xmrig | 5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065

Analysis

max time kernel
115s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
Size

1.1MB
MD5

1b946ea9712b27284e78d9e0c6da1958
SHA1

753a6ef08d27978343d7bd2f368e9751bd1448f3
SHA256

5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065
SHA512

1c0c70bc8d4dea23f296b777904f36f821b703ea62e2d116f3cb4eda54486264c497acd34a6e300d8633253bf622f169b0d8679f429be0591f512f130f371606
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPdxgsn:GezaTF8FcNkNdfE0pZ9ozttwIRRl0

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c9a-4.dat	xmrig
behavioral2/files/0x0007000000023c9e-7.dat	xmrig
behavioral2/files/0x0007000000023c9f-6.dat	xmrig
behavioral2/files/0x0007000000023ca2-23.dat	xmrig
behavioral2/files/0x0007000000023ca0-27.dat	xmrig
behavioral2/files/0x0007000000023ca3-34.dat	xmrig
behavioral2/files/0x0007000000023ca6-45.dat	xmrig
behavioral2/files/0x0007000000023ca5-48.dat	xmrig
behavioral2/files/0x0007000000023ca4-46.dat	xmrig
behavioral2/files/0x0007000000023ca1-25.dat	xmrig
behavioral2/files/0x0007000000023ca7-54.dat	xmrig
behavioral2/files/0x0008000000023c9b-59.dat	xmrig
behavioral2/files/0x0007000000023cb2-118.dat	xmrig
behavioral2/files/0x0007000000023cbc-142.dat	xmrig
behavioral2/files/0x0007000000023cb4-143.dat	xmrig
behavioral2/files/0x0007000000023cc2-172.dat	xmrig
behavioral2/files/0x0007000000023cb5-171.dat	xmrig
behavioral2/files/0x0007000000023cb3-170.dat	xmrig
behavioral2/files/0x0007000000023cc1-163.dat	xmrig
behavioral2/files/0x0007000000023cbb-161.dat	xmrig
behavioral2/files/0x0007000000023cc0-158.dat	xmrig
behavioral2/files/0x0007000000023cb9-153.dat	xmrig
behavioral2/files/0x0007000000023cbf-152.dat	xmrig
behavioral2/files/0x0007000000023cb0-150.dat	xmrig
behavioral2/files/0x0007000000023cbe-148.dat	xmrig
behavioral2/files/0x0007000000023cbd-147.dat	xmrig
behavioral2/files/0x0007000000023cb1-164.dat	xmrig
behavioral2/files/0x0007000000023ca9-139.dat	xmrig
behavioral2/files/0x0007000000023cba-138.dat	xmrig
behavioral2/files/0x0007000000023cb8-132.dat	xmrig
behavioral2/files/0x0007000000023cb6-127.dat	xmrig
behavioral2/files/0x0007000000023caf-120.dat	xmrig
behavioral2/files/0x0007000000023cae-110.dat	xmrig
behavioral2/files/0x0007000000023cab-102.dat	xmrig
behavioral2/files/0x0007000000023cb7-131.dat	xmrig
behavioral2/files/0x0007000000023cac-93.dat	xmrig
behavioral2/files/0x0007000000023caa-84.dat	xmrig
behavioral2/files/0x0007000000023cad-105.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
628	cagCkEG.exe
3784	taylUfl.exe
2104	kvmWXje.exe
2544	swzFYVF.exe
3804	nzRmVzD.exe
4696	jiALbRg.exe
3052	bsaoRMU.exe
644	asEUjqk.exe
1636	DWQmiBJ.exe
2396	mYLhWUu.exe
1708	LeaazTg.exe
1328	IUHqwey.exe
3820	AHzPBCN.exe
4308	jXuzBCX.exe
3624	VfgSFkB.exe
3736	DdXruQZ.exe
3524	EOELsSN.exe
2412	peSOWfm.exe
1032	vDSLCYt.exe
3764	uslSkco.exe
3008	SgFvttX.exe
3168	uKBulTh.exe
4992	FFdrVHr.exe
2216	FKhXuZK.exe
1672	yOEgwzs.exe
1524	JLvAYjD.exe
5044	loOIjZU.exe
4968	EdMLhcR.exe
436	usBORUl.exe
2160	AgvrGzr.exe
5048	tlFKagJ.exe
1468	MDtTRbA.exe
1816	sYZRlOQ.exe
3340	pwNUiTY.exe
2456	eIMbsgJ.exe
2040	oxNtmby.exe
1416	QbbNbkk.exe
3268	ATTJaKD.exe
1028	SUOndAt.exe
4596	XhTHCKe.exe
3280	rayGUyX.exe
1868	LVqABkS.exe
460	Esqxfcz.exe
1036	qZFTuPQ.exe
816	trmBNEu.exe
4776	qOkqOLk.exe
1364	xDIDFXY.exe
4748	mFxdHpX.exe
1516	QdCOtgP.exe
2852	xUEvcvS.exe
3532	yVZCwVz.exe
1496	LvDaKmc.exe
4008	QjVUWCd.exe
904	evaOkAt.exe
4948	hFkTECs.exe
3572	pRZllFo.exe
4288	hXIzDWA.exe
3708	PsuMjkc.exe
1100	RAzJJNh.exe
2000	werTkYG.exe
3792	bftkGtq.exe
732	HYndhmI.exe
3496	Ipogmtx.exe
3368	VoQkJYe.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vpvFADQ.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\FKhXuZK.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\ffYXeau.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\fXgkQGm.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\FCEiNjA.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\kvmWXje.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\zdAeuBk.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\GQbclJh.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\iHwMTQu.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\pZQGmOX.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\aYDmxRx.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\RUecfBQ.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\QwBGKrD.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\UDbIRLV.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\fcmJLTu.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\uBkrLGW.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\buHEyuD.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\Wlkegiu.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\zdskJdZ.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\gnncCku.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\CxpXHwf.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\pAuOJTA.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\ZskaAGw.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\GYWibmG.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\wuyNoFN.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\dsmdEZG.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\EzhyIcw.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\FvSYjtW.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\GAVjAOK.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\VdwAuyu.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\PuaCdaZ.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\QiSmUBE.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\ANfJUqG.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\YUXgiAZ.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\YsUwXAV.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\VfgSFkB.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\UnLwRZm.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\eiXZiWm.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\qIsYpus.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\NjOSHbV.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\hfAxiwU.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\CQuweKy.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\NAnMsfm.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\wVyAeBw.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\QCpJFqu.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\jLAApyv.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\kTshJmw.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\YlrTvcX.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\PWlsBWI.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\JLvAYjD.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\xlqIwgN.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\DdXruQZ.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\hGmRHBn.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\WPKduTp.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\kUwBWgm.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\FCaWFNk.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\OpduZII.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\VjemIZI.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\KIpLNDo.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\NsjIEav.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\DWQmiBJ.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\lRvjAPL.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\PstbgJD.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
File created	C:\Windows\System\dHiHXDv.exe	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17080	dwm.exe
Token: SeChangeNotifyPrivilege	17080	dwm.exe
Token: 33	17080	dwm.exe
Token: SeIncBasePriorityPrivilege	17080	dwm.exe
Token: SeShutdownPrivilege	17080	dwm.exe
Token: SeCreatePagefilePrivilege	17080	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 628	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	84
PID 1536 wrote to memory of 628	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	84
PID 1536 wrote to memory of 3784	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	85
PID 1536 wrote to memory of 3784	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	85
PID 1536 wrote to memory of 2104	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	86
PID 1536 wrote to memory of 2104	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	86
PID 1536 wrote to memory of 3804	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	87
PID 1536 wrote to memory of 3804	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	87
PID 1536 wrote to memory of 2544	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	88
PID 1536 wrote to memory of 2544	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	88
PID 1536 wrote to memory of 4696	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	89
PID 1536 wrote to memory of 4696	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	89
PID 1536 wrote to memory of 3052	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	90
PID 1536 wrote to memory of 3052	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	90
PID 1536 wrote to memory of 644	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	91
PID 1536 wrote to memory of 644	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	91
PID 1536 wrote to memory of 1636	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	92
PID 1536 wrote to memory of 1636	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	92
PID 1536 wrote to memory of 2396	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	93
PID 1536 wrote to memory of 2396	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	93
PID 1536 wrote to memory of 1708	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	94
PID 1536 wrote to memory of 1708	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	94
PID 1536 wrote to memory of 1328	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	95
PID 1536 wrote to memory of 1328	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	95
PID 1536 wrote to memory of 3820	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	96
PID 1536 wrote to memory of 3820	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	96
PID 1536 wrote to memory of 4308	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	97
PID 1536 wrote to memory of 4308	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	97
PID 1536 wrote to memory of 3624	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	98
PID 1536 wrote to memory of 3624	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	98
PID 1536 wrote to memory of 3736	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	99
PID 1536 wrote to memory of 3736	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	99
PID 1536 wrote to memory of 3524	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	100
PID 1536 wrote to memory of 3524	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	100
PID 1536 wrote to memory of 2412	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	101
PID 1536 wrote to memory of 2412	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	101
PID 1536 wrote to memory of 1032	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	102
PID 1536 wrote to memory of 1032	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	102
PID 1536 wrote to memory of 3764	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	103
PID 1536 wrote to memory of 3764	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	103
PID 1536 wrote to memory of 3008	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	104
PID 1536 wrote to memory of 3008	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	104
PID 1536 wrote to memory of 3168	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	105
PID 1536 wrote to memory of 3168	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	105
PID 1536 wrote to memory of 4992	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	106
PID 1536 wrote to memory of 4992	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	106
PID 1536 wrote to memory of 1468	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	107
PID 1536 wrote to memory of 1468	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	107
PID 1536 wrote to memory of 2216	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	108
PID 1536 wrote to memory of 2216	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	108
PID 1536 wrote to memory of 1672	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	109
PID 1536 wrote to memory of 1672	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	109
PID 1536 wrote to memory of 1524	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	110
PID 1536 wrote to memory of 1524	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	110
PID 1536 wrote to memory of 5044	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	111
PID 1536 wrote to memory of 5044	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	111
PID 1536 wrote to memory of 4968	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	112
PID 1536 wrote to memory of 4968	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	112
PID 1536 wrote to memory of 436	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	113
PID 1536 wrote to memory of 436	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	113
PID 1536 wrote to memory of 2160	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	114
PID 1536 wrote to memory of 2160	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	114
PID 1536 wrote to memory of 5048	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	115
PID 1536 wrote to memory of 5048	1536	5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe	115

C:\Users\Admin\AppData\Local\Temp\5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe
"C:\Users\Admin\AppData\Local\Temp\5a095b9af14c8ce36dfc12d40b99f4b2878152a3166ebbc7ae28aa9b2152e065.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\System\cagCkEG.exe
  C:\Windows\System\cagCkEG.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\taylUfl.exe
  C:\Windows\System\taylUfl.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\kvmWXje.exe
  C:\Windows\System\kvmWXje.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\nzRmVzD.exe
  C:\Windows\System\nzRmVzD.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\swzFYVF.exe
  C:\Windows\System\swzFYVF.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\jiALbRg.exe
  C:\Windows\System\jiALbRg.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\bsaoRMU.exe
  C:\Windows\System\bsaoRMU.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\asEUjqk.exe
  C:\Windows\System\asEUjqk.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\DWQmiBJ.exe
  C:\Windows\System\DWQmiBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\mYLhWUu.exe
  C:\Windows\System\mYLhWUu.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\LeaazTg.exe
  C:\Windows\System\LeaazTg.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\IUHqwey.exe
  C:\Windows\System\IUHqwey.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\AHzPBCN.exe
  C:\Windows\System\AHzPBCN.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\jXuzBCX.exe
  C:\Windows\System\jXuzBCX.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\VfgSFkB.exe
  C:\Windows\System\VfgSFkB.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\DdXruQZ.exe
  C:\Windows\System\DdXruQZ.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\EOELsSN.exe
  C:\Windows\System\EOELsSN.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\peSOWfm.exe
  C:\Windows\System\peSOWfm.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\vDSLCYt.exe
  C:\Windows\System\vDSLCYt.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\uslSkco.exe
  C:\Windows\System\uslSkco.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\SgFvttX.exe
  C:\Windows\System\SgFvttX.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\uKBulTh.exe
  C:\Windows\System\uKBulTh.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\FFdrVHr.exe
  C:\Windows\System\FFdrVHr.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\MDtTRbA.exe
  C:\Windows\System\MDtTRbA.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\FKhXuZK.exe
  C:\Windows\System\FKhXuZK.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\yOEgwzs.exe
  C:\Windows\System\yOEgwzs.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\JLvAYjD.exe
  C:\Windows\System\JLvAYjD.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\loOIjZU.exe
  C:\Windows\System\loOIjZU.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\EdMLhcR.exe
  C:\Windows\System\EdMLhcR.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\usBORUl.exe
  C:\Windows\System\usBORUl.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\AgvrGzr.exe
  C:\Windows\System\AgvrGzr.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\tlFKagJ.exe
  C:\Windows\System\tlFKagJ.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\sYZRlOQ.exe
  C:\Windows\System\sYZRlOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\pwNUiTY.exe
  C:\Windows\System\pwNUiTY.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\eIMbsgJ.exe
  C:\Windows\System\eIMbsgJ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\oxNtmby.exe
  C:\Windows\System\oxNtmby.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\QbbNbkk.exe
  C:\Windows\System\QbbNbkk.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\ATTJaKD.exe
  C:\Windows\System\ATTJaKD.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\SUOndAt.exe
  C:\Windows\System\SUOndAt.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\XhTHCKe.exe
  C:\Windows\System\XhTHCKe.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\rayGUyX.exe
  C:\Windows\System\rayGUyX.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\LVqABkS.exe
  C:\Windows\System\LVqABkS.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\trmBNEu.exe
  C:\Windows\System\trmBNEu.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\Esqxfcz.exe
  C:\Windows\System\Esqxfcz.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\qZFTuPQ.exe
  C:\Windows\System\qZFTuPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\qOkqOLk.exe
  C:\Windows\System\qOkqOLk.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\xDIDFXY.exe
  C:\Windows\System\xDIDFXY.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\mFxdHpX.exe
  C:\Windows\System\mFxdHpX.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\QdCOtgP.exe
  C:\Windows\System\QdCOtgP.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\xUEvcvS.exe
  C:\Windows\System\xUEvcvS.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\yVZCwVz.exe
  C:\Windows\System\yVZCwVz.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\LvDaKmc.exe
  C:\Windows\System\LvDaKmc.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\QjVUWCd.exe
  C:\Windows\System\QjVUWCd.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\PsuMjkc.exe
  C:\Windows\System\PsuMjkc.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\evaOkAt.exe
  C:\Windows\System\evaOkAt.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\hFkTECs.exe
  C:\Windows\System\hFkTECs.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\pRZllFo.exe
  C:\Windows\System\pRZllFo.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\werTkYG.exe
  C:\Windows\System\werTkYG.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\hXIzDWA.exe
  C:\Windows\System\hXIzDWA.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\RAzJJNh.exe
  C:\Windows\System\RAzJJNh.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\bftkGtq.exe
  C:\Windows\System\bftkGtq.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\HYndhmI.exe
  C:\Windows\System\HYndhmI.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\Ipogmtx.exe
  C:\Windows\System\Ipogmtx.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\VoQkJYe.exe
  C:\Windows\System\VoQkJYe.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\WlONfVm.exe
  C:\Windows\System\WlONfVm.exe
  2⤵
  PID:1004
- C:\Windows\System\yagfmfn.exe
  C:\Windows\System\yagfmfn.exe
  2⤵
  PID:2420
- C:\Windows\System\oOXAOsV.exe
  C:\Windows\System\oOXAOsV.exe
  2⤵
  PID:1220
- C:\Windows\System\JKkhcxi.exe
  C:\Windows\System\JKkhcxi.exe
  2⤵
  PID:3440
- C:\Windows\System\papTndj.exe
  C:\Windows\System\papTndj.exe
  2⤵
  PID:756
- C:\Windows\System\uvOgSsL.exe
  C:\Windows\System\uvOgSsL.exe
  2⤵
  PID:4564
- C:\Windows\System\pmaduxE.exe
  C:\Windows\System\pmaduxE.exe
  2⤵
  PID:2200
- C:\Windows\System\qKBbsTS.exe
  C:\Windows\System\qKBbsTS.exe
  2⤵
  PID:1224
- C:\Windows\System\hvpLMKW.exe
  C:\Windows\System\hvpLMKW.exe
  2⤵
  PID:4936
- C:\Windows\System\iBOwnAD.exe
  C:\Windows\System\iBOwnAD.exe
  2⤵
  PID:4356
- C:\Windows\System\IpBDjQE.exe
  C:\Windows\System\IpBDjQE.exe
  2⤵
  PID:1456
- C:\Windows\System\LnbERpo.exe
  C:\Windows\System\LnbERpo.exe
  2⤵
  PID:1972
- C:\Windows\System\dgPfsQf.exe
  C:\Windows\System\dgPfsQf.exe
  2⤵
  PID:3968
- C:\Windows\System\ZxSuqmK.exe
  C:\Windows\System\ZxSuqmK.exe
  2⤵
  PID:2904
- C:\Windows\System\YExPsop.exe
  C:\Windows\System\YExPsop.exe
  2⤵
  PID:5068
- C:\Windows\System\KexzWzW.exe
  C:\Windows\System\KexzWzW.exe
  2⤵
  PID:1584
- C:\Windows\System\ntOIpyz.exe
  C:\Windows\System\ntOIpyz.exe
  2⤵
  PID:4336
- C:\Windows\System\AQNWOcN.exe
  C:\Windows\System\AQNWOcN.exe
  2⤵
  PID:408
- C:\Windows\System\HKSXRAX.exe
  C:\Windows\System\HKSXRAX.exe
  2⤵
  PID:3120
- C:\Windows\System\fcmJLTu.exe
  C:\Windows\System\fcmJLTu.exe
  2⤵
  PID:2036
- C:\Windows\System\wfbsBQS.exe
  C:\Windows\System\wfbsBQS.exe
  2⤵
  PID:4652
- C:\Windows\System\jTUxhxJ.exe
  C:\Windows\System\jTUxhxJ.exe
  2⤵
  PID:3952
- C:\Windows\System\FILupXF.exe
  C:\Windows\System\FILupXF.exe
  2⤵
  PID:2004
- C:\Windows\System\KQDygVY.exe
  C:\Windows\System\KQDygVY.exe
  2⤵
  PID:3592
- C:\Windows\System\hHwEjyx.exe
  C:\Windows\System\hHwEjyx.exe
  2⤵
  PID:2348
- C:\Windows\System\iiJAdcE.exe
  C:\Windows\System\iiJAdcE.exe
  2⤵
  PID:4024
- C:\Windows\System\aORKUFy.exe
  C:\Windows\System\aORKUFy.exe
  2⤵
  PID:2696
- C:\Windows\System\CYLteTU.exe
  C:\Windows\System\CYLteTU.exe
  2⤵
  PID:2724
- C:\Windows\System\oABrHbN.exe
  C:\Windows\System\oABrHbN.exe
  2⤵
  PID:3800
- C:\Windows\System\OyLwNTq.exe
  C:\Windows\System\OyLwNTq.exe
  2⤵
  PID:3692
- C:\Windows\System\tSsivtr.exe
  C:\Windows\System\tSsivtr.exe
  2⤵
  PID:908
- C:\Windows\System\BkfOcHO.exe
  C:\Windows\System\BkfOcHO.exe
  2⤵
  PID:3636
- C:\Windows\System\fxaNeqg.exe
  C:\Windows\System\fxaNeqg.exe
  2⤵
  PID:2332
- C:\Windows\System\UOnuuPr.exe
  C:\Windows\System\UOnuuPr.exe
  2⤵
  PID:3484
- C:\Windows\System\UpNItAh.exe
  C:\Windows\System\UpNItAh.exe
  2⤵
  PID:4724
- C:\Windows\System\vdLuTYZ.exe
  C:\Windows\System\vdLuTYZ.exe
  2⤵
  PID:5008
- C:\Windows\System\NhfTzua.exe
  C:\Windows\System\NhfTzua.exe
  2⤵
  PID:4332
- C:\Windows\System\ImlIiUK.exe
  C:\Windows\System\ImlIiUK.exe
  2⤵
  PID:4572
- C:\Windows\System\PWQjOhL.exe
  C:\Windows\System\PWQjOhL.exe
  2⤵
  PID:1820
- C:\Windows\System\NmNNBSB.exe
  C:\Windows\System\NmNNBSB.exe
  2⤵
  PID:5156
- C:\Windows\System\YGYbWVP.exe
  C:\Windows\System\YGYbWVP.exe
  2⤵
  PID:5180
- C:\Windows\System\sjTobND.exe
  C:\Windows\System\sjTobND.exe
  2⤵
  PID:5208
- C:\Windows\System\ffYXeau.exe
  C:\Windows\System\ffYXeau.exe
  2⤵
  PID:5236
- C:\Windows\System\dHiHXDv.exe
  C:\Windows\System\dHiHXDv.exe
  2⤵
  PID:5264
- C:\Windows\System\ZMtqcFc.exe
  C:\Windows\System\ZMtqcFc.exe
  2⤵
  PID:5300
- C:\Windows\System\avRQfbZ.exe
  C:\Windows\System\avRQfbZ.exe
  2⤵
  PID:5328
- C:\Windows\System\OyAKmBD.exe
  C:\Windows\System\OyAKmBD.exe
  2⤵
  PID:5352
- C:\Windows\System\VqSuQef.exe
  C:\Windows\System\VqSuQef.exe
  2⤵
  PID:5376
- C:\Windows\System\UxUZLuE.exe
  C:\Windows\System\UxUZLuE.exe
  2⤵
  PID:5412
- C:\Windows\System\eNIOCzn.exe
  C:\Windows\System\eNIOCzn.exe
  2⤵
  PID:5448
- C:\Windows\System\ETGVGtX.exe
  C:\Windows\System\ETGVGtX.exe
  2⤵
  PID:5480
- C:\Windows\System\JJnkuTm.exe
  C:\Windows\System\JJnkuTm.exe
  2⤵
  PID:5516
- C:\Windows\System\qSaVDDQ.exe
  C:\Windows\System\qSaVDDQ.exe
  2⤵
  PID:5532
- C:\Windows\System\hmIFiZM.exe
  C:\Windows\System\hmIFiZM.exe
  2⤵
  PID:5568
- C:\Windows\System\SNlNcNy.exe
  C:\Windows\System\SNlNcNy.exe
  2⤵
  PID:5600
- C:\Windows\System\FQHpyYg.exe
  C:\Windows\System\FQHpyYg.exe
  2⤵
  PID:5628
- C:\Windows\System\sWlKybp.exe
  C:\Windows\System\sWlKybp.exe
  2⤵
  PID:5656
- C:\Windows\System\PfOIRrF.exe
  C:\Windows\System\PfOIRrF.exe
  2⤵
  PID:5680
- C:\Windows\System\pusqTGZ.exe
  C:\Windows\System\pusqTGZ.exe
  2⤵
  PID:5712
- C:\Windows\System\JsxywcD.exe
  C:\Windows\System\JsxywcD.exe
  2⤵
  PID:5740
- C:\Windows\System\jwrPfIn.exe
  C:\Windows\System\jwrPfIn.exe
  2⤵
  PID:5760
- C:\Windows\System\muiXFBY.exe
  C:\Windows\System\muiXFBY.exe
  2⤵
  PID:5784
- C:\Windows\System\GJBtAqB.exe
  C:\Windows\System\GJBtAqB.exe
  2⤵
  PID:5808
- C:\Windows\System\BvNJvMW.exe
  C:\Windows\System\BvNJvMW.exe
  2⤵
  PID:5844
- C:\Windows\System\NfKbxDi.exe
  C:\Windows\System\NfKbxDi.exe
  2⤵
  PID:5876
- C:\Windows\System\DsKcASj.exe
  C:\Windows\System\DsKcASj.exe
  2⤵
  PID:5896
- C:\Windows\System\AmwbWFK.exe
  C:\Windows\System\AmwbWFK.exe
  2⤵
  PID:5928
- C:\Windows\System\IrhBXYB.exe
  C:\Windows\System\IrhBXYB.exe
  2⤵
  PID:5956
- C:\Windows\System\xQkecsU.exe
  C:\Windows\System\xQkecsU.exe
  2⤵
  PID:5984
- C:\Windows\System\fnvNMFW.exe
  C:\Windows\System\fnvNMFW.exe
  2⤵
  PID:6016
- C:\Windows\System\RTMlzHV.exe
  C:\Windows\System\RTMlzHV.exe
  2⤵
  PID:6040
- C:\Windows\System\mGLgekm.exe
  C:\Windows\System\mGLgekm.exe
  2⤵
  PID:6076
- C:\Windows\System\YyxtSdg.exe
  C:\Windows\System\YyxtSdg.exe
  2⤵
  PID:6100
- C:\Windows\System\LbNVOLv.exe
  C:\Windows\System\LbNVOLv.exe
  2⤵
  PID:6124
- C:\Windows\System\GqeylEr.exe
  C:\Windows\System\GqeylEr.exe
  2⤵
  PID:3528
- C:\Windows\System\filiplq.exe
  C:\Windows\System\filiplq.exe
  2⤵
  PID:5176
- C:\Windows\System\SmMZpyp.exe
  C:\Windows\System\SmMZpyp.exe
  2⤵
  PID:5252
- C:\Windows\System\ROpVfbW.exe
  C:\Windows\System\ROpVfbW.exe
  2⤵
  PID:5296
- C:\Windows\System\yRZFWVg.exe
  C:\Windows\System\yRZFWVg.exe
  2⤵
  PID:5396
- C:\Windows\System\BwUOkpJ.exe
  C:\Windows\System\BwUOkpJ.exe
  2⤵
  PID:5428
- C:\Windows\System\wzUJJWU.exe
  C:\Windows\System\wzUJJWU.exe
  2⤵
  PID:5616
- C:\Windows\System\nsofvcv.exe
  C:\Windows\System\nsofvcv.exe
  2⤵
  PID:5612
- C:\Windows\System\bLbRCHp.exe
  C:\Windows\System\bLbRCHp.exe
  2⤵
  PID:5704
- C:\Windows\System\ezeNxrI.exe
  C:\Windows\System\ezeNxrI.exe
  2⤵
  PID:5728
- C:\Windows\System\JjWHDHY.exe
  C:\Windows\System\JjWHDHY.exe
  2⤵
  PID:5768
- C:\Windows\System\JHawFwl.exe
  C:\Windows\System\JHawFwl.exe
  2⤵
  PID:5800
- C:\Windows\System\rCvCJAA.exe
  C:\Windows\System\rCvCJAA.exe
  2⤵
  PID:5872
- C:\Windows\System\ACfAFrq.exe
  C:\Windows\System\ACfAFrq.exe
  2⤵
  PID:5916
- C:\Windows\System\qDdAwot.exe
  C:\Windows\System\qDdAwot.exe
  2⤵
  PID:5948
- C:\Windows\System\BbqePBD.exe
  C:\Windows\System\BbqePBD.exe
  2⤵
  PID:5972
- C:\Windows\System\qKkPZnX.exe
  C:\Windows\System\qKkPZnX.exe
  2⤵
  PID:6032
- C:\Windows\System\RAvxdKU.exe
  C:\Windows\System\RAvxdKU.exe
  2⤵
  PID:1980
- C:\Windows\System\CgbRSew.exe
  C:\Windows\System\CgbRSew.exe
  2⤵
  PID:5224
- C:\Windows\System\MgQupLA.exe
  C:\Windows\System\MgQupLA.exe
  2⤵
  PID:5216
- C:\Windows\System\UeZNTco.exe
  C:\Windows\System\UeZNTco.exe
  2⤵
  PID:5432
- C:\Windows\System\FvSYjtW.exe
  C:\Windows\System\FvSYjtW.exe
  2⤵
  PID:5500
- C:\Windows\System\TAuOyKR.exe
  C:\Windows\System\TAuOyKR.exe
  2⤵
  PID:5828
- C:\Windows\System\reNWAlZ.exe
  C:\Windows\System\reNWAlZ.exe
  2⤵
  PID:5912
- C:\Windows\System\agnyIMY.exe
  C:\Windows\System\agnyIMY.exe
  2⤵
  PID:5804
- C:\Windows\System\PUrULiV.exe
  C:\Windows\System\PUrULiV.exe
  2⤵
  PID:6140
- C:\Windows\System\GAVjAOK.exe
  C:\Windows\System\GAVjAOK.exe
  2⤵
  PID:5460
- C:\Windows\System\CLdLGLC.exe
  C:\Windows\System\CLdLGLC.exe
  2⤵
  PID:5320
- C:\Windows\System\iHwMTQu.exe
  C:\Windows\System\iHwMTQu.exe
  2⤵
  PID:6168
- C:\Windows\System\LlEVuWy.exe
  C:\Windows\System\LlEVuWy.exe
  2⤵
  PID:6196
- C:\Windows\System\xaFFEUz.exe
  C:\Windows\System\xaFFEUz.exe
  2⤵
  PID:6220
- C:\Windows\System\UNZCbqC.exe
  C:\Windows\System\UNZCbqC.exe
  2⤵
  PID:6244
- C:\Windows\System\MpbfYMX.exe
  C:\Windows\System\MpbfYMX.exe
  2⤵
  PID:6272
- C:\Windows\System\kORJmrk.exe
  C:\Windows\System\kORJmrk.exe
  2⤵
  PID:6300
- C:\Windows\System\otCHzeG.exe
  C:\Windows\System\otCHzeG.exe
  2⤵
  PID:6324
- C:\Windows\System\tgSrkgX.exe
  C:\Windows\System\tgSrkgX.exe
  2⤵
  PID:6348
- C:\Windows\System\YdTyOYA.exe
  C:\Windows\System\YdTyOYA.exe
  2⤵
  PID:6384
- C:\Windows\System\gVvSnxN.exe
  C:\Windows\System\gVvSnxN.exe
  2⤵
  PID:6412
- C:\Windows\System\CBFAFlu.exe
  C:\Windows\System\CBFAFlu.exe
  2⤵
  PID:6436
- C:\Windows\System\WyjSCuu.exe
  C:\Windows\System\WyjSCuu.exe
  2⤵
  PID:6460
- C:\Windows\System\hSrGlzt.exe
  C:\Windows\System\hSrGlzt.exe
  2⤵
  PID:6492
- C:\Windows\System\RuXJbBR.exe
  C:\Windows\System\RuXJbBR.exe
  2⤵
  PID:6516
- C:\Windows\System\fuwdlUV.exe
  C:\Windows\System\fuwdlUV.exe
  2⤵
  PID:6544
- C:\Windows\System\EoJLImw.exe
  C:\Windows\System\EoJLImw.exe
  2⤵
  PID:6576
- C:\Windows\System\HnyFQbX.exe
  C:\Windows\System\HnyFQbX.exe
  2⤵
  PID:6604
- C:\Windows\System\ttHKyBA.exe
  C:\Windows\System\ttHKyBA.exe
  2⤵
  PID:6640
- C:\Windows\System\QyArems.exe
  C:\Windows\System\QyArems.exe
  2⤵
  PID:6660
- C:\Windows\System\PYSTguH.exe
  C:\Windows\System\PYSTguH.exe
  2⤵
  PID:6684
- C:\Windows\System\drtIdle.exe
  C:\Windows\System\drtIdle.exe
  2⤵
  PID:6712
- C:\Windows\System\HPujLLu.exe
  C:\Windows\System\HPujLLu.exe
  2⤵
  PID:6744
- C:\Windows\System\YbhlFqo.exe
  C:\Windows\System\YbhlFqo.exe
  2⤵
  PID:6764
- C:\Windows\System\aPkVZFY.exe
  C:\Windows\System\aPkVZFY.exe
  2⤵
  PID:6784
- C:\Windows\System\azwHbAD.exe
  C:\Windows\System\azwHbAD.exe
  2⤵
  PID:6804
- C:\Windows\System\ZPDRDcG.exe
  C:\Windows\System\ZPDRDcG.exe
  2⤵
  PID:6832
- C:\Windows\System\uQKKXyf.exe
  C:\Windows\System\uQKKXyf.exe
  2⤵
  PID:6860
- C:\Windows\System\QGdjpIC.exe
  C:\Windows\System\QGdjpIC.exe
  2⤵
  PID:6884
- C:\Windows\System\cjfpPUy.exe
  C:\Windows\System\cjfpPUy.exe
  2⤵
  PID:6912
- C:\Windows\System\hfhQNht.exe
  C:\Windows\System\hfhQNht.exe
  2⤵
  PID:6936
- C:\Windows\System\OYEHKTE.exe
  C:\Windows\System\OYEHKTE.exe
  2⤵
  PID:6964
- C:\Windows\System\mnqaqDW.exe
  C:\Windows\System\mnqaqDW.exe
  2⤵
  PID:6992
- C:\Windows\System\GYWibmG.exe
  C:\Windows\System\GYWibmG.exe
  2⤵
  PID:7020
- C:\Windows\System\SnOvKPl.exe
  C:\Windows\System\SnOvKPl.exe
  2⤵
  PID:7048
- C:\Windows\System\gFTLLFX.exe
  C:\Windows\System\gFTLLFX.exe
  2⤵
  PID:7072
- C:\Windows\System\veVACKq.exe
  C:\Windows\System\veVACKq.exe
  2⤵
  PID:7100
- C:\Windows\System\OEXbQfU.exe
  C:\Windows\System\OEXbQfU.exe
  2⤵
  PID:7120
- C:\Windows\System\FnRwgeh.exe
  C:\Windows\System\FnRwgeh.exe
  2⤵
  PID:7144
- C:\Windows\System\LBRRrXw.exe
  C:\Windows\System\LBRRrXw.exe
  2⤵
  PID:5908
- C:\Windows\System\SGfArci.exe
  C:\Windows\System\SGfArci.exe
  2⤵
  PID:5796
- C:\Windows\System\otfmgfp.exe
  C:\Windows\System\otfmgfp.exe
  2⤵
  PID:5940
- C:\Windows\System\skQaDSD.exe
  C:\Windows\System\skQaDSD.exe
  2⤵
  PID:6232
- C:\Windows\System\SYIyhvD.exe
  C:\Windows\System\SYIyhvD.exe
  2⤵
  PID:6212
- C:\Windows\System\FocPCzU.exe
  C:\Windows\System\FocPCzU.exe
  2⤵
  PID:6284
- C:\Windows\System\ncERgJg.exe
  C:\Windows\System\ncERgJg.exe
  2⤵
  PID:6428
- C:\Windows\System\WFxhDYf.exe
  C:\Windows\System\WFxhDYf.exe
  2⤵
  PID:6268
- C:\Windows\System\PsCgGBI.exe
  C:\Windows\System\PsCgGBI.exe
  2⤵
  PID:6504
- C:\Windows\System\NGmEJcm.exe
  C:\Windows\System\NGmEJcm.exe
  2⤵
  PID:6652
- C:\Windows\System\jXeacHT.exe
  C:\Windows\System\jXeacHT.exe
  2⤵
  PID:6752
- C:\Windows\System\KlvzEzG.exe
  C:\Windows\System\KlvzEzG.exe
  2⤵
  PID:6840
- C:\Windows\System\ZrttZzW.exe
  C:\Windows\System\ZrttZzW.exe
  2⤵
  PID:6900
- C:\Windows\System\QGBbPFY.exe
  C:\Windows\System\QGBbPFY.exe
  2⤵
  PID:6624
- C:\Windows\System\WvTZfcT.exe
  C:\Windows\System\WvTZfcT.exe
  2⤵
  PID:7016
- C:\Windows\System\WmFmnOl.exe
  C:\Windows\System\WmFmnOl.exe
  2⤵
  PID:6892
- C:\Windows\System\FFqyfkO.exe
  C:\Windows\System\FFqyfkO.exe
  2⤵
  PID:7096
- C:\Windows\System\AtXwgYm.exe
  C:\Windows\System\AtXwgYm.exe
  2⤵
  PID:7004
- C:\Windows\System\UqERPEa.exe
  C:\Windows\System\UqERPEa.exe
  2⤵
  PID:6156
- C:\Windows\System\ZomoYmR.exe
  C:\Windows\System\ZomoYmR.exe
  2⤵
  PID:6364
- C:\Windows\System\FXZHZEy.exe
  C:\Windows\System\FXZHZEy.exe
  2⤵
  PID:6476
- C:\Windows\System\BLQYnbV.exe
  C:\Windows\System\BLQYnbV.exe
  2⤵
  PID:1920
- C:\Windows\System\LgOLQrl.exe
  C:\Windows\System\LgOLQrl.exe
  2⤵
  PID:6932
- C:\Windows\System\xCreUdl.exe
  C:\Windows\System\xCreUdl.exe
  2⤵
  PID:7196
- C:\Windows\System\CQvefip.exe
  C:\Windows\System\CQvefip.exe
  2⤵
  PID:7228
- C:\Windows\System\SggaaYe.exe
  C:\Windows\System\SggaaYe.exe
  2⤵
  PID:7260
- C:\Windows\System\ObSJbYd.exe
  C:\Windows\System\ObSJbYd.exe
  2⤵
  PID:7284
- C:\Windows\System\sEnXJOT.exe
  C:\Windows\System\sEnXJOT.exe
  2⤵
  PID:7316
- C:\Windows\System\ZEhmVBY.exe
  C:\Windows\System\ZEhmVBY.exe
  2⤵
  PID:7340
- C:\Windows\System\EpjiAWs.exe
  C:\Windows\System\EpjiAWs.exe
  2⤵
  PID:7368
- C:\Windows\System\VjemIZI.exe
  C:\Windows\System\VjemIZI.exe
  2⤵
  PID:7400
- C:\Windows\System\tvnbKBx.exe
  C:\Windows\System\tvnbKBx.exe
  2⤵
  PID:7424
- C:\Windows\System\SeIyhvL.exe
  C:\Windows\System\SeIyhvL.exe
  2⤵
  PID:7448
- C:\Windows\System\tLJSVnO.exe
  C:\Windows\System\tLJSVnO.exe
  2⤵
  PID:7480
- C:\Windows\System\bnppCNR.exe
  C:\Windows\System\bnppCNR.exe
  2⤵
  PID:7500
- C:\Windows\System\CxpXHwf.exe
  C:\Windows\System\CxpXHwf.exe
  2⤵
  PID:7528
- C:\Windows\System\VbQzDFF.exe
  C:\Windows\System\VbQzDFF.exe
  2⤵
  PID:7564
- C:\Windows\System\TqrNIlM.exe
  C:\Windows\System\TqrNIlM.exe
  2⤵
  PID:7588
- C:\Windows\System\zOIyexO.exe
  C:\Windows\System\zOIyexO.exe
  2⤵
  PID:7612
- C:\Windows\System\WtlTPho.exe
  C:\Windows\System\WtlTPho.exe
  2⤵
  PID:7640
- C:\Windows\System\MUizWDx.exe
  C:\Windows\System\MUizWDx.exe
  2⤵
  PID:7668
- C:\Windows\System\xFEcFli.exe
  C:\Windows\System\xFEcFli.exe
  2⤵
  PID:7696
- C:\Windows\System\RUecfBQ.exe
  C:\Windows\System\RUecfBQ.exe
  2⤵
  PID:7720
- C:\Windows\System\gujlXpy.exe
  C:\Windows\System\gujlXpy.exe
  2⤵
  PID:7748
- C:\Windows\System\yhFDzVD.exe
  C:\Windows\System\yhFDzVD.exe
  2⤵
  PID:7772
- C:\Windows\System\tzPNtUE.exe
  C:\Windows\System\tzPNtUE.exe
  2⤵
  PID:7792
- C:\Windows\System\xlqIwgN.exe
  C:\Windows\System\xlqIwgN.exe
  2⤵
  PID:7816
- C:\Windows\System\iNlsZkp.exe
  C:\Windows\System\iNlsZkp.exe
  2⤵
  PID:7836
- C:\Windows\System\IPoEtHu.exe
  C:\Windows\System\IPoEtHu.exe
  2⤵
  PID:7860
- C:\Windows\System\BEkLwXg.exe
  C:\Windows\System\BEkLwXg.exe
  2⤵
  PID:7880
- C:\Windows\System\vEHcASN.exe
  C:\Windows\System\vEHcASN.exe
  2⤵
  PID:7904
- C:\Windows\System\cNdyZKI.exe
  C:\Windows\System\cNdyZKI.exe
  2⤵
  PID:7920
- C:\Windows\System\hNIJInl.exe
  C:\Windows\System\hNIJInl.exe
  2⤵
  PID:8080
- C:\Windows\System\MZcgDdc.exe
  C:\Windows\System\MZcgDdc.exe
  2⤵
  PID:8124
- C:\Windows\System\nmNBvPB.exe
  C:\Windows\System\nmNBvPB.exe
  2⤵
  PID:8148
- C:\Windows\System\YTgwzum.exe
  C:\Windows\System\YTgwzum.exe
  2⤵
  PID:8176
- C:\Windows\System\GdsXtMG.exe
  C:\Windows\System\GdsXtMG.exe
  2⤵
  PID:6792
- C:\Windows\System\uBkrLGW.exe
  C:\Windows\System\uBkrLGW.exe
  2⤵
  PID:7028
- C:\Windows\System\JfSbfOM.exe
  C:\Windows\System\JfSbfOM.exe
  2⤵
  PID:6592
- C:\Windows\System\ZRiZQCH.exe
  C:\Windows\System\ZRiZQCH.exe
  2⤵
  PID:7084
- C:\Windows\System\fXgkQGm.exe
  C:\Windows\System\fXgkQGm.exe
  2⤵
  PID:5676
- C:\Windows\System\TyiFUfz.exe
  C:\Windows\System\TyiFUfz.exe
  2⤵
  PID:6972
- C:\Windows\System\rPVLZBY.exe
  C:\Windows\System\rPVLZBY.exe
  2⤵
  PID:7336
- C:\Windows\System\tYwCLoM.exe
  C:\Windows\System\tYwCLoM.exe
  2⤵
  PID:7388
- C:\Windows\System\jpjLXTz.exe
  C:\Windows\System\jpjLXTz.exe
  2⤵
  PID:6180
- C:\Windows\System\lRvjAPL.exe
  C:\Windows\System\lRvjAPL.exe
  2⤵
  PID:7608
- C:\Windows\System\VdwAuyu.exe
  C:\Windows\System\VdwAuyu.exe
  2⤵
  PID:7444
- C:\Windows\System\eUgFxKE.exe
  C:\Windows\System\eUgFxKE.exe
  2⤵
  PID:7660
- C:\Windows\System\DkiPQWi.exe
  C:\Windows\System\DkiPQWi.exe
  2⤵
  PID:7280
- C:\Windows\System\DylAqhv.exe
  C:\Windows\System\DylAqhv.exe
  2⤵
  PID:7736
- C:\Windows\System\mvzbojL.exe
  C:\Windows\System\mvzbojL.exe
  2⤵
  PID:7684
- C:\Windows\System\wjihNRT.exe
  C:\Windows\System\wjihNRT.exe
  2⤵
  PID:7600
- C:\Windows\System\TaHHbGv.exe
  C:\Windows\System\TaHHbGv.exe
  2⤵
  PID:7988
- C:\Windows\System\PstbgJD.exe
  C:\Windows\System\PstbgJD.exe
  2⤵
  PID:7900
- C:\Windows\System\Bcvtnyb.exe
  C:\Windows\System\Bcvtnyb.exe
  2⤵
  PID:8156
- C:\Windows\System\LtLtQWt.exe
  C:\Windows\System\LtLtQWt.exe
  2⤵
  PID:7044
- C:\Windows\System\SxEaNcH.exe
  C:\Windows\System\SxEaNcH.exe
  2⤵
  PID:6980
- C:\Windows\System\vZYGQZI.exe
  C:\Windows\System\vZYGQZI.exe
  2⤵
  PID:6772
- C:\Windows\System\ddnqLIt.exe
  C:\Windows\System\ddnqLIt.exe
  2⤵
  PID:6568
- C:\Windows\System\EYewJEe.exe
  C:\Windows\System\EYewJEe.exe
  2⤵
  PID:8100
- C:\Windows\System\bwBxKQq.exe
  C:\Windows\System\bwBxKQq.exe
  2⤵
  PID:7376
- C:\Windows\System\NVJCISh.exe
  C:\Windows\System\NVJCISh.exe
  2⤵
  PID:7788
- C:\Windows\System\exdxDWQ.exe
  C:\Windows\System\exdxDWQ.exe
  2⤵
  PID:7876
- C:\Windows\System\ICbKKOC.exe
  C:\Windows\System\ICbKKOC.exe
  2⤵
  PID:7664
- C:\Windows\System\VdWwsLA.exe
  C:\Windows\System\VdWwsLA.exe
  2⤵
  PID:7632
- C:\Windows\System\rxwwkEM.exe
  C:\Windows\System\rxwwkEM.exe
  2⤵
  PID:8184
- C:\Windows\System\URZOCCR.exe
  C:\Windows\System\URZOCCR.exe
  2⤵
  PID:8196
- C:\Windows\System\AHtIPFy.exe
  C:\Windows\System\AHtIPFy.exe
  2⤵
  PID:8216
- C:\Windows\System\RhhXolL.exe
  C:\Windows\System\RhhXolL.exe
  2⤵
  PID:8244
- C:\Windows\System\nItyxJe.exe
  C:\Windows\System\nItyxJe.exe
  2⤵
  PID:8276
- C:\Windows\System\AaYhfkF.exe
  C:\Windows\System\AaYhfkF.exe
  2⤵
  PID:8308
- C:\Windows\System\lhHceAR.exe
  C:\Windows\System\lhHceAR.exe
  2⤵
  PID:8332
- C:\Windows\System\OJfImCx.exe
  C:\Windows\System\OJfImCx.exe
  2⤵
  PID:8348
- C:\Windows\System\EeOMPFc.exe
  C:\Windows\System\EeOMPFc.exe
  2⤵
  PID:8384
- C:\Windows\System\RjCyOAj.exe
  C:\Windows\System\RjCyOAj.exe
  2⤵
  PID:8408
- C:\Windows\System\AXQBBvm.exe
  C:\Windows\System\AXQBBvm.exe
  2⤵
  PID:8432
- C:\Windows\System\EFjHkez.exe
  C:\Windows\System\EFjHkez.exe
  2⤵
  PID:8448
- C:\Windows\System\iuiepCB.exe
  C:\Windows\System\iuiepCB.exe
  2⤵
  PID:8472
- C:\Windows\System\JHRdZHe.exe
  C:\Windows\System\JHRdZHe.exe
  2⤵
  PID:8492
- C:\Windows\System\cuUntOP.exe
  C:\Windows\System\cuUntOP.exe
  2⤵
  PID:8524
- C:\Windows\System\apSiUCk.exe
  C:\Windows\System\apSiUCk.exe
  2⤵
  PID:8556
- C:\Windows\System\qSMRLLx.exe
  C:\Windows\System\qSMRLLx.exe
  2⤵
  PID:8580
- C:\Windows\System\Yfnrgya.exe
  C:\Windows\System\Yfnrgya.exe
  2⤵
  PID:8616
- C:\Windows\System\ZkpBLlU.exe
  C:\Windows\System\ZkpBLlU.exe
  2⤵
  PID:8640
- C:\Windows\System\puNULqT.exe
  C:\Windows\System\puNULqT.exe
  2⤵
  PID:8660
- C:\Windows\System\zsqtWNP.exe
  C:\Windows\System\zsqtWNP.exe
  2⤵
  PID:8680
- C:\Windows\System\BPxEair.exe
  C:\Windows\System\BPxEair.exe
  2⤵
  PID:8708
- C:\Windows\System\rJARWUe.exe
  C:\Windows\System\rJARWUe.exe
  2⤵
  PID:8736
- C:\Windows\System\pzpAumm.exe
  C:\Windows\System\pzpAumm.exe
  2⤵
  PID:8760
- C:\Windows\System\YnkhXIf.exe
  C:\Windows\System\YnkhXIf.exe
  2⤵
  PID:8788
- C:\Windows\System\cLBtddT.exe
  C:\Windows\System\cLBtddT.exe
  2⤵
  PID:8812
- C:\Windows\System\XqTdPKF.exe
  C:\Windows\System\XqTdPKF.exe
  2⤵
  PID:8840
- C:\Windows\System\cUMmeME.exe
  C:\Windows\System\cUMmeME.exe
  2⤵
  PID:8860
- C:\Windows\System\hDPVDyh.exe
  C:\Windows\System\hDPVDyh.exe
  2⤵
  PID:8876
- C:\Windows\System\pZQGmOX.exe
  C:\Windows\System\pZQGmOX.exe
  2⤵
  PID:8904
- C:\Windows\System\HTINYYY.exe
  C:\Windows\System\HTINYYY.exe
  2⤵
  PID:8932
- C:\Windows\System\FwYIlAg.exe
  C:\Windows\System\FwYIlAg.exe
  2⤵
  PID:8960
- C:\Windows\System\rSsQvaE.exe
  C:\Windows\System\rSsQvaE.exe
  2⤵
  PID:8980
- C:\Windows\System\SaJufcC.exe
  C:\Windows\System\SaJufcC.exe
  2⤵
  PID:9008
- C:\Windows\System\QqpYlBn.exe
  C:\Windows\System\QqpYlBn.exe
  2⤵
  PID:9032
- C:\Windows\System\liJtvtH.exe
  C:\Windows\System\liJtvtH.exe
  2⤵
  PID:9060
- C:\Windows\System\kDZxoKn.exe
  C:\Windows\System\kDZxoKn.exe
  2⤵
  PID:9088
- C:\Windows\System\KmUAjXS.exe
  C:\Windows\System\KmUAjXS.exe
  2⤵
  PID:9108
- C:\Windows\System\AACcrzv.exe
  C:\Windows\System\AACcrzv.exe
  2⤵
  PID:9140
- C:\Windows\System\aYDmxRx.exe
  C:\Windows\System\aYDmxRx.exe
  2⤵
  PID:9164
- C:\Windows\System\GLfEMMb.exe
  C:\Windows\System\GLfEMMb.exe
  2⤵
  PID:9188
- C:\Windows\System\jjXEzeW.exe
  C:\Windows\System\jjXEzeW.exe
  2⤵
  PID:9204
- C:\Windows\System\WYKEijw.exe
  C:\Windows\System\WYKEijw.exe
  2⤵
  PID:6668
- C:\Windows\System\LWeTNmU.exe
  C:\Windows\System\LWeTNmU.exe
  2⤵
  PID:8252
- C:\Windows\System\FTSaTjI.exe
  C:\Windows\System\FTSaTjI.exe
  2⤵
  PID:6396
- C:\Windows\System\XbMpcOs.exe
  C:\Windows\System\XbMpcOs.exe
  2⤵
  PID:7332
- C:\Windows\System\IqZePKX.exe
  C:\Windows\System\IqZePKX.exe
  2⤵
  PID:8264
- C:\Windows\System\cTXkHFJ.exe
  C:\Windows\System\cTXkHFJ.exe
  2⤵
  PID:7140
- C:\Windows\System\dhWAgyl.exe
  C:\Windows\System\dhWAgyl.exe
  2⤵
  PID:8456
- C:\Windows\System\JLNsZjQ.exe
  C:\Windows\System\JLNsZjQ.exe
  2⤵
  PID:8428
- C:\Windows\System\gzKJPcT.exe
  C:\Windows\System\gzKJPcT.exe
  2⤵
  PID:8592
- C:\Windows\System\MRscaHJ.exe
  C:\Windows\System\MRscaHJ.exe
  2⤵
  PID:8424
- C:\Windows\System\GeGzDku.exe
  C:\Windows\System\GeGzDku.exe
  2⤵
  PID:8776
- C:\Windows\System\MncRifI.exe
  C:\Windows\System\MncRifI.exe
  2⤵
  PID:8604
- C:\Windows\System\jzwltFf.exe
  C:\Windows\System\jzwltFf.exe
  2⤵
  PID:8624
- C:\Windows\System\sPpTkRF.exe
  C:\Windows\System\sPpTkRF.exe
  2⤵
  PID:8924
- C:\Windows\System\lSPOLva.exe
  C:\Windows\System\lSPOLva.exe
  2⤵
  PID:8996
- C:\Windows\System\UkUNJzy.exe
  C:\Windows\System\UkUNJzy.exe
  2⤵
  PID:9024
- C:\Windows\System\vUdRLuN.exe
  C:\Windows\System\vUdRLuN.exe
  2⤵
  PID:9072
- C:\Windows\System\wntZuAV.exe
  C:\Windows\System\wntZuAV.exe
  2⤵
  PID:8784
- C:\Windows\System\UEREmSt.exe
  C:\Windows\System\UEREmSt.exe
  2⤵
  PID:8944
- C:\Windows\System\RTycGMn.exe
  C:\Windows\System\RTycGMn.exe
  2⤵
  PID:8236
- C:\Windows\System\PocfaxS.exe
  C:\Windows\System\PocfaxS.exe
  2⤵
  PID:7976
- C:\Windows\System\yySFPnD.exe
  C:\Windows\System\yySFPnD.exe
  2⤵
  PID:8440
- C:\Windows\System\kohfHkF.exe
  C:\Windows\System\kohfHkF.exe
  2⤵
  PID:8576
- C:\Windows\System\Rbprqzw.exe
  C:\Windows\System\Rbprqzw.exe
  2⤵
  PID:9120
- C:\Windows\System\dXlCjno.exe
  C:\Windows\System\dXlCjno.exe
  2⤵
  PID:8328
- C:\Windows\System\hctRyDv.exe
  C:\Windows\System\hctRyDv.exe
  2⤵
  PID:9244
- C:\Windows\System\iclZgwY.exe
  C:\Windows\System\iclZgwY.exe
  2⤵
  PID:9268
- C:\Windows\System\TAzufqu.exe
  C:\Windows\System\TAzufqu.exe
  2⤵
  PID:9292
- C:\Windows\System\FDXqMZf.exe
  C:\Windows\System\FDXqMZf.exe
  2⤵
  PID:9320
- C:\Windows\System\wqkWmVz.exe
  C:\Windows\System\wqkWmVz.exe
  2⤵
  PID:9340
- C:\Windows\System\rricvbE.exe
  C:\Windows\System\rricvbE.exe
  2⤵
  PID:9368
- C:\Windows\System\hzHQtHN.exe
  C:\Windows\System\hzHQtHN.exe
  2⤵
  PID:9392
- C:\Windows\System\EXrjrrh.exe
  C:\Windows\System\EXrjrrh.exe
  2⤵
  PID:9416
- C:\Windows\System\mBerQFa.exe
  C:\Windows\System\mBerQFa.exe
  2⤵
  PID:9444
- C:\Windows\System\yMyVULw.exe
  C:\Windows\System\yMyVULw.exe
  2⤵
  PID:9468
- C:\Windows\System\gfUhFJc.exe
  C:\Windows\System\gfUhFJc.exe
  2⤵
  PID:9548
- C:\Windows\System\WAfRMjN.exe
  C:\Windows\System\WAfRMjN.exe
  2⤵
  PID:9600
- C:\Windows\System\VVaJNcI.exe
  C:\Windows\System\VVaJNcI.exe
  2⤵
  PID:9624
- C:\Windows\System\CfeQADQ.exe
  C:\Windows\System\CfeQADQ.exe
  2⤵
  PID:9644
- C:\Windows\System\puaOdqU.exe
  C:\Windows\System\puaOdqU.exe
  2⤵
  PID:9668
- C:\Windows\System\BvMjODV.exe
  C:\Windows\System\BvMjODV.exe
  2⤵
  PID:9704
- C:\Windows\System\VKYWnkU.exe
  C:\Windows\System\VKYWnkU.exe
  2⤵
  PID:9728
- C:\Windows\System\cjbjfKm.exe
  C:\Windows\System\cjbjfKm.exe
  2⤵
  PID:9752
- C:\Windows\System\XODcYTq.exe
  C:\Windows\System\XODcYTq.exe
  2⤵
  PID:9768
- C:\Windows\System\NdtMKuJ.exe
  C:\Windows\System\NdtMKuJ.exe
  2⤵
  PID:9800
- C:\Windows\System\atPZaVT.exe
  C:\Windows\System\atPZaVT.exe
  2⤵
  PID:9828
- C:\Windows\System\CRSDTwN.exe
  C:\Windows\System\CRSDTwN.exe
  2⤵
  PID:9860
- C:\Windows\System\DnYtgOD.exe
  C:\Windows\System\DnYtgOD.exe
  2⤵
  PID:9900
- C:\Windows\System\VuUTdpW.exe
  C:\Windows\System\VuUTdpW.exe
  2⤵
  PID:9924
- C:\Windows\System\kmMaVvQ.exe
  C:\Windows\System\kmMaVvQ.exe
  2⤵
  PID:9944
- C:\Windows\System\nOJbCmT.exe
  C:\Windows\System\nOJbCmT.exe
  2⤵
  PID:9964
- C:\Windows\System\yoPoPfX.exe
  C:\Windows\System\yoPoPfX.exe
  2⤵
  PID:9984
- C:\Windows\System\qafvpBc.exe
  C:\Windows\System\qafvpBc.exe
  2⤵
  PID:10012
- C:\Windows\System\buHEyuD.exe
  C:\Windows\System\buHEyuD.exe
  2⤵
  PID:10032
- C:\Windows\System\LXBNIND.exe
  C:\Windows\System\LXBNIND.exe
  2⤵
  PID:10060
- C:\Windows\System\FKteGtm.exe
  C:\Windows\System\FKteGtm.exe
  2⤵
  PID:10088
- C:\Windows\System\qQlkuZd.exe
  C:\Windows\System\qQlkuZd.exe
  2⤵
  PID:10120
- C:\Windows\System\UFvJmEX.exe
  C:\Windows\System\UFvJmEX.exe
  2⤵
  PID:10136
- C:\Windows\System\QfcapHZ.exe
  C:\Windows\System\QfcapHZ.exe
  2⤵
  PID:10160
- C:\Windows\System\cEJZSeJ.exe
  C:\Windows\System\cEJZSeJ.exe
  2⤵
  PID:10180
- C:\Windows\System\KsSmIQS.exe
  C:\Windows\System\KsSmIQS.exe
  2⤵
  PID:10204
- C:\Windows\System\gsdQZUC.exe
  C:\Windows\System\gsdQZUC.exe
  2⤵
  PID:10224
- C:\Windows\System\ReBVdbi.exe
  C:\Windows\System\ReBVdbi.exe
  2⤵
  PID:8852
- C:\Windows\System\bAurjbr.exe
  C:\Windows\System\bAurjbr.exe
  2⤵
  PID:9028
- C:\Windows\System\tzymETZ.exe
  C:\Windows\System\tzymETZ.exe
  2⤵
  PID:9404
- C:\Windows\System\OpduZII.exe
  C:\Windows\System\OpduZII.exe
  2⤵
  PID:9348
- C:\Windows\System\bsvGHFa.exe
  C:\Windows\System\bsvGHFa.exe
  2⤵
  PID:8300
- C:\Windows\System\bkirlMq.exe
  C:\Windows\System\bkirlMq.exe
  2⤵
  PID:9608
- C:\Windows\System\OYetgsh.exe
  C:\Windows\System\OYetgsh.exe
  2⤵
  PID:9692
- C:\Windows\System\otLZJiN.exe
  C:\Windows\System\otLZJiN.exe
  2⤵
  PID:9748
- C:\Windows\System\Wlkegiu.exe
  C:\Windows\System\Wlkegiu.exe
  2⤵
  PID:9816
- C:\Windows\System\bwdGAjj.exe
  C:\Windows\System\bwdGAjj.exe
  2⤵
  PID:9452
- C:\Windows\System\tjQFgBk.exe
  C:\Windows\System\tjQFgBk.exe
  2⤵
  PID:9884
- C:\Windows\System\wVWMyuB.exe
  C:\Windows\System\wVWMyuB.exe
  2⤵
  PID:9720
- C:\Windows\System\rOqyOTU.exe
  C:\Windows\System\rOqyOTU.exe
  2⤵
  PID:10116
- C:\Windows\System\wuyNoFN.exe
  C:\Windows\System\wuyNoFN.exe
  2⤵
  PID:8752
- C:\Windows\System\MFSHJak.exe
  C:\Windows\System\MFSHJak.exe
  2⤵
  PID:10072
- C:\Windows\System\YUBsUAX.exe
  C:\Windows\System\YUBsUAX.exe
  2⤵
  PID:10156
- C:\Windows\System\HMnxYcT.exe
  C:\Windows\System\HMnxYcT.exe
  2⤵
  PID:9972
- C:\Windows\System\rFJWoqa.exe
  C:\Windows\System\rFJWoqa.exe
  2⤵
  PID:8888
- C:\Windows\System\QAnSYWj.exe
  C:\Windows\System\QAnSYWj.exe
  2⤵
  PID:10040
- C:\Windows\System\moOMwLS.exe
  C:\Windows\System\moOMwLS.exe
  2⤵
  PID:10076
- C:\Windows\System\gSIqZmt.exe
  C:\Windows\System\gSIqZmt.exe
  2⤵
  PID:9808
- C:\Windows\System\KEtkVMz.exe
  C:\Windows\System\KEtkVMz.exe
  2⤵
  PID:8596
- C:\Windows\System\ZQJZszN.exe
  C:\Windows\System\ZQJZszN.exe
  2⤵
  PID:10192
- C:\Windows\System\JGQnWQS.exe
  C:\Windows\System\JGQnWQS.exe
  2⤵
  PID:9976
- C:\Windows\System\ScqXfbK.exe
  C:\Windows\System\ScqXfbK.exe
  2⤵
  PID:9584
- C:\Windows\System\NjOSHbV.exe
  C:\Windows\System\NjOSHbV.exe
  2⤵
  PID:9652
- C:\Windows\System\wHIguxe.exe
  C:\Windows\System\wHIguxe.exe
  2⤵
  PID:10256
- C:\Windows\System\QXcKGEW.exe
  C:\Windows\System\QXcKGEW.exe
  2⤵
  PID:10280
- C:\Windows\System\WmAxbUi.exe
  C:\Windows\System\WmAxbUi.exe
  2⤵
  PID:10308
- C:\Windows\System\wVyAeBw.exe
  C:\Windows\System\wVyAeBw.exe
  2⤵
  PID:10332
- C:\Windows\System\iZgrvCL.exe
  C:\Windows\System\iZgrvCL.exe
  2⤵
  PID:10360
- C:\Windows\System\ZqDwbte.exe
  C:\Windows\System\ZqDwbte.exe
  2⤵
  PID:10384
- C:\Windows\System\abarJwh.exe
  C:\Windows\System\abarJwh.exe
  2⤵
  PID:10404
- C:\Windows\System\VhodOdV.exe
  C:\Windows\System\VhodOdV.exe
  2⤵
  PID:10436
- C:\Windows\System\pFgShog.exe
  C:\Windows\System\pFgShog.exe
  2⤵
  PID:10452
- C:\Windows\System\vCFsrLL.exe
  C:\Windows\System\vCFsrLL.exe
  2⤵
  PID:10472
- C:\Windows\System\WBJAPBp.exe
  C:\Windows\System\WBJAPBp.exe
  2⤵
  PID:10508
- C:\Windows\System\cyOQsxf.exe
  C:\Windows\System\cyOQsxf.exe
  2⤵
  PID:10528
- C:\Windows\System\YPvVlfa.exe
  C:\Windows\System\YPvVlfa.exe
  2⤵
  PID:10556
- C:\Windows\System\llRBJXp.exe
  C:\Windows\System\llRBJXp.exe
  2⤵
  PID:10588
- C:\Windows\System\ZFARDrS.exe
  C:\Windows\System\ZFARDrS.exe
  2⤵
  PID:10604
- C:\Windows\System\JKRAyhZ.exe
  C:\Windows\System\JKRAyhZ.exe
  2⤵
  PID:10636
- C:\Windows\System\zsuRNmm.exe
  C:\Windows\System\zsuRNmm.exe
  2⤵
  PID:10664
- C:\Windows\System\NLgSsxE.exe
  C:\Windows\System\NLgSsxE.exe
  2⤵
  PID:10688
- C:\Windows\System\BxaxMAl.exe
  C:\Windows\System\BxaxMAl.exe
  2⤵
  PID:10720
- C:\Windows\System\bNjBOZl.exe
  C:\Windows\System\bNjBOZl.exe
  2⤵
  PID:10740
- C:\Windows\System\ziXqMHf.exe
  C:\Windows\System\ziXqMHf.exe
  2⤵
  PID:10768
- C:\Windows\System\lZoWtEP.exe
  C:\Windows\System\lZoWtEP.exe
  2⤵
  PID:10792
- C:\Windows\System\kDsHBXO.exe
  C:\Windows\System\kDsHBXO.exe
  2⤵
  PID:10820
- C:\Windows\System\hEfjkeC.exe
  C:\Windows\System\hEfjkeC.exe
  2⤵
  PID:10844
- C:\Windows\System\tGXsWlr.exe
  C:\Windows\System\tGXsWlr.exe
  2⤵
  PID:10868
- C:\Windows\System\rBtUaOr.exe
  C:\Windows\System\rBtUaOr.exe
  2⤵
  PID:10896
- C:\Windows\System\WQiKIXa.exe
  C:\Windows\System\WQiKIXa.exe
  2⤵
  PID:10928
- C:\Windows\System\jviyIKD.exe
  C:\Windows\System\jviyIKD.exe
  2⤵
  PID:10948
- C:\Windows\System\MXDWTxl.exe
  C:\Windows\System\MXDWTxl.exe
  2⤵
  PID:10972
- C:\Windows\System\zUtPGuG.exe
  C:\Windows\System\zUtPGuG.exe
  2⤵
  PID:11000
- C:\Windows\System\aGWBnUN.exe
  C:\Windows\System\aGWBnUN.exe
  2⤵
  PID:11028
- C:\Windows\System\rwONaFp.exe
  C:\Windows\System\rwONaFp.exe
  2⤵
  PID:11052
- C:\Windows\System\WFbxTeD.exe
  C:\Windows\System\WFbxTeD.exe
  2⤵
  PID:11088
- C:\Windows\System\PqxnejV.exe
  C:\Windows\System\PqxnejV.exe
  2⤵
  PID:11112
- C:\Windows\System\JvSsxyX.exe
  C:\Windows\System\JvSsxyX.exe
  2⤵
  PID:11144
- C:\Windows\System\wRhOVxt.exe
  C:\Windows\System\wRhOVxt.exe
  2⤵
  PID:11168
- C:\Windows\System\smEpyYz.exe
  C:\Windows\System\smEpyYz.exe
  2⤵
  PID:11204
- C:\Windows\System\jneidAv.exe
  C:\Windows\System\jneidAv.exe
  2⤵
  PID:11228
- C:\Windows\System\MRUFAKz.exe
  C:\Windows\System\MRUFAKz.exe
  2⤵
  PID:11252
- C:\Windows\System\yOmBtrf.exe
  C:\Windows\System\yOmBtrf.exe
  2⤵
  PID:10056
- C:\Windows\System\BNlxSxi.exe
  C:\Windows\System\BNlxSxi.exe
  2⤵
  PID:9436
- C:\Windows\System\FElKaSi.exe
  C:\Windows\System\FElKaSi.exe
  2⤵
  PID:9136
- C:\Windows\System\LBLZeTQ.exe
  C:\Windows\System\LBLZeTQ.exe
  2⤵
  PID:8372
- C:\Windows\System\otPhdKt.exe
  C:\Windows\System\otPhdKt.exe
  2⤵
  PID:8856
- C:\Windows\System\nUkKKup.exe
  C:\Windows\System\nUkKKup.exe
  2⤵
  PID:9156
- C:\Windows\System\tOVLYwa.exe
  C:\Windows\System\tOVLYwa.exe
  2⤵
  PID:9848
- C:\Windows\System\PuaCdaZ.exe
  C:\Windows\System\PuaCdaZ.exe
  2⤵
  PID:10292
- C:\Windows\System\JuhDYah.exe
  C:\Windows\System\JuhDYah.exe
  2⤵
  PID:10524
- C:\Windows\System\QCpJFqu.exe
  C:\Windows\System\QCpJFqu.exe
  2⤵
  PID:10620
- C:\Windows\System\kXwlohc.exe
  C:\Windows\System\kXwlohc.exe
  2⤵
  PID:10264
- C:\Windows\System\qGQiksw.exe
  C:\Windows\System\qGQiksw.exe
  2⤵
  PID:10464
- C:\Windows\System\THkmaQL.exe
  C:\Windows\System\THkmaQL.exe
  2⤵
  PID:10520
- C:\Windows\System\UNBEBPf.exe
  C:\Windows\System\UNBEBPf.exe
  2⤵
  PID:10860
- C:\Windows\System\lQPVaIT.exe
  C:\Windows\System\lQPVaIT.exe
  2⤵
  PID:10660
- C:\Windows\System\YDcqWxj.exe
  C:\Windows\System\YDcqWxj.exe
  2⤵
  PID:10544
- C:\Windows\System\tSSFGvA.exe
  C:\Windows\System\tSSFGvA.exe
  2⤵
  PID:10596
- C:\Windows\System\jLAApyv.exe
  C:\Windows\System\jLAApyv.exe
  2⤵
  PID:11192
- C:\Windows\System\XKjNzSy.exe
  C:\Windows\System\XKjNzSy.exe
  2⤵
  PID:10916
- C:\Windows\System\vjiVfIa.exe
  C:\Windows\System\vjiVfIa.exe
  2⤵
  PID:11012
- C:\Windows\System\VxygUtT.exe
  C:\Windows\System\VxygUtT.exe
  2⤵
  PID:11068
- C:\Windows\System\slbmvtq.exe
  C:\Windows\System\slbmvtq.exe
  2⤵
  PID:10244
- C:\Windows\System\ZBVsEuG.exe
  C:\Windows\System\ZBVsEuG.exe
  2⤵
  PID:10780
- C:\Windows\System\ClzCMxJ.exe
  C:\Windows\System\ClzCMxJ.exe
  2⤵
  PID:10800
- C:\Windows\System\KPPHKvN.exe
  C:\Windows\System\KPPHKvN.exe
  2⤵
  PID:10600
- C:\Windows\System\UaGaMth.exe
  C:\Windows\System\UaGaMth.exe
  2⤵
  PID:11184
- C:\Windows\System\uEdNPwQ.exe
  C:\Windows\System\uEdNPwQ.exe
  2⤵
  PID:11236
- C:\Windows\System\QLZcptk.exe
  C:\Windows\System\QLZcptk.exe
  2⤵
  PID:10704
- C:\Windows\System\DerpVay.exe
  C:\Windows\System\DerpVay.exe
  2⤵
  PID:10864
- C:\Windows\System\xZheNda.exe
  C:\Windows\System\xZheNda.exe
  2⤵
  PID:10956
- C:\Windows\System\PICXiut.exe
  C:\Windows\System\PICXiut.exe
  2⤵
  PID:11288
- C:\Windows\System\UnLwRZm.exe
  C:\Windows\System\UnLwRZm.exe
  2⤵
  PID:11312
- C:\Windows\System\wYKgUuE.exe
  C:\Windows\System\wYKgUuE.exe
  2⤵
  PID:11340
- C:\Windows\System\NTRArmr.exe
  C:\Windows\System\NTRArmr.exe
  2⤵
  PID:11368
- C:\Windows\System\sQSEiEO.exe
  C:\Windows\System\sQSEiEO.exe
  2⤵
  PID:11392
- C:\Windows\System\hhmMeUZ.exe
  C:\Windows\System\hhmMeUZ.exe
  2⤵
  PID:11416
- C:\Windows\System\CMixmWK.exe
  C:\Windows\System\CMixmWK.exe
  2⤵
  PID:11432
- C:\Windows\System\dcjEEmK.exe
  C:\Windows\System\dcjEEmK.exe
  2⤵
  PID:11448
- C:\Windows\System\PsvQpQi.exe
  C:\Windows\System\PsvQpQi.exe
  2⤵
  PID:11472
- C:\Windows\System\vRTArGC.exe
  C:\Windows\System\vRTArGC.exe
  2⤵
  PID:11508
- C:\Windows\System\hGeQeAZ.exe
  C:\Windows\System\hGeQeAZ.exe
  2⤵
  PID:11528
- C:\Windows\System\bwucfaU.exe
  C:\Windows\System\bwucfaU.exe
  2⤵
  PID:11556
- C:\Windows\System\odxBLRC.exe
  C:\Windows\System\odxBLRC.exe
  2⤵
  PID:11584
- C:\Windows\System\ZDgmofp.exe
  C:\Windows\System\ZDgmofp.exe
  2⤵
  PID:11612
- C:\Windows\System\QeyFwwV.exe
  C:\Windows\System\QeyFwwV.exe
  2⤵
  PID:11636
- C:\Windows\System\dByBoTL.exe
  C:\Windows\System\dByBoTL.exe
  2⤵
  PID:11656
- C:\Windows\System\lVwUMIh.exe
  C:\Windows\System\lVwUMIh.exe
  2⤵
  PID:11684
- C:\Windows\System\xWbZwJB.exe
  C:\Windows\System\xWbZwJB.exe
  2⤵
  PID:11712
- C:\Windows\System\zCHYqxs.exe
  C:\Windows\System\zCHYqxs.exe
  2⤵
  PID:11740
- C:\Windows\System\zEteueU.exe
  C:\Windows\System\zEteueU.exe
  2⤵
  PID:11756
- C:\Windows\System\xtrwgzk.exe
  C:\Windows\System\xtrwgzk.exe
  2⤵
  PID:11784
- C:\Windows\System\nEVEFNl.exe
  C:\Windows\System\nEVEFNl.exe
  2⤵
  PID:11808
- C:\Windows\System\HVScEpn.exe
  C:\Windows\System\HVScEpn.exe
  2⤵
  PID:11828
- C:\Windows\System\WcDUwgO.exe
  C:\Windows\System\WcDUwgO.exe
  2⤵
  PID:11852
- C:\Windows\System\YhdPirj.exe
  C:\Windows\System\YhdPirj.exe
  2⤵
  PID:11876
- C:\Windows\System\IuYuDyt.exe
  C:\Windows\System\IuYuDyt.exe
  2⤵
  PID:11904
- C:\Windows\System\BrnpYAm.exe
  C:\Windows\System\BrnpYAm.exe
  2⤵
  PID:11932
- C:\Windows\System\bVUFboS.exe
  C:\Windows\System\bVUFboS.exe
  2⤵
  PID:11948
- C:\Windows\System\CfgDsRq.exe
  C:\Windows\System\CfgDsRq.exe
  2⤵
  PID:11976
- C:\Windows\System\YSXOVxW.exe
  C:\Windows\System\YSXOVxW.exe
  2⤵
  PID:12000
- C:\Windows\System\dRvTAax.exe
  C:\Windows\System\dRvTAax.exe
  2⤵
  PID:12024
- C:\Windows\System\CECbfQD.exe
  C:\Windows\System\CECbfQD.exe
  2⤵
  PID:12056
- C:\Windows\System\ktepZmM.exe
  C:\Windows\System\ktepZmM.exe
  2⤵
  PID:12084
- C:\Windows\System\iaHDNYW.exe
  C:\Windows\System\iaHDNYW.exe
  2⤵
  PID:12112
- C:\Windows\System\tmGxMJF.exe
  C:\Windows\System\tmGxMJF.exe
  2⤵
  PID:12132
- C:\Windows\System\vSLUUrI.exe
  C:\Windows\System\vSLUUrI.exe
  2⤵
  PID:12160
- C:\Windows\System\wJiVIeT.exe
  C:\Windows\System\wJiVIeT.exe
  2⤵
  PID:12180
- C:\Windows\System\ANytlSA.exe
  C:\Windows\System\ANytlSA.exe
  2⤵
  PID:12204
- C:\Windows\System\bljjOSd.exe
  C:\Windows\System\bljjOSd.exe
  2⤵
  PID:12232
- C:\Windows\System\oFPiVTR.exe
  C:\Windows\System\oFPiVTR.exe
  2⤵
  PID:12256
- C:\Windows\System\crisSXI.exe
  C:\Windows\System\crisSXI.exe
  2⤵
  PID:12284
- C:\Windows\System\bsWsowP.exe
  C:\Windows\System\bsWsowP.exe
  2⤵
  PID:10320
- C:\Windows\System\fCFWzMy.exe
  C:\Windows\System\fCFWzMy.exe
  2⤵
  PID:9956
- C:\Windows\System\hDRFhUg.exe
  C:\Windows\System\hDRFhUg.exe
  2⤵
  PID:10936
- C:\Windows\System\btbVwKl.exe
  C:\Windows\System\btbVwKl.exe
  2⤵
  PID:11296
- C:\Windows\System\yAaCiKU.exe
  C:\Windows\System\yAaCiKU.exe
  2⤵
  PID:10808
- C:\Windows\System\OMwmEEB.exe
  C:\Windows\System\OMwmEEB.exe
  2⤵
  PID:11404
- C:\Windows\System\jiYGwbR.exe
  C:\Windows\System\jiYGwbR.exe
  2⤵
  PID:11468
- C:\Windows\System\MXEytNW.exe
  C:\Windows\System\MXEytNW.exe
  2⤵
  PID:11564
- C:\Windows\System\OHummBy.exe
  C:\Windows\System\OHummBy.exe
  2⤵
  PID:11604
- C:\Windows\System\PJdroTJ.exe
  C:\Windows\System\PJdroTJ.exe
  2⤵
  PID:11180
- C:\Windows\System\YRvBuMb.exe
  C:\Windows\System\YRvBuMb.exe
  2⤵
  PID:11732
- C:\Windows\System\LIpIwTp.exe
  C:\Windows\System\LIpIwTp.exe
  2⤵
  PID:11320
- C:\Windows\System\OYOssyL.exe
  C:\Windows\System\OYOssyL.exe
  2⤵
  PID:10856
- C:\Windows\System\Rcmoavf.exe
  C:\Windows\System\Rcmoavf.exe
  2⤵
  PID:11924
- C:\Windows\System\dsmdEZG.exe
  C:\Windows\System\dsmdEZG.exe
  2⤵
  PID:10776
- C:\Windows\System\DzhaahL.exe
  C:\Windows\System\DzhaahL.exe
  2⤵
  PID:11540
- C:\Windows\System\vwNyQeC.exe
  C:\Windows\System\vwNyQeC.exe
  2⤵
  PID:12092
- C:\Windows\System\RRoOTVn.exe
  C:\Windows\System\RRoOTVn.exe
  2⤵
  PID:11596
- C:\Windows\System\urWxvxY.exe
  C:\Windows\System\urWxvxY.exe
  2⤵
  PID:12152
- C:\Windows\System\FeGySsk.exe
  C:\Windows\System\FeGySsk.exe
  2⤵
  PID:12244
- C:\Windows\System\MYJMzzo.exe
  C:\Windows\System\MYJMzzo.exe
  2⤵
  PID:12272
- C:\Windows\System\HhzGHvA.exe
  C:\Windows\System\HhzGHvA.exe
  2⤵
  PID:12296
- C:\Windows\System\dDEOwUP.exe
  C:\Windows\System\dDEOwUP.exe
  2⤵
  PID:12320
- C:\Windows\System\GeiBCox.exe
  C:\Windows\System\GeiBCox.exe
  2⤵
  PID:12356
- C:\Windows\System\CwRSaIV.exe
  C:\Windows\System\CwRSaIV.exe
  2⤵
  PID:12376
- C:\Windows\System\rUJkMnS.exe
  C:\Windows\System\rUJkMnS.exe
  2⤵
  PID:12404
- C:\Windows\System\lgsfJNn.exe
  C:\Windows\System\lgsfJNn.exe
  2⤵
  PID:12432
- C:\Windows\System\ETHJwox.exe
  C:\Windows\System\ETHJwox.exe
  2⤵
  PID:12452
- C:\Windows\System\FgWrBcj.exe
  C:\Windows\System\FgWrBcj.exe
  2⤵
  PID:12472
- C:\Windows\System\SKdlohe.exe
  C:\Windows\System\SKdlohe.exe
  2⤵
  PID:12504
- C:\Windows\System\VdQUkMx.exe
  C:\Windows\System\VdQUkMx.exe
  2⤵
  PID:12528
- C:\Windows\System\iyDUVhQ.exe
  C:\Windows\System\iyDUVhQ.exe
  2⤵
  PID:12556
- C:\Windows\System\aWKGlEy.exe
  C:\Windows\System\aWKGlEy.exe
  2⤵
  PID:12576
- C:\Windows\System\gczZbhX.exe
  C:\Windows\System\gczZbhX.exe
  2⤵
  PID:12604
- C:\Windows\System\QwBGKrD.exe
  C:\Windows\System\QwBGKrD.exe
  2⤵
  PID:12632
- C:\Windows\System\LsaKzEH.exe
  C:\Windows\System\LsaKzEH.exe
  2⤵
  PID:12656
- C:\Windows\System\CjRsUEN.exe
  C:\Windows\System\CjRsUEN.exe
  2⤵
  PID:12684
- C:\Windows\System\PyTpJpS.exe
  C:\Windows\System\PyTpJpS.exe
  2⤵
  PID:12716
- C:\Windows\System\ywZGJHa.exe
  C:\Windows\System\ywZGJHa.exe
  2⤵
  PID:12736
- C:\Windows\System\LTLNeCb.exe
  C:\Windows\System\LTLNeCb.exe
  2⤵
  PID:12756
- C:\Windows\System\uHjJJbm.exe
  C:\Windows\System\uHjJJbm.exe
  2⤵
  PID:12780
- C:\Windows\System\FCEiNjA.exe
  C:\Windows\System\FCEiNjA.exe
  2⤵
  PID:12808
- C:\Windows\System\iWGbvRz.exe
  C:\Windows\System\iWGbvRz.exe
  2⤵
  PID:12836
- C:\Windows\System\EzhyIcw.exe
  C:\Windows\System\EzhyIcw.exe
  2⤵
  PID:12860
- C:\Windows\System\hsOvDIw.exe
  C:\Windows\System\hsOvDIw.exe
  2⤵
  PID:12884
- C:\Windows\System\QiSmUBE.exe
  C:\Windows\System\QiSmUBE.exe
  2⤵
  PID:12916
- C:\Windows\System\QHVQFqR.exe
  C:\Windows\System\QHVQFqR.exe
  2⤵
  PID:12940
- C:\Windows\System\zdAeuBk.exe
  C:\Windows\System\zdAeuBk.exe
  2⤵
  PID:12964
- C:\Windows\System\KjDSuXM.exe
  C:\Windows\System\KjDSuXM.exe
  2⤵
  PID:13220
- C:\Windows\System\KnFHPeq.exe
  C:\Windows\System\KnFHPeq.exe
  2⤵
  PID:13256
- C:\Windows\System\SYMlrwO.exe
  C:\Windows\System\SYMlrwO.exe
  2⤵
  PID:13296
- C:\Windows\System\ANfJUqG.exe
  C:\Windows\System\ANfJUqG.exe
  2⤵
  PID:11748
- C:\Windows\System\IEiAlCF.exe
  C:\Windows\System\IEiAlCF.exe
  2⤵
  PID:11772
- C:\Windows\System\kUwBWgm.exe
  C:\Windows\System\kUwBWgm.exe
  2⤵
  PID:11836
- C:\Windows\System\HwQTQGC.exe
  C:\Windows\System\HwQTQGC.exe
  2⤵
  PID:11848
- C:\Windows\System\CfwPopv.exe
  C:\Windows\System\CfwPopv.exe
  2⤵
  PID:11300
- C:\Windows\System\sQfanZZ.exe
  C:\Windows\System\sQfanZZ.exe
  2⤵
  PID:12144
- C:\Windows\System\UGnDxjO.exe
  C:\Windows\System\UGnDxjO.exe
  2⤵
  PID:12148
- C:\Windows\System\XDripPq.exe
  C:\Windows\System\XDripPq.exe
  2⤵
  PID:12328
- C:\Windows\System\WivxpOX.exe
  C:\Windows\System\WivxpOX.exe
  2⤵
  PID:12460
- C:\Windows\System\PbPIDjf.exe
  C:\Windows\System\PbPIDjf.exe
  2⤵
  PID:12644
- C:\Windows\System\nndxSzh.exe
  C:\Windows\System\nndxSzh.exe
  2⤵
  PID:12772
- C:\Windows\System\xfDHarq.exe
  C:\Windows\System\xfDHarq.exe
  2⤵
  PID:12848
- C:\Windows\System\sfmannC.exe
  C:\Windows\System\sfmannC.exe
  2⤵
  PID:11332
- C:\Windows\System\vLNMdqL.exe
  C:\Windows\System\vLNMdqL.exe
  2⤵
  PID:12492
- C:\Windows\System\sGObCZq.exe
  C:\Windows\System\sGObCZq.exe
  2⤵
  PID:10832
- C:\Windows\System\TFfalUT.exe
  C:\Windows\System\TFfalUT.exe
  2⤵
  PID:12020
- C:\Windows\System\eNuTtbG.exe
  C:\Windows\System\eNuTtbG.exe
  2⤵
  PID:12752
- C:\Windows\System\cmNSIhh.exe
  C:\Windows\System\cmNSIhh.exe
  2⤵
  PID:13128
- C:\Windows\System\YsjyBlY.exe
  C:\Windows\System\YsjyBlY.exe
  2⤵
  PID:12876
- C:\Windows\System\OsjeAqx.exe
  C:\Windows\System\OsjeAqx.exe
  2⤵
  PID:13188
- C:\Windows\System\htIkzfn.exe
  C:\Windows\System\htIkzfn.exe
  2⤵
  PID:12948
- C:\Windows\System\SsQrgvH.exe
  C:\Windows\System\SsQrgvH.exe
  2⤵
  PID:12420
- C:\Windows\System\hRsyUXV.exe
  C:\Windows\System\hRsyUXV.exe
  2⤵
  PID:12544
- C:\Windows\System\ayFHKvY.exe
  C:\Windows\System\ayFHKvY.exe
  2⤵
  PID:10984
- C:\Windows\System\DgzWvbe.exe
  C:\Windows\System\DgzWvbe.exe
  2⤵
  PID:11844
- C:\Windows\System\cvtCBeV.exe
  C:\Windows\System\cvtCBeV.exe
  2⤵
  PID:12648
- C:\Windows\System\fjdQMyx.exe
  C:\Windows\System\fjdQMyx.exe
  2⤵
  PID:12680
- C:\Windows\System\TfKabls.exe
  C:\Windows\System\TfKabls.exe
  2⤵
  PID:12448
- C:\Windows\System\ztrMXVo.exe
  C:\Windows\System\ztrMXVo.exe
  2⤵
  PID:13332
- C:\Windows\System\TjslZfa.exe
  C:\Windows\System\TjslZfa.exe
  2⤵
  PID:13364
- C:\Windows\System\UDbIRLV.exe
  C:\Windows\System\UDbIRLV.exe
  2⤵
  PID:13392
- C:\Windows\System\KIpLNDo.exe
  C:\Windows\System\KIpLNDo.exe
  2⤵
  PID:13420
- C:\Windows\System\LBMOHyn.exe
  C:\Windows\System\LBMOHyn.exe
  2⤵
  PID:13444
- C:\Windows\System\NsjIEav.exe
  C:\Windows\System\NsjIEav.exe
  2⤵
  PID:13472
- C:\Windows\System\VMtwBlT.exe
  C:\Windows\System\VMtwBlT.exe
  2⤵
  PID:13500
- C:\Windows\System\AVjZIWj.exe
  C:\Windows\System\AVjZIWj.exe
  2⤵
  PID:13524
- C:\Windows\System\zfKHtAe.exe
  C:\Windows\System\zfKHtAe.exe
  2⤵
  PID:13552
- C:\Windows\System\wOvvhvq.exe
  C:\Windows\System\wOvvhvq.exe
  2⤵
  PID:13572
- C:\Windows\System\VBYrWqG.exe
  C:\Windows\System\VBYrWqG.exe
  2⤵
  PID:13600
- C:\Windows\System\gQdOiRo.exe
  C:\Windows\System\gQdOiRo.exe
  2⤵
  PID:13628
- C:\Windows\System\gTsdHrq.exe
  C:\Windows\System\gTsdHrq.exe
  2⤵
  PID:13652
- C:\Windows\System\DOFXbtN.exe
  C:\Windows\System\DOFXbtN.exe
  2⤵
  PID:13668
- C:\Windows\System\TeCNiQn.exe
  C:\Windows\System\TeCNiQn.exe
  2⤵
  PID:13704
- C:\Windows\System\ekqqyKa.exe
  C:\Windows\System\ekqqyKa.exe
  2⤵
  PID:13952
- C:\Windows\System\QnGvUsW.exe
  C:\Windows\System\QnGvUsW.exe
  2⤵
  PID:13980
- C:\Windows\System\AwKtkyD.exe
  C:\Windows\System\AwKtkyD.exe
  2⤵
  PID:14016
- C:\Windows\System\kTshJmw.exe
  C:\Windows\System\kTshJmw.exe
  2⤵
  PID:14048
- C:\Windows\System\PCTJDZa.exe
  C:\Windows\System\PCTJDZa.exe
  2⤵
  PID:14092
- C:\Windows\System\iEgUyje.exe
  C:\Windows\System\iEgUyje.exe
  2⤵
  PID:14148
- C:\Windows\System\dGsyLFi.exe
  C:\Windows\System\dGsyLFi.exe
  2⤵
  PID:14192
- C:\Windows\System\TmXKmnf.exe
  C:\Windows\System\TmXKmnf.exe
  2⤵
  PID:14220
- C:\Windows\System\LptqIRY.exe
  C:\Windows\System\LptqIRY.exe
  2⤵
  PID:14252
- C:\Windows\System\HpsXgMq.exe
  C:\Windows\System\HpsXgMq.exe
  2⤵
  PID:14276
- C:\Windows\System\vlofPTT.exe
  C:\Windows\System\vlofPTT.exe
  2⤵
  PID:14316
- C:\Windows\System\KqFCuQv.exe
  C:\Windows\System\KqFCuQv.exe
  2⤵
  PID:12796
- C:\Windows\System\TPNNvcm.exe
  C:\Windows\System\TPNNvcm.exe
  2⤵
  PID:11124
- C:\Windows\System\iZTvJYK.exe
  C:\Windows\System\iZTvJYK.exe
  2⤵
  PID:12484
- C:\Windows\System\tPSOkNJ.exe
  C:\Windows\System\tPSOkNJ.exe
  2⤵
  PID:12520
- C:\Windows\System\TqQAMPa.exe
  C:\Windows\System\TqQAMPa.exe
  2⤵
  PID:13012
- C:\Windows\System\ZfSOFnD.exe
  C:\Windows\System\ZfSOFnD.exe
  2⤵
  PID:11988
- C:\Windows\System\QMOKBQR.exe
  C:\Windows\System\QMOKBQR.exe
  2⤵
  PID:12540
- C:\Windows\System\wpeAVbV.exe
  C:\Windows\System\wpeAVbV.exe
  2⤵
  PID:10676
- C:\Windows\System\bhMIskM.exe
  C:\Windows\System\bhMIskM.exe
  2⤵
  PID:11024
- C:\Windows\System\uDGmXQi.exe
  C:\Windows\System\uDGmXQi.exe
  2⤵
  PID:13540
- C:\Windows\System\NZPdSac.exe
  C:\Windows\System\NZPdSac.exe
  2⤵
  PID:11356
- C:\Windows\System\GOUGcQx.exe
  C:\Windows\System\GOUGcQx.exe
  2⤵
  PID:13588
- C:\Windows\System\NWMisrA.exe
  C:\Windows\System\NWMisrA.exe
  2⤵
  PID:12464
- C:\Windows\System\IVbhEXf.exe
  C:\Windows\System\IVbhEXf.exe
  2⤵
  PID:11972
- C:\Windows\System\qwsCTVK.exe
  C:\Windows\System\qwsCTVK.exe
  2⤵
  PID:13380
- C:\Windows\System\ZTwADNm.exe
  C:\Windows\System\ZTwADNm.exe
  2⤵
  PID:13612
- C:\Windows\System\mYIXLgm.exe
  C:\Windows\System\mYIXLgm.exe
  2⤵
  PID:13872
- C:\Windows\System\EOqtyYh.exe
  C:\Windows\System\EOqtyYh.exe
  2⤵
  PID:12584
- C:\Windows\System\oFtYrcF.exe
  C:\Windows\System\oFtYrcF.exe
  2⤵
  PID:12708
- C:\Windows\System\AtvMhxU.exe
  C:\Windows\System\AtvMhxU.exe
  2⤵
  PID:14004
- C:\Windows\System\aJZIpJq.exe
  C:\Windows\System\aJZIpJq.exe
  2⤵
  PID:14028
- C:\Windows\System\ZyDHRKf.exe
  C:\Windows\System\ZyDHRKf.exe
  2⤵
  PID:13772
- C:\Windows\System\GZAIsEk.exe
  C:\Windows\System\GZAIsEk.exe
  2⤵
  PID:13440
- C:\Windows\System\TPennTe.exe
  C:\Windows\System\TPennTe.exe
  2⤵
  PID:13512
- C:\Windows\System\pAYmgNY.exe
  C:\Windows\System\pAYmgNY.exe
  2⤵
  PID:14176
- C:\Windows\System\HpEXRVX.exe
  C:\Windows\System\HpEXRVX.exe
  2⤵
  PID:13936
- C:\Windows\System\QBzjMHw.exe
  C:\Windows\System\QBzjMHw.exe
  2⤵
  PID:13800
- C:\Windows\System\PrYSZtW.exe
  C:\Windows\System\PrYSZtW.exe
  2⤵
  PID:11968
- C:\Windows\System\LfATFzc.exe
  C:\Windows\System\LfATFzc.exe
  2⤵
  PID:13904
- C:\Windows\System\hfAxiwU.exe
  C:\Windows\System\hfAxiwU.exe
  2⤵
  PID:13964
- C:\Windows\System\YrOZNak.exe
  C:\Windows\System\YrOZNak.exe
  2⤵
  PID:10272
- C:\Windows\System\zGemvhO.exe
  C:\Windows\System\zGemvhO.exe
  2⤵
  PID:12168
- C:\Windows\System\aekbGGD.exe
  C:\Windows\System\aekbGGD.exe
  2⤵
  PID:14236
- C:\Windows\System\tXiFCjp.exe
  C:\Windows\System\tXiFCjp.exe
  2⤵
  PID:12748
- C:\Windows\System\vOWhzji.exe
  C:\Windows\System\vOWhzji.exe
  2⤵
  PID:12908
- C:\Windows\System\fuuRKHM.exe
  C:\Windows\System\fuuRKHM.exe
  2⤵
  PID:14436
- C:\Windows\System\fseJduv.exe
  C:\Windows\System\fseJduv.exe
  2⤵
  PID:14460
- C:\Windows\System\cbqhbgt.exe
  C:\Windows\System\cbqhbgt.exe
  2⤵
  PID:14480
- C:\Windows\System\IhYpELW.exe
  C:\Windows\System\IhYpELW.exe
  2⤵
  PID:14500
- C:\Windows\System\CokasSN.exe
  C:\Windows\System\CokasSN.exe
  2⤵
  PID:14528
- C:\Windows\System\HbOPJcQ.exe
  C:\Windows\System\HbOPJcQ.exe
  2⤵
  PID:14552
- C:\Windows\System\PIjWeKl.exe
  C:\Windows\System\PIjWeKl.exe
  2⤵
  PID:14576
- C:\Windows\System\AlKfFwk.exe
  C:\Windows\System\AlKfFwk.exe
  2⤵
  PID:14600
- C:\Windows\System\QuMdRzI.exe
  C:\Windows\System\QuMdRzI.exe
  2⤵
  PID:14628
- C:\Windows\System\hGmRHBn.exe
  C:\Windows\System\hGmRHBn.exe
  2⤵
  PID:14660
- C:\Windows\System\PUemWTG.exe
  C:\Windows\System\PUemWTG.exe
  2⤵
  PID:14684
- C:\Windows\System\mgQugkX.exe
  C:\Windows\System\mgQugkX.exe
  2⤵
  PID:14716
- C:\Windows\System\FqCCWIn.exe
  C:\Windows\System\FqCCWIn.exe
  2⤵
  PID:14740
- C:\Windows\System\HvkAptR.exe
  C:\Windows\System\HvkAptR.exe
  2⤵
  PID:14760
- C:\Windows\System\YbJxrKy.exe
  C:\Windows\System\YbJxrKy.exe
  2⤵
  PID:14784
- C:\Windows\System\oVmnACJ.exe
  C:\Windows\System\oVmnACJ.exe
  2⤵
  PID:14808
- C:\Windows\System\mwintjE.exe
  C:\Windows\System\mwintjE.exe
  2⤵
  PID:14832
- C:\Windows\System\CFGtLco.exe
  C:\Windows\System\CFGtLco.exe
  2⤵
  PID:14864
- C:\Windows\System\aPIPCud.exe
  C:\Windows\System\aPIPCud.exe
  2⤵
  PID:14900
- C:\Windows\System\SUcDjYJ.exe
  C:\Windows\System\SUcDjYJ.exe
  2⤵
  PID:14928
- C:\Windows\System\NenGtqo.exe
  C:\Windows\System\NenGtqo.exe
  2⤵
  PID:14956
- C:\Windows\System\ejSzmFz.exe
  C:\Windows\System\ejSzmFz.exe
  2⤵
  PID:14984
- C:\Windows\System\EEPTtga.exe
  C:\Windows\System\EEPTtga.exe
  2⤵
  PID:15016
- C:\Windows\System\FJqVtsA.exe
  C:\Windows\System\FJqVtsA.exe
  2⤵
  PID:15040
- C:\Windows\System\tBiYOcA.exe
  C:\Windows\System\tBiYOcA.exe
  2⤵
  PID:15064
- C:\Windows\System\lQyuvaq.exe
  C:\Windows\System\lQyuvaq.exe
  2⤵
  PID:15092
- C:\Windows\System\EmGHtLg.exe
  C:\Windows\System\EmGHtLg.exe
  2⤵
  PID:15120
- C:\Windows\System\wefEGcV.exe
  C:\Windows\System\wefEGcV.exe
  2⤵
  PID:15152
- C:\Windows\System\PoZgvTy.exe
  C:\Windows\System\PoZgvTy.exe
  2⤵
  PID:15220
- C:\Windows\System\zjntlop.exe
  C:\Windows\System\zjntlop.exe
  2⤵
  PID:15248
- C:\Windows\System\Nzbfmtx.exe
  C:\Windows\System\Nzbfmtx.exe
  2⤵
  PID:15276
- C:\Windows\System\vpvFADQ.exe
  C:\Windows\System\vpvFADQ.exe
  2⤵
  PID:15296
- C:\Windows\System\LOxZdWC.exe
  C:\Windows\System\LOxZdWC.exe
  2⤵
  PID:15320
- C:\Windows\System\zZBTnyw.exe
  C:\Windows\System\zZBTnyw.exe
  2⤵
  PID:15336
- C:\Windows\System\SwhaavL.exe
  C:\Windows\System\SwhaavL.exe
  2⤵
  PID:15356
- C:\Windows\System\CGKSsMT.exe
  C:\Windows\System\CGKSsMT.exe
  2⤵
  PID:11428
- C:\Windows\System\twiUHWl.exe
  C:\Windows\System\twiUHWl.exe
  2⤵
  PID:13124
- C:\Windows\System\UDnSPEN.exe
  C:\Windows\System\UDnSPEN.exe
  2⤵
  PID:14132
- C:\Windows\System\IMXbeZH.exe
  C:\Windows\System\IMXbeZH.exe
  2⤵
  PID:14308
- C:\Windows\System\zdskJdZ.exe
  C:\Windows\System\zdskJdZ.exe
  2⤵
  PID:11892
- C:\Windows\System\KiQQXPa.exe
  C:\Windows\System\KiQQXPa.exe
  2⤵
  PID:12972
- C:\Windows\System\fUugNHu.exe
  C:\Windows\System\fUugNHu.exe
  2⤵
  PID:13328
- C:\Windows\System\ELbpFgH.exe
  C:\Windows\System\ELbpFgH.exe
  2⤵
  PID:14288
- C:\Windows\System\AnMYeyt.exe
  C:\Windows\System\AnMYeyt.exe
  2⤵
  PID:14112
- C:\Windows\System\LjxUIAh.exe
  C:\Windows\System\LjxUIAh.exe
  2⤵
  PID:14508
- C:\Windows\System\UPDRTsU.exe
  C:\Windows\System\UPDRTsU.exe
  2⤵
  PID:14544
- C:\Windows\System\TxQYfFN.exe
  C:\Windows\System\TxQYfFN.exe
  2⤵
  PID:14560
- C:\Windows\System\lNsxSiO.exe
  C:\Windows\System\lNsxSiO.exe
  2⤵
  PID:14372
- C:\Windows\System\iKZoyjp.exe
  C:\Windows\System\iKZoyjp.exe
  2⤵
  PID:14456
- C:\Windows\System\dmpuIAc.exe
  C:\Windows\System\dmpuIAc.exe
  2⤵
  PID:14736
- C:\Windows\System\gnncCku.exe
  C:\Windows\System\gnncCku.exe
  2⤵
  PID:14804
- C:\Windows\System\BHReJro.exe
  C:\Windows\System\BHReJro.exe
  2⤵
  PID:14884
- C:\Windows\System\KZfDjnA.exe
  C:\Windows\System\KZfDjnA.exe
  2⤵
  PID:15032
- C:\Windows\System\imzXDox.exe
  C:\Windows\System\imzXDox.exe
  2⤵
  PID:14648
- C:\Windows\System\wIETceL.exe
  C:\Windows\System\wIETceL.exe
  2⤵
  PID:14972
- C:\Windows\System\jHvVNqK.exe
  C:\Windows\System\jHvVNqK.exe
  2⤵
  PID:15028
- C:\Windows\System\BzluiKQ.exe
  C:\Windows\System\BzluiKQ.exe
  2⤵
  PID:15136
- C:\Windows\System\IFwUWGs.exe
  C:\Windows\System\IFwUWGs.exe
  2⤵
  PID:15240
- C:\Windows\System\UfZSxKh.exe
  C:\Windows\System\UfZSxKh.exe
  2⤵
  PID:15308
- C:\Windows\System\onzDWyp.exe
  C:\Windows\System\onzDWyp.exe
  2⤵
  PID:15352
- C:\Windows\System\zdycsGJ.exe
  C:\Windows\System\zdycsGJ.exe
  2⤵
  PID:13844
- C:\Windows\System\PgsPmEM.exe
  C:\Windows\System\PgsPmEM.exe
  2⤵
  PID:13948
- C:\Windows\System\TmNPxob.exe
  C:\Windows\System\TmNPxob.exe
  2⤵
  PID:13236
- C:\Windows\System\yAOrpdc.exe
  C:\Windows\System\yAOrpdc.exe
  2⤵
  PID:14416
- C:\Windows\System\vjnsbhn.exe
  C:\Windows\System\vjnsbhn.exe
  2⤵
  PID:14452
- C:\Windows\System\gZCFiLO.exe
  C:\Windows\System\gZCFiLO.exe
  2⤵
  PID:14248
- C:\Windows\System\MNvuBuh.exe
  C:\Windows\System\MNvuBuh.exe
  2⤵
  PID:14880
- C:\Windows\System\ftXfoex.exe
  C:\Windows\System\ftXfoex.exe
  2⤵
  PID:15364
- C:\Windows\System\Gyclwxa.exe
  C:\Windows\System\Gyclwxa.exe
  2⤵
  PID:15396
- C:\Windows\System\OYxBnAT.exe
  C:\Windows\System\OYxBnAT.exe
  2⤵
  PID:15416
- C:\Windows\System\mrjlTKC.exe
  C:\Windows\System\mrjlTKC.exe
  2⤵
  PID:15444
- C:\Windows\System\VWpPtlR.exe
  C:\Windows\System\VWpPtlR.exe
  2⤵
  PID:15464
- C:\Windows\System\BIgROMN.exe
  C:\Windows\System\BIgROMN.exe
  2⤵
  PID:15484
- C:\Windows\System\mreLctg.exe
  C:\Windows\System\mreLctg.exe
  2⤵
  PID:15504
- C:\Windows\System\thiyCHX.exe
  C:\Windows\System\thiyCHX.exe
  2⤵
  PID:15528
- C:\Windows\System\yzkNWuN.exe
  C:\Windows\System\yzkNWuN.exe
  2⤵
  PID:15552
- C:\Windows\System\uTpzgNS.exe
  C:\Windows\System\uTpzgNS.exe
  2⤵
  PID:15572
- C:\Windows\System\lOYsiiW.exe
  C:\Windows\System\lOYsiiW.exe
  2⤵
  PID:15600
- C:\Windows\System\WtkIfVI.exe
  C:\Windows\System\WtkIfVI.exe
  2⤵
  PID:15620
- C:\Windows\System\PHpzqnX.exe
  C:\Windows\System\PHpzqnX.exe
  2⤵
  PID:15636
- C:\Windows\System\LQazSOL.exe
  C:\Windows\System\LQazSOL.exe
  2⤵
  PID:15672
- C:\Windows\System\zIlysea.exe
  C:\Windows\System\zIlysea.exe
  2⤵
  PID:15696
- C:\Windows\System\hkXWLGM.exe
  C:\Windows\System\hkXWLGM.exe
  2⤵
  PID:15724
- C:\Windows\System\LTETlNB.exe
  C:\Windows\System\LTETlNB.exe
  2⤵
  PID:15748
- C:\Windows\System\mnMuUZP.exe
  C:\Windows\System\mnMuUZP.exe
  2⤵
  PID:15772
- C:\Windows\System\VBZMwkl.exe
  C:\Windows\System\VBZMwkl.exe
  2⤵
  PID:15796
- C:\Windows\System\KxSiWky.exe
  C:\Windows\System\KxSiWky.exe
  2⤵
  PID:15828
- C:\Windows\System\jkSQGxV.exe
  C:\Windows\System\jkSQGxV.exe
  2⤵
  PID:15860
- C:\Windows\System\rPaHcka.exe
  C:\Windows\System\rPaHcka.exe
  2⤵
  PID:15884
- C:\Windows\System\wirLTas.exe
  C:\Windows\System\wirLTas.exe
  2⤵
  PID:15904
- C:\Windows\System\YlrTvcX.exe
  C:\Windows\System\YlrTvcX.exe
  2⤵
  PID:15936
- C:\Windows\System\HSRebRx.exe
  C:\Windows\System\HSRebRx.exe
  2⤵
  PID:15960
- C:\Windows\System\fIqTNJz.exe
  C:\Windows\System\fIqTNJz.exe
  2⤵
  PID:15976
- C:\Windows\System\cueqNMt.exe
  C:\Windows\System\cueqNMt.exe
  2⤵
  PID:16000
- C:\Windows\System\eiXZiWm.exe
  C:\Windows\System\eiXZiWm.exe
  2⤵
  PID:16040
- C:\Windows\System\puDqhtb.exe
  C:\Windows\System\puDqhtb.exe
  2⤵
  PID:16056
- C:\Windows\System\yLbgJND.exe
  C:\Windows\System\yLbgJND.exe
  2⤵
  PID:16084
- C:\Windows\System\BQARGKr.exe
  C:\Windows\System\BQARGKr.exe
  2⤵
  PID:16104
- C:\Windows\System\fKAxULe.exe
  C:\Windows\System\fKAxULe.exe
  2⤵
  PID:16120
- C:\Windows\System\uPpuShu.exe
  C:\Windows\System\uPpuShu.exe
  2⤵
  PID:16148
- C:\Windows\System\bISCGoY.exe
  C:\Windows\System\bISCGoY.exe
  2⤵
  PID:16176
- C:\Windows\System\ofPLrMp.exe
  C:\Windows\System\ofPLrMp.exe
  2⤵
  PID:16204
- C:\Windows\System\MhLcBYR.exe
  C:\Windows\System\MhLcBYR.exe
  2⤵
  PID:16224
- C:\Windows\System\QDdsqcw.exe
  C:\Windows\System\QDdsqcw.exe
  2⤵
  PID:16248
- C:\Windows\System\wRbfirw.exe
  C:\Windows\System\wRbfirw.exe
  2⤵
  PID:16280
- C:\Windows\System\DwHySAJ.exe
  C:\Windows\System\DwHySAJ.exe
  2⤵
  PID:16300
- C:\Windows\System\lSjkDby.exe
  C:\Windows\System\lSjkDby.exe
  2⤵
  PID:16316
- C:\Windows\System\HqJHEEl.exe
  C:\Windows\System\HqJHEEl.exe
  2⤵
  PID:16336
- C:\Windows\System\bYrzfTM.exe
  C:\Windows\System\bYrzfTM.exe
  2⤵
  PID:16356
- C:\Windows\System\OixVBXs.exe
  C:\Windows\System\OixVBXs.exe
  2⤵
  PID:16376
- C:\Windows\System\cLQjrdm.exe
  C:\Windows\System\cLQjrdm.exe
  2⤵
  PID:14976
- C:\Windows\System\mKHsnXx.exe
  C:\Windows\System\mKHsnXx.exe
  2⤵
  PID:14708
- C:\Windows\System\CGWcYHL.exe
  C:\Windows\System\CGWcYHL.exe
  2⤵
  PID:14100
- C:\Windows\System\bKrRrAu.exe
  C:\Windows\System\bKrRrAu.exe
  2⤵
  PID:14496
- C:\Windows\System\MAAkEpn.exe
  C:\Windows\System\MAAkEpn.exe
  2⤵
  PID:13568
- C:\Windows\System\qIsYpus.exe
  C:\Windows\System\qIsYpus.exe
  2⤵
  PID:12928
- C:\Windows\System\ZskaAGw.exe
  C:\Windows\System\ZskaAGw.exe
  2⤵
  PID:14680
- C:\Windows\System\qGiasiM.exe
  C:\Windows\System\qGiasiM.exe
  2⤵
  PID:15648
- C:\Windows\System\XmaUHVf.exe
  C:\Windows\System\XmaUHVf.exe
  2⤵
  PID:15736
- C:\Windows\System\IulRXou.exe
  C:\Windows\System\IulRXou.exe
  2⤵
  PID:15768
- C:\Windows\System\HbdaSEC.exe
  C:\Windows\System\HbdaSEC.exe
  2⤵
  PID:15872
- C:\Windows\System\WPKduTp.exe
  C:\Windows\System\WPKduTp.exe
  2⤵
  PID:13560
- C:\Windows\System\CQuweKy.exe
  C:\Windows\System\CQuweKy.exe
  2⤵
  PID:15956
- C:\Windows\System\tnzJTsU.exe
  C:\Windows\System\tnzJTsU.exe
  2⤵
  PID:14852
- C:\Windows\System\yeKoGjW.exe
  C:\Windows\System\yeKoGjW.exe
  2⤵
  PID:15584
- C:\Windows\System\PbRdvVz.exe
  C:\Windows\System\PbRdvVz.exe
  2⤵
  PID:16036
- C:\Windows\System\qBfJkfR.exe
  C:\Windows\System\qBfJkfR.exe
  2⤵
  PID:15680
- C:\Windows\System\aLmeJnR.exe
  C:\Windows\System\aLmeJnR.exe
  2⤵
  PID:16156
- C:\Windows\System\xotTfAz.exe
  C:\Windows\System\xotTfAz.exe
  2⤵
  PID:16440
- C:\Windows\System\ndxOTFV.exe
  C:\Windows\System\ndxOTFV.exe
  2⤵
  PID:16460
- C:\Windows\System\lQYioHf.exe
  C:\Windows\System\lQYioHf.exe
  2⤵
  PID:16496
- C:\Windows\System\sMuVRJk.exe
  C:\Windows\System\sMuVRJk.exe
  2⤵
  PID:16540
- C:\Windows\System\QgRCaLi.exe
  C:\Windows\System\QgRCaLi.exe
  2⤵
  PID:16584
- C:\Windows\System\MimZiXs.exe
  C:\Windows\System\MimZiXs.exe
  2⤵
  PID:16632
- C:\Windows\System\GlukAnc.exe
  C:\Windows\System\GlukAnc.exe
  2⤵
  PID:16680
- C:\Windows\System\qAxwbFX.exe
  C:\Windows\System\qAxwbFX.exe
  2⤵
  PID:16704
- C:\Windows\System\rNmxOzD.exe
  C:\Windows\System\rNmxOzD.exe
  2⤵
  PID:16724
- C:\Windows\System\hvYZljB.exe
  C:\Windows\System\hvYZljB.exe
  2⤵
  PID:16748
- C:\Windows\System\TGrLgGD.exe
  C:\Windows\System\TGrLgGD.exe
  2⤵
  PID:16776
- C:\Windows\System\IxHAccP.exe
  C:\Windows\System\IxHAccP.exe
  2⤵
  PID:16796
- C:\Windows\System\LApGoFn.exe
  C:\Windows\System\LApGoFn.exe
  2⤵
  PID:16832
- C:\Windows\System\enFxVDC.exe
  C:\Windows\System\enFxVDC.exe
  2⤵
  PID:16860
- C:\Windows\System\RimbHQT.exe
  C:\Windows\System\RimbHQT.exe
  2⤵
  PID:16896
- C:\Windows\System\GblZuYU.exe
  C:\Windows\System\GblZuYU.exe
  2⤵
  PID:16924
- C:\Windows\System\ecUXXXD.exe
  C:\Windows\System\ecUXXXD.exe
  2⤵
  PID:16960
- C:\Windows\System\FCaWFNk.exe
  C:\Windows\System\FCaWFNk.exe
  2⤵
  PID:16980
- C:\Windows\System\oOPbOlF.exe
  C:\Windows\System\oOPbOlF.exe
  2⤵
  PID:17000
- C:\Windows\System\hWPjwft.exe
  C:\Windows\System\hWPjwft.exe
  2⤵
  PID:17028
- C:\Windows\System\zwuYkAQ.exe
  C:\Windows\System\zwuYkAQ.exe
  2⤵
  PID:17044
- C:\Windows\System\fncSvqu.exe
  C:\Windows\System\fncSvqu.exe
  2⤵
  PID:17064
- C:\Windows\System\mxANGuf.exe
  C:\Windows\System\mxANGuf.exe
  2⤵
  PID:17096
- C:\Windows\System\cLZmVkI.exe
  C:\Windows\System\cLZmVkI.exe
  2⤵
  PID:17132
- C:\Windows\System\iQdFnQB.exe
  C:\Windows\System\iQdFnQB.exe
  2⤵
  PID:17156
- C:\Windows\System\KrTUHTf.exe
  C:\Windows\System\KrTUHTf.exe
  2⤵
  PID:17172
- C:\Windows\System\odZlDUN.exe
  C:\Windows\System\odZlDUN.exe
  2⤵
  PID:17192
- C:\Windows\System\zuCwcLq.exe
  C:\Windows\System\zuCwcLq.exe
  2⤵
  PID:17212
- C:\Windows\System\yVofwnT.exe
  C:\Windows\System\yVofwnT.exe
  2⤵
  PID:17236
- C:\Windows\System\caplbav.exe
  C:\Windows\System\caplbav.exe
  2⤵
  PID:17260
- C:\Windows\System\DIavFdG.exe
  C:\Windows\System\DIavFdG.exe
  2⤵
  PID:17276
- C:\Windows\System\NAnMsfm.exe
  C:\Windows\System\NAnMsfm.exe
  2⤵
  PID:17304
- C:\Windows\System\fwvvFdd.exe
  C:\Windows\System\fwvvFdd.exe
  2⤵
  PID:17320
- C:\Windows\System\JZeMBPr.exe
  C:\Windows\System\JZeMBPr.exe
  2⤵
  PID:17344
- C:\Windows\System\LNwhtps.exe
  C:\Windows\System\LNwhtps.exe
  2⤵
  PID:17368
- C:\Windows\System\vDSmEve.exe
  C:\Windows\System\vDSmEve.exe
  2⤵
  PID:17388
- C:\Windows\System\YsUwXAV.exe
  C:\Windows\System\YsUwXAV.exe
  2⤵
  PID:16784
- C:\Windows\System\yIyNuzK.exe
  C:\Windows\System\yIyNuzK.exe
  2⤵
  PID:16856
- C:\Windows\System\EnngcSQ.exe
  C:\Windows\System\EnngcSQ.exe
  2⤵
  PID:17152
- C:\Windows\System\AzSrBQP.exe
  C:\Windows\System\AzSrBQP.exe
  2⤵
  PID:16092

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17080

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:17388

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:16748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AHzPBCN.exe

Filesize
1.1MB

MD5
c40790a751dd9107c5a35928a06908d1

SHA1
3b584301f1510701cb5f4775f1b06b2ba436a488

SHA256
d33dff85967e82f2bacb2bc322c67340a48f6c6e09e80f6b2ba9c2a47330f0d5

SHA512
c53372fc1c2bc5ea57098a5711161f56770ff7b98898512406dd34d89b8a5aeec154ee8c417cc87a070abe02731056ba31d7e2922a7c612797873731737dee26

Download Submit
C:\Windows\System\ATTJaKD.exe

Filesize
1.1MB

MD5
d813bab8563ee6d791ffa24d7907db44

SHA1
00f1db0be2a95253bbf0e68bc578dca87045ca40

SHA256
37c64828e33f167d751acd0b4a1942cdf39121f7a1ae07c772227644a1f238b7

SHA512
b470d7775a387e361c43b87d12bf5e7c420a6f5d4e0212d5964fab53ce52fb76ebe70a515c6d550908a06aa0911b957dd2982185e514a4e794c9d42bd5cebcf4

Download Submit
C:\Windows\System\AgvrGzr.exe

Filesize
1.1MB

MD5
d4a7ba1a1581feff8fa839554713071f

SHA1
dbf1b9937d9dff6f3a08f37176bbce82fb4131e0

SHA256
f4954e6ef97acedf9b6e7a99e3279d15a4469815a653c555c67a03b71b045ee4

SHA512
7ea5f94c176994d4d07a2b3152c4b12210348b2108b9f35ee341d0f99377501da40fc991fafdc4dc06113c5f7bc515ad34d79eb087b4fca5973368af53ac9255

Download Submit
C:\Windows\System\DWQmiBJ.exe

Filesize
1.1MB

MD5
fd5ba9ddadfdd7f2c9cb92b1491045f7

SHA1
91421672c43620a786ffc8af42f9e1e00d16b51d

SHA256
4eac5819f99afd8e7401a14143391ed1c8876620e05d5b7a51f9cbd696bc2ffb

SHA512
35bf8789a9d45c67fab60345c3aa7b6b8558a729d55c83dc540ea097b965cd9710df0c3f40996a55ab9039d7a09d85f4921018a7c2665ed171d82fba7d748917

Download Submit
C:\Windows\System\DdXruQZ.exe

Filesize
1.1MB

MD5
559f63f1c6bfcac265c6d3a465d7a7ff

SHA1
6046f929c17bf697e2c50afb1e5bd2799dab3a3f

SHA256
2b0e6f5edc83cd53b06b0f92a162dd5f9818569a0d5aaa39915c78ae61ef1531

SHA512
5157a37e7473a6dec773ed36a5b55ac6525e6ae07c6245643063f1ff53783fdd43ab180faba07a23c064b68c3d4b95341f46364712f618dd46e520d071a150be

Download Submit
C:\Windows\System\EOELsSN.exe

Filesize
1.1MB

MD5
5a215bf46152ce9d7728270ba075b953

SHA1
955e7640a19e7e0b6daaf7b7fc9d0246fcba0a49

SHA256
926fabeec7c1db8daf970de0910092c8d1523e3243618a58b9af08e42807ce22

SHA512
a55d4b3e25d9557926f98241abdc295d5fcfccb0d26a098a486f8a483ee730b4d725d049d98b947b2f04f7947e25c62710f9598a34fd2e57908ce4bf60ae1839

Download Submit
C:\Windows\System\EdMLhcR.exe

Filesize
1.1MB

MD5
5c6fdbbe1c0f233ea7587c572b344e83

SHA1
6e1833f885651ca4ec6d545fcb88642719decd04

SHA256
90bb0e64dece8857d036171bd50503b951c0d54b300ad63ef9d809f62d1498ef

SHA512
38bd73b2934163cb690ee5044d61f9dc628542bac4907c621f94855ad2dc1a15855bc860a5084704d89c6419311d88d697aa15592a105ffeb2abae95c3b82628

Download Submit
C:\Windows\System\FFdrVHr.exe

Filesize
1.1MB

MD5
b92878564611ff7b28753985dbd9c1d3

SHA1
6a6625a1567f38a657d372d95197a1490818ade5

SHA256
c618277cb4d4b43ca8510426c356a349e94e7d215fe8a5355ae2c4adec84ab74

SHA512
feb3691050ee540e8db6f227b4f1f59299c94f1a8af7b9c32db01bdc71a8e031988756253caf7fdd0d410de10d65f26612f92dcc7849cce20184cb96b470efba

Download Submit
C:\Windows\System\FKhXuZK.exe

Filesize
1.1MB

MD5
360653807c2f491de22b2c548a838bf7

SHA1
4f7492d19fd3ed7c3bbbd6b28bad7ea46e401c54

SHA256
84690e6921aa97812c8f521d0f807d1c531eaea527fe19530f0f876910894be9

SHA512
e92fc56c26fd5c5999bcd5079b8b339e73676791168b6a743d40bf3281896ea48f9974641742d6d61fd194271b2f29f0957abd8b808bae90c8bf865fe98e683c

Download Submit
C:\Windows\System\IUHqwey.exe

Filesize
1.1MB

MD5
3b508b53a13f233cf46355512cc538e1

SHA1
e322626e38f52314b86a21ed748cbfe90f6cf1a0

SHA256
40e29f7bbbb0ead7baa610c874a2b23f7e7b1647ef359c90cdca965771d42f24

SHA512
1f301348a70c8dbdd31cf9a2ea4019e1c4ef257543019f11abb47f5e63bcea92bbabe8801a8d11c6285d9515069444f90c9cbc9074d2a7ce4b9e89f9050e13d5

Download Submit
C:\Windows\System\JLvAYjD.exe

Filesize
1.1MB

MD5
eda26ab94b44e4f296c87d2009fa895e

SHA1
869dd1c996e2950a27c553b04c0477b8fe85c114

SHA256
1d62bdb4e1be628c44811a2a0d4fc9dea7d0cd7c8cbaae1b468355425d8a44c6

SHA512
36c593964685675903884aea188c0933630410ed506b17e5a21df57b020c7a9f6613a94d496f0a78b6638dafa0a1dd574ff0d38499d1aa8550b74c60068dfe09

Download Submit
C:\Windows\System\LeaazTg.exe

Filesize
1.1MB

MD5
2fb6b7473eda2b264aafc077fbd34595

SHA1
cd53cf720a9acb94a54837c4c60d1865889579eb

SHA256
f02845f85cc4768e084ba234fdea530df8faf611fc2211f0a1799f3ea5032c26

SHA512
f7a8014e47cc136c97d5c407283179d271c2948e7cce497bc12fa5d1e897ad981bbc97c438b1b51be8fddd177b7742b4b7b967bc071f7a195da51694c445e700

Download Submit
C:\Windows\System\MDtTRbA.exe

Filesize
1.1MB

MD5
64460db16bce58d83b693f0b5a4991c5

SHA1
eda8a3b471b657dd2f10e0eb7e15bf74a44613cd

SHA256
87c783923cd84acf754a5f8a5e006a629f775a8080bfa638ce85b62a572e76d7

SHA512
780895898b79559cdf1b7f90cff3f7bad62f22c8b86749eafb6ac28d5ed22b663b098edadd5977269d024ab21e786a86a0d0c167d8dfbea852689f160bd237a3

Download Submit
C:\Windows\System\QbbNbkk.exe

Filesize
1.1MB

MD5
05f24b8104a244b900bc30782ed3c6ea

SHA1
718672abdc7cf3830e4a7e70c25b868174179dc6

SHA256
a74e01b1d68832d92d7e2931cca5455fbc37fe5bef04c665d0a21311a5417e31

SHA512
b3d56529d1ae38e77e6f2e4180cc999866417226364a30f7af62824218a6ecf3d669f718c683edb1a66c76baf52e0aee7bc9b3471c548ca20d6b6bd514a0349b

Download Submit
C:\Windows\System\SgFvttX.exe

Filesize
1.1MB

MD5
79e1eba855f162946e7dbe1170c22382

SHA1
ad65ac9275f47ecbd57906a7426c9325730b47a7

SHA256
01d37dcd4c774715033d64b6fe833cf1e5a9f4b5fa2848cf9d8aa913343bdb6e

SHA512
025b944e4ab12d4df315e1d4fcd41170925e1f670c1bc21cd17c5042d2f54b25e1c881a771f35623f85184563eef7f947a1cb484441c6a8e8d58c2193ec26c28

Download Submit
C:\Windows\System\VfgSFkB.exe

Filesize
1.1MB

MD5
3788fa60ca8f7eeb7c7df75760b2e94b

SHA1
8b99768965c981c3a051b2e024a0f52e106e4414

SHA256
297347544318940bb9d4a137f7398e90df2b32eaba66045273dd37bd579983af

SHA512
ce9af2733eab51aca2e85c4b325d1a822dadb544d0eef4ad28abe0217c1293685a41955101c0b13f6c3132cf9db42a8c598fe565c9bd317c537028418a31f2cd

Download Submit
C:\Windows\System\asEUjqk.exe

Filesize
1.1MB

MD5
02dea118c25a97d295839cc5238099bb

SHA1
d1cb17a164e3c9a33043004430feec78f63b84d7

SHA256
12f4b337cabfb9e577f52c9b8175a700954edbfa36870e8bd595db402916d159

SHA512
8e2ba660ccc6a231fa2c1442a0d062764cefaed2a000d8da8a979d1ae7c82fe3e824648f943ea22b46b0fb01da453d9c1912acbc5eb427456f06320f4227479b

Download Submit
C:\Windows\System\bsaoRMU.exe

Filesize
1.1MB

MD5
b471a41d7f53b24d62835706e0d1fd8a

SHA1
e41725da066426c50f755da6209ab55f62994f48

SHA256
9e905cc0fdbaeb5d638865464b056c9a9530c5c5bec58e1b668245916fe7aff2

SHA512
c2024ef7811efee51c63edba88be994be79d44368beae6b82547a69a254b7786234cd331532dedb3eb8c9d06adb6aaec1bac07d0dca0416522092c125648e29a

Download Submit
C:\Windows\System\cagCkEG.exe

Filesize
1.1MB

MD5
fe8737e502eee8f4e86f79762d85992f

SHA1
a681a6c0e594124b803c55b57688ad0f2ba97b71

SHA256
530346bbb24a2d8b10172c9a42768780e4ce1125c9ad36af3fcfdcf71eca1082

SHA512
27d1d5402c01140d16afaf037cd73e1e0dbf25906d36784d84000eb348b2c1a9cdff10cdfe51b62f5adb0f0dce7bd79ed1cb32b7dae63fc811d624b0ede44d88

Download Submit
C:\Windows\System\eIMbsgJ.exe

Filesize
1.1MB

MD5
b2660076b04852ba6e860a5a1ef822f7

SHA1
5573f4adc1a4b796614048b5de66a9e2c04e5004

SHA256
153be07257be7f09c3c0f80e76bea9c225cbfe139a17474a1965a40dc39f74df

SHA512
b3e0c1eda06ae9bb496a930f30d8a1d38552e82c306dff85c1b1d2605ef9512ad27e4aa622bb13afaa583e24955f38d0c452e233fdca57a1f83ca6b87aa83f0d

Download Submit
C:\Windows\System\jXuzBCX.exe

Filesize
1.1MB

MD5
d3a4756cd4a6d34376ba14b6aa617c56

SHA1
54bbd94ba1bb2f3b6d2cdb90e532500b296335de

SHA256
41b3286bf1f194bef80274137200538bae17db6864d7c1fde274dabe21b512fb

SHA512
80e9e5e1bebed65f1f923eb47cde937465a030211f476a195046aaa968fe95f4496173eff59e6b02180edc2f9ab1d1b980fa72f4f2a50e79ed34b488e76b5854

Download Submit
C:\Windows\System\jiALbRg.exe

Filesize
1.1MB

MD5
6e9eaf1880bbb3003a0cb9a2fb55e824

SHA1
a8bd3af03c6730f4f711822e2d74d56bac6b8017

SHA256
ed572e5b0fa8bc333a46e8da860136d75413b430f1f07fb1e8df236c8636aa3e

SHA512
68e8bf1672796965e99e64b38275957ac5e3a1f65aae857298bd593532cd0add6e85808594f8ec4d42e5cfb627617a922b48f1369fd67d8ec63f645dd0bd92fc

Download Submit
C:\Windows\System\kvmWXje.exe

Filesize
1.1MB

MD5
9001ae680f0ddef2413b5ab60f144762

SHA1
1e878bb32c35bd15b0a4e5198a4d428bd63c071f

SHA256
b6621dce311292b02b733fe514f3e52775423dc06b25fff8a88acd90dc309301

SHA512
f3ceec33b16a7cbfb19dcaeae4b6daae3b9bea7634a7780b6f80871037b5f6632155fe337b292efdf543899e91a2ea11e62d35631219e5247e00742a0b59488e

Download Submit
C:\Windows\System\loOIjZU.exe

Filesize
1.1MB

MD5
ca86b6c809ab941e91d513cad52c3d26

SHA1
f5ec15890da58fd169ba31fe248663bf8e3c412c

SHA256
1da3cd2657bfcf2e686289946323f8399310f33326b6488e2f004552c2714213

SHA512
8df056b76572acc250b7b20afdacb3c90faaaae578b15350d596b2c3bd2a7f0417e40632eaed2f258c417112f303ebc711e9913deadd66ce2802f93443e4b812

Download Submit
C:\Windows\System\mYLhWUu.exe

Filesize
1.1MB

MD5
9bbe35710b7dc16374f8e7bba3b37316

SHA1
b325f4db5ae14e353faafc40289092dfb6489c43

SHA256
1d5daa9da1452374c2ed8b6029b38eb1a462b9473b82c378704c2bb01217e9c3

SHA512
52247af1b3a1018f9075a8578b101fef22a3d824c84f39d99c5777cf149b12e35b8c5b207b3b06f3247161464c1b85ab643aafeeeaa709ead9f3e7a5ba2e8eae

Download Submit
C:\Windows\System\nzRmVzD.exe

Filesize
1.1MB

MD5
3e099fb74b48c8a98910d93d1b3e8819

SHA1
3c038fe2e505d8b4a22f69421a45db5c32e84566

SHA256
0e2aa380f7addd6a97c19661b899579a703ff9605369b0745337d8510aea7462

SHA512
b05dc124eadffdde84ef9dbd947da415329da0ae2743546a10d03e021b841e6a548ea17b1f32d8b206fd89c56c026cda7a12e7a4e13e8ec5ceb0909ce83f3a80

Download Submit
C:\Windows\System\oxNtmby.exe

Filesize
1.1MB

MD5
0fab0290f27a3867d6da38f5756ef0ed

SHA1
069a7b0362ec58d98457dde6fa6b91b731568f25

SHA256
74ea7446737de9b21162b5dc323bd7ddf9396b6bd8b76b9754b3e9365c5add73

SHA512
2f6496ab18d0d6ef1f4e9f7007c3e7b87543b570cefb0674ce022a0bd8fec5c607076bd61db6f016e356a8650d9a623f8d0e1acb8dad06dbacd8cbe392a34c8d

Download Submit
C:\Windows\System\peSOWfm.exe

Filesize
1.1MB

MD5
ee4b9a0c4795c362c35d5b7ddb09b02d

SHA1
fe2e93a4c0b1f256960143b26d051c1b66f08676

SHA256
c5d4f6d72fbf5c2852ef668b4e0359e632b68bbe5a841fc7e3b73cedd4c3cd06

SHA512
3b3494963d03b742f23e3d3e4dabeeacd6ed1a3b1b6b0402d34e626d719cbe9f033d9029ac3b138bd0fb3637b06fed0588329cc859f1fc90b49f15fe6ee91b4e

Download Submit
C:\Windows\System\pwNUiTY.exe

Filesize
1.1MB

MD5
b3f670c96d3d9a9a97e4172c5e1e140e

SHA1
6f3cd62fee1ba1ccb0d75984ae3246aed668b3d0

SHA256
24d9da2e78594d53efeda6df22ecb9ec9cf0e6addaaa5f6f1636b54d379904c6

SHA512
618c70b30b1883e66034f86498fdcac158337c8ac33437dafc5d96efc6cd340c954333f7b263ebc033040ca9654eabb463c00cc9506e5295ac85f5921a25bfc3

Download Submit
C:\Windows\System\sYZRlOQ.exe

Filesize
1.1MB

MD5
2d2ac2b11194380c6a1e165beb467939

SHA1
d6c15d00ccef802199e139740bc13fe1c9f39dc9

SHA256
f31ea24a7d22814e8032ef1d7bf7b3d374414b55e87aa0a8a0ef2155ac33c585

SHA512
c141c049c8daeff58a49594715a28abc3035578f9ce77306f13693edf0d5ce32c565832390df3b2e2a0433ca2d2efe430d21e96b33491eaf2bfc91e8aa71b105

Download Submit
C:\Windows\System\swzFYVF.exe

Filesize
1.1MB

MD5
48638791a92f9245bfeef3abbf801ff5

SHA1
ea970dc49582c7d2bbb4ab2747cacfff6dbcad76

SHA256
a9af1df819ac6258c96cf35ae6150ef3cab9060892f61ae984708f50d52390df

SHA512
f955ba3096b1c36252a0d5a27d7237a939b13de2991add9f3ea0bfae0477d5baad2332c69c05821d29ef4ee7bfabab23cdb047240a8525b2292e9c9f42c7113f

Download Submit
C:\Windows\System\taylUfl.exe

Filesize
1.1MB

MD5
e59c39f767801cecbd2e96a784c95c7f

SHA1
86cf4703313a560ddd0095c222a179cc5d6dfa2a

SHA256
70a6bf62604ed9117594602f13c19d938b77c55a3a8e554d6a49e4812d988617

SHA512
8a1ae9cbdfa41bc9db76b6691928fe9eb13f44500d3c87f6009e5a59e3cb16d2ade29e19b87a9e1cf7a9557f661fe3c23b4345daecde2a22bf94a7a7e67983cc

Download Submit
C:\Windows\System\tlFKagJ.exe

Filesize
1.1MB

MD5
e779350ee439409e69f9db67d1af32e7

SHA1
7e52c36d3986b2a635e03a5332657e0435470503

SHA256
a5753e3ff218ba3b0f83e22924786f0964715e7aa262cbf1eaf57e0ab210d590

SHA512
c198d1130047d762867c6422eece228f90eb824afeb187621d8c3ea19f19f66bc90907cf671a824894be7c929dda63ab7e54d3aaae7314eb2ef94b3d3947b571

Download Submit
C:\Windows\System\uKBulTh.exe

Filesize
1.1MB

MD5
c87ad2eca0e730f764825dac0f2e51fc

SHA1
f21dc9c5ab58bff95f167745ad43a76c8909b5b7

SHA256
b082e4fd439f3d6c90751ed23c9c6205b690c8589a355400f83ee10a6a3ca864

SHA512
3b415b14e075886e485e859ac88da43fc66a350a6b942a79de4dfc184d8f514c1c7860b56e91cd8498dd611622cadea43a9cb207ff5ef27c989293a0dec2d22b

Download Submit
C:\Windows\System\usBORUl.exe

Filesize
1.1MB

MD5
058d2fe979bcb5f64c7af537e5653c3b

SHA1
f63a0758aa1a7cd0e9529b2871b2893059be9028

SHA256
5db08d15a96bd50ba3fd70df7a1e497b3a8e93dd7c09ccdfffd5fa15f8db49cb

SHA512
97a8b8656ac2ad0e5f04f34c98af3a50432877fa8149f536cbd95e5c0952e039f8509003992209bad6e9d45b7e38b2f125245c565ec4b97704504a9d0944563f

Download Submit
C:\Windows\System\uslSkco.exe

Filesize
1.1MB

MD5
d26126c82f7a6c84774a9958ebd871d1

SHA1
305987a91dbcc12e6c61588010deffc6a17aa9ce

SHA256
0210d3e398d649f6e0bf52dbb1cff55dc99119ac8b2d7ae3796f26278ae04f9c

SHA512
169e94136b707d8a6f09125ce62cccf90c527d8eaa09e49581927426a0f50c1b8edb89f894abeb969d8c90abe62a91bb3fcdef679fc7d898e05850aaad05023d

Download Submit
C:\Windows\System\vDSLCYt.exe

Filesize
1.1MB

MD5
21cfeb4bc2aecfbfe84eba04756a3a29

SHA1
6fd4029293e5c7cd610cb2f67c0596b451021705

SHA256
21161c0668e70987fcaa568dcd3b60782370eab41d9d50369fbe0de9393aaef3

SHA512
7f3f5e7dd60b97ec89a072f6789be4f7a4aa07fa21bff31170ea4025bc94c10a95dc0b4b847803a8afed4cd8eeeb4305987b16d1d701d2e4667387ced1f18a51

Download Submit
C:\Windows\System\yOEgwzs.exe

Filesize
1.1MB

MD5
b3cd48dd50970ca085cd29c7a15347d6

SHA1
721efe6145a0b524296ee4f96b6bc70a0d361c03

SHA256
f7d3242dd59a968737196d6a71e03ca8a51120ad3f6c6a01c36c0ec352988de1

SHA512
fc2bcc26bc6730ddc5abbf899a031dabff8195bb96f00bffdc19ca5ba2b5f52ee30ecc9f9c4fb625a666b62c4ee2880faa23381611a55b7fa6fa9ca9fcb4e934

Download Submit
memory/1536-0-0x000001EC56520000-0x000001EC56530000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads