xmrig | 8726d957deafbf14dc6ef75fdc1cd2f3af88a2376495673563ccc93dd3a28eb7

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

106ff7ba65722b5eec26fe5bfbb234f0N.exe
Size

1.8MB
MD5

106ff7ba65722b5eec26fe5bfbb234f0
SHA1

93f8cfe764be24051c0dda352cee40624daab238
SHA256

8726d957deafbf14dc6ef75fdc1cd2f3af88a2376495673563ccc93dd3a28eb7
SHA512

dcb464485ecdf5d79481995d65740b9d928114bf2f37bbff182da15040ad58ac9f673f5f4b24b6e60a15b8ef4eba749f3b469e5bd339a44996f2ad7cd3d1cfce
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQW/zaZY7qM:oemTLkNdfE0pZrQ0

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2992-0-0x00007FF635FE0000-0x00007FF636334000-memory.dmp	xmrig
behavioral2/files/0x0007000000023256-5.dat	xmrig
behavioral2/files/0x0007000000023478-9.dat	xmrig
behavioral2/files/0x0007000000023479-19.dat	xmrig
behavioral2/memory/1484-30-0x00007FF683A60000-0x00007FF683DB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002347a-39.dat	xmrig
behavioral2/files/0x000700000002347d-53.dat	xmrig
behavioral2/files/0x000700000002347e-59.dat	xmrig
behavioral2/files/0x0007000000023481-70.dat	xmrig
behavioral2/files/0x0007000000023480-66.dat	xmrig
behavioral2/memory/4908-65-0x00007FF76CA50000-0x00007FF76CDA4000-memory.dmp	xmrig
behavioral2/files/0x000700000002347f-63.dat	xmrig
behavioral2/files/0x000700000002348d-126.dat	xmrig
behavioral2/files/0x0007000000023490-141.dat	xmrig
behavioral2/files/0x0007000000023493-156.dat	xmrig
behavioral2/memory/1732-596-0x00007FF61AB00000-0x00007FF61AE54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023496-171.dat	xmrig
behavioral2/files/0x0007000000023494-169.dat	xmrig
behavioral2/files/0x0007000000023495-166.dat	xmrig
behavioral2/files/0x0007000000023492-159.dat	xmrig
behavioral2/files/0x0007000000023491-154.dat	xmrig
behavioral2/files/0x000700000002348f-144.dat	xmrig
behavioral2/files/0x000700000002348e-139.dat	xmrig
behavioral2/files/0x000700000002348c-129.dat	xmrig
behavioral2/files/0x000700000002348b-124.dat	xmrig
behavioral2/files/0x000700000002348a-119.dat	xmrig
behavioral2/memory/4268-597-0x00007FF69BFE0000-0x00007FF69C334000-memory.dmp	xmrig
behavioral2/files/0x0007000000023489-114.dat	xmrig
behavioral2/memory/2052-599-0x00007FF77DA60000-0x00007FF77DDB4000-memory.dmp	xmrig
behavioral2/memory/4084-600-0x00007FF742DB0000-0x00007FF743104000-memory.dmp	xmrig
behavioral2/memory/2468-601-0x00007FF754EC0000-0x00007FF755214000-memory.dmp	xmrig
behavioral2/memory/2812-602-0x00007FF6A4CE0000-0x00007FF6A5034000-memory.dmp	xmrig
behavioral2/memory/336-603-0x00007FF7991D0000-0x00007FF799524000-memory.dmp	xmrig
behavioral2/memory/2576-604-0x00007FF6A3450000-0x00007FF6A37A4000-memory.dmp	xmrig
behavioral2/memory/4312-598-0x00007FF695270000-0x00007FF6955C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023488-109.dat	xmrig
behavioral2/files/0x0007000000023487-104.dat	xmrig
behavioral2/files/0x0007000000023486-99.dat	xmrig
behavioral2/files/0x0007000000023484-95.dat	xmrig
behavioral2/files/0x0007000000023483-93.dat	xmrig
behavioral2/files/0x0007000000023485-90.dat	xmrig
behavioral2/files/0x0007000000023482-81.dat	xmrig
behavioral2/memory/4004-67-0x00007FF6E99F0000-0x00007FF6E9D44000-memory.dmp	xmrig
behavioral2/memory/3640-61-0x00007FF65C070000-0x00007FF65C3C4000-memory.dmp	xmrig
behavioral2/memory/3992-56-0x00007FF75DF60000-0x00007FF75E2B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002347c-50.dat	xmrig
behavioral2/memory/3560-46-0x00007FF6E0590000-0x00007FF6E08E4000-memory.dmp	xmrig
behavioral2/files/0x000700000002347b-41.dat	xmrig
behavioral2/memory/436-36-0x00007FF6A5D50000-0x00007FF6A60A4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023477-25.dat	xmrig
behavioral2/memory/2876-16-0x00007FF7B4390000-0x00007FF7B46E4000-memory.dmp	xmrig
behavioral2/memory/2408-605-0x00007FF6367C0000-0x00007FF636B14000-memory.dmp	xmrig
behavioral2/memory/4900-606-0x00007FF79AF90000-0x00007FF79B2E4000-memory.dmp	xmrig
behavioral2/memory/4792-607-0x00007FF703EA0000-0x00007FF7041F4000-memory.dmp	xmrig
behavioral2/memory/2180-608-0x00007FF669070000-0x00007FF6693C4000-memory.dmp	xmrig
behavioral2/memory/3504-609-0x00007FF71B070000-0x00007FF71B3C4000-memory.dmp	xmrig
behavioral2/memory/3624-610-0x00007FF70A4B0000-0x00007FF70A804000-memory.dmp	xmrig
behavioral2/memory/3420-612-0x00007FF69E320000-0x00007FF69E674000-memory.dmp	xmrig
behavioral2/memory/3264-611-0x00007FF600C60000-0x00007FF600FB4000-memory.dmp	xmrig
behavioral2/memory/3688-618-0x00007FF7AFDD0000-0x00007FF7B0124000-memory.dmp	xmrig
behavioral2/memory/4296-625-0x00007FF62BC60000-0x00007FF62BFB4000-memory.dmp	xmrig
behavioral2/memory/2292-628-0x00007FF61E490000-0x00007FF61E7E4000-memory.dmp	xmrig
behavioral2/memory/4936-622-0x00007FF6C3330000-0x00007FF6C3684000-memory.dmp	xmrig
behavioral2/memory/1484-2117-0x00007FF683A60000-0x00007FF683DB4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2876	KlXqPng.exe
3992	nFVKzXf.exe
1484	sxVNNWZ.exe
436	ZZdOTXL.exe
3640	bfeJIJZ.exe
3560	aufSISK.exe
4908	nVmdkUY.exe
4004	GRbvuYY.exe
3688	QssgsoO.exe
1732	JfNSIor.exe
4268	nCNYywj.exe
4936	WeKzJRa.exe
4296	xyvYOVI.exe
2292	OzVTPgN.exe
4312	QfwfoEK.exe
2052	smfXMVA.exe
4084	PVnuNYK.exe
2468	xIFfKDt.exe
2812	jOuAqMI.exe
336	lppKXWG.exe
2576	TWuklOG.exe
2408	sHZTGiP.exe
4900	JaPhhCr.exe
4792	LxjdKaQ.exe
2180	SJslbIV.exe
3504	lUTrfoc.exe
3624	uQHroeA.exe
3264	sMcuyoP.exe
3420	NnXDPPC.exe
3092	gLmwJbi.exe
2672	imCaDZC.exe
3204	MDiVzSD.exe
4484	QLuziXH.exe
3428	IwtmLqJ.exe
2728	UgSwHzc.exe
696	LGuydhj.exe
2816	dMDEjvk.exe
1180	nBklxZj.exe
1084	dKoHJBW.exe
4208	DMRLvcL.exe
700	ITJAKQS.exe
212	CJOjAea.exe
2412	qaIHkRC.exe
2004	KuCVLzG.exe
4700	oSnCiar.exe
1472	AolTmPO.exe
4244	hvFeTTE.exe
3536	QyrIcdQ.exe
1096	bnBmFAy.exe
876	wWSIQNJ.exe
1780	lqJhWYn.exe
4444	dMJKAoZ.exe
3840	MyZcwGt.exe
3952	CDxdUMF.exe
372	OQrbSLN.exe
644	RzeNsoO.exe
2096	QnYSkOn.exe
3756	RspIFwr.exe
3960	oWwhccP.exe
2496	JrfxOYc.exe
4988	JuomIbz.exe
2508	sYhEQGl.exe
3180	NzXpjMc.exe
1520	kKDFAdT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2992-0-0x00007FF635FE0000-0x00007FF636334000-memory.dmp	upx
behavioral2/files/0x0007000000023256-5.dat	upx
behavioral2/files/0x0007000000023478-9.dat	upx
behavioral2/files/0x0007000000023479-19.dat	upx
behavioral2/memory/1484-30-0x00007FF683A60000-0x00007FF683DB4000-memory.dmp	upx
behavioral2/files/0x000700000002347a-39.dat	upx
behavioral2/files/0x000700000002347d-53.dat	upx
behavioral2/files/0x000700000002347e-59.dat	upx
behavioral2/files/0x0007000000023481-70.dat	upx
behavioral2/files/0x0007000000023480-66.dat	upx
behavioral2/memory/4908-65-0x00007FF76CA50000-0x00007FF76CDA4000-memory.dmp	upx
behavioral2/files/0x000700000002347f-63.dat	upx
behavioral2/files/0x000700000002348d-126.dat	upx
behavioral2/files/0x0007000000023490-141.dat	upx
behavioral2/files/0x0007000000023493-156.dat	upx
behavioral2/memory/1732-596-0x00007FF61AB00000-0x00007FF61AE54000-memory.dmp	upx
behavioral2/files/0x0007000000023496-171.dat	upx
behavioral2/files/0x0007000000023494-169.dat	upx
behavioral2/files/0x0007000000023495-166.dat	upx
behavioral2/files/0x0007000000023492-159.dat	upx
behavioral2/files/0x0007000000023491-154.dat	upx
behavioral2/files/0x000700000002348f-144.dat	upx
behavioral2/files/0x000700000002348e-139.dat	upx
behavioral2/files/0x000700000002348c-129.dat	upx
behavioral2/files/0x000700000002348b-124.dat	upx
behavioral2/files/0x000700000002348a-119.dat	upx
behavioral2/memory/4268-597-0x00007FF69BFE0000-0x00007FF69C334000-memory.dmp	upx
behavioral2/files/0x0007000000023489-114.dat	upx
behavioral2/memory/2052-599-0x00007FF77DA60000-0x00007FF77DDB4000-memory.dmp	upx
behavioral2/memory/4084-600-0x00007FF742DB0000-0x00007FF743104000-memory.dmp	upx
behavioral2/memory/2468-601-0x00007FF754EC0000-0x00007FF755214000-memory.dmp	upx
behavioral2/memory/2812-602-0x00007FF6A4CE0000-0x00007FF6A5034000-memory.dmp	upx
behavioral2/memory/336-603-0x00007FF7991D0000-0x00007FF799524000-memory.dmp	upx
behavioral2/memory/2576-604-0x00007FF6A3450000-0x00007FF6A37A4000-memory.dmp	upx
behavioral2/memory/4312-598-0x00007FF695270000-0x00007FF6955C4000-memory.dmp	upx
behavioral2/files/0x0007000000023488-109.dat	upx
behavioral2/files/0x0007000000023487-104.dat	upx
behavioral2/files/0x0007000000023486-99.dat	upx
behavioral2/files/0x0007000000023484-95.dat	upx
behavioral2/files/0x0007000000023483-93.dat	upx
behavioral2/files/0x0007000000023485-90.dat	upx
behavioral2/files/0x0007000000023482-81.dat	upx
behavioral2/memory/4004-67-0x00007FF6E99F0000-0x00007FF6E9D44000-memory.dmp	upx
behavioral2/memory/3640-61-0x00007FF65C070000-0x00007FF65C3C4000-memory.dmp	upx
behavioral2/memory/3992-56-0x00007FF75DF60000-0x00007FF75E2B4000-memory.dmp	upx
behavioral2/files/0x000700000002347c-50.dat	upx
behavioral2/memory/3560-46-0x00007FF6E0590000-0x00007FF6E08E4000-memory.dmp	upx
behavioral2/files/0x000700000002347b-41.dat	upx
behavioral2/memory/436-36-0x00007FF6A5D50000-0x00007FF6A60A4000-memory.dmp	upx
behavioral2/files/0x0008000000023477-25.dat	upx
behavioral2/memory/2876-16-0x00007FF7B4390000-0x00007FF7B46E4000-memory.dmp	upx
behavioral2/memory/2408-605-0x00007FF6367C0000-0x00007FF636B14000-memory.dmp	upx
behavioral2/memory/4900-606-0x00007FF79AF90000-0x00007FF79B2E4000-memory.dmp	upx
behavioral2/memory/4792-607-0x00007FF703EA0000-0x00007FF7041F4000-memory.dmp	upx
behavioral2/memory/2180-608-0x00007FF669070000-0x00007FF6693C4000-memory.dmp	upx
behavioral2/memory/3504-609-0x00007FF71B070000-0x00007FF71B3C4000-memory.dmp	upx
behavioral2/memory/3624-610-0x00007FF70A4B0000-0x00007FF70A804000-memory.dmp	upx
behavioral2/memory/3420-612-0x00007FF69E320000-0x00007FF69E674000-memory.dmp	upx
behavioral2/memory/3264-611-0x00007FF600C60000-0x00007FF600FB4000-memory.dmp	upx
behavioral2/memory/3688-618-0x00007FF7AFDD0000-0x00007FF7B0124000-memory.dmp	upx
behavioral2/memory/4296-625-0x00007FF62BC60000-0x00007FF62BFB4000-memory.dmp	upx
behavioral2/memory/2292-628-0x00007FF61E490000-0x00007FF61E7E4000-memory.dmp	upx
behavioral2/memory/4936-622-0x00007FF6C3330000-0x00007FF6C3684000-memory.dmp	upx
behavioral2/memory/1484-2117-0x00007FF683A60000-0x00007FF683DB4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uWqmhvo.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\MpcnkVk.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\ABAdGaN.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\FtsfpLO.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\WEbUYbb.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\QUdXsOj.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\KisEEnB.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\UiZIPls.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\frCGBjO.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\Zoqqgyb.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\oqbtepm.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\spWKQyv.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\vuayrGy.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\QuzZpJN.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\OwjSdQU.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\NjYqNJG.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\MCGapRJ.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\ogMumTN.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\oraHWbv.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\KxUAaht.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\dlEUIAc.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\EzHQCOi.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\KbbSfRB.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\tvZCzLE.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\suxeurA.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\IkkRnNB.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\ROActxh.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\NnXDPPC.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\CDxdUMF.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\RdTjFVL.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\vcKqEnk.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\bCyRyQl.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\LrDqGnx.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\AafGmgT.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\kORlDxd.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\UgSwHzc.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\wWSIQNJ.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\TmaHviB.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\hEROtFg.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\xKUpvDv.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\JmmKyUz.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\NEpzxOx.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\wCQEmvF.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\CXjmeGZ.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\wxgXjrf.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\YQrpWuX.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\wgBUDeG.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\ZRTvZfe.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\zsznFTU.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\uGtEQKm.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\LBwakMF.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\VAsDRJp.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\SytxROl.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\LidacGo.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\DAzXkDg.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\eOAlFbK.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\gXvivrz.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\fDbTpYI.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\IOyjNga.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\KPHkiYx.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\aTyOgEZ.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\zUrmLSG.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\XXtMRry.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe
File created	C:\Windows\System\aPqSkfU.exe	106ff7ba65722b5eec26fe5bfbb234f0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2876	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	83
PID 2992 wrote to memory of 2876	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	83
PID 2992 wrote to memory of 3992	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	84
PID 2992 wrote to memory of 3992	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	84
PID 2992 wrote to memory of 1484	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	85
PID 2992 wrote to memory of 1484	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	85
PID 2992 wrote to memory of 436	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	86
PID 2992 wrote to memory of 436	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	86
PID 2992 wrote to memory of 3640	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	87
PID 2992 wrote to memory of 3640	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	87
PID 2992 wrote to memory of 3560	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	88
PID 2992 wrote to memory of 3560	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	88
PID 2992 wrote to memory of 4908	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	89
PID 2992 wrote to memory of 4908	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	89
PID 2992 wrote to memory of 4004	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	90
PID 2992 wrote to memory of 4004	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	90
PID 2992 wrote to memory of 3688	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	91
PID 2992 wrote to memory of 3688	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	91
PID 2992 wrote to memory of 1732	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	92
PID 2992 wrote to memory of 1732	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	92
PID 2992 wrote to memory of 4268	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	93
PID 2992 wrote to memory of 4268	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	93
PID 2992 wrote to memory of 4936	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	94
PID 2992 wrote to memory of 4936	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	94
PID 2992 wrote to memory of 4296	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	95
PID 2992 wrote to memory of 4296	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	95
PID 2992 wrote to memory of 4312	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	96
PID 2992 wrote to memory of 4312	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	96
PID 2992 wrote to memory of 2052	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	97
PID 2992 wrote to memory of 2052	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	97
PID 2992 wrote to memory of 2292	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	98
PID 2992 wrote to memory of 2292	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	98
PID 2992 wrote to memory of 4084	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	99
PID 2992 wrote to memory of 4084	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	99
PID 2992 wrote to memory of 2468	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	100
PID 2992 wrote to memory of 2468	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	100
PID 2992 wrote to memory of 2812	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	101
PID 2992 wrote to memory of 2812	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	101
PID 2992 wrote to memory of 336	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	102
PID 2992 wrote to memory of 336	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	102
PID 2992 wrote to memory of 2576	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	103
PID 2992 wrote to memory of 2576	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	103
PID 2992 wrote to memory of 2408	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	104
PID 2992 wrote to memory of 2408	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	104
PID 2992 wrote to memory of 4900	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	105
PID 2992 wrote to memory of 4900	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	105
PID 2992 wrote to memory of 4792	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	106
PID 2992 wrote to memory of 4792	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	106
PID 2992 wrote to memory of 2180	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	107
PID 2992 wrote to memory of 2180	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	107
PID 2992 wrote to memory of 3504	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	108
PID 2992 wrote to memory of 3504	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	108
PID 2992 wrote to memory of 3624	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	109
PID 2992 wrote to memory of 3624	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	109
PID 2992 wrote to memory of 3264	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	110
PID 2992 wrote to memory of 3264	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	110
PID 2992 wrote to memory of 3420	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	111
PID 2992 wrote to memory of 3420	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	111
PID 2992 wrote to memory of 3092	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	112
PID 2992 wrote to memory of 3092	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	112
PID 2992 wrote to memory of 2672	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	113
PID 2992 wrote to memory of 2672	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	113
PID 2992 wrote to memory of 3204	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	114
PID 2992 wrote to memory of 3204	2992	106ff7ba65722b5eec26fe5bfbb234f0N.exe	114

C:\Users\Admin\AppData\Local\Temp\106ff7ba65722b5eec26fe5bfbb234f0N.exe
"C:\Users\Admin\AppData\Local\Temp\106ff7ba65722b5eec26fe5bfbb234f0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System\KlXqPng.exe
  C:\Windows\System\KlXqPng.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\nFVKzXf.exe
  C:\Windows\System\nFVKzXf.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\sxVNNWZ.exe
  C:\Windows\System\sxVNNWZ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\ZZdOTXL.exe
  C:\Windows\System\ZZdOTXL.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\bfeJIJZ.exe
  C:\Windows\System\bfeJIJZ.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\aufSISK.exe
  C:\Windows\System\aufSISK.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\nVmdkUY.exe
  C:\Windows\System\nVmdkUY.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\GRbvuYY.exe
  C:\Windows\System\GRbvuYY.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\QssgsoO.exe
  C:\Windows\System\QssgsoO.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\JfNSIor.exe
  C:\Windows\System\JfNSIor.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\nCNYywj.exe
  C:\Windows\System\nCNYywj.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\WeKzJRa.exe
  C:\Windows\System\WeKzJRa.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\xyvYOVI.exe
  C:\Windows\System\xyvYOVI.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\QfwfoEK.exe
  C:\Windows\System\QfwfoEK.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\smfXMVA.exe
  C:\Windows\System\smfXMVA.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\OzVTPgN.exe
  C:\Windows\System\OzVTPgN.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\PVnuNYK.exe
  C:\Windows\System\PVnuNYK.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\xIFfKDt.exe
  C:\Windows\System\xIFfKDt.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\jOuAqMI.exe
  C:\Windows\System\jOuAqMI.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\lppKXWG.exe
  C:\Windows\System\lppKXWG.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\TWuklOG.exe
  C:\Windows\System\TWuklOG.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\sHZTGiP.exe
  C:\Windows\System\sHZTGiP.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\JaPhhCr.exe
  C:\Windows\System\JaPhhCr.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\LxjdKaQ.exe
  C:\Windows\System\LxjdKaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\SJslbIV.exe
  C:\Windows\System\SJslbIV.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\lUTrfoc.exe
  C:\Windows\System\lUTrfoc.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\uQHroeA.exe
  C:\Windows\System\uQHroeA.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\sMcuyoP.exe
  C:\Windows\System\sMcuyoP.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\NnXDPPC.exe
  C:\Windows\System\NnXDPPC.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\gLmwJbi.exe
  C:\Windows\System\gLmwJbi.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\imCaDZC.exe
  C:\Windows\System\imCaDZC.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\MDiVzSD.exe
  C:\Windows\System\MDiVzSD.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\QLuziXH.exe
  C:\Windows\System\QLuziXH.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\IwtmLqJ.exe
  C:\Windows\System\IwtmLqJ.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\UgSwHzc.exe
  C:\Windows\System\UgSwHzc.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\LGuydhj.exe
  C:\Windows\System\LGuydhj.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\dMDEjvk.exe
  C:\Windows\System\dMDEjvk.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\nBklxZj.exe
  C:\Windows\System\nBklxZj.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\dKoHJBW.exe
  C:\Windows\System\dKoHJBW.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\DMRLvcL.exe
  C:\Windows\System\DMRLvcL.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\ITJAKQS.exe
  C:\Windows\System\ITJAKQS.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\CJOjAea.exe
  C:\Windows\System\CJOjAea.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\qaIHkRC.exe
  C:\Windows\System\qaIHkRC.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\KuCVLzG.exe
  C:\Windows\System\KuCVLzG.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\oSnCiar.exe
  C:\Windows\System\oSnCiar.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\AolTmPO.exe
  C:\Windows\System\AolTmPO.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\hvFeTTE.exe
  C:\Windows\System\hvFeTTE.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\QyrIcdQ.exe
  C:\Windows\System\QyrIcdQ.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\bnBmFAy.exe
  C:\Windows\System\bnBmFAy.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\wWSIQNJ.exe
  C:\Windows\System\wWSIQNJ.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\lqJhWYn.exe
  C:\Windows\System\lqJhWYn.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\dMJKAoZ.exe
  C:\Windows\System\dMJKAoZ.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\MyZcwGt.exe
  C:\Windows\System\MyZcwGt.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\CDxdUMF.exe
  C:\Windows\System\CDxdUMF.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\OQrbSLN.exe
  C:\Windows\System\OQrbSLN.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\RzeNsoO.exe
  C:\Windows\System\RzeNsoO.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\QnYSkOn.exe
  C:\Windows\System\QnYSkOn.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\RspIFwr.exe
  C:\Windows\System\RspIFwr.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\oWwhccP.exe
  C:\Windows\System\oWwhccP.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\JrfxOYc.exe
  C:\Windows\System\JrfxOYc.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\JuomIbz.exe
  C:\Windows\System\JuomIbz.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\sYhEQGl.exe
  C:\Windows\System\sYhEQGl.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\NzXpjMc.exe
  C:\Windows\System\NzXpjMc.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\kKDFAdT.exe
  C:\Windows\System\kKDFAdT.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\WeYAFnm.exe
  C:\Windows\System\WeYAFnm.exe
  2⤵
  PID:1760
- C:\Windows\System\peYVzgt.exe
  C:\Windows\System\peYVzgt.exe
  2⤵
  PID:2276
- C:\Windows\System\vrNKtKb.exe
  C:\Windows\System\vrNKtKb.exe
  2⤵
  PID:1600
- C:\Windows\System\EpBKviP.exe
  C:\Windows\System\EpBKviP.exe
  2⤵
  PID:1840
- C:\Windows\System\jIiNmzw.exe
  C:\Windows\System\jIiNmzw.exe
  2⤵
  PID:2636
- C:\Windows\System\MCpLKRX.exe
  C:\Windows\System\MCpLKRX.exe
  2⤵
  PID:1160
- C:\Windows\System\FEwVgFW.exe
  C:\Windows\System\FEwVgFW.exe
  2⤵
  PID:4168
- C:\Windows\System\RIFPtor.exe
  C:\Windows\System\RIFPtor.exe
  2⤵
  PID:1196
- C:\Windows\System\RepcutK.exe
  C:\Windows\System\RepcutK.exe
  2⤵
  PID:316
- C:\Windows\System\IhHgBYq.exe
  C:\Windows\System\IhHgBYq.exe
  2⤵
  PID:3540
- C:\Windows\System\BIdwCwA.exe
  C:\Windows\System\BIdwCwA.exe
  2⤵
  PID:5032
- C:\Windows\System\IzsCkon.exe
  C:\Windows\System\IzsCkon.exe
  2⤵
  PID:3500
- C:\Windows\System\zSKqOdZ.exe
  C:\Windows\System\zSKqOdZ.exe
  2⤵
  PID:1564
- C:\Windows\System\VvidOqa.exe
  C:\Windows\System\VvidOqa.exe
  2⤵
  PID:3980
- C:\Windows\System\JwArXoH.exe
  C:\Windows\System\JwArXoH.exe
  2⤵
  PID:3600
- C:\Windows\System\yjREmlo.exe
  C:\Windows\System\yjREmlo.exe
  2⤵
  PID:440
- C:\Windows\System\cIgMLWs.exe
  C:\Windows\System\cIgMLWs.exe
  2⤵
  PID:924
- C:\Windows\System\USgCDQY.exe
  C:\Windows\System\USgCDQY.exe
  2⤵
  PID:3864
- C:\Windows\System\VAsDRJp.exe
  C:\Windows\System\VAsDRJp.exe
  2⤵
  PID:3604
- C:\Windows\System\bCyRyQl.exe
  C:\Windows\System\bCyRyQl.exe
  2⤵
  PID:412
- C:\Windows\System\afxzwqp.exe
  C:\Windows\System\afxzwqp.exe
  2⤵
  PID:5124
- C:\Windows\System\BubhMCd.exe
  C:\Windows\System\BubhMCd.exe
  2⤵
  PID:5152
- C:\Windows\System\wliCHWq.exe
  C:\Windows\System\wliCHWq.exe
  2⤵
  PID:5184
- C:\Windows\System\XRogWVA.exe
  C:\Windows\System\XRogWVA.exe
  2⤵
  PID:5208
- C:\Windows\System\pfGLgzP.exe
  C:\Windows\System\pfGLgzP.exe
  2⤵
  PID:5240
- C:\Windows\System\voJebNR.exe
  C:\Windows\System\voJebNR.exe
  2⤵
  PID:5264
- C:\Windows\System\qphjeaT.exe
  C:\Windows\System\qphjeaT.exe
  2⤵
  PID:5332
- C:\Windows\System\XBSyvxd.exe
  C:\Windows\System\XBSyvxd.exe
  2⤵
  PID:5348
- C:\Windows\System\XkmdFXv.exe
  C:\Windows\System\XkmdFXv.exe
  2⤵
  PID:5364
- C:\Windows\System\XXtMRry.exe
  C:\Windows\System\XXtMRry.exe
  2⤵
  PID:5380
- C:\Windows\System\TmaHviB.exe
  C:\Windows\System\TmaHviB.exe
  2⤵
  PID:5408
- C:\Windows\System\wgBUDeG.exe
  C:\Windows\System\wgBUDeG.exe
  2⤵
  PID:5432
- C:\Windows\System\TPosrYX.exe
  C:\Windows\System\TPosrYX.exe
  2⤵
  PID:5460
- C:\Windows\System\uheXPly.exe
  C:\Windows\System\uheXPly.exe
  2⤵
  PID:5488
- C:\Windows\System\DvYCAdm.exe
  C:\Windows\System\DvYCAdm.exe
  2⤵
  PID:5516
- C:\Windows\System\NKHTFUn.exe
  C:\Windows\System\NKHTFUn.exe
  2⤵
  PID:5544
- C:\Windows\System\fDbTpYI.exe
  C:\Windows\System\fDbTpYI.exe
  2⤵
  PID:5572
- C:\Windows\System\fFImrlD.exe
  C:\Windows\System\fFImrlD.exe
  2⤵
  PID:5604
- C:\Windows\System\MeFRapt.exe
  C:\Windows\System\MeFRapt.exe
  2⤵
  PID:5632
- C:\Windows\System\lHdbiZd.exe
  C:\Windows\System\lHdbiZd.exe
  2⤵
  PID:5660
- C:\Windows\System\SLKCrTP.exe
  C:\Windows\System\SLKCrTP.exe
  2⤵
  PID:5688
- C:\Windows\System\LZkNIaa.exe
  C:\Windows\System\LZkNIaa.exe
  2⤵
  PID:5716
- C:\Windows\System\WOBiKEk.exe
  C:\Windows\System\WOBiKEk.exe
  2⤵
  PID:5740
- C:\Windows\System\tNMlssf.exe
  C:\Windows\System\tNMlssf.exe
  2⤵
  PID:5772
- C:\Windows\System\uilpLTi.exe
  C:\Windows\System\uilpLTi.exe
  2⤵
  PID:5796
- C:\Windows\System\CJKMSTm.exe
  C:\Windows\System\CJKMSTm.exe
  2⤵
  PID:5824
- C:\Windows\System\BtvqBge.exe
  C:\Windows\System\BtvqBge.exe
  2⤵
  PID:5852
- C:\Windows\System\Nejbypd.exe
  C:\Windows\System\Nejbypd.exe
  2⤵
  PID:5880
- C:\Windows\System\KejVfSu.exe
  C:\Windows\System\KejVfSu.exe
  2⤵
  PID:5912
- C:\Windows\System\rUjQZTv.exe
  C:\Windows\System\rUjQZTv.exe
  2⤵
  PID:5936
- C:\Windows\System\XMlFLME.exe
  C:\Windows\System\XMlFLME.exe
  2⤵
  PID:5964
- C:\Windows\System\aZUWnOa.exe
  C:\Windows\System\aZUWnOa.exe
  2⤵
  PID:5996
- C:\Windows\System\SytxROl.exe
  C:\Windows\System\SytxROl.exe
  2⤵
  PID:6020
- C:\Windows\System\KxUAaht.exe
  C:\Windows\System\KxUAaht.exe
  2⤵
  PID:6048
- C:\Windows\System\GJsCVlo.exe
  C:\Windows\System\GJsCVlo.exe
  2⤵
  PID:6080
- C:\Windows\System\Bbqahld.exe
  C:\Windows\System\Bbqahld.exe
  2⤵
  PID:6108
- C:\Windows\System\DiqqObt.exe
  C:\Windows\System\DiqqObt.exe
  2⤵
  PID:6132
- C:\Windows\System\QaYiPpV.exe
  C:\Windows\System\QaYiPpV.exe
  2⤵
  PID:392
- C:\Windows\System\OlSIJof.exe
  C:\Windows\System\OlSIJof.exe
  2⤵
  PID:220
- C:\Windows\System\KaRfVYX.exe
  C:\Windows\System\KaRfVYX.exe
  2⤵
  PID:4996
- C:\Windows\System\XgKRnfk.exe
  C:\Windows\System\XgKRnfk.exe
  2⤵
  PID:3676
- C:\Windows\System\IOyjNga.exe
  C:\Windows\System\IOyjNga.exe
  2⤵
  PID:3336
- C:\Windows\System\tYkyCFd.exe
  C:\Windows\System\tYkyCFd.exe
  2⤵
  PID:4016
- C:\Windows\System\aiOMqIE.exe
  C:\Windows\System\aiOMqIE.exe
  2⤵
  PID:5176
- C:\Windows\System\TCrxWRI.exe
  C:\Windows\System\TCrxWRI.exe
  2⤵
  PID:5252
- C:\Windows\System\vUrrEky.exe
  C:\Windows\System\vUrrEky.exe
  2⤵
  PID:5324
- C:\Windows\System\SzCprqM.exe
  C:\Windows\System\SzCprqM.exe
  2⤵
  PID:5376
- C:\Windows\System\mpvTHqN.exe
  C:\Windows\System\mpvTHqN.exe
  2⤵
  PID:5428
- C:\Windows\System\eajHmHu.exe
  C:\Windows\System\eajHmHu.exe
  2⤵
  PID:5484
- C:\Windows\System\LFpdHFt.exe
  C:\Windows\System\LFpdHFt.exe
  2⤵
  PID:5540
- C:\Windows\System\RiUADYZ.exe
  C:\Windows\System\RiUADYZ.exe
  2⤵
  PID:5620
- C:\Windows\System\sEbNxrA.exe
  C:\Windows\System\sEbNxrA.exe
  2⤵
  PID:5676
- C:\Windows\System\nOFIcTn.exe
  C:\Windows\System\nOFIcTn.exe
  2⤵
  PID:5732
- C:\Windows\System\TXZxYQY.exe
  C:\Windows\System\TXZxYQY.exe
  2⤵
  PID:5792
- C:\Windows\System\bIOGCSU.exe
  C:\Windows\System\bIOGCSU.exe
  2⤵
  PID:5868
- C:\Windows\System\kAdMzkd.exe
  C:\Windows\System\kAdMzkd.exe
  2⤵
  PID:5928
- C:\Windows\System\gHumprY.exe
  C:\Windows\System\gHumprY.exe
  2⤵
  PID:5988
- C:\Windows\System\QKqEDty.exe
  C:\Windows\System\QKqEDty.exe
  2⤵
  PID:6064
- C:\Windows\System\fxWrFJO.exe
  C:\Windows\System\fxWrFJO.exe
  2⤵
  PID:6124
- C:\Windows\System\pRtmotm.exe
  C:\Windows\System\pRtmotm.exe
  2⤵
  PID:4388
- C:\Windows\System\OfHHRAG.exe
  C:\Windows\System\OfHHRAG.exe
  2⤵
  PID:4648
- C:\Windows\System\fFIHykJ.exe
  C:\Windows\System\fFIHykJ.exe
  2⤵
  PID:5168
- C:\Windows\System\zafbSao.exe
  C:\Windows\System\zafbSao.exe
  2⤵
  PID:1560
- C:\Windows\System\WDadFzd.exe
  C:\Windows\System\WDadFzd.exe
  2⤵
  PID:3076
- C:\Windows\System\mqpPodi.exe
  C:\Windows\System\mqpPodi.exe
  2⤵
  PID:2220
- C:\Windows\System\RArkaXD.exe
  C:\Windows\System\RArkaXD.exe
  2⤵
  PID:5652
- C:\Windows\System\trvsQeu.exe
  C:\Windows\System\trvsQeu.exe
  2⤵
  PID:5764
- C:\Windows\System\OmayQfK.exe
  C:\Windows\System\OmayQfK.exe
  2⤵
  PID:4736
- C:\Windows\System\RfjVgDR.exe
  C:\Windows\System\RfjVgDR.exe
  2⤵
  PID:2744
- C:\Windows\System\oAxkUmM.exe
  C:\Windows\System\oAxkUmM.exe
  2⤵
  PID:6100
- C:\Windows\System\KmDVRZI.exe
  C:\Windows\System\KmDVRZI.exe
  2⤵
  PID:4368
- C:\Windows\System\opreTnA.exe
  C:\Windows\System\opreTnA.exe
  2⤵
  PID:5228
- C:\Windows\System\dCPZchf.exe
  C:\Windows\System\dCPZchf.exe
  2⤵
  PID:6168
- C:\Windows\System\DJZdghj.exe
  C:\Windows\System\DJZdghj.exe
  2⤵
  PID:6200
- C:\Windows\System\WaBgOhF.exe
  C:\Windows\System\WaBgOhF.exe
  2⤵
  PID:6228
- C:\Windows\System\LWYNlFs.exe
  C:\Windows\System\LWYNlFs.exe
  2⤵
  PID:6252
- C:\Windows\System\LidacGo.exe
  C:\Windows\System\LidacGo.exe
  2⤵
  PID:6280
- C:\Windows\System\jwbRVay.exe
  C:\Windows\System\jwbRVay.exe
  2⤵
  PID:6312
- C:\Windows\System\izHWeVO.exe
  C:\Windows\System\izHWeVO.exe
  2⤵
  PID:6340
- C:\Windows\System\hVLnFBP.exe
  C:\Windows\System\hVLnFBP.exe
  2⤵
  PID:6368
- C:\Windows\System\VgUwfAL.exe
  C:\Windows\System\VgUwfAL.exe
  2⤵
  PID:6392
- C:\Windows\System\JPKMkxL.exe
  C:\Windows\System\JPKMkxL.exe
  2⤵
  PID:6420
- C:\Windows\System\gmYbXCU.exe
  C:\Windows\System\gmYbXCU.exe
  2⤵
  PID:6448
- C:\Windows\System\EnxaDZp.exe
  C:\Windows\System\EnxaDZp.exe
  2⤵
  PID:6476
- C:\Windows\System\ddlMPMw.exe
  C:\Windows\System\ddlMPMw.exe
  2⤵
  PID:6504
- C:\Windows\System\EyCNxmm.exe
  C:\Windows\System\EyCNxmm.exe
  2⤵
  PID:6532
- C:\Windows\System\OUOviqh.exe
  C:\Windows\System\OUOviqh.exe
  2⤵
  PID:6564
- C:\Windows\System\RzHaIeS.exe
  C:\Windows\System\RzHaIeS.exe
  2⤵
  PID:6588
- C:\Windows\System\LrDqGnx.exe
  C:\Windows\System\LrDqGnx.exe
  2⤵
  PID:6616
- C:\Windows\System\CCWVZBG.exe
  C:\Windows\System\CCWVZBG.exe
  2⤵
  PID:6644
- C:\Windows\System\ONrygBo.exe
  C:\Windows\System\ONrygBo.exe
  2⤵
  PID:6676
- C:\Windows\System\OWvJOlQ.exe
  C:\Windows\System\OWvJOlQ.exe
  2⤵
  PID:6804
- C:\Windows\System\DwcwttH.exe
  C:\Windows\System\DwcwttH.exe
  2⤵
  PID:6832
- C:\Windows\System\hEROtFg.exe
  C:\Windows\System\hEROtFg.exe
  2⤵
  PID:6872
- C:\Windows\System\JTiClmv.exe
  C:\Windows\System\JTiClmv.exe
  2⤵
  PID:6888
- C:\Windows\System\splClSo.exe
  C:\Windows\System\splClSo.exe
  2⤵
  PID:6908
- C:\Windows\System\vXBloMk.exe
  C:\Windows\System\vXBloMk.exe
  2⤵
  PID:6928
- C:\Windows\System\Uuaywme.exe
  C:\Windows\System\Uuaywme.exe
  2⤵
  PID:6968
- C:\Windows\System\oYJagNp.exe
  C:\Windows\System\oYJagNp.exe
  2⤵
  PID:7008
- C:\Windows\System\EJysjty.exe
  C:\Windows\System\EJysjty.exe
  2⤵
  PID:7024
- C:\Windows\System\spWKQyv.exe
  C:\Windows\System\spWKQyv.exe
  2⤵
  PID:7056
- C:\Windows\System\umMHnZi.exe
  C:\Windows\System\umMHnZi.exe
  2⤵
  PID:7108
- C:\Windows\System\HpwyPWm.exe
  C:\Windows\System\HpwyPWm.exe
  2⤵
  PID:7124
- C:\Windows\System\cMFWzkm.exe
  C:\Windows\System\cMFWzkm.exe
  2⤵
  PID:1612
- C:\Windows\System\xKUpvDv.exe
  C:\Windows\System\xKUpvDv.exe
  2⤵
  PID:6160
- C:\Windows\System\JmmKyUz.exe
  C:\Windows\System\JmmKyUz.exe
  2⤵
  PID:6192
- C:\Windows\System\DnEDygf.exe
  C:\Windows\System\DnEDygf.exe
  2⤵
  PID:6268
- C:\Windows\System\LeRsfbC.exe
  C:\Windows\System\LeRsfbC.exe
  2⤵
  PID:2236
- C:\Windows\System\zIJTejb.exe
  C:\Windows\System\zIJTejb.exe
  2⤵
  PID:6352
- C:\Windows\System\YXPqLMe.exe
  C:\Windows\System\YXPqLMe.exe
  2⤵
  PID:6380
- C:\Windows\System\JnDKikg.exe
  C:\Windows\System\JnDKikg.exe
  2⤵
  PID:6412
- C:\Windows\System\hoscnrD.exe
  C:\Windows\System\hoscnrD.exe
  2⤵
  PID:6472
- C:\Windows\System\ChgngOe.exe
  C:\Windows\System\ChgngOe.exe
  2⤵
  PID:6520
- C:\Windows\System\DDliESQ.exe
  C:\Windows\System\DDliESQ.exe
  2⤵
  PID:6548
- C:\Windows\System\KPHkiYx.exe
  C:\Windows\System\KPHkiYx.exe
  2⤵
  PID:3440
- C:\Windows\System\SNVUrwc.exe
  C:\Windows\System\SNVUrwc.exe
  2⤵
  PID:2084
- C:\Windows\System\AyAAyKB.exe
  C:\Windows\System\AyAAyKB.exe
  2⤵
  PID:6576
- C:\Windows\System\mvEgsfw.exe
  C:\Windows\System\mvEgsfw.exe
  2⤵
  PID:4148
- C:\Windows\System\IoUKJjG.exe
  C:\Windows\System\IoUKJjG.exe
  2⤵
  PID:4256
- C:\Windows\System\djseRps.exe
  C:\Windows\System\djseRps.exe
  2⤵
  PID:6664
- C:\Windows\System\dwXJANq.exe
  C:\Windows\System\dwXJANq.exe
  2⤵
  PID:4912
- C:\Windows\System\QUdXsOj.exe
  C:\Windows\System\QUdXsOj.exe
  2⤵
  PID:6724
- C:\Windows\System\HpEXAXb.exe
  C:\Windows\System\HpEXAXb.exe
  2⤵
  PID:6748
- C:\Windows\System\YQuDuMz.exe
  C:\Windows\System\YQuDuMz.exe
  2⤵
  PID:6692
- C:\Windows\System\lktCDod.exe
  C:\Windows\System\lktCDod.exe
  2⤵
  PID:3888
- C:\Windows\System\CGAauvh.exe
  C:\Windows\System\CGAauvh.exe
  2⤵
  PID:4324
- C:\Windows\System\kCCCtCH.exe
  C:\Windows\System\kCCCtCH.exe
  2⤵
  PID:6860
- C:\Windows\System\EWtQXYZ.exe
  C:\Windows\System\EWtQXYZ.exe
  2⤵
  PID:6944
- C:\Windows\System\ZttKGbG.exe
  C:\Windows\System\ZttKGbG.exe
  2⤵
  PID:7044
- C:\Windows\System\CZKOkdm.exe
  C:\Windows\System\CZKOkdm.exe
  2⤵
  PID:7120
- C:\Windows\System\EgSChcD.exe
  C:\Windows\System\EgSChcD.exe
  2⤵
  PID:6784
- C:\Windows\System\NAFFvRW.exe
  C:\Windows\System\NAFFvRW.exe
  2⤵
  PID:6796
- C:\Windows\System\uzinLYw.exe
  C:\Windows\System\uzinLYw.exe
  2⤵
  PID:6276
- C:\Windows\System\wCVHyOS.exe
  C:\Windows\System\wCVHyOS.exe
  2⤵
  PID:5000
- C:\Windows\System\VtOSuPM.exe
  C:\Windows\System\VtOSuPM.exe
  2⤵
  PID:4688
- C:\Windows\System\TNrnEnc.exe
  C:\Windows\System\TNrnEnc.exe
  2⤵
  PID:6528
- C:\Windows\System\HZzjxGR.exe
  C:\Windows\System\HZzjxGR.exe
  2⤵
  PID:5344
- C:\Windows\System\VzxefDd.exe
  C:\Windows\System\VzxefDd.exe
  2⤵
  PID:1248
- C:\Windows\System\rCGVxYd.exe
  C:\Windows\System\rCGVxYd.exe
  2⤵
  PID:6956
- C:\Windows\System\SFxEkqk.exe
  C:\Windows\System\SFxEkqk.exe
  2⤵
  PID:2584
- C:\Windows\System\RYxclZJ.exe
  C:\Windows\System\RYxclZJ.exe
  2⤵
  PID:4000
- C:\Windows\System\FXayBPF.exe
  C:\Windows\System\FXayBPF.exe
  2⤵
  PID:6768
- C:\Windows\System\ssyMHdN.exe
  C:\Windows\System\ssyMHdN.exe
  2⤵
  PID:3632
- C:\Windows\System\zAhUsGf.exe
  C:\Windows\System\zAhUsGf.exe
  2⤵
  PID:7004
- C:\Windows\System\xRyUYjw.exe
  C:\Windows\System\xRyUYjw.exe
  2⤵
  PID:7132
- C:\Windows\System\ABiFoiV.exe
  C:\Windows\System\ABiFoiV.exe
  2⤵
  PID:6896
- C:\Windows\System\SRzBckY.exe
  C:\Windows\System\SRzBckY.exe
  2⤵
  PID:4092
- C:\Windows\System\yxWrSsF.exe
  C:\Windows\System\yxWrSsF.exe
  2⤵
  PID:5424
- C:\Windows\System\qWHyPdC.exe
  C:\Windows\System\qWHyPdC.exe
  2⤵
  PID:4820
- C:\Windows\System\ERBvEkz.exe
  C:\Windows\System\ERBvEkz.exe
  2⤵
  PID:6824
- C:\Windows\System\xPcqTzB.exe
  C:\Windows\System\xPcqTzB.exe
  2⤵
  PID:7100
- C:\Windows\System\LcSycSY.exe
  C:\Windows\System\LcSycSY.exe
  2⤵
  PID:6272
- C:\Windows\System\vuayrGy.exe
  C:\Windows\System\vuayrGy.exe
  2⤵
  PID:4408
- C:\Windows\System\XGoWogP.exe
  C:\Windows\System\XGoWogP.exe
  2⤵
  PID:6300
- C:\Windows\System\RRKamAP.exe
  C:\Windows\System\RRKamAP.exe
  2⤵
  PID:6924
- C:\Windows\System\HvhpsrW.exe
  C:\Windows\System\HvhpsrW.exe
  2⤵
  PID:7180
- C:\Windows\System\BlTDaWV.exe
  C:\Windows\System\BlTDaWV.exe
  2⤵
  PID:7212
- C:\Windows\System\YFYyiqU.exe
  C:\Windows\System\YFYyiqU.exe
  2⤵
  PID:7232
- C:\Windows\System\aDoeIAY.exe
  C:\Windows\System\aDoeIAY.exe
  2⤵
  PID:7268
- C:\Windows\System\wEBZPPP.exe
  C:\Windows\System\wEBZPPP.exe
  2⤵
  PID:7284
- C:\Windows\System\wdKjdmt.exe
  C:\Windows\System\wdKjdmt.exe
  2⤵
  PID:7324
- C:\Windows\System\IXaJmlk.exe
  C:\Windows\System\IXaJmlk.exe
  2⤵
  PID:7348
- C:\Windows\System\ArzWbJe.exe
  C:\Windows\System\ArzWbJe.exe
  2⤵
  PID:7380
- C:\Windows\System\LkHMPgS.exe
  C:\Windows\System\LkHMPgS.exe
  2⤵
  PID:7408
- C:\Windows\System\TWZLKGq.exe
  C:\Windows\System\TWZLKGq.exe
  2⤵
  PID:7436
- C:\Windows\System\VGgFscy.exe
  C:\Windows\System\VGgFscy.exe
  2⤵
  PID:7464
- C:\Windows\System\AafGmgT.exe
  C:\Windows\System\AafGmgT.exe
  2⤵
  PID:7492
- C:\Windows\System\TcEENim.exe
  C:\Windows\System\TcEENim.exe
  2⤵
  PID:7520
- C:\Windows\System\TusMBeF.exe
  C:\Windows\System\TusMBeF.exe
  2⤵
  PID:7548
- C:\Windows\System\kORlDxd.exe
  C:\Windows\System\kORlDxd.exe
  2⤵
  PID:7564
- C:\Windows\System\mWDYVQC.exe
  C:\Windows\System\mWDYVQC.exe
  2⤵
  PID:7604
- C:\Windows\System\fUGuVUo.exe
  C:\Windows\System\fUGuVUo.exe
  2⤵
  PID:7632
- C:\Windows\System\bueJHfC.exe
  C:\Windows\System\bueJHfC.exe
  2⤵
  PID:7660
- C:\Windows\System\BMogvGw.exe
  C:\Windows\System\BMogvGw.exe
  2⤵
  PID:7688
- C:\Windows\System\bZFlHtq.exe
  C:\Windows\System\bZFlHtq.exe
  2⤵
  PID:7704
- C:\Windows\System\NKQUyuq.exe
  C:\Windows\System\NKQUyuq.exe
  2⤵
  PID:7740
- C:\Windows\System\EZeOzVh.exe
  C:\Windows\System\EZeOzVh.exe
  2⤵
  PID:7764
- C:\Windows\System\FsjENsU.exe
  C:\Windows\System\FsjENsU.exe
  2⤵
  PID:7796
- C:\Windows\System\IXoQBcV.exe
  C:\Windows\System\IXoQBcV.exe
  2⤵
  PID:7824
- C:\Windows\System\InkazJD.exe
  C:\Windows\System\InkazJD.exe
  2⤵
  PID:7848
- C:\Windows\System\hxKJsGr.exe
  C:\Windows\System\hxKJsGr.exe
  2⤵
  PID:7876
- C:\Windows\System\ovLOSln.exe
  C:\Windows\System\ovLOSln.exe
  2⤵
  PID:7912
- C:\Windows\System\FBuYJkL.exe
  C:\Windows\System\FBuYJkL.exe
  2⤵
  PID:7932
- C:\Windows\System\AiNtznH.exe
  C:\Windows\System\AiNtznH.exe
  2⤵
  PID:7972
- C:\Windows\System\yQcthle.exe
  C:\Windows\System\yQcthle.exe
  2⤵
  PID:7988
- C:\Windows\System\uWqmhvo.exe
  C:\Windows\System\uWqmhvo.exe
  2⤵
  PID:8004
- C:\Windows\System\hpsgleA.exe
  C:\Windows\System\hpsgleA.exe
  2⤵
  PID:8056
- C:\Windows\System\rwLWjOa.exe
  C:\Windows\System\rwLWjOa.exe
  2⤵
  PID:8072
- C:\Windows\System\jhxhgNl.exe
  C:\Windows\System\jhxhgNl.exe
  2⤵
  PID:8112
- C:\Windows\System\bnhLgJQ.exe
  C:\Windows\System\bnhLgJQ.exe
  2⤵
  PID:8140
- C:\Windows\System\qnOiqSs.exe
  C:\Windows\System\qnOiqSs.exe
  2⤵
  PID:8168
- C:\Windows\System\HZysJdq.exe
  C:\Windows\System\HZysJdq.exe
  2⤵
  PID:7192
- C:\Windows\System\sVLrepV.exe
  C:\Windows\System\sVLrepV.exe
  2⤵
  PID:7224
- C:\Windows\System\oNfBeke.exe
  C:\Windows\System\oNfBeke.exe
  2⤵
  PID:7280
- C:\Windows\System\YAgkuvE.exe
  C:\Windows\System\YAgkuvE.exe
  2⤵
  PID:7376
- C:\Windows\System\MIpeYGC.exe
  C:\Windows\System\MIpeYGC.exe
  2⤵
  PID:7420
- C:\Windows\System\NKFtjqv.exe
  C:\Windows\System\NKFtjqv.exe
  2⤵
  PID:7480
- C:\Windows\System\cZltetT.exe
  C:\Windows\System\cZltetT.exe
  2⤵
  PID:7532
- C:\Windows\System\glNhsFy.exe
  C:\Windows\System\glNhsFy.exe
  2⤵
  PID:7616
- C:\Windows\System\PHhjvXk.exe
  C:\Windows\System\PHhjvXk.exe
  2⤵
  PID:7696
- C:\Windows\System\AhtywPC.exe
  C:\Windows\System\AhtywPC.exe
  2⤵
  PID:7760
- C:\Windows\System\FNHDOng.exe
  C:\Windows\System\FNHDOng.exe
  2⤵
  PID:7816
- C:\Windows\System\Nwmjgki.exe
  C:\Windows\System\Nwmjgki.exe
  2⤵
  PID:7892
- C:\Windows\System\oqtqVDT.exe
  C:\Windows\System\oqtqVDT.exe
  2⤵
  PID:7952
- C:\Windows\System\BmbKhZD.exe
  C:\Windows\System\BmbKhZD.exe
  2⤵
  PID:8040
- C:\Windows\System\NYVlKjS.exe
  C:\Windows\System\NYVlKjS.exe
  2⤵
  PID:8104
- C:\Windows\System\uWWxoAn.exe
  C:\Windows\System\uWWxoAn.exe
  2⤵
  PID:8156
- C:\Windows\System\WhmFbtg.exe
  C:\Windows\System\WhmFbtg.exe
  2⤵
  PID:7256
- C:\Windows\System\WgMtWdp.exe
  C:\Windows\System\WgMtWdp.exe
  2⤵
  PID:7428
- C:\Windows\System\hOJjJZO.exe
  C:\Windows\System\hOJjJZO.exe
  2⤵
  PID:7512
- C:\Windows\System\tXDvZgo.exe
  C:\Windows\System\tXDvZgo.exe
  2⤵
  PID:7776
- C:\Windows\System\HIICuHi.exe
  C:\Windows\System\HIICuHi.exe
  2⤵
  PID:7832
- C:\Windows\System\JHgNiEF.exe
  C:\Windows\System\JHgNiEF.exe
  2⤵
  PID:7964
- C:\Windows\System\AIJUZeQ.exe
  C:\Windows\System\AIJUZeQ.exe
  2⤵
  PID:7164
- C:\Windows\System\Ajuvmvb.exe
  C:\Windows\System\Ajuvmvb.exe
  2⤵
  PID:7448
- C:\Windows\System\DAzXkDg.exe
  C:\Windows\System\DAzXkDg.exe
  2⤵
  PID:7516
- C:\Windows\System\YtmDFAO.exe
  C:\Windows\System\YtmDFAO.exe
  2⤵
  PID:8204
- C:\Windows\System\ehVbzIt.exe
  C:\Windows\System\ehVbzIt.exe
  2⤵
  PID:8248
- C:\Windows\System\yojPHzi.exe
  C:\Windows\System\yojPHzi.exe
  2⤵
  PID:8264
- C:\Windows\System\TyifjJG.exe
  C:\Windows\System\TyifjJG.exe
  2⤵
  PID:8292
- C:\Windows\System\ltlyHLT.exe
  C:\Windows\System\ltlyHLT.exe
  2⤵
  PID:8320
- C:\Windows\System\VPThgde.exe
  C:\Windows\System\VPThgde.exe
  2⤵
  PID:8340
- C:\Windows\System\HFyvJod.exe
  C:\Windows\System\HFyvJod.exe
  2⤵
  PID:8376
- C:\Windows\System\GCYxNpa.exe
  C:\Windows\System\GCYxNpa.exe
  2⤵
  PID:8404
- C:\Windows\System\cEPjADB.exe
  C:\Windows\System\cEPjADB.exe
  2⤵
  PID:8420
- C:\Windows\System\lWlkTlG.exe
  C:\Windows\System\lWlkTlG.exe
  2⤵
  PID:8460
- C:\Windows\System\AYxepDL.exe
  C:\Windows\System\AYxepDL.exe
  2⤵
  PID:8480
- C:\Windows\System\NEpzxOx.exe
  C:\Windows\System\NEpzxOx.exe
  2⤵
  PID:8504
- C:\Windows\System\rKWPbyC.exe
  C:\Windows\System\rKWPbyC.exe
  2⤵
  PID:8536
- C:\Windows\System\TsleMvc.exe
  C:\Windows\System\TsleMvc.exe
  2⤵
  PID:8564
- C:\Windows\System\lwHffdn.exe
  C:\Windows\System\lwHffdn.exe
  2⤵
  PID:8588
- C:\Windows\System\ckmvqpv.exe
  C:\Windows\System\ckmvqpv.exe
  2⤵
  PID:8612
- C:\Windows\System\UrLVxAZ.exe
  C:\Windows\System\UrLVxAZ.exe
  2⤵
  PID:8628
- C:\Windows\System\gsTcYIU.exe
  C:\Windows\System\gsTcYIU.exe
  2⤵
  PID:8644
- C:\Windows\System\jAUhjBy.exe
  C:\Windows\System\jAUhjBy.exe
  2⤵
  PID:8668
- C:\Windows\System\MbTPpQo.exe
  C:\Windows\System\MbTPpQo.exe
  2⤵
  PID:8712
- C:\Windows\System\mPeoHsX.exe
  C:\Windows\System\mPeoHsX.exe
  2⤵
  PID:8740
- C:\Windows\System\aNBExcU.exe
  C:\Windows\System\aNBExcU.exe
  2⤵
  PID:8776
- C:\Windows\System\xPPOqCT.exe
  C:\Windows\System\xPPOqCT.exe
  2⤵
  PID:8800
- C:\Windows\System\XbaFUNO.exe
  C:\Windows\System\XbaFUNO.exe
  2⤵
  PID:8832
- C:\Windows\System\ruJGEyT.exe
  C:\Windows\System\ruJGEyT.exe
  2⤵
  PID:8856
- C:\Windows\System\xNfutTY.exe
  C:\Windows\System\xNfutTY.exe
  2⤵
  PID:8888
- C:\Windows\System\lvAEfSK.exe
  C:\Windows\System\lvAEfSK.exe
  2⤵
  PID:8916
- C:\Windows\System\tuwnIVs.exe
  C:\Windows\System\tuwnIVs.exe
  2⤵
  PID:8956
- C:\Windows\System\dwyJVvu.exe
  C:\Windows\System\dwyJVvu.exe
  2⤵
  PID:8972
- C:\Windows\System\yVLpBHx.exe
  C:\Windows\System\yVLpBHx.exe
  2⤵
  PID:9004
- C:\Windows\System\yYQkmfa.exe
  C:\Windows\System\yYQkmfa.exe
  2⤵
  PID:9040
- C:\Windows\System\ZrNEIyH.exe
  C:\Windows\System\ZrNEIyH.exe
  2⤵
  PID:9068
- C:\Windows\System\WUOYcVx.exe
  C:\Windows\System\WUOYcVx.exe
  2⤵
  PID:9084
- C:\Windows\System\KqGBpeK.exe
  C:\Windows\System\KqGBpeK.exe
  2⤵
  PID:9136
- C:\Windows\System\wjfEDvR.exe
  C:\Windows\System\wjfEDvR.exe
  2⤵
  PID:9164
- C:\Windows\System\JxqLVzw.exe
  C:\Windows\System\JxqLVzw.exe
  2⤵
  PID:9180
- C:\Windows\System\NFIUFTt.exe
  C:\Windows\System\NFIUFTt.exe
  2⤵
  PID:9208
- C:\Windows\System\ViKbHHR.exe
  C:\Windows\System\ViKbHHR.exe
  2⤵
  PID:8260
- C:\Windows\System\WZLpsAf.exe
  C:\Windows\System\WZLpsAf.exe
  2⤵
  PID:8312
- C:\Windows\System\zTCYbIY.exe
  C:\Windows\System\zTCYbIY.exe
  2⤵
  PID:8388
- C:\Windows\System\irQufJq.exe
  C:\Windows\System\irQufJq.exe
  2⤵
  PID:8456
- C:\Windows\System\kMsgXAC.exe
  C:\Windows\System\kMsgXAC.exe
  2⤵
  PID:8520
- C:\Windows\System\yblOSYS.exe
  C:\Windows\System\yblOSYS.exe
  2⤵
  PID:8552
- C:\Windows\System\SkMqqmz.exe
  C:\Windows\System\SkMqqmz.exe
  2⤵
  PID:8688
- C:\Windows\System\GstwOmH.exe
  C:\Windows\System\GstwOmH.exe
  2⤵
  PID:8692
- C:\Windows\System\wRSxkLL.exe
  C:\Windows\System\wRSxkLL.exe
  2⤵
  PID:8796
- C:\Windows\System\DulSgVo.exe
  C:\Windows\System\DulSgVo.exe
  2⤵
  PID:8840
- C:\Windows\System\lBCMvMR.exe
  C:\Windows\System\lBCMvMR.exe
  2⤵
  PID:8880
- C:\Windows\System\JLHpsum.exe
  C:\Windows\System\JLHpsum.exe
  2⤵
  PID:8984
- C:\Windows\System\CxEsIMP.exe
  C:\Windows\System\CxEsIMP.exe
  2⤵
  PID:8996
- C:\Windows\System\cpMoWaU.exe
  C:\Windows\System\cpMoWaU.exe
  2⤵
  PID:9076
- C:\Windows\System\aPqSkfU.exe
  C:\Windows\System\aPqSkfU.exe
  2⤵
  PID:9156
- C:\Windows\System\SGnRIeN.exe
  C:\Windows\System\SGnRIeN.exe
  2⤵
  PID:9204
- C:\Windows\System\eOAlFbK.exe
  C:\Windows\System\eOAlFbK.exe
  2⤵
  PID:8360
- C:\Windows\System\YRrvQqL.exe
  C:\Windows\System\YRrvQqL.exe
  2⤵
  PID:8496
- C:\Windows\System\rWZyCle.exe
  C:\Windows\System\rWZyCle.exe
  2⤵
  PID:8708
- C:\Windows\System\WgXlmyP.exe
  C:\Windows\System\WgXlmyP.exe
  2⤵
  PID:8828
- C:\Windows\System\QuzZpJN.exe
  C:\Windows\System\QuzZpJN.exe
  2⤵
  PID:9028
- C:\Windows\System\isTVZQR.exe
  C:\Windows\System\isTVZQR.exe
  2⤵
  PID:9192
- C:\Windows\System\NDaTcxf.exe
  C:\Windows\System\NDaTcxf.exe
  2⤵
  PID:8232
- C:\Windows\System\VLHHtXY.exe
  C:\Windows\System\VLHHtXY.exe
  2⤵
  PID:8728
- C:\Windows\System\AoViTvD.exe
  C:\Windows\System\AoViTvD.exe
  2⤵
  PID:8932
- C:\Windows\System\eYpLCqI.exe
  C:\Windows\System\eYpLCqI.exe
  2⤵
  PID:9128
- C:\Windows\System\MbCInsk.exe
  C:\Windows\System\MbCInsk.exe
  2⤵
  PID:9224
- C:\Windows\System\QKSjItw.exe
  C:\Windows\System\QKSjItw.exe
  2⤵
  PID:9252
- C:\Windows\System\PPsIthv.exe
  C:\Windows\System\PPsIthv.exe
  2⤵
  PID:9272
- C:\Windows\System\wOHTIYu.exe
  C:\Windows\System\wOHTIYu.exe
  2⤵
  PID:9308
- C:\Windows\System\DytzEGJ.exe
  C:\Windows\System\DytzEGJ.exe
  2⤵
  PID:9348
- C:\Windows\System\jQNVsSh.exe
  C:\Windows\System\jQNVsSh.exe
  2⤵
  PID:9376
- C:\Windows\System\XDKpkcm.exe
  C:\Windows\System\XDKpkcm.exe
  2⤵
  PID:9404
- C:\Windows\System\svRfkko.exe
  C:\Windows\System\svRfkko.exe
  2⤵
  PID:9428
- C:\Windows\System\RgRlXka.exe
  C:\Windows\System\RgRlXka.exe
  2⤵
  PID:9448
- C:\Windows\System\cQSVIfQ.exe
  C:\Windows\System\cQSVIfQ.exe
  2⤵
  PID:9480
- C:\Windows\System\YJTyQSQ.exe
  C:\Windows\System\YJTyQSQ.exe
  2⤵
  PID:9508
- C:\Windows\System\XxFPjmC.exe
  C:\Windows\System\XxFPjmC.exe
  2⤵
  PID:9536
- C:\Windows\System\zFvUswa.exe
  C:\Windows\System\zFvUswa.exe
  2⤵
  PID:9572
- C:\Windows\System\ceKkgEH.exe
  C:\Windows\System\ceKkgEH.exe
  2⤵
  PID:9600
- C:\Windows\System\YmKlwsg.exe
  C:\Windows\System\YmKlwsg.exe
  2⤵
  PID:9648
- C:\Windows\System\VUHHCNV.exe
  C:\Windows\System\VUHHCNV.exe
  2⤵
  PID:9664
- C:\Windows\System\rgyeUNY.exe
  C:\Windows\System\rgyeUNY.exe
  2⤵
  PID:9692
- C:\Windows\System\hxggOVI.exe
  C:\Windows\System\hxggOVI.exe
  2⤵
  PID:9724
- C:\Windows\System\OiLrYHc.exe
  C:\Windows\System\OiLrYHc.exe
  2⤵
  PID:9752
- C:\Windows\System\ZRTvZfe.exe
  C:\Windows\System\ZRTvZfe.exe
  2⤵
  PID:9780
- C:\Windows\System\Pvkqegr.exe
  C:\Windows\System\Pvkqegr.exe
  2⤵
  PID:9808
- C:\Windows\System\qzAuKSb.exe
  C:\Windows\System\qzAuKSb.exe
  2⤵
  PID:9836
- C:\Windows\System\OwjSdQU.exe
  C:\Windows\System\OwjSdQU.exe
  2⤵
  PID:9852
- C:\Windows\System\fHOGGpH.exe
  C:\Windows\System\fHOGGpH.exe
  2⤵
  PID:9896
- C:\Windows\System\XnPSDNy.exe
  C:\Windows\System\XnPSDNy.exe
  2⤵
  PID:9928
- C:\Windows\System\VhcRPrr.exe
  C:\Windows\System\VhcRPrr.exe
  2⤵
  PID:9964
- C:\Windows\System\eoiUlzt.exe
  C:\Windows\System\eoiUlzt.exe
  2⤵
  PID:9992
- C:\Windows\System\HtPYdpn.exe
  C:\Windows\System\HtPYdpn.exe
  2⤵
  PID:10020
- C:\Windows\System\mPYlPlQ.exe
  C:\Windows\System\mPYlPlQ.exe
  2⤵
  PID:10048
- C:\Windows\System\WBoSGBi.exe
  C:\Windows\System\WBoSGBi.exe
  2⤵
  PID:10076
- C:\Windows\System\bwUfuHt.exe
  C:\Windows\System\bwUfuHt.exe
  2⤵
  PID:10096
- C:\Windows\System\mkkzhyk.exe
  C:\Windows\System\mkkzhyk.exe
  2⤵
  PID:10120
- C:\Windows\System\bUsatiz.exe
  C:\Windows\System\bUsatiz.exe
  2⤵
  PID:10160
- C:\Windows\System\tdNcZwn.exe
  C:\Windows\System\tdNcZwn.exe
  2⤵
  PID:10180
- C:\Windows\System\LGNIJpp.exe
  C:\Windows\System\LGNIJpp.exe
  2⤵
  PID:10200
- C:\Windows\System\dlEUIAc.exe
  C:\Windows\System\dlEUIAc.exe
  2⤵
  PID:10232
- C:\Windows\System\WbgbVsk.exe
  C:\Windows\System\WbgbVsk.exe
  2⤵
  PID:8256
- C:\Windows\System\moWMpai.exe
  C:\Windows\System\moWMpai.exe
  2⤵
  PID:9364
- C:\Windows\System\KisEEnB.exe
  C:\Windows\System\KisEEnB.exe
  2⤵
  PID:9424
- C:\Windows\System\jIYOfRO.exe
  C:\Windows\System\jIYOfRO.exe
  2⤵
  PID:9476
- C:\Windows\System\FMpMUvK.exe
  C:\Windows\System\FMpMUvK.exe
  2⤵
  PID:9516
- C:\Windows\System\YmzDOhK.exe
  C:\Windows\System\YmzDOhK.exe
  2⤵
  PID:9584
- C:\Windows\System\OGPXnOz.exe
  C:\Windows\System\OGPXnOz.exe
  2⤵
  PID:9656
- C:\Windows\System\RuNgJVZ.exe
  C:\Windows\System\RuNgJVZ.exe
  2⤵
  PID:9748
- C:\Windows\System\UiZIPls.exe
  C:\Windows\System\UiZIPls.exe
  2⤵
  PID:9824
- C:\Windows\System\lNMatyM.exe
  C:\Windows\System\lNMatyM.exe
  2⤵
  PID:9884
- C:\Windows\System\EjYnIMx.exe
  C:\Windows\System\EjYnIMx.exe
  2⤵
  PID:9924
- C:\Windows\System\VsJkaJr.exe
  C:\Windows\System\VsJkaJr.exe
  2⤵
  PID:10012
- C:\Windows\System\RZGJdTn.exe
  C:\Windows\System\RZGJdTn.exe
  2⤵
  PID:10092
- C:\Windows\System\OZChyZM.exe
  C:\Windows\System\OZChyZM.exe
  2⤵
  PID:10152
- C:\Windows\System\ckjZqWP.exe
  C:\Windows\System\ckjZqWP.exe
  2⤵
  PID:10196
- C:\Windows\System\OCFKUBj.exe
  C:\Windows\System\OCFKUBj.exe
  2⤵
  PID:9344
- C:\Windows\System\oGIHUGU.exe
  C:\Windows\System\oGIHUGU.exe
  2⤵
  PID:9500
- C:\Windows\System\VafzUlg.exe
  C:\Windows\System\VafzUlg.exe
  2⤵
  PID:9608
- C:\Windows\System\ulgIZBp.exe
  C:\Windows\System\ulgIZBp.exe
  2⤵
  PID:9868
- C:\Windows\System\RWYLtPO.exe
  C:\Windows\System\RWYLtPO.exe
  2⤵
  PID:9980
- C:\Windows\System\GOjrQiQ.exe
  C:\Windows\System\GOjrQiQ.exe
  2⤵
  PID:10116
- C:\Windows\System\mdTCDyl.exe
  C:\Windows\System\mdTCDyl.exe
  2⤵
  PID:9392
- C:\Windows\System\MpcnkVk.exe
  C:\Windows\System\MpcnkVk.exe
  2⤵
  PID:9716
- C:\Windows\System\twJjoOb.exe
  C:\Windows\System\twJjoOb.exe
  2⤵
  PID:10136
- C:\Windows\System\ZscDoRC.exe
  C:\Windows\System\ZscDoRC.exe
  2⤵
  PID:9268
- C:\Windows\System\jqZqLMc.exe
  C:\Windows\System\jqZqLMc.exe
  2⤵
  PID:9336
- C:\Windows\System\juOLDXp.exe
  C:\Windows\System\juOLDXp.exe
  2⤵
  PID:10252
- C:\Windows\System\wPBAMgo.exe
  C:\Windows\System\wPBAMgo.exe
  2⤵
  PID:10292
- C:\Windows\System\wCQEmvF.exe
  C:\Windows\System\wCQEmvF.exe
  2⤵
  PID:10320
- C:\Windows\System\zorAmiV.exe
  C:\Windows\System\zorAmiV.exe
  2⤵
  PID:10344
- C:\Windows\System\tEqJnru.exe
  C:\Windows\System\tEqJnru.exe
  2⤵
  PID:10364
- C:\Windows\System\rIGcFSS.exe
  C:\Windows\System\rIGcFSS.exe
  2⤵
  PID:10384
- C:\Windows\System\LCAmjSP.exe
  C:\Windows\System\LCAmjSP.exe
  2⤵
  PID:10432
- C:\Windows\System\yTIwABk.exe
  C:\Windows\System\yTIwABk.exe
  2⤵
  PID:10464
- C:\Windows\System\EzHQCOi.exe
  C:\Windows\System\EzHQCOi.exe
  2⤵
  PID:10492
- C:\Windows\System\kbYhtXt.exe
  C:\Windows\System\kbYhtXt.exe
  2⤵
  PID:10520
- C:\Windows\System\KAdhcVL.exe
  C:\Windows\System\KAdhcVL.exe
  2⤵
  PID:10548
- C:\Windows\System\ABAdGaN.exe
  C:\Windows\System\ABAdGaN.exe
  2⤵
  PID:10580
- C:\Windows\System\RPXBscD.exe
  C:\Windows\System\RPXBscD.exe
  2⤵
  PID:10608
- C:\Windows\System\LNgDVpg.exe
  C:\Windows\System\LNgDVpg.exe
  2⤵
  PID:10636
- C:\Windows\System\tHmnNcC.exe
  C:\Windows\System\tHmnNcC.exe
  2⤵
  PID:10664
- C:\Windows\System\skBcAkg.exe
  C:\Windows\System\skBcAkg.exe
  2⤵
  PID:10680
- C:\Windows\System\OesOyxA.exe
  C:\Windows\System\OesOyxA.exe
  2⤵
  PID:10720
- C:\Windows\System\xsERjUW.exe
  C:\Windows\System\xsERjUW.exe
  2⤵
  PID:10736
- C:\Windows\System\sSBFQai.exe
  C:\Windows\System\sSBFQai.exe
  2⤵
  PID:10768
- C:\Windows\System\lwhSZxO.exe
  C:\Windows\System\lwhSZxO.exe
  2⤵
  PID:10796
- C:\Windows\System\VPKarzI.exe
  C:\Windows\System\VPKarzI.exe
  2⤵
  PID:10836
- C:\Windows\System\iBqQjyT.exe
  C:\Windows\System\iBqQjyT.exe
  2⤵
  PID:10856
- C:\Windows\System\zsznFTU.exe
  C:\Windows\System\zsznFTU.exe
  2⤵
  PID:10892
- C:\Windows\System\EXswBVh.exe
  C:\Windows\System\EXswBVh.exe
  2⤵
  PID:10920
- C:\Windows\System\OjJCSEq.exe
  C:\Windows\System\OjJCSEq.exe
  2⤵
  PID:10944
- C:\Windows\System\koufQIZ.exe
  C:\Windows\System\koufQIZ.exe
  2⤵
  PID:10964
- C:\Windows\System\IuKIBvu.exe
  C:\Windows\System\IuKIBvu.exe
  2⤵
  PID:11004
- C:\Windows\System\qEgCfzy.exe
  C:\Windows\System\qEgCfzy.exe
  2⤵
  PID:11020
- C:\Windows\System\BzQOccq.exe
  C:\Windows\System\BzQOccq.exe
  2⤵
  PID:11036
- C:\Windows\System\WnAhKlx.exe
  C:\Windows\System\WnAhKlx.exe
  2⤵
  PID:11056
- C:\Windows\System\HExNnXS.exe
  C:\Windows\System\HExNnXS.exe
  2⤵
  PID:11076
- C:\Windows\System\thWTqxm.exe
  C:\Windows\System\thWTqxm.exe
  2⤵
  PID:11096
- C:\Windows\System\wAlSlXE.exe
  C:\Windows\System\wAlSlXE.exe
  2⤵
  PID:11156
- C:\Windows\System\utErWoh.exe
  C:\Windows\System\utErWoh.exe
  2⤵
  PID:11188
- C:\Windows\System\jwOtqwA.exe
  C:\Windows\System\jwOtqwA.exe
  2⤵
  PID:11228
- C:\Windows\System\lbIXvqv.exe
  C:\Windows\System\lbIXvqv.exe
  2⤵
  PID:11244
- C:\Windows\System\ygfzBOQ.exe
  C:\Windows\System\ygfzBOQ.exe
  2⤵
  PID:10248
- C:\Windows\System\DysxRPL.exe
  C:\Windows\System\DysxRPL.exe
  2⤵
  PID:10328
- C:\Windows\System\cXUceLT.exe
  C:\Windows\System\cXUceLT.exe
  2⤵
  PID:10380
- C:\Windows\System\sSrPNvk.exe
  C:\Windows\System\sSrPNvk.exe
  2⤵
  PID:10460
- C:\Windows\System\nHPUzHM.exe
  C:\Windows\System\nHPUzHM.exe
  2⤵
  PID:10504
- C:\Windows\System\DUiNpeC.exe
  C:\Windows\System\DUiNpeC.exe
  2⤵
  PID:10592
- C:\Windows\System\hEKBpMd.exe
  C:\Windows\System\hEKBpMd.exe
  2⤵
  PID:10656
- C:\Windows\System\lZSmPbY.exe
  C:\Windows\System\lZSmPbY.exe
  2⤵
  PID:10732
- C:\Windows\System\JfUqjBV.exe
  C:\Windows\System\JfUqjBV.exe
  2⤵
  PID:10752
- C:\Windows\System\KDnPlzs.exe
  C:\Windows\System\KDnPlzs.exe
  2⤵
  PID:10852
- C:\Windows\System\GFOkQTL.exe
  C:\Windows\System\GFOkQTL.exe
  2⤵
  PID:10908
- C:\Windows\System\hVWBrkq.exe
  C:\Windows\System\hVWBrkq.exe
  2⤵
  PID:10984
- C:\Windows\System\HVLzVcZ.exe
  C:\Windows\System\HVLzVcZ.exe
  2⤵
  PID:11048
- C:\Windows\System\frCGBjO.exe
  C:\Windows\System\frCGBjO.exe
  2⤵
  PID:11084
- C:\Windows\System\KhMKIDd.exe
  C:\Windows\System\KhMKIDd.exe
  2⤵
  PID:11144
- C:\Windows\System\SldLOTJ.exe
  C:\Windows\System\SldLOTJ.exe
  2⤵
  PID:11240
- C:\Windows\System\FHiCghv.exe
  C:\Windows\System\FHiCghv.exe
  2⤵
  PID:10244
- C:\Windows\System\xBlDKBi.exe
  C:\Windows\System\xBlDKBi.exe
  2⤵
  PID:10424
- C:\Windows\System\RdTjFVL.exe
  C:\Windows\System\RdTjFVL.exe
  2⤵
  PID:10604
- C:\Windows\System\KFVKvIo.exe
  C:\Windows\System\KFVKvIo.exe
  2⤵
  PID:10728
- C:\Windows\System\WClyLyy.exe
  C:\Windows\System\WClyLyy.exe
  2⤵
  PID:10912
- C:\Windows\System\uLSmEQj.exe
  C:\Windows\System\uLSmEQj.exe
  2⤵
  PID:11184
- C:\Windows\System\WVkICsj.exe
  C:\Windows\System\WVkICsj.exe
  2⤵
  PID:9636
- C:\Windows\System\CXjmeGZ.exe
  C:\Windows\System\CXjmeGZ.exe
  2⤵
  PID:10792
- C:\Windows\System\KvDpcvc.exe
  C:\Windows\System\KvDpcvc.exe
  2⤵
  PID:10932
- C:\Windows\System\aTyOgEZ.exe
  C:\Windows\System\aTyOgEZ.exe
  2⤵
  PID:10420
- C:\Windows\System\WugQtZc.exe
  C:\Windows\System\WugQtZc.exe
  2⤵
  PID:10952
- C:\Windows\System\bQusNiR.exe
  C:\Windows\System\bQusNiR.exe
  2⤵
  PID:11288
- C:\Windows\System\mccxMSt.exe
  C:\Windows\System\mccxMSt.exe
  2⤵
  PID:11312
- C:\Windows\System\uGtEQKm.exe
  C:\Windows\System\uGtEQKm.exe
  2⤵
  PID:11344
- C:\Windows\System\UTtBBTS.exe
  C:\Windows\System\UTtBBTS.exe
  2⤵
  PID:11372
- C:\Windows\System\ezVohhN.exe
  C:\Windows\System\ezVohhN.exe
  2⤵
  PID:11412
- C:\Windows\System\AQTiEaC.exe
  C:\Windows\System\AQTiEaC.exe
  2⤵
  PID:11440
- C:\Windows\System\JIfYWBM.exe
  C:\Windows\System\JIfYWBM.exe
  2⤵
  PID:11468
- C:\Windows\System\OocKbFH.exe
  C:\Windows\System\OocKbFH.exe
  2⤵
  PID:11496
- C:\Windows\System\TpmIwSo.exe
  C:\Windows\System\TpmIwSo.exe
  2⤵
  PID:11524
- C:\Windows\System\MFAgusb.exe
  C:\Windows\System\MFAgusb.exe
  2⤵
  PID:11556
- C:\Windows\System\IkkRnNB.exe
  C:\Windows\System\IkkRnNB.exe
  2⤵
  PID:11584
- C:\Windows\System\FIbuYWY.exe
  C:\Windows\System\FIbuYWY.exe
  2⤵
  PID:11612
- C:\Windows\System\QvobllY.exe
  C:\Windows\System\QvobllY.exe
  2⤵
  PID:11628
- C:\Windows\System\bsuFIjb.exe
  C:\Windows\System\bsuFIjb.exe
  2⤵
  PID:11644
- C:\Windows\System\ZslruuA.exe
  C:\Windows\System\ZslruuA.exe
  2⤵
  PID:11668
- C:\Windows\System\HiuEsEw.exe
  C:\Windows\System\HiuEsEw.exe
  2⤵
  PID:11704
- C:\Windows\System\heepQQa.exe
  C:\Windows\System\heepQQa.exe
  2⤵
  PID:11752
- C:\Windows\System\GrnJeVe.exe
  C:\Windows\System\GrnJeVe.exe
  2⤵
  PID:11780
- C:\Windows\System\JOdpJvu.exe
  C:\Windows\System\JOdpJvu.exe
  2⤵
  PID:11808
- C:\Windows\System\yTXcNdR.exe
  C:\Windows\System\yTXcNdR.exe
  2⤵
  PID:11828
- C:\Windows\System\lkPBpNa.exe
  C:\Windows\System\lkPBpNa.exe
  2⤵
  PID:11856
- C:\Windows\System\KbbSfRB.exe
  C:\Windows\System\KbbSfRB.exe
  2⤵
  PID:11888
- C:\Windows\System\vcKqEnk.exe
  C:\Windows\System\vcKqEnk.exe
  2⤵
  PID:11924
- C:\Windows\System\mGFupsI.exe
  C:\Windows\System\mGFupsI.exe
  2⤵
  PID:11940
- C:\Windows\System\TNEDkhT.exe
  C:\Windows\System\TNEDkhT.exe
  2⤵
  PID:11964
- C:\Windows\System\WUsEVXe.exe
  C:\Windows\System\WUsEVXe.exe
  2⤵
  PID:12008
- C:\Windows\System\FCGvcqG.exe
  C:\Windows\System\FCGvcqG.exe
  2⤵
  PID:12024
- C:\Windows\System\XpslKKw.exe
  C:\Windows\System\XpslKKw.exe
  2⤵
  PID:12060
- C:\Windows\System\UlQEJyv.exe
  C:\Windows\System\UlQEJyv.exe
  2⤵
  PID:12080
- C:\Windows\System\WQVoHng.exe
  C:\Windows\System\WQVoHng.exe
  2⤵
  PID:12120
- C:\Windows\System\fcIpjbE.exe
  C:\Windows\System\fcIpjbE.exe
  2⤵
  PID:12156
- C:\Windows\System\ffLsddH.exe
  C:\Windows\System\ffLsddH.exe
  2⤵
  PID:12184
- C:\Windows\System\thFTmxb.exe
  C:\Windows\System\thFTmxb.exe
  2⤵
  PID:12208
- C:\Windows\System\NWTMRpi.exe
  C:\Windows\System\NWTMRpi.exe
  2⤵
  PID:12232
- C:\Windows\System\xjIGVRt.exe
  C:\Windows\System\xjIGVRt.exe
  2⤵
  PID:12260
- C:\Windows\System\UfeIuyW.exe
  C:\Windows\System\UfeIuyW.exe
  2⤵
  PID:10828
- C:\Windows\System\YjUYLrC.exe
  C:\Windows\System\YjUYLrC.exe
  2⤵
  PID:11276
- C:\Windows\System\PqfHcQI.exe
  C:\Windows\System\PqfHcQI.exe
  2⤵
  PID:11360
- C:\Windows\System\smTStye.exe
  C:\Windows\System\smTStye.exe
  2⤵
  PID:11404
- C:\Windows\System\tLQwJWJ.exe
  C:\Windows\System\tLQwJWJ.exe
  2⤵
  PID:11484
- C:\Windows\System\EDBrdAS.exe
  C:\Windows\System\EDBrdAS.exe
  2⤵
  PID:11544
- C:\Windows\System\gBitPRF.exe
  C:\Windows\System\gBitPRF.exe
  2⤵
  PID:11596
- C:\Windows\System\jCUKcqa.exe
  C:\Windows\System\jCUKcqa.exe
  2⤵
  PID:11624
- C:\Windows\System\yndlNaU.exe
  C:\Windows\System\yndlNaU.exe
  2⤵
  PID:11744
- C:\Windows\System\vqyYJZN.exe
  C:\Windows\System\vqyYJZN.exe
  2⤵
  PID:11836
- C:\Windows\System\esktjQH.exe
  C:\Windows\System\esktjQH.exe
  2⤵
  PID:11908
- C:\Windows\System\Bkrdobo.exe
  C:\Windows\System\Bkrdobo.exe
  2⤵
  PID:11932
- C:\Windows\System\LBwakMF.exe
  C:\Windows\System\LBwakMF.exe
  2⤵
  PID:11996
- C:\Windows\System\vYPMZLM.exe
  C:\Windows\System\vYPMZLM.exe
  2⤵
  PID:12068
- C:\Windows\System\ZMOFzbh.exe
  C:\Windows\System\ZMOFzbh.exe
  2⤵
  PID:12136
- C:\Windows\System\YnslChP.exe
  C:\Windows\System\YnslChP.exe
  2⤵
  PID:12240
- C:\Windows\System\hENviMc.exe
  C:\Windows\System\hENviMc.exe
  2⤵
  PID:11304
- C:\Windows\System\aCNXDoB.exe
  C:\Windows\System\aCNXDoB.exe
  2⤵
  PID:11464
- C:\Windows\System\zQekpBc.exe
  C:\Windows\System\zQekpBc.exe
  2⤵
  PID:11604
- C:\Windows\System\xoDxbdh.exe
  C:\Windows\System\xoDxbdh.exe
  2⤵
  PID:11712
- C:\Windows\System\uSGdZyc.exe
  C:\Windows\System\uSGdZyc.exe
  2⤵
  PID:11920
- C:\Windows\System\MXJMNVh.exe
  C:\Windows\System\MXJMNVh.exe
  2⤵
  PID:11980
- C:\Windows\System\ljnJvTm.exe
  C:\Windows\System\ljnJvTm.exe
  2⤵
  PID:12216
- C:\Windows\System\nSRfQDY.exe
  C:\Windows\System\nSRfQDY.exe
  2⤵
  PID:11356
- C:\Windows\System\gXvivrz.exe
  C:\Windows\System\gXvivrz.exe
  2⤵
  PID:11580
- C:\Windows\System\lCEonIQ.exe
  C:\Windows\System\lCEonIQ.exe
  2⤵
  PID:11904
- C:\Windows\System\NIdfuqQ.exe
  C:\Windows\System\NIdfuqQ.exe
  2⤵
  PID:12192
- C:\Windows\System\cSlMusA.exe
  C:\Windows\System\cSlMusA.exe
  2⤵
  PID:12116
- C:\Windows\System\KJUMEQA.exe
  C:\Windows\System\KJUMEQA.exe
  2⤵
  PID:12292
- C:\Windows\System\cVlHvxG.exe
  C:\Windows\System\cVlHvxG.exe
  2⤵
  PID:12316
- C:\Windows\System\xoGOfQc.exe
  C:\Windows\System\xoGOfQc.exe
  2⤵
  PID:12344
- C:\Windows\System\ruiSJKe.exe
  C:\Windows\System\ruiSJKe.exe
  2⤵
  PID:12368
- C:\Windows\System\eIxzLVg.exe
  C:\Windows\System\eIxzLVg.exe
  2⤵
  PID:12412
- C:\Windows\System\VzHCRor.exe
  C:\Windows\System\VzHCRor.exe
  2⤵
  PID:12456
- C:\Windows\System\efSMtDS.exe
  C:\Windows\System\efSMtDS.exe
  2⤵
  PID:12484
- C:\Windows\System\EMLlyKF.exe
  C:\Windows\System\EMLlyKF.exe
  2⤵
  PID:12504
- C:\Windows\System\dzIBAvK.exe
  C:\Windows\System\dzIBAvK.exe
  2⤵
  PID:12528
- C:\Windows\System\eBCgAwN.exe
  C:\Windows\System\eBCgAwN.exe
  2⤵
  PID:12572
- C:\Windows\System\RnZbnkA.exe
  C:\Windows\System\RnZbnkA.exe
  2⤵
  PID:12600
- C:\Windows\System\XKhgDns.exe
  C:\Windows\System\XKhgDns.exe
  2⤵
  PID:12648
- C:\Windows\System\NjYqNJG.exe
  C:\Windows\System\NjYqNJG.exe
  2⤵
  PID:12664
- C:\Windows\System\PXEcqaH.exe
  C:\Windows\System\PXEcqaH.exe
  2⤵
  PID:12688
- C:\Windows\System\rMbocgI.exe
  C:\Windows\System\rMbocgI.exe
  2⤵
  PID:12708
- C:\Windows\System\IKxETFo.exe
  C:\Windows\System\IKxETFo.exe
  2⤵
  PID:12748
- C:\Windows\System\gLSTgDx.exe
  C:\Windows\System\gLSTgDx.exe
  2⤵
  PID:12776
- C:\Windows\System\rbCeABE.exe
  C:\Windows\System\rbCeABE.exe
  2⤵
  PID:12804
- C:\Windows\System\PBrjYkG.exe
  C:\Windows\System\PBrjYkG.exe
  2⤵
  PID:12832
- C:\Windows\System\YVnwIMs.exe
  C:\Windows\System\YVnwIMs.exe
  2⤵
  PID:12860
- C:\Windows\System\dgTDJUg.exe
  C:\Windows\System\dgTDJUg.exe
  2⤵
  PID:12888
- C:\Windows\System\Jihrfzh.exe
  C:\Windows\System\Jihrfzh.exe
  2⤵
  PID:12924
- C:\Windows\System\FuDBKsq.exe
  C:\Windows\System\FuDBKsq.exe
  2⤵
  PID:12948
- C:\Windows\System\HOicVQe.exe
  C:\Windows\System\HOicVQe.exe
  2⤵
  PID:12968
- C:\Windows\System\BlBLEtL.exe
  C:\Windows\System\BlBLEtL.exe
  2⤵
  PID:12992
- C:\Windows\System\EnGSySp.exe
  C:\Windows\System\EnGSySp.exe
  2⤵
  PID:13024
- C:\Windows\System\ROActxh.exe
  C:\Windows\System\ROActxh.exe
  2⤵
  PID:13052
- C:\Windows\System\thHRtjF.exe
  C:\Windows\System\thHRtjF.exe
  2⤵
  PID:13084
- C:\Windows\System\kWlugqy.exe
  C:\Windows\System\kWlugqy.exe
  2⤵
  PID:13104
- C:\Windows\System\RviRgwT.exe
  C:\Windows\System\RviRgwT.exe
  2⤵
  PID:13136
- C:\Windows\System\gxMKGCD.exe
  C:\Windows\System\gxMKGCD.exe
  2⤵
  PID:13152
- C:\Windows\System\qkPWkhj.exe
  C:\Windows\System\qkPWkhj.exe
  2⤵
  PID:13184
- C:\Windows\System\XipAlFb.exe
  C:\Windows\System\XipAlFb.exe
  2⤵
  PID:13208
- C:\Windows\System\PTcQaLF.exe
  C:\Windows\System\PTcQaLF.exe
  2⤵
  PID:13240
- C:\Windows\System\SACkDTG.exe
  C:\Windows\System\SACkDTG.exe
  2⤵
  PID:13272
- C:\Windows\System\MuCzpFf.exe
  C:\Windows\System\MuCzpFf.exe
  2⤵
  PID:11792
- C:\Windows\System\jeREeeI.exe
  C:\Windows\System\jeREeeI.exe
  2⤵
  PID:12356
- C:\Windows\System\WUdvoEA.exe
  C:\Windows\System\WUdvoEA.exe
  2⤵
  PID:12396
- C:\Windows\System\tvZCzLE.exe
  C:\Windows\System\tvZCzLE.exe
  2⤵
  PID:12452
- C:\Windows\System\FtsfpLO.exe
  C:\Windows\System\FtsfpLO.exe
  2⤵
  PID:12516
- C:\Windows\System\NRkdtkV.exe
  C:\Windows\System\NRkdtkV.exe
  2⤵
  PID:12568
- C:\Windows\System\pPTbIDR.exe
  C:\Windows\System\pPTbIDR.exe
  2⤵
  PID:12676
- C:\Windows\System\QISJVDR.exe
  C:\Windows\System\QISJVDR.exe
  2⤵
  PID:12736
- C:\Windows\System\mQrKEQs.exe
  C:\Windows\System\mQrKEQs.exe
  2⤵
  PID:12844
- C:\Windows\System\tGsBuNk.exe
  C:\Windows\System\tGsBuNk.exe
  2⤵
  PID:12916
- C:\Windows\System\vMmXVud.exe
  C:\Windows\System\vMmXVud.exe
  2⤵
  PID:12976
- C:\Windows\System\JfbAfhC.exe
  C:\Windows\System\JfbAfhC.exe
  2⤵
  PID:13036
- C:\Windows\System\FsnwazA.exe
  C:\Windows\System\FsnwazA.exe
  2⤵
  PID:13096
- C:\Windows\System\MCGapRJ.exe
  C:\Windows\System\MCGapRJ.exe
  2⤵
  PID:13164
- C:\Windows\System\mPGbyrC.exe
  C:\Windows\System\mPGbyrC.exe
  2⤵
  PID:13224
- C:\Windows\System\QtpWEer.exe
  C:\Windows\System\QtpWEer.exe
  2⤵
  PID:13296
- C:\Windows\System\Zoqqgyb.exe
  C:\Windows\System\Zoqqgyb.exe
  2⤵
  PID:13288
- C:\Windows\System\ieQkEiD.exe
  C:\Windows\System\ieQkEiD.exe
  2⤵
  PID:12332
- C:\Windows\System\WcKWykP.exe
  C:\Windows\System\WcKWykP.exe
  2⤵
  PID:12424
- C:\Windows\System\SplFdua.exe
  C:\Windows\System\SplFdua.exe
  2⤵
  PID:12616
- C:\Windows\System\UecfgUa.exe
  C:\Windows\System\UecfgUa.exe
  2⤵
  PID:12792
- C:\Windows\System\WgqyuHs.exe
  C:\Windows\System\WgqyuHs.exe
  2⤵
  PID:12964
- C:\Windows\System\QwxHInO.exe
  C:\Windows\System\QwxHInO.exe
  2⤵
  PID:13100
- C:\Windows\System\chtSMfw.exe
  C:\Windows\System\chtSMfw.exe
  2⤵
  PID:1440
- C:\Windows\System\HqUNSSK.exe
  C:\Windows\System\HqUNSSK.exe
  2⤵
  PID:2396
- C:\Windows\System\vQBfUgH.exe
  C:\Windows\System\vQBfUgH.exe
  2⤵
  PID:12740
- C:\Windows\System\vDBAJyd.exe
  C:\Windows\System\vDBAJyd.exe
  2⤵
  PID:13068
- C:\Windows\System\KkxxNfJ.exe
  C:\Windows\System\KkxxNfJ.exe
  2⤵
  PID:13308
- C:\Windows\System\zXnvVpE.exe
  C:\Windows\System\zXnvVpE.exe
  2⤵
  PID:12700
- C:\Windows\System\yqgdgzn.exe
  C:\Windows\System\yqgdgzn.exe
  2⤵
  PID:12564
- C:\Windows\System\DJjGZaU.exe
  C:\Windows\System\DJjGZaU.exe
  2⤵
  PID:13332
- C:\Windows\System\blxtcNB.exe
  C:\Windows\System\blxtcNB.exe
  2⤵
  PID:13360
- C:\Windows\System\IUjJcWm.exe
  C:\Windows\System\IUjJcWm.exe
  2⤵
  PID:13388
- C:\Windows\System\WEbUYbb.exe
  C:\Windows\System\WEbUYbb.exe
  2⤵
  PID:13420
- C:\Windows\System\PQSmfmg.exe
  C:\Windows\System\PQSmfmg.exe
  2⤵
  PID:13448
- C:\Windows\System\NSUBeQX.exe
  C:\Windows\System\NSUBeQX.exe
  2⤵
  PID:13476
- C:\Windows\System\suxeurA.exe
  C:\Windows\System\suxeurA.exe
  2⤵
  PID:13492
- C:\Windows\System\PoxFAUo.exe
  C:\Windows\System\PoxFAUo.exe
  2⤵
  PID:13532
- C:\Windows\System\qxJfnjy.exe
  C:\Windows\System\qxJfnjy.exe
  2⤵
  PID:13560
- C:\Windows\System\pvHElbH.exe
  C:\Windows\System\pvHElbH.exe
  2⤵
  PID:13588
- C:\Windows\System\PBfMUnS.exe
  C:\Windows\System\PBfMUnS.exe
  2⤵
  PID:13616
- C:\Windows\System\zZcXdsg.exe
  C:\Windows\System\zZcXdsg.exe
  2⤵
  PID:13644
- C:\Windows\System\NPgzBSw.exe
  C:\Windows\System\NPgzBSw.exe
  2⤵
  PID:13672
- C:\Windows\System\sPrLkZp.exe
  C:\Windows\System\sPrLkZp.exe
  2⤵
  PID:13700
- C:\Windows\System\GcMZfwZ.exe
  C:\Windows\System\GcMZfwZ.exe
  2⤵
  PID:13728
- C:\Windows\System\AxSYKNV.exe
  C:\Windows\System\AxSYKNV.exe
  2⤵
  PID:13788
- C:\Windows\System\XDkbnEP.exe
  C:\Windows\System\XDkbnEP.exe
  2⤵
  PID:13820
- C:\Windows\System\zUrmLSG.exe
  C:\Windows\System\zUrmLSG.exe
  2⤵
  PID:13836
- C:\Windows\System\rNqwKEx.exe
  C:\Windows\System\rNqwKEx.exe
  2⤵
  PID:13852
- C:\Windows\System\zjxeYdP.exe
  C:\Windows\System\zjxeYdP.exe
  2⤵
  PID:13872
- C:\Windows\System\oMYmfhP.exe
  C:\Windows\System\oMYmfhP.exe
  2⤵
  PID:13908
- C:\Windows\System\qxmxYUQ.exe
  C:\Windows\System\qxmxYUQ.exe
  2⤵
  PID:13940
- C:\Windows\System\ogMumTN.exe
  C:\Windows\System\ogMumTN.exe
  2⤵
  PID:13964
- C:\Windows\System\DOVSrVI.exe
  C:\Windows\System\DOVSrVI.exe
  2⤵
  PID:13988
- C:\Windows\System\jLqEkcR.exe
  C:\Windows\System\jLqEkcR.exe
  2⤵
  PID:14040
- C:\Windows\System\wxgXjrf.exe
  C:\Windows\System\wxgXjrf.exe
  2⤵
  PID:14072
- C:\Windows\System\lCYRIvj.exe
  C:\Windows\System\lCYRIvj.exe
  2⤵
  PID:14100
- C:\Windows\System\iTsogXw.exe
  C:\Windows\System\iTsogXw.exe
  2⤵
  PID:14132
- C:\Windows\System\lqHZBqy.exe
  C:\Windows\System\lqHZBqy.exe
  2⤵
  PID:14160
- C:\Windows\System\QxRdoTG.exe
  C:\Windows\System\QxRdoTG.exe
  2⤵
  PID:14216
- C:\Windows\System\fbwrNlD.exe
  C:\Windows\System\fbwrNlD.exe
  2⤵
  PID:14232
- C:\Windows\System\HXQvqlV.exe
  C:\Windows\System\HXQvqlV.exe
  2⤵
  PID:14256
- C:\Windows\System\fFtRxuf.exe
  C:\Windows\System\fFtRxuf.exe
  2⤵
  PID:14280
- C:\Windows\System\GHVansN.exe
  C:\Windows\System\GHVansN.exe
  2⤵
  PID:14328
- C:\Windows\System\zyvKvpL.exe
  C:\Windows\System\zyvKvpL.exe
  2⤵
  PID:13352
- C:\Windows\System\oraHWbv.exe
  C:\Windows\System\oraHWbv.exe
  2⤵
  PID:13400
- C:\Windows\System\xVagfHs.exe
  C:\Windows\System\xVagfHs.exe
  2⤵
  PID:13444
- C:\Windows\System\FrXOVvR.exe
  C:\Windows\System\FrXOVvR.exe
  2⤵
  PID:13556
- C:\Windows\System\FHgEwJT.exe
  C:\Windows\System\FHgEwJT.exe
  2⤵
  PID:13612
- C:\Windows\System\uQOVUAw.exe
  C:\Windows\System\uQOVUAw.exe
  2⤵
  PID:13664
- C:\Windows\System\wXzGnSY.exe
  C:\Windows\System\wXzGnSY.exe
  2⤵
  PID:13740
- C:\Windows\System\DEKrQAf.exe
  C:\Windows\System\DEKrQAf.exe
  2⤵
  PID:13808
- C:\Windows\System\BcXPuaR.exe
  C:\Windows\System\BcXPuaR.exe
  2⤵
  PID:13864
- C:\Windows\System\KjFexWN.exe
  C:\Windows\System\KjFexWN.exe
  2⤵
  PID:13928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\GRbvuYY.exe

Filesize
1.8MB

MD5
5a6b89c2166753e5f36a56ca6ff3f576

SHA1
993cef86471fb1e67119315489a9a2546ad20b70

SHA256
eabbc33c55d4ba745f0133b90a8d8118fba8300b808f16da7863068cfc91cde7

SHA512
be1084a4d6c7a593bb96ee4736f517a6ccc9a46d7a5e00691c5a8950830354200072e114b87355144eef7af332e385e521371729ddf81741c095b4625913f911

Download Submit
C:\Windows\System\JaPhhCr.exe

Filesize
1.8MB

MD5
cef7ca73ef99a540a60b454a850c04a8

SHA1
58114f51fcfc6014fe718cad389366f0fd0052cf

SHA256
753adf66d766015342eb9805c54d3e3faa47e80ecdb3dbd894f4103f9b01de46

SHA512
e4540c935c7fd4c11fb48793688f09335287b1cd655b9b36762f0d7acb44cd9128517f4c721a5ca1ca80290aa22e17775c9266ebc2332e1e63819e9f845fa297

Download Submit
C:\Windows\System\JfNSIor.exe

Filesize
1.8MB

MD5
3bb3eb41f58362f858076356c121e04a

SHA1
4eceeccf4d9ed194b56760107885c57d4ec90e1f

SHA256
924b18f4f00f68bac278665cc42437a30277edc6b9125d953853c62ab50ff388

SHA512
7cc951c76b9918c4c52e42161c02f6cfa8da8978eca79eea621dcd229f911227d055c5f09e5fd4c400209e43f6357670e8e7571ed9b18ab9f20dfe9b6df58c35

Download Submit
C:\Windows\System\KlXqPng.exe

Filesize
1.8MB

MD5
227bc719dc2a7c618586ec98843abd4b

SHA1
9f38065097894ef2dbc40a5b0c8846ac787f8592

SHA256
819ad00124465d46059ff4272545cff99a3a94e530337b6b423c52ae97fee6c6

SHA512
594bad84456bc37d74a252e4ac89524efe54febf1a5655f3437387f302527661a136195c5b2d61c1e4089bfd0c28564e54a72cd6108a17195cbb15533613948e

Download Submit
C:\Windows\System\LxjdKaQ.exe

Filesize
1.8MB

MD5
bcbe13e12df9d3fdd5f795933038bc42

SHA1
e956b22b3c9a7d98d467260131112bd1fe691558

SHA256
e0a333429257ffcdc1491319a23140a3bbb2a1064f9f210e8d4917360eac65d0

SHA512
c38efa9c2f93337ec16dbea029b34ce0ecced01c6d76b3ee605b1e969eb6c7addacb3fec8a768760e07ea50ef2e1343446eec9f322bd8c394cda5a7c080f7183

Download Submit
C:\Windows\System\MDiVzSD.exe

Filesize
1.8MB

MD5
680c3a2fa0511ebf4913d764aaf4a2ea

SHA1
1f9628c0cf4cb29ec11461f72648063a137cfd1a

SHA256
de3773d8202e74df656187b293498fe1de662e4643d97aad230f25e20c661436

SHA512
3e7de2e246f2e6c98c0cc884c6f4141af73b3247f1d2fbe53aab9dd3f31a755ff7bf19924153edac0e2578ddeae08664b92e730dfc6277254499d5e106782ca2

Download Submit
C:\Windows\System\NnXDPPC.exe

Filesize
1.8MB

MD5
a46ec3152eaed922c2e9d1fefbffaf24

SHA1
a485ca49ae4f017e4aff5277178fd57d2e68824d

SHA256
1fb8276fdcd6396bd87262d9c313402f2c948bafd02c8c254a4f42c9155f88eb

SHA512
bd8a274f5a0fca18499955f6cd5b827ed7c0fd99785958ed697d0b2343afc86db0a9200c93bff3c0242d6e5b2ffe3bf720f18b2bc5e8db86747cfaeea31ce77d

Download Submit
C:\Windows\System\OzVTPgN.exe

Filesize
1.8MB

MD5
09f58b2f5ad2733b718f7856cb59049d

SHA1
305bcdab5606cdbae9b63775e7ea764f0032b57c

SHA256
c9d040fe42b95020e8a1bfd98eb91bef77af6045aada0153f6742a2dcd178c68

SHA512
11dd410b7b6561e97ef051bc74f634918b2372e68d566a9b88b8aa353b7f321e1373edcebfa35a890ae2a92d6116e41062a0e43e02c7b38a18bb9274bd00a32c

Download Submit
C:\Windows\System\PVnuNYK.exe

Filesize
1.8MB

MD5
caf77bc9c284dffe11981e2e4cb5cdab

SHA1
57acc28d538cc73fb900698d4f8dcbc992a44db7

SHA256
06d7229b806119a739adddfd2b0091ee59fd41e1438374bcd84e181488fa3de8

SHA512
08b91347e77bed31eb57110f5cc806d5e2a6e2ec56b88eae4ff3b4f09fc2466f32d090547b09804c22ff3cb8bddead01491405bef7c93a83b1a54559389ec1e2

Download Submit
C:\Windows\System\QLuziXH.exe

Filesize
1.8MB

MD5
ef9f2f98a98ef48a7376f836dc2b8537

SHA1
8bca76840d13de6d537386c0ea003161f7199dea

SHA256
23002f3074e4dc19a3752a0999845baba66023face7dd7772eebe6f9153c4e39

SHA512
25299ecf1a315edb5234f2d5d7f9b340129a3614cfb868d0ee23f7a0d74c1c7584ee0e55c16bdf87b952ab90b7edec4cd31e83247c78f60c04ee7c400a08c69d

Download Submit
C:\Windows\System\QfwfoEK.exe

Filesize
1.8MB

MD5
3153bac25843ccd68be41c99f52421b2

SHA1
10e97487f7effea68c1866be398ddfa93887cb2d

SHA256
d20e7bc60b0456439379c989d99bd5b49fccef90e784ef25ec7891d39bdc0912

SHA512
53bdfeb416d898f5606f3716b72f202a3c3105fbaed97d839592d1e4a07904b4a91d579c958eee62ffe0df9539559e958495a5a60b5416c1b70c61cdb5575725

Download Submit
C:\Windows\System\QssgsoO.exe

Filesize
1.8MB

MD5
7341770da2c7083326496022c9aa49e5

SHA1
068d7f24354c9edf1b0affae989d700ccc2882fd

SHA256
94651882c7f206a86aeea01840d6d5c54306e1302eaf415da0c12d0137376be7

SHA512
ff9c2e666ffe840855805ebde8fe91a57fb52bedfd24f07a9f21af44821916247128644b6639c83bd7f7c423f7e587318e5ec6f75e77860d3318132e6f482d00

Download Submit
C:\Windows\System\SJslbIV.exe

Filesize
1.8MB

MD5
283bdde8608db8ae148c8ace38c6d467

SHA1
68d86d20b1c68030d7f78508ed9f75860814c7d3

SHA256
5c81c6a9d3bdad80d679e8314b37c9f79bf3fc9155dec3749f4d1e1d103e90c3

SHA512
780561ccc23202dd328e8eb1696150400e29923ab017bc804e6c06c403ec61e744fb14fe19a9078522092676249aaa95588523b8e0ef44a70ec1edb90017c7a0

Download Submit
C:\Windows\System\TWuklOG.exe

Filesize
1.8MB

MD5
3152b4931a6882f52c5b86a30bb73b76

SHA1
5e9c61e92aa9491bdb73777b8f506d133656c757

SHA256
d9404bdc8776486aab89939c68dd614de125f4115fb264ac10afd38fff8bc07a

SHA512
f3d9cb14bd8ffe95380e01f4bad189ffb9f5607c9cc709234d0e29a42637651421044032e89b7b760b6057317bf0beb939a0211c22dcb24ff94fcaa41ec57dea

Download Submit
C:\Windows\System\WeKzJRa.exe

Filesize
1.8MB

MD5
c63abb0f7bf6a3accc97463b30cb029a

SHA1
bfb1d6e1cc658840fcc7ce4534ecf2d5b4e004dc

SHA256
933d7f609730291f40cdb4d52a059ddb3e7c58887746ad38f3a30c8a9343b7d5

SHA512
a9ffe16966040e5615440fdda74c6f30133e96bfc08ffece59c4408bb774f89ac13e57bd8b3278227af374d3ed52ffb7d9f202012b6658e76b863138b33d6c2a

Download Submit
C:\Windows\System\ZZdOTXL.exe

Filesize
1.8MB

MD5
19dee852f4125977797eb5aa942d8cb4

SHA1
6e51e0727d3227955b2327b2a2cec480c023a907

SHA256
bdf60d13f7fc6fb73f80a5fddbc224d7e4b94fcbd2cf9606dabc0bb2ca7cfa94

SHA512
61a2236cc97265731cc1726f02fb232c3244e8915b6515308d19de582631acd1c26163ed2e9f2b1b9b71b24b7dc67a1ae286dfdc413572642411a44ef92df9d0

Download Submit
C:\Windows\System\aufSISK.exe

Filesize
1.8MB

MD5
330333f1209864086c1bf9058dc030a4

SHA1
b8bdc2c6d70654de8ced248521d661b417e9fffa

SHA256
da69405b6562c5d10c25deffe4fa50153e6174fec099e9fddf214ea519efcb2d

SHA512
afcde6b0ecda874b1e399fdff2780c677d627eeae5b716aa2449a124df5e208f7fe1c1cb0e4050e32725de8ceb3e4dc33cc596eac36a08a7603224972d5ad46b

Download Submit
C:\Windows\System\bfeJIJZ.exe

Filesize
1.8MB

MD5
7497073790a3fae856c451552775fa1e

SHA1
ec773b80c3d64ab28faeb76dc0892308f42f01aa

SHA256
17bb41e679d5c8ecaafe850194158f0836db8c569c8fe070cb596f6d4fc7de45

SHA512
3f00d7c8081d996f1333f280acb711e1946be3cdd2dbdefc67f72a2197d403145315f8dbb04d050802968ddb43debeb01b9e514d99de8840b670dd0c85afe8ce

Download Submit
C:\Windows\System\gLmwJbi.exe

Filesize
1.8MB

MD5
772c4cbba512434651ecac1870991446

SHA1
eb2fbef001fa6db1be0a48560155eb31592209c0

SHA256
b0fca83f9b58cfdf5374b961733387e906883e2c93b7e470f6c06c91fee5b9ee

SHA512
aae5572f247ab7cfceaa202fd31dfcbde340f40bbd26c1518c08b561368d62b5dcd734708b86eb2c98bd0641f0d0daf1b8276bd4eefe90ee0779004861c79498

Download Submit
C:\Windows\System\imCaDZC.exe

Filesize
1.8MB

MD5
95e3952d4a53035f16b7f4bfbe34c22f

SHA1
061066f283d01a8ce3442f1a059b80d4fd8d8173

SHA256
f96d721a7fe807cb2526c4c654a9db41bd014d6a6501a09c5eaa37f2e11f3029

SHA512
c1a2535db33acc42da2e4edb74577b7fa945acf8c14a0cb814f972f63875263c5e630462d0870da3e347a34d9bbc92640e3c814c8145ac7dccbb381948b1b3e5

Download Submit
C:\Windows\System\jOuAqMI.exe

Filesize
1.8MB

MD5
d8b4459d876012127e0dec5728f52dad

SHA1
8748d2b0c2f32d8c39e04fe2291e0c0a761d54e2

SHA256
63ff4d05ce9fb00d416e12f9a4295442777e3ca4a396f0c08dec523374a732db

SHA512
f99e14032b77847592c79479e95e683aa3b90ba32ba5c611167040066553d195cc1efd6e792fb08e9f5daac90cadcf1413427284727596a8a974db16b9d23641

Download Submit
C:\Windows\System\lUTrfoc.exe

Filesize
1.8MB

MD5
47ae60510a1f6b0593c8934b034711e7

SHA1
59269c06d8e6f022358e8d3181ed254e03990c4c

SHA256
e0f01c5a82bd4fcade709b13f8e7038809a92d34a5cc925d49ef166d0646381a

SHA512
834fb2fad35f5629adc75ccdf18de7c82740f86b517a71306e59db21fad57b6438647f71c4917297fa9f1af6f3515b75365f399213a25fba553c9b72bbd475a7

Download Submit
C:\Windows\System\lppKXWG.exe

Filesize
1.8MB

MD5
8483817757ea227c5beccaaafbd019e7

SHA1
0780228080ab3c5f4eba84d4c6e99b32db328bea

SHA256
504abd87cc15ca6ef1806eb56a4e32ac2e7525d707d669ea4381d2a9ccd260a4

SHA512
a7bd3aa81feb58310863dd17b07479742a35ceccbc6bc653deeb76b93cd99a29431b21746d9e4323f04150d90bff522a838c5edba5d4399b3de0f6cad92e3742

Download Submit
C:\Windows\System\nCNYywj.exe

Filesize
1.8MB

MD5
b4b927183210f49cab0c84254024edb1

SHA1
fde4b600d069936befbf8ca766bef33cb48c5b6b

SHA256
fd9f7e2bcb65cbbf97e12b1a0e3de184464b0a505408039de0ff9625ea66e08f

SHA512
a5f54a2d212e3e95c8ef700349eb9f12aa3b5f211e3b330906c688be71b8a19de2c27f9ade187c4dd25865860a853605bffb84b0529e5290c8444136c670e7e5

Download Submit
C:\Windows\System\nFVKzXf.exe

Filesize
1.8MB

MD5
43f69c88e506887b5996276de89daeeb

SHA1
f4e92710f95c91a897d7284b333a417a9c642e3b

SHA256
7b3040860e6d4446aefa889da76a9f99d0e6b198db97e491ee4fcc35e9d8272a

SHA512
fa5dea6d506f7206ccbdb64b9d5a7edf358859c3d160c5df98ffe233adb903b80d272cc52187ec6590c65ed94edd9bda06a66676463290d3fca0b5b5ae9fd84c

Download Submit
C:\Windows\System\nVmdkUY.exe

Filesize
1.8MB

MD5
828263c6ecd319f229b97aac0558a26d

SHA1
e450880a360eb125274773c1419ae564ce40d515

SHA256
75fd1474fc09b53586f667093d1b0bc80371f1227e38bf6df3b03bc69e0e294a

SHA512
e1191c30adb09ed02c5e559c2cd7ef2642d7d9186d1427a1e4537399c4d618f23d47703239899cdef5aac3d5da47948ed7357c13b587b66e8bd6b3d14afe48a2

Download Submit
C:\Windows\System\sHZTGiP.exe

Filesize
1.8MB

MD5
835379f80241834ed11b6855fc2e5792

SHA1
a9b4341fb43e934baf7dad0f3927a408e723781a

SHA256
c02a04c1c3a2a974ee73414c7dfc43d91aa4fef08c4bd7f2658d34d9ff36056d

SHA512
2ac822991bd997bb590e10da0e8b4b0e3fa6ccd54d53ebec999ae9e0a80abdcb22e16ede6dba897ef30f0995a6e21aa1d876edd66c0339acf879ba1fcaaa44fa

Download Submit
C:\Windows\System\sMcuyoP.exe

Filesize
1.8MB

MD5
8bf6745def04e0ccec623e0bb37fbc67

SHA1
2d2043eaf1c33e0f44ad31f73d620020f972f92e

SHA256
a259356d0faa06d04c94d0bd976e479cf471296b025df33f0886d8641b50b2d5

SHA512
285d24e599671ab8e2875c2acc085ea242b2803f9e4a5d1e4233033523750ab8e5179c084413dbca222d434f1fdbe820a0720bba6dfebc92eac24bc4ada68532

Download Submit
C:\Windows\System\smfXMVA.exe

Filesize
1.8MB

MD5
41ef28d98b5eb0afeb68fbb864e15e93

SHA1
e713b8f7751382c7e1ac1ffd6ef412aac4e6dbd9

SHA256
6e461cf79fd8fcfc23d49f2269c20ac96a9297e5d936b7181e15336ca7975554

SHA512
67c1b96bb8f2236fe8ec69cd50b8ec3339f04e2fc9ef11debc8b4b0c65d139960cfc05b3e5e7c88a0a2613f55cf0a5384d38967a47be6250f01b59041fa74e3c

Download Submit
C:\Windows\System\sxVNNWZ.exe

Filesize
1.8MB

MD5
9eca9bcd93cfe92dc5923b308ac3ce6e

SHA1
99f9ba82269118309db6ebcfa592d420a9145631

SHA256
e3ceedc757bd18779ed5d0e117d4e8cda9c52174cbbf659bf755760f158ff653

SHA512
78600e74ed2fcd0c9ebfe8f72704a02c02266d0ad3028b93b3d0f42f09423f6168153bb9de47e55ae0b2f3228a58f1d5507a3f99bdd5613be1e768fcccf13963

Download Submit
C:\Windows\System\uQHroeA.exe

Filesize
1.8MB

MD5
d6bd74d8161d069373a35cc6b7fa431e

SHA1
36b446875093b5582b588afae0a4981c5e30d50f

SHA256
d542a6fdcb455d89de1ec81a2c45313babc4d75eaad15838de1985fc9fb4b050

SHA512
2df55d022b19a2f22501438b51dc4aa57e70932be0c2d77ba0a19e936673957438f7c694de2f87a8db79c1a3c9d6ecdf7496cd18d6731eec9d0382a890e8ac8c

Download Submit
C:\Windows\System\xIFfKDt.exe

Filesize
1.8MB

MD5
52b3708ea4d90a6e11a1ddf3a09f0bb8

SHA1
3d287c9feebd8cee6f20ef19e757a0df1f6347c4

SHA256
b282b95f79e11246eab2a20733eee0f62cec0e791027b5c8bff5e456c2a317bf

SHA512
a56ed447ebfd5da0a45db0ef8c757f47fa29ce55561bc6addf0c4e3a5580a572eee2a64834d95b38b38e9ad35618309f628d7ad3c828dc0ab012686946fe9e6c

Download Submit
C:\Windows\System\xyvYOVI.exe

Filesize
1.8MB

MD5
44608305556c5c1f401e71a05b27e219

SHA1
5b995f921f14559ba9ec7168aa21b13c303ca478

SHA256
1126a616d977eba1af2ec928bf2a1c0a632f6d779b1a9e3c9ba775345f74134e

SHA512
f9d31f53f722bb784dda34e8428adf28b16fa4b09f9da41cb7c9cdd5a901d4aea99b46b18b89781244c69e75e961726cc1bf567f56b16b1914b0e78e51449e8f

Download Submit
memory/336-2138-0x00007FF7991D0000-0x00007FF799524000-memory.dmp

Filesize
3.3MB

Download
memory/336-603-0x00007FF7991D0000-0x00007FF799524000-memory.dmp

Filesize
3.3MB

Download
memory/436-36-0x00007FF6A5D50000-0x00007FF6A60A4000-memory.dmp

Filesize
3.3MB

Download
memory/436-2120-0x00007FF6A5D50000-0x00007FF6A60A4000-memory.dmp

Filesize
3.3MB

Download
memory/1484-30-0x00007FF683A60000-0x00007FF683DB4000-memory.dmp

Filesize
3.3MB

Download
memory/1484-2117-0x00007FF683A60000-0x00007FF683DB4000-memory.dmp

Filesize
3.3MB

Download
memory/1484-2122-0x00007FF683A60000-0x00007FF683DB4000-memory.dmp

Filesize
3.3MB

Download
memory/1732-2128-0x00007FF61AB00000-0x00007FF61AE54000-memory.dmp

Filesize
3.3MB

Download
memory/1732-596-0x00007FF61AB00000-0x00007FF61AE54000-memory.dmp

Filesize
3.3MB

Download
memory/2052-599-0x00007FF77DA60000-0x00007FF77DDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2052-2132-0x00007FF77DA60000-0x00007FF77DDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2180-2144-0x00007FF669070000-0x00007FF6693C4000-memory.dmp

Filesize
3.3MB

Download
memory/2180-608-0x00007FF669070000-0x00007FF6693C4000-memory.dmp

Filesize
3.3MB

Download
memory/2292-2133-0x00007FF61E490000-0x00007FF61E7E4000-memory.dmp

Filesize
3.3MB

Download
memory/2292-628-0x00007FF61E490000-0x00007FF61E7E4000-memory.dmp

Filesize
3.3MB

Download
memory/2408-605-0x00007FF6367C0000-0x00007FF636B14000-memory.dmp

Filesize
3.3MB

Download
memory/2408-2140-0x00007FF6367C0000-0x00007FF636B14000-memory.dmp

Filesize
3.3MB

Download
memory/2468-2130-0x00007FF754EC0000-0x00007FF755214000-memory.dmp

Filesize
3.3MB

Download
memory/2468-601-0x00007FF754EC0000-0x00007FF755214000-memory.dmp

Filesize
3.3MB

Download
memory/2576-2139-0x00007FF6A3450000-0x00007FF6A37A4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-604-0x00007FF6A3450000-0x00007FF6A37A4000-memory.dmp

Filesize
3.3MB

Download
memory/2812-602-0x00007FF6A4CE0000-0x00007FF6A5034000-memory.dmp

Filesize
3.3MB

Download
memory/2812-2137-0x00007FF6A4CE0000-0x00007FF6A5034000-memory.dmp

Filesize
3.3MB

Download
memory/2876-2119-0x00007FF7B4390000-0x00007FF7B46E4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-16-0x00007FF7B4390000-0x00007FF7B46E4000-memory.dmp

Filesize
3.3MB

Download
memory/2992-0-0x00007FF635FE0000-0x00007FF636334000-memory.dmp

Filesize
3.3MB

Download
memory/2992-1-0x000001F6C03A0000-0x000001F6C03B0000-memory.dmp

Filesize
64KB

Download
memory/3264-611-0x00007FF600C60000-0x00007FF600FB4000-memory.dmp

Filesize
3.3MB

Download
memory/3264-2146-0x00007FF600C60000-0x00007FF600FB4000-memory.dmp

Filesize
3.3MB

Download
memory/3420-612-0x00007FF69E320000-0x00007FF69E674000-memory.dmp

Filesize
3.3MB

Download
memory/3420-2147-0x00007FF69E320000-0x00007FF69E674000-memory.dmp

Filesize
3.3MB

Download
memory/3504-609-0x00007FF71B070000-0x00007FF71B3C4000-memory.dmp

Filesize
3.3MB

Download
memory/3504-2145-0x00007FF71B070000-0x00007FF71B3C4000-memory.dmp

Filesize
3.3MB

Download
memory/3560-46-0x00007FF6E0590000-0x00007FF6E08E4000-memory.dmp

Filesize
3.3MB

Download
memory/3560-2118-0x00007FF6E0590000-0x00007FF6E08E4000-memory.dmp

Filesize
3.3MB

Download
memory/3560-2126-0x00007FF6E0590000-0x00007FF6E08E4000-memory.dmp

Filesize
3.3MB

Download
memory/3624-2142-0x00007FF70A4B0000-0x00007FF70A804000-memory.dmp

Filesize
3.3MB

Download
memory/3624-610-0x00007FF70A4B0000-0x00007FF70A804000-memory.dmp

Filesize
3.3MB

Download
memory/3640-2123-0x00007FF65C070000-0x00007FF65C3C4000-memory.dmp

Filesize
3.3MB

Download
memory/3640-61-0x00007FF65C070000-0x00007FF65C3C4000-memory.dmp

Filesize
3.3MB

Download
memory/3688-618-0x00007FF7AFDD0000-0x00007FF7B0124000-memory.dmp

Filesize
3.3MB

Download
memory/3688-2124-0x00007FF7AFDD0000-0x00007FF7B0124000-memory.dmp

Filesize
3.3MB

Download
memory/3992-2121-0x00007FF75DF60000-0x00007FF75E2B4000-memory.dmp

Filesize
3.3MB

Download
memory/3992-56-0x00007FF75DF60000-0x00007FF75E2B4000-memory.dmp

Filesize
3.3MB

Download
memory/4004-67-0x00007FF6E99F0000-0x00007FF6E9D44000-memory.dmp

Filesize
3.3MB

Download
memory/4004-2125-0x00007FF6E99F0000-0x00007FF6E9D44000-memory.dmp

Filesize
3.3MB

Download
memory/4084-600-0x00007FF742DB0000-0x00007FF743104000-memory.dmp

Filesize
3.3MB

Download
memory/4084-2129-0x00007FF742DB0000-0x00007FF743104000-memory.dmp

Filesize
3.3MB

Download
memory/4268-2136-0x00007FF69BFE0000-0x00007FF69C334000-memory.dmp

Filesize
3.3MB

Download
memory/4268-597-0x00007FF69BFE0000-0x00007FF69C334000-memory.dmp

Filesize
3.3MB

Download
memory/4296-2134-0x00007FF62BC60000-0x00007FF62BFB4000-memory.dmp

Filesize
3.3MB

Download
memory/4296-625-0x00007FF62BC60000-0x00007FF62BFB4000-memory.dmp

Filesize
3.3MB

Download
memory/4312-2131-0x00007FF695270000-0x00007FF6955C4000-memory.dmp

Filesize
3.3MB

Download
memory/4312-598-0x00007FF695270000-0x00007FF6955C4000-memory.dmp

Filesize
3.3MB

Download
memory/4792-2143-0x00007FF703EA0000-0x00007FF7041F4000-memory.dmp

Filesize
3.3MB

Download
memory/4792-607-0x00007FF703EA0000-0x00007FF7041F4000-memory.dmp

Filesize
3.3MB

Download
memory/4900-606-0x00007FF79AF90000-0x00007FF79B2E4000-memory.dmp

Filesize
3.3MB

Download
memory/4900-2141-0x00007FF79AF90000-0x00007FF79B2E4000-memory.dmp

Filesize
3.3MB

Download
memory/4908-2127-0x00007FF76CA50000-0x00007FF76CDA4000-memory.dmp

Filesize
3.3MB

Download
memory/4908-65-0x00007FF76CA50000-0x00007FF76CDA4000-memory.dmp

Filesize
3.3MB

Download
memory/4936-2135-0x00007FF6C3330000-0x00007FF6C3684000-memory.dmp

Filesize
3.3MB

Download
memory/4936-622-0x00007FF6C3330000-0x00007FF6C3684000-memory.dmp

Filesize
3.3MB

Download