows\System\dNZOjTI.exe
  C:\Windows\System\dNZOjTI.exe
  2⤵
  PID:15112
- C:\Windows\System\RrQuzVm.exe
  C:\Windows\System\RrQuzVm.exe
  2⤵
  PID:15132
- C:\Windows\System\BmAGtVC.exe
  C:\Windows\System\BmAGtVC.exe
  2⤵
  PID:14444
- C:\Windows\System\MIAFXfB.exe
  C:\Windows\System\MIAFXfB.exe
  2⤵
  PID:14832
- C:\Windows\System\qoZOqTl.exe
  C:\Windows\System\qoZOqTl.exe
  2⤵
  PID:14340
- C:\Windows\System\oDiJirv.exe
  C:\Windows\System\oDiJirv.exe
  2⤵
  PID:14440
- C:\Windows\System\ALqnsKV.exe
  C:\Windows\System\ALqnsKV.exe
  2⤵
  PID:15384
- C:\Windows\System\OwjFKZV.exe
  C:\Windows\System\OwjFKZV.exe
  2⤵
  PID:15408
- C:\Windows\System\GrBJMFP.exe
  C:\Windows\System\GrBJMFP.exe
  2⤵
  PID:15424
- C:\Windows\System\aaswEUF.exe
  C:\Windows\System\aaswEUF.exe
  2⤵
  PID:15452
- C:\Windows\System\yADGkLz.exe
  C:\Windows\System\yADGkLz.exe
  2⤵
  PID:15476
- C:\Windows\System\cgQOGvL.exe
  C:\Windows\System\cgQOGvL.exe
  2⤵
  PID:15508
- C:\Windows\System\eultGkT.exe
  C:\Windows\System\eultGkT.exe
  2⤵
  PID:15528
- C:\Windows\System\czOOUcQ.exe
  C:\Windows\System\czOOUcQ.exe
  2⤵
  PID:15552
- C:\Windows\System\OJYvZWP.exe
  C:\Windows\System\OJYvZWP.exe
  2⤵
  PID:15572
- C:\Windows\System\RuxljXh.exe
  C:\Windows\System\RuxljXh.exe
  2⤵
  PID:15608
- C:\Windows\System\YzWOSpZ.exe
  C:\Windows\System\YzWOSpZ.exe
  2⤵
  PID:15628
- C:\Windows\System\NbJRszE.exe
  C:\Windows\System\NbJRszE.exe
  2⤵
  PID:15660
- C:\Windows\System\HvfTidY.exe
  C:\Windows\System\HvfTidY.exe
  2⤵
  PID:15688
- C:\Windows\System\eJlxADW.exe
  C:\Windows\System\eJlxADW.exe
  2⤵
  PID:15704
- C:\Windows\System\oWvgJeG.exe
  C:\Windows\System\oWvgJeG.exe
  2⤵
  PID:15724
- C:\Windows\System\vZtRyxq.exe
  C:\Windows\System\vZtRyxq.exe
  2⤵
  PID:15756
- C:\Windows\System\VZCUSWk.exe
  C:\Windows\System\VZCUSWk.exe
  2⤵
  PID:15772
- C:\Windows\System\ndkDylJ.exe
  C:\Windows\System\ndkDylJ.exe
  2⤵
  PID:15796
- C:\Windows\System\KDZwVJB.exe
  C:\Windows\System\KDZwVJB.exe
  2⤵
  PID:15816
- C:\Windows\System\VOtnJvy.exe
  C:\Windows\System\VOtnJvy.exe
  2⤵
  PID:15860
- C:\Windows\System\tDBEnfR.exe
  C:\Windows\System\tDBEnfR.exe
  2⤵
  PID:15884
- C:\Windows\System\IkeqQPj.exe
  C:\Windows\System\IkeqQPj.exe
  2⤵
  PID:15904
- C:\Windows\System\KAcbhiB.exe
  C:\Windows\System\KAcbhiB.exe
  2⤵
  PID:15928
- C:\Windows\System\ECTmEWx.exe
  C:\Windows\System\ECTmEWx.exe
  2⤵
  PID:15952
- C:\Windows\System\UwykKVX.exe
  C:\Windows\System\UwykKVX.exe
  2⤵
  PID:15976
- C:\Windows\System\UDyhOUy.exe
  C:\Windows\System\UDyhOUy.exe
  2⤵
  PID:16000
- C:\Windows\System\TxUkabf.exe
  C:\Windows\System\TxUkabf.exe
  2⤵
  PID:16036
- C:\Windows\System\QPXGJJj.exe
  C:\Windows\System\QPXGJJj.exe
  2⤵
  PID:16060
- C:\Windows\System\mDeBZhO.exe
  C:\Windows\System\mDeBZhO.exe
  2⤵
  PID:16088
- C:\Windows\System\KIfvJBv.exe
  C:\Windows\System\KIfvJBv.exe
  2⤵
  PID:16108
- C:\Windows\System\aceowtB.exe
  C:\Windows\System\aceowtB.exe
  2⤵
  PID:16136
- C:\Windows\System\yIevpkE.exe
  C:\Windows\System\yIevpkE.exe
  2⤵
  PID:16160
- C:\Windows\System\HPgHbcc.exe
  C:\Windows\System\HPgHbcc.exe
  2⤵
  PID:16192
- C:\Windows\System\WLOFNGw.exe
  C:\Windows\System\WLOFNGw.exe
  2⤵
  PID:16220
- C:\Windows\System\aFVZunw.exe
  C:\Windows\System\aFVZunw.exe
  2⤵
  PID:16248
- C:\Windows\System\jvQzbwd.exe
  C:\Windows\System\jvQzbwd.exe
  2⤵
  PID:16280
- C:\Windows\System\WoEeRnt.exe
  C:\Windows\System\WoEeRnt.exe
  2⤵
  PID:16312
- C:\Windows\System\ljKMXnd.exe
  C:\Windows\System\ljKMXnd.exe
  2⤵
  PID:16344
- C:\Windows\System\dTqODZa.exe
  C:\Windows\System\dTqODZa.exe
  2⤵
  PID:16364
- C:\Windows\System\IxaXrEx.exe
  C:\Windows\System\IxaXrEx.exe
  2⤵
  PID:14736
- C:\Windows\System\MzeLLnL.exe
  C:\Windows\System\MzeLLnL.exe
  2⤵
  PID:14576
- C:\Windows\System\pwHUsNB.exe
  C:\Windows\System\pwHUsNB.exe
  2⤵
  PID:15352
- C:\Windows\System\JyjIkfl.exe
  C:\Windows\System\JyjIkfl.exe
  2⤵
  PID:14620
- C:\Windows\System\kyPJFxm.exe
  C:\Windows\System\kyPJFxm.exe
  2⤵
  PID:15368
- C:\Windows\System\qQaJEUT.exe
  C:\Windows\System\qQaJEUT.exe
  2⤵
  PID:14800
- C:\Windows\System\MimlldE.exe
  C:\Windows\System\MimlldE.exe
  2⤵
  PID:14780
- C:\Windows\System\lNqTTiG.exe
  C:\Windows\System\lNqTTiG.exe
  2⤵
  PID:15320
- C:\Windows\System\HDwfUXh.exe
  C:\Windows\System\HDwfUXh.exe
  2⤵
  PID:14824
- C:\Windows\System\sZHZCYA.exe
  C:\Windows\System\sZHZCYA.exe
  2⤵
  PID:14692
- C:\Windows\System\bOtMdoH.exe
  C:\Windows\System\bOtMdoH.exe
  2⤵
  PID:15696
- C:\Windows\System\uPVTWUr.exe
  C:\Windows\System\uPVTWUr.exe
  2⤵
  PID:15032
- C:\Windows\System\FXrbzDO.exe
  C:\Windows\System\FXrbzDO.exe
  2⤵
  PID:15784
- C:\Windows\System\nxOYWwx.exe
  C:\Windows\System\nxOYWwx.exe
  2⤵
  PID:14304
- C:\Windows\System\LABHSPo.exe
  C:\Windows\System\LABHSPo.exe
  2⤵
  PID:16012
- C:\Windows\System\QMeZGoX.exe
  C:\Windows\System\QMeZGoX.exe
  2⤵
  PID:16056
- C:\Windows\System\cpwErjt.exe
  C:\Windows\System\cpwErjt.exe
  2⤵
  PID:16104
- C:\Windows\System\oRtBrVG.exe
  C:\Windows\System\oRtBrVG.exe
  2⤵
  PID:15584
- C:\Windows\System\neGMyGa.exe
  C:\Windows\System\neGMyGa.exe
  2⤵
  PID:15872
- C:\Windows\System\cseTNJY.exe
  C:\Windows\System\cseTNJY.exe
  2⤵
  PID:15684
- C:\Windows\System\xHiGNdg.exe
  C:\Windows\System\xHiGNdg.exe
  2⤵
  PID:16268
- C:\Windows\System\gXECWaj.exe
  C:\Windows\System\gXECWaj.exe
  2⤵
  PID:15984
- C:\Windows\System\ffuqaMR.exe
  C:\Windows\System\ffuqaMR.exe
  2⤵
  PID:15068
- C:\Windows\System\tGEAgOv.exe
  C:\Windows\System\tGEAgOv.exe
  2⤵
  PID:15212
- C:\Windows\System\bmswsWZ.exe
  C:\Windows\System\bmswsWZ.exe
  2⤵
  PID:14956
- C:\Windows\System\MpUcCMx.exe
  C:\Windows\System\MpUcCMx.exe
  2⤵
  PID:15680
- C:\Windows\System\mHVUhUp.exe
  C:\Windows\System\mHVUhUp.exe
  2⤵
  PID:16396
- C:\Windows\System\FvEjXwM.exe
  C:\Windows\System\FvEjXwM.exe
  2⤵
  PID:16412
- C:\Windows\System\AXsoznA.exe
  C:\Windows\System\AXsoznA.exe
  2⤵
  PID:16432
- C:\Windows\System\ZVrFSIG.exe
  C:\Windows\System\ZVrFSIG.exe
  2⤵
  PID:16448
- C:\Windows\System\CxbNgBa.exe
  C:\Windows\System\CxbNgBa.exe
  2⤵
  PID:16484
- C:\Windows\System\jbNbZOV.exe
  C:\Windows\System\jbNbZOV.exe
  2⤵
  PID:16504
- C:\Windows\System\LPnUlkD.exe
  C:\Windows\System\LPnUlkD.exe
  2⤵
  PID:16524
- C:\Windows\System\EEpwAUg.exe
  C:\Windows\System\EEpwAUg.exe
  2⤵
  PID:16544
- C:\Windows\System\ZAlgNpV.exe
  C:\Windows\System\ZAlgNpV.exe
  2⤵
  PID:16576
- C:\Windows\System\bSqKcVl.exe
  C:\Windows\System\bSqKcVl.exe
  2⤵
  PID:16604
- C:\Windows\System\NIOPSlL.exe
  C:\Windows\System\NIOPSlL.exe
  2⤵
  PID:16628
- C:\Windows\System\MdWzyLY.exe
  C:\Windows\System\MdWzyLY.exe
  2⤵
  PID:16652
- C:\Windows\System\NfRUSRZ.exe
  C:\Windows\System\NfRUSRZ.exe
  2⤵
  PID:16688
- C:\Windows\System\LGBaqun.exe
  C:\Windows\System\LGBaqun.exe
  2⤵
  PID:16712
- C:\Windows\System\FwQDbDW.exe
  C:\Windows\System\FwQDbDW.exe
  2⤵
  PID:16736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AGTBOwy.exe

Filesize
1.6MB

MD5
0fe253c5322abf6a5f0913f963975f2e

SHA1
0bdeaae648d0ab09839772c535ad4fefc9a2fb85

SHA256
988945b099ef9c571db3ed1126733b05d9a32642dc955c6816779bd71f310dda

SHA512
5cf111a37be40f5eba814e336331d1a92a31d78850c8eac0c694934bd5dc6d000980751e439e57a8e8575d13130e65aaf812840c6b14ad9ef6ede61dce4ec82c

Download Submit
C:\Windows\System\BDjtCyi.exe

Filesize
1.6MB

MD5
78da3dab5b0257318310810df8db3693

SHA1
5974d8b35ec741e608e15b33d1a305468beddc39

SHA256
0eb9e109aaf22ddfe6293a6414820a77a40946f37bbf50e571b3495984f62c1c

SHA512
f4cf080831ef8d6930e1002b4bee5d8733082996cb90c70d6102f113f56ef0c51dec6734f2df2421a670963bbf145268c06f97b4a73a62f1fc69be12271c7c18

Download Submit
C:\Windows\System\BXJorKL.exe

Filesize
1.6MB

MD5
d95859be2a8bb720b21ee28546839787

SHA1
52637e885932565d574300f260c78579f832230e

SHA256
aebc38c49fc7d4232ab0b6530f989b75c21bbf017ecbb42337d04a0177f974c9

SHA512
b225be795c39c76a2af7328c5d66b8ec4e3194191bbd42eebc670970e9c51e2ac9f2fb530a5223f3eb898c629cf7759115d5faf50e76e8548c37edb6a4f59e16

Download Submit
C:\Windows\System\DqzRljr.exe

Filesize
1.5MB

MD5
902049b1e09e458e4f6feb5a0065f84e

SHA1
caa7d4651179512ea221f37025dfd00da2c18e06

SHA256
48bf6fcf4c11fc6588f6a521acf4eaf5a19c791fdd4164b1ef378de0c58833f1

SHA512
54a761726a23838928c8949bead7197eb87a85059ba45dbadbe0ab730b202ccea1053fd3029c05c18d72ee2f2343a4e620ae918069df173120937b8d10dba7ac

Download Submit
C:\Windows\System\GCkLlvc.exe

Filesize
1.6MB

MD5
bd3d4ae356d1044019f6577e435f4ebb

SHA1
7f7b7558e3b02a01b1041d5bbbd4d20965fc11f4

SHA256
4121c04d931c843132e3508c96055cf4d5e879ddd2b11bda369ecc4e7c383bd2

SHA512
a5e64eb77b52ea225c033ad19dcd8ae846644e5848758e4b098551b4543bd2e25903480804f2dd8df40091778d54c26f047ebf1c2dcf790dbaaa6d1e6023c20b

Download Submit
C:\Windows\System\HMSTbrd.exe

Filesize
1.6MB

MD5
dd76554a02d6a634d28affc5e4c831af

SHA1
40edf24e0292c4d94bf2ab6aaa0a895e6247e229

SHA256
09459af6c049c29567107e9fb03a0fcb801ce6c2f1485a5b8eef6c840829ca8d

SHA512
07e272f12e28c17524b3da51d40ce0d2f6799515e972580f7abd450b417e661f6dfb3df065fa77e2cedf24dcdddaef572efbf1548a36d26edd722262b134d35a

Download Submit
C:\Windows\System\IcAQsUe.exe

Filesize
1.6MB

MD5
0b56d28332ccfa146a0d673714915d4f

SHA1
36fbf6f0cbd0c850ab09b00dbe722cf76ba9cbb1

SHA256
f81fd317ba97e2e1a06b810bcf22687e0d169dff8bafd6f561be28a1ef66c108

SHA512
6d185c0b169434fb66c3df598821949c14efb6b2e27d4f52ef26bf6340e2ba0bc6f48f9252f17f45297e2560130eb786a84b4ae3cccbdd4c6aa15ebf9311e72a

Download Submit
C:\Windows\System\ItGLuPq.exe

Filesize
1.6MB

MD5
07d3bbee5ed3783df1a410378f4e594e

SHA1
e69675dffc5555067c521a8543f152c28e149b8b

SHA256
5c87bc8d975095298b8456e7266206ffc559eb6201379d799772e1df865ada5b

SHA512
ceecd336e209e93bfef85cfd6553cd78e3b1eacd82020bd4d2cbf7709389a0dd4a364b0b913e370a91b99805f4f496f36e1ea84f5da5520b653017e596addae1

Download Submit
C:\Windows\System\KaynFjc.exe

Filesize
1.6MB

MD5
b2f3a5e67425a61d4bd8c8182906f5a1

SHA1
881d59dad83c820fb36d3c5366df1fd83c4807eb

SHA256
4d3fe52a9e4107b061c50e1d865b4dafce9866ea64fbaccce2d63ddf30df7852

SHA512
a7f4f05546366ccced52f5abc262f25d01cfc0f4ce95e896a523ad6344d776fb852ae5668421d669e6e2fa4dc845f0012018c5b24594d3e25f35c13e9a5308fc

Download Submit
C:\Windows\System\LbOIhrj.exe

Filesize
1.6MB

MD5
fd08b02ce82d84875350bdccf63984aa

SHA1
0a4ef6a58043209bbfc5bf766c3e23594ce040c9

SHA256
d52bd73d8f51ef58f07bcc0d33d67a92a129de2c894d93d4f075deb034f2e315

SHA512
0d11c01f555aa4ead8992890805510d7335b37c2a2ca7acc3ba6532d893eecaacd2ca2d8fec5712489af18b02c760addd5fc952238371620f0a72c4c63050d88

Download Submit
C:\Windows\System\QKsJJFm.exe

Filesize
1.6MB

MD5
49a3ddd7250d9f6e77a8425f10a39c50

SHA1
33d7b3b9d6432f9dcdae09b7bd2e49cbcc6dfaa7

SHA256
ff18cbc263685c15c0043e556f0a1aa22c3790c45a30e109068bda7f78381342

SHA512
992616cc811cecc126a7cdd8aa78d9d9f1a6f3f4427cdb6d1d21f3e4b5bbc20ec2c21fd27e6ec9c82e7640391abb32149c21d43c543ba92f895d659149336b3d

Download Submit
C:\Windows\System\QuENMRD.exe

Filesize
1.6MB

MD5
2ccf21043516189b75938a131c87f761

SHA1
ad5152613c0f6f554be7a888db3cabe21ea89c01

SHA256
07a1cce97dabc6db1f45041eddf31e605dece6c1f727bb84c35678be041299c3

SHA512
7f09362d899c488c8c9aafc39da0a39ae03889a8a1b5cccc2238d3adce0babd71733b5f15ba050661cb1b0e1e589d69091689a21f42737ba5e738c6f18cdeafd

Download Submit
C:\Windows\System\RWrovkM.exe

Filesize
1.6MB

MD5
c0f6dee71b128ee24e0f31fe33dac1cb

SHA1
e1eb36377a4c3357f7890cbc95896bdd4d28d195

SHA256
f33042248688823c0a110933b23accf1f1fd5734ff27ee8ff8e4d0681b9db3f4

SHA512
3b6df5348271708f9f3bf8512edf6317ea1a64da46774209ec778655b28b15be02e79f6441f232070c4fbdee515122fc32534a2738f81193d5e290950797d14c

Download Submit
C:\Windows\System\RpSQpLZ.exe

Filesize
1.6MB

MD5
9850de55e8344c77e123e794fa5b4e85

SHA1
33c418ac33a407aec001ca7fd9518e0ce8281623

SHA256
8616abad73707e27cfb7f0e7d20b2d7f52e5b3219f0687b4f147fab4b17bae24

SHA512
26c425281379ab25324b11725006e2d88e2b3dd846383690e7e2315163d6435d3b7abccfdb5cea185849de7b5bd8081f5b773e8dd8e9bc759dc9e52f4cff87f4

Download Submit
C:\Windows\System\RvJLkTB.exe

Filesize
1.6MB

MD5
28d715a008d62d58f709d4eb01d8c189

SHA1
d3df9e817e44eca1d86506573121314c42172854

SHA256
2f35a4846442f9a96218690da994462405f4d4818bc76b96403e4ac31f81d982

SHA512
15c8dcb61f55d92bb9228fc6560876160cf51360d8980586eefcfbaaaea7ee1482d2028579b99bed1a043ab0f7fa01099070ff53aa1d3a68fbdb1996b17d4539

Download Submit
C:\Windows\System\TLwQjGR.exe

Filesize
1.6MB

MD5
b842e01a8196d7ab8ee5b654a745a24c

SHA1
362808c2213528e8eb212ef11622034bade20834

SHA256
876daab06a19f3280b538ea57d9ba2f45289aa367dc731e089857e86fed4ca73

SHA512
9c4f70b230725c8cbe742c21aca0cfc29216df6bbf1b2558aaeb6977782b8f948378e21bcadc41cb2b2dab9c63821c08f9506958dfd5a3921751c6ff11cf683a

Download Submit
C:\Windows\System\Tsnqawp.exe

Filesize
1.6MB

MD5
c94950403ff33cad71c44a676ac0849d

SHA1
6ddfb2f8422cf47523d0c0954cf8246d840552d5

SHA256
89ab6da50369c74031a829f358c48a52365c126894516517fd390b197dac1f4c

SHA512
a1d9459aff1a03e811689e128f2238cd5d707c8510559d5466b9a0a760b60abffba6ff5fe25a812a776117a077456f9787f55fb12b0d66f260b2e41f20486087

Download Submit
C:\Windows\System\VzHrsXn.exe

Filesize
1.6MB

MD5
d117035bbd7521c78441368f014b3a7c

SHA1
144980f56e035143b6828bbae05a525296877f10

SHA256
ffcc49239859ecf011e45f66f232527941c0bfbaad50c8b1af960e1086c0e8b6

SHA512
3c1968b652fd733d704ee21aaebb5639410ed46a9fbfab19ec87d7e87354a97068c21ec2d8f1a317e1241a522e7a9da9e627c23fe785925950f23964b321fa95

Download Submit
C:\Windows\System\Wzsuxag.exe

Filesize
1.6MB

MD5
93643b4ceacc5dfe0074511e716d6b3d

SHA1
e6c0c044e4d44942925bfc8211772b0defd87c17

SHA256
4a3c081dfb0f9f1070a4cf3a7b02d4ad248e7838eb1b72cbb24ac0d37780a516

SHA512
d78c5ddfae1589289780a1125c42635319dcbdb6e524d263a43903228706838fef5b90c0791421773d39c1b26772eecc31172f58ef25c9b3a60f68aafe558e8e

Download Submit
C:\Windows\System\YdpTOOL.exe

Filesize
1.6MB

MD5
d769f40328178910a261d0c1c03a0e70

SHA1
80b08314af8c8042fca64b8f96345089fe6711fd

SHA256
534e6d20ebfcf5af864eaafa40d7b97770e59a51dd518e07740d37b8a09552d3

SHA512
aa6ac717bfc6a2e63f34dc5d80d1c0fe6fff76b97b810de1c9cd8366ac4878326950a251ed50f00cf6e432547984b4c7f72e29b75775ba227a50a33a9e904689

Download Submit
C:\Windows\System\YoBokJj.exe

Filesize
1.6MB

MD5
396461b74420e42fc980b053449da84e

SHA1
9507ac022b955450244c60b6d07d94cb7b087235

SHA256
a0041b9fb4cca6fa6981c431d38bdbdc2b727d25c32d1b91178524615a05f8bf

SHA512
55ebe5c9727a165234e4b5d628a57e235a913f8e20bcc8e3271da8d697c6adec46b8801d0f5b5226230852c189d637d25465225b3ee4f86dc758c55837ea33b0

Download Submit
C:\Windows\System\aGpgIKC.exe

Filesize
1.5MB

MD5
d2fbd53bf737ca9eaee079707911cc9d

SHA1
6357e7c723432543a7da3c42f7963e50cec35f41

SHA256
9163684037f5b82514ebbdd2dff1d0f19be11b379cdb757420011c9c1cefa8f2

SHA512
a97c5cbed3332b7f460b52ef0d3255a204205e1123c53bda70b84e03d9a2bb050c5fd2dac05a0335922b2ae71342f1e340fb798005ab99be298c9797a18b2c6b

Download Submit
C:\Windows\System\kTaaEbx.exe

Filesize
1.6MB

MD5
c22291ff25581e3188e5db2767f75074

SHA1
309f7887a42a34f54327431f5ebc09dc818833ac

SHA256
66f2f64f09fef870f38175edea30f05a85031dfb17ab09fe97dddad5f9198caa

SHA512
13a39a1f94155c77114d9182ab438a95e11c7825528692e95f7b7b762c7b1b6cab604d0f459fd379b131ae7b6f0387eac12e765b604adb649867141809dc2d9c

Download Submit
C:\Windows\System\ksQHxwS.exe

Filesize
1.6MB

MD5
d0feaceb6bec203b1b615b7e998f00d1

SHA1
57b219edbd6d67c89059c075c85521469351d807

SHA256
e28c0919c99e5d8e0f0053638f1bcf3f0256f0e4ec4fae6a6cc9e11ba9282792

SHA512
680a540259b9d70bdcfc7ecc474802539ec77b9e55b783bbe65ab2a13284448d9c0c97db293cd4c286f5f19b4c17c184575f01b12c237e666bdc0f0c15a292bd

Download Submit
C:\Windows\System\lXmhhCh.exe

Filesize
1.6MB

MD5
ec577e62ea38d44eeee3170dd5e4e9ba

SHA1
2f7c25c712851ef7bb3ce3fbf44f6bdb9514bbac

SHA256
c9ee7d8b368fafa3863c331d1eb3c14ed1f8e8b13762e6f2e37976b7f1bf89f2

SHA512
3eccfbcc74c434ccfe494b26ff44c0ea0d9fe261f3ac0501fff396fd0ff76f2896bc8d0404ab5a853a593b3040e616302c100e89a190fd0326b551c051059fe3

Download Submit
C:\Windows\System\oJafVzM.exe

Filesize
1.5MB

MD5
d3f4fc308b2bcd0586f91a221ffa9b8e

SHA1
ece31447d4d4c3c666a98eeba821a1591102bb36

SHA256
383f1ca8dd8670908fd612a902a557a5c669fa8668c42a063ca49a3c6a5f995c

SHA512
db2c7a89edcc7bb88e62e27e7976b3c141f8d01f27e6813ecdd35c780dfa39ac240edac5df160995acacf59244f60efac275a4fa1dbe198f36676b8c213f22a7

Download Submit
C:\Windows\System\qiRUhHx.exe

Filesize
1.6MB

MD5
d53630b8ce331a8640d1076dab7ec39c

SHA1
edd4419f590c5cd33b359a38dc45b63bdcfc48bf

SHA256
bde58561aa954ea27741d4199faf03e2c1267b9d0a00805acdb9403ab0ece236

SHA512
1d00a0dd1042700dd7debc46863f343162de289a75aaa92c077a4d7f8a6c93ab8d00a9c7a9d61cd19f0920ec0aba46011cf2a1f0436b60a3c898508273ede85f

Download Submit
C:\Windows\System\sgzmiWV.exe

Filesize
1.6MB

MD5
b0582b36647ebcd1f635a22c4ae0ad47

SHA1
233c8967623fb0edf816b6e29ccedb33a7b80fad

SHA256
50a47acaf58964c8bda7060e9b17724793418a5e13a727ac252d8c67fc3fc645

SHA512
ae975fca9ffa6c63f0c05b905f88a45be44ab5976bd8d8dbe9a2ad956fecf3ddc17fd99b397f8616c9067a7b0ce23f30743d594f531a5b54984c104c4e97ffda

Download Submit
C:\Windows\System\tKsGAYz.exe

Filesize
1.6MB

MD5
06f1a439ccbaebb1008a03cc5d62b26e

SHA1
b4820ccdc4155cc67c71737b54479e958268b9ac

SHA256
533c7467a5320f625be8ef470c1c7dc559fa1b36964478f3b09c6f534a17d248

SHA512
15514c3a7d0898e080f1adc048d1dbb278f859223d56daf75efc0749704ac6b109d446c5f19355247b0750469b186168d652600b953d6a94c66c006fada17ebf

Download Submit
C:\Windows\System\trTjYTp.exe

Filesize
1.6MB

MD5
6c7f7c1980de32c273be657b0b637932

SHA1
87794e20e654e059778389e1a70b3876b0b9deed

SHA256
4d3a3c07e0fdcd57686abaadd9a4efedc70bf04aa2d4bb087e879e1da28519c9

SHA512
c83ab433cf7d54b2be39dcee0f0a9c5716f30797f15f3fd6a879774f820075984049a6a3e967a06bd6b08f41b05858a4bd453659c226e627d67dbb3dfc922708

Download Submit
C:\Windows\System\uRBBUvG.exe

Filesize
1.6MB

MD5
349ca3c256d894b4b2da22934eff2a51

SHA1
f4668b9c89b00d1cfef1a4ec4c5075bed4f0aa4c

SHA256
cedb17ca988d6c370e8d2f966e09827f5eec934b3ca27d86ec462b6540dd1e3c

SHA512
ae10e878b3116f658fd7e078dfc40a6f5d7aff36d6ba6adb7b904b3359cb50bef3d14c5785a0d8fc944136032f43761a2366c85703222abad96de4450d749e3f

Download Submit
C:\Windows\System\vEtZwoD.exe

Filesize
1.6MB

MD5
41f5d206b2351b6bc20330152be95943

SHA1
fb1e58bed1ecb0e5309f1c37b0949f4d72d78faf

SHA256
7f6016e0957db0598c23b947516c4ee27c146e5c266da03b3ac379089337bff8

SHA512
b27e7ec4bf418b927f389fa58d609a4db31674270ba82845743d8d78c076b518971e81cf769b3b8f2c2442b955455a70671cacb81600d44004d77a31cb465598

Download Submit
C:\Windows\System\wJfATws.exe

Filesize
1.6MB

MD5
7478459df5f6063eef4bbb9c46ec3ee0

SHA1
2afd5e78402bf59f63706c641a68d98d66073fd4

SHA256
74ffcd623a261d89b77ded146e760c7474ebdbc95e78cffcbfe769dee1273856

SHA512
b5de9b971a6f699171ef45e8529765eb3e1d9c16571858b6544b81c4c3b7b5f3353f4c3cc6edc049123c2ab4a6e3f2368f77c7dd1828c990fa210e73408a473f

Download Submit
C:\Windows\System\xNZEOFO.exe

Filesize
1.6MB

MD5
c2e1f8eab633851426045d15a1abec4d

SHA1
b95a9885dac229bb3c58f242c683238ef110069b

SHA256
5ada88ccf9097305d6a52d5ec74fb20e1af7c3f206cf0094aea0386e089a6c0e

SHA512
61620e487c1f904040e2a7b1d935d7fbbb14f0efd41cacfcc6026a7620cfe5b8b1af956b8e05ff4f1c41f4676d683d7ccbbcb2ab6d89373eec846456fea0a225

Download Submit
C:\Windows\System\xUXlwgB.exe

Filesize
1.6MB

MD5
5e3c6aafd95a16095e7faa8f2ee340b8

SHA1
636caf746cafe52284b4c5d12e4fd04f4feede52

SHA256
e06567afd9aff3ab3a1f5380b0029df72b2eff4ff10ac051cd46594147b8a5d5

SHA512
1d0f7636cfaf1bc8a6922037ba9d19d70a283fea61cb266cd033d7f99bbd4ac702f4547cb576e5b7032d71d08e94d75b30dc00d65a221e355da0d18aa7c39b99

Download Submit
C:\Windows\System\yVZWuKn.exe

Filesize
1.5MB

MD5
0b72d9ea2a02da616f9b9fd75aa2d588

SHA1
6b43600a438310a7a3c09c7f846b792b630a7763

SHA256
e5e0565dd6ed7be03924d61d47e0935bcb112bb05651e0dfae795cb67b79d863

SHA512
aab48263faeb8823a4a15c65687f681d7e04427ee42282bfe977678a1eab4b26b424dd716a51afa12c282a3328b5733e2c49717c318ad2259cddd17fa167ca80

Download Submit
memory/4984-0-0x000001CE73F10000-0x000001CE73F20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads