xmrig | 67e54c1ba74245b893afa8f64e7290f8925de109d8b28f6c4646bf20bb0dcbea

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ed1a2306e0d58b115db84921e419720N.exe
Size

782KB
MD5

3ed1a2306e0d58b115db84921e419720
SHA1

d8acfb319bfe1bc3105a89e7885eb787d2ffc21a
SHA256

67e54c1ba74245b893afa8f64e7290f8925de109d8b28f6c4646bf20bb0dcbea
SHA512

53d2b791fbd8f3114b2803dc0d4d5d253c59db10e91e9640f3d7109d444d4599a7cb2d55914d85815be3c21f90b09dc8d92b76059b2732ce155003a009e846dc
SSDEEP

12288:ISe8XYl3vWD8xCi7KZoqkatMLrJB0LCJP/YfjZ1ErN9AzSuNc1Lko:RVIl/WDGCi7/qkat6wEHAWuOX

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral2/memory/2152-383-0x00007FF6FFEB0000-0x00007FF700201000-memory.dmp	xmrig
behavioral2/memory/2856-391-0x00007FF657A50000-0x00007FF657DA1000-memory.dmp	xmrig
behavioral2/memory/316-397-0x00007FF75DD50000-0x00007FF75E0A1000-memory.dmp	xmrig
behavioral2/memory/4836-399-0x00007FF69A960000-0x00007FF69ACB1000-memory.dmp	xmrig
behavioral2/memory/3044-410-0x00007FF658050000-0x00007FF6583A1000-memory.dmp	xmrig
behavioral2/memory/2628-408-0x00007FF65E4A0000-0x00007FF65E7F1000-memory.dmp	xmrig
behavioral2/memory/2220-417-0x00007FF7DAED0000-0x00007FF7DB221000-memory.dmp	xmrig
behavioral2/memory/1576-419-0x00007FF694C40000-0x00007FF694F91000-memory.dmp	xmrig
behavioral2/memory/4168-439-0x00007FF731C30000-0x00007FF731F81000-memory.dmp	xmrig
behavioral2/memory/916-446-0x00007FF635B00000-0x00007FF635E51000-memory.dmp	xmrig
behavioral2/memory/376-450-0x00007FF6665E0000-0x00007FF666931000-memory.dmp	xmrig
behavioral2/memory/1972-478-0x00007FF7DAB90000-0x00007FF7DAEE1000-memory.dmp	xmrig
behavioral2/memory/796-479-0x00007FF685A90000-0x00007FF685DE1000-memory.dmp	xmrig
behavioral2/memory/1664-469-0x00007FF6E85F0000-0x00007FF6E8941000-memory.dmp	xmrig
behavioral2/memory/2456-463-0x00007FF7D5C40000-0x00007FF7D5F91000-memory.dmp	xmrig
behavioral2/memory/2372-460-0x00007FF6D5A30000-0x00007FF6D5D81000-memory.dmp	xmrig
behavioral2/memory/3192-445-0x00007FF7C13B0000-0x00007FF7C1701000-memory.dmp	xmrig
behavioral2/memory/2824-434-0x00007FF795B40000-0x00007FF795E91000-memory.dmp	xmrig
behavioral2/memory/3172-428-0x00007FF6C4560000-0x00007FF6C48B1000-memory.dmp	xmrig
behavioral2/memory/1516-423-0x00007FF6737D0000-0x00007FF673B21000-memory.dmp	xmrig
behavioral2/memory/3916-58-0x00007FF735C70000-0x00007FF735FC1000-memory.dmp	xmrig
behavioral2/memory/216-54-0x00007FF73B4A0000-0x00007FF73B7F1000-memory.dmp	xmrig
behavioral2/memory/3004-28-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp	xmrig
behavioral2/memory/4784-23-0x00007FF7434F0000-0x00007FF743841000-memory.dmp	xmrig
behavioral2/memory/5008-2224-0x00007FF69B570000-0x00007FF69B8C1000-memory.dmp	xmrig
behavioral2/memory/3004-2225-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp	xmrig
behavioral2/memory/728-2226-0x00007FF611CB0000-0x00007FF612001000-memory.dmp	xmrig
behavioral2/memory/4528-2231-0x00007FF733290000-0x00007FF7335E1000-memory.dmp	xmrig
behavioral2/memory/3844-2232-0x00007FF75BA60000-0x00007FF75BDB1000-memory.dmp	xmrig
behavioral2/memory/3028-2233-0x00007FF61AC40000-0x00007FF61AF91000-memory.dmp	xmrig
behavioral2/memory/5060-2234-0x00007FF7B4750000-0x00007FF7B4AA1000-memory.dmp	xmrig
behavioral2/memory/4784-2236-0x00007FF7434F0000-0x00007FF743841000-memory.dmp	xmrig
behavioral2/memory/3004-2238-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp	xmrig
behavioral2/memory/216-2240-0x00007FF73B4A0000-0x00007FF73B7F1000-memory.dmp	xmrig
behavioral2/memory/3028-2247-0x00007FF61AC40000-0x00007FF61AF91000-memory.dmp	xmrig
behavioral2/memory/4528-2250-0x00007FF733290000-0x00007FF7335E1000-memory.dmp	xmrig
behavioral2/memory/3844-2249-0x00007FF75BA60000-0x00007FF75BDB1000-memory.dmp	xmrig
behavioral2/memory/728-2245-0x00007FF611CB0000-0x00007FF612001000-memory.dmp	xmrig
behavioral2/memory/3916-2243-0x00007FF735C70000-0x00007FF735FC1000-memory.dmp	xmrig
behavioral2/memory/5060-2254-0x00007FF7B4750000-0x00007FF7B4AA1000-memory.dmp	xmrig
behavioral2/memory/1972-2256-0x00007FF7DAB90000-0x00007FF7DAEE1000-memory.dmp	xmrig
behavioral2/memory/796-2253-0x00007FF685A90000-0x00007FF685DE1000-memory.dmp	xmrig
behavioral2/memory/2152-2269-0x00007FF6FFEB0000-0x00007FF700201000-memory.dmp	xmrig
behavioral2/memory/2456-2292-0x00007FF7D5C40000-0x00007FF7D5F91000-memory.dmp	xmrig
behavioral2/memory/2372-2290-0x00007FF6D5A30000-0x00007FF6D5D81000-memory.dmp	xmrig
behavioral2/memory/1664-2288-0x00007FF6E85F0000-0x00007FF6E8941000-memory.dmp	xmrig
behavioral2/memory/4836-2284-0x00007FF69A960000-0x00007FF69ACB1000-memory.dmp	xmrig
behavioral2/memory/2628-2283-0x00007FF65E4A0000-0x00007FF65E7F1000-memory.dmp	xmrig
behavioral2/memory/2220-2278-0x00007FF7DAED0000-0x00007FF7DB221000-memory.dmp	xmrig
behavioral2/memory/1516-2276-0x00007FF6737D0000-0x00007FF673B21000-memory.dmp	xmrig
behavioral2/memory/916-2272-0x00007FF635B00000-0x00007FF635E51000-memory.dmp	xmrig
behavioral2/memory/3192-2271-0x00007FF7C13B0000-0x00007FF7C1701000-memory.dmp	xmrig
behavioral2/memory/316-2267-0x00007FF75DD50000-0x00007FF75E0A1000-memory.dmp	xmrig
behavioral2/memory/2856-2286-0x00007FF657A50000-0x00007FF657DA1000-memory.dmp	xmrig
behavioral2/memory/3044-2281-0x00007FF658050000-0x00007FF6583A1000-memory.dmp	xmrig
behavioral2/memory/3172-2262-0x00007FF6C4560000-0x00007FF6C48B1000-memory.dmp	xmrig
behavioral2/memory/2824-2260-0x00007FF795B40000-0x00007FF795E91000-memory.dmp	xmrig
behavioral2/memory/4168-2274-0x00007FF731C30000-0x00007FF731F81000-memory.dmp	xmrig
behavioral2/memory/1576-2265-0x00007FF694C40000-0x00007FF694F91000-memory.dmp	xmrig
behavioral2/memory/376-2259-0x00007FF6665E0000-0x00007FF666931000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4784	LemSAeN.exe
3004	kbflkcm.exe
216	baFmPhN.exe
3916	ghfelcE.exe
4528	PervtlT.exe
3844	awPghuO.exe
3028	SkAWZGP.exe
728	uiwrldQ.exe
5060	BcShXGu.exe
1972	vVepJgm.exe
796	NzFFviW.exe
2152	uxeEbtI.exe
2856	zoiTrII.exe
316	BoyckEh.exe
4836	SBXDfAS.exe
2628	ZyRVjoM.exe
3044	EiFdWVM.exe
2220	ltefOxg.exe
1576	MwNbarZ.exe
1516	lgipRDj.exe
3172	XhZiHUk.exe
2824	kGQQRmR.exe
4168	LrhVYtZ.exe
3192	ztDrIcK.exe
916	zFKfTYQ.exe
376	CygUemg.exe
2372	WgkeBQv.exe
2456	ujnwbFQ.exe
1664	YaCJZAj.exe
1388	bfSsoBx.exe
4608	tvorJwo.exe
3200	WVjMuif.exe
3484	qMVKRCQ.exe
1484	YeKMOPR.exe
4896	AIyBdbQ.exe
3636	LDJsVJQ.exe
4468	MVREjGQ.exe
4516	UbUsFVL.exe
3048	hAuaMco.exe
2828	eCJDboo.exe
4552	JLPzWew.exe
2364	xspbVcS.exe
4080	KSoHwOE.exe
3564	gUpIumg.exe
4912	fkVtrAL.exe
4344	eFwKXew.exe
720	ocVfyEj.exe
1992	BZtyZvF.exe
4036	FqWIdwB.exe
2268	jLMZQBj.exe
4872	DeJbeEJ.exe
4328	orffQPY.exe
696	mTQKlMl.exe
3716	iFrRsxb.exe
4716	ZfadhVX.exe
732	AZXPvxO.exe
4296	wWDVjwA.exe
3404	VYBGdAX.exe
2532	PLBnySs.exe
4304	sIOUXax.exe
716	ddYbKyL.exe
2904	vaOUBsT.exe
3648	VDMeOsz.exe
4764	UguSlkH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5008-0-0x00007FF69B570000-0x00007FF69B8C1000-memory.dmp	upx
behavioral2/files/0x000800000002347c-10.dat	upx
behavioral2/files/0x0007000000023482-25.dat	upx
behavioral2/memory/4528-36-0x00007FF733290000-0x00007FF7335E1000-memory.dmp	upx
behavioral2/memory/728-53-0x00007FF611CB0000-0x00007FF612001000-memory.dmp	upx
behavioral2/files/0x0007000000023486-55.dat	upx
behavioral2/files/0x0007000000023487-59.dat	upx
behavioral2/files/0x000700000002348a-77.dat	upx
behavioral2/files/0x000700000002348b-90.dat	upx
behavioral2/files/0x0007000000023492-117.dat	upx
behavioral2/files/0x0007000000023498-147.dat	upx
behavioral2/memory/2152-383-0x00007FF6FFEB0000-0x00007FF700201000-memory.dmp	upx
behavioral2/memory/2856-391-0x00007FF657A50000-0x00007FF657DA1000-memory.dmp	upx
behavioral2/memory/316-397-0x00007FF75DD50000-0x00007FF75E0A1000-memory.dmp	upx
behavioral2/memory/4836-399-0x00007FF69A960000-0x00007FF69ACB1000-memory.dmp	upx
behavioral2/memory/3044-410-0x00007FF658050000-0x00007FF6583A1000-memory.dmp	upx
behavioral2/memory/2628-408-0x00007FF65E4A0000-0x00007FF65E7F1000-memory.dmp	upx
behavioral2/memory/2220-417-0x00007FF7DAED0000-0x00007FF7DB221000-memory.dmp	upx
behavioral2/memory/1576-419-0x00007FF694C40000-0x00007FF694F91000-memory.dmp	upx
behavioral2/memory/4168-439-0x00007FF731C30000-0x00007FF731F81000-memory.dmp	upx
behavioral2/memory/916-446-0x00007FF635B00000-0x00007FF635E51000-memory.dmp	upx
behavioral2/memory/376-450-0x00007FF6665E0000-0x00007FF666931000-memory.dmp	upx
behavioral2/memory/1972-478-0x00007FF7DAB90000-0x00007FF7DAEE1000-memory.dmp	upx
behavioral2/memory/796-479-0x00007FF685A90000-0x00007FF685DE1000-memory.dmp	upx
behavioral2/memory/1664-469-0x00007FF6E85F0000-0x00007FF6E8941000-memory.dmp	upx
behavioral2/memory/2456-463-0x00007FF7D5C40000-0x00007FF7D5F91000-memory.dmp	upx
behavioral2/memory/2372-460-0x00007FF6D5A30000-0x00007FF6D5D81000-memory.dmp	upx
behavioral2/memory/3192-445-0x00007FF7C13B0000-0x00007FF7C1701000-memory.dmp	upx
behavioral2/memory/2824-434-0x00007FF795B40000-0x00007FF795E91000-memory.dmp	upx
behavioral2/memory/3172-428-0x00007FF6C4560000-0x00007FF6C48B1000-memory.dmp	upx
behavioral2/memory/1516-423-0x00007FF6737D0000-0x00007FF673B21000-memory.dmp	upx
behavioral2/files/0x000700000002349d-172.dat	upx
behavioral2/files/0x000700000002349b-170.dat	upx
behavioral2/files/0x000700000002349c-167.dat	upx
behavioral2/files/0x000700000002349a-165.dat	upx
behavioral2/files/0x0007000000023499-160.dat	upx
behavioral2/files/0x0007000000023497-150.dat	upx
behavioral2/files/0x0007000000023496-145.dat	upx
behavioral2/files/0x0007000000023495-140.dat	upx
behavioral2/files/0x0007000000023494-135.dat	upx
behavioral2/files/0x0007000000023493-130.dat	upx
behavioral2/files/0x0007000000023491-120.dat	upx
behavioral2/files/0x0007000000023490-115.dat	upx
behavioral2/files/0x000700000002348f-110.dat	upx
behavioral2/files/0x000700000002348e-105.dat	upx
behavioral2/files/0x000700000002348d-100.dat	upx
behavioral2/files/0x000700000002348c-95.dat	upx
behavioral2/files/0x0007000000023489-80.dat	upx
behavioral2/files/0x0007000000023488-75.dat	upx
behavioral2/files/0x0007000000023485-64.dat	upx
behavioral2/memory/5060-62-0x00007FF7B4750000-0x00007FF7B4AA1000-memory.dmp	upx
behavioral2/memory/3916-58-0x00007FF735C70000-0x00007FF735FC1000-memory.dmp	upx
behavioral2/memory/216-54-0x00007FF73B4A0000-0x00007FF73B7F1000-memory.dmp	upx
behavioral2/files/0x0007000000023484-47.dat	upx
behavioral2/files/0x0007000000023481-45.dat	upx
behavioral2/files/0x0007000000023483-44.dat	upx
behavioral2/memory/3028-43-0x00007FF61AC40000-0x00007FF61AF91000-memory.dmp	upx
behavioral2/memory/3844-38-0x00007FF75BA60000-0x00007FF75BDB1000-memory.dmp	upx
behavioral2/files/0x0007000000023480-41.dat	upx
behavioral2/memory/3004-28-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp	upx
behavioral2/memory/4784-23-0x00007FF7434F0000-0x00007FF743841000-memory.dmp	upx
behavioral2/files/0x000800000002347f-21.dat	upx
behavioral2/files/0x0009000000023419-9.dat	upx
behavioral2/memory/5008-2224-0x00007FF69B570000-0x00007FF69B8C1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hVSUelH.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\CWusKli.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\ZfadhVX.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\UguSlkH.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\JYdSsoR.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\AvJAFua.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\EwgaLje.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\ATgBAWz.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\cevBfLl.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\eLroycr.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\QMQGZMu.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\Atxiqni.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\kWnPtKj.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\OYzgToJ.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\nTORqYZ.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\ybGyLUj.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\mPCuNhE.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\KyMLPFE.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\dgcnwjp.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\lShCGjK.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\gYBOonL.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\dIZlbqZ.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\ibUgQOb.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\iITWXiW.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\eTOBwuO.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\WgkeBQv.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\pqEYRcE.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\VUvxZKQ.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\kdhWoMK.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\UvkVDAa.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\FkFsREz.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\baFmPhN.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\mmfpSsn.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\TcZqvdK.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\YlvuUIg.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\mTQKlMl.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\fqWQhFV.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\TDExYQk.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\VKPHUbZ.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\ZbHwIIV.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\Dwivmal.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\ScLRxFh.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\wUsQLYF.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\zQaKqtf.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\kYyNXqo.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\qzeEGLT.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\JWDwqpz.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\jciBlho.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\zWGtCES.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\fPAZDCk.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\SZAhmya.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\vaOUBsT.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\BBbhwYK.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\EfVjUUa.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\kMbthLz.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\YjlaPrf.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\lybroFE.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\ZyRVjoM.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\LxQLSkN.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\jwRPpNj.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\tqgXfcH.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\NPNftCP.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\vLJLkwI.exe	3ed1a2306e0d58b115db84921e419720N.exe
File created	C:\Windows\System\jLMZQBj.exe	3ed1a2306e0d58b115db84921e419720N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4784	5008	3ed1a2306e0d58b115db84921e419720N.exe	83
PID 5008 wrote to memory of 4784	5008	3ed1a2306e0d58b115db84921e419720N.exe	83
PID 5008 wrote to memory of 3004	5008	3ed1a2306e0d58b115db84921e419720N.exe	84
PID 5008 wrote to memory of 3004	5008	3ed1a2306e0d58b115db84921e419720N.exe	84
PID 5008 wrote to memory of 216	5008	3ed1a2306e0d58b115db84921e419720N.exe	85
PID 5008 wrote to memory of 216	5008	3ed1a2306e0d58b115db84921e419720N.exe	85
PID 5008 wrote to memory of 4528	5008	3ed1a2306e0d58b115db84921e419720N.exe	86
PID 5008 wrote to memory of 4528	5008	3ed1a2306e0d58b115db84921e419720N.exe	86
PID 5008 wrote to memory of 3028	5008	3ed1a2306e0d58b115db84921e419720N.exe	87
PID 5008 wrote to memory of 3028	5008	3ed1a2306e0d58b115db84921e419720N.exe	87
PID 5008 wrote to memory of 3916	5008	3ed1a2306e0d58b115db84921e419720N.exe	88
PID 5008 wrote to memory of 3916	5008	3ed1a2306e0d58b115db84921e419720N.exe	88
PID 5008 wrote to memory of 3844	5008	3ed1a2306e0d58b115db84921e419720N.exe	89
PID 5008 wrote to memory of 3844	5008	3ed1a2306e0d58b115db84921e419720N.exe	89
PID 5008 wrote to memory of 728	5008	3ed1a2306e0d58b115db84921e419720N.exe	90
PID 5008 wrote to memory of 728	5008	3ed1a2306e0d58b115db84921e419720N.exe	90
PID 5008 wrote to memory of 5060	5008	3ed1a2306e0d58b115db84921e419720N.exe	91
PID 5008 wrote to memory of 5060	5008	3ed1a2306e0d58b115db84921e419720N.exe	91
PID 5008 wrote to memory of 1972	5008	3ed1a2306e0d58b115db84921e419720N.exe	92
PID 5008 wrote to memory of 1972	5008	3ed1a2306e0d58b115db84921e419720N.exe	92
PID 5008 wrote to memory of 796	5008	3ed1a2306e0d58b115db84921e419720N.exe	93
PID 5008 wrote to memory of 796	5008	3ed1a2306e0d58b115db84921e419720N.exe	93
PID 5008 wrote to memory of 2152	5008	3ed1a2306e0d58b115db84921e419720N.exe	94
PID 5008 wrote to memory of 2152	5008	3ed1a2306e0d58b115db84921e419720N.exe	94
PID 5008 wrote to memory of 2856	5008	3ed1a2306e0d58b115db84921e419720N.exe	95
PID 5008 wrote to memory of 2856	5008	3ed1a2306e0d58b115db84921e419720N.exe	95
PID 5008 wrote to memory of 316	5008	3ed1a2306e0d58b115db84921e419720N.exe	96
PID 5008 wrote to memory of 316	5008	3ed1a2306e0d58b115db84921e419720N.exe	96
PID 5008 wrote to memory of 4836	5008	3ed1a2306e0d58b115db84921e419720N.exe	97
PID 5008 wrote to memory of 4836	5008	3ed1a2306e0d58b115db84921e419720N.exe	97
PID 5008 wrote to memory of 2628	5008	3ed1a2306e0d58b115db84921e419720N.exe	98
PID 5008 wrote to memory of 2628	5008	3ed1a2306e0d58b115db84921e419720N.exe	98
PID 5008 wrote to memory of 3044	5008	3ed1a2306e0d58b115db84921e419720N.exe	99
PID 5008 wrote to memory of 3044	5008	3ed1a2306e0d58b115db84921e419720N.exe	99
PID 5008 wrote to memory of 2220	5008	3ed1a2306e0d58b115db84921e419720N.exe	100
PID 5008 wrote to memory of 2220	5008	3ed1a2306e0d58b115db84921e419720N.exe	100
PID 5008 wrote to memory of 1576	5008	3ed1a2306e0d58b115db84921e419720N.exe	101
PID 5008 wrote to memory of 1576	5008	3ed1a2306e0d58b115db84921e419720N.exe	101
PID 5008 wrote to memory of 1516	5008	3ed1a2306e0d58b115db84921e419720N.exe	102
PID 5008 wrote to memory of 1516	5008	3ed1a2306e0d58b115db84921e419720N.exe	102
PID 5008 wrote to memory of 3172	5008	3ed1a2306e0d58b115db84921e419720N.exe	103
PID 5008 wrote to memory of 3172	5008	3ed1a2306e0d58b115db84921e419720N.exe	103
PID 5008 wrote to memory of 2824	5008	3ed1a2306e0d58b115db84921e419720N.exe	104
PID 5008 wrote to memory of 2824	5008	3ed1a2306e0d58b115db84921e419720N.exe	104
PID 5008 wrote to memory of 4168	5008	3ed1a2306e0d58b115db84921e419720N.exe	105
PID 5008 wrote to memory of 4168	5008	3ed1a2306e0d58b115db84921e419720N.exe	105
PID 5008 wrote to memory of 3192	5008	3ed1a2306e0d58b115db84921e419720N.exe	106
PID 5008 wrote to memory of 3192	5008	3ed1a2306e0d58b115db84921e419720N.exe	106
PID 5008 wrote to memory of 916	5008	3ed1a2306e0d58b115db84921e419720N.exe	107
PID 5008 wrote to memory of 916	5008	3ed1a2306e0d58b115db84921e419720N.exe	107
PID 5008 wrote to memory of 376	5008	3ed1a2306e0d58b115db84921e419720N.exe	108
PID 5008 wrote to memory of 376	5008	3ed1a2306e0d58b115db84921e419720N.exe	108
PID 5008 wrote to memory of 2372	5008	3ed1a2306e0d58b115db84921e419720N.exe	109
PID 5008 wrote to memory of 2372	5008	3ed1a2306e0d58b115db84921e419720N.exe	109
PID 5008 wrote to memory of 2456	5008	3ed1a2306e0d58b115db84921e419720N.exe	110
PID 5008 wrote to memory of 2456	5008	3ed1a2306e0d58b115db84921e419720N.exe	110
PID 5008 wrote to memory of 1664	5008	3ed1a2306e0d58b115db84921e419720N.exe	111
PID 5008 wrote to memory of 1664	5008	3ed1a2306e0d58b115db84921e419720N.exe	111
PID 5008 wrote to memory of 1388	5008	3ed1a2306e0d58b115db84921e419720N.exe	112
PID 5008 wrote to memory of 1388	5008	3ed1a2306e0d58b115db84921e419720N.exe	112
PID 5008 wrote to memory of 4608	5008	3ed1a2306e0d58b115db84921e419720N.exe	113
PID 5008 wrote to memory of 4608	5008	3ed1a2306e0d58b115db84921e419720N.exe	113
PID 5008 wrote to memory of 3200	5008	3ed1a2306e0d58b115db84921e419720N.exe	114
PID 5008 wrote to memory of 3200	5008	3ed1a2306e0d58b115db84921e419720N.exe	114

C:\Users\Admin\AppData\Local\Temp\3ed1a2306e0d58b115db84921e419720N.exe
"C:\Users\Admin\AppData\Local\Temp\3ed1a2306e0d58b115db84921e419720N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\System\LemSAeN.exe
  C:\Windows\System\LemSAeN.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\kbflkcm.exe
  C:\Windows\System\kbflkcm.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\baFmPhN.exe
  C:\Windows\System\baFmPhN.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\PervtlT.exe
  C:\Windows\System\PervtlT.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\SkAWZGP.exe
  C:\Windows\System\SkAWZGP.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\ghfelcE.exe
  C:\Windows\System\ghfelcE.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\awPghuO.exe
  C:\Windows\System\awPghuO.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\uiwrldQ.exe
  C:\Windows\System\uiwrldQ.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\BcShXGu.exe
  C:\Windows\System\BcShXGu.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\vVepJgm.exe
  C:\Windows\System\vVepJgm.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\NzFFviW.exe
  C:\Windows\System\NzFFviW.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\uxeEbtI.exe
  C:\Windows\System\uxeEbtI.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\zoiTrII.exe
  C:\Windows\System\zoiTrII.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\BoyckEh.exe
  C:\Windows\System\BoyckEh.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\SBXDfAS.exe
  C:\Windows\System\SBXDfAS.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\ZyRVjoM.exe
  C:\Windows\System\ZyRVjoM.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\EiFdWVM.exe
  C:\Windows\System\EiFdWVM.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\ltefOxg.exe
  C:\Windows\System\ltefOxg.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\MwNbarZ.exe
  C:\Windows\System\MwNbarZ.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\lgipRDj.exe
  C:\Windows\System\lgipRDj.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\XhZiHUk.exe
  C:\Windows\System\XhZiHUk.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\kGQQRmR.exe
  C:\Windows\System\kGQQRmR.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\LrhVYtZ.exe
  C:\Windows\System\LrhVYtZ.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\ztDrIcK.exe
  C:\Windows\System\ztDrIcK.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\zFKfTYQ.exe
  C:\Windows\System\zFKfTYQ.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\CygUemg.exe
  C:\Windows\System\CygUemg.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\WgkeBQv.exe
  C:\Windows\System\WgkeBQv.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ujnwbFQ.exe
  C:\Windows\System\ujnwbFQ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\YaCJZAj.exe
  C:\Windows\System\YaCJZAj.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\bfSsoBx.exe
  C:\Windows\System\bfSsoBx.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\tvorJwo.exe
  C:\Windows\System\tvorJwo.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\WVjMuif.exe
  C:\Windows\System\WVjMuif.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\qMVKRCQ.exe
  C:\Windows\System\qMVKRCQ.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\YeKMOPR.exe
  C:\Windows\System\YeKMOPR.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\AIyBdbQ.exe
  C:\Windows\System\AIyBdbQ.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\LDJsVJQ.exe
  C:\Windows\System\LDJsVJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\MVREjGQ.exe
  C:\Windows\System\MVREjGQ.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\UbUsFVL.exe
  C:\Windows\System\UbUsFVL.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\hAuaMco.exe
  C:\Windows\System\hAuaMco.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\eCJDboo.exe
  C:\Windows\System\eCJDboo.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\JLPzWew.exe
  C:\Windows\System\JLPzWew.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\xspbVcS.exe
  C:\Windows\System\xspbVcS.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\KSoHwOE.exe
  C:\Windows\System\KSoHwOE.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\gUpIumg.exe
  C:\Windows\System\gUpIumg.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\fkVtrAL.exe
  C:\Windows\System\fkVtrAL.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\eFwKXew.exe
  C:\Windows\System\eFwKXew.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\ocVfyEj.exe
  C:\Windows\System\ocVfyEj.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\BZtyZvF.exe
  C:\Windows\System\BZtyZvF.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\FqWIdwB.exe
  C:\Windows\System\FqWIdwB.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\jLMZQBj.exe
  C:\Windows\System\jLMZQBj.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\DeJbeEJ.exe
  C:\Windows\System\DeJbeEJ.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\orffQPY.exe
  C:\Windows\System\orffQPY.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\mTQKlMl.exe
  C:\Windows\System\mTQKlMl.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\iFrRsxb.exe
  C:\Windows\System\iFrRsxb.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\ZfadhVX.exe
  C:\Windows\System\ZfadhVX.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\AZXPvxO.exe
  C:\Windows\System\AZXPvxO.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\wWDVjwA.exe
  C:\Windows\System\wWDVjwA.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\VYBGdAX.exe
  C:\Windows\System\VYBGdAX.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\PLBnySs.exe
  C:\Windows\System\PLBnySs.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\sIOUXax.exe
  C:\Windows\System\sIOUXax.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\ddYbKyL.exe
  C:\Windows\System\ddYbKyL.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\vaOUBsT.exe
  C:\Windows\System\vaOUBsT.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\VDMeOsz.exe
  C:\Windows\System\VDMeOsz.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\UguSlkH.exe
  C:\Windows\System\UguSlkH.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\HxoaKRQ.exe
  C:\Windows\System\HxoaKRQ.exe
  2⤵
  PID:1880
- C:\Windows\System\AsszuGe.exe
  C:\Windows\System\AsszuGe.exe
  2⤵
  PID:5064
- C:\Windows\System\CQMAngz.exe
  C:\Windows\System\CQMAngz.exe
  2⤵
  PID:2900
- C:\Windows\System\YbnFytc.exe
  C:\Windows\System\YbnFytc.exe
  2⤵
  PID:4420
- C:\Windows\System\hxAVnhV.exe
  C:\Windows\System\hxAVnhV.exe
  2⤵
  PID:4336
- C:\Windows\System\CENBWss.exe
  C:\Windows\System\CENBWss.exe
  2⤵
  PID:1536
- C:\Windows\System\pqEYRcE.exe
  C:\Windows\System\pqEYRcE.exe
  2⤵
  PID:436
- C:\Windows\System\QEeSmdf.exe
  C:\Windows\System\QEeSmdf.exe
  2⤵
  PID:3508
- C:\Windows\System\AOhzruq.exe
  C:\Windows\System\AOhzruq.exe
  2⤵
  PID:5084
- C:\Windows\System\FiMycEp.exe
  C:\Windows\System\FiMycEp.exe
  2⤵
  PID:2524
- C:\Windows\System\ufRswWG.exe
  C:\Windows\System\ufRswWG.exe
  2⤵
  PID:3100
- C:\Windows\System\GmOPVOu.exe
  C:\Windows\System\GmOPVOu.exe
  2⤵
  PID:3932
- C:\Windows\System\DPuTlHY.exe
  C:\Windows\System\DPuTlHY.exe
  2⤵
  PID:684
- C:\Windows\System\BBbhwYK.exe
  C:\Windows\System\BBbhwYK.exe
  2⤵
  PID:3204
- C:\Windows\System\yEqEgFc.exe
  C:\Windows\System\yEqEgFc.exe
  2⤵
  PID:1532
- C:\Windows\System\XtmYzuL.exe
  C:\Windows\System\XtmYzuL.exe
  2⤵
  PID:5128
- C:\Windows\System\KiBdaIX.exe
  C:\Windows\System\KiBdaIX.exe
  2⤵
  PID:5156
- C:\Windows\System\HGHiTzp.exe
  C:\Windows\System\HGHiTzp.exe
  2⤵
  PID:5188
- C:\Windows\System\agSMrVH.exe
  C:\Windows\System\agSMrVH.exe
  2⤵
  PID:5212
- C:\Windows\System\DHVStoy.exe
  C:\Windows\System\DHVStoy.exe
  2⤵
  PID:5244
- C:\Windows\System\eNzuQfg.exe
  C:\Windows\System\eNzuQfg.exe
  2⤵
  PID:5268
- C:\Windows\System\dcTUsiR.exe
  C:\Windows\System\dcTUsiR.exe
  2⤵
  PID:5292
- C:\Windows\System\KyMLPFE.exe
  C:\Windows\System\KyMLPFE.exe
  2⤵
  PID:5324
- C:\Windows\System\SPBQAly.exe
  C:\Windows\System\SPBQAly.exe
  2⤵
  PID:5352
- C:\Windows\System\CojfaNF.exe
  C:\Windows\System\CojfaNF.exe
  2⤵
  PID:5380
- C:\Windows\System\LxQLSkN.exe
  C:\Windows\System\LxQLSkN.exe
  2⤵
  PID:5408
- C:\Windows\System\diVvXVn.exe
  C:\Windows\System\diVvXVn.exe
  2⤵
  PID:5432
- C:\Windows\System\utdRYsW.exe
  C:\Windows\System\utdRYsW.exe
  2⤵
  PID:5464
- C:\Windows\System\xRqKzoF.exe
  C:\Windows\System\xRqKzoF.exe
  2⤵
  PID:5488
- C:\Windows\System\jwRPpNj.exe
  C:\Windows\System\jwRPpNj.exe
  2⤵
  PID:5524
- C:\Windows\System\nSURnGp.exe
  C:\Windows\System\nSURnGp.exe
  2⤵
  PID:5548
- C:\Windows\System\VyarlNX.exe
  C:\Windows\System\VyarlNX.exe
  2⤵
  PID:5576
- C:\Windows\System\FJEZkHU.exe
  C:\Windows\System\FJEZkHU.exe
  2⤵
  PID:5600
- C:\Windows\System\pVsPlkr.exe
  C:\Windows\System\pVsPlkr.exe
  2⤵
  PID:5628
- C:\Windows\System\fUOzvJM.exe
  C:\Windows\System\fUOzvJM.exe
  2⤵
  PID:5660
- C:\Windows\System\Atxiqni.exe
  C:\Windows\System\Atxiqni.exe
  2⤵
  PID:5684
- C:\Windows\System\mDYmtrm.exe
  C:\Windows\System\mDYmtrm.exe
  2⤵
  PID:5720
- C:\Windows\System\pzujEHo.exe
  C:\Windows\System\pzujEHo.exe
  2⤵
  PID:5744
- C:\Windows\System\VyBkOaJ.exe
  C:\Windows\System\VyBkOaJ.exe
  2⤵
  PID:5784
- C:\Windows\System\dDAAxsB.exe
  C:\Windows\System\dDAAxsB.exe
  2⤵
  PID:5804
- C:\Windows\System\WsEUSbQ.exe
  C:\Windows\System\WsEUSbQ.exe
  2⤵
  PID:5836
- C:\Windows\System\LJrLnhF.exe
  C:\Windows\System\LJrLnhF.exe
  2⤵
  PID:5852
- C:\Windows\System\JjHkdXU.exe
  C:\Windows\System\JjHkdXU.exe
  2⤵
  PID:5868
- C:\Windows\System\SBmtPhl.exe
  C:\Windows\System\SBmtPhl.exe
  2⤵
  PID:5928
- C:\Windows\System\PVSNjeF.exe
  C:\Windows\System\PVSNjeF.exe
  2⤵
  PID:5980
- C:\Windows\System\YVTRBmw.exe
  C:\Windows\System\YVTRBmw.exe
  2⤵
  PID:6024
- C:\Windows\System\zUNQEox.exe
  C:\Windows\System\zUNQEox.exe
  2⤵
  PID:6040
- C:\Windows\System\WgZjAjA.exe
  C:\Windows\System\WgZjAjA.exe
  2⤵
  PID:6072
- C:\Windows\System\fqWQhFV.exe
  C:\Windows\System\fqWQhFV.exe
  2⤵
  PID:6088
- C:\Windows\System\dHOtnGD.exe
  C:\Windows\System\dHOtnGD.exe
  2⤵
  PID:2764
- C:\Windows\System\ScLRxFh.exe
  C:\Windows\System\ScLRxFh.exe
  2⤵
  PID:4496
- C:\Windows\System\SPxctXw.exe
  C:\Windows\System\SPxctXw.exe
  2⤵
  PID:664
- C:\Windows\System\TspcCoY.exe
  C:\Windows\System\TspcCoY.exe
  2⤵
  PID:1676
- C:\Windows\System\bVilnAY.exe
  C:\Windows\System\bVilnAY.exe
  2⤵
  PID:3672
- C:\Windows\System\tRDZOlk.exe
  C:\Windows\System\tRDZOlk.exe
  2⤵
  PID:5148
- C:\Windows\System\FJVplNk.exe
  C:\Windows\System\FJVplNk.exe
  2⤵
  PID:1936
- C:\Windows\System\UYdYkhw.exe
  C:\Windows\System\UYdYkhw.exe
  2⤵
  PID:5224
- C:\Windows\System\oXfxpzI.exe
  C:\Windows\System\oXfxpzI.exe
  2⤵
  PID:5264
- C:\Windows\System\pkEzEdL.exe
  C:\Windows\System\pkEzEdL.exe
  2⤵
  PID:4888
- C:\Windows\System\ippHSCr.exe
  C:\Windows\System\ippHSCr.exe
  2⤵
  PID:5392
- C:\Windows\System\XzkIWkq.exe
  C:\Windows\System\XzkIWkq.exe
  2⤵
  PID:2436
- C:\Windows\System\NLkhlpk.exe
  C:\Windows\System\NLkhlpk.exe
  2⤵
  PID:1660
- C:\Windows\System\jrowMzl.exe
  C:\Windows\System\jrowMzl.exe
  2⤵
  PID:920
- C:\Windows\System\tqgXfcH.exe
  C:\Windows\System\tqgXfcH.exe
  2⤵
  PID:5560
- C:\Windows\System\JfHlGIS.exe
  C:\Windows\System\JfHlGIS.exe
  2⤵
  PID:5592
- C:\Windows\System\Bpnzqye.exe
  C:\Windows\System\Bpnzqye.exe
  2⤵
  PID:4520
- C:\Windows\System\KnlXFym.exe
  C:\Windows\System\KnlXFym.exe
  2⤵
  PID:5652
- C:\Windows\System\FbPDjJv.exe
  C:\Windows\System\FbPDjJv.exe
  2⤵
  PID:5040
- C:\Windows\System\VsGOhnM.exe
  C:\Windows\System\VsGOhnM.exe
  2⤵
  PID:4736
- C:\Windows\System\jtUgttb.exe
  C:\Windows\System\jtUgttb.exe
  2⤵
  PID:4172
- C:\Windows\System\iXRkSrz.exe
  C:\Windows\System\iXRkSrz.exe
  2⤵
  PID:4032
- C:\Windows\System\MyOUFMa.exe
  C:\Windows\System\MyOUFMa.exe
  2⤵
  PID:792
- C:\Windows\System\quwJtzh.exe
  C:\Windows\System\quwJtzh.exe
  2⤵
  PID:4416
- C:\Windows\System\xBtuiXH.exe
  C:\Windows\System\xBtuiXH.exe
  2⤵
  PID:852
- C:\Windows\System\LYXAwQn.exe
  C:\Windows\System\LYXAwQn.exe
  2⤵
  PID:3036
- C:\Windows\System\eOCRdtW.exe
  C:\Windows\System\eOCRdtW.exe
  2⤵
  PID:4276
- C:\Windows\System\kWUIfJT.exe
  C:\Windows\System\kWUIfJT.exe
  2⤵
  PID:5888
- C:\Windows\System\JYdSsoR.exe
  C:\Windows\System\JYdSsoR.exe
  2⤵
  PID:5860
- C:\Windows\System\ACZhxjP.exe
  C:\Windows\System\ACZhxjP.exe
  2⤵
  PID:5904
- C:\Windows\System\LDxMZYS.exe
  C:\Windows\System\LDxMZYS.exe
  2⤵
  PID:4388
- C:\Windows\System\YLABiUb.exe
  C:\Windows\System\YLABiUb.exe
  2⤵
  PID:6032
- C:\Windows\System\GoOvbgP.exe
  C:\Windows\System\GoOvbgP.exe
  2⤵
  PID:6080
- C:\Windows\System\dhljQOW.exe
  C:\Windows\System\dhljQOW.exe
  2⤵
  PID:1764
- C:\Windows\System\gVkvSDO.exe
  C:\Windows\System\gVkvSDO.exe
  2⤵
  PID:4064
- C:\Windows\System\CbfAgJz.exe
  C:\Windows\System\CbfAgJz.exe
  2⤵
  PID:5144
- C:\Windows\System\dGyoRmr.exe
  C:\Windows\System\dGyoRmr.exe
  2⤵
  PID:1896
- C:\Windows\System\bcjAeNQ.exe
  C:\Windows\System\bcjAeNQ.exe
  2⤵
  PID:5312
- C:\Windows\System\TSAngMP.exe
  C:\Windows\System\TSAngMP.exe
  2⤵
  PID:5476
- C:\Windows\System\clvzuXQ.exe
  C:\Windows\System\clvzuXQ.exe
  2⤵
  PID:5512
- C:\Windows\System\BIhJVRX.exe
  C:\Windows\System\BIhJVRX.exe
  2⤵
  PID:5620
- C:\Windows\System\xfnhQWS.exe
  C:\Windows\System\xfnhQWS.exe
  2⤵
  PID:3008
- C:\Windows\System\pZLGCkn.exe
  C:\Windows\System\pZLGCkn.exe
  2⤵
  PID:1552
- C:\Windows\System\nVLVtGW.exe
  C:\Windows\System\nVLVtGW.exe
  2⤵
  PID:4788
- C:\Windows\System\WQxekbG.exe
  C:\Windows\System\WQxekbG.exe
  2⤵
  PID:1556
- C:\Windows\System\NDIjmYg.exe
  C:\Windows\System\NDIjmYg.exe
  2⤵
  PID:5024
- C:\Windows\System\dIsUWGL.exe
  C:\Windows\System\dIsUWGL.exe
  2⤵
  PID:5704
- C:\Windows\System\wIGAUFG.exe
  C:\Windows\System\wIGAUFG.exe
  2⤵
  PID:5736
- C:\Windows\System\CtpIPzN.exe
  C:\Windows\System\CtpIPzN.exe
  2⤵
  PID:1512
- C:\Windows\System\UpobvzF.exe
  C:\Windows\System\UpobvzF.exe
  2⤵
  PID:5916
- C:\Windows\System\AvJAFua.exe
  C:\Windows\System\AvJAFua.exe
  2⤵
  PID:6068
- C:\Windows\System\gKxCOmZ.exe
  C:\Windows\System\gKxCOmZ.exe
  2⤵
  PID:6064
- C:\Windows\System\GWpJXtk.exe
  C:\Windows\System\GWpJXtk.exe
  2⤵
  PID:3308
- C:\Windows\System\wjsaOag.exe
  C:\Windows\System\wjsaOag.exe
  2⤵
  PID:5452
- C:\Windows\System\dbxeSum.exe
  C:\Windows\System\dbxeSum.exe
  2⤵
  PID:3400
- C:\Windows\System\pUBoePS.exe
  C:\Windows\System\pUBoePS.exe
  2⤵
  PID:5944
- C:\Windows\System\VUvxZKQ.exe
  C:\Windows\System\VUvxZKQ.exe
  2⤵
  PID:404
- C:\Windows\System\dgcnwjp.exe
  C:\Windows\System\dgcnwjp.exe
  2⤵
  PID:3216
- C:\Windows\System\GgMheLo.exe
  C:\Windows\System\GgMheLo.exe
  2⤵
  PID:1940
- C:\Windows\System\FLMryXH.exe
  C:\Windows\System\FLMryXH.exe
  2⤵
  PID:5812
- C:\Windows\System\Bjvsgai.exe
  C:\Windows\System\Bjvsgai.exe
  2⤵
  PID:6156
- C:\Windows\System\ycQFSEe.exe
  C:\Windows\System\ycQFSEe.exe
  2⤵
  PID:6176
- C:\Windows\System\hXIySeb.exe
  C:\Windows\System\hXIySeb.exe
  2⤵
  PID:6196
- C:\Windows\System\wRNUKbP.exe
  C:\Windows\System\wRNUKbP.exe
  2⤵
  PID:6228
- C:\Windows\System\kqifVez.exe
  C:\Windows\System\kqifVez.exe
  2⤵
  PID:6284
- C:\Windows\System\iLHwXRG.exe
  C:\Windows\System\iLHwXRG.exe
  2⤵
  PID:6316
- C:\Windows\System\fSUMuoJ.exe
  C:\Windows\System\fSUMuoJ.exe
  2⤵
  PID:6340
- C:\Windows\System\yipFOXE.exe
  C:\Windows\System\yipFOXE.exe
  2⤵
  PID:6372
- C:\Windows\System\awBRYOH.exe
  C:\Windows\System\awBRYOH.exe
  2⤵
  PID:6388
- C:\Windows\System\gGcYcls.exe
  C:\Windows\System\gGcYcls.exe
  2⤵
  PID:6404
- C:\Windows\System\aKeJGwL.exe
  C:\Windows\System\aKeJGwL.exe
  2⤵
  PID:6420
- C:\Windows\System\EwgaLje.exe
  C:\Windows\System\EwgaLje.exe
  2⤵
  PID:6452
- C:\Windows\System\xrIVnhi.exe
  C:\Windows\System\xrIVnhi.exe
  2⤵
  PID:6492
- C:\Windows\System\bTqxUDv.exe
  C:\Windows\System\bTqxUDv.exe
  2⤵
  PID:6524
- C:\Windows\System\qFFFvmm.exe
  C:\Windows\System\qFFFvmm.exe
  2⤵
  PID:6588
- C:\Windows\System\ShTfVae.exe
  C:\Windows\System\ShTfVae.exe
  2⤵
  PID:6604
- C:\Windows\System\lShCGjK.exe
  C:\Windows\System\lShCGjK.exe
  2⤵
  PID:6636
- C:\Windows\System\geZKXjF.exe
  C:\Windows\System\geZKXjF.exe
  2⤵
  PID:6656
- C:\Windows\System\okFXILf.exe
  C:\Windows\System\okFXILf.exe
  2⤵
  PID:6672
- C:\Windows\System\TgKXuBx.exe
  C:\Windows\System\TgKXuBx.exe
  2⤵
  PID:6704
- C:\Windows\System\UPZgygK.exe
  C:\Windows\System\UPZgygK.exe
  2⤵
  PID:6736
- C:\Windows\System\jGRgfjE.exe
  C:\Windows\System\jGRgfjE.exe
  2⤵
  PID:6752
- C:\Windows\System\VlrZWSs.exe
  C:\Windows\System\VlrZWSs.exe
  2⤵
  PID:6792
- C:\Windows\System\zWGtCES.exe
  C:\Windows\System\zWGtCES.exe
  2⤵
  PID:6828
- C:\Windows\System\HaOraZP.exe
  C:\Windows\System\HaOraZP.exe
  2⤵
  PID:6852
- C:\Windows\System\jXKjliG.exe
  C:\Windows\System\jXKjliG.exe
  2⤵
  PID:6876
- C:\Windows\System\ZCgrctl.exe
  C:\Windows\System\ZCgrctl.exe
  2⤵
  PID:6892
- C:\Windows\System\jpXjVoC.exe
  C:\Windows\System\jpXjVoC.exe
  2⤵
  PID:6928
- C:\Windows\System\qUICEtS.exe
  C:\Windows\System\qUICEtS.exe
  2⤵
  PID:6944
- C:\Windows\System\jyTWjJg.exe
  C:\Windows\System\jyTWjJg.exe
  2⤵
  PID:6972
- C:\Windows\System\wQRgeMQ.exe
  C:\Windows\System\wQRgeMQ.exe
  2⤵
  PID:6988
- C:\Windows\System\anEKwtP.exe
  C:\Windows\System\anEKwtP.exe
  2⤵
  PID:7020
- C:\Windows\System\baSDqhi.exe
  C:\Windows\System\baSDqhi.exe
  2⤵
  PID:7060
- C:\Windows\System\uykyAlx.exe
  C:\Windows\System\uykyAlx.exe
  2⤵
  PID:7076
- C:\Windows\System\sbCCDcK.exe
  C:\Windows\System\sbCCDcK.exe
  2⤵
  PID:7104
- C:\Windows\System\dbwUcge.exe
  C:\Windows\System\dbwUcge.exe
  2⤵
  PID:7128
- C:\Windows\System\dWqSjXx.exe
  C:\Windows\System\dWqSjXx.exe
  2⤵
  PID:7152
- C:\Windows\System\xCtzjxE.exe
  C:\Windows\System\xCtzjxE.exe
  2⤵
  PID:6060
- C:\Windows\System\ptnDlOl.exe
  C:\Windows\System\ptnDlOl.exe
  2⤵
  PID:3660
- C:\Windows\System\ANSbUKS.exe
  C:\Windows\System\ANSbUKS.exe
  2⤵
  PID:6164
- C:\Windows\System\QySXWzT.exe
  C:\Windows\System\QySXWzT.exe
  2⤵
  PID:6256
- C:\Windows\System\sZSSTxb.exe
  C:\Windows\System\sZSSTxb.exe
  2⤵
  PID:6312
- C:\Windows\System\FJejmfQ.exe
  C:\Windows\System\FJejmfQ.exe
  2⤵
  PID:6432
- C:\Windows\System\QFIfjta.exe
  C:\Windows\System\QFIfjta.exe
  2⤵
  PID:6416
- C:\Windows\System\wUsQLYF.exe
  C:\Windows\System\wUsQLYF.exe
  2⤵
  PID:6384
- C:\Windows\System\TKsZQtm.exe
  C:\Windows\System\TKsZQtm.exe
  2⤵
  PID:6448
- C:\Windows\System\XUgadcx.exe
  C:\Windows\System\XUgadcx.exe
  2⤵
  PID:6508
- C:\Windows\System\vtHZBjs.exe
  C:\Windows\System\vtHZBjs.exe
  2⤵
  PID:6544
- C:\Windows\System\hPtowFQ.exe
  C:\Windows\System\hPtowFQ.exe
  2⤵
  PID:6580
- C:\Windows\System\KzVwuSJ.exe
  C:\Windows\System\KzVwuSJ.exe
  2⤵
  PID:5532
- C:\Windows\System\qjYWzyL.exe
  C:\Windows\System\qjYWzyL.exe
  2⤵
  PID:6624
- C:\Windows\System\RSNylYH.exe
  C:\Windows\System\RSNylYH.exe
  2⤵
  PID:6668
- C:\Windows\System\tJPOQhf.exe
  C:\Windows\System\tJPOQhf.exe
  2⤵
  PID:6696
- C:\Windows\System\Gqclbjt.exe
  C:\Windows\System\Gqclbjt.exe
  2⤵
  PID:6748
- C:\Windows\System\baJtYlE.exe
  C:\Windows\System\baJtYlE.exe
  2⤵
  PID:6776
- C:\Windows\System\AhsHaYv.exe
  C:\Windows\System\AhsHaYv.exe
  2⤵
  PID:6864
- C:\Windows\System\mwXQshK.exe
  C:\Windows\System\mwXQshK.exe
  2⤵
  PID:6820
- C:\Windows\System\bGDbHtx.exe
  C:\Windows\System\bGDbHtx.exe
  2⤵
  PID:6908
- C:\Windows\System\GBUqSzf.exe
  C:\Windows\System\GBUqSzf.exe
  2⤵
  PID:7056
- C:\Windows\System\UqufMVu.exe
  C:\Windows\System\UqufMVu.exe
  2⤵
  PID:6184
- C:\Windows\System\QXhVWRj.exe
  C:\Windows\System\QXhVWRj.exe
  2⤵
  PID:6760
- C:\Windows\System\fyAIPGe.exe
  C:\Windows\System\fyAIPGe.exe
  2⤵
  PID:6840
- C:\Windows\System\imOJFby.exe
  C:\Windows\System\imOJFby.exe
  2⤵
  PID:6488
- C:\Windows\System\HJOWoyM.exe
  C:\Windows\System\HJOWoyM.exe
  2⤵
  PID:6596
- C:\Windows\System\JlbLwza.exe
  C:\Windows\System\JlbLwza.exe
  2⤵
  PID:6396
- C:\Windows\System\fJnhtMc.exe
  C:\Windows\System\fJnhtMc.exe
  2⤵
  PID:6584
- C:\Windows\System\AToroLy.exe
  C:\Windows\System\AToroLy.exe
  2⤵
  PID:2712
- C:\Windows\System\NPNftCP.exe
  C:\Windows\System\NPNftCP.exe
  2⤵
  PID:6724
- C:\Windows\System\pnkLupD.exe
  C:\Windows\System\pnkLupD.exe
  2⤵
  PID:6996
- C:\Windows\System\HjhlUcm.exe
  C:\Windows\System\HjhlUcm.exe
  2⤵
  PID:7180
- C:\Windows\System\jcXgBNV.exe
  C:\Windows\System\jcXgBNV.exe
  2⤵
  PID:7200
- C:\Windows\System\iUeCFlH.exe
  C:\Windows\System\iUeCFlH.exe
  2⤵
  PID:7220
- C:\Windows\System\ZVxIySo.exe
  C:\Windows\System\ZVxIySo.exe
  2⤵
  PID:7240
- C:\Windows\System\iWJkbSR.exe
  C:\Windows\System\iWJkbSR.exe
  2⤵
  PID:7304
- C:\Windows\System\lUFaClq.exe
  C:\Windows\System\lUFaClq.exe
  2⤵
  PID:7328
- C:\Windows\System\yQzvfGj.exe
  C:\Windows\System\yQzvfGj.exe
  2⤵
  PID:7344
- C:\Windows\System\TXWLVRY.exe
  C:\Windows\System\TXWLVRY.exe
  2⤵
  PID:7428
- C:\Windows\System\ziuYDDv.exe
  C:\Windows\System\ziuYDDv.exe
  2⤵
  PID:7448
- C:\Windows\System\SLxvJmc.exe
  C:\Windows\System\SLxvJmc.exe
  2⤵
  PID:7464
- C:\Windows\System\qTTgbKS.exe
  C:\Windows\System\qTTgbKS.exe
  2⤵
  PID:7492
- C:\Windows\System\lATeFVn.exe
  C:\Windows\System\lATeFVn.exe
  2⤵
  PID:7652
- C:\Windows\System\RjVXAUP.exe
  C:\Windows\System\RjVXAUP.exe
  2⤵
  PID:7676
- C:\Windows\System\XnMAUgg.exe
  C:\Windows\System\XnMAUgg.exe
  2⤵
  PID:7692
- C:\Windows\System\ATgBAWz.exe
  C:\Windows\System\ATgBAWz.exe
  2⤵
  PID:7712
- C:\Windows\System\PmgDZpS.exe
  C:\Windows\System\PmgDZpS.exe
  2⤵
  PID:7728
- C:\Windows\System\ldOyIOz.exe
  C:\Windows\System\ldOyIOz.exe
  2⤵
  PID:7752
- C:\Windows\System\XebGWHP.exe
  C:\Windows\System\XebGWHP.exe
  2⤵
  PID:7780
- C:\Windows\System\lKoBNPE.exe
  C:\Windows\System\lKoBNPE.exe
  2⤵
  PID:7796
- C:\Windows\System\LRwxDXi.exe
  C:\Windows\System\LRwxDXi.exe
  2⤵
  PID:7816
- C:\Windows\System\XKTaUvS.exe
  C:\Windows\System\XKTaUvS.exe
  2⤵
  PID:7832
- C:\Windows\System\zphXGmg.exe
  C:\Windows\System\zphXGmg.exe
  2⤵
  PID:7856
- C:\Windows\System\zzSZlGZ.exe
  C:\Windows\System\zzSZlGZ.exe
  2⤵
  PID:7872
- C:\Windows\System\AbpxUZF.exe
  C:\Windows\System\AbpxUZF.exe
  2⤵
  PID:7912
- C:\Windows\System\HwCtJJZ.exe
  C:\Windows\System\HwCtJJZ.exe
  2⤵
  PID:7932
- C:\Windows\System\deJqgoJ.exe
  C:\Windows\System\deJqgoJ.exe
  2⤵
  PID:7948
- C:\Windows\System\RPCfvcv.exe
  C:\Windows\System\RPCfvcv.exe
  2⤵
  PID:7980
- C:\Windows\System\RHgjsOR.exe
  C:\Windows\System\RHgjsOR.exe
  2⤵
  PID:8000
- C:\Windows\System\oNcmYAY.exe
  C:\Windows\System\oNcmYAY.exe
  2⤵
  PID:8036
- C:\Windows\System\RbNZQXZ.exe
  C:\Windows\System\RbNZQXZ.exe
  2⤵
  PID:8052
- C:\Windows\System\VCkUwJg.exe
  C:\Windows\System\VCkUwJg.exe
  2⤵
  PID:8080
- C:\Windows\System\ydGKNEg.exe
  C:\Windows\System\ydGKNEg.exe
  2⤵
  PID:8100
- C:\Windows\System\nQUZyzv.exe
  C:\Windows\System\nQUZyzv.exe
  2⤵
  PID:8120
- C:\Windows\System\gHmjcty.exe
  C:\Windows\System\gHmjcty.exe
  2⤵
  PID:8136
- C:\Windows\System\Kjajqxy.exe
  C:\Windows\System\Kjajqxy.exe
  2⤵
  PID:6472
- C:\Windows\System\mRVOpRW.exe
  C:\Windows\System\mRVOpRW.exe
  2⤵
  PID:7016
- C:\Windows\System\gYBOonL.exe
  C:\Windows\System\gYBOonL.exe
  2⤵
  PID:7312
- C:\Windows\System\dRydojl.exe
  C:\Windows\System\dRydojl.exe
  2⤵
  PID:7188
- C:\Windows\System\EstquMp.exe
  C:\Windows\System\EstquMp.exe
  2⤵
  PID:7384
- C:\Windows\System\pVGFAaf.exe
  C:\Windows\System\pVGFAaf.exe
  2⤵
  PID:7480
- C:\Windows\System\FFnfTyK.exe
  C:\Windows\System\FFnfTyK.exe
  2⤵
  PID:7588
- C:\Windows\System\AWqyJZC.exe
  C:\Windows\System\AWqyJZC.exe
  2⤵
  PID:7764
- C:\Windows\System\XysOhfC.exe
  C:\Windows\System\XysOhfC.exe
  2⤵
  PID:7772
- C:\Windows\System\yAsyVvk.exe
  C:\Windows\System\yAsyVvk.exe
  2⤵
  PID:7736
- C:\Windows\System\eSpCXhg.exe
  C:\Windows\System\eSpCXhg.exe
  2⤵
  PID:7804
- C:\Windows\System\ceyODEg.exe
  C:\Windows\System\ceyODEg.exe
  2⤵
  PID:7868
- C:\Windows\System\eToAkfh.exe
  C:\Windows\System\eToAkfh.exe
  2⤵
  PID:7892
- C:\Windows\System\uGIJgdl.exe
  C:\Windows\System\uGIJgdl.exe
  2⤵
  PID:7928
- C:\Windows\System\ZgzMJte.exe
  C:\Windows\System\ZgzMJte.exe
  2⤵
  PID:7996
- C:\Windows\System\llVGBsV.exe
  C:\Windows\System\llVGBsV.exe
  2⤵
  PID:8172
- C:\Windows\System\NZhuGVG.exe
  C:\Windows\System\NZhuGVG.exe
  2⤵
  PID:8048
- C:\Windows\System\pISCCxF.exe
  C:\Windows\System\pISCCxF.exe
  2⤵
  PID:8180
- C:\Windows\System\JLCoVys.exe
  C:\Windows\System\JLCoVys.exe
  2⤵
  PID:7460
- C:\Windows\System\VPWbKGs.exe
  C:\Windows\System\VPWbKGs.exe
  2⤵
  PID:7292
- C:\Windows\System\eQLXbnI.exe
  C:\Windows\System\eQLXbnI.exe
  2⤵
  PID:7688
- C:\Windows\System\xfxqOKK.exe
  C:\Windows\System\xfxqOKK.exe
  2⤵
  PID:7672
- C:\Windows\System\mQhOVHr.exe
  C:\Windows\System\mQhOVHr.exe
  2⤵
  PID:7908
- C:\Windows\System\JvEVxrJ.exe
  C:\Windows\System\JvEVxrJ.exe
  2⤵
  PID:7792
- C:\Windows\System\bENDhxG.exe
  C:\Windows\System\bENDhxG.exe
  2⤵
  PID:7964
- C:\Windows\System\gAmFGlE.exe
  C:\Windows\System\gAmFGlE.exe
  2⤵
  PID:8132
- C:\Windows\System\IiHRxuV.exe
  C:\Windows\System\IiHRxuV.exe
  2⤵
  PID:6936
- C:\Windows\System\sXmJwfK.exe
  C:\Windows\System\sXmJwfK.exe
  2⤵
  PID:8196
- C:\Windows\System\cjpWVyh.exe
  C:\Windows\System\cjpWVyh.exe
  2⤵
  PID:8260
- C:\Windows\System\KckgSWb.exe
  C:\Windows\System\KckgSWb.exe
  2⤵
  PID:8280
- C:\Windows\System\pTcchJb.exe
  C:\Windows\System\pTcchJb.exe
  2⤵
  PID:8304
- C:\Windows\System\eknQtDH.exe
  C:\Windows\System\eknQtDH.exe
  2⤵
  PID:8352
- C:\Windows\System\IDKWPVj.exe
  C:\Windows\System\IDKWPVj.exe
  2⤵
  PID:8372
- C:\Windows\System\fFoDtqk.exe
  C:\Windows\System\fFoDtqk.exe
  2⤵
  PID:8420
- C:\Windows\System\wBmWfgh.exe
  C:\Windows\System\wBmWfgh.exe
  2⤵
  PID:8460
- C:\Windows\System\dGOJZhS.exe
  C:\Windows\System\dGOJZhS.exe
  2⤵
  PID:8476
- C:\Windows\System\wRSwYti.exe
  C:\Windows\System\wRSwYti.exe
  2⤵
  PID:8496
- C:\Windows\System\Gkbquhq.exe
  C:\Windows\System\Gkbquhq.exe
  2⤵
  PID:8512
- C:\Windows\System\sJoQiqj.exe
  C:\Windows\System\sJoQiqj.exe
  2⤵
  PID:8536
- C:\Windows\System\NJVtbTk.exe
  C:\Windows\System\NJVtbTk.exe
  2⤵
  PID:8552
- C:\Windows\System\HGqPUFh.exe
  C:\Windows\System\HGqPUFh.exe
  2⤵
  PID:8600
- C:\Windows\System\kdhWoMK.exe
  C:\Windows\System\kdhWoMK.exe
  2⤵
  PID:8616
- C:\Windows\System\sbuYehA.exe
  C:\Windows\System\sbuYehA.exe
  2⤵
  PID:8684
- C:\Windows\System\ozhXjvw.exe
  C:\Windows\System\ozhXjvw.exe
  2⤵
  PID:8700
- C:\Windows\System\NVjTHDC.exe
  C:\Windows\System\NVjTHDC.exe
  2⤵
  PID:8788
- C:\Windows\System\AteoDJW.exe
  C:\Windows\System\AteoDJW.exe
  2⤵
  PID:8804
- C:\Windows\System\wWOmpQq.exe
  C:\Windows\System\wWOmpQq.exe
  2⤵
  PID:8824
- C:\Windows\System\RKDPgJg.exe
  C:\Windows\System\RKDPgJg.exe
  2⤵
  PID:8848
- C:\Windows\System\QGcTEpX.exe
  C:\Windows\System\QGcTEpX.exe
  2⤵
  PID:8864
- C:\Windows\System\FrfeZpX.exe
  C:\Windows\System\FrfeZpX.exe
  2⤵
  PID:8916
- C:\Windows\System\GPgdtPs.exe
  C:\Windows\System\GPgdtPs.exe
  2⤵
  PID:8940
- C:\Windows\System\mmfpSsn.exe
  C:\Windows\System\mmfpSsn.exe
  2⤵
  PID:8968
- C:\Windows\System\HENyqIK.exe
  C:\Windows\System\HENyqIK.exe
  2⤵
  PID:9016
- C:\Windows\System\TDExYQk.exe
  C:\Windows\System\TDExYQk.exe
  2⤵
  PID:9032
- C:\Windows\System\guGnqcG.exe
  C:\Windows\System\guGnqcG.exe
  2⤵
  PID:9052
- C:\Windows\System\KtdTzsj.exe
  C:\Windows\System\KtdTzsj.exe
  2⤵
  PID:9068
- C:\Windows\System\hVSUelH.exe
  C:\Windows\System\hVSUelH.exe
  2⤵
  PID:9096
- C:\Windows\System\GeGHEsX.exe
  C:\Windows\System\GeGHEsX.exe
  2⤵
  PID:9136
- C:\Windows\System\MjzKhMi.exe
  C:\Windows\System\MjzKhMi.exe
  2⤵
  PID:9160
- C:\Windows\System\QgjKgsI.exe
  C:\Windows\System\QgjKgsI.exe
  2⤵
  PID:9176
- C:\Windows\System\EUkKMTT.exe
  C:\Windows\System\EUkKMTT.exe
  2⤵
  PID:7668
- C:\Windows\System\QongHRe.exe
  C:\Windows\System\QongHRe.exe
  2⤵
  PID:8232
- C:\Windows\System\mTdtkMe.exe
  C:\Windows\System\mTdtkMe.exe
  2⤵
  PID:8204
- C:\Windows\System\vJVjQtp.exe
  C:\Windows\System\vJVjQtp.exe
  2⤵
  PID:8072
- C:\Windows\System\inxqwqm.exe
  C:\Windows\System\inxqwqm.exe
  2⤵
  PID:8252
- C:\Windows\System\TSBxsEO.exe
  C:\Windows\System\TSBxsEO.exe
  2⤵
  PID:8248
- C:\Windows\System\KFJLHFK.exe
  C:\Windows\System\KFJLHFK.exe
  2⤵
  PID:8288
- C:\Windows\System\FuMdQfT.exe
  C:\Windows\System\FuMdQfT.exe
  2⤵
  PID:8432
- C:\Windows\System\kdzVSAP.exe
  C:\Windows\System\kdzVSAP.exe
  2⤵
  PID:8492
- C:\Windows\System\aimPtih.exe
  C:\Windows\System\aimPtih.exe
  2⤵
  PID:8452
- C:\Windows\System\NlIThyK.exe
  C:\Windows\System\NlIThyK.exe
  2⤵
  PID:8660
- C:\Windows\System\YLMhLSd.exe
  C:\Windows\System\YLMhLSd.exe
  2⤵
  PID:8632
- C:\Windows\System\FIwVYNk.exe
  C:\Windows\System\FIwVYNk.exe
  2⤵
  PID:8736
- C:\Windows\System\nAUEjye.exe
  C:\Windows\System\nAUEjye.exe
  2⤵
  PID:8800
- C:\Windows\System\JPWmVxS.exe
  C:\Windows\System\JPWmVxS.exe
  2⤵
  PID:8856
- C:\Windows\System\bayLNpE.exe
  C:\Windows\System\bayLNpE.exe
  2⤵
  PID:8876
- C:\Windows\System\dqvOXja.exe
  C:\Windows\System\dqvOXja.exe
  2⤵
  PID:8960
- C:\Windows\System\nwvDQEM.exe
  C:\Windows\System\nwvDQEM.exe
  2⤵
  PID:9028
- C:\Windows\System\ALnBvur.exe
  C:\Windows\System\ALnBvur.exe
  2⤵
  PID:9040
- C:\Windows\System\PSlbjVb.exe
  C:\Windows\System\PSlbjVb.exe
  2⤵
  PID:9120
- C:\Windows\System\zRovUYQ.exe
  C:\Windows\System\zRovUYQ.exe
  2⤵
  PID:9168
- C:\Windows\System\nnQjNpH.exe
  C:\Windows\System\nnQjNpH.exe
  2⤵
  PID:9148
- C:\Windows\System\xsVcYjx.exe
  C:\Windows\System\xsVcYjx.exe
  2⤵
  PID:7704
- C:\Windows\System\xyNisAt.exe
  C:\Windows\System\xyNisAt.exe
  2⤵
  PID:8860
- C:\Windows\System\fPAZDCk.exe
  C:\Windows\System\fPAZDCk.exe
  2⤵
  PID:8936
- C:\Windows\System\zjblRaJ.exe
  C:\Windows\System\zjblRaJ.exe
  2⤵
  PID:8988
- C:\Windows\System\pzNqefg.exe
  C:\Windows\System\pzNqefg.exe
  2⤵
  PID:7848
- C:\Windows\System\LOSYTve.exe
  C:\Windows\System\LOSYTve.exe
  2⤵
  PID:8592
- C:\Windows\System\UEKSKps.exe
  C:\Windows\System\UEKSKps.exe
  2⤵
  PID:8408
- C:\Windows\System\CDCaYPN.exe
  C:\Windows\System\CDCaYPN.exe
  2⤵
  PID:8508
- C:\Windows\System\YlSFvXE.exe
  C:\Windows\System\YlSFvXE.exe
  2⤵
  PID:8776
- C:\Windows\System\eAjpEGB.exe
  C:\Windows\System\eAjpEGB.exe
  2⤵
  PID:9236
- C:\Windows\System\HCllxmx.exe
  C:\Windows\System\HCllxmx.exe
  2⤵
  PID:9264
- C:\Windows\System\VaeDRCE.exe
  C:\Windows\System\VaeDRCE.exe
  2⤵
  PID:9296
- C:\Windows\System\kwTgMtM.exe
  C:\Windows\System\kwTgMtM.exe
  2⤵
  PID:9364
- C:\Windows\System\YHaICxL.exe
  C:\Windows\System\YHaICxL.exe
  2⤵
  PID:9396
- C:\Windows\System\WuoDUwi.exe
  C:\Windows\System\WuoDUwi.exe
  2⤵
  PID:9412
- C:\Windows\System\QfYlGCl.exe
  C:\Windows\System\QfYlGCl.exe
  2⤵
  PID:9456
- C:\Windows\System\YKEBZWP.exe
  C:\Windows\System\YKEBZWP.exe
  2⤵
  PID:9476
- C:\Windows\System\alFlbMZ.exe
  C:\Windows\System\alFlbMZ.exe
  2⤵
  PID:9504
- C:\Windows\System\QyalmZS.exe
  C:\Windows\System\QyalmZS.exe
  2⤵
  PID:9520
- C:\Windows\System\OOywlus.exe
  C:\Windows\System\OOywlus.exe
  2⤵
  PID:9548
- C:\Windows\System\adUKMbA.exe
  C:\Windows\System\adUKMbA.exe
  2⤵
  PID:9568
- C:\Windows\System\TcZqvdK.exe
  C:\Windows\System\TcZqvdK.exe
  2⤵
  PID:9584
- C:\Windows\System\VKPHUbZ.exe
  C:\Windows\System\VKPHUbZ.exe
  2⤵
  PID:9620
- C:\Windows\System\iwPGpXP.exe
  C:\Windows\System\iwPGpXP.exe
  2⤵
  PID:9644
- C:\Windows\System\TSellXm.exe
  C:\Windows\System\TSellXm.exe
  2⤵
  PID:9680
- C:\Windows\System\yHgLByh.exe
  C:\Windows\System\yHgLByh.exe
  2⤵
  PID:9704
- C:\Windows\System\EBuVfOc.exe
  C:\Windows\System\EBuVfOc.exe
  2⤵
  PID:9720
- C:\Windows\System\qhOmQHy.exe
  C:\Windows\System\qhOmQHy.exe
  2⤵
  PID:9740
- C:\Windows\System\ZbHwIIV.exe
  C:\Windows\System\ZbHwIIV.exe
  2⤵
  PID:9760
- C:\Windows\System\ygHrusI.exe
  C:\Windows\System\ygHrusI.exe
  2⤵
  PID:9776
- C:\Windows\System\JHuKSKe.exe
  C:\Windows\System\JHuKSKe.exe
  2⤵
  PID:9816
- C:\Windows\System\bvugRom.exe
  C:\Windows\System\bvugRom.exe
  2⤵
  PID:9864
- C:\Windows\System\prOvvxs.exe
  C:\Windows\System\prOvvxs.exe
  2⤵
  PID:9884
- C:\Windows\System\KjsdvWT.exe
  C:\Windows\System\KjsdvWT.exe
  2⤵
  PID:9944
- C:\Windows\System\BbAuNja.exe
  C:\Windows\System\BbAuNja.exe
  2⤵
  PID:9984
- C:\Windows\System\zQaKqtf.exe
  C:\Windows\System\zQaKqtf.exe
  2⤵
  PID:10028
- C:\Windows\System\qORZbFL.exe
  C:\Windows\System\qORZbFL.exe
  2⤵
  PID:10044
- C:\Windows\System\mUJIbRA.exe
  C:\Windows\System\mUJIbRA.exe
  2⤵
  PID:10064
- C:\Windows\System\jvgYIZL.exe
  C:\Windows\System\jvgYIZL.exe
  2⤵
  PID:10080
- C:\Windows\System\BMgLJnC.exe
  C:\Windows\System\BMgLJnC.exe
  2⤵
  PID:10100
- C:\Windows\System\DnvVjkW.exe
  C:\Windows\System\DnvVjkW.exe
  2⤵
  PID:10116
- C:\Windows\System\QtSVPsQ.exe
  C:\Windows\System\QtSVPsQ.exe
  2⤵
  PID:10156
- C:\Windows\System\qocZxhc.exe
  C:\Windows\System\qocZxhc.exe
  2⤵
  PID:10172
- C:\Windows\System\jMqUcYo.exe
  C:\Windows\System\jMqUcYo.exe
  2⤵
  PID:10200
- C:\Windows\System\VSAOpnx.exe
  C:\Windows\System\VSAOpnx.exe
  2⤵
  PID:10224
- C:\Windows\System\tJhqaSu.exe
  C:\Windows\System\tJhqaSu.exe
  2⤵
  PID:6332
- C:\Windows\System\jGquwCl.exe
  C:\Windows\System\jGquwCl.exe
  2⤵
  PID:8412
- C:\Windows\System\gatHljh.exe
  C:\Windows\System\gatHljh.exe
  2⤵
  PID:9024
- C:\Windows\System\BqQDjvD.exe
  C:\Windows\System\BqQDjvD.exe
  2⤵
  PID:9308
- C:\Windows\System\OzYuYJE.exe
  C:\Windows\System\OzYuYJE.exe
  2⤵
  PID:9408
- C:\Windows\System\ioYUuoz.exe
  C:\Windows\System\ioYUuoz.exe
  2⤵
  PID:9528
- C:\Windows\System\sgPDoZb.exe
  C:\Windows\System\sgPDoZb.exe
  2⤵
  PID:9560
- C:\Windows\System\JWDwqpz.exe
  C:\Windows\System\JWDwqpz.exe
  2⤵
  PID:9576
- C:\Windows\System\MSewhAa.exe
  C:\Windows\System\MSewhAa.exe
  2⤵
  PID:9636
- C:\Windows\System\QuKaJei.exe
  C:\Windows\System\QuKaJei.exe
  2⤵
  PID:9728
- C:\Windows\System\eyYmOCa.exe
  C:\Windows\System\eyYmOCa.exe
  2⤵
  PID:9852
- C:\Windows\System\nTnjoNN.exe
  C:\Windows\System\nTnjoNN.exe
  2⤵
  PID:9932
- C:\Windows\System\zGwCPRZ.exe
  C:\Windows\System\zGwCPRZ.exe
  2⤵
  PID:10024
- C:\Windows\System\cMGrsrh.exe
  C:\Windows\System\cMGrsrh.exe
  2⤵
  PID:10108
- C:\Windows\System\NKDGqiC.exe
  C:\Windows\System\NKDGqiC.exe
  2⤵
  PID:10088
- C:\Windows\System\KmuPwKc.exe
  C:\Windows\System\KmuPwKc.exe
  2⤵
  PID:9144
- C:\Windows\System\UumjhmI.exe
  C:\Windows\System\UumjhmI.exe
  2⤵
  PID:10180
- C:\Windows\System\WCmNeyX.exe
  C:\Windows\System\WCmNeyX.exe
  2⤵
  PID:10236
- C:\Windows\System\VdfUZOD.exe
  C:\Windows\System\VdfUZOD.exe
  2⤵
  PID:9440
- C:\Windows\System\hfBtYtV.exe
  C:\Windows\System\hfBtYtV.exe
  2⤵
  PID:9716
- C:\Windows\System\dVrzWdv.exe
  C:\Windows\System\dVrzWdv.exe
  2⤵
  PID:9912
- C:\Windows\System\bmpEgpP.exe
  C:\Windows\System\bmpEgpP.exe
  2⤵
  PID:10020
- C:\Windows\System\JEwtvFU.exe
  C:\Windows\System\JEwtvFU.exe
  2⤵
  PID:10152
- C:\Windows\System\CWusKli.exe
  C:\Windows\System\CWusKli.exe
  2⤵
  PID:9484
- C:\Windows\System\tAsDWly.exe
  C:\Windows\System\tAsDWly.exe
  2⤵
  PID:9516
- C:\Windows\System\KdhuyFS.exe
  C:\Windows\System\KdhuyFS.exe
  2⤵
  PID:9664
- C:\Windows\System\wEeIDWr.exe
  C:\Windows\System\wEeIDWr.exe
  2⤵
  PID:10136
- C:\Windows\System\TauIKWd.exe
  C:\Windows\System\TauIKWd.exe
  2⤵
  PID:10256
- C:\Windows\System\AupTvbR.exe
  C:\Windows\System\AupTvbR.exe
  2⤵
  PID:10272
- C:\Windows\System\sHFjHOI.exe
  C:\Windows\System\sHFjHOI.exe
  2⤵
  PID:10296
- C:\Windows\System\UwWzoAU.exe
  C:\Windows\System\UwWzoAU.exe
  2⤵
  PID:10376
- C:\Windows\System\Rhrizvx.exe
  C:\Windows\System\Rhrizvx.exe
  2⤵
  PID:10396
- C:\Windows\System\uIJLckB.exe
  C:\Windows\System\uIJLckB.exe
  2⤵
  PID:10416
- C:\Windows\System\drIeAJG.exe
  C:\Windows\System\drIeAJG.exe
  2⤵
  PID:10444
- C:\Windows\System\cJsjnUN.exe
  C:\Windows\System\cJsjnUN.exe
  2⤵
  PID:10484
- C:\Windows\System\QtdHHRT.exe
  C:\Windows\System\QtdHHRT.exe
  2⤵
  PID:10500
- C:\Windows\System\gYmXkxw.exe
  C:\Windows\System\gYmXkxw.exe
  2⤵
  PID:10520
- C:\Windows\System\sBRVKpx.exe
  C:\Windows\System\sBRVKpx.exe
  2⤵
  PID:10556
- C:\Windows\System\zcfqATu.exe
  C:\Windows\System\zcfqATu.exe
  2⤵
  PID:10592
- C:\Windows\System\WqqmErE.exe
  C:\Windows\System\WqqmErE.exe
  2⤵
  PID:10616
- C:\Windows\System\EfVjUUa.exe
  C:\Windows\System\EfVjUUa.exe
  2⤵
  PID:10632
- C:\Windows\System\xfeYUrG.exe
  C:\Windows\System\xfeYUrG.exe
  2⤵
  PID:10660
- C:\Windows\System\riBhvXK.exe
  C:\Windows\System\riBhvXK.exe
  2⤵
  PID:10680
- C:\Windows\System\lTvFAKj.exe
  C:\Windows\System\lTvFAKj.exe
  2⤵
  PID:10704
- C:\Windows\System\dIZlbqZ.exe
  C:\Windows\System\dIZlbqZ.exe
  2⤵
  PID:10724
- C:\Windows\System\SVBGEYE.exe
  C:\Windows\System\SVBGEYE.exe
  2⤵
  PID:10744
- C:\Windows\System\dqAecEz.exe
  C:\Windows\System\dqAecEz.exe
  2⤵
  PID:10760
- C:\Windows\System\mADvKMo.exe
  C:\Windows\System\mADvKMo.exe
  2⤵
  PID:10780
- C:\Windows\System\HtsjJjO.exe
  C:\Windows\System\HtsjJjO.exe
  2⤵
  PID:10808
- C:\Windows\System\jAHDjhJ.exe
  C:\Windows\System\jAHDjhJ.exe
  2⤵
  PID:10860
- C:\Windows\System\YmpReIH.exe
  C:\Windows\System\YmpReIH.exe
  2⤵
  PID:10880
- C:\Windows\System\qxHJdnX.exe
  C:\Windows\System\qxHJdnX.exe
  2⤵
  PID:10900
- C:\Windows\System\DIuLOGK.exe
  C:\Windows\System\DIuLOGK.exe
  2⤵
  PID:10952
- C:\Windows\System\ncUXsfX.exe
  C:\Windows\System\ncUXsfX.exe
  2⤵
  PID:10968
- C:\Windows\System\ZtNpMJn.exe
  C:\Windows\System\ZtNpMJn.exe
  2⤵
  PID:10988
- C:\Windows\System\iGFZOEQ.exe
  C:\Windows\System\iGFZOEQ.exe
  2⤵
  PID:11012
- C:\Windows\System\clCdMbS.exe
  C:\Windows\System\clCdMbS.exe
  2⤵
  PID:11028
- C:\Windows\System\KlZpSsL.exe
  C:\Windows\System\KlZpSsL.exe
  2⤵
  PID:11048
- C:\Windows\System\cQaaHaA.exe
  C:\Windows\System\cQaaHaA.exe
  2⤵
  PID:11068
- C:\Windows\System\aiDYixY.exe
  C:\Windows\System\aiDYixY.exe
  2⤵
  PID:11092
- C:\Windows\System\Onoyevc.exe
  C:\Windows\System\Onoyevc.exe
  2⤵
  PID:11108
- C:\Windows\System\DngvUcw.exe
  C:\Windows\System\DngvUcw.exe
  2⤵
  PID:11152
- C:\Windows\System\kVrZEqH.exe
  C:\Windows\System\kVrZEqH.exe
  2⤵
  PID:11168
- C:\Windows\System\ClaNWxA.exe
  C:\Windows\System\ClaNWxA.exe
  2⤵
  PID:11188
- C:\Windows\System\yQQpNcd.exe
  C:\Windows\System\yQQpNcd.exe
  2⤵
  PID:11232
- C:\Windows\System\FThrcpl.exe
  C:\Windows\System\FThrcpl.exe
  2⤵
  PID:10140
- C:\Windows\System\oodVvyN.exe
  C:\Windows\System\oodVvyN.exe
  2⤵
  PID:10288
- C:\Windows\System\CtcfYiK.exe
  C:\Windows\System\CtcfYiK.exe
  2⤵
  PID:10388
- C:\Windows\System\JZmpbxW.exe
  C:\Windows\System\JZmpbxW.exe
  2⤵
  PID:10408
- C:\Windows\System\LLNGMhZ.exe
  C:\Windows\System\LLNGMhZ.exe
  2⤵
  PID:10476
- C:\Windows\System\cevBfLl.exe
  C:\Windows\System\cevBfLl.exe
  2⤵
  PID:10604
- C:\Windows\System\nXgCzKf.exe
  C:\Windows\System\nXgCzKf.exe
  2⤵
  PID:10624
- C:\Windows\System\GMJHJfi.exe
  C:\Windows\System\GMJHJfi.exe
  2⤵
  PID:10732
- C:\Windows\System\wdShXdA.exe
  C:\Windows\System\wdShXdA.exe
  2⤵
  PID:10756
- C:\Windows\System\dHkjbrk.exe
  C:\Windows\System\dHkjbrk.exe
  2⤵
  PID:10688
- C:\Windows\System\kWnPtKj.exe
  C:\Windows\System\kWnPtKj.exe
  2⤵
  PID:10984
- C:\Windows\System\NjszgXi.exe
  C:\Windows\System\NjszgXi.exe
  2⤵
  PID:11104
- C:\Windows\System\qARgdBC.exe
  C:\Windows\System\qARgdBC.exe
  2⤵
  PID:11080
- C:\Windows\System\JlaKQWN.exe
  C:\Windows\System\JlaKQWN.exe
  2⤵
  PID:11140
- C:\Windows\System\ImGAkFp.exe
  C:\Windows\System\ImGAkFp.exe
  2⤵
  PID:11176
- C:\Windows\System\bUaHNjC.exe
  C:\Windows\System\bUaHNjC.exe
  2⤵
  PID:10456
- C:\Windows\System\DkhJivW.exe
  C:\Windows\System\DkhJivW.exe
  2⤵
  PID:10752
- C:\Windows\System\xlGJWUJ.exe
  C:\Windows\System\xlGJWUJ.exe
  2⤵
  PID:10836
- C:\Windows\System\EAcUmfv.exe
  C:\Windows\System\EAcUmfv.exe
  2⤵
  PID:11056
- C:\Windows\System\blLJmwk.exe
  C:\Windows\System\blLJmwk.exe
  2⤵
  PID:11160
- C:\Windows\System\yzPCqJP.exe
  C:\Windows\System\yzPCqJP.exe
  2⤵
  PID:11180
- C:\Windows\System\lCWrVav.exe
  C:\Windows\System\lCWrVav.exe
  2⤵
  PID:11272
- C:\Windows\System\FjyvBCn.exe
  C:\Windows\System\FjyvBCn.exe
  2⤵
  PID:11292
- C:\Windows\System\RAWOmfs.exe
  C:\Windows\System\RAWOmfs.exe
  2⤵
  PID:11308
- C:\Windows\System\FGXMFvs.exe
  C:\Windows\System\FGXMFvs.exe
  2⤵
  PID:11324
- C:\Windows\System\cMDdseY.exe
  C:\Windows\System\cMDdseY.exe
  2⤵
  PID:11340
- C:\Windows\System\RiGnBNk.exe
  C:\Windows\System\RiGnBNk.exe
  2⤵
  PID:11356
- C:\Windows\System\UAeelrp.exe
  C:\Windows\System\UAeelrp.exe
  2⤵
  PID:11372
- C:\Windows\System\NXhpGIM.exe
  C:\Windows\System\NXhpGIM.exe
  2⤵
  PID:11388
- C:\Windows\System\NrFhhVF.exe
  C:\Windows\System\NrFhhVF.exe
  2⤵
  PID:11404
- C:\Windows\System\aHtOlQu.exe
  C:\Windows\System\aHtOlQu.exe
  2⤵
  PID:11420
- C:\Windows\System\iAtOrkN.exe
  C:\Windows\System\iAtOrkN.exe
  2⤵
  PID:11436
- C:\Windows\System\ezmuMuu.exe
  C:\Windows\System\ezmuMuu.exe
  2⤵
  PID:11452
- C:\Windows\System\bxgRimu.exe
  C:\Windows\System\bxgRimu.exe
  2⤵
  PID:11468
- C:\Windows\System\OYzgToJ.exe
  C:\Windows\System\OYzgToJ.exe
  2⤵
  PID:11484
- C:\Windows\System\LoBbhNM.exe
  C:\Windows\System\LoBbhNM.exe
  2⤵
  PID:11512
- C:\Windows\System\fDhpeOi.exe
  C:\Windows\System\fDhpeOi.exe
  2⤵
  PID:11532
- C:\Windows\System\pnmfnGl.exe
  C:\Windows\System\pnmfnGl.exe
  2⤵
  PID:11548
- C:\Windows\System\WDWQEyY.exe
  C:\Windows\System\WDWQEyY.exe
  2⤵
  PID:11564
- C:\Windows\System\MUtnmbs.exe
  C:\Windows\System\MUtnmbs.exe
  2⤵
  PID:11580
- C:\Windows\System\RUPIeGC.exe
  C:\Windows\System\RUPIeGC.exe
  2⤵
  PID:11596
- C:\Windows\System\ICXUaUn.exe
  C:\Windows\System\ICXUaUn.exe
  2⤵
  PID:11612
- C:\Windows\System\hTApylF.exe
  C:\Windows\System\hTApylF.exe
  2⤵
  PID:11628
- C:\Windows\System\RtkBAGG.exe
  C:\Windows\System\RtkBAGG.exe
  2⤵
  PID:11712
- C:\Windows\System\oWhvPYm.exe
  C:\Windows\System\oWhvPYm.exe
  2⤵
  PID:11736
- C:\Windows\System\RzgbPEw.exe
  C:\Windows\System\RzgbPEw.exe
  2⤵
  PID:11760
- C:\Windows\System\JXFMwlT.exe
  C:\Windows\System\JXFMwlT.exe
  2⤵
  PID:11832
- C:\Windows\System\WhIPObF.exe
  C:\Windows\System\WhIPObF.exe
  2⤵
  PID:11856
- C:\Windows\System\ueVKXbM.exe
  C:\Windows\System\ueVKXbM.exe
  2⤵
  PID:11872
- C:\Windows\System\UvkVDAa.exe
  C:\Windows\System\UvkVDAa.exe
  2⤵
  PID:11972
- C:\Windows\System\neRelZg.exe
  C:\Windows\System\neRelZg.exe
  2⤵
  PID:12148
- C:\Windows\System\hqvCgAa.exe
  C:\Windows\System\hqvCgAa.exe
  2⤵
  PID:12164
- C:\Windows\System\ElnyJHv.exe
  C:\Windows\System\ElnyJHv.exe
  2⤵
  PID:12224
- C:\Windows\System\rnXulYa.exe
  C:\Windows\System\rnXulYa.exe
  2⤵
  PID:12248
- C:\Windows\System\HiofFnm.exe
  C:\Windows\System\HiofFnm.exe
  2⤵
  PID:12268
- C:\Windows\System\WxKZzBL.exe
  C:\Windows\System\WxKZzBL.exe
  2⤵
  PID:10536
- C:\Windows\System\pZjkCyD.exe
  C:\Windows\System\pZjkCyD.exe
  2⤵
  PID:11504
- C:\Windows\System\XLQgWSA.exe
  C:\Windows\System\XLQgWSA.exe
  2⤵
  PID:11004
- C:\Windows\System\EfvPzGA.exe
  C:\Windows\System\EfvPzGA.exe
  2⤵
  PID:11268
- C:\Windows\System\MxskPkY.exe
  C:\Windows\System\MxskPkY.exe
  2⤵
  PID:11316
- C:\Windows\System\nYEsjYl.exe
  C:\Windows\System\nYEsjYl.exe
  2⤵
  PID:11332
- C:\Windows\System\RyLcfSS.exe
  C:\Windows\System\RyLcfSS.exe
  2⤵
  PID:11416
- C:\Windows\System\UyNpNtT.exe
  C:\Windows\System\UyNpNtT.exe
  2⤵
  PID:11448
- C:\Windows\System\yVkAsqS.exe
  C:\Windows\System\yVkAsqS.exe
  2⤵
  PID:10740
- C:\Windows\System\UMOmjDp.exe
  C:\Windows\System\UMOmjDp.exe
  2⤵
  PID:11576
- C:\Windows\System\OhVHGmg.exe
  C:\Windows\System\OhVHGmg.exe
  2⤵
  PID:11608
- C:\Windows\System\eiXmTys.exe
  C:\Windows\System\eiXmTys.exe
  2⤵
  PID:11660
- C:\Windows\System\JPbhdtn.exe
  C:\Windows\System\JPbhdtn.exe
  2⤵
  PID:11688
- C:\Windows\System\wAvcvyh.exe
  C:\Windows\System\wAvcvyh.exe
  2⤵
  PID:11916
- C:\Windows\System\xuGAEfI.exe
  C:\Windows\System\xuGAEfI.exe
  2⤵
  PID:12000
- C:\Windows\System\ysgveGw.exe
  C:\Windows\System\ysgveGw.exe
  2⤵
  PID:11948
- C:\Windows\System\kMbthLz.exe
  C:\Windows\System\kMbthLz.exe
  2⤵
  PID:12116
- C:\Windows\System\FowZnnX.exe
  C:\Windows\System\FowZnnX.exe
  2⤵
  PID:12088
- C:\Windows\System\vLJLkwI.exe
  C:\Windows\System\vLJLkwI.exe
  2⤵
  PID:12160
- C:\Windows\System\tTUumAy.exe
  C:\Windows\System\tTUumAy.exe
  2⤵
  PID:12244
- C:\Windows\System\MxCmJYz.exe
  C:\Windows\System\MxCmJYz.exe
  2⤵
  PID:12284
- C:\Windows\System\YXcpIGJ.exe
  C:\Windows\System\YXcpIGJ.exe
  2⤵
  PID:11492
- C:\Windows\System\KwjcBlT.exe
  C:\Windows\System\KwjcBlT.exe
  2⤵
  PID:11364
- C:\Windows\System\PKNBLee.exe
  C:\Windows\System\PKNBLee.exe
  2⤵
  PID:10252
- C:\Windows\System\WxjHXWn.exe
  C:\Windows\System\WxjHXWn.exe
  2⤵
  PID:11544
- C:\Windows\System\oKbLeKl.exe
  C:\Windows\System\oKbLeKl.exe
  2⤵
  PID:11460
- C:\Windows\System\xoltduK.exe
  C:\Windows\System\xoltduK.exe
  2⤵
  PID:11668
- C:\Windows\System\qdgAAOC.exe
  C:\Windows\System\qdgAAOC.exe
  2⤵
  PID:11592
- C:\Windows\System\SZAhmya.exe
  C:\Windows\System\SZAhmya.exe
  2⤵
  PID:11812
- C:\Windows\System\AmsgNyS.exe
  C:\Windows\System\AmsgNyS.exe
  2⤵
  PID:12028
- C:\Windows\System\WgbvdWf.exe
  C:\Windows\System\WgbvdWf.exe
  2⤵
  PID:12264
- C:\Windows\System\wAQnbqN.exe
  C:\Windows\System\wAQnbqN.exe
  2⤵
  PID:11348
- C:\Windows\System\MTdcDls.exe
  C:\Windows\System\MTdcDls.exe
  2⤵
  PID:11988
- C:\Windows\System\eLroycr.exe
  C:\Windows\System\eLroycr.exe
  2⤵
  PID:11620
- C:\Windows\System\ImDNiqP.exe
  C:\Windows\System\ImDNiqP.exe
  2⤵
  PID:12312
- C:\Windows\System\OtORqpF.exe
  C:\Windows\System\OtORqpF.exe
  2⤵
  PID:12328
- C:\Windows\System\Vrxfalx.exe
  C:\Windows\System\Vrxfalx.exe
  2⤵
  PID:12348
- C:\Windows\System\BCFCDmH.exe
  C:\Windows\System\BCFCDmH.exe
  2⤵
  PID:12380
- C:\Windows\System\nTORqYZ.exe
  C:\Windows\System\nTORqYZ.exe
  2⤵
  PID:12424
- C:\Windows\System\hOJHqUo.exe
  C:\Windows\System\hOJHqUo.exe
  2⤵
  PID:12464
- C:\Windows\System\KmdIEws.exe
  C:\Windows\System\KmdIEws.exe
  2⤵
  PID:12480
- C:\Windows\System\UZSUKka.exe
  C:\Windows\System\UZSUKka.exe
  2⤵
  PID:12500
- C:\Windows\System\yHcKZMS.exe
  C:\Windows\System\yHcKZMS.exe
  2⤵
  PID:12520
- C:\Windows\System\IBRRgQV.exe
  C:\Windows\System\IBRRgQV.exe
  2⤵
  PID:12560
- C:\Windows\System\bNaAAkg.exe
  C:\Windows\System\bNaAAkg.exe
  2⤵
  PID:12580
- C:\Windows\System\FjIhEMq.exe
  C:\Windows\System\FjIhEMq.exe
  2⤵
  PID:12596
- C:\Windows\System\gqHdwET.exe
  C:\Windows\System\gqHdwET.exe
  2⤵
  PID:12652
- C:\Windows\System\DhNTzLB.exe
  C:\Windows\System\DhNTzLB.exe
  2⤵
  PID:12676
- C:\Windows\System\Dwivmal.exe
  C:\Windows\System\Dwivmal.exe
  2⤵
  PID:12736
- C:\Windows\System\nuuNsTa.exe
  C:\Windows\System\nuuNsTa.exe
  2⤵
  PID:12752
- C:\Windows\System\PRtmOJu.exe
  C:\Windows\System\PRtmOJu.exe
  2⤵
  PID:12780
- C:\Windows\System\heBMoFy.exe
  C:\Windows\System\heBMoFy.exe
  2⤵
  PID:12796
- C:\Windows\System\ybGyLUj.exe
  C:\Windows\System\ybGyLUj.exe
  2⤵
  PID:12820
- C:\Windows\System\BbAbeoj.exe
  C:\Windows\System\BbAbeoj.exe
  2⤵
  PID:12840
- C:\Windows\System\ehmKqSc.exe
  C:\Windows\System\ehmKqSc.exe
  2⤵
  PID:12860
- C:\Windows\System\FZBzJez.exe
  C:\Windows\System\FZBzJez.exe
  2⤵
  PID:12896
- C:\Windows\System\YjlaPrf.exe
  C:\Windows\System\YjlaPrf.exe
  2⤵
  PID:12912
- C:\Windows\System\CFmfPfH.exe
  C:\Windows\System\CFmfPfH.exe
  2⤵
  PID:12932
- C:\Windows\System\nXLtmoc.exe
  C:\Windows\System\nXLtmoc.exe
  2⤵
  PID:12964
- C:\Windows\System\mdzgKhK.exe
  C:\Windows\System\mdzgKhK.exe
  2⤵
  PID:13016
- C:\Windows\System\RpOyROK.exe
  C:\Windows\System\RpOyROK.exe
  2⤵
  PID:13036
- C:\Windows\System\nsfOfAx.exe
  C:\Windows\System\nsfOfAx.exe
  2⤵
  PID:13052
- C:\Windows\System\PyCxxVW.exe
  C:\Windows\System\PyCxxVW.exe
  2⤵
  PID:13084
- C:\Windows\System\UzdDXYw.exe
  C:\Windows\System\UzdDXYw.exe
  2⤵
  PID:13104
- C:\Windows\System\XPqxWoK.exe
  C:\Windows\System\XPqxWoK.exe
  2⤵
  PID:13144
- C:\Windows\System\yBUwyWM.exe
  C:\Windows\System\yBUwyWM.exe
  2⤵
  PID:13168
- C:\Windows\System\oVTDrqq.exe
  C:\Windows\System\oVTDrqq.exe
  2⤵
  PID:13228
- C:\Windows\System\owHiAYr.exe
  C:\Windows\System\owHiAYr.exe
  2⤵
  PID:13272
- C:\Windows\System\jlKnkYU.exe
  C:\Windows\System\jlKnkYU.exe
  2⤵
  PID:13304
- C:\Windows\System\ToBGsEV.exe
  C:\Windows\System\ToBGsEV.exe
  2⤵
  PID:11432
- C:\Windows\System\AMdMZVM.exe
  C:\Windows\System\AMdMZVM.exe
  2⤵
  PID:12356
- C:\Windows\System\QvGrLoH.exe
  C:\Windows\System\QvGrLoH.exe
  2⤵
  PID:12400
- C:\Windows\System\RFcKRAW.exe
  C:\Windows\System\RFcKRAW.exe
  2⤵
  PID:12440
- C:\Windows\System\YCxzlvF.exe
  C:\Windows\System\YCxzlvF.exe
  2⤵
  PID:12460
- C:\Windows\System\whpkjDF.exe
  C:\Windows\System\whpkjDF.exe
  2⤵
  PID:12416
- C:\Windows\System\FDXNSyX.exe
  C:\Windows\System\FDXNSyX.exe
  2⤵
  PID:12472
- C:\Windows\System\uCtvWLR.exe
  C:\Windows\System\uCtvWLR.exe
  2⤵
  PID:12568
- C:\Windows\System\rXJxHgD.exe
  C:\Windows\System\rXJxHgD.exe
  2⤵
  PID:12692
- C:\Windows\System\jZeZteD.exe
  C:\Windows\System\jZeZteD.exe
  2⤵
  PID:12760
- C:\Windows\System\enFxRJE.exe
  C:\Windows\System\enFxRJE.exe
  2⤵
  PID:12768
- C:\Windows\System\BbaDnnO.exe
  C:\Windows\System\BbaDnnO.exe
  2⤵
  PID:12976
- C:\Windows\System\DAQnWMJ.exe
  C:\Windows\System\DAQnWMJ.exe
  2⤵
  PID:12992
- C:\Windows\System\gxNAflm.exe
  C:\Windows\System\gxNAflm.exe
  2⤵
  PID:13044
- C:\Windows\System\EDVyZGU.exe
  C:\Windows\System\EDVyZGU.exe
  2⤵
  PID:13092
- C:\Windows\System\LvTOcfs.exe
  C:\Windows\System\LvTOcfs.exe
  2⤵
  PID:13188
- C:\Windows\System\olktYlm.exe
  C:\Windows\System\olktYlm.exe
  2⤵
  PID:13220
- C:\Windows\System\bQLcdbW.exe
  C:\Windows\System\bQLcdbW.exe
  2⤵
  PID:13292
- C:\Windows\System\jciBlho.exe
  C:\Windows\System\jciBlho.exe
  2⤵
  PID:9844
- C:\Windows\System\QMQGZMu.exe
  C:\Windows\System\QMQGZMu.exe
  2⤵
  PID:12376
- C:\Windows\System\mNbiRPx.exe
  C:\Windows\System\mNbiRPx.exe
  2⤵
  PID:12536
- C:\Windows\System\TlwRgaA.exe
  C:\Windows\System\TlwRgaA.exe
  2⤵
  PID:12660
- C:\Windows\System\PYMLcpY.exe
  C:\Windows\System\PYMLcpY.exe
  2⤵
  PID:12808
- C:\Windows\System\GOkixvw.exe
  C:\Windows\System\GOkixvw.exe
  2⤵
  PID:12836
- C:\Windows\System\FBCFOvj.exe
  C:\Windows\System\FBCFOvj.exe
  2⤵
  PID:12892
- C:\Windows\System\FvNQlFq.exe
  C:\Windows\System\FvNQlFq.exe
  2⤵
  PID:3300
- C:\Windows\System\wNMiMwC.exe
  C:\Windows\System\wNMiMwC.exe
  2⤵
  PID:13060
- C:\Windows\System\rpfmJoa.exe
  C:\Windows\System\rpfmJoa.exe
  2⤵
  PID:13212
- C:\Windows\System\zVIZfrR.exe
  C:\Windows\System\zVIZfrR.exe
  2⤵
  PID:12644
- C:\Windows\System\zPvhJPs.exe
  C:\Windows\System\zPvhJPs.exe
  2⤵
  PID:12492
- C:\Windows\System\GfisUZV.exe
  C:\Windows\System\GfisUZV.exe
  2⤵
  PID:12592
- C:\Windows\System\jSCtOrB.exe
  C:\Windows\System\jSCtOrB.exe
  2⤵
  PID:13340
- C:\Windows\System\sfuzoQc.exe
  C:\Windows\System\sfuzoQc.exe
  2⤵
  PID:13376
- C:\Windows\System\ubUiRPy.exe
  C:\Windows\System\ubUiRPy.exe
  2⤵
  PID:13396
- C:\Windows\System\ZJYemyB.exe
  C:\Windows\System\ZJYemyB.exe
  2⤵
  PID:13428
- C:\Windows\System\IMBOxFY.exe
  C:\Windows\System\IMBOxFY.exe
  2⤵
  PID:13448
- C:\Windows\System\ibUgQOb.exe
  C:\Windows\System\ibUgQOb.exe
  2⤵
  PID:13492
- C:\Windows\System\zQETCrQ.exe
  C:\Windows\System\zQETCrQ.exe
  2⤵
  PID:13516
- C:\Windows\System\VoHqWFY.exe
  C:\Windows\System\VoHqWFY.exe
  2⤵
  PID:13536
- C:\Windows\System\UCuHrBY.exe
  C:\Windows\System\UCuHrBY.exe
  2⤵
  PID:13552
- C:\Windows\System\WaMgyvH.exe
  C:\Windows\System\WaMgyvH.exe
  2⤵
  PID:13572
- C:\Windows\System\xyehYIO.exe
  C:\Windows\System\xyehYIO.exe
  2⤵
  PID:13588
- C:\Windows\System\yMlkeLK.exe
  C:\Windows\System\yMlkeLK.exe
  2⤵
  PID:13616
- C:\Windows\System\FSXTizz.exe
  C:\Windows\System\FSXTizz.exe
  2⤵
  PID:13636
- C:\Windows\System\hUbbFPn.exe
  C:\Windows\System\hUbbFPn.exe
  2⤵
  PID:13692
- C:\Windows\System\OjsMDkE.exe
  C:\Windows\System\OjsMDkE.exe
  2⤵
  PID:13708
- C:\Windows\System\VHKfjCJ.exe
  C:\Windows\System\VHKfjCJ.exe
  2⤵
  PID:13760
- C:\Windows\System\outdeBw.exe
  C:\Windows\System\outdeBw.exe
  2⤵
  PID:13776
- C:\Windows\System\RCUPrFp.exe
  C:\Windows\System\RCUPrFp.exe
  2⤵
  PID:13800
- C:\Windows\System\RDOjDrx.exe
  C:\Windows\System\RDOjDrx.exe
  2⤵
  PID:13820
- C:\Windows\System\ulLbBlG.exe
  C:\Windows\System\ulLbBlG.exe
  2⤵
  PID:13836
- C:\Windows\System\eYCdKNn.exe
  C:\Windows\System\eYCdKNn.exe
  2⤵
  PID:13864
- C:\Windows\System\nQFVVCm.exe
  C:\Windows\System\nQFVVCm.exe
  2⤵
  PID:13888
- C:\Windows\System\xyaVSWb.exe
  C:\Windows\System\xyaVSWb.exe
  2⤵
  PID:13904
- C:\Windows\System\FkFsREz.exe
  C:\Windows\System\FkFsREz.exe
  2⤵
  PID:13960
- C:\Windows\System\OZrdWtl.exe
  C:\Windows\System\OZrdWtl.exe
  2⤵
  PID:13976
- C:\Windows\System\OFypaSM.exe
  C:\Windows\System\OFypaSM.exe
  2⤵
  PID:14092
- C:\Windows\System\YpwxkNx.exe
  C:\Windows\System\YpwxkNx.exe
  2⤵
  PID:14108
- C:\Windows\System\DtsswHp.exe
  C:\Windows\System\DtsswHp.exe
  2⤵
  PID:14124
- C:\Windows\System\UYbRHPP.exe
  C:\Windows\System\UYbRHPP.exe
  2⤵
  PID:14140
- C:\Windows\System\YlvuUIg.exe
  C:\Windows\System\YlvuUIg.exe
  2⤵
  PID:14160
- C:\Windows\System\MVhxUUe.exe
  C:\Windows\System\MVhxUUe.exe
  2⤵
  PID:14188
- C:\Windows\System\wSzPvjn.exe
  C:\Windows\System\wSzPvjn.exe
  2⤵
  PID:14208
- C:\Windows\System\kYyNXqo.exe
  C:\Windows\System\kYyNXqo.exe
  2⤵
  PID:14248
- C:\Windows\System\RnliutL.exe
  C:\Windows\System\RnliutL.exe
  2⤵
  PID:14268
- C:\Windows\System\PvBmTqr.exe
  C:\Windows\System\PvBmTqr.exe
  2⤵
  PID:14284
- C:\Windows\System\IcGTxOa.exe
  C:\Windows\System\IcGTxOa.exe
  2⤵
  PID:14300
- C:\Windows\System\UHwMbgr.exe
  C:\Windows\System\UHwMbgr.exe
  2⤵
  PID:10876
- C:\Windows\System\iITWXiW.exe
  C:\Windows\System\iITWXiW.exe
  2⤵
  PID:13456
- C:\Windows\System\FExAAVw.exe
  C:\Windows\System\FExAAVw.exe
  2⤵
  PID:13416
- C:\Windows\System\kxvQmPk.exe
  C:\Windows\System\kxvQmPk.exe
  2⤵
  PID:13480
- C:\Windows\System\seyfvTb.exe
  C:\Windows\System\seyfvTb.exe
  2⤵
  PID:13596
- C:\Windows\System\uaemJnI.exe
  C:\Windows\System\uaemJnI.exe
  2⤵
  PID:13560
- C:\Windows\System\mOYsZEF.exe
  C:\Windows\System\mOYsZEF.exe
  2⤵
  PID:13624
- C:\Windows\System\vmpAeid.exe
  C:\Windows\System\vmpAeid.exe
  2⤵
  PID:13680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BcShXGu.exe

Filesize
783KB

MD5
58a40e01102752a0315d704f8d010e94

SHA1
af919bdb70967ab4297dcc9ec6a83ef411d1ed99

SHA256
97fef5d00145753c496c3e177d92c36f4eac8c2cab4ceb00a396d21de14f8518

SHA512
f15da10296d41600356a2c12e13904a1d6ed806fa08cf019139e39d902a119cc542c0c001e7081ebe9ced33b63980624994037a217045cf7a78a03c2a9b97076

Download Submit
C:\Windows\System\BoyckEh.exe

Filesize
785KB

MD5
65c374944666ccc68d351c4c74bef528

SHA1
57ab37674bae426586d3bcb0aeb507b332bb525b

SHA256
b33a5207544d61abc9419714c6e3b557e03e8566f344826ef5210b222de60c69

SHA512
6594bf117e26c8b7f519bf6be618d7044597384f6cf95622ce5dfbea106d8cd6b8848aa27be5442877e2528d45e1793b9e7176338fb0afa976b58c9782c3b7f6

Download Submit
C:\Windows\System\CygUemg.exe

Filesize
788KB

MD5
b7bdf78785eb771916b0faa504fef85b

SHA1
c0b43fbff03fd94bd912ec9e6784fd11e96c4e75

SHA256
0426134953c834759bdc0fef3e1435fc45fadde97f0b23e671117a8f0e6d8196

SHA512
7a75d1f439d6008fe9424c060cedf9adb9203f6aad8675204e687b013de6cf68806d68140b53e38c52fdc9a3649726e0a61fcd87278ec64ecaafd6a1851d092f

Download Submit
C:\Windows\System\EiFdWVM.exe

Filesize
785KB

MD5
202aeda0ba2bcd6ef3b43e4a0f540364

SHA1
a010b316ba618c4aeb914d7efd78397ffbc36893

SHA256
c593c0ef561db901c53b09c9ef036d09c4164ea133a94454221d5497c3f7ecdc

SHA512
f57f85f73bb0d7e47bb018b27389c3938ee992f2b0166dad639be4f7fd3def26ba129b0daf355412112a14f2e1763891a482d822f653d6d3ed9d8d188b95e8a1

Download Submit
C:\Windows\System\LemSAeN.exe

Filesize
782KB

MD5
fe3cd921f5c5554edfa5fb1f9a153e52

SHA1
8e4e8318d5bf806095e2630e3c8d7c6393f1a378

SHA256
a822616dddaf9114c45fd00d20aad0e6ec85648540449bc0111ebdba673c9044

SHA512
342644e4d553f756421fd794e167c65c92c90911031c98c4e1f5e24018e885cf3e1465d7bdd81ba4655f06a52295d281ecae801efa53629721b656874ae64d79

Download Submit
C:\Windows\System\LrhVYtZ.exe

Filesize
787KB

MD5
28ea445a47a0789eb12c73652a3a6a69

SHA1
435c90941e8d92771565c2bbcb74a5aa435f735d

SHA256
47ee10f3bf17056deca08c31de284fec357a42137769f9d2c62e08dc9c94eba7

SHA512
b60e604c0ac233985e21a4d175ebdfec3f13101e3ee49df480f372a362e8edb63ffffe0cfb0c1b071982d7f162f6b242a3978c5cf8193e6e03ac47b54ba1af56

Download Submit
C:\Windows\System\MwNbarZ.exe

Filesize
786KB

MD5
2b0a45ee4fb19764e88f138c2c111117

SHA1
d54a154ec1f07d025647b9b74dc9e0d965c1dc32

SHA256
f434c08e5a3ee26631a0a55deac306297c4c4594b55d1bc5d61cbc03a9e3e588

SHA512
fccd9ec5b0d2bdfe040897428610bf50122d50df9b327cbd7b04d2bf7bb69ee70b984ec8f3fa4183be2a1e5d464e87d438dcbc8690fb3641accd7e2617e8719b

Download Submit
C:\Windows\System\NzFFviW.exe

Filesize
784KB

MD5
4df555d80297d59e5d90628a144ed269

SHA1
17e54b934cc2db4b26805881ae759e3bba9bb1a9

SHA256
19291fe0c0b63f290d00487b9aa85c3d96f6f5c44bc4c6e9cdd61874c1eba881

SHA512
517ae131e51f7f620bd150f4f93767fb0d35577c0f83e3ef58c433003b75ca6aedcd24160ccf84f9dd22496eb2283f53096fdc691bb240b7c633e14f23b9f841

Download Submit
C:\Windows\System\PervtlT.exe

Filesize
782KB

MD5
9b5ea206d706ea3f9fa907645aeb43ba

SHA1
96ec019472c3fe910886bdc8489add7242635954

SHA256
c29bba8fe7fc4cde4b1ca325b28f15b52e9748572801d9d4db19e715366015de

SHA512
cb68488a06f7402777c494009a74c9151d2192c8b902d83a218c3756505fab3c9bbb4e0f4c118843c051cff548706e751f8fb391630ab047e5551ca72e289e55

Download Submit
C:\Windows\System\SBXDfAS.exe

Filesize
785KB

MD5
dc418c020e1d980b9dfab18aa9ad0818

SHA1
f0a111b05aae5ff767dd35afe0e71b8b500660c4

SHA256
b78ac6ca147e4c4e4116e1548c260ea043b1f922b8f930c57f4cc162e7604b00

SHA512
a18642c331cce7a48406e0663ab4ddc80286ecf80d86e9cc48ece6cab6eba6f500611762342e3cfaab39bb7e19010455bcb56eca5676b758a2bfbe7a8b899018

Download Submit
C:\Windows\System\SkAWZGP.exe

Filesize
783KB

MD5
96a7db4e2834fedeaacdc03793fa5fb2

SHA1
96dd685d1f5e81c4ef0289263ebded0bac9663d9

SHA256
55cc4d3b7da6533587735741c441087b133d8354329892270fc3f00346f702ad

SHA512
a7b7805d94ade244d9292c8b35ad52f6e12b3a0bc153dcd7a2725aa6356db11c06eb90e5e59c8b54d92f5964d1c62b5d993905619920c0b3752380a756ef1b5a

Download Submit
C:\Windows\System\WVjMuif.exe

Filesize
789KB

MD5
b1b6c03f783e73c0e75913da83aa1b3e

SHA1
3b7a41d577d271dd954e3497b53cb426384cb600

SHA256
a962ac4edfdc1f293ef7907a382f8896383d0ea778ea81b0aa050cfe59769991

SHA512
6737a657add5244433ee68aa5436f00b8df942190bbe3741d00e26e6dd67ece9d2c2d620b142381e5dd52e3f4f06ee2ed2146771ee8149f71e7ff3d8fdb55bd6

Download Submit
C:\Windows\System\WgkeBQv.exe

Filesize
788KB

MD5
6e9e162ad2e99969f94e8c4371b690c0

SHA1
86984f64736dcb0194ff87fa9cde616c00e40527

SHA256
8c83827f9c079d3729a64d3a1421c5dd570a9100b3fd3f7e54f65b9919b08fab

SHA512
cba5fdb30754c436edb2e39c76a378b973d93c59b2c42bff47bb1c175bdeaa124b8d6e81b8f7f9a9fe80fc7ca563ebd1bed06a7c99d105bba1d50ee96899dd53

Download Submit
C:\Windows\System\XhZiHUk.exe

Filesize
786KB

MD5
5f13abf81ff9d794725a31559a5bdbab

SHA1
7a6fe7ba4087dfa7a5d7a1a2b164cf5b74dd6810

SHA256
8de1ec077423881bec88b7f671be2cdd49ffada9f7e41d03978c9393929a8b57

SHA512
cde6ecaba0b76c1caaaaba0c60313bc67c4b40072985424ce9a7e46a4ed43188670e25e374405228e47d626dfbfd3f6754d29fff8bda786ae797822e003abe65

Download Submit
C:\Windows\System\YaCJZAj.exe

Filesize
788KB

MD5
34cb43aa31dc5b68d441ac73bf4433b1

SHA1
7577c22f9ae6682060a2a74891dbb4861ebd2c6a

SHA256
372f61d852395c3e00152e0c7409003c7f534b92665ef9cf23965adc6a426d1d

SHA512
3e3cfc1627cc84b476d351a03f7cc56f4232244306ec4d1c338748739d5a9120200d7f2460c521656994c02483ad17fa7672345b20686ccf583ff054685a4163

Download Submit
C:\Windows\System\ZyRVjoM.exe

Filesize
785KB

MD5
6dd9e5b2677e2c92daf176c8773c6270

SHA1
801651f5b5fb60875d2a786b9cca110cb4ab5f8e

SHA256
ec25f377cc052080aaf0da5459a10722cda68a0ff38d669cf307bc0faa48c70b

SHA512
68f8596924fadb901987716ede50d592d4779265f20540a6d47e893a19ad9a9c84475c07e415e3f01ec31e8c19b47a54cf4cbe6c5f1ccd3e7326a4e7be48b09b

Download Submit
C:\Windows\System\awPghuO.exe

Filesize
783KB

MD5
5841b9fdac990839eb0731cb69c60817

SHA1
0b8b00df5ad5265889b92ff5221594a950b8d48d

SHA256
3b02eeb5733e4818c937849151cadef2ee31aa79c19a69e968a62716f3fc164d

SHA512
47adb0f93a2a108d09d157bd1ea6a8176a7ef0ea41e886e701c5813a644b06e2e026eab7ac4395be56c0d669f98c3ce08d6349c559436cf12998e17c31c0dd06

Download Submit
C:\Windows\System\baFmPhN.exe

Filesize
782KB

MD5
971764f0548b65d491fce13e4850c5e3

SHA1
7ab920f6419b6913d781aaca895a4a15157c1050

SHA256
6162188090210acdd9ad9b00dbe1e2415321dd523ea82ec736e92d1b79e2f7c4

SHA512
3abec14adc93264df7fc0bd10c15ae867dffe656a3065f6219dc190397a4ed92ce3331a830d0a931af71e0c1ca9d3eebf3d8f8d1e4f83bf77a1c5f824505360e

Download Submit
C:\Windows\System\bfSsoBx.exe

Filesize
789KB

MD5
1d1c8f33794bc3d365a9eb8c8ffe69e0

SHA1
a6823afda4a4847496c78df35d8cd9a2d961e916

SHA256
85424a71dd3d9374619216f2594d8d9252e63bd764bb5bc1eccf322aeb0d3e9b

SHA512
f352b63a00fb077db3b0ebbc34ee9e5af64d8038057449684fa274fd181af41c57c28c018e79a9ca9bbe2d92699dabc992bcfb70675121ec6ea7aa233b3960c8

Download Submit
C:\Windows\System\ghfelcE.exe

Filesize
783KB

MD5
5705087336200133231fbf6f8cf664d4

SHA1
5bb11c876c903b76b849915add4b2a677179fa3e

SHA256
f9c0268bb69530f32b3fbc60e80fdb47da29117c2459f17af7584a93992189d7

SHA512
d80677887a74d53c02401f73722ab3e9bcd02c6ee700437d3f3b6a587e3b15906dd4416a70a246081f9804742ed614ed57d560a34cada086347a7ac6fd075ee8

Download Submit
C:\Windows\System\kGQQRmR.exe

Filesize
787KB

MD5
7990a7e0571d17db21574958f8b3cc70

SHA1
90a600b924dc33602f7e9c030c927d59d9c93ac4

SHA256
e723934c4cdd171db8c2b90aebbe7a60f392c3f99185033f0589dc10570e3320

SHA512
de2c34d2354df15db48501e9b19d33cffd566876241375df450587cced54069d7e7394fe2984b7923b1edf0694e1d70851c2203ef4e81411d70f467c7f2d535d

Download Submit
C:\Windows\System\kbflkcm.exe

Filesize
782KB

MD5
346043825953a578187792e1937d5dcd

SHA1
b5091040bb64643310805d65ca935ec88a4e28b2

SHA256
439782f8ee2ce92ee351b3ff623a92c7ebf9090e883baf598c3f09e3be9fc64f

SHA512
f488886504e5755d2d05ee225c3f69b0fa3843de79fb71bda5bef0ebab6991165ba9de0bd58f3b96e08e7f9fb4ad75412dee4c37853b76db9981ad4407b32f78

Download Submit
C:\Windows\System\lgipRDj.exe

Filesize
786KB

MD5
edd348de7fe574dcc3e057ac2f5aba23

SHA1
6be7c9e58b0d1a295abb08093c426ae847d5014d

SHA256
04ef2736f0b9b724c274476b8b4203ed8fe11af3fa53e7a0b7b12947941fde46

SHA512
62c51d2d237f30d606ecf9b0c8f3f1ca0fdc94499b40606bd8e366f3eac407f506bd9fc72525a305e09ffc01caa6fef2be4f32a2c5288c384205dede3d6d324d

Download Submit
C:\Windows\System\ltefOxg.exe

Filesize
786KB

MD5
b2b48e3725640198611b2b893d382e4b

SHA1
014b7ef5fe05377c90c96b761bbc907580125105

SHA256
4a21806b872f876d3ad5240d7d2ee33e2e96d24e96c952a32905d778710ca63f

SHA512
7feef806a2c72d3d872a37e20b4f30667fb5624e78d9ec29323bc75f2fc4b98472829cb644f9d9ced1a384a8846ad82a50b82e2543ec3ad8fa0c96a42b574ef6

Download Submit
C:\Windows\System\qMVKRCQ.exe

Filesize
789KB

MD5
76dc63531b0988858e22b53aa02f0ff5

SHA1
f3497df9afda4c65a71f713d9ec5d618d8aaa5f9

SHA256
2cd7a45a069381e6f79d8266aeb997a76cdacb57510cbdb2140cfa6e5eacf422

SHA512
47f1833fbd578394e0a8fa55cb3a629326a08243cf69bb8dbef01645a52abd55cc26189417b61246a9e2d58a0cecad83c418a208969c2fec7f0775125b4ec814

Download Submit
C:\Windows\System\tvorJwo.exe

Filesize
789KB

MD5
52a9c8fb90d1661394e8f6107f795342

SHA1
3e864c0ead9bfc25d05b95242707accdaf41b382

SHA256
a31358eccf8b58334b8a1dfdc2853b4ffa76a7487a8949041f4d08461d34cd1d

SHA512
9fff025002ad95cca907b42cb89d515b2539fe98b1260ea05a3dde64a44d826c2cfcea39e69996e7272ad4fb092cb606ce77270b7d9d3e517b34a9e780dcb2da

Download Submit
C:\Windows\System\uiwrldQ.exe

Filesize
783KB

MD5
097cc6a02a05ddbc4d5e4741c5426a39

SHA1
67e2fc9dd4c51da10e20661c635ee0c58dac3bdf

SHA256
bfb713f9dadfbbfd714ac754c4853d72e17b480276a7c1b86e62dbc57aca8be6

SHA512
06477390fcaae96678ecd1826bb851eb198eb624a4156b549ba257b3953ea8f6f445325815f30e84f510b050d656d6c00511b55abfb549a407fa6a5b8b1edc89

Download Submit
C:\Windows\System\ujnwbFQ.exe

Filesize
788KB

MD5
bfde1977bd9b9a353fedcbed9aa7fbcf

SHA1
06bbaca805f2a0178257660caa41293b3554bd86

SHA256
122a0e24d8990217a07afa5dfb8e2b28e49f8b5ac017707a43bb286d6e580619

SHA512
9ec571de3d789cfdfded0db75116d135fc107c643925917e42e666b48ccca3746b7314894d785f9f66073f6de86358f7008a06330fa8177a008c9d66be9ba77c

Download Submit
C:\Windows\System\uxeEbtI.exe

Filesize
784KB

MD5
b90ef80e4b378b1e458648620e5c9432

SHA1
abbb0f60bd7d9e3774ca34b0dc70df6f6f3edef2

SHA256
a86e1c7b41aeba677416cb4df6c13ea332ca6d9dceda90fcb60797f3d887d46c

SHA512
643f040066bf3cd9ab78e29bbda5b23aece0564cc2572c25b7f9faa03121c8c9d4c51a79e0ea390afda560993228ded6c786843d1dba34ceee18656c2d778d9e

Download Submit
C:\Windows\System\vVepJgm.exe

Filesize
784KB

MD5
3f13b6ac221e054b736677dadab1aacc

SHA1
d619f7faae140ce7fd08c21e523b33fcaff2b99f

SHA256
bd22b77e6341df57079ae54f0229a0752f5927a97fe6b2d69c4600f29a42d8b6

SHA512
fb3f6272d770da4bdd310c00f99d29bbe8c8f2886fc14d4b00bbfd60a3199922057995ea5f64cf3e684a0866feceea72a9320c9902abe4abbda6f738773ee643

Download Submit
C:\Windows\System\zFKfTYQ.exe

Filesize
787KB

MD5
74bcfc1d01bed6a7ceb8dcd9c74ac607

SHA1
8f7d64551fdaa35e9494d1c392f0bb291211e60b

SHA256
52b1727b73e6bb1fc47adac2bf49307b1f6f265ff9649c5268926046a49d9037

SHA512
0f848540d9fef23d3eee9a77ab7511d9b2be30060b349df7cb85c8ddf25a3a6f3c0d231e4275b638a34d6573e8d7db167f44a3c8d615501814d0999e239d44df

Download Submit
C:\Windows\System\zoiTrII.exe

Filesize
784KB

MD5
c73b42d7d0bcf73d4aac0f9085bb8223

SHA1
2b656b3fee552f1c00d118881c305e0119e84d59

SHA256
bbd2758c2ca404e0a3d6ce03bacc0ee74cc31f366208ba336ec6648b12e095ca

SHA512
374b3d34c8f00b98c52d23eb07d94b7e74364d4480264307478befbfa2efdcaca937ab125434cb21b3fe8e036e1d158f43f7a242585dd867743961bf9b05fc81

Download Submit
C:\Windows\System\ztDrIcK.exe

Filesize
787KB

MD5
300fb498bb4dfdd332efc12478200db5

SHA1
e8cb64183983fe30ede95d69b2d143725f808332

SHA256
f5f15fa31e55a1b7887d129c3bda135924db73be33a352e5dcd9e532dd4d0a65

SHA512
f0d3a142ec8e8fde361e5353a903f6770ba0901495244544defc60464ba389b1d16fb822201463bae84dbf425b6c821aa1ac8982052e1936b54a6bc641154a58

Download Submit
memory/216-2240-0x00007FF73B4A0000-0x00007FF73B7F1000-memory.dmp

Filesize
3.3MB

Download
memory/216-54-0x00007FF73B4A0000-0x00007FF73B7F1000-memory.dmp

Filesize
3.3MB

Download
memory/316-2267-0x00007FF75DD50000-0x00007FF75E0A1000-memory.dmp

Filesize
3.3MB

Download
memory/316-397-0x00007FF75DD50000-0x00007FF75E0A1000-memory.dmp

Filesize
3.3MB

Download
memory/376-2259-0x00007FF6665E0000-0x00007FF666931000-memory.dmp

Filesize
3.3MB

Download
memory/376-450-0x00007FF6665E0000-0x00007FF666931000-memory.dmp

Filesize
3.3MB

Download
memory/728-2245-0x00007FF611CB0000-0x00007FF612001000-memory.dmp

Filesize
3.3MB

Download
memory/728-53-0x00007FF611CB0000-0x00007FF612001000-memory.dmp

Filesize
3.3MB

Download
memory/728-2226-0x00007FF611CB0000-0x00007FF612001000-memory.dmp

Filesize
3.3MB

Download
memory/796-2253-0x00007FF685A90000-0x00007FF685DE1000-memory.dmp

Filesize
3.3MB

Download
memory/796-479-0x00007FF685A90000-0x00007FF685DE1000-memory.dmp

Filesize
3.3MB

Download
memory/916-2272-0x00007FF635B00000-0x00007FF635E51000-memory.dmp

Filesize
3.3MB

Download
memory/916-446-0x00007FF635B00000-0x00007FF635E51000-memory.dmp

Filesize
3.3MB

Download
memory/1516-2276-0x00007FF6737D0000-0x00007FF673B21000-memory.dmp

Filesize
3.3MB

Download
memory/1516-423-0x00007FF6737D0000-0x00007FF673B21000-memory.dmp

Filesize
3.3MB

Download
memory/1576-2265-0x00007FF694C40000-0x00007FF694F91000-memory.dmp

Filesize
3.3MB

Download
memory/1576-419-0x00007FF694C40000-0x00007FF694F91000-memory.dmp

Filesize
3.3MB

Download
memory/1664-469-0x00007FF6E85F0000-0x00007FF6E8941000-memory.dmp

Filesize
3.3MB

Download
memory/1664-2288-0x00007FF6E85F0000-0x00007FF6E8941000-memory.dmp

Filesize
3.3MB

Download
memory/1972-478-0x00007FF7DAB90000-0x00007FF7DAEE1000-memory.dmp

Filesize
3.3MB

Download
memory/1972-2256-0x00007FF7DAB90000-0x00007FF7DAEE1000-memory.dmp

Filesize
3.3MB

Download
memory/2152-383-0x00007FF6FFEB0000-0x00007FF700201000-memory.dmp

Filesize
3.3MB

Download
memory/2152-2269-0x00007FF6FFEB0000-0x00007FF700201000-memory.dmp

Filesize
3.3MB

Download
memory/2220-2278-0x00007FF7DAED0000-0x00007FF7DB221000-memory.dmp

Filesize
3.3MB

Download
memory/2220-417-0x00007FF7DAED0000-0x00007FF7DB221000-memory.dmp

Filesize
3.3MB

Download
memory/2372-2290-0x00007FF6D5A30000-0x00007FF6D5D81000-memory.dmp

Filesize
3.3MB

Download
memory/2372-460-0x00007FF6D5A30000-0x00007FF6D5D81000-memory.dmp

Filesize
3.3MB

Download
memory/2456-2292-0x00007FF7D5C40000-0x00007FF7D5F91000-memory.dmp

Filesize
3.3MB

Download
memory/2456-463-0x00007FF7D5C40000-0x00007FF7D5F91000-memory.dmp

Filesize
3.3MB

Download
memory/2628-2283-0x00007FF65E4A0000-0x00007FF65E7F1000-memory.dmp

Filesize
3.3MB

Download
memory/2628-408-0x00007FF65E4A0000-0x00007FF65E7F1000-memory.dmp

Filesize
3.3MB

Download
memory/2824-2260-0x00007FF795B40000-0x00007FF795E91000-memory.dmp

Filesize
3.3MB

Download
memory/2824-434-0x00007FF795B40000-0x00007FF795E91000-memory.dmp

Filesize
3.3MB

Download
memory/2856-2286-0x00007FF657A50000-0x00007FF657DA1000-memory.dmp

Filesize
3.3MB

Download
memory/2856-391-0x00007FF657A50000-0x00007FF657DA1000-memory.dmp

Filesize
3.3MB

Download
memory/3004-2238-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp

Filesize
3.3MB

Download
memory/3004-28-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp

Filesize
3.3MB

Download
memory/3004-2225-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp

Filesize
3.3MB

Download
memory/3028-2247-0x00007FF61AC40000-0x00007FF61AF91000-memory.dmp

Filesize
3.3MB

Download
memory/3028-2233-0x00007FF61AC40000-0x00007FF61AF91000-memory.dmp

Filesize
3.3MB

Download
memory/3028-43-0x00007FF61AC40000-0x00007FF61AF91000-memory.dmp

Filesize
3.3MB

Download
memory/3044-2281-0x00007FF658050000-0x00007FF6583A1000-memory.dmp

Filesize
3.3MB

Download
memory/3044-410-0x00007FF658050000-0x00007FF6583A1000-memory.dmp

Filesize
3.3MB

Download
memory/3172-2262-0x00007FF6C4560000-0x00007FF6C48B1000-memory.dmp

Filesize
3.3MB

Download
memory/3172-428-0x00007FF6C4560000-0x00007FF6C48B1000-memory.dmp

Filesize
3.3MB

Download
memory/3192-2271-0x00007FF7C13B0000-0x00007FF7C1701000-memory.dmp

Filesize
3.3MB

Download
memory/3192-445-0x00007FF7C13B0000-0x00007FF7C1701000-memory.dmp

Filesize
3.3MB

Download
memory/3844-2249-0x00007FF75BA60000-0x00007FF75BDB1000-memory.dmp

Filesize
3.3MB

Download
memory/3844-38-0x00007FF75BA60000-0x00007FF75BDB1000-memory.dmp

Filesize
3.3MB

Download
memory/3844-2232-0x00007FF75BA60000-0x00007FF75BDB1000-memory.dmp

Filesize
3.3MB

Download
memory/3916-58-0x00007FF735C70000-0x00007FF735FC1000-memory.dmp

Filesize
3.3MB

Download
memory/3916-2243-0x00007FF735C70000-0x00007FF735FC1000-memory.dmp

Filesize
3.3MB

Download
memory/4168-2274-0x00007FF731C30000-0x00007FF731F81000-memory.dmp

Filesize
3.3MB

Download
memory/4168-439-0x00007FF731C30000-0x00007FF731F81000-memory.dmp

Filesize
3.3MB

Download
memory/4528-2231-0x00007FF733290000-0x00007FF7335E1000-memory.dmp

Filesize
3.3MB

Download
memory/4528-36-0x00007FF733290000-0x00007FF7335E1000-memory.dmp

Filesize
3.3MB

Download
memory/4528-2250-0x00007FF733290000-0x00007FF7335E1000-memory.dmp

Filesize
3.3MB

Download
memory/4784-2236-0x00007FF7434F0000-0x00007FF743841000-memory.dmp

Filesize
3.3MB

Download
memory/4784-23-0x00007FF7434F0000-0x00007FF743841000-memory.dmp

Filesize
3.3MB

Download
memory/4836-399-0x00007FF69A960000-0x00007FF69ACB1000-memory.dmp

Filesize
3.3MB

Download
memory/4836-2284-0x00007FF69A960000-0x00007FF69ACB1000-memory.dmp

Filesize
3.3MB

Download
memory/5008-0-0x00007FF69B570000-0x00007FF69B8C1000-memory.dmp

Filesize
3.3MB

Download
memory/5008-2224-0x00007FF69B570000-0x00007FF69B8C1000-memory.dmp

Filesize
3.3MB

Download
memory/5008-1-0x000001EE2B850000-0x000001EE2B860000-memory.dmp

Filesize
64KB

Download
memory/5060-2254-0x00007FF7B4750000-0x00007FF7B4AA1000-memory.dmp

Filesize
3.3MB

Download
memory/5060-2234-0x00007FF7B4750000-0x00007FF7B4AA1000-memory.dmp

Filesize
3.3MB

Download
memory/5060-62-0x00007FF7B4750000-0x00007FF7B4AA1000-memory.dmp

Filesize
3.3MB

Download