xmrig | aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed

Analysis

max time kernel
136s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2025, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
Size

1.7MB
MD5

00cff0e50301bf06d812b5a6455e9a0c
SHA1

e56c6e7f84847edc41624ceaf50d330e734be8af
SHA256

aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed
SHA512

85a550a038cd5e97c6a2c8ef1a7fb1789ff83077a12cb64e549972f293ed2570d0eb82f1dcfa5d23a8957607f73a4b44b6d999efed2c95d2bb3a1612ceb132da
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZ/e3QpO:GemTLkNdfE0pZy0

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b7a-3.dat	xmrig
behavioral2/files/0x0007000000023c65-7.dat	xmrig
behavioral2/files/0x0007000000023c67-21.dat	xmrig
behavioral2/files/0x0007000000023c68-36.dat	xmrig
behavioral2/files/0x0007000000023c6a-40.dat	xmrig
behavioral2/files/0x0007000000023c69-38.dat	xmrig
behavioral2/files/0x0007000000023c66-25.dat	xmrig
behavioral2/files/0x0008000000023c61-15.dat	xmrig
behavioral2/files/0x0007000000023c6b-44.dat	xmrig
behavioral2/files/0x0007000000023c6c-50.dat	xmrig
behavioral2/files/0x0008000000023c62-47.dat	xmrig
behavioral2/files/0x0007000000023c6f-67.dat	xmrig
behavioral2/files/0x0007000000023c6e-68.dat	xmrig
behavioral2/files/0x0007000000023c6d-63.dat	xmrig
behavioral2/files/0x0007000000023c70-74.dat	xmrig
behavioral2/files/0x0007000000023c73-85.dat	xmrig
behavioral2/files/0x0007000000023c74-90.dat	xmrig
behavioral2/files/0x0007000000023c76-91.dat	xmrig
behavioral2/files/0x0007000000023c78-99.dat	xmrig
behavioral2/files/0x0007000000023c7a-131.dat	xmrig
behavioral2/files/0x0007000000023c8b-173.dat	xmrig
behavioral2/files/0x0007000000023c8a-170.dat	xmrig
behavioral2/files/0x0007000000023c89-167.dat	xmrig
behavioral2/files/0x0007000000023c88-160.dat	xmrig
behavioral2/files/0x0007000000023c87-159.dat	xmrig
behavioral2/files/0x0007000000023c86-154.dat	xmrig
behavioral2/files/0x0007000000023c85-151.dat	xmrig
behavioral2/files/0x0007000000023c84-150.dat	xmrig
behavioral2/files/0x0007000000023c83-149.dat	xmrig
behavioral2/files/0x0007000000023c82-148.dat	xmrig
behavioral2/files/0x0007000000023c7e-144.dat	xmrig
behavioral2/files/0x0007000000023c81-141.dat	xmrig
behavioral2/files/0x0007000000023c80-139.dat	xmrig
behavioral2/files/0x0007000000023c7f-137.dat	xmrig
behavioral2/files/0x0007000000023c7d-125.dat	xmrig
behavioral2/files/0x0007000000023c7c-124.dat	xmrig
behavioral2/files/0x0007000000023c7b-120.dat	xmrig
behavioral2/files/0x0007000000023c79-115.dat	xmrig
behavioral2/files/0x0007000000023c77-106.dat	xmrig
behavioral2/files/0x0007000000023c71-82.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2868	ScVAXYj.exe
536	emwxjKb.exe
380	xouloEw.exe
1604	jUhehlv.exe
396	UjSHHJB.exe
2212	MIUvhTW.exe
1484	DotbKKb.exe
4844	lCjRrNe.exe
1512	NBQfesW.exe
4696	QUhlupF.exe
908	LDCiYIg.exe
4444	FcLbMAT.exe
1296	fmYmjSU.exe
4248	ouhEiZw.exe
2780	bpBVdAT.exe
2260	kvxMssK.exe
2476	hcsDyWx.exe
2772	qSqYkDA.exe
1564	BKRnXIv.exe
3532	bbMuKpm.exe
5096	JTugQpo.exe
3536	CGCoSdH.exe
1896	qMtUcSw.exe
764	iqKFsqX.exe
860	qwMpKfk.exe
2292	GRsCVCI.exe
212	sqzfjNh.exe
4432	FEmAKuA.exe
4420	Yrwyzon.exe
1912	gHOdpjL.exe
4768	NHVYOTt.exe
4108	yttzgmX.exe
444	GSchwsO.exe
692	BLDyPjp.exe
2852	qgyZaiZ.exe
4196	YNjspNn.exe
4376	qOBVhIO.exe
4620	wTTBtPF.exe
2908	jaMmiwQ.exe
2704	JVTOJDu.exe
2392	fgdsHjh.exe
3888	sgmOrSz.exe
1188	aFveJxN.exe
4860	NsKhGPF.exe
2632	wRcPVGN.exe
4212	ftYGgLO.exe
1728	ydsKPHw.exe
3380	EWWCvSu.exe
3956	floYfDY.exe
4664	JMFYGKa.exe
3008	TMmQkGq.exe
1536	SAfFvZL.exe
4544	BCWYqKr.exe
4484	XtxKiGq.exe
4884	liDEGuQ.exe
4732	CzqlsfY.exe
112	FxxsLOZ.exe
2424	GhZNokO.exe
2784	TwYxmjm.exe
4368	GnBtdBi.exe
3356	wPNCuTr.exe
3264	ufjDcvY.exe
2840	RLcKLIe.exe
4868	XINoymu.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\navshxP.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\UFELJGo.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\HvYSCjg.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\JZmpavw.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\yHEFHhl.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\ACcOWsy.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\CohSLuw.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\cRRnyFy.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\izmygyT.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\HdKHYyh.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\sUvZhoB.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\nkyqecA.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\PIIXsls.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\SiniVWC.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\uBxphUA.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\OqEIkbc.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\vgvEOSp.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\HiMlPzz.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\rYHCGwH.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\fmYmjSU.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\qgyZaiZ.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\eIDvEUy.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\rxgcsiI.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\KyZkcxv.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\PtWqvSf.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\rfDKNVU.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\KNrmyun.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\ZuKQGQE.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\DotbKKb.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\kiXkobv.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\aDLmTbF.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\gbXftTm.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\iroIYQh.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\GkLCmsL.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\WIqnYRl.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\pPFgeHr.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\wTTBtPF.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\bldnGFP.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\WjpMwSU.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\WnzUmIn.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\GOfitdK.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\ENsntzE.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\MQDkavc.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\IHAsHBY.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\dcxOCTb.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\sXrOcDb.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\rFkvSeT.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\axyQgxu.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\kyUOHZk.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\ulHveAe.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\qShvuFK.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\FhNyhsf.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\myPEpqX.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\FVtfdPo.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\ppcqRVR.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\MxhaSWI.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\KfoDVDv.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\nFIPlxO.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\jaYRDeW.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\RhnKlrX.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\BcGtHsA.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\oILodYy.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\tCGOxYt.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
File created	C:\Windows\System\zAlknlW.exe	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16284	dwm.exe
Token: SeChangeNotifyPrivilege	16284	dwm.exe
Token: 33	16284	dwm.exe
Token: SeIncBasePriorityPrivilege	16284	dwm.exe
Token: SeShutdownPrivilege	16284	dwm.exe
Token: SeCreatePagefilePrivilege	16284	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2868	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	84
PID 4804 wrote to memory of 2868	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	84
PID 4804 wrote to memory of 536	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	85
PID 4804 wrote to memory of 536	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	85
PID 4804 wrote to memory of 380	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	86
PID 4804 wrote to memory of 380	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	86
PID 4804 wrote to memory of 1604	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	87
PID 4804 wrote to memory of 1604	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	87
PID 4804 wrote to memory of 396	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	88
PID 4804 wrote to memory of 396	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	88
PID 4804 wrote to memory of 2212	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	89
PID 4804 wrote to memory of 2212	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	89
PID 4804 wrote to memory of 1484	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	90
PID 4804 wrote to memory of 1484	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	90
PID 4804 wrote to memory of 4844	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	91
PID 4804 wrote to memory of 4844	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	91
PID 4804 wrote to memory of 1512	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	92
PID 4804 wrote to memory of 1512	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	92
PID 4804 wrote to memory of 4696	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	93
PID 4804 wrote to memory of 4696	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	93
PID 4804 wrote to memory of 908	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	94
PID 4804 wrote to memory of 908	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	94
PID 4804 wrote to memory of 4444	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	95
PID 4804 wrote to memory of 4444	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	95
PID 4804 wrote to memory of 1296	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	96
PID 4804 wrote to memory of 1296	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	96
PID 4804 wrote to memory of 4248	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	97
PID 4804 wrote to memory of 4248	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	97
PID 4804 wrote to memory of 2780	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	98
PID 4804 wrote to memory of 2780	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	98
PID 4804 wrote to memory of 2260	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	99
PID 4804 wrote to memory of 2260	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	99
PID 4804 wrote to memory of 2476	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	100
PID 4804 wrote to memory of 2476	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	100
PID 4804 wrote to memory of 2772	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	101
PID 4804 wrote to memory of 2772	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	101
PID 4804 wrote to memory of 1564	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	102
PID 4804 wrote to memory of 1564	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	102
PID 4804 wrote to memory of 3532	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	103
PID 4804 wrote to memory of 3532	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	103
PID 4804 wrote to memory of 5096	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	104
PID 4804 wrote to memory of 5096	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	104
PID 4804 wrote to memory of 3536	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	105
PID 4804 wrote to memory of 3536	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	105
PID 4804 wrote to memory of 1896	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	106
PID 4804 wrote to memory of 1896	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	106
PID 4804 wrote to memory of 764	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	107
PID 4804 wrote to memory of 764	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	107
PID 4804 wrote to memory of 860	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	108
PID 4804 wrote to memory of 860	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	108
PID 4804 wrote to memory of 2292	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	109
PID 4804 wrote to memory of 2292	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	109
PID 4804 wrote to memory of 212	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	110
PID 4804 wrote to memory of 212	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	110
PID 4804 wrote to memory of 4432	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	111
PID 4804 wrote to memory of 4432	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	111
PID 4804 wrote to memory of 4420	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	112
PID 4804 wrote to memory of 4420	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	112
PID 4804 wrote to memory of 1912	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	113
PID 4804 wrote to memory of 1912	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	113
PID 4804 wrote to memory of 4768	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	114
PID 4804 wrote to memory of 4768	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	114
PID 4804 wrote to memory of 4108	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	115
PID 4804 wrote to memory of 4108	4804	aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe	115

C:\Users\Admin\AppData\Local\Temp\aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe
"C:\Users\Admin\AppData\Local\Temp\aa33239468a8c007e7850cbfe6d2cc4dcb2584c94296eba0c33f6243dfed75ed.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\System\ScVAXYj.exe
  C:\Windows\System\ScVAXYj.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\emwxjKb.exe
  C:\Windows\System\emwxjKb.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\xouloEw.exe
  C:\Windows\System\xouloEw.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\jUhehlv.exe
  C:\Windows\System\jUhehlv.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\UjSHHJB.exe
  C:\Windows\System\UjSHHJB.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\MIUvhTW.exe
  C:\Windows\System\MIUvhTW.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\DotbKKb.exe
  C:\Windows\System\DotbKKb.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\lCjRrNe.exe
  C:\Windows\System\lCjRrNe.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\NBQfesW.exe
  C:\Windows\System\NBQfesW.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\QUhlupF.exe
  C:\Windows\System\QUhlupF.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\LDCiYIg.exe
  C:\Windows\System\LDCiYIg.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\FcLbMAT.exe
  C:\Windows\System\FcLbMAT.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\fmYmjSU.exe
  C:\Windows\System\fmYmjSU.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\ouhEiZw.exe
  C:\Windows\System\ouhEiZw.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\bpBVdAT.exe
  C:\Windows\System\bpBVdAT.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\kvxMssK.exe
  C:\Windows\System\kvxMssK.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\hcsDyWx.exe
  C:\Windows\System\hcsDyWx.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\qSqYkDA.exe
  C:\Windows\System\qSqYkDA.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\BKRnXIv.exe
  C:\Windows\System\BKRnXIv.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\bbMuKpm.exe
  C:\Windows\System\bbMuKpm.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\JTugQpo.exe
  C:\Windows\System\JTugQpo.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\CGCoSdH.exe
  C:\Windows\System\CGCoSdH.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\qMtUcSw.exe
  C:\Windows\System\qMtUcSw.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\iqKFsqX.exe
  C:\Windows\System\iqKFsqX.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\qwMpKfk.exe
  C:\Windows\System\qwMpKfk.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\GRsCVCI.exe
  C:\Windows\System\GRsCVCI.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\sqzfjNh.exe
  C:\Windows\System\sqzfjNh.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\FEmAKuA.exe
  C:\Windows\System\FEmAKuA.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\Yrwyzon.exe
  C:\Windows\System\Yrwyzon.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\gHOdpjL.exe
  C:\Windows\System\gHOdpjL.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\NHVYOTt.exe
  C:\Windows\System\NHVYOTt.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\yttzgmX.exe
  C:\Windows\System\yttzgmX.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\GSchwsO.exe
  C:\Windows\System\GSchwsO.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\BLDyPjp.exe
  C:\Windows\System\BLDyPjp.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\qgyZaiZ.exe
  C:\Windows\System\qgyZaiZ.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\YNjspNn.exe
  C:\Windows\System\YNjspNn.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\qOBVhIO.exe
  C:\Windows\System\qOBVhIO.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\wTTBtPF.exe
  C:\Windows\System\wTTBtPF.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\jaMmiwQ.exe
  C:\Windows\System\jaMmiwQ.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\JVTOJDu.exe
  C:\Windows\System\JVTOJDu.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\fgdsHjh.exe
  C:\Windows\System\fgdsHjh.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\sgmOrSz.exe
  C:\Windows\System\sgmOrSz.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\aFveJxN.exe
  C:\Windows\System\aFveJxN.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\NsKhGPF.exe
  C:\Windows\System\NsKhGPF.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\wRcPVGN.exe
  C:\Windows\System\wRcPVGN.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\ftYGgLO.exe
  C:\Windows\System\ftYGgLO.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\ydsKPHw.exe
  C:\Windows\System\ydsKPHw.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\EWWCvSu.exe
  C:\Windows\System\EWWCvSu.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\floYfDY.exe
  C:\Windows\System\floYfDY.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\JMFYGKa.exe
  C:\Windows\System\JMFYGKa.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\TMmQkGq.exe
  C:\Windows\System\TMmQkGq.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\SAfFvZL.exe
  C:\Windows\System\SAfFvZL.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\BCWYqKr.exe
  C:\Windows\System\BCWYqKr.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\XtxKiGq.exe
  C:\Windows\System\XtxKiGq.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\liDEGuQ.exe
  C:\Windows\System\liDEGuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\CzqlsfY.exe
  C:\Windows\System\CzqlsfY.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\FxxsLOZ.exe
  C:\Windows\System\FxxsLOZ.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\GhZNokO.exe
  C:\Windows\System\GhZNokO.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\TwYxmjm.exe
  C:\Windows\System\TwYxmjm.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\GnBtdBi.exe
  C:\Windows\System\GnBtdBi.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\wPNCuTr.exe
  C:\Windows\System\wPNCuTr.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\ufjDcvY.exe
  C:\Windows\System\ufjDcvY.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\RLcKLIe.exe
  C:\Windows\System\RLcKLIe.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\XINoymu.exe
  C:\Windows\System\XINoymu.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\OFNHlnd.exe
  C:\Windows\System\OFNHlnd.exe
  2⤵
  PID:1568
- C:\Windows\System\pjDfPSU.exe
  C:\Windows\System\pjDfPSU.exe
  2⤵
  PID:3896
- C:\Windows\System\orfktOY.exe
  C:\Windows\System\orfktOY.exe
  2⤵
  PID:3592
- C:\Windows\System\cmCuxiI.exe
  C:\Windows\System\cmCuxiI.exe
  2⤵
  PID:2540
- C:\Windows\System\IrzxzPj.exe
  C:\Windows\System\IrzxzPj.exe
  2⤵
  PID:4380
- C:\Windows\System\srAFNxC.exe
  C:\Windows\System\srAFNxC.exe
  2⤵
  PID:1032
- C:\Windows\System\xvsekgN.exe
  C:\Windows\System\xvsekgN.exe
  2⤵
  PID:4028
- C:\Windows\System\kCCgvSe.exe
  C:\Windows\System\kCCgvSe.exe
  2⤵
  PID:4032
- C:\Windows\System\ENsntzE.exe
  C:\Windows\System\ENsntzE.exe
  2⤵
  PID:2892
- C:\Windows\System\tAdzOjT.exe
  C:\Windows\System\tAdzOjT.exe
  2⤵
  PID:184
- C:\Windows\System\BpEsmPK.exe
  C:\Windows\System\BpEsmPK.exe
  2⤵
  PID:2300
- C:\Windows\System\zAlknlW.exe
  C:\Windows\System\zAlknlW.exe
  2⤵
  PID:2052
- C:\Windows\System\ZYCbQZj.exe
  C:\Windows\System\ZYCbQZj.exe
  2⤵
  PID:1560
- C:\Windows\System\GOJePua.exe
  C:\Windows\System\GOJePua.exe
  2⤵
  PID:4540
- C:\Windows\System\mQeqmwk.exe
  C:\Windows\System\mQeqmwk.exe
  2⤵
  PID:2972
- C:\Windows\System\YJbZHcl.exe
  C:\Windows\System\YJbZHcl.exe
  2⤵
  PID:2744
- C:\Windows\System\KKnZudO.exe
  C:\Windows\System\KKnZudO.exe
  2⤵
  PID:3976
- C:\Windows\System\bwzXGOM.exe
  C:\Windows\System\bwzXGOM.exe
  2⤵
  PID:3504
- C:\Windows\System\DkeBzjp.exe
  C:\Windows\System\DkeBzjp.exe
  2⤵
  PID:4680
- C:\Windows\System\bldnGFP.exe
  C:\Windows\System\bldnGFP.exe
  2⤵
  PID:1680
- C:\Windows\System\xagmKqM.exe
  C:\Windows\System\xagmKqM.exe
  2⤵
  PID:3472
- C:\Windows\System\iroIYQh.exe
  C:\Windows\System\iroIYQh.exe
  2⤵
  PID:400
- C:\Windows\System\SiniVWC.exe
  C:\Windows\System\SiniVWC.exe
  2⤵
  PID:2912
- C:\Windows\System\LoPJpqu.exe
  C:\Windows\System\LoPJpqu.exe
  2⤵
  PID:228
- C:\Windows\System\XzDsoXa.exe
  C:\Windows\System\XzDsoXa.exe
  2⤵
  PID:2872
- C:\Windows\System\hnrqTLl.exe
  C:\Windows\System\hnrqTLl.exe
  2⤵
  PID:4792
- C:\Windows\System\MyMorUP.exe
  C:\Windows\System\MyMorUP.exe
  2⤵
  PID:2104
- C:\Windows\System\YfDUwYe.exe
  C:\Windows\System\YfDUwYe.exe
  2⤵
  PID:5024
- C:\Windows\System\bVksROA.exe
  C:\Windows\System\bVksROA.exe
  2⤵
  PID:1260
- C:\Windows\System\DvwdgSN.exe
  C:\Windows\System\DvwdgSN.exe
  2⤵
  PID:3836
- C:\Windows\System\FkwgQls.exe
  C:\Windows\System\FkwgQls.exe
  2⤵
  PID:2764
- C:\Windows\System\DXdAALp.exe
  C:\Windows\System\DXdAALp.exe
  2⤵
  PID:4724
- C:\Windows\System\ltjmeGD.exe
  C:\Windows\System\ltjmeGD.exe
  2⤵
  PID:3824
- C:\Windows\System\hPpoIHJ.exe
  C:\Windows\System\hPpoIHJ.exe
  2⤵
  PID:4004
- C:\Windows\System\aydvIMt.exe
  C:\Windows\System\aydvIMt.exe
  2⤵
  PID:4332
- C:\Windows\System\UwCCWaT.exe
  C:\Windows\System\UwCCWaT.exe
  2⤵
  PID:4468
- C:\Windows\System\xSuklNl.exe
  C:\Windows\System\xSuklNl.exe
  2⤵
  PID:1760
- C:\Windows\System\nkyqecA.exe
  C:\Windows\System\nkyqecA.exe
  2⤵
  PID:932
- C:\Windows\System\GkLCmsL.exe
  C:\Windows\System\GkLCmsL.exe
  2⤵
  PID:4296
- C:\Windows\System\VtJZmUK.exe
  C:\Windows\System\VtJZmUK.exe
  2⤵
  PID:4164
- C:\Windows\System\LfRotrR.exe
  C:\Windows\System\LfRotrR.exe
  2⤵
  PID:1216
- C:\Windows\System\MuyByaa.exe
  C:\Windows\System\MuyByaa.exe
  2⤵
  PID:1548
- C:\Windows\System\WpyuPON.exe
  C:\Windows\System\WpyuPON.exe
  2⤵
  PID:3408
- C:\Windows\System\PIIXsls.exe
  C:\Windows\System\PIIXsls.exe
  2⤵
  PID:4364
- C:\Windows\System\rmYrjhf.exe
  C:\Windows\System\rmYrjhf.exe
  2⤵
  PID:4576
- C:\Windows\System\uWHQPpZ.exe
  C:\Windows\System\uWHQPpZ.exe
  2⤵
  PID:4156
- C:\Windows\System\FOriwDr.exe
  C:\Windows\System\FOriwDr.exe
  2⤵
  PID:2100
- C:\Windows\System\uBxphUA.exe
  C:\Windows\System\uBxphUA.exe
  2⤵
  PID:5144
- C:\Windows\System\bqYcKFr.exe
  C:\Windows\System\bqYcKFr.exe
  2⤵
  PID:5172
- C:\Windows\System\jhtfEZu.exe
  C:\Windows\System\jhtfEZu.exe
  2⤵
  PID:5204
- C:\Windows\System\aZihxlr.exe
  C:\Windows\System\aZihxlr.exe
  2⤵
  PID:5224
- C:\Windows\System\VsSgTIH.exe
  C:\Windows\System\VsSgTIH.exe
  2⤵
  PID:5256
- C:\Windows\System\HGxsnlk.exe
  C:\Windows\System\HGxsnlk.exe
  2⤵
  PID:5284
- C:\Windows\System\DkGhUvH.exe
  C:\Windows\System\DkGhUvH.exe
  2⤵
  PID:5308
- C:\Windows\System\WjRaorH.exe
  C:\Windows\System\WjRaorH.exe
  2⤵
  PID:5336
- C:\Windows\System\TICVvKn.exe
  C:\Windows\System\TICVvKn.exe
  2⤵
  PID:5368
- C:\Windows\System\jYEIzjH.exe
  C:\Windows\System\jYEIzjH.exe
  2⤵
  PID:5392
- C:\Windows\System\vUlOZTJ.exe
  C:\Windows\System\vUlOZTJ.exe
  2⤵
  PID:5416
- C:\Windows\System\ulHveAe.exe
  C:\Windows\System\ulHveAe.exe
  2⤵
  PID:5436
- C:\Windows\System\OJqudEd.exe
  C:\Windows\System\OJqudEd.exe
  2⤵
  PID:5464
- C:\Windows\System\gRfTGxN.exe
  C:\Windows\System\gRfTGxN.exe
  2⤵
  PID:5488
- C:\Windows\System\fLtkajD.exe
  C:\Windows\System\fLtkajD.exe
  2⤵
  PID:5524
- C:\Windows\System\gWBIuNg.exe
  C:\Windows\System\gWBIuNg.exe
  2⤵
  PID:5552
- C:\Windows\System\KvtiFeF.exe
  C:\Windows\System\KvtiFeF.exe
  2⤵
  PID:5584
- C:\Windows\System\MKRPccB.exe
  C:\Windows\System\MKRPccB.exe
  2⤵
  PID:5616
- C:\Windows\System\lWkQauF.exe
  C:\Windows\System\lWkQauF.exe
  2⤵
  PID:5640
- C:\Windows\System\QhtuYwo.exe
  C:\Windows\System\QhtuYwo.exe
  2⤵
  PID:5676
- C:\Windows\System\fzzYHVn.exe
  C:\Windows\System\fzzYHVn.exe
  2⤵
  PID:5704
- C:\Windows\System\twOyXLZ.exe
  C:\Windows\System\twOyXLZ.exe
  2⤵
  PID:5740
- C:\Windows\System\PKgcWpj.exe
  C:\Windows\System\PKgcWpj.exe
  2⤵
  PID:5764
- C:\Windows\System\qNLurNh.exe
  C:\Windows\System\qNLurNh.exe
  2⤵
  PID:5788
- C:\Windows\System\kySzFuK.exe
  C:\Windows\System\kySzFuK.exe
  2⤵
  PID:5820
- C:\Windows\System\yIgrFwc.exe
  C:\Windows\System\yIgrFwc.exe
  2⤵
  PID:5848
- C:\Windows\System\jrxwoow.exe
  C:\Windows\System\jrxwoow.exe
  2⤵
  PID:5884
- C:\Windows\System\juwyfmI.exe
  C:\Windows\System\juwyfmI.exe
  2⤵
  PID:5908
- C:\Windows\System\vQHKkgX.exe
  C:\Windows\System\vQHKkgX.exe
  2⤵
  PID:5936
- C:\Windows\System\MkpHPzV.exe
  C:\Windows\System\MkpHPzV.exe
  2⤵
  PID:5972
- C:\Windows\System\HbUgcly.exe
  C:\Windows\System\HbUgcly.exe
  2⤵
  PID:5992
- C:\Windows\System\wzmJEna.exe
  C:\Windows\System\wzmJEna.exe
  2⤵
  PID:6036
- C:\Windows\System\ReXFcTd.exe
  C:\Windows\System\ReXFcTd.exe
  2⤵
  PID:6056
- C:\Windows\System\FVtfdPo.exe
  C:\Windows\System\FVtfdPo.exe
  2⤵
  PID:6096
- C:\Windows\System\EXbYKlA.exe
  C:\Windows\System\EXbYKlA.exe
  2⤵
  PID:6124
- C:\Windows\System\awZLiWC.exe
  C:\Windows\System\awZLiWC.exe
  2⤵
  PID:5140
- C:\Windows\System\xeuFGzL.exe
  C:\Windows\System\xeuFGzL.exe
  2⤵
  PID:5168
- C:\Windows\System\vjkXtXT.exe
  C:\Windows\System\vjkXtXT.exe
  2⤵
  PID:5248
- C:\Windows\System\SwyhSEd.exe
  C:\Windows\System\SwyhSEd.exe
  2⤵
  PID:5300
- C:\Windows\System\QThpBkO.exe
  C:\Windows\System\QThpBkO.exe
  2⤵
  PID:5332
- C:\Windows\System\ILqwJZx.exe
  C:\Windows\System\ILqwJZx.exe
  2⤵
  PID:5388
- C:\Windows\System\GdKkSyp.exe
  C:\Windows\System\GdKkSyp.exe
  2⤵
  PID:5508
- C:\Windows\System\lUTVUFG.exe
  C:\Windows\System\lUTVUFG.exe
  2⤵
  PID:5580
- C:\Windows\System\VlzLmjN.exe
  C:\Windows\System\VlzLmjN.exe
  2⤵
  PID:5536
- C:\Windows\System\NuAJSBy.exe
  C:\Windows\System\NuAJSBy.exe
  2⤵
  PID:5712
- C:\Windows\System\TidEGEJ.exe
  C:\Windows\System\TidEGEJ.exe
  2⤵
  PID:5720
- C:\Windows\System\iTCLbyF.exe
  C:\Windows\System\iTCLbyF.exe
  2⤵
  PID:5796
- C:\Windows\System\LauWTkN.exe
  C:\Windows\System\LauWTkN.exe
  2⤵
  PID:5876
- C:\Windows\System\czaguhy.exe
  C:\Windows\System\czaguhy.exe
  2⤵
  PID:5952
- C:\Windows\System\PENVVai.exe
  C:\Windows\System\PENVVai.exe
  2⤵
  PID:6000
- C:\Windows\System\CJoEkrS.exe
  C:\Windows\System\CJoEkrS.exe
  2⤵
  PID:6084
- C:\Windows\System\efiRdCt.exe
  C:\Windows\System\efiRdCt.exe
  2⤵
  PID:6140
- C:\Windows\System\WcVusZQ.exe
  C:\Windows\System\WcVusZQ.exe
  2⤵
  PID:5196
- C:\Windows\System\gYpXgiJ.exe
  C:\Windows\System\gYpXgiJ.exe
  2⤵
  PID:5432
- C:\Windows\System\tlYnDzE.exe
  C:\Windows\System\tlYnDzE.exe
  2⤵
  PID:5548
- C:\Windows\System\kDOGXKc.exe
  C:\Windows\System\kDOGXKc.exe
  2⤵
  PID:5664
- C:\Windows\System\iHEfSBe.exe
  C:\Windows\System\iHEfSBe.exe
  2⤵
  PID:5784
- C:\Windows\System\azclfZt.exe
  C:\Windows\System\azclfZt.exe
  2⤵
  PID:6016
- C:\Windows\System\zSHsHhg.exe
  C:\Windows\System\zSHsHhg.exe
  2⤵
  PID:6136
- C:\Windows\System\jvmWOfB.exe
  C:\Windows\System\jvmWOfB.exe
  2⤵
  PID:5400
- C:\Windows\System\kcOFWdB.exe
  C:\Windows\System\kcOFWdB.exe
  2⤵
  PID:5660
- C:\Windows\System\SxeCrEh.exe
  C:\Windows\System\SxeCrEh.exe
  2⤵
  PID:6068
- C:\Windows\System\NTeDPNK.exe
  C:\Windows\System\NTeDPNK.exe
  2⤵
  PID:6032
- C:\Windows\System\SDJrzxc.exe
  C:\Windows\System\SDJrzxc.exe
  2⤵
  PID:6160
- C:\Windows\System\uXKaRNt.exe
  C:\Windows\System\uXKaRNt.exe
  2⤵
  PID:6188
- C:\Windows\System\VjYluKY.exe
  C:\Windows\System\VjYluKY.exe
  2⤵
  PID:6220
- C:\Windows\System\cbLkSVG.exe
  C:\Windows\System\cbLkSVG.exe
  2⤵
  PID:6244
- C:\Windows\System\xADieQo.exe
  C:\Windows\System\xADieQo.exe
  2⤵
  PID:6284
- C:\Windows\System\mQxcYJJ.exe
  C:\Windows\System\mQxcYJJ.exe
  2⤵
  PID:6312
- C:\Windows\System\nYaeqId.exe
  C:\Windows\System\nYaeqId.exe
  2⤵
  PID:6340
- C:\Windows\System\KDeMCzW.exe
  C:\Windows\System\KDeMCzW.exe
  2⤵
  PID:6368
- C:\Windows\System\uhSeruj.exe
  C:\Windows\System\uhSeruj.exe
  2⤵
  PID:6400
- C:\Windows\System\JTfLMCx.exe
  C:\Windows\System\JTfLMCx.exe
  2⤵
  PID:6428
- C:\Windows\System\kiXkobv.exe
  C:\Windows\System\kiXkobv.exe
  2⤵
  PID:6456
- C:\Windows\System\hmmLBXE.exe
  C:\Windows\System\hmmLBXE.exe
  2⤵
  PID:6484
- C:\Windows\System\tlGAYNq.exe
  C:\Windows\System\tlGAYNq.exe
  2⤵
  PID:6500
- C:\Windows\System\FoPDxWG.exe
  C:\Windows\System\FoPDxWG.exe
  2⤵
  PID:6528
- C:\Windows\System\EELLoXp.exe
  C:\Windows\System\EELLoXp.exe
  2⤵
  PID:6556
- C:\Windows\System\zObvQUP.exe
  C:\Windows\System\zObvQUP.exe
  2⤵
  PID:6584
- C:\Windows\System\SGRMdLf.exe
  C:\Windows\System\SGRMdLf.exe
  2⤵
  PID:6612
- C:\Windows\System\hRvIiZM.exe
  C:\Windows\System\hRvIiZM.exe
  2⤵
  PID:6640
- C:\Windows\System\dHRMPnP.exe
  C:\Windows\System\dHRMPnP.exe
  2⤵
  PID:6660
- C:\Windows\System\iXuMrKB.exe
  C:\Windows\System\iXuMrKB.exe
  2⤵
  PID:6688
- C:\Windows\System\MENgmeg.exe
  C:\Windows\System\MENgmeg.exe
  2⤵
  PID:6724
- C:\Windows\System\RhnKlrX.exe
  C:\Windows\System\RhnKlrX.exe
  2⤵
  PID:6760
- C:\Windows\System\LLuXQmW.exe
  C:\Windows\System\LLuXQmW.exe
  2⤵
  PID:6784
- C:\Windows\System\ghkcYkK.exe
  C:\Windows\System\ghkcYkK.exe
  2⤵
  PID:6812
- C:\Windows\System\hYlLiQP.exe
  C:\Windows\System\hYlLiQP.exe
  2⤵
  PID:6836
- C:\Windows\System\hzggerW.exe
  C:\Windows\System\hzggerW.exe
  2⤵
  PID:6868
- C:\Windows\System\yArtqfV.exe
  C:\Windows\System\yArtqfV.exe
  2⤵
  PID:6904
- C:\Windows\System\howtwqo.exe
  C:\Windows\System\howtwqo.exe
  2⤵
  PID:6920
- C:\Windows\System\qShvuFK.exe
  C:\Windows\System\qShvuFK.exe
  2⤵
  PID:6948
- C:\Windows\System\FkgUcxd.exe
  C:\Windows\System\FkgUcxd.exe
  2⤵
  PID:6964
- C:\Windows\System\MqJVpiv.exe
  C:\Windows\System\MqJVpiv.exe
  2⤵
  PID:6996
- C:\Windows\System\DcmcqyE.exe
  C:\Windows\System\DcmcqyE.exe
  2⤵
  PID:7024
- C:\Windows\System\JjWxzIl.exe
  C:\Windows\System\JjWxzIl.exe
  2⤵
  PID:7052
- C:\Windows\System\rxgcsiI.exe
  C:\Windows\System\rxgcsiI.exe
  2⤵
  PID:7080
- C:\Windows\System\HkqOeWI.exe
  C:\Windows\System\HkqOeWI.exe
  2⤵
  PID:7108
- C:\Windows\System\qVfNZFb.exe
  C:\Windows\System\qVfNZFb.exe
  2⤵
  PID:7144
- C:\Windows\System\FKpHctv.exe
  C:\Windows\System\FKpHctv.exe
  2⤵
  PID:6148
- C:\Windows\System\RMSzToA.exe
  C:\Windows\System\RMSzToA.exe
  2⤵
  PID:6184
- C:\Windows\System\sKqPgcS.exe
  C:\Windows\System\sKqPgcS.exe
  2⤵
  PID:6276
- C:\Windows\System\wZUPFLW.exe
  C:\Windows\System\wZUPFLW.exe
  2⤵
  PID:4908
- C:\Windows\System\xpKyzNb.exe
  C:\Windows\System\xpKyzNb.exe
  2⤵
  PID:6356
- C:\Windows\System\iVCWDxj.exe
  C:\Windows\System\iVCWDxj.exe
  2⤵
  PID:6448
- C:\Windows\System\AgYlsqC.exe
  C:\Windows\System\AgYlsqC.exe
  2⤵
  PID:6496
- C:\Windows\System\RSZzXOH.exe
  C:\Windows\System\RSZzXOH.exe
  2⤵
  PID:6540
- C:\Windows\System\ClwusaC.exe
  C:\Windows\System\ClwusaC.exe
  2⤵
  PID:6608
- C:\Windows\System\yVIIVbA.exe
  C:\Windows\System\yVIIVbA.exe
  2⤵
  PID:6684
- C:\Windows\System\wEcUpiq.exe
  C:\Windows\System\wEcUpiq.exe
  2⤵
  PID:6748
- C:\Windows\System\HHImzdq.exe
  C:\Windows\System\HHImzdq.exe
  2⤵
  PID:6792
- C:\Windows\System\oLNgHVb.exe
  C:\Windows\System\oLNgHVb.exe
  2⤵
  PID:6892
- C:\Windows\System\qZdOqen.exe
  C:\Windows\System\qZdOqen.exe
  2⤵
  PID:6912
- C:\Windows\System\cHmMdAO.exe
  C:\Windows\System\cHmMdAO.exe
  2⤵
  PID:6976
- C:\Windows\System\LZaESkW.exe
  C:\Windows\System\LZaESkW.exe
  2⤵
  PID:7004
- C:\Windows\System\meBOwJB.exe
  C:\Windows\System\meBOwJB.exe
  2⤵
  PID:7100
- C:\Windows\System\QPrXWlw.exe
  C:\Windows\System\QPrXWlw.exe
  2⤵
  PID:7160
- C:\Windows\System\ABWVlXT.exe
  C:\Windows\System\ABWVlXT.exe
  2⤵
  PID:6240
- C:\Windows\System\aOipJEG.exe
  C:\Windows\System\aOipJEG.exe
  2⤵
  PID:6384
- C:\Windows\System\hBMYsFm.exe
  C:\Windows\System\hBMYsFm.exe
  2⤵
  PID:6468
- C:\Windows\System\jUpgwZt.exe
  C:\Windows\System\jUpgwZt.exe
  2⤵
  PID:6572
- C:\Windows\System\LrIEORs.exe
  C:\Windows\System\LrIEORs.exe
  2⤵
  PID:6716
- C:\Windows\System\AIrqXxD.exe
  C:\Windows\System\AIrqXxD.exe
  2⤵
  PID:6740
- C:\Windows\System\FHgcBAg.exe
  C:\Windows\System\FHgcBAg.exe
  2⤵
  PID:6936
- C:\Windows\System\MgLwhAE.exe
  C:\Windows\System\MgLwhAE.exe
  2⤵
  PID:7076
- C:\Windows\System\mWFVLvK.exe
  C:\Windows\System\mWFVLvK.exe
  2⤵
  PID:6568
- C:\Windows\System\xsIgPwd.exe
  C:\Windows\System\xsIgPwd.exe
  2⤵
  PID:6860
- C:\Windows\System\NVrCZJu.exe
  C:\Windows\System\NVrCZJu.exe
  2⤵
  PID:6440
- C:\Windows\System\KjcvJDK.exe
  C:\Windows\System\KjcvJDK.exe
  2⤵
  PID:7172
- C:\Windows\System\OYIPvsv.exe
  C:\Windows\System\OYIPvsv.exe
  2⤵
  PID:7200
- C:\Windows\System\WIvASsJ.exe
  C:\Windows\System\WIvASsJ.exe
  2⤵
  PID:7236
- C:\Windows\System\wWGqtLh.exe
  C:\Windows\System\wWGqtLh.exe
  2⤵
  PID:7260
- C:\Windows\System\WvXeJEt.exe
  C:\Windows\System\WvXeJEt.exe
  2⤵
  PID:7288
- C:\Windows\System\rokooYS.exe
  C:\Windows\System\rokooYS.exe
  2⤵
  PID:7320
- C:\Windows\System\jzVFxBG.exe
  C:\Windows\System\jzVFxBG.exe
  2⤵
  PID:7348
- C:\Windows\System\Mnojfgd.exe
  C:\Windows\System\Mnojfgd.exe
  2⤵
  PID:7380
- C:\Windows\System\fXDdcuv.exe
  C:\Windows\System\fXDdcuv.exe
  2⤵
  PID:7400
- C:\Windows\System\vlViswB.exe
  C:\Windows\System\vlViswB.exe
  2⤵
  PID:7432
- C:\Windows\System\wdIawjy.exe
  C:\Windows\System\wdIawjy.exe
  2⤵
  PID:7456
- C:\Windows\System\oaYZeqR.exe
  C:\Windows\System\oaYZeqR.exe
  2⤵
  PID:7484
- C:\Windows\System\LTPaeio.exe
  C:\Windows\System\LTPaeio.exe
  2⤵
  PID:7516
- C:\Windows\System\xmZmNJS.exe
  C:\Windows\System\xmZmNJS.exe
  2⤵
  PID:7548
- C:\Windows\System\ufMyOMV.exe
  C:\Windows\System\ufMyOMV.exe
  2⤵
  PID:7576
- C:\Windows\System\qVlBRUU.exe
  C:\Windows\System\qVlBRUU.exe
  2⤵
  PID:7604
- C:\Windows\System\pUjUKtH.exe
  C:\Windows\System\pUjUKtH.exe
  2⤵
  PID:7632
- C:\Windows\System\hcQuXwm.exe
  C:\Windows\System\hcQuXwm.exe
  2⤵
  PID:7668
- C:\Windows\System\QCynaPp.exe
  C:\Windows\System\QCynaPp.exe
  2⤵
  PID:7692
- C:\Windows\System\xWewjNQ.exe
  C:\Windows\System\xWewjNQ.exe
  2⤵
  PID:7712
- C:\Windows\System\aDLmTbF.exe
  C:\Windows\System\aDLmTbF.exe
  2⤵
  PID:7748
- C:\Windows\System\xNjaBta.exe
  C:\Windows\System\xNjaBta.exe
  2⤵
  PID:7776
- C:\Windows\System\cYUJeoz.exe
  C:\Windows\System\cYUJeoz.exe
  2⤵
  PID:7796
- C:\Windows\System\vHXNeFa.exe
  C:\Windows\System\vHXNeFa.exe
  2⤵
  PID:7824
- C:\Windows\System\zKolBkU.exe
  C:\Windows\System\zKolBkU.exe
  2⤵
  PID:7852
- C:\Windows\System\BcGtHsA.exe
  C:\Windows\System\BcGtHsA.exe
  2⤵
  PID:7888
- C:\Windows\System\cwoIAEY.exe
  C:\Windows\System\cwoIAEY.exe
  2⤵
  PID:7916
- C:\Windows\System\uvMsQgf.exe
  C:\Windows\System\uvMsQgf.exe
  2⤵
  PID:7948
- C:\Windows\System\iQmkCtA.exe
  C:\Windows\System\iQmkCtA.exe
  2⤵
  PID:7984
- C:\Windows\System\UCTXlxA.exe
  C:\Windows\System\UCTXlxA.exe
  2⤵
  PID:8004
- C:\Windows\System\tlkxVmI.exe
  C:\Windows\System\tlkxVmI.exe
  2⤵
  PID:8036
- C:\Windows\System\EmqWeTP.exe
  C:\Windows\System\EmqWeTP.exe
  2⤵
  PID:8056
- C:\Windows\System\dafTnCX.exe
  C:\Windows\System\dafTnCX.exe
  2⤵
  PID:8080
- C:\Windows\System\bzgjfwG.exe
  C:\Windows\System\bzgjfwG.exe
  2⤵
  PID:8108
- C:\Windows\System\JQmVSEG.exe
  C:\Windows\System\JQmVSEG.exe
  2⤵
  PID:8132
- C:\Windows\System\OXeqkNP.exe
  C:\Windows\System\OXeqkNP.exe
  2⤵
  PID:8164
- C:\Windows\System\kiarBSK.exe
  C:\Windows\System\kiarBSK.exe
  2⤵
  PID:6960
- C:\Windows\System\HfteJWR.exe
  C:\Windows\System\HfteJWR.exe
  2⤵
  PID:6680
- C:\Windows\System\tjFiwox.exe
  C:\Windows\System\tjFiwox.exe
  2⤵
  PID:7252
- C:\Windows\System\gbXftTm.exe
  C:\Windows\System\gbXftTm.exe
  2⤵
  PID:7300
- C:\Windows\System\dVwcphx.exe
  C:\Windows\System\dVwcphx.exe
  2⤵
  PID:7396
- C:\Windows\System\BrakMpc.exe
  C:\Windows\System\BrakMpc.exe
  2⤵
  PID:7468
- C:\Windows\System\arowNUP.exe
  C:\Windows\System\arowNUP.exe
  2⤵
  PID:7528
- C:\Windows\System\ckqgBlX.exe
  C:\Windows\System\ckqgBlX.exe
  2⤵
  PID:7532
- C:\Windows\System\YcMPtwL.exe
  C:\Windows\System\YcMPtwL.exe
  2⤵
  PID:7644
- C:\Windows\System\RpNTTsu.exe
  C:\Windows\System\RpNTTsu.exe
  2⤵
  PID:7700
- C:\Windows\System\XjpromR.exe
  C:\Windows\System\XjpromR.exe
  2⤵
  PID:7736
- C:\Windows\System\sxCPDBu.exe
  C:\Windows\System\sxCPDBu.exe
  2⤵
  PID:7848
- C:\Windows\System\IFltSUE.exe
  C:\Windows\System\IFltSUE.exe
  2⤵
  PID:7908
- C:\Windows\System\vmkttAk.exe
  C:\Windows\System\vmkttAk.exe
  2⤵
  PID:7968
- C:\Windows\System\tzorPQS.exe
  C:\Windows\System\tzorPQS.exe
  2⤵
  PID:8020
- C:\Windows\System\kGBqKrY.exe
  C:\Windows\System\kGBqKrY.exe
  2⤵
  PID:8052
- C:\Windows\System\rvoCBEl.exe
  C:\Windows\System\rvoCBEl.exe
  2⤵
  PID:8152
- C:\Windows\System\xUpOEcm.exe
  C:\Windows\System\xUpOEcm.exe
  2⤵
  PID:7016
- C:\Windows\System\GgjBkrV.exe
  C:\Windows\System\GgjBkrV.exe
  2⤵
  PID:7280
- C:\Windows\System\owGLXkO.exe
  C:\Windows\System\owGLXkO.exe
  2⤵
  PID:7276
- C:\Windows\System\Zmrshuk.exe
  C:\Windows\System\Zmrshuk.exe
  2⤵
  PID:7616
- C:\Windows\System\ozXYpbQ.exe
  C:\Windows\System\ozXYpbQ.exe
  2⤵
  PID:7660
- C:\Windows\System\NofLGlV.exe
  C:\Windows\System\NofLGlV.exe
  2⤵
  PID:7756
- C:\Windows\System\nJMSCBn.exe
  C:\Windows\System\nJMSCBn.exe
  2⤵
  PID:8032
- C:\Windows\System\XMUNVQZ.exe
  C:\Windows\System\XMUNVQZ.exe
  2⤵
  PID:7972
- C:\Windows\System\eROOYew.exe
  C:\Windows\System\eROOYew.exe
  2⤵
  PID:7420
- C:\Windows\System\ldWhwgJ.exe
  C:\Windows\System\ldWhwgJ.exe
  2⤵
  PID:8144
- C:\Windows\System\gzoutLe.exe
  C:\Windows\System\gzoutLe.exe
  2⤵
  PID:8212
- C:\Windows\System\ShcnzQy.exe
  C:\Windows\System\ShcnzQy.exe
  2⤵
  PID:8244
- C:\Windows\System\ONHycVM.exe
  C:\Windows\System\ONHycVM.exe
  2⤵
  PID:8264
- C:\Windows\System\RuwANwr.exe
  C:\Windows\System\RuwANwr.exe
  2⤵
  PID:8292
- C:\Windows\System\FxeBTXh.exe
  C:\Windows\System\FxeBTXh.exe
  2⤵
  PID:8320
- C:\Windows\System\UPAQHRX.exe
  C:\Windows\System\UPAQHRX.exe
  2⤵
  PID:8352
- C:\Windows\System\gCAVETm.exe
  C:\Windows\System\gCAVETm.exe
  2⤵
  PID:8396
- C:\Windows\System\faMLlNr.exe
  C:\Windows\System\faMLlNr.exe
  2⤵
  PID:8436
- C:\Windows\System\lZYZrLs.exe
  C:\Windows\System\lZYZrLs.exe
  2⤵
  PID:8464
- C:\Windows\System\umMuuaR.exe
  C:\Windows\System\umMuuaR.exe
  2⤵
  PID:8488
- C:\Windows\System\VsflOAU.exe
  C:\Windows\System\VsflOAU.exe
  2⤵
  PID:8512
- C:\Windows\System\zfEZtrY.exe
  C:\Windows\System\zfEZtrY.exe
  2⤵
  PID:8528
- C:\Windows\System\wubElrI.exe
  C:\Windows\System\wubElrI.exe
  2⤵
  PID:8552
- C:\Windows\System\jvbmgzk.exe
  C:\Windows\System\jvbmgzk.exe
  2⤵
  PID:8584
- C:\Windows\System\LdwRQzm.exe
  C:\Windows\System\LdwRQzm.exe
  2⤵
  PID:8616
- C:\Windows\System\DrZjFuB.exe
  C:\Windows\System\DrZjFuB.exe
  2⤵
  PID:8652
- C:\Windows\System\lJoLKCa.exe
  C:\Windows\System\lJoLKCa.exe
  2⤵
  PID:8680
- C:\Windows\System\KhIIhEp.exe
  C:\Windows\System\KhIIhEp.exe
  2⤵
  PID:8704
- C:\Windows\System\clwVHbT.exe
  C:\Windows\System\clwVHbT.exe
  2⤵
  PID:8740
- C:\Windows\System\KXkyxQh.exe
  C:\Windows\System\KXkyxQh.exe
  2⤵
  PID:8764
- C:\Windows\System\GaNgGbH.exe
  C:\Windows\System\GaNgGbH.exe
  2⤵
  PID:8792
- C:\Windows\System\RlPzWJx.exe
  C:\Windows\System\RlPzWJx.exe
  2⤵
  PID:8820
- C:\Windows\System\UFHUYYK.exe
  C:\Windows\System\UFHUYYK.exe
  2⤵
  PID:8848
- C:\Windows\System\jczbFel.exe
  C:\Windows\System\jczbFel.exe
  2⤵
  PID:8876
- C:\Windows\System\rqBdiof.exe
  C:\Windows\System\rqBdiof.exe
  2⤵
  PID:8900
- C:\Windows\System\NjdRMlf.exe
  C:\Windows\System\NjdRMlf.exe
  2⤵
  PID:8924
- C:\Windows\System\rAphdfB.exe
  C:\Windows\System\rAphdfB.exe
  2⤵
  PID:8956
- C:\Windows\System\PxVDuSI.exe
  C:\Windows\System\PxVDuSI.exe
  2⤵
  PID:8984
- C:\Windows\System\KqQPEHg.exe
  C:\Windows\System\KqQPEHg.exe
  2⤵
  PID:9020
- C:\Windows\System\OMSKgOt.exe
  C:\Windows\System\OMSKgOt.exe
  2⤵
  PID:9036
- C:\Windows\System\AQzxcRx.exe
  C:\Windows\System\AQzxcRx.exe
  2⤵
  PID:9060
- C:\Windows\System\afmfUfh.exe
  C:\Windows\System\afmfUfh.exe
  2⤵
  PID:9088
- C:\Windows\System\daSkOsp.exe
  C:\Windows\System\daSkOsp.exe
  2⤵
  PID:9112
- C:\Windows\System\AgccQiZ.exe
  C:\Windows\System\AgccQiZ.exe
  2⤵
  PID:9136
- C:\Windows\System\iihwgfx.exe
  C:\Windows\System\iihwgfx.exe
  2⤵
  PID:9164
- C:\Windows\System\seGVKQt.exe
  C:\Windows\System\seGVKQt.exe
  2⤵
  PID:9188
- C:\Windows\System\elSJvMf.exe
  C:\Windows\System\elSJvMf.exe
  2⤵
  PID:6712
- C:\Windows\System\SMdkzOW.exe
  C:\Windows\System\SMdkzOW.exe
  2⤵
  PID:8092
- C:\Windows\System\CmasVXn.exe
  C:\Windows\System\CmasVXn.exe
  2⤵
  PID:8204
- C:\Windows\System\cgefYzR.exe
  C:\Windows\System\cgefYzR.exe
  2⤵
  PID:8224
- C:\Windows\System\HlwiDoa.exe
  C:\Windows\System\HlwiDoa.exe
  2⤵
  PID:8376
- C:\Windows\System\oHMsIhu.exe
  C:\Windows\System\oHMsIhu.exe
  2⤵
  PID:8328
- C:\Windows\System\ciEbIGl.exe
  C:\Windows\System\ciEbIGl.exe
  2⤵
  PID:8416
- C:\Windows\System\omFBZqf.exe
  C:\Windows\System\omFBZqf.exe
  2⤵
  PID:8544
- C:\Windows\System\GpCpUQs.exe
  C:\Windows\System\GpCpUQs.exe
  2⤵
  PID:8576
- C:\Windows\System\KfoDVDv.exe
  C:\Windows\System\KfoDVDv.exe
  2⤵
  PID:8628
- C:\Windows\System\fsPcUae.exe
  C:\Windows\System\fsPcUae.exe
  2⤵
  PID:8700
- C:\Windows\System\BLSYmVN.exe
  C:\Windows\System\BLSYmVN.exe
  2⤵
  PID:8728
- C:\Windows\System\OqEIkbc.exe
  C:\Windows\System\OqEIkbc.exe
  2⤵
  PID:8808
- C:\Windows\System\vcfqwSA.exe
  C:\Windows\System\vcfqwSA.exe
  2⤵
  PID:8932
- C:\Windows\System\cJgnWao.exe
  C:\Windows\System\cJgnWao.exe
  2⤵
  PID:8972
- C:\Windows\System\bvxxjdF.exe
  C:\Windows\System\bvxxjdF.exe
  2⤵
  PID:9004
- C:\Windows\System\iNeWzeX.exe
  C:\Windows\System\iNeWzeX.exe
  2⤵
  PID:9072
- C:\Windows\System\qzGdEpf.exe
  C:\Windows\System\qzGdEpf.exe
  2⤵
  PID:9152
- C:\Windows\System\CohSLuw.exe
  C:\Windows\System\CohSLuw.exe
  2⤵
  PID:9100
- C:\Windows\System\gJsiHJW.exe
  C:\Windows\System\gJsiHJW.exe
  2⤵
  PID:8252
- C:\Windows\System\uHQnNcQ.exe
  C:\Windows\System\uHQnNcQ.exe
  2⤵
  PID:8364
- C:\Windows\System\PubrRPi.exe
  C:\Windows\System\PubrRPi.exe
  2⤵
  PID:8460
- C:\Windows\System\zTVwtYV.exe
  C:\Windows\System\zTVwtYV.exe
  2⤵
  PID:8504
- C:\Windows\System\XGKXTtK.exe
  C:\Windows\System\XGKXTtK.exe
  2⤵
  PID:8724
- C:\Windows\System\BShruKR.exe
  C:\Windows\System\BShruKR.exe
  2⤵
  PID:8892
- C:\Windows\System\QcVLNLX.exe
  C:\Windows\System\QcVLNLX.exe
  2⤵
  PID:8912
- C:\Windows\System\naVzJVs.exe
  C:\Windows\System\naVzJVs.exe
  2⤵
  PID:8500
- C:\Windows\System\rGgYCvL.exe
  C:\Windows\System\rGgYCvL.exe
  2⤵
  PID:8844
- C:\Windows\System\EIifBjI.exe
  C:\Windows\System\EIifBjI.exe
  2⤵
  PID:8348
- C:\Windows\System\HBaubya.exe
  C:\Windows\System\HBaubya.exe
  2⤵
  PID:9220
- C:\Windows\System\QSVuqEe.exe
  C:\Windows\System\QSVuqEe.exe
  2⤵
  PID:9244
- C:\Windows\System\VXvjSIa.exe
  C:\Windows\System\VXvjSIa.exe
  2⤵
  PID:9272
- C:\Windows\System\iqQTDmh.exe
  C:\Windows\System\iqQTDmh.exe
  2⤵
  PID:9300
- C:\Windows\System\KHKQeBC.exe
  C:\Windows\System\KHKQeBC.exe
  2⤵
  PID:9328
- C:\Windows\System\JiawXqO.exe
  C:\Windows\System\JiawXqO.exe
  2⤵
  PID:9360
- C:\Windows\System\qqrWSHv.exe
  C:\Windows\System\qqrWSHv.exe
  2⤵
  PID:9380
- C:\Windows\System\ZTFBUBK.exe
  C:\Windows\System\ZTFBUBK.exe
  2⤵
  PID:9412
- C:\Windows\System\qDeGvai.exe
  C:\Windows\System\qDeGvai.exe
  2⤵
  PID:9444
- C:\Windows\System\NDItoeR.exe
  C:\Windows\System\NDItoeR.exe
  2⤵
  PID:9468
- C:\Windows\System\HzqbVfm.exe
  C:\Windows\System\HzqbVfm.exe
  2⤵
  PID:9496
- C:\Windows\System\hUzrwhS.exe
  C:\Windows\System\hUzrwhS.exe
  2⤵
  PID:9520
- C:\Windows\System\BuKrjnN.exe
  C:\Windows\System\BuKrjnN.exe
  2⤵
  PID:9544
- C:\Windows\System\NPlirtd.exe
  C:\Windows\System\NPlirtd.exe
  2⤵
  PID:9568
- C:\Windows\System\vTOdpeK.exe
  C:\Windows\System\vTOdpeK.exe
  2⤵
  PID:9604
- C:\Windows\System\LZgSnvi.exe
  C:\Windows\System\LZgSnvi.exe
  2⤵
  PID:9628
- C:\Windows\System\XNPfGEj.exe
  C:\Windows\System\XNPfGEj.exe
  2⤵
  PID:9656
- C:\Windows\System\FyyWYNC.exe
  C:\Windows\System\FyyWYNC.exe
  2⤵
  PID:9684
- C:\Windows\System\AvTHJsA.exe
  C:\Windows\System\AvTHJsA.exe
  2⤵
  PID:9708
- C:\Windows\System\BAFroCx.exe
  C:\Windows\System\BAFroCx.exe
  2⤵
  PID:9744
- C:\Windows\System\jbmFCNn.exe
  C:\Windows\System\jbmFCNn.exe
  2⤵
  PID:9764
- C:\Windows\System\MzsyhMe.exe
  C:\Windows\System\MzsyhMe.exe
  2⤵
  PID:9784
- C:\Windows\System\sUqWxDY.exe
  C:\Windows\System\sUqWxDY.exe
  2⤵
  PID:9816
- C:\Windows\System\vtKNXem.exe
  C:\Windows\System\vtKNXem.exe
  2⤵
  PID:9836
- C:\Windows\System\bTcIgip.exe
  C:\Windows\System\bTcIgip.exe
  2⤵
  PID:9864
- C:\Windows\System\LUDCjVc.exe
  C:\Windows\System\LUDCjVc.exe
  2⤵
  PID:9884
- C:\Windows\System\bIdkqcX.exe
  C:\Windows\System\bIdkqcX.exe
  2⤵
  PID:9904
- C:\Windows\System\vIuCnTU.exe
  C:\Windows\System\vIuCnTU.exe
  2⤵
  PID:9928
- C:\Windows\System\EIrMCSI.exe
  C:\Windows\System\EIrMCSI.exe
  2⤵
  PID:9960
- C:\Windows\System\ykMpOMS.exe
  C:\Windows\System\ykMpOMS.exe
  2⤵
  PID:9984
- C:\Windows\System\hgICwfb.exe
  C:\Windows\System\hgICwfb.exe
  2⤵
  PID:10012
- C:\Windows\System\pGJACQe.exe
  C:\Windows\System\pGJACQe.exe
  2⤵
  PID:10048
- C:\Windows\System\cmWZYir.exe
  C:\Windows\System\cmWZYir.exe
  2⤵
  PID:10072
- C:\Windows\System\cRRnyFy.exe
  C:\Windows\System\cRRnyFy.exe
  2⤵
  PID:10100
- C:\Windows\System\QCwvwMn.exe
  C:\Windows\System\QCwvwMn.exe
  2⤵
  PID:10124
- C:\Windows\System\ItPipcO.exe
  C:\Windows\System\ItPipcO.exe
  2⤵
  PID:10148
- C:\Windows\System\DadjKZc.exe
  C:\Windows\System\DadjKZc.exe
  2⤵
  PID:10172
- C:\Windows\System\yHEFHhl.exe
  C:\Windows\System\yHEFHhl.exe
  2⤵
  PID:10192
- C:\Windows\System\OOfUhkA.exe
  C:\Windows\System\OOfUhkA.exe
  2⤵
  PID:10220
- C:\Windows\System\HvYSCjg.exe
  C:\Windows\System\HvYSCjg.exe
  2⤵
  PID:8200
- C:\Windows\System\gbpMXFr.exe
  C:\Windows\System\gbpMXFr.exe
  2⤵
  PID:9096
- C:\Windows\System\ihlAQVO.exe
  C:\Windows\System\ihlAQVO.exe
  2⤵
  PID:8208
- C:\Windows\System\qHMccEe.exe
  C:\Windows\System\qHMccEe.exe
  2⤵
  PID:9352
- C:\Windows\System\BQTKhEc.exe
  C:\Windows\System\BQTKhEc.exe
  2⤵
  PID:9312
- C:\Windows\System\abDZeUd.exe
  C:\Windows\System\abDZeUd.exe
  2⤵
  PID:9372
- C:\Windows\System\SIDdYgZ.exe
  C:\Windows\System\SIDdYgZ.exe
  2⤵
  PID:9396
- C:\Windows\System\izmygyT.exe
  C:\Windows\System\izmygyT.exe
  2⤵
  PID:9484
- C:\Windows\System\rswlKzK.exe
  C:\Windows\System\rswlKzK.exe
  2⤵
  PID:9508
- C:\Windows\System\fYHKcgU.exe
  C:\Windows\System\fYHKcgU.exe
  2⤵
  PID:9740
- C:\Windows\System\tUBKHPB.exe
  C:\Windows\System\tUBKHPB.exe
  2⤵
  PID:9780
- C:\Windows\System\uiTWpqA.exe
  C:\Windows\System\uiTWpqA.exe
  2⤵
  PID:9824
- C:\Windows\System\AGqoKUy.exe
  C:\Windows\System\AGqoKUy.exe
  2⤵
  PID:9776
- C:\Windows\System\jUvJUkw.exe
  C:\Windows\System\jUvJUkw.exe
  2⤵
  PID:10000
- C:\Windows\System\wHfRwny.exe
  C:\Windows\System\wHfRwny.exe
  2⤵
  PID:10040
- C:\Windows\System\IHAsHBY.exe
  C:\Windows\System\IHAsHBY.exe
  2⤵
  PID:10092
- C:\Windows\System\yWhIJas.exe
  C:\Windows\System\yWhIJas.exe
  2⤵
  PID:10144
- C:\Windows\System\utRufws.exe
  C:\Windows\System\utRufws.exe
  2⤵
  PID:10232
- C:\Windows\System\ATzyaGI.exe
  C:\Windows\System\ATzyaGI.exe
  2⤵
  PID:9228
- C:\Windows\System\FXemzhw.exe
  C:\Windows\System\FXemzhw.exe
  2⤵
  PID:10112
- C:\Windows\System\BMAjYsn.exe
  C:\Windows\System\BMAjYsn.exe
  2⤵
  PID:7956
- C:\Windows\System\zNFpKzK.exe
  C:\Windows\System\zNFpKzK.exe
  2⤵
  PID:9736
- C:\Windows\System\pGZfgtx.exe
  C:\Windows\System\pGZfgtx.exe
  2⤵
  PID:10020
- C:\Windows\System\csxjwLq.exe
  C:\Windows\System\csxjwLq.exe
  2⤵
  PID:9760
- C:\Windows\System\AmXkSiH.exe
  C:\Windows\System\AmXkSiH.exe
  2⤵
  PID:10064
- C:\Windows\System\tnlwGce.exe
  C:\Windows\System\tnlwGce.exe
  2⤵
  PID:10260
- C:\Windows\System\RMcnRBp.exe
  C:\Windows\System\RMcnRBp.exe
  2⤵
  PID:10292
- C:\Windows\System\ZqcNiLg.exe
  C:\Windows\System\ZqcNiLg.exe
  2⤵
  PID:10324
- C:\Windows\System\LuokaKU.exe
  C:\Windows\System\LuokaKU.exe
  2⤵
  PID:10340
- C:\Windows\System\hYSBVOK.exe
  C:\Windows\System\hYSBVOK.exe
  2⤵
  PID:10372
- C:\Windows\System\bZtTNOO.exe
  C:\Windows\System\bZtTNOO.exe
  2⤵
  PID:10396
- C:\Windows\System\vBiCXjo.exe
  C:\Windows\System\vBiCXjo.exe
  2⤵
  PID:10424
- C:\Windows\System\XpFdKtA.exe
  C:\Windows\System\XpFdKtA.exe
  2⤵
  PID:10452
- C:\Windows\System\SyWWPST.exe
  C:\Windows\System\SyWWPST.exe
  2⤵
  PID:10620
- C:\Windows\System\YGZbfeE.exe
  C:\Windows\System\YGZbfeE.exe
  2⤵
  PID:10660
- C:\Windows\System\IdOcEjD.exe
  C:\Windows\System\IdOcEjD.exe
  2⤵
  PID:10708
- C:\Windows\System\nkFFtqg.exe
  C:\Windows\System\nkFFtqg.exe
  2⤵
  PID:10736
- C:\Windows\System\HxKliuE.exe
  C:\Windows\System\HxKliuE.exe
  2⤵
  PID:10752
- C:\Windows\System\kDAjHMp.exe
  C:\Windows\System\kDAjHMp.exe
  2⤵
  PID:10784
- C:\Windows\System\BkuAegN.exe
  C:\Windows\System\BkuAegN.exe
  2⤵
  PID:10800
- C:\Windows\System\ThiWJWE.exe
  C:\Windows\System\ThiWJWE.exe
  2⤵
  PID:10820
- C:\Windows\System\tmHYaEt.exe
  C:\Windows\System\tmHYaEt.exe
  2⤵
  PID:10844
- C:\Windows\System\hAkEiEq.exe
  C:\Windows\System\hAkEiEq.exe
  2⤵
  PID:10860
- C:\Windows\System\AEQARlr.exe
  C:\Windows\System\AEQARlr.exe
  2⤵
  PID:10892
- C:\Windows\System\jcExZBM.exe
  C:\Windows\System\jcExZBM.exe
  2⤵
  PID:10916
- C:\Windows\System\LpNcXrS.exe
  C:\Windows\System\LpNcXrS.exe
  2⤵
  PID:10936
- C:\Windows\System\MrmPyku.exe
  C:\Windows\System\MrmPyku.exe
  2⤵
  PID:10968
- C:\Windows\System\MfkmFSi.exe
  C:\Windows\System\MfkmFSi.exe
  2⤵
  PID:11000
- C:\Windows\System\QoPzNxu.exe
  C:\Windows\System\QoPzNxu.exe
  2⤵
  PID:11028
- C:\Windows\System\PtNGwnT.exe
  C:\Windows\System\PtNGwnT.exe
  2⤵
  PID:11056
- C:\Windows\System\qwlpmss.exe
  C:\Windows\System\qwlpmss.exe
  2⤵
  PID:11080
- C:\Windows\System\kmOxdub.exe
  C:\Windows\System\kmOxdub.exe
  2⤵
  PID:11108
- C:\Windows\System\JDOTdmk.exe
  C:\Windows\System\JDOTdmk.exe
  2⤵
  PID:11136
- C:\Windows\System\VJzfOrd.exe
  C:\Windows\System\VJzfOrd.exe
  2⤵
  PID:11164
- C:\Windows\System\AzkcObu.exe
  C:\Windows\System\AzkcObu.exe
  2⤵
  PID:11196
- C:\Windows\System\LxxrpEI.exe
  C:\Windows\System\LxxrpEI.exe
  2⤵
  PID:11220
- C:\Windows\System\kifIjxM.exe
  C:\Windows\System\kifIjxM.exe
  2⤵
  PID:11240
- C:\Windows\System\MlCAKCg.exe
  C:\Windows\System\MlCAKCg.exe
  2⤵
  PID:9324
- C:\Windows\System\INJrlpc.exe
  C:\Windows\System\INJrlpc.exe
  2⤵
  PID:10140
- C:\Windows\System\MQDkavc.exe
  C:\Windows\System\MQDkavc.exe
  2⤵
  PID:10268
- C:\Windows\System\eodHxYO.exe
  C:\Windows\System\eodHxYO.exe
  2⤵
  PID:10036
- C:\Windows\System\mUXSSSw.exe
  C:\Windows\System\mUXSSSw.exe
  2⤵
  PID:9480
- C:\Windows\System\yLIWkSm.exe
  C:\Windows\System\yLIWkSm.exe
  2⤵
  PID:9916
- C:\Windows\System\HEXbvvH.exe
  C:\Windows\System\HEXbvvH.exe
  2⤵
  PID:10364
- C:\Windows\System\rBYSmcb.exe
  C:\Windows\System\rBYSmcb.exe
  2⤵
  PID:10464
- C:\Windows\System\oRIHEZA.exe
  C:\Windows\System\oRIHEZA.exe
  2⤵
  PID:10628
- C:\Windows\System\iwqeJum.exe
  C:\Windows\System\iwqeJum.exe
  2⤵
  PID:10668
- C:\Windows\System\JeUviKF.exe
  C:\Windows\System\JeUviKF.exe
  2⤵
  PID:10352
- C:\Windows\System\JZmpavw.exe
  C:\Windows\System\JZmpavw.exe
  2⤵
  PID:10780
- C:\Windows\System\cOeUbnV.exe
  C:\Windows\System\cOeUbnV.exe
  2⤵
  PID:10832
- C:\Windows\System\JjwamfA.exe
  C:\Windows\System\JjwamfA.exe
  2⤵
  PID:10716
- C:\Windows\System\SIKePhH.exe
  C:\Windows\System\SIKePhH.exe
  2⤵
  PID:10932
- C:\Windows\System\DyVogBL.exe
  C:\Windows\System\DyVogBL.exe
  2⤵
  PID:11020
- C:\Windows\System\jXUaXuL.exe
  C:\Windows\System\jXUaXuL.exe
  2⤵
  PID:11092
- C:\Windows\System\wkdSVBM.exe
  C:\Windows\System\wkdSVBM.exe
  2⤵
  PID:11132
- C:\Windows\System\SKLaaTv.exe
  C:\Windows\System\SKLaaTv.exe
  2⤵
  PID:10208
- C:\Windows\System\jJHGQnE.exe
  C:\Windows\System\jJHGQnE.exe
  2⤵
  PID:11192
- C:\Windows\System\rUoTBdZ.exe
  C:\Windows\System\rUoTBdZ.exe
  2⤵
  PID:9952
- C:\Windows\System\zcCTPxX.exe
  C:\Windows\System\zcCTPxX.exe
  2⤵
  PID:9892
- C:\Windows\System\btQnwul.exe
  C:\Windows\System\btQnwul.exe
  2⤵
  PID:10356
- C:\Windows\System\RGaGVHt.exe
  C:\Windows\System\RGaGVHt.exe
  2⤵
  PID:10612
- C:\Windows\System\VKITLOi.exe
  C:\Windows\System\VKITLOi.exe
  2⤵
  PID:10684
- C:\Windows\System\QnZRHXR.exe
  C:\Windows\System\QnZRHXR.exe
  2⤵
  PID:10792
- C:\Windows\System\oFQNlVo.exe
  C:\Windows\System\oFQNlVo.exe
  2⤵
  PID:10900
- C:\Windows\System\ppcqRVR.exe
  C:\Windows\System\ppcqRVR.exe
  2⤵
  PID:10596
- C:\Windows\System\yJBtUmo.exe
  C:\Windows\System\yJBtUmo.exe
  2⤵
  PID:11188
- C:\Windows\System\XjPOywB.exe
  C:\Windows\System\XjPOywB.exe
  2⤵
  PID:10964
- C:\Windows\System\zdSoreA.exe
  C:\Windows\System\zdSoreA.exe
  2⤵
  PID:10908
- C:\Windows\System\uUPEHSo.exe
  C:\Windows\System\uUPEHSo.exe
  2⤵
  PID:10332
- C:\Windows\System\TDOxQiV.exe
  C:\Windows\System\TDOxQiV.exe
  2⤵
  PID:11276
- C:\Windows\System\dtGOQAH.exe
  C:\Windows\System\dtGOQAH.exe
  2⤵
  PID:11308
- C:\Windows\System\WvGiIfN.exe
  C:\Windows\System\WvGiIfN.exe
  2⤵
  PID:11328
- C:\Windows\System\OYisTaf.exe
  C:\Windows\System\OYisTaf.exe
  2⤵
  PID:11360
- C:\Windows\System\MgbaRCQ.exe
  C:\Windows\System\MgbaRCQ.exe
  2⤵
  PID:11384
- C:\Windows\System\SdithSR.exe
  C:\Windows\System\SdithSR.exe
  2⤵
  PID:11412
- C:\Windows\System\nFIPlxO.exe
  C:\Windows\System\nFIPlxO.exe
  2⤵
  PID:11432
- C:\Windows\System\XLFCgzx.exe
  C:\Windows\System\XLFCgzx.exe
  2⤵
  PID:11464
- C:\Windows\System\uYIkOKr.exe
  C:\Windows\System\uYIkOKr.exe
  2⤵
  PID:11484
- C:\Windows\System\CdaRrsk.exe
  C:\Windows\System\CdaRrsk.exe
  2⤵
  PID:11512
- C:\Windows\System\ZdXsxDI.exe
  C:\Windows\System\ZdXsxDI.exe
  2⤵
  PID:11552
- C:\Windows\System\ViNiEom.exe
  C:\Windows\System\ViNiEom.exe
  2⤵
  PID:11588
- C:\Windows\System\zhYQGiR.exe
  C:\Windows\System\zhYQGiR.exe
  2⤵
  PID:11604
- C:\Windows\System\bdsKTCY.exe
  C:\Windows\System\bdsKTCY.exe
  2⤵
  PID:11628
- C:\Windows\System\iwKAnti.exe
  C:\Windows\System\iwKAnti.exe
  2⤵
  PID:11644
- C:\Windows\System\ahNEfLP.exe
  C:\Windows\System\ahNEfLP.exe
  2⤵
  PID:11684
- C:\Windows\System\kaGRcIO.exe
  C:\Windows\System\kaGRcIO.exe
  2⤵
  PID:11708
- C:\Windows\System\XNuaEeH.exe
  C:\Windows\System\XNuaEeH.exe
  2⤵
  PID:11736
- C:\Windows\System\kQjQPWN.exe
  C:\Windows\System\kQjQPWN.exe
  2⤵
  PID:11756
- C:\Windows\System\TmrmQrS.exe
  C:\Windows\System\TmrmQrS.exe
  2⤵
  PID:11788
- C:\Windows\System\eILgsbO.exe
  C:\Windows\System\eILgsbO.exe
  2⤵
  PID:11808
- C:\Windows\System\BdLnRbZ.exe
  C:\Windows\System\BdLnRbZ.exe
  2⤵
  PID:11828
- C:\Windows\System\LLawSGJ.exe
  C:\Windows\System\LLawSGJ.exe
  2⤵
  PID:11852
- C:\Windows\System\xLohXLw.exe
  C:\Windows\System\xLohXLw.exe
  2⤵
  PID:11880
- C:\Windows\System\SoznCYB.exe
  C:\Windows\System\SoznCYB.exe
  2⤵
  PID:11904
- C:\Windows\System\vgvEOSp.exe
  C:\Windows\System\vgvEOSp.exe
  2⤵
  PID:11924
- C:\Windows\System\VVElvUF.exe
  C:\Windows\System\VVElvUF.exe
  2⤵
  PID:11960
- C:\Windows\System\rdzAVCj.exe
  C:\Windows\System\rdzAVCj.exe
  2⤵
  PID:11980
- C:\Windows\System\JhfMqPz.exe
  C:\Windows\System\JhfMqPz.exe
  2⤵
  PID:11996
- C:\Windows\System\mDAbBbO.exe
  C:\Windows\System\mDAbBbO.exe
  2⤵
  PID:12032
- C:\Windows\System\YjxwiUK.exe
  C:\Windows\System\YjxwiUK.exe
  2⤵
  PID:12052
- C:\Windows\System\qCaCJVw.exe
  C:\Windows\System\qCaCJVw.exe
  2⤵
  PID:12080
- C:\Windows\System\ciYDgqJ.exe
  C:\Windows\System\ciYDgqJ.exe
  2⤵
  PID:12104
- C:\Windows\System\XcVAxQY.exe
  C:\Windows\System\XcVAxQY.exe
  2⤵
  PID:12148
- C:\Windows\System\aAcNxwy.exe
  C:\Windows\System\aAcNxwy.exe
  2⤵
  PID:12168
- C:\Windows\System\QlpjAgs.exe
  C:\Windows\System\QlpjAgs.exe
  2⤵
  PID:12188
- C:\Windows\System\DfSaGQZ.exe
  C:\Windows\System\DfSaGQZ.exe
  2⤵
  PID:12220
- C:\Windows\System\vYCqjAL.exe
  C:\Windows\System\vYCqjAL.exe
  2⤵
  PID:11352
- C:\Windows\System\OtnLBVt.exe
  C:\Windows\System\OtnLBVt.exe
  2⤵
  PID:11480
- C:\Windows\System\dDPUPTl.exe
  C:\Windows\System\dDPUPTl.exe
  2⤵
  PID:11544
- C:\Windows\System\hChhwyR.exe
  C:\Windows\System\hChhwyR.exe
  2⤵
  PID:11152
- C:\Windows\System\dfakLlX.exe
  C:\Windows\System\dfakLlX.exe
  2⤵
  PID:11420
- C:\Windows\System\MvCITZD.exe
  C:\Windows\System\MvCITZD.exe
  2⤵
  PID:11428
- C:\Windows\System\iUfIZDj.exe
  C:\Windows\System\iUfIZDj.exe
  2⤵
  PID:11372
- C:\Windows\System\iGNftJL.exe
  C:\Windows\System\iGNftJL.exe
  2⤵
  PID:11816
- C:\Windows\System\otDZmND.exe
  C:\Windows\System\otDZmND.exe
  2⤵
  PID:11696
- C:\Windows\System\kUpvuDJ.exe
  C:\Windows\System\kUpvuDJ.exe
  2⤵
  PID:11952
- C:\Windows\System\VopgPZd.exe
  C:\Windows\System\VopgPZd.exe
  2⤵
  PID:11780
- C:\Windows\System\oILodYy.exe
  C:\Windows\System\oILodYy.exe
  2⤵
  PID:12072
- C:\Windows\System\WjpMwSU.exe
  C:\Windows\System\WjpMwSU.exe
  2⤵
  PID:12252
- C:\Windows\System\qtkxhkN.exe
  C:\Windows\System\qtkxhkN.exe
  2⤵
  PID:11892
- C:\Windows\System\vjhmhGh.exe
  C:\Windows\System\vjhmhGh.exe
  2⤵
  PID:11920
- C:\Windows\System\hUcGSxV.exe
  C:\Windows\System\hUcGSxV.exe
  2⤵
  PID:12176
- C:\Windows\System\efTlynI.exe
  C:\Windows\System\efTlynI.exe
  2⤵
  PID:12212
- C:\Windows\System\drQrhaG.exe
  C:\Windows\System\drQrhaG.exe
  2⤵
  PID:12236
- C:\Windows\System\jdyxRBL.exe
  C:\Windows\System\jdyxRBL.exe
  2⤵
  PID:11336
- C:\Windows\System\WldIvTv.exe
  C:\Windows\System\WldIvTv.exe
  2⤵
  PID:11376
- C:\Windows\System\rfDKNVU.exe
  C:\Windows\System\rfDKNVU.exe
  2⤵
  PID:11472
- C:\Windows\System\kWLGaSF.exe
  C:\Windows\System\kWLGaSF.exe
  2⤵
  PID:11988
- C:\Windows\System\FcyUNjf.exe
  C:\Windows\System\FcyUNjf.exe
  2⤵
  PID:12164
- C:\Windows\System\PeoXenr.exe
  C:\Windows\System\PeoXenr.exe
  2⤵
  PID:12132
- C:\Windows\System\eDvgOgE.exe
  C:\Windows\System\eDvgOgE.exe
  2⤵
  PID:12312
- C:\Windows\System\NLnWLTm.exe
  C:\Windows\System\NLnWLTm.exe
  2⤵
  PID:12344
- C:\Windows\System\navshxP.exe
  C:\Windows\System\navshxP.exe
  2⤵
  PID:12368
- C:\Windows\System\etMmZEU.exe
  C:\Windows\System\etMmZEU.exe
  2⤵
  PID:12396
- C:\Windows\System\HnXFAtu.exe
  C:\Windows\System\HnXFAtu.exe
  2⤵
  PID:12424
- C:\Windows\System\vLCmVou.exe
  C:\Windows\System\vLCmVou.exe
  2⤵
  PID:12448
- C:\Windows\System\dsNQvCe.exe
  C:\Windows\System\dsNQvCe.exe
  2⤵
  PID:12464
- C:\Windows\System\VgjViQc.exe
  C:\Windows\System\VgjViQc.exe
  2⤵
  PID:12488
- C:\Windows\System\NIIHoKM.exe
  C:\Windows\System\NIIHoKM.exe
  2⤵
  PID:12512
- C:\Windows\System\ipSyfCf.exe
  C:\Windows\System\ipSyfCf.exe
  2⤵
  PID:12548
- C:\Windows\System\HiMlPzz.exe
  C:\Windows\System\HiMlPzz.exe
  2⤵
  PID:12584
- C:\Windows\System\UnrpfLQ.exe
  C:\Windows\System\UnrpfLQ.exe
  2⤵
  PID:12608
- C:\Windows\System\XRLkfca.exe
  C:\Windows\System\XRLkfca.exe
  2⤵
  PID:12624
- C:\Windows\System\OfOzEbY.exe
  C:\Windows\System\OfOzEbY.exe
  2⤵
  PID:12644
- C:\Windows\System\YDLqPlv.exe
  C:\Windows\System\YDLqPlv.exe
  2⤵
  PID:12668
- C:\Windows\System\RFHVecb.exe
  C:\Windows\System\RFHVecb.exe
  2⤵
  PID:12688
- C:\Windows\System\YRCthdO.exe
  C:\Windows\System\YRCthdO.exe
  2⤵
  PID:12728
- C:\Windows\System\NRRBwjA.exe
  C:\Windows\System\NRRBwjA.exe
  2⤵
  PID:12748
- C:\Windows\System\TlHKmaU.exe
  C:\Windows\System\TlHKmaU.exe
  2⤵
  PID:12772
- C:\Windows\System\zEBqlpf.exe
  C:\Windows\System\zEBqlpf.exe
  2⤵
  PID:12796
- C:\Windows\System\YHMmDVv.exe
  C:\Windows\System\YHMmDVv.exe
  2⤵
  PID:12824
- C:\Windows\System\AufrkbD.exe
  C:\Windows\System\AufrkbD.exe
  2⤵
  PID:12856
- C:\Windows\System\Hztayqf.exe
  C:\Windows\System\Hztayqf.exe
  2⤵
  PID:12876
- C:\Windows\System\MeFZpyZ.exe
  C:\Windows\System\MeFZpyZ.exe
  2⤵
  PID:12908
- C:\Windows\System\OpUyujs.exe
  C:\Windows\System\OpUyujs.exe
  2⤵
  PID:12936
- C:\Windows\System\MXwvMZN.exe
  C:\Windows\System\MXwvMZN.exe
  2⤵
  PID:12960
- C:\Windows\System\snoRKWr.exe
  C:\Windows\System\snoRKWr.exe
  2⤵
  PID:12980
- C:\Windows\System\jmDjemu.exe
  C:\Windows\System\jmDjemu.exe
  2⤵
  PID:12996
- C:\Windows\System\fEQRGJR.exe
  C:\Windows\System\fEQRGJR.exe
  2⤵
  PID:13020
- C:\Windows\System\jfggXCg.exe
  C:\Windows\System\jfggXCg.exe
  2⤵
  PID:13060
- C:\Windows\System\uFascJz.exe
  C:\Windows\System\uFascJz.exe
  2⤵
  PID:13088
- C:\Windows\System\PSOuaRn.exe
  C:\Windows\System\PSOuaRn.exe
  2⤵
  PID:13112
- C:\Windows\System\CWaEbLh.exe
  C:\Windows\System\CWaEbLh.exe
  2⤵
  PID:13132
- C:\Windows\System\HdKHYyh.exe
  C:\Windows\System\HdKHYyh.exe
  2⤵
  PID:13160
- C:\Windows\System\CykNHip.exe
  C:\Windows\System\CykNHip.exe
  2⤵
  PID:13184
- C:\Windows\System\uhDRfiy.exe
  C:\Windows\System\uhDRfiy.exe
  2⤵
  PID:13204
- C:\Windows\System\BIxaJku.exe
  C:\Windows\System\BIxaJku.exe
  2⤵
  PID:13224
- C:\Windows\System\fLHVoon.exe
  C:\Windows\System\fLHVoon.exe
  2⤵
  PID:13252
- C:\Windows\System\rYHCGwH.exe
  C:\Windows\System\rYHCGwH.exe
  2⤵
  PID:13280
- C:\Windows\System\gdUorpL.exe
  C:\Windows\System\gdUorpL.exe
  2⤵
  PID:13308
- C:\Windows\System\hklIaqg.exe
  C:\Windows\System\hklIaqg.exe
  2⤵
  PID:11848
- C:\Windows\System\YLTkzgw.exe
  C:\Windows\System\YLTkzgw.exe
  2⤵
  PID:11824
- C:\Windows\System\RmuMoEH.exe
  C:\Windows\System\RmuMoEH.exe
  2⤵
  PID:11940
- C:\Windows\System\jErKSyh.exe
  C:\Windows\System\jErKSyh.exe
  2⤵
  PID:12388
- C:\Windows\System\Pzzsaia.exe
  C:\Windows\System\Pzzsaia.exe
  2⤵
  PID:12420
- C:\Windows\System\MWeZOja.exe
  C:\Windows\System\MWeZOja.exe
  2⤵
  PID:12184
- C:\Windows\System\DmtJyLC.exe
  C:\Windows\System\DmtJyLC.exe
  2⤵
  PID:10700
- C:\Windows\System\eOPAkIG.exe
  C:\Windows\System\eOPAkIG.exe
  2⤵
  PID:12568
- C:\Windows\System\NQgnNkx.exe
  C:\Windows\System\NQgnNkx.exe
  2⤵
  PID:11672
- C:\Windows\System\lxBxyCg.exe
  C:\Windows\System\lxBxyCg.exe
  2⤵
  PID:12532
- C:\Windows\System\WPVRqnl.exe
  C:\Windows\System\WPVRqnl.exe
  2⤵
  PID:12740
- C:\Windows\System\yjYClmN.exe
  C:\Windows\System\yjYClmN.exe
  2⤵
  PID:12596
- C:\Windows\System\aLYyHpS.exe
  C:\Windows\System\aLYyHpS.exe
  2⤵
  PID:12896
- C:\Windows\System\bOjEntP.exe
  C:\Windows\System\bOjEntP.exe
  2⤵
  PID:12928
- C:\Windows\System\XaaqgtH.exe
  C:\Windows\System\XaaqgtH.exe
  2⤵
  PID:12956
- C:\Windows\System\GdomEOy.exe
  C:\Windows\System\GdomEOy.exe
  2⤵
  PID:13076
- C:\Windows\System\BxuJmZQ.exe
  C:\Windows\System\BxuJmZQ.exe
  2⤵
  PID:12972
- C:\Windows\System\uZsIjYm.exe
  C:\Windows\System\uZsIjYm.exe
  2⤵
  PID:13196
- C:\Windows\System\PtWqvSf.exe
  C:\Windows\System\PtWqvSf.exe
  2⤵
  PID:13056
- C:\Windows\System\iiEQddw.exe
  C:\Windows\System\iiEQddw.exe
  2⤵
  PID:12916
- C:\Windows\System\gcwHMiY.exe
  C:\Windows\System\gcwHMiY.exe
  2⤵
  PID:13212
- C:\Windows\System\MdMPqmp.exe
  C:\Windows\System\MdMPqmp.exe
  2⤵
  PID:12364
- C:\Windows\System\mJCWPRc.exe
  C:\Windows\System\mJCWPRc.exe
  2⤵
  PID:13340
- C:\Windows\System\SfbBdGX.exe
  C:\Windows\System\SfbBdGX.exe
  2⤵
  PID:13360
- C:\Windows\System\uhkhhwY.exe
  C:\Windows\System\uhkhhwY.exe
  2⤵
  PID:13400
- C:\Windows\System\tNDJzSf.exe
  C:\Windows\System\tNDJzSf.exe
  2⤵
  PID:13420
- C:\Windows\System\qBXxHyn.exe
  C:\Windows\System\qBXxHyn.exe
  2⤵
  PID:13452
- C:\Windows\System\iqIBovj.exe
  C:\Windows\System\iqIBovj.exe
  2⤵
  PID:13476
- C:\Windows\System\wVxSEcC.exe
  C:\Windows\System\wVxSEcC.exe
  2⤵
  PID:13492
- C:\Windows\System\hMPtVoX.exe
  C:\Windows\System\hMPtVoX.exe
  2⤵
  PID:13512
- C:\Windows\System\MxhaSWI.exe
  C:\Windows\System\MxhaSWI.exe
  2⤵
  PID:13544
- C:\Windows\System\MVDCjku.exe
  C:\Windows\System\MVDCjku.exe
  2⤵
  PID:13564
- C:\Windows\System\lpIHlOa.exe
  C:\Windows\System\lpIHlOa.exe
  2⤵
  PID:13592
- C:\Windows\System\zFjtKgU.exe
  C:\Windows\System\zFjtKgU.exe
  2⤵
  PID:13616
- C:\Windows\System\JIbxeef.exe
  C:\Windows\System\JIbxeef.exe
  2⤵
  PID:13648
- C:\Windows\System\ydYaGjf.exe
  C:\Windows\System\ydYaGjf.exe
  2⤵
  PID:13668
- C:\Windows\System\OoWlDaS.exe
  C:\Windows\System\OoWlDaS.exe
  2⤵
  PID:13696
- C:\Windows\System\BUGmvAw.exe
  C:\Windows\System\BUGmvAw.exe
  2⤵
  PID:13712
- C:\Windows\System\fhaxrrg.exe
  C:\Windows\System\fhaxrrg.exe
  2⤵
  PID:13736
- C:\Windows\System\rdhmDVP.exe
  C:\Windows\System\rdhmDVP.exe
  2⤵
  PID:13768
- C:\Windows\System\EwWDJzM.exe
  C:\Windows\System\EwWDJzM.exe
  2⤵
  PID:13796
- C:\Windows\System\YiskHUQ.exe
  C:\Windows\System\YiskHUQ.exe
  2⤵
  PID:13816
- C:\Windows\System\rJYuujP.exe
  C:\Windows\System\rJYuujP.exe
  2⤵
  PID:13836
- C:\Windows\System\nkDFBtA.exe
  C:\Windows\System\nkDFBtA.exe
  2⤵
  PID:13852
- C:\Windows\System\vxNfnrY.exe
  C:\Windows\System\vxNfnrY.exe
  2⤵
  PID:13884
- C:\Windows\System\JtZFPJx.exe
  C:\Windows\System\JtZFPJx.exe
  2⤵
  PID:13908
- C:\Windows\System\gRsyiyE.exe
  C:\Windows\System\gRsyiyE.exe
  2⤵
  PID:13924
- C:\Windows\System\clDzQWp.exe
  C:\Windows\System\clDzQWp.exe
  2⤵
  PID:13948
- C:\Windows\System\EPAoSjy.exe
  C:\Windows\System\EPAoSjy.exe
  2⤵
  PID:13968
- C:\Windows\System\wbhmSeU.exe
  C:\Windows\System\wbhmSeU.exe
  2⤵
  PID:13992
- C:\Windows\System\liguekA.exe
  C:\Windows\System\liguekA.exe
  2⤵
  PID:14016
- C:\Windows\System\ACcOWsy.exe
  C:\Windows\System\ACcOWsy.exe
  2⤵
  PID:14040
- C:\Windows\System\mJtDnXK.exe
  C:\Windows\System\mJtDnXK.exe
  2⤵
  PID:14068
- C:\Windows\System\qjySqZh.exe
  C:\Windows\System\qjySqZh.exe
  2⤵
  PID:14092
- C:\Windows\System\mvuTVlG.exe
  C:\Windows\System\mvuTVlG.exe
  2⤵
  PID:14112
- C:\Windows\System\YblAbZc.exe
  C:\Windows\System\YblAbZc.exe
  2⤵
  PID:14148
- C:\Windows\System\yTiVPGw.exe
  C:\Windows\System\yTiVPGw.exe
  2⤵
  PID:14168
- C:\Windows\System\ZnSCXCD.exe
  C:\Windows\System\ZnSCXCD.exe
  2⤵
  PID:14204
- C:\Windows\System\pOBdGyk.exe
  C:\Windows\System\pOBdGyk.exe
  2⤵
  PID:14228
- C:\Windows\System\gzkeSGL.exe
  C:\Windows\System\gzkeSGL.exe
  2⤵
  PID:14252
- C:\Windows\System\VMwldOR.exe
  C:\Windows\System\VMwldOR.exe
  2⤵
  PID:14276
- C:\Windows\System\GPLLtwP.exe
  C:\Windows\System\GPLLtwP.exe
  2⤵
  PID:14300
- C:\Windows\System\XNLoWEh.exe
  C:\Windows\System\XNLoWEh.exe
  2⤵
  PID:14316
- C:\Windows\System\rctnxok.exe
  C:\Windows\System\rctnxok.exe
  2⤵
  PID:12636
- C:\Windows\System\DWOuCQM.exe
  C:\Windows\System\DWOuCQM.exe
  2⤵
  PID:13180
- C:\Windows\System\kWeifOM.exe
  C:\Windows\System\kWeifOM.exe
  2⤵
  PID:12524
- C:\Windows\System\VwhQeoI.exe
  C:\Windows\System\VwhQeoI.exe
  2⤵
  PID:12944
- C:\Windows\System\dxjuHLg.exe
  C:\Windows\System\dxjuHLg.exe
  2⤵
  PID:11596
- C:\Windows\System\fqOCNtS.exe
  C:\Windows\System\fqOCNtS.exe
  2⤵
  PID:12440
- C:\Windows\System\Ngrlnmz.exe
  C:\Windows\System\Ngrlnmz.exe
  2⤵
  PID:13348
- C:\Windows\System\IZduaTt.exe
  C:\Windows\System\IZduaTt.exe
  2⤵
  PID:12564
- C:\Windows\System\UpVyvur.exe
  C:\Windows\System\UpVyvur.exe
  2⤵
  PID:11804
- C:\Windows\System\SZTJXPT.exe
  C:\Windows\System\SZTJXPT.exe
  2⤵
  PID:12768
- C:\Windows\System\lywUjAY.exe
  C:\Windows\System\lywUjAY.exe
  2⤵
  PID:13416
- C:\Windows\System\NldXCXS.exe
  C:\Windows\System\NldXCXS.exe
  2⤵
  PID:13484
- C:\Windows\System\gUevhVX.exe
  C:\Windows\System\gUevhVX.exe
  2⤵
  PID:13540
- C:\Windows\System\hDXOLhm.exe
  C:\Windows\System\hDXOLhm.exe
  2⤵
  PID:13052
- C:\Windows\System\khEFkyB.exe
  C:\Windows\System\khEFkyB.exe
  2⤵
  PID:13108
- C:\Windows\System\MsXdWMM.exe
  C:\Windows\System\MsXdWMM.exe
  2⤵
  PID:13072
- C:\Windows\System\mNDDjOR.exe
  C:\Windows\System\mNDDjOR.exe
  2⤵
  PID:13780
- C:\Windows\System\CQutuPZ.exe
  C:\Windows\System\CQutuPZ.exe
  2⤵
  PID:13488
- C:\Windows\System\tDXGloD.exe
  C:\Windows\System\tDXGloD.exe
  2⤵
  PID:13844
- C:\Windows\System\WIqnYRl.exe
  C:\Windows\System\WIqnYRl.exe
  2⤵
  PID:13956
- C:\Windows\System\QNcjxWR.exe
  C:\Windows\System\QNcjxWR.exe
  2⤵
  PID:13976
- C:\Windows\System\UQUBPlS.exe
  C:\Windows\System\UQUBPlS.exe
  2⤵
  PID:13660
- C:\Windows\System\ROLLwDl.exe
  C:\Windows\System\ROLLwDl.exe
  2⤵
  PID:14080
- C:\Windows\System\YkXiMfM.exe
  C:\Windows\System\YkXiMfM.exe
  2⤵
  PID:14104
- C:\Windows\System\tjqItbF.exe
  C:\Windows\System\tjqItbF.exe
  2⤵
  PID:14132
- C:\Windows\System\OxaxmTv.exe
  C:\Windows\System\OxaxmTv.exe
  2⤵
  PID:14188
- C:\Windows\System\xTmuAbV.exe
  C:\Windows\System\xTmuAbV.exe
  2⤵
  PID:13900
- C:\Windows\System\EvGzXYF.exe
  C:\Windows\System\EvGzXYF.exe
  2⤵
  PID:13600
- C:\Windows\System\mhKQBNF.exe
  C:\Windows\System\mhKQBNF.exe
  2⤵
  PID:12812
- C:\Windows\System\cOictes.exe
  C:\Windows\System\cOictes.exe
  2⤵
  PID:12232
- C:\Windows\System\AjGHTAo.exe
  C:\Windows\System\AjGHTAo.exe
  2⤵
  PID:13760
- C:\Windows\System\YSQIwqK.exe
  C:\Windows\System\YSQIwqK.exe
  2⤵
  PID:12480
- C:\Windows\System\HyGHJuV.exe
  C:\Windows\System\HyGHJuV.exe
  2⤵
  PID:13508
- C:\Windows\System\WEWGNWc.exe
  C:\Windows\System\WEWGNWc.exe
  2⤵
  PID:14292
- C:\Windows\System\DFIuqNc.exe
  C:\Windows\System\DFIuqNc.exe
  2⤵
  PID:14368
- C:\Windows\System\tbFtiWo.exe
  C:\Windows\System\tbFtiWo.exe
  2⤵
  PID:14404
- C:\Windows\System\QoDCMYv.exe
  C:\Windows\System\QoDCMYv.exe
  2⤵
  PID:14424
- C:\Windows\System\DEyvdvr.exe
  C:\Windows\System\DEyvdvr.exe
  2⤵
  PID:14444
- C:\Windows\System\UmwrAcI.exe
  C:\Windows\System\UmwrAcI.exe
  2⤵
  PID:14460
- C:\Windows\System\baXArxV.exe
  C:\Windows\System\baXArxV.exe
  2⤵
  PID:14484
- C:\Windows\System\GAqhRrN.exe
  C:\Windows\System\GAqhRrN.exe
  2⤵
  PID:14508
- C:\Windows\System\mkbEMui.exe
  C:\Windows\System\mkbEMui.exe
  2⤵
  PID:14528
- C:\Windows\System\lDXLyOl.exe
  C:\Windows\System\lDXLyOl.exe
  2⤵
  PID:14548
- C:\Windows\System\aSGiPnv.exe
  C:\Windows\System\aSGiPnv.exe
  2⤵
  PID:14572
- C:\Windows\System\rWijUlg.exe
  C:\Windows\System\rWijUlg.exe
  2⤵
  PID:14596
- C:\Windows\System\iXuxvTG.exe
  C:\Windows\System\iXuxvTG.exe
  2⤵
  PID:14616
- C:\Windows\System\HMwSlyi.exe
  C:\Windows\System\HMwSlyi.exe
  2⤵
  PID:14640
- C:\Windows\System\VGFsJtp.exe
  C:\Windows\System\VGFsJtp.exe
  2⤵
  PID:14664
- C:\Windows\System\nDQPjdC.exe
  C:\Windows\System\nDQPjdC.exe
  2⤵
  PID:14684
- C:\Windows\System\vUFBhYo.exe
  C:\Windows\System\vUFBhYo.exe
  2⤵
  PID:14708
- C:\Windows\System\eHSrNeg.exe
  C:\Windows\System\eHSrNeg.exe
  2⤵
  PID:14732
- C:\Windows\System\KGIIeIH.exe
  C:\Windows\System\KGIIeIH.exe
  2⤵
  PID:14752
- C:\Windows\System\KJjtYNb.exe
  C:\Windows\System\KJjtYNb.exe
  2⤵
  PID:14776
- C:\Windows\System\jamCgPM.exe
  C:\Windows\System\jamCgPM.exe
  2⤵
  PID:14800
- C:\Windows\System\xZeIIYf.exe
  C:\Windows\System\xZeIIYf.exe
  2⤵
  PID:14824
- C:\Windows\System\CDIVGZk.exe
  C:\Windows\System\CDIVGZk.exe
  2⤵
  PID:14848
- C:\Windows\System\cQHMRDf.exe
  C:\Windows\System\cQHMRDf.exe
  2⤵
  PID:14876
- C:\Windows\System\GaklGOf.exe
  C:\Windows\System\GaklGOf.exe
  2⤵
  PID:14900
- C:\Windows\System\RpxvCdN.exe
  C:\Windows\System\RpxvCdN.exe
  2⤵
  PID:14936
- C:\Windows\System\aXuCdEp.exe
  C:\Windows\System\aXuCdEp.exe
  2⤵
  PID:14960
- C:\Windows\System\CfaKLvX.exe
  C:\Windows\System\CfaKLvX.exe
  2⤵
  PID:14984
- C:\Windows\System\YUCuHzu.exe
  C:\Windows\System\YUCuHzu.exe
  2⤵
  PID:15008
- C:\Windows\System\VFdJdso.exe
  C:\Windows\System\VFdJdso.exe
  2⤵
  PID:15032
- C:\Windows\System\QYUdMYP.exe
  C:\Windows\System\QYUdMYP.exe
  2⤵
  PID:15048
- C:\Windows\System\IqeejRi.exe
  C:\Windows\System\IqeejRi.exe
  2⤵
  PID:15076
- C:\Windows\System\aWonqGI.exe
  C:\Windows\System\aWonqGI.exe
  2⤵
  PID:15096
- C:\Windows\System\XoVVTVX.exe
  C:\Windows\System\XoVVTVX.exe
  2⤵
  PID:15116
- C:\Windows\System\XHYloxe.exe
  C:\Windows\System\XHYloxe.exe
  2⤵
  PID:15140
- C:\Windows\System\kvclHbD.exe
  C:\Windows\System\kvclHbD.exe
  2⤵
  PID:15172
- C:\Windows\System\CqScYzc.exe
  C:\Windows\System\CqScYzc.exe
  2⤵
  PID:15196
- C:\Windows\System\KjCoYYN.exe
  C:\Windows\System\KjCoYYN.exe
  2⤵
  PID:15220
- C:\Windows\System\PHPGBzo.exe
  C:\Windows\System\PHPGBzo.exe
  2⤵
  PID:15244
- C:\Windows\System\pxWCbOF.exe
  C:\Windows\System\pxWCbOF.exe
  2⤵
  PID:15264
- C:\Windows\System\otSaIWF.exe
  C:\Windows\System\otSaIWF.exe
  2⤵
  PID:15292
- C:\Windows\System\vXqcMUC.exe
  C:\Windows\System\vXqcMUC.exe
  2⤵
  PID:15308
- C:\Windows\System\zbMrnmh.exe
  C:\Windows\System\zbMrnmh.exe
  2⤵
  PID:15336
- C:\Windows\System\mLSTuzx.exe
  C:\Windows\System\mLSTuzx.exe
  2⤵
  PID:13640
- C:\Windows\System\efOqTQs.exe
  C:\Windows\System\efOqTQs.exe
  2⤵
  PID:14328
- C:\Windows\System\qSeyjsq.exe
  C:\Windows\System\qSeyjsq.exe
  2⤵
  PID:13664
- C:\Windows\System\mTTfCLc.exe
  C:\Windows\System\mTTfCLc.exe
  2⤵
  PID:13876
- C:\Windows\System\wKOpWnV.exe
  C:\Windows\System\wKOpWnV.exe
  2⤵
  PID:14088
- C:\Windows\System\zCsgIBY.exe
  C:\Windows\System\zCsgIBY.exe
  2⤵
  PID:13468
- C:\Windows\System\HZhOcry.exe
  C:\Windows\System\HZhOcry.exe
  2⤵
  PID:14248
- C:\Windows\System\EQJubKx.exe
  C:\Windows\System\EQJubKx.exe
  2⤵
  PID:13336
- C:\Windows\System\CumtpYt.exe
  C:\Windows\System\CumtpYt.exe
  2⤵
  PID:14440
- C:\Windows\System\PFpJXSx.exe
  C:\Windows\System\PFpJXSx.exe
  2⤵
  PID:14472
- C:\Windows\System\uhDtRjw.exe
  C:\Windows\System\uhDtRjw.exe
  2⤵
  PID:14052
- C:\Windows\System\ndqmjhl.exe
  C:\Windows\System\ndqmjhl.exe
  2⤵
  PID:13412
- C:\Windows\System\xBMNJeR.exe
  C:\Windows\System\xBMNJeR.exe
  2⤵
  PID:14696
- C:\Windows\System\vLTxWjZ.exe
  C:\Windows\System\vLTxWjZ.exe
  2⤵
  PID:12744
- C:\Windows\System\qhezRWU.exe
  C:\Windows\System\qhezRWU.exe
  2⤵
  PID:14008
- C:\Windows\System\RlpjixE.exe
  C:\Windows\System\RlpjixE.exe
  2⤵
  PID:12324
- C:\Windows\System\nphKawf.exe
  C:\Windows\System\nphKawf.exe
  2⤵
  PID:15364
- C:\Windows\System\CYmnrNE.exe
  C:\Windows\System\CYmnrNE.exe
  2⤵
  PID:15380
- C:\Windows\System\TNblAJg.exe
  C:\Windows\System\TNblAJg.exe
  2⤵
  PID:15404
- C:\Windows\System\lczBceD.exe
  C:\Windows\System\lczBceD.exe
  2⤵
  PID:15432
- C:\Windows\System\omddLKm.exe
  C:\Windows\System\omddLKm.exe
  2⤵
  PID:15456
- C:\Windows\System\XFJxMqi.exe
  C:\Windows\System\XFJxMqi.exe
  2⤵
  PID:15472
- C:\Windows\System\ptYIikl.exe
  C:\Windows\System\ptYIikl.exe
  2⤵
  PID:15492
- C:\Windows\System\hmAbftT.exe
  C:\Windows\System\hmAbftT.exe
  2⤵
  PID:15524
- C:\Windows\System\MyTJlNi.exe
  C:\Windows\System\MyTJlNi.exe
  2⤵
  PID:15552
- C:\Windows\System\ToFBHxm.exe
  C:\Windows\System\ToFBHxm.exe
  2⤵
  PID:15572
- C:\Windows\System\bjgsPBn.exe
  C:\Windows\System\bjgsPBn.exe
  2⤵
  PID:15600
- C:\Windows\System\XRFNZHF.exe
  C:\Windows\System\XRFNZHF.exe
  2⤵
  PID:15616
- C:\Windows\System\pdgdzUo.exe
  C:\Windows\System\pdgdzUo.exe
  2⤵
  PID:15652
- C:\Windows\System\wvyRGJQ.exe
  C:\Windows\System\wvyRGJQ.exe
  2⤵
  PID:15684
- C:\Windows\System\YEZAFfM.exe
  C:\Windows\System\YEZAFfM.exe
  2⤵
  PID:15704
- C:\Windows\System\vGbcwkR.exe
  C:\Windows\System\vGbcwkR.exe
  2⤵
  PID:15740
- C:\Windows\System\RTDpUGU.exe
  C:\Windows\System\RTDpUGU.exe
  2⤵
  PID:15768
- C:\Windows\System\axyQgxu.exe
  C:\Windows\System\axyQgxu.exe
  2⤵
  PID:15792
- C:\Windows\System\iwtKycn.exe
  C:\Windows\System\iwtKycn.exe
  2⤵
  PID:15812
- C:\Windows\System\XRjivoh.exe
  C:\Windows\System\XRjivoh.exe
  2⤵
  PID:15836
- C:\Windows\System\tGpoyCt.exe
  C:\Windows\System\tGpoyCt.exe
  2⤵
  PID:15856
- C:\Windows\System\maIVDwa.exe
  C:\Windows\System\maIVDwa.exe
  2⤵
  PID:15876
- C:\Windows\System\zIyRELN.exe
  C:\Windows\System\zIyRELN.exe
  2⤵
  PID:15896
- C:\Windows\System\xaTnHKf.exe
  C:\Windows\System\xaTnHKf.exe
  2⤵
  PID:15928
- C:\Windows\System\YxsTgXP.exe
  C:\Windows\System\YxsTgXP.exe
  2⤵
  PID:15948
- C:\Windows\System\nWeaihc.exe
  C:\Windows\System\nWeaihc.exe
  2⤵
  PID:15972
- C:\Windows\System\pZjooKg.exe
  C:\Windows\System\pZjooKg.exe
  2⤵
  PID:16000
- C:\Windows\System\bNcuEiy.exe
  C:\Windows\System\bNcuEiy.exe
  2⤵
  PID:16020
- C:\Windows\System\qNBtzHM.exe
  C:\Windows\System\qNBtzHM.exe
  2⤵
  PID:16036
- C:\Windows\System\TrrkzuR.exe
  C:\Windows\System\TrrkzuR.exe
  2⤵
  PID:16052
- C:\Windows\System\MXkNpZS.exe
  C:\Windows\System\MXkNpZS.exe
  2⤵
  PID:16068
- C:\Windows\System\WnzUmIn.exe
  C:\Windows\System\WnzUmIn.exe
  2⤵
  PID:16092
- C:\Windows\System\CxyiOLK.exe
  C:\Windows\System\CxyiOLK.exe
  2⤵
  PID:16116
- C:\Windows\System\CYNLxht.exe
  C:\Windows\System\CYNLxht.exe
  2⤵
  PID:16136
- C:\Windows\System\kyUOHZk.exe
  C:\Windows\System\kyUOHZk.exe
  2⤵
  PID:16152
- C:\Windows\System\VpPCOdg.exe
  C:\Windows\System\VpPCOdg.exe
  2⤵
  PID:16176
- C:\Windows\System\cpXfVZd.exe
  C:\Windows\System\cpXfVZd.exe
  2⤵
  PID:16208
- C:\Windows\System\pYoHQRP.exe
  C:\Windows\System\pYoHQRP.exe
  2⤵
  PID:16224
- C:\Windows\System\VabNvbH.exe
  C:\Windows\System\VabNvbH.exe
  2⤵
  PID:16248
- C:\Windows\System\LCGInZe.exe
  C:\Windows\System\LCGInZe.exe
  2⤵
  PID:16276
- C:\Windows\System\ksHgtwW.exe
  C:\Windows\System\ksHgtwW.exe
  2⤵
  PID:16300
- C:\Windows\System\QmtLIjY.exe
  C:\Windows\System\QmtLIjY.exe
  2⤵
  PID:16320
- C:\Windows\System\QBmGOXe.exe
  C:\Windows\System\QBmGOXe.exe
  2⤵
  PID:16344
- C:\Windows\System\JXmpnzO.exe
  C:\Windows\System\JXmpnzO.exe
  2⤵
  PID:16376
- C:\Windows\System\ZCHeUHV.exe
  C:\Windows\System\ZCHeUHV.exe
  2⤵
  PID:13396
- C:\Windows\System\mWAVPtC.exe
  C:\Windows\System\mWAVPtC.exe
  2⤵
  PID:15128
- C:\Windows\System\wYQJiSK.exe
  C:\Windows\System\wYQJiSK.exe
  2⤵
  PID:15156
- C:\Windows\System\guOPYyy.exe
  C:\Windows\System\guOPYyy.exe
  2⤵
  PID:15216
- C:\Windows\System\KNrmyun.exe
  C:\Windows\System\KNrmyun.exe
  2⤵
  PID:13328
- C:\Windows\System\eXkIsyb.exe
  C:\Windows\System\eXkIsyb.exe
  2⤵
  PID:15328
- C:\Windows\System\xFiqNJT.exe
  C:\Windows\System\xFiqNJT.exe
  2⤵
  PID:15352
- C:\Windows\System\clsoRzA.exe
  C:\Windows\System\clsoRzA.exe
  2⤵
  PID:14728
- C:\Windows\System\pPFgeHr.exe
  C:\Windows\System\pPFgeHr.exe
  2⤵
  PID:14244
- C:\Windows\System\QVImdkw.exe
  C:\Windows\System\QVImdkw.exe
  2⤵
  PID:14436
- C:\Windows\System\nDcmQbq.exe
  C:\Windows\System\nDcmQbq.exe
  2⤵
  PID:13268
- C:\Windows\System\QUQmGxi.exe
  C:\Windows\System\QUQmGxi.exe
  2⤵
  PID:14240
- C:\Windows\System\pZNeWaE.exe
  C:\Windows\System\pZNeWaE.exe
  2⤵
  PID:14380
- C:\Windows\System\YyJWjZy.exe
  C:\Windows\System\YyJWjZy.exe
  2⤵
  PID:15060
- C:\Windows\System\ACJbBsr.exe
  C:\Windows\System\ACJbBsr.exe
  2⤵
  PID:15480
- C:\Windows\System\msTZFvl.exe
  C:\Windows\System\msTZFvl.exe
  2⤵
  PID:15516
- C:\Windows\System\xmWqhPa.exe
  C:\Windows\System\xmWqhPa.exe
  2⤵
  PID:15612
- C:\Windows\System\QbtDJUn.exe
  C:\Windows\System\QbtDJUn.exe
  2⤵
  PID:15692
- C:\Windows\System\PrlOjIO.exe
  C:\Windows\System\PrlOjIO.exe
  2⤵
  PID:15276
- C:\Windows\System\MMscPFZ.exe
  C:\Windows\System\MMscPFZ.exe
  2⤵
  PID:15764
- C:\Windows\System\RwGipKE.exe
  C:\Windows\System\RwGipKE.exe
  2⤵
  PID:15808
- C:\Windows\System\jPuDlzW.exe
  C:\Windows\System\jPuDlzW.exe
  2⤵
  PID:13216
- C:\Windows\System\rlFyUNj.exe
  C:\Windows\System\rlFyUNj.exe
  2⤵
  PID:14220
- C:\Windows\System\icllOro.exe
  C:\Windows\System\icllOro.exe
  2⤵
  PID:15996
- C:\Windows\System\XXEpaJs.exe
  C:\Windows\System\XXEpaJs.exe
  2⤵
  PID:16396
- C:\Windows\System\FgWjJXA.exe
  C:\Windows\System\FgWjJXA.exe
  2⤵
  PID:16424
- C:\Windows\System\KGZffFQ.exe
  C:\Windows\System\KGZffFQ.exe
  2⤵
  PID:16440
- C:\Windows\System\nItqUJL.exe
  C:\Windows\System\nItqUJL.exe
  2⤵
  PID:16456
- C:\Windows\System\ACBrluF.exe
  C:\Windows\System\ACBrluF.exe
  2⤵
  PID:16472
- C:\Windows\System\CkktJim.exe
  C:\Windows\System\CkktJim.exe
  2⤵
  PID:16488
- C:\Windows\System\QqxsVOm.exe
  C:\Windows\System\QqxsVOm.exe
  2⤵
  PID:16508
- C:\Windows\System\xFxeuCp.exe
  C:\Windows\System\xFxeuCp.exe
  2⤵
  PID:16536
- C:\Windows\System\qBwiOLx.exe
  C:\Windows\System\qBwiOLx.exe
  2⤵
  PID:16564
- C:\Windows\System\mgCoLpF.exe
  C:\Windows\System\mgCoLpF.exe
  2⤵
  PID:16584
- C:\Windows\System\ehjulqd.exe
  C:\Windows\System\ehjulqd.exe
  2⤵
  PID:16616
- C:\Windows\System\jfLHtgt.exe
  C:\Windows\System\jfLHtgt.exe
  2⤵
  PID:16644
- C:\Windows\System\KVZNEDD.exe
  C:\Windows\System\KVZNEDD.exe
  2⤵
  PID:16668
- C:\Windows\System\qDCNVyQ.exe
  C:\Windows\System\qDCNVyQ.exe
  2⤵
  PID:16692
- C:\Windows\System\JaQShFU.exe
  C:\Windows\System\JaQShFU.exe
  2⤵
  PID:17080
- C:\Windows\System\tlnCgwJ.exe
  C:\Windows\System\tlnCgwJ.exe
  2⤵
  PID:17096
- C:\Windows\System\JFaNGhm.exe
  C:\Windows\System\JFaNGhm.exe
  2⤵
  PID:17112
- C:\Windows\System\qrkhXAb.exe
  C:\Windows\System\qrkhXAb.exe
  2⤵
  PID:17128
- C:\Windows\System\bYKNwOw.exe
  C:\Windows\System\bYKNwOw.exe
  2⤵
  PID:17144
- C:\Windows\System\WepQomh.exe
  C:\Windows\System\WepQomh.exe
  2⤵
  PID:17160
- C:\Windows\System\fTSDnVG.exe
  C:\Windows\System\fTSDnVG.exe
  2⤵
  PID:17180
- C:\Windows\System\dHaTdKu.exe
  C:\Windows\System\dHaTdKu.exe
  2⤵
  PID:17196
- C:\Windows\System\BIFwrVp.exe
  C:\Windows\System\BIFwrVp.exe
  2⤵
  PID:17224
- C:\Windows\System\EieOqqU.exe
  C:\Windows\System\EieOqqU.exe
  2⤵
  PID:17248
- C:\Windows\System\CCbLemO.exe
  C:\Windows\System\CCbLemO.exe
  2⤵
  PID:17264
- C:\Windows\System\xioeYrb.exe
  C:\Windows\System\xioeYrb.exe
  2⤵
  PID:17280
- C:\Windows\System\mtjEejA.exe
  C:\Windows\System\mtjEejA.exe
  2⤵
  PID:17296
- C:\Windows\System\kwbfuWH.exe
  C:\Windows\System\kwbfuWH.exe
  2⤵
  PID:17316
- C:\Windows\System\pIAIdYy.exe
  C:\Windows\System\pIAIdYy.exe
  2⤵
  PID:17332
- C:\Windows\System\mwranKp.exe
  C:\Windows\System\mwranKp.exe
  2⤵
  PID:17348
- C:\Windows\System\MRtnwCv.exe
  C:\Windows\System\MRtnwCv.exe
  2⤵
  PID:17364
- C:\Windows\System\ulHBahN.exe
  C:\Windows\System\ulHBahN.exe
  2⤵
  PID:17380
- C:\Windows\System\TIYpdyq.exe
  C:\Windows\System\TIYpdyq.exe
  2⤵
  PID:17396
- C:\Windows\System\ekiJNxs.exe
  C:\Windows\System\ekiJNxs.exe
  2⤵
  PID:16192
- C:\Windows\System\LKQQtFr.exe
  C:\Windows\System\LKQQtFr.exe
  2⤵
  PID:17172
- C:\Windows\System\wqkztQs.exe
  C:\Windows\System\wqkztQs.exe
  2⤵
  PID:17276
- C:\Windows\System\kgOPInq.exe
  C:\Windows\System\kgOPInq.exe
  2⤵
  PID:16972
- C:\Windows\System\bQIzCqi.exe
  C:\Windows\System\bQIzCqi.exe
  2⤵
  PID:15256
- C:\Windows\System\mrhvHUS.exe
  C:\Windows\System\mrhvHUS.exe
  2⤵
  PID:14028
- C:\Windows\System\nweAMrX.exe
  C:\Windows\System\nweAMrX.exe
  2⤵
  PID:15852
- C:\Windows\System\yrIRYsp.exe
  C:\Windows\System\yrIRYsp.exe
  2⤵
  PID:16936
- C:\Windows\System\sXrOcDb.exe
  C:\Windows\System\sXrOcDb.exe
  2⤵
  PID:17188
- C:\Windows\System\tCGOxYt.exe
  C:\Windows\System\tCGOxYt.exe
  2⤵
  PID:14356

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16284

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe a8acff8ea8781a75279fb141a3869ba1 UDm2zn5hz0OVId63SGpBsg.0.1.0.0.0
1⤵
PID:15552
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:15600

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:17380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BKRnXIv.exe

Filesize
1.7MB

MD5
fa8b7285a078252fcd8ddc345242254f

SHA1
7e283e73ee6ec463940ff8c7c9330a8ebedfee64

SHA256
4cb84803923442d0972ae81a39a32a2b64cdb6813bd484b4bf4ebd7db67b6d05

SHA512
7795a9b8ce57bee1581ae18f19a2f55f533bc754a0f3f865b6df960e83d2fc08c21f2e8904e9ba0937bb7127ddec657b31cf210bc8493d782bb8ec2eb3d46199

Download Submit
C:\Windows\System\BLDyPjp.exe

Filesize
1.7MB

MD5
2728505faa7ffdaf3e5decacbc62997a

SHA1
acdfc8b82cae686bb0b7e9b66820723b89ecec5a

SHA256
534101c2f16c29cf869d35811ac0e9ea42f218518ed03cd7f9810d76dcbcf1fd

SHA512
a0025f1dea0777b33b7fd12b460e770f804292497ae10fd1bc24ca61771a7b50a99d4a4c76b3b36b874f6b3e814a4115874d35b56aadf7ad5128344789b80b00

Download Submit
C:\Windows\System\CGCoSdH.exe

Filesize
1.7MB

MD5
90b8156dc445b923549a85de058556bc

SHA1
f55afa2a18d60b24a8e6d853ebcd180b8730c9bc

SHA256
8b3cd637334b306b5ac42316e484b3cc16e63846873042a38981ce4679dae75e

SHA512
fabd17ab88925005079bbb182cf1e1fcc7b71f3a51462697468cc95047cf2b03369a6b4623d7d871390e89a424c0b7df7047b3fbdcfec06abcbd8966688ff074

Download Submit
C:\Windows\System\DotbKKb.exe

Filesize
1.7MB

MD5
0e4093817a4641945ede4595d0bb8bf4

SHA1
02bcab3cca537a62f548d187771941320a0ca7dc

SHA256
63f45722dd7453d68cbcb154c52ab91bf66c2ffbfae165e3d302db8c4e654556

SHA512
7e9f75edf734821e8ed14b6cb3215405adc17a24a89ee6febc3e243f5c2e0d7b75484a7706eaf58890ce5fd3f8b25fd04ed7d88c8476b53b323f23a889365245

Download Submit
C:\Windows\System\FEmAKuA.exe

Filesize
1.7MB

MD5
0504e558c66a81ec835f63f6334224b5

SHA1
cebbac033982cce2eca956ce5be45de00d452f83

SHA256
239b2226550c6014b1ece7db8189b5194e50dbf9b1d37c158e9f20f62c4e9daa

SHA512
732216fd7d7cf45b3aa5e0b5de1696eea3d4b12333d9c305c49fe24127479a81e239d79020402e7a28e905985ae15bbe8d0c522ed36bd402865d2d079d2273c2

Download Submit
C:\Windows\System\FcLbMAT.exe

Filesize
1.7MB

MD5
b6d3c4954b325612d9b7891e0c634171

SHA1
6fd95b8e54a5ff8786e9889e64e1d1a856755bc3

SHA256
902d9500d18eded487fd2d063fc7710f61577a2c383034757597b13ff16d5890

SHA512
b77427e16ca6da16daca1996356870e3f06e22f06ef08937af4b278a97859dea0f4ea484ce438a277d6b2b0dd0bcb887f77d5913350a26bf06f64bf527af3e1a

Download Submit
C:\Windows\System\GRsCVCI.exe

Filesize
1.7MB

MD5
0d1a58f9325a08e75fe498c812a1a474

SHA1
f4f484967cb0e4e99dc616f81a607786fb3f9ad0

SHA256
b3bfce779c565e899fba6cef03cc03605f6c5ec97b193fe514723105668a614b

SHA512
f7388a9270e988e2933cb4dc8005d2c3439f15c0e625f2fc0cbd41d2ff01a4083cda01d25fbcd84891c0e5a4977e427306854b32aeb67db16f47d29571960c18

Download Submit
C:\Windows\System\GSchwsO.exe

Filesize
1.7MB

MD5
49719f72bc45f8d62c0d896b15ca5193

SHA1
ef717935bbcfd22c590f95cd81f23c7430d89825

SHA256
0ebecaae368709da41df2b46effd9f5debe2885b503b4fa0a7a2b1bc5778f5d9

SHA512
875b2a55a872e469583770b76bbbe7d7dff05bbf059ccda52923a24e98f90d798caa933be2d5d1432bf47374dd81ad62764938b24c0050f445b95c167f8c4c7c

Download Submit
C:\Windows\System\JTugQpo.exe

Filesize
1.7MB

MD5
b3331b7f54e5500cc7ae9fdb55bab7a7

SHA1
40d30a8424b9915426391d8af99f880ea6d82468

SHA256
0c1a06aca81f35960c63b57dd7dfbbdc35f53b4da5138071a446775bd949103a

SHA512
0b49fc4fed6c5edf3435b3acba9b4dfaa564a91a2a19ae48cb3c81ab960d7db4ade63bdb4da363e62e77c07fdbca45a1744da004eb163e622cbd0cd7fc261850

Download Submit
C:\Windows\System\JVTOJDu.exe

Filesize
1.7MB

MD5
635631eae4e7b6299d1d8c0fb93c0bfd

SHA1
457b0612cc25970e9f5e09612fdfab928cf93c11

SHA256
7e90e68b3bbf83559599511f3269b0ff81b51c873f61d09fdbf0122618b8e2f6

SHA512
2ad9aa3fc06da54aba169351943023a561ccfe167dc8d66de593e4027b84d9d6376aed64af84afa6f7bd1a236b04e510925394ef8398f6825dc306dba121156f

Download Submit
C:\Windows\System\LDCiYIg.exe

Filesize
1.7MB

MD5
387e1a1c6947a0d2546873c5c7bb9dd5

SHA1
27f10deb186f819559c0b07b6bb19d60b37e7bb1

SHA256
161395b590604820d7cf57d19157753aa5f9e91b2a872dc0485a33b3f2289877

SHA512
29eb6156aedb7ad5cf720f34f9bb07ea9ad0b4ecc97a044273bd19f40ffa7271085255370efd3f513b3d0aa66fd3ba88593d6cb9279def5e942407ed2f6cd740

Download Submit
C:\Windows\System\MIUvhTW.exe

Filesize
1.7MB

MD5
dc924e44dca8fd13f9ef776010a8dae4

SHA1
356106693af5f48b92dfee83874f14c8dd8423c1

SHA256
2edda25e76b68262b748c314b7334a3a0b13c4e9d38107f35ec0fcb2a58aeda3

SHA512
b8dfa4c6e6e471d3e86e052942f205805322bc751339b0c8b27186fbd8fc27542bb84c480334bab84c21cf64bde3ea28262e9aabbd64c40fd30278a7690fee9c

Download Submit
C:\Windows\System\NBQfesW.exe

Filesize
1.7MB

MD5
19a119873d3b3846462d53c6d8fa18c8

SHA1
837f3ccf606c4b27ca8da736e8d70cf02c71a462

SHA256
1d64bfa57d07d3a90b887bf74664ffd09d493189492e4228dcef5f7dba32d841

SHA512
9505600fc72d82df5b3144c26d6496b952efde1c232ddf49262a75155a76ffa00acb096abc21a8f6c4e26de00f276627b9a17ffd187329737f2f9f0a88084a69

Download Submit
C:\Windows\System\NHVYOTt.exe

Filesize
1.7MB

MD5
579dda117f2976535afb854460f24e9d

SHA1
e311aef3c05214d5b3f5b61629be49d9a38f04e5

SHA256
ed51a4eac46201c4e21a6b9e532691c495286e9ab879f7bc9c62f9dd32c55594

SHA512
dabc105690893bc766f17978e9c182dd56226c931f3df2ee2d7b1be56a6ee23933e42c37ba497949b25c5f046de0cf084d7ae90dec2a228f4bd8da73c7fa4247

Download Submit
C:\Windows\System\QUhlupF.exe

Filesize
1.7MB

MD5
b0358b20083a3a1c663fad0f1b959f35

SHA1
d69fe86cd37e06e146c5b53724aa0a29b79225cd

SHA256
affff31cc28d70dfedd78468d4869dc4ead3a351cde86c3da70843492feaf69b

SHA512
387261104938f754cea38ede85e588110d9680d34b1a3f07007548b13533ed717d8e081fa5a7537473f2441a26c66a9a20912824aa40274522d68ce10f547932

Download Submit
C:\Windows\System\ScVAXYj.exe

Filesize
1.7MB

MD5
7284e7c540bbfb85ba64fe8e8a2dc75c

SHA1
75c9d8740c48f149aad9f91bcd2cdbe6744cb522

SHA256
6b706debf1bc04bd7f8d1c2becc46f0cb5766690db2970ab62f67a0908dea44f

SHA512
d3223eb6c5e6ebedce430010cabbdb51ee9772daea780f36b67c16aafffed419a3e0102353e397b69eb12db27174b5e94e06c0f7624faf4fc164f81ef24e57e8

Download Submit
C:\Windows\System\UjSHHJB.exe

Filesize
1.7MB

MD5
8087b42dab9d8dff4083161f86eda052

SHA1
046137f63ccf4d15d896b638db434137c89918d6

SHA256
dc0a4e659329c0870862db7bf9d6c03c1ba357bc2f48e3bcc8cd6a051baafdbe

SHA512
a6583c9cb87884a251be023dc81553ea19798fdef6952fc87f2b24714e5eabf208603beac1575c897fd827dd6418685a89bd346cee4a909f8c449187e670dc0a

Download Submit
C:\Windows\System\YNjspNn.exe

Filesize
1.7MB

MD5
c0accc0fbe120d4ef22f0ff7ec09c06f

SHA1
d6d63ff74262f880b4eee1c90fc5f31988e4df66

SHA256
c33d0e91b9595a16a17c587d3957868137fea7d709cb537a2b8d54b4df338f2a

SHA512
e3b758b11a894cbb50a0ba5878a93a0d8be7e16505a5be7ac09e6d865e15f33453ed039e6ab1ea0e814a87109b8d59e5aeebd8cdb39533fb8605929f79ec91a5

Download Submit
C:\Windows\System\Yrwyzon.exe

Filesize
1.7MB

MD5
88551131353bacd50e4504e6b582430e

SHA1
bba77deae2f54d723948c2ec00c83933f0bd261a

SHA256
9e89686978a204504a54104b424815a56d84ae0952f07a1a2a74d9c7acdf2a83

SHA512
e75f2e2d56862f828a8aa88578be67f504be29a53da133153310fae8fdba3f55d7ff8b425ab678a8dd7ffaad1ad7c824407dbd226f29a4140cf2c5b5c0213bc6

Download Submit
C:\Windows\System\bbMuKpm.exe

Filesize
1.7MB

MD5
375240a313a5a65b483a4151e9eb3505

SHA1
f6e8325299efbeabde9a7e24c0acb8aa25546ac9

SHA256
5d25ea2843c6826c3164436caf707a1e41f15cee042ab0b513dc25b457b4e686

SHA512
e8f235c92734598360badf9f0350ec62c42321cba78c0b07661d7adc640ff2e1741c7c6aadc81c047ac9aa603656708208d08aa929a345bd6166a091faca3669

Download Submit
C:\Windows\System\bpBVdAT.exe

Filesize
1.7MB

MD5
9c169581a238e802c0fbed44cbb48650

SHA1
31aaba123bba95ab432e30ecb7130ac930c0e8f5

SHA256
c0a8bbda18c7c3a90179ba259e72191bede25565f3f9c82633780a49420bb04b

SHA512
14995eab1528cc715c48b42b6e0faed6cf0b6c210ff6aa23aec88ed039b866cb3832be923b1d53ac80be94df8e70dcd1fd2e40f80945228eda79ae1928af4bca

Download Submit
C:\Windows\System\emwxjKb.exe

Filesize
1.7MB

MD5
d1c9129e2f36e0efdbdd0753a57d2b5d

SHA1
f23f010782ab67afd87001b5330a533ad49cc7f5

SHA256
a666077a0d86c2078f1cf9056ff0197013e4c2239d620095bfade54bb7016e9b

SHA512
09b27e0000dfcec2841b372dde62a7540c8ef72a265025eeba1bfde901cb771205ee8ea8d3b4e811a34682d604c2c126bce57d9f8443b14d9422c6716adb43a1

Download Submit
C:\Windows\System\fmYmjSU.exe

Filesize
1.7MB

MD5
5aa66fcfdea2dfbe892ce5b2e71db552

SHA1
e633d9c942f2f495725056c8d9b4a327cb22e6f6

SHA256
07dcb7118a6f218c482cd575192175445689064dd06c2cdc0692a9c2f47f1511

SHA512
4b7374f757f9ffb66c0c4fa4a0e87902db94bad22d02b4666f49edf815d34c6079c9f224528346e034088a1c2f3f5ceaa5084afcbcd6b0a9dabeaa53a92560ec

Download Submit
C:\Windows\System\gHOdpjL.exe

Filesize
1.7MB

MD5
92afdcf20571011ce318c2c844649f81

SHA1
4db848fb2fd567c1110d3ea0065823bbdddc3076

SHA256
dbc7ce50a198b00eb03870a4db33cd0bf6541380e1bb58b41d97d2d940cc35fe

SHA512
85be4d7da5ad40e459b7682c4d63fc228eb6e4d43ccaebb6e3c2f724d9f40671831385aa24ef2acc655ca9dd7d2a810963140b4105ae211de8178ab26dcc9f97

Download Submit
C:\Windows\System\hcsDyWx.exe

Filesize
1.7MB

MD5
5b9170227ac4f972e99485ffa772b338

SHA1
93fd8da206bbc7909363066860c93af3ca78bf64

SHA256
0a04e189b582baebe72d22e2b93805c64851f3fac53a1aaf376caa7b6dfef161

SHA512
165239795cefa5eff888d213ae5c86b8d7bb57c5a50356c1cd09edf5c6e422f5778262224d073459a4bd24546112e27342076e27fae47378350d022d245b961a

Download Submit
C:\Windows\System\iqKFsqX.exe

Filesize
1.7MB

MD5
7937d93638ac58cf724cee7239680c6d

SHA1
f44a3a9c341d149d800c3221d964c172c01d8ab2

SHA256
e3b4f914dd79fd9de648e5602f6ae3ee37ba0855e12cc4d5db29c17e22ddc6c9

SHA512
69917a514801ec8642a2f9cfd04ba6af2f54f5d89be002e8a3f6e1cf17ba56d45b78fcc0beb92d1a5d925b706478a0bc98874cdc9bccda64cd515206221c4f87

Download Submit
C:\Windows\System\jUhehlv.exe

Filesize
1.7MB

MD5
d1ed97e06f6b2875e9acc8791435d7b9

SHA1
3606a2cf45e6e1b4c642f9f4e89e7c8412b2a61c

SHA256
0c6024d8b90a874fdfb2d999d1f6536e094944bf6134c8bede7c7a4970686c02

SHA512
a5b60642c30cb59f8d3dec3cc8e0a01706fc3275aceb94814069b8c669a33605e32df021adaa9548870330fce4ab325e566d4d13d28a72d267725a4dc00737eb

Download Submit
C:\Windows\System\jaMmiwQ.exe

Filesize
1.7MB

MD5
78d7a2c1f6947885ebbb3861dd4f9823

SHA1
a294ac39b24d3e9ca6e68bee244d3b9221838826

SHA256
b325f4380825959e87b0a295e82bf0553d3639db5734526c3ff1ea9e0572d47a

SHA512
437a5cfbad43a2dd7a9ba89cc61c9abcef913a3ae4d3389e12082703be7d7296125a37da9fd52d7a0cae443f2f78d568df1611ccc4ef7cfa5e690eddf43685c1

Download Submit
C:\Windows\System\kvxMssK.exe

Filesize
1.7MB

MD5
7028976f5510e6b00dd2894a07edbfa6

SHA1
5072dda2b330da6acbe601789719b4bbc999e1f1

SHA256
17c69b3db663a9781d8d2e8cf901697cc90c0c9fa1ae1d13f87308aab797a88d

SHA512
af365eb30b4f630b02886d0378bdb262967b9358e4d6ffa52dee900efb93a4e7af2920d1a2a8d532b6b044dcaa81512712b03d85d8b4d3119f4ecb0cd208b07f

Download Submit
C:\Windows\System\lCjRrNe.exe

Filesize
1.7MB

MD5
e72bae171cbbbb9206b7d7e9f0adc8ee

SHA1
e10b61f2f8299004df59186320c1546926577f3d

SHA256
37d4f29de043463faf934c4de5f5114ba76daf261d0f43b4fdbc8686c9c6e075

SHA512
27a78510e68f9b435419e8c39cbf30b388e29c2e44d5e8b4214e98233741ba8a0f71350b7b456c8a599512f934d380eb219cd2fc6a6d019c67e2002d3e897343

Download Submit
C:\Windows\System\ouhEiZw.exe

Filesize
1.7MB

MD5
48b9e6b175d5bb6525a6358e90aabef7

SHA1
a795c32ecbafc9976007877c3b62a929009c125a

SHA256
a6f1c5c49c44d6b96230dc136c48cc7859a6f1749aa41d07f7a65758c7220160

SHA512
b0c5f739e1b7ab3c2a01ac668bc3694f549041d85853deff25329e7db4d850e055c39c822e7cf48b835a7950c9a9e7090467a38d46ec40b6c3f60381b54118aa

Download Submit
C:\Windows\System\qMtUcSw.exe

Filesize
1.7MB

MD5
e79689dd3b0b0e32a76cce40d1f2e5ca

SHA1
08a2f53979baaba9b83cc2dd70e214f727b8a1b5

SHA256
7cd9cb4dd34cb3b519f660a7ed827ffb708dbb6a370ed325c4ec58f3b5b8261a

SHA512
f530192e892ade58f085ffc3a1e837f3c28b760ba485199b953724b57120f6e01ec5fb085a35844764f952a28bdac3edf77b9f63efd799f6b8ea59316d46d816

Download Submit
C:\Windows\System\qOBVhIO.exe

Filesize
1.7MB

MD5
8f6caf32b68ea8539c2695f30060cce8

SHA1
64a1d8580b38b7662ee02ee167a38f1c0b4eda90

SHA256
089994211bfe3b5f49463fd4777ac36a3b915099237c9e05aa712b002a6bea5e

SHA512
9df59fa1e0cb04f218458c0f5298d1ab269e45868b1166ac8b0cc1267075a9f81b716b117c060489c5c1898d7c220ea9eccc7a5043e7b37fc23e74c06c6e14bf

Download Submit
C:\Windows\System\qSqYkDA.exe

Filesize
1.7MB

MD5
396d2f8bcc67109ad9f16d4974f434dd

SHA1
3e76ad9921756bc4b0f57bee7baa698a7475beb7

SHA256
a8bd3fd595e7efcc143aa5c45eb432f04313312065cae1b2bf6b3bf4bb513241

SHA512
2254a1034bea6d87739e99c7a21735b97a999b7183da36c0db3f429e07eb6a8d9e336dde32d595b9e0999ce9179d042c088ae696f17bd1d0395f9014b78ab9aa

Download Submit
C:\Windows\System\qgyZaiZ.exe

Filesize
1.7MB

MD5
7a4bad8857adf43a03b5b5540208b54d

SHA1
bae7f43f3c4d141828d6b41e57271999816dd2dd

SHA256
59807f28cd8dda490b342cffefa3340c8d233f5f0220e84b3ac858233b7bcb5b

SHA512
0ec82fdb0841f276880e8cdb6b1c4980a8609b31c8decd12026c86aa049c2a9f9330c4de6b835fda44de8c0dc765d32a142de3e89e990496ab2d5b6bead8887a

Download Submit
C:\Windows\System\qwMpKfk.exe

Filesize
1.7MB

MD5
dbdf27057b4aeb46d9ce8bc0b552857e

SHA1
916dfb58ad921fa9273a2e309470a816994637b9

SHA256
47579f137aef3512e90a05d384ddc66eb083275fb2e2c1d1ba1c5cdf26e419f3

SHA512
77b9bcbd630a237c2adbe4871977ee77c52b21ac96642083f11eee5c7cbd25be3d7af2886204eb27985a4f9531518e1e8fe7f80ccc098cb5e5dfcb41734865af

Download Submit
C:\Windows\System\sqzfjNh.exe

Filesize
1.7MB

MD5
0c297e6e93b031aacba0f581d14518a2

SHA1
5be6bb84fc41143150e53cfb562c0039e630f89d

SHA256
ac7f44f02d58659de8e1a40383301128796bab13400c6675587260bb722fe53a

SHA512
564b77cf6e0af53e13159778e17d42ed3b6eba6e5c9106c99ce09e4d0c199cfa9af87befc99426ecbdf0fd0290c5ac7658ae624661c5d8e1f847ef1213110147

Download Submit
C:\Windows\System\wTTBtPF.exe

Filesize
1.7MB

MD5
b53c308ece624f7c84a6f8798268bc92

SHA1
9d691ac6b823155a93199f75ecc987ed9dd3caae

SHA256
e3613166dbb01295fe66c324c01dfa089a9e8e2223c84c27ec61e247752789cb

SHA512
e23918c760a0fae297622e8c4e3be69f9ccd0f40d543797a0d72ee735d54b9a184d3edd6931ebde8569d5efb155153c9d22da049d63a96496797178b65c600b2

Download Submit
C:\Windows\System\xouloEw.exe

Filesize
1.7MB

MD5
bfc0c245c5e7d533cff983a457b55a0a

SHA1
1bb93f3ba95bd74fade5c534a98b221e32ef049c

SHA256
00a348ef50403a152632bb51b4146a67a7445416a7ddb6bcf354d9894c6e6bdf

SHA512
c236ffe13a595d4a13620f6cae77dc6369e61b3f7acab345c4b7f3d52d9f8f47b85a6fec731215d15c70982532b3cc676e51d16fffe4f2e202d3cbd42f8c9360

Download Submit
C:\Windows\System\yttzgmX.exe

Filesize
1.7MB

MD5
5d9117034f61be4867d998e05d2f0c8e

SHA1
f54b2a0dfad093cb45eb48c79df2bee90c0cda83

SHA256
9634359d9108b8a8c5491bfbfc861f0d115c87662cc874dbce260014c7a6d029

SHA512
ed83a020125e80978dda20125756c7fd94a831ea28e65c5b44b52f281e204ec470354133627b39c5534e2736c552e4d05a3b6bbf3356a55b5197638c7925de94

Download Submit
memory/4804-0-0x00000166F0D20000-0x00000166F0D30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads