xmrig | 7e03188111f95eed98c3ccc38232bd44573aa84897a183f476f49dd82008c7bd

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be7712b6ad67434f11f1907acf5c84c0N.exe
Size

916KB
MD5

be7712b6ad67434f11f1907acf5c84c0
SHA1

6dde3ba132777829eaf9daa918cb57fc47aaa063
SHA256

7e03188111f95eed98c3ccc38232bd44573aa84897a183f476f49dd82008c7bd
SHA512

50eef59b60043eaaaf8aa345108545a91e72745998fe0dcb4026736f416261587d8c2a503d6d3f29e4c4d31332318adf138fbdd5c198c564a271d4555ee26fd2
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMzjkE4OpYOjh23:Lz071uv4BPMzsOpS3

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/3368-46-0x00007FF764BD0000-0x00007FF764FC2000-memory.dmp	xmrig
behavioral2/memory/5016-55-0x00007FF674A70000-0x00007FF674E62000-memory.dmp	xmrig
behavioral2/memory/4412-91-0x00007FF769680000-0x00007FF769A72000-memory.dmp	xmrig
behavioral2/memory/1312-118-0x00007FF63A6B0000-0x00007FF63AAA2000-memory.dmp	xmrig
behavioral2/memory/3256-169-0x00007FF6C7720000-0x00007FF6C7B12000-memory.dmp	xmrig
behavioral2/memory/2300-208-0x00007FF700D50000-0x00007FF701142000-memory.dmp	xmrig
behavioral2/memory/3552-204-0x00007FF605860000-0x00007FF605C52000-memory.dmp	xmrig
behavioral2/memory/3344-200-0x00007FF7639C0000-0x00007FF763DB2000-memory.dmp	xmrig
behavioral2/memory/1708-194-0x00007FF6D40F0000-0x00007FF6D44E2000-memory.dmp	xmrig
behavioral2/memory/4568-188-0x00007FF7773F0000-0x00007FF7777E2000-memory.dmp	xmrig
behavioral2/memory/2368-187-0x00007FF6BCE60000-0x00007FF6BD252000-memory.dmp	xmrig
behavioral2/memory/1300-181-0x00007FF7C1CB0000-0x00007FF7C20A2000-memory.dmp	xmrig
behavioral2/memory/4924-175-0x00007FF6346D0000-0x00007FF634AC2000-memory.dmp	xmrig
behavioral2/memory/1264-163-0x00007FF638050000-0x00007FF638442000-memory.dmp	xmrig
behavioral2/memory/1304-141-0x00007FF79E000000-0x00007FF79E3F2000-memory.dmp	xmrig
behavioral2/memory/2372-137-0x00007FF634D20000-0x00007FF635112000-memory.dmp	xmrig
behavioral2/memory/1016-131-0x00007FF614590000-0x00007FF614982000-memory.dmp	xmrig
behavioral2/memory/4484-126-0x00007FF7D0320000-0x00007FF7D0712000-memory.dmp	xmrig
behavioral2/memory/3336-124-0x00007FF7A79C0000-0x00007FF7A7DB2000-memory.dmp	xmrig
behavioral2/memory/3488-113-0x00007FF60ED60000-0x00007FF60F152000-memory.dmp	xmrig
behavioral2/memory/764-102-0x00007FF7658B0000-0x00007FF765CA2000-memory.dmp	xmrig
behavioral2/memory/4572-85-0x00007FF7AC800000-0x00007FF7ACBF2000-memory.dmp	xmrig
behavioral2/memory/4048-64-0x00007FF7BF3B0000-0x00007FF7BF7A2000-memory.dmp	xmrig
behavioral2/memory/3116-7-0x00007FF6BA960000-0x00007FF6BAD52000-memory.dmp	xmrig
behavioral2/memory/3116-3566-0x00007FF6BA960000-0x00007FF6BAD52000-memory.dmp	xmrig
behavioral2/memory/3368-3568-0x00007FF764BD0000-0x00007FF764FC2000-memory.dmp	xmrig
behavioral2/memory/1264-3572-0x00007FF638050000-0x00007FF638442000-memory.dmp	xmrig
behavioral2/memory/5016-3582-0x00007FF674A70000-0x00007FF674E62000-memory.dmp	xmrig
behavioral2/memory/2300-4609-0x00007FF700D50000-0x00007FF701142000-memory.dmp	xmrig
behavioral2/memory/3256-4605-0x00007FF6C7720000-0x00007FF6C7B12000-memory.dmp	xmrig
behavioral2/memory/1304-4604-0x00007FF79E000000-0x00007FF79E3F2000-memory.dmp	xmrig
behavioral2/memory/2372-4603-0x00007FF634D20000-0x00007FF635112000-memory.dmp	xmrig
behavioral2/memory/3552-4599-0x00007FF605860000-0x00007FF605C52000-memory.dmp	xmrig
behavioral2/memory/1300-4602-0x00007FF7C1CB0000-0x00007FF7C20A2000-memory.dmp	xmrig
behavioral2/memory/2368-4601-0x00007FF6BCE60000-0x00007FF6BD252000-memory.dmp	xmrig
behavioral2/memory/1708-4600-0x00007FF6D40F0000-0x00007FF6D44E2000-memory.dmp	xmrig
behavioral2/memory/3344-4594-0x00007FF7639C0000-0x00007FF763DB2000-memory.dmp	xmrig
behavioral2/memory/4924-4586-0x00007FF6346D0000-0x00007FF634AC2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	4592	powershell.exe
10	4592	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4592	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3116	YDNegng.exe
1264	aIiGBtR.exe
3368	ewlRgJP.exe
5016	zzRaRMW.exe
4048	JJYVrjH.exe
4572	etsqJDf.exe
4412	DmxGeGR.exe
764	zdqUBrK.exe
3488	TpYgyMI.exe
1312	SJCkGBz.exe
3256	JsVsIbo.exe
3336	JQGbxBa.exe
4484	CYhjOBV.exe
4924	ElWYhLY.exe
1016	VgeUuHC.exe
1300	Nczzudf.exe
2372	DcOXatM.exe
2368	PdlMASN.exe
1304	bkhjIeo.exe
4568	qzWQJpu.exe
1708	xiUZVPM.exe
3344	DPYOsZp.exe
3552	trXUXFN.exe
2300	VvUCcys.exe
4248	PyVdyQy.exe
2516	BoxDTax.exe
3536	qbHnZIn.exe
4796	MtrqavY.exe
3204	TMAfKkg.exe
4940	ANODqJj.exe
1388	Ykoikld.exe
1488	rXcXqbC.exe
2484	fTehMGe.exe
1068	kJhxElL.exe
2096	EAcqsTR.exe
3364	KwKWdlZ.exe
1776	Mputnno.exe
3296	sJRWoAi.exe
3052	WEPkvtB.exe
2492	pvNdGeV.exe
3024	TmHoEOQ.exe
2864	OmQPCwf.exe
3272	IqvnnTF.exe
4092	oaKCuxp.exe
748	dbJWQoD.exe
4336	GgjCFRJ.exe
1752	BtTwPNl.exe
3996	wWfILCu.exe
2760	cfjDIgu.exe
2928	zWxCumv.exe
3092	cAuMAwT.exe
4980	WUPCEzQ.exe
2108	NiQKUUd.exe
4416	MyjHZty.exe
1208	JyFqmyX.exe
512	IZiSANc.exe
4396	mqZqYeu.exe
4408	pEfWXls.exe
872	dexKGJj.exe
2680	hLTDfrU.exe
4236	WCaFbDr.exe
3268	DKTNkgy.exe
3324	eYQAHBj.exe
1628	eqxMSfi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3584-0-0x00007FF73B160000-0x00007FF73B552000-memory.dmp	upx
behavioral2/files/0x000b0000000234d2-6.dat	upx
behavioral2/files/0x00070000000234e1-16.dat	upx
behavioral2/memory/3368-46-0x00007FF764BD0000-0x00007FF764FC2000-memory.dmp	upx
behavioral2/memory/5016-55-0x00007FF674A70000-0x00007FF674E62000-memory.dmp	upx
behavioral2/files/0x00070000000234eb-78.dat	upx
behavioral2/memory/4412-91-0x00007FF769680000-0x00007FF769A72000-memory.dmp	upx
behavioral2/files/0x00080000000234ee-110.dat	upx
behavioral2/memory/1312-118-0x00007FF63A6B0000-0x00007FF63AAA2000-memory.dmp	upx
behavioral2/files/0x00070000000234f2-127.dat	upx
behavioral2/files/0x00090000000234dd-134.dat	upx
behavioral2/files/0x00070000000234f5-153.dat	upx
behavioral2/memory/3256-169-0x00007FF6C7720000-0x00007FF6C7B12000-memory.dmp	upx
behavioral2/files/0x00070000000234fa-182.dat	upx
behavioral2/memory/2300-208-0x00007FF700D50000-0x00007FF701142000-memory.dmp	upx
behavioral2/memory/3552-204-0x00007FF605860000-0x00007FF605C52000-memory.dmp	upx
behavioral2/memory/3344-200-0x00007FF7639C0000-0x00007FF763DB2000-memory.dmp	upx
behavioral2/files/0x00070000000234fe-197.dat	upx
behavioral2/files/0x00070000000234fc-195.dat	upx
behavioral2/memory/1708-194-0x00007FF6D40F0000-0x00007FF6D44E2000-memory.dmp	upx
behavioral2/files/0x00070000000234fd-191.dat	upx
behavioral2/files/0x00070000000234fb-189.dat	upx
behavioral2/memory/4568-188-0x00007FF7773F0000-0x00007FF7777E2000-memory.dmp	upx
behavioral2/memory/2368-187-0x00007FF6BCE60000-0x00007FF6BD252000-memory.dmp	upx
behavioral2/memory/1300-181-0x00007FF7C1CB0000-0x00007FF7C20A2000-memory.dmp	upx
behavioral2/files/0x00070000000234f9-176.dat	upx
behavioral2/memory/4924-175-0x00007FF6346D0000-0x00007FF634AC2000-memory.dmp	upx
behavioral2/files/0x00070000000234f8-170.dat	upx
behavioral2/files/0x00070000000234f7-164.dat	upx
behavioral2/memory/1264-163-0x00007FF638050000-0x00007FF638442000-memory.dmp	upx
behavioral2/files/0x00070000000234f6-158.dat	upx
behavioral2/files/0x00070000000234f4-147.dat	upx
behavioral2/memory/1304-141-0x00007FF79E000000-0x00007FF79E3F2000-memory.dmp	upx
behavioral2/memory/2372-137-0x00007FF634D20000-0x00007FF635112000-memory.dmp	upx
behavioral2/files/0x00070000000234f3-132.dat	upx
behavioral2/memory/1016-131-0x00007FF614590000-0x00007FF614982000-memory.dmp	upx
behavioral2/memory/4484-126-0x00007FF7D0320000-0x00007FF7D0712000-memory.dmp	upx
behavioral2/memory/3336-124-0x00007FF7A79C0000-0x00007FF7A7DB2000-memory.dmp	upx
behavioral2/files/0x00070000000234f1-119.dat	upx
behavioral2/memory/3488-113-0x00007FF60ED60000-0x00007FF60F152000-memory.dmp	upx
behavioral2/files/0x00070000000234ef-109.dat	upx
behavioral2/files/0x00070000000234f0-107.dat	upx
behavioral2/files/0x00080000000234ed-116.dat	upx
behavioral2/memory/764-102-0x00007FF7658B0000-0x00007FF765CA2000-memory.dmp	upx
behavioral2/files/0x00070000000234ec-104.dat	upx
behavioral2/files/0x00070000000234ea-94.dat	upx
behavioral2/files/0x00070000000234e9-92.dat	upx
behavioral2/memory/4572-85-0x00007FF7AC800000-0x00007FF7ACBF2000-memory.dmp	upx
behavioral2/memory/4048-64-0x00007FF7BF3B0000-0x00007FF7BF7A2000-memory.dmp	upx
behavioral2/files/0x00070000000234e6-56.dat	upx
behavioral2/files/0x00070000000234e5-54.dat	upx
behavioral2/files/0x00070000000234e8-60.dat	upx
behavioral2/files/0x00070000000234e4-49.dat	upx
behavioral2/files/0x00070000000234e7-50.dat	upx
behavioral2/files/0x00070000000234e3-29.dat	upx
behavioral2/files/0x00070000000234e2-26.dat	upx
behavioral2/files/0x00070000000234e0-19.dat	upx
behavioral2/memory/3116-7-0x00007FF6BA960000-0x00007FF6BAD52000-memory.dmp	upx
behavioral2/memory/3116-3566-0x00007FF6BA960000-0x00007FF6BAD52000-memory.dmp	upx
behavioral2/memory/3368-3568-0x00007FF764BD0000-0x00007FF764FC2000-memory.dmp	upx
behavioral2/memory/1264-3572-0x00007FF638050000-0x00007FF638442000-memory.dmp	upx
behavioral2/memory/5016-3582-0x00007FF674A70000-0x00007FF674E62000-memory.dmp	upx
behavioral2/memory/2300-4609-0x00007FF700D50000-0x00007FF701142000-memory.dmp	upx
behavioral2/memory/3256-4605-0x00007FF6C7720000-0x00007FF6C7B12000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QuewIUh.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\cHJSEgQ.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\YhkTRmr.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\CQOXiDy.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\PuTyPzT.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\oxitKMG.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\XJEERVT.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\RgbYxPO.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\ycKdBTO.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\ptqbuad.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\asgEOTh.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\RDkSxDe.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\KZYGMJc.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\LCFnHiL.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\LHBlpar.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\EkBXDfv.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\ERutmSe.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\kZfyWqN.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\ntwgyYB.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\CVEUpYs.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\bwXzYMd.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\wuFaTew.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\QWJaImA.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\QFgrywr.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\spLSmFg.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\smEvqlm.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\iJsZEnJ.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\IubEjEq.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\BiuKeSC.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\YcVSNRk.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\SaNvvKU.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\YhYGBJd.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\mZMCeEB.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\bqmdzkr.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\HKPltMA.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\AaStHfs.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\GREGmBy.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\NGgvWUF.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\RfNFOfX.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\EzDXTVL.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\laLDbiD.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\fOLPJrq.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\ZOMYiRm.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\tBBoxvJ.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\XXLGIuV.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\cyUqxSm.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\YRWLaOQ.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\INdreiE.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\PDyOTgZ.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\ECbKuKn.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\AVpKBrZ.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\OkYXsHD.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\HoQAMzY.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\angYnnh.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\hpBjzYR.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\iwsWIBd.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\zmzevpy.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\tWhFoGR.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\HWelgHl.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\YocQjfO.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\rjFmAAO.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\UPAsxCd.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\cPOTvfh.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\kfGofRl.exe	be7712b6ad67434f11f1907acf5c84c0N.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeLockMemoryPrivilege	3584	be7712b6ad67434f11f1907acf5c84c0N.exe
Token: SeLockMemoryPrivilege	3584	be7712b6ad67434f11f1907acf5c84c0N.exe
Token: SeCreateGlobalPrivilege	12832	dwm.exe
Token: SeChangeNotifyPrivilege	12832	dwm.exe
Token: 33	12832	dwm.exe
Token: SeIncBasePriorityPrivilege	12832	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4592	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	85
PID 3584 wrote to memory of 4592	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	85
PID 3584 wrote to memory of 3116	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	86
PID 3584 wrote to memory of 3116	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	86
PID 3584 wrote to memory of 1264	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	87
PID 3584 wrote to memory of 1264	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	87
PID 3584 wrote to memory of 3368	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	88
PID 3584 wrote to memory of 3368	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	88
PID 3584 wrote to memory of 5016	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	89
PID 3584 wrote to memory of 5016	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	89
PID 3584 wrote to memory of 4048	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	90
PID 3584 wrote to memory of 4048	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	90
PID 3584 wrote to memory of 4572	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	91
PID 3584 wrote to memory of 4572	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	91
PID 3584 wrote to memory of 4412	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	92
PID 3584 wrote to memory of 4412	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	92
PID 3584 wrote to memory of 764	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	93
PID 3584 wrote to memory of 764	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	93
PID 3584 wrote to memory of 3488	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	94
PID 3584 wrote to memory of 3488	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	94
PID 3584 wrote to memory of 1312	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	95
PID 3584 wrote to memory of 1312	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	95
PID 3584 wrote to memory of 3256	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	96
PID 3584 wrote to memory of 3256	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	96
PID 3584 wrote to memory of 3336	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	97
PID 3584 wrote to memory of 3336	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	97
PID 3584 wrote to memory of 4484	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	98
PID 3584 wrote to memory of 4484	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	98
PID 3584 wrote to memory of 4924	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	99
PID 3584 wrote to memory of 4924	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	99
PID 3584 wrote to memory of 2372	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	100
PID 3584 wrote to memory of 2372	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	100
PID 3584 wrote to memory of 1016	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	101
PID 3584 wrote to memory of 1016	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	101
PID 3584 wrote to memory of 1300	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	102
PID 3584 wrote to memory of 1300	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	102
PID 3584 wrote to memory of 2368	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	103
PID 3584 wrote to memory of 2368	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	103
PID 3584 wrote to memory of 1304	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	104
PID 3584 wrote to memory of 1304	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	104
PID 3584 wrote to memory of 4568	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	105
PID 3584 wrote to memory of 4568	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	105
PID 3584 wrote to memory of 1708	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	106
PID 3584 wrote to memory of 1708	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	106
PID 3584 wrote to memory of 3344	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	107
PID 3584 wrote to memory of 3344	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	107
PID 3584 wrote to memory of 3552	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	108
PID 3584 wrote to memory of 3552	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	108
PID 3584 wrote to memory of 2300	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	109
PID 3584 wrote to memory of 2300	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	109
PID 3584 wrote to memory of 4248	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	110
PID 3584 wrote to memory of 4248	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	110
PID 3584 wrote to memory of 2516	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	111
PID 3584 wrote to memory of 2516	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	111
PID 3584 wrote to memory of 3536	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	112
PID 3584 wrote to memory of 3536	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	112
PID 3584 wrote to memory of 4796	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	113
PID 3584 wrote to memory of 4796	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	113
PID 3584 wrote to memory of 3204	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	114
PID 3584 wrote to memory of 3204	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	114
PID 3584 wrote to memory of 4940	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	115
PID 3584 wrote to memory of 4940	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	115
PID 3584 wrote to memory of 1388	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	116
PID 3584 wrote to memory of 1388	3584	be7712b6ad67434f11f1907acf5c84c0N.exe	116

C:\Users\Admin\AppData\Local\Temp\be7712b6ad67434f11f1907acf5c84c0N.exe
"C:\Users\Admin\AppData\Local\Temp\be7712b6ad67434f11f1907acf5c84c0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4592" "2904" "2428" "2924" "0" "0" "2928" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12356
- C:\Windows\System\YDNegng.exe
  C:\Windows\System\YDNegng.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\aIiGBtR.exe
  C:\Windows\System\aIiGBtR.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\ewlRgJP.exe
  C:\Windows\System\ewlRgJP.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\zzRaRMW.exe
  C:\Windows\System\zzRaRMW.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\JJYVrjH.exe
  C:\Windows\System\JJYVrjH.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\etsqJDf.exe
  C:\Windows\System\etsqJDf.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\DmxGeGR.exe
  C:\Windows\System\DmxGeGR.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\zdqUBrK.exe
  C:\Windows\System\zdqUBrK.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\TpYgyMI.exe
  C:\Windows\System\TpYgyMI.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\SJCkGBz.exe
  C:\Windows\System\SJCkGBz.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\JsVsIbo.exe
  C:\Windows\System\JsVsIbo.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\JQGbxBa.exe
  C:\Windows\System\JQGbxBa.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\CYhjOBV.exe
  C:\Windows\System\CYhjOBV.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\ElWYhLY.exe
  C:\Windows\System\ElWYhLY.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\DcOXatM.exe
  C:\Windows\System\DcOXatM.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\VgeUuHC.exe
  C:\Windows\System\VgeUuHC.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\Nczzudf.exe
  C:\Windows\System\Nczzudf.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\PdlMASN.exe
  C:\Windows\System\PdlMASN.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\bkhjIeo.exe
  C:\Windows\System\bkhjIeo.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\qzWQJpu.exe
  C:\Windows\System\qzWQJpu.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\xiUZVPM.exe
  C:\Windows\System\xiUZVPM.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\DPYOsZp.exe
  C:\Windows\System\DPYOsZp.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\trXUXFN.exe
  C:\Windows\System\trXUXFN.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\VvUCcys.exe
  C:\Windows\System\VvUCcys.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\PyVdyQy.exe
  C:\Windows\System\PyVdyQy.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\BoxDTax.exe
  C:\Windows\System\BoxDTax.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\qbHnZIn.exe
  C:\Windows\System\qbHnZIn.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\MtrqavY.exe
  C:\Windows\System\MtrqavY.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\TMAfKkg.exe
  C:\Windows\System\TMAfKkg.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\ANODqJj.exe
  C:\Windows\System\ANODqJj.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\Ykoikld.exe
  C:\Windows\System\Ykoikld.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\rXcXqbC.exe
  C:\Windows\System\rXcXqbC.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\fTehMGe.exe
  C:\Windows\System\fTehMGe.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\kJhxElL.exe
  C:\Windows\System\kJhxElL.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\EAcqsTR.exe
  C:\Windows\System\EAcqsTR.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\KwKWdlZ.exe
  C:\Windows\System\KwKWdlZ.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\Mputnno.exe
  C:\Windows\System\Mputnno.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\sJRWoAi.exe
  C:\Windows\System\sJRWoAi.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\WEPkvtB.exe
  C:\Windows\System\WEPkvtB.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\pvNdGeV.exe
  C:\Windows\System\pvNdGeV.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\TmHoEOQ.exe
  C:\Windows\System\TmHoEOQ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\OmQPCwf.exe
  C:\Windows\System\OmQPCwf.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\IqvnnTF.exe
  C:\Windows\System\IqvnnTF.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\oaKCuxp.exe
  C:\Windows\System\oaKCuxp.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\dbJWQoD.exe
  C:\Windows\System\dbJWQoD.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\GgjCFRJ.exe
  C:\Windows\System\GgjCFRJ.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\BtTwPNl.exe
  C:\Windows\System\BtTwPNl.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\wWfILCu.exe
  C:\Windows\System\wWfILCu.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\cfjDIgu.exe
  C:\Windows\System\cfjDIgu.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\zWxCumv.exe
  C:\Windows\System\zWxCumv.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\cAuMAwT.exe
  C:\Windows\System\cAuMAwT.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\WUPCEzQ.exe
  C:\Windows\System\WUPCEzQ.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\NiQKUUd.exe
  C:\Windows\System\NiQKUUd.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\MyjHZty.exe
  C:\Windows\System\MyjHZty.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\JyFqmyX.exe
  C:\Windows\System\JyFqmyX.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\IZiSANc.exe
  C:\Windows\System\IZiSANc.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\mqZqYeu.exe
  C:\Windows\System\mqZqYeu.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\pEfWXls.exe
  C:\Windows\System\pEfWXls.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\dexKGJj.exe
  C:\Windows\System\dexKGJj.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\hLTDfrU.exe
  C:\Windows\System\hLTDfrU.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\WCaFbDr.exe
  C:\Windows\System\WCaFbDr.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\DKTNkgy.exe
  C:\Windows\System\DKTNkgy.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\eYQAHBj.exe
  C:\Windows\System\eYQAHBj.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\eqxMSfi.exe
  C:\Windows\System\eqxMSfi.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\sCJTJiH.exe
  C:\Windows\System\sCJTJiH.exe
  2⤵
  PID:4840
- C:\Windows\System\nOAnCpH.exe
  C:\Windows\System\nOAnCpH.exe
  2⤵
  PID:4300
- C:\Windows\System\DsPeHoW.exe
  C:\Windows\System\DsPeHoW.exe
  2⤵
  PID:3224
- C:\Windows\System\XwmpGKO.exe
  C:\Windows\System\XwmpGKO.exe
  2⤵
  PID:3964
- C:\Windows\System\zvAQFCK.exe
  C:\Windows\System\zvAQFCK.exe
  2⤵
  PID:640
- C:\Windows\System\jhjpWNK.exe
  C:\Windows\System\jhjpWNK.exe
  2⤵
  PID:372
- C:\Windows\System\enGsvUo.exe
  C:\Windows\System\enGsvUo.exe
  2⤵
  PID:3372
- C:\Windows\System\oczoIHG.exe
  C:\Windows\System\oczoIHG.exe
  2⤵
  PID:5024
- C:\Windows\System\CbMgXex.exe
  C:\Windows\System\CbMgXex.exe
  2⤵
  PID:2112
- C:\Windows\System\PzauUtr.exe
  C:\Windows\System\PzauUtr.exe
  2⤵
  PID:4240
- C:\Windows\System\mEFEErw.exe
  C:\Windows\System\mEFEErw.exe
  2⤵
  PID:1744
- C:\Windows\System\rqGCaMb.exe
  C:\Windows\System\rqGCaMb.exe
  2⤵
  PID:3112
- C:\Windows\System\HRGIFkE.exe
  C:\Windows\System\HRGIFkE.exe
  2⤵
  PID:3216
- C:\Windows\System\vLPRCXc.exe
  C:\Windows\System\vLPRCXc.exe
  2⤵
  PID:4280
- C:\Windows\System\DuMeKgc.exe
  C:\Windows\System\DuMeKgc.exe
  2⤵
  PID:920
- C:\Windows\System\IWwAESF.exe
  C:\Windows\System\IWwAESF.exe
  2⤵
  PID:3160
- C:\Windows\System\bnKgkxb.exe
  C:\Windows\System\bnKgkxb.exe
  2⤵
  PID:2288
- C:\Windows\System\REYdgwb.exe
  C:\Windows\System\REYdgwb.exe
  2⤵
  PID:1040
- C:\Windows\System\HuurdxI.exe
  C:\Windows\System\HuurdxI.exe
  2⤵
  PID:4908
- C:\Windows\System\HqDdtPh.exe
  C:\Windows\System\HqDdtPh.exe
  2⤵
  PID:1640
- C:\Windows\System\HXkMSyK.exe
  C:\Windows\System\HXkMSyK.exe
  2⤵
  PID:1476
- C:\Windows\System\GDOdTHB.exe
  C:\Windows\System\GDOdTHB.exe
  2⤵
  PID:3076
- C:\Windows\System\gNNDPhi.exe
  C:\Windows\System\gNNDPhi.exe
  2⤵
  PID:1120
- C:\Windows\System\jbUiDYz.exe
  C:\Windows\System\jbUiDYz.exe
  2⤵
  PID:2564
- C:\Windows\System\GpRBSoK.exe
  C:\Windows\System\GpRBSoK.exe
  2⤵
  PID:3340
- C:\Windows\System\onXeRwy.exe
  C:\Windows\System\onXeRwy.exe
  2⤵
  PID:2052
- C:\Windows\System\lmRYeTH.exe
  C:\Windows\System\lmRYeTH.exe
  2⤵
  PID:1864
- C:\Windows\System\WkuTkIg.exe
  C:\Windows\System\WkuTkIg.exe
  2⤵
  PID:2964
- C:\Windows\System\UeCUIQn.exe
  C:\Windows\System\UeCUIQn.exe
  2⤵
  PID:4208
- C:\Windows\System\CUkpVCm.exe
  C:\Windows\System\CUkpVCm.exe
  2⤵
  PID:4744
- C:\Windows\System\unJhtlt.exe
  C:\Windows\System\unJhtlt.exe
  2⤵
  PID:540
- C:\Windows\System\xUOKzfM.exe
  C:\Windows\System\xUOKzfM.exe
  2⤵
  PID:4688
- C:\Windows\System\GoSwqJF.exe
  C:\Windows\System\GoSwqJF.exe
  2⤵
  PID:4836
- C:\Windows\System\CbDIaOT.exe
  C:\Windows\System\CbDIaOT.exe
  2⤵
  PID:3980
- C:\Windows\System\lYOyBfN.exe
  C:\Windows\System\lYOyBfN.exe
  2⤵
  PID:5132
- C:\Windows\System\tErfmjq.exe
  C:\Windows\System\tErfmjq.exe
  2⤵
  PID:5148
- C:\Windows\System\oQUllJe.exe
  C:\Windows\System\oQUllJe.exe
  2⤵
  PID:5168
- C:\Windows\System\PAYHxRC.exe
  C:\Windows\System\PAYHxRC.exe
  2⤵
  PID:5216
- C:\Windows\System\zKaufJr.exe
  C:\Windows\System\zKaufJr.exe
  2⤵
  PID:5232
- C:\Windows\System\yWMkqHz.exe
  C:\Windows\System\yWMkqHz.exe
  2⤵
  PID:5256
- C:\Windows\System\DIgHwyU.exe
  C:\Windows\System\DIgHwyU.exe
  2⤵
  PID:5344
- C:\Windows\System\JtmpPXX.exe
  C:\Windows\System\JtmpPXX.exe
  2⤵
  PID:5360
- C:\Windows\System\bQZnHmZ.exe
  C:\Windows\System\bQZnHmZ.exe
  2⤵
  PID:5392
- C:\Windows\System\ccmRFuB.exe
  C:\Windows\System\ccmRFuB.exe
  2⤵
  PID:5408
- C:\Windows\System\hMWZEkk.exe
  C:\Windows\System\hMWZEkk.exe
  2⤵
  PID:5440
- C:\Windows\System\ivuuwud.exe
  C:\Windows\System\ivuuwud.exe
  2⤵
  PID:5456
- C:\Windows\System\NJFEewx.exe
  C:\Windows\System\NJFEewx.exe
  2⤵
  PID:5520
- C:\Windows\System\JOPxVMI.exe
  C:\Windows\System\JOPxVMI.exe
  2⤵
  PID:5564
- C:\Windows\System\mJapyEX.exe
  C:\Windows\System\mJapyEX.exe
  2⤵
  PID:5580
- C:\Windows\System\ptVWjUL.exe
  C:\Windows\System\ptVWjUL.exe
  2⤵
  PID:5600
- C:\Windows\System\oenGzMN.exe
  C:\Windows\System\oenGzMN.exe
  2⤵
  PID:5616
- C:\Windows\System\yCIEMIg.exe
  C:\Windows\System\yCIEMIg.exe
  2⤵
  PID:5636
- C:\Windows\System\dRGpsOe.exe
  C:\Windows\System\dRGpsOe.exe
  2⤵
  PID:5656
- C:\Windows\System\ChlgzzT.exe
  C:\Windows\System\ChlgzzT.exe
  2⤵
  PID:5672
- C:\Windows\System\pBjwIsj.exe
  C:\Windows\System\pBjwIsj.exe
  2⤵
  PID:5688
- C:\Windows\System\yRWtArB.exe
  C:\Windows\System\yRWtArB.exe
  2⤵
  PID:5712
- C:\Windows\System\eyqiSch.exe
  C:\Windows\System\eyqiSch.exe
  2⤵
  PID:5732
- C:\Windows\System\vBfFVOB.exe
  C:\Windows\System\vBfFVOB.exe
  2⤵
  PID:5756
- C:\Windows\System\WWabObz.exe
  C:\Windows\System\WWabObz.exe
  2⤵
  PID:5804
- C:\Windows\System\NWfePia.exe
  C:\Windows\System\NWfePia.exe
  2⤵
  PID:5824
- C:\Windows\System\ckVcewA.exe
  C:\Windows\System\ckVcewA.exe
  2⤵
  PID:5840
- C:\Windows\System\ummqpLo.exe
  C:\Windows\System\ummqpLo.exe
  2⤵
  PID:5864
- C:\Windows\System\sRJETlI.exe
  C:\Windows\System\sRJETlI.exe
  2⤵
  PID:5884
- C:\Windows\System\LaBvuhr.exe
  C:\Windows\System\LaBvuhr.exe
  2⤵
  PID:5948
- C:\Windows\System\yKxnuFY.exe
  C:\Windows\System\yKxnuFY.exe
  2⤵
  PID:6008
- C:\Windows\System\EAOgwHh.exe
  C:\Windows\System\EAOgwHh.exe
  2⤵
  PID:6024
- C:\Windows\System\UTWVVFT.exe
  C:\Windows\System\UTWVVFT.exe
  2⤵
  PID:6044
- C:\Windows\System\pDVHbUz.exe
  C:\Windows\System\pDVHbUz.exe
  2⤵
  PID:6064
- C:\Windows\System\sABACPs.exe
  C:\Windows\System\sABACPs.exe
  2⤵
  PID:6084
- C:\Windows\System\dXSfgKC.exe
  C:\Windows\System\dXSfgKC.exe
  2⤵
  PID:6100
- C:\Windows\System\IKilVhc.exe
  C:\Windows\System\IKilVhc.exe
  2⤵
  PID:6124
- C:\Windows\System\xbqdxFl.exe
  C:\Windows\System\xbqdxFl.exe
  2⤵
  PID:6140
- C:\Windows\System\rGzuBkQ.exe
  C:\Windows\System\rGzuBkQ.exe
  2⤵
  PID:3376
- C:\Windows\System\ZMzgUur.exe
  C:\Windows\System\ZMzgUur.exe
  2⤵
  PID:5144
- C:\Windows\System\rsZdXdD.exe
  C:\Windows\System\rsZdXdD.exe
  2⤵
  PID:5304
- C:\Windows\System\wVElrfq.exe
  C:\Windows\System\wVElrfq.exe
  2⤵
  PID:5292
- C:\Windows\System\zWnVxFS.exe
  C:\Windows\System\zWnVxFS.exe
  2⤵
  PID:5352
- C:\Windows\System\MzcQnWa.exe
  C:\Windows\System\MzcQnWa.exe
  2⤵
  PID:5376
- C:\Windows\System\miqAJOU.exe
  C:\Windows\System\miqAJOU.exe
  2⤵
  PID:536
- C:\Windows\System\eTfmsTT.exe
  C:\Windows\System\eTfmsTT.exe
  2⤵
  PID:5436
- C:\Windows\System\goxPyNt.exe
  C:\Windows\System\goxPyNt.exe
  2⤵
  PID:5492
- C:\Windows\System\vTwTOTJ.exe
  C:\Windows\System\vTwTOTJ.exe
  2⤵
  PID:5612
- C:\Windows\System\TAgDVlb.exe
  C:\Windows\System\TAgDVlb.exe
  2⤵
  PID:5624
- C:\Windows\System\lzsNmwR.exe
  C:\Windows\System\lzsNmwR.exe
  2⤵
  PID:5696
- C:\Windows\System\kkazpnX.exe
  C:\Windows\System\kkazpnX.exe
  2⤵
  PID:5780
- C:\Windows\System\vZAzBxv.exe
  C:\Windows\System\vZAzBxv.exe
  2⤵
  PID:5816
- C:\Windows\System\AtRZKcU.exe
  C:\Windows\System\AtRZKcU.exe
  2⤵
  PID:5852
- C:\Windows\System\VDAfMbC.exe
  C:\Windows\System\VDAfMbC.exe
  2⤵
  PID:5880
- C:\Windows\System\OSLwhkH.exe
  C:\Windows\System\OSLwhkH.exe
  2⤵
  PID:6000
- C:\Windows\System\AuvGaoC.exe
  C:\Windows\System\AuvGaoC.exe
  2⤵
  PID:5972
- C:\Windows\System\YfcySrv.exe
  C:\Windows\System\YfcySrv.exe
  2⤵
  PID:6020
- C:\Windows\System\qVMWLNB.exe
  C:\Windows\System\qVMWLNB.exe
  2⤵
  PID:5076
- C:\Windows\System\aIRFseJ.exe
  C:\Windows\System\aIRFseJ.exe
  2⤵
  PID:5432
- C:\Windows\System\mZMdwrF.exe
  C:\Windows\System\mZMdwrF.exe
  2⤵
  PID:3800
- C:\Windows\System\TLKKKtb.exe
  C:\Windows\System\TLKKKtb.exe
  2⤵
  PID:1408
- C:\Windows\System\YelHWHk.exe
  C:\Windows\System\YelHWHk.exe
  2⤵
  PID:6056
- C:\Windows\System\XvpBLUi.exe
  C:\Windows\System\XvpBLUi.exe
  2⤵
  PID:5796
- C:\Windows\System\zEqcBYC.exe
  C:\Windows\System\zEqcBYC.exe
  2⤵
  PID:5276
- C:\Windows\System\mzpnQZg.exe
  C:\Windows\System\mzpnQZg.exe
  2⤵
  PID:5908
- C:\Windows\System\npCiEtY.exe
  C:\Windows\System\npCiEtY.exe
  2⤵
  PID:1496
- C:\Windows\System\sPwpBsM.exe
  C:\Windows\System\sPwpBsM.exe
  2⤵
  PID:6148
- C:\Windows\System\ddOufmz.exe
  C:\Windows\System\ddOufmz.exe
  2⤵
  PID:6164
- C:\Windows\System\xVweCcN.exe
  C:\Windows\System\xVweCcN.exe
  2⤵
  PID:6184
- C:\Windows\System\aJvnpdb.exe
  C:\Windows\System\aJvnpdb.exe
  2⤵
  PID:6236
- C:\Windows\System\FYstfKh.exe
  C:\Windows\System\FYstfKh.exe
  2⤵
  PID:6296
- C:\Windows\System\NfyEqfS.exe
  C:\Windows\System\NfyEqfS.exe
  2⤵
  PID:6312
- C:\Windows\System\SGBEZrz.exe
  C:\Windows\System\SGBEZrz.exe
  2⤵
  PID:6340
- C:\Windows\System\GQqiELb.exe
  C:\Windows\System\GQqiELb.exe
  2⤵
  PID:6356
- C:\Windows\System\OFtUSaI.exe
  C:\Windows\System\OFtUSaI.exe
  2⤵
  PID:6376
- C:\Windows\System\MnIpfXd.exe
  C:\Windows\System\MnIpfXd.exe
  2⤵
  PID:6396
- C:\Windows\System\CQOXiDy.exe
  C:\Windows\System\CQOXiDy.exe
  2⤵
  PID:6452
- C:\Windows\System\pxsuwzh.exe
  C:\Windows\System\pxsuwzh.exe
  2⤵
  PID:6468
- C:\Windows\System\lAkqZsN.exe
  C:\Windows\System\lAkqZsN.exe
  2⤵
  PID:6496
- C:\Windows\System\IzBOCtb.exe
  C:\Windows\System\IzBOCtb.exe
  2⤵
  PID:6520
- C:\Windows\System\MYmtbVi.exe
  C:\Windows\System\MYmtbVi.exe
  2⤵
  PID:6556
- C:\Windows\System\AmAOZZp.exe
  C:\Windows\System\AmAOZZp.exe
  2⤵
  PID:6576
- C:\Windows\System\VMakyCH.exe
  C:\Windows\System\VMakyCH.exe
  2⤵
  PID:6608
- C:\Windows\System\bOGnOFl.exe
  C:\Windows\System\bOGnOFl.exe
  2⤵
  PID:6624
- C:\Windows\System\XeFpWlo.exe
  C:\Windows\System\XeFpWlo.exe
  2⤵
  PID:6644
- C:\Windows\System\cdKwCPR.exe
  C:\Windows\System\cdKwCPR.exe
  2⤵
  PID:6664
- C:\Windows\System\kQaUcCw.exe
  C:\Windows\System\kQaUcCw.exe
  2⤵
  PID:6680
- C:\Windows\System\MuhdpVt.exe
  C:\Windows\System\MuhdpVt.exe
  2⤵
  PID:6700
- C:\Windows\System\nCXNZia.exe
  C:\Windows\System\nCXNZia.exe
  2⤵
  PID:6720
- C:\Windows\System\WgHkElO.exe
  C:\Windows\System\WgHkElO.exe
  2⤵
  PID:6764
- C:\Windows\System\iCkUXbQ.exe
  C:\Windows\System\iCkUXbQ.exe
  2⤵
  PID:6804
- C:\Windows\System\LQwGKiK.exe
  C:\Windows\System\LQwGKiK.exe
  2⤵
  PID:6856
- C:\Windows\System\YgNjIIK.exe
  C:\Windows\System\YgNjIIK.exe
  2⤵
  PID:6880
- C:\Windows\System\gpXkYZf.exe
  C:\Windows\System\gpXkYZf.exe
  2⤵
  PID:6896
- C:\Windows\System\ikEVMXh.exe
  C:\Windows\System\ikEVMXh.exe
  2⤵
  PID:6956
- C:\Windows\System\WpuLNei.exe
  C:\Windows\System\WpuLNei.exe
  2⤵
  PID:6976
- C:\Windows\System\RqBsVwg.exe
  C:\Windows\System\RqBsVwg.exe
  2⤵
  PID:7004
- C:\Windows\System\aDsgkGd.exe
  C:\Windows\System\aDsgkGd.exe
  2⤵
  PID:7036
- C:\Windows\System\iFnpJRG.exe
  C:\Windows\System\iFnpJRG.exe
  2⤵
  PID:7060
- C:\Windows\System\mCLwxnk.exe
  C:\Windows\System\mCLwxnk.exe
  2⤵
  PID:7080
- C:\Windows\System\TaaVPKl.exe
  C:\Windows\System\TaaVPKl.exe
  2⤵
  PID:7100
- C:\Windows\System\GJSqxEu.exe
  C:\Windows\System\GJSqxEu.exe
  2⤵
  PID:7140
- C:\Windows\System\yLALzFg.exe
  C:\Windows\System\yLALzFg.exe
  2⤵
  PID:7160
- C:\Windows\System\mMhDfVN.exe
  C:\Windows\System\mMhDfVN.exe
  2⤵
  PID:2060
- C:\Windows\System\cHvCopl.exe
  C:\Windows\System\cHvCopl.exe
  2⤵
  PID:3720
- C:\Windows\System\rtyaYRu.exe
  C:\Windows\System\rtyaYRu.exe
  2⤵
  PID:6200
- C:\Windows\System\kDyLADo.exe
  C:\Windows\System\kDyLADo.exe
  2⤵
  PID:6212
- C:\Windows\System\iwsWIBd.exe
  C:\Windows\System\iwsWIBd.exe
  2⤵
  PID:6320
- C:\Windows\System\CLfcxZO.exe
  C:\Windows\System\CLfcxZO.exe
  2⤵
  PID:6332
- C:\Windows\System\ZsvjrFQ.exe
  C:\Windows\System\ZsvjrFQ.exe
  2⤵
  PID:6428
- C:\Windows\System\WKixJAP.exe
  C:\Windows\System\WKixJAP.exe
  2⤵
  PID:6484
- C:\Windows\System\qlFRSER.exe
  C:\Windows\System\qlFRSER.exe
  2⤵
  PID:6532
- C:\Windows\System\wOfMGbe.exe
  C:\Windows\System\wOfMGbe.exe
  2⤵
  PID:6568
- C:\Windows\System\SunvuNb.exe
  C:\Windows\System\SunvuNb.exe
  2⤵
  PID:6632
- C:\Windows\System\CRAiHOT.exe
  C:\Windows\System\CRAiHOT.exe
  2⤵
  PID:6660
- C:\Windows\System\GZIXQHS.exe
  C:\Windows\System\GZIXQHS.exe
  2⤵
  PID:6672
- C:\Windows\System\bXoZqXM.exe
  C:\Windows\System\bXoZqXM.exe
  2⤵
  PID:6756
- C:\Windows\System\veVMLvk.exe
  C:\Windows\System\veVMLvk.exe
  2⤵
  PID:6944
- C:\Windows\System\hwdKRHB.exe
  C:\Windows\System\hwdKRHB.exe
  2⤵
  PID:7056
- C:\Windows\System\QIrKhhF.exe
  C:\Windows\System\QIrKhhF.exe
  2⤵
  PID:7124
- C:\Windows\System\XJYQvJR.exe
  C:\Windows\System\XJYQvJR.exe
  2⤵
  PID:7076
- C:\Windows\System\FfNvKSw.exe
  C:\Windows\System\FfNvKSw.exe
  2⤵
  PID:5724
- C:\Windows\System\fxxjbyf.exe
  C:\Windows\System\fxxjbyf.exe
  2⤵
  PID:3080
- C:\Windows\System\MgUkrAD.exe
  C:\Windows\System\MgUkrAD.exe
  2⤵
  PID:6420
- C:\Windows\System\GpVmnQS.exe
  C:\Windows\System\GpVmnQS.exe
  2⤵
  PID:6620
- C:\Windows\System\PLdHzqg.exe
  C:\Windows\System\PLdHzqg.exe
  2⤵
  PID:6844
- C:\Windows\System\zEckwuI.exe
  C:\Windows\System\zEckwuI.exe
  2⤵
  PID:6828
- C:\Windows\System\cZuxLRx.exe
  C:\Windows\System\cZuxLRx.exe
  2⤵
  PID:7052
- C:\Windows\System\ARiclIH.exe
  C:\Windows\System\ARiclIH.exe
  2⤵
  PID:7132
- C:\Windows\System\yoUoJbu.exe
  C:\Windows\System\yoUoJbu.exe
  2⤵
  PID:5728
- C:\Windows\System\UmIuamN.exe
  C:\Windows\System\UmIuamN.exe
  2⤵
  PID:6596
- C:\Windows\System\RjTcsnB.exe
  C:\Windows\System\RjTcsnB.exe
  2⤵
  PID:6740
- C:\Windows\System\FKhJSLB.exe
  C:\Windows\System\FKhJSLB.exe
  2⤵
  PID:6392
- C:\Windows\System\wrEbZpX.exe
  C:\Windows\System\wrEbZpX.exe
  2⤵
  PID:7176
- C:\Windows\System\duAVjJw.exe
  C:\Windows\System\duAVjJw.exe
  2⤵
  PID:7196
- C:\Windows\System\hiaDzZU.exe
  C:\Windows\System\hiaDzZU.exe
  2⤵
  PID:7212
- C:\Windows\System\lIhmdCE.exe
  C:\Windows\System\lIhmdCE.exe
  2⤵
  PID:7232
- C:\Windows\System\SBuKDbl.exe
  C:\Windows\System\SBuKDbl.exe
  2⤵
  PID:7252
- C:\Windows\System\SlcZJpP.exe
  C:\Windows\System\SlcZJpP.exe
  2⤵
  PID:7268
- C:\Windows\System\LxyfuEy.exe
  C:\Windows\System\LxyfuEy.exe
  2⤵
  PID:7284
- C:\Windows\System\WIDBvpM.exe
  C:\Windows\System\WIDBvpM.exe
  2⤵
  PID:7304
- C:\Windows\System\aMngFsK.exe
  C:\Windows\System\aMngFsK.exe
  2⤵
  PID:7324
- C:\Windows\System\PNhFnfs.exe
  C:\Windows\System\PNhFnfs.exe
  2⤵
  PID:7376
- C:\Windows\System\CVfqDWZ.exe
  C:\Windows\System\CVfqDWZ.exe
  2⤵
  PID:7424
- C:\Windows\System\dSSYWgy.exe
  C:\Windows\System\dSSYWgy.exe
  2⤵
  PID:7484
- C:\Windows\System\cbvllGL.exe
  C:\Windows\System\cbvllGL.exe
  2⤵
  PID:7516
- C:\Windows\System\FLjZyAH.exe
  C:\Windows\System\FLjZyAH.exe
  2⤵
  PID:7544
- C:\Windows\System\JVqwErM.exe
  C:\Windows\System\JVqwErM.exe
  2⤵
  PID:7560
- C:\Windows\System\bcmpIyl.exe
  C:\Windows\System\bcmpIyl.exe
  2⤵
  PID:7576
- C:\Windows\System\mkUYawF.exe
  C:\Windows\System\mkUYawF.exe
  2⤵
  PID:7628
- C:\Windows\System\LvBVtjh.exe
  C:\Windows\System\LvBVtjh.exe
  2⤵
  PID:7668
- C:\Windows\System\eKgNGtc.exe
  C:\Windows\System\eKgNGtc.exe
  2⤵
  PID:7696
- C:\Windows\System\wxKUpbg.exe
  C:\Windows\System\wxKUpbg.exe
  2⤵
  PID:7716
- C:\Windows\System\SiSBJbz.exe
  C:\Windows\System\SiSBJbz.exe
  2⤵
  PID:7740
- C:\Windows\System\bDlUfUD.exe
  C:\Windows\System\bDlUfUD.exe
  2⤵
  PID:7756
- C:\Windows\System\yzdQDBK.exe
  C:\Windows\System\yzdQDBK.exe
  2⤵
  PID:7780
- C:\Windows\System\iEUEiLN.exe
  C:\Windows\System\iEUEiLN.exe
  2⤵
  PID:7828
- C:\Windows\System\ZQipECD.exe
  C:\Windows\System\ZQipECD.exe
  2⤵
  PID:7868
- C:\Windows\System\sUhqxhM.exe
  C:\Windows\System\sUhqxhM.exe
  2⤵
  PID:7892
- C:\Windows\System\TeHKUbO.exe
  C:\Windows\System\TeHKUbO.exe
  2⤵
  PID:7912
- C:\Windows\System\iNOPHQA.exe
  C:\Windows\System\iNOPHQA.exe
  2⤵
  PID:7936
- C:\Windows\System\UZCvKbY.exe
  C:\Windows\System\UZCvKbY.exe
  2⤵
  PID:7972
- C:\Windows\System\olSCJxC.exe
  C:\Windows\System\olSCJxC.exe
  2⤵
  PID:7992
- C:\Windows\System\tDIDbzi.exe
  C:\Windows\System\tDIDbzi.exe
  2⤵
  PID:8012
- C:\Windows\System\EIlTRTv.exe
  C:\Windows\System\EIlTRTv.exe
  2⤵
  PID:8052
- C:\Windows\System\DbYsSFT.exe
  C:\Windows\System\DbYsSFT.exe
  2⤵
  PID:8076
- C:\Windows\System\XZhjMmp.exe
  C:\Windows\System\XZhjMmp.exe
  2⤵
  PID:8108
- C:\Windows\System\kYlffyj.exe
  C:\Windows\System\kYlffyj.exe
  2⤵
  PID:8132
- C:\Windows\System\ZXSQLuO.exe
  C:\Windows\System\ZXSQLuO.exe
  2⤵
  PID:8172
- C:\Windows\System\UoCtRQs.exe
  C:\Windows\System\UoCtRQs.exe
  2⤵
  PID:6516
- C:\Windows\System\hTqmVXQ.exe
  C:\Windows\System\hTqmVXQ.exe
  2⤵
  PID:7204
- C:\Windows\System\vTrnJkt.exe
  C:\Windows\System\vTrnJkt.exe
  2⤵
  PID:7244
- C:\Windows\System\dWbrSjw.exe
  C:\Windows\System\dWbrSjw.exe
  2⤵
  PID:7320
- C:\Windows\System\oNgOzFg.exe
  C:\Windows\System\oNgOzFg.exe
  2⤵
  PID:7412
- C:\Windows\System\PuTyPzT.exe
  C:\Windows\System\PuTyPzT.exe
  2⤵
  PID:7468
- C:\Windows\System\EnjlpDN.exe
  C:\Windows\System\EnjlpDN.exe
  2⤵
  PID:7444
- C:\Windows\System\gjruiDb.exe
  C:\Windows\System\gjruiDb.exe
  2⤵
  PID:7508
- C:\Windows\System\tqGEmtB.exe
  C:\Windows\System\tqGEmtB.exe
  2⤵
  PID:7680
- C:\Windows\System\slvfWjG.exe
  C:\Windows\System\slvfWjG.exe
  2⤵
  PID:7736
- C:\Windows\System\zioGfYd.exe
  C:\Windows\System\zioGfYd.exe
  2⤵
  PID:7800
- C:\Windows\System\smXkGaM.exe
  C:\Windows\System\smXkGaM.exe
  2⤵
  PID:7816
- C:\Windows\System\RxkDYdU.exe
  C:\Windows\System\RxkDYdU.exe
  2⤵
  PID:7884
- C:\Windows\System\yUWahWg.exe
  C:\Windows\System\yUWahWg.exe
  2⤵
  PID:7952
- C:\Windows\System\oqIrZQo.exe
  C:\Windows\System\oqIrZQo.exe
  2⤵
  PID:8060
- C:\Windows\System\CSJjXhf.exe
  C:\Windows\System\CSJjXhf.exe
  2⤵
  PID:8104
- C:\Windows\System\BaenWGr.exe
  C:\Windows\System\BaenWGr.exe
  2⤵
  PID:8152
- C:\Windows\System\JyfWvjT.exe
  C:\Windows\System\JyfWvjT.exe
  2⤵
  PID:8188
- C:\Windows\System\NsKlOFt.exe
  C:\Windows\System\NsKlOFt.exe
  2⤵
  PID:6836
- C:\Windows\System\TAUsYnp.exe
  C:\Windows\System\TAUsYnp.exe
  2⤵
  PID:7220
- C:\Windows\System\KYWVSiX.exe
  C:\Windows\System\KYWVSiX.exe
  2⤵
  PID:7296
- C:\Windows\System\AKVjSMH.exe
  C:\Windows\System\AKVjSMH.exe
  2⤵
  PID:7460
- C:\Windows\System\eWcanra.exe
  C:\Windows\System\eWcanra.exe
  2⤵
  PID:7708
- C:\Windows\System\ZMvVkNY.exe
  C:\Windows\System\ZMvVkNY.exe
  2⤵
  PID:7864
- C:\Windows\System\oxitKMG.exe
  C:\Windows\System\oxitKMG.exe
  2⤵
  PID:3252
- C:\Windows\System\sMmImkx.exe
  C:\Windows\System\sMmImkx.exe
  2⤵
  PID:8048
- C:\Windows\System\PfzJGvs.exe
  C:\Windows\System\PfzJGvs.exe
  2⤵
  PID:8128
- C:\Windows\System\UlBLiWW.exe
  C:\Windows\System\UlBLiWW.exe
  2⤵
  PID:7404
- C:\Windows\System\pBqjwDt.exe
  C:\Windows\System\pBqjwDt.exe
  2⤵
  PID:7184
- C:\Windows\System\UBSIfsT.exe
  C:\Windows\System\UBSIfsT.exe
  2⤵
  PID:7280
- C:\Windows\System\xzgTGEu.exe
  C:\Windows\System\xzgTGEu.exe
  2⤵
  PID:8200
- C:\Windows\System\ktmwnaR.exe
  C:\Windows\System\ktmwnaR.exe
  2⤵
  PID:8220
- C:\Windows\System\kQUlmbh.exe
  C:\Windows\System\kQUlmbh.exe
  2⤵
  PID:8240
- C:\Windows\System\HVhObxV.exe
  C:\Windows\System\HVhObxV.exe
  2⤵
  PID:8332
- C:\Windows\System\xFenNst.exe
  C:\Windows\System\xFenNst.exe
  2⤵
  PID:8352
- C:\Windows\System\XCWJffj.exe
  C:\Windows\System\XCWJffj.exe
  2⤵
  PID:8380
- C:\Windows\System\PnSrxLC.exe
  C:\Windows\System\PnSrxLC.exe
  2⤵
  PID:8396
- C:\Windows\System\jgVXGJF.exe
  C:\Windows\System\jgVXGJF.exe
  2⤵
  PID:8420
- C:\Windows\System\pKGwXOK.exe
  C:\Windows\System\pKGwXOK.exe
  2⤵
  PID:8480
- C:\Windows\System\FbTQWop.exe
  C:\Windows\System\FbTQWop.exe
  2⤵
  PID:8500
- C:\Windows\System\yexUJeu.exe
  C:\Windows\System\yexUJeu.exe
  2⤵
  PID:8516
- C:\Windows\System\FBNJxDO.exe
  C:\Windows\System\FBNJxDO.exe
  2⤵
  PID:8564
- C:\Windows\System\hBtpDMZ.exe
  C:\Windows\System\hBtpDMZ.exe
  2⤵
  PID:8648
- C:\Windows\System\JcmvmbA.exe
  C:\Windows\System\JcmvmbA.exe
  2⤵
  PID:8700
- C:\Windows\System\AXfwYvv.exe
  C:\Windows\System\AXfwYvv.exe
  2⤵
  PID:8724
- C:\Windows\System\VLfUzgD.exe
  C:\Windows\System\VLfUzgD.exe
  2⤵
  PID:8740
- C:\Windows\System\IWAzmLy.exe
  C:\Windows\System\IWAzmLy.exe
  2⤵
  PID:8768
- C:\Windows\System\xgiHYNG.exe
  C:\Windows\System\xgiHYNG.exe
  2⤵
  PID:8792
- C:\Windows\System\DLAxDhx.exe
  C:\Windows\System\DLAxDhx.exe
  2⤵
  PID:8808
- C:\Windows\System\pordkyE.exe
  C:\Windows\System\pordkyE.exe
  2⤵
  PID:8832
- C:\Windows\System\okttETj.exe
  C:\Windows\System\okttETj.exe
  2⤵
  PID:8852
- C:\Windows\System\eLKwvui.exe
  C:\Windows\System\eLKwvui.exe
  2⤵
  PID:8872
- C:\Windows\System\SqWHONZ.exe
  C:\Windows\System\SqWHONZ.exe
  2⤵
  PID:8928
- C:\Windows\System\NBmeDGz.exe
  C:\Windows\System\NBmeDGz.exe
  2⤵
  PID:8944
- C:\Windows\System\ZaJBgSp.exe
  C:\Windows\System\ZaJBgSp.exe
  2⤵
  PID:8964
- C:\Windows\System\ozlzUun.exe
  C:\Windows\System\ozlzUun.exe
  2⤵
  PID:8984
- C:\Windows\System\hoABHsk.exe
  C:\Windows\System\hoABHsk.exe
  2⤵
  PID:9004
- C:\Windows\System\uVCUgji.exe
  C:\Windows\System\uVCUgji.exe
  2⤵
  PID:9024
- C:\Windows\System\KOYNZXO.exe
  C:\Windows\System\KOYNZXO.exe
  2⤵
  PID:9084
- C:\Windows\System\csrADXr.exe
  C:\Windows\System\csrADXr.exe
  2⤵
  PID:9100
- C:\Windows\System\MlCvenw.exe
  C:\Windows\System\MlCvenw.exe
  2⤵
  PID:9128
- C:\Windows\System\LJCRaDn.exe
  C:\Windows\System\LJCRaDn.exe
  2⤵
  PID:9148
- C:\Windows\System\ywFvxsI.exe
  C:\Windows\System\ywFvxsI.exe
  2⤵
  PID:9184
- C:\Windows\System\aVmiVRu.exe
  C:\Windows\System\aVmiVRu.exe
  2⤵
  PID:9200
- C:\Windows\System\cYyfaRC.exe
  C:\Windows\System\cYyfaRC.exe
  2⤵
  PID:7772
- C:\Windows\System\uXjBAUM.exe
  C:\Windows\System\uXjBAUM.exe
  2⤵
  PID:8196
- C:\Windows\System\SvxXaGe.exe
  C:\Windows\System\SvxXaGe.exe
  2⤵
  PID:1076
- C:\Windows\System\tqOcmAY.exe
  C:\Windows\System\tqOcmAY.exe
  2⤵
  PID:7600
- C:\Windows\System\DueoaKf.exe
  C:\Windows\System\DueoaKf.exe
  2⤵
  PID:8216
- C:\Windows\System\qTTJyao.exe
  C:\Windows\System\qTTJyao.exe
  2⤵
  PID:8340
- C:\Windows\System\HIOYNTs.exe
  C:\Windows\System\HIOYNTs.exe
  2⤵
  PID:8524
- C:\Windows\System\Estkngk.exe
  C:\Windows\System\Estkngk.exe
  2⤵
  PID:8508
- C:\Windows\System\DEowrFN.exe
  C:\Windows\System\DEowrFN.exe
  2⤵
  PID:8636
- C:\Windows\System\jdIYnJF.exe
  C:\Windows\System\jdIYnJF.exe
  2⤵
  PID:8692
- C:\Windows\System\rhOMOle.exe
  C:\Windows\System\rhOMOle.exe
  2⤵
  PID:8624
- C:\Windows\System\MTQhSsy.exe
  C:\Windows\System\MTQhSsy.exe
  2⤵
  PID:8732
- C:\Windows\System\bszJPJk.exe
  C:\Windows\System\bszJPJk.exe
  2⤵
  PID:8800
- C:\Windows\System\ppWtlFt.exe
  C:\Windows\System\ppWtlFt.exe
  2⤵
  PID:8924
- C:\Windows\System\gkvcgNt.exe
  C:\Windows\System\gkvcgNt.exe
  2⤵
  PID:9092
- C:\Windows\System\lrHzdSo.exe
  C:\Windows\System\lrHzdSo.exe
  2⤵
  PID:9156
- C:\Windows\System\YcVSNRk.exe
  C:\Windows\System\YcVSNRk.exe
  2⤵
  PID:9192
- C:\Windows\System\rTBByyT.exe
  C:\Windows\System\rTBByyT.exe
  2⤵
  PID:7752
- C:\Windows\System\rGgiZVs.exe
  C:\Windows\System\rGgiZVs.exe
  2⤵
  PID:8276
- C:\Windows\System\qVShSRi.exe
  C:\Windows\System\qVShSRi.exe
  2⤵
  PID:7620
- C:\Windows\System\pItHvEB.exe
  C:\Windows\System\pItHvEB.exe
  2⤵
  PID:8344
- C:\Windows\System\fKmoEhM.exe
  C:\Windows\System\fKmoEhM.exe
  2⤵
  PID:8560
- C:\Windows\System\sKiEFiL.exe
  C:\Windows\System\sKiEFiL.exe
  2⤵
  PID:8688
- C:\Windows\System\jOmYBoV.exe
  C:\Windows\System\jOmYBoV.exe
  2⤵
  PID:8900
- C:\Windows\System\jfDIgBz.exe
  C:\Windows\System\jfDIgBz.exe
  2⤵
  PID:9080
- C:\Windows\System\cWRGMhs.exe
  C:\Windows\System\cWRGMhs.exe
  2⤵
  PID:8072
- C:\Windows\System\LQTIQPo.exe
  C:\Windows\System\LQTIQPo.exe
  2⤵
  PID:8760
- C:\Windows\System\ZFhfiED.exe
  C:\Windows\System\ZFhfiED.exe
  2⤵
  PID:1456
- C:\Windows\System\mvUoVCL.exe
  C:\Windows\System\mvUoVCL.exe
  2⤵
  PID:9240
- C:\Windows\System\omEinDs.exe
  C:\Windows\System\omEinDs.exe
  2⤵
  PID:9280
- C:\Windows\System\FtfYUta.exe
  C:\Windows\System\FtfYUta.exe
  2⤵
  PID:9296
- C:\Windows\System\zJNLwrE.exe
  C:\Windows\System\zJNLwrE.exe
  2⤵
  PID:9320
- C:\Windows\System\ctpPafe.exe
  C:\Windows\System\ctpPafe.exe
  2⤵
  PID:9340
- C:\Windows\System\kNKzHMa.exe
  C:\Windows\System\kNKzHMa.exe
  2⤵
  PID:9380
- C:\Windows\System\NSqyMco.exe
  C:\Windows\System\NSqyMco.exe
  2⤵
  PID:9396
- C:\Windows\System\fVJongr.exe
  C:\Windows\System\fVJongr.exe
  2⤵
  PID:9428
- C:\Windows\System\ctzCnTB.exe
  C:\Windows\System\ctzCnTB.exe
  2⤵
  PID:9444
- C:\Windows\System\ZAEwgMS.exe
  C:\Windows\System\ZAEwgMS.exe
  2⤵
  PID:9468
- C:\Windows\System\skFisbX.exe
  C:\Windows\System\skFisbX.exe
  2⤵
  PID:9500
- C:\Windows\System\OUxNFug.exe
  C:\Windows\System\OUxNFug.exe
  2⤵
  PID:9536
- C:\Windows\System\XfDZaqu.exe
  C:\Windows\System\XfDZaqu.exe
  2⤵
  PID:9604
- C:\Windows\System\BnYHxIH.exe
  C:\Windows\System\BnYHxIH.exe
  2⤵
  PID:9620
- C:\Windows\System\MLjjuoO.exe
  C:\Windows\System\MLjjuoO.exe
  2⤵
  PID:9636
- C:\Windows\System\VKNEEvF.exe
  C:\Windows\System\VKNEEvF.exe
  2⤵
  PID:9652
- C:\Windows\System\CxTdIAx.exe
  C:\Windows\System\CxTdIAx.exe
  2⤵
  PID:9696
- C:\Windows\System\VyVbNNu.exe
  C:\Windows\System\VyVbNNu.exe
  2⤵
  PID:9732
- C:\Windows\System\axhIwCn.exe
  C:\Windows\System\axhIwCn.exe
  2⤵
  PID:9772
- C:\Windows\System\yGyDZJi.exe
  C:\Windows\System\yGyDZJi.exe
  2⤵
  PID:9788
- C:\Windows\System\DhtzYaI.exe
  C:\Windows\System\DhtzYaI.exe
  2⤵
  PID:9804
- C:\Windows\System\vwSPodO.exe
  C:\Windows\System\vwSPodO.exe
  2⤵
  PID:9832
- C:\Windows\System\zTMgZRZ.exe
  C:\Windows\System\zTMgZRZ.exe
  2⤵
  PID:9856
- C:\Windows\System\UWHCssX.exe
  C:\Windows\System\UWHCssX.exe
  2⤵
  PID:9876
- C:\Windows\System\DJvtWGH.exe
  C:\Windows\System\DJvtWGH.exe
  2⤵
  PID:9956
- C:\Windows\System\PwXoRgA.exe
  C:\Windows\System\PwXoRgA.exe
  2⤵
  PID:9976
- C:\Windows\System\PKUNYHU.exe
  C:\Windows\System\PKUNYHU.exe
  2⤵
  PID:9992
- C:\Windows\System\BwUsueJ.exe
  C:\Windows\System\BwUsueJ.exe
  2⤵
  PID:10016
- C:\Windows\System\wFkyhlG.exe
  C:\Windows\System\wFkyhlG.exe
  2⤵
  PID:10032
- C:\Windows\System\xJrOCCl.exe
  C:\Windows\System\xJrOCCl.exe
  2⤵
  PID:10064
- C:\Windows\System\BynabKj.exe
  C:\Windows\System\BynabKj.exe
  2⤵
  PID:10084
- C:\Windows\System\aBkXJfP.exe
  C:\Windows\System\aBkXJfP.exe
  2⤵
  PID:10100
- C:\Windows\System\OqpSkzD.exe
  C:\Windows\System\OqpSkzD.exe
  2⤵
  PID:10124
- C:\Windows\System\wDZSkoW.exe
  C:\Windows\System\wDZSkoW.exe
  2⤵
  PID:10140
- C:\Windows\System\gLzcCIQ.exe
  C:\Windows\System\gLzcCIQ.exe
  2⤵
  PID:8468
- C:\Windows\System\XkjdEpd.exe
  C:\Windows\System\XkjdEpd.exe
  2⤵
  PID:9376
- C:\Windows\System\NddEobV.exe
  C:\Windows\System\NddEobV.exe
  2⤵
  PID:9512
- C:\Windows\System\LSCBhkj.exe
  C:\Windows\System\LSCBhkj.exe
  2⤵
  PID:9420
- C:\Windows\System\PtWNjzQ.exe
  C:\Windows\System\PtWNjzQ.exe
  2⤵
  PID:9456
- C:\Windows\System\YpcIWiN.exe
  C:\Windows\System\YpcIWiN.exe
  2⤵
  PID:9704
- C:\Windows\System\qKVkDdq.exe
  C:\Windows\System\qKVkDdq.exe
  2⤵
  PID:9516
- C:\Windows\System\rHRndou.exe
  C:\Windows\System\rHRndou.exe
  2⤵
  PID:9720
- C:\Windows\System\ilTVwBO.exe
  C:\Windows\System\ilTVwBO.exe
  2⤵
  PID:9868
- C:\Windows\System\phfLXvM.exe
  C:\Windows\System\phfLXvM.exe
  2⤵
  PID:9648
- C:\Windows\System\ODleLYm.exe
  C:\Windows\System\ODleLYm.exe
  2⤵
  PID:9644
- C:\Windows\System\dBVJvIy.exe
  C:\Windows\System\dBVJvIy.exe
  2⤵
  PID:9796
- C:\Windows\System\pmIQpiE.exe
  C:\Windows\System\pmIQpiE.exe
  2⤵
  PID:9900
- C:\Windows\System\xqRqGad.exe
  C:\Windows\System\xqRqGad.exe
  2⤵
  PID:9988
- C:\Windows\System\imMlUnn.exe
  C:\Windows\System\imMlUnn.exe
  2⤵
  PID:10012
- C:\Windows\System\uZBeRTq.exe
  C:\Windows\System\uZBeRTq.exe
  2⤵
  PID:10148
- C:\Windows\System\klXnVDa.exe
  C:\Windows\System\klXnVDa.exe
  2⤵
  PID:10208
- C:\Windows\System\ZjbLJdo.exe
  C:\Windows\System\ZjbLJdo.exe
  2⤵
  PID:9968
- C:\Windows\System\tzUjghd.exe
  C:\Windows\System\tzUjghd.exe
  2⤵
  PID:8752
- C:\Windows\System\BLFlWbB.exe
  C:\Windows\System\BLFlWbB.exe
  2⤵
  PID:8916
- C:\Windows\System\YKhkUYh.exe
  C:\Windows\System\YKhkUYh.exe
  2⤵
  PID:10132
- C:\Windows\System\YTXdnPt.exe
  C:\Windows\System\YTXdnPt.exe
  2⤵
  PID:9316
- C:\Windows\System\cEQeLvy.exe
  C:\Windows\System\cEQeLvy.exe
  2⤵
  PID:9932
- C:\Windows\System\pwRPBGh.exe
  C:\Windows\System\pwRPBGh.exe
  2⤵
  PID:9724
- C:\Windows\System\GKyilbf.exe
  C:\Windows\System\GKyilbf.exe
  2⤵
  PID:9812
- C:\Windows\System\YrqfpAE.exe
  C:\Windows\System\YrqfpAE.exe
  2⤵
  PID:9816
- C:\Windows\System\pfTuyNZ.exe
  C:\Windows\System\pfTuyNZ.exe
  2⤵
  PID:10136
- C:\Windows\System\gbFVMTz.exe
  C:\Windows\System\gbFVMTz.exe
  2⤵
  PID:10244
- C:\Windows\System\VvZOCym.exe
  C:\Windows\System\VvZOCym.exe
  2⤵
  PID:10260
- C:\Windows\System\ELfCGeC.exe
  C:\Windows\System\ELfCGeC.exe
  2⤵
  PID:10300
- C:\Windows\System\vkENvvI.exe
  C:\Windows\System\vkENvvI.exe
  2⤵
  PID:10320
- C:\Windows\System\ndRmPJK.exe
  C:\Windows\System\ndRmPJK.exe
  2⤵
  PID:10340
- C:\Windows\System\ZWfpbkK.exe
  C:\Windows\System\ZWfpbkK.exe
  2⤵
  PID:10356
- C:\Windows\System\exRGmCr.exe
  C:\Windows\System\exRGmCr.exe
  2⤵
  PID:10384
- C:\Windows\System\CDGPlaU.exe
  C:\Windows\System\CDGPlaU.exe
  2⤵
  PID:10404
- C:\Windows\System\poxFpYn.exe
  C:\Windows\System\poxFpYn.exe
  2⤵
  PID:10420
- C:\Windows\System\cJtLDwV.exe
  C:\Windows\System\cJtLDwV.exe
  2⤵
  PID:10444
- C:\Windows\System\luStwJF.exe
  C:\Windows\System\luStwJF.exe
  2⤵
  PID:10492
- C:\Windows\System\hPluDZn.exe
  C:\Windows\System\hPluDZn.exe
  2⤵
  PID:10512
- C:\Windows\System\puefHuB.exe
  C:\Windows\System\puefHuB.exe
  2⤵
  PID:10612
- C:\Windows\System\Wxqcgdu.exe
  C:\Windows\System\Wxqcgdu.exe
  2⤵
  PID:10628
- C:\Windows\System\KEYayCp.exe
  C:\Windows\System\KEYayCp.exe
  2⤵
  PID:10656
- C:\Windows\System\tpAknpo.exe
  C:\Windows\System\tpAknpo.exe
  2⤵
  PID:10680
- C:\Windows\System\CQAIoyB.exe
  C:\Windows\System\CQAIoyB.exe
  2⤵
  PID:10700
- C:\Windows\System\RiNxhVx.exe
  C:\Windows\System\RiNxhVx.exe
  2⤵
  PID:10728
- C:\Windows\System\XpwPamS.exe
  C:\Windows\System\XpwPamS.exe
  2⤵
  PID:10756
- C:\Windows\System\lrBvbGh.exe
  C:\Windows\System\lrBvbGh.exe
  2⤵
  PID:10792
- C:\Windows\System\zaJLXJi.exe
  C:\Windows\System\zaJLXJi.exe
  2⤵
  PID:10816
- C:\Windows\System\gEoPggv.exe
  C:\Windows\System\gEoPggv.exe
  2⤵
  PID:10844
- C:\Windows\System\gpsTkzi.exe
  C:\Windows\System\gpsTkzi.exe
  2⤵
  PID:10904
- C:\Windows\System\xJlPuQg.exe
  C:\Windows\System\xJlPuQg.exe
  2⤵
  PID:10924
- C:\Windows\System\BYSJJXy.exe
  C:\Windows\System\BYSJJXy.exe
  2⤵
  PID:10964
- C:\Windows\System\BnbKeiQ.exe
  C:\Windows\System\BnbKeiQ.exe
  2⤵
  PID:10988
- C:\Windows\System\JEgLiam.exe
  C:\Windows\System\JEgLiam.exe
  2⤵
  PID:11004
- C:\Windows\System\kelcxYs.exe
  C:\Windows\System\kelcxYs.exe
  2⤵
  PID:11044
- C:\Windows\System\UEaxOBC.exe
  C:\Windows\System\UEaxOBC.exe
  2⤵
  PID:11064
- C:\Windows\System\FicmRVx.exe
  C:\Windows\System\FicmRVx.exe
  2⤵
  PID:11080
- C:\Windows\System\vGwxCjO.exe
  C:\Windows\System\vGwxCjO.exe
  2⤵
  PID:11104
- C:\Windows\System\FkzhiNV.exe
  C:\Windows\System\FkzhiNV.exe
  2⤵
  PID:11120
- C:\Windows\System\XYKFpLm.exe
  C:\Windows\System\XYKFpLm.exe
  2⤵
  PID:11136
- C:\Windows\System\aYFBVax.exe
  C:\Windows\System\aYFBVax.exe
  2⤵
  PID:11160
- C:\Windows\System\ycoqHTZ.exe
  C:\Windows\System\ycoqHTZ.exe
  2⤵
  PID:11180
- C:\Windows\System\HnKKQdV.exe
  C:\Windows\System\HnKKQdV.exe
  2⤵
  PID:11244
- C:\Windows\System\MHjVaoX.exe
  C:\Windows\System\MHjVaoX.exe
  2⤵
  PID:9392
- C:\Windows\System\KeBuBJb.exe
  C:\Windows\System\KeBuBJb.exe
  2⤵
  PID:10116
- C:\Windows\System\JiBRZXb.exe
  C:\Windows\System\JiBRZXb.exe
  2⤵
  PID:10080
- C:\Windows\System\AoPrtAC.exe
  C:\Windows\System\AoPrtAC.exe
  2⤵
  PID:10288
- C:\Windows\System\chFlsNV.exe
  C:\Windows\System\chFlsNV.exe
  2⤵
  PID:10336
- C:\Windows\System\nNaBYJP.exe
  C:\Windows\System\nNaBYJP.exe
  2⤵
  PID:10468
- C:\Windows\System\lUpvnmX.exe
  C:\Windows\System\lUpvnmX.exe
  2⤵
  PID:10436
- C:\Windows\System\ZxiwqyL.exe
  C:\Windows\System\ZxiwqyL.exe
  2⤵
  PID:10488
- C:\Windows\System\HHHIcBy.exe
  C:\Windows\System\HHHIcBy.exe
  2⤵
  PID:10548
- C:\Windows\System\FqQJEwL.exe
  C:\Windows\System\FqQJEwL.exe
  2⤵
  PID:10540
- C:\Windows\System\GpDqVvD.exe
  C:\Windows\System\GpDqVvD.exe
  2⤵
  PID:10648
- C:\Windows\System\IUhzgwc.exe
  C:\Windows\System\IUhzgwc.exe
  2⤵
  PID:10720
- C:\Windows\System\ncAUhCj.exe
  C:\Windows\System\ncAUhCj.exe
  2⤵
  PID:10748
- C:\Windows\System\ocpPsmk.exe
  C:\Windows\System\ocpPsmk.exe
  2⤵
  PID:10912
- C:\Windows\System\ISxcfYB.exe
  C:\Windows\System\ISxcfYB.exe
  2⤵
  PID:10976
- C:\Windows\System\McyVwWq.exe
  C:\Windows\System\McyVwWq.exe
  2⤵
  PID:11092
- C:\Windows\System\RVrWZlp.exe
  C:\Windows\System\RVrWZlp.exe
  2⤵
  PID:11152
- C:\Windows\System\AeAhJfe.exe
  C:\Windows\System\AeAhJfe.exe
  2⤵
  PID:11256
- C:\Windows\System\cHLkbOX.exe
  C:\Windows\System\cHLkbOX.exe
  2⤵
  PID:9676
- C:\Windows\System\YjynoTM.exe
  C:\Windows\System\YjynoTM.exe
  2⤵
  PID:10428
- C:\Windows\System\DXFqFhD.exe
  C:\Windows\System\DXFqFhD.exe
  2⤵
  PID:10372
- C:\Windows\System\rjFmAAO.exe
  C:\Windows\System\rjFmAAO.exe
  2⤵
  PID:10572
- C:\Windows\System\vzrThJE.exe
  C:\Windows\System\vzrThJE.exe
  2⤵
  PID:10620
- C:\Windows\System\vstdYZb.exe
  C:\Windows\System\vstdYZb.exe
  2⤵
  PID:10832
- C:\Windows\System\RnwtTrs.exe
  C:\Windows\System\RnwtTrs.exe
  2⤵
  PID:9292
- C:\Windows\System\oePhbqO.exe
  C:\Windows\System\oePhbqO.exe
  2⤵
  PID:9664
- C:\Windows\System\GMLvaiL.exe
  C:\Windows\System\GMLvaiL.exe
  2⤵
  PID:10576
- C:\Windows\System\hsKvrlY.exe
  C:\Windows\System\hsKvrlY.exe
  2⤵
  PID:10556
- C:\Windows\System\dUOoHDk.exe
  C:\Windows\System\dUOoHDk.exe
  2⤵
  PID:10828
- C:\Windows\System\FobucJY.exe
  C:\Windows\System\FobucJY.exe
  2⤵
  PID:10412
- C:\Windows\System\ZDlHrbn.exe
  C:\Windows\System\ZDlHrbn.exe
  2⤵
  PID:11284
- C:\Windows\System\pZmXQhw.exe
  C:\Windows\System\pZmXQhw.exe
  2⤵
  PID:11304
- C:\Windows\System\kFwtHHp.exe
  C:\Windows\System\kFwtHHp.exe
  2⤵
  PID:11320
- C:\Windows\System\hfcjxsc.exe
  C:\Windows\System\hfcjxsc.exe
  2⤵
  PID:11340
- C:\Windows\System\yNhezvN.exe
  C:\Windows\System\yNhezvN.exe
  2⤵
  PID:11356
- C:\Windows\System\PbZVJMD.exe
  C:\Windows\System\PbZVJMD.exe
  2⤵
  PID:11376
- C:\Windows\System\KbhIGGi.exe
  C:\Windows\System\KbhIGGi.exe
  2⤵
  PID:11392
- C:\Windows\System\UeenDXD.exe
  C:\Windows\System\UeenDXD.exe
  2⤵
  PID:11428
- C:\Windows\System\BQTJUGn.exe
  C:\Windows\System\BQTJUGn.exe
  2⤵
  PID:11452
- C:\Windows\System\ztMjlgw.exe
  C:\Windows\System\ztMjlgw.exe
  2⤵
  PID:11468
- C:\Windows\System\fycRerJ.exe
  C:\Windows\System\fycRerJ.exe
  2⤵
  PID:11492
- C:\Windows\System\hhEcJmp.exe
  C:\Windows\System\hhEcJmp.exe
  2⤵
  PID:11528
- C:\Windows\System\DkAYRXO.exe
  C:\Windows\System\DkAYRXO.exe
  2⤵
  PID:11548
- C:\Windows\System\GZbmEUm.exe
  C:\Windows\System\GZbmEUm.exe
  2⤵
  PID:11568
- C:\Windows\System\ylNDtKR.exe
  C:\Windows\System\ylNDtKR.exe
  2⤵
  PID:11588
- C:\Windows\System\zXtpwVx.exe
  C:\Windows\System\zXtpwVx.exe
  2⤵
  PID:11636
- C:\Windows\System\oqFRByI.exe
  C:\Windows\System\oqFRByI.exe
  2⤵
  PID:11664
- C:\Windows\System\rBnpXGl.exe
  C:\Windows\System\rBnpXGl.exe
  2⤵
  PID:11684
- C:\Windows\System\IzNficL.exe
  C:\Windows\System\IzNficL.exe
  2⤵
  PID:11744
- C:\Windows\System\bvraLKi.exe
  C:\Windows\System\bvraLKi.exe
  2⤵
  PID:11792
- C:\Windows\System\xaEQtGA.exe
  C:\Windows\System\xaEQtGA.exe
  2⤵
  PID:11848
- C:\Windows\System\letLnMK.exe
  C:\Windows\System\letLnMK.exe
  2⤵
  PID:11884
- C:\Windows\System\fgbkpqR.exe
  C:\Windows\System\fgbkpqR.exe
  2⤵
  PID:11912
- C:\Windows\System\JRArUsY.exe
  C:\Windows\System\JRArUsY.exe
  2⤵
  PID:11928
- C:\Windows\System\bPAjrUS.exe
  C:\Windows\System\bPAjrUS.exe
  2⤵
  PID:11976
- C:\Windows\System\xUkMtgc.exe
  C:\Windows\System\xUkMtgc.exe
  2⤵
  PID:11996
- C:\Windows\System\HOswkpt.exe
  C:\Windows\System\HOswkpt.exe
  2⤵
  PID:12016
- C:\Windows\System\LaqzoYG.exe
  C:\Windows\System\LaqzoYG.exe
  2⤵
  PID:12036
- C:\Windows\System\dzendhW.exe
  C:\Windows\System\dzendhW.exe
  2⤵
  PID:12056
- C:\Windows\System\UYWzItc.exe
  C:\Windows\System\UYWzItc.exe
  2⤵
  PID:12092
- C:\Windows\System\ZDFxqqL.exe
  C:\Windows\System\ZDFxqqL.exe
  2⤵
  PID:12136
- C:\Windows\System\mLmjnwQ.exe
  C:\Windows\System\mLmjnwQ.exe
  2⤵
  PID:12156
- C:\Windows\System\QwjKGuA.exe
  C:\Windows\System\QwjKGuA.exe
  2⤵
  PID:12176
- C:\Windows\System\BMgWaYT.exe
  C:\Windows\System\BMgWaYT.exe
  2⤵
  PID:12196
- C:\Windows\System\qohPNzM.exe
  C:\Windows\System\qohPNzM.exe
  2⤵
  PID:12228
- C:\Windows\System\dhtABsR.exe
  C:\Windows\System\dhtABsR.exe
  2⤵
  PID:12272
- C:\Windows\System\eQRxRLN.exe
  C:\Windows\System\eQRxRLN.exe
  2⤵
  PID:10364
- C:\Windows\System\ahIlPYU.exe
  C:\Windows\System\ahIlPYU.exe
  2⤵
  PID:11176
- C:\Windows\System\ZQJqKnO.exe
  C:\Windows\System\ZQJqKnO.exe
  2⤵
  PID:11336
- C:\Windows\System\MaBNCCg.exe
  C:\Windows\System\MaBNCCg.exe
  2⤵
  PID:11364
- C:\Windows\System\kCREoPC.exe
  C:\Windows\System\kCREoPC.exe
  2⤵
  PID:11448
- C:\Windows\System\NVfdHQE.exe
  C:\Windows\System\NVfdHQE.exe
  2⤵
  PID:11608
- C:\Windows\System\EOoXzPS.exe
  C:\Windows\System\EOoXzPS.exe
  2⤵
  PID:11408
- C:\Windows\System\weLfbZY.exe
  C:\Windows\System\weLfbZY.exe
  2⤵
  PID:11580
- C:\Windows\System\fdwexux.exe
  C:\Windows\System\fdwexux.exe
  2⤵
  PID:11656
- C:\Windows\System\nLNKZeD.exe
  C:\Windows\System\nLNKZeD.exe
  2⤵
  PID:11780
- C:\Windows\System\SvgflFD.exe
  C:\Windows\System\SvgflFD.exe
  2⤵
  PID:11836
- C:\Windows\System\WoVkbVI.exe
  C:\Windows\System\WoVkbVI.exe
  2⤵
  PID:11920
- C:\Windows\System\qYkCzVO.exe
  C:\Windows\System\qYkCzVO.exe
  2⤵
  PID:11908
- C:\Windows\System\rSxVlrr.exe
  C:\Windows\System\rSxVlrr.exe
  2⤵
  PID:11988
- C:\Windows\System\fAAZxzV.exe
  C:\Windows\System\fAAZxzV.exe
  2⤵
  PID:12012
- C:\Windows\System\AneZSpx.exe
  C:\Windows\System\AneZSpx.exe
  2⤵
  PID:12112
- C:\Windows\System\szJdXUJ.exe
  C:\Windows\System\szJdXUJ.exe
  2⤵
  PID:12168
- C:\Windows\System\tlfSHyo.exe
  C:\Windows\System\tlfSHyo.exe
  2⤵
  PID:12260
- C:\Windows\System\ynXHOpE.exe
  C:\Windows\System\ynXHOpE.exe
  2⤵
  PID:9756
- C:\Windows\System\AKQirSZ.exe
  C:\Windows\System\AKQirSZ.exe
  2⤵
  PID:11276
- C:\Windows\System\ZhWUGis.exe
  C:\Windows\System\ZhWUGis.exe
  2⤵
  PID:11464
- C:\Windows\System\vHjxoTy.exe
  C:\Windows\System\vHjxoTy.exe
  2⤵
  PID:11724
- C:\Windows\System\DoKWSbf.exe
  C:\Windows\System\DoKWSbf.exe
  2⤵
  PID:12152
- C:\Windows\System\SVFtLLs.exe
  C:\Windows\System\SVFtLLs.exe
  2⤵
  PID:12244
- C:\Windows\System\ItVjKtl.exe
  C:\Windows\System\ItVjKtl.exe
  2⤵
  PID:11436
- C:\Windows\System\jzIiJVR.exe
  C:\Windows\System\jzIiJVR.exe
  2⤵
  PID:11876
- C:\Windows\System\BlIQrYt.exe
  C:\Windows\System\BlIQrYt.exe
  2⤵
  PID:10752
- C:\Windows\System\kyEZKcU.exe
  C:\Windows\System\kyEZKcU.exe
  2⤵
  PID:11984
- C:\Windows\System\IQWPHkA.exe
  C:\Windows\System\IQWPHkA.exe
  2⤵
  PID:12312
- C:\Windows\System\LNMWQJL.exe
  C:\Windows\System\LNMWQJL.exe
  2⤵
  PID:12328
- C:\Windows\System\PLYaXFJ.exe
  C:\Windows\System\PLYaXFJ.exe
  2⤵
  PID:12380
- C:\Windows\System\dDLGBCW.exe
  C:\Windows\System\dDLGBCW.exe
  2⤵
  PID:12400
- C:\Windows\System\uZPiNyu.exe
  C:\Windows\System\uZPiNyu.exe
  2⤵
  PID:12424
- C:\Windows\System\VNwzULP.exe
  C:\Windows\System\VNwzULP.exe
  2⤵
  PID:12456
- C:\Windows\System\kpybcZN.exe
  C:\Windows\System\kpybcZN.exe
  2⤵
  PID:12472
- C:\Windows\System\qkjuSmS.exe
  C:\Windows\System\qkjuSmS.exe
  2⤵
  PID:12496
- C:\Windows\System\XADHZOP.exe
  C:\Windows\System\XADHZOP.exe
  2⤵
  PID:12524
- C:\Windows\System\wKogVlI.exe
  C:\Windows\System\wKogVlI.exe
  2⤵
  PID:12544
- C:\Windows\System\APlNZIC.exe
  C:\Windows\System\APlNZIC.exe
  2⤵
  PID:12572
- C:\Windows\System\RlwshLn.exe
  C:\Windows\System\RlwshLn.exe
  2⤵
  PID:12596
- C:\Windows\System\owlKaKR.exe
  C:\Windows\System\owlKaKR.exe
  2⤵
  PID:12612
- C:\Windows\System\wbGLdTm.exe
  C:\Windows\System\wbGLdTm.exe
  2⤵
  PID:12640
- C:\Windows\System\HqwmIYQ.exe
  C:\Windows\System\HqwmIYQ.exe
  2⤵
  PID:12660
- C:\Windows\System\ciJEgwa.exe
  C:\Windows\System\ciJEgwa.exe
  2⤵
  PID:12684
- C:\Windows\System\LNKuTJU.exe
  C:\Windows\System\LNKuTJU.exe
  2⤵
  PID:12700
- C:\Windows\System\imfUeco.exe
  C:\Windows\System\imfUeco.exe
  2⤵
  PID:12716
- C:\Windows\System\anoBAEx.exe
  C:\Windows\System\anoBAEx.exe
  2⤵
  PID:12764
- C:\Windows\System\FdAyTvh.exe
  C:\Windows\System\FdAyTvh.exe
  2⤵
  PID:12844
- C:\Windows\System\CPDyyKi.exe
  C:\Windows\System\CPDyyKi.exe
  2⤵
  PID:12900
- C:\Windows\System\ZiGImqC.exe
  C:\Windows\System\ZiGImqC.exe
  2⤵
  PID:12904
- C:\Windows\System\CJfqYGF.exe
  C:\Windows\System\CJfqYGF.exe
  2⤵
  PID:12916
- C:\Windows\System\KmnHNTF.exe
  C:\Windows\System\KmnHNTF.exe
  2⤵
  PID:12936
- C:\Windows\System\DUijlKN.exe
  C:\Windows\System\DUijlKN.exe
  2⤵
  PID:12976
- C:\Windows\System\bTSOoVM.exe
  C:\Windows\System\bTSOoVM.exe
  2⤵
  PID:12972
- C:\Windows\System\XRVOOoS.exe
  C:\Windows\System\XRVOOoS.exe
  2⤵
  PID:13000
- C:\Windows\System\heCJyid.exe
  C:\Windows\System\heCJyid.exe
  2⤵
  PID:13016
- C:\Windows\System\YpWPXLJ.exe
  C:\Windows\System\YpWPXLJ.exe
  2⤵
  PID:13040
- C:\Windows\System\poxITWB.exe
  C:\Windows\System\poxITWB.exe
  2⤵
  PID:13056
- C:\Windows\System\AahzIeT.exe
  C:\Windows\System\AahzIeT.exe
  2⤵
  PID:13108
- C:\Windows\System\TWqucxv.exe
  C:\Windows\System\TWqucxv.exe
  2⤵
  PID:13128
- C:\Windows\System\qfMxzEy.exe
  C:\Windows\System\qfMxzEy.exe
  2⤵
  PID:3760
- C:\Windows\System\gghrIQN.exe
  C:\Windows\System\gghrIQN.exe
  2⤵
  PID:13132
- C:\Windows\System\otsQuHA.exe
  C:\Windows\System\otsQuHA.exe
  2⤵
  PID:13156
- C:\Windows\System\PUDsZTw.exe
  C:\Windows\System\PUDsZTw.exe
  2⤵
  PID:12736
- C:\Windows\System\egOvQYb.exe
  C:\Windows\System\egOvQYb.exe
  2⤵
  PID:3428
- C:\Windows\System\sIySUdl.exe
  C:\Windows\System\sIySUdl.exe
  2⤵
  PID:12884
- C:\Windows\System\NmTgLOt.exe
  C:\Windows\System\NmTgLOt.exe
  2⤵
  PID:12920
- C:\Windows\System\uZyTlas.exe
  C:\Windows\System\uZyTlas.exe
  2⤵
  PID:12964
- C:\Windows\System\AZCsFlw.exe
  C:\Windows\System\AZCsFlw.exe
  2⤵
  PID:12996
- C:\Windows\System\cUDrkVh.exe
  C:\Windows\System\cUDrkVh.exe
  2⤵
  PID:13028
- C:\Windows\System\uPFROTD.exe
  C:\Windows\System\uPFROTD.exe
  2⤵
  PID:13092
- C:\Windows\System\vGlyHJZ.exe
  C:\Windows\System\vGlyHJZ.exe
  2⤵
  PID:13116
- C:\Windows\System\AWiUQMM.exe
  C:\Windows\System\AWiUQMM.exe
  2⤵
  PID:13168
- C:\Windows\System\NskDwQf.exe
  C:\Windows\System\NskDwQf.exe
  2⤵
  PID:13188
- C:\Windows\System\tkgWHEK.exe
  C:\Windows\System\tkgWHEK.exe
  2⤵
  PID:13200
- C:\Windows\System\XhBmwTv.exe
  C:\Windows\System\XhBmwTv.exe
  2⤵
  PID:13224
- C:\Windows\System\dbasRki.exe
  C:\Windows\System\dbasRki.exe
  2⤵
  PID:13244
- C:\Windows\System\HsTvOrK.exe
  C:\Windows\System\HsTvOrK.exe
  2⤵
  PID:13256
- C:\Windows\System\ozJDNDG.exe
  C:\Windows\System\ozJDNDG.exe
  2⤵
  PID:13276
- C:\Windows\System\yQnVUTT.exe
  C:\Windows\System\yQnVUTT.exe
  2⤵
  PID:12740
- C:\Windows\System\DCFfZwN.exe
  C:\Windows\System\DCFfZwN.exe
  2⤵
  PID:11352
- C:\Windows\System\ivKwNTe.exe
  C:\Windows\System\ivKwNTe.exe
  2⤵
  PID:13296
- C:\Windows\System\pjsCkdb.exe
  C:\Windows\System\pjsCkdb.exe
  2⤵
  PID:12084
- C:\Windows\System\wNwHlgz.exe
  C:\Windows\System\wNwHlgz.exe
  2⤵
  PID:12296
- C:\Windows\System\kUKxJPq.exe
  C:\Windows\System\kUKxJPq.exe
  2⤵
  PID:12408
- C:\Windows\System\ZzbgTfA.exe
  C:\Windows\System\ZzbgTfA.exe
  2⤵
  PID:12396
- C:\Windows\System\WJCZugZ.exe
  C:\Windows\System\WJCZugZ.exe
  2⤵
  PID:12468
- C:\Windows\System\aQadmvF.exe
  C:\Windows\System\aQadmvF.exe
  2⤵
  PID:12448
- C:\Windows\System\ebizZaj.exe
  C:\Windows\System\ebizZaj.exe
  2⤵
  PID:4060
- C:\Windows\System\AHwWuWx.exe
  C:\Windows\System\AHwWuWx.exe
  2⤵
  PID:12588
- C:\Windows\System\QNibwvS.exe
  C:\Windows\System\QNibwvS.exe
  2⤵
  PID:12748
- C:\Windows\System\OljbPpu.exe
  C:\Windows\System\OljbPpu.exe
  2⤵
  PID:3388
- C:\Windows\System\xJbguGW.exe
  C:\Windows\System\xJbguGW.exe
  2⤵
  PID:3788
- C:\Windows\System\DzJScBn.exe
  C:\Windows\System\DzJScBn.exe
  2⤵
  PID:13024
- C:\Windows\System\PJrfsDW.exe
  C:\Windows\System\PJrfsDW.exe
  2⤵
  PID:13068
- C:\Windows\System\hDItJzV.exe
  C:\Windows\System\hDItJzV.exe
  2⤵
  PID:13216
- C:\Windows\System\MLmxKPU.exe
  C:\Windows\System\MLmxKPU.exe
  2⤵
  PID:13300
- C:\Windows\System\GFufZii.exe
  C:\Windows\System\GFufZii.exe
  2⤵
  PID:1052
- C:\Windows\System\OqoiWhN.exe
  C:\Windows\System\OqoiWhN.exe
  2⤵
  PID:4984
- C:\Windows\System\kkrTrMS.exe
  C:\Windows\System\kkrTrMS.exe
  2⤵
  PID:812
- C:\Windows\System\jWZkcTE.exe
  C:\Windows\System\jWZkcTE.exe
  2⤵
  PID:12604
- C:\Windows\System\yqlSfKy.exe
  C:\Windows\System\yqlSfKy.exe
  2⤵
  PID:7264
- C:\Windows\System\YQWrhbJ.exe
  C:\Windows\System\YQWrhbJ.exe
  2⤵
  PID:12992
- C:\Windows\System\SSmpPmj.exe
  C:\Windows\System\SSmpPmj.exe
  2⤵
  PID:12680
- C:\Windows\System\QkzEXgU.exe
  C:\Windows\System\QkzEXgU.exe
  2⤵
  PID:13120
- C:\Windows\System\BHhqvXC.exe
  C:\Windows\System\BHhqvXC.exe
  2⤵
  PID:13220
- C:\Windows\System\fOyJJKt.exe
  C:\Windows\System\fOyJJKt.exe
  2⤵
  PID:528
- C:\Windows\System\QMWbRvQ.exe
  C:\Windows\System\QMWbRvQ.exe
  2⤵
  PID:736
- C:\Windows\System\eZdIxTb.exe
  C:\Windows\System\eZdIxTb.exe
  2⤵
  PID:12356
- C:\Windows\System\defKGOc.exe
  C:\Windows\System\defKGOc.exe
  2⤵
  PID:12416
- C:\Windows\System\IeODGBe.exe
  C:\Windows\System\IeODGBe.exe
  2⤵
  PID:12552
- C:\Windows\System\jwCYKrU.exe
  C:\Windows\System\jwCYKrU.exe
  2⤵
  PID:12924
- C:\Windows\System\LClpVbE.exe
  C:\Windows\System\LClpVbE.exe
  2⤵
  PID:3776
- C:\Windows\System\poaOqTp.exe
  C:\Windows\System\poaOqTp.exe
  2⤵
  PID:1192
- C:\Windows\System\gSsBGxc.exe
  C:\Windows\System\gSsBGxc.exe
  2⤵
  PID:3356
- C:\Windows\System\ivBhtwi.exe
  C:\Windows\System\ivBhtwi.exe
  2⤵
  PID:1468
- C:\Windows\System\PGUcwlb.exe
  C:\Windows\System\PGUcwlb.exe
  2⤵
  PID:4276
- C:\Windows\System\oOcIKFS.exe
  C:\Windows\System\oOcIKFS.exe
  2⤵
  PID:12320
- C:\Windows\System\JvLxGYe.exe
  C:\Windows\System\JvLxGYe.exe
  2⤵
  PID:12324
- C:\Windows\System\cvdigOb.exe
  C:\Windows\System\cvdigOb.exe
  2⤵
  PID:12632
- C:\Windows\System\wxWBOQE.exe
  C:\Windows\System\wxWBOQE.exe
  2⤵
  PID:5108
- C:\Windows\System\fbbPAdc.exe
  C:\Windows\System\fbbPAdc.exe
  2⤵
  PID:13268
- C:\Windows\System\SJSvjzi.exe
  C:\Windows\System\SJSvjzi.exe
  2⤵
  PID:13164
- C:\Windows\System\eOpFPmq.exe
  C:\Windows\System\eOpFPmq.exe
  2⤵
  PID:13180
- C:\Windows\System\PAiXvRd.exe
  C:\Windows\System\PAiXvRd.exe
  2⤵
  PID:3396
- C:\Windows\System\ySrpxgy.exe
  C:\Windows\System\ySrpxgy.exe
  2⤵
  PID:1444
- C:\Windows\System\kQVsTIS.exe
  C:\Windows\System\kQVsTIS.exe
  2⤵
  PID:4312
- C:\Windows\System\gWwNcmN.exe
  C:\Windows\System\gWwNcmN.exe
  2⤵
  PID:3852
- C:\Windows\System\xTdSnOv.exe
  C:\Windows\System\xTdSnOv.exe
  2⤵
  PID:13184
- C:\Windows\System\efzIYio.exe
  C:\Windows\System\efzIYio.exe
  2⤵
  PID:6132
- C:\Windows\System\cPJOgkZ.exe
  C:\Windows\System\cPJOgkZ.exe
  2⤵
  PID:13320
- C:\Windows\System\THeGJOz.exe
  C:\Windows\System\THeGJOz.exe
  2⤵
  PID:13340
- C:\Windows\System\NxmYqpJ.exe
  C:\Windows\System\NxmYqpJ.exe
  2⤵
  PID:13364
- C:\Windows\System\jcpZIGl.exe
  C:\Windows\System\jcpZIGl.exe
  2⤵
  PID:13380
- C:\Windows\System\pIRyEpy.exe
  C:\Windows\System\pIRyEpy.exe
  2⤵
  PID:13404
- C:\Windows\System\QiBBrxP.exe
  C:\Windows\System\QiBBrxP.exe
  2⤵
  PID:13444
- C:\Windows\System\joJrUDm.exe
  C:\Windows\System\joJrUDm.exe
  2⤵
  PID:13460
- C:\Windows\System\ftvqVuP.exe
  C:\Windows\System\ftvqVuP.exe
  2⤵
  PID:13488
- C:\Windows\System\OUNkqMe.exe
  C:\Windows\System\OUNkqMe.exe
  2⤵
  PID:13524
- C:\Windows\System\bjkCgNK.exe
  C:\Windows\System\bjkCgNK.exe
  2⤵
  PID:13552
- C:\Windows\System\XsQVPSs.exe
  C:\Windows\System\XsQVPSs.exe
  2⤵
  PID:13576
- C:\Windows\System\CHdBLSh.exe
  C:\Windows\System\CHdBLSh.exe
  2⤵
  PID:13592
- C:\Windows\System\DOPCQuO.exe
  C:\Windows\System\DOPCQuO.exe
  2⤵
  PID:13608
- C:\Windows\System\iGyfGgK.exe
  C:\Windows\System\iGyfGgK.exe
  2⤵
  PID:13640
- C:\Windows\System\dgMHlUL.exe
  C:\Windows\System\dgMHlUL.exe
  2⤵
  PID:14760
- C:\Windows\System\ZbfSaIx.exe
  C:\Windows\System\ZbfSaIx.exe
  2⤵
  PID:15368
- C:\Windows\System\pJEKXUZ.exe
  C:\Windows\System\pJEKXUZ.exe
  2⤵
  PID:15820
- C:\Windows\System\yuaQiQw.exe
  C:\Windows\System\yuaQiQw.exe
  2⤵
  PID:15844
- C:\Windows\System\RXMVsJr.exe
  C:\Windows\System\RXMVsJr.exe
  2⤵
  PID:16208
- C:\Windows\System\LHBlpar.exe
  C:\Windows\System\LHBlpar.exe
  2⤵
  PID:16916
- C:\Windows\System\eKdVojd.exe
  C:\Windows\System\eKdVojd.exe
  2⤵
  PID:17116
- C:\Windows\System\ZHqqZJL.exe
  C:\Windows\System\ZHqqZJL.exe
  2⤵
  PID:17132
- C:\Windows\System\wTVkIGo.exe
  C:\Windows\System\wTVkIGo.exe
  2⤵
  PID:17148
- C:\Windows\System\XCrJBoO.exe
  C:\Windows\System\XCrJBoO.exe
  2⤵
  PID:17164
- C:\Windows\System\cmJajPv.exe
  C:\Windows\System\cmJajPv.exe
  2⤵
  PID:17180
- C:\Windows\System\Gubnzdw.exe
  C:\Windows\System\Gubnzdw.exe
  2⤵
  PID:17196
- C:\Windows\System\CQadwqU.exe
  C:\Windows\System\CQadwqU.exe
  2⤵
  PID:17212
- C:\Windows\System\pqkQEiL.exe
  C:\Windows\System\pqkQEiL.exe
  2⤵
  PID:17228
- C:\Windows\System\oYmMOyj.exe
  C:\Windows\System\oYmMOyj.exe
  2⤵
  PID:17244
- C:\Windows\System\RcHRFtd.exe
  C:\Windows\System\RcHRFtd.exe
  2⤵
  PID:17260
- C:\Windows\System\NrMMSBM.exe
  C:\Windows\System\NrMMSBM.exe
  2⤵
  PID:17276
- C:\Windows\System\YFalvmD.exe
  C:\Windows\System\YFalvmD.exe
  2⤵
  PID:17292
- C:\Windows\System\DCRfYWb.exe
  C:\Windows\System\DCRfYWb.exe
  2⤵
  PID:17308
- C:\Windows\System\UezpIkt.exe
  C:\Windows\System\UezpIkt.exe
  2⤵
  PID:17324
- C:\Windows\System\dmEfYHE.exe
  C:\Windows\System\dmEfYHE.exe
  2⤵
  PID:17340
- C:\Windows\System\oiGyryo.exe
  C:\Windows\System\oiGyryo.exe
  2⤵
  PID:17376
- C:\Windows\System\aeNcOjs.exe
  C:\Windows\System\aeNcOjs.exe
  2⤵
  PID:17392
- C:\Windows\System\LeCvYlS.exe
  C:\Windows\System\LeCvYlS.exe
  2⤵
  PID:14020
- C:\Windows\System\pPlldTo.exe
  C:\Windows\System\pPlldTo.exe
  2⤵
  PID:14224
- C:\Windows\System\WZVbOtX.exe
  C:\Windows\System\WZVbOtX.exe
  2⤵
  PID:14244
- C:\Windows\System\ituoHtD.exe
  C:\Windows\System\ituoHtD.exe
  2⤵
  PID:2796
- C:\Windows\System\kmJIroB.exe
  C:\Windows\System\kmJIroB.exe
  2⤵
  PID:14520
- C:\Windows\System\JkFlKkV.exe
  C:\Windows\System\JkFlKkV.exe
  2⤵
  PID:15180
- C:\Windows\System\tBBoxvJ.exe
  C:\Windows\System\tBBoxvJ.exe
  2⤵
  PID:15212
- C:\Windows\System\mWbDIcg.exe
  C:\Windows\System\mWbDIcg.exe
  2⤵
  PID:13780
- C:\Windows\System\qRIgMCd.exe
  C:\Windows\System\qRIgMCd.exe
  2⤵
  PID:16416
- C:\Windows\System\LXCmhYk.exe
  C:\Windows\System\LXCmhYk.exe
  2⤵
  PID:15080
- C:\Windows\System\VTchoor.exe
  C:\Windows\System\VTchoor.exe
  2⤵
  PID:14220
- C:\Windows\System\WnurutJ.exe
  C:\Windows\System\WnurutJ.exe
  2⤵
  PID:15440
- C:\Windows\System\UIfIBUZ.exe
  C:\Windows\System\UIfIBUZ.exe
  2⤵
  PID:15584
- C:\Windows\System\AnOWmas.exe
  C:\Windows\System\AnOWmas.exe
  2⤵
  PID:15804
- C:\Windows\System\iGMuMbF.exe
  C:\Windows\System\iGMuMbF.exe
  2⤵
  PID:16100
- C:\Windows\System\GHKJAHM.exe
  C:\Windows\System\GHKJAHM.exe
  2⤵
  PID:1868
- C:\Windows\System\WowAwHG.exe
  C:\Windows\System\WowAwHG.exe
  2⤵
  PID:16364
- C:\Windows\System\httbaus.exe
  C:\Windows\System\httbaus.exe
  2⤵
  PID:14848
- C:\Windows\System\HlUJCZy.exe
  C:\Windows\System\HlUJCZy.exe
  2⤵
  PID:16736
- C:\Windows\System\aXtVqfp.exe
  C:\Windows\System\aXtVqfp.exe
  2⤵
  PID:4912
- C:\Windows\System\suMpORN.exe
  C:\Windows\System\suMpORN.exe
  2⤵
  PID:4852
- C:\Windows\System\vdyPqKw.exe
  C:\Windows\System\vdyPqKw.exe
  2⤵
  PID:17528
- C:\Windows\System\rMVzUNa.exe
  C:\Windows\System\rMVzUNa.exe
  2⤵
  PID:17780
- C:\Windows\System\DAgsMqS.exe
  C:\Windows\System\DAgsMqS.exe
  2⤵
  PID:17816
- C:\Windows\System\sxmNcPA.exe
  C:\Windows\System\sxmNcPA.exe
  2⤵
  PID:17832
- C:\Windows\System\xcSMoQz.exe
  C:\Windows\System\xcSMoQz.exe
  2⤵
  PID:17868
- C:\Windows\System\VHmsXdh.exe
  C:\Windows\System\VHmsXdh.exe
  2⤵
  PID:17884
- C:\Windows\System\fYujslH.exe
  C:\Windows\System\fYujslH.exe
  2⤵
  PID:17904
- C:\Windows\System\PLMvsGu.exe
  C:\Windows\System\PLMvsGu.exe
  2⤵
  PID:17924
- C:\Windows\System\IuxRkrp.exe
  C:\Windows\System\IuxRkrp.exe
  2⤵
  PID:17940
- C:\Windows\System\BiezGLt.exe
  C:\Windows\System\BiezGLt.exe
  2⤵
  PID:17956
- C:\Windows\System\TRJpLOY.exe
  C:\Windows\System\TRJpLOY.exe
  2⤵
  PID:17972
- C:\Windows\System\kzaWucM.exe
  C:\Windows\System\kzaWucM.exe
  2⤵
  PID:17988
- C:\Windows\System\vuzbDUd.exe
  C:\Windows\System\vuzbDUd.exe
  2⤵
  PID:18004
- C:\Windows\System\xrFspuE.exe
  C:\Windows\System\xrFspuE.exe
  2⤵
  PID:18020
- C:\Windows\System\oRfjtRd.exe
  C:\Windows\System\oRfjtRd.exe
  2⤵
  PID:18036
- C:\Windows\System\XFoMUGJ.exe
  C:\Windows\System\XFoMUGJ.exe
  2⤵
  PID:18052
- C:\Windows\System\qecuuwg.exe
  C:\Windows\System\qecuuwg.exe
  2⤵
  PID:18068
- C:\Windows\System\lPPTPxA.exe
  C:\Windows\System\lPPTPxA.exe
  2⤵
  PID:18084
- C:\Windows\System\ZyxOtqF.exe
  C:\Windows\System\ZyxOtqF.exe
  2⤵
  PID:18100
- C:\Windows\System\dDdiLxj.exe
  C:\Windows\System\dDdiLxj.exe
  2⤵
  PID:18116
- C:\Windows\System\bTdrECF.exe
  C:\Windows\System\bTdrECF.exe
  2⤵
  PID:18132
- C:\Windows\System\ZUPKOFM.exe
  C:\Windows\System\ZUPKOFM.exe
  2⤵
  PID:18148
- C:\Windows\System\PNaYzTO.exe
  C:\Windows\System\PNaYzTO.exe
  2⤵
  PID:18244
- C:\Windows\System\ftgRytQ.exe
  C:\Windows\System\ftgRytQ.exe
  2⤵
  PID:18268
- C:\Windows\System\JiSLcYj.exe
  C:\Windows\System\JiSLcYj.exe
  2⤵
  PID:18284
- C:\Windows\System\yYSkZcU.exe
  C:\Windows\System\yYSkZcU.exe
  2⤵
  PID:3320
- C:\Windows\System\gOKZQMf.exe
  C:\Windows\System\gOKZQMf.exe
  2⤵
  PID:16968
- C:\Windows\System\sWScwIs.exe
  C:\Windows\System\sWScwIs.exe
  2⤵
  PID:1668
- C:\Windows\System\tGbPLAC.exe
  C:\Windows\System\tGbPLAC.exe
  2⤵
  PID:4812
- C:\Windows\System\hBByYTJ.exe
  C:\Windows\System\hBByYTJ.exe
  2⤵
  PID:17156
- C:\Windows\System\pZWbaDD.exe
  C:\Windows\System\pZWbaDD.exe
  2⤵
  PID:17240
- C:\Windows\System\DXzAnIH.exe
  C:\Windows\System\DXzAnIH.exe
  2⤵
  PID:17316
- C:\Windows\System\CGvcOHo.exe
  C:\Windows\System\CGvcOHo.exe
  2⤵
  PID:17348
- C:\Windows\System\THROApQ.exe
  C:\Windows\System\THROApQ.exe
  2⤵
  PID:17364
- C:\Windows\System\fUOXqCm.exe
  C:\Windows\System\fUOXqCm.exe
  2⤵
  PID:17388
- C:\Windows\System\ngjeOgc.exe
  C:\Windows\System\ngjeOgc.exe
  2⤵
  PID:14860
- C:\Windows\System\kwjzNCu.exe
  C:\Windows\System\kwjzNCu.exe
  2⤵
  PID:14872
- C:\Windows\System\uMqkbSM.exe
  C:\Windows\System\uMqkbSM.exe
  2⤵
  PID:13844
- C:\Windows\System\RgQSxEt.exe
  C:\Windows\System\RgQSxEt.exe
  2⤵
  PID:13868
- C:\Windows\System\pAAfuBd.exe
  C:\Windows\System\pAAfuBd.exe
  2⤵
  PID:14924
- C:\Windows\System\KARIUCJ.exe
  C:\Windows\System\KARIUCJ.exe
  2⤵
  PID:13912
- C:\Windows\System\ZDJMLlM.exe
  C:\Windows\System\ZDJMLlM.exe
  2⤵
  PID:13920
- C:\Windows\System\OBDgQgF.exe
  C:\Windows\System\OBDgQgF.exe
  2⤵
  PID:13948
- C:\Windows\System\ZDQFsCE.exe
  C:\Windows\System\ZDQFsCE.exe
  2⤵
  PID:14968
- C:\Windows\System\YHbGoGR.exe
  C:\Windows\System\YHbGoGR.exe
  2⤵
  PID:13992
- C:\Windows\System\tErqjtC.exe
  C:\Windows\System\tErqjtC.exe
  2⤵
  PID:14036
- C:\Windows\System\KDpVmQa.exe
  C:\Windows\System\KDpVmQa.exe
  2⤵
  PID:14996
- C:\Windows\System\FuqfZJK.exe
  C:\Windows\System\FuqfZJK.exe
  2⤵
  PID:14080
- C:\Windows\System\JUbLzDz.exe
  C:\Windows\System\JUbLzDz.exe
  2⤵
  PID:15012
- C:\Windows\System\ysgfrvr.exe
  C:\Windows\System\ysgfrvr.exe
  2⤵
  PID:10212
- C:\Windows\System\rxCRggJ.exe
  C:\Windows\System\rxCRggJ.exe
  2⤵
  PID:9328
- C:\Windows\System\dmfHdiV.exe
  C:\Windows\System\dmfHdiV.exe
  2⤵
  PID:15344
- C:\Windows\System\CHFtQSU.exe
  C:\Windows\System\CHFtQSU.exe
  2⤵
  PID:13688
- C:\Windows\System\fvpMmem.exe
  C:\Windows\System\fvpMmem.exe
  2⤵
  PID:10952
- C:\Windows\System\iMAMvPp.exe
  C:\Windows\System\iMAMvPp.exe
  2⤵
  PID:17064
- C:\Windows\System\WprREGy.exe
  C:\Windows\System\WprREGy.exe
  2⤵
  PID:16984
- C:\Windows\System\wcnDupl.exe
  C:\Windows\System\wcnDupl.exe
  2⤵
  PID:16992
- C:\Windows\System\JMffQbP.exe
  C:\Windows\System\JMffQbP.exe
  2⤵
  PID:2724
- C:\Windows\System\OhisoEu.exe
  C:\Windows\System\OhisoEu.exe
  2⤵
  PID:14648
- C:\Windows\System\ZTOPodo.exe
  C:\Windows\System\ZTOPodo.exe
  2⤵
  PID:17032
- C:\Windows\System\ELXRFhV.exe
  C:\Windows\System\ELXRFhV.exe
  2⤵
  PID:13728
- C:\Windows\System\PoeSvOe.exe
  C:\Windows\System\PoeSvOe.exe
  2⤵
  PID:11168
- C:\Windows\System\cbAuTVp.exe
  C:\Windows\System\cbAuTVp.exe
  2⤵
  PID:2936
- C:\Windows\System\LWRRSXE.exe
  C:\Windows\System\LWRRSXE.exe
  2⤵
  PID:17076
- C:\Windows\System\xdzjKRp.exe
  C:\Windows\System\xdzjKRp.exe
  2⤵
  PID:4196
- C:\Windows\System\WuDFBKL.exe
  C:\Windows\System\WuDFBKL.exe
  2⤵
  PID:17096
- C:\Windows\System\HwTfPvv.exe
  C:\Windows\System\HwTfPvv.exe
  2⤵
  PID:17108
- C:\Windows\System\gtBEBxo.exe
  C:\Windows\System\gtBEBxo.exe
  2⤵
  PID:17176
- C:\Windows\System\WDKrUUl.exe
  C:\Windows\System\WDKrUUl.exe
  2⤵
  PID:17208
- C:\Windows\System\QrUQejf.exe
  C:\Windows\System\QrUQejf.exe
  2⤵
  PID:17268
- C:\Windows\System\yHbcdGt.exe
  C:\Windows\System\yHbcdGt.exe
  2⤵
  PID:14132
- C:\Windows\System\jMbEioU.exe
  C:\Windows\System\jMbEioU.exe
  2⤵
  PID:14156
- C:\Windows\System\IBHzhMk.exe
  C:\Windows\System\IBHzhMk.exe
  2⤵
  PID:15036
- C:\Windows\System\SpIkrmB.exe
  C:\Windows\System\SpIkrmB.exe
  2⤵
  PID:14216
- C:\Windows\System\ZFFkYmb.exe
  C:\Windows\System\ZFFkYmb.exe
  2⤵
  PID:14252
- C:\Windows\System\GPIdUcE.exe
  C:\Windows\System\GPIdUcE.exe
  2⤵
  PID:14264
- C:\Windows\System\fLnRxAI.exe
  C:\Windows\System\fLnRxAI.exe
  2⤵
  PID:14284
- C:\Windows\System\kQycneP.exe
  C:\Windows\System\kQycneP.exe
  2⤵
  PID:14300
- C:\Windows\System\egAFhbq.exe
  C:\Windows\System\egAFhbq.exe
  2⤵
  PID:14316
- C:\Windows\System\BbnEJCU.exe
  C:\Windows\System\BbnEJCU.exe
  2⤵
  PID:14332
- C:\Windows\System\wzKkYQh.exe
  C:\Windows\System\wzKkYQh.exe
  2⤵
  PID:13332
- C:\Windows\System\vfrxcKD.exe
  C:\Windows\System\vfrxcKD.exe
  2⤵
  PID:13360
- C:\Windows\System\iSnXcYY.exe
  C:\Windows\System\iSnXcYY.exe
  2⤵
  PID:15052
- C:\Windows\System\tDLvawo.exe
  C:\Windows\System\tDLvawo.exe
  2⤵
  PID:13280
- C:\Windows\System\Klsmvlt.exe
  C:\Windows\System\Klsmvlt.exe
  2⤵
  PID:13440
- C:\Windows\System\gTDdWFb.exe
  C:\Windows\System\gTDdWFb.exe
  2⤵
  PID:4368
- C:\Windows\System\gjUWJkI.exe
  C:\Windows\System\gjUWJkI.exe
  2⤵
  PID:13476
- C:\Windows\System\kuPMvwA.exe
  C:\Windows\System\kuPMvwA.exe
  2⤵
  PID:3152
- C:\Windows\System\rHYohOt.exe
  C:\Windows\System\rHYohOt.exe
  2⤵
  PID:996
- C:\Windows\System\isZbBPl.exe
  C:\Windows\System\isZbBPl.exe
  2⤵
  PID:13516
- C:\Windows\System\ITryBCF.exe
  C:\Windows\System\ITryBCF.exe
  2⤵
  PID:13572
- C:\Windows\System\jvTmtem.exe
  C:\Windows\System\jvTmtem.exe
  2⤵
  PID:13616
- C:\Windows\System\axyAxuP.exe
  C:\Windows\System\axyAxuP.exe
  2⤵
  PID:13896
- C:\Windows\System\KDvUCti.exe
  C:\Windows\System\KDvUCti.exe
  2⤵
  PID:14060
- C:\Windows\System\kcxTEWN.exe
  C:\Windows\System\kcxTEWN.exe
  2⤵
  PID:13684
- C:\Windows\System\KSTFaxl.exe
  C:\Windows\System\KSTFaxl.exe
  2⤵
  PID:10532
- C:\Windows\System\VeybkHw.exe
  C:\Windows\System\VeybkHw.exe
  2⤵
  PID:14360
- C:\Windows\System\vrRlmKb.exe
  C:\Windows\System\vrRlmKb.exe
  2⤵
  PID:14376
- C:\Windows\System\PCqnnbN.exe
  C:\Windows\System\PCqnnbN.exe
  2⤵
  PID:14396
- C:\Windows\System\tLkPFeo.exe
  C:\Windows\System\tLkPFeo.exe
  2⤵
  PID:14408
- C:\Windows\System\rytofeH.exe
  C:\Windows\System\rytofeH.exe
  2⤵
  PID:15064
- C:\Windows\System\SKxxzPg.exe
  C:\Windows\System\SKxxzPg.exe
  2⤵
  PID:14528
- C:\Windows\System\wspLqnQ.exe
  C:\Windows\System\wspLqnQ.exe
  2⤵
  PID:14544
- C:\Windows\System\KIktQWE.exe
  C:\Windows\System\KIktQWE.exe
  2⤵
  PID:14560
- C:\Windows\System\YRJCEog.exe
  C:\Windows\System\YRJCEog.exe
  2⤵
  PID:14580
- C:\Windows\System\vpBPPYX.exe
  C:\Windows\System\vpBPPYX.exe
  2⤵
  PID:14592
- C:\Windows\System\aBGxAyg.exe
  C:\Windows\System\aBGxAyg.exe
  2⤵
  PID:14608
- C:\Windows\System\uvrIzcp.exe
  C:\Windows\System\uvrIzcp.exe
  2⤵
  PID:14636
- C:\Windows\System\ICnEnlK.exe
  C:\Windows\System\ICnEnlK.exe
  2⤵
  PID:14664
- C:\Windows\System\aKXIsTU.exe
  C:\Windows\System\aKXIsTU.exe
  2⤵
  PID:14684
- C:\Windows\System\KMltcTu.exe
  C:\Windows\System\KMltcTu.exe
  2⤵
  PID:14696
- C:\Windows\System\pgoNavt.exe
  C:\Windows\System\pgoNavt.exe
  2⤵
  PID:14712
- C:\Windows\System\MfnqLeX.exe
  C:\Windows\System\MfnqLeX.exe
  2⤵
  PID:14728
- C:\Windows\System\IOYpJOo.exe
  C:\Windows\System\IOYpJOo.exe
  2⤵
  PID:14744
- C:\Windows\System\EXJbQKy.exe
  C:\Windows\System\EXJbQKy.exe
  2⤵
  PID:628
- C:\Windows\System\XKambFA.exe
  C:\Windows\System\XKambFA.exe
  2⤵
  PID:14788
- C:\Windows\System\TIfaOVT.exe
  C:\Windows\System\TIfaOVT.exe
  2⤵
  PID:15112
- C:\Windows\System\ysRxQWe.exe
  C:\Windows\System\ysRxQWe.exe
  2⤵
  PID:15124
- C:\Windows\System\jLRWtKQ.exe
  C:\Windows\System\jLRWtKQ.exe
  2⤵
  PID:15144
- C:\Windows\System\AVfoTTE.exe
  C:\Windows\System\AVfoTTE.exe
  2⤵
  PID:15160
- C:\Windows\System\ASoHvMf.exe
  C:\Windows\System\ASoHvMf.exe
  2⤵
  PID:15176
- C:\Windows\System\rctLKzi.exe
  C:\Windows\System\rctLKzi.exe
  2⤵
  PID:15204
- C:\Windows\System\lflPlLZ.exe
  C:\Windows\System\lflPlLZ.exe
  2⤵
  PID:15228
- C:\Windows\System\TFwVKtj.exe
  C:\Windows\System\TFwVKtj.exe
  2⤵
  PID:15248
- C:\Windows\System\gIzeTVi.exe
  C:\Windows\System\gIzeTVi.exe
  2⤵
  PID:15264
- C:\Windows\System\TCKzllE.exe
  C:\Windows\System\TCKzllE.exe
  2⤵
  PID:15280
- C:\Windows\System\cyWnEdG.exe
  C:\Windows\System\cyWnEdG.exe
  2⤵
  PID:15296
- C:\Windows\System\lEcNwCS.exe
  C:\Windows\System\lEcNwCS.exe
  2⤵
  PID:15316
- C:\Windows\System\pEzwNcb.exe
  C:\Windows\System\pEzwNcb.exe
  2⤵
  PID:13732
- C:\Windows\System\eHwsIie.exe
  C:\Windows\System\eHwsIie.exe
  2⤵
  PID:13752
- C:\Windows\System\fUjspTw.exe
  C:\Windows\System\fUjspTw.exe
  2⤵
  PID:13760
- C:\Windows\System\MwBTrcv.exe
  C:\Windows\System\MwBTrcv.exe
  2⤵
  PID:13772
- C:\Windows\System\CouOMkB.exe
  C:\Windows\System\CouOMkB.exe
  2⤵
  PID:13796
- C:\Windows\System\URIWfvS.exe
  C:\Windows\System\URIWfvS.exe
  2⤵
  PID:13808
- C:\Windows\System\zgPlDLG.exe
  C:\Windows\System\zgPlDLG.exe
  2⤵
  PID:13824
- C:\Windows\System\BOQmuMC.exe
  C:\Windows\System\BOQmuMC.exe
  2⤵
  PID:13668
- C:\Windows\System\MSSghnv.exe
  C:\Windows\System\MSSghnv.exe
  2⤵
  PID:14444
- C:\Windows\System\qTNwZZf.exe
  C:\Windows\System\qTNwZZf.exe
  2⤵
  PID:14460
- C:\Windows\System\xGrEQdL.exe
  C:\Windows\System\xGrEQdL.exe
  2⤵
  PID:14476
- C:\Windows\System\fIboPxL.exe
  C:\Windows\System\fIboPxL.exe
  2⤵
  PID:14492
- C:\Windows\System\OEzroNK.exe
  C:\Windows\System\OEzroNK.exe
  2⤵
  PID:7656
- C:\Windows\System\AdBMkJS.exe
  C:\Windows\System\AdBMkJS.exe
  2⤵
  PID:14768
- C:\Windows\System\AoeGuyW.exe
  C:\Windows\System\AoeGuyW.exe
  2⤵
  PID:13832
- C:\Windows\System\PNRxyhQ.exe
  C:\Windows\System\PNRxyhQ.exe
  2⤵
  PID:13856
- C:\Windows\System\TcfTCin.exe
  C:\Windows\System\TcfTCin.exe
  2⤵
  PID:2744
- C:\Windows\System\IRnCrIh.exe
  C:\Windows\System\IRnCrIh.exe
  2⤵
  PID:13908
- C:\Windows\System\MeohOFT.exe
  C:\Windows\System\MeohOFT.exe
  2⤵
  PID:13936
- C:\Windows\System\ZLEIDJb.exe
  C:\Windows\System\ZLEIDJb.exe
  2⤵
  PID:13956
- C:\Windows\System\gNQUlcb.exe
  C:\Windows\System\gNQUlcb.exe
  2⤵
  PID:13996
- C:\Windows\System\vqcLiUd.exe
  C:\Windows\System\vqcLiUd.exe
  2⤵
  PID:14024
- C:\Windows\System\JUtMQFs.exe
  C:\Windows\System\JUtMQFs.exe
  2⤵
  PID:14076
- C:\Windows\System\WljzXBv.exe
  C:\Windows\System\WljzXBv.exe
  2⤵
  PID:2420
- C:\Windows\System\CAUjybD.exe
  C:\Windows\System\CAUjybD.exe
  2⤵
  PID:16400
- C:\Windows\System\CndhhQT.exe
  C:\Windows\System\CndhhQT.exe
  2⤵
  PID:16408
- C:\Windows\System\hFFYiXs.exe
  C:\Windows\System\hFFYiXs.exe
  2⤵
  PID:14908
- C:\Windows\System\yCmYDyT.exe
  C:\Windows\System\yCmYDyT.exe
  2⤵
  PID:16680
- C:\Windows\System\lgCTPts.exe
  C:\Windows\System\lgCTPts.exe
  2⤵
  PID:14164
- C:\Windows\System\udszzMW.exe
  C:\Windows\System\udszzMW.exe
  2⤵
  PID:15376
- C:\Windows\System\jDQaqmA.exe
  C:\Windows\System\jDQaqmA.exe
  2⤵
  PID:15396
- C:\Windows\System\jaznrkP.exe
  C:\Windows\System\jaznrkP.exe
  2⤵
  PID:15684
- C:\Windows\System\UjyxKBo.exe
  C:\Windows\System\UjyxKBo.exe
  2⤵
  PID:15704
- C:\Windows\System\lhHjooJ.exe
  C:\Windows\System\lhHjooJ.exe
  2⤵
  PID:15720
- C:\Windows\System\jDhkshb.exe
  C:\Windows\System\jDhkshb.exe
  2⤵
  PID:15736
- C:\Windows\System\kmntASW.exe
  C:\Windows\System\kmntASW.exe
  2⤵
  PID:15760
- C:\Windows\System\jftKndS.exe
  C:\Windows\System\jftKndS.exe
  2⤵
  PID:15768
- C:\Windows\System\urPnIDz.exe
  C:\Windows\System\urPnIDz.exe
  2⤵
  PID:15896
- C:\Windows\System\dsNlQZA.exe
  C:\Windows\System\dsNlQZA.exe
  2⤵
  PID:16092
- C:\Windows\System\PkTHByo.exe
  C:\Windows\System\PkTHByo.exe
  2⤵
  PID:1364
- C:\Windows\System\OKGMOKv.exe
  C:\Windows\System\OKGMOKv.exe
  2⤵
  PID:5084
- C:\Windows\System\yzytgPe.exe
  C:\Windows\System\yzytgPe.exe
  2⤵
  PID:16756
- C:\Windows\System\oHbQGDw.exe
  C:\Windows\System\oHbQGDw.exe
  2⤵
  PID:16780
- C:\Windows\System\MNhxpsQ.exe
  C:\Windows\System\MNhxpsQ.exe
  2⤵
  PID:3452
- C:\Windows\System\dPbonzH.exe
  C:\Windows\System\dPbonzH.exe
  2⤵
  PID:1916
- C:\Windows\System\ftwvuBT.exe
  C:\Windows\System\ftwvuBT.exe
  2⤵
  PID:12896
- C:\Windows\System\HqjWejI.exe
  C:\Windows\System\HqjWejI.exe
  2⤵
  PID:17536
- C:\Windows\System\FYbutlR.exe
  C:\Windows\System\FYbutlR.exe
  2⤵
  PID:17612
- C:\Windows\System\XVtkhvK.exe
  C:\Windows\System\XVtkhvK.exe
  2⤵
  PID:380
- C:\Windows\System\tJzOFwp.exe
  C:\Windows\System\tJzOFwp.exe
  2⤵
  PID:5496
- C:\Windows\System\wQbQfGe.exe
  C:\Windows\System\wQbQfGe.exe
  2⤵
  PID:11420
- C:\Windows\System\aLtJpuV.exe
  C:\Windows\System\aLtJpuV.exe
  2⤵
  PID:17912
- C:\Windows\System\DwXeklN.exe
  C:\Windows\System\DwXeklN.exe
  2⤵
  PID:18016
- C:\Windows\System\dyuTVwO.exe
  C:\Windows\System\dyuTVwO.exe
  2⤵
  PID:3068
- C:\Windows\System\XqUQwez.exe
  C:\Windows\System\XqUQwez.exe
  2⤵
  PID:17304
- C:\Windows\System\IIqbINC.exe
  C:\Windows\System\IIqbINC.exe
  2⤵
  PID:17360
- C:\Windows\System\JPBZhEM.exe
  C:\Windows\System\JPBZhEM.exe
  2⤵
  PID:6552
- C:\Windows\System\ItQGHDL.exe
  C:\Windows\System\ItQGHDL.exe
  2⤵
  PID:14984
- C:\Windows\System\yJFHEwF.exe
  C:\Windows\System\yJFHEwF.exe
  2⤵
  PID:14068
- C:\Windows\System\UTmdNvT.exe
  C:\Windows\System\UTmdNvT.exe
  2⤵
  PID:14112
- C:\Windows\System\XaxwZja.exe
  C:\Windows\System\XaxwZja.exe
  2⤵
  PID:1800
- C:\Windows\System\jYZSton.exe
  C:\Windows\System\jYZSton.exe
  2⤵
  PID:6940
- C:\Windows\System\tmUCkAd.exe
  C:\Windows\System\tmUCkAd.exe
  2⤵
  PID:4260
- C:\Windows\System\IgldNbA.exe
  C:\Windows\System\IgldNbA.exe
  2⤵
  PID:15424
- C:\Windows\System\VLHsJXj.exe
  C:\Windows\System\VLHsJXj.exe
  2⤵
  PID:5340
- C:\Windows\System\ZtviXEA.exe
  C:\Windows\System\ZtviXEA.exe
  2⤵
  PID:15456
- C:\Windows\System\VyHpuqH.exe
  C:\Windows\System\VyHpuqH.exe
  2⤵
  PID:5996
- C:\Windows\System\ApuPURB.exe
  C:\Windows\System\ApuPURB.exe
  2⤵
  PID:5608
- C:\Windows\System\IDOpoVt.exe
  C:\Windows\System\IDOpoVt.exe
  2⤵
  PID:6384
- C:\Windows\System\JFYfLBc.exe
  C:\Windows\System\JFYfLBc.exe
  2⤵
  PID:4284
- C:\Windows\System\XSfqslC.exe
  C:\Windows\System\XSfqslC.exe
  2⤵
  PID:2684
- C:\Windows\System\lfZiuco.exe
  C:\Windows\System\lfZiuco.exe
  2⤵
  PID:15484
- C:\Windows\System\VrsPOWD.exe
  C:\Windows\System\VrsPOWD.exe
  2⤵
  PID:6796
- C:\Windows\System\jlGGqlm.exe
  C:\Windows\System\jlGGqlm.exe
  2⤵
  PID:13860
- C:\Windows\System\zdJAEtb.exe
  C:\Windows\System\zdJAEtb.exe
  2⤵
  PID:6696
- C:\Windows\System\LcBUXYm.exe
  C:\Windows\System\LcBUXYm.exe
  2⤵
  PID:5228
- C:\Windows\System\hrSxrdG.exe
  C:\Windows\System\hrSxrdG.exe
  2⤵
  PID:6912
- C:\Windows\System\gtcbQOE.exe
  C:\Windows\System\gtcbQOE.exe
  2⤵
  PID:15556
- C:\Windows\System\GgBfNiZ.exe
  C:\Windows\System\GgBfNiZ.exe
  2⤵
  PID:3796
- C:\Windows\System\UCIgcFn.exe
  C:\Windows\System\UCIgcFn.exe
  2⤵
  PID:4072
- C:\Windows\System\KwcjHfX.exe
  C:\Windows\System\KwcjHfX.exe
  2⤵
  PID:15540
- C:\Windows\System\hTVXTqt.exe
  C:\Windows\System\hTVXTqt.exe
  2⤵
  PID:15532
- C:\Windows\System\uccNzNg.exe
  C:\Windows\System\uccNzNg.exe
  2⤵
  PID:6232
- C:\Windows\System\sWPGTVo.exe
  C:\Windows\System\sWPGTVo.exe
  2⤵
  PID:7152
- C:\Windows\System\aMnCKGA.exe
  C:\Windows\System\aMnCKGA.exe
  2⤵
  PID:15352
- C:\Windows\System\gkwjtJt.exe
  C:\Windows\System\gkwjtJt.exe
  2⤵
  PID:10256
- C:\Windows\System\sTOdvit.exe
  C:\Windows\System\sTOdvit.exe
  2⤵
  PID:4128
- C:\Windows\System\DBnZAmQ.exe
  C:\Windows\System\DBnZAmQ.exe
  2⤵
  PID:17192
- C:\Windows\System\vfLXkOP.exe
  C:\Windows\System\vfLXkOP.exe
  2⤵
  PID:13372
- C:\Windows\System\TjlveOy.exe
  C:\Windows\System\TjlveOy.exe
  2⤵
  PID:5644
- C:\Windows\System\zUEbzqp.exe
  C:\Windows\System\zUEbzqp.exe
  2⤵
  PID:13716
- C:\Windows\System\dyHjNer.exe
  C:\Windows\System\dyHjNer.exe
  2⤵
  PID:7156
- C:\Windows\System\HKYxsBD.exe
  C:\Windows\System\HKYxsBD.exe
  2⤵
  PID:320
- C:\Windows\System\eBaREgZ.exe
  C:\Windows\System\eBaREgZ.exe
  2⤵
  PID:14352
- C:\Windows\System\wrmUEIl.exe
  C:\Windows\System\wrmUEIl.exe
  2⤵
  PID:14388
- C:\Windows\System\prchPXm.exe
  C:\Windows\System\prchPXm.exe
  2⤵
  PID:7360
- C:\Windows\System\qigeQOP.exe
  C:\Windows\System\qigeQOP.exe
  2⤵
  PID:7392
- C:\Windows\System\BUAEQba.exe
  C:\Windows\System\BUAEQba.exe
  2⤵
  PID:7344
- C:\Windows\System\vvySDxJ.exe
  C:\Windows\System\vvySDxJ.exe
  2⤵
  PID:15612
- C:\Windows\System\gjMIuDI.exe
  C:\Windows\System\gjMIuDI.exe
  2⤵
  PID:7364
- C:\Windows\System\PcmdGiN.exe
  C:\Windows\System\PcmdGiN.exe
  2⤵
  PID:7492
- C:\Windows\System\GMHYOXX.exe
  C:\Windows\System\GMHYOXX.exe
  2⤵
  PID:7496
- C:\Windows\System\gPGLhlP.exe
  C:\Windows\System\gPGLhlP.exe
  2⤵
  PID:14584
- C:\Windows\System\tVtHDqo.exe
  C:\Windows\System\tVtHDqo.exe
  2⤵
  PID:14692
- C:\Windows\System\OdukYuN.exe
  C:\Windows\System\OdukYuN.exe
  2⤵
  PID:14724
- C:\Windows\System\ZOhcLhy.exe
  C:\Windows\System\ZOhcLhy.exe
  2⤵
  PID:15196
- C:\Windows\System\poImart.exe
  C:\Windows\System\poImart.exe
  2⤵
  PID:15260
- C:\Windows\System\BnuCFfZ.exe
  C:\Windows\System\BnuCFfZ.exe
  2⤵
  PID:15308
- C:\Windows\System\RQDMsgc.exe
  C:\Windows\System\RQDMsgc.exe
  2⤵
  PID:15636
- C:\Windows\System\GpVlblB.exe
  C:\Windows\System\GpVlblB.exe
  2⤵
  PID:14436
- C:\Windows\System\oGdlSQo.exe
  C:\Windows\System\oGdlSQo.exe
  2⤵
  PID:15668
- C:\Windows\System\lkeBzNL.exe
  C:\Windows\System\lkeBzNL.exe
  2⤵
  PID:6992
- C:\Windows\System\gsSkJyh.exe
  C:\Windows\System\gsSkJyh.exe
  2⤵
  PID:15404
- C:\Windows\System\zGwbLlb.exe
  C:\Windows\System\zGwbLlb.exe
  2⤵
  PID:7136
- C:\Windows\System\rhgvVwC.exe
  C:\Windows\System\rhgvVwC.exe
  2⤵
  PID:6228
- C:\Windows\System\KsajIbU.exe
  C:\Windows\System\KsajIbU.exe
  2⤵
  PID:15900
- C:\Windows\System\FFVimPt.exe
  C:\Windows\System\FFVimPt.exe
  2⤵
  PID:15924
- C:\Windows\System\caSNdBH.exe
  C:\Windows\System\caSNdBH.exe
  2⤵
  PID:15940
- C:\Windows\System\wTIVgmk.exe
  C:\Windows\System\wTIVgmk.exe
  2⤵
  PID:15948
- C:\Windows\System\bAYpaFN.exe
  C:\Windows\System\bAYpaFN.exe
  2⤵
  PID:15964
- C:\Windows\System\MZSwYrR.exe
  C:\Windows\System\MZSwYrR.exe
  2⤵
  PID:15980
- C:\Windows\System\jMPjRut.exe
  C:\Windows\System\jMPjRut.exe
  2⤵
  PID:16004
- C:\Windows\System\NaAiSwq.exe
  C:\Windows\System\NaAiSwq.exe
  2⤵
  PID:16020
- C:\Windows\System\dZcHKMs.exe
  C:\Windows\System\dZcHKMs.exe
  2⤵
  PID:16036
- C:\Windows\System\wpUHvak.exe
  C:\Windows\System\wpUHvak.exe
  2⤵
  PID:16052
- C:\Windows\System\nGKqgUJ.exe
  C:\Windows\System\nGKqgUJ.exe
  2⤵
  PID:16064
- C:\Windows\System\IVVfsyV.exe
  C:\Windows\System\IVVfsyV.exe
  2⤵
  PID:16080
- C:\Windows\System\eYPSXyC.exe
  C:\Windows\System\eYPSXyC.exe
  2⤵
  PID:16120
- C:\Windows\System\imUHfBr.exe
  C:\Windows\System\imUHfBr.exe
  2⤵
  PID:16132
- C:\Windows\System\qfcqBiU.exe
  C:\Windows\System\qfcqBiU.exe
  2⤵
  PID:3608
- C:\Windows\System\BzatYvC.exe
  C:\Windows\System\BzatYvC.exe
  2⤵
  PID:16560
- C:\Windows\System\iDnbMns.exe
  C:\Windows\System\iDnbMns.exe
  2⤵
  PID:16748
- C:\Windows\System\ndvzVks.exe
  C:\Windows\System\ndvzVks.exe
  2⤵
  PID:16768
- C:\Windows\System\WApzAKw.exe
  C:\Windows\System\WApzAKw.exe
  2⤵
  PID:4896
- C:\Windows\System\xReUKjP.exe
  C:\Windows\System\xReUKjP.exe
  2⤵
  PID:17448
- C:\Windows\System\HxzQaWC.exe
  C:\Windows\System\HxzQaWC.exe
  2⤵
  PID:17544
- C:\Windows\System\QwWyfZr.exe
  C:\Windows\System\QwWyfZr.exe
  2⤵
  PID:17560
- C:\Windows\System\jIvHhep.exe
  C:\Windows\System\jIvHhep.exe
  2⤵
  PID:17576
- C:\Windows\System\SQyZKUD.exe
  C:\Windows\System\SQyZKUD.exe
  2⤵
  PID:17592
- C:\Windows\System\vYwnREg.exe
  C:\Windows\System\vYwnREg.exe
  2⤵
  PID:17604
- C:\Windows\System\XhPrFYJ.exe
  C:\Windows\System\XhPrFYJ.exe
  2⤵
  PID:2152
- C:\Windows\System\UvmOqJI.exe
  C:\Windows\System\UvmOqJI.exe
  2⤵
  PID:5776
- C:\Windows\System\OwDHtdu.exe
  C:\Windows\System\OwDHtdu.exe
  2⤵
  PID:7844
- C:\Windows\System\IyZgbpe.exe
  C:\Windows\System\IyZgbpe.exe
  2⤵
  PID:10932
- C:\Windows\System\IlfvICX.exe
  C:\Windows\System\IlfvICX.exe
  2⤵
  PID:7924
- C:\Windows\System\KGPgLez.exe
  C:\Windows\System\KGPgLez.exe
  2⤵
  PID:7944
- C:\Windows\System\iizZvDB.exe
  C:\Windows\System\iizZvDB.exe
  2⤵
  PID:14628
- C:\Windows\System\ophCrUP.exe
  C:\Windows\System\ophCrUP.exe
  2⤵
  PID:8000
- C:\Windows\System\cvfsAyV.exe
  C:\Windows\System\cvfsAyV.exe
  2⤵
  PID:17056
- C:\Windows\System\StOHWPN.exe
  C:\Windows\System\StOHWPN.exe
  2⤵
  PID:8088
- C:\Windows\System\KOljfJN.exe
  C:\Windows\System\KOljfJN.exe
  2⤵
  PID:8140
- C:\Windows\System\nmDqozq.exe
  C:\Windows\System\nmDqozq.exe
  2⤵
  PID:7224
- C:\Windows\System\oabfyrM.exe
  C:\Windows\System\oabfyrM.exe
  2⤵
  PID:17104
- C:\Windows\System\UZbiASk.exe
  C:\Windows\System\UZbiASk.exe
  2⤵
  PID:17204
- C:\Windows\System\MvPoBFr.exe
  C:\Windows\System\MvPoBFr.exe
  2⤵
  PID:17256
- C:\Windows\System\QOXxFRH.exe
  C:\Windows\System\QOXxFRH.exe
  2⤵
  PID:7556
- C:\Windows\System\JSxoxWw.exe
  C:\Windows\System\JSxoxWw.exe
  2⤵
  PID:7572
- C:\Windows\System\oxuRKfO.exe
  C:\Windows\System\oxuRKfO.exe
  2⤵
  PID:7904
- C:\Windows\System\ehzulKj.exe
  C:\Windows\System\ehzulKj.exe
  2⤵
  PID:8004
- C:\Windows\System\uVdXFiJ.exe
  C:\Windows\System\uVdXFiJ.exe
  2⤵
  PID:8028
- C:\Windows\System\XWtEHAB.exe
  C:\Windows\System\XWtEHAB.exe
  2⤵
  PID:14296
- C:\Windows\System\juLcEng.exe
  C:\Windows\System\juLcEng.exe
  2⤵
  PID:7188
- C:\Windows\System\FBupbnG.exe
  C:\Windows\System\FBupbnG.exe
  2⤵
  PID:4076
- C:\Windows\System\OJtiLpJ.exe
  C:\Windows\System\OJtiLpJ.exe
  2⤵
  PID:8296
- C:\Windows\System\VeLZgVh.exe
  C:\Windows\System\VeLZgVh.exe
  2⤵
  PID:8312
- C:\Windows\System\uwApcxc.exe
  C:\Windows\System\uwApcxc.exe
  2⤵
  PID:8368
- C:\Windows\System\kUTxCmc.exe
  C:\Windows\System\kUTxCmc.exe
  2⤵
  PID:8268
- C:\Windows\System\IAEdlSh.exe
  C:\Windows\System\IAEdlSh.exe
  2⤵
  PID:6096
- C:\Windows\System\nIGLRsl.exe
  C:\Windows\System\nIGLRsl.exe
  2⤵
  PID:8440
- C:\Windows\System\hQKvaBC.exe
  C:\Windows\System\hQKvaBC.exe
  2⤵
  PID:8444
- C:\Windows\System\KlMJPua.exe
  C:\Windows\System\KlMJPua.exe
  2⤵
  PID:8472
- C:\Windows\System\SlwRaty.exe
  C:\Windows\System\SlwRaty.exe
  2⤵
  PID:8456
- C:\Windows\System\sveigFS.exe
  C:\Windows\System\sveigFS.exe
  2⤵
  PID:13048
- C:\Windows\System\AdxgAAo.exe
  C:\Windows\System\AdxgAAo.exe
  2⤵
  PID:220
- C:\Windows\System\otkILnW.exe
  C:\Windows\System\otkILnW.exe
  2⤵
  PID:8536
- C:\Windows\System\xTOmmdP.exe
  C:\Windows\System\xTOmmdP.exe
  2⤵
  PID:8488
- C:\Windows\System\OcJqglm.exe
  C:\Windows\System\OcJqglm.exe
  2⤵
  PID:8580
- C:\Windows\System\xKnrOvL.exe
  C:\Windows\System\xKnrOvL.exe
  2⤵
  PID:8572
- C:\Windows\System\kgoGDAm.exe
  C:\Windows\System\kgoGDAm.exe
  2⤵
  PID:8676
- C:\Windows\System\ZTBpwaR.exe
  C:\Windows\System\ZTBpwaR.exe
  2⤵
  PID:8656
- C:\Windows\System\FKpqZvm.exe
  C:\Windows\System\FKpqZvm.exe
  2⤵
  PID:8848
- C:\Windows\System\qWJuzon.exe
  C:\Windows\System\qWJuzon.exe
  2⤵
  PID:8780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x20lhqqr.q3g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ANODqJj.exe

Filesize
923KB

MD5
cc9556ea9b7ea5c04828f529ec3fc47a

SHA1
5c196e0ff5fe2a513bf62968e261ca551a8c73c4

SHA256
392714ffcc222bd017ea7578544a09ebaa0656cb9f8fcb1e629c14ec32107a78

SHA512
69cb409a9add00713fc43f32fd6c1d4ccdddcf6e807d471d41f230e6d6681be6009007181e6d5f9692a093130192d64763b24fcd72b651b24021b4edc28bcb6d

Download Submit
C:\Windows\System\BoxDTax.exe

Filesize
922KB

MD5
115a6d94f91df7a0d267d0ab90901e7f

SHA1
3c94e1073c186895149fd65cb4ed4ee065006923

SHA256
7d4e7a90c71126129ffc0fa21c039cc0f990a95858e8cb0fa3747c2a4e4cde09

SHA512
e163ea04b1b107cf76a344b5df33d3d0a0f1137e8faa1f8f55cf0c2137c7832959c8d8399cc88f419644228a5ee5feae053fbdaa3cc513f138bf79fd511768bd

Download Submit
C:\Windows\System\CYhjOBV.exe

Filesize
919KB

MD5
60342f7e238d7ac691d3080259fff77f

SHA1
4ae75784743f89b6e675808268436a8105d2eeb8

SHA256
30050cc341c50004f0759c72ea3a93f3afc58d120a86327d3779778fa317d367

SHA512
911e2a76ebfa67d3876a3fcff96e1530ffb2add7e1b7bc9b538b35f7ba22deb6c4304736e8726a9459aefb2d4ee15116ebcbbbeaea7f0b24f0b16af653460d21

Download Submit
C:\Windows\System\DPYOsZp.exe

Filesize
921KB

MD5
a25d8d0bb60a83dd8fc1cb2163bd82e9

SHA1
5d7146111367b62f43defbfde561c6bcfc39c59c

SHA256
4eca726eaba846b23978045506724b679eaf20eecd819528f4326bb470382fb1

SHA512
226429893f7d4a01df461626204f22a3922fd91a8bc9f09f27e11bffab3b9c23012a08a38426af9a0ce63f599605d9653067276095ae7d713ec04ad97d503f80

Download Submit
C:\Windows\System\DcOXatM.exe

Filesize
920KB

MD5
2b9014b8be7ee21fd0157332e3ebe6b2

SHA1
29ecfe075476d06a0357d8830c7c8c028b346227

SHA256
af476f9e24d3b4428f01bd252a7f1749b1666a8b9ee093ec6cc464c47c25b764

SHA512
df2923b798cefbc41e229117ee574a689345d661367d263cf835964c511bde089743f10cfd89b6298fd8091b0e711e45c7437d45040b92d39fba416b62d1e687

Download Submit
C:\Windows\System\DmxGeGR.exe

Filesize
918KB

MD5
306653b22bc17b3330e49567b35364ca

SHA1
6edf432d9525298c7cd01a0599f8083f7a2fa792

SHA256
a71475947be8dd699e7bba55b3b186e8ec3b392a96ebd85b936fd0ce66d0b654

SHA512
4866ccee623977e25d84d27cdafc21b451aa31ede25df3ba21970300b09ff5ab64c68bcbb670e7d611d7197bccdeecb1a43def06728b9231de4088fd28d35357

Download Submit
C:\Windows\System\ElWYhLY.exe

Filesize
920KB

MD5
a4ea312edfae5f31f6d9c7ac23579471

SHA1
76e6edda2f1892611c664beadc9d7cac7841cac4

SHA256
bdbf89ede73377f95b717d33e35f0f79fc142632f2c8249fc1ebeee4aba4153e

SHA512
075301145bcf58c575eff47f685b8ec04d982747ffa50b96d03e114ca4c22573b94ac2495f6a8a09d94c13ff34d0d9fe6e3a625c9f81af76bae245ae024acefc

Download Submit
C:\Windows\System\JJYVrjH.exe

Filesize
917KB

MD5
989c8f116a0183d3b446acd1ed8e9376

SHA1
d75537ec0dd19721dd25f47cad5823efa3856e98

SHA256
e1717c6f5fe01e500871e37975f3346f43fe0ff7ee389c041752d0e29b1eca7e

SHA512
c7f59b1c7081b7d440c48a004575f885db3ef4949e8db1ad29c469f1535e15ca396a5295c7b815cbc9dddc732b985d044d6d77ddd58eb8e2d48e76d180e991db

Download Submit
C:\Windows\System\JQGbxBa.exe

Filesize
919KB

MD5
7ba1d0b9b3a7df0dbf513bf386311ba9

SHA1
3868fb1c2b31b6f90591c983fae5dd4d3466a0e4

SHA256
d204b67f3c87e0c30bc4bd60c76e85b6b46cf3c5143a5b25c4d9b8fce6dd7686

SHA512
90541d3c954db95865f1036f91c1ce55f376b561862973fa48586b34974575b14168d249aa9efe2ae53a2a4b85b80b54f8b0b826b23c9da7287fd827de1bf127

Download Submit
C:\Windows\System\JsVsIbo.exe

Filesize
919KB

MD5
3a25605db9111c4665abe62e981d218e

SHA1
fe1641831af85ce90c7185dcc601fda204256613

SHA256
e5597c9396d8a1082f6d47cc7443121bf827513c9ad5257acc817e66f99b25f5

SHA512
441715985b346387cfbafa8ebffbee65991fdfe74c761694981e821ee4731b44b94585f7e61dcdca38f6c36fda8d13a346d8d903f710aced96e5f2fa9cb6ec09

Download Submit
C:\Windows\System\MtrqavY.exe

Filesize
923KB

MD5
3f9c93460794f07695d99a182489edaf

SHA1
1ad9a00c2cfcd39a1ed8c93255b5589bb32d34a2

SHA256
330e1822d17a61a3c925dda09843a48acb8b08be843ea192a45163e093826aa1

SHA512
29e495ae8b276a17748714f6814270a7a2c0822f0c1a847b8b1fa4952e7dd350d0c268a3d1a5c48aa6d7ba3d1e7cf8b1652de4f038ea210e2769207cbf9a194c

Download Submit
C:\Windows\System\Nczzudf.exe

Filesize
920KB

MD5
4122406b91dde4cd9acd772a3875866c

SHA1
c9ae6a61ea05a57e9caccc08d4e4764c948f9670

SHA256
575ec027ac30aeeaf91dfb374f0336f7bfe4a5d0e229f8fdd44a325965854519

SHA512
76e761314a5439952710eea862e6ad0f83c2e3f18b931228214dfd604ab6edd0016ed63e1f3d26d13f9488fa88c755bf90ef458de17e2fedf52e984a2e3a342b

Download Submit
C:\Windows\System\PdlMASN.exe

Filesize
920KB

MD5
0821d5d1fe5b6bd5e9689d77060ce865

SHA1
95e4a2f07e54f882c111cd0feaaf0a8fb1435370

SHA256
cc266125d9cbb2048a2d639c10c44f19bc5da69314ed9f216854fc39c8874c4c

SHA512
1d84539cea69b4c6e51bba3ffba0c1d586746ed5a513a09e9441649fda3133c391873043add7dcfaaeba1820c5a24a6a465391ded34b172d4c61033eab80c130

Download Submit
C:\Windows\System\PyVdyQy.exe

Filesize
922KB

MD5
a28f5291a5115c2cd09ac83969b13cf8

SHA1
68dbe6b50b287363b54cabc3cb3370d36d81e92f

SHA256
a740950efcc578e50aba2c879c8e83b9c458ef50554deec3a01c9a66977ff824

SHA512
18c3d5fc6ecfbab286a24e9ac3c62d0ff5a49c8f378db056a20117c59be26fe4ec8e534390e86d7918162c79aff074d6afd3eaa3afbf409cb435d610a928b840

Download Submit
C:\Windows\System\SJCkGBz.exe

Filesize
919KB

MD5
80ba6b9d05f9cbf2b844b0f29b66545d

SHA1
d24790cabb5afcf5b19922449fc756aa79449a64

SHA256
7692321a69b22a06c686441b1087334ffb74ed9700d497587b8a59fe18491b38

SHA512
2a586cbe892aba455e0660844e86d12e20812485c4f0a20ddc32410645b10210bb9128e4aafeb83db78d86a817232cf93ed32e8ff297b22cd71d56b02aec8246

Download Submit
C:\Windows\System\TMAfKkg.exe

Filesize
923KB

MD5
58682668e146607e2e4386b7b26bf560

SHA1
f01e9aa5bee80e47cd2360b1de16f381c49b15fc

SHA256
134425ee3c43841f026eaafb507e4bb5bac02d1fa91020c8b22a1c6f1b0fb877

SHA512
845ec8249c07e85abba81279d20040f8ab047b433d19644042f87fa0700f1452976d19a7ae92fd15dadafdf632d044ba4866233bebca94f13a8a4665df5157d2

Download Submit
C:\Windows\System\TpYgyMI.exe

Filesize
918KB

MD5
0ba7eaca0b54d204a61688580b86dd35

SHA1
1c0a24527160effd500b10c5bd6795c7046a9d4e

SHA256
e76345a27f9417c74cd6c8250dd291ba8d6e5a8655fdf5c9b520c28232f31cea

SHA512
b7300cdebf8a18f697d963917255c5a821845a5de218f94065f6cad5e238b12b0fa5b024389688a89765d69b485366d5cf83fc3ea5106e1fe06e1c7b48799afd

Download Submit
C:\Windows\System\VgeUuHC.exe

Filesize
920KB

MD5
a672c39232fe112642bb26aab0d9651f

SHA1
360564d856e4753d79ad757cbf1d4b291e031daf

SHA256
6634363a96915d670aa14edc1cbd21549ba40e94f317818501b1c91794ee419d

SHA512
1cd283dbd52e7ebbe99c905e0ef6ef6d5e4ec84786f85ff42816f9ea74095c11b2a39b5995f790a30393f9dc10ddf61ac6d796d10937b7e1b185a0136aa00f11

Download Submit
C:\Windows\System\VvUCcys.exe

Filesize
922KB

MD5
dfac2328f1d94f0e81f32e13436f42ce

SHA1
8fff154f759568ac6cadf218b60828325d454fe8

SHA256
b6ed517dc06aa842da8045096681d88ebc6e19511539f8c2495d818c69b4eb76

SHA512
b7213cebf8f3bd4af47ebd8067d623182c64f2e5cd3689c86478cf2ed92d2485d51fb5db664226698b116b03c606012dd23516e46866d4392a7fcf22cfc60b9f

Download Submit
C:\Windows\System\YDNegng.exe

Filesize
916KB

MD5
d4d91c1269b461991aba37e97ca5cd4a

SHA1
ff3517a29e63820dca3d35f53fe646eb6f76cdcd

SHA256
1e199ad0b9325905a39bea9dd67d85304ebc66ddd298b19c2f8848ee746d20fc

SHA512
190fb0c8926df68747cff8bbc3626b53d1d0a07fd79bcc4d6f8ca9a1029f7ceffd9516b4fd5f0a694c2a506218a6b9bf615f21197b9e82c4a58430fc930d8482

Download Submit
C:\Windows\System\Ykoikld.exe

Filesize
924KB

MD5
d801165128f7371b0a7eb50510714c2c

SHA1
91a7a9750d50f2cc31dd2e07585e8daa8f1067d7

SHA256
ebfacba365bffebbf94053531852f898599ddba662e832ac926b428a0e35ff29

SHA512
70f3aca9aafe9eb7cc2dc15ea904188e3e397e780b259e4bd5beb7fa23b2535ec422a1e15afdae7e086a496046ed102c23b5fe55cdde2bd32e5345bfb81b76d8

Download Submit
C:\Windows\System\aIiGBtR.exe

Filesize
917KB

MD5
dfe50afa9e5a408f30cf933426e40dc4

SHA1
4c74d003aa77ea2ffdae7d1ae44a4714771c1b0b

SHA256
55e7c6cec95ed4a7e22b19965259a790fc00dfffca326891e7dee59046233889

SHA512
9335c707bc84a211ece2883c81f2f48e61f71c9dd5ccee7b987196dfc8ba19d23bf7fbe807f01948812cadf06ebe3799d76f3cae8a7ce57affbc1ca6411eb72c

Download Submit
C:\Windows\System\bkhjIeo.exe

Filesize
921KB

MD5
45c651f612904c18fe093b57d2064252

SHA1
82d297f0668b794dd209f5a13cffeffb17692a7e

SHA256
d782a9b5942fabc94e0fe0c0691a1036a3e70623d04ab9fa07dfd5da016dea1b

SHA512
6823cfacc19f1a363f894f744b8fab7a168843527ebb6517eacfaaa7f1c63bc0675512aa6fad94733aa6aaac4f29d3784813d7ebdac27a755fd91c44da55de54

Download Submit
C:\Windows\System\etsqJDf.exe

Filesize
918KB

MD5
2cdcea530184a2148983d6440841d8ed

SHA1
961842a26d6a189189f6f7dc8a033a1a681744ed

SHA256
e3c35120461e84cc9c069eceb3800e486738064f61696aab828de5c5bd71728b

SHA512
e0237690cb069daba28633a18ff333712360cf32daff42f0fd5170c4138fffbf5a4830f3d79b5ea64f07e5eb32c97f9a4fabe0b243b7eacbef09e10dfce63c9f

Download Submit
C:\Windows\System\ewlRgJP.exe

Filesize
917KB

MD5
1054ea99aaf63ef2fa50b9d0aabcb0a5

SHA1
a5503d96b04f5bc0668b0b1544c16946cc5006db

SHA256
0fb0c1693d0c5c68a224585146d71ec7930dda629370c41e8e672c7686ebca80

SHA512
c095310a80f8d8b00603636cc1d1e91479e6e1e9e57d8cb4c85f2df06e6ad2619a8c2271f214e126153ef30558232fdd79cc4ef6a6577dca1cb83da87c4e84db

Download Submit
C:\Windows\System\fTehMGe.exe

Filesize
924KB

MD5
c1a3cd63531da405e17d05cc490198de

SHA1
126e6023b15d7f661f0946fc62297a620cc6c881

SHA256
ba367aa65a89586bb501af0ca595435c3ed0485fb2f1f0ee2a42cd66a1b1eadf

SHA512
345d8845f81002cefca7717e46f183b9d0f6da2a1e3d8e569a0db0e9c48637d9798b031fc872f1f0448b6f1619cd3156387d50245a887fadeff5dbdf70c1705c

Download Submit
C:\Windows\System\qbHnZIn.exe

Filesize
923KB

MD5
ed8854b16b83abe81dd8534aa222d698

SHA1
cb2279d0b134e5eabe76da737cd8219a4b3ae3fe

SHA256
18b3438a17776006f82a4ac100224140a2429fc6070ae21342e100e4f8fbdb46

SHA512
9bd9cdee7decc592bf32d425031e172d7b37502b7a0309c2fababd6331e694525512ea468c1c2b8b4e8ad4be76c904662a3f0aa19ec26273d7c41970099741c0

Download Submit
C:\Windows\System\qzWQJpu.exe

Filesize
921KB

MD5
7a94738520f82ed6578624a9b6162e71

SHA1
3d99a225a9acebefb34ffad12444667af0221dba

SHA256
af8375b12b4520a47408f3579c445d7e60c89f44d154651a4e88cd414c219f47

SHA512
53368fab2533c869e2a8875c4dc93919d8235d541c595241c0725561e3c166e0c8fc71cd382c7927608d67012c18b3c2bcc44bb0522ec696fc90849c0b4f4b85

Download Submit
C:\Windows\System\rXcXqbC.exe

Filesize
924KB

MD5
dc7427cde9d475e3a9d6654f54d68d65

SHA1
2a1bc27973e85f932231a1070aa782ca670a6884

SHA256
88493e65fbb9166a0afba77db831bced638856e44e0f21e40181635d7bc90241

SHA512
0cf3436519b62578f2b229ed5017149d033f70b69a22d5e7881692da0af58fc566cfec83e52bbb342987545b3def8360d984154df5aee7253a8de186fc2b7df9

Download Submit
C:\Windows\System\trXUXFN.exe

Filesize
922KB

MD5
80321f96ba060d815a79277ea2c46a7c

SHA1
69a761302ec24ca2df0ec531168110f4a731a3c6

SHA256
987c12cfcc810173d691826664ce97779fb6b733ca5baf33ef809cc445633da4

SHA512
322992468139011e695c6757792552650c0f24c3b679c5eea506de5f8e469caa604eaa6894a57f499e1b4830750a8c0622834b3d72d28d5dc54994657fc586ca

Download Submit
C:\Windows\System\xiUZVPM.exe

Filesize
921KB

MD5
017cf631401fe7c9b162ae822f70fa58

SHA1
e33719ab6008d46b52576664ee51352f1b4963f0

SHA256
b109ed6c024d744da476d5b8cfdbfd301efdac628223013fbe2241c081dfe1c8

SHA512
9328c6a51b851683254a4d3ea44fb98d723f80db80cac269a7cc4b6d0b24293a06f3d2458d14447fa703e28bccbdd71f1d3eaa03475da1cc7c41003da097a4d2

Download Submit
C:\Windows\System\zdqUBrK.exe

Filesize
918KB

MD5
17e05abfa907963d1ee054dc56bc97c2

SHA1
71218556a8096fe966297dfd7303b7ff6269eaed

SHA256
bb32a78ac5758bce10c88fb93e887da33c9e7f33c17b03fac1bbaea18b534d60

SHA512
fc142d0b72639f433563be185ce40b6f476228826bba44d99abb043dcb3c385f92027623b4dc7fd3d50253a616d1489af4289d72bd7c65b8736462265c2871d8

Download Submit
C:\Windows\System\zzRaRMW.exe

Filesize
917KB

MD5
d481856373399dfe9e027170bb632d59

SHA1
2e0ceca60c58a1910a2b1e33dc70c4479313e24e

SHA256
12514f2e0d00293adbe758c7f595adea8d4a50c781597787033a0cae1d615b1e

SHA512
9d32ac363c1cac34e397b20fa9954f42a5d61951679696ce725540c1c97cf7a1dc8a365f7d9c48780dbff0cda701453dc4868c3272231e095ad529b058fd2838

Download Submit
memory/764-102-0x00007FF7658B0000-0x00007FF765CA2000-memory.dmp

Filesize
3.9MB

Download
memory/1016-131-0x00007FF614590000-0x00007FF614982000-memory.dmp

Filesize
3.9MB

Download
memory/1264-163-0x00007FF638050000-0x00007FF638442000-memory.dmp

Filesize
3.9MB

Download
memory/1264-3572-0x00007FF638050000-0x00007FF638442000-memory.dmp

Filesize
3.9MB

Download
memory/1300-181-0x00007FF7C1CB0000-0x00007FF7C20A2000-memory.dmp

Filesize
3.9MB

Download
memory/1300-4602-0x00007FF7C1CB0000-0x00007FF7C20A2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-4604-0x00007FF79E000000-0x00007FF79E3F2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-141-0x00007FF79E000000-0x00007FF79E3F2000-memory.dmp

Filesize
3.9MB

Download
memory/1312-118-0x00007FF63A6B0000-0x00007FF63AAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1708-4600-0x00007FF6D40F0000-0x00007FF6D44E2000-memory.dmp

Filesize
3.9MB

Download
memory/1708-194-0x00007FF6D40F0000-0x00007FF6D44E2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-208-0x00007FF700D50000-0x00007FF701142000-memory.dmp

Filesize
3.9MB

Download
memory/2300-4609-0x00007FF700D50000-0x00007FF701142000-memory.dmp

Filesize
3.9MB

Download
memory/2368-187-0x00007FF6BCE60000-0x00007FF6BD252000-memory.dmp

Filesize
3.9MB

Download
memory/2368-4601-0x00007FF6BCE60000-0x00007FF6BD252000-memory.dmp

Filesize
3.9MB

Download
memory/2372-137-0x00007FF634D20000-0x00007FF635112000-memory.dmp

Filesize
3.9MB

Download
memory/2372-4603-0x00007FF634D20000-0x00007FF635112000-memory.dmp

Filesize
3.9MB

Download
memory/3116-7-0x00007FF6BA960000-0x00007FF6BAD52000-memory.dmp

Filesize
3.9MB

Download
memory/3116-3566-0x00007FF6BA960000-0x00007FF6BAD52000-memory.dmp

Filesize
3.9MB

Download
memory/3256-169-0x00007FF6C7720000-0x00007FF6C7B12000-memory.dmp

Filesize
3.9MB

Download
memory/3256-4605-0x00007FF6C7720000-0x00007FF6C7B12000-memory.dmp

Filesize
3.9MB

Download
memory/3336-124-0x00007FF7A79C0000-0x00007FF7A7DB2000-memory.dmp

Filesize
3.9MB

Download
memory/3344-200-0x00007FF7639C0000-0x00007FF763DB2000-memory.dmp

Filesize
3.9MB

Download
memory/3344-4594-0x00007FF7639C0000-0x00007FF763DB2000-memory.dmp

Filesize
3.9MB

Download
memory/3368-3568-0x00007FF764BD0000-0x00007FF764FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3368-46-0x00007FF764BD0000-0x00007FF764FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-113-0x00007FF60ED60000-0x00007FF60F152000-memory.dmp

Filesize
3.9MB

Download
memory/3552-4599-0x00007FF605860000-0x00007FF605C52000-memory.dmp

Filesize
3.9MB

Download
memory/3552-204-0x00007FF605860000-0x00007FF605C52000-memory.dmp

Filesize
3.9MB

Download
memory/3584-0-0x00007FF73B160000-0x00007FF73B552000-memory.dmp

Filesize
3.9MB

Download
memory/3584-1-0x00000242F8670000-0x00000242F8680000-memory.dmp

Filesize
64KB

Download
memory/4048-64-0x00007FF7BF3B0000-0x00007FF7BF7A2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-91-0x00007FF769680000-0x00007FF769A72000-memory.dmp

Filesize
3.9MB

Download
memory/4484-126-0x00007FF7D0320000-0x00007FF7D0712000-memory.dmp

Filesize
3.9MB

Download
memory/4568-188-0x00007FF7773F0000-0x00007FF7777E2000-memory.dmp

Filesize
3.9MB

Download
memory/4572-85-0x00007FF7AC800000-0x00007FF7ACBF2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-8-0x00007FF968B43000-0x00007FF968B45000-memory.dmp

Filesize
8KB

Download
memory/4592-3398-0x00007FF968B43000-0x00007FF968B45000-memory.dmp

Filesize
8KB

Download
memory/4592-74-0x0000016E9A7B0000-0x0000016E9A7D2000-memory.dmp

Filesize
136KB

Download
memory/4592-3405-0x00007FF968B40000-0x00007FF969601000-memory.dmp

Filesize
10.8MB

Download
memory/4592-388-0x0000016E9B330000-0x0000016E9BAD6000-memory.dmp

Filesize
7.6MB

Download
memory/4592-152-0x00007FF968B40000-0x00007FF969601000-memory.dmp

Filesize
10.8MB

Download
memory/4592-3484-0x00007FF968B40000-0x00007FF969601000-memory.dmp

Filesize
10.8MB

Download
memory/4592-41-0x00007FF968B40000-0x00007FF969601000-memory.dmp

Filesize
10.8MB

Download
memory/4924-175-0x00007FF6346D0000-0x00007FF634AC2000-memory.dmp

Filesize
3.9MB

Download
memory/4924-4586-0x00007FF6346D0000-0x00007FF634AC2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-3582-0x00007FF674A70000-0x00007FF674E62000-memory.dmp

Filesize
3.9MB

Download
memory/5016-55-0x00007FF674A70000-0x00007FF674E62000-memory.dmp

Filesize
3.9MB

Download