xmrig | 5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
Size

1.6MB
MD5

18e34310e26d1dc2c1df4e2c966def71
SHA1

da02c82de8d51282b23db55896b17eb0ea7e2f64
SHA256

5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848
SHA512

ed32fed780dc86496bef58834e33834861332bd6fed8051abb1a3d9b2f1b21acd993f126427e4c2d5b4197a6e53df19a9c55fdbf010368124f6322e9f4c6af77
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRx2T9va4fzx79:GemTLkNdfE0pZy4

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023ba4-3.dat	xmrig
behavioral2/files/0x000a000000023ba8-9.dat	xmrig
behavioral2/files/0x000a000000023baa-30.dat	xmrig
behavioral2/files/0x000a000000023bac-33.dat	xmrig
behavioral2/files/0x000a000000023bad-35.dat	xmrig
behavioral2/files/0x000a000000023bab-28.dat	xmrig
behavioral2/files/0x000a000000023ba9-26.dat	xmrig
behavioral2/files/0x000b000000023bae-39.dat	xmrig
behavioral2/files/0x000a000000023bb8-47.dat	xmrig
behavioral2/files/0x000e000000023bbf-55.dat	xmrig
behavioral2/files/0x000e000000023bd3-85.dat	xmrig
behavioral2/files/0x0008000000023c0b-113.dat	xmrig
behavioral2/files/0x0008000000023c15-143.dat	xmrig
behavioral2/files/0x0016000000023c49-171.dat	xmrig
behavioral2/files/0x000b000000023c48-168.dat	xmrig
behavioral2/files/0x0008000000023c0c-166.dat	xmrig
behavioral2/files/0x0008000000023c33-165.dat	xmrig
behavioral2/files/0x0008000000023c32-164.dat	xmrig
behavioral2/files/0x0008000000023c31-163.dat	xmrig
behavioral2/files/0x0008000000023c30-158.dat	xmrig
behavioral2/files/0x0008000000023c2f-157.dat	xmrig
behavioral2/files/0x0008000000023bda-156.dat	xmrig
behavioral2/files/0x0008000000023bd9-155.dat	xmrig
behavioral2/files/0x0008000000023c0a-151.dat	xmrig
behavioral2/files/0x0008000000023c2e-150.dat	xmrig
behavioral2/files/0x0008000000023c28-149.dat	xmrig
behavioral2/files/0x0008000000023c16-146.dat	xmrig
behavioral2/files/0x0008000000023c14-140.dat	xmrig
behavioral2/files/0x0008000000023c0f-137.dat	xmrig
behavioral2/files/0x0008000000023c0e-134.dat	xmrig
behavioral2/files/0x0008000000023c0d-133.dat	xmrig
behavioral2/files/0x0008000000023bd8-129.dat	xmrig
behavioral2/files/0x0008000000023bd5-127.dat	xmrig
behavioral2/files/0x0008000000023bdb-105.dat	xmrig
behavioral2/files/0x0009000000023bcf-104.dat	xmrig
behavioral2/files/0x0009000000023bce-99.dat	xmrig
behavioral2/files/0x0009000000023bcd-92.dat	xmrig
behavioral2/files/0x0008000000023bc8-86.dat	xmrig
behavioral2/files/0x000b000000023ba5-78.dat	xmrig
behavioral2/files/0x000b000000023bb0-48.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3472	HEAGIRM.exe
4052	hnaqnCf.exe
4868	aDvSvTP.exe
2556	TdqmidI.exe
2188	raTWJuD.exe
1408	jOGUiFg.exe
4708	apKRACa.exe
1996	LKnXtwc.exe
2784	tQTncnv.exe
2904	WqKsgFL.exe
2372	dFjLqZX.exe
3784	luqpQMm.exe
4788	vnmokeM.exe
4864	OZLVfVr.exe
2156	eAOrYXC.exe
1680	LlgPSZn.exe
2408	SIqsiBi.exe
2296	rGoxWtG.exe
2240	kJGRARy.exe
3612	pZtsTjD.exe
5108	IPPjOUn.exe
556	dKCXjfO.exe
452	eCnBjMM.exe
1172	DjdONzV.exe
2980	KqzGnGB.exe
3128	YtwLaeN.exe
1224	sknhNkZ.exe
1012	UzuqxHL.exe
440	XuKotlD.exe
3132	BdMzSEM.exe
4228	TYWVzpH.exe
4640	PqXnkOE.exe
2084	FRxBjrG.exe
2792	WErVOGQ.exe
1396	GuKFhJD.exe
5016	xtZvEvX.exe
3076	PJDMfdm.exe
3928	KnHzxap.exe
4812	ksYQaEu.exe
4348	cQsrKqt.exe
3412	IURMoEX.exe
4388	wqOZiCm.exe
2568	dolLjAN.exe
1316	XLohJyU.exe
1340	qUiORIf.exe
3640	TRTZYpD.exe
404	GZnhtWT.exe
3144	coBsmXo.exe
468	yYlcQpf.exe
1684	iBIKXrt.exe
3452	mNmPRGo.exe
3808	hmSGnNx.exe
2984	nYAHrQu.exe
4596	qOIXAGl.exe
3392	MutJmpn.exe
3156	ZQpjjEv.exe
4252	DoCtdQJ.exe
3080	gWPRygG.exe
3020	NpGFwhe.exe
4012	AeCCVeJ.exe
2108	dyeATOz.exe
4532	BZslnDy.exe
1856	FlAAFLy.exe
4748	YNhanNA.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HAOyAMb.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\UXuFdOb.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\vdzAalv.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\oLQrFBd.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\MutJmpn.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\OKHgYOi.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\qesdScT.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\ZYiwrFn.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\VFhtgQW.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\olbzFul.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\asIpVez.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\UMmquhH.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\apKRACa.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\yEQWXxZ.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\RrofYdw.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\KpcDHtR.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\shibAOg.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\qeFaHUH.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\khKXpLE.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\IMFfzPB.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\HQpTins.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\jOGUiFg.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\BZslnDy.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\wXbSSKt.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\zFNqFKZ.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\RbFYSVh.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\FILdGMo.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\iJnASDI.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\HCKrmUc.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\jIEVTdt.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\sqPBhuU.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\knJLWMn.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\xmcdbHF.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\jpVdrsF.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\qpAHKoI.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\Vvwgqrg.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\ERzFKMC.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\MhmOOag.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\yFXwxcQ.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\wmzfaDL.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\qEfQHQK.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\xIReNze.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\DUmUqdJ.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\iLJTZwL.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\onVcKeI.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\dIXRlYI.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\HplVSLR.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\whqeHyI.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\GekPohi.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\iOGydWR.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\axZGBNM.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\ugCHhDL.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\TBjoMSe.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\xmDLdFM.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\TRdbFht.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\rtdGBwG.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\nYAHrQu.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\jHrxbjF.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\JyGueYr.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\RKaMOfo.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\jnXzgqm.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\MvjeDJh.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\eCnBjMM.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
File created	C:\Windows\System\qjsyHpC.exe	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	13744	dwm.exe
Token: SeChangeNotifyPrivilege	13744	dwm.exe
Token: 33	13744	dwm.exe
Token: SeIncBasePriorityPrivilege	13744	dwm.exe
Token: SeShutdownPrivilege	13744	dwm.exe
Token: SeCreatePagefilePrivilege	13744	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3472	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	84
PID 4884 wrote to memory of 3472	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	84
PID 4884 wrote to memory of 4052	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	85
PID 4884 wrote to memory of 4052	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	85
PID 4884 wrote to memory of 4868	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	86
PID 4884 wrote to memory of 4868	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	86
PID 4884 wrote to memory of 2556	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	87
PID 4884 wrote to memory of 2556	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	87
PID 4884 wrote to memory of 2188	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	88
PID 4884 wrote to memory of 2188	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	88
PID 4884 wrote to memory of 1408	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	89
PID 4884 wrote to memory of 1408	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	89
PID 4884 wrote to memory of 4708	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	90
PID 4884 wrote to memory of 4708	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	90
PID 4884 wrote to memory of 1996	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	91
PID 4884 wrote to memory of 1996	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	91
PID 4884 wrote to memory of 2784	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	92
PID 4884 wrote to memory of 2784	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	92
PID 4884 wrote to memory of 2904	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	93
PID 4884 wrote to memory of 2904	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	93
PID 4884 wrote to memory of 2372	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	94
PID 4884 wrote to memory of 2372	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	94
PID 4884 wrote to memory of 3784	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	95
PID 4884 wrote to memory of 3784	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	95
PID 4884 wrote to memory of 4788	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	96
PID 4884 wrote to memory of 4788	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	96
PID 4884 wrote to memory of 4864	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	97
PID 4884 wrote to memory of 4864	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	97
PID 4884 wrote to memory of 2156	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	98
PID 4884 wrote to memory of 2156	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	98
PID 4884 wrote to memory of 1680	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	99
PID 4884 wrote to memory of 1680	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	99
PID 4884 wrote to memory of 2408	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	100
PID 4884 wrote to memory of 2408	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	100
PID 4884 wrote to memory of 2296	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	101
PID 4884 wrote to memory of 2296	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	101
PID 4884 wrote to memory of 2240	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	102
PID 4884 wrote to memory of 2240	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	102
PID 4884 wrote to memory of 3612	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	103
PID 4884 wrote to memory of 3612	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	103
PID 4884 wrote to memory of 5108	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	104
PID 4884 wrote to memory of 5108	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	104
PID 4884 wrote to memory of 556	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	105
PID 4884 wrote to memory of 556	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	105
PID 4884 wrote to memory of 452	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	106
PID 4884 wrote to memory of 452	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	106
PID 4884 wrote to memory of 1172	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	107
PID 4884 wrote to memory of 1172	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	107
PID 4884 wrote to memory of 2980	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	108
PID 4884 wrote to memory of 2980	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	108
PID 4884 wrote to memory of 3128	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	109
PID 4884 wrote to memory of 3128	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	109
PID 4884 wrote to memory of 1224	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	110
PID 4884 wrote to memory of 1224	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	110
PID 4884 wrote to memory of 1012	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	111
PID 4884 wrote to memory of 1012	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	111
PID 4884 wrote to memory of 440	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	112
PID 4884 wrote to memory of 440	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	112
PID 4884 wrote to memory of 3132	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	113
PID 4884 wrote to memory of 3132	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	113
PID 4884 wrote to memory of 4228	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	114
PID 4884 wrote to memory of 4228	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	114
PID 4884 wrote to memory of 4640	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	115
PID 4884 wrote to memory of 4640	4884	5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe	115

C:\Users\Admin\AppData\Local\Temp\5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe
"C:\Users\Admin\AppData\Local\Temp\5752a6fcdb277deb3adf83d3c8195b8fa18a1efa1548d6f0e4b91cdfbaeb0848.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\System\HEAGIRM.exe
  C:\Windows\System\HEAGIRM.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\hnaqnCf.exe
  C:\Windows\System\hnaqnCf.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\aDvSvTP.exe
  C:\Windows\System\aDvSvTP.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\TdqmidI.exe
  C:\Windows\System\TdqmidI.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\raTWJuD.exe
  C:\Windows\System\raTWJuD.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\jOGUiFg.exe
  C:\Windows\System\jOGUiFg.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\apKRACa.exe
  C:\Windows\System\apKRACa.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\LKnXtwc.exe
  C:\Windows\System\LKnXtwc.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\tQTncnv.exe
  C:\Windows\System\tQTncnv.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\WqKsgFL.exe
  C:\Windows\System\WqKsgFL.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\dFjLqZX.exe
  C:\Windows\System\dFjLqZX.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\luqpQMm.exe
  C:\Windows\System\luqpQMm.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\vnmokeM.exe
  C:\Windows\System\vnmokeM.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\OZLVfVr.exe
  C:\Windows\System\OZLVfVr.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\eAOrYXC.exe
  C:\Windows\System\eAOrYXC.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\LlgPSZn.exe
  C:\Windows\System\LlgPSZn.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\SIqsiBi.exe
  C:\Windows\System\SIqsiBi.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\rGoxWtG.exe
  C:\Windows\System\rGoxWtG.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\kJGRARy.exe
  C:\Windows\System\kJGRARy.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\pZtsTjD.exe
  C:\Windows\System\pZtsTjD.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\IPPjOUn.exe
  C:\Windows\System\IPPjOUn.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\dKCXjfO.exe
  C:\Windows\System\dKCXjfO.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\eCnBjMM.exe
  C:\Windows\System\eCnBjMM.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\DjdONzV.exe
  C:\Windows\System\DjdONzV.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\KqzGnGB.exe
  C:\Windows\System\KqzGnGB.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\YtwLaeN.exe
  C:\Windows\System\YtwLaeN.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\sknhNkZ.exe
  C:\Windows\System\sknhNkZ.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\UzuqxHL.exe
  C:\Windows\System\UzuqxHL.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\XuKotlD.exe
  C:\Windows\System\XuKotlD.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\BdMzSEM.exe
  C:\Windows\System\BdMzSEM.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\TYWVzpH.exe
  C:\Windows\System\TYWVzpH.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\PqXnkOE.exe
  C:\Windows\System\PqXnkOE.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\FRxBjrG.exe
  C:\Windows\System\FRxBjrG.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\WErVOGQ.exe
  C:\Windows\System\WErVOGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\GuKFhJD.exe
  C:\Windows\System\GuKFhJD.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\xtZvEvX.exe
  C:\Windows\System\xtZvEvX.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\PJDMfdm.exe
  C:\Windows\System\PJDMfdm.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\KnHzxap.exe
  C:\Windows\System\KnHzxap.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\ksYQaEu.exe
  C:\Windows\System\ksYQaEu.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\cQsrKqt.exe
  C:\Windows\System\cQsrKqt.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\IURMoEX.exe
  C:\Windows\System\IURMoEX.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\wqOZiCm.exe
  C:\Windows\System\wqOZiCm.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\dolLjAN.exe
  C:\Windows\System\dolLjAN.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\XLohJyU.exe
  C:\Windows\System\XLohJyU.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\qUiORIf.exe
  C:\Windows\System\qUiORIf.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\TRTZYpD.exe
  C:\Windows\System\TRTZYpD.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\GZnhtWT.exe
  C:\Windows\System\GZnhtWT.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\coBsmXo.exe
  C:\Windows\System\coBsmXo.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\yYlcQpf.exe
  C:\Windows\System\yYlcQpf.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\iBIKXrt.exe
  C:\Windows\System\iBIKXrt.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\mNmPRGo.exe
  C:\Windows\System\mNmPRGo.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\hmSGnNx.exe
  C:\Windows\System\hmSGnNx.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\nYAHrQu.exe
  C:\Windows\System\nYAHrQu.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\qOIXAGl.exe
  C:\Windows\System\qOIXAGl.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\MutJmpn.exe
  C:\Windows\System\MutJmpn.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\ZQpjjEv.exe
  C:\Windows\System\ZQpjjEv.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\DoCtdQJ.exe
  C:\Windows\System\DoCtdQJ.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\gWPRygG.exe
  C:\Windows\System\gWPRygG.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\NpGFwhe.exe
  C:\Windows\System\NpGFwhe.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\AeCCVeJ.exe
  C:\Windows\System\AeCCVeJ.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\dyeATOz.exe
  C:\Windows\System\dyeATOz.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\BZslnDy.exe
  C:\Windows\System\BZslnDy.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\FlAAFLy.exe
  C:\Windows\System\FlAAFLy.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\YNhanNA.exe
  C:\Windows\System\YNhanNA.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\MOBbrLQ.exe
  C:\Windows\System\MOBbrLQ.exe
  2⤵
  PID:4084
- C:\Windows\System\xTlFyse.exe
  C:\Windows\System\xTlFyse.exe
  2⤵
  PID:4036
- C:\Windows\System\GgRxBkf.exe
  C:\Windows\System\GgRxBkf.exe
  2⤵
  PID:4880
- C:\Windows\System\PaoteQt.exe
  C:\Windows\System\PaoteQt.exe
  2⤵
  PID:2808
- C:\Windows\System\dVlPtwA.exe
  C:\Windows\System\dVlPtwA.exe
  2⤵
  PID:3176
- C:\Windows\System\lTsVoGZ.exe
  C:\Windows\System\lTsVoGZ.exe
  2⤵
  PID:2412
- C:\Windows\System\dHIQVPZ.exe
  C:\Windows\System\dHIQVPZ.exe
  2⤵
  PID:1976
- C:\Windows\System\yUyhRAQ.exe
  C:\Windows\System\yUyhRAQ.exe
  2⤵
  PID:2684
- C:\Windows\System\zqvEFkw.exe
  C:\Windows\System\zqvEFkw.exe
  2⤵
  PID:116
- C:\Windows\System\DaGANKp.exe
  C:\Windows\System\DaGANKp.exe
  2⤵
  PID:4508
- C:\Windows\System\kFHansL.exe
  C:\Windows\System\kFHansL.exe
  2⤵
  PID:3936
- C:\Windows\System\UboPXap.exe
  C:\Windows\System\UboPXap.exe
  2⤵
  PID:980
- C:\Windows\System\DUmUqdJ.exe
  C:\Windows\System\DUmUqdJ.exe
  2⤵
  PID:768
- C:\Windows\System\FKvxukH.exe
  C:\Windows\System\FKvxukH.exe
  2⤵
  PID:4432
- C:\Windows\System\sBgfUJJ.exe
  C:\Windows\System\sBgfUJJ.exe
  2⤵
  PID:5044
- C:\Windows\System\zQzHvKi.exe
  C:\Windows\System\zQzHvKi.exe
  2⤵
  PID:2212
- C:\Windows\System\kLwdrja.exe
  C:\Windows\System\kLwdrja.exe
  2⤵
  PID:4408
- C:\Windows\System\UFLjfpq.exe
  C:\Windows\System\UFLjfpq.exe
  2⤵
  PID:3996
- C:\Windows\System\jFbACiA.exe
  C:\Windows\System\jFbACiA.exe
  2⤵
  PID:4704
- C:\Windows\System\ACIRGQC.exe
  C:\Windows\System\ACIRGQC.exe
  2⤵
  PID:2924
- C:\Windows\System\HplVSLR.exe
  C:\Windows\System\HplVSLR.exe
  2⤵
  PID:3708
- C:\Windows\System\UwoMjff.exe
  C:\Windows\System\UwoMjff.exe
  2⤵
  PID:2124
- C:\Windows\System\DbioqZu.exe
  C:\Windows\System\DbioqZu.exe
  2⤵
  PID:1772
- C:\Windows\System\vpxqbaq.exe
  C:\Windows\System\vpxqbaq.exe
  2⤵
  PID:1648
- C:\Windows\System\CSMfeYP.exe
  C:\Windows\System\CSMfeYP.exe
  2⤵
  PID:3912
- C:\Windows\System\QRNjCny.exe
  C:\Windows\System\QRNjCny.exe
  2⤵
  PID:2916
- C:\Windows\System\xFqDmfr.exe
  C:\Windows\System\xFqDmfr.exe
  2⤵
  PID:1756
- C:\Windows\System\VHtlDaf.exe
  C:\Windows\System\VHtlDaf.exe
  2⤵
  PID:1768
- C:\Windows\System\FGXaVmi.exe
  C:\Windows\System\FGXaVmi.exe
  2⤵
  PID:4716
- C:\Windows\System\JEdDgXz.exe
  C:\Windows\System\JEdDgXz.exe
  2⤵
  PID:548
- C:\Windows\System\zvFJBHy.exe
  C:\Windows\System\zvFJBHy.exe
  2⤵
  PID:3100
- C:\Windows\System\gorQugr.exe
  C:\Windows\System\gorQugr.exe
  2⤵
  PID:740
- C:\Windows\System\uwQLTzl.exe
  C:\Windows\System\uwQLTzl.exe
  2⤵
  PID:4064
- C:\Windows\System\XlZXzvr.exe
  C:\Windows\System\XlZXzvr.exe
  2⤵
  PID:5080
- C:\Windows\System\uJYdaIP.exe
  C:\Windows\System\uJYdaIP.exe
  2⤵
  PID:3116
- C:\Windows\System\iLJTZwL.exe
  C:\Windows\System\iLJTZwL.exe
  2⤵
  PID:780
- C:\Windows\System\jHrxbjF.exe
  C:\Windows\System\jHrxbjF.exe
  2⤵
  PID:3908
- C:\Windows\System\wssdoAE.exe
  C:\Windows\System\wssdoAE.exe
  2⤵
  PID:3868
- C:\Windows\System\JyGueYr.exe
  C:\Windows\System\JyGueYr.exe
  2⤵
  PID:4480
- C:\Windows\System\UczHTpK.exe
  C:\Windows\System\UczHTpK.exe
  2⤵
  PID:2640
- C:\Windows\System\fNlfIxC.exe
  C:\Windows\System\fNlfIxC.exe
  2⤵
  PID:2964
- C:\Windows\System\ERzFKMC.exe
  C:\Windows\System\ERzFKMC.exe
  2⤵
  PID:2900
- C:\Windows\System\aUfywQA.exe
  C:\Windows\System\aUfywQA.exe
  2⤵
  PID:3864
- C:\Windows\System\YDyXLYt.exe
  C:\Windows\System\YDyXLYt.exe
  2⤵
  PID:3024
- C:\Windows\System\fbCAQik.exe
  C:\Windows\System\fbCAQik.exe
  2⤵
  PID:3984
- C:\Windows\System\TwDgFbh.exe
  C:\Windows\System\TwDgFbh.exe
  2⤵
  PID:4336
- C:\Windows\System\wXbSSKt.exe
  C:\Windows\System\wXbSSKt.exe
  2⤵
  PID:212
- C:\Windows\System\TruMmwS.exe
  C:\Windows\System\TruMmwS.exe
  2⤵
  PID:2704
- C:\Windows\System\QMkeRdv.exe
  C:\Windows\System\QMkeRdv.exe
  2⤵
  PID:4712
- C:\Windows\System\IWPOJix.exe
  C:\Windows\System\IWPOJix.exe
  2⤵
  PID:1776
- C:\Windows\System\maKAuOH.exe
  C:\Windows\System\maKAuOH.exe
  2⤵
  PID:5132
- C:\Windows\System\dLsQUzU.exe
  C:\Windows\System\dLsQUzU.exe
  2⤵
  PID:5160
- C:\Windows\System\IJbtTgS.exe
  C:\Windows\System\IJbtTgS.exe
  2⤵
  PID:5200
- C:\Windows\System\VFhtgQW.exe
  C:\Windows\System\VFhtgQW.exe
  2⤵
  PID:5216
- C:\Windows\System\DtILYyN.exe
  C:\Windows\System\DtILYyN.exe
  2⤵
  PID:5244
- C:\Windows\System\yEQWXxZ.exe
  C:\Windows\System\yEQWXxZ.exe
  2⤵
  PID:5280
- C:\Windows\System\hTkaDmB.exe
  C:\Windows\System\hTkaDmB.exe
  2⤵
  PID:5300
- C:\Windows\System\HyKYNlh.exe
  C:\Windows\System\HyKYNlh.exe
  2⤵
  PID:5316
- C:\Windows\System\dyuThkW.exe
  C:\Windows\System\dyuThkW.exe
  2⤵
  PID:5348
- C:\Windows\System\PwhsOxX.exe
  C:\Windows\System\PwhsOxX.exe
  2⤵
  PID:5372
- C:\Windows\System\PMOwNCG.exe
  C:\Windows\System\PMOwNCG.exe
  2⤵
  PID:5404
- C:\Windows\System\zutMjWW.exe
  C:\Windows\System\zutMjWW.exe
  2⤵
  PID:5440
- C:\Windows\System\MYVJMnt.exe
  C:\Windows\System\MYVJMnt.exe
  2⤵
  PID:5460
- C:\Windows\System\beuLBfm.exe
  C:\Windows\System\beuLBfm.exe
  2⤵
  PID:5488
- C:\Windows\System\oFHuwNy.exe
  C:\Windows\System\oFHuwNy.exe
  2⤵
  PID:5516
- C:\Windows\System\CySNBvx.exe
  C:\Windows\System\CySNBvx.exe
  2⤵
  PID:5544
- C:\Windows\System\XFKbvSH.exe
  C:\Windows\System\XFKbvSH.exe
  2⤵
  PID:5560
- C:\Windows\System\shibAOg.exe
  C:\Windows\System\shibAOg.exe
  2⤵
  PID:5592
- C:\Windows\System\JPzAcrK.exe
  C:\Windows\System\JPzAcrK.exe
  2⤵
  PID:5624
- C:\Windows\System\jGvUEBQ.exe
  C:\Windows\System\jGvUEBQ.exe
  2⤵
  PID:5652
- C:\Windows\System\kDKmQHD.exe
  C:\Windows\System\kDKmQHD.exe
  2⤵
  PID:5680
- C:\Windows\System\rJMTwyV.exe
  C:\Windows\System\rJMTwyV.exe
  2⤵
  PID:5712
- C:\Windows\System\lpTSoxw.exe
  C:\Windows\System\lpTSoxw.exe
  2⤵
  PID:5752
- C:\Windows\System\LsswBME.exe
  C:\Windows\System\LsswBME.exe
  2⤵
  PID:5776
- C:\Windows\System\MpKlZpI.exe
  C:\Windows\System\MpKlZpI.exe
  2⤵
  PID:5804
- C:\Windows\System\bezrnkf.exe
  C:\Windows\System\bezrnkf.exe
  2⤵
  PID:5832
- C:\Windows\System\QANtbtT.exe
  C:\Windows\System\QANtbtT.exe
  2⤵
  PID:5860
- C:\Windows\System\bgEyyKr.exe
  C:\Windows\System\bgEyyKr.exe
  2⤵
  PID:5888
- C:\Windows\System\GncyOXW.exe
  C:\Windows\System\GncyOXW.exe
  2⤵
  PID:5916
- C:\Windows\System\IGmTooG.exe
  C:\Windows\System\IGmTooG.exe
  2⤵
  PID:5948
- C:\Windows\System\mPSsiQy.exe
  C:\Windows\System\mPSsiQy.exe
  2⤵
  PID:5972
- C:\Windows\System\zoBITjv.exe
  C:\Windows\System\zoBITjv.exe
  2⤵
  PID:6000
- C:\Windows\System\LzefsNg.exe
  C:\Windows\System\LzefsNg.exe
  2⤵
  PID:6016
- C:\Windows\System\XjQjsUQ.exe
  C:\Windows\System\XjQjsUQ.exe
  2⤵
  PID:6048
- C:\Windows\System\jtSDezv.exe
  C:\Windows\System\jtSDezv.exe
  2⤵
  PID:6084
- C:\Windows\System\jQTCgWT.exe
  C:\Windows\System\jQTCgWT.exe
  2⤵
  PID:6100
- C:\Windows\System\PxCicex.exe
  C:\Windows\System\PxCicex.exe
  2⤵
  PID:6140
- C:\Windows\System\GOfioZR.exe
  C:\Windows\System\GOfioZR.exe
  2⤵
  PID:5124
- C:\Windows\System\eseyPuZ.exe
  C:\Windows\System\eseyPuZ.exe
  2⤵
  PID:5196
- C:\Windows\System\RgtWVIz.exe
  C:\Windows\System\RgtWVIz.exe
  2⤵
  PID:5256
- C:\Windows\System\zmKFSjX.exe
  C:\Windows\System\zmKFSjX.exe
  2⤵
  PID:5328
- C:\Windows\System\iDVOmMD.exe
  C:\Windows\System\iDVOmMD.exe
  2⤵
  PID:5356
- C:\Windows\System\YSjVApJ.exe
  C:\Windows\System\YSjVApJ.exe
  2⤵
  PID:5428
- C:\Windows\System\FnLqrCg.exe
  C:\Windows\System\FnLqrCg.exe
  2⤵
  PID:5508
- C:\Windows\System\aCofUdQ.exe
  C:\Windows\System\aCofUdQ.exe
  2⤵
  PID:5552
- C:\Windows\System\ueBevjT.exe
  C:\Windows\System\ueBevjT.exe
  2⤵
  PID:5636
- C:\Windows\System\CzsrBOr.exe
  C:\Windows\System\CzsrBOr.exe
  2⤵
  PID:5664
- C:\Windows\System\GVScfpb.exe
  C:\Windows\System\GVScfpb.exe
  2⤵
  PID:5772
- C:\Windows\System\AgoiSZD.exe
  C:\Windows\System\AgoiSZD.exe
  2⤵
  PID:5788
- C:\Windows\System\iWRhkTN.exe
  C:\Windows\System\iWRhkTN.exe
  2⤵
  PID:5884
- C:\Windows\System\ugpreuu.exe
  C:\Windows\System\ugpreuu.exe
  2⤵
  PID:5936
- C:\Windows\System\eDVuRlv.exe
  C:\Windows\System\eDVuRlv.exe
  2⤵
  PID:6032
- C:\Windows\System\BMhvgsD.exe
  C:\Windows\System\BMhvgsD.exe
  2⤵
  PID:6092
- C:\Windows\System\FHIDlFb.exe
  C:\Windows\System\FHIDlFb.exe
  2⤵
  PID:5212
- C:\Windows\System\HDSFVVz.exe
  C:\Windows\System\HDSFVVz.exe
  2⤵
  PID:5180
- C:\Windows\System\mPzSSKI.exe
  C:\Windows\System\mPzSSKI.exe
  2⤵
  PID:5416
- C:\Windows\System\psMNlhX.exe
  C:\Windows\System\psMNlhX.exe
  2⤵
  PID:5504
- C:\Windows\System\hQJKnlI.exe
  C:\Windows\System\hQJKnlI.exe
  2⤵
  PID:5668
- C:\Windows\System\OEQmclH.exe
  C:\Windows\System\OEQmclH.exe
  2⤵
  PID:5796
- C:\Windows\System\rMEQVVN.exe
  C:\Windows\System\rMEQVVN.exe
  2⤵
  PID:6040
- C:\Windows\System\GChmxZN.exe
  C:\Windows\System\GChmxZN.exe
  2⤵
  PID:5232
- C:\Windows\System\HpOQXmQ.exe
  C:\Windows\System\HpOQXmQ.exe
  2⤵
  PID:5388
- C:\Windows\System\tpYWlrO.exe
  C:\Windows\System\tpYWlrO.exe
  2⤵
  PID:5484
- C:\Windows\System\EKMZQmO.exe
  C:\Windows\System\EKMZQmO.exe
  2⤵
  PID:5928
- C:\Windows\System\fKUtlPH.exe
  C:\Windows\System\fKUtlPH.exe
  2⤵
  PID:5144
- C:\Windows\System\UyyjOhF.exe
  C:\Windows\System\UyyjOhF.exe
  2⤵
  PID:6156
- C:\Windows\System\fBpwPcC.exe
  C:\Windows\System\fBpwPcC.exe
  2⤵
  PID:6188
- C:\Windows\System\zJWUmhF.exe
  C:\Windows\System\zJWUmhF.exe
  2⤵
  PID:6212
- C:\Windows\System\RGMccOu.exe
  C:\Windows\System\RGMccOu.exe
  2⤵
  PID:6232
- C:\Windows\System\RKaMOfo.exe
  C:\Windows\System\RKaMOfo.exe
  2⤵
  PID:6260
- C:\Windows\System\SwWULIU.exe
  C:\Windows\System\SwWULIU.exe
  2⤵
  PID:6308
- C:\Windows\System\LFPUAng.exe
  C:\Windows\System\LFPUAng.exe
  2⤵
  PID:6340
- C:\Windows\System\ziQNdwI.exe
  C:\Windows\System\ziQNdwI.exe
  2⤵
  PID:6368
- C:\Windows\System\SfpXsGw.exe
  C:\Windows\System\SfpXsGw.exe
  2⤵
  PID:6388
- C:\Windows\System\fltAWvh.exe
  C:\Windows\System\fltAWvh.exe
  2⤵
  PID:6424
- C:\Windows\System\dIXRlYI.exe
  C:\Windows\System\dIXRlYI.exe
  2⤵
  PID:6456
- C:\Windows\System\nBiUtam.exe
  C:\Windows\System\nBiUtam.exe
  2⤵
  PID:6480
- C:\Windows\System\sfGtmDQ.exe
  C:\Windows\System\sfGtmDQ.exe
  2⤵
  PID:6516
- C:\Windows\System\MhdnjBc.exe
  C:\Windows\System\MhdnjBc.exe
  2⤵
  PID:6548
- C:\Windows\System\lLGRDgO.exe
  C:\Windows\System\lLGRDgO.exe
  2⤵
  PID:6576
- C:\Windows\System\axZGBNM.exe
  C:\Windows\System\axZGBNM.exe
  2⤵
  PID:6604
- C:\Windows\System\kUYmkbi.exe
  C:\Windows\System\kUYmkbi.exe
  2⤵
  PID:6644
- C:\Windows\System\yMadnyx.exe
  C:\Windows\System\yMadnyx.exe
  2⤵
  PID:6660
- C:\Windows\System\gZqFGwa.exe
  C:\Windows\System\gZqFGwa.exe
  2⤵
  PID:6680
- C:\Windows\System\yNJFYTQ.exe
  C:\Windows\System\yNJFYTQ.exe
  2⤵
  PID:6708
- C:\Windows\System\qeFaHUH.exe
  C:\Windows\System\qeFaHUH.exe
  2⤵
  PID:6732
- C:\Windows\System\iSBDQVi.exe
  C:\Windows\System\iSBDQVi.exe
  2⤵
  PID:6772
- C:\Windows\System\LuNFZvs.exe
  C:\Windows\System\LuNFZvs.exe
  2⤵
  PID:6800
- C:\Windows\System\KssUSGC.exe
  C:\Windows\System\KssUSGC.exe
  2⤵
  PID:6816
- C:\Windows\System\eVaSScT.exe
  C:\Windows\System\eVaSScT.exe
  2⤵
  PID:6844
- C:\Windows\System\nDqVJWq.exe
  C:\Windows\System\nDqVJWq.exe
  2⤵
  PID:6884
- C:\Windows\System\EepqYHt.exe
  C:\Windows\System\EepqYHt.exe
  2⤵
  PID:6912
- C:\Windows\System\AfEbGwW.exe
  C:\Windows\System\AfEbGwW.exe
  2⤵
  PID:6940
- C:\Windows\System\QYzUQPD.exe
  C:\Windows\System\QYzUQPD.exe
  2⤵
  PID:6968
- C:\Windows\System\vFQceMX.exe
  C:\Windows\System\vFQceMX.exe
  2⤵
  PID:7000
- C:\Windows\System\gFpmUtk.exe
  C:\Windows\System\gFpmUtk.exe
  2⤵
  PID:7028
- C:\Windows\System\alIOWgQ.exe
  C:\Windows\System\alIOWgQ.exe
  2⤵
  PID:7052
- C:\Windows\System\eeJUnvU.exe
  C:\Windows\System\eeJUnvU.exe
  2⤵
  PID:7080
- C:\Windows\System\oldmecK.exe
  C:\Windows\System\oldmecK.exe
  2⤵
  PID:7104
- C:\Windows\System\ZturHUt.exe
  C:\Windows\System\ZturHUt.exe
  2⤵
  PID:7124
- C:\Windows\System\MhmOOag.exe
  C:\Windows\System\MhmOOag.exe
  2⤵
  PID:7156
- C:\Windows\System\lKoGFCH.exe
  C:\Windows\System\lKoGFCH.exe
  2⤵
  PID:6208
- C:\Windows\System\hTULmHl.exe
  C:\Windows\System\hTULmHl.exe
  2⤵
  PID:6256
- C:\Windows\System\ojYBMzl.exe
  C:\Windows\System\ojYBMzl.exe
  2⤵
  PID:6268
- C:\Windows\System\chqrmoq.exe
  C:\Windows\System\chqrmoq.exe
  2⤵
  PID:6328
- C:\Windows\System\LZNxjxJ.exe
  C:\Windows\System\LZNxjxJ.exe
  2⤵
  PID:6444
- C:\Windows\System\sJFPXUQ.exe
  C:\Windows\System\sJFPXUQ.exe
  2⤵
  PID:6404
- C:\Windows\System\gxpengL.exe
  C:\Windows\System\gxpengL.exe
  2⤵
  PID:6564
- C:\Windows\System\wHoYKxc.exe
  C:\Windows\System\wHoYKxc.exe
  2⤵
  PID:6624
- C:\Windows\System\umprUPA.exe
  C:\Windows\System\umprUPA.exe
  2⤵
  PID:6688
- C:\Windows\System\qohylMs.exe
  C:\Windows\System\qohylMs.exe
  2⤵
  PID:6696
- C:\Windows\System\CNlSoEw.exe
  C:\Windows\System\CNlSoEw.exe
  2⤵
  PID:6832
- C:\Windows\System\khKXpLE.exe
  C:\Windows\System\khKXpLE.exe
  2⤵
  PID:6880
- C:\Windows\System\eHWJgWe.exe
  C:\Windows\System\eHWJgWe.exe
  2⤵
  PID:6964
- C:\Windows\System\iFmwUnr.exe
  C:\Windows\System\iFmwUnr.exe
  2⤵
  PID:7008
- C:\Windows\System\TbnEDFc.exe
  C:\Windows\System\TbnEDFc.exe
  2⤵
  PID:7068
- C:\Windows\System\yoghjjJ.exe
  C:\Windows\System\yoghjjJ.exe
  2⤵
  PID:6168
- C:\Windows\System\olbzFul.exe
  C:\Windows\System\olbzFul.exe
  2⤵
  PID:7140
- C:\Windows\System\eSbZEtC.exe
  C:\Windows\System\eSbZEtC.exe
  2⤵
  PID:6416
- C:\Windows\System\uYFKuiB.exe
  C:\Windows\System\uYFKuiB.exe
  2⤵
  PID:6504
- C:\Windows\System\mmXwycf.exe
  C:\Windows\System\mmXwycf.exe
  2⤵
  PID:6600
- C:\Windows\System\GekPohi.exe
  C:\Windows\System\GekPohi.exe
  2⤵
  PID:6872
- C:\Windows\System\OBElOpt.exe
  C:\Windows\System\OBElOpt.exe
  2⤵
  PID:7016
- C:\Windows\System\yqOTOxJ.exe
  C:\Windows\System\yqOTOxJ.exe
  2⤵
  PID:5724
- C:\Windows\System\PiboeUh.exe
  C:\Windows\System\PiboeUh.exe
  2⤵
  PID:6472
- C:\Windows\System\xSAdfWv.exe
  C:\Windows\System\xSAdfWv.exe
  2⤵
  PID:6860
- C:\Windows\System\ertIuBT.exe
  C:\Windows\System\ertIuBT.exe
  2⤵
  PID:7020
- C:\Windows\System\iVcNCMs.exe
  C:\Windows\System\iVcNCMs.exe
  2⤵
  PID:6792
- C:\Windows\System\mJdyJZX.exe
  C:\Windows\System\mJdyJZX.exe
  2⤵
  PID:7184
- C:\Windows\System\LptxCpB.exe
  C:\Windows\System\LptxCpB.exe
  2⤵
  PID:7200
- C:\Windows\System\LlaGHmn.exe
  C:\Windows\System\LlaGHmn.exe
  2⤵
  PID:7224
- C:\Windows\System\ZSIyCpb.exe
  C:\Windows\System\ZSIyCpb.exe
  2⤵
  PID:7264
- C:\Windows\System\fAcDWuC.exe
  C:\Windows\System\fAcDWuC.exe
  2⤵
  PID:7284
- C:\Windows\System\CMaONLH.exe
  C:\Windows\System\CMaONLH.exe
  2⤵
  PID:7316
- C:\Windows\System\npdAQsV.exe
  C:\Windows\System\npdAQsV.exe
  2⤵
  PID:7344
- C:\Windows\System\darbLeU.exe
  C:\Windows\System\darbLeU.exe
  2⤵
  PID:7368
- C:\Windows\System\qVNzcKa.exe
  C:\Windows\System\qVNzcKa.exe
  2⤵
  PID:7400
- C:\Windows\System\UMFpvPr.exe
  C:\Windows\System\UMFpvPr.exe
  2⤵
  PID:7428
- C:\Windows\System\AiapHhp.exe
  C:\Windows\System\AiapHhp.exe
  2⤵
  PID:7460
- C:\Windows\System\SsqIgOF.exe
  C:\Windows\System\SsqIgOF.exe
  2⤵
  PID:7496
- C:\Windows\System\pehWXoW.exe
  C:\Windows\System\pehWXoW.exe
  2⤵
  PID:7524
- C:\Windows\System\jDQqXwz.exe
  C:\Windows\System\jDQqXwz.exe
  2⤵
  PID:7552
- C:\Windows\System\IiMnblo.exe
  C:\Windows\System\IiMnblo.exe
  2⤵
  PID:7580
- C:\Windows\System\qoUARlu.exe
  C:\Windows\System\qoUARlu.exe
  2⤵
  PID:7608
- C:\Windows\System\mQLBmOV.exe
  C:\Windows\System\mQLBmOV.exe
  2⤵
  PID:7640
- C:\Windows\System\TNIbFAe.exe
  C:\Windows\System\TNIbFAe.exe
  2⤵
  PID:7664
- C:\Windows\System\lwxziUo.exe
  C:\Windows\System\lwxziUo.exe
  2⤵
  PID:7692
- C:\Windows\System\pxatVhy.exe
  C:\Windows\System\pxatVhy.exe
  2⤵
  PID:7720
- C:\Windows\System\cPRaWVE.exe
  C:\Windows\System\cPRaWVE.exe
  2⤵
  PID:7748
- C:\Windows\System\KhIkeAt.exe
  C:\Windows\System\KhIkeAt.exe
  2⤵
  PID:7776
- C:\Windows\System\LTKOBID.exe
  C:\Windows\System\LTKOBID.exe
  2⤵
  PID:7804
- C:\Windows\System\NyJppXs.exe
  C:\Windows\System\NyJppXs.exe
  2⤵
  PID:7832
- C:\Windows\System\RqUMixY.exe
  C:\Windows\System\RqUMixY.exe
  2⤵
  PID:7860
- C:\Windows\System\outqqrj.exe
  C:\Windows\System\outqqrj.exe
  2⤵
  PID:7892
- C:\Windows\System\URaOBlh.exe
  C:\Windows\System\URaOBlh.exe
  2⤵
  PID:7908
- C:\Windows\System\xuLIQEB.exe
  C:\Windows\System\xuLIQEB.exe
  2⤵
  PID:7936
- C:\Windows\System\VsUWogt.exe
  C:\Windows\System\VsUWogt.exe
  2⤵
  PID:7964
- C:\Windows\System\FwOMkDQ.exe
  C:\Windows\System\FwOMkDQ.exe
  2⤵
  PID:7992
- C:\Windows\System\PrjfgLo.exe
  C:\Windows\System\PrjfgLo.exe
  2⤵
  PID:8028
- C:\Windows\System\SutAflK.exe
  C:\Windows\System\SutAflK.exe
  2⤵
  PID:8052
- C:\Windows\System\OpMBzdJ.exe
  C:\Windows\System\OpMBzdJ.exe
  2⤵
  PID:8088
- C:\Windows\System\dmLLPtn.exe
  C:\Windows\System\dmLLPtn.exe
  2⤵
  PID:8116
- C:\Windows\System\gEXQlyC.exe
  C:\Windows\System\gEXQlyC.exe
  2⤵
  PID:8136
- C:\Windows\System\XevKkeS.exe
  C:\Windows\System\XevKkeS.exe
  2⤵
  PID:8176
- C:\Windows\System\AtjQrNx.exe
  C:\Windows\System\AtjQrNx.exe
  2⤵
  PID:7116
- C:\Windows\System\zVEbBkT.exe
  C:\Windows\System\zVEbBkT.exe
  2⤵
  PID:7244
- C:\Windows\System\IaTXqTf.exe
  C:\Windows\System\IaTXqTf.exe
  2⤵
  PID:7280
- C:\Windows\System\RoFpKeH.exe
  C:\Windows\System\RoFpKeH.exe
  2⤵
  PID:7328
- C:\Windows\System\asIpVez.exe
  C:\Windows\System\asIpVez.exe
  2⤵
  PID:7388
- C:\Windows\System\zoGWNxS.exe
  C:\Windows\System\zoGWNxS.exe
  2⤵
  PID:7476
- C:\Windows\System\KXZeGtt.exe
  C:\Windows\System\KXZeGtt.exe
  2⤵
  PID:7564
- C:\Windows\System\fDQsNdZ.exe
  C:\Windows\System\fDQsNdZ.exe
  2⤵
  PID:7568
- C:\Windows\System\WdhaYls.exe
  C:\Windows\System\WdhaYls.exe
  2⤵
  PID:7600
- C:\Windows\System\zFJNdNt.exe
  C:\Windows\System\zFJNdNt.exe
  2⤵
  PID:7708
- C:\Windows\System\SBuOWFv.exe
  C:\Windows\System\SBuOWFv.exe
  2⤵
  PID:7760
- C:\Windows\System\zbDYrQd.exe
  C:\Windows\System\zbDYrQd.exe
  2⤵
  PID:7824
- C:\Windows\System\NFjgsGK.exe
  C:\Windows\System\NFjgsGK.exe
  2⤵
  PID:7924
- C:\Windows\System\NYUEOoS.exe
  C:\Windows\System\NYUEOoS.exe
  2⤵
  PID:7952
- C:\Windows\System\wwOBDkF.exe
  C:\Windows\System\wwOBDkF.exe
  2⤵
  PID:8020
- C:\Windows\System\cARIPEw.exe
  C:\Windows\System\cARIPEw.exe
  2⤵
  PID:8072
- C:\Windows\System\JFgysBx.exe
  C:\Windows\System\JFgysBx.exe
  2⤵
  PID:8156
- C:\Windows\System\pyawSNA.exe
  C:\Windows\System\pyawSNA.exe
  2⤵
  PID:7252
- C:\Windows\System\ROKPEER.exe
  C:\Windows\System\ROKPEER.exe
  2⤵
  PID:7452
- C:\Windows\System\rAunaDE.exe
  C:\Windows\System\rAunaDE.exe
  2⤵
  PID:7512
- C:\Windows\System\sEVranA.exe
  C:\Windows\System\sEVranA.exe
  2⤵
  PID:7536
- C:\Windows\System\iRILLsC.exe
  C:\Windows\System\iRILLsC.exe
  2⤵
  PID:7744
- C:\Windows\System\jVwsReZ.exe
  C:\Windows\System\jVwsReZ.exe
  2⤵
  PID:7848
- C:\Windows\System\FYEcIJi.exe
  C:\Windows\System\FYEcIJi.exe
  2⤵
  PID:8044
- C:\Windows\System\NnmgQxy.exe
  C:\Windows\System\NnmgQxy.exe
  2⤵
  PID:7192
- C:\Windows\System\xaROeXu.exe
  C:\Windows\System\xaROeXu.exe
  2⤵
  PID:7676
- C:\Windows\System\XWfMMaD.exe
  C:\Windows\System\XWfMMaD.exe
  2⤵
  PID:7872
- C:\Windows\System\RQndkSa.exe
  C:\Windows\System\RQndkSa.exe
  2⤵
  PID:8200
- C:\Windows\System\XLRrwEI.exe
  C:\Windows\System\XLRrwEI.exe
  2⤵
  PID:8224
- C:\Windows\System\puJlPdc.exe
  C:\Windows\System\puJlPdc.exe
  2⤵
  PID:8260
- C:\Windows\System\RbFYSVh.exe
  C:\Windows\System\RbFYSVh.exe
  2⤵
  PID:8292
- C:\Windows\System\DNuWgwU.exe
  C:\Windows\System\DNuWgwU.exe
  2⤵
  PID:8320
- C:\Windows\System\VvJUtNh.exe
  C:\Windows\System\VvJUtNh.exe
  2⤵
  PID:8344
- C:\Windows\System\cBVkLrD.exe
  C:\Windows\System\cBVkLrD.exe
  2⤵
  PID:8364
- C:\Windows\System\QHAvTgt.exe
  C:\Windows\System\QHAvTgt.exe
  2⤵
  PID:8396
- C:\Windows\System\RzKnqHt.exe
  C:\Windows\System\RzKnqHt.exe
  2⤵
  PID:8428
- C:\Windows\System\zHwNkcF.exe
  C:\Windows\System\zHwNkcF.exe
  2⤵
  PID:8460
- C:\Windows\System\mNuJAvV.exe
  C:\Windows\System\mNuJAvV.exe
  2⤵
  PID:8496
- C:\Windows\System\bJminwS.exe
  C:\Windows\System\bJminwS.exe
  2⤵
  PID:8516
- C:\Windows\System\zFNqFKZ.exe
  C:\Windows\System\zFNqFKZ.exe
  2⤵
  PID:8540
- C:\Windows\System\jIEVTdt.exe
  C:\Windows\System\jIEVTdt.exe
  2⤵
  PID:8580
- C:\Windows\System\TSIYvGD.exe
  C:\Windows\System\TSIYvGD.exe
  2⤵
  PID:8600
- C:\Windows\System\YFsERvu.exe
  C:\Windows\System\YFsERvu.exe
  2⤵
  PID:8628
- C:\Windows\System\hNeYbUc.exe
  C:\Windows\System\hNeYbUc.exe
  2⤵
  PID:8660
- C:\Windows\System\tevcDvj.exe
  C:\Windows\System\tevcDvj.exe
  2⤵
  PID:8692
- C:\Windows\System\KbobvfN.exe
  C:\Windows\System\KbobvfN.exe
  2⤵
  PID:8720
- C:\Windows\System\hHOMUyo.exe
  C:\Windows\System\hHOMUyo.exe
  2⤵
  PID:8748
- C:\Windows\System\WXTSCiF.exe
  C:\Windows\System\WXTSCiF.exe
  2⤵
  PID:8784
- C:\Windows\System\KiRGqay.exe
  C:\Windows\System\KiRGqay.exe
  2⤵
  PID:8812
- C:\Windows\System\fUdaoFc.exe
  C:\Windows\System\fUdaoFc.exe
  2⤵
  PID:8848
- C:\Windows\System\oSNHpPT.exe
  C:\Windows\System\oSNHpPT.exe
  2⤵
  PID:8868
- C:\Windows\System\VuPGIJd.exe
  C:\Windows\System\VuPGIJd.exe
  2⤵
  PID:8900
- C:\Windows\System\aPjjrlL.exe
  C:\Windows\System\aPjjrlL.exe
  2⤵
  PID:8928
- C:\Windows\System\KMqBbaY.exe
  C:\Windows\System\KMqBbaY.exe
  2⤵
  PID:8960
- C:\Windows\System\urZKSQZ.exe
  C:\Windows\System\urZKSQZ.exe
  2⤵
  PID:8980
- C:\Windows\System\afVMNXs.exe
  C:\Windows\System\afVMNXs.exe
  2⤵
  PID:9000
- C:\Windows\System\qhNvDPC.exe
  C:\Windows\System\qhNvDPC.exe
  2⤵
  PID:9028
- C:\Windows\System\jUVRTcW.exe
  C:\Windows\System\jUVRTcW.exe
  2⤵
  PID:9052
- C:\Windows\System\QDXcrOH.exe
  C:\Windows\System\QDXcrOH.exe
  2⤵
  PID:9080
- C:\Windows\System\CCaKbiN.exe
  C:\Windows\System\CCaKbiN.exe
  2⤵
  PID:9108
- C:\Windows\System\TBjoMSe.exe
  C:\Windows\System\TBjoMSe.exe
  2⤵
  PID:9136
- C:\Windows\System\nrtQxyl.exe
  C:\Windows\System\nrtQxyl.exe
  2⤵
  PID:9164
- C:\Windows\System\EygfEiC.exe
  C:\Windows\System\EygfEiC.exe
  2⤵
  PID:9200
- C:\Windows\System\tNPHOCG.exe
  C:\Windows\System\tNPHOCG.exe
  2⤵
  PID:7880
- C:\Windows\System\TXEsZoh.exe
  C:\Windows\System\TXEsZoh.exe
  2⤵
  PID:8244
- C:\Windows\System\mbarNDH.exe
  C:\Windows\System\mbarNDH.exe
  2⤵
  PID:8312
- C:\Windows\System\fDTQYKp.exe
  C:\Windows\System\fDTQYKp.exe
  2⤵
  PID:8408
- C:\Windows\System\vYJJhva.exe
  C:\Windows\System\vYJJhva.exe
  2⤵
  PID:8472
- C:\Windows\System\FuRkstI.exe
  C:\Windows\System\FuRkstI.exe
  2⤵
  PID:8480
- C:\Windows\System\PQrBFVx.exe
  C:\Windows\System\PQrBFVx.exe
  2⤵
  PID:8656
- C:\Windows\System\OoQpUXe.exe
  C:\Windows\System\OoQpUXe.exe
  2⤵
  PID:8680
- C:\Windows\System\WiUphli.exe
  C:\Windows\System\WiUphli.exe
  2⤵
  PID:8772
- C:\Windows\System\QYKHtMN.exe
  C:\Windows\System\QYKHtMN.exe
  2⤵
  PID:8800
- C:\Windows\System\ugCHhDL.exe
  C:\Windows\System\ugCHhDL.exe
  2⤵
  PID:8844
- C:\Windows\System\ZkQttNJ.exe
  C:\Windows\System\ZkQttNJ.exe
  2⤵
  PID:8912
- C:\Windows\System\XdkGHNj.exe
  C:\Windows\System\XdkGHNj.exe
  2⤵
  PID:8988
- C:\Windows\System\QpzmzSF.exe
  C:\Windows\System\QpzmzSF.exe
  2⤵
  PID:9024
- C:\Windows\System\wuOptdg.exe
  C:\Windows\System\wuOptdg.exe
  2⤵
  PID:9156
- C:\Windows\System\vzwDNPj.exe
  C:\Windows\System\vzwDNPj.exe
  2⤵
  PID:9104
- C:\Windows\System\AWoTRTu.exe
  C:\Windows\System\AWoTRTu.exe
  2⤵
  PID:7788
- C:\Windows\System\VLhgvyt.exe
  C:\Windows\System\VLhgvyt.exe
  2⤵
  PID:8484
- C:\Windows\System\IKzMycz.exe
  C:\Windows\System\IKzMycz.exe
  2⤵
  PID:8504
- C:\Windows\System\XLMHDyR.exe
  C:\Windows\System\XLMHDyR.exe
  2⤵
  PID:8648
- C:\Windows\System\NHRwxtr.exe
  C:\Windows\System\NHRwxtr.exe
  2⤵
  PID:8744
- C:\Windows\System\IMFfzPB.exe
  C:\Windows\System\IMFfzPB.exe
  2⤵
  PID:8884
- C:\Windows\System\CtJtTOR.exe
  C:\Windows\System\CtJtTOR.exe
  2⤵
  PID:9100
- C:\Windows\System\WsmKvUl.exe
  C:\Windows\System\WsmKvUl.exe
  2⤵
  PID:9132
- C:\Windows\System\QMnTkcr.exe
  C:\Windows\System\QMnTkcr.exe
  2⤵
  PID:8108
- C:\Windows\System\VqduwKD.exe
  C:\Windows\System\VqduwKD.exe
  2⤵
  PID:8572
- C:\Windows\System\XilOqIe.exe
  C:\Windows\System\XilOqIe.exe
  2⤵
  PID:8972
- C:\Windows\System\HGxOkSp.exe
  C:\Windows\System\HGxOkSp.exe
  2⤵
  PID:8220
- C:\Windows\System\RBotJBN.exe
  C:\Windows\System\RBotJBN.exe
  2⤵
  PID:8804
- C:\Windows\System\qEfQHQK.exe
  C:\Windows\System\qEfQHQK.exe
  2⤵
  PID:9232
- C:\Windows\System\XfqMmsh.exe
  C:\Windows\System\XfqMmsh.exe
  2⤵
  PID:9260
- C:\Windows\System\BBnrdlE.exe
  C:\Windows\System\BBnrdlE.exe
  2⤵
  PID:9284
- C:\Windows\System\hAyobaX.exe
  C:\Windows\System\hAyobaX.exe
  2⤵
  PID:9308
- C:\Windows\System\GIzcCWe.exe
  C:\Windows\System\GIzcCWe.exe
  2⤵
  PID:9340
- C:\Windows\System\oFzbBZb.exe
  C:\Windows\System\oFzbBZb.exe
  2⤵
  PID:9364
- C:\Windows\System\QTALgWz.exe
  C:\Windows\System\QTALgWz.exe
  2⤵
  PID:9392
- C:\Windows\System\urXHgAK.exe
  C:\Windows\System\urXHgAK.exe
  2⤵
  PID:9424
- C:\Windows\System\RBmMrgE.exe
  C:\Windows\System\RBmMrgE.exe
  2⤵
  PID:9452
- C:\Windows\System\cAMUrqK.exe
  C:\Windows\System\cAMUrqK.exe
  2⤵
  PID:9488
- C:\Windows\System\YUROzdP.exe
  C:\Windows\System\YUROzdP.exe
  2⤵
  PID:9516
- C:\Windows\System\MvBCgOf.exe
  C:\Windows\System\MvBCgOf.exe
  2⤵
  PID:9540
- C:\Windows\System\NoLngGO.exe
  C:\Windows\System\NoLngGO.exe
  2⤵
  PID:9580
- C:\Windows\System\xofuXxz.exe
  C:\Windows\System\xofuXxz.exe
  2⤵
  PID:9604
- C:\Windows\System\vkEEZZP.exe
  C:\Windows\System\vkEEZZP.exe
  2⤵
  PID:9636
- C:\Windows\System\BstAkQO.exe
  C:\Windows\System\BstAkQO.exe
  2⤵
  PID:9668
- C:\Windows\System\IbewEyO.exe
  C:\Windows\System\IbewEyO.exe
  2⤵
  PID:9692
- C:\Windows\System\JKkVMGb.exe
  C:\Windows\System\JKkVMGb.exe
  2⤵
  PID:9712
- C:\Windows\System\AFtKltV.exe
  C:\Windows\System\AFtKltV.exe
  2⤵
  PID:9740
- C:\Windows\System\OCcSMOv.exe
  C:\Windows\System\OCcSMOv.exe
  2⤵
  PID:9768
- C:\Windows\System\DfGwbDT.exe
  C:\Windows\System\DfGwbDT.exe
  2⤵
  PID:9804
- C:\Windows\System\GduZGng.exe
  C:\Windows\System\GduZGng.exe
  2⤵
  PID:9840
- C:\Windows\System\ouIeaUV.exe
  C:\Windows\System\ouIeaUV.exe
  2⤵
  PID:9864
- C:\Windows\System\bpAPnEW.exe
  C:\Windows\System\bpAPnEW.exe
  2⤵
  PID:9888
- C:\Windows\System\ZHNLiOf.exe
  C:\Windows\System\ZHNLiOf.exe
  2⤵
  PID:9908
- C:\Windows\System\srOavAp.exe
  C:\Windows\System\srOavAp.exe
  2⤵
  PID:9940
- C:\Windows\System\DHWPRVF.exe
  C:\Windows\System\DHWPRVF.exe
  2⤵
  PID:9976
- C:\Windows\System\XFESYeG.exe
  C:\Windows\System\XFESYeG.exe
  2⤵
  PID:9992
- C:\Windows\System\awbCklS.exe
  C:\Windows\System\awbCklS.exe
  2⤵
  PID:10024
- C:\Windows\System\bPqmynQ.exe
  C:\Windows\System\bPqmynQ.exe
  2⤵
  PID:10044
- C:\Windows\System\ojcksTN.exe
  C:\Windows\System\ojcksTN.exe
  2⤵
  PID:10072
- C:\Windows\System\PVvAqok.exe
  C:\Windows\System\PVvAqok.exe
  2⤵
  PID:10100
- C:\Windows\System\OMBXEtY.exe
  C:\Windows\System\OMBXEtY.exe
  2⤵
  PID:10132
- C:\Windows\System\pWMgpCa.exe
  C:\Windows\System\pWMgpCa.exe
  2⤵
  PID:10160
- C:\Windows\System\HPXhbSb.exe
  C:\Windows\System\HPXhbSb.exe
  2⤵
  PID:10188
- C:\Windows\System\KRZuKix.exe
  C:\Windows\System\KRZuKix.exe
  2⤵
  PID:10212
- C:\Windows\System\bWuadFf.exe
  C:\Windows\System\bWuadFf.exe
  2⤵
  PID:8316
- C:\Windows\System\yFXwxcQ.exe
  C:\Windows\System\yFXwxcQ.exe
  2⤵
  PID:9192
- C:\Windows\System\xZHgLwp.exe
  C:\Windows\System\xZHgLwp.exe
  2⤵
  PID:9324
- C:\Windows\System\DsYFnFK.exe
  C:\Windows\System\DsYFnFK.exe
  2⤵
  PID:9384
- C:\Windows\System\qjsyHpC.exe
  C:\Windows\System\qjsyHpC.exe
  2⤵
  PID:9468
- C:\Windows\System\iZdOLHr.exe
  C:\Windows\System\iZdOLHr.exe
  2⤵
  PID:9532
- C:\Windows\System\wcyPOGz.exe
  C:\Windows\System\wcyPOGz.exe
  2⤵
  PID:9592
- C:\Windows\System\xqcguxW.exe
  C:\Windows\System\xqcguxW.exe
  2⤵
  PID:9652
- C:\Windows\System\GIUWHiG.exe
  C:\Windows\System\GIUWHiG.exe
  2⤵
  PID:9700
- C:\Windows\System\nxTYhLi.exe
  C:\Windows\System\nxTYhLi.exe
  2⤵
  PID:9680
- C:\Windows\System\QELVFod.exe
  C:\Windows\System\QELVFod.exe
  2⤵
  PID:9860
- C:\Windows\System\zOfsCDh.exe
  C:\Windows\System\zOfsCDh.exe
  2⤵
  PID:9880
- C:\Windows\System\BQlvufQ.exe
  C:\Windows\System\BQlvufQ.exe
  2⤵
  PID:9932
- C:\Windows\System\LOxTKBC.exe
  C:\Windows\System\LOxTKBC.exe
  2⤵
  PID:9984
- C:\Windows\System\YRxwqrS.exe
  C:\Windows\System\YRxwqrS.exe
  2⤵
  PID:9988
- C:\Windows\System\kSoYIQT.exe
  C:\Windows\System\kSoYIQT.exe
  2⤵
  PID:10144
- C:\Windows\System\kGKVnSj.exe
  C:\Windows\System\kGKVnSj.exe
  2⤵
  PID:10236
- C:\Windows\System\AhGZptb.exe
  C:\Windows\System\AhGZptb.exe
  2⤵
  PID:9316
- C:\Windows\System\xmcdbHF.exe
  C:\Windows\System\xmcdbHF.exe
  2⤵
  PID:9388
- C:\Windows\System\iqcUgYj.exe
  C:\Windows\System\iqcUgYj.exe
  2⤵
  PID:9292
- C:\Windows\System\mIwGmtD.exe
  C:\Windows\System\mIwGmtD.exe
  2⤵
  PID:9556
- C:\Windows\System\NbWUNLH.exe
  C:\Windows\System\NbWUNLH.exe
  2⤵
  PID:9524
- C:\Windows\System\LVydlfW.exe
  C:\Windows\System\LVydlfW.exe
  2⤵
  PID:9900
- C:\Windows\System\eAmFaSq.exe
  C:\Windows\System\eAmFaSq.exe
  2⤵
  PID:9796
- C:\Windows\System\ylGTmym.exe
  C:\Windows\System\ylGTmym.exe
  2⤵
  PID:10064
- C:\Windows\System\CYPDNnT.exe
  C:\Windows\System\CYPDNnT.exe
  2⤵
  PID:10272
- C:\Windows\System\mjsempa.exe
  C:\Windows\System\mjsempa.exe
  2⤵
  PID:10308
- C:\Windows\System\sGshaGh.exe
  C:\Windows\System\sGshaGh.exe
  2⤵
  PID:10336
- C:\Windows\System\yZkuJiw.exe
  C:\Windows\System\yZkuJiw.exe
  2⤵
  PID:10360
- C:\Windows\System\UijwWqI.exe
  C:\Windows\System\UijwWqI.exe
  2⤵
  PID:10388
- C:\Windows\System\aBsujeP.exe
  C:\Windows\System\aBsujeP.exe
  2⤵
  PID:10412
- C:\Windows\System\RBFxIPw.exe
  C:\Windows\System\RBFxIPw.exe
  2⤵
  PID:10432
- C:\Windows\System\zlJlNbJ.exe
  C:\Windows\System\zlJlNbJ.exe
  2⤵
  PID:10448
- C:\Windows\System\FILdGMo.exe
  C:\Windows\System\FILdGMo.exe
  2⤵
  PID:10492
- C:\Windows\System\YzNKioB.exe
  C:\Windows\System\YzNKioB.exe
  2⤵
  PID:10516
- C:\Windows\System\NvTnNKA.exe
  C:\Windows\System\NvTnNKA.exe
  2⤵
  PID:10544
- C:\Windows\System\xmDLdFM.exe
  C:\Windows\System\xmDLdFM.exe
  2⤵
  PID:10572
- C:\Windows\System\BorEsQZ.exe
  C:\Windows\System\BorEsQZ.exe
  2⤵
  PID:10592
- C:\Windows\System\eNWvzuJ.exe
  C:\Windows\System\eNWvzuJ.exe
  2⤵
  PID:10620
- C:\Windows\System\UKyrkhs.exe
  C:\Windows\System\UKyrkhs.exe
  2⤵
  PID:10640
- C:\Windows\System\KtkDfZO.exe
  C:\Windows\System\KtkDfZO.exe
  2⤵
  PID:10668
- C:\Windows\System\cdFzHBs.exe
  C:\Windows\System\cdFzHBs.exe
  2⤵
  PID:10700
- C:\Windows\System\BoVqWmz.exe
  C:\Windows\System\BoVqWmz.exe
  2⤵
  PID:10728
- C:\Windows\System\yiUVNVR.exe
  C:\Windows\System\yiUVNVR.exe
  2⤵
  PID:10752
- C:\Windows\System\CXoTwdB.exe
  C:\Windows\System\CXoTwdB.exe
  2⤵
  PID:10772
- C:\Windows\System\ceqpasU.exe
  C:\Windows\System\ceqpasU.exe
  2⤵
  PID:10800
- C:\Windows\System\necLndK.exe
  C:\Windows\System\necLndK.exe
  2⤵
  PID:10820
- C:\Windows\System\OeWIFVw.exe
  C:\Windows\System\OeWIFVw.exe
  2⤵
  PID:10848
- C:\Windows\System\QYMkSvu.exe
  C:\Windows\System\QYMkSvu.exe
  2⤵
  PID:10868
- C:\Windows\System\HCBsgOY.exe
  C:\Windows\System\HCBsgOY.exe
  2⤵
  PID:10896
- C:\Windows\System\wXAfpFC.exe
  C:\Windows\System\wXAfpFC.exe
  2⤵
  PID:10920
- C:\Windows\System\aLsIKUp.exe
  C:\Windows\System\aLsIKUp.exe
  2⤵
  PID:10940
- C:\Windows\System\ZLFCGsD.exe
  C:\Windows\System\ZLFCGsD.exe
  2⤵
  PID:10972
- C:\Windows\System\dnolUpb.exe
  C:\Windows\System\dnolUpb.exe
  2⤵
  PID:11000
- C:\Windows\System\YHeQBfC.exe
  C:\Windows\System\YHeQBfC.exe
  2⤵
  PID:11036
- C:\Windows\System\HFsidTL.exe
  C:\Windows\System\HFsidTL.exe
  2⤵
  PID:11064
- C:\Windows\System\rohcKPg.exe
  C:\Windows\System\rohcKPg.exe
  2⤵
  PID:11100
- C:\Windows\System\NJJTlGH.exe
  C:\Windows\System\NJJTlGH.exe
  2⤵
  PID:11120
- C:\Windows\System\jpVdrsF.exe
  C:\Windows\System\jpVdrsF.exe
  2⤵
  PID:11156
- C:\Windows\System\aTKyxzM.exe
  C:\Windows\System\aTKyxzM.exe
  2⤵
  PID:11184
- C:\Windows\System\jGpfFBu.exe
  C:\Windows\System\jGpfFBu.exe
  2⤵
  PID:11204
- C:\Windows\System\GJrpmaR.exe
  C:\Windows\System\GJrpmaR.exe
  2⤵
  PID:11236
- C:\Windows\System\HPJoZgA.exe
  C:\Windows\System\HPJoZgA.exe
  2⤵
  PID:11260
- C:\Windows\System\vKvEQNG.exe
  C:\Windows\System\vKvEQNG.exe
  2⤵
  PID:10296
- C:\Windows\System\diBXKpU.exe
  C:\Windows\System\diBXKpU.exe
  2⤵
  PID:10344
- C:\Windows\System\Zebotlh.exe
  C:\Windows\System\Zebotlh.exe
  2⤵
  PID:10368
- C:\Windows\System\HNIugeP.exe
  C:\Windows\System\HNIugeP.exe
  2⤵
  PID:10424
- C:\Windows\System\dDBpkse.exe
  C:\Windows\System\dDBpkse.exe
  2⤵
  PID:10540
- C:\Windows\System\BkqFVCk.exe
  C:\Windows\System\BkqFVCk.exe
  2⤵
  PID:10524
- C:\Windows\System\BbESqZQ.exe
  C:\Windows\System\BbESqZQ.exe
  2⤵
  PID:10588
- C:\Windows\System\zUTaTGS.exe
  C:\Windows\System\zUTaTGS.exe
  2⤵
  PID:10724
- C:\Windows\System\KcFwlzU.exe
  C:\Windows\System\KcFwlzU.exe
  2⤵
  PID:10796
- C:\Windows\System\rOKGfXt.exe
  C:\Windows\System\rOKGfXt.exe
  2⤵
  PID:10832
- C:\Windows\System\BCGOlwR.exe
  C:\Windows\System\BCGOlwR.exe
  2⤵
  PID:10864
- C:\Windows\System\OpuEPXs.exe
  C:\Windows\System\OpuEPXs.exe
  2⤵
  PID:10916
- C:\Windows\System\Sexqlfd.exe
  C:\Windows\System\Sexqlfd.exe
  2⤵
  PID:11072
- C:\Windows\System\rZKokRD.exe
  C:\Windows\System\rZKokRD.exe
  2⤵
  PID:10968
- C:\Windows\System\NuNclBN.exe
  C:\Windows\System\NuNclBN.exe
  2⤵
  PID:11176
- C:\Windows\System\WqhyDcl.exe
  C:\Windows\System\WqhyDcl.exe
  2⤵
  PID:11216
- C:\Windows\System\UeUPpNn.exe
  C:\Windows\System\UeUPpNn.exe
  2⤵
  PID:11244
- C:\Windows\System\PmQkBBc.exe
  C:\Windows\System\PmQkBBc.exe
  2⤵
  PID:10536
- C:\Windows\System\xYZlteP.exe
  C:\Windows\System\xYZlteP.exe
  2⤵
  PID:10480
- C:\Windows\System\TJodsLf.exe
  C:\Windows\System\TJodsLf.exe
  2⤵
  PID:10836
- C:\Windows\System\wXIuqpj.exe
  C:\Windows\System\wXIuqpj.exe
  2⤵
  PID:10568
- C:\Windows\System\ljlSFTa.exe
  C:\Windows\System\ljlSFTa.exe
  2⤵
  PID:10952
- C:\Windows\System\UNYuFIT.exe
  C:\Windows\System\UNYuFIT.exe
  2⤵
  PID:11048
- C:\Windows\System\KHZcWTH.exe
  C:\Windows\System\KHZcWTH.exe
  2⤵
  PID:10580
- C:\Windows\System\keGYlAM.exe
  C:\Windows\System\keGYlAM.exe
  2⤵
  PID:11272
- C:\Windows\System\SCalhtQ.exe
  C:\Windows\System\SCalhtQ.exe
  2⤵
  PID:11296
- C:\Windows\System\iCYITHR.exe
  C:\Windows\System\iCYITHR.exe
  2⤵
  PID:11328
- C:\Windows\System\WRTglXO.exe
  C:\Windows\System\WRTglXO.exe
  2⤵
  PID:11356
- C:\Windows\System\ohCGnQR.exe
  C:\Windows\System\ohCGnQR.exe
  2⤵
  PID:11372
- C:\Windows\System\rYMzDYr.exe
  C:\Windows\System\rYMzDYr.exe
  2⤵
  PID:11400
- C:\Windows\System\emgusTn.exe
  C:\Windows\System\emgusTn.exe
  2⤵
  PID:11420
- C:\Windows\System\ZxPANAP.exe
  C:\Windows\System\ZxPANAP.exe
  2⤵
  PID:11452
- C:\Windows\System\SaaDGbZ.exe
  C:\Windows\System\SaaDGbZ.exe
  2⤵
  PID:11476
- C:\Windows\System\wkQUhTc.exe
  C:\Windows\System\wkQUhTc.exe
  2⤵
  PID:11504
- C:\Windows\System\NGasQge.exe
  C:\Windows\System\NGasQge.exe
  2⤵
  PID:11524
- C:\Windows\System\MNmjSRE.exe
  C:\Windows\System\MNmjSRE.exe
  2⤵
  PID:11552
- C:\Windows\System\ZFBrXqH.exe
  C:\Windows\System\ZFBrXqH.exe
  2⤵
  PID:11576
- C:\Windows\System\SJaxfTV.exe
  C:\Windows\System\SJaxfTV.exe
  2⤵
  PID:11600
- C:\Windows\System\iUCvCxX.exe
  C:\Windows\System\iUCvCxX.exe
  2⤵
  PID:11632
- C:\Windows\System\qWuYadw.exe
  C:\Windows\System\qWuYadw.exe
  2⤵
  PID:11664
- C:\Windows\System\wmzfaDL.exe
  C:\Windows\System\wmzfaDL.exe
  2⤵
  PID:11696
- C:\Windows\System\TbkpHEM.exe
  C:\Windows\System\TbkpHEM.exe
  2⤵
  PID:11724
- C:\Windows\System\ptKdbKV.exe
  C:\Windows\System\ptKdbKV.exe
  2⤵
  PID:11752
- C:\Windows\System\MGWOZaF.exe
  C:\Windows\System\MGWOZaF.exe
  2⤵
  PID:11780
- C:\Windows\System\uItlxrw.exe
  C:\Windows\System\uItlxrw.exe
  2⤵
  PID:11804
- C:\Windows\System\hfcnUWt.exe
  C:\Windows\System\hfcnUWt.exe
  2⤵
  PID:11832
- C:\Windows\System\CbTvlcf.exe
  C:\Windows\System\CbTvlcf.exe
  2⤵
  PID:11860
- C:\Windows\System\NbdBAvU.exe
  C:\Windows\System\NbdBAvU.exe
  2⤵
  PID:11888
- C:\Windows\System\unJgSfH.exe
  C:\Windows\System\unJgSfH.exe
  2⤵
  PID:11920
- C:\Windows\System\FPGKuZo.exe
  C:\Windows\System\FPGKuZo.exe
  2⤵
  PID:11944
- C:\Windows\System\iOGydWR.exe
  C:\Windows\System\iOGydWR.exe
  2⤵
  PID:11968
- C:\Windows\System\fRUrRAt.exe
  C:\Windows\System\fRUrRAt.exe
  2⤵
  PID:11996
- C:\Windows\System\DwSdgcf.exe
  C:\Windows\System\DwSdgcf.exe
  2⤵
  PID:12024
- C:\Windows\System\PxYeBDg.exe
  C:\Windows\System\PxYeBDg.exe
  2⤵
  PID:12040
- C:\Windows\System\GMaCyBh.exe
  C:\Windows\System\GMaCyBh.exe
  2⤵
  PID:12088
- C:\Windows\System\LNUlMek.exe
  C:\Windows\System\LNUlMek.exe
  2⤵
  PID:12120
- C:\Windows\System\qlcFrwW.exe
  C:\Windows\System\qlcFrwW.exe
  2⤵
  PID:12152
- C:\Windows\System\CeQTGbF.exe
  C:\Windows\System\CeQTGbF.exe
  2⤵
  PID:12180
- C:\Windows\System\VCfIzLX.exe
  C:\Windows\System\VCfIzLX.exe
  2⤵
  PID:12204
- C:\Windows\System\yQXAHcA.exe
  C:\Windows\System\yQXAHcA.exe
  2⤵
  PID:12236
- C:\Windows\System\XVUUrYN.exe
  C:\Windows\System\XVUUrYN.exe
  2⤵
  PID:12256
- C:\Windows\System\ufUDsGR.exe
  C:\Windows\System\ufUDsGR.exe
  2⤵
  PID:12272
- C:\Windows\System\zZbYxtm.exe
  C:\Windows\System\zZbYxtm.exe
  2⤵
  PID:10316
- C:\Windows\System\NuefHne.exe
  C:\Windows\System\NuefHne.exe
  2⤵
  PID:10876
- C:\Windows\System\zVGrfXF.exe
  C:\Windows\System\zVGrfXF.exe
  2⤵
  PID:11320
- C:\Windows\System\UrEldVg.exe
  C:\Windows\System\UrEldVg.exe
  2⤵
  PID:11028
- C:\Windows\System\BJBpoTf.exe
  C:\Windows\System\BJBpoTf.exe
  2⤵
  PID:11440
- C:\Windows\System\whqeHyI.exe
  C:\Windows\System\whqeHyI.exe
  2⤵
  PID:11496
- C:\Windows\System\gFhFVwn.exe
  C:\Windows\System\gFhFVwn.exe
  2⤵
  PID:11564
- C:\Windows\System\dXyIvVL.exe
  C:\Windows\System\dXyIvVL.exe
  2⤵
  PID:11532
- C:\Windows\System\kDzPrpr.exe
  C:\Windows\System\kDzPrpr.exe
  2⤵
  PID:11672
- C:\Windows\System\XKqKIrE.exe
  C:\Windows\System\XKqKIrE.exe
  2⤵
  PID:11688
- C:\Windows\System\gHfDyRF.exe
  C:\Windows\System\gHfDyRF.exe
  2⤵
  PID:11736
- C:\Windows\System\HAOyAMb.exe
  C:\Windows\System\HAOyAMb.exe
  2⤵
  PID:11916
- C:\Windows\System\ZGcNgah.exe
  C:\Windows\System\ZGcNgah.exe
  2⤵
  PID:11976
- C:\Windows\System\VXWtHQm.exe
  C:\Windows\System\VXWtHQm.exe
  2⤵
  PID:11980
- C:\Windows\System\WZdJDnI.exe
  C:\Windows\System\WZdJDnI.exe
  2⤵
  PID:12012
- C:\Windows\System\XeCWhIo.exe
  C:\Windows\System\XeCWhIo.exe
  2⤵
  PID:12104
- C:\Windows\System\HQpTins.exe
  C:\Windows\System\HQpTins.exe
  2⤵
  PID:12068
- C:\Windows\System\OKHgYOi.exe
  C:\Windows\System\OKHgYOi.exe
  2⤵
  PID:12200
- C:\Windows\System\bHlLMoh.exe
  C:\Windows\System\bHlLMoh.exe
  2⤵
  PID:10384
- C:\Windows\System\xsmtIon.exe
  C:\Windows\System\xsmtIon.exe
  2⤵
  PID:11336
- C:\Windows\System\FlGKgBo.exe
  C:\Windows\System\FlGKgBo.exe
  2⤵
  PID:11364
- C:\Windows\System\oyNcLqo.exe
  C:\Windows\System\oyNcLqo.exe
  2⤵
  PID:11608
- C:\Windows\System\jQQjoOE.exe
  C:\Windows\System\jQQjoOE.exe
  2⤵
  PID:11436
- C:\Windows\System\mZuGYzV.exe
  C:\Windows\System\mZuGYzV.exe
  2⤵
  PID:11956
- C:\Windows\System\KNPCSLy.exe
  C:\Windows\System\KNPCSLy.exe
  2⤵
  PID:12016
- C:\Windows\System\aLLnjpx.exe
  C:\Windows\System\aLLnjpx.exe
  2⤵
  PID:12008
- C:\Windows\System\iJvBjkE.exe
  C:\Windows\System\iJvBjkE.exe
  2⤵
  PID:11652
- C:\Windows\System\dIkSqjY.exe
  C:\Windows\System\dIkSqjY.exe
  2⤵
  PID:12324
- C:\Windows\System\tCzVhIf.exe
  C:\Windows\System\tCzVhIf.exe
  2⤵
  PID:12360
- C:\Windows\System\BtnNDdg.exe
  C:\Windows\System\BtnNDdg.exe
  2⤵
  PID:12380
- C:\Windows\System\FEPiXLm.exe
  C:\Windows\System\FEPiXLm.exe
  2⤵
  PID:12400
- C:\Windows\System\OjallAy.exe
  C:\Windows\System\OjallAy.exe
  2⤵
  PID:12428
- C:\Windows\System\GnjPIjQ.exe
  C:\Windows\System\GnjPIjQ.exe
  2⤵
  PID:12452
- C:\Windows\System\qgFnjon.exe
  C:\Windows\System\qgFnjon.exe
  2⤵
  PID:12480
- C:\Windows\System\iJnASDI.exe
  C:\Windows\System\iJnASDI.exe
  2⤵
  PID:12500
- C:\Windows\System\szAmLrh.exe
  C:\Windows\System\szAmLrh.exe
  2⤵
  PID:12520
- C:\Windows\System\RrofYdw.exe
  C:\Windows\System\RrofYdw.exe
  2⤵
  PID:12556
- C:\Windows\System\LUoeDVD.exe
  C:\Windows\System\LUoeDVD.exe
  2⤵
  PID:12580
- C:\Windows\System\PuCTgfm.exe
  C:\Windows\System\PuCTgfm.exe
  2⤵
  PID:12612
- C:\Windows\System\CkYsNCu.exe
  C:\Windows\System\CkYsNCu.exe
  2⤵
  PID:12644
- C:\Windows\System\fuRjGeH.exe
  C:\Windows\System\fuRjGeH.exe
  2⤵
  PID:12664
- C:\Windows\System\bmgKJZb.exe
  C:\Windows\System\bmgKJZb.exe
  2⤵
  PID:12692
- C:\Windows\System\rLpFVgh.exe
  C:\Windows\System\rLpFVgh.exe
  2⤵
  PID:12736
- C:\Windows\System\HyWRKCB.exe
  C:\Windows\System\HyWRKCB.exe
  2⤵
  PID:12784
- C:\Windows\System\ohxcWFs.exe
  C:\Windows\System\ohxcWFs.exe
  2⤵
  PID:12808
- C:\Windows\System\ptNUtRW.exe
  C:\Windows\System\ptNUtRW.exe
  2⤵
  PID:12848
- C:\Windows\System\nAVhJek.exe
  C:\Windows\System\nAVhJek.exe
  2⤵
  PID:12876
- C:\Windows\System\uBfCsQS.exe
  C:\Windows\System\uBfCsQS.exe
  2⤵
  PID:12900
- C:\Windows\System\suuDyUE.exe
  C:\Windows\System\suuDyUE.exe
  2⤵
  PID:12928
- C:\Windows\System\DTQzISW.exe
  C:\Windows\System\DTQzISW.exe
  2⤵
  PID:12944
- C:\Windows\System\tBkiqUQ.exe
  C:\Windows\System\tBkiqUQ.exe
  2⤵
  PID:12972
- C:\Windows\System\NvRyZHI.exe
  C:\Windows\System\NvRyZHI.exe
  2⤵
  PID:12992
- C:\Windows\System\ihuxlTi.exe
  C:\Windows\System\ihuxlTi.exe
  2⤵
  PID:13012
- C:\Windows\System\WkRobXj.exe
  C:\Windows\System\WkRobXj.exe
  2⤵
  PID:13032
- C:\Windows\System\pUPOauv.exe
  C:\Windows\System\pUPOauv.exe
  2⤵
  PID:13056
- C:\Windows\System\rruSIwN.exe
  C:\Windows\System\rruSIwN.exe
  2⤵
  PID:13080
- C:\Windows\System\yuVxmIZ.exe
  C:\Windows\System\yuVxmIZ.exe
  2⤵
  PID:13112
- C:\Windows\System\AvlHniS.exe
  C:\Windows\System\AvlHniS.exe
  2⤵
  PID:13128
- C:\Windows\System\meRdHwr.exe
  C:\Windows\System\meRdHwr.exe
  2⤵
  PID:13156
- C:\Windows\System\CQkBkfp.exe
  C:\Windows\System\CQkBkfp.exe
  2⤵
  PID:13188
- C:\Windows\System\aeUdpIH.exe
  C:\Windows\System\aeUdpIH.exe
  2⤵
  PID:13212
- C:\Windows\System\xIReNze.exe
  C:\Windows\System\xIReNze.exe
  2⤵
  PID:13248
- C:\Windows\System\KpADFlG.exe
  C:\Windows\System\KpADFlG.exe
  2⤵
  PID:13268
- C:\Windows\System\ysKGoBt.exe
  C:\Windows\System\ysKGoBt.exe
  2⤵
  PID:13300
- C:\Windows\System\YXICOaD.exe
  C:\Windows\System\YXICOaD.exe
  2⤵
  PID:12128
- C:\Windows\System\QBJWlrd.exe
  C:\Windows\System\QBJWlrd.exe
  2⤵
  PID:9920
- C:\Windows\System\XwFdoso.exe
  C:\Windows\System\XwFdoso.exe
  2⤵
  PID:11952
- C:\Windows\System\GNsGaUa.exe
  C:\Windows\System\GNsGaUa.exe
  2⤵
  PID:12388
- C:\Windows\System\yMKyuzu.exe
  C:\Windows\System\yMKyuzu.exe
  2⤵
  PID:12340
- C:\Windows\System\RigwDOs.exe
  C:\Windows\System\RigwDOs.exe
  2⤵
  PID:11620
- C:\Windows\System\luvtCio.exe
  C:\Windows\System\luvtCio.exe
  2⤵
  PID:12412
- C:\Windows\System\bBebZJz.exe
  C:\Windows\System\bBebZJz.exe
  2⤵
  PID:12544
- C:\Windows\System\aPrHOxh.exe
  C:\Windows\System\aPrHOxh.exe
  2⤵
  PID:12468
- C:\Windows\System\OIAVtSM.exe
  C:\Windows\System\OIAVtSM.exe
  2⤵
  PID:12576
- C:\Windows\System\NCJMIaA.exe
  C:\Windows\System\NCJMIaA.exe
  2⤵
  PID:12640
- C:\Windows\System\QoFPbLj.exe
  C:\Windows\System\QoFPbLj.exe
  2⤵
  PID:12872
- C:\Windows\System\KpcDHtR.exe
  C:\Windows\System\KpcDHtR.exe
  2⤵
  PID:12792
- C:\Windows\System\uDmgABu.exe
  C:\Windows\System\uDmgABu.exe
  2⤵
  PID:12832
- C:\Windows\System\oLQrFBd.exe
  C:\Windows\System\oLQrFBd.exe
  2⤵
  PID:12964
- C:\Windows\System\YKUoLZZ.exe
  C:\Windows\System\YKUoLZZ.exe
  2⤵
  PID:12968
- C:\Windows\System\wbKdEYM.exe
  C:\Windows\System\wbKdEYM.exe
  2⤵
  PID:13040
- C:\Windows\System\wtUSNNK.exe
  C:\Windows\System\wtUSNNK.exe
  2⤵
  PID:13124
- C:\Windows\System\maaLsbW.exe
  C:\Windows\System\maaLsbW.exe
  2⤵
  PID:13288
- C:\Windows\System\nGachBJ.exe
  C:\Windows\System\nGachBJ.exe
  2⤵
  PID:13100
- C:\Windows\System\qOBHOly.exe
  C:\Windows\System\qOBHOly.exe
  2⤵
  PID:13168
- C:\Windows\System\JseYwwL.exe
  C:\Windows\System\JseYwwL.exe
  2⤵
  PID:10632
- C:\Windows\System\dYKciRi.exe
  C:\Windows\System\dYKciRi.exe
  2⤵
  PID:12508
- C:\Windows\System\gagWrcl.exe
  C:\Windows\System\gagWrcl.exe
  2⤵
  PID:12772
- C:\Windows\System\tKSZBen.exe
  C:\Windows\System\tKSZBen.exe
  2⤵
  PID:11692
- C:\Windows\System\vKvjwss.exe
  C:\Windows\System\vKvjwss.exe
  2⤵
  PID:13152
- C:\Windows\System\XhAZRQr.exe
  C:\Windows\System\XhAZRQr.exe
  2⤵
  PID:11708
- C:\Windows\System\oKRcUob.exe
  C:\Windows\System\oKRcUob.exe
  2⤵
  PID:13196
- C:\Windows\System\YGlbPnl.exe
  C:\Windows\System\YGlbPnl.exe
  2⤵
  PID:12604
- C:\Windows\System\fuAvBdd.exe
  C:\Windows\System\fuAvBdd.exe
  2⤵
  PID:13008
- C:\Windows\System\gGDzDPD.exe
  C:\Windows\System\gGDzDPD.exe
  2⤵
  PID:13340
- C:\Windows\System\DxrPGlq.exe
  C:\Windows\System\DxrPGlq.exe
  2⤵
  PID:13368
- C:\Windows\System\nNGuOKL.exe
  C:\Windows\System\nNGuOKL.exe
  2⤵
  PID:13396
- C:\Windows\System\EqFaUco.exe
  C:\Windows\System\EqFaUco.exe
  2⤵
  PID:13432
- C:\Windows\System\eJcqYVF.exe
  C:\Windows\System\eJcqYVF.exe
  2⤵
  PID:13452
- C:\Windows\System\AAEyqRM.exe
  C:\Windows\System\AAEyqRM.exe
  2⤵
  PID:13472
- C:\Windows\System\soAaJPL.exe
  C:\Windows\System\soAaJPL.exe
  2⤵
  PID:13488
- C:\Windows\System\yYGnncs.exe
  C:\Windows\System\yYGnncs.exe
  2⤵
  PID:13520
- C:\Windows\System\XHujAdy.exe
  C:\Windows\System\XHujAdy.exe
  2⤵
  PID:13556
- C:\Windows\System\aGcXDOk.exe
  C:\Windows\System\aGcXDOk.exe
  2⤵
  PID:13588
- C:\Windows\System\LNBebtj.exe
  C:\Windows\System\LNBebtj.exe
  2⤵
  PID:13612
- C:\Windows\System\mapzUGj.exe
  C:\Windows\System\mapzUGj.exe
  2⤵
  PID:13644
- C:\Windows\System\ORzZyVy.exe
  C:\Windows\System\ORzZyVy.exe
  2⤵
  PID:13664
- C:\Windows\System\MuwfObB.exe
  C:\Windows\System\MuwfObB.exe
  2⤵
  PID:13688
- C:\Windows\System\srzSsNa.exe
  C:\Windows\System\srzSsNa.exe
  2⤵
  PID:13716
- C:\Windows\System\vJTsTMu.exe
  C:\Windows\System\vJTsTMu.exe
  2⤵
  PID:13748
- C:\Windows\System\hIXuNWl.exe
  C:\Windows\System\hIXuNWl.exe
  2⤵
  PID:13772
- C:\Windows\System\gvtmLjT.exe
  C:\Windows\System\gvtmLjT.exe
  2⤵
  PID:13804
- C:\Windows\System\RJNZtbM.exe
  C:\Windows\System\RJNZtbM.exe
  2⤵
  PID:13836
- C:\Windows\System\AtuJdxa.exe
  C:\Windows\System\AtuJdxa.exe
  2⤵
  PID:13864
- C:\Windows\System\cAkuLpg.exe
  C:\Windows\System\cAkuLpg.exe
  2⤵
  PID:13908
- C:\Windows\System\hMAccFA.exe
  C:\Windows\System\hMAccFA.exe
  2⤵
  PID:13924
- C:\Windows\System\onVcKeI.exe
  C:\Windows\System\onVcKeI.exe
  2⤵
  PID:13944
- C:\Windows\System\FkLEilk.exe
  C:\Windows\System\FkLEilk.exe
  2⤵
  PID:13960
- C:\Windows\System\FICobSr.exe
  C:\Windows\System\FICobSr.exe
  2⤵
  PID:13992
- C:\Windows\System\UMmquhH.exe
  C:\Windows\System\UMmquhH.exe
  2⤵
  PID:14008
- C:\Windows\System\ypIKYKo.exe
  C:\Windows\System\ypIKYKo.exe
  2⤵
  PID:14044
- C:\Windows\System\bMZARTJ.exe
  C:\Windows\System\bMZARTJ.exe
  2⤵
  PID:14080
- C:\Windows\System\xZvwpTY.exe
  C:\Windows\System\xZvwpTY.exe
  2⤵
  PID:14104
- C:\Windows\System\xHIEPqP.exe
  C:\Windows\System\xHIEPqP.exe
  2⤵
  PID:14128
- C:\Windows\System\VaTaPbs.exe
  C:\Windows\System\VaTaPbs.exe
  2⤵
  PID:14160
- C:\Windows\System\YxMygtK.exe
  C:\Windows\System\YxMygtK.exe
  2⤵
  PID:14184
- C:\Windows\System\uwnuTkD.exe
  C:\Windows\System\uwnuTkD.exe
  2⤵
  PID:14204
- C:\Windows\System\TTGGzwp.exe
  C:\Windows\System\TTGGzwp.exe
  2⤵
  PID:14228
- C:\Windows\System\kWhqQbd.exe
  C:\Windows\System\kWhqQbd.exe
  2⤵
  PID:14256
- C:\Windows\System\NWTVWIo.exe
  C:\Windows\System\NWTVWIo.exe
  2⤵
  PID:14288
- C:\Windows\System\PpxASkc.exe
  C:\Windows\System\PpxASkc.exe
  2⤵
  PID:14304
- C:\Windows\System\YkZpsSb.exe
  C:\Windows\System\YkZpsSb.exe
  2⤵
  PID:14320
- C:\Windows\System\tqFTEQt.exe
  C:\Windows\System\tqFTEQt.exe
  2⤵
  PID:12032
- C:\Windows\System\WReMhAG.exe
  C:\Windows\System\WReMhAG.exe
  2⤵
  PID:12316
- C:\Windows\System\nCYeCAP.exe
  C:\Windows\System\nCYeCAP.exe
  2⤵
  PID:12600
- C:\Windows\System\nnDumJf.exe
  C:\Windows\System\nnDumJf.exe
  2⤵
  PID:13360
- C:\Windows\System\UBYgiYF.exe
  C:\Windows\System\UBYgiYF.exe
  2⤵
  PID:13420
- C:\Windows\System\JYAElBs.exe
  C:\Windows\System\JYAElBs.exe
  2⤵
  PID:13532
- C:\Windows\System\SbocstK.exe
  C:\Windows\System\SbocstK.exe
  2⤵
  PID:13412
- C:\Windows\System\sUSWIpm.exe
  C:\Windows\System\sUSWIpm.exe
  2⤵
  PID:13328
- C:\Windows\System\tPPNpBe.exe
  C:\Windows\System\tPPNpBe.exe
  2⤵
  PID:13540
- C:\Windows\System\MvjeDJh.exe
  C:\Windows\System\MvjeDJh.exe
  2⤵
  PID:13656
- C:\Windows\System\bkmmOwa.exe
  C:\Windows\System\bkmmOwa.exe
  2⤵
  PID:13496
- C:\Windows\System\IKFqAbO.exe
  C:\Windows\System\IKFqAbO.exe
  2⤵
  PID:13892
- C:\Windows\System\ZLjUHVw.exe
  C:\Windows\System\ZLjUHVw.exe
  2⤵
  PID:13952
- C:\Windows\System\XgzIhKI.exe
  C:\Windows\System\XgzIhKI.exe
  2⤵
  PID:13708
- C:\Windows\System\JmsMStW.exe
  C:\Windows\System\JmsMStW.exe
  2⤵
  PID:14156
- C:\Windows\System\ZyRVfKN.exe
  C:\Windows\System\ZyRVfKN.exe
  2⤵
  PID:13988
- C:\Windows\System\ouTAoil.exe
  C:\Windows\System\ouTAoil.exe
  2⤵
  PID:13852
- C:\Windows\System\WCsPuCp.exe
  C:\Windows\System\WCsPuCp.exe
  2⤵
  PID:14276
- C:\Windows\System\jTnNbRg.exe
  C:\Windows\System\jTnNbRg.exe
  2⤵
  PID:14176
- C:\Windows\System\svaWNyZ.exe
  C:\Windows\System\svaWNyZ.exe
  2⤵
  PID:13568
- C:\Windows\System\fodtaUf.exe
  C:\Windows\System\fodtaUf.exe
  2⤵
  PID:13440
- C:\Windows\System\btWeUzj.exe
  C:\Windows\System\btWeUzj.exe
  2⤵
  PID:13512
- C:\Windows\System\LGGXlyB.exe
  C:\Windows\System\LGGXlyB.exe
  2⤵
  PID:14340
- C:\Windows\System\bqUZscl.exe
  C:\Windows\System\bqUZscl.exe
  2⤵
  PID:14388
- C:\Windows\System\apaAcWw.exe
  C:\Windows\System\apaAcWw.exe
  2⤵
  PID:14404
- C:\Windows\System\iHNsRFV.exe
  C:\Windows\System\iHNsRFV.exe
  2⤵
  PID:14428
- C:\Windows\System\ljFLOEu.exe
  C:\Windows\System\ljFLOEu.exe
  2⤵
  PID:14444
- C:\Windows\System\eqDkDfj.exe
  C:\Windows\System\eqDkDfj.exe
  2⤵
  PID:14472
- C:\Windows\System\TRdbFht.exe
  C:\Windows\System\TRdbFht.exe
  2⤵
  PID:14512
- C:\Windows\System\wLFKlqx.exe
  C:\Windows\System\wLFKlqx.exe
  2⤵
  PID:14536
- C:\Windows\System\ayLHLLN.exe
  C:\Windows\System\ayLHLLN.exe
  2⤵
  PID:14560
- C:\Windows\System\kutzHaC.exe
  C:\Windows\System\kutzHaC.exe
  2⤵
  PID:14592
- C:\Windows\System\UXuFdOb.exe
  C:\Windows\System\UXuFdOb.exe
  2⤵
  PID:14612
- C:\Windows\System\cdtqLeL.exe
  C:\Windows\System\cdtqLeL.exe
  2⤵
  PID:14628
- C:\Windows\System\ovQMwMS.exe
  C:\Windows\System\ovQMwMS.exe
  2⤵
  PID:14652
- C:\Windows\System\FTbWAHj.exe
  C:\Windows\System\FTbWAHj.exe
  2⤵
  PID:14672
- C:\Windows\System\HCKrmUc.exe
  C:\Windows\System\HCKrmUc.exe
  2⤵
  PID:14704
- C:\Windows\System\fUVYqUP.exe
  C:\Windows\System\fUVYqUP.exe
  2⤵
  PID:14724
- C:\Windows\System\NFGQtcx.exe
  C:\Windows\System\NFGQtcx.exe
  2⤵
  PID:14748
- C:\Windows\System\rHDvPXD.exe
  C:\Windows\System\rHDvPXD.exe
  2⤵
  PID:14776
- C:\Windows\System\uxHgOxa.exe
  C:\Windows\System\uxHgOxa.exe
  2⤵
  PID:14796
- C:\Windows\System\oKTOPdk.exe
  C:\Windows\System\oKTOPdk.exe
  2⤵
  PID:14820
- C:\Windows\System\WTovVzW.exe
  C:\Windows\System\WTovVzW.exe
  2⤵
  PID:14840
- C:\Windows\System\wDdmuDB.exe
  C:\Windows\System\wDdmuDB.exe
  2⤵
  PID:14860
- C:\Windows\System\GGtBWWn.exe
  C:\Windows\System\GGtBWWn.exe
  2⤵
  PID:14896
- C:\Windows\System\mLXHgSZ.exe
  C:\Windows\System\mLXHgSZ.exe
  2⤵
  PID:14920
- C:\Windows\System\SEMsJMT.exe
  C:\Windows\System\SEMsJMT.exe
  2⤵
  PID:14948
- C:\Windows\System\wKUUWlV.exe
  C:\Windows\System\wKUUWlV.exe
  2⤵
  PID:14976
- C:\Windows\System\vdzAalv.exe
  C:\Windows\System\vdzAalv.exe
  2⤵
  PID:14996
- C:\Windows\System\YCZGvyP.exe
  C:\Windows\System\YCZGvyP.exe
  2⤵
  PID:15016
- C:\Windows\System\XOUVAGD.exe
  C:\Windows\System\XOUVAGD.exe
  2⤵
  PID:15040
- C:\Windows\System\vMxOkAG.exe
  C:\Windows\System\vMxOkAG.exe
  2⤵
  PID:15060
- C:\Windows\System\CWoxzzx.exe
  C:\Windows\System\CWoxzzx.exe
  2⤵
  PID:15076
- C:\Windows\System\TQnRMtV.exe
  C:\Windows\System\TQnRMtV.exe
  2⤵
  PID:15104
- C:\Windows\System\LhFdglb.exe
  C:\Windows\System\LhFdglb.exe
  2⤵
  PID:15124
- C:\Windows\System\PstysvQ.exe
  C:\Windows\System\PstysvQ.exe
  2⤵
  PID:15148
- C:\Windows\System\dkpIMHy.exe
  C:\Windows\System\dkpIMHy.exe
  2⤵
  PID:15172
- C:\Windows\System\mAHvhuF.exe
  C:\Windows\System\mAHvhuF.exe
  2⤵
  PID:15192
- C:\Windows\System\nfZEojS.exe
  C:\Windows\System\nfZEojS.exe
  2⤵
  PID:15212
- C:\Windows\System\vOVGCJe.exe
  C:\Windows\System\vOVGCJe.exe
  2⤵
  PID:15240
- C:\Windows\System\cSnIUrL.exe
  C:\Windows\System\cSnIUrL.exe
  2⤵
  PID:15268
- C:\Windows\System\knvszaA.exe
  C:\Windows\System\knvszaA.exe
  2⤵
  PID:15296
- C:\Windows\System\KChSubs.exe
  C:\Windows\System\KChSubs.exe
  2⤵
  PID:15320
- C:\Windows\System\xNuyQDe.exe
  C:\Windows\System\xNuyQDe.exe
  2⤵
  PID:14312
- C:\Windows\System\mfvcKKl.exe
  C:\Windows\System\mfvcKKl.exe
  2⤵
  PID:12496
- C:\Windows\System\GpuepCL.exe
  C:\Windows\System\GpuepCL.exe
  2⤵
  PID:13468
- C:\Windows\System\EVYyOoR.exe
  C:\Windows\System\EVYyOoR.exe
  2⤵
  PID:13940
- C:\Windows\System\IYMVTbs.exe
  C:\Windows\System\IYMVTbs.exe
  2⤵
  PID:14056
- C:\Windows\System\qctYomo.exe
  C:\Windows\System\qctYomo.exe
  2⤵
  PID:13640
- C:\Windows\System\nkPsBal.exe
  C:\Windows\System\nkPsBal.exe
  2⤵
  PID:14460
- C:\Windows\System\bhLxOQz.exe
  C:\Windows\System\bhLxOQz.exe
  2⤵
  PID:14520
- C:\Windows\System\zSLbCrH.exe
  C:\Windows\System\zSLbCrH.exe
  2⤵
  PID:13920
- C:\Windows\System\SpRUHuE.exe
  C:\Windows\System\SpRUHuE.exe
  2⤵
  PID:14668
- C:\Windows\System\dtFBPMX.exe
  C:\Windows\System\dtFBPMX.exe
  2⤵
  PID:14484
- C:\Windows\System\EMKNYsX.exe
  C:\Windows\System\EMKNYsX.exe
  2⤵
  PID:14736
- C:\Windows\System\gwhUINE.exe
  C:\Windows\System\gwhUINE.exe
  2⤵
  PID:14804
- C:\Windows\System\aYhdkhq.exe
  C:\Windows\System\aYhdkhq.exe
  2⤵
  PID:14852
- C:\Windows\System\UZFbYbK.exe
  C:\Windows\System\UZFbYbK.exe
  2⤵
  PID:14876
- C:\Windows\System\XDvzVak.exe
  C:\Windows\System\XDvzVak.exe
  2⤵
  PID:14496
- C:\Windows\System\eqatcqU.exe
  C:\Windows\System\eqatcqU.exe
  2⤵
  PID:14576
- C:\Windows\System\INwCqwg.exe
  C:\Windows\System\INwCqwg.exe
  2⤵
  PID:14832
- C:\Windows\System\eSekuOm.exe
  C:\Windows\System\eSekuOm.exe
  2⤵
  PID:14664
- C:\Windows\System\kdubEWP.exe
  C:\Windows\System\kdubEWP.exe
  2⤵
  PID:14756
- C:\Windows\System\ySOuflK.exe
  C:\Windows\System\ySOuflK.exe
  2⤵
  PID:14984
- C:\Windows\System\QrCbUZq.exe
  C:\Windows\System\QrCbUZq.exe
  2⤵
  PID:15088
- C:\Windows\System\suAiQUL.exe
  C:\Windows\System\suAiQUL.exe
  2⤵
  PID:14884
- C:\Windows\System\ApBnbQF.exe
  C:\Windows\System\ApBnbQF.exe
  2⤵
  PID:14936
- C:\Windows\System\igLUuIB.exe
  C:\Windows\System\igLUuIB.exe
  2⤵
  PID:15228
- C:\Windows\System\lTxFdzc.exe
  C:\Windows\System\lTxFdzc.exe
  2⤵
  PID:14500
- C:\Windows\System\AGzjTgn.exe
  C:\Windows\System\AGzjTgn.exe
  2⤵
  PID:15024
- C:\Windows\System\AkuINSo.exe
  C:\Windows\System\AkuINSo.exe
  2⤵
  PID:15380
- C:\Windows\System\OmRqneI.exe
  C:\Windows\System\OmRqneI.exe
  2⤵
  PID:15404
- C:\Windows\System\XlVyRWe.exe
  C:\Windows\System\XlVyRWe.exe
  2⤵
  PID:15424
- C:\Windows\System\lXSBexs.exe
  C:\Windows\System\lXSBexs.exe
  2⤵
  PID:15448
- C:\Windows\System\VZVioMg.exe
  C:\Windows\System\VZVioMg.exe
  2⤵
  PID:15480
- C:\Windows\System\jhXrunj.exe
  C:\Windows\System\jhXrunj.exe
  2⤵
  PID:15512
- C:\Windows\System\RSMRZvr.exe
  C:\Windows\System\RSMRZvr.exe
  2⤵
  PID:15532
- C:\Windows\System\GXdIKEm.exe
  C:\Windows\System\GXdIKEm.exe
  2⤵
  PID:15576
- C:\Windows\System\fqZEQEn.exe
  C:\Windows\System\fqZEQEn.exe
  2⤵
  PID:16036
- C:\Windows\System\tElOImS.exe
  C:\Windows\System\tElOImS.exe
  2⤵
  PID:16072
- C:\Windows\System\qvEeHJp.exe
  C:\Windows\System\qvEeHJp.exe
  2⤵
  PID:16116
- C:\Windows\System\ddbegzk.exe
  C:\Windows\System\ddbegzk.exe
  2⤵
  PID:16148
- C:\Windows\System\XNaYBvz.exe
  C:\Windows\System\XNaYBvz.exe
  2⤵
  PID:16180
- C:\Windows\System\DRWGSew.exe
  C:\Windows\System\DRWGSew.exe
  2⤵
  PID:16200
- C:\Windows\System\uiajwXy.exe
  C:\Windows\System\uiajwXy.exe
  2⤵
  PID:16224
- C:\Windows\System\JobKsmB.exe
  C:\Windows\System\JobKsmB.exe
  2⤵
  PID:16240
- C:\Windows\System\bJjQYyY.exe
  C:\Windows\System\bJjQYyY.exe
  2⤵
  PID:16264
- C:\Windows\System\JXYOAdw.exe
  C:\Windows\System\JXYOAdw.exe
  2⤵
  PID:16284
- C:\Windows\System\jDVgsfx.exe
  C:\Windows\System\jDVgsfx.exe
  2⤵
  PID:16300
- C:\Windows\System\qAiSggK.exe
  C:\Windows\System\qAiSggK.exe
  2⤵
  PID:16332
- C:\Windows\System\QSdFubN.exe
  C:\Windows\System\QSdFubN.exe
  2⤵
  PID:16364
- C:\Windows\System\juZTxUC.exe
  C:\Windows\System\juZTxUC.exe
  2⤵
  PID:15344
- C:\Windows\System\QRPfRWi.exe
  C:\Windows\System\QRPfRWi.exe
  2⤵
  PID:13880
- C:\Windows\System\qkouaKh.exe
  C:\Windows\System\qkouaKh.exe
  2⤵
  PID:15164
- C:\Windows\System\uMNnJvI.exe
  C:\Windows\System\uMNnJvI.exe
  2⤵
  PID:14368
- C:\Windows\System\cHmryPd.exe
  C:\Windows\System\cHmryPd.exe
  2⤵
  PID:15248
- C:\Windows\System\hTlHAUS.exe
  C:\Windows\System\hTlHAUS.exe
  2⤵
  PID:13788
- C:\Windows\System\tXEPxNh.exe
  C:\Windows\System\tXEPxNh.exe
  2⤵
  PID:15068
- C:\Windows\System\RuQMIec.exe
  C:\Windows\System\RuQMIec.exe
  2⤵
  PID:12988
- C:\Windows\System\ySnuOQX.exe
  C:\Windows\System\ySnuOQX.exe
  2⤵
  PID:15260
- C:\Windows\System\nSOxdEk.exe
  C:\Windows\System\nSOxdEk.exe
  2⤵
  PID:13888
- C:\Windows\System\LDQXEGP.exe
  C:\Windows\System\LDQXEGP.exe
  2⤵
  PID:14416
- C:\Windows\System\ixNjFUB.exe
  C:\Windows\System\ixNjFUB.exe
  2⤵
  PID:14640
- C:\Windows\System\UzrSguk.exe
  C:\Windows\System\UzrSguk.exe
  2⤵
  PID:15744
- C:\Windows\System\vPtMZiL.exe
  C:\Windows\System\vPtMZiL.exe
  2⤵
  PID:15768
- C:\Windows\System\IPiYLtA.exe
  C:\Windows\System\IPiYLtA.exe
  2⤵
  PID:14028
- C:\Windows\System\tZHGwCy.exe
  C:\Windows\System\tZHGwCy.exe
  2⤵
  PID:15396
- C:\Windows\System\OGgdVvs.exe
  C:\Windows\System\OGgdVvs.exe
  2⤵
  PID:15460
- C:\Windows\System\BcIeANl.exe
  C:\Windows\System\BcIeANl.exe
  2⤵
  PID:15616
- C:\Windows\System\WdOraXb.exe
  C:\Windows\System\WdOraXb.exe
  2⤵
  PID:15680
- C:\Windows\System\VEaPKkN.exe
  C:\Windows\System\VEaPKkN.exe
  2⤵
  PID:15928
- C:\Windows\System\HTbcAaZ.exe
  C:\Windows\System\HTbcAaZ.exe
  2⤵
  PID:15852
- C:\Windows\System\foTOvIq.exe
  C:\Windows\System\foTOvIq.exe
  2⤵
  PID:16056
- C:\Windows\System\ivdXhry.exe
  C:\Windows\System\ivdXhry.exe
  2⤵
  PID:16096
- C:\Windows\System\bUfQpWW.exe
  C:\Windows\System\bUfQpWW.exe
  2⤵
  PID:16128
- C:\Windows\System\qpAHKoI.exe
  C:\Windows\System\qpAHKoI.exe
  2⤵
  PID:16236
- C:\Windows\System\EJViZAm.exe
  C:\Windows\System\EJViZAm.exe
  2⤵
  PID:16256
- C:\Windows\System\FoQmpiT.exe
  C:\Windows\System\FoQmpiT.exe
  2⤵
  PID:16296
- C:\Windows\System\fEVUEFt.exe
  C:\Windows\System\fEVUEFt.exe
  2⤵
  PID:16344
- C:\Windows\System\zRTyQtb.exe
  C:\Windows\System\zRTyQtb.exe
  2⤵
  PID:14464
- C:\Windows\System\nHEVbEH.exe
  C:\Windows\System\nHEVbEH.exe
  2⤵
  PID:14720
- C:\Windows\System\nqyxwOl.exe
  C:\Windows\System\nqyxwOl.exe
  2⤵
  PID:14872
- C:\Windows\System\VJuFHPN.exe
  C:\Windows\System\VJuFHPN.exe
  2⤵
  PID:15544
- C:\Windows\System\bInaGcm.exe
  C:\Windows\System\bInaGcm.exe
  2⤵
  PID:15524
- C:\Windows\System\WjHjjbr.exe
  C:\Windows\System\WjHjjbr.exe
  2⤵
  PID:15488
- C:\Windows\System\ybSXESh.exe
  C:\Windows\System\ybSXESh.exe
  2⤵
  PID:15724
- C:\Windows\System\OGUlMgX.exe
  C:\Windows\System\OGUlMgX.exe
  2⤵
  PID:16260
- C:\Windows\System\NxBvgag.exe
  C:\Windows\System\NxBvgag.exe
  2⤵
  PID:16272
- C:\Windows\System\JfPssVQ.exe
  C:\Windows\System\JfPssVQ.exe
  2⤵
  PID:15008
- C:\Windows\System\mfMBjCv.exe
  C:\Windows\System\mfMBjCv.exe
  2⤵
  PID:14332
- C:\Windows\System\IkMFfNA.exe
  C:\Windows\System\IkMFfNA.exe
  2⤵
  PID:16400
- C:\Windows\System\sqPBhuU.exe
  C:\Windows\System\sqPBhuU.exe
  2⤵
  PID:16428
- C:\Windows\System\uMbTSgN.exe
  C:\Windows\System\uMbTSgN.exe
  2⤵
  PID:16448
- C:\Windows\System\lyNQfVc.exe
  C:\Windows\System\lyNQfVc.exe
  2⤵
  PID:16484
- C:\Windows\System\AjldclI.exe
  C:\Windows\System\AjldclI.exe
  2⤵
  PID:16508
- C:\Windows\System\ctSdHWW.exe
  C:\Windows\System\ctSdHWW.exe
  2⤵
  PID:16532
- C:\Windows\System\aTufbHa.exe
  C:\Windows\System\aTufbHa.exe
  2⤵
  PID:16548
- C:\Windows\System\knfoSUa.exe
  C:\Windows\System\knfoSUa.exe
  2⤵
  PID:16568
- C:\Windows\System\zwJneUi.exe
  C:\Windows\System\zwJneUi.exe
  2⤵
  PID:16592
- C:\Windows\System\WBNBeXb.exe
  C:\Windows\System\WBNBeXb.exe
  2⤵
  PID:16612
- C:\Windows\System\UcQcsQs.exe
  C:\Windows\System\UcQcsQs.exe
  2⤵
  PID:16636
- C:\Windows\System\knJLWMn.exe
  C:\Windows\System\knJLWMn.exe
  2⤵
  PID:16660
- C:\Windows\System\HsdhPdl.exe
  C:\Windows\System\HsdhPdl.exe
  2⤵
  PID:16684
- C:\Windows\System\zDtlltW.exe
  C:\Windows\System\zDtlltW.exe
  2⤵
  PID:16708
- C:\Windows\System\ZNSDhik.exe
  C:\Windows\System\ZNSDhik.exe
  2⤵
  PID:16732
- C:\Windows\System\lOYYxrm.exe
  C:\Windows\System\lOYYxrm.exe
  2⤵
  PID:16748
- C:\Windows\System\lnSOrEr.exe
  C:\Windows\System\lnSOrEr.exe
  2⤵
  PID:16776
- C:\Windows\System\GNCyTgP.exe
  C:\Windows\System\GNCyTgP.exe
  2⤵
  PID:16796
- C:\Windows\System\PekiuCe.exe
  C:\Windows\System\PekiuCe.exe
  2⤵
  PID:16828
- C:\Windows\System\xnXxPFl.exe
  C:\Windows\System\xnXxPFl.exe
  2⤵
  PID:16844
- C:\Windows\System\zyitimP.exe
  C:\Windows\System\zyitimP.exe
  2⤵
  PID:16876
- C:\Windows\System\AaRuqfz.exe
  C:\Windows\System\AaRuqfz.exe
  2⤵
  PID:16908
- C:\Windows\System\bOCEDDF.exe
  C:\Windows\System\bOCEDDF.exe
  2⤵
  PID:16924
- C:\Windows\System\MxgIfgf.exe
  C:\Windows\System\MxgIfgf.exe
  2⤵
  PID:16940
- C:\Windows\System\ewPDgBt.exe
  C:\Windows\System\ewPDgBt.exe
  2⤵
  PID:16960
- C:\Windows\System\OOCzOfl.exe
  C:\Windows\System\OOCzOfl.exe
  2⤵
  PID:16992
- C:\Windows\System\rtdGBwG.exe
  C:\Windows\System\rtdGBwG.exe
  2⤵
  PID:17012
- C:\Windows\System\XUrgLWm.exe
  C:\Windows\System\XUrgLWm.exe
  2⤵
  PID:17036
- C:\Windows\System\XcMoJWq.exe
  C:\Windows\System\XcMoJWq.exe
  2⤵
  PID:17056
- C:\Windows\System\ehCbroR.exe
  C:\Windows\System\ehCbroR.exe
  2⤵
  PID:17084
- C:\Windows\System\wGmWzLs.exe
  C:\Windows\System\wGmWzLs.exe
  2⤵
  PID:17100
- C:\Windows\System\ZAWjsbs.exe
  C:\Windows\System\ZAWjsbs.exe
  2⤵
  PID:17312
- C:\Windows\System\pDCFuiO.exe
  C:\Windows\System\pDCFuiO.exe
  2⤵
  PID:17344
- C:\Windows\System\juAHXLX.exe
  C:\Windows\System\juAHXLX.exe
  2⤵
  PID:15564
- C:\Windows\System\WHelMJL.exe
  C:\Windows\System\WHelMJL.exe
  2⤵
  PID:16408
- C:\Windows\System\zJvVifG.exe
  C:\Windows\System\zJvVifG.exe
  2⤵
  PID:16460
- C:\Windows\System\jnXzgqm.exe
  C:\Windows\System\jnXzgqm.exe
  2⤵
  PID:16644
- C:\Windows\System\tkPmbzF.exe
  C:\Windows\System\tkPmbzF.exe
  2⤵
  PID:16560

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BdMzSEM.exe

Filesize
1.6MB

MD5
ad3d9142b51e54355c361584ce0b9bba

SHA1
4a46ea00edd0734daa1518258e56eea826d22481

SHA256
0d35128c655611e27b3532549110ce24e60ec379878905cb034666fd9cf98c54

SHA512
950e18f12d3d0d06ef6c1dba51bc235af7efa9a4ebbfb21fd9250a7c8c633a76b3b6cca08af4f8efd9a38f798f3f8edd7b88c32c255fcc3dc975cad1046987ac

Download Submit
C:\Windows\System\DjdONzV.exe

Filesize
1.6MB

MD5
4371d8dc13c4bb668fb38b73296804a4

SHA1
0ba0ffb56b840aecdd12bd5a86562268b8a03822

SHA256
4deebdfda85abfbf780aca23a03e97978d41a1e301c1b39a3a5d77777be3eda0

SHA512
30f75a945a2f0ac90a1e07bf5117e3ee71d7c5994f099642ada9e66b99470d540dfbb9bef940ec54adc7111edd05dd5b667fbae8458d9107f72f0ddbbe250350

Download Submit
C:\Windows\System\FRxBjrG.exe

Filesize
1.6MB

MD5
82ed2a69fbd8ea344994260429dac28a

SHA1
5dd59d88893064eefb91c24c3f974835f50b83ba

SHA256
0e3b761545a7ea7a06197db01d232e643a98b4799704e24c15453743912b17df

SHA512
a74a448298fc104cb62d657f73f84613a2d487a588e583f3a0937bf893fab18aa1b26ce8463d1b1a50469b5ab401c10c3a9da5938aa7d6ec5aae2bb2c943cbef

Download Submit
C:\Windows\System\GuKFhJD.exe

Filesize
1.6MB

MD5
dccbd27378c2a5a62dc1d02a60b1ca60

SHA1
db98e94a965ceb892b1a2aff3e9e57b7185973db

SHA256
4f937378089757ee6f691de3244f0fcd39d31b096d7af9a371c8d10e056a5391

SHA512
f5fc8baef14cf91960e706b0ce71b7843d1bad1437190fe3ac45c3ceaf46142b3d49556b2713e3d9e4a06fd2606dcebb82326a4013b77362ec6b7992e2478977

Download Submit
C:\Windows\System\HEAGIRM.exe

Filesize
1.6MB

MD5
b8554a4951df6c13e4d6b94e3b59a3ce

SHA1
753e8b18cdf39aa5848eb0f716fd4244d8874e91

SHA256
f63392933aadc89c4d8ff73043cdf72812c5bfc235b58e1ac1871d7e851a3220

SHA512
6a64fc1f83885a6d6b43b2749aa8d4e123573d8de183ddc3503ec466602b9bc1a81967ebcc96e51fd581c36e5c45edda095698107a9f3631619d643bdcfbf26a

Download Submit
C:\Windows\System\IPPjOUn.exe

Filesize
1.6MB

MD5
96e5febbcff7856e0c9866f0650cab5c

SHA1
f0db0ddf85e8336cb6ffdb671052e128aa2cd495

SHA256
f9ce7c5a2254389be848ab06ab1434f279feeb1ff282578b740e9b1a71d559be

SHA512
69147858dc9ba7ff4e48154f2fe1c166990d95bd0ed0a73ffbc3bcd33111cdc509833cfda94771fae98ee73e2a26dc8105ee258c4c3e95ccf34216ed4b3c33c1

Download Submit
C:\Windows\System\KnHzxap.exe

Filesize
1.6MB

MD5
1967e95a25a50fcbfe5305f1f72ab29a

SHA1
6e7b46c1e2b96154abb6579ac157782e41b90088

SHA256
9f955137a18f7595c06fc295de83e56d82132fe8c9b53f249f1bc5693ace242c

SHA512
1e813315c65f3e054bc801355175572232421142c0f4b64e3504e794b192c12da5e5f7bdff536edd85f05ab075dda5d1199403c0539d8fd893d36de3a6554922

Download Submit
C:\Windows\System\KqzGnGB.exe

Filesize
1.6MB

MD5
1887e82a9f1f8b7e429b31e47e6c9a6a

SHA1
6dc6663097daf535a3090266551d53f5d11fbc63

SHA256
fcd9a7a6e178a7bb6e5684287376d316043e0be0ba803ef8ee3d8398d7825da5

SHA512
96b1b43f8bbe5d7b23af559f19d2028d850eadc3a95e9d13b8f663388aead9bfac96d607f0944b77e2d421d5364ad7db59d5aca508d44f93efcfecb36fdbbd41

Download Submit
C:\Windows\System\LKnXtwc.exe

Filesize
1.6MB

MD5
c6e0ddd361373b3c7444906a6ce331fb

SHA1
d86f98a73380a42cc03d314e8c003dd3581dc01b

SHA256
086eef76efcb844245fe69872f10326f68488e6cab105f3c87eacc4b0dd803e0

SHA512
2355862906ab6177622fa00b58fd8c18c8bda0062d35be7c5f4e0c084908d0f905beadd03c10bb89e907e98f8afe7664bc7a36144080b207260edf9d63aa40c5

Download Submit
C:\Windows\System\LlgPSZn.exe

Filesize
1.6MB

MD5
2d853a36a3aca686936843f74fc702b1

SHA1
6931e56037781cfcd5dace42d49df696f5c6cf67

SHA256
5cbadd0a678d4d3b521a0e3186a5702073f2e299d9e74381cbec34044faf1030

SHA512
c0e5e9db8fb526b0206fcf613e57b7d598e2d2ca89037d8c04d1cba741b5c94f7fe2a0cb4227be860a20223bfa24f7e22353a83982e2f168319973c92c3d5357

Download Submit
C:\Windows\System\OZLVfVr.exe

Filesize
1.6MB

MD5
863c3d0a0d5fb1d014eb27331adc609b

SHA1
c3eeb2582d1022a6302daa8183acd91770025a4d

SHA256
2f91c7e7e535893e9a28865417dbcdb000e3fc24a84912dccff3a189facb10b1

SHA512
b65c2dcae3c0f0ee099ebc932c2c51c1d2e06d47f885fe9d18f2569e43273433f3b5b2c423881e328294547790a6d4f720985e54bdf293b9255a5e4f3b11e564

Download Submit
C:\Windows\System\PJDMfdm.exe

Filesize
1.6MB

MD5
32e0cc6671da89b427c6201029e059b0

SHA1
980122d3b03a55053ee06a332136a91cdb709692

SHA256
bbc51e9ad2333e247801c6c564c131ba19394b7b451e7376d488b399a5a7976f

SHA512
7660b9740ee92827ced727ec32a37a1dbb1bd0fdaac4da6361ea721c75b9eef46333e042db056c36abac6822b121647c2669135292f77581e6da6d15e58a68ac

Download Submit
C:\Windows\System\PqXnkOE.exe

Filesize
1.6MB

MD5
b6843bc0127abf0710d8feb969802ced

SHA1
0851c2d2f1f94b8bb4217aa2e6c94a16daadb94d

SHA256
180ab362c0b87099856b54c60fa447d3eef9986cbf34fdcbe98e5f7e570e8a31

SHA512
4295b08781e29300ea46f4e4e1d64c3d6db8264f86cdde2370d3be709b4e24c698f10e08b9be7cb2c3fa9c47890385f6949f7460e80382d0542b813d03da9a6a

Download Submit
C:\Windows\System\SIqsiBi.exe

Filesize
1.6MB

MD5
4806520435dbc4737d2283207a35a946

SHA1
b533024954a98a284fd9f77655a7ee1078142bdf

SHA256
db088f5d5c83c4c076f21aa3bbee2666781e9a8f77f711db3c86989bb4964956

SHA512
deb45e39b5d0bc8b0c5014f761cb275c98d995b107f82dda0a24cb22a9423a6252243657daeb24bcd032b0a6871c3f79fba5014fc23e2d8549b6ddfe490f169b

Download Submit
C:\Windows\System\TYWVzpH.exe

Filesize
1.6MB

MD5
4fb87409614398eeb51dc1786a5ebff9

SHA1
dbf37ac491ba7dad02e29ed487925078be2fe728

SHA256
b298df61a865dfa65f82c55b0d3d41495ad932ce170e1907dc6d08828a45e7ba

SHA512
8d69c87e971c499f7ae90d5aae1708579de6854b624b3822daa71918a76c74b5cfe17e82fc6502929e43d64ceb766709cc4231b892a5b17a8cc110f22106a29b

Download Submit
C:\Windows\System\TdqmidI.exe

Filesize
1.6MB

MD5
9f69e05cb26a6fe51c5cecddf4e04259

SHA1
55421ab769f6e52eb6da6c56ea47a2045c42cfb1

SHA256
9fd1a3d7b06e21e65196fc5e1ce05249f9eb32702b43b0706fa6ba6d7556ccca

SHA512
6ac3230a4d59fc72965b9ff41b87084032860bfca09af22a1baf37b4f8cb716a3bcff4a5b9ae0ee152e964cfe82e9b839564b60e70eec66fb93d1fcc99be056a

Download Submit
C:\Windows\System\UzuqxHL.exe

Filesize
1.6MB

MD5
cd6b1357bab3301a020c2fe2bab3c7d4

SHA1
91b988fc712c24ec3ee240d8c59d3234f299c31a

SHA256
bf7b557c80377fe1deaf759484637b55c08ce4e14f272635a09078c60bcb263a

SHA512
5f524e83f578526106d3f815b4b9629db8ac2938ae0413279ca8ab24ac95960eb22ebc5ef689fb4a126ea0afc4ee3d1754515ab96867d75a4261a8880cac4b44

Download Submit
C:\Windows\System\WErVOGQ.exe

Filesize
1.6MB

MD5
7932960958ca25068278caf3f61beff7

SHA1
d10afd162565df9ebedde927ee2b2e1cfd986810

SHA256
d4cc6b2a03ab9e82fd0c264e091aab6c1cc28915b410eca6975f2f8336b4f5a3

SHA512
3c4190e56c6e64c3495e4a4b19f3a5b80b72e9cadb9d323eb0c9e966379cc3184cc01a112cb870e2296295d70a757f2fe8eb85361804216e5fa2dbb6feb6cece

Download Submit
C:\Windows\System\WqKsgFL.exe

Filesize
1.6MB

MD5
a14c6719ad555f074543949076fcecd6

SHA1
c148eaf98a0b82e8fbdeed5e7de352cd36eb19cc

SHA256
e6abf458dcb5ec7ec7ddfeb62a5f92073099d5ab18dce71b9ad430be1d16623f

SHA512
416d8c81b81ebff288429ba9f0673eb7a9f766a953218cf951ba7478f20ebc8e16170654e9455b0e3adf0b07fbea468f8d69447798d16686ee4df52edf900840

Download Submit
C:\Windows\System\XuKotlD.exe

Filesize
1.6MB

MD5
90ed3dde3a2e16868b4f1ad66f807d68

SHA1
43448817dfc83e7a0e404a90b42c04ac8c7e53ab

SHA256
ce84905646680cccd70827c1afbb544ec15c9d2ac152636d23ad0a650cfa1f1f

SHA512
74976adb97150562dbf23adccb4a88f0c563339323ec24afff475a272d1d9a8b4898f762f9aa9ac1a4f92f707bcba3dddb113901688a67d8326add8ad5b2fdbf

Download Submit
C:\Windows\System\YtwLaeN.exe

Filesize
1.6MB

MD5
4a018c560d35822400b68f6863f7c226

SHA1
07b0e2569f3cf13ddbec44c755016496fee3bc11

SHA256
12a155d5cc52de549897b081213d578d878596ae7e548554d97660683df78dab

SHA512
d0c6596c3a2b2f298ede4e5f21704ea36cc7554d49572106267e28100b599a58567336cd92d772ac6842e19d16d67a9c533a1a43a8af8e039f6c212900562a33

Download Submit
C:\Windows\System\aDvSvTP.exe

Filesize
1.6MB

MD5
c035115d5f6614e4d1678d4044c1e9f3

SHA1
d767fcce0b95e1b5b356575aed9fb016975e7c43

SHA256
307bd50885300615a20fddc2c94421f38ce564f6598a982daa208671c349ca70

SHA512
84cbaa8f06eddefddf05052e33618250e16cae747b3850be228438fe05e24ce68b52aa335b0522964f1b874813652916c83df85a890eea9aae1a8b08f9464487

Download Submit
C:\Windows\System\apKRACa.exe

Filesize
1.6MB

MD5
33fd9998f1b5491703beaf1ba2a61ff6

SHA1
0029af76ce8257e6b90ba127f8e608bc842f5b30

SHA256
079b9c392e4acc71e8686fc990905df0f57cd51ead984e4308b44c2ef370548a

SHA512
f9be6f2edd192294591361eaa9304d68c12c42980aaee5caadb0735633c55e72bab67c33bbc4b31028bf6e259ee367d957813973364debafa258dcdb7faf077b

Download Submit
C:\Windows\System\cQsrKqt.exe

Filesize
1.6MB

MD5
62484a764b5786aed0f5fab35d061e5d

SHA1
4bc96d7fca9409dd0dbb45ae6a16e18347185b18

SHA256
de590fa719e6ca297b5260c16aa6fd383e532ecfaebf8ff528bce1481b69e7ca

SHA512
a0527ea2e70fa7f1babcc5cb093995712c8c0e9286369026e261d1e95623cbce1b2eada495c08248dbed6262d3a508088e0c3bd70cd8055b8e0ec268d78344f6

Download Submit
C:\Windows\System\dFjLqZX.exe

Filesize
1.6MB

MD5
22c2c747e21951222f8426f343fbd4cd

SHA1
308f4b5ace2712c8a9946547ec39f59c58255540

SHA256
ab1a126afc9a179b0ba9a15b2d4a27ff4e285fa7e0d580510f2bbfe39932decd

SHA512
36eaa3fc53be25564e064b4ac0454a317dcc51a398e10c40a170d1bc8b1fa5cf8e68c76c3f64bd604e9a35ed79ece4929c336981f8e49152e9ec1cb52ab03767

Download Submit
C:\Windows\System\dKCXjfO.exe

Filesize
1.6MB

MD5
56cd45a6b7075cea7603a055af9678b1

SHA1
f7cc83a2ad4a15198cba30e6109203e89a11f673

SHA256
15d47b4de49463e8c7e7239e69f5dd3c701fe70b79ab52912f5f7a0b16339a97

SHA512
a3f0d4801daf19e988a3cc344a50c3d7d8969b9631e98c3993d610693d1c369762ae9b1ab6f47456072782b9bb3d6920a89611bb50d947fbd9317c81a36b3d83

Download Submit
C:\Windows\System\eAOrYXC.exe

Filesize
1.6MB

MD5
7450b5052a1d6cbaaab29418a25e26bc

SHA1
8a16dd46c7655bba69ff9edf0b3df9a11742d05d

SHA256
d65e2d639f52559c15cfa540736fde19c7d48882c0dfd9875afe329f3b08555e

SHA512
f1ae9145acefb8fdc5888116827b223a45a32fdfd2ab49b2cf4fc3dccbb3d795b7322158d616fb104c91cb4c7416023645bcbb131bf00ecbce9149414cfd07eb

Download Submit
C:\Windows\System\eCnBjMM.exe

Filesize
1.6MB

MD5
9b2f67393aaed32428b24850cc1d3d08

SHA1
58122a9011b5c28fb290d468eedfbc820a74aa36

SHA256
717cc87311b5712bb2c679d2d454d62eb97ba44390c6200a8fe45979e2f75e73

SHA512
1f7913d37468b8e2c8bd3bee9e63df14ed0693eccc3abdcaf9d315e5e9d6ca779f921d97e547f254ab5695fa97ccc6be296569b0e41cdeee8e1aab2f0d042608

Download Submit
C:\Windows\System\hnaqnCf.exe

Filesize
1.6MB

MD5
ea06771dc4f85ecbc6f4bdf7959492ca

SHA1
189fd123313077d17d3c7d05fc31bfe01c092b89

SHA256
17f1d1f2c44baf45bcf52862c6fff94cbd913e4fc3378c213069cde504d4b725

SHA512
de8c9405563105d054fedb4436fadb1632e9360825659227ca53b06c6b1db85ad709c9af14e9e1b76033cdf46f0d98448bcd82fb7fe2b5d8462c4b8e1de53636

Download Submit
C:\Windows\System\jOGUiFg.exe

Filesize
1.6MB

MD5
e31cbb0831456136384a3532c7197046

SHA1
218f2b60063d80066f79dedc3fa6d6e932c51091

SHA256
bd219f761a724d474341af7981dbbe504c79f536f91ab076b7c14afe4a36901b

SHA512
d397a49001c9265751d6da1a8c48de7639c2b4a0167ca51ebdf72c5ed37b09f19a8f75395c2f432360cc7a94de9c97353ac058afee58a2622df31d7b094c4ca9

Download Submit
C:\Windows\System\kJGRARy.exe

Filesize
1.6MB

MD5
610c6b247fa0b54cdd666d97ca299eb5

SHA1
b1be65a11ff9fce04d80ab1c62f16f1193472123

SHA256
cd420b670b0ab6a842e3c87f1ff8de9844137c94218b0aaabe99d9cf3286e13c

SHA512
cbbaa753f41fec76689a2e32743a5dbf4ba3feaa44832893b5a74e08a6caf98b7961a5d65a870b7797784e1ad7f465f4e8123a9118fba7355147417b65c6e680

Download Submit
C:\Windows\System\ksYQaEu.exe

Filesize
1.6MB

MD5
84f406d7fa620134ab88312faf73d6f6

SHA1
65c485e475da9f17fc28b2f422397519d1a08330

SHA256
d9b1434aa65ffaaa4dc4679910a4580a991740fc81ac85d1defa7182e389e193

SHA512
1c54d15a3e7e052e2d7c3696c9ebd86e5f0af0f9bc071f928b00fc869cf10234066e18960455945f33b5361c9364c9b22d04d3a58908951692be5a1351c8a59f

Download Submit
C:\Windows\System\luqpQMm.exe

Filesize
1.6MB

MD5
2c5f4afe3fb98fdd3fa89b4ecb8b03ba

SHA1
7908ed9d9d813cade338c5866f33294b3ddce6e5

SHA256
17debaa637f40a6805de082689dd0451717c17bfa564ce04531168c7abf89e79

SHA512
e9a473e19fa8f543d95601697515e55eba4edd58e4ee7633a3774fc73c5f79876f9cf5b7a0dd68b9a4bc40694cbbea41ece1f4d39138746514038663a1a73c3c

Download Submit
C:\Windows\System\pZtsTjD.exe

Filesize
1.6MB

MD5
1ec23d26e42d78a42e51752ec5aa37c8

SHA1
9c1b58d34d4fe40c0311ac43bb7fc1fe68751f74

SHA256
755ea24ec59cb3f380d21ec71c41cee3e44ea03ed8dfef4c1cfe286121f61bed

SHA512
6e45734236f221f9913b0c180461988acfc7fd2f690f3fddb8d60ea4ec68950c908f8861114787e4c23f557b836fcdee8fb8e6bd61511e50ec7ac3307d49267b

Download Submit
C:\Windows\System\rGoxWtG.exe

Filesize
1.6MB

MD5
1e5c5f35434cae2224aa8544f1d17ba1

SHA1
c9430740c49a6cc93354ac68d8dc01e2253c9c20

SHA256
05e1b915666af602af1863a596d91d9b315d393a266a672fe08d49ed212db9dc

SHA512
3a5d6ef08e2440275db1ae0e8fdedae184715c42a9fe1358c2dfd64340855d8b862e08be84cf8d94d2a3f434acfb79b9080fc2e6c887f5c4b40195775e24ac20

Download Submit
C:\Windows\System\raTWJuD.exe

Filesize
1.6MB

MD5
8972182352fefd3fcb6ce04f89ae4746

SHA1
023975bbea5840ecfe9d43b8f212604aa2bbec99

SHA256
d1970449c1e099bf8baf472021bd3e9e424a4ffd00002e9808a247741be8cbc8

SHA512
6e695de6bf6b35f92c093d28f877ee61e38b3dd290dc2d8b3923da4227dd9bfab357c61a9f3cfd1f52c1dfeae44fe3de27d3ec3516995bd1a0bdea2c25ff0fe8

Download Submit
C:\Windows\System\sknhNkZ.exe

Filesize
1.6MB

MD5
c1cd03ba76f9cd1d0b5dec0e894c6725

SHA1
e611164b26c22443b67aa05638ebe51515ce01f1

SHA256
aeec0f0bf7462cd8ef0982dd8f25d8a192e1baab0dac5b21542410f09d7e43dc

SHA512
34c13cb0e4f93f527a8a605e72772c6f601e8206a3b816f52e13aaa50e0827e9e56ca2a6a35ff4573daeab2770dac6d3a6a2b366d213ccf66e6cb0a190b6a3c4

Download Submit
C:\Windows\System\tQTncnv.exe

Filesize
1.6MB

MD5
eebb472556a65f83c450eedfa414eb3b

SHA1
47d67fd20343918bb4864424e304b717424d53f5

SHA256
0f9793318e6054cd9b64f4bf3ba3053939a48e54ac273c26685e2a38d86e2386

SHA512
add6bdd6579be9ffa7ba232d7fe87209b63b757bb8bd9de720e327a90c08de2c5e560432ab2f8e3370dd192f520ff3eafcffcc01a0120a6cabac11cd0117bc01

Download Submit
C:\Windows\System\vnmokeM.exe

Filesize
1.6MB

MD5
897a248198336776669ec78a9271b7df

SHA1
380927c6e1bc518b87a22818a69bc8fd871baae2

SHA256
a7c07574c20f70a30fdf2ecde16947e143dce28292b0af08954b7e0fe5bc958a

SHA512
089ba03b72aa0bab1a820a634e256b568f3053dd23da31677d137413557a57d26bbe85cd0524665fdce7ad299ce0c53190af4a20c7550f374b251414ce517a8f

Download Submit
C:\Windows\System\xtZvEvX.exe

Filesize
1.6MB

MD5
24552acbff71e6c2b86d141411f09548

SHA1
649dacd2cde311ac0c3f8fa2a0308d057c314d44

SHA256
502eddeb7c2c1479368ab72f16843e3b83c50fca83da61dff9f31bc96dcfd168

SHA512
013c0675783d6e48765401643b82b8c68a3482dd67058592574a25cf9208030c178058f841704be700236366c068f2608452d544c5864fee1f5d6d7ceeafcefe

Download Submit
memory/4884-0-0x000001458C650000-0x000001458C660000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads