xmrig | a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
Size 2.0MB
Sample240615-ar46zssemf
SHA256 a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1
MD5 848d1d657816022076e43ba8683d3e5d
SHA1 9c07daccf5cccd0386d7dc442c9d8491457dbfa7
SHA512 094d0eb1c30234d6f5102e05ba7d93d69c40e674b7d8d11b839c5c62b9bfc32d9f71ee278c1258a1184e4027fef442bb54e28de5ff85ea6c2a3c2d833f9a39f0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KA:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000900000002327a-4.dat	xmrig
behavioral2/files/0x0008000000023411-9.dat	xmrig
behavioral2/files/0x0007000000023412-14.dat	xmrig
behavioral2/files/0x0007000000023413-18.dat	xmrig
behavioral2/files/0x0007000000023414-23.dat	xmrig
behavioral2/files/0x0007000000023417-43.dat	xmrig
behavioral2/files/0x000700000002341a-58.dat	xmrig
behavioral2/files/0x000700000002341d-67.dat	xmrig
behavioral2/files/0x000700000002341e-74.dat	xmrig
behavioral2/files/0x0007000000023423-100.dat	xmrig
behavioral2/files/0x0007000000023424-108.dat	xmrig
behavioral2/files/0x000700000002342f-157.dat	xmrig
behavioral2/files/0x0007000000023430-162.dat	xmrig
behavioral2/files/0x000700000002342e-160.dat	xmrig
behavioral2/files/0x000700000002342d-155.dat	xmrig
behavioral2/files/0x000700000002342c-150.dat	xmrig
behavioral2/files/0x000700000002342b-145.dat	xmrig
behavioral2/files/0x000700000002342a-140.dat	xmrig
behavioral2/files/0x0007000000023429-132.dat	xmrig
behavioral2/files/0x0007000000023428-128.dat	xmrig
behavioral2/files/0x0007000000023427-123.dat	xmrig
behavioral2/files/0x0007000000023426-118.dat	xmrig
behavioral2/files/0x0007000000023425-113.dat	xmrig
behavioral2/files/0x0007000000023422-95.dat	xmrig
behavioral2/files/0x0007000000023421-90.dat	xmrig
behavioral2/files/0x0007000000023420-88.dat	xmrig
behavioral2/files/0x000700000002341f-80.dat	xmrig
behavioral2/files/0x000700000002341c-68.dat	xmrig
behavioral2/files/0x000700000002341b-62.dat	xmrig
behavioral2/files/0x0007000000023419-52.dat	xmrig
behavioral2/files/0x0007000000023418-48.dat	xmrig
behavioral2/files/0x0007000000023416-38.dat	xmrig
behavioral2/files/0x0007000000023415-30.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3020	kqlstGi.exe
1584	TtjoBPt.exe
2852	sBhzrhp.exe
3108	OAvRovk.exe
3184	fqrIWJR.exe
3172	JnbBYyi.exe
3152	rHMawgb.exe
1796	mSwLtkY.exe
1708	EOdhclL.exe
2504	yfNIDXu.exe
1388	QMiTyfX.exe
3348	LsunzOa.exe
2164	UUQMIbL.exe
2088	SDUcfBz.exe
4636	qIWYRGQ.exe
3032	ODIYbbz.exe
1652	TfUYWTI.exe
2416	MUiOYrS.exe
5072	iLFktTH.exe
1112	NKFYVAi.exe
3744	mhrtETP.exe
5068	nLZZCUI.exe
5008	xJSNoxL.exe
4368	omxafpB.exe
1828	YKzPCzq.exe
1568	sbgLjSG.exe
632	GwoDDEJ.exe
3232	FMWuhRN.exe
5104	UYaiNzp.exe
4544	QEjzRLG.exe
1228	JkIbhMm.exe
4668	wGruTzT.exe
1084	lRHMTgD.exe
3932	dYhUVqr.exe
1616	ODCUsUp.exe
2120	mlSQGfQ.exe
3088	nbYFEBj.exe
4076	fsyeKVR.exe
1872	pePSDsp.exe
3904	TOuVgwl.exe
3628	hMpdptJ.exe
2780	EYQEoqy.exe
3516	TYximOc.exe
4280	fPwoEsw.exe
2364	UcmmyEY.exe
4956	vvVlcBK.exe
2096	TeBqczx.exe
388	GTVFRIB.exe
3160	vbKBUmP.exe
1472	PFfpukl.exe
4804	FsSxVNn.exe
3368	qmhmxqp.exe
4344	exKrPoz.exe
4352	oekzkOF.exe
1620	vzZdkVA.exe
2556	hFGIfGU.exe
1528	vWOcyVl.exe
232	ZiJuhkX.exe
1376	UHxaDyO.exe
2612	ryaYdVQ.exe
5076	hJPUqOD.exe
1804	qVQzOPx.exe
3812	JQymxma.exe
1920	kZHMCDm.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\clqCfWR.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\oekzkOF.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\IobAVES.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\kAcwEdc.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\MEHIxbB.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\QKIfDNd.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\OAvRovk.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\FsVHxVo.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\IIelegH.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\hTtqRHM.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\mhrtETP.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\sAIBjjI.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\YnqanSK.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\yemTRaj.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\UJywixo.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\xLRXQgW.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\nlmHkQu.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\cfOqQbV.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\LHUcISL.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\dsCLhXZ.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\FiijKvJ.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\tUuEqGc.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\JjPkwxY.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\UcmmyEY.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\uooKGsJ.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\OEYiivP.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\CkVXDDp.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\wSuawju.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\MmxVJlh.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\GleWjan.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\NdKmYYf.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\yLgayfd.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\MNibjCB.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\yNwaUAv.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\hHzCILn.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\FaTXmzC.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\rNJgvOJ.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\jcbXcrp.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\CwsOqOm.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\tZvstze.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\iEzKurn.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\hnsgNEy.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\EHeMAmC.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\sbgLjSG.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\NbwbrXW.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\umYUXKU.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\oSteJxu.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\bDadYFS.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\HdEkYEe.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\gNTrzsj.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\DgVZhyb.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\hBxVGtP.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\NToacWx.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\SDUcfBz.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\mlzRgmE.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\LYGyiwT.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\JGeGjOX.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\jFMPUYE.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\cbzZkEP.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\YAOkaLe.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\jYTbuzr.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\aXpkoFw.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\JQymxma.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
File created	C:\Windows\System\gpXXyxt.exe	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16536	dwm.exe
Token: SeChangeNotifyPrivilege	16536	dwm.exe
Token: 33	16536	dwm.exe
Token: SeIncBasePriorityPrivilege	16536	dwm.exe
Token: SeShutdownPrivilege	16536	dwm.exe
Token: SeCreatePagefilePrivilege	16536	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3020	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	82
PID 4852 wrote to memory of 3020	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	82
PID 4852 wrote to memory of 1584	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	83
PID 4852 wrote to memory of 1584	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	83
PID 4852 wrote to memory of 2852	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	84
PID 4852 wrote to memory of 2852	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	84
PID 4852 wrote to memory of 3108	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	85
PID 4852 wrote to memory of 3108	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	85
PID 4852 wrote to memory of 3184	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	86
PID 4852 wrote to memory of 3184	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	86
PID 4852 wrote to memory of 3172	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	88
PID 4852 wrote to memory of 3172	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	88
PID 4852 wrote to memory of 3152	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	89
PID 4852 wrote to memory of 3152	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	89
PID 4852 wrote to memory of 1796	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	90
PID 4852 wrote to memory of 1796	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	90
PID 4852 wrote to memory of 1708	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	91
PID 4852 wrote to memory of 1708	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	91
PID 4852 wrote to memory of 2504	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	92
PID 4852 wrote to memory of 2504	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	92
PID 4852 wrote to memory of 1388	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	93
PID 4852 wrote to memory of 1388	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	93
PID 4852 wrote to memory of 3348	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	94
PID 4852 wrote to memory of 3348	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	94
PID 4852 wrote to memory of 2164	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	95
PID 4852 wrote to memory of 2164	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	95
PID 4852 wrote to memory of 2088	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	96
PID 4852 wrote to memory of 2088	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	96
PID 4852 wrote to memory of 4636	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	97
PID 4852 wrote to memory of 4636	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	97
PID 4852 wrote to memory of 3032	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	98
PID 4852 wrote to memory of 3032	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	98
PID 4852 wrote to memory of 1652	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	99
PID 4852 wrote to memory of 1652	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	99
PID 4852 wrote to memory of 2416	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	100
PID 4852 wrote to memory of 2416	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	100
PID 4852 wrote to memory of 5072	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	101
PID 4852 wrote to memory of 5072	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	101
PID 4852 wrote to memory of 1112	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	102
PID 4852 wrote to memory of 1112	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	102
PID 4852 wrote to memory of 3744	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	103
PID 4852 wrote to memory of 3744	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	103
PID 4852 wrote to memory of 5068	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	104
PID 4852 wrote to memory of 5068	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	104
PID 4852 wrote to memory of 5008	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	105
PID 4852 wrote to memory of 5008	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	105
PID 4852 wrote to memory of 4368	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	106
PID 4852 wrote to memory of 4368	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	106
PID 4852 wrote to memory of 1828	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	107
PID 4852 wrote to memory of 1828	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	107
PID 4852 wrote to memory of 1568	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	108
PID 4852 wrote to memory of 1568	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	108
PID 4852 wrote to memory of 632	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	109
PID 4852 wrote to memory of 632	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	109
PID 4852 wrote to memory of 3232	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	110
PID 4852 wrote to memory of 3232	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	110
PID 4852 wrote to memory of 5104	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	111
PID 4852 wrote to memory of 5104	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	111
PID 4852 wrote to memory of 4544	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	112
PID 4852 wrote to memory of 4544	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	112
PID 4852 wrote to memory of 1228	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	113
PID 4852 wrote to memory of 1228	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	113
PID 4852 wrote to memory of 4668	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	114
PID 4852 wrote to memory of 4668	4852	a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe	114

C:\Users\Admin\AppData\Local\Temp\a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe
"C:\Users\Admin\AppData\Local\Temp\a4ba6317a5244930e3aae2f50949d81588f3afd9cce144b22131061a73e32dc1.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\System\kqlstGi.exe
  C:\Windows\System\kqlstGi.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\TtjoBPt.exe
  C:\Windows\System\TtjoBPt.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\sBhzrhp.exe
  C:\Windows\System\sBhzrhp.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\OAvRovk.exe
  C:\Windows\System\OAvRovk.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\fqrIWJR.exe
  C:\Windows\System\fqrIWJR.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\JnbBYyi.exe
  C:\Windows\System\JnbBYyi.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\rHMawgb.exe
  C:\Windows\System\rHMawgb.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\mSwLtkY.exe
  C:\Windows\System\mSwLtkY.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\EOdhclL.exe
  C:\Windows\System\EOdhclL.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\yfNIDXu.exe
  C:\Windows\System\yfNIDXu.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\QMiTyfX.exe
  C:\Windows\System\QMiTyfX.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\LsunzOa.exe
  C:\Windows\System\LsunzOa.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\UUQMIbL.exe
  C:\Windows\System\UUQMIbL.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\SDUcfBz.exe
  C:\Windows\System\SDUcfBz.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\qIWYRGQ.exe
  C:\Windows\System\qIWYRGQ.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\ODIYbbz.exe
  C:\Windows\System\ODIYbbz.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\TfUYWTI.exe
  C:\Windows\System\TfUYWTI.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\MUiOYrS.exe
  C:\Windows\System\MUiOYrS.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\iLFktTH.exe
  C:\Windows\System\iLFktTH.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\NKFYVAi.exe
  C:\Windows\System\NKFYVAi.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\mhrtETP.exe
  C:\Windows\System\mhrtETP.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\nLZZCUI.exe
  C:\Windows\System\nLZZCUI.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\xJSNoxL.exe
  C:\Windows\System\xJSNoxL.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\omxafpB.exe
  C:\Windows\System\omxafpB.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\YKzPCzq.exe
  C:\Windows\System\YKzPCzq.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\sbgLjSG.exe
  C:\Windows\System\sbgLjSG.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\GwoDDEJ.exe
  C:\Windows\System\GwoDDEJ.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\FMWuhRN.exe
  C:\Windows\System\FMWuhRN.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\UYaiNzp.exe
  C:\Windows\System\UYaiNzp.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\QEjzRLG.exe
  C:\Windows\System\QEjzRLG.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\JkIbhMm.exe
  C:\Windows\System\JkIbhMm.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\wGruTzT.exe
  C:\Windows\System\wGruTzT.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\lRHMTgD.exe
  C:\Windows\System\lRHMTgD.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\dYhUVqr.exe
  C:\Windows\System\dYhUVqr.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\ODCUsUp.exe
  C:\Windows\System\ODCUsUp.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\mlSQGfQ.exe
  C:\Windows\System\mlSQGfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\nbYFEBj.exe
  C:\Windows\System\nbYFEBj.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\fsyeKVR.exe
  C:\Windows\System\fsyeKVR.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\pePSDsp.exe
  C:\Windows\System\pePSDsp.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\TOuVgwl.exe
  C:\Windows\System\TOuVgwl.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\hMpdptJ.exe
  C:\Windows\System\hMpdptJ.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\EYQEoqy.exe
  C:\Windows\System\EYQEoqy.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\TYximOc.exe
  C:\Windows\System\TYximOc.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\fPwoEsw.exe
  C:\Windows\System\fPwoEsw.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\UcmmyEY.exe
  C:\Windows\System\UcmmyEY.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\vvVlcBK.exe
  C:\Windows\System\vvVlcBK.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\TeBqczx.exe
  C:\Windows\System\TeBqczx.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\GTVFRIB.exe
  C:\Windows\System\GTVFRIB.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\vbKBUmP.exe
  C:\Windows\System\vbKBUmP.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\PFfpukl.exe
  C:\Windows\System\PFfpukl.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\FsSxVNn.exe
  C:\Windows\System\FsSxVNn.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\qmhmxqp.exe
  C:\Windows\System\qmhmxqp.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\exKrPoz.exe
  C:\Windows\System\exKrPoz.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\oekzkOF.exe
  C:\Windows\System\oekzkOF.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\vzZdkVA.exe
  C:\Windows\System\vzZdkVA.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\hFGIfGU.exe
  C:\Windows\System\hFGIfGU.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\vWOcyVl.exe
  C:\Windows\System\vWOcyVl.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\ZiJuhkX.exe
  C:\Windows\System\ZiJuhkX.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\UHxaDyO.exe
  C:\Windows\System\UHxaDyO.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\ryaYdVQ.exe
  C:\Windows\System\ryaYdVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\hJPUqOD.exe
  C:\Windows\System\hJPUqOD.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\qVQzOPx.exe
  C:\Windows\System\qVQzOPx.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\JQymxma.exe
  C:\Windows\System\JQymxma.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\kZHMCDm.exe
  C:\Windows\System\kZHMCDm.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\xAxkqFG.exe
  C:\Windows\System\xAxkqFG.exe
  2⤵
  PID:2276
- C:\Windows\System\KemLrOZ.exe
  C:\Windows\System\KemLrOZ.exe
  2⤵
  PID:2020
- C:\Windows\System\WLWhDUk.exe
  C:\Windows\System\WLWhDUk.exe
  2⤵
  PID:2312
- C:\Windows\System\zvlPjfi.exe
  C:\Windows\System\zvlPjfi.exe
  2⤵
  PID:4584
- C:\Windows\System\lAHkOym.exe
  C:\Windows\System\lAHkOym.exe
  2⤵
  PID:3612
- C:\Windows\System\UlGlihD.exe
  C:\Windows\System\UlGlihD.exe
  2⤵
  PID:3424
- C:\Windows\System\FPlJOro.exe
  C:\Windows\System\FPlJOro.exe
  2⤵
  PID:4776
- C:\Windows\System\UddVVPh.exe
  C:\Windows\System\UddVVPh.exe
  2⤵
  PID:4484
- C:\Windows\System\TCysheG.exe
  C:\Windows\System\TCysheG.exe
  2⤵
  PID:3480
- C:\Windows\System\hSMUmbh.exe
  C:\Windows\System\hSMUmbh.exe
  2⤵
  PID:4380
- C:\Windows\System\gpXXyxt.exe
  C:\Windows\System\gpXXyxt.exe
  2⤵
  PID:432
- C:\Windows\System\dOkuFJP.exe
  C:\Windows\System\dOkuFJP.exe
  2⤵
  PID:3644
- C:\Windows\System\ngqtGyG.exe
  C:\Windows\System\ngqtGyG.exe
  2⤵
  PID:1048
- C:\Windows\System\udCecKS.exe
  C:\Windows\System\udCecKS.exe
  2⤵
  PID:1468
- C:\Windows\System\ZbhkIZH.exe
  C:\Windows\System\ZbhkIZH.exe
  2⤵
  PID:532
- C:\Windows\System\dsCLhXZ.exe
  C:\Windows\System\dsCLhXZ.exe
  2⤵
  PID:3996
- C:\Windows\System\duugbUn.exe
  C:\Windows\System\duugbUn.exe
  2⤵
  PID:1728
- C:\Windows\System\WTRFYrA.exe
  C:\Windows\System\WTRFYrA.exe
  2⤵
  PID:3752
- C:\Windows\System\UYlYsGq.exe
  C:\Windows\System\UYlYsGq.exe
  2⤵
  PID:1892
- C:\Windows\System\RcfJmcK.exe
  C:\Windows\System\RcfJmcK.exe
  2⤵
  PID:1664
- C:\Windows\System\erNABWp.exe
  C:\Windows\System\erNABWp.exe
  2⤵
  PID:1756
- C:\Windows\System\LmiWXFI.exe
  C:\Windows\System\LmiWXFI.exe
  2⤵
  PID:4244
- C:\Windows\System\ButtzDV.exe
  C:\Windows\System\ButtzDV.exe
  2⤵
  PID:4880
- C:\Windows\System\KbOZcBZ.exe
  C:\Windows\System\KbOZcBZ.exe
  2⤵
  PID:1880
- C:\Windows\System\JwfXXSq.exe
  C:\Windows\System\JwfXXSq.exe
  2⤵
  PID:4148
- C:\Windows\System\HJUIKdg.exe
  C:\Windows\System\HJUIKdg.exe
  2⤵
  PID:5140
- C:\Windows\System\HcqNqpV.exe
  C:\Windows\System\HcqNqpV.exe
  2⤵
  PID:5168
- C:\Windows\System\SkjOgzj.exe
  C:\Windows\System\SkjOgzj.exe
  2⤵
  PID:5196
- C:\Windows\System\vYIghgp.exe
  C:\Windows\System\vYIghgp.exe
  2⤵
  PID:5228
- C:\Windows\System\CwsOqOm.exe
  C:\Windows\System\CwsOqOm.exe
  2⤵
  PID:5256
- C:\Windows\System\hwkIQdl.exe
  C:\Windows\System\hwkIQdl.exe
  2⤵
  PID:5284
- C:\Windows\System\mzYBqvm.exe
  C:\Windows\System\mzYBqvm.exe
  2⤵
  PID:5312
- C:\Windows\System\iTUjhDn.exe
  C:\Windows\System\iTUjhDn.exe
  2⤵
  PID:5340
- C:\Windows\System\xiSGiOp.exe
  C:\Windows\System\xiSGiOp.exe
  2⤵
  PID:5368
- C:\Windows\System\IPNVGpP.exe
  C:\Windows\System\IPNVGpP.exe
  2⤵
  PID:5396
- C:\Windows\System\zYVGKsn.exe
  C:\Windows\System\zYVGKsn.exe
  2⤵
  PID:5424
- C:\Windows\System\sAIBjjI.exe
  C:\Windows\System\sAIBjjI.exe
  2⤵
  PID:5452
- C:\Windows\System\VhukNGn.exe
  C:\Windows\System\VhukNGn.exe
  2⤵
  PID:5480
- C:\Windows\System\hsyWUuh.exe
  C:\Windows\System\hsyWUuh.exe
  2⤵
  PID:5508
- C:\Windows\System\uPUXywx.exe
  C:\Windows\System\uPUXywx.exe
  2⤵
  PID:5536
- C:\Windows\System\bhRbdMU.exe
  C:\Windows\System\bhRbdMU.exe
  2⤵
  PID:5560
- C:\Windows\System\lhXZbKt.exe
  C:\Windows\System\lhXZbKt.exe
  2⤵
  PID:5592
- C:\Windows\System\PdijKsm.exe
  C:\Windows\System\PdijKsm.exe
  2⤵
  PID:5620
- C:\Windows\System\nvgPNOY.exe
  C:\Windows\System\nvgPNOY.exe
  2⤵
  PID:5648
- C:\Windows\System\toGqnlJ.exe
  C:\Windows\System\toGqnlJ.exe
  2⤵
  PID:5680
- C:\Windows\System\BjSoXQR.exe
  C:\Windows\System\BjSoXQR.exe
  2⤵
  PID:5704
- C:\Windows\System\JdtMNDZ.exe
  C:\Windows\System\JdtMNDZ.exe
  2⤵
  PID:5728
- C:\Windows\System\kSWqTrP.exe
  C:\Windows\System\kSWqTrP.exe
  2⤵
  PID:5756
- C:\Windows\System\RrxTybs.exe
  C:\Windows\System\RrxTybs.exe
  2⤵
  PID:5788
- C:\Windows\System\ykIQRqW.exe
  C:\Windows\System\ykIQRqW.exe
  2⤵
  PID:5812
- C:\Windows\System\ZPLFraJ.exe
  C:\Windows\System\ZPLFraJ.exe
  2⤵
  PID:5840
- C:\Windows\System\aELWffu.exe
  C:\Windows\System\aELWffu.exe
  2⤵
  PID:5872
- C:\Windows\System\dyovQFa.exe
  C:\Windows\System\dyovQFa.exe
  2⤵
  PID:5896
- C:\Windows\System\DglqLgb.exe
  C:\Windows\System\DglqLgb.exe
  2⤵
  PID:5928
- C:\Windows\System\NnqCCSC.exe
  C:\Windows\System\NnqCCSC.exe
  2⤵
  PID:5952
- C:\Windows\System\MCxzvoG.exe
  C:\Windows\System\MCxzvoG.exe
  2⤵
  PID:5980
- C:\Windows\System\bFIgyfk.exe
  C:\Windows\System\bFIgyfk.exe
  2⤵
  PID:6012
- C:\Windows\System\zCBpDPd.exe
  C:\Windows\System\zCBpDPd.exe
  2⤵
  PID:6036
- C:\Windows\System\URqVenL.exe
  C:\Windows\System\URqVenL.exe
  2⤵
  PID:6068
- C:\Windows\System\mHBsLym.exe
  C:\Windows\System\mHBsLym.exe
  2⤵
  PID:6096
- C:\Windows\System\dTaVoRi.exe
  C:\Windows\System\dTaVoRi.exe
  2⤵
  PID:6124
- C:\Windows\System\WGDDWkU.exe
  C:\Windows\System\WGDDWkU.exe
  2⤵
  PID:1676
- C:\Windows\System\wjXJZDi.exe
  C:\Windows\System\wjXJZDi.exe
  2⤵
  PID:3400
- C:\Windows\System\tZvstze.exe
  C:\Windows\System\tZvstze.exe
  2⤵
  PID:2928
- C:\Windows\System\nWAYiuY.exe
  C:\Windows\System\nWAYiuY.exe
  2⤵
  PID:4764
- C:\Windows\System\GFZBlML.exe
  C:\Windows\System\GFZBlML.exe
  2⤵
  PID:5132
- C:\Windows\System\ZTnlmHs.exe
  C:\Windows\System\ZTnlmHs.exe
  2⤵
  PID:5192
- C:\Windows\System\oFhrwib.exe
  C:\Windows\System\oFhrwib.exe
  2⤵
  PID:5268
- C:\Windows\System\AfiJtbz.exe
  C:\Windows\System\AfiJtbz.exe
  2⤵
  PID:5328
- C:\Windows\System\jmOXaPe.exe
  C:\Windows\System\jmOXaPe.exe
  2⤵
  PID:5388
- C:\Windows\System\crHRrxs.exe
  C:\Windows\System\crHRrxs.exe
  2⤵
  PID:5464
- C:\Windows\System\daNzdYf.exe
  C:\Windows\System\daNzdYf.exe
  2⤵
  PID:5524
- C:\Windows\System\jFMPUYE.exe
  C:\Windows\System\jFMPUYE.exe
  2⤵
  PID:5584
- C:\Windows\System\FiijKvJ.exe
  C:\Windows\System\FiijKvJ.exe
  2⤵
  PID:5636
- C:\Windows\System\DYrCyjs.exe
  C:\Windows\System\DYrCyjs.exe
  2⤵
  PID:5700
- C:\Windows\System\gXQGBzD.exe
  C:\Windows\System\gXQGBzD.exe
  2⤵
  PID:5772
- C:\Windows\System\tRXIgVJ.exe
  C:\Windows\System\tRXIgVJ.exe
  2⤵
  PID:5832
- C:\Windows\System\OmmhCfE.exe
  C:\Windows\System\OmmhCfE.exe
  2⤵
  PID:5864
- C:\Windows\System\kSCFueU.exe
  C:\Windows\System\kSCFueU.exe
  2⤵
  PID:5940
- C:\Windows\System\aCDRjFc.exe
  C:\Windows\System\aCDRjFc.exe
  2⤵
  PID:6000
- C:\Windows\System\XJVERap.exe
  C:\Windows\System\XJVERap.exe
  2⤵
  PID:6048
- C:\Windows\System\OELkcjH.exe
  C:\Windows\System\OELkcjH.exe
  2⤵
  PID:6108
- C:\Windows\System\CILPIJj.exe
  C:\Windows\System\CILPIJj.exe
  2⤵
  PID:3672
- C:\Windows\System\FOdDIZI.exe
  C:\Windows\System\FOdDIZI.exe
  2⤵
  PID:3376
- C:\Windows\System\YDfGNHo.exe
  C:\Windows\System\YDfGNHo.exe
  2⤵
  PID:5160
- C:\Windows\System\iEfXvYn.exe
  C:\Windows\System\iEfXvYn.exe
  2⤵
  PID:5300
- C:\Windows\System\CslvsXC.exe
  C:\Windows\System\CslvsXC.exe
  2⤵
  PID:3140
- C:\Windows\System\xGGPasl.exe
  C:\Windows\System\xGGPasl.exe
  2⤵
  PID:5576
- C:\Windows\System\zRYLOzd.exe
  C:\Windows\System\zRYLOzd.exe
  2⤵
  PID:5668
- C:\Windows\System\cbzZkEP.exe
  C:\Windows\System\cbzZkEP.exe
  2⤵
  PID:4272
- C:\Windows\System\yZSZNqD.exe
  C:\Windows\System\yZSZNqD.exe
  2⤵
  PID:5892
- C:\Windows\System\uvITtOg.exe
  C:\Windows\System\uvITtOg.exe
  2⤵
  PID:4608
- C:\Windows\System\sHFYOVX.exe
  C:\Windows\System\sHFYOVX.exe
  2⤵
  PID:6136
- C:\Windows\System\MXFCluR.exe
  C:\Windows\System\MXFCluR.exe
  2⤵
  PID:4580
- C:\Windows\System\gfClZLW.exe
  C:\Windows\System\gfClZLW.exe
  2⤵
  PID:5220
- C:\Windows\System\tdQOJTO.exe
  C:\Windows\System\tdQOJTO.exe
  2⤵
  PID:1336
- C:\Windows\System\MRzlFRv.exe
  C:\Windows\System\MRzlFRv.exe
  2⤵
  PID:5748
- C:\Windows\System\LVTfCOd.exe
  C:\Windows\System\LVTfCOd.exe
  2⤵
  PID:732
- C:\Windows\System\NPrtYSC.exe
  C:\Windows\System\NPrtYSC.exe
  2⤵
  PID:3972
- C:\Windows\System\QXlLUXi.exe
  C:\Windows\System\QXlLUXi.exe
  2⤵
  PID:5856
- C:\Windows\System\PySwGnT.exe
  C:\Windows\System\PySwGnT.exe
  2⤵
  PID:4528
- C:\Windows\System\saWoSIU.exe
  C:\Windows\System\saWoSIU.exe
  2⤵
  PID:624
- C:\Windows\System\BpXSXnZ.exe
  C:\Windows\System\BpXSXnZ.exe
  2⤵
  PID:2036
- C:\Windows\System\XwGIMri.exe
  C:\Windows\System\XwGIMri.exe
  2⤵
  PID:5836
- C:\Windows\System\EGmbiRx.exe
  C:\Windows\System\EGmbiRx.exe
  2⤵
  PID:5916
- C:\Windows\System\IApJWqW.exe
  C:\Windows\System\IApJWqW.exe
  2⤵
  PID:2508
- C:\Windows\System\NmdoWGV.exe
  C:\Windows\System\NmdoWGV.exe
  2⤵
  PID:5044
- C:\Windows\System\sCWnYGA.exe
  C:\Windows\System\sCWnYGA.exe
  2⤵
  PID:4212
- C:\Windows\System\QykpraK.exe
  C:\Windows\System\QykpraK.exe
  2⤵
  PID:3328
- C:\Windows\System\PqkThcq.exe
  C:\Windows\System\PqkThcq.exe
  2⤵
  PID:6168
- C:\Windows\System\AsmnAgB.exe
  C:\Windows\System\AsmnAgB.exe
  2⤵
  PID:6200
- C:\Windows\System\czTJJyq.exe
  C:\Windows\System\czTJJyq.exe
  2⤵
  PID:6228
- C:\Windows\System\cGROuCL.exe
  C:\Windows\System\cGROuCL.exe
  2⤵
  PID:6256
- C:\Windows\System\TtIpvQE.exe
  C:\Windows\System\TtIpvQE.exe
  2⤵
  PID:6284
- C:\Windows\System\LbgvNrk.exe
  C:\Windows\System\LbgvNrk.exe
  2⤵
  PID:6312
- C:\Windows\System\GleWjan.exe
  C:\Windows\System\GleWjan.exe
  2⤵
  PID:6328
- C:\Windows\System\vIeZovx.exe
  C:\Windows\System\vIeZovx.exe
  2⤵
  PID:6356
- C:\Windows\System\zeDBXzf.exe
  C:\Windows\System\zeDBXzf.exe
  2⤵
  PID:6396
- C:\Windows\System\MWtTOhK.exe
  C:\Windows\System\MWtTOhK.exe
  2⤵
  PID:6424
- C:\Windows\System\hqaQLFC.exe
  C:\Windows\System\hqaQLFC.exe
  2⤵
  PID:6444
- C:\Windows\System\DkjxQOD.exe
  C:\Windows\System\DkjxQOD.exe
  2⤵
  PID:6500
- C:\Windows\System\fQIXFVF.exe
  C:\Windows\System\fQIXFVF.exe
  2⤵
  PID:6516
- C:\Windows\System\jObvOzu.exe
  C:\Windows\System\jObvOzu.exe
  2⤵
  PID:6532
- C:\Windows\System\wIpamAO.exe
  C:\Windows\System\wIpamAO.exe
  2⤵
  PID:6572
- C:\Windows\System\UCAEXoO.exe
  C:\Windows\System\UCAEXoO.exe
  2⤵
  PID:6600
- C:\Windows\System\qDbAVjv.exe
  C:\Windows\System\qDbAVjv.exe
  2⤵
  PID:6620
- C:\Windows\System\ofKMgTF.exe
  C:\Windows\System\ofKMgTF.exe
  2⤵
  PID:6644
- C:\Windows\System\PqHvNKC.exe
  C:\Windows\System\PqHvNKC.exe
  2⤵
  PID:6664
- C:\Windows\System\QoHhfge.exe
  C:\Windows\System\QoHhfge.exe
  2⤵
  PID:6688
- C:\Windows\System\huPVQuh.exe
  C:\Windows\System\huPVQuh.exe
  2⤵
  PID:6716
- C:\Windows\System\borkLZR.exe
  C:\Windows\System\borkLZR.exe
  2⤵
  PID:6736
- C:\Windows\System\lotbTlz.exe
  C:\Windows\System\lotbTlz.exe
  2⤵
  PID:6756
- C:\Windows\System\qgkWEvL.exe
  C:\Windows\System\qgkWEvL.exe
  2⤵
  PID:6780
- C:\Windows\System\mnTwYyI.exe
  C:\Windows\System\mnTwYyI.exe
  2⤵
  PID:6832
- C:\Windows\System\CGqClgk.exe
  C:\Windows\System\CGqClgk.exe
  2⤵
  PID:6868
- C:\Windows\System\nZgmpCH.exe
  C:\Windows\System\nZgmpCH.exe
  2⤵
  PID:6888
- C:\Windows\System\rQsPpke.exe
  C:\Windows\System\rQsPpke.exe
  2⤵
  PID:6920
- C:\Windows\System\DIEUVKC.exe
  C:\Windows\System\DIEUVKC.exe
  2⤵
  PID:6952
- C:\Windows\System\McOoywr.exe
  C:\Windows\System\McOoywr.exe
  2⤵
  PID:6968
- C:\Windows\System\jAszIJC.exe
  C:\Windows\System\jAszIJC.exe
  2⤵
  PID:7016
- C:\Windows\System\tIoKPUR.exe
  C:\Windows\System\tIoKPUR.exe
  2⤵
  PID:7052
- C:\Windows\System\CjfZzfN.exe
  C:\Windows\System\CjfZzfN.exe
  2⤵
  PID:7080
- C:\Windows\System\esoLmJV.exe
  C:\Windows\System\esoLmJV.exe
  2⤵
  PID:7104
- C:\Windows\System\xSjVhAr.exe
  C:\Windows\System\xSjVhAr.exe
  2⤵
  PID:7136
- C:\Windows\System\CsKhydW.exe
  C:\Windows\System\CsKhydW.exe
  2⤵
  PID:7160
- C:\Windows\System\FmltNzk.exe
  C:\Windows\System\FmltNzk.exe
  2⤵
  PID:6212
- C:\Windows\System\ZlppMPl.exe
  C:\Windows\System\ZlppMPl.exe
  2⤵
  PID:6276
- C:\Windows\System\JXZVZsm.exe
  C:\Windows\System\JXZVZsm.exe
  2⤵
  PID:6304
- C:\Windows\System\pscOdlh.exe
  C:\Windows\System\pscOdlh.exe
  2⤵
  PID:6388
- C:\Windows\System\eeVJApx.exe
  C:\Windows\System\eeVJApx.exe
  2⤵
  PID:6452
- C:\Windows\System\WNLgzIW.exe
  C:\Windows\System\WNLgzIW.exe
  2⤵
  PID:6528
- C:\Windows\System\TCRYczP.exe
  C:\Windows\System\TCRYczP.exe
  2⤵
  PID:6588
- C:\Windows\System\NatUEFL.exe
  C:\Windows\System\NatUEFL.exe
  2⤵
  PID:6684
- C:\Windows\System\DweoWvs.exe
  C:\Windows\System\DweoWvs.exe
  2⤵
  PID:6772
- C:\Windows\System\boiEUSe.exe
  C:\Windows\System\boiEUSe.exe
  2⤵
  PID:6820
- C:\Windows\System\juDsnrI.exe
  C:\Windows\System\juDsnrI.exe
  2⤵
  PID:6912
- C:\Windows\System\PnZGLqZ.exe
  C:\Windows\System\PnZGLqZ.exe
  2⤵
  PID:6964
- C:\Windows\System\TuQDawK.exe
  C:\Windows\System\TuQDawK.exe
  2⤵
  PID:7092
- C:\Windows\System\USlrtDX.exe
  C:\Windows\System\USlrtDX.exe
  2⤵
  PID:7128
- C:\Windows\System\LWTvUmH.exe
  C:\Windows\System\LWTvUmH.exe
  2⤵
  PID:6240
- C:\Windows\System\FbbBMsn.exe
  C:\Windows\System\FbbBMsn.exe
  2⤵
  PID:6352
- C:\Windows\System\HnerfOq.exe
  C:\Windows\System\HnerfOq.exe
  2⤵
  PID:6464
- C:\Windows\System\IiNHuWm.exe
  C:\Windows\System\IiNHuWm.exe
  2⤵
  PID:6724
- C:\Windows\System\NdKmYYf.exe
  C:\Windows\System\NdKmYYf.exe
  2⤵
  PID:6860
- C:\Windows\System\MVgOKPi.exe
  C:\Windows\System\MVgOKPi.exe
  2⤵
  PID:7024
- C:\Windows\System\bLQcRcc.exe
  C:\Windows\System\bLQcRcc.exe
  2⤵
  PID:6300
- C:\Windows\System\muVLlxk.exe
  C:\Windows\System\muVLlxk.exe
  2⤵
  PID:6656
- C:\Windows\System\LoPHmnA.exe
  C:\Windows\System\LoPHmnA.exe
  2⤵
  PID:7112
- C:\Windows\System\ybUjeES.exe
  C:\Windows\System\ybUjeES.exe
  2⤵
  PID:6768
- C:\Windows\System\aFScaNU.exe
  C:\Windows\System\aFScaNU.exe
  2⤵
  PID:7180
- C:\Windows\System\wygKDHW.exe
  C:\Windows\System\wygKDHW.exe
  2⤵
  PID:7208
- C:\Windows\System\tRNMlkv.exe
  C:\Windows\System\tRNMlkv.exe
  2⤵
  PID:7236
- C:\Windows\System\NGiiAXd.exe
  C:\Windows\System\NGiiAXd.exe
  2⤵
  PID:7252
- C:\Windows\System\GpTDsDf.exe
  C:\Windows\System\GpTDsDf.exe
  2⤵
  PID:7284
- C:\Windows\System\fSEXlwf.exe
  C:\Windows\System\fSEXlwf.exe
  2⤵
  PID:7320
- C:\Windows\System\SNLqkMv.exe
  C:\Windows\System\SNLqkMv.exe
  2⤵
  PID:7336
- C:\Windows\System\ikOGwzS.exe
  C:\Windows\System\ikOGwzS.exe
  2⤵
  PID:7368
- C:\Windows\System\rcbCeNv.exe
  C:\Windows\System\rcbCeNv.exe
  2⤵
  PID:7404
- C:\Windows\System\jdrwDXo.exe
  C:\Windows\System\jdrwDXo.exe
  2⤵
  PID:7420
- C:\Windows\System\CSCKgCC.exe
  C:\Windows\System\CSCKgCC.exe
  2⤵
  PID:7448
- C:\Windows\System\qMybMca.exe
  C:\Windows\System\qMybMca.exe
  2⤵
  PID:7476
- C:\Windows\System\nvGiKIn.exe
  C:\Windows\System\nvGiKIn.exe
  2⤵
  PID:7516
- C:\Windows\System\yRSawRy.exe
  C:\Windows\System\yRSawRy.exe
  2⤵
  PID:7532
- C:\Windows\System\wPzPPGC.exe
  C:\Windows\System\wPzPPGC.exe
  2⤵
  PID:7572
- C:\Windows\System\XzLaZnw.exe
  C:\Windows\System\XzLaZnw.exe
  2⤵
  PID:7600
- C:\Windows\System\xLRXQgW.exe
  C:\Windows\System\xLRXQgW.exe
  2⤵
  PID:7632
- C:\Windows\System\LbSPxgd.exe
  C:\Windows\System\LbSPxgd.exe
  2⤵
  PID:7656
- C:\Windows\System\nlmHkQu.exe
  C:\Windows\System\nlmHkQu.exe
  2⤵
  PID:7688
- C:\Windows\System\EPWGBCU.exe
  C:\Windows\System\EPWGBCU.exe
  2⤵
  PID:7712
- C:\Windows\System\mUxdtwE.exe
  C:\Windows\System\mUxdtwE.exe
  2⤵
  PID:7740
- C:\Windows\System\USlcELX.exe
  C:\Windows\System\USlcELX.exe
  2⤵
  PID:7756
- C:\Windows\System\cRltQSE.exe
  C:\Windows\System\cRltQSE.exe
  2⤵
  PID:7800
- C:\Windows\System\qGzrbge.exe
  C:\Windows\System\qGzrbge.exe
  2⤵
  PID:7828
- C:\Windows\System\rIAIzbU.exe
  C:\Windows\System\rIAIzbU.exe
  2⤵
  PID:7860
- C:\Windows\System\XbytDfo.exe
  C:\Windows\System\XbytDfo.exe
  2⤵
  PID:7892
- C:\Windows\System\GmLoQfO.exe
  C:\Windows\System\GmLoQfO.exe
  2⤵
  PID:7936
- C:\Windows\System\ySRVQTn.exe
  C:\Windows\System\ySRVQTn.exe
  2⤵
  PID:7952
- C:\Windows\System\hbebFnK.exe
  C:\Windows\System\hbebFnK.exe
  2⤵
  PID:7972
- C:\Windows\System\pFjTKdS.exe
  C:\Windows\System\pFjTKdS.exe
  2⤵
  PID:8008
- C:\Windows\System\vNKFFbb.exe
  C:\Windows\System\vNKFFbb.exe
  2⤵
  PID:8024
- C:\Windows\System\rvNEQVa.exe
  C:\Windows\System\rvNEQVa.exe
  2⤵
  PID:8072
- C:\Windows\System\kAcwEdc.exe
  C:\Windows\System\kAcwEdc.exe
  2⤵
  PID:8096
- C:\Windows\System\umYUXKU.exe
  C:\Windows\System\umYUXKU.exe
  2⤵
  PID:8116
- C:\Windows\System\yFJQMuh.exe
  C:\Windows\System\yFJQMuh.exe
  2⤵
  PID:8144
- C:\Windows\System\LYTXmCz.exe
  C:\Windows\System\LYTXmCz.exe
  2⤵
  PID:8172
- C:\Windows\System\GwgheYx.exe
  C:\Windows\System\GwgheYx.exe
  2⤵
  PID:7192
- C:\Windows\System\lWGhIVy.exe
  C:\Windows\System\lWGhIVy.exe
  2⤵
  PID:7312
- C:\Windows\System\vDHgUWA.exe
  C:\Windows\System\vDHgUWA.exe
  2⤵
  PID:7388
- C:\Windows\System\dyrrdPb.exe
  C:\Windows\System\dyrrdPb.exe
  2⤵
  PID:7432
- C:\Windows\System\Kxdouiy.exe
  C:\Windows\System\Kxdouiy.exe
  2⤵
  PID:7488
- C:\Windows\System\WbeNBBP.exe
  C:\Windows\System\WbeNBBP.exe
  2⤵
  PID:7584
- C:\Windows\System\dkyIEtj.exe
  C:\Windows\System\dkyIEtj.exe
  2⤵
  PID:7628
- C:\Windows\System\vvUoOmi.exe
  C:\Windows\System\vvUoOmi.exe
  2⤵
  PID:7700
- C:\Windows\System\GTpswfC.exe
  C:\Windows\System\GTpswfC.exe
  2⤵
  PID:7792
- C:\Windows\System\ftNPIXi.exe
  C:\Windows\System\ftNPIXi.exe
  2⤵
  PID:7872
- C:\Windows\System\XQvLPGS.exe
  C:\Windows\System\XQvLPGS.exe
  2⤵
  PID:1540
- C:\Windows\System\fLIKXZw.exe
  C:\Windows\System\fLIKXZw.exe
  2⤵
  PID:7948
- C:\Windows\System\sKryNMt.exe
  C:\Windows\System\sKryNMt.exe
  2⤵
  PID:2604
- C:\Windows\System\WoZuofy.exe
  C:\Windows\System\WoZuofy.exe
  2⤵
  PID:8020
- C:\Windows\System\EBbnQSD.exe
  C:\Windows\System\EBbnQSD.exe
  2⤵
  PID:8088
- C:\Windows\System\hRkwbep.exe
  C:\Windows\System\hRkwbep.exe
  2⤵
  PID:8160
- C:\Windows\System\JpEMZDP.exe
  C:\Windows\System\JpEMZDP.exe
  2⤵
  PID:7264
- C:\Windows\System\UFBRDIX.exe
  C:\Windows\System\UFBRDIX.exe
  2⤵
  PID:7460
- C:\Windows\System\zLpBUdt.exe
  C:\Windows\System\zLpBUdt.exe
  2⤵
  PID:7620
- C:\Windows\System\DwgBUZB.exe
  C:\Windows\System\DwgBUZB.exe
  2⤵
  PID:7748
- C:\Windows\System\hGkhYtQ.exe
  C:\Windows\System\hGkhYtQ.exe
  2⤵
  PID:7888
- C:\Windows\System\MGygwKn.exe
  C:\Windows\System\MGygwKn.exe
  2⤵
  PID:7040
- C:\Windows\System\XPwtPaw.exe
  C:\Windows\System\XPwtPaw.exe
  2⤵
  PID:8056
- C:\Windows\System\LiBmJTv.exe
  C:\Windows\System\LiBmJTv.exe
  2⤵
  PID:7200
- C:\Windows\System\GTzVnFb.exe
  C:\Windows\System\GTzVnFb.exe
  2⤵
  PID:6476
- C:\Windows\System\mikBZQa.exe
  C:\Windows\System\mikBZQa.exe
  2⤵
  PID:8000
- C:\Windows\System\IhnNYZr.exe
  C:\Windows\System\IhnNYZr.exe
  2⤵
  PID:6472
- C:\Windows\System\IobAVES.exe
  C:\Windows\System\IobAVES.exe
  2⤵
  PID:8200
- C:\Windows\System\qwyxlYL.exe
  C:\Windows\System\qwyxlYL.exe
  2⤵
  PID:8228
- C:\Windows\System\aKegLUH.exe
  C:\Windows\System\aKegLUH.exe
  2⤵
  PID:8252
- C:\Windows\System\WPRRZjc.exe
  C:\Windows\System\WPRRZjc.exe
  2⤵
  PID:8280
- C:\Windows\System\ojvalja.exe
  C:\Windows\System\ojvalja.exe
  2⤵
  PID:8304
- C:\Windows\System\onXbyzT.exe
  C:\Windows\System\onXbyzT.exe
  2⤵
  PID:8332
- C:\Windows\System\WQbIcZd.exe
  C:\Windows\System\WQbIcZd.exe
  2⤵
  PID:8360
- C:\Windows\System\PqePSKQ.exe
  C:\Windows\System\PqePSKQ.exe
  2⤵
  PID:8388
- C:\Windows\System\dOcGoNA.exe
  C:\Windows\System\dOcGoNA.exe
  2⤵
  PID:8424
- C:\Windows\System\FVtFtCz.exe
  C:\Windows\System\FVtFtCz.exe
  2⤵
  PID:8456
- C:\Windows\System\VANTVCu.exe
  C:\Windows\System\VANTVCu.exe
  2⤵
  PID:8480
- C:\Windows\System\WTEzMrt.exe
  C:\Windows\System\WTEzMrt.exe
  2⤵
  PID:8512
- C:\Windows\System\sKizFtg.exe
  C:\Windows\System\sKizFtg.exe
  2⤵
  PID:8540
- C:\Windows\System\HgefjTS.exe
  C:\Windows\System\HgefjTS.exe
  2⤵
  PID:8568
- C:\Windows\System\lPDEEbV.exe
  C:\Windows\System\lPDEEbV.exe
  2⤵
  PID:8596
- C:\Windows\System\BNiGvjj.exe
  C:\Windows\System\BNiGvjj.exe
  2⤵
  PID:8612
- C:\Windows\System\rNJgvOJ.exe
  C:\Windows\System\rNJgvOJ.exe
  2⤵
  PID:8640
- C:\Windows\System\dwSeaRJ.exe
  C:\Windows\System\dwSeaRJ.exe
  2⤵
  PID:8680
- C:\Windows\System\JrcGYsq.exe
  C:\Windows\System\JrcGYsq.exe
  2⤵
  PID:8708
- C:\Windows\System\GmwusaI.exe
  C:\Windows\System\GmwusaI.exe
  2⤵
  PID:8724
- C:\Windows\System\HieXgMa.exe
  C:\Windows\System\HieXgMa.exe
  2⤵
  PID:8752
- C:\Windows\System\vMjOXGJ.exe
  C:\Windows\System\vMjOXGJ.exe
  2⤵
  PID:8772
- C:\Windows\System\AkiJryR.exe
  C:\Windows\System\AkiJryR.exe
  2⤵
  PID:8796
- C:\Windows\System\ztjBYBD.exe
  C:\Windows\System\ztjBYBD.exe
  2⤵
  PID:8812
- C:\Windows\System\oLsxQOC.exe
  C:\Windows\System\oLsxQOC.exe
  2⤵
  PID:8860
- C:\Windows\System\uooKGsJ.exe
  C:\Windows\System\uooKGsJ.exe
  2⤵
  PID:8884
- C:\Windows\System\hoQlbxP.exe
  C:\Windows\System\hoQlbxP.exe
  2⤵
  PID:8912
- C:\Windows\System\nDdFAex.exe
  C:\Windows\System\nDdFAex.exe
  2⤵
  PID:8932
- C:\Windows\System\BOCqvvM.exe
  C:\Windows\System\BOCqvvM.exe
  2⤵
  PID:8988
- C:\Windows\System\AbBGfNK.exe
  C:\Windows\System\AbBGfNK.exe
  2⤵
  PID:9016
- C:\Windows\System\XjwxRPc.exe
  C:\Windows\System\XjwxRPc.exe
  2⤵
  PID:9044
- C:\Windows\System\yLgayfd.exe
  C:\Windows\System\yLgayfd.exe
  2⤵
  PID:9080
- C:\Windows\System\vZPRhct.exe
  C:\Windows\System\vZPRhct.exe
  2⤵
  PID:9108
- C:\Windows\System\fREbsYr.exe
  C:\Windows\System\fREbsYr.exe
  2⤵
  PID:9128
- C:\Windows\System\PChuzOW.exe
  C:\Windows\System\PChuzOW.exe
  2⤵
  PID:9152
- C:\Windows\System\xxYVDEu.exe
  C:\Windows\System\xxYVDEu.exe
  2⤵
  PID:9180
- C:\Windows\System\Dihmdsm.exe
  C:\Windows\System\Dihmdsm.exe
  2⤵
  PID:9208
- C:\Windows\System\rcHefLs.exe
  C:\Windows\System\rcHefLs.exe
  2⤵
  PID:8224
- C:\Windows\System\QrKgJvx.exe
  C:\Windows\System\QrKgJvx.exe
  2⤵
  PID:8324
- C:\Windows\System\KqdSeIP.exe
  C:\Windows\System\KqdSeIP.exe
  2⤵
  PID:8380
- C:\Windows\System\cIOubGm.exe
  C:\Windows\System\cIOubGm.exe
  2⤵
  PID:8452
- C:\Windows\System\oyhyLJA.exe
  C:\Windows\System\oyhyLJA.exe
  2⤵
  PID:8524
- C:\Windows\System\tvqHljL.exe
  C:\Windows\System\tvqHljL.exe
  2⤵
  PID:8588
- C:\Windows\System\tsAcdsz.exe
  C:\Windows\System\tsAcdsz.exe
  2⤵
  PID:8628
- C:\Windows\System\MjrqyyF.exe
  C:\Windows\System\MjrqyyF.exe
  2⤵
  PID:8692
- C:\Windows\System\TgmXmuz.exe
  C:\Windows\System\TgmXmuz.exe
  2⤵
  PID:8768
- C:\Windows\System\opNCoEg.exe
  C:\Windows\System\opNCoEg.exe
  2⤵
  PID:8844
- C:\Windows\System\BLEtJlq.exe
  C:\Windows\System\BLEtJlq.exe
  2⤵
  PID:8900
- C:\Windows\System\VPZARGc.exe
  C:\Windows\System\VPZARGc.exe
  2⤵
  PID:8952
- C:\Windows\System\bKHizyA.exe
  C:\Windows\System\bKHizyA.exe
  2⤵
  PID:9012
- C:\Windows\System\MKrezGg.exe
  C:\Windows\System\MKrezGg.exe
  2⤵
  PID:9076
- C:\Windows\System\dvURXvF.exe
  C:\Windows\System\dvURXvF.exe
  2⤵
  PID:9140
- C:\Windows\System\FgmkIiO.exe
  C:\Windows\System\FgmkIiO.exe
  2⤵
  PID:8260
- C:\Windows\System\vDeCvBs.exe
  C:\Windows\System\vDeCvBs.exe
  2⤵
  PID:8372
- C:\Windows\System\YAOkaLe.exe
  C:\Windows\System\YAOkaLe.exe
  2⤵
  PID:8564
- C:\Windows\System\dXHjXkJ.exe
  C:\Windows\System\dXHjXkJ.exe
  2⤵
  PID:8720
- C:\Windows\System\ZpFVDza.exe
  C:\Windows\System\ZpFVDza.exe
  2⤵
  PID:8804
- C:\Windows\System\VDWudMj.exe
  C:\Windows\System\VDWudMj.exe
  2⤵
  PID:8976
- C:\Windows\System\nvZbDJl.exe
  C:\Windows\System\nvZbDJl.exe
  2⤵
  PID:9096
- C:\Windows\System\UYTZfWw.exe
  C:\Windows\System\UYTZfWw.exe
  2⤵
  PID:8488
- C:\Windows\System\EhwddnJ.exe
  C:\Windows\System\EhwddnJ.exe
  2⤵
  PID:8744
- C:\Windows\System\uXnyKdV.exe
  C:\Windows\System\uXnyKdV.exe
  2⤵
  PID:9004
- C:\Windows\System\HWwbOxv.exe
  C:\Windows\System\HWwbOxv.exe
  2⤵
  PID:8676
- C:\Windows\System\IIelegH.exe
  C:\Windows\System\IIelegH.exe
  2⤵
  PID:9220
- C:\Windows\System\qsTFFKF.exe
  C:\Windows\System\qsTFFKF.exe
  2⤵
  PID:9248
- C:\Windows\System\vUNJBmf.exe
  C:\Windows\System\vUNJBmf.exe
  2⤵
  PID:9268
- C:\Windows\System\WFyQIpC.exe
  C:\Windows\System\WFyQIpC.exe
  2⤵
  PID:9300
- C:\Windows\System\TCWnmsB.exe
  C:\Windows\System\TCWnmsB.exe
  2⤵
  PID:9324
- C:\Windows\System\xOXhOGj.exe
  C:\Windows\System\xOXhOGj.exe
  2⤵
  PID:9360
- C:\Windows\System\ftFBCYh.exe
  C:\Windows\System\ftFBCYh.exe
  2⤵
  PID:9388
- C:\Windows\System\BhIpKjm.exe
  C:\Windows\System\BhIpKjm.exe
  2⤵
  PID:9420
- C:\Windows\System\lTIiNAn.exe
  C:\Windows\System\lTIiNAn.exe
  2⤵
  PID:9448
- C:\Windows\System\UELPuZx.exe
  C:\Windows\System\UELPuZx.exe
  2⤵
  PID:9476
- C:\Windows\System\NTumQfR.exe
  C:\Windows\System\NTumQfR.exe
  2⤵
  PID:9504
- C:\Windows\System\mlzRgmE.exe
  C:\Windows\System\mlzRgmE.exe
  2⤵
  PID:9532
- C:\Windows\System\TTytiLe.exe
  C:\Windows\System\TTytiLe.exe
  2⤵
  PID:9560
- C:\Windows\System\vZUdmuz.exe
  C:\Windows\System\vZUdmuz.exe
  2⤵
  PID:9588
- C:\Windows\System\sdoEWwU.exe
  C:\Windows\System\sdoEWwU.exe
  2⤵
  PID:9604
- C:\Windows\System\EJxYKGD.exe
  C:\Windows\System\EJxYKGD.exe
  2⤵
  PID:9640
- C:\Windows\System\sWdbcjO.exe
  C:\Windows\System\sWdbcjO.exe
  2⤵
  PID:9664
- C:\Windows\System\rLPDgmh.exe
  C:\Windows\System\rLPDgmh.exe
  2⤵
  PID:9692
- C:\Windows\System\HveolrQ.exe
  C:\Windows\System\HveolrQ.exe
  2⤵
  PID:9728
- C:\Windows\System\uQebork.exe
  C:\Windows\System\uQebork.exe
  2⤵
  PID:9748
- C:\Windows\System\tiAdONm.exe
  C:\Windows\System\tiAdONm.exe
  2⤵
  PID:9784
- C:\Windows\System\TqGSzeS.exe
  C:\Windows\System\TqGSzeS.exe
  2⤵
  PID:9812
- C:\Windows\System\jwfFQqM.exe
  C:\Windows\System\jwfFQqM.exe
  2⤵
  PID:9840
- C:\Windows\System\wHQycmW.exe
  C:\Windows\System\wHQycmW.exe
  2⤵
  PID:9868
- C:\Windows\System\kvofbfn.exe
  C:\Windows\System\kvofbfn.exe
  2⤵
  PID:9896
- C:\Windows\System\mnvckJp.exe
  C:\Windows\System\mnvckJp.exe
  2⤵
  PID:9924
- C:\Windows\System\bxbOlJu.exe
  C:\Windows\System\bxbOlJu.exe
  2⤵
  PID:9952
- C:\Windows\System\xPFMHCs.exe
  C:\Windows\System\xPFMHCs.exe
  2⤵
  PID:9980
- C:\Windows\System\hFdTWDC.exe
  C:\Windows\System\hFdTWDC.exe
  2⤵
  PID:10008
- C:\Windows\System\xQlXPjC.exe
  C:\Windows\System\xQlXPjC.exe
  2⤵
  PID:10036
- C:\Windows\System\bDadYFS.exe
  C:\Windows\System\bDadYFS.exe
  2⤵
  PID:10064
- C:\Windows\System\GhHzODU.exe
  C:\Windows\System\GhHzODU.exe
  2⤵
  PID:10092
- C:\Windows\System\ifEGCPw.exe
  C:\Windows\System\ifEGCPw.exe
  2⤵
  PID:10120
- C:\Windows\System\vvVeMlI.exe
  C:\Windows\System\vvVeMlI.exe
  2⤵
  PID:10156
- C:\Windows\System\MkiEgeQ.exe
  C:\Windows\System\MkiEgeQ.exe
  2⤵
  PID:10184
- C:\Windows\System\yjWEsrd.exe
  C:\Windows\System\yjWEsrd.exe
  2⤵
  PID:10212
- C:\Windows\System\kRMwDfD.exe
  C:\Windows\System\kRMwDfD.exe
  2⤵
  PID:10236
- C:\Windows\System\OmnAwux.exe
  C:\Windows\System\OmnAwux.exe
  2⤵
  PID:9276
- C:\Windows\System\jYTbuzr.exe
  C:\Windows\System\jYTbuzr.exe
  2⤵
  PID:9332
- C:\Windows\System\TIDfrin.exe
  C:\Windows\System\TIDfrin.exe
  2⤵
  PID:9384
- C:\Windows\System\ciLaxlq.exe
  C:\Windows\System\ciLaxlq.exe
  2⤵
  PID:9440
- C:\Windows\System\DqONaSp.exe
  C:\Windows\System\DqONaSp.exe
  2⤵
  PID:9516
- C:\Windows\System\pxgPIQM.exe
  C:\Windows\System\pxgPIQM.exe
  2⤵
  PID:9628
- C:\Windows\System\zpxRtYo.exe
  C:\Windows\System\zpxRtYo.exe
  2⤵
  PID:9672
- C:\Windows\System\qRnoIwG.exe
  C:\Windows\System\qRnoIwG.exe
  2⤵
  PID:9720
- C:\Windows\System\rZtebzw.exe
  C:\Windows\System\rZtebzw.exe
  2⤵
  PID:9804
- C:\Windows\System\LAUTiEi.exe
  C:\Windows\System\LAUTiEi.exe
  2⤵
  PID:9880
- C:\Windows\System\NpmqByC.exe
  C:\Windows\System\NpmqByC.exe
  2⤵
  PID:9944
- C:\Windows\System\xUtdrTr.exe
  C:\Windows\System\xUtdrTr.exe
  2⤵
  PID:10020
- C:\Windows\System\jGqzRdf.exe
  C:\Windows\System\jGqzRdf.exe
  2⤵
  PID:10060
- C:\Windows\System\BPjZOjw.exe
  C:\Windows\System\BPjZOjw.exe
  2⤵
  PID:10132
- C:\Windows\System\XyFRjqG.exe
  C:\Windows\System\XyFRjqG.exe
  2⤵
  PID:10220
- C:\Windows\System\TdKNJxn.exe
  C:\Windows\System\TdKNJxn.exe
  2⤵
  PID:9260
- C:\Windows\System\XdjCJlQ.exe
  C:\Windows\System\XdjCJlQ.exe
  2⤵
  PID:9416
- C:\Windows\System\iwAVqHL.exe
  C:\Windows\System\iwAVqHL.exe
  2⤵
  PID:9524
- C:\Windows\System\cidXgII.exe
  C:\Windows\System\cidXgII.exe
  2⤵
  PID:9796
- C:\Windows\System\BMjubmF.exe
  C:\Windows\System\BMjubmF.exe
  2⤵
  PID:9864
- C:\Windows\System\HtZWIHj.exe
  C:\Windows\System\HtZWIHj.exe
  2⤵
  PID:10088
- C:\Windows\System\QJaFyyf.exe
  C:\Windows\System\QJaFyyf.exe
  2⤵
  PID:10228
- C:\Windows\System\tqoxtwY.exe
  C:\Windows\System\tqoxtwY.exe
  2⤵
  PID:9144
- C:\Windows\System\GJQtqYf.exe
  C:\Windows\System\GJQtqYf.exe
  2⤵
  PID:10056
- C:\Windows\System\bezTZqI.exe
  C:\Windows\System\bezTZqI.exe
  2⤵
  PID:9348
- C:\Windows\System\NuUYANO.exe
  C:\Windows\System\NuUYANO.exe
  2⤵
  PID:9488
- C:\Windows\System\AmtWCMw.exe
  C:\Windows\System\AmtWCMw.exe
  2⤵
  PID:10256
- C:\Windows\System\BoYgxeQ.exe
  C:\Windows\System\BoYgxeQ.exe
  2⤵
  PID:10284
- C:\Windows\System\pntTnpn.exe
  C:\Windows\System\pntTnpn.exe
  2⤵
  PID:10312
- C:\Windows\System\rargJsY.exe
  C:\Windows\System\rargJsY.exe
  2⤵
  PID:10340
- C:\Windows\System\QJSWEZN.exe
  C:\Windows\System\QJSWEZN.exe
  2⤵
  PID:10368
- C:\Windows\System\ArRKyiO.exe
  C:\Windows\System\ArRKyiO.exe
  2⤵
  PID:10396
- C:\Windows\System\tymKPmJ.exe
  C:\Windows\System\tymKPmJ.exe
  2⤵
  PID:10424
- C:\Windows\System\hHzCILn.exe
  C:\Windows\System\hHzCILn.exe
  2⤵
  PID:10452
- C:\Windows\System\QOZCdPu.exe
  C:\Windows\System\QOZCdPu.exe
  2⤵
  PID:10480
- C:\Windows\System\SDWjbFz.exe
  C:\Windows\System\SDWjbFz.exe
  2⤵
  PID:10508
- C:\Windows\System\LNXgiSi.exe
  C:\Windows\System\LNXgiSi.exe
  2⤵
  PID:10536
- C:\Windows\System\qGjWLPf.exe
  C:\Windows\System\qGjWLPf.exe
  2⤵
  PID:10564
- C:\Windows\System\xIPKWJQ.exe
  C:\Windows\System\xIPKWJQ.exe
  2⤵
  PID:10592
- C:\Windows\System\zDesbzX.exe
  C:\Windows\System\zDesbzX.exe
  2⤵
  PID:10616
- C:\Windows\System\VmKTKCU.exe
  C:\Windows\System\VmKTKCU.exe
  2⤵
  PID:10648
- C:\Windows\System\clqCfWR.exe
  C:\Windows\System\clqCfWR.exe
  2⤵
  PID:10672
- C:\Windows\System\TjZQrnY.exe
  C:\Windows\System\TjZQrnY.exe
  2⤵
  PID:10704
- C:\Windows\System\BXrXYfa.exe
  C:\Windows\System\BXrXYfa.exe
  2⤵
  PID:10732
- C:\Windows\System\HxjuLAz.exe
  C:\Windows\System\HxjuLAz.exe
  2⤵
  PID:10760
- C:\Windows\System\AzdAsUU.exe
  C:\Windows\System\AzdAsUU.exe
  2⤵
  PID:10788
- C:\Windows\System\UiDEgGb.exe
  C:\Windows\System\UiDEgGb.exe
  2⤵
  PID:10816
- C:\Windows\System\hRsteiD.exe
  C:\Windows\System\hRsteiD.exe
  2⤵
  PID:10844
- C:\Windows\System\yEFkuXO.exe
  C:\Windows\System\yEFkuXO.exe
  2⤵
  PID:10872
- C:\Windows\System\sQkUycP.exe
  C:\Windows\System\sQkUycP.exe
  2⤵
  PID:10900
- C:\Windows\System\IpCAfrF.exe
  C:\Windows\System\IpCAfrF.exe
  2⤵
  PID:10928
- C:\Windows\System\nLkkvZM.exe
  C:\Windows\System\nLkkvZM.exe
  2⤵
  PID:10956
- C:\Windows\System\EQPQOqT.exe
  C:\Windows\System\EQPQOqT.exe
  2⤵
  PID:10984
- C:\Windows\System\vVdtwdt.exe
  C:\Windows\System\vVdtwdt.exe
  2⤵
  PID:11000
- C:\Windows\System\DvqdobS.exe
  C:\Windows\System\DvqdobS.exe
  2⤵
  PID:11040
- C:\Windows\System\SpqCpFj.exe
  C:\Windows\System\SpqCpFj.exe
  2⤵
  PID:11068
- C:\Windows\System\HzDmbOS.exe
  C:\Windows\System\HzDmbOS.exe
  2⤵
  PID:11096
- C:\Windows\System\fmDqKCF.exe
  C:\Windows\System\fmDqKCF.exe
  2⤵
  PID:11124
- C:\Windows\System\VmHjlww.exe
  C:\Windows\System\VmHjlww.exe
  2⤵
  PID:11152
- C:\Windows\System\pkoQTDM.exe
  C:\Windows\System\pkoQTDM.exe
  2⤵
  PID:11180
- C:\Windows\System\vtJJiva.exe
  C:\Windows\System\vtJJiva.exe
  2⤵
  PID:11208
- C:\Windows\System\HdEkYEe.exe
  C:\Windows\System\HdEkYEe.exe
  2⤵
  PID:11236
- C:\Windows\System\EipfdDJ.exe
  C:\Windows\System\EipfdDJ.exe
  2⤵
  PID:10196
- C:\Windows\System\DNZnCVu.exe
  C:\Windows\System\DNZnCVu.exe
  2⤵
  PID:10300
- C:\Windows\System\qrwQHLq.exe
  C:\Windows\System\qrwQHLq.exe
  2⤵
  PID:10364
- C:\Windows\System\wnUyzhQ.exe
  C:\Windows\System\wnUyzhQ.exe
  2⤵
  PID:10436
- C:\Windows\System\uBebErN.exe
  C:\Windows\System\uBebErN.exe
  2⤵
  PID:10496
- C:\Windows\System\PtoFciq.exe
  C:\Windows\System\PtoFciq.exe
  2⤵
  PID:10580
- C:\Windows\System\aXPwXcD.exe
  C:\Windows\System\aXPwXcD.exe
  2⤵
  PID:10632
- C:\Windows\System\wOyPFKh.exe
  C:\Windows\System\wOyPFKh.exe
  2⤵
  PID:10696
- C:\Windows\System\TRHFStK.exe
  C:\Windows\System\TRHFStK.exe
  2⤵
  PID:10772
- C:\Windows\System\icbJSRF.exe
  C:\Windows\System\icbJSRF.exe
  2⤵
  PID:10840
- C:\Windows\System\fVecUWN.exe
  C:\Windows\System\fVecUWN.exe
  2⤵
  PID:10912
- C:\Windows\System\jcbXcrp.exe
  C:\Windows\System\jcbXcrp.exe
  2⤵
  PID:10968
- C:\Windows\System\uZAWEmm.exe
  C:\Windows\System\uZAWEmm.exe
  2⤵
  PID:11052
- C:\Windows\System\vnQMWJB.exe
  C:\Windows\System\vnQMWJB.exe
  2⤵
  PID:11120
- C:\Windows\System\qSIXLOq.exe
  C:\Windows\System\qSIXLOq.exe
  2⤵
  PID:11176
- C:\Windows\System\ciVedEl.exe
  C:\Windows\System\ciVedEl.exe
  2⤵
  PID:11252
- C:\Windows\System\NwBbLVh.exe
  C:\Windows\System\NwBbLVh.exe
  2⤵
  PID:10328
- C:\Windows\System\oixdEQP.exe
  C:\Windows\System\oixdEQP.exe
  2⤵
  PID:10476
- C:\Windows\System\mcMvCYM.exe
  C:\Windows\System\mcMvCYM.exe
  2⤵
  PID:10656
- C:\Windows\System\tCnQUsd.exe
  C:\Windows\System\tCnQUsd.exe
  2⤵
  PID:10836
- C:\Windows\System\cToDYDN.exe
  C:\Windows\System\cToDYDN.exe
  2⤵
  PID:10972
- C:\Windows\System\PybJvQj.exe
  C:\Windows\System\PybJvQj.exe
  2⤵
  PID:11148
- C:\Windows\System\FudMrpG.exe
  C:\Windows\System\FudMrpG.exe
  2⤵
  PID:11256
- C:\Windows\System\YVyrvoJ.exe
  C:\Windows\System\YVyrvoJ.exe
  2⤵
  PID:10624
- C:\Windows\System\cfOqQbV.exe
  C:\Windows\System\cfOqQbV.exe
  2⤵
  PID:11036
- C:\Windows\System\zuJSbbN.exe
  C:\Windows\System\zuJSbbN.exe
  2⤵
  PID:11432
- C:\Windows\System\FsVHxVo.exe
  C:\Windows\System\FsVHxVo.exe
  2⤵
  PID:11452
- C:\Windows\System\MtfvbEr.exe
  C:\Windows\System\MtfvbEr.exe
  2⤵
  PID:11476
- C:\Windows\System\RGXRwUH.exe
  C:\Windows\System\RGXRwUH.exe
  2⤵
  PID:11524
- C:\Windows\System\RvJaMHT.exe
  C:\Windows\System\RvJaMHT.exe
  2⤵
  PID:11544
- C:\Windows\System\DXnmwLg.exe
  C:\Windows\System\DXnmwLg.exe
  2⤵
  PID:11584
- C:\Windows\System\tJVtlyW.exe
  C:\Windows\System\tJVtlyW.exe
  2⤵
  PID:11612
- C:\Windows\System\UDKPtFK.exe
  C:\Windows\System\UDKPtFK.exe
  2⤵
  PID:11640
- C:\Windows\System\ClYxcqR.exe
  C:\Windows\System\ClYxcqR.exe
  2⤵
  PID:11668
- C:\Windows\System\WYYOgBd.exe
  C:\Windows\System\WYYOgBd.exe
  2⤵
  PID:11696
- C:\Windows\System\kUnNBUJ.exe
  C:\Windows\System\kUnNBUJ.exe
  2⤵
  PID:11712
- C:\Windows\System\DyMVzlx.exe
  C:\Windows\System\DyMVzlx.exe
  2⤵
  PID:11752
- C:\Windows\System\tUuEqGc.exe
  C:\Windows\System\tUuEqGc.exe
  2⤵
  PID:11768
- C:\Windows\System\KyBmVNl.exe
  C:\Windows\System\KyBmVNl.exe
  2⤵
  PID:11800
- C:\Windows\System\bAihSPn.exe
  C:\Windows\System\bAihSPn.exe
  2⤵
  PID:11836
- C:\Windows\System\FkvdFrA.exe
  C:\Windows\System\FkvdFrA.exe
  2⤵
  PID:11864
- C:\Windows\System\MHDvZyL.exe
  C:\Windows\System\MHDvZyL.exe
  2⤵
  PID:11892
- C:\Windows\System\FZTSXVB.exe
  C:\Windows\System\FZTSXVB.exe
  2⤵
  PID:11916
- C:\Windows\System\BhydSap.exe
  C:\Windows\System\BhydSap.exe
  2⤵
  PID:11948
- C:\Windows\System\yYJoSCw.exe
  C:\Windows\System\yYJoSCw.exe
  2⤵
  PID:11976
- C:\Windows\System\IjIVBra.exe
  C:\Windows\System\IjIVBra.exe
  2⤵
  PID:12004
- C:\Windows\System\MeMqMfq.exe
  C:\Windows\System\MeMqMfq.exe
  2⤵
  PID:12032
- C:\Windows\System\eYnvbEK.exe
  C:\Windows\System\eYnvbEK.exe
  2⤵
  PID:12060
- C:\Windows\System\FevXMlH.exe
  C:\Windows\System\FevXMlH.exe
  2⤵
  PID:12088
- C:\Windows\System\MtyxlYn.exe
  C:\Windows\System\MtyxlYn.exe
  2⤵
  PID:12116
- C:\Windows\System\XDHcFQA.exe
  C:\Windows\System\XDHcFQA.exe
  2⤵
  PID:12144
- C:\Windows\System\NDmXbTR.exe
  C:\Windows\System\NDmXbTR.exe
  2⤵
  PID:12172
- C:\Windows\System\EGGGgyk.exe
  C:\Windows\System\EGGGgyk.exe
  2⤵
  PID:12200
- C:\Windows\System\NtLYzjG.exe
  C:\Windows\System\NtLYzjG.exe
  2⤵
  PID:12228
- C:\Windows\System\KfrceUA.exe
  C:\Windows\System\KfrceUA.exe
  2⤵
  PID:12256
- C:\Windows\System\QtCWTBN.exe
  C:\Windows\System\QtCWTBN.exe
  2⤵
  PID:12284
- C:\Windows\System\nMldVYp.exe
  C:\Windows\System\nMldVYp.exe
  2⤵
  PID:10528
- C:\Windows\System\gOgtzJC.exe
  C:\Windows\System\gOgtzJC.exe
  2⤵
  PID:11280
- C:\Windows\System\AAJLjgL.exe
  C:\Windows\System\AAJLjgL.exe
  2⤵
  PID:11308
- C:\Windows\System\iVODTFL.exe
  C:\Windows\System\iVODTFL.exe
  2⤵
  PID:11336
- C:\Windows\System\AgTuWQL.exe
  C:\Windows\System\AgTuWQL.exe
  2⤵
  PID:11364
- C:\Windows\System\qbvlXjt.exe
  C:\Windows\System\qbvlXjt.exe
  2⤵
  PID:11392
- C:\Windows\System\gifslTu.exe
  C:\Windows\System\gifslTu.exe
  2⤵
  PID:11408
- C:\Windows\System\szhHwap.exe
  C:\Windows\System\szhHwap.exe
  2⤵
  PID:11464
- C:\Windows\System\vvsqGXb.exe
  C:\Windows\System\vvsqGXb.exe
  2⤵
  PID:11540
- C:\Windows\System\rcXOzoZ.exe
  C:\Windows\System\rcXOzoZ.exe
  2⤵
  PID:11576
- C:\Windows\System\dmHLakU.exe
  C:\Windows\System\dmHLakU.exe
  2⤵
  PID:11652
- C:\Windows\System\lKvoStF.exe
  C:\Windows\System\lKvoStF.exe
  2⤵
  PID:11724
- C:\Windows\System\ySdUmOd.exe
  C:\Windows\System\ySdUmOd.exe
  2⤵
  PID:11796
- C:\Windows\System\BEQrLzQ.exe
  C:\Windows\System\BEQrLzQ.exe
  2⤵
  PID:11848
- C:\Windows\System\ZUhBvQE.exe
  C:\Windows\System\ZUhBvQE.exe
  2⤵
  PID:11880
- C:\Windows\System\RYPJmgE.exe
  C:\Windows\System\RYPJmgE.exe
  2⤵
  PID:11940
- C:\Windows\System\NWgPnZe.exe
  C:\Windows\System\NWgPnZe.exe
  2⤵
  PID:12044
- C:\Windows\System\rsBuBtm.exe
  C:\Windows\System\rsBuBtm.exe
  2⤵
  PID:12100
- C:\Windows\System\jqHtNKD.exe
  C:\Windows\System\jqHtNKD.exe
  2⤵
  PID:12168
- C:\Windows\System\QgLQFTL.exe
  C:\Windows\System\QgLQFTL.exe
  2⤵
  PID:12252
- C:\Windows\System\nYLjOAS.exe
  C:\Windows\System\nYLjOAS.exe
  2⤵
  PID:11232
- C:\Windows\System\QjHpFaV.exe
  C:\Windows\System\QjHpFaV.exe
  2⤵
  PID:11292
- C:\Windows\System\gNTrzsj.exe
  C:\Windows\System\gNTrzsj.exe
  2⤵
  PID:11332
- C:\Windows\System\yuneUpj.exe
  C:\Windows\System\yuneUpj.exe
  2⤵
  PID:11420
- C:\Windows\System\NbwbrXW.exe
  C:\Windows\System\NbwbrXW.exe
  2⤵
  PID:11688
- C:\Windows\System\tstylOL.exe
  C:\Windows\System\tstylOL.exe
  2⤵
  PID:11828
- C:\Windows\System\hUPjcLk.exe
  C:\Windows\System\hUPjcLk.exe
  2⤵
  PID:11988
- C:\Windows\System\LHUcISL.exe
  C:\Windows\System\LHUcISL.exe
  2⤵
  PID:12056
- C:\Windows\System\RBpYarG.exe
  C:\Windows\System\RBpYarG.exe
  2⤵
  PID:12140
- C:\Windows\System\YnqanSK.exe
  C:\Windows\System\YnqanSK.exe
  2⤵
  PID:11296
- C:\Windows\System\rZKPIsJ.exe
  C:\Windows\System\rZKPIsJ.exe
  2⤵
  PID:11628
- C:\Windows\System\bKRgUyr.exe
  C:\Windows\System\bKRgUyr.exe
  2⤵
  PID:11996
- C:\Windows\System\lmbJCpW.exe
  C:\Windows\System\lmbJCpW.exe
  2⤵
  PID:10464
- C:\Windows\System\JWQryPm.exe
  C:\Windows\System\JWQryPm.exe
  2⤵
  PID:11376
- C:\Windows\System\sQTOFjN.exe
  C:\Windows\System\sQTOFjN.exe
  2⤵
  PID:10924
- C:\Windows\System\EcealEu.exe
  C:\Windows\System\EcealEu.exe
  2⤵
  PID:12308
- C:\Windows\System\iFLioSR.exe
  C:\Windows\System\iFLioSR.exe
  2⤵
  PID:12344
- C:\Windows\System\fuySOFL.exe
  C:\Windows\System\fuySOFL.exe
  2⤵
  PID:12372
- C:\Windows\System\CKrZatU.exe
  C:\Windows\System\CKrZatU.exe
  2⤵
  PID:12400
- C:\Windows\System\yitlZbB.exe
  C:\Windows\System\yitlZbB.exe
  2⤵
  PID:12424
- C:\Windows\System\Tygfago.exe
  C:\Windows\System\Tygfago.exe
  2⤵
  PID:12448
- C:\Windows\System\PeRhoMr.exe
  C:\Windows\System\PeRhoMr.exe
  2⤵
  PID:12472
- C:\Windows\System\GQFolrN.exe
  C:\Windows\System\GQFolrN.exe
  2⤵
  PID:12504
- C:\Windows\System\vRIQPbp.exe
  C:\Windows\System\vRIQPbp.exe
  2⤵
  PID:12540
- C:\Windows\System\rLkUydX.exe
  C:\Windows\System\rLkUydX.exe
  2⤵
  PID:12556
- C:\Windows\System\aKeCNWm.exe
  C:\Windows\System\aKeCNWm.exe
  2⤵
  PID:12592
- C:\Windows\System\OXDlRSQ.exe
  C:\Windows\System\OXDlRSQ.exe
  2⤵
  PID:12616
- C:\Windows\System\hTtqRHM.exe
  C:\Windows\System\hTtqRHM.exe
  2⤵
  PID:12648
- C:\Windows\System\QymjsOe.exe
  C:\Windows\System\QymjsOe.exe
  2⤵
  PID:12680
- C:\Windows\System\hCFaJmy.exe
  C:\Windows\System\hCFaJmy.exe
  2⤵
  PID:12708
- C:\Windows\System\vpPdkxM.exe
  C:\Windows\System\vpPdkxM.exe
  2⤵
  PID:12736
- C:\Windows\System\FBOEgHB.exe
  C:\Windows\System\FBOEgHB.exe
  2⤵
  PID:12764
- C:\Windows\System\hxXyCfD.exe
  C:\Windows\System\hxXyCfD.exe
  2⤵
  PID:12792
- C:\Windows\System\ukcyKCc.exe
  C:\Windows\System\ukcyKCc.exe
  2⤵
  PID:12820
- C:\Windows\System\gzWSrZX.exe
  C:\Windows\System\gzWSrZX.exe
  2⤵
  PID:12848
- C:\Windows\System\boBhWxc.exe
  C:\Windows\System\boBhWxc.exe
  2⤵
  PID:12876
- C:\Windows\System\MgSsYUg.exe
  C:\Windows\System\MgSsYUg.exe
  2⤵
  PID:12904
- C:\Windows\System\Ibxmpci.exe
  C:\Windows\System\Ibxmpci.exe
  2⤵
  PID:12932
- C:\Windows\System\icYbNRX.exe
  C:\Windows\System\icYbNRX.exe
  2⤵
  PID:12960
- C:\Windows\System\dCRbGcq.exe
  C:\Windows\System\dCRbGcq.exe
  2⤵
  PID:12988
- C:\Windows\System\RHMhnPa.exe
  C:\Windows\System\RHMhnPa.exe
  2⤵
  PID:13016
- C:\Windows\System\wUmPzQJ.exe
  C:\Windows\System\wUmPzQJ.exe
  2⤵
  PID:13044
- C:\Windows\System\sTNlEAE.exe
  C:\Windows\System\sTNlEAE.exe
  2⤵
  PID:13068
- C:\Windows\System\cwvOGgG.exe
  C:\Windows\System\cwvOGgG.exe
  2⤵
  PID:13088
- C:\Windows\System\qAwExQl.exe
  C:\Windows\System\qAwExQl.exe
  2⤵
  PID:13128
- C:\Windows\System\CyYhfyh.exe
  C:\Windows\System\CyYhfyh.exe
  2⤵
  PID:13144
- C:\Windows\System\ubezTGo.exe
  C:\Windows\System\ubezTGo.exe
  2⤵
  PID:13172
- C:\Windows\System\mLyEWuo.exe
  C:\Windows\System\mLyEWuo.exe
  2⤵
  PID:13212
- C:\Windows\System\zchjtoJ.exe
  C:\Windows\System\zchjtoJ.exe
  2⤵
  PID:13240
- C:\Windows\System\RsRpIaX.exe
  C:\Windows\System\RsRpIaX.exe
  2⤵
  PID:13268
- C:\Windows\System\geRLrBS.exe
  C:\Windows\System\geRLrBS.exe
  2⤵
  PID:13292
- C:\Windows\System\LHZAAzY.exe
  C:\Windows\System\LHZAAzY.exe
  2⤵
  PID:12296
- C:\Windows\System\MNibjCB.exe
  C:\Windows\System\MNibjCB.exe
  2⤵
  PID:12360
- C:\Windows\System\riqSikP.exe
  C:\Windows\System\riqSikP.exe
  2⤵
  PID:12396
- C:\Windows\System\BaKNtAs.exe
  C:\Windows\System\BaKNtAs.exe
  2⤵
  PID:12468
- C:\Windows\System\uNmAXaN.exe
  C:\Windows\System\uNmAXaN.exe
  2⤵
  PID:12516
- C:\Windows\System\BWRNLyR.exe
  C:\Windows\System\BWRNLyR.exe
  2⤵
  PID:12624
- C:\Windows\System\FaTXmzC.exe
  C:\Windows\System\FaTXmzC.exe
  2⤵
  PID:12692
- C:\Windows\System\UYoWoGE.exe
  C:\Windows\System\UYoWoGE.exe
  2⤵
  PID:12732
- C:\Windows\System\ZYzaLxP.exe
  C:\Windows\System\ZYzaLxP.exe
  2⤵
  PID:12780
- C:\Windows\System\soIZThK.exe
  C:\Windows\System\soIZThK.exe
  2⤵
  PID:12832
- C:\Windows\System\YPvUSSv.exe
  C:\Windows\System\YPvUSSv.exe
  2⤵
  PID:12956
- C:\Windows\System\gVXpOlq.exe
  C:\Windows\System\gVXpOlq.exe
  2⤵
  PID:13012
- C:\Windows\System\lwsyDFM.exe
  C:\Windows\System\lwsyDFM.exe
  2⤵
  PID:13100
- C:\Windows\System\YDQFKLR.exe
  C:\Windows\System\YDQFKLR.exe
  2⤵
  PID:13140
- C:\Windows\System\iJFqITN.exe
  C:\Windows\System\iJFqITN.exe
  2⤵
  PID:13236
- C:\Windows\System\vvscdcg.exe
  C:\Windows\System\vvscdcg.exe
  2⤵
  PID:13288
- C:\Windows\System\OBARzJq.exe
  C:\Windows\System\OBARzJq.exe
  2⤵
  PID:12356
- C:\Windows\System\DXLCTGc.exe
  C:\Windows\System\DXLCTGc.exe
  2⤵
  PID:12632
- C:\Windows\System\jcaHlVa.exe
  C:\Windows\System\jcaHlVa.exe
  2⤵
  PID:12760
- C:\Windows\System\tGWtxdd.exe
  C:\Windows\System\tGWtxdd.exe
  2⤵
  PID:12980
- C:\Windows\System\qzJpKln.exe
  C:\Windows\System\qzJpKln.exe
  2⤵
  PID:13052
- C:\Windows\System\FuXyPMV.exe
  C:\Windows\System\FuXyPMV.exe
  2⤵
  PID:13208
- C:\Windows\System\GMQyTba.exe
  C:\Windows\System\GMQyTba.exe
  2⤵
  PID:12492
- C:\Windows\System\GJNCrNr.exe
  C:\Windows\System\GJNCrNr.exe
  2⤵
  PID:12864
- C:\Windows\System\UZjcdLf.exe
  C:\Windows\System\UZjcdLf.exe
  2⤵
  PID:13300
- C:\Windows\System\JynbpLl.exe
  C:\Windows\System\JynbpLl.exe
  2⤵
  PID:12860
- C:\Windows\System\PKIdXSf.exe
  C:\Windows\System\PKIdXSf.exe
  2⤵
  PID:13352
- C:\Windows\System\SdDbZFM.exe
  C:\Windows\System\SdDbZFM.exe
  2⤵
  PID:13380
- C:\Windows\System\cujylZF.exe
  C:\Windows\System\cujylZF.exe
  2⤵
  PID:13400
- C:\Windows\System\oLPibCD.exe
  C:\Windows\System\oLPibCD.exe
  2⤵
  PID:13424
- C:\Windows\System\DgVZhyb.exe
  C:\Windows\System\DgVZhyb.exe
  2⤵
  PID:13452
- C:\Windows\System\kAsRDmw.exe
  C:\Windows\System\kAsRDmw.exe
  2⤵
  PID:13472
- C:\Windows\System\IttvRMq.exe
  C:\Windows\System\IttvRMq.exe
  2⤵
  PID:13520
- C:\Windows\System\LDtaPkH.exe
  C:\Windows\System\LDtaPkH.exe
  2⤵
  PID:13564
- C:\Windows\System\RSauubV.exe
  C:\Windows\System\RSauubV.exe
  2⤵
  PID:13592
- C:\Windows\System\bxuVGCj.exe
  C:\Windows\System\bxuVGCj.exe
  2⤵
  PID:13620
- C:\Windows\System\qaWcnHA.exe
  C:\Windows\System\qaWcnHA.exe
  2⤵
  PID:13648
- C:\Windows\System\qfRPwmo.exe
  C:\Windows\System\qfRPwmo.exe
  2⤵
  PID:13676
- C:\Windows\System\ZzsMAmF.exe
  C:\Windows\System\ZzsMAmF.exe
  2⤵
  PID:13692
- C:\Windows\System\FzDoQwl.exe
  C:\Windows\System\FzDoQwl.exe
  2⤵
  PID:13732
- C:\Windows\System\hjTOlam.exe
  C:\Windows\System\hjTOlam.exe
  2⤵
  PID:13760
- C:\Windows\System\FtMsyvx.exe
  C:\Windows\System\FtMsyvx.exe
  2⤵
  PID:13788
- C:\Windows\System\FFkfssQ.exe
  C:\Windows\System\FFkfssQ.exe
  2⤵
  PID:13816
- C:\Windows\System\YrWmeYL.exe
  C:\Windows\System\YrWmeYL.exe
  2⤵
  PID:13832
- C:\Windows\System\aMYkPqT.exe
  C:\Windows\System\aMYkPqT.exe
  2⤵
  PID:13860
- C:\Windows\System\cROApla.exe
  C:\Windows\System\cROApla.exe
  2⤵
  PID:13880
- C:\Windows\System\ZXEtOFX.exe
  C:\Windows\System\ZXEtOFX.exe
  2⤵
  PID:13908
- C:\Windows\System\hTJzdvP.exe
  C:\Windows\System\hTJzdvP.exe
  2⤵
  PID:13932
- C:\Windows\System\SJlRFdQ.exe
  C:\Windows\System\SJlRFdQ.exe
  2⤵
  PID:13984
- C:\Windows\System\NQcsQOe.exe
  C:\Windows\System\NQcsQOe.exe
  2⤵
  PID:14012
- C:\Windows\System\fipIgGF.exe
  C:\Windows\System\fipIgGF.exe
  2⤵
  PID:14032
- C:\Windows\System\IvpJYVz.exe
  C:\Windows\System\IvpJYVz.exe
  2⤵
  PID:14068
- C:\Windows\System\WoJoPGq.exe
  C:\Windows\System\WoJoPGq.exe
  2⤵
  PID:14084
- C:\Windows\System\ecqdVSX.exe
  C:\Windows\System\ecqdVSX.exe
  2⤵
  PID:14112
- C:\Windows\System\egjUzJe.exe
  C:\Windows\System\egjUzJe.exe
  2⤵
  PID:14140
- C:\Windows\System\fOcmsqs.exe
  C:\Windows\System\fOcmsqs.exe
  2⤵
  PID:14168
- C:\Windows\System\qIClmLw.exe
  C:\Windows\System\qIClmLw.exe
  2⤵
  PID:14188
- C:\Windows\System\OZapCzm.exe
  C:\Windows\System\OZapCzm.exe
  2⤵
  PID:14236
- C:\Windows\System\kCYJZWb.exe
  C:\Windows\System\kCYJZWb.exe
  2⤵
  PID:14252
- C:\Windows\System\vruSjYr.exe
  C:\Windows\System\vruSjYr.exe
  2⤵
  PID:14276
- C:\Windows\System\SJPOLdZ.exe
  C:\Windows\System\SJPOLdZ.exe
  2⤵
  PID:14312
- C:\Windows\System\HttgmfT.exe
  C:\Windows\System\HttgmfT.exe
  2⤵
  PID:13112
- C:\Windows\System\amyflEv.exe
  C:\Windows\System\amyflEv.exe
  2⤵
  PID:13372
- C:\Windows\System\ZLwAzsV.exe
  C:\Windows\System\ZLwAzsV.exe
  2⤵
  PID:13436
- C:\Windows\System\swVoAYe.exe
  C:\Windows\System\swVoAYe.exe
  2⤵
  PID:13516
- C:\Windows\System\IJufsBl.exe
  C:\Windows\System\IJufsBl.exe
  2⤵
  PID:13576
- C:\Windows\System\iFaHfGw.exe
  C:\Windows\System\iFaHfGw.exe
  2⤵
  PID:13636
- C:\Windows\System\wUEJFoo.exe
  C:\Windows\System\wUEJFoo.exe
  2⤵
  PID:13728
- C:\Windows\System\rjbUbpQ.exe
  C:\Windows\System\rjbUbpQ.exe
  2⤵
  PID:13776
- C:\Windows\System\xtrjWgI.exe
  C:\Windows\System\xtrjWgI.exe
  2⤵
  PID:13848
- C:\Windows\System\gdVWZfe.exe
  C:\Windows\System\gdVWZfe.exe
  2⤵
  PID:13876
- C:\Windows\System\MMsrQZH.exe
  C:\Windows\System\MMsrQZH.exe
  2⤵
  PID:13976
- C:\Windows\System\yxrJByD.exe
  C:\Windows\System\yxrJByD.exe
  2⤵
  PID:14060
- C:\Windows\System\LBwgYpn.exe
  C:\Windows\System\LBwgYpn.exe
  2⤵
  PID:14096
- C:\Windows\System\pxDDyYP.exe
  C:\Windows\System\pxDDyYP.exe
  2⤵
  PID:14220
- C:\Windows\System\LKBMrwD.exe
  C:\Windows\System\LKBMrwD.exe
  2⤵
  PID:14224
- C:\Windows\System\JjPkwxY.exe
  C:\Windows\System\JjPkwxY.exe
  2⤵
  PID:14328
- C:\Windows\System\tdRPwcv.exe
  C:\Windows\System\tdRPwcv.exe
  2⤵
  PID:13364
- C:\Windows\System\LNeFOgH.exe
  C:\Windows\System\LNeFOgH.exe
  2⤵
  PID:13460
- C:\Windows\System\aWGhhOA.exe
  C:\Windows\System\aWGhhOA.exe
  2⤵
  PID:13612
- C:\Windows\System\ooYHaUK.exe
  C:\Windows\System\ooYHaUK.exe
  2⤵
  PID:13900
- C:\Windows\System\DBxzPvH.exe
  C:\Windows\System\DBxzPvH.exe
  2⤵
  PID:14052
- C:\Windows\System\hBxVGtP.exe
  C:\Windows\System\hBxVGtP.exe
  2⤵
  PID:14104
- C:\Windows\System\nSEqnPM.exe
  C:\Windows\System\nSEqnPM.exe
  2⤵
  PID:14244
- C:\Windows\System\OEYiivP.exe
  C:\Windows\System\OEYiivP.exe
  2⤵
  PID:13604
- C:\Windows\System\iqJYJEA.exe
  C:\Windows\System\iqJYJEA.exe
  2⤵
  PID:13704
- C:\Windows\System\vgBYnkD.exe
  C:\Windows\System\vgBYnkD.exe
  2⤵
  PID:13992
- C:\Windows\System\MMUuQjc.exe
  C:\Windows\System\MMUuQjc.exe
  2⤵
  PID:13324
- C:\Windows\System\eGQiLUj.exe
  C:\Windows\System\eGQiLUj.exe
  2⤵
  PID:14356
- C:\Windows\System\OIXnkRR.exe
  C:\Windows\System\OIXnkRR.exe
  2⤵
  PID:14388
- C:\Windows\System\JpkUCei.exe
  C:\Windows\System\JpkUCei.exe
  2⤵
  PID:14444
- C:\Windows\System\aEavFfD.exe
  C:\Windows\System\aEavFfD.exe
  2⤵
  PID:14472
- C:\Windows\System\ggISTUD.exe
  C:\Windows\System\ggISTUD.exe
  2⤵
  PID:14500
- C:\Windows\System\FdtofLA.exe
  C:\Windows\System\FdtofLA.exe
  2⤵
  PID:14528
- C:\Windows\System\NToacWx.exe
  C:\Windows\System\NToacWx.exe
  2⤵
  PID:14544
- C:\Windows\System\zyGCmAL.exe
  C:\Windows\System\zyGCmAL.exe
  2⤵
  PID:14584
- C:\Windows\System\ABMwtlv.exe
  C:\Windows\System\ABMwtlv.exe
  2⤵
  PID:14612
- C:\Windows\System\yemTRaj.exe
  C:\Windows\System\yemTRaj.exe
  2⤵
  PID:14628
- C:\Windows\System\zeBTCci.exe
  C:\Windows\System\zeBTCci.exe
  2⤵
  PID:14668
- C:\Windows\System\PsGlskO.exe
  C:\Windows\System\PsGlskO.exe
  2⤵
  PID:14684
- C:\Windows\System\BeFIWgb.exe
  C:\Windows\System\BeFIWgb.exe
  2⤵
  PID:14712
- C:\Windows\System\iWLDAsM.exe
  C:\Windows\System\iWLDAsM.exe
  2⤵
  PID:14732
- C:\Windows\System\uRWoEeZ.exe
  C:\Windows\System\uRWoEeZ.exe
  2⤵
  PID:14760
- C:\Windows\System\hnsgNEy.exe
  C:\Windows\System\hnsgNEy.exe
  2⤵
  PID:14788
- C:\Windows\System\ftEtspR.exe
  C:\Windows\System\ftEtspR.exe
  2⤵
  PID:14824
- C:\Windows\System\gXVrRtd.exe
  C:\Windows\System\gXVrRtd.exe
  2⤵
  PID:14876
- C:\Windows\System\vjEUFTu.exe
  C:\Windows\System\vjEUFTu.exe
  2⤵
  PID:14900
- C:\Windows\System\SmAirys.exe
  C:\Windows\System\SmAirys.exe
  2⤵
  PID:14928
- C:\Windows\System\PrbNFTd.exe
  C:\Windows\System\PrbNFTd.exe
  2⤵
  PID:14964
- C:\Windows\System\cKOqykf.exe
  C:\Windows\System\cKOqykf.exe
  2⤵
  PID:14996
- C:\Windows\System\HHurrfI.exe
  C:\Windows\System\HHurrfI.exe
  2⤵
  PID:15032
- C:\Windows\System\KLqZUYW.exe
  C:\Windows\System\KLqZUYW.exe
  2⤵
  PID:15064
- C:\Windows\System\fnZrkwV.exe
  C:\Windows\System\fnZrkwV.exe
  2⤵
  PID:15092
- C:\Windows\System\YlJbMju.exe
  C:\Windows\System\YlJbMju.exe
  2⤵
  PID:15124
- C:\Windows\System\vIyeBxC.exe
  C:\Windows\System\vIyeBxC.exe
  2⤵
  PID:15152
- C:\Windows\System\XrIBEhU.exe
  C:\Windows\System\XrIBEhU.exe
  2⤵
  PID:15180
- C:\Windows\System\IibGOCd.exe
  C:\Windows\System\IibGOCd.exe
  2⤵
  PID:15208
- C:\Windows\System\iYBtQiX.exe
  C:\Windows\System\iYBtQiX.exe
  2⤵
  PID:15236
- C:\Windows\System\iDAEEaM.exe
  C:\Windows\System\iDAEEaM.exe
  2⤵
  PID:15264
- C:\Windows\System\tFEAvZK.exe
  C:\Windows\System\tFEAvZK.exe
  2⤵
  PID:15292
- C:\Windows\System\ipJmtOs.exe
  C:\Windows\System\ipJmtOs.exe
  2⤵
  PID:15320
- C:\Windows\System\tnWNTbI.exe
  C:\Windows\System\tnWNTbI.exe
  2⤵
  PID:15348
- C:\Windows\System\ulpCxGA.exe
  C:\Windows\System\ulpCxGA.exe
  2⤵
  PID:13492
- C:\Windows\System\OBRPLiD.exe
  C:\Windows\System\OBRPLiD.exe
  2⤵
  PID:14352
- C:\Windows\System\yHuZOpQ.exe
  C:\Windows\System\yHuZOpQ.exe
  2⤵
  PID:14456
- C:\Windows\System\GldeGLf.exe
  C:\Windows\System\GldeGLf.exe
  2⤵
  PID:14512
- C:\Windows\System\hmSMaXj.exe
  C:\Windows\System\hmSMaXj.exe
  2⤵
  PID:14596
- C:\Windows\System\aXpkoFw.exe
  C:\Windows\System\aXpkoFw.exe
  2⤵
  PID:14664
- C:\Windows\System\MDzKcwE.exe
  C:\Windows\System\MDzKcwE.exe
  2⤵
  PID:14704
- C:\Windows\System\JTOdlIi.exe
  C:\Windows\System\JTOdlIi.exe
  2⤵
  PID:14776
- C:\Windows\System\eLDxOiB.exe
  C:\Windows\System\eLDxOiB.exe
  2⤵
  PID:14860
- C:\Windows\System\ZUOAAgJ.exe
  C:\Windows\System\ZUOAAgJ.exe
  2⤵
  PID:14924
- C:\Windows\System\kxsgZFy.exe
  C:\Windows\System\kxsgZFy.exe
  2⤵
  PID:15012
- C:\Windows\System\xtFNTfe.exe
  C:\Windows\System\xtFNTfe.exe
  2⤵
  PID:15080
- C:\Windows\System\YKHXMnr.exe
  C:\Windows\System\YKHXMnr.exe
  2⤵
  PID:15144
- C:\Windows\System\TImxyaS.exe
  C:\Windows\System\TImxyaS.exe
  2⤵
  PID:15176
- C:\Windows\System\CkVXDDp.exe
  C:\Windows\System\CkVXDDp.exe
  2⤵
  PID:15276
- C:\Windows\System\HbPrdoC.exe
  C:\Windows\System\HbPrdoC.exe
  2⤵
  PID:15332
- C:\Windows\System\assGkBe.exe
  C:\Windows\System\assGkBe.exe
  2⤵
  PID:14344
- C:\Windows\System\ogjJxuc.exe
  C:\Windows\System\ogjJxuc.exe
  2⤵
  PID:14484
- C:\Windows\System\OViDSzz.exe
  C:\Windows\System\OViDSzz.exe
  2⤵
  PID:14660
- C:\Windows\System\TzIaIOQ.exe
  C:\Windows\System\TzIaIOQ.exe
  2⤵
  PID:14744
- C:\Windows\System\KSKySIa.exe
  C:\Windows\System\KSKySIa.exe
  2⤵
  PID:14980
- C:\Windows\System\BwtPkZf.exe
  C:\Windows\System\BwtPkZf.exe
  2⤵
  PID:15168
- C:\Windows\System\UWTjGkY.exe
  C:\Windows\System\UWTjGkY.exe
  2⤵
  PID:15312
- C:\Windows\System\pRNnDlf.exe
  C:\Windows\System\pRNnDlf.exe
  2⤵
  PID:13752
- C:\Windows\System\nZcLWnh.exe
  C:\Windows\System\nZcLWnh.exe
  2⤵
  PID:14728
- C:\Windows\System\wrZaExc.exe
  C:\Windows\System\wrZaExc.exe
  2⤵
  PID:15108
- C:\Windows\System\VrQUUyS.exe
  C:\Windows\System\VrQUUyS.exe
  2⤵
  PID:14560
- C:\Windows\System\HShiShK.exe
  C:\Windows\System\HShiShK.exe
  2⤵
  PID:14912
- C:\Windows\System\eRVtwAF.exe
  C:\Windows\System\eRVtwAF.exe
  2⤵
  PID:15380
- C:\Windows\System\rCBKgkI.exe
  C:\Windows\System\rCBKgkI.exe
  2⤵
  PID:15408
- C:\Windows\System\rBhKFBt.exe
  C:\Windows\System\rBhKFBt.exe
  2⤵
  PID:15424
- C:\Windows\System\CDNCDeh.exe
  C:\Windows\System\CDNCDeh.exe
  2⤵
  PID:15452
- C:\Windows\System\nxrIXzR.exe
  C:\Windows\System\nxrIXzR.exe
  2⤵
  PID:15480
- C:\Windows\System\UFRqRUo.exe
  C:\Windows\System\UFRqRUo.exe
  2⤵
  PID:15508
- C:\Windows\System\kurLgtA.exe
  C:\Windows\System\kurLgtA.exe
  2⤵
  PID:15548
- C:\Windows\System\DLUqmas.exe
  C:\Windows\System\DLUqmas.exe
  2⤵
  PID:15564
- C:\Windows\System\GnKqTqQ.exe
  C:\Windows\System\GnKqTqQ.exe
  2⤵
  PID:15592
- C:\Windows\System\mkFbvTY.exe
  C:\Windows\System\mkFbvTY.exe
  2⤵
  PID:15632
- C:\Windows\System\bPuEBJa.exe
  C:\Windows\System\bPuEBJa.exe
  2⤵
  PID:15660
- C:\Windows\System\TKZCilQ.exe
  C:\Windows\System\TKZCilQ.exe
  2⤵
  PID:15684
- C:\Windows\System\QqBgsbl.exe
  C:\Windows\System\QqBgsbl.exe
  2⤵
  PID:15716
- C:\Windows\System\tFsXeVO.exe
  C:\Windows\System\tFsXeVO.exe
  2⤵
  PID:15744
- C:\Windows\System\AhJZHcI.exe
  C:\Windows\System\AhJZHcI.exe
  2⤵
  PID:15780
- C:\Windows\System\KtWISVQ.exe
  C:\Windows\System\KtWISVQ.exe
  2⤵
  PID:15808
- C:\Windows\System\pQbvXmH.exe
  C:\Windows\System\pQbvXmH.exe
  2⤵
  PID:15836
- C:\Windows\System\EHeMAmC.exe
  C:\Windows\System\EHeMAmC.exe
  2⤵
  PID:15864
- C:\Windows\System\oFkmEbZ.exe
  C:\Windows\System\oFkmEbZ.exe
  2⤵
  PID:15892
- C:\Windows\System\CtJFlGy.exe
  C:\Windows\System\CtJFlGy.exe
  2⤵
  PID:15944
- C:\Windows\System\gdxVrEO.exe
  C:\Windows\System\gdxVrEO.exe
  2⤵
  PID:15972
- C:\Windows\System\CHusogC.exe
  C:\Windows\System\CHusogC.exe
  2⤵
  PID:16000
- C:\Windows\System\YlfqcxC.exe
  C:\Windows\System\YlfqcxC.exe
  2⤵
  PID:16028
- C:\Windows\System\TNvNJWE.exe
  C:\Windows\System\TNvNJWE.exe
  2⤵
  PID:16056
- C:\Windows\System\rhoclBh.exe
  C:\Windows\System\rhoclBh.exe
  2⤵
  PID:16084
- C:\Windows\System\fbfXNCF.exe
  C:\Windows\System\fbfXNCF.exe
  2⤵
  PID:16112
- C:\Windows\System\OcXJkTj.exe
  C:\Windows\System\OcXJkTj.exe
  2⤵
  PID:16132
- C:\Windows\System\aLtwtZe.exe
  C:\Windows\System\aLtwtZe.exe
  2⤵
  PID:16172
- C:\Windows\System\PqYtnCT.exe
  C:\Windows\System\PqYtnCT.exe
  2⤵
  PID:16200
- C:\Windows\System\hZekUcu.exe
  C:\Windows\System\hZekUcu.exe
  2⤵
  PID:16232
- C:\Windows\System\NwpcLwg.exe
  C:\Windows\System\NwpcLwg.exe
  2⤵
  PID:16260
- C:\Windows\System\LYGyiwT.exe
  C:\Windows\System\LYGyiwT.exe
  2⤵
  PID:16288
- C:\Windows\System\gzAuASq.exe
  C:\Windows\System\gzAuASq.exe
  2⤵
  PID:16316
- C:\Windows\System\wzWDfGM.exe
  C:\Windows\System\wzWDfGM.exe
  2⤵
  PID:16344
- C:\Windows\System\wArSdgw.exe
  C:\Windows\System\wArSdgw.exe
  2⤵
  PID:16372
- C:\Windows\System\VXOrYac.exe
  C:\Windows\System\VXOrYac.exe
  2⤵
  PID:15404
- C:\Windows\System\koAcUpd.exe
  C:\Windows\System\koAcUpd.exe
  2⤵
  PID:15464
- C:\Windows\System\fQLvQPV.exe
  C:\Windows\System\fQLvQPV.exe
  2⤵
  PID:15540
- C:\Windows\System\uhpMDuX.exe
  C:\Windows\System\uhpMDuX.exe
  2⤵
  PID:15608
- C:\Windows\System\iNekfFK.exe
  C:\Windows\System\iNekfFK.exe
  2⤵
  PID:15692
- C:\Windows\System\fbOHvlV.exe
  C:\Windows\System\fbOHvlV.exe
  2⤵
  PID:15740
- C:\Windows\System\vOHSErN.exe
  C:\Windows\System\vOHSErN.exe
  2⤵
  PID:15804
- C:\Windows\System\dYNXtIr.exe
  C:\Windows\System\dYNXtIr.exe
  2⤵
  PID:15876
- C:\Windows\System\JGeGjOX.exe
  C:\Windows\System\JGeGjOX.exe
  2⤵
  PID:15956
- C:\Windows\System\KVWrEPk.exe
  C:\Windows\System\KVWrEPk.exe
  2⤵
  PID:16024
- C:\Windows\System\EaOGInU.exe
  C:\Windows\System\EaOGInU.exe
  2⤵
  PID:16080
- C:\Windows\System\pDHRozb.exe
  C:\Windows\System\pDHRozb.exe
  2⤵
  PID:16156
- C:\Windows\System\ZjdcWZP.exe
  C:\Windows\System\ZjdcWZP.exe
  2⤵
  PID:16216
- C:\Windows\System\uYjfwGB.exe
  C:\Windows\System\uYjfwGB.exe
  2⤵
  PID:16284
- C:\Windows\System\rTUEiYX.exe
  C:\Windows\System\rTUEiYX.exe
  2⤵
  PID:16356
- C:\Windows\System\DpPLUTA.exe
  C:\Windows\System\DpPLUTA.exe
  2⤵
  PID:5100
- C:\Windows\System\duQwTDq.exe
  C:\Windows\System\duQwTDq.exe
  2⤵
  PID:15440
- C:\Windows\System\jhqWAGs.exe
  C:\Windows\System\jhqWAGs.exe
  2⤵
  PID:15576
- C:\Windows\System\wgwQqQS.exe
  C:\Windows\System\wgwQqQS.exe
  2⤵
  PID:15644
- C:\Windows\System\DEfbPGR.exe
  C:\Windows\System\DEfbPGR.exe
  2⤵
  PID:15792
- C:\Windows\System\chPBGWk.exe
  C:\Windows\System\chPBGWk.exe
  2⤵
  PID:15988
- C:\Windows\System\bVBuJgN.exe
  C:\Windows\System\bVBuJgN.exe
  2⤵
  PID:16128
- C:\Windows\System\sxBSMmZ.exe
  C:\Windows\System\sxBSMmZ.exe
  2⤵
  PID:16280
- C:\Windows\System\alapVve.exe
  C:\Windows\System\alapVve.exe
  2⤵
  PID:1896
- C:\Windows\System\FbtOouA.exe
  C:\Windows\System\FbtOouA.exe
  2⤵
  PID:15648
- C:\Windows\System\hENjcHB.exe
  C:\Windows\System\hENjcHB.exe
  2⤵
  PID:15940
- C:\Windows\System\SyFIGSF.exe
  C:\Windows\System\SyFIGSF.exe
  2⤵
  PID:16340
- C:\Windows\System\YXpWYSg.exe
  C:\Windows\System\YXpWYSg.exe
  2⤵
  PID:14248
- C:\Windows\System\wSuawju.exe
  C:\Windows\System\wSuawju.exe
  2⤵
  PID:16272
- C:\Windows\System\PAAdcMg.exe
  C:\Windows\System\PAAdcMg.exe
  2⤵
  PID:16400
- C:\Windows\System\ecbrltb.exe
  C:\Windows\System\ecbrltb.exe
  2⤵
  PID:16432
- C:\Windows\System\PdAFWps.exe
  C:\Windows\System\PdAFWps.exe
  2⤵
  PID:16460
- C:\Windows\System\QMfAHLc.exe
  C:\Windows\System\QMfAHLc.exe
  2⤵
  PID:16488
- C:\Windows\System\NXaQvHP.exe
  C:\Windows\System\NXaQvHP.exe
  2⤵
  PID:16516
- C:\Windows\System\wjTPmJe.exe
  C:\Windows\System\wjTPmJe.exe
  2⤵
  PID:16544
- C:\Windows\System\knvBucQ.exe
  C:\Windows\System\knvBucQ.exe
  2⤵
  PID:16572
- C:\Windows\System\sVEsGab.exe
  C:\Windows\System\sVEsGab.exe
  2⤵
  PID:16600
- C:\Windows\System\cleRSew.exe
  C:\Windows\System\cleRSew.exe
  2⤵
  PID:16628
- C:\Windows\System\luxtukd.exe
  C:\Windows\System\luxtukd.exe
  2⤵
  PID:16656
- C:\Windows\System\sunaCxy.exe
  C:\Windows\System\sunaCxy.exe
  2⤵
  PID:16684
- C:\Windows\System\hAkxATb.exe
  C:\Windows\System\hAkxATb.exe
  2⤵
  PID:16712
- C:\Windows\System\uaijYnM.exe
  C:\Windows\System\uaijYnM.exe
  2⤵
  PID:16740
- C:\Windows\System\FDGwreb.exe
  C:\Windows\System\FDGwreb.exe
  2⤵
  PID:16772
- C:\Windows\System\IFyWaxd.exe
  C:\Windows\System\IFyWaxd.exe
  2⤵
  PID:16800
- C:\Windows\System\iEzKurn.exe
  C:\Windows\System\iEzKurn.exe
  2⤵
  PID:16828
- C:\Windows\System\HJjMrZl.exe
  C:\Windows\System\HJjMrZl.exe
  2⤵
  PID:16856
- C:\Windows\System\MmxVJlh.exe
  C:\Windows\System\MmxVJlh.exe
  2⤵
  PID:16884
- C:\Windows\System\zHnusZC.exe
  C:\Windows\System\zHnusZC.exe
  2⤵
  PID:16924
- C:\Windows\System\NuRpQDd.exe
  C:\Windows\System\NuRpQDd.exe
  2⤵
  PID:16952
- C:\Windows\System\RDcrEji.exe
  C:\Windows\System\RDcrEji.exe
  2⤵
  PID:16980
- C:\Windows\System\tOOlCSp.exe
  C:\Windows\System\tOOlCSp.exe
  2⤵
  PID:17008
- C:\Windows\System\lIpEOFO.exe
  C:\Windows\System\lIpEOFO.exe
  2⤵
  PID:17040
- C:\Windows\System\bhVxWIE.exe
  C:\Windows\System\bhVxWIE.exe
  2⤵
  PID:17072
- C:\Windows\System\lxcgenL.exe
  C:\Windows\System\lxcgenL.exe
  2⤵
  PID:17100
- C:\Windows\System\oSteJxu.exe
  C:\Windows\System\oSteJxu.exe
  2⤵
  PID:17128
- C:\Windows\System\rOttzWO.exe
  C:\Windows\System\rOttzWO.exe
  2⤵
  PID:17156
- C:\Windows\System\VgVsdGg.exe
  C:\Windows\System\VgVsdGg.exe
  2⤵
  PID:17184
- C:\Windows\System\XfIIMpe.exe
  C:\Windows\System\XfIIMpe.exe
  2⤵
  PID:17220
- C:\Windows\System\EJcCTzq.exe
  C:\Windows\System\EJcCTzq.exe
  2⤵
  PID:17248
- C:\Windows\System\ixBjPjx.exe
  C:\Windows\System\ixBjPjx.exe
  2⤵
  PID:17276
- C:\Windows\System\MEHIxbB.exe
  C:\Windows\System\MEHIxbB.exe
  2⤵
  PID:17304
- C:\Windows\System\vgeDcey.exe
  C:\Windows\System\vgeDcey.exe
  2⤵
  PID:17332
- C:\Windows\System\nZouaJd.exe
  C:\Windows\System\nZouaJd.exe
  2⤵
  PID:17368
- C:\Windows\System\MtgMVWy.exe
  C:\Windows\System\MtgMVWy.exe
  2⤵
  PID:17396
- C:\Windows\System\UJywixo.exe
  C:\Windows\System\UJywixo.exe
  2⤵
  PID:16428
- C:\Windows\System\ODUOMpo.exe
  C:\Windows\System\ODUOMpo.exe
  2⤵
  PID:16484

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EOdhclL.exe

Path C:\Windows\System\EOdhclL.exe
Size 2.1MB
SHA256 ecb2d18f86b3f484c880ff2c75f5bcd2197d86187f0cb42d6fe4f860c6213cfb
MD5 1608490c789b18ef5f3c83c645a0a322
SHA1 54e07beb746c51b05347f18aa85106da6e84fb14
SHA512 c78e15f3075f35cd6ea25bcef1642e8c71f54a9f4a57a09417604089d775659c4629727ebb5a49353844e0ced1a7697cac2bcf38de5aed6c5237feac2b2912c8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Kq:GemTLkNdfE0pZab
MD5 SHA1 SHA512 SSDEEP

Submit Download

FMWuhRN.exe

Path C:\Windows\System\FMWuhRN.exe
Size 2.1MB
SHA256 f248d83cddaeb75a00e9e1e7b2ac466bd0f6aafe16546e69c5575fd1b119f7e6
MD5 a0aa1f77ffff1fc989887a8060872de6
SHA1 62099ddd3c54c94f08d0e755def65ba72b449f13
SHA512 a8397db3b17f95ed605a1d4b1fd3b3a7b9324a3719699a0386867610a9a7da0a8895836832147a79c1c299b0b9491459a1814f0afa4cc235fbd6ca152bc28767
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Kt:GemTLkNdfE0pZaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

GwoDDEJ.exe

Path C:\Windows\System\GwoDDEJ.exe
Size 2.1MB
SHA256 ccf2caa30964084c08213d360886dd35ff95e3ad7d930298368b49cbd18fc576
MD5 937af837bdea780387a14f2e2b0788cf
SHA1 c21692d422951998345b56b9038cf68e3f0df1cc
SHA512 71c8f0bd8be349cb4598555d7ea77ac4d2e2c8c368c0fbd9d50dbb5f93bfd90beb8b8123caeb4e29c54c4b042e42738566d3f25f36cc11b40e5b52b59e17e4de
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KB:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

JkIbhMm.exe

Path C:\Windows\System\JkIbhMm.exe
Size 2.1MB
SHA256 70e4be4c97105c27c2d1f33fb42370ef7c541cbc169a7eeca0528ad5c22de44a
MD5 331180363de5588866690532adb1fa41
SHA1 45cb982820d33a25f0a3bb8e7fb26f80fa5b5107
SHA512 25477966935f35855a9946346283a268142227ad8922f43ad06576e95cfe2a4a29a52d76605e98239bbe46d9f47fb620f27b46457f5aba989ef6fcd480189df7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Kj:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

JnbBYyi.exe

Path C:\Windows\System\JnbBYyi.exe
Size 2.1MB
SHA256 f341122936897e0cfbb0184c0720c7ebd30a080ae8174f20f5036369051ac12a
MD5 f83494082377ac2c7787bbe284aa2f6e
SHA1 0dc37205b642ebbc37c8b0ec8ec82a2bd3b127c1
SHA512 26c932278a5950d968e966e1bea245106dceda2698dd05179792140e8e13dc8ec980580fb42c8312ea7024aa36d9272512ad72c31ff5250f23d3e239f3b53ebd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KP:GemTLkNdfE0pZa8
MD5 SHA1 SHA512 SSDEEP

Submit Download

LsunzOa.exe

Path C:\Windows\System\LsunzOa.exe
Size 2.1MB
SHA256 907ce9b835331c19b6315d7918cb45c95267221621828d73d218ebf5551ff03d
MD5 1378210bf47cdfd8164b66ac278c1cef
SHA1 6ab0da7a70a5ac4bfd70c97ba05f69ee1b724cdb
SHA512 942f85e4120ca3a26c63cad81cbf100b4fede0912d13c2855ab55892238ab6c6436d44b87c21d8059cae73a8c568cd4b96dfe2d719420474ca6dd1cda465b49a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Kx6:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MUiOYrS.exe

Path C:\Windows\System\MUiOYrS.exe
Size 2.1MB
SHA256 132276876c0e6f9ce50bbc66c29424802d6e0a05a9b5616bd97e27aa3bb7c184
MD5 29dfe9c4b353249d053cb66151c0e3e9
SHA1 d71417aff355294e9a2e6bb9703eead60535dc25
SHA512 1b70b9ab30549299bdb1623e86f60b2e5f71f7c13cbc80d8a9102638fe9060137afcdc8d4174bcc3ff09f15ca85bf309bacd9c3b8fdefad95e53e0bb0624de84
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+K5:GemTLkNdfE0pZaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

NKFYVAi.exe

Path C:\Windows\System\NKFYVAi.exe
Size 2.1MB
SHA256 1bf656125f826f9b2e956f0fe66299b7de92b2965b8e1cd47181b59d1019a1fc
MD5 6cd6f43d9fa401b183366677f7194b56
SHA1 bb9b09e3f48521f4a937e3aeb517ea212618655b
SHA512 76f7ec90e937dae20ae735f78cc7dd79077d94475888cca0510268ee297d3a20346477ed65ae3fc3604f012dfcb9e8526febabd4acabcf662ba3377302697c21
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KG:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

OAvRovk.exe

Path C:\Windows\System\OAvRovk.exe
Size 2.0MB
SHA256 3ff2f7053419b8b3e8ecc124de4181410ea4c5e64180606493afb3a28e38cc8b
MD5 89e6f4c208bac38e013c3ae19fe808b5
SHA1 c7020a4d4d312aa831576b135e31a300505b3203
SHA512 17abcd8eb9a881074aa38606a3379bf882619d29a12ca438fae7a033f5ea8e829fb668351ffcb7d0723f7c1586c360c766bbea427a36674cde697afae59f569b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KJ:GemTLkNdfE0pZa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ODIYbbz.exe

Path C:\Windows\System\ODIYbbz.exe
Size 2.1MB
SHA256 e15d57ecc544d5405f6960bed2aa4cffd0478e319877e725d2b77e0a39f24ae2
MD5 a9679ebc8f149f2fc1888a0dc59698b5
SHA1 fb80e473f96dd8e94bb085527a50e9de75d4c65b
SHA512 50eba46973013e6713f8bcaada71e2c4b49f3c871de475b16f40aa6693803a73cb82b812b5748c3fb8a83fe5e3194f2b2b97a707d8ca3ab436ffd48c6f436d19
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+K6:GemTLkNdfE0pZal
MD5 SHA1 SHA512 SSDEEP

Submit Download

QEjzRLG.exe

Path C:\Windows\System\QEjzRLG.exe
Size 2.1MB
SHA256 e85e72908e4dd7384389ee60b67cad186fb45264c070e116e9d96dc817b5e568
MD5 62fccabdd4cb22d9dfa1fb62dffcc23b
SHA1 c1d33cd9f01250633d96c2f6a5082bfadb36ec49
SHA512 9505250f2340e9be993e8a19981e490d8039c87829915833bc8e6e2dda4dd4cf4f7341994874d60e28334dc267710577a01304ebe277fbc88b0de5cdbda80801
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KG:GemTLkNdfE0pZaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMiTyfX.exe

Path C:\Windows\System\QMiTyfX.exe
Size 2.1MB
SHA256 915adefa2f28eb3d171c68864d2ec93876d081ceba4dcb08b8d6153ced7e42fe
MD5 95b82805ab09da6ae3e6cc65b71ff484
SHA1 338f77ab00ccdfe05adbc62e616088f71b919ec1
SHA512 ada14cb59bf9b9cfe2ed9f542ef0f36759b25fc743d9b79d254cc7f4705c30a4e9c28e86d1161427cf5ccea25c1ed7667e3a08efcbc0cf1e6200484f35de0e2c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KL:GemTLkNdfE0pZae
MD5 SHA1 SHA512 SSDEEP

Submit Download

SDUcfBz.exe

Path C:\Windows\System\SDUcfBz.exe
Size 2.1MB
SHA256 84660fefb0b6a05a8dfae7ef71321a8f86c29a877cb9baa2e445015ae58ced1d
MD5 6b8c96dfd3c0f8a66d0401a09dc1461f
SHA1 7edeba18b4723a696056c8440725be2f1820436a
SHA512 5aa943dc0011565a85493a4cd110687619720a010e4af4657d134e096fff5273575007fbcf5e32b0a5f9af348679614272923da10cce53dd58d608b1b4af0f0b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KB:GemTLkNdfE0pZam
MD5 SHA1 SHA512 SSDEEP

Submit Download

TfUYWTI.exe

Path C:\Windows\System\TfUYWTI.exe
Size 2.1MB
SHA256 a455826653b0f2e5634979faf27e4a87847542a0e78b7f8db6e4dca549746b42
MD5 576b4bfacc14582f770c5d7b7f4b98e6
SHA1 bf26822e3280ad911c4698486d938ae8482fcbea
SHA512 01df33328e8ef3a7d8cc1442830aa0506bdea019a5094559fa170176236bc987e2adc8aa2c7de2130109622fca62483216ded41bf181892e18c6c3996a86d1bf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KQ:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

TtjoBPt.exe

Path C:\Windows\System\TtjoBPt.exe
Size 2.0MB
SHA256 a674b70ea81fb449f960e1509d194866456d8984dd486b7d3b0bad0b77069366
MD5 cdfd2a7aedbf07d45a13770aba810131
SHA1 2b3bbeef4d4a602a08e1d18c0552bec77b1ca1f4
SHA512 eb6fa00c813c44f44f5f5acd5343ebef59fd7208711358347074896b1a427b0e6d53101e231403b8d669c0240b6b7ed29fdb9c45fe5d45821a05a2d0e171eef1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Kn:GemTLkNdfE0pZaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

UUQMIbL.exe

Path C:\Windows\System\UUQMIbL.exe
Size 2.1MB
SHA256 0b46ce23d6d2962ef65afcd971b8683fabec15b8f03269805310eaa72831c5b5
MD5 11018dc28a292e58e8251dec66852d54
SHA1 70d8521014e996b6c88307d1781108b61ff80915
SHA512 fe73840600056c65fad3d271d2d4e20644484abd773d023357affaa151945bb56ab617a5095d948c4b4479fb42e34a1fdda15ef94916bee39ad3af69d808142a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KJ:GemTLkNdfE0pZaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

UYaiNzp.exe

Path C:\Windows\System\UYaiNzp.exe
Size 2.1MB
SHA256 1fed375407d7e372e6877a283d238e5facea71fc685ba2e91f9fc1bb8c726a0c
MD5 19b308c667df99dee6f4e2b659cb3289
SHA1 2887b9c0450d328927030ee028c2582bff72b9e8
SHA512 79544872e7ffd43f2ad881265f02c7f618777e76806cc4a1cea06d77533105f51811daf12bd392b7d48e8ac2c8d6a49b088a8112ca867901d847528763ca6bbe
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KD:GemTLkNdfE0pZaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

YKzPCzq.exe

Path C:\Windows\System\YKzPCzq.exe
Size 2.1MB
SHA256 2d0ec4d2fe2aae73167ec9d3f6aefb3d56d6d19ea80e7fa3876dbcd8247fa363
MD5 3eda1a7f334daa24d58033ec87d92efe
SHA1 ad4651656122127e042346f02951475ad84265f8
SHA512 d8adbe6b132698c45426887229c703ea7d95c53ab91d5050dd265e911c1d818aededdd9f21471b59a8999b557ee14e16b9b2ce7a67afb6a3c0aecb6e008b6b12
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+K+:GemTLkNdfE0pZaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

fqrIWJR.exe

Path C:\Windows\System\fqrIWJR.exe
Size 2.1MB
SHA256 0303aa68354b4777ac25dde3ee5353343a85ec6c7c061c4eaf2b25a20739061a
MD5 cdb878d78eaf10780a70c8c5c52d12f1
SHA1 6756e34be7816293d8693373d237264c2572871a
SHA512 c86dbb424e2a95a246e4c20438a726c059a130d6de219cb09aa904464ce075c323e89dd52a33b8fbf52c6003e5296cdbbf881da381e16f13b2a089d9cda27e9a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+K2:GemTLkNdfE0pZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

iLFktTH.exe

Path C:\Windows\System\iLFktTH.exe
Size 2.1MB
SHA256 250058164faec3250a8aa754c09cd68b8ccce8b994672042e63210dad6c46ce7
MD5 6b2a37fe44e8e8c4540eafb1f1666c22
SHA1 b8fbf00dc6262f9e3223956c185d13a8f8adc867
SHA512 4c450cea18eb95c769bd8242dd27e11b6d92288e563a83aae9cfe8eb40419dcfd386ed079bae2b2ec32b0fe4bc5be636c3f535c4ad5274d0512066e1e7e1b7b9
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Kk:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

kqlstGi.exe

Path C:\Windows\System\kqlstGi.exe
Size 2.0MB
SHA256 f625041653f5f8441567f1b16d25b5c79f3ff03bfcdfd75bdbd420c3974c5396
MD5 4cde0f195c6905660bf9d681f41e5d46
SHA1 ca7f351986247f414b27040df04bcac45981f2da
SHA512 1b9457defdfe3d211c92792dd0424b597759563b944ea3febe20abc163a8b955b4b25d39c07bbd8cad2d0ac511b282b26726354d6cad526716773a6ca3b0097b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KB:GemTLkNdfE0pZaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lRHMTgD.exe

Path C:\Windows\System\lRHMTgD.exe
Size 2.1MB
SHA256 b06b292893f15084dbd64418d6973b5f8f6ea938f7dc5b17619193c314410668
MD5 d17dace78cfb54e5484ff7745c297bfc
SHA1 2d968f41431178dd467167428b211fc1c4420e87
SHA512 754990da61105ccb0954547bc8a2b96446d7de42e1098febb189ac597a53fc2bae43e1c3a3f6abddbb9eb1d27fdb82ad72a556f1bb3dbefa98ec4f0bc2885019
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Kb:GemTLkNdfE0pZay
MD5 SHA1 SHA512 SSDEEP

Submit Download

mSwLtkY.exe

Path C:\Windows\System\mSwLtkY.exe
Size 2.1MB
SHA256 843f78a8776608e9adf8397c7f5b48ca785901191a4dafe2f8f53dbae6e3e28b
MD5 a049ace5d585b90900b19c5465ea20d9
SHA1 f850e14fc0cb52821208de7d33dcc52a7d27ddad
SHA512 7d766f04b683d166beec20ea0d905506d27a19ef70b7b879fe9cb6ac6e5b04c13c27bed0ab413fe8f94921fd670829c2b780bd95675fc8ca43b9fb73fe0d1a25
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Kc:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

mhrtETP.exe

Path C:\Windows\System\mhrtETP.exe
Size 2.1MB
SHA256 5ab33c1af503645e6f9c778048ea78cc719aa9c7d55da4d6f67b775daa3eafa1
MD5 a39e30d823f05b81d855df980069fc11
SHA1 dd4b628b3edb916ce760c04871d71b49a3045ab8
SHA512 84d6c4ca86b4dec8337338c4b59c2ad36c1b9501959a43de1f087535df1c0b304c9c00f626b35d4dad0566f8b95a7f6e8f3a1cac77cd1431ef377698177adbbf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KZ:GemTLkNdfE0pZaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

nLZZCUI.exe

Path C:\Windows\System\nLZZCUI.exe
Size 2.1MB
SHA256 d0e7c615a48b0e0066214d2ff37cc8ebe5a6cf9931e6a21a321e76c337e9e02e
MD5 168fde6bcd99067ab1273958bde7af1f
SHA1 bb79e5655fe5dd321e7984755bf61ef6b12faaf3
SHA512 2e48725a957d95e52f6dd492f61a0c3b14f81efdc30cab2507e57ad8daeb00ec04cef44075e3a72d438d0c78ac0a6450755633642fbd0c871aa77f2a63512109
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KU:GemTLkNdfE0pZa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

omxafpB.exe

Path C:\Windows\System\omxafpB.exe
Size 2.1MB
SHA256 997668e4f36f499d1679c1f0c7c8fad978e8543cd2a14a18f0717fbdd9d24e6b
MD5 2c5a740a03393811aa7810ab77f1e4ed
SHA1 84c73f2438ef9f8d323b1b2614dbcdeeed164921
SHA512 c0ff1666d232d9e51e52de6a2dbc3ad88c3e4b5efb25bb678f0d963b4771ae61e36214eb4aa5fdddf68cd748afe77a2f3c37af8d734d86740ffa73de568feb83
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Kvk:GemTLkNdfE0pZaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

qIWYRGQ.exe

Path C:\Windows\System\qIWYRGQ.exe
Size 2.1MB
SHA256 2fed521528a0d8afe03abcbe7e50406b0792690c22919e97ad9bf0566a42f707
MD5 5b6c1cdd2e043bff3e0c2704b6b4e655
SHA1 f3acfb8c4caaaf519e91940bb3365586d3158f0b
SHA512 02e6a42ac31ec99182e7c417282ffea699f40a5398ee5d50b9bb383e746771142e2765619a344825cd427ab3b73e854c46bfa3584ad86ae342212d0d6cbf4218
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Ks:GemTLkNdfE0pZaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

rHMawgb.exe

Path C:\Windows\System\rHMawgb.exe
Size 2.1MB
SHA256 ce8e661f10b92ababe5e03acc8a3561e41b713d1485c15eb131a09948da9b786
MD5 3af067e0ffd6d6b2f098e9ef8e814d71
SHA1 ab1e70415f17a900c028cd420c5ab92079f11f2e
SHA512 9bddcdfea14de3479a30fb62519919aae8282d1da3dca770d86946aaec1771944361f95bb23d0738b3f9d3e9eb1d98921ddfb4832db1f401bff23f35906621ba
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Kr:GemTLkNdfE0pZaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

sBhzrhp.exe

Path C:\Windows\System\sBhzrhp.exe
Size 2.0MB
SHA256 e8f25ca8749f3d37b907d09cc8e11bda4fe4a5bc7e2628cbe80818cfc27e89c7
MD5 4fa534bedfc93514f51a9d5953c9a30b
SHA1 7a485318a91f7dd4bf5f38024c693e511af720a3
SHA512 8eed42684e5f22520815b8a666308b5ce84632d27832ae8c4eadeaad1d9f662345e52d9cbfae1218f9e828e7a032be5fb49cbd5ca9c781018825023c43f90112
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KW:GemTLkNdfE0pZar
MD5 SHA1 SHA512 SSDEEP

Submit Download

sbgLjSG.exe

Path C:\Windows\System\sbgLjSG.exe
Size 2.1MB
SHA256 913f6e79585b289855190c1283c49f5c02edfa654c109858843ad432b128de63
MD5 07e91befcd4b7ccabd93d90a47157658
SHA1 46e478f4d670fe065ff1028d7664c049dae89609
SHA512 50154f68201469bef5d2e7e7b3d9d65bec21fdd3b69a1687426700cbc929af84a5d63d902788634496e8f92c476d65b6efa25862033edea7ab81e9c36fac4de3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Ky:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

wGruTzT.exe

Path C:\Windows\System\wGruTzT.exe
Size 2.1MB
SHA256 ac422ba99a9f3f8461ea1d8290fff72d5c77789f2b29a0ba92385e3b29b1d332
MD5 f618129c6f9cb8c5af97a5f0f2dfdb62
SHA1 090df82c3f44a833369c19688dc9a3c1cee9da11
SHA512 d3cfbc0a2d8f7dfd4aaf2b83c1641bbb43040a1320de181c2b85cd7303d4949dff9d0762e47201d4416ebda6b822f9ee000971df17d0ac242a639d6c0111256e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+K2:GemTLkNdfE0pZal
MD5 SHA1 SHA512 SSDEEP

Submit Download

xJSNoxL.exe

Path C:\Windows\System\xJSNoxL.exe
Size 2.1MB
SHA256 af30e20988633b420039d6b68f2586b0b782d8101413baf006b8e45c54ca11e6
MD5 9ec25cf8a812db5dd3f68686926ae531
SHA1 ed0933ad2080f4b70b35b7c274a9256189dd92b7
SHA512 f6977f41b435c019b87fe5e6e4a4ccdc8aeef6cadf7fcfc4c4e18307bfc3cf7b4aafa86a00d3063abb85235ff527aa6d5fc2599826781be7c6c6de23382e26bb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KA:GemTLkNdfE0pZaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

yfNIDXu.exe

Path C:\Windows\System\yfNIDXu.exe
Size 2.1MB
SHA256 2aaa33f998ce6f3a8ea2e6e015d58aed569aa62319d83f1d27b3b4556b84a34d
MD5 1b250f26998fdcb304d43477357312e9
SHA1 09684e7f2091baa3acbed2bd31c80f5ab2ca4496
SHA512 39836f7b89bfb6bb3230a93ebbc1579221e88bd9c23405fad93dfc3b1369c06a910fbec2ad3e612295ca8307f280684d230e53cda7d56b01354d848c164fe76b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+KJ:GemTLkNdfE0pZaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4852-0-0x000001B0361A0000-0x000001B0361B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads