xmrig | 6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8

Analysis

max time kernel
123s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
Size

2.7MB
MD5

f86b5836600da6558aa02dda30935e33
SHA1

eeb5cb33110e22367c3faaf1a565e2a0a8f7cb0a
SHA256

6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8
SHA512

bd367d73eb8a978efeb2cf644a769063ce501e7e36622ad767e54c2f91913733f3a5869e81c9d2ed0af3edeb420535eba597948e3e4e7ef96da10ae389b454a4
SSDEEP

49152:w0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzzxTMS8Tg4nZIURq:w0GnJMOWPClFdx6e0EALKWVTffZiPAch

Score

10^/10

xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3104-0-0x00007FF659A60000-0x00007FF659E55000-memory.dmp	xmrig
behavioral2/files/0x0009000000023470-4.dat	xmrig
behavioral2/files/0x00090000000234bb-9.dat	xmrig
behavioral2/files/0x00070000000234cc-10.dat	xmrig
behavioral2/files/0x00070000000234cd-24.dat	xmrig
behavioral2/files/0x00070000000234ce-27.dat	xmrig
behavioral2/files/0x00070000000234db-94.dat	xmrig
behavioral2/files/0x00070000000234e0-119.dat	xmrig
behavioral2/files/0x00070000000234e3-131.dat	xmrig
behavioral2/files/0x00070000000234e6-147.dat	xmrig
behavioral2/memory/3064-623-0x00007FF683CD0000-0x00007FF6840C5000-memory.dmp	xmrig
behavioral2/memory/3856-624-0x00007FF62E280000-0x00007FF62E675000-memory.dmp	xmrig
behavioral2/memory/4040-625-0x00007FF7D18A0000-0x00007FF7D1C95000-memory.dmp	xmrig
behavioral2/memory/228-626-0x00007FF6C3FD0000-0x00007FF6C43C5000-memory.dmp	xmrig
behavioral2/memory/3076-627-0x00007FF7E2AB0000-0x00007FF7E2EA5000-memory.dmp	xmrig
behavioral2/memory/1448-628-0x00007FF7CD310000-0x00007FF7CD705000-memory.dmp	xmrig
behavioral2/memory/2592-629-0x00007FF70CE10000-0x00007FF70D205000-memory.dmp	xmrig
behavioral2/memory/4224-630-0x00007FF689DD0000-0x00007FF68A1C5000-memory.dmp	xmrig
behavioral2/memory/4628-631-0x00007FF6485A0000-0x00007FF648995000-memory.dmp	xmrig
behavioral2/memory/4276-632-0x00007FF6894E0000-0x00007FF6898D5000-memory.dmp	xmrig
behavioral2/memory/1544-653-0x00007FF76C4E0000-0x00007FF76C8D5000-memory.dmp	xmrig
behavioral2/memory/5008-663-0x00007FF693320000-0x00007FF693715000-memory.dmp	xmrig
behavioral2/memory/3552-671-0x00007FF61E6B0000-0x00007FF61EAA5000-memory.dmp	xmrig
behavioral2/memory/2900-669-0x00007FF7ED360000-0x00007FF7ED755000-memory.dmp	xmrig
behavioral2/memory/4920-666-0x00007FF70D6B0000-0x00007FF70DAA5000-memory.dmp	xmrig
behavioral2/memory/2920-682-0x00007FF78BE20000-0x00007FF78C215000-memory.dmp	xmrig
behavioral2/memory/4784-685-0x00007FF678E30000-0x00007FF679225000-memory.dmp	xmrig
behavioral2/memory/2688-677-0x00007FF6A5700000-0x00007FF6A5AF5000-memory.dmp	xmrig
behavioral2/memory/3572-646-0x00007FF64A440000-0x00007FF64A835000-memory.dmp	xmrig
behavioral2/memory/2864-640-0x00007FF70F480000-0x00007FF70F875000-memory.dmp	xmrig
behavioral2/memory/872-633-0x00007FF629180000-0x00007FF629575000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e9-164.dat	xmrig
behavioral2/files/0x00070000000234e8-159.dat	xmrig
behavioral2/files/0x00070000000234e7-154.dat	xmrig
behavioral2/files/0x00070000000234e5-144.dat	xmrig
behavioral2/files/0x00070000000234e4-139.dat	xmrig
behavioral2/files/0x00070000000234e2-129.dat	xmrig
behavioral2/files/0x00070000000234e1-124.dat	xmrig
behavioral2/files/0x00070000000234df-114.dat	xmrig
behavioral2/files/0x00070000000234de-109.dat	xmrig
behavioral2/files/0x00070000000234dd-104.dat	xmrig
behavioral2/files/0x00070000000234dc-99.dat	xmrig
behavioral2/files/0x00070000000234da-92.dat	xmrig
behavioral2/files/0x00070000000234d9-84.dat	xmrig
behavioral2/files/0x00070000000234d8-79.dat	xmrig
behavioral2/files/0x00070000000234d7-74.dat	xmrig
behavioral2/files/0x00070000000234d6-69.dat	xmrig
behavioral2/files/0x00070000000234d5-64.dat	xmrig
behavioral2/files/0x00070000000234d4-59.dat	xmrig
behavioral2/files/0x00070000000234d3-54.dat	xmrig
behavioral2/files/0x00070000000234d2-49.dat	xmrig
behavioral2/files/0x00070000000234d1-44.dat	xmrig
behavioral2/files/0x00070000000234d0-42.dat	xmrig
behavioral2/files/0x00070000000234cf-35.dat	xmrig
behavioral2/memory/1516-18-0x00007FF6A4290000-0x00007FF6A4685000-memory.dmp	xmrig
behavioral2/memory/3244-17-0x00007FF7A3610000-0x00007FF7A3A05000-memory.dmp	xmrig
behavioral2/memory/1920-13-0x00007FF68BE50000-0x00007FF68C245000-memory.dmp	xmrig
behavioral2/memory/3104-1864-0x00007FF659A60000-0x00007FF659E55000-memory.dmp	xmrig
behavioral2/memory/1516-1865-0x00007FF6A4290000-0x00007FF6A4685000-memory.dmp	xmrig
behavioral2/memory/1920-1866-0x00007FF68BE50000-0x00007FF68C245000-memory.dmp	xmrig
behavioral2/memory/3244-1867-0x00007FF7A3610000-0x00007FF7A3A05000-memory.dmp	xmrig
behavioral2/memory/1516-1868-0x00007FF6A4290000-0x00007FF6A4685000-memory.dmp	xmrig
behavioral2/memory/3064-1869-0x00007FF683CD0000-0x00007FF6840C5000-memory.dmp	xmrig
behavioral2/memory/4276-1874-0x00007FF6894E0000-0x00007FF6898D5000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1920	OpBqYUX.exe
3244	FYMfWqr.exe
1516	mAULrKY.exe
3064	NlfeTce.exe
3856	WXIoOim.exe
4040	MrWjtjK.exe
228	dsZRbKu.exe
3076	PdFnwdL.exe
1448	pzMLqAU.exe
2592	MvFTWVu.exe
4224	nnCwQGh.exe
4628	dGZNfOh.exe
4276	CZRAvEK.exe
872	AtiLhmt.exe
2864	VreWMQf.exe
3572	DCefvFV.exe
1544	TfgdcmD.exe
5008	VveHPEX.exe
4920	kwQKGFA.exe
2900	CXAbROT.exe
3552	cnOhYGQ.exe
2688	JoZuXPt.exe
2920	JYIspWS.exe
4784	PShdABs.exe
4832	xIpQuus.exe
1728	caKhxUb.exe
536	YeNtiEm.exe
1012	eYGuzzG.exe
4608	CAgEfAK.exe
644	rarYaHf.exe
2236	IrFKpEz.exe
560	TGFzSXu.exe
1336	cayGDFG.exe
820	AMzmlRZ.exe
1984	klJbRnm.exe
3772	pXuIdYT.exe
4400	iptbQne.exe
668	tOZeIUb.exe
1560	HGGyxKN.exe
5076	aePeddT.exe
2092	weWBlVg.exe
5104	kqxjOXW.exe
2972	dplJyvH.exe
1360	SHroseR.exe
4500	qeZDmwm.exe
4988	VtokSOT.exe
3352	XcrYAhZ.exe
3580	McsMxyq.exe
3976	aYYgJnr.exe
752	eqyvwSc.exe
548	UOLZqqf.exe
2988	XzyBJrW.exe
5048	DopBSal.exe
520	ADWJULj.exe
696	mzeSPZI.exe
216	gjwxHow.exe
3652	NSPcXRF.exe
3364	JMsNPgw.exe
2536	XmKtiaU.exe
3824	gkjrORL.exe
2260	DFCrQmS.exe
3092	HDyBmrl.exe
628	OVUkPxC.exe
1708	ijZrknA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3104-0-0x00007FF659A60000-0x00007FF659E55000-memory.dmp	upx
behavioral2/files/0x0009000000023470-4.dat	upx
behavioral2/files/0x00090000000234bb-9.dat	upx
behavioral2/files/0x00070000000234cc-10.dat	upx
behavioral2/files/0x00070000000234cd-24.dat	upx
behavioral2/files/0x00070000000234ce-27.dat	upx
behavioral2/files/0x00070000000234db-94.dat	upx
behavioral2/files/0x00070000000234e0-119.dat	upx
behavioral2/files/0x00070000000234e3-131.dat	upx
behavioral2/files/0x00070000000234e6-147.dat	upx
behavioral2/memory/3064-623-0x00007FF683CD0000-0x00007FF6840C5000-memory.dmp	upx
behavioral2/memory/3856-624-0x00007FF62E280000-0x00007FF62E675000-memory.dmp	upx
behavioral2/memory/4040-625-0x00007FF7D18A0000-0x00007FF7D1C95000-memory.dmp	upx
behavioral2/memory/228-626-0x00007FF6C3FD0000-0x00007FF6C43C5000-memory.dmp	upx
behavioral2/memory/3076-627-0x00007FF7E2AB0000-0x00007FF7E2EA5000-memory.dmp	upx
behavioral2/memory/1448-628-0x00007FF7CD310000-0x00007FF7CD705000-memory.dmp	upx
behavioral2/memory/2592-629-0x00007FF70CE10000-0x00007FF70D205000-memory.dmp	upx
behavioral2/memory/4224-630-0x00007FF689DD0000-0x00007FF68A1C5000-memory.dmp	upx
behavioral2/memory/4628-631-0x00007FF6485A0000-0x00007FF648995000-memory.dmp	upx
behavioral2/memory/4276-632-0x00007FF6894E0000-0x00007FF6898D5000-memory.dmp	upx
behavioral2/memory/1544-653-0x00007FF76C4E0000-0x00007FF76C8D5000-memory.dmp	upx
behavioral2/memory/5008-663-0x00007FF693320000-0x00007FF693715000-memory.dmp	upx
behavioral2/memory/3552-671-0x00007FF61E6B0000-0x00007FF61EAA5000-memory.dmp	upx
behavioral2/memory/2900-669-0x00007FF7ED360000-0x00007FF7ED755000-memory.dmp	upx
behavioral2/memory/4920-666-0x00007FF70D6B0000-0x00007FF70DAA5000-memory.dmp	upx
behavioral2/memory/2920-682-0x00007FF78BE20000-0x00007FF78C215000-memory.dmp	upx
behavioral2/memory/4784-685-0x00007FF678E30000-0x00007FF679225000-memory.dmp	upx
behavioral2/memory/2688-677-0x00007FF6A5700000-0x00007FF6A5AF5000-memory.dmp	upx
behavioral2/memory/3572-646-0x00007FF64A440000-0x00007FF64A835000-memory.dmp	upx
behavioral2/memory/2864-640-0x00007FF70F480000-0x00007FF70F875000-memory.dmp	upx
behavioral2/memory/872-633-0x00007FF629180000-0x00007FF629575000-memory.dmp	upx
behavioral2/files/0x00070000000234e9-164.dat	upx
behavioral2/files/0x00070000000234e8-159.dat	upx
behavioral2/files/0x00070000000234e7-154.dat	upx
behavioral2/files/0x00070000000234e5-144.dat	upx
behavioral2/files/0x00070000000234e4-139.dat	upx
behavioral2/files/0x00070000000234e2-129.dat	upx
behavioral2/files/0x00070000000234e1-124.dat	upx
behavioral2/files/0x00070000000234df-114.dat	upx
behavioral2/files/0x00070000000234de-109.dat	upx
behavioral2/files/0x00070000000234dd-104.dat	upx
behavioral2/files/0x00070000000234dc-99.dat	upx
behavioral2/files/0x00070000000234da-92.dat	upx
behavioral2/files/0x00070000000234d9-84.dat	upx
behavioral2/files/0x00070000000234d8-79.dat	upx
behavioral2/files/0x00070000000234d7-74.dat	upx
behavioral2/files/0x00070000000234d6-69.dat	upx
behavioral2/files/0x00070000000234d5-64.dat	upx
behavioral2/files/0x00070000000234d4-59.dat	upx
behavioral2/files/0x00070000000234d3-54.dat	upx
behavioral2/files/0x00070000000234d2-49.dat	upx
behavioral2/files/0x00070000000234d1-44.dat	upx
behavioral2/files/0x00070000000234d0-42.dat	upx
behavioral2/files/0x00070000000234cf-35.dat	upx
behavioral2/memory/1516-18-0x00007FF6A4290000-0x00007FF6A4685000-memory.dmp	upx
behavioral2/memory/3244-17-0x00007FF7A3610000-0x00007FF7A3A05000-memory.dmp	upx
behavioral2/memory/1920-13-0x00007FF68BE50000-0x00007FF68C245000-memory.dmp	upx
behavioral2/memory/3104-1864-0x00007FF659A60000-0x00007FF659E55000-memory.dmp	upx
behavioral2/memory/1516-1865-0x00007FF6A4290000-0x00007FF6A4685000-memory.dmp	upx
behavioral2/memory/1920-1866-0x00007FF68BE50000-0x00007FF68C245000-memory.dmp	upx
behavioral2/memory/3244-1867-0x00007FF7A3610000-0x00007FF7A3A05000-memory.dmp	upx
behavioral2/memory/1516-1868-0x00007FF6A4290000-0x00007FF6A4685000-memory.dmp	upx
behavioral2/memory/3064-1869-0x00007FF683CD0000-0x00007FF6840C5000-memory.dmp	upx
behavioral2/memory/4276-1874-0x00007FF6894E0000-0x00007FF6898D5000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\gjwxHow.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\JWUgBup.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\VwFLHxw.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\wPVtRjS.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\pSRmyuN.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\ktfHITe.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\pixFZxN.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\mfyCpjE.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\CAgEfAK.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\izboGjm.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\BWPBfgh.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\FdKoIdS.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\CkEyHei.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\GomIycq.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\hGDLKGa.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\FtFPBed.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\ScWTnrJ.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\WEIgyzZ.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\XVzHENM.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\RbrqwEL.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\CZRAvEK.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\Vgebkuw.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\uEbDMXv.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\XbwfAau.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\lfvCzOO.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\UOLZqqf.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\DvUPKcX.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\zwdFdKY.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\KUbqCmW.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\rarYaHf.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\SyCmedz.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\AZgAmdW.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\KpTkKVH.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\ceIghoV.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\xOhWwar.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\EYeVOiW.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\YXDTmOE.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\gThACCG.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\pzMLqAU.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\YeNtiEm.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\coZbsyx.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\VlWGhqa.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\WXIoOim.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\OIDmWnr.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\spTIpLv.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\PdFnwdL.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\XIAAntG.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\GmllYoy.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\zKtVIQh.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\zSrkxtN.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\ZRVhcZH.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\PbWTnfk.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\JLtPybi.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\sjNVvGm.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\CMfLlSz.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\qpbGWza.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\qIkEhWM.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\qOBgUSv.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\XcmPhKr.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\DCefvFV.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\kzckcvL.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\gKUIBrJ.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\kqxjOXW.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
File created	C:\Windows\System32\IEcYuVD.exe	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 1920	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	85
PID 3104 wrote to memory of 1920	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	85
PID 3104 wrote to memory of 3244	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	86
PID 3104 wrote to memory of 3244	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	86
PID 3104 wrote to memory of 1516	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	87
PID 3104 wrote to memory of 1516	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	87
PID 3104 wrote to memory of 3064	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	88
PID 3104 wrote to memory of 3064	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	88
PID 3104 wrote to memory of 3856	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	89
PID 3104 wrote to memory of 3856	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	89
PID 3104 wrote to memory of 4040	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	90
PID 3104 wrote to memory of 4040	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	90
PID 3104 wrote to memory of 228	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	91
PID 3104 wrote to memory of 228	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	91
PID 3104 wrote to memory of 3076	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	92
PID 3104 wrote to memory of 3076	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	92
PID 3104 wrote to memory of 1448	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	93
PID 3104 wrote to memory of 1448	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	93
PID 3104 wrote to memory of 2592	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	94
PID 3104 wrote to memory of 2592	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	94
PID 3104 wrote to memory of 4224	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	95
PID 3104 wrote to memory of 4224	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	95
PID 3104 wrote to memory of 4628	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	96
PID 3104 wrote to memory of 4628	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	96
PID 3104 wrote to memory of 4276	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	97
PID 3104 wrote to memory of 4276	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	97
PID 3104 wrote to memory of 872	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	98
PID 3104 wrote to memory of 872	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	98
PID 3104 wrote to memory of 2864	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	99
PID 3104 wrote to memory of 2864	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	99
PID 3104 wrote to memory of 3572	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	100
PID 3104 wrote to memory of 3572	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	100
PID 3104 wrote to memory of 1544	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	101
PID 3104 wrote to memory of 1544	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	101
PID 3104 wrote to memory of 5008	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	102
PID 3104 wrote to memory of 5008	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	102
PID 3104 wrote to memory of 4920	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	103
PID 3104 wrote to memory of 4920	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	103
PID 3104 wrote to memory of 2900	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	104
PID 3104 wrote to memory of 2900	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	104
PID 3104 wrote to memory of 3552	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	105
PID 3104 wrote to memory of 3552	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	105
PID 3104 wrote to memory of 2688	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	106
PID 3104 wrote to memory of 2688	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	106
PID 3104 wrote to memory of 2920	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	107
PID 3104 wrote to memory of 2920	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	107
PID 3104 wrote to memory of 4784	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	108
PID 3104 wrote to memory of 4784	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	108
PID 3104 wrote to memory of 4832	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	109
PID 3104 wrote to memory of 4832	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	109
PID 3104 wrote to memory of 1728	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	110
PID 3104 wrote to memory of 1728	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	110
PID 3104 wrote to memory of 536	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	111
PID 3104 wrote to memory of 536	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	111
PID 3104 wrote to memory of 1012	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	112
PID 3104 wrote to memory of 1012	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	112
PID 3104 wrote to memory of 4608	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	113
PID 3104 wrote to memory of 4608	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	113
PID 3104 wrote to memory of 644	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	114
PID 3104 wrote to memory of 644	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	114
PID 3104 wrote to memory of 2236	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	115
PID 3104 wrote to memory of 2236	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	115
PID 3104 wrote to memory of 560	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	116
PID 3104 wrote to memory of 560	3104	6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe	116

C:\Users\Admin\AppData\Local\Temp\6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe
"C:\Users\Admin\AppData\Local\Temp\6d9a4387a908c888733bfbf6c5f4f0d36bf953db5a70f7b7f8380ac6227eaed8.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\System32\OpBqYUX.exe
  C:\Windows\System32\OpBqYUX.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System32\FYMfWqr.exe
  C:\Windows\System32\FYMfWqr.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System32\mAULrKY.exe
  C:\Windows\System32\mAULrKY.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System32\NlfeTce.exe
  C:\Windows\System32\NlfeTce.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System32\WXIoOim.exe
  C:\Windows\System32\WXIoOim.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System32\MrWjtjK.exe
  C:\Windows\System32\MrWjtjK.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System32\dsZRbKu.exe
  C:\Windows\System32\dsZRbKu.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System32\PdFnwdL.exe
  C:\Windows\System32\PdFnwdL.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System32\pzMLqAU.exe
  C:\Windows\System32\pzMLqAU.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System32\MvFTWVu.exe
  C:\Windows\System32\MvFTWVu.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System32\nnCwQGh.exe
  C:\Windows\System32\nnCwQGh.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System32\dGZNfOh.exe
  C:\Windows\System32\dGZNfOh.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System32\CZRAvEK.exe
  C:\Windows\System32\CZRAvEK.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System32\AtiLhmt.exe
  C:\Windows\System32\AtiLhmt.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System32\VreWMQf.exe
  C:\Windows\System32\VreWMQf.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System32\DCefvFV.exe
  C:\Windows\System32\DCefvFV.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System32\TfgdcmD.exe
  C:\Windows\System32\TfgdcmD.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System32\VveHPEX.exe
  C:\Windows\System32\VveHPEX.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System32\kwQKGFA.exe
  C:\Windows\System32\kwQKGFA.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System32\CXAbROT.exe
  C:\Windows\System32\CXAbROT.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System32\cnOhYGQ.exe
  C:\Windows\System32\cnOhYGQ.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System32\JoZuXPt.exe
  C:\Windows\System32\JoZuXPt.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System32\JYIspWS.exe
  C:\Windows\System32\JYIspWS.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System32\PShdABs.exe
  C:\Windows\System32\PShdABs.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System32\xIpQuus.exe
  C:\Windows\System32\xIpQuus.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System32\caKhxUb.exe
  C:\Windows\System32\caKhxUb.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System32\YeNtiEm.exe
  C:\Windows\System32\YeNtiEm.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System32\eYGuzzG.exe
  C:\Windows\System32\eYGuzzG.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System32\CAgEfAK.exe
  C:\Windows\System32\CAgEfAK.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System32\rarYaHf.exe
  C:\Windows\System32\rarYaHf.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System32\IrFKpEz.exe
  C:\Windows\System32\IrFKpEz.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System32\TGFzSXu.exe
  C:\Windows\System32\TGFzSXu.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System32\cayGDFG.exe
  C:\Windows\System32\cayGDFG.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System32\AMzmlRZ.exe
  C:\Windows\System32\AMzmlRZ.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System32\klJbRnm.exe
  C:\Windows\System32\klJbRnm.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System32\pXuIdYT.exe
  C:\Windows\System32\pXuIdYT.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System32\iptbQne.exe
  C:\Windows\System32\iptbQne.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System32\tOZeIUb.exe
  C:\Windows\System32\tOZeIUb.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System32\HGGyxKN.exe
  C:\Windows\System32\HGGyxKN.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System32\aePeddT.exe
  C:\Windows\System32\aePeddT.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System32\weWBlVg.exe
  C:\Windows\System32\weWBlVg.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System32\kqxjOXW.exe
  C:\Windows\System32\kqxjOXW.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System32\dplJyvH.exe
  C:\Windows\System32\dplJyvH.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System32\SHroseR.exe
  C:\Windows\System32\SHroseR.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System32\qeZDmwm.exe
  C:\Windows\System32\qeZDmwm.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System32\VtokSOT.exe
  C:\Windows\System32\VtokSOT.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System32\XcrYAhZ.exe
  C:\Windows\System32\XcrYAhZ.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System32\McsMxyq.exe
  C:\Windows\System32\McsMxyq.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System32\aYYgJnr.exe
  C:\Windows\System32\aYYgJnr.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System32\eqyvwSc.exe
  C:\Windows\System32\eqyvwSc.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System32\UOLZqqf.exe
  C:\Windows\System32\UOLZqqf.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System32\XzyBJrW.exe
  C:\Windows\System32\XzyBJrW.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System32\DopBSal.exe
  C:\Windows\System32\DopBSal.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System32\ADWJULj.exe
  C:\Windows\System32\ADWJULj.exe
  2⤵
  - Executes dropped EXE
  PID:520
- C:\Windows\System32\mzeSPZI.exe
  C:\Windows\System32\mzeSPZI.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System32\gjwxHow.exe
  C:\Windows\System32\gjwxHow.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System32\NSPcXRF.exe
  C:\Windows\System32\NSPcXRF.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System32\JMsNPgw.exe
  C:\Windows\System32\JMsNPgw.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System32\XmKtiaU.exe
  C:\Windows\System32\XmKtiaU.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System32\gkjrORL.exe
  C:\Windows\System32\gkjrORL.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System32\DFCrQmS.exe
  C:\Windows\System32\DFCrQmS.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System32\HDyBmrl.exe
  C:\Windows\System32\HDyBmrl.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System32\OVUkPxC.exe
  C:\Windows\System32\OVUkPxC.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System32\ijZrknA.exe
  C:\Windows\System32\ijZrknA.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System32\gxxdXnh.exe
  C:\Windows\System32\gxxdXnh.exe
  2⤵
  PID:4680
- C:\Windows\System32\EslEpbH.exe
  C:\Windows\System32\EslEpbH.exe
  2⤵
  PID:1612
- C:\Windows\System32\WfaWnrQ.exe
  C:\Windows\System32\WfaWnrQ.exe
  2⤵
  PID:2724
- C:\Windows\System32\ryXSWIP.exe
  C:\Windows\System32\ryXSWIP.exe
  2⤵
  PID:4568
- C:\Windows\System32\IDocyCh.exe
  C:\Windows\System32\IDocyCh.exe
  2⤵
  PID:3564
- C:\Windows\System32\WWalnpq.exe
  C:\Windows\System32\WWalnpq.exe
  2⤵
  PID:2488
- C:\Windows\System32\foJfShu.exe
  C:\Windows\System32\foJfShu.exe
  2⤵
  PID:4316
- C:\Windows\System32\sZPuBuC.exe
  C:\Windows\System32\sZPuBuC.exe
  2⤵
  PID:328
- C:\Windows\System32\vQpEqnh.exe
  C:\Windows\System32\vQpEqnh.exe
  2⤵
  PID:4116
- C:\Windows\System32\IflHPNr.exe
  C:\Windows\System32\IflHPNr.exe
  2⤵
  PID:2548
- C:\Windows\System32\lWkPzJU.exe
  C:\Windows\System32\lWkPzJU.exe
  2⤵
  PID:2296
- C:\Windows\System32\ycnWkKn.exe
  C:\Windows\System32\ycnWkKn.exe
  2⤵
  PID:3340
- C:\Windows\System32\OrkfdqO.exe
  C:\Windows\System32\OrkfdqO.exe
  2⤵
  PID:1712
- C:\Windows\System32\ykqDUDq.exe
  C:\Windows\System32\ykqDUDq.exe
  2⤵
  PID:5140
- C:\Windows\System32\SWYsipE.exe
  C:\Windows\System32\SWYsipE.exe
  2⤵
  PID:5168
- C:\Windows\System32\dQWHdXI.exe
  C:\Windows\System32\dQWHdXI.exe
  2⤵
  PID:5196
- C:\Windows\System32\JRMtgSp.exe
  C:\Windows\System32\JRMtgSp.exe
  2⤵
  PID:5224
- C:\Windows\System32\Qozccgs.exe
  C:\Windows\System32\Qozccgs.exe
  2⤵
  PID:5252
- C:\Windows\System32\mqjHBAj.exe
  C:\Windows\System32\mqjHBAj.exe
  2⤵
  PID:5280
- C:\Windows\System32\SyCmedz.exe
  C:\Windows\System32\SyCmedz.exe
  2⤵
  PID:5308
- C:\Windows\System32\mzFINZa.exe
  C:\Windows\System32\mzFINZa.exe
  2⤵
  PID:5336
- C:\Windows\System32\jGYBmGd.exe
  C:\Windows\System32\jGYBmGd.exe
  2⤵
  PID:5364
- C:\Windows\System32\QEQkquH.exe
  C:\Windows\System32\QEQkquH.exe
  2⤵
  PID:5392
- C:\Windows\System32\dcDvyaA.exe
  C:\Windows\System32\dcDvyaA.exe
  2⤵
  PID:5416
- C:\Windows\System32\JQznMoh.exe
  C:\Windows\System32\JQznMoh.exe
  2⤵
  PID:5444
- C:\Windows\System32\StnWpxD.exe
  C:\Windows\System32\StnWpxD.exe
  2⤵
  PID:5472
- C:\Windows\System32\MTgFXAi.exe
  C:\Windows\System32\MTgFXAi.exe
  2⤵
  PID:5504
- C:\Windows\System32\AndhmRt.exe
  C:\Windows\System32\AndhmRt.exe
  2⤵
  PID:5532
- C:\Windows\System32\mAkqXiz.exe
  C:\Windows\System32\mAkqXiz.exe
  2⤵
  PID:5560
- C:\Windows\System32\qpbGWza.exe
  C:\Windows\System32\qpbGWza.exe
  2⤵
  PID:5588
- C:\Windows\System32\JoSKJio.exe
  C:\Windows\System32\JoSKJio.exe
  2⤵
  PID:5616
- C:\Windows\System32\YEcpdsR.exe
  C:\Windows\System32\YEcpdsR.exe
  2⤵
  PID:5644
- C:\Windows\System32\AZgAmdW.exe
  C:\Windows\System32\AZgAmdW.exe
  2⤵
  PID:5672
- C:\Windows\System32\DAykmrt.exe
  C:\Windows\System32\DAykmrt.exe
  2⤵
  PID:5700
- C:\Windows\System32\nIhUOFa.exe
  C:\Windows\System32\nIhUOFa.exe
  2⤵
  PID:5728
- C:\Windows\System32\ZUfIPBC.exe
  C:\Windows\System32\ZUfIPBC.exe
  2⤵
  PID:5756
- C:\Windows\System32\lPhbTKm.exe
  C:\Windows\System32\lPhbTKm.exe
  2⤵
  PID:5784
- C:\Windows\System32\NVOwGSx.exe
  C:\Windows\System32\NVOwGSx.exe
  2⤵
  PID:5812
- C:\Windows\System32\JLtPybi.exe
  C:\Windows\System32\JLtPybi.exe
  2⤵
  PID:5840
- C:\Windows\System32\jrrGLkm.exe
  C:\Windows\System32\jrrGLkm.exe
  2⤵
  PID:5868
- C:\Windows\System32\XQHfPrx.exe
  C:\Windows\System32\XQHfPrx.exe
  2⤵
  PID:5896
- C:\Windows\System32\pSRmyuN.exe
  C:\Windows\System32\pSRmyuN.exe
  2⤵
  PID:5920
- C:\Windows\System32\IacaniQ.exe
  C:\Windows\System32\IacaniQ.exe
  2⤵
  PID:5952
- C:\Windows\System32\DbpobJH.exe
  C:\Windows\System32\DbpobJH.exe
  2⤵
  PID:5980
- C:\Windows\System32\RNyWxTS.exe
  C:\Windows\System32\RNyWxTS.exe
  2⤵
  PID:6008
- C:\Windows\System32\TGvCSZl.exe
  C:\Windows\System32\TGvCSZl.exe
  2⤵
  PID:6032
- C:\Windows\System32\CXSLiyo.exe
  C:\Windows\System32\CXSLiyo.exe
  2⤵
  PID:6072
- C:\Windows\System32\zdAfOsP.exe
  C:\Windows\System32\zdAfOsP.exe
  2⤵
  PID:6092
- C:\Windows\System32\LeqYFMz.exe
  C:\Windows\System32\LeqYFMz.exe
  2⤵
  PID:6124
- C:\Windows\System32\RINgSUB.exe
  C:\Windows\System32\RINgSUB.exe
  2⤵
  PID:920
- C:\Windows\System32\uZJTuux.exe
  C:\Windows\System32\uZJTuux.exe
  2⤵
  PID:4064
- C:\Windows\System32\WttoCHk.exe
  C:\Windows\System32\WttoCHk.exe
  2⤵
  PID:4396
- C:\Windows\System32\GfNfxoB.exe
  C:\Windows\System32\GfNfxoB.exe
  2⤵
  PID:1940
- C:\Windows\System32\IJHsKzN.exe
  C:\Windows\System32\IJHsKzN.exe
  2⤵
  PID:1860
- C:\Windows\System32\GomIycq.exe
  C:\Windows\System32\GomIycq.exe
  2⤵
  PID:5124
- C:\Windows\System32\yRkoWSn.exe
  C:\Windows\System32\yRkoWSn.exe
  2⤵
  PID:5180
- C:\Windows\System32\GwoFjyb.exe
  C:\Windows\System32\GwoFjyb.exe
  2⤵
  PID:5260
- C:\Windows\System32\tRhRtUM.exe
  C:\Windows\System32\tRhRtUM.exe
  2⤵
  PID:5316
- C:\Windows\System32\BqpzuCJ.exe
  C:\Windows\System32\BqpzuCJ.exe
  2⤵
  PID:5384
- C:\Windows\System32\nwJlXyu.exe
  C:\Windows\System32\nwJlXyu.exe
  2⤵
  PID:5452
- C:\Windows\System32\LRHuYeW.exe
  C:\Windows\System32\LRHuYeW.exe
  2⤵
  PID:5516
- C:\Windows\System32\TQmdIZF.exe
  C:\Windows\System32\TQmdIZF.exe
  2⤵
  PID:5572
- C:\Windows\System32\aKrgSna.exe
  C:\Windows\System32\aKrgSna.exe
  2⤵
  PID:5652
- C:\Windows\System32\WwhtVfV.exe
  C:\Windows\System32\WwhtVfV.exe
  2⤵
  PID:5720
- C:\Windows\System32\gPxTmvH.exe
  C:\Windows\System32\gPxTmvH.exe
  2⤵
  PID:5764
- C:\Windows\System32\KpaOrCq.exe
  C:\Windows\System32\KpaOrCq.exe
  2⤵
  PID:5820
- C:\Windows\System32\kzckcvL.exe
  C:\Windows\System32\kzckcvL.exe
  2⤵
  PID:5904
- C:\Windows\System32\bjmqEOl.exe
  C:\Windows\System32\bjmqEOl.exe
  2⤵
  PID:5972
- C:\Windows\System32\xjwXINu.exe
  C:\Windows\System32\xjwXINu.exe
  2⤵
  PID:6028
- C:\Windows\System32\dJlAEML.exe
  C:\Windows\System32\dJlAEML.exe
  2⤵
  PID:6112
- C:\Windows\System32\yDXuBof.exe
  C:\Windows\System32\yDXuBof.exe
  2⤵
  PID:4520
- C:\Windows\System32\hqZLLyT.exe
  C:\Windows\System32\hqZLLyT.exe
  2⤵
  PID:3300
- C:\Windows\System32\MPJwmUG.exe
  C:\Windows\System32\MPJwmUG.exe
  2⤵
  PID:5152
- C:\Windows\System32\ndlZyUf.exe
  C:\Windows\System32\ndlZyUf.exe
  2⤵
  PID:5292
- C:\Windows\System32\LSarjZC.exe
  C:\Windows\System32\LSarjZC.exe
  2⤵
  PID:5412
- C:\Windows\System32\gKUIBrJ.exe
  C:\Windows\System32\gKUIBrJ.exe
  2⤵
  PID:5544
- C:\Windows\System32\NbQkxrF.exe
  C:\Windows\System32\NbQkxrF.exe
  2⤵
  PID:5776
- C:\Windows\System32\NewGxFp.exe
  C:\Windows\System32\NewGxFp.exe
  2⤵
  PID:5888
- C:\Windows\System32\coZbsyx.exe
  C:\Windows\System32\coZbsyx.exe
  2⤵
  PID:6020
- C:\Windows\System32\PfGpoQq.exe
  C:\Windows\System32\PfGpoQq.exe
  2⤵
  PID:2960
- C:\Windows\System32\leTMvMf.exe
  C:\Windows\System32\leTMvMf.exe
  2⤵
  PID:5236
- C:\Windows\System32\DrlKqYL.exe
  C:\Windows\System32\DrlKqYL.exe
  2⤵
  PID:5468
- C:\Windows\System32\MacayqF.exe
  C:\Windows\System32\MacayqF.exe
  2⤵
  PID:5792
- C:\Windows\System32\cgGNDij.exe
  C:\Windows\System32\cgGNDij.exe
  2⤵
  PID:6164
- C:\Windows\System32\LgVCHzr.exe
  C:\Windows\System32\LgVCHzr.exe
  2⤵
  PID:6196
- C:\Windows\System32\DDPtoOa.exe
  C:\Windows\System32\DDPtoOa.exe
  2⤵
  PID:6236
- C:\Windows\System32\luXJXEd.exe
  C:\Windows\System32\luXJXEd.exe
  2⤵
  PID:6252
- C:\Windows\System32\PCJsKNW.exe
  C:\Windows\System32\PCJsKNW.exe
  2⤵
  PID:6276
- C:\Windows\System32\OIDmWnr.exe
  C:\Windows\System32\OIDmWnr.exe
  2⤵
  PID:6308
- C:\Windows\System32\XpJJqds.exe
  C:\Windows\System32\XpJJqds.exe
  2⤵
  PID:6336
- C:\Windows\System32\XJLWyUt.exe
  C:\Windows\System32\XJLWyUt.exe
  2⤵
  PID:6364
- C:\Windows\System32\XUipJIw.exe
  C:\Windows\System32\XUipJIw.exe
  2⤵
  PID:6392
- C:\Windows\System32\SZMDUHn.exe
  C:\Windows\System32\SZMDUHn.exe
  2⤵
  PID:6416
- C:\Windows\System32\izboGjm.exe
  C:\Windows\System32\izboGjm.exe
  2⤵
  PID:6448
- C:\Windows\System32\fNSSINi.exe
  C:\Windows\System32\fNSSINi.exe
  2⤵
  PID:6476
- C:\Windows\System32\mfUagkj.exe
  C:\Windows\System32\mfUagkj.exe
  2⤵
  PID:6500
- C:\Windows\System32\yzQnRSa.exe
  C:\Windows\System32\yzQnRSa.exe
  2⤵
  PID:6532
- C:\Windows\System32\cCqsMQn.exe
  C:\Windows\System32\cCqsMQn.exe
  2⤵
  PID:6560
- C:\Windows\System32\uJSGQDk.exe
  C:\Windows\System32\uJSGQDk.exe
  2⤵
  PID:6588
- C:\Windows\System32\spTIpLv.exe
  C:\Windows\System32\spTIpLv.exe
  2⤵
  PID:6616
- C:\Windows\System32\QCmdslx.exe
  C:\Windows\System32\QCmdslx.exe
  2⤵
  PID:6644
- C:\Windows\System32\jSePvpM.exe
  C:\Windows\System32\jSePvpM.exe
  2⤵
  PID:6668
- C:\Windows\System32\FvKbXoH.exe
  C:\Windows\System32\FvKbXoH.exe
  2⤵
  PID:6700
- C:\Windows\System32\IEcYuVD.exe
  C:\Windows\System32\IEcYuVD.exe
  2⤵
  PID:6728
- C:\Windows\System32\VlWGhqa.exe
  C:\Windows\System32\VlWGhqa.exe
  2⤵
  PID:6756
- C:\Windows\System32\qGCcPFC.exe
  C:\Windows\System32\qGCcPFC.exe
  2⤵
  PID:6780
- C:\Windows\System32\kBfOzly.exe
  C:\Windows\System32\kBfOzly.exe
  2⤵
  PID:6812
- C:\Windows\System32\eGZjeNR.exe
  C:\Windows\System32\eGZjeNR.exe
  2⤵
  PID:6836
- C:\Windows\System32\QBsgKOw.exe
  C:\Windows\System32\QBsgKOw.exe
  2⤵
  PID:6868
- C:\Windows\System32\fBhctOg.exe
  C:\Windows\System32\fBhctOg.exe
  2⤵
  PID:6892
- C:\Windows\System32\bMYtwNk.exe
  C:\Windows\System32\bMYtwNk.exe
  2⤵
  PID:6924
- C:\Windows\System32\fyRwkUO.exe
  C:\Windows\System32\fyRwkUO.exe
  2⤵
  PID:6952
- C:\Windows\System32\xiyzYGM.exe
  C:\Windows\System32\xiyzYGM.exe
  2⤵
  PID:6980
- C:\Windows\System32\cQhUVYY.exe
  C:\Windows\System32\cQhUVYY.exe
  2⤵
  PID:7016
- C:\Windows\System32\cxwfoqe.exe
  C:\Windows\System32\cxwfoqe.exe
  2⤵
  PID:7036
- C:\Windows\System32\HeHLPsW.exe
  C:\Windows\System32\HeHLPsW.exe
  2⤵
  PID:7060
- C:\Windows\System32\pehgadr.exe
  C:\Windows\System32\pehgadr.exe
  2⤵
  PID:7092
- C:\Windows\System32\nJTgkMM.exe
  C:\Windows\System32\nJTgkMM.exe
  2⤵
  PID:7128
- C:\Windows\System32\wcYLNMs.exe
  C:\Windows\System32\wcYLNMs.exe
  2⤵
  PID:7148
- C:\Windows\System32\EgBmPTd.exe
  C:\Windows\System32\EgBmPTd.exe
  2⤵
  PID:6088
- C:\Windows\System32\VFoCnnt.exe
  C:\Windows\System32\VFoCnnt.exe
  2⤵
  PID:1748
- C:\Windows\System32\UsDvtkH.exe
  C:\Windows\System32\UsDvtkH.exe
  2⤵
  PID:6148
- C:\Windows\System32\SCWAnyC.exe
  C:\Windows\System32\SCWAnyC.exe
  2⤵
  PID:6424
- C:\Windows\System32\vPOOgMq.exe
  C:\Windows\System32\vPOOgMq.exe
  2⤵
  PID:6496
- C:\Windows\System32\vGesGsp.exe
  C:\Windows\System32\vGesGsp.exe
  2⤵
  PID:6524
- C:\Windows\System32\svtZedd.exe
  C:\Windows\System32\svtZedd.exe
  2⤵
  PID:6572
- C:\Windows\System32\oOxINPh.exe
  C:\Windows\System32\oOxINPh.exe
  2⤵
  PID:6628
- C:\Windows\System32\JqJwLLA.exe
  C:\Windows\System32\JqJwLLA.exe
  2⤵
  PID:1260
- C:\Windows\System32\VJzKsAx.exe
  C:\Windows\System32\VJzKsAx.exe
  2⤵
  PID:6712
- C:\Windows\System32\XYpLqBY.exe
  C:\Windows\System32\XYpLqBY.exe
  2⤵
  PID:4216
- C:\Windows\System32\vILMAOU.exe
  C:\Windows\System32\vILMAOU.exe
  2⤵
  PID:6900
- C:\Windows\System32\QEbiGUb.exe
  C:\Windows\System32\QEbiGUb.exe
  2⤵
  PID:6944
- C:\Windows\System32\aNeILXq.exe
  C:\Windows\System32\aNeILXq.exe
  2⤵
  PID:1628
- C:\Windows\System32\BODDlEQ.exe
  C:\Windows\System32\BODDlEQ.exe
  2⤵
  PID:7032
- C:\Windows\System32\bFLUEsE.exe
  C:\Windows\System32\bFLUEsE.exe
  2⤵
  PID:2664
- C:\Windows\System32\lFseQRr.exe
  C:\Windows\System32\lFseQRr.exe
  2⤵
  PID:7156
- C:\Windows\System32\CKjdGmP.exe
  C:\Windows\System32\CKjdGmP.exe
  2⤵
  PID:2604
- C:\Windows\System32\KUbqCmW.exe
  C:\Windows\System32\KUbqCmW.exe
  2⤵
  PID:6216
- C:\Windows\System32\EvFaaLq.exe
  C:\Windows\System32\EvFaaLq.exe
  2⤵
  PID:6484
- C:\Windows\System32\HLrShxg.exe
  C:\Windows\System32\HLrShxg.exe
  2⤵
  PID:2032
- C:\Windows\System32\DvUPKcX.exe
  C:\Windows\System32\DvUPKcX.exe
  2⤵
  PID:1804
- C:\Windows\System32\VwFLHxw.exe
  C:\Windows\System32\VwFLHxw.exe
  2⤵
  PID:1716
- C:\Windows\System32\MxsaSZb.exe
  C:\Windows\System32\MxsaSZb.exe
  2⤵
  PID:4476
- C:\Windows\System32\sDnCmof.exe
  C:\Windows\System32\sDnCmof.exe
  2⤵
  PID:6736
- C:\Windows\System32\XmFUziq.exe
  C:\Windows\System32\XmFUziq.exe
  2⤵
  PID:2876
- C:\Windows\System32\KjPqDKG.exe
  C:\Windows\System32\KjPqDKG.exe
  2⤵
  PID:7048
- C:\Windows\System32\dOJQsWR.exe
  C:\Windows\System32\dOJQsWR.exe
  2⤵
  PID:4460
- C:\Windows\System32\QEhYYYj.exe
  C:\Windows\System32\QEhYYYj.exe
  2⤵
  PID:1532
- C:\Windows\System32\sWtJDsD.exe
  C:\Windows\System32\sWtJDsD.exe
  2⤵
  PID:616
- C:\Windows\System32\kzwVWEb.exe
  C:\Windows\System32\kzwVWEb.exe
  2⤵
  PID:6456
- C:\Windows\System32\joguUuL.exe
  C:\Windows\System32\joguUuL.exe
  2⤵
  PID:6720
- C:\Windows\System32\EZYHsIH.exe
  C:\Windows\System32\EZYHsIH.exe
  2⤵
  PID:6880
- C:\Windows\System32\mSWZDTm.exe
  C:\Windows\System32\mSWZDTm.exe
  2⤵
  PID:7068
- C:\Windows\System32\kGPOZUd.exe
  C:\Windows\System32\kGPOZUd.exe
  2⤵
  PID:6508
- C:\Windows\System32\eNIpGDj.exe
  C:\Windows\System32\eNIpGDj.exe
  2⤵
  PID:6820
- C:\Windows\System32\UkKdvxg.exe
  C:\Windows\System32\UkKdvxg.exe
  2⤵
  PID:7212
- C:\Windows\System32\uLhtjPx.exe
  C:\Windows\System32\uLhtjPx.exe
  2⤵
  PID:7256
- C:\Windows\System32\EwseRpO.exe
  C:\Windows\System32\EwseRpO.exe
  2⤵
  PID:7280
- C:\Windows\System32\TJBSHtQ.exe
  C:\Windows\System32\TJBSHtQ.exe
  2⤵
  PID:7328
- C:\Windows\System32\vAIxmHf.exe
  C:\Windows\System32\vAIxmHf.exe
  2⤵
  PID:7360
- C:\Windows\System32\qUPejXT.exe
  C:\Windows\System32\qUPejXT.exe
  2⤵
  PID:7412
- C:\Windows\System32\yFjhQMU.exe
  C:\Windows\System32\yFjhQMU.exe
  2⤵
  PID:7440
- C:\Windows\System32\YjzPYrR.exe
  C:\Windows\System32\YjzPYrR.exe
  2⤵
  PID:7456
- C:\Windows\System32\swGImmP.exe
  C:\Windows\System32\swGImmP.exe
  2⤵
  PID:7492
- C:\Windows\System32\bfjJybK.exe
  C:\Windows\System32\bfjJybK.exe
  2⤵
  PID:7516
- C:\Windows\System32\XfJSsij.exe
  C:\Windows\System32\XfJSsij.exe
  2⤵
  PID:7556
- C:\Windows\System32\XPeYAHU.exe
  C:\Windows\System32\XPeYAHU.exe
  2⤵
  PID:7572
- C:\Windows\System32\sjNVvGm.exe
  C:\Windows\System32\sjNVvGm.exe
  2⤵
  PID:7624
- C:\Windows\System32\LKgJrOk.exe
  C:\Windows\System32\LKgJrOk.exe
  2⤵
  PID:7668
- C:\Windows\System32\rPrDnXe.exe
  C:\Windows\System32\rPrDnXe.exe
  2⤵
  PID:7708
- C:\Windows\System32\rAuYIWU.exe
  C:\Windows\System32\rAuYIWU.exe
  2⤵
  PID:7736
- C:\Windows\System32\PwLPgJA.exe
  C:\Windows\System32\PwLPgJA.exe
  2⤵
  PID:7764
- C:\Windows\System32\byDNssd.exe
  C:\Windows\System32\byDNssd.exe
  2⤵
  PID:7792
- C:\Windows\System32\YgWGhwT.exe
  C:\Windows\System32\YgWGhwT.exe
  2⤵
  PID:7820
- C:\Windows\System32\WNsQSUo.exe
  C:\Windows\System32\WNsQSUo.exe
  2⤵
  PID:7848
- C:\Windows\System32\elqjkwk.exe
  C:\Windows\System32\elqjkwk.exe
  2⤵
  PID:7876
- C:\Windows\System32\lmpbztZ.exe
  C:\Windows\System32\lmpbztZ.exe
  2⤵
  PID:7908
- C:\Windows\System32\ioaBfMR.exe
  C:\Windows\System32\ioaBfMR.exe
  2⤵
  PID:7940
- C:\Windows\System32\BWPBfgh.exe
  C:\Windows\System32\BWPBfgh.exe
  2⤵
  PID:7968
- C:\Windows\System32\pPbSTmB.exe
  C:\Windows\System32\pPbSTmB.exe
  2⤵
  PID:7996
- C:\Windows\System32\szdyFKo.exe
  C:\Windows\System32\szdyFKo.exe
  2⤵
  PID:8028
- C:\Windows\System32\LlmMemA.exe
  C:\Windows\System32\LlmMemA.exe
  2⤵
  PID:8060
- C:\Windows\System32\PHMNwdb.exe
  C:\Windows\System32\PHMNwdb.exe
  2⤵
  PID:8084
- C:\Windows\System32\dkCiFgV.exe
  C:\Windows\System32\dkCiFgV.exe
  2⤵
  PID:8116
- C:\Windows\System32\BlTrqiM.exe
  C:\Windows\System32\BlTrqiM.exe
  2⤵
  PID:8156
- C:\Windows\System32\OgVOfyx.exe
  C:\Windows\System32\OgVOfyx.exe
  2⤵
  PID:8172
- C:\Windows\System32\PMuuTcV.exe
  C:\Windows\System32\PMuuTcV.exe
  2⤵
  PID:7264
- C:\Windows\System32\RFBAEbC.exe
  C:\Windows\System32\RFBAEbC.exe
  2⤵
  PID:7348
- C:\Windows\System32\WRdTmKr.exe
  C:\Windows\System32\WRdTmKr.exe
  2⤵
  PID:7408
- C:\Windows\System32\XSOijRd.exe
  C:\Windows\System32\XSOijRd.exe
  2⤵
  PID:6460
- C:\Windows\System32\DqpwMby.exe
  C:\Windows\System32\DqpwMby.exe
  2⤵
  PID:7396
- C:\Windows\System32\MhleIxC.exe
  C:\Windows\System32\MhleIxC.exe
  2⤵
  PID:7488
- C:\Windows\System32\TNvdODN.exe
  C:\Windows\System32\TNvdODN.exe
  2⤵
  PID:7472
- C:\Windows\System32\pvMiuzU.exe
  C:\Windows\System32\pvMiuzU.exe
  2⤵
  PID:7632
- C:\Windows\System32\liuNwko.exe
  C:\Windows\System32\liuNwko.exe
  2⤵
  PID:7684
- C:\Windows\System32\DjzSjnO.exe
  C:\Windows\System32\DjzSjnO.exe
  2⤵
  PID:6316
- C:\Windows\System32\rgrLIMF.exe
  C:\Windows\System32\rgrLIMF.exe
  2⤵
  PID:7804
- C:\Windows\System32\cGDJOta.exe
  C:\Windows\System32\cGDJOta.exe
  2⤵
  PID:7868
- C:\Windows\System32\hGDLKGa.exe
  C:\Windows\System32\hGDLKGa.exe
  2⤵
  PID:6328
- C:\Windows\System32\JQvcZjG.exe
  C:\Windows\System32\JQvcZjG.exe
  2⤵
  PID:7980
- C:\Windows\System32\tEEyVhp.exe
  C:\Windows\System32\tEEyVhp.exe
  2⤵
  PID:8036
- C:\Windows\System32\gMwggnn.exe
  C:\Windows\System32\gMwggnn.exe
  2⤵
  PID:8132
- C:\Windows\System32\UJlbVco.exe
  C:\Windows\System32\UJlbVco.exe
  2⤵
  PID:8168
- C:\Windows\System32\kytrBtb.exe
  C:\Windows\System32\kytrBtb.exe
  2⤵
  PID:7276
- C:\Windows\System32\ihtExnz.exe
  C:\Windows\System32\ihtExnz.exe
  2⤵
  PID:7420
- C:\Windows\System32\sAJvkVH.exe
  C:\Windows\System32\sAJvkVH.exe
  2⤵
  PID:2936
- C:\Windows\System32\RJWhANm.exe
  C:\Windows\System32\RJWhANm.exe
  2⤵
  PID:7608
- C:\Windows\System32\REFgYcG.exe
  C:\Windows\System32\REFgYcG.exe
  2⤵
  PID:6932
- C:\Windows\System32\uWZoGGR.exe
  C:\Windows\System32\uWZoGGR.exe
  2⤵
  PID:7840
- C:\Windows\System32\gnyVNIn.exe
  C:\Windows\System32\gnyVNIn.exe
  2⤵
  PID:6608
- C:\Windows\System32\CMfLlSz.exe
  C:\Windows\System32\CMfLlSz.exe
  2⤵
  PID:8068
- C:\Windows\System32\Vgebkuw.exe
  C:\Windows\System32\Vgebkuw.exe
  2⤵
  PID:7244
- C:\Windows\System32\wNWjEwJ.exe
  C:\Windows\System32\wNWjEwJ.exe
  2⤵
  PID:7680
- C:\Windows\System32\HmIRMmd.exe
  C:\Windows\System32\HmIRMmd.exe
  2⤵
  PID:7964
- C:\Windows\System32\DdkyIKG.exe
  C:\Windows\System32\DdkyIKG.exe
  2⤵
  PID:7184
- C:\Windows\System32\lOwDLyy.exe
  C:\Windows\System32\lOwDLyy.exe
  2⤵
  PID:8200
- C:\Windows\System32\foAsIox.exe
  C:\Windows\System32\foAsIox.exe
  2⤵
  PID:8228
- C:\Windows\System32\AcaVdaY.exe
  C:\Windows\System32\AcaVdaY.exe
  2⤵
  PID:8264
- C:\Windows\System32\lttnhNz.exe
  C:\Windows\System32\lttnhNz.exe
  2⤵
  PID:8296
- C:\Windows\System32\qIkEhWM.exe
  C:\Windows\System32\qIkEhWM.exe
  2⤵
  PID:8324
- C:\Windows\System32\VmGmzuO.exe
  C:\Windows\System32\VmGmzuO.exe
  2⤵
  PID:8352
- C:\Windows\System32\wdBcIAu.exe
  C:\Windows\System32\wdBcIAu.exe
  2⤵
  PID:8384
- C:\Windows\System32\VEvyJOf.exe
  C:\Windows\System32\VEvyJOf.exe
  2⤵
  PID:8408
- C:\Windows\System32\wBVFRFm.exe
  C:\Windows\System32\wBVFRFm.exe
  2⤵
  PID:8436
- C:\Windows\System32\oIhoRuZ.exe
  C:\Windows\System32\oIhoRuZ.exe
  2⤵
  PID:8468
- C:\Windows\System32\rZwdNAY.exe
  C:\Windows\System32\rZwdNAY.exe
  2⤵
  PID:8496
- C:\Windows\System32\CixexDU.exe
  C:\Windows\System32\CixexDU.exe
  2⤵
  PID:8532
- C:\Windows\System32\lHfMgiF.exe
  C:\Windows\System32\lHfMgiF.exe
  2⤵
  PID:8552
- C:\Windows\System32\VMWnmwu.exe
  C:\Windows\System32\VMWnmwu.exe
  2⤵
  PID:8580
- C:\Windows\System32\IvnRwET.exe
  C:\Windows\System32\IvnRwET.exe
  2⤵
  PID:8616
- C:\Windows\System32\eKxtwUm.exe
  C:\Windows\System32\eKxtwUm.exe
  2⤵
  PID:8636
- C:\Windows\System32\YXDTmOE.exe
  C:\Windows\System32\YXDTmOE.exe
  2⤵
  PID:8664
- C:\Windows\System32\kZgtIkK.exe
  C:\Windows\System32\kZgtIkK.exe
  2⤵
  PID:8716
- C:\Windows\System32\zKtVIQh.exe
  C:\Windows\System32\zKtVIQh.exe
  2⤵
  PID:8732
- C:\Windows\System32\JFGkevY.exe
  C:\Windows\System32\JFGkevY.exe
  2⤵
  PID:8768
- C:\Windows\System32\NZwbybk.exe
  C:\Windows\System32\NZwbybk.exe
  2⤵
  PID:8804
- C:\Windows\System32\RFTLwBI.exe
  C:\Windows\System32\RFTLwBI.exe
  2⤵
  PID:8828
- C:\Windows\System32\DDpgXUr.exe
  C:\Windows\System32\DDpgXUr.exe
  2⤵
  PID:8856
- C:\Windows\System32\CxkzoYh.exe
  C:\Windows\System32\CxkzoYh.exe
  2⤵
  PID:8892
- C:\Windows\System32\MJcIajt.exe
  C:\Windows\System32\MJcIajt.exe
  2⤵
  PID:8932
- C:\Windows\System32\vherCxT.exe
  C:\Windows\System32\vherCxT.exe
  2⤵
  PID:8960
- C:\Windows\System32\YZLtFTy.exe
  C:\Windows\System32\YZLtFTy.exe
  2⤵
  PID:8988
- C:\Windows\System32\xoPqoBr.exe
  C:\Windows\System32\xoPqoBr.exe
  2⤵
  PID:9032
- C:\Windows\System32\JeOxjtt.exe
  C:\Windows\System32\JeOxjtt.exe
  2⤵
  PID:9072
- C:\Windows\System32\iwfPVKM.exe
  C:\Windows\System32\iwfPVKM.exe
  2⤵
  PID:9116
- C:\Windows\System32\skfkclc.exe
  C:\Windows\System32\skfkclc.exe
  2⤵
  PID:9164
- C:\Windows\System32\vBgIWQq.exe
  C:\Windows\System32\vBgIWQq.exe
  2⤵
  PID:7888
- C:\Windows\System32\aZYoFrY.exe
  C:\Windows\System32\aZYoFrY.exe
  2⤵
  PID:1176
- C:\Windows\System32\rsMsdNo.exe
  C:\Windows\System32\rsMsdNo.exe
  2⤵
  PID:8372
- C:\Windows\System32\lIZVmUx.exe
  C:\Windows\System32\lIZVmUx.exe
  2⤵
  PID:8488
- C:\Windows\System32\XbwfAau.exe
  C:\Windows\System32\XbwfAau.exe
  2⤵
  PID:8600
- C:\Windows\System32\oSreMTX.exe
  C:\Windows\System32\oSreMTX.exe
  2⤵
  PID:8660
- C:\Windows\System32\tZABLjz.exe
  C:\Windows\System32\tZABLjz.exe
  2⤵
  PID:8756
- C:\Windows\System32\rMZWPCa.exe
  C:\Windows\System32\rMZWPCa.exe
  2⤵
  PID:8840
- C:\Windows\System32\LMjYSdP.exe
  C:\Windows\System32\LMjYSdP.exe
  2⤵
  PID:8900
- C:\Windows\System32\WpeyiPO.exe
  C:\Windows\System32\WpeyiPO.exe
  2⤵
  PID:8980
- C:\Windows\System32\zlSMAmZ.exe
  C:\Windows\System32\zlSMAmZ.exe
  2⤵
  PID:9056
- C:\Windows\System32\uEbDMXv.exe
  C:\Windows\System32\uEbDMXv.exe
  2⤵
  PID:9184
- C:\Windows\System32\fOHpjxH.exe
  C:\Windows\System32\fOHpjxH.exe
  2⤵
  PID:8364
- C:\Windows\System32\blNeYoy.exe
  C:\Windows\System32\blNeYoy.exe
  2⤵
  PID:8632
- C:\Windows\System32\TsOtjRi.exe
  C:\Windows\System32\TsOtjRi.exe
  2⤵
  PID:8852
- C:\Windows\System32\IuWcXPk.exe
  C:\Windows\System32\IuWcXPk.exe
  2⤵
  PID:9160
- C:\Windows\System32\uGsSoMZ.exe
  C:\Windows\System32\uGsSoMZ.exe
  2⤵
  PID:8792
- C:\Windows\System32\tdPPpVQ.exe
  C:\Windows\System32\tdPPpVQ.exe
  2⤵
  PID:8288
- C:\Windows\System32\zBYowoM.exe
  C:\Windows\System32\zBYowoM.exe
  2⤵
  PID:8592
- C:\Windows\System32\vxvxkIT.exe
  C:\Windows\System32\vxvxkIT.exe
  2⤵
  PID:9240
- C:\Windows\System32\JoyuDIu.exe
  C:\Windows\System32\JoyuDIu.exe
  2⤵
  PID:9264
- C:\Windows\System32\jZWNJJr.exe
  C:\Windows\System32\jZWNJJr.exe
  2⤵
  PID:9300
- C:\Windows\System32\rwfgeOO.exe
  C:\Windows\System32\rwfgeOO.exe
  2⤵
  PID:9320
- C:\Windows\System32\oIEvUTf.exe
  C:\Windows\System32\oIEvUTf.exe
  2⤵
  PID:9352
- C:\Windows\System32\YIGgJiN.exe
  C:\Windows\System32\YIGgJiN.exe
  2⤵
  PID:9380
- C:\Windows\System32\hbjUpKM.exe
  C:\Windows\System32\hbjUpKM.exe
  2⤵
  PID:9408
- C:\Windows\System32\OkwoIDV.exe
  C:\Windows\System32\OkwoIDV.exe
  2⤵
  PID:9440
- C:\Windows\System32\WZGNAsi.exe
  C:\Windows\System32\WZGNAsi.exe
  2⤵
  PID:9464
- C:\Windows\System32\fGZtGVB.exe
  C:\Windows\System32\fGZtGVB.exe
  2⤵
  PID:9496
- C:\Windows\System32\IYyqUuW.exe
  C:\Windows\System32\IYyqUuW.exe
  2⤵
  PID:9524
- C:\Windows\System32\gVczLze.exe
  C:\Windows\System32\gVczLze.exe
  2⤵
  PID:9552
- C:\Windows\System32\nBjFtiQ.exe
  C:\Windows\System32\nBjFtiQ.exe
  2⤵
  PID:9580
- C:\Windows\System32\ktfHITe.exe
  C:\Windows\System32\ktfHITe.exe
  2⤵
  PID:9608
- C:\Windows\System32\ecgWMbc.exe
  C:\Windows\System32\ecgWMbc.exe
  2⤵
  PID:9636
- C:\Windows\System32\FYpnVad.exe
  C:\Windows\System32\FYpnVad.exe
  2⤵
  PID:9664
- C:\Windows\System32\EABevkW.exe
  C:\Windows\System32\EABevkW.exe
  2⤵
  PID:9680
- C:\Windows\System32\zvWOgOq.exe
  C:\Windows\System32\zvWOgOq.exe
  2⤵
  PID:9716
- C:\Windows\System32\znmInpe.exe
  C:\Windows\System32\znmInpe.exe
  2⤵
  PID:9748
- C:\Windows\System32\AaIVhYx.exe
  C:\Windows\System32\AaIVhYx.exe
  2⤵
  PID:9776
- C:\Windows\System32\toYnmQQ.exe
  C:\Windows\System32\toYnmQQ.exe
  2⤵
  PID:9800
- C:\Windows\System32\RifqLdn.exe
  C:\Windows\System32\RifqLdn.exe
  2⤵
  PID:9832
- C:\Windows\System32\QMusufc.exe
  C:\Windows\System32\QMusufc.exe
  2⤵
  PID:9856
- C:\Windows\System32\zUuXCaP.exe
  C:\Windows\System32\zUuXCaP.exe
  2⤵
  PID:9888
- C:\Windows\System32\APdcIaC.exe
  C:\Windows\System32\APdcIaC.exe
  2⤵
  PID:9916
- C:\Windows\System32\bqXjhuW.exe
  C:\Windows\System32\bqXjhuW.exe
  2⤵
  PID:9944
- C:\Windows\System32\ElKMATf.exe
  C:\Windows\System32\ElKMATf.exe
  2⤵
  PID:9972
- C:\Windows\System32\bbEUXAp.exe
  C:\Windows\System32\bbEUXAp.exe
  2⤵
  PID:10000
- C:\Windows\System32\zaXIZfA.exe
  C:\Windows\System32\zaXIZfA.exe
  2⤵
  PID:10028
- C:\Windows\System32\nfmWkFd.exe
  C:\Windows\System32\nfmWkFd.exe
  2⤵
  PID:10056
- C:\Windows\System32\kkdbGdF.exe
  C:\Windows\System32\kkdbGdF.exe
  2⤵
  PID:10072
- C:\Windows\System32\SrAQYyR.exe
  C:\Windows\System32\SrAQYyR.exe
  2⤵
  PID:10092
- C:\Windows\System32\DdYYyAy.exe
  C:\Windows\System32\DdYYyAy.exe
  2⤵
  PID:10152
- C:\Windows\System32\rPPuanG.exe
  C:\Windows\System32\rPPuanG.exe
  2⤵
  PID:10168
- C:\Windows\System32\IaArPaU.exe
  C:\Windows\System32\IaArPaU.exe
  2⤵
  PID:10196
- C:\Windows\System32\esHHdlX.exe
  C:\Windows\System32\esHHdlX.exe
  2⤵
  PID:10224
- C:\Windows\System32\gwenukQ.exe
  C:\Windows\System32\gwenukQ.exe
  2⤵
  PID:9248
- C:\Windows\System32\gMZCUCT.exe
  C:\Windows\System32\gMZCUCT.exe
  2⤵
  PID:9312
- C:\Windows\System32\KyHkBxY.exe
  C:\Windows\System32\KyHkBxY.exe
  2⤵
  PID:9372
- C:\Windows\System32\PDOnwad.exe
  C:\Windows\System32\PDOnwad.exe
  2⤵
  PID:9472
- C:\Windows\System32\qotKWeg.exe
  C:\Windows\System32\qotKWeg.exe
  2⤵
  PID:9520
- C:\Windows\System32\CbokXeI.exe
  C:\Windows\System32\CbokXeI.exe
  2⤵
  PID:9576
- C:\Windows\System32\rhXlnmh.exe
  C:\Windows\System32\rhXlnmh.exe
  2⤵
  PID:9656
- C:\Windows\System32\oTxiHkW.exe
  C:\Windows\System32\oTxiHkW.exe
  2⤵
  PID:9700
- C:\Windows\System32\zSrkxtN.exe
  C:\Windows\System32\zSrkxtN.exe
  2⤵
  PID:9768
- C:\Windows\System32\yblrDTG.exe
  C:\Windows\System32\yblrDTG.exe
  2⤵
  PID:9840
- C:\Windows\System32\ObnYfad.exe
  C:\Windows\System32\ObnYfad.exe
  2⤵
  PID:9908
- C:\Windows\System32\iKDOUKg.exe
  C:\Windows\System32\iKDOUKg.exe
  2⤵
  PID:9956
- C:\Windows\System32\uqEZHBQ.exe
  C:\Windows\System32\uqEZHBQ.exe
  2⤵
  PID:10040
- C:\Windows\System32\UIaBOTb.exe
  C:\Windows\System32\UIaBOTb.exe
  2⤵
  PID:10104
- C:\Windows\System32\FSsYzIs.exe
  C:\Windows\System32\FSsYzIs.exe
  2⤵
  PID:10132
- C:\Windows\System32\gFwhyPG.exe
  C:\Windows\System32\gFwhyPG.exe
  2⤵
  PID:9228
- C:\Windows\System32\VxkmAxU.exe
  C:\Windows\System32\VxkmAxU.exe
  2⤵
  PID:9288
- C:\Windows\System32\yyVkUYF.exe
  C:\Windows\System32\yyVkUYF.exe
  2⤵
  PID:9484
- C:\Windows\System32\ceIghoV.exe
  C:\Windows\System32\ceIghoV.exe
  2⤵
  PID:9696
- C:\Windows\System32\dMwflnd.exe
  C:\Windows\System32\dMwflnd.exe
  2⤵
  PID:9824
- C:\Windows\System32\KGbisvZ.exe
  C:\Windows\System32\KGbisvZ.exe
  2⤵
  PID:9900
- C:\Windows\System32\YOHAndM.exe
  C:\Windows\System32\YOHAndM.exe
  2⤵
  PID:10064
- C:\Windows\System32\BfiSFiC.exe
  C:\Windows\System32\BfiSFiC.exe
  2⤵
  PID:10216
- C:\Windows\System32\nRxIjIy.exe
  C:\Windows\System32\nRxIjIy.exe
  2⤵
  PID:9672
- C:\Windows\System32\NBDcLrr.exe
  C:\Windows\System32\NBDcLrr.exe
  2⤵
  PID:10068
- C:\Windows\System32\PFtZKMA.exe
  C:\Windows\System32\PFtZKMA.exe
  2⤵
  PID:10024
- C:\Windows\System32\oigMutA.exe
  C:\Windows\System32\oigMutA.exe
  2⤵
  PID:10244
- C:\Windows\System32\hhTRKdP.exe
  C:\Windows\System32\hhTRKdP.exe
  2⤵
  PID:10272
- C:\Windows\System32\IHxwRQC.exe
  C:\Windows\System32\IHxwRQC.exe
  2⤵
  PID:10288
- C:\Windows\System32\BNXfyQt.exe
  C:\Windows\System32\BNXfyQt.exe
  2⤵
  PID:10324
- C:\Windows\System32\szBPADQ.exe
  C:\Windows\System32\szBPADQ.exe
  2⤵
  PID:10360
- C:\Windows\System32\ZEFlIDv.exe
  C:\Windows\System32\ZEFlIDv.exe
  2⤵
  PID:10388
- C:\Windows\System32\FHBXcOE.exe
  C:\Windows\System32\FHBXcOE.exe
  2⤵
  PID:10404
- C:\Windows\System32\NLpDWcB.exe
  C:\Windows\System32\NLpDWcB.exe
  2⤵
  PID:10436
- C:\Windows\System32\xOCzTYJ.exe
  C:\Windows\System32\xOCzTYJ.exe
  2⤵
  PID:10460
- C:\Windows\System32\xKVkiYO.exe
  C:\Windows\System32\xKVkiYO.exe
  2⤵
  PID:10496
- C:\Windows\System32\TwiIKMw.exe
  C:\Windows\System32\TwiIKMw.exe
  2⤵
  PID:10528
- C:\Windows\System32\TGkAicJ.exe
  C:\Windows\System32\TGkAicJ.exe
  2⤵
  PID:10552
- C:\Windows\System32\wqtREDB.exe
  C:\Windows\System32\wqtREDB.exe
  2⤵
  PID:10576
- C:\Windows\System32\APCBQBC.exe
  C:\Windows\System32\APCBQBC.exe
  2⤵
  PID:10612
- C:\Windows\System32\hmMJerT.exe
  C:\Windows\System32\hmMJerT.exe
  2⤵
  PID:10640
- C:\Windows\System32\XIAAntG.exe
  C:\Windows\System32\XIAAntG.exe
  2⤵
  PID:10656
- C:\Windows\System32\KjBDyIZ.exe
  C:\Windows\System32\KjBDyIZ.exe
  2⤵
  PID:10684
- C:\Windows\System32\OAgvOxx.exe
  C:\Windows\System32\OAgvOxx.exe
  2⤵
  PID:10712
- C:\Windows\System32\coGNHom.exe
  C:\Windows\System32\coGNHom.exe
  2⤵
  PID:10740
- C:\Windows\System32\ROZMqPo.exe
  C:\Windows\System32\ROZMqPo.exe
  2⤵
  PID:10780
- C:\Windows\System32\ZRVhcZH.exe
  C:\Windows\System32\ZRVhcZH.exe
  2⤵
  PID:10800
- C:\Windows\System32\CDeaNaY.exe
  C:\Windows\System32\CDeaNaY.exe
  2⤵
  PID:10828
- C:\Windows\System32\QHZhARG.exe
  C:\Windows\System32\QHZhARG.exe
  2⤵
  PID:10852
- C:\Windows\System32\uUiWRov.exe
  C:\Windows\System32\uUiWRov.exe
  2⤵
  PID:10892
- C:\Windows\System32\gcodYTk.exe
  C:\Windows\System32\gcodYTk.exe
  2⤵
  PID:10920
- C:\Windows\System32\XiRfrkK.exe
  C:\Windows\System32\XiRfrkK.exe
  2⤵
  PID:10948
- C:\Windows\System32\kdAElML.exe
  C:\Windows\System32\kdAElML.exe
  2⤵
  PID:10972
- C:\Windows\System32\gvvKWsP.exe
  C:\Windows\System32\gvvKWsP.exe
  2⤵
  PID:11004
- C:\Windows\System32\pixFZxN.exe
  C:\Windows\System32\pixFZxN.exe
  2⤵
  PID:11032
- C:\Windows\System32\tHcWCfm.exe
  C:\Windows\System32\tHcWCfm.exe
  2⤵
  PID:11060
- C:\Windows\System32\vxqjszR.exe
  C:\Windows\System32\vxqjszR.exe
  2⤵
  PID:11096
- C:\Windows\System32\ScWTnrJ.exe
  C:\Windows\System32\ScWTnrJ.exe
  2⤵
  PID:11136
- C:\Windows\System32\jGgaQzk.exe
  C:\Windows\System32\jGgaQzk.exe
  2⤵
  PID:11156
- C:\Windows\System32\FtFPBed.exe
  C:\Windows\System32\FtFPBed.exe
  2⤵
  PID:11208
- C:\Windows\System32\DavyeLm.exe
  C:\Windows\System32\DavyeLm.exe
  2⤵
  PID:11236
- C:\Windows\System32\xOhWwar.exe
  C:\Windows\System32\xOhWwar.exe
  2⤵
  PID:9344
- C:\Windows\System32\uKzzMjV.exe
  C:\Windows\System32\uKzzMjV.exe
  2⤵
  PID:10268
- C:\Windows\System32\QFvSMUL.exe
  C:\Windows\System32\QFvSMUL.exe
  2⤵
  PID:10352
- C:\Windows\System32\TILFQdB.exe
  C:\Windows\System32\TILFQdB.exe
  2⤵
  PID:10424
- C:\Windows\System32\HSOSpFV.exe
  C:\Windows\System32\HSOSpFV.exe
  2⤵
  PID:10448
- C:\Windows\System32\EYeVOiW.exe
  C:\Windows\System32\EYeVOiW.exe
  2⤵
  PID:10560
- C:\Windows\System32\AtxDqdY.exe
  C:\Windows\System32\AtxDqdY.exe
  2⤵
  PID:10628
- C:\Windows\System32\fHUOYza.exe
  C:\Windows\System32\fHUOYza.exe
  2⤵
  PID:10680
- C:\Windows\System32\WYVpzCr.exe
  C:\Windows\System32\WYVpzCr.exe
  2⤵
  PID:10752
- C:\Windows\System32\WPTwmDq.exe
  C:\Windows\System32\WPTwmDq.exe
  2⤵
  PID:10808
- C:\Windows\System32\ZHDLfGr.exe
  C:\Windows\System32\ZHDLfGr.exe
  2⤵
  PID:10848
- C:\Windows\System32\gThACCG.exe
  C:\Windows\System32\gThACCG.exe
  2⤵
  PID:10940
- C:\Windows\System32\ikiKBIz.exe
  C:\Windows\System32\ikiKBIz.exe
  2⤵
  PID:11016
- C:\Windows\System32\mXaymUZ.exe
  C:\Windows\System32\mXaymUZ.exe
  2⤵
  PID:11092
- C:\Windows\System32\XzSfmoV.exe
  C:\Windows\System32\XzSfmoV.exe
  2⤵
  PID:11152
- C:\Windows\System32\kldLKhu.exe
  C:\Windows\System32\kldLKhu.exe
  2⤵
  PID:11228
- C:\Windows\System32\TJkeDmu.exe
  C:\Windows\System32\TJkeDmu.exe
  2⤵
  PID:10256
- C:\Windows\System32\kqDeiHv.exe
  C:\Windows\System32\kqDeiHv.exe
  2⤵
  PID:10444
- C:\Windows\System32\SPBXiyP.exe
  C:\Windows\System32\SPBXiyP.exe
  2⤵
  PID:10604
- C:\Windows\System32\BtNvIdO.exe
  C:\Windows\System32\BtNvIdO.exe
  2⤵
  PID:10772
- C:\Windows\System32\hvxMWow.exe
  C:\Windows\System32\hvxMWow.exe
  2⤵
  PID:10884
- C:\Windows\System32\awDMacz.exe
  C:\Windows\System32\awDMacz.exe
  2⤵
  PID:10988
- C:\Windows\System32\hKBWKpm.exe
  C:\Windows\System32\hKBWKpm.exe
  2⤵
  PID:11204
- C:\Windows\System32\eUYIOTx.exe
  C:\Windows\System32\eUYIOTx.exe
  2⤵
  PID:10524
- C:\Windows\System32\pUBQZpU.exe
  C:\Windows\System32\pUBQZpU.exe
  2⤵
  PID:10844
- C:\Windows\System32\FvOTJZX.exe
  C:\Windows\System32\FvOTJZX.exe
  2⤵
  PID:11052
- C:\Windows\System32\SjBShHs.exe
  C:\Windows\System32\SjBShHs.exe
  2⤵
  PID:10964
- C:\Windows\System32\xGrnevL.exe
  C:\Windows\System32\xGrnevL.exe
  2⤵
  PID:11272
- C:\Windows\System32\HkkUblc.exe
  C:\Windows\System32\HkkUblc.exe
  2⤵
  PID:11300
- C:\Windows\System32\TVFocJv.exe
  C:\Windows\System32\TVFocJv.exe
  2⤵
  PID:11328
- C:\Windows\System32\WsYyscb.exe
  C:\Windows\System32\WsYyscb.exe
  2⤵
  PID:11356
- C:\Windows\System32\qOBgUSv.exe
  C:\Windows\System32\qOBgUSv.exe
  2⤵
  PID:11388
- C:\Windows\System32\ZypPuPU.exe
  C:\Windows\System32\ZypPuPU.exe
  2⤵
  PID:11412
- C:\Windows\System32\aBiOXqp.exe
  C:\Windows\System32\aBiOXqp.exe
  2⤵
  PID:11444
- C:\Windows\System32\mlQZcgD.exe
  C:\Windows\System32\mlQZcgD.exe
  2⤵
  PID:11460
- C:\Windows\System32\wJoAomO.exe
  C:\Windows\System32\wJoAomO.exe
  2⤵
  PID:11488
- C:\Windows\System32\XonWyEe.exe
  C:\Windows\System32\XonWyEe.exe
  2⤵
  PID:11516
- C:\Windows\System32\FLiDupA.exe
  C:\Windows\System32\FLiDupA.exe
  2⤵
  PID:11532
- C:\Windows\System32\kTOYEcv.exe
  C:\Windows\System32\kTOYEcv.exe
  2⤵
  PID:11592
- C:\Windows\System32\VVjZVfh.exe
  C:\Windows\System32\VVjZVfh.exe
  2⤵
  PID:11612
- C:\Windows\System32\HfvuDJf.exe
  C:\Windows\System32\HfvuDJf.exe
  2⤵
  PID:11640
- C:\Windows\System32\GXuBHtI.exe
  C:\Windows\System32\GXuBHtI.exe
  2⤵
  PID:11668
- C:\Windows\System32\PRBFGjc.exe
  C:\Windows\System32\PRBFGjc.exe
  2⤵
  PID:11708
- C:\Windows\System32\tTDGnEz.exe
  C:\Windows\System32\tTDGnEz.exe
  2⤵
  PID:11736
- C:\Windows\System32\AqUBvAT.exe
  C:\Windows\System32\AqUBvAT.exe
  2⤵
  PID:11764
- C:\Windows\System32\WbOfqbY.exe
  C:\Windows\System32\WbOfqbY.exe
  2⤵
  PID:11804
- C:\Windows\System32\nPFuKiH.exe
  C:\Windows\System32\nPFuKiH.exe
  2⤵
  PID:11824
- C:\Windows\System32\nOqTgIN.exe
  C:\Windows\System32\nOqTgIN.exe
  2⤵
  PID:11852
- C:\Windows\System32\mmIcRak.exe
  C:\Windows\System32\mmIcRak.exe
  2⤵
  PID:11880
- C:\Windows\System32\guMNJaK.exe
  C:\Windows\System32\guMNJaK.exe
  2⤵
  PID:11900
- C:\Windows\System32\kehJOao.exe
  C:\Windows\System32\kehJOao.exe
  2⤵
  PID:11924
- C:\Windows\System32\xJWwOsk.exe
  C:\Windows\System32\xJWwOsk.exe
  2⤵
  PID:11944
- C:\Windows\System32\dcLmGpc.exe
  C:\Windows\System32\dcLmGpc.exe
  2⤵
  PID:11980
- C:\Windows\System32\PQfEoGH.exe
  C:\Windows\System32\PQfEoGH.exe
  2⤵
  PID:12000
- C:\Windows\System32\OYHyEGe.exe
  C:\Windows\System32\OYHyEGe.exe
  2⤵
  PID:12028
- C:\Windows\System32\wQfmrcK.exe
  C:\Windows\System32\wQfmrcK.exe
  2⤵
  PID:12088
- C:\Windows\System32\FdKoIdS.exe
  C:\Windows\System32\FdKoIdS.exe
  2⤵
  PID:12108
- C:\Windows\System32\MyiRpYZ.exe
  C:\Windows\System32\MyiRpYZ.exe
  2⤵
  PID:12136
- C:\Windows\System32\mXcjHpe.exe
  C:\Windows\System32\mXcjHpe.exe
  2⤵
  PID:12164
- C:\Windows\System32\NKrXMsT.exe
  C:\Windows\System32\NKrXMsT.exe
  2⤵
  PID:12192
- C:\Windows\System32\WEIgyzZ.exe
  C:\Windows\System32\WEIgyzZ.exe
  2⤵
  PID:12208
- C:\Windows\System32\CegzHoi.exe
  C:\Windows\System32\CegzHoi.exe
  2⤵
  PID:12236
- C:\Windows\System32\fKOrNjh.exe
  C:\Windows\System32\fKOrNjh.exe
  2⤵
  PID:12276
- C:\Windows\System32\ecDmQZd.exe
  C:\Windows\System32\ecDmQZd.exe
  2⤵
  PID:10700
- C:\Windows\System32\fijBwVb.exe
  C:\Windows\System32\fijBwVb.exe
  2⤵
  PID:11372
- C:\Windows\System32\IFAzNob.exe
  C:\Windows\System32\IFAzNob.exe
  2⤵
  PID:11428
- C:\Windows\System32\EGBOJzr.exe
  C:\Windows\System32\EGBOJzr.exe
  2⤵
  PID:11476
- C:\Windows\System32\nISAFsz.exe
  C:\Windows\System32\nISAFsz.exe
  2⤵
  PID:11552
- C:\Windows\System32\lHxZBpc.exe
  C:\Windows\System32\lHxZBpc.exe
  2⤵
  PID:11624
- C:\Windows\System32\OrOJwjL.exe
  C:\Windows\System32\OrOJwjL.exe
  2⤵
  PID:11680
- C:\Windows\System32\XVzHENM.exe
  C:\Windows\System32\XVzHENM.exe
  2⤵
  PID:10544
- C:\Windows\System32\csjQUvW.exe
  C:\Windows\System32\csjQUvW.exe
  2⤵
  PID:11780
- C:\Windows\System32\idnAxld.exe
  C:\Windows\System32\idnAxld.exe
  2⤵
  PID:11872
- C:\Windows\System32\XcmPhKr.exe
  C:\Windows\System32\XcmPhKr.exe
  2⤵
  PID:11960
- C:\Windows\System32\GAqmcXG.exe
  C:\Windows\System32\GAqmcXG.exe
  2⤵
  PID:12016
- C:\Windows\System32\vvCxKtx.exe
  C:\Windows\System32\vvCxKtx.exe
  2⤵
  PID:12096
- C:\Windows\System32\zwdFdKY.exe
  C:\Windows\System32\zwdFdKY.exe
  2⤵
  PID:12128
- C:\Windows\System32\KnNaHZA.exe
  C:\Windows\System32\KnNaHZA.exe
  2⤵
  PID:12232
- C:\Windows\System32\KAjdYfC.exe
  C:\Windows\System32\KAjdYfC.exe
  2⤵
  PID:12248
- C:\Windows\System32\JxugmMa.exe
  C:\Windows\System32\JxugmMa.exe
  2⤵
  PID:11320
- C:\Windows\System32\rnLFMRj.exe
  C:\Windows\System32\rnLFMRj.exe
  2⤵
  PID:11500
- C:\Windows\System32\QcMMxCR.exe
  C:\Windows\System32\QcMMxCR.exe
  2⤵
  PID:11720
- C:\Windows\System32\MmvrRUP.exe
  C:\Windows\System32\MmvrRUP.exe
  2⤵
  PID:11816
- C:\Windows\System32\fRQHHut.exe
  C:\Windows\System32\fRQHHut.exe
  2⤵
  PID:12012
- C:\Windows\System32\rLwZDJn.exe
  C:\Windows\System32\rLwZDJn.exe
  2⤵
  PID:12060
- C:\Windows\System32\jAeCpjn.exe
  C:\Windows\System32\jAeCpjn.exe
  2⤵
  PID:12120
- C:\Windows\System32\iPAZWEs.exe
  C:\Windows\System32\iPAZWEs.exe
  2⤵
  PID:12284
- C:\Windows\System32\KttTpJP.exe
  C:\Windows\System32\KttTpJP.exe
  2⤵
  PID:11996
- C:\Windows\System32\RbrqwEL.exe
  C:\Windows\System32\RbrqwEL.exe
  2⤵
  PID:11840
- C:\Windows\System32\qvQPVJV.exe
  C:\Windows\System32\qvQPVJV.exe
  2⤵
  PID:4480
- C:\Windows\System32\dXRJFlW.exe
  C:\Windows\System32\dXRJFlW.exe
  2⤵
  PID:11608
- C:\Windows\System32\FPSSFhD.exe
  C:\Windows\System32\FPSSFhD.exe
  2⤵
  PID:11420
- C:\Windows\System32\QpObsPo.exe
  C:\Windows\System32\QpObsPo.exe
  2⤵
  PID:12312
- C:\Windows\System32\OpziNkc.exe
  C:\Windows\System32\OpziNkc.exe
  2⤵
  PID:12348
- C:\Windows\System32\kOTESDM.exe
  C:\Windows\System32\kOTESDM.exe
  2⤵
  PID:12364
- C:\Windows\System32\jDBrRYX.exe
  C:\Windows\System32\jDBrRYX.exe
  2⤵
  PID:12396
- C:\Windows\System32\IVHcEwB.exe
  C:\Windows\System32\IVHcEwB.exe
  2⤵
  PID:12432
- C:\Windows\System32\KpTkKVH.exe
  C:\Windows\System32\KpTkKVH.exe
  2⤵
  PID:12460
- C:\Windows\System32\bQcOCYy.exe
  C:\Windows\System32\bQcOCYy.exe
  2⤵
  PID:12476
- C:\Windows\System32\BqnVUHg.exe
  C:\Windows\System32\BqnVUHg.exe
  2⤵
  PID:12516
- C:\Windows\System32\DZbOucb.exe
  C:\Windows\System32\DZbOucb.exe
  2⤵
  PID:12544
- C:\Windows\System32\UwqqjdO.exe
  C:\Windows\System32\UwqqjdO.exe
  2⤵
  PID:12564
- C:\Windows\System32\qrMFewh.exe
  C:\Windows\System32\qrMFewh.exe
  2⤵
  PID:12596
- C:\Windows\System32\heoYBhd.exe
  C:\Windows\System32\heoYBhd.exe
  2⤵
  PID:12636
- C:\Windows\System32\ehcumZF.exe
  C:\Windows\System32\ehcumZF.exe
  2⤵
  PID:12672
- C:\Windows\System32\mgmkBpg.exe
  C:\Windows\System32\mgmkBpg.exe
  2⤵
  PID:12712
- C:\Windows\System32\KhErGHh.exe
  C:\Windows\System32\KhErGHh.exe
  2⤵
  PID:12756
- C:\Windows\System32\SWqiXLf.exe
  C:\Windows\System32\SWqiXLf.exe
  2⤵
  PID:12776
- C:\Windows\System32\nMOvpsN.exe
  C:\Windows\System32\nMOvpsN.exe
  2⤵
  PID:12804
- C:\Windows\System32\tIgkwqW.exe
  C:\Windows\System32\tIgkwqW.exe
  2⤵
  PID:12860
- C:\Windows\System32\blKOlrE.exe
  C:\Windows\System32\blKOlrE.exe
  2⤵
  PID:12904
- C:\Windows\System32\CkEyHei.exe
  C:\Windows\System32\CkEyHei.exe
  2⤵
  PID:12928
- C:\Windows\System32\kHDyNdf.exe
  C:\Windows\System32\kHDyNdf.exe
  2⤵
  PID:12964
- C:\Windows\System32\hGpdtAt.exe
  C:\Windows\System32\hGpdtAt.exe
  2⤵
  PID:13000
- C:\Windows\System32\GNpuVaQ.exe
  C:\Windows\System32\GNpuVaQ.exe
  2⤵
  PID:13048
- C:\Windows\System32\rBFGbvU.exe
  C:\Windows\System32\rBFGbvU.exe
  2⤵
  PID:13072
- C:\Windows\System32\ZLTbTeh.exe
  C:\Windows\System32\ZLTbTeh.exe
  2⤵
  PID:13096
- C:\Windows\System32\quzaSRR.exe
  C:\Windows\System32\quzaSRR.exe
  2⤵
  PID:13128
- C:\Windows\System32\CULNBBO.exe
  C:\Windows\System32\CULNBBO.exe
  2⤵
  PID:13160
- C:\Windows\System32\YVnrLko.exe
  C:\Windows\System32\YVnrLko.exe
  2⤵
  PID:13188
- C:\Windows\System32\CIfnIZs.exe
  C:\Windows\System32\CIfnIZs.exe
  2⤵
  PID:13216
- C:\Windows\System32\IRpellR.exe
  C:\Windows\System32\IRpellR.exe
  2⤵
  PID:13236
- C:\Windows\System32\DBcBWOw.exe
  C:\Windows\System32\DBcBWOw.exe
  2⤵
  PID:13268
- C:\Windows\System32\lfvCzOO.exe
  C:\Windows\System32\lfvCzOO.exe
  2⤵
  PID:13308
- C:\Windows\System32\wPVtRjS.exe
  C:\Windows\System32\wPVtRjS.exe
  2⤵
  PID:12304
- C:\Windows\System32\sWIVYwj.exe
  C:\Windows\System32\sWIVYwj.exe
  2⤵
  PID:12360
- C:\Windows\System32\aOpSIdG.exe
  C:\Windows\System32\aOpSIdG.exe
  2⤵
  PID:12448
- C:\Windows\System32\BTvELHm.exe
  C:\Windows\System32\BTvELHm.exe
  2⤵
  PID:12500
- C:\Windows\System32\wnphRuS.exe
  C:\Windows\System32\wnphRuS.exe
  2⤵
  PID:12560
- C:\Windows\System32\JWUgBup.exe
  C:\Windows\System32\JWUgBup.exe
  2⤵
  PID:12656
- C:\Windows\System32\tZXFfYl.exe
  C:\Windows\System32\tZXFfYl.exe
  2⤵
  PID:12724
- C:\Windows\System32\senHjAV.exe
  C:\Windows\System32\senHjAV.exe
  2⤵
  PID:12792
- C:\Windows\System32\rXixJCo.exe
  C:\Windows\System32\rXixJCo.exe
  2⤵
  PID:12900
- C:\Windows\System32\PzrzomS.exe
  C:\Windows\System32\PzrzomS.exe
  2⤵
  PID:12980
- C:\Windows\System32\bETYRNQ.exe
  C:\Windows\System32\bETYRNQ.exe
  2⤵
  PID:13040
- C:\Windows\System32\EKbAxfV.exe
  C:\Windows\System32\EKbAxfV.exe
  2⤵
  PID:13120
- C:\Windows\System32\lcJZNHe.exe
  C:\Windows\System32\lcJZNHe.exe
  2⤵
  PID:13180
- C:\Windows\System32\CUXrkWp.exe
  C:\Windows\System32\CUXrkWp.exe
  2⤵
  PID:13256
- C:\Windows\System32\PbWTnfk.exe
  C:\Windows\System32\PbWTnfk.exe
  2⤵
  PID:12328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AtiLhmt.exe

Filesize
2.7MB

MD5
de7dc2572b449747f3637b8f7b4d0e31

SHA1
425a5f4eaf7346adea719a291bde795ecc12afab

SHA256
084ff203671beed20060796b5fbde7bfd96e22d1c9f8fa7447deb2742667c3a6

SHA512
cc850d204e54dc712593b8b5e4fb21f313d4a3dbb68394975bf720a20c9b83fe046608645ffa19b048c711477e7f1142bfbad1f9074c33540b6203faf2281fb4

Download Submit
C:\Windows\System32\CAgEfAK.exe

Filesize
2.7MB

MD5
36f839ecdf09dab4f4143fa6bcb6518e

SHA1
6c78f5ca1f36bf302acbcf77e272c3ff2f3ef5f4

SHA256
21cff290814a4d5492187d0d21cdccce1923d7124c262fbcda05eae94cc1b928

SHA512
2e6ac5c31b145640baf15e893a1bc855d847954bb7bb6c99b2fd6815034ef74f090b9e5915e0324070cebbcfa1ab341338328adf3d05bef8e19319ad59258c22

Download Submit
C:\Windows\System32\CXAbROT.exe

Filesize
2.7MB

MD5
46dabd0f636d9db8584e52e5f292bf5f

SHA1
a15c2ae97a56f8d39da6965cfa931ec39bf2bee9

SHA256
4c9acfd3a9a8e7bca64e4b8d046326402e1dcd9b9fd7a52a2426ef5c4470bb44

SHA512
70491b7bc7d01994d2d51a0e33bb3a9877ca18fce4fd5e0f97398fe5eb1003395f91c455435527c8ea944cb907529410e779b92cc69a1be2af63f676e1ff525b

Download Submit
C:\Windows\System32\CZRAvEK.exe

Filesize
2.7MB

MD5
7cac654c7c30e34ca3ab56c850954984

SHA1
633cecef69c81735370d1faba9f333ccc836415f

SHA256
c694a15d7517619bcd0d81c9d1674a7f8ae062fea20b813ae740d3d70ada8572

SHA512
e3e87d1d9741e9ca0a728b49dc5a7dbf5cab1f3441103386adb035c826147adfde72adf6c79ef6c19fb380ed85a629180bc0fd0096db6f5f1c12008c078ea8f3

Download Submit
C:\Windows\System32\DCefvFV.exe

Filesize
2.7MB

MD5
339d9c159e5d70e83325bb739c253f80

SHA1
8956e725a71636293ca2b588a55f137e6fad2d1f

SHA256
a97a48764d0a672ae7ca132dda0c6f1beb6e5757c4ae60ef4a4a90b83355aacc

SHA512
2e937d61086f48ba7ef51b1d8f10d2f6140f2a1e44fa424cd502986b8a80eb3f5f98ae186625b633048c29343b566935311b162b270962444e289f503df5e8bd

Download Submit
C:\Windows\System32\FYMfWqr.exe

Filesize
2.7MB

MD5
5be278163b9dcedf17a4af63ea1ffccb

SHA1
a364695117b30628a1bc7570bb970738a4ba1747

SHA256
f5629cd6fd3d9c875e1c0bb1caa00fd527818b7c6c39bc6849f3ff281fa4d803

SHA512
5c69b7cc6d4c44b9b492acacac84e6859145898542486cec3e9a2fccac79803c1189fff7593c528ffa52cf4e864e0c30c0eadede002d30cd3f49a550072d9718

Download Submit
C:\Windows\System32\IrFKpEz.exe

Filesize
2.7MB

MD5
51008d502713655f20dbc774a82f8cff

SHA1
d8652bbe81b53fe7451e6f0301ac18ed58f2c7a0

SHA256
02bd14119acc2f6389a73ec2bd068897f69a00b578db64e99e0ddb00a43c0cbd

SHA512
caae6e576b2372efd606b73fe1a6b880267682a52df3e985fec0dc05eecb8479a543a6be6a3c951aace4d4fcd1acbade6b6ec476b966a3f666d0002e5c5062ca

Download Submit
C:\Windows\System32\JYIspWS.exe

Filesize
2.7MB

MD5
c7f659657f2fee20320ef6c6df486c07

SHA1
b0b0b19da3d739e4e8fe0e81d18c58a4645280ae

SHA256
04e59c7852668b67549ad8b7718d474da28d55814e6b03556f16131232519c0c

SHA512
ec2e28090271098054219b082eac4a27071e5b521c822362f98467646618723c2a3a98074a5d93f175ae56f250e1779c81b27cea6f5e271e25c3fda43c2104ae

Download Submit
C:\Windows\System32\JoZuXPt.exe

Filesize
2.7MB

MD5
6a676a21d30201256db3ed64a08d64a1

SHA1
3d64b8496479ea6a9d62bb5ea6be7d2b34a0341d

SHA256
d5edc2d2e8a0f59080f258c713309f55d37c2b04af226c9bc90ed81d904ef227

SHA512
1594cd70ba0ee2a79335aea17d94a892048284161b05159ca55b9b82d6d65ca870bd3c5823ec2723a2c7a8d41d1c970734e75f4eaea6a986283a8160dffe00cb

Download Submit
C:\Windows\System32\MrWjtjK.exe

Filesize
2.7MB

MD5
80dab6f428ff34ba9f73721764a572a6

SHA1
e9bcbb025903dbbd8d88e6d6f7ab52c05feee301

SHA256
f975a992dc5ff43e67c1cd0bf7a51581f9c09dd8c8eac0636a0ac847c1440387

SHA512
cf7d0553267ee2bc705afcf9dace8c7fd20b239d5de8ec6b7bccfe2101bf091b6abf10652b39d128c83b62f0b355fa21d9a35b1f035b39da764db89444f53d94

Download Submit
C:\Windows\System32\MvFTWVu.exe

Filesize
2.7MB

MD5
acbc0bde98f1e2eeaf370653df991adc

SHA1
2174516e56fcf86ccef04a566a8c17eb8bb49a4e

SHA256
50061679223a254426036752baf489cee668fd745b9f6c4c22c9de6109a1c6f4

SHA512
e05d11c7838645e1c09046d79e30c569bce230707458f00532186f9bc578203a176591b496516f650097aa4a4634f6fc4057a82ce8afced572f4abe3bc4eeaf2

Download Submit
C:\Windows\System32\NlfeTce.exe

Filesize
2.7MB

MD5
8593fadb5574089bd69c123bb6cd045f

SHA1
7bf4aefc1da8edf0deb02393cf64c575c1df193a

SHA256
468b725aaec4beac50e73492cda6d5d5f02d7044ad4c4f31ea5563181cc8e31f

SHA512
102e4a83d131875a558fc8967d2888edac60ef5125ae6b9b0ce9be22138ff35078b8872c5340b075f307b42fd6c4970ab8d0404adec81d1131622436ec2d72ef

Download Submit
C:\Windows\System32\OpBqYUX.exe

Filesize
2.7MB

MD5
aee38c300ccbbfd7116600702d93ab60

SHA1
ab64fda086c1cce654a64c55f7b4125c112d2f21

SHA256
e8d96755df2229d4b7eb3369111d2046818731aeec103dddcae4d7ebbee5b032

SHA512
3a8047f460930ee63723cee630818761cd23d7c01c8881c4fe73aafe925b31b5513ea171834bdf55e804cd1dc000b881736509cf8dbdbecfdb2b871cc23feefe

Download Submit
C:\Windows\System32\PShdABs.exe

Filesize
2.7MB

MD5
db497d6944b41e85ac2681459a568b2b

SHA1
a4be60b8198412ae0d6ca856defcec3084108c79

SHA256
c5c5643a4958e35bd5bc13997d26cdafbc2950cf03d04e85664394748ec89a8e

SHA512
e9aad03f514e30de2f4fa5ed0833c536965febdaeb292ed55a4396ca61151cca401e0200953f1813c906b885ddd172aafeef672c52976670f1f0c9c8e1d8d7e1

Download Submit
C:\Windows\System32\PdFnwdL.exe

Filesize
2.7MB

MD5
511c2be96bcfb8cea8a60edf423fd855

SHA1
f304a7ba5c28f8fcf1818aecdf9e5f03d492bef1

SHA256
b12724b6ded68753fd4b350e386d9d541c1eeab4041109fdb4f1c1bbb11d042b

SHA512
98d333343d75fbb3ebcdf0ea6c8840d81137c7ff09cb8797b43fc60e486ac176641affcac6b67c267449e125db39dcf6df939e7ca5bc40191f3ee016092ee68f

Download Submit
C:\Windows\System32\TGFzSXu.exe

Filesize
2.7MB

MD5
24aff407611bbcdd6e6422088b3aa0cb

SHA1
ed760fbb1f321b523d2348c222ac822784328ebb

SHA256
bf234ea101c7015363b45f17c8c958c871f94ece19efc525a82b180aea43670b

SHA512
0fa5f4804953e84261aed41c0b0ffd713812de5e1db76ec03bf6762c283adf8b50305ee99f87a95c244c45bab8748bd4f8e693fe0500eee4285bbd3d52ed7755

Download Submit
C:\Windows\System32\TfgdcmD.exe

Filesize
2.7MB

MD5
19575d841634a3d3fab66f91732594c0

SHA1
0a0d52415d68e7b698bc2a9d2a14d02312a784c3

SHA256
34775b7cb071de3b8d983d542f6612ec02eea242a3cf5427e7d759da058e18dd

SHA512
a649b8ec4058086dec084432adf5f6f579362be77927ee1cfd7baec09ca1630e3be6841838e1ba30618692f8bce7cbfa82f3f1228b2090e821358d07001322c0

Download Submit
C:\Windows\System32\VreWMQf.exe

Filesize
2.7MB

MD5
10d6a25c9db525d7154abfd4cf1bb133

SHA1
0986c5bef2d26a098f8833a0d77c18aa02a9d416

SHA256
953ed602329fa42ad1755330b5273a456f2cf2b5f8cdf28125d34186971bb49a

SHA512
75a2610f8961bc21be62a9a16b790f90d5e5ae6e86bea06c53ea180f1b046c2e7ad9f707cb00b7d72ee8976b163e0d677ffbf2e4f6c3c7fe920a6732823b53f0

Download Submit
C:\Windows\System32\VveHPEX.exe

Filesize
2.7MB

MD5
bbc345fb0b5f9b5fbddbe61b77f2bab8

SHA1
445c828ca636575322bb27608fda668a0bdae004

SHA256
ffa75b5cbceed37b8c4359565dd5fb632a8e161cddb360575d21f6a236312b2f

SHA512
558727acec41fd922c80b5d222a59b621ffa499e483196d3b40de014387f13787a182ec6584d190106dc728b4e6785e8a7ea7055ae13548aa896b28f4bb7796b

Download Submit
C:\Windows\System32\WXIoOim.exe

Filesize
2.7MB

MD5
1d12093bdd4d752c686091d7e0f16582

SHA1
9e39608720f2a8de165f0cf5ee775bad57c6874d

SHA256
5ae34db01291db3b4521959a359a6427dc3f09fe9f7341ca5d5b7debdbb81e1f

SHA512
042fb5466655da277a68b72a501fc38e4dc876c5ae0d987d662f333c92b0345bf15e0b26108f51da9f25e16526e58a7ab7a242def726c4ac8e6bd0a669990812

Download Submit
C:\Windows\System32\YeNtiEm.exe

Filesize
2.7MB

MD5
306cf3e79455ee5202c4a415b15513ae

SHA1
c48e5a0bdf25094cc491956d75f02da6ebbbb12b

SHA256
19c3b877751bf84fb7f19491332742d821a0684bcfa89c54cd6eaa8f7be04125

SHA512
fc98164ec45b7f0cd970a3fffcae6308d2e9bbb475a7b183401e33109f6f7bd1435d24ff49620b7a34a42ad928206e95b846ab63ec468456b86304051f6600fe

Download Submit
C:\Windows\System32\caKhxUb.exe

Filesize
2.7MB

MD5
b10cbd7533bfb0b77f77d2524ef68811

SHA1
a90b3dff9178b77811c4aea06995204bf68fab08

SHA256
7f89edfd9f68629278db72f122bd3e67fda8e0f898b31a9b74c49eff16363e67

SHA512
08848329b85934e27a0b5f1c0a8c5ce3fed2779f525a01dc0cdb12d459c696ad52589e12bba0cb10b0a7c3b1837c7e174ae34bb7f16dc808ac6e879add1c44d3

Download Submit
C:\Windows\System32\cnOhYGQ.exe

Filesize
2.7MB

MD5
6900280f274e0bfaaded1c992736a9de

SHA1
992a05571b714ff7161c39420f7cd028b08778ab

SHA256
a95ea4163658353080f8ed0218bbdb39c61a5f99fd752a3d0bfc6c7b0611e233

SHA512
292e69a1aa05c686ed8049479b8193de94a7e768a5a3dcc2de537b28f2ba8c1259eb4fb74f16e23863dd40f2d3aa25e97372701d7beccc61207fc505946f8d79

Download Submit
C:\Windows\System32\dGZNfOh.exe

Filesize
2.7MB

MD5
d9484fc3a6489c21f2520cf006bf44d7

SHA1
ae7ef8bdde38d8a43ff0b0257f40a8d77af93786

SHA256
3696c110b5eb960cdcb7a2b5ee2d1132b8731b789a50247f784d1ce7522d571d

SHA512
aeacb9773a483651eb38e585c5504f9c99a309ef782a8e1ee48b7c1f04ff0eaaf99283851aa4fff0a47e9616fdfe3231b2272ef7dc9272dd908fca4525eb4ca3

Download Submit
C:\Windows\System32\dsZRbKu.exe

Filesize
2.7MB

MD5
e6a4443f10ea8ee280f776b8a318e8f7

SHA1
b3c504d50ddefb3f2245d5e522d3a351e68fe559

SHA256
b27c2ef1baad7efab86b5b56687dc4509ad3729f518e7e60252935d808fa1c80

SHA512
f99be983ef34c552f6a7994d8c548d1c6dbf353d68824cab32aab6d8576c95375450440b230119e80e9d708868299a451482f27ea6d1d90e7610833d911de528

Download Submit
C:\Windows\System32\eYGuzzG.exe

Filesize
2.7MB

MD5
919dd87f78cd717986708fd9e1bd8bc8

SHA1
f7a32b3f602c240517608f2fe660eaf80faf7fee

SHA256
e8fce79299e0b9d8a2cec063cdc4da0b973966fd5432d2a39f6638d638106955

SHA512
c8429f0e20263897465183ac043b638fbbf765055f81b12e0f434c316f6f458a73b6f3ca90565261f479875b054ebd1658dfa87f24305c18311b502ab9cfa740

Download Submit
C:\Windows\System32\kwQKGFA.exe

Filesize
2.7MB

MD5
20078a10cd93692d0baeeff6b6252d1f

SHA1
6d3bb6d1c00cdb3ebe967dc95e819cd3817b3d11

SHA256
4c7b6748f93b0d31d4095f788d0c757ee6a409698dd5fe59d790f085f9bed8cb

SHA512
2c6bf080f1897b2b6e34d60fb3a9c7adc00cd0c0651329c3b7dca3669d80b1476bacc8b0e586069157f01e2843163ef12b422b3e4033e15e98f83c228ecf9291

Download Submit
C:\Windows\System32\mAULrKY.exe

Filesize
2.7MB

MD5
8e519013c9e399c7e2e32c33a89c1e7e

SHA1
ff13f6fe4f60dbcdfa3fe110ea69a1ac591f0c2f

SHA256
c538e91e6fb7cb91081255e1fc0a8b478364afcdbea8de103e30cdc5cd15bc0b

SHA512
0819c91d7fd9bdd9e49c8972800412cfb6101db511bccee83d1d2d30a3a60da8c0726df48fc3767e722da8bde97a74806705433c98757ad11307a8b410c8850c

Download Submit
C:\Windows\System32\nnCwQGh.exe

Filesize
2.7MB

MD5
5cf77e7654e09426ef0373bc9bc98711

SHA1
5eec942bb01cffe74fc650962cd1d0dd75ffdaac

SHA256
ce9d1880cb89ea511feae801f5b3cb7d69265482506a411783fd51452781cffc

SHA512
571593dbe8923d2c383d08841fc613629b2f2b6d9f4819b0b0dd3ee13cdd458be671f5886104ea840e8e3c7d58fc0952d294ce0bf56a84ca07b67af1523e2f55

Download Submit
C:\Windows\System32\pzMLqAU.exe

Filesize
2.7MB

MD5
0aa0c1c685bb86db2ac99564829a16a9

SHA1
25cffef8742f43ac252837b2579e9b54ff3c9fab

SHA256
4ada9e1893d1cfb575880fa1c6f440e0dddf6e87503ae778dca8b836ffa5553a

SHA512
b11d645e72e213b46082e5e28baacb7637cad1c83d2001822cfc359300134b1c59e2813cf7b205f7ba92ff3ca3aa19404556d8a171a78edaaba7d997e6a14f64

Download Submit
C:\Windows\System32\rarYaHf.exe

Filesize
2.7MB

MD5
b8e0b9948b325b58c11517ba285104f4

SHA1
488c65c351aaef2ca43b76ba2c76a140ddb36263

SHA256
e67a4fee5022dd0e4c565fcccce426531c625210eba1040bf7b1e32fc9671cda

SHA512
7051a62b8d6ac09727bd7683997eda3e750736c7cbf7274ba42586fdde014a7a8ce8849dcd7a59c62ed0216b2b24d4ab1bcd15794e2458d3c0856f546a261600

Download Submit
C:\Windows\System32\xIpQuus.exe

Filesize
2.7MB

MD5
44dee913b559840cf64f9a0655564b9b

SHA1
e5a67da175547d5d3175149fdffa3d61333e1b9e

SHA256
2285eb80cbb7ef88ee701c7ef1a501bb8d5f03bb5b3f217cb8c4fec2d8955608

SHA512
68a8637d2af8927dca63b2568e144e117c8c8af91006263bfcd28044c25ef30df56a1f5613458a6b686631bf94ef001542bfda1df2efd15c69e8f82329f2e715

Download Submit
memory/228-626-0x00007FF6C3FD0000-0x00007FF6C43C5000-memory.dmp

Filesize
4.0MB

Download
memory/228-1872-0x00007FF6C3FD0000-0x00007FF6C43C5000-memory.dmp

Filesize
4.0MB

Download
memory/872-1880-0x00007FF629180000-0x00007FF629575000-memory.dmp

Filesize
4.0MB

Download
memory/872-633-0x00007FF629180000-0x00007FF629575000-memory.dmp

Filesize
4.0MB

Download
memory/1448-1875-0x00007FF7CD310000-0x00007FF7CD705000-memory.dmp

Filesize
4.0MB

Download
memory/1448-628-0x00007FF7CD310000-0x00007FF7CD705000-memory.dmp

Filesize
4.0MB

Download
memory/1516-1865-0x00007FF6A4290000-0x00007FF6A4685000-memory.dmp

Filesize
4.0MB

Download
memory/1516-18-0x00007FF6A4290000-0x00007FF6A4685000-memory.dmp

Filesize
4.0MB

Download
memory/1516-1868-0x00007FF6A4290000-0x00007FF6A4685000-memory.dmp

Filesize
4.0MB

Download
memory/1544-653-0x00007FF76C4E0000-0x00007FF76C8D5000-memory.dmp

Filesize
4.0MB

Download
memory/1544-1881-0x00007FF76C4E0000-0x00007FF76C8D5000-memory.dmp

Filesize
4.0MB

Download
memory/1920-13-0x00007FF68BE50000-0x00007FF68C245000-memory.dmp

Filesize
4.0MB

Download
memory/1920-1866-0x00007FF68BE50000-0x00007FF68C245000-memory.dmp

Filesize
4.0MB

Download
memory/2592-1876-0x00007FF70CE10000-0x00007FF70D205000-memory.dmp

Filesize
4.0MB

Download
memory/2592-629-0x00007FF70CE10000-0x00007FF70D205000-memory.dmp

Filesize
4.0MB

Download
memory/2688-677-0x00007FF6A5700000-0x00007FF6A5AF5000-memory.dmp

Filesize
4.0MB

Download
memory/2688-1888-0x00007FF6A5700000-0x00007FF6A5AF5000-memory.dmp

Filesize
4.0MB

Download
memory/2864-1873-0x00007FF70F480000-0x00007FF70F875000-memory.dmp

Filesize
4.0MB

Download
memory/2864-640-0x00007FF70F480000-0x00007FF70F875000-memory.dmp

Filesize
4.0MB

Download
memory/2900-669-0x00007FF7ED360000-0x00007FF7ED755000-memory.dmp

Filesize
4.0MB

Download
memory/2900-1889-0x00007FF7ED360000-0x00007FF7ED755000-memory.dmp

Filesize
4.0MB

Download
memory/2920-682-0x00007FF78BE20000-0x00007FF78C215000-memory.dmp

Filesize
4.0MB

Download
memory/2920-1887-0x00007FF78BE20000-0x00007FF78C215000-memory.dmp

Filesize
4.0MB

Download
memory/3064-1869-0x00007FF683CD0000-0x00007FF6840C5000-memory.dmp

Filesize
4.0MB

Download
memory/3064-623-0x00007FF683CD0000-0x00007FF6840C5000-memory.dmp

Filesize
4.0MB

Download
memory/3076-1877-0x00007FF7E2AB0000-0x00007FF7E2EA5000-memory.dmp

Filesize
4.0MB

Download
memory/3076-627-0x00007FF7E2AB0000-0x00007FF7E2EA5000-memory.dmp

Filesize
4.0MB

Download
memory/3104-0-0x00007FF659A60000-0x00007FF659E55000-memory.dmp

Filesize
4.0MB

Download
memory/3104-1864-0x00007FF659A60000-0x00007FF659E55000-memory.dmp

Filesize
4.0MB

Download
memory/3104-1-0x0000017072DC0000-0x0000017072DD0000-memory.dmp

Filesize
64KB

Download
memory/3244-1867-0x00007FF7A3610000-0x00007FF7A3A05000-memory.dmp

Filesize
4.0MB

Download
memory/3244-17-0x00007FF7A3610000-0x00007FF7A3A05000-memory.dmp

Filesize
4.0MB

Download
memory/3552-671-0x00007FF61E6B0000-0x00007FF61EAA5000-memory.dmp

Filesize
4.0MB

Download
memory/3552-1886-0x00007FF61E6B0000-0x00007FF61EAA5000-memory.dmp

Filesize
4.0MB

Download
memory/3572-646-0x00007FF64A440000-0x00007FF64A835000-memory.dmp

Filesize
4.0MB

Download
memory/3572-1879-0x00007FF64A440000-0x00007FF64A835000-memory.dmp

Filesize
4.0MB

Download
memory/3856-1870-0x00007FF62E280000-0x00007FF62E675000-memory.dmp

Filesize
4.0MB

Download
memory/3856-624-0x00007FF62E280000-0x00007FF62E675000-memory.dmp

Filesize
4.0MB

Download
memory/4040-625-0x00007FF7D18A0000-0x00007FF7D1C95000-memory.dmp

Filesize
4.0MB

Download
memory/4040-1878-0x00007FF7D18A0000-0x00007FF7D1C95000-memory.dmp

Filesize
4.0MB

Download
memory/4224-1871-0x00007FF689DD0000-0x00007FF68A1C5000-memory.dmp

Filesize
4.0MB

Download
memory/4224-630-0x00007FF689DD0000-0x00007FF68A1C5000-memory.dmp

Filesize
4.0MB

Download
memory/4276-632-0x00007FF6894E0000-0x00007FF6898D5000-memory.dmp

Filesize
4.0MB

Download
memory/4276-1874-0x00007FF6894E0000-0x00007FF6898D5000-memory.dmp

Filesize
4.0MB

Download
memory/4628-631-0x00007FF6485A0000-0x00007FF648995000-memory.dmp

Filesize
4.0MB

Download
memory/4628-1882-0x00007FF6485A0000-0x00007FF648995000-memory.dmp

Filesize
4.0MB

Download
memory/4784-685-0x00007FF678E30000-0x00007FF679225000-memory.dmp

Filesize
4.0MB

Download
memory/4784-1885-0x00007FF678E30000-0x00007FF679225000-memory.dmp

Filesize
4.0MB

Download
memory/4920-1883-0x00007FF70D6B0000-0x00007FF70DAA5000-memory.dmp

Filesize
4.0MB

Download
memory/4920-666-0x00007FF70D6B0000-0x00007FF70DAA5000-memory.dmp

Filesize
4.0MB

Download
memory/5008-1884-0x00007FF693320000-0x00007FF693715000-memory.dmp

Filesize
4.0MB

Download
memory/5008-663-0x00007FF693320000-0x00007FF693715000-memory.dmp

Filesize
4.0MB

Download