xmrig | a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17

Analysis

max time kernel
133s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
Size

1.0MB
MD5

a046882d13ac6c3bd9eb08a002ab3c2c
SHA1

05b158d778da9637f03708deb40cdb59c869e080
SHA256

a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17
SHA512

f8fbd123370ab1ed1da9c40214e68a701013a8151cbf5e4c440a9ee3a5cb802c844310047cea243b9dee32028ba53cdb02e4c2d9e467f1599c9c7b819e5a2c32
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/ccJLb:GezaTF8FcNkNdfE0pZ9ozttwIRxh

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

Processes:

resource	yara_rule
behavioral2/files/0x000b000000023b74-4.dat	xmrig
behavioral2/files/0x000a000000023b79-8.dat	xmrig
behavioral2/files/0x000a000000023b78-10.dat	xmrig
behavioral2/files/0x000a000000023b7b-21.dat	xmrig
behavioral2/files/0x000a000000023b7d-32.dat	xmrig
behavioral2/files/0x000a000000023b88-87.dat	xmrig
behavioral2/files/0x000a000000023b8b-102.dat	xmrig
behavioral2/files/0x000a000000023b90-127.dat	xmrig
behavioral2/files/0x0008000000023bac-162.dat	xmrig
behavioral2/files/0x000a000000023b9c-160.dat	xmrig
behavioral2/files/0x000e000000023ba3-157.dat	xmrig
behavioral2/files/0x000b000000023b94-155.dat	xmrig
behavioral2/files/0x000b000000023b93-150.dat	xmrig
behavioral2/files/0x000b000000023b92-145.dat	xmrig
behavioral2/files/0x000a000000023b91-140.dat	xmrig
behavioral2/files/0x000a000000023b8f-130.dat	xmrig
behavioral2/files/0x000a000000023b8e-125.dat	xmrig
behavioral2/files/0x000a000000023b8d-120.dat	xmrig
behavioral2/files/0x000a000000023b8c-115.dat	xmrig
behavioral2/files/0x000a000000023b8a-105.dat	xmrig
behavioral2/files/0x000a000000023b89-100.dat	xmrig
behavioral2/files/0x000a000000023b87-90.dat	xmrig
behavioral2/files/0x000a000000023b86-85.dat	xmrig
behavioral2/files/0x000a000000023b85-80.dat	xmrig
behavioral2/files/0x000a000000023b84-75.dat	xmrig
behavioral2/files/0x000a000000023b83-70.dat	xmrig
behavioral2/files/0x000a000000023b82-65.dat	xmrig
behavioral2/files/0x000a000000023b81-60.dat	xmrig
behavioral2/files/0x000a000000023b80-55.dat	xmrig
behavioral2/files/0x000a000000023b7f-50.dat	xmrig
behavioral2/files/0x000a000000023b7e-45.dat	xmrig
behavioral2/files/0x000a000000023b7c-43.dat	xmrig
behavioral2/files/0x000a000000023b7a-29.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

BcSeNIZ.exeHKGKVEL.exelnmlgXF.exeVFXawTX.exetiEoRtu.exeUfMJzrU.exeLXknNyK.exeGcgUyZK.exeCeJdbDR.exevDnGDXh.exeUaKJvHw.exepaLpJEu.execJOJdkw.exeCCUPVUB.exedsjKVlY.exeJnbGPga.exeqivbrVc.exegJbokoQ.exefGLWLOd.exeWyXyqGg.exeNAxhheG.exeLTocNdt.exeIqiugeX.exeVGkmhyc.exemZhTwCn.exeHNDhzrZ.exedAOkhUa.exeaubWBQz.exeAivxazi.exeaJwqmKR.exeMYoauXV.exePdOaOwK.exesfPmBAo.exexXMCqOB.exeJqzdENE.exeOEXbDBZ.exeYlnacBy.exeeBeXyTM.exeMCOWODw.exebuxelpj.exeqkqwkfY.exeBMitIIE.exezNjCLfh.exeTfkcmva.exeZuRrfsI.exegsxoUFM.exemRkNYsB.exemeqHMfb.exeqFtVljY.exeoAKDkka.exeGopuonx.exeKREqLZF.exeizkxYON.exeJVLCySB.exeXMaPkzC.exexCNaMnF.exeRRezSQF.exemLcnDVv.exeMdGlvqy.exebZnerOz.exeOUvKPsm.exeqPHnnSh.exeyVeKvXy.exeeLYnlZu.exe

pid	Process
4504	BcSeNIZ.exe
3756	HKGKVEL.exe
2652	lnmlgXF.exe
4112	VFXawTX.exe
3800	tiEoRtu.exe
2060	UfMJzrU.exe
4312	LXknNyK.exe
3192	GcgUyZK.exe
4324	CeJdbDR.exe
2760	vDnGDXh.exe
1072	UaKJvHw.exe
2320	paLpJEu.exe
4028	cJOJdkw.exe
2880	CCUPVUB.exe
2312	dsjKVlY.exe
2672	JnbGPga.exe
4996	qivbrVc.exe
4072	gJbokoQ.exe
3956	fGLWLOd.exe
2704	WyXyqGg.exe
1252	NAxhheG.exe
2864	LTocNdt.exe
972	IqiugeX.exe
2008	VGkmhyc.exe
1080	mZhTwCn.exe
2620	HNDhzrZ.exe
2868	dAOkhUa.exe
1900	aubWBQz.exe
932	Aivxazi.exe
1460	aJwqmKR.exe
4792	MYoauXV.exe
4336	PdOaOwK.exe
3524	sfPmBAo.exe
4320	xXMCqOB.exe
3976	JqzdENE.exe
2648	OEXbDBZ.exe
1872	YlnacBy.exe
2248	eBeXyTM.exe
3032	MCOWODw.exe
4952	buxelpj.exe
704	qkqwkfY.exe
2508	BMitIIE.exe
2456	zNjCLfh.exe
3028	Tfkcmva.exe
4412	ZuRrfsI.exe
2296	gsxoUFM.exe
1936	mRkNYsB.exe
1404	meqHMfb.exe
2148	qFtVljY.exe
1828	oAKDkka.exe
760	Gopuonx.exe
4788	KREqLZF.exe
5008	izkxYON.exe
3488	JVLCySB.exe
2240	XMaPkzC.exe
1648	xCNaMnF.exe
816	RRezSQF.exe
3420	mLcnDVv.exe
3148	MdGlvqy.exe
452	bZnerOz.exe
2072	OUvKPsm.exe
1892	qPHnnSh.exe
2960	yVeKvXy.exe
3328	eLYnlZu.exe

Drops file in Windows directory 64 IoCs

Processes:

a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe

description	ioc	Process
File created	C:\Windows\System\ZAXcjTR.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\iDrirdL.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\jqVbraU.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\qUQNwDf.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\lirErsr.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\ERHtAht.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\XqNSWjl.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\MFTGRuw.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\tiEoRtu.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\cJOJdkw.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\BhLvzTC.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\LEpvvcE.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\ysLeUMd.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\TtwypfS.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\YmeclXf.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\IzAQAuQ.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\pTOzffG.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\vDnGDXh.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\NAxhheG.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\YxrtdeJ.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\jDOxidD.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\SwyzkMz.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\mJartzs.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\LHNgiQD.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\JwzhjcV.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\lrcTNzZ.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\dVikVaZ.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\kEmlrRt.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\LRBiLLv.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\ohLCihR.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\OTKMWUb.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\mcjtUVG.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\cEkhVjQ.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\aGsxVFX.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\HeBqxsc.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\zBczKbL.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\WkelWWZ.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\JGQRnbv.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\BESCubo.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\nQFsFOp.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\chcjzVW.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\tsvhOdi.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\jVWBQXt.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\PdOaOwK.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\HvMykje.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\GTjeLwz.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\bzxCjwS.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\oMwNxvF.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\aDTvWcw.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\RNkdWNS.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\uQsEXIv.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\XjJnDsS.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\vuwTFEO.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\MYoauXV.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\meqHMfb.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\DynRXSR.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\NcwOWGm.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\SHkVexQ.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\gsxoUFM.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\qTstiHP.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\myXswrG.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\VFXawTX.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\vNpQbSv.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
File created	C:\Windows\System\lpAZMGX.exe	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

dwm.exe

description	pid	Process
Token: SeCreateGlobalPrivilege	17364	dwm.exe
Token: SeChangeNotifyPrivilege	17364	dwm.exe
Token: 33	17364	dwm.exe
Token: SeIncBasePriorityPrivilege	17364	dwm.exe
Token: SeShutdownPrivilege	17364	dwm.exe
Token: SeCreatePagefilePrivilege	17364	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe

description	pid	Process	procid_target
PID 1356 wrote to memory of 4504	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	84
PID 1356 wrote to memory of 4504	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	84
PID 1356 wrote to memory of 3756	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	85
PID 1356 wrote to memory of 3756	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	85
PID 1356 wrote to memory of 2652	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	86
PID 1356 wrote to memory of 2652	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	86
PID 1356 wrote to memory of 3800	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	87
PID 1356 wrote to memory of 3800	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	87
PID 1356 wrote to memory of 4112	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	88
PID 1356 wrote to memory of 4112	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	88
PID 1356 wrote to memory of 2060	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	89
PID 1356 wrote to memory of 2060	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	89
PID 1356 wrote to memory of 4312	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	90
PID 1356 wrote to memory of 4312	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	90
PID 1356 wrote to memory of 3192	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	91
PID 1356 wrote to memory of 3192	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	91
PID 1356 wrote to memory of 4324	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	92
PID 1356 wrote to memory of 4324	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	92
PID 1356 wrote to memory of 2760	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	93
PID 1356 wrote to memory of 2760	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	93
PID 1356 wrote to memory of 1072	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	94
PID 1356 wrote to memory of 1072	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	94
PID 1356 wrote to memory of 2320	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	95
PID 1356 wrote to memory of 2320	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	95
PID 1356 wrote to memory of 4028	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	96
PID 1356 wrote to memory of 4028	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	96
PID 1356 wrote to memory of 2880	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	97
PID 1356 wrote to memory of 2880	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	97
PID 1356 wrote to memory of 2312	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	98
PID 1356 wrote to memory of 2312	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	98
PID 1356 wrote to memory of 2672	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	99
PID 1356 wrote to memory of 2672	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	99
PID 1356 wrote to memory of 4996	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	100
PID 1356 wrote to memory of 4996	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	100
PID 1356 wrote to memory of 4072	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	101
PID 1356 wrote to memory of 4072	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	101
PID 1356 wrote to memory of 3956	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	102
PID 1356 wrote to memory of 3956	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	102
PID 1356 wrote to memory of 2704	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	103
PID 1356 wrote to memory of 2704	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	103
PID 1356 wrote to memory of 1252	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	104
PID 1356 wrote to memory of 1252	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	104
PID 1356 wrote to memory of 2864	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	105
PID 1356 wrote to memory of 2864	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	105
PID 1356 wrote to memory of 972	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	106
PID 1356 wrote to memory of 972	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	106
PID 1356 wrote to memory of 2008	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	107
PID 1356 wrote to memory of 2008	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	107
PID 1356 wrote to memory of 1080	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	108
PID 1356 wrote to memory of 1080	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	108
PID 1356 wrote to memory of 2620	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	109
PID 1356 wrote to memory of 2620	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	109
PID 1356 wrote to memory of 2868	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	110
PID 1356 wrote to memory of 2868	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	110
PID 1356 wrote to memory of 1900	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	111
PID 1356 wrote to memory of 1900	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	111
PID 1356 wrote to memory of 932	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	112
PID 1356 wrote to memory of 932	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	112
PID 1356 wrote to memory of 1460	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	113
PID 1356 wrote to memory of 1460	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	113
PID 1356 wrote to memory of 4792	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	114
PID 1356 wrote to memory of 4792	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	114
PID 1356 wrote to memory of 4336	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	115
PID 1356 wrote to memory of 4336	1356	a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe	115

C:\Users\Admin\AppData\Local\Temp\a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe
"C:\Users\Admin\AppData\Local\Temp\a3749d4d4f85925ded28f0a0f7ea793c8c9e612bff8f81c1bb29054f37bb9f17.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\System\BcSeNIZ.exe
  C:\Windows\System\BcSeNIZ.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\HKGKVEL.exe
  C:\Windows\System\HKGKVEL.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\lnmlgXF.exe
  C:\Windows\System\lnmlgXF.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\tiEoRtu.exe
  C:\Windows\System\tiEoRtu.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\VFXawTX.exe
  C:\Windows\System\VFXawTX.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\UfMJzrU.exe
  C:\Windows\System\UfMJzrU.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\LXknNyK.exe
  C:\Windows\System\LXknNyK.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\GcgUyZK.exe
  C:\Windows\System\GcgUyZK.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\CeJdbDR.exe
  C:\Windows\System\CeJdbDR.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\vDnGDXh.exe
  C:\Windows\System\vDnGDXh.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\UaKJvHw.exe
  C:\Windows\System\UaKJvHw.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\paLpJEu.exe
  C:\Windows\System\paLpJEu.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\cJOJdkw.exe
  C:\Windows\System\cJOJdkw.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\CCUPVUB.exe
  C:\Windows\System\CCUPVUB.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\dsjKVlY.exe
  C:\Windows\System\dsjKVlY.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\JnbGPga.exe
  C:\Windows\System\JnbGPga.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\qivbrVc.exe
  C:\Windows\System\qivbrVc.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\gJbokoQ.exe
  C:\Windows\System\gJbokoQ.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\fGLWLOd.exe
  C:\Windows\System\fGLWLOd.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\WyXyqGg.exe
  C:\Windows\System\WyXyqGg.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\NAxhheG.exe
  C:\Windows\System\NAxhheG.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\LTocNdt.exe
  C:\Windows\System\LTocNdt.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\IqiugeX.exe
  C:\Windows\System\IqiugeX.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\VGkmhyc.exe
  C:\Windows\System\VGkmhyc.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\mZhTwCn.exe
  C:\Windows\System\mZhTwCn.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\HNDhzrZ.exe
  C:\Windows\System\HNDhzrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\dAOkhUa.exe
  C:\Windows\System\dAOkhUa.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\aubWBQz.exe
  C:\Windows\System\aubWBQz.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\Aivxazi.exe
  C:\Windows\System\Aivxazi.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\aJwqmKR.exe
  C:\Windows\System\aJwqmKR.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\MYoauXV.exe
  C:\Windows\System\MYoauXV.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\PdOaOwK.exe
  C:\Windows\System\PdOaOwK.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\sfPmBAo.exe
  C:\Windows\System\sfPmBAo.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\xXMCqOB.exe
  C:\Windows\System\xXMCqOB.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\JqzdENE.exe
  C:\Windows\System\JqzdENE.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\OEXbDBZ.exe
  C:\Windows\System\OEXbDBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\YlnacBy.exe
  C:\Windows\System\YlnacBy.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\eBeXyTM.exe
  C:\Windows\System\eBeXyTM.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\MCOWODw.exe
  C:\Windows\System\MCOWODw.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\buxelpj.exe
  C:\Windows\System\buxelpj.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\qkqwkfY.exe
  C:\Windows\System\qkqwkfY.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\BMitIIE.exe
  C:\Windows\System\BMitIIE.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\zNjCLfh.exe
  C:\Windows\System\zNjCLfh.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\Tfkcmva.exe
  C:\Windows\System\Tfkcmva.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\ZuRrfsI.exe
  C:\Windows\System\ZuRrfsI.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\gsxoUFM.exe
  C:\Windows\System\gsxoUFM.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\mRkNYsB.exe
  C:\Windows\System\mRkNYsB.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\meqHMfb.exe
  C:\Windows\System\meqHMfb.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\qFtVljY.exe
  C:\Windows\System\qFtVljY.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\oAKDkka.exe
  C:\Windows\System\oAKDkka.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\Gopuonx.exe
  C:\Windows\System\Gopuonx.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\KREqLZF.exe
  C:\Windows\System\KREqLZF.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\izkxYON.exe
  C:\Windows\System\izkxYON.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\JVLCySB.exe
  C:\Windows\System\JVLCySB.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\XMaPkzC.exe
  C:\Windows\System\XMaPkzC.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\xCNaMnF.exe
  C:\Windows\System\xCNaMnF.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\RRezSQF.exe
  C:\Windows\System\RRezSQF.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\mLcnDVv.exe
  C:\Windows\System\mLcnDVv.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\MdGlvqy.exe
  C:\Windows\System\MdGlvqy.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\bZnerOz.exe
  C:\Windows\System\bZnerOz.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\OUvKPsm.exe
  C:\Windows\System\OUvKPsm.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\qPHnnSh.exe
  C:\Windows\System\qPHnnSh.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\yVeKvXy.exe
  C:\Windows\System\yVeKvXy.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\eLYnlZu.exe
  C:\Windows\System\eLYnlZu.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\JwzhjcV.exe
  C:\Windows\System\JwzhjcV.exe
  2⤵
  PID:3164
- C:\Windows\System\NbYIfNz.exe
  C:\Windows\System\NbYIfNz.exe
  2⤵
  PID:2532
- C:\Windows\System\eZZYJDQ.exe
  C:\Windows\System\eZZYJDQ.exe
  2⤵
  PID:2900
- C:\Windows\System\fwOTzQP.exe
  C:\Windows\System\fwOTzQP.exe
  2⤵
  PID:4344
- C:\Windows\System\wrUXXdB.exe
  C:\Windows\System\wrUXXdB.exe
  2⤵
  PID:5144
- C:\Windows\System\epzzvKG.exe
  C:\Windows\System\epzzvKG.exe
  2⤵
  PID:5168
- C:\Windows\System\czbmPjj.exe
  C:\Windows\System\czbmPjj.exe
  2⤵
  PID:5200
- C:\Windows\System\MRtZjyf.exe
  C:\Windows\System\MRtZjyf.exe
  2⤵
  PID:5224
- C:\Windows\System\mHkPLwm.exe
  C:\Windows\System\mHkPLwm.exe
  2⤵
  PID:5256
- C:\Windows\System\DynRXSR.exe
  C:\Windows\System\DynRXSR.exe
  2⤵
  PID:5284
- C:\Windows\System\yONhySi.exe
  C:\Windows\System\yONhySi.exe
  2⤵
  PID:5308
- C:\Windows\System\DKuQvZk.exe
  C:\Windows\System\DKuQvZk.exe
  2⤵
  PID:5340
- C:\Windows\System\TCeTlsd.exe
  C:\Windows\System\TCeTlsd.exe
  2⤵
  PID:5364
- C:\Windows\System\mzztZmm.exe
  C:\Windows\System\mzztZmm.exe
  2⤵
  PID:5396
- C:\Windows\System\kSpgWct.exe
  C:\Windows\System\kSpgWct.exe
  2⤵
  PID:5420
- C:\Windows\System\qCrbNiF.exe
  C:\Windows\System\qCrbNiF.exe
  2⤵
  PID:5452
- C:\Windows\System\WaYWTSX.exe
  C:\Windows\System\WaYWTSX.exe
  2⤵
  PID:5476
- C:\Windows\System\NcwOWGm.exe
  C:\Windows\System\NcwOWGm.exe
  2⤵
  PID:5508
- C:\Windows\System\VrmirFs.exe
  C:\Windows\System\VrmirFs.exe
  2⤵
  PID:5532
- C:\Windows\System\CqHaEUi.exe
  C:\Windows\System\CqHaEUi.exe
  2⤵
  PID:5564
- C:\Windows\System\VCjowEN.exe
  C:\Windows\System\VCjowEN.exe
  2⤵
  PID:5588
- C:\Windows\System\ZAXcjTR.exe
  C:\Windows\System\ZAXcjTR.exe
  2⤵
  PID:5620
- C:\Windows\System\zqmIaNc.exe
  C:\Windows\System\zqmIaNc.exe
  2⤵
  PID:5648
- C:\Windows\System\StwSAca.exe
  C:\Windows\System\StwSAca.exe
  2⤵
  PID:5672
- C:\Windows\System\qLJhfwk.exe
  C:\Windows\System\qLJhfwk.exe
  2⤵
  PID:5704
- C:\Windows\System\yFSwtTI.exe
  C:\Windows\System\yFSwtTI.exe
  2⤵
  PID:5728
- C:\Windows\System\jiNdeZj.exe
  C:\Windows\System\jiNdeZj.exe
  2⤵
  PID:5756
- C:\Windows\System\JbURnMl.exe
  C:\Windows\System\JbURnMl.exe
  2⤵
  PID:5784
- C:\Windows\System\obWLOHE.exe
  C:\Windows\System\obWLOHE.exe
  2⤵
  PID:5816
- C:\Windows\System\fnZlNBy.exe
  C:\Windows\System\fnZlNBy.exe
  2⤵
  PID:5844
- C:\Windows\System\vCTQxDQ.exe
  C:\Windows\System\vCTQxDQ.exe
  2⤵
  PID:5872
- C:\Windows\System\ankZEhV.exe
  C:\Windows\System\ankZEhV.exe
  2⤵
  PID:5896
- C:\Windows\System\BESCubo.exe
  C:\Windows\System\BESCubo.exe
  2⤵
  PID:5924
- C:\Windows\System\PnGlXbS.exe
  C:\Windows\System\PnGlXbS.exe
  2⤵
  PID:5952
- C:\Windows\System\uLlZBaE.exe
  C:\Windows\System\uLlZBaE.exe
  2⤵
  PID:5984
- C:\Windows\System\HvMykje.exe
  C:\Windows\System\HvMykje.exe
  2⤵
  PID:6012
- C:\Windows\System\Aohmxtn.exe
  C:\Windows\System\Aohmxtn.exe
  2⤵
  PID:6036
- C:\Windows\System\VoPIdol.exe
  C:\Windows\System\VoPIdol.exe
  2⤵
  PID:6064
- C:\Windows\System\ppBypVH.exe
  C:\Windows\System\ppBypVH.exe
  2⤵
  PID:6092
- C:\Windows\System\hPaQXVR.exe
  C:\Windows\System\hPaQXVR.exe
  2⤵
  PID:6124
- C:\Windows\System\ChJYwBL.exe
  C:\Windows\System\ChJYwBL.exe
  2⤵
  PID:3760
- C:\Windows\System\aDTvWcw.exe
  C:\Windows\System\aDTvWcw.exe
  2⤵
  PID:2912
- C:\Windows\System\qeouLsf.exe
  C:\Windows\System\qeouLsf.exe
  2⤵
  PID:2628
- C:\Windows\System\ZbkxpqW.exe
  C:\Windows\System\ZbkxpqW.exe
  2⤵
  PID:4132
- C:\Windows\System\uZdqyHi.exe
  C:\Windows\System\uZdqyHi.exe
  2⤵
  PID:2940
- C:\Windows\System\EBKdJkb.exe
  C:\Windows\System\EBKdJkb.exe
  2⤵
  PID:344
- C:\Windows\System\fUxAnfB.exe
  C:\Windows\System\fUxAnfB.exe
  2⤵
  PID:3700
- C:\Windows\System\QOofvOw.exe
  C:\Windows\System\QOofvOw.exe
  2⤵
  PID:5156
- C:\Windows\System\bXVkxqC.exe
  C:\Windows\System\bXVkxqC.exe
  2⤵
  PID:5220
- C:\Windows\System\hxHSres.exe
  C:\Windows\System\hxHSres.exe
  2⤵
  PID:5300
- C:\Windows\System\jXIHUyk.exe
  C:\Windows\System\jXIHUyk.exe
  2⤵
  PID:5356
- C:\Windows\System\gXPadFT.exe
  C:\Windows\System\gXPadFT.exe
  2⤵
  PID:5432
- C:\Windows\System\XiULVii.exe
  C:\Windows\System\XiULVii.exe
  2⤵
  PID:5488
- C:\Windows\System\tAlzkDA.exe
  C:\Windows\System\tAlzkDA.exe
  2⤵
  PID:5548
- C:\Windows\System\aEmQGbt.exe
  C:\Windows\System\aEmQGbt.exe
  2⤵
  PID:5600
- C:\Windows\System\hrZkTpg.exe
  C:\Windows\System\hrZkTpg.exe
  2⤵
  PID:5664
- C:\Windows\System\JCmAhfM.exe
  C:\Windows\System\JCmAhfM.exe
  2⤵
  PID:5724
- C:\Windows\System\roliTrw.exe
  C:\Windows\System\roliTrw.exe
  2⤵
  PID:5796
- C:\Windows\System\jgmhKdF.exe
  C:\Windows\System\jgmhKdF.exe
  2⤵
  PID:5852
- C:\Windows\System\eGFQWOO.exe
  C:\Windows\System\eGFQWOO.exe
  2⤵
  PID:5912
- C:\Windows\System\uHKsEYh.exe
  C:\Windows\System\uHKsEYh.exe
  2⤵
  PID:5968
- C:\Windows\System\vNpQbSv.exe
  C:\Windows\System\vNpQbSv.exe
  2⤵
  PID:6032
- C:\Windows\System\TJsAhSx.exe
  C:\Windows\System\TJsAhSx.exe
  2⤵
  PID:3172
- C:\Windows\System\WlcGBUU.exe
  C:\Windows\System\WlcGBUU.exe
  2⤵
  PID:1464
- C:\Windows\System\xkVFPOE.exe
  C:\Windows\System\xkVFPOE.exe
  2⤵
  PID:3112
- C:\Windows\System\CLGdkdJ.exe
  C:\Windows\System\CLGdkdJ.exe
  2⤵
  PID:2440
- C:\Windows\System\WEDtGME.exe
  C:\Windows\System\WEDtGME.exe
  2⤵
  PID:3988
- C:\Windows\System\eSNPLRf.exe
  C:\Windows\System\eSNPLRf.exe
  2⤵
  PID:5152
- C:\Windows\System\JAvKeXF.exe
  C:\Windows\System\JAvKeXF.exe
  2⤵
  PID:5320
- C:\Windows\System\zuPYJRW.exe
  C:\Windows\System\zuPYJRW.exe
  2⤵
  PID:5384
- C:\Windows\System\xZScblA.exe
  C:\Windows\System\xZScblA.exe
  2⤵
  PID:3836
- C:\Windows\System\dVikVaZ.exe
  C:\Windows\System\dVikVaZ.exe
  2⤵
  PID:1868
- C:\Windows\System\dnspMeH.exe
  C:\Windows\System\dnspMeH.exe
  2⤵
  PID:5772
- C:\Windows\System\UqyWzHD.exe
  C:\Windows\System\UqyWzHD.exe
  2⤵
  PID:3368
- C:\Windows\System\mcjtUVG.exe
  C:\Windows\System\mcjtUVG.exe
  2⤵
  PID:5084
- C:\Windows\System\pCHnQBs.exe
  C:\Windows\System\pCHnQBs.exe
  2⤵
  PID:216
- C:\Windows\System\HDKDgbL.exe
  C:\Windows\System\HDKDgbL.exe
  2⤵
  PID:2664
- C:\Windows\System\iksUniO.exe
  C:\Windows\System\iksUniO.exe
  2⤵
  PID:1496
- C:\Windows\System\vwJzVaF.exe
  C:\Windows\System\vwJzVaF.exe
  2⤵
  PID:1504
- C:\Windows\System\JavuSLZ.exe
  C:\Windows\System\JavuSLZ.exe
  2⤵
  PID:1944
- C:\Windows\System\OVnZKIl.exe
  C:\Windows\System\OVnZKIl.exe
  2⤵
  PID:2708
- C:\Windows\System\sHtKpEZ.exe
  C:\Windows\System\sHtKpEZ.exe
  2⤵
  PID:6108
- C:\Windows\System\FFxNykr.exe
  C:\Windows\System\FFxNykr.exe
  2⤵
  PID:4088
- C:\Windows\System\HNtfFUX.exe
  C:\Windows\System\HNtfFUX.exe
  2⤵
  PID:2944
- C:\Windows\System\zOUqbdB.exe
  C:\Windows\System\zOUqbdB.exe
  2⤵
  PID:4424
- C:\Windows\System\qNjpEso.exe
  C:\Windows\System\qNjpEso.exe
  2⤵
  PID:2220
- C:\Windows\System\NWnjBJZ.exe
  C:\Windows\System\NWnjBJZ.exe
  2⤵
  PID:2016
- C:\Windows\System\RNkdWNS.exe
  C:\Windows\System\RNkdWNS.exe
  2⤵
  PID:5892
- C:\Windows\System\aUCvwBs.exe
  C:\Windows\System\aUCvwBs.exe
  2⤵
  PID:820
- C:\Windows\System\cmBirzE.exe
  C:\Windows\System\cmBirzE.exe
  2⤵
  PID:2012
- C:\Windows\System\ShDFKGV.exe
  C:\Windows\System\ShDFKGV.exe
  2⤵
  PID:1976
- C:\Windows\System\kEmlrRt.exe
  C:\Windows\System\kEmlrRt.exe
  2⤵
  PID:4892
- C:\Windows\System\rJRaXzE.exe
  C:\Windows\System\rJRaXzE.exe
  2⤵
  PID:5036
- C:\Windows\System\dFzAyii.exe
  C:\Windows\System\dFzAyii.exe
  2⤵
  PID:5440
- C:\Windows\System\iDrirdL.exe
  C:\Windows\System\iDrirdL.exe
  2⤵
  PID:4900
- C:\Windows\System\nutfRui.exe
  C:\Windows\System\nutfRui.exe
  2⤵
  PID:1644
- C:\Windows\System\viLSmQO.exe
  C:\Windows\System\viLSmQO.exe
  2⤵
  PID:840
- C:\Windows\System\flXzVoM.exe
  C:\Windows\System\flXzVoM.exe
  2⤵
  PID:3304
- C:\Windows\System\gtCUCqU.exe
  C:\Windows\System\gtCUCqU.exe
  2⤵
  PID:6104
- C:\Windows\System\IDmSjTG.exe
  C:\Windows\System\IDmSjTG.exe
  2⤵
  PID:5244
- C:\Windows\System\ipCceAh.exe
  C:\Windows\System\ipCceAh.exe
  2⤵
  PID:528
- C:\Windows\System\YjKbSKJ.exe
  C:\Windows\System\YjKbSKJ.exe
  2⤵
  PID:1996
- C:\Windows\System\TwSwaQu.exe
  C:\Windows\System\TwSwaQu.exe
  2⤵
  PID:3204
- C:\Windows\System\cZmxxdT.exe
  C:\Windows\System\cZmxxdT.exe
  2⤵
  PID:2376
- C:\Windows\System\BBmNKUV.exe
  C:\Windows\System\BBmNKUV.exe
  2⤵
  PID:6152
- C:\Windows\System\RdDEMIE.exe
  C:\Windows\System\RdDEMIE.exe
  2⤵
  PID:6176
- C:\Windows\System\XRcVgNx.exe
  C:\Windows\System\XRcVgNx.exe
  2⤵
  PID:6196
- C:\Windows\System\fulXPOc.exe
  C:\Windows\System\fulXPOc.exe
  2⤵
  PID:6220
- C:\Windows\System\VhAfGqJ.exe
  C:\Windows\System\VhAfGqJ.exe
  2⤵
  PID:6276
- C:\Windows\System\kmXDwoh.exe
  C:\Windows\System\kmXDwoh.exe
  2⤵
  PID:6296
- C:\Windows\System\kUfPxPw.exe
  C:\Windows\System\kUfPxPw.exe
  2⤵
  PID:6320
- C:\Windows\System\ceRVXhf.exe
  C:\Windows\System\ceRVXhf.exe
  2⤵
  PID:6360
- C:\Windows\System\BYmDXLg.exe
  C:\Windows\System\BYmDXLg.exe
  2⤵
  PID:6392
- C:\Windows\System\bzzTVnP.exe
  C:\Windows\System\bzzTVnP.exe
  2⤵
  PID:6416
- C:\Windows\System\fEirfdI.exe
  C:\Windows\System\fEirfdI.exe
  2⤵
  PID:6432
- C:\Windows\System\XgLUtEf.exe
  C:\Windows\System\XgLUtEf.exe
  2⤵
  PID:6452
- C:\Windows\System\auXYqJt.exe
  C:\Windows\System\auXYqJt.exe
  2⤵
  PID:6484
- C:\Windows\System\sfPoPWb.exe
  C:\Windows\System\sfPoPWb.exe
  2⤵
  PID:6500
- C:\Windows\System\UnoxjrD.exe
  C:\Windows\System\UnoxjrD.exe
  2⤵
  PID:6528
- C:\Windows\System\LaoEaqE.exe
  C:\Windows\System\LaoEaqE.exe
  2⤵
  PID:6560
- C:\Windows\System\avQgzsi.exe
  C:\Windows\System\avQgzsi.exe
  2⤵
  PID:6612
- C:\Windows\System\RTJrPNj.exe
  C:\Windows\System\RTJrPNj.exe
  2⤵
  PID:6628
- C:\Windows\System\YwqpIfy.exe
  C:\Windows\System\YwqpIfy.exe
  2⤵
  PID:6656
- C:\Windows\System\FWLizUY.exe
  C:\Windows\System\FWLizUY.exe
  2⤵
  PID:6676
- C:\Windows\System\QoztMcV.exe
  C:\Windows\System\QoztMcV.exe
  2⤵
  PID:6704
- C:\Windows\System\cfHtmsV.exe
  C:\Windows\System\cfHtmsV.exe
  2⤵
  PID:6728
- C:\Windows\System\EomyinH.exe
  C:\Windows\System\EomyinH.exe
  2⤵
  PID:6752
- C:\Windows\System\AazrAbf.exe
  C:\Windows\System\AazrAbf.exe
  2⤵
  PID:6784
- C:\Windows\System\wnYaKhP.exe
  C:\Windows\System\wnYaKhP.exe
  2⤵
  PID:6808
- C:\Windows\System\NbPwuaT.exe
  C:\Windows\System\NbPwuaT.exe
  2⤵
  PID:6836
- C:\Windows\System\cCDVivN.exe
  C:\Windows\System\cCDVivN.exe
  2⤵
  PID:6860
- C:\Windows\System\xXBwdge.exe
  C:\Windows\System\xXBwdge.exe
  2⤵
  PID:6888
- C:\Windows\System\keKARIJ.exe
  C:\Windows\System\keKARIJ.exe
  2⤵
  PID:6916
- C:\Windows\System\lrcTNzZ.exe
  C:\Windows\System\lrcTNzZ.exe
  2⤵
  PID:6940
- C:\Windows\System\uAHcFSo.exe
  C:\Windows\System\uAHcFSo.exe
  2⤵
  PID:6968
- C:\Windows\System\UaaefOg.exe
  C:\Windows\System\UaaefOg.exe
  2⤵
  PID:7012
- C:\Windows\System\ZiVcLrK.exe
  C:\Windows\System\ZiVcLrK.exe
  2⤵
  PID:7060
- C:\Windows\System\cszCnJC.exe
  C:\Windows\System\cszCnJC.exe
  2⤵
  PID:7076
- C:\Windows\System\YcFnXrT.exe
  C:\Windows\System\YcFnXrT.exe
  2⤵
  PID:7096
- C:\Windows\System\zhBwLqw.exe
  C:\Windows\System\zhBwLqw.exe
  2⤵
  PID:7120
- C:\Windows\System\JjoeAOv.exe
  C:\Windows\System\JjoeAOv.exe
  2⤵
  PID:428
- C:\Windows\System\jQGczzq.exe
  C:\Windows\System\jQGczzq.exe
  2⤵
  PID:6188
- C:\Windows\System\atKPCBo.exe
  C:\Windows\System\atKPCBo.exe
  2⤵
  PID:6244
- C:\Windows\System\qExYMYi.exe
  C:\Windows\System\qExYMYi.exe
  2⤵
  PID:6288
- C:\Windows\System\hoypvgv.exe
  C:\Windows\System\hoypvgv.exe
  2⤵
  PID:6356
- C:\Windows\System\ZREpEhZ.exe
  C:\Windows\System\ZREpEhZ.exe
  2⤵
  PID:4256
- C:\Windows\System\jgWyOHL.exe
  C:\Windows\System\jgWyOHL.exe
  2⤵
  PID:6400
- C:\Windows\System\gcfcURn.exe
  C:\Windows\System\gcfcURn.exe
  2⤵
  PID:6440
- C:\Windows\System\kPVaWaq.exe
  C:\Windows\System\kPVaWaq.exe
  2⤵
  PID:6572
- C:\Windows\System\IiRPyFu.exe
  C:\Windows\System\IiRPyFu.exe
  2⤵
  PID:6600
- C:\Windows\System\XNtbbmZ.exe
  C:\Windows\System\XNtbbmZ.exe
  2⤵
  PID:6672
- C:\Windows\System\bSCqFyu.exe
  C:\Windows\System\bSCqFyu.exe
  2⤵
  PID:6768
- C:\Windows\System\PdZvruU.exe
  C:\Windows\System\PdZvruU.exe
  2⤵
  PID:6868
- C:\Windows\System\DKamtyt.exe
  C:\Windows\System\DKamtyt.exe
  2⤵
  PID:6884
- C:\Windows\System\oHYcTyY.exe
  C:\Windows\System\oHYcTyY.exe
  2⤵
  PID:6912
- C:\Windows\System\HIdeunR.exe
  C:\Windows\System\HIdeunR.exe
  2⤵
  PID:7008
- C:\Windows\System\YJWxMPJ.exe
  C:\Windows\System\YJWxMPJ.exe
  2⤵
  PID:7072
- C:\Windows\System\SPiQadJ.exe
  C:\Windows\System\SPiQadJ.exe
  2⤵
  PID:7116
- C:\Windows\System\JIARnVl.exe
  C:\Windows\System\JIARnVl.exe
  2⤵
  PID:4524
- C:\Windows\System\ZTpYbbf.exe
  C:\Windows\System\ZTpYbbf.exe
  2⤵
  PID:6316
- C:\Windows\System\drtjrKc.exe
  C:\Windows\System\drtjrKc.exe
  2⤵
  PID:4188
- C:\Windows\System\ZBgAXgv.exe
  C:\Windows\System\ZBgAXgv.exe
  2⤵
  PID:6408
- C:\Windows\System\JpXpnZK.exe
  C:\Windows\System\JpXpnZK.exe
  2⤵
  PID:6644
- C:\Windows\System\pRYTERE.exe
  C:\Windows\System\pRYTERE.exe
  2⤵
  PID:6824
- C:\Windows\System\SoTljzp.exe
  C:\Windows\System\SoTljzp.exe
  2⤵
  PID:7024
- C:\Windows\System\QqxlhWc.exe
  C:\Windows\System\QqxlhWc.exe
  2⤵
  PID:6212
- C:\Windows\System\gurJJdv.exe
  C:\Windows\System\gurJJdv.exe
  2⤵
  PID:6540
- C:\Windows\System\SZSwjBP.exe
  C:\Windows\System\SZSwjBP.exe
  2⤵
  PID:6748
- C:\Windows\System\FQAGXFm.exe
  C:\Windows\System\FQAGXFm.exe
  2⤵
  PID:6928
- C:\Windows\System\mvrrObJ.exe
  C:\Windows\System\mvrrObJ.exe
  2⤵
  PID:7184
- C:\Windows\System\uJniFJh.exe
  C:\Windows\System\uJniFJh.exe
  2⤵
  PID:7212
- C:\Windows\System\FlXtbNF.exe
  C:\Windows\System\FlXtbNF.exe
  2⤵
  PID:7236
- C:\Windows\System\zryHWNV.exe
  C:\Windows\System\zryHWNV.exe
  2⤵
  PID:7256
- C:\Windows\System\lCNVtKu.exe
  C:\Windows\System\lCNVtKu.exe
  2⤵
  PID:7284
- C:\Windows\System\RHDjmZX.exe
  C:\Windows\System\RHDjmZX.exe
  2⤵
  PID:7328
- C:\Windows\System\rZdLKDj.exe
  C:\Windows\System\rZdLKDj.exe
  2⤵
  PID:7352
- C:\Windows\System\vJcDniZ.exe
  C:\Windows\System\vJcDniZ.exe
  2⤵
  PID:7384
- C:\Windows\System\jrSncIA.exe
  C:\Windows\System\jrSncIA.exe
  2⤵
  PID:7412
- C:\Windows\System\ImfOrXh.exe
  C:\Windows\System\ImfOrXh.exe
  2⤵
  PID:7432
- C:\Windows\System\uBclaIj.exe
  C:\Windows\System\uBclaIj.exe
  2⤵
  PID:7456
- C:\Windows\System\cBeAnkU.exe
  C:\Windows\System\cBeAnkU.exe
  2⤵
  PID:7480
- C:\Windows\System\sOryRSp.exe
  C:\Windows\System\sOryRSp.exe
  2⤵
  PID:7552
- C:\Windows\System\OjHvFqB.exe
  C:\Windows\System\OjHvFqB.exe
  2⤵
  PID:7588
- C:\Windows\System\wKaDpzt.exe
  C:\Windows\System\wKaDpzt.exe
  2⤵
  PID:7604
- C:\Windows\System\GQLinPi.exe
  C:\Windows\System\GQLinPi.exe
  2⤵
  PID:7628
- C:\Windows\System\CfIDjSX.exe
  C:\Windows\System\CfIDjSX.exe
  2⤵
  PID:7656
- C:\Windows\System\jqVbraU.exe
  C:\Windows\System\jqVbraU.exe
  2⤵
  PID:7688
- C:\Windows\System\luDdfLV.exe
  C:\Windows\System\luDdfLV.exe
  2⤵
  PID:7724
- C:\Windows\System\gvoNlIz.exe
  C:\Windows\System\gvoNlIz.exe
  2⤵
  PID:7756
- C:\Windows\System\qYrMXYm.exe
  C:\Windows\System\qYrMXYm.exe
  2⤵
  PID:7772
- C:\Windows\System\dzWiVuk.exe
  C:\Windows\System\dzWiVuk.exe
  2⤵
  PID:7796
- C:\Windows\System\gEJTwNT.exe
  C:\Windows\System\gEJTwNT.exe
  2⤵
  PID:7816
- C:\Windows\System\UpRzSiQ.exe
  C:\Windows\System\UpRzSiQ.exe
  2⤵
  PID:7864
- C:\Windows\System\aeTaAeP.exe
  C:\Windows\System\aeTaAeP.exe
  2⤵
  PID:7888
- C:\Windows\System\AsTETLf.exe
  C:\Windows\System\AsTETLf.exe
  2⤵
  PID:7908
- C:\Windows\System\grbFJMZ.exe
  C:\Windows\System\grbFJMZ.exe
  2⤵
  PID:7928
- C:\Windows\System\VtQYcBv.exe
  C:\Windows\System\VtQYcBv.exe
  2⤵
  PID:7956
- C:\Windows\System\KLWOPOA.exe
  C:\Windows\System\KLWOPOA.exe
  2⤵
  PID:7980
- C:\Windows\System\YmeclXf.exe
  C:\Windows\System\YmeclXf.exe
  2⤵
  PID:8008
- C:\Windows\System\ItVjlSt.exe
  C:\Windows\System\ItVjlSt.exe
  2⤵
  PID:8032
- C:\Windows\System\JSboVhh.exe
  C:\Windows\System\JSboVhh.exe
  2⤵
  PID:8084
- C:\Windows\System\GDsAXam.exe
  C:\Windows\System\GDsAXam.exe
  2⤵
  PID:8112
- C:\Windows\System\dFKDGNB.exe
  C:\Windows\System\dFKDGNB.exe
  2⤵
  PID:8132
- C:\Windows\System\NUYsUdP.exe
  C:\Windows\System\NUYsUdP.exe
  2⤵
  PID:8164
- C:\Windows\System\qTWHUgc.exe
  C:\Windows\System\qTWHUgc.exe
  2⤵
  PID:3492
- C:\Windows\System\DkVFBmp.exe
  C:\Windows\System\DkVFBmp.exe
  2⤵
  PID:7172
- C:\Windows\System\dScfleq.exe
  C:\Windows\System\dScfleq.exe
  2⤵
  PID:7204
- C:\Windows\System\ervdasN.exe
  C:\Windows\System\ervdasN.exe
  2⤵
  PID:7316
- C:\Windows\System\pjzCeJT.exe
  C:\Windows\System\pjzCeJT.exe
  2⤵
  PID:7400
- C:\Windows\System\tPneHCp.exe
  C:\Windows\System\tPneHCp.exe
  2⤵
  PID:7376
- C:\Windows\System\gtjLKxZ.exe
  C:\Windows\System\gtjLKxZ.exe
  2⤵
  PID:7444
- C:\Windows\System\RXLjlUi.exe
  C:\Windows\System\RXLjlUi.exe
  2⤵
  PID:7644
- C:\Windows\System\SmFCRLg.exe
  C:\Windows\System\SmFCRLg.exe
  2⤵
  PID:7700
- C:\Windows\System\pPrFDBP.exe
  C:\Windows\System\pPrFDBP.exe
  2⤵
  PID:7740
- C:\Windows\System\ewBzKiD.exe
  C:\Windows\System\ewBzKiD.exe
  2⤵
  PID:7808
- C:\Windows\System\KVIPkHU.exe
  C:\Windows\System\KVIPkHU.exe
  2⤵
  PID:1596
- C:\Windows\System\wZsWYeO.exe
  C:\Windows\System\wZsWYeO.exe
  2⤵
  PID:7900
- C:\Windows\System\NLThHlk.exe
  C:\Windows\System\NLThHlk.exe
  2⤵
  PID:7920
- C:\Windows\System\EdlFcad.exe
  C:\Windows\System\EdlFcad.exe
  2⤵
  PID:8092
- C:\Windows\System\igBnWEw.exe
  C:\Windows\System\igBnWEw.exe
  2⤵
  PID:8108
- C:\Windows\System\rSKGFXT.exe
  C:\Windows\System\rSKGFXT.exe
  2⤵
  PID:8172
- C:\Windows\System\nEKksJw.exe
  C:\Windows\System\nEKksJw.exe
  2⤵
  PID:6688
- C:\Windows\System\kFTwIue.exe
  C:\Windows\System\kFTwIue.exe
  2⤵
  PID:7308
- C:\Windows\System\mKxfMXW.exe
  C:\Windows\System\mKxfMXW.exe
  2⤵
  PID:7360
- C:\Windows\System\jDIBvlO.exe
  C:\Windows\System\jDIBvlO.exe
  2⤵
  PID:7468
- C:\Windows\System\RyLDNDr.exe
  C:\Windows\System\RyLDNDr.exe
  2⤵
  PID:7680
- C:\Windows\System\YnOZwER.exe
  C:\Windows\System\YnOZwER.exe
  2⤵
  PID:7788
- C:\Windows\System\mgsAgYa.exe
  C:\Windows\System\mgsAgYa.exe
  2⤵
  PID:60
- C:\Windows\System\gICtkKx.exe
  C:\Windows\System\gICtkKx.exe
  2⤵
  PID:8028
- C:\Windows\System\AoWxHcu.exe
  C:\Windows\System\AoWxHcu.exe
  2⤵
  PID:8184
- C:\Windows\System\qAywOcQ.exe
  C:\Windows\System\qAywOcQ.exe
  2⤵
  PID:7464
- C:\Windows\System\WvMyxlI.exe
  C:\Windows\System\WvMyxlI.exe
  2⤵
  PID:1888
- C:\Windows\System\QHLERMW.exe
  C:\Windows\System\QHLERMW.exe
  2⤵
  PID:7180
- C:\Windows\System\lwVtwWs.exe
  C:\Windows\System\lwVtwWs.exe
  2⤵
  PID:8208
- C:\Windows\System\gfJGhJh.exe
  C:\Windows\System\gfJGhJh.exe
  2⤵
  PID:8240
- C:\Windows\System\XcDNlki.exe
  C:\Windows\System\XcDNlki.exe
  2⤵
  PID:8256
- C:\Windows\System\qrcuOQi.exe
  C:\Windows\System\qrcuOQi.exe
  2⤵
  PID:8296
- C:\Windows\System\VetkoqC.exe
  C:\Windows\System\VetkoqC.exe
  2⤵
  PID:8336
- C:\Windows\System\rxXYsdd.exe
  C:\Windows\System\rxXYsdd.exe
  2⤵
  PID:8360
- C:\Windows\System\zJQGuOU.exe
  C:\Windows\System\zJQGuOU.exe
  2⤵
  PID:8380
- C:\Windows\System\lNLMxqF.exe
  C:\Windows\System\lNLMxqF.exe
  2⤵
  PID:8412
- C:\Windows\System\GNESfRB.exe
  C:\Windows\System\GNESfRB.exe
  2⤵
  PID:8436
- C:\Windows\System\zmPYMFb.exe
  C:\Windows\System\zmPYMFb.exe
  2⤵
  PID:8452
- C:\Windows\System\FtzQaZN.exe
  C:\Windows\System\FtzQaZN.exe
  2⤵
  PID:8480
- C:\Windows\System\TUjjAfB.exe
  C:\Windows\System\TUjjAfB.exe
  2⤵
  PID:8520
- C:\Windows\System\oUMBtZC.exe
  C:\Windows\System\oUMBtZC.exe
  2⤵
  PID:8536
- C:\Windows\System\lRTqeqV.exe
  C:\Windows\System\lRTqeqV.exe
  2⤵
  PID:8580
- C:\Windows\System\qUQNwDf.exe
  C:\Windows\System\qUQNwDf.exe
  2⤵
  PID:8616
- C:\Windows\System\LkPAdTy.exe
  C:\Windows\System\LkPAdTy.exe
  2⤵
  PID:8636
- C:\Windows\System\kVHxPDw.exe
  C:\Windows\System\kVHxPDw.exe
  2⤵
  PID:8660
- C:\Windows\System\AhrnyDD.exe
  C:\Windows\System\AhrnyDD.exe
  2⤵
  PID:8688
- C:\Windows\System\wCkUUMp.exe
  C:\Windows\System\wCkUUMp.exe
  2⤵
  PID:8716
- C:\Windows\System\eXQoert.exe
  C:\Windows\System\eXQoert.exe
  2⤵
  PID:8760
- C:\Windows\System\ndQbVRO.exe
  C:\Windows\System\ndQbVRO.exe
  2⤵
  PID:8788
- C:\Windows\System\aybhRGh.exe
  C:\Windows\System\aybhRGh.exe
  2⤵
  PID:8816
- C:\Windows\System\OPypQHo.exe
  C:\Windows\System\OPypQHo.exe
  2⤵
  PID:8844
- C:\Windows\System\YcqllUh.exe
  C:\Windows\System\YcqllUh.exe
  2⤵
  PID:8860
- C:\Windows\System\hKKLyxY.exe
  C:\Windows\System\hKKLyxY.exe
  2⤵
  PID:8888
- C:\Windows\System\ulTldyW.exe
  C:\Windows\System\ulTldyW.exe
  2⤵
  PID:8916
- C:\Windows\System\fsFGYim.exe
  C:\Windows\System\fsFGYim.exe
  2⤵
  PID:8944
- C:\Windows\System\cSVvvyK.exe
  C:\Windows\System\cSVvvyK.exe
  2⤵
  PID:8984
- C:\Windows\System\IjVmsKu.exe
  C:\Windows\System\IjVmsKu.exe
  2⤵
  PID:9016
- C:\Windows\System\tEZVYzJ.exe
  C:\Windows\System\tEZVYzJ.exe
  2⤵
  PID:9044
- C:\Windows\System\DSnOvpi.exe
  C:\Windows\System\DSnOvpi.exe
  2⤵
  PID:9064
- C:\Windows\System\UpSUwkz.exe
  C:\Windows\System\UpSUwkz.exe
  2⤵
  PID:9088
- C:\Windows\System\uUxZLzX.exe
  C:\Windows\System\uUxZLzX.exe
  2⤵
  PID:9112
- C:\Windows\System\bYBWcvE.exe
  C:\Windows\System\bYBWcvE.exe
  2⤵
  PID:9148
- C:\Windows\System\XiUyTKt.exe
  C:\Windows\System\XiUyTKt.exe
  2⤵
  PID:9164
- C:\Windows\System\kajAsnx.exe
  C:\Windows\System\kajAsnx.exe
  2⤵
  PID:9188
- C:\Windows\System\IURWeWG.exe
  C:\Windows\System\IURWeWG.exe
  2⤵
  PID:8000
- C:\Windows\System\BKLYCQP.exe
  C:\Windows\System\BKLYCQP.exe
  2⤵
  PID:8224
- C:\Windows\System\rQAQXIw.exe
  C:\Windows\System\rQAQXIw.exe
  2⤵
  PID:8280
- C:\Windows\System\OxtLTEa.exe
  C:\Windows\System\OxtLTEa.exe
  2⤵
  PID:8348
- C:\Windows\System\yUlTCGQ.exe
  C:\Windows\System\yUlTCGQ.exe
  2⤵
  PID:8404
- C:\Windows\System\qUbtPvD.exe
  C:\Windows\System\qUbtPvD.exe
  2⤵
  PID:8468
- C:\Windows\System\mFMBQUo.exe
  C:\Windows\System\mFMBQUo.exe
  2⤵
  PID:8492
- C:\Windows\System\TzonEob.exe
  C:\Windows\System\TzonEob.exe
  2⤵
  PID:8588
- C:\Windows\System\PTzoyWI.exe
  C:\Windows\System\PTzoyWI.exe
  2⤵
  PID:8644
- C:\Windows\System\sfpAAPN.exe
  C:\Windows\System\sfpAAPN.exe
  2⤵
  PID:8684
- C:\Windows\System\UOpRvTT.exe
  C:\Windows\System\UOpRvTT.exe
  2⤵
  PID:8712
- C:\Windows\System\dhdrXXk.exe
  C:\Windows\System\dhdrXXk.exe
  2⤵
  PID:8780
- C:\Windows\System\UJzrNUn.exe
  C:\Windows\System\UJzrNUn.exe
  2⤵
  PID:8836
- C:\Windows\System\Kyslhmu.exe
  C:\Windows\System\Kyslhmu.exe
  2⤵
  PID:8904
- C:\Windows\System\uzqAptK.exe
  C:\Windows\System\uzqAptK.exe
  2⤵
  PID:8960
- C:\Windows\System\gtKeOym.exe
  C:\Windows\System\gtKeOym.exe
  2⤵
  PID:9100
- C:\Windows\System\VEQiDTF.exe
  C:\Windows\System\VEQiDTF.exe
  2⤵
  PID:9156
- C:\Windows\System\kKKxEZK.exe
  C:\Windows\System\kKKxEZK.exe
  2⤵
  PID:7948
- C:\Windows\System\ZKzVqHa.exe
  C:\Windows\System\ZKzVqHa.exe
  2⤵
  PID:8312
- C:\Windows\System\tbEHMHa.exe
  C:\Windows\System\tbEHMHa.exe
  2⤵
  PID:8472
- C:\Windows\System\jFGBLvJ.exe
  C:\Windows\System\jFGBLvJ.exe
  2⤵
  PID:8680
- C:\Windows\System\BWpTpvl.exe
  C:\Windows\System\BWpTpvl.exe
  2⤵
  PID:8828
- C:\Windows\System\HqyutpD.exe
  C:\Windows\System\HqyutpD.exe
  2⤵
  PID:8880
- C:\Windows\System\UupjeEq.exe
  C:\Windows\System\UupjeEq.exe
  2⤵
  PID:7944
- C:\Windows\System\IKwNuQD.exe
  C:\Windows\System\IKwNuQD.exe
  2⤵
  PID:8352
- C:\Windows\System\Llynakf.exe
  C:\Windows\System\Llynakf.exe
  2⤵
  PID:8600
- C:\Windows\System\kaiWDsz.exe
  C:\Windows\System\kaiWDsz.exe
  2⤵
  PID:8772
- C:\Windows\System\ImffapS.exe
  C:\Windows\System\ImffapS.exe
  2⤵
  PID:7068
- C:\Windows\System\ehrRrFg.exe
  C:\Windows\System\ehrRrFg.exe
  2⤵
  PID:8464
- C:\Windows\System\jHSMmQj.exe
  C:\Windows\System\jHSMmQj.exe
  2⤵
  PID:9232
- C:\Windows\System\OyLgBhq.exe
  C:\Windows\System\OyLgBhq.exe
  2⤵
  PID:9272
- C:\Windows\System\cQAECWB.exe
  C:\Windows\System\cQAECWB.exe
  2⤵
  PID:9300
- C:\Windows\System\aGmvyHK.exe
  C:\Windows\System\aGmvyHK.exe
  2⤵
  PID:9328
- C:\Windows\System\Mkptgmd.exe
  C:\Windows\System\Mkptgmd.exe
  2⤵
  PID:9348
- C:\Windows\System\WjaleLm.exe
  C:\Windows\System\WjaleLm.exe
  2⤵
  PID:9372
- C:\Windows\System\vhABVEo.exe
  C:\Windows\System\vhABVEo.exe
  2⤵
  PID:9396
- C:\Windows\System\jwdQmVg.exe
  C:\Windows\System\jwdQmVg.exe
  2⤵
  PID:9424
- C:\Windows\System\JkHEwXC.exe
  C:\Windows\System\JkHEwXC.exe
  2⤵
  PID:9448
- C:\Windows\System\QxSvhRL.exe
  C:\Windows\System\QxSvhRL.exe
  2⤵
  PID:9472
- C:\Windows\System\VOYUuRH.exe
  C:\Windows\System\VOYUuRH.exe
  2⤵
  PID:9516
- C:\Windows\System\ouGsTkG.exe
  C:\Windows\System\ouGsTkG.exe
  2⤵
  PID:9552
- C:\Windows\System\gswBhEU.exe
  C:\Windows\System\gswBhEU.exe
  2⤵
  PID:9568
- C:\Windows\System\HAUhXjL.exe
  C:\Windows\System\HAUhXjL.exe
  2⤵
  PID:9596
- C:\Windows\System\QEtbiVe.exe
  C:\Windows\System\QEtbiVe.exe
  2⤵
  PID:9624
- C:\Windows\System\dooqfwC.exe
  C:\Windows\System\dooqfwC.exe
  2⤵
  PID:9648
- C:\Windows\System\XWgmhdD.exe
  C:\Windows\System\XWgmhdD.exe
  2⤵
  PID:9672
- C:\Windows\System\vFlAAjB.exe
  C:\Windows\System\vFlAAjB.exe
  2⤵
  PID:9696
- C:\Windows\System\WpXJYWV.exe
  C:\Windows\System\WpXJYWV.exe
  2⤵
  PID:9716
- C:\Windows\System\VWyKSYt.exe
  C:\Windows\System\VWyKSYt.exe
  2⤵
  PID:9744
- C:\Windows\System\IYpasjM.exe
  C:\Windows\System\IYpasjM.exe
  2⤵
  PID:9772
- C:\Windows\System\qgeTUZL.exe
  C:\Windows\System\qgeTUZL.exe
  2⤵
  PID:9828
- C:\Windows\System\VWpYGhd.exe
  C:\Windows\System\VWpYGhd.exe
  2⤵
  PID:9848
- C:\Windows\System\CIoOUkS.exe
  C:\Windows\System\CIoOUkS.exe
  2⤵
  PID:9864
- C:\Windows\System\ubpQSxn.exe
  C:\Windows\System\ubpQSxn.exe
  2⤵
  PID:9888
- C:\Windows\System\iQBhUWH.exe
  C:\Windows\System\iQBhUWH.exe
  2⤵
  PID:9920
- C:\Windows\System\RNGlzSi.exe
  C:\Windows\System\RNGlzSi.exe
  2⤵
  PID:9940
- C:\Windows\System\ijhSSIm.exe
  C:\Windows\System\ijhSSIm.exe
  2⤵
  PID:9964
- C:\Windows\System\PVJqosu.exe
  C:\Windows\System\PVJqosu.exe
  2⤵
  PID:9988
- C:\Windows\System\xgUchAV.exe
  C:\Windows\System\xgUchAV.exe
  2⤵
  PID:10012
- C:\Windows\System\sMTFmpQ.exe
  C:\Windows\System\sMTFmpQ.exe
  2⤵
  PID:10040
- C:\Windows\System\dbsRDjW.exe
  C:\Windows\System\dbsRDjW.exe
  2⤵
  PID:10060
- C:\Windows\System\kRMQLNp.exe
  C:\Windows\System\kRMQLNp.exe
  2⤵
  PID:10088
- C:\Windows\System\ugVwwAn.exe
  C:\Windows\System\ugVwwAn.exe
  2⤵
  PID:10108
- C:\Windows\System\tSPGoFg.exe
  C:\Windows\System\tSPGoFg.exe
  2⤵
  PID:10164
- C:\Windows\System\IMPzUhL.exe
  C:\Windows\System\IMPzUhL.exe
  2⤵
  PID:10212
- C:\Windows\System\cWcquUv.exe
  C:\Windows\System\cWcquUv.exe
  2⤵
  PID:9128
- C:\Windows\System\racydgl.exe
  C:\Windows\System\racydgl.exe
  2⤵
  PID:9312
- C:\Windows\System\GfAYSdV.exe
  C:\Windows\System\GfAYSdV.exe
  2⤵
  PID:9344
- C:\Windows\System\ySmJlqb.exe
  C:\Windows\System\ySmJlqb.exe
  2⤵
  PID:9384
- C:\Windows\System\TZmnfVb.exe
  C:\Windows\System\TZmnfVb.exe
  2⤵
  PID:9456
- C:\Windows\System\bDalZem.exe
  C:\Windows\System\bDalZem.exe
  2⤵
  PID:9504
- C:\Windows\System\WlaYEcj.exe
  C:\Windows\System\WlaYEcj.exe
  2⤵
  PID:9592
- C:\Windows\System\lirErsr.exe
  C:\Windows\System\lirErsr.exe
  2⤵
  PID:9732
- C:\Windows\System\nVvVUlu.exe
  C:\Windows\System\nVvVUlu.exe
  2⤵
  PID:9684
- C:\Windows\System\LpZvfvX.exe
  C:\Windows\System\LpZvfvX.exe
  2⤵
  PID:9692
- C:\Windows\System\yUTAoNQ.exe
  C:\Windows\System\yUTAoNQ.exe
  2⤵
  PID:9836
- C:\Windows\System\ydqnQCA.exe
  C:\Windows\System\ydqnQCA.exe
  2⤵
  PID:9884
- C:\Windows\System\SfLXmpN.exe
  C:\Windows\System\SfLXmpN.exe
  2⤵
  PID:9932
- C:\Windows\System\hChHZRb.exe
  C:\Windows\System\hChHZRb.exe
  2⤵
  PID:9984
- C:\Windows\System\sKdULBy.exe
  C:\Windows\System\sKdULBy.exe
  2⤵
  PID:10056
- C:\Windows\System\HxWExfm.exe
  C:\Windows\System\HxWExfm.exe
  2⤵
  PID:10128
- C:\Windows\System\zmnxuBV.exe
  C:\Windows\System\zmnxuBV.exe
  2⤵
  PID:9248
- C:\Windows\System\XAVacOr.exe
  C:\Windows\System\XAVacOr.exe
  2⤵
  PID:9408
- C:\Windows\System\jnJiEOh.exe
  C:\Windows\System\jnJiEOh.exe
  2⤵
  PID:9488
- C:\Windows\System\bWrJpSr.exe
  C:\Windows\System\bWrJpSr.exe
  2⤵
  PID:9640
- C:\Windows\System\kHPUvKy.exe
  C:\Windows\System\kHPUvKy.exe
  2⤵
  PID:9820
- C:\Windows\System\cEkhVjQ.exe
  C:\Windows\System\cEkhVjQ.exe
  2⤵
  PID:9956
- C:\Windows\System\WCfUfqJ.exe
  C:\Windows\System\WCfUfqJ.exe
  2⤵
  PID:10180
- C:\Windows\System\gTTJcRD.exe
  C:\Windows\System\gTTJcRD.exe
  2⤵
  PID:10236
- C:\Windows\System\JLLKvya.exe
  C:\Windows\System\JLLKvya.exe
  2⤵
  PID:9824
- C:\Windows\System\MTbytPa.exe
  C:\Windows\System\MTbytPa.exe
  2⤵
  PID:9320
- C:\Windows\System\URMWRXU.exe
  C:\Windows\System\URMWRXU.exe
  2⤵
  PID:9936
- C:\Windows\System\idYEVzt.exe
  C:\Windows\System\idYEVzt.exe
  2⤵
  PID:10248
- C:\Windows\System\RojiIQq.exe
  C:\Windows\System\RojiIQq.exe
  2⤵
  PID:10268
- C:\Windows\System\AIhhTAw.exe
  C:\Windows\System\AIhhTAw.exe
  2⤵
  PID:10292
- C:\Windows\System\MbPojDo.exe
  C:\Windows\System\MbPojDo.exe
  2⤵
  PID:10328
- C:\Windows\System\LNsrhus.exe
  C:\Windows\System\LNsrhus.exe
  2⤵
  PID:10344
- C:\Windows\System\aKsLfxV.exe
  C:\Windows\System\aKsLfxV.exe
  2⤵
  PID:10368
- C:\Windows\System\LqkCaVR.exe
  C:\Windows\System\LqkCaVR.exe
  2⤵
  PID:10392
- C:\Windows\System\dRxofDa.exe
  C:\Windows\System\dRxofDa.exe
  2⤵
  PID:10444
- C:\Windows\System\FBegxpg.exe
  C:\Windows\System\FBegxpg.exe
  2⤵
  PID:10460
- C:\Windows\System\xPdykZC.exe
  C:\Windows\System\xPdykZC.exe
  2⤵
  PID:10496
- C:\Windows\System\cdLLddw.exe
  C:\Windows\System\cdLLddw.exe
  2⤵
  PID:10532
- C:\Windows\System\BhLvzTC.exe
  C:\Windows\System\BhLvzTC.exe
  2⤵
  PID:10548
- C:\Windows\System\sjCgjiR.exe
  C:\Windows\System\sjCgjiR.exe
  2⤵
  PID:10576
- C:\Windows\System\OWOJajX.exe
  C:\Windows\System\OWOJajX.exe
  2⤵
  PID:10596
- C:\Windows\System\hVwESLz.exe
  C:\Windows\System\hVwESLz.exe
  2⤵
  PID:10624
- C:\Windows\System\drDCIgQ.exe
  C:\Windows\System\drDCIgQ.exe
  2⤵
  PID:10644
- C:\Windows\System\gxZysUd.exe
  C:\Windows\System\gxZysUd.exe
  2⤵
  PID:10672
- C:\Windows\System\QFsMwqc.exe
  C:\Windows\System\QFsMwqc.exe
  2⤵
  PID:10720
- C:\Windows\System\vUwUNXn.exe
  C:\Windows\System\vUwUNXn.exe
  2⤵
  PID:10744
- C:\Windows\System\hoytpNy.exe
  C:\Windows\System\hoytpNy.exe
  2⤵
  PID:10780
- C:\Windows\System\HeBqxsc.exe
  C:\Windows\System\HeBqxsc.exe
  2⤵
  PID:10800
- C:\Windows\System\FaQbKan.exe
  C:\Windows\System\FaQbKan.exe
  2⤵
  PID:10828
- C:\Windows\System\wbtKcfW.exe
  C:\Windows\System\wbtKcfW.exe
  2⤵
  PID:10848
- C:\Windows\System\BnpXIDv.exe
  C:\Windows\System\BnpXIDv.exe
  2⤵
  PID:10880
- C:\Windows\System\uztfyrx.exe
  C:\Windows\System\uztfyrx.exe
  2⤵
  PID:10904
- C:\Windows\System\AXinbjY.exe
  C:\Windows\System\AXinbjY.exe
  2⤵
  PID:10928
- C:\Windows\System\ZHKkvvO.exe
  C:\Windows\System\ZHKkvvO.exe
  2⤵
  PID:10944
- C:\Windows\System\MFFpOuD.exe
  C:\Windows\System\MFFpOuD.exe
  2⤵
  PID:10976
- C:\Windows\System\YrLLzAq.exe
  C:\Windows\System\YrLLzAq.exe
  2⤵
  PID:11024
- C:\Windows\System\NqHYLTu.exe
  C:\Windows\System\NqHYLTu.exe
  2⤵
  PID:11052
- C:\Windows\System\gHVkfrV.exe
  C:\Windows\System\gHVkfrV.exe
  2⤵
  PID:11080
- C:\Windows\System\kOFDyUA.exe
  C:\Windows\System\kOFDyUA.exe
  2⤵
  PID:11104
- C:\Windows\System\pLmDMPl.exe
  C:\Windows\System\pLmDMPl.exe
  2⤵
  PID:11136
- C:\Windows\System\TXaBTKe.exe
  C:\Windows\System\TXaBTKe.exe
  2⤵
  PID:11164
- C:\Windows\System\EGPDXbr.exe
  C:\Windows\System\EGPDXbr.exe
  2⤵
  PID:11192
- C:\Windows\System\AsiUFWM.exe
  C:\Windows\System\AsiUFWM.exe
  2⤵
  PID:11216
- C:\Windows\System\RXhChsn.exe
  C:\Windows\System\RXhChsn.exe
  2⤵
  PID:11244
- C:\Windows\System\smlAfqb.exe
  C:\Windows\System\smlAfqb.exe
  2⤵
  PID:10288
- C:\Windows\System\xeXqbnP.exe
  C:\Windows\System\xeXqbnP.exe
  2⤵
  PID:10336
- C:\Windows\System\uMQfUfP.exe
  C:\Windows\System\uMQfUfP.exe
  2⤵
  PID:10380
- C:\Windows\System\oKWHcqT.exe
  C:\Windows\System\oKWHcqT.exe
  2⤵
  PID:10424
- C:\Windows\System\GLoXPuw.exe
  C:\Windows\System\GLoXPuw.exe
  2⤵
  PID:10508
- C:\Windows\System\twVNgOy.exe
  C:\Windows\System\twVNgOy.exe
  2⤵
  PID:10568
- C:\Windows\System\fxzXjLV.exe
  C:\Windows\System\fxzXjLV.exe
  2⤵
  PID:10692
- C:\Windows\System\TNxUCJW.exe
  C:\Windows\System\TNxUCJW.exe
  2⤵
  PID:10640
- C:\Windows\System\WjuIuJC.exe
  C:\Windows\System\WjuIuJC.exe
  2⤵
  PID:10712
- C:\Windows\System\dlIzGOI.exe
  C:\Windows\System\dlIzGOI.exe
  2⤵
  PID:10768
- C:\Windows\System\bAaCEBs.exe
  C:\Windows\System\bAaCEBs.exe
  2⤵
  PID:10820
- C:\Windows\System\mDsWasV.exe
  C:\Windows\System\mDsWasV.exe
  2⤵
  PID:10868
- C:\Windows\System\wLhxbEg.exe
  C:\Windows\System\wLhxbEg.exe
  2⤵
  PID:10968
- C:\Windows\System\lpAZMGX.exe
  C:\Windows\System\lpAZMGX.exe
  2⤵
  PID:11040
- C:\Windows\System\BcaJVvH.exe
  C:\Windows\System\BcaJVvH.exe
  2⤵
  PID:11008
- C:\Windows\System\txSOiUO.exe
  C:\Windows\System\txSOiUO.exe
  2⤵
  PID:11148
- C:\Windows\System\zBczKbL.exe
  C:\Windows\System\zBczKbL.exe
  2⤵
  PID:11240
- C:\Windows\System\WkelWWZ.exe
  C:\Windows\System\WkelWWZ.exe
  2⤵
  PID:9792
- C:\Windows\System\eSHGeHg.exe
  C:\Windows\System\eSHGeHg.exe
  2⤵
  PID:10612
- C:\Windows\System\uQsEXIv.exe
  C:\Windows\System\uQsEXIv.exe
  2⤵
  PID:10936
- C:\Windows\System\ieoIMwg.exe
  C:\Windows\System\ieoIMwg.exe
  2⤵
  PID:11076
- C:\Windows\System\pNHgjDf.exe
  C:\Windows\System\pNHgjDf.exe
  2⤵
  PID:11016
- C:\Windows\System\jfsgFQd.exe
  C:\Windows\System\jfsgFQd.exe
  2⤵
  PID:11180
- C:\Windows\System\YhjjfDb.exe
  C:\Windows\System\YhjjfDb.exe
  2⤵
  PID:10452
- C:\Windows\System\nXVDHqY.exe
  C:\Windows\System\nXVDHqY.exe
  2⤵
  PID:10856
- C:\Windows\System\rBnjjJe.exe
  C:\Windows\System\rBnjjJe.exe
  2⤵
  PID:11224
- C:\Windows\System\ILuyOyq.exe
  C:\Windows\System\ILuyOyq.exe
  2⤵
  PID:10512
- C:\Windows\System\PeEqYJn.exe
  C:\Windows\System\PeEqYJn.exe
  2⤵
  PID:11288
- C:\Windows\System\xveRxWS.exe
  C:\Windows\System\xveRxWS.exe
  2⤵
  PID:11312
- C:\Windows\System\Hasqwxa.exe
  C:\Windows\System\Hasqwxa.exe
  2⤵
  PID:11356
- C:\Windows\System\aoOWDJl.exe
  C:\Windows\System\aoOWDJl.exe
  2⤵
  PID:11384
- C:\Windows\System\AQPQvHu.exe
  C:\Windows\System\AQPQvHu.exe
  2⤵
  PID:11412
- C:\Windows\System\nzUOANI.exe
  C:\Windows\System\nzUOANI.exe
  2⤵
  PID:11440
- C:\Windows\System\dTgOuOB.exe
  C:\Windows\System\dTgOuOB.exe
  2⤵
  PID:11460
- C:\Windows\System\sQQKEgP.exe
  C:\Windows\System\sQQKEgP.exe
  2⤵
  PID:11480
- C:\Windows\System\KEFyBpd.exe
  C:\Windows\System\KEFyBpd.exe
  2⤵
  PID:11504
- C:\Windows\System\PYDshqU.exe
  C:\Windows\System\PYDshqU.exe
  2⤵
  PID:11532
- C:\Windows\System\LEpvvcE.exe
  C:\Windows\System\LEpvvcE.exe
  2⤵
  PID:11568
- C:\Windows\System\Xhaqpgy.exe
  C:\Windows\System\Xhaqpgy.exe
  2⤵
  PID:11592
- C:\Windows\System\wUiUtxz.exe
  C:\Windows\System\wUiUtxz.exe
  2⤵
  PID:11620
- C:\Windows\System\VIKRBsJ.exe
  C:\Windows\System\VIKRBsJ.exe
  2⤵
  PID:11648
- C:\Windows\System\OIqBeal.exe
  C:\Windows\System\OIqBeal.exe
  2⤵
  PID:11668
- C:\Windows\System\CeemIFl.exe
  C:\Windows\System\CeemIFl.exe
  2⤵
  PID:11720
- C:\Windows\System\lXtckrJ.exe
  C:\Windows\System\lXtckrJ.exe
  2⤵
  PID:11740
- C:\Windows\System\ThAtrfS.exe
  C:\Windows\System\ThAtrfS.exe
  2⤵
  PID:11764
- C:\Windows\System\CuguplF.exe
  C:\Windows\System\CuguplF.exe
  2⤵
  PID:11784
- C:\Windows\System\xNbTKvj.exe
  C:\Windows\System\xNbTKvj.exe
  2⤵
  PID:11812
- C:\Windows\System\BVhriSl.exe
  C:\Windows\System\BVhriSl.exe
  2⤵
  PID:11832
- C:\Windows\System\TLwphbF.exe
  C:\Windows\System\TLwphbF.exe
  2⤵
  PID:11856
- C:\Windows\System\YTnBUTr.exe
  C:\Windows\System\YTnBUTr.exe
  2⤵
  PID:11884
- C:\Windows\System\NEKDVSt.exe
  C:\Windows\System\NEKDVSt.exe
  2⤵
  PID:11916
- C:\Windows\System\nQFsFOp.exe
  C:\Windows\System\nQFsFOp.exe
  2⤵
  PID:11940
- C:\Windows\System\lEbUZpL.exe
  C:\Windows\System\lEbUZpL.exe
  2⤵
  PID:11972
- C:\Windows\System\dicjAeR.exe
  C:\Windows\System\dicjAeR.exe
  2⤵
  PID:12004
- C:\Windows\System\KXIICdW.exe
  C:\Windows\System\KXIICdW.exe
  2⤵
  PID:12056
- C:\Windows\System\WFShVyx.exe
  C:\Windows\System\WFShVyx.exe
  2⤵
  PID:12076
- C:\Windows\System\rLdXHXi.exe
  C:\Windows\System\rLdXHXi.exe
  2⤵
  PID:12100
- C:\Windows\System\xlQTqtu.exe
  C:\Windows\System\xlQTqtu.exe
  2⤵
  PID:12120
- C:\Windows\System\ZEjlMtH.exe
  C:\Windows\System\ZEjlMtH.exe
  2⤵
  PID:12168
- C:\Windows\System\nlskYPK.exe
  C:\Windows\System\nlskYPK.exe
  2⤵
  PID:12188
- C:\Windows\System\ITTkCmp.exe
  C:\Windows\System\ITTkCmp.exe
  2⤵
  PID:12212
- C:\Windows\System\TTayMJv.exe
  C:\Windows\System\TTayMJv.exe
  2⤵
  PID:12240
- C:\Windows\System\hMwclzO.exe
  C:\Windows\System\hMwclzO.exe
  2⤵
  PID:12272
- C:\Windows\System\idUtrSf.exe
  C:\Windows\System\idUtrSf.exe
  2⤵
  PID:11308
- C:\Windows\System\chcjzVW.exe
  C:\Windows\System\chcjzVW.exe
  2⤵
  PID:11304
- C:\Windows\System\NQtBqei.exe
  C:\Windows\System\NQtBqei.exe
  2⤵
  PID:11376
- C:\Windows\System\LRBiLLv.exe
  C:\Windows\System\LRBiLLv.exe
  2⤵
  PID:11432
- C:\Windows\System\QkRjLlB.exe
  C:\Windows\System\QkRjLlB.exe
  2⤵
  PID:11424
- C:\Windows\System\vnilcPW.exe
  C:\Windows\System\vnilcPW.exe
  2⤵
  PID:11500
- C:\Windows\System\OJJyWfy.exe
  C:\Windows\System\OJJyWfy.exe
  2⤵
  PID:11628
- C:\Windows\System\WGPEXHr.exe
  C:\Windows\System\WGPEXHr.exe
  2⤵
  PID:11696
- C:\Windows\System\OgIRjfg.exe
  C:\Windows\System\OgIRjfg.exe
  2⤵
  PID:11728
- C:\Windows\System\xUuuPfi.exe
  C:\Windows\System\xUuuPfi.exe
  2⤵
  PID:11804
- C:\Windows\System\pbKGtKG.exe
  C:\Windows\System\pbKGtKG.exe
  2⤵
  PID:11868
- C:\Windows\System\ImmYlHj.exe
  C:\Windows\System\ImmYlHj.exe
  2⤵
  PID:11932
- C:\Windows\System\EaSIlWk.exe
  C:\Windows\System\EaSIlWk.exe
  2⤵
  PID:12020
- C:\Windows\System\poJMkuN.exe
  C:\Windows\System\poJMkuN.exe
  2⤵
  PID:12072
- C:\Windows\System\QvRhdJK.exe
  C:\Windows\System\QvRhdJK.exe
  2⤵
  PID:12148
- C:\Windows\System\tsvhOdi.exe
  C:\Windows\System\tsvhOdi.exe
  2⤵
  PID:12180
- C:\Windows\System\bkrlMnB.exe
  C:\Windows\System\bkrlMnB.exe
  2⤵
  PID:12220
- C:\Windows\System\GEHZBzo.exe
  C:\Windows\System\GEHZBzo.exe
  2⤵
  PID:11280
- C:\Windows\System\zJifZcY.exe
  C:\Windows\System\zJifZcY.exe
  2⤵
  PID:11448
- C:\Windows\System\ohLCihR.exe
  C:\Windows\System\ohLCihR.exe
  2⤵
  PID:11796
- C:\Windows\System\iYYeyXU.exe
  C:\Windows\System\iYYeyXU.exe
  2⤵
  PID:11844
- C:\Windows\System\ZuAOWCD.exe
  C:\Windows\System\ZuAOWCD.exe
  2⤵
  PID:12000
- C:\Windows\System\rOMUvFZ.exe
  C:\Windows\System\rOMUvFZ.exe
  2⤵
  PID:12092
- C:\Windows\System\lGUCipy.exe
  C:\Windows\System\lGUCipy.exe
  2⤵
  PID:12256
- C:\Windows\System\YFUVRAu.exe
  C:\Windows\System\YFUVRAu.exe
  2⤵
  PID:11300
- C:\Windows\System\lYIctrx.exe
  C:\Windows\System\lYIctrx.exe
  2⤵
  PID:12084
- C:\Windows\System\LZqkCjk.exe
  C:\Windows\System\LZqkCjk.exe
  2⤵
  PID:11984
- C:\Windows\System\pFhfdrj.exe
  C:\Windows\System\pFhfdrj.exe
  2⤵
  PID:12300
- C:\Windows\System\fdzuaiW.exe
  C:\Windows\System\fdzuaiW.exe
  2⤵
  PID:12320
- C:\Windows\System\jcNoqVr.exe
  C:\Windows\System\jcNoqVr.exe
  2⤵
  PID:12348
- C:\Windows\System\iDMAyfX.exe
  C:\Windows\System\iDMAyfX.exe
  2⤵
  PID:12392
- C:\Windows\System\iasoXOr.exe
  C:\Windows\System\iasoXOr.exe
  2⤵
  PID:12432
- C:\Windows\System\tfrxude.exe
  C:\Windows\System\tfrxude.exe
  2⤵
  PID:12448
- C:\Windows\System\NgFtyXT.exe
  C:\Windows\System\NgFtyXT.exe
  2⤵
  PID:12472
- C:\Windows\System\mqcMiLX.exe
  C:\Windows\System\mqcMiLX.exe
  2⤵
  PID:12500
- C:\Windows\System\qTstiHP.exe
  C:\Windows\System\qTstiHP.exe
  2⤵
  PID:12556
- C:\Windows\System\JEcMsIb.exe
  C:\Windows\System\JEcMsIb.exe
  2⤵
  PID:12584
- C:\Windows\System\TfsUFOG.exe
  C:\Windows\System\TfsUFOG.exe
  2⤵
  PID:12600
- C:\Windows\System\afPIMYn.exe
  C:\Windows\System\afPIMYn.exe
  2⤵
  PID:12624
- C:\Windows\System\vnYmXaD.exe
  C:\Windows\System\vnYmXaD.exe
  2⤵
  PID:12652
- C:\Windows\System\YxrtdeJ.exe
  C:\Windows\System\YxrtdeJ.exe
  2⤵
  PID:12688
- C:\Windows\System\wpCaLax.exe
  C:\Windows\System\wpCaLax.exe
  2⤵
  PID:12720
- C:\Windows\System\hNMppVM.exe
  C:\Windows\System\hNMppVM.exe
  2⤵
  PID:12744
- C:\Windows\System\oZPbrkK.exe
  C:\Windows\System\oZPbrkK.exe
  2⤵
  PID:12772
- C:\Windows\System\YEvdBfz.exe
  C:\Windows\System\YEvdBfz.exe
  2⤵
  PID:12796
- C:\Windows\System\drmcTXW.exe
  C:\Windows\System\drmcTXW.exe
  2⤵
  PID:12816
- C:\Windows\System\GkWbzRG.exe
  C:\Windows\System\GkWbzRG.exe
  2⤵
  PID:12848
- C:\Windows\System\sIYAAJq.exe
  C:\Windows\System\sIYAAJq.exe
  2⤵
  PID:12872
- C:\Windows\System\DRjgiiK.exe
  C:\Windows\System\DRjgiiK.exe
  2⤵
  PID:12908
- C:\Windows\System\RwafuaG.exe
  C:\Windows\System\RwafuaG.exe
  2⤵
  PID:12936
- C:\Windows\System\jVhmQEk.exe
  C:\Windows\System\jVhmQEk.exe
  2⤵
  PID:12976
- C:\Windows\System\iBkHZrP.exe
  C:\Windows\System\iBkHZrP.exe
  2⤵
  PID:12996
- C:\Windows\System\XjJnDsS.exe
  C:\Windows\System\XjJnDsS.exe
  2⤵
  PID:13020
- C:\Windows\System\fXGneij.exe
  C:\Windows\System\fXGneij.exe
  2⤵
  PID:13060
- C:\Windows\System\UdjXzPv.exe
  C:\Windows\System\UdjXzPv.exe
  2⤵
  PID:13088
- C:\Windows\System\pfhiach.exe
  C:\Windows\System\pfhiach.exe
  2⤵
  PID:13112
- C:\Windows\System\pklbeds.exe
  C:\Windows\System\pklbeds.exe
  2⤵
  PID:13132
- C:\Windows\System\RbleKNx.exe
  C:\Windows\System\RbleKNx.exe
  2⤵
  PID:13148
- C:\Windows\System\hUvtEXs.exe
  C:\Windows\System\hUvtEXs.exe
  2⤵
  PID:13172
- C:\Windows\System\RJrrEPh.exe
  C:\Windows\System\RJrrEPh.exe
  2⤵
  PID:13224
- C:\Windows\System\wpUYRSb.exe
  C:\Windows\System\wpUYRSb.exe
  2⤵
  PID:13244
- C:\Windows\System\fcIZFqp.exe
  C:\Windows\System\fcIZFqp.exe
  2⤵
  PID:13268
- C:\Windows\System\ysLeUMd.exe
  C:\Windows\System\ysLeUMd.exe
  2⤵
  PID:11544
- C:\Windows\System\QBZSeQE.exe
  C:\Windows\System\QBZSeQE.exe
  2⤵
  PID:12308
- C:\Windows\System\jsJMoZR.exe
  C:\Windows\System\jsJMoZR.exe
  2⤵
  PID:12336
- C:\Windows\System\vkrvtCj.exe
  C:\Windows\System\vkrvtCj.exe
  2⤵
  PID:12420
- C:\Windows\System\romHEUm.exe
  C:\Windows\System\romHEUm.exe
  2⤵
  PID:12460
- C:\Windows\System\XmvBlQL.exe
  C:\Windows\System\XmvBlQL.exe
  2⤵
  PID:12524
- C:\Windows\System\GTjeLwz.exe
  C:\Windows\System\GTjeLwz.exe
  2⤵
  PID:12596
- C:\Windows\System\KIWvFEl.exe
  C:\Windows\System\KIWvFEl.exe
  2⤵
  PID:12620
- C:\Windows\System\oKLrxat.exe
  C:\Windows\System\oKLrxat.exe
  2⤵
  PID:12716
- C:\Windows\System\btrYPeH.exe
  C:\Windows\System\btrYPeH.exe
  2⤵
  PID:12768
- C:\Windows\System\Qbgqmal.exe
  C:\Windows\System\Qbgqmal.exe
  2⤵
  PID:12836
- C:\Windows\System\MFTGRuw.exe
  C:\Windows\System\MFTGRuw.exe
  2⤵
  PID:12904
- C:\Windows\System\vuwTFEO.exe
  C:\Windows\System\vuwTFEO.exe
  2⤵
  PID:12960
- C:\Windows\System\FRjHJrZ.exe
  C:\Windows\System\FRjHJrZ.exe
  2⤵
  PID:13016
- C:\Windows\System\cPCowfg.exe
  C:\Windows\System\cPCowfg.exe
  2⤵
  PID:13100
- C:\Windows\System\TbKbuJD.exe
  C:\Windows\System\TbKbuJD.exe
  2⤵
  PID:13160
- C:\Windows\System\ERHtAht.exe
  C:\Windows\System\ERHtAht.exe
  2⤵
  PID:13236
- C:\Windows\System\mFzPQDx.exe
  C:\Windows\System\mFzPQDx.exe
  2⤵
  PID:12292
- C:\Windows\System\pLVdoLL.exe
  C:\Windows\System\pLVdoLL.exe
  2⤵
  PID:12384
- C:\Windows\System\evzAlER.exe
  C:\Windows\System\evzAlER.exe
  2⤵
  PID:12552
- C:\Windows\System\jYtfjHM.exe
  C:\Windows\System\jYtfjHM.exe
  2⤵
  PID:12668
- C:\Windows\System\XIDfQFe.exe
  C:\Windows\System\XIDfQFe.exe
  2⤵
  PID:12864
- C:\Windows\System\xqDKkZZ.exe
  C:\Windows\System\xqDKkZZ.exe
  2⤵
  PID:13044
- C:\Windows\System\HPnDnbf.exe
  C:\Windows\System\HPnDnbf.exe
  2⤵
  PID:13076
- C:\Windows\System\hfWpFgv.exe
  C:\Windows\System\hfWpFgv.exe
  2⤵
  PID:13260
- C:\Windows\System\SSHDAqE.exe
  C:\Windows\System\SSHDAqE.exe
  2⤵
  PID:12468
- C:\Windows\System\gGSjhOj.exe
  C:\Windows\System\gGSjhOj.exe
  2⤵
  PID:12788
- C:\Windows\System\DwgpIKB.exe
  C:\Windows\System\DwgpIKB.exe
  2⤵
  PID:12988
- C:\Windows\System\mLgDxtb.exe
  C:\Windows\System\mLgDxtb.exe
  2⤵
  PID:13208
- C:\Windows\System\NKyYKmm.exe
  C:\Windows\System\NKyYKmm.exe
  2⤵
  PID:12812
- C:\Windows\System\MdVtFby.exe
  C:\Windows\System\MdVtFby.exe
  2⤵
  PID:13340
- C:\Windows\System\rOfxYLh.exe
  C:\Windows\System\rOfxYLh.exe
  2⤵
  PID:13356
- C:\Windows\System\ssJCbvM.exe
  C:\Windows\System\ssJCbvM.exe
  2⤵
  PID:13416
- C:\Windows\System\QKlcQCt.exe
  C:\Windows\System\QKlcQCt.exe
  2⤵
  PID:13456
- C:\Windows\System\CNYzQpO.exe
  C:\Windows\System\CNYzQpO.exe
  2⤵
  PID:13484
- C:\Windows\System\DhjFTHA.exe
  C:\Windows\System\DhjFTHA.exe
  2⤵
  PID:13504
- C:\Windows\System\hqvtnnx.exe
  C:\Windows\System\hqvtnnx.exe
  2⤵
  PID:13528
- C:\Windows\System\JGQRnbv.exe
  C:\Windows\System\JGQRnbv.exe
  2⤵
  PID:13544
- C:\Windows\System\vOigsDi.exe
  C:\Windows\System\vOigsDi.exe
  2⤵
  PID:13572
- C:\Windows\System\hrsiGLm.exe
  C:\Windows\System\hrsiGLm.exe
  2⤵
  PID:13596
- C:\Windows\System\mNHeqmK.exe
  C:\Windows\System\mNHeqmK.exe
  2⤵
  PID:13628
- C:\Windows\System\RLJuEaN.exe
  C:\Windows\System\RLJuEaN.exe
  2⤵
  PID:13680
- C:\Windows\System\RhCrfIx.exe
  C:\Windows\System\RhCrfIx.exe
  2⤵
  PID:13700
- C:\Windows\System\QOkoGXZ.exe
  C:\Windows\System\QOkoGXZ.exe
  2⤵
  PID:13720
- C:\Windows\System\CHxLFbQ.exe
  C:\Windows\System\CHxLFbQ.exe
  2⤵
  PID:13740
- C:\Windows\System\hvtQgEN.exe
  C:\Windows\System\hvtQgEN.exe
  2⤵
  PID:13756
- C:\Windows\System\ZKtByul.exe
  C:\Windows\System\ZKtByul.exe
  2⤵
  PID:13772
- C:\Windows\System\VLYVyzK.exe
  C:\Windows\System\VLYVyzK.exe
  2⤵
  PID:13848
- C:\Windows\System\yOQWHuK.exe
  C:\Windows\System\yOQWHuK.exe
  2⤵
  PID:13876
- C:\Windows\System\oEPwSWL.exe
  C:\Windows\System\oEPwSWL.exe
  2⤵
  PID:13892
- C:\Windows\System\FMtKXXJ.exe
  C:\Windows\System\FMtKXXJ.exe
  2⤵
  PID:13924
- C:\Windows\System\XJQuJKi.exe
  C:\Windows\System\XJQuJKi.exe
  2⤵
  PID:13948
- C:\Windows\System\MZNyxUP.exe
  C:\Windows\System\MZNyxUP.exe
  2⤵
  PID:13972
- C:\Windows\System\zCTAeyr.exe
  C:\Windows\System\zCTAeyr.exe
  2⤵
  PID:13996
- C:\Windows\System\QLPgKtF.exe
  C:\Windows\System\QLPgKtF.exe
  2⤵
  PID:14020
- C:\Windows\System\wHpOsgM.exe
  C:\Windows\System\wHpOsgM.exe
  2⤵
  PID:14056
- C:\Windows\System\IDTssVs.exe
  C:\Windows\System\IDTssVs.exe
  2⤵
  PID:14080
- C:\Windows\System\bICKmvV.exe
  C:\Windows\System\bICKmvV.exe
  2⤵
  PID:14108
- C:\Windows\System\HeamhCF.exe
  C:\Windows\System\HeamhCF.exe
  2⤵
  PID:14144
- C:\Windows\System\fbeivFq.exe
  C:\Windows\System\fbeivFq.exe
  2⤵
  PID:14172
- C:\Windows\System\CslVHoL.exe
  C:\Windows\System\CslVHoL.exe
  2⤵
  PID:14188
- C:\Windows\System\RCETWGX.exe
  C:\Windows\System\RCETWGX.exe
  2⤵
  PID:14240
- C:\Windows\System\TSMmyhi.exe
  C:\Windows\System\TSMmyhi.exe
  2⤵
  PID:14268
- C:\Windows\System\ELHelGR.exe
  C:\Windows\System\ELHelGR.exe
  2⤵
  PID:14292
- C:\Windows\System\dltHKcP.exe
  C:\Windows\System\dltHKcP.exe
  2⤵
  PID:14316
- C:\Windows\System\OTKMWUb.exe
  C:\Windows\System\OTKMWUb.exe
  2⤵
  PID:13324
- C:\Windows\System\YKPQDCm.exe
  C:\Windows\System\YKPQDCm.exe
  2⤵
  PID:12956
- C:\Windows\System\bPQHxNw.exe
  C:\Windows\System\bPQHxNw.exe
  2⤵
  PID:13392
- C:\Windows\System\PJenKqj.exe
  C:\Windows\System\PJenKqj.exe
  2⤵
  PID:13472
- C:\Windows\System\EaXmJMy.exe
  C:\Windows\System\EaXmJMy.exe
  2⤵
  PID:13580
- C:\Windows\System\vjEHrvb.exe
  C:\Windows\System\vjEHrvb.exe
  2⤵
  PID:13640
- C:\Windows\System\XzePtsB.exe
  C:\Windows\System\XzePtsB.exe
  2⤵
  PID:13712
- C:\Windows\System\NCVhDny.exe
  C:\Windows\System\NCVhDny.exe
  2⤵
  PID:13752
- C:\Windows\System\OeZvPYs.exe
  C:\Windows\System\OeZvPYs.exe
  2⤵
  PID:13868
- C:\Windows\System\yVFQozB.exe
  C:\Windows\System\yVFQozB.exe
  2⤵
  PID:13932
- C:\Windows\System\XqNSWjl.exe
  C:\Windows\System\XqNSWjl.exe
  2⤵
  PID:13944
- C:\Windows\System\HvkntXu.exe
  C:\Windows\System\HvkntXu.exe
  2⤵
  PID:14068
- C:\Windows\System\bzxCjwS.exe
  C:\Windows\System\bzxCjwS.exe
  2⤵
  PID:14076
- C:\Windows\System\GOqHfkZ.exe
  C:\Windows\System\GOqHfkZ.exe
  2⤵
  PID:14140
- C:\Windows\System\QopcbCK.exe
  C:\Windows\System\QopcbCK.exe
  2⤵
  PID:14256
- C:\Windows\System\ELiSZTK.exe
  C:\Windows\System\ELiSZTK.exe
  2⤵
  PID:14280
- C:\Windows\System\uQXYRwm.exe
  C:\Windows\System\uQXYRwm.exe
  2⤵
  PID:13108
- C:\Windows\System\DiwFHZE.exe
  C:\Windows\System\DiwFHZE.exe
  2⤵
  PID:13436
- C:\Windows\System\mSMHMLw.exe
  C:\Windows\System\mSMHMLw.exe
  2⤵
  PID:13568
- C:\Windows\System\dMDCdpp.exe
  C:\Windows\System\dMDCdpp.exe
  2⤵
  PID:13708
- C:\Windows\System\ZyZEBSy.exe
  C:\Windows\System\ZyZEBSy.exe
  2⤵
  PID:13840
- C:\Windows\System\yBdRLSQ.exe
  C:\Windows\System\yBdRLSQ.exe
  2⤵
  PID:14048
- C:\Windows\System\qjtzhsd.exe
  C:\Windows\System\qjtzhsd.exe
  2⤵
  PID:14212
- C:\Windows\System\yLQORNM.exe
  C:\Windows\System\yLQORNM.exe
  2⤵
  PID:14284
- C:\Windows\System\doGOebn.exe
  C:\Windows\System\doGOebn.exe
  2⤵
  PID:13520
- C:\Windows\System\JKmCDJQ.exe
  C:\Windows\System\JKmCDJQ.exe
  2⤵
  PID:13808
- C:\Windows\System\JkuDySE.exe
  C:\Windows\System\JkuDySE.exe
  2⤵
  PID:14040
- C:\Windows\System\GbJonqS.exe
  C:\Windows\System\GbJonqS.exe
  2⤵
  PID:14224
- C:\Windows\System\CrPtFnF.exe
  C:\Windows\System\CrPtFnF.exe
  2⤵
  PID:14356
- C:\Windows\System\UHWHcQH.exe
  C:\Windows\System\UHWHcQH.exe
  2⤵
  PID:14376
- C:\Windows\System\ROkcJVF.exe
  C:\Windows\System\ROkcJVF.exe
  2⤵
  PID:14408
- C:\Windows\System\XknltQP.exe
  C:\Windows\System\XknltQP.exe
  2⤵
  PID:14440
- C:\Windows\System\gUBiViV.exe
  C:\Windows\System\gUBiViV.exe
  2⤵
  PID:14476
- C:\Windows\System\HOetMLR.exe
  C:\Windows\System\HOetMLR.exe
  2⤵
  PID:14500
- C:\Windows\System\ZNGJeEM.exe
  C:\Windows\System\ZNGJeEM.exe
  2⤵
  PID:14532
- C:\Windows\System\vYxhfnJ.exe
  C:\Windows\System\vYxhfnJ.exe
  2⤵
  PID:14568
- C:\Windows\System\AMaeCpF.exe
  C:\Windows\System\AMaeCpF.exe
  2⤵
  PID:14584
- C:\Windows\System\SavqjFq.exe
  C:\Windows\System\SavqjFq.exe
  2⤵
  PID:14608
- C:\Windows\System\BlTEjHn.exe
  C:\Windows\System\BlTEjHn.exe
  2⤵
  PID:14660
- C:\Windows\System\OoMEvRf.exe
  C:\Windows\System\OoMEvRf.exe
  2⤵
  PID:14684
- C:\Windows\System\iFhkfrU.exe
  C:\Windows\System\iFhkfrU.exe
  2⤵
  PID:14720
- C:\Windows\System\lpSpUcJ.exe
  C:\Windows\System\lpSpUcJ.exe
  2⤵
  PID:14748
- C:\Windows\System\TLqGEMY.exe
  C:\Windows\System\TLqGEMY.exe
  2⤵
  PID:14784
- C:\Windows\System\OnZxdih.exe
  C:\Windows\System\OnZxdih.exe
  2⤵
  PID:14800
- C:\Windows\System\ThkabCA.exe
  C:\Windows\System\ThkabCA.exe
  2⤵
  PID:14820
- C:\Windows\System\AVjfPkV.exe
  C:\Windows\System\AVjfPkV.exe
  2⤵
  PID:14852
- C:\Windows\System\uEYGmfk.exe
  C:\Windows\System\uEYGmfk.exe
  2⤵
  PID:14888
- C:\Windows\System\SvfViJx.exe
  C:\Windows\System\SvfViJx.exe
  2⤵
  PID:14908
- C:\Windows\System\nWKKTcg.exe
  C:\Windows\System\nWKKTcg.exe
  2⤵
  PID:14940
- C:\Windows\System\vKZpjGM.exe
  C:\Windows\System\vKZpjGM.exe
  2⤵
  PID:14960
- C:\Windows\System\BpASjMJ.exe
  C:\Windows\System\BpASjMJ.exe
  2⤵
  PID:14988
- C:\Windows\System\KmBMtIX.exe
  C:\Windows\System\KmBMtIX.exe
  2⤵
  PID:15028
- C:\Windows\System\fqPGlyC.exe
  C:\Windows\System\fqPGlyC.exe
  2⤵
  PID:15068
- C:\Windows\System\oJxFULM.exe
  C:\Windows\System\oJxFULM.exe
  2⤵
  PID:15088
- C:\Windows\System\KWvOeca.exe
  C:\Windows\System\KWvOeca.exe
  2⤵
  PID:15112
- C:\Windows\System\MpxqndZ.exe
  C:\Windows\System\MpxqndZ.exe
  2⤵
  PID:15144
- C:\Windows\System\jDOxidD.exe
  C:\Windows\System\jDOxidD.exe
  2⤵
  PID:15168
- C:\Windows\System\qgsRGQR.exe
  C:\Windows\System\qgsRGQR.exe
  2⤵
  PID:15188
- C:\Windows\System\tiACyGz.exe
  C:\Windows\System\tiACyGz.exe
  2⤵
  PID:15216
- C:\Windows\System\eiCoSFA.exe
  C:\Windows\System\eiCoSFA.exe
  2⤵
  PID:15232
- C:\Windows\System\SHHzTMH.exe
  C:\Windows\System\SHHzTMH.exe
  2⤵
  PID:15272
- C:\Windows\System\QlLvTcu.exe
  C:\Windows\System\QlLvTcu.exe
  2⤵
  PID:15300
- C:\Windows\System\XseZBOX.exe
  C:\Windows\System\XseZBOX.exe
  2⤵
  PID:15320
- C:\Windows\System\UBXQNSc.exe
  C:\Windows\System\UBXQNSc.exe
  2⤵
  PID:15340
- C:\Windows\System\tYVbfcA.exe
  C:\Windows\System\tYVbfcA.exe
  2⤵
  PID:14428
- C:\Windows\System\KjydMMv.exe
  C:\Windows\System\KjydMMv.exe
  2⤵
  PID:14560
- C:\Windows\System\IZWIzlA.exe
  C:\Windows\System\IZWIzlA.exe
  2⤵
  PID:14544
- C:\Windows\System\dbSulwx.exe
  C:\Windows\System\dbSulwx.exe
  2⤵
  PID:14604
- C:\Windows\System\Byjuzwg.exe
  C:\Windows\System\Byjuzwg.exe
  2⤵
  PID:14712
- C:\Windows\System\FKNzGlo.exe
  C:\Windows\System\FKNzGlo.exe
  2⤵
  PID:14740
- C:\Windows\System\CIERGnq.exe
  C:\Windows\System\CIERGnq.exe
  2⤵
  PID:14792
- C:\Windows\System\nKtnaRz.exe
  C:\Windows\System\nKtnaRz.exe
  2⤵
  PID:14868
- C:\Windows\System\IYbFbCO.exe
  C:\Windows\System\IYbFbCO.exe
  2⤵
  PID:14900
- C:\Windows\System\VXjfzGQ.exe
  C:\Windows\System\VXjfzGQ.exe
  2⤵
  PID:14984
- C:\Windows\System\rvoewuK.exe
  C:\Windows\System\rvoewuK.exe
  2⤵
  PID:15056
- C:\Windows\System\CuUNUQE.exe
  C:\Windows\System\CuUNUQE.exe
  2⤵
  PID:15108
- C:\Windows\System\oJBPTPb.exe
  C:\Windows\System\oJBPTPb.exe
  2⤵
  PID:15164
- C:\Windows\System\PSQxacs.exe
  C:\Windows\System\PSQxacs.exe
  2⤵
  PID:15244
- C:\Windows\System\bGDPtID.exe
  C:\Windows\System\bGDPtID.exe
  2⤵
  PID:15312
- C:\Windows\System\YEircPP.exe
  C:\Windows\System\YEircPP.exe
  2⤵
  PID:14132
- C:\Windows\System\cxtQbJI.exe
  C:\Windows\System\cxtQbJI.exe
  2⤵
  PID:14460
- C:\Windows\System\xtUuHph.exe
  C:\Windows\System\xtUuHph.exe
  2⤵
  PID:14528
- C:\Windows\System\SwyzkMz.exe
  C:\Windows\System\SwyzkMz.exe
  2⤵
  PID:14836
- C:\Windows\System\IzAQAuQ.exe
  C:\Windows\System\IzAQAuQ.exe
  2⤵
  PID:14952
- C:\Windows\System\wEsWfiN.exe
  C:\Windows\System\wEsWfiN.exe
  2⤵
  PID:15020
- C:\Windows\System\clHTivt.exe
  C:\Windows\System\clHTivt.exe
  2⤵
  PID:15268
- C:\Windows\System\UEnBfdz.exe
  C:\Windows\System\UEnBfdz.exe
  2⤵
  PID:15332
- C:\Windows\System\UDcXXgL.exe
  C:\Windows\System\UDcXXgL.exe
  2⤵
  PID:15084
- C:\Windows\System\ygftxvL.exe
  C:\Windows\System\ygftxvL.exe
  2⤵
  PID:15124
- C:\Windows\System\lZGaHmo.exe
  C:\Windows\System\lZGaHmo.exe
  2⤵
  PID:15228
- C:\Windows\System\IPQaHAj.exe
  C:\Windows\System\IPQaHAj.exe
  2⤵
  PID:15388
- C:\Windows\System\VoOMCTP.exe
  C:\Windows\System\VoOMCTP.exe
  2⤵
  PID:15416
- C:\Windows\System\SrWYXRE.exe
  C:\Windows\System\SrWYXRE.exe
  2⤵
  PID:15436
- C:\Windows\System\ivLnrwi.exe
  C:\Windows\System\ivLnrwi.exe
  2⤵
  PID:15472
- C:\Windows\System\yAcXniJ.exe
  C:\Windows\System\yAcXniJ.exe
  2⤵
  PID:15504
- C:\Windows\System\fUCoWrx.exe
  C:\Windows\System\fUCoWrx.exe
  2⤵
  PID:15532
- C:\Windows\System\vPgjCmv.exe
  C:\Windows\System\vPgjCmv.exe
  2⤵
  PID:15548
- C:\Windows\System\Qkqkier.exe
  C:\Windows\System\Qkqkier.exe
  2⤵
  PID:15604
- C:\Windows\System\vdvvofk.exe
  C:\Windows\System\vdvvofk.exe
  2⤵
  PID:15624
- C:\Windows\System\GLaLsKu.exe
  C:\Windows\System\GLaLsKu.exe
  2⤵
  PID:15644
- C:\Windows\System\bitDfZH.exe
  C:\Windows\System\bitDfZH.exe
  2⤵
  PID:15672
- C:\Windows\System\jbjwbHo.exe
  C:\Windows\System\jbjwbHo.exe
  2⤵
  PID:15708
- C:\Windows\System\vMFrUaV.exe
  C:\Windows\System\vMFrUaV.exe
  2⤵
  PID:15732
- C:\Windows\System\eBbviyg.exe
  C:\Windows\System\eBbviyg.exe
  2⤵
  PID:15764
- C:\Windows\System\oMwNxvF.exe
  C:\Windows\System\oMwNxvF.exe
  2⤵
  PID:15784
- C:\Windows\System\GBjETBk.exe
  C:\Windows\System\GBjETBk.exe
  2⤵
  PID:15808
- C:\Windows\System\KLKBvcS.exe
  C:\Windows\System\KLKBvcS.exe
  2⤵
  PID:15832
- C:\Windows\System\PAQlwrT.exe
  C:\Windows\System\PAQlwrT.exe
  2⤵
  PID:15852
- C:\Windows\System\UyYEAKi.exe
  C:\Windows\System\UyYEAKi.exe
  2⤵
  PID:15900
- C:\Windows\System\myXswrG.exe
  C:\Windows\System\myXswrG.exe
  2⤵
  PID:15924
- C:\Windows\System\uHowdWr.exe
  C:\Windows\System\uHowdWr.exe
  2⤵
  PID:15948
- C:\Windows\System\qkQBSdP.exe
  C:\Windows\System\qkQBSdP.exe
  2⤵
  PID:15972
- C:\Windows\System\MmUfFgu.exe
  C:\Windows\System\MmUfFgu.exe
  2⤵
  PID:16028
- C:\Windows\System\GRVMwKS.exe
  C:\Windows\System\GRVMwKS.exe
  2⤵
  PID:16060
- C:\Windows\System\fZwmjnX.exe
  C:\Windows\System\fZwmjnX.exe
  2⤵
  PID:16076
- C:\Windows\System\rxEpmsU.exe
  C:\Windows\System\rxEpmsU.exe
  2⤵
  PID:16100
- C:\Windows\System\AFccHoZ.exe
  C:\Windows\System\AFccHoZ.exe
  2⤵
  PID:16148
- C:\Windows\System\yVGQvAt.exe
  C:\Windows\System\yVGQvAt.exe
  2⤵
  PID:16172
- C:\Windows\System\XekeMhZ.exe
  C:\Windows\System\XekeMhZ.exe
  2⤵
  PID:16208
- C:\Windows\System\YPrwFmY.exe
  C:\Windows\System\YPrwFmY.exe
  2⤵
  PID:16228
- C:\Windows\System\lUpuKLO.exe
  C:\Windows\System\lUpuKLO.exe
  2⤵
  PID:16256
- C:\Windows\System\sirlNQp.exe
  C:\Windows\System\sirlNQp.exe
  2⤵
  PID:16288
- C:\Windows\System\QlfTsZP.exe
  C:\Windows\System\QlfTsZP.exe
  2⤵
  PID:16308
- C:\Windows\System\YWGVNWZ.exe
  C:\Windows\System\YWGVNWZ.exe
  2⤵
  PID:16336
- C:\Windows\System\PsCkRbT.exe
  C:\Windows\System\PsCkRbT.exe
  2⤵
  PID:16356
- C:\Windows\System\XyFCQCD.exe
  C:\Windows\System\XyFCQCD.exe
  2⤵
  PID:16380
- C:\Windows\System\IKTKMhq.exe
  C:\Windows\System\IKTKMhq.exe
  2⤵
  PID:14492
- C:\Windows\System\zVzOfGg.exe
  C:\Windows\System\zVzOfGg.exe
  2⤵
  PID:15404
- C:\Windows\System\CucmkUJ.exe
  C:\Windows\System\CucmkUJ.exe
  2⤵
  PID:15484
- C:\Windows\System\rEezTkb.exe
  C:\Windows\System\rEezTkb.exe
  2⤵
  PID:15516
- C:\Windows\System\Ubxxzjf.exe
  C:\Windows\System\Ubxxzjf.exe
  2⤵
  PID:15584
- C:\Windows\System\VAUEIWc.exe
  C:\Windows\System\VAUEIWc.exe
  2⤵
  PID:15636
- C:\Windows\System\WyhAXbi.exe
  C:\Windows\System\WyhAXbi.exe
  2⤵
  PID:15684
- C:\Windows\System\JCdFSjW.exe
  C:\Windows\System\JCdFSjW.exe
  2⤵
  PID:15756
- C:\Windows\System\UCSurXp.exe
  C:\Windows\System\UCSurXp.exe
  2⤵
  PID:15796
- C:\Windows\System\BKKfchE.exe
  C:\Windows\System\BKKfchE.exe
  2⤵
  PID:15844
- C:\Windows\System\LcMxnsh.exe
  C:\Windows\System\LcMxnsh.exe
  2⤵
  PID:15916
- C:\Windows\System\cEXalqz.exe
  C:\Windows\System\cEXalqz.exe
  2⤵
  PID:15960
- C:\Windows\System\WvZMJiq.exe
  C:\Windows\System\WvZMJiq.exe
  2⤵
  PID:16040
- C:\Windows\System\aGLqQyj.exe
  C:\Windows\System\aGLqQyj.exe
  2⤵
  PID:16096
- C:\Windows\System\uuRXJrK.exe
  C:\Windows\System\uuRXJrK.exe
  2⤵
  PID:16144
- C:\Windows\System\pMSBJIv.exe
  C:\Windows\System\pMSBJIv.exe
  2⤵
  PID:16220
- C:\Windows\System\UdYNHRU.exe
  C:\Windows\System\UdYNHRU.exe
  2⤵
  PID:16272
- C:\Windows\System\RJLdysm.exe
  C:\Windows\System\RJLdysm.exe
  2⤵
  PID:16372
- C:\Windows\System\wfqCtxH.exe
  C:\Windows\System\wfqCtxH.exe
  2⤵
  PID:15468
- C:\Windows\System\gjdcmas.exe
  C:\Windows\System\gjdcmas.exe
  2⤵
  PID:15488
- C:\Windows\System\fSekbKZ.exe
  C:\Windows\System\fSekbKZ.exe
  2⤵
  PID:15616
- C:\Windows\System\WelILAQ.exe
  C:\Windows\System\WelILAQ.exe
  2⤵
  PID:15800
- C:\Windows\System\jSEdcWf.exe
  C:\Windows\System\jSEdcWf.exe
  2⤵
  PID:15876
- C:\Windows\System\KgXbREq.exe
  C:\Windows\System\KgXbREq.exe
  2⤵
  PID:16252
- C:\Windows\System\ATrKJVb.exe
  C:\Windows\System\ATrKJVb.exe
  2⤵
  PID:16332
- C:\Windows\System\SuFeUMq.exe
  C:\Windows\System\SuFeUMq.exe
  2⤵
  PID:15432
- C:\Windows\System\lNYJDCA.exe
  C:\Windows\System\lNYJDCA.exe
  2⤵
  PID:14676
- C:\Windows\System\mVYHZpL.exe
  C:\Windows\System\mVYHZpL.exe
  2⤵
  PID:15968
- C:\Windows\System\yyoutgE.exe
  C:\Windows\System\yyoutgE.exe
  2⤵
  PID:16400
- C:\Windows\System\CKtbJLZ.exe
  C:\Windows\System\CKtbJLZ.exe
  2⤵
  PID:16424
- C:\Windows\System\boSXaJN.exe
  C:\Windows\System\boSXaJN.exe
  2⤵
  PID:16448
- C:\Windows\System\qMepKwK.exe
  C:\Windows\System\qMepKwK.exe
  2⤵
  PID:16472
- C:\Windows\System\crTYFLz.exe
  C:\Windows\System\crTYFLz.exe
  2⤵
  PID:16492
- C:\Windows\System\iUzZZkb.exe
  C:\Windows\System\iUzZZkb.exe
  2⤵
  PID:16512
- C:\Windows\System\AwSrrul.exe
  C:\Windows\System\AwSrrul.exe
  2⤵
  PID:16532
- C:\Windows\System\yJmonih.exe
  C:\Windows\System\yJmonih.exe
  2⤵
  PID:16564
- C:\Windows\System\VpwYvAm.exe
  C:\Windows\System\VpwYvAm.exe
  2⤵
  PID:16584
- C:\Windows\System\DMiIFKc.exe
  C:\Windows\System\DMiIFKc.exe
  2⤵
  PID:16604
- C:\Windows\System\SPuNGSU.exe
  C:\Windows\System\SPuNGSU.exe
  2⤵
  PID:16636
- C:\Windows\System\rKuQrRG.exe
  C:\Windows\System\rKuQrRG.exe
  2⤵
  PID:16652
- C:\Windows\System\sZzuRFQ.exe
  C:\Windows\System\sZzuRFQ.exe
  2⤵
  PID:16676
- C:\Windows\System\ujenrtP.exe
  C:\Windows\System\ujenrtP.exe
  2⤵
  PID:16716
- C:\Windows\System\BoeYrSK.exe
  C:\Windows\System\BoeYrSK.exe
  2⤵
  PID:16744
- C:\Windows\System\bQlMrBF.exe
  C:\Windows\System\bQlMrBF.exe
  2⤵
  PID:16764
- C:\Windows\System\OXXJtpo.exe
  C:\Windows\System\OXXJtpo.exe
  2⤵
  PID:16788
- C:\Windows\System\OXPvRpK.exe
  C:\Windows\System\OXPvRpK.exe
  2⤵
  PID:16812
- C:\Windows\System\WfFEXvP.exe
  C:\Windows\System\WfFEXvP.exe
  2⤵
  PID:16840
- C:\Windows\System\hBWfdwo.exe
  C:\Windows\System\hBWfdwo.exe
  2⤵
  PID:16860
- C:\Windows\System\YUfuZlT.exe
  C:\Windows\System\YUfuZlT.exe
  2⤵
  PID:16880
- C:\Windows\System\jVWBQXt.exe
  C:\Windows\System\jVWBQXt.exe
  2⤵
  PID:16908
- C:\Windows\System\vzdOLBa.exe
  C:\Windows\System\vzdOLBa.exe
  2⤵
  PID:16932
- C:\Windows\System\UDrYYhz.exe
  C:\Windows\System\UDrYYhz.exe
  2⤵
  PID:16952
- C:\Windows\System\hhanxMl.exe
  C:\Windows\System\hhanxMl.exe
  2⤵
  PID:16972
- C:\Windows\System\KuiErDy.exe
  C:\Windows\System\KuiErDy.exe
  2⤵
  PID:16992
- C:\Windows\System\FVvrika.exe
  C:\Windows\System\FVvrika.exe
  2⤵
  PID:17024
- C:\Windows\System\KyCVOgH.exe
  C:\Windows\System\KyCVOgH.exe
  2⤵
  PID:17040
- C:\Windows\System\aHQcKhW.exe
  C:\Windows\System\aHQcKhW.exe
  2⤵
  PID:17056
- C:\Windows\System\oMTWIZa.exe
  C:\Windows\System\oMTWIZa.exe
  2⤵
  PID:17072
- C:\Windows\System\RGLyylS.exe
  C:\Windows\System\RGLyylS.exe
  2⤵
  PID:17096
- C:\Windows\System\TTMaKGs.exe
  C:\Windows\System\TTMaKGs.exe
  2⤵
  PID:17112
- C:\Windows\System\qzHprRQ.exe
  C:\Windows\System\qzHprRQ.exe
  2⤵
  PID:16316
- C:\Windows\System\XoHMVJe.exe
  C:\Windows\System\XoHMVJe.exe
  2⤵
  PID:15740
- C:\Windows\System\trIpMjA.exe
  C:\Windows\System\trIpMjA.exe
  2⤵
  PID:16396
- C:\Windows\System\QkfLUeQ.exe
  C:\Windows\System\QkfLUeQ.exe
  2⤵
  PID:16548
- C:\Windows\System\meQwzSH.exe
  C:\Windows\System\meQwzSH.exe
  2⤵
  PID:17124
- C:\Windows\System\OLgWpWP.exe
  C:\Windows\System\OLgWpWP.exe
  2⤵
  PID:17144

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\Aivxazi.exe

Filesize
1.0MB

MD5
b653fff11735cc7e99e4e60e636a1ca5

SHA1
2298bd7c9fb5c370912ab41c0edd20ac6b27647a

SHA256
60c4701fbdb878738ca1ea7e98ff68dd5b9f5f976b1310a6bd1773eb72e45a1e

SHA512
cae1b6e5161d445a355ae73f77bf7ccf488c638abf2901d3be2f0c019bc40252b3b7cf66766ad21969c7bf964c9e3966de91443856a3573407ed616931bbdc5c

Download Submit
C:\Windows\System\BcSeNIZ.exe

Filesize
1.0MB

MD5
0059e6ce283c4abd7e32b489076e6b71

SHA1
a9d20ce76b1680822bb430847d80792a7d76a905

SHA256
25776fb84f4b7ae56b3892e4a8337ec8cf71cd099f638bb7c6d109bb8b9df01d

SHA512
85b4e153c12fe3222fe8ef8cead82e1e3a36fb007ab98206998f168840577e0b95d1f6bec767156da5ea45c25ae83e6a1b2720fdefb9a63f3aed2e00732e1ca9

Download Submit
C:\Windows\System\CCUPVUB.exe

Filesize
1.0MB

MD5
85918a682352df8eb9f1f5d6a834bbfb

SHA1
084cde3d42d2a0a2a3d17ebdc62bce3965c1e83e

SHA256
f072ad508a5c07e59dc715f797d50f9f7940446b26510ed358af69ba00cd74d7

SHA512
a060281e6db496b419b20f99785f8c69b5d2348ebe3da9f01858d00644f51dadd5b82ad6c0926469789ad7fd7de0730785f853a5cc2ad80c8322bdaa800631e0

Download Submit
C:\Windows\System\CeJdbDR.exe

Filesize
1.0MB

MD5
fdf3ce0cd2c945090c7c5adf9d2718b6

SHA1
fb97974b70b31194ffd99b4ff6ff8b39d0691923

SHA256
eba5bb2c4d7c99d267abde90aaa4fb3d0966bf7a85ba1504f2a3ac9d0fc75763

SHA512
c428286fb9e9455f1f39ea9787bfc2b4cb4cf64f52bdd6b96dfbe3f38afe31fb3be2843188f7e4f068e33c296820305f51fac820b76c8dbc8cdf5737706742ee

Download Submit
C:\Windows\System\GcgUyZK.exe

Filesize
1.0MB

MD5
c27ba1c2a244ec35cf1b44e398aff729

SHA1
53b0eb16c2bd030178ec583b58cab2e09905cb7d

SHA256
da718866dac1179bda2887f17d4578e53ac638f50487c32b4cac9072ba27d436

SHA512
d0742cdfd583173e52fd60263ff4b1b9ab15b545945e6d1fdedc90810ddbfb7cd680e3411b7be857f090db95e5a44f0f2bae1c58e49bfb86092873d371239167

Download Submit
C:\Windows\System\HKGKVEL.exe

Filesize
1.0MB

MD5
1caccb3bb1f288bac9e8e194f8d3ed99

SHA1
3657e24e87ef2a3947094c9a1507a2cff36f97b4

SHA256
dcaf36a6404bb0bf85d4bf64470ba7e9b85bf4c357fd2e714271178b0cf4e409

SHA512
9403602db5cfe596ac92aff13037c3982e3ba445ab19110c1f5e992c97eb714657de6d824a0f1505b9aaba3a98041cf8bb55a549b54f599752cc160233116f3f

Download Submit
C:\Windows\System\HNDhzrZ.exe

Filesize
1.0MB

MD5
ceeb08aab834309eace4033627408d04

SHA1
e392a62a9f709e0c7cb4acb326488319772e03f1

SHA256
b58eeb4e30ed6e34ab824e268a011c93a4305dab978062bd880522bb514c0390

SHA512
12ac2ccee3545f03c284330a466d51662f2181c07a1a7d650d123599a055ff71c0a4668dbbac0549b0770ed475b0113bc2d798f1a49141bea91563b8ff3689a9

Download Submit
C:\Windows\System\IqiugeX.exe

Filesize
1.0MB

MD5
c4caf4aea9cf895cce272fa409c7d7da

SHA1
b04c0c458c8ea4eaf10c47addb42c53e9bb6e315

SHA256
102345b0560caea702a9ebf65b9945b0c0ca39f1930abe7f610effe73d11db08

SHA512
b9bcba8a01f5c5130ac6f017a4c0d2024b687dc880986decbddebf2f761dca5fee73d624b8113d645eebd8a48016e1e35ec2e0fe3e7ca0f0ae9a5629563a1607

Download Submit
C:\Windows\System\JnbGPga.exe

Filesize
1.0MB

MD5
4755de724a56d5e9e871f432d8ac7594

SHA1
32363635bd29cf63efca195c00f2620fb863cd41

SHA256
e4215238aaea5cf92a727d583e6b3d444773d514d85889df35964f702d42716a

SHA512
ae8c72bd7d56ed9b836d1abad125043a160f0baf1ebaddd9ca27a3640c86ab07e90100f17315ad8f1b1cdc1a9a47b4ce6640dc52f90011a76ac661610ec13db2

Download Submit
C:\Windows\System\LTocNdt.exe

Filesize
1.0MB

MD5
59297779b589eb85c923223c64eac589

SHA1
1fb1a459cb5137066f9aee59eca2e4dbade8e60c

SHA256
4d7dd1f05fe3fd184099ac6a637e22f5dc92946ab9bf6aa8d0c8048d20beb439

SHA512
d41a991eb1674fa251f280d1be988ad91dd79bc3290c1b58c68ab952ce8cb1f08dbae7caa790bc00174407c3be0dbd602f5486926493754dfc67d085f7ac6c9f

Download Submit
C:\Windows\System\LXknNyK.exe

Filesize
1.0MB

MD5
c12d0ddf56930ae95b21662d4402b336

SHA1
4ab02bb8a663af1e595bfbce7dabc7c974f8e871

SHA256
f2d2da7a0a43ac4a25264747dfb7c0c2595c1e2f02a01bc5a4575b121281e03b

SHA512
d56ce6341c7cc3409369c2754066cf7df5dc23d2c9faca37bbfa07a04f374038d133df1c12d711c96c7d4a24baba9ecc63fb2c77b676106c64248be114a4d011

Download Submit
C:\Windows\System\MYoauXV.exe

Filesize
1.0MB

MD5
e824823f0a2147e80fbf404e59a32623

SHA1
631a993a74439267e3688eef0852bb78f0319716

SHA256
3c45460136a6c2837bdc240d88d0729d0bf1a717dc815b2af2792f8ee0a3cba7

SHA512
23efaa5c0f66c3a3f1604eb989c1ff3c5e14731c48137d746187c310a3e719a81f6fb85ff770e1504a7f331c7371b82a179b139e8a08dc1d7fe2ea5eaeb959b5

Download Submit
C:\Windows\System\NAxhheG.exe

Filesize
1.0MB

MD5
1f178993cc3cfad5980e21f286f33316

SHA1
cbecfe1a8f2a61a7f4a68f40dbbd87253885b6ef

SHA256
1e1856cd9bf21f2cf6617e6dbfbe844026cfb5fa82934c04b456f49c661a4bcd

SHA512
240f03005dc44e52a964331a66ca702d9f048a3af0d90ed3a54c760a8aae2ed4edec769560f6fffebdd313641fe8366fb9d49d6e63102f79bf74fc42b192fa6c

Download Submit
C:\Windows\System\PdOaOwK.exe

Filesize
1.0MB

MD5
9f5feab9ebaa9785073a32af3519b3f1

SHA1
8a8ff4e94f35876784d35f79127c2418792f10b7

SHA256
9ea1585d91fef4eb2125c1fdc7769b6e9355d1dcefcd9aa8b0fb2adb833f4f69

SHA512
3f33d0f89ed4626df3aeafeea7dcbceae28805e3e706713d375e31069fa48688d95f4e472302232f47a583ddc618138a24ddb0d8a94788772d0d347b7ec67329

Download Submit
C:\Windows\System\UaKJvHw.exe

Filesize
1.0MB

MD5
90f882185269133c0ece8027594f1211

SHA1
802eb13de7e5387f29b3c6c9e002c68669646c66

SHA256
98c5ae551fdaecc255d70e353840da4ce1293d0c36f84bb304d9278c07884b3f

SHA512
628cdbb4d0cafb3f4a3697f2242112b009a2ec9fb44bfc7664ffa3776bd0018a791b494aeb4385026aa1d59eb2805c6ac7aae57e239332d6d71976890bf396c3

Download Submit
C:\Windows\System\UfMJzrU.exe

Filesize
1.0MB

MD5
45e5fa4ac8faf445af5bb2f5423ac7a9

SHA1
7f5a41f19e45d390fcf24560f9c17e1480d39758

SHA256
830d3993968bb9cf4f3cd50ca639210f1626ab557471516918678baec7a519b5

SHA512
057d0ce0a35e9b2ae75539756a11311665e88d9e5483115162b6f63a6dcebfcf3a477440e4d7bd0d5cf1308e484c38c3fed2140706b5458ad44e0783f85e83f2

Download Submit
C:\Windows\System\VFXawTX.exe

Filesize
1.0MB

MD5
6dd002cc1fe195e58007a0bcbd05b237

SHA1
6763aa0f48878a8b1875b12dbc9069215a0c8978

SHA256
66f1f481f7d430727496ccb44fe0ca9f180616fb63c1cddee44ba7b42b6672cf

SHA512
b17a111fe2995dfa6c075e919639fbd537d9c5c6e7e37cfaa8dff1733814e7ddb1f52ce6f876cb8008938ea76e915a114525e5be93a0336a9b0dbac257731d38

Download Submit
C:\Windows\System\VGkmhyc.exe

Filesize
1.0MB

MD5
0f95600e39d867dc9cf9e1c6b1469a54

SHA1
ab294184704bea2ed3a086c9a9043a10b18a4a6d

SHA256
da456d6235288c95b78050265502f3a55990683a18228594a179fba6f4a9012f

SHA512
0dfd4cb205270021e52962558548d20e8d3c9cc55df6cdb11da2916d2c2e7eee2b9551407fa3bb9312f56e9f9b2c768626384a1200383be3f45fa27c347fc8bf

Download Submit
C:\Windows\System\WyXyqGg.exe

Filesize
1.0MB

MD5
392a8c3c0a3dda1cb0413d9738b4c44c

SHA1
594e4ed1210c930ff7fbc3b177589180bd072a50

SHA256
187d621967caed51efc28f8476878a4c0494f813ce0b2e7779285f23fdf09eaa

SHA512
772c82726a4e23a5f392d06fa4bcacf4869624b2d724eb791f68731a2146227b8ee7063e87d5bf19c058818b97f887fac9c0cdf7edc3ffb4ebaa9ad22fd57267

Download Submit
C:\Windows\System\aJwqmKR.exe

Filesize
1.0MB

MD5
81aa7a18b792fc24fa2de2efe868a4f6

SHA1
982bedb86fcebd32e3eb25b48ad39d5f5d81b7dd

SHA256
f2a36820e604c69bac69dcd4443420e4c080a2e894a46e89e5be1b0b893f9810

SHA512
ca57b8c79e824965cddf6d718d3d704afe9a89d73fbbf50d289ff3d6136a6398b3baa9fec690d06f516b658e6417bbedacd73860fcaf2674722c855d20ab8632

Download Submit
C:\Windows\System\aubWBQz.exe

Filesize
1.0MB

MD5
6ffa526cb9a528a35e9799b307bc0716

SHA1
fab670354c73c8e75b6acc526f739adfc1a6eac9

SHA256
5007b13a4a1648934a2a110f73f75377dd8dc80613008224cbf1c4ea3fd85ec3

SHA512
e0a51f252ca0cdd8dd4dcdf74374ef02209f1546d65000001a43a3178b07247d550ea4bde0222529965dcdbfb2184a5a3172526dfb6c2a28c0f1604699ac4a5f

Download Submit
C:\Windows\System\cJOJdkw.exe

Filesize
1.0MB

MD5
7b5e4ceb3afb1916ea8138add46f8f83

SHA1
1b67e9f7b18a62501987cafac02c46fc4296cbc4

SHA256
edb218d3fac699d557be188a15f385b290cc4b0648ea9c561bb93b2f5e07e3e1

SHA512
117066b881a0475fb31697aab2be9a6279cda3a525900e7934d54b8cb46afb026d5466fdeacf6224872955dd482f66924201737a2cf8c4f8c8c2899c4f852bbf

Download Submit
C:\Windows\System\dAOkhUa.exe

Filesize
1.0MB

MD5
7bd35b13a9876b75bddc98ab6f081c68

SHA1
561302c05043d6458c4fb34c059d170539322973

SHA256
1f5ed235f9a4880575bce8e4d0ffd043b3cc934dbf72afdb80a380c6a917e762

SHA512
e557593d7c639fbda844dae961c3b3677a1c34a405f47fec869ad7e86dc67d1422ac34a9d519854fa307d4bd8b24cf06a958356312705c4293c5208c8e54ca24

Download Submit
C:\Windows\System\dsjKVlY.exe

Filesize
1.0MB

MD5
7aedae091184c65f3cf3082c49852bb5

SHA1
a56de2a6375ad724e3cedc286b9519a709f0493c

SHA256
778fb40e78265fdcc24b09bd19ce7b6bce5478a66f886354e0f7c7a97c243d49

SHA512
7913c07639797989e3f6f20f582d8ead418577ed63a705283604c1ba1c324343324a6a1a4adff13b6dc5330aba996e445ba89ef57ede41aa4e108d6266b802ef

Download Submit
C:\Windows\System\fGLWLOd.exe

Filesize
1.0MB

MD5
82d76b454570edcc3eeb3c7efc48204c

SHA1
c6283d9d5a77b0a1aff1e37061277d25a2d10f12

SHA256
9f529c8a9fb3467cca1bd56c8653058e0bd1d6aeb0a8ba978ed7bee4887b43a3

SHA512
9c9d9f142661292fa4bf17efbca6514ea08c91b8821f542f86ac040e1be79ba8e62b08033866e027c0816449de648a3b49c72631255bf528b6722ead819df5c5

Download Submit
C:\Windows\System\gJbokoQ.exe

Filesize
1.0MB

MD5
77ca6c7446d07d8b8c2dd8de10d90503

SHA1
c070be43b2d3f36020311e6df0b00ee2a5204409

SHA256
629b35c4f13c37fb8ad180dec91db4fc054b3f81932693052439fa681dd0b2b8

SHA512
fd83478d498a691819a2e5913ad68c458da07a7250dad063a8f70dece889a8c97ea0b72d1660f8eb664026973f8666340e1323e6b4aad2ae613ff2bfe0b7749c

Download Submit
C:\Windows\System\lnmlgXF.exe

Filesize
1.0MB

MD5
062d1749461162ece7e9d220536e1bb8

SHA1
87ffc6bec8235f683458859fcaf9fa16ef684d38

SHA256
2268f6786a5833c9d36f104aac8548fb6ce988d4a0e0e679d1acedcc36d6b40b

SHA512
6779a93caff45e84853f0c2d19f349177e8832a016b8803ae092cb9f7ad0b3872d52e88cfccc4ddb537fa4eb626a2ad1e2dc83ee884955e1ae53f1ab6902d3d7

Download Submit
C:\Windows\System\mZhTwCn.exe

Filesize
1.0MB

MD5
dda3fdfe9a249781da8c0ccef2111dd9

SHA1
4913a7aa645464493f1f2e12a06dd3c047b064e4

SHA256
169d7245eae7b8138eac65cef13eb6bfd1696fbaab219283aa3d21dd51ea0096

SHA512
cbfca3849b32d1ddf7788fe959a5564cd324b880af78983cd6cc0f35d728878ba8a2ab86a3696cc15c4490a806bb07b3c0f3ee6e8e4e868f7fb09d1888f588df

Download Submit
C:\Windows\System\paLpJEu.exe

Filesize
1.0MB

MD5
73dee2c91380f5fe63b82fc748571477

SHA1
ecd70445910fec63967f03f65e20f6222ab4260f

SHA256
c57b8fa962954295ce588da82df4a423eeeac9b6e4d2274788846a339702fa0c

SHA512
511997426680ee31c77f545767c959f4eef97005f8352b35f0070b74d7e53cf28c5cf3ea4a4031d439f99d30b0f009d45d3edfb0e30617de60bc211bf05a2cb3

Download Submit
C:\Windows\System\qivbrVc.exe

Filesize
1.0MB

MD5
ca1abd3dfc13b67187ea288b49fc9a1d

SHA1
1b641a0dd212c9b95d2cb0782ddec3f3be639b19

SHA256
6400d08a24df6084e4d6fc9f2d77b6eb7882f2a27410c5fe2bd9c794ae9892fe

SHA512
04f3e75739cfcad3e1e2273d50afee2b206caf19445172d63ea60834f7bed47dead7eaf217a1ee80da4e62c5ce1e35c35f8b870849905f7fb3a6e8d34dc69801

Download Submit
C:\Windows\System\sfPmBAo.exe

Filesize
1.0MB

MD5
02dc156f45febec7366dcfe85a6ff582

SHA1
b0980944196b7479c06e0aad821aa7d4a5abbbc8

SHA256
e686ce791a873bb66337cf71ecf81b571c472464cc729eb07aa2e2f651c6fda2

SHA512
8d3cac7702c35422394f23cb6bf0a825cca30d8f0be6b0238506a56cd82bf1c50d3f7e72dc3ebf67b5bd26f093c6775bfc9d3194fae93fed99d81cdb154111fc

Download Submit
C:\Windows\System\tiEoRtu.exe

Filesize
1.0MB

MD5
fc327cd30145f83c3ff00e89dbb286be

SHA1
34c9b3a2f36fed375a7fe2397d10e77bb360356e

SHA256
2a1d55f04e9de6d64ca665d8eb1856419bfca0ff0ca84fb267b32d11c07726c9

SHA512
79fd6efcdb910e0e7077ba0adaeb236c8a8f4f04cb1df503024fb6a0fe4adad02b269ee69b4c11bfbc425d2248b4894566551078af797a35b3e5975d3c85aa58

Download Submit
C:\Windows\System\vDnGDXh.exe

Filesize
1.0MB

MD5
973c2f285ffb06c6ecac0cf86320d76f

SHA1
be7e1fb99731dd234565e7f17508c9b24f376890

SHA256
84d01d23a287d8d5bd57a5e2a401db921d620b5df5d62e1ed56b96d810182493

SHA512
df34e71b14450a3c684e8c52e34a0c4090e4d6743f90fc2dd765cf5d4e93f711d3b1a4658569ca3922b467f1da5538e22e3fa03ee31d619483973e0f2489234c

Download Submit
memory/1356-0-0x00000206D5C90000-0x00000206D5CA0000-memory.dmp

Filesize
64KB

Download