xmrig | d5795f51423ee16137a6d55469b04efa484a96b3bd3910023a0ac2c50b2c0757

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

676a194daf3604605c907330f1e4e3d0.exe
Size

1.8MB
MD5

676a194daf3604605c907330f1e4e3d0
SHA1

4eca7dab8dc24f1d9035ddb9c7bed5438624e7b3
SHA256

d5795f51423ee16137a6d55469b04efa484a96b3bd3910023a0ac2c50b2c0757
SHA512

1ee8ef4acffcebff2388f39125952c2a7e10f6fdd4d7f4478b21f412660f10d60aede30bcfb50c9dd73d7f55c7e2e702200f1dc7e6f03f20f89d8537b8c15bfe
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh/Q6F:BemTLkNdfE0pZrq

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1984-0-0x00007FF6C41B0000-0x00007FF6C4504000-memory.dmp	xmrig
behavioral2/files/0x0009000000023419-5.dat	xmrig
behavioral2/files/0x0007000000023435-21.dat	xmrig
behavioral2/files/0x0007000000023436-18.dat	xmrig
behavioral2/files/0x0007000000023434-16.dat	xmrig
behavioral2/files/0x0008000000023433-15.dat	xmrig
behavioral2/memory/2064-8-0x00007FF769BE0000-0x00007FF769F34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023438-39.dat	xmrig
behavioral2/files/0x0007000000023439-45.dat	xmrig
behavioral2/memory/1680-53-0x00007FF6DCCE0000-0x00007FF6DD034000-memory.dmp	xmrig
behavioral2/memory/3456-56-0x00007FF7216F0000-0x00007FF721A44000-memory.dmp	xmrig
behavioral2/files/0x000700000002343a-54.dat	xmrig
behavioral2/memory/2300-44-0x00007FF6475D0000-0x00007FF647924000-memory.dmp	xmrig
behavioral2/files/0x0007000000023437-42.dat	xmrig
behavioral2/memory/1852-38-0x00007FF7788F0000-0x00007FF778C44000-memory.dmp	xmrig
behavioral2/memory/2240-37-0x00007FF7B9CA0000-0x00007FF7B9FF4000-memory.dmp	xmrig
behavioral2/memory/3904-33-0x00007FF7D0730000-0x00007FF7D0A84000-memory.dmp	xmrig
behavioral2/memory/3232-32-0x00007FF740EB0000-0x00007FF741204000-memory.dmp	xmrig
behavioral2/memory/2872-29-0x00007FF640F60000-0x00007FF6412B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-59.dat	xmrig
behavioral2/memory/3052-64-0x00007FF7BC940000-0x00007FF7BCC94000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-73.dat	xmrig
behavioral2/files/0x000700000002343e-85.dat	xmrig
behavioral2/memory/2448-88-0x00007FF6078D0000-0x00007FF607C24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-95.dat	xmrig
behavioral2/files/0x0007000000023444-113.dat	xmrig
behavioral2/files/0x0007000000023445-122.dat	xmrig
behavioral2/files/0x0007000000023449-138.dat	xmrig
behavioral2/files/0x000700000002344b-151.dat	xmrig
behavioral2/memory/5088-609-0x00007FF7E6BA0000-0x00007FF7E6EF4000-memory.dmp	xmrig
behavioral2/memory/2508-610-0x00007FF70AB00000-0x00007FF70AE54000-memory.dmp	xmrig
behavioral2/memory/4732-645-0x00007FF6B2B50000-0x00007FF6B2EA4000-memory.dmp	xmrig
behavioral2/memory/888-632-0x00007FF74A460000-0x00007FF74A7B4000-memory.dmp	xmrig
behavioral2/memory/4504-626-0x00007FF7C9EE0000-0x00007FF7CA234000-memory.dmp	xmrig
behavioral2/memory/4392-621-0x00007FF6AC8C0000-0x00007FF6ACC14000-memory.dmp	xmrig
behavioral2/memory/4692-617-0x00007FF7638F0000-0x00007FF763C44000-memory.dmp	xmrig
behavioral2/memory/3268-780-0x00007FF79DAE0000-0x00007FF79DE34000-memory.dmp	xmrig
behavioral2/memory/4716-757-0x00007FF632FA0000-0x00007FF6332F4000-memory.dmp	xmrig
behavioral2/memory/3716-731-0x00007FF75DC00000-0x00007FF75DF54000-memory.dmp	xmrig
behavioral2/memory/3164-726-0x00007FF650CC0000-0x00007FF651014000-memory.dmp	xmrig
behavioral2/memory/4664-712-0x00007FF73CEC0000-0x00007FF73D214000-memory.dmp	xmrig
behavioral2/memory/516-694-0x00007FF78E5C0000-0x00007FF78E914000-memory.dmp	xmrig
behavioral2/memory/1808-681-0x00007FF732E10000-0x00007FF733164000-memory.dmp	xmrig
behavioral2/memory/2892-675-0x00007FF7B4410000-0x00007FF7B4764000-memory.dmp	xmrig
behavioral2/memory/3704-661-0x00007FF7BE000000-0x00007FF7BE354000-memory.dmp	xmrig
behavioral2/files/0x0007000000023451-176.dat	xmrig
behavioral2/files/0x0007000000023450-173.dat	xmrig
behavioral2/files/0x000700000002344f-171.dat	xmrig
behavioral2/files/0x000700000002344e-167.dat	xmrig
behavioral2/files/0x000700000002344d-162.dat	xmrig
behavioral2/files/0x000700000002344c-157.dat	xmrig
behavioral2/files/0x000700000002344a-147.dat	xmrig
behavioral2/files/0x0007000000023448-136.dat	xmrig
behavioral2/files/0x0007000000023447-132.dat	xmrig
behavioral2/files/0x0007000000023446-127.dat	xmrig
behavioral2/files/0x0007000000023443-111.dat	xmrig
behavioral2/files/0x0007000000023441-102.dat	xmrig
behavioral2/files/0x0007000000023440-100.dat	xmrig
behavioral2/files/0x000700000002343f-98.dat	xmrig
behavioral2/memory/2000-81-0x00007FF705480000-0x00007FF7057D4000-memory.dmp	xmrig
behavioral2/memory/4052-78-0x00007FF73C860000-0x00007FF73CBB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343d-77.dat	xmrig
behavioral2/files/0x0008000000023431-71.dat	xmrig
behavioral2/memory/1984-1440-0x00007FF6C41B0000-0x00007FF6C4504000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2064	ORisUZD.exe
2872	XEvDyAg.exe
3232	dPCShkV.exe
2240	gFEVLgY.exe
3904	HyldJWk.exe
1852	xVZpznM.exe
2300	qFSTPdi.exe
1680	hAHekQD.exe
3456	pYuIBVA.exe
3052	dqUajkj.exe
4052	ZooqyIR.exe
2000	iGHeERZ.exe
2448	qUyELUz.exe
4716	qjkTepd.exe
5088	hwkjFvg.exe
2508	vVnUJPO.exe
3268	kNiJbQi.exe
4692	BHwrIJr.exe
4392	pHdiiSY.exe
4504	vitjlvb.exe
888	JBRbvHu.exe
4732	CsJPzPl.exe
3704	HhQxhFp.exe
2892	eCXusSZ.exe
1808	UyFvSFe.exe
516	pixypnf.exe
4664	QWHPWBw.exe
3164	cSbUGMT.exe
3716	IDtKrAR.exe
4896	gQjtxOQ.exe
2032	UIrUfjZ.exe
3632	OBnsMgt.exe
2224	RFebDUU.exe
684	wfZCtKJ.exe
2044	xFDVKPU.exe
2732	BWBOpxH.exe
3432	keJMHJQ.exe
3696	XPZRwUl.exe
1420	TaOgBQm.exe
3020	oHWyAKt.exe
3668	siajmJv.exe
3408	lGYDxnM.exe
2232	GNboMTT.exe
2412	pHMycUR.exe
2340	fQckNdr.exe
4012	YPkvzWO.exe
1640	DZAFndQ.exe
440	itkozVd.exe
392	RyBrhWs.exe
4344	fCbkArZ.exe
4580	fqUwmOV.exe
3224	wVefSXn.exe
64	PGgnvdZ.exe
3400	qkWmkoo.exe
4688	kgEmdQU.exe
680	ZIvgTNY.exe
2780	lYLfjvq.exe
4188	epqAyxK.exe
1792	pSLdOww.exe
4660	CXdWikg.exe
1796	dCUQoBq.exe
876	zyqnIYI.exe
3880	wwkBFsy.exe
2616	LreaGIO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1984-0-0x00007FF6C41B0000-0x00007FF6C4504000-memory.dmp	upx
behavioral2/files/0x0009000000023419-5.dat	upx
behavioral2/files/0x0007000000023435-21.dat	upx
behavioral2/files/0x0007000000023436-18.dat	upx
behavioral2/files/0x0007000000023434-16.dat	upx
behavioral2/files/0x0008000000023433-15.dat	upx
behavioral2/memory/2064-8-0x00007FF769BE0000-0x00007FF769F34000-memory.dmp	upx
behavioral2/files/0x0007000000023438-39.dat	upx
behavioral2/files/0x0007000000023439-45.dat	upx
behavioral2/memory/1680-53-0x00007FF6DCCE0000-0x00007FF6DD034000-memory.dmp	upx
behavioral2/memory/3456-56-0x00007FF7216F0000-0x00007FF721A44000-memory.dmp	upx
behavioral2/files/0x000700000002343a-54.dat	upx
behavioral2/memory/2300-44-0x00007FF6475D0000-0x00007FF647924000-memory.dmp	upx
behavioral2/files/0x0007000000023437-42.dat	upx
behavioral2/memory/1852-38-0x00007FF7788F0000-0x00007FF778C44000-memory.dmp	upx
behavioral2/memory/2240-37-0x00007FF7B9CA0000-0x00007FF7B9FF4000-memory.dmp	upx
behavioral2/memory/3904-33-0x00007FF7D0730000-0x00007FF7D0A84000-memory.dmp	upx
behavioral2/memory/3232-32-0x00007FF740EB0000-0x00007FF741204000-memory.dmp	upx
behavioral2/memory/2872-29-0x00007FF640F60000-0x00007FF6412B4000-memory.dmp	upx
behavioral2/files/0x000700000002343b-59.dat	upx
behavioral2/memory/3052-64-0x00007FF7BC940000-0x00007FF7BCC94000-memory.dmp	upx
behavioral2/files/0x000700000002343c-73.dat	upx
behavioral2/files/0x000700000002343e-85.dat	upx
behavioral2/memory/2448-88-0x00007FF6078D0000-0x00007FF607C24000-memory.dmp	upx
behavioral2/files/0x0007000000023442-95.dat	upx
behavioral2/files/0x0007000000023444-113.dat	upx
behavioral2/files/0x0007000000023445-122.dat	upx
behavioral2/files/0x0007000000023449-138.dat	upx
behavioral2/files/0x000700000002344b-151.dat	upx
behavioral2/memory/5088-609-0x00007FF7E6BA0000-0x00007FF7E6EF4000-memory.dmp	upx
behavioral2/memory/2508-610-0x00007FF70AB00000-0x00007FF70AE54000-memory.dmp	upx
behavioral2/memory/4732-645-0x00007FF6B2B50000-0x00007FF6B2EA4000-memory.dmp	upx
behavioral2/memory/888-632-0x00007FF74A460000-0x00007FF74A7B4000-memory.dmp	upx
behavioral2/memory/4504-626-0x00007FF7C9EE0000-0x00007FF7CA234000-memory.dmp	upx
behavioral2/memory/4392-621-0x00007FF6AC8C0000-0x00007FF6ACC14000-memory.dmp	upx
behavioral2/memory/4692-617-0x00007FF7638F0000-0x00007FF763C44000-memory.dmp	upx
behavioral2/memory/3268-780-0x00007FF79DAE0000-0x00007FF79DE34000-memory.dmp	upx
behavioral2/memory/4716-757-0x00007FF632FA0000-0x00007FF6332F4000-memory.dmp	upx
behavioral2/memory/3716-731-0x00007FF75DC00000-0x00007FF75DF54000-memory.dmp	upx
behavioral2/memory/3164-726-0x00007FF650CC0000-0x00007FF651014000-memory.dmp	upx
behavioral2/memory/4664-712-0x00007FF73CEC0000-0x00007FF73D214000-memory.dmp	upx
behavioral2/memory/516-694-0x00007FF78E5C0000-0x00007FF78E914000-memory.dmp	upx
behavioral2/memory/1808-681-0x00007FF732E10000-0x00007FF733164000-memory.dmp	upx
behavioral2/memory/2892-675-0x00007FF7B4410000-0x00007FF7B4764000-memory.dmp	upx
behavioral2/memory/3704-661-0x00007FF7BE000000-0x00007FF7BE354000-memory.dmp	upx
behavioral2/files/0x0007000000023451-176.dat	upx
behavioral2/files/0x0007000000023450-173.dat	upx
behavioral2/files/0x000700000002344f-171.dat	upx
behavioral2/files/0x000700000002344e-167.dat	upx
behavioral2/files/0x000700000002344d-162.dat	upx
behavioral2/files/0x000700000002344c-157.dat	upx
behavioral2/files/0x000700000002344a-147.dat	upx
behavioral2/files/0x0007000000023448-136.dat	upx
behavioral2/files/0x0007000000023447-132.dat	upx
behavioral2/files/0x0007000000023446-127.dat	upx
behavioral2/files/0x0007000000023443-111.dat	upx
behavioral2/files/0x0007000000023441-102.dat	upx
behavioral2/files/0x0007000000023440-100.dat	upx
behavioral2/files/0x000700000002343f-98.dat	upx
behavioral2/memory/2000-81-0x00007FF705480000-0x00007FF7057D4000-memory.dmp	upx
behavioral2/memory/4052-78-0x00007FF73C860000-0x00007FF73CBB4000-memory.dmp	upx
behavioral2/files/0x000700000002343d-77.dat	upx
behavioral2/files/0x0008000000023431-71.dat	upx
behavioral2/memory/1984-1440-0x00007FF6C41B0000-0x00007FF6C4504000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xFDVKPU.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\bgTsWJX.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\ZitinUf.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\CJLlwhC.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\IwxhqkP.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\ubPKBgf.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\gWizVuz.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\kkUPoLJ.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\nuWLwDn.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\PdVtawB.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\JBRbvHu.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\bCldMIQ.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\LVhKVzP.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\ygGbaBA.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\laSjjUw.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\IaSIaDq.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\qRAOwrw.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\UThtIBN.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\VswjyWF.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\nygiUVe.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\zGXPaFP.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\OOuanpR.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\BHwrIJr.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\oHWyAKt.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\XIBnrNb.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\kIRuJpv.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\NBZYWNp.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\DFFaKea.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\sIyOQwi.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\QjtILsd.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\ikgcjBk.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\kJvPPtJ.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\OcCzRfn.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\VWjpxvC.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\mpxmMEU.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\vitjlvb.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\gFGtoYl.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\CuugAFa.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\XIKhjKa.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\rOcpTRp.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\itkozVd.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\XEywZgH.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\ExnfHld.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\ujYFlNm.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\QpSKXSl.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\quIYZIP.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\fFlDnrt.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\ndvfAFX.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\DEkKUlF.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\daAeBQN.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\epqAyxK.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\bMPrEiQ.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\DnMHjKP.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\eZtENOe.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\CsfaVpW.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\hAHekQD.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\gDssSyq.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\BpnSokF.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\fDyawab.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\BWUPlnm.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\rSIqiUn.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\WIHJsNP.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\GnYHmgf.exe	676a194daf3604605c907330f1e4e3d0.exe
File created	C:\Windows\System\uHFdGlB.exe	676a194daf3604605c907330f1e4e3d0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2064	1984	676a194daf3604605c907330f1e4e3d0.exe	83
PID 1984 wrote to memory of 2064	1984	676a194daf3604605c907330f1e4e3d0.exe	83
PID 1984 wrote to memory of 2872	1984	676a194daf3604605c907330f1e4e3d0.exe	84
PID 1984 wrote to memory of 2872	1984	676a194daf3604605c907330f1e4e3d0.exe	84
PID 1984 wrote to memory of 3232	1984	676a194daf3604605c907330f1e4e3d0.exe	85
PID 1984 wrote to memory of 3232	1984	676a194daf3604605c907330f1e4e3d0.exe	85
PID 1984 wrote to memory of 3904	1984	676a194daf3604605c907330f1e4e3d0.exe	86
PID 1984 wrote to memory of 3904	1984	676a194daf3604605c907330f1e4e3d0.exe	86
PID 1984 wrote to memory of 2240	1984	676a194daf3604605c907330f1e4e3d0.exe	87
PID 1984 wrote to memory of 2240	1984	676a194daf3604605c907330f1e4e3d0.exe	87
PID 1984 wrote to memory of 1852	1984	676a194daf3604605c907330f1e4e3d0.exe	88
PID 1984 wrote to memory of 1852	1984	676a194daf3604605c907330f1e4e3d0.exe	88
PID 1984 wrote to memory of 2300	1984	676a194daf3604605c907330f1e4e3d0.exe	89
PID 1984 wrote to memory of 2300	1984	676a194daf3604605c907330f1e4e3d0.exe	89
PID 1984 wrote to memory of 1680	1984	676a194daf3604605c907330f1e4e3d0.exe	90
PID 1984 wrote to memory of 1680	1984	676a194daf3604605c907330f1e4e3d0.exe	90
PID 1984 wrote to memory of 3456	1984	676a194daf3604605c907330f1e4e3d0.exe	91
PID 1984 wrote to memory of 3456	1984	676a194daf3604605c907330f1e4e3d0.exe	91
PID 1984 wrote to memory of 3052	1984	676a194daf3604605c907330f1e4e3d0.exe	93
PID 1984 wrote to memory of 3052	1984	676a194daf3604605c907330f1e4e3d0.exe	93
PID 1984 wrote to memory of 4052	1984	676a194daf3604605c907330f1e4e3d0.exe	94
PID 1984 wrote to memory of 4052	1984	676a194daf3604605c907330f1e4e3d0.exe	94
PID 1984 wrote to memory of 2000	1984	676a194daf3604605c907330f1e4e3d0.exe	95
PID 1984 wrote to memory of 2000	1984	676a194daf3604605c907330f1e4e3d0.exe	95
PID 1984 wrote to memory of 2448	1984	676a194daf3604605c907330f1e4e3d0.exe	96
PID 1984 wrote to memory of 2448	1984	676a194daf3604605c907330f1e4e3d0.exe	96
PID 1984 wrote to memory of 4716	1984	676a194daf3604605c907330f1e4e3d0.exe	97
PID 1984 wrote to memory of 4716	1984	676a194daf3604605c907330f1e4e3d0.exe	97
PID 1984 wrote to memory of 5088	1984	676a194daf3604605c907330f1e4e3d0.exe	98
PID 1984 wrote to memory of 5088	1984	676a194daf3604605c907330f1e4e3d0.exe	98
PID 1984 wrote to memory of 2508	1984	676a194daf3604605c907330f1e4e3d0.exe	99
PID 1984 wrote to memory of 2508	1984	676a194daf3604605c907330f1e4e3d0.exe	99
PID 1984 wrote to memory of 3268	1984	676a194daf3604605c907330f1e4e3d0.exe	100
PID 1984 wrote to memory of 3268	1984	676a194daf3604605c907330f1e4e3d0.exe	100
PID 1984 wrote to memory of 4692	1984	676a194daf3604605c907330f1e4e3d0.exe	101
PID 1984 wrote to memory of 4692	1984	676a194daf3604605c907330f1e4e3d0.exe	101
PID 1984 wrote to memory of 4392	1984	676a194daf3604605c907330f1e4e3d0.exe	102
PID 1984 wrote to memory of 4392	1984	676a194daf3604605c907330f1e4e3d0.exe	102
PID 1984 wrote to memory of 4504	1984	676a194daf3604605c907330f1e4e3d0.exe	103
PID 1984 wrote to memory of 4504	1984	676a194daf3604605c907330f1e4e3d0.exe	103
PID 1984 wrote to memory of 888	1984	676a194daf3604605c907330f1e4e3d0.exe	104
PID 1984 wrote to memory of 888	1984	676a194daf3604605c907330f1e4e3d0.exe	104
PID 1984 wrote to memory of 4732	1984	676a194daf3604605c907330f1e4e3d0.exe	105
PID 1984 wrote to memory of 4732	1984	676a194daf3604605c907330f1e4e3d0.exe	105
PID 1984 wrote to memory of 3704	1984	676a194daf3604605c907330f1e4e3d0.exe	106
PID 1984 wrote to memory of 3704	1984	676a194daf3604605c907330f1e4e3d0.exe	106
PID 1984 wrote to memory of 2892	1984	676a194daf3604605c907330f1e4e3d0.exe	107
PID 1984 wrote to memory of 2892	1984	676a194daf3604605c907330f1e4e3d0.exe	107
PID 1984 wrote to memory of 1808	1984	676a194daf3604605c907330f1e4e3d0.exe	108
PID 1984 wrote to memory of 1808	1984	676a194daf3604605c907330f1e4e3d0.exe	108
PID 1984 wrote to memory of 516	1984	676a194daf3604605c907330f1e4e3d0.exe	109
PID 1984 wrote to memory of 516	1984	676a194daf3604605c907330f1e4e3d0.exe	109
PID 1984 wrote to memory of 4664	1984	676a194daf3604605c907330f1e4e3d0.exe	110
PID 1984 wrote to memory of 4664	1984	676a194daf3604605c907330f1e4e3d0.exe	110
PID 1984 wrote to memory of 3164	1984	676a194daf3604605c907330f1e4e3d0.exe	111
PID 1984 wrote to memory of 3164	1984	676a194daf3604605c907330f1e4e3d0.exe	111
PID 1984 wrote to memory of 3716	1984	676a194daf3604605c907330f1e4e3d0.exe	112
PID 1984 wrote to memory of 3716	1984	676a194daf3604605c907330f1e4e3d0.exe	112
PID 1984 wrote to memory of 4896	1984	676a194daf3604605c907330f1e4e3d0.exe	113
PID 1984 wrote to memory of 4896	1984	676a194daf3604605c907330f1e4e3d0.exe	113
PID 1984 wrote to memory of 2032	1984	676a194daf3604605c907330f1e4e3d0.exe	114
PID 1984 wrote to memory of 2032	1984	676a194daf3604605c907330f1e4e3d0.exe	114
PID 1984 wrote to memory of 3632	1984	676a194daf3604605c907330f1e4e3d0.exe	115
PID 1984 wrote to memory of 3632	1984	676a194daf3604605c907330f1e4e3d0.exe	115

C:\Users\Admin\AppData\Local\Temp\676a194daf3604605c907330f1e4e3d0.exe
"C:\Users\Admin\AppData\Local\Temp\676a194daf3604605c907330f1e4e3d0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\System\ORisUZD.exe
  C:\Windows\System\ORisUZD.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\XEvDyAg.exe
  C:\Windows\System\XEvDyAg.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\dPCShkV.exe
  C:\Windows\System\dPCShkV.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\HyldJWk.exe
  C:\Windows\System\HyldJWk.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\gFEVLgY.exe
  C:\Windows\System\gFEVLgY.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\xVZpznM.exe
  C:\Windows\System\xVZpznM.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\qFSTPdi.exe
  C:\Windows\System\qFSTPdi.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\hAHekQD.exe
  C:\Windows\System\hAHekQD.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\pYuIBVA.exe
  C:\Windows\System\pYuIBVA.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\dqUajkj.exe
  C:\Windows\System\dqUajkj.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\ZooqyIR.exe
  C:\Windows\System\ZooqyIR.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\iGHeERZ.exe
  C:\Windows\System\iGHeERZ.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\qUyELUz.exe
  C:\Windows\System\qUyELUz.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\qjkTepd.exe
  C:\Windows\System\qjkTepd.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\hwkjFvg.exe
  C:\Windows\System\hwkjFvg.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\vVnUJPO.exe
  C:\Windows\System\vVnUJPO.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\kNiJbQi.exe
  C:\Windows\System\kNiJbQi.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\BHwrIJr.exe
  C:\Windows\System\BHwrIJr.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\pHdiiSY.exe
  C:\Windows\System\pHdiiSY.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\vitjlvb.exe
  C:\Windows\System\vitjlvb.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\JBRbvHu.exe
  C:\Windows\System\JBRbvHu.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\CsJPzPl.exe
  C:\Windows\System\CsJPzPl.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\HhQxhFp.exe
  C:\Windows\System\HhQxhFp.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\eCXusSZ.exe
  C:\Windows\System\eCXusSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\UyFvSFe.exe
  C:\Windows\System\UyFvSFe.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\pixypnf.exe
  C:\Windows\System\pixypnf.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\QWHPWBw.exe
  C:\Windows\System\QWHPWBw.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\cSbUGMT.exe
  C:\Windows\System\cSbUGMT.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\IDtKrAR.exe
  C:\Windows\System\IDtKrAR.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\gQjtxOQ.exe
  C:\Windows\System\gQjtxOQ.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\UIrUfjZ.exe
  C:\Windows\System\UIrUfjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\OBnsMgt.exe
  C:\Windows\System\OBnsMgt.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\RFebDUU.exe
  C:\Windows\System\RFebDUU.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\wfZCtKJ.exe
  C:\Windows\System\wfZCtKJ.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\xFDVKPU.exe
  C:\Windows\System\xFDVKPU.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\BWBOpxH.exe
  C:\Windows\System\BWBOpxH.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\keJMHJQ.exe
  C:\Windows\System\keJMHJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\XPZRwUl.exe
  C:\Windows\System\XPZRwUl.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\TaOgBQm.exe
  C:\Windows\System\TaOgBQm.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\oHWyAKt.exe
  C:\Windows\System\oHWyAKt.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\siajmJv.exe
  C:\Windows\System\siajmJv.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\lGYDxnM.exe
  C:\Windows\System\lGYDxnM.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\GNboMTT.exe
  C:\Windows\System\GNboMTT.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\pHMycUR.exe
  C:\Windows\System\pHMycUR.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\fQckNdr.exe
  C:\Windows\System\fQckNdr.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\YPkvzWO.exe
  C:\Windows\System\YPkvzWO.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\DZAFndQ.exe
  C:\Windows\System\DZAFndQ.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\itkozVd.exe
  C:\Windows\System\itkozVd.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\RyBrhWs.exe
  C:\Windows\System\RyBrhWs.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\fCbkArZ.exe
  C:\Windows\System\fCbkArZ.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\fqUwmOV.exe
  C:\Windows\System\fqUwmOV.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\wVefSXn.exe
  C:\Windows\System\wVefSXn.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\PGgnvdZ.exe
  C:\Windows\System\PGgnvdZ.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\qkWmkoo.exe
  C:\Windows\System\qkWmkoo.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\kgEmdQU.exe
  C:\Windows\System\kgEmdQU.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\ZIvgTNY.exe
  C:\Windows\System\ZIvgTNY.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\lYLfjvq.exe
  C:\Windows\System\lYLfjvq.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\epqAyxK.exe
  C:\Windows\System\epqAyxK.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\pSLdOww.exe
  C:\Windows\System\pSLdOww.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\CXdWikg.exe
  C:\Windows\System\CXdWikg.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\dCUQoBq.exe
  C:\Windows\System\dCUQoBq.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\zyqnIYI.exe
  C:\Windows\System\zyqnIYI.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\wwkBFsy.exe
  C:\Windows\System\wwkBFsy.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\LreaGIO.exe
  C:\Windows\System\LreaGIO.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\uqvIKHX.exe
  C:\Windows\System\uqvIKHX.exe
  2⤵
  PID:5076
- C:\Windows\System\XPWdIWd.exe
  C:\Windows\System\XPWdIWd.exe
  2⤵
  PID:4892
- C:\Windows\System\HvSMMIW.exe
  C:\Windows\System\HvSMMIW.exe
  2⤵
  PID:3032
- C:\Windows\System\MHOkaQM.exe
  C:\Windows\System\MHOkaQM.exe
  2⤵
  PID:5004
- C:\Windows\System\RfrqgNC.exe
  C:\Windows\System\RfrqgNC.exe
  2⤵
  PID:2192
- C:\Windows\System\hiMwaWt.exe
  C:\Windows\System\hiMwaWt.exe
  2⤵
  PID:3288
- C:\Windows\System\oMwjDGH.exe
  C:\Windows\System\oMwjDGH.exe
  2⤵
  PID:4464
- C:\Windows\System\VgpdAEI.exe
  C:\Windows\System\VgpdAEI.exe
  2⤵
  PID:3608
- C:\Windows\System\huSYJOl.exe
  C:\Windows\System\huSYJOl.exe
  2⤵
  PID:3368
- C:\Windows\System\nQQnlKo.exe
  C:\Windows\System\nQQnlKo.exe
  2⤵
  PID:2368
- C:\Windows\System\bizSqkM.exe
  C:\Windows\System\bizSqkM.exe
  2⤵
  PID:3544
- C:\Windows\System\QYiEEJq.exe
  C:\Windows\System\QYiEEJq.exe
  2⤵
  PID:4000
- C:\Windows\System\NElhIMq.exe
  C:\Windows\System\NElhIMq.exe
  2⤵
  PID:2424
- C:\Windows\System\NJWtGdi.exe
  C:\Windows\System\NJWtGdi.exe
  2⤵
  PID:1084
- C:\Windows\System\ZaAkxsQ.exe
  C:\Windows\System\ZaAkxsQ.exe
  2⤵
  PID:2652
- C:\Windows\System\IxZzYUP.exe
  C:\Windows\System\IxZzYUP.exe
  2⤵
  PID:3260
- C:\Windows\System\JYdtLrm.exe
  C:\Windows\System\JYdtLrm.exe
  2⤵
  PID:1404
- C:\Windows\System\bMPrEiQ.exe
  C:\Windows\System\bMPrEiQ.exe
  2⤵
  PID:2404
- C:\Windows\System\kzbpRET.exe
  C:\Windows\System\kzbpRET.exe
  2⤵
  PID:1684
- C:\Windows\System\bgTsWJX.exe
  C:\Windows\System\bgTsWJX.exe
  2⤵
  PID:4172
- C:\Windows\System\XEywZgH.exe
  C:\Windows\System\XEywZgH.exe
  2⤵
  PID:4876
- C:\Windows\System\pcvmRnq.exe
  C:\Windows\System\pcvmRnq.exe
  2⤵
  PID:3928
- C:\Windows\System\jTKpwMG.exe
  C:\Windows\System\jTKpwMG.exe
  2⤵
  PID:436
- C:\Windows\System\MPsLDqV.exe
  C:\Windows\System\MPsLDqV.exe
  2⤵
  PID:4132
- C:\Windows\System\igCfptj.exe
  C:\Windows\System\igCfptj.exe
  2⤵
  PID:4164
- C:\Windows\System\CrARbFu.exe
  C:\Windows\System\CrARbFu.exe
  2⤵
  PID:5096
- C:\Windows\System\dnCCGuQ.exe
  C:\Windows\System\dnCCGuQ.exe
  2⤵
  PID:2356
- C:\Windows\System\ZsWzpGN.exe
  C:\Windows\System\ZsWzpGN.exe
  2⤵
  PID:3988
- C:\Windows\System\lkcigMI.exe
  C:\Windows\System\lkcigMI.exe
  2⤵
  PID:5140
- C:\Windows\System\KNpjMdl.exe
  C:\Windows\System\KNpjMdl.exe
  2⤵
  PID:5168
- C:\Windows\System\diqYdSw.exe
  C:\Windows\System\diqYdSw.exe
  2⤵
  PID:5196
- C:\Windows\System\QZrwhpI.exe
  C:\Windows\System\QZrwhpI.exe
  2⤵
  PID:5224
- C:\Windows\System\naGcDvh.exe
  C:\Windows\System\naGcDvh.exe
  2⤵
  PID:5252
- C:\Windows\System\TAlSCJA.exe
  C:\Windows\System\TAlSCJA.exe
  2⤵
  PID:5280
- C:\Windows\System\yOcJURP.exe
  C:\Windows\System\yOcJURP.exe
  2⤵
  PID:5308
- C:\Windows\System\bnmVckT.exe
  C:\Windows\System\bnmVckT.exe
  2⤵
  PID:5336
- C:\Windows\System\Bcuoybx.exe
  C:\Windows\System\Bcuoybx.exe
  2⤵
  PID:5360
- C:\Windows\System\ZIEBVoH.exe
  C:\Windows\System\ZIEBVoH.exe
  2⤵
  PID:5388
- C:\Windows\System\dbCqhzK.exe
  C:\Windows\System\dbCqhzK.exe
  2⤵
  PID:5420
- C:\Windows\System\WsofzYP.exe
  C:\Windows\System\WsofzYP.exe
  2⤵
  PID:5444
- C:\Windows\System\bKZRqYG.exe
  C:\Windows\System\bKZRqYG.exe
  2⤵
  PID:5472
- C:\Windows\System\zPLMQxN.exe
  C:\Windows\System\zPLMQxN.exe
  2⤵
  PID:5500
- C:\Windows\System\gDssSyq.exe
  C:\Windows\System\gDssSyq.exe
  2⤵
  PID:5532
- C:\Windows\System\GvVCYbh.exe
  C:\Windows\System\GvVCYbh.exe
  2⤵
  PID:5560
- C:\Windows\System\owZHqTE.exe
  C:\Windows\System\owZHqTE.exe
  2⤵
  PID:5588
- C:\Windows\System\jGjXrSi.exe
  C:\Windows\System\jGjXrSi.exe
  2⤵
  PID:5616
- C:\Windows\System\YwQHtLw.exe
  C:\Windows\System\YwQHtLw.exe
  2⤵
  PID:5644
- C:\Windows\System\kkUPoLJ.exe
  C:\Windows\System\kkUPoLJ.exe
  2⤵
  PID:5672
- C:\Windows\System\cSQTsvo.exe
  C:\Windows\System\cSQTsvo.exe
  2⤵
  PID:5700
- C:\Windows\System\vsjdIDz.exe
  C:\Windows\System\vsjdIDz.exe
  2⤵
  PID:5728
- C:\Windows\System\AfDIEHV.exe
  C:\Windows\System\AfDIEHV.exe
  2⤵
  PID:5756
- C:\Windows\System\xjAQhVV.exe
  C:\Windows\System\xjAQhVV.exe
  2⤵
  PID:5784
- C:\Windows\System\VswjyWF.exe
  C:\Windows\System\VswjyWF.exe
  2⤵
  PID:5812
- C:\Windows\System\agzSAdh.exe
  C:\Windows\System\agzSAdh.exe
  2⤵
  PID:5836
- C:\Windows\System\YazQFGc.exe
  C:\Windows\System\YazQFGc.exe
  2⤵
  PID:5868
- C:\Windows\System\dzwvgnu.exe
  C:\Windows\System\dzwvgnu.exe
  2⤵
  PID:5892
- C:\Windows\System\LYNJLRl.exe
  C:\Windows\System\LYNJLRl.exe
  2⤵
  PID:5924
- C:\Windows\System\nFEHVIs.exe
  C:\Windows\System\nFEHVIs.exe
  2⤵
  PID:5952
- C:\Windows\System\bCldMIQ.exe
  C:\Windows\System\bCldMIQ.exe
  2⤵
  PID:5976
- C:\Windows\System\hAiXmCl.exe
  C:\Windows\System\hAiXmCl.exe
  2⤵
  PID:6008
- C:\Windows\System\UwQhbHX.exe
  C:\Windows\System\UwQhbHX.exe
  2⤵
  PID:6036
- C:\Windows\System\RtBsEuM.exe
  C:\Windows\System\RtBsEuM.exe
  2⤵
  PID:6064
- C:\Windows\System\eReyOsy.exe
  C:\Windows\System\eReyOsy.exe
  2⤵
  PID:6092
- C:\Windows\System\iXFCAEl.exe
  C:\Windows\System\iXFCAEl.exe
  2⤵
  PID:6120
- C:\Windows\System\gfemlsZ.exe
  C:\Windows\System\gfemlsZ.exe
  2⤵
  PID:2692
- C:\Windows\System\wlujJst.exe
  C:\Windows\System\wlujJst.exe
  2⤵
  PID:3036
- C:\Windows\System\jaNGZtX.exe
  C:\Windows\System\jaNGZtX.exe
  2⤵
  PID:872
- C:\Windows\System\LJHUvkR.exe
  C:\Windows\System\LJHUvkR.exe
  2⤵
  PID:4380
- C:\Windows\System\eozlUrj.exe
  C:\Windows\System\eozlUrj.exe
  2⤵
  PID:1012
- C:\Windows\System\toKNViQ.exe
  C:\Windows\System\toKNViQ.exe
  2⤵
  PID:404
- C:\Windows\System\FrVvPMe.exe
  C:\Windows\System\FrVvPMe.exe
  2⤵
  PID:5160
- C:\Windows\System\emEYOFY.exe
  C:\Windows\System\emEYOFY.exe
  2⤵
  PID:5236
- C:\Windows\System\TMmNmoL.exe
  C:\Windows\System\TMmNmoL.exe
  2⤵
  PID:5296
- C:\Windows\System\dIFXeXx.exe
  C:\Windows\System\dIFXeXx.exe
  2⤵
  PID:5356
- C:\Windows\System\RnDmpHn.exe
  C:\Windows\System\RnDmpHn.exe
  2⤵
  PID:5412
- C:\Windows\System\gStLcPZ.exe
  C:\Windows\System\gStLcPZ.exe
  2⤵
  PID:5488
- C:\Windows\System\ZGGaxYx.exe
  C:\Windows\System\ZGGaxYx.exe
  2⤵
  PID:5548
- C:\Windows\System\bqUEGYt.exe
  C:\Windows\System\bqUEGYt.exe
  2⤵
  PID:5604
- C:\Windows\System\DtkmVnB.exe
  C:\Windows\System\DtkmVnB.exe
  2⤵
  PID:5664
- C:\Windows\System\CgcOWWz.exe
  C:\Windows\System\CgcOWWz.exe
  2⤵
  PID:5740
- C:\Windows\System\WIHJsNP.exe
  C:\Windows\System\WIHJsNP.exe
  2⤵
  PID:5800
- C:\Windows\System\yDHHbwk.exe
  C:\Windows\System\yDHHbwk.exe
  2⤵
  PID:5860
- C:\Windows\System\Dinynvh.exe
  C:\Windows\System\Dinynvh.exe
  2⤵
  PID:5916
- C:\Windows\System\ObFNPsG.exe
  C:\Windows\System\ObFNPsG.exe
  2⤵
  PID:5996
- C:\Windows\System\JOBcGoD.exe
  C:\Windows\System\JOBcGoD.exe
  2⤵
  PID:6076
- C:\Windows\System\ewkuyeF.exe
  C:\Windows\System\ewkuyeF.exe
  2⤵
  PID:6132
- C:\Windows\System\eLHegZq.exe
  C:\Windows\System\eLHegZq.exe
  2⤵
  PID:1728
- C:\Windows\System\brbfwLp.exe
  C:\Windows\System\brbfwLp.exe
  2⤵
  PID:1616
- C:\Windows\System\XmCcROJ.exe
  C:\Windows\System\XmCcROJ.exe
  2⤵
  PID:5132
- C:\Windows\System\gWOBvUQ.exe
  C:\Windows\System\gWOBvUQ.exe
  2⤵
  PID:5272
- C:\Windows\System\yeztkjM.exe
  C:\Windows\System\yeztkjM.exe
  2⤵
  PID:5404
- C:\Windows\System\EaRKZfE.exe
  C:\Windows\System\EaRKZfE.exe
  2⤵
  PID:2276
- C:\Windows\System\bjsgOIv.exe
  C:\Windows\System\bjsgOIv.exe
  2⤵
  PID:5692
- C:\Windows\System\LCueUSY.exe
  C:\Windows\System\LCueUSY.exe
  2⤵
  PID:5776
- C:\Windows\System\tDcFHzN.exe
  C:\Windows\System\tDcFHzN.exe
  2⤵
  PID:5908
- C:\Windows\System\PEMksWA.exe
  C:\Windows\System\PEMksWA.exe
  2⤵
  PID:6056
- C:\Windows\System\vfZOgko.exe
  C:\Windows\System\vfZOgko.exe
  2⤵
  PID:4936
- C:\Windows\System\aGGVqVu.exe
  C:\Windows\System\aGGVqVu.exe
  2⤵
  PID:5208
- C:\Windows\System\kCjwkci.exe
  C:\Windows\System\kCjwkci.exe
  2⤵
  PID:6164
- C:\Windows\System\UEjSrJx.exe
  C:\Windows\System\UEjSrJx.exe
  2⤵
  PID:6196
- C:\Windows\System\XIBnrNb.exe
  C:\Windows\System\XIBnrNb.exe
  2⤵
  PID:6224
- C:\Windows\System\StqLTSf.exe
  C:\Windows\System\StqLTSf.exe
  2⤵
  PID:6252
- C:\Windows\System\oldymlz.exe
  C:\Windows\System\oldymlz.exe
  2⤵
  PID:6280
- C:\Windows\System\QfwzJbt.exe
  C:\Windows\System\QfwzJbt.exe
  2⤵
  PID:6308
- C:\Windows\System\piesziv.exe
  C:\Windows\System\piesziv.exe
  2⤵
  PID:6336
- C:\Windows\System\yCygmem.exe
  C:\Windows\System\yCygmem.exe
  2⤵
  PID:6364
- C:\Windows\System\LjLQCup.exe
  C:\Windows\System\LjLQCup.exe
  2⤵
  PID:6392
- C:\Windows\System\Kvyolsj.exe
  C:\Windows\System\Kvyolsj.exe
  2⤵
  PID:6420
- C:\Windows\System\OLTKlJk.exe
  C:\Windows\System\OLTKlJk.exe
  2⤵
  PID:6448
- C:\Windows\System\tJXBsnP.exe
  C:\Windows\System\tJXBsnP.exe
  2⤵
  PID:6476
- C:\Windows\System\MKThEbG.exe
  C:\Windows\System\MKThEbG.exe
  2⤵
  PID:6504
- C:\Windows\System\GlieDZN.exe
  C:\Windows\System\GlieDZN.exe
  2⤵
  PID:6532
- C:\Windows\System\KKSkfCi.exe
  C:\Windows\System\KKSkfCi.exe
  2⤵
  PID:6556
- C:\Windows\System\UgPmSTB.exe
  C:\Windows\System\UgPmSTB.exe
  2⤵
  PID:6584
- C:\Windows\System\OTrvCEi.exe
  C:\Windows\System\OTrvCEi.exe
  2⤵
  PID:6648
- C:\Windows\System\KKqCAyY.exe
  C:\Windows\System\KKqCAyY.exe
  2⤵
  PID:6672
- C:\Windows\System\HFpPNXV.exe
  C:\Windows\System\HFpPNXV.exe
  2⤵
  PID:6692
- C:\Windows\System\NMsKstQ.exe
  C:\Windows\System\NMsKstQ.exe
  2⤵
  PID:6720
- C:\Windows\System\qjOHRWa.exe
  C:\Windows\System\qjOHRWa.exe
  2⤵
  PID:6736
- C:\Windows\System\ugbFNSc.exe
  C:\Windows\System\ugbFNSc.exe
  2⤵
  PID:6756
- C:\Windows\System\rprkzWD.exe
  C:\Windows\System\rprkzWD.exe
  2⤵
  PID:6776
- C:\Windows\System\hqBGiOF.exe
  C:\Windows\System\hqBGiOF.exe
  2⤵
  PID:6792
- C:\Windows\System\JIELvtT.exe
  C:\Windows\System\JIELvtT.exe
  2⤵
  PID:6812
- C:\Windows\System\gELIeuD.exe
  C:\Windows\System\gELIeuD.exe
  2⤵
  PID:6848
- C:\Windows\System\gRByBRX.exe
  C:\Windows\System\gRByBRX.exe
  2⤵
  PID:6872
- C:\Windows\System\hpNqkOK.exe
  C:\Windows\System\hpNqkOK.exe
  2⤵
  PID:6892
- C:\Windows\System\DnMHjKP.exe
  C:\Windows\System\DnMHjKP.exe
  2⤵
  PID:6912
- C:\Windows\System\VhpVRlY.exe
  C:\Windows\System\VhpVRlY.exe
  2⤵
  PID:6948
- C:\Windows\System\VcGMAiZ.exe
  C:\Windows\System\VcGMAiZ.exe
  2⤵
  PID:6968
- C:\Windows\System\FgBUsJx.exe
  C:\Windows\System\FgBUsJx.exe
  2⤵
  PID:6984
- C:\Windows\System\ObYzxyr.exe
  C:\Windows\System\ObYzxyr.exe
  2⤵
  PID:7024
- C:\Windows\System\lGwacrk.exe
  C:\Windows\System\lGwacrk.exe
  2⤵
  PID:7052
- C:\Windows\System\kvtASpQ.exe
  C:\Windows\System\kvtASpQ.exe
  2⤵
  PID:7068
- C:\Windows\System\HJIPaVp.exe
  C:\Windows\System\HJIPaVp.exe
  2⤵
  PID:7100
- C:\Windows\System\wHqFRxW.exe
  C:\Windows\System\wHqFRxW.exe
  2⤵
  PID:7124
- C:\Windows\System\rDEVTxI.exe
  C:\Windows\System\rDEVTxI.exe
  2⤵
  PID:7152
- C:\Windows\System\gzSWjtf.exe
  C:\Windows\System\gzSWjtf.exe
  2⤵
  PID:5464
- C:\Windows\System\kyzHZNu.exe
  C:\Windows\System\kyzHZNu.exe
  2⤵
  PID:5656
- C:\Windows\System\leRNjfd.exe
  C:\Windows\System\leRNjfd.exe
  2⤵
  PID:5852
- C:\Windows\System\nBwjRYe.exe
  C:\Windows\System\nBwjRYe.exe
  2⤵
  PID:3548
- C:\Windows\System\ZitinUf.exe
  C:\Windows\System\ZitinUf.exe
  2⤵
  PID:3712
- C:\Windows\System\QjtILsd.exe
  C:\Windows\System\QjtILsd.exe
  2⤵
  PID:3440
- C:\Windows\System\nbrdGpM.exe
  C:\Windows\System\nbrdGpM.exe
  2⤵
  PID:3012
- C:\Windows\System\EgojWgT.exe
  C:\Windows\System\EgojWgT.exe
  2⤵
  PID:6244
- C:\Windows\System\UgxXGFC.exe
  C:\Windows\System\UgxXGFC.exe
  2⤵
  PID:2916
- C:\Windows\System\yEsRNiI.exe
  C:\Windows\System\yEsRNiI.exe
  2⤵
  PID:6356
- C:\Windows\System\zmInQqT.exe
  C:\Windows\System\zmInQqT.exe
  2⤵
  PID:2512
- C:\Windows\System\gNnQRGq.exe
  C:\Windows\System\gNnQRGq.exe
  2⤵
  PID:6412
- C:\Windows\System\YdBwqBH.exe
  C:\Windows\System\YdBwqBH.exe
  2⤵
  PID:6460
- C:\Windows\System\WVtrxyt.exe
  C:\Windows\System\WVtrxyt.exe
  2⤵
  PID:6488
- C:\Windows\System\AmIQAMq.exe
  C:\Windows\System\AmIQAMq.exe
  2⤵
  PID:6520
- C:\Windows\System\WxnPzDx.exe
  C:\Windows\System\WxnPzDx.exe
  2⤵
  PID:1828
- C:\Windows\System\qUxKFVy.exe
  C:\Windows\System\qUxKFVy.exe
  2⤵
  PID:6600
- C:\Windows\System\CLFXevp.exe
  C:\Windows\System\CLFXevp.exe
  2⤵
  PID:2876
- C:\Windows\System\ZYRzpsf.exe
  C:\Windows\System\ZYRzpsf.exe
  2⤵
  PID:6632
- C:\Windows\System\xBHKBid.exe
  C:\Windows\System\xBHKBid.exe
  2⤵
  PID:6708
- C:\Windows\System\BpnSokF.exe
  C:\Windows\System\BpnSokF.exe
  2⤵
  PID:6828
- C:\Windows\System\aAPDkxp.exe
  C:\Windows\System\aAPDkxp.exe
  2⤵
  PID:6808
- C:\Windows\System\TByYbZz.exe
  C:\Windows\System\TByYbZz.exe
  2⤵
  PID:6992
- C:\Windows\System\TtjGuje.exe
  C:\Windows\System\TtjGuje.exe
  2⤵
  PID:6900
- C:\Windows\System\xEIFGUo.exe
  C:\Windows\System\xEIFGUo.exe
  2⤵
  PID:7048
- C:\Windows\System\FvVvgBT.exe
  C:\Windows\System\FvVvgBT.exe
  2⤵
  PID:5972
- C:\Windows\System\OQgTLzQ.exe
  C:\Windows\System\OQgTLzQ.exe
  2⤵
  PID:7008
- C:\Windows\System\PajMzQl.exe
  C:\Windows\System\PajMzQl.exe
  2⤵
  PID:6272
- C:\Windows\System\tSutGfA.exe
  C:\Windows\System\tSutGfA.exe
  2⤵
  PID:7164
- C:\Windows\System\JiYFRmd.exe
  C:\Windows\System\JiYFRmd.exe
  2⤵
  PID:5600
- C:\Windows\System\nygiUVe.exe
  C:\Windows\System\nygiUVe.exe
  2⤵
  PID:6156
- C:\Windows\System\kIRuJpv.exe
  C:\Windows\System\kIRuJpv.exe
  2⤵
  PID:6572
- C:\Windows\System\VmAYpGG.exe
  C:\Windows\System\VmAYpGG.exe
  2⤵
  PID:6296
- C:\Windows\System\VAYLHwu.exe
  C:\Windows\System\VAYLHwu.exe
  2⤵
  PID:6880
- C:\Windows\System\XVgCNbD.exe
  C:\Windows\System\XVgCNbD.exe
  2⤵
  PID:7176
- C:\Windows\System\QveTirG.exe
  C:\Windows\System\QveTirG.exe
  2⤵
  PID:7204
- C:\Windows\System\hEynrXp.exe
  C:\Windows\System\hEynrXp.exe
  2⤵
  PID:7220
- C:\Windows\System\pNSPNPm.exe
  C:\Windows\System\pNSPNPm.exe
  2⤵
  PID:7240
- C:\Windows\System\CgeFTZG.exe
  C:\Windows\System\CgeFTZG.exe
  2⤵
  PID:7280
- C:\Windows\System\wQafxLt.exe
  C:\Windows\System\wQafxLt.exe
  2⤵
  PID:7308
- C:\Windows\System\COIyvvm.exe
  C:\Windows\System\COIyvvm.exe
  2⤵
  PID:7332
- C:\Windows\System\qiuLYjv.exe
  C:\Windows\System\qiuLYjv.exe
  2⤵
  PID:7364
- C:\Windows\System\YYtFaxi.exe
  C:\Windows\System\YYtFaxi.exe
  2⤵
  PID:7396
- C:\Windows\System\ARHBZFF.exe
  C:\Windows\System\ARHBZFF.exe
  2⤵
  PID:7416
- C:\Windows\System\rHMKewp.exe
  C:\Windows\System\rHMKewp.exe
  2⤵
  PID:7432
- C:\Windows\System\CVJEJmd.exe
  C:\Windows\System\CVJEJmd.exe
  2⤵
  PID:7472
- C:\Windows\System\XItAKMO.exe
  C:\Windows\System\XItAKMO.exe
  2⤵
  PID:7512
- C:\Windows\System\rPUmMMt.exe
  C:\Windows\System\rPUmMMt.exe
  2⤵
  PID:7548
- C:\Windows\System\hVgdsEy.exe
  C:\Windows\System\hVgdsEy.exe
  2⤵
  PID:7572
- C:\Windows\System\zGXPaFP.exe
  C:\Windows\System\zGXPaFP.exe
  2⤵
  PID:7600
- C:\Windows\System\XZhMirH.exe
  C:\Windows\System\XZhMirH.exe
  2⤵
  PID:7624
- C:\Windows\System\toXTGjr.exe
  C:\Windows\System\toXTGjr.exe
  2⤵
  PID:7660
- C:\Windows\System\VLdhybr.exe
  C:\Windows\System\VLdhybr.exe
  2⤵
  PID:7676
- C:\Windows\System\XArhUsF.exe
  C:\Windows\System\XArhUsF.exe
  2⤵
  PID:7700
- C:\Windows\System\TUOWkZe.exe
  C:\Windows\System\TUOWkZe.exe
  2⤵
  PID:7724
- C:\Windows\System\dQDroWr.exe
  C:\Windows\System\dQDroWr.exe
  2⤵
  PID:7760
- C:\Windows\System\ZpNDIuG.exe
  C:\Windows\System\ZpNDIuG.exe
  2⤵
  PID:7796
- C:\Windows\System\nOsMmrp.exe
  C:\Windows\System\nOsMmrp.exe
  2⤵
  PID:7820
- C:\Windows\System\nuWLwDn.exe
  C:\Windows\System\nuWLwDn.exe
  2⤵
  PID:7856
- C:\Windows\System\KIxsvzc.exe
  C:\Windows\System\KIxsvzc.exe
  2⤵
  PID:7892
- C:\Windows\System\Swgmvzp.exe
  C:\Windows\System\Swgmvzp.exe
  2⤵
  PID:7916
- C:\Windows\System\cetWaGL.exe
  C:\Windows\System\cetWaGL.exe
  2⤵
  PID:7936
- C:\Windows\System\RmycrUY.exe
  C:\Windows\System\RmycrUY.exe
  2⤵
  PID:7960
- C:\Windows\System\oxbSTWL.exe
  C:\Windows\System\oxbSTWL.exe
  2⤵
  PID:8000
- C:\Windows\System\HZJRxMI.exe
  C:\Windows\System\HZJRxMI.exe
  2⤵
  PID:8028
- C:\Windows\System\szQBLru.exe
  C:\Windows\System\szQBLru.exe
  2⤵
  PID:8056
- C:\Windows\System\djEfjYT.exe
  C:\Windows\System\djEfjYT.exe
  2⤵
  PID:8080
- C:\Windows\System\RfCgfmU.exe
  C:\Windows\System\RfCgfmU.exe
  2⤵
  PID:8104
- C:\Windows\System\SUWhFQl.exe
  C:\Windows\System\SUWhFQl.exe
  2⤵
  PID:8124
- C:\Windows\System\LVhKVzP.exe
  C:\Windows\System\LVhKVzP.exe
  2⤵
  PID:8156
- C:\Windows\System\nWahYwE.exe
  C:\Windows\System\nWahYwE.exe
  2⤵
  PID:4004
- C:\Windows\System\TSCMeKv.exe
  C:\Windows\System\TSCMeKv.exe
  2⤵
  PID:3416
- C:\Windows\System\GxXRkju.exe
  C:\Windows\System\GxXRkju.exe
  2⤵
  PID:6980
- C:\Windows\System\GnYHmgf.exe
  C:\Windows\System\GnYHmgf.exe
  2⤵
  PID:6840
- C:\Windows\System\ExnfHld.exe
  C:\Windows\System\ExnfHld.exe
  2⤵
  PID:6956
- C:\Windows\System\IcwLbaM.exe
  C:\Windows\System\IcwLbaM.exe
  2⤵
  PID:6216
- C:\Windows\System\EzzLNWH.exe
  C:\Windows\System\EzzLNWH.exe
  2⤵
  PID:6184
- C:\Windows\System\YVtZUlG.exe
  C:\Windows\System\YVtZUlG.exe
  2⤵
  PID:6404
- C:\Windows\System\YNMHByB.exe
  C:\Windows\System\YNMHByB.exe
  2⤵
  PID:7404
- C:\Windows\System\CNQhKAw.exe
  C:\Windows\System\CNQhKAw.exe
  2⤵
  PID:7672
- C:\Windows\System\QzIJKbU.exe
  C:\Windows\System\QzIJKbU.exe
  2⤵
  PID:7744
- C:\Windows\System\lVSgAdm.exe
  C:\Windows\System\lVSgAdm.exe
  2⤵
  PID:7840
- C:\Windows\System\kDdrdJi.exe
  C:\Windows\System\kDdrdJi.exe
  2⤵
  PID:7468
- C:\Windows\System\SrxAmTw.exe
  C:\Windows\System\SrxAmTw.exe
  2⤵
  PID:7608
- C:\Windows\System\oEXbkYX.exe
  C:\Windows\System\oEXbkYX.exe
  2⤵
  PID:7904
- C:\Windows\System\AGgkkKH.exe
  C:\Windows\System\AGgkkKH.exe
  2⤵
  PID:7776
- C:\Windows\System\MCcrrCb.exe
  C:\Windows\System\MCcrrCb.exe
  2⤵
  PID:7816
- C:\Windows\System\TQcAzsR.exe
  C:\Windows\System\TQcAzsR.exe
  2⤵
  PID:7880
- C:\Windows\System\CJLlwhC.exe
  C:\Windows\System\CJLlwhC.exe
  2⤵
  PID:8112
- C:\Windows\System\NeuxFRF.exe
  C:\Windows\System\NeuxFRF.exe
  2⤵
  PID:6764
- C:\Windows\System\RsOsliB.exe
  C:\Windows\System\RsOsliB.exe
  2⤵
  PID:7184
- C:\Windows\System\xoMnwiG.exe
  C:\Windows\System\xoMnwiG.exe
  2⤵
  PID:7016
- C:\Windows\System\wWwPwZg.exe
  C:\Windows\System\wWwPwZg.exe
  2⤵
  PID:7408
- C:\Windows\System\LkhcVEc.exe
  C:\Windows\System\LkhcVEc.exe
  2⤵
  PID:6844
- C:\Windows\System\wnOfWjP.exe
  C:\Windows\System\wnOfWjP.exe
  2⤵
  PID:5348
- C:\Windows\System\AcFkcoc.exe
  C:\Windows\System\AcFkcoc.exe
  2⤵
  PID:8212
- C:\Windows\System\XbNmDQq.exe
  C:\Windows\System\XbNmDQq.exe
  2⤵
  PID:8248
- C:\Windows\System\pzPBOSW.exe
  C:\Windows\System\pzPBOSW.exe
  2⤵
  PID:8276
- C:\Windows\System\PRekuDB.exe
  C:\Windows\System\PRekuDB.exe
  2⤵
  PID:8308
- C:\Windows\System\NgKXkZv.exe
  C:\Windows\System\NgKXkZv.exe
  2⤵
  PID:8368
- C:\Windows\System\EfsMMRk.exe
  C:\Windows\System\EfsMMRk.exe
  2⤵
  PID:8388
- C:\Windows\System\fooHTIL.exe
  C:\Windows\System\fooHTIL.exe
  2⤵
  PID:8452
- C:\Windows\System\qvlecxP.exe
  C:\Windows\System\qvlecxP.exe
  2⤵
  PID:8492
- C:\Windows\System\smLfBlt.exe
  C:\Windows\System\smLfBlt.exe
  2⤵
  PID:8532
- C:\Windows\System\FHGBoKf.exe
  C:\Windows\System\FHGBoKf.exe
  2⤵
  PID:8600
- C:\Windows\System\YDyijbA.exe
  C:\Windows\System\YDyijbA.exe
  2⤵
  PID:8648
- C:\Windows\System\TgNDMOl.exe
  C:\Windows\System\TgNDMOl.exe
  2⤵
  PID:8700
- C:\Windows\System\WLlZRmD.exe
  C:\Windows\System\WLlZRmD.exe
  2⤵
  PID:8732
- C:\Windows\System\jsFFStF.exe
  C:\Windows\System\jsFFStF.exe
  2⤵
  PID:8748
- C:\Windows\System\ZRVjqaY.exe
  C:\Windows\System\ZRVjqaY.exe
  2⤵
  PID:8788
- C:\Windows\System\XpjmLFj.exe
  C:\Windows\System\XpjmLFj.exe
  2⤵
  PID:8888
- C:\Windows\System\acThVby.exe
  C:\Windows\System\acThVby.exe
  2⤵
  PID:8904
- C:\Windows\System\bOdrZhf.exe
  C:\Windows\System\bOdrZhf.exe
  2⤵
  PID:8920
- C:\Windows\System\PYaAFkQ.exe
  C:\Windows\System\PYaAFkQ.exe
  2⤵
  PID:8968
- C:\Windows\System\DnQlvER.exe
  C:\Windows\System\DnQlvER.exe
  2⤵
  PID:8984
- C:\Windows\System\wFbsvrA.exe
  C:\Windows\System\wFbsvrA.exe
  2⤵
  PID:9000
- C:\Windows\System\yQpPWSf.exe
  C:\Windows\System\yQpPWSf.exe
  2⤵
  PID:9020
- C:\Windows\System\pECtloe.exe
  C:\Windows\System\pECtloe.exe
  2⤵
  PID:9036
- C:\Windows\System\heIuKnj.exe
  C:\Windows\System\heIuKnj.exe
  2⤵
  PID:9092
- C:\Windows\System\VymozPl.exe
  C:\Windows\System\VymozPl.exe
  2⤵
  PID:9116
- C:\Windows\System\UnPEJZY.exe
  C:\Windows\System\UnPEJZY.exe
  2⤵
  PID:9132
- C:\Windows\System\xKyrSSg.exe
  C:\Windows\System\xKyrSSg.exe
  2⤵
  PID:9152
- C:\Windows\System\EjlehEP.exe
  C:\Windows\System\EjlehEP.exe
  2⤵
  PID:9196
- C:\Windows\System\tmVHCVa.exe
  C:\Windows\System\tmVHCVa.exe
  2⤵
  PID:7316
- C:\Windows\System\xrCfqdx.exe
  C:\Windows\System\xrCfqdx.exe
  2⤵
  PID:7384
- C:\Windows\System\fDyawab.exe
  C:\Windows\System\fDyawab.exe
  2⤵
  PID:7712
- C:\Windows\System\Spukxhs.exe
  C:\Windows\System\Spukxhs.exe
  2⤵
  PID:8168
- C:\Windows\System\fpTGlzO.exe
  C:\Windows\System\fpTGlzO.exe
  2⤵
  PID:7060
- C:\Windows\System\REYFfpn.exe
  C:\Windows\System\REYFfpn.exe
  2⤵
  PID:6864
- C:\Windows\System\MBePsdS.exe
  C:\Windows\System\MBePsdS.exe
  2⤵
  PID:8196
- C:\Windows\System\ZaZBOwd.exe
  C:\Windows\System\ZaZBOwd.exe
  2⤵
  PID:8232
- C:\Windows\System\NSAuxHY.exe
  C:\Windows\System\NSAuxHY.exe
  2⤵
  PID:8300
- C:\Windows\System\zQMzFVH.exe
  C:\Windows\System\zQMzFVH.exe
  2⤵
  PID:8396
- C:\Windows\System\ZruErjG.exe
  C:\Windows\System\ZruErjG.exe
  2⤵
  PID:8480
- C:\Windows\System\VsgbedC.exe
  C:\Windows\System\VsgbedC.exe
  2⤵
  PID:8556
- C:\Windows\System\DDGUzMS.exe
  C:\Windows\System\DDGUzMS.exe
  2⤵
  PID:8624
- C:\Windows\System\SFhJvLA.exe
  C:\Windows\System\SFhJvLA.exe
  2⤵
  PID:8636
- C:\Windows\System\eZtENOe.exe
  C:\Windows\System\eZtENOe.exe
  2⤵
  PID:8744
- C:\Windows\System\FFAyhci.exe
  C:\Windows\System\FFAyhci.exe
  2⤵
  PID:8824
- C:\Windows\System\PzFMbgz.exe
  C:\Windows\System\PzFMbgz.exe
  2⤵
  PID:8912
- C:\Windows\System\IaSIaDq.exe
  C:\Windows\System\IaSIaDq.exe
  2⤵
  PID:8992
- C:\Windows\System\Nplcjie.exe
  C:\Windows\System\Nplcjie.exe
  2⤵
  PID:6612
- C:\Windows\System\HBMsrpV.exe
  C:\Windows\System\HBMsrpV.exe
  2⤵
  PID:9112
- C:\Windows\System\GvYHqVj.exe
  C:\Windows\System\GvYHqVj.exe
  2⤵
  PID:9180
- C:\Windows\System\pxzacKv.exe
  C:\Windows\System\pxzacKv.exe
  2⤵
  PID:7428
- C:\Windows\System\QmwgIYn.exe
  C:\Windows\System\QmwgIYn.exe
  2⤵
  PID:7808
- C:\Windows\System\TtLYYul.exe
  C:\Windows\System\TtLYYul.exe
  2⤵
  PID:5084
- C:\Windows\System\pKfGTOg.exe
  C:\Windows\System\pKfGTOg.exe
  2⤵
  PID:8184
- C:\Windows\System\sKECnMM.exe
  C:\Windows\System\sKECnMM.exe
  2⤵
  PID:8260
- C:\Windows\System\FfsDuBf.exe
  C:\Windows\System\FfsDuBf.exe
  2⤵
  PID:8432
- C:\Windows\System\LklQvBh.exe
  C:\Windows\System\LklQvBh.exe
  2⤵
  PID:8444
- C:\Windows\System\cRGQvFD.exe
  C:\Windows\System\cRGQvFD.exe
  2⤵
  PID:8776
- C:\Windows\System\OOuanpR.exe
  C:\Windows\System\OOuanpR.exe
  2⤵
  PID:8980
- C:\Windows\System\ujYFlNm.exe
  C:\Windows\System\ujYFlNm.exe
  2⤵
  PID:9076
- C:\Windows\System\sCSValD.exe
  C:\Windows\System\sCSValD.exe
  2⤵
  PID:7288
- C:\Windows\System\hGfXtqp.exe
  C:\Windows\System\hGfXtqp.exe
  2⤵
  PID:7640
- C:\Windows\System\XkETdzQ.exe
  C:\Windows\System\XkETdzQ.exe
  2⤵
  PID:8332
- C:\Windows\System\gFGtoYl.exe
  C:\Windows\System\gFGtoYl.exe
  2⤵
  PID:8740
- C:\Windows\System\jpIShTe.exe
  C:\Windows\System\jpIShTe.exe
  2⤵
  PID:9100
- C:\Windows\System\NSFWpDd.exe
  C:\Windows\System\NSFWpDd.exe
  2⤵
  PID:6704
- C:\Windows\System\RbVsFYY.exe
  C:\Windows\System\RbVsFYY.exe
  2⤵
  PID:8840
- C:\Windows\System\eNYyMUG.exe
  C:\Windows\System\eNYyMUG.exe
  2⤵
  PID:7120
- C:\Windows\System\HjGpeTW.exe
  C:\Windows\System\HjGpeTW.exe
  2⤵
  PID:9236
- C:\Windows\System\NhOvbMS.exe
  C:\Windows\System\NhOvbMS.exe
  2⤵
  PID:9264
- C:\Windows\System\oErDjrQ.exe
  C:\Windows\System\oErDjrQ.exe
  2⤵
  PID:9292
- C:\Windows\System\EIykyYx.exe
  C:\Windows\System\EIykyYx.exe
  2⤵
  PID:9320
- C:\Windows\System\FqjgMkm.exe
  C:\Windows\System\FqjgMkm.exe
  2⤵
  PID:9348
- C:\Windows\System\wJdXYzo.exe
  C:\Windows\System\wJdXYzo.exe
  2⤵
  PID:9368
- C:\Windows\System\mDkmZjW.exe
  C:\Windows\System\mDkmZjW.exe
  2⤵
  PID:9392
- C:\Windows\System\bBAkWDZ.exe
  C:\Windows\System\bBAkWDZ.exe
  2⤵
  PID:9408
- C:\Windows\System\fZXvljN.exe
  C:\Windows\System\fZXvljN.exe
  2⤵
  PID:9460
- C:\Windows\System\uqNbblY.exe
  C:\Windows\System\uqNbblY.exe
  2⤵
  PID:9480
- C:\Windows\System\XuHOBGo.exe
  C:\Windows\System\XuHOBGo.exe
  2⤵
  PID:9504
- C:\Windows\System\wydacso.exe
  C:\Windows\System\wydacso.exe
  2⤵
  PID:9520
- C:\Windows\System\RbRBlfe.exe
  C:\Windows\System\RbRBlfe.exe
  2⤵
  PID:9548
- C:\Windows\System\IXnFtqD.exe
  C:\Windows\System\IXnFtqD.exe
  2⤵
  PID:9580
- C:\Windows\System\XSqCjkZ.exe
  C:\Windows\System\XSqCjkZ.exe
  2⤵
  PID:9604
- C:\Windows\System\qovMvHQ.exe
  C:\Windows\System\qovMvHQ.exe
  2⤵
  PID:9632
- C:\Windows\System\ikgcjBk.exe
  C:\Windows\System\ikgcjBk.exe
  2⤵
  PID:9672
- C:\Windows\System\jqWRxir.exe
  C:\Windows\System\jqWRxir.exe
  2⤵
  PID:9704
- C:\Windows\System\UOUlAUC.exe
  C:\Windows\System\UOUlAUC.exe
  2⤵
  PID:9728
- C:\Windows\System\doMWfuV.exe
  C:\Windows\System\doMWfuV.exe
  2⤵
  PID:9756
- C:\Windows\System\WYRQFLB.exe
  C:\Windows\System\WYRQFLB.exe
  2⤵
  PID:9784
- C:\Windows\System\GbPgjUn.exe
  C:\Windows\System\GbPgjUn.exe
  2⤵
  PID:9812
- C:\Windows\System\xcqKuOt.exe
  C:\Windows\System\xcqKuOt.exe
  2⤵
  PID:9852
- C:\Windows\System\IwxhqkP.exe
  C:\Windows\System\IwxhqkP.exe
  2⤵
  PID:9880
- C:\Windows\System\meeMxdW.exe
  C:\Windows\System\meeMxdW.exe
  2⤵
  PID:9908
- C:\Windows\System\zAMwJGe.exe
  C:\Windows\System\zAMwJGe.exe
  2⤵
  PID:9928
- C:\Windows\System\xMILxTN.exe
  C:\Windows\System\xMILxTN.exe
  2⤵
  PID:9964
- C:\Windows\System\pNLHifZ.exe
  C:\Windows\System\pNLHifZ.exe
  2⤵
  PID:9992
- C:\Windows\System\ttOZgYt.exe
  C:\Windows\System\ttOZgYt.exe
  2⤵
  PID:10008
- C:\Windows\System\OkUZWoV.exe
  C:\Windows\System\OkUZWoV.exe
  2⤵
  PID:10036
- C:\Windows\System\mqqCCFo.exe
  C:\Windows\System\mqqCCFo.exe
  2⤵
  PID:10056
- C:\Windows\System\dGZnrnV.exe
  C:\Windows\System\dGZnrnV.exe
  2⤵
  PID:10092
- C:\Windows\System\yLcxTYq.exe
  C:\Windows\System\yLcxTYq.exe
  2⤵
  PID:10136
- C:\Windows\System\EExuYlu.exe
  C:\Windows\System\EExuYlu.exe
  2⤵
  PID:10164
- C:\Windows\System\dykEsZs.exe
  C:\Windows\System\dykEsZs.exe
  2⤵
  PID:10180
- C:\Windows\System\ORmcSqP.exe
  C:\Windows\System\ORmcSqP.exe
  2⤵
  PID:10208
- C:\Windows\System\trqtlJy.exe
  C:\Windows\System\trqtlJy.exe
  2⤵
  PID:9220
- C:\Windows\System\rqojUqp.exe
  C:\Windows\System\rqojUqp.exe
  2⤵
  PID:9284
- C:\Windows\System\RBuiamc.exe
  C:\Windows\System\RBuiamc.exe
  2⤵
  PID:9316
- C:\Windows\System\kJvPPtJ.exe
  C:\Windows\System\kJvPPtJ.exe
  2⤵
  PID:9376
- C:\Windows\System\rMWMZrj.exe
  C:\Windows\System\rMWMZrj.exe
  2⤵
  PID:9452
- C:\Windows\System\UGyWSUk.exe
  C:\Windows\System\UGyWSUk.exe
  2⤵
  PID:9516
- C:\Windows\System\xsgpCkl.exe
  C:\Windows\System\xsgpCkl.exe
  2⤵
  PID:9616
- C:\Windows\System\xGVtzQL.exe
  C:\Windows\System\xGVtzQL.exe
  2⤵
  PID:9648
- C:\Windows\System\FwcZBHS.exe
  C:\Windows\System\FwcZBHS.exe
  2⤵
  PID:9740
- C:\Windows\System\ULlXmmu.exe
  C:\Windows\System\ULlXmmu.exe
  2⤵
  PID:9800
- C:\Windows\System\UklXqss.exe
  C:\Windows\System\UklXqss.exe
  2⤵
  PID:9868
- C:\Windows\System\xasMbHL.exe
  C:\Windows\System\xasMbHL.exe
  2⤵
  PID:9896
- C:\Windows\System\AJODZsr.exe
  C:\Windows\System\AJODZsr.exe
  2⤵
  PID:9960
- C:\Windows\System\ONoWBXS.exe
  C:\Windows\System\ONoWBXS.exe
  2⤵
  PID:10028
- C:\Windows\System\kmTSIJF.exe
  C:\Windows\System\kmTSIJF.exe
  2⤵
  PID:10084
- C:\Windows\System\MxQjIvg.exe
  C:\Windows\System\MxQjIvg.exe
  2⤵
  PID:10148
- C:\Windows\System\KOaqoqs.exe
  C:\Windows\System\KOaqoqs.exe
  2⤵
  PID:9248
- C:\Windows\System\JMeUZyF.exe
  C:\Windows\System\JMeUZyF.exe
  2⤵
  PID:9304
- C:\Windows\System\cIIcLLa.exe
  C:\Windows\System\cIIcLLa.exe
  2⤵
  PID:9496
- C:\Windows\System\QSYNgCW.exe
  C:\Windows\System\QSYNgCW.exe
  2⤵
  PID:9596
- C:\Windows\System\IngRRoA.exe
  C:\Windows\System\IngRRoA.exe
  2⤵
  PID:9776
- C:\Windows\System\tcLsDPN.exe
  C:\Windows\System\tcLsDPN.exe
  2⤵
  PID:9836
- C:\Windows\System\jYuHltY.exe
  C:\Windows\System\jYuHltY.exe
  2⤵
  PID:10020
- C:\Windows\System\HjSLxyX.exe
  C:\Windows\System\HjSLxyX.exe
  2⤵
  PID:10160
- C:\Windows\System\iOuKUte.exe
  C:\Windows\System\iOuKUte.exe
  2⤵
  PID:9400
- C:\Windows\System\iVMWGqR.exe
  C:\Windows\System\iVMWGqR.exe
  2⤵
  PID:9724
- C:\Windows\System\tUiwlPE.exe
  C:\Windows\System\tUiwlPE.exe
  2⤵
  PID:9468
- C:\Windows\System\vkGbQSh.exe
  C:\Windows\System\vkGbQSh.exe
  2⤵
  PID:10000
- C:\Windows\System\dHzdpoc.exe
  C:\Windows\System\dHzdpoc.exe
  2⤵
  PID:10252
- C:\Windows\System\rBhOWaz.exe
  C:\Windows\System\rBhOWaz.exe
  2⤵
  PID:10280
- C:\Windows\System\sYLqRyv.exe
  C:\Windows\System\sYLqRyv.exe
  2⤵
  PID:10308
- C:\Windows\System\ogICBaB.exe
  C:\Windows\System\ogICBaB.exe
  2⤵
  PID:10348
- C:\Windows\System\jNFvFBS.exe
  C:\Windows\System\jNFvFBS.exe
  2⤵
  PID:10428
- C:\Windows\System\QfSJatK.exe
  C:\Windows\System\QfSJatK.exe
  2⤵
  PID:10444
- C:\Windows\System\WgJvqeW.exe
  C:\Windows\System\WgJvqeW.exe
  2⤵
  PID:10472
- C:\Windows\System\PqDyDXd.exe
  C:\Windows\System\PqDyDXd.exe
  2⤵
  PID:10500
- C:\Windows\System\nltXdgL.exe
  C:\Windows\System\nltXdgL.exe
  2⤵
  PID:10528
- C:\Windows\System\tFOJxiF.exe
  C:\Windows\System\tFOJxiF.exe
  2⤵
  PID:10564
- C:\Windows\System\RHHPujO.exe
  C:\Windows\System\RHHPujO.exe
  2⤵
  PID:10580
- C:\Windows\System\ZqhnCsO.exe
  C:\Windows\System\ZqhnCsO.exe
  2⤵
  PID:10608
- C:\Windows\System\eFWJwwa.exe
  C:\Windows\System\eFWJwwa.exe
  2⤵
  PID:10636
- C:\Windows\System\MMZfwBz.exe
  C:\Windows\System\MMZfwBz.exe
  2⤵
  PID:10676
- C:\Windows\System\lfuGtEF.exe
  C:\Windows\System\lfuGtEF.exe
  2⤵
  PID:10704
- C:\Windows\System\nHiTfOE.exe
  C:\Windows\System\nHiTfOE.exe
  2⤵
  PID:10720
- C:\Windows\System\TzaPFbq.exe
  C:\Windows\System\TzaPFbq.exe
  2⤵
  PID:10748
- C:\Windows\System\oONXUKo.exe
  C:\Windows\System\oONXUKo.exe
  2⤵
  PID:10764
- C:\Windows\System\bjsRcrp.exe
  C:\Windows\System\bjsRcrp.exe
  2⤵
  PID:10780
- C:\Windows\System\ncSpVPB.exe
  C:\Windows\System\ncSpVPB.exe
  2⤵
  PID:10832
- C:\Windows\System\CyiKFaR.exe
  C:\Windows\System\CyiKFaR.exe
  2⤵
  PID:10872
- C:\Windows\System\gNSUPap.exe
  C:\Windows\System\gNSUPap.exe
  2⤵
  PID:10896
- C:\Windows\System\YGjpoBy.exe
  C:\Windows\System\YGjpoBy.exe
  2⤵
  PID:10912
- C:\Windows\System\QpSKXSl.exe
  C:\Windows\System\QpSKXSl.exe
  2⤵
  PID:10932
- C:\Windows\System\UYAmLCo.exe
  C:\Windows\System\UYAmLCo.exe
  2⤵
  PID:10952
- C:\Windows\System\TOfeClz.exe
  C:\Windows\System\TOfeClz.exe
  2⤵
  PID:10976
- C:\Windows\System\RQdGhNJ.exe
  C:\Windows\System\RQdGhNJ.exe
  2⤵
  PID:11000
- C:\Windows\System\aropVms.exe
  C:\Windows\System\aropVms.exe
  2⤵
  PID:11040
- C:\Windows\System\elaPQlc.exe
  C:\Windows\System\elaPQlc.exe
  2⤵
  PID:11080
- C:\Windows\System\VlvrtNr.exe
  C:\Windows\System\VlvrtNr.exe
  2⤵
  PID:11112
- C:\Windows\System\JtEJGeb.exe
  C:\Windows\System\JtEJGeb.exe
  2⤵
  PID:11148
- C:\Windows\System\vNGjxNI.exe
  C:\Windows\System\vNGjxNI.exe
  2⤵
  PID:11200
- C:\Windows\System\YnEwPFD.exe
  C:\Windows\System\YnEwPFD.exe
  2⤵
  PID:11224
- C:\Windows\System\KnOXcax.exe
  C:\Windows\System\KnOXcax.exe
  2⤵
  PID:11240
- C:\Windows\System\guBRVmA.exe
  C:\Windows\System\guBRVmA.exe
  2⤵
  PID:9564
- C:\Windows\System\pTJMyXm.exe
  C:\Windows\System\pTJMyXm.exe
  2⤵
  PID:10268
- C:\Windows\System\wOAVtvz.exe
  C:\Windows\System\wOAVtvz.exe
  2⤵
  PID:10340
- C:\Windows\System\gSDNzkn.exe
  C:\Windows\System\gSDNzkn.exe
  2⤵
  PID:10436
- C:\Windows\System\OWHJWGN.exe
  C:\Windows\System\OWHJWGN.exe
  2⤵
  PID:10556
- C:\Windows\System\WyTHzvX.exe
  C:\Windows\System\WyTHzvX.exe
  2⤵
  PID:10600
- C:\Windows\System\mpSJEOE.exe
  C:\Windows\System\mpSJEOE.exe
  2⤵
  PID:10692
- C:\Windows\System\YxedHHv.exe
  C:\Windows\System\YxedHHv.exe
  2⤵
  PID:10732
- C:\Windows\System\SkrlUGk.exe
  C:\Windows\System\SkrlUGk.exe
  2⤵
  PID:10820
- C:\Windows\System\nrwuchV.exe
  C:\Windows\System\nrwuchV.exe
  2⤵
  PID:10856
- C:\Windows\System\JsrXYDm.exe
  C:\Windows\System\JsrXYDm.exe
  2⤵
  PID:10924
- C:\Windows\System\RBvvInU.exe
  C:\Windows\System\RBvvInU.exe
  2⤵
  PID:10996
- C:\Windows\System\ubPKBgf.exe
  C:\Windows\System\ubPKBgf.exe
  2⤵
  PID:11072
- C:\Windows\System\FrePwfX.exe
  C:\Windows\System\FrePwfX.exe
  2⤵
  PID:11124
- C:\Windows\System\lDyVglB.exe
  C:\Windows\System\lDyVglB.exe
  2⤵
  PID:11164
- C:\Windows\System\GDFPEOi.exe
  C:\Windows\System\GDFPEOi.exe
  2⤵
  PID:10320
- C:\Windows\System\JHEAMuG.exe
  C:\Windows\System\JHEAMuG.exe
  2⤵
  PID:10464
- C:\Windows\System\yPAUjyr.exe
  C:\Windows\System\yPAUjyr.exe
  2⤵
  PID:10592
- C:\Windows\System\uwLJyWh.exe
  C:\Windows\System\uwLJyWh.exe
  2⤵
  PID:10796
- C:\Windows\System\XZADFfC.exe
  C:\Windows\System\XZADFfC.exe
  2⤵
  PID:10904
- C:\Windows\System\dJlMXvN.exe
  C:\Windows\System\dJlMXvN.exe
  2⤵
  PID:11068
- C:\Windows\System\WwigFKe.exe
  C:\Windows\System\WwigFKe.exe
  2⤵
  PID:11236
- C:\Windows\System\xFnUbfE.exe
  C:\Windows\System\xFnUbfE.exe
  2⤵
  PID:10940
- C:\Windows\System\qOySaXf.exe
  C:\Windows\System\qOySaXf.exe
  2⤵
  PID:11136
- C:\Windows\System\MvliXvL.exe
  C:\Windows\System\MvliXvL.exe
  2⤵
  PID:10264
- C:\Windows\System\pRrqOXn.exe
  C:\Windows\System\pRrqOXn.exe
  2⤵
  PID:11248
- C:\Windows\System\fkDeIpH.exe
  C:\Windows\System\fkDeIpH.exe
  2⤵
  PID:11292
- C:\Windows\System\svYeoJF.exe
  C:\Windows\System\svYeoJF.exe
  2⤵
  PID:11324
- C:\Windows\System\TZithzt.exe
  C:\Windows\System\TZithzt.exe
  2⤵
  PID:11340
- C:\Windows\System\FCyiAcQ.exe
  C:\Windows\System\FCyiAcQ.exe
  2⤵
  PID:11368
- C:\Windows\System\vuSYOsg.exe
  C:\Windows\System\vuSYOsg.exe
  2⤵
  PID:11396
- C:\Windows\System\AWUxumJ.exe
  C:\Windows\System\AWUxumJ.exe
  2⤵
  PID:11436
- C:\Windows\System\NBZYWNp.exe
  C:\Windows\System\NBZYWNp.exe
  2⤵
  PID:11452
- C:\Windows\System\PIGyZqa.exe
  C:\Windows\System\PIGyZqa.exe
  2⤵
  PID:11480
- C:\Windows\System\gYmfTfV.exe
  C:\Windows\System\gYmfTfV.exe
  2⤵
  PID:11496
- C:\Windows\System\uvMbuEo.exe
  C:\Windows\System\uvMbuEo.exe
  2⤵
  PID:11528
- C:\Windows\System\poxGRkk.exe
  C:\Windows\System\poxGRkk.exe
  2⤵
  PID:11560
- C:\Windows\System\nlQqjQG.exe
  C:\Windows\System\nlQqjQG.exe
  2⤵
  PID:11588
- C:\Windows\System\QnuevBe.exe
  C:\Windows\System\QnuevBe.exe
  2⤵
  PID:11612
- C:\Windows\System\mleNIGV.exe
  C:\Windows\System\mleNIGV.exe
  2⤵
  PID:11648
- C:\Windows\System\aGRyRxd.exe
  C:\Windows\System\aGRyRxd.exe
  2⤵
  PID:11676
- C:\Windows\System\AnQtpGN.exe
  C:\Windows\System\AnQtpGN.exe
  2⤵
  PID:11704
- C:\Windows\System\WKXiHXt.exe
  C:\Windows\System\WKXiHXt.exe
  2⤵
  PID:11744
- C:\Windows\System\wrQMOwD.exe
  C:\Windows\System\wrQMOwD.exe
  2⤵
  PID:11772
- C:\Windows\System\OcCzRfn.exe
  C:\Windows\System\OcCzRfn.exe
  2⤵
  PID:11788
- C:\Windows\System\UTzCaNQ.exe
  C:\Windows\System\UTzCaNQ.exe
  2⤵
  PID:11828
- C:\Windows\System\soSpKkD.exe
  C:\Windows\System\soSpKkD.exe
  2⤵
  PID:11856
- C:\Windows\System\HHYjzgj.exe
  C:\Windows\System\HHYjzgj.exe
  2⤵
  PID:11884
- C:\Windows\System\CClhIFT.exe
  C:\Windows\System\CClhIFT.exe
  2⤵
  PID:11912
- C:\Windows\System\IEPIElv.exe
  C:\Windows\System\IEPIElv.exe
  2⤵
  PID:11928
- C:\Windows\System\cIWWxmn.exe
  C:\Windows\System\cIWWxmn.exe
  2⤵
  PID:11968
- C:\Windows\System\aZqyBLK.exe
  C:\Windows\System\aZqyBLK.exe
  2⤵
  PID:11984
- C:\Windows\System\vXFxfWS.exe
  C:\Windows\System\vXFxfWS.exe
  2⤵
  PID:12012
- C:\Windows\System\dLQWUNX.exe
  C:\Windows\System\dLQWUNX.exe
  2⤵
  PID:12056
- C:\Windows\System\DfMycrT.exe
  C:\Windows\System\DfMycrT.exe
  2⤵
  PID:12084
- C:\Windows\System\SECZvSa.exe
  C:\Windows\System\SECZvSa.exe
  2⤵
  PID:12100
- C:\Windows\System\StLptoE.exe
  C:\Windows\System\StLptoE.exe
  2⤵
  PID:12124
- C:\Windows\System\BJMkEoF.exe
  C:\Windows\System\BJMkEoF.exe
  2⤵
  PID:12160
- C:\Windows\System\HQxjYhk.exe
  C:\Windows\System\HQxjYhk.exe
  2⤵
  PID:12176
- C:\Windows\System\ZwgoTOV.exe
  C:\Windows\System\ZwgoTOV.exe
  2⤵
  PID:12204
- C:\Windows\System\XsqYGiP.exe
  C:\Windows\System\XsqYGiP.exe
  2⤵
  PID:12256
- C:\Windows\System\JRRaRPX.exe
  C:\Windows\System\JRRaRPX.exe
  2⤵
  PID:12284
- C:\Windows\System\ygGbaBA.exe
  C:\Windows\System\ygGbaBA.exe
  2⤵
  PID:11276
- C:\Windows\System\CuugAFa.exe
  C:\Windows\System\CuugAFa.exe
  2⤵
  PID:11332
- C:\Windows\System\nZwYZal.exe
  C:\Windows\System\nZwYZal.exe
  2⤵
  PID:11416
- C:\Windows\System\DFFaKea.exe
  C:\Windows\System\DFFaKea.exe
  2⤵
  PID:11516
- C:\Windows\System\eZZuhzq.exe
  C:\Windows\System\eZZuhzq.exe
  2⤵
  PID:11552
- C:\Windows\System\thkKEbx.exe
  C:\Windows\System\thkKEbx.exe
  2⤵
  PID:11608
- C:\Windows\System\CvbkDUo.exe
  C:\Windows\System\CvbkDUo.exe
  2⤵
  PID:11692
- C:\Windows\System\gmZZaFJ.exe
  C:\Windows\System\gmZZaFJ.exe
  2⤵
  PID:11764
- C:\Windows\System\FAHFaRM.exe
  C:\Windows\System\FAHFaRM.exe
  2⤵
  PID:11820
- C:\Windows\System\bAFVcnj.exe
  C:\Windows\System\bAFVcnj.exe
  2⤵
  PID:11908
- C:\Windows\System\VWjpxvC.exe
  C:\Windows\System\VWjpxvC.exe
  2⤵
  PID:10960
- C:\Windows\System\UMzFCYm.exe
  C:\Windows\System\UMzFCYm.exe
  2⤵
  PID:11996
- C:\Windows\System\QgafwUv.exe
  C:\Windows\System\QgafwUv.exe
  2⤵
  PID:12112
- C:\Windows\System\YSLWNMi.exe
  C:\Windows\System\YSLWNMi.exe
  2⤵
  PID:12172
- C:\Windows\System\vShNYWn.exe
  C:\Windows\System\vShNYWn.exe
  2⤵
  PID:12248
- C:\Windows\System\XihRUyb.exe
  C:\Windows\System\XihRUyb.exe
  2⤵
  PID:12272
- C:\Windows\System\qDZSuHS.exe
  C:\Windows\System\qDZSuHS.exe
  2⤵
  PID:11472
- C:\Windows\System\FilFjMr.exe
  C:\Windows\System\FilFjMr.exe
  2⤵
  PID:11572
- C:\Windows\System\iDzNPaS.exe
  C:\Windows\System\iDzNPaS.exe
  2⤵
  PID:11632
- C:\Windows\System\OBnaKAM.exe
  C:\Windows\System\OBnaKAM.exe
  2⤵
  PID:11840
- C:\Windows\System\mmrVIrL.exe
  C:\Windows\System\mmrVIrL.exe
  2⤵
  PID:12136
- C:\Windows\System\OVfpldr.exe
  C:\Windows\System\OVfpldr.exe
  2⤵
  PID:12212
- C:\Windows\System\tjrQsFR.exe
  C:\Windows\System\tjrQsFR.exe
  2⤵
  PID:11412
- C:\Windows\System\UrlGAeS.exe
  C:\Windows\System\UrlGAeS.exe
  2⤵
  PID:11600
- C:\Windows\System\KmMaLXQ.exe
  C:\Windows\System\KmMaLXQ.exe
  2⤵
  PID:11964
- C:\Windows\System\fIBKZZH.exe
  C:\Windows\System\fIBKZZH.exe
  2⤵
  PID:11388
- C:\Windows\System\FrmgTem.exe
  C:\Windows\System\FrmgTem.exe
  2⤵
  PID:11784
- C:\Windows\System\Knbmnml.exe
  C:\Windows\System\Knbmnml.exe
  2⤵
  PID:12316
- C:\Windows\System\quIYZIP.exe
  C:\Windows\System\quIYZIP.exe
  2⤵
  PID:12344
- C:\Windows\System\yjFwCQB.exe
  C:\Windows\System\yjFwCQB.exe
  2⤵
  PID:12388
- C:\Windows\System\IGZneGY.exe
  C:\Windows\System\IGZneGY.exe
  2⤵
  PID:12404
- C:\Windows\System\HGAZBCi.exe
  C:\Windows\System\HGAZBCi.exe
  2⤵
  PID:12424
- C:\Windows\System\FSjaKVp.exe
  C:\Windows\System\FSjaKVp.exe
  2⤵
  PID:12456
- C:\Windows\System\nvOVysM.exe
  C:\Windows\System\nvOVysM.exe
  2⤵
  PID:12476
- C:\Windows\System\fNtNlrL.exe
  C:\Windows\System\fNtNlrL.exe
  2⤵
  PID:12504
- C:\Windows\System\IgnGlgB.exe
  C:\Windows\System\IgnGlgB.exe
  2⤵
  PID:12532
- C:\Windows\System\THDYakI.exe
  C:\Windows\System\THDYakI.exe
  2⤵
  PID:12572
- C:\Windows\System\jlDMpOm.exe
  C:\Windows\System\jlDMpOm.exe
  2⤵
  PID:12600
- C:\Windows\System\mpxmMEU.exe
  C:\Windows\System\mpxmMEU.exe
  2⤵
  PID:12632
- C:\Windows\System\gurSBkB.exe
  C:\Windows\System\gurSBkB.exe
  2⤵
  PID:12656
- C:\Windows\System\VzgzEXI.exe
  C:\Windows\System\VzgzEXI.exe
  2⤵
  PID:12684
- C:\Windows\System\fQNaHbG.exe
  C:\Windows\System\fQNaHbG.exe
  2⤵
  PID:12712
- C:\Windows\System\FTclIeH.exe
  C:\Windows\System\FTclIeH.exe
  2⤵
  PID:12740
- C:\Windows\System\qMOpJSa.exe
  C:\Windows\System\qMOpJSa.exe
  2⤵
  PID:12768
- C:\Windows\System\YEskPMI.exe
  C:\Windows\System\YEskPMI.exe
  2⤵
  PID:12796
- C:\Windows\System\VJFdWkX.exe
  C:\Windows\System\VJFdWkX.exe
  2⤵
  PID:12816
- C:\Windows\System\ChVdcgq.exe
  C:\Windows\System\ChVdcgq.exe
  2⤵
  PID:12852
- C:\Windows\System\eRtLPVY.exe
  C:\Windows\System\eRtLPVY.exe
  2⤵
  PID:12880
- C:\Windows\System\ubnSqKx.exe
  C:\Windows\System\ubnSqKx.exe
  2⤵
  PID:12908
- C:\Windows\System\douPilv.exe
  C:\Windows\System\douPilv.exe
  2⤵
  PID:12924
- C:\Windows\System\mnIodMK.exe
  C:\Windows\System\mnIodMK.exe
  2⤵
  PID:12964
- C:\Windows\System\QYAFcCS.exe
  C:\Windows\System\QYAFcCS.exe
  2⤵
  PID:12996
- C:\Windows\System\pmiqJQq.exe
  C:\Windows\System\pmiqJQq.exe
  2⤵
  PID:13032
- C:\Windows\System\hUwEJZX.exe
  C:\Windows\System\hUwEJZX.exe
  2⤵
  PID:13048
- C:\Windows\System\PJuWepH.exe
  C:\Windows\System\PJuWepH.exe
  2⤵
  PID:13072
- C:\Windows\System\aYUqbHF.exe
  C:\Windows\System\aYUqbHF.exe
  2⤵
  PID:13092
- C:\Windows\System\fxGOYFR.exe
  C:\Windows\System\fxGOYFR.exe
  2⤵
  PID:13132
- C:\Windows\System\MuZtEZO.exe
  C:\Windows\System\MuZtEZO.exe
  2⤵
  PID:13156
- C:\Windows\System\oxGWnWL.exe
  C:\Windows\System\oxGWnWL.exe
  2⤵
  PID:13188
- C:\Windows\System\XnfVEEb.exe
  C:\Windows\System\XnfVEEb.exe
  2⤵
  PID:13204
- C:\Windows\System\BcHDFGb.exe
  C:\Windows\System\BcHDFGb.exe
  2⤵
  PID:13224
- C:\Windows\System\SxfkEIy.exe
  C:\Windows\System\SxfkEIy.exe
  2⤵
  PID:13252
- C:\Windows\System\rnfhbXA.exe
  C:\Windows\System\rnfhbXA.exe
  2⤵
  PID:13280
- C:\Windows\System\gguFYZB.exe
  C:\Windows\System\gguFYZB.exe
  2⤵
  PID:13308
- C:\Windows\System\xEmBXCE.exe
  C:\Windows\System\xEmBXCE.exe
  2⤵
  PID:12336
- C:\Windows\System\oVHHlKg.exe
  C:\Windows\System\oVHHlKg.exe
  2⤵
  PID:12360
- C:\Windows\System\fFlDnrt.exe
  C:\Windows\System\fFlDnrt.exe
  2⤵
  PID:12472
- C:\Windows\System\rvXFDTM.exe
  C:\Windows\System\rvXFDTM.exe
  2⤵
  PID:12444
- C:\Windows\System\WpufKRH.exe
  C:\Windows\System\WpufKRH.exe
  2⤵
  PID:12552
- C:\Windows\System\gWizVuz.exe
  C:\Windows\System\gWizVuz.exe
  2⤵
  PID:12652
- C:\Windows\System\ozXIMJF.exe
  C:\Windows\System\ozXIMJF.exe
  2⤵
  PID:12732
- C:\Windows\System\XMIWUwP.exe
  C:\Windows\System\XMIWUwP.exe
  2⤵
  PID:12812
- C:\Windows\System\NxicGRQ.exe
  C:\Windows\System\NxicGRQ.exe
  2⤵
  PID:12872
- C:\Windows\System\hIdmlGZ.exe
  C:\Windows\System\hIdmlGZ.exe
  2⤵
  PID:12916
- C:\Windows\System\netXtdD.exe
  C:\Windows\System\netXtdD.exe
  2⤵
  PID:13016
- C:\Windows\System\vlGtcib.exe
  C:\Windows\System\vlGtcib.exe
  2⤵
  PID:13060
- C:\Windows\System\CApEgsx.exe
  C:\Windows\System\CApEgsx.exe
  2⤵
  PID:13112
- C:\Windows\System\DAVIISH.exe
  C:\Windows\System\DAVIISH.exe
  2⤵
  PID:13184
- C:\Windows\System\GRuqgWh.exe
  C:\Windows\System\GRuqgWh.exe
  2⤵
  PID:13288
- C:\Windows\System\JMipnBW.exe
  C:\Windows\System\JMipnBW.exe
  2⤵
  PID:11940
- C:\Windows\System\QdVXrdT.exe
  C:\Windows\System\QdVXrdT.exe
  2⤵
  PID:12512
- C:\Windows\System\ziZMjjC.exe
  C:\Windows\System\ziZMjjC.exe
  2⤵
  PID:12592
- C:\Windows\System\YaPdUDq.exe
  C:\Windows\System\YaPdUDq.exe
  2⤵
  PID:12524
- C:\Windows\System\NoWFuvW.exe
  C:\Windows\System\NoWFuvW.exe
  2⤵
  PID:4924
- C:\Windows\System\YgTinGv.exe
  C:\Windows\System\YgTinGv.exe
  2⤵
  PID:12920
- C:\Windows\System\NGfaXSA.exe
  C:\Windows\System\NGfaXSA.exe
  2⤵
  PID:13128
- C:\Windows\System\LBYuZpD.exe
  C:\Windows\System\LBYuZpD.exe
  2⤵
  PID:13200
- C:\Windows\System\chWfKri.exe
  C:\Windows\System\chWfKri.exe
  2⤵
  PID:13268
- C:\Windows\System\gMWbeOw.exe
  C:\Windows\System\gMWbeOw.exe
  2⤵
  PID:12764
- C:\Windows\System\KrLehNk.exe
  C:\Windows\System\KrLehNk.exe
  2⤵
  PID:13044
- C:\Windows\System\rOcpTRp.exe
  C:\Windows\System\rOcpTRp.exe
  2⤵
  PID:12436
- C:\Windows\System\tRmriWs.exe
  C:\Windows\System\tRmriWs.exe
  2⤵
  PID:2348
- C:\Windows\System\EEADSYs.exe
  C:\Windows\System\EEADSYs.exe
  2⤵
  PID:13124
- C:\Windows\System\VVwKSwM.exe
  C:\Windows\System\VVwKSwM.exe
  2⤵
  PID:12528
- C:\Windows\System\QbYCDes.exe
  C:\Windows\System\QbYCDes.exe
  2⤵
  PID:13144
- C:\Windows\System\nEfWOFl.exe
  C:\Windows\System\nEfWOFl.exe
  2⤵
  PID:13324
- C:\Windows\System\VJantyB.exe
  C:\Windows\System\VJantyB.exe
  2⤵
  PID:13364
- C:\Windows\System\BYArvAt.exe
  C:\Windows\System\BYArvAt.exe
  2⤵
  PID:13404
- C:\Windows\System\tPXCTyN.exe
  C:\Windows\System\tPXCTyN.exe
  2⤵
  PID:13432
- C:\Windows\System\kNrDSUK.exe
  C:\Windows\System\kNrDSUK.exe
  2⤵
  PID:13460
- C:\Windows\System\BWUPlnm.exe
  C:\Windows\System\BWUPlnm.exe
  2⤵
  PID:13500
- C:\Windows\System\KhkUnJI.exe
  C:\Windows\System\KhkUnJI.exe
  2⤵
  PID:13528
- C:\Windows\System\iSRPrtu.exe
  C:\Windows\System\iSRPrtu.exe
  2⤵
  PID:13544
- C:\Windows\System\uFftKJt.exe
  C:\Windows\System\uFftKJt.exe
  2⤵
  PID:13572
- C:\Windows\System\LqEEEcm.exe
  C:\Windows\System\LqEEEcm.exe
  2⤵
  PID:13600
- C:\Windows\System\dbYTvPM.exe
  C:\Windows\System\dbYTvPM.exe
  2⤵
  PID:13632
- C:\Windows\System\UyhLhAk.exe
  C:\Windows\System\UyhLhAk.exe
  2⤵
  PID:13668
- C:\Windows\System\PdVtawB.exe
  C:\Windows\System\PdVtawB.exe
  2⤵
  PID:13696
- C:\Windows\System\hShTTXi.exe
  C:\Windows\System\hShTTXi.exe
  2⤵
  PID:13712
- C:\Windows\System\itUscDC.exe
  C:\Windows\System\itUscDC.exe
  2⤵
  PID:13740
- C:\Windows\System\tWAgVYD.exe
  C:\Windows\System\tWAgVYD.exe
  2⤵
  PID:13764
- C:\Windows\System\QiwYjoL.exe
  C:\Windows\System\QiwYjoL.exe
  2⤵
  PID:13788
- C:\Windows\System\sIyOQwi.exe
  C:\Windows\System\sIyOQwi.exe
  2⤵
  PID:13808
- C:\Windows\System\OawRzPE.exe
  C:\Windows\System\OawRzPE.exe
  2⤵
  PID:13832
- C:\Windows\System\CnhSqbv.exe
  C:\Windows\System\CnhSqbv.exe
  2⤵
  PID:13852
- C:\Windows\System\yAEmMRb.exe
  C:\Windows\System\yAEmMRb.exe
  2⤵
  PID:13880
- C:\Windows\System\sMBQPBD.exe
  C:\Windows\System\sMBQPBD.exe
  2⤵
  PID:13896
- C:\Windows\System\VEkpxWz.exe
  C:\Windows\System\VEkpxWz.exe
  2⤵
  PID:13980
- C:\Windows\System\nHHQNaS.exe
  C:\Windows\System\nHHQNaS.exe
  2⤵
  PID:14004
- C:\Windows\System\PWWBguC.exe
  C:\Windows\System\PWWBguC.exe
  2⤵
  PID:14020
- C:\Windows\System\bMNJeDa.exe
  C:\Windows\System\bMNJeDa.exe
  2⤵
  PID:14072
- C:\Windows\System\MpTaSas.exe
  C:\Windows\System\MpTaSas.exe
  2⤵
  PID:14088
- C:\Windows\System\mSETjpV.exe
  C:\Windows\System\mSETjpV.exe
  2⤵
  PID:14128
- C:\Windows\System\ndvfAFX.exe
  C:\Windows\System\ndvfAFX.exe
  2⤵
  PID:14152
- C:\Windows\System\XIKhjKa.exe
  C:\Windows\System\XIKhjKa.exe
  2⤵
  PID:14172
- C:\Windows\System\wcHfTVH.exe
  C:\Windows\System\wcHfTVH.exe
  2⤵
  PID:14188
- C:\Windows\System\mCYaVDf.exe
  C:\Windows\System\mCYaVDf.exe
  2⤵
  PID:14212
- C:\Windows\System\rSIqiUn.exe
  C:\Windows\System\rSIqiUn.exe
  2⤵
  PID:14236
- C:\Windows\System\FWLeHjs.exe
  C:\Windows\System\FWLeHjs.exe
  2⤵
  PID:14272
- C:\Windows\System\aVanWFw.exe
  C:\Windows\System\aVanWFw.exe
  2⤵
  PID:14300
- C:\Windows\System\UsjVBwB.exe
  C:\Windows\System\UsjVBwB.exe
  2⤵
  PID:13316
- C:\Windows\System\ylixQvb.exe
  C:\Windows\System\ylixQvb.exe
  2⤵
  PID:13340
- C:\Windows\System\CEaGrFh.exe
  C:\Windows\System\CEaGrFh.exe
  2⤵
  PID:13416
- C:\Windows\System\etWKQMI.exe
  C:\Windows\System\etWKQMI.exe
  2⤵
  PID:1532
- C:\Windows\System\yArOqAP.exe
  C:\Windows\System\yArOqAP.exe
  2⤵
  PID:13536
- C:\Windows\System\PMRqorU.exe
  C:\Windows\System\PMRqorU.exe
  2⤵
  PID:13652
- C:\Windows\System\JIPntRc.exe
  C:\Windows\System\JIPntRc.exe
  2⤵
  PID:13680
- C:\Windows\System\VPABAqA.exe
  C:\Windows\System\VPABAqA.exe
  2⤵
  PID:13732
- C:\Windows\System\TUloXTt.exe
  C:\Windows\System\TUloXTt.exe
  2⤵
  PID:13800
- C:\Windows\System\CCIWnxL.exe
  C:\Windows\System\CCIWnxL.exe
  2⤵
  PID:13804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BHwrIJr.exe

Filesize
1.8MB

MD5
5b991b7f3ad0b3367034f69199798337

SHA1
e2ec46f346a58c02d64b7a43aed206f261938cf7

SHA256
400e5e1e0299129f1f0440d305b98b398acd2ad56374962670977ea528cbafe7

SHA512
693fe8762b140fc6ee94a9cd8cce031a909e8d7fb5604b5ffc4f0770792bbe4cdf06a74901fef40904b0434dee828d1fbe92c418d2f9ba29969d6c0bbcc20ecf

Download Submit
C:\Windows\System\CsJPzPl.exe

Filesize
1.8MB

MD5
f4dff6a7691f84fb68cae19521daa1fc

SHA1
7626092d6e801ee7ab95822bff5ebec8b739f98b

SHA256
abe0f1e0ac7b036140ac60e947a3296a4d07fc52b290fdcc8299f673a02fb7c5

SHA512
bffd7d58f8796affdbffb2b4d830c6ba76062b700bf639aedaeb112d44f8d9845448b5914c53905134d23e165f9c6d963ddec4c51da17436e2e1eb129a433caf

Download Submit
C:\Windows\System\HhQxhFp.exe

Filesize
1.8MB

MD5
0888a245d6f94d8c03f30de149c2e26b

SHA1
14a5b3bcb99b30fba21c42f6a6eeae38fef50367

SHA256
00916b935263740d312191809e45057fd21717293a5225a78f734e13e1564861

SHA512
8c25483def88ecea12da4f8fd620dfe852a76695f1373f058fac4f1157e9a52afce8575b13117c841fa254cf88af785e5b13de7ff9d82b6f5819445691c5541d

Download Submit
C:\Windows\System\HyldJWk.exe

Filesize
1.8MB

MD5
1b9f038824c0f503d0ad218500bf5f31

SHA1
8d6f8cf369e4ade6cdad80cb38e4e11329544963

SHA256
c21862fc7d7856e7f611a6efe11efbf8e328999af05fb2acbb4a00ee460adb48

SHA512
768bb566890130736ccf025a01e04ad5ea95346fb549319f19094787dc0b1188bbd62b00eafd9a6c515edd5fcda3f437d6ee7b54e063fbabf469c651f7e67e10

Download Submit
C:\Windows\System\IDtKrAR.exe

Filesize
1.8MB

MD5
7dbe2019e3cecd77d3bf676f1a79817c

SHA1
15d9ea713ea82f25f969cd9bdaab9b46fe21af7f

SHA256
f661320d2c047c88ff9429c9cd496dad4e3d7bd234b3580364913bd30ccf2df7

SHA512
5e17df1f874f75813265c3cae7e94f6a8a2b7f68f592b1c048cd74343f12094e2b61b384dfcce212a27c7200d88f5a3ad0d8a505f4c7bdfd874dbef151b250c1

Download Submit
C:\Windows\System\JBRbvHu.exe

Filesize
1.8MB

MD5
4826ed907820d3281e85f49de352c41e

SHA1
57f61e40f2770f73d7e84464a78e0763e49b7d38

SHA256
001e78ca7ef3bc131697879b7c3af6eaae61f1ece3890fccd7164f0b3b64084a

SHA512
6d3d35d2e4d10df9ac2b97c53afcc42f540c381af7f2f39c876aaf2a644b3d30197e24c416d2ee370725be08d895fbf4351670033ecb9936057bd88afbcbdffb

Download Submit
C:\Windows\System\OBnsMgt.exe

Filesize
1.8MB

MD5
677d55bd6a4f6f26fca50e8a2d286af1

SHA1
40a5be1d3eed6afd06a66d095c284ff1e2f2cc83

SHA256
e661f5fe23f237f6d54e61cf5729b07efcaaf4fa0db31292a36cbd350b739336

SHA512
f0c383cb4e66b12f24ebf530a14ed8e867a71a2ab73ab48f16ee96af92a9437c1256f6ec87d449f60af3e6c0a8ee2379bb48d2b31478c1b9a1290d952a8e8d57

Download Submit
C:\Windows\System\ORisUZD.exe

Filesize
1.8MB

MD5
43f2d75755679eb71cea67da9dea48aa

SHA1
917b86d1006ac1a9ab7160ac973403406b305b05

SHA256
e12838b685014a06f221bde9b19f96ff639faf9eb09f4914298f56523d30abc3

SHA512
c77e2e3c011c0e3047d4bf5fe7c8fe47fbc4533ae2a1b0fabe390df7ad3bd4366fc5fe78384de2474a75c701aa56b7300a508ac1d95e49baa4a90175dd117a68

Download Submit
C:\Windows\System\QWHPWBw.exe

Filesize
1.8MB

MD5
72cb575c863df02550626957f9c1ad84

SHA1
e157c669c8d8f243cb6f509cc39010dfd9bc19dd

SHA256
06e91e15a63ad7d396630e8da871c387560a7b4cc86c41e9e019c3577b3216f7

SHA512
18a02d3177a8482ae87374d466fe18a11810a3beb832ccbb9c19d6c5b5fc27e0af32369bf130084c4cbf1288162829adccc23324c8df56e6be995ca94980bb03

Download Submit
C:\Windows\System\RFebDUU.exe

Filesize
1.8MB

MD5
c678d0a965c0c168dd9b0637eb304917

SHA1
dbacbae2d4f651c8f3dd097af04f9906f9dc11b1

SHA256
7621fd1aa4d412c815d406600cff1d73239a60194afdf778715cb041950de218

SHA512
e0393eb14e6235c0d492c68dd69d93ab72f63b297863c41375b047f4a9ad1522bf6340de16cef3f51a4b4fbe720e241cb6ccad9010c32d872f3b0e09f39d3cfd

Download Submit
C:\Windows\System\UIrUfjZ.exe

Filesize
1.8MB

MD5
9dfddc4e7ad09021f5fe52d2bbe5d930

SHA1
a08ab18ce8a1dddab5fe750dbe6a1e24dc681601

SHA256
cc0fd8c2167434b29af6a2b2770df834db482f07be90ed105f183a92fcd26c9b

SHA512
bd1463c945adc04717508ce4da9a0d12af5f5315b2225fc6e3521341eed519bc718ad34b846a7cc342d5f0378fa3ae888564939539ad431c164503fc11b79d49

Download Submit
C:\Windows\System\UyFvSFe.exe

Filesize
1.8MB

MD5
052bc08f7cac3d385bc8f1b72e13613a

SHA1
ec9f80a453eef03a02f92520d22ee754b28136b7

SHA256
71290aeb08beaeae44248892c1c108813a26799d0d6cca748700cccdd3793ee5

SHA512
d154ba2983439b696464da53a3951b265ad0830c688245338a4edb6514e72e87018a7c2c747f7e1a665b1d60f30d87f6a613cac573407bce9fca91cd1b587ac5

Download Submit
C:\Windows\System\XEvDyAg.exe

Filesize
1.8MB

MD5
112c3d2e708005e33dbacb2f95904088

SHA1
0091ae60dd114b0955df265ae4cd93063623b588

SHA256
b4a5d27dd7862722ec177fcde38a18f12b938c0d4855632ee57167114376c36e

SHA512
c6d418e36ef8c8a359985b762019b3fd6f42b5a73e99ea28c0ba6384c02c10d9b7783610d18d0e9465427f0e932bfc992caa4ecaf2cef788cf9f3fa4efe16277

Download Submit
C:\Windows\System\ZooqyIR.exe

Filesize
1.8MB

MD5
9c8b0f74fa5714ed12237ef56ebff27c

SHA1
f8708dd08676afd9c08d07f2cdebfc4daaada52c

SHA256
405f15bc0479df4c0a8c65d7b6070dafad67d287fb4b9b279671d83eb7137cfd

SHA512
d11004d1100060b835ed175815288f2c3395f9e489a1430ccb37691f12fef4818a8d19bbfba93e54810f8019c4e2b001b1ea138bbe7ba9daa08031a1aab2272a

Download Submit
C:\Windows\System\cSbUGMT.exe

Filesize
1.8MB

MD5
27c675d162ec798755bbc1f6e21017f8

SHA1
cb56a58e72132e5cf74916309230f67c0d636b53

SHA256
50ec7f4cefda3763500e2b2658bf98e24664886e718b0b13530c31a03984e1de

SHA512
d10eb052b860cd743d83e0bc6ee496c733b8d3880403c9083ed2903c7769077ebe59de947ef20f34898c8c5ca076b1046c34e508373188c72436f4edf5c7ed1c

Download Submit
C:\Windows\System\dPCShkV.exe

Filesize
1.8MB

MD5
0d7dc7d8e1c0e865c9d6a3cdae33e367

SHA1
38dc96c90914141555e3b20335f3627b57ef88ae

SHA256
d1889fe7e52377ef94b82b4457af5ac1101b33f8c65dea6c787a64b38b42367c

SHA512
d2879ef3347b530dc7d9a3bb4c2b23a7651e50dfbd9287f3cf9fe63c60d4e3283551d0d01636bfe5f62192619c2e3e41bb70af4f8bcc1685422fcc61ba3f44bf

Download Submit
C:\Windows\System\dqUajkj.exe

Filesize
1.8MB

MD5
2d861e3ee20d12749fef7b0add34f374

SHA1
a0dd5216fd7d6906acb6641b65490add11314f51

SHA256
f92503fd6879bae97a7454837ff2480130da9ed08907c9a1f542e2278de8ba31

SHA512
df804bab3ae221419a20d1e8aa112b6cb2fdfc393e5ce06b65fb121bcfd16e887649dffd114a9cfe28b442a85265b361b2702a4e0f02a3dda233c3c69a98ff6e

Download Submit
C:\Windows\System\eCXusSZ.exe

Filesize
1.8MB

MD5
6d0d13cfc1917a7d7d0b836e206a5f12

SHA1
89265d9bb5def38aee68a63aaaeeb348dffbad3c

SHA256
9a4d0047f73693e3d158b6062eec1bf396bee91ad21282cbeadf0534cb0342e7

SHA512
51bcdbf06805a997f84bd3be8a83dfc71bbf4e0fa2c3e3514343b668529a7209ffab0eaa445212da8985226f9825e9a2d8083f17597ab7c3283cb851da6eeac2

Download Submit
C:\Windows\System\gFEVLgY.exe

Filesize
1.8MB

MD5
34a4cf6d3f8bde0db8e59658ebab33b1

SHA1
1c8365438fd5c5129f1480b77849347eede2ccf7

SHA256
d8b757ba63b546921c53d21afb6d2165b6338bc494dffdcebfb35704dd2b60b1

SHA512
75afdce3d1cf77c2500373f99d55c0ca5b4de1aee88e0107cb70cd8f6869df8780543d5b99c2cd9df7256915c22894c6c0ec979ffde0c04f82e9fb665bbf2723

Download Submit
C:\Windows\System\gQjtxOQ.exe

Filesize
1.8MB

MD5
ce6cd803d66d38b12900ca9e36e3322c

SHA1
5f1bebcbcb63dc840c6940d9616f854cf33074ef

SHA256
29bd70110efefed4027e79420430a4180dc06ef991490341e250c873a5e1f2ce

SHA512
76b6c2c49d0774bf73eecf01c011e1c4e60fd7ed2a7e84d18b6a6970319cd6ed58db6c61451428cd455c672e1cc8b3445abbc83a1c06c049d0dbc547d2195799

Download Submit
C:\Windows\System\hAHekQD.exe

Filesize
1.8MB

MD5
fbf6e2cbf75346db40dbc03afa593dce

SHA1
760dd606f5dc711c060f980e63ef3dd4b96806d1

SHA256
83c93fd2ac49d304328e17d2db42cd22fa8b7258e467b93adb762baaae191757

SHA512
82238cd46ce75fba8d5210b87533feb43835463d2d8ab519b76ad0af171dbe917986f6d4810918fec3d298461c51d9f1f6203afbc5783225406c2bc982554e93

Download Submit
C:\Windows\System\hwkjFvg.exe

Filesize
1.8MB

MD5
8bc7c69e813b441ae00bda04a328cb7a

SHA1
affb07f81e8959c23e5cf0d6a9f599cbda1955af

SHA256
e1c6d21546bd3d0dae552858f78850d39be35c3d21a659021d18651edfb432c5

SHA512
d2588eed20323144b7e7d3cb92e78969bb148cba1a0363b77c001beab1bb79fff42fb01bee8dbd759eb55341e60561d5581a6bee25437b8e8e91094cc5ee385c

Download Submit
C:\Windows\System\iGHeERZ.exe

Filesize
1.8MB

MD5
229991dc91066c3b5e690562abd308f4

SHA1
344e77318f5e46edb23ef4d3696ff737d513fa4b

SHA256
6d1b250d135b37b24288f67a8f695ed58178de1ffe5169dddf24538ba5913675

SHA512
87ee3e94fdcc2e7d5a8baa9e43acbf6b27813ae77bddc956d958e1f83610f7382aa28d16a1ccd4dd1b047aa2e5f73eea153fb6a4dd59897385e11a87cabb69cb

Download Submit
C:\Windows\System\kNiJbQi.exe

Filesize
1.8MB

MD5
57d965708040feca7b4f9d4efc413900

SHA1
debadd0a8640b1b580e8d4ce4777c6aff59fc871

SHA256
dfdfd5afc1e0346e6147ddb3d125eb944bc4d34daa62726f15246781f11fd8bd

SHA512
1e64c44abc737ae8097c92e4454838ea13cab9b01ec15f2f2528777b55ff9c4664c55296bc6974790a9babb25e8a297ed7d67393d07223b2fba70d393adf714f

Download Submit
C:\Windows\System\pHdiiSY.exe

Filesize
1.8MB

MD5
66bb555f6dfcb92d203f56b3ce0706e3

SHA1
0068801ac44ce9bf7bc640b2f7ec92efe09d660d

SHA256
9985d0c82b48478e92482cdd5a9e486b91b1e455bf64b1f2f51809fdaf90d9b0

SHA512
c2c1134b1a8c38330a38b953d2a9a9e0cbefeaf14887c8876ebf6b30f4baf0cdddfb235fd213cd117bcb12d99967788f8ce44de117f1fdb9f73b7bac52b53c51

Download Submit
C:\Windows\System\pYuIBVA.exe

Filesize
1.8MB

MD5
7cf5fae9fb71f2717d90112b3ad7b40f

SHA1
a5b2c666d8aa5c46fee64a25f4c425583b66a290

SHA256
5a0ddfacd3a0d8213892c8a804dee92bdc3e592c3a44c226a5aa06e40377344d

SHA512
0bdade74e3afa09aab30bb55860c886defc8b4921f38a627f66c3f1133d725b509ea39a9b902b9d3b11478a879680874dddbd0fa0e9bbfbfc1e76dbf608f1e95

Download Submit
C:\Windows\System\pixypnf.exe

Filesize
1.8MB

MD5
ded1a0f0f44d165009abaf362940fbee

SHA1
0e65ee0483d79182b1c6d4756596d046fd3f20c7

SHA256
c68602715037504a9b243fa362150e39ff26b8e0ad2e5dc6dffd1724a3d54fe2

SHA512
392bbd26dfa2892eeba0b0932c5d49abea4db2cf1302514136cad85ebbec5e15e68fc60768ec47b7cff688791c800efa7409d3c1a688eaa61d54a1c87b4659b2

Download Submit
C:\Windows\System\qFSTPdi.exe

Filesize
1.8MB

MD5
eb353d3cbae75740f6a0dc7d472327d1

SHA1
6df62d79a2bbde7eb1d5480146db9fbd457db2ec

SHA256
4d6e6a3fb7650fb1fd71b9639a48558ae82a5084826bcfc30ec44f67c80f6f7f

SHA512
d06c035cf55a1992289522d18b3e954175e83c7c431732d18236dc3713c850842cdebf2c7439903b82cabcc2799c53440d94c1f80a04d34cdea96ce13f29187a

Download Submit
C:\Windows\System\qUyELUz.exe

Filesize
1.8MB

MD5
9b9f96ed5764bc20faf6cf7017276b71

SHA1
a50402687ff29cf6ded72c05e8ba3c3696509033

SHA256
134cb2e0b54caf9f85fa47c1cfe818bd02ca92df9ce28d11a83ac637b749b510

SHA512
27b32158ee627aa9771553577f6f7dd7e6d31a56abb5576ab061bada48012778613348b30614680b3b364ef500234ba08bbfbae77225df960bf1de1aff102c67

Download Submit
C:\Windows\System\qjkTepd.exe

Filesize
1.8MB

MD5
3c267e7931e9a152a64fa60dd4ac520b

SHA1
258b905301db5c2a11ba61a95254fabf5a5f8140

SHA256
63d7ef15b214333e0a29f9420459ad2fb7c0113286da013dd408423fee27271b

SHA512
fee621014def8f222e24d3cfebc82471c65dde1a0c5d44044445172d20559837a681539106af05f2ca2be3c9d6f690683b20bb0039c40b80649cab4272fef733

Download Submit
C:\Windows\System\vVnUJPO.exe

Filesize
1.8MB

MD5
e7fca9dd3bf03822bd48a422b0395a3b

SHA1
c810a9a8508a86b6b739f9b18fa839850e93045e

SHA256
9b4bf6fbcf69858067e3bbe9c93d38ee8e04d59abfe76a51ab04b9e1f58c2433

SHA512
2734a1498d3cf9762d34d3c747bb3e9e64ec05f00a2a78b1b1a04ca387435934145047d6a712a142023888d792bd2d49fcbd7fcdbe44b264fba2d83e9767e5ac

Download Submit
C:\Windows\System\vitjlvb.exe

Filesize
1.8MB

MD5
2c2b66ab24882f045e14da4a1b4f2a39

SHA1
afc3ca7b429592ea15b29a068d2b70344ce7b213

SHA256
0d4eb397b0b69bb967549acec3776efab29dd95beb52e716885f59beee5cdb60

SHA512
c1579dc900d46559732a570de92c8fac740318f122c823c5811a359636a101b786dcfb81623a7f0c96eddbd276923e6bcdaffca6841b9a52d1392839e17ab986

Download Submit
C:\Windows\System\xVZpznM.exe

Filesize
1.8MB

MD5
c2ef5691e44c0a745c640d35271f0a63

SHA1
1f2587ce76a32cc5bb3e3ad02094a32168bcce1d

SHA256
08fd620c0c8c0bc82d013fcf21b51fa4176d6536b0b6f4376a8e183c40fe86ac

SHA512
311854d1746953bb3c12c20461b3b66f0688eba7b1eb359049a36a9bbc7fe844e40e4d6a253c02292d8315bc9dc2756c0e3bda93226491a80da0f024cbc8f15f

Download Submit
memory/516-694-0x00007FF78E5C0000-0x00007FF78E914000-memory.dmp

Filesize
3.3MB

Download
memory/516-2174-0x00007FF78E5C0000-0x00007FF78E914000-memory.dmp

Filesize
3.3MB

Download
memory/888-632-0x00007FF74A460000-0x00007FF74A7B4000-memory.dmp

Filesize
3.3MB

Download
memory/888-2167-0x00007FF74A460000-0x00007FF74A7B4000-memory.dmp

Filesize
3.3MB

Download
memory/1680-53-0x00007FF6DCCE0000-0x00007FF6DD034000-memory.dmp

Filesize
3.3MB

Download
memory/1680-2152-0x00007FF6DCCE0000-0x00007FF6DD034000-memory.dmp

Filesize
3.3MB

Download
memory/1680-2142-0x00007FF6DCCE0000-0x00007FF6DD034000-memory.dmp

Filesize
3.3MB

Download
memory/1808-2172-0x00007FF732E10000-0x00007FF733164000-memory.dmp

Filesize
3.3MB

Download
memory/1808-681-0x00007FF732E10000-0x00007FF733164000-memory.dmp

Filesize
3.3MB

Download
memory/1852-2154-0x00007FF7788F0000-0x00007FF778C44000-memory.dmp

Filesize
3.3MB

Download
memory/1852-38-0x00007FF7788F0000-0x00007FF778C44000-memory.dmp

Filesize
3.3MB

Download
memory/1852-2140-0x00007FF7788F0000-0x00007FF778C44000-memory.dmp

Filesize
3.3MB

Download
memory/1984-1440-0x00007FF6C41B0000-0x00007FF6C4504000-memory.dmp

Filesize
3.3MB

Download
memory/1984-0-0x00007FF6C41B0000-0x00007FF6C4504000-memory.dmp

Filesize
3.3MB

Download
memory/1984-1-0x000001CEBC2F0000-0x000001CEBC300000-memory.dmp

Filesize
64KB

Download
memory/2000-81-0x00007FF705480000-0x00007FF7057D4000-memory.dmp

Filesize
3.3MB

Download
memory/2000-2156-0x00007FF705480000-0x00007FF7057D4000-memory.dmp

Filesize
3.3MB

Download
memory/2064-2146-0x00007FF769BE0000-0x00007FF769F34000-memory.dmp

Filesize
3.3MB

Download
memory/2064-1993-0x00007FF769BE0000-0x00007FF769F34000-memory.dmp

Filesize
3.3MB

Download
memory/2064-8-0x00007FF769BE0000-0x00007FF769F34000-memory.dmp

Filesize
3.3MB

Download
memory/2240-2148-0x00007FF7B9CA0000-0x00007FF7B9FF4000-memory.dmp

Filesize
3.3MB

Download
memory/2240-37-0x00007FF7B9CA0000-0x00007FF7B9FF4000-memory.dmp

Filesize
3.3MB

Download
memory/2300-2141-0x00007FF6475D0000-0x00007FF647924000-memory.dmp

Filesize
3.3MB

Download
memory/2300-2153-0x00007FF6475D0000-0x00007FF647924000-memory.dmp

Filesize
3.3MB

Download
memory/2300-44-0x00007FF6475D0000-0x00007FF647924000-memory.dmp

Filesize
3.3MB

Download
memory/2448-88-0x00007FF6078D0000-0x00007FF607C24000-memory.dmp

Filesize
3.3MB

Download
memory/2448-2144-0x00007FF6078D0000-0x00007FF607C24000-memory.dmp

Filesize
3.3MB

Download
memory/2448-2163-0x00007FF6078D0000-0x00007FF607C24000-memory.dmp

Filesize
3.3MB

Download
memory/2508-610-0x00007FF70AB00000-0x00007FF70AE54000-memory.dmp

Filesize
3.3MB

Download
memory/2508-2160-0x00007FF70AB00000-0x00007FF70AE54000-memory.dmp

Filesize
3.3MB

Download
memory/2872-2150-0x00007FF640F60000-0x00007FF6412B4000-memory.dmp

Filesize
3.3MB

Download
memory/2872-29-0x00007FF640F60000-0x00007FF6412B4000-memory.dmp

Filesize
3.3MB

Download
memory/2872-1997-0x00007FF640F60000-0x00007FF6412B4000-memory.dmp

Filesize
3.3MB

Download
memory/2892-675-0x00007FF7B4410000-0x00007FF7B4764000-memory.dmp

Filesize
3.3MB

Download
memory/2892-2173-0x00007FF7B4410000-0x00007FF7B4764000-memory.dmp

Filesize
3.3MB

Download
memory/3052-64-0x00007FF7BC940000-0x00007FF7BCC94000-memory.dmp

Filesize
3.3MB

Download
memory/3052-2155-0x00007FF7BC940000-0x00007FF7BCC94000-memory.dmp

Filesize
3.3MB

Download
memory/3164-726-0x00007FF650CC0000-0x00007FF651014000-memory.dmp

Filesize
3.3MB

Download
memory/3164-2169-0x00007FF650CC0000-0x00007FF651014000-memory.dmp

Filesize
3.3MB

Download
memory/3232-32-0x00007FF740EB0000-0x00007FF741204000-memory.dmp

Filesize
3.3MB

Download
memory/3232-2149-0x00007FF740EB0000-0x00007FF741204000-memory.dmp

Filesize
3.3MB

Download
memory/3268-2159-0x00007FF79DAE0000-0x00007FF79DE34000-memory.dmp

Filesize
3.3MB

Download
memory/3268-780-0x00007FF79DAE0000-0x00007FF79DE34000-memory.dmp

Filesize
3.3MB

Download
memory/3456-2151-0x00007FF7216F0000-0x00007FF721A44000-memory.dmp

Filesize
3.3MB

Download
memory/3456-56-0x00007FF7216F0000-0x00007FF721A44000-memory.dmp

Filesize
3.3MB

Download
memory/3456-2143-0x00007FF7216F0000-0x00007FF721A44000-memory.dmp

Filesize
3.3MB

Download
memory/3704-661-0x00007FF7BE000000-0x00007FF7BE354000-memory.dmp

Filesize
3.3MB

Download
memory/3704-2170-0x00007FF7BE000000-0x00007FF7BE354000-memory.dmp

Filesize
3.3MB

Download
memory/3716-731-0x00007FF75DC00000-0x00007FF75DF54000-memory.dmp

Filesize
3.3MB

Download
memory/3716-2171-0x00007FF75DC00000-0x00007FF75DF54000-memory.dmp

Filesize
3.3MB

Download
memory/3904-2147-0x00007FF7D0730000-0x00007FF7D0A84000-memory.dmp

Filesize
3.3MB

Download
memory/3904-33-0x00007FF7D0730000-0x00007FF7D0A84000-memory.dmp

Filesize
3.3MB

Download
memory/4052-2145-0x00007FF73C860000-0x00007FF73CBB4000-memory.dmp

Filesize
3.3MB

Download
memory/4052-2157-0x00007FF73C860000-0x00007FF73CBB4000-memory.dmp

Filesize
3.3MB

Download
memory/4052-78-0x00007FF73C860000-0x00007FF73CBB4000-memory.dmp

Filesize
3.3MB

Download
memory/4392-621-0x00007FF6AC8C0000-0x00007FF6ACC14000-memory.dmp

Filesize
3.3MB

Download
memory/4392-2158-0x00007FF6AC8C0000-0x00007FF6ACC14000-memory.dmp

Filesize
3.3MB

Download
memory/4504-626-0x00007FF7C9EE0000-0x00007FF7CA234000-memory.dmp

Filesize
3.3MB

Download
memory/4504-2165-0x00007FF7C9EE0000-0x00007FF7CA234000-memory.dmp

Filesize
3.3MB

Download
memory/4664-2168-0x00007FF73CEC0000-0x00007FF73D214000-memory.dmp

Filesize
3.3MB

Download
memory/4664-712-0x00007FF73CEC0000-0x00007FF73D214000-memory.dmp

Filesize
3.3MB

Download
memory/4692-617-0x00007FF7638F0000-0x00007FF763C44000-memory.dmp

Filesize
3.3MB

Download
memory/4692-2164-0x00007FF7638F0000-0x00007FF763C44000-memory.dmp

Filesize
3.3MB

Download
memory/4716-2162-0x00007FF632FA0000-0x00007FF6332F4000-memory.dmp

Filesize
3.3MB

Download
memory/4716-757-0x00007FF632FA0000-0x00007FF6332F4000-memory.dmp

Filesize
3.3MB

Download
memory/4732-645-0x00007FF6B2B50000-0x00007FF6B2EA4000-memory.dmp

Filesize
3.3MB

Download
memory/4732-2166-0x00007FF6B2B50000-0x00007FF6B2EA4000-memory.dmp

Filesize
3.3MB

Download
memory/5088-2161-0x00007FF7E6BA0000-0x00007FF7E6EF4000-memory.dmp

Filesize
3.3MB

Download
memory/5088-609-0x00007FF7E6BA0000-0x00007FF7E6EF4000-memory.dmp

Filesize
3.3MB

Download