xmrig | 572751901c05f1602f76286b1fe5f762124ef725a2fcaff79e63e1069e00bdd4

Analysis

max time kernel
117s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fd1ada66066cd4935a568abccb62b80N.exe
Size

1.5MB
MD5

4fd1ada66066cd4935a568abccb62b80
SHA1

f44ca397664fb9e8dd9f3d33d95ff426db270db2
SHA256

572751901c05f1602f76286b1fe5f762124ef725a2fcaff79e63e1069e00bdd4
SHA512

05ea0bb2b08a88bf308470a94d77fe253008b6cecded88f1143cf21495424db5904885a5393a0837c8d9a4897735cdd19cc592c007a8b226a483ddc748f7334e
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XCGiApbVUFVQB6N75aDTAsh:knw9oUUEEDlGUrGiAowoNFQAk

Score

10^/10

xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/4684-26-0x00007FF6C2F10000-0x00007FF6C3301000-memory.dmp	xmrig
behavioral2/memory/3668-61-0x00007FF6CF430000-0x00007FF6CF821000-memory.dmp	xmrig
behavioral2/memory/1484-63-0x00007FF721E90000-0x00007FF722281000-memory.dmp	xmrig
behavioral2/memory/2520-376-0x00007FF7F1370000-0x00007FF7F1761000-memory.dmp	xmrig
behavioral2/memory/924-378-0x00007FF6BA730000-0x00007FF6BAB21000-memory.dmp	xmrig
behavioral2/memory/3540-382-0x00007FF6B95F0000-0x00007FF6B99E1000-memory.dmp	xmrig
behavioral2/memory/3016-389-0x00007FF638710000-0x00007FF638B01000-memory.dmp	xmrig
behavioral2/memory/2376-393-0x00007FF624F10000-0x00007FF625301000-memory.dmp	xmrig
behavioral2/memory/2724-85-0x00007FF6B3F70000-0x00007FF6B4361000-memory.dmp	xmrig
behavioral2/memory/3480-81-0x00007FF62A5D0000-0x00007FF62A9C1000-memory.dmp	xmrig
behavioral2/memory/3664-65-0x00007FF67B6A0000-0x00007FF67BA91000-memory.dmp	xmrig
behavioral2/memory/3776-60-0x00007FF738040000-0x00007FF738431000-memory.dmp	xmrig
behavioral2/memory/1156-50-0x00007FF705850000-0x00007FF705C41000-memory.dmp	xmrig
behavioral2/memory/2852-37-0x00007FF6A18B0000-0x00007FF6A1CA1000-memory.dmp	xmrig
behavioral2/memory/1836-395-0x00007FF7C3FC0000-0x00007FF7C43B1000-memory.dmp	xmrig
behavioral2/memory/3344-397-0x00007FF6EDAC0000-0x00007FF6EDEB1000-memory.dmp	xmrig
behavioral2/memory/2844-403-0x00007FF719D10000-0x00007FF71A101000-memory.dmp	xmrig
behavioral2/memory/2616-401-0x00007FF7C4CB0000-0x00007FF7C50A1000-memory.dmp	xmrig
behavioral2/memory/2380-409-0x00007FF72A060000-0x00007FF72A451000-memory.dmp	xmrig
behavioral2/memory/4116-406-0x00007FF721EB0000-0x00007FF7222A1000-memory.dmp	xmrig
behavioral2/memory/3336-449-0x00007FF71AE60000-0x00007FF71B251000-memory.dmp	xmrig
behavioral2/memory/4404-1129-0x00007FF76DC60000-0x00007FF76E051000-memory.dmp	xmrig
behavioral2/memory/3872-1258-0x00007FF719140000-0x00007FF719531000-memory.dmp	xmrig
behavioral2/memory/1876-1390-0x00007FF6B0B80000-0x00007FF6B0F71000-memory.dmp	xmrig
behavioral2/memory/3184-1395-0x00007FF69C010000-0x00007FF69C401000-memory.dmp	xmrig
behavioral2/memory/2724-2130-0x00007FF6B3F70000-0x00007FF6B4361000-memory.dmp	xmrig
behavioral2/memory/4116-2132-0x00007FF721EB0000-0x00007FF7222A1000-memory.dmp	xmrig
behavioral2/memory/3336-2134-0x00007FF71AE60000-0x00007FF71B251000-memory.dmp	xmrig
behavioral2/memory/4684-2136-0x00007FF6C2F10000-0x00007FF6C3301000-memory.dmp	xmrig
behavioral2/memory/2852-2151-0x00007FF6A18B0000-0x00007FF6A1CA1000-memory.dmp	xmrig
behavioral2/memory/1156-2153-0x00007FF705850000-0x00007FF705C41000-memory.dmp	xmrig
behavioral2/memory/1484-2155-0x00007FF721E90000-0x00007FF722281000-memory.dmp	xmrig
behavioral2/memory/3776-2157-0x00007FF738040000-0x00007FF738431000-memory.dmp	xmrig
behavioral2/memory/3668-2161-0x00007FF6CF430000-0x00007FF6CF821000-memory.dmp	xmrig
behavioral2/memory/3664-2160-0x00007FF67B6A0000-0x00007FF67BA91000-memory.dmp	xmrig
behavioral2/memory/1876-2178-0x00007FF6B0B80000-0x00007FF6B0F71000-memory.dmp	xmrig
behavioral2/memory/3872-2195-0x00007FF719140000-0x00007FF719531000-memory.dmp	xmrig
behavioral2/memory/4404-2187-0x00007FF76DC60000-0x00007FF76E051000-memory.dmp	xmrig
behavioral2/memory/2380-2202-0x00007FF72A060000-0x00007FF72A451000-memory.dmp	xmrig
behavioral2/memory/3540-2204-0x00007FF6B95F0000-0x00007FF6B99E1000-memory.dmp	xmrig
behavioral2/memory/2376-2209-0x00007FF624F10000-0x00007FF625301000-memory.dmp	xmrig
behavioral2/memory/1836-2211-0x00007FF7C3FC0000-0x00007FF7C43B1000-memory.dmp	xmrig
behavioral2/memory/3016-2207-0x00007FF638710000-0x00007FF638B01000-memory.dmp	xmrig
behavioral2/memory/924-2206-0x00007FF6BA730000-0x00007FF6BAB21000-memory.dmp	xmrig
behavioral2/memory/2520-2199-0x00007FF7F1370000-0x00007FF7F1761000-memory.dmp	xmrig
behavioral2/memory/3184-2197-0x00007FF69C010000-0x00007FF69C401000-memory.dmp	xmrig
behavioral2/memory/3344-2257-0x00007FF6EDAC0000-0x00007FF6EDEB1000-memory.dmp	xmrig
behavioral2/memory/2616-2255-0x00007FF7C4CB0000-0x00007FF7C50A1000-memory.dmp	xmrig
behavioral2/memory/2844-2253-0x00007FF719D10000-0x00007FF71A101000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2724	cfPcxGE.exe
4116	RyzQmUQ.exe
3336	joGUiVd.exe
4684	ihhbaxc.exe
2852	UanwSfb.exe
1156	aePRDjK.exe
1484	iBzpnAv.exe
3776	ZNIeyzj.exe
3664	LSGHrZb.exe
3668	EVxhngJ.exe
4404	BnaWeOb.exe
3872	nOYbkpN.exe
1876	XyDiUHg.exe
3184	HeuJVnW.exe
2380	VmFNnTh.exe
2520	XZRaOJe.exe
924	hNuGARm.exe
3540	EHzDaLr.exe
3016	kYSpddp.exe
2376	SGMxvDT.exe
1836	ogXbeOX.exe
3344	GGwOETS.exe
2616	HmecpMg.exe
2844	SqpJWGD.exe
4092	lozhbfH.exe
3660	jLtIYDC.exe
2448	QhEwwlL.exe
1164	WAGtLsx.exe
1220	KUZgkdx.exe
3380	PQSdwHI.exe
3792	bqjOniN.exe
2240	eUTqgLH.exe
3812	KGlKMEw.exe
232	tDHZUZB.exe
3756	yVCbgnv.exe
1012	yVUQZWE.exe
3260	rCKFFIV.exe
1200	RxBnFFT.exe
3700	pkkEgJb.exe
4652	DpDGxZw.exe
4232	NRMnIAO.exe
3204	AqubBsz.exe
5080	GFxAQUa.exe
4988	aIFBJOs.exe
2348	sLbpWEn.exe
2972	PdrcoVz.exe
1496	QoJTYdk.exe
1016	cysCCLa.exe
4516	oJOXjDa.exe
4376	zVKkjeM.exe
2728	kGzTDGo.exe
4428	sQuOTFz.exe
1648	nVtQgox.exe
3780	ZgzaplC.exe
3232	TJCYPsJ.exe
4956	EWfZUCw.exe
2656	lKafGRe.exe
4764	vMTbDhd.exe
2624	rURAgid.exe
4492	sFYueOJ.exe
3652	PhgaxsY.exe
940	JjEKbEk.exe
4944	qOMbgkH.exe
2028	vKlyXRe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3480-0-0x00007FF62A5D0000-0x00007FF62A9C1000-memory.dmp	upx
behavioral2/files/0x0008000000023471-5.dat	upx
behavioral2/files/0x0007000000023473-9.dat	upx
behavioral2/files/0x0007000000023472-15.dat	upx
behavioral2/memory/4116-16-0x00007FF721EB0000-0x00007FF7222A1000-memory.dmp	upx
behavioral2/files/0x0007000000023474-21.dat	upx
behavioral2/memory/3336-25-0x00007FF71AE60000-0x00007FF71B251000-memory.dmp	upx
behavioral2/memory/4684-26-0x00007FF6C2F10000-0x00007FF6C3301000-memory.dmp	upx
behavioral2/memory/2724-11-0x00007FF6B3F70000-0x00007FF6B4361000-memory.dmp	upx
behavioral2/files/0x0007000000023475-30.dat	upx
behavioral2/files/0x0007000000023476-35.dat	upx
behavioral2/files/0x000900000002346f-41.dat	upx
behavioral2/files/0x0007000000023477-44.dat	upx
behavioral2/files/0x0007000000023478-55.dat	upx
behavioral2/files/0x0007000000023479-57.dat	upx
behavioral2/memory/3668-61-0x00007FF6CF430000-0x00007FF6CF821000-memory.dmp	upx
behavioral2/memory/1484-63-0x00007FF721E90000-0x00007FF722281000-memory.dmp	upx
behavioral2/memory/4404-66-0x00007FF76DC60000-0x00007FF76E051000-memory.dmp	upx
behavioral2/files/0x000700000002347b-70.dat	upx
behavioral2/files/0x000700000002347e-79.dat	upx
behavioral2/files/0x000700000002347f-91.dat	upx
behavioral2/files/0x0007000000023481-99.dat	upx
behavioral2/files/0x0007000000023483-109.dat	upx
behavioral2/files/0x0007000000023486-126.dat	upx
behavioral2/files/0x0007000000023488-134.dat	upx
behavioral2/files/0x0007000000023489-141.dat	upx
behavioral2/files/0x000700000002348b-151.dat	upx
behavioral2/files/0x000700000002348e-164.dat	upx
behavioral2/memory/3184-375-0x00007FF69C010000-0x00007FF69C401000-memory.dmp	upx
behavioral2/memory/2520-376-0x00007FF7F1370000-0x00007FF7F1761000-memory.dmp	upx
behavioral2/memory/924-378-0x00007FF6BA730000-0x00007FF6BAB21000-memory.dmp	upx
behavioral2/memory/3540-382-0x00007FF6B95F0000-0x00007FF6B99E1000-memory.dmp	upx
behavioral2/files/0x0007000000023490-176.dat	upx
behavioral2/files/0x000700000002348f-171.dat	upx
behavioral2/files/0x000700000002348d-161.dat	upx
behavioral2/files/0x000700000002348c-156.dat	upx
behavioral2/files/0x000700000002348a-149.dat	upx
behavioral2/memory/3016-389-0x00007FF638710000-0x00007FF638B01000-memory.dmp	upx
behavioral2/memory/2376-393-0x00007FF624F10000-0x00007FF625301000-memory.dmp	upx
behavioral2/files/0x0007000000023487-131.dat	upx
behavioral2/files/0x0007000000023485-121.dat	upx
behavioral2/files/0x0007000000023484-116.dat	upx
behavioral2/files/0x0007000000023482-106.dat	upx
behavioral2/files/0x0007000000023480-96.dat	upx
behavioral2/memory/2724-85-0x00007FF6B3F70000-0x00007FF6B4361000-memory.dmp	upx
behavioral2/files/0x000700000002347d-82.dat	upx
behavioral2/memory/3480-81-0x00007FF62A5D0000-0x00007FF62A9C1000-memory.dmp	upx
behavioral2/memory/1876-78-0x00007FF6B0B80000-0x00007FF6B0F71000-memory.dmp	upx
behavioral2/memory/3872-72-0x00007FF719140000-0x00007FF719531000-memory.dmp	upx
behavioral2/files/0x000700000002347a-62.dat	upx
behavioral2/memory/3664-65-0x00007FF67B6A0000-0x00007FF67BA91000-memory.dmp	upx
behavioral2/memory/3776-60-0x00007FF738040000-0x00007FF738431000-memory.dmp	upx
behavioral2/memory/1156-50-0x00007FF705850000-0x00007FF705C41000-memory.dmp	upx
behavioral2/memory/2852-37-0x00007FF6A18B0000-0x00007FF6A1CA1000-memory.dmp	upx
behavioral2/memory/1836-395-0x00007FF7C3FC0000-0x00007FF7C43B1000-memory.dmp	upx
behavioral2/memory/3344-397-0x00007FF6EDAC0000-0x00007FF6EDEB1000-memory.dmp	upx
behavioral2/memory/2844-403-0x00007FF719D10000-0x00007FF71A101000-memory.dmp	upx
behavioral2/memory/2616-401-0x00007FF7C4CB0000-0x00007FF7C50A1000-memory.dmp	upx
behavioral2/memory/2380-409-0x00007FF72A060000-0x00007FF72A451000-memory.dmp	upx
behavioral2/memory/4116-406-0x00007FF721EB0000-0x00007FF7222A1000-memory.dmp	upx
behavioral2/memory/3336-449-0x00007FF71AE60000-0x00007FF71B251000-memory.dmp	upx
behavioral2/memory/4404-1129-0x00007FF76DC60000-0x00007FF76E051000-memory.dmp	upx
behavioral2/memory/3872-1258-0x00007FF719140000-0x00007FF719531000-memory.dmp	upx
behavioral2/memory/1876-1390-0x00007FF6B0B80000-0x00007FF6B0F71000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DagNJkn.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\rEwYDkS.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\bpbhvxp.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\vNDcBvd.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\LiyzRWv.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\aMGSLyu.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\kzlFXbs.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\EHzDaLr.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\mogoPbg.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\yaJvkhR.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\ZYliFGR.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\IhdtoeU.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\nVtQgox.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\zBZYzgR.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\cObtfSn.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\kuMScKI.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\JKWdGqQ.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\gJsLIuh.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\yuqyhFB.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\DnPZvCe.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\qPemSgY.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\qOZsrzW.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\UzhqEFL.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\BnaWeOb.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\gKNsxjq.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\XhkKNJx.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\BLTUJLX.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\itaMJfb.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\RUNsqIv.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\jjGNVFy.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\XYdyjgD.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\qzddDXA.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\TPKaKRU.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\FLPOZyu.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\SnTAUpf.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\YWFmQhE.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\pWVtdjr.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\qjYnosK.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\QhEwwlL.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\vMTbDhd.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\YIyNdjv.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\nGQstQb.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\vWfRhfH.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\hGaDecq.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\tcBWAbA.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\ltaphjV.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\XOvopEo.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\jNPIpcQ.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\YJUBhOF.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\HUgYYGR.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\AZNVQxl.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\GBOkivu.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\CWCZvTq.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\hBoumnW.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\zZXxxWi.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\czLtXJc.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\LpyXzLO.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\YDYCImq.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\QqlWnyU.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\pkFYqif.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\DLpfeuP.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\OlRlRqh.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\VziwXED.exe	4fd1ada66066cd4935a568abccb62b80N.exe
File created	C:\Windows\System32\lBNqOKA.exe	4fd1ada66066cd4935a568abccb62b80N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2724	3480	4fd1ada66066cd4935a568abccb62b80N.exe	85
PID 3480 wrote to memory of 2724	3480	4fd1ada66066cd4935a568abccb62b80N.exe	85
PID 3480 wrote to memory of 4116	3480	4fd1ada66066cd4935a568abccb62b80N.exe	86
PID 3480 wrote to memory of 4116	3480	4fd1ada66066cd4935a568abccb62b80N.exe	86
PID 3480 wrote to memory of 3336	3480	4fd1ada66066cd4935a568abccb62b80N.exe	87
PID 3480 wrote to memory of 3336	3480	4fd1ada66066cd4935a568abccb62b80N.exe	87
PID 3480 wrote to memory of 4684	3480	4fd1ada66066cd4935a568abccb62b80N.exe	88
PID 3480 wrote to memory of 4684	3480	4fd1ada66066cd4935a568abccb62b80N.exe	88
PID 3480 wrote to memory of 2852	3480	4fd1ada66066cd4935a568abccb62b80N.exe	89
PID 3480 wrote to memory of 2852	3480	4fd1ada66066cd4935a568abccb62b80N.exe	89
PID 3480 wrote to memory of 1156	3480	4fd1ada66066cd4935a568abccb62b80N.exe	90
PID 3480 wrote to memory of 1156	3480	4fd1ada66066cd4935a568abccb62b80N.exe	90
PID 3480 wrote to memory of 1484	3480	4fd1ada66066cd4935a568abccb62b80N.exe	91
PID 3480 wrote to memory of 1484	3480	4fd1ada66066cd4935a568abccb62b80N.exe	91
PID 3480 wrote to memory of 3776	3480	4fd1ada66066cd4935a568abccb62b80N.exe	92
PID 3480 wrote to memory of 3776	3480	4fd1ada66066cd4935a568abccb62b80N.exe	92
PID 3480 wrote to memory of 3668	3480	4fd1ada66066cd4935a568abccb62b80N.exe	93
PID 3480 wrote to memory of 3668	3480	4fd1ada66066cd4935a568abccb62b80N.exe	93
PID 3480 wrote to memory of 3664	3480	4fd1ada66066cd4935a568abccb62b80N.exe	94
PID 3480 wrote to memory of 3664	3480	4fd1ada66066cd4935a568abccb62b80N.exe	94
PID 3480 wrote to memory of 4404	3480	4fd1ada66066cd4935a568abccb62b80N.exe	95
PID 3480 wrote to memory of 4404	3480	4fd1ada66066cd4935a568abccb62b80N.exe	95
PID 3480 wrote to memory of 3872	3480	4fd1ada66066cd4935a568abccb62b80N.exe	96
PID 3480 wrote to memory of 3872	3480	4fd1ada66066cd4935a568abccb62b80N.exe	96
PID 3480 wrote to memory of 1876	3480	4fd1ada66066cd4935a568abccb62b80N.exe	97
PID 3480 wrote to memory of 1876	3480	4fd1ada66066cd4935a568abccb62b80N.exe	97
PID 3480 wrote to memory of 3184	3480	4fd1ada66066cd4935a568abccb62b80N.exe	98
PID 3480 wrote to memory of 3184	3480	4fd1ada66066cd4935a568abccb62b80N.exe	98
PID 3480 wrote to memory of 2380	3480	4fd1ada66066cd4935a568abccb62b80N.exe	99
PID 3480 wrote to memory of 2380	3480	4fd1ada66066cd4935a568abccb62b80N.exe	99
PID 3480 wrote to memory of 2520	3480	4fd1ada66066cd4935a568abccb62b80N.exe	100
PID 3480 wrote to memory of 2520	3480	4fd1ada66066cd4935a568abccb62b80N.exe	100
PID 3480 wrote to memory of 924	3480	4fd1ada66066cd4935a568abccb62b80N.exe	101
PID 3480 wrote to memory of 924	3480	4fd1ada66066cd4935a568abccb62b80N.exe	101
PID 3480 wrote to memory of 3540	3480	4fd1ada66066cd4935a568abccb62b80N.exe	102
PID 3480 wrote to memory of 3540	3480	4fd1ada66066cd4935a568abccb62b80N.exe	102
PID 3480 wrote to memory of 3016	3480	4fd1ada66066cd4935a568abccb62b80N.exe	103
PID 3480 wrote to memory of 3016	3480	4fd1ada66066cd4935a568abccb62b80N.exe	103
PID 3480 wrote to memory of 2376	3480	4fd1ada66066cd4935a568abccb62b80N.exe	104
PID 3480 wrote to memory of 2376	3480	4fd1ada66066cd4935a568abccb62b80N.exe	104
PID 3480 wrote to memory of 1836	3480	4fd1ada66066cd4935a568abccb62b80N.exe	105
PID 3480 wrote to memory of 1836	3480	4fd1ada66066cd4935a568abccb62b80N.exe	105
PID 3480 wrote to memory of 3344	3480	4fd1ada66066cd4935a568abccb62b80N.exe	106
PID 3480 wrote to memory of 3344	3480	4fd1ada66066cd4935a568abccb62b80N.exe	106
PID 3480 wrote to memory of 2616	3480	4fd1ada66066cd4935a568abccb62b80N.exe	107
PID 3480 wrote to memory of 2616	3480	4fd1ada66066cd4935a568abccb62b80N.exe	107
PID 3480 wrote to memory of 2844	3480	4fd1ada66066cd4935a568abccb62b80N.exe	108
PID 3480 wrote to memory of 2844	3480	4fd1ada66066cd4935a568abccb62b80N.exe	108
PID 3480 wrote to memory of 4092	3480	4fd1ada66066cd4935a568abccb62b80N.exe	109
PID 3480 wrote to memory of 4092	3480	4fd1ada66066cd4935a568abccb62b80N.exe	109
PID 3480 wrote to memory of 3660	3480	4fd1ada66066cd4935a568abccb62b80N.exe	110
PID 3480 wrote to memory of 3660	3480	4fd1ada66066cd4935a568abccb62b80N.exe	110
PID 3480 wrote to memory of 2448	3480	4fd1ada66066cd4935a568abccb62b80N.exe	111
PID 3480 wrote to memory of 2448	3480	4fd1ada66066cd4935a568abccb62b80N.exe	111
PID 3480 wrote to memory of 1164	3480	4fd1ada66066cd4935a568abccb62b80N.exe	112
PID 3480 wrote to memory of 1164	3480	4fd1ada66066cd4935a568abccb62b80N.exe	112
PID 3480 wrote to memory of 1220	3480	4fd1ada66066cd4935a568abccb62b80N.exe	113
PID 3480 wrote to memory of 1220	3480	4fd1ada66066cd4935a568abccb62b80N.exe	113
PID 3480 wrote to memory of 3380	3480	4fd1ada66066cd4935a568abccb62b80N.exe	114
PID 3480 wrote to memory of 3380	3480	4fd1ada66066cd4935a568abccb62b80N.exe	114
PID 3480 wrote to memory of 3792	3480	4fd1ada66066cd4935a568abccb62b80N.exe	115
PID 3480 wrote to memory of 3792	3480	4fd1ada66066cd4935a568abccb62b80N.exe	115
PID 3480 wrote to memory of 2240	3480	4fd1ada66066cd4935a568abccb62b80N.exe	116
PID 3480 wrote to memory of 2240	3480	4fd1ada66066cd4935a568abccb62b80N.exe	116

C:\Users\Admin\AppData\Local\Temp\4fd1ada66066cd4935a568abccb62b80N.exe
"C:\Users\Admin\AppData\Local\Temp\4fd1ada66066cd4935a568abccb62b80N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\System32\cfPcxGE.exe
  C:\Windows\System32\cfPcxGE.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System32\RyzQmUQ.exe
  C:\Windows\System32\RyzQmUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System32\joGUiVd.exe
  C:\Windows\System32\joGUiVd.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System32\ihhbaxc.exe
  C:\Windows\System32\ihhbaxc.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System32\UanwSfb.exe
  C:\Windows\System32\UanwSfb.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System32\aePRDjK.exe
  C:\Windows\System32\aePRDjK.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System32\iBzpnAv.exe
  C:\Windows\System32\iBzpnAv.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System32\ZNIeyzj.exe
  C:\Windows\System32\ZNIeyzj.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System32\EVxhngJ.exe
  C:\Windows\System32\EVxhngJ.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System32\LSGHrZb.exe
  C:\Windows\System32\LSGHrZb.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System32\BnaWeOb.exe
  C:\Windows\System32\BnaWeOb.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System32\nOYbkpN.exe
  C:\Windows\System32\nOYbkpN.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System32\XyDiUHg.exe
  C:\Windows\System32\XyDiUHg.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System32\HeuJVnW.exe
  C:\Windows\System32\HeuJVnW.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System32\VmFNnTh.exe
  C:\Windows\System32\VmFNnTh.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System32\XZRaOJe.exe
  C:\Windows\System32\XZRaOJe.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System32\hNuGARm.exe
  C:\Windows\System32\hNuGARm.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System32\EHzDaLr.exe
  C:\Windows\System32\EHzDaLr.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System32\kYSpddp.exe
  C:\Windows\System32\kYSpddp.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System32\SGMxvDT.exe
  C:\Windows\System32\SGMxvDT.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System32\ogXbeOX.exe
  C:\Windows\System32\ogXbeOX.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System32\GGwOETS.exe
  C:\Windows\System32\GGwOETS.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System32\HmecpMg.exe
  C:\Windows\System32\HmecpMg.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System32\SqpJWGD.exe
  C:\Windows\System32\SqpJWGD.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System32\lozhbfH.exe
  C:\Windows\System32\lozhbfH.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System32\jLtIYDC.exe
  C:\Windows\System32\jLtIYDC.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System32\QhEwwlL.exe
  C:\Windows\System32\QhEwwlL.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System32\WAGtLsx.exe
  C:\Windows\System32\WAGtLsx.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System32\KUZgkdx.exe
  C:\Windows\System32\KUZgkdx.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System32\PQSdwHI.exe
  C:\Windows\System32\PQSdwHI.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System32\bqjOniN.exe
  C:\Windows\System32\bqjOniN.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System32\eUTqgLH.exe
  C:\Windows\System32\eUTqgLH.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System32\KGlKMEw.exe
  C:\Windows\System32\KGlKMEw.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System32\tDHZUZB.exe
  C:\Windows\System32\tDHZUZB.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System32\yVCbgnv.exe
  C:\Windows\System32\yVCbgnv.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System32\yVUQZWE.exe
  C:\Windows\System32\yVUQZWE.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System32\rCKFFIV.exe
  C:\Windows\System32\rCKFFIV.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System32\RxBnFFT.exe
  C:\Windows\System32\RxBnFFT.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System32\pkkEgJb.exe
  C:\Windows\System32\pkkEgJb.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System32\DpDGxZw.exe
  C:\Windows\System32\DpDGxZw.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System32\NRMnIAO.exe
  C:\Windows\System32\NRMnIAO.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System32\AqubBsz.exe
  C:\Windows\System32\AqubBsz.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System32\GFxAQUa.exe
  C:\Windows\System32\GFxAQUa.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System32\aIFBJOs.exe
  C:\Windows\System32\aIFBJOs.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System32\sLbpWEn.exe
  C:\Windows\System32\sLbpWEn.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System32\PdrcoVz.exe
  C:\Windows\System32\PdrcoVz.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System32\QoJTYdk.exe
  C:\Windows\System32\QoJTYdk.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System32\cysCCLa.exe
  C:\Windows\System32\cysCCLa.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System32\oJOXjDa.exe
  C:\Windows\System32\oJOXjDa.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System32\zVKkjeM.exe
  C:\Windows\System32\zVKkjeM.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System32\kGzTDGo.exe
  C:\Windows\System32\kGzTDGo.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System32\sQuOTFz.exe
  C:\Windows\System32\sQuOTFz.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System32\nVtQgox.exe
  C:\Windows\System32\nVtQgox.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System32\ZgzaplC.exe
  C:\Windows\System32\ZgzaplC.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System32\TJCYPsJ.exe
  C:\Windows\System32\TJCYPsJ.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System32\EWfZUCw.exe
  C:\Windows\System32\EWfZUCw.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System32\lKafGRe.exe
  C:\Windows\System32\lKafGRe.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System32\vMTbDhd.exe
  C:\Windows\System32\vMTbDhd.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System32\rURAgid.exe
  C:\Windows\System32\rURAgid.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System32\sFYueOJ.exe
  C:\Windows\System32\sFYueOJ.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System32\PhgaxsY.exe
  C:\Windows\System32\PhgaxsY.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System32\JjEKbEk.exe
  C:\Windows\System32\JjEKbEk.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System32\qOMbgkH.exe
  C:\Windows\System32\qOMbgkH.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System32\vKlyXRe.exe
  C:\Windows\System32\vKlyXRe.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System32\IqgygvP.exe
  C:\Windows\System32\IqgygvP.exe
  2⤵
  PID:5040
- C:\Windows\System32\cKexNMX.exe
  C:\Windows\System32\cKexNMX.exe
  2⤵
  PID:3288
- C:\Windows\System32\RQJsaUO.exe
  C:\Windows\System32\RQJsaUO.exe
  2⤵
  PID:2836
- C:\Windows\System32\FSfoFoX.exe
  C:\Windows\System32\FSfoFoX.exe
  2⤵
  PID:3640
- C:\Windows\System32\fSrjPug.exe
  C:\Windows\System32\fSrjPug.exe
  2⤵
  PID:948
- C:\Windows\System32\pmmjTZr.exe
  C:\Windows\System32\pmmjTZr.exe
  2⤵
  PID:1924
- C:\Windows\System32\gKNsxjq.exe
  C:\Windows\System32\gKNsxjq.exe
  2⤵
  PID:64
- C:\Windows\System32\HUgYYGR.exe
  C:\Windows\System32\HUgYYGR.exe
  2⤵
  PID:2156
- C:\Windows\System32\RXHxOjT.exe
  C:\Windows\System32\RXHxOjT.exe
  2⤵
  PID:2280
- C:\Windows\System32\PgmfiKt.exe
  C:\Windows\System32\PgmfiKt.exe
  2⤵
  PID:2392
- C:\Windows\System32\fDaLFee.exe
  C:\Windows\System32\fDaLFee.exe
  2⤵
  PID:5144
- C:\Windows\System32\XneZKPR.exe
  C:\Windows\System32\XneZKPR.exe
  2⤵
  PID:5180
- C:\Windows\System32\eZTYoHX.exe
  C:\Windows\System32\eZTYoHX.exe
  2⤵
  PID:5196
- C:\Windows\System32\PtVzZGA.exe
  C:\Windows\System32\PtVzZGA.exe
  2⤵
  PID:5228
- C:\Windows\System32\KUuNASA.exe
  C:\Windows\System32\KUuNASA.exe
  2⤵
  PID:5264
- C:\Windows\System32\bhACNgI.exe
  C:\Windows\System32\bhACNgI.exe
  2⤵
  PID:5292
- C:\Windows\System32\kdVvxBm.exe
  C:\Windows\System32\kdVvxBm.exe
  2⤵
  PID:5320
- C:\Windows\System32\JKWdGqQ.exe
  C:\Windows\System32\JKWdGqQ.exe
  2⤵
  PID:5344
- C:\Windows\System32\edsrnoa.exe
  C:\Windows\System32\edsrnoa.exe
  2⤵
  PID:5364
- C:\Windows\System32\zKSEteg.exe
  C:\Windows\System32\zKSEteg.exe
  2⤵
  PID:5396
- C:\Windows\System32\UpqVXgK.exe
  C:\Windows\System32\UpqVXgK.exe
  2⤵
  PID:5420
- C:\Windows\System32\ghoaNoL.exe
  C:\Windows\System32\ghoaNoL.exe
  2⤵
  PID:5460
- C:\Windows\System32\aSDYqTh.exe
  C:\Windows\System32\aSDYqTh.exe
  2⤵
  PID:5488
- C:\Windows\System32\CLBbNRb.exe
  C:\Windows\System32\CLBbNRb.exe
  2⤵
  PID:5516
- C:\Windows\System32\eVEuFzm.exe
  C:\Windows\System32\eVEuFzm.exe
  2⤵
  PID:5544
- C:\Windows\System32\aJvxMIk.exe
  C:\Windows\System32\aJvxMIk.exe
  2⤵
  PID:5560
- C:\Windows\System32\JdaxwqW.exe
  C:\Windows\System32\JdaxwqW.exe
  2⤵
  PID:5624
- C:\Windows\System32\KcvXYbi.exe
  C:\Windows\System32\KcvXYbi.exe
  2⤵
  PID:5640
- C:\Windows\System32\LmdewMK.exe
  C:\Windows\System32\LmdewMK.exe
  2⤵
  PID:5668
- C:\Windows\System32\HrTsOqX.exe
  C:\Windows\System32\HrTsOqX.exe
  2⤵
  PID:5692
- C:\Windows\System32\TPJCRYs.exe
  C:\Windows\System32\TPJCRYs.exe
  2⤵
  PID:5712
- C:\Windows\System32\nyNJTxK.exe
  C:\Windows\System32\nyNJTxK.exe
  2⤵
  PID:5752
- C:\Windows\System32\bPUthVm.exe
  C:\Windows\System32\bPUthVm.exe
  2⤵
  PID:5768
- C:\Windows\System32\tfPEeSf.exe
  C:\Windows\System32\tfPEeSf.exe
  2⤵
  PID:5796
- C:\Windows\System32\ONvpzmf.exe
  C:\Windows\System32\ONvpzmf.exe
  2⤵
  PID:5824
- C:\Windows\System32\GgrfJQh.exe
  C:\Windows\System32\GgrfJQh.exe
  2⤵
  PID:5904
- C:\Windows\System32\KnCzPys.exe
  C:\Windows\System32\KnCzPys.exe
  2⤵
  PID:5932
- C:\Windows\System32\wsgpqGG.exe
  C:\Windows\System32\wsgpqGG.exe
  2⤵
  PID:5948
- C:\Windows\System32\RtiiaJz.exe
  C:\Windows\System32\RtiiaJz.exe
  2⤵
  PID:5972
- C:\Windows\System32\bvdCdQx.exe
  C:\Windows\System32\bvdCdQx.exe
  2⤵
  PID:6020
- C:\Windows\System32\tvpqXBf.exe
  C:\Windows\System32\tvpqXBf.exe
  2⤵
  PID:6052
- C:\Windows\System32\HeqrMLO.exe
  C:\Windows\System32\HeqrMLO.exe
  2⤵
  PID:6084
- C:\Windows\System32\gyCYEeT.exe
  C:\Windows\System32\gyCYEeT.exe
  2⤵
  PID:6132
- C:\Windows\System32\ZanKfRM.exe
  C:\Windows\System32\ZanKfRM.exe
  2⤵
  PID:4680
- C:\Windows\System32\AZNVQxl.exe
  C:\Windows\System32\AZNVQxl.exe
  2⤵
  PID:1420
- C:\Windows\System32\FEASvFs.exe
  C:\Windows\System32\FEASvFs.exe
  2⤵
  PID:4596
- C:\Windows\System32\aQHUaXt.exe
  C:\Windows\System32\aQHUaXt.exe
  2⤵
  PID:764
- C:\Windows\System32\QDPWqsp.exe
  C:\Windows\System32\QDPWqsp.exe
  2⤵
  PID:5160
- C:\Windows\System32\YIyNdjv.exe
  C:\Windows\System32\YIyNdjv.exe
  2⤵
  PID:5220
- C:\Windows\System32\irvrlSc.exe
  C:\Windows\System32\irvrlSc.exe
  2⤵
  PID:5244
- C:\Windows\System32\nrifwac.exe
  C:\Windows\System32\nrifwac.exe
  2⤵
  PID:5312
- C:\Windows\System32\ZDZKfwB.exe
  C:\Windows\System32\ZDZKfwB.exe
  2⤵
  PID:5356
- C:\Windows\System32\vswFJcZ.exe
  C:\Windows\System32\vswFJcZ.exe
  2⤵
  PID:5480
- C:\Windows\System32\gJsLIuh.exe
  C:\Windows\System32\gJsLIuh.exe
  2⤵
  PID:5500
- C:\Windows\System32\sZancIV.exe
  C:\Windows\System32\sZancIV.exe
  2⤵
  PID:5592
- C:\Windows\System32\ieFcVRI.exe
  C:\Windows\System32\ieFcVRI.exe
  2⤵
  PID:5632
- C:\Windows\System32\pMqOcxk.exe
  C:\Windows\System32\pMqOcxk.exe
  2⤵
  PID:5648
- C:\Windows\System32\RPVErAQ.exe
  C:\Windows\System32\RPVErAQ.exe
  2⤵
  PID:3680
- C:\Windows\System32\wRWtBxN.exe
  C:\Windows\System32\wRWtBxN.exe
  2⤵
  PID:5724
- C:\Windows\System32\DegjDym.exe
  C:\Windows\System32\DegjDym.exe
  2⤵
  PID:5728
- C:\Windows\System32\dWTOgIB.exe
  C:\Windows\System32\dWTOgIB.exe
  2⤵
  PID:4564
- C:\Windows\System32\nGQstQb.exe
  C:\Windows\System32\nGQstQb.exe
  2⤵
  PID:1508
- C:\Windows\System32\vVHPEhd.exe
  C:\Windows\System32\vVHPEhd.exe
  2⤵
  PID:3836
- C:\Windows\System32\PeLVGFT.exe
  C:\Windows\System32\PeLVGFT.exe
  2⤵
  PID:4136
- C:\Windows\System32\BFMGmoT.exe
  C:\Windows\System32\BFMGmoT.exe
  2⤵
  PID:3136
- C:\Windows\System32\XhkKNJx.exe
  C:\Windows\System32\XhkKNJx.exe
  2⤵
  PID:4360
- C:\Windows\System32\nHFETrJ.exe
  C:\Windows\System32\nHFETrJ.exe
  2⤵
  PID:4556
- C:\Windows\System32\hfsEaaa.exe
  C:\Windows\System32\hfsEaaa.exe
  2⤵
  PID:4968
- C:\Windows\System32\qVvBhLU.exe
  C:\Windows\System32\qVvBhLU.exe
  2⤵
  PID:2248
- C:\Windows\System32\yvfCOag.exe
  C:\Windows\System32\yvfCOag.exe
  2⤵
  PID:2752
- C:\Windows\System32\njudbgW.exe
  C:\Windows\System32\njudbgW.exe
  2⤵
  PID:384
- C:\Windows\System32\BhEJIGx.exe
  C:\Windows\System32\BhEJIGx.exe
  2⤵
  PID:1844
- C:\Windows\System32\kGEfxqk.exe
  C:\Windows\System32\kGEfxqk.exe
  2⤵
  PID:5820
- C:\Windows\System32\qNTjWzJ.exe
  C:\Windows\System32\qNTjWzJ.exe
  2⤵
  PID:5092
- C:\Windows\System32\IajPyfY.exe
  C:\Windows\System32\IajPyfY.exe
  2⤵
  PID:4072
- C:\Windows\System32\gZXckcV.exe
  C:\Windows\System32\gZXckcV.exe
  2⤵
  PID:752
- C:\Windows\System32\DaDRIME.exe
  C:\Windows\System32\DaDRIME.exe
  2⤵
  PID:5924
- C:\Windows\System32\zBZYzgR.exe
  C:\Windows\System32\zBZYzgR.exe
  2⤵
  PID:5992
- C:\Windows\System32\NwVrcMU.exe
  C:\Windows\System32\NwVrcMU.exe
  2⤵
  PID:6080
- C:\Windows\System32\HEnOmfh.exe
  C:\Windows\System32\HEnOmfh.exe
  2⤵
  PID:6060
- C:\Windows\System32\BKGCIwG.exe
  C:\Windows\System32\BKGCIwG.exe
  2⤵
  PID:4488
- C:\Windows\System32\hMBKOSA.exe
  C:\Windows\System32\hMBKOSA.exe
  2⤵
  PID:4396
- C:\Windows\System32\jcGMeRm.exe
  C:\Windows\System32\jcGMeRm.exe
  2⤵
  PID:5472
- C:\Windows\System32\czLtXJc.exe
  C:\Windows\System32\czLtXJc.exe
  2⤵
  PID:5872
- C:\Windows\System32\YeZqgDv.exe
  C:\Windows\System32\YeZqgDv.exe
  2⤵
  PID:5708
- C:\Windows\System32\IgDZyXA.exe
  C:\Windows\System32\IgDZyXA.exe
  2⤵
  PID:5744
- C:\Windows\System32\hLCpjIS.exe
  C:\Windows\System32\hLCpjIS.exe
  2⤵
  PID:2016
- C:\Windows\System32\uHVQIoN.exe
  C:\Windows\System32\uHVQIoN.exe
  2⤵
  PID:6072
- C:\Windows\System32\VPvIrBA.exe
  C:\Windows\System32\VPvIrBA.exe
  2⤵
  PID:2488
- C:\Windows\System32\nCVmZFU.exe
  C:\Windows\System32\nCVmZFU.exe
  2⤵
  PID:816
- C:\Windows\System32\dbXSOfz.exe
  C:\Windows\System32\dbXSOfz.exe
  2⤵
  PID:5808
- C:\Windows\System32\jOnLgPb.exe
  C:\Windows\System32\jOnLgPb.exe
  2⤵
  PID:5836
- C:\Windows\System32\SiJjpBa.exe
  C:\Windows\System32\SiJjpBa.exe
  2⤵
  PID:5940
- C:\Windows\System32\AWJpwMJ.exe
  C:\Windows\System32\AWJpwMJ.exe
  2⤵
  PID:5984
- C:\Windows\System32\NUSKIAM.exe
  C:\Windows\System32\NUSKIAM.exe
  2⤵
  PID:6116
- C:\Windows\System32\reUTjnQ.exe
  C:\Windows\System32\reUTjnQ.exe
  2⤵
  PID:5680
- C:\Windows\System32\dwpNAMn.exe
  C:\Windows\System32\dwpNAMn.exe
  2⤵
  PID:5060
- C:\Windows\System32\BZQXkjz.exe
  C:\Windows\System32\BZQXkjz.exe
  2⤵
  PID:3012
- C:\Windows\System32\QXRieWV.exe
  C:\Windows\System32\QXRieWV.exe
  2⤵
  PID:2732
- C:\Windows\System32\eflLcZx.exe
  C:\Windows\System32\eflLcZx.exe
  2⤵
  PID:1104
- C:\Windows\System32\FbCdRNp.exe
  C:\Windows\System32\FbCdRNp.exe
  2⤵
  PID:720
- C:\Windows\System32\BbGJqbR.exe
  C:\Windows\System32\BbGJqbR.exe
  2⤵
  PID:2460
- C:\Windows\System32\vWFqQwL.exe
  C:\Windows\System32\vWFqQwL.exe
  2⤵
  PID:6044
- C:\Windows\System32\aHzlzxs.exe
  C:\Windows\System32\aHzlzxs.exe
  2⤵
  PID:5920
- C:\Windows\System32\COgjdtp.exe
  C:\Windows\System32\COgjdtp.exe
  2⤵
  PID:3704
- C:\Windows\System32\eMfrNuP.exe
  C:\Windows\System32\eMfrNuP.exe
  2⤵
  PID:6164
- C:\Windows\System32\lajYdyl.exe
  C:\Windows\System32\lajYdyl.exe
  2⤵
  PID:6188
- C:\Windows\System32\AhXIIEE.exe
  C:\Windows\System32\AhXIIEE.exe
  2⤵
  PID:6212
- C:\Windows\System32\cloILGB.exe
  C:\Windows\System32\cloILGB.exe
  2⤵
  PID:6232
- C:\Windows\System32\QUwNRhi.exe
  C:\Windows\System32\QUwNRhi.exe
  2⤵
  PID:6280
- C:\Windows\System32\ZSzWkQP.exe
  C:\Windows\System32\ZSzWkQP.exe
  2⤵
  PID:6296
- C:\Windows\System32\DHrRTSe.exe
  C:\Windows\System32\DHrRTSe.exe
  2⤵
  PID:6324
- C:\Windows\System32\dEAgeVV.exe
  C:\Windows\System32\dEAgeVV.exe
  2⤵
  PID:6340
- C:\Windows\System32\TgsCQOH.exe
  C:\Windows\System32\TgsCQOH.exe
  2⤵
  PID:6364
- C:\Windows\System32\SBCXqDP.exe
  C:\Windows\System32\SBCXqDP.exe
  2⤵
  PID:6380
- C:\Windows\System32\jvTkFRs.exe
  C:\Windows\System32\jvTkFRs.exe
  2⤵
  PID:6408
- C:\Windows\System32\WKXaLBY.exe
  C:\Windows\System32\WKXaLBY.exe
  2⤵
  PID:6444
- C:\Windows\System32\EOAmqEs.exe
  C:\Windows\System32\EOAmqEs.exe
  2⤵
  PID:6476
- C:\Windows\System32\eeEnYrC.exe
  C:\Windows\System32\eeEnYrC.exe
  2⤵
  PID:6500
- C:\Windows\System32\atITnox.exe
  C:\Windows\System32\atITnox.exe
  2⤵
  PID:6524
- C:\Windows\System32\PObLtte.exe
  C:\Windows\System32\PObLtte.exe
  2⤵
  PID:6560
- C:\Windows\System32\qJSptQI.exe
  C:\Windows\System32\qJSptQI.exe
  2⤵
  PID:6616
- C:\Windows\System32\oUQOLMz.exe
  C:\Windows\System32\oUQOLMz.exe
  2⤵
  PID:6644
- C:\Windows\System32\bwfOjkz.exe
  C:\Windows\System32\bwfOjkz.exe
  2⤵
  PID:6664
- C:\Windows\System32\ytppbxr.exe
  C:\Windows\System32\ytppbxr.exe
  2⤵
  PID:6684
- C:\Windows\System32\GBOkivu.exe
  C:\Windows\System32\GBOkivu.exe
  2⤵
  PID:6716
- C:\Windows\System32\FZtAkJa.exe
  C:\Windows\System32\FZtAkJa.exe
  2⤵
  PID:6736
- C:\Windows\System32\zXiTaly.exe
  C:\Windows\System32\zXiTaly.exe
  2⤵
  PID:6752
- C:\Windows\System32\rYqjrKT.exe
  C:\Windows\System32\rYqjrKT.exe
  2⤵
  PID:6776
- C:\Windows\System32\YLPjvyc.exe
  C:\Windows\System32\YLPjvyc.exe
  2⤵
  PID:6828
- C:\Windows\System32\ftADFLH.exe
  C:\Windows\System32\ftADFLH.exe
  2⤵
  PID:6848
- C:\Windows\System32\igXBuac.exe
  C:\Windows\System32\igXBuac.exe
  2⤵
  PID:6872
- C:\Windows\System32\DybbEgG.exe
  C:\Windows\System32\DybbEgG.exe
  2⤵
  PID:6904
- C:\Windows\System32\XdSqoRt.exe
  C:\Windows\System32\XdSqoRt.exe
  2⤵
  PID:6928
- C:\Windows\System32\jpEMcga.exe
  C:\Windows\System32\jpEMcga.exe
  2⤵
  PID:6952
- C:\Windows\System32\JNEWoXm.exe
  C:\Windows\System32\JNEWoXm.exe
  2⤵
  PID:6968
- C:\Windows\System32\LpyXzLO.exe
  C:\Windows\System32\LpyXzLO.exe
  2⤵
  PID:6984
- C:\Windows\System32\YNvOswg.exe
  C:\Windows\System32\YNvOswg.exe
  2⤵
  PID:7056
- C:\Windows\System32\Jfgqrxv.exe
  C:\Windows\System32\Jfgqrxv.exe
  2⤵
  PID:7076
- C:\Windows\System32\yECNUIJ.exe
  C:\Windows\System32\yECNUIJ.exe
  2⤵
  PID:7092
- C:\Windows\System32\YOAaSmn.exe
  C:\Windows\System32\YOAaSmn.exe
  2⤵
  PID:7108
- C:\Windows\System32\hxwWtMD.exe
  C:\Windows\System32\hxwWtMD.exe
  2⤵
  PID:7124
- C:\Windows\System32\ovKOvcT.exe
  C:\Windows\System32\ovKOvcT.exe
  2⤵
  PID:7140
- C:\Windows\System32\xZuJQAv.exe
  C:\Windows\System32\xZuJQAv.exe
  2⤵
  PID:7156
- C:\Windows\System32\mMtXDeB.exe
  C:\Windows\System32\mMtXDeB.exe
  2⤵
  PID:6264
- C:\Windows\System32\EMoCIKO.exe
  C:\Windows\System32\EMoCIKO.exe
  2⤵
  PID:6372
- C:\Windows\System32\LCruzSI.exe
  C:\Windows\System32\LCruzSI.exe
  2⤵
  PID:6552
- C:\Windows\System32\XFNDjex.exe
  C:\Windows\System32\XFNDjex.exe
  2⤵
  PID:6572
- C:\Windows\System32\mNpTWSi.exe
  C:\Windows\System32\mNpTWSi.exe
  2⤵
  PID:6628
- C:\Windows\System32\IvbYGZt.exe
  C:\Windows\System32\IvbYGZt.exe
  2⤵
  PID:6672
- C:\Windows\System32\BIUMywz.exe
  C:\Windows\System32\BIUMywz.exe
  2⤵
  PID:6772
- C:\Windows\System32\cFplVHa.exe
  C:\Windows\System32\cFplVHa.exe
  2⤵
  PID:6760
- C:\Windows\System32\xiMczRn.exe
  C:\Windows\System32\xiMczRn.exe
  2⤵
  PID:6892
- C:\Windows\System32\EZOSUDq.exe
  C:\Windows\System32\EZOSUDq.exe
  2⤵
  PID:6960
- C:\Windows\System32\EopCVJm.exe
  C:\Windows\System32\EopCVJm.exe
  2⤵
  PID:7068
- C:\Windows\System32\mogoPbg.exe
  C:\Windows\System32\mogoPbg.exe
  2⤵
  PID:7120
- C:\Windows\System32\pMqYDVc.exe
  C:\Windows\System32\pMqYDVc.exe
  2⤵
  PID:7116
- C:\Windows\System32\uRSfIYY.exe
  C:\Windows\System32\uRSfIYY.exe
  2⤵
  PID:7148
- C:\Windows\System32\ESBJpnH.exe
  C:\Windows\System32\ESBJpnH.exe
  2⤵
  PID:6248
- C:\Windows\System32\XNGKoZE.exe
  C:\Windows\System32\XNGKoZE.exe
  2⤵
  PID:6400
- C:\Windows\System32\AijXriN.exe
  C:\Windows\System32\AijXriN.exe
  2⤵
  PID:6492
- C:\Windows\System32\AmBascG.exe
  C:\Windows\System32\AmBascG.exe
  2⤵
  PID:6748
- C:\Windows\System32\ikjnnOh.exe
  C:\Windows\System32\ikjnnOh.exe
  2⤵
  PID:6804
- C:\Windows\System32\wPhhqda.exe
  C:\Windows\System32\wPhhqda.exe
  2⤵
  PID:6856
- C:\Windows\System32\OCaONcc.exe
  C:\Windows\System32\OCaONcc.exe
  2⤵
  PID:7136
- C:\Windows\System32\TPKaKRU.exe
  C:\Windows\System32\TPKaKRU.exe
  2⤵
  PID:6488
- C:\Windows\System32\ZJnzMCa.exe
  C:\Windows\System32\ZJnzMCa.exe
  2⤵
  PID:6676
- C:\Windows\System32\Mqlsqth.exe
  C:\Windows\System32\Mqlsqth.exe
  2⤵
  PID:6924
- C:\Windows\System32\QSVxeHe.exe
  C:\Windows\System32\QSVxeHe.exe
  2⤵
  PID:7048
- C:\Windows\System32\fxgifKn.exe
  C:\Windows\System32\fxgifKn.exe
  2⤵
  PID:7192
- C:\Windows\System32\JtYjYCO.exe
  C:\Windows\System32\JtYjYCO.exe
  2⤵
  PID:7208
- C:\Windows\System32\tUpMoNg.exe
  C:\Windows\System32\tUpMoNg.exe
  2⤵
  PID:7260
- C:\Windows\System32\eFePIgj.exe
  C:\Windows\System32\eFePIgj.exe
  2⤵
  PID:7284
- C:\Windows\System32\lBNqOKA.exe
  C:\Windows\System32\lBNqOKA.exe
  2⤵
  PID:7304
- C:\Windows\System32\pMxexgJ.exe
  C:\Windows\System32\pMxexgJ.exe
  2⤵
  PID:7328
- C:\Windows\System32\leKdpRC.exe
  C:\Windows\System32\leKdpRC.exe
  2⤵
  PID:7372
- C:\Windows\System32\UsZuTSX.exe
  C:\Windows\System32\UsZuTSX.exe
  2⤵
  PID:7396
- C:\Windows\System32\ojlANns.exe
  C:\Windows\System32\ojlANns.exe
  2⤵
  PID:7416
- C:\Windows\System32\LPiKxQk.exe
  C:\Windows\System32\LPiKxQk.exe
  2⤵
  PID:7444
- C:\Windows\System32\qPKbLBD.exe
  C:\Windows\System32\qPKbLBD.exe
  2⤵
  PID:7464
- C:\Windows\System32\YPaDaCw.exe
  C:\Windows\System32\YPaDaCw.exe
  2⤵
  PID:7512
- C:\Windows\System32\tItnoKn.exe
  C:\Windows\System32\tItnoKn.exe
  2⤵
  PID:7536
- C:\Windows\System32\NgkJjcz.exe
  C:\Windows\System32\NgkJjcz.exe
  2⤵
  PID:7564
- C:\Windows\System32\qPemSgY.exe
  C:\Windows\System32\qPemSgY.exe
  2⤵
  PID:7620
- C:\Windows\System32\JVLeNzF.exe
  C:\Windows\System32\JVLeNzF.exe
  2⤵
  PID:7636
- C:\Windows\System32\mWIJlwn.exe
  C:\Windows\System32\mWIJlwn.exe
  2⤵
  PID:7672
- C:\Windows\System32\uymivsb.exe
  C:\Windows\System32\uymivsb.exe
  2⤵
  PID:7696
- C:\Windows\System32\IWjmSUV.exe
  C:\Windows\System32\IWjmSUV.exe
  2⤵
  PID:7752
- C:\Windows\System32\GjEEjeM.exe
  C:\Windows\System32\GjEEjeM.exe
  2⤵
  PID:7768
- C:\Windows\System32\DxexKZV.exe
  C:\Windows\System32\DxexKZV.exe
  2⤵
  PID:7788
- C:\Windows\System32\BVRkObE.exe
  C:\Windows\System32\BVRkObE.exe
  2⤵
  PID:7808
- C:\Windows\System32\OMYVQiX.exe
  C:\Windows\System32\OMYVQiX.exe
  2⤵
  PID:7868
- C:\Windows\System32\nkSVAUj.exe
  C:\Windows\System32\nkSVAUj.exe
  2⤵
  PID:7900
- C:\Windows\System32\IrmfJkq.exe
  C:\Windows\System32\IrmfJkq.exe
  2⤵
  PID:7924
- C:\Windows\System32\GFMmgzK.exe
  C:\Windows\System32\GFMmgzK.exe
  2⤵
  PID:7940
- C:\Windows\System32\BiMXWhL.exe
  C:\Windows\System32\BiMXWhL.exe
  2⤵
  PID:7968
- C:\Windows\System32\UfLAMdm.exe
  C:\Windows\System32\UfLAMdm.exe
  2⤵
  PID:7988
- C:\Windows\System32\BLTUJLX.exe
  C:\Windows\System32\BLTUJLX.exe
  2⤵
  PID:8032
- C:\Windows\System32\JopscrZ.exe
  C:\Windows\System32\JopscrZ.exe
  2⤵
  PID:8064
- C:\Windows\System32\BfsLpYq.exe
  C:\Windows\System32\BfsLpYq.exe
  2⤵
  PID:8088
- C:\Windows\System32\cZygQqD.exe
  C:\Windows\System32\cZygQqD.exe
  2⤵
  PID:8124
- C:\Windows\System32\ZDwFqPU.exe
  C:\Windows\System32\ZDwFqPU.exe
  2⤵
  PID:8152
- C:\Windows\System32\tLVuGvB.exe
  C:\Windows\System32\tLVuGvB.exe
  2⤵
  PID:8172
- C:\Windows\System32\RoPkwbx.exe
  C:\Windows\System32\RoPkwbx.exe
  2⤵
  PID:6632
- C:\Windows\System32\EtcTdIt.exe
  C:\Windows\System32\EtcTdIt.exe
  2⤵
  PID:7180
- C:\Windows\System32\cysVSfJ.exe
  C:\Windows\System32\cysVSfJ.exe
  2⤵
  PID:7232
- C:\Windows\System32\hIemqDz.exe
  C:\Windows\System32\hIemqDz.exe
  2⤵
  PID:7300
- C:\Windows\System32\PJGorBz.exe
  C:\Windows\System32\PJGorBz.exe
  2⤵
  PID:7388
- C:\Windows\System32\ZmPNtOB.exe
  C:\Windows\System32\ZmPNtOB.exe
  2⤵
  PID:7476
- C:\Windows\System32\aDPXfnG.exe
  C:\Windows\System32\aDPXfnG.exe
  2⤵
  PID:7560
- C:\Windows\System32\ijpLpjD.exe
  C:\Windows\System32\ijpLpjD.exe
  2⤵
  PID:7584
- C:\Windows\System32\ePlHqNS.exe
  C:\Windows\System32\ePlHqNS.exe
  2⤵
  PID:7628
- C:\Windows\System32\QjIrOFU.exe
  C:\Windows\System32\QjIrOFU.exe
  2⤵
  PID:7680
- C:\Windows\System32\iQuaFCK.exe
  C:\Windows\System32\iQuaFCK.exe
  2⤵
  PID:7744
- C:\Windows\System32\vWfRhfH.exe
  C:\Windows\System32\vWfRhfH.exe
  2⤵
  PID:7844
- C:\Windows\System32\ZeBSecI.exe
  C:\Windows\System32\ZeBSecI.exe
  2⤵
  PID:7896
- C:\Windows\System32\qpDpvtB.exe
  C:\Windows\System32\qpDpvtB.exe
  2⤵
  PID:7936
- C:\Windows\System32\YDYCImq.exe
  C:\Windows\System32\YDYCImq.exe
  2⤵
  PID:8012
- C:\Windows\System32\LcfStDj.exe
  C:\Windows\System32\LcfStDj.exe
  2⤵
  PID:8084
- C:\Windows\System32\tHzjyxZ.exe
  C:\Windows\System32\tHzjyxZ.exe
  2⤵
  PID:8120
- C:\Windows\System32\nWzEObk.exe
  C:\Windows\System32\nWzEObk.exe
  2⤵
  PID:8164
- C:\Windows\System32\hpyLgbn.exe
  C:\Windows\System32\hpyLgbn.exe
  2⤵
  PID:7088
- C:\Windows\System32\wpxtBxP.exe
  C:\Windows\System32\wpxtBxP.exe
  2⤵
  PID:7336
- C:\Windows\System32\WnFjGEe.exe
  C:\Windows\System32\WnFjGEe.exe
  2⤵
  PID:7404
- C:\Windows\System32\swwCFnL.exe
  C:\Windows\System32\swwCFnL.exe
  2⤵
  PID:7576
- C:\Windows\System32\itaMJfb.exe
  C:\Windows\System32\itaMJfb.exe
  2⤵
  PID:7688
- C:\Windows\System32\nUIYhuU.exe
  C:\Windows\System32\nUIYhuU.exe
  2⤵
  PID:7804
- C:\Windows\System32\jTHMvXb.exe
  C:\Windows\System32\jTHMvXb.exe
  2⤵
  PID:7960
- C:\Windows\System32\WkvMiUd.exe
  C:\Windows\System32\WkvMiUd.exe
  2⤵
  PID:8116
- C:\Windows\System32\uvFpJPQ.exe
  C:\Windows\System32\uvFpJPQ.exe
  2⤵
  PID:7504
- C:\Windows\System32\FgHSreK.exe
  C:\Windows\System32\FgHSreK.exe
  2⤵
  PID:8024
- C:\Windows\System32\BYsfezI.exe
  C:\Windows\System32\BYsfezI.exe
  2⤵
  PID:8184
- C:\Windows\System32\UapNPsM.exe
  C:\Windows\System32\UapNPsM.exe
  2⤵
  PID:8200
- C:\Windows\System32\MANdero.exe
  C:\Windows\System32\MANdero.exe
  2⤵
  PID:8228
- C:\Windows\System32\AOpGTKZ.exe
  C:\Windows\System32\AOpGTKZ.exe
  2⤵
  PID:8252
- C:\Windows\System32\rERpTNU.exe
  C:\Windows\System32\rERpTNU.exe
  2⤵
  PID:8280
- C:\Windows\System32\nHVZBbQ.exe
  C:\Windows\System32\nHVZBbQ.exe
  2⤵
  PID:8296
- C:\Windows\System32\qOZsrzW.exe
  C:\Windows\System32\qOZsrzW.exe
  2⤵
  PID:8324
- C:\Windows\System32\WfJvtGO.exe
  C:\Windows\System32\WfJvtGO.exe
  2⤵
  PID:8384
- C:\Windows\System32\PbaXEYn.exe
  C:\Windows\System32\PbaXEYn.exe
  2⤵
  PID:8448
- C:\Windows\System32\LkTBvuJ.exe
  C:\Windows\System32\LkTBvuJ.exe
  2⤵
  PID:8476
- C:\Windows\System32\UaKKyAb.exe
  C:\Windows\System32\UaKKyAb.exe
  2⤵
  PID:8500
- C:\Windows\System32\kzupxeb.exe
  C:\Windows\System32\kzupxeb.exe
  2⤵
  PID:8520
- C:\Windows\System32\bPokoAq.exe
  C:\Windows\System32\bPokoAq.exe
  2⤵
  PID:8544
- C:\Windows\System32\hGaDecq.exe
  C:\Windows\System32\hGaDecq.exe
  2⤵
  PID:8588
- C:\Windows\System32\fzBJYia.exe
  C:\Windows\System32\fzBJYia.exe
  2⤵
  PID:8612
- C:\Windows\System32\RybcVwc.exe
  C:\Windows\System32\RybcVwc.exe
  2⤵
  PID:8632
- C:\Windows\System32\ZTMFCpm.exe
  C:\Windows\System32\ZTMFCpm.exe
  2⤵
  PID:8652
- C:\Windows\System32\tcBWAbA.exe
  C:\Windows\System32\tcBWAbA.exe
  2⤵
  PID:8696
- C:\Windows\System32\mlmNNhZ.exe
  C:\Windows\System32\mlmNNhZ.exe
  2⤵
  PID:8724
- C:\Windows\System32\MrRuXFO.exe
  C:\Windows\System32\MrRuXFO.exe
  2⤵
  PID:8752
- C:\Windows\System32\WNGswkC.exe
  C:\Windows\System32\WNGswkC.exe
  2⤵
  PID:8772
- C:\Windows\System32\ecDeZUb.exe
  C:\Windows\System32\ecDeZUb.exe
  2⤵
  PID:8816
- C:\Windows\System32\FlpclVU.exe
  C:\Windows\System32\FlpclVU.exe
  2⤵
  PID:8836
- C:\Windows\System32\RuXRkUu.exe
  C:\Windows\System32\RuXRkUu.exe
  2⤵
  PID:8852
- C:\Windows\System32\NjLXPYW.exe
  C:\Windows\System32\NjLXPYW.exe
  2⤵
  PID:8868
- C:\Windows\System32\HlUifEn.exe
  C:\Windows\System32\HlUifEn.exe
  2⤵
  PID:8908
- C:\Windows\System32\wyKftHx.exe
  C:\Windows\System32\wyKftHx.exe
  2⤵
  PID:8956
- C:\Windows\System32\pQUFlYH.exe
  C:\Windows\System32\pQUFlYH.exe
  2⤵
  PID:8984
- C:\Windows\System32\oVXoFuT.exe
  C:\Windows\System32\oVXoFuT.exe
  2⤵
  PID:9012
- C:\Windows\System32\AJEhSDE.exe
  C:\Windows\System32\AJEhSDE.exe
  2⤵
  PID:9040
- C:\Windows\System32\FReshoE.exe
  C:\Windows\System32\FReshoE.exe
  2⤵
  PID:9056
- C:\Windows\System32\fXkeDtp.exe
  C:\Windows\System32\fXkeDtp.exe
  2⤵
  PID:9084
- C:\Windows\System32\QcorIWo.exe
  C:\Windows\System32\QcorIWo.exe
  2⤵
  PID:9132
- C:\Windows\System32\yaJvkhR.exe
  C:\Windows\System32\yaJvkhR.exe
  2⤵
  PID:9156
- C:\Windows\System32\pkFYqif.exe
  C:\Windows\System32\pkFYqif.exe
  2⤵
  PID:9196
- C:\Windows\System32\HdOBOiJ.exe
  C:\Windows\System32\HdOBOiJ.exe
  2⤵
  PID:7984
- C:\Windows\System32\GwKITAW.exe
  C:\Windows\System32\GwKITAW.exe
  2⤵
  PID:8260
- C:\Windows\System32\HWFnMPp.exe
  C:\Windows\System32\HWFnMPp.exe
  2⤵
  PID:8340
- C:\Windows\System32\skryhNv.exe
  C:\Windows\System32\skryhNv.exe
  2⤵
  PID:8332
- C:\Windows\System32\jprxcRv.exe
  C:\Windows\System32\jprxcRv.exe
  2⤵
  PID:8416
- C:\Windows\System32\cYWiWWS.exe
  C:\Windows\System32\cYWiWWS.exe
  2⤵
  PID:8532
- C:\Windows\System32\NNmJjpF.exe
  C:\Windows\System32\NNmJjpF.exe
  2⤵
  PID:8572
- C:\Windows\System32\YUqOLVc.exe
  C:\Windows\System32\YUqOLVc.exe
  2⤵
  PID:8672
- C:\Windows\System32\BnfnbRF.exe
  C:\Windows\System32\BnfnbRF.exe
  2⤵
  PID:8788
- C:\Windows\System32\DywxhnD.exe
  C:\Windows\System32\DywxhnD.exe
  2⤵
  PID:8824
- C:\Windows\System32\hLwfzmA.exe
  C:\Windows\System32\hLwfzmA.exe
  2⤵
  PID:8900
- C:\Windows\System32\lBjtfJv.exe
  C:\Windows\System32\lBjtfJv.exe
  2⤵
  PID:9000
- C:\Windows\System32\iMYfDQl.exe
  C:\Windows\System32\iMYfDQl.exe
  2⤵
  PID:9052
- C:\Windows\System32\yuqyhFB.exe
  C:\Windows\System32\yuqyhFB.exe
  2⤵
  PID:9144
- C:\Windows\System32\ZIspCrA.exe
  C:\Windows\System32\ZIspCrA.exe
  2⤵
  PID:8292
- C:\Windows\System32\XgSRUVs.exe
  C:\Windows\System32\XgSRUVs.exe
  2⤵
  PID:8368
- C:\Windows\System32\YmiSWSX.exe
  C:\Windows\System32\YmiSWSX.exe
  2⤵
  PID:8336
- C:\Windows\System32\imlYvqn.exe
  C:\Windows\System32\imlYvqn.exe
  2⤵
  PID:8516
- C:\Windows\System32\DSrIKRu.exe
  C:\Windows\System32\DSrIKRu.exe
  2⤵
  PID:8708
- C:\Windows\System32\tmHtaAX.exe
  C:\Windows\System32\tmHtaAX.exe
  2⤵
  PID:8860
- C:\Windows\System32\RoYLEtD.exe
  C:\Windows\System32\RoYLEtD.exe
  2⤵
  PID:9148
- C:\Windows\System32\DbLdpIW.exe
  C:\Windows\System32\DbLdpIW.exe
  2⤵
  PID:9120
- C:\Windows\System32\hzYEyTd.exe
  C:\Windows\System32\hzYEyTd.exe
  2⤵
  PID:9024
- C:\Windows\System32\XvkWcmt.exe
  C:\Windows\System32\XvkWcmt.exe
  2⤵
  PID:9184
- C:\Windows\System32\DuyxIIc.exe
  C:\Windows\System32\DuyxIIc.exe
  2⤵
  PID:8320
- C:\Windows\System32\LcLNnUJ.exe
  C:\Windows\System32\LcLNnUJ.exe
  2⤵
  PID:9232
- C:\Windows\System32\mETwsEI.exe
  C:\Windows\System32\mETwsEI.exe
  2⤵
  PID:9256
- C:\Windows\System32\GEdRnXD.exe
  C:\Windows\System32\GEdRnXD.exe
  2⤵
  PID:9292
- C:\Windows\System32\KDdvGJL.exe
  C:\Windows\System32\KDdvGJL.exe
  2⤵
  PID:9316
- C:\Windows\System32\xAedflV.exe
  C:\Windows\System32\xAedflV.exe
  2⤵
  PID:9336
- C:\Windows\System32\ozyPPcK.exe
  C:\Windows\System32\ozyPPcK.exe
  2⤵
  PID:9376
- C:\Windows\System32\sXijiwk.exe
  C:\Windows\System32\sXijiwk.exe
  2⤵
  PID:9396
- C:\Windows\System32\CWCZvTq.exe
  C:\Windows\System32\CWCZvTq.exe
  2⤵
  PID:9416
- C:\Windows\System32\KIDUevh.exe
  C:\Windows\System32\KIDUevh.exe
  2⤵
  PID:9448
- C:\Windows\System32\wnQnbWD.exe
  C:\Windows\System32\wnQnbWD.exe
  2⤵
  PID:9468
- C:\Windows\System32\tcvYius.exe
  C:\Windows\System32\tcvYius.exe
  2⤵
  PID:9504
- C:\Windows\System32\MycKBzo.exe
  C:\Windows\System32\MycKBzo.exe
  2⤵
  PID:9548
- C:\Windows\System32\bjRmJIf.exe
  C:\Windows\System32\bjRmJIf.exe
  2⤵
  PID:9572
- C:\Windows\System32\DagNJkn.exe
  C:\Windows\System32\DagNJkn.exe
  2⤵
  PID:9592
- C:\Windows\System32\eyPYkWh.exe
  C:\Windows\System32\eyPYkWh.exe
  2⤵
  PID:9632
- C:\Windows\System32\AiuLPNU.exe
  C:\Windows\System32\AiuLPNU.exe
  2⤵
  PID:9660
- C:\Windows\System32\ApXWoeC.exe
  C:\Windows\System32\ApXWoeC.exe
  2⤵
  PID:9688
- C:\Windows\System32\iPpzwzv.exe
  C:\Windows\System32\iPpzwzv.exe
  2⤵
  PID:9716
- C:\Windows\System32\biTNsRq.exe
  C:\Windows\System32\biTNsRq.exe
  2⤵
  PID:9748
- C:\Windows\System32\OwvdCSV.exe
  C:\Windows\System32\OwvdCSV.exe
  2⤵
  PID:9768
- C:\Windows\System32\DejjPGN.exe
  C:\Windows\System32\DejjPGN.exe
  2⤵
  PID:9792
- C:\Windows\System32\udCUfej.exe
  C:\Windows\System32\udCUfej.exe
  2⤵
  PID:9816
- C:\Windows\System32\MXEcGKs.exe
  C:\Windows\System32\MXEcGKs.exe
  2⤵
  PID:9860
- C:\Windows\System32\FLPOZyu.exe
  C:\Windows\System32\FLPOZyu.exe
  2⤵
  PID:9896
- C:\Windows\System32\ptuPBOM.exe
  C:\Windows\System32\ptuPBOM.exe
  2⤵
  PID:9916
- C:\Windows\System32\ovVogSk.exe
  C:\Windows\System32\ovVogSk.exe
  2⤵
  PID:9936
- C:\Windows\System32\gOpcHkv.exe
  C:\Windows\System32\gOpcHkv.exe
  2⤵
  PID:9984
- C:\Windows\System32\nbLndTv.exe
  C:\Windows\System32\nbLndTv.exe
  2⤵
  PID:10008
- C:\Windows\System32\mwmwySj.exe
  C:\Windows\System32\mwmwySj.exe
  2⤵
  PID:10024
- C:\Windows\System32\lfwEevz.exe
  C:\Windows\System32\lfwEevz.exe
  2⤵
  PID:10044
- C:\Windows\System32\DLpfeuP.exe
  C:\Windows\System32\DLpfeuP.exe
  2⤵
  PID:10092
- C:\Windows\System32\XpknLyT.exe
  C:\Windows\System32\XpknLyT.exe
  2⤵
  PID:10116
- C:\Windows\System32\hBoumnW.exe
  C:\Windows\System32\hBoumnW.exe
  2⤵
  PID:10164
- C:\Windows\System32\nCRCkKo.exe
  C:\Windows\System32\nCRCkKo.exe
  2⤵
  PID:10180
- C:\Windows\System32\KJYFVDd.exe
  C:\Windows\System32\KJYFVDd.exe
  2⤵
  PID:10196
- C:\Windows\System32\rvJdNVi.exe
  C:\Windows\System32\rvJdNVi.exe
  2⤵
  PID:10220
- C:\Windows\System32\WoxvkgV.exe
  C:\Windows\System32\WoxvkgV.exe
  2⤵
  PID:10236
- C:\Windows\System32\NfOnnZf.exe
  C:\Windows\System32\NfOnnZf.exe
  2⤵
  PID:9240
- C:\Windows\System32\EAeCaxo.exe
  C:\Windows\System32\EAeCaxo.exe
  2⤵
  PID:9328
- C:\Windows\System32\JaMHHSD.exe
  C:\Windows\System32\JaMHHSD.exe
  2⤵
  PID:9456
- C:\Windows\System32\sFbaRXe.exe
  C:\Windows\System32\sFbaRXe.exe
  2⤵
  PID:9524
- C:\Windows\System32\qSuzhnW.exe
  C:\Windows\System32\qSuzhnW.exe
  2⤵
  PID:9560
- C:\Windows\System32\ZqgRoiu.exe
  C:\Windows\System32\ZqgRoiu.exe
  2⤵
  PID:9656
- C:\Windows\System32\SnTAUpf.exe
  C:\Windows\System32\SnTAUpf.exe
  2⤵
  PID:9708
- C:\Windows\System32\slRhkxH.exe
  C:\Windows\System32\slRhkxH.exe
  2⤵
  PID:9776
- C:\Windows\System32\uhcOjuZ.exe
  C:\Windows\System32\uhcOjuZ.exe
  2⤵
  PID:9904
- C:\Windows\System32\koVeQMJ.exe
  C:\Windows\System32\koVeQMJ.exe
  2⤵
  PID:2400
- C:\Windows\System32\SdhIrkK.exe
  C:\Windows\System32\SdhIrkK.exe
  2⤵
  PID:9932
- C:\Windows\System32\RqZMCYR.exe
  C:\Windows\System32\RqZMCYR.exe
  2⤵
  PID:9972
- C:\Windows\System32\oSLahfx.exe
  C:\Windows\System32\oSLahfx.exe
  2⤵
  PID:4796
- C:\Windows\System32\dqSeYvZ.exe
  C:\Windows\System32\dqSeYvZ.exe
  2⤵
  PID:10088
- C:\Windows\System32\qjYnosK.exe
  C:\Windows\System32\qjYnosK.exe
  2⤵
  PID:10104
- C:\Windows\System32\GcaGtqA.exe
  C:\Windows\System32\GcaGtqA.exe
  2⤵
  PID:9284
- C:\Windows\System32\UlPeMnn.exe
  C:\Windows\System32\UlPeMnn.exe
  2⤵
  PID:9276
- C:\Windows\System32\xLotWYk.exe
  C:\Windows\System32\xLotWYk.exe
  2⤵
  PID:9436
- C:\Windows\System32\NGImcGo.exe
  C:\Windows\System32\NGImcGo.exe
  2⤵
  PID:9584
- C:\Windows\System32\YWFmQhE.exe
  C:\Windows\System32\YWFmQhE.exe
  2⤵
  PID:9736
- C:\Windows\System32\rEwYDkS.exe
  C:\Windows\System32\rEwYDkS.exe
  2⤵
  PID:5572
- C:\Windows\System32\bbmQMge.exe
  C:\Windows\System32\bbmQMge.exe
  2⤵
  PID:9880
- C:\Windows\System32\XYdyjgD.exe
  C:\Windows\System32\XYdyjgD.exe
  2⤵
  PID:10020
- C:\Windows\System32\wWOiGNU.exe
  C:\Windows\System32\wWOiGNU.exe
  2⤵
  PID:9224
- C:\Windows\System32\nThuWZz.exe
  C:\Windows\System32\nThuWZz.exe
  2⤵
  PID:9564
- C:\Windows\System32\bwFXPda.exe
  C:\Windows\System32\bwFXPda.exe
  2⤵
  PID:9848
- C:\Windows\System32\PXVNMaz.exe
  C:\Windows\System32\PXVNMaz.exe
  2⤵
  PID:8924
- C:\Windows\System32\pOVIHDK.exe
  C:\Windows\System32\pOVIHDK.exe
  2⤵
  PID:9460
- C:\Windows\System32\sCwxzhh.exe
  C:\Windows\System32\sCwxzhh.exe
  2⤵
  PID:10204
- C:\Windows\System32\fefswBn.exe
  C:\Windows\System32\fefswBn.exe
  2⤵
  PID:10264
- C:\Windows\System32\kDZZMef.exe
  C:\Windows\System32\kDZZMef.exe
  2⤵
  PID:10284
- C:\Windows\System32\dfBTVME.exe
  C:\Windows\System32\dfBTVME.exe
  2⤵
  PID:10300
- C:\Windows\System32\upWOJak.exe
  C:\Windows\System32\upWOJak.exe
  2⤵
  PID:10336
- C:\Windows\System32\DnPZvCe.exe
  C:\Windows\System32\DnPZvCe.exe
  2⤵
  PID:10388
- C:\Windows\System32\ocbXZhJ.exe
  C:\Windows\System32\ocbXZhJ.exe
  2⤵
  PID:10408
- C:\Windows\System32\OlbJHMt.exe
  C:\Windows\System32\OlbJHMt.exe
  2⤵
  PID:10444
- C:\Windows\System32\cObtfSn.exe
  C:\Windows\System32\cObtfSn.exe
  2⤵
  PID:10468
- C:\Windows\System32\IyLKxon.exe
  C:\Windows\System32\IyLKxon.exe
  2⤵
  PID:10496
- C:\Windows\System32\IiwbLzC.exe
  C:\Windows\System32\IiwbLzC.exe
  2⤵
  PID:10524
- C:\Windows\System32\zOhTDBt.exe
  C:\Windows\System32\zOhTDBt.exe
  2⤵
  PID:10548
- C:\Windows\System32\xEvTLNB.exe
  C:\Windows\System32\xEvTLNB.exe
  2⤵
  PID:10576
- C:\Windows\System32\lOppsxo.exe
  C:\Windows\System32\lOppsxo.exe
  2⤵
  PID:10592
- C:\Windows\System32\TTyVtAT.exe
  C:\Windows\System32\TTyVtAT.exe
  2⤵
  PID:10616
- C:\Windows\System32\fPljDaN.exe
  C:\Windows\System32\fPljDaN.exe
  2⤵
  PID:10664
- C:\Windows\System32\FPJeKCq.exe
  C:\Windows\System32\FPJeKCq.exe
  2⤵
  PID:10680
- C:\Windows\System32\rKLvyKN.exe
  C:\Windows\System32\rKLvyKN.exe
  2⤵
  PID:10716
- C:\Windows\System32\IQyYnQS.exe
  C:\Windows\System32\IQyYnQS.exe
  2⤵
  PID:10744
- C:\Windows\System32\RUNsqIv.exe
  C:\Windows\System32\RUNsqIv.exe
  2⤵
  PID:10776
- C:\Windows\System32\fVUgsQm.exe
  C:\Windows\System32\fVUgsQm.exe
  2⤵
  PID:10800
- C:\Windows\System32\azuDtcl.exe
  C:\Windows\System32\azuDtcl.exe
  2⤵
  PID:10832
- C:\Windows\System32\SlJJsYd.exe
  C:\Windows\System32\SlJJsYd.exe
  2⤵
  PID:10852
- C:\Windows\System32\mhxYZSV.exe
  C:\Windows\System32\mhxYZSV.exe
  2⤵
  PID:10904
- C:\Windows\System32\GFAlPBw.exe
  C:\Windows\System32\GFAlPBw.exe
  2⤵
  PID:10932
- C:\Windows\System32\voDmRdn.exe
  C:\Windows\System32\voDmRdn.exe
  2⤵
  PID:10956
- C:\Windows\System32\OJBrhJd.exe
  C:\Windows\System32\OJBrhJd.exe
  2⤵
  PID:10976
- C:\Windows\System32\qcdFHoa.exe
  C:\Windows\System32\qcdFHoa.exe
  2⤵
  PID:11024
- C:\Windows\System32\AJunrMb.exe
  C:\Windows\System32\AJunrMb.exe
  2⤵
  PID:11044
- C:\Windows\System32\VLImAez.exe
  C:\Windows\System32\VLImAez.exe
  2⤵
  PID:11060
- C:\Windows\System32\fdkNZYl.exe
  C:\Windows\System32\fdkNZYl.exe
  2⤵
  PID:11088
- C:\Windows\System32\bpbhvxp.exe
  C:\Windows\System32\bpbhvxp.exe
  2⤵
  PID:11120
- C:\Windows\System32\VmtGctq.exe
  C:\Windows\System32\VmtGctq.exe
  2⤵
  PID:11152
- C:\Windows\System32\zdjEjFP.exe
  C:\Windows\System32\zdjEjFP.exe
  2⤵
  PID:11180
- C:\Windows\System32\rrAbmEK.exe
  C:\Windows\System32\rrAbmEK.exe
  2⤵
  PID:11204
- C:\Windows\System32\jaOjAvf.exe
  C:\Windows\System32\jaOjAvf.exe
  2⤵
  PID:11232
- C:\Windows\System32\eBAJxBp.exe
  C:\Windows\System32\eBAJxBp.exe
  2⤵
  PID:10212
- C:\Windows\System32\DqPsAxT.exe
  C:\Windows\System32\DqPsAxT.exe
  2⤵
  PID:10248
- C:\Windows\System32\ayVhVqz.exe
  C:\Windows\System32\ayVhVqz.exe
  2⤵
  PID:10372
- C:\Windows\System32\mWqxOaj.exe
  C:\Windows\System32\mWqxOaj.exe
  2⤵
  PID:10416
- C:\Windows\System32\zszinvu.exe
  C:\Windows\System32\zszinvu.exe
  2⤵
  PID:10460
- C:\Windows\System32\bxTCDBc.exe
  C:\Windows\System32\bxTCDBc.exe
  2⤵
  PID:10564
- C:\Windows\System32\OlgSYcb.exe
  C:\Windows\System32\OlgSYcb.exe
  2⤵
  PID:10588
- C:\Windows\System32\QdluuwK.exe
  C:\Windows\System32\QdluuwK.exe
  2⤵
  PID:10308
- C:\Windows\System32\kBoljHC.exe
  C:\Windows\System32\kBoljHC.exe
  2⤵
  PID:10652
- C:\Windows\System32\UfFFeHD.exe
  C:\Windows\System32\UfFFeHD.exe
  2⤵
  PID:10704
- C:\Windows\System32\XOPPsgs.exe
  C:\Windows\System32\XOPPsgs.exe
  2⤵
  PID:10796
- C:\Windows\System32\QqcZjLO.exe
  C:\Windows\System32\QqcZjLO.exe
  2⤵
  PID:10916
- C:\Windows\System32\nUnVMAJ.exe
  C:\Windows\System32\nUnVMAJ.exe
  2⤵
  PID:10972
- C:\Windows\System32\WwDYIAP.exe
  C:\Windows\System32\WwDYIAP.exe
  2⤵
  PID:11056
- C:\Windows\System32\zypAEKL.exe
  C:\Windows\System32\zypAEKL.exe
  2⤵
  PID:11108
- C:\Windows\System32\BJjJCgU.exe
  C:\Windows\System32\BJjJCgU.exe
  2⤵
  PID:11172
- C:\Windows\System32\sKAEhyO.exe
  C:\Windows\System32\sKAEhyO.exe
  2⤵
  PID:11220
- C:\Windows\System32\ONmPZpX.exe
  C:\Windows\System32\ONmPZpX.exe
  2⤵
  PID:10296
- C:\Windows\System32\cqHVwGE.exe
  C:\Windows\System32\cqHVwGE.exe
  2⤵
  PID:10400
- C:\Windows\System32\bibSIHi.exe
  C:\Windows\System32\bibSIHi.exe
  2⤵
  PID:10480
- C:\Windows\System32\WlxMZbB.exe
  C:\Windows\System32\WlxMZbB.exe
  2⤵
  PID:10784
- C:\Windows\System32\pJsJhzx.exe
  C:\Windows\System32\pJsJhzx.exe
  2⤵
  PID:10880
- C:\Windows\System32\WoBvxJP.exe
  C:\Windows\System32\WoBvxJP.exe
  2⤵
  PID:11012
- C:\Windows\System32\QTdejmh.exe
  C:\Windows\System32\QTdejmh.exe
  2⤵
  PID:11080
- C:\Windows\System32\eooHZeG.exe
  C:\Windows\System32\eooHZeG.exe
  2⤵
  PID:11188
- C:\Windows\System32\nofEfdl.exe
  C:\Windows\System32\nofEfdl.exe
  2⤵
  PID:10540
- C:\Windows\System32\BODlewc.exe
  C:\Windows\System32\BODlewc.exe
  2⤵
  PID:10888
- C:\Windows\System32\XIeYpZn.exe
  C:\Windows\System32\XIeYpZn.exe
  2⤵
  PID:10608
- C:\Windows\System32\qzddDXA.exe
  C:\Windows\System32\qzddDXA.exe
  2⤵
  PID:10632
- C:\Windows\System32\qwYPAzq.exe
  C:\Windows\System32\qwYPAzq.exe
  2⤵
  PID:11280
- C:\Windows\System32\sozxwyL.exe
  C:\Windows\System32\sozxwyL.exe
  2⤵
  PID:11312
- C:\Windows\System32\vNDcBvd.exe
  C:\Windows\System32\vNDcBvd.exe
  2⤵
  PID:11356
- C:\Windows\System32\pLEjXTC.exe
  C:\Windows\System32\pLEjXTC.exe
  2⤵
  PID:11372
- C:\Windows\System32\BHozVka.exe
  C:\Windows\System32\BHozVka.exe
  2⤵
  PID:11392
- C:\Windows\System32\gtNNQvG.exe
  C:\Windows\System32\gtNNQvG.exe
  2⤵
  PID:11412
- C:\Windows\System32\brdzckm.exe
  C:\Windows\System32\brdzckm.exe
  2⤵
  PID:11436
- C:\Windows\System32\PEGOXiO.exe
  C:\Windows\System32\PEGOXiO.exe
  2⤵
  PID:11456
- C:\Windows\System32\laRNycx.exe
  C:\Windows\System32\laRNycx.exe
  2⤵
  PID:11516
- C:\Windows\System32\onzJQpI.exe
  C:\Windows\System32\onzJQpI.exe
  2⤵
  PID:11532
- C:\Windows\System32\GvlBBKN.exe
  C:\Windows\System32\GvlBBKN.exe
  2⤵
  PID:11560
- C:\Windows\System32\jKAbssP.exe
  C:\Windows\System32\jKAbssP.exe
  2⤵
  PID:11588
- C:\Windows\System32\eIWWVoa.exe
  C:\Windows\System32\eIWWVoa.exe
  2⤵
  PID:11604
- C:\Windows\System32\xMuDFbQ.exe
  C:\Windows\System32\xMuDFbQ.exe
  2⤵
  PID:11636
- C:\Windows\System32\KFxMBIE.exe
  C:\Windows\System32\KFxMBIE.exe
  2⤵
  PID:11684
- C:\Windows\System32\cqlFWGH.exe
  C:\Windows\System32\cqlFWGH.exe
  2⤵
  PID:11712
- C:\Windows\System32\NKVmkaZ.exe
  C:\Windows\System32\NKVmkaZ.exe
  2⤵
  PID:11740
- C:\Windows\System32\UTjYarI.exe
  C:\Windows\System32\UTjYarI.exe
  2⤵
  PID:11756
- C:\Windows\System32\hQkiCjL.exe
  C:\Windows\System32\hQkiCjL.exe
  2⤵
  PID:11792
- C:\Windows\System32\HXAJhld.exe
  C:\Windows\System32\HXAJhld.exe
  2⤵
  PID:11824
- C:\Windows\System32\vehekzd.exe
  C:\Windows\System32\vehekzd.exe
  2⤵
  PID:11848
- C:\Windows\System32\BNAoMXm.exe
  C:\Windows\System32\BNAoMXm.exe
  2⤵
  PID:11868
- C:\Windows\System32\LiyzRWv.exe
  C:\Windows\System32\LiyzRWv.exe
  2⤵
  PID:11908
- C:\Windows\System32\eZDrEBt.exe
  C:\Windows\System32\eZDrEBt.exe
  2⤵
  PID:11932
- C:\Windows\System32\JqQmFBC.exe
  C:\Windows\System32\JqQmFBC.exe
  2⤵
  PID:11952
- C:\Windows\System32\qshxJGY.exe
  C:\Windows\System32\qshxJGY.exe
  2⤵
  PID:11992
- C:\Windows\System32\CzMitgU.exe
  C:\Windows\System32\CzMitgU.exe
  2⤵
  PID:12012
- C:\Windows\System32\MPXtIgX.exe
  C:\Windows\System32\MPXtIgX.exe
  2⤵
  PID:12032
- C:\Windows\System32\ROcxbjx.exe
  C:\Windows\System32\ROcxbjx.exe
  2⤵
  PID:12056
- C:\Windows\System32\fwxvJzI.exe
  C:\Windows\System32\fwxvJzI.exe
  2⤵
  PID:12080
- C:\Windows\System32\apdmPDx.exe
  C:\Windows\System32\apdmPDx.exe
  2⤵
  PID:12100
- C:\Windows\System32\jRqGlpD.exe
  C:\Windows\System32\jRqGlpD.exe
  2⤵
  PID:12128
- C:\Windows\System32\OlRlRqh.exe
  C:\Windows\System32\OlRlRqh.exe
  2⤵
  PID:12156
- C:\Windows\System32\xlJFHFO.exe
  C:\Windows\System32\xlJFHFO.exe
  2⤵
  PID:12192
- C:\Windows\System32\PDaaqbb.exe
  C:\Windows\System32\PDaaqbb.exe
  2⤵
  PID:12224
- C:\Windows\System32\LzxNnrP.exe
  C:\Windows\System32\LzxNnrP.exe
  2⤵
  PID:10356
- C:\Windows\System32\QqlWnyU.exe
  C:\Windows\System32\QqlWnyU.exe
  2⤵
  PID:11292
- C:\Windows\System32\KIHrkue.exe
  C:\Windows\System32\KIHrkue.exe
  2⤵
  PID:11324
- C:\Windows\System32\CccqyWs.exe
  C:\Windows\System32\CccqyWs.exe
  2⤵
  PID:11404
- C:\Windows\System32\rNYlrsw.exe
  C:\Windows\System32\rNYlrsw.exe
  2⤵
  PID:11500
- C:\Windows\System32\agwAoiy.exe
  C:\Windows\System32\agwAoiy.exe
  2⤵
  PID:11512
- C:\Windows\System32\rQEhztD.exe
  C:\Windows\System32\rQEhztD.exe
  2⤵
  PID:11612
- C:\Windows\System32\uYpQxPS.exe
  C:\Windows\System32\uYpQxPS.exe
  2⤵
  PID:11652
- C:\Windows\System32\DKuaNJa.exe
  C:\Windows\System32\DKuaNJa.exe
  2⤵
  PID:11752
- C:\Windows\System32\KEsUFCY.exe
  C:\Windows\System32\KEsUFCY.exe
  2⤵
  PID:11768
- C:\Windows\System32\PlerOQg.exe
  C:\Windows\System32\PlerOQg.exe
  2⤵
  PID:11820
- C:\Windows\System32\QXlkHhI.exe
  C:\Windows\System32\QXlkHhI.exe
  2⤵
  PID:11904
- C:\Windows\System32\aUjoMyr.exe
  C:\Windows\System32\aUjoMyr.exe
  2⤵
  PID:11972
- C:\Windows\System32\gbSMfzc.exe
  C:\Windows\System32\gbSMfzc.exe
  2⤵
  PID:12072
- C:\Windows\System32\RfdYPjo.exe
  C:\Windows\System32\RfdYPjo.exe
  2⤵
  PID:12120
- C:\Windows\System32\jNsZAPz.exe
  C:\Windows\System32\jNsZAPz.exe
  2⤵
  PID:12184
- C:\Windows\System32\CgEQFgJ.exe
  C:\Windows\System32\CgEQFgJ.exe
  2⤵
  PID:12204
- C:\Windows\System32\rxJqamn.exe
  C:\Windows\System32\rxJqamn.exe
  2⤵
  PID:11468
- C:\Windows\System32\TwdvYPC.exe
  C:\Windows\System32\TwdvYPC.exe
  2⤵
  PID:11556
- C:\Windows\System32\DoHbPfk.exe
  C:\Windows\System32\DoHbPfk.exe
  2⤵
  PID:11672
- C:\Windows\System32\pNPzdPh.exe
  C:\Windows\System32\pNPzdPh.exe
  2⤵
  PID:11816
- C:\Windows\System32\FMwElYx.exe
  C:\Windows\System32\FMwElYx.exe
  2⤵
  PID:11964
- C:\Windows\System32\LdeZthH.exe
  C:\Windows\System32\LdeZthH.exe
  2⤵
  PID:12068
- C:\Windows\System32\PQkzaLf.exe
  C:\Windows\System32\PQkzaLf.exe
  2⤵
  PID:12284
- C:\Windows\System32\jhOxkdg.exe
  C:\Windows\System32\jhOxkdg.exe
  2⤵
  PID:11552
- C:\Windows\System32\dSQlZCm.exe
  C:\Windows\System32\dSQlZCm.exe
  2⤵
  PID:11808
- C:\Windows\System32\CQtosPb.exe
  C:\Windows\System32\CQtosPb.exe
  2⤵
  PID:11428
- C:\Windows\System32\OHoeLGZ.exe
  C:\Windows\System32\OHoeLGZ.exe
  2⤵
  PID:12144
- C:\Windows\System32\jjGNVFy.exe
  C:\Windows\System32\jjGNVFy.exe
  2⤵
  PID:12304
- C:\Windows\System32\BfDVLTy.exe
  C:\Windows\System32\BfDVLTy.exe
  2⤵
  PID:12332
- C:\Windows\System32\YNHzQNY.exe
  C:\Windows\System32\YNHzQNY.exe
  2⤵
  PID:12352
- C:\Windows\System32\ltaphjV.exe
  C:\Windows\System32\ltaphjV.exe
  2⤵
  PID:12372
- C:\Windows\System32\kuMScKI.exe
  C:\Windows\System32\kuMScKI.exe
  2⤵
  PID:12396
- C:\Windows\System32\OxRgJXI.exe
  C:\Windows\System32\OxRgJXI.exe
  2⤵
  PID:12416
- C:\Windows\System32\YZzfjyK.exe
  C:\Windows\System32\YZzfjyK.exe
  2⤵
  PID:12436
- C:\Windows\System32\qRGLEKf.exe
  C:\Windows\System32\qRGLEKf.exe
  2⤵
  PID:12504
- C:\Windows\System32\JdBLtQn.exe
  C:\Windows\System32\JdBLtQn.exe
  2⤵
  PID:12532
- C:\Windows\System32\PFVmbfk.exe
  C:\Windows\System32\PFVmbfk.exe
  2⤵
  PID:12560
- C:\Windows\System32\iUUpxBG.exe
  C:\Windows\System32\iUUpxBG.exe
  2⤵
  PID:12580
- C:\Windows\System32\YPtWpwv.exe
  C:\Windows\System32\YPtWpwv.exe
  2⤵
  PID:12608
- C:\Windows\System32\zZXxxWi.exe
  C:\Windows\System32\zZXxxWi.exe
  2⤵
  PID:12632
- C:\Windows\System32\eYgjTUt.exe
  C:\Windows\System32\eYgjTUt.exe
  2⤵
  PID:12672
- C:\Windows\System32\XOvopEo.exe
  C:\Windows\System32\XOvopEo.exe
  2⤵
  PID:12712
- C:\Windows\System32\HsHALqw.exe
  C:\Windows\System32\HsHALqw.exe
  2⤵
  PID:12728
- C:\Windows\System32\FoJUyaC.exe
  C:\Windows\System32\FoJUyaC.exe
  2⤵
  PID:12752
- C:\Windows\System32\wTtjtcJ.exe
  C:\Windows\System32\wTtjtcJ.exe
  2⤵
  PID:12772
- C:\Windows\System32\ZYliFGR.exe
  C:\Windows\System32\ZYliFGR.exe
  2⤵
  PID:12800
- C:\Windows\System32\hHDKuyV.exe
  C:\Windows\System32\hHDKuyV.exe
  2⤵
  PID:12824
- C:\Windows\System32\jNPIpcQ.exe
  C:\Windows\System32\jNPIpcQ.exe
  2⤵
  PID:12848
- C:\Windows\System32\PQDMNyz.exe
  C:\Windows\System32\PQDMNyz.exe
  2⤵
  PID:12880
- C:\Windows\System32\fJDHFeJ.exe
  C:\Windows\System32\fJDHFeJ.exe
  2⤵
  PID:12916
- C:\Windows\System32\OvlzboB.exe
  C:\Windows\System32\OvlzboB.exe
  2⤵
  PID:12940
- C:\Windows\System32\WsPveJd.exe
  C:\Windows\System32\WsPveJd.exe
  2⤵
  PID:12960
- C:\Windows\System32\XFvzFsa.exe
  C:\Windows\System32\XFvzFsa.exe
  2⤵
  PID:13012
- C:\Windows\System32\rDTojem.exe
  C:\Windows\System32\rDTojem.exe
  2⤵
  PID:13036
- C:\Windows\System32\BtHWhMn.exe
  C:\Windows\System32\BtHWhMn.exe
  2⤵
  PID:13060
- C:\Windows\System32\hftUQLo.exe
  C:\Windows\System32\hftUQLo.exe
  2⤵
  PID:13096
- C:\Windows\System32\KTAEXQF.exe
  C:\Windows\System32\KTAEXQF.exe
  2⤵
  PID:13120
- C:\Windows\System32\edBMOKa.exe
  C:\Windows\System32\edBMOKa.exe
  2⤵
  PID:13156
- C:\Windows\System32\azIpXPo.exe
  C:\Windows\System32\azIpXPo.exe
  2⤵
  PID:13184
- C:\Windows\System32\zOnBHah.exe
  C:\Windows\System32\zOnBHah.exe
  2⤵
  PID:13220
- C:\Windows\System32\bTlfCJL.exe
  C:\Windows\System32\bTlfCJL.exe
  2⤵
  PID:13236
- C:\Windows\System32\MSVCyFH.exe
  C:\Windows\System32\MSVCyFH.exe
  2⤵
  PID:13272
- C:\Windows\System32\WHXNlvq.exe
  C:\Windows\System32\WHXNlvq.exe
  2⤵
  PID:13300
- C:\Windows\System32\BTkeXQl.exe
  C:\Windows\System32\BTkeXQl.exe
  2⤵
  PID:12292
- C:\Windows\System32\BeaXnYn.exe
  C:\Windows\System32\BeaXnYn.exe
  2⤵
  PID:12348
- C:\Windows\System32\VRZUBIm.exe
  C:\Windows\System32\VRZUBIm.exe
  2⤵
  PID:12364
- C:\Windows\System32\jLDNVSs.exe
  C:\Windows\System32\jLDNVSs.exe
  2⤵
  PID:12520
- C:\Windows\System32\zFNsbJQ.exe
  C:\Windows\System32\zFNsbJQ.exe
  2⤵
  PID:12572
- C:\Windows\System32\PILPQbF.exe
  C:\Windows\System32\PILPQbF.exe
  2⤵
  PID:12680
- C:\Windows\System32\GvGWhlH.exe
  C:\Windows\System32\GvGWhlH.exe
  2⤵
  PID:12720
- C:\Windows\System32\LpxluvS.exe
  C:\Windows\System32\LpxluvS.exe
  2⤵
  PID:12764
- C:\Windows\System32\AMacLDf.exe
  C:\Windows\System32\AMacLDf.exe
  2⤵
  PID:12864
- C:\Windows\System32\wYIuRnC.exe
  C:\Windows\System32\wYIuRnC.exe
  2⤵
  PID:3372
- C:\Windows\System32\xDwSuIj.exe
  C:\Windows\System32\xDwSuIj.exe
  2⤵
  PID:1316
- C:\Windows\System32\yZcwuKZ.exe
  C:\Windows\System32\yZcwuKZ.exe
  2⤵
  PID:12936
- C:\Windows\System32\bPjbRdT.exe
  C:\Windows\System32\bPjbRdT.exe
  2⤵
  PID:12988
- C:\Windows\System32\Qijemhe.exe
  C:\Windows\System32\Qijemhe.exe
  2⤵
  PID:13072
- C:\Windows\System32\EgDARHe.exe
  C:\Windows\System32\EgDARHe.exe
  2⤵
  PID:13132
- C:\Windows\System32\sHxPkbx.exe
  C:\Windows\System32\sHxPkbx.exe
  2⤵
  PID:13208
- C:\Windows\System32\xihiQgR.exe
  C:\Windows\System32\xihiQgR.exe
  2⤵
  PID:13228
- C:\Windows\System32\qMbonjS.exe
  C:\Windows\System32\qMbonjS.exe
  2⤵
  PID:12296
- C:\Windows\System32\pUEuyMi.exe
  C:\Windows\System32\pUEuyMi.exe
  2⤵
  PID:12432
- C:\Windows\System32\IpBSlji.exe
  C:\Windows\System32\IpBSlji.exe
  2⤵
  PID:12696
- C:\Windows\System32\OTQlVks.exe
  C:\Windows\System32\OTQlVks.exe
  2⤵
  PID:12896
- C:\Windows\System32\ebpgUMF.exe
  C:\Windows\System32\ebpgUMF.exe
  2⤵
  PID:1668
- C:\Windows\System32\lXFCdUU.exe
  C:\Windows\System32\lXFCdUU.exe
  2⤵
  PID:12984
- C:\Windows\System32\umznKWY.exe
  C:\Windows\System32\umznKWY.exe
  2⤵
  PID:13108
- C:\Windows\System32\pWVtdjr.exe
  C:\Windows\System32\pWVtdjr.exe
  2⤵
  PID:13180
- C:\Windows\System32\numRQHq.exe
  C:\Windows\System32\numRQHq.exe
  2⤵
  PID:12604
- C:\Windows\System32\nRUfcPc.exe
  C:\Windows\System32\nRUfcPc.exe
  2⤵
  PID:3752
- C:\Windows\System32\Dntyjtv.exe
  C:\Windows\System32\Dntyjtv.exe
  2⤵
  PID:13168
- C:\Windows\System32\fGPELoi.exe
  C:\Windows\System32\fGPELoi.exe
  2⤵
  PID:3392
- C:\Windows\System32\SjbsZZe.exe
  C:\Windows\System32\SjbsZZe.exe
  2⤵
  PID:12768
- C:\Windows\System32\VLqqfyM.exe
  C:\Windows\System32\VLqqfyM.exe
  2⤵
  PID:13288
- C:\Windows\System32\GoxqrAy.exe
  C:\Windows\System32\GoxqrAy.exe
  2⤵
  PID:13352
- C:\Windows\System32\dtiigUu.exe
  C:\Windows\System32\dtiigUu.exe
  2⤵
  PID:13392
- C:\Windows\System32\etbFtbU.exe
  C:\Windows\System32\etbFtbU.exe
  2⤵
  PID:13420
- C:\Windows\System32\ufwUYOr.exe
  C:\Windows\System32\ufwUYOr.exe
  2⤵
  PID:13440
- C:\Windows\System32\NUBRLrw.exe
  C:\Windows\System32\NUBRLrw.exe
  2⤵
  PID:13468
- C:\Windows\System32\esBcoFW.exe
  C:\Windows\System32\esBcoFW.exe
  2⤵
  PID:13484
- C:\Windows\System32\yWHUzdO.exe
  C:\Windows\System32\yWHUzdO.exe
  2⤵
  PID:13512
- C:\Windows\System32\RabrtNh.exe
  C:\Windows\System32\RabrtNh.exe
  2⤵
  PID:13584
- C:\Windows\System32\BherqGD.exe
  C:\Windows\System32\BherqGD.exe
  2⤵
  PID:13608
- C:\Windows\System32\cJcckbU.exe
  C:\Windows\System32\cJcckbU.exe
  2⤵
  PID:13640
- C:\Windows\System32\ZcBPalD.exe
  C:\Windows\System32\ZcBPalD.exe
  2⤵
  PID:13664
- C:\Windows\System32\vIbFjlR.exe
  C:\Windows\System32\vIbFjlR.exe
  2⤵
  PID:13688
- C:\Windows\System32\lgblHWM.exe
  C:\Windows\System32\lgblHWM.exe
  2⤵
  PID:13704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\BnaWeOb.exe

Filesize
1.5MB

MD5
8ec970f701bf2e6f5f0aa6c40347de35

SHA1
884be0362dbb07c854b7ab8f3a00d307006d9c5a

SHA256
56afa45badd4ef91361a5ab40a66a679a69b5dad087f1e8c917ab4399d0c7291

SHA512
597b16fbd0ef64f4ae647b39c115f2770d6e6b25e0dc1c374ebff3372eb536374b7b78b738995c6addf6eb8d6b8f552e89c6aa4822e0c579a9c546afe3d0e4f1

Download Submit
C:\Windows\System32\EHzDaLr.exe

Filesize
1.5MB

MD5
76c22bbad2d44a672a747c7181c1521a

SHA1
293727f2fa30ee8842b8ffb4a5bdc209b584e5ac

SHA256
b6bf9550f67e6b92f4e0094b7f172e611ef20645cfb80a16620d203e9c7ed3e1

SHA512
9abf4928805634baf922145b0e6094fa7e8f9a9215ee72b5a75c5c287b24a1ea6627a6edfe48ca9f594493209f5141d36dcf23cd69d1bc8aaa1aa893fb768d83

Download Submit
C:\Windows\System32\EVxhngJ.exe

Filesize
1.5MB

MD5
48d2c9b057d5728450756a30962833a2

SHA1
10ca9ebe4cd5b4414041aa642f395bd7d1caec40

SHA256
ed38f9f8f6724f4eec60d1c03263e73d84ab25bc7c27478a1207aad74e1675b8

SHA512
722cf0cccd6a462becb8f53cd7f9b92ef03f2df915b30a5b28ed65d64a13c6b6d4b43a4381262a461410d98c6f0122daabd95aeb75f96c997514f4aad5787202

Download Submit
C:\Windows\System32\GGwOETS.exe

Filesize
1.5MB

MD5
547e7b8277f9f1be4cb069b15bdbc768

SHA1
6f805d7f41e6f8d551f32f301b2c15788cd32bba

SHA256
da498c5635693f80b413d221c4481daa8a7c73497107a941993ca4e63d4c4a86

SHA512
ff85a3d99b1eabedfc8834a63ce02a66a3b5f96c17d5955f337478c67a03ab68737040b55ef65bf9fe5abcbadbb82d6e4d1c206295fdc1f5decfb0a79457c926

Download Submit
C:\Windows\System32\HeuJVnW.exe

Filesize
1.5MB

MD5
43f71c694d5236a9be880101a77496c2

SHA1
f4ce8aa82cec6c79a9d49b27675a31a367387cf9

SHA256
0fe30bb69ac483cbf7454bf6fcd3eb1927625178f99844cbccef762be897ceca

SHA512
d447aa0816a9bc73f63da37594b4870630601980e447f6d7f16c30f86d958443357d951780feac4479fff65383d643b1381f6ede66eaf3a64de983119c3c3b29

Download Submit
C:\Windows\System32\HmecpMg.exe

Filesize
1.5MB

MD5
cbb3c156abbd3b063adb46a1f5b4c16c

SHA1
60940053fe97b1715d2f699e854655e8620fbad9

SHA256
ad30efc9ca58aff54c35fd00677821f6a10c168b28699f06aa8556b5341eda10

SHA512
1a824a25bfc43827df5859c3447a5b4cd6f7d7e8b50db976b552075b9dd20067e3b9b96110cdbac69e2728d18f4f0060d073533e5c5c6e0a6c52e135e4d003fb

Download Submit
C:\Windows\System32\KUZgkdx.exe

Filesize
1.5MB

MD5
f469bb1e3c5a634f3cbf0f3188a4eaf0

SHA1
1c9ff2fb4ec94b4442458e5d3bdd6387b394fb6a

SHA256
5c596acc4d512fd4ca58b117835829d1d341b509e2c2723f111edec437651f15

SHA512
4a17314231c4e6cfcbe8644e95e40c5dfaac5737eb17673f955e19405beaed3377918e5ca93057400ffe6d91b6dd200c7df857d4b43a20aad780d6f519048738

Download Submit
C:\Windows\System32\LSGHrZb.exe

Filesize
1.5MB

MD5
661fc7c2bf337b7cdac1a8bd46e4d1f2

SHA1
a54ea18a6d16c0eaef32f2ac0d3910dac7bb8df8

SHA256
5e0376c911a70c8dab838f156ff97f8f96050ae5a958446e4917841a0731b11f

SHA512
58fdb10b7554cfaeee2951a3f1928429bd461ee3bd6f02e6d7e9b0cf0fb5aa0e86ddfe89cb6bb90023b831b14a1d1afda1746cda2883b16e648843053ff8f9c1

Download Submit
C:\Windows\System32\PQSdwHI.exe

Filesize
1.5MB

MD5
228d65ee103bde5cd5854b3354ec388b

SHA1
9470270d1e5ce2a1694295e4f816342458098a2d

SHA256
f72bb5a70acd31a33562dbce6ff7b4b159b93fc0dc04b3cbb6a5b6207481baa2

SHA512
bcb1b21b6375f93914f6a6cea09c1652220f780cf5738679715dcb81e0bd506a2e3498cd50c2b123accc2b91aae3f92d21fa4a673a92a4ae66c3fc5e0b48e2c3

Download Submit
C:\Windows\System32\QhEwwlL.exe

Filesize
1.5MB

MD5
bf6d2e98503b6a6fc1025f03bfe70d76

SHA1
0de23d197348bac6da7d47fe9f3d98af723fbde4

SHA256
057814a0aee3a9174fa7e87b5a2aa2723f00e618fea19ac1af429b6db28b8bbd

SHA512
de2a429766035bafe562336cf6e7027afb11d83a0705b96d4765866a87b41701e2677fa252fb8ec67fdd75429c08c997c6e3274e3e5162169b6cf3111cd3d2b0

Download Submit
C:\Windows\System32\RyzQmUQ.exe

Filesize
1.5MB

MD5
8dd97ae5c87029771f006d4792635239

SHA1
08963f688c895cedb7c458483ffc50366b9d6c8c

SHA256
94763bd05e1e1d1b4c8aec8744cf44836746f2c28a2c48ad694a38a11afe5444

SHA512
91c894e0608fc8162b7b17252820c39645272b6fc625f3dcc0e9c468caccd4d082bedb10a4bea2be5d6d03c3d39f29e0ef3ba0cf59469394f9f67ad80aa1a1af

Download Submit
C:\Windows\System32\SGMxvDT.exe

Filesize
1.5MB

MD5
ed598b8f87a005ddfcf65f5e6989cb9c

SHA1
a38a1a956bfb3fc52c92cd85e49a3726fdfde5e6

SHA256
6af31c35ed3a14acb78c8744023f8784ae62810b900915928e06155ab38baa50

SHA512
f744fd3edae2b20c67a6cc1fa4a5eee5b5dced6aded97bf8465a0ad6e2f26b92327237a314173355c3c5ca5315210fccce5410241230c41e2157fce4e51d7251

Download Submit
C:\Windows\System32\SqpJWGD.exe

Filesize
1.5MB

MD5
13bbb99ca562821da877f00d3891d184

SHA1
ddce07c35e96161e7f3be95a6f47c068c2905710

SHA256
87266a2c308f7f0c82cde6b9f9606aeae6905e9d029d524074b68b70950cf617

SHA512
1e5483d3149f9a9af94ffc2c26accba0bf64ae4ac84dbf2fa4bee9d35fb279bc21df1c56afc95bfb2d55317b17bdee546bd3404512b4811f4108733db9945646

Download Submit
C:\Windows\System32\UanwSfb.exe

Filesize
1.5MB

MD5
1f8102c778526c7f6f5bf1cb296b4f34

SHA1
b9ef8cc2e71624ff2924a9e3003c3118bc476c9a

SHA256
e83490b56fcf4bc8f275cbc238f1ca1055b3b7570a20012575e90414eedb1fa5

SHA512
bdc417b898a5814f66996d64b399596a1e2ee91dbed4d03ab095eae5bccccda16eddd7451fd4282cd233df6b4262ac263ae704b4e9f06e7cea3fcfcd746a6bbf

Download Submit
C:\Windows\System32\VmFNnTh.exe

Filesize
1.5MB

MD5
8b27b3667ed4ffdc01f0574c495c2619

SHA1
0a0d6a53cffd60ebd753c4b44844d45e5fad843b

SHA256
75481a145c6cf245e71cb092acd08fed46dfcf5ef36f8b63f347006d2a5a68d6

SHA512
592d65852267bcebea621aee79ddffdd9ddd5f6510ea7e73746b4440e19cc91a67c3d080a9c52db770b0867b48ce8a5141287617779b737cff2924700953002e

Download Submit
C:\Windows\System32\WAGtLsx.exe

Filesize
1.5MB

MD5
5a261d377e1607ef04ef1e00679cfa8e

SHA1
17b3f8ae74ea106455e996425593e874d4337b31

SHA256
014d5fb74cf7a31f57643e97a648fe86e995cf9805b1c3c324c89fed57494754

SHA512
8e45d8b1c2725c62468af2056e2cb1ef7dfad0a536b498383fff9c1d3a2a6e4339d88501d5ea13eb9a742b47045084cf6558651d10b898ef16717b31819419e9

Download Submit
C:\Windows\System32\XZRaOJe.exe

Filesize
1.5MB

MD5
5928687c159c37969b319170cd74aecb

SHA1
f06c6df3d76f4ac8b34b6d406eb621deaffd0d83

SHA256
cfc0eda9e3cd56d3683238ef3ec8d535608493a58b32d0a95ed9e9a639c7f2ff

SHA512
59622185f1ba92efc5ad0fa0e7a210f4e5ed0ab3ae1e4b187baaa5f4a265a6ac63bcd5865838a693336a4d06fb0f9c32a80ad8c79f9276d96d851e260b6e747f

Download Submit
C:\Windows\System32\XyDiUHg.exe

Filesize
1.5MB

MD5
ba5640b4684c81491cc2113396775adb

SHA1
ba3a462cb5bea1fd5e95882b2ecf08dbcab27480

SHA256
f74fee9833eeee7baa176c6de91d97737676787eb0a62a0b833a6bb37c922355

SHA512
8349e0b25ed6b9770dbc8d9a71c3d59d57508c399d6b75ebde0a7b2bca8f3b950c903519570cc971aaabba576bf7859dbe30ac7ec71b99e1b4bfa5db83a82375

Download Submit
C:\Windows\System32\ZNIeyzj.exe

Filesize
1.5MB

MD5
aed655461853da6b1454de958c83c94d

SHA1
186d4d90ead899dd21f091fdf0b79f9c02905744

SHA256
7414c00c7b1cbda222ae83521fe2f1e7f8606e94d3690f2d934c127c5fbe271a

SHA512
65aca77361f790ed6f4c81caa243a6ee79b46a7d213dfacf858698d1494416cb6fd956257aed8a54ba3c56598268f5243406b6a648a4f2aad81e2fc890eb78a9

Download Submit
C:\Windows\System32\aePRDjK.exe

Filesize
1.5MB

MD5
50fe09f5a00e17813b0b259ba8a4e0b8

SHA1
23f8c6251e09f386425860b920cafa4db08b8dca

SHA256
4a507b336c4078b8c3f89cf94fb51411df4f1d28a99ae4f4a1b7efd3aadd41db

SHA512
ff1cc4ae58dfee76e26b3efb4bfe0bf8af193a8fa23a7a744e6c1b8e8f5c6031cdff6751c09392e9df04255135cfd16e08eb2bde06606aba896fcf6e30d15a66

Download Submit
C:\Windows\System32\bqjOniN.exe

Filesize
1.5MB

MD5
a08f2e9e9356f98506c5783ac2c89602

SHA1
eb23d90673768c89825c5fa4b44b435ddc1ac879

SHA256
59b73139da6d2d7796173561c273dde038d0ff41f629df530c981ca71bd85951

SHA512
2bd22c958c0850e9c6b8c9bc1206978263b8273a95ef385c326bb916dba0e7040bf97364513624084ce506b3b072e95e0b0bfd25dc62f22c94dbfc356c1b416d

Download Submit
C:\Windows\System32\cfPcxGE.exe

Filesize
1.5MB

MD5
e80b3cb7ac4a15832be04a76fe3a23fb

SHA1
73aa6174de285374cb621f10d9c84ca9a5cdcd4a

SHA256
6d0ef2a738b367fc026bdbd05d2aa5cdee2c3371d3a09630b8f0c9492579276f

SHA512
ed9367793d644ca8fe47cb4feed1193a4cd9a7bf8f9c5970e717f709f065751500e9e3e8c3ff4560e4b3ae617c0ec691a25cea816b41f7398a63b218d81bc7eb

Download Submit
C:\Windows\System32\eUTqgLH.exe

Filesize
1.5MB

MD5
ecd547bed0975302d79138a4eb8a52d0

SHA1
e95e00ba7920b0edf56a3f73726778a6c1d3c6b8

SHA256
f8df4dfa5422e7cae20c739a67354a570f99b33dd6f02aa88a922d9cb7ea59d5

SHA512
edfd654a4c6b9b916861a1de569eab8368a5861cd78c1b0aa0d4a5485dab04489d9d3704b2c235cf1aa7de8c5fa00e2d8e7f735137ccaca485e78cb0c2cf8996

Download Submit
C:\Windows\System32\hNuGARm.exe

Filesize
1.5MB

MD5
cfe1abc8a4ed3b8dc926fc1c9c832620

SHA1
1dd8c1c5b1c720687926aaa9299af23e47a381d8

SHA256
0691f957096304dfaf51efa9fb3923c8232dc118f1182f0d67d1db40695e62c9

SHA512
28ac1a1c743209202e75b1f638364fb367c7ce761b8e95bbab333b2ac9542d76edf4e9810869f2d8bbaa0d683bbda4e1d9abe320eb8ea178fd54a4bdd4407752

Download Submit
C:\Windows\System32\iBzpnAv.exe

Filesize
1.5MB

MD5
7342583c689ef8186626e9cf431822b9

SHA1
72aad90808c530e0d1aa6129bb87fff1dadeda50

SHA256
692ecf6792e1039fc82a0bdebbb48088436f6b9bfa34f942ab84086a00232682

SHA512
b406b2d296b3732918f0485c2c219a0ba2c3dd95f1ed5e6b83b8c126fa1a3d6dadcc3a3e2461971890fb369592350ccfde204b6e17a3c4d5aa3b75aa3dac5c51

Download Submit
C:\Windows\System32\ihhbaxc.exe

Filesize
1.5MB

MD5
8752853ebd5575a7e587015d412f5a4e

SHA1
e071732b6e51743c408e3c1df481a6dd22773ea2

SHA256
1d18ac9d5e98a1cb00851af9af9ff07e5cf5ece499c7241aada99c03bbc9204b

SHA512
e9517eeae1b2f7af5df5f4365029d4a4289e644bed781f2693658aaa0d327914432f5e204443edfb9dbae4cafde32b0abbff279e60991b431c72649c39398530

Download Submit
C:\Windows\System32\jLtIYDC.exe

Filesize
1.5MB

MD5
de794c3deaa63a25ff74b47d93909eaf

SHA1
0ffbed3d447585a98cc20834bf2e9b1503bb700c

SHA256
9947acb528bf4e95f3f5979da78bf5518c50851840fa71cc8a347da13d1171c7

SHA512
bb813ac79940e4265228dfc933c9c80097e5ffc6e1851bcd638473cd87594ce4a055e161e73c5dbbdc6ab165964a2ecea82bc4e013883bb9833e3e131acc20b5

Download Submit
C:\Windows\System32\joGUiVd.exe

Filesize
1.5MB

MD5
3d2b44d72e3021faae905fb2b2c8af0b

SHA1
71d8cf8b7c9b5216e8c8e86ebf985f432aa98f6c

SHA256
559197573f6faaa956eace5a99395153fa2b79e57be70fdcc8c41ee8674fced1

SHA512
d02332d2af18a9cb6bb8d414cc9ba169008c9410fd889b340a8b9c11b0eb7023f40a36f5220baaebee42fc1d608088d521c74ed85620cbbbd85b384100589fa7

Download Submit
C:\Windows\System32\kYSpddp.exe

Filesize
1.5MB

MD5
18761ad1af2ec0eee4f805dadc7f9cdf

SHA1
116972bbe77e743d2eb4e88e8b6fb8f3e51ac2dd

SHA256
181033c88f4c5041158e5adf2bdda0674634cb735c80daed8cfe585e885e682b

SHA512
db8f9ac46e881be77a7d1bdf9e5ebde5196fe41bd2de37362b51a348f847ebf2ef4fbf8fafcccf3e9da1f2dfe9ae898d4d740be999a4ce9495aaf1ac900efdc5

Download Submit
C:\Windows\System32\lozhbfH.exe

Filesize
1.5MB

MD5
34d28fc56e23aabd5fc4cfab1f97293c

SHA1
6b59c2f5beb22fa77279eb405de0631d810678fe

SHA256
2014befe4291126b15ad09c364649fa1cd706dcc88b05787674b1167bf2fac1e

SHA512
7967dc55da7c43276dc630b3ceb25769dce3e205019bfda74eddefb15406143716c068d3e961fb699ea556e3eb80adea75c5d5e339901a97c4ec051a89aee56e

Download Submit
C:\Windows\System32\nOYbkpN.exe

Filesize
1.5MB

MD5
91064738140a2f7918ce61440987b4c8

SHA1
086f172ba850b9bbee38051fc4709ddd89fbc4ac

SHA256
fb00c17cd6b94abcbec22094e8210ff4d8fb59ce213a8edcedbe0a7cbf55118d

SHA512
94802ff8afc614562a041e7f89cd86d126fa1d9cb7c0ff45d0c4c66dfd6b36cc998dc31e2308b900c649ae8d34abd6a743e01b7ab726a31c4516e4610c249ddd

Download Submit
C:\Windows\System32\ogXbeOX.exe

Filesize
1.5MB

MD5
5991ff5ee26f453d2e5f6ce9b5fb5d10

SHA1
112becf4875b4c9ae9fc7f8d9133f6f454e2e53c

SHA256
be4c658f0d14b6088482595510ac49066147c6f48d4bc1a44e7676a6c6a45987

SHA512
5db606dfdd37dfab75fa72e20ff6e1e7523c0f4a7c65832cc432b4a393524c69eae59f48734b913dafa51e42f22c165925b809adb26bbaa8ac3ac8cf00b03ede

Download Submit
memory/924-2206-0x00007FF6BA730000-0x00007FF6BAB21000-memory.dmp

Filesize
3.9MB

Download
memory/924-378-0x00007FF6BA730000-0x00007FF6BAB21000-memory.dmp

Filesize
3.9MB

Download
memory/1156-50-0x00007FF705850000-0x00007FF705C41000-memory.dmp

Filesize
3.9MB

Download
memory/1156-2153-0x00007FF705850000-0x00007FF705C41000-memory.dmp

Filesize
3.9MB

Download
memory/1484-2155-0x00007FF721E90000-0x00007FF722281000-memory.dmp

Filesize
3.9MB

Download
memory/1484-63-0x00007FF721E90000-0x00007FF722281000-memory.dmp

Filesize
3.9MB

Download
memory/1836-2211-0x00007FF7C3FC0000-0x00007FF7C43B1000-memory.dmp

Filesize
3.9MB

Download
memory/1836-395-0x00007FF7C3FC0000-0x00007FF7C43B1000-memory.dmp

Filesize
3.9MB

Download
memory/1876-78-0x00007FF6B0B80000-0x00007FF6B0F71000-memory.dmp

Filesize
3.9MB

Download
memory/1876-1390-0x00007FF6B0B80000-0x00007FF6B0F71000-memory.dmp

Filesize
3.9MB

Download
memory/1876-2178-0x00007FF6B0B80000-0x00007FF6B0F71000-memory.dmp

Filesize
3.9MB

Download
memory/2376-393-0x00007FF624F10000-0x00007FF625301000-memory.dmp

Filesize
3.9MB

Download
memory/2376-2209-0x00007FF624F10000-0x00007FF625301000-memory.dmp

Filesize
3.9MB

Download
memory/2380-2202-0x00007FF72A060000-0x00007FF72A451000-memory.dmp

Filesize
3.9MB

Download
memory/2380-409-0x00007FF72A060000-0x00007FF72A451000-memory.dmp

Filesize
3.9MB

Download
memory/2520-2199-0x00007FF7F1370000-0x00007FF7F1761000-memory.dmp

Filesize
3.9MB

Download
memory/2520-376-0x00007FF7F1370000-0x00007FF7F1761000-memory.dmp

Filesize
3.9MB

Download
memory/2616-401-0x00007FF7C4CB0000-0x00007FF7C50A1000-memory.dmp

Filesize
3.9MB

Download
memory/2616-2255-0x00007FF7C4CB0000-0x00007FF7C50A1000-memory.dmp

Filesize
3.9MB

Download
memory/2724-2130-0x00007FF6B3F70000-0x00007FF6B4361000-memory.dmp

Filesize
3.9MB

Download
memory/2724-11-0x00007FF6B3F70000-0x00007FF6B4361000-memory.dmp

Filesize
3.9MB

Download
memory/2724-85-0x00007FF6B3F70000-0x00007FF6B4361000-memory.dmp

Filesize
3.9MB

Download
memory/2844-2253-0x00007FF719D10000-0x00007FF71A101000-memory.dmp

Filesize
3.9MB

Download
memory/2844-403-0x00007FF719D10000-0x00007FF71A101000-memory.dmp

Filesize
3.9MB

Download
memory/2852-37-0x00007FF6A18B0000-0x00007FF6A1CA1000-memory.dmp

Filesize
3.9MB

Download
memory/2852-2151-0x00007FF6A18B0000-0x00007FF6A1CA1000-memory.dmp

Filesize
3.9MB

Download
memory/3016-389-0x00007FF638710000-0x00007FF638B01000-memory.dmp

Filesize
3.9MB

Download
memory/3016-2207-0x00007FF638710000-0x00007FF638B01000-memory.dmp

Filesize
3.9MB

Download
memory/3184-1395-0x00007FF69C010000-0x00007FF69C401000-memory.dmp

Filesize
3.9MB

Download
memory/3184-2197-0x00007FF69C010000-0x00007FF69C401000-memory.dmp

Filesize
3.9MB

Download
memory/3184-375-0x00007FF69C010000-0x00007FF69C401000-memory.dmp

Filesize
3.9MB

Download
memory/3336-449-0x00007FF71AE60000-0x00007FF71B251000-memory.dmp

Filesize
3.9MB

Download
memory/3336-2134-0x00007FF71AE60000-0x00007FF71B251000-memory.dmp

Filesize
3.9MB

Download
memory/3336-25-0x00007FF71AE60000-0x00007FF71B251000-memory.dmp

Filesize
3.9MB

Download
memory/3344-2257-0x00007FF6EDAC0000-0x00007FF6EDEB1000-memory.dmp

Filesize
3.9MB

Download
memory/3344-397-0x00007FF6EDAC0000-0x00007FF6EDEB1000-memory.dmp

Filesize
3.9MB

Download
memory/3480-0-0x00007FF62A5D0000-0x00007FF62A9C1000-memory.dmp

Filesize
3.9MB

Download
memory/3480-1-0x000001A4ADF20000-0x000001A4ADF30000-memory.dmp

Filesize
64KB

Download
memory/3480-81-0x00007FF62A5D0000-0x00007FF62A9C1000-memory.dmp

Filesize
3.9MB

Download
memory/3540-2204-0x00007FF6B95F0000-0x00007FF6B99E1000-memory.dmp

Filesize
3.9MB

Download
memory/3540-382-0x00007FF6B95F0000-0x00007FF6B99E1000-memory.dmp

Filesize
3.9MB

Download
memory/3664-2160-0x00007FF67B6A0000-0x00007FF67BA91000-memory.dmp

Filesize
3.9MB

Download
memory/3664-65-0x00007FF67B6A0000-0x00007FF67BA91000-memory.dmp

Filesize
3.9MB

Download
memory/3668-2161-0x00007FF6CF430000-0x00007FF6CF821000-memory.dmp

Filesize
3.9MB

Download
memory/3668-61-0x00007FF6CF430000-0x00007FF6CF821000-memory.dmp

Filesize
3.9MB

Download
memory/3776-60-0x00007FF738040000-0x00007FF738431000-memory.dmp

Filesize
3.9MB

Download
memory/3776-2157-0x00007FF738040000-0x00007FF738431000-memory.dmp

Filesize
3.9MB

Download
memory/3872-2195-0x00007FF719140000-0x00007FF719531000-memory.dmp

Filesize
3.9MB

Download
memory/3872-1258-0x00007FF719140000-0x00007FF719531000-memory.dmp

Filesize
3.9MB

Download
memory/3872-72-0x00007FF719140000-0x00007FF719531000-memory.dmp

Filesize
3.9MB

Download
memory/4116-2132-0x00007FF721EB0000-0x00007FF7222A1000-memory.dmp

Filesize
3.9MB

Download
memory/4116-406-0x00007FF721EB0000-0x00007FF7222A1000-memory.dmp

Filesize
3.9MB

Download
memory/4116-16-0x00007FF721EB0000-0x00007FF7222A1000-memory.dmp

Filesize
3.9MB

Download
memory/4404-1129-0x00007FF76DC60000-0x00007FF76E051000-memory.dmp

Filesize
3.9MB

Download
memory/4404-66-0x00007FF76DC60000-0x00007FF76E051000-memory.dmp

Filesize
3.9MB

Download
memory/4404-2187-0x00007FF76DC60000-0x00007FF76E051000-memory.dmp

Filesize
3.9MB

Download
memory/4684-26-0x00007FF6C2F10000-0x00007FF6C3301000-memory.dmp

Filesize
3.9MB

Download
memory/4684-2136-0x00007FF6C2F10000-0x00007FF6C3301000-memory.dmp

Filesize
3.9MB

Download