xmrig | 25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab

Analysis

max time kernel
98s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2025, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
Size

1.7MB
MD5

356eb2187e776ed33e7e26ab3e966d88
SHA1

d145907a30c3bf7e1b2ac3b5102988b45212ce67
SHA256

25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab
SHA512

cbdb71cbd4f47a8e6f481d27d71049151db497b36e4f33b15a80f3de1325c9ae8466231594b423ed571f98607b47ef2694ef01fd45a8855ac68faae99a877616
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxA1Mc2UVHUo2G:GemTLkNdfE0pZyE

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b6b-3.dat	xmrig
behavioral2/files/0x0007000000023c4f-8.dat	xmrig
behavioral2/files/0x0008000000023c4b-9.dat	xmrig
behavioral2/files/0x0007000000023c50-17.dat	xmrig
behavioral2/files/0x0007000000023c53-32.dat	xmrig
behavioral2/files/0x0007000000023c54-39.dat	xmrig
behavioral2/files/0x0007000000023c57-54.dat	xmrig
behavioral2/files/0x0007000000023c5a-67.dat	xmrig
behavioral2/files/0x0007000000023c5e-87.dat	xmrig
behavioral2/files/0x0007000000023c64-120.dat	xmrig
behavioral2/files/0x0007000000023c63-118.dat	xmrig
behavioral2/files/0x0007000000023c60-116.dat	xmrig
behavioral2/files/0x0007000000023c5f-114.dat	xmrig
behavioral2/files/0x0007000000023c62-112.dat	xmrig
behavioral2/files/0x0007000000023c61-110.dat	xmrig
behavioral2/files/0x0007000000023c5d-108.dat	xmrig
behavioral2/files/0x0007000000023c5c-106.dat	xmrig
behavioral2/files/0x0007000000023c5b-101.dat	xmrig
behavioral2/files/0x0007000000023c59-95.dat	xmrig
behavioral2/files/0x0007000000023c58-78.dat	xmrig
behavioral2/files/0x0007000000023c56-73.dat	xmrig
behavioral2/files/0x0007000000023c55-57.dat	xmrig
behavioral2/files/0x0007000000023c65-124.dat	xmrig
behavioral2/files/0x0007000000023c52-33.dat	xmrig
behavioral2/files/0x0007000000023c51-30.dat	xmrig
behavioral2/files/0x000e000000023b19-130.dat	xmrig
behavioral2/files/0x0008000000023c4c-134.dat	xmrig
behavioral2/files/0x0008000000023c66-139.dat	xmrig
behavioral2/files/0x0008000000023c68-141.dat	xmrig
behavioral2/files/0x0007000000023c69-149.dat	xmrig
behavioral2/files/0x000300000001e4ba-158.dat	xmrig
behavioral2/files/0x0007000000023c6b-163.dat	xmrig
behavioral2/files/0x0007000000023c6a-156.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4328	dDTuOih.exe
3884	OLIKiDT.exe
2760	uIdwhIv.exe
2492	OIrdxAG.exe
3516	pOAHZIU.exe
3588	YRPoEpH.exe
1968	pSTETeC.exe
3336	YIElPqI.exe
2400	trNVbSl.exe
1632	JRJBXrK.exe
2184	HcdNpBL.exe
4596	lsYuAAO.exe
3204	MbRkNka.exe
1208	HkpADMC.exe
2168	CjNscfj.exe
3120	USYiCXR.exe
2692	EdNlQmM.exe
212	YAnTWbx.exe
3476	enPuAGC.exe
4884	zvyRauU.exe
2572	pEZGgEO.exe
2688	OyqXjrL.exe
2708	LStEMex.exe
5004	tPXqkpR.exe
1664	agyImTX.exe
4532	KIGKBuv.exe
1424	KUoLwHV.exe
1308	kDvpdKR.exe
1636	ApsRfND.exe
4948	eCRcHmB.exe
368	ZZIyHYt.exe
2472	WBgkmgg.exe
1820	hGtzaBB.exe
3332	zdzcKaI.exe
3508	ZBbcYhZ.exe
3944	JYrPetX.exe
4460	sNNsuRQ.exe
3928	ccABuUs.exe
3960	wcSsIve.exe
728	RMiAkUO.exe
2092	hoxdbQu.exe
3152	HfcOyKz.exe
4696	mNkFrHN.exe
1732	fejdFAH.exe
380	pCpxHZx.exe
3632	QjsmVce.exe
5040	UJlqRyJ.exe
5068	CyEvCKA.exe
2116	fldYEpR.exe
3008	jHbEnuN.exe
5012	SoOiPvL.exe
1684	OspSxNy.exe
5020	QJelabp.exe
3148	GpZymXp.exe
876	GsvBDyy.exe
3108	QbWWzIL.exe
3368	cKjjvnL.exe
984	PYYotnn.exe
2428	xTbxzej.exe
1808	kOLqxUa.exe
2512	agRUPnq.exe
3640	PHTTsKX.exe
4852	uQWqUww.exe
3520	kXVioKj.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yPAPqQl.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\vPUUeOL.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\pItlPJn.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\wCdURJD.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\IqaeEIX.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\YlYGPXz.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\VHEyptm.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\Zczwbxf.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\lIkVJeZ.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\WGdFUla.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\PrVPyKS.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\ibrPsrn.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\JNmCaTT.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\vKKgixg.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\DQSeLJY.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\flbhHdC.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\BQQyfUA.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\QPfrshW.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\iaDlLCh.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\jWvWPrs.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\oNTmUMH.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\JHHdlmO.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\tlLJeon.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\SbeQZfy.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\nYomvSU.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\zXdOenY.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\gryilSD.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\EKipFxF.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\FxBcyMj.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\HmdjPCw.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\YOCbJTY.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\IcljVLg.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\NNNbgsG.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\iwYnwKl.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\pCpxHZx.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\nFawRaA.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\DfxNrdt.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\hywuzis.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\cxyOIEh.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\VcpPrrW.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\hgmbPCe.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\aZSdBmD.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\KIGKBuv.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\fldYEpR.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\UwdTwSL.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\gyQTSXc.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\CDPNIFE.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\kmAQScl.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\pOAHZIU.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\qOJcHfX.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\aEqWlAw.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\xYNhrDk.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\upTqiwW.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\KSfLIUS.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\euXHMVX.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\yEPGbuG.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\fhEYeih.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\kLtETPv.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\rwtawQt.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\ssCqnto.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\zFxuUEs.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\bOPpnvg.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\cyQzomT.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
File created	C:\Windows\System\NnBTxXZ.exe	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16936	dwm.exe
Token: SeChangeNotifyPrivilege	16936	dwm.exe
Token: 33	16936	dwm.exe
Token: SeIncBasePriorityPrivilege	16936	dwm.exe
Token: SeShutdownPrivilege	16936	dwm.exe
Token: SeCreatePagefilePrivilege	16936	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4328	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	85
PID 2360 wrote to memory of 4328	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	85
PID 2360 wrote to memory of 3884	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	86
PID 2360 wrote to memory of 3884	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	86
PID 2360 wrote to memory of 2760	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	88
PID 2360 wrote to memory of 2760	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	88
PID 2360 wrote to memory of 2492	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	89
PID 2360 wrote to memory of 2492	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	89
PID 2360 wrote to memory of 3516	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	90
PID 2360 wrote to memory of 3516	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	90
PID 2360 wrote to memory of 3588	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	91
PID 2360 wrote to memory of 3588	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	91
PID 2360 wrote to memory of 1968	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	92
PID 2360 wrote to memory of 1968	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	92
PID 2360 wrote to memory of 3336	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	93
PID 2360 wrote to memory of 3336	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	93
PID 2360 wrote to memory of 2400	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	94
PID 2360 wrote to memory of 2400	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	94
PID 2360 wrote to memory of 1632	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	95
PID 2360 wrote to memory of 1632	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	95
PID 2360 wrote to memory of 2184	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	96
PID 2360 wrote to memory of 2184	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	96
PID 2360 wrote to memory of 4596	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	97
PID 2360 wrote to memory of 4596	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	97
PID 2360 wrote to memory of 3204	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	98
PID 2360 wrote to memory of 3204	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	98
PID 2360 wrote to memory of 1208	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	99
PID 2360 wrote to memory of 1208	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	99
PID 2360 wrote to memory of 2168	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	100
PID 2360 wrote to memory of 2168	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	100
PID 2360 wrote to memory of 3120	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	101
PID 2360 wrote to memory of 3120	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	101
PID 2360 wrote to memory of 2692	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	102
PID 2360 wrote to memory of 2692	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	102
PID 2360 wrote to memory of 212	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	103
PID 2360 wrote to memory of 212	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	103
PID 2360 wrote to memory of 3476	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	104
PID 2360 wrote to memory of 3476	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	104
PID 2360 wrote to memory of 4884	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	105
PID 2360 wrote to memory of 4884	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	105
PID 2360 wrote to memory of 2572	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	106
PID 2360 wrote to memory of 2572	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	106
PID 2360 wrote to memory of 2688	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	107
PID 2360 wrote to memory of 2688	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	107
PID 2360 wrote to memory of 2708	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	108
PID 2360 wrote to memory of 2708	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	108
PID 2360 wrote to memory of 5004	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	109
PID 2360 wrote to memory of 5004	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	109
PID 2360 wrote to memory of 1664	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	111
PID 2360 wrote to memory of 1664	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	111
PID 2360 wrote to memory of 4532	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	112
PID 2360 wrote to memory of 4532	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	112
PID 2360 wrote to memory of 1424	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	113
PID 2360 wrote to memory of 1424	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	113
PID 2360 wrote to memory of 1308	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	114
PID 2360 wrote to memory of 1308	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	114
PID 2360 wrote to memory of 1636	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	115
PID 2360 wrote to memory of 1636	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	115
PID 2360 wrote to memory of 4948	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	116
PID 2360 wrote to memory of 4948	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	116
PID 2360 wrote to memory of 368	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	117
PID 2360 wrote to memory of 368	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	117
PID 2360 wrote to memory of 2472	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	118
PID 2360 wrote to memory of 2472	2360	25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe	118

C:\Users\Admin\AppData\Local\Temp\25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe
"C:\Users\Admin\AppData\Local\Temp\25f1be5c1f7d7ca49fc591117d792c82ae3397fc3dbf9bbd9c50e8838741fbab.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System\dDTuOih.exe
  C:\Windows\System\dDTuOih.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\OLIKiDT.exe
  C:\Windows\System\OLIKiDT.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\uIdwhIv.exe
  C:\Windows\System\uIdwhIv.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\OIrdxAG.exe
  C:\Windows\System\OIrdxAG.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\pOAHZIU.exe
  C:\Windows\System\pOAHZIU.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\YRPoEpH.exe
  C:\Windows\System\YRPoEpH.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\pSTETeC.exe
  C:\Windows\System\pSTETeC.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\YIElPqI.exe
  C:\Windows\System\YIElPqI.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\trNVbSl.exe
  C:\Windows\System\trNVbSl.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\JRJBXrK.exe
  C:\Windows\System\JRJBXrK.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\HcdNpBL.exe
  C:\Windows\System\HcdNpBL.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\lsYuAAO.exe
  C:\Windows\System\lsYuAAO.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\MbRkNka.exe
  C:\Windows\System\MbRkNka.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\HkpADMC.exe
  C:\Windows\System\HkpADMC.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\CjNscfj.exe
  C:\Windows\System\CjNscfj.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\USYiCXR.exe
  C:\Windows\System\USYiCXR.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\EdNlQmM.exe
  C:\Windows\System\EdNlQmM.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\YAnTWbx.exe
  C:\Windows\System\YAnTWbx.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\enPuAGC.exe
  C:\Windows\System\enPuAGC.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\zvyRauU.exe
  C:\Windows\System\zvyRauU.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\pEZGgEO.exe
  C:\Windows\System\pEZGgEO.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\OyqXjrL.exe
  C:\Windows\System\OyqXjrL.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\LStEMex.exe
  C:\Windows\System\LStEMex.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\tPXqkpR.exe
  C:\Windows\System\tPXqkpR.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\agyImTX.exe
  C:\Windows\System\agyImTX.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\KIGKBuv.exe
  C:\Windows\System\KIGKBuv.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\KUoLwHV.exe
  C:\Windows\System\KUoLwHV.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\kDvpdKR.exe
  C:\Windows\System\kDvpdKR.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\ApsRfND.exe
  C:\Windows\System\ApsRfND.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\eCRcHmB.exe
  C:\Windows\System\eCRcHmB.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\ZZIyHYt.exe
  C:\Windows\System\ZZIyHYt.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\WBgkmgg.exe
  C:\Windows\System\WBgkmgg.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\hGtzaBB.exe
  C:\Windows\System\hGtzaBB.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\zdzcKaI.exe
  C:\Windows\System\zdzcKaI.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\ZBbcYhZ.exe
  C:\Windows\System\ZBbcYhZ.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\JYrPetX.exe
  C:\Windows\System\JYrPetX.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\sNNsuRQ.exe
  C:\Windows\System\sNNsuRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\ccABuUs.exe
  C:\Windows\System\ccABuUs.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\wcSsIve.exe
  C:\Windows\System\wcSsIve.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\RMiAkUO.exe
  C:\Windows\System\RMiAkUO.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\hoxdbQu.exe
  C:\Windows\System\hoxdbQu.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\HfcOyKz.exe
  C:\Windows\System\HfcOyKz.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\mNkFrHN.exe
  C:\Windows\System\mNkFrHN.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\fejdFAH.exe
  C:\Windows\System\fejdFAH.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\pCpxHZx.exe
  C:\Windows\System\pCpxHZx.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\QjsmVce.exe
  C:\Windows\System\QjsmVce.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\UJlqRyJ.exe
  C:\Windows\System\UJlqRyJ.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\CyEvCKA.exe
  C:\Windows\System\CyEvCKA.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\fldYEpR.exe
  C:\Windows\System\fldYEpR.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\SoOiPvL.exe
  C:\Windows\System\SoOiPvL.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\jHbEnuN.exe
  C:\Windows\System\jHbEnuN.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\OspSxNy.exe
  C:\Windows\System\OspSxNy.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\QJelabp.exe
  C:\Windows\System\QJelabp.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\GpZymXp.exe
  C:\Windows\System\GpZymXp.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\GsvBDyy.exe
  C:\Windows\System\GsvBDyy.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\QbWWzIL.exe
  C:\Windows\System\QbWWzIL.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\cKjjvnL.exe
  C:\Windows\System\cKjjvnL.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\PYYotnn.exe
  C:\Windows\System\PYYotnn.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\xTbxzej.exe
  C:\Windows\System\xTbxzej.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\kOLqxUa.exe
  C:\Windows\System\kOLqxUa.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\agRUPnq.exe
  C:\Windows\System\agRUPnq.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\PHTTsKX.exe
  C:\Windows\System\PHTTsKX.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\uQWqUww.exe
  C:\Windows\System\uQWqUww.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\kXVioKj.exe
  C:\Windows\System\kXVioKj.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\lcQmcao.exe
  C:\Windows\System\lcQmcao.exe
  2⤵
  PID:3756
- C:\Windows\System\PylViUD.exe
  C:\Windows\System\PylViUD.exe
  2⤵
  PID:1912
- C:\Windows\System\jWcyRyg.exe
  C:\Windows\System\jWcyRyg.exe
  2⤵
  PID:4248
- C:\Windows\System\ryMeRpG.exe
  C:\Windows\System\ryMeRpG.exe
  2⤵
  PID:2636
- C:\Windows\System\YlYGPXz.exe
  C:\Windows\System\YlYGPXz.exe
  2⤵
  PID:4708
- C:\Windows\System\NOFrvuI.exe
  C:\Windows\System\NOFrvuI.exe
  2⤵
  PID:1300
- C:\Windows\System\fcZdjyE.exe
  C:\Windows\System\fcZdjyE.exe
  2⤵
  PID:4492
- C:\Windows\System\jslzbzw.exe
  C:\Windows\System\jslzbzw.exe
  2⤵
  PID:2128
- C:\Windows\System\zxAYkHT.exe
  C:\Windows\System\zxAYkHT.exe
  2⤵
  PID:3604
- C:\Windows\System\WFjXUeX.exe
  C:\Windows\System\WFjXUeX.exe
  2⤵
  PID:3556
- C:\Windows\System\YIpnKWZ.exe
  C:\Windows\System\YIpnKWZ.exe
  2⤵
  PID:2696
- C:\Windows\System\UdeRkbP.exe
  C:\Windows\System\UdeRkbP.exe
  2⤵
  PID:2260
- C:\Windows\System\JjFlmlt.exe
  C:\Windows\System\JjFlmlt.exe
  2⤵
  PID:4228
- C:\Windows\System\OMFqMIX.exe
  C:\Windows\System\OMFqMIX.exe
  2⤵
  PID:4936
- C:\Windows\System\ETgDCdk.exe
  C:\Windows\System\ETgDCdk.exe
  2⤵
  PID:4584
- C:\Windows\System\xdAipBf.exe
  C:\Windows\System\xdAipBf.exe
  2⤵
  PID:1988
- C:\Windows\System\xhcDWuv.exe
  C:\Windows\System\xhcDWuv.exe
  2⤵
  PID:5016
- C:\Windows\System\xsPVEdo.exe
  C:\Windows\System\xsPVEdo.exe
  2⤵
  PID:1160
- C:\Windows\System\VvoqtTo.exe
  C:\Windows\System\VvoqtTo.exe
  2⤵
  PID:1924
- C:\Windows\System\AvWyMdi.exe
  C:\Windows\System\AvWyMdi.exe
  2⤵
  PID:1480
- C:\Windows\System\faEXuzv.exe
  C:\Windows\System\faEXuzv.exe
  2⤵
  PID:1100
- C:\Windows\System\hBuFagQ.exe
  C:\Windows\System\hBuFagQ.exe
  2⤵
  PID:2480
- C:\Windows\System\nFawRaA.exe
  C:\Windows\System\nFawRaA.exe
  2⤵
  PID:2776
- C:\Windows\System\pycbLqP.exe
  C:\Windows\System\pycbLqP.exe
  2⤵
  PID:4516
- C:\Windows\System\aiEDZVJ.exe
  C:\Windows\System\aiEDZVJ.exe
  2⤵
  PID:1628
- C:\Windows\System\zlpAmiI.exe
  C:\Windows\System\zlpAmiI.exe
  2⤵
  PID:4928
- C:\Windows\System\MRKyYpj.exe
  C:\Windows\System\MRKyYpj.exe
  2⤵
  PID:1564
- C:\Windows\System\NcxnpaH.exe
  C:\Windows\System\NcxnpaH.exe
  2⤵
  PID:4332
- C:\Windows\System\pkMumKF.exe
  C:\Windows\System\pkMumKF.exe
  2⤵
  PID:1348
- C:\Windows\System\rCIGWck.exe
  C:\Windows\System\rCIGWck.exe
  2⤵
  PID:5148
- C:\Windows\System\cJwDAWG.exe
  C:\Windows\System\cJwDAWG.exe
  2⤵
  PID:5184
- C:\Windows\System\BUsCiyA.exe
  C:\Windows\System\BUsCiyA.exe
  2⤵
  PID:5212
- C:\Windows\System\twYOqTH.exe
  C:\Windows\System\twYOqTH.exe
  2⤵
  PID:5244
- C:\Windows\System\SKChxBr.exe
  C:\Windows\System\SKChxBr.exe
  2⤵
  PID:5268
- C:\Windows\System\VVEfDDJ.exe
  C:\Windows\System\VVEfDDJ.exe
  2⤵
  PID:5296
- C:\Windows\System\vDVroIF.exe
  C:\Windows\System\vDVroIF.exe
  2⤵
  PID:5312
- C:\Windows\System\CLhVYpY.exe
  C:\Windows\System\CLhVYpY.exe
  2⤵
  PID:5352
- C:\Windows\System\TZTLHvr.exe
  C:\Windows\System\TZTLHvr.exe
  2⤵
  PID:5380
- C:\Windows\System\NNEWfTY.exe
  C:\Windows\System\NNEWfTY.exe
  2⤵
  PID:5408
- C:\Windows\System\OBSejcB.exe
  C:\Windows\System\OBSejcB.exe
  2⤵
  PID:5424
- C:\Windows\System\CNtWJVg.exe
  C:\Windows\System\CNtWJVg.exe
  2⤵
  PID:5440
- C:\Windows\System\QPfrshW.exe
  C:\Windows\System\QPfrshW.exe
  2⤵
  PID:5468
- C:\Windows\System\DpQudMp.exe
  C:\Windows\System\DpQudMp.exe
  2⤵
  PID:5500
- C:\Windows\System\FpRlYUh.exe
  C:\Windows\System\FpRlYUh.exe
  2⤵
  PID:5536
- C:\Windows\System\UswrWAL.exe
  C:\Windows\System\UswrWAL.exe
  2⤵
  PID:5576
- C:\Windows\System\eZHNfZI.exe
  C:\Windows\System\eZHNfZI.exe
  2⤵
  PID:5592
- C:\Windows\System\zeRvIOA.exe
  C:\Windows\System\zeRvIOA.exe
  2⤵
  PID:5608
- C:\Windows\System\jhNFSoE.exe
  C:\Windows\System\jhNFSoE.exe
  2⤵
  PID:5636
- C:\Windows\System\taBCMjz.exe
  C:\Windows\System\taBCMjz.exe
  2⤵
  PID:5668
- C:\Windows\System\tRyRZYh.exe
  C:\Windows\System\tRyRZYh.exe
  2⤵
  PID:5704
- C:\Windows\System\ZxqIiCv.exe
  C:\Windows\System\ZxqIiCv.exe
  2⤵
  PID:5744
- C:\Windows\System\oVmrdeL.exe
  C:\Windows\System\oVmrdeL.exe
  2⤵
  PID:5772
- C:\Windows\System\CziIuir.exe
  C:\Windows\System\CziIuir.exe
  2⤵
  PID:5800
- C:\Windows\System\ieyvXyc.exe
  C:\Windows\System\ieyvXyc.exe
  2⤵
  PID:5828
- C:\Windows\System\JVneXjl.exe
  C:\Windows\System\JVneXjl.exe
  2⤵
  PID:5864
- C:\Windows\System\xwqMIsI.exe
  C:\Windows\System\xwqMIsI.exe
  2⤵
  PID:5892
- C:\Windows\System\ffpgONW.exe
  C:\Windows\System\ffpgONW.exe
  2⤵
  PID:5920
- C:\Windows\System\tpBtDTx.exe
  C:\Windows\System\tpBtDTx.exe
  2⤵
  PID:5948
- C:\Windows\System\fYFWQNC.exe
  C:\Windows\System\fYFWQNC.exe
  2⤵
  PID:5980
- C:\Windows\System\kyAmZgI.exe
  C:\Windows\System\kyAmZgI.exe
  2⤵
  PID:6008
- C:\Windows\System\NqsAJPP.exe
  C:\Windows\System\NqsAJPP.exe
  2⤵
  PID:6032
- C:\Windows\System\MStOCvW.exe
  C:\Windows\System\MStOCvW.exe
  2⤵
  PID:6064
- C:\Windows\System\PxYGfMs.exe
  C:\Windows\System\PxYGfMs.exe
  2⤵
  PID:6088
- C:\Windows\System\wORXFsR.exe
  C:\Windows\System\wORXFsR.exe
  2⤵
  PID:6108
- C:\Windows\System\OKUgOKB.exe
  C:\Windows\System\OKUgOKB.exe
  2⤵
  PID:6132
- C:\Windows\System\fSbSxDK.exe
  C:\Windows\System\fSbSxDK.exe
  2⤵
  PID:5144
- C:\Windows\System\tDnWfqg.exe
  C:\Windows\System\tDnWfqg.exe
  2⤵
  PID:5232
- C:\Windows\System\XmnOqCr.exe
  C:\Windows\System\XmnOqCr.exe
  2⤵
  PID:5292
- C:\Windows\System\rwFBmMq.exe
  C:\Windows\System\rwFBmMq.exe
  2⤵
  PID:5324
- C:\Windows\System\JciBCPF.exe
  C:\Windows\System\JciBCPF.exe
  2⤵
  PID:5396
- C:\Windows\System\ikigKRm.exe
  C:\Windows\System\ikigKRm.exe
  2⤵
  PID:5436
- C:\Windows\System\bLDyGrC.exe
  C:\Windows\System\bLDyGrC.exe
  2⤵
  PID:5524
- C:\Windows\System\bgvqeUx.exe
  C:\Windows\System\bgvqeUx.exe
  2⤵
  PID:5600
- C:\Windows\System\GtLaHJL.exe
  C:\Windows\System\GtLaHJL.exe
  2⤵
  PID:5676
- C:\Windows\System\gMyDdNm.exe
  C:\Windows\System\gMyDdNm.exe
  2⤵
  PID:5764
- C:\Windows\System\inQCrKZ.exe
  C:\Windows\System\inQCrKZ.exe
  2⤵
  PID:5812
- C:\Windows\System\ibrPsrn.exe
  C:\Windows\System\ibrPsrn.exe
  2⤵
  PID:5904
- C:\Windows\System\fyvraFd.exe
  C:\Windows\System\fyvraFd.exe
  2⤵
  PID:5940
- C:\Windows\System\UeeQHXy.exe
  C:\Windows\System\UeeQHXy.exe
  2⤵
  PID:5972
- C:\Windows\System\xNyLqYU.exe
  C:\Windows\System\xNyLqYU.exe
  2⤵
  PID:6056
- C:\Windows\System\IrRQIyA.exe
  C:\Windows\System\IrRQIyA.exe
  2⤵
  PID:3912
- C:\Windows\System\evpZlMq.exe
  C:\Windows\System\evpZlMq.exe
  2⤵
  PID:5280
- C:\Windows\System\NvCmjax.exe
  C:\Windows\System\NvCmjax.exe
  2⤵
  PID:5452
- C:\Windows\System\mMJjuoJ.exe
  C:\Windows\System\mMJjuoJ.exe
  2⤵
  PID:5628
- C:\Windows\System\EbsEDjr.exe
  C:\Windows\System\EbsEDjr.exe
  2⤵
  PID:5492
- C:\Windows\System\yDdVtFt.exe
  C:\Windows\System\yDdVtFt.exe
  2⤵
  PID:5876
- C:\Windows\System\JNmCaTT.exe
  C:\Windows\System\JNmCaTT.exe
  2⤵
  PID:6028
- C:\Windows\System\EZjaUaE.exe
  C:\Windows\System\EZjaUaE.exe
  2⤵
  PID:5364
- C:\Windows\System\IyyxEjp.exe
  C:\Windows\System\IyyxEjp.exe
  2⤵
  PID:5652
- C:\Windows\System\YOCbJTY.exe
  C:\Windows\System\YOCbJTY.exe
  2⤵
  PID:5968
- C:\Windows\System\uCsBGZQ.exe
  C:\Windows\System\uCsBGZQ.exe
  2⤵
  PID:5584
- C:\Windows\System\RDVASCq.exe
  C:\Windows\System\RDVASCq.exe
  2⤵
  PID:6116
- C:\Windows\System\asirTdW.exe
  C:\Windows\System\asirTdW.exe
  2⤵
  PID:6168
- C:\Windows\System\nUiSptH.exe
  C:\Windows\System\nUiSptH.exe
  2⤵
  PID:6196
- C:\Windows\System\yPAPqQl.exe
  C:\Windows\System\yPAPqQl.exe
  2⤵
  PID:6224
- C:\Windows\System\lyYJpVq.exe
  C:\Windows\System\lyYJpVq.exe
  2⤵
  PID:6256
- C:\Windows\System\vzdjmZO.exe
  C:\Windows\System\vzdjmZO.exe
  2⤵
  PID:6284
- C:\Windows\System\EQqFSHS.exe
  C:\Windows\System\EQqFSHS.exe
  2⤵
  PID:6308
- C:\Windows\System\gYOPUat.exe
  C:\Windows\System\gYOPUat.exe
  2⤵
  PID:6328
- C:\Windows\System\vkyzmHQ.exe
  C:\Windows\System\vkyzmHQ.exe
  2⤵
  PID:6368
- C:\Windows\System\NqnKsKk.exe
  C:\Windows\System\NqnKsKk.exe
  2⤵
  PID:6400
- C:\Windows\System\wIWsYJf.exe
  C:\Windows\System\wIWsYJf.exe
  2⤵
  PID:6424
- C:\Windows\System\gQwezqv.exe
  C:\Windows\System\gQwezqv.exe
  2⤵
  PID:6444
- C:\Windows\System\MGKukyL.exe
  C:\Windows\System\MGKukyL.exe
  2⤵
  PID:6472
- C:\Windows\System\NTTdTGv.exe
  C:\Windows\System\NTTdTGv.exe
  2⤵
  PID:6488
- C:\Windows\System\wLfoRGv.exe
  C:\Windows\System\wLfoRGv.exe
  2⤵
  PID:6516
- C:\Windows\System\YcSUxoT.exe
  C:\Windows\System\YcSUxoT.exe
  2⤵
  PID:6552
- C:\Windows\System\puacwzj.exe
  C:\Windows\System\puacwzj.exe
  2⤵
  PID:6576
- C:\Windows\System\PNZNYpB.exe
  C:\Windows\System\PNZNYpB.exe
  2⤵
  PID:6612
- C:\Windows\System\eiyPlVH.exe
  C:\Windows\System\eiyPlVH.exe
  2⤵
  PID:6632
- C:\Windows\System\UJJQcOR.exe
  C:\Windows\System\UJJQcOR.exe
  2⤵
  PID:6660
- C:\Windows\System\QcnQgZC.exe
  C:\Windows\System\QcnQgZC.exe
  2⤵
  PID:6684
- C:\Windows\System\dddmRRj.exe
  C:\Windows\System\dddmRRj.exe
  2⤵
  PID:6724
- C:\Windows\System\kmWlpev.exe
  C:\Windows\System\kmWlpev.exe
  2⤵
  PID:6752
- C:\Windows\System\uWzRETb.exe
  C:\Windows\System\uWzRETb.exe
  2⤵
  PID:6776
- C:\Windows\System\IrrfhqA.exe
  C:\Windows\System\IrrfhqA.exe
  2⤵
  PID:6804
- C:\Windows\System\nEPcvnR.exe
  C:\Windows\System\nEPcvnR.exe
  2⤵
  PID:6840
- C:\Windows\System\JYLXsZE.exe
  C:\Windows\System\JYLXsZE.exe
  2⤵
  PID:6864
- C:\Windows\System\rknCMXe.exe
  C:\Windows\System\rknCMXe.exe
  2⤵
  PID:6896
- C:\Windows\System\rpHWETd.exe
  C:\Windows\System\rpHWETd.exe
  2⤵
  PID:6928
- C:\Windows\System\ZOSjVmH.exe
  C:\Windows\System\ZOSjVmH.exe
  2⤵
  PID:6948
- C:\Windows\System\GdiGnND.exe
  C:\Windows\System\GdiGnND.exe
  2⤵
  PID:6972
- C:\Windows\System\dsIQXiI.exe
  C:\Windows\System\dsIQXiI.exe
  2⤵
  PID:7004
- C:\Windows\System\zrjgKoE.exe
  C:\Windows\System\zrjgKoE.exe
  2⤵
  PID:7036
- C:\Windows\System\QzZStEQ.exe
  C:\Windows\System\QzZStEQ.exe
  2⤵
  PID:7064
- C:\Windows\System\PXaLhBu.exe
  C:\Windows\System\PXaLhBu.exe
  2⤵
  PID:7100
- C:\Windows\System\lYRBDnx.exe
  C:\Windows\System\lYRBDnx.exe
  2⤵
  PID:7128
- C:\Windows\System\gMWpUkx.exe
  C:\Windows\System\gMWpUkx.exe
  2⤵
  PID:6148
- C:\Windows\System\hbrBFib.exe
  C:\Windows\System\hbrBFib.exe
  2⤵
  PID:6212
- C:\Windows\System\IcljVLg.exe
  C:\Windows\System\IcljVLg.exe
  2⤵
  PID:6276
- C:\Windows\System\nZUOvkU.exe
  C:\Windows\System\nZUOvkU.exe
  2⤵
  PID:6324
- C:\Windows\System\QIVFSXZ.exe
  C:\Windows\System\QIVFSXZ.exe
  2⤵
  PID:6392
- C:\Windows\System\CGThLjH.exe
  C:\Windows\System\CGThLjH.exe
  2⤵
  PID:6432
- C:\Windows\System\HTfpFDk.exe
  C:\Windows\System\HTfpFDk.exe
  2⤵
  PID:6508
- C:\Windows\System\gdChGMO.exe
  C:\Windows\System\gdChGMO.exe
  2⤵
  PID:6568
- C:\Windows\System\WGeGiDD.exe
  C:\Windows\System\WGeGiDD.exe
  2⤵
  PID:6736
- C:\Windows\System\lNBHEAx.exe
  C:\Windows\System\lNBHEAx.exe
  2⤵
  PID:6716
- C:\Windows\System\DBIJBXy.exe
  C:\Windows\System\DBIJBXy.exe
  2⤵
  PID:6820
- C:\Windows\System\VHEyptm.exe
  C:\Windows\System\VHEyptm.exe
  2⤵
  PID:6856
- C:\Windows\System\hTkufJM.exe
  C:\Windows\System\hTkufJM.exe
  2⤵
  PID:6920
- C:\Windows\System\PytNFHQ.exe
  C:\Windows\System\PytNFHQ.exe
  2⤵
  PID:6916
- C:\Windows\System\bNaeMJV.exe
  C:\Windows\System\bNaeMJV.exe
  2⤵
  PID:6996
- C:\Windows\System\XtvPBtm.exe
  C:\Windows\System\XtvPBtm.exe
  2⤵
  PID:7124
- C:\Windows\System\ycQhgdk.exe
  C:\Windows\System\ycQhgdk.exe
  2⤵
  PID:6176
- C:\Windows\System\FbWvihS.exe
  C:\Windows\System\FbWvihS.exe
  2⤵
  PID:6460
- C:\Windows\System\DSwBstH.exe
  C:\Windows\System\DSwBstH.exe
  2⤵
  PID:6484
- C:\Windows\System\lalogKR.exe
  C:\Windows\System\lalogKR.exe
  2⤵
  PID:6656
- C:\Windows\System\rLfONuh.exe
  C:\Windows\System\rLfONuh.exe
  2⤵
  PID:7024
- C:\Windows\System\KYCqygK.exe
  C:\Windows\System\KYCqygK.exe
  2⤵
  PID:7088
- C:\Windows\System\KCsQchw.exe
  C:\Windows\System\KCsQchw.exe
  2⤵
  PID:6440
- C:\Windows\System\KjdoLfM.exe
  C:\Windows\System\KjdoLfM.exe
  2⤵
  PID:6644
- C:\Windows\System\kIWVafE.exe
  C:\Windows\System\kIWVafE.exe
  2⤵
  PID:6696
- C:\Windows\System\drDRrcq.exe
  C:\Windows\System\drDRrcq.exe
  2⤵
  PID:7116
- C:\Windows\System\GfcbWuz.exe
  C:\Windows\System\GfcbWuz.exe
  2⤵
  PID:6464
- C:\Windows\System\giEBnDP.exe
  C:\Windows\System\giEBnDP.exe
  2⤵
  PID:7188
- C:\Windows\System\vPUUeOL.exe
  C:\Windows\System\vPUUeOL.exe
  2⤵
  PID:7224
- C:\Windows\System\DfxNrdt.exe
  C:\Windows\System\DfxNrdt.exe
  2⤵
  PID:7244
- C:\Windows\System\RQCBwqg.exe
  C:\Windows\System\RQCBwqg.exe
  2⤵
  PID:7276
- C:\Windows\System\iaDlLCh.exe
  C:\Windows\System\iaDlLCh.exe
  2⤵
  PID:7312
- C:\Windows\System\xIqFNZo.exe
  C:\Windows\System\xIqFNZo.exe
  2⤵
  PID:7348
- C:\Windows\System\UhKnSeu.exe
  C:\Windows\System\UhKnSeu.exe
  2⤵
  PID:7368
- C:\Windows\System\bMwrKSE.exe
  C:\Windows\System\bMwrKSE.exe
  2⤵
  PID:7392
- C:\Windows\System\cMtHLys.exe
  C:\Windows\System\cMtHLys.exe
  2⤵
  PID:7416
- C:\Windows\System\xmtcVpA.exe
  C:\Windows\System\xmtcVpA.exe
  2⤵
  PID:7436
- C:\Windows\System\sQigflj.exe
  C:\Windows\System\sQigflj.exe
  2⤵
  PID:7460
- C:\Windows\System\jdITNQk.exe
  C:\Windows\System\jdITNQk.exe
  2⤵
  PID:7496
- C:\Windows\System\oIMhPtD.exe
  C:\Windows\System\oIMhPtD.exe
  2⤵
  PID:7528
- C:\Windows\System\hywuzis.exe
  C:\Windows\System\hywuzis.exe
  2⤵
  PID:7564
- C:\Windows\System\yqMcxKH.exe
  C:\Windows\System\yqMcxKH.exe
  2⤵
  PID:7588
- C:\Windows\System\pegtDYk.exe
  C:\Windows\System\pegtDYk.exe
  2⤵
  PID:7616
- C:\Windows\System\JYhiOlN.exe
  C:\Windows\System\JYhiOlN.exe
  2⤵
  PID:7648
- C:\Windows\System\QVmRsxX.exe
  C:\Windows\System\QVmRsxX.exe
  2⤵
  PID:7684
- C:\Windows\System\iSuwQYh.exe
  C:\Windows\System\iSuwQYh.exe
  2⤵
  PID:7708
- C:\Windows\System\Zczwbxf.exe
  C:\Windows\System\Zczwbxf.exe
  2⤵
  PID:7736
- C:\Windows\System\MCDXnNb.exe
  C:\Windows\System\MCDXnNb.exe
  2⤵
  PID:7768
- C:\Windows\System\NvCQcTk.exe
  C:\Windows\System\NvCQcTk.exe
  2⤵
  PID:7796
- C:\Windows\System\XWPkVen.exe
  C:\Windows\System\XWPkVen.exe
  2⤵
  PID:7824
- C:\Windows\System\nOAOnqf.exe
  C:\Windows\System\nOAOnqf.exe
  2⤵
  PID:7852
- C:\Windows\System\IzdiYOn.exe
  C:\Windows\System\IzdiYOn.exe
  2⤵
  PID:7892
- C:\Windows\System\lXjVtPT.exe
  C:\Windows\System\lXjVtPT.exe
  2⤵
  PID:7916
- C:\Windows\System\hJJUfeN.exe
  C:\Windows\System\hJJUfeN.exe
  2⤵
  PID:7944
- C:\Windows\System\lkHxZLt.exe
  C:\Windows\System\lkHxZLt.exe
  2⤵
  PID:7972
- C:\Windows\System\uBlclqv.exe
  C:\Windows\System\uBlclqv.exe
  2⤵
  PID:8008
- C:\Windows\System\QllNiro.exe
  C:\Windows\System\QllNiro.exe
  2⤵
  PID:8036
- C:\Windows\System\wqjVkXg.exe
  C:\Windows\System\wqjVkXg.exe
  2⤵
  PID:8076
- C:\Windows\System\syhkVtQ.exe
  C:\Windows\System\syhkVtQ.exe
  2⤵
  PID:8104
- C:\Windows\System\fsAOhUp.exe
  C:\Windows\System\fsAOhUp.exe
  2⤵
  PID:8132
- C:\Windows\System\QaKZbQt.exe
  C:\Windows\System\QaKZbQt.exe
  2⤵
  PID:8148
- C:\Windows\System\nkGIofH.exe
  C:\Windows\System\nkGIofH.exe
  2⤵
  PID:8176
- C:\Windows\System\MZjjQJY.exe
  C:\Windows\System\MZjjQJY.exe
  2⤵
  PID:7112
- C:\Windows\System\iQxfvPT.exe
  C:\Windows\System\iQxfvPT.exe
  2⤵
  PID:7208
- C:\Windows\System\IpZHado.exe
  C:\Windows\System\IpZHado.exe
  2⤵
  PID:7324
- C:\Windows\System\rBWADlV.exe
  C:\Windows\System\rBWADlV.exe
  2⤵
  PID:7400
- C:\Windows\System\JDdFkpF.exe
  C:\Windows\System\JDdFkpF.exe
  2⤵
  PID:7480
- C:\Windows\System\pZiTJPu.exe
  C:\Windows\System\pZiTJPu.exe
  2⤵
  PID:7540
- C:\Windows\System\fnzGKfY.exe
  C:\Windows\System\fnzGKfY.exe
  2⤵
  PID:7508
- C:\Windows\System\UzTVHnw.exe
  C:\Windows\System\UzTVHnw.exe
  2⤵
  PID:7608
- C:\Windows\System\fliUsrX.exe
  C:\Windows\System\fliUsrX.exe
  2⤵
  PID:7724
- C:\Windows\System\IYOZGLC.exe
  C:\Windows\System\IYOZGLC.exe
  2⤵
  PID:7704
- C:\Windows\System\KkbeIGI.exe
  C:\Windows\System\KkbeIGI.exe
  2⤵
  PID:7752
- C:\Windows\System\NPifDgy.exe
  C:\Windows\System\NPifDgy.exe
  2⤵
  PID:7808
- C:\Windows\System\XIVRgal.exe
  C:\Windows\System\XIVRgal.exe
  2⤵
  PID:7864
- C:\Windows\System\LCknYPt.exe
  C:\Windows\System\LCknYPt.exe
  2⤵
  PID:7968
- C:\Windows\System\mkQRfHR.exe
  C:\Windows\System\mkQRfHR.exe
  2⤵
  PID:8064
- C:\Windows\System\wVVBYgI.exe
  C:\Windows\System\wVVBYgI.exe
  2⤵
  PID:8128
- C:\Windows\System\wajUKMV.exe
  C:\Windows\System\wajUKMV.exe
  2⤵
  PID:7172
- C:\Windows\System\LXjFfqy.exe
  C:\Windows\System\LXjFfqy.exe
  2⤵
  PID:7308
- C:\Windows\System\LeIzpUz.exe
  C:\Windows\System\LeIzpUz.exe
  2⤵
  PID:7408
- C:\Windows\System\UxDxJkS.exe
  C:\Windows\System\UxDxJkS.exe
  2⤵
  PID:7452
- C:\Windows\System\kENKtjv.exe
  C:\Windows\System\kENKtjv.exe
  2⤵
  PID:7760
- C:\Windows\System\NtNFHEd.exe
  C:\Windows\System\NtNFHEd.exe
  2⤵
  PID:7696
- C:\Windows\System\aMFwHcu.exe
  C:\Windows\System\aMFwHcu.exe
  2⤵
  PID:7904
- C:\Windows\System\YxZpzoU.exe
  C:\Windows\System\YxZpzoU.exe
  2⤵
  PID:8028
- C:\Windows\System\LrVpjZo.exe
  C:\Windows\System\LrVpjZo.exe
  2⤵
  PID:7424
- C:\Windows\System\EaHYYyS.exe
  C:\Windows\System\EaHYYyS.exe
  2⤵
  PID:7584
- C:\Windows\System\Aujgniz.exe
  C:\Windows\System\Aujgniz.exe
  2⤵
  PID:7996
- C:\Windows\System\vKKgixg.exe
  C:\Windows\System\vKKgixg.exe
  2⤵
  PID:7380
- C:\Windows\System\ULbnZyl.exe
  C:\Windows\System\ULbnZyl.exe
  2⤵
  PID:8212
- C:\Windows\System\KmAexeS.exe
  C:\Windows\System\KmAexeS.exe
  2⤵
  PID:8244
- C:\Windows\System\DQSeLJY.exe
  C:\Windows\System\DQSeLJY.exe
  2⤵
  PID:8260
- C:\Windows\System\EyNLwDw.exe
  C:\Windows\System\EyNLwDw.exe
  2⤵
  PID:8288
- C:\Windows\System\dVequzi.exe
  C:\Windows\System\dVequzi.exe
  2⤵
  PID:8304
- C:\Windows\System\vvdmRvB.exe
  C:\Windows\System\vvdmRvB.exe
  2⤵
  PID:8328
- C:\Windows\System\lRttLnp.exe
  C:\Windows\System\lRttLnp.exe
  2⤵
  PID:8352
- C:\Windows\System\qwaiLPk.exe
  C:\Windows\System\qwaiLPk.exe
  2⤵
  PID:8388
- C:\Windows\System\qpaZjHZ.exe
  C:\Windows\System\qpaZjHZ.exe
  2⤵
  PID:8416
- C:\Windows\System\sOusZUq.exe
  C:\Windows\System\sOusZUq.exe
  2⤵
  PID:8444
- C:\Windows\System\mPVlHzC.exe
  C:\Windows\System\mPVlHzC.exe
  2⤵
  PID:8472
- C:\Windows\System\nhmnfqd.exe
  C:\Windows\System\nhmnfqd.exe
  2⤵
  PID:8500
- C:\Windows\System\orNiudy.exe
  C:\Windows\System\orNiudy.exe
  2⤵
  PID:8520
- C:\Windows\System\jWvWPrs.exe
  C:\Windows\System\jWvWPrs.exe
  2⤵
  PID:8552
- C:\Windows\System\znXPhvc.exe
  C:\Windows\System\znXPhvc.exe
  2⤵
  PID:8584
- C:\Windows\System\RANggqc.exe
  C:\Windows\System\RANggqc.exe
  2⤵
  PID:8612
- C:\Windows\System\WFrEosU.exe
  C:\Windows\System\WFrEosU.exe
  2⤵
  PID:8628
- C:\Windows\System\eudluLt.exe
  C:\Windows\System\eudluLt.exe
  2⤵
  PID:8660
- C:\Windows\System\QVFVbbo.exe
  C:\Windows\System\QVFVbbo.exe
  2⤵
  PID:8688
- C:\Windows\System\xjIXuwZ.exe
  C:\Windows\System\xjIXuwZ.exe
  2⤵
  PID:8716
- C:\Windows\System\hjMzhIc.exe
  C:\Windows\System\hjMzhIc.exe
  2⤵
  PID:8748
- C:\Windows\System\tcJkHMW.exe
  C:\Windows\System\tcJkHMW.exe
  2⤵
  PID:8772
- C:\Windows\System\iNSNiqA.exe
  C:\Windows\System\iNSNiqA.exe
  2⤵
  PID:8800
- C:\Windows\System\LkNGeHp.exe
  C:\Windows\System\LkNGeHp.exe
  2⤵
  PID:8832
- C:\Windows\System\eTrrvDf.exe
  C:\Windows\System\eTrrvDf.exe
  2⤵
  PID:8864
- C:\Windows\System\WvfdOnW.exe
  C:\Windows\System\WvfdOnW.exe
  2⤵
  PID:8892
- C:\Windows\System\VBOiODr.exe
  C:\Windows\System\VBOiODr.exe
  2⤵
  PID:8928
- C:\Windows\System\bFgYZCF.exe
  C:\Windows\System\bFgYZCF.exe
  2⤵
  PID:8964
- C:\Windows\System\YCqtWMU.exe
  C:\Windows\System\YCqtWMU.exe
  2⤵
  PID:8992
- C:\Windows\System\vvHtOud.exe
  C:\Windows\System\vvHtOud.exe
  2⤵
  PID:9024
- C:\Windows\System\ShQpWcX.exe
  C:\Windows\System\ShQpWcX.exe
  2⤵
  PID:9048
- C:\Windows\System\GvehnAL.exe
  C:\Windows\System\GvehnAL.exe
  2⤵
  PID:9076
- C:\Windows\System\qKAzFGz.exe
  C:\Windows\System\qKAzFGz.exe
  2⤵
  PID:9104
- C:\Windows\System\aEBlUkW.exe
  C:\Windows\System\aEBlUkW.exe
  2⤵
  PID:9132
- C:\Windows\System\DSAZHno.exe
  C:\Windows\System\DSAZHno.exe
  2⤵
  PID:9164
- C:\Windows\System\uxpmgwd.exe
  C:\Windows\System\uxpmgwd.exe
  2⤵
  PID:9200
- C:\Windows\System\jNmebOe.exe
  C:\Windows\System\jNmebOe.exe
  2⤵
  PID:8160
- C:\Windows\System\phBzGOn.exe
  C:\Windows\System\phBzGOn.exe
  2⤵
  PID:8200
- C:\Windows\System\YPgpdIz.exe
  C:\Windows\System\YPgpdIz.exe
  2⤵
  PID:8320
- C:\Windows\System\upTqiwW.exe
  C:\Windows\System\upTqiwW.exe
  2⤵
  PID:8348
- C:\Windows\System\SpyzYxy.exe
  C:\Windows\System\SpyzYxy.exe
  2⤵
  PID:8284
- C:\Windows\System\LiZwioU.exe
  C:\Windows\System\LiZwioU.exe
  2⤵
  PID:8404
- C:\Windows\System\lAXtLHQ.exe
  C:\Windows\System\lAXtLHQ.exe
  2⤵
  PID:8428
- C:\Windows\System\oNTmUMH.exe
  C:\Windows\System\oNTmUMH.exe
  2⤵
  PID:8508
- C:\Windows\System\xYNhrDk.exe
  C:\Windows\System\xYNhrDk.exe
  2⤵
  PID:8604
- C:\Windows\System\alUcqhE.exe
  C:\Windows\System\alUcqhE.exe
  2⤵
  PID:8620
- C:\Windows\System\GeQfxST.exe
  C:\Windows\System\GeQfxST.exe
  2⤵
  PID:8732
- C:\Windows\System\vPeZNTA.exe
  C:\Windows\System\vPeZNTA.exe
  2⤵
  PID:8796
- C:\Windows\System\AjsaKOr.exe
  C:\Windows\System\AjsaKOr.exe
  2⤵
  PID:8844
- C:\Windows\System\cBkExej.exe
  C:\Windows\System\cBkExej.exe
  2⤵
  PID:8944
- C:\Windows\System\GXvGaRa.exe
  C:\Windows\System\GXvGaRa.exe
  2⤵
  PID:8960
- C:\Windows\System\CUiAxPA.exe
  C:\Windows\System\CUiAxPA.exe
  2⤵
  PID:9148
- C:\Windows\System\AwnhMAT.exe
  C:\Windows\System\AwnhMAT.exe
  2⤵
  PID:9188
- C:\Windows\System\qeGeozc.exe
  C:\Windows\System\qeGeozc.exe
  2⤵
  PID:9192
- C:\Windows\System\gYtaAhZ.exe
  C:\Windows\System\gYtaAhZ.exe
  2⤵
  PID:8572
- C:\Windows\System\FMGybXS.exe
  C:\Windows\System\FMGybXS.exe
  2⤵
  PID:8376
- C:\Windows\System\dqKAgsq.exe
  C:\Windows\System\dqKAgsq.exe
  2⤵
  PID:8480
- C:\Windows\System\xXLAIbz.exe
  C:\Windows\System\xXLAIbz.exe
  2⤵
  PID:8644
- C:\Windows\System\LSlwCCp.exe
  C:\Windows\System\LSlwCCp.exe
  2⤵
  PID:9088
- C:\Windows\System\aBwUGJl.exe
  C:\Windows\System\aBwUGJl.exe
  2⤵
  PID:9208
- C:\Windows\System\DdthHkR.exe
  C:\Windows\System\DdthHkR.exe
  2⤵
  PID:8640
- C:\Windows\System\IPxeZhR.exe
  C:\Windows\System\IPxeZhR.exe
  2⤵
  PID:9224
- C:\Windows\System\ogdwWKt.exe
  C:\Windows\System\ogdwWKt.exe
  2⤵
  PID:9244
- C:\Windows\System\sqlyWRP.exe
  C:\Windows\System\sqlyWRP.exe
  2⤵
  PID:9272
- C:\Windows\System\qmYsSIm.exe
  C:\Windows\System\qmYsSIm.exe
  2⤵
  PID:9296
- C:\Windows\System\JmeraXc.exe
  C:\Windows\System\JmeraXc.exe
  2⤵
  PID:9320
- C:\Windows\System\hooTQIP.exe
  C:\Windows\System\hooTQIP.exe
  2⤵
  PID:9352
- C:\Windows\System\SwGOASy.exe
  C:\Windows\System\SwGOASy.exe
  2⤵
  PID:9384
- C:\Windows\System\cnyDKHF.exe
  C:\Windows\System\cnyDKHF.exe
  2⤵
  PID:9404
- C:\Windows\System\PeiGnUj.exe
  C:\Windows\System\PeiGnUj.exe
  2⤵
  PID:9432
- C:\Windows\System\JSqOkbN.exe
  C:\Windows\System\JSqOkbN.exe
  2⤵
  PID:9456
- C:\Windows\System\jwBrvoi.exe
  C:\Windows\System\jwBrvoi.exe
  2⤵
  PID:9484
- C:\Windows\System\CRGXTut.exe
  C:\Windows\System\CRGXTut.exe
  2⤵
  PID:9508
- C:\Windows\System\kIsysYz.exe
  C:\Windows\System\kIsysYz.exe
  2⤵
  PID:9544
- C:\Windows\System\sYfDOZJ.exe
  C:\Windows\System\sYfDOZJ.exe
  2⤵
  PID:9572
- C:\Windows\System\umfuGVK.exe
  C:\Windows\System\umfuGVK.exe
  2⤵
  PID:9596
- C:\Windows\System\fjaGrnB.exe
  C:\Windows\System\fjaGrnB.exe
  2⤵
  PID:9620
- C:\Windows\System\AFBXDJC.exe
  C:\Windows\System\AFBXDJC.exe
  2⤵
  PID:9640
- C:\Windows\System\tSfIsqr.exe
  C:\Windows\System\tSfIsqr.exe
  2⤵
  PID:9668
- C:\Windows\System\WDdgSZb.exe
  C:\Windows\System\WDdgSZb.exe
  2⤵
  PID:9684
- C:\Windows\System\TkSrmhI.exe
  C:\Windows\System\TkSrmhI.exe
  2⤵
  PID:9716
- C:\Windows\System\kheQlAF.exe
  C:\Windows\System\kheQlAF.exe
  2⤵
  PID:9740
- C:\Windows\System\XuUADha.exe
  C:\Windows\System\XuUADha.exe
  2⤵
  PID:9764
- C:\Windows\System\JDggWeU.exe
  C:\Windows\System\JDggWeU.exe
  2⤵
  PID:9800
- C:\Windows\System\QAINvbi.exe
  C:\Windows\System\QAINvbi.exe
  2⤵
  PID:9832
- C:\Windows\System\NEGMvDb.exe
  C:\Windows\System\NEGMvDb.exe
  2⤵
  PID:9856
- C:\Windows\System\bfAaajw.exe
  C:\Windows\System\bfAaajw.exe
  2⤵
  PID:9888
- C:\Windows\System\ZUOOWws.exe
  C:\Windows\System\ZUOOWws.exe
  2⤵
  PID:9916
- C:\Windows\System\JHHdlmO.exe
  C:\Windows\System\JHHdlmO.exe
  2⤵
  PID:9944
- C:\Windows\System\sgfnedM.exe
  C:\Windows\System\sgfnedM.exe
  2⤵
  PID:9976
- C:\Windows\System\nYomvSU.exe
  C:\Windows\System\nYomvSU.exe
  2⤵
  PID:10012
- C:\Windows\System\dBtGyks.exe
  C:\Windows\System\dBtGyks.exe
  2⤵
  PID:10036
- C:\Windows\System\VVwRAab.exe
  C:\Windows\System\VVwRAab.exe
  2⤵
  PID:10064
- C:\Windows\System\jTodrRd.exe
  C:\Windows\System\jTodrRd.exe
  2⤵
  PID:10100
- C:\Windows\System\kFFaIfp.exe
  C:\Windows\System\kFFaIfp.exe
  2⤵
  PID:10132
- C:\Windows\System\yXNUrMC.exe
  C:\Windows\System\yXNUrMC.exe
  2⤵
  PID:10164
- C:\Windows\System\kFhiDJO.exe
  C:\Windows\System\kFhiDJO.exe
  2⤵
  PID:10192
- C:\Windows\System\wLzteee.exe
  C:\Windows\System\wLzteee.exe
  2⤵
  PID:10212
- C:\Windows\System\UwdTwSL.exe
  C:\Windows\System\UwdTwSL.exe
  2⤵
  PID:10232
- C:\Windows\System\SJFGTWf.exe
  C:\Windows\System\SJFGTWf.exe
  2⤵
  PID:8852
- C:\Windows\System\QTBweyi.exe
  C:\Windows\System\QTBweyi.exe
  2⤵
  PID:8764
- C:\Windows\System\qhnGyJj.exe
  C:\Windows\System\qhnGyJj.exe
  2⤵
  PID:9312
- C:\Windows\System\oExtXxo.exe
  C:\Windows\System\oExtXxo.exe
  2⤵
  PID:9340
- C:\Windows\System\cyQzomT.exe
  C:\Windows\System\cyQzomT.exe
  2⤵
  PID:9304
- C:\Windows\System\knFCHOl.exe
  C:\Windows\System\knFCHOl.exe
  2⤵
  PID:9392
- C:\Windows\System\FaBitLp.exe
  C:\Windows\System\FaBitLp.exe
  2⤵
  PID:9528
- C:\Windows\System\gvznAWp.exe
  C:\Windows\System\gvznAWp.exe
  2⤵
  PID:9468
- C:\Windows\System\PSRsETu.exe
  C:\Windows\System\PSRsETu.exe
  2⤵
  PID:9540
- C:\Windows\System\ecDpPau.exe
  C:\Windows\System\ecDpPau.exe
  2⤵
  PID:9676
- C:\Windows\System\Wfiiifj.exe
  C:\Windows\System\Wfiiifj.exe
  2⤵
  PID:9664
- C:\Windows\System\isDhznC.exe
  C:\Windows\System\isDhznC.exe
  2⤵
  PID:9760
- C:\Windows\System\LpNdvKL.exe
  C:\Windows\System\LpNdvKL.exe
  2⤵
  PID:9828
- C:\Windows\System\VVQLxZv.exe
  C:\Windows\System\VVQLxZv.exe
  2⤵
  PID:9972
- C:\Windows\System\dvWScXI.exe
  C:\Windows\System\dvWScXI.exe
  2⤵
  PID:10028
- C:\Windows\System\jbdSyvl.exe
  C:\Windows\System\jbdSyvl.exe
  2⤵
  PID:10084
- C:\Windows\System\XuYVVge.exe
  C:\Windows\System\XuYVVge.exe
  2⤵
  PID:10184
- C:\Windows\System\eoTYCza.exe
  C:\Windows\System\eoTYCza.exe
  2⤵
  PID:8920
- C:\Windows\System\qPMKekv.exe
  C:\Windows\System\qPMKekv.exe
  2⤵
  PID:9364
- C:\Windows\System\OGLJZHS.exe
  C:\Windows\System\OGLJZHS.exe
  2⤵
  PID:9496
- C:\Windows\System\MUMZaGX.exe
  C:\Windows\System\MUMZaGX.exe
  2⤵
  PID:8780
- C:\Windows\System\WIwOlVh.exe
  C:\Windows\System\WIwOlVh.exe
  2⤵
  PID:9592
- C:\Windows\System\RNhDvAt.exe
  C:\Windows\System\RNhDvAt.exe
  2⤵
  PID:10060
- C:\Windows\System\KudDgns.exe
  C:\Windows\System\KudDgns.exe
  2⤵
  PID:9788
- C:\Windows\System\NNNbgsG.exe
  C:\Windows\System\NNNbgsG.exe
  2⤵
  PID:9232
- C:\Windows\System\FxBcyMj.exe
  C:\Windows\System\FxBcyMj.exe
  2⤵
  PID:10128
- C:\Windows\System\jutveot.exe
  C:\Windows\System\jutveot.exe
  2⤵
  PID:10264
- C:\Windows\System\oJgJMUX.exe
  C:\Windows\System\oJgJMUX.exe
  2⤵
  PID:10300
- C:\Windows\System\nsPqBFE.exe
  C:\Windows\System\nsPqBFE.exe
  2⤵
  PID:10324
- C:\Windows\System\geBNZEj.exe
  C:\Windows\System\geBNZEj.exe
  2⤵
  PID:10352
- C:\Windows\System\ndVVQNJ.exe
  C:\Windows\System\ndVVQNJ.exe
  2⤵
  PID:10384
- C:\Windows\System\NRVClHb.exe
  C:\Windows\System\NRVClHb.exe
  2⤵
  PID:10416
- C:\Windows\System\zXdOenY.exe
  C:\Windows\System\zXdOenY.exe
  2⤵
  PID:10456
- C:\Windows\System\UcoVhvN.exe
  C:\Windows\System\UcoVhvN.exe
  2⤵
  PID:10484
- C:\Windows\System\mmWoZwa.exe
  C:\Windows\System\mmWoZwa.exe
  2⤵
  PID:10516
- C:\Windows\System\RTzgTNw.exe
  C:\Windows\System\RTzgTNw.exe
  2⤵
  PID:10548
- C:\Windows\System\KSfLIUS.exe
  C:\Windows\System\KSfLIUS.exe
  2⤵
  PID:10568
- C:\Windows\System\NYbGFuI.exe
  C:\Windows\System\NYbGFuI.exe
  2⤵
  PID:10588
- C:\Windows\System\sCisuZU.exe
  C:\Windows\System\sCisuZU.exe
  2⤵
  PID:10624
- C:\Windows\System\lIkVJeZ.exe
  C:\Windows\System\lIkVJeZ.exe
  2⤵
  PID:10652
- C:\Windows\System\RPpeDdX.exe
  C:\Windows\System\RPpeDdX.exe
  2⤵
  PID:10684
- C:\Windows\System\pohKpQK.exe
  C:\Windows\System\pohKpQK.exe
  2⤵
  PID:10712
- C:\Windows\System\HaPBHDS.exe
  C:\Windows\System\HaPBHDS.exe
  2⤵
  PID:10748
- C:\Windows\System\fucqWOJ.exe
  C:\Windows\System\fucqWOJ.exe
  2⤵
  PID:10780
- C:\Windows\System\VHoeFYr.exe
  C:\Windows\System\VHoeFYr.exe
  2⤵
  PID:10824
- C:\Windows\System\EmHefIK.exe
  C:\Windows\System\EmHefIK.exe
  2⤵
  PID:10844
- C:\Windows\System\ZnUhxBs.exe
  C:\Windows\System\ZnUhxBs.exe
  2⤵
  PID:10880
- C:\Windows\System\EupJPHJ.exe
  C:\Windows\System\EupJPHJ.exe
  2⤵
  PID:10916
- C:\Windows\System\IbowVFm.exe
  C:\Windows\System\IbowVFm.exe
  2⤵
  PID:10952
- C:\Windows\System\pvbVNid.exe
  C:\Windows\System\pvbVNid.exe
  2⤵
  PID:10976
- C:\Windows\System\qOyPrlM.exe
  C:\Windows\System\qOyPrlM.exe
  2⤵
  PID:10992
- C:\Windows\System\sFmIQqz.exe
  C:\Windows\System\sFmIQqz.exe
  2⤵
  PID:11024
- C:\Windows\System\xBuULMI.exe
  C:\Windows\System\xBuULMI.exe
  2⤵
  PID:11060
- C:\Windows\System\AisHZOM.exe
  C:\Windows\System\AisHZOM.exe
  2⤵
  PID:11088
- C:\Windows\System\uvwTodZ.exe
  C:\Windows\System\uvwTodZ.exe
  2⤵
  PID:11104
- C:\Windows\System\kpREntG.exe
  C:\Windows\System\kpREntG.exe
  2⤵
  PID:11136
- C:\Windows\System\gdKcUbi.exe
  C:\Windows\System\gdKcUbi.exe
  2⤵
  PID:11160
- C:\Windows\System\gOZXlLk.exe
  C:\Windows\System\gOZXlLk.exe
  2⤵
  PID:11180
- C:\Windows\System\Jwsctvq.exe
  C:\Windows\System\Jwsctvq.exe
  2⤵
  PID:11200
- C:\Windows\System\OYqvwUy.exe
  C:\Windows\System\OYqvwUy.exe
  2⤵
  PID:11236
- C:\Windows\System\zkSeCkP.exe
  C:\Windows\System\zkSeCkP.exe
  2⤵
  PID:9492
- C:\Windows\System\uYLNAFM.exe
  C:\Windows\System\uYLNAFM.exe
  2⤵
  PID:9872
- C:\Windows\System\mvTFhxQ.exe
  C:\Windows\System\mvTFhxQ.exe
  2⤵
  PID:10144
- C:\Windows\System\TkSodcH.exe
  C:\Windows\System\TkSodcH.exe
  2⤵
  PID:10312
- C:\Windows\System\lRmCwqs.exe
  C:\Windows\System\lRmCwqs.exe
  2⤵
  PID:10404
- C:\Windows\System\TWjglpu.exe
  C:\Windows\System\TWjglpu.exe
  2⤵
  PID:10440
- C:\Windows\System\BWhrCHd.exe
  C:\Windows\System\BWhrCHd.exe
  2⤵
  PID:10584
- C:\Windows\System\sUrMzjl.exe
  C:\Windows\System\sUrMzjl.exe
  2⤵
  PID:10636
- C:\Windows\System\klsaXYx.exe
  C:\Windows\System\klsaXYx.exe
  2⤵
  PID:10640
- C:\Windows\System\ZcgRIRg.exe
  C:\Windows\System\ZcgRIRg.exe
  2⤵
  PID:10736
- C:\Windows\System\PGroFXw.exe
  C:\Windows\System\PGroFXw.exe
  2⤵
  PID:10852
- C:\Windows\System\yjeEcdH.exe
  C:\Windows\System\yjeEcdH.exe
  2⤵
  PID:10872
- C:\Windows\System\aCDuyUc.exe
  C:\Windows\System\aCDuyUc.exe
  2⤵
  PID:10960
- C:\Windows\System\oWMcqZp.exe
  C:\Windows\System\oWMcqZp.exe
  2⤵
  PID:11040
- C:\Windows\System\gPDeDZX.exe
  C:\Windows\System\gPDeDZX.exe
  2⤵
  PID:11096
- C:\Windows\System\GlfzAyo.exe
  C:\Windows\System\GlfzAyo.exe
  2⤵
  PID:11224
- C:\Windows\System\pFkNyBn.exe
  C:\Windows\System\pFkNyBn.exe
  2⤵
  PID:11248
- C:\Windows\System\HfWtvsz.exe
  C:\Windows\System\HfWtvsz.exe
  2⤵
  PID:9556
- C:\Windows\System\fhEYeih.exe
  C:\Windows\System\fhEYeih.exe
  2⤵
  PID:10244
- C:\Windows\System\POCtKsd.exe
  C:\Windows\System\POCtKsd.exe
  2⤵
  PID:10500
- C:\Windows\System\JMneaaQ.exe
  C:\Windows\System\JMneaaQ.exe
  2⤵
  PID:10672
- C:\Windows\System\WGdFUla.exe
  C:\Windows\System\WGdFUla.exe
  2⤵
  PID:10756
- C:\Windows\System\dluoNQz.exe
  C:\Windows\System\dluoNQz.exe
  2⤵
  PID:10896
- C:\Windows\System\nwedhSz.exe
  C:\Windows\System\nwedhSz.exe
  2⤵
  PID:11080
- C:\Windows\System\tTCjpEC.exe
  C:\Windows\System\tTCjpEC.exe
  2⤵
  PID:11152
- C:\Windows\System\AhskhNy.exe
  C:\Windows\System\AhskhNy.exe
  2⤵
  PID:10360
- C:\Windows\System\NnBTxXZ.exe
  C:\Windows\System\NnBTxXZ.exe
  2⤵
  PID:10696
- C:\Windows\System\YUTkLYZ.exe
  C:\Windows\System\YUTkLYZ.exe
  2⤵
  PID:11192
- C:\Windows\System\fQDUrge.exe
  C:\Windows\System\fQDUrge.exe
  2⤵
  PID:11220
- C:\Windows\System\NbwxSyK.exe
  C:\Windows\System\NbwxSyK.exe
  2⤵
  PID:11036
- C:\Windows\System\kyZvDbb.exe
  C:\Windows\System\kyZvDbb.exe
  2⤵
  PID:11288
- C:\Windows\System\oPAnPsI.exe
  C:\Windows\System\oPAnPsI.exe
  2⤵
  PID:11316
- C:\Windows\System\gkhpBRt.exe
  C:\Windows\System\gkhpBRt.exe
  2⤵
  PID:11344
- C:\Windows\System\ylfXzFb.exe
  C:\Windows\System\ylfXzFb.exe
  2⤵
  PID:11372
- C:\Windows\System\OUZQFVy.exe
  C:\Windows\System\OUZQFVy.exe
  2⤵
  PID:11412
- C:\Windows\System\fTMImNc.exe
  C:\Windows\System\fTMImNc.exe
  2⤵
  PID:11440
- C:\Windows\System\hMwaSaQ.exe
  C:\Windows\System\hMwaSaQ.exe
  2⤵
  PID:11468
- C:\Windows\System\PaRDImu.exe
  C:\Windows\System\PaRDImu.exe
  2⤵
  PID:11496
- C:\Windows\System\aIFRfkD.exe
  C:\Windows\System\aIFRfkD.exe
  2⤵
  PID:11524
- C:\Windows\System\mHdyvsu.exe
  C:\Windows\System\mHdyvsu.exe
  2⤵
  PID:11552
- C:\Windows\System\juxuVwP.exe
  C:\Windows\System\juxuVwP.exe
  2⤵
  PID:11580
- C:\Windows\System\IPBmIDW.exe
  C:\Windows\System\IPBmIDW.exe
  2⤵
  PID:11608
- C:\Windows\System\xQavCAz.exe
  C:\Windows\System\xQavCAz.exe
  2⤵
  PID:11640
- C:\Windows\System\oFQFjHJ.exe
  C:\Windows\System\oFQFjHJ.exe
  2⤵
  PID:11668
- C:\Windows\System\dHgLCGq.exe
  C:\Windows\System\dHgLCGq.exe
  2⤵
  PID:11684
- C:\Windows\System\orDAGUz.exe
  C:\Windows\System\orDAGUz.exe
  2⤵
  PID:11712
- C:\Windows\System\dpbTwQe.exe
  C:\Windows\System\dpbTwQe.exe
  2⤵
  PID:11740
- C:\Windows\System\BlHoOIz.exe
  C:\Windows\System\BlHoOIz.exe
  2⤵
  PID:11768
- C:\Windows\System\DZmejCj.exe
  C:\Windows\System\DZmejCj.exe
  2⤵
  PID:11796
- C:\Windows\System\tspiGZX.exe
  C:\Windows\System\tspiGZX.exe
  2⤵
  PID:11824
- C:\Windows\System\flbhHdC.exe
  C:\Windows\System\flbhHdC.exe
  2⤵
  PID:11840
- C:\Windows\System\aPqxPcS.exe
  C:\Windows\System\aPqxPcS.exe
  2⤵
  PID:11872
- C:\Windows\System\gryilSD.exe
  C:\Windows\System\gryilSD.exe
  2⤵
  PID:11904
- C:\Windows\System\YAVgQAu.exe
  C:\Windows\System\YAVgQAu.exe
  2⤵
  PID:11928
- C:\Windows\System\ORFdvfi.exe
  C:\Windows\System\ORFdvfi.exe
  2⤵
  PID:11956
- C:\Windows\System\KieSIrx.exe
  C:\Windows\System\KieSIrx.exe
  2⤵
  PID:11984
- C:\Windows\System\wNpdwox.exe
  C:\Windows\System\wNpdwox.exe
  2⤵
  PID:12016
- C:\Windows\System\cxyOIEh.exe
  C:\Windows\System\cxyOIEh.exe
  2⤵
  PID:12040
- C:\Windows\System\xDyrtSh.exe
  C:\Windows\System\xDyrtSh.exe
  2⤵
  PID:12064
- C:\Windows\System\eLhlgYl.exe
  C:\Windows\System\eLhlgYl.exe
  2⤵
  PID:12100
- C:\Windows\System\KwdzQdM.exe
  C:\Windows\System\KwdzQdM.exe
  2⤵
  PID:12132
- C:\Windows\System\VcpPrrW.exe
  C:\Windows\System\VcpPrrW.exe
  2⤵
  PID:12164
- C:\Windows\System\wzftuCo.exe
  C:\Windows\System\wzftuCo.exe
  2⤵
  PID:12180
- C:\Windows\System\kLtETPv.exe
  C:\Windows\System\kLtETPv.exe
  2⤵
  PID:12204
- C:\Windows\System\Hyfyikh.exe
  C:\Windows\System\Hyfyikh.exe
  2⤵
  PID:12236
- C:\Windows\System\cHiuCXS.exe
  C:\Windows\System\cHiuCXS.exe
  2⤵
  PID:12264
- C:\Windows\System\phjSTqG.exe
  C:\Windows\System\phjSTqG.exe
  2⤵
  PID:10776
- C:\Windows\System\RahDnCt.exe
  C:\Windows\System\RahDnCt.exe
  2⤵
  PID:11304
- C:\Windows\System\BQQyfUA.exe
  C:\Windows\System\BQQyfUA.exe
  2⤵
  PID:11396
- C:\Windows\System\JfYKJtY.exe
  C:\Windows\System\JfYKJtY.exe
  2⤵
  PID:11480
- C:\Windows\System\ncqnLZw.exe
  C:\Windows\System\ncqnLZw.exe
  2⤵
  PID:11536
- C:\Windows\System\REKxtHB.exe
  C:\Windows\System\REKxtHB.exe
  2⤵
  PID:11620
- C:\Windows\System\uFfseiU.exe
  C:\Windows\System\uFfseiU.exe
  2⤵
  PID:11680
- C:\Windows\System\jBQOrty.exe
  C:\Windows\System\jBQOrty.exe
  2⤵
  PID:11728
- C:\Windows\System\ptxkcVb.exe
  C:\Windows\System\ptxkcVb.exe
  2⤵
  PID:11812
- C:\Windows\System\mNwQJsz.exe
  C:\Windows\System\mNwQJsz.exe
  2⤵
  PID:11880
- C:\Windows\System\FPTtyHl.exe
  C:\Windows\System\FPTtyHl.exe
  2⤵
  PID:11920
- C:\Windows\System\dmEhOzx.exe
  C:\Windows\System\dmEhOzx.exe
  2⤵
  PID:12012
- C:\Windows\System\hhPsLCY.exe
  C:\Windows\System\hhPsLCY.exe
  2⤵
  PID:12060
- C:\Windows\System\SusuzXV.exe
  C:\Windows\System\SusuzXV.exe
  2⤵
  PID:12124
- C:\Windows\System\uJJvRsI.exe
  C:\Windows\System\uJJvRsI.exe
  2⤵
  PID:12196
- C:\Windows\System\wFQjvie.exe
  C:\Windows\System\wFQjvie.exe
  2⤵
  PID:12276
- C:\Windows\System\UnEjxuR.exe
  C:\Windows\System\UnEjxuR.exe
  2⤵
  PID:11340
- C:\Windows\System\lhyKbNR.exe
  C:\Windows\System\lhyKbNR.exe
  2⤵
  PID:11464
- C:\Windows\System\mRUgqCQ.exe
  C:\Windows\System\mRUgqCQ.exe
  2⤵
  PID:11636
- C:\Windows\System\IdXOXXL.exe
  C:\Windows\System\IdXOXXL.exe
  2⤵
  PID:11808
- C:\Windows\System\GNyRzcs.exe
  C:\Windows\System\GNyRzcs.exe
  2⤵
  PID:11980
- C:\Windows\System\IBWmSgS.exe
  C:\Windows\System\IBWmSgS.exe
  2⤵
  PID:12144
- C:\Windows\System\lnHzAZt.exe
  C:\Windows\System\lnHzAZt.exe
  2⤵
  PID:11132
- C:\Windows\System\xmlIexj.exe
  C:\Windows\System\xmlIexj.exe
  2⤵
  PID:11600
- C:\Windows\System\uIBTMHl.exe
  C:\Windows\System\uIBTMHl.exe
  2⤵
  PID:11968
- C:\Windows\System\LLVVCZK.exe
  C:\Windows\System\LLVVCZK.exe
  2⤵
  PID:12272
- C:\Windows\System\BUmhtqB.exe
  C:\Windows\System\BUmhtqB.exe
  2⤵
  PID:12228
- C:\Windows\System\TiGVFdv.exe
  C:\Windows\System\TiGVFdv.exe
  2⤵
  PID:12308
- C:\Windows\System\LoYBBld.exe
  C:\Windows\System\LoYBBld.exe
  2⤵
  PID:12336
- C:\Windows\System\MThVIJj.exe
  C:\Windows\System\MThVIJj.exe
  2⤵
  PID:12364
- C:\Windows\System\jGVzBgY.exe
  C:\Windows\System\jGVzBgY.exe
  2⤵
  PID:12392
- C:\Windows\System\AjjeuMR.exe
  C:\Windows\System\AjjeuMR.exe
  2⤵
  PID:12408
- C:\Windows\System\AqKbsTx.exe
  C:\Windows\System\AqKbsTx.exe
  2⤵
  PID:12436
- C:\Windows\System\AbXFvnu.exe
  C:\Windows\System\AbXFvnu.exe
  2⤵
  PID:12460
- C:\Windows\System\Wewfsqj.exe
  C:\Windows\System\Wewfsqj.exe
  2⤵
  PID:12480
- C:\Windows\System\Xyevkxw.exe
  C:\Windows\System\Xyevkxw.exe
  2⤵
  PID:12508
- C:\Windows\System\gnLslkA.exe
  C:\Windows\System\gnLslkA.exe
  2⤵
  PID:12524
- C:\Windows\System\KfpNCcY.exe
  C:\Windows\System\KfpNCcY.exe
  2⤵
  PID:12540
- C:\Windows\System\CPVTmjB.exe
  C:\Windows\System\CPVTmjB.exe
  2⤵
  PID:12564
- C:\Windows\System\gyQTSXc.exe
  C:\Windows\System\gyQTSXc.exe
  2⤵
  PID:12592
- C:\Windows\System\RNDDgJC.exe
  C:\Windows\System\RNDDgJC.exe
  2⤵
  PID:12616
- C:\Windows\System\Fncsuwv.exe
  C:\Windows\System\Fncsuwv.exe
  2⤵
  PID:12644
- C:\Windows\System\IXJEjyJ.exe
  C:\Windows\System\IXJEjyJ.exe
  2⤵
  PID:12672
- C:\Windows\System\iMJwQJi.exe
  C:\Windows\System\iMJwQJi.exe
  2⤵
  PID:12688
- C:\Windows\System\cZvbQFw.exe
  C:\Windows\System\cZvbQFw.exe
  2⤵
  PID:12716
- C:\Windows\System\YAKYAAT.exe
  C:\Windows\System\YAKYAAT.exe
  2⤵
  PID:12744
- C:\Windows\System\SdviCpd.exe
  C:\Windows\System\SdviCpd.exe
  2⤵
  PID:12784
- C:\Windows\System\iOITzXE.exe
  C:\Windows\System\iOITzXE.exe
  2⤵
  PID:12812
- C:\Windows\System\EWgbgmU.exe
  C:\Windows\System\EWgbgmU.exe
  2⤵
  PID:12836
- C:\Windows\System\zdJPgob.exe
  C:\Windows\System\zdJPgob.exe
  2⤵
  PID:12864
- C:\Windows\System\cmNEkpX.exe
  C:\Windows\System\cmNEkpX.exe
  2⤵
  PID:12900
- C:\Windows\System\lSieuuj.exe
  C:\Windows\System\lSieuuj.exe
  2⤵
  PID:12936
- C:\Windows\System\cuDFrVC.exe
  C:\Windows\System\cuDFrVC.exe
  2⤵
  PID:12976
- C:\Windows\System\TLXxPZC.exe
  C:\Windows\System\TLXxPZC.exe
  2⤵
  PID:13004
- C:\Windows\System\gZbZhPr.exe
  C:\Windows\System\gZbZhPr.exe
  2⤵
  PID:13024
- C:\Windows\System\rwtawQt.exe
  C:\Windows\System\rwtawQt.exe
  2⤵
  PID:13056
- C:\Windows\System\DmCvjRF.exe
  C:\Windows\System\DmCvjRF.exe
  2⤵
  PID:13080
- C:\Windows\System\nbccRCd.exe
  C:\Windows\System\nbccRCd.exe
  2⤵
  PID:13112
- C:\Windows\System\tLwebTc.exe
  C:\Windows\System\tLwebTc.exe
  2⤵
  PID:13140
- C:\Windows\System\gUhfpPt.exe
  C:\Windows\System\gUhfpPt.exe
  2⤵
  PID:13176
- C:\Windows\System\uESIsPH.exe
  C:\Windows\System\uESIsPH.exe
  2⤵
  PID:13208
- C:\Windows\System\PiAbLfu.exe
  C:\Windows\System\PiAbLfu.exe
  2⤵
  PID:13232
- C:\Windows\System\qibpijw.exe
  C:\Windows\System\qibpijw.exe
  2⤵
  PID:13268
- C:\Windows\System\PeGnbzu.exe
  C:\Windows\System\PeGnbzu.exe
  2⤵
  PID:13300
- C:\Windows\System\AnBjrwj.exe
  C:\Windows\System\AnBjrwj.exe
  2⤵
  PID:12328
- C:\Windows\System\slPFUDA.exe
  C:\Windows\System\slPFUDA.exe
  2⤵
  PID:12360
- C:\Windows\System\dsLDIXb.exe
  C:\Windows\System\dsLDIXb.exe
  2⤵
  PID:12448
- C:\Windows\System\taoQwrL.exe
  C:\Windows\System\taoQwrL.exe
  2⤵
  PID:12516
- C:\Windows\System\KACWrun.exe
  C:\Windows\System\KACWrun.exe
  2⤵
  PID:12560
- C:\Windows\System\xQWiZAw.exe
  C:\Windows\System\xQWiZAw.exe
  2⤵
  PID:12636
- C:\Windows\System\mYtotDd.exe
  C:\Windows\System\mYtotDd.exe
  2⤵
  PID:12764
- C:\Windows\System\IqaeEIX.exe
  C:\Windows\System\IqaeEIX.exe
  2⤵
  PID:12776
- C:\Windows\System\UkdIxwS.exe
  C:\Windows\System\UkdIxwS.exe
  2⤵
  PID:12856
- C:\Windows\System\UYlKOGT.exe
  C:\Windows\System\UYlKOGT.exe
  2⤵
  PID:12876
- C:\Windows\System\hmwkUvF.exe
  C:\Windows\System\hmwkUvF.exe
  2⤵
  PID:12916
- C:\Windows\System\roTZCZm.exe
  C:\Windows\System\roTZCZm.exe
  2⤵
  PID:13012
- C:\Windows\System\DgOGYTq.exe
  C:\Windows\System\DgOGYTq.exe
  2⤵
  PID:13044
- C:\Windows\System\iaaFYel.exe
  C:\Windows\System\iaaFYel.exe
  2⤵
  PID:13104
- C:\Windows\System\hgmbPCe.exe
  C:\Windows\System\hgmbPCe.exe
  2⤵
  PID:13192
- C:\Windows\System\lqrClho.exe
  C:\Windows\System\lqrClho.exe
  2⤵
  PID:13280
- C:\Windows\System\CAVnnYb.exe
  C:\Windows\System\CAVnnYb.exe
  2⤵
  PID:13292
- C:\Windows\System\ZfFxHmb.exe
  C:\Windows\System\ZfFxHmb.exe
  2⤵
  PID:12352
- C:\Windows\System\AOhSrwA.exe
  C:\Windows\System\AOhSrwA.exe
  2⤵
  PID:12492
- C:\Windows\System\ICAtldx.exe
  C:\Windows\System\ICAtldx.exe
  2⤵
  PID:12536
- C:\Windows\System\VDGUZDC.exe
  C:\Windows\System\VDGUZDC.exe
  2⤵
  PID:12756
- C:\Windows\System\qeAzmPF.exe
  C:\Windows\System\qeAzmPF.exe
  2⤵
  PID:12948
- C:\Windows\System\bUyLTKu.exe
  C:\Windows\System\bUyLTKu.exe
  2⤵
  PID:13036
- C:\Windows\System\nrjAyMb.exe
  C:\Windows\System\nrjAyMb.exe
  2⤵
  PID:13132
- C:\Windows\System\ixvsGto.exe
  C:\Windows\System\ixvsGto.exe
  2⤵
  PID:12428
- C:\Windows\System\JUyzVJF.exe
  C:\Windows\System\JUyzVJF.exe
  2⤵
  PID:12712
- C:\Windows\System\ACfKwRq.exe
  C:\Windows\System\ACfKwRq.exe
  2⤵
  PID:12828
- C:\Windows\System\XvXwRXw.exe
  C:\Windows\System\XvXwRXw.exe
  2⤵
  PID:13320
- C:\Windows\System\wkhWSaR.exe
  C:\Windows\System\wkhWSaR.exe
  2⤵
  PID:13340
- C:\Windows\System\oMrPUgS.exe
  C:\Windows\System\oMrPUgS.exe
  2⤵
  PID:13368
- C:\Windows\System\oFALUTf.exe
  C:\Windows\System\oFALUTf.exe
  2⤵
  PID:13396
- C:\Windows\System\TSMpwsD.exe
  C:\Windows\System\TSMpwsD.exe
  2⤵
  PID:13412
- C:\Windows\System\fAADdKo.exe
  C:\Windows\System\fAADdKo.exe
  2⤵
  PID:13436
- C:\Windows\System\qhRctky.exe
  C:\Windows\System\qhRctky.exe
  2⤵
  PID:13456
- C:\Windows\System\cWSgoMS.exe
  C:\Windows\System\cWSgoMS.exe
  2⤵
  PID:13484
- C:\Windows\System\KDtVvkw.exe
  C:\Windows\System\KDtVvkw.exe
  2⤵
  PID:13516
- C:\Windows\System\BIxKIvi.exe
  C:\Windows\System\BIxKIvi.exe
  2⤵
  PID:13552
- C:\Windows\System\PHRgHvk.exe
  C:\Windows\System\PHRgHvk.exe
  2⤵
  PID:13588
- C:\Windows\System\HmdjPCw.exe
  C:\Windows\System\HmdjPCw.exe
  2⤵
  PID:13612
- C:\Windows\System\wVQwfEI.exe
  C:\Windows\System\wVQwfEI.exe
  2⤵
  PID:13632
- C:\Windows\System\uaNTsTr.exe
  C:\Windows\System\uaNTsTr.exe
  2⤵
  PID:13652
- C:\Windows\System\sIraqkP.exe
  C:\Windows\System\sIraqkP.exe
  2⤵
  PID:13680
- C:\Windows\System\gHWtuTW.exe
  C:\Windows\System\gHWtuTW.exe
  2⤵
  PID:13696
- C:\Windows\System\iSOjawC.exe
  C:\Windows\System\iSOjawC.exe
  2⤵
  PID:13724
- C:\Windows\System\SfJhJOr.exe
  C:\Windows\System\SfJhJOr.exe
  2⤵
  PID:13748
- C:\Windows\System\euXHMVX.exe
  C:\Windows\System\euXHMVX.exe
  2⤵
  PID:13796
- C:\Windows\System\ojHnluc.exe
  C:\Windows\System\ojHnluc.exe
  2⤵
  PID:13820
- C:\Windows\System\cXolmrY.exe
  C:\Windows\System\cXolmrY.exe
  2⤵
  PID:13848
- C:\Windows\System\KDhxSRU.exe
  C:\Windows\System\KDhxSRU.exe
  2⤵
  PID:13876
- C:\Windows\System\ieckkJG.exe
  C:\Windows\System\ieckkJG.exe
  2⤵
  PID:13908
- C:\Windows\System\QphKwSP.exe
  C:\Windows\System\QphKwSP.exe
  2⤵
  PID:13944
- C:\Windows\System\kVrWdQq.exe
  C:\Windows\System\kVrWdQq.exe
  2⤵
  PID:13972
- C:\Windows\System\McAXMaT.exe
  C:\Windows\System\McAXMaT.exe
  2⤵
  PID:13992
- C:\Windows\System\pItlPJn.exe
  C:\Windows\System\pItlPJn.exe
  2⤵
  PID:14020
- C:\Windows\System\LIIIKWn.exe
  C:\Windows\System\LIIIKWn.exe
  2⤵
  PID:14052
- C:\Windows\System\XOhajBs.exe
  C:\Windows\System\XOhajBs.exe
  2⤵
  PID:14080
- C:\Windows\System\GdyxAyf.exe
  C:\Windows\System\GdyxAyf.exe
  2⤵
  PID:14104
- C:\Windows\System\ttniKgX.exe
  C:\Windows\System\ttniKgX.exe
  2⤵
  PID:14128
- C:\Windows\System\zFxuUEs.exe
  C:\Windows\System\zFxuUEs.exe
  2⤵
  PID:14152
- C:\Windows\System\pGvEXnR.exe
  C:\Windows\System\pGvEXnR.exe
  2⤵
  PID:14172
- C:\Windows\System\KPDTRhX.exe
  C:\Windows\System\KPDTRhX.exe
  2⤵
  PID:14212
- C:\Windows\System\ZkZCyYM.exe
  C:\Windows\System\ZkZCyYM.exe
  2⤵
  PID:14240
- C:\Windows\System\WsiCput.exe
  C:\Windows\System\WsiCput.exe
  2⤵
  PID:14264
- C:\Windows\System\BQQERMG.exe
  C:\Windows\System\BQQERMG.exe
  2⤵
  PID:14300
- C:\Windows\System\zRsCNtL.exe
  C:\Windows\System\zRsCNtL.exe
  2⤵
  PID:13308
- C:\Windows\System\yxZuZNc.exe
  C:\Windows\System\yxZuZNc.exe
  2⤵
  PID:13352
- C:\Windows\System\RmfNvEp.exe
  C:\Windows\System\RmfNvEp.exe
  2⤵
  PID:13380
- C:\Windows\System\jGrYkiD.exe
  C:\Windows\System\jGrYkiD.exe
  2⤵
  PID:13408
- C:\Windows\System\YKtQbcU.exe
  C:\Windows\System\YKtQbcU.exe
  2⤵
  PID:13448
- C:\Windows\System\KkrILIK.exe
  C:\Windows\System\KkrILIK.exe
  2⤵
  PID:13540
- C:\Windows\System\QnGToAK.exe
  C:\Windows\System\QnGToAK.exe
  2⤵
  PID:13608
- C:\Windows\System\qOJcHfX.exe
  C:\Windows\System\qOJcHfX.exe
  2⤵
  PID:13692
- C:\Windows\System\irJUUib.exe
  C:\Windows\System\irJUUib.exe
  2⤵
  PID:13780
- C:\Windows\System\gBpPQYh.exe
  C:\Windows\System\gBpPQYh.exe
  2⤵
  PID:13760
- C:\Windows\System\ZGKAABA.exe
  C:\Windows\System\ZGKAABA.exe
  2⤵
  PID:13896
- C:\Windows\System\UzRjejZ.exe
  C:\Windows\System\UzRjejZ.exe
  2⤵
  PID:13980
- C:\Windows\System\MhguYvi.exe
  C:\Windows\System\MhguYvi.exe
  2⤵
  PID:14000
- C:\Windows\System\fCRyrmw.exe
  C:\Windows\System\fCRyrmw.exe
  2⤵
  PID:14096
- C:\Windows\System\VsSWybW.exe
  C:\Windows\System\VsSWybW.exe
  2⤵
  PID:14076
- C:\Windows\System\DXwmGuW.exe
  C:\Windows\System\DXwmGuW.exe
  2⤵
  PID:14112
- C:\Windows\System\MZDnaod.exe
  C:\Windows\System\MZDnaod.exe
  2⤵
  PID:14168
- C:\Windows\System\LuvYvGX.exe
  C:\Windows\System\LuvYvGX.exe
  2⤵
  PID:14292
- C:\Windows\System\SXURzHb.exe
  C:\Windows\System\SXURzHb.exe
  2⤵
  PID:13504
- C:\Windows\System\yIMWYGY.exe
  C:\Windows\System\yIMWYGY.exe
  2⤵
  PID:13600
- C:\Windows\System\ealygql.exe
  C:\Windows\System\ealygql.exe
  2⤵
  PID:13688
- C:\Windows\System\IKGJbfL.exe
  C:\Windows\System\IKGJbfL.exe
  2⤵
  PID:13508
- C:\Windows\System\ycdkazk.exe
  C:\Windows\System\ycdkazk.exe
  2⤵
  PID:13648
- C:\Windows\System\tvWgocW.exe
  C:\Windows\System\tvWgocW.exe
  2⤵
  PID:13884
- C:\Windows\System\rJyGRYG.exe
  C:\Windows\System\rJyGRYG.exe
  2⤵
  PID:14120
- C:\Windows\System\EKipFxF.exe
  C:\Windows\System\EKipFxF.exe
  2⤵
  PID:13472
- C:\Windows\System\rFAVqGn.exe
  C:\Windows\System\rFAVqGn.exe
  2⤵
  PID:14348
- C:\Windows\System\yZTBpUD.exe
  C:\Windows\System\yZTBpUD.exe
  2⤵
  PID:14376
- C:\Windows\System\fpiWEPt.exe
  C:\Windows\System\fpiWEPt.exe
  2⤵
  PID:14400
- C:\Windows\System\dgDyZsU.exe
  C:\Windows\System\dgDyZsU.exe
  2⤵
  PID:14428
- C:\Windows\System\jZHKYyw.exe
  C:\Windows\System\jZHKYyw.exe
  2⤵
  PID:14452
- C:\Windows\System\NYaFMik.exe
  C:\Windows\System\NYaFMik.exe
  2⤵
  PID:14472
- C:\Windows\System\GWLfADF.exe
  C:\Windows\System\GWLfADF.exe
  2⤵
  PID:14488
- C:\Windows\System\bNXyiVq.exe
  C:\Windows\System\bNXyiVq.exe
  2⤵
  PID:14520
- C:\Windows\System\irJqKwY.exe
  C:\Windows\System\irJqKwY.exe
  2⤵
  PID:14552
- C:\Windows\System\ryEDLyc.exe
  C:\Windows\System\ryEDLyc.exe
  2⤵
  PID:14580
- C:\Windows\System\PrVPyKS.exe
  C:\Windows\System\PrVPyKS.exe
  2⤵
  PID:14600
- C:\Windows\System\bOPpnvg.exe
  C:\Windows\System\bOPpnvg.exe
  2⤵
  PID:14624
- C:\Windows\System\CDPNIFE.exe
  C:\Windows\System\CDPNIFE.exe
  2⤵
  PID:14828
- C:\Windows\System\rfZadSw.exe
  C:\Windows\System\rfZadSw.exe
  2⤵
  PID:14844
- C:\Windows\System\WSdvqfc.exe
  C:\Windows\System\WSdvqfc.exe
  2⤵
  PID:14860
- C:\Windows\System\pShqtzv.exe
  C:\Windows\System\pShqtzv.exe
  2⤵
  PID:14884
- C:\Windows\System\UyhsrNX.exe
  C:\Windows\System\UyhsrNX.exe
  2⤵
  PID:14916
- C:\Windows\System\DOSRwUP.exe
  C:\Windows\System\DOSRwUP.exe
  2⤵
  PID:14940
- C:\Windows\System\lrfSuSL.exe
  C:\Windows\System\lrfSuSL.exe
  2⤵
  PID:14968
- C:\Windows\System\UAUsWsS.exe
  C:\Windows\System\UAUsWsS.exe
  2⤵
  PID:14988
- C:\Windows\System\AuOUQso.exe
  C:\Windows\System\AuOUQso.exe
  2⤵
  PID:15024
- C:\Windows\System\RINrUZa.exe
  C:\Windows\System\RINrUZa.exe
  2⤵
  PID:15048
- C:\Windows\System\oUAvPBb.exe
  C:\Windows\System\oUAvPBb.exe
  2⤵
  PID:15064
- C:\Windows\System\IjCwNNB.exe
  C:\Windows\System\IjCwNNB.exe
  2⤵
  PID:15100
- C:\Windows\System\QTSNXwJ.exe
  C:\Windows\System\QTSNXwJ.exe
  2⤵
  PID:15124
- C:\Windows\System\WzaVnVq.exe
  C:\Windows\System\WzaVnVq.exe
  2⤵
  PID:15152
- C:\Windows\System\CoUNcHh.exe
  C:\Windows\System\CoUNcHh.exe
  2⤵
  PID:15176
- C:\Windows\System\zYYFWOG.exe
  C:\Windows\System\zYYFWOG.exe
  2⤵
  PID:15200
- C:\Windows\System\oIxJLBX.exe
  C:\Windows\System\oIxJLBX.exe
  2⤵
  PID:15220
- C:\Windows\System\DgPTMMn.exe
  C:\Windows\System\DgPTMMn.exe
  2⤵
  PID:15256
- C:\Windows\System\NTAbegh.exe
  C:\Windows\System\NTAbegh.exe
  2⤵
  PID:15284
- C:\Windows\System\iwYnwKl.exe
  C:\Windows\System\iwYnwKl.exe
  2⤵
  PID:15312
- C:\Windows\System\yEPGbuG.exe
  C:\Windows\System\yEPGbuG.exe
  2⤵
  PID:15332
- C:\Windows\System\FBRZlyu.exe
  C:\Windows\System\FBRZlyu.exe
  2⤵
  PID:15356
- C:\Windows\System\drUnvac.exe
  C:\Windows\System\drUnvac.exe
  2⤵
  PID:14012
- C:\Windows\System\geftDkG.exe
  C:\Windows\System\geftDkG.exe
  2⤵
  PID:13844
- C:\Windows\System\wUEnpUq.exe
  C:\Windows\System\wUEnpUq.exe
  2⤵
  PID:14460
- C:\Windows\System\khGjmjg.exe
  C:\Windows\System\khGjmjg.exe
  2⤵
  PID:14508
- C:\Windows\System\OjkAquS.exe
  C:\Windows\System\OjkAquS.exe
  2⤵
  PID:14368
- C:\Windows\System\FLutrmp.exe
  C:\Windows\System\FLutrmp.exe
  2⤵
  PID:14420
- C:\Windows\System\JRkHBSy.exe
  C:\Windows\System\JRkHBSy.exe
  2⤵
  PID:14608
- C:\Windows\System\CfpyUMo.exe
  C:\Windows\System\CfpyUMo.exe
  2⤵
  PID:14736
- C:\Windows\System\TijoYEf.exe
  C:\Windows\System\TijoYEf.exe
  2⤵
  PID:14816
- C:\Windows\System\TzqWXcL.exe
  C:\Windows\System\TzqWXcL.exe
  2⤵
  PID:14836
- C:\Windows\System\FVaJsJt.exe
  C:\Windows\System\FVaJsJt.exe
  2⤵
  PID:14896
- C:\Windows\System\IeEecJW.exe
  C:\Windows\System\IeEecJW.exe
  2⤵
  PID:14936
- C:\Windows\System\tlLJeon.exe
  C:\Windows\System\tlLJeon.exe
  2⤵
  PID:15044
- C:\Windows\System\ecVqJac.exe
  C:\Windows\System\ecVqJac.exe
  2⤵
  PID:15060
- C:\Windows\System\sdWhHcb.exe
  C:\Windows\System\sdWhHcb.exe
  2⤵
  PID:15140
- C:\Windows\System\DLjZScQ.exe
  C:\Windows\System\DLjZScQ.exe
  2⤵
  PID:15216
- C:\Windows\System\SbeQZfy.exe
  C:\Windows\System\SbeQZfy.exe
  2⤵
  PID:15244
- C:\Windows\System\zOdygnj.exe
  C:\Windows\System\zOdygnj.exe
  2⤵
  PID:15328
- C:\Windows\System\wCdURJD.exe
  C:\Windows\System\wCdURJD.exe
  2⤵
  PID:13672
- C:\Windows\System\gQujYUK.exe
  C:\Windows\System\gQujYUK.exe
  2⤵
  PID:13580
- C:\Windows\System\qpGQMxq.exe
  C:\Windows\System\qpGQMxq.exe
  2⤵
  PID:14344
- C:\Windows\System\QCdxEpv.exe
  C:\Windows\System\QCdxEpv.exe
  2⤵
  PID:14576
- C:\Windows\System\IrfoRsh.exe
  C:\Windows\System\IrfoRsh.exe
  2⤵
  PID:14716
- C:\Windows\System\ncnnrEs.exe
  C:\Windows\System\ncnnrEs.exe
  2⤵
  PID:15160
- C:\Windows\System\JzPPOZt.exe
  C:\Windows\System\JzPPOZt.exe
  2⤵
  PID:15080
- C:\Windows\System\ayKEjVQ.exe
  C:\Windows\System\ayKEjVQ.exe
  2⤵
  PID:15232
- C:\Windows\System\UoLJSoD.exe
  C:\Windows\System\UoLJSoD.exe
  2⤵
  PID:15352
- C:\Windows\System\SveNzWw.exe
  C:\Windows\System\SveNzWw.exe
  2⤵
  PID:14808
- C:\Windows\System\QuSQzlv.exe
  C:\Windows\System\QuSQzlv.exe
  2⤵
  PID:15280
- C:\Windows\System\aXFlEgX.exe
  C:\Windows\System\aXFlEgX.exe
  2⤵
  PID:15384
- C:\Windows\System\xDzveBM.exe
  C:\Windows\System\xDzveBM.exe
  2⤵
  PID:15412
- C:\Windows\System\aZSdBmD.exe
  C:\Windows\System\aZSdBmD.exe
  2⤵
  PID:15428
- C:\Windows\System\kQWcmoH.exe
  C:\Windows\System\kQWcmoH.exe
  2⤵
  PID:15452
- C:\Windows\System\tLHStmp.exe
  C:\Windows\System\tLHStmp.exe
  2⤵
  PID:15480
- C:\Windows\System\NEdUZAm.exe
  C:\Windows\System\NEdUZAm.exe
  2⤵
  PID:15508
- C:\Windows\System\wBVZpmZ.exe
  C:\Windows\System\wBVZpmZ.exe
  2⤵
  PID:15544
- C:\Windows\System\NXMsWeK.exe
  C:\Windows\System\NXMsWeK.exe
  2⤵
  PID:15572
- C:\Windows\System\myvrYec.exe
  C:\Windows\System\myvrYec.exe
  2⤵
  PID:15596
- C:\Windows\System\wDtRTZY.exe
  C:\Windows\System\wDtRTZY.exe
  2⤵
  PID:15624
- C:\Windows\System\WaCyLoG.exe
  C:\Windows\System\WaCyLoG.exe
  2⤵
  PID:15656
- C:\Windows\System\ILdqFFz.exe
  C:\Windows\System\ILdqFFz.exe
  2⤵
  PID:15688
- C:\Windows\System\ARKhoIH.exe
  C:\Windows\System\ARKhoIH.exe
  2⤵
  PID:15716
- C:\Windows\System\QBteKIe.exe
  C:\Windows\System\QBteKIe.exe
  2⤵
  PID:15740
- C:\Windows\System\fIbcpvP.exe
  C:\Windows\System\fIbcpvP.exe
  2⤵
  PID:15768
- C:\Windows\System\XOhRTZM.exe
  C:\Windows\System\XOhRTZM.exe
  2⤵
  PID:15796
- C:\Windows\System\EhdUwLM.exe
  C:\Windows\System\EhdUwLM.exe
  2⤵
  PID:15824
- C:\Windows\System\XZRfrdj.exe
  C:\Windows\System\XZRfrdj.exe
  2⤵
  PID:15852
- C:\Windows\System\HLZeSbJ.exe
  C:\Windows\System\HLZeSbJ.exe
  2⤵
  PID:15884
- C:\Windows\System\zkUabuo.exe
  C:\Windows\System\zkUabuo.exe
  2⤵
  PID:15908
- C:\Windows\System\fVXhukc.exe
  C:\Windows\System\fVXhukc.exe
  2⤵
  PID:15932
- C:\Windows\System\KGtXDZB.exe
  C:\Windows\System\KGtXDZB.exe
  2⤵
  PID:15960
- C:\Windows\System\DsXNbAc.exe
  C:\Windows\System\DsXNbAc.exe
  2⤵
  PID:15988
- C:\Windows\System\iMXqifG.exe
  C:\Windows\System\iMXqifG.exe
  2⤵
  PID:16024
- C:\Windows\System\fLHSdwa.exe
  C:\Windows\System\fLHSdwa.exe
  2⤵
  PID:16040
- C:\Windows\System\oqwtcTj.exe
  C:\Windows\System\oqwtcTj.exe
  2⤵
  PID:16072
- C:\Windows\System\FSJLaCH.exe
  C:\Windows\System\FSJLaCH.exe
  2⤵
  PID:16100
- C:\Windows\System\KCAJJkP.exe
  C:\Windows\System\KCAJJkP.exe
  2⤵
  PID:16128
- C:\Windows\System\BIYGzxR.exe
  C:\Windows\System\BIYGzxR.exe
  2⤵
  PID:16160
- C:\Windows\System\PpEIdzN.exe
  C:\Windows\System\PpEIdzN.exe
  2⤵
  PID:16192
- C:\Windows\System\zKSQDdE.exe
  C:\Windows\System\zKSQDdE.exe
  2⤵
  PID:16212
- C:\Windows\System\vZmpzId.exe
  C:\Windows\System\vZmpzId.exe
  2⤵
  PID:16232
- C:\Windows\System\ZRVahbB.exe
  C:\Windows\System\ZRVahbB.exe
  2⤵
  PID:16260
- C:\Windows\System\BNmgkZI.exe
  C:\Windows\System\BNmgkZI.exe
  2⤵
  PID:16284
- C:\Windows\System\yyeEbyh.exe
  C:\Windows\System\yyeEbyh.exe
  2⤵
  PID:16304
- C:\Windows\System\BoTHxjK.exe
  C:\Windows\System\BoTHxjK.exe
  2⤵
  PID:16324
- C:\Windows\System\qAeaphj.exe
  C:\Windows\System\qAeaphj.exe
  2⤵
  PID:16356
- C:\Windows\System\xNJJWCR.exe
  C:\Windows\System\xNJJWCR.exe
  2⤵
  PID:16372
- C:\Windows\System\yjKVNcm.exe
  C:\Windows\System\yjKVNcm.exe
  2⤵
  PID:14928
- C:\Windows\System\dUhMYmx.exe
  C:\Windows\System\dUhMYmx.exe
  2⤵
  PID:14444
- C:\Windows\System\rDajgWf.exe
  C:\Windows\System\rDajgWf.exe
  2⤵
  PID:14340
- C:\Windows\System\xLbugyO.exe
  C:\Windows\System\xLbugyO.exe
  2⤵
  PID:15516
- C:\Windows\System\QjjDYau.exe
  C:\Windows\System\QjjDYau.exe
  2⤵
  PID:15620
- C:\Windows\System\hvIyBNW.exe
  C:\Windows\System\hvIyBNW.exe
  2⤵
  PID:15568
- C:\Windows\System\gdZZNzP.exe
  C:\Windows\System\gdZZNzP.exe
  2⤵
  PID:15584
- C:\Windows\System\HstJTRJ.exe
  C:\Windows\System\HstJTRJ.exe
  2⤵
  PID:15748
- C:\Windows\System\qGlgYAN.exe
  C:\Windows\System\qGlgYAN.exe
  2⤵
  PID:15672
- C:\Windows\System\kPyHJpr.exe
  C:\Windows\System\kPyHJpr.exe
  2⤵
  PID:15864
- C:\Windows\System\rZvwKvM.exe
  C:\Windows\System\rZvwKvM.exe
  2⤵
  PID:15976
- C:\Windows\System\ssCqnto.exe
  C:\Windows\System\ssCqnto.exe
  2⤵
  PID:15900
- C:\Windows\System\MqDAOxJ.exe
  C:\Windows\System\MqDAOxJ.exe
  2⤵
  PID:1196
- C:\Windows\System\LrqZynM.exe
  C:\Windows\System\LrqZynM.exe
  2⤵
  PID:16056
- C:\Windows\System\UdqwErI.exe
  C:\Windows\System\UdqwErI.exe
  2⤵
  PID:16008
- C:\Windows\System\FmLRRpI.exe
  C:\Windows\System\FmLRRpI.exe
  2⤵
  PID:16064
- C:\Windows\System\mwdwZUK.exe
  C:\Windows\System\mwdwZUK.exe
  2⤵
  PID:16156
- C:\Windows\System\EBvuEEm.exe
  C:\Windows\System\EBvuEEm.exe
  2⤵
  PID:16256
- C:\Windows\System\ChRwBVM.exe
  C:\Windows\System\ChRwBVM.exe
  2⤵
  PID:16296
- C:\Windows\System\inssxGK.exe
  C:\Windows\System\inssxGK.exe
  2⤵
  PID:15324
- C:\Windows\System\ZSJJaIa.exe
  C:\Windows\System\ZSJJaIa.exe
  2⤵
  PID:16368
- C:\Windows\System\ytIChrX.exe
  C:\Windows\System\ytIChrX.exe
  2⤵
  PID:15604
- C:\Windows\System\QFfXhto.exe
  C:\Windows\System\QFfXhto.exe
  2⤵
  PID:15392
- C:\Windows\System\QHoQtwP.exe
  C:\Windows\System\QHoQtwP.exe
  2⤵
  PID:14852
- C:\Windows\System\YyfHNCV.exe
  C:\Windows\System\YyfHNCV.exe
  2⤵
  PID:15536
- C:\Windows\System\ExQvfQD.exe
  C:\Windows\System\ExQvfQD.exe
  2⤵
  PID:16280
- C:\Windows\System\usXjHTt.exe
  C:\Windows\System\usXjHTt.exe
  2⤵
  PID:15420
- C:\Windows\System\UgOHkmj.exe
  C:\Windows\System\UgOHkmj.exe
  2⤵
  PID:16392
- C:\Windows\System\hrgXdOY.exe
  C:\Windows\System\hrgXdOY.exe
  2⤵
  PID:16420
- C:\Windows\System\vAuVEZy.exe
  C:\Windows\System\vAuVEZy.exe
  2⤵
  PID:16448
- C:\Windows\System\mnlfnmi.exe
  C:\Windows\System\mnlfnmi.exe
  2⤵
  PID:16472
- C:\Windows\System\EHpENCh.exe
  C:\Windows\System\EHpENCh.exe
  2⤵
  PID:16496
- C:\Windows\System\LapbuoY.exe
  C:\Windows\System\LapbuoY.exe
  2⤵
  PID:16528
- C:\Windows\System\skpStuq.exe
  C:\Windows\System\skpStuq.exe
  2⤵
  PID:16548
- C:\Windows\System\voOKJyK.exe
  C:\Windows\System\voOKJyK.exe
  2⤵
  PID:16572
- C:\Windows\System\DLikJco.exe
  C:\Windows\System\DLikJco.exe
  2⤵
  PID:16600
- C:\Windows\System\vtLZDyx.exe
  C:\Windows\System\vtLZDyx.exe
  2⤵
  PID:16624
- C:\Windows\System\rpYcjXE.exe
  C:\Windows\System\rpYcjXE.exe
  2⤵
  PID:16668
- C:\Windows\System\xfaTPPp.exe
  C:\Windows\System\xfaTPPp.exe
  2⤵
  PID:16692
- C:\Windows\System\TxSuPuQ.exe
  C:\Windows\System\TxSuPuQ.exe
  2⤵
  PID:16728
- C:\Windows\System\XqbrgVh.exe
  C:\Windows\System\XqbrgVh.exe
  2⤵
  PID:16752
- C:\Windows\System\syeLZIj.exe
  C:\Windows\System\syeLZIj.exe
  2⤵
  PID:16768
- C:\Windows\System\CKpaYyf.exe
  C:\Windows\System\CKpaYyf.exe
  2⤵
  PID:16800
- C:\Windows\System\zcWPAry.exe
  C:\Windows\System\zcWPAry.exe
  2⤵
  PID:16820
- C:\Windows\System\OGfBwmg.exe
  C:\Windows\System\OGfBwmg.exe
  2⤵
  PID:16860
- C:\Windows\System\bXMlwVu.exe
  C:\Windows\System\bXMlwVu.exe
  2⤵
  PID:16880
- C:\Windows\System\WbzHpDB.exe
  C:\Windows\System\WbzHpDB.exe
  2⤵
  PID:16900
- C:\Windows\System\CdeROCQ.exe
  C:\Windows\System\CdeROCQ.exe
  2⤵
  PID:16924
- C:\Windows\System\BsuBFpN.exe
  C:\Windows\System\BsuBFpN.exe
  2⤵
  PID:16944
- C:\Windows\System\gEQSjfU.exe
  C:\Windows\System\gEQSjfU.exe
  2⤵
  PID:16964
- C:\Windows\System\YIrbmjQ.exe
  C:\Windows\System\YIrbmjQ.exe
  2⤵
  PID:16992
- C:\Windows\System\MbzuTUn.exe
  C:\Windows\System\MbzuTUn.exe
  2⤵
  PID:17016
- C:\Windows\System\LyvvJKN.exe
  C:\Windows\System\LyvvJKN.exe
  2⤵
  PID:17040
- C:\Windows\System\ZZSLSwI.exe
  C:\Windows\System\ZZSLSwI.exe
  2⤵
  PID:17064
- C:\Windows\System\HzRbmiP.exe
  C:\Windows\System\HzRbmiP.exe
  2⤵
  PID:17096
- C:\Windows\System\MxbbaFn.exe
  C:\Windows\System\MxbbaFn.exe
  2⤵
  PID:17128
- C:\Windows\System\jfBeorh.exe
  C:\Windows\System\jfBeorh.exe
  2⤵
  PID:17144
- C:\Windows\System\CPKweyh.exe
  C:\Windows\System\CPKweyh.exe
  2⤵
  PID:17184
- C:\Windows\System\KUZMnEW.exe
  C:\Windows\System\KUZMnEW.exe
  2⤵
  PID:17224
- C:\Windows\System\wnTJrCx.exe
  C:\Windows\System\wnTJrCx.exe
  2⤵
  PID:17248
- C:\Windows\System\aEqWlAw.exe
  C:\Windows\System\aEqWlAw.exe
  2⤵
  PID:17276
- C:\Windows\System\vneZvXu.exe
  C:\Windows\System\vneZvXu.exe
  2⤵
  PID:17296
- C:\Windows\System\FxWCSje.exe
  C:\Windows\System\FxWCSje.exe
  2⤵
  PID:17336
- C:\Windows\System\DMtPuco.exe
  C:\Windows\System\DMtPuco.exe
  2⤵
  PID:17364
- C:\Windows\System\BkKxmGr.exe
  C:\Windows\System\BkKxmGr.exe
  2⤵
  PID:17392
- C:\Windows\System\IQEHuth.exe
  C:\Windows\System\IQEHuth.exe
  2⤵
  PID:16764
- C:\Windows\System\pRkvMZY.exe
  C:\Windows\System\pRkvMZY.exe
  2⤵
  PID:16740
- C:\Windows\System\YxOtqfN.exe
  C:\Windows\System\YxOtqfN.exe
  2⤵
  PID:16852

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ApsRfND.exe

Filesize
1.7MB

MD5
ed01904ba218c662dcc30e448a54da8f

SHA1
444160da5bfcca3233aaae15e6101f00a0b82e50

SHA256
4990ab266701c31a529f926fbc2c99e1df7d6d09f52417f63799e2697ac83651

SHA512
802f675c4a244a6396d1f90670c11d8b5da6f6084e936efb966a162560f99ca539ef16574882e5771429650f064e08228f6daa410c5eb0dea00841f52a162407

Download Submit
C:\Windows\System\CjNscfj.exe

Filesize
1.7MB

MD5
50bac5919ed1b83705169b8de6a4d745

SHA1
b543ee58046924742c15090771586f2310422fd7

SHA256
7382a8f582896e9212251547d0d4e9f6022a883f97607b2c13eff338acc15cd4

SHA512
c4e43801aa42b9ed3afb8445460e303ce5dfe07a99d32a6c3a5fcd9d1b71d175782343b4e79f6c760321bbe8abbef7696717f355cec4673c82c246025a1e1805

Download Submit
C:\Windows\System\EdNlQmM.exe

Filesize
1.7MB

MD5
fa1a3997c76df53b9ef591147962e933

SHA1
507c196ba9a6a4ddb380a41d0b0ec1603da8850e

SHA256
b2f340c3b1b631b07cebcdbdb51d1d73dfef0a9966afc8a7bb865fcb1354d566

SHA512
32f75d010c15e45fb7afeb81d7dbde2f9d856215ffc49b1413bd6f73ae107bd4770a25550e1bd65f4024f4030f8ece44ba4e84afb5ce8fbb863faf52b4a0f734

Download Submit
C:\Windows\System\HcdNpBL.exe

Filesize
1.7MB

MD5
49165de856e6f7ef7ffd36bf8ae8df8a

SHA1
ed3174b62057e172a13bc909d5bc5454d06fcd6b

SHA256
e5d6ce2688e8e10a225274400d5603d2546c5c541b5dc2e0705f1d785fbc876c

SHA512
4d0999a8f159dede905899f9f0f49d1a5f339fbb9348d234fb34574363aeaf46006ed9326c859f3882eeaf4c9884f5089411f372f517ba93b85cc6691d817ed2

Download Submit
C:\Windows\System\HkpADMC.exe

Filesize
1.7MB

MD5
4aa84b0d31c39c54ad6f090820d251a9

SHA1
671d512e90d28551eea2feb98c122b21159c9215

SHA256
e48e46aa4897952ad8132b03a6c65df1a4c3b6ad8489bc98c7d6a4c273b3e68d

SHA512
69cd72d89c77255010e8d151981684f0469c72ded989aea38562b9572255645530ca0b09035b9bd4d852da37b3da123a4b1dc3dd2d3526ab50e78ecc3ce9e73b

Download Submit
C:\Windows\System\JRJBXrK.exe

Filesize
1.7MB

MD5
b750ab8fce7affb252d523d8ea9b661f

SHA1
2cfc787d271ecc4d574398962e63be626fbf27a3

SHA256
df48f812bdcfb08e03cf2d53a08cd0a0da9dcd86c3796b61f5f304d614960490

SHA512
6b46c911c8178ef1c8378382a1bd6bf48fd64b1a78debec22d6ab5d5bdebe3dc8311a21ebe5022efe6fff7f3f97dec19b158eb52d1bf5d8ede5b477d3390a882

Download Submit
C:\Windows\System\KIGKBuv.exe

Filesize
1.7MB

MD5
f270780347f87aa5aa111b8f398882d9

SHA1
766006da84e2d5478042194c19ce65bd6ca430e9

SHA256
2d88b6b00fd636df413ef51289d0c853ad991aeb873630bea9c6a6c1e8fbc285

SHA512
7951ea01ecb34e5250ea84935e3dade56a4f5bcf0e894d078a5dbf066ba434ee9f525fb4bbc776bd1d4664b0887fdb3da465296d244bd6ba95924eabcfe9ced8

Download Submit
C:\Windows\System\KUoLwHV.exe

Filesize
1.7MB

MD5
e3ef1e95a003d68eb36e5ac92ae39ede

SHA1
5f42614eb096d6e1d997acdc65534e1cbeb5bff9

SHA256
bca7dee55c3b47e22db3b7c83ef28cfd284433914ca45e4105d9ffda275231b0

SHA512
dc29d5c5df3c7f7e4a929cb333ab12e8ce7c3002d07e752e312cf0f0335de092e23ad617a105c5fcbd361453db451edad6f4bed357f4d1e8d7840a780a7828ef

Download Submit
C:\Windows\System\LStEMex.exe

Filesize
1.7MB

MD5
26664142a2a424545416facf64122269

SHA1
388132feaf483fb7d03ab51aecfb8edb54d9927c

SHA256
d831ea07ec21e8f32358993f2773beedad05aeec1f1c907b31069adebd9319b8

SHA512
ccb4fb989f8ca27c1d28fa27ddf1b55167cf58335fd4b83e479f8aaa306087ab35d3a4bd395ea3e9569eab9d1c878beda7a28ce1efc7590fee5b535d7cb98da6

Download Submit
C:\Windows\System\MbRkNka.exe

Filesize
1.7MB

MD5
134e6353bca5743902a4dc56fdcc9611

SHA1
b19b37efd0fd346a4d362f2bac55e231f735024e

SHA256
5f75bbd7578ce112e1bb8579429aa47f86106face411b2c1c1ceb707c86f8d64

SHA512
002204e03a089aab9aeda05ef37a08cc32bed46596f45f326888492cdd4807c840075941159fe32f2a9290ed12d23edb3d6ee0778a00040f0ee40c37aee62a11

Download Submit
C:\Windows\System\OIrdxAG.exe

Filesize
1.7MB

MD5
877798fe3485c0d7abfe9909b5f41d31

SHA1
20f791bf34f3d908aff64fc2a7623e69411c1e4e

SHA256
d6724eff74cf79a25b48ee75acca48bef59e4642cb8cfddeb744200b59adc151

SHA512
e17d06111d301b3112c09e528f17a6679b78766b1430b65f715a8a626127da703df626c656585bf92edc503ce857a96f8a0fff64634c4e1a09cbda3c1fd9038c

Download Submit
C:\Windows\System\OLIKiDT.exe

Filesize
1.7MB

MD5
56038f2b3034b405e8b0dbf1b192c164

SHA1
ebec05312b5f4e3e5b4fd5ed6beb6a3bc8188139

SHA256
a6ad1bde6a20461dee4aca059899712fc6eea8f4c490de3be2376e7d55ffaac5

SHA512
45f1bcbb84b4beb0710690c8a77f88f2d56564d1d443e5b90b00f3a11a543f451df3e3c7c70a072b19d07da5c6d1f0a9330fd03603bbf3a5a28e7972ad1cfe77

Download Submit
C:\Windows\System\OyqXjrL.exe

Filesize
1.7MB

MD5
1fc5a45137f96678416ea4e0e07df561

SHA1
081d4d76e5dee74f6d7c11168a70c5bd6ddede81

SHA256
250630d48c8f4bf3cd6298d8126bb407aa3435f1f2eadac6e9132334ecff89a6

SHA512
9be5892bc11ad13b9f5c047f1c9ae3974fd6e82dfc16a189c5afc0640be3a3f2582c0400477194c5852cd1d8c2ea4ddc2169bc3c1bcfa91539d82c750b5a8697

Download Submit
C:\Windows\System\USYiCXR.exe

Filesize
1.7MB

MD5
e9a5a821f915815502f11c79957a4615

SHA1
116536e1aef2c4b23f4a84ef89e53bcf739163d6

SHA256
746d2130b2cd1e55dccbb05508cde121da4496c36b097239ec90c156f8a1e813

SHA512
a5b675abdc15dd4acae946296a9ac11e15473474fada28b3c349927598f397c4b5dd147b342511ac24cc487dd382f1e7ace1276d7139120976fe90b9a9ddaa07

Download Submit
C:\Windows\System\WBgkmgg.exe

Filesize
1.7MB

MD5
74819a7a69e516c397a2fc8dd4aeee56

SHA1
bd321e3012541a839857c94108bfd20c9a2e4467

SHA256
34cd6517ce689cc0f51613be7eca09852ddbbf85345ac9c578928713b6f6130e

SHA512
e6c712e5c9f30fe259eefd6cb300ad2d78648c2c2a15be929ab0ba1b048dfe7e20a91e1a5a0170f13bd3a428937f8963d10bd434f37ece487e89429aa582401f

Download Submit
C:\Windows\System\YAnTWbx.exe

Filesize
1.7MB

MD5
6351f456785a933fa592d4209326b963

SHA1
e250ec1397c46209ff9d781a2ed57f5144a7912c

SHA256
c0d8af413801d0f7df65c41c711fbaf45e1ef59aa8078269b5ecc04cba26d438

SHA512
5dd1ec08c2891161505c6ee5ea719443f35cd10c47be9ddf830f4650f6267b7e4420ed544c0fcb9905e1a3fd0556ff38c7f4a5fa25f86052f643a9b4aa9d6c3b

Download Submit
C:\Windows\System\YIElPqI.exe

Filesize
1.7MB

MD5
47f94f58faa1737330c8fdc299bdbe1b

SHA1
8bec95c467317154417e91232f1cca68550f8e08

SHA256
c52a8ad7b3e85459404fc6bf97739e1d2aad97e50a7de0a1e8fdd3f7adf89fd6

SHA512
7dcdd37fca5b56cdf3f9eb9fb406fa7528801e2809bf9f346248dfe8976b4964abae75677ad8da8125d61dc358db11662d4a106179b44368f776239a2329b434

Download Submit
C:\Windows\System\YRPoEpH.exe

Filesize
1.7MB

MD5
b0e30331075059eb6dc78d5ce3a641e2

SHA1
6962839fd0f11ee16d11dfd6fff62bc044bfe15d

SHA256
37e297732b64c9f38b57d0bca488b38a2a466145069ca890b7f87a11fe215387

SHA512
40769baff35e39d562e3b698222e7edc51677f2c30e12ca86c042bd3593bc6c60de6fb26321b61770a5ae02af15d3f10a39362e1185f252834e5f485d1012b7a

Download Submit
C:\Windows\System\ZZIyHYt.exe

Filesize
1.7MB

MD5
b7d9bea2472051de2d257f9dcdd96b78

SHA1
6dbbc668f47fa94bf3f42c76a5c9e9b7212df28d

SHA256
bd50555a2118e51c434df2955b4ec18d6197e9d4d6c4a1eae36a8a4ea7d12f71

SHA512
542feb759286fd61fdc36caf2494bccbe6dcfd7149620f0b8206ba7673bc9f3cc2824505a5ce5fafe04fe99e8bc71ccfdeec7c661e773049c7c418fcd00a9e54

Download Submit
C:\Windows\System\agyImTX.exe

Filesize
1.7MB

MD5
5edeb819846399518f24ecb9c9402f3a

SHA1
2a494101408d25d9d8f9d65509145bee7a453b34

SHA256
76cc9f5313cabce72070e369d0a763c2698913f0a1cb4a1416e494b3ab2e345c

SHA512
f2c331e1ca8ea27083de7ce3120a9c6ffcb26591818ae0bcfe3393bab27d791ed3dfb30eeb0dae495698a46a2f0a925e6070b54db986bdb0978e61e4f95099bd

Download Submit
C:\Windows\System\dDTuOih.exe

Filesize
1.7MB

MD5
a09560d3d9de97f1e172fb4348ba88cf

SHA1
ca1926d3d3f3aa98e2e29e8ed955f20f3afe9181

SHA256
7f6237c64065bd496bc405f42d2b7d69c80921d0572e5fe63901093d76357534

SHA512
2eb704ba26b76967a3c142b29d111f5de64fad660131d5b668bf049630829285d70853668336a0e3a467df9a7bff3aa874ff37c7f998e28f11ec4daedf5aa198

Download Submit
C:\Windows\System\eCRcHmB.exe

Filesize
1.7MB

MD5
975e4ff41b1fd315b2555a2f7c4c6324

SHA1
d0521a11a37a53f501a5984e5215b1973d5d3898

SHA256
58e01080355f4d508ca31814bf83f6a2a656ce5c35554b808b941bddaf1c4629

SHA512
50c66b9ef293876b69df7aefa056cc3202a14e4292caae51a72657e44c1961be45492487a9d5af2c31c6708b14faf457a84df58a812d9acb0731fd73d6273a6c

Download Submit
C:\Windows\System\enPuAGC.exe

Filesize
1.7MB

MD5
598668edd802f72c0ecf77ac59ca65e6

SHA1
2c689f58a16c8101043acbafc55996ac6f417755

SHA256
92731f7ddc084a7ac98e9fa5d158b33f66839ed74d1f8ab2c56227391e140f62

SHA512
2111b5b92896e8f68d3967034c4a6c2c33779ea6c762bbc86fde37130c89ac9eaeca98258d270bb32e88d52966158fa47afcd83038bed5c66ac6d916d6f87551

Download Submit
C:\Windows\System\hGtzaBB.exe

Filesize
1.7MB

MD5
b8dae1ac80474f855e642edd4ef24c28

SHA1
79c254a9447cd66f07be462ddbb65eeabc556d51

SHA256
09ebe14bbb423ed8dbf82a3e268dc7829ebfc185dfedafc14783819c7b7ce537

SHA512
20ebec3e4cea50da24d4506206bf33060dac9f87e24d6add7534eed5e3a81b1939e2cb185ea6bc6696ad7fe1e2644491d79766a5a7cc89d30902d13d96281aaa

Download Submit
C:\Windows\System\kDvpdKR.exe

Filesize
1.7MB

MD5
4047964b987ef79c60f7ca774af50f71

SHA1
9d686c771564a4eb37f403d6817ec2b470682066

SHA256
e43fdc41743fbe3607b7e979dd491ab3f14e5ef2dfe2bce8870b96ce0d7dac7c

SHA512
f3ebc38e6a78b9cd3469cbebbbc63168f8a4ab81f7cec3b69d2e6c7cf19bdaa975d53aef584802e2aa526fce2f03148329395e506ec850f8d267d3be3b0826db

Download Submit
C:\Windows\System\lsYuAAO.exe

Filesize
1.7MB

MD5
a58125c7bc9ac2878a2d80a3ef35b3da

SHA1
c5b245b68e4ee837cea2f7737d206c9cb8cad6f3

SHA256
14b3e27f5528cb181812595194a9ca33594699bc4dad3923fa1633302e2c0667

SHA512
7e3fede8941c5ff173143b85df3410726fe23b9f319c8db4efb3cfadfed283e01ae6cf4927b59b277cb92405ac272b38f7f5d43e8534cadcec33a493c50caade

Download Submit
C:\Windows\System\pEZGgEO.exe

Filesize
1.7MB

MD5
70bb769ad1be696ede0e43def976d02f

SHA1
8dae219fe5f1380ad5aa2486509ea937fa2c5082

SHA256
be310af73485ab20ac427a61ae1a0d4d9d7fa9b74e963b99689b97a7bc18c1c1

SHA512
e4320f6783ce3ab7b766cb6c61be3dfccc9823f09a350ada9681925a98c86d7d2b18fcd0cf7023e128adc8e6f5e91f65931c0df83ae92b5407617fb43e9d6c9f

Download Submit
C:\Windows\System\pOAHZIU.exe

Filesize
1.7MB

MD5
8e27dee0d3367010651f8b5eb9e57eaf

SHA1
dfdca47d73fd3422eddcc81e8ca830e7f3129c80

SHA256
d0b57ece44c6d1286db95ef9eea570a721d7abf5651e1b63cdbb14de097c254f

SHA512
cda5e5957a315bbf5c6522cdb7f2e72122329b0bbae7c5cc32e38059f136d7dbca4cd10093ecaed955d3fdca9487f27a608061df4e413ed0d9a92657a0c01482

Download Submit
C:\Windows\System\pSTETeC.exe

Filesize
1.7MB

MD5
e3ca6d76c2cb5c84dd0c5d6bdeee156b

SHA1
d0f55ae824ec10f687533c6ee9dacf3c5b9335e2

SHA256
7f47ad5558c928bb06a8155975c08f623abb03ea028238efa1b293a77c733f20

SHA512
78608cf95a04385c7408e149b0de87d87e6677fc3e9f7c3cbd2188765ad32ca537868f4717f814d990ec726f33644f733e498db7f4a439a2826d9960e2a52ee2

Download Submit
C:\Windows\System\tPXqkpR.exe

Filesize
1.7MB

MD5
7ff9b20ca825d6143ba1b9a7674cfaae

SHA1
003b9e2835a4c006eb94232e585e62d84a6dac47

SHA256
3a1d90c8e07aaa6c380c8d064117d3f9b0651f64764d1aade907483dac32c360

SHA512
1f56a050a4dd62bf2c5ea6bfc129bfd1dee8587a89021d2dfa170eb96ff823d8aee7c5f6ba8c4ec4319e32c23b43e3636ce6d74a2a6831230e1970b1912db554

Download Submit
C:\Windows\System\trNVbSl.exe

Filesize
1.7MB

MD5
7f1e4b10661ba9774cbfbe638d2d5e2f

SHA1
85207f13cc39f88e288fe3fc8c6384959fa7869b

SHA256
90723f4e06b95cb39ab51ec26f1671a84745bf0f42de7e7d91dfe9eba8c2d688

SHA512
fd5e748dcf11d093b4ae78a7aafb77434d476f5465167d6d19ac2dab26006ef3ca37149d01498e3da3da49ac6c1ca8fec99c59604d9bf95397adc72cde33188c

Download Submit
C:\Windows\System\uIdwhIv.exe

Filesize
1.7MB

MD5
5a071a08a1bf8f4a107c8517aab14cc4

SHA1
36e2d14fa7f8ee05419ea3d0c1a7b7a9f073c318

SHA256
58ffbc518d372d46d149c5601d2388925c0f0602c4de4116be0afc4acc3de582

SHA512
bd78eb7a3e5159c02d1be70b74d02c64bd2d2fab19eecf08f33b10be73f0430af81193aade8e7df4daae9a787535933c85512111ee8cd72166bab65ce2e009f4

Download Submit
C:\Windows\System\zvyRauU.exe

Filesize
1.7MB

MD5
8f497dc78a8e1de641d9c23b77acfe21

SHA1
a4059075c1173acea6b40e39cd841502066e4a8a

SHA256
463747e0a32ea4e540307ca1fcad8e4fecd5798677c470a31ba92c95aa40032d

SHA512
82cca334420dd78f49c39dde80b260107bd9fe5fcdbfb2db4c67dead4d2afb2c28b028914a014f86018eda6a917f993deb99eb4ba30d90484c78a38f028867ed

Download Submit
memory/2360-0-0x0000019717470000-0x0000019717480000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads