xmrig | 7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28

Analysis

max time kernel
132s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
Size

1.6MB
MD5

1eea1c59d173358a5a6c01d16012dbe0
SHA1

a23bef71e352c86e1fab45d113ab35afcb85e64d
SHA256

7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28
SHA512

e78d82dc20ea4047fa249ee5afabd3c9439a3208770e346759dddb2a4f924773e3331bcba7f21161ebf3079e44c763940e89ac924c61dcf99a622b7a5c05caf7
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZCQ7Z:GemTLkNdfE0pZyP

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023b9f-4.dat	xmrig
behavioral2/files/0x000a000000023ba7-8.dat	xmrig
behavioral2/files/0x000a000000023ba8-9.dat	xmrig
behavioral2/files/0x000a000000023bab-28.dat	xmrig
behavioral2/files/0x0009000000023bce-75.dat	xmrig
behavioral2/files/0x0008000000023bd8-100.dat	xmrig
behavioral2/files/0x0008000000023c0f-146.dat	xmrig
behavioral2/files/0x0008000000023c16-161.dat	xmrig
behavioral2/files/0x0008000000023c28-160.dat	xmrig
behavioral2/files/0x0008000000023c15-156.dat	xmrig
behavioral2/files/0x0008000000023c14-150.dat	xmrig
behavioral2/files/0x0008000000023c0e-141.dat	xmrig
behavioral2/files/0x0008000000023c0d-136.dat	xmrig
behavioral2/files/0x0008000000023c0c-131.dat	xmrig
behavioral2/files/0x0008000000023c0b-126.dat	xmrig
behavioral2/files/0x0008000000023c0a-120.dat	xmrig
behavioral2/files/0x0008000000023bdb-116.dat	xmrig
behavioral2/files/0x0008000000023bda-110.dat	xmrig
behavioral2/files/0x0008000000023bd9-106.dat	xmrig
behavioral2/files/0x0008000000023bd5-96.dat	xmrig
behavioral2/files/0x000e000000023bd3-90.dat	xmrig
behavioral2/files/0x0009000000023bcf-86.dat	xmrig
behavioral2/files/0x0009000000023bcd-76.dat	xmrig
behavioral2/files/0x0008000000023bc8-71.dat	xmrig
behavioral2/files/0x000e000000023bbf-65.dat	xmrig
behavioral2/files/0x000a000000023bb8-61.dat	xmrig
behavioral2/files/0x000b000000023bb0-55.dat	xmrig
behavioral2/files/0x000b000000023baf-51.dat	xmrig
behavioral2/files/0x000b000000023bae-45.dat	xmrig
behavioral2/files/0x000a000000023bad-38.dat	xmrig
behavioral2/files/0x000a000000023bac-33.dat	xmrig
behavioral2/files/0x000a000000023baa-23.dat	xmrig
behavioral2/files/0x000a000000023ba9-18.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4364	SNwiFVA.exe
2928	rjfXGcr.exe
2340	kLuKJax.exe
4112	YHrqCPM.exe
3736	spsCWCB.exe
3212	dsgGqoy.exe
232	AGeOczA.exe
2012	jYHGQfe.exe
632	LlTOrLD.exe
2752	krLPygy.exe
1576	CUhapmQ.exe
3520	gNIElRh.exe
4028	sKHAKBI.exe
1140	fjOLffy.exe
2568	kmbDOfg.exe
4964	oSxKoCj.exe
3468	OBdnNcv.exe
1972	XBmfYyL.exe
3244	qzhwTpX.exe
4436	NbFINKL.exe
2460	PVymTtT.exe
2560	ZqwRlef.exe
968	lnTkAXB.exe
852	vRJmXjv.exe
3292	ywwquoc.exe
1508	rHvVvJB.exe
2420	cTvABrh.exe
4856	SmWazMn.exe
2384	ciugIqL.exe
1244	oUeEmkk.exe
1312	TDLHbrs.exe
4776	WaueYQi.exe
4832	GYXEDzT.exe
3408	OrNabUl.exe
3612	deEkKfO.exe
3168	nwHGEok.exe
3288	qDqgCoE.exe
692	McAsAqM.exe
956	ZWWQrkc.exe
2484	sDDcefk.exe
1600	zJwUuxH.exe
1820	IDlvRdH.exe
4060	LAoYPBy.exe
3744	vToXDsP.exe
3260	vjCoEDs.exe
1616	YumzCUp.exe
3544	LplUwqS.exe
2224	RjUAARj.exe
4424	MZofJGO.exe
4652	AGaZmmH.exe
4368	ebXTaXr.exe
5064	uOzvRVW.exe
544	IPYSuas.exe
4992	dGcwjYM.exe
4948	FpPRPxj.exe
3480	JcUUSWe.exe
208	fLyhWcq.exe
3752	ArcSbxA.exe
4848	OJGXtlR.exe
3824	OIcdCxL.exe
4172	AnETDUI.exe
4724	AthQICM.exe
1520	zGtWOdB.exe
2596	uCxvIeB.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CiSsLaa.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\MYqMhhs.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\YZsDXrO.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\DCupAKw.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\IkShibA.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\KBhPJAa.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\ngmaRhd.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\VosdGFi.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\RPLmiZa.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\eHuQHWa.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\QIvPIOi.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\warcCwD.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\YsJaDeF.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\XHIbstx.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\dCfXOaj.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\PvnUoJg.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\zSsldZn.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\pyeicjj.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\deVqQSI.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\LCXTUKH.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\zGjRkbJ.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\CBTCCIb.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\lnTkAXB.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\CzgAfwR.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\erRAOVI.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\PEtLPVk.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\KjpJKbO.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\biBogRj.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\EbSJIbw.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\hWtskIR.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\pabKxqt.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\miLxRiw.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\xWdmWGJ.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\seGBFEX.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\RkzjlLf.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\WdoovuE.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\BpbmYtw.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\JhUVNYb.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\KVDecFl.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\iApaYjN.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\zyStVSH.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\DIaYuaJ.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\UxBtLLc.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\NZFAQKO.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\oUeEmkk.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\AGaZmmH.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\FjFZOiq.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\zGtWOdB.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\RFfqqzb.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\flKzLRb.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\wCUkuGb.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\UMNoHsk.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\UwJzSRX.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\OtiShuj.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\JALRbNV.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\RNhHKDp.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\DTZaiPh.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\ODMIuVR.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\qDqgCoE.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\BYPlLdN.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\xDVEzCx.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\aLYVsoH.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\oCZWXHT.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
File created	C:\Windows\System\VXUOvUu.exe	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17296	dwm.exe
Token: SeChangeNotifyPrivilege	17296	dwm.exe
Token: 33	17296	dwm.exe
Token: SeIncBasePriorityPrivilege	17296	dwm.exe
Token: SeCreateGlobalPrivilege	17216	dwm.exe
Token: SeChangeNotifyPrivilege	17216	dwm.exe
Token: 33	17216	dwm.exe
Token: SeIncBasePriorityPrivilege	17216	dwm.exe
Token: SeShutdownPrivilege	17216	dwm.exe
Token: SeCreatePagefilePrivilege	17216	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4364	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	84
PID 1476 wrote to memory of 4364	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	84
PID 1476 wrote to memory of 2928	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	85
PID 1476 wrote to memory of 2928	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	85
PID 1476 wrote to memory of 2340	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	86
PID 1476 wrote to memory of 2340	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	86
PID 1476 wrote to memory of 4112	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	87
PID 1476 wrote to memory of 4112	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	87
PID 1476 wrote to memory of 3736	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	88
PID 1476 wrote to memory of 3736	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	88
PID 1476 wrote to memory of 3212	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	89
PID 1476 wrote to memory of 3212	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	89
PID 1476 wrote to memory of 232	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	90
PID 1476 wrote to memory of 232	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	90
PID 1476 wrote to memory of 2012	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	91
PID 1476 wrote to memory of 2012	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	91
PID 1476 wrote to memory of 632	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	92
PID 1476 wrote to memory of 632	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	92
PID 1476 wrote to memory of 2752	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	93
PID 1476 wrote to memory of 2752	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	93
PID 1476 wrote to memory of 1576	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	94
PID 1476 wrote to memory of 1576	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	94
PID 1476 wrote to memory of 3520	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	95
PID 1476 wrote to memory of 3520	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	95
PID 1476 wrote to memory of 4028	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	96
PID 1476 wrote to memory of 4028	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	96
PID 1476 wrote to memory of 1140	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	97
PID 1476 wrote to memory of 1140	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	97
PID 1476 wrote to memory of 2568	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	98
PID 1476 wrote to memory of 2568	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	98
PID 1476 wrote to memory of 4964	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	99
PID 1476 wrote to memory of 4964	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	99
PID 1476 wrote to memory of 3468	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	100
PID 1476 wrote to memory of 3468	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	100
PID 1476 wrote to memory of 1972	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	101
PID 1476 wrote to memory of 1972	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	101
PID 1476 wrote to memory of 3244	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	102
PID 1476 wrote to memory of 3244	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	102
PID 1476 wrote to memory of 4436	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	103
PID 1476 wrote to memory of 4436	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	103
PID 1476 wrote to memory of 2460	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	104
PID 1476 wrote to memory of 2460	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	104
PID 1476 wrote to memory of 2560	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	105
PID 1476 wrote to memory of 2560	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	105
PID 1476 wrote to memory of 968	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	106
PID 1476 wrote to memory of 968	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	106
PID 1476 wrote to memory of 852	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	107
PID 1476 wrote to memory of 852	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	107
PID 1476 wrote to memory of 3292	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	108
PID 1476 wrote to memory of 3292	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	108
PID 1476 wrote to memory of 1508	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	109
PID 1476 wrote to memory of 1508	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	109
PID 1476 wrote to memory of 2420	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	110
PID 1476 wrote to memory of 2420	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	110
PID 1476 wrote to memory of 4856	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	111
PID 1476 wrote to memory of 4856	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	111
PID 1476 wrote to memory of 2384	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	112
PID 1476 wrote to memory of 2384	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	112
PID 1476 wrote to memory of 1244	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	113
PID 1476 wrote to memory of 1244	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	113
PID 1476 wrote to memory of 1312	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	114
PID 1476 wrote to memory of 1312	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	114
PID 1476 wrote to memory of 4776	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	115
PID 1476 wrote to memory of 4776	1476	7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe	115

C:\Users\Admin\AppData\Local\Temp\7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe
"C:\Users\Admin\AppData\Local\Temp\7b969db995bd54f6c267ce4a1d32ec81b5c88f328a1963281f09810c9f1cac28.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\System\SNwiFVA.exe
  C:\Windows\System\SNwiFVA.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\rjfXGcr.exe
  C:\Windows\System\rjfXGcr.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\kLuKJax.exe
  C:\Windows\System\kLuKJax.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\YHrqCPM.exe
  C:\Windows\System\YHrqCPM.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\spsCWCB.exe
  C:\Windows\System\spsCWCB.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\dsgGqoy.exe
  C:\Windows\System\dsgGqoy.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\AGeOczA.exe
  C:\Windows\System\AGeOczA.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\jYHGQfe.exe
  C:\Windows\System\jYHGQfe.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\LlTOrLD.exe
  C:\Windows\System\LlTOrLD.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\krLPygy.exe
  C:\Windows\System\krLPygy.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\CUhapmQ.exe
  C:\Windows\System\CUhapmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\gNIElRh.exe
  C:\Windows\System\gNIElRh.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\sKHAKBI.exe
  C:\Windows\System\sKHAKBI.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\fjOLffy.exe
  C:\Windows\System\fjOLffy.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\kmbDOfg.exe
  C:\Windows\System\kmbDOfg.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\oSxKoCj.exe
  C:\Windows\System\oSxKoCj.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\OBdnNcv.exe
  C:\Windows\System\OBdnNcv.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\XBmfYyL.exe
  C:\Windows\System\XBmfYyL.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\qzhwTpX.exe
  C:\Windows\System\qzhwTpX.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\NbFINKL.exe
  C:\Windows\System\NbFINKL.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\PVymTtT.exe
  C:\Windows\System\PVymTtT.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\ZqwRlef.exe
  C:\Windows\System\ZqwRlef.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\lnTkAXB.exe
  C:\Windows\System\lnTkAXB.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\vRJmXjv.exe
  C:\Windows\System\vRJmXjv.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\ywwquoc.exe
  C:\Windows\System\ywwquoc.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\rHvVvJB.exe
  C:\Windows\System\rHvVvJB.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\cTvABrh.exe
  C:\Windows\System\cTvABrh.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\SmWazMn.exe
  C:\Windows\System\SmWazMn.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\ciugIqL.exe
  C:\Windows\System\ciugIqL.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\oUeEmkk.exe
  C:\Windows\System\oUeEmkk.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\TDLHbrs.exe
  C:\Windows\System\TDLHbrs.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\WaueYQi.exe
  C:\Windows\System\WaueYQi.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\GYXEDzT.exe
  C:\Windows\System\GYXEDzT.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\OrNabUl.exe
  C:\Windows\System\OrNabUl.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\deEkKfO.exe
  C:\Windows\System\deEkKfO.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\nwHGEok.exe
  C:\Windows\System\nwHGEok.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\qDqgCoE.exe
  C:\Windows\System\qDqgCoE.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\McAsAqM.exe
  C:\Windows\System\McAsAqM.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\ZWWQrkc.exe
  C:\Windows\System\ZWWQrkc.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\sDDcefk.exe
  C:\Windows\System\sDDcefk.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\zJwUuxH.exe
  C:\Windows\System\zJwUuxH.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\IDlvRdH.exe
  C:\Windows\System\IDlvRdH.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\LAoYPBy.exe
  C:\Windows\System\LAoYPBy.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\vToXDsP.exe
  C:\Windows\System\vToXDsP.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\vjCoEDs.exe
  C:\Windows\System\vjCoEDs.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\YumzCUp.exe
  C:\Windows\System\YumzCUp.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\LplUwqS.exe
  C:\Windows\System\LplUwqS.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\RjUAARj.exe
  C:\Windows\System\RjUAARj.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\MZofJGO.exe
  C:\Windows\System\MZofJGO.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\AGaZmmH.exe
  C:\Windows\System\AGaZmmH.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\ebXTaXr.exe
  C:\Windows\System\ebXTaXr.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\uOzvRVW.exe
  C:\Windows\System\uOzvRVW.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\IPYSuas.exe
  C:\Windows\System\IPYSuas.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\dGcwjYM.exe
  C:\Windows\System\dGcwjYM.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\FpPRPxj.exe
  C:\Windows\System\FpPRPxj.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\JcUUSWe.exe
  C:\Windows\System\JcUUSWe.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\fLyhWcq.exe
  C:\Windows\System\fLyhWcq.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\ArcSbxA.exe
  C:\Windows\System\ArcSbxA.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\OJGXtlR.exe
  C:\Windows\System\OJGXtlR.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\OIcdCxL.exe
  C:\Windows\System\OIcdCxL.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\AnETDUI.exe
  C:\Windows\System\AnETDUI.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\AthQICM.exe
  C:\Windows\System\AthQICM.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\zGtWOdB.exe
  C:\Windows\System\zGtWOdB.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\uCxvIeB.exe
  C:\Windows\System\uCxvIeB.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\aizQVGu.exe
  C:\Windows\System\aizQVGu.exe
  2⤵
  PID:1884
- C:\Windows\System\wZBtPwn.exe
  C:\Windows\System\wZBtPwn.exe
  2⤵
  PID:4944
- C:\Windows\System\eWlvqpj.exe
  C:\Windows\System\eWlvqpj.exe
  2⤵
  PID:3760
- C:\Windows\System\yNCchsv.exe
  C:\Windows\System\yNCchsv.exe
  2⤵
  PID:3048
- C:\Windows\System\bmxhkVp.exe
  C:\Windows\System\bmxhkVp.exe
  2⤵
  PID:1592
- C:\Windows\System\erOOAdU.exe
  C:\Windows\System\erOOAdU.exe
  2⤵
  PID:3192
- C:\Windows\System\HAwkdpW.exe
  C:\Windows\System\HAwkdpW.exe
  2⤵
  PID:4472
- C:\Windows\System\VugPdhI.exe
  C:\Windows\System\VugPdhI.exe
  2⤵
  PID:3716
- C:\Windows\System\sMVFcpG.exe
  C:\Windows\System\sMVFcpG.exe
  2⤵
  PID:836
- C:\Windows\System\PamLUgV.exe
  C:\Windows\System\PamLUgV.exe
  2⤵
  PID:4788
- C:\Windows\System\nomhMsm.exe
  C:\Windows\System\nomhMsm.exe
  2⤵
  PID:4196
- C:\Windows\System\UAPvDHu.exe
  C:\Windows\System\UAPvDHu.exe
  2⤵
  PID:5140
- C:\Windows\System\wCUkuGb.exe
  C:\Windows\System\wCUkuGb.exe
  2⤵
  PID:5168
- C:\Windows\System\FGdHNQv.exe
  C:\Windows\System\FGdHNQv.exe
  2⤵
  PID:5196
- C:\Windows\System\KFeQOgE.exe
  C:\Windows\System\KFeQOgE.exe
  2⤵
  PID:5228
- C:\Windows\System\auSYmRI.exe
  C:\Windows\System\auSYmRI.exe
  2⤵
  PID:5252
- C:\Windows\System\iDbvyLh.exe
  C:\Windows\System\iDbvyLh.exe
  2⤵
  PID:5280
- C:\Windows\System\dmrFKQA.exe
  C:\Windows\System\dmrFKQA.exe
  2⤵
  PID:5312
- C:\Windows\System\vuKIbTX.exe
  C:\Windows\System\vuKIbTX.exe
  2⤵
  PID:5336
- C:\Windows\System\IvxqmIH.exe
  C:\Windows\System\IvxqmIH.exe
  2⤵
  PID:5364
- C:\Windows\System\FchIdYq.exe
  C:\Windows\System\FchIdYq.exe
  2⤵
  PID:5392
- C:\Windows\System\fdcTTGV.exe
  C:\Windows\System\fdcTTGV.exe
  2⤵
  PID:5420
- C:\Windows\System\lvWpeRk.exe
  C:\Windows\System\lvWpeRk.exe
  2⤵
  PID:5448
- C:\Windows\System\ddaxAVB.exe
  C:\Windows\System\ddaxAVB.exe
  2⤵
  PID:5480
- C:\Windows\System\zoChERv.exe
  C:\Windows\System\zoChERv.exe
  2⤵
  PID:5508
- C:\Windows\System\znOirgN.exe
  C:\Windows\System\znOirgN.exe
  2⤵
  PID:5532
- C:\Windows\System\dGRASAt.exe
  C:\Windows\System\dGRASAt.exe
  2⤵
  PID:5560
- C:\Windows\System\erRAOVI.exe
  C:\Windows\System\erRAOVI.exe
  2⤵
  PID:5588
- C:\Windows\System\ZtTYNsO.exe
  C:\Windows\System\ZtTYNsO.exe
  2⤵
  PID:5620
- C:\Windows\System\OFdPJhi.exe
  C:\Windows\System\OFdPJhi.exe
  2⤵
  PID:5648
- C:\Windows\System\deVqQSI.exe
  C:\Windows\System\deVqQSI.exe
  2⤵
  PID:5672
- C:\Windows\System\YkmnuDu.exe
  C:\Windows\System\YkmnuDu.exe
  2⤵
  PID:5700
- C:\Windows\System\AoateiX.exe
  C:\Windows\System\AoateiX.exe
  2⤵
  PID:5728
- C:\Windows\System\OxobPls.exe
  C:\Windows\System\OxobPls.exe
  2⤵
  PID:5752
- C:\Windows\System\ScIpyKu.exe
  C:\Windows\System\ScIpyKu.exe
  2⤵
  PID:5784
- C:\Windows\System\XFzbyhs.exe
  C:\Windows\System\XFzbyhs.exe
  2⤵
  PID:5816
- C:\Windows\System\GFSJGhX.exe
  C:\Windows\System\GFSJGhX.exe
  2⤵
  PID:5844
- C:\Windows\System\HFRaQXv.exe
  C:\Windows\System\HFRaQXv.exe
  2⤵
  PID:5868
- C:\Windows\System\cZDrZLx.exe
  C:\Windows\System\cZDrZLx.exe
  2⤵
  PID:5896
- C:\Windows\System\EkllTFp.exe
  C:\Windows\System\EkllTFp.exe
  2⤵
  PID:5924
- C:\Windows\System\cogczrQ.exe
  C:\Windows\System\cogczrQ.exe
  2⤵
  PID:5988
- C:\Windows\System\jYTplJH.exe
  C:\Windows\System\jYTplJH.exe
  2⤵
  PID:6004
- C:\Windows\System\YcchMrJ.exe
  C:\Windows\System\YcchMrJ.exe
  2⤵
  PID:6020
- C:\Windows\System\XziLunP.exe
  C:\Windows\System\XziLunP.exe
  2⤵
  PID:6044
- C:\Windows\System\pjRAgVR.exe
  C:\Windows\System\pjRAgVR.exe
  2⤵
  PID:6076
- C:\Windows\System\lbvMxbi.exe
  C:\Windows\System\lbvMxbi.exe
  2⤵
  PID:6100
- C:\Windows\System\nesgmSk.exe
  C:\Windows\System\nesgmSk.exe
  2⤵
  PID:6124
- C:\Windows\System\gtYMMvQ.exe
  C:\Windows\System\gtYMMvQ.exe
  2⤵
  PID:4296
- C:\Windows\System\lpnzAUV.exe
  C:\Windows\System\lpnzAUV.exe
  2⤵
  PID:4380
- C:\Windows\System\pPpbTUK.exe
  C:\Windows\System\pPpbTUK.exe
  2⤵
  PID:1532
- C:\Windows\System\VKFmluZ.exe
  C:\Windows\System\VKFmluZ.exe
  2⤵
  PID:2724
- C:\Windows\System\jpwJOaI.exe
  C:\Windows\System\jpwJOaI.exe
  2⤵
  PID:1084
- C:\Windows\System\ebmjOrD.exe
  C:\Windows\System\ebmjOrD.exe
  2⤵
  PID:4528
- C:\Windows\System\NAtyZXP.exe
  C:\Windows\System\NAtyZXP.exe
  2⤵
  PID:5104
- C:\Windows\System\hhoYmUh.exe
  C:\Windows\System\hhoYmUh.exe
  2⤵
  PID:5156
- C:\Windows\System\qsaavFv.exe
  C:\Windows\System\qsaavFv.exe
  2⤵
  PID:5216
- C:\Windows\System\JoidBHt.exe
  C:\Windows\System\JoidBHt.exe
  2⤵
  PID:5292
- C:\Windows\System\lIiOpKl.exe
  C:\Windows\System\lIiOpKl.exe
  2⤵
  PID:5356
- C:\Windows\System\lenCIQF.exe
  C:\Windows\System\lenCIQF.exe
  2⤵
  PID:5408
- C:\Windows\System\DNGcXkM.exe
  C:\Windows\System\DNGcXkM.exe
  2⤵
  PID:5488
- C:\Windows\System\DaLUAPB.exe
  C:\Windows\System\DaLUAPB.exe
  2⤵
  PID:5548
- C:\Windows\System\ODyUxxy.exe
  C:\Windows\System\ODyUxxy.exe
  2⤵
  PID:5612
- C:\Windows\System\Ggzgdxe.exe
  C:\Windows\System\Ggzgdxe.exe
  2⤵
  PID:5684
- C:\Windows\System\dmYrTvh.exe
  C:\Windows\System\dmYrTvh.exe
  2⤵
  PID:5744
- C:\Windows\System\NgHUvVq.exe
  C:\Windows\System\NgHUvVq.exe
  2⤵
  PID:5800
- C:\Windows\System\TPaishA.exe
  C:\Windows\System\TPaishA.exe
  2⤵
  PID:5860
- C:\Windows\System\hQqHCcx.exe
  C:\Windows\System\hQqHCcx.exe
  2⤵
  PID:5936
- C:\Windows\System\jUyMGsw.exe
  C:\Windows\System\jUyMGsw.exe
  2⤵
  PID:5996
- C:\Windows\System\vNIPWAF.exe
  C:\Windows\System\vNIPWAF.exe
  2⤵
  PID:6060
- C:\Windows\System\XPzIAyF.exe
  C:\Windows\System\XPzIAyF.exe
  2⤵
  PID:6116
- C:\Windows\System\icbcEFO.exe
  C:\Windows\System\icbcEFO.exe
  2⤵
  PID:1900
- C:\Windows\System\VbrhqvL.exe
  C:\Windows\System\VbrhqvL.exe
  2⤵
  PID:3436
- C:\Windows\System\gQnivBb.exe
  C:\Windows\System\gQnivBb.exe
  2⤵
  PID:2368
- C:\Windows\System\rNDXqOh.exe
  C:\Windows\System\rNDXqOh.exe
  2⤵
  PID:5248
- C:\Windows\System\xiRPfYt.exe
  C:\Windows\System\xiRPfYt.exe
  2⤵
  PID:5380
- C:\Windows\System\cFCgbIp.exe
  C:\Windows\System\cFCgbIp.exe
  2⤵
  PID:5524
- C:\Windows\System\KJxXJAW.exe
  C:\Windows\System\KJxXJAW.exe
  2⤵
  PID:5664
- C:\Windows\System\dvQZZlA.exe
  C:\Windows\System\dvQZZlA.exe
  2⤵
  PID:5832
- C:\Windows\System\sZFvcQD.exe
  C:\Windows\System\sZFvcQD.exe
  2⤵
  PID:6168
- C:\Windows\System\euZJPax.exe
  C:\Windows\System\euZJPax.exe
  2⤵
  PID:6192
- C:\Windows\System\KVDecFl.exe
  C:\Windows\System\KVDecFl.exe
  2⤵
  PID:6224
- C:\Windows\System\FrAkXeh.exe
  C:\Windows\System\FrAkXeh.exe
  2⤵
  PID:6248
- C:\Windows\System\dJVTaeQ.exe
  C:\Windows\System\dJVTaeQ.exe
  2⤵
  PID:6276
- C:\Windows\System\gNKfGlS.exe
  C:\Windows\System\gNKfGlS.exe
  2⤵
  PID:6308
- C:\Windows\System\wZzTrXV.exe
  C:\Windows\System\wZzTrXV.exe
  2⤵
  PID:6332
- C:\Windows\System\cZFgrRR.exe
  C:\Windows\System\cZFgrRR.exe
  2⤵
  PID:6360
- C:\Windows\System\VwNpOtN.exe
  C:\Windows\System\VwNpOtN.exe
  2⤵
  PID:6388
- C:\Windows\System\BJkkqpU.exe
  C:\Windows\System\BJkkqpU.exe
  2⤵
  PID:6416
- C:\Windows\System\kekJYyh.exe
  C:\Windows\System\kekJYyh.exe
  2⤵
  PID:6444
- C:\Windows\System\xVkYfMi.exe
  C:\Windows\System\xVkYfMi.exe
  2⤵
  PID:6476
- C:\Windows\System\FsltyqV.exe
  C:\Windows\System\FsltyqV.exe
  2⤵
  PID:6500
- C:\Windows\System\jRNMvug.exe
  C:\Windows\System\jRNMvug.exe
  2⤵
  PID:6536
- C:\Windows\System\bPjJxUR.exe
  C:\Windows\System\bPjJxUR.exe
  2⤵
  PID:6568
- C:\Windows\System\YjYFmhH.exe
  C:\Windows\System\YjYFmhH.exe
  2⤵
  PID:6596
- C:\Windows\System\XmzcGlH.exe
  C:\Windows\System\XmzcGlH.exe
  2⤵
  PID:6616
- C:\Windows\System\oRIdvfi.exe
  C:\Windows\System\oRIdvfi.exe
  2⤵
  PID:6640
- C:\Windows\System\BYPlLdN.exe
  C:\Windows\System\BYPlLdN.exe
  2⤵
  PID:6672
- C:\Windows\System\EbSJIbw.exe
  C:\Windows\System\EbSJIbw.exe
  2⤵
  PID:6696
- C:\Windows\System\UFHWuvX.exe
  C:\Windows\System\UFHWuvX.exe
  2⤵
  PID:6724
- C:\Windows\System\SDPiCwL.exe
  C:\Windows\System\SDPiCwL.exe
  2⤵
  PID:6756
- C:\Windows\System\LKwWtbI.exe
  C:\Windows\System\LKwWtbI.exe
  2⤵
  PID:6784
- C:\Windows\System\eYsXjnd.exe
  C:\Windows\System\eYsXjnd.exe
  2⤵
  PID:6812
- C:\Windows\System\CCgotxp.exe
  C:\Windows\System\CCgotxp.exe
  2⤵
  PID:6840
- C:\Windows\System\PlmHDDS.exe
  C:\Windows\System\PlmHDDS.exe
  2⤵
  PID:6868
- C:\Windows\System\ghFzDtt.exe
  C:\Windows\System\ghFzDtt.exe
  2⤵
  PID:6896
- C:\Windows\System\slvaVdL.exe
  C:\Windows\System\slvaVdL.exe
  2⤵
  PID:6924
- C:\Windows\System\PYnZdpM.exe
  C:\Windows\System\PYnZdpM.exe
  2⤵
  PID:6952
- C:\Windows\System\iEAhOlh.exe
  C:\Windows\System\iEAhOlh.exe
  2⤵
  PID:6976
- C:\Windows\System\GWTHXcy.exe
  C:\Windows\System\GWTHXcy.exe
  2⤵
  PID:7004
- C:\Windows\System\eEQrRRd.exe
  C:\Windows\System\eEQrRRd.exe
  2⤵
  PID:7032
- C:\Windows\System\OkDGjhc.exe
  C:\Windows\System\OkDGjhc.exe
  2⤵
  PID:7060
- C:\Windows\System\dSKXLiW.exe
  C:\Windows\System\dSKXLiW.exe
  2⤵
  PID:7092
- C:\Windows\System\zyStVSH.exe
  C:\Windows\System\zyStVSH.exe
  2⤵
  PID:7120
- C:\Windows\System\jLPSdDG.exe
  C:\Windows\System\jLPSdDG.exe
  2⤵
  PID:7144
- C:\Windows\System\akxCExg.exe
  C:\Windows\System\akxCExg.exe
  2⤵
  PID:5912
- C:\Windows\System\ZhdFkXc.exe
  C:\Windows\System\ZhdFkXc.exe
  2⤵
  PID:6036
- C:\Windows\System\PiYoJda.exe
  C:\Windows\System\PiYoJda.exe
  2⤵
  PID:3368
- C:\Windows\System\AvmFoqY.exe
  C:\Windows\System\AvmFoqY.exe
  2⤵
  PID:5132
- C:\Windows\System\xDVEzCx.exe
  C:\Windows\System\xDVEzCx.exe
  2⤵
  PID:5460
- C:\Windows\System\ZvWxcZs.exe
  C:\Windows\System\ZvWxcZs.exe
  2⤵
  PID:5656
- C:\Windows\System\xyTvWBq.exe
  C:\Windows\System\xyTvWBq.exe
  2⤵
  PID:6180
- C:\Windows\System\fYrGHFO.exe
  C:\Windows\System\fYrGHFO.exe
  2⤵
  PID:6240
- C:\Windows\System\dWCZyVl.exe
  C:\Windows\System\dWCZyVl.exe
  2⤵
  PID:6296
- C:\Windows\System\XokuEKr.exe
  C:\Windows\System\XokuEKr.exe
  2⤵
  PID:6376
- C:\Windows\System\AogNgzC.exe
  C:\Windows\System\AogNgzC.exe
  2⤵
  PID:3892
- C:\Windows\System\IBsOaXe.exe
  C:\Windows\System\IBsOaXe.exe
  2⤵
  PID:6560
- C:\Windows\System\KjpJKbO.exe
  C:\Windows\System\KjpJKbO.exe
  2⤵
  PID:6612
- C:\Windows\System\Zhpeuuq.exe
  C:\Windows\System\Zhpeuuq.exe
  2⤵
  PID:6660
- C:\Windows\System\MAozSDO.exe
  C:\Windows\System\MAozSDO.exe
  2⤵
  PID:6692
- C:\Windows\System\ogdkwAm.exe
  C:\Windows\System\ogdkwAm.exe
  2⤵
  PID:6744
- C:\Windows\System\DIaYuaJ.exe
  C:\Windows\System\DIaYuaJ.exe
  2⤵
  PID:6860
- C:\Windows\System\AhOOlbM.exe
  C:\Windows\System\AhOOlbM.exe
  2⤵
  PID:4800
- C:\Windows\System\dMCnDVt.exe
  C:\Windows\System\dMCnDVt.exe
  2⤵
  PID:6964
- C:\Windows\System\MYqMhhs.exe
  C:\Windows\System\MYqMhhs.exe
  2⤵
  PID:7020
- C:\Windows\System\xxyGIlJ.exe
  C:\Windows\System\xxyGIlJ.exe
  2⤵
  PID:7052
- C:\Windows\System\eDZnaKO.exe
  C:\Windows\System\eDZnaKO.exe
  2⤵
  PID:7108
- C:\Windows\System\oWCWzxD.exe
  C:\Windows\System\oWCWzxD.exe
  2⤵
  PID:7160
- C:\Windows\System\lrDLcFi.exe
  C:\Windows\System\lrDLcFi.exe
  2⤵
  PID:2336
- C:\Windows\System\AEDCVhR.exe
  C:\Windows\System\AEDCVhR.exe
  2⤵
  PID:548
- C:\Windows\System\bmuuUEn.exe
  C:\Windows\System\bmuuUEn.exe
  2⤵
  PID:4744
- C:\Windows\System\JAnHgkC.exe
  C:\Windows\System\JAnHgkC.exe
  2⤵
  PID:5044
- C:\Windows\System\utMJOom.exe
  C:\Windows\System\utMJOom.exe
  2⤵
  PID:216
- C:\Windows\System\xNNkbPt.exe
  C:\Windows\System\xNNkbPt.exe
  2⤵
  PID:3228
- C:\Windows\System\osPzoDy.exe
  C:\Windows\System\osPzoDy.exe
  2⤵
  PID:1684
- C:\Windows\System\VpSLEeU.exe
  C:\Windows\System\VpSLEeU.exe
  2⤵
  PID:1952
- C:\Windows\System\LCXTUKH.exe
  C:\Windows\System\LCXTUKH.exe
  2⤵
  PID:1044
- C:\Windows\System\YnavNjW.exe
  C:\Windows\System\YnavNjW.exe
  2⤵
  PID:6352
- C:\Windows\System\zTkKPhD.exe
  C:\Windows\System\zTkKPhD.exe
  2⤵
  PID:4204
- C:\Windows\System\emgCQMg.exe
  C:\Windows\System\emgCQMg.exe
  2⤵
  PID:4516
- C:\Windows\System\cuXuFTs.exe
  C:\Windows\System\cuXuFTs.exe
  2⤵
  PID:3648
- C:\Windows\System\VywywJB.exe
  C:\Windows\System\VywywJB.exe
  2⤵
  PID:6716
- C:\Windows\System\LMmqbxc.exe
  C:\Windows\System\LMmqbxc.exe
  2⤵
  PID:6688
- C:\Windows\System\RsXkihx.exe
  C:\Windows\System\RsXkihx.exe
  2⤵
  PID:6832
- C:\Windows\System\kfwiGhw.exe
  C:\Windows\System\kfwiGhw.exe
  2⤵
  PID:1292
- C:\Windows\System\GmnlvVd.exe
  C:\Windows\System\GmnlvVd.exe
  2⤵
  PID:3764
- C:\Windows\System\TEJiuZO.exe
  C:\Windows\System\TEJiuZO.exe
  2⤵
  PID:7164
- C:\Windows\System\ngmaRhd.exe
  C:\Windows\System\ngmaRhd.exe
  2⤵
  PID:2180
- C:\Windows\System\lSoxdRz.exe
  C:\Windows\System\lSoxdRz.exe
  2⤵
  PID:4808
- C:\Windows\System\YTGsNTM.exe
  C:\Windows\System\YTGsNTM.exe
  2⤵
  PID:3720
- C:\Windows\System\VVwuchb.exe
  C:\Windows\System\VVwuchb.exe
  2⤵
  PID:1864
- C:\Windows\System\euYSxLl.exe
  C:\Windows\System\euYSxLl.exe
  2⤵
  PID:940
- C:\Windows\System\UfPTkuU.exe
  C:\Windows\System\UfPTkuU.exe
  2⤵
  PID:3404
- C:\Windows\System\sOwvOtt.exe
  C:\Windows\System\sOwvOtt.exe
  2⤵
  PID:6608
- C:\Windows\System\huffUbg.exe
  C:\Windows\System\huffUbg.exe
  2⤵
  PID:7048
- C:\Windows\System\VDhXMWJ.exe
  C:\Windows\System\VDhXMWJ.exe
  2⤵
  PID:4524
- C:\Windows\System\JfuPzid.exe
  C:\Windows\System\JfuPzid.exe
  2⤵
  PID:3820
- C:\Windows\System\RbKDeqn.exe
  C:\Windows\System\RbKDeqn.exe
  2⤵
  PID:4216
- C:\Windows\System\XwVxrbY.exe
  C:\Windows\System\XwVxrbY.exe
  2⤵
  PID:6492
- C:\Windows\System\jrKfouc.exe
  C:\Windows\System\jrKfouc.exe
  2⤵
  PID:6888
- C:\Windows\System\LkSZEqQ.exe
  C:\Windows\System\LkSZEqQ.exe
  2⤵
  PID:3548
- C:\Windows\System\MsImRlU.exe
  C:\Windows\System\MsImRlU.exe
  2⤵
  PID:2380
- C:\Windows\System\VzqAIzL.exe
  C:\Windows\System\VzqAIzL.exe
  2⤵
  PID:880
- C:\Windows\System\gcfnGQY.exe
  C:\Windows\System\gcfnGQY.exe
  2⤵
  PID:6684
- C:\Windows\System\GqOtLGX.exe
  C:\Windows\System\GqOtLGX.exe
  2⤵
  PID:7188
- C:\Windows\System\pUDeVMz.exe
  C:\Windows\System\pUDeVMz.exe
  2⤵
  PID:7228
- C:\Windows\System\DKcLRdc.exe
  C:\Windows\System\DKcLRdc.exe
  2⤵
  PID:7256
- C:\Windows\System\zMHFsfv.exe
  C:\Windows\System\zMHFsfv.exe
  2⤵
  PID:7284
- C:\Windows\System\banJuXm.exe
  C:\Windows\System\banJuXm.exe
  2⤵
  PID:7300
- C:\Windows\System\gZAqziw.exe
  C:\Windows\System\gZAqziw.exe
  2⤵
  PID:7340
- C:\Windows\System\VrLeEuf.exe
  C:\Windows\System\VrLeEuf.exe
  2⤵
  PID:7360
- C:\Windows\System\JBLmsly.exe
  C:\Windows\System\JBLmsly.exe
  2⤵
  PID:7392
- C:\Windows\System\Cbkvggt.exe
  C:\Windows\System\Cbkvggt.exe
  2⤵
  PID:7420
- C:\Windows\System\cevzBPY.exe
  C:\Windows\System\cevzBPY.exe
  2⤵
  PID:7456
- C:\Windows\System\JOVAVGy.exe
  C:\Windows\System\JOVAVGy.exe
  2⤵
  PID:7476
- C:\Windows\System\SxBvICS.exe
  C:\Windows\System\SxBvICS.exe
  2⤵
  PID:7504
- C:\Windows\System\HPjuMho.exe
  C:\Windows\System\HPjuMho.exe
  2⤵
  PID:7520
- C:\Windows\System\HZcDcze.exe
  C:\Windows\System\HZcDcze.exe
  2⤵
  PID:7536
- C:\Windows\System\DEahgHh.exe
  C:\Windows\System\DEahgHh.exe
  2⤵
  PID:7564
- C:\Windows\System\XlkmjNF.exe
  C:\Windows\System\XlkmjNF.exe
  2⤵
  PID:7592
- C:\Windows\System\ZxKvCnJ.exe
  C:\Windows\System\ZxKvCnJ.exe
  2⤵
  PID:7616
- C:\Windows\System\hWtskIR.exe
  C:\Windows\System\hWtskIR.exe
  2⤵
  PID:7652
- C:\Windows\System\LrVewKr.exe
  C:\Windows\System\LrVewKr.exe
  2⤵
  PID:7680
- C:\Windows\System\PEtLPVk.exe
  C:\Windows\System\PEtLPVk.exe
  2⤵
  PID:7740
- C:\Windows\System\nUHyMId.exe
  C:\Windows\System\nUHyMId.exe
  2⤵
  PID:7764
- C:\Windows\System\RQwFVUV.exe
  C:\Windows\System\RQwFVUV.exe
  2⤵
  PID:7792
- C:\Windows\System\tijGppC.exe
  C:\Windows\System\tijGppC.exe
  2⤵
  PID:7812
- C:\Windows\System\EuSGwLK.exe
  C:\Windows\System\EuSGwLK.exe
  2⤵
  PID:7836
- C:\Windows\System\dKJaEoS.exe
  C:\Windows\System\dKJaEoS.exe
  2⤵
  PID:7856
- C:\Windows\System\jvqymUT.exe
  C:\Windows\System\jvqymUT.exe
  2⤵
  PID:7892
- C:\Windows\System\BahFdbW.exe
  C:\Windows\System\BahFdbW.exe
  2⤵
  PID:7936
- C:\Windows\System\nsKnhDF.exe
  C:\Windows\System\nsKnhDF.exe
  2⤵
  PID:7952
- C:\Windows\System\pwRLZVP.exe
  C:\Windows\System\pwRLZVP.exe
  2⤵
  PID:7980
- C:\Windows\System\qIrdPHV.exe
  C:\Windows\System\qIrdPHV.exe
  2⤵
  PID:8004
- C:\Windows\System\mdDzLrM.exe
  C:\Windows\System\mdDzLrM.exe
  2⤵
  PID:8036
- C:\Windows\System\OuVznNW.exe
  C:\Windows\System\OuVznNW.exe
  2⤵
  PID:8064
- C:\Windows\System\CgEDZPg.exe
  C:\Windows\System\CgEDZPg.exe
  2⤵
  PID:8092
- C:\Windows\System\iQpfURJ.exe
  C:\Windows\System\iQpfURJ.exe
  2⤵
  PID:8120
- C:\Windows\System\PWUYQxF.exe
  C:\Windows\System\PWUYQxF.exe
  2⤵
  PID:8160
- C:\Windows\System\vdPSdTS.exe
  C:\Windows\System\vdPSdTS.exe
  2⤵
  PID:8176
- C:\Windows\System\NdcNNnC.exe
  C:\Windows\System\NdcNNnC.exe
  2⤵
  PID:7220
- C:\Windows\System\NnebnsY.exe
  C:\Windows\System\NnebnsY.exe
  2⤵
  PID:7276
- C:\Windows\System\JHuvusT.exe
  C:\Windows\System\JHuvusT.exe
  2⤵
  PID:7320
- C:\Windows\System\pabKxqt.exe
  C:\Windows\System\pabKxqt.exe
  2⤵
  PID:7356
- C:\Windows\System\BohXAMS.exe
  C:\Windows\System\BohXAMS.exe
  2⤵
  PID:7448
- C:\Windows\System\Qigmvwj.exe
  C:\Windows\System\Qigmvwj.exe
  2⤵
  PID:7488
- C:\Windows\System\SleRvbI.exe
  C:\Windows\System\SleRvbI.exe
  2⤵
  PID:7572
- C:\Windows\System\psPJprt.exe
  C:\Windows\System\psPJprt.exe
  2⤵
  PID:7644
- C:\Windows\System\tIfVRkT.exe
  C:\Windows\System\tIfVRkT.exe
  2⤵
  PID:7732
- C:\Windows\System\NOMuvyH.exe
  C:\Windows\System\NOMuvyH.exe
  2⤵
  PID:7804
- C:\Windows\System\bEyqmEM.exe
  C:\Windows\System\bEyqmEM.exe
  2⤵
  PID:4200
- C:\Windows\System\QZzjYva.exe
  C:\Windows\System\QZzjYva.exe
  2⤵
  PID:2584
- C:\Windows\System\SaBqFnZ.exe
  C:\Windows\System\SaBqFnZ.exe
  2⤵
  PID:7884
- C:\Windows\System\UxBtLLc.exe
  C:\Windows\System\UxBtLLc.exe
  2⤵
  PID:7968
- C:\Windows\System\TdfoMPV.exe
  C:\Windows\System\TdfoMPV.exe
  2⤵
  PID:8024
- C:\Windows\System\XtRKhIB.exe
  C:\Windows\System\XtRKhIB.exe
  2⤵
  PID:8080
- C:\Windows\System\RyuRwOV.exe
  C:\Windows\System\RyuRwOV.exe
  2⤵
  PID:8152
- C:\Windows\System\KtfIhDL.exe
  C:\Windows\System\KtfIhDL.exe
  2⤵
  PID:7292
- C:\Windows\System\sGNvDNb.exe
  C:\Windows\System\sGNvDNb.exe
  2⤵
  PID:7296
- C:\Windows\System\COpkDGu.exe
  C:\Windows\System\COpkDGu.exe
  2⤵
  PID:7576
- C:\Windows\System\jMSkJcx.exe
  C:\Windows\System\jMSkJcx.exe
  2⤵
  PID:7780
- C:\Windows\System\zegJAng.exe
  C:\Windows\System\zegJAng.exe
  2⤵
  PID:2332
- C:\Windows\System\sPvfusC.exe
  C:\Windows\System\sPvfusC.exe
  2⤵
  PID:8028
- C:\Windows\System\LtwOnHC.exe
  C:\Windows\System\LtwOnHC.exe
  2⤵
  PID:8156
- C:\Windows\System\DTsrLdS.exe
  C:\Windows\System\DTsrLdS.exe
  2⤵
  PID:7348
- C:\Windows\System\uGMbdBB.exe
  C:\Windows\System\uGMbdBB.exe
  2⤵
  PID:7604
- C:\Windows\System\MaVmsvW.exe
  C:\Windows\System\MaVmsvW.exe
  2⤵
  PID:8112
- C:\Windows\System\MFaLglf.exe
  C:\Windows\System\MFaLglf.exe
  2⤵
  PID:7268
- C:\Windows\System\yWlMPiI.exe
  C:\Windows\System\yWlMPiI.exe
  2⤵
  PID:7964
- C:\Windows\System\QosgsNA.exe
  C:\Windows\System\QosgsNA.exe
  2⤵
  PID:8212
- C:\Windows\System\bdYLHCO.exe
  C:\Windows\System\bdYLHCO.exe
  2⤵
  PID:8252
- C:\Windows\System\QIvPIOi.exe
  C:\Windows\System\QIvPIOi.exe
  2⤵
  PID:8268
- C:\Windows\System\xAuMuVn.exe
  C:\Windows\System\xAuMuVn.exe
  2⤵
  PID:8308
- C:\Windows\System\EBNulsx.exe
  C:\Windows\System\EBNulsx.exe
  2⤵
  PID:8328
- C:\Windows\System\Cthittw.exe
  C:\Windows\System\Cthittw.exe
  2⤵
  PID:8352
- C:\Windows\System\RuWPHdv.exe
  C:\Windows\System\RuWPHdv.exe
  2⤵
  PID:8392
- C:\Windows\System\YonnyVX.exe
  C:\Windows\System\YonnyVX.exe
  2⤵
  PID:8420
- C:\Windows\System\rCBIxrx.exe
  C:\Windows\System\rCBIxrx.exe
  2⤵
  PID:8436
- C:\Windows\System\bTCDFYZ.exe
  C:\Windows\System\bTCDFYZ.exe
  2⤵
  PID:8468
- C:\Windows\System\qBbRkSZ.exe
  C:\Windows\System\qBbRkSZ.exe
  2⤵
  PID:8492
- C:\Windows\System\NhZCtqr.exe
  C:\Windows\System\NhZCtqr.exe
  2⤵
  PID:8520
- C:\Windows\System\bKQOuew.exe
  C:\Windows\System\bKQOuew.exe
  2⤵
  PID:8548
- C:\Windows\System\XoyiJUm.exe
  C:\Windows\System\XoyiJUm.exe
  2⤵
  PID:8576
- C:\Windows\System\XFinDXc.exe
  C:\Windows\System\XFinDXc.exe
  2⤵
  PID:8600
- C:\Windows\System\yeBCrIK.exe
  C:\Windows\System\yeBCrIK.exe
  2⤵
  PID:8632
- C:\Windows\System\LLwFYBq.exe
  C:\Windows\System\LLwFYBq.exe
  2⤵
  PID:8656
- C:\Windows\System\mgsSSwV.exe
  C:\Windows\System\mgsSSwV.exe
  2⤵
  PID:8680
- C:\Windows\System\FdvCGtA.exe
  C:\Windows\System\FdvCGtA.exe
  2⤵
  PID:8708
- C:\Windows\System\PvnUoJg.exe
  C:\Windows\System\PvnUoJg.exe
  2⤵
  PID:8756
- C:\Windows\System\iApaYjN.exe
  C:\Windows\System\iApaYjN.exe
  2⤵
  PID:8780
- C:\Windows\System\VlZtkPD.exe
  C:\Windows\System\VlZtkPD.exe
  2⤵
  PID:8796
- C:\Windows\System\yLFpxao.exe
  C:\Windows\System\yLFpxao.exe
  2⤵
  PID:8820
- C:\Windows\System\JZpbBxu.exe
  C:\Windows\System\JZpbBxu.exe
  2⤵
  PID:8860
- C:\Windows\System\EzTQtSj.exe
  C:\Windows\System\EzTQtSj.exe
  2⤵
  PID:8896
- C:\Windows\System\dMxzpAz.exe
  C:\Windows\System\dMxzpAz.exe
  2⤵
  PID:8932
- C:\Windows\System\WDWjlpK.exe
  C:\Windows\System\WDWjlpK.exe
  2⤵
  PID:8948
- C:\Windows\System\ywWfqad.exe
  C:\Windows\System\ywWfqad.exe
  2⤵
  PID:9000
- C:\Windows\System\NkPIhrO.exe
  C:\Windows\System\NkPIhrO.exe
  2⤵
  PID:9028
- C:\Windows\System\UpxOvpr.exe
  C:\Windows\System\UpxOvpr.exe
  2⤵
  PID:9044
- C:\Windows\System\pChLtKD.exe
  C:\Windows\System\pChLtKD.exe
  2⤵
  PID:9072
- C:\Windows\System\eoNjitc.exe
  C:\Windows\System\eoNjitc.exe
  2⤵
  PID:9100
- C:\Windows\System\qXeceiI.exe
  C:\Windows\System\qXeceiI.exe
  2⤵
  PID:9140
- C:\Windows\System\czfysdk.exe
  C:\Windows\System\czfysdk.exe
  2⤵
  PID:9168
- C:\Windows\System\JHcrkae.exe
  C:\Windows\System\JHcrkae.exe
  2⤵
  PID:9196
- C:\Windows\System\ODMIuVR.exe
  C:\Windows\System\ODMIuVR.exe
  2⤵
  PID:9212
- C:\Windows\System\QDlXJzq.exe
  C:\Windows\System\QDlXJzq.exe
  2⤵
  PID:8196
- C:\Windows\System\DMtGWGO.exe
  C:\Windows\System\DMtGWGO.exe
  2⤵
  PID:8264
- C:\Windows\System\xxERReu.exe
  C:\Windows\System\xxERReu.exe
  2⤵
  PID:8348
- C:\Windows\System\tMMKdVG.exe
  C:\Windows\System\tMMKdVG.exe
  2⤵
  PID:8412
- C:\Windows\System\GCdAYyU.exe
  C:\Windows\System\GCdAYyU.exe
  2⤵
  PID:8500
- C:\Windows\System\PeZoXat.exe
  C:\Windows\System\PeZoXat.exe
  2⤵
  PID:8536
- C:\Windows\System\VosdGFi.exe
  C:\Windows\System\VosdGFi.exe
  2⤵
  PID:8596
- C:\Windows\System\QQJPcvi.exe
  C:\Windows\System\QQJPcvi.exe
  2⤵
  PID:8672
- C:\Windows\System\RmcPTjp.exe
  C:\Windows\System\RmcPTjp.exe
  2⤵
  PID:8748
- C:\Windows\System\iRcRECb.exe
  C:\Windows\System\iRcRECb.exe
  2⤵
  PID:8852
- C:\Windows\System\TMzIDGL.exe
  C:\Windows\System\TMzIDGL.exe
  2⤵
  PID:8920
- C:\Windows\System\XIKyTpJ.exe
  C:\Windows\System\XIKyTpJ.exe
  2⤵
  PID:8976
- C:\Windows\System\dFmpNrK.exe
  C:\Windows\System\dFmpNrK.exe
  2⤵
  PID:9060
- C:\Windows\System\kfVyEHf.exe
  C:\Windows\System\kfVyEHf.exe
  2⤵
  PID:9092
- C:\Windows\System\fFcbCYy.exe
  C:\Windows\System\fFcbCYy.exe
  2⤵
  PID:9180
- C:\Windows\System\YZsDXrO.exe
  C:\Windows\System\YZsDXrO.exe
  2⤵
  PID:8248
- C:\Windows\System\VAGdQHO.exe
  C:\Windows\System\VAGdQHO.exe
  2⤵
  PID:8476
- C:\Windows\System\urjIoyu.exe
  C:\Windows\System\urjIoyu.exe
  2⤵
  PID:8460
- C:\Windows\System\IFLFZYE.exe
  C:\Windows\System\IFLFZYE.exe
  2⤵
  PID:8792
- C:\Windows\System\lqWnAFW.exe
  C:\Windows\System\lqWnAFW.exe
  2⤵
  PID:3492
- C:\Windows\System\QGrgpWv.exe
  C:\Windows\System\QGrgpWv.exe
  2⤵
  PID:9012
- C:\Windows\System\gAXVhvp.exe
  C:\Windows\System\gAXVhvp.exe
  2⤵
  PID:9164
- C:\Windows\System\ltnePOD.exe
  C:\Windows\System\ltnePOD.exe
  2⤵
  PID:8452
- C:\Windows\System\pkUdSJE.exe
  C:\Windows\System\pkUdSJE.exe
  2⤵
  PID:8628
- C:\Windows\System\aznAkHa.exe
  C:\Windows\System\aznAkHa.exe
  2⤵
  PID:8916
- C:\Windows\System\eTVyBXN.exe
  C:\Windows\System\eTVyBXN.exe
  2⤵
  PID:9056
- C:\Windows\System\BVXvyQj.exe
  C:\Windows\System\BVXvyQj.exe
  2⤵
  PID:8372
- C:\Windows\System\uvgFNCP.exe
  C:\Windows\System\uvgFNCP.exe
  2⤵
  PID:9224
- C:\Windows\System\qCxcVCE.exe
  C:\Windows\System\qCxcVCE.exe
  2⤵
  PID:9240
- C:\Windows\System\pDqbxgi.exe
  C:\Windows\System\pDqbxgi.exe
  2⤵
  PID:9256
- C:\Windows\System\AwdHWtf.exe
  C:\Windows\System\AwdHWtf.exe
  2⤵
  PID:9308
- C:\Windows\System\gxHbDUB.exe
  C:\Windows\System\gxHbDUB.exe
  2⤵
  PID:9336
- C:\Windows\System\iNdfLQm.exe
  C:\Windows\System\iNdfLQm.exe
  2⤵
  PID:9352
- C:\Windows\System\yooERvg.exe
  C:\Windows\System\yooERvg.exe
  2⤵
  PID:9380
- C:\Windows\System\GPXoRjc.exe
  C:\Windows\System\GPXoRjc.exe
  2⤵
  PID:9408
- C:\Windows\System\KOWpOld.exe
  C:\Windows\System\KOWpOld.exe
  2⤵
  PID:9436
- C:\Windows\System\KPBXPjW.exe
  C:\Windows\System\KPBXPjW.exe
  2⤵
  PID:9464
- C:\Windows\System\PfiyVYc.exe
  C:\Windows\System\PfiyVYc.exe
  2⤵
  PID:9484
- C:\Windows\System\SauNSpi.exe
  C:\Windows\System\SauNSpi.exe
  2⤵
  PID:9520
- C:\Windows\System\MrDKmcT.exe
  C:\Windows\System\MrDKmcT.exe
  2⤵
  PID:9548
- C:\Windows\System\AAIRMOy.exe
  C:\Windows\System\AAIRMOy.exe
  2⤵
  PID:9588
- C:\Windows\System\iiWCQXZ.exe
  C:\Windows\System\iiWCQXZ.exe
  2⤵
  PID:9616
- C:\Windows\System\NErEOTr.exe
  C:\Windows\System\NErEOTr.exe
  2⤵
  PID:9636
- C:\Windows\System\WAhjuPG.exe
  C:\Windows\System\WAhjuPG.exe
  2⤵
  PID:9668
- C:\Windows\System\NxNQWUi.exe
  C:\Windows\System\NxNQWUi.exe
  2⤵
  PID:9700
- C:\Windows\System\UElNIeP.exe
  C:\Windows\System\UElNIeP.exe
  2⤵
  PID:9716
- C:\Windows\System\HQaHWZf.exe
  C:\Windows\System\HQaHWZf.exe
  2⤵
  PID:9756
- C:\Windows\System\RBKmvqD.exe
  C:\Windows\System\RBKmvqD.exe
  2⤵
  PID:9776
- C:\Windows\System\EqVArEq.exe
  C:\Windows\System\EqVArEq.exe
  2⤵
  PID:9816
- C:\Windows\System\RkPZDnX.exe
  C:\Windows\System\RkPZDnX.exe
  2⤵
  PID:9836
- C:\Windows\System\MAjhhmW.exe
  C:\Windows\System\MAjhhmW.exe
  2⤵
  PID:9860
- C:\Windows\System\UGFtPyJ.exe
  C:\Windows\System\UGFtPyJ.exe
  2⤵
  PID:9884
- C:\Windows\System\WftRKXK.exe
  C:\Windows\System\WftRKXK.exe
  2⤵
  PID:9916
- C:\Windows\System\DFaVIbg.exe
  C:\Windows\System\DFaVIbg.exe
  2⤵
  PID:9944
- C:\Windows\System\RwXNqSS.exe
  C:\Windows\System\RwXNqSS.exe
  2⤵
  PID:9968
- C:\Windows\System\FfacWhH.exe
  C:\Windows\System\FfacWhH.exe
  2⤵
  PID:9984
- C:\Windows\System\RXkXXvE.exe
  C:\Windows\System\RXkXXvE.exe
  2⤵
  PID:10004
- C:\Windows\System\yDTTpuR.exe
  C:\Windows\System\yDTTpuR.exe
  2⤵
  PID:10056
- C:\Windows\System\JWoMzZN.exe
  C:\Windows\System\JWoMzZN.exe
  2⤵
  PID:10080
- C:\Windows\System\JtTyYCq.exe
  C:\Windows\System\JtTyYCq.exe
  2⤵
  PID:10100
- C:\Windows\System\WHUMGyK.exe
  C:\Windows\System\WHUMGyK.exe
  2⤵
  PID:10132
- C:\Windows\System\biBogRj.exe
  C:\Windows\System\biBogRj.exe
  2⤵
  PID:10180
- C:\Windows\System\fuWuNNV.exe
  C:\Windows\System\fuWuNNV.exe
  2⤵
  PID:10208
- C:\Windows\System\YgfIKcV.exe
  C:\Windows\System\YgfIKcV.exe
  2⤵
  PID:10224
- C:\Windows\System\xmaESve.exe
  C:\Windows\System\xmaESve.exe
  2⤵
  PID:9236
- C:\Windows\System\JSsXIDv.exe
  C:\Windows\System\JSsXIDv.exe
  2⤵
  PID:9272
- C:\Windows\System\fHNJBCP.exe
  C:\Windows\System\fHNJBCP.exe
  2⤵
  PID:9328
- C:\Windows\System\IJAPQMM.exe
  C:\Windows\System\IJAPQMM.exe
  2⤵
  PID:9428
- C:\Windows\System\ZMfEGfT.exe
  C:\Windows\System\ZMfEGfT.exe
  2⤵
  PID:9480
- C:\Windows\System\CiSsLaa.exe
  C:\Windows\System\CiSsLaa.exe
  2⤵
  PID:9584
- C:\Windows\System\BudaVOr.exe
  C:\Windows\System\BudaVOr.exe
  2⤵
  PID:9612
- C:\Windows\System\QTyVyEZ.exe
  C:\Windows\System\QTyVyEZ.exe
  2⤵
  PID:9680
- C:\Windows\System\jEXImKH.exe
  C:\Windows\System\jEXImKH.exe
  2⤵
  PID:9764
- C:\Windows\System\VbaOULu.exe
  C:\Windows\System\VbaOULu.exe
  2⤵
  PID:9796
- C:\Windows\System\MLxlOGt.exe
  C:\Windows\System\MLxlOGt.exe
  2⤵
  PID:9848
- C:\Windows\System\XecAjxd.exe
  C:\Windows\System\XecAjxd.exe
  2⤵
  PID:400
- C:\Windows\System\NdGrOfI.exe
  C:\Windows\System\NdGrOfI.exe
  2⤵
  PID:10016
- C:\Windows\System\ylGgPAa.exe
  C:\Windows\System\ylGgPAa.exe
  2⤵
  PID:10088
- C:\Windows\System\XWjnZUT.exe
  C:\Windows\System\XWjnZUT.exe
  2⤵
  PID:10152
- C:\Windows\System\xTgdyqA.exe
  C:\Windows\System\xTgdyqA.exe
  2⤵
  PID:10204
- C:\Windows\System\qyLaSAi.exe
  C:\Windows\System\qyLaSAi.exe
  2⤵
  PID:9304
- C:\Windows\System\LNhMSKD.exe
  C:\Windows\System\LNhMSKD.exe
  2⤵
  PID:9424
- C:\Windows\System\jzArzDD.exe
  C:\Windows\System\jzArzDD.exe
  2⤵
  PID:9608
- C:\Windows\System\XxqpNJL.exe
  C:\Windows\System\XxqpNJL.exe
  2⤵
  PID:9844
- C:\Windows\System\RrLaily.exe
  C:\Windows\System\RrLaily.exe
  2⤵
  PID:9832
- C:\Windows\System\htaTgWV.exe
  C:\Windows\System\htaTgWV.exe
  2⤵
  PID:10000
- C:\Windows\System\QuepxUm.exe
  C:\Windows\System\QuepxUm.exe
  2⤵
  PID:10176
- C:\Windows\System\kFjHYuH.exe
  C:\Windows\System\kFjHYuH.exe
  2⤵
  PID:9348
- C:\Windows\System\bjAFoyf.exe
  C:\Windows\System\bjAFoyf.exe
  2⤵
  PID:9652
- C:\Windows\System\wUehYae.exe
  C:\Windows\System\wUehYae.exe
  2⤵
  PID:9828
- C:\Windows\System\sVboEvT.exe
  C:\Windows\System\sVboEvT.exe
  2⤵
  PID:10216
- C:\Windows\System\RcotYgN.exe
  C:\Windows\System\RcotYgN.exe
  2⤵
  PID:10268
- C:\Windows\System\IhbLIaD.exe
  C:\Windows\System\IhbLIaD.exe
  2⤵
  PID:10300
- C:\Windows\System\sVTbncS.exe
  C:\Windows\System\sVTbncS.exe
  2⤵
  PID:10332
- C:\Windows\System\MxjxdTX.exe
  C:\Windows\System\MxjxdTX.exe
  2⤵
  PID:10364
- C:\Windows\System\tODSnjn.exe
  C:\Windows\System\tODSnjn.exe
  2⤵
  PID:10384
- C:\Windows\System\BDorQIb.exe
  C:\Windows\System\BDorQIb.exe
  2⤵
  PID:10400
- C:\Windows\System\RpAlKcv.exe
  C:\Windows\System\RpAlKcv.exe
  2⤵
  PID:10428
- C:\Windows\System\VieqnaG.exe
  C:\Windows\System\VieqnaG.exe
  2⤵
  PID:10456
- C:\Windows\System\YlWtgAt.exe
  C:\Windows\System\YlWtgAt.exe
  2⤵
  PID:10488
- C:\Windows\System\kNYYGVR.exe
  C:\Windows\System\kNYYGVR.exe
  2⤵
  PID:10520
- C:\Windows\System\AHhVtcA.exe
  C:\Windows\System\AHhVtcA.exe
  2⤵
  PID:10544
- C:\Windows\System\RNhHKDp.exe
  C:\Windows\System\RNhHKDp.exe
  2⤵
  PID:10564
- C:\Windows\System\tfSnOXH.exe
  C:\Windows\System\tfSnOXH.exe
  2⤵
  PID:10620
- C:\Windows\System\bMFYVTh.exe
  C:\Windows\System\bMFYVTh.exe
  2⤵
  PID:10648
- C:\Windows\System\RZSQoee.exe
  C:\Windows\System\RZSQoee.exe
  2⤵
  PID:10684
- C:\Windows\System\kODRovH.exe
  C:\Windows\System\kODRovH.exe
  2⤵
  PID:10708
- C:\Windows\System\OvBCaRp.exe
  C:\Windows\System\OvBCaRp.exe
  2⤵
  PID:10748
- C:\Windows\System\vAWdpTw.exe
  C:\Windows\System\vAWdpTw.exe
  2⤵
  PID:10764
- C:\Windows\System\mDROxpi.exe
  C:\Windows\System\mDROxpi.exe
  2⤵
  PID:10792
- C:\Windows\System\lstFEkJ.exe
  C:\Windows\System\lstFEkJ.exe
  2⤵
  PID:10828
- C:\Windows\System\USMUaFw.exe
  C:\Windows\System\USMUaFw.exe
  2⤵
  PID:10848
- C:\Windows\System\gDHJBpc.exe
  C:\Windows\System\gDHJBpc.exe
  2⤵
  PID:10876
- C:\Windows\System\ttSEIjZ.exe
  C:\Windows\System\ttSEIjZ.exe
  2⤵
  PID:10904
- C:\Windows\System\ZDHsNjh.exe
  C:\Windows\System\ZDHsNjh.exe
  2⤵
  PID:10928
- C:\Windows\System\czKmPKT.exe
  C:\Windows\System\czKmPKT.exe
  2⤵
  PID:10976
- C:\Windows\System\vdHzhkn.exe
  C:\Windows\System\vdHzhkn.exe
  2⤵
  PID:10992
- C:\Windows\System\rtXjCve.exe
  C:\Windows\System\rtXjCve.exe
  2⤵
  PID:11020
- C:\Windows\System\vdEZVGB.exe
  C:\Windows\System\vdEZVGB.exe
  2⤵
  PID:11040
- C:\Windows\System\pGEwusn.exe
  C:\Windows\System\pGEwusn.exe
  2⤵
  PID:11088
- C:\Windows\System\jFVaEAG.exe
  C:\Windows\System\jFVaEAG.exe
  2⤵
  PID:11112
- C:\Windows\System\ApajluN.exe
  C:\Windows\System\ApajluN.exe
  2⤵
  PID:11132
- C:\Windows\System\LFhwQZD.exe
  C:\Windows\System\LFhwQZD.exe
  2⤵
  PID:11152
- C:\Windows\System\UIZuQSc.exe
  C:\Windows\System\UIZuQSc.exe
  2⤵
  PID:11176
- C:\Windows\System\CIeKIGG.exe
  C:\Windows\System\CIeKIGG.exe
  2⤵
  PID:11200
- C:\Windows\System\blduHbE.exe
  C:\Windows\System\blduHbE.exe
  2⤵
  PID:11244
- C:\Windows\System\NesUbiv.exe
  C:\Windows\System\NesUbiv.exe
  2⤵
  PID:10236
- C:\Windows\System\UcVnuNy.exe
  C:\Windows\System\UcVnuNy.exe
  2⤵
  PID:10320
- C:\Windows\System\TEuMYTG.exe
  C:\Windows\System\TEuMYTG.exe
  2⤵
  PID:10392
- C:\Windows\System\ftMqcIf.exe
  C:\Windows\System\ftMqcIf.exe
  2⤵
  PID:10512
- C:\Windows\System\nEQwlHR.exe
  C:\Windows\System\nEQwlHR.exe
  2⤵
  PID:10508
- C:\Windows\System\kGYywrm.exe
  C:\Windows\System\kGYywrm.exe
  2⤵
  PID:10600
- C:\Windows\System\DTZaiPh.exe
  C:\Windows\System\DTZaiPh.exe
  2⤵
  PID:10676
- C:\Windows\System\KNaLvvo.exe
  C:\Windows\System\KNaLvvo.exe
  2⤵
  PID:10728
- C:\Windows\System\MFqhhRO.exe
  C:\Windows\System\MFqhhRO.exe
  2⤵
  PID:10788
- C:\Windows\System\NZFAQKO.exe
  C:\Windows\System\NZFAQKO.exe
  2⤵
  PID:10840
- C:\Windows\System\zSsldZn.exe
  C:\Windows\System\zSsldZn.exe
  2⤵
  PID:10936
- C:\Windows\System\MDFotbz.exe
  C:\Windows\System\MDFotbz.exe
  2⤵
  PID:11004
- C:\Windows\System\GhazcrP.exe
  C:\Windows\System\GhazcrP.exe
  2⤵
  PID:11048
- C:\Windows\System\rWCMclb.exe
  C:\Windows\System\rWCMclb.exe
  2⤵
  PID:11096
- C:\Windows\System\gDEfcpL.exe
  C:\Windows\System\gDEfcpL.exe
  2⤵
  PID:11160
- C:\Windows\System\xWdmWGJ.exe
  C:\Windows\System\xWdmWGJ.exe
  2⤵
  PID:11196
- C:\Windows\System\uVOtaqy.exe
  C:\Windows\System\uVOtaqy.exe
  2⤵
  PID:11252
- C:\Windows\System\zjfXhpX.exe
  C:\Windows\System\zjfXhpX.exe
  2⤵
  PID:10412
- C:\Windows\System\xXrAECy.exe
  C:\Windows\System\xXrAECy.exe
  2⤵
  PID:10540
- C:\Windows\System\dJNGWKW.exe
  C:\Windows\System\dJNGWKW.exe
  2⤵
  PID:10656
- C:\Windows\System\gIwgJOu.exe
  C:\Windows\System\gIwgJOu.exe
  2⤵
  PID:10804
- C:\Windows\System\YtQgMVm.exe
  C:\Windows\System\YtQgMVm.exe
  2⤵
  PID:10916
- C:\Windows\System\KVbdOnH.exe
  C:\Windows\System\KVbdOnH.exe
  2⤵
  PID:11148
- C:\Windows\System\nxUayWh.exe
  C:\Windows\System\nxUayWh.exe
  2⤵
  PID:11192
- C:\Windows\System\OtiShuj.exe
  C:\Windows\System\OtiShuj.exe
  2⤵
  PID:10640
- C:\Windows\System\mRViGQG.exe
  C:\Windows\System\mRViGQG.exe
  2⤵
  PID:10528
- C:\Windows\System\uzIuKGW.exe
  C:\Windows\System\uzIuKGW.exe
  2⤵
  PID:11220
- C:\Windows\System\arfdoAO.exe
  C:\Windows\System\arfdoAO.exe
  2⤵
  PID:11028
- C:\Windows\System\lwCslgn.exe
  C:\Windows\System\lwCslgn.exe
  2⤵
  PID:11304
- C:\Windows\System\wPBWYWq.exe
  C:\Windows\System\wPBWYWq.exe
  2⤵
  PID:11336
- C:\Windows\System\tpSUJld.exe
  C:\Windows\System\tpSUJld.exe
  2⤵
  PID:11364
- C:\Windows\System\RRXPgQG.exe
  C:\Windows\System\RRXPgQG.exe
  2⤵
  PID:11396
- C:\Windows\System\jsSWOpu.exe
  C:\Windows\System\jsSWOpu.exe
  2⤵
  PID:11420
- C:\Windows\System\ExqKqsa.exe
  C:\Windows\System\ExqKqsa.exe
  2⤵
  PID:11440
- C:\Windows\System\qhdTpFV.exe
  C:\Windows\System\qhdTpFV.exe
  2⤵
  PID:11472
- C:\Windows\System\tPRHoYg.exe
  C:\Windows\System\tPRHoYg.exe
  2⤵
  PID:11496
- C:\Windows\System\RNBrgGx.exe
  C:\Windows\System\RNBrgGx.exe
  2⤵
  PID:11516
- C:\Windows\System\lZGTzer.exe
  C:\Windows\System\lZGTzer.exe
  2⤵
  PID:11560
- C:\Windows\System\NkRjjjK.exe
  C:\Windows\System\NkRjjjK.exe
  2⤵
  PID:11580
- C:\Windows\System\DCupAKw.exe
  C:\Windows\System\DCupAKw.exe
  2⤵
  PID:11620
- C:\Windows\System\UMNoHsk.exe
  C:\Windows\System\UMNoHsk.exe
  2⤵
  PID:11648
- C:\Windows\System\ADlEBDP.exe
  C:\Windows\System\ADlEBDP.exe
  2⤵
  PID:11676
- C:\Windows\System\DDqUCVB.exe
  C:\Windows\System\DDqUCVB.exe
  2⤵
  PID:11704
- C:\Windows\System\PtDEuHD.exe
  C:\Windows\System\PtDEuHD.exe
  2⤵
  PID:11732
- C:\Windows\System\xMerLls.exe
  C:\Windows\System\xMerLls.exe
  2⤵
  PID:11760
- C:\Windows\System\urJvEmy.exe
  C:\Windows\System\urJvEmy.exe
  2⤵
  PID:11784
- C:\Windows\System\QpUIaJF.exe
  C:\Windows\System\QpUIaJF.exe
  2⤵
  PID:11816
- C:\Windows\System\vRjmSyi.exe
  C:\Windows\System\vRjmSyi.exe
  2⤵
  PID:11832
- C:\Windows\System\KtVqXKm.exe
  C:\Windows\System\KtVqXKm.exe
  2⤵
  PID:11872
- C:\Windows\System\xqxuQGt.exe
  C:\Windows\System\xqxuQGt.exe
  2⤵
  PID:11892
- C:\Windows\System\BAkPjQu.exe
  C:\Windows\System\BAkPjQu.exe
  2⤵
  PID:11928
- C:\Windows\System\AzmZXay.exe
  C:\Windows\System\AzmZXay.exe
  2⤵
  PID:11952
- C:\Windows\System\TuaAMht.exe
  C:\Windows\System\TuaAMht.exe
  2⤵
  PID:11984
- C:\Windows\System\LCMolBb.exe
  C:\Windows\System\LCMolBb.exe
  2⤵
  PID:12000
- C:\Windows\System\ffVcRTP.exe
  C:\Windows\System\ffVcRTP.exe
  2⤵
  PID:12048
- C:\Windows\System\pdiSMkR.exe
  C:\Windows\System\pdiSMkR.exe
  2⤵
  PID:12064
- C:\Windows\System\JsHHBJq.exe
  C:\Windows\System\JsHHBJq.exe
  2⤵
  PID:12092
- C:\Windows\System\XrBlqJe.exe
  C:\Windows\System\XrBlqJe.exe
  2⤵
  PID:12132
- C:\Windows\System\zKsNUPo.exe
  C:\Windows\System\zKsNUPo.exe
  2⤵
  PID:12148
- C:\Windows\System\BoxgmmQ.exe
  C:\Windows\System\BoxgmmQ.exe
  2⤵
  PID:12188
- C:\Windows\System\OrBUyjW.exe
  C:\Windows\System\OrBUyjW.exe
  2⤵
  PID:12216
- C:\Windows\System\fnoBdxU.exe
  C:\Windows\System\fnoBdxU.exe
  2⤵
  PID:12244
- C:\Windows\System\ZDpBTUI.exe
  C:\Windows\System\ZDpBTUI.exe
  2⤵
  PID:12260
- C:\Windows\System\RAwgOOV.exe
  C:\Windows\System\RAwgOOV.exe
  2⤵
  PID:11292
- C:\Windows\System\ePvvTrz.exe
  C:\Windows\System\ePvvTrz.exe
  2⤵
  PID:11348
- C:\Windows\System\GbdadaD.exe
  C:\Windows\System\GbdadaD.exe
  2⤵
  PID:11416
- C:\Windows\System\nyRVdtC.exe
  C:\Windows\System\nyRVdtC.exe
  2⤵
  PID:11492
- C:\Windows\System\IKJUVrW.exe
  C:\Windows\System\IKJUVrW.exe
  2⤵
  PID:11512
- C:\Windows\System\scZAkeU.exe
  C:\Windows\System\scZAkeU.exe
  2⤵
  PID:11600
- C:\Windows\System\KxxXitK.exe
  C:\Windows\System\KxxXitK.exe
  2⤵
  PID:11688
- C:\Windows\System\IHoSYOW.exe
  C:\Windows\System\IHoSYOW.exe
  2⤵
  PID:11720
- C:\Windows\System\UwJzSRX.exe
  C:\Windows\System\UwJzSRX.exe
  2⤵
  PID:11752
- C:\Windows\System\rJtbbcT.exe
  C:\Windows\System\rJtbbcT.exe
  2⤵
  PID:11812
- C:\Windows\System\RuumiEj.exe
  C:\Windows\System\RuumiEj.exe
  2⤵
  PID:11904
- C:\Windows\System\cXTPryn.exe
  C:\Windows\System\cXTPryn.exe
  2⤵
  PID:11976
- C:\Windows\System\KQRxnaX.exe
  C:\Windows\System\KQRxnaX.exe
  2⤵
  PID:12028
- C:\Windows\System\GaSMaie.exe
  C:\Windows\System\GaSMaie.exe
  2⤵
  PID:12104
- C:\Windows\System\nvaeHcb.exe
  C:\Windows\System\nvaeHcb.exe
  2⤵
  PID:12204
- C:\Windows\System\AWCOgmC.exe
  C:\Windows\System\AWCOgmC.exe
  2⤵
  PID:10888
- C:\Windows\System\DuHQpJN.exe
  C:\Windows\System\DuHQpJN.exe
  2⤵
  PID:11380
- C:\Windows\System\xUCxQAs.exe
  C:\Windows\System\xUCxQAs.exe
  2⤵
  PID:11576
- C:\Windows\System\PPpazye.exe
  C:\Windows\System\PPpazye.exe
  2⤵
  PID:11664
- C:\Windows\System\FjFZOiq.exe
  C:\Windows\System\FjFZOiq.exe
  2⤵
  PID:11796
- C:\Windows\System\qRJKIgJ.exe
  C:\Windows\System\qRJKIgJ.exe
  2⤵
  PID:11884
- C:\Windows\System\rQaiefy.exe
  C:\Windows\System\rQaiefy.exe
  2⤵
  PID:12088
- C:\Windows\System\pyeicjj.exe
  C:\Windows\System\pyeicjj.exe
  2⤵
  PID:12212
- C:\Windows\System\DAATDIe.exe
  C:\Windows\System\DAATDIe.exe
  2⤵
  PID:11632
- C:\Windows\System\bkIgQMa.exe
  C:\Windows\System\bkIgQMa.exe
  2⤵
  PID:11828
- C:\Windows\System\IkShibA.exe
  C:\Windows\System\IkShibA.exe
  2⤵
  PID:12060
- C:\Windows\System\scNZHPb.exe
  C:\Windows\System\scNZHPb.exe
  2⤵
  PID:11456
- C:\Windows\System\veavVHt.exe
  C:\Windows\System\veavVHt.exe
  2⤵
  PID:12032
- C:\Windows\System\LTATrdA.exe
  C:\Windows\System\LTATrdA.exe
  2⤵
  PID:12308
- C:\Windows\System\DljFWOZ.exe
  C:\Windows\System\DljFWOZ.exe
  2⤵
  PID:12340
- C:\Windows\System\iDyOaft.exe
  C:\Windows\System\iDyOaft.exe
  2⤵
  PID:12372
- C:\Windows\System\auVivDp.exe
  C:\Windows\System\auVivDp.exe
  2⤵
  PID:12404
- C:\Windows\System\sFlfglz.exe
  C:\Windows\System\sFlfglz.exe
  2⤵
  PID:12428
- C:\Windows\System\WApUFFk.exe
  C:\Windows\System\WApUFFk.exe
  2⤵
  PID:12460
- C:\Windows\System\UUoNZqR.exe
  C:\Windows\System\UUoNZqR.exe
  2⤵
  PID:12484
- C:\Windows\System\dSZwaUY.exe
  C:\Windows\System\dSZwaUY.exe
  2⤵
  PID:12516
- C:\Windows\System\Iqmogfg.exe
  C:\Windows\System\Iqmogfg.exe
  2⤵
  PID:12540
- C:\Windows\System\kLiBBjc.exe
  C:\Windows\System\kLiBBjc.exe
  2⤵
  PID:12572
- C:\Windows\System\lnDXHTl.exe
  C:\Windows\System\lnDXHTl.exe
  2⤵
  PID:12600
- C:\Windows\System\ztCwesS.exe
  C:\Windows\System\ztCwesS.exe
  2⤵
  PID:12628
- C:\Windows\System\fAeIzlF.exe
  C:\Windows\System\fAeIzlF.exe
  2⤵
  PID:12668
- C:\Windows\System\bRaGRdJ.exe
  C:\Windows\System\bRaGRdJ.exe
  2⤵
  PID:12692
- C:\Windows\System\MuFIJxY.exe
  C:\Windows\System\MuFIJxY.exe
  2⤵
  PID:12724
- C:\Windows\System\FSBTyhl.exe
  C:\Windows\System\FSBTyhl.exe
  2⤵
  PID:12748
- C:\Windows\System\ZqZuRUi.exe
  C:\Windows\System\ZqZuRUi.exe
  2⤵
  PID:12768
- C:\Windows\System\YUqIQce.exe
  C:\Windows\System\YUqIQce.exe
  2⤵
  PID:12808
- C:\Windows\System\iMjWgPK.exe
  C:\Windows\System\iMjWgPK.exe
  2⤵
  PID:12836
- C:\Windows\System\iOWxJSN.exe
  C:\Windows\System\iOWxJSN.exe
  2⤵
  PID:12852
- C:\Windows\System\VXUOvUu.exe
  C:\Windows\System\VXUOvUu.exe
  2⤵
  PID:12868
- C:\Windows\System\jfGeYrt.exe
  C:\Windows\System\jfGeYrt.exe
  2⤵
  PID:12896
- C:\Windows\System\cqodSvm.exe
  C:\Windows\System\cqodSvm.exe
  2⤵
  PID:12924
- C:\Windows\System\QboABYZ.exe
  C:\Windows\System\QboABYZ.exe
  2⤵
  PID:12952
- C:\Windows\System\fiWIwcG.exe
  C:\Windows\System\fiWIwcG.exe
  2⤵
  PID:12972
- C:\Windows\System\CzgAfwR.exe
  C:\Windows\System\CzgAfwR.exe
  2⤵
  PID:13012
- C:\Windows\System\FWWhgfa.exe
  C:\Windows\System\FWWhgfa.exe
  2⤵
  PID:13040
- C:\Windows\System\IPUPvWC.exe
  C:\Windows\System\IPUPvWC.exe
  2⤵
  PID:13092
- C:\Windows\System\rnzcCmc.exe
  C:\Windows\System\rnzcCmc.exe
  2⤵
  PID:13120
- C:\Windows\System\qYBnnPx.exe
  C:\Windows\System\qYBnnPx.exe
  2⤵
  PID:13148
- C:\Windows\System\actetOL.exe
  C:\Windows\System\actetOL.exe
  2⤵
  PID:13176
- C:\Windows\System\cCCtQHM.exe
  C:\Windows\System\cCCtQHM.exe
  2⤵
  PID:13204
- C:\Windows\System\KBhPJAa.exe
  C:\Windows\System\KBhPJAa.exe
  2⤵
  PID:13232
- C:\Windows\System\ndcVWNS.exe
  C:\Windows\System\ndcVWNS.exe
  2⤵
  PID:13260
- C:\Windows\System\tsQWQHG.exe
  C:\Windows\System\tsQWQHG.exe
  2⤵
  PID:13288
- C:\Windows\System\AvNvomC.exe
  C:\Windows\System\AvNvomC.exe
  2⤵
  PID:13304
- C:\Windows\System\kdijgqe.exe
  C:\Windows\System\kdijgqe.exe
  2⤵
  PID:12332
- C:\Windows\System\zGjRkbJ.exe
  C:\Windows\System\zGjRkbJ.exe
  2⤵
  PID:12388
- C:\Windows\System\BpbmYtw.exe
  C:\Windows\System\BpbmYtw.exe
  2⤵
  PID:12440
- C:\Windows\System\seGBFEX.exe
  C:\Windows\System\seGBFEX.exe
  2⤵
  PID:12536
- C:\Windows\System\kTyvIOX.exe
  C:\Windows\System\kTyvIOX.exe
  2⤵
  PID:12584
- C:\Windows\System\rMKgPqw.exe
  C:\Windows\System\rMKgPqw.exe
  2⤵
  PID:12652
- C:\Windows\System\JFqfuSg.exe
  C:\Windows\System\JFqfuSg.exe
  2⤵
  PID:12708
- C:\Windows\System\ZQLxAoO.exe
  C:\Windows\System\ZQLxAoO.exe
  2⤵
  PID:12740
- C:\Windows\System\HNWilli.exe
  C:\Windows\System\HNWilli.exe
  2⤵
  PID:12832
- C:\Windows\System\RmkXqOA.exe
  C:\Windows\System\RmkXqOA.exe
  2⤵
  PID:12884
- C:\Windows\System\mTCxbMw.exe
  C:\Windows\System\mTCxbMw.exe
  2⤵
  PID:13008
- C:\Windows\System\PHiAiMj.exe
  C:\Windows\System\PHiAiMj.exe
  2⤵
  PID:13064
- C:\Windows\System\cxBoMFl.exe
  C:\Windows\System\cxBoMFl.exe
  2⤵
  PID:13136
- C:\Windows\System\DmsqMJK.exe
  C:\Windows\System\DmsqMJK.exe
  2⤵
  PID:13172
- C:\Windows\System\iNtPziS.exe
  C:\Windows\System\iNtPziS.exe
  2⤵
  PID:13280
- C:\Windows\System\CZdKRTH.exe
  C:\Windows\System\CZdKRTH.exe
  2⤵
  PID:13300
- C:\Windows\System\pJfLcGG.exe
  C:\Windows\System\pJfLcGG.exe
  2⤵
  PID:12396
- C:\Windows\System\QprrEdA.exe
  C:\Windows\System\QprrEdA.exe
  2⤵
  PID:12532
- C:\Windows\System\EmlMBkq.exe
  C:\Windows\System\EmlMBkq.exe
  2⤵
  PID:12744
- C:\Windows\System\KOqfoWU.exe
  C:\Windows\System\KOqfoWU.exe
  2⤵
  PID:12880
- C:\Windows\System\WbVoTeW.exe
  C:\Windows\System\WbVoTeW.exe
  2⤵
  PID:13108
- C:\Windows\System\gjXwXNH.exe
  C:\Windows\System\gjXwXNH.exe
  2⤵
  PID:13220
- C:\Windows\System\dEwKKxU.exe
  C:\Windows\System\dEwKKxU.exe
  2⤵
  PID:12420
- C:\Windows\System\PUyPSsM.exe
  C:\Windows\System\PUyPSsM.exe
  2⤵
  PID:12620
- C:\Windows\System\dCfXOaj.exe
  C:\Windows\System\dCfXOaj.exe
  2⤵
  PID:12936
- C:\Windows\System\RkzjlLf.exe
  C:\Windows\System\RkzjlLf.exe
  2⤵
  PID:13216
- C:\Windows\System\BGYHYvX.exe
  C:\Windows\System\BGYHYvX.exe
  2⤵
  PID:13028
- C:\Windows\System\JALRbNV.exe
  C:\Windows\System\JALRbNV.exe
  2⤵
  PID:13348
- C:\Windows\System\MMzESpx.exe
  C:\Windows\System\MMzESpx.exe
  2⤵
  PID:13372
- C:\Windows\System\bajFugv.exe
  C:\Windows\System\bajFugv.exe
  2⤵
  PID:13392
- C:\Windows\System\sdsginv.exe
  C:\Windows\System\sdsginv.exe
  2⤵
  PID:13432
- C:\Windows\System\fYZfXlL.exe
  C:\Windows\System\fYZfXlL.exe
  2⤵
  PID:13456
- C:\Windows\System\oAObJAp.exe
  C:\Windows\System\oAObJAp.exe
  2⤵
  PID:13472
- C:\Windows\System\otVxxBQ.exe
  C:\Windows\System\otVxxBQ.exe
  2⤵
  PID:13504
- C:\Windows\System\uSghotp.exe
  C:\Windows\System\uSghotp.exe
  2⤵
  PID:13528
- C:\Windows\System\lGoJuzI.exe
  C:\Windows\System\lGoJuzI.exe
  2⤵
  PID:13580
- C:\Windows\System\qWruaZb.exe
  C:\Windows\System\qWruaZb.exe
  2⤵
  PID:13600
- C:\Windows\System\EwVbiNQ.exe
  C:\Windows\System\EwVbiNQ.exe
  2⤵
  PID:13628
- C:\Windows\System\GxBNGgh.exe
  C:\Windows\System\GxBNGgh.exe
  2⤵
  PID:13664
- C:\Windows\System\gWUAuQR.exe
  C:\Windows\System\gWUAuQR.exe
  2⤵
  PID:13680
- C:\Windows\System\yFVEGdD.exe
  C:\Windows\System\yFVEGdD.exe
  2⤵
  PID:13712
- C:\Windows\System\VuPHadE.exe
  C:\Windows\System\VuPHadE.exe
  2⤵
  PID:13760
- C:\Windows\System\GgNRoTq.exe
  C:\Windows\System\GgNRoTq.exe
  2⤵
  PID:13788
- C:\Windows\System\RPLmiZa.exe
  C:\Windows\System\RPLmiZa.exe
  2⤵
  PID:13808
- C:\Windows\System\rxkCvUH.exe
  C:\Windows\System\rxkCvUH.exe
  2⤵
  PID:13832
- C:\Windows\System\IQqSaVg.exe
  C:\Windows\System\IQqSaVg.exe
  2⤵
  PID:13856
- C:\Windows\System\ZnhApDo.exe
  C:\Windows\System\ZnhApDo.exe
  2⤵
  PID:13888
- C:\Windows\System\moZtluL.exe
  C:\Windows\System\moZtluL.exe
  2⤵
  PID:13908
- C:\Windows\System\EHEqrXr.exe
  C:\Windows\System\EHEqrXr.exe
  2⤵
  PID:13936
- C:\Windows\System\zGzfrYK.exe
  C:\Windows\System\zGzfrYK.exe
  2⤵
  PID:13972
- C:\Windows\System\YdRrEhF.exe
  C:\Windows\System\YdRrEhF.exe
  2⤵
  PID:14000
- C:\Windows\System\gqWKaZR.exe
  C:\Windows\System\gqWKaZR.exe
  2⤵
  PID:14028
- C:\Windows\System\Bjexqpg.exe
  C:\Windows\System\Bjexqpg.exe
  2⤵
  PID:14056
- C:\Windows\System\QcMMOlW.exe
  C:\Windows\System\QcMMOlW.exe
  2⤵
  PID:14072
- C:\Windows\System\TjhoUNc.exe
  C:\Windows\System\TjhoUNc.exe
  2⤵
  PID:14108
- C:\Windows\System\QQsMjww.exe
  C:\Windows\System\QQsMjww.exe
  2⤵
  PID:14136
- C:\Windows\System\kBAjkFg.exe
  C:\Windows\System\kBAjkFg.exe
  2⤵
  PID:14160
- C:\Windows\System\YxBFndA.exe
  C:\Windows\System\YxBFndA.exe
  2⤵
  PID:14176
- C:\Windows\System\UcjSMxk.exe
  C:\Windows\System\UcjSMxk.exe
  2⤵
  PID:14240
- C:\Windows\System\nqqIUPA.exe
  C:\Windows\System\nqqIUPA.exe
  2⤵
  PID:14268
- C:\Windows\System\ryqluKO.exe
  C:\Windows\System\ryqluKO.exe
  2⤵
  PID:14296
- C:\Windows\System\qVlWnca.exe
  C:\Windows\System\qVlWnca.exe
  2⤵
  PID:14324
- C:\Windows\System\PSENptX.exe
  C:\Windows\System\PSENptX.exe
  2⤵
  PID:12596
- C:\Windows\System\HzFDnDS.exe
  C:\Windows\System\HzFDnDS.exe
  2⤵
  PID:13388
- C:\Windows\System\JxSlajw.exe
  C:\Windows\System\JxSlajw.exe
  2⤵
  PID:13400
- C:\Windows\System\rZXxAKj.exe
  C:\Windows\System\rZXxAKj.exe
  2⤵
  PID:13484
- C:\Windows\System\trxBScj.exe
  C:\Windows\System\trxBScj.exe
  2⤵
  PID:13524
- C:\Windows\System\jWuKtFx.exe
  C:\Windows\System\jWuKtFx.exe
  2⤵
  PID:13588
- C:\Windows\System\JhUVNYb.exe
  C:\Windows\System\JhUVNYb.exe
  2⤵
  PID:13672
- C:\Windows\System\YeMkOSQ.exe
  C:\Windows\System\YeMkOSQ.exe
  2⤵
  PID:13780
- C:\Windows\System\DvwErCi.exe
  C:\Windows\System\DvwErCi.exe
  2⤵
  PID:13816
- C:\Windows\System\miLxRiw.exe
  C:\Windows\System\miLxRiw.exe
  2⤵
  PID:13896
- C:\Windows\System\kSmKfZy.exe
  C:\Windows\System\kSmKfZy.exe
  2⤵
  PID:13944
- C:\Windows\System\rdXorMH.exe
  C:\Windows\System\rdXorMH.exe
  2⤵
  PID:13924
- C:\Windows\System\ZmdwkNH.exe
  C:\Windows\System\ZmdwkNH.exe
  2⤵
  PID:14020
- C:\Windows\System\TqHaHnE.exe
  C:\Windows\System\TqHaHnE.exe
  2⤵
  PID:14068
- C:\Windows\System\WwauqSu.exe
  C:\Windows\System\WwauqSu.exe
  2⤵
  PID:14188
- C:\Windows\System\yBZkdyz.exe
  C:\Windows\System\yBZkdyz.exe
  2⤵
  PID:14288
- C:\Windows\System\VQaJZYk.exe
  C:\Windows\System\VQaJZYk.exe
  2⤵
  PID:13336
- C:\Windows\System\pDMJUmy.exe
  C:\Windows\System\pDMJUmy.exe
  2⤵
  PID:13420
- C:\Windows\System\KPqVeXz.exe
  C:\Windows\System\KPqVeXz.exe
  2⤵
  PID:13656
- C:\Windows\System\uqMQqwH.exe
  C:\Windows\System\uqMQqwH.exe
  2⤵
  PID:13776
- C:\Windows\System\gwovzvy.exe
  C:\Windows\System\gwovzvy.exe
  2⤵
  PID:13928
- C:\Windows\System\eEFdJDq.exe
  C:\Windows\System\eEFdJDq.exe
  2⤵
  PID:14024
- C:\Windows\System\PKOgAyF.exe
  C:\Windows\System\PKOgAyF.exe
  2⤵
  PID:14144
- C:\Windows\System\mqDWDUM.exe
  C:\Windows\System\mqDWDUM.exe
  2⤵
  PID:12804
- C:\Windows\System\hcvciuT.exe
  C:\Windows\System\hcvciuT.exe
  2⤵
  PID:13548
- C:\Windows\System\uaQpWMF.exe
  C:\Windows\System\uaQpWMF.exe
  2⤵
  PID:13828
- C:\Windows\System\YsJaDeF.exe
  C:\Windows\System\YsJaDeF.exe
  2⤵
  PID:13380
- C:\Windows\System\GydSBug.exe
  C:\Windows\System\GydSBug.exe
  2⤵
  PID:14128
- C:\Windows\System\vIWqxpF.exe
  C:\Windows\System\vIWqxpF.exe
  2⤵
  PID:14364
- C:\Windows\System\dlrzFpp.exe
  C:\Windows\System\dlrzFpp.exe
  2⤵
  PID:14384
- C:\Windows\System\UiGrQIJ.exe
  C:\Windows\System\UiGrQIJ.exe
  2⤵
  PID:14416
- C:\Windows\System\ZuKiPUd.exe
  C:\Windows\System\ZuKiPUd.exe
  2⤵
  PID:14448
- C:\Windows\System\iXPksyz.exe
  C:\Windows\System\iXPksyz.exe
  2⤵
  PID:14488
- C:\Windows\System\MsFWMpp.exe
  C:\Windows\System\MsFWMpp.exe
  2⤵
  PID:14516
- C:\Windows\System\iWecFgY.exe
  C:\Windows\System\iWecFgY.exe
  2⤵
  PID:14544
- C:\Windows\System\WLRUbDq.exe
  C:\Windows\System\WLRUbDq.exe
  2⤵
  PID:14572
- C:\Windows\System\eHuQHWa.exe
  C:\Windows\System\eHuQHWa.exe
  2⤵
  PID:14592
- C:\Windows\System\bNhWKEc.exe
  C:\Windows\System\bNhWKEc.exe
  2⤵
  PID:14616
- C:\Windows\System\UvdDBvE.exe
  C:\Windows\System\UvdDBvE.exe
  2⤵
  PID:14632
- C:\Windows\System\JMHJjVk.exe
  C:\Windows\System\JMHJjVk.exe
  2⤵
  PID:14652
- C:\Windows\System\CBTCCIb.exe
  C:\Windows\System\CBTCCIb.exe
  2⤵
  PID:14676
- C:\Windows\System\gdKhETy.exe
  C:\Windows\System\gdKhETy.exe
  2⤵
  PID:14692
- C:\Windows\System\ttGQQOJ.exe
  C:\Windows\System\ttGQQOJ.exe
  2⤵
  PID:14720
- C:\Windows\System\jhJaULn.exe
  C:\Windows\System\jhJaULn.exe
  2⤵
  PID:14760
- C:\Windows\System\FtPCqjZ.exe
  C:\Windows\System\FtPCqjZ.exe
  2⤵
  PID:14788
- C:\Windows\System\ScjWSjr.exe
  C:\Windows\System\ScjWSjr.exe
  2⤵
  PID:14808
- C:\Windows\System\AMToBvo.exe
  C:\Windows\System\AMToBvo.exe
  2⤵
  PID:14828
- C:\Windows\System\OyoUfSb.exe
  C:\Windows\System\OyoUfSb.exe
  2⤵
  PID:14860
- C:\Windows\System\XHIbstx.exe
  C:\Windows\System\XHIbstx.exe
  2⤵
  PID:14892
- C:\Windows\System\OMViXNw.exe
  C:\Windows\System\OMViXNw.exe
  2⤵
  PID:14968
- C:\Windows\System\GjezXrh.exe
  C:\Windows\System\GjezXrh.exe
  2⤵
  PID:14996
- C:\Windows\System\HyoCTnH.exe
  C:\Windows\System\HyoCTnH.exe
  2⤵
  PID:15016
- C:\Windows\System\qqxSBdX.exe
  C:\Windows\System\qqxSBdX.exe
  2⤵
  PID:15040
- C:\Windows\System\rcDALzl.exe
  C:\Windows\System\rcDALzl.exe
  2⤵
  PID:15072
- C:\Windows\System\XYcIudJ.exe
  C:\Windows\System\XYcIudJ.exe
  2⤵
  PID:15104
- C:\Windows\System\mEjYYPI.exe
  C:\Windows\System\mEjYYPI.exe
  2⤵
  PID:15136
- C:\Windows\System\tdglHtI.exe
  C:\Windows\System\tdglHtI.exe
  2⤵
  PID:15164
- C:\Windows\System\zyJfocs.exe
  C:\Windows\System\zyJfocs.exe
  2⤵
  PID:15180
- C:\Windows\System\KafWVSI.exe
  C:\Windows\System\KafWVSI.exe
  2⤵
  PID:15220
- C:\Windows\System\MzhVIdg.exe
  C:\Windows\System\MzhVIdg.exe
  2⤵
  PID:15248
- C:\Windows\System\DTsTPZG.exe
  C:\Windows\System\DTsTPZG.exe
  2⤵
  PID:15276
- C:\Windows\System\wsJocxY.exe
  C:\Windows\System\wsJocxY.exe
  2⤵
  PID:15292
- C:\Windows\System\zpPxMfl.exe
  C:\Windows\System\zpPxMfl.exe
  2⤵
  PID:15320
- C:\Windows\System\eRxTDZb.exe
  C:\Windows\System\eRxTDZb.exe
  2⤵
  PID:13968
- C:\Windows\System\FJlSnJr.exe
  C:\Windows\System\FJlSnJr.exe
  2⤵
  PID:14392
- C:\Windows\System\xZOdznw.exe
  C:\Windows\System\xZOdznw.exe
  2⤵
  PID:14408
- C:\Windows\System\oxRoQxH.exe
  C:\Windows\System\oxRoQxH.exe
  2⤵
  PID:14468
- C:\Windows\System\fKEXMoX.exe
  C:\Windows\System\fKEXMoX.exe
  2⤵
  PID:14536
- C:\Windows\System\oXwRJlS.exe
  C:\Windows\System\oXwRJlS.exe
  2⤵
  PID:14568
- C:\Windows\System\kYhPlSY.exe
  C:\Windows\System\kYhPlSY.exe
  2⤵
  PID:14624
- C:\Windows\System\txbQjlh.exe
  C:\Windows\System\txbQjlh.exe
  2⤵
  PID:14736
- C:\Windows\System\eQiIIME.exe
  C:\Windows\System\eQiIIME.exe
  2⤵
  PID:14868
- C:\Windows\System\RdbIWlZ.exe
  C:\Windows\System\RdbIWlZ.exe
  2⤵
  PID:14884
- C:\Windows\System\WdoovuE.exe
  C:\Windows\System\WdoovuE.exe
  2⤵
  PID:14852
- C:\Windows\System\KJRqFfX.exe
  C:\Windows\System\KJRqFfX.exe
  2⤵
  PID:14992
- C:\Windows\System\FwEcyIE.exe
  C:\Windows\System\FwEcyIE.exe
  2⤵
  PID:15088
- C:\Windows\System\RdHXMkZ.exe
  C:\Windows\System\RdHXMkZ.exe
  2⤵
  PID:15120
- C:\Windows\System\tJyzxoi.exe
  C:\Windows\System\tJyzxoi.exe
  2⤵
  PID:15244
- C:\Windows\System\bQbplDZ.exe
  C:\Windows\System\bQbplDZ.exe
  2⤵
  PID:15304
- C:\Windows\System\XPMSSAA.exe
  C:\Windows\System\XPMSSAA.exe
  2⤵
  PID:15356
- C:\Windows\System\zMDGJYY.exe
  C:\Windows\System\zMDGJYY.exe
  2⤵
  PID:14428
- C:\Windows\System\ntQRJdx.exe
  C:\Windows\System\ntQRJdx.exe
  2⤵
  PID:14512
- C:\Windows\System\cIYIHhZ.exe
  C:\Windows\System\cIYIHhZ.exe
  2⤵
  PID:14668
- C:\Windows\System\IVCmVDt.exe
  C:\Windows\System\IVCmVDt.exe
  2⤵
  PID:14712
- C:\Windows\System\wuKysnQ.exe
  C:\Windows\System\wuKysnQ.exe
  2⤵
  PID:14908
- C:\Windows\System\rKAnJGU.exe
  C:\Windows\System\rKAnJGU.exe
  2⤵
  PID:14988
- C:\Windows\System\eyUmLCX.exe
  C:\Windows\System\eyUmLCX.exe
  2⤵
  PID:15268
- C:\Windows\System\NXhQXES.exe
  C:\Windows\System\NXhQXES.exe
  2⤵
  PID:14380
- C:\Windows\System\tobgnaY.exe
  C:\Windows\System\tobgnaY.exe
  2⤵
  PID:2660
- C:\Windows\System\WUbBIOE.exe
  C:\Windows\System\WUbBIOE.exe
  2⤵
  PID:14964
- C:\Windows\System\KIFYUbw.exe
  C:\Windows\System\KIFYUbw.exe
  2⤵
  PID:15172
- C:\Windows\System\bZAbwAo.exe
  C:\Windows\System\bZAbwAo.exe
  2⤵
  PID:14780
- C:\Windows\System\zoaxRDX.exe
  C:\Windows\System\zoaxRDX.exe
  2⤵
  PID:15112
- C:\Windows\System\qBZoqla.exe
  C:\Windows\System\qBZoqla.exe
  2⤵
  PID:15384
- C:\Windows\System\YeJITHP.exe
  C:\Windows\System\YeJITHP.exe
  2⤵
  PID:15412
- C:\Windows\System\IxTLCto.exe
  C:\Windows\System\IxTLCto.exe
  2⤵
  PID:15456
- C:\Windows\System\nSSqHgq.exe
  C:\Windows\System\nSSqHgq.exe
  2⤵
  PID:15492
- C:\Windows\System\oQvofFh.exe
  C:\Windows\System\oQvofFh.exe
  2⤵
  PID:15520
- C:\Windows\System\aLYVsoH.exe
  C:\Windows\System\aLYVsoH.exe
  2⤵
  PID:15540
- C:\Windows\System\oiCJjxw.exe
  C:\Windows\System\oiCJjxw.exe
  2⤵
  PID:15556
- C:\Windows\System\DPbIdzb.exe
  C:\Windows\System\DPbIdzb.exe
  2⤵
  PID:15588
- C:\Windows\System\yPZzump.exe
  C:\Windows\System\yPZzump.exe
  2⤵
  PID:15608
- C:\Windows\System\yZQyeDc.exe
  C:\Windows\System\yZQyeDc.exe
  2⤵
  PID:15636
- C:\Windows\System\cDUHTJN.exe
  C:\Windows\System\cDUHTJN.exe
  2⤵
  PID:15680
- C:\Windows\System\xuudvqc.exe
  C:\Windows\System\xuudvqc.exe
  2⤵
  PID:15700
- C:\Windows\System\glNVvBS.exe
  C:\Windows\System\glNVvBS.exe
  2⤵
  PID:15740
- C:\Windows\System\nwSwiQM.exe
  C:\Windows\System\nwSwiQM.exe
  2⤵
  PID:15760
- C:\Windows\System\YxrrPhf.exe
  C:\Windows\System\YxrrPhf.exe
  2⤵
  PID:15788
- C:\Windows\System\XpgbVoY.exe
  C:\Windows\System\XpgbVoY.exe
  2⤵
  PID:15812
- C:\Windows\System\VomqZWJ.exe
  C:\Windows\System\VomqZWJ.exe
  2⤵
  PID:15836
- C:\Windows\System\VtbEetD.exe
  C:\Windows\System\VtbEetD.exe
  2⤵
  PID:15868
- C:\Windows\System\RoZeooK.exe
  C:\Windows\System\RoZeooK.exe
  2⤵
  PID:15920
- C:\Windows\System\ZvDJRXB.exe
  C:\Windows\System\ZvDJRXB.exe
  2⤵
  PID:15940
- C:\Windows\System\qdpCqLM.exe
  C:\Windows\System\qdpCqLM.exe
  2⤵
  PID:15964
- C:\Windows\System\warcCwD.exe
  C:\Windows\System\warcCwD.exe
  2⤵
  PID:16004
- C:\Windows\System\DwXAlxC.exe
  C:\Windows\System\DwXAlxC.exe
  2⤵
  PID:16020
- C:\Windows\System\ePohiuL.exe
  C:\Windows\System\ePohiuL.exe
  2⤵
  PID:16048
- C:\Windows\System\ChnSzGi.exe
  C:\Windows\System\ChnSzGi.exe
  2⤵
  PID:16076
- C:\Windows\System\taSKzVE.exe
  C:\Windows\System\taSKzVE.exe
  2⤵
  PID:16096
- C:\Windows\System\vfogmJS.exe
  C:\Windows\System\vfogmJS.exe
  2⤵
  PID:16132
- C:\Windows\System\XkEUvNz.exe
  C:\Windows\System\XkEUvNz.exe
  2⤵
  PID:16156
- C:\Windows\System\SdyIDAW.exe
  C:\Windows\System\SdyIDAW.exe
  2⤵
  PID:16176
- C:\Windows\System\SmoJBTB.exe
  C:\Windows\System\SmoJBTB.exe
  2⤵
  PID:16200
- C:\Windows\System\lzlsnxI.exe
  C:\Windows\System\lzlsnxI.exe
  2⤵
  PID:16220
- C:\Windows\System\fFfFBek.exe
  C:\Windows\System\fFfFBek.exe
  2⤵
  PID:16272
- C:\Windows\System\yyiQzhC.exe
  C:\Windows\System\yyiQzhC.exe
  2⤵
  PID:16296
- C:\Windows\System\XJFjcjm.exe
  C:\Windows\System\XJFjcjm.exe
  2⤵
  PID:16316
- C:\Windows\System\AzcUGCt.exe
  C:\Windows\System\AzcUGCt.exe
  2⤵
  PID:16336
- C:\Windows\System\mtmpPhh.exe
  C:\Windows\System\mtmpPhh.exe
  2⤵
  PID:16364
- C:\Windows\System\jADVtyF.exe
  C:\Windows\System\jADVtyF.exe
  2⤵
  PID:15404
- C:\Windows\System\QDzuVRG.exe
  C:\Windows\System\QDzuVRG.exe
  2⤵
  PID:15472
- C:\Windows\System\rjRrTdV.exe
  C:\Windows\System\rjRrTdV.exe
  2⤵
  PID:15512
- C:\Windows\System\ADzluLl.exe
  C:\Windows\System\ADzluLl.exe
  2⤵
  PID:15572
- C:\Windows\System\eyaAMlz.exe
  C:\Windows\System\eyaAMlz.exe
  2⤵
  PID:15632
- C:\Windows\System\YKuSzdH.exe
  C:\Windows\System\YKuSzdH.exe
  2⤵
  PID:15664
- C:\Windows\System\CVawSze.exe
  C:\Windows\System\CVawSze.exe
  2⤵
  PID:15796
- C:\Windows\System\GQWpuXg.exe
  C:\Windows\System\GQWpuXg.exe
  2⤵
  PID:15860
- C:\Windows\System\GNVcTOE.exe
  C:\Windows\System\GNVcTOE.exe
  2⤵
  PID:15896
- C:\Windows\System\rAmyWuM.exe
  C:\Windows\System\rAmyWuM.exe
  2⤵
  PID:15976
- C:\Windows\System\qRIqPPw.exe
  C:\Windows\System\qRIqPPw.exe
  2⤵
  PID:16064
- C:\Windows\System\HfXCwXx.exe
  C:\Windows\System\HfXCwXx.exe
  2⤵
  PID:16112
- C:\Windows\System\RaZluJg.exe
  C:\Windows\System\RaZluJg.exe
  2⤵
  PID:16152
- C:\Windows\System\oCZWXHT.exe
  C:\Windows\System\oCZWXHT.exe
  2⤵
  PID:16212
- C:\Windows\System\FpjIfjt.exe
  C:\Windows\System\FpjIfjt.exe
  2⤵
  PID:16240
- C:\Windows\System\VZkdPzM.exe
  C:\Windows\System\VZkdPzM.exe
  2⤵
  PID:16344
- C:\Windows\System\hQgUDbB.exe
  C:\Windows\System\hQgUDbB.exe
  2⤵
  PID:15400
- C:\Windows\System\wRQHhFY.exe
  C:\Windows\System\wRQHhFY.exe
  2⤵
  PID:15604
- C:\Windows\System\ZZJvqxp.exe
  C:\Windows\System\ZZJvqxp.exe
  2⤵
  PID:15732
- C:\Windows\System\HWSVEgB.exe
  C:\Windows\System\HWSVEgB.exe
  2⤵
  PID:15828
- C:\Windows\System\GawBNKA.exe
  C:\Windows\System\GawBNKA.exe
  2⤵
  PID:16092
- C:\Windows\System\qzyvrdc.exe
  C:\Windows\System\qzyvrdc.exe
  2⤵
  PID:16124
- C:\Windows\System\nIVGbCg.exe
  C:\Windows\System\nIVGbCg.exe
  2⤵
  PID:15548
- C:\Windows\System\omISSFE.exe
  C:\Windows\System\omISSFE.exe
  2⤵
  PID:15912
- C:\Windows\System\FECMkjm.exe
  C:\Windows\System\FECMkjm.exe
  2⤵
  PID:15552
- C:\Windows\System\UkQXMpz.exe
  C:\Windows\System\UkQXMpz.exe
  2⤵
  PID:16172
- C:\Windows\System\flKzLRb.exe
  C:\Windows\System\flKzLRb.exe
  2⤵
  PID:15392
- C:\Windows\System\gkZRtHZ.exe
  C:\Windows\System\gkZRtHZ.exe
  2⤵
  PID:16412
- C:\Windows\System\RQmqvHb.exe
  C:\Windows\System\RQmqvHb.exe
  2⤵
  PID:16440
- C:\Windows\System\wuVLvcA.exe
  C:\Windows\System\wuVLvcA.exe
  2⤵
  PID:16456
- C:\Windows\System\sPPEyYk.exe
  C:\Windows\System\sPPEyYk.exe
  2⤵
  PID:16496
- C:\Windows\System\AXCqIFQ.exe
  C:\Windows\System\AXCqIFQ.exe
  2⤵
  PID:16524
- C:\Windows\System\PyEXsbj.exe
  C:\Windows\System\PyEXsbj.exe
  2⤵
  PID:16544
- C:\Windows\System\nXtdvaq.exe
  C:\Windows\System\nXtdvaq.exe
  2⤵
  PID:16568
- C:\Windows\System\OSQIIuP.exe
  C:\Windows\System\OSQIIuP.exe
  2⤵
  PID:16608
- C:\Windows\System\KmDwSWh.exe
  C:\Windows\System\KmDwSWh.exe
  2⤵
  PID:16628
- C:\Windows\System\PRMMJNi.exe
  C:\Windows\System\PRMMJNi.exe
  2⤵
  PID:16652
- C:\Windows\System\jgYrdXW.exe
  C:\Windows\System\jgYrdXW.exe
  2⤵
  PID:16668
- C:\Windows\System\RFfqqzb.exe
  C:\Windows\System\RFfqqzb.exe
  2⤵
  PID:16720
- C:\Windows\System\sMipeMY.exe
  C:\Windows\System\sMipeMY.exe
  2⤵
  PID:16736
- C:\Windows\System\MaEbkCZ.exe
  C:\Windows\System\MaEbkCZ.exe
  2⤵
  PID:16756
- C:\Windows\System\qihsrLD.exe
  C:\Windows\System\qihsrLD.exe
  2⤵
  PID:16796
- C:\Windows\System\iKeSwev.exe
  C:\Windows\System\iKeSwev.exe
  2⤵
  PID:16820
- C:\Windows\System\VpvIKeg.exe
  C:\Windows\System\VpvIKeg.exe
  2⤵
  PID:16860
- C:\Windows\System\pbbOISs.exe
  C:\Windows\System\pbbOISs.exe
  2⤵
  PID:16884
- C:\Windows\System\qTXvgnI.exe
  C:\Windows\System\qTXvgnI.exe
  2⤵
  PID:16908
- C:\Windows\System\bVxYIQi.exe
  C:\Windows\System\bVxYIQi.exe
  2⤵
  PID:16936
- C:\Windows\System\LpHZPMo.exe
  C:\Windows\System\LpHZPMo.exe
  2⤵
  PID:16960
- C:\Windows\System\KPKEPlm.exe
  C:\Windows\System\KPKEPlm.exe
  2⤵
  PID:16988
- C:\Windows\System\hcfgOGC.exe
  C:\Windows\System\hcfgOGC.exe
  2⤵
  PID:17016
- C:\Windows\System\uuaXJfD.exe
  C:\Windows\System\uuaXJfD.exe
  2⤵
  PID:17040

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17296

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AGeOczA.exe

Filesize
1.6MB

MD5
aa1b877d5d44aef461d0ea17feedbcce

SHA1
e5909550fe1b7d6e536428a8720f4d1aab47ac0b

SHA256
012138a52499619527cec80d84bfa776f11f7b12d21350d3b9b62526f31cf1d5

SHA512
c2b3471d3da73d62f6e29565175a687d4b09ddc58df0be80070ea08644a63bdac2a5ab9a9fcfbf3cc4c5af01169997da3e78f97f85137a7b57860072a5473972

Download Submit
C:\Windows\System\CUhapmQ.exe

Filesize
1.6MB

MD5
7371aed406cae1a35696e3a8b7d8bc86

SHA1
dae75b6024bc4a7b8d96f9d8170d2264b6b43f23

SHA256
311cd3c1f16795b4e05d5384e300ecde6e052e7e8d96580561283ef0a4cf8167

SHA512
0999a03656735652391cc07bae3c36ef7acfff485a74b64c84c19e66074774110ff990f4964c9083f1a510a07ab28d51fbd2384b0af23c680cc93af46dd2d4e9

Download Submit
C:\Windows\System\GYXEDzT.exe

Filesize
1.6MB

MD5
423dbc97ad917867d988fa949fcf17de

SHA1
c477af6ae8ac7c6945474ca215c7023f8607cfca

SHA256
63360a304a88a30eca13d52c8bc11bef0cdf8eceb99b0a23acaef00f46410adb

SHA512
9f2c5b89d5a66c0056240719a2e88d35b98fda646f9522809a6d831c86eb719ed374f04b9d1f9060430f005bd4e11c3953f976f05026019cf30db2f1831e7282

Download Submit
C:\Windows\System\LlTOrLD.exe

Filesize
1.6MB

MD5
6956b7775ea8d972ee368d8ab0b7a7f2

SHA1
48d8e321998836889433faf334f0299befa8bd86

SHA256
7df26e698417e819c26ba6efe60eb79f88f86b178b8491f57c8307e42203f220

SHA512
6098f136f821a9f154a44a06dffa8e55cc39de292c6aad8011ea3caae854f7249d60acae72aed82ca0b1420da79aacf7c4a863fe8c00f79242a1e3703c018516

Download Submit
C:\Windows\System\NbFINKL.exe

Filesize
1.6MB

MD5
8945156b32ecb454f4b2d346dce9f2db

SHA1
43ad04d37bf3e5ab1f2c9a0ec00efd3d0552381b

SHA256
b2201cef9532169ff72f24cc01a23d52690d36d4e32e648255bc9de9f7f6276c

SHA512
439dde30faecde0fafa62a01db379ff533e687d64f28becca2998b4516a1747fec200837f475af7cd471e2e998f1789c48dfa39402ccd413dbb210e63f24e180

Download Submit
C:\Windows\System\OBdnNcv.exe

Filesize
1.6MB

MD5
bd7718bd649703e9521490e5b1406d12

SHA1
616c2dd7a867348acd27d90958cf1f127e505100

SHA256
97c8b423e57ca12abc6a1f029c8cefc6198d50b271bd073d20f5bbabc6d7683f

SHA512
427fd5f7b8c4cf8698f1121649d95bdfb6a7929323368ee331572a9e0f2693fe06fa10663129c011bfd9cbd28dccdce20eb329acaaa1dee2e1535aa935822421

Download Submit
C:\Windows\System\PVymTtT.exe

Filesize
1.6MB

MD5
29c26b6147e443d732588aefe27cb855

SHA1
ac2649b15b2116319ad1ffdf076b35799b59a519

SHA256
11bd368e24cc39954454932ca2c1797516981b8ae1946474ba519fab70a7cae2

SHA512
39e69db9f24f03857ef6512642f9d0f22883070f52e1e8dee2fd25ebdd983ea24c9d9373ce65e510942717f816fbc1036e66510acd1f0815ab84c63653a5477c

Download Submit
C:\Windows\System\SNwiFVA.exe

Filesize
1.6MB

MD5
c0a9c6af8cd88974da9e8ab8e01ec75c

SHA1
743c87e68f2e3c4ca47cec1cf0de0ea61fc7a3e3

SHA256
9b1778f7c4adf32d5f77b0cbdb7b99c818f5eefedd146a7fb31d357589afb227

SHA512
9b96a4bd233cd29506ccaeba79890faeeb57c1f933dc3662d9704752293f29ab2f69e3059c53628d8fd087a7b3e0175402a06c51cf1fa80edc37c06b174c6594

Download Submit
C:\Windows\System\SmWazMn.exe

Filesize
1.6MB

MD5
5b0161bb851f5f8fbccaa2ea3079fd19

SHA1
8b96bd562cf163e766cdd236a23608d85d37409c

SHA256
427d4b076c757c5ed2a368ca83f47c3d36fd7b2c5e4bd529baca5bf8e5d6fe8a

SHA512
6156872ae4bd7ca64c153705036df23760ce6b22618f7f8aff312f9b73f3d0c534e3cfd9bd6a5c424108e436adb4dbe89be60cf10533cfbe3deb58758a6f76e8

Download Submit
C:\Windows\System\TDLHbrs.exe

Filesize
1.6MB

MD5
d8859c2320adf9013d0bbff910ab47db

SHA1
635b830d0a75d418db54e2b0cb277ab0a85b0d7a

SHA256
ac5a6335ade4aeaaa55a3804e183e9ade006f435107ed7733b79cdc876a9927e

SHA512
24d6acca9f5537720d8ec8cf5310dd8cf7e30e6f0a13c5ab0f5127295d9d7daf08527928f921432e9496eecd03211c07472bc537fd1284585c2558940aca82eb

Download Submit
C:\Windows\System\WaueYQi.exe

Filesize
1.6MB

MD5
019e656a7d2fb0bc7ef1a3019228170f

SHA1
673afbdf2a6aac58dfbf1b6bfd8c55344aee118d

SHA256
a2e077655a91e18bb9b259790a4e1fd120899c52d1bf702bbc2b7d1bbe72ab74

SHA512
f9805ffec99261bac8053ea2f987bb9b0457a85793225b3ee3c4f572412795ed75d2edcea0a70a4e8c681c53ad8bdd7006a664cb75200b110a426055ab5e606f

Download Submit
C:\Windows\System\XBmfYyL.exe

Filesize
1.6MB

MD5
125c038efaf8b52d049737c87ec13de7

SHA1
7e81639aaa1f2f490a7431b4fb596a52aff1bcc4

SHA256
90700e7e6cf9f22b39aa59aa8b4b97b5f94b6d1330015460d27bc1d9b2daea26

SHA512
7729f024d3d0945661c979929e2ad770a5112061359222349d09e2ac894386ae5c82c8fbcac4f0449f84586ab648cc022b0320304fe1ccc6968374618f3ce691

Download Submit
C:\Windows\System\YHrqCPM.exe

Filesize
1.6MB

MD5
2c0d2803318fec3be8e9b6fd8f33bc61

SHA1
56c5bed19e2b1ffc3021f00964c8f9c918e1856e

SHA256
83bd59c3489fec67f11da65e02c6efff23cc74b42159d7039336c7421eb914ed

SHA512
45a01eaf8188645a8a90dd6dfb5c9e4c941725aa4b95889c649acb2c604fba2fb133970a3824349b553f409b0b06cb2befcffd25515a1811a02b6c6051e3de9c

Download Submit
C:\Windows\System\ZqwRlef.exe

Filesize
1.6MB

MD5
2892638dd2344f5445b71cd13e85bcae

SHA1
5d584c23516991faecd18253a04858db2f6de6a4

SHA256
b9e3e83eaf14fc9b7efc65e19f5d56388e06229e33be35355373f6c1ab1b5157

SHA512
4ed69a29f03c893d83e3611a826042fc1c19494430f79a8361c9c166f10879e78a0594bd90234e2c176a44eb06faab274544f1c5aef4e46922c551565fe8a238

Download Submit
C:\Windows\System\cTvABrh.exe

Filesize
1.6MB

MD5
b5ec87e3c5085ca665f816a2a8cbc184

SHA1
627dc81dabef58323ac0be48cd51236372f921a7

SHA256
592f80cb891dee4a122b7faf9bff82b334a3bfeff5c3a65cbaf8ea160c1e9d63

SHA512
46566a40873211488b1d521e6b9c5145de224ef1090f758145fd1b092db592726956c00ab5513ecb5bc6a25ff3967670e086598b5cff51b3a4a77843208a7512

Download Submit
C:\Windows\System\ciugIqL.exe

Filesize
1.6MB

MD5
706e39c06e5b7b2eecd7e19e90cea3ae

SHA1
63ecbf4630c3eb78059ff4a7926906b1d2c69656

SHA256
f5ddba13eab5560e726f5f578358b53575913f5f1fb4d4f1bd83f96bcf3244b4

SHA512
e243e0f64738bd3d1364292b9b8077253b13764134a7a3dd22a24d728ffea5f284d4f102b958e6239cf8f916023a2d66478b4c993a99b85b1e13e4ceb1e9b873

Download Submit
C:\Windows\System\dsgGqoy.exe

Filesize
1.6MB

MD5
3931ff78fe393d3d8020300a02ed5cdc

SHA1
10ceff4fd16c79a75621315a4180cda236288be4

SHA256
4d8f80d03133104b514d6998fa9a4ee49a7d793708ed5feb3912f0567950f6f7

SHA512
ac6013b42a66523c426eab08d62b62418e2f8f2c58cf13411c93a70ad4b35e9312ab6b64170dc93e63b0ca9dc2ad1bafb6f2aae5a670787a1132a0844683e4d2

Download Submit
C:\Windows\System\fjOLffy.exe

Filesize
1.6MB

MD5
1cfc788c25d9f8339ff2b2a52e4d4f2e

SHA1
b4647e330b37826a117aa2da0e3f92305b91710c

SHA256
2ac80155af53ccc7fd405f92924bac2931a435d740697c77068d0feec805ed82

SHA512
a402ce102a2ba25b41ea002776e597bf103a991ea0c4eb28b1f8e8017b265142c16029b64a9492285d65ed163a5c19ad97ebb4d46ec2f2088d39fd71f1f0ec0a

Download Submit
C:\Windows\System\gNIElRh.exe

Filesize
1.6MB

MD5
1bde35e69e142ad0f422dddb72920ec9

SHA1
3100e7f98ee3cbe2dae8a92b88eb57845fa01667

SHA256
58b0ec75c5bcba813a32efe7ffa12a02dba838b57fd101c12953ff391c249506

SHA512
766f7a6bf8bcecca2374fca40342c4c97da9eebe3a3262f054805d16d7c39c37cabb9c6956133eb117508f8b4b7fd0fffdde55f67614bdfe23bbd2bfd2affdea

Download Submit
C:\Windows\System\jYHGQfe.exe

Filesize
1.6MB

MD5
9283832f0bb6af90f3723dd4e64d5498

SHA1
8e806c878ec12e2641b33eec45304f78a2c9cd03

SHA256
4528b679be4e64c353c0413727ec8e7423ba4ab61d71deab478a55c4205282ce

SHA512
e88fc61cd1715c7aa5f4e1729411e18af241c2617529ea5ad1681e4e13fc955889e55a7726fa3988055e8b8e8b1d51a4655f704d84e147f14b35ab7e851d487a

Download Submit
C:\Windows\System\kLuKJax.exe

Filesize
1.6MB

MD5
890d1b1c5b0a91fc4bd1eb236aa9de50

SHA1
92cfcd5366e17ec8d68ed501f1b25a7654d79b03

SHA256
bbf0cc979d19015c2e7416d7af7ff64589373d139a72cede1b254be10a5ef17f

SHA512
e7f23dd2b7b0535389d85853f2bf8661a1391c1d27a28db3eea092b8c76ddaeeff8ef6b1a813e3920d841c20c9eaa67246465703186dcb904dacdcda1f48e515

Download Submit
C:\Windows\System\kmbDOfg.exe

Filesize
1.6MB

MD5
422434c7b4ad371cfaf7b3296a02b97f

SHA1
e1580440aa51abdcb9d65a63d5142a76de7d5afa

SHA256
961023cff078a61dee221619e982800892904af20ea7b010fe867393ac7d82dd

SHA512
a1df4642c9fa634911b8858b98d06e33d18ec4f888daea420de0b022c268326bea3780f82facfc1ba94867a464ab5500830e0349fe4c5381e4bd8d88fd8297ef

Download Submit
C:\Windows\System\krLPygy.exe

Filesize
1.6MB

MD5
7abb2b784462f1eb3e9c5db3d96ca5f3

SHA1
00fb0296fdba6d59d0a96d93f7c7bdbdc79b8ae8

SHA256
1388babf68232f7cfb15f18b3a556b9ba43e835816fae34b7160350640dbb372

SHA512
6514fab1f4e77e46f13e93cf68ba70580121cc9da9c67a752451f0bd526997af1f2d9d0a71d010ee4c5170d1dcfd0d03bdac00f8261128812218caadde440e74

Download Submit
C:\Windows\System\lnTkAXB.exe

Filesize
1.6MB

MD5
9e60523726d17210540dbc0ecc869d1c

SHA1
7b49ba9135611888ba9a4cbd8f445543552bf179

SHA256
a4beb5c95adb59d336e4d6784a7ab792eee48151bf833deae10c4db2b05df330

SHA512
05df366a877deaa009d6be05781ccc677e4c7bcc84cc2681ed15c208e90fdc23ab8dfe1d43355e9cb089d87c0834e0622b43f0e7b531809afeb0401b95b66b83

Download Submit
C:\Windows\System\oSxKoCj.exe

Filesize
1.6MB

MD5
24f8af947a55460c4ac3be6a0c02a3f7

SHA1
67624af01473c1f6503c55086d9b1731314e04f2

SHA256
52d40d995029cdb0b4620e5911db69d8bdcacf87ea2bb551a787c265bd03cb21

SHA512
cac4e114e9c400692739919280b9cd73712ea956bd13ebe1c06031242f15d78135e36feb4fa5f5e44c1c3608ff54785d81252064fa7f71874703332b90271588

Download Submit
C:\Windows\System\oUeEmkk.exe

Filesize
1.6MB

MD5
e22b691ea908072b00c458f8b217c1e4

SHA1
bb1e99bb15b5de43c95366f7af10771287a1ffba

SHA256
0a70c8d60862a62720b498b047a5277256692136a3abbbea4818c3ca268ed4b6

SHA512
2db105d8181dbba2c2a35ac94e0e3fee47ce7d01c479dc3dd9b09fdc643b58e9d7a28ea45f6f358b58bc32eb4169f74762f636bf8991b0845129beae8e89b430

Download Submit
C:\Windows\System\qzhwTpX.exe

Filesize
1.6MB

MD5
386d0d9e64b97676383b5d1da67d5c51

SHA1
b10c2f59e984af6f01017ec77b28330b84b6dbba

SHA256
a553c3b6191058cc05f16ad9ece0284650007a6f93c9a5dfeab8052ba1745de8

SHA512
79dab071faba15ce2d56aee8ac5d6d6784942941924ecdc6203ca453050cc1e30c9cde23f2033a37dfba643a871ef077e276dc75970fc34545dd0a547547e388

Download Submit
C:\Windows\System\rHvVvJB.exe

Filesize
1.6MB

MD5
a89c78bbc2d7c493a97790dea780954b

SHA1
3b939b860a4a185fff4b4e8c45a34bd0c8afadac

SHA256
15c71d5c93c0152761ce6cc30e7e5ee84d814f1aeee10c7c9f575e64cec99b81

SHA512
469bbaec7a7ec999c027afaa8090f02413b00dd6f32b38c2fa64a1c79fd592a4cc99374fcf98bcd0989b5323e9bccfdabf81024ddfcaea0dd1474158f209d6ca

Download Submit
C:\Windows\System\rjfXGcr.exe

Filesize
1.6MB

MD5
dbf791e60c3a71df904ac53ef60516d0

SHA1
71bfd1f6cfa29ae4e741610c7d4f60aea46bad01

SHA256
b29d33dfa2ef892fd4ff3ff7145bc8233ef53dcffd80be1efe1078865c74fa8f

SHA512
7b7d61b12aa7b5e5fa182164b004374d1d4e78580bbc6d8fa78efb324fa5c83799d6ad8a7fa75fde8bebf25dbb29d5bd5c48b5b0a98b337b3c087de72b659366

Download Submit
C:\Windows\System\sKHAKBI.exe

Filesize
1.6MB

MD5
23071e0b865d7ff2ffb8007fb1271082

SHA1
392f9615dc079846ba1223e27610b50ae0e42fad

SHA256
c431eac25d8ed508891976914936fd7d7a588adffe3cce0bf50dbca49ad5b95a

SHA512
88b49b130116a50d38583de5a6eb3524663c76b03c27e384bb0b7b8fcd377919b269ff67d34ce7aa5d5e1def803a0cb2660769b01040ed68ec7312fa914777d7

Download Submit
C:\Windows\System\spsCWCB.exe

Filesize
1.6MB

MD5
bae93a7efe276354856ef133116dc3ba

SHA1
90f5d4b8c1dae4291b4ae1dee4db26674e64e4df

SHA256
a2cbe512e7d6a100691ce9511cb10589c45e63750eb24e7641fa92a084f0e1a4

SHA512
4ffb7e6fdf84c6285715c6484a665692fe990620e2a51d839b8769e014e28af2205ccee8303e52791a2210307992b2fc00f79d6d97be7e1265fa00b79a24ae79

Download Submit
C:\Windows\System\vRJmXjv.exe

Filesize
1.6MB

MD5
ee50785d809297dcbfab9f1e6074af53

SHA1
eb3e664a6e491b8fd0ae1e0d3723edc31ff0db55

SHA256
6bc3a7f55ef9763293e88d1dc020bb8657b870ada4a1f5b2f501acd0d557dddf

SHA512
a82c395ce58da98978b0f3f75e0608fa507445406058d21ed29265deeb6b21135e2fd107741988c93f83c6710820fdc01881259ff78cae4d1f5fbe34250bd7d2

Download Submit
C:\Windows\System\ywwquoc.exe

Filesize
1.6MB

MD5
c063d6571127c5e41c01383607ddc0e2

SHA1
6a24aedb91471017ad59682d0ad4372831e2ac21

SHA256
d02fd50bba5971ede5ce3c02e726ab38d4cc552020d37665d4c2acd0b59df8e6

SHA512
c1a3c73d0c76585964ebc25f125a7a6784032610fee2f01d8a7f2a59a35c39fb6086f63605697743e4ed86fb46bd72272f1e942f73c5cd52140e713736f75a73

Download Submit
memory/1476-0-0x00000279C2B00000-0x00000279C2B10000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads