xmrig | af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
Size

1.1MB
MD5

cea9755aa40a9dbc0e7ae685ba785e86
SHA1

096ac929f7092df50a14cb7285c83e95462e601f
SHA256

af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec
SHA512

86e958058a014e3c2d92feb033128d0ebc8ff83342eb1267bb6770718d18d5d5b5640b2f5e53546a41c6cccc0c495d0e21e9f566febf004e34e16f1b2af9a9e3
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BPhhl3iJ:GezaTF8FcNkNdfE0pZ9ozttwIRakGJfC

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/files/0x00040000000229c7-4.dat	xmrig
behavioral2/files/0x0007000000023c88-9.dat	xmrig
behavioral2/files/0x0007000000023c89-7.dat	xmrig
behavioral2/files/0x0007000000023c8a-18.dat	xmrig
behavioral2/files/0x0007000000023c8b-23.dat	xmrig
behavioral2/files/0x000600000001e4df-30.dat	xmrig
behavioral2/files/0x000300000001e5b3-44.dat	xmrig
behavioral2/files/0x000300000001e5b5-50.dat	xmrig
behavioral2/files/0x0008000000023c85-73.dat	xmrig
behavioral2/files/0x0007000000023c8e-93.dat	xmrig
behavioral2/files/0x0007000000023c92-139.dat	xmrig
behavioral2/files/0x0007000000023ca5-171.dat	xmrig
behavioral2/files/0x0007000000023c98-170.dat	xmrig
behavioral2/files/0x0007000000023c91-169.dat	xmrig
behavioral2/files/0x0007000000023ca4-168.dat	xmrig
behavioral2/files/0x0007000000023c96-164.dat	xmrig
behavioral2/files/0x0007000000023ca3-163.dat	xmrig
behavioral2/files/0x0007000000023ca2-162.dat	xmrig
behavioral2/files/0x0007000000023c97-158.dat	xmrig
behavioral2/files/0x0007000000023c94-155.dat	xmrig
behavioral2/files/0x0007000000023ca1-154.dat	xmrig
behavioral2/files/0x0007000000023ca0-153.dat	xmrig
behavioral2/files/0x0007000000023c9e-150.dat	xmrig
behavioral2/files/0x0007000000023c9f-149.dat	xmrig
behavioral2/files/0x0007000000023c93-140.dat	xmrig
behavioral2/files/0x0007000000023c90-138.dat	xmrig
behavioral2/files/0x0007000000023c9d-137.dat	xmrig
behavioral2/files/0x0007000000023c9c-136.dat	xmrig
behavioral2/files/0x0007000000023c9b-130.dat	xmrig
behavioral2/files/0x0007000000023c95-127.dat	xmrig
behavioral2/files/0x0007000000023c99-122.dat	xmrig
behavioral2/files/0x0007000000023c9a-129.dat	xmrig
behavioral2/files/0x0007000000023c8f-101.dat	xmrig
behavioral2/files/0x0007000000023c8d-75.dat	xmrig
behavioral2/files/0x000300000001e5b4-71.dat	xmrig
behavioral2/files/0x0007000000023c8c-69.dat	xmrig
behavioral2/files/0x000300000001e5b2-57.dat	xmrig
behavioral2/files/0x000400000001e4e1-54.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3912	EFwhLDz.exe
3560	nItrTGN.exe
372	IkHXLtm.exe
4164	FTjgKnK.exe
1712	bWmsGBO.exe
5052	CBAsbQA.exe
4836	HjJMdgJ.exe
4744	yJdqPul.exe
4148	VsqMNIS.exe
976	bimVTOB.exe
2312	IxOvarg.exe
2948	pRsrRch.exe
4900	bLEpzhT.exe
4224	AHjPvaD.exe
892	ijCyyvs.exe
664	ggAjnPx.exe
1988	NyEerHB.exe
608	lTpAmrR.exe
3608	vNBFpdm.exe
1528	CrtXGSV.exe
3392	htvbRUz.exe
4832	KaIMHQW.exe
916	wWyyHjE.exe
4428	Xdfbiiu.exe
1800	rpwdCbJ.exe
4500	msdXZFj.exe
3208	raLIYcC.exe
3896	DFxORMm.exe
4528	wemYMyC.exe
3972	QbZuBkW.exe
1428	GqZvnvW.exe
2252	MRZTKlV.exe
2380	pePJOtc.exe
1960	BvnzEuf.exe
4472	yCGvWha.exe
5012	wpdWvtW.exe
752	jADtBse.exe
1612	XIHUMsi.exe
4808	NqEFcBl.exe
4456	GBDvMxF.exe
4352	mvCXRNr.exe
1568	aZIBZzL.exe
4724	GolUnnT.exe
3932	qYrIOEo.exe
4332	AUxiRin.exe
1648	HilXgli.exe
4316	WgvTAIG.exe
2716	vaTGQYB.exe
988	uNoeBKw.exe
4908	dqIQVft.exe
2544	VLXeaXk.exe
3820	yIdmjxf.exe
1136	mVjESfS.exe
4920	ifFvzrJ.exe
100	ZBCUQOo.exe
2940	dUNMTkr.exe
744	gwhhptw.exe
4588	VZvOKDw.exe
3008	ILkDLbT.exe
4864	FUWehdE.exe
3776	zHRMKAw.exe
3800	fbVxEYi.exe
3508	EmjNtWl.exe
2152	qHYADih.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hZsVyuM.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\WuagLcB.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\kAtJqCY.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\NqEFcBl.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\RzDAdGL.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\PZVvNvo.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\BDzfKmw.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\gpTyPnj.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\zQxbLKN.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\RHkNRqE.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\OLAsQac.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\iwPEwoJ.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\EETRZQF.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\QLxmEDc.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\pGbgZxS.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\rfcesyY.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\hthxWuw.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\UwajVWd.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\arVGFay.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\ZUBTRPo.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\VtyvwJS.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\KqQWflG.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\xGzCRpM.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\DxnvALe.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\aKLGdWi.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\sMbiiYr.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\aUaqqxr.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\zzXQUCe.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\KtEMyYY.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\RNRwydI.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\UteYaOI.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\jlJeFXY.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\hhuvAtg.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\rGUBkrE.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\mSjGHtW.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\MSVuiVT.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\tSYYbDu.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\yMlOcRs.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\LtzuiHk.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\aZIBZzL.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\npZrIlN.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\NmgIRxj.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\ebCzEnu.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\nDTBbOV.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\rbHBfcu.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\EtETPNP.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\mcaazDn.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\ruPdHpl.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\TkGsaMk.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\GBDvMxF.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\offUpjz.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\lbHCzZw.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\yAmkecq.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\cmvUfid.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\zArlmXW.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\iOiAvil.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\tbeosnc.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\fkWusRT.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\DGeQrva.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\tvGhWIp.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\RGXIiFc.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\VjArEEK.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\ewFXbpV.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
File created	C:\Windows\System\jyDqsAP.exe	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	13324	dwm.exe
Token: SeChangeNotifyPrivilege	13324	dwm.exe
Token: 33	13324	dwm.exe
Token: SeIncBasePriorityPrivilege	13324	dwm.exe
Token: SeCreateGlobalPrivilege	10416	dwm.exe
Token: SeChangeNotifyPrivilege	10416	dwm.exe
Token: 33	10416	dwm.exe
Token: SeIncBasePriorityPrivilege	10416	dwm.exe
Token: SeShutdownPrivilege	10416	dwm.exe
Token: SeCreatePagefilePrivilege	10416	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 3912	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	86
PID 1336 wrote to memory of 3912	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	86
PID 1336 wrote to memory of 3560	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	87
PID 1336 wrote to memory of 3560	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	87
PID 1336 wrote to memory of 372	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	88
PID 1336 wrote to memory of 372	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	88
PID 1336 wrote to memory of 4164	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	89
PID 1336 wrote to memory of 4164	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	89
PID 1336 wrote to memory of 1712	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	91
PID 1336 wrote to memory of 1712	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	91
PID 1336 wrote to memory of 5052	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	92
PID 1336 wrote to memory of 5052	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	92
PID 1336 wrote to memory of 4836	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	93
PID 1336 wrote to memory of 4836	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	93
PID 1336 wrote to memory of 4744	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	94
PID 1336 wrote to memory of 4744	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	94
PID 1336 wrote to memory of 4148	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	95
PID 1336 wrote to memory of 4148	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	95
PID 1336 wrote to memory of 976	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	96
PID 1336 wrote to memory of 976	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	96
PID 1336 wrote to memory of 2312	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	97
PID 1336 wrote to memory of 2312	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	97
PID 1336 wrote to memory of 2948	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	98
PID 1336 wrote to memory of 2948	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	98
PID 1336 wrote to memory of 4900	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	99
PID 1336 wrote to memory of 4900	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	99
PID 1336 wrote to memory of 4224	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	100
PID 1336 wrote to memory of 4224	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	100
PID 1336 wrote to memory of 892	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	101
PID 1336 wrote to memory of 892	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	101
PID 1336 wrote to memory of 664	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	102
PID 1336 wrote to memory of 664	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	102
PID 1336 wrote to memory of 1988	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	103
PID 1336 wrote to memory of 1988	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	103
PID 1336 wrote to memory of 608	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	104
PID 1336 wrote to memory of 608	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	104
PID 1336 wrote to memory of 3608	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	105
PID 1336 wrote to memory of 3608	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	105
PID 1336 wrote to memory of 1528	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	106
PID 1336 wrote to memory of 1528	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	106
PID 1336 wrote to memory of 3392	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	107
PID 1336 wrote to memory of 3392	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	107
PID 1336 wrote to memory of 4832	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	108
PID 1336 wrote to memory of 4832	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	108
PID 1336 wrote to memory of 916	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	109
PID 1336 wrote to memory of 916	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	109
PID 1336 wrote to memory of 4428	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	110
PID 1336 wrote to memory of 4428	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	110
PID 1336 wrote to memory of 1800	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	111
PID 1336 wrote to memory of 1800	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	111
PID 1336 wrote to memory of 4500	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	112
PID 1336 wrote to memory of 4500	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	112
PID 1336 wrote to memory of 3208	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	113
PID 1336 wrote to memory of 3208	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	113
PID 1336 wrote to memory of 3896	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	114
PID 1336 wrote to memory of 3896	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	114
PID 1336 wrote to memory of 4528	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	115
PID 1336 wrote to memory of 4528	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	115
PID 1336 wrote to memory of 3972	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	116
PID 1336 wrote to memory of 3972	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	116
PID 1336 wrote to memory of 1428	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	117
PID 1336 wrote to memory of 1428	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	117
PID 1336 wrote to memory of 2252	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	118
PID 1336 wrote to memory of 2252	1336	af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe	118

C:\Users\Admin\AppData\Local\Temp\af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe
"C:\Users\Admin\AppData\Local\Temp\af67d23afdd083f13b8864a83cd49d0f2a8f504d9c0f7642dd664c04a0a64eec.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\System\EFwhLDz.exe
  C:\Windows\System\EFwhLDz.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\nItrTGN.exe
  C:\Windows\System\nItrTGN.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\IkHXLtm.exe
  C:\Windows\System\IkHXLtm.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\FTjgKnK.exe
  C:\Windows\System\FTjgKnK.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\bWmsGBO.exe
  C:\Windows\System\bWmsGBO.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\CBAsbQA.exe
  C:\Windows\System\CBAsbQA.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\HjJMdgJ.exe
  C:\Windows\System\HjJMdgJ.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\yJdqPul.exe
  C:\Windows\System\yJdqPul.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\VsqMNIS.exe
  C:\Windows\System\VsqMNIS.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\bimVTOB.exe
  C:\Windows\System\bimVTOB.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\IxOvarg.exe
  C:\Windows\System\IxOvarg.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\pRsrRch.exe
  C:\Windows\System\pRsrRch.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\bLEpzhT.exe
  C:\Windows\System\bLEpzhT.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\AHjPvaD.exe
  C:\Windows\System\AHjPvaD.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\ijCyyvs.exe
  C:\Windows\System\ijCyyvs.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\ggAjnPx.exe
  C:\Windows\System\ggAjnPx.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\NyEerHB.exe
  C:\Windows\System\NyEerHB.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\lTpAmrR.exe
  C:\Windows\System\lTpAmrR.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\vNBFpdm.exe
  C:\Windows\System\vNBFpdm.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\CrtXGSV.exe
  C:\Windows\System\CrtXGSV.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\htvbRUz.exe
  C:\Windows\System\htvbRUz.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\KaIMHQW.exe
  C:\Windows\System\KaIMHQW.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\wWyyHjE.exe
  C:\Windows\System\wWyyHjE.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\Xdfbiiu.exe
  C:\Windows\System\Xdfbiiu.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\rpwdCbJ.exe
  C:\Windows\System\rpwdCbJ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\msdXZFj.exe
  C:\Windows\System\msdXZFj.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\raLIYcC.exe
  C:\Windows\System\raLIYcC.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\DFxORMm.exe
  C:\Windows\System\DFxORMm.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\wemYMyC.exe
  C:\Windows\System\wemYMyC.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\QbZuBkW.exe
  C:\Windows\System\QbZuBkW.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\GqZvnvW.exe
  C:\Windows\System\GqZvnvW.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\MRZTKlV.exe
  C:\Windows\System\MRZTKlV.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\pePJOtc.exe
  C:\Windows\System\pePJOtc.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\BvnzEuf.exe
  C:\Windows\System\BvnzEuf.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\yCGvWha.exe
  C:\Windows\System\yCGvWha.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\wpdWvtW.exe
  C:\Windows\System\wpdWvtW.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\jADtBse.exe
  C:\Windows\System\jADtBse.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\XIHUMsi.exe
  C:\Windows\System\XIHUMsi.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\NqEFcBl.exe
  C:\Windows\System\NqEFcBl.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\GBDvMxF.exe
  C:\Windows\System\GBDvMxF.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\mvCXRNr.exe
  C:\Windows\System\mvCXRNr.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\aZIBZzL.exe
  C:\Windows\System\aZIBZzL.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\GolUnnT.exe
  C:\Windows\System\GolUnnT.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\qYrIOEo.exe
  C:\Windows\System\qYrIOEo.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\AUxiRin.exe
  C:\Windows\System\AUxiRin.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\WgvTAIG.exe
  C:\Windows\System\WgvTAIG.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\HilXgli.exe
  C:\Windows\System\HilXgli.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\vaTGQYB.exe
  C:\Windows\System\vaTGQYB.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\uNoeBKw.exe
  C:\Windows\System\uNoeBKw.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\dqIQVft.exe
  C:\Windows\System\dqIQVft.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\VLXeaXk.exe
  C:\Windows\System\VLXeaXk.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\yIdmjxf.exe
  C:\Windows\System\yIdmjxf.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\mVjESfS.exe
  C:\Windows\System\mVjESfS.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\ifFvzrJ.exe
  C:\Windows\System\ifFvzrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\dUNMTkr.exe
  C:\Windows\System\dUNMTkr.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\ZBCUQOo.exe
  C:\Windows\System\ZBCUQOo.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\VZvOKDw.exe
  C:\Windows\System\VZvOKDw.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\gwhhptw.exe
  C:\Windows\System\gwhhptw.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\ILkDLbT.exe
  C:\Windows\System\ILkDLbT.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\FUWehdE.exe
  C:\Windows\System\FUWehdE.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\zHRMKAw.exe
  C:\Windows\System\zHRMKAw.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\qHYADih.exe
  C:\Windows\System\qHYADih.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\fbVxEYi.exe
  C:\Windows\System\fbVxEYi.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\EmjNtWl.exe
  C:\Windows\System\EmjNtWl.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\wkBDLQN.exe
  C:\Windows\System\wkBDLQN.exe
  2⤵
  PID:3892
- C:\Windows\System\RnBsxkl.exe
  C:\Windows\System\RnBsxkl.exe
  2⤵
  PID:704
- C:\Windows\System\zfZhUMN.exe
  C:\Windows\System\zfZhUMN.exe
  2⤵
  PID:2536
- C:\Windows\System\NMmnrHi.exe
  C:\Windows\System\NMmnrHi.exe
  2⤵
  PID:3496
- C:\Windows\System\JgvOlRJ.exe
  C:\Windows\System\JgvOlRJ.exe
  2⤵
  PID:4512
- C:\Windows\System\hhatEUf.exe
  C:\Windows\System\hhatEUf.exe
  2⤵
  PID:2780
- C:\Windows\System\sZSTgKT.exe
  C:\Windows\System\sZSTgKT.exe
  2⤵
  PID:3540
- C:\Windows\System\KPDHGuX.exe
  C:\Windows\System\KPDHGuX.exe
  2⤵
  PID:4856
- C:\Windows\System\CUvAlYF.exe
  C:\Windows\System\CUvAlYF.exe
  2⤵
  PID:2812
- C:\Windows\System\QcLGMjT.exe
  C:\Windows\System\QcLGMjT.exe
  2⤵
  PID:4888
- C:\Windows\System\uKjtHtV.exe
  C:\Windows\System\uKjtHtV.exe
  2⤵
  PID:1816
- C:\Windows\System\crVSgbr.exe
  C:\Windows\System\crVSgbr.exe
  2⤵
  PID:4648
- C:\Windows\System\bdWDNmc.exe
  C:\Windows\System\bdWDNmc.exe
  2⤵
  PID:4028
- C:\Windows\System\gryvwvC.exe
  C:\Windows\System\gryvwvC.exe
  2⤵
  PID:2268
- C:\Windows\System\rwJrfYF.exe
  C:\Windows\System\rwJrfYF.exe
  2⤵
  PID:2424
- C:\Windows\System\jyDqsAP.exe
  C:\Windows\System\jyDqsAP.exe
  2⤵
  PID:3632
- C:\Windows\System\zQxbLKN.exe
  C:\Windows\System\zQxbLKN.exe
  2⤵
  PID:4560
- C:\Windows\System\GXlrocX.exe
  C:\Windows\System\GXlrocX.exe
  2⤵
  PID:4460
- C:\Windows\System\YDOSgZc.exe
  C:\Windows\System\YDOSgZc.exe
  2⤵
  PID:2012
- C:\Windows\System\WYyCIZg.exe
  C:\Windows\System\WYyCIZg.exe
  2⤵
  PID:2864
- C:\Windows\System\CvASLSD.exe
  C:\Windows\System\CvASLSD.exe
  2⤵
  PID:2260
- C:\Windows\System\joLiMwS.exe
  C:\Windows\System\joLiMwS.exe
  2⤵
  PID:4396
- C:\Windows\System\ZgkcWrg.exe
  C:\Windows\System\ZgkcWrg.exe
  2⤵
  PID:2264
- C:\Windows\System\eRShpZJ.exe
  C:\Windows\System\eRShpZJ.exe
  2⤵
  PID:3788
- C:\Windows\System\hNfYfde.exe
  C:\Windows\System\hNfYfde.exe
  2⤵
  PID:4680
- C:\Windows\System\hgEavSY.exe
  C:\Windows\System\hgEavSY.exe
  2⤵
  PID:544
- C:\Windows\System\douUCuC.exe
  C:\Windows\System\douUCuC.exe
  2⤵
  PID:1272
- C:\Windows\System\uuYdBMK.exe
  C:\Windows\System\uuYdBMK.exe
  2⤵
  PID:3024
- C:\Windows\System\rGhXyLE.exe
  C:\Windows\System\rGhXyLE.exe
  2⤵
  PID:4392
- C:\Windows\System\UvxyvXz.exe
  C:\Windows\System\UvxyvXz.exe
  2⤵
  PID:4568
- C:\Windows\System\DRlYryt.exe
  C:\Windows\System\DRlYryt.exe
  2⤵
  PID:3120
- C:\Windows\System\ObEeeMk.exe
  C:\Windows\System\ObEeeMk.exe
  2⤵
  PID:4804
- C:\Windows\System\YIaPXLm.exe
  C:\Windows\System\YIaPXLm.exe
  2⤵
  PID:2856
- C:\Windows\System\znutpcI.exe
  C:\Windows\System\znutpcI.exe
  2⤵
  PID:3064
- C:\Windows\System\PRsaZJd.exe
  C:\Windows\System\PRsaZJd.exe
  2⤵
  PID:4328
- C:\Windows\System\IkqBhie.exe
  C:\Windows\System\IkqBhie.exe
  2⤵
  PID:4524
- C:\Windows\System\dMhOEfA.exe
  C:\Windows\System\dMhOEfA.exe
  2⤵
  PID:3696
- C:\Windows\System\ejxjmLR.exe
  C:\Windows\System\ejxjmLR.exe
  2⤵
  PID:1904
- C:\Windows\System\otKNmVF.exe
  C:\Windows\System\otKNmVF.exe
  2⤵
  PID:2400
- C:\Windows\System\SbxdNav.exe
  C:\Windows\System\SbxdNav.exe
  2⤵
  PID:1616
- C:\Windows\System\OYBkcfs.exe
  C:\Windows\System\OYBkcfs.exe
  2⤵
  PID:2756
- C:\Windows\System\zYSNmrA.exe
  C:\Windows\System\zYSNmrA.exe
  2⤵
  PID:5128
- C:\Windows\System\vGYchEc.exe
  C:\Windows\System\vGYchEc.exe
  2⤵
  PID:5152
- C:\Windows\System\AWZZYZU.exe
  C:\Windows\System\AWZZYZU.exe
  2⤵
  PID:5184
- C:\Windows\System\YjDYFFt.exe
  C:\Windows\System\YjDYFFt.exe
  2⤵
  PID:5212
- C:\Windows\System\EMaZgTf.exe
  C:\Windows\System\EMaZgTf.exe
  2⤵
  PID:5244
- C:\Windows\System\EuDsmCv.exe
  C:\Windows\System\EuDsmCv.exe
  2⤵
  PID:5264
- C:\Windows\System\OnMbZsj.exe
  C:\Windows\System\OnMbZsj.exe
  2⤵
  PID:5296
- C:\Windows\System\xqITtQr.exe
  C:\Windows\System\xqITtQr.exe
  2⤵
  PID:5324
- C:\Windows\System\jygTVlo.exe
  C:\Windows\System\jygTVlo.exe
  2⤵
  PID:5348
- C:\Windows\System\bJsUzcX.exe
  C:\Windows\System\bJsUzcX.exe
  2⤵
  PID:5372
- C:\Windows\System\LspSbkG.exe
  C:\Windows\System\LspSbkG.exe
  2⤵
  PID:5400
- C:\Windows\System\mxJRghl.exe
  C:\Windows\System\mxJRghl.exe
  2⤵
  PID:5428
- C:\Windows\System\EETRZQF.exe
  C:\Windows\System\EETRZQF.exe
  2⤵
  PID:5464
- C:\Windows\System\AyjwFqV.exe
  C:\Windows\System\AyjwFqV.exe
  2⤵
  PID:5488
- C:\Windows\System\ZUBTRPo.exe
  C:\Windows\System\ZUBTRPo.exe
  2⤵
  PID:5516
- C:\Windows\System\BGHXGzD.exe
  C:\Windows\System\BGHXGzD.exe
  2⤵
  PID:5544
- C:\Windows\System\KqBfrtj.exe
  C:\Windows\System\KqBfrtj.exe
  2⤵
  PID:5568
- C:\Windows\System\NbVOhYX.exe
  C:\Windows\System\NbVOhYX.exe
  2⤵
  PID:5604
- C:\Windows\System\HiqDAsK.exe
  C:\Windows\System\HiqDAsK.exe
  2⤵
  PID:5628
- C:\Windows\System\DPQYrnH.exe
  C:\Windows\System\DPQYrnH.exe
  2⤵
  PID:5656
- C:\Windows\System\QLxmEDc.exe
  C:\Windows\System\QLxmEDc.exe
  2⤵
  PID:5696
- C:\Windows\System\odgNmPE.exe
  C:\Windows\System\odgNmPE.exe
  2⤵
  PID:5720
- C:\Windows\System\tDkyxcj.exe
  C:\Windows\System\tDkyxcj.exe
  2⤵
  PID:5748
- C:\Windows\System\jSrgNeL.exe
  C:\Windows\System\jSrgNeL.exe
  2⤵
  PID:5780
- C:\Windows\System\tecesPc.exe
  C:\Windows\System\tecesPc.exe
  2⤵
  PID:5808
- C:\Windows\System\pGbgZxS.exe
  C:\Windows\System\pGbgZxS.exe
  2⤵
  PID:5828
- C:\Windows\System\tvGhWIp.exe
  C:\Windows\System\tvGhWIp.exe
  2⤵
  PID:5860
- C:\Windows\System\aKLGdWi.exe
  C:\Windows\System\aKLGdWi.exe
  2⤵
  PID:5888
- C:\Windows\System\sSugYfm.exe
  C:\Windows\System\sSugYfm.exe
  2⤵
  PID:5940
- C:\Windows\System\FpgZhDJ.exe
  C:\Windows\System\FpgZhDJ.exe
  2⤵
  PID:5968
- C:\Windows\System\DiNxtYe.exe
  C:\Windows\System\DiNxtYe.exe
  2⤵
  PID:5996
- C:\Windows\System\svvqAYo.exe
  C:\Windows\System\svvqAYo.exe
  2⤵
  PID:6028
- C:\Windows\System\NuTVxej.exe
  C:\Windows\System\NuTVxej.exe
  2⤵
  PID:6064
- C:\Windows\System\SGDYJoZ.exe
  C:\Windows\System\SGDYJoZ.exe
  2⤵
  PID:6092
- C:\Windows\System\EWkdaRA.exe
  C:\Windows\System\EWkdaRA.exe
  2⤵
  PID:6124
- C:\Windows\System\hQEZoSH.exe
  C:\Windows\System\hQEZoSH.exe
  2⤵
  PID:1580
- C:\Windows\System\odOiMoU.exe
  C:\Windows\System\odOiMoU.exe
  2⤵
  PID:5148
- C:\Windows\System\BomQGOP.exe
  C:\Windows\System\BomQGOP.exe
  2⤵
  PID:1676
- C:\Windows\System\kgKWOXM.exe
  C:\Windows\System\kgKWOXM.exe
  2⤵
  PID:1624
- C:\Windows\System\aosrtQH.exe
  C:\Windows\System\aosrtQH.exe
  2⤵
  PID:5276
- C:\Windows\System\dYpeLnv.exe
  C:\Windows\System\dYpeLnv.exe
  2⤵
  PID:5260
- C:\Windows\System\HpPYALA.exe
  C:\Windows\System\HpPYALA.exe
  2⤵
  PID:5304
- C:\Windows\System\YMFpCZS.exe
  C:\Windows\System\YMFpCZS.exe
  2⤵
  PID:5332
- C:\Windows\System\yNMSKXE.exe
  C:\Windows\System\yNMSKXE.exe
  2⤵
  PID:5256
- C:\Windows\System\WAQUnxJ.exe
  C:\Windows\System\WAQUnxJ.exe
  2⤵
  PID:5552
- C:\Windows\System\rfcesyY.exe
  C:\Windows\System\rfcesyY.exe
  2⤵
  PID:5504
- C:\Windows\System\roxFgLW.exe
  C:\Windows\System\roxFgLW.exe
  2⤵
  PID:5484
- C:\Windows\System\rXEbffX.exe
  C:\Windows\System\rXEbffX.exe
  2⤵
  PID:5648
- C:\Windows\System\ikijmOy.exe
  C:\Windows\System\ikijmOy.exe
  2⤵
  PID:1472
- C:\Windows\System\RHkNRqE.exe
  C:\Windows\System\RHkNRqE.exe
  2⤵
  PID:688
- C:\Windows\System\edcfbBC.exe
  C:\Windows\System\edcfbBC.exe
  2⤵
  PID:6112
- C:\Windows\System\VqgrpLc.exe
  C:\Windows\System\VqgrpLc.exe
  2⤵
  PID:5388
- C:\Windows\System\ZonyHaE.exe
  C:\Windows\System\ZonyHaE.exe
  2⤵
  PID:5196
- C:\Windows\System\AnOQbFP.exe
  C:\Windows\System\AnOQbFP.exe
  2⤵
  PID:5680
- C:\Windows\System\SpeCWKF.exe
  C:\Windows\System\SpeCWKF.exe
  2⤵
  PID:5440
- C:\Windows\System\IVPASRD.exe
  C:\Windows\System\IVPASRD.exe
  2⤵
  PID:5744
- C:\Windows\System\VuBIKlg.exe
  C:\Windows\System\VuBIKlg.exe
  2⤵
  PID:5776
- C:\Windows\System\GMKioDH.exe
  C:\Windows\System\GMKioDH.exe
  2⤵
  PID:4916
- C:\Windows\System\sTyiODs.exe
  C:\Windows\System\sTyiODs.exe
  2⤵
  PID:2248
- C:\Windows\System\dEkhAMf.exe
  C:\Windows\System\dEkhAMf.exe
  2⤵
  PID:5316
- C:\Windows\System\xEkWgbL.exe
  C:\Windows\System\xEkWgbL.exe
  2⤵
  PID:5444
- C:\Windows\System\sqhRuAl.exe
  C:\Windows\System\sqhRuAl.exe
  2⤵
  PID:5560
- C:\Windows\System\RGXIiFc.exe
  C:\Windows\System\RGXIiFc.exe
  2⤵
  PID:6044
- C:\Windows\System\CEhITVR.exe
  C:\Windows\System\CEhITVR.exe
  2⤵
  PID:6164
- C:\Windows\System\nIRKwlP.exe
  C:\Windows\System\nIRKwlP.exe
  2⤵
  PID:6188
- C:\Windows\System\ehCKXaC.exe
  C:\Windows\System\ehCKXaC.exe
  2⤵
  PID:6212
- C:\Windows\System\SXVKZVI.exe
  C:\Windows\System\SXVKZVI.exe
  2⤵
  PID:6240
- C:\Windows\System\MqljOSd.exe
  C:\Windows\System\MqljOSd.exe
  2⤵
  PID:6272
- C:\Windows\System\vXDiHGP.exe
  C:\Windows\System\vXDiHGP.exe
  2⤵
  PID:6292
- C:\Windows\System\GkPRLYo.exe
  C:\Windows\System\GkPRLYo.exe
  2⤵
  PID:6320
- C:\Windows\System\rTYGPiW.exe
  C:\Windows\System\rTYGPiW.exe
  2⤵
  PID:6340
- C:\Windows\System\oJdjRHR.exe
  C:\Windows\System\oJdjRHR.exe
  2⤵
  PID:6364
- C:\Windows\System\MXAXWFw.exe
  C:\Windows\System\MXAXWFw.exe
  2⤵
  PID:6388
- C:\Windows\System\MXcTBDf.exe
  C:\Windows\System\MXcTBDf.exe
  2⤵
  PID:6412
- C:\Windows\System\oLmQZQX.exe
  C:\Windows\System\oLmQZQX.exe
  2⤵
  PID:6436
- C:\Windows\System\BlzUXkB.exe
  C:\Windows\System\BlzUXkB.exe
  2⤵
  PID:6452
- C:\Windows\System\LTKbOsI.exe
  C:\Windows\System\LTKbOsI.exe
  2⤵
  PID:6476
- C:\Windows\System\MnEzmrX.exe
  C:\Windows\System\MnEzmrX.exe
  2⤵
  PID:6508
- C:\Windows\System\coAPvdB.exe
  C:\Windows\System\coAPvdB.exe
  2⤵
  PID:6536
- C:\Windows\System\WlUbxei.exe
  C:\Windows\System\WlUbxei.exe
  2⤵
  PID:6560
- C:\Windows\System\TMBjuow.exe
  C:\Windows\System\TMBjuow.exe
  2⤵
  PID:6584
- C:\Windows\System\ZMtOkwP.exe
  C:\Windows\System\ZMtOkwP.exe
  2⤵
  PID:6612
- C:\Windows\System\dmvvGKP.exe
  C:\Windows\System\dmvvGKP.exe
  2⤵
  PID:6636
- C:\Windows\System\ybGAcXI.exe
  C:\Windows\System\ybGAcXI.exe
  2⤵
  PID:6660
- C:\Windows\System\HhPqkIL.exe
  C:\Windows\System\HhPqkIL.exe
  2⤵
  PID:6692
- C:\Windows\System\VCMgmqm.exe
  C:\Windows\System\VCMgmqm.exe
  2⤵
  PID:6720
- C:\Windows\System\VvgtyNj.exe
  C:\Windows\System\VvgtyNj.exe
  2⤵
  PID:6752
- C:\Windows\System\AxjRufM.exe
  C:\Windows\System\AxjRufM.exe
  2⤵
  PID:6776
- C:\Windows\System\rKXuDpk.exe
  C:\Windows\System\rKXuDpk.exe
  2⤵
  PID:6816
- C:\Windows\System\SFsULng.exe
  C:\Windows\System\SFsULng.exe
  2⤵
  PID:6832
- C:\Windows\System\yMlOcRs.exe
  C:\Windows\System\yMlOcRs.exe
  2⤵
  PID:6856
- C:\Windows\System\yUDXNDM.exe
  C:\Windows\System\yUDXNDM.exe
  2⤵
  PID:6876
- C:\Windows\System\wasSqTk.exe
  C:\Windows\System\wasSqTk.exe
  2⤵
  PID:6912
- C:\Windows\System\IbcaFpX.exe
  C:\Windows\System\IbcaFpX.exe
  2⤵
  PID:6936
- C:\Windows\System\vADYtsT.exe
  C:\Windows\System\vADYtsT.exe
  2⤵
  PID:6952
- C:\Windows\System\rDwolgf.exe
  C:\Windows\System\rDwolgf.exe
  2⤵
  PID:6984
- C:\Windows\System\QYDRDwU.exe
  C:\Windows\System\QYDRDwU.exe
  2⤵
  PID:7004
- C:\Windows\System\oDvUrSm.exe
  C:\Windows\System\oDvUrSm.exe
  2⤵
  PID:7028
- C:\Windows\System\hQYHeEO.exe
  C:\Windows\System\hQYHeEO.exe
  2⤵
  PID:7052
- C:\Windows\System\NbqpggH.exe
  C:\Windows\System\NbqpggH.exe
  2⤵
  PID:7076
- C:\Windows\System\thANuJL.exe
  C:\Windows\System\thANuJL.exe
  2⤵
  PID:7096
- C:\Windows\System\AZpRgMM.exe
  C:\Windows\System\AZpRgMM.exe
  2⤵
  PID:7116
- C:\Windows\System\VjArEEK.exe
  C:\Windows\System\VjArEEK.exe
  2⤵
  PID:7140
- C:\Windows\System\WioelDG.exe
  C:\Windows\System\WioelDG.exe
  2⤵
  PID:7160
- C:\Windows\System\sokTWAw.exe
  C:\Windows\System\sokTWAw.exe
  2⤵
  PID:6180
- C:\Windows\System\RbfgwPB.exe
  C:\Windows\System\RbfgwPB.exe
  2⤵
  PID:6220
- C:\Windows\System\exhvFJP.exe
  C:\Windows\System\exhvFJP.exe
  2⤵
  PID:6172
- C:\Windows\System\sPgzhVH.exe
  C:\Windows\System\sPgzhVH.exe
  2⤵
  PID:6308
- C:\Windows\System\xuqxtiE.exe
  C:\Windows\System\xuqxtiE.exe
  2⤵
  PID:6376
- C:\Windows\System\NBRvYmg.exe
  C:\Windows\System\NBRvYmg.exe
  2⤵
  PID:6428
- C:\Windows\System\XcrZoOp.exe
  C:\Windows\System\XcrZoOp.exe
  2⤵
  PID:6500
- C:\Windows\System\qrCUhlj.exe
  C:\Windows\System\qrCUhlj.exe
  2⤵
  PID:6556
- C:\Windows\System\ynQppEu.exe
  C:\Windows\System\ynQppEu.exe
  2⤵
  PID:6572
- C:\Windows\System\BSXzMVo.exe
  C:\Windows\System\BSXzMVo.exe
  2⤵
  PID:6604
- C:\Windows\System\nSqlopB.exe
  C:\Windows\System\nSqlopB.exe
  2⤵
  PID:6716
- C:\Windows\System\FOHclkG.exe
  C:\Windows\System\FOHclkG.exe
  2⤵
  PID:6824
- C:\Windows\System\WHmQGJg.exe
  C:\Windows\System\WHmQGJg.exe
  2⤵
  PID:6736
- C:\Windows\System\tnWbVrF.exe
  C:\Windows\System\tnWbVrF.exe
  2⤵
  PID:6848
- C:\Windows\System\lUoowlg.exe
  C:\Windows\System\lUoowlg.exe
  2⤵
  PID:6748
- C:\Windows\System\NXCENWl.exe
  C:\Windows\System\NXCENWl.exe
  2⤵
  PID:7040
- C:\Windows\System\waYYPcQ.exe
  C:\Windows\System\waYYPcQ.exe
  2⤵
  PID:6964
- C:\Windows\System\IrvGBLS.exe
  C:\Windows\System\IrvGBLS.exe
  2⤵
  PID:7136
- C:\Windows\System\JPrrWUr.exe
  C:\Windows\System\JPrrWUr.exe
  2⤵
  PID:7092
- C:\Windows\System\AIxIQzN.exe
  C:\Windows\System\AIxIQzN.exe
  2⤵
  PID:7104
- C:\Windows\System\hDsUYPh.exe
  C:\Windows\System\hDsUYPh.exe
  2⤵
  PID:6400
- C:\Windows\System\ABGTJoI.exe
  C:\Windows\System\ABGTJoI.exe
  2⤵
  PID:6200
- C:\Windows\System\rlYHsLy.exe
  C:\Windows\System\rlYHsLy.exe
  2⤵
  PID:6928
- C:\Windows\System\PJHnTHS.exe
  C:\Windows\System\PJHnTHS.exe
  2⤵
  PID:7188
- C:\Windows\System\RgGRaGz.exe
  C:\Windows\System\RgGRaGz.exe
  2⤵
  PID:7220
- C:\Windows\System\MYAtlve.exe
  C:\Windows\System\MYAtlve.exe
  2⤵
  PID:7240
- C:\Windows\System\RVOVpCr.exe
  C:\Windows\System\RVOVpCr.exe
  2⤵
  PID:7268
- C:\Windows\System\VtyvwJS.exe
  C:\Windows\System\VtyvwJS.exe
  2⤵
  PID:7300
- C:\Windows\System\fAhetJL.exe
  C:\Windows\System\fAhetJL.exe
  2⤵
  PID:7316
- C:\Windows\System\xNNceKN.exe
  C:\Windows\System\xNNceKN.exe
  2⤵
  PID:7344
- C:\Windows\System\GEMZdiv.exe
  C:\Windows\System\GEMZdiv.exe
  2⤵
  PID:7376
- C:\Windows\System\suIyKqY.exe
  C:\Windows\System\suIyKqY.exe
  2⤵
  PID:7396
- C:\Windows\System\osPpsYj.exe
  C:\Windows\System\osPpsYj.exe
  2⤵
  PID:7424
- C:\Windows\System\PlcPnAK.exe
  C:\Windows\System\PlcPnAK.exe
  2⤵
  PID:7456
- C:\Windows\System\XnyNKQh.exe
  C:\Windows\System\XnyNKQh.exe
  2⤵
  PID:7480
- C:\Windows\System\WCBQHeS.exe
  C:\Windows\System\WCBQHeS.exe
  2⤵
  PID:7508
- C:\Windows\System\qlvEyxv.exe
  C:\Windows\System\qlvEyxv.exe
  2⤵
  PID:7532
- C:\Windows\System\dWWNeFl.exe
  C:\Windows\System\dWWNeFl.exe
  2⤵
  PID:7560
- C:\Windows\System\housJqp.exe
  C:\Windows\System\housJqp.exe
  2⤵
  PID:7584
- C:\Windows\System\DKXKfTQ.exe
  C:\Windows\System\DKXKfTQ.exe
  2⤵
  PID:7612
- C:\Windows\System\euRbWRH.exe
  C:\Windows\System\euRbWRH.exe
  2⤵
  PID:7636
- C:\Windows\System\MVprwtC.exe
  C:\Windows\System\MVprwtC.exe
  2⤵
  PID:7664
- C:\Windows\System\oRyeKFU.exe
  C:\Windows\System\oRyeKFU.exe
  2⤵
  PID:7684
- C:\Windows\System\gHNSCqv.exe
  C:\Windows\System\gHNSCqv.exe
  2⤵
  PID:7704
- C:\Windows\System\nCLCqph.exe
  C:\Windows\System\nCLCqph.exe
  2⤵
  PID:7724
- C:\Windows\System\zJqLKRk.exe
  C:\Windows\System\zJqLKRk.exe
  2⤵
  PID:7756
- C:\Windows\System\XQYVbLs.exe
  C:\Windows\System\XQYVbLs.exe
  2⤵
  PID:7780
- C:\Windows\System\dvZIGFx.exe
  C:\Windows\System\dvZIGFx.exe
  2⤵
  PID:7800
- C:\Windows\System\QGpGXpp.exe
  C:\Windows\System\QGpGXpp.exe
  2⤵
  PID:7828
- C:\Windows\System\NUJRxcw.exe
  C:\Windows\System\NUJRxcw.exe
  2⤵
  PID:7852
- C:\Windows\System\rHQutWi.exe
  C:\Windows\System\rHQutWi.exe
  2⤵
  PID:7880
- C:\Windows\System\IXXFGdY.exe
  C:\Windows\System\IXXFGdY.exe
  2⤵
  PID:7904
- C:\Windows\System\JYnnMPi.exe
  C:\Windows\System\JYnnMPi.exe
  2⤵
  PID:7924
- C:\Windows\System\qkiyHyU.exe
  C:\Windows\System\qkiyHyU.exe
  2⤵
  PID:7948
- C:\Windows\System\ePcBRCm.exe
  C:\Windows\System\ePcBRCm.exe
  2⤵
  PID:7968
- C:\Windows\System\GiaxZoR.exe
  C:\Windows\System\GiaxZoR.exe
  2⤵
  PID:7988
- C:\Windows\System\CamuyTn.exe
  C:\Windows\System\CamuyTn.exe
  2⤵
  PID:8016
- C:\Windows\System\VszdmGB.exe
  C:\Windows\System\VszdmGB.exe
  2⤵
  PID:8040
- C:\Windows\System\mAvwJXL.exe
  C:\Windows\System\mAvwJXL.exe
  2⤵
  PID:8064
- C:\Windows\System\oyjWkMR.exe
  C:\Windows\System\oyjWkMR.exe
  2⤵
  PID:8084
- C:\Windows\System\DXbqXeN.exe
  C:\Windows\System\DXbqXeN.exe
  2⤵
  PID:8116
- C:\Windows\System\rgWMNKY.exe
  C:\Windows\System\rgWMNKY.exe
  2⤵
  PID:8140
- C:\Windows\System\kROFujy.exe
  C:\Windows\System\kROFujy.exe
  2⤵
  PID:8160
- C:\Windows\System\yeetsCX.exe
  C:\Windows\System\yeetsCX.exe
  2⤵
  PID:8188
- C:\Windows\System\tNERiQb.exe
  C:\Windows\System\tNERiQb.exe
  2⤵
  PID:6548
- C:\Windows\System\CRLIkuh.exe
  C:\Windows\System\CRLIkuh.exe
  2⤵
  PID:6284
- C:\Windows\System\stkwElk.exe
  C:\Windows\System\stkwElk.exe
  2⤵
  PID:6872
- C:\Windows\System\ENzxpSf.exe
  C:\Windows\System\ENzxpSf.exe
  2⤵
  PID:7016
- C:\Windows\System\UDGCKfX.exe
  C:\Windows\System\UDGCKfX.exe
  2⤵
  PID:6652
- C:\Windows\System\EtETPNP.exe
  C:\Windows\System\EtETPNP.exe
  2⤵
  PID:7264
- C:\Windows\System\KExTpQV.exe
  C:\Windows\System\KExTpQV.exe
  2⤵
  PID:7308
- C:\Windows\System\FFSZWvQ.exe
  C:\Windows\System\FFSZWvQ.exe
  2⤵
  PID:7364
- C:\Windows\System\kMpdRgP.exe
  C:\Windows\System\kMpdRgP.exe
  2⤵
  PID:7152
- C:\Windows\System\GJsfcRp.exe
  C:\Windows\System\GJsfcRp.exe
  2⤵
  PID:7280
- C:\Windows\System\sGyCIeA.exe
  C:\Windows\System\sGyCIeA.exe
  2⤵
  PID:7572
- C:\Windows\System\fypyhga.exe
  C:\Windows\System\fypyhga.exe
  2⤵
  PID:7652
- C:\Windows\System\QVmRrQU.exe
  C:\Windows\System\QVmRrQU.exe
  2⤵
  PID:7696
- C:\Windows\System\DcmRJPS.exe
  C:\Windows\System\DcmRJPS.exe
  2⤵
  PID:7496
- C:\Windows\System\jSeaVbc.exe
  C:\Windows\System\jSeaVbc.exe
  2⤵
  PID:7896
- C:\Windows\System\eMzXRsl.exe
  C:\Windows\System\eMzXRsl.exe
  2⤵
  PID:8036
- C:\Windows\System\fqWFFZX.exe
  C:\Windows\System\fqWFFZX.exe
  2⤵
  PID:7528
- C:\Windows\System\MSIMVhe.exe
  C:\Windows\System\MSIMVhe.exe
  2⤵
  PID:7820
- C:\Windows\System\npZrIlN.exe
  C:\Windows\System\npZrIlN.exe
  2⤵
  PID:8152
- C:\Windows\System\BYrQpMX.exe
  C:\Windows\System\BYrQpMX.exe
  2⤵
  PID:7980
- C:\Windows\System\CACBqDW.exe
  C:\Windows\System\CACBqDW.exe
  2⤵
  PID:8060
- C:\Windows\System\dXsNqQv.exe
  C:\Windows\System\dXsNqQv.exe
  2⤵
  PID:8112
- C:\Windows\System\XMlMLep.exe
  C:\Windows\System\XMlMLep.exe
  2⤵
  PID:7404
- C:\Windows\System\dBadTta.exe
  C:\Windows\System\dBadTta.exe
  2⤵
  PID:8156
- C:\Windows\System\PMoQpoh.exe
  C:\Windows\System\PMoQpoh.exe
  2⤵
  PID:7412
- C:\Windows\System\UTxAgCf.exe
  C:\Windows\System\UTxAgCf.exe
  2⤵
  PID:6596
- C:\Windows\System\VCljPvm.exe
  C:\Windows\System\VCljPvm.exe
  2⤵
  PID:7372
- C:\Windows\System\uoDRTix.exe
  C:\Windows\System\uoDRTix.exe
  2⤵
  PID:8000
- C:\Windows\System\nDplRcv.exe
  C:\Windows\System\nDplRcv.exe
  2⤵
  PID:7248
- C:\Windows\System\pDoHJIB.exe
  C:\Windows\System\pDoHJIB.exe
  2⤵
  PID:8212
- C:\Windows\System\pAUCkIK.exe
  C:\Windows\System\pAUCkIK.exe
  2⤵
  PID:8232
- C:\Windows\System\sFRgjEV.exe
  C:\Windows\System\sFRgjEV.exe
  2⤵
  PID:8248
- C:\Windows\System\GEmPCES.exe
  C:\Windows\System\GEmPCES.exe
  2⤵
  PID:8268
- C:\Windows\System\BnQIKUu.exe
  C:\Windows\System\BnQIKUu.exe
  2⤵
  PID:8296
- C:\Windows\System\WOnSuoq.exe
  C:\Windows\System\WOnSuoq.exe
  2⤵
  PID:8316
- C:\Windows\System\aKiMTSe.exe
  C:\Windows\System\aKiMTSe.exe
  2⤵
  PID:8344
- C:\Windows\System\udyngCB.exe
  C:\Windows\System\udyngCB.exe
  2⤵
  PID:8372
- C:\Windows\System\CWuvQfa.exe
  C:\Windows\System\CWuvQfa.exe
  2⤵
  PID:8400
- C:\Windows\System\BkYGcVO.exe
  C:\Windows\System\BkYGcVO.exe
  2⤵
  PID:8420
- C:\Windows\System\cdYsfrW.exe
  C:\Windows\System\cdYsfrW.exe
  2⤵
  PID:8444
- C:\Windows\System\kgoduIb.exe
  C:\Windows\System\kgoduIb.exe
  2⤵
  PID:8468
- C:\Windows\System\RigxQVi.exe
  C:\Windows\System\RigxQVi.exe
  2⤵
  PID:8492
- C:\Windows\System\glewZMB.exe
  C:\Windows\System\glewZMB.exe
  2⤵
  PID:8508
- C:\Windows\System\offUpjz.exe
  C:\Windows\System\offUpjz.exe
  2⤵
  PID:8528
- C:\Windows\System\bdUBjaK.exe
  C:\Windows\System\bdUBjaK.exe
  2⤵
  PID:8580
- C:\Windows\System\WuagLcB.exe
  C:\Windows\System\WuagLcB.exe
  2⤵
  PID:8596
- C:\Windows\System\sMbiiYr.exe
  C:\Windows\System\sMbiiYr.exe
  2⤵
  PID:8616
- C:\Windows\System\SrIHUrS.exe
  C:\Windows\System\SrIHUrS.exe
  2⤵
  PID:8644
- C:\Windows\System\oSPEjvd.exe
  C:\Windows\System\oSPEjvd.exe
  2⤵
  PID:8660
- C:\Windows\System\zoqkFrl.exe
  C:\Windows\System\zoqkFrl.exe
  2⤵
  PID:8680
- C:\Windows\System\VIeldjw.exe
  C:\Windows\System\VIeldjw.exe
  2⤵
  PID:8724
- C:\Windows\System\gtyAbJi.exe
  C:\Windows\System\gtyAbJi.exe
  2⤵
  PID:8740
- C:\Windows\System\iJAsrTn.exe
  C:\Windows\System\iJAsrTn.exe
  2⤵
  PID:8760
- C:\Windows\System\uyRVEEl.exe
  C:\Windows\System\uyRVEEl.exe
  2⤵
  PID:8784
- C:\Windows\System\sWkiSOr.exe
  C:\Windows\System\sWkiSOr.exe
  2⤵
  PID:8804
- C:\Windows\System\ibvVckH.exe
  C:\Windows\System\ibvVckH.exe
  2⤵
  PID:8836
- C:\Windows\System\rMyYBpg.exe
  C:\Windows\System\rMyYBpg.exe
  2⤵
  PID:8852
- C:\Windows\System\RdPXhoF.exe
  C:\Windows\System\RdPXhoF.exe
  2⤵
  PID:8872
- C:\Windows\System\UhLojCc.exe
  C:\Windows\System\UhLojCc.exe
  2⤵
  PID:8900
- C:\Windows\System\SmUYJnp.exe
  C:\Windows\System\SmUYJnp.exe
  2⤵
  PID:8920
- C:\Windows\System\WDMrGsO.exe
  C:\Windows\System\WDMrGsO.exe
  2⤵
  PID:8948
- C:\Windows\System\GWEmZsk.exe
  C:\Windows\System\GWEmZsk.exe
  2⤵
  PID:8972
- C:\Windows\System\BUjUmNP.exe
  C:\Windows\System\BUjUmNP.exe
  2⤵
  PID:9000
- C:\Windows\System\TESOqZJ.exe
  C:\Windows\System\TESOqZJ.exe
  2⤵
  PID:9024
- C:\Windows\System\ECPAXGQ.exe
  C:\Windows\System\ECPAXGQ.exe
  2⤵
  PID:9040
- C:\Windows\System\SDTeuON.exe
  C:\Windows\System\SDTeuON.exe
  2⤵
  PID:9056
- C:\Windows\System\jrbEdRd.exe
  C:\Windows\System\jrbEdRd.exe
  2⤵
  PID:9080
- C:\Windows\System\ocytytB.exe
  C:\Windows\System\ocytytB.exe
  2⤵
  PID:9104
- C:\Windows\System\RqfZeUp.exe
  C:\Windows\System\RqfZeUp.exe
  2⤵
  PID:9132
- C:\Windows\System\rTweFNK.exe
  C:\Windows\System\rTweFNK.exe
  2⤵
  PID:9148
- C:\Windows\System\fcjmCoL.exe
  C:\Windows\System\fcjmCoL.exe
  2⤵
  PID:9172
- C:\Windows\System\NmgIRxj.exe
  C:\Windows\System\NmgIRxj.exe
  2⤵
  PID:9200
- C:\Windows\System\tcytduC.exe
  C:\Windows\System\tcytduC.exe
  2⤵
  PID:6408
- C:\Windows\System\TINMJQY.exe
  C:\Windows\System\TINMJQY.exe
  2⤵
  PID:7860
- C:\Windows\System\qnblKXv.exe
  C:\Windows\System\qnblKXv.exe
  2⤵
  PID:8184
- C:\Windows\System\ZCrtuWb.exe
  C:\Windows\System\ZCrtuWb.exe
  2⤵
  PID:8128
- C:\Windows\System\jZZWUHA.exe
  C:\Windows\System\jZZWUHA.exe
  2⤵
  PID:7788
- C:\Windows\System\SYJmgmr.exe
  C:\Windows\System\SYJmgmr.exe
  2⤵
  PID:8292
- C:\Windows\System\fZbOUXZ.exe
  C:\Windows\System\fZbOUXZ.exe
  2⤵
  PID:8336
- C:\Windows\System\AnNBBaK.exe
  C:\Windows\System\AnNBBaK.exe
  2⤵
  PID:8464
- C:\Windows\System\wuMHAoD.exe
  C:\Windows\System\wuMHAoD.exe
  2⤵
  PID:8592
- C:\Windows\System\YZcbTJc.exe
  C:\Windows\System\YZcbTJc.exe
  2⤵
  PID:8284
- C:\Windows\System\ZxlysuP.exe
  C:\Windows\System\ZxlysuP.exe
  2⤵
  PID:7700
- C:\Windows\System\tRsanTs.exe
  C:\Windows\System\tRsanTs.exe
  2⤵
  PID:8412
- C:\Windows\System\oLWtHPw.exe
  C:\Windows\System\oLWtHPw.exe
  2⤵
  PID:8800
- C:\Windows\System\nCUirYO.exe
  C:\Windows\System\nCUirYO.exe
  2⤵
  PID:8520
- C:\Windows\System\uXuCKTi.exe
  C:\Windows\System\uXuCKTi.exe
  2⤵
  PID:7212
- C:\Windows\System\znnbtgZ.exe
  C:\Windows\System\znnbtgZ.exe
  2⤵
  PID:8932
- C:\Windows\System\GURdNFs.exe
  C:\Windows\System\GURdNFs.exe
  2⤵
  PID:8984
- C:\Windows\System\kyHpkzC.exe
  C:\Windows\System\kyHpkzC.exe
  2⤵
  PID:9220
- C:\Windows\System\xFuVUIE.exe
  C:\Windows\System\xFuVUIE.exe
  2⤵
  PID:9244
- C:\Windows\System\tPIbWyp.exe
  C:\Windows\System\tPIbWyp.exe
  2⤵
  PID:9260
- C:\Windows\System\oZPcjwC.exe
  C:\Windows\System\oZPcjwC.exe
  2⤵
  PID:9292
- C:\Windows\System\IgdRRaR.exe
  C:\Windows\System\IgdRRaR.exe
  2⤵
  PID:9312
- C:\Windows\System\qBbcIJa.exe
  C:\Windows\System\qBbcIJa.exe
  2⤵
  PID:9348
- C:\Windows\System\Jvkpqsb.exe
  C:\Windows\System\Jvkpqsb.exe
  2⤵
  PID:9364
- C:\Windows\System\jlJeFXY.exe
  C:\Windows\System\jlJeFXY.exe
  2⤵
  PID:9388
- C:\Windows\System\CJbSuGj.exe
  C:\Windows\System\CJbSuGj.exe
  2⤵
  PID:9412
- C:\Windows\System\NrFCxNn.exe
  C:\Windows\System\NrFCxNn.exe
  2⤵
  PID:9432
- C:\Windows\System\lTXOcfK.exe
  C:\Windows\System\lTXOcfK.exe
  2⤵
  PID:9456
- C:\Windows\System\vmiykTv.exe
  C:\Windows\System\vmiykTv.exe
  2⤵
  PID:9484
- C:\Windows\System\kyHbpVW.exe
  C:\Windows\System\kyHbpVW.exe
  2⤵
  PID:9500
- C:\Windows\System\PcNiDuo.exe
  C:\Windows\System\PcNiDuo.exe
  2⤵
  PID:9528
- C:\Windows\System\rnqlqPc.exe
  C:\Windows\System\rnqlqPc.exe
  2⤵
  PID:9544
- C:\Windows\System\cmvUfid.exe
  C:\Windows\System\cmvUfid.exe
  2⤵
  PID:9560
- C:\Windows\System\RzDAdGL.exe
  C:\Windows\System\RzDAdGL.exe
  2⤵
  PID:9588
- C:\Windows\System\UXgNHDG.exe
  C:\Windows\System\UXgNHDG.exe
  2⤵
  PID:9612
- C:\Windows\System\HLcAwVF.exe
  C:\Windows\System\HLcAwVF.exe
  2⤵
  PID:9736
- C:\Windows\System\YljHCEo.exe
  C:\Windows\System\YljHCEo.exe
  2⤵
  PID:9752
- C:\Windows\System\lRjpELq.exe
  C:\Windows\System\lRjpELq.exe
  2⤵
  PID:9768
- C:\Windows\System\AVOFAjb.exe
  C:\Windows\System\AVOFAjb.exe
  2⤵
  PID:9784
- C:\Windows\System\UxtppRG.exe
  C:\Windows\System\UxtppRG.exe
  2⤵
  PID:9824
- C:\Windows\System\raUvYbN.exe
  C:\Windows\System\raUvYbN.exe
  2⤵
  PID:9844
- C:\Windows\System\rzqXsxU.exe
  C:\Windows\System\rzqXsxU.exe
  2⤵
  PID:9860
- C:\Windows\System\oEFsTle.exe
  C:\Windows\System\oEFsTle.exe
  2⤵
  PID:9880
- C:\Windows\System\IYEklPF.exe
  C:\Windows\System\IYEklPF.exe
  2⤵
  PID:9900
- C:\Windows\System\LnrEejs.exe
  C:\Windows\System\LnrEejs.exe
  2⤵
  PID:9928
- C:\Windows\System\CHpHfSi.exe
  C:\Windows\System\CHpHfSi.exe
  2⤵
  PID:9956
- C:\Windows\System\YBNFExR.exe
  C:\Windows\System\YBNFExR.exe
  2⤵
  PID:9976
- C:\Windows\System\jxUwOoM.exe
  C:\Windows\System\jxUwOoM.exe
  2⤵
  PID:9996
- C:\Windows\System\KqAPZxK.exe
  C:\Windows\System\KqAPZxK.exe
  2⤵
  PID:10028
- C:\Windows\System\gGevZQr.exe
  C:\Windows\System\gGevZQr.exe
  2⤵
  PID:10060
- C:\Windows\System\nJQnXlg.exe
  C:\Windows\System\nJQnXlg.exe
  2⤵
  PID:10092
- C:\Windows\System\qNwTWru.exe
  C:\Windows\System\qNwTWru.exe
  2⤵
  PID:10112
- C:\Windows\System\hhuvAtg.exe
  C:\Windows\System\hhuvAtg.exe
  2⤵
  PID:10140
- C:\Windows\System\zJbsXGQ.exe
  C:\Windows\System\zJbsXGQ.exe
  2⤵
  PID:10168
- C:\Windows\System\yfgZaEC.exe
  C:\Windows\System\yfgZaEC.exe
  2⤵
  PID:10184
- C:\Windows\System\opjnfca.exe
  C:\Windows\System\opjnfca.exe
  2⤵
  PID:10204
- C:\Windows\System\yfpQUBG.exe
  C:\Windows\System\yfpQUBG.exe
  2⤵
  PID:10224
- C:\Windows\System\wWuBQNo.exe
  C:\Windows\System\wWuBQNo.exe
  2⤵
  PID:9048
- C:\Windows\System\nndPtCu.exe
  C:\Windows\System\nndPtCu.exe
  2⤵
  PID:9076
- C:\Windows\System\KuZFrml.exe
  C:\Windows\System\KuZFrml.exe
  2⤵
  PID:9160
- C:\Windows\System\mjaDgRr.exe
  C:\Windows\System\mjaDgRr.exe
  2⤵
  PID:8416
- C:\Windows\System\QXOIdRM.exe
  C:\Windows\System\QXOIdRM.exe
  2⤵
  PID:8136
- C:\Windows\System\LEMyIiO.exe
  C:\Windows\System\LEMyIiO.exe
  2⤵
  PID:8824
- C:\Windows\System\ugPzrkn.exe
  C:\Windows\System\ugPzrkn.exe
  2⤵
  PID:8844
- C:\Windows\System\JsPmuSn.exe
  C:\Windows\System\JsPmuSn.exe
  2⤵
  PID:8888
- C:\Windows\System\GrmpeYY.exe
  C:\Windows\System\GrmpeYY.exe
  2⤵
  PID:7720
- C:\Windows\System\ROGoDEZ.exe
  C:\Windows\System\ROGoDEZ.exe
  2⤵
  PID:9140
- C:\Windows\System\BqwRgmF.exe
  C:\Windows\System\BqwRgmF.exe
  2⤵
  PID:7392
- C:\Windows\System\OKRhWrv.exe
  C:\Windows\System\OKRhWrv.exe
  2⤵
  PID:7544
- C:\Windows\System\GTRuylo.exe
  C:\Windows\System\GTRuylo.exe
  2⤵
  PID:9624
- C:\Windows\System\CUYTPBl.exe
  C:\Windows\System\CUYTPBl.exe
  2⤵
  PID:8960
- C:\Windows\System\HgAPXcy.exe
  C:\Windows\System\HgAPXcy.exe
  2⤵
  PID:9324
- C:\Windows\System\IepirpA.exe
  C:\Windows\System\IepirpA.exe
  2⤵
  PID:8076
- C:\Windows\System\RVEvFHI.exe
  C:\Windows\System\RVEvFHI.exe
  2⤵
  PID:9508
- C:\Windows\System\gobMEro.exe
  C:\Windows\System\gobMEro.exe
  2⤵
  PID:9608
- C:\Windows\System\AlstlZu.exe
  C:\Windows\System\AlstlZu.exe
  2⤵
  PID:8244
- C:\Windows\System\CsHQrPo.exe
  C:\Windows\System\CsHQrPo.exe
  2⤵
  PID:9240
- C:\Windows\System\tcxKFYl.exe
  C:\Windows\System\tcxKFYl.exe
  2⤵
  PID:8612
- C:\Windows\System\LqOqivF.exe
  C:\Windows\System\LqOqivF.exe
  2⤵
  PID:9840
- C:\Windows\System\mHqbeWV.exe
  C:\Windows\System\mHqbeWV.exe
  2⤵
  PID:9920
- C:\Windows\System\FdZrtQt.exe
  C:\Windows\System\FdZrtQt.exe
  2⤵
  PID:10256
- C:\Windows\System\RhbnZiL.exe
  C:\Windows\System\RhbnZiL.exe
  2⤵
  PID:10280
- C:\Windows\System\KqQWflG.exe
  C:\Windows\System\KqQWflG.exe
  2⤵
  PID:10304
- C:\Windows\System\bnwLJrT.exe
  C:\Windows\System\bnwLJrT.exe
  2⤵
  PID:10320
- C:\Windows\System\FAaxlDB.exe
  C:\Windows\System\FAaxlDB.exe
  2⤵
  PID:10344
- C:\Windows\System\lSHCNpl.exe
  C:\Windows\System\lSHCNpl.exe
  2⤵
  PID:10376
- C:\Windows\System\lqWDozM.exe
  C:\Windows\System\lqWDozM.exe
  2⤵
  PID:10400
- C:\Windows\System\rGUBkrE.exe
  C:\Windows\System\rGUBkrE.exe
  2⤵
  PID:10428
- C:\Windows\System\qOTvEgv.exe
  C:\Windows\System\qOTvEgv.exe
  2⤵
  PID:10452
- C:\Windows\System\aUaqqxr.exe
  C:\Windows\System\aUaqqxr.exe
  2⤵
  PID:10476
- C:\Windows\System\xmOBKJD.exe
  C:\Windows\System\xmOBKJD.exe
  2⤵
  PID:10500
- C:\Windows\System\ubjFqrl.exe
  C:\Windows\System\ubjFqrl.exe
  2⤵
  PID:10524
- C:\Windows\System\kqsUstx.exe
  C:\Windows\System\kqsUstx.exe
  2⤵
  PID:10556
- C:\Windows\System\OTuDcPT.exe
  C:\Windows\System\OTuDcPT.exe
  2⤵
  PID:10584
- C:\Windows\System\RYyKvRh.exe
  C:\Windows\System\RYyKvRh.exe
  2⤵
  PID:10616
- C:\Windows\System\eOnSjjp.exe
  C:\Windows\System\eOnSjjp.exe
  2⤵
  PID:10636
- C:\Windows\System\HtekcZI.exe
  C:\Windows\System\HtekcZI.exe
  2⤵
  PID:10660
- C:\Windows\System\XwewDmW.exe
  C:\Windows\System\XwewDmW.exe
  2⤵
  PID:10680
- C:\Windows\System\lcYOPay.exe
  C:\Windows\System\lcYOPay.exe
  2⤵
  PID:10704
- C:\Windows\System\EAqNIeg.exe
  C:\Windows\System\EAqNIeg.exe
  2⤵
  PID:10728
- C:\Windows\System\qQQospd.exe
  C:\Windows\System\qQQospd.exe
  2⤵
  PID:10748
- C:\Windows\System\hmuNPHq.exe
  C:\Windows\System\hmuNPHq.exe
  2⤵
  PID:10772
- C:\Windows\System\yahgEUu.exe
  C:\Windows\System\yahgEUu.exe
  2⤵
  PID:10800
- C:\Windows\System\XNziMnm.exe
  C:\Windows\System\XNziMnm.exe
  2⤵
  PID:10816
- C:\Windows\System\wSqyKuQ.exe
  C:\Windows\System\wSqyKuQ.exe
  2⤵
  PID:10852
- C:\Windows\System\OeiIhQN.exe
  C:\Windows\System\OeiIhQN.exe
  2⤵
  PID:10876
- C:\Windows\System\fOFZwev.exe
  C:\Windows\System\fOFZwev.exe
  2⤵
  PID:10904
- C:\Windows\System\SOTxksm.exe
  C:\Windows\System\SOTxksm.exe
  2⤵
  PID:10920
- C:\Windows\System\aDHDzPh.exe
  C:\Windows\System\aDHDzPh.exe
  2⤵
  PID:10948
- C:\Windows\System\CZQpBAW.exe
  C:\Windows\System\CZQpBAW.exe
  2⤵
  PID:10964
- C:\Windows\System\zcpVCFs.exe
  C:\Windows\System\zcpVCFs.exe
  2⤵
  PID:10984
- C:\Windows\System\cjsOaZu.exe
  C:\Windows\System\cjsOaZu.exe
  2⤵
  PID:11008
- C:\Windows\System\TMHbeGC.exe
  C:\Windows\System\TMHbeGC.exe
  2⤵
  PID:11028
- C:\Windows\System\BDMzWaT.exe
  C:\Windows\System\BDMzWaT.exe
  2⤵
  PID:11048
- C:\Windows\System\mgbdSww.exe
  C:\Windows\System\mgbdSww.exe
  2⤵
  PID:11076
- C:\Windows\System\NIYDMuZ.exe
  C:\Windows\System\NIYDMuZ.exe
  2⤵
  PID:11100
- C:\Windows\System\YCXOBPs.exe
  C:\Windows\System\YCXOBPs.exe
  2⤵
  PID:11120
- C:\Windows\System\UvVQPBc.exe
  C:\Windows\System\UvVQPBc.exe
  2⤵
  PID:11144
- C:\Windows\System\seFTOKn.exe
  C:\Windows\System\seFTOKn.exe
  2⤵
  PID:11168
- C:\Windows\System\CLynaXL.exe
  C:\Windows\System\CLynaXL.exe
  2⤵
  PID:11188
- C:\Windows\System\zArlmXW.exe
  C:\Windows\System\zArlmXW.exe
  2⤵
  PID:11208
- C:\Windows\System\kAtJqCY.exe
  C:\Windows\System\kAtJqCY.exe
  2⤵
  PID:11224
- C:\Windows\System\MRsyLmu.exe
  C:\Windows\System\MRsyLmu.exe
  2⤵
  PID:11248
- C:\Windows\System\uVnzhNy.exe
  C:\Windows\System\uVnzhNy.exe
  2⤵
  PID:9540
- C:\Windows\System\buvVtqR.exe
  C:\Windows\System\buvVtqR.exe
  2⤵
  PID:9556
- C:\Windows\System\UFyRIFy.exe
  C:\Windows\System\UFyRIFy.exe
  2⤵
  PID:10176
- C:\Windows\System\pkFnqeP.exe
  C:\Windows\System\pkFnqeP.exe
  2⤵
  PID:9552
- C:\Windows\System\PNotEmi.exe
  C:\Windows\System\PNotEmi.exe
  2⤵
  PID:9444
- C:\Windows\System\fMHJMpF.exe
  C:\Windows\System\fMHJMpF.exe
  2⤵
  PID:9396
- C:\Windows\System\gSrwMfq.exe
  C:\Windows\System\gSrwMfq.exe
  2⤵
  PID:9012
- C:\Windows\System\wInKSFn.exe
  C:\Windows\System\wInKSFn.exe
  2⤵
  PID:10220
- C:\Windows\System\UPhzusu.exe
  C:\Windows\System\UPhzusu.exe
  2⤵
  PID:9208
- C:\Windows\System\iOiAvil.exe
  C:\Windows\System\iOiAvil.exe
  2⤵
  PID:8652
- C:\Windows\System\aXbNago.exe
  C:\Windows\System\aXbNago.exe
  2⤵
  PID:7816
- C:\Windows\System\IrdZbxe.exe
  C:\Windows\System\IrdZbxe.exe
  2⤵
  PID:9924
- C:\Windows\System\ebCzEnu.exe
  C:\Windows\System\ebCzEnu.exe
  2⤵
  PID:6600
- C:\Windows\System\rmOrjFE.exe
  C:\Windows\System\rmOrjFE.exe
  2⤵
  PID:9964
- C:\Windows\System\FkEdsXO.exe
  C:\Windows\System\FkEdsXO.exe
  2⤵
  PID:9228
- C:\Windows\System\IBHhGxh.exe
  C:\Windows\System\IBHhGxh.exe
  2⤵
  PID:9280
- C:\Windows\System\laQJwYq.exe
  C:\Windows\System\laQJwYq.exe
  2⤵
  PID:10084
- C:\Windows\System\IQCTBQt.exe
  C:\Windows\System\IQCTBQt.exe
  2⤵
  PID:10132
- C:\Windows\System\sAYRbwL.exe
  C:\Windows\System\sAYRbwL.exe
  2⤵
  PID:9748
- C:\Windows\System\DxRizRi.exe
  C:\Windows\System\DxRizRi.exe
  2⤵
  PID:9764
- C:\Windows\System\dRyDRAs.exe
  C:\Windows\System\dRyDRAs.exe
  2⤵
  PID:10700
- C:\Windows\System\WttqqVA.exe
  C:\Windows\System\WttqqVA.exe
  2⤵
  PID:8460
- C:\Windows\System\GxUqaEu.exe
  C:\Windows\System\GxUqaEu.exe
  2⤵
  PID:11268
- C:\Windows\System\PpwpyWI.exe
  C:\Windows\System\PpwpyWI.exe
  2⤵
  PID:11300
- C:\Windows\System\jCIjWff.exe
  C:\Windows\System\jCIjWff.exe
  2⤵
  PID:11328
- C:\Windows\System\rGLRlzU.exe
  C:\Windows\System\rGLRlzU.exe
  2⤵
  PID:11348
- C:\Windows\System\ybEyzvM.exe
  C:\Windows\System\ybEyzvM.exe
  2⤵
  PID:11368
- C:\Windows\System\PvgDFgr.exe
  C:\Windows\System\PvgDFgr.exe
  2⤵
  PID:11388
- C:\Windows\System\NsFkceI.exe
  C:\Windows\System\NsFkceI.exe
  2⤵
  PID:11412
- C:\Windows\System\xEBZpzk.exe
  C:\Windows\System\xEBZpzk.exe
  2⤵
  PID:11428
- C:\Windows\System\juhaLPA.exe
  C:\Windows\System\juhaLPA.exe
  2⤵
  PID:11448
- C:\Windows\System\iMzepGf.exe
  C:\Windows\System\iMzepGf.exe
  2⤵
  PID:11468
- C:\Windows\System\mUcZIZl.exe
  C:\Windows\System\mUcZIZl.exe
  2⤵
  PID:11504
- C:\Windows\System\WUrmSyK.exe
  C:\Windows\System\WUrmSyK.exe
  2⤵
  PID:11520
- C:\Windows\System\hWjuWxf.exe
  C:\Windows\System\hWjuWxf.exe
  2⤵
  PID:11540
- C:\Windows\System\YYDAgqW.exe
  C:\Windows\System\YYDAgqW.exe
  2⤵
  PID:11560
- C:\Windows\System\RwUhrQS.exe
  C:\Windows\System\RwUhrQS.exe
  2⤵
  PID:11580
- C:\Windows\System\tDcJuaR.exe
  C:\Windows\System\tDcJuaR.exe
  2⤵
  PID:11604
- C:\Windows\System\EqNuJov.exe
  C:\Windows\System\EqNuJov.exe
  2⤵
  PID:11620
- C:\Windows\System\bLtyduN.exe
  C:\Windows\System\bLtyduN.exe
  2⤵
  PID:11644
- C:\Windows\System\UwajVWd.exe
  C:\Windows\System\UwajVWd.exe
  2⤵
  PID:11660
- C:\Windows\System\UZjFVLx.exe
  C:\Windows\System\UZjFVLx.exe
  2⤵
  PID:11684
- C:\Windows\System\BJrkoqi.exe
  C:\Windows\System\BJrkoqi.exe
  2⤵
  PID:11704
- C:\Windows\System\fDHMQIt.exe
  C:\Windows\System\fDHMQIt.exe
  2⤵
  PID:11724
- C:\Windows\System\XHXWWqh.exe
  C:\Windows\System\XHXWWqh.exe
  2⤵
  PID:11748
- C:\Windows\System\MGqMUOA.exe
  C:\Windows\System\MGqMUOA.exe
  2⤵
  PID:11772
- C:\Windows\System\IyyCKBT.exe
  C:\Windows\System\IyyCKBT.exe
  2⤵
  PID:11792
- C:\Windows\System\XtIWnYg.exe
  C:\Windows\System\XtIWnYg.exe
  2⤵
  PID:11812
- C:\Windows\System\eFBzPex.exe
  C:\Windows\System\eFBzPex.exe
  2⤵
  PID:11832
- C:\Windows\System\RCBsrMx.exe
  C:\Windows\System\RCBsrMx.exe
  2⤵
  PID:11852
- C:\Windows\System\HuoFWKy.exe
  C:\Windows\System\HuoFWKy.exe
  2⤵
  PID:11884
- C:\Windows\System\ogwFJAB.exe
  C:\Windows\System\ogwFJAB.exe
  2⤵
  PID:11904
- C:\Windows\System\WiJvcBC.exe
  C:\Windows\System\WiJvcBC.exe
  2⤵
  PID:11940
- C:\Windows\System\YXZtDeM.exe
  C:\Windows\System\YXZtDeM.exe
  2⤵
  PID:11956
- C:\Windows\System\QNCJvrU.exe
  C:\Windows\System\QNCJvrU.exe
  2⤵
  PID:11972
- C:\Windows\System\NkMWbnf.exe
  C:\Windows\System\NkMWbnf.exe
  2⤵
  PID:11988
- C:\Windows\System\XEocDGd.exe
  C:\Windows\System\XEocDGd.exe
  2⤵
  PID:12012
- C:\Windows\System\pIEYUER.exe
  C:\Windows\System\pIEYUER.exe
  2⤵
  PID:12032
- C:\Windows\System\VjsovLf.exe
  C:\Windows\System\VjsovLf.exe
  2⤵
  PID:12056
- C:\Windows\System\CptZoet.exe
  C:\Windows\System\CptZoet.exe
  2⤵
  PID:12080
- C:\Windows\System\FUmmATP.exe
  C:\Windows\System\FUmmATP.exe
  2⤵
  PID:12100
- C:\Windows\System\PZVvNvo.exe
  C:\Windows\System\PZVvNvo.exe
  2⤵
  PID:12124
- C:\Windows\System\nfriZJC.exe
  C:\Windows\System\nfriZJC.exe
  2⤵
  PID:12144
- C:\Windows\System\dttbAXC.exe
  C:\Windows\System\dttbAXC.exe
  2⤵
  PID:12172
- C:\Windows\System\GsJdzCl.exe
  C:\Windows\System\GsJdzCl.exe
  2⤵
  PID:12188
- C:\Windows\System\tXdmYEy.exe
  C:\Windows\System\tXdmYEy.exe
  2⤵
  PID:12204
- C:\Windows\System\WuTZlyI.exe
  C:\Windows\System\WuTZlyI.exe
  2⤵
  PID:12220
- C:\Windows\System\CMNZdMq.exe
  C:\Windows\System\CMNZdMq.exe
  2⤵
  PID:12240
- C:\Windows\System\lbHCzZw.exe
  C:\Windows\System\lbHCzZw.exe
  2⤵
  PID:12268
- C:\Windows\System\UpzxiVN.exe
  C:\Windows\System\UpzxiVN.exe
  2⤵
  PID:8752
- C:\Windows\System\MCPQeYe.exe
  C:\Windows\System\MCPQeYe.exe
  2⤵
  PID:10872
- C:\Windows\System\wwxTcTw.exe
  C:\Windows\System\wwxTcTw.exe
  2⤵
  PID:9400
- C:\Windows\System\xYedQEE.exe
  C:\Windows\System\xYedQEE.exe
  2⤵
  PID:11000
- C:\Windows\System\zpBaDeY.exe
  C:\Windows\System\zpBaDeY.exe
  2⤵
  PID:11016
- C:\Windows\System\mBCwZgY.exe
  C:\Windows\System\mBCwZgY.exe
  2⤵
  PID:10252
- C:\Windows\System\wOFEzgo.exe
  C:\Windows\System\wOFEzgo.exe
  2⤵
  PID:11200
- C:\Windows\System\ewFXbpV.exe
  C:\Windows\System\ewFXbpV.exe
  2⤵
  PID:10268
- C:\Windows\System\siPIEqx.exe
  C:\Windows\System\siPIEqx.exe
  2⤵
  PID:11260
- C:\Windows\System\cADPTCR.exe
  C:\Windows\System\cADPTCR.exe
  2⤵
  PID:10332
- C:\Windows\System\ojIBWzK.exe
  C:\Windows\System\ojIBWzK.exe
  2⤵
  PID:9492
- C:\Windows\System\NTsVcGr.exe
  C:\Windows\System\NTsVcGr.exe
  2⤵
  PID:10516
- C:\Windows\System\EBXIqMd.exe
  C:\Windows\System\EBXIqMd.exe
  2⤵
  PID:10552
- C:\Windows\System\cltXjAo.exe
  C:\Windows\System\cltXjAo.exe
  2⤵
  PID:10608
- C:\Windows\System\OAJzwYI.exe
  C:\Windows\System\OAJzwYI.exe
  2⤵
  PID:9796
- C:\Windows\System\dpUmfPq.exe
  C:\Windows\System\dpUmfPq.exe
  2⤵
  PID:9916
- C:\Windows\System\JWJuosh.exe
  C:\Windows\System\JWJuosh.exe
  2⤵
  PID:10744
- C:\Windows\System\RIcHrLC.exe
  C:\Windows\System\RIcHrLC.exe
  2⤵
  PID:10720
- C:\Windows\System\VPuguMe.exe
  C:\Windows\System\VPuguMe.exe
  2⤵
  PID:11296
- C:\Windows\System\uSYZzVA.exe
  C:\Windows\System\uSYZzVA.exe
  2⤵
  PID:11344
- C:\Windows\System\GhCdHjK.exe
  C:\Windows\System\GhCdHjK.exe
  2⤵
  PID:10892
- C:\Windows\System\USdVLSP.exe
  C:\Windows\System\USdVLSP.exe
  2⤵
  PID:11456
- C:\Windows\System\skSZvvY.exe
  C:\Windows\System\skSZvvY.exe
  2⤵
  PID:11044
- C:\Windows\System\MgRLTVl.exe
  C:\Windows\System\MgRLTVl.exe
  2⤵
  PID:11056
- C:\Windows\System\NVfoFEm.exe
  C:\Windows\System\NVfoFEm.exe
  2⤵
  PID:11132
- C:\Windows\System\QdvApzG.exe
  C:\Windows\System\QdvApzG.exe
  2⤵
  PID:12296
- C:\Windows\System\zzXQUCe.exe
  C:\Windows\System\zzXQUCe.exe
  2⤵
  PID:12316
- C:\Windows\System\lpDzqCP.exe
  C:\Windows\System\lpDzqCP.exe
  2⤵
  PID:12340
- C:\Windows\System\gQIujLv.exe
  C:\Windows\System\gQIujLv.exe
  2⤵
  PID:12368
- C:\Windows\System\VXtkLDG.exe
  C:\Windows\System\VXtkLDG.exe
  2⤵
  PID:12388
- C:\Windows\System\bVraNNO.exe
  C:\Windows\System\bVraNNO.exe
  2⤵
  PID:12424
- C:\Windows\System\evPkJxW.exe
  C:\Windows\System\evPkJxW.exe
  2⤵
  PID:12460
- C:\Windows\System\NmpIRSA.exe
  C:\Windows\System\NmpIRSA.exe
  2⤵
  PID:12484
- C:\Windows\System\ILTUYcK.exe
  C:\Windows\System\ILTUYcK.exe
  2⤵
  PID:12508
- C:\Windows\System\BYIsvNo.exe
  C:\Windows\System\BYIsvNo.exe
  2⤵
  PID:12944
- C:\Windows\System\LtzuiHk.exe
  C:\Windows\System\LtzuiHk.exe
  2⤵
  PID:12960
- C:\Windows\System\GEzMgFR.exe
  C:\Windows\System\GEzMgFR.exe
  2⤵
  PID:12976
- C:\Windows\System\arVGFay.exe
  C:\Windows\System\arVGFay.exe
  2⤵
  PID:12992
- C:\Windows\System\WoRmNJT.exe
  C:\Windows\System\WoRmNJT.exe
  2⤵
  PID:13008
- C:\Windows\System\fHNSLIN.exe
  C:\Windows\System\fHNSLIN.exe
  2⤵
  PID:13024
- C:\Windows\System\mSjGHtW.exe
  C:\Windows\System\mSjGHtW.exe
  2⤵
  PID:13040
- C:\Windows\System\gOBNgRv.exe
  C:\Windows\System\gOBNgRv.exe
  2⤵
  PID:13056
- C:\Windows\System\wXLWVNo.exe
  C:\Windows\System\wXLWVNo.exe
  2⤵
  PID:13076
- C:\Windows\System\VsvPffF.exe
  C:\Windows\System\VsvPffF.exe
  2⤵
  PID:13096
- C:\Windows\System\QqVChsR.exe
  C:\Windows\System\QqVChsR.exe
  2⤵
  PID:13116
- C:\Windows\System\pFNhxhJ.exe
  C:\Windows\System\pFNhxhJ.exe
  2⤵
  PID:13136
- C:\Windows\System\QLvrFVU.exe
  C:\Windows\System\QLvrFVU.exe
  2⤵
  PID:13152
- C:\Windows\System\QPIYBeP.exe
  C:\Windows\System\QPIYBeP.exe
  2⤵
  PID:13168
- C:\Windows\System\TJGTtlz.exe
  C:\Windows\System\TJGTtlz.exe
  2⤵
  PID:13184
- C:\Windows\System\HqEoVxD.exe
  C:\Windows\System\HqEoVxD.exe
  2⤵
  PID:13200
- C:\Windows\System\uGiXnbD.exe
  C:\Windows\System\uGiXnbD.exe
  2⤵
  PID:13216
- C:\Windows\System\vAvXOpo.exe
  C:\Windows\System\vAvXOpo.exe
  2⤵
  PID:13236
- C:\Windows\System\CZAZOSB.exe
  C:\Windows\System\CZAZOSB.exe
  2⤵
  PID:13252
- C:\Windows\System\fFQXNqV.exe
  C:\Windows\System\fFQXNqV.exe
  2⤵
  PID:13268
- C:\Windows\System\SsldSoB.exe
  C:\Windows\System\SsldSoB.exe
  2⤵
  PID:13284
- C:\Windows\System\cbZAYuA.exe
  C:\Windows\System\cbZAYuA.exe
  2⤵
  PID:13300
- C:\Windows\System\JnezkxP.exe
  C:\Windows\System\JnezkxP.exe
  2⤵
  PID:11656
- C:\Windows\System\JOVgtaZ.exe
  C:\Windows\System\JOVgtaZ.exe
  2⤵
  PID:11692
- C:\Windows\System\iwPEwoJ.exe
  C:\Windows\System\iwPEwoJ.exe
  2⤵
  PID:9576
- C:\Windows\System\PrDtuFK.exe
  C:\Windows\System\PrDtuFK.exe
  2⤵
  PID:9328
- C:\Windows\System\MSVuiVT.exe
  C:\Windows\System\MSVuiVT.exe
  2⤵
  PID:6492
- C:\Windows\System\YsChFyl.exe
  C:\Windows\System\YsChFyl.exe
  2⤵
  PID:12008
- C:\Windows\System\idhUBhe.exe
  C:\Windows\System\idhUBhe.exe
  2⤵
  PID:10760
- C:\Windows\System\cIjWpMb.exe
  C:\Windows\System\cIjWpMb.exe
  2⤵
  PID:11324
- C:\Windows\System\MKDipgf.exe
  C:\Windows\System\MKDipgf.exe
  2⤵
  PID:10900
- C:\Windows\System\DpzZhfv.exe
  C:\Windows\System\DpzZhfv.exe
  2⤵
  PID:10572
- C:\Windows\System\huQIJAh.exe
  C:\Windows\System\huQIJAh.exe
  2⤵
  PID:8080
- C:\Windows\System\RsSVoWb.exe
  C:\Windows\System\RsSVoWb.exe
  2⤵
  PID:10668
- C:\Windows\System\glafiSO.exe
  C:\Windows\System\glafiSO.exe
  2⤵
  PID:9812
- C:\Windows\System\sWTGDkQ.exe
  C:\Windows\System\sWTGDkQ.exe
  2⤵
  PID:10844
- C:\Windows\System\WBRMkMp.exe
  C:\Windows\System\WBRMkMp.exe
  2⤵
  PID:11444
- C:\Windows\System\iLtyBIA.exe
  C:\Windows\System\iLtyBIA.exe
  2⤵
  PID:11160
- C:\Windows\System\nWjfNeD.exe
  C:\Windows\System\nWjfNeD.exe
  2⤵
  PID:10156
- C:\Windows\System\msSKfmu.exe
  C:\Windows\System\msSKfmu.exe
  2⤵
  PID:9304
- C:\Windows\System\NMuFiQO.exe
  C:\Windows\System\NMuFiQO.exe
  2⤵
  PID:9804
- C:\Windows\System\bIcMUKy.exe
  C:\Windows\System\bIcMUKy.exe
  2⤵
  PID:12004
- C:\Windows\System\DRlZCFl.exe
  C:\Windows\System\DRlZCFl.exe
  2⤵
  PID:12072
- C:\Windows\System\kVMwGpN.exe
  C:\Windows\System\kVMwGpN.exe
  2⤵
  PID:12112
- C:\Windows\System\vYAiSiL.exe
  C:\Windows\System\vYAiSiL.exe
  2⤵
  PID:12136
- C:\Windows\System\OLAsQac.exe
  C:\Windows\System\OLAsQac.exe
  2⤵
  PID:12236
- C:\Windows\System\QGtHmFX.exe
  C:\Windows\System\QGtHmFX.exe
  2⤵
  PID:10836
- C:\Windows\System\uYwUCVH.exe
  C:\Windows\System\uYwUCVH.exe
  2⤵
  PID:11128
- C:\Windows\System\IOBOShn.exe
  C:\Windows\System\IOBOShn.exe
  2⤵
  PID:12700
- C:\Windows\System\XqbgEUH.exe
  C:\Windows\System\XqbgEUH.exe
  2⤵
  PID:11240
- C:\Windows\System\tbeosnc.exe
  C:\Windows\System\tbeosnc.exe
  2⤵
  PID:11632
- C:\Windows\System\DjlcvYZ.exe
  C:\Windows\System\DjlcvYZ.exe
  2⤵
  PID:12888
- C:\Windows\System\flEXBUD.exe
  C:\Windows\System\flEXBUD.exe
  2⤵
  PID:12436
- C:\Windows\System\stiwRlk.exe
  C:\Windows\System\stiwRlk.exe
  2⤵
  PID:11732
- C:\Windows\System\tSYYbDu.exe
  C:\Windows\System\tSYYbDu.exe
  2⤵
  PID:12476
- C:\Windows\System\bkVTntu.exe
  C:\Windows\System\bkVTntu.exe
  2⤵
  PID:12972
- C:\Windows\System\REAAsLa.exe
  C:\Windows\System\REAAsLa.exe
  2⤵
  PID:13108
- C:\Windows\System\GOLJOgi.exe
  C:\Windows\System\GOLJOgi.exe
  2⤵
  PID:13148
- C:\Windows\System\YPrJilA.exe
  C:\Windows\System\YPrJilA.exe
  2⤵
  PID:13196
- C:\Windows\System\xztZvyp.exe
  C:\Windows\System\xztZvyp.exe
  2⤵
  PID:13332
- C:\Windows\System\gpTyPnj.exe
  C:\Windows\System\gpTyPnj.exe
  2⤵
  PID:13352
- C:\Windows\System\flkOHVa.exe
  C:\Windows\System\flkOHVa.exe
  2⤵
  PID:13372
- C:\Windows\System\AcrDkYt.exe
  C:\Windows\System\AcrDkYt.exe
  2⤵
  PID:13388
- C:\Windows\System\CNscjiu.exe
  C:\Windows\System\CNscjiu.exe
  2⤵
  PID:13404
- C:\Windows\System\EDdirRH.exe
  C:\Windows\System\EDdirRH.exe
  2⤵
  PID:13420
- C:\Windows\System\gSXOnqg.exe
  C:\Windows\System\gSXOnqg.exe
  2⤵
  PID:13448
- C:\Windows\System\emYqaCZ.exe
  C:\Windows\System\emYqaCZ.exe
  2⤵
  PID:13464
- C:\Windows\System\QSJPshJ.exe
  C:\Windows\System\QSJPshJ.exe
  2⤵
  PID:13480
- C:\Windows\System\cebpisi.exe
  C:\Windows\System\cebpisi.exe
  2⤵
  PID:13508
- C:\Windows\System\nRNoCLf.exe
  C:\Windows\System\nRNoCLf.exe
  2⤵
  PID:13540
- C:\Windows\System\nDTBbOV.exe
  C:\Windows\System\nDTBbOV.exe
  2⤵
  PID:13568
- C:\Windows\System\byIhauo.exe
  C:\Windows\System\byIhauo.exe
  2⤵
  PID:13600
- C:\Windows\System\RjJNtrk.exe
  C:\Windows\System\RjJNtrk.exe
  2⤵
  PID:13616
- C:\Windows\System\rjYEwSb.exe
  C:\Windows\System\rjYEwSb.exe
  2⤵
  PID:13632
- C:\Windows\System\ldueuFI.exe
  C:\Windows\System\ldueuFI.exe
  2⤵
  PID:13652
- C:\Windows\System\MmUojTA.exe
  C:\Windows\System\MmUojTA.exe
  2⤵
  PID:13672
- C:\Windows\System\fbWzJMB.exe
  C:\Windows\System\fbWzJMB.exe
  2⤵
  PID:13688
- C:\Windows\System\zWQDBDr.exe
  C:\Windows\System\zWQDBDr.exe
  2⤵
  PID:13716
- C:\Windows\System\AAoTfho.exe
  C:\Windows\System\AAoTfho.exe
  2⤵
  PID:13736
- C:\Windows\System\wUqcoOX.exe
  C:\Windows\System\wUqcoOX.exe
  2⤵
  PID:13752
- C:\Windows\System\PjyiqWl.exe
  C:\Windows\System\PjyiqWl.exe
  2⤵
  PID:13768
- C:\Windows\System\KTOWGiz.exe
  C:\Windows\System\KTOWGiz.exe
  2⤵
  PID:13788
- C:\Windows\System\fsNhmAx.exe
  C:\Windows\System\fsNhmAx.exe
  2⤵
  PID:13812
- C:\Windows\System\CJqttFv.exe
  C:\Windows\System\CJqttFv.exe
  2⤵
  PID:13828
- C:\Windows\System\JocmEoy.exe
  C:\Windows\System\JocmEoy.exe
  2⤵
  PID:13844
- C:\Windows\System\EoIlzmT.exe
  C:\Windows\System\EoIlzmT.exe
  2⤵
  PID:13876
- C:\Windows\System\RoDTbKT.exe
  C:\Windows\System\RoDTbKT.exe
  2⤵
  PID:13900
- C:\Windows\System\uVHwSRC.exe
  C:\Windows\System\uVHwSRC.exe
  2⤵
  PID:13936
- C:\Windows\System\hoLEGMk.exe
  C:\Windows\System\hoLEGMk.exe
  2⤵
  PID:13968
- C:\Windows\System\AykyWvo.exe
  C:\Windows\System\AykyWvo.exe
  2⤵
  PID:13996
- C:\Windows\System\XjKduLX.exe
  C:\Windows\System\XjKduLX.exe
  2⤵
  PID:14020
- C:\Windows\System\KBvDsnW.exe
  C:\Windows\System\KBvDsnW.exe
  2⤵
  PID:14048
- C:\Windows\System\USRdRXo.exe
  C:\Windows\System\USRdRXo.exe
  2⤵
  PID:14076
- C:\Windows\System\XDMiKSt.exe
  C:\Windows\System\XDMiKSt.exe
  2⤵
  PID:14104
- C:\Windows\System\SOKsdlW.exe
  C:\Windows\System\SOKsdlW.exe
  2⤵
  PID:14136
- C:\Windows\System\tdColce.exe
  C:\Windows\System\tdColce.exe
  2⤵
  PID:14156
- C:\Windows\System\OeCvgWK.exe
  C:\Windows\System\OeCvgWK.exe
  2⤵
  PID:14184
- C:\Windows\System\rJuOgvE.exe
  C:\Windows\System\rJuOgvE.exe
  2⤵
  PID:14220
- C:\Windows\System\lvBTvyP.exe
  C:\Windows\System\lvBTvyP.exe
  2⤵
  PID:14248
- C:\Windows\System\mcaazDn.exe
  C:\Windows\System\mcaazDn.exe
  2⤵
  PID:14268
- C:\Windows\System\YVQFimv.exe
  C:\Windows\System\YVQFimv.exe
  2⤵
  PID:14288
- C:\Windows\System\rlvkGaT.exe
  C:\Windows\System\rlvkGaT.exe
  2⤵
  PID:14324
- C:\Windows\System\CzvfzIr.exe
  C:\Windows\System\CzvfzIr.exe
  2⤵
  PID:13232
- C:\Windows\System\WYJfIFM.exe
  C:\Windows\System\WYJfIFM.exe
  2⤵
  PID:11800
- C:\Windows\System\TLvbQGy.exe
  C:\Windows\System\TLvbQGy.exe
  2⤵
  PID:12040
- C:\Windows\System\dFvXdYT.exe
  C:\Windows\System\dFvXdYT.exe
  2⤵
  PID:8340
- C:\Windows\System\oXlcgdU.exe
  C:\Windows\System\oXlcgdU.exe
  2⤵
  PID:13804
- C:\Windows\System\BAIhXRa.exe
  C:\Windows\System\BAIhXRa.exe
  2⤵
  PID:13856
- C:\Windows\System\vHiepGZ.exe
  C:\Windows\System\vHiepGZ.exe
  2⤵
  PID:13872
- C:\Windows\System\cMdljVi.exe
  C:\Windows\System\cMdljVi.exe
  2⤵
  PID:13928
- C:\Windows\System\djANMUa.exe
  C:\Windows\System\djANMUa.exe
  2⤵
  PID:13952
- C:\Windows\System\HnDTAdD.exe
  C:\Windows\System\HnDTAdD.exe
  2⤵
  PID:11920
- C:\Windows\System\XsGbMPr.exe
  C:\Windows\System\XsGbMPr.exe
  2⤵
  PID:14212
- C:\Windows\System\UteYaOI.exe
  C:\Windows\System\UteYaOI.exe
  2⤵
  PID:12000
- C:\Windows\System\xTgOYjS.exe
  C:\Windows\System\xTgOYjS.exe
  2⤵
  PID:14260
- C:\Windows\System\GauFdbv.exe
  C:\Windows\System\GauFdbv.exe
  2⤵
  PID:14312
- C:\Windows\System\qvpfHvb.exe
  C:\Windows\System\qvpfHvb.exe
  2⤵
  PID:12232
- C:\Windows\System\oZgxJhc.exe
  C:\Windows\System\oZgxJhc.exe
  2⤵
  PID:11496
- C:\Windows\System\TAwphUf.exe
  C:\Windows\System\TAwphUf.exe
  2⤵
  PID:13088
- C:\Windows\System\BDzfKmw.exe
  C:\Windows\System\BDzfKmw.exe
  2⤵
  PID:13052
- C:\Windows\System\oMPDgoY.exe
  C:\Windows\System\oMPDgoY.exe
  2⤵
  PID:14356
- C:\Windows\System\abaQiVr.exe
  C:\Windows\System\abaQiVr.exe
  2⤵
  PID:14748
- C:\Windows\System\rvbAwfM.exe
  C:\Windows\System\rvbAwfM.exe
  2⤵
  PID:14772
- C:\Windows\System\exutxEI.exe
  C:\Windows\System\exutxEI.exe
  2⤵
  PID:14788
- C:\Windows\System\PSuTemS.exe
  C:\Windows\System\PSuTemS.exe
  2⤵
  PID:14804
- C:\Windows\System\YdDOjau.exe
  C:\Windows\System\YdDOjau.exe
  2⤵
  PID:14820
- C:\Windows\System\KrIIcLb.exe
  C:\Windows\System\KrIIcLb.exe
  2⤵
  PID:14836
- C:\Windows\System\LGdZLmL.exe
  C:\Windows\System\LGdZLmL.exe
  2⤵
  PID:14852
- C:\Windows\System\rczftsu.exe
  C:\Windows\System\rczftsu.exe
  2⤵
  PID:14868
- C:\Windows\System\kLjQqcm.exe
  C:\Windows\System\kLjQqcm.exe
  2⤵
  PID:14892
- C:\Windows\System\KtEMyYY.exe
  C:\Windows\System\KtEMyYY.exe
  2⤵
  PID:14912
- C:\Windows\System\ucurNFo.exe
  C:\Windows\System\ucurNFo.exe
  2⤵
  PID:14928
- C:\Windows\System\FjABsyj.exe
  C:\Windows\System\FjABsyj.exe
  2⤵
  PID:14944
- C:\Windows\System\NWKakiu.exe
  C:\Windows\System\NWKakiu.exe
  2⤵
  PID:14960
- C:\Windows\System\rbHBfcu.exe
  C:\Windows\System\rbHBfcu.exe
  2⤵
  PID:14976
- C:\Windows\System\cqKOhuk.exe
  C:\Windows\System\cqKOhuk.exe
  2⤵
  PID:15008
- C:\Windows\System\DpULpFc.exe
  C:\Windows\System\DpULpFc.exe
  2⤵
  PID:15036
- C:\Windows\System\IaRJVXK.exe
  C:\Windows\System\IaRJVXK.exe
  2⤵
  PID:15096
- C:\Windows\System\qKEhZOs.exe
  C:\Windows\System\qKEhZOs.exe
  2⤵
  PID:15128
- C:\Windows\System\PRxqYuL.exe
  C:\Windows\System\PRxqYuL.exe
  2⤵
  PID:15164
- C:\Windows\System\AqBjpNL.exe
  C:\Windows\System\AqBjpNL.exe
  2⤵
  PID:15196
- C:\Windows\System\TISCoQq.exe
  C:\Windows\System\TISCoQq.exe
  2⤵
  PID:15224
- C:\Windows\System\QfJsCLG.exe
  C:\Windows\System\QfJsCLG.exe
  2⤵
  PID:15256
- C:\Windows\System\ruPdHpl.exe
  C:\Windows\System\ruPdHpl.exe
  2⤵
  PID:15288
- C:\Windows\System\gVstDSw.exe
  C:\Windows\System\gVstDSw.exe
  2⤵
  PID:15316
- C:\Windows\System\wLlPuxh.exe
  C:\Windows\System\wLlPuxh.exe
  2⤵
  PID:15348
- C:\Windows\System\hZsVyuM.exe
  C:\Windows\System\hZsVyuM.exe
  2⤵
  PID:11596
- C:\Windows\System\yHaKhvJ.exe
  C:\Windows\System\yHaKhvJ.exe
  2⤵
  PID:10180
- C:\Windows\System\yrDczGN.exe
  C:\Windows\System\yrDczGN.exe
  2⤵
  PID:13560
- C:\Windows\System\EvuBcpP.exe
  C:\Windows\System\EvuBcpP.exe
  2⤵
  PID:13608
- C:\Windows\System\pKgFUEu.exe
  C:\Windows\System\pKgFUEu.exe
  2⤵
  PID:13680
- C:\Windows\System\RAIQrWk.exe
  C:\Windows\System\RAIQrWk.exe
  2⤵
  PID:14016
- C:\Windows\System\QjMqDJL.exe
  C:\Windows\System\QjMqDJL.exe
  2⤵
  PID:14092
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14092 -s 248
    3⤵
    PID:17180
- C:\Windows\System\vldcKOg.exe
  C:\Windows\System\vldcKOg.exe
  2⤵
  PID:14332
- C:\Windows\System\zvNLiBP.exe
  C:\Windows\System\zvNLiBP.exe
  2⤵
  PID:12748
- C:\Windows\System\uDZNprD.exe
  C:\Windows\System\uDZNprD.exe
  2⤵
  PID:13084
- C:\Windows\System\VqsKuco.exe
  C:\Windows\System\VqsKuco.exe
  2⤵
  PID:10976
- C:\Windows\System\XwwgBli.exe
  C:\Windows\System\XwwgBli.exe
  2⤵
  PID:10996
- C:\Windows\System\zjhvNkb.exe
  C:\Windows\System\zjhvNkb.exe
  2⤵
  PID:11204
- C:\Windows\System\VRtXiQO.exe
  C:\Windows\System\VRtXiQO.exe
  2⤵
  PID:13412
- C:\Windows\System\EAxCmwy.exe
  C:\Windows\System\EAxCmwy.exe
  2⤵
  PID:13504
- C:\Windows\System\tGdAZhD.exe
  C:\Windows\System\tGdAZhD.exe
  2⤵
  PID:13548
- C:\Windows\System\EQZCzqV.exe
  C:\Windows\System\EQZCzqV.exe
  2⤵
  PID:13700
- C:\Windows\System\EJWOOLG.exe
  C:\Windows\System\EJWOOLG.exe
  2⤵
  PID:13728
- C:\Windows\System\kcvnYbS.exe
  C:\Windows\System\kcvnYbS.exe
  2⤵
  PID:13784
- C:\Windows\System\NQjZpBV.exe
  C:\Windows\System\NQjZpBV.exe
  2⤵
  PID:14028
- C:\Windows\System\nsScSol.exe
  C:\Windows\System\nsScSol.exe
  2⤵
  PID:14148
- C:\Windows\System\VAbZheY.exe
  C:\Windows\System\VAbZheY.exe
  2⤵
  PID:14120
- C:\Windows\System\JFhdwou.exe
  C:\Windows\System\JFhdwou.exe
  2⤵
  PID:13276
- C:\Windows\System\AvqbiMR.exe
  C:\Windows\System\AvqbiMR.exe
  2⤵
  PID:10460
- C:\Windows\System\tXzXNer.exe
  C:\Windows\System\tXzXNer.exe
  2⤵
  PID:13864
- C:\Windows\System\yMNsfiv.exe
  C:\Windows\System\yMNsfiv.exe
  2⤵
  PID:12276
- C:\Windows\System\OLJOAtA.exe
  C:\Windows\System\OLJOAtA.exe
  2⤵
  PID:14244
- C:\Windows\System\SunhFEP.exe
  C:\Windows\System\SunhFEP.exe
  2⤵
  PID:14764
- C:\Windows\System\cwmEAqT.exe
  C:\Windows\System\cwmEAqT.exe
  2⤵
  PID:14876
- C:\Windows\System\KzWacnM.exe
  C:\Windows\System\KzWacnM.exe
  2⤵
  PID:14936
- C:\Windows\System\rjoIMUr.exe
  C:\Windows\System\rjoIMUr.exe
  2⤵
  PID:14972
- C:\Windows\System\uFomFSa.exe
  C:\Windows\System\uFomFSa.exe
  2⤵
  PID:15376
- C:\Windows\System\FJQzTHj.exe
  C:\Windows\System\FJQzTHj.exe
  2⤵
  PID:15408
- C:\Windows\System\iosapyJ.exe
  C:\Windows\System\iosapyJ.exe
  2⤵
  PID:15428
- C:\Windows\System\egenvAl.exe
  C:\Windows\System\egenvAl.exe
  2⤵
  PID:15448
- C:\Windows\System\lXJRkUH.exe
  C:\Windows\System\lXJRkUH.exe
  2⤵
  PID:15496
- C:\Windows\System\ruNTwAX.exe
  C:\Windows\System\ruNTwAX.exe
  2⤵
  PID:15512
- C:\Windows\System\SmkURIf.exe
  C:\Windows\System\SmkURIf.exe
  2⤵
  PID:15540
- C:\Windows\System\HCnCSZn.exe
  C:\Windows\System\HCnCSZn.exe
  2⤵
  PID:15572
- C:\Windows\System\ghElSDi.exe
  C:\Windows\System\ghElSDi.exe
  2⤵
  PID:15592
- C:\Windows\System\wSRtktc.exe
  C:\Windows\System\wSRtktc.exe
  2⤵
  PID:15624
- C:\Windows\System\khlYtrv.exe
  C:\Windows\System\khlYtrv.exe
  2⤵
  PID:15640
- C:\Windows\System\JXGhtAm.exe
  C:\Windows\System\JXGhtAm.exe
  2⤵
  PID:15672
- C:\Windows\System\WPvChXh.exe
  C:\Windows\System\WPvChXh.exe
  2⤵
  PID:15692
- C:\Windows\System\CCMZdta.exe
  C:\Windows\System\CCMZdta.exe
  2⤵
  PID:15724
- C:\Windows\System\fkWusRT.exe
  C:\Windows\System\fkWusRT.exe
  2⤵
  PID:15748
- C:\Windows\System\frfDbkc.exe
  C:\Windows\System\frfDbkc.exe
  2⤵
  PID:15764
- C:\Windows\System\esiCFnO.exe
  C:\Windows\System\esiCFnO.exe
  2⤵
  PID:15792
- C:\Windows\System\jTUlNXM.exe
  C:\Windows\System\jTUlNXM.exe
  2⤵
  PID:15820
- C:\Windows\System\ZAhHhFf.exe
  C:\Windows\System\ZAhHhFf.exe
  2⤵
  PID:15840
- C:\Windows\System\oZtqjmZ.exe
  C:\Windows\System\oZtqjmZ.exe
  2⤵
  PID:15856
- C:\Windows\System\LskmxUw.exe
  C:\Windows\System\LskmxUw.exe
  2⤵
  PID:15888
- C:\Windows\System\FcifQNl.exe
  C:\Windows\System\FcifQNl.exe
  2⤵
  PID:15908
- C:\Windows\System\UCooYoM.exe
  C:\Windows\System\UCooYoM.exe
  2⤵
  PID:15936
- C:\Windows\System\JaJwuXD.exe
  C:\Windows\System\JaJwuXD.exe
  2⤵
  PID:15968
- C:\Windows\System\PSdkqSD.exe
  C:\Windows\System\PSdkqSD.exe
  2⤵
  PID:15988
- C:\Windows\System\zJRrwvO.exe
  C:\Windows\System\zJRrwvO.exe
  2⤵
  PID:16008
- C:\Windows\System\KXUDvJF.exe
  C:\Windows\System\KXUDvJF.exe
  2⤵
  PID:16036
- C:\Windows\System\IyPQXoP.exe
  C:\Windows\System\IyPQXoP.exe
  2⤵
  PID:16060
- C:\Windows\System\HPdcNNG.exe
  C:\Windows\System\HPdcNNG.exe
  2⤵
  PID:16092
- C:\Windows\System\fGBuaUK.exe
  C:\Windows\System\fGBuaUK.exe
  2⤵
  PID:16108
- C:\Windows\System\RkUjbqh.exe
  C:\Windows\System\RkUjbqh.exe
  2⤵
  PID:16140
- C:\Windows\System\jqTzbKK.exe
  C:\Windows\System\jqTzbKK.exe
  2⤵
  PID:16156
- C:\Windows\System\wMbFHOM.exe
  C:\Windows\System\wMbFHOM.exe
  2⤵
  PID:16180
- C:\Windows\System\UsUHjcX.exe
  C:\Windows\System\UsUHjcX.exe
  2⤵
  PID:16208
- C:\Windows\System\qvMmeKb.exe
  C:\Windows\System\qvMmeKb.exe
  2⤵
  PID:16236
- C:\Windows\System\uDWAfue.exe
  C:\Windows\System\uDWAfue.exe
  2⤵
  PID:16264
- C:\Windows\System\lgdpRRV.exe
  C:\Windows\System\lgdpRRV.exe
  2⤵
  PID:16280
- C:\Windows\System\KYwEVsu.exe
  C:\Windows\System\KYwEVsu.exe
  2⤵
  PID:16312
- C:\Windows\System\PTBOUuN.exe
  C:\Windows\System\PTBOUuN.exe
  2⤵
  PID:16344
- C:\Windows\System\TYLEqOl.exe
  C:\Windows\System\TYLEqOl.exe
  2⤵
  PID:16364
- C:\Windows\System\BNJLbEC.exe
  C:\Windows\System\BNJLbEC.exe
  2⤵
  PID:10108
- C:\Windows\System\EkCgMrT.exe
  C:\Windows\System\EkCgMrT.exe
  2⤵
  PID:15208
- C:\Windows\System\lwVWBgD.exe
  C:\Windows\System\lwVWBgD.exe
  2⤵
  PID:15336
- C:\Windows\System\FbDxgPp.exe
  C:\Windows\System\FbDxgPp.exe
  2⤵
  PID:13588
- C:\Windows\System\zDJqflr.exe
  C:\Windows\System\zDJqflr.exe
  2⤵
  PID:14068
- C:\Windows\System\TsvHaZJ.exe
  C:\Windows\System\TsvHaZJ.exe
  2⤵
  PID:13892
- C:\Windows\System\ghwnXhh.exe
  C:\Windows\System\ghwnXhh.exe
  2⤵
  PID:14284
- C:\Windows\System\WMhvHNm.exe
  C:\Windows\System\WMhvHNm.exe
  2⤵
  PID:8260
- C:\Windows\System\IDUDiCb.exe
  C:\Windows\System\IDUDiCb.exe
  2⤵
  PID:14780
- C:\Windows\System\rarBFaF.exe
  C:\Windows\System\rarBFaF.exe
  2⤵
  PID:10792
- C:\Windows\System\jgstUHU.exe
  C:\Windows\System\jgstUHU.exe
  2⤵
  PID:14844
- C:\Windows\System\rQqvnKD.exe
  C:\Windows\System\rQqvnKD.exe
  2⤵
  PID:14900
- C:\Windows\System\rCRhDwX.exe
  C:\Windows\System\rCRhDwX.exe
  2⤵
  PID:16400
- C:\Windows\System\iAZqFGp.exe
  C:\Windows\System\iAZqFGp.exe
  2⤵
  PID:16416
- C:\Windows\System\GwRobhB.exe
  C:\Windows\System\GwRobhB.exe
  2⤵
  PID:16448
- C:\Windows\System\TEkmbOd.exe
  C:\Windows\System\TEkmbOd.exe
  2⤵
  PID:16472
- C:\Windows\System\jgUlVyF.exe
  C:\Windows\System\jgUlVyF.exe
  2⤵
  PID:16492
- C:\Windows\System\HRmRVPW.exe
  C:\Windows\System\HRmRVPW.exe
  2⤵
  PID:16512
- C:\Windows\System\wytDBPH.exe
  C:\Windows\System\wytDBPH.exe
  2⤵
  PID:16540
- C:\Windows\System\DTycHFQ.exe
  C:\Windows\System\DTycHFQ.exe
  2⤵
  PID:16556
- C:\Windows\System\gjQRdzt.exe
  C:\Windows\System\gjQRdzt.exe
  2⤵
  PID:16624
- C:\Windows\System\CZZNEZy.exe
  C:\Windows\System\CZZNEZy.exe
  2⤵
  PID:16640
- C:\Windows\System\Tzljkbm.exe
  C:\Windows\System\Tzljkbm.exe
  2⤵
  PID:16656
- C:\Windows\System\zlkvDWr.exe
  C:\Windows\System\zlkvDWr.exe
  2⤵
  PID:16676
- C:\Windows\System\EqWgdBG.exe
  C:\Windows\System\EqWgdBG.exe
  2⤵
  PID:16692
- C:\Windows\System\mBFHkLI.exe
  C:\Windows\System\mBFHkLI.exe
  2⤵
  PID:16716
- C:\Windows\System\afUGIZD.exe
  C:\Windows\System\afUGIZD.exe
  2⤵
  PID:16732
- C:\Windows\System\piLdfnY.exe
  C:\Windows\System\piLdfnY.exe
  2⤵
  PID:16748
- C:\Windows\System\yAmkecq.exe
  C:\Windows\System\yAmkecq.exe
  2⤵
  PID:16772
- C:\Windows\System\CHVvbxr.exe
  C:\Windows\System\CHVvbxr.exe
  2⤵
  PID:16788
- C:\Windows\System\JNxypcU.exe
  C:\Windows\System\JNxypcU.exe
  2⤵
  PID:16804
- C:\Windows\System\vCpPDCF.exe
  C:\Windows\System\vCpPDCF.exe
  2⤵
  PID:16820
- C:\Windows\System\hqHPsgu.exe
  C:\Windows\System\hqHPsgu.exe
  2⤵
  PID:16844
- C:\Windows\System\ZGFiPfL.exe
  C:\Windows\System\ZGFiPfL.exe
  2⤵
  PID:16860
- C:\Windows\System\OmmjIyV.exe
  C:\Windows\System\OmmjIyV.exe
  2⤵
  PID:16876
- C:\Windows\System\eYAoFAI.exe
  C:\Windows\System\eYAoFAI.exe
  2⤵
  PID:16904
- C:\Windows\System\RAhSqtc.exe
  C:\Windows\System\RAhSqtc.exe
  2⤵
  PID:16920
- C:\Windows\System\RNRwydI.exe
  C:\Windows\System\RNRwydI.exe
  2⤵
  PID:16940
- C:\Windows\System\xGzCRpM.exe
  C:\Windows\System\xGzCRpM.exe
  2⤵
  PID:16960
- C:\Windows\System\YIMGuAO.exe
  C:\Windows\System\YIMGuAO.exe
  2⤵
  PID:16976
- C:\Windows\System\jhFiQdT.exe
  C:\Windows\System\jhFiQdT.exe
  2⤵
  PID:16992
- C:\Windows\System\IObFPlK.exe
  C:\Windows\System\IObFPlK.exe
  2⤵
  PID:17016
- C:\Windows\System\MOKlMdF.exe
  C:\Windows\System\MOKlMdF.exe
  2⤵
  PID:17036
- C:\Windows\System\iWBYCoZ.exe
  C:\Windows\System\iWBYCoZ.exe
  2⤵
  PID:17052
- C:\Windows\System\dBIOgrh.exe
  C:\Windows\System\dBIOgrh.exe
  2⤵
  PID:17072
- C:\Windows\System\yJtWFwJ.exe
  C:\Windows\System\yJtWFwJ.exe
  2⤵
  PID:17108
- C:\Windows\System\PCGsQIH.exe
  C:\Windows\System\PCGsQIH.exe
  2⤵
  PID:17124
- C:\Windows\System\kcblHRK.exe
  C:\Windows\System\kcblHRK.exe
  2⤵
  PID:17140
- C:\Windows\System\sRNQFMK.exe
  C:\Windows\System\sRNQFMK.exe
  2⤵
  PID:17156

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13324

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AHjPvaD.exe

Filesize
1.1MB

MD5
552cddf98ad8baf1acc7a8676d180d50

SHA1
bf822243de5a9ce5f7d1a0b5f2d78535a9acce90

SHA256
3191c0e88a88ff7892ad26d0a7c012eb54c1b64cf3da96f863699acbfa4fad05

SHA512
0ad7659907be4795157327f5d6ac1c316fc0157755e0d651fe2679fcf45220a29a62c417e4874eb1230b6e2cc80351e4d45328f790aaee8bd9a54a4c726aa7b9

Download Submit
C:\Windows\System\BvnzEuf.exe

Filesize
1.1MB

MD5
30ee22d7703ffbf875a8c66c1e21cece

SHA1
51c38ce6fe4089b4824356906a4e3b0d7a64e720

SHA256
0dd5635e4f65f50f8b7ef0f75927516accba0e19bf3bacb629a43e389b16fd27

SHA512
2cfd4538e65dd2968cf1ef20e1d80c704d86ecf6325a9060129ab2d486e11609def66f7f5ed44b4e1453654d96abb5ba28c88217648788de8df84045a944ddd7

Download Submit
C:\Windows\System\CBAsbQA.exe

Filesize
1.1MB

MD5
6457131c963a74f2c77486e21c64c814

SHA1
9b5cb7a7f75bf58179161c65cfed8e2c5f5bc709

SHA256
601ddde0a9247731d1852f954bfd31c058f02f6c281bdde77aed9e0a76cd0b85

SHA512
c24c60627e905e180614a4f57320094484c81abdf96c3b27ac60c83bb50f5aabad6bfcff6da05c4d51b840c3b510c2939b978786aaf6fac83fe5068c934a71e1

Download Submit
C:\Windows\System\CrtXGSV.exe

Filesize
1.1MB

MD5
529d62d870f5022b969c21c2c63fc782

SHA1
94cfe81bb226dde86aa87ef65bad8dd26e34247d

SHA256
7e059321500a3fbdccd6de7a7651b9753674374e09e280cddba0c2d845753278

SHA512
3fa2f2ffb9abe2d183fff1e1c9a6fdc2b058851d942bd4eca8acc6a54a5b31b06b8de6deda24c60c4688353ba45f04baec08e3ee0585f534ad86f22dded8a333

Download Submit
C:\Windows\System\DFxORMm.exe

Filesize
1.1MB

MD5
ae966b7a3c2c52e5a66ffce5b5d364db

SHA1
8896e17bb43916eeccf6d940f07c8514bed983ba

SHA256
4f2acbdbc2dff07f77a187898d6f15ac71d4de8b1a49489b0f82b9ab1582d30a

SHA512
9ad239cbdc58f7bdeb4ba97319cae324bae7d6ddd06ddbed7606192f4988854d96269fca5b6293427295daff4cd5847d88fc56557cbe4e29de06f1aaf75593f9

Download Submit
C:\Windows\System\EFwhLDz.exe

Filesize
1.1MB

MD5
b8d4cb4564ad3d460091510f0426f1ab

SHA1
c78cd98b24520094d27bd23cbb095aa061fa93b9

SHA256
ce3b1672648333e7af7ab7519fe8a6277e0db4c8577065accbb54dd8a95b66f2

SHA512
a85c91beebe259efb74f65bebbf7ba34393fb9f628dad9981de2f81911f3e65ecd64654d6199965ec5c3891c90b08d994dcf0719bc771d2a41f0d10b4488b86b

Download Submit
C:\Windows\System\FTjgKnK.exe

Filesize
1.1MB

MD5
00aa24d3bf71542b54d252db7b66319c

SHA1
1dadc1ae57a15f9a61685b2787af644aeee2749c

SHA256
2be3db2ac99bdbbcbe6cfa136c2cb2950d8fb0e2db6b8a1ba9b15f98e3a2998a

SHA512
2fea1fb1c9e44a122de8e589889f167e313e417fe696f3af3ab1d95d6d452e2b89557eef77673e2d84e82f18d9d2743f708232032417f734e56981a5b9a1c6ec

Download Submit
C:\Windows\System\GqZvnvW.exe

Filesize
1.1MB

MD5
52ea618ff1c0265fd2eeaee902a60c66

SHA1
fc16d264b0ed7d57e76c5ee15ac0e88ab5589c2e

SHA256
239d48b493784f785663da2b89b6ef5d89726ac201d1d43f812d04b98c43c20a

SHA512
a9ac82ff172df9598da60030168518a99dcf03870d2165469eddfbcb6f25e8a1badf2deeba359d014662328c1e1073cc7515c534b915c87924a40d80c3c4c13b

Download Submit
C:\Windows\System\HjJMdgJ.exe

Filesize
1.1MB

MD5
cd1e092e991a0dff822cb1dd2cfed6f1

SHA1
e52a4fefeba9ad2b3e456280078636e923ec99ad

SHA256
909a9461a9c43fab4e49f3be515e502b714d2df9f54999b4a8945e223deff0d4

SHA512
d3c0ca34306f3a0ec39e5a678f3948cccb4e1030268a75212b932b5c5efac8ef3396163bdbf03c0adececa3d5371b30a8327dcfb5a01ed31cb5cc6ebfe3bb2ad

Download Submit
C:\Windows\System\IkHXLtm.exe

Filesize
1.1MB

MD5
20d157d03609f5678a4495c706464583

SHA1
1d1eee2e7903483b3ba45c29eb1c4aea190d41ab

SHA256
f6811dd6db152c23b5864a06c2e5751fecdacbd3f25da00c613ae4e8de753fc9

SHA512
a7818f3ed81b01ab8774a96628625d11ae828bea6fb3ffc9f532f4d71d37ddd5c7e2dfcc628c8463fc9e4238f90f0e1fdd14fd4e6a77ba84d18fa4b646caaca8

Download Submit
C:\Windows\System\IxOvarg.exe

Filesize
1.1MB

MD5
d703691a96293af36ef1797c4bd22c16

SHA1
a716fd72649e5200b94d3630bf2fa1f78ce35786

SHA256
614ae689a0f7ebbbf988c4316decb3cb411a07754d84b62574a7cee90030f750

SHA512
44e36b1290930491c641f305c8f12259b9ad9ca29c80d28f1311383b43135d35bc97745c43b08689e28eb28a214851f5582dd2f6058b786ed570f26cd0417a0a

Download Submit
C:\Windows\System\KaIMHQW.exe

Filesize
1.1MB

MD5
dee1ea881d1f7355985655b2a1d23e61

SHA1
3f0d15cd618ddc4474cdc3eb166d8336a04872a9

SHA256
437f2d0bdb4e29b9be1ca82ed56b8d7f7d09dc4bfd800f9e21d3b635419bd08f

SHA512
368af9267affbfcd8f53fd529d9d30f1e1b105f514cf5b925b5dd7f5e450191afb0e58d76bbe4248b6d71fba84fddd22c2e75a8798a9a023eaecea6fcf5fb09e

Download Submit
C:\Windows\System\MRZTKlV.exe

Filesize
1.1MB

MD5
6ec8430041f841560d055b0184728f11

SHA1
f4dbec144638c6c6c87cfc32832559bc8f0f4b32

SHA256
ce7c57bba4bf4145662a6b7bbab2429b9758a8c6109c6ea034ee8475a050731b

SHA512
e525e7a8a42c3ef0728f1784419cefc061a5bcc85415ba58478f98310d13f2c03a7525cc55a9171dda9f036c05a6dfa3f0cb4042763b839ffa2d2722665fb45b

Download Submit
C:\Windows\System\NyEerHB.exe

Filesize
1.1MB

MD5
f4e596af906b05fffb3679bf8d08447b

SHA1
58670b25388bb74a489fd087c3a46f9a6462d4d6

SHA256
aa08f6df2d088680a3e32c02e6e4226d5c302d991615480b957ce3f40a44b80c

SHA512
8035ef861e1b696cc5fc12c1f09720003db205bb39a291f6fcb688106ae4716b5bd31946852b95a522ba94fa755696b78e908d67eea900a238dd1df54a74f502

Download Submit
C:\Windows\System\QbZuBkW.exe

Filesize
1.1MB

MD5
63c9aa621aa1ee9b779171665007394f

SHA1
b48f123d5f398fe85d3246cc3e0d149b53369066

SHA256
efc88a1a9c1bc856a433ff40a2490cf5ed8a27970f9c6cfd412eccb53c9ed273

SHA512
8b6e10ff1a7e08943fee4da7ba0f9f47fcba11e3cb50a660eb430d629e4fb53b7677b19d188222730aa2d5b8522564b9a215c54b52da69d76b5d5a2ea0487d0a

Download Submit
C:\Windows\System\VsqMNIS.exe

Filesize
1.1MB

MD5
f9b26c5bbeb0700fc19a94fe08eea076

SHA1
235f07616ce3ccefeeb24f7e94a62c557a8732f4

SHA256
efcaab401f4c09a5bafdbbded913a1d0a3a9ba29fc43a87f30cf1f68d63a4a37

SHA512
fe0375217e5adce7fde45ad71a24cdb0ee687f1d1a43d7bbc9b03750bc818d03b52e6eabf3af9ebc792fc46d6cd4b24a3804639a59fd971bad5632dcb6c0124b

Download Submit
C:\Windows\System\XIHUMsi.exe

Filesize
1.1MB

MD5
ae7c85c41073e58133fd24c684bb51e5

SHA1
54ee5d46867a58e0eb21d267ba20bfad38429530

SHA256
7c8a4a30e72ed33f9613859c14051234118225e2ed1d594632960d4c48c3e9e9

SHA512
6dc605cdc0a3d96bf522ed7824165d8c41eedcb707082a6f6c431b0aee52e816aa92f7d16832a4159835073fab93a5d17f55eab698db29320a8baad2cfdde4d7

Download Submit
C:\Windows\System\Xdfbiiu.exe

Filesize
1.1MB

MD5
1eaecbc6565156cef89824d01128c1e4

SHA1
09975824c57c86b873e2814ca6cff736b6077fc1

SHA256
06583aa334fd015db3c159fa89986d0979c9c22e3eea8a9b83d092b49cae0f94

SHA512
5343fb68b0f571e818cfc57b57a19202714a036c2d1eb221b2e79b383ed6e77c4cf61b10347c1815fd0716f7229b4bd29701504f67307dbc4d568600ce160985

Download Submit
C:\Windows\System\bLEpzhT.exe

Filesize
1.1MB

MD5
0a69fe60ad808fb1ba0d5ee4ce36409c

SHA1
38ac777629fe5f0dcb18fc65858463b1be83fc71

SHA256
9c682fa10e1b2f90aa576079e000d48a849d7c97d1abf1f66435bc9060297204

SHA512
d562e19332769cf416c7931d19206a6085a341912821259dd19c92a7d0630729ceecf247ca5364b15c7fdf57981ff9adeeb4e49ac6116bb1360a4ad4aca7719f

Download Submit
C:\Windows\System\bWmsGBO.exe

Filesize
1.1MB

MD5
dca21ff40e22e1936a8dc0261812497d

SHA1
42c334d65869a3a578d1ff3ec1dc16fd98c285d4

SHA256
dd96e53c3025d3bc4b5bdba2313f83b2758e248c7e037c731316e91c5a75cb7e

SHA512
3301c2fb335fe244c8e2484955af3cdfe076ea8752f0022996d92320997080e0fdf2b789007525c964d07662e14efa8d63b9af7a3d713c962c277dcdd862ddb0

Download Submit
C:\Windows\System\bimVTOB.exe

Filesize
1.1MB

MD5
7008b7e9fb7860359f29524a4c681de9

SHA1
4045f145c3880635e41131de12c2e27d673e1f61

SHA256
499f8ae050201696dfd7721b1cc551a482237a45138298d8b09feea594036220

SHA512
c245bb5b23068d258f55a11ab5a0fd24b3d12ad8cda0f35cbefff72b4d1cfc620575eb4d4de85dd0e51f69e28052cb084b07aca1d6ec7f4027cce2c68400c6db

Download Submit
C:\Windows\System\ggAjnPx.exe

Filesize
1.1MB

MD5
8ddd777c5d3d561d45a4046ee68ff6b5

SHA1
1919f4dc68c8ce922679345a6ba9d56393b0a226

SHA256
577aa05c182b7ef72cc35b4cd8380c53735e638d89ea28713033a3e953859610

SHA512
5d1ab897546b141bcb510e3c5b180ee4f94fa087935c933145cb577c3ab55e10fc9ab507543bc6afaa275d6c9fb8abcdf94ca7506349ab1f2ba940f1a8d68bec

Download Submit
C:\Windows\System\htvbRUz.exe

Filesize
1.1MB

MD5
c906088bc0179ec6b10bb7629abc1055

SHA1
9a0b1ea771c37f5c415b69a50d64153507fafd14

SHA256
b14d9506b23ab804824d4494d74eb277b4fe6e1885119dee408b175077ed4e84

SHA512
8fddf4ebc2953c47c2ef85fa3ff26a1b11dafd4ede45df9624c83a3c656daa647204c263a7cf5cd0fc9f0459c71919b4288d1071cb66155e062a17406d90b2ca

Download Submit
C:\Windows\System\ijCyyvs.exe

Filesize
1.1MB

MD5
cc05dba052abc356ae24bdfc3dbfa198

SHA1
839b08be54e529acb9532ecd082dd9190fa08140

SHA256
7a84c41b21eaa894a61b1143c5b510c3997c5ea26e20a1f8753c7856cb5b890e

SHA512
d7819eac9d29ff8ba20f9472a9ab7aaa539989209bc1f56db3e161de9ae0c09c533f0071ec74363b1c66519019afe06a2de52821f387ace18ede1bbe96ffd1e5

Download Submit
C:\Windows\System\jADtBse.exe

Filesize
1.1MB

MD5
359a8bbbab1b3f7faa8efce26e59cf45

SHA1
08bb44773d6a3c65741107023d7068f5a6e0da27

SHA256
7e1deaa6e832ef9697bd3a6734c92bd50dc1643ea557e5d00aa238f95b265b90

SHA512
57679404d5784d7ab41bd4e7de2dd0b0eca5c4137f8470e8da4fec6be21dc513cb896eab6618e988be7a8bf93882ca700e7f0e2331ac2ff1d23438c8b7db66e4

Download Submit
C:\Windows\System\lTpAmrR.exe

Filesize
1.1MB

MD5
679c664b3bd5d0a0b8ac5424b6d7a1bd

SHA1
c4c7186befa10b961a1279c420bba0ada7062cbe

SHA256
ac26ec19073fc601c5b546005a9b5fd5bb34c78c3f6c86554002035b5f6073ec

SHA512
cf5ca816d6b6ce21071c9264318f6628b7b679dea989ff9587f8824c19a0be6d46a7faa3a34ce8ebe4c2e72baa0162d436dc5779050060a3eab9f236a4d4bd12

Download Submit
C:\Windows\System\msdXZFj.exe

Filesize
1.1MB

MD5
8c49bd5d39fa5cb9da9b2e562652d886

SHA1
b0ead510490846716eefe1d4f32a330bf7a4a9ec

SHA256
00426db8a8da3d57c69efb2dc912729a82680b8251b83374c8ed6144d5f31fd0

SHA512
56ac9ab8e86885ad1c64c8d0dc7e332869c3433c255269b23725962c50ea4c9b886589ce8dcb22f77e48d158b4fc3eae8bff991922484b54c6da119ea939c483

Download Submit
C:\Windows\System\nItrTGN.exe

Filesize
1.1MB

MD5
31b0b3565b7314ca8c87c05e2e46cb58

SHA1
f327ac5ea2ab42cb2ee5cff9b0e843bfa3036fb3

SHA256
36ab78e68d29627cdf45b98de90382ebcd0590a01af1da5527a3ccad73360897

SHA512
0fb045b5c960b2ebe3f9302b8310bb69b9424a2f1c2baa982ab32ba7aeac34b5898201d69ef3749be4cd79d84896ab3e08b4f39e15246f16ecc24dd893867734

Download Submit
C:\Windows\System\pRsrRch.exe

Filesize
1.1MB

MD5
5d63cf9b4e7a04f36b433959082ef7f4

SHA1
3cde00b92a3cc623eb63091f88149c9cf05eb695

SHA256
e1f73f71551b6ebac57d6552551c5f570a5cef061d87cbbdc73501afa19cb2f3

SHA512
183db5d682c3b23712cbffb08e86d9555a78a7844385e1e3b8ae95a3e5808d87679f0831ee1701dc81287783b1813ab1d632e0b2306577328350f48424b95c37

Download Submit
C:\Windows\System\pePJOtc.exe

Filesize
1.1MB

MD5
633212fa07f5c4bd9fbdea802dd36e6e

SHA1
87d65fb93f764d9a058372efea0eb9396c6ea34c

SHA256
cc2544c1e948136804a49e21b6cf3fe80d5d3ba49a1cce2d18251b55c26785e6

SHA512
e4c7d991cfee29fc804f2ab4400cf1f4d98d3ef1acb6e909adb89ece3562fbdad6028abd94ad2baf034bb940ee7c32ad5857d6846e781068d6a8d677caf087aa

Download Submit
C:\Windows\System\raLIYcC.exe

Filesize
1.1MB

MD5
4679cb3fc8b79480f1ccb3b932e1d60a

SHA1
566eeade9aeb8c188a38940ae0638f9cfe9d8f7a

SHA256
6fc5aca914b7fed8f9783b7872e1b14df959b956f47b543834e1e803f5f70b70

SHA512
09c3dceb49b98fd82c49ebc834059856d2558b899f4549aef341e3546376e1c80bf39568ff92eb907cf611f8764f9b3ddf42e5da4d62ff969a49cc9f5dec3030

Download Submit
C:\Windows\System\rpwdCbJ.exe

Filesize
1.1MB

MD5
75299a3be9a664cb9ebd9fca37578edf

SHA1
5b27ae93471748dc6df540b03c636f6539992aa0

SHA256
a0436768711085848e4fc246dbb4f0ac3f03b0c0345665aa9134ef9f74a6b2a9

SHA512
498423bc31f8311e0fb128e21c96383bd4a24b8c0a4af85b65e7d38b2c96a80770b552bfcd900f1fae882781f69b6558cb2d7cc081dab2b4beef27b470c9e22a

Download Submit
C:\Windows\System\vNBFpdm.exe

Filesize
1.1MB

MD5
dc1bb8aaa25835dc92aa98cf705d8a8f

SHA1
1c9b0771d98ab79a7597ee2d7dd56649aaca8eba

SHA256
131f640363b78b59d8612e60da2f755035c68bc52f7fd9f9b5a40b417e71771e

SHA512
ee201e2d7ac0c0e22cd4ef5338e0687e81b52d03cc7bcf4c623d02acbb04dced3968aa8c49e7e23372600bef78f157bb39461e60ec08a28a8b252cd0f755e208

Download Submit
C:\Windows\System\wWyyHjE.exe

Filesize
1.1MB

MD5
68353e84e46014931e4eea9f89fabb97

SHA1
04ea3af7496ae55a37846ed1aa0ab391a8cccbe2

SHA256
50bf65427e5d34d7822fce58e72133bc42e2c2f74476ce5c3063b87562288aa5

SHA512
49e9f54376090497396831b227ca916e70ac95d02e79e0d4af24b982fa55e53e09eeb6ea9f21284b82ecb573138e1b745d111217c06e7204ffa9ffc4ab079b1b

Download Submit
C:\Windows\System\wemYMyC.exe

Filesize
1.1MB

MD5
6f9543cd76ed8a9a05c7abd64b873d33

SHA1
0de21b7df33feb3c287b5bfe2a7d5b28483720da

SHA256
2728d8cad690a570a2e910cbf4ab37f43160a4d7d38cae720a34c61063b98ec1

SHA512
c46968b7123b9169397a34640c3ab055b36a5c0cadb1b0b06cae3946253020af49960bb978676a2745af171facc23e76259d94efe038ad079f3ffd289eb6f208

Download Submit
C:\Windows\System\wpdWvtW.exe

Filesize
1.1MB

MD5
4ed0c868846b0aa8af4d0b0bf80476f9

SHA1
c2a22dd223221c12344de4ac8cca7af9da55bd87

SHA256
8fa81b026073277231c01ae53f15d4eebb10be3cb7f30ddd3f637a6aa0198e00

SHA512
ba1a107db5392693497eaec31a9126a68e08a6ddc24bfb8ddad16e783c49494fe719764302e32596c2d1d57347c5e27ea60455dd29f35b0bb7c0b40bdd1b83a8

Download Submit
C:\Windows\System\yCGvWha.exe

Filesize
1.1MB

MD5
76984d1e2b376ddd54a9482e10826598

SHA1
89d51e37120ebed63093a470349d81add401e4de

SHA256
a5989610e240059a9d928740ea92c5c06003b712f75cf7f0f88588296fbe9228

SHA512
7af4bc2d391d6e1659fc28532ac1fa3c6f0cf10cf87a4e23fb16e8c84d61f587f1ab011f285979bbd71c9950cc0090b344a8342edb9475c0aaf6e9c6b4aa9881

Download Submit
C:\Windows\System\yJdqPul.exe

Filesize
1.1MB

MD5
6e7d1ffbdb4152b5bb44dd3b0744feaf

SHA1
ed476f85da8d8e83d4330f27b9aaddda4778334e

SHA256
1de019bbc14f3bd4adcf363fd06490fc3a5ac93f877dec5afd504761458c129c

SHA512
8ff41092408f12865b37d1ac00debc9fbca92b4093882a623e0b07d292e3cc7c74651fea8a89e5777f4a28ec55c90b04c23aeeaaa665bea2cdc78260635be564

Download Submit
memory/1336-0-0x0000020190760000-0x0000020190770000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads