xmrig | d3efdae11ff03f09b1d0f065eabd79ec9ab0e8265d44fd0ae075a3b8b9dee4b1

Analysis

max time kernel
63s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e7f310651dba0218fa79b694c765dd0N.exe
Size

2.6MB
MD5

8e7f310651dba0218fa79b694c765dd0
SHA1

1d4ab2e5996dcaa552b09bd1eecf3c7d9ae41397
SHA256

d3efdae11ff03f09b1d0f065eabd79ec9ab0e8265d44fd0ae075a3b8b9dee4b1
SHA512

39cb334367bfe8f781a35f139a1e706ee750880132ae01a0815da3524bbd93c562714dc515cfa656e92b3ae21669f178f16e4ce9f763f48cb8640848384ad364
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoTzD7nh:oemTLkNdfE0pZrV56utgpPFop

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4580-0-0x00007FF670560000-0x00007FF6708B4000-memory.dmp	xmrig
behavioral2/files/0x000900000002346e-5.dat	xmrig
behavioral2/memory/5004-6-0x00007FF731460000-0x00007FF7317B4000-memory.dmp	xmrig
behavioral2/files/0x00080000000234c2-9.dat	xmrig
behavioral2/memory/868-14-0x00007FF6588A0000-0x00007FF658BF4000-memory.dmp	xmrig
behavioral2/files/0x00070000000234c3-8.dat	xmrig
behavioral2/files/0x000b0000000234c0-23.dat	xmrig
behavioral2/memory/4928-22-0x00007FF6D6410000-0x00007FF6D6764000-memory.dmp	xmrig
behavioral2/memory/4784-26-0x00007FF764480000-0x00007FF7647D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000234c4-29.dat	xmrig
behavioral2/files/0x00070000000234c5-35.dat	xmrig
behavioral2/files/0x00070000000234c7-44.dat	xmrig
behavioral2/files/0x00070000000234c8-49.dat	xmrig
behavioral2/files/0x00070000000234ca-63.dat	xmrig
behavioral2/files/0x00070000000234cc-69.dat	xmrig
behavioral2/files/0x00070000000234cd-78.dat	xmrig
behavioral2/files/0x00070000000234d0-89.dat	xmrig
behavioral2/files/0x00070000000234d5-112.dat	xmrig
behavioral2/files/0x00070000000234d6-123.dat	xmrig
behavioral2/files/0x00070000000234d9-138.dat	xmrig
behavioral2/files/0x00070000000234dc-152.dat	xmrig
behavioral2/files/0x00070000000234e0-167.dat	xmrig
behavioral2/memory/3004-566-0x00007FF6A6840000-0x00007FF6A6B94000-memory.dmp	xmrig
behavioral2/memory/1828-577-0x00007FF67CB80000-0x00007FF67CED4000-memory.dmp	xmrig
behavioral2/memory/1572-593-0x00007FF7C6490000-0x00007FF7C67E4000-memory.dmp	xmrig
behavioral2/memory/220-590-0x00007FF7FCD10000-0x00007FF7FD064000-memory.dmp	xmrig
behavioral2/memory/1948-599-0x00007FF7032A0000-0x00007FF7035F4000-memory.dmp	xmrig
behavioral2/memory/228-586-0x00007FF6C0F70000-0x00007FF6C12C4000-memory.dmp	xmrig
behavioral2/memory/4360-582-0x00007FF7CBF30000-0x00007FF7CC284000-memory.dmp	xmrig
behavioral2/memory/2704-570-0x00007FF761870000-0x00007FF761BC4000-memory.dmp	xmrig
behavioral2/memory/2996-556-0x00007FF768D50000-0x00007FF7690A4000-memory.dmp	xmrig
behavioral2/memory/4680-552-0x00007FF73BD50000-0x00007FF73C0A4000-memory.dmp	xmrig
behavioral2/memory/3652-544-0x00007FF6DF550000-0x00007FF6DF8A4000-memory.dmp	xmrig
behavioral2/memory/1236-538-0x00007FF6FDD80000-0x00007FF6FE0D4000-memory.dmp	xmrig
behavioral2/memory/4804-535-0x00007FF7831E0000-0x00007FF783534000-memory.dmp	xmrig
behavioral2/memory/452-530-0x00007FF7C6F40000-0x00007FF7C7294000-memory.dmp	xmrig
behavioral2/memory/3852-606-0x00007FF730D80000-0x00007FF7310D4000-memory.dmp	xmrig
behavioral2/memory/812-609-0x00007FF7F7A40000-0x00007FF7F7D94000-memory.dmp	xmrig
behavioral2/memory/4484-615-0x00007FF643EB0000-0x00007FF644204000-memory.dmp	xmrig
behavioral2/memory/3476-641-0x00007FF704950000-0x00007FF704CA4000-memory.dmp	xmrig
behavioral2/memory/1380-650-0x00007FF791FB0000-0x00007FF792304000-memory.dmp	xmrig
behavioral2/memory/3424-666-0x00007FF6BAC10000-0x00007FF6BAF64000-memory.dmp	xmrig
behavioral2/memory/4272-659-0x00007FF6EC320000-0x00007FF6EC674000-memory.dmp	xmrig
behavioral2/memory/3000-656-0x00007FF65EC00000-0x00007FF65EF54000-memory.dmp	xmrig
behavioral2/memory/4440-635-0x00007FF7A8AF0000-0x00007FF7A8E44000-memory.dmp	xmrig
behavioral2/memory/4468-633-0x00007FF76BE10000-0x00007FF76C164000-memory.dmp	xmrig
behavioral2/memory/4616-622-0x00007FF6B6440000-0x00007FF6B6794000-memory.dmp	xmrig
behavioral2/files/0x00070000000234df-164.dat	xmrig
behavioral2/files/0x00070000000234de-162.dat	xmrig
behavioral2/files/0x00070000000234dd-158.dat	xmrig
behavioral2/files/0x00070000000234db-148.dat	xmrig
behavioral2/files/0x00070000000234da-140.dat	xmrig
behavioral2/files/0x00070000000234d8-132.dat	xmrig
behavioral2/files/0x00070000000234d7-128.dat	xmrig
behavioral2/files/0x00070000000234d4-113.dat	xmrig
behavioral2/files/0x00070000000234d3-107.dat	xmrig
behavioral2/files/0x00070000000234d2-103.dat	xmrig
behavioral2/files/0x00070000000234d1-97.dat	xmrig
behavioral2/files/0x00070000000234cf-87.dat	xmrig
behavioral2/files/0x00070000000234ce-83.dat	xmrig
behavioral2/files/0x00070000000234cb-67.dat	xmrig
behavioral2/files/0x00070000000234c9-58.dat	xmrig
behavioral2/files/0x00070000000234c6-42.dat	xmrig
behavioral2/memory/4580-1972-0x00007FF670560000-0x00007FF6708B4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5004	vTRcVBh.exe
868	nafalct.exe
4928	OmMtGdp.exe
4784	AeqIEPg.exe
452	dAIhpns.exe
3424	oCPELSq.exe
4804	OnKitXA.exe
1236	pkLNMNf.exe
3652	sKuSZfL.exe
4680	dPmTLsv.exe
2996	EFzRuMn.exe
3004	WlpgETx.exe
2704	hrTlvlL.exe
1828	aBlpEgw.exe
4360	hTxlmsy.exe
228	orFtMAp.exe
220	YTejhad.exe
1572	LsBJeXn.exe
1948	bfKHWrg.exe
3852	KVJjoDg.exe
812	wDCBtdb.exe
4484	SHXiFvP.exe
4616	OQpbRzQ.exe
4468	FxoGcwZ.exe
4440	VMQCbvE.exe
3476	JKVVNHz.exe
1380	jQARmEp.exe
3000	MaSYOex.exe
4272	Aerrnmw.exe
1932	vFCmRBn.exe
2220	WTCWmGZ.exe
2152	ZTxnggm.exe
4564	dJiLlnG.exe
4860	qAtCbRz.exe
2216	OJckkXK.exe
4640	QCSGyNh.exe
2612	tzzTADP.exe
5048	jNlWezt.exe
2364	GWsSvyG.exe
3484	jnlYifJ.exe
1916	jgfUUlx.exe
60	xQkbEvN.exe
952	xAKHWwJ.exe
3672	DGDcTSV.exe
552	fxOdCGJ.exe
1600	hzweyoC.exe
3068	cIQijcM.exe
1288	LXzgWxS.exe
3708	yOHTyAb.exe
1156	KlsPwHw.exe
1660	MSxahsi.exe
3064	XnWjPuQ.exe
3360	yRQhBgP.exe
1516	tnhRgYQ.exe
704	xbxYJFm.exe
3244	KkUrqxX.exe
3116	NNRQmWp.exe
4364	qNWWXvi.exe
3448	QNagIQA.exe
4632	lyMAWGv.exe
3052	HLHBCZd.exe
2672	kgEBeVK.exe
1488	tYuADOg.exe
2140	mqbgpMt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4580-0-0x00007FF670560000-0x00007FF6708B4000-memory.dmp	upx
behavioral2/files/0x000900000002346e-5.dat	upx
behavioral2/memory/5004-6-0x00007FF731460000-0x00007FF7317B4000-memory.dmp	upx
behavioral2/files/0x00080000000234c2-9.dat	upx
behavioral2/memory/868-14-0x00007FF6588A0000-0x00007FF658BF4000-memory.dmp	upx
behavioral2/files/0x00070000000234c3-8.dat	upx
behavioral2/files/0x000b0000000234c0-23.dat	upx
behavioral2/memory/4928-22-0x00007FF6D6410000-0x00007FF6D6764000-memory.dmp	upx
behavioral2/memory/4784-26-0x00007FF764480000-0x00007FF7647D4000-memory.dmp	upx
behavioral2/files/0x00070000000234c4-29.dat	upx
behavioral2/files/0x00070000000234c5-35.dat	upx
behavioral2/files/0x00070000000234c7-44.dat	upx
behavioral2/files/0x00070000000234c8-49.dat	upx
behavioral2/files/0x00070000000234ca-63.dat	upx
behavioral2/files/0x00070000000234cc-69.dat	upx
behavioral2/files/0x00070000000234cd-78.dat	upx
behavioral2/files/0x00070000000234d0-89.dat	upx
behavioral2/files/0x00070000000234d5-112.dat	upx
behavioral2/files/0x00070000000234d6-123.dat	upx
behavioral2/files/0x00070000000234d9-138.dat	upx
behavioral2/files/0x00070000000234dc-152.dat	upx
behavioral2/files/0x00070000000234e0-167.dat	upx
behavioral2/memory/3004-566-0x00007FF6A6840000-0x00007FF6A6B94000-memory.dmp	upx
behavioral2/memory/1828-577-0x00007FF67CB80000-0x00007FF67CED4000-memory.dmp	upx
behavioral2/memory/1572-593-0x00007FF7C6490000-0x00007FF7C67E4000-memory.dmp	upx
behavioral2/memory/220-590-0x00007FF7FCD10000-0x00007FF7FD064000-memory.dmp	upx
behavioral2/memory/1948-599-0x00007FF7032A0000-0x00007FF7035F4000-memory.dmp	upx
behavioral2/memory/228-586-0x00007FF6C0F70000-0x00007FF6C12C4000-memory.dmp	upx
behavioral2/memory/4360-582-0x00007FF7CBF30000-0x00007FF7CC284000-memory.dmp	upx
behavioral2/memory/2704-570-0x00007FF761870000-0x00007FF761BC4000-memory.dmp	upx
behavioral2/memory/2996-556-0x00007FF768D50000-0x00007FF7690A4000-memory.dmp	upx
behavioral2/memory/4680-552-0x00007FF73BD50000-0x00007FF73C0A4000-memory.dmp	upx
behavioral2/memory/3652-544-0x00007FF6DF550000-0x00007FF6DF8A4000-memory.dmp	upx
behavioral2/memory/1236-538-0x00007FF6FDD80000-0x00007FF6FE0D4000-memory.dmp	upx
behavioral2/memory/4804-535-0x00007FF7831E0000-0x00007FF783534000-memory.dmp	upx
behavioral2/memory/452-530-0x00007FF7C6F40000-0x00007FF7C7294000-memory.dmp	upx
behavioral2/memory/3852-606-0x00007FF730D80000-0x00007FF7310D4000-memory.dmp	upx
behavioral2/memory/812-609-0x00007FF7F7A40000-0x00007FF7F7D94000-memory.dmp	upx
behavioral2/memory/4484-615-0x00007FF643EB0000-0x00007FF644204000-memory.dmp	upx
behavioral2/memory/3476-641-0x00007FF704950000-0x00007FF704CA4000-memory.dmp	upx
behavioral2/memory/1380-650-0x00007FF791FB0000-0x00007FF792304000-memory.dmp	upx
behavioral2/memory/3424-666-0x00007FF6BAC10000-0x00007FF6BAF64000-memory.dmp	upx
behavioral2/memory/4272-659-0x00007FF6EC320000-0x00007FF6EC674000-memory.dmp	upx
behavioral2/memory/3000-656-0x00007FF65EC00000-0x00007FF65EF54000-memory.dmp	upx
behavioral2/memory/4440-635-0x00007FF7A8AF0000-0x00007FF7A8E44000-memory.dmp	upx
behavioral2/memory/4468-633-0x00007FF76BE10000-0x00007FF76C164000-memory.dmp	upx
behavioral2/memory/4616-622-0x00007FF6B6440000-0x00007FF6B6794000-memory.dmp	upx
behavioral2/files/0x00070000000234df-164.dat	upx
behavioral2/files/0x00070000000234de-162.dat	upx
behavioral2/files/0x00070000000234dd-158.dat	upx
behavioral2/files/0x00070000000234db-148.dat	upx
behavioral2/files/0x00070000000234da-140.dat	upx
behavioral2/files/0x00070000000234d8-132.dat	upx
behavioral2/files/0x00070000000234d7-128.dat	upx
behavioral2/files/0x00070000000234d4-113.dat	upx
behavioral2/files/0x00070000000234d3-107.dat	upx
behavioral2/files/0x00070000000234d2-103.dat	upx
behavioral2/files/0x00070000000234d1-97.dat	upx
behavioral2/files/0x00070000000234cf-87.dat	upx
behavioral2/files/0x00070000000234ce-83.dat	upx
behavioral2/files/0x00070000000234cb-67.dat	upx
behavioral2/files/0x00070000000234c9-58.dat	upx
behavioral2/files/0x00070000000234c6-42.dat	upx
behavioral2/memory/4580-1972-0x00007FF670560000-0x00007FF6708B4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xXwqOMP.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\afdgljZ.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\yylDvIZ.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\afPgneX.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\PLnpbKC.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\BOGJRpJ.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\GnDqGJB.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\ykDPbll.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\Ushgqrt.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\qHZsCnS.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\OVUbKss.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\hodajIQ.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\NvOYTNL.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\looTPwG.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\bLVirhC.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\bIKZznl.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\QxXbnYw.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\zqIbLjX.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\kQIipqN.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\XFcTaoV.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\LKruMiP.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\tpDvOUk.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\BoEpvCw.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\ySnzYcU.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\StRWToL.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\EmetVjL.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\AkwnHhj.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\nGgrktY.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\VkwirqZ.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\zUCCUfY.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\DeVvVcD.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\mfnQEuY.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\qUGmKUL.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\wbBpIiq.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\zGdCcyd.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\cUxkysj.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\gujzuud.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\xyzOUvq.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\fCLeCfI.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\BOJJVGV.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\nQzmlUZ.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\vftjYdK.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\sCEDxKi.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\JUuTqaR.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\PCRnDDI.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\BhuWDLR.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\HhnrDGN.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\gsmbQSA.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\CYVaTOA.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\isuKIBj.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\FURzCRm.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\aEUCaET.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\ZWVKLOz.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\FwkJgTK.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\srGAgTa.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\nRdbOre.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\mCOquLB.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\ikKZEbv.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\EDgQhzg.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\WjglbDV.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\xPRFUlp.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\mBHDKhU.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\fmlUMdl.exe	8e7f310651dba0218fa79b694c765dd0N.exe
File created	C:\Windows\System\XbNBSLb.exe	8e7f310651dba0218fa79b694c765dd0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 5004	4580	8e7f310651dba0218fa79b694c765dd0N.exe	82
PID 4580 wrote to memory of 5004	4580	8e7f310651dba0218fa79b694c765dd0N.exe	82
PID 4580 wrote to memory of 868	4580	8e7f310651dba0218fa79b694c765dd0N.exe	83
PID 4580 wrote to memory of 868	4580	8e7f310651dba0218fa79b694c765dd0N.exe	83
PID 4580 wrote to memory of 4928	4580	8e7f310651dba0218fa79b694c765dd0N.exe	84
PID 4580 wrote to memory of 4928	4580	8e7f310651dba0218fa79b694c765dd0N.exe	84
PID 4580 wrote to memory of 4784	4580	8e7f310651dba0218fa79b694c765dd0N.exe	85
PID 4580 wrote to memory of 4784	4580	8e7f310651dba0218fa79b694c765dd0N.exe	85
PID 4580 wrote to memory of 452	4580	8e7f310651dba0218fa79b694c765dd0N.exe	86
PID 4580 wrote to memory of 452	4580	8e7f310651dba0218fa79b694c765dd0N.exe	86
PID 4580 wrote to memory of 3424	4580	8e7f310651dba0218fa79b694c765dd0N.exe	87
PID 4580 wrote to memory of 3424	4580	8e7f310651dba0218fa79b694c765dd0N.exe	87
PID 4580 wrote to memory of 4804	4580	8e7f310651dba0218fa79b694c765dd0N.exe	88
PID 4580 wrote to memory of 4804	4580	8e7f310651dba0218fa79b694c765dd0N.exe	88
PID 4580 wrote to memory of 1236	4580	8e7f310651dba0218fa79b694c765dd0N.exe	89
PID 4580 wrote to memory of 1236	4580	8e7f310651dba0218fa79b694c765dd0N.exe	89
PID 4580 wrote to memory of 3652	4580	8e7f310651dba0218fa79b694c765dd0N.exe	90
PID 4580 wrote to memory of 3652	4580	8e7f310651dba0218fa79b694c765dd0N.exe	90
PID 4580 wrote to memory of 4680	4580	8e7f310651dba0218fa79b694c765dd0N.exe	91
PID 4580 wrote to memory of 4680	4580	8e7f310651dba0218fa79b694c765dd0N.exe	91
PID 4580 wrote to memory of 2996	4580	8e7f310651dba0218fa79b694c765dd0N.exe	92
PID 4580 wrote to memory of 2996	4580	8e7f310651dba0218fa79b694c765dd0N.exe	92
PID 4580 wrote to memory of 3004	4580	8e7f310651dba0218fa79b694c765dd0N.exe	93
PID 4580 wrote to memory of 3004	4580	8e7f310651dba0218fa79b694c765dd0N.exe	93
PID 4580 wrote to memory of 2704	4580	8e7f310651dba0218fa79b694c765dd0N.exe	94
PID 4580 wrote to memory of 2704	4580	8e7f310651dba0218fa79b694c765dd0N.exe	94
PID 4580 wrote to memory of 1828	4580	8e7f310651dba0218fa79b694c765dd0N.exe	95
PID 4580 wrote to memory of 1828	4580	8e7f310651dba0218fa79b694c765dd0N.exe	95
PID 4580 wrote to memory of 4360	4580	8e7f310651dba0218fa79b694c765dd0N.exe	96
PID 4580 wrote to memory of 4360	4580	8e7f310651dba0218fa79b694c765dd0N.exe	96
PID 4580 wrote to memory of 228	4580	8e7f310651dba0218fa79b694c765dd0N.exe	97
PID 4580 wrote to memory of 228	4580	8e7f310651dba0218fa79b694c765dd0N.exe	97
PID 4580 wrote to memory of 220	4580	8e7f310651dba0218fa79b694c765dd0N.exe	98
PID 4580 wrote to memory of 220	4580	8e7f310651dba0218fa79b694c765dd0N.exe	98
PID 4580 wrote to memory of 1572	4580	8e7f310651dba0218fa79b694c765dd0N.exe	99
PID 4580 wrote to memory of 1572	4580	8e7f310651dba0218fa79b694c765dd0N.exe	99
PID 4580 wrote to memory of 1948	4580	8e7f310651dba0218fa79b694c765dd0N.exe	100
PID 4580 wrote to memory of 1948	4580	8e7f310651dba0218fa79b694c765dd0N.exe	100
PID 4580 wrote to memory of 3852	4580	8e7f310651dba0218fa79b694c765dd0N.exe	101
PID 4580 wrote to memory of 3852	4580	8e7f310651dba0218fa79b694c765dd0N.exe	101
PID 4580 wrote to memory of 812	4580	8e7f310651dba0218fa79b694c765dd0N.exe	102
PID 4580 wrote to memory of 812	4580	8e7f310651dba0218fa79b694c765dd0N.exe	102
PID 4580 wrote to memory of 4484	4580	8e7f310651dba0218fa79b694c765dd0N.exe	103
PID 4580 wrote to memory of 4484	4580	8e7f310651dba0218fa79b694c765dd0N.exe	103
PID 4580 wrote to memory of 4616	4580	8e7f310651dba0218fa79b694c765dd0N.exe	104
PID 4580 wrote to memory of 4616	4580	8e7f310651dba0218fa79b694c765dd0N.exe	104
PID 4580 wrote to memory of 4468	4580	8e7f310651dba0218fa79b694c765dd0N.exe	105
PID 4580 wrote to memory of 4468	4580	8e7f310651dba0218fa79b694c765dd0N.exe	105
PID 4580 wrote to memory of 4440	4580	8e7f310651dba0218fa79b694c765dd0N.exe	106
PID 4580 wrote to memory of 4440	4580	8e7f310651dba0218fa79b694c765dd0N.exe	106
PID 4580 wrote to memory of 3476	4580	8e7f310651dba0218fa79b694c765dd0N.exe	107
PID 4580 wrote to memory of 3476	4580	8e7f310651dba0218fa79b694c765dd0N.exe	107
PID 4580 wrote to memory of 1380	4580	8e7f310651dba0218fa79b694c765dd0N.exe	108
PID 4580 wrote to memory of 1380	4580	8e7f310651dba0218fa79b694c765dd0N.exe	108
PID 4580 wrote to memory of 3000	4580	8e7f310651dba0218fa79b694c765dd0N.exe	109
PID 4580 wrote to memory of 3000	4580	8e7f310651dba0218fa79b694c765dd0N.exe	109
PID 4580 wrote to memory of 4272	4580	8e7f310651dba0218fa79b694c765dd0N.exe	110
PID 4580 wrote to memory of 4272	4580	8e7f310651dba0218fa79b694c765dd0N.exe	110
PID 4580 wrote to memory of 1932	4580	8e7f310651dba0218fa79b694c765dd0N.exe	111
PID 4580 wrote to memory of 1932	4580	8e7f310651dba0218fa79b694c765dd0N.exe	111
PID 4580 wrote to memory of 2220	4580	8e7f310651dba0218fa79b694c765dd0N.exe	112
PID 4580 wrote to memory of 2220	4580	8e7f310651dba0218fa79b694c765dd0N.exe	112
PID 4580 wrote to memory of 2152	4580	8e7f310651dba0218fa79b694c765dd0N.exe	113
PID 4580 wrote to memory of 2152	4580	8e7f310651dba0218fa79b694c765dd0N.exe	113

C:\Users\Admin\AppData\Local\Temp\8e7f310651dba0218fa79b694c765dd0N.exe
"C:\Users\Admin\AppData\Local\Temp\8e7f310651dba0218fa79b694c765dd0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\System\vTRcVBh.exe
  C:\Windows\System\vTRcVBh.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\nafalct.exe
  C:\Windows\System\nafalct.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\OmMtGdp.exe
  C:\Windows\System\OmMtGdp.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\AeqIEPg.exe
  C:\Windows\System\AeqIEPg.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\dAIhpns.exe
  C:\Windows\System\dAIhpns.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\oCPELSq.exe
  C:\Windows\System\oCPELSq.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\OnKitXA.exe
  C:\Windows\System\OnKitXA.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\pkLNMNf.exe
  C:\Windows\System\pkLNMNf.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\sKuSZfL.exe
  C:\Windows\System\sKuSZfL.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\dPmTLsv.exe
  C:\Windows\System\dPmTLsv.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\EFzRuMn.exe
  C:\Windows\System\EFzRuMn.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\WlpgETx.exe
  C:\Windows\System\WlpgETx.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\hrTlvlL.exe
  C:\Windows\System\hrTlvlL.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\aBlpEgw.exe
  C:\Windows\System\aBlpEgw.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\hTxlmsy.exe
  C:\Windows\System\hTxlmsy.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\orFtMAp.exe
  C:\Windows\System\orFtMAp.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\YTejhad.exe
  C:\Windows\System\YTejhad.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\LsBJeXn.exe
  C:\Windows\System\LsBJeXn.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\bfKHWrg.exe
  C:\Windows\System\bfKHWrg.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\KVJjoDg.exe
  C:\Windows\System\KVJjoDg.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\wDCBtdb.exe
  C:\Windows\System\wDCBtdb.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\SHXiFvP.exe
  C:\Windows\System\SHXiFvP.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\OQpbRzQ.exe
  C:\Windows\System\OQpbRzQ.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\FxoGcwZ.exe
  C:\Windows\System\FxoGcwZ.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\VMQCbvE.exe
  C:\Windows\System\VMQCbvE.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\JKVVNHz.exe
  C:\Windows\System\JKVVNHz.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\jQARmEp.exe
  C:\Windows\System\jQARmEp.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\MaSYOex.exe
  C:\Windows\System\MaSYOex.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\Aerrnmw.exe
  C:\Windows\System\Aerrnmw.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\vFCmRBn.exe
  C:\Windows\System\vFCmRBn.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\WTCWmGZ.exe
  C:\Windows\System\WTCWmGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\ZTxnggm.exe
  C:\Windows\System\ZTxnggm.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\dJiLlnG.exe
  C:\Windows\System\dJiLlnG.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\qAtCbRz.exe
  C:\Windows\System\qAtCbRz.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\OJckkXK.exe
  C:\Windows\System\OJckkXK.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\QCSGyNh.exe
  C:\Windows\System\QCSGyNh.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\tzzTADP.exe
  C:\Windows\System\tzzTADP.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\jNlWezt.exe
  C:\Windows\System\jNlWezt.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\GWsSvyG.exe
  C:\Windows\System\GWsSvyG.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\jnlYifJ.exe
  C:\Windows\System\jnlYifJ.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\jgfUUlx.exe
  C:\Windows\System\jgfUUlx.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\xQkbEvN.exe
  C:\Windows\System\xQkbEvN.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\xAKHWwJ.exe
  C:\Windows\System\xAKHWwJ.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\DGDcTSV.exe
  C:\Windows\System\DGDcTSV.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\fxOdCGJ.exe
  C:\Windows\System\fxOdCGJ.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\hzweyoC.exe
  C:\Windows\System\hzweyoC.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\cIQijcM.exe
  C:\Windows\System\cIQijcM.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\LXzgWxS.exe
  C:\Windows\System\LXzgWxS.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\yOHTyAb.exe
  C:\Windows\System\yOHTyAb.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\KlsPwHw.exe
  C:\Windows\System\KlsPwHw.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\MSxahsi.exe
  C:\Windows\System\MSxahsi.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\XnWjPuQ.exe
  C:\Windows\System\XnWjPuQ.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\yRQhBgP.exe
  C:\Windows\System\yRQhBgP.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\tnhRgYQ.exe
  C:\Windows\System\tnhRgYQ.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\xbxYJFm.exe
  C:\Windows\System\xbxYJFm.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\KkUrqxX.exe
  C:\Windows\System\KkUrqxX.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\NNRQmWp.exe
  C:\Windows\System\NNRQmWp.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\qNWWXvi.exe
  C:\Windows\System\qNWWXvi.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\QNagIQA.exe
  C:\Windows\System\QNagIQA.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\lyMAWGv.exe
  C:\Windows\System\lyMAWGv.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\HLHBCZd.exe
  C:\Windows\System\HLHBCZd.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\kgEBeVK.exe
  C:\Windows\System\kgEBeVK.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\tYuADOg.exe
  C:\Windows\System\tYuADOg.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\mqbgpMt.exe
  C:\Windows\System\mqbgpMt.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\QlLBTVo.exe
  C:\Windows\System\QlLBTVo.exe
  2⤵
  PID:4524
- C:\Windows\System\WiCgiFi.exe
  C:\Windows\System\WiCgiFi.exe
  2⤵
  PID:4424
- C:\Windows\System\rMJBXLj.exe
  C:\Windows\System\rMJBXLj.exe
  2⤵
  PID:4240
- C:\Windows\System\pnyrhEW.exe
  C:\Windows\System\pnyrhEW.exe
  2⤵
  PID:4852
- C:\Windows\System\OxBCrFe.exe
  C:\Windows\System\OxBCrFe.exe
  2⤵
  PID:3456
- C:\Windows\System\QufoaMp.exe
  C:\Windows\System\QufoaMp.exe
  2⤵
  PID:4972
- C:\Windows\System\iExnMPA.exe
  C:\Windows\System\iExnMPA.exe
  2⤵
  PID:4588
- C:\Windows\System\XYGvsqz.exe
  C:\Windows\System\XYGvsqz.exe
  2⤵
  PID:5072
- C:\Windows\System\dopXILx.exe
  C:\Windows\System\dopXILx.exe
  2⤵
  PID:1944
- C:\Windows\System\gmFSzdZ.exe
  C:\Windows\System\gmFSzdZ.exe
  2⤵
  PID:2460
- C:\Windows\System\aOpmMVQ.exe
  C:\Windows\System\aOpmMVQ.exe
  2⤵
  PID:4372
- C:\Windows\System\YDAWavI.exe
  C:\Windows\System\YDAWavI.exe
  2⤵
  PID:3048
- C:\Windows\System\fnwWOlf.exe
  C:\Windows\System\fnwWOlf.exe
  2⤵
  PID:4600
- C:\Windows\System\FURzCRm.exe
  C:\Windows\System\FURzCRm.exe
  2⤵
  PID:1324
- C:\Windows\System\rACJDSn.exe
  C:\Windows\System\rACJDSn.exe
  2⤵
  PID:2760
- C:\Windows\System\yBPaHFx.exe
  C:\Windows\System\yBPaHFx.exe
  2⤵
  PID:628
- C:\Windows\System\fvWpvfd.exe
  C:\Windows\System\fvWpvfd.exe
  2⤵
  PID:1656
- C:\Windows\System\AcWdKcd.exe
  C:\Windows\System\AcWdKcd.exe
  2⤵
  PID:1464
- C:\Windows\System\MrjlUKH.exe
  C:\Windows\System\MrjlUKH.exe
  2⤵
  PID:4620
- C:\Windows\System\OjBRRru.exe
  C:\Windows\System\OjBRRru.exe
  2⤵
  PID:3712
- C:\Windows\System\yUssFNu.exe
  C:\Windows\System\yUssFNu.exe
  2⤵
  PID:5084
- C:\Windows\System\MJwqrms.exe
  C:\Windows\System\MJwqrms.exe
  2⤵
  PID:540
- C:\Windows\System\xMOabUS.exe
  C:\Windows\System\xMOabUS.exe
  2⤵
  PID:2844
- C:\Windows\System\puEvecn.exe
  C:\Windows\System\puEvecn.exe
  2⤵
  PID:1924
- C:\Windows\System\xyCxpxZ.exe
  C:\Windows\System\xyCxpxZ.exe
  2⤵
  PID:2444
- C:\Windows\System\wHnUOcY.exe
  C:\Windows\System\wHnUOcY.exe
  2⤵
  PID:4036
- C:\Windows\System\dPlyJgC.exe
  C:\Windows\System\dPlyJgC.exe
  2⤵
  PID:1612
- C:\Windows\System\UHDwYQq.exe
  C:\Windows\System\UHDwYQq.exe
  2⤵
  PID:3132
- C:\Windows\System\hSqbFlm.exe
  C:\Windows\System\hSqbFlm.exe
  2⤵
  PID:5064
- C:\Windows\System\hodajIQ.exe
  C:\Windows\System\hodajIQ.exe
  2⤵
  PID:4628
- C:\Windows\System\hpdSFVY.exe
  C:\Windows\System\hpdSFVY.exe
  2⤵
  PID:4464
- C:\Windows\System\UJkSecE.exe
  C:\Windows\System\UJkSecE.exe
  2⤵
  PID:3968
- C:\Windows\System\sFlbLTW.exe
  C:\Windows\System\sFlbLTW.exe
  2⤵
  PID:4560
- C:\Windows\System\rHBEjgu.exe
  C:\Windows\System\rHBEjgu.exe
  2⤵
  PID:2816
- C:\Windows\System\ujDMVJu.exe
  C:\Windows\System\ujDMVJu.exe
  2⤵
  PID:2744
- C:\Windows\System\CyHQRCE.exe
  C:\Windows\System\CyHQRCE.exe
  2⤵
  PID:2420
- C:\Windows\System\PRPaUMM.exe
  C:\Windows\System\PRPaUMM.exe
  2⤵
  PID:924
- C:\Windows\System\xPRFUlp.exe
  C:\Windows\System\xPRFUlp.exe
  2⤵
  PID:4396
- C:\Windows\System\KvxYGjV.exe
  C:\Windows\System\KvxYGjV.exe
  2⤵
  PID:4752
- C:\Windows\System\kLmClZL.exe
  C:\Windows\System\kLmClZL.exe
  2⤵
  PID:2044
- C:\Windows\System\kCNCzab.exe
  C:\Windows\System\kCNCzab.exe
  2⤵
  PID:3688
- C:\Windows\System\NBrMWjL.exe
  C:\Windows\System\NBrMWjL.exe
  2⤵
  PID:3612
- C:\Windows\System\IjMyLfj.exe
  C:\Windows\System\IjMyLfj.exe
  2⤵
  PID:1196
- C:\Windows\System\RVZTOQj.exe
  C:\Windows\System\RVZTOQj.exe
  2⤵
  PID:3340
- C:\Windows\System\MAYyBKD.exe
  C:\Windows\System\MAYyBKD.exe
  2⤵
  PID:3716
- C:\Windows\System\gfnhpvj.exe
  C:\Windows\System\gfnhpvj.exe
  2⤵
  PID:408
- C:\Windows\System\AnuMmFa.exe
  C:\Windows\System\AnuMmFa.exe
  2⤵
  PID:3284
- C:\Windows\System\OvRTLJb.exe
  C:\Windows\System\OvRTLJb.exe
  2⤵
  PID:4608
- C:\Windows\System\LUHkmkl.exe
  C:\Windows\System\LUHkmkl.exe
  2⤵
  PID:3624
- C:\Windows\System\uJGIMVN.exe
  C:\Windows\System\uJGIMVN.exe
  2⤵
  PID:3916
- C:\Windows\System\oyPkHTr.exe
  C:\Windows\System\oyPkHTr.exe
  2⤵
  PID:5128
- C:\Windows\System\NvOYTNL.exe
  C:\Windows\System\NvOYTNL.exe
  2⤵
  PID:5152
- C:\Windows\System\lTtXzuO.exe
  C:\Windows\System\lTtXzuO.exe
  2⤵
  PID:5180
- C:\Windows\System\tXuctWO.exe
  C:\Windows\System\tXuctWO.exe
  2⤵
  PID:5208
- C:\Windows\System\vAcAQIc.exe
  C:\Windows\System\vAcAQIc.exe
  2⤵
  PID:5236
- C:\Windows\System\KhiUxFb.exe
  C:\Windows\System\KhiUxFb.exe
  2⤵
  PID:5264
- C:\Windows\System\tbOEpWR.exe
  C:\Windows\System\tbOEpWR.exe
  2⤵
  PID:5292
- C:\Windows\System\dITHGfn.exe
  C:\Windows\System\dITHGfn.exe
  2⤵
  PID:5320
- C:\Windows\System\jquDMIZ.exe
  C:\Windows\System\jquDMIZ.exe
  2⤵
  PID:5348
- C:\Windows\System\WobhIbw.exe
  C:\Windows\System\WobhIbw.exe
  2⤵
  PID:5376
- C:\Windows\System\OTnprVy.exe
  C:\Windows\System\OTnprVy.exe
  2⤵
  PID:5404
- C:\Windows\System\aHxeItx.exe
  C:\Windows\System\aHxeItx.exe
  2⤵
  PID:5432
- C:\Windows\System\yhNrdMs.exe
  C:\Windows\System\yhNrdMs.exe
  2⤵
  PID:5460
- C:\Windows\System\meNZIur.exe
  C:\Windows\System\meNZIur.exe
  2⤵
  PID:5488
- C:\Windows\System\VjWEkAR.exe
  C:\Windows\System\VjWEkAR.exe
  2⤵
  PID:5516
- C:\Windows\System\aEUCaET.exe
  C:\Windows\System\aEUCaET.exe
  2⤵
  PID:5544
- C:\Windows\System\lRFOoRe.exe
  C:\Windows\System\lRFOoRe.exe
  2⤵
  PID:5568
- C:\Windows\System\davUfkL.exe
  C:\Windows\System\davUfkL.exe
  2⤵
  PID:5600
- C:\Windows\System\xYBIZsz.exe
  C:\Windows\System\xYBIZsz.exe
  2⤵
  PID:5628
- C:\Windows\System\ECQurRz.exe
  C:\Windows\System\ECQurRz.exe
  2⤵
  PID:5656
- C:\Windows\System\FPYXVui.exe
  C:\Windows\System\FPYXVui.exe
  2⤵
  PID:5684
- C:\Windows\System\bwsJHoe.exe
  C:\Windows\System\bwsJHoe.exe
  2⤵
  PID:5712
- C:\Windows\System\tHayJrC.exe
  C:\Windows\System\tHayJrC.exe
  2⤵
  PID:5740
- C:\Windows\System\cpyJwEg.exe
  C:\Windows\System\cpyJwEg.exe
  2⤵
  PID:5768
- C:\Windows\System\mvmUfGy.exe
  C:\Windows\System\mvmUfGy.exe
  2⤵
  PID:5796
- C:\Windows\System\NTwbCXS.exe
  C:\Windows\System\NTwbCXS.exe
  2⤵
  PID:5824
- C:\Windows\System\vhMbdSH.exe
  C:\Windows\System\vhMbdSH.exe
  2⤵
  PID:5852
- C:\Windows\System\ogWcmla.exe
  C:\Windows\System\ogWcmla.exe
  2⤵
  PID:5880
- C:\Windows\System\olhyZXL.exe
  C:\Windows\System\olhyZXL.exe
  2⤵
  PID:5908
- C:\Windows\System\xXwqOMP.exe
  C:\Windows\System\xXwqOMP.exe
  2⤵
  PID:5936
- C:\Windows\System\Okipijo.exe
  C:\Windows\System\Okipijo.exe
  2⤵
  PID:5964
- C:\Windows\System\PDaaNmE.exe
  C:\Windows\System\PDaaNmE.exe
  2⤵
  PID:5992
- C:\Windows\System\zbCuNlK.exe
  C:\Windows\System\zbCuNlK.exe
  2⤵
  PID:6020
- C:\Windows\System\XTZUYWC.exe
  C:\Windows\System\XTZUYWC.exe
  2⤵
  PID:6044
- C:\Windows\System\nDcoRbB.exe
  C:\Windows\System\nDcoRbB.exe
  2⤵
  PID:6080
- C:\Windows\System\RvucKAP.exe
  C:\Windows\System\RvucKAP.exe
  2⤵
  PID:6104
- C:\Windows\System\vGXSfdr.exe
  C:\Windows\System\vGXSfdr.exe
  2⤵
  PID:6132
- C:\Windows\System\kfIQRNl.exe
  C:\Windows\System\kfIQRNl.exe
  2⤵
  PID:512
- C:\Windows\System\kQIipqN.exe
  C:\Windows\System\kQIipqN.exe
  2⤵
  PID:3736
- C:\Windows\System\HcDLyOG.exe
  C:\Windows\System\HcDLyOG.exe
  2⤵
  PID:5148
- C:\Windows\System\clhPzab.exe
  C:\Windows\System\clhPzab.exe
  2⤵
  PID:5220
- C:\Windows\System\ZWVKLOz.exe
  C:\Windows\System\ZWVKLOz.exe
  2⤵
  PID:5332
- C:\Windows\System\mBHDKhU.exe
  C:\Windows\System\mBHDKhU.exe
  2⤵
  PID:5396
- C:\Windows\System\WnktCuD.exe
  C:\Windows\System\WnktCuD.exe
  2⤵
  PID:5448
- C:\Windows\System\oBJriTZ.exe
  C:\Windows\System\oBJriTZ.exe
  2⤵
  PID:5476
- C:\Windows\System\hCeBCZC.exe
  C:\Windows\System\hCeBCZC.exe
  2⤵
  PID:5528
- C:\Windows\System\HywpaBc.exe
  C:\Windows\System\HywpaBc.exe
  2⤵
  PID:5584
- C:\Windows\System\zNMavDN.exe
  C:\Windows\System\zNMavDN.exe
  2⤵
  PID:5612
- C:\Windows\System\zHkBtkn.exe
  C:\Windows\System\zHkBtkn.exe
  2⤵
  PID:5672
- C:\Windows\System\YEcUnOS.exe
  C:\Windows\System\YEcUnOS.exe
  2⤵
  PID:5752
- C:\Windows\System\remGHtX.exe
  C:\Windows\System\remGHtX.exe
  2⤵
  PID:5840
- C:\Windows\System\nyaCPKx.exe
  C:\Windows\System\nyaCPKx.exe
  2⤵
  PID:5920
- C:\Windows\System\FDuQIzK.exe
  C:\Windows\System\FDuQIzK.exe
  2⤵
  PID:5976
- C:\Windows\System\afdgljZ.exe
  C:\Windows\System\afdgljZ.exe
  2⤵
  PID:4520
- C:\Windows\System\QmcvMXD.exe
  C:\Windows\System\QmcvMXD.exe
  2⤵
  PID:4448
- C:\Windows\System\GqrpQIW.exe
  C:\Windows\System\GqrpQIW.exe
  2⤵
  PID:4076
- C:\Windows\System\JJwyXjq.exe
  C:\Windows\System\JJwyXjq.exe
  2⤵
  PID:4404
- C:\Windows\System\SprFrRE.exe
  C:\Windows\System\SprFrRE.exe
  2⤵
  PID:1424
- C:\Windows\System\yylDvIZ.exe
  C:\Windows\System\yylDvIZ.exe
  2⤵
  PID:5284
- C:\Windows\System\SjaXlxH.exe
  C:\Windows\System\SjaXlxH.exe
  2⤵
  PID:5560
- C:\Windows\System\vjNJAiT.exe
  C:\Windows\System\vjNJAiT.exe
  2⤵
  PID:5508
- C:\Windows\System\mPBFoLo.exe
  C:\Windows\System\mPBFoLo.exe
  2⤵
  PID:5564
- C:\Windows\System\zbnnIYd.exe
  C:\Windows\System\zbnnIYd.exe
  2⤵
  PID:1620
- C:\Windows\System\bXfBTMP.exe
  C:\Windows\System\bXfBTMP.exe
  2⤵
  PID:5808
- C:\Windows\System\WRsRYAI.exe
  C:\Windows\System\WRsRYAI.exe
  2⤵
  PID:6008
- C:\Windows\System\DZCCIMQ.exe
  C:\Windows\System\DZCCIMQ.exe
  2⤵
  PID:440
- C:\Windows\System\PwksBWu.exe
  C:\Windows\System\PwksBWu.exe
  2⤵
  PID:6040
- C:\Windows\System\RAchjwr.exe
  C:\Windows\System\RAchjwr.exe
  2⤵
  PID:6096
- C:\Windows\System\BOMOtOQ.exe
  C:\Windows\System\BOMOtOQ.exe
  2⤵
  PID:5196
- C:\Windows\System\btXKOrv.exe
  C:\Windows\System\btXKOrv.exe
  2⤵
  PID:984
- C:\Windows\System\UaaaGMY.exe
  C:\Windows\System\UaaaGMY.exe
  2⤵
  PID:4596
- C:\Windows\System\OSiQMgi.exe
  C:\Windows\System\OSiQMgi.exe
  2⤵
  PID:5472
- C:\Windows\System\DeVvVcD.exe
  C:\Windows\System\DeVvVcD.exe
  2⤵
  PID:5668
- C:\Windows\System\mfnQEuY.exe
  C:\Windows\System\mfnQEuY.exe
  2⤵
  PID:1504
- C:\Windows\System\PxiydNC.exe
  C:\Windows\System\PxiydNC.exe
  2⤵
  PID:3696
- C:\Windows\System\fbiRspY.exe
  C:\Windows\System\fbiRspY.exe
  2⤵
  PID:6172
- C:\Windows\System\nzhcJhX.exe
  C:\Windows\System\nzhcJhX.exe
  2⤵
  PID:6204
- C:\Windows\System\gRyaCiF.exe
  C:\Windows\System\gRyaCiF.exe
  2⤵
  PID:6252
- C:\Windows\System\BnqSuug.exe
  C:\Windows\System\BnqSuug.exe
  2⤵
  PID:6288
- C:\Windows\System\EyJHyAY.exe
  C:\Windows\System\EyJHyAY.exe
  2⤵
  PID:6308
- C:\Windows\System\itIWIBm.exe
  C:\Windows\System\itIWIBm.exe
  2⤵
  PID:6364
- C:\Windows\System\xmRbXXK.exe
  C:\Windows\System\xmRbXXK.exe
  2⤵
  PID:6392
- C:\Windows\System\GrHNmYO.exe
  C:\Windows\System\GrHNmYO.exe
  2⤵
  PID:6432
- C:\Windows\System\zPtBtWv.exe
  C:\Windows\System\zPtBtWv.exe
  2⤵
  PID:6480
- C:\Windows\System\cGjozkX.exe
  C:\Windows\System\cGjozkX.exe
  2⤵
  PID:6500
- C:\Windows\System\JPsXafP.exe
  C:\Windows\System\JPsXafP.exe
  2⤵
  PID:6528
- C:\Windows\System\toTAPhp.exe
  C:\Windows\System\toTAPhp.exe
  2⤵
  PID:6560
- C:\Windows\System\unWdQzL.exe
  C:\Windows\System\unWdQzL.exe
  2⤵
  PID:6584
- C:\Windows\System\ImqJhxN.exe
  C:\Windows\System\ImqJhxN.exe
  2⤵
  PID:6612
- C:\Windows\System\yzoWsqy.exe
  C:\Windows\System\yzoWsqy.exe
  2⤵
  PID:6640
- C:\Windows\System\kaPZfoc.exe
  C:\Windows\System\kaPZfoc.exe
  2⤵
  PID:6664
- C:\Windows\System\ylMPfVR.exe
  C:\Windows\System\ylMPfVR.exe
  2⤵
  PID:6700
- C:\Windows\System\ETUFpTJ.exe
  C:\Windows\System\ETUFpTJ.exe
  2⤵
  PID:6724
- C:\Windows\System\yrQPVAo.exe
  C:\Windows\System\yrQPVAo.exe
  2⤵
  PID:6752
- C:\Windows\System\gujzuud.exe
  C:\Windows\System\gujzuud.exe
  2⤵
  PID:6788
- C:\Windows\System\nGgrktY.exe
  C:\Windows\System\nGgrktY.exe
  2⤵
  PID:6808
- C:\Windows\System\MpcQnSt.exe
  C:\Windows\System\MpcQnSt.exe
  2⤵
  PID:6836
- C:\Windows\System\qTduAIB.exe
  C:\Windows\System\qTduAIB.exe
  2⤵
  PID:6864
- C:\Windows\System\VyTwMpU.exe
  C:\Windows\System\VyTwMpU.exe
  2⤵
  PID:6892
- C:\Windows\System\DnEADZB.exe
  C:\Windows\System\DnEADZB.exe
  2⤵
  PID:6920
- C:\Windows\System\BNdJRVq.exe
  C:\Windows\System\BNdJRVq.exe
  2⤵
  PID:6948
- C:\Windows\System\UXuVyTT.exe
  C:\Windows\System\UXuVyTT.exe
  2⤵
  PID:6976
- C:\Windows\System\TMYByKH.exe
  C:\Windows\System\TMYByKH.exe
  2⤵
  PID:7004
- C:\Windows\System\JUuTqaR.exe
  C:\Windows\System\JUuTqaR.exe
  2⤵
  PID:7040
- C:\Windows\System\ZLftlhh.exe
  C:\Windows\System\ZLftlhh.exe
  2⤵
  PID:7060
- C:\Windows\System\xyzOUvq.exe
  C:\Windows\System\xyzOUvq.exe
  2⤵
  PID:7088
- C:\Windows\System\afPgneX.exe
  C:\Windows\System\afPgneX.exe
  2⤵
  PID:7116
- C:\Windows\System\PIXJbzk.exe
  C:\Windows\System\PIXJbzk.exe
  2⤵
  PID:7148
- C:\Windows\System\DGdzJMV.exe
  C:\Windows\System\DGdzJMV.exe
  2⤵
  PID:468
- C:\Windows\System\LXWUbvN.exe
  C:\Windows\System\LXWUbvN.exe
  2⤵
  PID:6148
- C:\Windows\System\lNISjnl.exe
  C:\Windows\System\lNISjnl.exe
  2⤵
  PID:6216
- C:\Windows\System\rDifTEt.exe
  C:\Windows\System\rDifTEt.exe
  2⤵
  PID:6260
- C:\Windows\System\CWkypkl.exe
  C:\Windows\System\CWkypkl.exe
  2⤵
  PID:6340
- C:\Windows\System\SqGepBP.exe
  C:\Windows\System\SqGepBP.exe
  2⤵
  PID:6388
- C:\Windows\System\QbIOLMR.exe
  C:\Windows\System\QbIOLMR.exe
  2⤵
  PID:6468
- C:\Windows\System\sKckEeO.exe
  C:\Windows\System\sKckEeO.exe
  2⤵
  PID:6544
- C:\Windows\System\jronHTi.exe
  C:\Windows\System\jronHTi.exe
  2⤵
  PID:6596
- C:\Windows\System\TVPGfTc.exe
  C:\Windows\System\TVPGfTc.exe
  2⤵
  PID:5500
- C:\Windows\System\ovTpjnu.exe
  C:\Windows\System\ovTpjnu.exe
  2⤵
  PID:6688
- C:\Windows\System\MdPDWyC.exe
  C:\Windows\System\MdPDWyC.exe
  2⤵
  PID:6764
- C:\Windows\System\bmzJvMt.exe
  C:\Windows\System\bmzJvMt.exe
  2⤵
  PID:6804
- C:\Windows\System\PCBVZqc.exe
  C:\Windows\System\PCBVZqc.exe
  2⤵
  PID:6860
- C:\Windows\System\CHhZdqs.exe
  C:\Windows\System\CHhZdqs.exe
  2⤵
  PID:6912
- C:\Windows\System\khCHDad.exe
  C:\Windows\System\khCHDad.exe
  2⤵
  PID:5956
- C:\Windows\System\BchrPhz.exe
  C:\Windows\System\BchrPhz.exe
  2⤵
  PID:7016
- C:\Windows\System\ANwloxm.exe
  C:\Windows\System\ANwloxm.exe
  2⤵
  PID:7080
- C:\Windows\System\TkMwvCU.exe
  C:\Windows\System\TkMwvCU.exe
  2⤵
  PID:7140
- C:\Windows\System\DhfpJvJ.exe
  C:\Windows\System\DhfpJvJ.exe
  2⤵
  PID:880
- C:\Windows\System\JPoXhxC.exe
  C:\Windows\System\JPoXhxC.exe
  2⤵
  PID:6324
- C:\Windows\System\pkLHMSR.exe
  C:\Windows\System\pkLHMSR.exe
  2⤵
  PID:3996
- C:\Windows\System\xwfiCzy.exe
  C:\Windows\System\xwfiCzy.exe
  2⤵
  PID:6552
- C:\Windows\System\IivBKFS.exe
  C:\Windows\System\IivBKFS.exe
  2⤵
  PID:6676
- C:\Windows\System\neQGXsi.exe
  C:\Windows\System\neQGXsi.exe
  2⤵
  PID:6800
- C:\Windows\System\eomzkKo.exe
  C:\Windows\System\eomzkKo.exe
  2⤵
  PID:4836
- C:\Windows\System\SSMuweF.exe
  C:\Windows\System\SSMuweF.exe
  2⤵
  PID:4124
- C:\Windows\System\UXsuqyJ.exe
  C:\Windows\System\UXsuqyJ.exe
  2⤵
  PID:4708
- C:\Windows\System\ZgLqIpJ.exe
  C:\Windows\System\ZgLqIpJ.exe
  2⤵
  PID:6304
- C:\Windows\System\GzEhyUm.exe
  C:\Windows\System\GzEhyUm.exe
  2⤵
  PID:5892
- C:\Windows\System\NrLiuHM.exe
  C:\Windows\System\NrLiuHM.exe
  2⤵
  PID:6848
- C:\Windows\System\gcsXWEh.exe
  C:\Windows\System\gcsXWEh.exe
  2⤵
  PID:6996
- C:\Windows\System\zmNXOOk.exe
  C:\Windows\System\zmNXOOk.exe
  2⤵
  PID:5592
- C:\Windows\System\LDRDQON.exe
  C:\Windows\System\LDRDQON.exe
  2⤵
  PID:6908
- C:\Windows\System\VkSquIH.exe
  C:\Windows\System\VkSquIH.exe
  2⤵
  PID:3944
- C:\Windows\System\QroxZtX.exe
  C:\Windows\System\QroxZtX.exe
  2⤵
  PID:7180
- C:\Windows\System\fUBjQWu.exe
  C:\Windows\System\fUBjQWu.exe
  2⤵
  PID:7204
- C:\Windows\System\QDnAJqI.exe
  C:\Windows\System\QDnAJqI.exe
  2⤵
  PID:7232
- C:\Windows\System\oZwDohZ.exe
  C:\Windows\System\oZwDohZ.exe
  2⤵
  PID:7260
- C:\Windows\System\COjTBle.exe
  C:\Windows\System\COjTBle.exe
  2⤵
  PID:7284
- C:\Windows\System\DzgEPZC.exe
  C:\Windows\System\DzgEPZC.exe
  2⤵
  PID:7316
- C:\Windows\System\stcxcrQ.exe
  C:\Windows\System\stcxcrQ.exe
  2⤵
  PID:7344
- C:\Windows\System\ZRdTyuT.exe
  C:\Windows\System\ZRdTyuT.exe
  2⤵
  PID:7372
- C:\Windows\System\pItwknj.exe
  C:\Windows\System\pItwknj.exe
  2⤵
  PID:7400
- C:\Windows\System\XFcTaoV.exe
  C:\Windows\System\XFcTaoV.exe
  2⤵
  PID:7428
- C:\Windows\System\zJtOPlN.exe
  C:\Windows\System\zJtOPlN.exe
  2⤵
  PID:7456
- C:\Windows\System\GPPCBTe.exe
  C:\Windows\System\GPPCBTe.exe
  2⤵
  PID:7488
- C:\Windows\System\IQuXGjD.exe
  C:\Windows\System\IQuXGjD.exe
  2⤵
  PID:7516
- C:\Windows\System\NnPTvqe.exe
  C:\Windows\System\NnPTvqe.exe
  2⤵
  PID:7540
- C:\Windows\System\cXWdHFH.exe
  C:\Windows\System\cXWdHFH.exe
  2⤵
  PID:7564
- C:\Windows\System\ypArAUh.exe
  C:\Windows\System\ypArAUh.exe
  2⤵
  PID:7600
- C:\Windows\System\dPRMGid.exe
  C:\Windows\System\dPRMGid.exe
  2⤵
  PID:7624
- C:\Windows\System\iTFCXMC.exe
  C:\Windows\System\iTFCXMC.exe
  2⤵
  PID:7652
- C:\Windows\System\GMeWaBL.exe
  C:\Windows\System\GMeWaBL.exe
  2⤵
  PID:7676
- C:\Windows\System\cLEYHIh.exe
  C:\Windows\System\cLEYHIh.exe
  2⤵
  PID:7708
- C:\Windows\System\sMvepmm.exe
  C:\Windows\System\sMvepmm.exe
  2⤵
  PID:7736
- C:\Windows\System\zxcWoHA.exe
  C:\Windows\System\zxcWoHA.exe
  2⤵
  PID:7764
- C:\Windows\System\ZyDrkTm.exe
  C:\Windows\System\ZyDrkTm.exe
  2⤵
  PID:7796
- C:\Windows\System\epriaxD.exe
  C:\Windows\System\epriaxD.exe
  2⤵
  PID:7820
- C:\Windows\System\fCLeCfI.exe
  C:\Windows\System\fCLeCfI.exe
  2⤵
  PID:7848
- C:\Windows\System\InwbGRg.exe
  C:\Windows\System\InwbGRg.exe
  2⤵
  PID:7880
- C:\Windows\System\wumwKDA.exe
  C:\Windows\System\wumwKDA.exe
  2⤵
  PID:7900
- C:\Windows\System\TcOQQAP.exe
  C:\Windows\System\TcOQQAP.exe
  2⤵
  PID:7932
- C:\Windows\System\QhojljV.exe
  C:\Windows\System\QhojljV.exe
  2⤵
  PID:7960
- C:\Windows\System\NsCFdss.exe
  C:\Windows\System\NsCFdss.exe
  2⤵
  PID:7992
- C:\Windows\System\PCRnDDI.exe
  C:\Windows\System\PCRnDDI.exe
  2⤵
  PID:8012
- C:\Windows\System\XkBVakF.exe
  C:\Windows\System\XkBVakF.exe
  2⤵
  PID:8040
- C:\Windows\System\GnDqGJB.exe
  C:\Windows\System\GnDqGJB.exe
  2⤵
  PID:8068
- C:\Windows\System\uZqPRNc.exe
  C:\Windows\System\uZqPRNc.exe
  2⤵
  PID:8096
- C:\Windows\System\POsCuba.exe
  C:\Windows\System\POsCuba.exe
  2⤵
  PID:8140
- C:\Windows\System\wiguyHx.exe
  C:\Windows\System\wiguyHx.exe
  2⤵
  PID:8156
- C:\Windows\System\NnuxDBX.exe
  C:\Windows\System\NnuxDBX.exe
  2⤵
  PID:8184
- C:\Windows\System\ykDPbll.exe
  C:\Windows\System\ykDPbll.exe
  2⤵
  PID:7224
- C:\Windows\System\xPDMdPn.exe
  C:\Windows\System\xPDMdPn.exe
  2⤵
  PID:7296
- C:\Windows\System\LKruMiP.exe
  C:\Windows\System\LKruMiP.exe
  2⤵
  PID:7352
- C:\Windows\System\NfVYkxK.exe
  C:\Windows\System\NfVYkxK.exe
  2⤵
  PID:7420
- C:\Windows\System\sWxtmCB.exe
  C:\Windows\System\sWxtmCB.exe
  2⤵
  PID:7500
- C:\Windows\System\DQIDdeO.exe
  C:\Windows\System\DQIDdeO.exe
  2⤵
  PID:7560
- C:\Windows\System\sLvivaQ.exe
  C:\Windows\System\sLvivaQ.exe
  2⤵
  PID:7616
- C:\Windows\System\BYHtHKq.exe
  C:\Windows\System\BYHtHKq.exe
  2⤵
  PID:7692
- C:\Windows\System\jyUIXAl.exe
  C:\Windows\System\jyUIXAl.exe
  2⤵
  PID:7752
- C:\Windows\System\fmlUMdl.exe
  C:\Windows\System\fmlUMdl.exe
  2⤵
  PID:7812
- C:\Windows\System\HBmTgkd.exe
  C:\Windows\System\HBmTgkd.exe
  2⤵
  PID:7892
- C:\Windows\System\PLVnPwo.exe
  C:\Windows\System\PLVnPwo.exe
  2⤵
  PID:7952
- C:\Windows\System\iNuReQt.exe
  C:\Windows\System\iNuReQt.exe
  2⤵
  PID:8024
- C:\Windows\System\eoEuZaI.exe
  C:\Windows\System\eoEuZaI.exe
  2⤵
  PID:8088
- C:\Windows\System\iLAwnFO.exe
  C:\Windows\System\iLAwnFO.exe
  2⤵
  PID:8148
- C:\Windows\System\yVeKUcI.exe
  C:\Windows\System\yVeKUcI.exe
  2⤵
  PID:7216
- C:\Windows\System\IedYzEk.exe
  C:\Windows\System\IedYzEk.exe
  2⤵
  PID:7384
- C:\Windows\System\SrQUtaK.exe
  C:\Windows\System\SrQUtaK.exe
  2⤵
  PID:7532
- C:\Windows\System\VEeAQzR.exe
  C:\Windows\System\VEeAQzR.exe
  2⤵
  PID:7720
- C:\Windows\System\QgpfnBg.exe
  C:\Windows\System\QgpfnBg.exe
  2⤵
  PID:7808
- C:\Windows\System\RnHqUwA.exe
  C:\Windows\System\RnHqUwA.exe
  2⤵
  PID:8000
- C:\Windows\System\FIZspKv.exe
  C:\Windows\System\FIZspKv.exe
  2⤵
  PID:8136
- C:\Windows\System\tULvymd.exe
  C:\Windows\System\tULvymd.exe
  2⤵
  PID:7412
- C:\Windows\System\srDepWs.exe
  C:\Windows\System\srDepWs.exe
  2⤵
  PID:7780
- C:\Windows\System\frrAllM.exe
  C:\Windows\System\frrAllM.exe
  2⤵
  PID:8108
- C:\Windows\System\sAIcqoA.exe
  C:\Windows\System\sAIcqoA.exe
  2⤵
  PID:7924
- C:\Windows\System\lxjnPAE.exe
  C:\Windows\System\lxjnPAE.exe
  2⤵
  PID:8036
- C:\Windows\System\VXWYZAl.exe
  C:\Windows\System\VXWYZAl.exe
  2⤵
  PID:8216
- C:\Windows\System\rStQQcz.exe
  C:\Windows\System\rStQQcz.exe
  2⤵
  PID:8244
- C:\Windows\System\DWZcIfx.exe
  C:\Windows\System\DWZcIfx.exe
  2⤵
  PID:8272
- C:\Windows\System\EKsdAzd.exe
  C:\Windows\System\EKsdAzd.exe
  2⤵
  PID:8296
- C:\Windows\System\dZlfHEU.exe
  C:\Windows\System\dZlfHEU.exe
  2⤵
  PID:8328
- C:\Windows\System\NBthgZw.exe
  C:\Windows\System\NBthgZw.exe
  2⤵
  PID:8356
- C:\Windows\System\pfxweEm.exe
  C:\Windows\System\pfxweEm.exe
  2⤵
  PID:8384
- C:\Windows\System\csbJgrk.exe
  C:\Windows\System\csbJgrk.exe
  2⤵
  PID:8412
- C:\Windows\System\CwSvvFo.exe
  C:\Windows\System\CwSvvFo.exe
  2⤵
  PID:8440
- C:\Windows\System\cTRZfxZ.exe
  C:\Windows\System\cTRZfxZ.exe
  2⤵
  PID:8472
- C:\Windows\System\bPDtISf.exe
  C:\Windows\System\bPDtISf.exe
  2⤵
  PID:8496
- C:\Windows\System\yqXkGrU.exe
  C:\Windows\System\yqXkGrU.exe
  2⤵
  PID:8528
- C:\Windows\System\hXxSnxv.exe
  C:\Windows\System\hXxSnxv.exe
  2⤵
  PID:8552
- C:\Windows\System\looTPwG.exe
  C:\Windows\System\looTPwG.exe
  2⤵
  PID:8580
- C:\Windows\System\dWTeljq.exe
  C:\Windows\System\dWTeljq.exe
  2⤵
  PID:8604
- C:\Windows\System\bNyZYJQ.exe
  C:\Windows\System\bNyZYJQ.exe
  2⤵
  PID:8632
- C:\Windows\System\FwkJgTK.exe
  C:\Windows\System\FwkJgTK.exe
  2⤵
  PID:8660
- C:\Windows\System\eYhgwEf.exe
  C:\Windows\System\eYhgwEf.exe
  2⤵
  PID:8688
- C:\Windows\System\FvQAOhz.exe
  C:\Windows\System\FvQAOhz.exe
  2⤵
  PID:8716
- C:\Windows\System\GUtnixq.exe
  C:\Windows\System\GUtnixq.exe
  2⤵
  PID:8744
- C:\Windows\System\gCrLFVS.exe
  C:\Windows\System\gCrLFVS.exe
  2⤵
  PID:8768
- C:\Windows\System\gGXqdpJ.exe
  C:\Windows\System\gGXqdpJ.exe
  2⤵
  PID:8788
- C:\Windows\System\MEKIJDu.exe
  C:\Windows\System\MEKIJDu.exe
  2⤵
  PID:8812
- C:\Windows\System\EvANufW.exe
  C:\Windows\System\EvANufW.exe
  2⤵
  PID:8844
- C:\Windows\System\QQXVNxU.exe
  C:\Windows\System\QQXVNxU.exe
  2⤵
  PID:8872
- C:\Windows\System\onQMYGT.exe
  C:\Windows\System\onQMYGT.exe
  2⤵
  PID:8912
- C:\Windows\System\TUSBWCc.exe
  C:\Windows\System\TUSBWCc.exe
  2⤵
  PID:8928
- C:\Windows\System\GVXtQAb.exe
  C:\Windows\System\GVXtQAb.exe
  2⤵
  PID:8964
- C:\Windows\System\AUhkljE.exe
  C:\Windows\System\AUhkljE.exe
  2⤵
  PID:8988
- C:\Windows\System\HLHKXbB.exe
  C:\Windows\System\HLHKXbB.exe
  2⤵
  PID:9028
- C:\Windows\System\BhuWDLR.exe
  C:\Windows\System\BhuWDLR.exe
  2⤵
  PID:9044
- C:\Windows\System\koqpykj.exe
  C:\Windows\System\koqpykj.exe
  2⤵
  PID:9072
- C:\Windows\System\OGGIlsL.exe
  C:\Windows\System\OGGIlsL.exe
  2⤵
  PID:9100
- C:\Windows\System\BnAkksz.exe
  C:\Windows\System\BnAkksz.exe
  2⤵
  PID:9128
- C:\Windows\System\IvvtEIY.exe
  C:\Windows\System\IvvtEIY.exe
  2⤵
  PID:9168
- C:\Windows\System\wpPuMkh.exe
  C:\Windows\System\wpPuMkh.exe
  2⤵
  PID:9196
- C:\Windows\System\VJFAkny.exe
  C:\Windows\System\VJFAkny.exe
  2⤵
  PID:8208
- C:\Windows\System\YuqOiXa.exe
  C:\Windows\System\YuqOiXa.exe
  2⤵
  PID:8252
- C:\Windows\System\kgWfbZH.exe
  C:\Windows\System\kgWfbZH.exe
  2⤵
  PID:8316
- C:\Windows\System\ahoNKFT.exe
  C:\Windows\System\ahoNKFT.exe
  2⤵
  PID:8404
- C:\Windows\System\bZxxRhn.exe
  C:\Windows\System\bZxxRhn.exe
  2⤵
  PID:8480
- C:\Windows\System\BOJJVGV.exe
  C:\Windows\System\BOJJVGV.exe
  2⤵
  PID:8540
- C:\Windows\System\XngXXtr.exe
  C:\Windows\System\XngXXtr.exe
  2⤵
  PID:8572
- C:\Windows\System\LKwwceI.exe
  C:\Windows\System\LKwwceI.exe
  2⤵
  PID:8656
- C:\Windows\System\esQtddu.exe
  C:\Windows\System\esQtddu.exe
  2⤵
  PID:8700
- C:\Windows\System\JJRHtqu.exe
  C:\Windows\System\JJRHtqu.exe
  2⤵
  PID:8804
- C:\Windows\System\sXaLgpx.exe
  C:\Windows\System\sXaLgpx.exe
  2⤵
  PID:8800
- C:\Windows\System\WUdZDJJ.exe
  C:\Windows\System\WUdZDJJ.exe
  2⤵
  PID:8904
- C:\Windows\System\uHKENSn.exe
  C:\Windows\System\uHKENSn.exe
  2⤵
  PID:9008
- C:\Windows\System\tpDvOUk.exe
  C:\Windows\System\tpDvOUk.exe
  2⤵
  PID:9036
- C:\Windows\System\HhnrDGN.exe
  C:\Windows\System\HhnrDGN.exe
  2⤵
  PID:9120
- C:\Windows\System\IefOkcz.exe
  C:\Windows\System\IefOkcz.exe
  2⤵
  PID:9180
- C:\Windows\System\lGmhKDh.exe
  C:\Windows\System\lGmhKDh.exe
  2⤵
  PID:8204
- C:\Windows\System\lYywNQk.exe
  C:\Windows\System\lYywNQk.exe
  2⤵
  PID:8344
- C:\Windows\System\AFxCOrM.exe
  C:\Windows\System\AFxCOrM.exe
  2⤵
  PID:8516
- C:\Windows\System\jSJJNrs.exe
  C:\Windows\System\jSJJNrs.exe
  2⤵
  PID:7468
- C:\Windows\System\JLABoWc.exe
  C:\Windows\System\JLABoWc.exe
  2⤵
  PID:8824
- C:\Windows\System\OwSKrPU.exe
  C:\Windows\System\OwSKrPU.exe
  2⤵
  PID:8956
- C:\Windows\System\gLnOqyH.exe
  C:\Windows\System\gLnOqyH.exe
  2⤵
  PID:9096
- C:\Windows\System\OgacWaM.exe
  C:\Windows\System\OgacWaM.exe
  2⤵
  PID:8392
- C:\Windows\System\YmWAmTn.exe
  C:\Windows\System\YmWAmTn.exe
  2⤵
  PID:8684
- C:\Windows\System\LUMfKkT.exe
  C:\Windows\System\LUMfKkT.exe
  2⤵
  PID:8308
- C:\Windows\System\OAkJIXB.exe
  C:\Windows\System\OAkJIXB.exe
  2⤵
  PID:9016
- C:\Windows\System\MAdfaws.exe
  C:\Windows\System\MAdfaws.exe
  2⤵
  PID:9224
- C:\Windows\System\MOSWLXZ.exe
  C:\Windows\System\MOSWLXZ.exe
  2⤵
  PID:9252
- C:\Windows\System\IDTFTPQ.exe
  C:\Windows\System\IDTFTPQ.exe
  2⤵
  PID:9268
- C:\Windows\System\iFBVtQM.exe
  C:\Windows\System\iFBVtQM.exe
  2⤵
  PID:9296
- C:\Windows\System\pGCPVXR.exe
  C:\Windows\System\pGCPVXR.exe
  2⤵
  PID:9312
- C:\Windows\System\raEROJA.exe
  C:\Windows\System\raEROJA.exe
  2⤵
  PID:9364
- C:\Windows\System\nwyVPUY.exe
  C:\Windows\System\nwyVPUY.exe
  2⤵
  PID:9392
- C:\Windows\System\DPWWceU.exe
  C:\Windows\System\DPWWceU.exe
  2⤵
  PID:9416
- C:\Windows\System\XIChXTj.exe
  C:\Windows\System\XIChXTj.exe
  2⤵
  PID:9444
- C:\Windows\System\pbyXuEV.exe
  C:\Windows\System\pbyXuEV.exe
  2⤵
  PID:9480
- C:\Windows\System\PQciwzd.exe
  C:\Windows\System\PQciwzd.exe
  2⤵
  PID:9496
- C:\Windows\System\fXVSeWr.exe
  C:\Windows\System\fXVSeWr.exe
  2⤵
  PID:9524
- C:\Windows\System\QlBeIwq.exe
  C:\Windows\System\QlBeIwq.exe
  2⤵
  PID:9560
- C:\Windows\System\mMEHhOW.exe
  C:\Windows\System\mMEHhOW.exe
  2⤵
  PID:9580
- C:\Windows\System\gixwUKU.exe
  C:\Windows\System\gixwUKU.exe
  2⤵
  PID:9620
- C:\Windows\System\WICjqPF.exe
  C:\Windows\System\WICjqPF.exe
  2⤵
  PID:9648
- C:\Windows\System\EGtWVqB.exe
  C:\Windows\System\EGtWVqB.exe
  2⤵
  PID:9664
- C:\Windows\System\akqGuaL.exe
  C:\Windows\System\akqGuaL.exe
  2⤵
  PID:9684
- C:\Windows\System\DcfCYgo.exe
  C:\Windows\System\DcfCYgo.exe
  2⤵
  PID:9732
- C:\Windows\System\LXzUXda.exe
  C:\Windows\System\LXzUXda.exe
  2⤵
  PID:9756
- C:\Windows\System\IgvssKH.exe
  C:\Windows\System\IgvssKH.exe
  2⤵
  PID:9776
- C:\Windows\System\AZDCvcc.exe
  C:\Windows\System\AZDCvcc.exe
  2⤵
  PID:9792
- C:\Windows\System\gsmbQSA.exe
  C:\Windows\System\gsmbQSA.exe
  2⤵
  PID:9820
- C:\Windows\System\tRcCRpz.exe
  C:\Windows\System\tRcCRpz.exe
  2⤵
  PID:9852
- C:\Windows\System\dCprxVw.exe
  C:\Windows\System\dCprxVw.exe
  2⤵
  PID:9892
- C:\Windows\System\uZGFckp.exe
  C:\Windows\System\uZGFckp.exe
  2⤵
  PID:9908
- C:\Windows\System\GquiQwz.exe
  C:\Windows\System\GquiQwz.exe
  2⤵
  PID:9928
- C:\Windows\System\KfKPMcv.exe
  C:\Windows\System\KfKPMcv.exe
  2⤵
  PID:9948
- C:\Windows\System\yoXOccs.exe
  C:\Windows\System\yoXOccs.exe
  2⤵
  PID:9976
- C:\Windows\System\QkiuHxt.exe
  C:\Windows\System\QkiuHxt.exe
  2⤵
  PID:10004
- C:\Windows\System\gfBIydN.exe
  C:\Windows\System\gfBIydN.exe
  2⤵
  PID:10048
- C:\Windows\System\gHGWuBh.exe
  C:\Windows\System\gHGWuBh.exe
  2⤵
  PID:10080
- C:\Windows\System\xioggfU.exe
  C:\Windows\System\xioggfU.exe
  2⤵
  PID:10112
- C:\Windows\System\bBXaDwU.exe
  C:\Windows\System\bBXaDwU.exe
  2⤵
  PID:10148
- C:\Windows\System\xEzBDIq.exe
  C:\Windows\System\xEzBDIq.exe
  2⤵
  PID:10180
- C:\Windows\System\ItLtccd.exe
  C:\Windows\System\ItLtccd.exe
  2⤵
  PID:10208
- C:\Windows\System\OGIeueK.exe
  C:\Windows\System\OGIeueK.exe
  2⤵
  PID:10236
- C:\Windows\System\BZoROkP.exe
  C:\Windows\System\BZoROkP.exe
  2⤵
  PID:8984
- C:\Windows\System\maCrZci.exe
  C:\Windows\System\maCrZci.exe
  2⤵
  PID:9292
- C:\Windows\System\xkgedck.exe
  C:\Windows\System\xkgedck.exe
  2⤵
  PID:9388
- C:\Windows\System\lltKOGZ.exe
  C:\Windows\System\lltKOGZ.exe
  2⤵
  PID:9436
- C:\Windows\System\aWBfGid.exe
  C:\Windows\System\aWBfGid.exe
  2⤵
  PID:9516
- C:\Windows\System\doExQiC.exe
  C:\Windows\System\doExQiC.exe
  2⤵
  PID:9572
- C:\Windows\System\XbNBSLb.exe
  C:\Windows\System\XbNBSLb.exe
  2⤵
  PID:9660
- C:\Windows\System\nQzmlUZ.exe
  C:\Windows\System\nQzmlUZ.exe
  2⤵
  PID:9708
- C:\Windows\System\XmufIsA.exe
  C:\Windows\System\XmufIsA.exe
  2⤵
  PID:9764
- C:\Windows\System\iWqQFDV.exe
  C:\Windows\System\iWqQFDV.exe
  2⤵
  PID:9784
- C:\Windows\System\DqUWjTQ.exe
  C:\Windows\System\DqUWjTQ.exe
  2⤵
  PID:9876
- C:\Windows\System\ZgAUvNE.exe
  C:\Windows\System\ZgAUvNE.exe
  2⤵
  PID:9968
- C:\Windows\System\aiFpTGr.exe
  C:\Windows\System\aiFpTGr.exe
  2⤵
  PID:10064
- C:\Windows\System\VNyxilo.exe
  C:\Windows\System\VNyxilo.exe
  2⤵
  PID:10100
- C:\Windows\System\bLVirhC.exe
  C:\Windows\System\bLVirhC.exe
  2⤵
  PID:10172
- C:\Windows\System\zbZIIkh.exe
  C:\Windows\System\zbZIIkh.exe
  2⤵
  PID:10232
- C:\Windows\System\bLrDPJF.exe
  C:\Windows\System\bLrDPJF.exe
  2⤵
  PID:9356
- C:\Windows\System\KbQLsie.exe
  C:\Windows\System\KbQLsie.exe
  2⤵
  PID:9400
- C:\Windows\System\PlYUSJn.exe
  C:\Windows\System\PlYUSJn.exe
  2⤵
  PID:9644
- C:\Windows\System\UmUzQiZ.exe
  C:\Windows\System\UmUzQiZ.exe
  2⤵
  PID:9812
- C:\Windows\System\EamqZPF.exe
  C:\Windows\System\EamqZPF.exe
  2⤵
  PID:9944
- C:\Windows\System\UkTmZkQ.exe
  C:\Windows\System\UkTmZkQ.exe
  2⤵
  PID:10016
- C:\Windows\System\zKixpmJ.exe
  C:\Windows\System\zKixpmJ.exe
  2⤵
  PID:9248
- C:\Windows\System\hHfMurD.exe
  C:\Windows\System\hHfMurD.exe
  2⤵
  PID:9428
- C:\Windows\System\ozSHsLs.exe
  C:\Windows\System\ozSHsLs.exe
  2⤵
  PID:9836
- C:\Windows\System\mPTBwuU.exe
  C:\Windows\System\mPTBwuU.exe
  2⤵
  PID:10024
- C:\Windows\System\escvNja.exe
  C:\Windows\System\escvNja.exe
  2⤵
  PID:9924
- C:\Windows\System\vBLxvyO.exe
  C:\Windows\System\vBLxvyO.exe
  2⤵
  PID:10244
- C:\Windows\System\Ushgqrt.exe
  C:\Windows\System\Ushgqrt.exe
  2⤵
  PID:10280
- C:\Windows\System\bEEPVHq.exe
  C:\Windows\System\bEEPVHq.exe
  2⤵
  PID:10296
- C:\Windows\System\oWNBYYi.exe
  C:\Windows\System\oWNBYYi.exe
  2⤵
  PID:10336
- C:\Windows\System\sJDxRfa.exe
  C:\Windows\System\sJDxRfa.exe
  2⤵
  PID:10364
- C:\Windows\System\tQotjaj.exe
  C:\Windows\System\tQotjaj.exe
  2⤵
  PID:10392
- C:\Windows\System\AYMHAns.exe
  C:\Windows\System\AYMHAns.exe
  2⤵
  PID:10420
- C:\Windows\System\rvgNhaz.exe
  C:\Windows\System\rvgNhaz.exe
  2⤵
  PID:10436
- C:\Windows\System\NhRbnOB.exe
  C:\Windows\System\NhRbnOB.exe
  2⤵
  PID:10472
- C:\Windows\System\ihhuoAT.exe
  C:\Windows\System\ihhuoAT.exe
  2⤵
  PID:10492
- C:\Windows\System\zcfwVyP.exe
  C:\Windows\System\zcfwVyP.exe
  2⤵
  PID:10524
- C:\Windows\System\DcsZWKO.exe
  C:\Windows\System\DcsZWKO.exe
  2⤵
  PID:10556
- C:\Windows\System\srGAgTa.exe
  C:\Windows\System\srGAgTa.exe
  2⤵
  PID:10584
- C:\Windows\System\WaUDhqE.exe
  C:\Windows\System\WaUDhqE.exe
  2⤵
  PID:10616
- C:\Windows\System\zFWQqap.exe
  C:\Windows\System\zFWQqap.exe
  2⤵
  PID:10632
- C:\Windows\System\iRQBPnW.exe
  C:\Windows\System\iRQBPnW.exe
  2⤵
  PID:10660
- C:\Windows\System\hNgIcNt.exe
  C:\Windows\System\hNgIcNt.exe
  2⤵
  PID:10688
- C:\Windows\System\lbnQzOC.exe
  C:\Windows\System\lbnQzOC.exe
  2⤵
  PID:10728
- C:\Windows\System\GAwQQJa.exe
  C:\Windows\System\GAwQQJa.exe
  2⤵
  PID:10744
- C:\Windows\System\SfqyOoM.exe
  C:\Windows\System\SfqyOoM.exe
  2⤵
  PID:10772
- C:\Windows\System\lrJMyhp.exe
  C:\Windows\System\lrJMyhp.exe
  2⤵
  PID:10808
- C:\Windows\System\QJommdE.exe
  C:\Windows\System\QJommdE.exe
  2⤵
  PID:10828
- C:\Windows\System\NIrvYPq.exe
  C:\Windows\System\NIrvYPq.exe
  2⤵
  PID:10868
- C:\Windows\System\TJdfhEI.exe
  C:\Windows\System\TJdfhEI.exe
  2⤵
  PID:10884
- C:\Windows\System\HqSuFud.exe
  C:\Windows\System\HqSuFud.exe
  2⤵
  PID:10920
- C:\Windows\System\mxfoDsO.exe
  C:\Windows\System\mxfoDsO.exe
  2⤵
  PID:10940
- C:\Windows\System\NDDshUT.exe
  C:\Windows\System\NDDshUT.exe
  2⤵
  PID:10968
- C:\Windows\System\NUnIsNs.exe
  C:\Windows\System\NUnIsNs.exe
  2⤵
  PID:11004
- C:\Windows\System\Ynmvwex.exe
  C:\Windows\System\Ynmvwex.exe
  2⤵
  PID:11036
- C:\Windows\System\nRdbOre.exe
  C:\Windows\System\nRdbOre.exe
  2⤵
  PID:11052
- C:\Windows\System\BoEpvCw.exe
  C:\Windows\System\BoEpvCw.exe
  2⤵
  PID:11088
- C:\Windows\System\JANtlfX.exe
  C:\Windows\System\JANtlfX.exe
  2⤵
  PID:11120
- C:\Windows\System\ugOVDGA.exe
  C:\Windows\System\ugOVDGA.exe
  2⤵
  PID:11140
- C:\Windows\System\LrYJexn.exe
  C:\Windows\System\LrYJexn.exe
  2⤵
  PID:11176
- C:\Windows\System\qUGmKUL.exe
  C:\Windows\System\qUGmKUL.exe
  2⤵
  PID:11204
- C:\Windows\System\horsNgA.exe
  C:\Windows\System\horsNgA.exe
  2⤵
  PID:11232
- C:\Windows\System\KzQmcVv.exe
  C:\Windows\System\KzQmcVv.exe
  2⤵
  PID:11260
- C:\Windows\System\VpQxxUs.exe
  C:\Windows\System\VpQxxUs.exe
  2⤵
  PID:10292
- C:\Windows\System\PTiKDkt.exe
  C:\Windows\System\PTiKDkt.exe
  2⤵
  PID:10356
- C:\Windows\System\ovwoCQh.exe
  C:\Windows\System\ovwoCQh.exe
  2⤵
  PID:10416
- C:\Windows\System\PLnpbKC.exe
  C:\Windows\System\PLnpbKC.exe
  2⤵
  PID:10480
- C:\Windows\System\PmbxyIz.exe
  C:\Windows\System\PmbxyIz.exe
  2⤵
  PID:10532
- C:\Windows\System\JKdxKYg.exe
  C:\Windows\System\JKdxKYg.exe
  2⤵
  PID:10600
- C:\Windows\System\WZatHkh.exe
  C:\Windows\System\WZatHkh.exe
  2⤵
  PID:10652
- C:\Windows\System\yeWwFrD.exe
  C:\Windows\System\yeWwFrD.exe
  2⤵
  PID:10672
- C:\Windows\System\rscDwJZ.exe
  C:\Windows\System\rscDwJZ.exe
  2⤵
  PID:10800
- C:\Windows\System\HrYfbXH.exe
  C:\Windows\System\HrYfbXH.exe
  2⤵
  PID:10844
- C:\Windows\System\PVGqauJ.exe
  C:\Windows\System\PVGqauJ.exe
  2⤵
  PID:10908
- C:\Windows\System\ENXuFcN.exe
  C:\Windows\System\ENXuFcN.exe
  2⤵
  PID:11012
- C:\Windows\System\glzDASb.exe
  C:\Windows\System\glzDASb.exe
  2⤵
  PID:11048
- C:\Windows\System\bAAANbk.exe
  C:\Windows\System\bAAANbk.exe
  2⤵
  PID:11116
- C:\Windows\System\LPpntQA.exe
  C:\Windows\System\LPpntQA.exe
  2⤵
  PID:11192
- C:\Windows\System\JsWSfCY.exe
  C:\Windows\System\JsWSfCY.exe
  2⤵
  PID:11244
- C:\Windows\System\IicHRPW.exe
  C:\Windows\System\IicHRPW.exe
  2⤵
  PID:10404
- C:\Windows\System\mbHTxoT.exe
  C:\Windows\System\mbHTxoT.exe
  2⤵
  PID:10516
- C:\Windows\System\RZqlaRe.exe
  C:\Windows\System\RZqlaRe.exe
  2⤵
  PID:10684
- C:\Windows\System\hvQAVkd.exe
  C:\Windows\System\hvQAVkd.exe
  2⤵
  PID:10848
- C:\Windows\System\tPTIdKa.exe
  C:\Windows\System\tPTIdKa.exe
  2⤵
  PID:10964
- C:\Windows\System\VkwirqZ.exe
  C:\Windows\System\VkwirqZ.exe
  2⤵
  PID:11160
- C:\Windows\System\tDlvBJi.exe
  C:\Windows\System\tDlvBJi.exe
  2⤵
  PID:10332
- C:\Windows\System\uxXdmJr.exe
  C:\Windows\System\uxXdmJr.exe
  2⤵
  PID:10576
- C:\Windows\System\fMblgeP.exe
  C:\Windows\System\fMblgeP.exe
  2⤵
  PID:11248
- C:\Windows\System\hzacQPQ.exe
  C:\Windows\System\hzacQPQ.exe
  2⤵
  PID:10736
- C:\Windows\System\IKCoKFA.exe
  C:\Windows\System\IKCoKFA.exe
  2⤵
  PID:11148
- C:\Windows\System\ROKlhYj.exe
  C:\Windows\System\ROKlhYj.exe
  2⤵
  PID:11272
- C:\Windows\System\eVvfMJm.exe
  C:\Windows\System\eVvfMJm.exe
  2⤵
  PID:11312
- C:\Windows\System\XscUUEh.exe
  C:\Windows\System\XscUUEh.exe
  2⤵
  PID:11336
- C:\Windows\System\yjNTQva.exe
  C:\Windows\System\yjNTQva.exe
  2⤵
  PID:11356
- C:\Windows\System\xwqwINk.exe
  C:\Windows\System\xwqwINk.exe
  2⤵
  PID:11392
- C:\Windows\System\KbUEVqx.exe
  C:\Windows\System\KbUEVqx.exe
  2⤵
  PID:11412
- C:\Windows\System\ZVLzCIO.exe
  C:\Windows\System\ZVLzCIO.exe
  2⤵
  PID:11440
- C:\Windows\System\xxiQevG.exe
  C:\Windows\System\xxiQevG.exe
  2⤵
  PID:11480
- C:\Windows\System\rrhTVIW.exe
  C:\Windows\System\rrhTVIW.exe
  2⤵
  PID:11500
- C:\Windows\System\ITqGClG.exe
  C:\Windows\System\ITqGClG.exe
  2⤵
  PID:11524
- C:\Windows\System\RPLTJSl.exe
  C:\Windows\System\RPLTJSl.exe
  2⤵
  PID:11540
- C:\Windows\System\ySnzYcU.exe
  C:\Windows\System\ySnzYcU.exe
  2⤵
  PID:11592
- C:\Windows\System\FQSyVmK.exe
  C:\Windows\System\FQSyVmK.exe
  2⤵
  PID:11620
- C:\Windows\System\vVdsCdc.exe
  C:\Windows\System\vVdsCdc.exe
  2⤵
  PID:11648
- C:\Windows\System\yNEyfGo.exe
  C:\Windows\System\yNEyfGo.exe
  2⤵
  PID:11664
- C:\Windows\System\PJdGgZr.exe
  C:\Windows\System\PJdGgZr.exe
  2⤵
  PID:11704
- C:\Windows\System\dIIJRww.exe
  C:\Windows\System\dIIJRww.exe
  2⤵
  PID:11732
- C:\Windows\System\mBONYeI.exe
  C:\Windows\System\mBONYeI.exe
  2⤵
  PID:11748
- C:\Windows\System\ranTXol.exe
  C:\Windows\System\ranTXol.exe
  2⤵
  PID:11780
- C:\Windows\System\LJyKjNo.exe
  C:\Windows\System\LJyKjNo.exe
  2⤵
  PID:11816
- C:\Windows\System\PBpAkRY.exe
  C:\Windows\System\PBpAkRY.exe
  2⤵
  PID:11844
- C:\Windows\System\zLuVbeT.exe
  C:\Windows\System\zLuVbeT.exe
  2⤵
  PID:11860
- C:\Windows\System\BcMoZiz.exe
  C:\Windows\System\BcMoZiz.exe
  2⤵
  PID:11888
- C:\Windows\System\nBURZMa.exe
  C:\Windows\System\nBURZMa.exe
  2⤵
  PID:11904
- C:\Windows\System\MARgexo.exe
  C:\Windows\System\MARgexo.exe
  2⤵
  PID:11956
- C:\Windows\System\PozodRP.exe
  C:\Windows\System\PozodRP.exe
  2⤵
  PID:11984
- C:\Windows\System\bEiDlAI.exe
  C:\Windows\System\bEiDlAI.exe
  2⤵
  PID:12000
- C:\Windows\System\DlZDBuh.exe
  C:\Windows\System\DlZDBuh.exe
  2⤵
  PID:12044
- C:\Windows\System\YhTgzxQ.exe
  C:\Windows\System\YhTgzxQ.exe
  2⤵
  PID:12072
- C:\Windows\System\rkoKvMk.exe
  C:\Windows\System\rkoKvMk.exe
  2⤵
  PID:12100
- C:\Windows\System\GDHvOTt.exe
  C:\Windows\System\GDHvOTt.exe
  2⤵
  PID:12116
- C:\Windows\System\bIKZznl.exe
  C:\Windows\System\bIKZznl.exe
  2⤵
  PID:12156
- C:\Windows\System\KkBpYfC.exe
  C:\Windows\System\KkBpYfC.exe
  2⤵
  PID:12184
- C:\Windows\System\UPXfrTG.exe
  C:\Windows\System\UPXfrTG.exe
  2⤵
  PID:12212
- C:\Windows\System\tXzYwCg.exe
  C:\Windows\System\tXzYwCg.exe
  2⤵
  PID:12228
- C:\Windows\System\soIRQOq.exe
  C:\Windows\System\soIRQOq.exe
  2⤵
  PID:12244
- C:\Windows\System\cfTiydB.exe
  C:\Windows\System\cfTiydB.exe
  2⤵
  PID:12284
- C:\Windows\System\EftCnsn.exe
  C:\Windows\System\EftCnsn.exe
  2⤵
  PID:11328
- C:\Windows\System\cgTzKre.exe
  C:\Windows\System\cgTzKre.exe
  2⤵
  PID:4088
- C:\Windows\System\VFDzrxP.exe
  C:\Windows\System\VFDzrxP.exe
  2⤵
  PID:11424
- C:\Windows\System\FWteWWa.exe
  C:\Windows\System\FWteWWa.exe
  2⤵
  PID:11472
- C:\Windows\System\CNvHSku.exe
  C:\Windows\System\CNvHSku.exe
  2⤵
  PID:11584
- C:\Windows\System\wbBpIiq.exe
  C:\Windows\System\wbBpIiq.exe
  2⤵
  PID:11644
- C:\Windows\System\BPrPhcq.exe
  C:\Windows\System\BPrPhcq.exe
  2⤵
  PID:11716
- C:\Windows\System\mCOquLB.exe
  C:\Windows\System\mCOquLB.exe
  2⤵
  PID:11768
- C:\Windows\System\bPHyvCx.exe
  C:\Windows\System\bPHyvCx.exe
  2⤵
  PID:11824
- C:\Windows\System\oeTQKes.exe
  C:\Windows\System\oeTQKes.exe
  2⤵
  PID:11872
- C:\Windows\System\ZblWYuC.exe
  C:\Windows\System\ZblWYuC.exe
  2⤵
  PID:11952
- C:\Windows\System\arzxMqZ.exe
  C:\Windows\System\arzxMqZ.exe
  2⤵
  PID:12032
- C:\Windows\System\XGkgQfN.exe
  C:\Windows\System\XGkgQfN.exe
  2⤵
  PID:12096
- C:\Windows\System\zGdCcyd.exe
  C:\Windows\System\zGdCcyd.exe
  2⤵
  PID:12172
- C:\Windows\System\vftjYdK.exe
  C:\Windows\System\vftjYdK.exe
  2⤵
  PID:12240
- C:\Windows\System\sXxBzgX.exe
  C:\Windows\System\sXxBzgX.exe
  2⤵
  PID:11308
- C:\Windows\System\hSSJpbb.exe
  C:\Windows\System\hSSJpbb.exe
  2⤵
  PID:11428
- C:\Windows\System\isuKIBj.exe
  C:\Windows\System\isuKIBj.exe
  2⤵
  PID:11532
- C:\Windows\System\QMuDqxK.exe
  C:\Windows\System\QMuDqxK.exe
  2⤵
  PID:11632
- C:\Windows\System\WNxGzBb.exe
  C:\Windows\System\WNxGzBb.exe
  2⤵
  PID:11840
- C:\Windows\System\PQGqRmZ.exe
  C:\Windows\System\PQGqRmZ.exe
  2⤵
  PID:12020
- C:\Windows\System\vKaKVZu.exe
  C:\Windows\System\vKaKVZu.exe
  2⤵
  PID:12092
- C:\Windows\System\TdZnfbV.exe
  C:\Windows\System\TdZnfbV.exe
  2⤵
  PID:11288
- C:\Windows\System\EaBDhoH.exe
  C:\Windows\System\EaBDhoH.exe
  2⤵
  PID:11760
- C:\Windows\System\yHQFSdJ.exe
  C:\Windows\System\yHQFSdJ.exe
  2⤵
  PID:11980
- C:\Windows\System\DUZuVjO.exe
  C:\Windows\System\DUZuVjO.exe
  2⤵
  PID:11400
- C:\Windows\System\rkKWifa.exe
  C:\Windows\System\rkKWifa.exe
  2⤵
  PID:11928
- C:\Windows\System\rghvtJa.exe
  C:\Windows\System\rghvtJa.exe
  2⤵
  PID:12208
- C:\Windows\System\eGDtNAL.exe
  C:\Windows\System\eGDtNAL.exe
  2⤵
  PID:12312
- C:\Windows\System\lqGOuSE.exe
  C:\Windows\System\lqGOuSE.exe
  2⤵
  PID:12336
- C:\Windows\System\kCurKZC.exe
  C:\Windows\System\kCurKZC.exe
  2⤵
  PID:12380
- C:\Windows\System\fxQeETK.exe
  C:\Windows\System\fxQeETK.exe
  2⤵
  PID:12408
- C:\Windows\System\rfpseRd.exe
  C:\Windows\System\rfpseRd.exe
  2⤵
  PID:12436
- C:\Windows\System\SIDJqNe.exe
  C:\Windows\System\SIDJqNe.exe
  2⤵
  PID:12464
- C:\Windows\System\svyDbgH.exe
  C:\Windows\System\svyDbgH.exe
  2⤵
  PID:12492
- C:\Windows\System\BOGJRpJ.exe
  C:\Windows\System\BOGJRpJ.exe
  2⤵
  PID:12520
- C:\Windows\System\DzWyUXN.exe
  C:\Windows\System\DzWyUXN.exe
  2⤵
  PID:12536
- C:\Windows\System\YxjtlAX.exe
  C:\Windows\System\YxjtlAX.exe
  2⤵
  PID:12568
- C:\Windows\System\hxHOHeM.exe
  C:\Windows\System\hxHOHeM.exe
  2⤵
  PID:12592
- C:\Windows\System\ckkQZPW.exe
  C:\Windows\System\ckkQZPW.exe
  2⤵
  PID:12620
- C:\Windows\System\qNKcNzH.exe
  C:\Windows\System\qNKcNzH.exe
  2⤵
  PID:12656
- C:\Windows\System\MervAVW.exe
  C:\Windows\System\MervAVW.exe
  2⤵
  PID:12688
- C:\Windows\System\uFUAEHY.exe
  C:\Windows\System\uFUAEHY.exe
  2⤵
  PID:12716
- C:\Windows\System\xNZjDSB.exe
  C:\Windows\System\xNZjDSB.exe
  2⤵
  PID:12752
- C:\Windows\System\IeIbEgA.exe
  C:\Windows\System\IeIbEgA.exe
  2⤵
  PID:12780
- C:\Windows\System\tUdFyQB.exe
  C:\Windows\System\tUdFyQB.exe
  2⤵
  PID:12800
- C:\Windows\System\hgWRpOS.exe
  C:\Windows\System\hgWRpOS.exe
  2⤵
  PID:12828
- C:\Windows\System\jGPtZiE.exe
  C:\Windows\System\jGPtZiE.exe
  2⤵
  PID:12868
- C:\Windows\System\CpUKKal.exe
  C:\Windows\System\CpUKKal.exe
  2⤵
  PID:12896
- C:\Windows\System\AqRkdka.exe
  C:\Windows\System\AqRkdka.exe
  2⤵
  PID:12932
- C:\Windows\System\xHyTlRY.exe
  C:\Windows\System\xHyTlRY.exe
  2⤵
  PID:12960
- C:\Windows\System\BeonhAa.exe
  C:\Windows\System\BeonhAa.exe
  2⤵
  PID:12976
- C:\Windows\System\qHZsCnS.exe
  C:\Windows\System\qHZsCnS.exe
  2⤵
  PID:13016
- C:\Windows\System\phopQKG.exe
  C:\Windows\System\phopQKG.exe
  2⤵
  PID:13032
- C:\Windows\System\MHHEDpw.exe
  C:\Windows\System\MHHEDpw.exe
  2⤵
  PID:13060
- C:\Windows\System\VaeZOFK.exe
  C:\Windows\System\VaeZOFK.exe
  2⤵
  PID:13092
- C:\Windows\System\dzjnBMK.exe
  C:\Windows\System\dzjnBMK.exe
  2⤵
  PID:13116
- C:\Windows\System\uiHwCCI.exe
  C:\Windows\System\uiHwCCI.exe
  2⤵
  PID:13132
- C:\Windows\System\UnqFSAU.exe
  C:\Windows\System\UnqFSAU.exe
  2⤵
  PID:13168
- C:\Windows\System\StRWToL.exe
  C:\Windows\System\StRWToL.exe
  2⤵
  PID:13208
- C:\Windows\System\KXoeFSK.exe
  C:\Windows\System\KXoeFSK.exe
  2⤵
  PID:13228
- C:\Windows\System\GFmNCNR.exe
  C:\Windows\System\GFmNCNR.exe
  2⤵
  PID:13268
- C:\Windows\System\wltwtsO.exe
  C:\Windows\System\wltwtsO.exe
  2⤵
  PID:13296
- C:\Windows\System\zqIbLjX.exe
  C:\Windows\System\zqIbLjX.exe
  2⤵
  PID:12324
- C:\Windows\System\nFamibM.exe
  C:\Windows\System\nFamibM.exe
  2⤵
  PID:12376
- C:\Windows\System\UXpaXVa.exe
  C:\Windows\System\UXpaXVa.exe
  2⤵
  PID:12432
- C:\Windows\System\jTEqDIp.exe
  C:\Windows\System\jTEqDIp.exe
  2⤵
  PID:12484
- C:\Windows\System\ThgZrxB.exe
  C:\Windows\System\ThgZrxB.exe
  2⤵
  PID:12564
- C:\Windows\System\jvyRKBa.exe
  C:\Windows\System\jvyRKBa.exe
  2⤵
  PID:12604
- C:\Windows\System\kfwuaiJ.exe
  C:\Windows\System\kfwuaiJ.exe
  2⤵
  PID:12668
- C:\Windows\System\UrSMxTW.exe
  C:\Windows\System\UrSMxTW.exe
  2⤵
  PID:12764
- C:\Windows\System\fGSwJAY.exe
  C:\Windows\System\fGSwJAY.exe
  2⤵
  PID:12820
- C:\Windows\System\PwvenKL.exe
  C:\Windows\System\PwvenKL.exe
  2⤵
  PID:12908
- C:\Windows\System\EOiHLVL.exe
  C:\Windows\System\EOiHLVL.exe
  2⤵
  PID:13004
- C:\Windows\System\ZMclmjk.exe
  C:\Windows\System\ZMclmjk.exe
  2⤵
  PID:13012
- C:\Windows\System\HugDJDL.exe
  C:\Windows\System\HugDJDL.exe
  2⤵
  PID:13088
- C:\Windows\System\AfnWNqL.exe
  C:\Windows\System\AfnWNqL.exe
  2⤵
  PID:13200
- C:\Windows\System\kXAFvur.exe
  C:\Windows\System\kXAFvur.exe
  2⤵
  PID:13220
- C:\Windows\System\ihFQZKu.exe
  C:\Windows\System\ihFQZKu.exe
  2⤵
  PID:13256
- C:\Windows\System\QGffqgm.exe
  C:\Windows\System\QGffqgm.exe
  2⤵
  PID:13308
- C:\Windows\System\OHQRCKG.exe
  C:\Windows\System\OHQRCKG.exe
  2⤵
  PID:12508
- C:\Windows\System\NuyaYZC.exe
  C:\Windows\System\NuyaYZC.exe
  2⤵
  PID:12700
- C:\Windows\System\EmetVjL.exe
  C:\Windows\System\EmetVjL.exe
  2⤵
  PID:12864
- C:\Windows\System\XAOfXeg.exe
  C:\Windows\System\XAOfXeg.exe
  2⤵
  PID:13104
- C:\Windows\System\DowUBLL.exe
  C:\Windows\System\DowUBLL.exe
  2⤵
  PID:13156
- C:\Windows\System\WgUbrZg.exe
  C:\Windows\System\WgUbrZg.exe
  2⤵
  PID:13288
- C:\Windows\System\wIORuYr.exe
  C:\Windows\System\wIORuYr.exe
  2⤵
  PID:12732
- C:\Windows\System\gLCEPhc.exe
  C:\Windows\System\gLCEPhc.exe
  2⤵
  PID:12972
- C:\Windows\System\UPGvJKi.exe
  C:\Windows\System\UPGvJKi.exe
  2⤵
  PID:12640
- C:\Windows\System\auRqRaz.exe
  C:\Windows\System\auRqRaz.exe
  2⤵
  PID:12968
- C:\Windows\System\wVtgiTJ.exe
  C:\Windows\System\wVtgiTJ.exe
  2⤵
  PID:13320
- C:\Windows\System\ZwlgiNs.exe
  C:\Windows\System\ZwlgiNs.exe
  2⤵
  PID:13360
- C:\Windows\System\Xpugunt.exe
  C:\Windows\System\Xpugunt.exe
  2⤵
  PID:13376
- C:\Windows\System\skvLsWI.exe
  C:\Windows\System\skvLsWI.exe
  2⤵
  PID:13408
- C:\Windows\System\xaINNfn.exe
  C:\Windows\System\xaINNfn.exe
  2⤵
  PID:13432
- C:\Windows\System\HyVBand.exe
  C:\Windows\System\HyVBand.exe
  2⤵
  PID:13472
- C:\Windows\System\QxXbnYw.exe
  C:\Windows\System\QxXbnYw.exe
  2⤵
  PID:13500
- C:\Windows\System\mLriQFl.exe
  C:\Windows\System\mLriQFl.exe
  2⤵
  PID:13528
- C:\Windows\System\ZINOffj.exe
  C:\Windows\System\ZINOffj.exe
  2⤵
  PID:13544
- C:\Windows\System\XDDSOhu.exe
  C:\Windows\System\XDDSOhu.exe
  2⤵
  PID:13584
- C:\Windows\System\ZbpSWix.exe
  C:\Windows\System\ZbpSWix.exe
  2⤵
  PID:13612
- C:\Windows\System\pblrkyi.exe
  C:\Windows\System\pblrkyi.exe
  2⤵
  PID:13640
- C:\Windows\System\nZswsTL.exe
  C:\Windows\System\nZswsTL.exe
  2⤵
  PID:13668
- C:\Windows\System\gzkCYgP.exe
  C:\Windows\System\gzkCYgP.exe
  2⤵
  PID:13688
- C:\Windows\System\uysZWJE.exe
  C:\Windows\System\uysZWJE.exe
  2⤵
  PID:13724
- C:\Windows\System\ikKZEbv.exe
  C:\Windows\System\ikKZEbv.exe
  2⤵
  PID:13740
- C:\Windows\System\yzGKMbK.exe
  C:\Windows\System\yzGKMbK.exe
  2⤵
  PID:13780
- C:\Windows\System\AkwnHhj.exe
  C:\Windows\System\AkwnHhj.exe
  2⤵
  PID:13900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AeqIEPg.exe

Filesize
2.6MB

MD5
f0f640af654b3710e8c9b4018b6aaa99

SHA1
ff6a2e3ed688b04d1d293d91b7a832a40fa7d54e

SHA256
6465aa9db7415a8069ad4866b1063e411240c8b743bdc400cb67649748fa68cf

SHA512
99909dfd78a8c5d65df3d24bacb33d692624b563a0242e192ad10afde4e5bb7d7af1b40ae06d401f50e90f64c241e816d191ed7d9086685eed1d5b79ef45a7d9

Download Submit
C:\Windows\System\Aerrnmw.exe

Filesize
2.6MB

MD5
54ac8fd571d767093f52a357ddb9178f

SHA1
aadf2821116d443c776484d2d6333ebe9e438943

SHA256
7f125117b675e4a4d60c6be599f8f6838c46b42f5b21eeea58f4ec7d25d3d69a

SHA512
40382145a69f3de253a3534f3f73f6ef94fd45ab19c81a4fe0f520e1362cb71df4642b6aec953821055009c281e85b9c5f8542cae29bcc0a3296c777238c6303

Download Submit
C:\Windows\System\EFzRuMn.exe

Filesize
2.6MB

MD5
978ffa5184f4f78fdeb63a761aeca83a

SHA1
fa5e14e8d40f0e47a2740e4b9ae863217e71de0c

SHA256
84731a9ea92a211d04514a1fdf1fc011ef66459a034080a1c9276b9f14659608

SHA512
c91ca1cacc9f0a1afeeb8416deff425ac98cd97c0614a9de1864db60dbe6b5176e86f904680aad49886765d7a6a735afbe2b8b713031d0adbf7c9a099867efc2

Download Submit
C:\Windows\System\FxoGcwZ.exe

Filesize
2.6MB

MD5
1f83731c99477f6c422784846a473764

SHA1
5b406ce7d8413e964ef2917dae9dfc20fb2af3c1

SHA256
7c9777e31ef5708d237c1ba3fa393293dd8d87a0fa820650a36a56044996aa8a

SHA512
737114cfe140bef26bdfa9a503e11bb125fcbbf8bb841fe11dc8d675eb7d9cfd854f3f959a8223b424fa4b62847bfe57b710f06ba163be33a8af27db9888c65c

Download Submit
C:\Windows\System\JKVVNHz.exe

Filesize
2.6MB

MD5
55ac81d6752bf24de9f6c9d04efcfbad

SHA1
09a2735c2030ddc7260a857b6ebd2d0e0a0c7124

SHA256
8f7185b4fbe98e5fcea4d07df19f1b9196a45dfe88c54974033228589225e8d6

SHA512
a9b4fde5ab3c480b08a933366af46c3b64cdc4ebfd527d56e942b83b3eef18be26b59ac4d268c17e1be45d3464ef8d225c9c71b728a3f171ccbe14903220517e

Download Submit
C:\Windows\System\KVJjoDg.exe

Filesize
2.6MB

MD5
16461b5244d7866cdba71bd28a4a4980

SHA1
fe4804987d60d03930d17dbada44a28b4145fca6

SHA256
04694f1f1673854b8f578079a4705881f05bcfb0e6b9d94f506ead02a9085899

SHA512
bf00ac115db912be62412b2d26e79e0dfde56b1a3caeed45037526129ce633573b084afd7b424c6a3b103823bcaa7180ea503a4399f288099cb5b40dde0dd01e

Download Submit
C:\Windows\System\LsBJeXn.exe

Filesize
2.6MB

MD5
a78707eaff9a0640b5e070cf732cb002

SHA1
75ff669474acbb72cff82c36d205dbbaf4c69a5f

SHA256
3518a55c5ff33224a0f125dc6c43ffe77533cb5a3f935988dcb957d07bf74708

SHA512
0f314bcfd10e10beb611506352cd2f76f84849a5bb75af754d117e5dc89a739b9a641feb2cf8d504f64c31b21ac3fba275b9f9b103879c03a686e5cd158e056d

Download Submit
C:\Windows\System\MaSYOex.exe

Filesize
2.6MB

MD5
367ce3c82b0b7bc9464af00bdda86922

SHA1
1608eea0744acc84c587549a7b9cea75314d4b8c

SHA256
a33f0020ff52edff27af2cc726883a2a706569358d64d3d5c741997630c89595

SHA512
22b43b3e036a13eb39dfe82f928d13885c4fac2837c0a3823d1e5b0eac9e493c7d6e1464586f932a7717be96e0fd8d882893b50b97334e8d880db1a91f4d68b6

Download Submit
C:\Windows\System\OQpbRzQ.exe

Filesize
2.6MB

MD5
92ea2c23a0ab5e989cb03680bae1b055

SHA1
ed5d3c3fa0243e2111d2495403be9db3092c63f2

SHA256
8445e020ee33d1dcc37a1f7836c8c7a1b7afc656303ddb5181030331391bdd97

SHA512
910f8032fb4a181ff59ec9f4896c8093cc35a840a9fb19eec8705965eb38419fe2049bd8ec3990a65014afbe434b1399b3575238991d8c306524583412e0eb0f

Download Submit
C:\Windows\System\OmMtGdp.exe

Filesize
2.6MB

MD5
06884d8847967263e42a9446ffcf90d0

SHA1
40af15bf7056e33d716e085a97fcdaa4b01e828b

SHA256
70a4833752da79724d7ddb048a1de2c94a8d62b8b7606e8c5696e10d388cf0ae

SHA512
817cab1c51f6f49dac04f0b486d47d479481371ad176cc09bd9aa1e6c1f3ee446fd46e3bad6b499f07d172ee9f03cd926a66f81f4b1db1ab0599ba2283d4ebef

Download Submit
C:\Windows\System\OnKitXA.exe

Filesize
2.6MB

MD5
b3f3d2372d533dde98eb9f820a79992f

SHA1
26636cc27abf502ea5a894e6a3daebb19cb6f92f

SHA256
0431dee49a2a2a2f33b5c2309826ae2787044aaaefb1a77165219088226169a5

SHA512
328bc2d3d87954e91981713fef11543596592056834d10fed1185432133de4dbe74c93e6098703414355a838f096c00aecb0ba4340c9bedbaad288ca9ee57555

Download Submit
C:\Windows\System\SHXiFvP.exe

Filesize
2.6MB

MD5
dd357edfba4fe9cfdba91adacd28d486

SHA1
b780659f5942033b25eba4f115f4042baba1032f

SHA256
9d3fa48f8ea28b49393afb69bf218d342a33dd4a3d4205ffadad6d5ecb4325ff

SHA512
d8213ced599ce53143b42cf8759782baa46f29d6559dfb8b54175c3092d5a4440f90c3ed56bbce674a46ae282a0166077da2e73564a45352edce119d0d8c05c2

Download Submit
C:\Windows\System\VMQCbvE.exe

Filesize
2.6MB

MD5
b845fb431561b85b191d23e3f49f2f54

SHA1
7934e6b5ca1521c08b0d88cc26294e47c8ecec1a

SHA256
c8d9c42e4adb33695f5c8b3813cdef5a669a66945137f28e460cc69594242749

SHA512
49f9500fcc1097bfa27c8d043eebbfd2388b067fdf49a0e4c3d7295d59ed885e3cc36a4694f6310f5249fed388dc6d0b313a25f0ca1d3a61f9e17958a72bf3ca

Download Submit
C:\Windows\System\WTCWmGZ.exe

Filesize
2.6MB

MD5
eb79f74856f7dc9f08eef43a6111d0f6

SHA1
9524b203c06dcbe74617ab00b014c24d6935af0c

SHA256
629f3a9d454e121de6195d1f9cee91d3cc21f10e5ce0f41a57013d46dca25215

SHA512
a4a47f0e0f1e09217467c7960c04d4330b57a909ddff320ad2e62311af5787c95deb7a7d172f0320c00714f1d5b53d7301862e33f15aed1522a4b75e837fd273

Download Submit
C:\Windows\System\WlpgETx.exe

Filesize
2.6MB

MD5
6eeef6f156661abc8a0ce0d4532243df

SHA1
58dc81ec3c747b1d34c3672a0f722bc15520a512

SHA256
0e020013e7e9199260ca187f5e9b57e6a7d13d6e0604d2224fad68d545424f98

SHA512
db7c23253ee8ff661f46846b10a0c74467bd5b94809cf737032bb9beba03cc50ee3fd2bb4ec28d70993f2aa98abed4ad65e988daa7d9a1c99fe0a9d8c944335b

Download Submit
C:\Windows\System\YTejhad.exe

Filesize
2.6MB

MD5
041669c5d0797dd427deb20dd1666d69

SHA1
809dc484d582854434aa06276a55bcab63fe8670

SHA256
4217dd9bfc3b284de77258557b7c134de612fc74dde8f23e0e6c9af58044165b

SHA512
ce70c0d9e480923e90235438c8d3d48560d13b91e3d293ffb3fa9a1e8a4680391a0b5b4f11a543846814941b3928a40c705ce2970103efa6a99886080be4713b

Download Submit
C:\Windows\System\ZTxnggm.exe

Filesize
2.6MB

MD5
129165af61c92cdab3c744fd4447b8ee

SHA1
3eb0dc74c858e696a1a9b886c6315c696056668c

SHA256
92a1ed04bf96bfaeac5a09705392ac2ea1fb357ea616a20d4c9ede62a6a2b59a

SHA512
7f7923be98c58459bc7dd1eed4b7a4bc47a8b0db61ab2b839b68681c8f5086158ff285838969d25f369cf059dca51069d4c13469d6d42e71a52f3c539f49cea8

Download Submit
C:\Windows\System\aBlpEgw.exe

Filesize
2.6MB

MD5
0b7d37319ffe15592d8b164ed1ab8811

SHA1
f7cb0cff3a7c8036bfb5b58aa0d704bfeed90f79

SHA256
6b3f02ddd5fa8ed9dcac415e0e5934ee1477c487872917ecbd5391e0c28c9e8e

SHA512
4686c39b7aa4769ce83b5f5ccb4b5860ca00985a97b0b8dc4b8319a50dcb59020baabd2103ce920f6fa949ed77f1ad839e1e5b7f388d016f9abed24991477f24

Download Submit
C:\Windows\System\bfKHWrg.exe

Filesize
2.6MB

MD5
bf88a9b732660a84b408c8b0ba03c4af

SHA1
b53d90a41c2c4f4bb92f9125a9a03b43dfc0dc51

SHA256
32a7f3beabbc9ffd134dafa4bcffccd9e85105034b64d712a4368ec61bf2ca3c

SHA512
109d31409dd25140af66fc8bcafa8485574d2350543b89ea4b4b5c86a76e82be0346aa98a28a19a9dc86aa8bd796b3d0accc8a81bbc5832d62e718202c81d402

Download Submit
C:\Windows\System\dAIhpns.exe

Filesize
2.6MB

MD5
97c075e7dbf59f55b4e0cb8acc49143b

SHA1
78c2f932c4720c3f8ab66c830f011875997577e3

SHA256
3d506384247df40bb93aa12d9b0570f3ef0d732a1aba4bd04cb0fd97faeea438

SHA512
a7ed5ceafe6941541fdee89cc998c173486ec236b01b2d8f7aae309b2fe6c6b8c3e9829734a4033717b5163114dcb870526a9967e73200e50db5a656bed3192e

Download Submit
C:\Windows\System\dJiLlnG.exe

Filesize
2.6MB

MD5
7d38922141e06d784109aa07a5f295e9

SHA1
62e290964b2de2910f2c27387d2d61fbc3d84d31

SHA256
4597b82b04fcdcffbcb353dcfaf8e711155f4c95b758c2e2b767ac722ed7d3ba

SHA512
89e1aa6db21043cfaa47eb9219d34bee65cafbf4b191fff285460ddb94bf2f74d2d275c244935b596eecbcccbbdd66719120df098f8025f4679368cfd21f58c9

Download Submit
C:\Windows\System\dPmTLsv.exe

Filesize
2.6MB

MD5
41745b937d6afcfa9b87928866768d47

SHA1
b199d561c3ffc9aa3c2a45bf5204cb2dd2d27b31

SHA256
448531b50aad3e4d60657740b4982cd77c0cbf579b6d2a89b7943f068f75d167

SHA512
23e803b6d9b134fe4f3939af9a694c800edb4e21a6a3a85ec1fb40f99e2da0776f396f1e97d7eee79154ccec1214a60b8c4a7cff602dbe4ca0220bc7981f0d83

Download Submit
C:\Windows\System\hTxlmsy.exe

Filesize
2.6MB

MD5
cefd202a0a329916bb5bc7cadc01cd03

SHA1
c3134975e2f4322fcae320bf857ddd0b759c3d64

SHA256
c3c3b0a9537e1dde7780a163c5f946b24f200ccfc393004ef95efc0bcc1c8f8f

SHA512
d1cbf51f111a133ea8f98ca095881c0dc0a459e9786969038e97e26b721a34c187b073d8809cb836dcfc240273851cdf209a14afde00bf463ee85265e0de1903

Download Submit
C:\Windows\System\hrTlvlL.exe

Filesize
2.6MB

MD5
7f15ca661fd03a2f81fad8ab70c4ddcb

SHA1
340e4a85e0858633f31c7b59d7ffcd2a3606c562

SHA256
afdf4ca9caf26f6d9b20ac0eb3421fe81ab121758931be2329d9390382780700

SHA512
eea3d49dda1f8982ed0f05a4d115196b27d5603b739692bd1aeaa4f7a3a00320abbd4f472c14d2a0f0b028347a1f6e66fa67a653aaa6124a64440ce9373c8571

Download Submit
C:\Windows\System\jQARmEp.exe

Filesize
2.6MB

MD5
98758971609691ec25fb0a755a5a6bc9

SHA1
5935e96442fffe91f4cd1a762c982a37b59647bf

SHA256
eb77c4147d8c9cca6984bb52058fb91b45825e3ec286cd87e089104b35341403

SHA512
3ba60bcde4fe8ea8a4b037518a6671b49b19fb21bd6d97d78c4d0a83e3e2082c64c79fc5a3cccc09b49e28eb08668d7d5e92e84a52c399d78984428917e19513

Download Submit
C:\Windows\System\nafalct.exe

Filesize
2.6MB

MD5
51929df6f36f7526a6d150371a7aa52d

SHA1
c2d7000f353f35dec61aea6a45c6ecf84e279d79

SHA256
38946de728170b2d3cc798bf6bc48f26ad05b465110f508c61a789132f625503

SHA512
62a0752de97f719615857bdfc35cb1a45d1d4b83e713536b53fbf5c1832f184aa6a96d3261b5488845ec268909e9115c25b326a58ccfa644123fc78d595f4e61

Download Submit
C:\Windows\System\oCPELSq.exe

Filesize
2.6MB

MD5
3c2c4e50e71057c9fb30a8d85319106d

SHA1
58fe88de0a29a648571a2d9b69fbb407488d1b8f

SHA256
8da056d44da3e5351affcade7313026d391a4d665e2ad6103b371dc116437a65

SHA512
506955dfbce7fac5a50676b51e66aaabed6fde65fcc716b4d138a7cf0636c230d473d11ea3e174838b3b2e75a5e2b409cf6989a786dbfb6b44b32738f01dc2ba

Download Submit
C:\Windows\System\orFtMAp.exe

Filesize
2.6MB

MD5
43c6bec5aa1482520a4f14b9a70571a3

SHA1
a8d1adc8d362b72eb398be5c0c1013ada26d9082

SHA256
b068fad3010215f6732932748143a38e08d7d3f8fef2a60890e059f806fd29c5

SHA512
3515878c01d928be5d4c6674335c4ef682ca6c7f135f877250e311217f162ed09bf1f0b1f2a0943394bb32058e35c9313feb05df06313e2c7a9fa20130ac13d6

Download Submit
C:\Windows\System\pkLNMNf.exe

Filesize
2.6MB

MD5
a5d0794ce698084e8f8c3fdc4db0368e

SHA1
53f42f3c3cee3839376fbf0fc639fd955274b994

SHA256
bbf304954d3f732d509ae29a701b216d4c02104780fb01bc230ca93ca342f3f7

SHA512
4667b02dc87b05ff4294f03dc3e1b77e1663465c4893cee186c4c5690b71279895ae57283a941afb3a300a5c7989a186c297a3b181e3c8b72a3237cc5ebd89ae

Download Submit
C:\Windows\System\sKuSZfL.exe

Filesize
2.6MB

MD5
c95d0bda226b24f9b88af285c56b6cdc

SHA1
9ce7b5a8ae516dc7abba15bcacb8ae01b32c7529

SHA256
3ba8549da1ace25fed057327663d88829d3ef7e3b79378b1e4e24d5157729037

SHA512
f6018770ad9d9a8aef0088035b73913a4f1b4af69666eb66411899861933d0dac21e348e4650964fb407549f56cd5add5a3eb01d31dfddd833bcd2808e262809

Download Submit
C:\Windows\System\vFCmRBn.exe

Filesize
2.6MB

MD5
d7652cbb001d10f02c04f8bf302adb9b

SHA1
fd552efe43ac30bff84d8fe747497f535b722049

SHA256
c378d94b27da681c5c1f719bd15d4f8777fadebbd69fd1a37eca653510b3062c

SHA512
ff2815c750263852e9287277adbf1cc56670d0d6192cdaf464df5439045905bdc595373ba1980a7124025ee70c2074ed2d98d01f0da5c26befbf5b514486c621

Download Submit
C:\Windows\System\vTRcVBh.exe

Filesize
2.6MB

MD5
f76f1f2795d053decd497e90a97b1837

SHA1
4929add9f58ad6c55316f7b9a007fd381702af69

SHA256
6bf77ddc23ca66ff29bd673d7ca213e365e675330480eb8dba3bc36471205885

SHA512
66ceb211dc6d76504dee8ed358cb96a1af13e9abba469a49c597cef3958665b1b8e61772980fc255d2404b8bfaf271eb0d7738ea4027169a57d988c1dbfc8fa1

Download Submit
C:\Windows\System\wDCBtdb.exe

Filesize
2.6MB

MD5
72711227e359de010d802e462edf7353

SHA1
432b67b63f2f38cfd2156042800d4610ce8174b6

SHA256
35837ce2829032a9b56d612287818642954b97dd8ef15acb1a4fcc3c6b63dbed

SHA512
f6825cd39ba164066e093961a5e72253b803fcfbcc50a5ae4a78a93bcac7c6e9d82ad65cb3fd3e5c4acf2a63caf182c184c38e2160f8c52974f7fc2bf8d94a42

Download Submit
memory/220-590-0x00007FF7FCD10000-0x00007FF7FD064000-memory.dmp

Filesize
3.3MB

Download
memory/220-2184-0x00007FF7FCD10000-0x00007FF7FD064000-memory.dmp

Filesize
3.3MB

Download
memory/228-586-0x00007FF6C0F70000-0x00007FF6C12C4000-memory.dmp

Filesize
3.3MB

Download
memory/228-2180-0x00007FF6C0F70000-0x00007FF6C12C4000-memory.dmp

Filesize
3.3MB

Download
memory/452-2170-0x00007FF7C6F40000-0x00007FF7C7294000-memory.dmp

Filesize
3.3MB

Download
memory/452-530-0x00007FF7C6F40000-0x00007FF7C7294000-memory.dmp

Filesize
3.3MB

Download
memory/812-609-0x00007FF7F7A40000-0x00007FF7F7D94000-memory.dmp

Filesize
3.3MB

Download
memory/812-2188-0x00007FF7F7A40000-0x00007FF7F7D94000-memory.dmp

Filesize
3.3MB

Download
memory/868-2167-0x00007FF6588A0000-0x00007FF658BF4000-memory.dmp

Filesize
3.3MB

Download
memory/868-14-0x00007FF6588A0000-0x00007FF658BF4000-memory.dmp

Filesize
3.3MB

Download
memory/1236-538-0x00007FF6FDD80000-0x00007FF6FE0D4000-memory.dmp

Filesize
3.3MB

Download
memory/1236-2173-0x00007FF6FDD80000-0x00007FF6FE0D4000-memory.dmp

Filesize
3.3MB

Download
memory/1380-650-0x00007FF791FB0000-0x00007FF792304000-memory.dmp

Filesize
3.3MB

Download
memory/1380-2189-0x00007FF791FB0000-0x00007FF792304000-memory.dmp

Filesize
3.3MB

Download
memory/1572-2182-0x00007FF7C6490000-0x00007FF7C67E4000-memory.dmp

Filesize
3.3MB

Download
memory/1572-593-0x00007FF7C6490000-0x00007FF7C67E4000-memory.dmp

Filesize
3.3MB

Download
memory/1828-577-0x00007FF67CB80000-0x00007FF67CED4000-memory.dmp

Filesize
3.3MB

Download
memory/1828-2177-0x00007FF67CB80000-0x00007FF67CED4000-memory.dmp

Filesize
3.3MB

Download
memory/1948-599-0x00007FF7032A0000-0x00007FF7035F4000-memory.dmp

Filesize
3.3MB

Download
memory/1948-2185-0x00007FF7032A0000-0x00007FF7035F4000-memory.dmp

Filesize
3.3MB

Download
memory/2704-2179-0x00007FF761870000-0x00007FF761BC4000-memory.dmp

Filesize
3.3MB

Download
memory/2704-570-0x00007FF761870000-0x00007FF761BC4000-memory.dmp

Filesize
3.3MB

Download
memory/2996-2178-0x00007FF768D50000-0x00007FF7690A4000-memory.dmp

Filesize
3.3MB

Download
memory/2996-556-0x00007FF768D50000-0x00007FF7690A4000-memory.dmp

Filesize
3.3MB

Download
memory/3000-656-0x00007FF65EC00000-0x00007FF65EF54000-memory.dmp

Filesize
3.3MB

Download
memory/3000-2193-0x00007FF65EC00000-0x00007FF65EF54000-memory.dmp

Filesize
3.3MB

Download
memory/3004-566-0x00007FF6A6840000-0x00007FF6A6B94000-memory.dmp

Filesize
3.3MB

Download
memory/3004-2176-0x00007FF6A6840000-0x00007FF6A6B94000-memory.dmp

Filesize
3.3MB

Download
memory/3424-2171-0x00007FF6BAC10000-0x00007FF6BAF64000-memory.dmp

Filesize
3.3MB

Download
memory/3424-666-0x00007FF6BAC10000-0x00007FF6BAF64000-memory.dmp

Filesize
3.3MB

Download
memory/3476-641-0x00007FF704950000-0x00007FF704CA4000-memory.dmp

Filesize
3.3MB

Download
memory/3476-2190-0x00007FF704950000-0x00007FF704CA4000-memory.dmp

Filesize
3.3MB

Download
memory/3652-544-0x00007FF6DF550000-0x00007FF6DF8A4000-memory.dmp

Filesize
3.3MB

Download
memory/3652-2174-0x00007FF6DF550000-0x00007FF6DF8A4000-memory.dmp

Filesize
3.3MB

Download
memory/3852-606-0x00007FF730D80000-0x00007FF7310D4000-memory.dmp

Filesize
3.3MB

Download
memory/3852-2183-0x00007FF730D80000-0x00007FF7310D4000-memory.dmp

Filesize
3.3MB

Download
memory/4272-2194-0x00007FF6EC320000-0x00007FF6EC674000-memory.dmp

Filesize
3.3MB

Download
memory/4272-659-0x00007FF6EC320000-0x00007FF6EC674000-memory.dmp

Filesize
3.3MB

Download
memory/4360-582-0x00007FF7CBF30000-0x00007FF7CC284000-memory.dmp

Filesize
3.3MB

Download
memory/4360-2181-0x00007FF7CBF30000-0x00007FF7CC284000-memory.dmp

Filesize
3.3MB

Download
memory/4440-2191-0x00007FF7A8AF0000-0x00007FF7A8E44000-memory.dmp

Filesize
3.3MB

Download
memory/4440-635-0x00007FF7A8AF0000-0x00007FF7A8E44000-memory.dmp

Filesize
3.3MB

Download
memory/4468-633-0x00007FF76BE10000-0x00007FF76C164000-memory.dmp

Filesize
3.3MB

Download
memory/4468-2192-0x00007FF76BE10000-0x00007FF76C164000-memory.dmp

Filesize
3.3MB

Download
memory/4484-615-0x00007FF643EB0000-0x00007FF644204000-memory.dmp

Filesize
3.3MB

Download
memory/4484-2186-0x00007FF643EB0000-0x00007FF644204000-memory.dmp

Filesize
3.3MB

Download
memory/4580-0-0x00007FF670560000-0x00007FF6708B4000-memory.dmp

Filesize
3.3MB

Download
memory/4580-1-0x00000181C7690000-0x00000181C76A0000-memory.dmp

Filesize
64KB

Download
memory/4580-1972-0x00007FF670560000-0x00007FF6708B4000-memory.dmp

Filesize
3.3MB

Download
memory/4616-2187-0x00007FF6B6440000-0x00007FF6B6794000-memory.dmp

Filesize
3.3MB

Download
memory/4616-622-0x00007FF6B6440000-0x00007FF6B6794000-memory.dmp

Filesize
3.3MB

Download
memory/4680-552-0x00007FF73BD50000-0x00007FF73C0A4000-memory.dmp

Filesize
3.3MB

Download
memory/4680-2175-0x00007FF73BD50000-0x00007FF73C0A4000-memory.dmp

Filesize
3.3MB

Download
memory/4784-2165-0x00007FF764480000-0x00007FF7647D4000-memory.dmp

Filesize
3.3MB

Download
memory/4784-26-0x00007FF764480000-0x00007FF7647D4000-memory.dmp

Filesize
3.3MB

Download
memory/4784-2169-0x00007FF764480000-0x00007FF7647D4000-memory.dmp

Filesize
3.3MB

Download
memory/4804-2172-0x00007FF7831E0000-0x00007FF783534000-memory.dmp

Filesize
3.3MB

Download
memory/4804-535-0x00007FF7831E0000-0x00007FF783534000-memory.dmp

Filesize
3.3MB

Download
memory/4928-2168-0x00007FF6D6410000-0x00007FF6D6764000-memory.dmp

Filesize
3.3MB

Download
memory/4928-22-0x00007FF6D6410000-0x00007FF6D6764000-memory.dmp

Filesize
3.3MB

Download
memory/5004-2166-0x00007FF731460000-0x00007FF7317B4000-memory.dmp

Filesize
3.3MB

Download
memory/5004-6-0x00007FF731460000-0x00007FF7317B4000-memory.dmp

Filesize
3.3MB

Download