xmrig | 1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8

Analysis

max time kernel
149s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
Size 2.1MB
Sample240613-yhrfjayerf
SHA256 1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8
MD5 0e9535a365b9c86dcbdb17cbe92b810d
SHA1 84adae700b41990463170e8bc9fb345d21342f80
SHA512 8face794e7c9368881db194d10c41aeef9db42730ced33c4cb501141b63e482730576551c9143fc6a13fd4a65104af74bdcdaf0d063348c9a3e0b356e045779e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOO:GemTLkNdfE0pZaw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000022f51-4.dat	xmrig
behavioral2/files/0x000700000002340f-8.dat	xmrig
behavioral2/files/0x0007000000023411-15.dat	xmrig
behavioral2/files/0x0007000000023410-18.dat	xmrig
behavioral2/files/0x0007000000023412-23.dat	xmrig
behavioral2/files/0x0007000000023413-28.dat	xmrig
behavioral2/files/0x0007000000023416-38.dat	xmrig
behavioral2/files/0x0007000000023415-43.dat	xmrig
behavioral2/files/0x0007000000023417-63.dat	xmrig
behavioral2/files/0x000700000002341c-89.dat	xmrig
behavioral2/files/0x000700000002341e-102.dat	xmrig
behavioral2/files/0x0007000000023426-125.dat	xmrig
behavioral2/files/0x0007000000023425-123.dat	xmrig
behavioral2/files/0x0007000000023424-121.dat	xmrig
behavioral2/files/0x0007000000023423-119.dat	xmrig
behavioral2/files/0x0007000000023422-117.dat	xmrig
behavioral2/files/0x0007000000023421-115.dat	xmrig
behavioral2/files/0x0007000000023420-113.dat	xmrig
behavioral2/files/0x000700000002341f-111.dat	xmrig
behavioral2/files/0x000700000002341d-101.dat	xmrig
behavioral2/files/0x000700000002341b-85.dat	xmrig
behavioral2/files/0x000700000002341a-75.dat	xmrig
behavioral2/files/0x0007000000023419-72.dat	xmrig
behavioral2/files/0x0007000000023418-69.dat	xmrig
behavioral2/files/0x0007000000023414-41.dat	xmrig
behavioral2/files/0x0007000000023427-128.dat	xmrig
behavioral2/files/0x000800000002340c-135.dat	xmrig
behavioral2/files/0x0007000000023428-139.dat	xmrig
behavioral2/files/0x0007000000023429-144.dat	xmrig
behavioral2/files/0x000700000002342a-148.dat	xmrig
behavioral2/files/0x000700000002342b-154.dat	xmrig
behavioral2/files/0x000700000002342c-160.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2328	XxTUFJk.exe
372	MvogQon.exe
1708	qzBIQnD.exe
4220	ivMNEhs.exe
1556	nlpmcRf.exe
4504	YpXrgni.exe
4040	kPUvtnC.exe
1668	qtYswgo.exe
4856	DabWqCs.exe
2008	rwXQZOc.exe
4900	yJeFoxP.exe
884	YItoHxw.exe
3440	gvaOtGd.exe
4784	TxOxqgW.exe
2372	xDrljap.exe
1256	ZIFGhzx.exe
4488	MBKuXrX.exe
4760	wDtyauE.exe
4048	OOADntC.exe
1608	jLXOnWR.exe
640	PRZJdCe.exe
4468	LrETTQa.exe
3128	zQiXgtn.exe
2476	YpdgAaS.exe
3196	JXFMvdg.exe
3036	IYVfwLB.exe
3568	CjAYdau.exe
852	XUNjChA.exe
4248	RJSACFc.exe
1736	fnMUSXv.exe
3708	cyShOvd.exe
1804	bbpmYIv.exe
1664	LfgGwWk.exe
376	nXYKKFs.exe
2536	gYcWysX.exe
5108	InABvOg.exe
1020	Owfplny.exe
2188	mZXRfFY.exe
2004	qiVDsZv.exe
1740	lGKQseR.exe
2960	vnbwKbi.exe
1368	loCgsDz.exe
2576	bRvdWvb.exe
3956	VYhlBce.exe
2120	JMsYSuI.exe
4344	oqrBPkX.exe
1680	kTgNPWz.exe
2496	UsOZrTk.exe
5004	fwmfPIr.exe
4416	ZTFWVQH.exe
4352	mIdshOF.exe
2500	AtnGYvT.exe
4544	aWXYXUb.exe
4508	ktugrex.exe
4124	AinwxCd.exe
3464	TuYCsCx.exe
1420	lOutceV.exe
1500	CZLuxJt.exe
2628	LkIrOPH.exe
4312	Vmwuksl.exe
3972	rGINAjh.exe
2280	XQhtdFw.exe
4676	ezCjfDt.exe
1684	yBOtynL.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kPUvtnC.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\MlkGxaC.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\nIaHBRn.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\SJrWyMr.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\yADQgha.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\tkeGroe.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\OWxInLX.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\tVDPXQi.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\MfObxsH.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\HoHwiOJ.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\RPErOvu.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\awGeVSr.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\bAfQrxU.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\TvWjWUK.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\iCBZjhd.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\jXCWclG.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\zQiXgtn.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\jljRfUN.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\gGecHmI.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\luoOmzA.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\yZKggtV.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\KDHCQEA.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\UCXMOHg.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\YonMVVC.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\oIXbHgc.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\uTQOhAl.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\QfEyoDt.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\oVonvuY.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\vWnkEOZ.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\wUVnBKg.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\ASgFohM.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\utbQeDZ.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\hSlenct.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\ahCNZBZ.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\OkIlJjB.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\OnMBTxH.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\WqGPrUx.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\RHwoqOu.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\cexfjFV.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\loCgsDz.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\INoKWok.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\NXiSGNQ.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\qDtudro.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\KlTgosy.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\xityJTZ.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\LkIrOPH.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\RvSsdTb.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\QHXZruD.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\MpxIkqs.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\GLnxzLS.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\GbwuwFW.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\BqhooSF.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\kIojdRH.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\fJqEawh.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\YnpAORb.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\OOBlVGp.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\tixzaCr.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\amnQtyL.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\CWgfuXG.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\RNdRZYl.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\mBhQwnF.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\lnDqilJ.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\zqkrRmn.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
File created	C:\Windows\System\KERQZCa.exe	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17088	dwm.exe
Token: SeChangeNotifyPrivilege	17088	dwm.exe
Token: 33	17088	dwm.exe
Token: SeIncBasePriorityPrivilege	17088	dwm.exe
Token: SeShutdownPrivilege	17088	dwm.exe
Token: SeCreatePagefilePrivilege	17088	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2328	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	83
PID 1416 wrote to memory of 2328	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	83
PID 1416 wrote to memory of 372	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	84
PID 1416 wrote to memory of 372	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	84
PID 1416 wrote to memory of 1708	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	85
PID 1416 wrote to memory of 1708	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	85
PID 1416 wrote to memory of 4220	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	86
PID 1416 wrote to memory of 4220	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	86
PID 1416 wrote to memory of 1556	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	87
PID 1416 wrote to memory of 1556	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	87
PID 1416 wrote to memory of 4504	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	88
PID 1416 wrote to memory of 4504	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	88
PID 1416 wrote to memory of 4040	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	89
PID 1416 wrote to memory of 4040	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	89
PID 1416 wrote to memory of 1668	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	90
PID 1416 wrote to memory of 1668	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	90
PID 1416 wrote to memory of 4856	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	91
PID 1416 wrote to memory of 4856	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	91
PID 1416 wrote to memory of 2008	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	92
PID 1416 wrote to memory of 2008	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	92
PID 1416 wrote to memory of 4900	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	93
PID 1416 wrote to memory of 4900	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	93
PID 1416 wrote to memory of 884	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	94
PID 1416 wrote to memory of 884	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	94
PID 1416 wrote to memory of 3440	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	95
PID 1416 wrote to memory of 3440	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	95
PID 1416 wrote to memory of 4784	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	96
PID 1416 wrote to memory of 4784	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	96
PID 1416 wrote to memory of 2372	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	97
PID 1416 wrote to memory of 2372	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	97
PID 1416 wrote to memory of 1256	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	98
PID 1416 wrote to memory of 1256	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	98
PID 1416 wrote to memory of 4488	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	99
PID 1416 wrote to memory of 4488	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	99
PID 1416 wrote to memory of 4760	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	100
PID 1416 wrote to memory of 4760	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	100
PID 1416 wrote to memory of 4048	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	101
PID 1416 wrote to memory of 4048	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	101
PID 1416 wrote to memory of 1608	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	102
PID 1416 wrote to memory of 1608	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	102
PID 1416 wrote to memory of 640	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	103
PID 1416 wrote to memory of 640	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	103
PID 1416 wrote to memory of 4468	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	104
PID 1416 wrote to memory of 4468	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	104
PID 1416 wrote to memory of 3128	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	105
PID 1416 wrote to memory of 3128	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	105
PID 1416 wrote to memory of 2476	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	106
PID 1416 wrote to memory of 2476	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	106
PID 1416 wrote to memory of 3196	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	107
PID 1416 wrote to memory of 3196	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	107
PID 1416 wrote to memory of 3036	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	108
PID 1416 wrote to memory of 3036	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	108
PID 1416 wrote to memory of 3568	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	110
PID 1416 wrote to memory of 3568	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	110
PID 1416 wrote to memory of 852	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	111
PID 1416 wrote to memory of 852	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	111
PID 1416 wrote to memory of 4248	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	112
PID 1416 wrote to memory of 4248	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	112
PID 1416 wrote to memory of 1736	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	113
PID 1416 wrote to memory of 1736	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	113
PID 1416 wrote to memory of 3708	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	114
PID 1416 wrote to memory of 3708	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	114
PID 1416 wrote to memory of 1804	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	115
PID 1416 wrote to memory of 1804	1416	1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe	115

C:\Users\Admin\AppData\Local\Temp\1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe
"C:\Users\Admin\AppData\Local\Temp\1736f4f43ec11d0a7e9b21971662b1a7c412b9478d4f1f9df4a09c9e097d9bf8.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\System\XxTUFJk.exe
  C:\Windows\System\XxTUFJk.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\MvogQon.exe
  C:\Windows\System\MvogQon.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\qzBIQnD.exe
  C:\Windows\System\qzBIQnD.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ivMNEhs.exe
  C:\Windows\System\ivMNEhs.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\nlpmcRf.exe
  C:\Windows\System\nlpmcRf.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\YpXrgni.exe
  C:\Windows\System\YpXrgni.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\kPUvtnC.exe
  C:\Windows\System\kPUvtnC.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\qtYswgo.exe
  C:\Windows\System\qtYswgo.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\DabWqCs.exe
  C:\Windows\System\DabWqCs.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\rwXQZOc.exe
  C:\Windows\System\rwXQZOc.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\yJeFoxP.exe
  C:\Windows\System\yJeFoxP.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\YItoHxw.exe
  C:\Windows\System\YItoHxw.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\gvaOtGd.exe
  C:\Windows\System\gvaOtGd.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\TxOxqgW.exe
  C:\Windows\System\TxOxqgW.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\xDrljap.exe
  C:\Windows\System\xDrljap.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ZIFGhzx.exe
  C:\Windows\System\ZIFGhzx.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\MBKuXrX.exe
  C:\Windows\System\MBKuXrX.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\wDtyauE.exe
  C:\Windows\System\wDtyauE.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\OOADntC.exe
  C:\Windows\System\OOADntC.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\jLXOnWR.exe
  C:\Windows\System\jLXOnWR.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\PRZJdCe.exe
  C:\Windows\System\PRZJdCe.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\LrETTQa.exe
  C:\Windows\System\LrETTQa.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\zQiXgtn.exe
  C:\Windows\System\zQiXgtn.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\YpdgAaS.exe
  C:\Windows\System\YpdgAaS.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\JXFMvdg.exe
  C:\Windows\System\JXFMvdg.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\IYVfwLB.exe
  C:\Windows\System\IYVfwLB.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\CjAYdau.exe
  C:\Windows\System\CjAYdau.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\XUNjChA.exe
  C:\Windows\System\XUNjChA.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\RJSACFc.exe
  C:\Windows\System\RJSACFc.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\fnMUSXv.exe
  C:\Windows\System\fnMUSXv.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\cyShOvd.exe
  C:\Windows\System\cyShOvd.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\bbpmYIv.exe
  C:\Windows\System\bbpmYIv.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\LfgGwWk.exe
  C:\Windows\System\LfgGwWk.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\nXYKKFs.exe
  C:\Windows\System\nXYKKFs.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\gYcWysX.exe
  C:\Windows\System\gYcWysX.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\InABvOg.exe
  C:\Windows\System\InABvOg.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\Owfplny.exe
  C:\Windows\System\Owfplny.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\mZXRfFY.exe
  C:\Windows\System\mZXRfFY.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\qiVDsZv.exe
  C:\Windows\System\qiVDsZv.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\lGKQseR.exe
  C:\Windows\System\lGKQseR.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\vnbwKbi.exe
  C:\Windows\System\vnbwKbi.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\loCgsDz.exe
  C:\Windows\System\loCgsDz.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\bRvdWvb.exe
  C:\Windows\System\bRvdWvb.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\VYhlBce.exe
  C:\Windows\System\VYhlBce.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\JMsYSuI.exe
  C:\Windows\System\JMsYSuI.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\oqrBPkX.exe
  C:\Windows\System\oqrBPkX.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\kTgNPWz.exe
  C:\Windows\System\kTgNPWz.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\UsOZrTk.exe
  C:\Windows\System\UsOZrTk.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\fwmfPIr.exe
  C:\Windows\System\fwmfPIr.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\ZTFWVQH.exe
  C:\Windows\System\ZTFWVQH.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\mIdshOF.exe
  C:\Windows\System\mIdshOF.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\AtnGYvT.exe
  C:\Windows\System\AtnGYvT.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\aWXYXUb.exe
  C:\Windows\System\aWXYXUb.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\ktugrex.exe
  C:\Windows\System\ktugrex.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\AinwxCd.exe
  C:\Windows\System\AinwxCd.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\TuYCsCx.exe
  C:\Windows\System\TuYCsCx.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\lOutceV.exe
  C:\Windows\System\lOutceV.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\CZLuxJt.exe
  C:\Windows\System\CZLuxJt.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\LkIrOPH.exe
  C:\Windows\System\LkIrOPH.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\Vmwuksl.exe
  C:\Windows\System\Vmwuksl.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\rGINAjh.exe
  C:\Windows\System\rGINAjh.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\XQhtdFw.exe
  C:\Windows\System\XQhtdFw.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ezCjfDt.exe
  C:\Windows\System\ezCjfDt.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\yBOtynL.exe
  C:\Windows\System\yBOtynL.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\dgRGpEZ.exe
  C:\Windows\System\dgRGpEZ.exe
  2⤵
  PID:5112
- C:\Windows\System\PspJmnS.exe
  C:\Windows\System\PspJmnS.exe
  2⤵
  PID:668
- C:\Windows\System\ZXJtRPo.exe
  C:\Windows\System\ZXJtRPo.exe
  2⤵
  PID:1400
- C:\Windows\System\nGbvFHO.exe
  C:\Windows\System\nGbvFHO.exe
  2⤵
  PID:5040
- C:\Windows\System\jXCWclG.exe
  C:\Windows\System\jXCWclG.exe
  2⤵
  PID:4432
- C:\Windows\System\OVuRqfg.exe
  C:\Windows\System\OVuRqfg.exe
  2⤵
  PID:3408
- C:\Windows\System\FUwxnLS.exe
  C:\Windows\System\FUwxnLS.exe
  2⤵
  PID:1288
- C:\Windows\System\husUIuZ.exe
  C:\Windows\System\husUIuZ.exe
  2⤵
  PID:3900
- C:\Windows\System\tpbhoGY.exe
  C:\Windows\System\tpbhoGY.exe
  2⤵
  PID:1696
- C:\Windows\System\cewndJk.exe
  C:\Windows\System\cewndJk.exe
  2⤵
  PID:2644
- C:\Windows\System\awGeVSr.exe
  C:\Windows\System\awGeVSr.exe
  2⤵
  PID:4908
- C:\Windows\System\PPouGWJ.exe
  C:\Windows\System\PPouGWJ.exe
  2⤵
  PID:3168
- C:\Windows\System\NyZVOPD.exe
  C:\Windows\System\NyZVOPD.exe
  2⤵
  PID:3632
- C:\Windows\System\TUVwlJW.exe
  C:\Windows\System\TUVwlJW.exe
  2⤵
  PID:4836
- C:\Windows\System\rVvwtNW.exe
  C:\Windows\System\rVvwtNW.exe
  2⤵
  PID:4932
- C:\Windows\System\nieEMgE.exe
  C:\Windows\System\nieEMgE.exe
  2⤵
  PID:628
- C:\Windows\System\lKcuEEy.exe
  C:\Windows\System\lKcuEEy.exe
  2⤵
  PID:3572
- C:\Windows\System\sBJRUGd.exe
  C:\Windows\System\sBJRUGd.exe
  2⤵
  PID:1840
- C:\Windows\System\fpeBVpa.exe
  C:\Windows\System\fpeBVpa.exe
  2⤵
  PID:4380
- C:\Windows\System\MNENvDA.exe
  C:\Windows\System\MNENvDA.exe
  2⤵
  PID:1520
- C:\Windows\System\zboTcAe.exe
  C:\Windows\System\zboTcAe.exe
  2⤵
  PID:4612
- C:\Windows\System\HkHIViz.exe
  C:\Windows\System\HkHIViz.exe
  2⤵
  PID:1044
- C:\Windows\System\vGEILUv.exe
  C:\Windows\System\vGEILUv.exe
  2⤵
  PID:4496
- C:\Windows\System\LUJTDap.exe
  C:\Windows\System\LUJTDap.exe
  2⤵
  PID:4196
- C:\Windows\System\lgWXrAz.exe
  C:\Windows\System\lgWXrAz.exe
  2⤵
  PID:5028
- C:\Windows\System\edmZkIo.exe
  C:\Windows\System\edmZkIo.exe
  2⤵
  PID:1180
- C:\Windows\System\gNjlvql.exe
  C:\Windows\System\gNjlvql.exe
  2⤵
  PID:4792
- C:\Windows\System\SuLsjkN.exe
  C:\Windows\System\SuLsjkN.exe
  2⤵
  PID:4580
- C:\Windows\System\auHtyIQ.exe
  C:\Windows\System\auHtyIQ.exe
  2⤵
  PID:2384
- C:\Windows\System\iwpSKeD.exe
  C:\Windows\System\iwpSKeD.exe
  2⤵
  PID:452
- C:\Windows\System\wYzilEG.exe
  C:\Windows\System\wYzilEG.exe
  2⤵
  PID:4624
- C:\Windows\System\tyExlur.exe
  C:\Windows\System\tyExlur.exe
  2⤵
  PID:2292
- C:\Windows\System\srVbHKs.exe
  C:\Windows\System\srVbHKs.exe
  2⤵
  PID:3996
- C:\Windows\System\qdFyxGR.exe
  C:\Windows\System\qdFyxGR.exe
  2⤵
  PID:3312
- C:\Windows\System\xOxfPqN.exe
  C:\Windows\System\xOxfPqN.exe
  2⤵
  PID:4364
- C:\Windows\System\rqJSMle.exe
  C:\Windows\System\rqJSMle.exe
  2⤵
  PID:4692
- C:\Windows\System\oxaTBwB.exe
  C:\Windows\System\oxaTBwB.exe
  2⤵
  PID:3652
- C:\Windows\System\bmMqcOe.exe
  C:\Windows\System\bmMqcOe.exe
  2⤵
  PID:3988
- C:\Windows\System\TgWOgRJ.exe
  C:\Windows\System\TgWOgRJ.exe
  2⤵
  PID:2860
- C:\Windows\System\zIScAek.exe
  C:\Windows\System\zIScAek.exe
  2⤵
  PID:4084
- C:\Windows\System\hYctqrg.exe
  C:\Windows\System\hYctqrg.exe
  2⤵
  PID:2096
- C:\Windows\System\cqVMWFy.exe
  C:\Windows\System\cqVMWFy.exe
  2⤵
  PID:380
- C:\Windows\System\YnpAORb.exe
  C:\Windows\System\YnpAORb.exe
  2⤵
  PID:1468
- C:\Windows\System\JqePmwp.exe
  C:\Windows\System\JqePmwp.exe
  2⤵
  PID:1912
- C:\Windows\System\BJffXRn.exe
  C:\Windows\System\BJffXRn.exe
  2⤵
  PID:5132
- C:\Windows\System\MvwFcMd.exe
  C:\Windows\System\MvwFcMd.exe
  2⤵
  PID:5148
- C:\Windows\System\QBfKNTh.exe
  C:\Windows\System\QBfKNTh.exe
  2⤵
  PID:5188
- C:\Windows\System\UtRdgMq.exe
  C:\Windows\System\UtRdgMq.exe
  2⤵
  PID:5204
- C:\Windows\System\CtEdnii.exe
  C:\Windows\System\CtEdnii.exe
  2⤵
  PID:5244
- C:\Windows\System\wKaVXQN.exe
  C:\Windows\System\wKaVXQN.exe
  2⤵
  PID:5264
- C:\Windows\System\CZuCAsO.exe
  C:\Windows\System\CZuCAsO.exe
  2⤵
  PID:5300
- C:\Windows\System\bHrrHSq.exe
  C:\Windows\System\bHrrHSq.exe
  2⤵
  PID:5328
- C:\Windows\System\oDUwQSq.exe
  C:\Windows\System\oDUwQSq.exe
  2⤵
  PID:5344
- C:\Windows\System\WiAjpJO.exe
  C:\Windows\System\WiAjpJO.exe
  2⤵
  PID:5364
- C:\Windows\System\YfdTvAr.exe
  C:\Windows\System\YfdTvAr.exe
  2⤵
  PID:5400
- C:\Windows\System\zKrpAYS.exe
  C:\Windows\System\zKrpAYS.exe
  2⤵
  PID:5440
- C:\Windows\System\ytcFBNj.exe
  C:\Windows\System\ytcFBNj.exe
  2⤵
  PID:5476
- C:\Windows\System\StaKsLq.exe
  C:\Windows\System\StaKsLq.exe
  2⤵
  PID:5496
- C:\Windows\System\CZRxTcx.exe
  C:\Windows\System\CZRxTcx.exe
  2⤵
  PID:5528
- C:\Windows\System\wWKsGDc.exe
  C:\Windows\System\wWKsGDc.exe
  2⤵
  PID:5548
- C:\Windows\System\McqyMcy.exe
  C:\Windows\System\McqyMcy.exe
  2⤵
  PID:5584
- C:\Windows\System\OLzkjsn.exe
  C:\Windows\System\OLzkjsn.exe
  2⤵
  PID:5604
- C:\Windows\System\MauGWmx.exe
  C:\Windows\System\MauGWmx.exe
  2⤵
  PID:5636
- C:\Windows\System\KzbmCKn.exe
  C:\Windows\System\KzbmCKn.exe
  2⤵
  PID:5664
- C:\Windows\System\MRldQRN.exe
  C:\Windows\System\MRldQRN.exe
  2⤵
  PID:5696
- C:\Windows\System\hPjxmeE.exe
  C:\Windows\System\hPjxmeE.exe
  2⤵
  PID:5720
- C:\Windows\System\WlaOLPy.exe
  C:\Windows\System\WlaOLPy.exe
  2⤵
  PID:5740
- C:\Windows\System\BavuGUs.exe
  C:\Windows\System\BavuGUs.exe
  2⤵
  PID:5784
- C:\Windows\System\vyrNKqn.exe
  C:\Windows\System\vyrNKqn.exe
  2⤵
  PID:5808
- C:\Windows\System\JKKMTii.exe
  C:\Windows\System\JKKMTii.exe
  2⤵
  PID:5836
- C:\Windows\System\zQLEMmS.exe
  C:\Windows\System\zQLEMmS.exe
  2⤵
  PID:5864
- C:\Windows\System\XJtEtxJ.exe
  C:\Windows\System\XJtEtxJ.exe
  2⤵
  PID:5892
- C:\Windows\System\zpJWFhI.exe
  C:\Windows\System\zpJWFhI.exe
  2⤵
  PID:5916
- C:\Windows\System\JfRZuUm.exe
  C:\Windows\System\JfRZuUm.exe
  2⤵
  PID:5948
- C:\Windows\System\RitXskS.exe
  C:\Windows\System\RitXskS.exe
  2⤵
  PID:5964
- C:\Windows\System\nATRASF.exe
  C:\Windows\System\nATRASF.exe
  2⤵
  PID:5980
- C:\Windows\System\tkHHPAv.exe
  C:\Windows\System\tkHHPAv.exe
  2⤵
  PID:6008
- C:\Windows\System\jrTBvFj.exe
  C:\Windows\System\jrTBvFj.exe
  2⤵
  PID:6048
- C:\Windows\System\BHFzaon.exe
  C:\Windows\System\BHFzaon.exe
  2⤵
  PID:6064
- C:\Windows\System\tGDJnCi.exe
  C:\Windows\System\tGDJnCi.exe
  2⤵
  PID:6084
- C:\Windows\System\Drpgwfi.exe
  C:\Windows\System\Drpgwfi.exe
  2⤵
  PID:6112
- C:\Windows\System\TWqEuUw.exe
  C:\Windows\System\TWqEuUw.exe
  2⤵
  PID:5140
- C:\Windows\System\TIjCQWB.exe
  C:\Windows\System\TIjCQWB.exe
  2⤵
  PID:5232
- C:\Windows\System\KkPFazH.exe
  C:\Windows\System\KkPFazH.exe
  2⤵
  PID:5284
- C:\Windows\System\uwPAEqz.exe
  C:\Windows\System\uwPAEqz.exe
  2⤵
  PID:5384
- C:\Windows\System\cXcSzfo.exe
  C:\Windows\System\cXcSzfo.exe
  2⤵
  PID:5424
- C:\Windows\System\MJwbCCP.exe
  C:\Windows\System\MJwbCCP.exe
  2⤵
  PID:5484
- C:\Windows\System\mxolLne.exe
  C:\Windows\System\mxolLne.exe
  2⤵
  PID:5516
- C:\Windows\System\zOlnChr.exe
  C:\Windows\System\zOlnChr.exe
  2⤵
  PID:5596
- C:\Windows\System\sVTYVKw.exe
  C:\Windows\System\sVTYVKw.exe
  2⤵
  PID:5676
- C:\Windows\System\NibJqTK.exe
  C:\Windows\System\NibJqTK.exe
  2⤵
  PID:5716
- C:\Windows\System\VIeaKvl.exe
  C:\Windows\System\VIeaKvl.exe
  2⤵
  PID:5776
- C:\Windows\System\DpBfnHa.exe
  C:\Windows\System\DpBfnHa.exe
  2⤵
  PID:5856
- C:\Windows\System\qSIWaZL.exe
  C:\Windows\System\qSIWaZL.exe
  2⤵
  PID:5944
- C:\Windows\System\xLhsvsi.exe
  C:\Windows\System\xLhsvsi.exe
  2⤵
  PID:6060
- C:\Windows\System\mXHUzJh.exe
  C:\Windows\System\mXHUzJh.exe
  2⤵
  PID:6132
- C:\Windows\System\ifUdCFR.exe
  C:\Windows\System\ifUdCFR.exe
  2⤵
  PID:2800
- C:\Windows\System\zmfmlTb.exe
  C:\Windows\System\zmfmlTb.exe
  2⤵
  PID:5360
- C:\Windows\System\GiVoilV.exe
  C:\Windows\System\GiVoilV.exe
  2⤵
  PID:5460
- C:\Windows\System\HudYjno.exe
  C:\Windows\System\HudYjno.exe
  2⤵
  PID:5656
- C:\Windows\System\hwVphBx.exe
  C:\Windows\System\hwVphBx.exe
  2⤵
  PID:5772
- C:\Windows\System\QfYABzE.exe
  C:\Windows\System\QfYABzE.exe
  2⤵
  PID:5956
- C:\Windows\System\SzCPrHg.exe
  C:\Windows\System\SzCPrHg.exe
  2⤵
  PID:6092
- C:\Windows\System\ZVfPlfQ.exe
  C:\Windows\System\ZVfPlfQ.exe
  2⤵
  PID:5228
- C:\Windows\System\vqXTBha.exe
  C:\Windows\System\vqXTBha.exe
  2⤵
  PID:5732
- C:\Windows\System\qicMVxL.exe
  C:\Windows\System\qicMVxL.exe
  2⤵
  PID:6072
- C:\Windows\System\dwqejXp.exe
  C:\Windows\System\dwqejXp.exe
  2⤵
  PID:5688
- C:\Windows\System\qZhLtXr.exe
  C:\Windows\System\qZhLtXr.exe
  2⤵
  PID:5540
- C:\Windows\System\RIyRGxc.exe
  C:\Windows\System\RIyRGxc.exe
  2⤵
  PID:6176
- C:\Windows\System\RkqqzfL.exe
  C:\Windows\System\RkqqzfL.exe
  2⤵
  PID:6204
- C:\Windows\System\KTAQWbe.exe
  C:\Windows\System\KTAQWbe.exe
  2⤵
  PID:6228
- C:\Windows\System\zhBESzP.exe
  C:\Windows\System\zhBESzP.exe
  2⤵
  PID:6256
- C:\Windows\System\ODDKSme.exe
  C:\Windows\System\ODDKSme.exe
  2⤵
  PID:6284
- C:\Windows\System\HkfwWHy.exe
  C:\Windows\System\HkfwWHy.exe
  2⤵
  PID:6300
- C:\Windows\System\yFcXMLS.exe
  C:\Windows\System\yFcXMLS.exe
  2⤵
  PID:6340
- C:\Windows\System\YmxyuLx.exe
  C:\Windows\System\YmxyuLx.exe
  2⤵
  PID:6368
- C:\Windows\System\dHprDYT.exe
  C:\Windows\System\dHprDYT.exe
  2⤵
  PID:6396
- C:\Windows\System\WdRsODb.exe
  C:\Windows\System\WdRsODb.exe
  2⤵
  PID:6424
- C:\Windows\System\aUCrjVC.exe
  C:\Windows\System\aUCrjVC.exe
  2⤵
  PID:6452
- C:\Windows\System\JRvzdrM.exe
  C:\Windows\System\JRvzdrM.exe
  2⤵
  PID:6484
- C:\Windows\System\UhtilGp.exe
  C:\Windows\System\UhtilGp.exe
  2⤵
  PID:6508
- C:\Windows\System\WAtuDOC.exe
  C:\Windows\System\WAtuDOC.exe
  2⤵
  PID:6528
- C:\Windows\System\YkLosFZ.exe
  C:\Windows\System\YkLosFZ.exe
  2⤵
  PID:6568
- C:\Windows\System\xvPjHAy.exe
  C:\Windows\System\xvPjHAy.exe
  2⤵
  PID:6592
- C:\Windows\System\xRAHamV.exe
  C:\Windows\System\xRAHamV.exe
  2⤵
  PID:6620
- C:\Windows\System\frUdoxF.exe
  C:\Windows\System\frUdoxF.exe
  2⤵
  PID:6648
- C:\Windows\System\AJEPIHp.exe
  C:\Windows\System\AJEPIHp.exe
  2⤵
  PID:6664
- C:\Windows\System\NkFfetI.exe
  C:\Windows\System\NkFfetI.exe
  2⤵
  PID:6700
- C:\Windows\System\dOXiLZe.exe
  C:\Windows\System\dOXiLZe.exe
  2⤵
  PID:6720
- C:\Windows\System\utNAiGM.exe
  C:\Windows\System\utNAiGM.exe
  2⤵
  PID:6752
- C:\Windows\System\SvrbmoX.exe
  C:\Windows\System\SvrbmoX.exe
  2⤵
  PID:6788
- C:\Windows\System\ESGYFni.exe
  C:\Windows\System\ESGYFni.exe
  2⤵
  PID:6820
- C:\Windows\System\ChkNBYD.exe
  C:\Windows\System\ChkNBYD.exe
  2⤵
  PID:6852
- C:\Windows\System\BEVlXos.exe
  C:\Windows\System\BEVlXos.exe
  2⤵
  PID:6876
- C:\Windows\System\CmvqdDq.exe
  C:\Windows\System\CmvqdDq.exe
  2⤵
  PID:6900
- C:\Windows\System\EnqXPwm.exe
  C:\Windows\System\EnqXPwm.exe
  2⤵
  PID:6936
- C:\Windows\System\eltpRqT.exe
  C:\Windows\System\eltpRqT.exe
  2⤵
  PID:6960
- C:\Windows\System\IeiLccG.exe
  C:\Windows\System\IeiLccG.exe
  2⤵
  PID:6988
- C:\Windows\System\vrYrAHT.exe
  C:\Windows\System\vrYrAHT.exe
  2⤵
  PID:7012
- C:\Windows\System\pVTJJMe.exe
  C:\Windows\System\pVTJJMe.exe
  2⤵
  PID:7048
- C:\Windows\System\lVahSGK.exe
  C:\Windows\System\lVahSGK.exe
  2⤵
  PID:7088
- C:\Windows\System\djLHEfz.exe
  C:\Windows\System\djLHEfz.exe
  2⤵
  PID:7108
- C:\Windows\System\hSttnld.exe
  C:\Windows\System\hSttnld.exe
  2⤵
  PID:7144
- C:\Windows\System\uuZmYNW.exe
  C:\Windows\System\uuZmYNW.exe
  2⤵
  PID:6156
- C:\Windows\System\tVDPXQi.exe
  C:\Windows\System\tVDPXQi.exe
  2⤵
  PID:6196
- C:\Windows\System\JCXzSCC.exe
  C:\Windows\System\JCXzSCC.exe
  2⤵
  PID:6268
- C:\Windows\System\mBhQwnF.exe
  C:\Windows\System\mBhQwnF.exe
  2⤵
  PID:6352
- C:\Windows\System\ZXoHcea.exe
  C:\Windows\System\ZXoHcea.exe
  2⤵
  PID:6388
- C:\Windows\System\hvnxddf.exe
  C:\Windows\System\hvnxddf.exe
  2⤵
  PID:6464
- C:\Windows\System\vFbxMiJ.exe
  C:\Windows\System\vFbxMiJ.exe
  2⤵
  PID:6516
- C:\Windows\System\mAlIhev.exe
  C:\Windows\System\mAlIhev.exe
  2⤵
  PID:6576
- C:\Windows\System\ANEDxVe.exe
  C:\Windows\System\ANEDxVe.exe
  2⤵
  PID:6660
- C:\Windows\System\aMbCcaX.exe
  C:\Windows\System\aMbCcaX.exe
  2⤵
  PID:6732
- C:\Windows\System\OnMBTxH.exe
  C:\Windows\System\OnMBTxH.exe
  2⤵
  PID:6804
- C:\Windows\System\dFeZeBS.exe
  C:\Windows\System\dFeZeBS.exe
  2⤵
  PID:6872
- C:\Windows\System\GfEXpUO.exe
  C:\Windows\System\GfEXpUO.exe
  2⤵
  PID:6928
- C:\Windows\System\EjTPJbG.exe
  C:\Windows\System\EjTPJbG.exe
  2⤵
  PID:7008
- C:\Windows\System\TAGkNqY.exe
  C:\Windows\System\TAGkNqY.exe
  2⤵
  PID:7068
- C:\Windows\System\sfuksfL.exe
  C:\Windows\System\sfuksfL.exe
  2⤵
  PID:7116
- C:\Windows\System\jjbTbpi.exe
  C:\Windows\System\jjbTbpi.exe
  2⤵
  PID:6244
- C:\Windows\System\VIlsLCp.exe
  C:\Windows\System\VIlsLCp.exe
  2⤵
  PID:6444
- C:\Windows\System\YhlBimE.exe
  C:\Windows\System\YhlBimE.exe
  2⤵
  PID:6544
- C:\Windows\System\SYuMlVj.exe
  C:\Windows\System\SYuMlVj.exe
  2⤵
  PID:6692
- C:\Windows\System\VeDJiHm.exe
  C:\Windows\System\VeDJiHm.exe
  2⤵
  PID:6892
- C:\Windows\System\luoOmzA.exe
  C:\Windows\System\luoOmzA.exe
  2⤵
  PID:7032
- C:\Windows\System\HdiAkSq.exe
  C:\Windows\System\HdiAkSq.exe
  2⤵
  PID:6220
- C:\Windows\System\qHbdJwK.exe
  C:\Windows\System\qHbdJwK.exe
  2⤵
  PID:6536
- C:\Windows\System\xZUGEtn.exe
  C:\Windows\System\xZUGEtn.exe
  2⤵
  PID:6924
- C:\Windows\System\HpouSaA.exe
  C:\Windows\System\HpouSaA.exe
  2⤵
  PID:6448
- C:\Windows\System\vgncuFm.exe
  C:\Windows\System\vgncuFm.exe
  2⤵
  PID:6832
- C:\Windows\System\QYYsOSV.exe
  C:\Windows\System\QYYsOSV.exe
  2⤵
  PID:7196
- C:\Windows\System\YALsAxa.exe
  C:\Windows\System\YALsAxa.exe
  2⤵
  PID:7224
- C:\Windows\System\EyxHxFE.exe
  C:\Windows\System\EyxHxFE.exe
  2⤵
  PID:7252
- C:\Windows\System\kCDpKtO.exe
  C:\Windows\System\kCDpKtO.exe
  2⤵
  PID:7284
- C:\Windows\System\UuAICRc.exe
  C:\Windows\System\UuAICRc.exe
  2⤵
  PID:7308
- C:\Windows\System\xAoPmdm.exe
  C:\Windows\System\xAoPmdm.exe
  2⤵
  PID:7336
- C:\Windows\System\gFUwhFt.exe
  C:\Windows\System\gFUwhFt.exe
  2⤵
  PID:7364
- C:\Windows\System\INoKWok.exe
  C:\Windows\System\INoKWok.exe
  2⤵
  PID:7392
- C:\Windows\System\RvSsdTb.exe
  C:\Windows\System\RvSsdTb.exe
  2⤵
  PID:7408
- C:\Windows\System\emRTwgQ.exe
  C:\Windows\System\emRTwgQ.exe
  2⤵
  PID:7436
- C:\Windows\System\RBjeTny.exe
  C:\Windows\System\RBjeTny.exe
  2⤵
  PID:7476
- C:\Windows\System\zkfuLEI.exe
  C:\Windows\System\zkfuLEI.exe
  2⤵
  PID:7504
- C:\Windows\System\FCZEPkk.exe
  C:\Windows\System\FCZEPkk.exe
  2⤵
  PID:7536
- C:\Windows\System\GqTlrrc.exe
  C:\Windows\System\GqTlrrc.exe
  2⤵
  PID:7564
- C:\Windows\System\gqPRpRf.exe
  C:\Windows\System\gqPRpRf.exe
  2⤵
  PID:7592
- C:\Windows\System\Ipcagtc.exe
  C:\Windows\System\Ipcagtc.exe
  2⤵
  PID:7620
- C:\Windows\System\mHIFnLk.exe
  C:\Windows\System\mHIFnLk.exe
  2⤵
  PID:7648
- C:\Windows\System\yZKggtV.exe
  C:\Windows\System\yZKggtV.exe
  2⤵
  PID:7668
- C:\Windows\System\QIigowm.exe
  C:\Windows\System\QIigowm.exe
  2⤵
  PID:7708
- C:\Windows\System\EwSjBSL.exe
  C:\Windows\System\EwSjBSL.exe
  2⤵
  PID:7736
- C:\Windows\System\tiImRPu.exe
  C:\Windows\System\tiImRPu.exe
  2⤵
  PID:7752
- C:\Windows\System\TrOAItv.exe
  C:\Windows\System\TrOAItv.exe
  2⤵
  PID:7792
- C:\Windows\System\ObjccUX.exe
  C:\Windows\System\ObjccUX.exe
  2⤵
  PID:7820
- C:\Windows\System\mJLwIDd.exe
  C:\Windows\System\mJLwIDd.exe
  2⤵
  PID:7848
- C:\Windows\System\SfcnLWO.exe
  C:\Windows\System\SfcnLWO.exe
  2⤵
  PID:7864
- C:\Windows\System\crfbUNQ.exe
  C:\Windows\System\crfbUNQ.exe
  2⤵
  PID:7884
- C:\Windows\System\fytjFaE.exe
  C:\Windows\System\fytjFaE.exe
  2⤵
  PID:7920
- C:\Windows\System\yWmgiVi.exe
  C:\Windows\System\yWmgiVi.exe
  2⤵
  PID:7956
- C:\Windows\System\WIWVEPX.exe
  C:\Windows\System\WIWVEPX.exe
  2⤵
  PID:7988
- C:\Windows\System\osjamgq.exe
  C:\Windows\System\osjamgq.exe
  2⤵
  PID:8016
- C:\Windows\System\zinWtbL.exe
  C:\Windows\System\zinWtbL.exe
  2⤵
  PID:8048
- C:\Windows\System\isLMXww.exe
  C:\Windows\System\isLMXww.exe
  2⤵
  PID:8072
- C:\Windows\System\MlkGxaC.exe
  C:\Windows\System\MlkGxaC.exe
  2⤵
  PID:8100
- C:\Windows\System\nPFgtxn.exe
  C:\Windows\System\nPFgtxn.exe
  2⤵
  PID:8136
- C:\Windows\System\DINiulS.exe
  C:\Windows\System\DINiulS.exe
  2⤵
  PID:8164
- C:\Windows\System\AbUuEsn.exe
  C:\Windows\System\AbUuEsn.exe
  2⤵
  PID:8180
- C:\Windows\System\mJEsKUH.exe
  C:\Windows\System\mJEsKUH.exe
  2⤵
  PID:7180
- C:\Windows\System\OYDCbIr.exe
  C:\Windows\System\OYDCbIr.exe
  2⤵
  PID:7276
- C:\Windows\System\ZAokxQV.exe
  C:\Windows\System\ZAokxQV.exe
  2⤵
  PID:7332
- C:\Windows\System\SYcNPRR.exe
  C:\Windows\System\SYcNPRR.exe
  2⤵
  PID:7400
- C:\Windows\System\FMbZOxQ.exe
  C:\Windows\System\FMbZOxQ.exe
  2⤵
  PID:7460
- C:\Windows\System\CfYiBsN.exe
  C:\Windows\System\CfYiBsN.exe
  2⤵
  PID:7528
- C:\Windows\System\udCqokR.exe
  C:\Windows\System\udCqokR.exe
  2⤵
  PID:7588
- C:\Windows\System\iVJbnsX.exe
  C:\Windows\System\iVJbnsX.exe
  2⤵
  PID:7632
- C:\Windows\System\iwujGcA.exe
  C:\Windows\System\iwujGcA.exe
  2⤵
  PID:7700
- C:\Windows\System\RfQxDrf.exe
  C:\Windows\System\RfQxDrf.exe
  2⤵
  PID:7776
- C:\Windows\System\SzCpJkT.exe
  C:\Windows\System\SzCpJkT.exe
  2⤵
  PID:7840
- C:\Windows\System\SAFPmVQ.exe
  C:\Windows\System\SAFPmVQ.exe
  2⤵
  PID:7932
- C:\Windows\System\ECWtUvr.exe
  C:\Windows\System\ECWtUvr.exe
  2⤵
  PID:8008
- C:\Windows\System\QvYhPfT.exe
  C:\Windows\System\QvYhPfT.exe
  2⤵
  PID:8040
- C:\Windows\System\LsdAocc.exe
  C:\Windows\System\LsdAocc.exe
  2⤵
  PID:8148
- C:\Windows\System\WWFTDtc.exe
  C:\Windows\System\WWFTDtc.exe
  2⤵
  PID:7192
- C:\Windows\System\vwNpJwb.exe
  C:\Windows\System\vwNpJwb.exe
  2⤵
  PID:7360
- C:\Windows\System\yeHZPWk.exe
  C:\Windows\System\yeHZPWk.exe
  2⤵
  PID:7420
- C:\Windows\System\BuEVAOm.exe
  C:\Windows\System\BuEVAOm.exe
  2⤵
  PID:7496
- C:\Windows\System\grHAItn.exe
  C:\Windows\System\grHAItn.exe
  2⤵
  PID:7616
- C:\Windows\System\VOPEGdf.exe
  C:\Windows\System\VOPEGdf.exe
  2⤵
  PID:7872
- C:\Windows\System\UcbexGU.exe
  C:\Windows\System\UcbexGU.exe
  2⤵
  PID:8028
- C:\Windows\System\wCfKtGc.exe
  C:\Windows\System\wCfKtGc.exe
  2⤵
  PID:7220
- C:\Windows\System\GMCWzIs.exe
  C:\Windows\System\GMCWzIs.exe
  2⤵
  PID:7576
- C:\Windows\System\ynDxKXw.exe
  C:\Windows\System\ynDxKXw.exe
  2⤵
  PID:7916
- C:\Windows\System\ZDdJoPs.exe
  C:\Windows\System\ZDdJoPs.exe
  2⤵
  PID:7320
- C:\Windows\System\dsPvLNu.exe
  C:\Windows\System\dsPvLNu.exe
  2⤵
  PID:8204
- C:\Windows\System\PSrzjyc.exe
  C:\Windows\System\PSrzjyc.exe
  2⤵
  PID:8224
- C:\Windows\System\TSxeaxX.exe
  C:\Windows\System\TSxeaxX.exe
  2⤵
  PID:8240
- C:\Windows\System\HMeIhNp.exe
  C:\Windows\System\HMeIhNp.exe
  2⤵
  PID:8264
- C:\Windows\System\mmUoxeJ.exe
  C:\Windows\System\mmUoxeJ.exe
  2⤵
  PID:8280
- C:\Windows\System\TBuiPlg.exe
  C:\Windows\System\TBuiPlg.exe
  2⤵
  PID:8296
- C:\Windows\System\YyxGxmO.exe
  C:\Windows\System\YyxGxmO.exe
  2⤵
  PID:8316
- C:\Windows\System\jRYJjJf.exe
  C:\Windows\System\jRYJjJf.exe
  2⤵
  PID:8336
- C:\Windows\System\KMkTjDx.exe
  C:\Windows\System\KMkTjDx.exe
  2⤵
  PID:8356
- C:\Windows\System\FlFwodE.exe
  C:\Windows\System\FlFwodE.exe
  2⤵
  PID:8384
- C:\Windows\System\DUYxXfr.exe
  C:\Windows\System\DUYxXfr.exe
  2⤵
  PID:8420
- C:\Windows\System\xKQBBmT.exe
  C:\Windows\System\xKQBBmT.exe
  2⤵
  PID:8460
- C:\Windows\System\IKQBYzb.exe
  C:\Windows\System\IKQBYzb.exe
  2⤵
  PID:8488
- C:\Windows\System\BQgmujR.exe
  C:\Windows\System\BQgmujR.exe
  2⤵
  PID:8508
- C:\Windows\System\dQmXKqu.exe
  C:\Windows\System\dQmXKqu.exe
  2⤵
  PID:8540
- C:\Windows\System\DGnqekm.exe
  C:\Windows\System\DGnqekm.exe
  2⤵
  PID:8572
- C:\Windows\System\QfEyoDt.exe
  C:\Windows\System\QfEyoDt.exe
  2⤵
  PID:8604
- C:\Windows\System\CRYtKFY.exe
  C:\Windows\System\CRYtKFY.exe
  2⤵
  PID:8644
- C:\Windows\System\ycmnDiF.exe
  C:\Windows\System\ycmnDiF.exe
  2⤵
  PID:8680
- C:\Windows\System\gLzPTTs.exe
  C:\Windows\System\gLzPTTs.exe
  2⤵
  PID:8716
- C:\Windows\System\jrQsALV.exe
  C:\Windows\System\jrQsALV.exe
  2⤵
  PID:8752
- C:\Windows\System\vBzXQlG.exe
  C:\Windows\System\vBzXQlG.exe
  2⤵
  PID:8780
- C:\Windows\System\juCqZiD.exe
  C:\Windows\System\juCqZiD.exe
  2⤵
  PID:8816
- C:\Windows\System\EtwwTOd.exe
  C:\Windows\System\EtwwTOd.exe
  2⤵
  PID:8844
- C:\Windows\System\JFBokZv.exe
  C:\Windows\System\JFBokZv.exe
  2⤵
  PID:8860
- C:\Windows\System\OsZPjwR.exe
  C:\Windows\System\OsZPjwR.exe
  2⤵
  PID:8884
- C:\Windows\System\sNwrsZk.exe
  C:\Windows\System\sNwrsZk.exe
  2⤵
  PID:8908
- C:\Windows\System\lAenpJe.exe
  C:\Windows\System\lAenpJe.exe
  2⤵
  PID:8940
- C:\Windows\System\oCGaylM.exe
  C:\Windows\System\oCGaylM.exe
  2⤵
  PID:8976
- C:\Windows\System\glFhoop.exe
  C:\Windows\System\glFhoop.exe
  2⤵
  PID:9004
- C:\Windows\System\fKadrun.exe
  C:\Windows\System\fKadrun.exe
  2⤵
  PID:9024
- C:\Windows\System\EMIcWZA.exe
  C:\Windows\System\EMIcWZA.exe
  2⤵
  PID:9044
- C:\Windows\System\RPvDLdk.exe
  C:\Windows\System\RPvDLdk.exe
  2⤵
  PID:9060
- C:\Windows\System\YJFFHld.exe
  C:\Windows\System\YJFFHld.exe
  2⤵
  PID:9088
- C:\Windows\System\drMCTpj.exe
  C:\Windows\System\drMCTpj.exe
  2⤵
  PID:9112
- C:\Windows\System\fdKIpgI.exe
  C:\Windows\System\fdKIpgI.exe
  2⤵
  PID:9136
- C:\Windows\System\BuMAjMB.exe
  C:\Windows\System\BuMAjMB.exe
  2⤵
  PID:9176
- C:\Windows\System\AwpwTEY.exe
  C:\Windows\System\AwpwTEY.exe
  2⤵
  PID:9208
- C:\Windows\System\BdFURjs.exe
  C:\Windows\System\BdFURjs.exe
  2⤵
  PID:8200
- C:\Windows\System\pwAKWUb.exe
  C:\Windows\System\pwAKWUb.exe
  2⤵
  PID:7660
- C:\Windows\System\DrmSejF.exe
  C:\Windows\System\DrmSejF.exe
  2⤵
  PID:8324
- C:\Windows\System\iAVbpIe.exe
  C:\Windows\System\iAVbpIe.exe
  2⤵
  PID:8412
- C:\Windows\System\KCddcQg.exe
  C:\Windows\System\KCddcQg.exe
  2⤵
  PID:8564
- C:\Windows\System\okdvqMJ.exe
  C:\Windows\System\okdvqMJ.exe
  2⤵
  PID:8588
- C:\Windows\System\XBNSDEi.exe
  C:\Windows\System\XBNSDEi.exe
  2⤵
  PID:8652
- C:\Windows\System\LpQBiVI.exe
  C:\Windows\System\LpQBiVI.exe
  2⤵
  PID:8732
- C:\Windows\System\qJsjOWY.exe
  C:\Windows\System\qJsjOWY.exe
  2⤵
  PID:8832
- C:\Windows\System\dVQCnxv.exe
  C:\Windows\System\dVQCnxv.exe
  2⤵
  PID:8892
- C:\Windows\System\nPsjpuf.exe
  C:\Windows\System\nPsjpuf.exe
  2⤵
  PID:8936
- C:\Windows\System\JnrYfBr.exe
  C:\Windows\System\JnrYfBr.exe
  2⤵
  PID:9016
- C:\Windows\System\uPBYeCX.exe
  C:\Windows\System\uPBYeCX.exe
  2⤵
  PID:9096
- C:\Windows\System\zEygURk.exe
  C:\Windows\System\zEygURk.exe
  2⤵
  PID:9132
- C:\Windows\System\dsjAtGY.exe
  C:\Windows\System\dsjAtGY.exe
  2⤵
  PID:9204
- C:\Windows\System\RijckEh.exe
  C:\Windows\System\RijckEh.exe
  2⤵
  PID:9200
- C:\Windows\System\zVuYwgU.exe
  C:\Windows\System\zVuYwgU.exe
  2⤵
  PID:8404
- C:\Windows\System\BXDzwnp.exe
  C:\Windows\System\BXDzwnp.exe
  2⤵
  PID:8700
- C:\Windows\System\HwhYMIb.exe
  C:\Windows\System\HwhYMIb.exe
  2⤵
  PID:8872
- C:\Windows\System\brGfHIE.exe
  C:\Windows\System\brGfHIE.exe
  2⤵
  PID:9040
- C:\Windows\System\ftkHIOV.exe
  C:\Windows\System\ftkHIOV.exe
  2⤵
  PID:9084
- C:\Windows\System\EhlmWEG.exe
  C:\Windows\System\EhlmWEG.exe
  2⤵
  PID:8372
- C:\Windows\System\PJvutpj.exe
  C:\Windows\System\PJvutpj.exe
  2⤵
  PID:8704
- C:\Windows\System\LfEBscr.exe
  C:\Windows\System\LfEBscr.exe
  2⤵
  PID:9012
- C:\Windows\System\kwAeCVn.exe
  C:\Windows\System\kwAeCVn.exe
  2⤵
  PID:8260
- C:\Windows\System\UrqDVCz.exe
  C:\Windows\System\UrqDVCz.exe
  2⤵
  PID:8924
- C:\Windows\System\DwMysDU.exe
  C:\Windows\System\DwMysDU.exe
  2⤵
  PID:9240
- C:\Windows\System\iyiaqnL.exe
  C:\Windows\System\iyiaqnL.exe
  2⤵
  PID:9264
- C:\Windows\System\NvzHLKf.exe
  C:\Windows\System\NvzHLKf.exe
  2⤵
  PID:9300
- C:\Windows\System\zZAVekg.exe
  C:\Windows\System\zZAVekg.exe
  2⤵
  PID:9344
- C:\Windows\System\jljRfUN.exe
  C:\Windows\System\jljRfUN.exe
  2⤵
  PID:9372
- C:\Windows\System\oZvAwgX.exe
  C:\Windows\System\oZvAwgX.exe
  2⤵
  PID:9388
- C:\Windows\System\VKFeHmD.exe
  C:\Windows\System\VKFeHmD.exe
  2⤵
  PID:9416
- C:\Windows\System\fNEvktS.exe
  C:\Windows\System\fNEvktS.exe
  2⤵
  PID:9444
- C:\Windows\System\aASFrTF.exe
  C:\Windows\System\aASFrTF.exe
  2⤵
  PID:9484
- C:\Windows\System\xXWCGev.exe
  C:\Windows\System\xXWCGev.exe
  2⤵
  PID:9512
- C:\Windows\System\oPCaKYd.exe
  C:\Windows\System\oPCaKYd.exe
  2⤵
  PID:9532
- C:\Windows\System\RzgtNAS.exe
  C:\Windows\System\RzgtNAS.exe
  2⤵
  PID:9556
- C:\Windows\System\vqlrKwa.exe
  C:\Windows\System\vqlrKwa.exe
  2⤵
  PID:9592
- C:\Windows\System\EkCsAVP.exe
  C:\Windows\System\EkCsAVP.exe
  2⤵
  PID:9624
- C:\Windows\System\yfCUsXp.exe
  C:\Windows\System\yfCUsXp.exe
  2⤵
  PID:9656
- C:\Windows\System\rsPHiAX.exe
  C:\Windows\System\rsPHiAX.exe
  2⤵
  PID:9684
- C:\Windows\System\yRTMiEP.exe
  C:\Windows\System\yRTMiEP.exe
  2⤵
  PID:9712
- C:\Windows\System\nMXMtRW.exe
  C:\Windows\System\nMXMtRW.exe
  2⤵
  PID:9740
- C:\Windows\System\KbMUkRv.exe
  C:\Windows\System\KbMUkRv.exe
  2⤵
  PID:9768
- C:\Windows\System\ASqzGZb.exe
  C:\Windows\System\ASqzGZb.exe
  2⤵
  PID:9796
- C:\Windows\System\dnuQBLC.exe
  C:\Windows\System\dnuQBLC.exe
  2⤵
  PID:9824
- C:\Windows\System\TmVhfGp.exe
  C:\Windows\System\TmVhfGp.exe
  2⤵
  PID:9852
- C:\Windows\System\CUmwwDM.exe
  C:\Windows\System\CUmwwDM.exe
  2⤵
  PID:9868
- C:\Windows\System\BpCUXvM.exe
  C:\Windows\System\BpCUXvM.exe
  2⤵
  PID:9908
- C:\Windows\System\BsJewVA.exe
  C:\Windows\System\BsJewVA.exe
  2⤵
  PID:9940
- C:\Windows\System\MKcxWOv.exe
  C:\Windows\System\MKcxWOv.exe
  2⤵
  PID:9968
- C:\Windows\System\miiCmYr.exe
  C:\Windows\System\miiCmYr.exe
  2⤵
  PID:9996
- C:\Windows\System\oPLuuQY.exe
  C:\Windows\System\oPLuuQY.exe
  2⤵
  PID:10024
- C:\Windows\System\EAkoNVO.exe
  C:\Windows\System\EAkoNVO.exe
  2⤵
  PID:10052
- C:\Windows\System\nIaHBRn.exe
  C:\Windows\System\nIaHBRn.exe
  2⤵
  PID:10080
- C:\Windows\System\hqJQEfM.exe
  C:\Windows\System\hqJQEfM.exe
  2⤵
  PID:10108
- C:\Windows\System\euVCcio.exe
  C:\Windows\System\euVCcio.exe
  2⤵
  PID:10124
- C:\Windows\System\fpJDJXc.exe
  C:\Windows\System\fpJDJXc.exe
  2⤵
  PID:10156
- C:\Windows\System\ZcbyALj.exe
  C:\Windows\System\ZcbyALj.exe
  2⤵
  PID:10180
- C:\Windows\System\QHXZruD.exe
  C:\Windows\System\QHXZruD.exe
  2⤵
  PID:10208
- C:\Windows\System\EwQujDF.exe
  C:\Windows\System\EwQujDF.exe
  2⤵
  PID:8616
- C:\Windows\System\VmAsJka.exe
  C:\Windows\System\VmAsJka.exe
  2⤵
  PID:9284
- C:\Windows\System\aufbWGN.exe
  C:\Windows\System\aufbWGN.exe
  2⤵
  PID:9364
- C:\Windows\System\gJDijkq.exe
  C:\Windows\System\gJDijkq.exe
  2⤵
  PID:9428
- C:\Windows\System\PfymuwZ.exe
  C:\Windows\System\PfymuwZ.exe
  2⤵
  PID:9496
- C:\Windows\System\lnDqilJ.exe
  C:\Windows\System\lnDqilJ.exe
  2⤵
  PID:9548
- C:\Windows\System\qQzkAoC.exe
  C:\Windows\System\qQzkAoC.exe
  2⤵
  PID:9612
- C:\Windows\System\LPPikLb.exe
  C:\Windows\System\LPPikLb.exe
  2⤵
  PID:9648
- C:\Windows\System\OVliliw.exe
  C:\Windows\System\OVliliw.exe
  2⤵
  PID:9724
- C:\Windows\System\bQRqghI.exe
  C:\Windows\System\bQRqghI.exe
  2⤵
  PID:9788
- C:\Windows\System\wxamAQa.exe
  C:\Windows\System\wxamAQa.exe
  2⤵
  PID:9880
- C:\Windows\System\wfQYmeB.exe
  C:\Windows\System\wfQYmeB.exe
  2⤵
  PID:9952
- C:\Windows\System\kksjTFA.exe
  C:\Windows\System\kksjTFA.exe
  2⤵
  PID:9988
- C:\Windows\System\hLkiFyb.exe
  C:\Windows\System\hLkiFyb.exe
  2⤵
  PID:10076
- C:\Windows\System\MpxIkqs.exe
  C:\Windows\System\MpxIkqs.exe
  2⤵
  PID:10164
- C:\Windows\System\fdtbGqx.exe
  C:\Windows\System\fdtbGqx.exe
  2⤵
  PID:10232
- C:\Windows\System\zBSJpqm.exe
  C:\Windows\System\zBSJpqm.exe
  2⤵
  PID:9296
- C:\Windows\System\bmpbiMH.exe
  C:\Windows\System\bmpbiMH.exe
  2⤵
  PID:9440
- C:\Windows\System\ammOklq.exe
  C:\Windows\System\ammOklq.exe
  2⤵
  PID:9588
- C:\Windows\System\BvGBTzZ.exe
  C:\Windows\System\BvGBTzZ.exe
  2⤵
  PID:9696
- C:\Windows\System\jzKxfMf.exe
  C:\Windows\System\jzKxfMf.exe
  2⤵
  PID:9916
- C:\Windows\System\RQQpLeo.exe
  C:\Windows\System\RQQpLeo.exe
  2⤵
  PID:9992
- C:\Windows\System\RuwxoIv.exe
  C:\Windows\System\RuwxoIv.exe
  2⤵
  PID:10100
- C:\Windows\System\JUFSTLd.exe
  C:\Windows\System\JUFSTLd.exe
  2⤵
  PID:10220
- C:\Windows\System\hgRjusN.exe
  C:\Windows\System\hgRjusN.exe
  2⤵
  PID:9552
- C:\Windows\System\NXiSGNQ.exe
  C:\Windows\System\NXiSGNQ.exe
  2⤵
  PID:9960
- C:\Windows\System\ZWgOFrd.exe
  C:\Windows\System\ZWgOFrd.exe
  2⤵
  PID:9356
- C:\Windows\System\zasJJWq.exe
  C:\Windows\System\zasJJWq.exe
  2⤵
  PID:9520
- C:\Windows\System\efHVTZk.exe
  C:\Windows\System\efHVTZk.exe
  2⤵
  PID:10260
- C:\Windows\System\mMLGXUq.exe
  C:\Windows\System\mMLGXUq.exe
  2⤵
  PID:10284
- C:\Windows\System\coqpCFd.exe
  C:\Windows\System\coqpCFd.exe
  2⤵
  PID:10312
- C:\Windows\System\izVkYie.exe
  C:\Windows\System\izVkYie.exe
  2⤵
  PID:10340
- C:\Windows\System\dKfPSZb.exe
  C:\Windows\System\dKfPSZb.exe
  2⤵
  PID:10368
- C:\Windows\System\bzSSWSj.exe
  C:\Windows\System\bzSSWSj.exe
  2⤵
  PID:10412
- C:\Windows\System\mJrQsym.exe
  C:\Windows\System\mJrQsym.exe
  2⤵
  PID:10440
- C:\Windows\System\LjXnxoh.exe
  C:\Windows\System\LjXnxoh.exe
  2⤵
  PID:10468
- C:\Windows\System\HwYoHOz.exe
  C:\Windows\System\HwYoHOz.exe
  2⤵
  PID:10496
- C:\Windows\System\TMqrviN.exe
  C:\Windows\System\TMqrviN.exe
  2⤵
  PID:10512
- C:\Windows\System\UboLWZk.exe
  C:\Windows\System\UboLWZk.exe
  2⤵
  PID:10552
- C:\Windows\System\QqICvNI.exe
  C:\Windows\System\QqICvNI.exe
  2⤵
  PID:10572
- C:\Windows\System\bFHKEcO.exe
  C:\Windows\System\bFHKEcO.exe
  2⤵
  PID:10596
- C:\Windows\System\gMXpJNT.exe
  C:\Windows\System\gMXpJNT.exe
  2⤵
  PID:10636
- C:\Windows\System\kZzrSuF.exe
  C:\Windows\System\kZzrSuF.exe
  2⤵
  PID:10660
- C:\Windows\System\UjrThiM.exe
  C:\Windows\System\UjrThiM.exe
  2⤵
  PID:10680
- C:\Windows\System\BdDYzai.exe
  C:\Windows\System\BdDYzai.exe
  2⤵
  PID:10720
- C:\Windows\System\EIUoznR.exe
  C:\Windows\System\EIUoznR.exe
  2⤵
  PID:10736
- C:\Windows\System\bNjWhTa.exe
  C:\Windows\System\bNjWhTa.exe
  2⤵
  PID:10772
- C:\Windows\System\hlGZGtg.exe
  C:\Windows\System\hlGZGtg.exe
  2⤵
  PID:10808
- C:\Windows\System\ltPNMVz.exe
  C:\Windows\System\ltPNMVz.exe
  2⤵
  PID:10840
- C:\Windows\System\ibZTXnq.exe
  C:\Windows\System\ibZTXnq.exe
  2⤵
  PID:10868
- C:\Windows\System\cgaIMzA.exe
  C:\Windows\System\cgaIMzA.exe
  2⤵
  PID:10896
- C:\Windows\System\uSNHyrJ.exe
  C:\Windows\System\uSNHyrJ.exe
  2⤵
  PID:10924
- C:\Windows\System\AIYHcJS.exe
  C:\Windows\System\AIYHcJS.exe
  2⤵
  PID:10940
- C:\Windows\System\GLnxzLS.exe
  C:\Windows\System\GLnxzLS.exe
  2⤵
  PID:10956
- C:\Windows\System\abuncgY.exe
  C:\Windows\System\abuncgY.exe
  2⤵
  PID:10992
- C:\Windows\System\DyXhKnk.exe
  C:\Windows\System\DyXhKnk.exe
  2⤵
  PID:11024
- C:\Windows\System\rJmZiWD.exe
  C:\Windows\System\rJmZiWD.exe
  2⤵
  PID:11052
- C:\Windows\System\UtSCYVV.exe
  C:\Windows\System\UtSCYVV.exe
  2⤵
  PID:11080
- C:\Windows\System\oxZqFKC.exe
  C:\Windows\System\oxZqFKC.exe
  2⤵
  PID:11120
- C:\Windows\System\hdiYhvI.exe
  C:\Windows\System\hdiYhvI.exe
  2⤵
  PID:11136
- C:\Windows\System\sTyMqDO.exe
  C:\Windows\System\sTyMqDO.exe
  2⤵
  PID:11176
- C:\Windows\System\jYSEOvo.exe
  C:\Windows\System\jYSEOvo.exe
  2⤵
  PID:11192
- C:\Windows\System\lGIuzFQ.exe
  C:\Windows\System\lGIuzFQ.exe
  2⤵
  PID:11220
- C:\Windows\System\rajILHE.exe
  C:\Windows\System\rajILHE.exe
  2⤵
  PID:11260
- C:\Windows\System\yExxhzT.exe
  C:\Windows\System\yExxhzT.exe
  2⤵
  PID:10268
- C:\Windows\System\JNvNJJN.exe
  C:\Windows\System\JNvNJJN.exe
  2⤵
  PID:10352
- C:\Windows\System\EpHIPDa.exe
  C:\Windows\System\EpHIPDa.exe
  2⤵
  PID:10424
- C:\Windows\System\ArQyojY.exe
  C:\Windows\System\ArQyojY.exe
  2⤵
  PID:10492
- C:\Windows\System\cRABsCS.exe
  C:\Windows\System\cRABsCS.exe
  2⤵
  PID:10584
- C:\Windows\System\YfOsmFJ.exe
  C:\Windows\System\YfOsmFJ.exe
  2⤵
  PID:10608
- C:\Windows\System\ASgFohM.exe
  C:\Windows\System\ASgFohM.exe
  2⤵
  PID:10644
- C:\Windows\System\qDtudro.exe
  C:\Windows\System\qDtudro.exe
  2⤵
  PID:10716
- C:\Windows\System\KDHCQEA.exe
  C:\Windows\System\KDHCQEA.exe
  2⤵
  PID:10804
- C:\Windows\System\WKIChOI.exe
  C:\Windows\System\WKIChOI.exe
  2⤵
  PID:10852
- C:\Windows\System\jKaQqSr.exe
  C:\Windows\System\jKaQqSr.exe
  2⤵
  PID:10936
- C:\Windows\System\fFqUsAK.exe
  C:\Windows\System\fFqUsAK.exe
  2⤵
  PID:10980
- C:\Windows\System\PjZXxZQ.exe
  C:\Windows\System\PjZXxZQ.exe
  2⤵
  PID:11064
- C:\Windows\System\wQGWgRs.exe
  C:\Windows\System\wQGWgRs.exe
  2⤵
  PID:11128
- C:\Windows\System\RdupDfL.exe
  C:\Windows\System\RdupDfL.exe
  2⤵
  PID:11184
- C:\Windows\System\DDVmrud.exe
  C:\Windows\System\DDVmrud.exe
  2⤵
  PID:11256
- C:\Windows\System\ATlYsdr.exe
  C:\Windows\System\ATlYsdr.exe
  2⤵
  PID:10400
- C:\Windows\System\zqkrRmn.exe
  C:\Windows\System\zqkrRmn.exe
  2⤵
  PID:10508
- C:\Windows\System\LSoCQsz.exe
  C:\Windows\System\LSoCQsz.exe
  2⤵
  PID:10692
- C:\Windows\System\EZrXJwC.exe
  C:\Windows\System\EZrXJwC.exe
  2⤵
  PID:10824
- C:\Windows\System\IWDSfSs.exe
  C:\Windows\System\IWDSfSs.exe
  2⤵
  PID:10908
- C:\Windows\System\NvWDqxV.exe
  C:\Windows\System\NvWDqxV.exe
  2⤵
  PID:10984
- C:\Windows\System\XMmbdNE.exe
  C:\Windows\System\XMmbdNE.exe
  2⤵
  PID:11188
- C:\Windows\System\JJSdbRE.exe
  C:\Windows\System\JJSdbRE.exe
  2⤵
  PID:10480
- C:\Windows\System\THzmyfP.exe
  C:\Windows\System\THzmyfP.exe
  2⤵
  PID:10756
- C:\Windows\System\RveaIpT.exe
  C:\Windows\System\RveaIpT.exe
  2⤵
  PID:11108
- C:\Windows\System\QPeYRtY.exe
  C:\Windows\System\QPeYRtY.exe
  2⤵
  PID:10972
- C:\Windows\System\PwCeclE.exe
  C:\Windows\System\PwCeclE.exe
  2⤵
  PID:11276
- C:\Windows\System\TJxXGlD.exe
  C:\Windows\System\TJxXGlD.exe
  2⤵
  PID:11312
- C:\Windows\System\TJRVxPd.exe
  C:\Windows\System\TJRVxPd.exe
  2⤵
  PID:11344
- C:\Windows\System\WqGPrUx.exe
  C:\Windows\System\WqGPrUx.exe
  2⤵
  PID:11360
- C:\Windows\System\KlTgosy.exe
  C:\Windows\System\KlTgosy.exe
  2⤵
  PID:11392
- C:\Windows\System\jYZneNH.exe
  C:\Windows\System\jYZneNH.exe
  2⤵
  PID:11428
- C:\Windows\System\bkyimVb.exe
  C:\Windows\System\bkyimVb.exe
  2⤵
  PID:11456
- C:\Windows\System\FaslPCV.exe
  C:\Windows\System\FaslPCV.exe
  2⤵
  PID:11484
- C:\Windows\System\ZkjdFtD.exe
  C:\Windows\System\ZkjdFtD.exe
  2⤵
  PID:11512
- C:\Windows\System\WlQlbTy.exe
  C:\Windows\System\WlQlbTy.exe
  2⤵
  PID:11540
- C:\Windows\System\hNIMqfN.exe
  C:\Windows\System\hNIMqfN.exe
  2⤵
  PID:11556
- C:\Windows\System\KLtwHQy.exe
  C:\Windows\System\KLtwHQy.exe
  2⤵
  PID:11584
- C:\Windows\System\vSuBgLe.exe
  C:\Windows\System\vSuBgLe.exe
  2⤵
  PID:11624
- C:\Windows\System\hroJGSJ.exe
  C:\Windows\System\hroJGSJ.exe
  2⤵
  PID:11644
- C:\Windows\System\sFhSxKX.exe
  C:\Windows\System\sFhSxKX.exe
  2⤵
  PID:11668
- C:\Windows\System\tiCArRW.exe
  C:\Windows\System\tiCArRW.exe
  2⤵
  PID:11684
- C:\Windows\System\MfObxsH.exe
  C:\Windows\System\MfObxsH.exe
  2⤵
  PID:11720
- C:\Windows\System\bBQNyUr.exe
  C:\Windows\System\bBQNyUr.exe
  2⤵
  PID:11752
- C:\Windows\System\krzlPZU.exe
  C:\Windows\System\krzlPZU.exe
  2⤵
  PID:11780
- C:\Windows\System\alPEaEE.exe
  C:\Windows\System\alPEaEE.exe
  2⤵
  PID:11808
- C:\Windows\System\feQVKlL.exe
  C:\Windows\System\feQVKlL.exe
  2⤵
  PID:11840
- C:\Windows\System\ihOlNIO.exe
  C:\Windows\System\ihOlNIO.exe
  2⤵
  PID:11872
- C:\Windows\System\SJrWyMr.exe
  C:\Windows\System\SJrWyMr.exe
  2⤵
  PID:11892
- C:\Windows\System\jzRhNBT.exe
  C:\Windows\System\jzRhNBT.exe
  2⤵
  PID:11920
- C:\Windows\System\HcRcjZe.exe
  C:\Windows\System\HcRcjZe.exe
  2⤵
  PID:11956
- C:\Windows\System\DWuyfAm.exe
  C:\Windows\System\DWuyfAm.exe
  2⤵
  PID:11976
- C:\Windows\System\wXIuoYf.exe
  C:\Windows\System\wXIuoYf.exe
  2⤵
  PID:12004
- C:\Windows\System\HGpVyvO.exe
  C:\Windows\System\HGpVyvO.exe
  2⤵
  PID:12044
- C:\Windows\System\fYkffYw.exe
  C:\Windows\System\fYkffYw.exe
  2⤵
  PID:12072
- C:\Windows\System\wlAnRSu.exe
  C:\Windows\System\wlAnRSu.exe
  2⤵
  PID:12100
- C:\Windows\System\edjHpqP.exe
  C:\Windows\System\edjHpqP.exe
  2⤵
  PID:12128
- C:\Windows\System\BNHwBIY.exe
  C:\Windows\System\BNHwBIY.exe
  2⤵
  PID:12156
- C:\Windows\System\OOBlVGp.exe
  C:\Windows\System\OOBlVGp.exe
  2⤵
  PID:12172
- C:\Windows\System\YOLRGaz.exe
  C:\Windows\System\YOLRGaz.exe
  2⤵
  PID:12204
- C:\Windows\System\MvEvOtl.exe
  C:\Windows\System\MvEvOtl.exe
  2⤵
  PID:12240
- C:\Windows\System\EvuCmcD.exe
  C:\Windows\System\EvuCmcD.exe
  2⤵
  PID:12268
- C:\Windows\System\IoTyVMg.exe
  C:\Windows\System\IoTyVMg.exe
  2⤵
  PID:11272
- C:\Windows\System\tIoKdzM.exe
  C:\Windows\System\tIoKdzM.exe
  2⤵
  PID:11304
- C:\Windows\System\ATStZWO.exe
  C:\Windows\System\ATStZWO.exe
  2⤵
  PID:11352
- C:\Windows\System\IYdGcfz.exe
  C:\Windows\System\IYdGcfz.exe
  2⤵
  PID:11480
- C:\Windows\System\yADQgha.exe
  C:\Windows\System\yADQgha.exe
  2⤵
  PID:11524
- C:\Windows\System\UCXMOHg.exe
  C:\Windows\System\UCXMOHg.exe
  2⤵
  PID:11572
- C:\Windows\System\IBHXwgO.exe
  C:\Windows\System\IBHXwgO.exe
  2⤵
  PID:11608
- C:\Windows\System\uOCiCis.exe
  C:\Windows\System\uOCiCis.exe
  2⤵
  PID:11656
- C:\Windows\System\pdfBrTf.exe
  C:\Windows\System\pdfBrTf.exe
  2⤵
  PID:11772
- C:\Windows\System\HVygGAD.exe
  C:\Windows\System\HVygGAD.exe
  2⤵
  PID:11792
- C:\Windows\System\cOMlIcH.exe
  C:\Windows\System\cOMlIcH.exe
  2⤵
  PID:11848
- C:\Windows\System\fonsCTF.exe
  C:\Windows\System\fonsCTF.exe
  2⤵
  PID:11880
- C:\Windows\System\XjjdSqu.exe
  C:\Windows\System\XjjdSqu.exe
  2⤵
  PID:12000
- C:\Windows\System\IAxYcZm.exe
  C:\Windows\System\IAxYcZm.exe
  2⤵
  PID:12032
- C:\Windows\System\EVOpliY.exe
  C:\Windows\System\EVOpliY.exe
  2⤵
  PID:12112
- C:\Windows\System\elIQDNl.exe
  C:\Windows\System\elIQDNl.exe
  2⤵
  PID:12192
- C:\Windows\System\LTlIMrr.exe
  C:\Windows\System\LTlIMrr.exe
  2⤵
  PID:12256
- C:\Windows\System\fZJAGXA.exe
  C:\Windows\System\fZJAGXA.exe
  2⤵
  PID:11340
- C:\Windows\System\DyOOEee.exe
  C:\Windows\System\DyOOEee.exe
  2⤵
  PID:11468
- C:\Windows\System\qPogqKI.exe
  C:\Windows\System\qPogqKI.exe
  2⤵
  PID:11508
- C:\Windows\System\UkznaIb.exe
  C:\Windows\System\UkznaIb.exe
  2⤵
  PID:11704
- C:\Windows\System\ADbTgJv.exe
  C:\Windows\System\ADbTgJv.exe
  2⤵
  PID:1080
- C:\Windows\System\tkeGroe.exe
  C:\Windows\System\tkeGroe.exe
  2⤵
  PID:11964
- C:\Windows\System\DEhZYSM.exe
  C:\Windows\System\DEhZYSM.exe
  2⤵
  PID:12096
- C:\Windows\System\xhMwFAs.exe
  C:\Windows\System\xhMwFAs.exe
  2⤵
  PID:12224
- C:\Windows\System\GbwuwFW.exe
  C:\Windows\System\GbwuwFW.exe
  2⤵
  PID:11448
- C:\Windows\System\BiKNnGY.exe
  C:\Windows\System\BiKNnGY.exe
  2⤵
  PID:11496
- C:\Windows\System\cYvEoxH.exe
  C:\Windows\System\cYvEoxH.exe
  2⤵
  PID:11888
- C:\Windows\System\cnqQJnj.exe
  C:\Windows\System\cnqQJnj.exe
  2⤵
  PID:10276
- C:\Windows\System\LWmsmCJ.exe
  C:\Windows\System\LWmsmCJ.exe
  2⤵
  PID:11868
- C:\Windows\System\cvcoPBf.exe
  C:\Windows\System\cvcoPBf.exe
  2⤵
  PID:12316
- C:\Windows\System\WBmVtDv.exe
  C:\Windows\System\WBmVtDv.exe
  2⤵
  PID:12344
- C:\Windows\System\BqhooSF.exe
  C:\Windows\System\BqhooSF.exe
  2⤵
  PID:12360
- C:\Windows\System\njRNIAi.exe
  C:\Windows\System\njRNIAi.exe
  2⤵
  PID:12388
- C:\Windows\System\hSlenct.exe
  C:\Windows\System\hSlenct.exe
  2⤵
  PID:12408
- C:\Windows\System\hDnVyFw.exe
  C:\Windows\System\hDnVyFw.exe
  2⤵
  PID:12432
- C:\Windows\System\iDtFtQi.exe
  C:\Windows\System\iDtFtQi.exe
  2⤵
  PID:12456
- C:\Windows\System\cUIGsdA.exe
  C:\Windows\System\cUIGsdA.exe
  2⤵
  PID:12472
- C:\Windows\System\QakyQnC.exe
  C:\Windows\System\QakyQnC.exe
  2⤵
  PID:12492
- C:\Windows\System\zlTUxbn.exe
  C:\Windows\System\zlTUxbn.exe
  2⤵
  PID:12524
- C:\Windows\System\JGxdTCT.exe
  C:\Windows\System\JGxdTCT.exe
  2⤵
  PID:12556
- C:\Windows\System\ZGvukkF.exe
  C:\Windows\System\ZGvukkF.exe
  2⤵
  PID:12576
- C:\Windows\System\cdjDHdt.exe
  C:\Windows\System\cdjDHdt.exe
  2⤵
  PID:12604
- C:\Windows\System\EADbjnQ.exe
  C:\Windows\System\EADbjnQ.exe
  2⤵
  PID:12632
- C:\Windows\System\YkYtQhN.exe
  C:\Windows\System\YkYtQhN.exe
  2⤵
  PID:12656
- C:\Windows\System\wjwtBfF.exe
  C:\Windows\System\wjwtBfF.exe
  2⤵
  PID:12680
- C:\Windows\System\RHwoqOu.exe
  C:\Windows\System\RHwoqOu.exe
  2⤵
  PID:12708
- C:\Windows\System\tULKdPB.exe
  C:\Windows\System\tULKdPB.exe
  2⤵
  PID:12748
- C:\Windows\System\EGuZGSo.exe
  C:\Windows\System\EGuZGSo.exe
  2⤵
  PID:12772
- C:\Windows\System\BOMqdly.exe
  C:\Windows\System\BOMqdly.exe
  2⤵
  PID:12800
- C:\Windows\System\JJeRDOX.exe
  C:\Windows\System\JJeRDOX.exe
  2⤵
  PID:12828
- C:\Windows\System\OvSshTe.exe
  C:\Windows\System\OvSshTe.exe
  2⤵
  PID:12864
- C:\Windows\System\hwQDQSz.exe
  C:\Windows\System\hwQDQSz.exe
  2⤵
  PID:12892
- C:\Windows\System\kLsdmbo.exe
  C:\Windows\System\kLsdmbo.exe
  2⤵
  PID:12928
- C:\Windows\System\gQrQFsU.exe
  C:\Windows\System\gQrQFsU.exe
  2⤵
  PID:12952
- C:\Windows\System\vjbvlTq.exe
  C:\Windows\System\vjbvlTq.exe
  2⤵
  PID:12980
- C:\Windows\System\KRFCBZW.exe
  C:\Windows\System\KRFCBZW.exe
  2⤵
  PID:13004
- C:\Windows\System\CJnKXZk.exe
  C:\Windows\System\CJnKXZk.exe
  2⤵
  PID:13036
- C:\Windows\System\rbRMWnk.exe
  C:\Windows\System\rbRMWnk.exe
  2⤵
  PID:13056
- C:\Windows\System\AjWjESf.exe
  C:\Windows\System\AjWjESf.exe
  2⤵
  PID:13084
- C:\Windows\System\bDGYoTC.exe
  C:\Windows\System\bDGYoTC.exe
  2⤵
  PID:13112
- C:\Windows\System\UEdKDpl.exe
  C:\Windows\System\UEdKDpl.exe
  2⤵
  PID:13152
- C:\Windows\System\yjtQxDJ.exe
  C:\Windows\System\yjtQxDJ.exe
  2⤵
  PID:13188
- C:\Windows\System\imICzwk.exe
  C:\Windows\System\imICzwk.exe
  2⤵
  PID:13216
- C:\Windows\System\VoIAMXJ.exe
  C:\Windows\System\VoIAMXJ.exe
  2⤵
  PID:13240
- C:\Windows\System\NppcNdS.exe
  C:\Windows\System\NppcNdS.exe
  2⤵
  PID:13276
- C:\Windows\System\aDOYfQl.exe
  C:\Windows\System\aDOYfQl.exe
  2⤵
  PID:13304
- C:\Windows\System\czOOkBs.exe
  C:\Windows\System\czOOkBs.exe
  2⤵
  PID:944
- C:\Windows\System\lLEbbiB.exe
  C:\Windows\System\lLEbbiB.exe
  2⤵
  PID:12328
- C:\Windows\System\IZBzqeh.exe
  C:\Windows\System\IZBzqeh.exe
  2⤵
  PID:12356
- C:\Windows\System\amKsqJy.exe
  C:\Windows\System\amKsqJy.exe
  2⤵
  PID:12384
- C:\Windows\System\eGMCcQR.exe
  C:\Windows\System\eGMCcQR.exe
  2⤵
  PID:12516
- C:\Windows\System\fBGoGkd.exe
  C:\Windows\System\fBGoGkd.exe
  2⤵
  PID:12568
- C:\Windows\System\NNQHbWP.exe
  C:\Windows\System\NNQHbWP.exe
  2⤵
  PID:12620
- C:\Windows\System\lVIYEzw.exe
  C:\Windows\System\lVIYEzw.exe
  2⤵
  PID:12732
- C:\Windows\System\grklJqP.exe
  C:\Windows\System\grklJqP.exe
  2⤵
  PID:12756
- C:\Windows\System\czKrDFI.exe
  C:\Windows\System\czKrDFI.exe
  2⤵
  PID:12908
- C:\Windows\System\dnKnIya.exe
  C:\Windows\System\dnKnIya.exe
  2⤵
  PID:12948
- C:\Windows\System\urcBqGN.exe
  C:\Windows\System\urcBqGN.exe
  2⤵
  PID:12944
- C:\Windows\System\maqAYYE.exe
  C:\Windows\System\maqAYYE.exe
  2⤵
  PID:12968
- C:\Windows\System\FSKaXAn.exe
  C:\Windows\System\FSKaXAn.exe
  2⤵
  PID:13080
- C:\Windows\System\OwrmcwS.exe
  C:\Windows\System\OwrmcwS.exe
  2⤵
  PID:13092
- C:\Windows\System\KERQZCa.exe
  C:\Windows\System\KERQZCa.exe
  2⤵
  PID:13232
- C:\Windows\System\KVanczt.exe
  C:\Windows\System\KVanczt.exe
  2⤵
  PID:11676
- C:\Windows\System\pYcoiWx.exe
  C:\Windows\System\pYcoiWx.exe
  2⤵
  PID:12352
- C:\Windows\System\PuDgyxY.exe
  C:\Windows\System\PuDgyxY.exe
  2⤵
  PID:12400
- C:\Windows\System\bAfQrxU.exe
  C:\Windows\System\bAfQrxU.exe
  2⤵
  PID:12588
- C:\Windows\System\SDUyosF.exe
  C:\Windows\System\SDUyosF.exe
  2⤵
  PID:12716
- C:\Windows\System\IjZGnrH.exe
  C:\Windows\System\IjZGnrH.exe
  2⤵
  PID:12988
- C:\Windows\System\nLOUONV.exe
  C:\Windows\System\nLOUONV.exe
  2⤵
  PID:13000
- C:\Windows\System\cbKQfgT.exe
  C:\Windows\System\cbKQfgT.exe
  2⤵
  PID:13272
- C:\Windows\System\RiVyrYe.exe
  C:\Windows\System\RiVyrYe.exe
  2⤵
  PID:12404
- C:\Windows\System\rWwoyfu.exe
  C:\Windows\System\rWwoyfu.exe
  2⤵
  PID:13172
- C:\Windows\System\zxwYkHM.exe
  C:\Windows\System\zxwYkHM.exe
  2⤵
  PID:13320
- C:\Windows\System\vlGJTWm.exe
  C:\Windows\System\vlGJTWm.exe
  2⤵
  PID:13356
- C:\Windows\System\qQGWMnn.exe
  C:\Windows\System\qQGWMnn.exe
  2⤵
  PID:13372
- C:\Windows\System\UxHEtYS.exe
  C:\Windows\System\UxHEtYS.exe
  2⤵
  PID:13404
- C:\Windows\System\QiLYtNe.exe
  C:\Windows\System\QiLYtNe.exe
  2⤵
  PID:13440
- C:\Windows\System\zwddpox.exe
  C:\Windows\System\zwddpox.exe
  2⤵
  PID:13468
- C:\Windows\System\ONVJjOP.exe
  C:\Windows\System\ONVJjOP.exe
  2⤵
  PID:13496
- C:\Windows\System\flRHgiU.exe
  C:\Windows\System\flRHgiU.exe
  2⤵
  PID:13512
- C:\Windows\System\ZHlbbQL.exe
  C:\Windows\System\ZHlbbQL.exe
  2⤵
  PID:13536
- C:\Windows\System\wNKOKWO.exe
  C:\Windows\System\wNKOKWO.exe
  2⤵
  PID:13568
- C:\Windows\System\HhhMMfq.exe
  C:\Windows\System\HhhMMfq.exe
  2⤵
  PID:13600
- C:\Windows\System\HoHwiOJ.exe
  C:\Windows\System\HoHwiOJ.exe
  2⤵
  PID:13632
- C:\Windows\System\JJIgUHh.exe
  C:\Windows\System\JJIgUHh.exe
  2⤵
  PID:13656
- C:\Windows\System\nPwIxzw.exe
  C:\Windows\System\nPwIxzw.exe
  2⤵
  PID:13696
- C:\Windows\System\TvWjWUK.exe
  C:\Windows\System\TvWjWUK.exe
  2⤵
  PID:13716
- C:\Windows\System\eCQUTcR.exe
  C:\Windows\System\eCQUTcR.exe
  2⤵
  PID:13748
- C:\Windows\System\ZUlsWrT.exe
  C:\Windows\System\ZUlsWrT.exe
  2⤵
  PID:13780
- C:\Windows\System\bvvlxNp.exe
  C:\Windows\System\bvvlxNp.exe
  2⤵
  PID:13804
- C:\Windows\System\qNbnEmH.exe
  C:\Windows\System\qNbnEmH.exe
  2⤵
  PID:13832
- C:\Windows\System\YYcxcEU.exe
  C:\Windows\System\YYcxcEU.exe
  2⤵
  PID:13852
- C:\Windows\System\dbrxMdR.exe
  C:\Windows\System\dbrxMdR.exe
  2⤵
  PID:13880
- C:\Windows\System\EVgLokR.exe
  C:\Windows\System\EVgLokR.exe
  2⤵
  PID:13904
- C:\Windows\System\KTVEJft.exe
  C:\Windows\System\KTVEJft.exe
  2⤵
  PID:13940
- C:\Windows\System\NgBPTKk.exe
  C:\Windows\System\NgBPTKk.exe
  2⤵
  PID:13960
- C:\Windows\System\FefPvPk.exe
  C:\Windows\System\FefPvPk.exe
  2⤵
  PID:13988
- C:\Windows\System\gpjtdiy.exe
  C:\Windows\System\gpjtdiy.exe
  2⤵
  PID:14020
- C:\Windows\System\yLGAVDJ.exe
  C:\Windows\System\yLGAVDJ.exe
  2⤵
  PID:14056
- C:\Windows\System\VVjvwmV.exe
  C:\Windows\System\VVjvwmV.exe
  2⤵
  PID:14084
- C:\Windows\System\lhtvNOn.exe
  C:\Windows\System\lhtvNOn.exe
  2⤵
  PID:14100
- C:\Windows\System\YonMVVC.exe
  C:\Windows\System\YonMVVC.exe
  2⤵
  PID:14136
- C:\Windows\System\kNEPBeC.exe
  C:\Windows\System\kNEPBeC.exe
  2⤵
  PID:14168
- C:\Windows\System\ulhNfHM.exe
  C:\Windows\System\ulhNfHM.exe
  2⤵
  PID:14196
- C:\Windows\System\vRbzJYa.exe
  C:\Windows\System\vRbzJYa.exe
  2⤵
  PID:14224
- C:\Windows\System\OAMqLPS.exe
  C:\Windows\System\OAMqLPS.exe
  2⤵
  PID:14248
- C:\Windows\System\XYulZEf.exe
  C:\Windows\System\XYulZEf.exe
  2⤵
  PID:14268
- C:\Windows\System\VCctgGF.exe
  C:\Windows\System\VCctgGF.exe
  2⤵
  PID:14284
- C:\Windows\System\fuUhQtb.exe
  C:\Windows\System\fuUhQtb.exe
  2⤵
  PID:14304
- C:\Windows\System\DSCkRKO.exe
  C:\Windows\System\DSCkRKO.exe
  2⤵
  PID:14328
- C:\Windows\System\WwlfTSh.exe
  C:\Windows\System\WwlfTSh.exe
  2⤵
  PID:13024
- C:\Windows\System\oqUPGdX.exe
  C:\Windows\System\oqUPGdX.exe
  2⤵
  PID:2076
- C:\Windows\System\KKvtrdD.exe
  C:\Windows\System\KKvtrdD.exe
  2⤵
  PID:13452
- C:\Windows\System\BJoHvJG.exe
  C:\Windows\System\BJoHvJG.exe
  2⤵
  PID:13480
- C:\Windows\System\ashKAKS.exe
  C:\Windows\System\ashKAKS.exe
  2⤵
  PID:13508
- C:\Windows\System\oVonvuY.exe
  C:\Windows\System\oVonvuY.exe
  2⤵
  PID:13624
- C:\Windows\System\sEBxnbn.exe
  C:\Windows\System\sEBxnbn.exe
  2⤵
  PID:13724
- C:\Windows\System\tacmFCr.exe
  C:\Windows\System\tacmFCr.exe
  2⤵
  PID:13740
- C:\Windows\System\aWSssUN.exe
  C:\Windows\System\aWSssUN.exe
  2⤵
  PID:13820
- C:\Windows\System\WSWLfkZ.exe
  C:\Windows\System\WSWLfkZ.exe
  2⤵
  PID:13924
- C:\Windows\System\IWqbWEc.exe
  C:\Windows\System\IWqbWEc.exe
  2⤵
  PID:13932
- C:\Windows\System\gCNayIq.exe
  C:\Windows\System\gCNayIq.exe
  2⤵
  PID:14000
- C:\Windows\System\RPErOvu.exe
  C:\Windows\System\RPErOvu.exe
  2⤵
  PID:14068
- C:\Windows\System\XXqLgaa.exe
  C:\Windows\System\XXqLgaa.exe
  2⤵
  PID:14128
- C:\Windows\System\PAcyRfs.exe
  C:\Windows\System\PAcyRfs.exe
  2⤵
  PID:14184
- C:\Windows\System\YwAGfiZ.exe
  C:\Windows\System\YwAGfiZ.exe
  2⤵
  PID:14292
- C:\Windows\System\PsuYUeK.exe
  C:\Windows\System\PsuYUeK.exe
  2⤵
  PID:13200
- C:\Windows\System\XIwTVPq.exe
  C:\Windows\System\XIwTVPq.exe
  2⤵
  PID:13316
- C:\Windows\System\OBssthX.exe
  C:\Windows\System\OBssthX.exe
  2⤵
  PID:12788
- C:\Windows\System\SmHLbIh.exe
  C:\Windows\System\SmHLbIh.exe
  2⤵
  PID:13652
- C:\Windows\System\JUrbRLN.exe
  C:\Windows\System\JUrbRLN.exe
  2⤵
  PID:13816
- C:\Windows\System\dELffvI.exe
  C:\Windows\System\dELffvI.exe
  2⤵
  PID:13872
- C:\Windows\System\oIXbHgc.exe
  C:\Windows\System\oIXbHgc.exe
  2⤵
  PID:14076
- C:\Windows\System\CbySQXc.exe
  C:\Windows\System\CbySQXc.exe
  2⤵
  PID:14276
- C:\Windows\System\YsSegdR.exe
  C:\Windows\System\YsSegdR.exe
  2⤵
  PID:14324
- C:\Windows\System\iKtSmWu.exe
  C:\Windows\System\iKtSmWu.exe
  2⤵
  PID:13772
- C:\Windows\System\VLdpepu.exe
  C:\Windows\System\VLdpepu.exe
  2⤵
  PID:14188
- C:\Windows\System\vMeMjRx.exe
  C:\Windows\System\vMeMjRx.exe
  2⤵
  PID:13392
- C:\Windows\System\ZJafcTh.exe
  C:\Windows\System\ZJafcTh.exe
  2⤵
  PID:14044
- C:\Windows\System\JjObjTF.exe
  C:\Windows\System\JjObjTF.exe
  2⤵
  PID:14356
- C:\Windows\System\eeThKZq.exe
  C:\Windows\System\eeThKZq.exe
  2⤵
  PID:14384
- C:\Windows\System\UslAYBU.exe
  C:\Windows\System\UslAYBU.exe
  2⤵
  PID:14400
- C:\Windows\System\EERMvSW.exe
  C:\Windows\System\EERMvSW.exe
  2⤵
  PID:14444
- C:\Windows\System\ZRwPaDS.exe
  C:\Windows\System\ZRwPaDS.exe
  2⤵
  PID:14476
- C:\Windows\System\BYBDSvB.exe
  C:\Windows\System\BYBDSvB.exe
  2⤵
  PID:14504
- C:\Windows\System\JrbXmnf.exe
  C:\Windows\System\JrbXmnf.exe
  2⤵
  PID:14532
- C:\Windows\System\DMKUYAn.exe
  C:\Windows\System\DMKUYAn.exe
  2⤵
  PID:14552
- C:\Windows\System\AgqCXGB.exe
  C:\Windows\System\AgqCXGB.exe
  2⤵
  PID:14580
- C:\Windows\System\vWnkEOZ.exe
  C:\Windows\System\vWnkEOZ.exe
  2⤵
  PID:14616
- C:\Windows\System\NwzolDS.exe
  C:\Windows\System\NwzolDS.exe
  2⤵
  PID:14648
- C:\Windows\System\crnRMDc.exe
  C:\Windows\System\crnRMDc.exe
  2⤵
  PID:14676
- C:\Windows\System\BoihUVU.exe
  C:\Windows\System\BoihUVU.exe
  2⤵
  PID:14704
- C:\Windows\System\gMWDgfe.exe
  C:\Windows\System\gMWDgfe.exe
  2⤵
  PID:14728
- C:\Windows\System\qkdzmLU.exe
  C:\Windows\System\qkdzmLU.exe
  2⤵
  PID:14748
- C:\Windows\System\zZvgFlM.exe
  C:\Windows\System\zZvgFlM.exe
  2⤵
  PID:14768
- C:\Windows\System\LoPgHCV.exe
  C:\Windows\System\LoPgHCV.exe
  2⤵
  PID:14800
- C:\Windows\System\HZFRKgp.exe
  C:\Windows\System\HZFRKgp.exe
  2⤵
  PID:14824
- C:\Windows\System\dvzlnDR.exe
  C:\Windows\System\dvzlnDR.exe
  2⤵
  PID:14864
- C:\Windows\System\EYmpfis.exe
  C:\Windows\System\EYmpfis.exe
  2⤵
  PID:14888
- C:\Windows\System\WcbJCRC.exe
  C:\Windows\System\WcbJCRC.exe
  2⤵
  PID:14920
- C:\Windows\System\JnhZQLu.exe
  C:\Windows\System\JnhZQLu.exe
  2⤵
  PID:14952
- C:\Windows\System\ifuKZTf.exe
  C:\Windows\System\ifuKZTf.exe
  2⤵
  PID:14980
- C:\Windows\System\kehsbwC.exe
  C:\Windows\System\kehsbwC.exe
  2⤵
  PID:14996
- C:\Windows\System\ijttAAv.exe
  C:\Windows\System\ijttAAv.exe
  2⤵
  PID:15024
- C:\Windows\System\hvoBxLi.exe
  C:\Windows\System\hvoBxLi.exe
  2⤵
  PID:15044
- C:\Windows\System\QTNFpki.exe
  C:\Windows\System\QTNFpki.exe
  2⤵
  PID:15072
- C:\Windows\System\JjQVyJF.exe
  C:\Windows\System\JjQVyJF.exe
  2⤵
  PID:15096
- C:\Windows\System\GvjHAxd.exe
  C:\Windows\System\GvjHAxd.exe
  2⤵
  PID:15132
- C:\Windows\System\FoAPEJB.exe
  C:\Windows\System\FoAPEJB.exe
  2⤵
  PID:15164
- C:\Windows\System\itZZUlf.exe
  C:\Windows\System\itZZUlf.exe
  2⤵
  PID:15184
- C:\Windows\System\rgskMMI.exe
  C:\Windows\System\rgskMMI.exe
  2⤵
  PID:15212
- C:\Windows\System\kIojdRH.exe
  C:\Windows\System\kIojdRH.exe
  2⤵
  PID:15240
- C:\Windows\System\tsdOSUN.exe
  C:\Windows\System\tsdOSUN.exe
  2⤵
  PID:15276
- C:\Windows\System\AHentBy.exe
  C:\Windows\System\AHentBy.exe
  2⤵
  PID:15296
- C:\Windows\System\xJBqlVH.exe
  C:\Windows\System\xJBqlVH.exe
  2⤵
  PID:15316
- C:\Windows\System\BqRSXzq.exe
  C:\Windows\System\BqRSXzq.exe
  2⤵
  PID:15348
- C:\Windows\System\knmHpAY.exe
  C:\Windows\System\knmHpAY.exe
  2⤵
  PID:408
- C:\Windows\System\VcLXnAr.exe
  C:\Windows\System\VcLXnAr.exe
  2⤵
  PID:14468
- C:\Windows\System\FADihho.exe
  C:\Windows\System\FADihho.exe
  2⤵
  PID:14520
- C:\Windows\System\VPrRcQh.exe
  C:\Windows\System\VPrRcQh.exe
  2⤵
  PID:14544
- C:\Windows\System\xZzjmDn.exe
  C:\Windows\System\xZzjmDn.exe
  2⤵
  PID:14608
- C:\Windows\System\BaUwACb.exe
  C:\Windows\System\BaUwACb.exe
  2⤵
  PID:14660
- C:\Windows\System\pWCJmEn.exe
  C:\Windows\System\pWCJmEn.exe
  2⤵
  PID:14744
- C:\Windows\System\xPZNeNq.exe
  C:\Windows\System\xPZNeNq.exe
  2⤵
  PID:14880
- C:\Windows\System\njnmAfY.exe
  C:\Windows\System\njnmAfY.exe
  2⤵
  PID:14916
- C:\Windows\System\oFHZNWT.exe
  C:\Windows\System\oFHZNWT.exe
  2⤵
  PID:14988
- C:\Windows\System\DujWRri.exe
  C:\Windows\System\DujWRri.exe
  2⤵
  PID:14964
- C:\Windows\System\YLesVdG.exe
  C:\Windows\System\YLesVdG.exe
  2⤵
  PID:15064
- C:\Windows\System\lsLTddN.exe
  C:\Windows\System\lsLTddN.exe
  2⤵
  PID:15112
- C:\Windows\System\BDDYqjO.exe
  C:\Windows\System\BDDYqjO.exe
  2⤵
  PID:15252
- C:\Windows\System\pHhTIpI.exe
  C:\Windows\System\pHhTIpI.exe
  2⤵
  PID:15328
- C:\Windows\System\yFuEHLg.exe
  C:\Windows\System\yFuEHLg.exe
  2⤵
  PID:15356
- C:\Windows\System\jCIYZGM.exe
  C:\Windows\System\jCIYZGM.exe
  2⤵
  PID:14424
- C:\Windows\System\SAdDGHr.exe
  C:\Windows\System\SAdDGHr.exe
  2⤵
  PID:14592
- C:\Windows\System\ndqfviv.exe
  C:\Windows\System\ndqfviv.exe
  2⤵
  PID:14936
- C:\Windows\System\ywNJvzL.exe
  C:\Windows\System\ywNJvzL.exe
  2⤵
  PID:14968
- C:\Windows\System\nuOgbeP.exe
  C:\Windows\System\nuOgbeP.exe
  2⤵
  PID:15180
- C:\Windows\System\gGecHmI.exe
  C:\Windows\System\gGecHmI.exe
  2⤵
  PID:15232
- C:\Windows\System\rPhXYRI.exe
  C:\Windows\System\rPhXYRI.exe
  2⤵
  PID:14392
- C:\Windows\System\LLHNpAl.exe
  C:\Windows\System\LLHNpAl.exe
  2⤵
  PID:14600
- C:\Windows\System\fnDVWoC.exe
  C:\Windows\System\fnDVWoC.exe
  2⤵
  PID:14912
- C:\Windows\System\kjAhiLA.exe
  C:\Windows\System\kjAhiLA.exe
  2⤵
  PID:15284
- C:\Windows\System\fJqEawh.exe
  C:\Windows\System\fJqEawh.exe
  2⤵
  PID:14684
- C:\Windows\System\eMAeDvu.exe
  C:\Windows\System\eMAeDvu.exe
  2⤵
  PID:15368
- C:\Windows\System\peWMlYh.exe
  C:\Windows\System\peWMlYh.exe
  2⤵
  PID:15396
- C:\Windows\System\orprxew.exe
  C:\Windows\System\orprxew.exe
  2⤵
  PID:15428
- C:\Windows\System\onPEXJO.exe
  C:\Windows\System\onPEXJO.exe
  2⤵
  PID:15448
- C:\Windows\System\BlsQjmB.exe
  C:\Windows\System\BlsQjmB.exe
  2⤵
  PID:15472
- C:\Windows\System\kXSuzvN.exe
  C:\Windows\System\kXSuzvN.exe
  2⤵
  PID:15488
- C:\Windows\System\HrNSezD.exe
  C:\Windows\System\HrNSezD.exe
  2⤵
  PID:15520
- C:\Windows\System\tixzaCr.exe
  C:\Windows\System\tixzaCr.exe
  2⤵
  PID:15556
- C:\Windows\System\rMkwtqc.exe
  C:\Windows\System\rMkwtqc.exe
  2⤵
  PID:15580
- C:\Windows\System\iqICDDF.exe
  C:\Windows\System\iqICDDF.exe
  2⤵
  PID:15612
- C:\Windows\System\yvBEaTy.exe
  C:\Windows\System\yvBEaTy.exe
  2⤵
  PID:15640
- C:\Windows\System\WHCQdVC.exe
  C:\Windows\System\WHCQdVC.exe
  2⤵
  PID:15676
- C:\Windows\System\sjBnRqL.exe
  C:\Windows\System\sjBnRqL.exe
  2⤵
  PID:15692
- C:\Windows\System\WaTyjjP.exe
  C:\Windows\System\WaTyjjP.exe
  2⤵
  PID:15708
- C:\Windows\System\OqUHHEX.exe
  C:\Windows\System\OqUHHEX.exe
  2⤵
  PID:15740
- C:\Windows\System\CTLpbdv.exe
  C:\Windows\System\CTLpbdv.exe
  2⤵
  PID:15780
- C:\Windows\System\hwdXeNt.exe
  C:\Windows\System\hwdXeNt.exe
  2⤵
  PID:15808
- C:\Windows\System\JIdPcFp.exe
  C:\Windows\System\JIdPcFp.exe
  2⤵
  PID:15832
- C:\Windows\System\OPWvmPH.exe
  C:\Windows\System\OPWvmPH.exe
  2⤵
  PID:15856
- C:\Windows\System\btqJYjU.exe
  C:\Windows\System\btqJYjU.exe
  2⤵
  PID:15888
- C:\Windows\System\nlQJYhD.exe
  C:\Windows\System\nlQJYhD.exe
  2⤵
  PID:15920
- C:\Windows\System\EwEfDYO.exe
  C:\Windows\System\EwEfDYO.exe
  2⤵
  PID:15952
- C:\Windows\System\cRbeXDd.exe
  C:\Windows\System\cRbeXDd.exe
  2⤵
  PID:15984
- C:\Windows\System\lYsNBWw.exe
  C:\Windows\System\lYsNBWw.exe
  2⤵
  PID:16012
- C:\Windows\System\HsOeRDf.exe
  C:\Windows\System\HsOeRDf.exe
  2⤵
  PID:16028
- C:\Windows\System\ahCNZBZ.exe
  C:\Windows\System\ahCNZBZ.exe
  2⤵
  PID:16052
- C:\Windows\System\qxzAWTJ.exe
  C:\Windows\System\qxzAWTJ.exe
  2⤵
  PID:16080
- C:\Windows\System\bONFeqB.exe
  C:\Windows\System\bONFeqB.exe
  2⤵
  PID:16112
- C:\Windows\System\QGCboyO.exe
  C:\Windows\System\QGCboyO.exe
  2⤵
  PID:16148
- C:\Windows\System\ruOuAuN.exe
  C:\Windows\System\ruOuAuN.exe
  2⤵
  PID:16180
- C:\Windows\System\MfkzFyw.exe
  C:\Windows\System\MfkzFyw.exe
  2⤵
  PID:16208
- C:\Windows\System\nnvTwyT.exe
  C:\Windows\System\nnvTwyT.exe
  2⤵
  PID:16228
- C:\Windows\System\SQJjDJD.exe
  C:\Windows\System\SQJjDJD.exe
  2⤵
  PID:16252
- C:\Windows\System\VLFebKD.exe
  C:\Windows\System\VLFebKD.exe
  2⤵
  PID:16276
- C:\Windows\System\bgSJmhP.exe
  C:\Windows\System\bgSJmhP.exe
  2⤵
  PID:16316
- C:\Windows\System\BGgvivw.exe
  C:\Windows\System\BGgvivw.exe
  2⤵
  PID:16344
- C:\Windows\System\vOtKMoI.exe
  C:\Windows\System\vOtKMoI.exe
  2⤵
  PID:16372
- C:\Windows\System\BWJYEwj.exe
  C:\Windows\System\BWJYEwj.exe
  2⤵
  PID:14420
- C:\Windows\System\mzdJmxE.exe
  C:\Windows\System\mzdJmxE.exe
  2⤵
  PID:15440
- C:\Windows\System\rPmtDhI.exe
  C:\Windows\System\rPmtDhI.exe
  2⤵
  PID:15544
- C:\Windows\System\EnWzGDl.exe
  C:\Windows\System\EnWzGDl.exe
  2⤵
  PID:15568
- C:\Windows\System\amnQtyL.exe
  C:\Windows\System\amnQtyL.exe
  2⤵
  PID:15652
- C:\Windows\System\oNAOPDn.exe
  C:\Windows\System\oNAOPDn.exe
  2⤵
  PID:15720
- C:\Windows\System\CWgfuXG.exe
  C:\Windows\System\CWgfuXG.exe
  2⤵
  PID:15736
- C:\Windows\System\WIKoNFX.exe
  C:\Windows\System\WIKoNFX.exe
  2⤵
  PID:15752
- C:\Windows\System\tmQlbyC.exe
  C:\Windows\System\tmQlbyC.exe
  2⤵
  PID:15916
- C:\Windows\System\hdEOnVc.exe
  C:\Windows\System\hdEOnVc.exe
  2⤵
  PID:15996
- C:\Windows\System\UYtoNgb.exe
  C:\Windows\System\UYtoNgb.exe
  2⤵
  PID:16048
- C:\Windows\System\MqPlnEV.exe
  C:\Windows\System\MqPlnEV.exe
  2⤵
  PID:16124
- C:\Windows\System\vNMCsSP.exe
  C:\Windows\System\vNMCsSP.exe
  2⤵
  PID:16100
- C:\Windows\System\htienlR.exe
  C:\Windows\System\htienlR.exe
  2⤵
  PID:16196
- C:\Windows\System\cexfjFV.exe
  C:\Windows\System\cexfjFV.exe
  2⤵
  PID:16216
- C:\Windows\System\OqmHMVZ.exe
  C:\Windows\System\OqmHMVZ.exe
  2⤵
  PID:16340
- C:\Windows\System\oxJzmHo.exe
  C:\Windows\System\oxJzmHo.exe
  2⤵
  PID:15436
- C:\Windows\System\EXZqAkp.exe
  C:\Windows\System\EXZqAkp.exe
  2⤵
  PID:15624
- C:\Windows\System\MHRQOiT.exe
  C:\Windows\System\MHRQOiT.exe
  2⤵
  PID:15684
- C:\Windows\System\niONdUI.exe
  C:\Windows\System\niONdUI.exe
  2⤵
  PID:15768
- C:\Windows\System\TwqveWS.exe
  C:\Windows\System\TwqveWS.exe
  2⤵
  PID:16044
- C:\Windows\System\MwOaSdi.exe
  C:\Windows\System\MwOaSdi.exe
  2⤵
  PID:16104
- C:\Windows\System\kiyVAoL.exe
  C:\Windows\System\kiyVAoL.exe
  2⤵
  PID:16240
- C:\Windows\System\hUceDIA.exe
  C:\Windows\System\hUceDIA.exe
  2⤵
  PID:14664
- C:\Windows\System\IjBczfQ.exe
  C:\Windows\System\IjBczfQ.exe
  2⤵
  PID:15596
- C:\Windows\System\eYoXwzH.exe
  C:\Windows\System\eYoXwzH.exe
  2⤵
  PID:16000
- C:\Windows\System\kzKYZub.exe
  C:\Windows\System\kzKYZub.exe
  2⤵
  PID:16336
- C:\Windows\System\NzLxcUJ.exe
  C:\Windows\System\NzLxcUJ.exe
  2⤵
  PID:16404
- C:\Windows\System\tDuEgxl.exe
  C:\Windows\System\tDuEgxl.exe
  2⤵
  PID:16432
- C:\Windows\System\jptJqYL.exe
  C:\Windows\System\jptJqYL.exe
  2⤵
  PID:16460
- C:\Windows\System\QHHdKaZ.exe
  C:\Windows\System\QHHdKaZ.exe
  2⤵
  PID:16488
- C:\Windows\System\FJPbnkU.exe
  C:\Windows\System\FJPbnkU.exe
  2⤵
  PID:16528
- C:\Windows\System\POuqcwO.exe
  C:\Windows\System\POuqcwO.exe
  2⤵
  PID:16548
- C:\Windows\System\TjObkBY.exe
  C:\Windows\System\TjObkBY.exe
  2⤵
  PID:16580
- C:\Windows\System\fzfqcsk.exe
  C:\Windows\System\fzfqcsk.exe
  2⤵
  PID:16604
- C:\Windows\System\aFnaoIR.exe
  C:\Windows\System\aFnaoIR.exe
  2⤵
  PID:16620
- C:\Windows\System\OkIlJjB.exe
  C:\Windows\System\OkIlJjB.exe
  2⤵
  PID:16644
- C:\Windows\System\KpzrHEg.exe
  C:\Windows\System\KpzrHEg.exe
  2⤵
  PID:16676
- C:\Windows\System\tHsZBVh.exe
  C:\Windows\System\tHsZBVh.exe
  2⤵
  PID:16708
- C:\Windows\System\hOMsldr.exe
  C:\Windows\System\hOMsldr.exe
  2⤵
  PID:16728
- C:\Windows\System\wLQBPFC.exe
  C:\Windows\System\wLQBPFC.exe
  2⤵
  PID:16824
- C:\Windows\System\IkeFDLi.exe
  C:\Windows\System\IkeFDLi.exe
  2⤵
  PID:16840
- C:\Windows\System\tYgZOmk.exe
  C:\Windows\System\tYgZOmk.exe
  2⤵
  PID:16868
- C:\Windows\System\zWIOLdK.exe
  C:\Windows\System\zWIOLdK.exe
  2⤵
  PID:16888
- C:\Windows\System\UDLbAlV.exe
  C:\Windows\System\UDLbAlV.exe
  2⤵
  PID:16912
- C:\Windows\System\OWxInLX.exe
  C:\Windows\System\OWxInLX.exe
  2⤵
  PID:16936
- C:\Windows\System\eTnSRXz.exe
  C:\Windows\System\eTnSRXz.exe
  2⤵
  PID:16968
- C:\Windows\System\anLmVdt.exe
  C:\Windows\System\anLmVdt.exe
  2⤵
  PID:16984
- C:\Windows\System\GfzcLCp.exe
  C:\Windows\System\GfzcLCp.exe
  2⤵
  PID:17008
- C:\Windows\System\QZHfQFr.exe
  C:\Windows\System\QZHfQFr.exe
  2⤵
  PID:17036
- C:\Windows\System\aEPctQJ.exe
  C:\Windows\System\aEPctQJ.exe
  2⤵
  PID:17064
- C:\Windows\System\SgQTTTO.exe
  C:\Windows\System\SgQTTTO.exe
  2⤵
  PID:17092
- C:\Windows\System\UjybnPN.exe
  C:\Windows\System\UjybnPN.exe
  2⤵
  PID:17112
- C:\Windows\System\UaGAoXW.exe
  C:\Windows\System\UaGAoXW.exe
  2⤵
  PID:17128
- C:\Windows\System\GeqHdqk.exe
  C:\Windows\System\GeqHdqk.exe
  2⤵
  PID:17152
- C:\Windows\System\yCwRcmc.exe
  C:\Windows\System\yCwRcmc.exe
  2⤵
  PID:17184

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CjAYdau.exe

Path C:\Windows\System\CjAYdau.exe
Size 2.1MB
SHA256 b35350616321d35af746833f01d4b066804e2a30445e92161e4bef11ec84d6f5
MD5 201d2a88707a9e52f3b5e72d2a40282b
SHA1 b7cf57af0fd2165883d073e1559a375234207965
SHA512 cf0888a4d5efba069f36e4e4d6711388552672fe892bdc672a66bcc6059ab848c911551e92aba42ade00f4774abd04be6573fe235fa7564642020c28eff596e5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOT:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

DabWqCs.exe

Path C:\Windows\System\DabWqCs.exe
Size 2.1MB
SHA256 ed45d80ddc74fc9d29c6d8058dd86d132608f28fe347d281db366a8ee436356b
MD5 e778c31736705f099076480d0cf28e07
SHA1 605cc6495befe3a691cf40d124333c2ef64235fd
SHA512 ee6af067021f81c29c25459a0b626389625fe43df64d0a1eff0040d0f523e0b20ac8645f561016a22981a76ad1d13a0ed241133fc12533860693b3d9157a2b97
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOF:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

IYVfwLB.exe

Path C:\Windows\System\IYVfwLB.exe
Size 2.1MB
SHA256 70e615da64e38de6d30bb43e07ddb5aae4607ba686be7e5f1ad64eb7eeed6c53
MD5 10cb92921f441ac9129ee39f37df66f1
SHA1 202e6fc10169931127c069fa07e569f70709a40d
SHA512 d268240ba7e6050cd0bde7df548383f98f135e2deaa830e42948f75d190a990d210965d81a3e1876f20d05f618c3fe0f1a74ccd48fa69de236fa5091155f2162
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOP:GemTLkNdfE0pZaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

JXFMvdg.exe

Path C:\Windows\System\JXFMvdg.exe
Size 2.1MB
SHA256 a5e686471f4da4a17fe991b3e6f30c24c8ba72b03d1b8f09d8de453d37fa4e88
MD5 10fc3f78cddeb02fa54328abf3f37f68
SHA1 9538b8d8d7bbdd29024d8e488712b0884f972a6c
SHA512 17d49876857da3e9ee38e922c1df539064235c834d89ee5e9333a375b4eda0ba2fd73011a80386e9fb81c8b1f431f0e94a5d0f738e0a0d502d575cc6f8f20690
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOW:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

LrETTQa.exe

Path C:\Windows\System\LrETTQa.exe
Size 2.1MB
SHA256 ccd9881997d7377f519a0f9f7c25f38f630b597ea33cc8eaaaa74c3a59fbb962
MD5 d24e1c3f39a34bc443e632dda28bfb23
SHA1 0d290e7e51c65519fc0cc427be5619275dc0001c
SHA512 d80a85a4678996108a91a30aa9f997f8cf9ba89055cc052db3fe81e506efc4f87a5708478d621f5b3a538d69fb7166b623593136edd6c67c0910fa50a7ff9ca3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOm:GemTLkNdfE0pZaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

MBKuXrX.exe

Path C:\Windows\System\MBKuXrX.exe
Size 2.1MB
SHA256 07fc5fdef7fb6e8fd10bd85a5e5adc943aae42dabe11a2700ff94e2d7a53e8ee
MD5 afce5a215edd2059cb2388e829e4b241
SHA1 b6d396379289eb493f7e84b421082efa18503ead
SHA512 5512301a893b58baec72bd59c48a598be48aa09b858cde34f7eeb7f6fe921fd1a8c385da4f4624ad60ca73c73e46983fd24eebfe439ba4eb52d67f51e292607f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOh:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

MvogQon.exe

Path C:\Windows\System\MvogQon.exe
Size 2.1MB
SHA256 c144438d2b65a70db9d06f29ecee8769ec8e109c4c2a74ff772f726a21b9c9ea
MD5 5f61b947e7507d6317a06c2d3f02eca1
SHA1 ca98199182381018294d8560bb82cbe3ab05c8d9
SHA512 e93c63f37a28b7507181351e1e0032fb2951a989fbdc5027fd55cd257134ef4c26cdc63685d80ff5aee214229dd709c618176c5386047adee0c29fa012447e72
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOK:GemTLkNdfE0pZaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

OOADntC.exe

Path C:\Windows\System\OOADntC.exe
Size 2.1MB
SHA256 862e26ee39e646e9580f265c26fc6f45a45fab8d39d6cfb0b6d3a38a081d7c79
MD5 2119480364ba64ebc9d525c6e63a9c61
SHA1 cbd16c67aeb65cca1c8c0df4378385d92041262e
SHA512 3d987e965977aa4d7136fbe4ca7ea510348dcdae33d9d625fac8d11fcefad91a7724569e1ea51fa16fd494700e98872f9db3b7b71d7d25381b4e438ce5ab3b2f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOa:GemTLkNdfE0pZaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

PRZJdCe.exe

Path C:\Windows\System\PRZJdCe.exe
Size 2.1MB
SHA256 16498fc92bd76aea4810ca0ea2a0eb0f7cb408de4ee1fcd483b7c06cc6d4350f
MD5 211937fc8932d6961bd156c77cf6ed2c
SHA1 afc1edd99ec018496aaa7f6c79f5e4937847c894
SHA512 911068036d4fbf952feb98a76cb36b8fb6e221552da7e18d7f7a08a46b57bab6ad9d72c5d29187687e91f5e04dc5e7852650753225e53a1acd3672419f785350
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbO6:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

RJSACFc.exe

Path C:\Windows\System\RJSACFc.exe
Size 2.1MB
SHA256 60771600e805bba2b9f26c84e92bb91e8cf9f26335060169b2de9501ea6cecc2
MD5 78c702678271b307aed8775a08949343
SHA1 bbb8b2156430765f766e3d464e5108d69d5c47a8
SHA512 18c58102d8f493e19732381d3db9d148613103e2607675a491b06b1a0f30f6985201c2d19b2e7b299d1f69d5a0e612d0d39a9e951501f11e18fb7a02634517d4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOB:GemTLkNdfE0pZaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

TxOxqgW.exe

Path C:\Windows\System\TxOxqgW.exe
Size 2.1MB
SHA256 9831252a681ee9e47a47f28f59b62e58fcb59fb7cc4c9348fea889a7f5656efb
MD5 e1777d5870771c80f6f6841228bc3386
SHA1 ecb685a46ffdf5f15454c83437761d362f030d01
SHA512 1717c6bd790b019611823b9100de95a57463d9081ef0aefbddaabaa74f837a2f0c288013eec08373ab311378130c5364192ba93c68d338e8e48a6ee43f1d79a6
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOl:GemTLkNdfE0pZar
MD5 SHA1 SHA512 SSDEEP

Submit Download

XUNjChA.exe

Path C:\Windows\System\XUNjChA.exe
Size 2.1MB
SHA256 376ca138d94811e09a72bbc803b42cc61c0346954f746c8f43a12a6f4ffc4bff
MD5 78f4f14983e00514c9606693fbc6ff5d
SHA1 b0482bc6d289b47fde95e40d4a71e50bfee7ac1f
SHA512 32211893f22cdeda69cab01e40e8344bc4b400f667a0de73085b5bd71e9a882788acad88abfe82dc4f1a075d9c9f92472a8c44fe4f4705451aa49d5fadb99345
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbO2:GemTLkNdfE0pZa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxTUFJk.exe

Path C:\Windows\System\XxTUFJk.exe
Size 2.1MB
SHA256 8c80055c3dc3fba7c1b8cd20f22220e385434aef05759959a093721f593ec20d
MD5 cf695711045759e51c44fa5fc010a0f3
SHA1 2e2320412ea78c35df2be5e61b43ebd2d66f599c
SHA512 84de8abe0a555b1ef12fd354fac6367142ff86686d46398c663480b63322fa21232a9b1238a3c5358762eb20f18216be3c82468fc70cb6181adc7438e3a295d1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOB:GemTLkNdfE0pZaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

YItoHxw.exe

Path C:\Windows\System\YItoHxw.exe
Size 2.1MB
SHA256 1b721c73b73e6572fde15f4d364404aec8d97bd85fbe6c4b94b1c3b897d0928a
MD5 e9cc6e09a916e3c3fb3568ae593b48e8
SHA1 8c1cab08f353ff2635c5705c3dc18f66e5c44fa7
SHA512 784778d01972cd960dec038847b1930dd7fafbe24e07957511b4407846a8886c472345ec2c4558822bc45781e2097d137ac7bff3f794ea13ac2372e924e3596e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOF:GemTLkNdfE0pZaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

YpXrgni.exe

Path C:\Windows\System\YpXrgni.exe
Size 2.1MB
SHA256 df55cde28a046c2ae84f4e5caa852c16d8c84bd6a0f6ab7323365c4e3740bf79
MD5 2d73d2f6920667b2ed3eb9b508fcb4bc
SHA1 deb3b23dd2c758cc2c9f39ad7578c93a4a3c36d3
SHA512 367a4f0595f4eadc79e2c5aa4adbb5f190c6dda437e44378f5b5b4dfeb7fc4b5690aa0e0653bcf6a7d52c1b0a64318b97a4491787395e9c6ddd8defdbd6f3acd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOe:GemTLkNdfE0pZa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

YpdgAaS.exe

Path C:\Windows\System\YpdgAaS.exe
Size 2.1MB
SHA256 7f5afa62f5a4582ae701b01b3cadc59586b9ba1cabd80e5b0b4f79044537227e
MD5 014636df4f049721ce1a743dd2aa557a
SHA1 3619a9c7c1970d8cf488f7d16f74c54e8c5d9103
SHA512 8a32cacc21beb58353c7ad769151f56e1bba83f0345456562f76aa4125de576510ee61894588400a0d5047dcc8b2dc03fb2e1f3db324e83eaf38e1c61b6adf29
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOo:GemTLkNdfE0pZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIFGhzx.exe

Path C:\Windows\System\ZIFGhzx.exe
Size 2.1MB
SHA256 e0dd1b61e98adec8f7c3fd8868c35d835ef3ba220da034a43ba8f2eb1ade9a2c
MD5 1ad2ee5bcc6ba0445f6e750d2fbe4cab
SHA1 cabf12136a1ecd054819ed0b959f7b066ba32aed
SHA512 67bc73fe1df71007dbec3056afb4096265268b8e27f8630241a8040be4475b6a0f1d581a2e75e22370722455b088d5e7417a9c376df58b2958cd6d478f2b8020
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOiN:GemTLkNdfE0pZai
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbpmYIv.exe

Path C:\Windows\System\bbpmYIv.exe
Size 2.1MB
SHA256 9195f1dbe8b8f2463711790f0247264648efb30e513799ad22012b5ab5d4f9dd
MD5 ae29a0a81cb474d21b4783de5ef8642a
SHA1 87e0911f55d3d26c85144cb18c021bc9b2ebf448
SHA512 acc3f6b77da96095a6d6fd4ec9b64d4abc1f062632d3c538e4ba3800d3d05019966b26d45dc407a390e3f134af413f1dcd981bbd51bdaa4536ad9d4a485e1d5e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOM:GemTLkNdfE0pZam
MD5 SHA1 SHA512 SSDEEP

Submit Download

cyShOvd.exe

Path C:\Windows\System\cyShOvd.exe
Size 2.1MB
SHA256 ac2410ec1171d48133304859da2cef456d8f0584d47403573a332e1569155c42
MD5 e36d0bdbfd84a10d6adbf63e53cf73bc
SHA1 ebcefe6ab003ea684f944955d3e9c010806a50da
SHA512 41b7fa6337462819b014ebf9d1be3ce282775456dc4c587cc708285d49813783b4a5d7feeb2001f2ce2163b8102317b414a02bbdd475253457e34e66b92e1ffd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOt:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

fnMUSXv.exe

Path C:\Windows\System\fnMUSXv.exe
Size 2.1MB
SHA256 e94a66a6fe2682cc489e2d7186ecd92b3ecd3ee6d4b4f739f65902d8eadaca15
MD5 17e33ce75255aeeba8f14c1c1b0868ed
SHA1 d9304120e120616a04dc7058accbca61669ef0c7
SHA512 79da23a0eac6ce165b7f57e54aaede99e2c344b6aabcda70f30cd68d68d98e0807e73d407b1a423661ba156c536ce9e7da0f2cf58a09b2e933ef29ad5bba34c9
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOt:GemTLkNdfE0pZab
MD5 SHA1 SHA512 SSDEEP

Submit Download

gvaOtGd.exe

Path C:\Windows\System\gvaOtGd.exe
Size 2.1MB
SHA256 3c9601e522f49225efa5b458f95286511d3182e22cb1abe85e9871570cf4d614
MD5 0ad9eb2248eeb1fe0e5ca8bba8380c42
SHA1 834713ef57971d02472d1cccaaee875c661efc8f
SHA512 35502e50ebb9f84b10f1a24cb7596aa4ee84af5d3c6aae7f3e9f2a682f59ac0e4d2b3e52178d06f387366d19f54356247dac37893cf5440c16d40ed8dbff6ee2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbON:GemTLkNdfE0pZav
MD5 SHA1 SHA512 SSDEEP

Submit Download

ivMNEhs.exe

Path C:\Windows\System\ivMNEhs.exe
Size 2.1MB
SHA256 1fb29607b20de32542070eb21aea582286737494bae5263ac99fd23d715b66a7
MD5 300b3af681ed074e0abc2a15f5990daa
SHA1 ccdccbf44b91b657949baf050bbde0dab4342c6b
SHA512 6ff7105cc73236ce7017411e6f9cbcddc818f66cef5a4da4098ad52f9a048929c609385b759a1eaa193793ce25e937de5dc081e7e6c7a937952b0bd1f21a6da4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOl:GemTLkNdfE0pZaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

jLXOnWR.exe

Path C:\Windows\System\jLXOnWR.exe
Size 2.1MB
SHA256 fad23dc810c0a513ef9225ba5a374f4224ea521c4ca4d522792293e25cf7542a
MD5 0f3df25b7950c19bf239ab3dc62d0d8b
SHA1 74d902bb04628705fa2d875b7287f2e870fe0533
SHA512 b754188ec13d19bd2950e5dfcb61872ef0d18860f50967f4ae13f519bc006e0d9f8fe655f7b44d3058eb73475d40f11feaf67cbeb4823c1b89a68a1ec83f95ac
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbO5:GemTLkNdfE0pZaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

kPUvtnC.exe

Path C:\Windows\System\kPUvtnC.exe
Size 2.1MB
SHA256 3b4e62d43c2927b35d7eac7d3f2b9da5804a45b83d4f558f559da9f318487184
MD5 8503bb770a9723fff5629a8670e46db6
SHA1 fbaa021e89118cb620f877e02a09b253695c5e8a
SHA512 0987a382ef0f634ed781daccdabf4718a7945a715db453da51061352e96ca5e3b10e69e6dc6e35dea29faf5caf12ab467583310c2a6a3b30e35fc016eedc289e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOq:GemTLkNdfE0pZa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

nlpmcRf.exe

Path C:\Windows\System\nlpmcRf.exe
Size 2.1MB
SHA256 d51b17d91d51f32b7ab31a82f036a387a81fc7c2004f0dc71db164177833338b
MD5 ff5aa39b83b6b9964113dba8bd684cf9
SHA1 3e1bd8306aeb10af508a483e720c48ea44c2ab5d
SHA512 ebbbd7b221dc526bdebca701abb6c960eae60a950433972eeb392f95ea40ca4480f9b4efc0b324971e20316d9cdca9137c2f36e13fb1ee3990c866a808a409e3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbO1:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtYswgo.exe

Path C:\Windows\System\qtYswgo.exe
Size 2.1MB
SHA256 659a6413cd5aba31898918534cfe3db5290bc71f3a0b942cf4e23d43fbe63095
MD5 7276ea31ec6857f041dfe9e2ae1bca87
SHA1 72e423108f214e931413b6aa54375140a202770d
SHA512 f301e974affab29072c955a7a3a5724be3a549371ef131d5492e686e5e5b915ac243d5881fd4514efd63d8ef2e88beee75ece472365c0b1aa7e0ccd2fbf8bf7d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOo:GemTLkNdfE0pZaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzBIQnD.exe

Path C:\Windows\System\qzBIQnD.exe
Size 2.1MB
SHA256 b0849938ce05cb327a7f22cfea0be0f94e78474fb623dbb322cd2a5619eadf88
MD5 bbb33b8ceeab473f3478bded09da9d09
SHA1 01916ea6853047efd593a596dd86ab69a7ce06cc
SHA512 d1fd214871c87624a697c482dee236319486d187bed06d055aabe278298eded52575d7772054f84c05890eeda07c6b7369d1dfa556981ccc1bc8340044e40faa
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOQ:GemTLkNdfE0pZa+
MD5 SHA1 SHA512 SSDEEP

Submit Download

rwXQZOc.exe

Path C:\Windows\System\rwXQZOc.exe
Size 2.1MB
SHA256 a6b323e12840afc7d678b49d9a0de5e6ab2ac2e384b061aeff5bfa62c6d97c79
MD5 6ff7bf080ece5c4595c1e0557c8160ac
SHA1 ae377cc8d232f949eff84c10afa1ee1c4c237850
SHA512 3fbb3624233543b8e89fcfc314b2df6d47f399d024aa41ecb1adc9fcd36dc960c9fa5e7f87eee23767d5951e49b2bef15c108fed902084091b363fe66de7ebf8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOu:GemTLkNdfE0pZao
MD5 SHA1 SHA512 SSDEEP

Submit Download

wDtyauE.exe

Path C:\Windows\System\wDtyauE.exe
Size 2.1MB
SHA256 0f86dede57a2c631f9da7f89b8169b9bd0d9efa3569e7bc05abf8be07b8f6405
MD5 24a051810609a833b6a04b0ac8ed3e5d
SHA1 feab49c04e7f35ae20b4e616eeb2fefbde8aa7cc
SHA512 848ace6a8cd1a6b07fc69f77a83f86f8a69ca6684c9161083c7fef0a28652969b81d4843a836534b6bf8089c3b95174e8b963e61755c21e27742eb01d9accc79
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOv:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

xDrljap.exe

Path C:\Windows\System\xDrljap.exe
Size 2.1MB
SHA256 3aacff7c7495f66166bd78b9a7ab5eb3fa4d5656ab30e38bb1c11f67486144a9
MD5 3780f4989bd5a28b291d3ffe20945ee6
SHA1 cecdfe157f05156b3cca76650dd2808dd12a062c
SHA512 92f764974dba5b6633c49a2da8679dc74cb972bfc87dc1b5d6e7a359defa9de6bc626cf958930b95e9f5f295167b6c37810312bc40c618f2bf17af150eeef3e4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOJ:GemTLkNdfE0pZa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

yJeFoxP.exe

Path C:\Windows\System\yJeFoxP.exe
Size 2.1MB
SHA256 a5ba55f164c5319ba6c154ec3936842f05ad8a02a13b9a59317e37b824b5d95d
MD5 afa0adbd8a35896fd2cd1d7059acc5cd
SHA1 9ff0badbb70f09349b1414d8e67047e9ace100b7
SHA512 e67cd0f44975f4e14d25df686575319e5052bc6b33c882fea7ac9b218e9970b2b98d6a895e29e85d9ea60af433d80f161794828f2b0979f270d36bf195a6d379
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbO2:GemTLkNdfE0pZa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

zQiXgtn.exe

Path C:\Windows\System\zQiXgtn.exe
Size 2.1MB
SHA256 98b2a94dc0ba6b7de6964418fdc60b99ebca94a298056eb9f383ceca6a75f1fc
MD5 a59c9e7010795bad0679e79ac7f2bf52
SHA1 58a9dfad04e8e0a3a0beca1294cc6a9055007528
SHA512 d62d5d50c2636456a9d2425efa92caee50b0259ba20e50ba2c2e4e7487272f029dbfa0a8bdd9c9acc50a400a797a97e7ac4e7fafdc453ad56ded085a8b7f14d1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KbOY:GemTLkNdfE0pZa+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1416-0-0x00000204E2E10000-0x00000204E2E20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads