xmrig | 80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
Size

1.9MB
MD5

c4f0442f822a0d6f711d809ce03045cc
SHA1

b780d2388d88d46c8511d9c6e2e619472112a23d
SHA256

80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d
SHA512

d7d85f318d586485a276f1eba18f6932cd0c25067cbe39ade4458bc607b2782a446fd1d5bb263e81c71ffd62694ebe5ae010d6230cd678020995a69e06ae8b8b
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ7pH+nw:GemTLkNdfE0pZyU

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

Processes:

resource	yara_rule
behavioral2/files/0x000c000000023b2f-2.dat	xmrig
behavioral2/files/0x000a000000023b92-9.dat	xmrig
behavioral2/files/0x000a000000023b93-13.dat	xmrig
behavioral2/files/0x000a000000023b94-19.dat	xmrig
behavioral2/files/0x000a000000023b95-23.dat	xmrig
behavioral2/files/0x000a000000023b96-29.dat	xmrig
behavioral2/files/0x000a000000023b97-32.dat	xmrig
behavioral2/files/0x000a000000023b98-37.dat	xmrig
behavioral2/files/0x000a000000023b99-47.dat	xmrig
behavioral2/files/0x000a000000023b9b-51.dat	xmrig
behavioral2/files/0x000a000000023b9a-55.dat	xmrig
behavioral2/files/0x000b000000023b8f-70.dat	xmrig
behavioral2/files/0x000a000000023b9f-74.dat	xmrig
behavioral2/files/0x000a000000023ba0-79.dat	xmrig
behavioral2/files/0x000a000000023ba2-84.dat	xmrig
behavioral2/files/0x000a000000023ba1-89.dat	xmrig
behavioral2/files/0x000a000000023b9e-68.dat	xmrig
behavioral2/files/0x000a000000023b9c-62.dat	xmrig
behavioral2/files/0x000a000000023ba3-93.dat	xmrig
behavioral2/files/0x000d000000023ab2-102.dat	xmrig
behavioral2/files/0x001d000000023ab9-106.dat	xmrig
behavioral2/files/0x000f000000023aad-105.dat	xmrig
behavioral2/files/0x000a000000023ad3-113.dat	xmrig
behavioral2/files/0x000a000000023ba5-122.dat	xmrig
behavioral2/files/0x000a000000023ba4-136.dat	xmrig
behavioral2/files/0x000b000000023ba9-144.dat	xmrig
behavioral2/files/0x000b000000023baa-149.dat	xmrig
behavioral2/files/0x000a000000023ba7-145.dat	xmrig
behavioral2/files/0x000a000000023ba8-140.dat	xmrig
behavioral2/files/0x000a000000023ba6-132.dat	xmrig
behavioral2/files/0x000b000000023bab-154.dat	xmrig
behavioral2/files/0x000a000000023bb3-157.dat	xmrig
behavioral2/files/0x000e000000023bba-160.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

PIBdPMD.exeHNqSdtR.exerYMSSts.exeOIVxWQR.exezRYswWs.exetnvYBTY.exeaxvEjsv.exeCCxfuyn.exehVZoziU.exeXLtaPWo.exeeNENSNL.exePbIZnUo.exeOFUwDhW.exeVDerirW.exeZQLYurG.exeyZEcjlg.exeRxGOmOs.exeMWgJUtG.exeXTRNQsL.exehqiEcVP.exeUuElmqF.exeAYbxIFR.exeuJNEgZm.exeVeydSih.exeufXzLtl.exeKUnpxHQ.exevPeQqGh.exeozyATkH.exeDufqdvI.exeJVGAbTa.exeSyieCjo.exemxaaojB.exegMKUkoo.exetewuZOI.exexXzWbvj.exeFNuXZfN.exepLluYuL.exetCGIBYf.exeRXtVeiV.exebWEnLMF.exeLQVLtjd.exeLJXldpa.exeXcrpDzE.exetFxrNvY.exeYmtIHPA.exeFlLeBYj.exeYKDGIYS.exeamMRxhW.exeQlnNoHb.exeMMUTjUj.exefTfddFF.exegrheyGi.exeJpUVWbU.exeUvcVISe.exebLThvgx.exevHyMGra.exeUEOwWlV.exeHGrNzSM.exeNtYWyZo.exedLZJznJ.exeOIeFhPw.exelqHfMGj.exepcMsycX.exeZOJpnNK.exe

pid	Process
4588	PIBdPMD.exe
980	HNqSdtR.exe
2064	rYMSSts.exe
2792	OIVxWQR.exe
3224	zRYswWs.exe
2208	tnvYBTY.exe
1972	axvEjsv.exe
2588	CCxfuyn.exe
2620	hVZoziU.exe
4988	XLtaPWo.exe
1748	eNENSNL.exe
4936	PbIZnUo.exe
3080	OFUwDhW.exe
3468	VDerirW.exe
2772	ZQLYurG.exe
448	yZEcjlg.exe
3832	RxGOmOs.exe
3984	MWgJUtG.exe
3104	XTRNQsL.exe
3124	hqiEcVP.exe
1040	UuElmqF.exe
4696	AYbxIFR.exe
4864	uJNEgZm.exe
4488	VeydSih.exe
3516	ufXzLtl.exe
1376	KUnpxHQ.exe
3636	vPeQqGh.exe
3144	ozyATkH.exe
3112	DufqdvI.exe
1176	JVGAbTa.exe
4796	SyieCjo.exe
2368	mxaaojB.exe
4872	gMKUkoo.exe
4492	tewuZOI.exe
4620	xXzWbvj.exe
4656	FNuXZfN.exe
3016	pLluYuL.exe
4360	tCGIBYf.exe
424	RXtVeiV.exe
4164	bWEnLMF.exe
2900	LQVLtjd.exe
5068	LJXldpa.exe
2268	XcrpDzE.exe
2512	tFxrNvY.exe
1612	YmtIHPA.exe
548	FlLeBYj.exe
4192	YKDGIYS.exe
3200	amMRxhW.exe
320	QlnNoHb.exe
4944	MMUTjUj.exe
4772	fTfddFF.exe
3148	grheyGi.exe
952	JpUVWbU.exe
3256	UvcVISe.exe
2104	bLThvgx.exe
1828	vHyMGra.exe
1132	UEOwWlV.exe
4844	HGrNzSM.exe
3296	NtYWyZo.exe
4776	dLZJznJ.exe
964	OIeFhPw.exe
2844	lqHfMGj.exe
372	pcMsycX.exe
3876	ZOJpnNK.exe

Drops file in Windows directory 64 IoCs

Processes:

80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe

description	ioc	Process
File created	C:\Windows\System\vxLniHU.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\YUQdMJd.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\VSBQUCj.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\kHStxVB.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\nnuJnLe.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\FHSoMqg.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\aUhaIbB.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\kjNIsRP.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\QHqSmIA.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\nTlONtX.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\ugLDMBT.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\LPXgiXF.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\dDpuLsg.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\RBugsrj.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\cHYmVun.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\gfdzcBe.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\EKrwySD.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\WRshrtA.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\FyjOBJQ.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\dViXxeI.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\lQHtpCI.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\qVQMCkf.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\xcROYGv.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\ZfOjUQF.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\AsSEfrz.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\DqKTkoX.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\OBCYgNq.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\FCWWjcj.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\PHfehKQ.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\uTUOSGo.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\KiVjuaG.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\ZYKvrNc.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\kbCYFXy.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\nZlFJwY.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\QyrtCOd.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\rYzaTiV.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\HmXKIZL.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\YdUHLdn.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\uGjByfy.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\oUgXgTx.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\pzepLBO.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\DnrKLJO.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\AhFzYOE.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\XaDovqc.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\MufsGbX.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\itFMjFy.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\ggJEnMA.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\OJAoklj.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\mmbJzFA.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\JxbQlSl.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\hlmmnnz.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\RZEkHjh.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\JdZlFiD.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\wvszmbf.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\VOfnbWv.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\bZnnbAU.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\MxIfVlL.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\TpbBYvh.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\FDpKXXA.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\mfHfvCc.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\xfszYVE.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\qdxDoMc.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\PjQlcTz.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
File created	C:\Windows\System\GAboOsW.exe	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exedwm.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exedwm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

Processes:

dwm.exedwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

dwm.exedwm.exe

description	pid	Process
Token: SeCreateGlobalPrivilege	16392	dwm.exe
Token: SeChangeNotifyPrivilege	16392	dwm.exe
Token: 33	16392	dwm.exe
Token: SeIncBasePriorityPrivilege	16392	dwm.exe
Token: SeCreateGlobalPrivilege	15368	dwm.exe
Token: SeChangeNotifyPrivilege	15368	dwm.exe
Token: 33	15368	dwm.exe
Token: SeIncBasePriorityPrivilege	15368	dwm.exe
Token: SeShutdownPrivilege	15368	dwm.exe
Token: SeCreatePagefilePrivilege	15368	dwm.exe
Token: SeShutdownPrivilege	15368	dwm.exe
Token: SeCreatePagefilePrivilege	15368	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe

description	pid	Process	procid_target
PID 1672 wrote to memory of 4588	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	84
PID 1672 wrote to memory of 4588	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	84
PID 1672 wrote to memory of 980	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	85
PID 1672 wrote to memory of 980	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	85
PID 1672 wrote to memory of 2064	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	86
PID 1672 wrote to memory of 2064	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	86
PID 1672 wrote to memory of 2792	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	87
PID 1672 wrote to memory of 2792	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	87
PID 1672 wrote to memory of 3224	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	88
PID 1672 wrote to memory of 3224	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	88
PID 1672 wrote to memory of 2208	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	90
PID 1672 wrote to memory of 2208	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	90
PID 1672 wrote to memory of 1972	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	91
PID 1672 wrote to memory of 1972	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	91
PID 1672 wrote to memory of 2588	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	92
PID 1672 wrote to memory of 2588	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	92
PID 1672 wrote to memory of 2620	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	93
PID 1672 wrote to memory of 2620	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	93
PID 1672 wrote to memory of 4988	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	94
PID 1672 wrote to memory of 4988	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	94
PID 1672 wrote to memory of 1748	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	95
PID 1672 wrote to memory of 1748	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	95
PID 1672 wrote to memory of 4936	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	96
PID 1672 wrote to memory of 4936	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	96
PID 1672 wrote to memory of 3080	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	99
PID 1672 wrote to memory of 3080	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	99
PID 1672 wrote to memory of 3468	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	100
PID 1672 wrote to memory of 3468	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	100
PID 1672 wrote to memory of 2772	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	101
PID 1672 wrote to memory of 2772	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	101
PID 1672 wrote to memory of 448	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	102
PID 1672 wrote to memory of 448	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	102
PID 1672 wrote to memory of 3832	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	103
PID 1672 wrote to memory of 3832	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	103
PID 1672 wrote to memory of 3984	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	104
PID 1672 wrote to memory of 3984	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	104
PID 1672 wrote to memory of 3104	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	105
PID 1672 wrote to memory of 3104	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	105
PID 1672 wrote to memory of 3124	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	106
PID 1672 wrote to memory of 3124	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	106
PID 1672 wrote to memory of 1040	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	107
PID 1672 wrote to memory of 1040	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	107
PID 1672 wrote to memory of 4696	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	108
PID 1672 wrote to memory of 4696	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	108
PID 1672 wrote to memory of 4864	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	109
PID 1672 wrote to memory of 4864	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	109
PID 1672 wrote to memory of 4488	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	110
PID 1672 wrote to memory of 4488	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	110
PID 1672 wrote to memory of 3516	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	111
PID 1672 wrote to memory of 3516	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	111
PID 1672 wrote to memory of 1376	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	112
PID 1672 wrote to memory of 1376	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	112
PID 1672 wrote to memory of 3636	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	113
PID 1672 wrote to memory of 3636	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	113
PID 1672 wrote to memory of 3144	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	114
PID 1672 wrote to memory of 3144	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	114
PID 1672 wrote to memory of 3112	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	115
PID 1672 wrote to memory of 3112	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	115
PID 1672 wrote to memory of 1176	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	116
PID 1672 wrote to memory of 1176	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	116
PID 1672 wrote to memory of 4796	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	117
PID 1672 wrote to memory of 4796	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	117
PID 1672 wrote to memory of 2368	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	118
PID 1672 wrote to memory of 2368	1672	80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe	118

C:\Users\Admin\AppData\Local\Temp\80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe
"C:\Users\Admin\AppData\Local\Temp\80c66ad9ad561ac10e10812a3605d5f76bfbb0884076cf48de5256011206035d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\System\PIBdPMD.exe
  C:\Windows\System\PIBdPMD.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\HNqSdtR.exe
  C:\Windows\System\HNqSdtR.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\rYMSSts.exe
  C:\Windows\System\rYMSSts.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\OIVxWQR.exe
  C:\Windows\System\OIVxWQR.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\zRYswWs.exe
  C:\Windows\System\zRYswWs.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\tnvYBTY.exe
  C:\Windows\System\tnvYBTY.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\axvEjsv.exe
  C:\Windows\System\axvEjsv.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\CCxfuyn.exe
  C:\Windows\System\CCxfuyn.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\hVZoziU.exe
  C:\Windows\System\hVZoziU.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\XLtaPWo.exe
  C:\Windows\System\XLtaPWo.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\eNENSNL.exe
  C:\Windows\System\eNENSNL.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\PbIZnUo.exe
  C:\Windows\System\PbIZnUo.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\OFUwDhW.exe
  C:\Windows\System\OFUwDhW.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\VDerirW.exe
  C:\Windows\System\VDerirW.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\ZQLYurG.exe
  C:\Windows\System\ZQLYurG.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\yZEcjlg.exe
  C:\Windows\System\yZEcjlg.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\RxGOmOs.exe
  C:\Windows\System\RxGOmOs.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\MWgJUtG.exe
  C:\Windows\System\MWgJUtG.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\XTRNQsL.exe
  C:\Windows\System\XTRNQsL.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\hqiEcVP.exe
  C:\Windows\System\hqiEcVP.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\UuElmqF.exe
  C:\Windows\System\UuElmqF.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\AYbxIFR.exe
  C:\Windows\System\AYbxIFR.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\uJNEgZm.exe
  C:\Windows\System\uJNEgZm.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\VeydSih.exe
  C:\Windows\System\VeydSih.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\ufXzLtl.exe
  C:\Windows\System\ufXzLtl.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\KUnpxHQ.exe
  C:\Windows\System\KUnpxHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\vPeQqGh.exe
  C:\Windows\System\vPeQqGh.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\ozyATkH.exe
  C:\Windows\System\ozyATkH.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\DufqdvI.exe
  C:\Windows\System\DufqdvI.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\JVGAbTa.exe
  C:\Windows\System\JVGAbTa.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\SyieCjo.exe
  C:\Windows\System\SyieCjo.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\mxaaojB.exe
  C:\Windows\System\mxaaojB.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\gMKUkoo.exe
  C:\Windows\System\gMKUkoo.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\tewuZOI.exe
  C:\Windows\System\tewuZOI.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\xXzWbvj.exe
  C:\Windows\System\xXzWbvj.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\FNuXZfN.exe
  C:\Windows\System\FNuXZfN.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\pLluYuL.exe
  C:\Windows\System\pLluYuL.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\tCGIBYf.exe
  C:\Windows\System\tCGIBYf.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\RXtVeiV.exe
  C:\Windows\System\RXtVeiV.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\bWEnLMF.exe
  C:\Windows\System\bWEnLMF.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\LQVLtjd.exe
  C:\Windows\System\LQVLtjd.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\LJXldpa.exe
  C:\Windows\System\LJXldpa.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\XcrpDzE.exe
  C:\Windows\System\XcrpDzE.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\tFxrNvY.exe
  C:\Windows\System\tFxrNvY.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\YmtIHPA.exe
  C:\Windows\System\YmtIHPA.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\FlLeBYj.exe
  C:\Windows\System\FlLeBYj.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\YKDGIYS.exe
  C:\Windows\System\YKDGIYS.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\amMRxhW.exe
  C:\Windows\System\amMRxhW.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\QlnNoHb.exe
  C:\Windows\System\QlnNoHb.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\MMUTjUj.exe
  C:\Windows\System\MMUTjUj.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\fTfddFF.exe
  C:\Windows\System\fTfddFF.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\grheyGi.exe
  C:\Windows\System\grheyGi.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\JpUVWbU.exe
  C:\Windows\System\JpUVWbU.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\UvcVISe.exe
  C:\Windows\System\UvcVISe.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\bLThvgx.exe
  C:\Windows\System\bLThvgx.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\vHyMGra.exe
  C:\Windows\System\vHyMGra.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\UEOwWlV.exe
  C:\Windows\System\UEOwWlV.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\HGrNzSM.exe
  C:\Windows\System\HGrNzSM.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\NtYWyZo.exe
  C:\Windows\System\NtYWyZo.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\dLZJznJ.exe
  C:\Windows\System\dLZJznJ.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\OIeFhPw.exe
  C:\Windows\System\OIeFhPw.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\lqHfMGj.exe
  C:\Windows\System\lqHfMGj.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\pcMsycX.exe
  C:\Windows\System\pcMsycX.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\ZOJpnNK.exe
  C:\Windows\System\ZOJpnNK.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\nVCYoqe.exe
  C:\Windows\System\nVCYoqe.exe
  2⤵
  PID:4904
- C:\Windows\System\KBfkQfA.exe
  C:\Windows\System\KBfkQfA.exe
  2⤵
  PID:3416
- C:\Windows\System\mwjFIVS.exe
  C:\Windows\System\mwjFIVS.exe
  2⤵
  PID:3244
- C:\Windows\System\DJKJMau.exe
  C:\Windows\System\DJKJMau.exe
  2⤵
  PID:2916
- C:\Windows\System\GoRVWBv.exe
  C:\Windows\System\GoRVWBv.exe
  2⤵
  PID:344
- C:\Windows\System\ARJnkrT.exe
  C:\Windows\System\ARJnkrT.exe
  2⤵
  PID:3612
- C:\Windows\System\iASBQJX.exe
  C:\Windows\System\iASBQJX.exe
  2⤵
  PID:3900
- C:\Windows\System\BjhASKn.exe
  C:\Windows\System\BjhASKn.exe
  2⤵
  PID:4456
- C:\Windows\System\xQTwPYg.exe
  C:\Windows\System\xQTwPYg.exe
  2⤵
  PID:4616
- C:\Windows\System\OHXgLBZ.exe
  C:\Windows\System\OHXgLBZ.exe
  2⤵
  PID:772
- C:\Windows\System\dMyniCJ.exe
  C:\Windows\System\dMyniCJ.exe
  2⤵
  PID:3040
- C:\Windows\System\pWkQNIw.exe
  C:\Windows\System\pWkQNIw.exe
  2⤵
  PID:1076
- C:\Windows\System\VOfnbWv.exe
  C:\Windows\System\VOfnbWv.exe
  2⤵
  PID:3964
- C:\Windows\System\sPBGTFp.exe
  C:\Windows\System\sPBGTFp.exe
  2⤵
  PID:4100
- C:\Windows\System\gfdzcBe.exe
  C:\Windows\System\gfdzcBe.exe
  2⤵
  PID:3208
- C:\Windows\System\eDFJLEl.exe
  C:\Windows\System\eDFJLEl.exe
  2⤵
  PID:4168
- C:\Windows\System\kTTmDtR.exe
  C:\Windows\System\kTTmDtR.exe
  2⤵
  PID:1432
- C:\Windows\System\wiKentT.exe
  C:\Windows\System\wiKentT.exe
  2⤵
  PID:392
- C:\Windows\System\YoAqkId.exe
  C:\Windows\System\YoAqkId.exe
  2⤵
  PID:3404
- C:\Windows\System\DqKTkoX.exe
  C:\Windows\System\DqKTkoX.exe
  2⤵
  PID:2304
- C:\Windows\System\SnigImt.exe
  C:\Windows\System\SnigImt.exe
  2⤵
  PID:3188
- C:\Windows\System\PzDCKoB.exe
  C:\Windows\System\PzDCKoB.exe
  2⤵
  PID:740
- C:\Windows\System\jlhzjup.exe
  C:\Windows\System\jlhzjup.exe
  2⤵
  PID:4908
- C:\Windows\System\YTDxGob.exe
  C:\Windows\System\YTDxGob.exe
  2⤵
  PID:3408
- C:\Windows\System\zsnBsHQ.exe
  C:\Windows\System\zsnBsHQ.exe
  2⤵
  PID:3536
- C:\Windows\System\SgPLLgk.exe
  C:\Windows\System\SgPLLgk.exe
  2⤵
  PID:2928
- C:\Windows\System\wrXnziF.exe
  C:\Windows\System\wrXnziF.exe
  2⤵
  PID:3896
- C:\Windows\System\TgYamiN.exe
  C:\Windows\System\TgYamiN.exe
  2⤵
  PID:4920
- C:\Windows\System\WTYUyHj.exe
  C:\Windows\System\WTYUyHj.exe
  2⤵
  PID:3584
- C:\Windows\System\sOzlQOH.exe
  C:\Windows\System\sOzlQOH.exe
  2⤵
  PID:2360
- C:\Windows\System\ZaxCVcW.exe
  C:\Windows\System\ZaxCVcW.exe
  2⤵
  PID:3980
- C:\Windows\System\qBraQXT.exe
  C:\Windows\System\qBraQXT.exe
  2⤵
  PID:5128
- C:\Windows\System\hpGsDTI.exe
  C:\Windows\System\hpGsDTI.exe
  2⤵
  PID:5148
- C:\Windows\System\PPWGfGS.exe
  C:\Windows\System\PPWGfGS.exe
  2⤵
  PID:5192
- C:\Windows\System\ugLDMBT.exe
  C:\Windows\System\ugLDMBT.exe
  2⤵
  PID:5224
- C:\Windows\System\PeHjBGn.exe
  C:\Windows\System\PeHjBGn.exe
  2⤵
  PID:5252
- C:\Windows\System\BOdxbcy.exe
  C:\Windows\System\BOdxbcy.exe
  2⤵
  PID:5272
- C:\Windows\System\uosAucn.exe
  C:\Windows\System\uosAucn.exe
  2⤵
  PID:5308
- C:\Windows\System\NYJoYxd.exe
  C:\Windows\System\NYJoYxd.exe
  2⤵
  PID:5328
- C:\Windows\System\TssZLnT.exe
  C:\Windows\System\TssZLnT.exe
  2⤵
  PID:5348
- C:\Windows\System\nZlFJwY.exe
  C:\Windows\System\nZlFJwY.exe
  2⤵
  PID:5376
- C:\Windows\System\dwMXiUr.exe
  C:\Windows\System\dwMXiUr.exe
  2⤵
  PID:5400
- C:\Windows\System\mtcvYsB.exe
  C:\Windows\System\mtcvYsB.exe
  2⤵
  PID:5424
- C:\Windows\System\TCuZgnb.exe
  C:\Windows\System\TCuZgnb.exe
  2⤵
  PID:5456
- C:\Windows\System\BsZoKDk.exe
  C:\Windows\System\BsZoKDk.exe
  2⤵
  PID:5480
- C:\Windows\System\XyXztlF.exe
  C:\Windows\System\XyXztlF.exe
  2⤵
  PID:5516
- C:\Windows\System\UppVdrz.exe
  C:\Windows\System\UppVdrz.exe
  2⤵
  PID:5540
- C:\Windows\System\LbHSiob.exe
  C:\Windows\System\LbHSiob.exe
  2⤵
  PID:5568
- C:\Windows\System\xrlyriJ.exe
  C:\Windows\System\xrlyriJ.exe
  2⤵
  PID:5604
- C:\Windows\System\KxTHqSi.exe
  C:\Windows\System\KxTHqSi.exe
  2⤵
  PID:5628
- C:\Windows\System\aGnTMDE.exe
  C:\Windows\System\aGnTMDE.exe
  2⤵
  PID:5660
- C:\Windows\System\EYdKAjH.exe
  C:\Windows\System\EYdKAjH.exe
  2⤵
  PID:5692
- C:\Windows\System\XRxPRHQ.exe
  C:\Windows\System\XRxPRHQ.exe
  2⤵
  PID:5716
- C:\Windows\System\QmzWGmr.exe
  C:\Windows\System\QmzWGmr.exe
  2⤵
  PID:5748
- C:\Windows\System\ztBOikP.exe
  C:\Windows\System\ztBOikP.exe
  2⤵
  PID:5772
- C:\Windows\System\AYQeWHS.exe
  C:\Windows\System\AYQeWHS.exe
  2⤵
  PID:5804
- C:\Windows\System\ADTZvnb.exe
  C:\Windows\System\ADTZvnb.exe
  2⤵
  PID:5832
- C:\Windows\System\vxLniHU.exe
  C:\Windows\System\vxLniHU.exe
  2⤵
  PID:5868
- C:\Windows\System\aoLkVMA.exe
  C:\Windows\System\aoLkVMA.exe
  2⤵
  PID:5892
- C:\Windows\System\EWIxOzm.exe
  C:\Windows\System\EWIxOzm.exe
  2⤵
  PID:5940
- C:\Windows\System\HeUIEth.exe
  C:\Windows\System\HeUIEth.exe
  2⤵
  PID:5960
- C:\Windows\System\MmyfyQD.exe
  C:\Windows\System\MmyfyQD.exe
  2⤵
  PID:5984
- C:\Windows\System\RYrJPfl.exe
  C:\Windows\System\RYrJPfl.exe
  2⤵
  PID:6004
- C:\Windows\System\FtlpYNw.exe
  C:\Windows\System\FtlpYNw.exe
  2⤵
  PID:6028
- C:\Windows\System\ClewJPO.exe
  C:\Windows\System\ClewJPO.exe
  2⤵
  PID:6052
- C:\Windows\System\LAxCqVA.exe
  C:\Windows\System\LAxCqVA.exe
  2⤵
  PID:6080
- C:\Windows\System\JCYfcKE.exe
  C:\Windows\System\JCYfcKE.exe
  2⤵
  PID:6104
- C:\Windows\System\mDbSSVU.exe
  C:\Windows\System\mDbSSVU.exe
  2⤵
  PID:6124
- C:\Windows\System\ilZovTC.exe
  C:\Windows\System\ilZovTC.exe
  2⤵
  PID:1172
- C:\Windows\System\OHTUXUH.exe
  C:\Windows\System\OHTUXUH.exe
  2⤵
  PID:5180
- C:\Windows\System\OzAySkm.exe
  C:\Windows\System\OzAySkm.exe
  2⤵
  PID:5240
- C:\Windows\System\MiqQgjj.exe
  C:\Windows\System\MiqQgjj.exe
  2⤵
  PID:5304
- C:\Windows\System\dzYgXYy.exe
  C:\Windows\System\dzYgXYy.exe
  2⤵
  PID:5368
- C:\Windows\System\xVaVSEK.exe
  C:\Windows\System\xVaVSEK.exe
  2⤵
  PID:5488
- C:\Windows\System\FRhYhay.exe
  C:\Windows\System\FRhYhay.exe
  2⤵
  PID:5500
- C:\Windows\System\TpbBYvh.exe
  C:\Windows\System\TpbBYvh.exe
  2⤵
  PID:5580
- C:\Windows\System\ctgodMM.exe
  C:\Windows\System\ctgodMM.exe
  2⤵
  PID:5596
- C:\Windows\System\pXDuQNi.exe
  C:\Windows\System\pXDuQNi.exe
  2⤵
  PID:5712
- C:\Windows\System\SaOPuaD.exe
  C:\Windows\System\SaOPuaD.exe
  2⤵
  PID:5732
- C:\Windows\System\wvfWmGe.exe
  C:\Windows\System\wvfWmGe.exe
  2⤵
  PID:5792
- C:\Windows\System\OJAoklj.exe
  C:\Windows\System\OJAoklj.exe
  2⤵
  PID:5816
- C:\Windows\System\ZQCHORs.exe
  C:\Windows\System\ZQCHORs.exe
  2⤵
  PID:5924
- C:\Windows\System\xccmfJT.exe
  C:\Windows\System\xccmfJT.exe
  2⤵
  PID:5980
- C:\Windows\System\UneDpit.exe
  C:\Windows\System\UneDpit.exe
  2⤵
  PID:6000
- C:\Windows\System\JrhWINR.exe
  C:\Windows\System\JrhWINR.exe
  2⤵
  PID:6064
- C:\Windows\System\FryEKxz.exe
  C:\Windows\System\FryEKxz.exe
  2⤵
  PID:720
- C:\Windows\System\XCKrKtK.exe
  C:\Windows\System\XCKrKtK.exe
  2⤵
  PID:5280
- C:\Windows\System\vVOlRXl.exe
  C:\Windows\System\vVOlRXl.exe
  2⤵
  PID:5340
- C:\Windows\System\LNScxQx.exe
  C:\Windows\System\LNScxQx.exe
  2⤵
  PID:5616
- C:\Windows\System\mPhFwOE.exe
  C:\Windows\System\mPhFwOE.exe
  2⤵
  PID:5788
- C:\Windows\System\FkJxQNQ.exe
  C:\Windows\System\FkJxQNQ.exe
  2⤵
  PID:2100
- C:\Windows\System\dtVhaVt.exe
  C:\Windows\System\dtVhaVt.exe
  2⤵
  PID:5880
- C:\Windows\System\tBKRJHO.exe
  C:\Windows\System\tBKRJHO.exe
  2⤵
  PID:2496
- C:\Windows\System\CgLATrT.exe
  C:\Windows\System\CgLATrT.exe
  2⤵
  PID:5528
- C:\Windows\System\zaMsgAJ.exe
  C:\Windows\System\zaMsgAJ.exe
  2⤵
  PID:6152
- C:\Windows\System\OjWOrnd.exe
  C:\Windows\System\OjWOrnd.exe
  2⤵
  PID:6188
- C:\Windows\System\BuepSVZ.exe
  C:\Windows\System\BuepSVZ.exe
  2⤵
  PID:6204
- C:\Windows\System\mLcIIKr.exe
  C:\Windows\System\mLcIIKr.exe
  2⤵
  PID:6232
- C:\Windows\System\IvZubLO.exe
  C:\Windows\System\IvZubLO.exe
  2⤵
  PID:6248
- C:\Windows\System\oUsZiXu.exe
  C:\Windows\System\oUsZiXu.exe
  2⤵
  PID:6280
- C:\Windows\System\pyjYxLl.exe
  C:\Windows\System\pyjYxLl.exe
  2⤵
  PID:6304
- C:\Windows\System\FfelHHU.exe
  C:\Windows\System\FfelHHU.exe
  2⤵
  PID:6328
- C:\Windows\System\MhZkWry.exe
  C:\Windows\System\MhZkWry.exe
  2⤵
  PID:6380
- C:\Windows\System\Fsbzwap.exe
  C:\Windows\System\Fsbzwap.exe
  2⤵
  PID:6416
- C:\Windows\System\euQploB.exe
  C:\Windows\System\euQploB.exe
  2⤵
  PID:6448
- C:\Windows\System\NdmraDU.exe
  C:\Windows\System\NdmraDU.exe
  2⤵
  PID:6484
- C:\Windows\System\OBCYgNq.exe
  C:\Windows\System\OBCYgNq.exe
  2⤵
  PID:6508
- C:\Windows\System\gfwxTNb.exe
  C:\Windows\System\gfwxTNb.exe
  2⤵
  PID:6528
- C:\Windows\System\eEfrgvm.exe
  C:\Windows\System\eEfrgvm.exe
  2⤵
  PID:6556
- C:\Windows\System\PYcGDAF.exe
  C:\Windows\System\PYcGDAF.exe
  2⤵
  PID:6592
- C:\Windows\System\kAaaSJC.exe
  C:\Windows\System\kAaaSJC.exe
  2⤵
  PID:6616
- C:\Windows\System\dKseHPA.exe
  C:\Windows\System\dKseHPA.exe
  2⤵
  PID:6648
- C:\Windows\System\BZRovYf.exe
  C:\Windows\System\BZRovYf.exe
  2⤵
  PID:6676
- C:\Windows\System\BcnZgEl.exe
  C:\Windows\System\BcnZgEl.exe
  2⤵
  PID:6700
- C:\Windows\System\aOsFXBA.exe
  C:\Windows\System\aOsFXBA.exe
  2⤵
  PID:6732
- C:\Windows\System\ashPzFp.exe
  C:\Windows\System\ashPzFp.exe
  2⤵
  PID:6764
- C:\Windows\System\fkflfSv.exe
  C:\Windows\System\fkflfSv.exe
  2⤵
  PID:6788
- C:\Windows\System\GqyFjpy.exe
  C:\Windows\System\GqyFjpy.exe
  2⤵
  PID:6812
- C:\Windows\System\jkXUGOq.exe
  C:\Windows\System\jkXUGOq.exe
  2⤵
  PID:6848
- C:\Windows\System\pEUTocZ.exe
  C:\Windows\System\pEUTocZ.exe
  2⤵
  PID:6872
- C:\Windows\System\nGYXhHi.exe
  C:\Windows\System\nGYXhHi.exe
  2⤵
  PID:6904
- C:\Windows\System\oXbcYpw.exe
  C:\Windows\System\oXbcYpw.exe
  2⤵
  PID:6924
- C:\Windows\System\zUEiLIz.exe
  C:\Windows\System\zUEiLIz.exe
  2⤵
  PID:6948
- C:\Windows\System\muwPDOB.exe
  C:\Windows\System\muwPDOB.exe
  2⤵
  PID:6976
- C:\Windows\System\YpzvTPW.exe
  C:\Windows\System\YpzvTPW.exe
  2⤵
  PID:6996
- C:\Windows\System\tdEEdrG.exe
  C:\Windows\System\tdEEdrG.exe
  2⤵
  PID:7036
- C:\Windows\System\YwxzwkZ.exe
  C:\Windows\System\YwxzwkZ.exe
  2⤵
  PID:7056
- C:\Windows\System\uTCRMNC.exe
  C:\Windows\System\uTCRMNC.exe
  2⤵
  PID:7088
- C:\Windows\System\fOxmXZM.exe
  C:\Windows\System\fOxmXZM.exe
  2⤵
  PID:7112
- C:\Windows\System\EUZumTO.exe
  C:\Windows\System\EUZumTO.exe
  2⤵
  PID:7148
- C:\Windows\System\hqmgiSJ.exe
  C:\Windows\System\hqmgiSJ.exe
  2⤵
  PID:5996
- C:\Windows\System\odcoNzE.exe
  C:\Windows\System\odcoNzE.exe
  2⤵
  PID:5588
- C:\Windows\System\GgJmeao.exe
  C:\Windows\System\GgJmeao.exe
  2⤵
  PID:4332
- C:\Windows\System\uSlajsZ.exe
  C:\Windows\System\uSlajsZ.exe
  2⤵
  PID:6276
- C:\Windows\System\zKSxwwy.exe
  C:\Windows\System\zKSxwwy.exe
  2⤵
  PID:6268
- C:\Windows\System\vmJjNLy.exe
  C:\Windows\System\vmJjNLy.exe
  2⤵
  PID:6316
- C:\Windows\System\iGpybOC.exe
  C:\Windows\System\iGpybOC.exe
  2⤵
  PID:6424
- C:\Windows\System\pZXJbfz.exe
  C:\Windows\System\pZXJbfz.exe
  2⤵
  PID:6500
- C:\Windows\System\SkPNOby.exe
  C:\Windows\System\SkPNOby.exe
  2⤵
  PID:6544
- C:\Windows\System\bYzHgcI.exe
  C:\Windows\System\bYzHgcI.exe
  2⤵
  PID:6636
- C:\Windows\System\QyrtCOd.exe
  C:\Windows\System\QyrtCOd.exe
  2⤵
  PID:6692
- C:\Windows\System\FKtXmXF.exe
  C:\Windows\System\FKtXmXF.exe
  2⤵
  PID:6804
- C:\Windows\System\qVQMCkf.exe
  C:\Windows\System\qVQMCkf.exe
  2⤵
  PID:6824
- C:\Windows\System\OszOENv.exe
  C:\Windows\System\OszOENv.exe
  2⤵
  PID:6912
- C:\Windows\System\XbBfKjK.exe
  C:\Windows\System\XbBfKjK.exe
  2⤵
  PID:7016
- C:\Windows\System\CIHcbdZ.exe
  C:\Windows\System\CIHcbdZ.exe
  2⤵
  PID:7052
- C:\Windows\System\sNqBkto.exe
  C:\Windows\System\sNqBkto.exe
  2⤵
  PID:7108
- C:\Windows\System\woGYqRY.exe
  C:\Windows\System\woGYqRY.exe
  2⤵
  PID:7140
- C:\Windows\System\ZFCrXBM.exe
  C:\Windows\System\ZFCrXBM.exe
  2⤵
  PID:6200
- C:\Windows\System\hmlfKtr.exe
  C:\Windows\System\hmlfKtr.exe
  2⤵
  PID:6356
- C:\Windows\System\KbhDCnk.exe
  C:\Windows\System\KbhDCnk.exe
  2⤵
  PID:6492
- C:\Windows\System\GxSEbGW.exe
  C:\Windows\System\GxSEbGW.exe
  2⤵
  PID:6564
- C:\Windows\System\ljVgnDn.exe
  C:\Windows\System\ljVgnDn.exe
  2⤵
  PID:6832
- C:\Windows\System\rAlafoD.exe
  C:\Windows\System\rAlafoD.exe
  2⤵
  PID:6972
- C:\Windows\System\WEZTPBo.exe
  C:\Windows\System\WEZTPBo.exe
  2⤵
  PID:7048
- C:\Windows\System\KnDWnmq.exe
  C:\Windows\System\KnDWnmq.exe
  2⤵
  PID:6216
- C:\Windows\System\tCOWOvU.exe
  C:\Windows\System\tCOWOvU.exe
  2⤵
  PID:6496
- C:\Windows\System\uizPCOg.exe
  C:\Windows\System\uizPCOg.exe
  2⤵
  PID:6444
- C:\Windows\System\bfaSjOy.exe
  C:\Windows\System\bfaSjOy.exe
  2⤵
  PID:6292
- C:\Windows\System\DkStwDT.exe
  C:\Windows\System\DkStwDT.exe
  2⤵
  PID:7188
- C:\Windows\System\grhzbFU.exe
  C:\Windows\System\grhzbFU.exe
  2⤵
  PID:7212
- C:\Windows\System\xcROYGv.exe
  C:\Windows\System\xcROYGv.exe
  2⤵
  PID:7252
- C:\Windows\System\KQANJWJ.exe
  C:\Windows\System\KQANJWJ.exe
  2⤵
  PID:7272
- C:\Windows\System\LJgXsCP.exe
  C:\Windows\System\LJgXsCP.exe
  2⤵
  PID:7292
- C:\Windows\System\mozeSOL.exe
  C:\Windows\System\mozeSOL.exe
  2⤵
  PID:7320
- C:\Windows\System\CVcftkr.exe
  C:\Windows\System\CVcftkr.exe
  2⤵
  PID:7348
- C:\Windows\System\JGhVVHt.exe
  C:\Windows\System\JGhVVHt.exe
  2⤵
  PID:7380
- C:\Windows\System\fyOHsAq.exe
  C:\Windows\System\fyOHsAq.exe
  2⤵
  PID:7412
- C:\Windows\System\LnLNahE.exe
  C:\Windows\System\LnLNahE.exe
  2⤵
  PID:7436
- C:\Windows\System\hYSbxyo.exe
  C:\Windows\System\hYSbxyo.exe
  2⤵
  PID:7472
- C:\Windows\System\PUjMStC.exe
  C:\Windows\System\PUjMStC.exe
  2⤵
  PID:7492
- C:\Windows\System\PBBxjFQ.exe
  C:\Windows\System\PBBxjFQ.exe
  2⤵
  PID:7512
- C:\Windows\System\IPrFcTp.exe
  C:\Windows\System\IPrFcTp.exe
  2⤵
  PID:7540
- C:\Windows\System\KKjaFyW.exe
  C:\Windows\System\KKjaFyW.exe
  2⤵
  PID:7568
- C:\Windows\System\FPrEHEO.exe
  C:\Windows\System\FPrEHEO.exe
  2⤵
  PID:7600
- C:\Windows\System\PHfehKQ.exe
  C:\Windows\System\PHfehKQ.exe
  2⤵
  PID:7636
- C:\Windows\System\nXeLbDk.exe
  C:\Windows\System\nXeLbDk.exe
  2⤵
  PID:7652
- C:\Windows\System\AhFzYOE.exe
  C:\Windows\System\AhFzYOE.exe
  2⤵
  PID:7680
- C:\Windows\System\TxOVLwX.exe
  C:\Windows\System\TxOVLwX.exe
  2⤵
  PID:7708
- C:\Windows\System\PFUBnFt.exe
  C:\Windows\System\PFUBnFt.exe
  2⤵
  PID:7736
- C:\Windows\System\PdLunSK.exe
  C:\Windows\System\PdLunSK.exe
  2⤵
  PID:7764
- C:\Windows\System\UhVMKNK.exe
  C:\Windows\System\UhVMKNK.exe
  2⤵
  PID:7792
- C:\Windows\System\xLJwenH.exe
  C:\Windows\System\xLJwenH.exe
  2⤵
  PID:7812
- C:\Windows\System\TVJjBhJ.exe
  C:\Windows\System\TVJjBhJ.exe
  2⤵
  PID:7840
- C:\Windows\System\pqohLBP.exe
  C:\Windows\System\pqohLBP.exe
  2⤵
  PID:7868
- C:\Windows\System\ViaRwXz.exe
  C:\Windows\System\ViaRwXz.exe
  2⤵
  PID:7900
- C:\Windows\System\hrLrnYm.exe
  C:\Windows\System\hrLrnYm.exe
  2⤵
  PID:7932
- C:\Windows\System\RVqaoqh.exe
  C:\Windows\System\RVqaoqh.exe
  2⤵
  PID:7960
- C:\Windows\System\fDoVXFa.exe
  C:\Windows\System\fDoVXFa.exe
  2⤵
  PID:7980
- C:\Windows\System\ZlGeUtN.exe
  C:\Windows\System\ZlGeUtN.exe
  2⤵
  PID:8004
- C:\Windows\System\ZRnqCvX.exe
  C:\Windows\System\ZRnqCvX.exe
  2⤵
  PID:8040
- C:\Windows\System\bqFrvZT.exe
  C:\Windows\System\bqFrvZT.exe
  2⤵
  PID:8072
- C:\Windows\System\rrBwZuw.exe
  C:\Windows\System\rrBwZuw.exe
  2⤵
  PID:8100
- C:\Windows\System\dXKCRKx.exe
  C:\Windows\System\dXKCRKx.exe
  2⤵
  PID:8124
- C:\Windows\System\mcyBUnK.exe
  C:\Windows\System\mcyBUnK.exe
  2⤵
  PID:8164
- C:\Windows\System\xKILlLG.exe
  C:\Windows\System\xKILlLG.exe
  2⤵
  PID:8188
- C:\Windows\System\vqUIElO.exe
  C:\Windows\System\vqUIElO.exe
  2⤵
  PID:7172
- C:\Windows\System\JhXVPaZ.exe
  C:\Windows\System\JhXVPaZ.exe
  2⤵
  PID:7236
- C:\Windows\System\gZzFsHD.exe
  C:\Windows\System\gZzFsHD.exe
  2⤵
  PID:7304
- C:\Windows\System\blCBtcV.exe
  C:\Windows\System\blCBtcV.exe
  2⤵
  PID:7328
- C:\Windows\System\PqRlNrX.exe
  C:\Windows\System\PqRlNrX.exe
  2⤵
  PID:7408
- C:\Windows\System\VrOIvKP.exe
  C:\Windows\System\VrOIvKP.exe
  2⤵
  PID:7468
- C:\Windows\System\Hhageoi.exe
  C:\Windows\System\Hhageoi.exe
  2⤵
  PID:7556
- C:\Windows\System\qUVSovo.exe
  C:\Windows\System\qUVSovo.exe
  2⤵
  PID:7584
- C:\Windows\System\MKfMlwh.exe
  C:\Windows\System\MKfMlwh.exe
  2⤵
  PID:7696
- C:\Windows\System\rOHWokt.exe
  C:\Windows\System\rOHWokt.exe
  2⤵
  PID:7732
- C:\Windows\System\pkMqGwI.exe
  C:\Windows\System\pkMqGwI.exe
  2⤵
  PID:7860
- C:\Windows\System\sQwZEsb.exe
  C:\Windows\System\sQwZEsb.exe
  2⤵
  PID:7896
- C:\Windows\System\jNNnNTE.exe
  C:\Windows\System\jNNnNTE.exe
  2⤵
  PID:8028
- C:\Windows\System\DGWzrSF.exe
  C:\Windows\System\DGWzrSF.exe
  2⤵
  PID:8012
- C:\Windows\System\LBtvIet.exe
  C:\Windows\System\LBtvIet.exe
  2⤵
  PID:8120
- C:\Windows\System\eVFHwuB.exe
  C:\Windows\System\eVFHwuB.exe
  2⤵
  PID:8156
- C:\Windows\System\VVJMoNj.exe
  C:\Windows\System\VVJMoNj.exe
  2⤵
  PID:5416
- C:\Windows\System\XaDovqc.exe
  C:\Windows\System\XaDovqc.exe
  2⤵
  PID:7376
- C:\Windows\System\jkRmqSo.exe
  C:\Windows\System\jkRmqSo.exe
  2⤵
  PID:7508
- C:\Windows\System\nsAVzpv.exe
  C:\Windows\System\nsAVzpv.exe
  2⤵
  PID:7620
- C:\Windows\System\qIjuGgq.exe
  C:\Windows\System\qIjuGgq.exe
  2⤵
  PID:7888
- C:\Windows\System\FKSdROL.exe
  C:\Windows\System\FKSdROL.exe
  2⤵
  PID:8060
- C:\Windows\System\hNyPQZH.exe
  C:\Windows\System\hNyPQZH.exe
  2⤵
  PID:7180
- C:\Windows\System\thPDkSR.exe
  C:\Windows\System\thPDkSR.exe
  2⤵
  PID:7400
- C:\Windows\System\tpIRSrf.exe
  C:\Windows\System\tpIRSrf.exe
  2⤵
  PID:7956
- C:\Windows\System\aIzMtDC.exe
  C:\Windows\System\aIzMtDC.exe
  2⤵
  PID:7244
- C:\Windows\System\CfDFHas.exe
  C:\Windows\System\CfDFHas.exe
  2⤵
  PID:8092
- C:\Windows\System\ZykXYbk.exe
  C:\Windows\System\ZykXYbk.exe
  2⤵
  PID:8224
- C:\Windows\System\dAganHJ.exe
  C:\Windows\System\dAganHJ.exe
  2⤵
  PID:8248
- C:\Windows\System\tAHvGiY.exe
  C:\Windows\System\tAHvGiY.exe
  2⤵
  PID:8268
- C:\Windows\System\hvxrOBw.exe
  C:\Windows\System\hvxrOBw.exe
  2⤵
  PID:8304
- C:\Windows\System\hjADSPF.exe
  C:\Windows\System\hjADSPF.exe
  2⤵
  PID:8328
- C:\Windows\System\TJEjRQt.exe
  C:\Windows\System\TJEjRQt.exe
  2⤵
  PID:8356
- C:\Windows\System\SUxHUTk.exe
  C:\Windows\System\SUxHUTk.exe
  2⤵
  PID:8380
- C:\Windows\System\dPJYgBR.exe
  C:\Windows\System\dPJYgBR.exe
  2⤵
  PID:8408
- C:\Windows\System\BusLvPr.exe
  C:\Windows\System\BusLvPr.exe
  2⤵
  PID:8444
- C:\Windows\System\qdxDoMc.exe
  C:\Windows\System\qdxDoMc.exe
  2⤵
  PID:8468
- C:\Windows\System\WRshrtA.exe
  C:\Windows\System\WRshrtA.exe
  2⤵
  PID:8500
- C:\Windows\System\cYoDACe.exe
  C:\Windows\System\cYoDACe.exe
  2⤵
  PID:8528
- C:\Windows\System\FexzPXA.exe
  C:\Windows\System\FexzPXA.exe
  2⤵
  PID:8544
- C:\Windows\System\zPEqrDX.exe
  C:\Windows\System\zPEqrDX.exe
  2⤵
  PID:8564
- C:\Windows\System\YELHgRu.exe
  C:\Windows\System\YELHgRu.exe
  2⤵
  PID:8600
- C:\Windows\System\uTUOSGo.exe
  C:\Windows\System\uTUOSGo.exe
  2⤵
  PID:8632
- C:\Windows\System\mmbJzFA.exe
  C:\Windows\System\mmbJzFA.exe
  2⤵
  PID:8652
- C:\Windows\System\MlekkQO.exe
  C:\Windows\System\MlekkQO.exe
  2⤵
  PID:8688
- C:\Windows\System\oglUvgK.exe
  C:\Windows\System\oglUvgK.exe
  2⤵
  PID:8708
- C:\Windows\System\ISaVaPx.exe
  C:\Windows\System\ISaVaPx.exe
  2⤵
  PID:8736
- C:\Windows\System\WmfELAT.exe
  C:\Windows\System\WmfELAT.exe
  2⤵
  PID:8756
- C:\Windows\System\zwVdOyR.exe
  C:\Windows\System\zwVdOyR.exe
  2⤵
  PID:8788
- C:\Windows\System\TZfJBXw.exe
  C:\Windows\System\TZfJBXw.exe
  2⤵
  PID:8816
- C:\Windows\System\FCmkONu.exe
  C:\Windows\System\FCmkONu.exe
  2⤵
  PID:8840
- C:\Windows\System\CxgyVGL.exe
  C:\Windows\System\CxgyVGL.exe
  2⤵
  PID:8872
- C:\Windows\System\ltVZexN.exe
  C:\Windows\System\ltVZexN.exe
  2⤵
  PID:8896
- C:\Windows\System\LwWsIWa.exe
  C:\Windows\System\LwWsIWa.exe
  2⤵
  PID:8936
- C:\Windows\System\corHukJ.exe
  C:\Windows\System\corHukJ.exe
  2⤵
  PID:8964
- C:\Windows\System\kRhKlhW.exe
  C:\Windows\System\kRhKlhW.exe
  2⤵
  PID:8984
- C:\Windows\System\ZjDynrW.exe
  C:\Windows\System\ZjDynrW.exe
  2⤵
  PID:9012
- C:\Windows\System\URHxohj.exe
  C:\Windows\System\URHxohj.exe
  2⤵
  PID:9032
- C:\Windows\System\hNUKMwm.exe
  C:\Windows\System\hNUKMwm.exe
  2⤵
  PID:9056
- C:\Windows\System\pAesQZU.exe
  C:\Windows\System\pAesQZU.exe
  2⤵
  PID:9084
- C:\Windows\System\FxcIBlK.exe
  C:\Windows\System\FxcIBlK.exe
  2⤵
  PID:9108
- C:\Windows\System\gAVwHsz.exe
  C:\Windows\System\gAVwHsz.exe
  2⤵
  PID:9136
- C:\Windows\System\oIcIcHH.exe
  C:\Windows\System\oIcIcHH.exe
  2⤵
  PID:9160
- C:\Windows\System\QgAkalJ.exe
  C:\Windows\System\QgAkalJ.exe
  2⤵
  PID:9188
- C:\Windows\System\hdAhcck.exe
  C:\Windows\System\hdAhcck.exe
  2⤵
  PID:7200
- C:\Windows\System\vnYJkmr.exe
  C:\Windows\System\vnYJkmr.exe
  2⤵
  PID:8204
- C:\Windows\System\rEVSDZO.exe
  C:\Windows\System\rEVSDZO.exe
  2⤵
  PID:8260
- C:\Windows\System\wfQifRU.exe
  C:\Windows\System\wfQifRU.exe
  2⤵
  PID:8340
- C:\Windows\System\GNJZXdm.exe
  C:\Windows\System\GNJZXdm.exe
  2⤵
  PID:8376
- C:\Windows\System\GbDymxL.exe
  C:\Windows\System\GbDymxL.exe
  2⤵
  PID:8424
- C:\Windows\System\IwODkVG.exe
  C:\Windows\System\IwODkVG.exe
  2⤵
  PID:8496
- C:\Windows\System\bMwDpoT.exe
  C:\Windows\System\bMwDpoT.exe
  2⤵
  PID:8588
- C:\Windows\System\dHNfDzV.exe
  C:\Windows\System\dHNfDzV.exe
  2⤵
  PID:8676
- C:\Windows\System\lWUtTmX.exe
  C:\Windows\System\lWUtTmX.exe
  2⤵
  PID:8724
- C:\Windows\System\HjtJuPe.exe
  C:\Windows\System\HjtJuPe.exe
  2⤵
  PID:8800
- C:\Windows\System\nbXobIv.exe
  C:\Windows\System\nbXobIv.exe
  2⤵
  PID:8884
- C:\Windows\System\VjZgsiS.exe
  C:\Windows\System\VjZgsiS.exe
  2⤵
  PID:8836
- C:\Windows\System\efuFZmR.exe
  C:\Windows\System\efuFZmR.exe
  2⤵
  PID:8948
- C:\Windows\System\yDOQjuh.exe
  C:\Windows\System\yDOQjuh.exe
  2⤵
  PID:9040
- C:\Windows\System\nhnLvKk.exe
  C:\Windows\System\nhnLvKk.exe
  2⤵
  PID:9096
- C:\Windows\System\KXxPotB.exe
  C:\Windows\System\KXxPotB.exe
  2⤵
  PID:9184
- C:\Windows\System\Yqhtwyn.exe
  C:\Windows\System\Yqhtwyn.exe
  2⤵
  PID:9144
- C:\Windows\System\DBstDEB.exe
  C:\Windows\System\DBstDEB.exe
  2⤵
  PID:8312
- C:\Windows\System\MYgiugA.exe
  C:\Windows\System\MYgiugA.exe
  2⤵
  PID:8616
- C:\Windows\System\GlhEBro.exe
  C:\Windows\System\GlhEBro.exe
  2⤵
  PID:8368
- C:\Windows\System\zHhAZdp.exe
  C:\Windows\System\zHhAZdp.exe
  2⤵
  PID:8832
- C:\Windows\System\bRROoRl.exe
  C:\Windows\System\bRROoRl.exe
  2⤵
  PID:8612
- C:\Windows\System\vKQGSTt.exe
  C:\Windows\System\vKQGSTt.exe
  2⤵
  PID:9132
- C:\Windows\System\HGTcVfM.exe
  C:\Windows\System\HGTcVfM.exe
  2⤵
  PID:8276
- C:\Windows\System\rOmupKr.exe
  C:\Windows\System\rOmupKr.exe
  2⤵
  PID:8704
- C:\Windows\System\vDxGAkg.exe
  C:\Windows\System\vDxGAkg.exe
  2⤵
  PID:9224
- C:\Windows\System\LPXgiXF.exe
  C:\Windows\System\LPXgiXF.exe
  2⤵
  PID:9256
- C:\Windows\System\hVLHxfL.exe
  C:\Windows\System\hVLHxfL.exe
  2⤵
  PID:9288
- C:\Windows\System\xerEHvX.exe
  C:\Windows\System\xerEHvX.exe
  2⤵
  PID:9312
- C:\Windows\System\pQLcNrO.exe
  C:\Windows\System\pQLcNrO.exe
  2⤵
  PID:9340
- C:\Windows\System\JxbQlSl.exe
  C:\Windows\System\JxbQlSl.exe
  2⤵
  PID:9376
- C:\Windows\System\NPToXHC.exe
  C:\Windows\System\NPToXHC.exe
  2⤵
  PID:9404
- C:\Windows\System\lbmkYUq.exe
  C:\Windows\System\lbmkYUq.exe
  2⤵
  PID:9432
- C:\Windows\System\XMQrUFP.exe
  C:\Windows\System\XMQrUFP.exe
  2⤵
  PID:9456
- C:\Windows\System\osmhRew.exe
  C:\Windows\System\osmhRew.exe
  2⤵
  PID:9488
- C:\Windows\System\VKHJWal.exe
  C:\Windows\System\VKHJWal.exe
  2⤵
  PID:9528
- C:\Windows\System\bZnnbAU.exe
  C:\Windows\System\bZnnbAU.exe
  2⤵
  PID:9608
- C:\Windows\System\jycRLnK.exe
  C:\Windows\System\jycRLnK.exe
  2⤵
  PID:9624
- C:\Windows\System\aUhaIbB.exe
  C:\Windows\System\aUhaIbB.exe
  2⤵
  PID:9652
- C:\Windows\System\GiXXUTw.exe
  C:\Windows\System\GiXXUTw.exe
  2⤵
  PID:9672
- C:\Windows\System\Rmutzju.exe
  C:\Windows\System\Rmutzju.exe
  2⤵
  PID:9696
- C:\Windows\System\ReouVZP.exe
  C:\Windows\System\ReouVZP.exe
  2⤵
  PID:9728
- C:\Windows\System\dDpuLsg.exe
  C:\Windows\System\dDpuLsg.exe
  2⤵
  PID:9752
- C:\Windows\System\XDJWmQF.exe
  C:\Windows\System\XDJWmQF.exe
  2⤵
  PID:9788
- C:\Windows\System\BuqAJnI.exe
  C:\Windows\System\BuqAJnI.exe
  2⤵
  PID:9812
- C:\Windows\System\qtgcwFs.exe
  C:\Windows\System\qtgcwFs.exe
  2⤵
  PID:9836
- C:\Windows\System\kjNIsRP.exe
  C:\Windows\System\kjNIsRP.exe
  2⤵
  PID:9864
- C:\Windows\System\sZEsYuD.exe
  C:\Windows\System\sZEsYuD.exe
  2⤵
  PID:9892
- C:\Windows\System\CpRbIEU.exe
  C:\Windows\System\CpRbIEU.exe
  2⤵
  PID:9912
- C:\Windows\System\cZbmEqS.exe
  C:\Windows\System\cZbmEqS.exe
  2⤵
  PID:9948
- C:\Windows\System\xHYRrXS.exe
  C:\Windows\System\xHYRrXS.exe
  2⤵
  PID:9972
- C:\Windows\System\gNJyxLp.exe
  C:\Windows\System\gNJyxLp.exe
  2⤵
  PID:10004
- C:\Windows\System\VMTfJQQ.exe
  C:\Windows\System\VMTfJQQ.exe
  2⤵
  PID:10032
- C:\Windows\System\zShmbIA.exe
  C:\Windows\System\zShmbIA.exe
  2⤵
  PID:10060
- C:\Windows\System\VBDjYaq.exe
  C:\Windows\System\VBDjYaq.exe
  2⤵
  PID:10092
- C:\Windows\System\FNjiJul.exe
  C:\Windows\System\FNjiJul.exe
  2⤵
  PID:10116
- C:\Windows\System\FVQZgvS.exe
  C:\Windows\System\FVQZgvS.exe
  2⤵
  PID:10144
- C:\Windows\System\gldfnfv.exe
  C:\Windows\System\gldfnfv.exe
  2⤵
  PID:10176
- C:\Windows\System\YUQdMJd.exe
  C:\Windows\System\YUQdMJd.exe
  2⤵
  PID:10204
- C:\Windows\System\GKGZAPd.exe
  C:\Windows\System\GKGZAPd.exe
  2⤵
  PID:10228
- C:\Windows\System\iThqLzJ.exe
  C:\Windows\System\iThqLzJ.exe
  2⤵
  PID:9120
- C:\Windows\System\KDLzqgL.exe
  C:\Windows\System\KDLzqgL.exe
  2⤵
  PID:9236
- C:\Windows\System\eCDZXRa.exe
  C:\Windows\System\eCDZXRa.exe
  2⤵
  PID:8620
- C:\Windows\System\zTlkUzp.exe
  C:\Windows\System\zTlkUzp.exe
  2⤵
  PID:9364
- C:\Windows\System\DStuKgO.exe
  C:\Windows\System\DStuKgO.exe
  2⤵
  PID:9440
- C:\Windows\System\xftgcoL.exe
  C:\Windows\System\xftgcoL.exe
  2⤵
  PID:9508
- C:\Windows\System\JGoCAyO.exe
  C:\Windows\System\JGoCAyO.exe
  2⤵
  PID:9540
- C:\Windows\System\DNhvdOy.exe
  C:\Windows\System\DNhvdOy.exe
  2⤵
  PID:9620
- C:\Windows\System\UyxEAFm.exe
  C:\Windows\System\UyxEAFm.exe
  2⤵
  PID:9704
- C:\Windows\System\HiFlJSR.exe
  C:\Windows\System\HiFlJSR.exe
  2⤵
  PID:9736
- C:\Windows\System\zYagqry.exe
  C:\Windows\System\zYagqry.exe
  2⤵
  PID:9744
- C:\Windows\System\nfxtoRM.exe
  C:\Windows\System\nfxtoRM.exe
  2⤵
  PID:9852
- C:\Windows\System\QjRCTbX.exe
  C:\Windows\System\QjRCTbX.exe
  2⤵
  PID:9944
- C:\Windows\System\fTRNEsf.exe
  C:\Windows\System\fTRNEsf.exe
  2⤵
  PID:9992
- C:\Windows\System\PjQlcTz.exe
  C:\Windows\System\PjQlcTz.exe
  2⤵
  PID:10084
- C:\Windows\System\WtsGojj.exe
  C:\Windows\System\WtsGojj.exe
  2⤵
  PID:10140
- C:\Windows\System\tdAviPd.exe
  C:\Windows\System\tdAviPd.exe
  2⤵
  PID:10212
- C:\Windows\System\mTxVwDl.exe
  C:\Windows\System\mTxVwDl.exe
  2⤵
  PID:9220
- C:\Windows\System\GftDqYA.exe
  C:\Windows\System\GftDqYA.exe
  2⤵
  PID:9384
- C:\Windows\System\nDHqHZH.exe
  C:\Windows\System\nDHqHZH.exe
  2⤵
  PID:9484
- C:\Windows\System\MufsGbX.exe
  C:\Windows\System\MufsGbX.exe
  2⤵
  PID:9648
- C:\Windows\System\pSbdUMh.exe
  C:\Windows\System\pSbdUMh.exe
  2⤵
  PID:9776
- C:\Windows\System\FDpKXXA.exe
  C:\Windows\System\FDpKXXA.exe
  2⤵
  PID:9908
- C:\Windows\System\srXsoIP.exe
  C:\Windows\System\srXsoIP.exe
  2⤵
  PID:10040
- C:\Windows\System\aKpfsLM.exe
  C:\Windows\System\aKpfsLM.exe
  2⤵
  PID:10108
- C:\Windows\System\bLeNLJw.exe
  C:\Windows\System\bLeNLJw.exe
  2⤵
  PID:8732
- C:\Windows\System\bMnpBTo.exe
  C:\Windows\System\bMnpBTo.exe
  2⤵
  PID:9428
- C:\Windows\System\cVIuyHa.exe
  C:\Windows\System\cVIuyHa.exe
  2⤵
  PID:9984
- C:\Windows\System\sUppCLp.exe
  C:\Windows\System\sUppCLp.exe
  2⤵
  PID:10056
- C:\Windows\System\fgycKhC.exe
  C:\Windows\System\fgycKhC.exe
  2⤵
  PID:10264
- C:\Windows\System\SOgcPrd.exe
  C:\Windows\System\SOgcPrd.exe
  2⤵
  PID:10288
- C:\Windows\System\vHZQDtn.exe
  C:\Windows\System\vHZQDtn.exe
  2⤵
  PID:10320
- C:\Windows\System\reYrrkX.exe
  C:\Windows\System\reYrrkX.exe
  2⤵
  PID:10348
- C:\Windows\System\pEjIvCY.exe
  C:\Windows\System\pEjIvCY.exe
  2⤵
  PID:10376
- C:\Windows\System\prqaQPn.exe
  C:\Windows\System\prqaQPn.exe
  2⤵
  PID:10400
- C:\Windows\System\sQjnnrf.exe
  C:\Windows\System\sQjnnrf.exe
  2⤵
  PID:10420
- C:\Windows\System\HmrRwLi.exe
  C:\Windows\System\HmrRwLi.exe
  2⤵
  PID:10452
- C:\Windows\System\cxWcFAT.exe
  C:\Windows\System\cxWcFAT.exe
  2⤵
  PID:10480
- C:\Windows\System\EMXrNdw.exe
  C:\Windows\System\EMXrNdw.exe
  2⤵
  PID:10496
- C:\Windows\System\CcEtBSR.exe
  C:\Windows\System\CcEtBSR.exe
  2⤵
  PID:10536
- C:\Windows\System\RScYlnf.exe
  C:\Windows\System\RScYlnf.exe
  2⤵
  PID:10560
- C:\Windows\System\FbJymMF.exe
  C:\Windows\System\FbJymMF.exe
  2⤵
  PID:10584
- C:\Windows\System\xepaSZD.exe
  C:\Windows\System\xepaSZD.exe
  2⤵
  PID:10612
- C:\Windows\System\evfCkoy.exe
  C:\Windows\System\evfCkoy.exe
  2⤵
  PID:10640
- C:\Windows\System\okRgbSE.exe
  C:\Windows\System\okRgbSE.exe
  2⤵
  PID:10672
- C:\Windows\System\aOIbMTY.exe
  C:\Windows\System\aOIbMTY.exe
  2⤵
  PID:10696
- C:\Windows\System\daBfCoz.exe
  C:\Windows\System\daBfCoz.exe
  2⤵
  PID:10732
- C:\Windows\System\VSBQUCj.exe
  C:\Windows\System\VSBQUCj.exe
  2⤵
  PID:10756
- C:\Windows\System\CdlbJyp.exe
  C:\Windows\System\CdlbJyp.exe
  2⤵
  PID:10780
- C:\Windows\System\oqwiFcK.exe
  C:\Windows\System\oqwiFcK.exe
  2⤵
  PID:10804
- C:\Windows\System\tAnxCcs.exe
  C:\Windows\System\tAnxCcs.exe
  2⤵
  PID:10836
- C:\Windows\System\OoYLcGR.exe
  C:\Windows\System\OoYLcGR.exe
  2⤵
  PID:10868
- C:\Windows\System\rdeKlDZ.exe
  C:\Windows\System\rdeKlDZ.exe
  2⤵
  PID:10900
- C:\Windows\System\OFnRBpA.exe
  C:\Windows\System\OFnRBpA.exe
  2⤵
  PID:10936
- C:\Windows\System\JGGeIII.exe
  C:\Windows\System\JGGeIII.exe
  2⤵
  PID:10972
- C:\Windows\System\WMoImvb.exe
  C:\Windows\System\WMoImvb.exe
  2⤵
  PID:11004
- C:\Windows\System\EKrwySD.exe
  C:\Windows\System\EKrwySD.exe
  2⤵
  PID:11040
- C:\Windows\System\nvUQDIO.exe
  C:\Windows\System\nvUQDIO.exe
  2⤵
  PID:11072
- C:\Windows\System\BpZFuUL.exe
  C:\Windows\System\BpZFuUL.exe
  2⤵
  PID:11096
- C:\Windows\System\JWkSBgd.exe
  C:\Windows\System\JWkSBgd.exe
  2⤵
  PID:11136
- C:\Windows\System\wKVHOcP.exe
  C:\Windows\System\wKVHOcP.exe
  2⤵
  PID:11156
- C:\Windows\System\ZyWJLNp.exe
  C:\Windows\System\ZyWJLNp.exe
  2⤵
  PID:11184
- C:\Windows\System\LugZOZF.exe
  C:\Windows\System\LugZOZF.exe
  2⤵
  PID:11216
- C:\Windows\System\KrgDhih.exe
  C:\Windows\System\KrgDhih.exe
  2⤵
  PID:11248
- C:\Windows\System\SAMDqCS.exe
  C:\Windows\System\SAMDqCS.exe
  2⤵
  PID:9004
- C:\Windows\System\AXEZnVX.exe
  C:\Windows\System\AXEZnVX.exe
  2⤵
  PID:10104
- C:\Windows\System\egmoEUc.exe
  C:\Windows\System\egmoEUc.exe
  2⤵
  PID:9692
- C:\Windows\System\auMrRmi.exe
  C:\Windows\System\auMrRmi.exe
  2⤵
  PID:10256
- C:\Windows\System\OpdNthC.exe
  C:\Windows\System\OpdNthC.exe
  2⤵
  PID:10408
- C:\Windows\System\ZmePhxq.exe
  C:\Windows\System\ZmePhxq.exe
  2⤵
  PID:10492
- C:\Windows\System\DPxJzjE.exe
  C:\Windows\System\DPxJzjE.exe
  2⤵
  PID:10596
- C:\Windows\System\oAcVVpp.exe
  C:\Windows\System\oAcVVpp.exe
  2⤵
  PID:10576
- C:\Windows\System\uiksoIx.exe
  C:\Windows\System\uiksoIx.exe
  2⤵
  PID:10768
- C:\Windows\System\WRhGtbM.exe
  C:\Windows\System\WRhGtbM.exe
  2⤵
  PID:10800
- C:\Windows\System\xfszYVE.exe
  C:\Windows\System\xfszYVE.exe
  2⤵
  PID:10828
- C:\Windows\System\hlmmnnz.exe
  C:\Windows\System\hlmmnnz.exe
  2⤵
  PID:10964
- C:\Windows\System\LbaobeI.exe
  C:\Windows\System\LbaobeI.exe
  2⤵
  PID:10916
- C:\Windows\System\uywHOXl.exe
  C:\Windows\System\uywHOXl.exe
  2⤵
  PID:10992
- C:\Windows\System\HlGdIGa.exe
  C:\Windows\System\HlGdIGa.exe
  2⤵
  PID:11020
- C:\Windows\System\FADZhFB.exe
  C:\Windows\System\FADZhFB.exe
  2⤵
  PID:11088
- C:\Windows\System\wuYfZsc.exe
  C:\Windows\System\wuYfZsc.exe
  2⤵
  PID:11196
- C:\Windows\System\PFFUQQp.exe
  C:\Windows\System\PFFUQQp.exe
  2⤵
  PID:11240
- C:\Windows\System\dUvVCEe.exe
  C:\Windows\System\dUvVCEe.exe
  2⤵
  PID:10248
- C:\Windows\System\FhXPFtJ.exe
  C:\Windows\System\FhXPFtJ.exe
  2⤵
  PID:10388
- C:\Windows\System\TKcvoHh.exe
  C:\Windows\System\TKcvoHh.exe
  2⤵
  PID:10508
- C:\Windows\System\ewRSLqt.exe
  C:\Windows\System\ewRSLqt.exe
  2⤵
  PID:10664
- C:\Windows\System\HkkhgGc.exe
  C:\Windows\System\HkkhgGc.exe
  2⤵
  PID:10896
- C:\Windows\System\VJsQZXv.exe
  C:\Windows\System\VJsQZXv.exe
  2⤵
  PID:10988
- C:\Windows\System\pLnoaqa.exe
  C:\Windows\System\pLnoaqa.exe
  2⤵
  PID:11060
- C:\Windows\System\PnEbUJm.exe
  C:\Windows\System\PnEbUJm.exe
  2⤵
  PID:10440
- C:\Windows\System\HmXKIZL.exe
  C:\Windows\System\HmXKIZL.exe
  2⤵
  PID:10888
- C:\Windows\System\PLbSGIb.exe
  C:\Windows\System\PLbSGIb.exe
  2⤵
  PID:11200
- C:\Windows\System\DWkxLeo.exe
  C:\Windows\System\DWkxLeo.exe
  2⤵
  PID:11288
- C:\Windows\System\aMqXcDV.exe
  C:\Windows\System\aMqXcDV.exe
  2⤵
  PID:11316
- C:\Windows\System\ijTjLcN.exe
  C:\Windows\System\ijTjLcN.exe
  2⤵
  PID:11332
- C:\Windows\System\gkDrelw.exe
  C:\Windows\System\gkDrelw.exe
  2⤵
  PID:11364
- C:\Windows\System\EonFJke.exe
  C:\Windows\System\EonFJke.exe
  2⤵
  PID:11404
- C:\Windows\System\itFMjFy.exe
  C:\Windows\System\itFMjFy.exe
  2⤵
  PID:11432
- C:\Windows\System\iqthQHa.exe
  C:\Windows\System\iqthQHa.exe
  2⤵
  PID:11460
- C:\Windows\System\HDtZCis.exe
  C:\Windows\System\HDtZCis.exe
  2⤵
  PID:11488
- C:\Windows\System\zJrwNtv.exe
  C:\Windows\System\zJrwNtv.exe
  2⤵
  PID:11512
- C:\Windows\System\gHZZfUI.exe
  C:\Windows\System\gHZZfUI.exe
  2⤵
  PID:11544
- C:\Windows\System\wzVoEIz.exe
  C:\Windows\System\wzVoEIz.exe
  2⤵
  PID:11568
- C:\Windows\System\ZiJaVTm.exe
  C:\Windows\System\ZiJaVTm.exe
  2⤵
  PID:11596
- C:\Windows\System\wmOEjHy.exe
  C:\Windows\System\wmOEjHy.exe
  2⤵
  PID:11624
- C:\Windows\System\YdUHLdn.exe
  C:\Windows\System\YdUHLdn.exe
  2⤵
  PID:11648
- C:\Windows\System\jEpHkyb.exe
  C:\Windows\System\jEpHkyb.exe
  2⤵
  PID:11668
- C:\Windows\System\DNVpXIK.exe
  C:\Windows\System\DNVpXIK.exe
  2⤵
  PID:11696
- C:\Windows\System\lTbIPAo.exe
  C:\Windows\System\lTbIPAo.exe
  2⤵
  PID:11724
- C:\Windows\System\ndrtAvf.exe
  C:\Windows\System\ndrtAvf.exe
  2⤵
  PID:11748
- C:\Windows\System\CsWLrbe.exe
  C:\Windows\System\CsWLrbe.exe
  2⤵
  PID:11784
- C:\Windows\System\mAjgfOa.exe
  C:\Windows\System\mAjgfOa.exe
  2⤵
  PID:11812
- C:\Windows\System\kzJtAhu.exe
  C:\Windows\System\kzJtAhu.exe
  2⤵
  PID:11844
- C:\Windows\System\jJBjYLX.exe
  C:\Windows\System\jJBjYLX.exe
  2⤵
  PID:11884
- C:\Windows\System\tZJsYcK.exe
  C:\Windows\System\tZJsYcK.exe
  2⤵
  PID:11912
- C:\Windows\System\QKPUWvT.exe
  C:\Windows\System\QKPUWvT.exe
  2⤵
  PID:11932
- C:\Windows\System\LtrfRcQ.exe
  C:\Windows\System\LtrfRcQ.exe
  2⤵
  PID:11956
- C:\Windows\System\aEcFAic.exe
  C:\Windows\System\aEcFAic.exe
  2⤵
  PID:11984
- C:\Windows\System\RwOjnFG.exe
  C:\Windows\System\RwOjnFG.exe
  2⤵
  PID:12016
- C:\Windows\System\yozoKtX.exe
  C:\Windows\System\yozoKtX.exe
  2⤵
  PID:12032
- C:\Windows\System\IuUFVFU.exe
  C:\Windows\System\IuUFVFU.exe
  2⤵
  PID:12052
- C:\Windows\System\HLxpWQL.exe
  C:\Windows\System\HLxpWQL.exe
  2⤵
  PID:12088
- C:\Windows\System\wlSYKxx.exe
  C:\Windows\System\wlSYKxx.exe
  2⤵
  PID:12112
- C:\Windows\System\OQMwtPj.exe
  C:\Windows\System\OQMwtPj.exe
  2⤵
  PID:12136
- C:\Windows\System\zydaHuJ.exe
  C:\Windows\System\zydaHuJ.exe
  2⤵
  PID:12164
- C:\Windows\System\FDaIzYa.exe
  C:\Windows\System\FDaIzYa.exe
  2⤵
  PID:12188
- C:\Windows\System\HqygrSN.exe
  C:\Windows\System\HqygrSN.exe
  2⤵
  PID:12232
- C:\Windows\System\oRGiizQ.exe
  C:\Windows\System\oRGiizQ.exe
  2⤵
  PID:12260
- C:\Windows\System\yrbjkUr.exe
  C:\Windows\System\yrbjkUr.exe
  2⤵
  PID:12284
- C:\Windows\System\UaPSnSW.exe
  C:\Windows\System\UaPSnSW.exe
  2⤵
  PID:11056
- C:\Windows\System\pngbnUI.exe
  C:\Windows\System\pngbnUI.exe
  2⤵
  PID:11300
- C:\Windows\System\qItFeCi.exe
  C:\Windows\System\qItFeCi.exe
  2⤵
  PID:11356
- C:\Windows\System\TgtEIHx.exe
  C:\Windows\System\TgtEIHx.exe
  2⤵
  PID:11424
- C:\Windows\System\YCaTyha.exe
  C:\Windows\System\YCaTyha.exe
  2⤵
  PID:11452
- C:\Windows\System\eHsUmtW.exe
  C:\Windows\System\eHsUmtW.exe
  2⤵
  PID:11564
- C:\Windows\System\WsXRtuk.exe
  C:\Windows\System\WsXRtuk.exe
  2⤵
  PID:11636
- C:\Windows\System\pxuMegc.exe
  C:\Windows\System\pxuMegc.exe
  2⤵
  PID:11792
- C:\Windows\System\drKuIIr.exe
  C:\Windows\System\drKuIIr.exe
  2⤵
  PID:11800
- C:\Windows\System\qIBKTIj.exe
  C:\Windows\System\qIBKTIj.exe
  2⤵
  PID:11876
- C:\Windows\System\Ypcapuq.exe
  C:\Windows\System\Ypcapuq.exe
  2⤵
  PID:11944
- C:\Windows\System\cvqKMOu.exe
  C:\Windows\System\cvqKMOu.exe
  2⤵
  PID:11996
- C:\Windows\System\YyAaIwQ.exe
  C:\Windows\System\YyAaIwQ.exe
  2⤵
  PID:12064
- C:\Windows\System\EmGxPaR.exe
  C:\Windows\System\EmGxPaR.exe
  2⤵
  PID:12072
- C:\Windows\System\PHSiyqx.exe
  C:\Windows\System\PHSiyqx.exe
  2⤵
  PID:12220
- C:\Windows\System\RJlzskL.exe
  C:\Windows\System\RJlzskL.exe
  2⤵
  PID:12240
- C:\Windows\System\xlTTSZY.exe
  C:\Windows\System\xlTTSZY.exe
  2⤵
  PID:10628
- C:\Windows\System\ZhxYXid.exe
  C:\Windows\System\ZhxYXid.exe
  2⤵
  PID:11500
- C:\Windows\System\EecUpKf.exe
  C:\Windows\System\EecUpKf.exe
  2⤵
  PID:11664
- C:\Windows\System\wuZYAxB.exe
  C:\Windows\System\wuZYAxB.exe
  2⤵
  PID:11736
- C:\Windows\System\uZXNhKg.exe
  C:\Windows\System\uZXNhKg.exe
  2⤵
  PID:11824
- C:\Windows\System\qXMESZM.exe
  C:\Windows\System\qXMESZM.exe
  2⤵
  PID:11952
- C:\Windows\System\pLhqCtN.exe
  C:\Windows\System\pLhqCtN.exe
  2⤵
  PID:12200
- C:\Windows\System\lLnUSsj.exe
  C:\Windows\System\lLnUSsj.exe
  2⤵
  PID:10304
- C:\Windows\System\MxIfVlL.exe
  C:\Windows\System\MxIfVlL.exe
  2⤵
  PID:11308
- C:\Windows\System\csqUsxt.exe
  C:\Windows\System\csqUsxt.exe
  2⤵
  PID:11504
- C:\Windows\System\CefaJVL.exe
  C:\Windows\System\CefaJVL.exe
  2⤵
  PID:12320
- C:\Windows\System\FtSSdYh.exe
  C:\Windows\System\FtSSdYh.exe
  2⤵
  PID:12344
- C:\Windows\System\fZKfqcK.exe
  C:\Windows\System\fZKfqcK.exe
  2⤵
  PID:12372
- C:\Windows\System\iawmFcp.exe
  C:\Windows\System\iawmFcp.exe
  2⤵
  PID:12408
- C:\Windows\System\oCxqdUn.exe
  C:\Windows\System\oCxqdUn.exe
  2⤵
  PID:12432
- C:\Windows\System\nMQvCVh.exe
  C:\Windows\System\nMQvCVh.exe
  2⤵
  PID:12456
- C:\Windows\System\cBIODEH.exe
  C:\Windows\System\cBIODEH.exe
  2⤵
  PID:12480
- C:\Windows\System\vkwWBgT.exe
  C:\Windows\System\vkwWBgT.exe
  2⤵
  PID:12512
- C:\Windows\System\jkVnsFU.exe
  C:\Windows\System\jkVnsFU.exe
  2⤵
  PID:12532
- C:\Windows\System\GAboOsW.exe
  C:\Windows\System\GAboOsW.exe
  2⤵
  PID:12548
- C:\Windows\System\iAigxbX.exe
  C:\Windows\System\iAigxbX.exe
  2⤵
  PID:12572
- C:\Windows\System\JHtUtwn.exe
  C:\Windows\System\JHtUtwn.exe
  2⤵
  PID:12612
- C:\Windows\System\HwaQBjU.exe
  C:\Windows\System\HwaQBjU.exe
  2⤵
  PID:12648
- C:\Windows\System\DIOPnPk.exe
  C:\Windows\System\DIOPnPk.exe
  2⤵
  PID:12680
- C:\Windows\System\wKUCvXW.exe
  C:\Windows\System\wKUCvXW.exe
  2⤵
  PID:12700
- C:\Windows\System\veUdTEt.exe
  C:\Windows\System\veUdTEt.exe
  2⤵
  PID:12732
- C:\Windows\System\QyYnsBP.exe
  C:\Windows\System\QyYnsBP.exe
  2⤵
  PID:12780
- C:\Windows\System\CZFuYQy.exe
  C:\Windows\System\CZFuYQy.exe
  2⤵
  PID:12816
- C:\Windows\System\idGQpJX.exe
  C:\Windows\System\idGQpJX.exe
  2⤵
  PID:12836
- C:\Windows\System\zzNPbzt.exe
  C:\Windows\System\zzNPbzt.exe
  2⤵
  PID:12860
- C:\Windows\System\BXuFCcq.exe
  C:\Windows\System\BXuFCcq.exe
  2⤵
  PID:12888
- C:\Windows\System\jnLaVHX.exe
  C:\Windows\System\jnLaVHX.exe
  2⤵
  PID:12916
- C:\Windows\System\zuoTKSM.exe
  C:\Windows\System\zuoTKSM.exe
  2⤵
  PID:12944
- C:\Windows\System\jLiLHcb.exe
  C:\Windows\System\jLiLHcb.exe
  2⤵
  PID:12976
- C:\Windows\System\zFbUYnI.exe
  C:\Windows\System\zFbUYnI.exe
  2⤵
  PID:13004
- C:\Windows\System\RZEkHjh.exe
  C:\Windows\System\RZEkHjh.exe
  2⤵
  PID:13032
- C:\Windows\System\xYfWXdN.exe
  C:\Windows\System\xYfWXdN.exe
  2⤵
  PID:13056
- C:\Windows\System\ekvXdyf.exe
  C:\Windows\System\ekvXdyf.exe
  2⤵
  PID:13076
- C:\Windows\System\NAGkkSo.exe
  C:\Windows\System\NAGkkSo.exe
  2⤵
  PID:13100
- C:\Windows\System\llClOEq.exe
  C:\Windows\System\llClOEq.exe
  2⤵
  PID:13132
- C:\Windows\System\YYoikIR.exe
  C:\Windows\System\YYoikIR.exe
  2⤵
  PID:13156
- C:\Windows\System\NprpKUO.exe
  C:\Windows\System\NprpKUO.exe
  2⤵
  PID:13184
- C:\Windows\System\vNRpfhu.exe
  C:\Windows\System\vNRpfhu.exe
  2⤵
  PID:13212
- C:\Windows\System\MvxNODl.exe
  C:\Windows\System\MvxNODl.exe
  2⤵
  PID:13232
- C:\Windows\System\wAahwij.exe
  C:\Windows\System\wAahwij.exe
  2⤵
  PID:13256
- C:\Windows\System\rYdlPTB.exe
  C:\Windows\System\rYdlPTB.exe
  2⤵
  PID:13288
- C:\Windows\System\xnMXIDE.exe
  C:\Windows\System\xnMXIDE.exe
  2⤵
  PID:13308
- C:\Windows\System\jEdioXI.exe
  C:\Windows\System\jEdioXI.exe
  2⤵
  PID:12076
- C:\Windows\System\sbnSKPB.exe
  C:\Windows\System\sbnSKPB.exe
  2⤵
  PID:12300
- C:\Windows\System\bFnIubW.exe
  C:\Windows\System\bFnIubW.exe
  2⤵
  PID:12332
- C:\Windows\System\CAMyZdq.exe
  C:\Windows\System\CAMyZdq.exe
  2⤵
  PID:12452
- C:\Windows\System\jAltjcs.exe
  C:\Windows\System\jAltjcs.exe
  2⤵
  PID:12524
- C:\Windows\System\OFqBFan.exe
  C:\Windows\System\OFqBFan.exe
  2⤵
  PID:12540
- C:\Windows\System\FgRRuef.exe
  C:\Windows\System\FgRRuef.exe
  2⤵
  PID:12596
- C:\Windows\System\wAihZFG.exe
  C:\Windows\System\wAihZFG.exe
  2⤵
  PID:12728
- C:\Windows\System\FGFTcYO.exe
  C:\Windows\System\FGFTcYO.exe
  2⤵
  PID:12800
- C:\Windows\System\qPBZVOV.exe
  C:\Windows\System\qPBZVOV.exe
  2⤵
  PID:12832
- C:\Windows\System\OAKbCyz.exe
  C:\Windows\System\OAKbCyz.exe
  2⤵
  PID:12880
- C:\Windows\System\zHFmWJA.exe
  C:\Windows\System\zHFmWJA.exe
  2⤵
  PID:12932
- C:\Windows\System\jQqqNVr.exe
  C:\Windows\System\jQqqNVr.exe
  2⤵
  PID:12960
- C:\Windows\System\Uabtvvx.exe
  C:\Windows\System\Uabtvvx.exe
  2⤵
  PID:13064
- C:\Windows\System\uYAwUGH.exe
  C:\Windows\System\uYAwUGH.exe
  2⤵
  PID:13096
- C:\Windows\System\rFsTIBC.exe
  C:\Windows\System\rFsTIBC.exe
  2⤵
  PID:13172
- C:\Windows\System\CSAuVZu.exe
  C:\Windows\System\CSAuVZu.exe
  2⤵
  PID:13272
- C:\Windows\System\HHjhPCH.exe
  C:\Windows\System\HHjhPCH.exe
  2⤵
  PID:13304
- C:\Windows\System\dDSgIuq.exe
  C:\Windows\System\dDSgIuq.exe
  2⤵
  PID:11444
- C:\Windows\System\PEnQbCY.exe
  C:\Windows\System\PEnQbCY.exe
  2⤵
  PID:13268
- C:\Windows\System\UKNiTJe.exe
  C:\Windows\System\UKNiTJe.exe
  2⤵
  PID:12444
- C:\Windows\System\wvddpIA.exe
  C:\Windows\System\wvddpIA.exe
  2⤵
  PID:12712
- C:\Windows\System\iUyxEFf.exe
  C:\Windows\System\iUyxEFf.exe
  2⤵
  PID:12852
- C:\Windows\System\zZxhPwR.exe
  C:\Windows\System\zZxhPwR.exe
  2⤵
  PID:13016
- C:\Windows\System\GEEclLo.exe
  C:\Windows\System\GEEclLo.exe
  2⤵
  PID:12876
- C:\Windows\System\NqVfPCM.exe
  C:\Windows\System\NqVfPCM.exe
  2⤵
  PID:11704
- C:\Windows\System\FOdHIXs.exe
  C:\Windows\System\FOdHIXs.exe
  2⤵
  PID:12592
- C:\Windows\System\doBJixb.exe
  C:\Windows\System\doBJixb.exe
  2⤵
  PID:12424
- C:\Windows\System\ZvPoUbw.exe
  C:\Windows\System\ZvPoUbw.exe
  2⤵
  PID:13300
- C:\Windows\System\HGicdmt.exe
  C:\Windows\System\HGicdmt.exe
  2⤵
  PID:13348
- C:\Windows\System\vLKrWNw.exe
  C:\Windows\System\vLKrWNw.exe
  2⤵
  PID:13372
- C:\Windows\System\KjCfFYs.exe
  C:\Windows\System\KjCfFYs.exe
  2⤵
  PID:13404
- C:\Windows\System\ObiYOef.exe
  C:\Windows\System\ObiYOef.exe
  2⤵
  PID:13436
- C:\Windows\System\yrBgADA.exe
  C:\Windows\System\yrBgADA.exe
  2⤵
  PID:13472
- C:\Windows\System\qimrKYd.exe
  C:\Windows\System\qimrKYd.exe
  2⤵
  PID:13508
- C:\Windows\System\LfCEchQ.exe
  C:\Windows\System\LfCEchQ.exe
  2⤵
  PID:13532
- C:\Windows\System\nPKSIyD.exe
  C:\Windows\System\nPKSIyD.exe
  2⤵
  PID:13564
- C:\Windows\System\reoIrrb.exe
  C:\Windows\System\reoIrrb.exe
  2⤵
  PID:13600
- C:\Windows\System\niuzpfy.exe
  C:\Windows\System\niuzpfy.exe
  2⤵
  PID:13632
- C:\Windows\System\IGTcROB.exe
  C:\Windows\System\IGTcROB.exe
  2⤵
  PID:13656
- C:\Windows\System\bIgCJqy.exe
  C:\Windows\System\bIgCJqy.exe
  2⤵
  PID:13688
- C:\Windows\System\xxWpZcM.exe
  C:\Windows\System\xxWpZcM.exe
  2⤵
  PID:13716
- C:\Windows\System\asfgjRF.exe
  C:\Windows\System\asfgjRF.exe
  2⤵
  PID:13736
- C:\Windows\System\iOGfMij.exe
  C:\Windows\System\iOGfMij.exe
  2⤵
  PID:13764
- C:\Windows\System\ZovYiix.exe
  C:\Windows\System\ZovYiix.exe
  2⤵
  PID:13792
- C:\Windows\System\vJlBPpt.exe
  C:\Windows\System\vJlBPpt.exe
  2⤵
  PID:13820
- C:\Windows\System\JdZlFiD.exe
  C:\Windows\System\JdZlFiD.exe
  2⤵
  PID:13844
- C:\Windows\System\bycTOYw.exe
  C:\Windows\System\bycTOYw.exe
  2⤵
  PID:13880
- C:\Windows\System\ixfzRLn.exe
  C:\Windows\System\ixfzRLn.exe
  2⤵
  PID:13908
- C:\Windows\System\rBEfmKV.exe
  C:\Windows\System\rBEfmKV.exe
  2⤵
  PID:13936
- C:\Windows\System\rQfIKNA.exe
  C:\Windows\System\rQfIKNA.exe
  2⤵
  PID:13960
- C:\Windows\System\HvhIsvl.exe
  C:\Windows\System\HvhIsvl.exe
  2⤵
  PID:13980
- C:\Windows\System\iWQKZMv.exe
  C:\Windows\System\iWQKZMv.exe
  2⤵
  PID:14004
- C:\Windows\System\LLDcDmA.exe
  C:\Windows\System\LLDcDmA.exe
  2⤵
  PID:14028
- C:\Windows\System\QHqSmIA.exe
  C:\Windows\System\QHqSmIA.exe
  2⤵
  PID:14048
- C:\Windows\System\mcAKqte.exe
  C:\Windows\System\mcAKqte.exe
  2⤵
  PID:14080
- C:\Windows\System\KZmQCuT.exe
  C:\Windows\System\KZmQCuT.exe
  2⤵
  PID:14104
- C:\Windows\System\uvUVgFO.exe
  C:\Windows\System\uvUVgFO.exe
  2⤵
  PID:14128
- C:\Windows\System\RpYCjaD.exe
  C:\Windows\System\RpYCjaD.exe
  2⤵
  PID:14156
- C:\Windows\System\lLHmroc.exe
  C:\Windows\System\lLHmroc.exe
  2⤵
  PID:14188
- C:\Windows\System\nTlONtX.exe
  C:\Windows\System\nTlONtX.exe
  2⤵
  PID:14204
- C:\Windows\System\RJiXOdf.exe
  C:\Windows\System\RJiXOdf.exe
  2⤵
  PID:14232
- C:\Windows\System\QIizpXU.exe
  C:\Windows\System\QIizpXU.exe
  2⤵
  PID:14264
- C:\Windows\System\FEpkSUd.exe
  C:\Windows\System\FEpkSUd.exe
  2⤵
  PID:14284
- C:\Windows\System\ggMorKg.exe
  C:\Windows\System\ggMorKg.exe
  2⤵
  PID:14300
- C:\Windows\System\cGopHJc.exe
  C:\Windows\System\cGopHJc.exe
  2⤵
  PID:14332
- C:\Windows\System\HohqlAF.exe
  C:\Windows\System\HohqlAF.exe
  2⤵
  PID:12756
- C:\Windows\System\fPULONO.exe
  C:\Windows\System\fPULONO.exe
  2⤵
  PID:13084
- C:\Windows\System\mvMLYGW.exe
  C:\Windows\System\mvMLYGW.exe
  2⤵
  PID:13432
- C:\Windows\System\eFJrsyv.exe
  C:\Windows\System\eFJrsyv.exe
  2⤵
  PID:13424
- C:\Windows\System\FgHSWoA.exe
  C:\Windows\System\FgHSWoA.exe
  2⤵
  PID:11616
- C:\Windows\System\EQIjGCZ.exe
  C:\Windows\System\EQIjGCZ.exe
  2⤵
  PID:13484
- C:\Windows\System\JFBwjnc.exe
  C:\Windows\System\JFBwjnc.exe
  2⤵
  PID:13648
- C:\Windows\System\KZWPIrr.exe
  C:\Windows\System\KZWPIrr.exe
  2⤵
  PID:13708
- C:\Windows\System\BgSVuRi.exe
  C:\Windows\System\BgSVuRi.exe
  2⤵
  PID:13668
- C:\Windows\System\vfLcBEi.exe
  C:\Windows\System\vfLcBEi.exe
  2⤵
  PID:13704
- C:\Windows\System\yFNkbjx.exe
  C:\Windows\System\yFNkbjx.exe
  2⤵
  PID:13868
- C:\Windows\System\HqZmvsc.exe
  C:\Windows\System\HqZmvsc.exe
  2⤵
  PID:13900
- C:\Windows\System\wdnaIdV.exe
  C:\Windows\System\wdnaIdV.exe
  2⤵
  PID:13968
- C:\Windows\System\DkWGSnR.exe
  C:\Windows\System\DkWGSnR.exe
  2⤵
  PID:13976
- C:\Windows\System\XpgIAzY.exe
  C:\Windows\System\XpgIAzY.exe
  2⤵
  PID:13992
- C:\Windows\System\JgYdDQy.exe
  C:\Windows\System\JgYdDQy.exe
  2⤵
  PID:14100
- C:\Windows\System\PUzyhEx.exe
  C:\Windows\System\PUzyhEx.exe
  2⤵
  PID:14196
- C:\Windows\System\DVcbNnA.exe
  C:\Windows\System\DVcbNnA.exe
  2⤵
  PID:14280
- C:\Windows\System\qnBhkvl.exe
  C:\Windows\System\qnBhkvl.exe
  2⤵
  PID:12584
- C:\Windows\System\ttilhcm.exe
  C:\Windows\System\ttilhcm.exe
  2⤵
  PID:13464
- C:\Windows\System\CAOBkIK.exe
  C:\Windows\System\CAOBkIK.exe
  2⤵
  PID:13560
- C:\Windows\System\gzmpqib.exe
  C:\Windows\System\gzmpqib.exe
  2⤵
  PID:13368
- C:\Windows\System\rYzaTiV.exe
  C:\Windows\System\rYzaTiV.exe
  2⤵
  PID:12560
- C:\Windows\System\nMAGlql.exe
  C:\Windows\System\nMAGlql.exe
  2⤵
  PID:14040
- C:\Windows\System\MRoTNEl.exe
  C:\Windows\System\MRoTNEl.exe
  2⤵
  PID:13776
- C:\Windows\System\SjAgiez.exe
  C:\Windows\System\SjAgiez.exe
  2⤵
  PID:12624
- C:\Windows\System\kyJzfNI.exe
  C:\Windows\System\kyJzfNI.exe
  2⤵
  PID:14364
- C:\Windows\System\xXeONrV.exe
  C:\Windows\System\xXeONrV.exe
  2⤵
  PID:14392
- C:\Windows\System\kGtUaST.exe
  C:\Windows\System\kGtUaST.exe
  2⤵
  PID:14420
- C:\Windows\System\bFHZmnH.exe
  C:\Windows\System\bFHZmnH.exe
  2⤵
  PID:14440
- C:\Windows\System\ZfOjUQF.exe
  C:\Windows\System\ZfOjUQF.exe
  2⤵
  PID:14468
- C:\Windows\System\xLUMtvY.exe
  C:\Windows\System\xLUMtvY.exe
  2⤵
  PID:14504
- C:\Windows\System\LFfOMOx.exe
  C:\Windows\System\LFfOMOx.exe
  2⤵
  PID:14528
- C:\Windows\System\ggJEnMA.exe
  C:\Windows\System\ggJEnMA.exe
  2⤵
  PID:14556
- C:\Windows\System\fTZcOJR.exe
  C:\Windows\System\fTZcOJR.exe
  2⤵
  PID:14580
- C:\Windows\System\rAVFKKd.exe
  C:\Windows\System\rAVFKKd.exe
  2⤵
  PID:14608
- C:\Windows\System\FPausPB.exe
  C:\Windows\System\FPausPB.exe
  2⤵
  PID:14636
- C:\Windows\System\UgPEfCy.exe
  C:\Windows\System\UgPEfCy.exe
  2⤵
  PID:14672
- C:\Windows\System\verfeqk.exe
  C:\Windows\System\verfeqk.exe
  2⤵
  PID:14692
- C:\Windows\System\KiVjuaG.exe
  C:\Windows\System\KiVjuaG.exe
  2⤵
  PID:14720
- C:\Windows\System\gHhlTUe.exe
  C:\Windows\System\gHhlTUe.exe
  2⤵
  PID:14752
- C:\Windows\System\wvszmbf.exe
  C:\Windows\System\wvszmbf.exe
  2⤵
  PID:14792
- C:\Windows\System\OewwBzW.exe
  C:\Windows\System\OewwBzW.exe
  2⤵
  PID:14816
- C:\Windows\System\fNXWFgJ.exe
  C:\Windows\System\fNXWFgJ.exe
  2⤵
  PID:14844
- C:\Windows\System\MZHuHOl.exe
  C:\Windows\System\MZHuHOl.exe
  2⤵
  PID:14876
- C:\Windows\System\DhGDnOk.exe
  C:\Windows\System\DhGDnOk.exe
  2⤵
  PID:14904
- C:\Windows\System\CFsqUyb.exe
  C:\Windows\System\CFsqUyb.exe
  2⤵
  PID:14936
- C:\Windows\System\kHStxVB.exe
  C:\Windows\System\kHStxVB.exe
  2⤵
  PID:14964
- C:\Windows\System\zuMuekQ.exe
  C:\Windows\System\zuMuekQ.exe
  2⤵
  PID:14992
- C:\Windows\System\TSMSqgZ.exe
  C:\Windows\System\TSMSqgZ.exe
  2⤵
  PID:15028
- C:\Windows\System\uuUuAjC.exe
  C:\Windows\System\uuUuAjC.exe
  2⤵
  PID:15052
- C:\Windows\System\PPaYHyR.exe
  C:\Windows\System\PPaYHyR.exe
  2⤵
  PID:15080
- C:\Windows\System\HDWwhKQ.exe
  C:\Windows\System\HDWwhKQ.exe
  2⤵
  PID:15108
- C:\Windows\System\LEOIoBe.exe
  C:\Windows\System\LEOIoBe.exe
  2⤵
  PID:15148
- C:\Windows\System\bMkGRtk.exe
  C:\Windows\System\bMkGRtk.exe
  2⤵
  PID:15168
- C:\Windows\System\VtyQqyu.exe
  C:\Windows\System\VtyQqyu.exe
  2⤵
  PID:15196
- C:\Windows\System\vmkhURb.exe
  C:\Windows\System\vmkhURb.exe
  2⤵
  PID:15216
- C:\Windows\System\kEsGGXC.exe
  C:\Windows\System\kEsGGXC.exe
  2⤵
  PID:15248
- C:\Windows\System\ysscYum.exe
  C:\Windows\System\ysscYum.exe
  2⤵
  PID:15272
- C:\Windows\System\wqRVsjI.exe
  C:\Windows\System\wqRVsjI.exe
  2⤵
  PID:15292
- C:\Windows\System\quErawq.exe
  C:\Windows\System\quErawq.exe
  2⤵
  PID:15320
- C:\Windows\System\nGRPNwE.exe
  C:\Windows\System\nGRPNwE.exe
  2⤵
  PID:15336
- C:\Windows\System\qNVxIqY.exe
  C:\Windows\System\qNVxIqY.exe
  2⤵
  PID:12904
- C:\Windows\System\BbkLiOq.exe
  C:\Windows\System\BbkLiOq.exe
  2⤵
  PID:14216
- C:\Windows\System\uOClajK.exe
  C:\Windows\System\uOClajK.exe
  2⤵
  PID:14176
- C:\Windows\System\MLdyHgZ.exe
  C:\Windows\System\MLdyHgZ.exe
  2⤵
  PID:13588
- C:\Windows\System\rfvKMnx.exe
  C:\Windows\System\rfvKMnx.exe
  2⤵
  PID:13616
- C:\Windows\System\ZVInngD.exe
  C:\Windows\System\ZVInngD.exe
  2⤵
  PID:14072
- C:\Windows\System\uqLSnRs.exe
  C:\Windows\System\uqLSnRs.exe
  2⤵
  PID:14492
- C:\Windows\System\TtaGwxx.exe
  C:\Windows\System\TtaGwxx.exe
  2⤵
  PID:14428
- C:\Windows\System\uGjByfy.exe
  C:\Windows\System\uGjByfy.exe
  2⤵
  PID:14604
- C:\Windows\System\kRIUSZU.exe
  C:\Windows\System\kRIUSZU.exe
  2⤵
  PID:14680
- C:\Windows\System\agXgCzp.exe
  C:\Windows\System\agXgCzp.exe
  2⤵
  PID:14552
- C:\Windows\System\wRDKDnA.exe
  C:\Windows\System\wRDKDnA.exe
  2⤵
  PID:14760
- C:\Windows\System\zZEmieM.exe
  C:\Windows\System\zZEmieM.exe
  2⤵
  PID:14856
- C:\Windows\System\giXkPPY.exe
  C:\Windows\System\giXkPPY.exe
  2⤵
  PID:15012
- C:\Windows\System\fgkfqRf.exe
  C:\Windows\System\fgkfqRf.exe
  2⤵
  PID:14668
- C:\Windows\System\BXQiBma.exe
  C:\Windows\System\BXQiBma.exe
  2⤵
  PID:15128
- C:\Windows\System\xuSNKsG.exe
  C:\Windows\System\xuSNKsG.exe
  2⤵
  PID:15160
- C:\Windows\System\FyjOBJQ.exe
  C:\Windows\System\FyjOBJQ.exe
  2⤵
  PID:14868
- C:\Windows\System\nurcsRV.exe
  C:\Windows\System\nurcsRV.exe
  2⤵
  PID:15136
- C:\Windows\System\MgyFtIw.exe
  C:\Windows\System\MgyFtIw.exe
  2⤵
  PID:15192
- C:\Windows\System\DrZBxAG.exe
  C:\Windows\System\DrZBxAG.exe
  2⤵
  PID:13620
- C:\Windows\System\xzPHyuR.exe
  C:\Windows\System\xzPHyuR.exe
  2⤵
  PID:15268
- C:\Windows\System\HRXZSEQ.exe
  C:\Windows\System\HRXZSEQ.exe
  2⤵
  PID:14092
- C:\Windows\System\nxtGROe.exe
  C:\Windows\System\nxtGROe.exe
  2⤵
  PID:14784
- C:\Windows\System\FtgYfpO.exe
  C:\Windows\System\FtgYfpO.exe
  2⤵
  PID:14872
- C:\Windows\System\iZdlMLB.exe
  C:\Windows\System\iZdlMLB.exe
  2⤵
  PID:15372
- C:\Windows\System\uvukraL.exe
  C:\Windows\System\uvukraL.exe
  2⤵
  PID:15400
- C:\Windows\System\DNhRpDX.exe
  C:\Windows\System\DNhRpDX.exe
  2⤵
  PID:15436
- C:\Windows\System\hJKkLFe.exe
  C:\Windows\System\hJKkLFe.exe
  2⤵
  PID:15464
- C:\Windows\System\yAJxOGr.exe
  C:\Windows\System\yAJxOGr.exe
  2⤵
  PID:15488
- C:\Windows\System\SwqkkTa.exe
  C:\Windows\System\SwqkkTa.exe
  2⤵
  PID:15516
- C:\Windows\System\ijTIfcH.exe
  C:\Windows\System\ijTIfcH.exe
  2⤵
  PID:15552
- C:\Windows\System\WSUuEpz.exe
  C:\Windows\System\WSUuEpz.exe
  2⤵
  PID:15572
- C:\Windows\System\BdMkgek.exe
  C:\Windows\System\BdMkgek.exe
  2⤵
  PID:15592
- C:\Windows\System\EIpVKWb.exe
  C:\Windows\System\EIpVKWb.exe
  2⤵
  PID:15616
- C:\Windows\System\mHJrRMP.exe
  C:\Windows\System\mHJrRMP.exe
  2⤵
  PID:15648
- C:\Windows\System\ObUXqLh.exe
  C:\Windows\System\ObUXqLh.exe
  2⤵
  PID:15676
- C:\Windows\System\pBSXWHt.exe
  C:\Windows\System\pBSXWHt.exe
  2⤵
  PID:15704
- C:\Windows\System\Eaivpnf.exe
  C:\Windows\System\Eaivpnf.exe
  2⤵
  PID:15728
- C:\Windows\System\WmalBsC.exe
  C:\Windows\System\WmalBsC.exe
  2⤵
  PID:15756
- C:\Windows\System\AKAkKqu.exe
  C:\Windows\System\AKAkKqu.exe
  2⤵
  PID:15780
- C:\Windows\System\ARnMSwD.exe
  C:\Windows\System\ARnMSwD.exe
  2⤵
  PID:15796
- C:\Windows\System\tJfqsdo.exe
  C:\Windows\System\tJfqsdo.exe
  2⤵
  PID:15828
- C:\Windows\System\DixffwW.exe
  C:\Windows\System\DixffwW.exe
  2⤵
  PID:15844
- C:\Windows\System\KtJtsxU.exe
  C:\Windows\System\KtJtsxU.exe
  2⤵
  PID:15876
- C:\Windows\System\qJRZnIa.exe
  C:\Windows\System\qJRZnIa.exe
  2⤵
  PID:15912
- C:\Windows\System\zDjPTCT.exe
  C:\Windows\System\zDjPTCT.exe
  2⤵
  PID:15928
- C:\Windows\System\aofnweK.exe
  C:\Windows\System\aofnweK.exe
  2⤵
  PID:15956
- C:\Windows\System\SDXBmBv.exe
  C:\Windows\System\SDXBmBv.exe
  2⤵
  PID:15984
- C:\Windows\System\WCCbzIR.exe
  C:\Windows\System\WCCbzIR.exe
  2⤵
  PID:16012
- C:\Windows\System\lokZTaN.exe
  C:\Windows\System\lokZTaN.exe
  2⤵
  PID:16032
- C:\Windows\System\YcdYkxN.exe
  C:\Windows\System\YcdYkxN.exe
  2⤵
  PID:16060
- C:\Windows\System\IzsjDIM.exe
  C:\Windows\System\IzsjDIM.exe
  2⤵
  PID:16092
- C:\Windows\System\aHVQETD.exe
  C:\Windows\System\aHVQETD.exe
  2⤵
  PID:16128
- C:\Windows\System\KBQZTPd.exe
  C:\Windows\System\KBQZTPd.exe
  2⤵
  PID:16144
- C:\Windows\System\dFkUzUY.exe
  C:\Windows\System\dFkUzUY.exe
  2⤵
  PID:16168
- C:\Windows\System\CUjgXMc.exe
  C:\Windows\System\CUjgXMc.exe
  2⤵
  PID:16200
- C:\Windows\System\zYmhvKO.exe
  C:\Windows\System\zYmhvKO.exe
  2⤵
  PID:16216
- C:\Windows\System\MCsVmCI.exe
  C:\Windows\System\MCsVmCI.exe
  2⤵
  PID:16272
- C:\Windows\System\LruNkOr.exe
  C:\Windows\System\LruNkOr.exe
  2⤵
  PID:16304
- C:\Windows\System\vZDrUJr.exe
  C:\Windows\System\vZDrUJr.exe
  2⤵
  PID:16344
- C:\Windows\System\znoBfjO.exe
  C:\Windows\System\znoBfjO.exe
  2⤵
  PID:16372
- C:\Windows\System\EbAyRxd.exe
  C:\Windows\System\EbAyRxd.exe
  2⤵
  PID:15044
- C:\Windows\System\wsSSsCJ.exe
  C:\Windows\System\wsSSsCJ.exe
  2⤵
  PID:15096
- C:\Windows\System\FhrecBj.exe
  C:\Windows\System\FhrecBj.exe
  2⤵
  PID:14888
- C:\Windows\System\jyZslQs.exe
  C:\Windows\System\jyZslQs.exe
  2⤵
  PID:15432
- C:\Windows\System\oVHdmfp.exe
  C:\Windows\System\oVHdmfp.exe
  2⤵
  PID:13752
- C:\Windows\System\GRZleYc.exe
  C:\Windows\System\GRZleYc.exe
  2⤵
  PID:14516
- C:\Windows\System\vitReaK.exe
  C:\Windows\System\vitReaK.exe
  2⤵
  PID:15548
- C:\Windows\System\jhXzrIe.exe
  C:\Windows\System\jhXzrIe.exe
  2⤵
  PID:15384
- C:\Windows\System\zeopoDQ.exe
  C:\Windows\System\zeopoDQ.exe
  2⤵
  PID:15428
- C:\Windows\System\UJQyizo.exe
  C:\Windows\System\UJQyizo.exe
  2⤵
  PID:15720
- C:\Windows\System\flXyPjf.exe
  C:\Windows\System\flXyPjf.exe
  2⤵
  PID:15600
- C:\Windows\System\SLUxDHZ.exe
  C:\Windows\System\SLUxDHZ.exe
  2⤵
  PID:15836
- C:\Windows\System\RBugsrj.exe
  C:\Windows\System\RBugsrj.exe
  2⤵
  PID:16048
- C:\Windows\System\aucicad.exe
  C:\Windows\System\aucicad.exe
  2⤵
  PID:15788
- C:\Windows\System\mqLpVnG.exe
  C:\Windows\System\mqLpVnG.exe
  2⤵
  PID:16160
- C:\Windows\System\AKNksJS.exe
  C:\Windows\System\AKNksJS.exe
  2⤵
  PID:15992
- C:\Windows\System\bxfDzlg.exe
  C:\Windows\System\bxfDzlg.exe
  2⤵
  PID:16028
- C:\Windows\System\pyxPpjY.exe
  C:\Windows\System\pyxPpjY.exe
  2⤵
  PID:16352
- C:\Windows\System\EpaZLhP.exe
  C:\Windows\System\EpaZLhP.exe
  2⤵
  PID:15328
- C:\Windows\System\lDzJqLC.exe
  C:\Windows\System\lDzJqLC.exe
  2⤵
  PID:16252
- C:\Windows\System\GAjXPnD.exe
  C:\Windows\System\GAjXPnD.exe
  2⤵
  PID:16316
- C:\Windows\System\lZNvDUM.exe
  C:\Windows\System\lZNvDUM.exe
  2⤵
  PID:16332
- C:\Windows\System\CkJCDOA.exe
  C:\Windows\System\CkJCDOA.exe
  2⤵
  PID:15356
- C:\Windows\System\rVzunHq.exe
  C:\Windows\System\rVzunHq.exe
  2⤵
  PID:15820
- C:\Windows\System\wcawvMG.exe
  C:\Windows\System\wcawvMG.exe
  2⤵
  PID:16212
- C:\Windows\System\pLdRIoq.exe
  C:\Windows\System\pLdRIoq.exe
  2⤵
  PID:16240
- C:\Windows\System\gteZdsq.exe
  C:\Windows\System\gteZdsq.exe
  2⤵
  PID:15480
- C:\Windows\System\doomTkx.exe
  C:\Windows\System\doomTkx.exe
  2⤵
  PID:16400
- C:\Windows\System\OanXaCr.exe
  C:\Windows\System\OanXaCr.exe
  2⤵
  PID:16424
- C:\Windows\System\oNwVeIK.exe
  C:\Windows\System\oNwVeIK.exe
  2⤵
  PID:16452
- C:\Windows\System\ZUqWAfe.exe
  C:\Windows\System\ZUqWAfe.exe
  2⤵
  PID:16480
- C:\Windows\System\mljCnrO.exe
  C:\Windows\System\mljCnrO.exe
  2⤵
  PID:16520
- C:\Windows\System\xnZiNco.exe
  C:\Windows\System\xnZiNco.exe
  2⤵
  PID:16544
- C:\Windows\System\AeAoBnM.exe
  C:\Windows\System\AeAoBnM.exe
  2⤵
  PID:16576
- C:\Windows\System\njPQYKk.exe
  C:\Windows\System\njPQYKk.exe
  2⤵
  PID:16608
- C:\Windows\System\dViXxeI.exe
  C:\Windows\System\dViXxeI.exe
  2⤵
  PID:16640
- C:\Windows\System\GvaaWML.exe
  C:\Windows\System\GvaaWML.exe
  2⤵
  PID:16676
- C:\Windows\System\QVvphQK.exe
  C:\Windows\System\QVvphQK.exe
  2⤵
  PID:16700
- C:\Windows\System\XiKEpjT.exe
  C:\Windows\System\XiKEpjT.exe
  2⤵
  PID:16724
- C:\Windows\System\yXCrzGO.exe
  C:\Windows\System\yXCrzGO.exe
  2⤵
  PID:16744
- C:\Windows\System\fDtkVXd.exe
  C:\Windows\System\fDtkVXd.exe
  2⤵
  PID:16772
- C:\Windows\System\SlKMYRv.exe
  C:\Windows\System\SlKMYRv.exe
  2⤵
  PID:16800
- C:\Windows\System\ygjLhTz.exe
  C:\Windows\System\ygjLhTz.exe
  2⤵
  PID:16824
- C:\Windows\System\uelcouc.exe
  C:\Windows\System\uelcouc.exe
  2⤵
  PID:16860
- C:\Windows\System\HwZRZUJ.exe
  C:\Windows\System\HwZRZUJ.exe
  2⤵
  PID:16888
- C:\Windows\System\bgLtXdB.exe
  C:\Windows\System\bgLtXdB.exe
  2⤵
  PID:16912
- C:\Windows\System\ZYKvrNc.exe
  C:\Windows\System\ZYKvrNc.exe
  2⤵
  PID:16944
- C:\Windows\System\HunFvvd.exe
  C:\Windows\System\HunFvvd.exe
  2⤵
  PID:16968
- C:\Windows\System\ifQrNSY.exe
  C:\Windows\System\ifQrNSY.exe
  2⤵
  PID:16988
- C:\Windows\System\IHMouJJ.exe
  C:\Windows\System\IHMouJJ.exe
  2⤵
  PID:17012
- C:\Windows\System\rrwvGIG.exe
  C:\Windows\System\rrwvGIG.exe
  2⤵
  PID:17032
- C:\Windows\System\sobrbEx.exe
  C:\Windows\System\sobrbEx.exe
  2⤵
  PID:17060
- C:\Windows\System\xmsVwJU.exe
  C:\Windows\System\xmsVwJU.exe
  2⤵
  PID:17088
- C:\Windows\System\qUHtzqV.exe
  C:\Windows\System\qUHtzqV.exe
  2⤵
  PID:17104
- C:\Windows\System\BbTgrgv.exe
  C:\Windows\System\BbTgrgv.exe
  2⤵
  PID:17128
- C:\Windows\System\Tnbmujf.exe
  C:\Windows\System\Tnbmujf.exe
  2⤵
  PID:17144
- C:\Windows\System\JWkVMVY.exe
  C:\Windows\System\JWkVMVY.exe
  2⤵
  PID:17168
- C:\Windows\System\rFhhXNI.exe
  C:\Windows\System\rFhhXNI.exe
  2⤵
  PID:17188
- C:\Windows\System\IDwwTEw.exe
  C:\Windows\System\IDwwTEw.exe
  2⤵
  PID:17208
- C:\Windows\System\TKjebXe.exe
  C:\Windows\System\TKjebXe.exe
  2⤵
  PID:17244
- C:\Windows\System\cHYmVun.exe
  C:\Windows\System\cHYmVun.exe
  2⤵
  PID:17276
- C:\Windows\System\DsJTtuw.exe
  C:\Windows\System\DsJTtuw.exe
  2⤵
  PID:17292
- C:\Windows\System\qiBnNuF.exe
  C:\Windows\System\qiBnNuF.exe
  2⤵
  PID:17324
- C:\Windows\System\YALKuZC.exe
  C:\Windows\System\YALKuZC.exe
  2⤵
  PID:17364
- C:\Windows\System\HJutLHj.exe
  C:\Windows\System\HJutLHj.exe
  2⤵
  PID:17384
- C:\Windows\System\ZNoNlbg.exe
  C:\Windows\System\ZNoNlbg.exe
  2⤵
  PID:16188
- C:\Windows\System\nnuJnLe.exe
  C:\Windows\System\nnuJnLe.exe
  2⤵
  PID:15612
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15612 -s 248
    3⤵
    PID:15904
- C:\Windows\System\KKmOHKC.exe
  C:\Windows\System\KKmOHKC.exe
  2⤵
  PID:15856
- C:\Windows\System\YLODAYX.exe
  C:\Windows\System\YLODAYX.exe
  2⤵
  PID:16472
- C:\Windows\System\NeQFKKn.exe
  C:\Windows\System\NeQFKKn.exe
  2⤵
  PID:16908
- C:\Windows\System\BGRvikK.exe
  C:\Windows\System\BGRvikK.exe
  2⤵
  PID:16736
- C:\Windows\System\HKgkgWY.exe
  C:\Windows\System\HKgkgWY.exe
  2⤵
  PID:17076
- C:\Windows\System\ARUUWSI.exe
  C:\Windows\System\ARUUWSI.exe
  2⤵
  PID:16880
- C:\Windows\System\OIhCcEP.exe
  C:\Windows\System\OIhCcEP.exe
  2⤵
  PID:15132
- C:\Windows\System\rJfowoT.exe
  C:\Windows\System\rJfowoT.exe
  2⤵
  PID:14240
- C:\Windows\System\qdSnLgB.exe
  C:\Windows\System\qdSnLgB.exe
  2⤵
  PID:15884
- C:\Windows\System\OuMujDO.exe
  C:\Windows\System\OuMujDO.exe
  2⤵
  PID:16976
- C:\Windows\System\AsSEfrz.exe
  C:\Windows\System\AsSEfrz.exe
  2⤵
  PID:17160
- C:\Windows\System\GhVQFbn.exe
  C:\Windows\System\GhVQFbn.exe
  2⤵
  PID:15040
- C:\Windows\System\LtTxvxm.exe
  C:\Windows\System\LtTxvxm.exe
  2⤵
  PID:15920
- C:\Windows\System\jdJgMVv.exe
  C:\Windows\System\jdJgMVv.exe
  2⤵
  PID:17356

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 3864 -i 3864 -h 448 -j 428 -s 496 -d 0
1⤵
PID:16816

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16392

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AYbxIFR.exe

Filesize
1.9MB

MD5
a41040c540c7be7dc8e4abea16cf00a4

SHA1
598d13e8f697009d2b7f45134a4d00257d0d2212

SHA256
0f1047361aaf4f56944b7f34986c604a151e7b9296def955d9a99bd20a5bca54

SHA512
016fce5b8f7b355bff67190d82235fd46d90fb835f600b53447e144fe4c63e54cbf3e53e479265b8e6fb35042464216ebe3b9d487efa9b802a8dc4816ba097a2

Download Submit
C:\Windows\System\CCxfuyn.exe

Filesize
1.9MB

MD5
a9feaa82b24b3efce2901f0f36d742da

SHA1
bca9a568cc21bd499948838116aa70414f5d8b2c

SHA256
4ca98033337e81bdf5f129ba88555fda67ea607116fe812012f20fc9214d2a90

SHA512
2077a2700a71785fc7f897b772331cc11c324a3be064a02c1cfe019f9b1a4285c5b55c48f0b38ada500fea597ca141958fb7637ac50e4ebf32fafed6d6fcfc37

Download Submit
C:\Windows\System\DufqdvI.exe

Filesize
1.9MB

MD5
80a885bb6c7aa6c7719204d84ea1c687

SHA1
a9a915a67de066d7a23a53d44932ce4de7c83bf3

SHA256
4e660617856460b4a7226f4aad85323b7be4626dbd491e5520f45c9421812b43

SHA512
2091617c46552dc704f65eb62dfe3e96f72cfa06aebbf475e5bc4f63da50dd8d8faa3861c3bef4a4647118af7404590480c8dab2ffe46404ebf50a4f9f430e0c

Download Submit
C:\Windows\System\HNqSdtR.exe

Filesize
1.9MB

MD5
6a49fc77c35164f96cdfff093826b400

SHA1
2404b430ec2fdeb911aada0966641d3ec7f23862

SHA256
eac670136e3fa3e92f93e1d7cf3e740e1538a5c3a7c24aa5099c790d8b86bab8

SHA512
f11d491e66e01eb2a16cf0b7d8e83edc5c949fad71456aad57b693332768db67ac95b97ef08f5e2dc96830fa0a0d1f4d879db6c74afbefbc70fab0388323144d

Download Submit
C:\Windows\System\JVGAbTa.exe

Filesize
1.9MB

MD5
2aab3e76aa148ce2517d3b6be7376bc8

SHA1
3154c756bec2fe8fc5339d42eb2bac70710d5566

SHA256
26d47bbbf39e453d19a218f26ee9ec594963b163de556cf4b8d5a40e5bf109b1

SHA512
334db37ffa73640e4459d5e815225187a75eed3c5e335d5dd549cc6af1b72934971c650f005d14d4e905eeaf46e530956f59baa30b226faf554ecf99d6e1bf65

Download Submit
C:\Windows\System\KUnpxHQ.exe

Filesize
1.9MB

MD5
5d825b3c5e2ff95a1c023c592bbc0a73

SHA1
b8849618554096477d70b4508ca6d2eed6e9d02e

SHA256
edfffc8e39a36361337189a204a75945019ced17ebd5732c745adc811c7bbc71

SHA512
c2c873e118a8162a55f2b7029c2dea06d11519591953b3f03842a0589acd5ee6b81a794c7c7f3b4ede4587a037014e8d1a85d8f1f8b0163faa1b5ade39d068e5

Download Submit
C:\Windows\System\MWgJUtG.exe

Filesize
1.9MB

MD5
5a7ea6edca42224cc9a36b7fc0bd42ce

SHA1
6909ed7eb259daf3774376b6631d605b4419714b

SHA256
119b29f330ae33b42a9384754e9eccc70e9123096cd10e5b65b0a728a7f556d0

SHA512
e308096b0475b11b1103cc6e141828b150201647861dbcb0a073e5aebf27e50fce84cf28ae052983dd16347240f79882dcbd99b10c29107658d53111b0e379bc

Download Submit
C:\Windows\System\OFUwDhW.exe

Filesize
1.9MB

MD5
cac5de7b54cf272ba0c0feb99da518de

SHA1
193ec08563dd74c326859a5170f79d50d903de48

SHA256
a3ce091d0e2afcc358e3e10e13af039a9bf97550a9b0636dc6340bc425cc969d

SHA512
534bb87ba51c21b3063771a19a66039f563994046ecea5a8da82066ddd7a52f9e91b9806caaed0814525f0a813fb3caeb55e0a3ed4f72c165009b4134a79c66f

Download Submit
C:\Windows\System\OIVxWQR.exe

Filesize
1.9MB

MD5
da4c657af29ec6f8529a4b9ebff7b4e5

SHA1
0817eb46550d617f365469a2f9517b1dbc414dd0

SHA256
deb6e188c130fce0f308a69c27c208c8c35541856fa3076480064c45c8fd44a6

SHA512
aa0bded7c24f91449abc31f49d199cb576ea94895be82dd1b6a92718628fc59b3aeaccdae49f1745365d1804c92592190b6d2a7e204f8d0cfe18e9e5112eb257

Download Submit
C:\Windows\System\PIBdPMD.exe

Filesize
1.9MB

MD5
64da96a723608eb088c3fc618ae2ec59

SHA1
2814061aad3b0bb6ffc45615dd2742a97c1e4294

SHA256
31fb64c11476937625604f98a79c8afc9ec1ca84966cb20ce1853d9cff0fe30e

SHA512
9fb6dec86928c0109e7295be9a92a1a0b4d67f426781d116dca777de6471a2d8ce57b1b633c04110deb6815fb0cf03ef8f5359c3726d99915805ad32e465d270

Download Submit
C:\Windows\System\PbIZnUo.exe

Filesize
1.9MB

MD5
c7a58c26c96243ba2476f3e62556d51d

SHA1
bde1e658f5f50cac5fd1dd768153799ac39c1050

SHA256
753f4ba9dbecc650e84c02b72572136426bfe16b00e486710ee080fc20fc9181

SHA512
aa8392cf99bca45032a9cdd3f17fd3a9b1266b3f402eec015682a00b49a08beb20193a5b9b25fab52d9dac93cc5b9586425b2a89cf9106ebf6fbcf6a4077246c

Download Submit
C:\Windows\System\RxGOmOs.exe

Filesize
1.9MB

MD5
6f935acde5b5bf2e2d10e12e3045eab1

SHA1
52649684ecad623e83770ea7386ea292a4a11fe1

SHA256
c7f1f24b3be7a1522dfdb1a523ab93780283f134da66420c082c00ba0c32b3ab

SHA512
cd58b0ea007a6e7bda9b07d65159c283aadbc1a5306a01b4330d1fe768a6cbcb737f464dd75e51f12c6ee82833c144e203f756e776aa6e0f8a86497cf584ad4e

Download Submit
C:\Windows\System\SyieCjo.exe

Filesize
1.9MB

MD5
ec4647a51f6f5cfa2825a06120b5121a

SHA1
11e32631b98ad4af8fcb1c8c56472f9ff6055f9f

SHA256
ebce1037a2cb1511c8c1193c34dd4b5ae91e43b1fddb4c11cd0fbe419c99a515

SHA512
b3d6d8f23df932da65bd0c151f422b0d55464ed6524bce18a63bf2f40ba6d2588c2e2e9b0c8b2e989853941d06ee973631791d41908b7f4dedaa61e4446eccb7

Download Submit
C:\Windows\System\UuElmqF.exe

Filesize
1.9MB

MD5
0d7399fef1e00d6c5f3916eca026519c

SHA1
19f211952cfc354cab22b470602ef1a33b832d47

SHA256
c087c00a26d3ebfc74bbe25e9082f792f6b6d52ae5e1af35c5149432fb4e3167

SHA512
f696963fadabdfbbb94539ffcfbbe34171a65ee1059f40b8d6180f5ea763fa9fa401c80e90fb13d25ec63be31570eaa677aead7520d2c51f20516e74eb349040

Download Submit
C:\Windows\System\VDerirW.exe

Filesize
1.9MB

MD5
3c8343e0f44ef06b13e9bd5837a5fa79

SHA1
892621011a812d2292c498513a3bb7f9f917fb02

SHA256
b69fee5ce1fdfeb1b0b62db40509b90aafd803b38f1f9393f0f21a9e3ca89b96

SHA512
dca54fe82bf1f2d227567e05a93c3aaecec0261e6411b639ccb1e4eab1d93d2ebf6de5f98c1540829a1a4121825478b15aa275507365227405c51248b83d47db

Download Submit
C:\Windows\System\VeydSih.exe

Filesize
1.9MB

MD5
8f6a109bcb284c3e0486d638fd65f599

SHA1
c17eb388b2c235aab8074392ed782193288d6e2b

SHA256
59cd291baa43e207d168b42412472a36ab4d3554c6dd03ad1d21e90dc636af62

SHA512
f3d9db0cc59cb8d5ff0450ddeb722aea11d833f485fc80d51811a0bbf437ed64c5fd9da4d63d0cad369949e6a9d9e5038c0a36b26d45e8bb5bd11b7a734064f5

Download Submit
C:\Windows\System\XLtaPWo.exe

Filesize
1.9MB

MD5
4b745c1251226c8f222f5d8da63511f2

SHA1
d2c48bb9cd57ba786c49942eebea529f07e754b0

SHA256
c32e8db4ee99331a9d62eedc5008c37ebb35dac8138bfe80ddef7372a774cd8a

SHA512
ab5ce031c3518b74313512379c96b90994708138175b187a911c72d54306340e40cc531e4ede440ff3d127d7821d1ebf28d7c92e4981caa61302d76ba6619588

Download Submit
C:\Windows\System\XTRNQsL.exe

Filesize
1.9MB

MD5
8738424f9b4e5f347f231d2ef05bfffb

SHA1
90fc177ebab826e1701f42c8b06428fd605bd418

SHA256
42390ffdfa53115e0c8531abbfd6d4548698fb3b62dbf2ffc2c4cd614929ebb5

SHA512
24f308c96717ab9cc6026eca9f0171b746dc2fcb634a3c8512179e66e06379bb2562f5358b63080ca2128018aca4639f01f5803594b05d4884acab64be5ae06d

Download Submit
C:\Windows\System\ZQLYurG.exe

Filesize
1.9MB

MD5
ea649e9a7d67782bd8d6b8aefc9e9dbe

SHA1
7681e39178d03fd0e89a5047bb1fd1db3ca489cd

SHA256
3e373cf3244a57ea87f2315db214289958b5dfef2917cffd2157bffa17489dba

SHA512
1cdb9c8586adf466518b25dd398650a95d8127dd7e65d1caec8acd85f381ce03117a1ef4970e3e7e510e7fed6ff7d17630a116f34527bcf3630a64a4639e5b41

Download Submit
C:\Windows\System\axvEjsv.exe

Filesize
1.9MB

MD5
68e98eb84bb92773844fe4d291fe4328

SHA1
3c1c8709e09880bf631c3e93c66afe64ec75589a

SHA256
a090b44c65a0e5b2ad2e2d49fdd0c8ea334b6e19222b298e987b6320be821e9c

SHA512
0f72f8d1702000355e40e8b71e3c6b8f14f4cb1c06e084527de85a1a4008b5b8ae03f8ec15b18703698d47952f7023bc1ef3c2f5ef78db64ece39f3cbd99e242

Download Submit
C:\Windows\System\eNENSNL.exe

Filesize
1.9MB

MD5
a6dbea9259c04c2f691d51a9ec40a76c

SHA1
9c6a042e654c6db929630c15bcb5dab4d32d020d

SHA256
45e442cb23241e42734c0727612823083525eb44cba715769e507b4f73fbb982

SHA512
b3197493c077826df7dc694c0550c34978eee9243386c23404353f17011f2cf4a7a387846bb46a350e6c90925d2ddf751223400c445875d9fc0b771aecc7e69c

Download Submit
C:\Windows\System\gMKUkoo.exe

Filesize
1.9MB

MD5
cbefad848e3bd60dc5f0489b46a6f66e

SHA1
2f540fdd85993bec35227eebb6933c60fbc91273

SHA256
abf18a836554942f118684498db7c8ccffef84caf37db2e4cd657b9d67ac027f

SHA512
32462638a4e8f7bddd7cc3002f1beaf89a90a5116535963ace5b6206e47bb79cc3aaa884f4aa3217834394aa93fdfedb28770a63e92f4448b2fb944c801d6c60

Download Submit
C:\Windows\System\hVZoziU.exe

Filesize
1.9MB

MD5
ad92916a1d42a6e3c37c02fd29446fa7

SHA1
ed7312ae91094fe305fa46efbaffab6925f0f95a

SHA256
67693da187a3b7f8ecb4dd0ab06972c64086d0095042e6f03106a540d5ff7978

SHA512
2c3950cf7f7befc24434ae240b7409c2a21df1de828c88e6e27fbde563f703e68750c3c1b61db77b96a46791a750887be36228d7304ad9b86b91d0b2edbe285c

Download Submit
C:\Windows\System\hqiEcVP.exe

Filesize
1.9MB

MD5
7b6df92fc0ddc5a3e497d5bc6d059182

SHA1
f777bd9a7fbc4544f275ae86e0204a905ed46478

SHA256
cbc19bbf44f6ad179065a6d1d4d4dffd8ba52596efcecd1e9e25e4ad0b57310b

SHA512
8cfd39971f666d04d9e727be63666edbbcc460c4e9a6360d94c147ecaec8a2866c658ed023b4413cb57cda60937b3f537863cd2449be5d52776d2016baa78ada

Download Submit
C:\Windows\System\mxaaojB.exe

Filesize
1.9MB

MD5
1be6ae24299ee4d0ccd2cbf6f3b5fe96

SHA1
f3d7b1e38de7694bb64af7a13a73adaee5c148c9

SHA256
309fa0d7f08c2e7ae2fc79c1847826695026d6da45251057cb51202a24bcc900

SHA512
439fac24549e89dcce5a88a329df7d6f3c376bdeb4cb23b8ca5581c7479fb49568b2a42b00c72302bad3353a92686664c77dab86827ef9db67e585c2529f4588

Download Submit
C:\Windows\System\ozyATkH.exe

Filesize
1.9MB

MD5
b809d8ebdf73d60df3e9d01e9a010b8a

SHA1
def4bf320b6f2401f5e5db7731ae06ac6dc14cef

SHA256
8c672a47f441f1dde396af513541ad9c1a960b365ff8be4fcf6db44c61057f93

SHA512
021b7be7d03d791033cc9a310c7c1fdc1eba1d7833ab68005cf3f73f25b74aecbceea406192460e626a60bc3568960cfd15353ddf4c9effb8887e3f4dfd1d089

Download Submit
C:\Windows\System\rYMSSts.exe

Filesize
1.9MB

MD5
da4e2427005201e269f5be0c731d1a55

SHA1
9758a1a9c67ef6fdeb18b42104e38ad81d1b1627

SHA256
7d5f9533ce16553bc8a85144cd24084bb84d8160b11f2f089808f5082be0ad58

SHA512
b600ced25f1229600a6eb8d66f5164a6156dd16c36d51c46b3ce456f67d823a0b846c1ae6838444d82f9bb29c3f25950136a2f6f32d6d41e45e689ff85887caf

Download Submit
C:\Windows\System\tnvYBTY.exe

Filesize
1.9MB

MD5
c3ab0fca3e4cfbb01db73847170d23e6

SHA1
2c290b8c4ee14ff530556c017f8c38f4b0459d6b

SHA256
5bea3723e76e6cbf26883b8b24eee7bd3c02bc19a2460b415321a04cd8ccdf51

SHA512
e85be51742acc1c437854d7694bf76bd21cd6f021cf816d16b3b99b70e817c65ebef975d3123b40b9a4e39a93a9ccbf99b7d07748700c0d87eb8552e6b6b6833

Download Submit
C:\Windows\System\uJNEgZm.exe

Filesize
1.9MB

MD5
cc6153465af57ddd18c89cae91a37393

SHA1
2b84e33edfcaf838317e81c36a9081dfbbcd6363

SHA256
2a2c310e507fad4c5a6f3bb2e565011a11027b6c07eabb92d99430ce4bf07cf6

SHA512
7ebde350801ee8895332b316df1486243108117424290a0e31cf638f7eb50595ebd6e3e60509870853d0632314f385fd2e33c0e8df2fba9c20837228e1a36b06

Download Submit
C:\Windows\System\ufXzLtl.exe

Filesize
1.9MB

MD5
94b62a8b97a2f9fd397f77e059451a52

SHA1
9e91efe4579a5bf5c1895d5ce5f41a3a869bf743

SHA256
3a0b882bb2931bd0206e66f30be594ef3b8069e6ba6827848a64cbd9062d6775

SHA512
065c74829ca26fddb751b7467fd3acc0d13c46546989a69a01cb0e7629d20dca6c3a47a1477f1b52f5aae7618393be3bfed4226f89bffae4c3bcab96ddd067c5

Download Submit
C:\Windows\System\vPeQqGh.exe

Filesize
1.9MB

MD5
44c1995d291ad478e2bf50071734755e

SHA1
2391cf2462a786f8a7db285013d6a28d90084666

SHA256
8ccb5e18060a6bffa17e855a350d7096b88e4995f29b493528fb87939aed9802

SHA512
a4ceb941fac99a707c8e7517c7e7be18569628df153563e92381be0bcd5169a85559304d02cad5ee8d6bcd8d11304678fac1259d4fd7a4b9c831c44d26b1abb1

Download Submit
C:\Windows\System\yZEcjlg.exe

Filesize
1.9MB

MD5
6cb19e20f15834d8abdd22803ca32317

SHA1
0a239009c6518100325965e917436a0b62f2695a

SHA256
4efa59c298e8a0f946fbf2bfec589f33b05447a5326a128fcb9ff0bb395ee472

SHA512
4b2aea6c52c1db99fef5dadf1d6a2709476bc93860a90e79c62a6c475ac016bfe9ad8b369162760499677363080ffd0643b2e1b99aa139f29a5f1e6548653971

Download Submit
C:\Windows\System\zRYswWs.exe

Filesize
1.9MB

MD5
685f17797bfcab35fe1d21b5084f40e4

SHA1
56c235f3d905acdae9efb89faa53a9186e727789

SHA256
eecbed797ab5ac264551b42349ee80a5a49b186bbcc839b65ad571c815213dbe

SHA512
4a475faf33ca3b675042bd1057ff01b4d0b257b1a618e3b3aaf745f1776dd2a292113c5349499ac5eca3f51a2a2969c315e73dc60cbdd2599948ca570782d490

Download Submit
memory/1672-0-0x0000021F76650000-0x0000021F76660000-memory.dmp

Filesize
64KB

Download