xmrig | 68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d

Analysis

max time kernel
97s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
Size

1.7MB
MD5

8c8238898abdedafdbb8a353be1cb27f
SHA1

c8e038f9c5f867ecfa0422e380594735144ce9eb
SHA256

68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d
SHA512

8d4d288ce5e284580379588fd38cb170026c42fd1e1a1cfaf7ff4badeff7e9c7bb75d605f4e19e7b6d167f8faffd6682b1cedf280cd712301c1ed98dfb645cbb
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLjAp:GemTLkNdfE0pZyH

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023cc2-4.dat	xmrig
behavioral2/files/0x0007000000023cc6-7.dat	xmrig
behavioral2/files/0x0007000000023ccb-27.dat	xmrig
behavioral2/files/0x0007000000023ccf-45.dat	xmrig
behavioral2/files/0x0007000000023cd1-60.dat	xmrig
behavioral2/files/0x0007000000023cd3-72.dat	xmrig
behavioral2/files/0x0007000000023cd0-85.dat	xmrig
behavioral2/files/0x0007000000023cda-110.dat	xmrig
behavioral2/files/0x0007000000023cd9-108.dat	xmrig
behavioral2/files/0x0007000000023cd8-106.dat	xmrig
behavioral2/files/0x0007000000023cd7-104.dat	xmrig
behavioral2/files/0x0007000000023cd6-102.dat	xmrig
behavioral2/files/0x0007000000023cd5-100.dat	xmrig
behavioral2/files/0x0007000000023cd4-98.dat	xmrig
behavioral2/files/0x0007000000023cd2-93.dat	xmrig
behavioral2/files/0x0007000000023cce-58.dat	xmrig
behavioral2/files/0x0007000000023ccd-57.dat	xmrig
behavioral2/files/0x0007000000023ccc-52.dat	xmrig
behavioral2/files/0x0007000000023cca-49.dat	xmrig
behavioral2/files/0x0007000000023cc9-41.dat	xmrig
behavioral2/files/0x0007000000023cc8-38.dat	xmrig
behavioral2/files/0x0007000000023cc7-34.dat	xmrig
behavioral2/files/0x0007000000023cdb-119.dat	xmrig
behavioral2/files/0x0008000000023cc3-124.dat	xmrig
behavioral2/files/0x0007000000023cde-127.dat	xmrig
behavioral2/files/0x0007000000023cdd-134.dat	xmrig
behavioral2/files/0x0007000000023ce0-150.dat	xmrig
behavioral2/files/0x0007000000023ce2-148.dat	xmrig
behavioral2/files/0x0007000000023ce1-146.dat	xmrig
behavioral2/files/0x0007000000023cdf-129.dat	xmrig
behavioral2/files/0x0007000000023ce3-154.dat	xmrig
behavioral2/files/0x0007000000023ce4-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3256	WrsqaRt.exe
1972	EWWqkWL.exe
928	eRMXLxQ.exe
1204	wjSukzC.exe
2908	SQHumZh.exe
3000	kPzqWIx.exe
440	KgmrGHp.exe
4324	YfYOyXY.exe
4004	pXRBgXy.exe
1692	rVLafWi.exe
4800	mtwPrRh.exe
624	DSaxoyh.exe
1296	HuoDXHa.exe
4064	rpaqTod.exe
4084	VyFgspv.exe
3732	ubrTWRS.exe
4080	yrlhfUk.exe
5088	rZxNFLi.exe
948	Dgaqlwy.exe
224	pObsayz.exe
100	VdwbkrK.exe
4480	ZgswDbw.exe
1008	nlxUslL.exe
4132	YUMmvoi.exe
2408	aENnIlR.exe
5080	kbFrCha.exe
4432	jBGbhib.exe
2916	jLjDpCR.exe
3028	DupZkan.exe
2232	VJdXVWD.exe
232	ERObbcm.exe
2348	JZoRzpg.exe
1672	CZqsmoz.exe
4076	GcrgDmV.exe
3172	oDJnLfu.exe
5096	ppfxXdq.exe
3044	ycfGKcG.exe
4816	tgzcAmV.exe
2224	UsveAsd.exe
3332	XtMWdCg.exe
4848	bVrWhmM.exe
2376	BfIEtgX.exe
4040	jFHLKDI.exe
3412	jQdFSRw.exe
3696	FdFEpwk.exe
3964	ZzlfGDU.exe
1028	aHSHSBk.exe
1628	fQzIuOE.exe
2184	uPXiKqE.exe
3112	fqkFOkU.exe
2952	tjKUAQB.exe
3572	fBGSRwy.exe
5068	ASOahxf.exe
4304	xGUvsAu.exe
1784	BJvSmwp.exe
4164	NxiQsxs.exe
944	yfuibMH.exe
1420	EtCUsGB.exe
1588	BFPBJDg.exe
1924	edselVL.exe
3568	jxiKCYy.exe
3724	obBeyDd.exe
2020	VbwTTjx.exe
2904	JPZyMJg.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZkjjFVb.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\ecqbWmp.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\SUPpveh.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\qkJXSAK.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\OZYFHCw.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\HkmqKsS.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\mSkwjBk.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\pIEcuZW.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\ORTFQvO.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\emniWyy.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\tTZDHUg.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\rTgfsBX.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\CboroNb.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\bQFTHHq.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\oRBXuGS.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\ubrTWRS.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\TVDlcvJ.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\Pdxkjnu.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\ymBtbAg.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\yihcPvo.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\xZJPgvP.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\xSxoEeh.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\fCARmAP.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\fCWmCMY.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\OjfNZeu.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\rFBPdOn.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\mnjbMUw.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\pjKCKSW.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\lSZTNvK.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\aPjdxWW.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\dcJPcVz.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\xGUvsAu.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\Mzaaazq.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\ZizkVii.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\DLFWWrm.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\zPizaoE.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\mlxRUdQ.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\WEEZFCa.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\KZliMdd.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\AIHvLZY.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\qNcZjhV.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\JIhYFaC.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\lwXzvOp.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\lmmxmjr.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\rvNDZjW.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\MKStTgA.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\scvQERj.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\GllDTSX.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\BhDLfOl.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\ktRiXWi.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\XGmLktg.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\kGJwXZB.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\cmhBLPa.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\rZxNFLi.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\YUMmvoi.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\uvVxjKl.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\msWmArv.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\JEVURzs.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\ASOahxf.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\imgEmhE.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\GHloiwb.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\kcvZEyq.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\nVmOKuC.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
File created	C:\Windows\System\gkGaxQf.exe	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 3256	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	84
PID 4392 wrote to memory of 3256	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	84
PID 4392 wrote to memory of 1972	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	85
PID 4392 wrote to memory of 1972	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	85
PID 4392 wrote to memory of 928	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	86
PID 4392 wrote to memory of 928	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	86
PID 4392 wrote to memory of 1204	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	87
PID 4392 wrote to memory of 1204	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	87
PID 4392 wrote to memory of 2908	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	88
PID 4392 wrote to memory of 2908	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	88
PID 4392 wrote to memory of 3000	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	89
PID 4392 wrote to memory of 3000	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	89
PID 4392 wrote to memory of 440	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	90
PID 4392 wrote to memory of 440	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	90
PID 4392 wrote to memory of 4324	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	91
PID 4392 wrote to memory of 4324	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	91
PID 4392 wrote to memory of 4004	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	92
PID 4392 wrote to memory of 4004	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	92
PID 4392 wrote to memory of 1692	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	93
PID 4392 wrote to memory of 1692	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	93
PID 4392 wrote to memory of 4800	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	94
PID 4392 wrote to memory of 4800	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	94
PID 4392 wrote to memory of 624	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	95
PID 4392 wrote to memory of 624	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	95
PID 4392 wrote to memory of 1296	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	96
PID 4392 wrote to memory of 1296	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	96
PID 4392 wrote to memory of 4064	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	97
PID 4392 wrote to memory of 4064	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	97
PID 4392 wrote to memory of 4084	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	98
PID 4392 wrote to memory of 4084	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	98
PID 4392 wrote to memory of 3732	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	99
PID 4392 wrote to memory of 3732	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	99
PID 4392 wrote to memory of 4080	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	100
PID 4392 wrote to memory of 4080	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	100
PID 4392 wrote to memory of 5088	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	101
PID 4392 wrote to memory of 5088	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	101
PID 4392 wrote to memory of 948	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	102
PID 4392 wrote to memory of 948	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	102
PID 4392 wrote to memory of 224	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	103
PID 4392 wrote to memory of 224	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	103
PID 4392 wrote to memory of 100	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	104
PID 4392 wrote to memory of 100	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	104
PID 4392 wrote to memory of 4480	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	105
PID 4392 wrote to memory of 4480	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	105
PID 4392 wrote to memory of 1008	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	106
PID 4392 wrote to memory of 1008	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	106
PID 4392 wrote to memory of 4132	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	107
PID 4392 wrote to memory of 4132	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	107
PID 4392 wrote to memory of 2408	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	108
PID 4392 wrote to memory of 2408	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	108
PID 4392 wrote to memory of 5080	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	109
PID 4392 wrote to memory of 5080	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	109
PID 4392 wrote to memory of 4432	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	110
PID 4392 wrote to memory of 4432	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	110
PID 4392 wrote to memory of 2232	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	111
PID 4392 wrote to memory of 2232	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	111
PID 4392 wrote to memory of 2916	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	112
PID 4392 wrote to memory of 2916	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	112
PID 4392 wrote to memory of 3028	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	113
PID 4392 wrote to memory of 3028	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	113
PID 4392 wrote to memory of 232	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	114
PID 4392 wrote to memory of 232	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	114
PID 4392 wrote to memory of 2348	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	115
PID 4392 wrote to memory of 2348	4392	68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe	115

C:\Users\Admin\AppData\Local\Temp\68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe
"C:\Users\Admin\AppData\Local\Temp\68cf3da599e9a8715d31818476ca87ab111a93841d2bb554b7fc7950ba2d1a7d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\System\WrsqaRt.exe
  C:\Windows\System\WrsqaRt.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\EWWqkWL.exe
  C:\Windows\System\EWWqkWL.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\eRMXLxQ.exe
  C:\Windows\System\eRMXLxQ.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\wjSukzC.exe
  C:\Windows\System\wjSukzC.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\SQHumZh.exe
  C:\Windows\System\SQHumZh.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\kPzqWIx.exe
  C:\Windows\System\kPzqWIx.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\KgmrGHp.exe
  C:\Windows\System\KgmrGHp.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\YfYOyXY.exe
  C:\Windows\System\YfYOyXY.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\pXRBgXy.exe
  C:\Windows\System\pXRBgXy.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\rVLafWi.exe
  C:\Windows\System\rVLafWi.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\mtwPrRh.exe
  C:\Windows\System\mtwPrRh.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\DSaxoyh.exe
  C:\Windows\System\DSaxoyh.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\HuoDXHa.exe
  C:\Windows\System\HuoDXHa.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\rpaqTod.exe
  C:\Windows\System\rpaqTod.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\VyFgspv.exe
  C:\Windows\System\VyFgspv.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\ubrTWRS.exe
  C:\Windows\System\ubrTWRS.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\yrlhfUk.exe
  C:\Windows\System\yrlhfUk.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\rZxNFLi.exe
  C:\Windows\System\rZxNFLi.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\Dgaqlwy.exe
  C:\Windows\System\Dgaqlwy.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\pObsayz.exe
  C:\Windows\System\pObsayz.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\VdwbkrK.exe
  C:\Windows\System\VdwbkrK.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\ZgswDbw.exe
  C:\Windows\System\ZgswDbw.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\nlxUslL.exe
  C:\Windows\System\nlxUslL.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\YUMmvoi.exe
  C:\Windows\System\YUMmvoi.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\aENnIlR.exe
  C:\Windows\System\aENnIlR.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\kbFrCha.exe
  C:\Windows\System\kbFrCha.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\jBGbhib.exe
  C:\Windows\System\jBGbhib.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\VJdXVWD.exe
  C:\Windows\System\VJdXVWD.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\jLjDpCR.exe
  C:\Windows\System\jLjDpCR.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\DupZkan.exe
  C:\Windows\System\DupZkan.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\ERObbcm.exe
  C:\Windows\System\ERObbcm.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\JZoRzpg.exe
  C:\Windows\System\JZoRzpg.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\CZqsmoz.exe
  C:\Windows\System\CZqsmoz.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\GcrgDmV.exe
  C:\Windows\System\GcrgDmV.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\oDJnLfu.exe
  C:\Windows\System\oDJnLfu.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\ppfxXdq.exe
  C:\Windows\System\ppfxXdq.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\ycfGKcG.exe
  C:\Windows\System\ycfGKcG.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\tgzcAmV.exe
  C:\Windows\System\tgzcAmV.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\UsveAsd.exe
  C:\Windows\System\UsveAsd.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\XtMWdCg.exe
  C:\Windows\System\XtMWdCg.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\bVrWhmM.exe
  C:\Windows\System\bVrWhmM.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\BfIEtgX.exe
  C:\Windows\System\BfIEtgX.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\jFHLKDI.exe
  C:\Windows\System\jFHLKDI.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\jQdFSRw.exe
  C:\Windows\System\jQdFSRw.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\FdFEpwk.exe
  C:\Windows\System\FdFEpwk.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\ZzlfGDU.exe
  C:\Windows\System\ZzlfGDU.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\aHSHSBk.exe
  C:\Windows\System\aHSHSBk.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\fQzIuOE.exe
  C:\Windows\System\fQzIuOE.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\uPXiKqE.exe
  C:\Windows\System\uPXiKqE.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\fqkFOkU.exe
  C:\Windows\System\fqkFOkU.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\tjKUAQB.exe
  C:\Windows\System\tjKUAQB.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\fBGSRwy.exe
  C:\Windows\System\fBGSRwy.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\ASOahxf.exe
  C:\Windows\System\ASOahxf.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\xGUvsAu.exe
  C:\Windows\System\xGUvsAu.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\BJvSmwp.exe
  C:\Windows\System\BJvSmwp.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\NxiQsxs.exe
  C:\Windows\System\NxiQsxs.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\yfuibMH.exe
  C:\Windows\System\yfuibMH.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\EtCUsGB.exe
  C:\Windows\System\EtCUsGB.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\BFPBJDg.exe
  C:\Windows\System\BFPBJDg.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\edselVL.exe
  C:\Windows\System\edselVL.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\jxiKCYy.exe
  C:\Windows\System\jxiKCYy.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\obBeyDd.exe
  C:\Windows\System\obBeyDd.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\VbwTTjx.exe
  C:\Windows\System\VbwTTjx.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\JPZyMJg.exe
  C:\Windows\System\JPZyMJg.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\uzKHtyV.exe
  C:\Windows\System\uzKHtyV.exe
  2⤵
  PID:4172
- C:\Windows\System\myEEGNL.exe
  C:\Windows\System\myEEGNL.exe
  2⤵
  PID:4764
- C:\Windows\System\NhsnwFI.exe
  C:\Windows\System\NhsnwFI.exe
  2⤵
  PID:4212
- C:\Windows\System\fNTYKWk.exe
  C:\Windows\System\fNTYKWk.exe
  2⤵
  PID:4464
- C:\Windows\System\VUDanaG.exe
  C:\Windows\System\VUDanaG.exe
  2⤵
  PID:4780
- C:\Windows\System\pFKxhfR.exe
  C:\Windows\System\pFKxhfR.exe
  2⤵
  PID:216
- C:\Windows\System\VekMUJI.exe
  C:\Windows\System\VekMUJI.exe
  2⤵
  PID:4900
- C:\Windows\System\WguJQod.exe
  C:\Windows\System\WguJQod.exe
  2⤵
  PID:4908
- C:\Windows\System\SKooahH.exe
  C:\Windows\System\SKooahH.exe
  2⤵
  PID:3368
- C:\Windows\System\sqeVAEk.exe
  C:\Windows\System\sqeVAEk.exe
  2⤵
  PID:4336
- C:\Windows\System\NUPzChb.exe
  C:\Windows\System\NUPzChb.exe
  2⤵
  PID:1984
- C:\Windows\System\GsmhVjT.exe
  C:\Windows\System\GsmhVjT.exe
  2⤵
  PID:4328
- C:\Windows\System\hrAqlcJ.exe
  C:\Windows\System\hrAqlcJ.exe
  2⤵
  PID:3788
- C:\Windows\System\kcvZEyq.exe
  C:\Windows\System\kcvZEyq.exe
  2⤵
  PID:1136
- C:\Windows\System\eNIwJOs.exe
  C:\Windows\System\eNIwJOs.exe
  2⤵
  PID:4940
- C:\Windows\System\IZYUwRm.exe
  C:\Windows\System\IZYUwRm.exe
  2⤵
  PID:2268
- C:\Windows\System\cwHIiKP.exe
  C:\Windows\System\cwHIiKP.exe
  2⤵
  PID:4460
- C:\Windows\System\MKhteXf.exe
  C:\Windows\System\MKhteXf.exe
  2⤵
  PID:2028
- C:\Windows\System\cXZmyHR.exe
  C:\Windows\System\cXZmyHR.exe
  2⤵
  PID:1128
- C:\Windows\System\DCKGxEB.exe
  C:\Windows\System\DCKGxEB.exe
  2⤵
  PID:5032
- C:\Windows\System\fYCDBIY.exe
  C:\Windows\System\fYCDBIY.exe
  2⤵
  PID:5020
- C:\Windows\System\UWNspyb.exe
  C:\Windows\System\UWNspyb.exe
  2⤵
  PID:2412
- C:\Windows\System\kNQHowU.exe
  C:\Windows\System\kNQHowU.exe
  2⤵
  PID:4284
- C:\Windows\System\ZqETmyu.exe
  C:\Windows\System\ZqETmyu.exe
  2⤵
  PID:4144
- C:\Windows\System\qNcZjhV.exe
  C:\Windows\System\qNcZjhV.exe
  2⤵
  PID:1108
- C:\Windows\System\GCcNGtJ.exe
  C:\Windows\System\GCcNGtJ.exe
  2⤵
  PID:3228
- C:\Windows\System\eGFFHxi.exe
  C:\Windows\System\eGFFHxi.exe
  2⤵
  PID:3664
- C:\Windows\System\pYqSnFU.exe
  C:\Windows\System\pYqSnFU.exe
  2⤵
  PID:3620
- C:\Windows\System\sNFgNAU.exe
  C:\Windows\System\sNFgNAU.exe
  2⤵
  PID:4252
- C:\Windows\System\pjKCKSW.exe
  C:\Windows\System\pjKCKSW.exe
  2⤵
  PID:3868
- C:\Windows\System\CkRwHyZ.exe
  C:\Windows\System\CkRwHyZ.exe
  2⤵
  PID:2960
- C:\Windows\System\HrxuyBT.exe
  C:\Windows\System\HrxuyBT.exe
  2⤵
  PID:1996
- C:\Windows\System\bYifjwN.exe
  C:\Windows\System\bYifjwN.exe
  2⤵
  PID:1700
- C:\Windows\System\hUrMAdQ.exe
  C:\Windows\System\hUrMAdQ.exe
  2⤵
  PID:1876
- C:\Windows\System\hvjtvXq.exe
  C:\Windows\System\hvjtvXq.exe
  2⤵
  PID:548
- C:\Windows\System\UdaoHUi.exe
  C:\Windows\System\UdaoHUi.exe
  2⤵
  PID:2548
- C:\Windows\System\emMqzHl.exe
  C:\Windows\System\emMqzHl.exe
  2⤵
  PID:3908
- C:\Windows\System\CpywQbv.exe
  C:\Windows\System\CpywQbv.exe
  2⤵
  PID:5008
- C:\Windows\System\tjYpDUH.exe
  C:\Windows\System\tjYpDUH.exe
  2⤵
  PID:1012
- C:\Windows\System\RCAzpAn.exe
  C:\Windows\System\RCAzpAn.exe
  2⤵
  PID:4604
- C:\Windows\System\mIokfqN.exe
  C:\Windows\System\mIokfqN.exe
  2⤵
  PID:3608
- C:\Windows\System\yCDompK.exe
  C:\Windows\System\yCDompK.exe
  2⤵
  PID:2064
- C:\Windows\System\xJXWmrT.exe
  C:\Windows\System\xJXWmrT.exe
  2⤵
  PID:4032
- C:\Windows\System\MLIlXka.exe
  C:\Windows\System\MLIlXka.exe
  2⤵
  PID:1964
- C:\Windows\System\AtEEKVp.exe
  C:\Windows\System\AtEEKVp.exe
  2⤵
  PID:4400
- C:\Windows\System\QqNNKuh.exe
  C:\Windows\System\QqNNKuh.exe
  2⤵
  PID:2316
- C:\Windows\System\scvQERj.exe
  C:\Windows\System\scvQERj.exe
  2⤵
  PID:4772
- C:\Windows\System\hEzVggI.exe
  C:\Windows\System\hEzVggI.exe
  2⤵
  PID:724
- C:\Windows\System\MWjunAB.exe
  C:\Windows\System\MWjunAB.exe
  2⤵
  PID:5148
- C:\Windows\System\KSeTBoD.exe
  C:\Windows\System\KSeTBoD.exe
  2⤵
  PID:5176
- C:\Windows\System\ANoeIbr.exe
  C:\Windows\System\ANoeIbr.exe
  2⤵
  PID:5200
- C:\Windows\System\OkSAzyC.exe
  C:\Windows\System\OkSAzyC.exe
  2⤵
  PID:5244
- C:\Windows\System\uzADMQh.exe
  C:\Windows\System\uzADMQh.exe
  2⤵
  PID:5260
- C:\Windows\System\QyfknmP.exe
  C:\Windows\System\QyfknmP.exe
  2⤵
  PID:5288
- C:\Windows\System\NkZkBpy.exe
  C:\Windows\System\NkZkBpy.exe
  2⤵
  PID:5320
- C:\Windows\System\cLkbSoE.exe
  C:\Windows\System\cLkbSoE.exe
  2⤵
  PID:5344
- C:\Windows\System\MokbyVD.exe
  C:\Windows\System\MokbyVD.exe
  2⤵
  PID:5384
- C:\Windows\System\alxOtMp.exe
  C:\Windows\System\alxOtMp.exe
  2⤵
  PID:5412
- C:\Windows\System\gjeLwQV.exe
  C:\Windows\System\gjeLwQV.exe
  2⤵
  PID:5428
- C:\Windows\System\BIsQmiY.exe
  C:\Windows\System\BIsQmiY.exe
  2⤵
  PID:5456
- C:\Windows\System\eGPgAiM.exe
  C:\Windows\System\eGPgAiM.exe
  2⤵
  PID:5476
- C:\Windows\System\WgZPjYc.exe
  C:\Windows\System\WgZPjYc.exe
  2⤵
  PID:5508
- C:\Windows\System\YVAqRgL.exe
  C:\Windows\System\YVAqRgL.exe
  2⤵
  PID:5540
- C:\Windows\System\aumjYEk.exe
  C:\Windows\System\aumjYEk.exe
  2⤵
  PID:5568
- C:\Windows\System\gwLbvya.exe
  C:\Windows\System\gwLbvya.exe
  2⤵
  PID:5588
- C:\Windows\System\Hpbdysw.exe
  C:\Windows\System\Hpbdysw.exe
  2⤵
  PID:5620
- C:\Windows\System\cQfPSND.exe
  C:\Windows\System\cQfPSND.exe
  2⤵
  PID:5640
- C:\Windows\System\OwrUjEZ.exe
  C:\Windows\System\OwrUjEZ.exe
  2⤵
  PID:5668
- C:\Windows\System\MyAqUHe.exe
  C:\Windows\System\MyAqUHe.exe
  2⤵
  PID:5684
- C:\Windows\System\cvOSawm.exe
  C:\Windows\System\cvOSawm.exe
  2⤵
  PID:5700
- C:\Windows\System\hpACCdz.exe
  C:\Windows\System\hpACCdz.exe
  2⤵
  PID:5732
- C:\Windows\System\aRpAuWT.exe
  C:\Windows\System\aRpAuWT.exe
  2⤵
  PID:5780
- C:\Windows\System\QuIRIGE.exe
  C:\Windows\System\QuIRIGE.exe
  2⤵
  PID:5816
- C:\Windows\System\AKqwPbw.exe
  C:\Windows\System\AKqwPbw.exe
  2⤵
  PID:5836
- C:\Windows\System\uNfVebn.exe
  C:\Windows\System\uNfVebn.exe
  2⤵
  PID:5852
- C:\Windows\System\BDwoOwF.exe
  C:\Windows\System\BDwoOwF.exe
  2⤵
  PID:5880
- C:\Windows\System\unsHARJ.exe
  C:\Windows\System\unsHARJ.exe
  2⤵
  PID:5908
- C:\Windows\System\JFGPwPe.exe
  C:\Windows\System\JFGPwPe.exe
  2⤵
  PID:5936
- C:\Windows\System\EdGyUed.exe
  C:\Windows\System\EdGyUed.exe
  2⤵
  PID:5956
- C:\Windows\System\mSkwjBk.exe
  C:\Windows\System\mSkwjBk.exe
  2⤵
  PID:5988
- C:\Windows\System\TVDlcvJ.exe
  C:\Windows\System\TVDlcvJ.exe
  2⤵
  PID:6024
- C:\Windows\System\FZyoPQh.exe
  C:\Windows\System\FZyoPQh.exe
  2⤵
  PID:6048
- C:\Windows\System\VtRFVia.exe
  C:\Windows\System\VtRFVia.exe
  2⤵
  PID:6076
- C:\Windows\System\OfXUgZP.exe
  C:\Windows\System\OfXUgZP.exe
  2⤵
  PID:6108
- C:\Windows\System\RLwkkuL.exe
  C:\Windows\System\RLwkkuL.exe
  2⤵
  PID:6140
- C:\Windows\System\bwRCvwi.exe
  C:\Windows\System\bwRCvwi.exe
  2⤵
  PID:5160
- C:\Windows\System\bQFTHHq.exe
  C:\Windows\System\bQFTHHq.exe
  2⤵
  PID:5188
- C:\Windows\System\JncwvJB.exe
  C:\Windows\System\JncwvJB.exe
  2⤵
  PID:5272
- C:\Windows\System\uGlYGch.exe
  C:\Windows\System\uGlYGch.exe
  2⤵
  PID:5336
- C:\Windows\System\LvKTgyT.exe
  C:\Windows\System\LvKTgyT.exe
  2⤵
  PID:5356
- C:\Windows\System\NtczjNU.exe
  C:\Windows\System\NtczjNU.exe
  2⤵
  PID:5444
- C:\Windows\System\bBJTtjd.exe
  C:\Windows\System\bBJTtjd.exe
  2⤵
  PID:5532
- C:\Windows\System\BhDLfOl.exe
  C:\Windows\System\BhDLfOl.exe
  2⤵
  PID:5596
- C:\Windows\System\RIZCbxq.exe
  C:\Windows\System\RIZCbxq.exe
  2⤵
  PID:5576
- C:\Windows\System\ecqbWmp.exe
  C:\Windows\System\ecqbWmp.exe
  2⤵
  PID:5664
- C:\Windows\System\TkbfGJk.exe
  C:\Windows\System\TkbfGJk.exe
  2⤵
  PID:5744
- C:\Windows\System\lUEXeYk.exe
  C:\Windows\System\lUEXeYk.exe
  2⤵
  PID:5796
- C:\Windows\System\QCALZIN.exe
  C:\Windows\System\QCALZIN.exe
  2⤵
  PID:5904
- C:\Windows\System\BRhujEc.exe
  C:\Windows\System\BRhujEc.exe
  2⤵
  PID:5976
- C:\Windows\System\UuisCxK.exe
  C:\Windows\System\UuisCxK.exe
  2⤵
  PID:6100
- C:\Windows\System\cBNamje.exe
  C:\Windows\System\cBNamje.exe
  2⤵
  PID:5140
- C:\Windows\System\lZkFrES.exe
  C:\Windows\System\lZkFrES.exe
  2⤵
  PID:6136
- C:\Windows\System\waXmQZG.exe
  C:\Windows\System\waXmQZG.exe
  2⤵
  PID:5484
- C:\Windows\System\TeEYbiU.exe
  C:\Windows\System\TeEYbiU.exe
  2⤵
  PID:5560
- C:\Windows\System\rVIgFom.exe
  C:\Windows\System\rVIgFom.exe
  2⤵
  PID:5656
- C:\Windows\System\GHrehKa.exe
  C:\Windows\System\GHrehKa.exe
  2⤵
  PID:5896
- C:\Windows\System\SUPpveh.exe
  C:\Windows\System\SUPpveh.exe
  2⤵
  PID:5888
- C:\Windows\System\aKSqfOw.exe
  C:\Windows\System\aKSqfOw.exe
  2⤵
  PID:5252
- C:\Windows\System\SJugDqJ.exe
  C:\Windows\System\SJugDqJ.exe
  2⤵
  PID:5424
- C:\Windows\System\YnuJCly.exe
  C:\Windows\System\YnuJCly.exe
  2⤵
  PID:5948
- C:\Windows\System\nmBKhEz.exe
  C:\Windows\System\nmBKhEz.exe
  2⤵
  PID:5340
- C:\Windows\System\OezdkLn.exe
  C:\Windows\System\OezdkLn.exe
  2⤵
  PID:5980
- C:\Windows\System\oypTyox.exe
  C:\Windows\System\oypTyox.exe
  2⤵
  PID:6176
- C:\Windows\System\MZpEpNQ.exe
  C:\Windows\System\MZpEpNQ.exe
  2⤵
  PID:6196
- C:\Windows\System\yexTFEj.exe
  C:\Windows\System\yexTFEj.exe
  2⤵
  PID:6220
- C:\Windows\System\ljQXjuq.exe
  C:\Windows\System\ljQXjuq.exe
  2⤵
  PID:6256
- C:\Windows\System\TfyvboK.exe
  C:\Windows\System\TfyvboK.exe
  2⤵
  PID:6292
- C:\Windows\System\EPgPero.exe
  C:\Windows\System\EPgPero.exe
  2⤵
  PID:6312
- C:\Windows\System\WFMQIBA.exe
  C:\Windows\System\WFMQIBA.exe
  2⤵
  PID:6336
- C:\Windows\System\OLuOyLe.exe
  C:\Windows\System\OLuOyLe.exe
  2⤵
  PID:6368
- C:\Windows\System\PeUhMFr.exe
  C:\Windows\System\PeUhMFr.exe
  2⤵
  PID:6404
- C:\Windows\System\SoXsHfz.exe
  C:\Windows\System\SoXsHfz.exe
  2⤵
  PID:6420
- C:\Windows\System\iAJUMqU.exe
  C:\Windows\System\iAJUMqU.exe
  2⤵
  PID:6448
- C:\Windows\System\CpGLjBN.exe
  C:\Windows\System\CpGLjBN.exe
  2⤵
  PID:6488
- C:\Windows\System\ECThkps.exe
  C:\Windows\System\ECThkps.exe
  2⤵
  PID:6508
- C:\Windows\System\wGPJoQQ.exe
  C:\Windows\System\wGPJoQQ.exe
  2⤵
  PID:6536
- C:\Windows\System\oPiWCEQ.exe
  C:\Windows\System\oPiWCEQ.exe
  2⤵
  PID:6564
- C:\Windows\System\eckIBjr.exe
  C:\Windows\System\eckIBjr.exe
  2⤵
  PID:6584
- C:\Windows\System\XmvwAxa.exe
  C:\Windows\System\XmvwAxa.exe
  2⤵
  PID:6608
- C:\Windows\System\fCWmCMY.exe
  C:\Windows\System\fCWmCMY.exe
  2⤵
  PID:6636
- C:\Windows\System\eWfeZjU.exe
  C:\Windows\System\eWfeZjU.exe
  2⤵
  PID:6668
- C:\Windows\System\zjAhnpI.exe
  C:\Windows\System\zjAhnpI.exe
  2⤵
  PID:6704
- C:\Windows\System\uvVxjKl.exe
  C:\Windows\System\uvVxjKl.exe
  2⤵
  PID:6720
- C:\Windows\System\bugIDHT.exe
  C:\Windows\System\bugIDHT.exe
  2⤵
  PID:6752
- C:\Windows\System\OxnCngC.exe
  C:\Windows\System\OxnCngC.exe
  2⤵
  PID:6788
- C:\Windows\System\lIjuuMH.exe
  C:\Windows\System\lIjuuMH.exe
  2⤵
  PID:6820
- C:\Windows\System\vLfENGm.exe
  C:\Windows\System\vLfENGm.exe
  2⤵
  PID:6856
- C:\Windows\System\wtxnmyK.exe
  C:\Windows\System\wtxnmyK.exe
  2⤵
  PID:6872
- C:\Windows\System\vtnEsNN.exe
  C:\Windows\System\vtnEsNN.exe
  2⤵
  PID:6900
- C:\Windows\System\uXloxPP.exe
  C:\Windows\System\uXloxPP.exe
  2⤵
  PID:6916
- C:\Windows\System\SittIHU.exe
  C:\Windows\System\SittIHU.exe
  2⤵
  PID:6944
- C:\Windows\System\EOTVvLj.exe
  C:\Windows\System\EOTVvLj.exe
  2⤵
  PID:6972
- C:\Windows\System\khGFfIn.exe
  C:\Windows\System\khGFfIn.exe
  2⤵
  PID:7004
- C:\Windows\System\yihcPvo.exe
  C:\Windows\System\yihcPvo.exe
  2⤵
  PID:7040
- C:\Windows\System\HzyURWQ.exe
  C:\Windows\System\HzyURWQ.exe
  2⤵
  PID:7068
- C:\Windows\System\AXrTyVx.exe
  C:\Windows\System\AXrTyVx.exe
  2⤵
  PID:7096
- C:\Windows\System\YdVYMfC.exe
  C:\Windows\System\YdVYMfC.exe
  2⤵
  PID:7116
- C:\Windows\System\yIGZvUp.exe
  C:\Windows\System\yIGZvUp.exe
  2⤵
  PID:7144
- C:\Windows\System\RvygQgR.exe
  C:\Windows\System\RvygQgR.exe
  2⤵
  PID:5808
- C:\Windows\System\EbXWPQd.exe
  C:\Windows\System\EbXWPQd.exe
  2⤵
  PID:6216
- C:\Windows\System\uhPVhAU.exe
  C:\Windows\System\uhPVhAU.exe
  2⤵
  PID:6248
- C:\Windows\System\JrhtlJy.exe
  C:\Windows\System\JrhtlJy.exe
  2⤵
  PID:6324
- C:\Windows\System\QTkJUlK.exe
  C:\Windows\System\QTkJUlK.exe
  2⤵
  PID:6376
- C:\Windows\System\UAtdzMO.exe
  C:\Windows\System\UAtdzMO.exe
  2⤵
  PID:6456
- C:\Windows\System\qDDAgxk.exe
  C:\Windows\System\qDDAgxk.exe
  2⤵
  PID:6528
- C:\Windows\System\aNOtlgz.exe
  C:\Windows\System\aNOtlgz.exe
  2⤵
  PID:6580
- C:\Windows\System\dVeXZCA.exe
  C:\Windows\System\dVeXZCA.exe
  2⤵
  PID:6660
- C:\Windows\System\fmTjLqy.exe
  C:\Windows\System\fmTjLqy.exe
  2⤵
  PID:6744
- C:\Windows\System\PlJoJZR.exe
  C:\Windows\System\PlJoJZR.exe
  2⤵
  PID:6800
- C:\Windows\System\anQgHHI.exe
  C:\Windows\System\anQgHHI.exe
  2⤵
  PID:6864
- C:\Windows\System\JgQhpaG.exe
  C:\Windows\System\JgQhpaG.exe
  2⤵
  PID:6928
- C:\Windows\System\ZvNqRkL.exe
  C:\Windows\System\ZvNqRkL.exe
  2⤵
  PID:7028
- C:\Windows\System\NqaHZeo.exe
  C:\Windows\System\NqaHZeo.exe
  2⤵
  PID:7016
- C:\Windows\System\yoFiMoW.exe
  C:\Windows\System\yoFiMoW.exe
  2⤵
  PID:7104
- C:\Windows\System\hkSdlbe.exe
  C:\Windows\System\hkSdlbe.exe
  2⤵
  PID:7164
- C:\Windows\System\ZnLYFGd.exe
  C:\Windows\System\ZnLYFGd.exe
  2⤵
  PID:6436
- C:\Windows\System\zSUJpKx.exe
  C:\Windows\System\zSUJpKx.exe
  2⤵
  PID:5036
- C:\Windows\System\cklANlk.exe
  C:\Windows\System\cklANlk.exe
  2⤵
  PID:6548
- C:\Windows\System\FCRhptj.exe
  C:\Windows\System\FCRhptj.exe
  2⤵
  PID:6816
- C:\Windows\System\uTSxlrF.exe
  C:\Windows\System\uTSxlrF.exe
  2⤵
  PID:6932
- C:\Windows\System\uFffhnE.exe
  C:\Windows\System\uFffhnE.exe
  2⤵
  PID:7108
- C:\Windows\System\hyJhyqn.exe
  C:\Windows\System\hyJhyqn.exe
  2⤵
  PID:7160
- C:\Windows\System\MvUXqgz.exe
  C:\Windows\System\MvUXqgz.exe
  2⤵
  PID:6772
- C:\Windows\System\iESfRSj.exe
  C:\Windows\System\iESfRSj.exe
  2⤵
  PID:6996
- C:\Windows\System\nVmOKuC.exe
  C:\Windows\System\nVmOKuC.exe
  2⤵
  PID:6680
- C:\Windows\System\WLsEQHw.exe
  C:\Windows\System\WLsEQHw.exe
  2⤵
  PID:7184
- C:\Windows\System\JeYXlOe.exe
  C:\Windows\System\JeYXlOe.exe
  2⤵
  PID:7212
- C:\Windows\System\evYxuug.exe
  C:\Windows\System\evYxuug.exe
  2⤵
  PID:7252
- C:\Windows\System\zOboLsq.exe
  C:\Windows\System\zOboLsq.exe
  2⤵
  PID:7268
- C:\Windows\System\SbwRDYe.exe
  C:\Windows\System\SbwRDYe.exe
  2⤵
  PID:7300
- C:\Windows\System\XBgTAVN.exe
  C:\Windows\System\XBgTAVN.exe
  2⤵
  PID:7320
- C:\Windows\System\WBzrobJ.exe
  C:\Windows\System\WBzrobJ.exe
  2⤵
  PID:7352
- C:\Windows\System\QCyBhji.exe
  C:\Windows\System\QCyBhji.exe
  2⤵
  PID:7380
- C:\Windows\System\KKEQSvC.exe
  C:\Windows\System\KKEQSvC.exe
  2⤵
  PID:7412
- C:\Windows\System\fMmxVMI.exe
  C:\Windows\System\fMmxVMI.exe
  2⤵
  PID:7436
- C:\Windows\System\yCCWGXo.exe
  C:\Windows\System\yCCWGXo.exe
  2⤵
  PID:7464
- C:\Windows\System\brkFitx.exe
  C:\Windows\System\brkFitx.exe
  2⤵
  PID:7480
- C:\Windows\System\feOILzS.exe
  C:\Windows\System\feOILzS.exe
  2⤵
  PID:7500
- C:\Windows\System\uRLHhkW.exe
  C:\Windows\System\uRLHhkW.exe
  2⤵
  PID:7548
- C:\Windows\System\YkYtEyo.exe
  C:\Windows\System\YkYtEyo.exe
  2⤵
  PID:7564
- C:\Windows\System\VdTnKOG.exe
  C:\Windows\System\VdTnKOG.exe
  2⤵
  PID:7592
- C:\Windows\System\VxFQneT.exe
  C:\Windows\System\VxFQneT.exe
  2⤵
  PID:7620
- C:\Windows\System\fVgzFOn.exe
  C:\Windows\System\fVgzFOn.exe
  2⤵
  PID:7648
- C:\Windows\System\CXxOoly.exe
  C:\Windows\System\CXxOoly.exe
  2⤵
  PID:7668
- C:\Windows\System\uijtBtP.exe
  C:\Windows\System\uijtBtP.exe
  2⤵
  PID:7696
- C:\Windows\System\dbgbvYa.exe
  C:\Windows\System\dbgbvYa.exe
  2⤵
  PID:7720
- C:\Windows\System\iXnUDoB.exe
  C:\Windows\System\iXnUDoB.exe
  2⤵
  PID:7736
- C:\Windows\System\kGJwXZB.exe
  C:\Windows\System\kGJwXZB.exe
  2⤵
  PID:7768
- C:\Windows\System\IhTrkuR.exe
  C:\Windows\System\IhTrkuR.exe
  2⤵
  PID:7792
- C:\Windows\System\cmhBLPa.exe
  C:\Windows\System\cmhBLPa.exe
  2⤵
  PID:7820
- C:\Windows\System\cIgwJBn.exe
  C:\Windows\System\cIgwJBn.exe
  2⤵
  PID:7856
- C:\Windows\System\XWFpvqF.exe
  C:\Windows\System\XWFpvqF.exe
  2⤵
  PID:7892
- C:\Windows\System\DwXGWIe.exe
  C:\Windows\System\DwXGWIe.exe
  2⤵
  PID:7932
- C:\Windows\System\wDPpYle.exe
  C:\Windows\System\wDPpYle.exe
  2⤵
  PID:7960
- C:\Windows\System\lDtupeJ.exe
  C:\Windows\System\lDtupeJ.exe
  2⤵
  PID:7992
- C:\Windows\System\YjiOCFM.exe
  C:\Windows\System\YjiOCFM.exe
  2⤵
  PID:8008
- C:\Windows\System\ECzCZpR.exe
  C:\Windows\System\ECzCZpR.exe
  2⤵
  PID:8040
- C:\Windows\System\KYJXIgK.exe
  C:\Windows\System\KYJXIgK.exe
  2⤵
  PID:8060
- C:\Windows\System\JGDQpIj.exe
  C:\Windows\System\JGDQpIj.exe
  2⤵
  PID:8088
- C:\Windows\System\TIgxqSI.exe
  C:\Windows\System\TIgxqSI.exe
  2⤵
  PID:8104
- C:\Windows\System\SoVXpkH.exe
  C:\Windows\System\SoVXpkH.exe
  2⤵
  PID:8124
- C:\Windows\System\jfbbIaX.exe
  C:\Windows\System\jfbbIaX.exe
  2⤵
  PID:8148
- C:\Windows\System\BHcMGLF.exe
  C:\Windows\System\BHcMGLF.exe
  2⤵
  PID:8180
- C:\Windows\System\ijzvbjA.exe
  C:\Windows\System\ijzvbjA.exe
  2⤵
  PID:7172
- C:\Windows\System\qKINyru.exe
  C:\Windows\System\qKINyru.exe
  2⤵
  PID:7232
- C:\Windows\System\jRBNMlp.exe
  C:\Windows\System\jRBNMlp.exe
  2⤵
  PID:7344
- C:\Windows\System\GamAdNy.exe
  C:\Windows\System\GamAdNy.exe
  2⤵
  PID:7368
- C:\Windows\System\DHsqaag.exe
  C:\Windows\System\DHsqaag.exe
  2⤵
  PID:7428
- C:\Windows\System\HDmdmqS.exe
  C:\Windows\System\HDmdmqS.exe
  2⤵
  PID:7496
- C:\Windows\System\yHthIbg.exe
  C:\Windows\System\yHthIbg.exe
  2⤵
  PID:7632
- C:\Windows\System\fvEythi.exe
  C:\Windows\System\fvEythi.exe
  2⤵
  PID:7628
- C:\Windows\System\ptKOyWS.exe
  C:\Windows\System\ptKOyWS.exe
  2⤵
  PID:7764
- C:\Windows\System\UyOOrDk.exe
  C:\Windows\System\UyOOrDk.exe
  2⤵
  PID:7708
- C:\Windows\System\FtKsCdd.exe
  C:\Windows\System\FtKsCdd.exe
  2⤵
  PID:7884
- C:\Windows\System\OByFzSJ.exe
  C:\Windows\System\OByFzSJ.exe
  2⤵
  PID:7984
- C:\Windows\System\OeGsRJw.exe
  C:\Windows\System\OeGsRJw.exe
  2⤵
  PID:8028
- C:\Windows\System\LyMzPYi.exe
  C:\Windows\System\LyMzPYi.exe
  2⤵
  PID:8052
- C:\Windows\System\oadddny.exe
  C:\Windows\System\oadddny.exe
  2⤵
  PID:8096
- C:\Windows\System\mpvTKYD.exe
  C:\Windows\System\mpvTKYD.exe
  2⤵
  PID:8144
- C:\Windows\System\nttZLEV.exe
  C:\Windows\System\nttZLEV.exe
  2⤵
  PID:7376
- C:\Windows\System\IOTloNY.exe
  C:\Windows\System\IOTloNY.exe
  2⤵
  PID:7532
- C:\Windows\System\FhxEQgK.exe
  C:\Windows\System\FhxEQgK.exe
  2⤵
  PID:7756
- C:\Windows\System\kPJIFpZ.exe
  C:\Windows\System\kPJIFpZ.exe
  2⤵
  PID:7852
- C:\Windows\System\suuzCJa.exe
  C:\Windows\System\suuzCJa.exe
  2⤵
  PID:7928
- C:\Windows\System\GJMEUES.exe
  C:\Windows\System\GJMEUES.exe
  2⤵
  PID:8156
- C:\Windows\System\ZrTpAlN.exe
  C:\Windows\System\ZrTpAlN.exe
  2⤵
  PID:7424
- C:\Windows\System\QMzyejj.exe
  C:\Windows\System\QMzyejj.exe
  2⤵
  PID:7392
- C:\Windows\System\Qelmjdg.exe
  C:\Windows\System\Qelmjdg.exe
  2⤵
  PID:7684
- C:\Windows\System\UoFIpOO.exe
  C:\Windows\System\UoFIpOO.exe
  2⤵
  PID:8032
- C:\Windows\System\qnNgKTE.exe
  C:\Windows\System\qnNgKTE.exe
  2⤵
  PID:8080
- C:\Windows\System\nvacrzD.exe
  C:\Windows\System\nvacrzD.exe
  2⤵
  PID:8200
- C:\Windows\System\enDtRAd.exe
  C:\Windows\System\enDtRAd.exe
  2⤵
  PID:8248
- C:\Windows\System\jQVkuiK.exe
  C:\Windows\System\jQVkuiK.exe
  2⤵
  PID:8280
- C:\Windows\System\bLSgOZn.exe
  C:\Windows\System\bLSgOZn.exe
  2⤵
  PID:8304
- C:\Windows\System\LSWTqyG.exe
  C:\Windows\System\LSWTqyG.exe
  2⤵
  PID:8336
- C:\Windows\System\MrQCqxu.exe
  C:\Windows\System\MrQCqxu.exe
  2⤵
  PID:8368
- C:\Windows\System\zPizaoE.exe
  C:\Windows\System\zPizaoE.exe
  2⤵
  PID:8384
- C:\Windows\System\CMjuQrQ.exe
  C:\Windows\System\CMjuQrQ.exe
  2⤵
  PID:8416
- C:\Windows\System\JGfueBI.exe
  C:\Windows\System\JGfueBI.exe
  2⤵
  PID:8440
- C:\Windows\System\mKhjDjK.exe
  C:\Windows\System\mKhjDjK.exe
  2⤵
  PID:8468
- C:\Windows\System\TMjigow.exe
  C:\Windows\System\TMjigow.exe
  2⤵
  PID:8488
- C:\Windows\System\mMArKQY.exe
  C:\Windows\System\mMArKQY.exe
  2⤵
  PID:8528
- C:\Windows\System\mqsvHgH.exe
  C:\Windows\System\mqsvHgH.exe
  2⤵
  PID:8548
- C:\Windows\System\ZPHyeIo.exe
  C:\Windows\System\ZPHyeIo.exe
  2⤵
  PID:8580
- C:\Windows\System\YVRCajQ.exe
  C:\Windows\System\YVRCajQ.exe
  2⤵
  PID:8624
- C:\Windows\System\DAnQOOS.exe
  C:\Windows\System\DAnQOOS.exe
  2⤵
  PID:8660
- C:\Windows\System\gwnXgiI.exe
  C:\Windows\System\gwnXgiI.exe
  2⤵
  PID:8676
- C:\Windows\System\cpUjvyW.exe
  C:\Windows\System\cpUjvyW.exe
  2⤵
  PID:8700
- C:\Windows\System\ONHbnDE.exe
  C:\Windows\System\ONHbnDE.exe
  2⤵
  PID:8732
- C:\Windows\System\sUhAWug.exe
  C:\Windows\System\sUhAWug.exe
  2⤵
  PID:8752
- C:\Windows\System\ztguEYD.exe
  C:\Windows\System\ztguEYD.exe
  2⤵
  PID:8784
- C:\Windows\System\emniWyy.exe
  C:\Windows\System\emniWyy.exe
  2⤵
  PID:8804
- C:\Windows\System\fxlunTk.exe
  C:\Windows\System\fxlunTk.exe
  2⤵
  PID:8832
- C:\Windows\System\SWgHtvT.exe
  C:\Windows\System\SWgHtvT.exe
  2⤵
  PID:8860
- C:\Windows\System\VKrBYih.exe
  C:\Windows\System\VKrBYih.exe
  2⤵
  PID:8892
- C:\Windows\System\puRvsqo.exe
  C:\Windows\System\puRvsqo.exe
  2⤵
  PID:8920
- C:\Windows\System\qpMrSDM.exe
  C:\Windows\System\qpMrSDM.exe
  2⤵
  PID:8940
- C:\Windows\System\msAxNlw.exe
  C:\Windows\System\msAxNlw.exe
  2⤵
  PID:8968
- C:\Windows\System\HnGvQlw.exe
  C:\Windows\System\HnGvQlw.exe
  2⤵
  PID:8996
- C:\Windows\System\ulrovyh.exe
  C:\Windows\System\ulrovyh.exe
  2⤵
  PID:9020
- C:\Windows\System\GvTAKhX.exe
  C:\Windows\System\GvTAKhX.exe
  2⤵
  PID:9052
- C:\Windows\System\pNiierC.exe
  C:\Windows\System\pNiierC.exe
  2⤵
  PID:9076
- C:\Windows\System\rNKalwK.exe
  C:\Windows\System\rNKalwK.exe
  2⤵
  PID:9112
- C:\Windows\System\VMtwPZs.exe
  C:\Windows\System\VMtwPZs.exe
  2⤵
  PID:9144
- C:\Windows\System\cthFumz.exe
  C:\Windows\System\cthFumz.exe
  2⤵
  PID:9164
- C:\Windows\System\Ztavoyx.exe
  C:\Windows\System\Ztavoyx.exe
  2⤵
  PID:9196
- C:\Windows\System\shTbUCb.exe
  C:\Windows\System\shTbUCb.exe
  2⤵
  PID:7832
- C:\Windows\System\RQxyVoz.exe
  C:\Windows\System\RQxyVoz.exe
  2⤵
  PID:8272
- C:\Windows\System\gMfnOJA.exe
  C:\Windows\System\gMfnOJA.exe
  2⤵
  PID:8328
- C:\Windows\System\AiOBpKr.exe
  C:\Windows\System\AiOBpKr.exe
  2⤵
  PID:8404
- C:\Windows\System\mxFIVsj.exe
  C:\Windows\System\mxFIVsj.exe
  2⤵
  PID:8424
- C:\Windows\System\mASvHED.exe
  C:\Windows\System\mASvHED.exe
  2⤵
  PID:8500
- C:\Windows\System\HaGRpLG.exe
  C:\Windows\System\HaGRpLG.exe
  2⤵
  PID:8604
- C:\Windows\System\bBzbnZW.exe
  C:\Windows\System\bBzbnZW.exe
  2⤵
  PID:8692
- C:\Windows\System\VnHoNKt.exe
  C:\Windows\System\VnHoNKt.exe
  2⤵
  PID:8760
- C:\Windows\System\ggImwIq.exe
  C:\Windows\System\ggImwIq.exe
  2⤵
  PID:8824
- C:\Windows\System\HrKCnDM.exe
  C:\Windows\System\HrKCnDM.exe
  2⤵
  PID:8884
- C:\Windows\System\WaAwCvh.exe
  C:\Windows\System\WaAwCvh.exe
  2⤵
  PID:8916
- C:\Windows\System\LmPisxM.exe
  C:\Windows\System\LmPisxM.exe
  2⤵
  PID:8952
- C:\Windows\System\OAPGCPI.exe
  C:\Windows\System\OAPGCPI.exe
  2⤵
  PID:9100
- C:\Windows\System\UgCYrry.exe
  C:\Windows\System\UgCYrry.exe
  2⤵
  PID:9092
- C:\Windows\System\kJoaFkL.exe
  C:\Windows\System\kJoaFkL.exe
  2⤵
  PID:9188
- C:\Windows\System\VZRGjqW.exe
  C:\Windows\System\VZRGjqW.exe
  2⤵
  PID:8300
- C:\Windows\System\tTZDHUg.exe
  C:\Windows\System\tTZDHUg.exe
  2⤵
  PID:8396
- C:\Windows\System\qzJbTLv.exe
  C:\Windows\System\qzJbTLv.exe
  2⤵
  PID:8556
- C:\Windows\System\kduoNcl.exe
  C:\Windows\System\kduoNcl.exe
  2⤵
  PID:8656
- C:\Windows\System\olvETbH.exe
  C:\Windows\System\olvETbH.exe
  2⤵
  PID:8800
- C:\Windows\System\lzGxVwt.exe
  C:\Windows\System\lzGxVwt.exe
  2⤵
  PID:9044
- C:\Windows\System\wcAWcpR.exe
  C:\Windows\System\wcAWcpR.exe
  2⤵
  PID:9204
- C:\Windows\System\vwjPlTk.exe
  C:\Windows\System\vwjPlTk.exe
  2⤵
  PID:6844
- C:\Windows\System\szKkzDt.exe
  C:\Windows\System\szKkzDt.exe
  2⤵
  PID:8744
- C:\Windows\System\MUFjsDt.exe
  C:\Windows\System\MUFjsDt.exe
  2⤵
  PID:9064
- C:\Windows\System\iUmrbVu.exe
  C:\Windows\System\iUmrbVu.exe
  2⤵
  PID:8344
- C:\Windows\System\IBuSNwF.exe
  C:\Windows\System\IBuSNwF.exe
  2⤵
  PID:9236
- C:\Windows\System\msWmArv.exe
  C:\Windows\System\msWmArv.exe
  2⤵
  PID:9264
- C:\Windows\System\KeSVJDF.exe
  C:\Windows\System\KeSVJDF.exe
  2⤵
  PID:9288
- C:\Windows\System\uBrAOEt.exe
  C:\Windows\System\uBrAOEt.exe
  2⤵
  PID:9304
- C:\Windows\System\aEjMwJX.exe
  C:\Windows\System\aEjMwJX.exe
  2⤵
  PID:9328
- C:\Windows\System\JJlqcgR.exe
  C:\Windows\System\JJlqcgR.exe
  2⤵
  PID:9360
- C:\Windows\System\oavdeRj.exe
  C:\Windows\System\oavdeRj.exe
  2⤵
  PID:9392
- C:\Windows\System\HVcLRDy.exe
  C:\Windows\System\HVcLRDy.exe
  2⤵
  PID:9420
- C:\Windows\System\dYaMTcF.exe
  C:\Windows\System\dYaMTcF.exe
  2⤵
  PID:9448
- C:\Windows\System\HyBJJBF.exe
  C:\Windows\System\HyBJJBF.exe
  2⤵
  PID:9476
- C:\Windows\System\UpIvQMT.exe
  C:\Windows\System\UpIvQMT.exe
  2⤵
  PID:9496
- C:\Windows\System\uJaeIMZ.exe
  C:\Windows\System\uJaeIMZ.exe
  2⤵
  PID:9524
- C:\Windows\System\NiZsILu.exe
  C:\Windows\System\NiZsILu.exe
  2⤵
  PID:9560
- C:\Windows\System\KKNIzBV.exe
  C:\Windows\System\KKNIzBV.exe
  2⤵
  PID:9592
- C:\Windows\System\nfDGgvA.exe
  C:\Windows\System\nfDGgvA.exe
  2⤵
  PID:9612
- C:\Windows\System\ntijcui.exe
  C:\Windows\System\ntijcui.exe
  2⤵
  PID:9644
- C:\Windows\System\MSNQGrH.exe
  C:\Windows\System\MSNQGrH.exe
  2⤵
  PID:9676
- C:\Windows\System\fXVtbEl.exe
  C:\Windows\System\fXVtbEl.exe
  2⤵
  PID:9692
- C:\Windows\System\GHrHPso.exe
  C:\Windows\System\GHrHPso.exe
  2⤵
  PID:9728
- C:\Windows\System\JWHJFCj.exe
  C:\Windows\System\JWHJFCj.exe
  2⤵
  PID:9756
- C:\Windows\System\ktRiXWi.exe
  C:\Windows\System\ktRiXWi.exe
  2⤵
  PID:9780
- C:\Windows\System\aSJtKAU.exe
  C:\Windows\System\aSJtKAU.exe
  2⤵
  PID:9800
- C:\Windows\System\kToBMJn.exe
  C:\Windows\System\kToBMJn.exe
  2⤵
  PID:9824
- C:\Windows\System\EbKTmGf.exe
  C:\Windows\System\EbKTmGf.exe
  2⤵
  PID:9856
- C:\Windows\System\nRzQQvK.exe
  C:\Windows\System\nRzQQvK.exe
  2⤵
  PID:9876
- C:\Windows\System\YVoFKJv.exe
  C:\Windows\System\YVoFKJv.exe
  2⤵
  PID:9904
- C:\Windows\System\uNpVvDU.exe
  C:\Windows\System\uNpVvDU.exe
  2⤵
  PID:9928
- C:\Windows\System\cuMMzHt.exe
  C:\Windows\System\cuMMzHt.exe
  2⤵
  PID:9944
- C:\Windows\System\WqvpSsr.exe
  C:\Windows\System\WqvpSsr.exe
  2⤵
  PID:9980
- C:\Windows\System\IuOnPxl.exe
  C:\Windows\System\IuOnPxl.exe
  2⤵
  PID:10008
- C:\Windows\System\Qkazotq.exe
  C:\Windows\System\Qkazotq.exe
  2⤵
  PID:10036
- C:\Windows\System\FpWFKHp.exe
  C:\Windows\System\FpWFKHp.exe
  2⤵
  PID:10064
- C:\Windows\System\ftHZqGU.exe
  C:\Windows\System\ftHZqGU.exe
  2⤵
  PID:10092
- C:\Windows\System\zZXtjgN.exe
  C:\Windows\System\zZXtjgN.exe
  2⤵
  PID:10120
- C:\Windows\System\feexVDP.exe
  C:\Windows\System\feexVDP.exe
  2⤵
  PID:10156
- C:\Windows\System\dylDZAA.exe
  C:\Windows\System\dylDZAA.exe
  2⤵
  PID:10184
- C:\Windows\System\hpLsANw.exe
  C:\Windows\System\hpLsANw.exe
  2⤵
  PID:10216
- C:\Windows\System\CmRqDuX.exe
  C:\Windows\System\CmRqDuX.exe
  2⤵
  PID:8320
- C:\Windows\System\JdajrIu.exe
  C:\Windows\System\JdajrIu.exe
  2⤵
  PID:9232
- C:\Windows\System\nnYmJKz.exe
  C:\Windows\System\nnYmJKz.exe
  2⤵
  PID:9312
- C:\Windows\System\xmmIGzy.exe
  C:\Windows\System\xmmIGzy.exe
  2⤵
  PID:9276
- C:\Windows\System\vZDystE.exe
  C:\Windows\System\vZDystE.exe
  2⤵
  PID:9436
- C:\Windows\System\gAprqrV.exe
  C:\Windows\System\gAprqrV.exe
  2⤵
  PID:9484
- C:\Windows\System\OIdFBFE.exe
  C:\Windows\System\OIdFBFE.exe
  2⤵
  PID:9572
- C:\Windows\System\FoaSQeT.exe
  C:\Windows\System\FoaSQeT.exe
  2⤵
  PID:9668
- C:\Windows\System\qzuSXjD.exe
  C:\Windows\System\qzuSXjD.exe
  2⤵
  PID:9688
- C:\Windows\System\pIEcuZW.exe
  C:\Windows\System\pIEcuZW.exe
  2⤵
  PID:9772
- C:\Windows\System\bpkULuI.exe
  C:\Windows\System\bpkULuI.exe
  2⤵
  PID:9848
- C:\Windows\System\vpycqin.exe
  C:\Windows\System\vpycqin.exe
  2⤵
  PID:9864
- C:\Windows\System\GcVBFbv.exe
  C:\Windows\System\GcVBFbv.exe
  2⤵
  PID:10004
- C:\Windows\System\BhogNJZ.exe
  C:\Windows\System\BhogNJZ.exe
  2⤵
  PID:10016
- C:\Windows\System\FMpfIeY.exe
  C:\Windows\System\FMpfIeY.exe
  2⤵
  PID:10144
- C:\Windows\System\UlJpwcX.exe
  C:\Windows\System\UlJpwcX.exe
  2⤵
  PID:10152
- C:\Windows\System\EPqMOEw.exe
  C:\Windows\System\EPqMOEw.exe
  2⤵
  PID:10212
- C:\Windows\System\kWGjLOT.exe
  C:\Windows\System\kWGjLOT.exe
  2⤵
  PID:10200
- C:\Windows\System\hNZDRTn.exe
  C:\Windows\System\hNZDRTn.exe
  2⤵
  PID:9632
- C:\Windows\System\GPWHDAr.exe
  C:\Windows\System\GPWHDAr.exe
  2⤵
  PID:9520
- C:\Windows\System\RYTflUM.exe
  C:\Windows\System\RYTflUM.exe
  2⤵
  PID:9768
- C:\Windows\System\CbCioDr.exe
  C:\Windows\System\CbCioDr.exe
  2⤵
  PID:9972
- C:\Windows\System\adMbSsf.exe
  C:\Windows\System\adMbSsf.exe
  2⤵
  PID:9956
- C:\Windows\System\lSZTNvK.exe
  C:\Windows\System\lSZTNvK.exe
  2⤵
  PID:10080
- C:\Windows\System\DpMqtjV.exe
  C:\Windows\System\DpMqtjV.exe
  2⤵
  PID:9224
- C:\Windows\System\ZPDJwQK.exe
  C:\Windows\System\ZPDJwQK.exe
  2⤵
  PID:9296
- C:\Windows\System\JIhYFaC.exe
  C:\Windows\System\JIhYFaC.exe
  2⤵
  PID:10116
- C:\Windows\System\CuPlBlE.exe
  C:\Windows\System\CuPlBlE.exe
  2⤵
  PID:9844
- C:\Windows\System\GbUGoKJ.exe
  C:\Windows\System\GbUGoKJ.exe
  2⤵
  PID:10256
- C:\Windows\System\MDWBBCf.exe
  C:\Windows\System\MDWBBCf.exe
  2⤵
  PID:10292
- C:\Windows\System\Bcygbed.exe
  C:\Windows\System\Bcygbed.exe
  2⤵
  PID:10324
- C:\Windows\System\SCNOlTw.exe
  C:\Windows\System\SCNOlTw.exe
  2⤵
  PID:10352
- C:\Windows\System\OjfNZeu.exe
  C:\Windows\System\OjfNZeu.exe
  2⤵
  PID:10372
- C:\Windows\System\NVBHZld.exe
  C:\Windows\System\NVBHZld.exe
  2⤵
  PID:10404
- C:\Windows\System\QkUFYVx.exe
  C:\Windows\System\QkUFYVx.exe
  2⤵
  PID:10440
- C:\Windows\System\IHgZjiv.exe
  C:\Windows\System\IHgZjiv.exe
  2⤵
  PID:10472
- C:\Windows\System\juWmQEy.exe
  C:\Windows\System\juWmQEy.exe
  2⤵
  PID:10500
- C:\Windows\System\xSfMLCq.exe
  C:\Windows\System\xSfMLCq.exe
  2⤵
  PID:10520
- C:\Windows\System\RECuoMo.exe
  C:\Windows\System\RECuoMo.exe
  2⤵
  PID:10552
- C:\Windows\System\uZLKpNr.exe
  C:\Windows\System\uZLKpNr.exe
  2⤵
  PID:10580
- C:\Windows\System\cxxofuW.exe
  C:\Windows\System\cxxofuW.exe
  2⤵
  PID:10608
- C:\Windows\System\SnKmxiU.exe
  C:\Windows\System\SnKmxiU.exe
  2⤵
  PID:10624
- C:\Windows\System\IhgdpNQ.exe
  C:\Windows\System\IhgdpNQ.exe
  2⤵
  PID:10648
- C:\Windows\System\sqvfnRG.exe
  C:\Windows\System\sqvfnRG.exe
  2⤵
  PID:10676
- C:\Windows\System\WEEZFCa.exe
  C:\Windows\System\WEEZFCa.exe
  2⤵
  PID:10704
- C:\Windows\System\GjjyYCh.exe
  C:\Windows\System\GjjyYCh.exe
  2⤵
  PID:10740
- C:\Windows\System\POfbpKI.exe
  C:\Windows\System\POfbpKI.exe
  2⤵
  PID:10764
- C:\Windows\System\RTjhIxN.exe
  C:\Windows\System\RTjhIxN.exe
  2⤵
  PID:10788
- C:\Windows\System\YGXiasv.exe
  C:\Windows\System\YGXiasv.exe
  2⤵
  PID:10808
- C:\Windows\System\EtPWFzJ.exe
  C:\Windows\System\EtPWFzJ.exe
  2⤵
  PID:10840
- C:\Windows\System\hFFlzza.exe
  C:\Windows\System\hFFlzza.exe
  2⤵
  PID:10864
- C:\Windows\System\bmJFcUf.exe
  C:\Windows\System\bmJFcUf.exe
  2⤵
  PID:10888
- C:\Windows\System\oknuoLk.exe
  C:\Windows\System\oknuoLk.exe
  2⤵
  PID:10912
- C:\Windows\System\WahinJa.exe
  C:\Windows\System\WahinJa.exe
  2⤵
  PID:10948
- C:\Windows\System\KENRpDg.exe
  C:\Windows\System\KENRpDg.exe
  2⤵
  PID:10972
- C:\Windows\System\ggAcedy.exe
  C:\Windows\System\ggAcedy.exe
  2⤵
  PID:11008
- C:\Windows\System\pHXfkFo.exe
  C:\Windows\System\pHXfkFo.exe
  2⤵
  PID:11044
- C:\Windows\System\vzYsszo.exe
  C:\Windows\System\vzYsszo.exe
  2⤵
  PID:11072
- C:\Windows\System\gkGaxQf.exe
  C:\Windows\System\gkGaxQf.exe
  2⤵
  PID:11096
- C:\Windows\System\kTgbGJt.exe
  C:\Windows\System\kTgbGJt.exe
  2⤵
  PID:11116
- C:\Windows\System\HRquZpg.exe
  C:\Windows\System\HRquZpg.exe
  2⤵
  PID:11144
- C:\Windows\System\naMHVPI.exe
  C:\Windows\System\naMHVPI.exe
  2⤵
  PID:11172
- C:\Windows\System\JEVURzs.exe
  C:\Windows\System\JEVURzs.exe
  2⤵
  PID:11212
- C:\Windows\System\BNnbmzC.exe
  C:\Windows\System\BNnbmzC.exe
  2⤵
  PID:11244
- C:\Windows\System\fxklQvV.exe
  C:\Windows\System\fxklQvV.exe
  2⤵
  PID:10088
- C:\Windows\System\CSkBcXS.exe
  C:\Windows\System\CSkBcXS.exe
  2⤵
  PID:10276
- C:\Windows\System\WSImnFN.exe
  C:\Windows\System\WSImnFN.exe
  2⤵
  PID:10332
- C:\Windows\System\ZkjjFVb.exe
  C:\Windows\System\ZkjjFVb.exe
  2⤵
  PID:10392
- C:\Windows\System\tZeVSpk.exe
  C:\Windows\System\tZeVSpk.exe
  2⤵
  PID:10468
- C:\Windows\System\gjtwhHN.exe
  C:\Windows\System\gjtwhHN.exe
  2⤵
  PID:10512
- C:\Windows\System\UodlqwN.exe
  C:\Windows\System\UodlqwN.exe
  2⤵
  PID:10564
- C:\Windows\System\ZTInxpF.exe
  C:\Windows\System\ZTInxpF.exe
  2⤵
  PID:10636
- C:\Windows\System\nxsoqEG.exe
  C:\Windows\System\nxsoqEG.exe
  2⤵
  PID:10748
- C:\Windows\System\DMasnRq.exe
  C:\Windows\System\DMasnRq.exe
  2⤵
  PID:10820
- C:\Windows\System\tUnXSHd.exe
  C:\Windows\System\tUnXSHd.exe
  2⤵
  PID:10964
- C:\Windows\System\rXoDQSH.exe
  C:\Windows\System\rXoDQSH.exe
  2⤵
  PID:11020
- C:\Windows\System\CSWpEgO.exe
  C:\Windows\System\CSWpEgO.exe
  2⤵
  PID:10876
- C:\Windows\System\vMCpwvI.exe
  C:\Windows\System\vMCpwvI.exe
  2⤵
  PID:11088
- C:\Windows\System\dkPHnqU.exe
  C:\Windows\System\dkPHnqU.exe
  2⤵
  PID:11160
- C:\Windows\System\OZYFHCw.exe
  C:\Windows\System\OZYFHCw.exe
  2⤵
  PID:11260
- C:\Windows\System\CQIZiDw.exe
  C:\Windows\System\CQIZiDw.exe
  2⤵
  PID:11228
- C:\Windows\System\lOOxBoL.exe
  C:\Windows\System\lOOxBoL.exe
  2⤵
  PID:10416
- C:\Windows\System\xfqYjWy.exe
  C:\Windows\System\xfqYjWy.exe
  2⤵
  PID:10600
- C:\Windows\System\MoTuxxv.exe
  C:\Windows\System\MoTuxxv.exe
  2⤵
  PID:10456
- C:\Windows\System\Mzaaazq.exe
  C:\Windows\System\Mzaaazq.exe
  2⤵
  PID:10728
- C:\Windows\System\WRGvkIy.exe
  C:\Windows\System\WRGvkIy.exe
  2⤵
  PID:10784
- C:\Windows\System\jRlUMrz.exe
  C:\Windows\System\jRlUMrz.exe
  2⤵
  PID:11028
- C:\Windows\System\ZAVoZql.exe
  C:\Windows\System\ZAVoZql.exe
  2⤵
  PID:9796
- C:\Windows\System\tFTwAMP.exe
  C:\Windows\System\tFTwAMP.exe
  2⤵
  PID:10724
- C:\Windows\System\PjARgjH.exe
  C:\Windows\System\PjARgjH.exe
  2⤵
  PID:10988
- C:\Windows\System\ehDLSvm.exe
  C:\Windows\System\ehDLSvm.exe
  2⤵
  PID:11024
- C:\Windows\System\exsTGDi.exe
  C:\Windows\System\exsTGDi.exe
  2⤵
  PID:11268
- C:\Windows\System\Pdxkjnu.exe
  C:\Windows\System\Pdxkjnu.exe
  2⤵
  PID:11296
- C:\Windows\System\WnpwDOD.exe
  C:\Windows\System\WnpwDOD.exe
  2⤵
  PID:11332
- C:\Windows\System\imgEmhE.exe
  C:\Windows\System\imgEmhE.exe
  2⤵
  PID:11360
- C:\Windows\System\zAKOxws.exe
  C:\Windows\System\zAKOxws.exe
  2⤵
  PID:11388
- C:\Windows\System\voyjShR.exe
  C:\Windows\System\voyjShR.exe
  2⤵
  PID:11420
- C:\Windows\System\qtcqUru.exe
  C:\Windows\System\qtcqUru.exe
  2⤵
  PID:11440
- C:\Windows\System\yTbheOX.exe
  C:\Windows\System\yTbheOX.exe
  2⤵
  PID:11468
- C:\Windows\System\NRfiogI.exe
  C:\Windows\System\NRfiogI.exe
  2⤵
  PID:11492
- C:\Windows\System\PKNQGpz.exe
  C:\Windows\System\PKNQGpz.exe
  2⤵
  PID:11512
- C:\Windows\System\OPinXsb.exe
  C:\Windows\System\OPinXsb.exe
  2⤵
  PID:11532
- C:\Windows\System\GlmyGZC.exe
  C:\Windows\System\GlmyGZC.exe
  2⤵
  PID:11560
- C:\Windows\System\IFMuBWZ.exe
  C:\Windows\System\IFMuBWZ.exe
  2⤵
  PID:11592
- C:\Windows\System\KKychoA.exe
  C:\Windows\System\KKychoA.exe
  2⤵
  PID:11620
- C:\Windows\System\yYLBpPx.exe
  C:\Windows\System\yYLBpPx.exe
  2⤵
  PID:11668
- C:\Windows\System\OjpxaZq.exe
  C:\Windows\System\OjpxaZq.exe
  2⤵
  PID:11692
- C:\Windows\System\YiRPWDb.exe
  C:\Windows\System\YiRPWDb.exe
  2⤵
  PID:11716
- C:\Windows\System\SlOmGxv.exe
  C:\Windows\System\SlOmGxv.exe
  2⤵
  PID:11744
- C:\Windows\System\iGOFSFj.exe
  C:\Windows\System\iGOFSFj.exe
  2⤵
  PID:11768
- C:\Windows\System\Vdwcuyw.exe
  C:\Windows\System\Vdwcuyw.exe
  2⤵
  PID:11800
- C:\Windows\System\XlfKcXw.exe
  C:\Windows\System\XlfKcXw.exe
  2⤵
  PID:11820
- C:\Windows\System\VodQOer.exe
  C:\Windows\System\VodQOer.exe
  2⤵
  PID:11848
- C:\Windows\System\azQMtsa.exe
  C:\Windows\System\azQMtsa.exe
  2⤵
  PID:11876
- C:\Windows\System\czexUwG.exe
  C:\Windows\System\czexUwG.exe
  2⤵
  PID:11900
- C:\Windows\System\GjQSmxC.exe
  C:\Windows\System\GjQSmxC.exe
  2⤵
  PID:11936
- C:\Windows\System\FnIkEkW.exe
  C:\Windows\System\FnIkEkW.exe
  2⤵
  PID:11960
- C:\Windows\System\xZJPgvP.exe
  C:\Windows\System\xZJPgvP.exe
  2⤵
  PID:11984
- C:\Windows\System\KZliMdd.exe
  C:\Windows\System\KZliMdd.exe
  2⤵
  PID:12008
- C:\Windows\System\mvLUxSZ.exe
  C:\Windows\System\mvLUxSZ.exe
  2⤵
  PID:12044
- C:\Windows\System\wXkKqKt.exe
  C:\Windows\System\wXkKqKt.exe
  2⤵
  PID:12080
- C:\Windows\System\QXLHrwR.exe
  C:\Windows\System\QXLHrwR.exe
  2⤵
  PID:12108
- C:\Windows\System\ZcMSAXB.exe
  C:\Windows\System\ZcMSAXB.exe
  2⤵
  PID:12140
- C:\Windows\System\oUllIyU.exe
  C:\Windows\System\oUllIyU.exe
  2⤵
  PID:12164
- C:\Windows\System\tKvlFWj.exe
  C:\Windows\System\tKvlFWj.exe
  2⤵
  PID:12192
- C:\Windows\System\yaNIBHX.exe
  C:\Windows\System\yaNIBHX.exe
  2⤵
  PID:12224
- C:\Windows\System\IKOOOOe.exe
  C:\Windows\System\IKOOOOe.exe
  2⤵
  PID:12260
- C:\Windows\System\vZdgEjZ.exe
  C:\Windows\System\vZdgEjZ.exe
  2⤵
  PID:12284
- C:\Windows\System\nbaXmZx.exe
  C:\Windows\System\nbaXmZx.exe
  2⤵
  PID:11348
- C:\Windows\System\xlBpQca.exe
  C:\Windows\System\xlBpQca.exe
  2⤵
  PID:11408
- C:\Windows\System\vBlhNvH.exe
  C:\Windows\System\vBlhNvH.exe
  2⤵
  PID:11376
- C:\Windows\System\cFYCYYz.exe
  C:\Windows\System\cFYCYYz.exe
  2⤵
  PID:11412
- C:\Windows\System\xqoWbEt.exe
  C:\Windows\System\xqoWbEt.exe
  2⤵
  PID:11548
- C:\Windows\System\ENsrtIj.exe
  C:\Windows\System\ENsrtIj.exe
  2⤵
  PID:11584
- C:\Windows\System\drMRhfX.exe
  C:\Windows\System\drMRhfX.exe
  2⤵
  PID:11688
- C:\Windows\System\pPbuBPX.exe
  C:\Windows\System\pPbuBPX.exe
  2⤵
  PID:11740
- C:\Windows\System\ClnGiKs.exe
  C:\Windows\System\ClnGiKs.exe
  2⤵
  PID:11808
- C:\Windows\System\lmmxmjr.exe
  C:\Windows\System\lmmxmjr.exe
  2⤵
  PID:11888
- C:\Windows\System\fghwIvd.exe
  C:\Windows\System\fghwIvd.exe
  2⤵
  PID:11948
- C:\Windows\System\yLiyLnB.exe
  C:\Windows\System\yLiyLnB.exe
  2⤵
  PID:11972
- C:\Windows\System\veRPKLh.exe
  C:\Windows\System\veRPKLh.exe
  2⤵
  PID:11980
- C:\Windows\System\MyrKpTm.exe
  C:\Windows\System\MyrKpTm.exe
  2⤵
  PID:12004
- C:\Windows\System\LqCGGPf.exe
  C:\Windows\System\LqCGGPf.exe
  2⤵
  PID:12132
- C:\Windows\System\thhToXo.exe
  C:\Windows\System\thhToXo.exe
  2⤵
  PID:12268
- C:\Windows\System\brmqPTR.exe
  C:\Windows\System\brmqPTR.exe
  2⤵
  PID:12240
- C:\Windows\System\SDwAjET.exe
  C:\Windows\System\SDwAjET.exe
  2⤵
  PID:11484
- C:\Windows\System\CaamvUy.exe
  C:\Windows\System\CaamvUy.exe
  2⤵
  PID:11508
- C:\Windows\System\QXYRhTR.exe
  C:\Windows\System\QXYRhTR.exe
  2⤵
  PID:11708
- C:\Windows\System\PwigSmY.exe
  C:\Windows\System\PwigSmY.exe
  2⤵
  PID:11704
- C:\Windows\System\IGykyAk.exe
  C:\Windows\System\IGykyAk.exe
  2⤵
  PID:9636
- C:\Windows\System\LEagwaJ.exe
  C:\Windows\System\LEagwaJ.exe
  2⤵
  PID:12232
- C:\Windows\System\mnjbMUw.exe
  C:\Windows\System\mnjbMUw.exe
  2⤵
  PID:12040
- C:\Windows\System\iQiaFVj.exe
  C:\Windows\System\iQiaFVj.exe
  2⤵
  PID:11528
- C:\Windows\System\iHKnmRN.exe
  C:\Windows\System\iHKnmRN.exe
  2⤵
  PID:12276
- C:\Windows\System\LHmvmRn.exe
  C:\Windows\System\LHmvmRn.exe
  2⤵
  PID:12308
- C:\Windows\System\CbxhEie.exe
  C:\Windows\System\CbxhEie.exe
  2⤵
  PID:12344
- C:\Windows\System\ZtDHFbf.exe
  C:\Windows\System\ZtDHFbf.exe
  2⤵
  PID:12364
- C:\Windows\System\buhfaWZ.exe
  C:\Windows\System\buhfaWZ.exe
  2⤵
  PID:12396
- C:\Windows\System\zfPjRNh.exe
  C:\Windows\System\zfPjRNh.exe
  2⤵
  PID:12420
- C:\Windows\System\RjsvQIR.exe
  C:\Windows\System\RjsvQIR.exe
  2⤵
  PID:12456
- C:\Windows\System\jbFNMFS.exe
  C:\Windows\System\jbFNMFS.exe
  2⤵
  PID:12484
- C:\Windows\System\ZWqONTg.exe
  C:\Windows\System\ZWqONTg.exe
  2⤵
  PID:12512
- C:\Windows\System\mnPunBK.exe
  C:\Windows\System\mnPunBK.exe
  2⤵
  PID:12540
- C:\Windows\System\xZSaizC.exe
  C:\Windows\System\xZSaizC.exe
  2⤵
  PID:12564
- C:\Windows\System\tHBoThs.exe
  C:\Windows\System\tHBoThs.exe
  2⤵
  PID:12588
- C:\Windows\System\FhqXMzq.exe
  C:\Windows\System\FhqXMzq.exe
  2⤵
  PID:12612
- C:\Windows\System\HWBRRbB.exe
  C:\Windows\System\HWBRRbB.exe
  2⤵
  PID:12644
- C:\Windows\System\fJebdBL.exe
  C:\Windows\System\fJebdBL.exe
  2⤵
  PID:12680
- C:\Windows\System\XiTzvHB.exe
  C:\Windows\System\XiTzvHB.exe
  2⤵
  PID:12704
- C:\Windows\System\YlSNlDZ.exe
  C:\Windows\System\YlSNlDZ.exe
  2⤵
  PID:12732
- C:\Windows\System\lYUXuBF.exe
  C:\Windows\System\lYUXuBF.exe
  2⤵
  PID:12760
- C:\Windows\System\aPjdxWW.exe
  C:\Windows\System\aPjdxWW.exe
  2⤵
  PID:12788
- C:\Windows\System\ACShWUl.exe
  C:\Windows\System\ACShWUl.exe
  2⤵
  PID:12816
- C:\Windows\System\lbykxdY.exe
  C:\Windows\System\lbykxdY.exe
  2⤵
  PID:12844
- C:\Windows\System\FCgZbPx.exe
  C:\Windows\System\FCgZbPx.exe
  2⤵
  PID:12868
- C:\Windows\System\XFqFPbe.exe
  C:\Windows\System\XFqFPbe.exe
  2⤵
  PID:12896
- C:\Windows\System\ORTFQvO.exe
  C:\Windows\System\ORTFQvO.exe
  2⤵
  PID:12916
- C:\Windows\System\cqbssPg.exe
  C:\Windows\System\cqbssPg.exe
  2⤵
  PID:12948
- C:\Windows\System\YytvwXR.exe
  C:\Windows\System\YytvwXR.exe
  2⤵
  PID:12980
- C:\Windows\System\QBbCMXj.exe
  C:\Windows\System\QBbCMXj.exe
  2⤵
  PID:13000
- C:\Windows\System\vgjVEsw.exe
  C:\Windows\System\vgjVEsw.exe
  2⤵
  PID:13028
- C:\Windows\System\LwqLymB.exe
  C:\Windows\System\LwqLymB.exe
  2⤵
  PID:13068
- C:\Windows\System\FJSSkGE.exe
  C:\Windows\System\FJSSkGE.exe
  2⤵
  PID:13088
- C:\Windows\System\NOUOAEw.exe
  C:\Windows\System\NOUOAEw.exe
  2⤵
  PID:13124
- C:\Windows\System\fNxadIF.exe
  C:\Windows\System\fNxadIF.exe
  2⤵
  PID:13148
- C:\Windows\System\dIBYtLW.exe
  C:\Windows\System\dIBYtLW.exe
  2⤵
  PID:13172
- C:\Windows\System\UINDlxD.exe
  C:\Windows\System\UINDlxD.exe
  2⤵
  PID:13196
- C:\Windows\System\gnfXDDc.exe
  C:\Windows\System\gnfXDDc.exe
  2⤵
  PID:13220
- C:\Windows\System\EcHNJdm.exe
  C:\Windows\System\EcHNJdm.exe
  2⤵
  PID:13248
- C:\Windows\System\tsDoHYQ.exe
  C:\Windows\System\tsDoHYQ.exe
  2⤵
  PID:13276
- C:\Windows\System\uuyOcee.exe
  C:\Windows\System\uuyOcee.exe
  2⤵
  PID:13304
- C:\Windows\System\eDUSpeY.exe
  C:\Windows\System\eDUSpeY.exe
  2⤵
  PID:11844
- C:\Windows\System\KfdNQTo.exe
  C:\Windows\System\KfdNQTo.exe
  2⤵
  PID:12304
- C:\Windows\System\QEPybwK.exe
  C:\Windows\System\QEPybwK.exe
  2⤵
  PID:12032
- C:\Windows\System\ROJhacm.exe
  C:\Windows\System\ROJhacm.exe
  2⤵
  PID:12356
- C:\Windows\System\qAJspbZ.exe
  C:\Windows\System\qAJspbZ.exe
  2⤵
  PID:12440
- C:\Windows\System\JPYhkhr.exe
  C:\Windows\System\JPYhkhr.exe
  2⤵
  PID:12548
- C:\Windows\System\kxDvfxT.exe
  C:\Windows\System\kxDvfxT.exe
  2⤵
  PID:12552
- C:\Windows\System\VZsgAfI.exe
  C:\Windows\System\VZsgAfI.exe
  2⤵
  PID:12724
- C:\Windows\System\rQBmoUd.exe
  C:\Windows\System\rQBmoUd.exe
  2⤵
  PID:12784
- C:\Windows\System\AIHvLZY.exe
  C:\Windows\System\AIHvLZY.exe
  2⤵
  PID:12808
- C:\Windows\System\JToslor.exe
  C:\Windows\System\JToslor.exe
  2⤵
  PID:12828
- C:\Windows\System\qcNqWSB.exe
  C:\Windows\System\qcNqWSB.exe
  2⤵
  PID:12968
- C:\Windows\System\QWlUzIi.exe
  C:\Windows\System\QWlUzIi.exe
  2⤵
  PID:13040
- C:\Windows\System\RuuLkYx.exe
  C:\Windows\System\RuuLkYx.exe
  2⤵
  PID:12960
- C:\Windows\System\APdPXvB.exe
  C:\Windows\System\APdPXvB.exe
  2⤵
  PID:13016
- C:\Windows\System\dOoFaQL.exe
  C:\Windows\System\dOoFaQL.exe
  2⤵
  PID:13164
- C:\Windows\System\FTMDZeF.exe
  C:\Windows\System\FTMDZeF.exe
  2⤵
  PID:13212
- C:\Windows\System\beIDlTN.exe
  C:\Windows\System\beIDlTN.exe
  2⤵
  PID:12320
- C:\Windows\System\tUJJMuz.exe
  C:\Windows\System\tUJJMuz.exe
  2⤵
  PID:13240
- C:\Windows\System\AJsnaYJ.exe
  C:\Windows\System\AJsnaYJ.exe
  2⤵
  PID:12448
- C:\Windows\System\oRBXuGS.exe
  C:\Windows\System\oRBXuGS.exe
  2⤵
  PID:12352
- C:\Windows\System\EgoTSyf.exe
  C:\Windows\System\EgoTSyf.exe
  2⤵
  PID:12712
- C:\Windows\System\SmjYltb.exe
  C:\Windows\System\SmjYltb.exe
  2⤵
  PID:12864
- C:\Windows\System\eNHoZKF.exe
  C:\Windows\System\eNHoZKF.exe
  2⤵
  PID:12748
- C:\Windows\System\sPXItIn.exe
  C:\Windows\System\sPXItIn.exe
  2⤵
  PID:13116
- C:\Windows\System\miBDObG.exe
  C:\Windows\System\miBDObG.exe
  2⤵
  PID:13104
- C:\Windows\System\uMTugSG.exe
  C:\Windows\System\uMTugSG.exe
  2⤵
  PID:12292
- C:\Windows\System\atkNtrr.exe
  C:\Windows\System\atkNtrr.exe
  2⤵
  PID:13324
- C:\Windows\System\tQbywtP.exe
  C:\Windows\System\tQbywtP.exe
  2⤵
  PID:13348
- C:\Windows\System\xlrMypU.exe
  C:\Windows\System\xlrMypU.exe
  2⤵
  PID:13364
- C:\Windows\System\rrEpycJ.exe
  C:\Windows\System\rrEpycJ.exe
  2⤵
  PID:13380
- C:\Windows\System\SiBpamw.exe
  C:\Windows\System\SiBpamw.exe
  2⤵
  PID:13408
- C:\Windows\System\tfdziGu.exe
  C:\Windows\System\tfdziGu.exe
  2⤵
  PID:13440
- C:\Windows\System\qpcfPRC.exe
  C:\Windows\System\qpcfPRC.exe
  2⤵
  PID:13464
- C:\Windows\System\tvSYeyC.exe
  C:\Windows\System\tvSYeyC.exe
  2⤵
  PID:13488
- C:\Windows\System\awilzHE.exe
  C:\Windows\System\awilzHE.exe
  2⤵
  PID:13504
- C:\Windows\System\dApyVbz.exe
  C:\Windows\System\dApyVbz.exe
  2⤵
  PID:13532
- C:\Windows\System\EhwBLjZ.exe
  C:\Windows\System\EhwBLjZ.exe
  2⤵
  PID:13548
- C:\Windows\System\obhGCCP.exe
  C:\Windows\System\obhGCCP.exe
  2⤵
  PID:13584
- C:\Windows\System\XYRMFtn.exe
  C:\Windows\System\XYRMFtn.exe
  2⤵
  PID:13624
- C:\Windows\System\YuzWHjd.exe
  C:\Windows\System\YuzWHjd.exe
  2⤵
  PID:13648
- C:\Windows\System\DwBqvGY.exe
  C:\Windows\System\DwBqvGY.exe
  2⤵
  PID:13680
- C:\Windows\System\GvUPTVy.exe
  C:\Windows\System\GvUPTVy.exe
  2⤵
  PID:13708
- C:\Windows\System\drlqwnf.exe
  C:\Windows\System\drlqwnf.exe
  2⤵
  PID:13728
- C:\Windows\System\MoyPmhD.exe
  C:\Windows\System\MoyPmhD.exe
  2⤵
  PID:13940
- C:\Windows\System\HEYdhdO.exe
  C:\Windows\System\HEYdhdO.exe
  2⤵
  PID:13956
- C:\Windows\System\qXtSyZP.exe
  C:\Windows\System\qXtSyZP.exe
  2⤵
  PID:13972
- C:\Windows\System\xilhuhV.exe
  C:\Windows\System\xilhuhV.exe
  2⤵
  PID:13992
- C:\Windows\System\EguSNyJ.exe
  C:\Windows\System\EguSNyJ.exe
  2⤵
  PID:14024
- C:\Windows\System\OJlpmir.exe
  C:\Windows\System\OJlpmir.exe
  2⤵
  PID:14044
- C:\Windows\System\fFtSTZW.exe
  C:\Windows\System\fFtSTZW.exe
  2⤵
  PID:14068
- C:\Windows\System\dumeDIZ.exe
  C:\Windows\System\dumeDIZ.exe
  2⤵
  PID:14092
- C:\Windows\System\xPnycOa.exe
  C:\Windows\System\xPnycOa.exe
  2⤵
  PID:14116
- C:\Windows\System\GllDTSX.exe
  C:\Windows\System\GllDTSX.exe
  2⤵
  PID:14144
- C:\Windows\System\VRWXiOi.exe
  C:\Windows\System\VRWXiOi.exe
  2⤵
  PID:14164
- C:\Windows\System\IojapRt.exe
  C:\Windows\System\IojapRt.exe
  2⤵
  PID:14184
- C:\Windows\System\SqsJVuP.exe
  C:\Windows\System\SqsJVuP.exe
  2⤵
  PID:14212
- C:\Windows\System\dHPspWC.exe
  C:\Windows\System\dHPspWC.exe
  2⤵
  PID:14228
- C:\Windows\System\wxJOWpU.exe
  C:\Windows\System\wxJOWpU.exe
  2⤵
  PID:14256
- C:\Windows\System\rYzdyGq.exe
  C:\Windows\System\rYzdyGq.exe
  2⤵
  PID:14284
- C:\Windows\System\mBUcXIr.exe
  C:\Windows\System\mBUcXIr.exe
  2⤵
  PID:14312
- C:\Windows\System\QqMPcDu.exe
  C:\Windows\System\QqMPcDu.exe
  2⤵
  PID:12832
- C:\Windows\System\OkBdVFb.exe
  C:\Windows\System\OkBdVFb.exe
  2⤵
  PID:12600
- C:\Windows\System\nwTPnTA.exe
  C:\Windows\System\nwTPnTA.exe
  2⤵
  PID:12800
- C:\Windows\System\yMGuZzX.exe
  C:\Windows\System\yMGuZzX.exe
  2⤵
  PID:12804
- C:\Windows\System\lDYHUBE.exe
  C:\Windows\System\lDYHUBE.exe
  2⤵
  PID:12884
- C:\Windows\System\xPElubt.exe
  C:\Windows\System\xPElubt.exe
  2⤵
  PID:13500
- C:\Windows\System\dfKGRbp.exe
  C:\Windows\System\dfKGRbp.exe
  2⤵
  PID:13560
- C:\Windows\System\fnWijDB.exe
  C:\Windows\System\fnWijDB.exe
  2⤵
  PID:13476
- C:\Windows\System\uVOBzcA.exe
  C:\Windows\System\uVOBzcA.exe
  2⤵
  PID:13636
- C:\Windows\System\KjfapDt.exe
  C:\Windows\System\KjfapDt.exe
  2⤵
  PID:13692
- C:\Windows\System\pRYmZUG.exe
  C:\Windows\System\pRYmZUG.exe
  2⤵
  PID:13668
- C:\Windows\System\epxvOzI.exe
  C:\Windows\System\epxvOzI.exe
  2⤵
  PID:13820
- C:\Windows\System\aGCIapO.exe
  C:\Windows\System\aGCIapO.exe
  2⤵
  PID:13748
- C:\Windows\System\ymBtbAg.exe
  C:\Windows\System\ymBtbAg.exe
  2⤵
  PID:13984
- C:\Windows\System\nJgiKTu.exe
  C:\Windows\System\nJgiKTu.exe
  2⤵
  PID:14032
- C:\Windows\System\pozWRWo.exe
  C:\Windows\System\pozWRWo.exe
  2⤵
  PID:14136
- C:\Windows\System\FWhQpRI.exe
  C:\Windows\System\FWhQpRI.exe
  2⤵
  PID:14132
- C:\Windows\System\fKfHSXb.exe
  C:\Windows\System\fKfHSXb.exe
  2⤵
  PID:14220
- C:\Windows\System\qqvTMqe.exe
  C:\Windows\System\qqvTMqe.exe
  2⤵
  PID:14224
- C:\Windows\System\SVGAtZe.exe
  C:\Windows\System\SVGAtZe.exe
  2⤵
  PID:13340
- C:\Windows\System\OeCvEYI.exe
  C:\Windows\System\OeCvEYI.exe
  2⤵
  PID:13428
- C:\Windows\System\ZWvfsHn.exe
  C:\Windows\System\ZWvfsHn.exe
  2⤵
  PID:13580
- C:\Windows\System\EFNJNbx.exe
  C:\Windows\System\EFNJNbx.exe
  2⤵
  PID:13396
- C:\Windows\System\vSbIkxA.exe
  C:\Windows\System\vSbIkxA.exe
  2⤵
  PID:13880
- C:\Windows\System\xSxoEeh.exe
  C:\Windows\System\xSxoEeh.exe
  2⤵
  PID:14000
- C:\Windows\System\DcvoRHZ.exe
  C:\Windows\System\DcvoRHZ.exe
  2⤵
  PID:14080
- C:\Windows\System\ghQXbTT.exe
  C:\Windows\System\ghQXbTT.exe
  2⤵
  PID:14112
- C:\Windows\System\vDqeGTn.exe
  C:\Windows\System\vDqeGTn.exe
  2⤵
  PID:14300
- C:\Windows\System\SXVzxKW.exe
  C:\Windows\System\SXVzxKW.exe
  2⤵
  PID:13424
- C:\Windows\System\XGmLktg.exe
  C:\Windows\System\XGmLktg.exe
  2⤵
  PID:14124
- C:\Windows\System\WQfozrk.exe
  C:\Windows\System\WQfozrk.exe
  2⤵
  PID:13948
- C:\Windows\System\rTgfsBX.exe
  C:\Windows\System\rTgfsBX.exe
  2⤵
  PID:14364
- C:\Windows\System\tlOXbaq.exe
  C:\Windows\System\tlOXbaq.exe
  2⤵
  PID:14388
- C:\Windows\System\CboroNb.exe
  C:\Windows\System\CboroNb.exe
  2⤵
  PID:14420
- C:\Windows\System\dYEngvG.exe
  C:\Windows\System\dYEngvG.exe
  2⤵
  PID:14440
- C:\Windows\System\ZLkPcnH.exe
  C:\Windows\System\ZLkPcnH.exe
  2⤵
  PID:14468
- C:\Windows\System\YFzogev.exe
  C:\Windows\System\YFzogev.exe
  2⤵
  PID:14496
- C:\Windows\System\TdDgGIU.exe
  C:\Windows\System\TdDgGIU.exe
  2⤵
  PID:14520
- C:\Windows\System\clmBncf.exe
  C:\Windows\System\clmBncf.exe
  2⤵
  PID:14544
- C:\Windows\System\sNBWmje.exe
  C:\Windows\System\sNBWmje.exe
  2⤵
  PID:14576
- C:\Windows\System\IUKBqgG.exe
  C:\Windows\System\IUKBqgG.exe
  2⤵
  PID:14600
- C:\Windows\System\GHdVtSK.exe
  C:\Windows\System\GHdVtSK.exe
  2⤵
  PID:14632
- C:\Windows\System\qKtKCov.exe
  C:\Windows\System\qKtKCov.exe
  2⤵
  PID:14660
- C:\Windows\System\xUaPBXg.exe
  C:\Windows\System\xUaPBXg.exe
  2⤵
  PID:14696
- C:\Windows\System\CZyQYGe.exe
  C:\Windows\System\CZyQYGe.exe
  2⤵
  PID:14720
- C:\Windows\System\emPONeq.exe
  C:\Windows\System\emPONeq.exe
  2⤵
  PID:14748
- C:\Windows\System\iqgjqvC.exe
  C:\Windows\System\iqgjqvC.exe
  2⤵
  PID:14776
- C:\Windows\System\xXQJYBL.exe
  C:\Windows\System\xXQJYBL.exe
  2⤵
  PID:14804
- C:\Windows\System\TzsrXYw.exe
  C:\Windows\System\TzsrXYw.exe
  2⤵
  PID:14832
- C:\Windows\System\LhpoXOP.exe
  C:\Windows\System\LhpoXOP.exe
  2⤵
  PID:14852
- C:\Windows\System\XlShCXD.exe
  C:\Windows\System\XlShCXD.exe
  2⤵
  PID:14872
- C:\Windows\System\tVcgzzY.exe
  C:\Windows\System\tVcgzzY.exe
  2⤵
  PID:14896
- C:\Windows\System\sTHaKRe.exe
  C:\Windows\System\sTHaKRe.exe
  2⤵
  PID:14924
- C:\Windows\System\EpgphqM.exe
  C:\Windows\System\EpgphqM.exe
  2⤵
  PID:14960
- C:\Windows\System\PKZbthV.exe
  C:\Windows\System\PKZbthV.exe
  2⤵
  PID:14976
- C:\Windows\System\qfyKkJs.exe
  C:\Windows\System\qfyKkJs.exe
  2⤵
  PID:15008
- C:\Windows\System\uaxytSh.exe
  C:\Windows\System\uaxytSh.exe
  2⤵
  PID:15044
- C:\Windows\System\CEvDuaN.exe
  C:\Windows\System\CEvDuaN.exe
  2⤵
  PID:15068
- C:\Windows\System\iBcpIUo.exe
  C:\Windows\System\iBcpIUo.exe
  2⤵
  PID:15100
- C:\Windows\System\XLVidei.exe
  C:\Windows\System\XLVidei.exe
  2⤵
  PID:15128
- C:\Windows\System\aGYHGtS.exe
  C:\Windows\System\aGYHGtS.exe
  2⤵
  PID:15152
- C:\Windows\System\cXjCWmm.exe
  C:\Windows\System\cXjCWmm.exe
  2⤵
  PID:15184
- C:\Windows\System\HtUaBJt.exe
  C:\Windows\System\HtUaBJt.exe
  2⤵
  PID:15212
- C:\Windows\System\gaqIsic.exe
  C:\Windows\System\gaqIsic.exe
  2⤵
  PID:15232
- C:\Windows\System\ZxQyKfV.exe
  C:\Windows\System\ZxQyKfV.exe
  2⤵
  PID:15260
- C:\Windows\System\nMHhRfR.exe
  C:\Windows\System\nMHhRfR.exe
  2⤵
  PID:15300
- C:\Windows\System\ExELwQt.exe
  C:\Windows\System\ExELwQt.exe
  2⤵
  PID:15324
- C:\Windows\System\jTaLgwK.exe
  C:\Windows\System\jTaLgwK.exe
  2⤵
  PID:15352
- C:\Windows\System\yEzEhsz.exe
  C:\Windows\System\yEzEhsz.exe
  2⤵
  PID:13516
- C:\Windows\System\DbrCTIC.exe
  C:\Windows\System\DbrCTIC.exe
  2⤵
  PID:14356
- C:\Windows\System\JIeRMpY.exe
  C:\Windows\System\JIeRMpY.exe
  2⤵
  PID:13456
- C:\Windows\System\fHYbKDn.exe
  C:\Windows\System\fHYbKDn.exe
  2⤵
  PID:14488
- C:\Windows\System\dMerejJ.exe
  C:\Windows\System\dMerejJ.exe
  2⤵
  PID:14480
- C:\Windows\System\DVqoJlq.exe
  C:\Windows\System\DVqoJlq.exe
  2⤵
  PID:14452
- C:\Windows\System\vMgoSFP.exe
  C:\Windows\System\vMgoSFP.exe
  2⤵
  PID:14532
- C:\Windows\System\JPjDXgS.exe
  C:\Windows\System\JPjDXgS.exe
  2⤵
  PID:14628
- C:\Windows\System\bStQdJC.exe
  C:\Windows\System\bStQdJC.exe
  2⤵
  PID:14680
- C:\Windows\System\gFLbgGB.exe
  C:\Windows\System\gFLbgGB.exe
  2⤵
  PID:14844
- C:\Windows\System\FWEAerW.exe
  C:\Windows\System\FWEAerW.exe
  2⤵
  PID:15000
- C:\Windows\System\yIeITgQ.exe
  C:\Windows\System\yIeITgQ.exe
  2⤵
  PID:15096
- C:\Windows\System\ZjKLNkw.exe
  C:\Windows\System\ZjKLNkw.exe
  2⤵
  PID:15056
- C:\Windows\System\ikFvCVr.exe
  C:\Windows\System\ikFvCVr.exe
  2⤵
  PID:15348
- C:\Windows\System\noiRWwf.exe
  C:\Windows\System\noiRWwf.exe
  2⤵
  PID:15148
- C:\Windows\System\dcJPcVz.exe
  C:\Windows\System\dcJPcVz.exe
  2⤵
  PID:15208
- C:\Windows\System\YaAjgpw.exe
  C:\Windows\System\YaAjgpw.exe
  2⤵
  PID:14156
- C:\Windows\System\CgszMTv.exe
  C:\Windows\System\CgszMTv.exe
  2⤵
  PID:15248
- C:\Windows\System\pCPsuZh.exe
  C:\Windows\System\pCPsuZh.exe
  2⤵
  PID:14460
- C:\Windows\System\FVUmMYF.exe
  C:\Windows\System\FVUmMYF.exe
  2⤵
  PID:14456
- C:\Windows\System\YLgeBsr.exe
  C:\Windows\System\YLgeBsr.exe
  2⤵
  PID:15244
- C:\Windows\System\gxUnCCt.exe
  C:\Windows\System\gxUnCCt.exe
  2⤵
  PID:15288
- C:\Windows\System\NIRuKYU.exe
  C:\Windows\System\NIRuKYU.exe
  2⤵
  PID:13596
- C:\Windows\System\HkmqKsS.exe
  C:\Windows\System\HkmqKsS.exe
  2⤵
  PID:14820
- C:\Windows\System\QiMPMZB.exe
  C:\Windows\System\QiMPMZB.exe
  2⤵
  PID:15380
- C:\Windows\System\GADKUjW.exe
  C:\Windows\System\GADKUjW.exe
  2⤵
  PID:15404
- C:\Windows\System\XMxRYJc.exe
  C:\Windows\System\XMxRYJc.exe
  2⤵
  PID:15420
- C:\Windows\System\gtKgCNJ.exe
  C:\Windows\System\gtKgCNJ.exe
  2⤵
  PID:15448
- C:\Windows\System\LPzXjtQ.exe
  C:\Windows\System\LPzXjtQ.exe
  2⤵
  PID:15464
- C:\Windows\System\FCoRGIQ.exe
  C:\Windows\System\FCoRGIQ.exe
  2⤵
  PID:15496
- C:\Windows\System\nlzhHoZ.exe
  C:\Windows\System\nlzhHoZ.exe
  2⤵
  PID:15528
- C:\Windows\System\bQVlheg.exe
  C:\Windows\System\bQVlheg.exe
  2⤵
  PID:15548
- C:\Windows\System\lEytBkv.exe
  C:\Windows\System\lEytBkv.exe
  2⤵
  PID:15580
- C:\Windows\System\tvfaNNC.exe
  C:\Windows\System\tvfaNNC.exe
  2⤵
  PID:15608
- C:\Windows\System\rvNDZjW.exe
  C:\Windows\System\rvNDZjW.exe
  2⤵
  PID:15636
- C:\Windows\System\pNgljID.exe
  C:\Windows\System\pNgljID.exe
  2⤵
  PID:15656
- C:\Windows\System\hbhdQQc.exe
  C:\Windows\System\hbhdQQc.exe
  2⤵
  PID:15680
- C:\Windows\System\vxgzpvw.exe
  C:\Windows\System\vxgzpvw.exe
  2⤵
  PID:15708
- C:\Windows\System\MeRkhfw.exe
  C:\Windows\System\MeRkhfw.exe
  2⤵
  PID:15732
- C:\Windows\System\zejJquu.exe
  C:\Windows\System\zejJquu.exe
  2⤵
  PID:15756
- C:\Windows\System\QlPymKJ.exe
  C:\Windows\System\QlPymKJ.exe
  2⤵
  PID:15788
- C:\Windows\System\uNZnpVf.exe
  C:\Windows\System\uNZnpVf.exe
  2⤵
  PID:15816
- C:\Windows\System\kuSZHrY.exe
  C:\Windows\System\kuSZHrY.exe
  2⤵
  PID:15848
- C:\Windows\System\lwXzvOp.exe
  C:\Windows\System\lwXzvOp.exe
  2⤵
  PID:15872
- C:\Windows\System\AaSnBXt.exe
  C:\Windows\System\AaSnBXt.exe
  2⤵
  PID:15908
- C:\Windows\System\DLFWWrm.exe
  C:\Windows\System\DLFWWrm.exe
  2⤵
  PID:15932
- C:\Windows\System\pqXZYKr.exe
  C:\Windows\System\pqXZYKr.exe
  2⤵
  PID:15952
- C:\Windows\System\YaxTzPL.exe
  C:\Windows\System\YaxTzPL.exe
  2⤵
  PID:15980
- C:\Windows\System\WoJlLJs.exe
  C:\Windows\System\WoJlLJs.exe
  2⤵
  PID:16008
- C:\Windows\System\xCaylVC.exe
  C:\Windows\System\xCaylVC.exe
  2⤵
  PID:16028
- C:\Windows\System\WYKdOrJ.exe
  C:\Windows\System\WYKdOrJ.exe
  2⤵
  PID:16056
- C:\Windows\System\NuhpWtL.exe
  C:\Windows\System\NuhpWtL.exe
  2⤵
  PID:16072
- C:\Windows\System\kNGHuKI.exe
  C:\Windows\System\kNGHuKI.exe
  2⤵
  PID:16104
- C:\Windows\System\BfLmQnS.exe
  C:\Windows\System\BfLmQnS.exe
  2⤵
  PID:16128
- C:\Windows\System\XddQAcW.exe
  C:\Windows\System\XddQAcW.exe
  2⤵
  PID:16164
- C:\Windows\System\OIFptJu.exe
  C:\Windows\System\OIFptJu.exe
  2⤵
  PID:16192
- C:\Windows\System\mlxRUdQ.exe
  C:\Windows\System\mlxRUdQ.exe
  2⤵
  PID:16216
- C:\Windows\System\FRvvyZs.exe
  C:\Windows\System\FRvvyZs.exe
  2⤵
  PID:16244
- C:\Windows\System\hzDHkHD.exe
  C:\Windows\System\hzDHkHD.exe
  2⤵
  PID:16280
- C:\Windows\System\hhAhmJz.exe
  C:\Windows\System\hhAhmJz.exe
  2⤵
  PID:16300
- C:\Windows\System\TBiTQqx.exe
  C:\Windows\System\TBiTQqx.exe
  2⤵
  PID:16328
- C:\Windows\System\nNVkKaw.exe
  C:\Windows\System\nNVkKaw.exe
  2⤵
  PID:16352
- C:\Windows\System\rFBPdOn.exe
  C:\Windows\System\rFBPdOn.exe
  2⤵
  PID:16372
- C:\Windows\System\tKEeyOd.exe
  C:\Windows\System\tKEeyOd.exe
  2⤵
  PID:14932
- C:\Windows\System\fJflUEk.exe
  C:\Windows\System\fJflUEk.exe
  2⤵
  PID:14380
- C:\Windows\System\SIkwInS.exe
  C:\Windows\System\SIkwInS.exe
  2⤵
  PID:14708
- C:\Windows\System\OaoKOmH.exe
  C:\Windows\System\OaoKOmH.exe
  2⤵
  PID:14568
- C:\Windows\System\GHloiwb.exe
  C:\Windows\System\GHloiwb.exe
  2⤵
  PID:14728
- C:\Windows\System\ZcJjgAT.exe
  C:\Windows\System\ZcJjgAT.exe
  2⤵
  PID:15536
- C:\Windows\System\IsGiiAY.exe
  C:\Windows\System\IsGiiAY.exe
  2⤵
  PID:15576
- C:\Windows\System\dRQChDa.exe
  C:\Windows\System\dRQChDa.exe
  2⤵
  PID:15488
- C:\Windows\System\qhLkwdE.exe
  C:\Windows\System\qhLkwdE.exe
  2⤵
  PID:15696
- C:\Windows\System\fBtAOOF.exe
  C:\Windows\System\fBtAOOF.exe
  2⤵
  PID:15744
- C:\Windows\System\osUiErm.exe
  C:\Windows\System\osUiErm.exe
  2⤵
  PID:15772
- C:\Windows\System\HAmTkib.exe
  C:\Windows\System\HAmTkib.exe
  2⤵
  PID:15964
- C:\Windows\System\NLENTvD.exe
  C:\Windows\System\NLENTvD.exe
  2⤵
  PID:15776
- C:\Windows\System\PVNPAFw.exe
  C:\Windows\System\PVNPAFw.exe
  2⤵
  PID:16116
- C:\Windows\System\ApTqfat.exe
  C:\Windows\System\ApTqfat.exe
  2⤵
  PID:16096
- C:\Windows\System\qkJXSAK.exe
  C:\Windows\System\qkJXSAK.exe
  2⤵
  PID:16152
- C:\Windows\System\YPXcyJB.exe
  C:\Windows\System\YPXcyJB.exe
  2⤵
  PID:16064
- C:\Windows\System\uAizaTC.exe
  C:\Windows\System\uAizaTC.exe
  2⤵
  PID:16232
- C:\Windows\System\sbiZOKv.exe
  C:\Windows\System\sbiZOKv.exe
  2⤵
  PID:16292
- C:\Windows\System\OHPKPBt.exe
  C:\Windows\System\OHPKPBt.exe
  2⤵
  PID:14540
- C:\Windows\System\CDibQNb.exe
  C:\Windows\System\CDibQNb.exe
  2⤵
  PID:15672
- C:\Windows\System\sWteyMS.exe
  C:\Windows\System\sWteyMS.exe
  2⤵
  PID:15632
- C:\Windows\System\TJdzApX.exe
  C:\Windows\System\TJdzApX.exe
  2⤵
  PID:15416
- C:\Windows\System\OxidWSi.exe
  C:\Windows\System\OxidWSi.exe
  2⤵
  PID:15728
- C:\Windows\System\YOBbiop.exe
  C:\Windows\System\YOBbiop.exe
  2⤵
  PID:15440
- C:\Windows\System\uDIPNZW.exe
  C:\Windows\System\uDIPNZW.exe
  2⤵
  PID:16392
- C:\Windows\System\dvCyDYI.exe
  C:\Windows\System\dvCyDYI.exe
  2⤵
  PID:16408
- C:\Windows\System\BoRAJKJ.exe
  C:\Windows\System\BoRAJKJ.exe
  2⤵
  PID:16428
- C:\Windows\System\ZizkVii.exe
  C:\Windows\System\ZizkVii.exe
  2⤵
  PID:16460
- C:\Windows\System\mhiRRQO.exe
  C:\Windows\System\mhiRRQO.exe
  2⤵
  PID:16480
- C:\Windows\System\WPgyFna.exe
  C:\Windows\System\WPgyFna.exe
  2⤵
  PID:16512
- C:\Windows\System\YgmXTDz.exe
  C:\Windows\System\YgmXTDz.exe
  2⤵
  PID:16540
- C:\Windows\System\NZwtBYR.exe
  C:\Windows\System\NZwtBYR.exe
  2⤵
  PID:16568
- C:\Windows\System\dKtCYiN.exe
  C:\Windows\System\dKtCYiN.exe
  2⤵
  PID:16596
- C:\Windows\System\MKStTgA.exe
  C:\Windows\System\MKStTgA.exe
  2⤵
  PID:16620
- C:\Windows\System\LKGnPRx.exe
  C:\Windows\System\LKGnPRx.exe
  2⤵
  PID:16644
- C:\Windows\System\KIUsqBK.exe
  C:\Windows\System\KIUsqBK.exe
  2⤵
  PID:16672
- C:\Windows\System\fSKEdmx.exe
  C:\Windows\System\fSKEdmx.exe
  2⤵
  PID:16700
- C:\Windows\System\fCARmAP.exe
  C:\Windows\System\fCARmAP.exe
  2⤵
  PID:16728
- C:\Windows\System\xhKWMPg.exe
  C:\Windows\System\xhKWMPg.exe
  2⤵
  PID:16756
- C:\Windows\System\rcydWkt.exe
  C:\Windows\System\rcydWkt.exe
  2⤵
  PID:16772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DSaxoyh.exe

Filesize
1.7MB

MD5
94b8e231cf86c1f88db67ea39ced62bc

SHA1
890d0a8fec914e2e2f4d7b9665712cd56fb6632f

SHA256
d237a668e74be49655046ca27f339e0bff1157c4bca3927f77d0673e63bcf973

SHA512
42b1049d2e9bdb43047a59282ab72f9a53d84ea697bd36d2a962a4cdda774e669e1558cd8f8e6b833c150d37ea45f3778e0e35d25e2ac144f558f7d0b42c90c8

Download Submit
C:\Windows\System\Dgaqlwy.exe

Filesize
1.7MB

MD5
a8cfe624244d3087e560aaed33ff822a

SHA1
90714df7990ed7aeb43dcd0e67844ce551762952

SHA256
cd41975ecccf158d0a0967ff36e9357b9abdd25bc2086820b69f2fe39482a180

SHA512
4dd94b4ba4dc79fccf64c6f50ff3590b6f4450170bb7fe5d2c228e885495fd682417361f57babe1e5acc721e89309fe10f549d25cee179bebd8b7d319371e7ec

Download Submit
C:\Windows\System\DupZkan.exe

Filesize
1.7MB

MD5
98df6b22ebd8681c47d129113dc6b9ce

SHA1
7f1b0caf230a51180171f6121e9c3eca404e1d9b

SHA256
f4b73032cf60d13779971b039a314833a84006e67221c0f656c750b8773f0794

SHA512
63034c4bd71b30303c99d5e09e1e2483a83964acd121cdfb474bccadb03239a1bc8e6041111279f3a659c9dcc2874b2e2cb6f0c2b3cb288de7e1f898d17f234a

Download Submit
C:\Windows\System\ERObbcm.exe

Filesize
1.7MB

MD5
4009bc6ed94095bb13ca893d559d2d9b

SHA1
7d728b6d581c8a2637d9e4a2d420c2f326565b33

SHA256
499c5aded515349ca0a6df1ae6dd8b15c8d010b69ce0965eab8470ae90fe12fe

SHA512
4ed1992b36c153404f5de510eb130a53605c9edae1f13bcc642f35489ca81dfddb3e5a938c5519e5dc8a64ee7a8c1a7bf6705bc80509cbd1cadafa877fa6c139

Download Submit
C:\Windows\System\EWWqkWL.exe

Filesize
1.7MB

MD5
074596e1eba79736e6ac1050f1bd47c2

SHA1
2cde4eafa7330ab3ba2b2c8eebc8d9b3c04ab4aa

SHA256
c1c2c188314f86a54fbd7eba80833eb9ed2f5e5694bce27c6a4ce5935de198d6

SHA512
c451647904b9b045d8d22863bf0bd1131c770dd5b014c0427efabacf84dcde58768de384d990564c3c734f484e2cdffbe8c5be194fbd1850e2ef272c6c7f6758

Download Submit
C:\Windows\System\HuoDXHa.exe

Filesize
1.7MB

MD5
68c7af795740ddb55229d8a73b278fb9

SHA1
98007d50714f1094c9d0da27f1203cbd7f305152

SHA256
84b2e368041198f8da4f3611af305ca4330ae118d3610afb59ea52d4dccdac54

SHA512
b738ffb3362c49e0c569031f637eaf582e30eae976a285da83a656aec41d564093efb7df94ef8b74141e2b50595dbadfe3ae36b13059d077aa27d6432e3b2f14

Download Submit
C:\Windows\System\JZoRzpg.exe

Filesize
1.7MB

MD5
1902879d0143dafe79c8c7356aeff93f

SHA1
e1f13f4ed75141de5069985492e309c3c595771d

SHA256
f0d6adb9c3d679f83904116da4206ef5fa67fac4fb43312922055c9aad08e6ba

SHA512
34c4c2e4edb46f3a2008a3893a92345d2b05c1e394e48bd88936ec397dbe906aaaef7bb8fb5b2c1b96c94393528a947f265a57e5c3b5fffe0213493ef9577c01

Download Submit
C:\Windows\System\KgmrGHp.exe

Filesize
1.7MB

MD5
a87d483c5834cc7ff4ef9d6b781bd751

SHA1
91e02be1f5e1d48b60033e6fb54e79dd06edf9da

SHA256
df97b284d9c4e25e403f6e6ff76c69b211782010ec62be5d4d97fa014e47b19c

SHA512
53617eaa19a5782937def2bc1ef5f9a2c28922b29db9666362c2f438bc10e1121ed1a583c2a9e6fe7728ff5f5daa5506dce6e4199937d75729472c5ecc6a2572

Download Submit
C:\Windows\System\SQHumZh.exe

Filesize
1.7MB

MD5
34062eac07a2dc83d087fa12f09617d3

SHA1
9e5377586da1c40ed8d561cda796e44802224367

SHA256
7d8a9eebe530004840354cfd32f42ce9ff22839b5e6e1318e5f7de322c12ebdc

SHA512
6bf6c02e638cc23e830902c50a9f666bcdfa5fc3648a8711228d074e39c047182372adc76c2480bc6c97ebb4b77fb6ea659e6e3735c19e1bfbcb18551621c311

Download Submit
C:\Windows\System\VJdXVWD.exe

Filesize
1.7MB

MD5
63710453a1b048b47f5631ef28383f67

SHA1
d7b8a202d35d8f98f14fbc8eb431fc325fc71c92

SHA256
5fd75bdc1971a35576076a2dddec0ea5388a5d8d6a7bf5017f08cfc75c1fe2a0

SHA512
50a832b16a8fb2ab4f1c363efeba9723ecdb0e2c7b36b3605808959ceae155a451d8b48173f1ed19d09f40fa3337b427a88f57ee9099296f4110684a68b88012

Download Submit
C:\Windows\System\VdwbkrK.exe

Filesize
1.7MB

MD5
c332366504461805c752bea0f8e480be

SHA1
15ad64270bda88c70259fa06c6cf8e0206ebfde4

SHA256
dac3ff38bc41e6c132bc5c2706fa5b7bc0db2caca3c32cde78c04c82c77abe73

SHA512
eaeaccb94c1d542d0f6c76c6b2d772765743e6649eb6aecffd9025d3b8f6812b33e8df7e95d87dcfdde9c555a5a76580262341aa45dc95056cbd4643ca698250

Download Submit
C:\Windows\System\VyFgspv.exe

Filesize
1.7MB

MD5
db2a42aee169cb12438689f832b0a4a8

SHA1
844164fcae1a54befd6abe4e9938ff626056fcbe

SHA256
8368a9e0aa1a160a5823ac8c3a3edff16c32b74a3b5495111829ee93c032fff0

SHA512
35426ab9a8aff6016c785bf9e427a31c55b106ee14f4e334b4e88806a62a055bd4a3dbdf4bc14e4e5c44f7ac3ab30a7173f64e75ae112b9ea85977970d2d1eee

Download Submit
C:\Windows\System\WrsqaRt.exe

Filesize
1.7MB

MD5
5086be90e0e42bc4175254cf637b96f7

SHA1
bd65a7072ea97fb0afc12317a0a78402ca990f18

SHA256
2710ac7d678c5dd73d13fc7123019767e1b297229557d6892e34a503fbed2838

SHA512
71d7cd531c7edc3d44f7777f6beda9393a3e364b5ec65d33a881b9a7103869ddd4dfce197389adb1a5324fab8264373dc01d152717d2c1ec20f5e96eb70d26c6

Download Submit
C:\Windows\System\YUMmvoi.exe

Filesize
1.7MB

MD5
69a84ee17e245463a2439940f8623bce

SHA1
da3a5f8aa9ceec436a0d491cbe2053fef82eed23

SHA256
69e78ee54e8af510d993961f039ac55320a543174760ef90a13189c7adea564b

SHA512
d219334a9756f569f2feb61a8f281de302ce65cc4099641fd33175fe043748c41f252d5c9c42fda3443382eb25e73cd9c50f14774e8eb2c3b0b620d2b6880b55

Download Submit
C:\Windows\System\YfYOyXY.exe

Filesize
1.7MB

MD5
476dd93ecc34ff9710271d8de87be7f9

SHA1
a023d480ef1f1834e50df323f55359adca4b4645

SHA256
824a22ceda35cfa8437af6e59519a2a3c5c769db976bf84ed91f6f3639acb59e

SHA512
4b460491606f354f7937fd5250eb1231a80c075b221111fa0264bd67347c1c566ec410019e9f6a87b259cd13cc0deaf3f0778893110bbd3ffd700522d3a3a9ca

Download Submit
C:\Windows\System\ZgswDbw.exe

Filesize
1.7MB

MD5
7411bb765a58de63b271f9722ac486d3

SHA1
0fcb007225220eca921b7caa31c1a5d700771304

SHA256
67021880528c0272aade93b2b169decb9dfdb3a149730ffc88dfa0d48cee8516

SHA512
d9c28d542495e047cf80fad64bdccaece1e240eebbf5b228b2008d9214b0f1fd2fde94ebecf039c9a790d4095195fb9f0e69aab3d75dfbad5973f047a248c343

Download Submit
C:\Windows\System\aENnIlR.exe

Filesize
1.7MB

MD5
5dc4195e0347aabb4c51d8fccac08e31

SHA1
15ca8a9a05ea7a7e139fd207d139abddc482d3bf

SHA256
1860296ae28bc832302abdc1ec105e0c851fb398ffe96d3955b4739b1dc0f55e

SHA512
f0298e882a114429cbdd57eb4eff02d22deecd1c33817eb958cb29afb234c7611bfabf1d3158fc89e5fc2338a14a799c966fe17e70c37009a2911e2986082a6f

Download Submit
C:\Windows\System\eRMXLxQ.exe

Filesize
1.7MB

MD5
675029de8c3f858eff4389b1c9d24394

SHA1
a42bba23ba48f01eb1b077d2a9f8e8c4677c183c

SHA256
0ce2223baedb022ef81e11c478288be7bf7a7de3b99eb96937e64bac74434268

SHA512
8739f90b2a71490d7987865859fdad200ed3dfe6c6e736df5055b4510100bb23d7fcf5d60d7d7075d3cd44078aa89f39db30f06d8166b4289d9ca09063223c62

Download Submit
C:\Windows\System\jBGbhib.exe

Filesize
1.7MB

MD5
77dc44514211bf929d8354feeed93200

SHA1
ce0f328f2a5db3d6745d5522674ff33640fb32b3

SHA256
6f85bf8392627d04c30774788fdf27189cfa0204b658cb1ab8d163c615d69795

SHA512
ad2a632e7091569dbfd8033c19f4f20c2db29cee0673e2a0d55656df49025c9599a680445571bda9d08788e74564a5a9b3fdc465a024f058e7b20572f478962f

Download Submit
C:\Windows\System\jLjDpCR.exe

Filesize
1.7MB

MD5
8ff0fbdae538488d7b61c6a5d24f6fde

SHA1
9815abde6724e4588a5dec71d691b15cc5219ade

SHA256
17c0ffc8f989f7092415ace04b962ae37dc36e6517a6ff61c343181c8320a8e1

SHA512
ece9be7e35a6d65fa26f0a839092fcbca2bd6e826781436609c9718f7007776a05222a842d3dd9122d18f8e390ebc36d7f4abdfa9c6d2edee508cc44155b6320

Download Submit
C:\Windows\System\kPzqWIx.exe

Filesize
1.7MB

MD5
8be3c35b67f73194faed43871af0b50e

SHA1
a017301e58ed69c03e0423e648afe86a13da8581

SHA256
e48949a53a6b8fa0e991c9f26ba5e76ef34a51ad8595f2d356e047c9013a80ca

SHA512
de8fc532386bcae08d005f76dfc9b3c3b1e15f36a4521cb5d2da53c4622a4d6a79068a39650c38d2280b9989719692526d697495637fc3e2fbd51179ada9ce84

Download Submit
C:\Windows\System\kbFrCha.exe

Filesize
1.7MB

MD5
136848ad9d79e7d501f4bc8f739ddead

SHA1
19a30f850c6078effb2e866d29e0f2d8ba2747ba

SHA256
7e55e89ff6b9eac2542d2279aafd9c6993fa416f78eff032334d5a926d0daf03

SHA512
20ab518edc647497af10cf5914b970a39a75044ba0df61eb24e95b0bb02a92d6ce12e2fbaeffdc9aa76b87711dc8cbcbb6292434df85903f9be3f20440d59791

Download Submit
C:\Windows\System\mtwPrRh.exe

Filesize
1.7MB

MD5
61d40fa185d19cf20a651ba7ea0fae64

SHA1
e361d81f0a10ec0b33876c6fcb6d54c4502e88be

SHA256
ce9d21cd82c67a940b7d2b96b53bfe9301e085d6c253e88dcf9b20af9d3ad756

SHA512
bf17d9c8527ad66078631282b8f23a1456348a2fd940231416904c4ce473df5b1021b32ea14cab53eb0a1abb8a65e2f478089c7e0a210f289c6fd39a0d73d219

Download Submit
C:\Windows\System\nlxUslL.exe

Filesize
1.7MB

MD5
f098024f4654f1f0afd9275d961e2710

SHA1
e05ba321b153f5c5f994629a774ce27f54355695

SHA256
9ff2d7da1ad6f81c1288f6be0d70a6f70d540345bc209f0d02a3e472bd34789e

SHA512
808e2a8e982793ea53602b448acad9dc38eecb9dfa35adf7444d0b08cc02ed7b1598768787e0f10f94a173c84f6b632606fc010485f0b2c692b65124cbadad03

Download Submit
C:\Windows\System\pObsayz.exe

Filesize
1.7MB

MD5
cb9f5c43fa5769ddd32fa5a6bd00718f

SHA1
17c2ed92562559021f9f07ba1ef7a75e692e18cf

SHA256
df5f9950ef3ab8e83d10d298b656fc2fa0a78fb7edcbba75f11129bc8b7d657b

SHA512
56ea30728171c0aa635297ffde248cc404793082e6a96c5b677a9c4c51ea1a1d617789616960a7560f8fc84d55090f1a0a040cd0d8dd5606f9b8e506effe84c5

Download Submit
C:\Windows\System\pXRBgXy.exe

Filesize
1.7MB

MD5
b024bddbffa0004bb62f5852d507fcb6

SHA1
9c1bbf31835d7f471de6e9164ef64d571b925083

SHA256
7edd3eb54f550ec9d4b4d2e4652375aeaca0ba457618468981f86a6db1deef57

SHA512
98f7af4c39dcb6a6d9f42cdab98fdff5c9b4d0eddd622b16324e5976bba2e6abf9e26d0c7c519a173f7695ae2ab758997bdabeb5aa0d51773280d56506178a68

Download Submit
C:\Windows\System\rVLafWi.exe

Filesize
1.7MB

MD5
e6f27db15d86974f65d0db73df503dc7

SHA1
4165199aff79a1d9ef907278124a3607bd7e3862

SHA256
1469f532073758a1f5c06c7d20f215cb7a203aafe709754873675e62213f8472

SHA512
01c8f83c7116bf1bfc9889c6cbb03e9c3916e8e9805ddbe59b4e63b7cdaa4bf399d62f0344a7901372e446814e5e3f550fee84dd3546ffdacada5d883f72c392

Download Submit
C:\Windows\System\rZxNFLi.exe

Filesize
1.7MB

MD5
fc494750ed5f86621c2fce37ce734752

SHA1
c4f3952d5d8b48f942cbe75ebb73afcef3059a1b

SHA256
56268a4c381c5aa67b5b484c7ff0b116a78e0d425b6a1d7fa60d1b0b201900f6

SHA512
e3a42af83ccd9b8024316e2daa28f7346baa671c270abaa986137796194c0220a3e93ba5c88c9f813bcc69d5d6eedd1a99ac565238cdecd7a76b10e736fd25ab

Download Submit
C:\Windows\System\rpaqTod.exe

Filesize
1.7MB

MD5
cf869f370beee75be3923b0a0d71df78

SHA1
df9004928a9248bf79461ae167ed5e301d6fd3d6

SHA256
7cb5472ff033051a3e32b6f5a92968739931246008e4612dc62ca088a18e1c0c

SHA512
d9b8d1275453a920b687ccf6810cedcc3c5d5ab55ab372d70345ff70f1a821090beacad551428d3180a7a12c3cc1649848089269807d41a86e3ec1ae3ccbd834

Download Submit
C:\Windows\System\ubrTWRS.exe

Filesize
1.7MB

MD5
e88e2751f7ee9823a3e70d3372e3f833

SHA1
53047ce0769f5f3deb180d861ed1e61599cdf4f8

SHA256
d929c88d01b09d5eac93fd05a1fd9c5acf97a2c367c5c226da101369d585d31c

SHA512
043e928f7256bde2c71bc4877d3d4dae5282b9cbe4e65d421f2504cd66d6539b820e11ea6e4446d72cff0b2cfa087bcf5e5c2fcc64d6a899be749d6148e9aa83

Download Submit
C:\Windows\System\wjSukzC.exe

Filesize
1.7MB

MD5
4fc75ba07f38223d91c39345ecf313f0

SHA1
b6a2c2597ccf4b648fb00d40de2f550e4a6ab13a

SHA256
83adfd371d9f44ce9af1979e33c74f29db4f756a0b0b17fb57e3f851b5cc2177

SHA512
e3acd6e2bfc7701141c3f4b7581e44f64153520d7b7e6047f51cc6b298c3ec9efe27d9397f12ce7b30e0dd86a26d99ab31ab34c9c3b59206c66e994b710cae27

Download Submit
C:\Windows\System\yrlhfUk.exe

Filesize
1.7MB

MD5
ce6d6535d8308b5b1f783e58f5e68b12

SHA1
7bfda44d1bf51f6968fc23364503065fc0521429

SHA256
f6a09f85d5f71adeaddc9067418eb837f97e51dee9c1059dbdb09f58043501a2

SHA512
592819213545c888fec8901d5f412516262aece2d69730c4692b1a5531129af2743d5391e2c8fcf4a4561a74654e16e7ffa5ce25efff63d67c180b0d06a0a26e

Download Submit
memory/4392-0-0x000002B7E7110000-0x000002B7E7120000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads