xmrig | 97f8d7a4fe2304e0d97b97addb9d688c108899a3f8c05211fe0f73c8c1a79e9f

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aab33ab57a3d0863791f71a91327db40N.exe
Size

1.6MB
MD5

aab33ab57a3d0863791f71a91327db40
SHA1

31e5ceabb6e2a4ddec5de8ee278408c46b1660a1
SHA256

97f8d7a4fe2304e0d97b97addb9d688c108899a3f8c05211fe0f73c8c1a79e9f
SHA512

086643955984de9dac8e24407af91be170b638fd7d62ef181ac6f2c8425355b392d07fd1788c80595e6af3803ecd734113e18e98960619148803abf881e902c3
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaF2UdJwUkw3jv0FXbzQppj2gsgr4u:ROdWCCi7/rahOY2UrwUveeF39

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/648-428-0x00007FF6E9280000-0x00007FF6E95D1000-memory.dmp	xmrig
behavioral2/memory/2220-441-0x00007FF767340000-0x00007FF767691000-memory.dmp	xmrig
behavioral2/memory/3576-561-0x00007FF7E1B60000-0x00007FF7E1EB1000-memory.dmp	xmrig
behavioral2/memory/536-564-0x00007FF637920000-0x00007FF637C71000-memory.dmp	xmrig
behavioral2/memory/3952-570-0x00007FF72B7A0000-0x00007FF72BAF1000-memory.dmp	xmrig
behavioral2/memory/4748-569-0x00007FF75F640000-0x00007FF75F991000-memory.dmp	xmrig
behavioral2/memory/4932-568-0x00007FF6FD470000-0x00007FF6FD7C1000-memory.dmp	xmrig
behavioral2/memory/4792-567-0x00007FF695AF0000-0x00007FF695E41000-memory.dmp	xmrig
behavioral2/memory/3360-566-0x00007FF693B10000-0x00007FF693E61000-memory.dmp	xmrig
behavioral2/memory/4384-565-0x00007FF6EB750000-0x00007FF6EBAA1000-memory.dmp	xmrig
behavioral2/memory/764-563-0x00007FF79CFC0000-0x00007FF79D311000-memory.dmp	xmrig
behavioral2/memory/2820-562-0x00007FF69D3A0000-0x00007FF69D6F1000-memory.dmp	xmrig
behavioral2/memory/3968-560-0x00007FF7BDD00000-0x00007FF7BE051000-memory.dmp	xmrig
behavioral2/memory/3048-520-0x00007FF6088F0000-0x00007FF608C41000-memory.dmp	xmrig
behavioral2/memory/3644-379-0x00007FF650CA0000-0x00007FF650FF1000-memory.dmp	xmrig
behavioral2/memory/3896-351-0x00007FF655330000-0x00007FF655681000-memory.dmp	xmrig
behavioral2/memory/1456-350-0x00007FF61A510000-0x00007FF61A861000-memory.dmp	xmrig
behavioral2/memory/1260-270-0x00007FF71F700000-0x00007FF71FA51000-memory.dmp	xmrig
behavioral2/memory/4864-242-0x00007FF6ACE00000-0x00007FF6AD151000-memory.dmp	xmrig
behavioral2/memory/408-241-0x00007FF623B00000-0x00007FF623E51000-memory.dmp	xmrig
behavioral2/memory/2084-222-0x00007FF77AE40000-0x00007FF77B191000-memory.dmp	xmrig
behavioral2/memory/4252-158-0x00007FF756580000-0x00007FF7568D1000-memory.dmp	xmrig
behavioral2/memory/1628-119-0x00007FF7DC070000-0x00007FF7DC3C1000-memory.dmp	xmrig
behavioral2/memory/916-2047-0x00007FF66BFD0000-0x00007FF66C321000-memory.dmp	xmrig
behavioral2/memory/1000-2146-0x00007FF672450000-0x00007FF6727A1000-memory.dmp	xmrig
behavioral2/memory/1720-2147-0x00007FF7A0CC0000-0x00007FF7A1011000-memory.dmp	xmrig
behavioral2/memory/3780-2148-0x00007FF73F2B0000-0x00007FF73F601000-memory.dmp	xmrig
behavioral2/memory/644-2151-0x00007FF677D90000-0x00007FF6780E1000-memory.dmp	xmrig
behavioral2/memory/4552-2150-0x00007FF6FDD20000-0x00007FF6FE071000-memory.dmp	xmrig
behavioral2/memory/468-2149-0x00007FF7511A0000-0x00007FF7514F1000-memory.dmp	xmrig
behavioral2/memory/1000-2153-0x00007FF672450000-0x00007FF6727A1000-memory.dmp	xmrig
behavioral2/memory/1720-2155-0x00007FF7A0CC0000-0x00007FF7A1011000-memory.dmp	xmrig
behavioral2/memory/3780-2157-0x00007FF73F2B0000-0x00007FF73F601000-memory.dmp	xmrig
behavioral2/memory/4792-2161-0x00007FF695AF0000-0x00007FF695E41000-memory.dmp	xmrig
behavioral2/memory/4552-2163-0x00007FF6FDD20000-0x00007FF6FE071000-memory.dmp	xmrig
behavioral2/memory/468-2165-0x00007FF7511A0000-0x00007FF7514F1000-memory.dmp	xmrig
behavioral2/memory/1628-2160-0x00007FF7DC070000-0x00007FF7DC3C1000-memory.dmp	xmrig
behavioral2/memory/4932-2180-0x00007FF6FD470000-0x00007FF6FD7C1000-memory.dmp	xmrig
behavioral2/memory/648-2199-0x00007FF6E9280000-0x00007FF6E95D1000-memory.dmp	xmrig
behavioral2/memory/2220-2202-0x00007FF767340000-0x00007FF767691000-memory.dmp	xmrig
behavioral2/memory/764-2206-0x00007FF79CFC0000-0x00007FF79D311000-memory.dmp	xmrig
behavioral2/memory/536-2208-0x00007FF637920000-0x00007FF637C71000-memory.dmp	xmrig
behavioral2/memory/2820-2204-0x00007FF69D3A0000-0x00007FF69D6F1000-memory.dmp	xmrig
behavioral2/memory/3968-2196-0x00007FF7BDD00000-0x00007FF7BE051000-memory.dmp	xmrig
behavioral2/memory/1260-2194-0x00007FF71F700000-0x00007FF71FA51000-memory.dmp	xmrig
behavioral2/memory/4384-2192-0x00007FF6EB750000-0x00007FF6EBAA1000-memory.dmp	xmrig
behavioral2/memory/2084-2190-0x00007FF77AE40000-0x00007FF77B191000-memory.dmp	xmrig
behavioral2/memory/3644-2189-0x00007FF650CA0000-0x00007FF650FF1000-memory.dmp	xmrig
behavioral2/memory/3952-2187-0x00007FF72B7A0000-0x00007FF72BAF1000-memory.dmp	xmrig
behavioral2/memory/4252-2184-0x00007FF756580000-0x00007FF7568D1000-memory.dmp	xmrig
behavioral2/memory/644-2178-0x00007FF677D90000-0x00007FF6780E1000-memory.dmp	xmrig
behavioral2/memory/408-2175-0x00007FF623B00000-0x00007FF623E51000-memory.dmp	xmrig
behavioral2/memory/3048-2173-0x00007FF6088F0000-0x00007FF608C41000-memory.dmp	xmrig
behavioral2/memory/1456-2172-0x00007FF61A510000-0x00007FF61A861000-memory.dmp	xmrig
behavioral2/memory/4864-2168-0x00007FF6ACE00000-0x00007FF6AD151000-memory.dmp	xmrig
behavioral2/memory/4748-2186-0x00007FF75F640000-0x00007FF75F991000-memory.dmp	xmrig
behavioral2/memory/3896-2170-0x00007FF655330000-0x00007FF655681000-memory.dmp	xmrig
behavioral2/memory/3360-2225-0x00007FF693B10000-0x00007FF693E61000-memory.dmp	xmrig
behavioral2/memory/3576-2223-0x00007FF7E1B60000-0x00007FF7E1EB1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1000	OPMNyxR.exe
1720	kpJyPEN.exe
468	KOkUYCk.exe
3780	NUmvHfU.exe
4792	fzDvgTI.exe
4552	SeuCSvK.exe
644	FiJdsxr.exe
1628	WrjLcPG.exe
4252	QraxrnE.exe
2084	FkFjOCd.exe
4932	fAIgiUM.exe
408	OmaqHkr.exe
4864	pLpdmKB.exe
1260	JboZjBb.exe
1456	VepGrxu.exe
3896	LDbznfp.exe
4748	MyUUjUE.exe
3644	ctdHjAj.exe
648	fskjySH.exe
2220	CbRnziQ.exe
3048	eLJqMSJ.exe
3968	YAHanDO.exe
3576	MyDgKmt.exe
2820	immFFxG.exe
764	mDAMNRb.exe
3952	rUkUAuK.exe
536	KZZnGxP.exe
4384	PfDMCud.exe
3360	HNtnlkX.exe
4756	QqbycTs.exe
1992	zzwYVCQ.exe
4300	uZMaqfR.exe
4232	ZoqLiOY.exe
3352	nQlBmOq.exe
3008	FBPCeTU.exe
2964	GMkOJBL.exe
4132	qLTTKCZ.exe
4808	WWQBxFJ.exe
4876	ZlRdZeM.exe
4848	LLLRWBa.exe
4420	yqtzrIW.exe
4196	QQYZfAF.exe
4852	MnKmdtn.exe
2372	FIuufyC.exe
3716	JErzIJB.exe
2208	krKCFNd.exe
1876	uarQqIn.exe
440	nIjDEzZ.exe
2940	zEFBtyB.exe
1684	aezvEgN.exe
2144	xChcsCR.exe
2540	MCLSUrS.exe
860	avGlZQr.exe
4376	NSLQPDr.exe
4124	lSxiGnc.exe
1624	RcHVDGE.exe
4496	rgkuCBp.exe
4212	qKocTTC.exe
2780	ACckTpC.exe
2960	FEkVTXZ.exe
4888	JgSeSBY.exe
3596	oexpIXd.exe
3000	BBlNWHQ.exe
1988	AqOJaqa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/916-0-0x00007FF66BFD0000-0x00007FF66C321000-memory.dmp	upx
behavioral2/files/0x00070000000234c8-8.dat	upx
behavioral2/files/0x00080000000234c3-16.dat	upx
behavioral2/files/0x00070000000234c7-30.dat	upx
behavioral2/files/0x00070000000234ca-49.dat	upx
behavioral2/files/0x00070000000234d4-149.dat	upx
behavioral2/files/0x00070000000234d9-203.dat	upx
behavioral2/memory/648-428-0x00007FF6E9280000-0x00007FF6E95D1000-memory.dmp	upx
behavioral2/memory/2220-441-0x00007FF767340000-0x00007FF767691000-memory.dmp	upx
behavioral2/memory/3576-561-0x00007FF7E1B60000-0x00007FF7E1EB1000-memory.dmp	upx
behavioral2/memory/536-564-0x00007FF637920000-0x00007FF637C71000-memory.dmp	upx
behavioral2/memory/3952-570-0x00007FF72B7A0000-0x00007FF72BAF1000-memory.dmp	upx
behavioral2/memory/4748-569-0x00007FF75F640000-0x00007FF75F991000-memory.dmp	upx
behavioral2/memory/4932-568-0x00007FF6FD470000-0x00007FF6FD7C1000-memory.dmp	upx
behavioral2/memory/4792-567-0x00007FF695AF0000-0x00007FF695E41000-memory.dmp	upx
behavioral2/memory/3360-566-0x00007FF693B10000-0x00007FF693E61000-memory.dmp	upx
behavioral2/memory/4384-565-0x00007FF6EB750000-0x00007FF6EBAA1000-memory.dmp	upx
behavioral2/memory/764-563-0x00007FF79CFC0000-0x00007FF79D311000-memory.dmp	upx
behavioral2/memory/2820-562-0x00007FF69D3A0000-0x00007FF69D6F1000-memory.dmp	upx
behavioral2/memory/3968-560-0x00007FF7BDD00000-0x00007FF7BE051000-memory.dmp	upx
behavioral2/memory/3048-520-0x00007FF6088F0000-0x00007FF608C41000-memory.dmp	upx
behavioral2/memory/3644-379-0x00007FF650CA0000-0x00007FF650FF1000-memory.dmp	upx
behavioral2/memory/3896-351-0x00007FF655330000-0x00007FF655681000-memory.dmp	upx
behavioral2/memory/1456-350-0x00007FF61A510000-0x00007FF61A861000-memory.dmp	upx
behavioral2/memory/1260-270-0x00007FF71F700000-0x00007FF71FA51000-memory.dmp	upx
behavioral2/memory/4864-242-0x00007FF6ACE00000-0x00007FF6AD151000-memory.dmp	upx
behavioral2/memory/408-241-0x00007FF623B00000-0x00007FF623E51000-memory.dmp	upx
behavioral2/memory/2084-222-0x00007FF77AE40000-0x00007FF77B191000-memory.dmp	upx
behavioral2/files/0x00070000000234ec-202.dat	upx
behavioral2/files/0x00070000000234eb-199.dat	upx
behavioral2/files/0x00070000000234d8-194.dat	upx
behavioral2/files/0x00070000000234ea-193.dat	upx
behavioral2/files/0x00070000000234e1-186.dat	upx
behavioral2/files/0x00070000000234d7-179.dat	upx
behavioral2/files/0x00070000000234e9-176.dat	upx
behavioral2/files/0x00070000000234d6-168.dat	upx
behavioral2/files/0x00070000000234e8-165.dat	upx
behavioral2/files/0x00070000000234e7-164.dat	upx
behavioral2/files/0x00070000000234df-163.dat	upx
behavioral2/memory/4252-158-0x00007FF756580000-0x00007FF7568D1000-memory.dmp	upx
behavioral2/files/0x00070000000234e6-156.dat	upx
behavioral2/files/0x00070000000234d5-153.dat	upx
behavioral2/files/0x00070000000234e3-145.dat	upx
behavioral2/files/0x00070000000234da-142.dat	upx
behavioral2/files/0x00070000000234d3-140.dat	upx
behavioral2/files/0x00070000000234e2-137.dat	upx
behavioral2/files/0x00070000000234e0-129.dat	upx
behavioral2/files/0x00070000000234cc-123.dat	upx
behavioral2/memory/1628-119-0x00007FF7DC070000-0x00007FF7DC3C1000-memory.dmp	upx
behavioral2/memory/644-116-0x00007FF677D90000-0x00007FF6780E1000-memory.dmp	upx
behavioral2/files/0x00070000000234de-115.dat	upx
behavioral2/files/0x00070000000234dd-112.dat	upx
behavioral2/files/0x00070000000234e5-155.dat	upx
behavioral2/files/0x00070000000234dc-111.dat	upx
behavioral2/files/0x00070000000234db-110.dat	upx
behavioral2/files/0x00070000000234e4-152.dat	upx
behavioral2/files/0x00070000000234cf-108.dat	upx
behavioral2/files/0x00070000000234ce-101.dat	upx
behavioral2/files/0x00070000000234d2-134.dat	upx
behavioral2/files/0x00070000000234d1-92.dat	upx
behavioral2/files/0x00070000000234d0-87.dat	upx
behavioral2/files/0x00070000000234cb-74.dat	upx
behavioral2/memory/4552-82-0x00007FF6FDD20000-0x00007FF6FE071000-memory.dmp	upx
behavioral2/memory/468-53-0x00007FF7511A0000-0x00007FF7514F1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OxBghbV.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\mDAMNRb.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\PtuCjvY.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\dlQgyem.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\VhERdzE.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\IxDVdWR.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\nOZCAVL.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\ZHIMXja.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\hKLtFCt.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\BAsZVAn.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\lKUkvdv.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\InDRtIi.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\hyivJvp.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\VuNPQUi.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\dvMgjNn.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\VepGrxu.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\rfRgUsC.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\AMfDQmB.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\QGrmnac.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\HeWpVTi.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\nDUVaPP.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\OdioRFl.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\FEkVTXZ.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\osYDsvo.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\eUTATSj.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\AkrddAQ.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\KnvbzEf.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\sCLVNRI.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\rMLUiEG.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\jMVKTbM.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\VwWJWgY.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\psujQOw.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\OsAnUJb.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\lgEyjsY.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\xVlYvrM.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\LTRYroP.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\OZcnAwR.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\RiTKvtv.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\LDbznfp.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\qKocTTC.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\FRcNWac.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\IqEFzel.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\kdrlLzU.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\mbZZWkj.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\FkFjOCd.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\QQYZfAF.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\uKRrzyF.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\qUSLczR.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\IrQtTld.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\tFkUPVs.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\JlRmQPU.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\uarQqIn.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\daCiQAM.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\XdvNCYR.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\vOouMvF.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\SrYSEPq.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\IPwfWeY.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\ZkdtJFP.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\xEdWQEZ.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\aeirpcl.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\HZMKBaA.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\MJImCNV.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\oDEAfvD.exe	aab33ab57a3d0863791f71a91327db40N.exe
File created	C:\Windows\System\DgwDYup.exe	aab33ab57a3d0863791f71a91327db40N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1000	916	aab33ab57a3d0863791f71a91327db40N.exe	85
PID 916 wrote to memory of 1000	916	aab33ab57a3d0863791f71a91327db40N.exe	85
PID 916 wrote to memory of 1720	916	aab33ab57a3d0863791f71a91327db40N.exe	86
PID 916 wrote to memory of 1720	916	aab33ab57a3d0863791f71a91327db40N.exe	86
PID 916 wrote to memory of 468	916	aab33ab57a3d0863791f71a91327db40N.exe	87
PID 916 wrote to memory of 468	916	aab33ab57a3d0863791f71a91327db40N.exe	87
PID 916 wrote to memory of 3780	916	aab33ab57a3d0863791f71a91327db40N.exe	88
PID 916 wrote to memory of 3780	916	aab33ab57a3d0863791f71a91327db40N.exe	88
PID 916 wrote to memory of 4792	916	aab33ab57a3d0863791f71a91327db40N.exe	89
PID 916 wrote to memory of 4792	916	aab33ab57a3d0863791f71a91327db40N.exe	89
PID 916 wrote to memory of 4552	916	aab33ab57a3d0863791f71a91327db40N.exe	90
PID 916 wrote to memory of 4552	916	aab33ab57a3d0863791f71a91327db40N.exe	90
PID 916 wrote to memory of 644	916	aab33ab57a3d0863791f71a91327db40N.exe	91
PID 916 wrote to memory of 644	916	aab33ab57a3d0863791f71a91327db40N.exe	91
PID 916 wrote to memory of 1628	916	aab33ab57a3d0863791f71a91327db40N.exe	92
PID 916 wrote to memory of 1628	916	aab33ab57a3d0863791f71a91327db40N.exe	92
PID 916 wrote to memory of 4252	916	aab33ab57a3d0863791f71a91327db40N.exe	93
PID 916 wrote to memory of 4252	916	aab33ab57a3d0863791f71a91327db40N.exe	93
PID 916 wrote to memory of 2084	916	aab33ab57a3d0863791f71a91327db40N.exe	94
PID 916 wrote to memory of 2084	916	aab33ab57a3d0863791f71a91327db40N.exe	94
PID 916 wrote to memory of 4932	916	aab33ab57a3d0863791f71a91327db40N.exe	95
PID 916 wrote to memory of 4932	916	aab33ab57a3d0863791f71a91327db40N.exe	95
PID 916 wrote to memory of 408	916	aab33ab57a3d0863791f71a91327db40N.exe	96
PID 916 wrote to memory of 408	916	aab33ab57a3d0863791f71a91327db40N.exe	96
PID 916 wrote to memory of 4864	916	aab33ab57a3d0863791f71a91327db40N.exe	97
PID 916 wrote to memory of 4864	916	aab33ab57a3d0863791f71a91327db40N.exe	97
PID 916 wrote to memory of 1260	916	aab33ab57a3d0863791f71a91327db40N.exe	98
PID 916 wrote to memory of 1260	916	aab33ab57a3d0863791f71a91327db40N.exe	98
PID 916 wrote to memory of 1456	916	aab33ab57a3d0863791f71a91327db40N.exe	99
PID 916 wrote to memory of 1456	916	aab33ab57a3d0863791f71a91327db40N.exe	99
PID 916 wrote to memory of 3896	916	aab33ab57a3d0863791f71a91327db40N.exe	100
PID 916 wrote to memory of 3896	916	aab33ab57a3d0863791f71a91327db40N.exe	100
PID 916 wrote to memory of 4748	916	aab33ab57a3d0863791f71a91327db40N.exe	101
PID 916 wrote to memory of 4748	916	aab33ab57a3d0863791f71a91327db40N.exe	101
PID 916 wrote to memory of 3644	916	aab33ab57a3d0863791f71a91327db40N.exe	102
PID 916 wrote to memory of 3644	916	aab33ab57a3d0863791f71a91327db40N.exe	102
PID 916 wrote to memory of 648	916	aab33ab57a3d0863791f71a91327db40N.exe	103
PID 916 wrote to memory of 648	916	aab33ab57a3d0863791f71a91327db40N.exe	103
PID 916 wrote to memory of 2220	916	aab33ab57a3d0863791f71a91327db40N.exe	104
PID 916 wrote to memory of 2220	916	aab33ab57a3d0863791f71a91327db40N.exe	104
PID 916 wrote to memory of 3048	916	aab33ab57a3d0863791f71a91327db40N.exe	105
PID 916 wrote to memory of 3048	916	aab33ab57a3d0863791f71a91327db40N.exe	105
PID 916 wrote to memory of 3968	916	aab33ab57a3d0863791f71a91327db40N.exe	106
PID 916 wrote to memory of 3968	916	aab33ab57a3d0863791f71a91327db40N.exe	106
PID 916 wrote to memory of 3576	916	aab33ab57a3d0863791f71a91327db40N.exe	107
PID 916 wrote to memory of 3576	916	aab33ab57a3d0863791f71a91327db40N.exe	107
PID 916 wrote to memory of 2820	916	aab33ab57a3d0863791f71a91327db40N.exe	108
PID 916 wrote to memory of 2820	916	aab33ab57a3d0863791f71a91327db40N.exe	108
PID 916 wrote to memory of 764	916	aab33ab57a3d0863791f71a91327db40N.exe	109
PID 916 wrote to memory of 764	916	aab33ab57a3d0863791f71a91327db40N.exe	109
PID 916 wrote to memory of 3952	916	aab33ab57a3d0863791f71a91327db40N.exe	110
PID 916 wrote to memory of 3952	916	aab33ab57a3d0863791f71a91327db40N.exe	110
PID 916 wrote to memory of 536	916	aab33ab57a3d0863791f71a91327db40N.exe	111
PID 916 wrote to memory of 536	916	aab33ab57a3d0863791f71a91327db40N.exe	111
PID 916 wrote to memory of 4384	916	aab33ab57a3d0863791f71a91327db40N.exe	112
PID 916 wrote to memory of 4384	916	aab33ab57a3d0863791f71a91327db40N.exe	112
PID 916 wrote to memory of 3360	916	aab33ab57a3d0863791f71a91327db40N.exe	113
PID 916 wrote to memory of 3360	916	aab33ab57a3d0863791f71a91327db40N.exe	113
PID 916 wrote to memory of 4756	916	aab33ab57a3d0863791f71a91327db40N.exe	114
PID 916 wrote to memory of 4756	916	aab33ab57a3d0863791f71a91327db40N.exe	114
PID 916 wrote to memory of 1992	916	aab33ab57a3d0863791f71a91327db40N.exe	115
PID 916 wrote to memory of 1992	916	aab33ab57a3d0863791f71a91327db40N.exe	115
PID 916 wrote to memory of 4300	916	aab33ab57a3d0863791f71a91327db40N.exe	116
PID 916 wrote to memory of 4300	916	aab33ab57a3d0863791f71a91327db40N.exe	116

C:\Users\Admin\AppData\Local\Temp\aab33ab57a3d0863791f71a91327db40N.exe
"C:\Users\Admin\AppData\Local\Temp\aab33ab57a3d0863791f71a91327db40N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\System\OPMNyxR.exe
  C:\Windows\System\OPMNyxR.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\kpJyPEN.exe
  C:\Windows\System\kpJyPEN.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\KOkUYCk.exe
  C:\Windows\System\KOkUYCk.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\NUmvHfU.exe
  C:\Windows\System\NUmvHfU.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\fzDvgTI.exe
  C:\Windows\System\fzDvgTI.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\SeuCSvK.exe
  C:\Windows\System\SeuCSvK.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\FiJdsxr.exe
  C:\Windows\System\FiJdsxr.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\WrjLcPG.exe
  C:\Windows\System\WrjLcPG.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\QraxrnE.exe
  C:\Windows\System\QraxrnE.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\FkFjOCd.exe
  C:\Windows\System\FkFjOCd.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\fAIgiUM.exe
  C:\Windows\System\fAIgiUM.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\OmaqHkr.exe
  C:\Windows\System\OmaqHkr.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\pLpdmKB.exe
  C:\Windows\System\pLpdmKB.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\JboZjBb.exe
  C:\Windows\System\JboZjBb.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\VepGrxu.exe
  C:\Windows\System\VepGrxu.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\LDbznfp.exe
  C:\Windows\System\LDbznfp.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\MyUUjUE.exe
  C:\Windows\System\MyUUjUE.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\ctdHjAj.exe
  C:\Windows\System\ctdHjAj.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\fskjySH.exe
  C:\Windows\System\fskjySH.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\CbRnziQ.exe
  C:\Windows\System\CbRnziQ.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\eLJqMSJ.exe
  C:\Windows\System\eLJqMSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\YAHanDO.exe
  C:\Windows\System\YAHanDO.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\MyDgKmt.exe
  C:\Windows\System\MyDgKmt.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\immFFxG.exe
  C:\Windows\System\immFFxG.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\mDAMNRb.exe
  C:\Windows\System\mDAMNRb.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\rUkUAuK.exe
  C:\Windows\System\rUkUAuK.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\KZZnGxP.exe
  C:\Windows\System\KZZnGxP.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\PfDMCud.exe
  C:\Windows\System\PfDMCud.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\HNtnlkX.exe
  C:\Windows\System\HNtnlkX.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\QqbycTs.exe
  C:\Windows\System\QqbycTs.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\zzwYVCQ.exe
  C:\Windows\System\zzwYVCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\uZMaqfR.exe
  C:\Windows\System\uZMaqfR.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\ZoqLiOY.exe
  C:\Windows\System\ZoqLiOY.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\nQlBmOq.exe
  C:\Windows\System\nQlBmOq.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\FBPCeTU.exe
  C:\Windows\System\FBPCeTU.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\GMkOJBL.exe
  C:\Windows\System\GMkOJBL.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\qLTTKCZ.exe
  C:\Windows\System\qLTTKCZ.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\WWQBxFJ.exe
  C:\Windows\System\WWQBxFJ.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\ZlRdZeM.exe
  C:\Windows\System\ZlRdZeM.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\LLLRWBa.exe
  C:\Windows\System\LLLRWBa.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\yqtzrIW.exe
  C:\Windows\System\yqtzrIW.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\QQYZfAF.exe
  C:\Windows\System\QQYZfAF.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\MnKmdtn.exe
  C:\Windows\System\MnKmdtn.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\FIuufyC.exe
  C:\Windows\System\FIuufyC.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\JErzIJB.exe
  C:\Windows\System\JErzIJB.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\krKCFNd.exe
  C:\Windows\System\krKCFNd.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\uarQqIn.exe
  C:\Windows\System\uarQqIn.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\nIjDEzZ.exe
  C:\Windows\System\nIjDEzZ.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\zEFBtyB.exe
  C:\Windows\System\zEFBtyB.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\aezvEgN.exe
  C:\Windows\System\aezvEgN.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\xChcsCR.exe
  C:\Windows\System\xChcsCR.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\MCLSUrS.exe
  C:\Windows\System\MCLSUrS.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\avGlZQr.exe
  C:\Windows\System\avGlZQr.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\NSLQPDr.exe
  C:\Windows\System\NSLQPDr.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\lSxiGnc.exe
  C:\Windows\System\lSxiGnc.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\RcHVDGE.exe
  C:\Windows\System\RcHVDGE.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\rgkuCBp.exe
  C:\Windows\System\rgkuCBp.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\qKocTTC.exe
  C:\Windows\System\qKocTTC.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\ACckTpC.exe
  C:\Windows\System\ACckTpC.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\FEkVTXZ.exe
  C:\Windows\System\FEkVTXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\JgSeSBY.exe
  C:\Windows\System\JgSeSBY.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\oexpIXd.exe
  C:\Windows\System\oexpIXd.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\BBlNWHQ.exe
  C:\Windows\System\BBlNWHQ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\AqOJaqa.exe
  C:\Windows\System\AqOJaqa.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\TJORELQ.exe
  C:\Windows\System\TJORELQ.exe
  2⤵
  PID:4380
- C:\Windows\System\TsiIsNv.exe
  C:\Windows\System\TsiIsNv.exe
  2⤵
  PID:4356
- C:\Windows\System\pdakANv.exe
  C:\Windows\System\pdakANv.exe
  2⤵
  PID:5076
- C:\Windows\System\xVlYvrM.exe
  C:\Windows\System\xVlYvrM.exe
  2⤵
  PID:3600
- C:\Windows\System\tTvrzEl.exe
  C:\Windows\System\tTvrzEl.exe
  2⤵
  PID:2648
- C:\Windows\System\FeYUkYG.exe
  C:\Windows\System\FeYUkYG.exe
  2⤵
  PID:2840
- C:\Windows\System\awKzuOB.exe
  C:\Windows\System\awKzuOB.exe
  2⤵
  PID:896
- C:\Windows\System\DmFNHLQ.exe
  C:\Windows\System\DmFNHLQ.exe
  2⤵
  PID:1372
- C:\Windows\System\DzURSyq.exe
  C:\Windows\System\DzURSyq.exe
  2⤵
  PID:1488
- C:\Windows\System\hmttgwK.exe
  C:\Windows\System\hmttgwK.exe
  2⤵
  PID:3732
- C:\Windows\System\mdwFvmZ.exe
  C:\Windows\System\mdwFvmZ.exe
  2⤵
  PID:4036
- C:\Windows\System\VWEhcjV.exe
  C:\Windows\System\VWEhcjV.exe
  2⤵
  PID:2620
- C:\Windows\System\yWTkyBk.exe
  C:\Windows\System\yWTkyBk.exe
  2⤵
  PID:4612
- C:\Windows\System\LJgHEjy.exe
  C:\Windows\System\LJgHEjy.exe
  2⤵
  PID:2728
- C:\Windows\System\cQeLQVw.exe
  C:\Windows\System\cQeLQVw.exe
  2⤵
  PID:4964
- C:\Windows\System\CoOwRRu.exe
  C:\Windows\System\CoOwRRu.exe
  2⤵
  PID:4208
- C:\Windows\System\rlOcOrh.exe
  C:\Windows\System\rlOcOrh.exe
  2⤵
  PID:1464
- C:\Windows\System\qiMuYzF.exe
  C:\Windows\System\qiMuYzF.exe
  2⤵
  PID:4268
- C:\Windows\System\CmWyAhN.exe
  C:\Windows\System\CmWyAhN.exe
  2⤵
  PID:1984
- C:\Windows\System\LIVfLmY.exe
  C:\Windows\System\LIVfLmY.exe
  2⤵
  PID:2316
- C:\Windows\System\tUupykO.exe
  C:\Windows\System\tUupykO.exe
  2⤵
  PID:4528
- C:\Windows\System\vPEkGWx.exe
  C:\Windows\System\vPEkGWx.exe
  2⤵
  PID:3244
- C:\Windows\System\yDrUTOq.exe
  C:\Windows\System\yDrUTOq.exe
  2⤵
  PID:5132
- C:\Windows\System\hjytcQh.exe
  C:\Windows\System\hjytcQh.exe
  2⤵
  PID:5148
- C:\Windows\System\OZqrrsM.exe
  C:\Windows\System\OZqrrsM.exe
  2⤵
  PID:5164
- C:\Windows\System\iAkwUIg.exe
  C:\Windows\System\iAkwUIg.exe
  2⤵
  PID:5180
- C:\Windows\System\AZBKlHC.exe
  C:\Windows\System\AZBKlHC.exe
  2⤵
  PID:5196
- C:\Windows\System\LOVWKYz.exe
  C:\Windows\System\LOVWKYz.exe
  2⤵
  PID:5212
- C:\Windows\System\CepbZqi.exe
  C:\Windows\System\CepbZqi.exe
  2⤵
  PID:5228
- C:\Windows\System\mRAiQnS.exe
  C:\Windows\System\mRAiQnS.exe
  2⤵
  PID:5248
- C:\Windows\System\uTFKAst.exe
  C:\Windows\System\uTFKAst.exe
  2⤵
  PID:5268
- C:\Windows\System\OaEYASa.exe
  C:\Windows\System\OaEYASa.exe
  2⤵
  PID:5292
- C:\Windows\System\uPlCqth.exe
  C:\Windows\System\uPlCqth.exe
  2⤵
  PID:5312
- C:\Windows\System\ltVAdtE.exe
  C:\Windows\System\ltVAdtE.exe
  2⤵
  PID:5332
- C:\Windows\System\itffdFH.exe
  C:\Windows\System\itffdFH.exe
  2⤵
  PID:5372
- C:\Windows\System\vTsCHqV.exe
  C:\Windows\System\vTsCHqV.exe
  2⤵
  PID:5388
- C:\Windows\System\cDsZqjk.exe
  C:\Windows\System\cDsZqjk.exe
  2⤵
  PID:5412
- C:\Windows\System\yHeKkQB.exe
  C:\Windows\System\yHeKkQB.exe
  2⤵
  PID:5436
- C:\Windows\System\ZHIMXja.exe
  C:\Windows\System\ZHIMXja.exe
  2⤵
  PID:5456
- C:\Windows\System\SEnAUtU.exe
  C:\Windows\System\SEnAUtU.exe
  2⤵
  PID:5476
- C:\Windows\System\VJrpuHZ.exe
  C:\Windows\System\VJrpuHZ.exe
  2⤵
  PID:5500
- C:\Windows\System\FBUNWbX.exe
  C:\Windows\System\FBUNWbX.exe
  2⤵
  PID:5520
- C:\Windows\System\XcTeMUN.exe
  C:\Windows\System\XcTeMUN.exe
  2⤵
  PID:5544
- C:\Windows\System\vcYXAMZ.exe
  C:\Windows\System\vcYXAMZ.exe
  2⤵
  PID:5592
- C:\Windows\System\EUHqHPm.exe
  C:\Windows\System\EUHqHPm.exe
  2⤵
  PID:5616
- C:\Windows\System\lPmdSKA.exe
  C:\Windows\System\lPmdSKA.exe
  2⤵
  PID:5632
- C:\Windows\System\OFaIdWt.exe
  C:\Windows\System\OFaIdWt.exe
  2⤵
  PID:5656
- C:\Windows\System\qBLXXew.exe
  C:\Windows\System\qBLXXew.exe
  2⤵
  PID:5672
- C:\Windows\System\UkIhHcF.exe
  C:\Windows\System\UkIhHcF.exe
  2⤵
  PID:5704
- C:\Windows\System\pFIPgdk.exe
  C:\Windows\System\pFIPgdk.exe
  2⤵
  PID:5720
- C:\Windows\System\euWbOQn.exe
  C:\Windows\System\euWbOQn.exe
  2⤵
  PID:5748
- C:\Windows\System\LAxFKMl.exe
  C:\Windows\System\LAxFKMl.exe
  2⤵
  PID:5768
- C:\Windows\System\CvkuIbq.exe
  C:\Windows\System\CvkuIbq.exe
  2⤵
  PID:5788
- C:\Windows\System\BNdixbh.exe
  C:\Windows\System\BNdixbh.exe
  2⤵
  PID:5904
- C:\Windows\System\mqSbDjm.exe
  C:\Windows\System\mqSbDjm.exe
  2⤵
  PID:5920
- C:\Windows\System\mzmZlMO.exe
  C:\Windows\System\mzmZlMO.exe
  2⤵
  PID:5940
- C:\Windows\System\PtuCjvY.exe
  C:\Windows\System\PtuCjvY.exe
  2⤵
  PID:5956
- C:\Windows\System\SCsrQFJ.exe
  C:\Windows\System\SCsrQFJ.exe
  2⤵
  PID:5980
- C:\Windows\System\uSwxXfa.exe
  C:\Windows\System\uSwxXfa.exe
  2⤵
  PID:5996
- C:\Windows\System\kZyfKwL.exe
  C:\Windows\System\kZyfKwL.exe
  2⤵
  PID:6020
- C:\Windows\System\LuMaeSG.exe
  C:\Windows\System\LuMaeSG.exe
  2⤵
  PID:6056
- C:\Windows\System\Rwhesgn.exe
  C:\Windows\System\Rwhesgn.exe
  2⤵
  PID:6084
- C:\Windows\System\lpouDnw.exe
  C:\Windows\System\lpouDnw.exe
  2⤵
  PID:6104
- C:\Windows\System\YnGZFfh.exe
  C:\Windows\System\YnGZFfh.exe
  2⤵
  PID:6124
- C:\Windows\System\FdUnFZQ.exe
  C:\Windows\System\FdUnFZQ.exe
  2⤵
  PID:3392
- C:\Windows\System\DrkjqPQ.exe
  C:\Windows\System\DrkjqPQ.exe
  2⤵
  PID:4892
- C:\Windows\System\ouKVOOu.exe
  C:\Windows\System\ouKVOOu.exe
  2⤵
  PID:3724
- C:\Windows\System\novMUCt.exe
  C:\Windows\System\novMUCt.exe
  2⤵
  PID:316
- C:\Windows\System\bHoSIba.exe
  C:\Windows\System\bHoSIba.exe
  2⤵
  PID:1124
- C:\Windows\System\WlYRito.exe
  C:\Windows\System\WlYRito.exe
  2⤵
  PID:4980
- C:\Windows\System\Whlkozo.exe
  C:\Windows\System\Whlkozo.exe
  2⤵
  PID:2484
- C:\Windows\System\QVltMZt.exe
  C:\Windows\System\QVltMZt.exe
  2⤵
  PID:348
- C:\Windows\System\dYFpomt.exe
  C:\Windows\System\dYFpomt.exe
  2⤵
  PID:2880
- C:\Windows\System\aeirpcl.exe
  C:\Windows\System\aeirpcl.exe
  2⤵
  PID:2352
- C:\Windows\System\RWWGTqw.exe
  C:\Windows\System\RWWGTqw.exe
  2⤵
  PID:3432
- C:\Windows\System\adRfgid.exe
  C:\Windows\System\adRfgid.exe
  2⤵
  PID:2044
- C:\Windows\System\gklMASp.exe
  C:\Windows\System\gklMASp.exe
  2⤵
  PID:4256
- C:\Windows\System\uMnQOol.exe
  C:\Windows\System\uMnQOol.exe
  2⤵
  PID:2388
- C:\Windows\System\UsDLhiA.exe
  C:\Windows\System\UsDLhiA.exe
  2⤵
  PID:4984
- C:\Windows\System\JLqHiJj.exe
  C:\Windows\System\JLqHiJj.exe
  2⤵
  PID:2264
- C:\Windows\System\lazXKzE.exe
  C:\Windows\System\lazXKzE.exe
  2⤵
  PID:1824
- C:\Windows\System\zfEazHj.exe
  C:\Windows\System\zfEazHj.exe
  2⤵
  PID:2292
- C:\Windows\System\hEtWFfK.exe
  C:\Windows\System\hEtWFfK.exe
  2⤵
  PID:4668
- C:\Windows\System\TOBJIqd.exe
  C:\Windows\System\TOBJIqd.exe
  2⤵
  PID:2492
- C:\Windows\System\sFAxvgO.exe
  C:\Windows\System\sFAxvgO.exe
  2⤵
  PID:3480
- C:\Windows\System\vOseish.exe
  C:\Windows\System\vOseish.exe
  2⤵
  PID:4108
- C:\Windows\System\WmrXYuQ.exe
  C:\Windows\System\WmrXYuQ.exe
  2⤵
  PID:2100
- C:\Windows\System\kXoGilb.exe
  C:\Windows\System\kXoGilb.exe
  2⤵
  PID:5668
- C:\Windows\System\NUMcgyD.exe
  C:\Windows\System\NUMcgyD.exe
  2⤵
  PID:4048
- C:\Windows\System\xcssizp.exe
  C:\Windows\System\xcssizp.exe
  2⤵
  PID:6164
- C:\Windows\System\DZKqGyr.exe
  C:\Windows\System\DZKqGyr.exe
  2⤵
  PID:6204
- C:\Windows\System\hKLtFCt.exe
  C:\Windows\System\hKLtFCt.exe
  2⤵
  PID:6224
- C:\Windows\System\CKuEkxg.exe
  C:\Windows\System\CKuEkxg.exe
  2⤵
  PID:6252
- C:\Windows\System\myIMlYt.exe
  C:\Windows\System\myIMlYt.exe
  2⤵
  PID:6272
- C:\Windows\System\CwKObij.exe
  C:\Windows\System\CwKObij.exe
  2⤵
  PID:6292
- C:\Windows\System\CzFqEbO.exe
  C:\Windows\System\CzFqEbO.exe
  2⤵
  PID:6312
- C:\Windows\System\yncwCVg.exe
  C:\Windows\System\yncwCVg.exe
  2⤵
  PID:6340
- C:\Windows\System\uKRrzyF.exe
  C:\Windows\System\uKRrzyF.exe
  2⤵
  PID:6372
- C:\Windows\System\Txpoics.exe
  C:\Windows\System\Txpoics.exe
  2⤵
  PID:6396
- C:\Windows\System\ejoZyct.exe
  C:\Windows\System\ejoZyct.exe
  2⤵
  PID:6424
- C:\Windows\System\nyBLEPC.exe
  C:\Windows\System\nyBLEPC.exe
  2⤵
  PID:6444
- C:\Windows\System\IDUakuR.exe
  C:\Windows\System\IDUakuR.exe
  2⤵
  PID:6468
- C:\Windows\System\UuHvhvW.exe
  C:\Windows\System\UuHvhvW.exe
  2⤵
  PID:6488
- C:\Windows\System\NBZEpOA.exe
  C:\Windows\System\NBZEpOA.exe
  2⤵
  PID:6504
- C:\Windows\System\VdLhEiV.exe
  C:\Windows\System\VdLhEiV.exe
  2⤵
  PID:6524
- C:\Windows\System\daCiQAM.exe
  C:\Windows\System\daCiQAM.exe
  2⤵
  PID:6540
- C:\Windows\System\DYJucpH.exe
  C:\Windows\System\DYJucpH.exe
  2⤵
  PID:6568
- C:\Windows\System\DtseVzB.exe
  C:\Windows\System\DtseVzB.exe
  2⤵
  PID:6584
- C:\Windows\System\MEEGEjL.exe
  C:\Windows\System\MEEGEjL.exe
  2⤵
  PID:6608
- C:\Windows\System\TBUHPnN.exe
  C:\Windows\System\TBUHPnN.exe
  2⤵
  PID:6636
- C:\Windows\System\UqNrXMv.exe
  C:\Windows\System\UqNrXMv.exe
  2⤵
  PID:6652
- C:\Windows\System\uILDpai.exe
  C:\Windows\System\uILDpai.exe
  2⤵
  PID:6692
- C:\Windows\System\rqPLVNa.exe
  C:\Windows\System\rqPLVNa.exe
  2⤵
  PID:6708
- C:\Windows\System\xIjsmxF.exe
  C:\Windows\System\xIjsmxF.exe
  2⤵
  PID:6732
- C:\Windows\System\vFsINUI.exe
  C:\Windows\System\vFsINUI.exe
  2⤵
  PID:6748
- C:\Windows\System\PzqrpGA.exe
  C:\Windows\System\PzqrpGA.exe
  2⤵
  PID:6768
- C:\Windows\System\VwWJWgY.exe
  C:\Windows\System\VwWJWgY.exe
  2⤵
  PID:6792
- C:\Windows\System\ayzDiUM.exe
  C:\Windows\System\ayzDiUM.exe
  2⤵
  PID:6816
- C:\Windows\System\lMhTAKh.exe
  C:\Windows\System\lMhTAKh.exe
  2⤵
  PID:6832
- C:\Windows\System\DRzyuDT.exe
  C:\Windows\System\DRzyuDT.exe
  2⤵
  PID:6856
- C:\Windows\System\cHQchpb.exe
  C:\Windows\System\cHQchpb.exe
  2⤵
  PID:6880
- C:\Windows\System\xCQNPeA.exe
  C:\Windows\System\xCQNPeA.exe
  2⤵
  PID:6900
- C:\Windows\System\RGyUdIV.exe
  C:\Windows\System\RGyUdIV.exe
  2⤵
  PID:7056
- C:\Windows\System\dlQgyem.exe
  C:\Windows\System\dlQgyem.exe
  2⤵
  PID:7072
- C:\Windows\System\okjbjUQ.exe
  C:\Windows\System\okjbjUQ.exe
  2⤵
  PID:7088
- C:\Windows\System\IEMypHj.exe
  C:\Windows\System\IEMypHj.exe
  2⤵
  PID:7104
- C:\Windows\System\WcOiUnc.exe
  C:\Windows\System\WcOiUnc.exe
  2⤵
  PID:7120
- C:\Windows\System\wnoWaEj.exe
  C:\Windows\System\wnoWaEj.exe
  2⤵
  PID:7136
- C:\Windows\System\duskTGm.exe
  C:\Windows\System\duskTGm.exe
  2⤵
  PID:7152
- C:\Windows\System\TmMPbHF.exe
  C:\Windows\System\TmMPbHF.exe
  2⤵
  PID:5992
- C:\Windows\System\XwyrCEH.exe
  C:\Windows\System\XwyrCEH.exe
  2⤵
  PID:6016
- C:\Windows\System\bBsWtav.exe
  C:\Windows\System\bBsWtav.exe
  2⤵
  PID:5128
- C:\Windows\System\OKWbvbF.exe
  C:\Windows\System\OKWbvbF.exe
  2⤵
  PID:5140
- C:\Windows\System\RlrwjBH.exe
  C:\Windows\System\RlrwjBH.exe
  2⤵
  PID:1716
- C:\Windows\System\jXrwaro.exe
  C:\Windows\System\jXrwaro.exe
  2⤵
  PID:5308
- C:\Windows\System\hflpjNx.exe
  C:\Windows\System\hflpjNx.exe
  2⤵
  PID:5384
- C:\Windows\System\xnVXHwm.exe
  C:\Windows\System\xnVXHwm.exe
  2⤵
  PID:5484
- C:\Windows\System\SLkejKn.exe
  C:\Windows\System\SLkejKn.exe
  2⤵
  PID:5528
- C:\Windows\System\UHEFsYE.exe
  C:\Windows\System\UHEFsYE.exe
  2⤵
  PID:2688
- C:\Windows\System\NYhcakp.exe
  C:\Windows\System\NYhcakp.exe
  2⤵
  PID:5584
- C:\Windows\System\JdokYZd.exe
  C:\Windows\System\JdokYZd.exe
  2⤵
  PID:4204
- C:\Windows\System\MYxjDxS.exe
  C:\Windows\System\MYxjDxS.exe
  2⤵
  PID:5952
- C:\Windows\System\vijRVqt.exe
  C:\Windows\System\vijRVqt.exe
  2⤵
  PID:5892
- C:\Windows\System\oPiiRua.exe
  C:\Windows\System\oPiiRua.exe
  2⤵
  PID:1188
- C:\Windows\System\FRcNWac.exe
  C:\Windows\System\FRcNWac.exe
  2⤵
  PID:6048
- C:\Windows\System\psujQOw.exe
  C:\Windows\System\psujQOw.exe
  2⤵
  PID:6080
- C:\Windows\System\QZKnLVH.exe
  C:\Windows\System\QZKnLVH.exe
  2⤵
  PID:4424
- C:\Windows\System\pmoqtxj.exe
  C:\Windows\System\pmoqtxj.exe
  2⤵
  PID:3068
- C:\Windows\System\QJvpGmG.exe
  C:\Windows\System\QJvpGmG.exe
  2⤵
  PID:3956
- C:\Windows\System\WsfWiWq.exe
  C:\Windows\System\WsfWiWq.exe
  2⤵
  PID:1080
- C:\Windows\System\kLbwhNQ.exe
  C:\Windows\System\kLbwhNQ.exe
  2⤵
  PID:4360
- C:\Windows\System\ngbjNzY.exe
  C:\Windows\System\ngbjNzY.exe
  2⤵
  PID:4436
- C:\Windows\System\hRVvenL.exe
  C:\Windows\System\hRVvenL.exe
  2⤵
  PID:3484
- C:\Windows\System\xHtOGgt.exe
  C:\Windows\System\xHtOGgt.exe
  2⤵
  PID:6232
- C:\Windows\System\BlICNoA.exe
  C:\Windows\System\BlICNoA.exe
  2⤵
  PID:6416
- C:\Windows\System\wdUcyrd.exe
  C:\Windows\System\wdUcyrd.exe
  2⤵
  PID:6676
- C:\Windows\System\RVDxouV.exe
  C:\Windows\System\RVDxouV.exe
  2⤵
  PID:6936
- C:\Windows\System\wVeRtPJ.exe
  C:\Windows\System\wVeRtPJ.exe
  2⤵
  PID:6196
- C:\Windows\System\tjBdeMH.exe
  C:\Windows\System\tjBdeMH.exe
  2⤵
  PID:6280
- C:\Windows\System\HrnhiyC.exe
  C:\Windows\System\HrnhiyC.exe
  2⤵
  PID:6332
- C:\Windows\System\XRLwGjQ.exe
  C:\Windows\System\XRLwGjQ.exe
  2⤵
  PID:6408
- C:\Windows\System\IXLXWdk.exe
  C:\Windows\System\IXLXWdk.exe
  2⤵
  PID:6496
- C:\Windows\System\wocuZlF.exe
  C:\Windows\System\wocuZlF.exe
  2⤵
  PID:6576
- C:\Windows\System\nMCnFtC.exe
  C:\Windows\System\nMCnFtC.exe
  2⤵
  PID:6648
- C:\Windows\System\BOYehsj.exe
  C:\Windows\System\BOYehsj.exe
  2⤵
  PID:6716
- C:\Windows\System\IItRAYX.exe
  C:\Windows\System\IItRAYX.exe
  2⤵
  PID:6788
- C:\Windows\System\oTBfvzC.exe
  C:\Windows\System\oTBfvzC.exe
  2⤵
  PID:6868
- C:\Windows\System\MNcArgs.exe
  C:\Windows\System\MNcArgs.exe
  2⤵
  PID:4400
- C:\Windows\System\YCTlbIe.exe
  C:\Windows\System\YCTlbIe.exe
  2⤵
  PID:7188
- C:\Windows\System\dSRfcDc.exe
  C:\Windows\System\dSRfcDc.exe
  2⤵
  PID:7208
- C:\Windows\System\KxQGPcX.exe
  C:\Windows\System\KxQGPcX.exe
  2⤵
  PID:7232
- C:\Windows\System\FPgJyFq.exe
  C:\Windows\System\FPgJyFq.exe
  2⤵
  PID:7252
- C:\Windows\System\LIGyTBX.exe
  C:\Windows\System\LIGyTBX.exe
  2⤵
  PID:7276
- C:\Windows\System\IYOkRgC.exe
  C:\Windows\System\IYOkRgC.exe
  2⤵
  PID:7300
- C:\Windows\System\QYeJWuq.exe
  C:\Windows\System\QYeJWuq.exe
  2⤵
  PID:7320
- C:\Windows\System\BAsZVAn.exe
  C:\Windows\System\BAsZVAn.exe
  2⤵
  PID:7344
- C:\Windows\System\EOVAqtt.exe
  C:\Windows\System\EOVAqtt.exe
  2⤵
  PID:7364
- C:\Windows\System\IqEFzel.exe
  C:\Windows\System\IqEFzel.exe
  2⤵
  PID:7384
- C:\Windows\System\ggbFHKL.exe
  C:\Windows\System\ggbFHKL.exe
  2⤵
  PID:7408
- C:\Windows\System\qUSLczR.exe
  C:\Windows\System\qUSLczR.exe
  2⤵
  PID:7444
- C:\Windows\System\QYCzaCp.exe
  C:\Windows\System\QYCzaCp.exe
  2⤵
  PID:7460
- C:\Windows\System\mksGcUE.exe
  C:\Windows\System\mksGcUE.exe
  2⤵
  PID:7480
- C:\Windows\System\aTYRxxN.exe
  C:\Windows\System\aTYRxxN.exe
  2⤵
  PID:7496
- C:\Windows\System\EPocZss.exe
  C:\Windows\System\EPocZss.exe
  2⤵
  PID:7516
- C:\Windows\System\gfENTeP.exe
  C:\Windows\System\gfENTeP.exe
  2⤵
  PID:7536
- C:\Windows\System\AlmRAIe.exe
  C:\Windows\System\AlmRAIe.exe
  2⤵
  PID:7552
- C:\Windows\System\HZMKBaA.exe
  C:\Windows\System\HZMKBaA.exe
  2⤵
  PID:7572
- C:\Windows\System\waQsLXG.exe
  C:\Windows\System\waQsLXG.exe
  2⤵
  PID:7588
- C:\Windows\System\OZPdKks.exe
  C:\Windows\System\OZPdKks.exe
  2⤵
  PID:7608
- C:\Windows\System\auSgprs.exe
  C:\Windows\System\auSgprs.exe
  2⤵
  PID:7628
- C:\Windows\System\WjAAZme.exe
  C:\Windows\System\WjAAZme.exe
  2⤵
  PID:7648
- C:\Windows\System\VHrsZIU.exe
  C:\Windows\System\VHrsZIU.exe
  2⤵
  PID:7664
- C:\Windows\System\gRUzNGI.exe
  C:\Windows\System\gRUzNGI.exe
  2⤵
  PID:7684
- C:\Windows\System\qsUTlAo.exe
  C:\Windows\System\qsUTlAo.exe
  2⤵
  PID:7704
- C:\Windows\System\mpPVwow.exe
  C:\Windows\System\mpPVwow.exe
  2⤵
  PID:7724
- C:\Windows\System\VEMnWQG.exe
  C:\Windows\System\VEMnWQG.exe
  2⤵
  PID:7744
- C:\Windows\System\QxlEtNE.exe
  C:\Windows\System\QxlEtNE.exe
  2⤵
  PID:7764
- C:\Windows\System\qjyahVL.exe
  C:\Windows\System\qjyahVL.exe
  2⤵
  PID:7784
- C:\Windows\System\zmpGAfZ.exe
  C:\Windows\System\zmpGAfZ.exe
  2⤵
  PID:7812
- C:\Windows\System\KtzCIjJ.exe
  C:\Windows\System\KtzCIjJ.exe
  2⤵
  PID:7828
- C:\Windows\System\jrhXBPb.exe
  C:\Windows\System\jrhXBPb.exe
  2⤵
  PID:7848
- C:\Windows\System\LPXVAWt.exe
  C:\Windows\System\LPXVAWt.exe
  2⤵
  PID:7872
- C:\Windows\System\MfQMIYC.exe
  C:\Windows\System\MfQMIYC.exe
  2⤵
  PID:7892
- C:\Windows\System\rGNYzGv.exe
  C:\Windows\System\rGNYzGv.exe
  2⤵
  PID:8108
- C:\Windows\System\fTphiBJ.exe
  C:\Windows\System\fTphiBJ.exe
  2⤵
  PID:8128
- C:\Windows\System\guelVFk.exe
  C:\Windows\System\guelVFk.exe
  2⤵
  PID:8148
- C:\Windows\System\tBCfiZD.exe
  C:\Windows\System\tBCfiZD.exe
  2⤵
  PID:8168
- C:\Windows\System\cWQNRtV.exe
  C:\Windows\System\cWQNRtV.exe
  2⤵
  PID:8184
- C:\Windows\System\XdvNCYR.exe
  C:\Windows\System\XdvNCYR.exe
  2⤵
  PID:7096
- C:\Windows\System\bwpgzBM.exe
  C:\Windows\System\bwpgzBM.exe
  2⤵
  PID:7160
- C:\Windows\System\TiYEQGW.exe
  C:\Windows\System\TiYEQGW.exe
  2⤵
  PID:5188
- C:\Windows\System\YYGxSfn.exe
  C:\Windows\System\YYGxSfn.exe
  2⤵
  PID:8340
- C:\Windows\System\jNMPbZg.exe
  C:\Windows\System\jNMPbZg.exe
  2⤵
  PID:8356
- C:\Windows\System\PzZkqUM.exe
  C:\Windows\System\PzZkqUM.exe
  2⤵
  PID:8372
- C:\Windows\System\wdZkPvA.exe
  C:\Windows\System\wdZkPvA.exe
  2⤵
  PID:8388
- C:\Windows\System\WzCpbvw.exe
  C:\Windows\System\WzCpbvw.exe
  2⤵
  PID:8404
- C:\Windows\System\YwZNsNE.exe
  C:\Windows\System\YwZNsNE.exe
  2⤵
  PID:8420
- C:\Windows\System\YukTULd.exe
  C:\Windows\System\YukTULd.exe
  2⤵
  PID:8436
- C:\Windows\System\vALvqKU.exe
  C:\Windows\System\vALvqKU.exe
  2⤵
  PID:8452
- C:\Windows\System\yQsNigu.exe
  C:\Windows\System\yQsNigu.exe
  2⤵
  PID:8468
- C:\Windows\System\BIKPTFt.exe
  C:\Windows\System\BIKPTFt.exe
  2⤵
  PID:8484
- C:\Windows\System\YawhSrC.exe
  C:\Windows\System\YawhSrC.exe
  2⤵
  PID:8500
- C:\Windows\System\VcAzBCT.exe
  C:\Windows\System\VcAzBCT.exe
  2⤵
  PID:8516
- C:\Windows\System\HnzFraF.exe
  C:\Windows\System\HnzFraF.exe
  2⤵
  PID:8548
- C:\Windows\System\nlofeqa.exe
  C:\Windows\System\nlofeqa.exe
  2⤵
  PID:8564
- C:\Windows\System\qbyvIVf.exe
  C:\Windows\System\qbyvIVf.exe
  2⤵
  PID:8580
- C:\Windows\System\JjEMOoq.exe
  C:\Windows\System\JjEMOoq.exe
  2⤵
  PID:8600
- C:\Windows\System\OsAnUJb.exe
  C:\Windows\System\OsAnUJb.exe
  2⤵
  PID:8976
- C:\Windows\System\kdrlLzU.exe
  C:\Windows\System\kdrlLzU.exe
  2⤵
  PID:9000
- C:\Windows\System\COpWMiZ.exe
  C:\Windows\System\COpWMiZ.exe
  2⤵
  PID:9024
- C:\Windows\System\zFanlOY.exe
  C:\Windows\System\zFanlOY.exe
  2⤵
  PID:9048
- C:\Windows\System\XJZhPJP.exe
  C:\Windows\System\XJZhPJP.exe
  2⤵
  PID:9108
- C:\Windows\System\ZNmmavw.exe
  C:\Windows\System\ZNmmavw.exe
  2⤵
  PID:9128
- C:\Windows\System\OiURljH.exe
  C:\Windows\System\OiURljH.exe
  2⤵
  PID:9148
- C:\Windows\System\hFJIYsr.exe
  C:\Windows\System\hFJIYsr.exe
  2⤵
  PID:9172
- C:\Windows\System\OTrRTXs.exe
  C:\Windows\System\OTrRTXs.exe
  2⤵
  PID:9200
- C:\Windows\System\rfRgUsC.exe
  C:\Windows\System\rfRgUsC.exe
  2⤵
  PID:7332
- C:\Windows\System\vhvDTYJ.exe
  C:\Windows\System\vhvDTYJ.exe
  2⤵
  PID:7492
- C:\Windows\System\CAbSVTX.exe
  C:\Windows\System\CAbSVTX.exe
  2⤵
  PID:7600
- C:\Windows\System\JLnTngY.exe
  C:\Windows\System\JLnTngY.exe
  2⤵
  PID:7636
- C:\Windows\System\jHebpOI.exe
  C:\Windows\System\jHebpOI.exe
  2⤵
  PID:7660
- C:\Windows\System\sYFelkp.exe
  C:\Windows\System\sYFelkp.exe
  2⤵
  PID:7692
- C:\Windows\System\lPYKjFK.exe
  C:\Windows\System\lPYKjFK.exe
  2⤵
  PID:7760
- C:\Windows\System\rzqynvf.exe
  C:\Windows\System\rzqynvf.exe
  2⤵
  PID:1668
- C:\Windows\System\AMfDQmB.exe
  C:\Windows\System\AMfDQmB.exe
  2⤵
  PID:7316
- C:\Windows\System\sEUwunE.exe
  C:\Windows\System\sEUwunE.exe
  2⤵
  PID:7084
- C:\Windows\System\tQuKqbC.exe
  C:\Windows\System\tQuKqbC.exe
  2⤵
  PID:7164
- C:\Windows\System\lRqWGPf.exe
  C:\Windows\System\lRqWGPf.exe
  2⤵
  PID:5300
- C:\Windows\System\VhERdzE.exe
  C:\Windows\System\VhERdzE.exe
  2⤵
  PID:5680
- C:\Windows\System\ccmlHfD.exe
  C:\Windows\System\ccmlHfD.exe
  2⤵
  PID:5800
- C:\Windows\System\SQASYRl.exe
  C:\Windows\System\SQASYRl.exe
  2⤵
  PID:5936
- C:\Windows\System\lgEyjsY.exe
  C:\Windows\System\lgEyjsY.exe
  2⤵
  PID:2752
- C:\Windows\System\gKIfcqo.exe
  C:\Windows\System\gKIfcqo.exe
  2⤵
  PID:4368
- C:\Windows\System\NJEpyWd.exe
  C:\Windows\System\NJEpyWd.exe
  2⤵
  PID:4164
- C:\Windows\System\PdkKiSZ.exe
  C:\Windows\System\PdkKiSZ.exe
  2⤵
  PID:6480
- C:\Windows\System\lrHqjpo.exe
  C:\Windows\System\lrHqjpo.exe
  2⤵
  PID:6864
- C:\Windows\System\QGrmnac.exe
  C:\Windows\System\QGrmnac.exe
  2⤵
  PID:6240
- C:\Windows\System\aeJkyDm.exe
  C:\Windows\System\aeJkyDm.exe
  2⤵
  PID:6404
- C:\Windows\System\VFCQoSb.exe
  C:\Windows\System\VFCQoSb.exe
  2⤵
  PID:6520
- C:\Windows\System\iwHDTri.exe
  C:\Windows\System\iwHDTri.exe
  2⤵
  PID:6644
- C:\Windows\System\TcypRJm.exe
  C:\Windows\System\TcypRJm.exe
  2⤵
  PID:6764
- C:\Windows\System\pKTinog.exe
  C:\Windows\System\pKTinog.exe
  2⤵
  PID:6892
- C:\Windows\System\EMxSveD.exe
  C:\Windows\System\EMxSveD.exe
  2⤵
  PID:7216
- C:\Windows\System\zvWzsib.exe
  C:\Windows\System\zvWzsib.exe
  2⤵
  PID:7272
- C:\Windows\System\XpTmAAe.exe
  C:\Windows\System\XpTmAAe.exe
  2⤵
  PID:7328
- C:\Windows\System\jnEKfad.exe
  C:\Windows\System\jnEKfad.exe
  2⤵
  PID:7380
- C:\Windows\System\fbJXuJf.exe
  C:\Windows\System\fbJXuJf.exe
  2⤵
  PID:7436
- C:\Windows\System\ehbqAYF.exe
  C:\Windows\System\ehbqAYF.exe
  2⤵
  PID:7528
- C:\Windows\System\RcjKCDr.exe
  C:\Windows\System\RcjKCDr.exe
  2⤵
  PID:7596
- C:\Windows\System\RiTKvtv.exe
  C:\Windows\System\RiTKvtv.exe
  2⤵
  PID:7752
- C:\Windows\System\EdNugcO.exe
  C:\Windows\System\EdNugcO.exe
  2⤵
  PID:8508
- C:\Windows\System\PtHhApP.exe
  C:\Windows\System\PtHhApP.exe
  2⤵
  PID:7820
- C:\Windows\System\TriEmiv.exe
  C:\Windows\System\TriEmiv.exe
  2⤵
  PID:7856
- C:\Windows\System\osYDsvo.exe
  C:\Windows\System\osYDsvo.exe
  2⤵
  PID:7900
- C:\Windows\System\SDvizMA.exe
  C:\Windows\System\SDvizMA.exe
  2⤵
  PID:8064
- C:\Windows\System\eUTATSj.exe
  C:\Windows\System\eUTATSj.exe
  2⤵
  PID:8088
- C:\Windows\System\PVBsKGG.exe
  C:\Windows\System\PVBsKGG.exe
  2⤵
  PID:8116
- C:\Windows\System\ucXVupI.exe
  C:\Windows\System\ucXVupI.exe
  2⤵
  PID:8156
- C:\Windows\System\ykWCQOy.exe
  C:\Windows\System\ykWCQOy.exe
  2⤵
  PID:7040
- C:\Windows\System\KnvbzEf.exe
  C:\Windows\System\KnvbzEf.exe
  2⤵
  PID:8300
- C:\Windows\System\MJImCNV.exe
  C:\Windows\System\MJImCNV.exe
  2⤵
  PID:8492
- C:\Windows\System\UZgONbD.exe
  C:\Windows\System\UZgONbD.exe
  2⤵
  PID:9240
- C:\Windows\System\CWXVqfD.exe
  C:\Windows\System\CWXVqfD.exe
  2⤵
  PID:9264
- C:\Windows\System\yWEJKNs.exe
  C:\Windows\System\yWEJKNs.exe
  2⤵
  PID:9288
- C:\Windows\System\BbuGfip.exe
  C:\Windows\System\BbuGfip.exe
  2⤵
  PID:9308
- C:\Windows\System\fYdXnut.exe
  C:\Windows\System\fYdXnut.exe
  2⤵
  PID:9348
- C:\Windows\System\kKeEgrM.exe
  C:\Windows\System\kKeEgrM.exe
  2⤵
  PID:9364
- C:\Windows\System\InDRtIi.exe
  C:\Windows\System\InDRtIi.exe
  2⤵
  PID:9404
- C:\Windows\System\AHkoCww.exe
  C:\Windows\System\AHkoCww.exe
  2⤵
  PID:9428
- C:\Windows\System\YXSBcTV.exe
  C:\Windows\System\YXSBcTV.exe
  2⤵
  PID:9484
- C:\Windows\System\XdBreFp.exe
  C:\Windows\System\XdBreFp.exe
  2⤵
  PID:9508
- C:\Windows\System\EIxePpS.exe
  C:\Windows\System\EIxePpS.exe
  2⤵
  PID:9528
- C:\Windows\System\CfUlIHz.exe
  C:\Windows\System\CfUlIHz.exe
  2⤵
  PID:9552
- C:\Windows\System\vOouMvF.exe
  C:\Windows\System\vOouMvF.exe
  2⤵
  PID:9576
- C:\Windows\System\MqONUaj.exe
  C:\Windows\System\MqONUaj.exe
  2⤵
  PID:9600
- C:\Windows\System\CweviKR.exe
  C:\Windows\System\CweviKR.exe
  2⤵
  PID:9624
- C:\Windows\System\pugbxEj.exe
  C:\Windows\System\pugbxEj.exe
  2⤵
  PID:9652
- C:\Windows\System\WlFvFhl.exe
  C:\Windows\System\WlFvFhl.exe
  2⤵
  PID:9692
- C:\Windows\System\JJSynWO.exe
  C:\Windows\System\JJSynWO.exe
  2⤵
  PID:9712
- C:\Windows\System\wJdlhUH.exe
  C:\Windows\System\wJdlhUH.exe
  2⤵
  PID:9732
- C:\Windows\System\baVBbYc.exe
  C:\Windows\System\baVBbYc.exe
  2⤵
  PID:9768
- C:\Windows\System\AkrddAQ.exe
  C:\Windows\System\AkrddAQ.exe
  2⤵
  PID:9784
- C:\Windows\System\GFDtNkR.exe
  C:\Windows\System\GFDtNkR.exe
  2⤵
  PID:9804
- C:\Windows\System\gpuBbJb.exe
  C:\Windows\System\gpuBbJb.exe
  2⤵
  PID:9840
- C:\Windows\System\UmOhnil.exe
  C:\Windows\System\UmOhnil.exe
  2⤵
  PID:9860
- C:\Windows\System\sCLVNRI.exe
  C:\Windows\System\sCLVNRI.exe
  2⤵
  PID:9880
- C:\Windows\System\iJRAMuc.exe
  C:\Windows\System\iJRAMuc.exe
  2⤵
  PID:9904
- C:\Windows\System\SLdTibf.exe
  C:\Windows\System\SLdTibf.exe
  2⤵
  PID:9924
- C:\Windows\System\AUZXpEQ.exe
  C:\Windows\System\AUZXpEQ.exe
  2⤵
  PID:9944
- C:\Windows\System\gmvoMWr.exe
  C:\Windows\System\gmvoMWr.exe
  2⤵
  PID:9960
- C:\Windows\System\WGPyMOo.exe
  C:\Windows\System\WGPyMOo.exe
  2⤵
  PID:9980
- C:\Windows\System\HeWpVTi.exe
  C:\Windows\System\HeWpVTi.exe
  2⤵
  PID:10008
- C:\Windows\System\hkHbucn.exe
  C:\Windows\System\hkHbucn.exe
  2⤵
  PID:10028
- C:\Windows\System\kuOeBIP.exe
  C:\Windows\System\kuOeBIP.exe
  2⤵
  PID:10052
- C:\Windows\System\sfhCEfG.exe
  C:\Windows\System\sfhCEfG.exe
  2⤵
  PID:10076
- C:\Windows\System\IhvQfYq.exe
  C:\Windows\System\IhvQfYq.exe
  2⤵
  PID:10096
- C:\Windows\System\mLnSwRX.exe
  C:\Windows\System\mLnSwRX.exe
  2⤵
  PID:10124
- C:\Windows\System\WSpQvVI.exe
  C:\Windows\System\WSpQvVI.exe
  2⤵
  PID:10144
- C:\Windows\System\ngoBnId.exe
  C:\Windows\System\ngoBnId.exe
  2⤵
  PID:10164
- C:\Windows\System\GDIoaYX.exe
  C:\Windows\System\GDIoaYX.exe
  2⤵
  PID:10184
- C:\Windows\System\TQkipKR.exe
  C:\Windows\System\TQkipKR.exe
  2⤵
  PID:10212
- C:\Windows\System\mckBhcY.exe
  C:\Windows\System\mckBhcY.exe
  2⤵
  PID:10236
- C:\Windows\System\JWebzNG.exe
  C:\Windows\System\JWebzNG.exe
  2⤵
  PID:8864
- C:\Windows\System\dNyhQpk.exe
  C:\Windows\System\dNyhQpk.exe
  2⤵
  PID:8700
- C:\Windows\System\ayTTCKP.exe
  C:\Windows\System\ayTTCKP.exe
  2⤵
  PID:1248
- C:\Windows\System\nDUVaPP.exe
  C:\Windows\System\nDUVaPP.exe
  2⤵
  PID:8348
- C:\Windows\System\IHZiBVf.exe
  C:\Windows\System\IHZiBVf.exe
  2⤵
  PID:5576
- C:\Windows\System\AcldFWY.exe
  C:\Windows\System\AcldFWY.exe
  2⤵
  PID:2968
- C:\Windows\System\mNxkjue.exe
  C:\Windows\System\mNxkjue.exe
  2⤵
  PID:3844
- C:\Windows\System\cqxuwVJ.exe
  C:\Windows\System\cqxuwVJ.exe
  2⤵
  PID:8384
- C:\Windows\System\vazjGLr.exe
  C:\Windows\System\vazjGLr.exe
  2⤵
  PID:8432
- C:\Windows\System\cBVKFpJ.exe
  C:\Windows\System\cBVKFpJ.exe
  2⤵
  PID:6740
- C:\Windows\System\bAZkwjV.exe
  C:\Windows\System\bAZkwjV.exe
  2⤵
  PID:7296
- C:\Windows\System\mnyVVlg.exe
  C:\Windows\System\mnyVVlg.exe
  2⤵
  PID:7416
- C:\Windows\System\hIixtzT.exe
  C:\Windows\System\hIixtzT.exe
  2⤵
  PID:7800
- C:\Windows\System\XbYaSjQ.exe
  C:\Windows\System\XbYaSjQ.exe
  2⤵
  PID:7884
- C:\Windows\System\SPfpOEG.exe
  C:\Windows\System\SPfpOEG.exe
  2⤵
  PID:8124
- C:\Windows\System\ibdBwGa.exe
  C:\Windows\System\ibdBwGa.exe
  2⤵
  PID:9276
- C:\Windows\System\qfLZwPu.exe
  C:\Windows\System\qfLZwPu.exe
  2⤵
  PID:9328
- C:\Windows\System\jJbQYUF.exe
  C:\Windows\System\jJbQYUF.exe
  2⤵
  PID:8740
- C:\Windows\System\XAYTERz.exe
  C:\Windows\System\XAYTERz.exe
  2⤵
  PID:8756
- C:\Windows\System\HmjliGo.exe
  C:\Windows\System\HmjliGo.exe
  2⤵
  PID:9608
- C:\Windows\System\eWXLucA.exe
  C:\Windows\System\eWXLucA.exe
  2⤵
  PID:9776
- C:\Windows\System\hyivJvp.exe
  C:\Windows\System\hyivJvp.exe
  2⤵
  PID:6220
- C:\Windows\System\HXPGseZ.exe
  C:\Windows\System\HXPGseZ.exe
  2⤵
  PID:6464
- C:\Windows\System\IrQtTld.exe
  C:\Windows\System\IrQtTld.exe
  2⤵
  PID:10264
- C:\Windows\System\JlhkLtS.exe
  C:\Windows\System\JlhkLtS.exe
  2⤵
  PID:10288
- C:\Windows\System\gZqPrVP.exe
  C:\Windows\System\gZqPrVP.exe
  2⤵
  PID:10304
- C:\Windows\System\NujpiEz.exe
  C:\Windows\System\NujpiEz.exe
  2⤵
  PID:10328
- C:\Windows\System\bQuIMcQ.exe
  C:\Windows\System\bQuIMcQ.exe
  2⤵
  PID:10348
- C:\Windows\System\dmwPHDr.exe
  C:\Windows\System\dmwPHDr.exe
  2⤵
  PID:10364
- C:\Windows\System\QOwWWsv.exe
  C:\Windows\System\QOwWWsv.exe
  2⤵
  PID:10384
- C:\Windows\System\guoguKE.exe
  C:\Windows\System\guoguKE.exe
  2⤵
  PID:10408
- C:\Windows\System\SyfaOmf.exe
  C:\Windows\System\SyfaOmf.exe
  2⤵
  PID:10424
- C:\Windows\System\Yfbzbrn.exe
  C:\Windows\System\Yfbzbrn.exe
  2⤵
  PID:10448
- C:\Windows\System\cfBvCly.exe
  C:\Windows\System\cfBvCly.exe
  2⤵
  PID:10464
- C:\Windows\System\dNqJnlO.exe
  C:\Windows\System\dNqJnlO.exe
  2⤵
  PID:10484
- C:\Windows\System\ecDQwUi.exe
  C:\Windows\System\ecDQwUi.exe
  2⤵
  PID:10508
- C:\Windows\System\mbZZWkj.exe
  C:\Windows\System\mbZZWkj.exe
  2⤵
  PID:10528
- C:\Windows\System\ubEVqeS.exe
  C:\Windows\System\ubEVqeS.exe
  2⤵
  PID:10556
- C:\Windows\System\GRZesuf.exe
  C:\Windows\System\GRZesuf.exe
  2⤵
  PID:10576
- C:\Windows\System\zQcHDYi.exe
  C:\Windows\System\zQcHDYi.exe
  2⤵
  PID:10592
- C:\Windows\System\RIBkoZA.exe
  C:\Windows\System\RIBkoZA.exe
  2⤵
  PID:10912
- C:\Windows\System\lBCLydU.exe
  C:\Windows\System\lBCLydU.exe
  2⤵
  PID:11048
- C:\Windows\System\PYHEtTN.exe
  C:\Windows\System\PYHEtTN.exe
  2⤵
  PID:11072
- C:\Windows\System\DgaCPQB.exe
  C:\Windows\System\DgaCPQB.exe
  2⤵
  PID:11096
- C:\Windows\System\plyDQBw.exe
  C:\Windows\System\plyDQBw.exe
  2⤵
  PID:11120
- C:\Windows\System\IUvoBku.exe
  C:\Windows\System\IUvoBku.exe
  2⤵
  PID:11148
- C:\Windows\System\YuFiZha.exe
  C:\Windows\System\YuFiZha.exe
  2⤵
  PID:11196
- C:\Windows\System\QvjEwCa.exe
  C:\Windows\System\QvjEwCa.exe
  2⤵
  PID:11216
- C:\Windows\System\MzwLMgN.exe
  C:\Windows\System\MzwLMgN.exe
  2⤵
  PID:11236
- C:\Windows\System\rhjDNTn.exe
  C:\Windows\System\rhjDNTn.exe
  2⤵
  PID:9876
- C:\Windows\System\LTRYroP.exe
  C:\Windows\System\LTRYroP.exe
  2⤵
  PID:9952
- C:\Windows\System\iNVPrBi.exe
  C:\Windows\System\iNVPrBi.exe
  2⤵
  PID:9100
- C:\Windows\System\mPTUJXj.exe
  C:\Windows\System\mPTUJXj.exe
  2⤵
  PID:9144
- C:\Windows\System\ozPoGVg.exe
  C:\Windows\System\ozPoGVg.exe
  2⤵
  PID:9208
- C:\Windows\System\nFxoxkH.exe
  C:\Windows\System\nFxoxkH.exe
  2⤵
  PID:7560
- C:\Windows\System\EwffEPS.exe
  C:\Windows\System\EwffEPS.exe
  2⤵
  PID:7676
- C:\Windows\System\HlPCPqm.exe
  C:\Windows\System\HlPCPqm.exe
  2⤵
  PID:7836
- C:\Windows\System\VuNPQUi.exe
  C:\Windows\System\VuNPQUi.exe
  2⤵
  PID:7132
- C:\Windows\System\ULrmWmB.exe
  C:\Windows\System\ULrmWmB.exe
  2⤵
  PID:5836
- C:\Windows\System\mhIrQEk.exe
  C:\Windows\System\mhIrQEk.exe
  2⤵
  PID:6320
- C:\Windows\System\ZcugAbm.exe
  C:\Windows\System\ZcugAbm.exe
  2⤵
  PID:6476
- C:\Windows\System\XKGngEq.exe
  C:\Windows\System\XKGngEq.exe
  2⤵
  PID:7732
- C:\Windows\System\MElKMyH.exe
  C:\Windows\System\MElKMyH.exe
  2⤵
  PID:8396
- C:\Windows\System\SpEIump.exe
  C:\Windows\System\SpEIump.exe
  2⤵
  PID:8876
- C:\Windows\System\kJbDzKY.exe
  C:\Windows\System\kJbDzKY.exe
  2⤵
  PID:7736
- C:\Windows\System\BBfWFOa.exe
  C:\Windows\System\BBfWFOa.exe
  2⤵
  PID:10296
- C:\Windows\System\EseSuln.exe
  C:\Windows\System\EseSuln.exe
  2⤵
  PID:10376
- C:\Windows\System\TtITsGO.exe
  C:\Windows\System\TtITsGO.exe
  2⤵
  PID:10496
- C:\Windows\System\ujsEgEP.exe
  C:\Windows\System\ujsEgEP.exe
  2⤵
  PID:9444
- C:\Windows\System\OdioRFl.exe
  C:\Windows\System\OdioRFl.exe
  2⤵
  PID:10416
- C:\Windows\System\mCJdGvb.exe
  C:\Windows\System\mCJdGvb.exe
  2⤵
  PID:10604
- C:\Windows\System\tFkUPVs.exe
  C:\Windows\System\tFkUPVs.exe
  2⤵
  PID:8328
- C:\Windows\System\bxfsksf.exe
  C:\Windows\System\bxfsksf.exe
  2⤵
  PID:9372
- C:\Windows\System\owyCnmm.exe
  C:\Windows\System\owyCnmm.exe
  2⤵
  PID:9420
- C:\Windows\System\psVLQsq.exe
  C:\Windows\System\psVLQsq.exe
  2⤵
  PID:9492
- C:\Windows\System\sKBPzod.exe
  C:\Windows\System\sKBPzod.exe
  2⤵
  PID:9544
- C:\Windows\System\ZMyampw.exe
  C:\Windows\System\ZMyampw.exe
  2⤵
  PID:9584
- C:\Windows\System\bNRHBrE.exe
  C:\Windows\System\bNRHBrE.exe
  2⤵
  PID:1436
- C:\Windows\System\qgIFLxO.exe
  C:\Windows\System\qgIFLxO.exe
  2⤵
  PID:9708
- C:\Windows\System\dGboxHA.exe
  C:\Windows\System\dGboxHA.exe
  2⤵
  PID:9756
- C:\Windows\System\dvMgjNn.exe
  C:\Windows\System\dvMgjNn.exe
  2⤵
  PID:9892
- C:\Windows\System\BEvgFJg.exe
  C:\Windows\System\BEvgFJg.exe
  2⤵
  PID:9988
- C:\Windows\System\OXQefxr.exe
  C:\Windows\System\OXQefxr.exe
  2⤵
  PID:10092
- C:\Windows\System\KWnPaPO.exe
  C:\Windows\System\KWnPaPO.exe
  2⤵
  PID:10196
- C:\Windows\System\dZqTjNo.exe
  C:\Windows\System\dZqTjNo.exe
  2⤵
  PID:5644
- C:\Windows\System\xNRWqom.exe
  C:\Windows\System\xNRWqom.exe
  2⤵
  PID:11268
- C:\Windows\System\UaMgmqB.exe
  C:\Windows\System\UaMgmqB.exe
  2⤵
  PID:11288
- C:\Windows\System\bhugYVJ.exe
  C:\Windows\System\bhugYVJ.exe
  2⤵
  PID:11312
- C:\Windows\System\TfvOrRT.exe
  C:\Windows\System\TfvOrRT.exe
  2⤵
  PID:11336
- C:\Windows\System\lKUkvdv.exe
  C:\Windows\System\lKUkvdv.exe
  2⤵
  PID:11364
- C:\Windows\System\REJpjDx.exe
  C:\Windows\System\REJpjDx.exe
  2⤵
  PID:11384
- C:\Windows\System\OxBghbV.exe
  C:\Windows\System\OxBghbV.exe
  2⤵
  PID:11416
- C:\Windows\System\oDEAfvD.exe
  C:\Windows\System\oDEAfvD.exe
  2⤵
  PID:11432
- C:\Windows\System\NpPspRn.exe
  C:\Windows\System\NpPspRn.exe
  2⤵
  PID:11448
- C:\Windows\System\eyWfObU.exe
  C:\Windows\System\eyWfObU.exe
  2⤵
  PID:11576
- C:\Windows\System\sZOBqTj.exe
  C:\Windows\System\sZOBqTj.exe
  2⤵
  PID:11604
- C:\Windows\System\CdrLPCh.exe
  C:\Windows\System\CdrLPCh.exe
  2⤵
  PID:11628
- C:\Windows\System\FnUnxRT.exe
  C:\Windows\System\FnUnxRT.exe
  2⤵
  PID:11664
- C:\Windows\System\EvlzIxY.exe
  C:\Windows\System\EvlzIxY.exe
  2⤵
  PID:11684
- C:\Windows\System\ufQhMVU.exe
  C:\Windows\System\ufQhMVU.exe
  2⤵
  PID:11704
- C:\Windows\System\kTghpHo.exe
  C:\Windows\System\kTghpHo.exe
  2⤵
  PID:11728
- C:\Windows\System\hmAAxTK.exe
  C:\Windows\System\hmAAxTK.exe
  2⤵
  PID:11780
- C:\Windows\System\RJBgjPp.exe
  C:\Windows\System\RJBgjPp.exe
  2⤵
  PID:11808
- C:\Windows\System\QXzeXhe.exe
  C:\Windows\System\QXzeXhe.exe
  2⤵
  PID:11832
- C:\Windows\System\hrVvHep.exe
  C:\Windows\System\hrVvHep.exe
  2⤵
  PID:11860
- C:\Windows\System\IeLTMON.exe
  C:\Windows\System\IeLTMON.exe
  2⤵
  PID:11904
- C:\Windows\System\XSZbYXW.exe
  C:\Windows\System\XSZbYXW.exe
  2⤵
  PID:11920
- C:\Windows\System\UOMhhDX.exe
  C:\Windows\System\UOMhhDX.exe
  2⤵
  PID:11936
- C:\Windows\System\BtAjTts.exe
  C:\Windows\System\BtAjTts.exe
  2⤵
  PID:11952
- C:\Windows\System\wdJspFA.exe
  C:\Windows\System\wdJspFA.exe
  2⤵
  PID:11976
- C:\Windows\System\JkcaPUV.exe
  C:\Windows\System\JkcaPUV.exe
  2⤵
  PID:11996
- C:\Windows\System\kMjbYmn.exe
  C:\Windows\System\kMjbYmn.exe
  2⤵
  PID:12012
- C:\Windows\System\aJTvbwO.exe
  C:\Windows\System\aJTvbwO.exe
  2⤵
  PID:12036
- C:\Windows\System\PJDOhis.exe
  C:\Windows\System\PJDOhis.exe
  2⤵
  PID:12056
- C:\Windows\System\nFZxwxw.exe
  C:\Windows\System\nFZxwxw.exe
  2⤵
  PID:12072
- C:\Windows\System\qFyhFPu.exe
  C:\Windows\System\qFyhFPu.exe
  2⤵
  PID:12092
- C:\Windows\System\HcOlnFP.exe
  C:\Windows\System\HcOlnFP.exe
  2⤵
  PID:12112
- C:\Windows\System\GwcQdRJ.exe
  C:\Windows\System\GwcQdRJ.exe
  2⤵
  PID:12132
- C:\Windows\System\fLuPbgL.exe
  C:\Windows\System\fLuPbgL.exe
  2⤵
  PID:12152
- C:\Windows\System\nmqZOEs.exe
  C:\Windows\System\nmqZOEs.exe
  2⤵
  PID:12172
- C:\Windows\System\urqAvWl.exe
  C:\Windows\System\urqAvWl.exe
  2⤵
  PID:12192
- C:\Windows\System\smmBIDn.exe
  C:\Windows\System\smmBIDn.exe
  2⤵
  PID:12212
- C:\Windows\System\SDLKGEW.exe
  C:\Windows\System\SDLKGEW.exe
  2⤵
  PID:12232
- C:\Windows\System\ElTzVmG.exe
  C:\Windows\System\ElTzVmG.exe
  2⤵
  PID:12248
- C:\Windows\System\hiMpClF.exe
  C:\Windows\System\hiMpClF.exe
  2⤵
  PID:12268
- C:\Windows\System\oNRzAmP.exe
  C:\Windows\System\oNRzAmP.exe
  2⤵
  PID:12284
- C:\Windows\System\fhOIqRW.exe
  C:\Windows\System\fhOIqRW.exe
  2⤵
  PID:7488
- C:\Windows\System\WKJaBGx.exe
  C:\Windows\System\WKJaBGx.exe
  2⤵
  PID:7204
- C:\Windows\System\YhIwyoZ.exe
  C:\Windows\System\YhIwyoZ.exe
  2⤵
  PID:7796
- C:\Windows\System\wqQZbIG.exe
  C:\Windows\System\wqQZbIG.exe
  2⤵
  PID:11164
- C:\Windows\System\nOZCAVL.exe
  C:\Windows\System\nOZCAVL.exe
  2⤵
  PID:3464
- C:\Windows\System\IpnLucX.exe
  C:\Windows\System\IpnLucX.exe
  2⤵
  PID:8692
- C:\Windows\System\CpaIOut.exe
  C:\Windows\System\CpaIOut.exe
  2⤵
  PID:8788
- C:\Windows\System\QegHLxd.exe
  C:\Windows\System\QegHLxd.exe
  2⤵
  PID:10248
- C:\Windows\System\xdVYigN.exe
  C:\Windows\System\xdVYigN.exe
  2⤵
  PID:10324
- C:\Windows\System\SrYSEPq.exe
  C:\Windows\System\SrYSEPq.exe
  2⤵
  PID:10392
- C:\Windows\System\PIvmQSG.exe
  C:\Windows\System\PIvmQSG.exe
  2⤵
  PID:10460
- C:\Windows\System\NvxcZqc.exe
  C:\Windows\System\NvxcZqc.exe
  2⤵
  PID:10536
- C:\Windows\System\rwqSDXe.exe
  C:\Windows\System\rwqSDXe.exe
  2⤵
  PID:6780
- C:\Windows\System\obyjNbP.exe
  C:\Windows\System\obyjNbP.exe
  2⤵
  PID:7644
- C:\Windows\System\WaaGQbn.exe
  C:\Windows\System\WaaGQbn.exe
  2⤵
  PID:7356
- C:\Windows\System\vDgBCRI.exe
  C:\Windows\System\vDgBCRI.exe
  2⤵
  PID:10340
- C:\Windows\System\pXsszKw.exe
  C:\Windows\System\pXsszKw.exe
  2⤵
  PID:9832
- C:\Windows\System\HVvUttU.exe
  C:\Windows\System\HVvUttU.exe
  2⤵
  PID:10904
- C:\Windows\System\xemYUoa.exe
  C:\Windows\System\xemYUoa.exe
  2⤵
  PID:9680
- C:\Windows\System\dARKzWk.exe
  C:\Windows\System\dARKzWk.exe
  2⤵
  PID:10948
- C:\Windows\System\iudNdze.exe
  C:\Windows\System\iudNdze.exe
  2⤵
  PID:10068
- C:\Windows\System\frSQrDh.exe
  C:\Windows\System\frSQrDh.exe
  2⤵
  PID:9056
- C:\Windows\System\eZdVZSB.exe
  C:\Windows\System\eZdVZSB.exe
  2⤵
  PID:13196
- C:\Windows\System\UXhvwjX.exe
  C:\Windows\System\UXhvwjX.exe
  2⤵
  PID:13212
- C:\Windows\System\jktxMii.exe
  C:\Windows\System\jktxMii.exe
  2⤵
  PID:13232
- C:\Windows\System\vKpRbGl.exe
  C:\Windows\System\vKpRbGl.exe
  2⤵
  PID:13264
- C:\Windows\System\KQjCkmL.exe
  C:\Windows\System\KQjCkmL.exe
  2⤵
  PID:13288
- C:\Windows\System\nwwQMsV.exe
  C:\Windows\System\nwwQMsV.exe
  2⤵
  PID:9572
- C:\Windows\System\BWhNiou.exe
  C:\Windows\System\BWhNiou.exe
  2⤵
  PID:10952
- C:\Windows\System\ToPKelf.exe
  C:\Windows\System\ToPKelf.exe
  2⤵
  PID:10972
- C:\Windows\System\xGPVCrQ.exe
  C:\Windows\System\xGPVCrQ.exe
  2⤵
  PID:10344
- C:\Windows\System\GkvmGIC.exe
  C:\Windows\System\GkvmGIC.exe
  2⤵
  PID:10572
- C:\Windows\System\iYAofkS.exe
  C:\Windows\System\iYAofkS.exe
  2⤵
  PID:11028
- C:\Windows\System\qohIQWe.exe
  C:\Windows\System\qohIQWe.exe
  2⤵
  PID:9640
- C:\Windows\System\rOjkgYd.exe
  C:\Windows\System\rOjkgYd.exe
  2⤵
  PID:2284
- C:\Windows\System\RhmGFUO.exe
  C:\Windows\System\RhmGFUO.exe
  2⤵
  PID:11252
- C:\Windows\System\fBqQTqR.exe
  C:\Windows\System\fBqQTqR.exe
  2⤵
  PID:9044
- C:\Windows\System\ZkdtJFP.exe
  C:\Windows\System\ZkdtJFP.exe
  2⤵
  PID:7476
- C:\Windows\System\fUtLwtC.exe
  C:\Windows\System\fUtLwtC.exe
  2⤵
  PID:7068
- C:\Windows\System\BgMoaah.exe
  C:\Windows\System\BgMoaah.exe
  2⤵
  PID:6148
- C:\Windows\System\DOdgWLj.exe
  C:\Windows\System\DOdgWLj.exe
  2⤵
  PID:8572
- C:\Windows\System\NlPDmMa.exe
  C:\Windows\System\NlPDmMa.exe
  2⤵
  PID:10612
- C:\Windows\System\FBeHwZh.exe
  C:\Windows\System\FBeHwZh.exe
  2⤵
  PID:9412
- C:\Windows\System\dpanKuQ.exe
  C:\Windows\System\dpanKuQ.exe
  2⤵
  PID:9744
- C:\Windows\System\QshiOFJ.exe
  C:\Windows\System\QshiOFJ.exe
  2⤵
  PID:11320
- C:\Windows\System\LJFfnCK.exe
  C:\Windows\System\LJFfnCK.exe
  2⤵
  PID:12024
- C:\Windows\System\kUtufFJ.exe
  C:\Windows\System\kUtufFJ.exe
  2⤵
  PID:12128
- C:\Windows\System\UfQAcHx.exe
  C:\Windows\System\UfQAcHx.exe
  2⤵
  PID:12260
- C:\Windows\System\hwtoyHV.exe
  C:\Windows\System\hwtoyHV.exe
  2⤵
  PID:2760
- C:\Windows\System\EVdkrrL.exe
  C:\Windows\System\EVdkrrL.exe
  2⤵
  PID:7044
- C:\Windows\System\zOMfbmZ.exe
  C:\Windows\System\zOMfbmZ.exe
  2⤵
  PID:2088
- C:\Windows\System\IOkLgtT.exe
  C:\Windows\System\IOkLgtT.exe
  2⤵
  PID:10004
- C:\Windows\System\jkPziDl.exe
  C:\Windows\System\jkPziDl.exe
  2⤵
  PID:2928
- C:\Windows\System\RgbVvlr.exe
  C:\Windows\System\RgbVvlr.exe
  2⤵
  PID:11596
- C:\Windows\System\rcYltaZ.exe
  C:\Windows\System\rcYltaZ.exe
  2⤵
  PID:11656
- C:\Windows\System\AwHBDKF.exe
  C:\Windows\System\AwHBDKF.exe
  2⤵
  PID:11724
- C:\Windows\System\RIixVzV.exe
  C:\Windows\System\RIixVzV.exe
  2⤵
  PID:12052
- C:\Windows\System\sPlDGiZ.exe
  C:\Windows\System\sPlDGiZ.exe
  2⤵
  PID:12160
- C:\Windows\System\hkOaGsL.exe
  C:\Windows\System\hkOaGsL.exe
  2⤵
  PID:12200
- C:\Windows\System\aPSmBLd.exe
  C:\Windows\System\aPSmBLd.exe
  2⤵
  PID:11092
- C:\Windows\System\wLtPwoT.exe
  C:\Windows\System\wLtPwoT.exe
  2⤵
  PID:4540
- C:\Windows\System\YTtHHTU.exe
  C:\Windows\System\YTtHHTU.exe
  2⤵
  PID:8880
- C:\Windows\System\siFAkvQ.exe
  C:\Windows\System\siFAkvQ.exe
  2⤵
  PID:12320
- C:\Windows\System\hbtwqyQ.exe
  C:\Windows\System\hbtwqyQ.exe
  2⤵
  PID:3488
- C:\Windows\System\oEdcxsL.exe
  C:\Windows\System\oEdcxsL.exe
  2⤵
  PID:1612
- C:\Windows\System\nzbejjs.exe
  C:\Windows\System\nzbejjs.exe
  2⤵
  PID:5328
- C:\Windows\System\wwgZzEB.exe
  C:\Windows\System\wwgZzEB.exe
  2⤵
  PID:12876
- C:\Windows\System\BAcLEhL.exe
  C:\Windows\System\BAcLEhL.exe
  2⤵
  PID:12900
- C:\Windows\System\mPymcPZ.exe
  C:\Windows\System\mPymcPZ.exe
  2⤵
  PID:4040
- C:\Windows\System\YHFOdep.exe
  C:\Windows\System\YHFOdep.exe
  2⤵
  PID:12240
- C:\Windows\System\NlrrBkQ.exe
  C:\Windows\System\NlrrBkQ.exe
  2⤵
  PID:11160
- C:\Windows\System\iqwnjyT.exe
  C:\Windows\System\iqwnjyT.exe
  2⤵
  PID:10360
- C:\Windows\System\NdYdRgI.exe
  C:\Windows\System\NdYdRgI.exe
  2⤵
  PID:12612
- C:\Windows\System\zSxJcfr.exe
  C:\Windows\System\zSxJcfr.exe
  2⤵
  PID:2528
- C:\Windows\System\bCcoWpX.exe
  C:\Windows\System\bCcoWpX.exe
  2⤵
  PID:13260
- C:\Windows\System\ZtAseWE.exe
  C:\Windows\System\ZtAseWE.exe
  2⤵
  PID:10584
- C:\Windows\System\xEdWQEZ.exe
  C:\Windows\System\xEdWQEZ.exe
  2⤵
  PID:10476
- C:\Windows\System\adLDTqb.exe
  C:\Windows\System\adLDTqb.exe
  2⤵
  PID:12768
- C:\Windows\System\updwhtu.exe
  C:\Windows\System\updwhtu.exe
  2⤵
  PID:12792
- C:\Windows\System\rMLUiEG.exe
  C:\Windows\System\rMLUiEG.exe
  2⤵
  PID:11992
- C:\Windows\System\lLnBsbm.exe
  C:\Windows\System\lLnBsbm.exe
  2⤵
  PID:12188
- C:\Windows\System\VovhDZI.exe
  C:\Windows\System\VovhDZI.exe
  2⤵
  PID:9356
- C:\Windows\System\lxBMbYR.exe
  C:\Windows\System\lxBMbYR.exe
  2⤵
  PID:13304
- C:\Windows\System\QyjiwTh.exe
  C:\Windows\System\QyjiwTh.exe
  2⤵
  PID:11680
- C:\Windows\System\WwzGUaU.exe
  C:\Windows\System\WwzGUaU.exe
  2⤵
  PID:12912
- C:\Windows\System\PToADfh.exe
  C:\Windows\System\PToADfh.exe
  2⤵
  PID:12936
- C:\Windows\System\sgnSvnb.exe
  C:\Windows\System\sgnSvnb.exe
  2⤵
  PID:13036
- C:\Windows\System\IFDopCz.exe
  C:\Windows\System\IFDopCz.exe
  2⤵
  PID:13068
- C:\Windows\System\wbNgiRJ.exe
  C:\Windows\System\wbNgiRJ.exe
  2⤵
  PID:13096
- C:\Windows\System\cEudIRE.exe
  C:\Windows\System\cEudIRE.exe
  2⤵
  PID:11036
- C:\Windows\System\aakKMFb.exe
  C:\Windows\System\aakKMFb.exe
  2⤵
  PID:12784
- C:\Windows\System\MYwqJzz.exe
  C:\Windows\System\MYwqJzz.exe
  2⤵
  PID:11428
- C:\Windows\System\abJeHHV.exe
  C:\Windows\System\abJeHHV.exe
  2⤵
  PID:13180
- C:\Windows\System\utJebKa.exe
  C:\Windows\System\utJebKa.exe
  2⤵
  PID:1212
- C:\Windows\System\ZjOkGbO.exe
  C:\Windows\System\ZjOkGbO.exe
  2⤵
  PID:452
- C:\Windows\System\TSYBVIl.exe
  C:\Windows\System\TSYBVIl.exe
  2⤵
  PID:3912
- C:\Windows\System\tIhUcUx.exe
  C:\Windows\System\tIhUcUx.exe
  2⤵
  PID:13336
- C:\Windows\System\cKmEBGh.exe
  C:\Windows\System\cKmEBGh.exe
  2⤵
  PID:13360
- C:\Windows\System\dTVqYzN.exe
  C:\Windows\System\dTVqYzN.exe
  2⤵
  PID:13380
- C:\Windows\System\DgwDYup.exe
  C:\Windows\System\DgwDYup.exe
  2⤵
  PID:13412
- C:\Windows\System\qmTPUZx.exe
  C:\Windows\System\qmTPUZx.exe
  2⤵
  PID:13428
- C:\Windows\System\iLNnyIb.exe
  C:\Windows\System\iLNnyIb.exe
  2⤵
  PID:13444
- C:\Windows\System\kiSLbzV.exe
  C:\Windows\System\kiSLbzV.exe
  2⤵
  PID:13460
- C:\Windows\System\deiYhSU.exe
  C:\Windows\System\deiYhSU.exe
  2⤵
  PID:13492
- C:\Windows\System\rSnTWIv.exe
  C:\Windows\System\rSnTWIv.exe
  2⤵
  PID:13516
- C:\Windows\System\qrdkCsx.exe
  C:\Windows\System\qrdkCsx.exe
  2⤵
  PID:13536
- C:\Windows\System\ZLULjeF.exe
  C:\Windows\System\ZLULjeF.exe
  2⤵
  PID:13556
- C:\Windows\System\sNlRjSE.exe
  C:\Windows\System\sNlRjSE.exe
  2⤵
  PID:13576
- C:\Windows\System\UFObBso.exe
  C:\Windows\System\UFObBso.exe
  2⤵
  PID:13600
- C:\Windows\System\RCRDRgC.exe
  C:\Windows\System\RCRDRgC.exe
  2⤵
  PID:13628
- C:\Windows\System\BIpfTMz.exe
  C:\Windows\System\BIpfTMz.exe
  2⤵
  PID:13648
- C:\Windows\System\kIkdoLd.exe
  C:\Windows\System\kIkdoLd.exe
  2⤵
  PID:13668
- C:\Windows\System\yVOQRqD.exe
  C:\Windows\System\yVOQRqD.exe
  2⤵
  PID:13692
- C:\Windows\System\dVIQsum.exe
  C:\Windows\System\dVIQsum.exe
  2⤵
  PID:13716
- C:\Windows\System\dfmDttn.exe
  C:\Windows\System\dfmDttn.exe
  2⤵
  PID:13740
- C:\Windows\System\sgPfkIG.exe
  C:\Windows\System\sgPfkIG.exe
  2⤵
  PID:13760
- C:\Windows\System\gyxKLnI.exe
  C:\Windows\System\gyxKLnI.exe
  2⤵
  PID:13776
- C:\Windows\System\pwWIKfW.exe
  C:\Windows\System\pwWIKfW.exe
  2⤵
  PID:13800
- C:\Windows\System\xVCfTac.exe
  C:\Windows\System\xVCfTac.exe
  2⤵
  PID:13824
- C:\Windows\System\mATCedY.exe
  C:\Windows\System\mATCedY.exe
  2⤵
  PID:13844
- C:\Windows\System\JlRmQPU.exe
  C:\Windows\System\JlRmQPU.exe
  2⤵
  PID:13872
- C:\Windows\System\IMKXApi.exe
  C:\Windows\System\IMKXApi.exe
  2⤵
  PID:13896
- C:\Windows\System\UJHIjUg.exe
  C:\Windows\System\UJHIjUg.exe
  2⤵
  PID:13916
- C:\Windows\System\xqWGyRc.exe
  C:\Windows\System\xqWGyRc.exe
  2⤵
  PID:13940
- C:\Windows\System\neQMgau.exe
  C:\Windows\System\neQMgau.exe
  2⤵
  PID:13964
- C:\Windows\System\uynhARD.exe
  C:\Windows\System\uynhARD.exe
  2⤵
  PID:13988
- C:\Windows\System\AUNHZEM.exe
  C:\Windows\System\AUNHZEM.exe
  2⤵
  PID:14004
- C:\Windows\System\qhDlSnA.exe
  C:\Windows\System\qhDlSnA.exe
  2⤵
  PID:14020
- C:\Windows\System\zdrIUyw.exe
  C:\Windows\System\zdrIUyw.exe
  2⤵
  PID:14056
- C:\Windows\System\jjOiCKS.exe
  C:\Windows\System\jjOiCKS.exe
  2⤵
  PID:14084
- C:\Windows\System\LIRdcmZ.exe
  C:\Windows\System\LIRdcmZ.exe
  2⤵
  PID:11156
- C:\Windows\System\nnhoLOL.exe
  C:\Windows\System\nnhoLOL.exe
  2⤵
  PID:9116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CbRnziQ.exe

Filesize
1.6MB

MD5
abf0828ecd52a21af75ecca93bf48c6b

SHA1
bb9d10971e5b43fa41c059bc43c44f15b7a9f363

SHA256
5b9274618f65bafa5cea17c3dc4a4d6e32c751a3119bf6b335c33d35272bd3fc

SHA512
3a1616837a765bd99cf3e2d7d7817f12d6a2686cecae3a47045d8b604f29caf4eee653c307bbf7fcdc3e5feb0559e155cbf7616df720a1cfea91a89fa34e0bc2

Download Submit
C:\Windows\System\FBPCeTU.exe

Filesize
1.6MB

MD5
4fe618e10c6f50674e997cf79b1fd470

SHA1
3ddcc5508815bcb7dd835eee749f96d04a1127ab

SHA256
ac4524836cf20655f663aa16ee8d0f2770cc9f4fec34bedb235ddea51e2591cf

SHA512
d51ab11eb81aa9b45d902dd821f40b1207933326b627bf6f54aadb3801308557dc523701f7ce2da3a75b21e4ccf22031bbc656d7a8deeaa3305ab32be7c83747

Download Submit
C:\Windows\System\FiJdsxr.exe

Filesize
1.6MB

MD5
ed293718f7db2f85cdf010d8698a93f5

SHA1
0757fffa5daf50f88b219bf751f2bf6d0130926c

SHA256
8a507adfbdcfb99a7a0d98d000f629c66c6c3cb5cd85457cdaadf135a9457f48

SHA512
17ad5d1baafa29a28c1c35fbcdc51f2be94097f48a6704e1a9863d580f1b0d162e83a0122731cc97e51c2e9ef87f41ffe4b7da52585b8e063bb9bf266083ce06

Download Submit
C:\Windows\System\FkFjOCd.exe

Filesize
1.6MB

MD5
512385c54b4708f99cebea553e57c885

SHA1
cdc8a9c9b91dafe9cf0fed264bbdc2904f963f9b

SHA256
b28e67b2355ce48af5b4b99768fb027ef2ec44ecc6cfa14f36f53518a240b326

SHA512
d51ed216faa659b288703d6b028d40e6e981336d2ed5cd8f0a331570a2bf6409390531057bcd17e796ea3aba5a17fe9cd7bab5e166755f1012554a1778685a7d

Download Submit
C:\Windows\System\GMkOJBL.exe

Filesize
1.6MB

MD5
25bab3bf630bc397e28e18a452fb03ca

SHA1
aee4f5476561294477c909a6264a430a92685c86

SHA256
60350729395ebe96cbe34e3f1fc483a823108748f45b7254f091b151a2cad5d8

SHA512
9e530b29c8139fa7f1e9e38958fd1ba205dedb8b32af583a80d84b97d50226e8fa15224f1fe614267738e2a96f89382386e85bdb88b819532a5bb04aa4642762

Download Submit
C:\Windows\System\HNtnlkX.exe

Filesize
1.6MB

MD5
421fd7257a370cc45dea15fa90732f04

SHA1
63aa9fc6799332532ded4d95ff1e1703b9c73794

SHA256
1decefa04bd09b900298bcd57219b8543f22d5dc24b3ee29355d8b803f4beed5

SHA512
8074363bcaf5521c3294215f549d9b7aea0e0e1209e3e22dcd9ccb576fc0646c9cc25e036f35209b3b208c49a5df929055e168c78e51d188ae2168748003ee30

Download Submit
C:\Windows\System\JboZjBb.exe

Filesize
1.6MB

MD5
d853cd72382786e10574992e8bb6802c

SHA1
804960384886f7aa58b01a113e7822b31a4cffe6

SHA256
6ab9f3e2e766a2adeeba90696b44a8b3e41b363fdb259ca8b048a732b43e901a

SHA512
aabb16374fedd5ea7afea84b66b97c9df2b85dd275fe62249769ec59dde1a03b5c67cf29a64a5404e9d301f3843b46eb2f242a46c082840b350eb44b5e343f20

Download Submit
C:\Windows\System\KOkUYCk.exe

Filesize
1.6MB

MD5
7eedf43fd1a63ccdabc5f6046f157c9d

SHA1
d89feae972e973defad341a57dbaaf1d04d1574d

SHA256
843660789fed7fdf2e2257eeab6e01d1205d559a28c2b0b718503364fa45e517

SHA512
048491ad80f526c35c47f14763fd91f17ff9e4b869e5c501df7349f9e88fd715bfc051609addfc79d5b527f53754e81d004ef0c62a5656da55763b9dd2900711

Download Submit
C:\Windows\System\KZZnGxP.exe

Filesize
1.6MB

MD5
4ec51c0b0bd3a8584e33dba949bdf35c

SHA1
9b72d66d8c76a5003a66ee602ea26d4f51f2bb5a

SHA256
d9ec5900057464971526bb1183ae5232b6b6d448b7bc607cafbe3dde44fd030c

SHA512
01860cda72efdeb0e0c7e267e74f963b38eddec2380db2ed9c46e68c55778267edbd4ca89b13a91cdedb90eb0908ebacbcbffb96aea30807c7a7ee8b43b85561

Download Submit
C:\Windows\System\LDbznfp.exe

Filesize
1.6MB

MD5
85b4f896f22543bf9810b0d0e54e9913

SHA1
a190d0397899bd85cf18e82a7c4457cf7137f57d

SHA256
e035fb386b9c26c021cddd723f2cb9fb4ee0314ea649ff902b73184f1945d9c2

SHA512
70d013f4a0fdd6eaa4ab6dd855ec8325ccc8cd4c5172478fa8381af1e36e8250a395d34026cfc8f6bb7c9a5ee03cc0e6256c4c3a7fc394651122651c1bf1b3eb

Download Submit
C:\Windows\System\MyDgKmt.exe

Filesize
1.6MB

MD5
e969127d3cd5f5054bea589598096811

SHA1
c20d190194088f8e31d93e101e192d96c5a5109a

SHA256
f2418241aebd8087ca913eb3b9bf43e6d0a6feaeea098043cb8ea7e8469c0c0e

SHA512
81fd7179ef7b038cda38eb3d1350510700515ef62aaec5a84a0b7be3c0e89e96c4cc4d07cf83b9fffe8f84e3ed33b5776b94bfecc7b71bfed846bcefd551b1f1

Download Submit
C:\Windows\System\MyUUjUE.exe

Filesize
1.6MB

MD5
d4e802609fe10e329600ffca2f3f75ce

SHA1
82173cc1ea0be27bff087cfe037a14fde2d91f71

SHA256
e3eaefe201885b0591c5598dfd59b41a55b80c4e7572123d6685c5ce2c114d8b

SHA512
34c0a93f89f18347d8e8fa09b19ea4c66a9724c57f3c511efee79866db63d80922953c6ffcaf6349636ac9681ec0c31b5e6a7619883bd80bfd9dfb5dfb36d2ee

Download Submit
C:\Windows\System\NUmvHfU.exe

Filesize
1.6MB

MD5
b036e73159403a5b511da3c621bd88cd

SHA1
78d5e18f3d715d8751dc74dd8779201e69980872

SHA256
0e05f7943cd5e0d88c4aec2a52e8230d2f8ba76dbd1e4e96d48951fda6c57925

SHA512
5bc26eb8bd7dac2ddde7e502fad1d4e8fd38a9a8b775880158d88f33d1c0c6c08e3d98a0bdf571b558364dbadc7734152ee1e48e3ea165d8e024847cd3f5cc97

Download Submit
C:\Windows\System\OPMNyxR.exe

Filesize
1.6MB

MD5
c119c73c868429d17ebb4c98cfcdad60

SHA1
01eccb62f0e9e0c44a5a15bb0788af582eefd873

SHA256
36f4d9c5265d8b8182566a199e71bdf340967b85ac69bbba95d88f9b0ce6410f

SHA512
383e4e93d9e289092c7092573544da8796245a596b10c6ec5ba764b3dd2668cd333bf4205884c8928d6c64c84eff375faba12e51103e07d07514cdd3c66f670c

Download Submit
C:\Windows\System\OmaqHkr.exe

Filesize
1.6MB

MD5
517e1d5a4e60c9c1574103786ad3d27e

SHA1
b488ddc053cec765418b789c20de786a53c5f2ff

SHA256
11695fb528acddcedd22e3d91a1c780ae966ab3673a1a903239ebbca679fe9cb

SHA512
3b0acc4b5cd473da0ebc7d075d29c7cc1228de411fab6bdd58d28207f20f9e3eba7d66e84ca0dff9354af7c9da6ff7871941f70e2d5a54e43f3bbe77aee1bf85

Download Submit
C:\Windows\System\PfDMCud.exe

Filesize
1.6MB

MD5
a8e3bf954c589aca7e80f97a31273235

SHA1
c176c4979adc63efe96a666a8086671180c366f7

SHA256
32cf3f03cceba0cb9d2d0cf16dee5d127a1be2f687e8267bd916880806db1428

SHA512
4ef7d29aae49a3d6cb11e5094626239e9a4ecdcbb46925290a76a80a5d22d5f0215ef0bee0f96b2654494ceecbdd889704a44849ba5cdf3842ff0efd4fc9406b

Download Submit
C:\Windows\System\QqbycTs.exe

Filesize
1.6MB

MD5
50d5926818480629aad328443ce63a6a

SHA1
6509c2abe6b933df7edf975bbe81ac947b8a4236

SHA256
ed3b4d5c3fe3b21f98547e90c13b0fde619cc0057205ec122e1b7fb8517d79fa

SHA512
a348e7c5051a5bded0fd519c01c23d4d17b3152768eb1eb139e724c9f641af5b00ba97465ed2f45e56c1cd569f4c3570512eff279a3f508843fe2476d45fcbb7

Download Submit
C:\Windows\System\QraxrnE.exe

Filesize
1.6MB

MD5
da1ec4b027833e94ad87929e64400f9f

SHA1
4e9857aeba7bb2a809e50de2f6f2eb34efffa7c6

SHA256
171582aa0f0aabc78206f978b5b38f0438aace905ef13682ae5ba1387d82fb12

SHA512
c68c6675cc5782826eb5875bf1577e0c1b56e321a62a9b7689d086f6a8f047dc0cc9f9d118b6bd8b848c201dbbbd66cba72e0ed33ffd3c714ba6e6017403fe54

Download Submit
C:\Windows\System\SeuCSvK.exe

Filesize
1.6MB

MD5
dc0c0aaf27c4ca3bd0bcb2ec68e0098d

SHA1
c76d66d3aaaab8115bb5f4d507debb676d4d702f

SHA256
6e3434c5b56d61cef251dd77162e6f105f4af128a40652f7b326dda4dd9edcc6

SHA512
434035ae87f5644eb5e3ba532be9ee7ffe5c47f574c5f1c270ad4fe7e33a2a1a6a8b2df1d55ef1850a34ecfba77323949e9654883d864d3197545c2d6ec38a3c

Download Submit
C:\Windows\System\VepGrxu.exe

Filesize
1.6MB

MD5
59e361147a470264567351432b86db47

SHA1
667a818848f31f68bc7c04b10326f2bbbe34b7bc

SHA256
d1fefe9507637482f91c4edd9316f2e6d9aa50997d48c6801792be8443742066

SHA512
c34af31b9fd286a518e6d9ef2764e71bedc440bc8298b63e7f32e91b4dbd72c81f6d434cf98962d4dca9693dc4825f6d08288edc60353952a5151ed490515e40

Download Submit
C:\Windows\System\WWQBxFJ.exe

Filesize
1.6MB

MD5
6f8c646fdf954b349095c3ab29a25837

SHA1
c6f386c515c155ebef94ce46a51818db10519384

SHA256
9ed639609bef105b8cd45c2ebf966fd87306219e31fb25a4aa0ce117c7fd82c7

SHA512
1ac9e22fd8e3551d85d219fbc71147979911fa432d2477f09a0a7cba0aae177033eccbea63918d395158c18b79025de2d8d990799ab552bac4789b4ee2af6199

Download Submit
C:\Windows\System\WrjLcPG.exe

Filesize
1.6MB

MD5
b0aaef94cad7591ddbd337563c31dc7c

SHA1
4b6a0b3fd6df2d7b798d00f1da4f39b9ca9b43bb

SHA256
10e092904c90631ded30404a62a71421a972b6fb6596e6f36fabed7b4c1c9585

SHA512
f6738682c3807862854ddc3e9d68a44e457226cc20da96ef3e967b1ff61e716204738166b9f7985384cfca4a622a8c8b3a342fc27de56307d6cd4f6a85db262a

Download Submit
C:\Windows\System\YAHanDO.exe

Filesize
1.6MB

MD5
5337af2017a27673e8a3858dd259f926

SHA1
0d998663776138078e91d5b56ee8d250810d4316

SHA256
fc3f004e3864a4a65a4ad5c0b2861b6b5f88b99ec61bde45ff7ab42766a2b08a

SHA512
d90f2fd96ec6971006b48475d8e12b22b2d5c8a711f5a9b51cec1e3e11abcc971b14cacc2413ebae0015fb150f2229aaf21184f0798bacffebba933c49c732b8

Download Submit
C:\Windows\System\ZlRdZeM.exe

Filesize
1.6MB

MD5
8751a880294708843c87c413df00d8dc

SHA1
533800a1a5b74810479f5bb6aad4f6604ef2359d

SHA256
e40ac30a99eba49bf4d853ba2c64dd13f412e43a06fd4c5dab8f7fd8f72eb019

SHA512
574fd39077eb48bb63f3856599672c40b67d06430b3e27ff2ff3de80bbcaee79adfcdd8ea64fce52f8687c82995d1051c3622526e3f757845baa42a9192ab7ae

Download Submit
C:\Windows\System\ZoqLiOY.exe

Filesize
1.6MB

MD5
37b4f941d765623e73e32687090b3bb9

SHA1
b5c9d8c375fd23fe71ca2bd3e08de4487dce0f0a

SHA256
c8542500ffd48fa8ce91b78d88df694278719aaae9c1162b91141a9c2bfc236b

SHA512
976056327023eee2874a5db9e5d690254eab7af98bc27274fe0dd53d586e99ae8e4cfcf0141c2aa1ebf11f294c918a8370cc6d2d95a5efb14ae2c68e46ea8aee

Download Submit
C:\Windows\System\ctdHjAj.exe

Filesize
1.6MB

MD5
29d85d4d1cb8e532ee4541d9cdc68297

SHA1
9cd2acad7fe06cfaad972802a8078868f83df7a5

SHA256
ba8f4b172fde920a190edfa0149ccbdcfe00a3bd91210e3ba8d939f4320c60ed

SHA512
688b536801f90de659796f87923f5963e905f258c7a2b03768711359e533f71d92ade64763cbbcc39f40afc4b76635f7349f10b77a47b78f8c79f1a2630099b7

Download Submit
C:\Windows\System\eLJqMSJ.exe

Filesize
1.6MB

MD5
f9d77454826b444fc1b329995adfc95a

SHA1
1df9136b26eecf01e01741528aca831874cb9c99

SHA256
ae81a4b51850b0e39d6aa880d2caba5dffa4b5b58fb954fee8ffecfadc7ddee1

SHA512
19d370e0e9a070b640b5b1c7b1666e24d2fd9e6ae815dac8733cf7d76ac7bb58636d01672fe183efac201be6e78163e5492d0940ea7d702be4cd7b28007ced88

Download Submit
C:\Windows\System\fAIgiUM.exe

Filesize
1.6MB

MD5
32bc4d0e4cbbd368a58f1b10a35ee509

SHA1
f384e90b366c0a83a0e9f842afdab950c12a0caf

SHA256
281b9c042b46f18d6510586e7e4676449dbe8c4bf0717993d16b171fd1927f21

SHA512
b87e4c0dc61f7aa03899a06489450291d39407eb2d0aee1cfca27a280bb05926f9cb3bc522b02cb5ff5f07bc7914d58b011f5dc030b371ea7a690f9c3dc01bb2

Download Submit
C:\Windows\System\fskjySH.exe

Filesize
1.6MB

MD5
04fd9bfd46adea610beb3843dc7acd54

SHA1
ef2cec8acec1ca61c5cd8c4bbdd10aa397b7702e

SHA256
35bc88816f2212cb7e13ab831dbcb04e3b4ec12312185cafcd86c89aefd13773

SHA512
1b431e59ea86255c53eb735f8700575aeb99fb48ddb2ab6cb8f5cf8add3ea03b1af6988724b305a94b79b7501953a21cbf1eb1b5bdc727f5414897a8f09eab76

Download Submit
C:\Windows\System\fzDvgTI.exe

Filesize
1.6MB

MD5
fc0873242f56bf3f90f46cc5a0718bf3

SHA1
de84c11acdb59d8b50a49d131603407ef9ae016d

SHA256
07b0489ba067640dbe8dac898939b6877abacb5127697b0b18d5f2dfd57901d9

SHA512
cb04576329ae889407ab0801e0260b81340e768061769591607362473a6b122f202a3e9770bbc2cebf0615741f951fce18daf8c07d669a2a8c35fb285d1a5c87

Download Submit
C:\Windows\System\immFFxG.exe

Filesize
1.6MB

MD5
da1c3398f5e1bdb55066c1abfc42d611

SHA1
b19224cbc7c4ea3956323376a43ba0eb5570f300

SHA256
c0620139967b0cfe8b31e7d674c2ccf6351daf2fa2fc3c93e6ec87e9f417b37c

SHA512
3c7d6f524a9585a33315bac49cf0a0abf9c3cbeb795b70b1d89eb9abadaa7a25d6f99a71e3c917aa1ff5151d5c5e764597c3ab2d48d51150db8598c3ad65b45b

Download Submit
C:\Windows\System\kpJyPEN.exe

Filesize
1.6MB

MD5
d7b9aecd41361d9e40fef04681d51687

SHA1
eaf07e640c3a866e8c3d1276ef9a5d0d988b4d31

SHA256
5747264afd03186d88b54382802851888b26bcf01dbc278f92a62eb18178f826

SHA512
b3bddd6a3b97847ebc2ed9da967e5eba5c0cdb9ad9552431578260f50019d0db1267bed6128e8cafd98ecd369fa64da9e027f127722e5fcad106c63ee66c208e

Download Submit
C:\Windows\System\mDAMNRb.exe

Filesize
1.6MB

MD5
e7034b79f46c8c4022014eed350e76a6

SHA1
3f8649f6dc94eff22969151b8847c465e37afaad

SHA256
a81104d371ac85829d3bca48ff18dc119b83e5aea0a4edd9842039cc1b9b0931

SHA512
a46f1b7967f3e1cd7819fdf61015f29ee09c5b6062a2376d1653d3ea30f27a25053a261f2ba380b1ca7aa472b7680feb5157c79df94c2f7ebb397dbf37e5f307

Download Submit
C:\Windows\System\nQlBmOq.exe

Filesize
1.6MB

MD5
34d5a3c0b6624781c49de2bb0c8a97c9

SHA1
a30ccc349259da9155208d9c16a0d38078746ff1

SHA256
549793838745df3cebf632f433b725fecf04cd6613c346d4ce3d72dc5cf69bcd

SHA512
e30467b3a559a842c3d7f2f31eea7b5013dc0870dc693b3f63ead7910fa662badb80d7b0983753510780503278c0ca58b1d0c5a2c6e43ccbbfb1d1854a671246

Download Submit
C:\Windows\System\pLpdmKB.exe

Filesize
1.6MB

MD5
993d29b92494d9a0c06132dc4b79afad

SHA1
dfd259676d326b724147a7ec7c09b87adff935fe

SHA256
a50a6272837427ce7621f144c8a943f19a5ab59e48d7edfb42294e7e92009e5b

SHA512
b3b81719972787ebb7f83e28d00e9ce16f0381e7d33be28c55ede1dab4d96f2fb6a5f58cdede14d294b4daef742769eafdb47d64ab15b320890d968296c4bb7b

Download Submit
C:\Windows\System\qLTTKCZ.exe

Filesize
1.6MB

MD5
d0e6ab91573f2ea7e478c5fa61a6e08d

SHA1
6565cae0b3dc6d3d051b21b7e2ee737919a79b00

SHA256
620dc6f9ea9ff11cebeee403543187ac9f07ce07c007e0663b003800fccd6f34

SHA512
fbbd2bd031f7923245068710eab3894f05593dc33203ab239d0207803cc5599dc4e3e5754a28b1d0521dbaa6a05f21b701611f2032c11b2e24e260ff0fdcbe81

Download Submit
C:\Windows\System\rUkUAuK.exe

Filesize
1.6MB

MD5
e941fd866bb153e67640f6087eaa4f26

SHA1
bfcb606c5d5ccdf3258aea08ea0d601a9b0159b1

SHA256
939618f1986ed1ec6b8f6e3234988540f0796b644d63da320aceaafe471859dd

SHA512
7dd6942dd21264c5b9ed4591b26624d366d8b7596d40343c0f7947293312a9cbd6307379776da7d6ccc5056a8c7cd796202da39daaa1ab2ea1572c4860023d21

Download Submit
C:\Windows\System\uZMaqfR.exe

Filesize
1.6MB

MD5
2b3bdacd19e77140bc68108a8def689f

SHA1
407bae6432fa0fcb9bf9b20c8bf13d89397b8d61

SHA256
8d9dd5d340219ae0bbc19df8dbfeeb0d0f431a1974882502ccac0323cd6080f1

SHA512
10864a39fe088f70818afbfac49edb138e7c7490730722bd3635b5e52f93c67ddb7feca2747480989b843ffcf13c4df6ecf82f76c7c65aec09372d7f6a574548

Download Submit
C:\Windows\System\zzwYVCQ.exe

Filesize
1.6MB

MD5
add3a8431da81635791bae2a3f3cb4c0

SHA1
80739e67eb48d8e18b972354dbf6ad4af69f3122

SHA256
61150ed5c86cb1ff38f2d23750e0abdf3d1864dc5614b9de2859e43a256656dd

SHA512
77fababbbc20cbcb03cb0e3f1465ff2b3f549c3d165f58c9fd8c7988101d1ab5ede10371cba11368554c2fd3b84a6bdeb1f8722b6d68acf4e8d84c5521e7bd87

Download Submit
memory/408-241-0x00007FF623B00000-0x00007FF623E51000-memory.dmp

Filesize
3.3MB

Download
memory/408-2175-0x00007FF623B00000-0x00007FF623E51000-memory.dmp

Filesize
3.3MB

Download
memory/468-2149-0x00007FF7511A0000-0x00007FF7514F1000-memory.dmp

Filesize
3.3MB

Download
memory/468-53-0x00007FF7511A0000-0x00007FF7514F1000-memory.dmp

Filesize
3.3MB

Download
memory/468-2165-0x00007FF7511A0000-0x00007FF7514F1000-memory.dmp

Filesize
3.3MB

Download
memory/536-2208-0x00007FF637920000-0x00007FF637C71000-memory.dmp

Filesize
3.3MB

Download
memory/536-564-0x00007FF637920000-0x00007FF637C71000-memory.dmp

Filesize
3.3MB

Download
memory/644-2178-0x00007FF677D90000-0x00007FF6780E1000-memory.dmp

Filesize
3.3MB

Download
memory/644-116-0x00007FF677D90000-0x00007FF6780E1000-memory.dmp

Filesize
3.3MB

Download
memory/644-2151-0x00007FF677D90000-0x00007FF6780E1000-memory.dmp

Filesize
3.3MB

Download
memory/648-428-0x00007FF6E9280000-0x00007FF6E95D1000-memory.dmp

Filesize
3.3MB

Download
memory/648-2199-0x00007FF6E9280000-0x00007FF6E95D1000-memory.dmp

Filesize
3.3MB

Download
memory/764-2206-0x00007FF79CFC0000-0x00007FF79D311000-memory.dmp

Filesize
3.3MB

Download
memory/764-563-0x00007FF79CFC0000-0x00007FF79D311000-memory.dmp

Filesize
3.3MB

Download
memory/916-2047-0x00007FF66BFD0000-0x00007FF66C321000-memory.dmp

Filesize
3.3MB

Download
memory/916-0-0x00007FF66BFD0000-0x00007FF66C321000-memory.dmp

Filesize
3.3MB

Download
memory/916-1-0x0000025D5D1D0000-0x0000025D5D1E0000-memory.dmp

Filesize
64KB

Download
memory/1000-2146-0x00007FF672450000-0x00007FF6727A1000-memory.dmp

Filesize
3.3MB

Download
memory/1000-9-0x00007FF672450000-0x00007FF6727A1000-memory.dmp

Filesize
3.3MB

Download
memory/1000-2153-0x00007FF672450000-0x00007FF6727A1000-memory.dmp

Filesize
3.3MB

Download
memory/1260-270-0x00007FF71F700000-0x00007FF71FA51000-memory.dmp

Filesize
3.3MB

Download
memory/1260-2194-0x00007FF71F700000-0x00007FF71FA51000-memory.dmp

Filesize
3.3MB

Download
memory/1456-350-0x00007FF61A510000-0x00007FF61A861000-memory.dmp

Filesize
3.3MB

Download
memory/1456-2172-0x00007FF61A510000-0x00007FF61A861000-memory.dmp

Filesize
3.3MB

Download
memory/1628-119-0x00007FF7DC070000-0x00007FF7DC3C1000-memory.dmp

Filesize
3.3MB

Download
memory/1628-2160-0x00007FF7DC070000-0x00007FF7DC3C1000-memory.dmp

Filesize
3.3MB

Download
memory/1720-2147-0x00007FF7A0CC0000-0x00007FF7A1011000-memory.dmp

Filesize
3.3MB

Download
memory/1720-14-0x00007FF7A0CC0000-0x00007FF7A1011000-memory.dmp

Filesize
3.3MB

Download
memory/1720-2155-0x00007FF7A0CC0000-0x00007FF7A1011000-memory.dmp

Filesize
3.3MB

Download
memory/2084-2190-0x00007FF77AE40000-0x00007FF77B191000-memory.dmp

Filesize
3.3MB

Download
memory/2084-222-0x00007FF77AE40000-0x00007FF77B191000-memory.dmp

Filesize
3.3MB

Download
memory/2220-2202-0x00007FF767340000-0x00007FF767691000-memory.dmp

Filesize
3.3MB

Download
memory/2220-441-0x00007FF767340000-0x00007FF767691000-memory.dmp

Filesize
3.3MB

Download
memory/2820-2204-0x00007FF69D3A0000-0x00007FF69D6F1000-memory.dmp

Filesize
3.3MB

Download
memory/2820-562-0x00007FF69D3A0000-0x00007FF69D6F1000-memory.dmp

Filesize
3.3MB

Download
memory/3048-520-0x00007FF6088F0000-0x00007FF608C41000-memory.dmp

Filesize
3.3MB

Download
memory/3048-2173-0x00007FF6088F0000-0x00007FF608C41000-memory.dmp

Filesize
3.3MB

Download
memory/3360-2225-0x00007FF693B10000-0x00007FF693E61000-memory.dmp

Filesize
3.3MB

Download
memory/3360-566-0x00007FF693B10000-0x00007FF693E61000-memory.dmp

Filesize
3.3MB

Download
memory/3576-561-0x00007FF7E1B60000-0x00007FF7E1EB1000-memory.dmp

Filesize
3.3MB

Download
memory/3576-2223-0x00007FF7E1B60000-0x00007FF7E1EB1000-memory.dmp

Filesize
3.3MB

Download
memory/3644-379-0x00007FF650CA0000-0x00007FF650FF1000-memory.dmp

Filesize
3.3MB

Download
memory/3644-2189-0x00007FF650CA0000-0x00007FF650FF1000-memory.dmp

Filesize
3.3MB

Download
memory/3780-2157-0x00007FF73F2B0000-0x00007FF73F601000-memory.dmp

Filesize
3.3MB

Download
memory/3780-2148-0x00007FF73F2B0000-0x00007FF73F601000-memory.dmp

Filesize
3.3MB

Download
memory/3780-27-0x00007FF73F2B0000-0x00007FF73F601000-memory.dmp

Filesize
3.3MB

Download
memory/3896-351-0x00007FF655330000-0x00007FF655681000-memory.dmp

Filesize
3.3MB

Download
memory/3896-2170-0x00007FF655330000-0x00007FF655681000-memory.dmp

Filesize
3.3MB

Download
memory/3952-2187-0x00007FF72B7A0000-0x00007FF72BAF1000-memory.dmp

Filesize
3.3MB

Download
memory/3952-570-0x00007FF72B7A0000-0x00007FF72BAF1000-memory.dmp

Filesize
3.3MB

Download
memory/3968-560-0x00007FF7BDD00000-0x00007FF7BE051000-memory.dmp

Filesize
3.3MB

Download
memory/3968-2196-0x00007FF7BDD00000-0x00007FF7BE051000-memory.dmp

Filesize
3.3MB

Download
memory/4252-158-0x00007FF756580000-0x00007FF7568D1000-memory.dmp

Filesize
3.3MB

Download
memory/4252-2184-0x00007FF756580000-0x00007FF7568D1000-memory.dmp

Filesize
3.3MB

Download
memory/4384-2192-0x00007FF6EB750000-0x00007FF6EBAA1000-memory.dmp

Filesize
3.3MB

Download
memory/4384-565-0x00007FF6EB750000-0x00007FF6EBAA1000-memory.dmp

Filesize
3.3MB

Download
memory/4552-2150-0x00007FF6FDD20000-0x00007FF6FE071000-memory.dmp

Filesize
3.3MB

Download
memory/4552-82-0x00007FF6FDD20000-0x00007FF6FE071000-memory.dmp

Filesize
3.3MB

Download
memory/4552-2163-0x00007FF6FDD20000-0x00007FF6FE071000-memory.dmp

Filesize
3.3MB

Download
memory/4748-569-0x00007FF75F640000-0x00007FF75F991000-memory.dmp

Filesize
3.3MB

Download
memory/4748-2186-0x00007FF75F640000-0x00007FF75F991000-memory.dmp

Filesize
3.3MB

Download
memory/4792-2161-0x00007FF695AF0000-0x00007FF695E41000-memory.dmp

Filesize
3.3MB

Download
memory/4792-567-0x00007FF695AF0000-0x00007FF695E41000-memory.dmp

Filesize
3.3MB

Download
memory/4864-2168-0x00007FF6ACE00000-0x00007FF6AD151000-memory.dmp

Filesize
3.3MB

Download
memory/4864-242-0x00007FF6ACE00000-0x00007FF6AD151000-memory.dmp

Filesize
3.3MB

Download
memory/4932-2180-0x00007FF6FD470000-0x00007FF6FD7C1000-memory.dmp

Filesize
3.3MB

Download
memory/4932-568-0x00007FF6FD470000-0x00007FF6FD7C1000-memory.dmp

Filesize
3.3MB

Download