xmrig | 666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
Size

1.5MB
MD5

8d0e188d418cb049e5513521714800c9
SHA1

c4ef9d4a10e47c44dbaa9b6ba94a0da149d05eda
SHA256

666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373
SHA512

4d12c257cbe59e7e9c5074fcb8d7a76cfd830b59523528064832961dd3ad169e5cf880d3aa443957cc7baef6c4c717c0a60ea1ae6961be3511ee00739094a0e5
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcy:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5I

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b35-4.dat	xmrig
behavioral2/files/0x000a000000023b91-6.dat	xmrig
behavioral2/files/0x000b000000023b8d-7.dat	xmrig
behavioral2/files/0x000a000000023b92-19.dat	xmrig
behavioral2/files/0x000a000000023b94-29.dat	xmrig
behavioral2/files/0x000a000000023b96-39.dat	xmrig
behavioral2/files/0x000a000000023b98-49.dat	xmrig
behavioral2/files/0x000a000000023b9a-57.dat	xmrig
behavioral2/files/0x000a000000023b9d-72.dat	xmrig
behavioral2/files/0x000a000000023ba9-97.dat	xmrig
behavioral2/files/0x000e000000023bb0-110.dat	xmrig
behavioral2/files/0x0009000000023bc0-122.dat	xmrig
behavioral2/files/0x000e000000023bc4-135.dat	xmrig
behavioral2/files/0x0008000000023bfc-162.dat	xmrig
behavioral2/files/0x0008000000023bcc-160.dat	xmrig
behavioral2/files/0x0008000000023bfb-157.dat	xmrig
behavioral2/files/0x0008000000023bcb-155.dat	xmrig
behavioral2/files/0x0008000000023bca-150.dat	xmrig
behavioral2/files/0x0008000000023bc9-145.dat	xmrig
behavioral2/files/0x0008000000023bc6-140.dat	xmrig
behavioral2/files/0x0009000000023bbf-125.dat	xmrig
behavioral2/files/0x0009000000023bbe-120.dat	xmrig
behavioral2/files/0x0008000000023bb9-115.dat	xmrig
behavioral2/files/0x000b000000023ba1-100.dat	xmrig
behavioral2/files/0x000b000000023ba0-95.dat	xmrig
behavioral2/files/0x000b000000023b9f-90.dat	xmrig
behavioral2/files/0x000a000000023b9e-85.dat	xmrig
behavioral2/files/0x000a000000023b9c-75.dat	xmrig
behavioral2/files/0x000a000000023b9b-70.dat	xmrig
behavioral2/files/0x000a000000023b99-60.dat	xmrig
behavioral2/files/0x000a000000023b97-47.dat	xmrig
behavioral2/files/0x000a000000023b95-35.dat	xmrig
behavioral2/files/0x000a000000023b93-27.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4432	iHLfxzT.exe
3576	zNUewHm.exe
2880	nJxPRnc.exe
4972	hhTLEKL.exe
3944	kWqyJFd.exe
4932	OtQynHH.exe
2792	WyglTLC.exe
3836	lxCGNrJ.exe
1576	yETjmfk.exe
1972	EsYbKeg.exe
1108	TTWpkvM.exe
1148	aPguabl.exe
2916	fKijXUK.exe
2384	ZzVaCBe.exe
3460	yBvPSxN.exe
1968	kYIkrFj.exe
4032	OdfiMtE.exe
2000	nwUFvSJ.exe
1628	YAmBgcl.exe
3432	tTlFhkT.exe
3192	JplSegB.exe
1532	jdbaRCR.exe
876	AgLCNnX.exe
392	jGiRNSn.exe
2368	HLzqPkd.exe
2568	pvEIbVQ.exe
3464	IaQUGuU.exe
2228	urwNvYl.exe
992	DpfphLX.exe
1764	GJotQhV.exe
1488	DeruZuM.exe
5072	iTnQBkQ.exe
1880	MMRppbi.exe
4920	FZBxrtk.exe
5044	BQeeaQN.exe
708	ruIuoav.exe
452	ofPSOuu.exe
4728	ktXphiz.exe
812	MYBAvUh.exe
3972	ymURFuw.exe
380	QfvVliZ.exe
4060	hAHVYrG.exe
4256	orAKNYZ.exe
3824	tCaXYIt.exe
2532	GuCDgDh.exe
3980	ugQtgSZ.exe
3316	zAkgMwY.exe
2924	taanvhg.exe
4628	OxkDvMm.exe
4532	zMElJCF.exe
2580	ScDWhJo.exe
4176	PRHUZEz.exe
1144	dluCYyc.exe
3488	zJqRHkk.exe
3620	YfyEeLP.exe
4668	rSyIpsP.exe
4456	dwzBtdp.exe
3132	JFjBEPr.exe
3676	gTwoaMn.exe
2008	UtXAJqA.exe
3852	oXvBJkT.exe
4772	cbKcgOB.exe
1872	iJMKmTh.exe
636	rQaGGGH.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JplSegB.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\hlNUwet.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\PxCPnnW.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\rxLGnea.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\CXXSvwp.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\THVLHtV.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\xhMvtZW.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\kqAzjZt.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\GuCDgDh.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\CVHRBxi.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\fgFMYdx.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\fKijXUK.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\JaBJOvL.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\eFdQUHU.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\IFHZwOc.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\bShsNIu.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\KbdTWBv.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\WQHSMCM.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\ccKNBOk.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\hgEcGPF.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\KBFiyqS.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\yETjmfk.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\OAGtvvA.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\XnvwTRR.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\FMgkTCZ.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\znwJrLk.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\OVnIDZC.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\qCNJNiJ.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\iJMKmTh.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\CzsPcUV.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\JGHxHZn.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\zipjaYC.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\bYvdSQN.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\ZVoHzYC.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\xdITbcq.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\wDJtmZd.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\KEoSzBC.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\CUNtoFJ.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\KWjAlns.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\FiELjFk.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\pfoWCZN.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\ySHuYGo.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\tCaXYIt.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\wabXozX.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\UpkRALm.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\TmZtRKa.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\MMRtTcu.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\zlqtRMT.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\OdfiMtE.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\iZQNGYf.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\zDObgga.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\bckJjcH.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\WcbtbXJ.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\QbTWECM.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\QjYMVRl.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\xVeaBou.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\TpXfuMh.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\fUOgpVQ.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\PxKhRuO.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\hwQTbFW.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\OtQynHH.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\aIjKJsw.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\zWDpZAs.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
File created	C:\Windows\System\oBTdmTP.exe	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17400	dwm.exe
Token: SeChangeNotifyPrivilege	17400	dwm.exe
Token: 33	17400	dwm.exe
Token: SeIncBasePriorityPrivilege	17400	dwm.exe
Token: SeShutdownPrivilege	17400	dwm.exe
Token: SeCreatePagefilePrivilege	17400	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 4432	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	84
PID 2356 wrote to memory of 4432	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	84
PID 2356 wrote to memory of 3576	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	85
PID 2356 wrote to memory of 3576	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	85
PID 2356 wrote to memory of 2880	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	86
PID 2356 wrote to memory of 2880	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	86
PID 2356 wrote to memory of 4972	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	87
PID 2356 wrote to memory of 4972	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	87
PID 2356 wrote to memory of 3944	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	88
PID 2356 wrote to memory of 3944	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	88
PID 2356 wrote to memory of 4932	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	89
PID 2356 wrote to memory of 4932	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	89
PID 2356 wrote to memory of 2792	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	90
PID 2356 wrote to memory of 2792	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	90
PID 2356 wrote to memory of 3836	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	91
PID 2356 wrote to memory of 3836	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	91
PID 2356 wrote to memory of 1576	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	92
PID 2356 wrote to memory of 1576	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	92
PID 2356 wrote to memory of 1972	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	93
PID 2356 wrote to memory of 1972	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	93
PID 2356 wrote to memory of 1108	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	94
PID 2356 wrote to memory of 1108	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	94
PID 2356 wrote to memory of 1148	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	95
PID 2356 wrote to memory of 1148	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	95
PID 2356 wrote to memory of 2916	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	96
PID 2356 wrote to memory of 2916	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	96
PID 2356 wrote to memory of 2384	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	97
PID 2356 wrote to memory of 2384	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	97
PID 2356 wrote to memory of 3460	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	98
PID 2356 wrote to memory of 3460	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	98
PID 2356 wrote to memory of 1968	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	99
PID 2356 wrote to memory of 1968	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	99
PID 2356 wrote to memory of 4032	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	100
PID 2356 wrote to memory of 4032	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	100
PID 2356 wrote to memory of 2000	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	101
PID 2356 wrote to memory of 2000	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	101
PID 2356 wrote to memory of 1628	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	102
PID 2356 wrote to memory of 1628	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	102
PID 2356 wrote to memory of 3432	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	103
PID 2356 wrote to memory of 3432	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	103
PID 2356 wrote to memory of 3192	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	104
PID 2356 wrote to memory of 3192	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	104
PID 2356 wrote to memory of 1532	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	105
PID 2356 wrote to memory of 1532	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	105
PID 2356 wrote to memory of 876	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	106
PID 2356 wrote to memory of 876	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	106
PID 2356 wrote to memory of 392	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	107
PID 2356 wrote to memory of 392	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	107
PID 2356 wrote to memory of 2368	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	108
PID 2356 wrote to memory of 2368	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	108
PID 2356 wrote to memory of 2568	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	109
PID 2356 wrote to memory of 2568	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	109
PID 2356 wrote to memory of 3464	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	110
PID 2356 wrote to memory of 3464	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	110
PID 2356 wrote to memory of 2228	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	111
PID 2356 wrote to memory of 2228	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	111
PID 2356 wrote to memory of 992	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	112
PID 2356 wrote to memory of 992	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	112
PID 2356 wrote to memory of 1764	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	113
PID 2356 wrote to memory of 1764	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	113
PID 2356 wrote to memory of 1488	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	114
PID 2356 wrote to memory of 1488	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	114
PID 2356 wrote to memory of 5072	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	115
PID 2356 wrote to memory of 5072	2356	666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe	115

C:\Users\Admin\AppData\Local\Temp\666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe
"C:\Users\Admin\AppData\Local\Temp\666b1b26aa96e554a20ebb151da83ab33a2ad20a13c0d8005ba81957e5c37373.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\System\iHLfxzT.exe
  C:\Windows\System\iHLfxzT.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\zNUewHm.exe
  C:\Windows\System\zNUewHm.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\nJxPRnc.exe
  C:\Windows\System\nJxPRnc.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\hhTLEKL.exe
  C:\Windows\System\hhTLEKL.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\kWqyJFd.exe
  C:\Windows\System\kWqyJFd.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\OtQynHH.exe
  C:\Windows\System\OtQynHH.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\WyglTLC.exe
  C:\Windows\System\WyglTLC.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\lxCGNrJ.exe
  C:\Windows\System\lxCGNrJ.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\yETjmfk.exe
  C:\Windows\System\yETjmfk.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\EsYbKeg.exe
  C:\Windows\System\EsYbKeg.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\TTWpkvM.exe
  C:\Windows\System\TTWpkvM.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\aPguabl.exe
  C:\Windows\System\aPguabl.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\fKijXUK.exe
  C:\Windows\System\fKijXUK.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\ZzVaCBe.exe
  C:\Windows\System\ZzVaCBe.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\yBvPSxN.exe
  C:\Windows\System\yBvPSxN.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\kYIkrFj.exe
  C:\Windows\System\kYIkrFj.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\OdfiMtE.exe
  C:\Windows\System\OdfiMtE.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\nwUFvSJ.exe
  C:\Windows\System\nwUFvSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\YAmBgcl.exe
  C:\Windows\System\YAmBgcl.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\tTlFhkT.exe
  C:\Windows\System\tTlFhkT.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\JplSegB.exe
  C:\Windows\System\JplSegB.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\jdbaRCR.exe
  C:\Windows\System\jdbaRCR.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\AgLCNnX.exe
  C:\Windows\System\AgLCNnX.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\jGiRNSn.exe
  C:\Windows\System\jGiRNSn.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\HLzqPkd.exe
  C:\Windows\System\HLzqPkd.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\pvEIbVQ.exe
  C:\Windows\System\pvEIbVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\IaQUGuU.exe
  C:\Windows\System\IaQUGuU.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\urwNvYl.exe
  C:\Windows\System\urwNvYl.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\DpfphLX.exe
  C:\Windows\System\DpfphLX.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\GJotQhV.exe
  C:\Windows\System\GJotQhV.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\DeruZuM.exe
  C:\Windows\System\DeruZuM.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\iTnQBkQ.exe
  C:\Windows\System\iTnQBkQ.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\MMRppbi.exe
  C:\Windows\System\MMRppbi.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\FZBxrtk.exe
  C:\Windows\System\FZBxrtk.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\BQeeaQN.exe
  C:\Windows\System\BQeeaQN.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\ruIuoav.exe
  C:\Windows\System\ruIuoav.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\ofPSOuu.exe
  C:\Windows\System\ofPSOuu.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\ktXphiz.exe
  C:\Windows\System\ktXphiz.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\MYBAvUh.exe
  C:\Windows\System\MYBAvUh.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\ymURFuw.exe
  C:\Windows\System\ymURFuw.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\QfvVliZ.exe
  C:\Windows\System\QfvVliZ.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\hAHVYrG.exe
  C:\Windows\System\hAHVYrG.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\orAKNYZ.exe
  C:\Windows\System\orAKNYZ.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\tCaXYIt.exe
  C:\Windows\System\tCaXYIt.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\GuCDgDh.exe
  C:\Windows\System\GuCDgDh.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\ugQtgSZ.exe
  C:\Windows\System\ugQtgSZ.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\zAkgMwY.exe
  C:\Windows\System\zAkgMwY.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\taanvhg.exe
  C:\Windows\System\taanvhg.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\OxkDvMm.exe
  C:\Windows\System\OxkDvMm.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\zMElJCF.exe
  C:\Windows\System\zMElJCF.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\ScDWhJo.exe
  C:\Windows\System\ScDWhJo.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\PRHUZEz.exe
  C:\Windows\System\PRHUZEz.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\dluCYyc.exe
  C:\Windows\System\dluCYyc.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\zJqRHkk.exe
  C:\Windows\System\zJqRHkk.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\YfyEeLP.exe
  C:\Windows\System\YfyEeLP.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\rSyIpsP.exe
  C:\Windows\System\rSyIpsP.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\dwzBtdp.exe
  C:\Windows\System\dwzBtdp.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\JFjBEPr.exe
  C:\Windows\System\JFjBEPr.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\gTwoaMn.exe
  C:\Windows\System\gTwoaMn.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\UtXAJqA.exe
  C:\Windows\System\UtXAJqA.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\oXvBJkT.exe
  C:\Windows\System\oXvBJkT.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\cbKcgOB.exe
  C:\Windows\System\cbKcgOB.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\iJMKmTh.exe
  C:\Windows\System\iJMKmTh.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\rQaGGGH.exe
  C:\Windows\System\rQaGGGH.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\zBoxwLX.exe
  C:\Windows\System\zBoxwLX.exe
  2⤵
  PID:444
- C:\Windows\System\ZpBiJEG.exe
  C:\Windows\System\ZpBiJEG.exe
  2⤵
  PID:1696
- C:\Windows\System\WYWXHjh.exe
  C:\Windows\System\WYWXHjh.exe
  2⤵
  PID:3396
- C:\Windows\System\zQbvLCJ.exe
  C:\Windows\System\zQbvLCJ.exe
  2⤵
  PID:2024
- C:\Windows\System\SKEeyPJ.exe
  C:\Windows\System\SKEeyPJ.exe
  2⤵
  PID:3084
- C:\Windows\System\IuXAfjx.exe
  C:\Windows\System\IuXAfjx.exe
  2⤵
  PID:648
- C:\Windows\System\Ermcezl.exe
  C:\Windows\System\Ermcezl.exe
  2⤵
  PID:1068
- C:\Windows\System\MkHgnds.exe
  C:\Windows\System\MkHgnds.exe
  2⤵
  PID:3596
- C:\Windows\System\ZbGDASN.exe
  C:\Windows\System\ZbGDASN.exe
  2⤵
  PID:2364
- C:\Windows\System\dkNSKOj.exe
  C:\Windows\System\dkNSKOj.exe
  2⤵
  PID:4588
- C:\Windows\System\PdmYQqB.exe
  C:\Windows\System\PdmYQqB.exe
  2⤵
  PID:4348
- C:\Windows\System\lmwaoCl.exe
  C:\Windows\System\lmwaoCl.exe
  2⤵
  PID:4872
- C:\Windows\System\kchJYPW.exe
  C:\Windows\System\kchJYPW.exe
  2⤵
  PID:2848
- C:\Windows\System\RTVUzwP.exe
  C:\Windows\System\RTVUzwP.exe
  2⤵
  PID:2480
- C:\Windows\System\JaBJOvL.exe
  C:\Windows\System\JaBJOvL.exe
  2⤵
  PID:908
- C:\Windows\System\dYwrfHY.exe
  C:\Windows\System\dYwrfHY.exe
  2⤵
  PID:4008
- C:\Windows\System\GwiNrMo.exe
  C:\Windows\System\GwiNrMo.exe
  2⤵
  PID:5108
- C:\Windows\System\RJhslGh.exe
  C:\Windows\System\RJhslGh.exe
  2⤵
  PID:5128
- C:\Windows\System\lGxKBaU.exe
  C:\Windows\System\lGxKBaU.exe
  2⤵
  PID:5152
- C:\Windows\System\JKxHOSj.exe
  C:\Windows\System\JKxHOSj.exe
  2⤵
  PID:5172
- C:\Windows\System\tdqQmQo.exe
  C:\Windows\System\tdqQmQo.exe
  2⤵
  PID:5200
- C:\Windows\System\AopAJyy.exe
  C:\Windows\System\AopAJyy.exe
  2⤵
  PID:5236
- C:\Windows\System\PtwSosm.exe
  C:\Windows\System\PtwSosm.exe
  2⤵
  PID:5264
- C:\Windows\System\VSJSLrS.exe
  C:\Windows\System\VSJSLrS.exe
  2⤵
  PID:5296
- C:\Windows\System\LEJzNVa.exe
  C:\Windows\System\LEJzNVa.exe
  2⤵
  PID:5324
- C:\Windows\System\PZiiMpE.exe
  C:\Windows\System\PZiiMpE.exe
  2⤵
  PID:5348
- C:\Windows\System\pVjKXxt.exe
  C:\Windows\System\pVjKXxt.exe
  2⤵
  PID:5380
- C:\Windows\System\xdITbcq.exe
  C:\Windows\System\xdITbcq.exe
  2⤵
  PID:5404
- C:\Windows\System\XjCpCyu.exe
  C:\Windows\System\XjCpCyu.exe
  2⤵
  PID:5424
- C:\Windows\System\CogNyZe.exe
  C:\Windows\System\CogNyZe.exe
  2⤵
  PID:5452
- C:\Windows\System\lAospwB.exe
  C:\Windows\System\lAospwB.exe
  2⤵
  PID:5480
- C:\Windows\System\urBUddv.exe
  C:\Windows\System\urBUddv.exe
  2⤵
  PID:5504
- C:\Windows\System\dbpdChu.exe
  C:\Windows\System\dbpdChu.exe
  2⤵
  PID:5536
- C:\Windows\System\BYjYrpd.exe
  C:\Windows\System\BYjYrpd.exe
  2⤵
  PID:5564
- C:\Windows\System\CqIZMAT.exe
  C:\Windows\System\CqIZMAT.exe
  2⤵
  PID:5588
- C:\Windows\System\CHkzAoi.exe
  C:\Windows\System\CHkzAoi.exe
  2⤵
  PID:5620
- C:\Windows\System\pLszsyW.exe
  C:\Windows\System\pLszsyW.exe
  2⤵
  PID:5648
- C:\Windows\System\zwGlzsx.exe
  C:\Windows\System\zwGlzsx.exe
  2⤵
  PID:5676
- C:\Windows\System\thcyiYf.exe
  C:\Windows\System\thcyiYf.exe
  2⤵
  PID:5700
- C:\Windows\System\jotnSgQ.exe
  C:\Windows\System\jotnSgQ.exe
  2⤵
  PID:5732
- C:\Windows\System\WhTFbmE.exe
  C:\Windows\System\WhTFbmE.exe
  2⤵
  PID:5760
- C:\Windows\System\aIjKJsw.exe
  C:\Windows\System\aIjKJsw.exe
  2⤵
  PID:5788
- C:\Windows\System\jqtWhJe.exe
  C:\Windows\System\jqtWhJe.exe
  2⤵
  PID:5816
- C:\Windows\System\mlfsDvP.exe
  C:\Windows\System\mlfsDvP.exe
  2⤵
  PID:5844
- C:\Windows\System\cPyYfCZ.exe
  C:\Windows\System\cPyYfCZ.exe
  2⤵
  PID:5876
- C:\Windows\System\swOwOyF.exe
  C:\Windows\System\swOwOyF.exe
  2⤵
  PID:5908
- C:\Windows\System\bShsNIu.exe
  C:\Windows\System\bShsNIu.exe
  2⤵
  PID:5940
- C:\Windows\System\WLlDIVA.exe
  C:\Windows\System\WLlDIVA.exe
  2⤵
  PID:5964
- C:\Windows\System\jWTbQey.exe
  C:\Windows\System\jWTbQey.exe
  2⤵
  PID:5988
- C:\Windows\System\AHxnyFy.exe
  C:\Windows\System\AHxnyFy.exe
  2⤵
  PID:6020
- C:\Windows\System\ccKNBOk.exe
  C:\Windows\System\ccKNBOk.exe
  2⤵
  PID:6048
- C:\Windows\System\gNbjYNj.exe
  C:\Windows\System\gNbjYNj.exe
  2⤵
  PID:6080
- C:\Windows\System\CNhppEP.exe
  C:\Windows\System\CNhppEP.exe
  2⤵
  PID:6104
- C:\Windows\System\qhfxoql.exe
  C:\Windows\System\qhfxoql.exe
  2⤵
  PID:6124
- C:\Windows\System\OvRnORd.exe
  C:\Windows\System\OvRnORd.exe
  2⤵
  PID:4876
- C:\Windows\System\bQaBuMH.exe
  C:\Windows\System\bQaBuMH.exe
  2⤵
  PID:3260
- C:\Windows\System\bxjbIrU.exe
  C:\Windows\System\bxjbIrU.exe
  2⤵
  PID:1464
- C:\Windows\System\fLKUHQK.exe
  C:\Windows\System\fLKUHQK.exe
  2⤵
  PID:5148
- C:\Windows\System\hneTXUj.exe
  C:\Windows\System\hneTXUj.exe
  2⤵
  PID:5188
- C:\Windows\System\irHydjv.exe
  C:\Windows\System\irHydjv.exe
  2⤵
  PID:5224
- C:\Windows\System\rxitEHf.exe
  C:\Windows\System\rxitEHf.exe
  2⤵
  PID:5284
- C:\Windows\System\POrEGHd.exe
  C:\Windows\System\POrEGHd.exe
  2⤵
  PID:5360
- C:\Windows\System\REguzcq.exe
  C:\Windows\System\REguzcq.exe
  2⤵
  PID:5412
- C:\Windows\System\TIeoWBO.exe
  C:\Windows\System\TIeoWBO.exe
  2⤵
  PID:5468
- C:\Windows\System\iaDETbI.exe
  C:\Windows\System\iaDETbI.exe
  2⤵
  PID:5516
- C:\Windows\System\fOjsIzg.exe
  C:\Windows\System\fOjsIzg.exe
  2⤵
  PID:5656
- C:\Windows\System\tMQdXjo.exe
  C:\Windows\System\tMQdXjo.exe
  2⤵
  PID:4328
- C:\Windows\System\AqObpqE.exe
  C:\Windows\System\AqObpqE.exe
  2⤵
  PID:5712
- C:\Windows\System\HLABMRI.exe
  C:\Windows\System\HLABMRI.exe
  2⤵
  PID:1892
- C:\Windows\System\syZyask.exe
  C:\Windows\System\syZyask.exe
  2⤵
  PID:5752
- C:\Windows\System\UwLLsPR.exe
  C:\Windows\System\UwLLsPR.exe
  2⤵
  PID:5808
- C:\Windows\System\ilEFWyR.exe
  C:\Windows\System\ilEFWyR.exe
  2⤵
  PID:2988
- C:\Windows\System\ylLjmzm.exe
  C:\Windows\System\ylLjmzm.exe
  2⤵
  PID:5896
- C:\Windows\System\yVTbARU.exe
  C:\Windows\System\yVTbARU.exe
  2⤵
  PID:4508
- C:\Windows\System\CxSVYRU.exe
  C:\Windows\System\CxSVYRU.exe
  2⤵
  PID:5984
- C:\Windows\System\tkCITvy.exe
  C:\Windows\System\tkCITvy.exe
  2⤵
  PID:5068
- C:\Windows\System\sEpFCyM.exe
  C:\Windows\System\sEpFCyM.exe
  2⤵
  PID:6064
- C:\Windows\System\CzsPcUV.exe
  C:\Windows\System\CzsPcUV.exe
  2⤵
  PID:6100
- C:\Windows\System\pZhwFit.exe
  C:\Windows\System\pZhwFit.exe
  2⤵
  PID:1212
- C:\Windows\System\euhlpJY.exe
  C:\Windows\System\euhlpJY.exe
  2⤵
  PID:6140
- C:\Windows\System\AjUfhhc.exe
  C:\Windows\System\AjUfhhc.exe
  2⤵
  PID:1832
- C:\Windows\System\raqpIQz.exe
  C:\Windows\System\raqpIQz.exe
  2⤵
  PID:4384
- C:\Windows\System\FMgkTCZ.exe
  C:\Windows\System\FMgkTCZ.exe
  2⤵
  PID:4360
- C:\Windows\System\jsBdaFj.exe
  C:\Windows\System\jsBdaFj.exe
  2⤵
  PID:5216
- C:\Windows\System\ddchEbR.exe
  C:\Windows\System\ddchEbR.exe
  2⤵
  PID:5248
- C:\Windows\System\XdxOVsY.exe
  C:\Windows\System\XdxOVsY.exe
  2⤵
  PID:5400
- C:\Windows\System\LcYdwGr.exe
  C:\Windows\System\LcYdwGr.exe
  2⤵
  PID:5600
- C:\Windows\System\YyBtbTr.exe
  C:\Windows\System\YyBtbTr.exe
  2⤵
  PID:5696
- C:\Windows\System\ZZWQorv.exe
  C:\Windows\System\ZZWQorv.exe
  2⤵
  PID:5740
- C:\Windows\System\BTkjTLF.exe
  C:\Windows\System\BTkjTLF.exe
  2⤵
  PID:2420
- C:\Windows\System\wmzmdrJ.exe
  C:\Windows\System\wmzmdrJ.exe
  2⤵
  PID:3936
- C:\Windows\System\OyhlKWT.exe
  C:\Windows\System\OyhlKWT.exe
  2⤵
  PID:1648
- C:\Windows\System\nXdAsfI.exe
  C:\Windows\System\nXdAsfI.exe
  2⤵
  PID:3124
- C:\Windows\System\YLfVITA.exe
  C:\Windows\System\YLfVITA.exe
  2⤵
  PID:3040
- C:\Windows\System\lxPbova.exe
  C:\Windows\System\lxPbova.exe
  2⤵
  PID:5580
- C:\Windows\System\ScAziNa.exe
  C:\Windows\System\ScAziNa.exe
  2⤵
  PID:5948
- C:\Windows\System\MqXaqMA.exe
  C:\Windows\System\MqXaqMA.exe
  2⤵
  PID:900
- C:\Windows\System\dcleMMJ.exe
  C:\Windows\System\dcleMMJ.exe
  2⤵
  PID:4832
- C:\Windows\System\btTeHfE.exe
  C:\Windows\System\btTeHfE.exe
  2⤵
  PID:5584
- C:\Windows\System\LKZhIsZ.exe
  C:\Windows\System\LKZhIsZ.exe
  2⤵
  PID:5276
- C:\Windows\System\uNRPvAI.exe
  C:\Windows\System\uNRPvAI.exe
  2⤵
  PID:6160
- C:\Windows\System\cVzBoAI.exe
  C:\Windows\System\cVzBoAI.exe
  2⤵
  PID:6196
- C:\Windows\System\MGClYZB.exe
  C:\Windows\System\MGClYZB.exe
  2⤵
  PID:6228
- C:\Windows\System\nrqvMlP.exe
  C:\Windows\System\nrqvMlP.exe
  2⤵
  PID:6244
- C:\Windows\System\NGquYLf.exe
  C:\Windows\System\NGquYLf.exe
  2⤵
  PID:6272
- C:\Windows\System\auLUbAI.exe
  C:\Windows\System\auLUbAI.exe
  2⤵
  PID:6300
- C:\Windows\System\aKjgCRQ.exe
  C:\Windows\System\aKjgCRQ.exe
  2⤵
  PID:6328
- C:\Windows\System\eDWBpQW.exe
  C:\Windows\System\eDWBpQW.exe
  2⤵
  PID:6344
- C:\Windows\System\qJGIwYl.exe
  C:\Windows\System\qJGIwYl.exe
  2⤵
  PID:6360
- C:\Windows\System\APSXTSt.exe
  C:\Windows\System\APSXTSt.exe
  2⤵
  PID:6384
- C:\Windows\System\wDJtmZd.exe
  C:\Windows\System\wDJtmZd.exe
  2⤵
  PID:6452
- C:\Windows\System\iZQNGYf.exe
  C:\Windows\System\iZQNGYf.exe
  2⤵
  PID:6476
- C:\Windows\System\KHEYwWG.exe
  C:\Windows\System\KHEYwWG.exe
  2⤵
  PID:6496
- C:\Windows\System\zzGvovp.exe
  C:\Windows\System\zzGvovp.exe
  2⤵
  PID:6524
- C:\Windows\System\XpKnLSq.exe
  C:\Windows\System\XpKnLSq.exe
  2⤵
  PID:6564
- C:\Windows\System\LtGHpio.exe
  C:\Windows\System\LtGHpio.exe
  2⤵
  PID:6580
- C:\Windows\System\VuhjTYk.exe
  C:\Windows\System\VuhjTYk.exe
  2⤵
  PID:6596
- C:\Windows\System\OYLBuyP.exe
  C:\Windows\System\OYLBuyP.exe
  2⤵
  PID:6612
- C:\Windows\System\lSTvljH.exe
  C:\Windows\System\lSTvljH.exe
  2⤵
  PID:6640
- C:\Windows\System\zDObgga.exe
  C:\Windows\System\zDObgga.exe
  2⤵
  PID:6660
- C:\Windows\System\LNtoWhY.exe
  C:\Windows\System\LNtoWhY.exe
  2⤵
  PID:6680
- C:\Windows\System\dOPKGYL.exe
  C:\Windows\System\dOPKGYL.exe
  2⤵
  PID:6708
- C:\Windows\System\YdoMicf.exe
  C:\Windows\System\YdoMicf.exe
  2⤵
  PID:6728
- C:\Windows\System\xbSAIRe.exe
  C:\Windows\System\xbSAIRe.exe
  2⤵
  PID:6788
- C:\Windows\System\lnlzVUy.exe
  C:\Windows\System\lnlzVUy.exe
  2⤵
  PID:6804
- C:\Windows\System\LHLYAdN.exe
  C:\Windows\System\LHLYAdN.exe
  2⤵
  PID:6824
- C:\Windows\System\ePfnIlo.exe
  C:\Windows\System\ePfnIlo.exe
  2⤵
  PID:6852
- C:\Windows\System\iWzbRqj.exe
  C:\Windows\System\iWzbRqj.exe
  2⤵
  PID:6880
- C:\Windows\System\SGhfxdV.exe
  C:\Windows\System\SGhfxdV.exe
  2⤵
  PID:6916
- C:\Windows\System\hlNUwet.exe
  C:\Windows\System\hlNUwet.exe
  2⤵
  PID:6984
- C:\Windows\System\vBLxRKu.exe
  C:\Windows\System\vBLxRKu.exe
  2⤵
  PID:7012
- C:\Windows\System\OQHezEM.exe
  C:\Windows\System\OQHezEM.exe
  2⤵
  PID:7040
- C:\Windows\System\YJQKhVJ.exe
  C:\Windows\System\YJQKhVJ.exe
  2⤵
  PID:7056
- C:\Windows\System\eZCAFWb.exe
  C:\Windows\System\eZCAFWb.exe
  2⤵
  PID:7072
- C:\Windows\System\hHGZeZa.exe
  C:\Windows\System\hHGZeZa.exe
  2⤵
  PID:7088
- C:\Windows\System\UKRgnbi.exe
  C:\Windows\System\UKRgnbi.exe
  2⤵
  PID:7104
- C:\Windows\System\ItnwTws.exe
  C:\Windows\System\ItnwTws.exe
  2⤵
  PID:7120
- C:\Windows\System\LbaLfrI.exe
  C:\Windows\System\LbaLfrI.exe
  2⤵
  PID:7160
- C:\Windows\System\gKmTbeu.exe
  C:\Windows\System\gKmTbeu.exe
  2⤵
  PID:6012
- C:\Windows\System\zWDpZAs.exe
  C:\Windows\System\zWDpZAs.exe
  2⤵
  PID:6188
- C:\Windows\System\AlOQloE.exe
  C:\Windows\System\AlOQloE.exe
  2⤵
  PID:6240
- C:\Windows\System\RWeilhg.exe
  C:\Windows\System\RWeilhg.exe
  2⤵
  PID:6256
- C:\Windows\System\rTZqICE.exe
  C:\Windows\System\rTZqICE.exe
  2⤵
  PID:6376
- C:\Windows\System\mIWgASW.exe
  C:\Windows\System\mIWgASW.exe
  2⤵
  PID:6380
- C:\Windows\System\sBwaQLA.exe
  C:\Windows\System\sBwaQLA.exe
  2⤵
  PID:6440
- C:\Windows\System\ZpXIxuA.exe
  C:\Windows\System\ZpXIxuA.exe
  2⤵
  PID:6520
- C:\Windows\System\aPwdsGA.exe
  C:\Windows\System\aPwdsGA.exe
  2⤵
  PID:6756
- C:\Windows\System\ONaHShA.exe
  C:\Windows\System\ONaHShA.exe
  2⤵
  PID:6812
- C:\Windows\System\tzaTDhZ.exe
  C:\Windows\System\tzaTDhZ.exe
  2⤵
  PID:6900
- C:\Windows\System\YCUIMCr.exe
  C:\Windows\System\YCUIMCr.exe
  2⤵
  PID:7032
- C:\Windows\System\JGHxHZn.exe
  C:\Windows\System\JGHxHZn.exe
  2⤵
  PID:7064
- C:\Windows\System\qMmiNrb.exe
  C:\Windows\System\qMmiNrb.exe
  2⤵
  PID:7116
- C:\Windows\System\HAKylpV.exe
  C:\Windows\System\HAKylpV.exe
  2⤵
  PID:1396
- C:\Windows\System\OnvukRW.exe
  C:\Windows\System\OnvukRW.exe
  2⤵
  PID:6220
- C:\Windows\System\AYoBMMY.exe
  C:\Windows\System\AYoBMMY.exe
  2⤵
  PID:2484
- C:\Windows\System\gaubRwt.exe
  C:\Windows\System\gaubRwt.exe
  2⤵
  PID:3804
- C:\Windows\System\rstxgEY.exe
  C:\Windows\System\rstxgEY.exe
  2⤵
  PID:6592
- C:\Windows\System\DgoVytf.exe
  C:\Windows\System\DgoVytf.exe
  2⤵
  PID:6652
- C:\Windows\System\GldJDXU.exe
  C:\Windows\System\GldJDXU.exe
  2⤵
  PID:6492
- C:\Windows\System\pCMkdMb.exe
  C:\Windows\System\pCMkdMb.exe
  2⤵
  PID:6972
- C:\Windows\System\RcVTmZR.exe
  C:\Windows\System\RcVTmZR.exe
  2⤵
  PID:4620
- C:\Windows\System\oxTRrmE.exe
  C:\Windows\System\oxTRrmE.exe
  2⤵
  PID:5668
- C:\Windows\System\DwqBzGb.exe
  C:\Windows\System\DwqBzGb.exe
  2⤵
  PID:6316
- C:\Windows\System\qBmHAwt.exe
  C:\Windows\System\qBmHAwt.exe
  2⤵
  PID:3928
- C:\Windows\System\bAXBYyQ.exe
  C:\Windows\System\bAXBYyQ.exe
  2⤵
  PID:552
- C:\Windows\System\aWqhxAI.exe
  C:\Windows\System\aWqhxAI.exe
  2⤵
  PID:6940
- C:\Windows\System\oVzAykk.exe
  C:\Windows\System\oVzAykk.exe
  2⤵
  PID:7140
- C:\Windows\System\TiUoghJ.exe
  C:\Windows\System\TiUoghJ.exe
  2⤵
  PID:4988
- C:\Windows\System\vyzKthH.exe
  C:\Windows\System\vyzKthH.exe
  2⤵
  PID:6912
- C:\Windows\System\rlgMfsD.exe
  C:\Windows\System\rlgMfsD.exe
  2⤵
  PID:1592
- C:\Windows\System\priPxse.exe
  C:\Windows\System\priPxse.exe
  2⤵
  PID:7192
- C:\Windows\System\aAEuHCm.exe
  C:\Windows\System\aAEuHCm.exe
  2⤵
  PID:7212
- C:\Windows\System\YMbNuuC.exe
  C:\Windows\System\YMbNuuC.exe
  2⤵
  PID:7260
- C:\Windows\System\CapesQG.exe
  C:\Windows\System\CapesQG.exe
  2⤵
  PID:7280
- C:\Windows\System\znwJrLk.exe
  C:\Windows\System\znwJrLk.exe
  2⤵
  PID:7316
- C:\Windows\System\qcopfbt.exe
  C:\Windows\System\qcopfbt.exe
  2⤵
  PID:7344
- C:\Windows\System\GSgxYur.exe
  C:\Windows\System\GSgxYur.exe
  2⤵
  PID:7360
- C:\Windows\System\bckJjcH.exe
  C:\Windows\System\bckJjcH.exe
  2⤵
  PID:7400
- C:\Windows\System\trKDmBv.exe
  C:\Windows\System\trKDmBv.exe
  2⤵
  PID:7416
- C:\Windows\System\rIvzPRh.exe
  C:\Windows\System\rIvzPRh.exe
  2⤵
  PID:7448
- C:\Windows\System\VkdWQUT.exe
  C:\Windows\System\VkdWQUT.exe
  2⤵
  PID:7472
- C:\Windows\System\nbZRPrG.exe
  C:\Windows\System\nbZRPrG.exe
  2⤵
  PID:7500
- C:\Windows\System\yknnAfP.exe
  C:\Windows\System\yknnAfP.exe
  2⤵
  PID:7540
- C:\Windows\System\rTbbsHX.exe
  C:\Windows\System\rTbbsHX.exe
  2⤵
  PID:7568
- C:\Windows\System\JQiyPQA.exe
  C:\Windows\System\JQiyPQA.exe
  2⤵
  PID:7584
- C:\Windows\System\WyASEPu.exe
  C:\Windows\System\WyASEPu.exe
  2⤵
  PID:7612
- C:\Windows\System\ovjXDXZ.exe
  C:\Windows\System\ovjXDXZ.exe
  2⤵
  PID:7640
- C:\Windows\System\TfcGLsC.exe
  C:\Windows\System\TfcGLsC.exe
  2⤵
  PID:7680
- C:\Windows\System\HShjEsn.exe
  C:\Windows\System\HShjEsn.exe
  2⤵
  PID:7696
- C:\Windows\System\tQpIWvK.exe
  C:\Windows\System\tQpIWvK.exe
  2⤵
  PID:7724
- C:\Windows\System\cZwzkAn.exe
  C:\Windows\System\cZwzkAn.exe
  2⤵
  PID:7752
- C:\Windows\System\loJpQKU.exe
  C:\Windows\System\loJpQKU.exe
  2⤵
  PID:7780
- C:\Windows\System\rqySDYX.exe
  C:\Windows\System\rqySDYX.exe
  2⤵
  PID:7808
- C:\Windows\System\HwsLyMZ.exe
  C:\Windows\System\HwsLyMZ.exe
  2⤵
  PID:7848
- C:\Windows\System\ZDWDNon.exe
  C:\Windows\System\ZDWDNon.exe
  2⤵
  PID:7872
- C:\Windows\System\hMrCQvM.exe
  C:\Windows\System\hMrCQvM.exe
  2⤵
  PID:7904
- C:\Windows\System\AloVWAB.exe
  C:\Windows\System\AloVWAB.exe
  2⤵
  PID:7920
- C:\Windows\System\dvhGoZT.exe
  C:\Windows\System\dvhGoZT.exe
  2⤵
  PID:7948
- C:\Windows\System\JmQAQkH.exe
  C:\Windows\System\JmQAQkH.exe
  2⤵
  PID:7976
- C:\Windows\System\WYPVqGU.exe
  C:\Windows\System\WYPVqGU.exe
  2⤵
  PID:8004
- C:\Windows\System\hxyhXru.exe
  C:\Windows\System\hxyhXru.exe
  2⤵
  PID:8032
- C:\Windows\System\zyFgcgS.exe
  C:\Windows\System\zyFgcgS.exe
  2⤵
  PID:8048
- C:\Windows\System\zbUQvzv.exe
  C:\Windows\System\zbUQvzv.exe
  2⤵
  PID:8076
- C:\Windows\System\zjuePGK.exe
  C:\Windows\System\zjuePGK.exe
  2⤵
  PID:8136
- C:\Windows\System\rqfkilr.exe
  C:\Windows\System\rqfkilr.exe
  2⤵
  PID:8152
- C:\Windows\System\mDShijH.exe
  C:\Windows\System\mDShijH.exe
  2⤵
  PID:8176
- C:\Windows\System\XtXRrig.exe
  C:\Windows\System\XtXRrig.exe
  2⤵
  PID:4852
- C:\Windows\System\uIUBJLj.exe
  C:\Windows\System\uIUBJLj.exe
  2⤵
  PID:7172
- C:\Windows\System\hiIJxax.exe
  C:\Windows\System\hiIJxax.exe
  2⤵
  PID:7308
- C:\Windows\System\ethxTPr.exe
  C:\Windows\System\ethxTPr.exe
  2⤵
  PID:7352
- C:\Windows\System\iAUoykr.exe
  C:\Windows\System\iAUoykr.exe
  2⤵
  PID:7412
- C:\Windows\System\YZLVZSK.exe
  C:\Windows\System\YZLVZSK.exe
  2⤵
  PID:7456
- C:\Windows\System\cJYfwek.exe
  C:\Windows\System\cJYfwek.exe
  2⤵
  PID:7528
- C:\Windows\System\TOGTaxW.exe
  C:\Windows\System\TOGTaxW.exe
  2⤵
  PID:7576
- C:\Windows\System\BkJxWJd.exe
  C:\Windows\System\BkJxWJd.exe
  2⤵
  PID:7708
- C:\Windows\System\TmbqIxV.exe
  C:\Windows\System\TmbqIxV.exe
  2⤵
  PID:7740
- C:\Windows\System\kzUYHdc.exe
  C:\Windows\System\kzUYHdc.exe
  2⤵
  PID:7748
- C:\Windows\System\jrmHaGs.exe
  C:\Windows\System\jrmHaGs.exe
  2⤵
  PID:7824
- C:\Windows\System\rPNtKkd.exe
  C:\Windows\System\rPNtKkd.exe
  2⤵
  PID:7916
- C:\Windows\System\cihRkwT.exe
  C:\Windows\System\cihRkwT.exe
  2⤵
  PID:8000
- C:\Windows\System\beukhMf.exe
  C:\Windows\System\beukhMf.exe
  2⤵
  PID:8044
- C:\Windows\System\oFAVgge.exe
  C:\Windows\System\oFAVgge.exe
  2⤵
  PID:1392
- C:\Windows\System\lFOspYv.exe
  C:\Windows\System\lFOspYv.exe
  2⤵
  PID:8144
- C:\Windows\System\QZEfqCa.exe
  C:\Windows\System\QZEfqCa.exe
  2⤵
  PID:7176
- C:\Windows\System\gtsYqqI.exe
  C:\Windows\System\gtsYqqI.exe
  2⤵
  PID:7396
- C:\Windows\System\cHPXQwh.exe
  C:\Windows\System\cHPXQwh.exe
  2⤵
  PID:7496
- C:\Windows\System\DtpvSnN.exe
  C:\Windows\System\DtpvSnN.exe
  2⤵
  PID:1644
- C:\Windows\System\LAhtzqW.exe
  C:\Windows\System\LAhtzqW.exe
  2⤵
  PID:7796
- C:\Windows\System\vUehXjk.exe
  C:\Windows\System\vUehXjk.exe
  2⤵
  PID:7868
- C:\Windows\System\KBpCeGE.exe
  C:\Windows\System\KBpCeGE.exe
  2⤵
  PID:7960
- C:\Windows\System\aDujAPX.exe
  C:\Windows\System\aDujAPX.exe
  2⤵
  PID:8100
- C:\Windows\System\SjrcZEh.exe
  C:\Windows\System\SjrcZEh.exe
  2⤵
  PID:7240
- C:\Windows\System\qGnnxdw.exe
  C:\Windows\System\qGnnxdw.exe
  2⤵
  PID:7772
- C:\Windows\System\aNKLpWA.exe
  C:\Windows\System\aNKLpWA.exe
  2⤵
  PID:8168
- C:\Windows\System\zSKFmuW.exe
  C:\Windows\System\zSKFmuW.exe
  2⤵
  PID:7676
- C:\Windows\System\NZpQMxX.exe
  C:\Windows\System\NZpQMxX.exe
  2⤵
  PID:8148
- C:\Windows\System\CcVNCmz.exe
  C:\Windows\System\CcVNCmz.exe
  2⤵
  PID:8228
- C:\Windows\System\hDetwmU.exe
  C:\Windows\System\hDetwmU.exe
  2⤵
  PID:8256
- C:\Windows\System\vShODHg.exe
  C:\Windows\System\vShODHg.exe
  2⤵
  PID:8288
- C:\Windows\System\yMwkhZh.exe
  C:\Windows\System\yMwkhZh.exe
  2⤵
  PID:8316
- C:\Windows\System\gdbaUMI.exe
  C:\Windows\System\gdbaUMI.exe
  2⤵
  PID:8332
- C:\Windows\System\aHLVkBc.exe
  C:\Windows\System\aHLVkBc.exe
  2⤵
  PID:8360
- C:\Windows\System\LyDojzD.exe
  C:\Windows\System\LyDojzD.exe
  2⤵
  PID:8376
- C:\Windows\System\JyfDMZT.exe
  C:\Windows\System\JyfDMZT.exe
  2⤵
  PID:8404
- C:\Windows\System\IDizqrZ.exe
  C:\Windows\System\IDizqrZ.exe
  2⤵
  PID:8428
- C:\Windows\System\TcKRDpi.exe
  C:\Windows\System\TcKRDpi.exe
  2⤵
  PID:8464
- C:\Windows\System\MCGPLUW.exe
  C:\Windows\System\MCGPLUW.exe
  2⤵
  PID:8512
- C:\Windows\System\aFBSmJW.exe
  C:\Windows\System\aFBSmJW.exe
  2⤵
  PID:8540
- C:\Windows\System\wWqjRZh.exe
  C:\Windows\System\wWqjRZh.exe
  2⤵
  PID:8564
- C:\Windows\System\bTeFHWM.exe
  C:\Windows\System\bTeFHWM.exe
  2⤵
  PID:8584
- C:\Windows\System\TnnVpxK.exe
  C:\Windows\System\TnnVpxK.exe
  2⤵
  PID:8612
- C:\Windows\System\ZaoAJsH.exe
  C:\Windows\System\ZaoAJsH.exe
  2⤵
  PID:8640
- C:\Windows\System\cruFYkw.exe
  C:\Windows\System\cruFYkw.exe
  2⤵
  PID:8676
- C:\Windows\System\BByYLbU.exe
  C:\Windows\System\BByYLbU.exe
  2⤵
  PID:8696
- C:\Windows\System\whgEFYS.exe
  C:\Windows\System\whgEFYS.exe
  2⤵
  PID:8712
- C:\Windows\System\sQstGOe.exe
  C:\Windows\System\sQstGOe.exe
  2⤵
  PID:8728
- C:\Windows\System\XwRRIUq.exe
  C:\Windows\System\XwRRIUq.exe
  2⤵
  PID:8768
- C:\Windows\System\bBEIRNv.exe
  C:\Windows\System\bBEIRNv.exe
  2⤵
  PID:8796
- C:\Windows\System\nzeIqZG.exe
  C:\Windows\System\nzeIqZG.exe
  2⤵
  PID:8848
- C:\Windows\System\jIZnBEJ.exe
  C:\Windows\System\jIZnBEJ.exe
  2⤵
  PID:8876
- C:\Windows\System\MBNGeLI.exe
  C:\Windows\System\MBNGeLI.exe
  2⤵
  PID:8904
- C:\Windows\System\KkXwOOv.exe
  C:\Windows\System\KkXwOOv.exe
  2⤵
  PID:8936
- C:\Windows\System\FckzydN.exe
  C:\Windows\System\FckzydN.exe
  2⤵
  PID:8976
- C:\Windows\System\LQSwyhC.exe
  C:\Windows\System\LQSwyhC.exe
  2⤵
  PID:9004
- C:\Windows\System\WcbtbXJ.exe
  C:\Windows\System\WcbtbXJ.exe
  2⤵
  PID:9028
- C:\Windows\System\uLdAykL.exe
  C:\Windows\System\uLdAykL.exe
  2⤵
  PID:9044
- C:\Windows\System\xeNngnq.exe
  C:\Windows\System\xeNngnq.exe
  2⤵
  PID:9060
- C:\Windows\System\IKMLouR.exe
  C:\Windows\System\IKMLouR.exe
  2⤵
  PID:9088
- C:\Windows\System\DltzJdV.exe
  C:\Windows\System\DltzJdV.exe
  2⤵
  PID:9124
- C:\Windows\System\wIlQSST.exe
  C:\Windows\System\wIlQSST.exe
  2⤵
  PID:9144
- C:\Windows\System\gFncNJs.exe
  C:\Windows\System\gFncNJs.exe
  2⤵
  PID:9180
- C:\Windows\System\iJzxcmm.exe
  C:\Windows\System\iJzxcmm.exe
  2⤵
  PID:9208
- C:\Windows\System\TLxgHLf.exe
  C:\Windows\System\TLxgHLf.exe
  2⤵
  PID:8244
- C:\Windows\System\vaEYzSN.exe
  C:\Windows\System\vaEYzSN.exe
  2⤵
  PID:8308
- C:\Windows\System\xCKFlCo.exe
  C:\Windows\System\xCKFlCo.exe
  2⤵
  PID:1272
- C:\Windows\System\mhSrUxo.exe
  C:\Windows\System\mhSrUxo.exe
  2⤵
  PID:8372
- C:\Windows\System\rJAGLWa.exe
  C:\Windows\System\rJAGLWa.exe
  2⤵
  PID:8424
- C:\Windows\System\PxKhRuO.exe
  C:\Windows\System\PxKhRuO.exe
  2⤵
  PID:8528
- C:\Windows\System\WhVdEDj.exe
  C:\Windows\System\WhVdEDj.exe
  2⤵
  PID:8576
- C:\Windows\System\wedLwWm.exe
  C:\Windows\System\wedLwWm.exe
  2⤵
  PID:8672
- C:\Windows\System\ydNxczj.exe
  C:\Windows\System\ydNxczj.exe
  2⤵
  PID:8704
- C:\Windows\System\ENvuWGG.exe
  C:\Windows\System\ENvuWGG.exe
  2⤵
  PID:8868
- C:\Windows\System\qHjvdsa.exe
  C:\Windows\System\qHjvdsa.exe
  2⤵
  PID:8888
- C:\Windows\System\WczoWpG.exe
  C:\Windows\System\WczoWpG.exe
  2⤵
  PID:8968
- C:\Windows\System\eVfZVjN.exe
  C:\Windows\System\eVfZVjN.exe
  2⤵
  PID:3608
- C:\Windows\System\TcuFttu.exe
  C:\Windows\System\TcuFttu.exe
  2⤵
  PID:8120
- C:\Windows\System\mXVnPjf.exe
  C:\Windows\System\mXVnPjf.exe
  2⤵
  PID:9080
- C:\Windows\System\eFdQUHU.exe
  C:\Windows\System\eFdQUHU.exe
  2⤵
  PID:9164
- C:\Windows\System\oxblVxP.exe
  C:\Windows\System\oxblVxP.exe
  2⤵
  PID:8016
- C:\Windows\System\eaTWOEc.exe
  C:\Windows\System\eaTWOEc.exe
  2⤵
  PID:3644
- C:\Windows\System\qDiWaYG.exe
  C:\Windows\System\qDiWaYG.exe
  2⤵
  PID:8420
- C:\Windows\System\plPrilj.exe
  C:\Windows\System\plPrilj.exe
  2⤵
  PID:8708
- C:\Windows\System\PxCPnnW.exe
  C:\Windows\System\PxCPnnW.exe
  2⤵
  PID:8844
- C:\Windows\System\gUiuOBJ.exe
  C:\Windows\System\gUiuOBJ.exe
  2⤵
  PID:8892
- C:\Windows\System\mpwGlQo.exe
  C:\Windows\System\mpwGlQo.exe
  2⤵
  PID:9136
- C:\Windows\System\ZaCDYKg.exe
  C:\Windows\System\ZaCDYKg.exe
  2⤵
  PID:8300
- C:\Windows\System\SJqsphp.exe
  C:\Windows\System\SJqsphp.exe
  2⤵
  PID:8396
- C:\Windows\System\eaYgsoN.exe
  C:\Windows\System\eaYgsoN.exe
  2⤵
  PID:8724
- C:\Windows\System\IJKZNAV.exe
  C:\Windows\System\IJKZNAV.exe
  2⤵
  PID:9108
- C:\Windows\System\BEURhdo.exe
  C:\Windows\System\BEURhdo.exe
  2⤵
  PID:9104
- C:\Windows\System\rxLGnea.exe
  C:\Windows\System\rxLGnea.exe
  2⤵
  PID:9236
- C:\Windows\System\CTqcUei.exe
  C:\Windows\System\CTqcUei.exe
  2⤵
  PID:9264
- C:\Windows\System\ZMZfHAF.exe
  C:\Windows\System\ZMZfHAF.exe
  2⤵
  PID:9304
- C:\Windows\System\pqRdgeY.exe
  C:\Windows\System\pqRdgeY.exe
  2⤵
  PID:9332
- C:\Windows\System\vngvHPK.exe
  C:\Windows\System\vngvHPK.exe
  2⤵
  PID:9348
- C:\Windows\System\JOuDfsD.exe
  C:\Windows\System\JOuDfsD.exe
  2⤵
  PID:9368
- C:\Windows\System\QjYMVRl.exe
  C:\Windows\System\QjYMVRl.exe
  2⤵
  PID:9404
- C:\Windows\System\wPpHJip.exe
  C:\Windows\System\wPpHJip.exe
  2⤵
  PID:9432
- C:\Windows\System\PfEPldW.exe
  C:\Windows\System\PfEPldW.exe
  2⤵
  PID:9448
- C:\Windows\System\IRWOfQe.exe
  C:\Windows\System\IRWOfQe.exe
  2⤵
  PID:9464
- C:\Windows\System\MCjLVGr.exe
  C:\Windows\System\MCjLVGr.exe
  2⤵
  PID:9496
- C:\Windows\System\VjnTCWJ.exe
  C:\Windows\System\VjnTCWJ.exe
  2⤵
  PID:9536
- C:\Windows\System\xoARCfG.exe
  C:\Windows\System\xoARCfG.exe
  2⤵
  PID:9552
- C:\Windows\System\LhYpjrh.exe
  C:\Windows\System\LhYpjrh.exe
  2⤵
  PID:9584
- C:\Windows\System\VAHgZed.exe
  C:\Windows\System\VAHgZed.exe
  2⤵
  PID:9628
- C:\Windows\System\CMXLnig.exe
  C:\Windows\System\CMXLnig.exe
  2⤵
  PID:9656
- C:\Windows\System\lJQVqyK.exe
  C:\Windows\System\lJQVqyK.exe
  2⤵
  PID:9684
- C:\Windows\System\eQmgUcm.exe
  C:\Windows\System\eQmgUcm.exe
  2⤵
  PID:9712
- C:\Windows\System\CVHRBxi.exe
  C:\Windows\System\CVHRBxi.exe
  2⤵
  PID:9740
- C:\Windows\System\yVDckkE.exe
  C:\Windows\System\yVDckkE.exe
  2⤵
  PID:9768
- C:\Windows\System\AejMVJZ.exe
  C:\Windows\System\AejMVJZ.exe
  2⤵
  PID:9784
- C:\Windows\System\oWkDLhI.exe
  C:\Windows\System\oWkDLhI.exe
  2⤵
  PID:9804
- C:\Windows\System\AfbeJxg.exe
  C:\Windows\System\AfbeJxg.exe
  2⤵
  PID:9832
- C:\Windows\System\yLWHOhP.exe
  C:\Windows\System\yLWHOhP.exe
  2⤵
  PID:9888
- C:\Windows\System\YXzZWRW.exe
  C:\Windows\System\YXzZWRW.exe
  2⤵
  PID:9908
- C:\Windows\System\MhjLMnw.exe
  C:\Windows\System\MhjLMnw.exe
  2⤵
  PID:9924
- C:\Windows\System\IdzifGD.exe
  C:\Windows\System\IdzifGD.exe
  2⤵
  PID:9952
- C:\Windows\System\cdaNwrO.exe
  C:\Windows\System\cdaNwrO.exe
  2⤵
  PID:9992
- C:\Windows\System\CXXSvwp.exe
  C:\Windows\System\CXXSvwp.exe
  2⤵
  PID:10012
- C:\Windows\System\JFauqjq.exe
  C:\Windows\System\JFauqjq.exe
  2⤵
  PID:10040
- C:\Windows\System\GSccHts.exe
  C:\Windows\System\GSccHts.exe
  2⤵
  PID:10064
- C:\Windows\System\TxxtBnc.exe
  C:\Windows\System\TxxtBnc.exe
  2⤵
  PID:10092
- C:\Windows\System\xhMvtZW.exe
  C:\Windows\System\xhMvtZW.exe
  2⤵
  PID:10124
- C:\Windows\System\IcGoiOM.exe
  C:\Windows\System\IcGoiOM.exe
  2⤵
  PID:10164
- C:\Windows\System\LtCTrwV.exe
  C:\Windows\System\LtCTrwV.exe
  2⤵
  PID:10192
- C:\Windows\System\xnajosd.exe
  C:\Windows\System\xnajosd.exe
  2⤵
  PID:10232
- C:\Windows\System\kCODYka.exe
  C:\Windows\System\kCODYka.exe
  2⤵
  PID:8856
- C:\Windows\System\fIbBwhG.exe
  C:\Windows\System\fIbBwhG.exe
  2⤵
  PID:9280
- C:\Windows\System\kBrgSDD.exe
  C:\Windows\System\kBrgSDD.exe
  2⤵
  PID:9340
- C:\Windows\System\KQYRjpf.exe
  C:\Windows\System\KQYRjpf.exe
  2⤵
  PID:1420
- C:\Windows\System\eCHbvqy.exe
  C:\Windows\System\eCHbvqy.exe
  2⤵
  PID:9440
- C:\Windows\System\FTZQDAG.exe
  C:\Windows\System\FTZQDAG.exe
  2⤵
  PID:9524
- C:\Windows\System\hZwRqNG.exe
  C:\Windows\System\hZwRqNG.exe
  2⤵
  PID:9608
- C:\Windows\System\lncjPni.exe
  C:\Windows\System\lncjPni.exe
  2⤵
  PID:9648
- C:\Windows\System\augTlNr.exe
  C:\Windows\System\augTlNr.exe
  2⤵
  PID:9704
- C:\Windows\System\MIvoPNu.exe
  C:\Windows\System\MIvoPNu.exe
  2⤵
  PID:9780
- C:\Windows\System\gYGMlqo.exe
  C:\Windows\System\gYGMlqo.exe
  2⤵
  PID:9816
- C:\Windows\System\laXawDp.exe
  C:\Windows\System\laXawDp.exe
  2⤵
  PID:9868
- C:\Windows\System\pltcRFF.exe
  C:\Windows\System\pltcRFF.exe
  2⤵
  PID:9944
- C:\Windows\System\vTHdhGX.exe
  C:\Windows\System\vTHdhGX.exe
  2⤵
  PID:10032
- C:\Windows\System\wZDileL.exe
  C:\Windows\System\wZDileL.exe
  2⤵
  PID:10076
- C:\Windows\System\gDyXYXh.exe
  C:\Windows\System\gDyXYXh.exe
  2⤵
  PID:10144
- C:\Windows\System\agkiAIu.exe
  C:\Windows\System\agkiAIu.exe
  2⤵
  PID:10220
- C:\Windows\System\ZeDgWoe.exe
  C:\Windows\System\ZeDgWoe.exe
  2⤵
  PID:8720
- C:\Windows\System\VrjsrUh.exe
  C:\Windows\System\VrjsrUh.exe
  2⤵
  PID:4904
- C:\Windows\System\dNbGNUJ.exe
  C:\Windows\System\dNbGNUJ.exe
  2⤵
  PID:4684
- C:\Windows\System\afyHNvf.exe
  C:\Windows\System\afyHNvf.exe
  2⤵
  PID:9484
- C:\Windows\System\vSqPyVm.exe
  C:\Windows\System\vSqPyVm.exe
  2⤵
  PID:9764
- C:\Windows\System\zCIpGuk.exe
  C:\Windows\System\zCIpGuk.exe
  2⤵
  PID:10056
- C:\Windows\System\URJjhDd.exe
  C:\Windows\System\URJjhDd.exe
  2⤵
  PID:10152
- C:\Windows\System\FmXtVzn.exe
  C:\Windows\System\FmXtVzn.exe
  2⤵
  PID:9112
- C:\Windows\System\xsPTRls.exe
  C:\Windows\System\xsPTRls.exe
  2⤵
  PID:9604
- C:\Windows\System\aCvctMe.exe
  C:\Windows\System\aCvctMe.exe
  2⤵
  PID:4428
- C:\Windows\System\GnujGGW.exe
  C:\Windows\System\GnujGGW.exe
  2⤵
  PID:9976
- C:\Windows\System\zMOCvVs.exe
  C:\Windows\System\zMOCvVs.exe
  2⤵
  PID:9300
- C:\Windows\System\hnRvPrR.exe
  C:\Windows\System\hnRvPrR.exe
  2⤵
  PID:4492
- C:\Windows\System\hFLUnRG.exe
  C:\Windows\System\hFLUnRG.exe
  2⤵
  PID:9580
- C:\Windows\System\ghWDVWx.exe
  C:\Windows\System\ghWDVWx.exe
  2⤵
  PID:10256
- C:\Windows\System\hgEcGPF.exe
  C:\Windows\System\hgEcGPF.exe
  2⤵
  PID:10284
- C:\Windows\System\rvpnDOx.exe
  C:\Windows\System\rvpnDOx.exe
  2⤵
  PID:10308
- C:\Windows\System\xIyHdZa.exe
  C:\Windows\System\xIyHdZa.exe
  2⤵
  PID:10328
- C:\Windows\System\lrGEmEM.exe
  C:\Windows\System\lrGEmEM.exe
  2⤵
  PID:10368
- C:\Windows\System\dtqpCWp.exe
  C:\Windows\System\dtqpCWp.exe
  2⤵
  PID:10384
- C:\Windows\System\KEoSzBC.exe
  C:\Windows\System\KEoSzBC.exe
  2⤵
  PID:10416
- C:\Windows\System\KdDnbJY.exe
  C:\Windows\System\KdDnbJY.exe
  2⤵
  PID:10452
- C:\Windows\System\ozOVjGK.exe
  C:\Windows\System\ozOVjGK.exe
  2⤵
  PID:10480
- C:\Windows\System\MYFjmpc.exe
  C:\Windows\System\MYFjmpc.exe
  2⤵
  PID:10496
- C:\Windows\System\TpXfuMh.exe
  C:\Windows\System\TpXfuMh.exe
  2⤵
  PID:10528
- C:\Windows\System\PZcWGyz.exe
  C:\Windows\System\PZcWGyz.exe
  2⤵
  PID:10552
- C:\Windows\System\cGFGRsG.exe
  C:\Windows\System\cGFGRsG.exe
  2⤵
  PID:10592
- C:\Windows\System\VHWneko.exe
  C:\Windows\System\VHWneko.exe
  2⤵
  PID:10620
- C:\Windows\System\iuZUgnF.exe
  C:\Windows\System\iuZUgnF.exe
  2⤵
  PID:10648
- C:\Windows\System\FVQiwHi.exe
  C:\Windows\System\FVQiwHi.exe
  2⤵
  PID:10676
- C:\Windows\System\IjXclOk.exe
  C:\Windows\System\IjXclOk.exe
  2⤵
  PID:10692
- C:\Windows\System\OiLLKrp.exe
  C:\Windows\System\OiLLKrp.exe
  2⤵
  PID:10732
- C:\Windows\System\ItRTJpc.exe
  C:\Windows\System\ItRTJpc.exe
  2⤵
  PID:10748
- C:\Windows\System\FZkvpsk.exe
  C:\Windows\System\FZkvpsk.exe
  2⤵
  PID:10776
- C:\Windows\System\iweXCLd.exe
  C:\Windows\System\iweXCLd.exe
  2⤵
  PID:10804
- C:\Windows\System\vBladNl.exe
  C:\Windows\System\vBladNl.exe
  2⤵
  PID:10832
- C:\Windows\System\oUihWGy.exe
  C:\Windows\System\oUihWGy.exe
  2⤵
  PID:10860
- C:\Windows\System\YOZSzgP.exe
  C:\Windows\System\YOZSzgP.exe
  2⤵
  PID:10888
- C:\Windows\System\RyuAkUB.exe
  C:\Windows\System\RyuAkUB.exe
  2⤵
  PID:10916
- C:\Windows\System\PEJzfep.exe
  C:\Windows\System\PEJzfep.exe
  2⤵
  PID:10944
- C:\Windows\System\QbTWECM.exe
  C:\Windows\System\QbTWECM.exe
  2⤵
  PID:10972
- C:\Windows\System\LLLrADF.exe
  C:\Windows\System\LLLrADF.exe
  2⤵
  PID:11012
- C:\Windows\System\jTIepAw.exe
  C:\Windows\System\jTIepAw.exe
  2⤵
  PID:11040
- C:\Windows\System\QmTWrvl.exe
  C:\Windows\System\QmTWrvl.exe
  2⤵
  PID:11056
- C:\Windows\System\pjqrNEN.exe
  C:\Windows\System\pjqrNEN.exe
  2⤵
  PID:11084
- C:\Windows\System\fgcGEYT.exe
  C:\Windows\System\fgcGEYT.exe
  2⤵
  PID:11112
- C:\Windows\System\zuuLCel.exe
  C:\Windows\System\zuuLCel.exe
  2⤵
  PID:11140
- C:\Windows\System\KoRScSh.exe
  C:\Windows\System\KoRScSh.exe
  2⤵
  PID:11168
- C:\Windows\System\XLLtPXl.exe
  C:\Windows\System\XLLtPXl.exe
  2⤵
  PID:11184
- C:\Windows\System\XFuVtDe.exe
  C:\Windows\System\XFuVtDe.exe
  2⤵
  PID:11236
- C:\Windows\System\YVcTdxG.exe
  C:\Windows\System\YVcTdxG.exe
  2⤵
  PID:11252
- C:\Windows\System\wYUWJoc.exe
  C:\Windows\System\wYUWJoc.exe
  2⤵
  PID:10280
- C:\Windows\System\gcDKoLj.exe
  C:\Windows\System\gcDKoLj.exe
  2⤵
  PID:10352
- C:\Windows\System\CUNtoFJ.exe
  C:\Windows\System\CUNtoFJ.exe
  2⤵
  PID:10408
- C:\Windows\System\WJrZbHY.exe
  C:\Windows\System\WJrZbHY.exe
  2⤵
  PID:10476
- C:\Windows\System\gyKlNQf.exe
  C:\Windows\System\gyKlNQf.exe
  2⤵
  PID:10516
- C:\Windows\System\cEpHvTV.exe
  C:\Windows\System\cEpHvTV.exe
  2⤵
  PID:10584
- C:\Windows\System\CrRnIIF.exe
  C:\Windows\System\CrRnIIF.exe
  2⤵
  PID:10644
- C:\Windows\System\mTCdNyO.exe
  C:\Windows\System\mTCdNyO.exe
  2⤵
  PID:10684
- C:\Windows\System\LjfqAif.exe
  C:\Windows\System\LjfqAif.exe
  2⤵
  PID:10724
- C:\Windows\System\JVbOdNs.exe
  C:\Windows\System\JVbOdNs.exe
  2⤵
  PID:10772
- C:\Windows\System\oBTdmTP.exe
  C:\Windows\System\oBTdmTP.exe
  2⤵
  PID:10848
- C:\Windows\System\eNEZhOp.exe
  C:\Windows\System\eNEZhOp.exe
  2⤵
  PID:10992
- C:\Windows\System\NucLnBW.exe
  C:\Windows\System\NucLnBW.exe
  2⤵
  PID:11024
- C:\Windows\System\jcsYoLH.exe
  C:\Windows\System\jcsYoLH.exe
  2⤵
  PID:11076
- C:\Windows\System\sXcYSuL.exe
  C:\Windows\System\sXcYSuL.exe
  2⤵
  PID:11132
- C:\Windows\System\ipKULRg.exe
  C:\Windows\System\ipKULRg.exe
  2⤵
  PID:11232
- C:\Windows\System\dueKYNO.exe
  C:\Windows\System\dueKYNO.exe
  2⤵
  PID:10376
- C:\Windows\System\gTsjxuk.exe
  C:\Windows\System\gTsjxuk.exe
  2⤵
  PID:10540
- C:\Windows\System\OVnIDZC.exe
  C:\Windows\System\OVnIDZC.exe
  2⤵
  PID:10660
- C:\Windows\System\eJSNDAJ.exe
  C:\Windows\System\eJSNDAJ.exe
  2⤵
  PID:10744
- C:\Windows\System\RPPighG.exe
  C:\Windows\System\RPPighG.exe
  2⤵
  PID:10876
- C:\Windows\System\YLKcMRd.exe
  C:\Windows\System\YLKcMRd.exe
  2⤵
  PID:11148
- C:\Windows\System\DrEYOvC.exe
  C:\Windows\System\DrEYOvC.exe
  2⤵
  PID:10268
- C:\Windows\System\eovoHBk.exe
  C:\Windows\System\eovoHBk.exe
  2⤵
  PID:10576
- C:\Windows\System\YgiswfQ.exe
  C:\Windows\System\YgiswfQ.exe
  2⤵
  PID:10880
- C:\Windows\System\hauryRw.exe
  C:\Windows\System\hauryRw.exe
  2⤵
  PID:11072
- C:\Windows\System\iGldOkY.exe
  C:\Windows\System\iGldOkY.exe
  2⤵
  PID:10964
- C:\Windows\System\fgFMYdx.exe
  C:\Windows\System\fgFMYdx.exe
  2⤵
  PID:11276
- C:\Windows\System\DQamMgs.exe
  C:\Windows\System\DQamMgs.exe
  2⤵
  PID:11304
- C:\Windows\System\tQmmlQV.exe
  C:\Windows\System\tQmmlQV.exe
  2⤵
  PID:11324
- C:\Windows\System\GTNbjRm.exe
  C:\Windows\System\GTNbjRm.exe
  2⤵
  PID:11348
- C:\Windows\System\kOqQaAQ.exe
  C:\Windows\System\kOqQaAQ.exe
  2⤵
  PID:11376
- C:\Windows\System\DzxFFKv.exe
  C:\Windows\System\DzxFFKv.exe
  2⤵
  PID:11404
- C:\Windows\System\HLZvOiQ.exe
  C:\Windows\System\HLZvOiQ.exe
  2⤵
  PID:11432
- C:\Windows\System\ZoSEYxd.exe
  C:\Windows\System\ZoSEYxd.exe
  2⤵
  PID:11500
- C:\Windows\System\ezKCKFq.exe
  C:\Windows\System\ezKCKFq.exe
  2⤵
  PID:11516
- C:\Windows\System\IMNxeVX.exe
  C:\Windows\System\IMNxeVX.exe
  2⤵
  PID:11544
- C:\Windows\System\LtHkqUv.exe
  C:\Windows\System\LtHkqUv.exe
  2⤵
  PID:11572
- C:\Windows\System\ZgyyBdQ.exe
  C:\Windows\System\ZgyyBdQ.exe
  2⤵
  PID:11592
- C:\Windows\System\YylEKgt.exe
  C:\Windows\System\YylEKgt.exe
  2⤵
  PID:11616
- C:\Windows\System\KfkknpA.exe
  C:\Windows\System\KfkknpA.exe
  2⤵
  PID:11656
- C:\Windows\System\agupgKF.exe
  C:\Windows\System\agupgKF.exe
  2⤵
  PID:11684
- C:\Windows\System\GzQzbaf.exe
  C:\Windows\System\GzQzbaf.exe
  2⤵
  PID:11700
- C:\Windows\System\GajufTr.exe
  C:\Windows\System\GajufTr.exe
  2⤵
  PID:11740
- C:\Windows\System\nqqSHCi.exe
  C:\Windows\System\nqqSHCi.exe
  2⤵
  PID:11756
- C:\Windows\System\glOmWPK.exe
  C:\Windows\System\glOmWPK.exe
  2⤵
  PID:11776
- C:\Windows\System\SwieTfs.exe
  C:\Windows\System\SwieTfs.exe
  2⤵
  PID:11812
- C:\Windows\System\IuQQOXI.exe
  C:\Windows\System\IuQQOXI.exe
  2⤵
  PID:11840
- C:\Windows\System\ipIaNlc.exe
  C:\Windows\System\ipIaNlc.exe
  2⤵
  PID:11868
- C:\Windows\System\WTzYPhR.exe
  C:\Windows\System\WTzYPhR.exe
  2⤵
  PID:11884
- C:\Windows\System\elllEwa.exe
  C:\Windows\System\elllEwa.exe
  2⤵
  PID:11912
- C:\Windows\System\xVeaBou.exe
  C:\Windows\System\xVeaBou.exe
  2⤵
  PID:11964
- C:\Windows\System\OwbIidC.exe
  C:\Windows\System\OwbIidC.exe
  2⤵
  PID:11980
- C:\Windows\System\bzxETXN.exe
  C:\Windows\System\bzxETXN.exe
  2⤵
  PID:12020
- C:\Windows\System\UyzNTMg.exe
  C:\Windows\System\UyzNTMg.exe
  2⤵
  PID:12048
- C:\Windows\System\lxqciHt.exe
  C:\Windows\System\lxqciHt.exe
  2⤵
  PID:12076
- C:\Windows\System\Cwbffdi.exe
  C:\Windows\System\Cwbffdi.exe
  2⤵
  PID:12096
- C:\Windows\System\oCxusGn.exe
  C:\Windows\System\oCxusGn.exe
  2⤵
  PID:12120
- C:\Windows\System\qCNJNiJ.exe
  C:\Windows\System\qCNJNiJ.exe
  2⤵
  PID:12152
- C:\Windows\System\arCUijx.exe
  C:\Windows\System\arCUijx.exe
  2⤵
  PID:12176
- C:\Windows\System\dSzGhWI.exe
  C:\Windows\System\dSzGhWI.exe
  2⤵
  PID:12192
- C:\Windows\System\rnwCMxv.exe
  C:\Windows\System\rnwCMxv.exe
  2⤵
  PID:12240
- C:\Windows\System\SitQmWS.exe
  C:\Windows\System\SitQmWS.exe
  2⤵
  PID:12260
- C:\Windows\System\MOvuPby.exe
  C:\Windows\System\MOvuPby.exe
  2⤵
  PID:10520
- C:\Windows\System\CLlXhSG.exe
  C:\Windows\System\CLlXhSG.exe
  2⤵
  PID:11356
- C:\Windows\System\tdPFNXs.exe
  C:\Windows\System\tdPFNXs.exe
  2⤵
  PID:11372
- C:\Windows\System\sqJKZqV.exe
  C:\Windows\System\sqJKZqV.exe
  2⤵
  PID:11444
- C:\Windows\System\KBvdEtN.exe
  C:\Windows\System\KBvdEtN.exe
  2⤵
  PID:11488
- C:\Windows\System\nhffVlg.exe
  C:\Windows\System\nhffVlg.exe
  2⤵
  PID:11564
- C:\Windows\System\XpnVXRK.exe
  C:\Windows\System\XpnVXRK.exe
  2⤵
  PID:11632
- C:\Windows\System\oOFYYht.exe
  C:\Windows\System\oOFYYht.exe
  2⤵
  PID:11692
- C:\Windows\System\VXnYfuz.exe
  C:\Windows\System\VXnYfuz.exe
  2⤵
  PID:11784
- C:\Windows\System\dZOtwvx.exe
  C:\Windows\System\dZOtwvx.exe
  2⤵
  PID:11836
- C:\Windows\System\hqFuNlK.exe
  C:\Windows\System\hqFuNlK.exe
  2⤵
  PID:11876
- C:\Windows\System\udOkbhJ.exe
  C:\Windows\System\udOkbhJ.exe
  2⤵
  PID:11952
- C:\Windows\System\bdjksdv.exe
  C:\Windows\System\bdjksdv.exe
  2⤵
  PID:12040
- C:\Windows\System\KXyhJTz.exe
  C:\Windows\System\KXyhJTz.exe
  2⤵
  PID:12112
- C:\Windows\System\saKujdz.exe
  C:\Windows\System\saKujdz.exe
  2⤵
  PID:12144
- C:\Windows\System\vIWWPED.exe
  C:\Windows\System\vIWWPED.exe
  2⤵
  PID:12216
- C:\Windows\System\JTwfFQX.exe
  C:\Windows\System\JTwfFQX.exe
  2⤵
  PID:11004
- C:\Windows\System\MPcetLg.exe
  C:\Windows\System\MPcetLg.exe
  2⤵
  PID:11332
- C:\Windows\System\ebJEswf.exe
  C:\Windows\System\ebJEswf.exe
  2⤵
  PID:11512
- C:\Windows\System\PsJQDRU.exe
  C:\Windows\System\PsJQDRU.exe
  2⤵
  PID:11672
- C:\Windows\System\YPnCfwc.exe
  C:\Windows\System\YPnCfwc.exe
  2⤵
  PID:11924
- C:\Windows\System\CHVXLBx.exe
  C:\Windows\System\CHVXLBx.exe
  2⤵
  PID:12064
- C:\Windows\System\WovzEoR.exe
  C:\Windows\System\WovzEoR.exe
  2⤵
  PID:12188
- C:\Windows\System\jKaGOec.exe
  C:\Windows\System\jKaGOec.exe
  2⤵
  PID:11424
- C:\Windows\System\XhCCDQv.exe
  C:\Windows\System\XhCCDQv.exe
  2⤵
  PID:11832
- C:\Windows\System\fsOUOAD.exe
  C:\Windows\System\fsOUOAD.exe
  2⤵
  PID:12172
- C:\Windows\System\PTKKBck.exe
  C:\Windows\System\PTKKBck.exe
  2⤵
  PID:11772
- C:\Windows\System\ZdMWpci.exe
  C:\Windows\System\ZdMWpci.exe
  2⤵
  PID:11288
- C:\Windows\System\pJHvEjI.exe
  C:\Windows\System\pJHvEjI.exe
  2⤵
  PID:12308
- C:\Windows\System\YLjzqaw.exe
  C:\Windows\System\YLjzqaw.exe
  2⤵
  PID:12324
- C:\Windows\System\GTfTxpN.exe
  C:\Windows\System\GTfTxpN.exe
  2⤵
  PID:12352
- C:\Windows\System\GeVlmMk.exe
  C:\Windows\System\GeVlmMk.exe
  2⤵
  PID:12400
- C:\Windows\System\MBMNBQg.exe
  C:\Windows\System\MBMNBQg.exe
  2⤵
  PID:12420
- C:\Windows\System\hDxbxFI.exe
  C:\Windows\System\hDxbxFI.exe
  2⤵
  PID:12460
- C:\Windows\System\kBlYVhR.exe
  C:\Windows\System\kBlYVhR.exe
  2⤵
  PID:12476
- C:\Windows\System\KWjAlns.exe
  C:\Windows\System\KWjAlns.exe
  2⤵
  PID:12504
- C:\Windows\System\INyhWkI.exe
  C:\Windows\System\INyhWkI.exe
  2⤵
  PID:12528
- C:\Windows\System\aDvYiWy.exe
  C:\Windows\System\aDvYiWy.exe
  2⤵
  PID:12560
- C:\Windows\System\OTHqXeU.exe
  C:\Windows\System\OTHqXeU.exe
  2⤵
  PID:12588
- C:\Windows\System\nJEYCof.exe
  C:\Windows\System\nJEYCof.exe
  2⤵
  PID:12616
- C:\Windows\System\FiELjFk.exe
  C:\Windows\System\FiELjFk.exe
  2⤵
  PID:12632
- C:\Windows\System\BIYSWxq.exe
  C:\Windows\System\BIYSWxq.exe
  2⤵
  PID:12680
- C:\Windows\System\oMBRweN.exe
  C:\Windows\System\oMBRweN.exe
  2⤵
  PID:12700
- C:\Windows\System\QciYaiA.exe
  C:\Windows\System\QciYaiA.exe
  2⤵
  PID:12740
- C:\Windows\System\bCQLvfU.exe
  C:\Windows\System\bCQLvfU.exe
  2⤵
  PID:12768
- C:\Windows\System\MxIaTjz.exe
  C:\Windows\System\MxIaTjz.exe
  2⤵
  PID:12796
- C:\Windows\System\kOsUUJr.exe
  C:\Windows\System\kOsUUJr.exe
  2⤵
  PID:12812
- C:\Windows\System\yMlnTYB.exe
  C:\Windows\System\yMlnTYB.exe
  2⤵
  PID:12840
- C:\Windows\System\UmBYWwM.exe
  C:\Windows\System\UmBYWwM.exe
  2⤵
  PID:12868
- C:\Windows\System\kqAzjZt.exe
  C:\Windows\System\kqAzjZt.exe
  2⤵
  PID:12904
- C:\Windows\System\xlkzAOc.exe
  C:\Windows\System\xlkzAOc.exe
  2⤵
  PID:12924
- C:\Windows\System\BAIBIJX.exe
  C:\Windows\System\BAIBIJX.exe
  2⤵
  PID:12944
- C:\Windows\System\dBEJbTm.exe
  C:\Windows\System\dBEJbTm.exe
  2⤵
  PID:12980
- C:\Windows\System\eIqSIlb.exe
  C:\Windows\System\eIqSIlb.exe
  2⤵
  PID:13020
- C:\Windows\System\hgjYUIh.exe
  C:\Windows\System\hgjYUIh.exe
  2⤵
  PID:13060
- C:\Windows\System\IdbUfBC.exe
  C:\Windows\System\IdbUfBC.exe
  2⤵
  PID:13080
- C:\Windows\System\JpjiFru.exe
  C:\Windows\System\JpjiFru.exe
  2⤵
  PID:13104
- C:\Windows\System\cErCIuv.exe
  C:\Windows\System\cErCIuv.exe
  2⤵
  PID:13120
- C:\Windows\System\RbeCqyp.exe
  C:\Windows\System\RbeCqyp.exe
  2⤵
  PID:13156
- C:\Windows\System\BjUYmwf.exe
  C:\Windows\System\BjUYmwf.exe
  2⤵
  PID:13176
- C:\Windows\System\YUIxTiH.exe
  C:\Windows\System\YUIxTiH.exe
  2⤵
  PID:13204
- C:\Windows\System\vTLZpzJ.exe
  C:\Windows\System\vTLZpzJ.exe
  2⤵
  PID:13248
- C:\Windows\System\iVVeaZj.exe
  C:\Windows\System\iVVeaZj.exe
  2⤵
  PID:13276
- C:\Windows\System\IwsawNi.exe
  C:\Windows\System\IwsawNi.exe
  2⤵
  PID:13300
- C:\Windows\System\laRlJeb.exe
  C:\Windows\System\laRlJeb.exe
  2⤵
  PID:12320
- C:\Windows\System\jzDmSXt.exe
  C:\Windows\System\jzDmSXt.exe
  2⤵
  PID:12340
- C:\Windows\System\EQqQWMv.exe
  C:\Windows\System\EQqQWMv.exe
  2⤵
  PID:12416
- C:\Windows\System\AjMqiIF.exe
  C:\Windows\System\AjMqiIF.exe
  2⤵
  PID:12440
- C:\Windows\System\SdfnDDp.exe
  C:\Windows\System\SdfnDDp.exe
  2⤵
  PID:12572
- C:\Windows\System\HofCdCq.exe
  C:\Windows\System\HofCdCq.exe
  2⤵
  PID:12644
- C:\Windows\System\KYRVWBa.exe
  C:\Windows\System\KYRVWBa.exe
  2⤵
  PID:12736
- C:\Windows\System\NPKLpVQ.exe
  C:\Windows\System\NPKLpVQ.exe
  2⤵
  PID:12808
- C:\Windows\System\xGUTfgs.exe
  C:\Windows\System\xGUTfgs.exe
  2⤵
  PID:12832
- C:\Windows\System\zZebpyp.exe
  C:\Windows\System\zZebpyp.exe
  2⤵
  PID:12900
- C:\Windows\System\mSSrByJ.exe
  C:\Windows\System\mSSrByJ.exe
  2⤵
  PID:12968
- C:\Windows\System\tsYzYXK.exe
  C:\Windows\System\tsYzYXK.exe
  2⤵
  PID:13068
- C:\Windows\System\UVWOpGf.exe
  C:\Windows\System\UVWOpGf.exe
  2⤵
  PID:13132
- C:\Windows\System\tsLavmp.exe
  C:\Windows\System\tsLavmp.exe
  2⤵
  PID:13220
- C:\Windows\System\umUXQaB.exe
  C:\Windows\System\umUXQaB.exe
  2⤵
  PID:13240
- C:\Windows\System\dnBaaGe.exe
  C:\Windows\System\dnBaaGe.exe
  2⤵
  PID:13292
- C:\Windows\System\dBgNWfX.exe
  C:\Windows\System\dBgNWfX.exe
  2⤵
  PID:12380
- C:\Windows\System\OAGtvvA.exe
  C:\Windows\System\OAGtvvA.exe
  2⤵
  PID:12516
- C:\Windows\System\avMlzwi.exe
  C:\Windows\System\avMlzwi.exe
  2⤵
  PID:12624
- C:\Windows\System\VCVHiaL.exe
  C:\Windows\System\VCVHiaL.exe
  2⤵
  PID:12828
- C:\Windows\System\SZccNiN.exe
  C:\Windows\System\SZccNiN.exe
  2⤵
  PID:13140
- C:\Windows\System\ReCEquZ.exe
  C:\Windows\System\ReCEquZ.exe
  2⤵
  PID:13188
- C:\Windows\System\ctPcluw.exe
  C:\Windows\System\ctPcluw.exe
  2⤵
  PID:12344
- C:\Windows\System\zipjaYC.exe
  C:\Windows\System\zipjaYC.exe
  2⤵
  PID:12604
- C:\Windows\System\JZkEyNH.exe
  C:\Windows\System\JZkEyNH.exe
  2⤵
  PID:13192
- C:\Windows\System\juHKKlZ.exe
  C:\Windows\System\juHKKlZ.exe
  2⤵
  PID:11936
- C:\Windows\System\LgVqwMB.exe
  C:\Windows\System\LgVqwMB.exe
  2⤵
  PID:12336
- C:\Windows\System\OcjbjBJ.exe
  C:\Windows\System\OcjbjBJ.exe
  2⤵
  PID:13324
- C:\Windows\System\XnvwTRR.exe
  C:\Windows\System\XnvwTRR.exe
  2⤵
  PID:13348
- C:\Windows\System\eJzJUtF.exe
  C:\Windows\System\eJzJUtF.exe
  2⤵
  PID:13372
- C:\Windows\System\sPIxCpK.exe
  C:\Windows\System\sPIxCpK.exe
  2⤵
  PID:13400
- C:\Windows\System\aLxmrid.exe
  C:\Windows\System\aLxmrid.exe
  2⤵
  PID:13444
- C:\Windows\System\WedSVxl.exe
  C:\Windows\System\WedSVxl.exe
  2⤵
  PID:13472
- C:\Windows\System\OMpbjgX.exe
  C:\Windows\System\OMpbjgX.exe
  2⤵
  PID:13512
- C:\Windows\System\UaLNIYM.exe
  C:\Windows\System\UaLNIYM.exe
  2⤵
  PID:13532
- C:\Windows\System\VfrpmBC.exe
  C:\Windows\System\VfrpmBC.exe
  2⤵
  PID:13552
- C:\Windows\System\ywHWMlh.exe
  C:\Windows\System\ywHWMlh.exe
  2⤵
  PID:13580
- C:\Windows\System\OZHGClG.exe
  C:\Windows\System\OZHGClG.exe
  2⤵
  PID:13600
- C:\Windows\System\ROYDOVX.exe
  C:\Windows\System\ROYDOVX.exe
  2⤵
  PID:13624
- C:\Windows\System\EWfsIZN.exe
  C:\Windows\System\EWfsIZN.exe
  2⤵
  PID:13656
- C:\Windows\System\cAimsPP.exe
  C:\Windows\System\cAimsPP.exe
  2⤵
  PID:13680
- C:\Windows\System\pbwHaoM.exe
  C:\Windows\System\pbwHaoM.exe
  2⤵
  PID:13724
- C:\Windows\System\EEXynYC.exe
  C:\Windows\System\EEXynYC.exe
  2⤵
  PID:13748
- C:\Windows\System\ExTScAr.exe
  C:\Windows\System\ExTScAr.exe
  2⤵
  PID:13784
- C:\Windows\System\rbiSBCU.exe
  C:\Windows\System\rbiSBCU.exe
  2⤵
  PID:13812
- C:\Windows\System\ATslWwR.exe
  C:\Windows\System\ATslWwR.exe
  2⤵
  PID:13836
- C:\Windows\System\PtLrnpG.exe
  C:\Windows\System\PtLrnpG.exe
  2⤵
  PID:13852
- C:\Windows\System\WpEiQpm.exe
  C:\Windows\System\WpEiQpm.exe
  2⤵
  PID:13884
- C:\Windows\System\hdBNhxI.exe
  C:\Windows\System\hdBNhxI.exe
  2⤵
  PID:13908
- C:\Windows\System\uYsruLp.exe
  C:\Windows\System\uYsruLp.exe
  2⤵
  PID:13928
- C:\Windows\System\quSSJcX.exe
  C:\Windows\System\quSSJcX.exe
  2⤵
  PID:13948
- C:\Windows\System\Spmkzyc.exe
  C:\Windows\System\Spmkzyc.exe
  2⤵
  PID:13988
- C:\Windows\System\ATSbgZh.exe
  C:\Windows\System\ATSbgZh.exe
  2⤵
  PID:14024
- C:\Windows\System\UvZvzLl.exe
  C:\Windows\System\UvZvzLl.exe
  2⤵
  PID:14048
- C:\Windows\System\fSeyfQH.exe
  C:\Windows\System\fSeyfQH.exe
  2⤵
  PID:14088
- C:\Windows\System\kVUylwX.exe
  C:\Windows\System\kVUylwX.exe
  2⤵
  PID:14112
- C:\Windows\System\fUOgpVQ.exe
  C:\Windows\System\fUOgpVQ.exe
  2⤵
  PID:14136
- C:\Windows\System\hwQTbFW.exe
  C:\Windows\System\hwQTbFW.exe
  2⤵
  PID:14164
- C:\Windows\System\MkeWdXs.exe
  C:\Windows\System\MkeWdXs.exe
  2⤵
  PID:14200
- C:\Windows\System\jcpQeor.exe
  C:\Windows\System\jcpQeor.exe
  2⤵
  PID:14220
- C:\Windows\System\KbdTWBv.exe
  C:\Windows\System\KbdTWBv.exe
  2⤵
  PID:14264
- C:\Windows\System\iXihQFW.exe
  C:\Windows\System\iXihQFW.exe
  2⤵
  PID:14292
- C:\Windows\System\BrXQqkm.exe
  C:\Windows\System\BrXQqkm.exe
  2⤵
  PID:14312
- C:\Windows\System\BENVvik.exe
  C:\Windows\System\BENVvik.exe
  2⤵
  PID:12952
- C:\Windows\System\UVlfums.exe
  C:\Windows\System\UVlfums.exe
  2⤵
  PID:13364
- C:\Windows\System\UERftvY.exe
  C:\Windows\System\UERftvY.exe
  2⤵
  PID:13384
- C:\Windows\System\EbzzCeN.exe
  C:\Windows\System\EbzzCeN.exe
  2⤵
  PID:13468
- C:\Windows\System\dEljaHT.exe
  C:\Windows\System\dEljaHT.exe
  2⤵
  PID:13540
- C:\Windows\System\piAjslD.exe
  C:\Windows\System\piAjslD.exe
  2⤵
  PID:13612
- C:\Windows\System\WtVIkNA.exe
  C:\Windows\System\WtVIkNA.exe
  2⤵
  PID:13740
- C:\Windows\System\pfoWCZN.exe
  C:\Windows\System\pfoWCZN.exe
  2⤵
  PID:13772
- C:\Windows\System\ClLQwQp.exe
  C:\Windows\System\ClLQwQp.exe
  2⤵
  PID:13824
- C:\Windows\System\DMyCUSy.exe
  C:\Windows\System\DMyCUSy.exe
  2⤵
  PID:13896
- C:\Windows\System\YWmaNpv.exe
  C:\Windows\System\YWmaNpv.exe
  2⤵
  PID:13944
- C:\Windows\System\wqScYMs.exe
  C:\Windows\System\wqScYMs.exe
  2⤵
  PID:13976
- C:\Windows\System\myUXMnV.exe
  C:\Windows\System\myUXMnV.exe
  2⤵
  PID:14104
- C:\Windows\System\ljCSrnf.exe
  C:\Windows\System\ljCSrnf.exe
  2⤵
  PID:14176
- C:\Windows\System\BgrwMaT.exe
  C:\Windows\System\BgrwMaT.exe
  2⤵
  PID:14236
- C:\Windows\System\HjQZeOu.exe
  C:\Windows\System\HjQZeOu.exe
  2⤵
  PID:14260
- C:\Windows\System\GLBguic.exe
  C:\Windows\System\GLBguic.exe
  2⤵
  PID:14288
- C:\Windows\System\kKDkbjj.exe
  C:\Windows\System\kKDkbjj.exe
  2⤵
  PID:13432
- C:\Windows\System\wLUukXU.exe
  C:\Windows\System\wLUukXU.exe
  2⤵
  PID:13452
- C:\Windows\System\oJquREy.exe
  C:\Windows\System\oJquREy.exe
  2⤵
  PID:13696
- C:\Windows\System\JkErelG.exe
  C:\Windows\System\JkErelG.exe
  2⤵
  PID:13924
- C:\Windows\System\blPtYsR.exe
  C:\Windows\System\blPtYsR.exe
  2⤵
  PID:14012
- C:\Windows\System\GhCSoAF.exe
  C:\Windows\System\GhCSoAF.exe
  2⤵
  PID:14284
- C:\Windows\System\OoxTFwh.exe
  C:\Windows\System\OoxTFwh.exe
  2⤵
  PID:13508
- C:\Windows\System\jXcVZtx.exe
  C:\Windows\System\jXcVZtx.exe
  2⤵
  PID:13716
- C:\Windows\System\FgcqRnX.exe
  C:\Windows\System\FgcqRnX.exe
  2⤵
  PID:14100
- C:\Windows\System\qRoqwUJ.exe
  C:\Windows\System\qRoqwUJ.exe
  2⤵
  PID:13672
- C:\Windows\System\YpSaGaq.exe
  C:\Windows\System\YpSaGaq.exe
  2⤵
  PID:13380
- C:\Windows\System\QyApBUd.exe
  C:\Windows\System\QyApBUd.exe
  2⤵
  PID:14364
- C:\Windows\System\omrcqJZ.exe
  C:\Windows\System\omrcqJZ.exe
  2⤵
  PID:14380
- C:\Windows\System\mXxSBhu.exe
  C:\Windows\System\mXxSBhu.exe
  2⤵
  PID:14412
- C:\Windows\System\sMCSFoD.exe
  C:\Windows\System\sMCSFoD.exe
  2⤵
  PID:14436
- C:\Windows\System\mRpZNnI.exe
  C:\Windows\System\mRpZNnI.exe
  2⤵
  PID:14460
- C:\Windows\System\WDpiEkP.exe
  C:\Windows\System\WDpiEkP.exe
  2⤵
  PID:14504
- C:\Windows\System\HWlxzFx.exe
  C:\Windows\System\HWlxzFx.exe
  2⤵
  PID:14520
- C:\Windows\System\pnseyZj.exe
  C:\Windows\System\pnseyZj.exe
  2⤵
  PID:14540
- C:\Windows\System\lTiBGVm.exe
  C:\Windows\System\lTiBGVm.exe
  2⤵
  PID:14576
- C:\Windows\System\DoYicas.exe
  C:\Windows\System\DoYicas.exe
  2⤵
  PID:14596
- C:\Windows\System\zKbwVwr.exe
  C:\Windows\System\zKbwVwr.exe
  2⤵
  PID:14624
- C:\Windows\System\LqWqXut.exe
  C:\Windows\System\LqWqXut.exe
  2⤵
  PID:14648
- C:\Windows\System\VguqwuR.exe
  C:\Windows\System\VguqwuR.exe
  2⤵
  PID:14672
- C:\Windows\System\BeiNYKA.exe
  C:\Windows\System\BeiNYKA.exe
  2⤵
  PID:14708
- C:\Windows\System\EqIWlqo.exe
  C:\Windows\System\EqIWlqo.exe
  2⤵
  PID:14744
- C:\Windows\System\WjozaGr.exe
  C:\Windows\System\WjozaGr.exe
  2⤵
  PID:14760
- C:\Windows\System\qojbSed.exe
  C:\Windows\System\qojbSed.exe
  2⤵
  PID:14784
- C:\Windows\System\kysWwtb.exe
  C:\Windows\System\kysWwtb.exe
  2⤵
  PID:14828
- C:\Windows\System\RcjVOTb.exe
  C:\Windows\System\RcjVOTb.exe
  2⤵
  PID:14856
- C:\Windows\System\xcaocxw.exe
  C:\Windows\System\xcaocxw.exe
  2⤵
  PID:14892
- C:\Windows\System\ZboLDhh.exe
  C:\Windows\System\ZboLDhh.exe
  2⤵
  PID:14908
- C:\Windows\System\QnPesks.exe
  C:\Windows\System\QnPesks.exe
  2⤵
  PID:14940
- C:\Windows\System\kjldrME.exe
  C:\Windows\System\kjldrME.exe
  2⤵
  PID:14964
- C:\Windows\System\YakphrI.exe
  C:\Windows\System\YakphrI.exe
  2⤵
  PID:14988
- C:\Windows\System\xGeguFC.exe
  C:\Windows\System\xGeguFC.exe
  2⤵
  PID:15016
- C:\Windows\System\LdYTyLK.exe
  C:\Windows\System\LdYTyLK.exe
  2⤵
  PID:15064
- C:\Windows\System\nRaBRVM.exe
  C:\Windows\System\nRaBRVM.exe
  2⤵
  PID:15092
- C:\Windows\System\MGyrbDL.exe
  C:\Windows\System\MGyrbDL.exe
  2⤵
  PID:15108
- C:\Windows\System\wfGagCy.exe
  C:\Windows\System\wfGagCy.exe
  2⤵
  PID:15148
- C:\Windows\System\WnYCsbP.exe
  C:\Windows\System\WnYCsbP.exe
  2⤵
  PID:15176
- C:\Windows\System\KKKDYUf.exe
  C:\Windows\System\KKKDYUf.exe
  2⤵
  PID:15200
- C:\Windows\System\LDBePBs.exe
  C:\Windows\System\LDBePBs.exe
  2⤵
  PID:15220
- C:\Windows\System\qvGbmVf.exe
  C:\Windows\System\qvGbmVf.exe
  2⤵
  PID:15240
- C:\Windows\System\XCMLTPH.exe
  C:\Windows\System\XCMLTPH.exe
  2⤵
  PID:15272
- C:\Windows\System\qeDFDcP.exe
  C:\Windows\System\qeDFDcP.exe
  2⤵
  PID:15292
- C:\Windows\System\UHaswDo.exe
  C:\Windows\System\UHaswDo.exe
  2⤵
  PID:15316
- C:\Windows\System\fgGrNTN.exe
  C:\Windows\System\fgGrNTN.exe
  2⤵
  PID:15344
- C:\Windows\System\MzgGavO.exe
  C:\Windows\System\MzgGavO.exe
  2⤵
  PID:14352
- C:\Windows\System\VvUudal.exe
  C:\Windows\System\VvUudal.exe
  2⤵
  PID:14372
- C:\Windows\System\GJIufhJ.exe
  C:\Windows\System\GJIufhJ.exe
  2⤵
  PID:14560
- C:\Windows\System\IbBweXQ.exe
  C:\Windows\System\IbBweXQ.exe
  2⤵
  PID:14616
- C:\Windows\System\ohCKzlY.exe
  C:\Windows\System\ohCKzlY.exe
  2⤵
  PID:14732
- C:\Windows\System\CSNjzFn.exe
  C:\Windows\System\CSNjzFn.exe
  2⤵
  PID:14700
- C:\Windows\System\XYAGPja.exe
  C:\Windows\System\XYAGPja.exe
  2⤵
  PID:14804
- C:\Windows\System\PoQrdGF.exe
  C:\Windows\System\PoQrdGF.exe
  2⤵
  PID:14840
- C:\Windows\System\WKoZMut.exe
  C:\Windows\System\WKoZMut.exe
  2⤵
  PID:14924
- C:\Windows\System\FHTAmLZ.exe
  C:\Windows\System\FHTAmLZ.exe
  2⤵
  PID:14956
- C:\Windows\System\VcEAfvE.exe
  C:\Windows\System\VcEAfvE.exe
  2⤵
  PID:15032
- C:\Windows\System\oXfmUcA.exe
  C:\Windows\System\oXfmUcA.exe
  2⤵
  PID:15164
- C:\Windows\System\JizoPzN.exe
  C:\Windows\System\JizoPzN.exe
  2⤵
  PID:15188
- C:\Windows\System\rGpSmDB.exe
  C:\Windows\System\rGpSmDB.exe
  2⤵
  PID:15288
- C:\Windows\System\fRDJKKR.exe
  C:\Windows\System\fRDJKKR.exe
  2⤵
  PID:15328
- C:\Windows\System\XLxQkpA.exe
  C:\Windows\System\XLxQkpA.exe
  2⤵
  PID:14396
- C:\Windows\System\wuFfUdc.exe
  C:\Windows\System\wuFfUdc.exe
  2⤵
  PID:14592
- C:\Windows\System\uyfIeiJ.exe
  C:\Windows\System\uyfIeiJ.exe
  2⤵
  PID:14756
- C:\Windows\System\fTDvDOX.exe
  C:\Windows\System\fTDvDOX.exe
  2⤵
  PID:14844
- C:\Windows\System\iwlDlMy.exe
  C:\Windows\System\iwlDlMy.exe
  2⤵
  PID:14932
- C:\Windows\System\giCwBBj.exe
  C:\Windows\System\giCwBBj.exe
  2⤵
  PID:15256
- C:\Windows\System\EGUvizG.exe
  C:\Windows\System\EGUvizG.exe
  2⤵
  PID:15308
- C:\Windows\System\bYvdSQN.exe
  C:\Windows\System\bYvdSQN.exe
  2⤵
  PID:14456
- C:\Windows\System\LRwWdpE.exe
  C:\Windows\System\LRwWdpE.exe
  2⤵
  PID:14724
- C:\Windows\System\HuQckNc.exe
  C:\Windows\System\HuQckNc.exe
  2⤵
  PID:15248
- C:\Windows\System\RpGpXbQ.exe
  C:\Windows\System\RpGpXbQ.exe
  2⤵
  PID:14728
- C:\Windows\System\bkuaXkQ.exe
  C:\Windows\System\bkuaXkQ.exe
  2⤵
  PID:15260
- C:\Windows\System\grXqXbx.exe
  C:\Windows\System\grXqXbx.exe
  2⤵
  PID:15396
- C:\Windows\System\xHQNrJQ.exe
  C:\Windows\System\xHQNrJQ.exe
  2⤵
  PID:15412
- C:\Windows\System\XTmUSfs.exe
  C:\Windows\System\XTmUSfs.exe
  2⤵
  PID:15464
- C:\Windows\System\hLdRNWO.exe
  C:\Windows\System\hLdRNWO.exe
  2⤵
  PID:15488
- C:\Windows\System\tMulpni.exe
  C:\Windows\System\tMulpni.exe
  2⤵
  PID:15508
- C:\Windows\System\njjTeQR.exe
  C:\Windows\System\njjTeQR.exe
  2⤵
  PID:15536
- C:\Windows\System\HRTykWR.exe
  C:\Windows\System\HRTykWR.exe
  2⤵
  PID:15556
- C:\Windows\System\wabXozX.exe
  C:\Windows\System\wabXozX.exe
  2⤵
  PID:15592
- C:\Windows\System\KuDWCGS.exe
  C:\Windows\System\KuDWCGS.exe
  2⤵
  PID:15608
- C:\Windows\System\AxOTpWr.exe
  C:\Windows\System\AxOTpWr.exe
  2⤵
  PID:15624
- C:\Windows\System\eeVrXoI.exe
  C:\Windows\System\eeVrXoI.exe
  2⤵
  PID:15668
- C:\Windows\System\xnAvyKu.exe
  C:\Windows\System\xnAvyKu.exe
  2⤵
  PID:15688
- C:\Windows\System\dsKSSyw.exe
  C:\Windows\System\dsKSSyw.exe
  2⤵
  PID:15728
- C:\Windows\System\TnxBbKl.exe
  C:\Windows\System\TnxBbKl.exe
  2⤵
  PID:15748
- C:\Windows\System\rWRvkLS.exe
  C:\Windows\System\rWRvkLS.exe
  2⤵
  PID:15788
- C:\Windows\System\NNcwNSp.exe
  C:\Windows\System\NNcwNSp.exe
  2⤵
  PID:15812
- C:\Windows\System\djVRAel.exe
  C:\Windows\System\djVRAel.exe
  2⤵
  PID:15832
- C:\Windows\System\IFHZwOc.exe
  C:\Windows\System\IFHZwOc.exe
  2⤵
  PID:15884
- C:\Windows\System\UpkRALm.exe
  C:\Windows\System\UpkRALm.exe
  2⤵
  PID:15908
- C:\Windows\System\IxecXwp.exe
  C:\Windows\System\IxecXwp.exe
  2⤵
  PID:15936
- C:\Windows\System\IPsPzwn.exe
  C:\Windows\System\IPsPzwn.exe
  2⤵
  PID:15956
- C:\Windows\System\ZVoHzYC.exe
  C:\Windows\System\ZVoHzYC.exe
  2⤵
  PID:15996
- C:\Windows\System\CsXtKFV.exe
  C:\Windows\System\CsXtKFV.exe
  2⤵
  PID:16012
- C:\Windows\System\EFAEVPp.exe
  C:\Windows\System\EFAEVPp.exe
  2⤵
  PID:16040
- C:\Windows\System\BGhIBpE.exe
  C:\Windows\System\BGhIBpE.exe
  2⤵
  PID:16080
- C:\Windows\System\ysblOjW.exe
  C:\Windows\System\ysblOjW.exe
  2⤵
  PID:16100
- C:\Windows\System\hNJmOBP.exe
  C:\Windows\System\hNJmOBP.exe
  2⤵
  PID:16132
- C:\Windows\System\ZeqJRZL.exe
  C:\Windows\System\ZeqJRZL.exe
  2⤵
  PID:16152
- C:\Windows\System\rOEzRIc.exe
  C:\Windows\System\rOEzRIc.exe
  2⤵
  PID:16180
- C:\Windows\System\qlMZjCm.exe
  C:\Windows\System\qlMZjCm.exe
  2⤵
  PID:16200
- C:\Windows\System\zQoMmHT.exe
  C:\Windows\System\zQoMmHT.exe
  2⤵
  PID:16248
- C:\Windows\System\pqOWMQg.exe
  C:\Windows\System\pqOWMQg.exe
  2⤵
  PID:16264
- C:\Windows\System\ilJvFLX.exe
  C:\Windows\System\ilJvFLX.exe
  2⤵
  PID:16316
- C:\Windows\System\YXHCBhJ.exe
  C:\Windows\System\YXHCBhJ.exe
  2⤵
  PID:16340
- C:\Windows\System\gUkJyEx.exe
  C:\Windows\System\gUkJyEx.exe
  2⤵
  PID:16360
- C:\Windows\System\qwtyThA.exe
  C:\Windows\System\qwtyThA.exe
  2⤵
  PID:14888
- C:\Windows\System\caDHEfU.exe
  C:\Windows\System\caDHEfU.exe
  2⤵
  PID:15408
- C:\Windows\System\idBBbmo.exe
  C:\Windows\System\idBBbmo.exe
  2⤵
  PID:15480
- C:\Windows\System\tngwEot.exe
  C:\Windows\System\tngwEot.exe
  2⤵
  PID:15528
- C:\Windows\System\WOShqCp.exe
  C:\Windows\System\WOShqCp.exe
  2⤵
  PID:15616
- C:\Windows\System\kKAFGdv.exe
  C:\Windows\System\kKAFGdv.exe
  2⤵
  PID:4992
- C:\Windows\System\itcWfoo.exe
  C:\Windows\System\itcWfoo.exe
  2⤵
  PID:15700
- C:\Windows\System\TmZtRKa.exe
  C:\Windows\System\TmZtRKa.exe
  2⤵
  PID:15744
- C:\Windows\System\BBNcWdK.exe
  C:\Windows\System\BBNcWdK.exe
  2⤵
  PID:15804
- C:\Windows\System\DwzkHIX.exe
  C:\Windows\System\DwzkHIX.exe
  2⤵
  PID:15860
- C:\Windows\System\rigYrqc.exe
  C:\Windows\System\rigYrqc.exe
  2⤵
  PID:15904
- C:\Windows\System\hWIYYPI.exe
  C:\Windows\System\hWIYYPI.exe
  2⤵
  PID:15988
- C:\Windows\System\POhZdkQ.exe
  C:\Windows\System\POhZdkQ.exe
  2⤵
  PID:16076
- C:\Windows\System\AIdiHbk.exe
  C:\Windows\System\AIdiHbk.exe
  2⤵
  PID:16176
- C:\Windows\System\FmMcoOJ.exe
  C:\Windows\System\FmMcoOJ.exe
  2⤵
  PID:16236
- C:\Windows\System\zYOcWix.exe
  C:\Windows\System\zYOcWix.exe
  2⤵
  PID:16304
- C:\Windows\System\DUbAEUb.exe
  C:\Windows\System\DUbAEUb.exe
  2⤵
  PID:16356
- C:\Windows\System\kdBersv.exe
  C:\Windows\System\kdBersv.exe
  2⤵
  PID:16380
- C:\Windows\System\tVdqUTu.exe
  C:\Windows\System\tVdqUTu.exe
  2⤵
  PID:15524
- C:\Windows\System\PPnxFQq.exe
  C:\Windows\System\PPnxFQq.exe
  2⤵
  PID:15676
- C:\Windows\System\UvvBJwI.exe
  C:\Windows\System\UvvBJwI.exe
  2⤵
  PID:15780
- C:\Windows\System\NLSnfVL.exe
  C:\Windows\System\NLSnfVL.exe
  2⤵
  PID:16036
- C:\Windows\System\BgxxHhM.exe
  C:\Windows\System\BgxxHhM.exe
  2⤵
  PID:16232
- C:\Windows\System\wDlFXXU.exe
  C:\Windows\System\wDlFXXU.exe
  2⤵
  PID:14572
- C:\Windows\System\gpxBoEo.exe
  C:\Windows\System\gpxBoEo.exe
  2⤵
  PID:15520
- C:\Windows\System\yBVpDQl.exe
  C:\Windows\System\yBVpDQl.exe
  2⤵
  PID:2144
- C:\Windows\System\THVLHtV.exe
  C:\Windows\System\THVLHtV.exe
  2⤵
  PID:15992
- C:\Windows\System\rXRJooO.exe
  C:\Windows\System\rXRJooO.exe
  2⤵
  PID:16256
- C:\Windows\System\HqMeNAr.exe
  C:\Windows\System\HqMeNAr.exe
  2⤵
  PID:16420
- C:\Windows\System\RjSIIIO.exe
  C:\Windows\System\RjSIIIO.exe
  2⤵
  PID:16444
- C:\Windows\System\WAVZurl.exe
  C:\Windows\System\WAVZurl.exe
  2⤵
  PID:16464
- C:\Windows\System\iTxCnaz.exe
  C:\Windows\System\iTxCnaz.exe
  2⤵
  PID:16484
- C:\Windows\System\teBGfzQ.exe
  C:\Windows\System\teBGfzQ.exe
  2⤵
  PID:16520
- C:\Windows\System\DhQIzWf.exe
  C:\Windows\System\DhQIzWf.exe
  2⤵
  PID:16536
- C:\Windows\System\aJIUIFI.exe
  C:\Windows\System\aJIUIFI.exe
  2⤵
  PID:16560
- C:\Windows\System\LdtcHqk.exe
  C:\Windows\System\LdtcHqk.exe
  2⤵
  PID:16600
- C:\Windows\System\MQpxduD.exe
  C:\Windows\System\MQpxduD.exe
  2⤵
  PID:16628
- C:\Windows\System\KAPTikX.exe
  C:\Windows\System\KAPTikX.exe
  2⤵
  PID:16672
- C:\Windows\System\IEdTkgT.exe
  C:\Windows\System\IEdTkgT.exe
  2⤵
  PID:16688
- C:\Windows\System\KBFiyqS.exe
  C:\Windows\System\KBFiyqS.exe
  2⤵
  PID:16712
- C:\Windows\System\LpLiqRF.exe
  C:\Windows\System\LpLiqRF.exe
  2⤵
  PID:16768
- C:\Windows\System\tMDhRQy.exe
  C:\Windows\System\tMDhRQy.exe
  2⤵
  PID:16788
- C:\Windows\System\PDKQnXb.exe
  C:\Windows\System\PDKQnXb.exe
  2⤵
  PID:16812
- C:\Windows\System\VUriqcf.exe
  C:\Windows\System\VUriqcf.exe
  2⤵
  PID:16832
- C:\Windows\System\WyulvDA.exe
  C:\Windows\System\WyulvDA.exe
  2⤵
  PID:16856
- C:\Windows\System\GdKOtHZ.exe
  C:\Windows\System\GdKOtHZ.exe
  2⤵
  PID:16872
- C:\Windows\System\fqWKrHw.exe
  C:\Windows\System\fqWKrHw.exe
  2⤵
  PID:16912
- C:\Windows\System\MMRtTcu.exe
  C:\Windows\System\MMRtTcu.exe
  2⤵
  PID:16940
- C:\Windows\System\ySHuYGo.exe
  C:\Windows\System\ySHuYGo.exe
  2⤵
  PID:16960
- C:\Windows\System\bvtsyan.exe
  C:\Windows\System\bvtsyan.exe
  2⤵
  PID:16992
- C:\Windows\System\XWbktFs.exe
  C:\Windows\System\XWbktFs.exe
  2⤵
  PID:17032
- C:\Windows\System\HVhzqoZ.exe
  C:\Windows\System\HVhzqoZ.exe
  2⤵
  PID:17064

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AgLCNnX.exe

Filesize
1.5MB

MD5
0dfa8021f8237fc5927a6d25370e72a8

SHA1
67923ca964e688d795d7cb2a3ff8b8e82f25125e

SHA256
d271b9b52d765897e7bf13f74c467b35068a8e5d815035d497c9ace2d414ca51

SHA512
a646458b0cfdb7ee8e59ac2aedd78b4db0d44dfa1900f0ab98d30141b865ab5ca40e43390baf0f23e3253ebca45ab4ea351b7337dedad4f24f0dd4515fd08e3e

Download Submit
C:\Windows\System\DeruZuM.exe

Filesize
1.5MB

MD5
785e91b6e0105a9d76d98fc5639da198

SHA1
e8d2010218d7be1b08c6f8dec938b9695db6e7fe

SHA256
1a7bda955667ecbc98f8c1071437bcd08e45af30ea379406737cc1df0b64659f

SHA512
279aa95063b5a0c31fcac2996004850cd8be63bc89d912d7168ade5ad9b3ff6ccee6f216d5d3fd6539d8cb2ce547f621dfa7c243aa164274c6af6c978a2db49d

Download Submit
C:\Windows\System\DpfphLX.exe

Filesize
1.5MB

MD5
66f6654e4e49efe48dd7ffcbbedab3a5

SHA1
6c28e8695bb3661d637ca6e0340953e8a4e6cdb1

SHA256
1a7a4eb1644745fb495eeb4d443beb84cf01742a2665e721a297f904e799a905

SHA512
8f1296250536c54174621569d3b274d653336f2503e41612ecdcbb618d0693c093e0753c2e470574f659846367bb9ff785216b28f8630bc6ab2550786be357ba

Download Submit
C:\Windows\System\EsYbKeg.exe

Filesize
1.5MB

MD5
a385ae029be02acf89bab3086a4b612f

SHA1
62590b304777318d22bbe50531895a242eda8e4b

SHA256
8da80ddc1174e315c8c6feab5ae3d0857bd738ea49aa5bc6543d6d886e6dde9b

SHA512
b698a67d549e11fb1e8273e51ed1802d616a7114122e6ef8555f92262c225c7b925eac88c319729062cf92218c54107458a99b8bf54c935d380e5cff7868d5b3

Download Submit
C:\Windows\System\GJotQhV.exe

Filesize
1.5MB

MD5
1a7316dde623692affba5444c127968f

SHA1
24a18ed4b0689adf2e5ce9f988eedda576ed2ff2

SHA256
4ad01294e9d02bc87807a8c31d5ad602dc8625af5e9605783f787876520e5052

SHA512
659d83b5ec97388e5073c99b43bd949e6d834886399430ac42c5a5a7f50242ec702236540f34027798ddf5e700e666789a141fff0d6749d66ceb5f8b6c4a026d

Download Submit
C:\Windows\System\HLzqPkd.exe

Filesize
1.5MB

MD5
681da125276e4aad7094ecd5f1d3505b

SHA1
04c3560cc0f991b6f195bcd753fca242cbf2e8eb

SHA256
a1048dd5cfaf237b79855b5bc60ca7927e48f046129b8fa21ebe171f2912f941

SHA512
243aca66140cd1858e4b481909131e69475b15cd4afcd08a09e3fe0e1060b29844ad30a5dc0a4c00fca2f722904b378094dd4ad586206915f18df9e3f80fe931

Download Submit
C:\Windows\System\IaQUGuU.exe

Filesize
1.5MB

MD5
642a623fd0cca393f943bd8a4813e759

SHA1
9954652a7a66319f73171d9561f84019456093f7

SHA256
ffa159e2ed10b45bdda159696b1fed3a8ed8b6682adfe9114951fadc88097b52

SHA512
42a9cdfe86a58eac21abd99c5be247660d5326c109d38d83c08a069842ebaebc37f9bc9c15f95f9f4d5093080568fe05df460cef5021f5232775a8875a32fb9d

Download Submit
C:\Windows\System\JplSegB.exe

Filesize
1.5MB

MD5
a0ba8bab90106dd107844f3ebf6e2242

SHA1
c38ec8838eb9fe9ed3569be0df3362dde2fa781c

SHA256
4c40c371fb4776b5a676318875a09eea4f231b7225d6ea7fe110fef2693b2b17

SHA512
304c794cfc77378b4e1f47372b313844e421f2f6f59ec46b4ba3a19242edde1b07d2cda8b84c391415384a6e2cf805bd5a25c429807302c2eef86450b15d6afd

Download Submit
C:\Windows\System\MMRppbi.exe

Filesize
1.5MB

MD5
c19dc4468289856470ee8786144cec66

SHA1
93dc1b9b3e9fb2ac0ea4a211e7e5e071cff39204

SHA256
427f53a2971518e61ab5a487c4b49805892c2d1de1ebd236fae0623227cc061e

SHA512
c3b63d441f32d11f7c2529d0bdff5dcbd7e1361f8b176284ceed97064fe52d4e1133ad80130c3e5d222778946406e673b19b79e453dffa6f4b86994573b2e122

Download Submit
C:\Windows\System\OdfiMtE.exe

Filesize
1.5MB

MD5
1e1ae300253aac4577a40124cdcc081d

SHA1
3e87ce4638622705ecbd37aec6aa968eabf47a56

SHA256
e30d2b8537d7382c7c71812e82ab0c14caecb4edef9a49f47ac2281a584fbe53

SHA512
ef3bd76d5750c44ed5552940dc4f80a166095b581be9646f0b8cb60832d0627dfcfdfe5758bded5192c9e45b2eb44af83910c765019ca29f6a8a38b2bc7fa273

Download Submit
C:\Windows\System\OtQynHH.exe

Filesize
1.5MB

MD5
614de227725b462a9443fc503a8dcac4

SHA1
b62dd9d0a7fcba91c484d944a3c895cd696ed9af

SHA256
e8dd9394ae76d1e7b41c0a0b959f545754ba228cd0b2057bddc7664e78432a99

SHA512
05c746eb93d415edebedfb69d2e8b6c59ea27637ce5b30d472cc8f53e8e55d240dd0ba430e4016774f7f2af97b54049a3bea7ce15268c97a6b08a120d8101369

Download Submit
C:\Windows\System\TTWpkvM.exe

Filesize
1.5MB

MD5
e47d9e072b8fdf481d96da4a96399679

SHA1
4be724329cee8e3c0a7b42c03dca6b2775519dd8

SHA256
9f7b1e928e2aa90e092cad68ccb4fa9dcd2850ac3d63077048930a8f22563c18

SHA512
851583cd978a0026e65ef2107419208e36a3bd520d689ac849446642877dd2f7aa1c4d337b431588d013e4fba9ec98a90a64b0ba5816f1c88f9ab1273961541c

Download Submit
C:\Windows\System\WyglTLC.exe

Filesize
1.5MB

MD5
cac1d0466f56764a07bbaa1893594151

SHA1
63f1a49e11c4f8cefa652383f43f228717160e84

SHA256
11aba6adf7f235182139f28c764d2e04fd77cc3e8d14d574ff3d67903a701f1d

SHA512
6ceecdbf299ab8351545b86a38f4a816b3a8dbe49b39528151d5003e0e32fc9e31bc1d7a44ced92b6444b8b8604a101f96ba5c03d00827ed16b5ba45f19d3882

Download Submit
C:\Windows\System\YAmBgcl.exe

Filesize
1.5MB

MD5
122e34e93a0db35300fa336b113101a1

SHA1
91fc1fd53bedcd71c25b9448c4f002df81eebdf9

SHA256
2daec0d1071c537cb767b2548763b5aa848f99aada3e6e1caadd2356dbf9d04a

SHA512
09da20d83d529142a93a2ec8025c330cb0b235ced2ef3fb50d8c8cb1c0a8e274c6609e02c3e5309989fcc1e2dc5dd579e6850783eaadecaa17ad7ac4f8c62497

Download Submit
C:\Windows\System\ZzVaCBe.exe

Filesize
1.5MB

MD5
73f4940d8824ad6d64dae0ac7b604c3c

SHA1
2a9a270d5b4c06b94548a2fb2ff5193f39b34d68

SHA256
228a935ed4ee4b3f873fa57d2d672b0de5e983aee3c41a1d72280e1aff1695e0

SHA512
e6442f1e12dd3f9c2d2e29577a67740256231e658f4c6440bbb62224bca038d0429920c88084bce8cbd1c42c7d166b73f7ae1f2bb39ee19266559839cb2a4114

Download Submit
C:\Windows\System\aPguabl.exe

Filesize
1.5MB

MD5
8fae8a74774e1011558912a29cde1c51

SHA1
afcfb5cda16e5693f3eae6d250d70253fc4187d8

SHA256
bede1d0fb006a4f98b110966893cdc4ed9fa8cca6186adfb9400884752ce5e07

SHA512
a20caedcea290f04afcf6635269ca6041a458d9c4efeeb19ff6d79bc4cc903ac5f69f8214cb8ab0d3b487035169ed4ee1a0045aa8c5c40b82865dfa22c7225ef

Download Submit
C:\Windows\System\fKijXUK.exe

Filesize
1.5MB

MD5
15a4d37b352ad449d2d172096d1f67f9

SHA1
71d37a09cd5b9df6f8f1ee02623b94108a5d747e

SHA256
dafd5b08690eeb5f000084be080c6f703981322d9e8b9af1aa95b46e2c494dcd

SHA512
eaa324fa4b7f45ef0f7ef247ce85fc3f186d93eb82a8be4e07b820d6ef78c0acb75367a10857badcb49fd15a6d79918ac52eb83365987e8d9587f2f6c85a600b

Download Submit
C:\Windows\System\hhTLEKL.exe

Filesize
1.5MB

MD5
310e522d00185b94b119be8922e7af78

SHA1
40f271113e35c3b372bc118c2b27c04e1d8269e8

SHA256
cd6477a9fd75794f9fbfb03558a88cebb085c3cc6eb9c2e733dc2593f8b97cf3

SHA512
4a0c8e7c8d1f17a436e1d93f9678927e683a35de8282df563f0422cc59bfed5ac5aefd898a8b7e3c790855ffb10742e840ae1508cc09ef646d2fac6ffeaf0710

Download Submit
C:\Windows\System\iHLfxzT.exe

Filesize
1.5MB

MD5
daaa62ad800e7b4f6dc70a85a4495164

SHA1
b6ae747937358dfc2bc7227f754d3c64f67765eb

SHA256
01d82b930f4a9cab2d650010ee3eba6471e91c0f5880e9f307078cb8c8ca093d

SHA512
da27ed80de2f819a996cd931b9d59032dc38f980a0a4a2e0a4180cfa6a44708768a541015210c1cc1df3c7b683ed6624ae47ae3cff9d5861844322da61bc5952

Download Submit
C:\Windows\System\iTnQBkQ.exe

Filesize
1.5MB

MD5
4ec5c7aa435e8b369fbbabf2f38015bc

SHA1
34772b280bd99be531c6062dd83070520f2f9bde

SHA256
ef35ae442846dd5d2b7b214b784da84365ea47cf6c295ef191ad5b8a0a7bb51e

SHA512
91689ef41503896357a02c5621cac2e5eb4f967cb0d266cb7c9f47c07b422c14ffad54960d317e5ac39d530af910b3a380da2022b465324f899b797f5a090a65

Download Submit
C:\Windows\System\jGiRNSn.exe

Filesize
1.5MB

MD5
a78587e9392ea6773ee06ba7309ef603

SHA1
362eac8d530bbaabe14b7e3d69fbe0c0e954c399

SHA256
0843fd7c0a5ed812e1e100db420a3690af95457f3a5165aeec96956b613c2e7a

SHA512
53ab8a5f9a2b4ef4cd13e1adfb430dff4057ff8f0a23d6084ef9b136473029f6030fe762dfccbbdf9916290588aa30775c7a2a3faa7637b3689f0d147b3e211d

Download Submit
C:\Windows\System\jdbaRCR.exe

Filesize
1.5MB

MD5
529fe3f67d81217574cf59983bb20f13

SHA1
6afccfab33e6ba8683c4d860afbba787e7dea683

SHA256
9c22fdc7938af58436b0be778bfb0303dbba6e66591d1009805da847748bf50b

SHA512
772d01d28aaa1d5e631046979804e471ffea5ba449ce9915d379b3a930b59866fcf48e2b635df44332b3ec0627273e8a168ad06bafac0e3db63afc30b91db5f6

Download Submit
C:\Windows\System\kWqyJFd.exe

Filesize
1.5MB

MD5
39699063af473e2143f26021155b1c71

SHA1
9afb2fb2c0695408fd73df8fad64ebb488fa2ece

SHA256
8b85391d6e176c1a0af0f0ee866b4a50ae4a60dce73a28ec7553b66e9f5cbd69

SHA512
01ac6c89fa0e90d62def13f06a67cd9a149f337655b4a0188759c6af9102babc27dd7b995e70304fd6b68c13af658b5da596a4cfb8658e1916575654ad2f71c8

Download Submit
C:\Windows\System\kYIkrFj.exe

Filesize
1.5MB

MD5
e150c69d4b5721a20aac3f516ba430ea

SHA1
78c71365189279925751092ce4dc3a9ee89cb47e

SHA256
5013a5d058521134b03769b7f999a66c83e957a3a9ae1306c3a483e976375039

SHA512
d30fe1646aa9be5b034c19aa877d54e7cc4ad863c1e88f55b4928131756a07fb0815657630b89b316b720fcd2a80e8008837269d186f9d28fd3dbf415671a11e

Download Submit
C:\Windows\System\lxCGNrJ.exe

Filesize
1.5MB

MD5
fe55ee10646e0e34c9be11feb2340ef6

SHA1
e7c70477f0bb5846c680c2eba100161841f114aa

SHA256
868e92c54cf740959ffa75d9ed0e39a1a4d46892ba9cb80c16f703a04ab1114d

SHA512
5ab3b0cc171c237caad0f013d0b46702f4edd9f6b9b91baa38caa70ec18509969ee980723462149b0521d8b42b0d911b879bd44d631698120836b34a09409260

Download Submit
C:\Windows\System\nJxPRnc.exe

Filesize
1.5MB

MD5
a7da05da709da434e0ce09329ae0c5a5

SHA1
3cb0549f6d1b8236bf78325483b865155801e850

SHA256
08fd882f853e7d3481658ed83123b62493b54637f296f65a5f187e3e06746ef7

SHA512
414187488924597b72ab7539da428026d810b503888d8f0920b9a19ada5af598c3b43015a57259e47506c807317249fe55a70898f3fe3b87f5d490eda3b32bda

Download Submit
C:\Windows\System\nwUFvSJ.exe

Filesize
1.5MB

MD5
63648b23f43804ee56c88cdce0ef4379

SHA1
39162b64b6d4e850c368050badf5ffeab002bddb

SHA256
62da005d223d84135b93b2561c12577f9f2a1fea47880aae749f21f2c8716eb5

SHA512
f0c8d51a1dc381d6a320be68a9a0d59240610073cce42e2cc08de22e0b0e63859ae8e06e85d821240f88f01285f86935779e2bdeaebc0c769bf17a79453f3c58

Download Submit
C:\Windows\System\pvEIbVQ.exe

Filesize
1.5MB

MD5
6f67016bc8e3424b75c3aed318a51f3c

SHA1
66e6cf278becf5215e7faa0ea56fddc3c1e7d5f5

SHA256
c4440f659e2b6774ec8968f3a1e543d23edc5bf7697ae32a823294f5a3ab4ff9

SHA512
32a089638e4c5b248f80b5fb278491ddbadf3631a2801e91d064669b2b5c3e401f20bec6f6e0f435fa4b8de59fa364d2b5ab9c53981587d0f9edd1e14d7270f5

Download Submit
C:\Windows\System\tTlFhkT.exe

Filesize
1.5MB

MD5
381f93d7bb9c4c3c8c148bb6ea671dc8

SHA1
39fb09ba0dbf08fdbc7e01575af1bb3f49c972a1

SHA256
0d8a918f3866ae27fb944b389a20287f9de409e5e27d818236e736dbd1da28c5

SHA512
92aa13e2fe48b685341d1020b73d0f8316ee253c57cc8d45c29568e93c80cf9bad686e9ec2f0957423a889c21d18040f6fec801e706482a204e697945a03dc8b

Download Submit
C:\Windows\System\urwNvYl.exe

Filesize
1.5MB

MD5
2d1d1363acbfa1852ea534e557359f5e

SHA1
cadf8042c506175b3a89f9994378d90d2f03cee5

SHA256
c1545bae43d4c41b610b53aeff7f159e9bbff8e70e5ab67e752a313c63916c6c

SHA512
738a57e17eaa8d75079d48bc6ac86822ce9da67fe70520f7582494f265b0fcd9b878a89f221e9cf596b0043601b72b59c461f55be5a27d8bb7c3b3ab7e0983b5

Download Submit
C:\Windows\System\yBvPSxN.exe

Filesize
1.5MB

MD5
3861af8b20debd79d63496ec2b461925

SHA1
f0c62f69d29c4a5b7c35b31fa8d917ae063651e2

SHA256
2f7ee92d757f07af5046be03fe7bed757d538c411a1889080d4f1a4099124d7e

SHA512
52c7252fb71b3068f4f25a187d2150d1095a35295524fdfbf95d3c960a92d73609a7cfdcab7433a1f6ecf54e5dcd68fb1e567da7786ce53b128dd7af1c6b1460

Download Submit
C:\Windows\System\yETjmfk.exe

Filesize
1.5MB

MD5
8eb6670449b0ff475d1f3b4f229eb103

SHA1
608a2e27c83a0aaa0c1f52bd6c34c5fd70fd68e0

SHA256
93f64a4d22dbcf348d815da29952f9e8678c23c7d8a841eea0909f870d02dd75

SHA512
6a55400ab5167bba7d161e41c291e3bc8eb5612e937172421275d02f7d75cebed26c1263684ffa5c416c03043ed07dd41da131c1c45ea1e30ed2e745ab55b156

Download Submit
C:\Windows\System\zNUewHm.exe

Filesize
1.5MB

MD5
b9c384ff7f78b6d517bc4fcb4b95c56d

SHA1
698b3baa9e969382466b2f392d87dd67c99ad921

SHA256
9c0e43394f1b1db160a38317c2c1b6d36f298827a7831353afe617ff7ab758d8

SHA512
52d312b9a8ec9eb59360c8da4a665925d2a1017f6ab9355fa7601e9ba45184a9f50d046294287b67fec05e7ac69352db8b5728bc41ef194d203239d5b42dd772

Download Submit
memory/2356-0-0x000001FC1CD80000-0x000001FC1CD90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads