xmrig | 8af5d5ffde9c75c44f2a21837233387f679239e22f469d6ac8b17f21cfd4581a

Analysis

max time kernel
115s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab3d42d3b42c6a320031763466474e80N.exe
Size

1.9MB
MD5

ab3d42d3b42c6a320031763466474e80
SHA1

aaa9af4af9debc3eed1e68d0c26f5bd2e7f50879
SHA256

8af5d5ffde9c75c44f2a21837233387f679239e22f469d6ac8b17f21cfd4581a
SHA512

286d10910a687127a9c40019ec2d6ffa2d7870fc2b597fcfc8086a5625d456ba48560d80607a39558ddce957bec09a3743c8e8710bf7054a8398c7ff4b38e063
SSDEEP

49152:ROdWCCi7/raU56uL3pgrCEd2hXcfFfikqtmm:RWWBib356utgU

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/1476-12-0x00007FF77E100000-0x00007FF77E451000-memory.dmp	xmrig
behavioral2/memory/4088-49-0x00007FF66DF50000-0x00007FF66E2A1000-memory.dmp	xmrig
behavioral2/memory/3396-73-0x00007FF70FEA0000-0x00007FF7101F1000-memory.dmp	xmrig
behavioral2/memory/3976-52-0x00007FF6C27A0000-0x00007FF6C2AF1000-memory.dmp	xmrig
behavioral2/memory/2456-503-0x00007FF7553B0000-0x00007FF755701000-memory.dmp	xmrig
behavioral2/memory/4260-502-0x00007FF7DF390000-0x00007FF7DF6E1000-memory.dmp	xmrig
behavioral2/memory/2904-508-0x00007FF72A0D0000-0x00007FF72A421000-memory.dmp	xmrig
behavioral2/memory/1324-516-0x00007FF768180000-0x00007FF7684D1000-memory.dmp	xmrig
behavioral2/memory/1496-519-0x00007FF701B60000-0x00007FF701EB1000-memory.dmp	xmrig
behavioral2/memory/2088-540-0x00007FF664210000-0x00007FF664561000-memory.dmp	xmrig
behavioral2/memory/4152-561-0x00007FF7C0810000-0x00007FF7C0B61000-memory.dmp	xmrig
behavioral2/memory/1776-580-0x00007FF6B1A70000-0x00007FF6B1DC1000-memory.dmp	xmrig
behavioral2/memory/5012-590-0x00007FF7DA720000-0x00007FF7DAA71000-memory.dmp	xmrig
behavioral2/memory/2068-583-0x00007FF673A20000-0x00007FF673D71000-memory.dmp	xmrig
behavioral2/memory/1404-575-0x00007FF618B60000-0x00007FF618EB1000-memory.dmp	xmrig
behavioral2/memory/2376-574-0x00007FF7D2AA0000-0x00007FF7D2DF1000-memory.dmp	xmrig
behavioral2/memory/884-566-0x00007FF6E0E20000-0x00007FF6E1171000-memory.dmp	xmrig
behavioral2/memory/612-559-0x00007FF7D4A50000-0x00007FF7D4DA1000-memory.dmp	xmrig
behavioral2/memory/5088-552-0x00007FF763080000-0x00007FF7633D1000-memory.dmp	xmrig
behavioral2/memory/1328-541-0x00007FF61CFF0000-0x00007FF61D341000-memory.dmp	xmrig
behavioral2/memory/1232-535-0x00007FF6B0B20000-0x00007FF6B0E71000-memory.dmp	xmrig
behavioral2/memory/3640-531-0x00007FF60D5C0000-0x00007FF60D911000-memory.dmp	xmrig
behavioral2/memory/4456-528-0x00007FF7CC720000-0x00007FF7CCA71000-memory.dmp	xmrig
behavioral2/memory/4768-513-0x00007FF7DAB40000-0x00007FF7DAE91000-memory.dmp	xmrig
behavioral2/memory/2916-1857-0x00007FF792740000-0x00007FF792A91000-memory.dmp	xmrig
behavioral2/memory/5004-2173-0x00007FF6E1E40000-0x00007FF6E2191000-memory.dmp	xmrig
behavioral2/memory/2240-2198-0x00007FF742590000-0x00007FF7428E1000-memory.dmp	xmrig
behavioral2/memory/1292-2207-0x00007FF797370000-0x00007FF7976C1000-memory.dmp	xmrig
behavioral2/memory/4812-2208-0x00007FF7A5630000-0x00007FF7A5981000-memory.dmp	xmrig
behavioral2/memory/3396-2209-0x00007FF70FEA0000-0x00007FF7101F1000-memory.dmp	xmrig
behavioral2/memory/1476-2215-0x00007FF77E100000-0x00007FF77E451000-memory.dmp	xmrig
behavioral2/memory/3628-2217-0x00007FF63FD20000-0x00007FF640071000-memory.dmp	xmrig
behavioral2/memory/5004-2245-0x00007FF6E1E40000-0x00007FF6E2191000-memory.dmp	xmrig
behavioral2/memory/2240-2247-0x00007FF742590000-0x00007FF7428E1000-memory.dmp	xmrig
behavioral2/memory/4088-2249-0x00007FF66DF50000-0x00007FF66E2A1000-memory.dmp	xmrig
behavioral2/memory/1292-2255-0x00007FF797370000-0x00007FF7976C1000-memory.dmp	xmrig
behavioral2/memory/3976-2254-0x00007FF6C27A0000-0x00007FF6C2AF1000-memory.dmp	xmrig
behavioral2/memory/3396-2252-0x00007FF70FEA0000-0x00007FF7101F1000-memory.dmp	xmrig
behavioral2/memory/4260-2257-0x00007FF7DF390000-0x00007FF7DF6E1000-memory.dmp	xmrig
behavioral2/memory/4812-2261-0x00007FF7A5630000-0x00007FF7A5981000-memory.dmp	xmrig
behavioral2/memory/2456-2263-0x00007FF7553B0000-0x00007FF755701000-memory.dmp	xmrig
behavioral2/memory/4768-2267-0x00007FF7DAB40000-0x00007FF7DAE91000-memory.dmp	xmrig
behavioral2/memory/2904-2266-0x00007FF72A0D0000-0x00007FF72A421000-memory.dmp	xmrig
behavioral2/memory/5012-2259-0x00007FF7DA720000-0x00007FF7DAA71000-memory.dmp	xmrig
behavioral2/memory/4456-2295-0x00007FF7CC720000-0x00007FF7CCA71000-memory.dmp	xmrig
behavioral2/memory/1324-2300-0x00007FF768180000-0x00007FF7684D1000-memory.dmp	xmrig
behavioral2/memory/2088-2310-0x00007FF664210000-0x00007FF664561000-memory.dmp	xmrig
behavioral2/memory/1496-2308-0x00007FF701B60000-0x00007FF701EB1000-memory.dmp	xmrig
behavioral2/memory/3640-2293-0x00007FF60D5C0000-0x00007FF60D911000-memory.dmp	xmrig
behavioral2/memory/1232-2291-0x00007FF6B0B20000-0x00007FF6B0E71000-memory.dmp	xmrig
behavioral2/memory/1328-2289-0x00007FF61CFF0000-0x00007FF61D341000-memory.dmp	xmrig
behavioral2/memory/5088-2287-0x00007FF763080000-0x00007FF7633D1000-memory.dmp	xmrig
behavioral2/memory/4152-2282-0x00007FF7C0810000-0x00007FF7C0B61000-memory.dmp	xmrig
behavioral2/memory/884-2281-0x00007FF6E0E20000-0x00007FF6E1171000-memory.dmp	xmrig
behavioral2/memory/2376-2279-0x00007FF7D2AA0000-0x00007FF7D2DF1000-memory.dmp	xmrig
behavioral2/memory/1404-2277-0x00007FF618B60000-0x00007FF618EB1000-memory.dmp	xmrig
behavioral2/memory/2068-2273-0x00007FF673A20000-0x00007FF673D71000-memory.dmp	xmrig
behavioral2/memory/612-2285-0x00007FF7D4A50000-0x00007FF7D4DA1000-memory.dmp	xmrig
behavioral2/memory/1776-2275-0x00007FF6B1A70000-0x00007FF6B1DC1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1476	RUsSQGq.exe
3628	iQPGcXx.exe
5004	CLlXNoZ.exe
2240	yNsGaxp.exe
1292	DuvxVfI.exe
4088	qNKqclD.exe
3976	HuimsdL.exe
3396	VlBniSJ.exe
4812	BKTdLje.exe
5012	HBlPfNZ.exe
4260	fUDgWuz.exe
2456	naPAduF.exe
2904	LpaFgwp.exe
4768	PmjhZLq.exe
1324	lDsebpJ.exe
1496	XRoPpPB.exe
4456	PwpVCKZ.exe
3640	NkGnhPc.exe
1232	cPOjDOh.exe
2088	FVlEUdq.exe
1328	zkAzmVD.exe
5088	DrjBczl.exe
612	UXgxlqk.exe
4152	xevuDwS.exe
884	UiqDHdC.exe
2376	haxbCXP.exe
1404	PiOdylg.exe
1776	pGkqKxw.exe
2068	NUhjQjM.exe
1544	UyXQHwX.exe
1096	iBkSiDg.exe
1552	lYEMEuC.exe
1748	bUqPnit.exe
3268	rMaWAaB.exe
5052	XPMzRGi.exe
5040	EBWkJZY.exe
1432	lqbwbHr.exe
3100	FxgDWsY.exe
2944	AEyAghq.exe
2744	NOsbmNB.exe
2712	WDoTISL.exe
5104	PDrITJh.exe
2920	NdtfPYt.exe
4940	cQUBtQv.exe
3636	onPAWRX.exe
416	JNTsVBt.exe
4916	kRAiPZo.exe
4784	hdGMbeb.exe
4400	KwoqvoA.exe
4688	dGmaBbE.exe
4832	UJfzUCy.exe
4952	lfiovwj.exe
1580	LPoePNF.exe
3000	nwfXcPq.exe
4760	HJOWodQ.exe
5016	IkOpiwK.exe
4436	xFuiJpi.exe
3856	RiisjwZ.exe
740	hVjwaxY.exe
3876	UxxHPNN.exe
1508	tcLZFhi.exe
4188	EphKBqW.exe
1900	yAWakQM.exe
3164	dqWNZEX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2916-0-0x00007FF792740000-0x00007FF792A91000-memory.dmp	upx
behavioral2/files/0x000900000002346c-6.dat	upx
behavioral2/files/0x0007000000023477-8.dat	upx
behavioral2/memory/1476-12-0x00007FF77E100000-0x00007FF77E451000-memory.dmp	upx
behavioral2/memory/3628-14-0x00007FF63FD20000-0x00007FF640071000-memory.dmp	upx
behavioral2/files/0x0007000000023476-11.dat	upx
behavioral2/files/0x0009000000023471-23.dat	upx
behavioral2/memory/2240-24-0x00007FF742590000-0x00007FF7428E1000-memory.dmp	upx
behavioral2/files/0x000700000002347b-43.dat	upx
behavioral2/memory/4088-49-0x00007FF66DF50000-0x00007FF66E2A1000-memory.dmp	upx
behavioral2/files/0x000700000002347d-59.dat	upx
behavioral2/files/0x0007000000023480-64.dat	upx
behavioral2/memory/3396-73-0x00007FF70FEA0000-0x00007FF7101F1000-memory.dmp	upx
behavioral2/files/0x000700000002348a-123.dat	upx
behavioral2/files/0x0007000000023492-163.dat	upx
behavioral2/files/0x0007000000023495-172.dat	upx
behavioral2/files/0x0007000000023493-168.dat	upx
behavioral2/files/0x0007000000023494-167.dat	upx
behavioral2/files/0x0007000000023491-158.dat	upx
behavioral2/files/0x0007000000023490-153.dat	upx
behavioral2/files/0x000700000002348f-148.dat	upx
behavioral2/files/0x000700000002348e-143.dat	upx
behavioral2/files/0x000700000002348d-138.dat	upx
behavioral2/files/0x000700000002348c-133.dat	upx
behavioral2/files/0x000700000002348b-128.dat	upx
behavioral2/files/0x0007000000023489-118.dat	upx
behavioral2/files/0x0007000000023488-113.dat	upx
behavioral2/files/0x0007000000023487-108.dat	upx
behavioral2/files/0x0007000000023486-103.dat	upx
behavioral2/files/0x0007000000023485-98.dat	upx
behavioral2/files/0x0007000000023484-93.dat	upx
behavioral2/files/0x0007000000023483-88.dat	upx
behavioral2/files/0x0007000000023482-80.dat	upx
behavioral2/files/0x0007000000023481-78.dat	upx
behavioral2/files/0x000700000002347f-70.dat	upx
behavioral2/files/0x000700000002347e-67.dat	upx
behavioral2/files/0x000700000002347c-57.dat	upx
behavioral2/memory/4812-53-0x00007FF7A5630000-0x00007FF7A5981000-memory.dmp	upx
behavioral2/memory/3976-52-0x00007FF6C27A0000-0x00007FF6C2AF1000-memory.dmp	upx
behavioral2/files/0x000700000002347a-36.dat	upx
behavioral2/files/0x0007000000023479-35.dat	upx
behavioral2/memory/1292-32-0x00007FF797370000-0x00007FF7976C1000-memory.dmp	upx
behavioral2/memory/5004-18-0x00007FF6E1E40000-0x00007FF6E2191000-memory.dmp	upx
behavioral2/memory/2456-503-0x00007FF7553B0000-0x00007FF755701000-memory.dmp	upx
behavioral2/memory/4260-502-0x00007FF7DF390000-0x00007FF7DF6E1000-memory.dmp	upx
behavioral2/memory/2904-508-0x00007FF72A0D0000-0x00007FF72A421000-memory.dmp	upx
behavioral2/memory/1324-516-0x00007FF768180000-0x00007FF7684D1000-memory.dmp	upx
behavioral2/memory/1496-519-0x00007FF701B60000-0x00007FF701EB1000-memory.dmp	upx
behavioral2/memory/2088-540-0x00007FF664210000-0x00007FF664561000-memory.dmp	upx
behavioral2/memory/4152-561-0x00007FF7C0810000-0x00007FF7C0B61000-memory.dmp	upx
behavioral2/memory/1776-580-0x00007FF6B1A70000-0x00007FF6B1DC1000-memory.dmp	upx
behavioral2/memory/5012-590-0x00007FF7DA720000-0x00007FF7DAA71000-memory.dmp	upx
behavioral2/memory/2068-583-0x00007FF673A20000-0x00007FF673D71000-memory.dmp	upx
behavioral2/memory/1404-575-0x00007FF618B60000-0x00007FF618EB1000-memory.dmp	upx
behavioral2/memory/2376-574-0x00007FF7D2AA0000-0x00007FF7D2DF1000-memory.dmp	upx
behavioral2/memory/884-566-0x00007FF6E0E20000-0x00007FF6E1171000-memory.dmp	upx
behavioral2/memory/612-559-0x00007FF7D4A50000-0x00007FF7D4DA1000-memory.dmp	upx
behavioral2/memory/5088-552-0x00007FF763080000-0x00007FF7633D1000-memory.dmp	upx
behavioral2/memory/1328-541-0x00007FF61CFF0000-0x00007FF61D341000-memory.dmp	upx
behavioral2/memory/1232-535-0x00007FF6B0B20000-0x00007FF6B0E71000-memory.dmp	upx
behavioral2/memory/3640-531-0x00007FF60D5C0000-0x00007FF60D911000-memory.dmp	upx
behavioral2/memory/4456-528-0x00007FF7CC720000-0x00007FF7CCA71000-memory.dmp	upx
behavioral2/memory/4768-513-0x00007FF7DAB40000-0x00007FF7DAE91000-memory.dmp	upx
behavioral2/memory/2916-1857-0x00007FF792740000-0x00007FF792A91000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YGHqorP.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\aGZEAzf.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\EZfAAzW.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\ebAqnJr.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\DefSKQJ.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\MHrqvOj.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\PxOeOck.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\RiQlUDr.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\ICdJchC.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\XeaxAwL.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\SnFiIcV.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\eZfPijl.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\XGNnAfd.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\EHweoQo.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\ihKNOWT.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\kLatqrB.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\oZhXYQl.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\rgCvzAd.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\yBiKKDu.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\pkGFCIk.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\cooFvmF.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\KZaiGhq.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\IuEscSd.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\bZqUtPR.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\vqSnzdl.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\RiisjwZ.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\cftlNRs.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\bftlWVE.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\HntiQmm.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\RrrtwFb.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\rWnjUeG.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\mmuEggC.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\QrUHqVF.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\YcxZXHo.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\CCLfKaM.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\acVlQDQ.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\ucpYrWl.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\vcrAVUQ.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\FNJmoZV.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\XalDuWD.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\YtfAAxE.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\RCEoHaI.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\BhyeYle.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\GwyZGMp.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\kkwLbqY.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\zBptqkP.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\xbXqNOz.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\HKbBZYn.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\ZMZBFLX.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\OBmcAuY.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\hIMdQWA.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\hkDjRKk.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\ASUGZaW.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\kBFIaJp.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\gqRMmAl.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\AsUaiBV.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\eAPgFRe.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\XxpssXP.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\HuimsdL.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\FVlEUdq.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\TUHyroK.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\etxNTsj.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\CptuJll.exe	ab3d42d3b42c6a320031763466474e80N.exe
File created	C:\Windows\System\wDRbaoc.exe	ab3d42d3b42c6a320031763466474e80N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1476	2916	ab3d42d3b42c6a320031763466474e80N.exe	85
PID 2916 wrote to memory of 1476	2916	ab3d42d3b42c6a320031763466474e80N.exe	85
PID 2916 wrote to memory of 3628	2916	ab3d42d3b42c6a320031763466474e80N.exe	86
PID 2916 wrote to memory of 3628	2916	ab3d42d3b42c6a320031763466474e80N.exe	86
PID 2916 wrote to memory of 5004	2916	ab3d42d3b42c6a320031763466474e80N.exe	87
PID 2916 wrote to memory of 5004	2916	ab3d42d3b42c6a320031763466474e80N.exe	87
PID 2916 wrote to memory of 2240	2916	ab3d42d3b42c6a320031763466474e80N.exe	88
PID 2916 wrote to memory of 2240	2916	ab3d42d3b42c6a320031763466474e80N.exe	88
PID 2916 wrote to memory of 1292	2916	ab3d42d3b42c6a320031763466474e80N.exe	89
PID 2916 wrote to memory of 1292	2916	ab3d42d3b42c6a320031763466474e80N.exe	89
PID 2916 wrote to memory of 4088	2916	ab3d42d3b42c6a320031763466474e80N.exe	90
PID 2916 wrote to memory of 4088	2916	ab3d42d3b42c6a320031763466474e80N.exe	90
PID 2916 wrote to memory of 3976	2916	ab3d42d3b42c6a320031763466474e80N.exe	91
PID 2916 wrote to memory of 3976	2916	ab3d42d3b42c6a320031763466474e80N.exe	91
PID 2916 wrote to memory of 3396	2916	ab3d42d3b42c6a320031763466474e80N.exe	92
PID 2916 wrote to memory of 3396	2916	ab3d42d3b42c6a320031763466474e80N.exe	92
PID 2916 wrote to memory of 4812	2916	ab3d42d3b42c6a320031763466474e80N.exe	93
PID 2916 wrote to memory of 4812	2916	ab3d42d3b42c6a320031763466474e80N.exe	93
PID 2916 wrote to memory of 5012	2916	ab3d42d3b42c6a320031763466474e80N.exe	94
PID 2916 wrote to memory of 5012	2916	ab3d42d3b42c6a320031763466474e80N.exe	94
PID 2916 wrote to memory of 4260	2916	ab3d42d3b42c6a320031763466474e80N.exe	95
PID 2916 wrote to memory of 4260	2916	ab3d42d3b42c6a320031763466474e80N.exe	95
PID 2916 wrote to memory of 2456	2916	ab3d42d3b42c6a320031763466474e80N.exe	96
PID 2916 wrote to memory of 2456	2916	ab3d42d3b42c6a320031763466474e80N.exe	96
PID 2916 wrote to memory of 2904	2916	ab3d42d3b42c6a320031763466474e80N.exe	97
PID 2916 wrote to memory of 2904	2916	ab3d42d3b42c6a320031763466474e80N.exe	97
PID 2916 wrote to memory of 4768	2916	ab3d42d3b42c6a320031763466474e80N.exe	98
PID 2916 wrote to memory of 4768	2916	ab3d42d3b42c6a320031763466474e80N.exe	98
PID 2916 wrote to memory of 1324	2916	ab3d42d3b42c6a320031763466474e80N.exe	99
PID 2916 wrote to memory of 1324	2916	ab3d42d3b42c6a320031763466474e80N.exe	99
PID 2916 wrote to memory of 1496	2916	ab3d42d3b42c6a320031763466474e80N.exe	100
PID 2916 wrote to memory of 1496	2916	ab3d42d3b42c6a320031763466474e80N.exe	100
PID 2916 wrote to memory of 4456	2916	ab3d42d3b42c6a320031763466474e80N.exe	101
PID 2916 wrote to memory of 4456	2916	ab3d42d3b42c6a320031763466474e80N.exe	101
PID 2916 wrote to memory of 3640	2916	ab3d42d3b42c6a320031763466474e80N.exe	102
PID 2916 wrote to memory of 3640	2916	ab3d42d3b42c6a320031763466474e80N.exe	102
PID 2916 wrote to memory of 1232	2916	ab3d42d3b42c6a320031763466474e80N.exe	103
PID 2916 wrote to memory of 1232	2916	ab3d42d3b42c6a320031763466474e80N.exe	103
PID 2916 wrote to memory of 2088	2916	ab3d42d3b42c6a320031763466474e80N.exe	104
PID 2916 wrote to memory of 2088	2916	ab3d42d3b42c6a320031763466474e80N.exe	104
PID 2916 wrote to memory of 1328	2916	ab3d42d3b42c6a320031763466474e80N.exe	105
PID 2916 wrote to memory of 1328	2916	ab3d42d3b42c6a320031763466474e80N.exe	105
PID 2916 wrote to memory of 5088	2916	ab3d42d3b42c6a320031763466474e80N.exe	106
PID 2916 wrote to memory of 5088	2916	ab3d42d3b42c6a320031763466474e80N.exe	106
PID 2916 wrote to memory of 612	2916	ab3d42d3b42c6a320031763466474e80N.exe	107
PID 2916 wrote to memory of 612	2916	ab3d42d3b42c6a320031763466474e80N.exe	107
PID 2916 wrote to memory of 4152	2916	ab3d42d3b42c6a320031763466474e80N.exe	108
PID 2916 wrote to memory of 4152	2916	ab3d42d3b42c6a320031763466474e80N.exe	108
PID 2916 wrote to memory of 884	2916	ab3d42d3b42c6a320031763466474e80N.exe	109
PID 2916 wrote to memory of 884	2916	ab3d42d3b42c6a320031763466474e80N.exe	109
PID 2916 wrote to memory of 2376	2916	ab3d42d3b42c6a320031763466474e80N.exe	110
PID 2916 wrote to memory of 2376	2916	ab3d42d3b42c6a320031763466474e80N.exe	110
PID 2916 wrote to memory of 1404	2916	ab3d42d3b42c6a320031763466474e80N.exe	111
PID 2916 wrote to memory of 1404	2916	ab3d42d3b42c6a320031763466474e80N.exe	111
PID 2916 wrote to memory of 1776	2916	ab3d42d3b42c6a320031763466474e80N.exe	112
PID 2916 wrote to memory of 1776	2916	ab3d42d3b42c6a320031763466474e80N.exe	112
PID 2916 wrote to memory of 2068	2916	ab3d42d3b42c6a320031763466474e80N.exe	113
PID 2916 wrote to memory of 2068	2916	ab3d42d3b42c6a320031763466474e80N.exe	113
PID 2916 wrote to memory of 1544	2916	ab3d42d3b42c6a320031763466474e80N.exe	114
PID 2916 wrote to memory of 1544	2916	ab3d42d3b42c6a320031763466474e80N.exe	114
PID 2916 wrote to memory of 1096	2916	ab3d42d3b42c6a320031763466474e80N.exe	115
PID 2916 wrote to memory of 1096	2916	ab3d42d3b42c6a320031763466474e80N.exe	115
PID 2916 wrote to memory of 1552	2916	ab3d42d3b42c6a320031763466474e80N.exe	116
PID 2916 wrote to memory of 1552	2916	ab3d42d3b42c6a320031763466474e80N.exe	116

C:\Users\Admin\AppData\Local\Temp\ab3d42d3b42c6a320031763466474e80N.exe
"C:\Users\Admin\AppData\Local\Temp\ab3d42d3b42c6a320031763466474e80N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System\RUsSQGq.exe
  C:\Windows\System\RUsSQGq.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\iQPGcXx.exe
  C:\Windows\System\iQPGcXx.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\CLlXNoZ.exe
  C:\Windows\System\CLlXNoZ.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\yNsGaxp.exe
  C:\Windows\System\yNsGaxp.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\DuvxVfI.exe
  C:\Windows\System\DuvxVfI.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\qNKqclD.exe
  C:\Windows\System\qNKqclD.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\HuimsdL.exe
  C:\Windows\System\HuimsdL.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\VlBniSJ.exe
  C:\Windows\System\VlBniSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\BKTdLje.exe
  C:\Windows\System\BKTdLje.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\HBlPfNZ.exe
  C:\Windows\System\HBlPfNZ.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\fUDgWuz.exe
  C:\Windows\System\fUDgWuz.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\naPAduF.exe
  C:\Windows\System\naPAduF.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\LpaFgwp.exe
  C:\Windows\System\LpaFgwp.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\PmjhZLq.exe
  C:\Windows\System\PmjhZLq.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\lDsebpJ.exe
  C:\Windows\System\lDsebpJ.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\XRoPpPB.exe
  C:\Windows\System\XRoPpPB.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\PwpVCKZ.exe
  C:\Windows\System\PwpVCKZ.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\NkGnhPc.exe
  C:\Windows\System\NkGnhPc.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\cPOjDOh.exe
  C:\Windows\System\cPOjDOh.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\FVlEUdq.exe
  C:\Windows\System\FVlEUdq.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\zkAzmVD.exe
  C:\Windows\System\zkAzmVD.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\DrjBczl.exe
  C:\Windows\System\DrjBczl.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\UXgxlqk.exe
  C:\Windows\System\UXgxlqk.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\xevuDwS.exe
  C:\Windows\System\xevuDwS.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\UiqDHdC.exe
  C:\Windows\System\UiqDHdC.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\haxbCXP.exe
  C:\Windows\System\haxbCXP.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\PiOdylg.exe
  C:\Windows\System\PiOdylg.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\pGkqKxw.exe
  C:\Windows\System\pGkqKxw.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\NUhjQjM.exe
  C:\Windows\System\NUhjQjM.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\UyXQHwX.exe
  C:\Windows\System\UyXQHwX.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\iBkSiDg.exe
  C:\Windows\System\iBkSiDg.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\lYEMEuC.exe
  C:\Windows\System\lYEMEuC.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\bUqPnit.exe
  C:\Windows\System\bUqPnit.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\rMaWAaB.exe
  C:\Windows\System\rMaWAaB.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\XPMzRGi.exe
  C:\Windows\System\XPMzRGi.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\EBWkJZY.exe
  C:\Windows\System\EBWkJZY.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\lqbwbHr.exe
  C:\Windows\System\lqbwbHr.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\FxgDWsY.exe
  C:\Windows\System\FxgDWsY.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\AEyAghq.exe
  C:\Windows\System\AEyAghq.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\NOsbmNB.exe
  C:\Windows\System\NOsbmNB.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\WDoTISL.exe
  C:\Windows\System\WDoTISL.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\PDrITJh.exe
  C:\Windows\System\PDrITJh.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\NdtfPYt.exe
  C:\Windows\System\NdtfPYt.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\cQUBtQv.exe
  C:\Windows\System\cQUBtQv.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\onPAWRX.exe
  C:\Windows\System\onPAWRX.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\JNTsVBt.exe
  C:\Windows\System\JNTsVBt.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\kRAiPZo.exe
  C:\Windows\System\kRAiPZo.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\hdGMbeb.exe
  C:\Windows\System\hdGMbeb.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\KwoqvoA.exe
  C:\Windows\System\KwoqvoA.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\dGmaBbE.exe
  C:\Windows\System\dGmaBbE.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\UJfzUCy.exe
  C:\Windows\System\UJfzUCy.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\lfiovwj.exe
  C:\Windows\System\lfiovwj.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\LPoePNF.exe
  C:\Windows\System\LPoePNF.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\nwfXcPq.exe
  C:\Windows\System\nwfXcPq.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\HJOWodQ.exe
  C:\Windows\System\HJOWodQ.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\IkOpiwK.exe
  C:\Windows\System\IkOpiwK.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\xFuiJpi.exe
  C:\Windows\System\xFuiJpi.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\RiisjwZ.exe
  C:\Windows\System\RiisjwZ.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\hVjwaxY.exe
  C:\Windows\System\hVjwaxY.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\UxxHPNN.exe
  C:\Windows\System\UxxHPNN.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\tcLZFhi.exe
  C:\Windows\System\tcLZFhi.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\EphKBqW.exe
  C:\Windows\System\EphKBqW.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\yAWakQM.exe
  C:\Windows\System\yAWakQM.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\dqWNZEX.exe
  C:\Windows\System\dqWNZEX.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\gKEqPqi.exe
  C:\Windows\System\gKEqPqi.exe
  2⤵
  PID:3452
- C:\Windows\System\OkURBhW.exe
  C:\Windows\System\OkURBhW.exe
  2⤵
  PID:4864
- C:\Windows\System\OataeIb.exe
  C:\Windows\System\OataeIb.exe
  2⤵
  PID:4444
- C:\Windows\System\lwYBaoS.exe
  C:\Windows\System\lwYBaoS.exe
  2⤵
  PID:4300
- C:\Windows\System\TgctLGh.exe
  C:\Windows\System\TgctLGh.exe
  2⤵
  PID:4544
- C:\Windows\System\bMBdByD.exe
  C:\Windows\System\bMBdByD.exe
  2⤵
  PID:4148
- C:\Windows\System\MwZmYXK.exe
  C:\Windows\System\MwZmYXK.exe
  2⤵
  PID:2600
- C:\Windows\System\ObvYslQ.exe
  C:\Windows\System\ObvYslQ.exe
  2⤵
  PID:4824
- C:\Windows\System\bZAPnUA.exe
  C:\Windows\System\bZAPnUA.exe
  2⤵
  PID:4392
- C:\Windows\System\ROjGnhX.exe
  C:\Windows\System\ROjGnhX.exe
  2⤵
  PID:2040
- C:\Windows\System\HxswYdx.exe
  C:\Windows\System\HxswYdx.exe
  2⤵
  PID:1736
- C:\Windows\System\aAEGCwK.exe
  C:\Windows\System\aAEGCwK.exe
  2⤵
  PID:4648
- C:\Windows\System\CBbZbqA.exe
  C:\Windows\System\CBbZbqA.exe
  2⤵
  PID:856
- C:\Windows\System\TUHyroK.exe
  C:\Windows\System\TUHyroK.exe
  2⤵
  PID:2936
- C:\Windows\System\EYOauOP.exe
  C:\Windows\System\EYOauOP.exe
  2⤵
  PID:3380
- C:\Windows\System\GUUQTra.exe
  C:\Windows\System\GUUQTra.exe
  2⤵
  PID:2952
- C:\Windows\System\SdBMQyk.exe
  C:\Windows\System\SdBMQyk.exe
  2⤵
  PID:3680
- C:\Windows\System\wNCFXSa.exe
  C:\Windows\System\wNCFXSa.exe
  2⤵
  PID:320
- C:\Windows\System\wJTbfcS.exe
  C:\Windows\System\wJTbfcS.exe
  2⤵
  PID:3560
- C:\Windows\System\WDrUynA.exe
  C:\Windows\System\WDrUynA.exe
  2⤵
  PID:548
- C:\Windows\System\BGulYxQ.exe
  C:\Windows\System\BGulYxQ.exe
  2⤵
  PID:5140
- C:\Windows\System\YtfAAxE.exe
  C:\Windows\System\YtfAAxE.exe
  2⤵
  PID:5164
- C:\Windows\System\iSIhpxO.exe
  C:\Windows\System\iSIhpxO.exe
  2⤵
  PID:5196
- C:\Windows\System\pxLnSoi.exe
  C:\Windows\System\pxLnSoi.exe
  2⤵
  PID:5220
- C:\Windows\System\vdAijbM.exe
  C:\Windows\System\vdAijbM.exe
  2⤵
  PID:5252
- C:\Windows\System\uRsLTwr.exe
  C:\Windows\System\uRsLTwr.exe
  2⤵
  PID:5280
- C:\Windows\System\fVDarpR.exe
  C:\Windows\System\fVDarpR.exe
  2⤵
  PID:5308
- C:\Windows\System\oxfsadZ.exe
  C:\Windows\System\oxfsadZ.exe
  2⤵
  PID:5336
- C:\Windows\System\kNhHABx.exe
  C:\Windows\System\kNhHABx.exe
  2⤵
  PID:5368
- C:\Windows\System\RiQlUDr.exe
  C:\Windows\System\RiQlUDr.exe
  2⤵
  PID:5396
- C:\Windows\System\NyyhTAJ.exe
  C:\Windows\System\NyyhTAJ.exe
  2⤵
  PID:5424
- C:\Windows\System\qSpgidr.exe
  C:\Windows\System\qSpgidr.exe
  2⤵
  PID:5448
- C:\Windows\System\QrUHqVF.exe
  C:\Windows\System\QrUHqVF.exe
  2⤵
  PID:5480
- C:\Windows\System\qErSiMS.exe
  C:\Windows\System\qErSiMS.exe
  2⤵
  PID:5508
- C:\Windows\System\qMIbmxs.exe
  C:\Windows\System\qMIbmxs.exe
  2⤵
  PID:5536
- C:\Windows\System\WLgLxzx.exe
  C:\Windows\System\WLgLxzx.exe
  2⤵
  PID:5560
- C:\Windows\System\epuvbZP.exe
  C:\Windows\System\epuvbZP.exe
  2⤵
  PID:5588
- C:\Windows\System\sFKKGYb.exe
  C:\Windows\System\sFKKGYb.exe
  2⤵
  PID:5616
- C:\Windows\System\uOJyhIu.exe
  C:\Windows\System\uOJyhIu.exe
  2⤵
  PID:5644
- C:\Windows\System\GDpKNwt.exe
  C:\Windows\System\GDpKNwt.exe
  2⤵
  PID:5676
- C:\Windows\System\lyNzNjr.exe
  C:\Windows\System\lyNzNjr.exe
  2⤵
  PID:5704
- C:\Windows\System\tePeISV.exe
  C:\Windows\System\tePeISV.exe
  2⤵
  PID:5732
- C:\Windows\System\mLzDwwJ.exe
  C:\Windows\System\mLzDwwJ.exe
  2⤵
  PID:5760
- C:\Windows\System\KWyJPfK.exe
  C:\Windows\System\KWyJPfK.exe
  2⤵
  PID:5788
- C:\Windows\System\GSoyBzL.exe
  C:\Windows\System\GSoyBzL.exe
  2⤵
  PID:5812
- C:\Windows\System\ZHUbTzW.exe
  C:\Windows\System\ZHUbTzW.exe
  2⤵
  PID:5840
- C:\Windows\System\ycVHJNq.exe
  C:\Windows\System\ycVHJNq.exe
  2⤵
  PID:5872
- C:\Windows\System\OEMJrIe.exe
  C:\Windows\System\OEMJrIe.exe
  2⤵
  PID:5900
- C:\Windows\System\jDTGMTf.exe
  C:\Windows\System\jDTGMTf.exe
  2⤵
  PID:5928
- C:\Windows\System\aGFhouX.exe
  C:\Windows\System\aGFhouX.exe
  2⤵
  PID:5952
- C:\Windows\System\AdzEsQI.exe
  C:\Windows\System\AdzEsQI.exe
  2⤵
  PID:5980
- C:\Windows\System\kvKsYRA.exe
  C:\Windows\System\kvKsYRA.exe
  2⤵
  PID:6012
- C:\Windows\System\RCEoHaI.exe
  C:\Windows\System\RCEoHaI.exe
  2⤵
  PID:6036
- C:\Windows\System\CgpJrYZ.exe
  C:\Windows\System\CgpJrYZ.exe
  2⤵
  PID:6064
- C:\Windows\System\ZfWMBFw.exe
  C:\Windows\System\ZfWMBFw.exe
  2⤵
  PID:6096
- C:\Windows\System\DFasWwW.exe
  C:\Windows\System\DFasWwW.exe
  2⤵
  PID:6124
- C:\Windows\System\wARfWUd.exe
  C:\Windows\System\wARfWUd.exe
  2⤵
  PID:3104
- C:\Windows\System\HSCTqrz.exe
  C:\Windows\System\HSCTqrz.exe
  2⤵
  PID:748
- C:\Windows\System\uNdMJTb.exe
  C:\Windows\System\uNdMJTb.exe
  2⤵
  PID:916
- C:\Windows\System\cMsYtdg.exe
  C:\Windows\System\cMsYtdg.exe
  2⤵
  PID:2448
- C:\Windows\System\eHSGdDn.exe
  C:\Windows\System\eHSGdDn.exe
  2⤵
  PID:5132
- C:\Windows\System\AErFDeY.exe
  C:\Windows\System\AErFDeY.exe
  2⤵
  PID:5208
- C:\Windows\System\DXiyRcM.exe
  C:\Windows\System\DXiyRcM.exe
  2⤵
  PID:5268
- C:\Windows\System\LRFZVZj.exe
  C:\Windows\System\LRFZVZj.exe
  2⤵
  PID:5332
- C:\Windows\System\LYgLRje.exe
  C:\Windows\System\LYgLRje.exe
  2⤵
  PID:5388
- C:\Windows\System\gbktOfg.exe
  C:\Windows\System\gbktOfg.exe
  2⤵
  PID:5464
- C:\Windows\System\QasDDfS.exe
  C:\Windows\System\QasDDfS.exe
  2⤵
  PID:5496
- C:\Windows\System\ZYZcJNt.exe
  C:\Windows\System\ZYZcJNt.exe
  2⤵
  PID:5576
- C:\Windows\System\VwIrSGH.exe
  C:\Windows\System\VwIrSGH.exe
  2⤵
  PID:1912
- C:\Windows\System\YGOZJFO.exe
  C:\Windows\System\YGOZJFO.exe
  2⤵
  PID:3800
- C:\Windows\System\KOQfyyU.exe
  C:\Windows\System\KOQfyyU.exe
  2⤵
  PID:5748
- C:\Windows\System\JrDJToo.exe
  C:\Windows\System\JrDJToo.exe
  2⤵
  PID:5804
- C:\Windows\System\aLDzSPk.exe
  C:\Windows\System\aLDzSPk.exe
  2⤵
  PID:2608
- C:\Windows\System\cuJbGoV.exe
  C:\Windows\System\cuJbGoV.exe
  2⤵
  PID:5912
- C:\Windows\System\mIsjfiB.exe
  C:\Windows\System\mIsjfiB.exe
  2⤵
  PID:5968
- C:\Windows\System\QiWJBUL.exe
  C:\Windows\System\QiWJBUL.exe
  2⤵
  PID:6004
- C:\Windows\System\kLatqrB.exe
  C:\Windows\System\kLatqrB.exe
  2⤵
  PID:6060
- C:\Windows\System\nqwzSnB.exe
  C:\Windows\System\nqwzSnB.exe
  2⤵
  PID:6136
- C:\Windows\System\oZhXYQl.exe
  C:\Windows\System\oZhXYQl.exe
  2⤵
  PID:4024
- C:\Windows\System\QQzJlKH.exe
  C:\Windows\System\QQzJlKH.exe
  2⤵
  PID:5180
- C:\Windows\System\JOygctC.exe
  C:\Windows\System\JOygctC.exe
  2⤵
  PID:5380
- C:\Windows\System\JwBhekW.exe
  C:\Windows\System\JwBhekW.exe
  2⤵
  PID:5468
- C:\Windows\System\bkbyvaV.exe
  C:\Windows\System\bkbyvaV.exe
  2⤵
  PID:5548
- C:\Windows\System\PEzUpjM.exe
  C:\Windows\System\PEzUpjM.exe
  2⤵
  PID:3820
- C:\Windows\System\gecabwG.exe
  C:\Windows\System\gecabwG.exe
  2⤵
  PID:5724
- C:\Windows\System\xUAXmYx.exe
  C:\Windows\System\xUAXmYx.exe
  2⤵
  PID:5836
- C:\Windows\System\xVYuXmE.exe
  C:\Windows\System\xVYuXmE.exe
  2⤵
  PID:6052
- C:\Windows\System\Gdicxfb.exe
  C:\Windows\System\Gdicxfb.exe
  2⤵
  PID:5944
- C:\Windows\System\zQkZuDQ.exe
  C:\Windows\System\zQkZuDQ.exe
  2⤵
  PID:804
- C:\Windows\System\BixNwZX.exe
  C:\Windows\System\BixNwZX.exe
  2⤵
  PID:3292
- C:\Windows\System\BhyeYle.exe
  C:\Windows\System\BhyeYle.exe
  2⤵
  PID:1800
- C:\Windows\System\oTWPdaZ.exe
  C:\Windows\System\oTWPdaZ.exe
  2⤵
  PID:4764
- C:\Windows\System\YGHqorP.exe
  C:\Windows\System\YGHqorP.exe
  2⤵
  PID:4184
- C:\Windows\System\GdjqDXC.exe
  C:\Windows\System\GdjqDXC.exe
  2⤵
  PID:1596
- C:\Windows\System\VCmxrvp.exe
  C:\Windows\System\VCmxrvp.exe
  2⤵
  PID:5000
- C:\Windows\System\lCWTAEx.exe
  C:\Windows\System\lCWTAEx.exe
  2⤵
  PID:3552
- C:\Windows\System\lXjluVx.exe
  C:\Windows\System\lXjluVx.exe
  2⤵
  PID:4900
- C:\Windows\System\wxDobep.exe
  C:\Windows\System\wxDobep.exe
  2⤵
  PID:440
- C:\Windows\System\zHemnEM.exe
  C:\Windows\System\zHemnEM.exe
  2⤵
  PID:3604
- C:\Windows\System\XMEivPs.exe
  C:\Windows\System\XMEivPs.exe
  2⤵
  PID:5884
- C:\Windows\System\dqXEoGj.exe
  C:\Windows\System\dqXEoGj.exe
  2⤵
  PID:5060
- C:\Windows\System\HqFrheK.exe
  C:\Windows\System\HqFrheK.exe
  2⤵
  PID:6184
- C:\Windows\System\EgxxcAe.exe
  C:\Windows\System\EgxxcAe.exe
  2⤵
  PID:6204
- C:\Windows\System\IZBUbqp.exe
  C:\Windows\System\IZBUbqp.exe
  2⤵
  PID:6248
- C:\Windows\System\QUwJRjV.exe
  C:\Windows\System\QUwJRjV.exe
  2⤵
  PID:6292
- C:\Windows\System\eyOzFvm.exe
  C:\Windows\System\eyOzFvm.exe
  2⤵
  PID:6344
- C:\Windows\System\qPxddQD.exe
  C:\Windows\System\qPxddQD.exe
  2⤵
  PID:6364
- C:\Windows\System\VzBywQA.exe
  C:\Windows\System\VzBywQA.exe
  2⤵
  PID:6388
- C:\Windows\System\fTPesUU.exe
  C:\Windows\System\fTPesUU.exe
  2⤵
  PID:6408
- C:\Windows\System\AhxegTn.exe
  C:\Windows\System\AhxegTn.exe
  2⤵
  PID:6428
- C:\Windows\System\DieAuSn.exe
  C:\Windows\System\DieAuSn.exe
  2⤵
  PID:6460
- C:\Windows\System\BdApAZG.exe
  C:\Windows\System\BdApAZG.exe
  2⤵
  PID:6500
- C:\Windows\System\kuGKogB.exe
  C:\Windows\System\kuGKogB.exe
  2⤵
  PID:6576
- C:\Windows\System\KkQfelD.exe
  C:\Windows\System\KkQfelD.exe
  2⤵
  PID:6596
- C:\Windows\System\JbisoGY.exe
  C:\Windows\System\JbisoGY.exe
  2⤵
  PID:6636
- C:\Windows\System\nuwMWvc.exe
  C:\Windows\System\nuwMWvc.exe
  2⤵
  PID:6668
- C:\Windows\System\CyTIfop.exe
  C:\Windows\System\CyTIfop.exe
  2⤵
  PID:6688
- C:\Windows\System\xMINgOS.exe
  C:\Windows\System\xMINgOS.exe
  2⤵
  PID:6708
- C:\Windows\System\ECvvsnz.exe
  C:\Windows\System\ECvvsnz.exe
  2⤵
  PID:6732
- C:\Windows\System\AoFCFzA.exe
  C:\Windows\System\AoFCFzA.exe
  2⤵
  PID:6752
- C:\Windows\System\cftlNRs.exe
  C:\Windows\System\cftlNRs.exe
  2⤵
  PID:6780
- C:\Windows\System\nwoMiCP.exe
  C:\Windows\System\nwoMiCP.exe
  2⤵
  PID:6796
- C:\Windows\System\ZCinUcn.exe
  C:\Windows\System\ZCinUcn.exe
  2⤵
  PID:6816
- C:\Windows\System\DngBcji.exe
  C:\Windows\System\DngBcji.exe
  2⤵
  PID:6840
- C:\Windows\System\JMYaNFy.exe
  C:\Windows\System\JMYaNFy.exe
  2⤵
  PID:6904
- C:\Windows\System\hfOVnjg.exe
  C:\Windows\System\hfOVnjg.exe
  2⤵
  PID:6920
- C:\Windows\System\xJAbkpk.exe
  C:\Windows\System\xJAbkpk.exe
  2⤵
  PID:6948
- C:\Windows\System\MlAECaf.exe
  C:\Windows\System\MlAECaf.exe
  2⤵
  PID:6968
- C:\Windows\System\KMyMFqR.exe
  C:\Windows\System\KMyMFqR.exe
  2⤵
  PID:6988
- C:\Windows\System\pbUhnUP.exe
  C:\Windows\System\pbUhnUP.exe
  2⤵
  PID:7012
- C:\Windows\System\QcyrYpD.exe
  C:\Windows\System\QcyrYpD.exe
  2⤵
  PID:7052
- C:\Windows\System\gvPXWQk.exe
  C:\Windows\System\gvPXWQk.exe
  2⤵
  PID:7072
- C:\Windows\System\COrsMJq.exe
  C:\Windows\System\COrsMJq.exe
  2⤵
  PID:7120
- C:\Windows\System\JQguvls.exe
  C:\Windows\System\JQguvls.exe
  2⤵
  PID:7140
- C:\Windows\System\brgQbgx.exe
  C:\Windows\System\brgQbgx.exe
  2⤵
  PID:6220
- C:\Windows\System\qgPwRil.exe
  C:\Windows\System\qgPwRil.exe
  2⤵
  PID:6216
- C:\Windows\System\JgebvXs.exe
  C:\Windows\System\JgebvXs.exe
  2⤵
  PID:6268
- C:\Windows\System\WTFPuWN.exe
  C:\Windows\System\WTFPuWN.exe
  2⤵
  PID:5300
- C:\Windows\System\rgetegF.exe
  C:\Windows\System\rgetegF.exe
  2⤵
  PID:6384
- C:\Windows\System\vfxZDpK.exe
  C:\Windows\System\vfxZDpK.exe
  2⤵
  PID:6416
- C:\Windows\System\wKFqikP.exe
  C:\Windows\System\wKFqikP.exe
  2⤵
  PID:3600
- C:\Windows\System\GArtQXw.exe
  C:\Windows\System\GArtQXw.exe
  2⤵
  PID:5976
- C:\Windows\System\zplhPEF.exe
  C:\Windows\System\zplhPEF.exe
  2⤵
  PID:6512
- C:\Windows\System\MOpYzxi.exe
  C:\Windows\System\MOpYzxi.exe
  2⤵
  PID:6452
- C:\Windows\System\UnvNiwc.exe
  C:\Windows\System\UnvNiwc.exe
  2⤵
  PID:6588
- C:\Windows\System\kxXUYzy.exe
  C:\Windows\System\kxXUYzy.exe
  2⤵
  PID:6628
- C:\Windows\System\rgCvzAd.exe
  C:\Windows\System\rgCvzAd.exe
  2⤵
  PID:6700
- C:\Windows\System\BFbFigA.exe
  C:\Windows\System\BFbFigA.exe
  2⤵
  PID:6748
- C:\Windows\System\qrldJHt.exe
  C:\Windows\System\qrldJHt.exe
  2⤵
  PID:6832
- C:\Windows\System\CKKruJa.exe
  C:\Windows\System\CKKruJa.exe
  2⤵
  PID:6960
- C:\Windows\System\LfOYTNt.exe
  C:\Windows\System\LfOYTNt.exe
  2⤵
  PID:6900
- C:\Windows\System\qmtCVOR.exe
  C:\Windows\System\qmtCVOR.exe
  2⤵
  PID:6984
- C:\Windows\System\bftlWVE.exe
  C:\Windows\System\bftlWVE.exe
  2⤵
  PID:7128
- C:\Windows\System\uYBdCCV.exe
  C:\Windows\System\uYBdCCV.exe
  2⤵
  PID:6304
- C:\Windows\System\pndEVId.exe
  C:\Windows\System\pndEVId.exe
  2⤵
  PID:2084
- C:\Windows\System\DefSKQJ.exe
  C:\Windows\System\DefSKQJ.exe
  2⤵
  PID:6436
- C:\Windows\System\KSJTIpH.exe
  C:\Windows\System\KSJTIpH.exe
  2⤵
  PID:6404
- C:\Windows\System\LvncMBg.exe
  C:\Windows\System\LvncMBg.exe
  2⤵
  PID:6632
- C:\Windows\System\omSOxXg.exe
  C:\Windows\System\omSOxXg.exe
  2⤵
  PID:6724
- C:\Windows\System\PfaZWPZ.exe
  C:\Windows\System\PfaZWPZ.exe
  2⤵
  PID:6912
- C:\Windows\System\WJAOFPj.exe
  C:\Windows\System\WJAOFPj.exe
  2⤵
  PID:1076
- C:\Windows\System\jkuQADl.exe
  C:\Windows\System\jkuQADl.exe
  2⤵
  PID:6212
- C:\Windows\System\GcUTdiZ.exe
  C:\Windows\System\GcUTdiZ.exe
  2⤵
  PID:6788
- C:\Windows\System\QZcObRe.exe
  C:\Windows\System\QZcObRe.exe
  2⤵
  PID:7100
- C:\Windows\System\bxEAoDZ.exe
  C:\Windows\System\bxEAoDZ.exe
  2⤵
  PID:7040
- C:\Windows\System\qdRgedk.exe
  C:\Windows\System\qdRgedk.exe
  2⤵
  PID:7172
- C:\Windows\System\pFqtiqZ.exe
  C:\Windows\System\pFqtiqZ.exe
  2⤵
  PID:7188
- C:\Windows\System\IFYotoT.exe
  C:\Windows\System\IFYotoT.exe
  2⤵
  PID:7240
- C:\Windows\System\zBgTfAq.exe
  C:\Windows\System\zBgTfAq.exe
  2⤵
  PID:7260
- C:\Windows\System\McIGDHI.exe
  C:\Windows\System\McIGDHI.exe
  2⤵
  PID:7280
- C:\Windows\System\AsJXGDG.exe
  C:\Windows\System\AsJXGDG.exe
  2⤵
  PID:7324
- C:\Windows\System\EUFEeuF.exe
  C:\Windows\System\EUFEeuF.exe
  2⤵
  PID:7364
- C:\Windows\System\etxNTsj.exe
  C:\Windows\System\etxNTsj.exe
  2⤵
  PID:7396
- C:\Windows\System\YGpHron.exe
  C:\Windows\System\YGpHron.exe
  2⤵
  PID:7416
- C:\Windows\System\tUhCYtj.exe
  C:\Windows\System\tUhCYtj.exe
  2⤵
  PID:7436
- C:\Windows\System\GXwbcak.exe
  C:\Windows\System\GXwbcak.exe
  2⤵
  PID:7464
- C:\Windows\System\JRKMheK.exe
  C:\Windows\System\JRKMheK.exe
  2⤵
  PID:7488
- C:\Windows\System\grdPIDM.exe
  C:\Windows\System\grdPIDM.exe
  2⤵
  PID:7508
- C:\Windows\System\ZqhPMDc.exe
  C:\Windows\System\ZqhPMDc.exe
  2⤵
  PID:7536
- C:\Windows\System\rpTROjb.exe
  C:\Windows\System\rpTROjb.exe
  2⤵
  PID:7564
- C:\Windows\System\hgWiMsH.exe
  C:\Windows\System\hgWiMsH.exe
  2⤵
  PID:7588
- C:\Windows\System\oQRhEGG.exe
  C:\Windows\System\oQRhEGG.exe
  2⤵
  PID:7608
- C:\Windows\System\PMxbdme.exe
  C:\Windows\System\PMxbdme.exe
  2⤵
  PID:7632
- C:\Windows\System\vwGGVaz.exe
  C:\Windows\System\vwGGVaz.exe
  2⤵
  PID:7664
- C:\Windows\System\EteDTnF.exe
  C:\Windows\System\EteDTnF.exe
  2⤵
  PID:7692
- C:\Windows\System\dHWkpkH.exe
  C:\Windows\System\dHWkpkH.exe
  2⤵
  PID:7708
- C:\Windows\System\LpOVjVs.exe
  C:\Windows\System\LpOVjVs.exe
  2⤵
  PID:7752
- C:\Windows\System\rZuXqCe.exe
  C:\Windows\System\rZuXqCe.exe
  2⤵
  PID:7812
- C:\Windows\System\SutFtXq.exe
  C:\Windows\System\SutFtXq.exe
  2⤵
  PID:7832
- C:\Windows\System\iRupGmI.exe
  C:\Windows\System\iRupGmI.exe
  2⤵
  PID:7852
- C:\Windows\System\eSzcNAi.exe
  C:\Windows\System\eSzcNAi.exe
  2⤵
  PID:7872
- C:\Windows\System\GDtlWnp.exe
  C:\Windows\System\GDtlWnp.exe
  2⤵
  PID:7900
- C:\Windows\System\VBljDTH.exe
  C:\Windows\System\VBljDTH.exe
  2⤵
  PID:7928
- C:\Windows\System\HEqHFtD.exe
  C:\Windows\System\HEqHFtD.exe
  2⤵
  PID:7948
- C:\Windows\System\WMYRuME.exe
  C:\Windows\System\WMYRuME.exe
  2⤵
  PID:8004
- C:\Windows\System\weSXxtW.exe
  C:\Windows\System\weSXxtW.exe
  2⤵
  PID:8024
- C:\Windows\System\wWiHbMW.exe
  C:\Windows\System\wWiHbMW.exe
  2⤵
  PID:8052
- C:\Windows\System\fCiHqAV.exe
  C:\Windows\System\fCiHqAV.exe
  2⤵
  PID:8076
- C:\Windows\System\ZkaqtyZ.exe
  C:\Windows\System\ZkaqtyZ.exe
  2⤵
  PID:8100
- C:\Windows\System\urVhgMb.exe
  C:\Windows\System\urVhgMb.exe
  2⤵
  PID:8176
- C:\Windows\System\AGLfOhX.exe
  C:\Windows\System\AGLfOhX.exe
  2⤵
  PID:7196
- C:\Windows\System\JZxBmZB.exe
  C:\Windows\System\JZxBmZB.exe
  2⤵
  PID:7252
- C:\Windows\System\JvgyxNK.exe
  C:\Windows\System\JvgyxNK.exe
  2⤵
  PID:7316
- C:\Windows\System\GwyZGMp.exe
  C:\Windows\System\GwyZGMp.exe
  2⤵
  PID:7384
- C:\Windows\System\SzbbBda.exe
  C:\Windows\System\SzbbBda.exe
  2⤵
  PID:7484
- C:\Windows\System\DlvbYRx.exe
  C:\Windows\System\DlvbYRx.exe
  2⤵
  PID:7516
- C:\Windows\System\bFnrZWE.exe
  C:\Windows\System\bFnrZWE.exe
  2⤵
  PID:7560
- C:\Windows\System\yBiKKDu.exe
  C:\Windows\System\yBiKKDu.exe
  2⤵
  PID:7572
- C:\Windows\System\TkXOTFB.exe
  C:\Windows\System\TkXOTFB.exe
  2⤵
  PID:7604
- C:\Windows\System\ZrMCflU.exe
  C:\Windows\System\ZrMCflU.exe
  2⤵
  PID:7736
- C:\Windows\System\CGgzAdV.exe
  C:\Windows\System\CGgzAdV.exe
  2⤵
  PID:7744
- C:\Windows\System\GWsKCfn.exe
  C:\Windows\System\GWsKCfn.exe
  2⤵
  PID:7840
- C:\Windows\System\CWFTgia.exe
  C:\Windows\System\CWFTgia.exe
  2⤵
  PID:7880
- C:\Windows\System\crNjgLi.exe
  C:\Windows\System\crNjgLi.exe
  2⤵
  PID:7988
- C:\Windows\System\CptuJll.exe
  C:\Windows\System\CptuJll.exe
  2⤵
  PID:7984
- C:\Windows\System\UWSHMZc.exe
  C:\Windows\System\UWSHMZc.exe
  2⤵
  PID:8032
- C:\Windows\System\vFDqosH.exe
  C:\Windows\System\vFDqosH.exe
  2⤵
  PID:8096
- C:\Windows\System\hIMdQWA.exe
  C:\Windows\System\hIMdQWA.exe
  2⤵
  PID:8188
- C:\Windows\System\vLDFSHZ.exe
  C:\Windows\System\vLDFSHZ.exe
  2⤵
  PID:7348
- C:\Windows\System\TUpvppn.exe
  C:\Windows\System\TUpvppn.exe
  2⤵
  PID:7408
- C:\Windows\System\SDqfdWD.exe
  C:\Windows\System\SDqfdWD.exe
  2⤵
  PID:7824
- C:\Windows\System\sFAvMkx.exe
  C:\Windows\System\sFAvMkx.exe
  2⤵
  PID:7864
- C:\Windows\System\kuUMexy.exe
  C:\Windows\System\kuUMexy.exe
  2⤵
  PID:8068
- C:\Windows\System\COBKhKN.exe
  C:\Windows\System\COBKhKN.exe
  2⤵
  PID:7180
- C:\Windows\System\gAxZeTI.exe
  C:\Windows\System\gAxZeTI.exe
  2⤵
  PID:7332
- C:\Windows\System\ZUUwOAS.exe
  C:\Windows\System\ZUUwOAS.exe
  2⤵
  PID:8184
- C:\Windows\System\snZeOZz.exe
  C:\Windows\System\snZeOZz.exe
  2⤵
  PID:8212
- C:\Windows\System\qSqfJwc.exe
  C:\Windows\System\qSqfJwc.exe
  2⤵
  PID:8236
- C:\Windows\System\GpIXpQL.exe
  C:\Windows\System\GpIXpQL.exe
  2⤵
  PID:8252
- C:\Windows\System\mZbRNqs.exe
  C:\Windows\System\mZbRNqs.exe
  2⤵
  PID:8268
- C:\Windows\System\rWMppBv.exe
  C:\Windows\System\rWMppBv.exe
  2⤵
  PID:8288
- C:\Windows\System\fDmDsdZ.exe
  C:\Windows\System\fDmDsdZ.exe
  2⤵
  PID:8316
- C:\Windows\System\WKCCLKL.exe
  C:\Windows\System\WKCCLKL.exe
  2⤵
  PID:8348
- C:\Windows\System\RDJYprY.exe
  C:\Windows\System\RDJYprY.exe
  2⤵
  PID:8376
- C:\Windows\System\HntiQmm.exe
  C:\Windows\System\HntiQmm.exe
  2⤵
  PID:8396
- C:\Windows\System\eNuCnJN.exe
  C:\Windows\System\eNuCnJN.exe
  2⤵
  PID:8440
- C:\Windows\System\nUPfHdy.exe
  C:\Windows\System\nUPfHdy.exe
  2⤵
  PID:8464
- C:\Windows\System\hjBUTLa.exe
  C:\Windows\System\hjBUTLa.exe
  2⤵
  PID:8500
- C:\Windows\System\COxNNly.exe
  C:\Windows\System\COxNNly.exe
  2⤵
  PID:8520
- C:\Windows\System\ZcrwEyK.exe
  C:\Windows\System\ZcrwEyK.exe
  2⤵
  PID:8548
- C:\Windows\System\HLgJEmL.exe
  C:\Windows\System\HLgJEmL.exe
  2⤵
  PID:8572
- C:\Windows\System\NwCabFq.exe
  C:\Windows\System\NwCabFq.exe
  2⤵
  PID:8588
- C:\Windows\System\LjfohAJ.exe
  C:\Windows\System\LjfohAJ.exe
  2⤵
  PID:8624
- C:\Windows\System\njffVBS.exe
  C:\Windows\System\njffVBS.exe
  2⤵
  PID:8644
- C:\Windows\System\OUQYEVe.exe
  C:\Windows\System\OUQYEVe.exe
  2⤵
  PID:8692
- C:\Windows\System\orSOdTi.exe
  C:\Windows\System\orSOdTi.exe
  2⤵
  PID:8720
- C:\Windows\System\aGZEAzf.exe
  C:\Windows\System\aGZEAzf.exe
  2⤵
  PID:8748
- C:\Windows\System\UDXckgD.exe
  C:\Windows\System\UDXckgD.exe
  2⤵
  PID:8776
- C:\Windows\System\QXFSyfp.exe
  C:\Windows\System\QXFSyfp.exe
  2⤵
  PID:8796
- C:\Windows\System\hkDjRKk.exe
  C:\Windows\System\hkDjRKk.exe
  2⤵
  PID:8812
- C:\Windows\System\yNWpKaC.exe
  C:\Windows\System\yNWpKaC.exe
  2⤵
  PID:8832
- C:\Windows\System\DawRLEa.exe
  C:\Windows\System\DawRLEa.exe
  2⤵
  PID:8852
- C:\Windows\System\SaeOiMz.exe
  C:\Windows\System\SaeOiMz.exe
  2⤵
  PID:8876
- C:\Windows\System\XvEOCqC.exe
  C:\Windows\System\XvEOCqC.exe
  2⤵
  PID:8896
- C:\Windows\System\MIYukNs.exe
  C:\Windows\System\MIYukNs.exe
  2⤵
  PID:8916
- C:\Windows\System\XnmQafc.exe
  C:\Windows\System\XnmQafc.exe
  2⤵
  PID:9004
- C:\Windows\System\ZZANvSo.exe
  C:\Windows\System\ZZANvSo.exe
  2⤵
  PID:9036
- C:\Windows\System\kkwLbqY.exe
  C:\Windows\System\kkwLbqY.exe
  2⤵
  PID:9072
- C:\Windows\System\nNEOrOP.exe
  C:\Windows\System\nNEOrOP.exe
  2⤵
  PID:9092
- C:\Windows\System\nQmEiXL.exe
  C:\Windows\System\nQmEiXL.exe
  2⤵
  PID:9136
- C:\Windows\System\pfbJCqA.exe
  C:\Windows\System\pfbJCqA.exe
  2⤵
  PID:9160
- C:\Windows\System\AbmxojB.exe
  C:\Windows\System\AbmxojB.exe
  2⤵
  PID:9208
- C:\Windows\System\TpQFyTZ.exe
  C:\Windows\System\TpQFyTZ.exe
  2⤵
  PID:7792
- C:\Windows\System\McDSudC.exe
  C:\Windows\System\McDSudC.exe
  2⤵
  PID:8224
- C:\Windows\System\Eztwvsa.exe
  C:\Windows\System\Eztwvsa.exe
  2⤵
  PID:8280
- C:\Windows\System\bSkTVLb.exe
  C:\Windows\System\bSkTVLb.exe
  2⤵
  PID:8408
- C:\Windows\System\CeexNhd.exe
  C:\Windows\System\CeexNhd.exe
  2⤵
  PID:8412
- C:\Windows\System\ZxwNgRm.exe
  C:\Windows\System\ZxwNgRm.exe
  2⤵
  PID:8456
- C:\Windows\System\WRoaZBq.exe
  C:\Windows\System\WRoaZBq.exe
  2⤵
  PID:8508
- C:\Windows\System\rqDPaVZ.exe
  C:\Windows\System\rqDPaVZ.exe
  2⤵
  PID:8636
- C:\Windows\System\joVykBH.exe
  C:\Windows\System\joVykBH.exe
  2⤵
  PID:8728
- C:\Windows\System\eajmIlD.exe
  C:\Windows\System\eajmIlD.exe
  2⤵
  PID:8688
- C:\Windows\System\vcrAVUQ.exe
  C:\Windows\System\vcrAVUQ.exe
  2⤵
  PID:8840
- C:\Windows\System\ASUGZaW.exe
  C:\Windows\System\ASUGZaW.exe
  2⤵
  PID:8864
- C:\Windows\System\PWpScKT.exe
  C:\Windows\System\PWpScKT.exe
  2⤵
  PID:8968
- C:\Windows\System\gmLAbAo.exe
  C:\Windows\System\gmLAbAo.exe
  2⤵
  PID:8980
- C:\Windows\System\QCpwOAb.exe
  C:\Windows\System\QCpwOAb.exe
  2⤵
  PID:9064
- C:\Windows\System\dIVQBMZ.exe
  C:\Windows\System\dIVQBMZ.exe
  2⤵
  PID:9124
- C:\Windows\System\tylphmt.exe
  C:\Windows\System\tylphmt.exe
  2⤵
  PID:7760
- C:\Windows\System\cjXXcbV.exe
  C:\Windows\System\cjXXcbV.exe
  2⤵
  PID:8344
- C:\Windows\System\gXOjRVp.exe
  C:\Windows\System\gXOjRVp.exe
  2⤵
  PID:8492
- C:\Windows\System\uufzyOM.exe
  C:\Windows\System\uufzyOM.exe
  2⤵
  PID:8656
- C:\Windows\System\cooFvmF.exe
  C:\Windows\System\cooFvmF.exe
  2⤵
  PID:8764
- C:\Windows\System\HNEvCbh.exe
  C:\Windows\System\HNEvCbh.exe
  2⤵
  PID:9028
- C:\Windows\System\VuCqRDg.exe
  C:\Windows\System\VuCqRDg.exe
  2⤵
  PID:8932
- C:\Windows\System\FLeStGB.exe
  C:\Windows\System\FLeStGB.exe
  2⤵
  PID:9188
- C:\Windows\System\XZPCMhg.exe
  C:\Windows\System\XZPCMhg.exe
  2⤵
  PID:8392
- C:\Windows\System\cmTFvMC.exe
  C:\Windows\System\cmTFvMC.exe
  2⤵
  PID:8888
- C:\Windows\System\RqbUFkx.exe
  C:\Windows\System\RqbUFkx.exe
  2⤵
  PID:8956
- C:\Windows\System\hvJKPYI.exe
  C:\Windows\System\hvJKPYI.exe
  2⤵
  PID:9220
- C:\Windows\System\DrhRkSD.exe
  C:\Windows\System\DrhRkSD.exe
  2⤵
  PID:9244
- C:\Windows\System\oyholFw.exe
  C:\Windows\System\oyholFw.exe
  2⤵
  PID:9264
- C:\Windows\System\ovTsBoD.exe
  C:\Windows\System\ovTsBoD.exe
  2⤵
  PID:9288
- C:\Windows\System\hYNLJcs.exe
  C:\Windows\System\hYNLJcs.exe
  2⤵
  PID:9312
- C:\Windows\System\JerCTyw.exe
  C:\Windows\System\JerCTyw.exe
  2⤵
  PID:9360
- C:\Windows\System\UKgtHrd.exe
  C:\Windows\System\UKgtHrd.exe
  2⤵
  PID:9396
- C:\Windows\System\dLIOdvf.exe
  C:\Windows\System\dLIOdvf.exe
  2⤵
  PID:9420
- C:\Windows\System\YcxZXHo.exe
  C:\Windows\System\YcxZXHo.exe
  2⤵
  PID:9440
- C:\Windows\System\lMLNxYP.exe
  C:\Windows\System\lMLNxYP.exe
  2⤵
  PID:9476
- C:\Windows\System\tKYBWHw.exe
  C:\Windows\System\tKYBWHw.exe
  2⤵
  PID:9500
- C:\Windows\System\aiMvyVP.exe
  C:\Windows\System\aiMvyVP.exe
  2⤵
  PID:9524
- C:\Windows\System\pkGFCIk.exe
  C:\Windows\System\pkGFCIk.exe
  2⤵
  PID:9552
- C:\Windows\System\MrKUMLw.exe
  C:\Windows\System\MrKUMLw.exe
  2⤵
  PID:9612
- C:\Windows\System\KCdElmm.exe
  C:\Windows\System\KCdElmm.exe
  2⤵
  PID:9636
- C:\Windows\System\gxDjOoi.exe
  C:\Windows\System\gxDjOoi.exe
  2⤵
  PID:9660
- C:\Windows\System\TqucymR.exe
  C:\Windows\System\TqucymR.exe
  2⤵
  PID:9680
- C:\Windows\System\zuQcqVA.exe
  C:\Windows\System\zuQcqVA.exe
  2⤵
  PID:9704
- C:\Windows\System\quAhWQL.exe
  C:\Windows\System\quAhWQL.exe
  2⤵
  PID:9724
- C:\Windows\System\xVRTNty.exe
  C:\Windows\System\xVRTNty.exe
  2⤵
  PID:9760
- C:\Windows\System\rChrQWV.exe
  C:\Windows\System\rChrQWV.exe
  2⤵
  PID:9784
- C:\Windows\System\tnZxNOw.exe
  C:\Windows\System\tnZxNOw.exe
  2⤵
  PID:9832
- C:\Windows\System\vOrlEqA.exe
  C:\Windows\System\vOrlEqA.exe
  2⤵
  PID:9852
- C:\Windows\System\FNJmoZV.exe
  C:\Windows\System\FNJmoZV.exe
  2⤵
  PID:9904
- C:\Windows\System\IDzwRkj.exe
  C:\Windows\System\IDzwRkj.exe
  2⤵
  PID:9956
- C:\Windows\System\gzANdWa.exe
  C:\Windows\System\gzANdWa.exe
  2⤵
  PID:10004
- C:\Windows\System\PgEEJyh.exe
  C:\Windows\System\PgEEJyh.exe
  2⤵
  PID:10020
- C:\Windows\System\sEVGqhl.exe
  C:\Windows\System\sEVGqhl.exe
  2⤵
  PID:10104
- C:\Windows\System\ZRKUJMQ.exe
  C:\Windows\System\ZRKUJMQ.exe
  2⤵
  PID:10124
- C:\Windows\System\aVBgFsF.exe
  C:\Windows\System\aVBgFsF.exe
  2⤵
  PID:10140
- C:\Windows\System\egtbvfE.exe
  C:\Windows\System\egtbvfE.exe
  2⤵
  PID:10156
- C:\Windows\System\EJRFpaA.exe
  C:\Windows\System\EJRFpaA.exe
  2⤵
  PID:10172
- C:\Windows\System\fdcPMmn.exe
  C:\Windows\System\fdcPMmn.exe
  2⤵
  PID:10188
- C:\Windows\System\BcQCRDv.exe
  C:\Windows\System\BcQCRDv.exe
  2⤵
  PID:10208
- C:\Windows\System\XKvZFXM.exe
  C:\Windows\System\XKvZFXM.exe
  2⤵
  PID:9148
- C:\Windows\System\zRcxwgG.exe
  C:\Windows\System\zRcxwgG.exe
  2⤵
  PID:9272
- C:\Windows\System\ykDUIpx.exe
  C:\Windows\System\ykDUIpx.exe
  2⤵
  PID:9304
- C:\Windows\System\ttwYRFH.exe
  C:\Windows\System\ttwYRFH.exe
  2⤵
  PID:9432
- C:\Windows\System\LOwdBWS.exe
  C:\Windows\System\LOwdBWS.exe
  2⤵
  PID:9464
- C:\Windows\System\jnAaiRj.exe
  C:\Windows\System\jnAaiRj.exe
  2⤵
  PID:9644
- C:\Windows\System\HTWflAe.exe
  C:\Windows\System\HTWflAe.exe
  2⤵
  PID:9736
- C:\Windows\System\pEOygSF.exe
  C:\Windows\System\pEOygSF.exe
  2⤵
  PID:9876
- C:\Windows\System\spGukfj.exe
  C:\Windows\System\spGukfj.exe
  2⤵
  PID:9912
- C:\Windows\System\gJNLsAY.exe
  C:\Windows\System\gJNLsAY.exe
  2⤵
  PID:10012
- C:\Windows\System\XeZuqqd.exe
  C:\Windows\System\XeZuqqd.exe
  2⤵
  PID:10096
- C:\Windows\System\yDdiieh.exe
  C:\Windows\System\yDdiieh.exe
  2⤵
  PID:9936
- C:\Windows\System\sFStnrC.exe
  C:\Windows\System\sFStnrC.exe
  2⤵
  PID:9976
- C:\Windows\System\ugYbKJP.exe
  C:\Windows\System\ugYbKJP.exe
  2⤵
  PID:10076
- C:\Windows\System\RwYJUgq.exe
  C:\Windows\System\RwYJUgq.exe
  2⤵
  PID:10132
- C:\Windows\System\Svmnlyq.exe
  C:\Windows\System\Svmnlyq.exe
  2⤵
  PID:10152
- C:\Windows\System\eqaWzOF.exe
  C:\Windows\System\eqaWzOF.exe
  2⤵
  PID:10072
- C:\Windows\System\gIrfBCG.exe
  C:\Windows\System\gIrfBCG.exe
  2⤵
  PID:8824
- C:\Windows\System\bdKajRU.exe
  C:\Windows\System\bdKajRU.exe
  2⤵
  PID:9404
- C:\Windows\System\AsWcYOH.exe
  C:\Windows\System\AsWcYOH.exe
  2⤵
  PID:9548
- C:\Windows\System\rRSWUtD.exe
  C:\Windows\System\rRSWUtD.exe
  2⤵
  PID:9848
- C:\Windows\System\AoCdTPa.exe
  C:\Windows\System\AoCdTPa.exe
  2⤵
  PID:9860
- C:\Windows\System\udtfcVR.exe
  C:\Windows\System\udtfcVR.exe
  2⤵
  PID:10000
- C:\Windows\System\evkcdwf.exe
  C:\Windows\System\evkcdwf.exe
  2⤵
  PID:9892
- C:\Windows\System\XikdmuV.exe
  C:\Windows\System\XikdmuV.exe
  2⤵
  PID:9952
- C:\Windows\System\qvpTWQH.exe
  C:\Windows\System\qvpTWQH.exe
  2⤵
  PID:10048
- C:\Windows\System\OZVmdcY.exe
  C:\Windows\System\OZVmdcY.exe
  2⤵
  PID:10184
- C:\Windows\System\HcTQsaw.exe
  C:\Windows\System\HcTQsaw.exe
  2⤵
  PID:9296
- C:\Windows\System\AsUaiBV.exe
  C:\Windows\System\AsUaiBV.exe
  2⤵
  PID:9376
- C:\Windows\System\fPTcSLB.exe
  C:\Windows\System\fPTcSLB.exe
  2⤵
  PID:10264
- C:\Windows\System\PyxOBor.exe
  C:\Windows\System\PyxOBor.exe
  2⤵
  PID:10288
- C:\Windows\System\JpkWCMj.exe
  C:\Windows\System\JpkWCMj.exe
  2⤵
  PID:10316
- C:\Windows\System\GSZxLYs.exe
  C:\Windows\System\GSZxLYs.exe
  2⤵
  PID:10360
- C:\Windows\System\HyZoeME.exe
  C:\Windows\System\HyZoeME.exe
  2⤵
  PID:10388
- C:\Windows\System\JepuRAX.exe
  C:\Windows\System\JepuRAX.exe
  2⤵
  PID:10408
- C:\Windows\System\TOLrrpE.exe
  C:\Windows\System\TOLrrpE.exe
  2⤵
  PID:10428
- C:\Windows\System\jnERewm.exe
  C:\Windows\System\jnERewm.exe
  2⤵
  PID:10464
- C:\Windows\System\hfMGZEa.exe
  C:\Windows\System\hfMGZEa.exe
  2⤵
  PID:10484
- C:\Windows\System\BnZgdix.exe
  C:\Windows\System\BnZgdix.exe
  2⤵
  PID:10516
- C:\Windows\System\aytKSaN.exe
  C:\Windows\System\aytKSaN.exe
  2⤵
  PID:10544
- C:\Windows\System\ReDZmSn.exe
  C:\Windows\System\ReDZmSn.exe
  2⤵
  PID:10568
- C:\Windows\System\LoAWeQx.exe
  C:\Windows\System\LoAWeQx.exe
  2⤵
  PID:10592
- C:\Windows\System\ZFtTcOJ.exe
  C:\Windows\System\ZFtTcOJ.exe
  2⤵
  PID:10612
- C:\Windows\System\CIcAIPd.exe
  C:\Windows\System\CIcAIPd.exe
  2⤵
  PID:10640
- C:\Windows\System\thiWBZv.exe
  C:\Windows\System\thiWBZv.exe
  2⤵
  PID:10668
- C:\Windows\System\KPDyGnA.exe
  C:\Windows\System\KPDyGnA.exe
  2⤵
  PID:10696
- C:\Windows\System\LvJIMjV.exe
  C:\Windows\System\LvJIMjV.exe
  2⤵
  PID:10756
- C:\Windows\System\VSwHCZr.exe
  C:\Windows\System\VSwHCZr.exe
  2⤵
  PID:10772
- C:\Windows\System\mvSEUVM.exe
  C:\Windows\System\mvSEUVM.exe
  2⤵
  PID:10800
- C:\Windows\System\akFKqJD.exe
  C:\Windows\System\akFKqJD.exe
  2⤵
  PID:10820
- C:\Windows\System\PhBhSKi.exe
  C:\Windows\System\PhBhSKi.exe
  2⤵
  PID:10840
- C:\Windows\System\UYjaZSU.exe
  C:\Windows\System\UYjaZSU.exe
  2⤵
  PID:10860
- C:\Windows\System\EczdgsS.exe
  C:\Windows\System\EczdgsS.exe
  2⤵
  PID:10900
- C:\Windows\System\RqFicMD.exe
  C:\Windows\System\RqFicMD.exe
  2⤵
  PID:10948
- C:\Windows\System\MfDchFr.exe
  C:\Windows\System\MfDchFr.exe
  2⤵
  PID:10984
- C:\Windows\System\bXqSdWK.exe
  C:\Windows\System\bXqSdWK.exe
  2⤵
  PID:11016
- C:\Windows\System\XhYMxvo.exe
  C:\Windows\System\XhYMxvo.exe
  2⤵
  PID:11032
- C:\Windows\System\vnwhXdk.exe
  C:\Windows\System\vnwhXdk.exe
  2⤵
  PID:11072
- C:\Windows\System\uWOyBnt.exe
  C:\Windows\System\uWOyBnt.exe
  2⤵
  PID:11096
- C:\Windows\System\kqQfxUB.exe
  C:\Windows\System\kqQfxUB.exe
  2⤵
  PID:11124
- C:\Windows\System\mzkkbvN.exe
  C:\Windows\System\mzkkbvN.exe
  2⤵
  PID:11144
- C:\Windows\System\kdsBpgX.exe
  C:\Windows\System\kdsBpgX.exe
  2⤵
  PID:11168
- C:\Windows\System\gzcsOOT.exe
  C:\Windows\System\gzcsOOT.exe
  2⤵
  PID:11212
- C:\Windows\System\GJjcisk.exe
  C:\Windows\System\GJjcisk.exe
  2⤵
  PID:11236
- C:\Windows\System\DkSPfgX.exe
  C:\Windows\System\DkSPfgX.exe
  2⤵
  PID:11260
- C:\Windows\System\wZAtTqR.exe
  C:\Windows\System\wZAtTqR.exe
  2⤵
  PID:9948
- C:\Windows\System\bQBHeQz.exe
  C:\Windows\System\bQBHeQz.exe
  2⤵
  PID:10276
- C:\Windows\System\EVRwaYR.exe
  C:\Windows\System\EVRwaYR.exe
  2⤵
  PID:10396
- C:\Windows\System\FuIuULI.exe
  C:\Windows\System\FuIuULI.exe
  2⤵
  PID:10436
- C:\Windows\System\eHMxjsz.exe
  C:\Windows\System\eHMxjsz.exe
  2⤵
  PID:10496
- C:\Windows\System\ZbftCBW.exe
  C:\Windows\System\ZbftCBW.exe
  2⤵
  PID:10540
- C:\Windows\System\eTFfUxF.exe
  C:\Windows\System\eTFfUxF.exe
  2⤵
  PID:10556
- C:\Windows\System\HleMGXf.exe
  C:\Windows\System\HleMGXf.exe
  2⤵
  PID:10608
- C:\Windows\System\ovoAkEO.exe
  C:\Windows\System\ovoAkEO.exe
  2⤵
  PID:10720
- C:\Windows\System\QDALIdA.exe
  C:\Windows\System\QDALIdA.exe
  2⤵
  PID:10748
- C:\Windows\System\KZaiGhq.exe
  C:\Windows\System\KZaiGhq.exe
  2⤵
  PID:10832
- C:\Windows\System\VpZnhIV.exe
  C:\Windows\System\VpZnhIV.exe
  2⤵
  PID:10936
- C:\Windows\System\qPCmRTR.exe
  C:\Windows\System\qPCmRTR.exe
  2⤵
  PID:10980
- C:\Windows\System\VrLfXQL.exe
  C:\Windows\System\VrLfXQL.exe
  2⤵
  PID:11088
- C:\Windows\System\XalDuWD.exe
  C:\Windows\System\XalDuWD.exe
  2⤵
  PID:11140
- C:\Windows\System\kOzeJee.exe
  C:\Windows\System\kOzeJee.exe
  2⤵
  PID:11232
- C:\Windows\System\joJtswq.exe
  C:\Windows\System\joJtswq.exe
  2⤵
  PID:11204
- C:\Windows\System\YNZkoVJ.exe
  C:\Windows\System\YNZkoVJ.exe
  2⤵
  PID:10092
- C:\Windows\System\swcYcnc.exe
  C:\Windows\System\swcYcnc.exe
  2⤵
  PID:10308
- C:\Windows\System\XGNnAfd.exe
  C:\Windows\System\XGNnAfd.exe
  2⤵
  PID:10380
- C:\Windows\System\EZfAAzW.exe
  C:\Windows\System\EZfAAzW.exe
  2⤵
  PID:10532
- C:\Windows\System\rChSmAE.exe
  C:\Windows\System\rChSmAE.exe
  2⤵
  PID:10744
- C:\Windows\System\zLDdSii.exe
  C:\Windows\System\zLDdSii.exe
  2⤵
  PID:10976
- C:\Windows\System\YPtvbIJ.exe
  C:\Windows\System\YPtvbIJ.exe
  2⤵
  PID:11224
- C:\Windows\System\cpXjDoz.exe
  C:\Windows\System\cpXjDoz.exe
  2⤵
  PID:10356
- C:\Windows\System\EqlbWhv.exe
  C:\Windows\System\EqlbWhv.exe
  2⤵
  PID:10680
- C:\Windows\System\rekYPpQ.exe
  C:\Windows\System\rekYPpQ.exe
  2⤵
  PID:10740
- C:\Windows\System\iEtrczw.exe
  C:\Windows\System\iEtrczw.exe
  2⤵
  PID:10336
- C:\Windows\System\YtIYywf.exe
  C:\Windows\System\YtIYywf.exe
  2⤵
  PID:11268
- C:\Windows\System\bIxpLcf.exe
  C:\Windows\System\bIxpLcf.exe
  2⤵
  PID:11284
- C:\Windows\System\kcnRjRM.exe
  C:\Windows\System\kcnRjRM.exe
  2⤵
  PID:11324
- C:\Windows\System\UlywkgL.exe
  C:\Windows\System\UlywkgL.exe
  2⤵
  PID:11348
- C:\Windows\System\RHLHDDO.exe
  C:\Windows\System\RHLHDDO.exe
  2⤵
  PID:11368
- C:\Windows\System\tppWGOV.exe
  C:\Windows\System\tppWGOV.exe
  2⤵
  PID:11408
- C:\Windows\System\CCFKJqv.exe
  C:\Windows\System\CCFKJqv.exe
  2⤵
  PID:11424
- C:\Windows\System\nSDAdMc.exe
  C:\Windows\System\nSDAdMc.exe
  2⤵
  PID:11444
- C:\Windows\System\EHweoQo.exe
  C:\Windows\System\EHweoQo.exe
  2⤵
  PID:11484
- C:\Windows\System\EvruLVw.exe
  C:\Windows\System\EvruLVw.exe
  2⤵
  PID:11508
- C:\Windows\System\cWyRIsR.exe
  C:\Windows\System\cWyRIsR.exe
  2⤵
  PID:11540
- C:\Windows\System\MZgZVjs.exe
  C:\Windows\System\MZgZVjs.exe
  2⤵
  PID:11556
- C:\Windows\System\rNLESzY.exe
  C:\Windows\System\rNLESzY.exe
  2⤵
  PID:11612
- C:\Windows\System\ypwaTld.exe
  C:\Windows\System\ypwaTld.exe
  2⤵
  PID:11628
- C:\Windows\System\kgYcAUa.exe
  C:\Windows\System\kgYcAUa.exe
  2⤵
  PID:11668
- C:\Windows\System\PKyralx.exe
  C:\Windows\System\PKyralx.exe
  2⤵
  PID:11700
- C:\Windows\System\YkYWYQK.exe
  C:\Windows\System\YkYWYQK.exe
  2⤵
  PID:11724
- C:\Windows\System\KcUbXcv.exe
  C:\Windows\System\KcUbXcv.exe
  2⤵
  PID:11740
- C:\Windows\System\JMHYrto.exe
  C:\Windows\System\JMHYrto.exe
  2⤵
  PID:11768
- C:\Windows\System\itlXZQH.exe
  C:\Windows\System\itlXZQH.exe
  2⤵
  PID:11792
- C:\Windows\System\iQoTbAe.exe
  C:\Windows\System\iQoTbAe.exe
  2⤵
  PID:11816
- C:\Windows\System\bbqUSpr.exe
  C:\Windows\System\bbqUSpr.exe
  2⤵
  PID:11840
- C:\Windows\System\zBptqkP.exe
  C:\Windows\System\zBptqkP.exe
  2⤵
  PID:11888
- C:\Windows\System\wnZkMyd.exe
  C:\Windows\System\wnZkMyd.exe
  2⤵
  PID:11908
- C:\Windows\System\WTbvpNp.exe
  C:\Windows\System\WTbvpNp.exe
  2⤵
  PID:11948
- C:\Windows\System\LoRyGWo.exe
  C:\Windows\System\LoRyGWo.exe
  2⤵
  PID:11972
- C:\Windows\System\RAjGdyU.exe
  C:\Windows\System\RAjGdyU.exe
  2⤵
  PID:11992
- C:\Windows\System\wpypUlh.exe
  C:\Windows\System\wpypUlh.exe
  2⤵
  PID:12032
- C:\Windows\System\hQOqgpk.exe
  C:\Windows\System\hQOqgpk.exe
  2⤵
  PID:12056
- C:\Windows\System\ETnxIUR.exe
  C:\Windows\System\ETnxIUR.exe
  2⤵
  PID:12076
- C:\Windows\System\CCLfKaM.exe
  C:\Windows\System\CCLfKaM.exe
  2⤵
  PID:12100
- C:\Windows\System\RHaTAaP.exe
  C:\Windows\System\RHaTAaP.exe
  2⤵
  PID:12124
- C:\Windows\System\cgTuDLe.exe
  C:\Windows\System\cgTuDLe.exe
  2⤵
  PID:12172
- C:\Windows\System\bnbBwiQ.exe
  C:\Windows\System\bnbBwiQ.exe
  2⤵
  PID:12192
- C:\Windows\System\dnxBQha.exe
  C:\Windows\System\dnxBQha.exe
  2⤵
  PID:12236
- C:\Windows\System\npZWazt.exe
  C:\Windows\System\npZWazt.exe
  2⤵
  PID:12260
- C:\Windows\System\zbqiCry.exe
  C:\Windows\System\zbqiCry.exe
  2⤵
  PID:11192
- C:\Windows\System\RQZHvMR.exe
  C:\Windows\System\RQZHvMR.exe
  2⤵
  PID:11336
- C:\Windows\System\eAPgFRe.exe
  C:\Windows\System\eAPgFRe.exe
  2⤵
  PID:11364
- C:\Windows\System\VjHqbnK.exe
  C:\Windows\System\VjHqbnK.exe
  2⤵
  PID:11436
- C:\Windows\System\iHlISkr.exe
  C:\Windows\System\iHlISkr.exe
  2⤵
  PID:11524
- C:\Windows\System\BEbauir.exe
  C:\Windows\System\BEbauir.exe
  2⤵
  PID:10920
- C:\Windows\System\ebAqnJr.exe
  C:\Windows\System\ebAqnJr.exe
  2⤵
  PID:11620
- C:\Windows\System\DQHPeYG.exe
  C:\Windows\System\DQHPeYG.exe
  2⤵
  PID:11688
- C:\Windows\System\TKHLcfS.exe
  C:\Windows\System\TKHLcfS.exe
  2⤵
  PID:11712
- C:\Windows\System\IuEscSd.exe
  C:\Windows\System\IuEscSd.exe
  2⤵
  PID:11752
- C:\Windows\System\qArzUVi.exe
  C:\Windows\System\qArzUVi.exe
  2⤵
  PID:11824
- C:\Windows\System\zfenMVK.exe
  C:\Windows\System\zfenMVK.exe
  2⤵
  PID:11868
- C:\Windows\System\mSOSmzr.exe
  C:\Windows\System\mSOSmzr.exe
  2⤵
  PID:12024
- C:\Windows\System\vfEfydF.exe
  C:\Windows\System\vfEfydF.exe
  2⤵
  PID:12064
- C:\Windows\System\yvsWniw.exe
  C:\Windows\System\yvsWniw.exe
  2⤵
  PID:12120
- C:\Windows\System\uhNphHR.exe
  C:\Windows\System\uhNphHR.exe
  2⤵
  PID:12208
- C:\Windows\System\PNlBfVn.exe
  C:\Windows\System\PNlBfVn.exe
  2⤵
  PID:12228
- C:\Windows\System\eZATbWJ.exe
  C:\Windows\System\eZATbWJ.exe
  2⤵
  PID:11456
- C:\Windows\System\Phfpbqt.exe
  C:\Windows\System\Phfpbqt.exe
  2⤵
  PID:11624
- C:\Windows\System\qXvTIEh.exe
  C:\Windows\System\qXvTIEh.exe
  2⤵
  PID:11692
- C:\Windows\System\FqizLpV.exe
  C:\Windows\System\FqizLpV.exe
  2⤵
  PID:11480
- C:\Windows\System\XxpssXP.exe
  C:\Windows\System\XxpssXP.exe
  2⤵
  PID:12012
- C:\Windows\System\ylZYAXv.exe
  C:\Windows\System\ylZYAXv.exe
  2⤵
  PID:12160
- C:\Windows\System\MLbBDfc.exe
  C:\Windows\System\MLbBDfc.exe
  2⤵
  PID:11400
- C:\Windows\System\pEgmzAH.exe
  C:\Windows\System\pEgmzAH.exe
  2⤵
  PID:11860
- C:\Windows\System\Wyvwijc.exe
  C:\Windows\System\Wyvwijc.exe
  2⤵
  PID:12188
- C:\Windows\System\TIaYLuv.exe
  C:\Windows\System\TIaYLuv.exe
  2⤵
  PID:11656
- C:\Windows\System\eRgpHYB.exe
  C:\Windows\System\eRgpHYB.exe
  2⤵
  PID:12312
- C:\Windows\System\iGJhXiV.exe
  C:\Windows\System\iGJhXiV.exe
  2⤵
  PID:12336
- C:\Windows\System\NvvnVvM.exe
  C:\Windows\System\NvvnVvM.exe
  2⤵
  PID:12364
- C:\Windows\System\yxkDZFT.exe
  C:\Windows\System\yxkDZFT.exe
  2⤵
  PID:12384
- C:\Windows\System\ucEfuOp.exe
  C:\Windows\System\ucEfuOp.exe
  2⤵
  PID:12404
- C:\Windows\System\dmHkUqd.exe
  C:\Windows\System\dmHkUqd.exe
  2⤵
  PID:12424
- C:\Windows\System\xbXqNOz.exe
  C:\Windows\System\xbXqNOz.exe
  2⤵
  PID:12448
- C:\Windows\System\gVzAhke.exe
  C:\Windows\System\gVzAhke.exe
  2⤵
  PID:12464
- C:\Windows\System\HiOpQoz.exe
  C:\Windows\System\HiOpQoz.exe
  2⤵
  PID:12488
- C:\Windows\System\IzScEZx.exe
  C:\Windows\System\IzScEZx.exe
  2⤵
  PID:12516
- C:\Windows\System\hhpeVcA.exe
  C:\Windows\System\hhpeVcA.exe
  2⤵
  PID:12540
- C:\Windows\System\UHuMWdl.exe
  C:\Windows\System\UHuMWdl.exe
  2⤵
  PID:12596
- C:\Windows\System\jFJGWhd.exe
  C:\Windows\System\jFJGWhd.exe
  2⤵
  PID:12620
- C:\Windows\System\cHxAqGQ.exe
  C:\Windows\System\cHxAqGQ.exe
  2⤵
  PID:12672
- C:\Windows\System\acVlQDQ.exe
  C:\Windows\System\acVlQDQ.exe
  2⤵
  PID:12688
- C:\Windows\System\WIsdNbx.exe
  C:\Windows\System\WIsdNbx.exe
  2⤵
  PID:12708
- C:\Windows\System\CJeanjk.exe
  C:\Windows\System\CJeanjk.exe
  2⤵
  PID:12748
- C:\Windows\System\xNaewHT.exe
  C:\Windows\System\xNaewHT.exe
  2⤵
  PID:12772
- C:\Windows\System\zcZgGAS.exe
  C:\Windows\System\zcZgGAS.exe
  2⤵
  PID:12796
- C:\Windows\System\jnBoEhO.exe
  C:\Windows\System\jnBoEhO.exe
  2⤵
  PID:12828
- C:\Windows\System\rKuQhwu.exe
  C:\Windows\System\rKuQhwu.exe
  2⤵
  PID:12852
- C:\Windows\System\LKGfQLN.exe
  C:\Windows\System\LKGfQLN.exe
  2⤵
  PID:12876
- C:\Windows\System\fNYTkEz.exe
  C:\Windows\System\fNYTkEz.exe
  2⤵
  PID:12900
- C:\Windows\System\XdRUKnV.exe
  C:\Windows\System\XdRUKnV.exe
  2⤵
  PID:12924
- C:\Windows\System\lgupkjC.exe
  C:\Windows\System\lgupkjC.exe
  2⤵
  PID:12960
- C:\Windows\System\qbmkBHm.exe
  C:\Windows\System\qbmkBHm.exe
  2⤵
  PID:12980
- C:\Windows\System\HkGjKXC.exe
  C:\Windows\System\HkGjKXC.exe
  2⤵
  PID:13036
- C:\Windows\System\RrrtwFb.exe
  C:\Windows\System\RrrtwFb.exe
  2⤵
  PID:13084
- C:\Windows\System\ICdJchC.exe
  C:\Windows\System\ICdJchC.exe
  2⤵
  PID:13120
- C:\Windows\System\FiDexJF.exe
  C:\Windows\System\FiDexJF.exe
  2⤵
  PID:13136
- C:\Windows\System\hkNIBfE.exe
  C:\Windows\System\hkNIBfE.exe
  2⤵
  PID:13164
- C:\Windows\System\giYzyJr.exe
  C:\Windows\System\giYzyJr.exe
  2⤵
  PID:13192
- C:\Windows\System\HKbBZYn.exe
  C:\Windows\System\HKbBZYn.exe
  2⤵
  PID:13264
- C:\Windows\System\wmvHksj.exe
  C:\Windows\System\wmvHksj.exe
  2⤵
  PID:13280
- C:\Windows\System\kBFIaJp.exe
  C:\Windows\System\kBFIaJp.exe
  2⤵
  PID:13296
- C:\Windows\System\xTmkaJl.exe
  C:\Windows\System\xTmkaJl.exe
  2⤵
  PID:11520
- C:\Windows\System\XeaxAwL.exe
  C:\Windows\System\XeaxAwL.exe
  2⤵
  PID:11924
- C:\Windows\System\wDRbaoc.exe
  C:\Windows\System\wDRbaoc.exe
  2⤵
  PID:12348
- C:\Windows\System\DIVfheW.exe
  C:\Windows\System\DIVfheW.exe
  2⤵
  PID:12328
- C:\Windows\System\MAWGGca.exe
  C:\Windows\System\MAWGGca.exe
  2⤵
  PID:12392
- C:\Windows\System\DPtlbTu.exe
  C:\Windows\System\DPtlbTu.exe
  2⤵
  PID:12480
- C:\Windows\System\aCDLsWl.exe
  C:\Windows\System\aCDLsWl.exe
  2⤵
  PID:12656
- C:\Windows\System\zrOKOWi.exe
  C:\Windows\System\zrOKOWi.exe
  2⤵
  PID:12820
- C:\Windows\System\bmxHbAT.exe
  C:\Windows\System\bmxHbAT.exe
  2⤵
  PID:12968
- C:\Windows\System\SnFiIcV.exe
  C:\Windows\System\SnFiIcV.exe
  2⤵
  PID:12976
- C:\Windows\System\LLIwgta.exe
  C:\Windows\System\LLIwgta.exe
  2⤵
  PID:13004
- C:\Windows\System\ByaKTsC.exe
  C:\Windows\System\ByaKTsC.exe
  2⤵
  PID:13128
- C:\Windows\System\bZqUtPR.exe
  C:\Windows\System\bZqUtPR.exe
  2⤵
  PID:13248
- C:\Windows\System\MHrqvOj.exe
  C:\Windows\System\MHrqvOj.exe
  2⤵
  PID:13276
- C:\Windows\System\SxLSBkP.exe
  C:\Windows\System\SxLSBkP.exe
  2⤵
  PID:12344
- C:\Windows\System\iGhGdhg.exe
  C:\Windows\System\iGhGdhg.exe
  2⤵
  PID:12456
- C:\Windows\System\oNmzYBj.exe
  C:\Windows\System\oNmzYBj.exe
  2⤵
  PID:1964
- C:\Windows\System\sAEGjmD.exe
  C:\Windows\System\sAEGjmD.exe
  2⤵
  PID:12568
- C:\Windows\System\ucpYrWl.exe
  C:\Windows\System\ucpYrWl.exe
  2⤵
  PID:12696
- C:\Windows\System\cZNjcMt.exe
  C:\Windows\System\cZNjcMt.exe
  2⤵
  PID:12844
- C:\Windows\System\TZYaMml.exe
  C:\Windows\System\TZYaMml.exe
  2⤵
  PID:12736
- C:\Windows\System\qHglYJK.exe
  C:\Windows\System\qHglYJK.exe
  2⤵
  PID:13080
- C:\Windows\System\meFHwgg.exe
  C:\Windows\System\meFHwgg.exe
  2⤵
  PID:13152
- C:\Windows\System\tFMMTBc.exe
  C:\Windows\System\tFMMTBc.exe
  2⤵
  PID:13292
- C:\Windows\System\SBrOuEg.exe
  C:\Windows\System\SBrOuEg.exe
  2⤵
  PID:4612
- C:\Windows\System\YfXZcDO.exe
  C:\Windows\System\YfXZcDO.exe
  2⤵
  PID:12420
- C:\Windows\System\UyBbIkt.exe
  C:\Windows\System\UyBbIkt.exe
  2⤵
  PID:12944
- C:\Windows\System\vnpOQqp.exe
  C:\Windows\System\vnpOQqp.exe
  2⤵
  PID:12048
- C:\Windows\System\gqRMmAl.exe
  C:\Windows\System\gqRMmAl.exe
  2⤵
  PID:13324
- C:\Windows\System\kUHfqQz.exe
  C:\Windows\System\kUHfqQz.exe
  2⤵
  PID:13360
- C:\Windows\System\oCATPCj.exe
  C:\Windows\System\oCATPCj.exe
  2⤵
  PID:13384
- C:\Windows\System\JflYPKX.exe
  C:\Windows\System\JflYPKX.exe
  2⤵
  PID:13408
- C:\Windows\System\OgVYnGL.exe
  C:\Windows\System\OgVYnGL.exe
  2⤵
  PID:13428
- C:\Windows\System\QjPiTZa.exe
  C:\Windows\System\QjPiTZa.exe
  2⤵
  PID:13456
- C:\Windows\System\nybsSpi.exe
  C:\Windows\System\nybsSpi.exe
  2⤵
  PID:13492
- C:\Windows\System\lUmGbfz.exe
  C:\Windows\System\lUmGbfz.exe
  2⤵
  PID:13512
- C:\Windows\System\bQvsIXb.exe
  C:\Windows\System\bQvsIXb.exe
  2⤵
  PID:13548
- C:\Windows\System\gUQtLIr.exe
  C:\Windows\System\gUQtLIr.exe
  2⤵
  PID:13600
- C:\Windows\System\zyleLgN.exe
  C:\Windows\System\zyleLgN.exe
  2⤵
  PID:13620
- C:\Windows\System\AZKNYet.exe
  C:\Windows\System\AZKNYet.exe
  2⤵
  PID:13648
- C:\Windows\System\vedUcSL.exe
  C:\Windows\System\vedUcSL.exe
  2⤵
  PID:13672
- C:\Windows\System\zUUDudt.exe
  C:\Windows\System\zUUDudt.exe
  2⤵
  PID:13700
- C:\Windows\System\IjanCRd.exe
  C:\Windows\System\IjanCRd.exe
  2⤵
  PID:13724
- C:\Windows\System\rznlcyj.exe
  C:\Windows\System\rznlcyj.exe
  2⤵
  PID:13756
- C:\Windows\System\ckyLYIQ.exe
  C:\Windows\System\ckyLYIQ.exe
  2⤵
  PID:13776
- C:\Windows\System\YJIpwqU.exe
  C:\Windows\System\YJIpwqU.exe
  2⤵
  PID:13800
- C:\Windows\System\HJVnSnj.exe
  C:\Windows\System\HJVnSnj.exe
  2⤵
  PID:13848
- C:\Windows\System\ldtgyUh.exe
  C:\Windows\System\ldtgyUh.exe
  2⤵
  PID:13876
- C:\Windows\System\EguiJgJ.exe
  C:\Windows\System\EguiJgJ.exe
  2⤵
  PID:13916
- C:\Windows\System\LeYoiuE.exe
  C:\Windows\System\LeYoiuE.exe
  2⤵
  PID:13944
- C:\Windows\System\fmbFiiS.exe
  C:\Windows\System\fmbFiiS.exe
  2⤵
  PID:13964
- C:\Windows\System\rWnjUeG.exe
  C:\Windows\System\rWnjUeG.exe
  2⤵
  PID:13988
- C:\Windows\System\WdqjUsr.exe
  C:\Windows\System\WdqjUsr.exe
  2⤵
  PID:14008
- C:\Windows\System\ZGLpwrv.exe
  C:\Windows\System\ZGLpwrv.exe
  2⤵
  PID:14028
- C:\Windows\System\LHeWYEu.exe
  C:\Windows\System\LHeWYEu.exe
  2⤵
  PID:14060
- C:\Windows\System\eZfPijl.exe
  C:\Windows\System\eZfPijl.exe
  2⤵
  PID:14112
- C:\Windows\System\fHtfkkf.exe
  C:\Windows\System\fHtfkkf.exe
  2⤵
  PID:14140
- C:\Windows\System\dRFvPqV.exe
  C:\Windows\System\dRFvPqV.exe
  2⤵
  PID:14184
- C:\Windows\System\LLfMSMk.exe
  C:\Windows\System\LLfMSMk.exe
  2⤵
  PID:14220
- C:\Windows\System\nMAMgUz.exe
  C:\Windows\System\nMAMgUz.exe
  2⤵
  PID:14244
- C:\Windows\System\OBmcAuY.exe
  C:\Windows\System\OBmcAuY.exe
  2⤵
  PID:14260
- C:\Windows\System\ChoSOnb.exe
  C:\Windows\System\ChoSOnb.exe
  2⤵
  PID:14276
- C:\Windows\System\otJVLzw.exe
  C:\Windows\System\otJVLzw.exe
  2⤵
  PID:2836
- C:\Windows\System\IVrCEER.exe
  C:\Windows\System\IVrCEER.exe
  2⤵
  PID:13320
- C:\Windows\System\gIWLpSN.exe
  C:\Windows\System\gIWLpSN.exe
  2⤵
  PID:13400
- C:\Windows\System\kjklPKI.exe
  C:\Windows\System\kjklPKI.exe
  2⤵
  PID:13468
- C:\Windows\System\zAGidlL.exe
  C:\Windows\System\zAGidlL.exe
  2⤵
  PID:13616
- C:\Windows\System\pXWAemK.exe
  C:\Windows\System\pXWAemK.exe
  2⤵
  PID:13664
- C:\Windows\System\PaGTyFd.exe
  C:\Windows\System\PaGTyFd.exe
  2⤵
  PID:13696
- C:\Windows\System\IXfimLr.exe
  C:\Windows\System\IXfimLr.exe
  2⤵
  PID:13860
- C:\Windows\System\pxHHEqD.exe
  C:\Windows\System\pxHHEqD.exe
  2⤵
  PID:13896
- C:\Windows\System\oXYMjmd.exe
  C:\Windows\System\oXYMjmd.exe
  2⤵
  PID:13960
- C:\Windows\System\beirjzH.exe
  C:\Windows\System\beirjzH.exe
  2⤵
  PID:14000
- C:\Windows\System\eWlywIG.exe
  C:\Windows\System\eWlywIG.exe
  2⤵
  PID:14096
- C:\Windows\System\CWJYAEM.exe
  C:\Windows\System\CWJYAEM.exe
  2⤵
  PID:14128
- C:\Windows\System\WxYsboy.exe
  C:\Windows\System\WxYsboy.exe
  2⤵
  PID:14176
- C:\Windows\System\LDrmfaX.exe
  C:\Windows\System\LDrmfaX.exe
  2⤵
  PID:14272
- C:\Windows\System\PQfLCCO.exe
  C:\Windows\System\PQfLCCO.exe
  2⤵
  PID:13424
- C:\Windows\System\evEEqXq.exe
  C:\Windows\System\evEEqXq.exe
  2⤵
  PID:13520
- C:\Windows\System\QVpTIBJ.exe
  C:\Windows\System\QVpTIBJ.exe
  2⤵
  PID:13660
- C:\Windows\System\HFjOhIu.exe
  C:\Windows\System\HFjOhIu.exe
  2⤵
  PID:13892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BKTdLje.exe

Filesize
1.9MB

MD5
ab369aec75f2f62e286facbbdcb92c8f

SHA1
d65a3d387d68f8b89477bef738ef9912bdd6aebd

SHA256
75e55ce32a6677f1da99e821add2258b48552b7a44944213cdfcdf61c664e558

SHA512
93d4a877f3fb1c181f8e07e8b1ef99adf7c4fdc08d3ee9eb8eb7adfb26a7cb98db0b15c3d207fae4f1b981a7b8f2bda3c8ba8610bea8043ac781f7fa7530f53b

Download Submit
C:\Windows\System\CLlXNoZ.exe

Filesize
1.9MB

MD5
cd421d33e2a332d7dcf45704ac165d70

SHA1
9490a2f44a60db2a768070104b9e541ad5241910

SHA256
4bd79f7cf679369cf8f036a775c9e30cd4d0da361e3094059f2269fd934d55ff

SHA512
ab7da72f58e21b637e8d81b6a994588953a4adfaa4fb1c828c7f22e5a6d0781bccea7ee1c6bb5cc3d49089df8549e831a190f461662018e7094b5bc5785a0e8a

Download Submit
C:\Windows\System\DrjBczl.exe

Filesize
1.9MB

MD5
78a4e86eaf39fe2b204c2442f0d86df7

SHA1
60229ca41b33a37dd88b0165da94c8124598b565

SHA256
5d35bcc2ef20b177aaf9904bfdf0f8a312f0bbdfa04e36a8a31bcb4562b1a919

SHA512
80bad0e5320ca951c320a118b7a6028576c5803858b956e1be9fc6bc2b5c16d202dd1ba06c2b7c77488af2767e1a9c6e077f2efc8324f3926e960335bb817dfa

Download Submit
C:\Windows\System\DuvxVfI.exe

Filesize
1.9MB

MD5
69c7dae287586479599606cf73703920

SHA1
a9bcbf032eaaf409905bd2968ef403a7ad955f99

SHA256
f72f6bd563f630ac557b7d6f4cf44bfe066f21ed4bc26790ce474a745e5a61be

SHA512
36a1c8aebf3cb66254bbcfc3e1523b0d2b48fb32a6144559ab56d8c63e97bb0c79e4b3c658b7b0608573b8358b458026af6c8eeddb6db6d06319445ea38f9411

Download Submit
C:\Windows\System\FVlEUdq.exe

Filesize
1.9MB

MD5
5b9b3784ce8152264a0f3014c8b075f8

SHA1
9f92a411b40cd50981b1fb2ff642d55ccc11696b

SHA256
a0a8d22928dd65f7b3fa7e7fb95cc65a496347d4fa5994047336c50e6f12779c

SHA512
523bf5ea3eafddafe0d220948c08c6e900bc03c6d94d6301d84d4554c4f695eb829afc87e7fd8facd6f550d70ae4a100e726ee57aac040cf0c8a1d3df33329d4

Download Submit
C:\Windows\System\HBlPfNZ.exe

Filesize
1.9MB

MD5
8d3d1a2092acae6dfc3f381b894b18c9

SHA1
c969c247ff582e9ae743e30479e1df515458e93a

SHA256
acce5583f3602bb956714991cd41b70e8da20171795e30eee509755a48121297

SHA512
f516825e1a701717f40d51a206ba2ca46a1e179775e296d4be1816e676ac60dd915007554f1b42dbdbc8a0be57ec0faa34186e458cccb0929346cbc09331bee9

Download Submit
C:\Windows\System\HuimsdL.exe

Filesize
1.9MB

MD5
0651109885889874de7c3d06309a2759

SHA1
944fa813a6e6d63afad1982b08904a2aca022fbd

SHA256
293130cc0075a7810b93c7a8452ed25100cf38c1de965020e9bd87a6ab38d41e

SHA512
f25bb2f78641a7511fcd0e1481d3ace6265309eadd9081e08a2772def561f67e7a0f859b0057cedb92306fe65929eb2969edf6e1dbe0849c5e6d0d44c200a358

Download Submit
C:\Windows\System\LpaFgwp.exe

Filesize
1.9MB

MD5
53a3109d6f50d1c83f2aee140bb08ef0

SHA1
6edd4f8129f39c35009ceb3cf30776a63fdcabfd

SHA256
04d34ed250a2b3d4661c860f1bef68e584fa9cbcc9caf409da23017480488dd4

SHA512
b48ff4d3ce2f9aef5af9f9d3d2f3edde12abf0180d01a5025bdf9471e0724f6a245bbcf7c0a175c462c600ea375de6692e918317383057eb8f123e5215d4b7a2

Download Submit
C:\Windows\System\NUhjQjM.exe

Filesize
1.9MB

MD5
b8aa73a68d2302184d987b6ea808a154

SHA1
9628976b2d5c45d5df3a7f0adac4b7767de4c3be

SHA256
3e1250f499a622bedc0bba6c12eaa6dedf1694ff2065e9d654d6019a5bef42b8

SHA512
3dfe2064a1fcc9b45cae1038a19cbc780e1123d6ea6a07e99f9c02ee0d58410ef9c94f10cfa83c1a17e3d43e82af4dec5bbc496222c207ddddaa01c7b24a9074

Download Submit
C:\Windows\System\NkGnhPc.exe

Filesize
1.9MB

MD5
75ec0f8ea2c66ba7901e0f59d476a199

SHA1
add559f328612c056d5c78ecfdf130a3817d50d6

SHA256
27dfa2e3bd4d3bd613c70f166e490ee313b08ad6b8c6a41571145ea8f57d55fe

SHA512
6538b2138e3303c3eed23636a4e18efc14c734e2c16e98569151da44be6c022040a66b119b3435c8cf62db7c8fc67d9cb34605a76343bff08192b30debc54ae1

Download Submit
C:\Windows\System\PiOdylg.exe

Filesize
1.9MB

MD5
422a77bcd32fb2d8270e3b0ddd42159c

SHA1
0087325ea4fe5dc4c4eed73de6f03ca5d638e87c

SHA256
433d18d84e0f1c80f0178d17807dcfba300debb62b2a1e8d1c169d0e5e82f88f

SHA512
dca5938483fe4b1367b06d16e43cb8bf287eaaaa774e85e0a2b8c0b407f6cab84bde063de28315ca919d5a8cd7cad4818f0b9f9dc682e90afb9a3c9a7b8bf324

Download Submit
C:\Windows\System\PmjhZLq.exe

Filesize
1.9MB

MD5
f9427e96957e6c2e91f0bee685d843ac

SHA1
1866c2d7546d82d31f9210c657d7db1f106091b1

SHA256
053f427f42dc9613e5a5f861a3df4287fe19d801aba76b7a3f49b08ec5b800a2

SHA512
3bf37f2d4e4d6a09613a59ff57d26ec64874a2b836f2e3ac72cdafa5ed60293af3bcf7724988c0521fb1b75652fdbe9ffaa3f11990733b3a995569f71aaf233d

Download Submit
C:\Windows\System\PwpVCKZ.exe

Filesize
1.9MB

MD5
c365fe86ccd246c4e2dce68a004093be

SHA1
73f57d7c3bf7d22c62fbb0f2cb70ab4fc3fc1fcd

SHA256
347eebe212cdb01891dfc3400d3a67ed35bff53e5b241e7591519ed51e53e1eb

SHA512
9d92528d1f779c7d7ca8c7122a1a1a1adb0d81137c527ed4513de88c953396c499bb98bf33b216948a806e64c6d15c34c5f7adcc51da381bbed3989177944ad1

Download Submit
C:\Windows\System\RUsSQGq.exe

Filesize
1.9MB

MD5
1167432445929b743a045d8a3a94b321

SHA1
1ac5e4b3ea96e6958fcd5b33993d3c17cb2b7a6a

SHA256
0cc28844f1adb837375d951662766369cc5d0a62598ca04cbb2727a61dea8d5e

SHA512
4a2bb3cf98265ff7c177240c7bbf927a79b9988a525c055789492b82726bf695b354953f2d4c094fc513d13609c2b22a7259116dba97eaa646978d935c9f64dd

Download Submit
C:\Windows\System\UXgxlqk.exe

Filesize
1.9MB

MD5
1267c3e7534c4bdb830e80789ce153e7

SHA1
95b84c30fa87930ea600303038ab19edde806609

SHA256
d7db3cf5978acda2330acd6b0a6c9d41bca22a3e3223dd5f3a66e14e498fd89f

SHA512
f848db3c12023f75c584ef5640ee494f9dd928f867e88ae5ae33709014f237d858f412b45494fcec8afe9843f7e089a2617c4a160108e873364a9d8488222513

Download Submit
C:\Windows\System\UiqDHdC.exe

Filesize
1.9MB

MD5
e268c4d5860a027aab293f1505de1150

SHA1
311153acecbab311c2b110df9c7b148ade25fadf

SHA256
abd2a40195d7ec8cbb3bf93ab5a9e5c5aff3a778eeb9cb63278b35d27f5ff40f

SHA512
ce87b4842c893e928c183a4a3f228a2bd8b0f3027bdf2747cf9c0d2c97a7fa04278f48c2c538fec38406e545cf0a9d4d71dad058ca5cf137cd77085279caa8a0

Download Submit
C:\Windows\System\UyXQHwX.exe

Filesize
1.9MB

MD5
b0248a0bba045bff68c50423e037222e

SHA1
6206e77d7bdbff2f85cb46ef64d9530a9285a5b5

SHA256
285849fc3ed33d9cf36a90116ab4919f6cba37840654fe0916135dd548f37bf9

SHA512
7f889b6d87af68758f6565382bdfbaad2a2282f5b4f8279de3740c8621b7a74567ab3ffaeb739b175a517fbd092a6dee03344c7ae2ea5f571ca2162204fb48dd

Download Submit
C:\Windows\System\VlBniSJ.exe

Filesize
1.9MB

MD5
4d5e92f5dee33c9f834960d60056d41b

SHA1
8a20d7eb7fd4c34cff78d34801c4ddcef6f75e1e

SHA256
240ab68004cc1eeaa767f96f7a459fdfd6a17dc8d6da7e4d830a4523e6aa0558

SHA512
ae2b20126c3833c18ccd010d3eba24e9202494ba5026f119a92741b85c47956b60f484816fa05f538422714cdb29db1b9a0c36149ecce517077f2ae9142bd94a

Download Submit
C:\Windows\System\XRoPpPB.exe

Filesize
1.9MB

MD5
fab8182417ee59e6afd5d81ae5996b5f

SHA1
67b384cd4694196d6faf03cdd6b7a1045a64f641

SHA256
c3d83843b108733165ea47410e9caeb72ec4c71f3b41628bfcc3ab3cd117bcf8

SHA512
cd23df4288174d80ecc5c6cfe46c406a54c59a2976e27f806218d5ff117db0ed92e94cd9c0a66e25f935ef68b8984d042189b3b65f6687ce632c1c7cb0ebb052

Download Submit
C:\Windows\System\bUqPnit.exe

Filesize
1.9MB

MD5
1ab473c86e5c6da9622a71653b266592

SHA1
35651bc1a71255c375bc183ad6c347b689abb08d

SHA256
79eb932fad10f61ee699ac7aeddb88715bb89253d7d1da6e5b8dcb5741f9f812

SHA512
666ed4895564023349c820dd56afe57b681674898e5f873c3a9f77043f776d371473fdc0ab021b2cab84c4c01f4aea2aadc025797f5b607f79c42c19cb09b2d3

Download Submit
C:\Windows\System\cPOjDOh.exe

Filesize
1.9MB

MD5
9da8b9b8ab5aed07f7f4b9aebdf96cb9

SHA1
9be2158703afd05dff182684a5947443b7ea1d50

SHA256
26026985e28d8d60ef98f40862719112374ccb12e0a5c1ec1e79f6ac51eacd14

SHA512
9173c8004caea7e8ce131020e5504cd22b1f5d8c5a400334fcc65b6f9e77310802f4f63f9509e4360eb385c3e296f1867c260f5271d6b314033dec784740b477

Download Submit
C:\Windows\System\fUDgWuz.exe

Filesize
1.9MB

MD5
f302d918d771b74893f5d05cc91508f5

SHA1
91cae598cada78660cb0312338840dc2602d905f

SHA256
1a65c2e5bd77c548c9c57a69a58fc2652877d834a72ab90dcd9ee691d903f46f

SHA512
9760a5383aaa590366fe606c2d139fcb6f5f9ba3ee096a87b192fdcfc9b4514bd13f1b942b0b16b7bee983f788168ef79b01564f23fc1d80b83b4fb3f03aeac4

Download Submit
C:\Windows\System\haxbCXP.exe

Filesize
1.9MB

MD5
11717afcc38f2170ef3ddee0d05a4cd9

SHA1
8b660d11007767c700b9201b1b3445f18c8ad0e0

SHA256
23e7163106ed07c1e1a02221e175e62fa950a72be8ad32f785ce7e5878cd8173

SHA512
f7b09f2e2d61ec47c0868d6d4d3c38f176b672ce81df710ffe2c47b6c0ff136e91eff4fe97b377c48aa39e16d3cc53b695671fde15d8658e510e1385864d6525

Download Submit
C:\Windows\System\iBkSiDg.exe

Filesize
1.9MB

MD5
ead5b7f79de5ba18542641ddd0806d97

SHA1
5fc16867e398bd306b92910851b13cdcad0ff5d0

SHA256
cf5720fe39d2c8721de56064dda075c2a3553f5e0517b20660ecbc93febc0fe4

SHA512
9a9cf1590433a14d821775f5fc5839b51bfaefbdfa8fdfce54d6bbff3dda1aac56315be0126773904f2a686a5b2baa900587851390a8194a38998496a1c492d1

Download Submit
C:\Windows\System\iQPGcXx.exe

Filesize
1.9MB

MD5
958b1d19382380f92e4d9475ca89c298

SHA1
112b0d6edf6919cfb1c896318424e52a0821a419

SHA256
e398985acbc39993e5475f4f258bcbe890aef5b8f454d025dbc97c5cf1de20f5

SHA512
c7c0760211f8c0aada65bc35c90db36a0dd913f1ed0abee700ef3c9eb74d671b8898a4fbb14e5e4b07c9ce29df7312faf8e90e54b4170a57de8c8ab6d2880ed2

Download Submit
C:\Windows\System\lDsebpJ.exe

Filesize
1.9MB

MD5
613f6c3ef6e901cde7209ac442a8b4c0

SHA1
f2a5739e8f2e8b69c0bc2ccec2c4fd61ed1d895c

SHA256
be3e3e1c6c03c48dff31375ff3c4fa5941384d605105e6b4c31af0d2982ca3e4

SHA512
dc77516702617d94b28348df03f02c12fac5b5671ab6bfbd8843c1951315444e1a9040c880d3c51eabb8ff5a0130c5a74f2dde1a999f86572c2e70a0e611bada

Download Submit
C:\Windows\System\lYEMEuC.exe

Filesize
1.9MB

MD5
1efe7d5f82cfb5a11a848c1b2c3e92f5

SHA1
926192262a94824c09e2bb030814529b61677b23

SHA256
414ef3e6fbee0c81c30eff8db07854385e04e5c8488afcba42105a7971c17262

SHA512
b12d853c812aafb33b304b30c5eb5e89e13bfc2773f1f0f965fe8a52fec4f501b300ef22f6f7ac2b941d0a1c0ad7e3e2817e7e260db3020a59aa04199c6e35c2

Download Submit
C:\Windows\System\naPAduF.exe

Filesize
1.9MB

MD5
eb9ce6ec4b9df9d31bcb3a856b6da5b3

SHA1
6ff51778cb1e02e8c12a0facfce099ed5de37245

SHA256
7e06f821f5378f1bc565417667758a00ba654cf5441e448873ffeb098cc56490

SHA512
240721d32aeaa07b7feffa7f5d82a7adc4eb3d727ff8f784777cc47ae879974cd4c3d946c825ae0bc9f3a0445ab0e022c907a8328b7a9a4fa8bad305c2a034f0

Download Submit
C:\Windows\System\pGkqKxw.exe

Filesize
1.9MB

MD5
0291c322f8cdb9109006ffecfe4f6edb

SHA1
05f3df624bf999fc7b49b18a36950ffdd69b7e50

SHA256
b6519fa03637c71fd324e7fc4601bfcf1648a2d6d102ddb00a73cf9f8cf50c47

SHA512
f8cef9e8e205ebc6f0d5af1c3f302cf70ddb2ea8c53a788a4162e150ed8dfe3ec11c527db8207ec5bd594f6526a56651180cad072708364824afab818bf428d1

Download Submit
C:\Windows\System\qNKqclD.exe

Filesize
1.9MB

MD5
771c4a248aa9bb5eeb510cd7f41207aa

SHA1
a9e11af39922cf2644dafb0b37354a02879fd227

SHA256
70261e6765a317669487dd56af71c86a82c97be8b0afee083b948f5d89092305

SHA512
f131baee21fdcac49295543dc9097091740499aa027425a7ace74af202fea8ab80b125207499d60f1535a67e7b7276642d2b4f267f7f47a392d9567cf941e821

Download Submit
C:\Windows\System\xevuDwS.exe

Filesize
1.9MB

MD5
f8032d4e2bdb5e13ae33de390dfe0597

SHA1
9d7ae5c47d438001aa0c6573e10a5ce6b180cd41

SHA256
2b4ccfece279cf5cfcfc7b3a10dea7abb945f35a58618312f34c632e1d8b53bc

SHA512
8d425369e3e8759416174215411221e05af9a4a92a1aec8b1b99108b32c1e62420ccf0310a4668587d2ccb2194e8bac4b1806201c253a5c7ab8714349be9d6c8

Download Submit
C:\Windows\System\yNsGaxp.exe

Filesize
1.9MB

MD5
9a9e70c48c9cf71e2613db5d832b03a9

SHA1
73b065cdf0d84305a29b2758172c645be4dc7554

SHA256
bb4e68bea4e7314f81c0822a3fc86dc6f530a3c10539b954e5fd48f17ff3b906

SHA512
650382e7602e9338654fcac0e1d5c5eb4bca2ddba55a54c2d5efa390f67dd1286b2de8a252ff4c972361880d56377af7277f327bfd6c696972f55d096cce68ab

Download Submit
C:\Windows\System\zkAzmVD.exe

Filesize
1.9MB

MD5
1ef44b5901db87be8678b5ea534c4ce6

SHA1
a84948cce3c88200389d9fabc4f155f1aa00583d

SHA256
020c20e367e2491f95b4f4dd48c07f0a025bb8e4188bb9f3ea0feb5b4721542e

SHA512
99ba41fc0e364f025f126d38b74a3e57f36a14b57be201a82d7b86ec6697ed048cb2f6a60b6477fbacbc731e5cb4cf091e976bba2afe0c5b7a1b41333b24d581

Download Submit
memory/612-559-0x00007FF7D4A50000-0x00007FF7D4DA1000-memory.dmp

Filesize
3.3MB

Download
memory/612-2285-0x00007FF7D4A50000-0x00007FF7D4DA1000-memory.dmp

Filesize
3.3MB

Download
memory/884-2281-0x00007FF6E0E20000-0x00007FF6E1171000-memory.dmp

Filesize
3.3MB

Download
memory/884-566-0x00007FF6E0E20000-0x00007FF6E1171000-memory.dmp

Filesize
3.3MB

Download
memory/1232-2291-0x00007FF6B0B20000-0x00007FF6B0E71000-memory.dmp

Filesize
3.3MB

Download
memory/1232-535-0x00007FF6B0B20000-0x00007FF6B0E71000-memory.dmp

Filesize
3.3MB

Download
memory/1292-32-0x00007FF797370000-0x00007FF7976C1000-memory.dmp

Filesize
3.3MB

Download
memory/1292-2255-0x00007FF797370000-0x00007FF7976C1000-memory.dmp

Filesize
3.3MB

Download
memory/1292-2207-0x00007FF797370000-0x00007FF7976C1000-memory.dmp

Filesize
3.3MB

Download
memory/1324-2300-0x00007FF768180000-0x00007FF7684D1000-memory.dmp

Filesize
3.3MB

Download
memory/1324-516-0x00007FF768180000-0x00007FF7684D1000-memory.dmp

Filesize
3.3MB

Download
memory/1328-541-0x00007FF61CFF0000-0x00007FF61D341000-memory.dmp

Filesize
3.3MB

Download
memory/1328-2289-0x00007FF61CFF0000-0x00007FF61D341000-memory.dmp

Filesize
3.3MB

Download
memory/1404-575-0x00007FF618B60000-0x00007FF618EB1000-memory.dmp

Filesize
3.3MB

Download
memory/1404-2277-0x00007FF618B60000-0x00007FF618EB1000-memory.dmp

Filesize
3.3MB

Download
memory/1476-2215-0x00007FF77E100000-0x00007FF77E451000-memory.dmp

Filesize
3.3MB

Download
memory/1476-12-0x00007FF77E100000-0x00007FF77E451000-memory.dmp

Filesize
3.3MB

Download
memory/1496-519-0x00007FF701B60000-0x00007FF701EB1000-memory.dmp

Filesize
3.3MB

Download
memory/1496-2308-0x00007FF701B60000-0x00007FF701EB1000-memory.dmp

Filesize
3.3MB

Download
memory/1776-2275-0x00007FF6B1A70000-0x00007FF6B1DC1000-memory.dmp

Filesize
3.3MB

Download
memory/1776-580-0x00007FF6B1A70000-0x00007FF6B1DC1000-memory.dmp

Filesize
3.3MB

Download
memory/2068-583-0x00007FF673A20000-0x00007FF673D71000-memory.dmp

Filesize
3.3MB

Download
memory/2068-2273-0x00007FF673A20000-0x00007FF673D71000-memory.dmp

Filesize
3.3MB

Download
memory/2088-540-0x00007FF664210000-0x00007FF664561000-memory.dmp

Filesize
3.3MB

Download
memory/2088-2310-0x00007FF664210000-0x00007FF664561000-memory.dmp

Filesize
3.3MB

Download
memory/2240-2247-0x00007FF742590000-0x00007FF7428E1000-memory.dmp

Filesize
3.3MB

Download
memory/2240-2198-0x00007FF742590000-0x00007FF7428E1000-memory.dmp

Filesize
3.3MB

Download
memory/2240-24-0x00007FF742590000-0x00007FF7428E1000-memory.dmp

Filesize
3.3MB

Download
memory/2376-574-0x00007FF7D2AA0000-0x00007FF7D2DF1000-memory.dmp

Filesize
3.3MB

Download
memory/2376-2279-0x00007FF7D2AA0000-0x00007FF7D2DF1000-memory.dmp

Filesize
3.3MB

Download
memory/2456-503-0x00007FF7553B0000-0x00007FF755701000-memory.dmp

Filesize
3.3MB

Download
memory/2456-2263-0x00007FF7553B0000-0x00007FF755701000-memory.dmp

Filesize
3.3MB

Download
memory/2904-2266-0x00007FF72A0D0000-0x00007FF72A421000-memory.dmp

Filesize
3.3MB

Download
memory/2904-508-0x00007FF72A0D0000-0x00007FF72A421000-memory.dmp

Filesize
3.3MB

Download
memory/2916-0-0x00007FF792740000-0x00007FF792A91000-memory.dmp

Filesize
3.3MB

Download
memory/2916-1857-0x00007FF792740000-0x00007FF792A91000-memory.dmp

Filesize
3.3MB

Download
memory/2916-1-0x000002397F970000-0x000002397F980000-memory.dmp

Filesize
64KB

Download
memory/3396-2209-0x00007FF70FEA0000-0x00007FF7101F1000-memory.dmp

Filesize
3.3MB

Download
memory/3396-73-0x00007FF70FEA0000-0x00007FF7101F1000-memory.dmp

Filesize
3.3MB

Download
memory/3396-2252-0x00007FF70FEA0000-0x00007FF7101F1000-memory.dmp

Filesize
3.3MB

Download
memory/3628-2217-0x00007FF63FD20000-0x00007FF640071000-memory.dmp

Filesize
3.3MB

Download
memory/3628-14-0x00007FF63FD20000-0x00007FF640071000-memory.dmp

Filesize
3.3MB

Download
memory/3640-2293-0x00007FF60D5C0000-0x00007FF60D911000-memory.dmp

Filesize
3.3MB

Download
memory/3640-531-0x00007FF60D5C0000-0x00007FF60D911000-memory.dmp

Filesize
3.3MB

Download
memory/3976-52-0x00007FF6C27A0000-0x00007FF6C2AF1000-memory.dmp

Filesize
3.3MB

Download
memory/3976-2254-0x00007FF6C27A0000-0x00007FF6C2AF1000-memory.dmp

Filesize
3.3MB

Download
memory/4088-49-0x00007FF66DF50000-0x00007FF66E2A1000-memory.dmp

Filesize
3.3MB

Download
memory/4088-2249-0x00007FF66DF50000-0x00007FF66E2A1000-memory.dmp

Filesize
3.3MB

Download
memory/4152-561-0x00007FF7C0810000-0x00007FF7C0B61000-memory.dmp

Filesize
3.3MB

Download
memory/4152-2282-0x00007FF7C0810000-0x00007FF7C0B61000-memory.dmp

Filesize
3.3MB

Download
memory/4260-502-0x00007FF7DF390000-0x00007FF7DF6E1000-memory.dmp

Filesize
3.3MB

Download
memory/4260-2257-0x00007FF7DF390000-0x00007FF7DF6E1000-memory.dmp

Filesize
3.3MB

Download
memory/4456-2295-0x00007FF7CC720000-0x00007FF7CCA71000-memory.dmp

Filesize
3.3MB

Download
memory/4456-528-0x00007FF7CC720000-0x00007FF7CCA71000-memory.dmp

Filesize
3.3MB

Download
memory/4768-2267-0x00007FF7DAB40000-0x00007FF7DAE91000-memory.dmp

Filesize
3.3MB

Download
memory/4768-513-0x00007FF7DAB40000-0x00007FF7DAE91000-memory.dmp

Filesize
3.3MB

Download
memory/4812-2208-0x00007FF7A5630000-0x00007FF7A5981000-memory.dmp

Filesize
3.3MB

Download
memory/4812-53-0x00007FF7A5630000-0x00007FF7A5981000-memory.dmp

Filesize
3.3MB

Download
memory/4812-2261-0x00007FF7A5630000-0x00007FF7A5981000-memory.dmp

Filesize
3.3MB

Download
memory/5004-2173-0x00007FF6E1E40000-0x00007FF6E2191000-memory.dmp

Filesize
3.3MB

Download
memory/5004-18-0x00007FF6E1E40000-0x00007FF6E2191000-memory.dmp

Filesize
3.3MB

Download
memory/5004-2245-0x00007FF6E1E40000-0x00007FF6E2191000-memory.dmp

Filesize
3.3MB

Download
memory/5012-2259-0x00007FF7DA720000-0x00007FF7DAA71000-memory.dmp

Filesize
3.3MB

Download
memory/5012-590-0x00007FF7DA720000-0x00007FF7DAA71000-memory.dmp

Filesize
3.3MB

Download
memory/5088-2287-0x00007FF763080000-0x00007FF7633D1000-memory.dmp

Filesize
3.3MB

Download
memory/5088-552-0x00007FF763080000-0x00007FF7633D1000-memory.dmp

Filesize
3.3MB

Download