xmrig | c3b4fba9661a4b983b7b96789d8c881d75d22afc28d39dbd8cfc43bcb2a2c9aa

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6ee39d50b5833d4cc8aa658006a3b490N.exe
Size

2.9MB
MD5

6ee39d50b5833d4cc8aa658006a3b490
SHA1

0c8bd834ac0ca59f91f16312300a193a5f5ce7ca
SHA256

c3b4fba9661a4b983b7b96789d8c881d75d22afc28d39dbd8cfc43bcb2a2c9aa
SHA512

6b90c0069b61cc5b7b340724c283ae2c93f96723eae2b9f7f7ad744a59522a5f296580e275d0212522715e8640a65671f075b0772ed8e3aea383b65387bf4155
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5V+J1K7zGZ:NAB2

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/1956-806-0x00007FF6B2540000-0x00007FF6B2932000-memory.dmp	xmrig
behavioral2/memory/1612-809-0x00007FF7CB190000-0x00007FF7CB582000-memory.dmp	xmrig
behavioral2/memory/1624-815-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp	xmrig
behavioral2/memory/4676-814-0x00007FF64AA90000-0x00007FF64AE82000-memory.dmp	xmrig
behavioral2/memory/64-823-0x00007FF75AE50000-0x00007FF75B242000-memory.dmp	xmrig
behavioral2/memory/2464-824-0x00007FF6EC2C0000-0x00007FF6EC6B2000-memory.dmp	xmrig
behavioral2/memory/1564-834-0x00007FF781990000-0x00007FF781D82000-memory.dmp	xmrig
behavioral2/memory/3924-831-0x00007FF6B2B70000-0x00007FF6B2F62000-memory.dmp	xmrig
behavioral2/memory/2500-827-0x00007FF657810000-0x00007FF657C02000-memory.dmp	xmrig
behavioral2/memory/4636-822-0x00007FF743120000-0x00007FF743512000-memory.dmp	xmrig
behavioral2/memory/2448-820-0x00007FF6A81C0000-0x00007FF6A85B2000-memory.dmp	xmrig
behavioral2/memory/648-808-0x00007FF728EF0000-0x00007FF7292E2000-memory.dmp	xmrig
behavioral2/memory/3516-851-0x00007FF6F8310000-0x00007FF6F8702000-memory.dmp	xmrig
behavioral2/memory/4680-850-0x00007FF739DB0000-0x00007FF73A1A2000-memory.dmp	xmrig
behavioral2/memory/2280-844-0x00007FF60A2D0000-0x00007FF60A6C2000-memory.dmp	xmrig
behavioral2/memory/2564-1304-0x00007FF73EBA0000-0x00007FF73EF92000-memory.dmp	xmrig
behavioral2/memory/1992-1290-0x00007FF6A77A0000-0x00007FF6A7B92000-memory.dmp	xmrig
behavioral2/memory/4708-1677-0x00007FF748A30000-0x00007FF748E22000-memory.dmp	xmrig
behavioral2/memory/3720-2048-0x00007FF774900000-0x00007FF774CF2000-memory.dmp	xmrig
behavioral2/memory/3036-2049-0x00007FF771220000-0x00007FF771612000-memory.dmp	xmrig
behavioral2/memory/412-2050-0x00007FF7DB1C0000-0x00007FF7DB5B2000-memory.dmp	xmrig
behavioral2/memory/4708-2052-0x00007FF748A30000-0x00007FF748E22000-memory.dmp	xmrig
behavioral2/memory/2564-2056-0x00007FF73EBA0000-0x00007FF73EF92000-memory.dmp	xmrig
behavioral2/memory/4032-2055-0x00007FF61D7D0000-0x00007FF61DBC2000-memory.dmp	xmrig
behavioral2/memory/1744-2058-0x00007FF6C4810000-0x00007FF6C4C02000-memory.dmp	xmrig
behavioral2/memory/3036-2062-0x00007FF771220000-0x00007FF771612000-memory.dmp	xmrig
behavioral2/memory/4456-2061-0x00007FF7CE010000-0x00007FF7CE402000-memory.dmp	xmrig
behavioral2/memory/412-2066-0x00007FF7DB1C0000-0x00007FF7DB5B2000-memory.dmp	xmrig
behavioral2/memory/3720-2064-0x00007FF774900000-0x00007FF774CF2000-memory.dmp	xmrig
behavioral2/memory/64-2080-0x00007FF75AE50000-0x00007FF75B242000-memory.dmp	xmrig
behavioral2/memory/1956-2084-0x00007FF6B2540000-0x00007FF6B2932000-memory.dmp	xmrig
behavioral2/memory/2464-2086-0x00007FF6EC2C0000-0x00007FF6EC6B2000-memory.dmp	xmrig
behavioral2/memory/3924-2089-0x00007FF6B2B70000-0x00007FF6B2F62000-memory.dmp	xmrig
behavioral2/memory/1564-2103-0x00007FF781990000-0x00007FF781D82000-memory.dmp	xmrig
behavioral2/memory/4680-2122-0x00007FF739DB0000-0x00007FF73A1A2000-memory.dmp	xmrig
behavioral2/memory/3516-2121-0x00007FF6F8310000-0x00007FF6F8702000-memory.dmp	xmrig
behavioral2/memory/2280-2118-0x00007FF60A2D0000-0x00007FF60A6C2000-memory.dmp	xmrig
behavioral2/memory/2500-2090-0x00007FF657810000-0x00007FF657C02000-memory.dmp	xmrig
behavioral2/memory/3104-2083-0x00007FF7DF1A0000-0x00007FF7DF592000-memory.dmp	xmrig
behavioral2/memory/648-2078-0x00007FF728EF0000-0x00007FF7292E2000-memory.dmp	xmrig
behavioral2/memory/4676-2077-0x00007FF64AA90000-0x00007FF64AE82000-memory.dmp	xmrig
behavioral2/memory/1612-2074-0x00007FF7CB190000-0x00007FF7CB582000-memory.dmp	xmrig
behavioral2/memory/2448-2071-0x00007FF6A81C0000-0x00007FF6A85B2000-memory.dmp	xmrig
behavioral2/memory/4636-2069-0x00007FF743120000-0x00007FF743512000-memory.dmp	xmrig
behavioral2/memory/1624-2073-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1724	powershell.exe
5	1724	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1724	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2564	zfHZMRF.exe
4708	IWyngsE.exe
4032	rfbCHKE.exe
1744	VQVcOSa.exe
3036	CroniKd.exe
3720	OZlqJfm.exe
412	jXaDjHD.exe
4456	BEJeArU.exe
3104	poChzlo.exe
1956	tJzQdPH.exe
648	XOOtmdP.exe
1612	FVucabx.exe
4676	hlSPZFP.exe
1624	cKJFpfE.exe
2448	AMxXgux.exe
4636	htMErQm.exe
64	woBDwsi.exe
2464	yvqjFEJ.exe
2500	QsXKkiD.exe
3924	aspRmox.exe
1564	YsGsDwg.exe
2280	LsSyxDn.exe
4680	jZXQKzt.exe
3516	CVWseRi.exe
3028	NBlNBRK.exe
1764	VquxFRr.exe
5080	nbpoluM.exe
1372	ouThsWI.exe
832	ooyyyUG.exe
4304	RDGgMLR.exe
1140	wgpugGs.exe
2700	NCQtKqi.exe
4348	awCalXE.exe
348	BXYxvOU.exe
3136	LHXcZbT.exe
5040	PVMeuga.exe
3728	NQjUiTr.exe
944	NsydGKt.exe
1104	vArtkoM.exe
3424	AIPOsup.exe
1736	MtdhrdL.exe
3556	BQKdoLJ.exe
2112	ULjPzAU.exe
3848	FhdZvjN.exe
4824	uqBNcjs.exe
5128	sAkbrYN.exe
5148	xaZxuQE.exe
5176	LDrtmmr.exe
5204	aHNiLuf.exe
5228	MjHHsiL.exe
5256	roGPUxa.exe
5288	oMsWYDY.exe
5316	WwVaUpm.exe
5340	qEBPYaI.exe
5372	kMZkYUW.exe
5400	idaiNpV.exe
5428	sqHRPPs.exe
5456	QjDSttQ.exe
5488	qVAyuwR.exe
5516	XipzjjX.exe
5540	azoahyt.exe
5572	HwJITwv.exe
5600	BsbewCC.exe
5628	JTjLmkz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1992-0-0x00007FF6A77A0000-0x00007FF6A7B92000-memory.dmp	upx
behavioral2/files/0x00080000000235d1-8.dat	upx
behavioral2/memory/4708-15-0x00007FF748A30000-0x00007FF748E22000-memory.dmp	upx
behavioral2/files/0x00070000000235d7-28.dat	upx
behavioral2/files/0x00070000000235d8-37.dat	upx
behavioral2/memory/412-43-0x00007FF7DB1C0000-0x00007FF7DB5B2000-memory.dmp	upx
behavioral2/files/0x00070000000235d6-45.dat	upx
behavioral2/files/0x00070000000235dc-75.dat	upx
behavioral2/files/0x00070000000235de-85.dat	upx
behavioral2/files/0x00070000000235e0-95.dat	upx
behavioral2/files/0x00070000000235e4-125.dat	upx
behavioral2/files/0x00080000000235e7-135.dat	upx
behavioral2/files/0x00070000000235ea-150.dat	upx
behavioral2/files/0x00070000000235ed-165.dat	upx
behavioral2/files/0x00070000000235f1-182.dat	upx
behavioral2/memory/1956-806-0x00007FF6B2540000-0x00007FF6B2932000-memory.dmp	upx
behavioral2/memory/1612-809-0x00007FF7CB190000-0x00007FF7CB582000-memory.dmp	upx
behavioral2/memory/1624-815-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp	upx
behavioral2/memory/4676-814-0x00007FF64AA90000-0x00007FF64AE82000-memory.dmp	upx
behavioral2/memory/64-823-0x00007FF75AE50000-0x00007FF75B242000-memory.dmp	upx
behavioral2/memory/2464-824-0x00007FF6EC2C0000-0x00007FF6EC6B2000-memory.dmp	upx
behavioral2/memory/1564-834-0x00007FF781990000-0x00007FF781D82000-memory.dmp	upx
behavioral2/memory/3924-831-0x00007FF6B2B70000-0x00007FF6B2F62000-memory.dmp	upx
behavioral2/memory/2500-827-0x00007FF657810000-0x00007FF657C02000-memory.dmp	upx
behavioral2/memory/4636-822-0x00007FF743120000-0x00007FF743512000-memory.dmp	upx
behavioral2/memory/2448-820-0x00007FF6A81C0000-0x00007FF6A85B2000-memory.dmp	upx
behavioral2/memory/648-808-0x00007FF728EF0000-0x00007FF7292E2000-memory.dmp	upx
behavioral2/memory/3516-851-0x00007FF6F8310000-0x00007FF6F8702000-memory.dmp	upx
behavioral2/memory/4680-850-0x00007FF739DB0000-0x00007FF73A1A2000-memory.dmp	upx
behavioral2/memory/2280-844-0x00007FF60A2D0000-0x00007FF60A6C2000-memory.dmp	upx
behavioral2/files/0x00070000000235ef-180.dat	upx
behavioral2/files/0x00070000000235f0-177.dat	upx
behavioral2/files/0x00070000000235ee-175.dat	upx
behavioral2/files/0x00080000000235e6-170.dat	upx
behavioral2/files/0x00070000000235ec-160.dat	upx
behavioral2/files/0x00070000000235eb-155.dat	upx
behavioral2/files/0x00070000000235e9-145.dat	upx
behavioral2/files/0x00070000000235e8-140.dat	upx
behavioral2/files/0x00070000000235e5-130.dat	upx
behavioral2/files/0x00070000000235e3-120.dat	upx
behavioral2/files/0x00070000000235e2-115.dat	upx
behavioral2/files/0x00070000000235e1-100.dat	upx
behavioral2/files/0x00070000000235df-90.dat	upx
behavioral2/files/0x00070000000235dd-80.dat	upx
behavioral2/files/0x00080000000235d2-70.dat	upx
behavioral2/files/0x00070000000235db-65.dat	upx
behavioral2/files/0x00070000000235da-57.dat	upx
behavioral2/memory/3104-54-0x00007FF7DF1A0000-0x00007FF7DF592000-memory.dmp	upx
behavioral2/files/0x00070000000235d9-48.dat	upx
behavioral2/memory/4456-44-0x00007FF7CE010000-0x00007FF7CE402000-memory.dmp	upx
behavioral2/memory/3036-38-0x00007FF771220000-0x00007FF771612000-memory.dmp	upx
behavioral2/memory/3720-31-0x00007FF774900000-0x00007FF774CF2000-memory.dmp	upx
behavioral2/files/0x00070000000235d5-34.dat	upx
behavioral2/memory/1744-30-0x00007FF6C4810000-0x00007FF6C4C02000-memory.dmp	upx
behavioral2/memory/4032-25-0x00007FF61D7D0000-0x00007FF61DBC2000-memory.dmp	upx
behavioral2/files/0x00080000000235d4-22.dat	upx
behavioral2/files/0x00090000000235ce-18.dat	upx
behavioral2/memory/2564-11-0x00007FF73EBA0000-0x00007FF73EF92000-memory.dmp	upx
behavioral2/memory/2564-1304-0x00007FF73EBA0000-0x00007FF73EF92000-memory.dmp	upx
behavioral2/memory/1992-1290-0x00007FF6A77A0000-0x00007FF6A7B92000-memory.dmp	upx
behavioral2/memory/4708-1677-0x00007FF748A30000-0x00007FF748E22000-memory.dmp	upx
behavioral2/memory/3720-2048-0x00007FF774900000-0x00007FF774CF2000-memory.dmp	upx
behavioral2/memory/3036-2049-0x00007FF771220000-0x00007FF771612000-memory.dmp	upx
behavioral2/memory/412-2050-0x00007FF7DB1C0000-0x00007FF7DB5B2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\khjBRXW.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\NDNxiqR.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\gmxzGnJ.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\xptqXuj.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\vSNbnHi.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\PQIKpEa.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\jXaDjHD.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\bWvgRQy.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\tJuAXkJ.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\GlcMAcm.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\iXMufUB.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\gjzOxyW.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\HpWZMPG.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\PgesHWV.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\WdINGvP.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\BoEmNBu.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\bimmcoH.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\ojIJbyy.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\ZBUMWOj.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\eZIsuin.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\SkSnkfe.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\LIqBuZs.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\WqQndbW.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\eiHQUyF.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\nUzGWmU.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\PVMeuga.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\mUjRJQM.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\OCoLgRe.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\quLrAZp.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\pkslFTO.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\JQUJkCA.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\byrdGjo.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\kTfyLPd.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\MrgtpDy.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\QHCPFAd.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\RHYOWri.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\YJpEYgB.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\PmepFla.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\eerDmsi.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\YIqfuAI.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\aHNiLuf.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\peiJTga.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\aiRUlvI.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\toVbtxE.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\SPWHZmb.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\CXCUPwi.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\uSxQglL.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\jjZgeFq.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\fhHHtYs.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\VMIGoVV.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\SGWKWMR.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\JPJZjqQ.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\OmbSgaw.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\ifGUfaD.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\kJRQkQG.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\HsrmEsD.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\GeyrdSc.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\TLvXUxT.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\oRLXdFz.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\ooyyyUG.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\rqoIacZ.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\bOvZnWV.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\ylndLqa.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe
File created	C:\Windows\System\qlokLUD.exe	6ee39d50b5833d4cc8aa658006a3b490N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1724	powershell.exe
1724	powershell.exe
1724	powershell.exe
1724	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe
Token: SeLockMemoryPrivilege	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe
Token: SeDebugPrivilege	1724	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1724	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	92
PID 1992 wrote to memory of 1724	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	92
PID 1992 wrote to memory of 2564	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	93
PID 1992 wrote to memory of 2564	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	93
PID 1992 wrote to memory of 4708	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	94
PID 1992 wrote to memory of 4708	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	94
PID 1992 wrote to memory of 4032	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	95
PID 1992 wrote to memory of 4032	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	95
PID 1992 wrote to memory of 1744	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	96
PID 1992 wrote to memory of 1744	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	96
PID 1992 wrote to memory of 3036	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	97
PID 1992 wrote to memory of 3036	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	97
PID 1992 wrote to memory of 3720	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	98
PID 1992 wrote to memory of 3720	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	98
PID 1992 wrote to memory of 412	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	99
PID 1992 wrote to memory of 412	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	99
PID 1992 wrote to memory of 4456	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	100
PID 1992 wrote to memory of 4456	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	100
PID 1992 wrote to memory of 3104	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	101
PID 1992 wrote to memory of 3104	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	101
PID 1992 wrote to memory of 1956	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	102
PID 1992 wrote to memory of 1956	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	102
PID 1992 wrote to memory of 648	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	103
PID 1992 wrote to memory of 648	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	103
PID 1992 wrote to memory of 1612	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	104
PID 1992 wrote to memory of 1612	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	104
PID 1992 wrote to memory of 4676	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	105
PID 1992 wrote to memory of 4676	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	105
PID 1992 wrote to memory of 1624	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	106
PID 1992 wrote to memory of 1624	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	106
PID 1992 wrote to memory of 2448	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	107
PID 1992 wrote to memory of 2448	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	107
PID 1992 wrote to memory of 4636	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	108
PID 1992 wrote to memory of 4636	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	108
PID 1992 wrote to memory of 64	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	109
PID 1992 wrote to memory of 64	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	109
PID 1992 wrote to memory of 2464	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	110
PID 1992 wrote to memory of 2464	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	110
PID 1992 wrote to memory of 2500	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	111
PID 1992 wrote to memory of 2500	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	111
PID 1992 wrote to memory of 3924	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	112
PID 1992 wrote to memory of 3924	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	112
PID 1992 wrote to memory of 1564	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	113
PID 1992 wrote to memory of 1564	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	113
PID 1992 wrote to memory of 2280	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	114
PID 1992 wrote to memory of 2280	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	114
PID 1992 wrote to memory of 4680	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	115
PID 1992 wrote to memory of 4680	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	115
PID 1992 wrote to memory of 3516	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	116
PID 1992 wrote to memory of 3516	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	116
PID 1992 wrote to memory of 3028	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	117
PID 1992 wrote to memory of 3028	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	117
PID 1992 wrote to memory of 1764	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	118
PID 1992 wrote to memory of 1764	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	118
PID 1992 wrote to memory of 5080	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	119
PID 1992 wrote to memory of 5080	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	119
PID 1992 wrote to memory of 1372	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	120
PID 1992 wrote to memory of 1372	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	120
PID 1992 wrote to memory of 832	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	121
PID 1992 wrote to memory of 832	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	121
PID 1992 wrote to memory of 4304	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	122
PID 1992 wrote to memory of 4304	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	122
PID 1992 wrote to memory of 1140	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	123
PID 1992 wrote to memory of 1140	1992	6ee39d50b5833d4cc8aa658006a3b490N.exe	123

C:\Users\Admin\AppData\Local\Temp\6ee39d50b5833d4cc8aa658006a3b490N.exe
"C:\Users\Admin\AppData\Local\Temp\6ee39d50b5833d4cc8aa658006a3b490N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1724" "2960" "2792" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:5608
- C:\Windows\System\zfHZMRF.exe
  C:\Windows\System\zfHZMRF.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\IWyngsE.exe
  C:\Windows\System\IWyngsE.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\rfbCHKE.exe
  C:\Windows\System\rfbCHKE.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\VQVcOSa.exe
  C:\Windows\System\VQVcOSa.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\CroniKd.exe
  C:\Windows\System\CroniKd.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\OZlqJfm.exe
  C:\Windows\System\OZlqJfm.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\jXaDjHD.exe
  C:\Windows\System\jXaDjHD.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\BEJeArU.exe
  C:\Windows\System\BEJeArU.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\poChzlo.exe
  C:\Windows\System\poChzlo.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\tJzQdPH.exe
  C:\Windows\System\tJzQdPH.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\XOOtmdP.exe
  C:\Windows\System\XOOtmdP.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\FVucabx.exe
  C:\Windows\System\FVucabx.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\hlSPZFP.exe
  C:\Windows\System\hlSPZFP.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\cKJFpfE.exe
  C:\Windows\System\cKJFpfE.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\AMxXgux.exe
  C:\Windows\System\AMxXgux.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\htMErQm.exe
  C:\Windows\System\htMErQm.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\woBDwsi.exe
  C:\Windows\System\woBDwsi.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\yvqjFEJ.exe
  C:\Windows\System\yvqjFEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\QsXKkiD.exe
  C:\Windows\System\QsXKkiD.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\aspRmox.exe
  C:\Windows\System\aspRmox.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\YsGsDwg.exe
  C:\Windows\System\YsGsDwg.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\LsSyxDn.exe
  C:\Windows\System\LsSyxDn.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\jZXQKzt.exe
  C:\Windows\System\jZXQKzt.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\CVWseRi.exe
  C:\Windows\System\CVWseRi.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\NBlNBRK.exe
  C:\Windows\System\NBlNBRK.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\VquxFRr.exe
  C:\Windows\System\VquxFRr.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\nbpoluM.exe
  C:\Windows\System\nbpoluM.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\ouThsWI.exe
  C:\Windows\System\ouThsWI.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ooyyyUG.exe
  C:\Windows\System\ooyyyUG.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\RDGgMLR.exe
  C:\Windows\System\RDGgMLR.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\wgpugGs.exe
  C:\Windows\System\wgpugGs.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\NCQtKqi.exe
  C:\Windows\System\NCQtKqi.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\awCalXE.exe
  C:\Windows\System\awCalXE.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\BXYxvOU.exe
  C:\Windows\System\BXYxvOU.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\LHXcZbT.exe
  C:\Windows\System\LHXcZbT.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\PVMeuga.exe
  C:\Windows\System\PVMeuga.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\NQjUiTr.exe
  C:\Windows\System\NQjUiTr.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\NsydGKt.exe
  C:\Windows\System\NsydGKt.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\vArtkoM.exe
  C:\Windows\System\vArtkoM.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\AIPOsup.exe
  C:\Windows\System\AIPOsup.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\MtdhrdL.exe
  C:\Windows\System\MtdhrdL.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\BQKdoLJ.exe
  C:\Windows\System\BQKdoLJ.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\ULjPzAU.exe
  C:\Windows\System\ULjPzAU.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\FhdZvjN.exe
  C:\Windows\System\FhdZvjN.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\uqBNcjs.exe
  C:\Windows\System\uqBNcjs.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\sAkbrYN.exe
  C:\Windows\System\sAkbrYN.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\xaZxuQE.exe
  C:\Windows\System\xaZxuQE.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\LDrtmmr.exe
  C:\Windows\System\LDrtmmr.exe
  2⤵
  - Executes dropped EXE
  PID:5176
- C:\Windows\System\aHNiLuf.exe
  C:\Windows\System\aHNiLuf.exe
  2⤵
  - Executes dropped EXE
  PID:5204
- C:\Windows\System\MjHHsiL.exe
  C:\Windows\System\MjHHsiL.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\roGPUxa.exe
  C:\Windows\System\roGPUxa.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\oMsWYDY.exe
  C:\Windows\System\oMsWYDY.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\WwVaUpm.exe
  C:\Windows\System\WwVaUpm.exe
  2⤵
  - Executes dropped EXE
  PID:5316
- C:\Windows\System\qEBPYaI.exe
  C:\Windows\System\qEBPYaI.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\kMZkYUW.exe
  C:\Windows\System\kMZkYUW.exe
  2⤵
  - Executes dropped EXE
  PID:5372
- C:\Windows\System\idaiNpV.exe
  C:\Windows\System\idaiNpV.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\sqHRPPs.exe
  C:\Windows\System\sqHRPPs.exe
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Windows\System\QjDSttQ.exe
  C:\Windows\System\QjDSttQ.exe
  2⤵
  - Executes dropped EXE
  PID:5456
- C:\Windows\System\qVAyuwR.exe
  C:\Windows\System\qVAyuwR.exe
  2⤵
  - Executes dropped EXE
  PID:5488
- C:\Windows\System\XipzjjX.exe
  C:\Windows\System\XipzjjX.exe
  2⤵
  - Executes dropped EXE
  PID:5516
- C:\Windows\System\azoahyt.exe
  C:\Windows\System\azoahyt.exe
  2⤵
  - Executes dropped EXE
  PID:5540
- C:\Windows\System\HwJITwv.exe
  C:\Windows\System\HwJITwv.exe
  2⤵
  - Executes dropped EXE
  PID:5572
- C:\Windows\System\BsbewCC.exe
  C:\Windows\System\BsbewCC.exe
  2⤵
  - Executes dropped EXE
  PID:5600
- C:\Windows\System\JTjLmkz.exe
  C:\Windows\System\JTjLmkz.exe
  2⤵
  - Executes dropped EXE
  PID:5628
- C:\Windows\System\dmtDzxM.exe
  C:\Windows\System\dmtDzxM.exe
  2⤵
  PID:5656
- C:\Windows\System\ergEvWJ.exe
  C:\Windows\System\ergEvWJ.exe
  2⤵
  PID:5688
- C:\Windows\System\TCxiUat.exe
  C:\Windows\System\TCxiUat.exe
  2⤵
  PID:5712
- C:\Windows\System\cTFlqWv.exe
  C:\Windows\System\cTFlqWv.exe
  2⤵
  PID:5744
- C:\Windows\System\jjZgeFq.exe
  C:\Windows\System\jjZgeFq.exe
  2⤵
  PID:5768
- C:\Windows\System\bYwSEtd.exe
  C:\Windows\System\bYwSEtd.exe
  2⤵
  PID:5804
- C:\Windows\System\WsNiAMt.exe
  C:\Windows\System\WsNiAMt.exe
  2⤵
  PID:5828
- C:\Windows\System\llJQieK.exe
  C:\Windows\System\llJQieK.exe
  2⤵
  PID:5856
- C:\Windows\System\gsyHtTY.exe
  C:\Windows\System\gsyHtTY.exe
  2⤵
  PID:5888
- C:\Windows\System\XoDvxjq.exe
  C:\Windows\System\XoDvxjq.exe
  2⤵
  PID:5916
- C:\Windows\System\oyPzrdf.exe
  C:\Windows\System\oyPzrdf.exe
  2⤵
  PID:5940
- C:\Windows\System\zNNvPtG.exe
  C:\Windows\System\zNNvPtG.exe
  2⤵
  PID:5976
- C:\Windows\System\ayGcwST.exe
  C:\Windows\System\ayGcwST.exe
  2⤵
  PID:6004
- C:\Windows\System\dEwmPaA.exe
  C:\Windows\System\dEwmPaA.exe
  2⤵
  PID:6032
- C:\Windows\System\VgobXDy.exe
  C:\Windows\System\VgobXDy.exe
  2⤵
  PID:6060
- C:\Windows\System\JyVnOni.exe
  C:\Windows\System\JyVnOni.exe
  2⤵
  PID:6088
- C:\Windows\System\XldMElH.exe
  C:\Windows\System\XldMElH.exe
  2⤵
  PID:6128
- C:\Windows\System\JEfweBF.exe
  C:\Windows\System\JEfweBF.exe
  2⤵
  PID:4316
- C:\Windows\System\opVpBQl.exe
  C:\Windows\System\opVpBQl.exe
  2⤵
  PID:5012
- C:\Windows\System\TvtqxHX.exe
  C:\Windows\System\TvtqxHX.exe
  2⤵
  PID:4688
- C:\Windows\System\VoxJIlX.exe
  C:\Windows\System\VoxJIlX.exe
  2⤵
  PID:4832
- C:\Windows\System\isnoteE.exe
  C:\Windows\System\isnoteE.exe
  2⤵
  PID:5164
- C:\Windows\System\PhZiuty.exe
  C:\Windows\System\PhZiuty.exe
  2⤵
  PID:5220
- C:\Windows\System\TbEDxun.exe
  C:\Windows\System\TbEDxun.exe
  2⤵
  PID:5300
- C:\Windows\System\inAulUi.exe
  C:\Windows\System\inAulUi.exe
  2⤵
  PID:5364
- C:\Windows\System\RTRelKe.exe
  C:\Windows\System\RTRelKe.exe
  2⤵
  PID:5424
- C:\Windows\System\PhpMQJg.exe
  C:\Windows\System\PhpMQJg.exe
  2⤵
  PID:5500
- C:\Windows\System\mNdvjps.exe
  C:\Windows\System\mNdvjps.exe
  2⤵
  PID:5564
- C:\Windows\System\OxEguAg.exe
  C:\Windows\System\OxEguAg.exe
  2⤵
  PID:5624
- C:\Windows\System\AklswcY.exe
  C:\Windows\System\AklswcY.exe
  2⤵
  PID:5700
- C:\Windows\System\GOFUoWE.exe
  C:\Windows\System\GOFUoWE.exe
  2⤵
  PID:5760
- C:\Windows\System\lnvLinF.exe
  C:\Windows\System\lnvLinF.exe
  2⤵
  PID:5824
- C:\Windows\System\bRuPMSq.exe
  C:\Windows\System\bRuPMSq.exe
  2⤵
  PID:5904
- C:\Windows\System\EDFOckV.exe
  C:\Windows\System\EDFOckV.exe
  2⤵
  PID:5964
- C:\Windows\System\YhcowUA.exe
  C:\Windows\System\YhcowUA.exe
  2⤵
  PID:6028
- C:\Windows\System\FfCpCkZ.exe
  C:\Windows\System\FfCpCkZ.exe
  2⤵
  PID:6108
- C:\Windows\System\llFHGMS.exe
  C:\Windows\System\llFHGMS.exe
  2⤵
  PID:2572
- C:\Windows\System\GgyrBTC.exe
  C:\Windows\System\GgyrBTC.exe
  2⤵
  PID:5124
- C:\Windows\System\DlKAsWe.exe
  C:\Windows\System\DlKAsWe.exe
  2⤵
  PID:5272
- C:\Windows\System\xULgblo.exe
  C:\Windows\System\xULgblo.exe
  2⤵
  PID:5396
- C:\Windows\System\MBoPYEQ.exe
  C:\Windows\System\MBoPYEQ.exe
  2⤵
  PID:5596
- C:\Windows\System\FgLxoyS.exe
  C:\Windows\System\FgLxoyS.exe
  2⤵
  PID:5732
- C:\Windows\System\kQoPSyG.exe
  C:\Windows\System\kQoPSyG.exe
  2⤵
  PID:5880
- C:\Windows\System\XRUwWWD.exe
  C:\Windows\System\XRUwWWD.exe
  2⤵
  PID:6168
- C:\Windows\System\zSYeonT.exe
  C:\Windows\System\zSYeonT.exe
  2⤵
  PID:6196
- C:\Windows\System\jGPsPsh.exe
  C:\Windows\System\jGPsPsh.exe
  2⤵
  PID:6224
- C:\Windows\System\SQiwVLQ.exe
  C:\Windows\System\SQiwVLQ.exe
  2⤵
  PID:6252
- C:\Windows\System\EJCxwTB.exe
  C:\Windows\System\EJCxwTB.exe
  2⤵
  PID:6284
- C:\Windows\System\sOPVnBf.exe
  C:\Windows\System\sOPVnBf.exe
  2⤵
  PID:6316
- C:\Windows\System\gjaAefv.exe
  C:\Windows\System\gjaAefv.exe
  2⤵
  PID:6344
- C:\Windows\System\fUflybf.exe
  C:\Windows\System\fUflybf.exe
  2⤵
  PID:6376
- C:\Windows\System\BZtNfwQ.exe
  C:\Windows\System\BZtNfwQ.exe
  2⤵
  PID:6404
- C:\Windows\System\WpYIFEn.exe
  C:\Windows\System\WpYIFEn.exe
  2⤵
  PID:6428
- C:\Windows\System\cfzIhIs.exe
  C:\Windows\System\cfzIhIs.exe
  2⤵
  PID:6456
- C:\Windows\System\GhTDRHk.exe
  C:\Windows\System\GhTDRHk.exe
  2⤵
  PID:6484
- C:\Windows\System\haMZaOD.exe
  C:\Windows\System\haMZaOD.exe
  2⤵
  PID:6512
- C:\Windows\System\aVBnCAF.exe
  C:\Windows\System\aVBnCAF.exe
  2⤵
  PID:6544
- C:\Windows\System\iNINQMt.exe
  C:\Windows\System\iNINQMt.exe
  2⤵
  PID:6568
- C:\Windows\System\IRtXsWr.exe
  C:\Windows\System\IRtXsWr.exe
  2⤵
  PID:6600
- C:\Windows\System\PtbCwzj.exe
  C:\Windows\System\PtbCwzj.exe
  2⤵
  PID:6620
- C:\Windows\System\twtQCOo.exe
  C:\Windows\System\twtQCOo.exe
  2⤵
  PID:6652
- C:\Windows\System\QpQhhuC.exe
  C:\Windows\System\QpQhhuC.exe
  2⤵
  PID:6684
- C:\Windows\System\yIdDkCI.exe
  C:\Windows\System\yIdDkCI.exe
  2⤵
  PID:6712
- C:\Windows\System\btHitAb.exe
  C:\Windows\System\btHitAb.exe
  2⤵
  PID:6744
- C:\Windows\System\ltHHqXt.exe
  C:\Windows\System\ltHHqXt.exe
  2⤵
  PID:6776
- C:\Windows\System\VGEbpXq.exe
  C:\Windows\System\VGEbpXq.exe
  2⤵
  PID:6804
- C:\Windows\System\UbwOcvp.exe
  C:\Windows\System\UbwOcvp.exe
  2⤵
  PID:6832
- C:\Windows\System\xDAGeNV.exe
  C:\Windows\System\xDAGeNV.exe
  2⤵
  PID:6864
- C:\Windows\System\pqcshoj.exe
  C:\Windows\System\pqcshoj.exe
  2⤵
  PID:6888
- C:\Windows\System\siuOntV.exe
  C:\Windows\System\siuOntV.exe
  2⤵
  PID:6916
- C:\Windows\System\zKICaGk.exe
  C:\Windows\System\zKICaGk.exe
  2⤵
  PID:6948
- C:\Windows\System\uhXWeMF.exe
  C:\Windows\System\uhXWeMF.exe
  2⤵
  PID:6976
- C:\Windows\System\lkJFsnX.exe
  C:\Windows\System\lkJFsnX.exe
  2⤵
  PID:7004
- C:\Windows\System\RNJhpoB.exe
  C:\Windows\System\RNJhpoB.exe
  2⤵
  PID:7028
- C:\Windows\System\SZSZKAf.exe
  C:\Windows\System\SZSZKAf.exe
  2⤵
  PID:7056
- C:\Windows\System\jtbTwhs.exe
  C:\Windows\System\jtbTwhs.exe
  2⤵
  PID:7088
- C:\Windows\System\YxvwtTy.exe
  C:\Windows\System\YxvwtTy.exe
  2⤵
  PID:7116
- C:\Windows\System\ejjppDh.exe
  C:\Windows\System\ejjppDh.exe
  2⤵
  PID:7140
- C:\Windows\System\VYLYeVh.exe
  C:\Windows\System\VYLYeVh.exe
  2⤵
  PID:5952
- C:\Windows\System\tlVkQaS.exe
  C:\Windows\System\tlVkQaS.exe
  2⤵
  PID:6084
- C:\Windows\System\YacKcnC.exe
  C:\Windows\System\YacKcnC.exe
  2⤵
  PID:2004
- C:\Windows\System\JMRJKVZ.exe
  C:\Windows\System\JMRJKVZ.exe
  2⤵
  PID:5476
- C:\Windows\System\oZUkhNq.exe
  C:\Windows\System\oZUkhNq.exe
  2⤵
  PID:5820
- C:\Windows\System\MHYoIcp.exe
  C:\Windows\System\MHYoIcp.exe
  2⤵
  PID:6192
- C:\Windows\System\zutkQud.exe
  C:\Windows\System\zutkQud.exe
  2⤵
  PID:6268
- C:\Windows\System\HQfHGLj.exe
  C:\Windows\System\HQfHGLj.exe
  2⤵
  PID:6336
- C:\Windows\System\qyfFWRo.exe
  C:\Windows\System\qyfFWRo.exe
  2⤵
  PID:6400
- C:\Windows\System\CcZqPAs.exe
  C:\Windows\System\CcZqPAs.exe
  2⤵
  PID:6476
- C:\Windows\System\NKKMemc.exe
  C:\Windows\System\NKKMemc.exe
  2⤵
  PID:6532
- C:\Windows\System\lqSqnHF.exe
  C:\Windows\System\lqSqnHF.exe
  2⤵
  PID:6592
- C:\Windows\System\HNDfWJw.exe
  C:\Windows\System\HNDfWJw.exe
  2⤵
  PID:6672
- C:\Windows\System\sTGHqqZ.exe
  C:\Windows\System\sTGHqqZ.exe
  2⤵
  PID:6736
- C:\Windows\System\BBcWVsn.exe
  C:\Windows\System\BBcWVsn.exe
  2⤵
  PID:6792
- C:\Windows\System\iWCKUHJ.exe
  C:\Windows\System\iWCKUHJ.exe
  2⤵
  PID:6828
- C:\Windows\System\nEaPUFW.exe
  C:\Windows\System\nEaPUFW.exe
  2⤵
  PID:6904
- C:\Windows\System\BGHwwZr.exe
  C:\Windows\System\BGHwwZr.exe
  2⤵
  PID:6960
- C:\Windows\System\LGdVoHh.exe
  C:\Windows\System\LGdVoHh.exe
  2⤵
  PID:7020
- C:\Windows\System\XxsprFN.exe
  C:\Windows\System\XxsprFN.exe
  2⤵
  PID:7100
- C:\Windows\System\BtBbZdU.exe
  C:\Windows\System\BtBbZdU.exe
  2⤵
  PID:7156
- C:\Windows\System\psPBLtb.exe
  C:\Windows\System\psPBLtb.exe
  2⤵
  PID:4848
- C:\Windows\System\BpgsMlV.exe
  C:\Windows\System\BpgsMlV.exe
  2⤵
  PID:5680
- C:\Windows\System\FhiHuTp.exe
  C:\Windows\System\FhiHuTp.exe
  2⤵
  PID:6244
- C:\Windows\System\RSxpQBG.exe
  C:\Windows\System\RSxpQBG.exe
  2⤵
  PID:6444
- C:\Windows\System\GnnCcri.exe
  C:\Windows\System\GnnCcri.exe
  2⤵
  PID:6564
- C:\Windows\System\LdjSRao.exe
  C:\Windows\System\LdjSRao.exe
  2⤵
  PID:6708
- C:\Windows\System\lfuVDxT.exe
  C:\Windows\System\lfuVDxT.exe
  2⤵
  PID:6856
- C:\Windows\System\EkrNVfw.exe
  C:\Windows\System\EkrNVfw.exe
  2⤵
  PID:6992
- C:\Windows\System\VVSRBbV.exe
  C:\Windows\System\VVSRBbV.exe
  2⤵
  PID:7128
- C:\Windows\System\hIMuWNz.exe
  C:\Windows\System\hIMuWNz.exe
  2⤵
  PID:788
- C:\Windows\System\dVWgrPr.exe
  C:\Windows\System\dVWgrPr.exe
  2⤵
  PID:7180
- C:\Windows\System\uSiPBNh.exe
  C:\Windows\System\uSiPBNh.exe
  2⤵
  PID:7208
- C:\Windows\System\fiCcpcn.exe
  C:\Windows\System\fiCcpcn.exe
  2⤵
  PID:7236
- C:\Windows\System\ZRMywbA.exe
  C:\Windows\System\ZRMywbA.exe
  2⤵
  PID:7264
- C:\Windows\System\gKPETcn.exe
  C:\Windows\System\gKPETcn.exe
  2⤵
  PID:7296
- C:\Windows\System\AfdDnwo.exe
  C:\Windows\System\AfdDnwo.exe
  2⤵
  PID:7320
- C:\Windows\System\EPSCHwu.exe
  C:\Windows\System\EPSCHwu.exe
  2⤵
  PID:7352
- C:\Windows\System\iwJloEv.exe
  C:\Windows\System\iwJloEv.exe
  2⤵
  PID:7380
- C:\Windows\System\MtxlmAB.exe
  C:\Windows\System\MtxlmAB.exe
  2⤵
  PID:7404
- C:\Windows\System\uBRHQQj.exe
  C:\Windows\System\uBRHQQj.exe
  2⤵
  PID:7432
- C:\Windows\System\fhHHtYs.exe
  C:\Windows\System\fhHHtYs.exe
  2⤵
  PID:7464
- C:\Windows\System\zfvBBSc.exe
  C:\Windows\System\zfvBBSc.exe
  2⤵
  PID:7492
- C:\Windows\System\EdaSdHS.exe
  C:\Windows\System\EdaSdHS.exe
  2⤵
  PID:7520
- C:\Windows\System\HWsbNfA.exe
  C:\Windows\System\HWsbNfA.exe
  2⤵
  PID:7544
- C:\Windows\System\WwEGiiN.exe
  C:\Windows\System\WwEGiiN.exe
  2⤵
  PID:7572
- C:\Windows\System\YvTtuSG.exe
  C:\Windows\System\YvTtuSG.exe
  2⤵
  PID:7604
- C:\Windows\System\TCpPzuU.exe
  C:\Windows\System\TCpPzuU.exe
  2⤵
  PID:7632
- C:\Windows\System\mUjRJQM.exe
  C:\Windows\System\mUjRJQM.exe
  2⤵
  PID:7656
- C:\Windows\System\WdINGvP.exe
  C:\Windows\System\WdINGvP.exe
  2⤵
  PID:7688
- C:\Windows\System\MMgkCjr.exe
  C:\Windows\System\MMgkCjr.exe
  2⤵
  PID:7716
- C:\Windows\System\oURSGdr.exe
  C:\Windows\System\oURSGdr.exe
  2⤵
  PID:7740
- C:\Windows\System\WmkQfcY.exe
  C:\Windows\System\WmkQfcY.exe
  2⤵
  PID:7768
- C:\Windows\System\peHRzFZ.exe
  C:\Windows\System\peHRzFZ.exe
  2⤵
  PID:7800
- C:\Windows\System\QCdXDjo.exe
  C:\Windows\System\QCdXDjo.exe
  2⤵
  PID:7824
- C:\Windows\System\bQQkMkv.exe
  C:\Windows\System\bQQkMkv.exe
  2⤵
  PID:7856
- C:\Windows\System\rTKQlfE.exe
  C:\Windows\System\rTKQlfE.exe
  2⤵
  PID:7880
- C:\Windows\System\ULnzdKj.exe
  C:\Windows\System\ULnzdKj.exe
  2⤵
  PID:7912
- C:\Windows\System\aDMxftv.exe
  C:\Windows\System\aDMxftv.exe
  2⤵
  PID:7940
- C:\Windows\System\XplmfhM.exe
  C:\Windows\System\XplmfhM.exe
  2⤵
  PID:7968
- C:\Windows\System\peiJTga.exe
  C:\Windows\System\peiJTga.exe
  2⤵
  PID:7992
- C:\Windows\System\xElMazj.exe
  C:\Windows\System\xElMazj.exe
  2⤵
  PID:8024
- C:\Windows\System\ODygNEB.exe
  C:\Windows\System\ODygNEB.exe
  2⤵
  PID:8052
- C:\Windows\System\RVWsvPA.exe
  C:\Windows\System\RVWsvPA.exe
  2⤵
  PID:8080
- C:\Windows\System\YYpWSiZ.exe
  C:\Windows\System\YYpWSiZ.exe
  2⤵
  PID:8108
- C:\Windows\System\KbKEAlC.exe
  C:\Windows\System\KbKEAlC.exe
  2⤵
  PID:8132
- C:\Windows\System\vTDBCES.exe
  C:\Windows\System\vTDBCES.exe
  2⤵
  PID:8160
- C:\Windows\System\eSlJESs.exe
  C:\Windows\System\eSlJESs.exe
  2⤵
  PID:8188
- C:\Windows\System\VrNFzDm.exe
  C:\Windows\System\VrNFzDm.exe
  2⤵
  PID:572
- C:\Windows\System\OKnTMDe.exe
  C:\Windows\System\OKnTMDe.exe
  2⤵
  PID:6772
- C:\Windows\System\yaHHGwM.exe
  C:\Windows\System\yaHHGwM.exe
  2⤵
  PID:7072
- C:\Windows\System\fRDXkGf.exe
  C:\Windows\System\fRDXkGf.exe
  2⤵
  PID:7176
- C:\Windows\System\vqcqPHI.exe
  C:\Windows\System\vqcqPHI.exe
  2⤵
  PID:7232
- C:\Windows\System\VazroNF.exe
  C:\Windows\System\VazroNF.exe
  2⤵
  PID:7308
- C:\Windows\System\rhQvkOw.exe
  C:\Windows\System\rhQvkOw.exe
  2⤵
  PID:7392
- C:\Windows\System\KTNtMAQ.exe
  C:\Windows\System\KTNtMAQ.exe
  2⤵
  PID:7424
- C:\Windows\System\kTXpmBj.exe
  C:\Windows\System\kTXpmBj.exe
  2⤵
  PID:7484
- C:\Windows\System\MivrWOY.exe
  C:\Windows\System\MivrWOY.exe
  2⤵
  PID:7540
- C:\Windows\System\ZiBaSoN.exe
  C:\Windows\System\ZiBaSoN.exe
  2⤵
  PID:7588
- C:\Windows\System\HXoBJsX.exe
  C:\Windows\System\HXoBJsX.exe
  2⤵
  PID:7812
- C:\Windows\System\mGyMxvF.exe
  C:\Windows\System\mGyMxvF.exe
  2⤵
  PID:8044
- C:\Windows\System\CPiQgyo.exe
  C:\Windows\System\CPiQgyo.exe
  2⤵
  PID:2992
- C:\Windows\System\lHkAwSy.exe
  C:\Windows\System\lHkAwSy.exe
  2⤵
  PID:8120
- C:\Windows\System\WqQndbW.exe
  C:\Windows\System\WqQndbW.exe
  2⤵
  PID:548
- C:\Windows\System\HrdlNev.exe
  C:\Windows\System\HrdlNev.exe
  2⤵
  PID:8176
- C:\Windows\System\FuwrYJN.exe
  C:\Windows\System\FuwrYJN.exe
  2⤵
  PID:1816
- C:\Windows\System\WSShNLP.exe
  C:\Windows\System\WSShNLP.exe
  2⤵
  PID:5676
- C:\Windows\System\steLmoG.exe
  C:\Windows\System\steLmoG.exe
  2⤵
  PID:7228
- C:\Windows\System\mUzDFHL.exe
  C:\Windows\System\mUzDFHL.exe
  2⤵
  PID:2044
- C:\Windows\System\YUWKpKD.exe
  C:\Windows\System\YUWKpKD.exe
  2⤵
  PID:7340
- C:\Windows\System\NgaGSts.exe
  C:\Windows\System\NgaGSts.exe
  2⤵
  PID:4928
- C:\Windows\System\LnKLBUU.exe
  C:\Windows\System\LnKLBUU.exe
  2⤵
  PID:1852
- C:\Windows\System\RiUbSpN.exe
  C:\Windows\System\RiUbSpN.exe
  2⤵
  PID:1536
- C:\Windows\System\BcsnRmy.exe
  C:\Windows\System\BcsnRmy.exe
  2⤵
  PID:1064
- C:\Windows\System\QkiFvum.exe
  C:\Windows\System\QkiFvum.exe
  2⤵
  PID:7708
- C:\Windows\System\JHIYcTb.exe
  C:\Windows\System\JHIYcTb.exe
  2⤵
  PID:7672
- C:\Windows\System\QouENYl.exe
  C:\Windows\System\QouENYl.exe
  2⤵
  PID:3712
- C:\Windows\System\ikAaMiY.exe
  C:\Windows\System\ikAaMiY.exe
  2⤵
  PID:2508
- C:\Windows\System\klZrVzA.exe
  C:\Windows\System\klZrVzA.exe
  2⤵
  PID:3960
- C:\Windows\System\tLezrAe.exe
  C:\Windows\System\tLezrAe.exe
  2⤵
  PID:7872
- C:\Windows\System\hwBMeqs.exe
  C:\Windows\System\hwBMeqs.exe
  2⤵
  PID:7932
- C:\Windows\System\WpDwwaN.exe
  C:\Windows\System\WpDwwaN.exe
  2⤵
  PID:4492
- C:\Windows\System\bpEueHj.exe
  C:\Windows\System\bpEueHj.exe
  2⤵
  PID:7904
- C:\Windows\System\PETcAKk.exe
  C:\Windows\System\PETcAKk.exe
  2⤵
  PID:6632
- C:\Windows\System\NBKAPHE.exe
  C:\Windows\System\NBKAPHE.exe
  2⤵
  PID:4612
- C:\Windows\System\bzMkPNw.exe
  C:\Windows\System\bzMkPNw.exe
  2⤵
  PID:1792
- C:\Windows\System\aiRUlvI.exe
  C:\Windows\System\aiRUlvI.exe
  2⤵
  PID:1004
- C:\Windows\System\jDdKFGu.exe
  C:\Windows\System\jDdKFGu.exe
  2⤵
  PID:2944
- C:\Windows\System\KxoTopx.exe
  C:\Windows\System\KxoTopx.exe
  2⤵
  PID:840
- C:\Windows\System\zPRTsCh.exe
  C:\Windows\System\zPRTsCh.exe
  2⤵
  PID:2084
- C:\Windows\System\kTnZZLk.exe
  C:\Windows\System\kTnZZLk.exe
  2⤵
  PID:4420
- C:\Windows\System\dQLfGcv.exe
  C:\Windows\System\dQLfGcv.exe
  2⤵
  PID:5004
- C:\Windows\System\dldsKRu.exe
  C:\Windows\System\dldsKRu.exe
  2⤵
  PID:7928
- C:\Windows\System\hXEHySK.exe
  C:\Windows\System\hXEHySK.exe
  2⤵
  PID:3108
- C:\Windows\System\arBerla.exe
  C:\Windows\System\arBerla.exe
  2⤵
  PID:1368
- C:\Windows\System\knUQNrH.exe
  C:\Windows\System\knUQNrH.exe
  2⤵
  PID:7792
- C:\Windows\System\skXGURg.exe
  C:\Windows\System\skXGURg.exe
  2⤵
  PID:3588
- C:\Windows\System\kGJtNcj.exe
  C:\Windows\System\kGJtNcj.exe
  2⤵
  PID:3392
- C:\Windows\System\LxvdPzw.exe
  C:\Windows\System\LxvdPzw.exe
  2⤵
  PID:3876
- C:\Windows\System\YLtjxYG.exe
  C:\Windows\System\YLtjxYG.exe
  2⤵
  PID:4020
- C:\Windows\System\JUwSMqz.exe
  C:\Windows\System\JUwSMqz.exe
  2⤵
  PID:7924
- C:\Windows\System\HDgjvNA.exe
  C:\Windows\System\HDgjvNA.exe
  2⤵
  PID:336
- C:\Windows\System\AzKCXxA.exe
  C:\Windows\System\AzKCXxA.exe
  2⤵
  PID:7456
- C:\Windows\System\TyGOoyy.exe
  C:\Windows\System\TyGOoyy.exe
  2⤵
  PID:4156
- C:\Windows\System\MpnkgEZ.exe
  C:\Windows\System\MpnkgEZ.exe
  2⤵
  PID:7736
- C:\Windows\System\mQDSsHI.exe
  C:\Windows\System\mQDSsHI.exe
  2⤵
  PID:8220
- C:\Windows\System\yqrzbdE.exe
  C:\Windows\System\yqrzbdE.exe
  2⤵
  PID:8252
- C:\Windows\System\vfclDdg.exe
  C:\Windows\System\vfclDdg.exe
  2⤵
  PID:8288
- C:\Windows\System\RculbVM.exe
  C:\Windows\System\RculbVM.exe
  2⤵
  PID:8308
- C:\Windows\System\bWxQGlN.exe
  C:\Windows\System\bWxQGlN.exe
  2⤵
  PID:8336
- C:\Windows\System\aRGVTzo.exe
  C:\Windows\System\aRGVTzo.exe
  2⤵
  PID:8364
- C:\Windows\System\rmSwZvr.exe
  C:\Windows\System\rmSwZvr.exe
  2⤵
  PID:8392
- C:\Windows\System\HjUKAey.exe
  C:\Windows\System\HjUKAey.exe
  2⤵
  PID:8420
- C:\Windows\System\TKxPBMk.exe
  C:\Windows\System\TKxPBMk.exe
  2⤵
  PID:8448
- C:\Windows\System\JhXNfhq.exe
  C:\Windows\System\JhXNfhq.exe
  2⤵
  PID:8476
- C:\Windows\System\BaecKHp.exe
  C:\Windows\System\BaecKHp.exe
  2⤵
  PID:8504
- C:\Windows\System\DTxgsgi.exe
  C:\Windows\System\DTxgsgi.exe
  2⤵
  PID:8552
- C:\Windows\System\gTqsPXy.exe
  C:\Windows\System\gTqsPXy.exe
  2⤵
  PID:8572
- C:\Windows\System\PklDWzF.exe
  C:\Windows\System\PklDWzF.exe
  2⤵
  PID:8604
- C:\Windows\System\gmGLPhu.exe
  C:\Windows\System\gmGLPhu.exe
  2⤵
  PID:8628
- C:\Windows\System\BoEmNBu.exe
  C:\Windows\System\BoEmNBu.exe
  2⤵
  PID:8648
- C:\Windows\System\bFopfrB.exe
  C:\Windows\System\bFopfrB.exe
  2⤵
  PID:8676
- C:\Windows\System\tWohydD.exe
  C:\Windows\System\tWohydD.exe
  2⤵
  PID:8704
- C:\Windows\System\CMpReLf.exe
  C:\Windows\System\CMpReLf.exe
  2⤵
  PID:8728
- C:\Windows\System\gYtxbyx.exe
  C:\Windows\System\gYtxbyx.exe
  2⤵
  PID:8784
- C:\Windows\System\HyKwobp.exe
  C:\Windows\System\HyKwobp.exe
  2⤵
  PID:8812
- C:\Windows\System\KJPxtYs.exe
  C:\Windows\System\KJPxtYs.exe
  2⤵
  PID:8832
- C:\Windows\System\DwahRxq.exe
  C:\Windows\System\DwahRxq.exe
  2⤵
  PID:8868
- C:\Windows\System\SkSnkfe.exe
  C:\Windows\System\SkSnkfe.exe
  2⤵
  PID:8888
- C:\Windows\System\jfMViKO.exe
  C:\Windows\System\jfMViKO.exe
  2⤵
  PID:8920
- C:\Windows\System\rqZQJEp.exe
  C:\Windows\System\rqZQJEp.exe
  2⤵
  PID:8940
- C:\Windows\System\luOgnoc.exe
  C:\Windows\System\luOgnoc.exe
  2⤵
  PID:8968
- C:\Windows\System\uZhGfrG.exe
  C:\Windows\System\uZhGfrG.exe
  2⤵
  PID:8988
- C:\Windows\System\vsaWAkN.exe
  C:\Windows\System\vsaWAkN.exe
  2⤵
  PID:9016
- C:\Windows\System\BYloxWT.exe
  C:\Windows\System\BYloxWT.exe
  2⤵
  PID:9052
- C:\Windows\System\UaohJHI.exe
  C:\Windows\System\UaohJHI.exe
  2⤵
  PID:9092
- C:\Windows\System\yqXgVby.exe
  C:\Windows\System\yqXgVby.exe
  2⤵
  PID:9112
- C:\Windows\System\LoGWGPc.exe
  C:\Windows\System\LoGWGPc.exe
  2⤵
  PID:9140
- C:\Windows\System\rXpwXXY.exe
  C:\Windows\System\rXpwXXY.exe
  2⤵
  PID:9164
- C:\Windows\System\YByVWWU.exe
  C:\Windows\System\YByVWWU.exe
  2⤵
  PID:9184
- C:\Windows\System\tPeCeay.exe
  C:\Windows\System\tPeCeay.exe
  2⤵
  PID:2684
- C:\Windows\System\ldLHmfx.exe
  C:\Windows\System\ldLHmfx.exe
  2⤵
  PID:8212
- C:\Windows\System\qAyOUEY.exe
  C:\Windows\System\qAyOUEY.exe
  2⤵
  PID:8280
- C:\Windows\System\jaimVhY.exe
  C:\Windows\System\jaimVhY.exe
  2⤵
  PID:8328
- C:\Windows\System\XvONINo.exe
  C:\Windows\System\XvONINo.exe
  2⤵
  PID:8440
- C:\Windows\System\zajeFna.exe
  C:\Windows\System\zajeFna.exe
  2⤵
  PID:8472
- C:\Windows\System\pEIZSTT.exe
  C:\Windows\System\pEIZSTT.exe
  2⤵
  PID:8568
- C:\Windows\System\APEfuyl.exe
  C:\Windows\System\APEfuyl.exe
  2⤵
  PID:8616
- C:\Windows\System\uqTKjlP.exe
  C:\Windows\System\uqTKjlP.exe
  2⤵
  PID:8672
- C:\Windows\System\SLeQQzF.exe
  C:\Windows\System\SLeQQzF.exe
  2⤵
  PID:6648
- C:\Windows\System\IuaFmie.exe
  C:\Windows\System\IuaFmie.exe
  2⤵
  PID:8800
- C:\Windows\System\jbvaQpu.exe
  C:\Windows\System\jbvaQpu.exe
  2⤵
  PID:8828
- C:\Windows\System\RvmSXnK.exe
  C:\Windows\System\RvmSXnK.exe
  2⤵
  PID:8884
- C:\Windows\System\waphDJj.exe
  C:\Windows\System\waphDJj.exe
  2⤵
  PID:8996
- C:\Windows\System\MqpUqXt.exe
  C:\Windows\System\MqpUqXt.exe
  2⤵
  PID:9080
- C:\Windows\System\Ctcwikw.exe
  C:\Windows\System\Ctcwikw.exe
  2⤵
  PID:9120
- C:\Windows\System\fhnAkDW.exe
  C:\Windows\System\fhnAkDW.exe
  2⤵
  PID:9196
- C:\Windows\System\RwNoFml.exe
  C:\Windows\System\RwNoFml.exe
  2⤵
  PID:8304
- C:\Windows\System\uDypEWT.exe
  C:\Windows\System\uDypEWT.exe
  2⤵
  PID:8416
- C:\Windows\System\BNpunxy.exe
  C:\Windows\System\BNpunxy.exe
  2⤵
  PID:8620
- C:\Windows\System\nrmDQSj.exe
  C:\Windows\System\nrmDQSj.exe
  2⤵
  PID:8752
- C:\Windows\System\duvqbAC.exe
  C:\Windows\System\duvqbAC.exe
  2⤵
  PID:8860
- C:\Windows\System\vCHmirj.exe
  C:\Windows\System\vCHmirj.exe
  2⤵
  PID:8980
- C:\Windows\System\dqznGLk.exe
  C:\Windows\System\dqznGLk.exe
  2⤵
  PID:9180
- C:\Windows\System\Kquugfe.exe
  C:\Windows\System\Kquugfe.exe
  2⤵
  PID:1684
- C:\Windows\System\exfWXgJ.exe
  C:\Windows\System\exfWXgJ.exe
  2⤵
  PID:8640
- C:\Windows\System\OoFIIAw.exe
  C:\Windows\System\OoFIIAw.exe
  2⤵
  PID:9104
- C:\Windows\System\rmgFrXc.exe
  C:\Windows\System\rmgFrXc.exe
  2⤵
  PID:8548
- C:\Windows\System\cyPbGAg.exe
  C:\Windows\System\cyPbGAg.exe
  2⤵
  PID:9240
- C:\Windows\System\moQCHZf.exe
  C:\Windows\System\moQCHZf.exe
  2⤵
  PID:9264
- C:\Windows\System\RnZIMHO.exe
  C:\Windows\System\RnZIMHO.exe
  2⤵
  PID:9284
- C:\Windows\System\XqufjoL.exe
  C:\Windows\System\XqufjoL.exe
  2⤵
  PID:9304
- C:\Windows\System\BAIqExw.exe
  C:\Windows\System\BAIqExw.exe
  2⤵
  PID:9332
- C:\Windows\System\pkdLcQs.exe
  C:\Windows\System\pkdLcQs.exe
  2⤵
  PID:9360
- C:\Windows\System\fGMWuMU.exe
  C:\Windows\System\fGMWuMU.exe
  2⤵
  PID:9392
- C:\Windows\System\VYiywYa.exe
  C:\Windows\System\VYiywYa.exe
  2⤵
  PID:9412
- C:\Windows\System\ttwFPEe.exe
  C:\Windows\System\ttwFPEe.exe
  2⤵
  PID:9436
- C:\Windows\System\byrdGjo.exe
  C:\Windows\System\byrdGjo.exe
  2⤵
  PID:9488
- C:\Windows\System\JNwOHTP.exe
  C:\Windows\System\JNwOHTP.exe
  2⤵
  PID:9512
- C:\Windows\System\uGleRSl.exe
  C:\Windows\System\uGleRSl.exe
  2⤵
  PID:9532
- C:\Windows\System\iXGXGGp.exe
  C:\Windows\System\iXGXGGp.exe
  2⤵
  PID:9568
- C:\Windows\System\lmzAZdS.exe
  C:\Windows\System\lmzAZdS.exe
  2⤵
  PID:9608
- C:\Windows\System\CLvsZbn.exe
  C:\Windows\System\CLvsZbn.exe
  2⤵
  PID:9628
- C:\Windows\System\OnwQZqQ.exe
  C:\Windows\System\OnwQZqQ.exe
  2⤵
  PID:9652
- C:\Windows\System\DCbeiMF.exe
  C:\Windows\System\DCbeiMF.exe
  2⤵
  PID:9672
- C:\Windows\System\pwoDczX.exe
  C:\Windows\System\pwoDczX.exe
  2⤵
  PID:9692
- C:\Windows\System\OUNslBs.exe
  C:\Windows\System\OUNslBs.exe
  2⤵
  PID:9720
- C:\Windows\System\YiWeUch.exe
  C:\Windows\System\YiWeUch.exe
  2⤵
  PID:9740
- C:\Windows\System\RzFsVzD.exe
  C:\Windows\System\RzFsVzD.exe
  2⤵
  PID:9764
- C:\Windows\System\NUAumJu.exe
  C:\Windows\System\NUAumJu.exe
  2⤵
  PID:9784
- C:\Windows\System\mWlurjY.exe
  C:\Windows\System\mWlurjY.exe
  2⤵
  PID:9804
- C:\Windows\System\ARKWRPl.exe
  C:\Windows\System\ARKWRPl.exe
  2⤵
  PID:9832
- C:\Windows\System\duszVoJ.exe
  C:\Windows\System\duszVoJ.exe
  2⤵
  PID:9860
- C:\Windows\System\jNoZoGQ.exe
  C:\Windows\System\jNoZoGQ.exe
  2⤵
  PID:9880
- C:\Windows\System\dcljrGj.exe
  C:\Windows\System\dcljrGj.exe
  2⤵
  PID:9952
- C:\Windows\System\IfNDdmE.exe
  C:\Windows\System\IfNDdmE.exe
  2⤵
  PID:9988
- C:\Windows\System\YDbmJNX.exe
  C:\Windows\System\YDbmJNX.exe
  2⤵
  PID:10032
- C:\Windows\System\fFDoxHe.exe
  C:\Windows\System\fFDoxHe.exe
  2⤵
  PID:10048
- C:\Windows\System\cNfeMqL.exe
  C:\Windows\System\cNfeMqL.exe
  2⤵
  PID:10068
- C:\Windows\System\eOXmoKj.exe
  C:\Windows\System\eOXmoKj.exe
  2⤵
  PID:10108
- C:\Windows\System\oMDozVL.exe
  C:\Windows\System\oMDozVL.exe
  2⤵
  PID:10132
- C:\Windows\System\AhHOnab.exe
  C:\Windows\System\AhHOnab.exe
  2⤵
  PID:10152
- C:\Windows\System\XbWpaca.exe
  C:\Windows\System\XbWpaca.exe
  2⤵
  PID:10176
- C:\Windows\System\qQQvUrr.exe
  C:\Windows\System\qQQvUrr.exe
  2⤵
  PID:10196
- C:\Windows\System\IxpxcKl.exe
  C:\Windows\System\IxpxcKl.exe
  2⤵
  PID:8272
- C:\Windows\System\JQgHrhG.exe
  C:\Windows\System\JQgHrhG.exe
  2⤵
  PID:9252
- C:\Windows\System\mPqaeQL.exe
  C:\Windows\System\mPqaeQL.exe
  2⤵
  PID:9340
- C:\Windows\System\RHILWKP.exe
  C:\Windows\System\RHILWKP.exe
  2⤵
  PID:9356
- C:\Windows\System\tAtYtnw.exe
  C:\Windows\System\tAtYtnw.exe
  2⤵
  PID:9432
- C:\Windows\System\yYvCeZZ.exe
  C:\Windows\System\yYvCeZZ.exe
  2⤵
  PID:9524
- C:\Windows\System\PqeYBqS.exe
  C:\Windows\System\PqeYBqS.exe
  2⤵
  PID:9584
- C:\Windows\System\RNxURUY.exe
  C:\Windows\System\RNxURUY.exe
  2⤵
  PID:9644
- C:\Windows\System\uDTdTAr.exe
  C:\Windows\System\uDTdTAr.exe
  2⤵
  PID:9728
- C:\Windows\System\bIqoPxV.exe
  C:\Windows\System\bIqoPxV.exe
  2⤵
  PID:9760
- C:\Windows\System\YhXLjHd.exe
  C:\Windows\System\YhXLjHd.exe
  2⤵
  PID:9848
- C:\Windows\System\AJGtSoC.exe
  C:\Windows\System\AJGtSoC.exe
  2⤵
  PID:9896
- C:\Windows\System\WHNMnVb.exe
  C:\Windows\System\WHNMnVb.exe
  2⤵
  PID:9936
- C:\Windows\System\eJFwDyO.exe
  C:\Windows\System\eJFwDyO.exe
  2⤵
  PID:10012
- C:\Windows\System\OTtKWva.exe
  C:\Windows\System\OTtKWva.exe
  2⤵
  PID:10100
- C:\Windows\System\VzARGvO.exe
  C:\Windows\System\VzARGvO.exe
  2⤵
  PID:10192
- C:\Windows\System\vxwtvnP.exe
  C:\Windows\System\vxwtvnP.exe
  2⤵
  PID:9484
- C:\Windows\System\laDIOpM.exe
  C:\Windows\System\laDIOpM.exe
  2⤵
  PID:9496
- C:\Windows\System\duedmUe.exe
  C:\Windows\System\duedmUe.exe
  2⤵
  PID:9600
- C:\Windows\System\mocOPXO.exe
  C:\Windows\System\mocOPXO.exe
  2⤵
  PID:9712
- C:\Windows\System\LpYvCQB.exe
  C:\Windows\System\LpYvCQB.exe
  2⤵
  PID:9756
- C:\Windows\System\xmhlyfv.exe
  C:\Windows\System\xmhlyfv.exe
  2⤵
  PID:9872
- C:\Windows\System\fdwGMCL.exe
  C:\Windows\System\fdwGMCL.exe
  2⤵
  PID:10080
- C:\Windows\System\rRzgUAC.exe
  C:\Windows\System\rRzgUAC.exe
  2⤵
  PID:10116
- C:\Windows\System\FcXmBCk.exe
  C:\Windows\System\FcXmBCk.exe
  2⤵
  PID:9408
- C:\Windows\System\VaroOvu.exe
  C:\Windows\System\VaroOvu.exe
  2⤵
  PID:9780
- C:\Windows\System\eoujhws.exe
  C:\Windows\System\eoujhws.exe
  2⤵
  PID:10260
- C:\Windows\System\vPVMCdS.exe
  C:\Windows\System\vPVMCdS.exe
  2⤵
  PID:10300
- C:\Windows\System\sNgIIse.exe
  C:\Windows\System\sNgIIse.exe
  2⤵
  PID:10320
- C:\Windows\System\ZdZqryI.exe
  C:\Windows\System\ZdZqryI.exe
  2⤵
  PID:10360
- C:\Windows\System\CzVpocw.exe
  C:\Windows\System\CzVpocw.exe
  2⤵
  PID:10380
- C:\Windows\System\KgsKHOG.exe
  C:\Windows\System\KgsKHOG.exe
  2⤵
  PID:10400
- C:\Windows\System\IdFvGsx.exe
  C:\Windows\System\IdFvGsx.exe
  2⤵
  PID:10432
- C:\Windows\System\fUzdokX.exe
  C:\Windows\System\fUzdokX.exe
  2⤵
  PID:10464
- C:\Windows\System\jQiRZrJ.exe
  C:\Windows\System\jQiRZrJ.exe
  2⤵
  PID:10492
- C:\Windows\System\fgKTyRI.exe
  C:\Windows\System\fgKTyRI.exe
  2⤵
  PID:10524
- C:\Windows\System\wtioBCu.exe
  C:\Windows\System\wtioBCu.exe
  2⤵
  PID:10568
- C:\Windows\System\CyVrQoR.exe
  C:\Windows\System\CyVrQoR.exe
  2⤵
  PID:10584
- C:\Windows\System\WMTGRxk.exe
  C:\Windows\System\WMTGRxk.exe
  2⤵
  PID:10616
- C:\Windows\System\tPgtkMG.exe
  C:\Windows\System\tPgtkMG.exe
  2⤵
  PID:10644
- C:\Windows\System\HgiKRXq.exe
  C:\Windows\System\HgiKRXq.exe
  2⤵
  PID:10676
- C:\Windows\System\WTirJDh.exe
  C:\Windows\System\WTirJDh.exe
  2⤵
  PID:10692
- C:\Windows\System\EyrGAdH.exe
  C:\Windows\System\EyrGAdH.exe
  2⤵
  PID:10716
- C:\Windows\System\kCYMqIF.exe
  C:\Windows\System\kCYMqIF.exe
  2⤵
  PID:10748
- C:\Windows\System\uffmaFP.exe
  C:\Windows\System\uffmaFP.exe
  2⤵
  PID:10792
- C:\Windows\System\VrMXSFX.exe
  C:\Windows\System\VrMXSFX.exe
  2⤵
  PID:10816
- C:\Windows\System\rofeuSZ.exe
  C:\Windows\System\rofeuSZ.exe
  2⤵
  PID:10840
- C:\Windows\System\tgOMvAc.exe
  C:\Windows\System\tgOMvAc.exe
  2⤵
  PID:10876
- C:\Windows\System\ERsgcfr.exe
  C:\Windows\System\ERsgcfr.exe
  2⤵
  PID:10892
- C:\Windows\System\kTvQGfa.exe
  C:\Windows\System\kTvQGfa.exe
  2⤵
  PID:10924
- C:\Windows\System\ccDNtBi.exe
  C:\Windows\System\ccDNtBi.exe
  2⤵
  PID:10944
- C:\Windows\System\xMDCOZw.exe
  C:\Windows\System\xMDCOZw.exe
  2⤵
  PID:10960
- C:\Windows\System\tbJvkBj.exe
  C:\Windows\System\tbJvkBj.exe
  2⤵
  PID:10996
- C:\Windows\System\eHPqYMM.exe
  C:\Windows\System\eHPqYMM.exe
  2⤵
  PID:11048
- C:\Windows\System\swTdQMQ.exe
  C:\Windows\System\swTdQMQ.exe
  2⤵
  PID:11072
- C:\Windows\System\OAvTIey.exe
  C:\Windows\System\OAvTIey.exe
  2⤵
  PID:11092
- C:\Windows\System\plozEVN.exe
  C:\Windows\System\plozEVN.exe
  2⤵
  PID:11132
- C:\Windows\System\ncaeteu.exe
  C:\Windows\System\ncaeteu.exe
  2⤵
  PID:11152
- C:\Windows\System\NdMOLbE.exe
  C:\Windows\System\NdMOLbE.exe
  2⤵
  PID:11176
- C:\Windows\System\ZNlqBKX.exe
  C:\Windows\System\ZNlqBKX.exe
  2⤵
  PID:11208
- C:\Windows\System\rQxrsTb.exe
  C:\Windows\System\rQxrsTb.exe
  2⤵
  PID:11232
- C:\Windows\System\ExwvpYd.exe
  C:\Windows\System\ExwvpYd.exe
  2⤵
  PID:10160
- C:\Windows\System\gOVyviA.exe
  C:\Windows\System\gOVyviA.exe
  2⤵
  PID:9708
- C:\Windows\System\GfxfzSU.exe
  C:\Windows\System\GfxfzSU.exe
  2⤵
  PID:10256
- C:\Windows\System\GwIBGwF.exe
  C:\Windows\System\GwIBGwF.exe
  2⤵
  PID:10312
- C:\Windows\System\OlXbeTq.exe
  C:\Windows\System\OlXbeTq.exe
  2⤵
  PID:10368
- C:\Windows\System\BvCXavL.exe
  C:\Windows\System\BvCXavL.exe
  2⤵
  PID:10416
- C:\Windows\System\PbMMZgZ.exe
  C:\Windows\System\PbMMZgZ.exe
  2⤵
  PID:10480
- C:\Windows\System\cjWqMtL.exe
  C:\Windows\System\cjWqMtL.exe
  2⤵
  PID:10556
- C:\Windows\System\MCazJhd.exe
  C:\Windows\System\MCazJhd.exe
  2⤵
  PID:10668
- C:\Windows\System\eiOxuGt.exe
  C:\Windows\System\eiOxuGt.exe
  2⤵
  PID:10708
- C:\Windows\System\LAySJho.exe
  C:\Windows\System\LAySJho.exe
  2⤵
  PID:10776
- C:\Windows\System\oTXOomE.exe
  C:\Windows\System\oTXOomE.exe
  2⤵
  PID:10852
- C:\Windows\System\wMgutPM.exe
  C:\Windows\System\wMgutPM.exe
  2⤵
  PID:10908
- C:\Windows\System\PwASFKi.exe
  C:\Windows\System\PwASFKi.exe
  2⤵
  PID:10972
- C:\Windows\System\VVOOeAN.exe
  C:\Windows\System\VVOOeAN.exe
  2⤵
  PID:11012
- C:\Windows\System\PMHJHff.exe
  C:\Windows\System\PMHJHff.exe
  2⤵
  PID:11080
- C:\Windows\System\MUVxPNu.exe
  C:\Windows\System\MUVxPNu.exe
  2⤵
  PID:11148
- C:\Windows\System\DKijhof.exe
  C:\Windows\System\DKijhof.exe
  2⤵
  PID:11228
- C:\Windows\System\TlAIzny.exe
  C:\Windows\System\TlAIzny.exe
  2⤵
  PID:10028
- C:\Windows\System\ZqYomuZ.exe
  C:\Windows\System\ZqYomuZ.exe
  2⤵
  PID:10336
- C:\Windows\System\CmLXGRO.exe
  C:\Windows\System\CmLXGRO.exe
  2⤵
  PID:10460
- C:\Windows\System\zqNmRBD.exe
  C:\Windows\System\zqNmRBD.exe
  2⤵
  PID:10608
- C:\Windows\System\UykVqpM.exe
  C:\Windows\System\UykVqpM.exe
  2⤵
  PID:10756
- C:\Windows\System\PhLyrtz.exe
  C:\Windows\System\PhLyrtz.exe
  2⤵
  PID:10920
- C:\Windows\System\bWvgRQy.exe
  C:\Windows\System\bWvgRQy.exe
  2⤵
  PID:10952
- C:\Windows\System\QunqoaG.exe
  C:\Windows\System\QunqoaG.exe
  2⤵
  PID:11164
- C:\Windows\System\tsIubPz.exe
  C:\Windows\System\tsIubPz.exe
  2⤵
  PID:10352
- C:\Windows\System\gmsEyXL.exe
  C:\Windows\System\gmsEyXL.exe
  2⤵
  PID:10520
- C:\Windows\System\CQxKjmG.exe
  C:\Windows\System\CQxKjmG.exe
  2⤵
  PID:11088
- C:\Windows\System\NgULXfX.exe
  C:\Windows\System\NgULXfX.exe
  2⤵
  PID:10636
- C:\Windows\System\NTTVeeL.exe
  C:\Windows\System\NTTVeeL.exe
  2⤵
  PID:11256
- C:\Windows\System\tOCdYAQ.exe
  C:\Windows\System\tOCdYAQ.exe
  2⤵
  PID:11276
- C:\Windows\System\GtykTEu.exe
  C:\Windows\System\GtykTEu.exe
  2⤵
  PID:11304
- C:\Windows\System\aUCBeOi.exe
  C:\Windows\System\aUCBeOi.exe
  2⤵
  PID:11332
- C:\Windows\System\zbpKYOo.exe
  C:\Windows\System\zbpKYOo.exe
  2⤵
  PID:11368
- C:\Windows\System\lNJesCc.exe
  C:\Windows\System\lNJesCc.exe
  2⤵
  PID:11392
- C:\Windows\System\SGWKWMR.exe
  C:\Windows\System\SGWKWMR.exe
  2⤵
  PID:11412
- C:\Windows\System\tZcAFkA.exe
  C:\Windows\System\tZcAFkA.exe
  2⤵
  PID:11428
- C:\Windows\System\enFHjaC.exe
  C:\Windows\System\enFHjaC.exe
  2⤵
  PID:11468
- C:\Windows\System\DHVqylh.exe
  C:\Windows\System\DHVqylh.exe
  2⤵
  PID:11508
- C:\Windows\System\zeKrHkY.exe
  C:\Windows\System\zeKrHkY.exe
  2⤵
  PID:11528
- C:\Windows\System\LMLlKDx.exe
  C:\Windows\System\LMLlKDx.exe
  2⤵
  PID:11556
- C:\Windows\System\PwiaknJ.exe
  C:\Windows\System\PwiaknJ.exe
  2⤵
  PID:11580
- C:\Windows\System\PJWIQtF.exe
  C:\Windows\System\PJWIQtF.exe
  2⤵
  PID:11604
- C:\Windows\System\jePppFN.exe
  C:\Windows\System\jePppFN.exe
  2⤵
  PID:11624
- C:\Windows\System\VSEmYmd.exe
  C:\Windows\System\VSEmYmd.exe
  2⤵
  PID:11672
- C:\Windows\System\oDlvpte.exe
  C:\Windows\System\oDlvpte.exe
  2⤵
  PID:11692
- C:\Windows\System\FGlEJFV.exe
  C:\Windows\System\FGlEJFV.exe
  2⤵
  PID:11724
- C:\Windows\System\vnskZZc.exe
  C:\Windows\System\vnskZZc.exe
  2⤵
  PID:11760
- C:\Windows\System\OqnjeSV.exe
  C:\Windows\System\OqnjeSV.exe
  2⤵
  PID:11780
- C:\Windows\System\QtaUuxB.exe
  C:\Windows\System\QtaUuxB.exe
  2⤵
  PID:11804
- C:\Windows\System\aYiNwdR.exe
  C:\Windows\System\aYiNwdR.exe
  2⤵
  PID:11828
- C:\Windows\System\jAgRGhW.exe
  C:\Windows\System\jAgRGhW.exe
  2⤵
  PID:11852
- C:\Windows\System\tdJlkcJ.exe
  C:\Windows\System\tdJlkcJ.exe
  2⤵
  PID:11880
- C:\Windows\System\ncOFDnP.exe
  C:\Windows\System\ncOFDnP.exe
  2⤵
  PID:11904
- C:\Windows\System\JqXRDXl.exe
  C:\Windows\System\JqXRDXl.exe
  2⤵
  PID:11932
- C:\Windows\System\YhPnPEl.exe
  C:\Windows\System\YhPnPEl.exe
  2⤵
  PID:11956
- C:\Windows\System\ECvOwKV.exe
  C:\Windows\System\ECvOwKV.exe
  2⤵
  PID:11980
- C:\Windows\System\bxJPrYl.exe
  C:\Windows\System\bxJPrYl.exe
  2⤵
  PID:12004
- C:\Windows\System\dHkWjLR.exe
  C:\Windows\System\dHkWjLR.exe
  2⤵
  PID:12028
- C:\Windows\System\feTXYJS.exe
  C:\Windows\System\feTXYJS.exe
  2⤵
  PID:12072
- C:\Windows\System\xNVicfc.exe
  C:\Windows\System\xNVicfc.exe
  2⤵
  PID:12108
- C:\Windows\System\haLNJdy.exe
  C:\Windows\System\haLNJdy.exe
  2⤵
  PID:12144
- C:\Windows\System\fnIyEim.exe
  C:\Windows\System\fnIyEim.exe
  2⤵
  PID:12160
- C:\Windows\System\mhcFEHf.exe
  C:\Windows\System\mhcFEHf.exe
  2⤵
  PID:12180
- C:\Windows\System\hjVBuMS.exe
  C:\Windows\System\hjVBuMS.exe
  2⤵
  PID:12204
- C:\Windows\System\RemkzXG.exe
  C:\Windows\System\RemkzXG.exe
  2⤵
  PID:12244
- C:\Windows\System\vKuqlAX.exe
  C:\Windows\System\vKuqlAX.exe
  2⤵
  PID:12264
- C:\Windows\System\QkUpYce.exe
  C:\Windows\System\QkUpYce.exe
  2⤵
  PID:10864
- C:\Windows\System\LXNJqzt.exe
  C:\Windows\System\LXNJqzt.exe
  2⤵
  PID:11316
- C:\Windows\System\XIJYYVm.exe
  C:\Windows\System\XIJYYVm.exe
  2⤵
  PID:11408
- C:\Windows\System\wtAoSEm.exe
  C:\Windows\System\wtAoSEm.exe
  2⤵
  PID:11456
- C:\Windows\System\YwZhkwr.exe
  C:\Windows\System\YwZhkwr.exe
  2⤵
  PID:11520
- C:\Windows\System\WPHerSo.exe
  C:\Windows\System\WPHerSo.exe
  2⤵
  PID:11568
- C:\Windows\System\hMadZvd.exe
  C:\Windows\System\hMadZvd.exe
  2⤵
  PID:11680
- C:\Windows\System\CUroSpA.exe
  C:\Windows\System\CUroSpA.exe
  2⤵
  PID:11772
- C:\Windows\System\eyjYtJP.exe
  C:\Windows\System\eyjYtJP.exe
  2⤵
  PID:11816
- C:\Windows\System\NrMejwN.exe
  C:\Windows\System\NrMejwN.exe
  2⤵
  PID:11912
- C:\Windows\System\aUkXkzc.exe
  C:\Windows\System\aUkXkzc.exe
  2⤵
  PID:12016
- C:\Windows\System\wsllFtW.exe
  C:\Windows\System\wsllFtW.exe
  2⤵
  PID:12064
- C:\Windows\System\AQwKsqd.exe
  C:\Windows\System\AQwKsqd.exe
  2⤵
  PID:12128
- C:\Windows\System\uQsAelg.exe
  C:\Windows\System\uQsAelg.exe
  2⤵
  PID:12152
- C:\Windows\System\cSwUpWc.exe
  C:\Windows\System\cSwUpWc.exe
  2⤵
  PID:12200
- C:\Windows\System\HvZbGfK.exe
  C:\Windows\System\HvZbGfK.exe
  2⤵
  PID:12260
- C:\Windows\System\YtBRRxA.exe
  C:\Windows\System\YtBRRxA.exe
  2⤵
  PID:11284
- C:\Windows\System\nyFVkEB.exe
  C:\Windows\System\nyFVkEB.exe
  2⤵
  PID:3480
- C:\Windows\System\baFocXD.exe
  C:\Windows\System\baFocXD.exe
  2⤵
  PID:11620
- C:\Windows\System\oDUoDbp.exe
  C:\Windows\System\oDUoDbp.exe
  2⤵
  PID:11864
- C:\Windows\System\QaoYWTm.exe
  C:\Windows\System\QaoYWTm.exe
  2⤵
  PID:11876
- C:\Windows\System\exUofuI.exe
  C:\Windows\System\exUofuI.exe
  2⤵
  PID:12088
- C:\Windows\System\NjcCrwh.exe
  C:\Windows\System\NjcCrwh.exe
  2⤵
  PID:11964
- C:\Windows\System\hEBjIag.exe
  C:\Windows\System\hEBjIag.exe
  2⤵
  PID:11384
- C:\Windows\System\vtlSblS.exe
  C:\Windows\System\vtlSblS.exe
  2⤵
  PID:11644
- C:\Windows\System\KNBcOgb.exe
  C:\Windows\System\KNBcOgb.exe
  2⤵
  PID:11948
- C:\Windows\System\WpaqOwT.exe
  C:\Windows\System\WpaqOwT.exe
  2⤵
  PID:12284
- C:\Windows\System\PyyJHkS.exe
  C:\Windows\System\PyyJHkS.exe
  2⤵
  PID:11872
- C:\Windows\System\NRiDQJl.exe
  C:\Windows\System\NRiDQJl.exe
  2⤵
  PID:12296
- C:\Windows\System\YMpRbgT.exe
  C:\Windows\System\YMpRbgT.exe
  2⤵
  PID:12352
- C:\Windows\System\gupDmAL.exe
  C:\Windows\System\gupDmAL.exe
  2⤵
  PID:12372
- C:\Windows\System\tWKSTxp.exe
  C:\Windows\System\tWKSTxp.exe
  2⤵
  PID:12396
- C:\Windows\System\Oqvurwu.exe
  C:\Windows\System\Oqvurwu.exe
  2⤵
  PID:12412
- C:\Windows\System\GLdFFLp.exe
  C:\Windows\System\GLdFFLp.exe
  2⤵
  PID:12448
- C:\Windows\System\KrZyPoH.exe
  C:\Windows\System\KrZyPoH.exe
  2⤵
  PID:12492
- C:\Windows\System\PEzLxPs.exe
  C:\Windows\System\PEzLxPs.exe
  2⤵
  PID:12520
- C:\Windows\System\feznqpx.exe
  C:\Windows\System\feznqpx.exe
  2⤵
  PID:12540
- C:\Windows\System\prJUNdy.exe
  C:\Windows\System\prJUNdy.exe
  2⤵
  PID:12576
- C:\Windows\System\cCsbQBZ.exe
  C:\Windows\System\cCsbQBZ.exe
  2⤵
  PID:12596
- C:\Windows\System\VGlGsOt.exe
  C:\Windows\System\VGlGsOt.exe
  2⤵
  PID:12632
- C:\Windows\System\BjximjI.exe
  C:\Windows\System\BjximjI.exe
  2⤵
  PID:12652
- C:\Windows\System\YxMSpMJ.exe
  C:\Windows\System\YxMSpMJ.exe
  2⤵
  PID:12680
- C:\Windows\System\QLAirrz.exe
  C:\Windows\System\QLAirrz.exe
  2⤵
  PID:12700
- C:\Windows\System\hfkyuVO.exe
  C:\Windows\System\hfkyuVO.exe
  2⤵
  PID:12724
- C:\Windows\System\pCrWoTv.exe
  C:\Windows\System\pCrWoTv.exe
  2⤵
  PID:12748
- C:\Windows\System\gPxPdvG.exe
  C:\Windows\System\gPxPdvG.exe
  2⤵
  PID:12772
- C:\Windows\System\yXeUCJn.exe
  C:\Windows\System\yXeUCJn.exe
  2⤵
  PID:12832
- C:\Windows\System\jbgLQEY.exe
  C:\Windows\System\jbgLQEY.exe
  2⤵
  PID:12852
- C:\Windows\System\XkudDrm.exe
  C:\Windows\System\XkudDrm.exe
  2⤵
  PID:12888
- C:\Windows\System\BzuSYya.exe
  C:\Windows\System\BzuSYya.exe
  2⤵
  PID:12912
- C:\Windows\System\qravqGd.exe
  C:\Windows\System\qravqGd.exe
  2⤵
  PID:12932
- C:\Windows\System\PfObgVr.exe
  C:\Windows\System\PfObgVr.exe
  2⤵
  PID:12960
- C:\Windows\System\coVGkOU.exe
  C:\Windows\System\coVGkOU.exe
  2⤵
  PID:12984
- C:\Windows\System\MHFSSgx.exe
  C:\Windows\System\MHFSSgx.exe
  2⤵
  PID:13008
- C:\Windows\System\jSPhHwW.exe
  C:\Windows\System\jSPhHwW.exe
  2⤵
  PID:13048
- C:\Windows\System\ftJlXHz.exe
  C:\Windows\System\ftJlXHz.exe
  2⤵
  PID:13068
- C:\Windows\System\Blibllm.exe
  C:\Windows\System\Blibllm.exe
  2⤵
  PID:13092
- C:\Windows\System\cGWYFFJ.exe
  C:\Windows\System\cGWYFFJ.exe
  2⤵
  PID:13120
- C:\Windows\System\tNIYsls.exe
  C:\Windows\System\tNIYsls.exe
  2⤵
  PID:13140
- C:\Windows\System\rjFvWwO.exe
  C:\Windows\System\rjFvWwO.exe
  2⤵
  PID:13168
- C:\Windows\System\vugRLRE.exe
  C:\Windows\System\vugRLRE.exe
  2⤵
  PID:13188
- C:\Windows\System\fVvowVP.exe
  C:\Windows\System\fVvowVP.exe
  2⤵
  PID:13232
- C:\Windows\System\vpPlniO.exe
  C:\Windows\System\vpPlniO.exe
  2⤵
  PID:13288
- C:\Windows\System\edQYAnW.exe
  C:\Windows\System\edQYAnW.exe
  2⤵
  PID:13308
- C:\Windows\System\GBNzQqu.exe
  C:\Windows\System\GBNzQqu.exe
  2⤵
  PID:12344
- C:\Windows\System\PCEQnxw.exe
  C:\Windows\System\PCEQnxw.exe
  2⤵
  PID:12432
- C:\Windows\System\vcsXgeU.exe
  C:\Windows\System\vcsXgeU.exe
  2⤵
  PID:12480
- C:\Windows\System\Aookfqx.exe
  C:\Windows\System\Aookfqx.exe
  2⤵
  PID:12536
- C:\Windows\System\PvUdbFG.exe
  C:\Windows\System\PvUdbFG.exe
  2⤵
  PID:12588
- C:\Windows\System\yPmutqK.exe
  C:\Windows\System\yPmutqK.exe
  2⤵
  PID:12672
- C:\Windows\System\VbGliYd.exe
  C:\Windows\System\VbGliYd.exe
  2⤵
  PID:12708
- C:\Windows\System\RZWyATx.exe
  C:\Windows\System\RZWyATx.exe
  2⤵
  PID:12796
- C:\Windows\System\dJwgjyD.exe
  C:\Windows\System\dJwgjyD.exe
  2⤵
  PID:7892
- C:\Windows\System\ktEdZeo.exe
  C:\Windows\System\ktEdZeo.exe
  2⤵
  PID:912
- C:\Windows\System\ywimZoA.exe
  C:\Windows\System\ywimZoA.exe
  2⤵
  PID:2364
- C:\Windows\System\eUKlltn.exe
  C:\Windows\System\eUKlltn.exe
  2⤵
  PID:13044
- C:\Windows\System\pwsRRCy.exe
  C:\Windows\System\pwsRRCy.exe
  2⤵
  PID:5044
- C:\Windows\System\Brogghf.exe
  C:\Windows\System\Brogghf.exe
  2⤵
  PID:1968
- C:\Windows\System\JFZMGHE.exe
  C:\Windows\System\JFZMGHE.exe
  2⤵
  PID:13204
- C:\Windows\System\vyxSahl.exe
  C:\Windows\System\vyxSahl.exe
  2⤵
  PID:13156
- C:\Windows\System\lDWWFKm.exe
  C:\Windows\System\lDWWFKm.exe
  2⤵
  PID:13180
- C:\Windows\System\RQmOKoP.exe
  C:\Windows\System\RQmOKoP.exe
  2⤵
  PID:13116
- C:\Windows\System\Gumqdsh.exe
  C:\Windows\System\Gumqdsh.exe
  2⤵
  PID:13228
- C:\Windows\System\LMUoHKt.exe
  C:\Windows\System\LMUoHKt.exe
  2⤵
  PID:4904
- C:\Windows\System\tUYlSjm.exe
  C:\Windows\System\tUYlSjm.exe
  2⤵
  PID:13300
- C:\Windows\System\YLetqIe.exe
  C:\Windows\System\YLetqIe.exe
  2⤵
  PID:12360
- C:\Windows\System\CIVQSOH.exe
  C:\Windows\System\CIVQSOH.exe
  2⤵
  PID:12864
- C:\Windows\System\douSgTB.exe
  C:\Windows\System\douSgTB.exe
  2⤵
  PID:1352
- C:\Windows\System\zqcUfEC.exe
  C:\Windows\System\zqcUfEC.exe
  2⤵
  PID:3972
- C:\Windows\System\TCkHmAU.exe
  C:\Windows\System\TCkHmAU.exe
  2⤵
  PID:5800
- C:\Windows\System\XqAWtMH.exe
  C:\Windows\System\XqAWtMH.exe
  2⤵
  PID:1212
- C:\Windows\System\eerDmsi.exe
  C:\Windows\System\eerDmsi.exe
  2⤵
  PID:2052
- C:\Windows\System\ZPXfbHD.exe
  C:\Windows\System\ZPXfbHD.exe
  2⤵
  PID:11940
- C:\Windows\System\KxZzkRr.exe
  C:\Windows\System\KxZzkRr.exe
  2⤵
  PID:388
- C:\Windows\System\GcKlvBE.exe
  C:\Windows\System\GcKlvBE.exe
  2⤵
  PID:12572
- C:\Windows\System\SIZDuim.exe
  C:\Windows\System\SIZDuim.exe
  2⤵
  PID:12668
- C:\Windows\System\ByrCKOc.exe
  C:\Windows\System\ByrCKOc.exe
  2⤵
  PID:12824
- C:\Windows\System\FWeIgUR.exe
  C:\Windows\System\FWeIgUR.exe
  2⤵
  PID:13064
- C:\Windows\System\PhThOAT.exe
  C:\Windows\System\PhThOAT.exe
  2⤵
  PID:13100
- C:\Windows\System\yKZGrjk.exe
  C:\Windows\System\yKZGrjk.exe
  2⤵
  PID:780
- C:\Windows\System\NnbASDH.exe
  C:\Windows\System\NnbASDH.exe
  2⤵
  PID:4736
- C:\Windows\System\kDBgkZB.exe
  C:\Windows\System\kDBgkZB.exe
  2⤵
  PID:2728
- C:\Windows\System\uijiEgG.exe
  C:\Windows\System\uijiEgG.exe
  2⤵
  PID:880
- C:\Windows\System\sIBulsq.exe
  C:\Windows\System\sIBulsq.exe
  2⤵
  PID:4968
- C:\Windows\System\khjBRXW.exe
  C:\Windows\System\khjBRXW.exe
  2⤵
  PID:4804
- C:\Windows\System\uymssWM.exe
  C:\Windows\System\uymssWM.exe
  2⤵
  PID:7700
- C:\Windows\System\KaupguB.exe
  C:\Windows\System\KaupguB.exe
  2⤵
  PID:6304
- C:\Windows\System\lBztBCC.exe
  C:\Windows\System\lBztBCC.exe
  2⤵
  PID:7900
- C:\Windows\System\sXWJipj.exe
  C:\Windows\System\sXWJipj.exe
  2⤵
  PID:8152
- C:\Windows\System\dgrgquj.exe
  C:\Windows\System\dgrgquj.exe
  2⤵
  PID:4556
- C:\Windows\System\ihdLirv.exe
  C:\Windows\System\ihdLirv.exe
  2⤵
  PID:12464
- C:\Windows\System\iowQUNQ.exe
  C:\Windows\System\iowQUNQ.exe
  2⤵
  PID:1648
- C:\Windows\System\IxaloIN.exe
  C:\Windows\System\IxaloIN.exe
  2⤵
  PID:1952
- C:\Windows\System\kidfxed.exe
  C:\Windows\System\kidfxed.exe
  2⤵
  PID:5308
- C:\Windows\System\EKhrgaW.exe
  C:\Windows\System\EKhrgaW.exe
  2⤵
  PID:5496
- C:\Windows\System\SpueZOT.exe
  C:\Windows\System\SpueZOT.exe
  2⤵
  PID:5568
- C:\Windows\System\MCsHbfR.exe
  C:\Windows\System\MCsHbfR.exe
  2⤵
  PID:5560
- C:\Windows\System\LguFNDS.exe
  C:\Windows\System\LguFNDS.exe
  2⤵
  PID:5900
- C:\Windows\System\FoxgReB.exe
  C:\Windows\System\FoxgReB.exe
  2⤵
  PID:3112
- C:\Windows\System\WjlLIsx.exe
  C:\Windows\System\WjlLIsx.exe
  2⤵
  PID:2396
- C:\Windows\System\GxcWzvM.exe
  C:\Windows\System\GxcWzvM.exe
  2⤵
  PID:7784
- C:\Windows\System\YIqfuAI.exe
  C:\Windows\System\YIqfuAI.exe
  2⤵
  PID:12820
- C:\Windows\System\OuQkVDV.exe
  C:\Windows\System\OuQkVDV.exe
  2⤵
  PID:5188
- C:\Windows\System\KoDCBQh.exe
  C:\Windows\System\KoDCBQh.exe
  2⤵
  PID:6072
- C:\Windows\System\pNTypvE.exe
  C:\Windows\System\pNTypvE.exe
  2⤵
  PID:5668
- C:\Windows\System\dyOZgXT.exe
  C:\Windows\System\dyOZgXT.exe
  2⤵
  PID:5280
- C:\Windows\System\rCRFChH.exe
  C:\Windows\System\rCRFChH.exe
  2⤵
  PID:5780
- C:\Windows\System\HDIbNKN.exe
  C:\Windows\System\HDIbNKN.exe
  2⤵
  PID:644
- C:\Windows\System\ODgABHK.exe
  C:\Windows\System\ODgABHK.exe
  2⤵
  PID:5864
- C:\Windows\System\ZSKMmby.exe
  C:\Windows\System\ZSKMmby.exe
  2⤵
  PID:5896
- C:\Windows\System\xXUQdfn.exe
  C:\Windows\System\xXUQdfn.exe
  2⤵
  PID:5612
- C:\Windows\System\TDriupw.exe
  C:\Windows\System\TDriupw.exe
  2⤵
  PID:5264
- C:\Windows\System\mbOcsjv.exe
  C:\Windows\System\mbOcsjv.exe
  2⤵
  PID:7808
- C:\Windows\System\fWMAFEN.exe
  C:\Windows\System\fWMAFEN.exe
  2⤵
  PID:3768
- C:\Windows\System\saFgmpP.exe
  C:\Windows\System\saFgmpP.exe
  2⤵
  PID:4208
- C:\Windows\System\KtvWuSB.exe
  C:\Windows\System\KtvWuSB.exe
  2⤵
  PID:7864
- C:\Windows\System\ngXOcAs.exe
  C:\Windows\System\ngXOcAs.exe
  2⤵
  PID:13084
- C:\Windows\System\JPYoWaC.exe
  C:\Windows\System\JPYoWaC.exe
  2⤵
  PID:13224
- C:\Windows\System\bvyJqZs.exe
  C:\Windows\System\bvyJqZs.exe
  2⤵
  PID:6508
- C:\Windows\System\MjVayrM.exe
  C:\Windows\System\MjVayrM.exe
  2⤵
  PID:1148
- C:\Windows\System\rVqFWfx.exe
  C:\Windows\System\rVqFWfx.exe
  2⤵
  PID:12420
- C:\Windows\System\sCnVNEs.exe
  C:\Windows\System\sCnVNEs.exe
  2⤵
  PID:2548
- C:\Windows\System\aspufXF.exe
  C:\Windows\System\aspufXF.exe
  2⤵
  PID:1640
- C:\Windows\System\LJRtTrH.exe
  C:\Windows\System\LJRtTrH.exe
  2⤵
  PID:4488
- C:\Windows\System\bTFOygl.exe
  C:\Windows\System\bTFOygl.exe
  2⤵
  PID:12624
- C:\Windows\System\dBMytCx.exe
  C:\Windows\System\dBMytCx.exe
  2⤵
  PID:2476
- C:\Windows\System\CRbBrVf.exe
  C:\Windows\System\CRbBrVf.exe
  2⤵
  PID:12972
- C:\Windows\System\ApfYuVE.exe
  C:\Windows\System\ApfYuVE.exe
  2⤵
  PID:8020
- C:\Windows\System\FlbvEHf.exe
  C:\Windows\System\FlbvEHf.exe
  2⤵
  PID:6056
- C:\Windows\System\uKcPdgo.exe
  C:\Windows\System\uKcPdgo.exe
  2⤵
  PID:13276
- C:\Windows\System\tyAacYx.exe
  C:\Windows\System\tyAacYx.exe
  2⤵
  PID:4704
- C:\Windows\System\hWRXxqM.exe
  C:\Windows\System\hWRXxqM.exe
  2⤵
  PID:5028
- C:\Windows\System\BKcoeEw.exe
  C:\Windows\System\BKcoeEw.exe
  2⤵
  PID:4720
- C:\Windows\System\DAtwvrx.exe
  C:\Windows\System\DAtwvrx.exe
  2⤵
  PID:5972
- C:\Windows\System\VQmtQBE.exe
  C:\Windows\System\VQmtQBE.exe
  2⤵
  PID:6152
- C:\Windows\System\GTSoYZC.exe
  C:\Windows\System\GTSoYZC.exe
  2⤵
  PID:4068
- C:\Windows\System\wgggkNk.exe
  C:\Windows\System\wgggkNk.exe
  2⤵
  PID:2740
- C:\Windows\System\VkiWcYk.exe
  C:\Windows\System\VkiWcYk.exe
  2⤵
  PID:5708
- C:\Windows\System\AsZmzfH.exe
  C:\Windows\System\AsZmzfH.exe
  2⤵
  PID:13132
- C:\Windows\System\IHZFUGr.exe
  C:\Windows\System\IHZFUGr.exe
  2⤵
  PID:3092
- C:\Windows\System\EwNxlux.exe
  C:\Windows\System\EwNxlux.exe
  2⤵
  PID:6052
- C:\Windows\System\JZdoIZD.exe
  C:\Windows\System\JZdoIZD.exe
  2⤵
  PID:7960
- C:\Windows\System\iaqeBUK.exe
  C:\Windows\System\iaqeBUK.exe
  2⤵
  PID:2184
- C:\Windows\System\AdLxqwU.exe
  C:\Windows\System\AdLxqwU.exe
  2⤵
  PID:4540
- C:\Windows\System\eNuUFZD.exe
  C:\Windows\System\eNuUFZD.exe
  2⤵
  PID:5328
- C:\Windows\System\XcasHTg.exe
  C:\Windows\System\XcasHTg.exe
  2⤵
  PID:1844
- C:\Windows\System\VBkbsGk.exe
  C:\Windows\System\VBkbsGk.exe
  2⤵
  PID:1636
- C:\Windows\System\lNDkxYK.exe
  C:\Windows\System\lNDkxYK.exe
  2⤵
  PID:1608
- C:\Windows\System\IvUFdFv.exe
  C:\Windows\System\IvUFdFv.exe
  2⤵
  PID:6204
- C:\Windows\System\OklZoPe.exe
  C:\Windows\System\OklZoPe.exe
  2⤵
  PID:1120
- C:\Windows\System\qBNOExs.exe
  C:\Windows\System\qBNOExs.exe
  2⤵
  PID:8200
- C:\Windows\System\tkIkRcH.exe
  C:\Windows\System\tkIkRcH.exe
  2⤵
  PID:4244
- C:\Windows\System\fGJZJiU.exe
  C:\Windows\System\fGJZJiU.exe
  2⤵
  PID:2980
- C:\Windows\System\SXkKedT.exe
  C:\Windows\System\SXkKedT.exe
  2⤵
  PID:7368
- C:\Windows\System\TqxNgFK.exe
  C:\Windows\System\TqxNgFK.exe
  2⤵
  PID:4948
- C:\Windows\System\EHrCMoy.exe
  C:\Windows\System\EHrCMoy.exe
  2⤵
  PID:8316
- C:\Windows\System\ujadNsO.exe
  C:\Windows\System\ujadNsO.exe
  2⤵
  PID:5360
- C:\Windows\System\IxrEVLA.exe
  C:\Windows\System\IxrEVLA.exe
  2⤵
  PID:5408
- C:\Windows\System\cYUiESW.exe
  C:\Windows\System\cYUiESW.exe
  2⤵
  PID:12552
- C:\Windows\System\ngJmtrM.exe
  C:\Windows\System\ngJmtrM.exe
  2⤵
  PID:5384
- C:\Windows\System\iXCkBoa.exe
  C:\Windows\System\iXCkBoa.exe
  2⤵
  PID:5724
- C:\Windows\System\NZZOkWd.exe
  C:\Windows\System\NZZOkWd.exe
  2⤵
  PID:8488
- C:\Windows\System\liqIKjx.exe
  C:\Windows\System\liqIKjx.exe
  2⤵
  PID:6520
- C:\Windows\System\TeRFGOO.exe
  C:\Windows\System\TeRFGOO.exe
  2⤵
  PID:6576
- C:\Windows\System\lcPMJbh.exe
  C:\Windows\System\lcPMJbh.exe
  2⤵
  PID:6412
- C:\Windows\System\abBTzwS.exe
  C:\Windows\System\abBTzwS.exe
  2⤵
  PID:6524
- C:\Windows\System\agSWsmC.exe
  C:\Windows\System\agSWsmC.exe
  2⤵
  PID:1156
- C:\Windows\System\MBYsVlF.exe
  C:\Windows\System\MBYsVlF.exe
  2⤵
  PID:6096
- C:\Windows\System\xgGgolD.exe
  C:\Windows\System\xgGgolD.exe
  2⤵
  PID:5684
- C:\Windows\System\iFxGeTT.exe
  C:\Windows\System\iFxGeTT.exe
  2⤵
  PID:568
- C:\Windows\System\xUcOThL.exe
  C:\Windows\System\xUcOThL.exe
  2⤵
  PID:5796
- C:\Windows\System\TYuwrCy.exe
  C:\Windows\System\TYuwrCy.exe
  2⤵
  PID:1924
- C:\Windows\System\YTfjGdc.exe
  C:\Windows\System\YTfjGdc.exe
  2⤵
  PID:3900
- C:\Windows\System\ljDYwLp.exe
  C:\Windows\System\ljDYwLp.exe
  2⤵
  PID:12736
- C:\Windows\System\pvEjGqQ.exe
  C:\Windows\System\pvEjGqQ.exe
  2⤵
  PID:5648
- C:\Windows\System\RcVBVwq.exe
  C:\Windows\System\RcVBVwq.exe
  2⤵
  PID:6636
- C:\Windows\System\uhoQzif.exe
  C:\Windows\System\uhoQzif.exe
  2⤵
  PID:7832
- C:\Windows\System\lYZVcRu.exe
  C:\Windows\System\lYZVcRu.exe
  2⤵
  PID:5440
- C:\Windows\System\IoMKkfM.exe
  C:\Windows\System\IoMKkfM.exe
  2⤵
  PID:12880
- C:\Windows\System\ctqiYZQ.exe
  C:\Windows\System\ctqiYZQ.exe
  2⤵
  PID:4232
- C:\Windows\System\FyeAznI.exe
  C:\Windows\System\FyeAznI.exe
  2⤵
  PID:5268
- C:\Windows\System\MlmIVFU.exe
  C:\Windows\System\MlmIVFU.exe
  2⤵
  PID:2560
- C:\Windows\System\GDsZNiH.exe
  C:\Windows\System\GDsZNiH.exe
  2⤵
  PID:8876
- C:\Windows\System\pcQyNlU.exe
  C:\Windows\System\pcQyNlU.exe
  2⤵
  PID:8144
- C:\Windows\System\OqOGXYU.exe
  C:\Windows\System\OqOGXYU.exe
  2⤵
  PID:13296
- C:\Windows\System\THOJniH.exe
  C:\Windows\System\THOJniH.exe
  2⤵
  PID:8976
- C:\Windows\System\mmNwhnx.exe
  C:\Windows\System\mmNwhnx.exe
  2⤵
  PID:2320
- C:\Windows\System\QUyqMkB.exe
  C:\Windows\System\QUyqMkB.exe
  2⤵
  PID:5160
- C:\Windows\System\sOpmjiv.exe
  C:\Windows\System\sOpmjiv.exe
  2⤵
  PID:1332
- C:\Windows\System\OOAcOOi.exe
  C:\Windows\System\OOAcOOi.exe
  2⤵
  PID:9028
- C:\Windows\System\DuDJIQq.exe
  C:\Windows\System\DuDJIQq.exe
  2⤵
  PID:5928
- C:\Windows\System\ghzUXUS.exe
  C:\Windows\System\ghzUXUS.exe
  2⤵
  PID:6788
- C:\Windows\System\dKofNeA.exe
  C:\Windows\System\dKofNeA.exe
  2⤵
  PID:9060
- C:\Windows\System\DgzMVJw.exe
  C:\Windows\System\DgzMVJw.exe
  2⤵
  PID:6816
- C:\Windows\System\TjrQvhQ.exe
  C:\Windows\System\TjrQvhQ.exe
  2⤵
  PID:9128
- C:\Windows\System\WEuFlMH.exe
  C:\Windows\System\WEuFlMH.exe
  2⤵
  PID:5464
- C:\Windows\System\qMNcDoY.exe
  C:\Windows\System\qMNcDoY.exe
  2⤵
  PID:9192
- C:\Windows\System\UPTugzC.exe
  C:\Windows\System\UPTugzC.exe
  2⤵
  PID:4224
- C:\Windows\System\fKrmOdI.exe
  C:\Windows\System\fKrmOdI.exe
  2⤵
  PID:3216
- C:\Windows\System\qTRwCjt.exe
  C:\Windows\System\qTRwCjt.exe
  2⤵
  PID:3212
- C:\Windows\System\UdIfpTV.exe
  C:\Windows\System\UdIfpTV.exe
  2⤵
  PID:12948
- C:\Windows\System\AbXEwEM.exe
  C:\Windows\System\AbXEwEM.exe
  2⤵
  PID:6924
- C:\Windows\System\ZjcgsVU.exe
  C:\Windows\System\ZjcgsVU.exe
  2⤵
  PID:8004
- C:\Windows\System\vsTsBAE.exe
  C:\Windows\System\vsTsBAE.exe
  2⤵
  PID:8496
- C:\Windows\System\eEkQyHN.exe
  C:\Windows\System\eEkQyHN.exe
  2⤵
  PID:6120
- C:\Windows\System\BoLNrcM.exe
  C:\Windows\System\BoLNrcM.exe
  2⤵
  PID:8104
- C:\Windows\System\GdDVIWw.exe
  C:\Windows\System\GdDVIWw.exe
  2⤵
  PID:2316
- C:\Windows\System\VHRXCVb.exe
  C:\Windows\System\VHRXCVb.exe
  2⤵
  PID:5756
- C:\Windows\System\hDkyvVb.exe
  C:\Windows\System\hDkyvVb.exe
  2⤵
  PID:8664
- C:\Windows\System\pfQYuTS.exe
  C:\Windows\System\pfQYuTS.exe
  2⤵
  PID:5912
- C:\Windows\System\yWBGOtX.exe
  C:\Windows\System\yWBGOtX.exe
  2⤵
  PID:13000
- C:\Windows\System\nwcQdSr.exe
  C:\Windows\System\nwcQdSr.exe
  2⤵
  PID:9136
- C:\Windows\System\ndFteou.exe
  C:\Windows\System\ndFteou.exe
  2⤵
  PID:1688
- C:\Windows\System\zSmEboI.exe
  C:\Windows\System\zSmEboI.exe
  2⤵
  PID:1980
- C:\Windows\System\ndaWSHY.exe
  C:\Windows\System\ndaWSHY.exe
  2⤵
  PID:2648
- C:\Windows\System\QcFaqPe.exe
  C:\Windows\System\QcFaqPe.exe
  2⤵
  PID:5144
- C:\Windows\System\uSSHsmd.exe
  C:\Windows\System\uSSHsmd.exe
  2⤵
  PID:3656
- C:\Windows\System\yLVZuMh.exe
  C:\Windows\System\yLVZuMh.exe
  2⤵
  PID:8644
- C:\Windows\System\vAGPqQS.exe
  C:\Windows\System\vAGPqQS.exe
  2⤵
  PID:7148
- C:\Windows\System\rjzqYCg.exe
  C:\Windows\System\rjzqYCg.exe
  2⤵
  PID:9008
- C:\Windows\System\evGcPtp.exe
  C:\Windows\System\evGcPtp.exe
  2⤵
  PID:7152
- C:\Windows\System\WQgjEbb.exe
  C:\Windows\System\WQgjEbb.exe
  2⤵
  PID:5512
- C:\Windows\System\RiUnDFr.exe
  C:\Windows\System\RiUnDFr.exe
  2⤵
  PID:6080
- C:\Windows\System\zRUxGVi.exe
  C:\Windows\System\zRUxGVi.exe
  2⤵
  PID:8236
- C:\Windows\System\plqTKET.exe
  C:\Windows\System\plqTKET.exe
  2⤵
  PID:1264
- C:\Windows\System\yrPfhym.exe
  C:\Windows\System\yrPfhym.exe
  2⤵
  PID:12952
- C:\Windows\System\tWPEPtQ.exe
  C:\Windows\System\tWPEPtQ.exe
  2⤵
  PID:3432
- C:\Windows\System\krDAInP.exe
  C:\Windows\System\krDAInP.exe
  2⤵
  PID:5484
- C:\Windows\System\oqaCoTt.exe
  C:\Windows\System\oqaCoTt.exe
  2⤵
  PID:9228
- C:\Windows\System\VuXkaaX.exe
  C:\Windows\System\VuXkaaX.exe
  2⤵
  PID:2736
- C:\Windows\System\UrZlOrX.exe
  C:\Windows\System\UrZlOrX.exe
  2⤵
  PID:2116
- C:\Windows\System\sIByjvS.exe
  C:\Windows\System\sIByjvS.exe
  2⤵
  PID:4352
- C:\Windows\System\CozUWaO.exe
  C:\Windows\System\CozUWaO.exe
  2⤵
  PID:6264
- C:\Windows\System\WuQWpTm.exe
  C:\Windows\System\WuQWpTm.exe
  2⤵
  PID:9316
- C:\Windows\System\xArzEGp.exe
  C:\Windows\System\xArzEGp.exe
  2⤵
  PID:224
- C:\Windows\System\hEQyDqX.exe
  C:\Windows\System\hEQyDqX.exe
  2⤵
  PID:5672
- C:\Windows\System\CBJBzLA.exe
  C:\Windows\System\CBJBzLA.exe
  2⤵
  PID:6216
- C:\Windows\System\uddvFNs.exe
  C:\Windows\System\uddvFNs.exe
  2⤵
  PID:6276
- C:\Windows\System\ZQKrnDc.exe
  C:\Windows\System\ZQKrnDc.exe
  2⤵
  PID:9444
- C:\Windows\System\ODXfigO.exe
  C:\Windows\System\ODXfigO.exe
  2⤵
  PID:9476
- C:\Windows\System\vzlZlbb.exe
  C:\Windows\System\vzlZlbb.exe
  2⤵
  PID:4760
- C:\Windows\System\ftbswjc.exe
  C:\Windows\System\ftbswjc.exe
  2⤵
  PID:6364
- C:\Windows\System\bwLgUSD.exe
  C:\Windows\System\bwLgUSD.exe
  2⤵
  PID:8408
- C:\Windows\System\bxQCVDX.exe
  C:\Windows\System\bxQCVDX.exe
  2⤵
  PID:9580
- C:\Windows\System\Jvdezqq.exe
  C:\Windows\System\Jvdezqq.exe
  2⤵
  PID:4452
- C:\Windows\System\nrKpgvT.exe
  C:\Windows\System\nrKpgvT.exe
  2⤵
  PID:9624
- C:\Windows\System\BbULItL.exe
  C:\Windows\System\BbULItL.exe
  2⤵
  PID:6296
- C:\Windows\System\aADqkZf.exe
  C:\Windows\System\aADqkZf.exe
  2⤵
  PID:6436
- C:\Windows\System\acZpnff.exe
  C:\Windows\System\acZpnff.exe
  2⤵
  PID:8580
- C:\Windows\System\JPJZjqQ.exe
  C:\Windows\System\JPJZjqQ.exe
  2⤵
  PID:7920
- C:\Windows\System\eGCyskC.exe
  C:\Windows\System\eGCyskC.exe
  2⤵
  PID:12664
- C:\Windows\System\yseFDHL.exe
  C:\Windows\System\yseFDHL.exe
  2⤵
  PID:4648
- C:\Windows\System\ogMFaNP.exe
  C:\Windows\System\ogMFaNP.exe
  2⤵
  PID:8684
- C:\Windows\System\FQGwnmI.exe
  C:\Windows\System\FQGwnmI.exe
  2⤵
  PID:8140
- C:\Windows\System\cXwqEmo.exe
  C:\Windows\System\cXwqEmo.exe
  2⤵
  PID:6884
- C:\Windows\System\AEGDlUl.exe
  C:\Windows\System\AEGDlUl.exe
  2⤵
  PID:8744
- C:\Windows\System\jcXoKbd.exe
  C:\Windows\System\jcXoKbd.exe
  2⤵
  PID:12840
- C:\Windows\System\YoOFfHG.exe
  C:\Windows\System\YoOFfHG.exe
  2⤵
  PID:5592
- C:\Windows\System\oiOCHgR.exe
  C:\Windows\System\oiOCHgR.exe
  2⤵
  PID:6628
- C:\Windows\System\Zvllskq.exe
  C:\Windows\System\Zvllskq.exe
  2⤵
  PID:7048
- C:\Windows\System\PpeLxJn.exe
  C:\Windows\System\PpeLxJn.exe
  2⤵
  PID:10216
- C:\Windows\System\qDIebDM.exe
  C:\Windows\System\qDIebDM.exe
  2⤵
  PID:9220
- C:\Windows\System\HuKwbcF.exe
  C:\Windows\System\HuKwbcF.exe
  2⤵
  PID:9276
- C:\Windows\System\waUMWxi.exe
  C:\Windows\System\waUMWxi.exe
  2⤵
  PID:5988
- C:\Windows\System\CjmrIaC.exe
  C:\Windows\System\CjmrIaC.exe
  2⤵
  PID:5156
- C:\Windows\System\prIqKAR.exe
  C:\Windows\System\prIqKAR.exe
  2⤵
  PID:7644
- C:\Windows\System\FZzsLUH.exe
  C:\Windows\System\FZzsLUH.exe
  2⤵
  PID:5284
- C:\Windows\System\jRHFJJB.exe
  C:\Windows\System\jRHFJJB.exe
  2⤵
  PID:7988
- C:\Windows\System\HsrmEsD.exe
  C:\Windows\System\HsrmEsD.exe
  2⤵
  PID:12928
- C:\Windows\System\LISYaOi.exe
  C:\Windows\System\LISYaOi.exe
  2⤵
  PID:8900
- C:\Windows\System\DoGWemX.exe
  C:\Windows\System\DoGWemX.exe
  2⤵
  PID:6696
- C:\Windows\System\GvApbXZ.exe
  C:\Windows\System\GvApbXZ.exe
  2⤵
  PID:7624
- C:\Windows\System\FyPugob.exe
  C:\Windows\System\FyPugob.exe
  2⤵
  PID:9680
- C:\Windows\System\CRGUPah.exe
  C:\Windows\System\CRGUPah.exe
  2⤵
  PID:9000
- C:\Windows\System\DWeyYEe.exe
  C:\Windows\System\DWeyYEe.exe
  2⤵
  PID:5580
- C:\Windows\System\zqLtYzw.exe
  C:\Windows\System\zqLtYzw.exe
  2⤵
  PID:7908
- C:\Windows\System\SYaAocf.exe
  C:\Windows\System\SYaAocf.exe
  2⤵
  PID:13304
- C:\Windows\System\VpFEpXP.exe
  C:\Windows\System\VpFEpXP.exe
  2⤵
  PID:6616
- C:\Windows\System\FdZmhzU.exe
  C:\Windows\System\FdZmhzU.exe
  2⤵
  PID:6812
- C:\Windows\System\SkOggiH.exe
  C:\Windows\System\SkOggiH.exe
  2⤵
  PID:4280
- C:\Windows\System\fGizVsy.exe
  C:\Windows\System\fGizVsy.exe
  2⤵
  PID:9100
- C:\Windows\System\GHmqgku.exe
  C:\Windows\System\GHmqgku.exe
  2⤵
  PID:8588
- C:\Windows\System\qeStivh.exe
  C:\Windows\System\qeStivh.exe
  2⤵
  PID:6996
- C:\Windows\System\LfSfTmG.exe
  C:\Windows\System\LfSfTmG.exe
  2⤵
  PID:7136
- C:\Windows\System\qiBjKuW.exe
  C:\Windows\System\qiBjKuW.exe
  2⤵
  PID:9036
- C:\Windows\System\NgDLCmz.exe
  C:\Windows\System\NgDLCmz.exe
  2⤵
  PID:10268
- C:\Windows\System\MqrFkCP.exe
  C:\Windows\System\MqrFkCP.exe
  2⤵
  PID:1304
- C:\Windows\System\HVAYUXf.exe
  C:\Windows\System\HVAYUXf.exe
  2⤵
  PID:1268
- C:\Windows\System\VTYTSrs.exe
  C:\Windows\System\VTYTSrs.exe
  2⤵
  PID:7188
- C:\Windows\System\qxeULeO.exe
  C:\Windows\System\qxeULeO.exe
  2⤵
  PID:1656
- C:\Windows\System\bgcLqQc.exe
  C:\Windows\System\bgcLqQc.exe
  2⤵
  PID:5588
- C:\Windows\System\HQDFkDk.exe
  C:\Windows\System\HQDFkDk.exe
  2⤵
  PID:8740
- C:\Windows\System\GqdHtwS.exe
  C:\Windows\System\GqdHtwS.exe
  2⤵
  PID:6896
- C:\Windows\System\GeyrdSc.exe
  C:\Windows\System\GeyrdSc.exe
  2⤵
  PID:8344
- C:\Windows\System\GSHLHjw.exe
  C:\Windows\System\GSHLHjw.exe
  2⤵
  PID:7328
- C:\Windows\System\IaqcdeS.exe
  C:\Windows\System\IaqcdeS.exe
  2⤵
  PID:7220
- C:\Windows\System\kkGVzhq.exe
  C:\Windows\System\kkGVzhq.exe
  2⤵
  PID:8592
- C:\Windows\System\hesWNUD.exe
  C:\Windows\System\hesWNUD.exe
  2⤵
  PID:10332
- C:\Windows\System\FnqTsoV.exe
  C:\Windows\System\FnqTsoV.exe
  2⤵
  PID:7348
- C:\Windows\System\jezyzQM.exe
  C:\Windows\System\jezyzQM.exe
  2⤵
  PID:7376
- C:\Windows\System\edQbNLz.exe
  C:\Windows\System\edQbNLz.exe
  2⤵
  PID:10420
- C:\Windows\System\cnGqtTw.exe
  C:\Windows\System\cnGqtTw.exe
  2⤵
  PID:244
- C:\Windows\System\zdHkOrh.exe
  C:\Windows\System\zdHkOrh.exe
  2⤵
  PID:8928
- C:\Windows\System\awaFTUQ.exe
  C:\Windows\System\awaFTUQ.exe
  2⤵
  PID:7040
- C:\Windows\System\eLDPBbb.exe
  C:\Windows\System\eLDPBbb.exe
  2⤵
  PID:9068
- C:\Windows\System\UMlwRRh.exe
  C:\Windows\System\UMlwRRh.exe
  2⤵
  PID:5104
- C:\Windows\System\KrCpFiw.exe
  C:\Windows\System\KrCpFiw.exe
  2⤵
  PID:7500
- C:\Windows\System\fnUNaTy.exe
  C:\Windows\System\fnUNaTy.exe
  2⤵
  PID:6236
- C:\Windows\System\pOMzDeX.exe
  C:\Windows\System\pOMzDeX.exe
  2⤵
  PID:5184
- C:\Windows\System\YiYtWHx.exe
  C:\Windows\System\YiYtWHx.exe
  2⤵
  PID:8232
- C:\Windows\System\SPWHZmb.exe
  C:\Windows\System\SPWHZmb.exe
  2⤵
  PID:10452
- C:\Windows\System\dDeehgj.exe
  C:\Windows\System\dDeehgj.exe
  2⤵
  PID:7600
- C:\Windows\System\IbyFaNP.exe
  C:\Windows\System\IbyFaNP.exe
  2⤵
  PID:4296
- C:\Windows\System\SGIdryf.exe
  C:\Windows\System\SGIdryf.exe
  2⤵
  PID:4716
- C:\Windows\System\AkGXISW.exe
  C:\Windows\System\AkGXISW.exe
  2⤵
  PID:10548
- C:\Windows\System\IhAhatd.exe
  C:\Windows\System\IhAhatd.exe
  2⤵
  PID:7664
- C:\Windows\System\kcswRIq.exe
  C:\Windows\System\kcswRIq.exe
  2⤵
  PID:10600
- C:\Windows\System\gCidroB.exe
  C:\Windows\System\gCidroB.exe
  2⤵
  PID:10664
- C:\Windows\System\bMklvqv.exe
  C:\Windows\System\bMklvqv.exe
  2⤵
  PID:9292
- C:\Windows\System\TlmWYpn.exe
  C:\Windows\System\TlmWYpn.exe
  2⤵
  PID:5216
- C:\Windows\System\tSovpTm.exe
  C:\Windows\System\tSovpTm.exe
  2⤵
  PID:10736
- C:\Windows\System\PnZdpta.exe
  C:\Windows\System\PnZdpta.exe
  2⤵
  PID:10780
- C:\Windows\System\QYxbMLp.exe
  C:\Windows\System\QYxbMLp.exe
  2⤵
  PID:7752
- C:\Windows\System\oOafSbJ.exe
  C:\Windows\System\oOafSbJ.exe
  2⤵
  PID:5412
- C:\Windows\System\KtDuQKg.exe
  C:\Windows\System\KtDuQKg.exe
  2⤵
  PID:6356
- C:\Windows\System\ZvWgONh.exe
  C:\Windows\System\ZvWgONh.exe
  2⤵
  PID:6360
- C:\Windows\System\kJSgMJG.exe
  C:\Windows\System\kJSgMJG.exe
  2⤵
  PID:9540
- C:\Windows\System\hYTvLIk.exe
  C:\Windows\System\hYTvLIk.exe
  2⤵
  PID:6424
- C:\Windows\System\weThXpw.exe
  C:\Windows\System\weThXpw.exe
  2⤵
  PID:6500
- C:\Windows\System\ybCgYWh.exe
  C:\Windows\System\ybCgYWh.exe
  2⤵
  PID:6324
- C:\Windows\System\FKHkCkU.exe
  C:\Windows\System\FKHkCkU.exe
  2⤵
  PID:11060
- C:\Windows\System\ZXSMJUm.exe
  C:\Windows\System\ZXSMJUm.exe
  2⤵
  PID:11116
- C:\Windows\System\jtWEDBK.exe
  C:\Windows\System\jtWEDBK.exe
  2⤵
  PID:5244
- C:\Windows\System\ahQRbbw.exe
  C:\Windows\System\ahQRbbw.exe
  2⤵
  PID:5136
- C:\Windows\System\FIXlnyC.exe
  C:\Windows\System\FIXlnyC.exe
  2⤵
  PID:7948
- C:\Windows\System\VSqLWas.exe
  C:\Windows\System\VSqLWas.exe
  2⤵
  PID:11184
- C:\Windows\System\WNxQAWT.exe
  C:\Windows\System\WNxQAWT.exe
  2⤵
  PID:11220
- C:\Windows\System\bKInwjb.exe
  C:\Windows\System\bKInwjb.exe
  2⤵
  PID:2504
- C:\Windows\System\zgrhDgK.exe
  C:\Windows\System\zgrhDgK.exe
  2⤵
  PID:10064
- C:\Windows\System\YKLIquN.exe
  C:\Windows\System\YKLIquN.exe
  2⤵
  PID:7044
- C:\Windows\System\PnvzkZK.exe
  C:\Windows\System\PnvzkZK.exe
  2⤵
  PID:7080
- C:\Windows\System\JcuSiZR.exe
  C:\Windows\System\JcuSiZR.exe
  2⤵
  PID:10376
- C:\Windows\System\UuDFWmI.exe
  C:\Windows\System\UuDFWmI.exe
  2⤵
  PID:10536
- C:\Windows\System\zqEJDCS.exe
  C:\Windows\System\zqEJDCS.exe
  2⤵
  PID:10580
- C:\Windows\System\ZzQIlFk.exe
  C:\Windows\System\ZzQIlFk.exe
  2⤵
  PID:6692
- C:\Windows\System\wdzgfwA.exe
  C:\Windows\System\wdzgfwA.exe
  2⤵
  PID:10576
- C:\Windows\System\cSCuXDp.exe
  C:\Windows\System\cSCuXDp.exe
  2⤵
  PID:10660
- C:\Windows\System\ZUbeCSB.exe
  C:\Windows\System\ZUbeCSB.exe
  2⤵
  PID:3032
- C:\Windows\System\hLZazUV.exe
  C:\Windows\System\hLZazUV.exe
  2⤵
  PID:9448
- C:\Windows\System\idZRQDz.exe
  C:\Windows\System\idZRQDz.exe
  2⤵
  PID:8008
- C:\Windows\System\DmAhFCk.exe
  C:\Windows\System\DmAhFCk.exe
  2⤵
  PID:6164
- C:\Windows\System\NoDLEWa.exe
  C:\Windows\System\NoDLEWa.exe
  2⤵
  PID:9604
- C:\Windows\System\KtINBAN.exe
  C:\Windows\System\KtINBAN.exe
  2⤵
  PID:2288
- C:\Windows\System\BVqEiqD.exe
  C:\Windows\System\BVqEiqD.exe
  2⤵
  PID:13184
- C:\Windows\System\hVxmtbP.exe
  C:\Windows\System\hVxmtbP.exe
  2⤵
  PID:6768
- C:\Windows\System\XuBkABZ.exe
  C:\Windows\System\XuBkABZ.exe
  2⤵
  PID:11204
- C:\Windows\System\PpYEjqa.exe
  C:\Windows\System\PpYEjqa.exe
  2⤵
  PID:10172
- C:\Windows\System\bnQQvyW.exe
  C:\Windows\System\bnQQvyW.exe
  2⤵
  PID:6756
- C:\Windows\System\pXrxPmV.exe
  C:\Windows\System\pXrxPmV.exe
  2⤵
  PID:9776
- C:\Windows\System\TjHVklE.exe
  C:\Windows\System\TjHVklE.exe
  2⤵
  PID:3428
- C:\Windows\System\XpDYAGV.exe
  C:\Windows\System\XpDYAGV.exe
  2⤵
  PID:3160
- C:\Windows\System\rBzpvWh.exe
  C:\Windows\System\rBzpvWh.exe
  2⤵
  PID:10740
- C:\Windows\System\MVSwsKT.exe
  C:\Windows\System\MVSwsKT.exe
  2⤵
  PID:9124
- C:\Windows\System\nYkLKdW.exe
  C:\Windows\System\nYkLKdW.exe
  2⤵
  PID:7076
- C:\Windows\System\uAXBBfI.exe
  C:\Windows\System\uAXBBfI.exe
  2⤵
  PID:1616
- C:\Windows\System\kCwoUTw.exe
  C:\Windows\System\kCwoUTw.exe
  2⤵
  PID:4320
- C:\Windows\System\ufFkpuK.exe
  C:\Windows\System\ufFkpuK.exe
  2⤵
  PID:8636
- C:\Windows\System\hpknSpk.exe
  C:\Windows\System\hpknSpk.exe
  2⤵
  PID:8400
- C:\Windows\System\JPQXJWv.exe
  C:\Windows\System\JPQXJWv.exe
  2⤵
  PID:4460
- C:\Windows\System\IeHznww.exe
  C:\Windows\System\IeHznww.exe
  2⤵
  PID:13268
- C:\Windows\System\rVxmfvT.exe
  C:\Windows\System\rVxmfvT.exe
  2⤵
  PID:6928
- C:\Windows\System\IFqBNat.exe
  C:\Windows\System\IFqBNat.exe
  2⤵
  PID:2324
- C:\Windows\System\MbTwhXd.exe
  C:\Windows\System\MbTwhXd.exe
  2⤵
  PID:12944
- C:\Windows\System\KmgWuKA.exe
  C:\Windows\System\KmgWuKA.exe
  2⤵
  PID:2440
- C:\Windows\System\sVPESez.exe
  C:\Windows\System\sVPESez.exe
  2⤵
  PID:8356
- C:\Windows\System\wwmdSVB.exe
  C:\Windows\System\wwmdSVB.exe
  2⤵
  PID:11056
- C:\Windows\System\OCoLgRe.exe
  C:\Windows\System\OCoLgRe.exe
  2⤵
  PID:7000
- C:\Windows\System\WPPodDQ.exe
  C:\Windows\System\WPPodDQ.exe
  2⤵
  PID:11292
- C:\Windows\System\amvUqIo.exe
  C:\Windows\System\amvUqIo.exe
  2⤵
  PID:7332
- C:\Windows\System\NenHDdg.exe
  C:\Windows\System\NenHDdg.exe
  2⤵
  PID:1444
- C:\Windows\System\qjwGywG.exe
  C:\Windows\System\qjwGywG.exe
  2⤵
  PID:9204
- C:\Windows\System\dFYEeQf.exe
  C:\Windows\System\dFYEeQf.exe
  2⤵
  PID:7388
- C:\Windows\System\zumGyei.exe
  C:\Windows\System\zumGyei.exe
  2⤵
  PID:7488
- C:\Windows\System\hFVMgWv.exe
  C:\Windows\System\hFVMgWv.exe
  2⤵
  PID:5992
- C:\Windows\System\NNAYoVH.exe
  C:\Windows\System\NNAYoVH.exe
  2⤵
  PID:9012
- C:\Windows\System\iUYBkkZ.exe
  C:\Windows\System\iUYBkkZ.exe
  2⤵
  PID:8468
- C:\Windows\System\rksgiKT.exe
  C:\Windows\System\rksgiKT.exe
  2⤵
  PID:11436
- C:\Windows\System\caVDzcA.exe
  C:\Windows\System\caVDzcA.exe
  2⤵
  PID:5556
- C:\Windows\System\lvQlMgq.exe
  C:\Windows\System\lvQlMgq.exe
  2⤵
  PID:7460
- C:\Windows\System\ZkfLXpP.exe
  C:\Windows\System\ZkfLXpP.exe
  2⤵
  PID:11480
- C:\Windows\System\GatWvtb.exe
  C:\Windows\System\GatWvtb.exe
  2⤵
  PID:11540
- C:\Windows\System\qwXGBgV.exe
  C:\Windows\System\qwXGBgV.exe
  2⤵
  PID:10704
- C:\Windows\System\wOlEluV.exe
  C:\Windows\System\wOlEluV.exe
  2⤵
  PID:5792
- C:\Windows\System\OlrJsAH.exe
  C:\Windows\System\OlrJsAH.exe
  2⤵
  PID:6208
- C:\Windows\System\fMicbNT.exe
  C:\Windows\System\fMicbNT.exe
  2⤵
  PID:8520
- C:\Windows\System\LtSgLGY.exe
  C:\Windows\System\LtSgLGY.exe
  2⤵
  PID:7760
- C:\Windows\System\jitunPI.exe
  C:\Windows\System\jitunPI.exe
  2⤵
  PID:7564
- C:\Windows\System\mmsbAqV.exe
  C:\Windows\System\mmsbAqV.exe
  2⤵
  PID:7612
- C:\Windows\System\UUbVjcY.exe
  C:\Windows\System\UUbVjcY.exe
  2⤵
  PID:9376
- C:\Windows\System\oMZYxZt.exe
  C:\Windows\System\oMZYxZt.exe
  2⤵
  PID:9564
- C:\Windows\System\IiVPgev.exe
  C:\Windows\System\IiVPgev.exe
  2⤵
  PID:7852
- C:\Windows\System\ONKCDwb.exe
  C:\Windows\System\ONKCDwb.exe
  2⤵
  PID:800
- C:\Windows\System\iWoPIVk.exe
  C:\Windows\System\iWoPIVk.exe
  2⤵
  PID:11824
- C:\Windows\System\tiKxrRW.exe
  C:\Windows\System\tiKxrRW.exe
  2⤵
  PID:11068
- C:\Windows\System\QEkGAOn.exe
  C:\Windows\System\QEkGAOn.exe
  2⤵
  PID:6612
- C:\Windows\System\dYBCCJc.exe
  C:\Windows\System\dYBCCJc.exe
  2⤵
  PID:11104
- C:\Windows\System\Icalqvw.exe
  C:\Windows\System\Icalqvw.exe
  2⤵
  PID:7964
- C:\Windows\System\LuZWPPA.exe
  C:\Windows\System\LuZWPPA.exe
  2⤵
  PID:9996
- C:\Windows\System\cITrFhZ.exe
  C:\Windows\System\cITrFhZ.exe
  2⤵
  PID:7976
- C:\Windows\System\SalFYNI.exe
  C:\Windows\System\SalFYNI.exe
  2⤵
  PID:8764
- C:\Windows\System\eQHvhEA.exe
  C:\Windows\System\eQHvhEA.exe
  2⤵
  PID:6968
- C:\Windows\System\gmqjPHz.exe
  C:\Windows\System\gmqjPHz.exe
  2⤵
  PID:10340
- C:\Windows\System\zbJpIiD.exe
  C:\Windows\System\zbJpIiD.exe
  2⤵
  PID:7108
- C:\Windows\System\zHoNkfH.exe
  C:\Windows\System\zHoNkfH.exe
  2⤵
  PID:5636
- C:\Windows\System\cybDRFB.exe
  C:\Windows\System\cybDRFB.exe
  2⤵
  PID:10596
- C:\Windows\System\yxXBRdH.exe
  C:\Windows\System\yxXBRdH.exe
  2⤵
  PID:6020
- C:\Windows\System\FNvATkD.exe
  C:\Windows\System\FNvATkD.exe
  2⤵
  PID:7840
- C:\Windows\System\PgxIeYP.exe
  C:\Windows\System\PgxIeYP.exe
  2⤵
  PID:9636
- C:\Windows\System\ytHIyTw.exe
  C:\Windows\System\ytHIyTw.exe
  2⤵
  PID:6184
- C:\Windows\System\AoGEbSK.exe
  C:\Windows\System\AoGEbSK.exe
  2⤵
  PID:556
- C:\Windows\System\kXQxpcY.exe
  C:\Windows\System\kXQxpcY.exe
  2⤵
  PID:6452
- C:\Windows\System\icICVAo.exe
  C:\Windows\System\icICVAo.exe
  2⤵
  PID:11736
- C:\Windows\System\WndeyHy.exe
  C:\Windows\System\WndeyHy.exe
  2⤵
  PID:9924
- C:\Windows\System\depqdpI.exe
  C:\Windows\System\depqdpI.exe
  2⤵
  PID:4672
- C:\Windows\System\nzbobHB.exe
  C:\Windows\System\nzbobHB.exe
  2⤵
  PID:9148
- C:\Windows\System\VGqMhMC.exe
  C:\Windows\System\VGqMhMC.exe
  2⤵
  PID:6076
- C:\Windows\System\aZpfphk.exe
  C:\Windows\System\aZpfphk.exe
  2⤵
  PID:4532
- C:\Windows\System\IPgbUQD.exe
  C:\Windows\System\IPgbUQD.exe
  2⤵
  PID:1708
- C:\Windows\System\dqSOJTn.exe
  C:\Windows\System\dqSOJTn.exe
  2⤵
  PID:11344
- C:\Windows\System\JJJfDZU.exe
  C:\Windows\System\JJJfDZU.exe
  2⤵
  PID:924
- C:\Windows\System\mKFdDTy.exe
  C:\Windows\System\mKFdDTy.exe
  2⤵
  PID:4560
- C:\Windows\System\HcXAKzH.exe
  C:\Windows\System\HcXAKzH.exe
  2⤵
  PID:7244
- C:\Windows\System\SfHpAwL.exe
  C:\Windows\System\SfHpAwL.exe
  2⤵
  PID:10232
- C:\Windows\System\jKqObsd.exe
  C:\Windows\System\jKqObsd.exe
  2⤵
  PID:7696
- C:\Windows\System\gidCWcg.exe
  C:\Windows\System\gidCWcg.exe
  2⤵
  PID:11348
- C:\Windows\System\TLmWIbl.exe
  C:\Windows\System\TLmWIbl.exe
  2⤵
  PID:8964
- C:\Windows\System\OgzBMFp.exe
  C:\Windows\System\OgzBMFp.exe
  2⤵
  PID:2792
- C:\Windows\System\VeCYKIW.exe
  C:\Windows\System\VeCYKIW.exe
  2⤵
  PID:3772
- C:\Windows\System\ajVLSdz.exe
  C:\Windows\System\ajVLSdz.exe
  2⤵
  PID:11376
- C:\Windows\System\qUNwlGa.exe
  C:\Windows\System\qUNwlGa.exe
  2⤵
  PID:11448
- C:\Windows\System\uiJDVkm.exe
  C:\Windows\System\uiJDVkm.exe
  2⤵
  PID:11496
- C:\Windows\System\xffDYMg.exe
  C:\Windows\System\xffDYMg.exe
  2⤵
  PID:7068
- C:\Windows\System\burxYDb.exe
  C:\Windows\System\burxYDb.exe
  2⤵
  PID:10624
- C:\Windows\System\mcxPEAC.exe
  C:\Windows\System\mcxPEAC.exe
  2⤵
  PID:12424
- C:\Windows\System\EEcZQVI.exe
  C:\Windows\System\EEcZQVI.exe
  2⤵
  PID:7516
- C:\Windows\System\rNcoInx.exe
  C:\Windows\System\rNcoInx.exe
  2⤵
  PID:7732
- C:\Windows\System\tJuAXkJ.exe
  C:\Windows\System\tJuAXkJ.exe
  2⤵
  PID:12476
- C:\Windows\System\WQduZYl.exe
  C:\Windows\System\WQduZYl.exe
  2⤵
  PID:12556
- C:\Windows\System\GpBiuqE.exe
  C:\Windows\System\GpBiuqE.exe
  2⤵
  PID:7628
- C:\Windows\System\cgLVxMF.exe
  C:\Windows\System\cgLVxMF.exe
  2⤵
  PID:12404
- C:\Windows\System\avkAKyf.exe
  C:\Windows\System\avkAKyf.exe
  2⤵
  PID:12628
- C:\Windows\System\qLHsQkv.exe
  C:\Windows\System\qLHsQkv.exe
  2⤵
  PID:5664
- C:\Windows\System\fluTiOD.exe
  C:\Windows\System\fluTiOD.exe
  2⤵
  PID:12808
- C:\Windows\System\WmiMQpw.exe
  C:\Windows\System\WmiMQpw.exe
  2⤵
  PID:12812
- C:\Windows\System\RvuJazg.exe
  C:\Windows\System\RvuJazg.exe
  2⤵
  PID:12876
- C:\Windows\System\luWBQww.exe
  C:\Windows\System\luWBQww.exe
  2⤵
  PID:9648
- C:\Windows\System\FWRWWhT.exe
  C:\Windows\System\FWRWWhT.exe
  2⤵
  PID:11036
- C:\Windows\System\JxlCdmv.exe
  C:\Windows\System\JxlCdmv.exe
  2⤵
  PID:11652
- C:\Windows\System\peaYVud.exe
  C:\Windows\System\peaYVud.exe
  2⤵
  PID:12968
- C:\Windows\System\WUdOhnx.exe
  C:\Windows\System\WUdOhnx.exe
  2⤵
  PID:11656
- C:\Windows\System\lRwDkeI.exe
  C:\Windows\System\lRwDkeI.exe
  2⤵
  PID:13040
- C:\Windows\System\fQJjwkb.exe
  C:\Windows\System\fQJjwkb.exe
  2⤵
  PID:11192
- C:\Windows\System\RBNXXwj.exe
  C:\Windows\System\RBNXXwj.exe
  2⤵
  PID:9576
- C:\Windows\System\iYwlyhl.exe
  C:\Windows\System\iYwlyhl.exe
  2⤵
  PID:11020
- C:\Windows\System\fDvvmIk.exe
  C:\Windows\System\fDvvmIk.exe
  2⤵
  PID:6644
- C:\Windows\System\lapVniV.exe
  C:\Windows\System\lapVniV.exe
  2⤵
  PID:13196
- C:\Windows\System\ZxiOOWc.exe
  C:\Windows\System\ZxiOOWc.exe
  2⤵
  PID:10412
- C:\Windows\System\ADPwElE.exe
  C:\Windows\System\ADPwElE.exe
  2⤵
  PID:6580
- C:\Windows\System\XQuwyLH.exe
  C:\Windows\System\XQuwyLH.exe
  2⤵
  PID:11328
- C:\Windows\System\HxLsicf.exe
  C:\Windows\System\HxLsicf.exe
  2⤵
  PID:10824
- C:\Windows\System\SCgeifI.exe
  C:\Windows\System\SCgeifI.exe
  2⤵
  PID:8956
- C:\Windows\System\DyvHtUP.exe
  C:\Windows\System\DyvHtUP.exe
  2⤵
  PID:12436
- C:\Windows\System\wrFUEXz.exe
  C:\Windows\System\wrFUEXz.exe
  2⤵
  PID:11716
- C:\Windows\System\HJqKFLv.exe
  C:\Windows\System\HJqKFLv.exe
  2⤵
  PID:10652
- C:\Windows\System\quLrAZp.exe
  C:\Windows\System\quLrAZp.exe
  2⤵
  PID:12620
- C:\Windows\System\TIbhDbW.exe
  C:\Windows\System\TIbhDbW.exe
  2⤵
  PID:7336
- C:\Windows\System\FadTWxe.exe
  C:\Windows\System\FadTWxe.exe
  2⤵
  PID:11452
- C:\Windows\System\KtRWIFr.exe
  C:\Windows\System\KtRWIFr.exe
  2⤵
  PID:11364
- C:\Windows\System\ObgyECK.exe
  C:\Windows\System\ObgyECK.exe
  2⤵
  PID:8500
- C:\Windows\System\bhDnSxa.exe
  C:\Windows\System\bhDnSxa.exe
  2⤵
  PID:12120
- C:\Windows\System\QBbxYiU.exe
  C:\Windows\System\QBbxYiU.exe
  2⤵
  PID:4956
- C:\Windows\System\YtMfrug.exe
  C:\Windows\System\YtMfrug.exe
  2⤵
  PID:11464
- C:\Windows\System\urUKYwb.exe
  C:\Windows\System\urUKYwb.exe
  2⤵
  PID:12336
- C:\Windows\System\WDkSJpk.exe
  C:\Windows\System\WDkSJpk.exe
  2⤵
  PID:12428
- C:\Windows\System\jgvJRrQ.exe
  C:\Windows\System\jgvJRrQ.exe
  2⤵
  PID:12504
- C:\Windows\System\WqZVVEN.exe
  C:\Windows\System\WqZVVEN.exe
  2⤵
  PID:12564
- C:\Windows\System\sVRswLX.exe
  C:\Windows\System\sVRswLX.exe
  2⤵
  PID:12604
- C:\Windows\System\SofTedG.exe
  C:\Windows\System\SofTedG.exe
  2⤵
  PID:6292
- C:\Windows\System\tFsmxWE.exe
  C:\Windows\System\tFsmxWE.exe
  2⤵
  PID:11660
- C:\Windows\System\peWHBjC.exe
  C:\Windows\System\peWHBjC.exe
  2⤵
  PID:7776
- C:\Windows\System\LQhfTMm.exe
  C:\Windows\System\LQhfTMm.exe
  2⤵
  PID:12956
- C:\Windows\System\GaJvJuF.exe
  C:\Windows\System\GaJvJuF.exe
  2⤵
  PID:12980
- C:\Windows\System\vXuvLMY.exe
  C:\Windows\System\vXuvLMY.exe
  2⤵
  PID:10004
- C:\Windows\System\SqIkoWI.exe
  C:\Windows\System\SqIkoWI.exe
  2⤵
  PID:8096
- C:\Windows\System\fpQbvnL.exe
  C:\Windows\System\fpQbvnL.exe
  2⤵
  PID:4844
- C:\Windows\System\AVedbVL.exe
  C:\Windows\System\AVedbVL.exe
  2⤵
  PID:9480
- C:\Windows\System\EgkpesQ.exe
  C:\Windows\System\EgkpesQ.exe
  2⤵
  PID:13272
- C:\Windows\System\hpcADEw.exe
  C:\Windows\System\hpcADEw.exe
  2⤵
  PID:9508
- C:\Windows\System\ABkerps.exe
  C:\Windows\System\ABkerps.exe
  2⤵
  PID:6312
- C:\Windows\System\euIROXI.exe
  C:\Windows\System\euIROXI.exe
  2⤵
  PID:11752
- C:\Windows\System\vPSdwzE.exe
  C:\Windows\System\vPSdwzE.exe
  2⤵
  PID:12528
- C:\Windows\System\dnPoJMB.exe
  C:\Windows\System\dnPoJMB.exe
  2⤵
  PID:12608
- C:\Windows\System\mpeDZyM.exe
  C:\Windows\System\mpeDZyM.exe
  2⤵
  PID:6824
- C:\Windows\System\zzVDVLs.exe
  C:\Windows\System\zzVDVLs.exe
  2⤵
  PID:8404
- C:\Windows\System\SOElZul.exe
  C:\Windows\System\SOElZul.exe
  2⤵
  PID:6944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:8
1⤵
PID:7624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oimcb2d4.grc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AMxXgux.exe

Filesize
2.9MB

MD5
2bc1bc3db255172b46d29226f973f098

SHA1
4f11aa1cdfc880ba775a7105c302b730dc2e9c9e

SHA256
0e5ebff8f1436618e053c9bfe3d0f2632f062a660660c77c218ea984b0e45d52

SHA512
3111a08da839bb985e44e7e0b1b7bbfa18b6197856bc211d42321a31b4ba1a4e1f8fe43148d40050916d263f42cd0659accd47d0ebf5099cc7a50de837f0ff40

Download Submit
C:\Windows\System\BEJeArU.exe

Filesize
2.9MB

MD5
09ef76161b3a5cad386127187b03044d

SHA1
edae255929ad0486255691fa981eb6a0e9ca8588

SHA256
c707097955b3fd305e04742f73afdc917d390180ba26399be29df825fce49040

SHA512
8772c0b54529cc69c53d7046334e63b00126d26e63516325ba9a62bcaa9e7a29c031e72e6405aaa36281c943b6b696e1d8bb7a460ffea431d131fd23bfe565ff

Download Submit
C:\Windows\System\CVWseRi.exe

Filesize
2.9MB

MD5
755b5ba349c628db0ab8c6815f9d146b

SHA1
5bdc24baf876d682df235631a93bf0ffdafb853d

SHA256
c7f3fbfba650c7c99549a06bbcffff7bc906d8a465785c06a730813d3418e2cf

SHA512
f8725d92d0bd0a6090ec0c7167e638f08f7228950998af46ea135dc1d467b466c6396dc36b17493d36deccf7ea77e1b42c0c7f582ce13808b51f9e3de02557bc

Download Submit
C:\Windows\System\CroniKd.exe

Filesize
2.9MB

MD5
79fa819602b7026a510ab6231a7fa044

SHA1
a14d9a87379ed7f42475b60356816528f69baa20

SHA256
84daca870b2c7edb0cb4f5eea4014a71c72451745653f33f8b88e7b642a8abee

SHA512
a4c12b21beb5ef2ed5c8c19b647f78d5320a37b3348e5a4cf80f946e50650cafbdc754026b727842be79393a7f4ddacf0a295490b3e39d9ae52a95593d509920

Download Submit
C:\Windows\System\FVucabx.exe

Filesize
2.9MB

MD5
c6bd628c800782ef27fd441226570d1d

SHA1
81374000f4f43ea8d3ec24cc352b6ead79cd476d

SHA256
794d38e1cf29172c076264e36e68fab84325f7a25cdb49516bab98fd935864b1

SHA512
6308252a29ece723c6a1d58cd409cce48ab8ca9dc242a001e2c61974072f2545702a0fe830958ee2511096681ea9b1c5de0914d2ce8a8db56c9a857525c39c84

Download Submit
C:\Windows\System\HZSFCNh.exe

Filesize
8B

MD5
f6061fc6a7c99ae821a125be5d34b682

SHA1
cd62deeb3efa237b04e342e9238578fd370ae14d

SHA256
700c9a719b011e50437e2fa1d083a87e3381f4f178b8b9f9899f4bbf7503df60

SHA512
cc6b78f85499cc18661ced0cca34cc6f25b4f82783646930e95bb966639561cabaf13feff5c13c58aa77b6804729d0ec64978f44b9a573d37b44aa1603320b3d

Download Submit
C:\Windows\System\IWyngsE.exe

Filesize
2.9MB

MD5
951e0fb8c67e67102e18f6b5a8c82217

SHA1
9f2163a467f15b59ebbf43a4061cbd6edb69356b

SHA256
76f931abfcf7a89c2fb8649562fa236361d3c048b5d6be94394cb0c69105360e

SHA512
67cec20f8bac9ce398ab14c662b7540333235d640d299647eb6fbc177d682e39d9fd013a04c6bb8110209320941c6005c68fd62580287413dca7c98dc26fbc90

Download Submit
C:\Windows\System\LsSyxDn.exe

Filesize
2.9MB

MD5
17e23b8ec1ee2ccba242fdb7fe8aff2a

SHA1
bc5a891689f2fa96ced636df776c52e1d68341ef

SHA256
35f11bb27fd32ec50420efbd75c134989bb08fa11afef9511b328e50e74f0e98

SHA512
545affd54a9dbaa15a55a3e3cf2cbba735ce52b19baebad3f5145a0f415ea607a2ce5cfbc88a1a8e15ee238be2d715dd749fd9be490d7e3afd5df32c1c94e060

Download Submit
C:\Windows\System\NBlNBRK.exe

Filesize
2.9MB

MD5
764bf8b10d29c290ef4176f0bbe78dfa

SHA1
b65cdc50cf66623574ad14cd60443858326d9c6a

SHA256
4102a7133f0a46113e78dfe9043df143fbb63501360f047563efc545fbcc4329

SHA512
c6ccf411facb86f19a77001c8857e227c2e493b6a6abc99d0e354d769c46513da8b7f4828a7c6043194dc601a895939c7e96ffc2396c3ef1ace16b56430361e1

Download Submit
C:\Windows\System\NCQtKqi.exe

Filesize
2.9MB

MD5
7355eb87b415bd6d7944c4e466202af3

SHA1
158cf6a7bf7075bc27c53d11a693b79373bb7b95

SHA256
04717658239aa93605874e8ec1b76034aabc4be5b4e1b74efc10a10957416e63

SHA512
36931e740471a3ca22e433d8f7abe6ca685921724dfb6d72201a71eb42629581b87116bf4ebdcfa3beffd2cfbc85453bb4526171a1cf69b07989e2a06130cb55

Download Submit
C:\Windows\System\OZlqJfm.exe

Filesize
2.9MB

MD5
926434fdebd4520bdfe5e5f4262f99b0

SHA1
a94a80f347334c3bb677114e5e9257821ba90625

SHA256
2242b86217aa7702e60dab7c00ba1c6b00fc6db28f40aa53893207c12227858c

SHA512
ad5b116b5fe6fbd645ee562ffdb69be8268c2c2e88d56aa9755858fd93816ef797e44bc1dfd8ed9183aaebc74f546a9dc4418cb2ef99c710df7d40b61a25b01b

Download Submit
C:\Windows\System\QsXKkiD.exe

Filesize
2.9MB

MD5
3042bb55cd875968a9f0f7d9a495f15c

SHA1
3f4d2c7d7529e4ec0adf84c0a4cfb6fd60c1af4b

SHA256
c7615f93805ef752a44cfd9098a003d93abf6f21e1b89496134c5015ded1353b

SHA512
801a1046bfa43a8800d18eae545f97a109b1f82ccb4d3f4cb958955fa5a480ea8b318a7dfc381b60c38fa40985b0b8340f299bffa94560a3d7c0ad7195623d25

Download Submit
C:\Windows\System\RDGgMLR.exe

Filesize
2.9MB

MD5
3f608a7658e7b92b252f5fead6294f60

SHA1
b5cca9a0d9c8eefdbe782f560e863c0af690f014

SHA256
9514558148218f372aebb5c87c62553968e1e02d05eb913d092642e36df7b10f

SHA512
b99ea43dc78c50aaa73d3669a48e6ab936663899b2ae2477bf5406966d5867781b348224c735043c22093c89e8f3aeda398d7858d912dcb22c7041355a48fb60

Download Submit
C:\Windows\System\VQVcOSa.exe

Filesize
2.9MB

MD5
f82d2fcb3a5bd503f01e5cd70ec4d2b7

SHA1
ed7c5aa37fdec1a5eef186d14c4ff2ba8735bd8b

SHA256
8462af63c04bce87c6641282a99082d68e63646b77bfc01c139ff64a4298cbd2

SHA512
5527502a6f9373b1d4b39da8a5389d279fce026ed10487d5f7e39051aa7eb3509aa1f8583cfcd6cbcfd2d339fa02c6786ef4a16c6a546e3efc410e8d4ca5d75f

Download Submit
C:\Windows\System\VquxFRr.exe

Filesize
2.9MB

MD5
51f05fb01086573b6b4de46146eb2241

SHA1
22a457430a3fed43b3e7abf95f841d908fc0b40f

SHA256
105ecbe1c71c48dd142482488f3ef58aeb033dc56eecb2ed68d86ef0868abaa4

SHA512
20b51c4cc9d9e1e33e413480fd373bde0449b57a15c3f8214eacfedf6febf1eb3b8e01e8f86b3637be3b7ed6a50f0036d0f41e82d205e34d2d2b104b2a2b3e37

Download Submit
C:\Windows\System\XOOtmdP.exe

Filesize
2.9MB

MD5
1a89a3585f767579a74ad1ab12a4558a

SHA1
ed3e8fc9687ecbbfc4a3b7b8f045f3c6e4489b51

SHA256
e99caeb578cb4340220022b8f37adbc8b43e89096e980e95e815afb1f5ac42ed

SHA512
253bad76674efdb01820ac75d606c79db6a2a33aba5f4b63b6c929a1a23423ebb9af7442eb05ebd13f217fe2d70db16975b6a3e269a4ec3cd378180e1b0b2162

Download Submit
C:\Windows\System\YsGsDwg.exe

Filesize
2.9MB

MD5
855fdbb31ba96d9fc56af1c082cf7d5e

SHA1
712807400496bb01382312c6c99c4b77916cf94d

SHA256
c77f5ac853e4666a90df18ddacf7f48b2f3f92869ead29dd5429ff32bd9dde69

SHA512
1a9b3d35990e66dde282ce5de5c2726f11b5011de58100cda2bc0ebcff33956022c5aa6b583e82f1f782289e950cd812e5877a8414a9b493e075cebcb30c9d87

Download Submit
C:\Windows\System\aspRmox.exe

Filesize
2.9MB

MD5
43d3c42502b35871abb8850580ac44f0

SHA1
060fcfd98a82dcf584e8ba8a58314cc16bed5c30

SHA256
607590cff890a18e47bf32965ec73c8e64046481d0ea9191a595be88a7b37886

SHA512
7ec891ea6b223e51f0c182c1e4bf9826dbcfe1317022b234bf2f19844266d2bfb2a443d6f272fd53c5f0712816ad17a2c50a073da0140066819d16dbc7188883

Download Submit
C:\Windows\System\awCalXE.exe

Filesize
2.9MB

MD5
362bcb6591c69486d80ccbe2424cb7f9

SHA1
148245effc7fad5525993c74daa85f9a7f04a812

SHA256
e0fc5dc5041d9b428abb197e28f27be9cdf23230b37c76dcf39391a38b80548f

SHA512
b8dc8b2a5eb4352f9693709d1837a23ed00d0117720d09da92702d01567021ced5dc1873013a9a2754e769ecfae51b46f581cc8a2694e6fabc79a81072fc6949

Download Submit
C:\Windows\System\cKJFpfE.exe

Filesize
2.9MB

MD5
e4532304d579e4c765da58bf47e5d92c

SHA1
28b726e3d51eaf9ddcac3bbab4aa35b072ccac37

SHA256
d546e71d90fd28d4bec8933a450e3debc8d34dea09b893b99adef9fc1b196c4c

SHA512
a3ca2ed615fcd42b91ffb0580d700a82bebe70b77465b15d667ef6f37ad4d18c3e2436b77b7c57bdb504f00f6cf210b5a20ef6401e4537ccf6fc93309d146adc

Download Submit
C:\Windows\System\hlSPZFP.exe

Filesize
2.9MB

MD5
40f5ae86e8e4c4ddfc59e603f1a2708d

SHA1
fbabf937ef9cf9d8848ef512f34f153be713f255

SHA256
2a62db38775f9c72c43f010dbb600d74d0c956bad31826c0237a5eea98cc01a1

SHA512
c5b8994272776dc686daded2b8a5f0858dd82f4c229b524b1811654c27b41499774023c347ab197b057642e3699218c37c9ffac18f50c1a1bd8b382db61e5bc2

Download Submit
C:\Windows\System\htMErQm.exe

Filesize
2.9MB

MD5
1c828384cbeb754e089dac0e684d2088

SHA1
840a940882d4586ae8eff031546a2cca6ff779ab

SHA256
376841f769788bd409550fe837534e377cee8e7809c82c6d0a65a23e998be6eb

SHA512
14d654f0179a018795ef9f19ce0fd82e4a0b230362265f8ebebc15470ef62b8718183a8563a7f106f491a7fbcf1caee494c5b2676ec47473378143f136308b25

Download Submit
C:\Windows\System\jXaDjHD.exe

Filesize
2.9MB

MD5
5a644589ba8191e66035358de6783c49

SHA1
790607bb9c64e6857bec00e5666d6dae95c3e00a

SHA256
5fa1edd3e881418013f908d448ca004c96ebab0b15b65d360a734a62c4bb7f57

SHA512
42efd6773ef03cd7e2082886aaa411c46593dec1b40d948df664dc9905b6651bc1f42c67ac0c5d869d2b85ec7e4e802dbc412b374cf798173612aa72ae69045f

Download Submit
C:\Windows\System\jZXQKzt.exe

Filesize
2.9MB

MD5
2edc3a7f8af76f50dd5bd93f7d317629

SHA1
4e6b7de6fd8579398a202c41b5a46938d84d5520

SHA256
cdbead46f6ca0004b2898018663a993dbfb1466cb40f898da1bdbd7646ae2772

SHA512
1a7d16b79a9752b6e5e7876bf972d4ce60b3e7d13984bff8ff1aa6e090d63015b86cc137535b98aeb0381e8457f938253025ef2466dd95a9d0c1db9319d24a33

Download Submit
C:\Windows\System\nbpoluM.exe

Filesize
2.9MB

MD5
310f52144b54e2a1d7818196a9661ba6

SHA1
f52da31d3ccc2653289ae265eb6dc6f14cd5c6ff

SHA256
dc5a7a2786115f969d5ab97e50301d00f83e21ba9fdbb3eb19f67f21f2d42aa0

SHA512
43826f8cd546996ff07be5a15cd135f7fdaf2381de6c169523c9e530fa563f6f2d63e016da33dd50d0eb73b76606996dfef739194b54a127e39ee10f0ef6744f

Download Submit
C:\Windows\System\ooyyyUG.exe

Filesize
2.9MB

MD5
3f2d6b47d6c8d520293db1e34340d5ad

SHA1
0d595195f1e641ec00d94a6340f6fdc7e0dadc04

SHA256
a68d39baaf6618d1aff7fa8f4ef91282d7141bb81933d22961fc66415163c073

SHA512
1a37f87017c858ae39fd40a1f0505db4f65710a89842b7116e737f0d9a7feeea4d354a4afa0a0e2d2ef5c3c9a30d8d21381d8cbe7ce1f029747ce7552dc79eaf

Download Submit
C:\Windows\System\ouThsWI.exe

Filesize
2.9MB

MD5
e1e2ec0f7bacf6e3760eb491367f9674

SHA1
ced6e9164043162200c14119589c3680c35fc923

SHA256
a63c92b0f50ad02fc87aa85a0de53a6a425dba71cd8f3d8ac967093fc9160654

SHA512
fdd713b1b7ca19a735db99579f47b56bb77f44fa8851091b066ada3f915ba0a67d057c050cac0f435a40e9c7af74634f813e6f0a75c6009321746c147513c9df

Download Submit
C:\Windows\System\poChzlo.exe

Filesize
2.9MB

MD5
475a5fa6a23435713e05cc2c92888307

SHA1
f291f1a93fcdbf7d399692ddca5505257629459b

SHA256
042a26614edaee48f8990b6c78085d21645a986b741d759e7e0d5cd1c000c004

SHA512
dd9dc219d3228ec5a6e229100c920695efa62af923baab60ef86915f4e439c14e6b15bbf1a5e685b22c9ec86bd820243a76a9832fac4d51ddcc2ddef53bf497f

Download Submit
C:\Windows\System\rfbCHKE.exe

Filesize
2.9MB

MD5
1b6e0c3d1d00226f1eaa3e779071a028

SHA1
1aa4cc098a7222a606349e868495c8b2a9e2bf5f

SHA256
e57ec26f6b0875ccd76305c4a12a043953300414a8bf9af3a9e386bb77b97d86

SHA512
8514e096982b5e8c774d15574e78f3e95d81f525c44929f256c4c1b22da1941ae9c7e0668888c7822e3260d59fa14d4fb92fdf8935ecfff1004c201411e1a107

Download Submit
C:\Windows\System\tJzQdPH.exe

Filesize
2.9MB

MD5
e02acb1bada401c5dab3371178d7020b

SHA1
544590c464d9f81373d2b188e9910f3063c67cba

SHA256
47410463b1e3a5f1057b3990f03e49d9a42c23eca68b69e05bedb604b8fac393

SHA512
97b2d8b811eb6859d53ff965d1afec755b4e40b31b8fd8bc91a341b1e98736116dd1bb1f7afc4891386a362016fb4a7fb853df22395c58ccec84bcec6faa96c0

Download Submit
C:\Windows\System\wgpugGs.exe

Filesize
2.9MB

MD5
067effb71e051542d72e3b0cc50a2bc1

SHA1
3a5aef1e402f5527c752dd84c74aacd878ebd965

SHA256
5f5c05479f6155ba914bef00ecfb843aa4b63c07e867d82d1caf901a5daf2bcd

SHA512
cd4f19a911487cd99f80d9bc70b6a210068a029b5ea954ce6e59536aa3d3f6eae4b54eac0465c4613c5eba7088069fc90503ce04b2584f6da20bdb1df26de0e9

Download Submit
C:\Windows\System\woBDwsi.exe

Filesize
2.9MB

MD5
b0a95b67e14ed09587aa0474ae296878

SHA1
4699db50d25f7781c986f086e36c5e6c4da8c879

SHA256
32229bdf880a51d5e98fc6f5fc6efc47839ce0671e24dae84c49a0463c177fa5

SHA512
6768664b71247275b32d28e07da7276276bbf6949920c665b13d51b0dd53e85097b5e266340b1b794b67b978a1daa40159c85cb5ffc9a34fca119aadb3fcebfd

Download Submit
C:\Windows\System\yvqjFEJ.exe

Filesize
2.9MB

MD5
e394e7447c1d5ed29f1fcf081830af58

SHA1
200e5771e046c8fc0c6c17f808358e203da8e23c

SHA256
fbfb9d2712c7d2f98c7865daf0cd8b8c4cd005c990dbc684a5faceeecc87382e

SHA512
ab72fc0551db631239c238e5ab25b91994ddebb071bf59192436b8d31ca70582c8d7d8734d3d5f2ee0aa04fa89520d59d3b77aa1ac8123de4c9d0a8356980cc1

Download Submit
C:\Windows\System\zfHZMRF.exe

Filesize
2.9MB

MD5
326907b83fe15b52eeea4d7ff2c7918e

SHA1
69f5fbd3fe14ddc73fd6c7a0a84beff485cbf557

SHA256
af366ad169c68fba91aa585a4b132f4310c58675018e26e162fa54fc20ac07f7

SHA512
5b718fa9bebbd33212a3192a09790f81f636b7f1e99e64d3ace2405701359e24c74795eb27546e41a186acbfac706e6a8eca1d368527cbfbd4cc50ab2cd45918

Download Submit
memory/64-823-0x00007FF75AE50000-0x00007FF75B242000-memory.dmp

Filesize
3.9MB

Download
memory/64-2080-0x00007FF75AE50000-0x00007FF75B242000-memory.dmp

Filesize
3.9MB

Download
memory/412-2050-0x00007FF7DB1C0000-0x00007FF7DB5B2000-memory.dmp

Filesize
3.9MB

Download
memory/412-2066-0x00007FF7DB1C0000-0x00007FF7DB5B2000-memory.dmp

Filesize
3.9MB

Download
memory/412-43-0x00007FF7DB1C0000-0x00007FF7DB5B2000-memory.dmp

Filesize
3.9MB

Download
memory/648-808-0x00007FF728EF0000-0x00007FF7292E2000-memory.dmp

Filesize
3.9MB

Download
memory/648-2078-0x00007FF728EF0000-0x00007FF7292E2000-memory.dmp

Filesize
3.9MB

Download
memory/1564-834-0x00007FF781990000-0x00007FF781D82000-memory.dmp

Filesize
3.9MB

Download
memory/1564-2103-0x00007FF781990000-0x00007FF781D82000-memory.dmp

Filesize
3.9MB

Download
memory/1612-809-0x00007FF7CB190000-0x00007FF7CB582000-memory.dmp

Filesize
3.9MB

Download
memory/1612-2074-0x00007FF7CB190000-0x00007FF7CB582000-memory.dmp

Filesize
3.9MB

Download
memory/1624-2073-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp

Filesize
3.9MB

Download
memory/1624-815-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp

Filesize
3.9MB

Download
memory/1724-455-0x0000020FFDDC0000-0x0000020FFE566000-memory.dmp

Filesize
7.6MB

Download
memory/1724-114-0x0000020FFB100000-0x0000020FFB122000-memory.dmp

Filesize
136KB

Download
memory/1744-2058-0x00007FF6C4810000-0x00007FF6C4C02000-memory.dmp

Filesize
3.9MB

Download
memory/1744-30-0x00007FF6C4810000-0x00007FF6C4C02000-memory.dmp

Filesize
3.9MB

Download
memory/1956-806-0x00007FF6B2540000-0x00007FF6B2932000-memory.dmp

Filesize
3.9MB

Download
memory/1956-2084-0x00007FF6B2540000-0x00007FF6B2932000-memory.dmp

Filesize
3.9MB

Download
memory/1992-1-0x0000027AB83F0000-0x0000027AB8400000-memory.dmp

Filesize
64KB

Download
memory/1992-0-0x00007FF6A77A0000-0x00007FF6A7B92000-memory.dmp

Filesize
3.9MB

Download
memory/1992-1290-0x00007FF6A77A0000-0x00007FF6A7B92000-memory.dmp

Filesize
3.9MB

Download
memory/2280-2118-0x00007FF60A2D0000-0x00007FF60A6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2280-844-0x00007FF60A2D0000-0x00007FF60A6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-820-0x00007FF6A81C0000-0x00007FF6A85B2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-2071-0x00007FF6A81C0000-0x00007FF6A85B2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-2086-0x00007FF6EC2C0000-0x00007FF6EC6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-824-0x00007FF6EC2C0000-0x00007FF6EC6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-2090-0x00007FF657810000-0x00007FF657C02000-memory.dmp

Filesize
3.9MB

Download
memory/2500-827-0x00007FF657810000-0x00007FF657C02000-memory.dmp

Filesize
3.9MB

Download
memory/2564-1304-0x00007FF73EBA0000-0x00007FF73EF92000-memory.dmp

Filesize
3.9MB

Download
memory/2564-11-0x00007FF73EBA0000-0x00007FF73EF92000-memory.dmp

Filesize
3.9MB

Download
memory/2564-2056-0x00007FF73EBA0000-0x00007FF73EF92000-memory.dmp

Filesize
3.9MB

Download
memory/3036-2049-0x00007FF771220000-0x00007FF771612000-memory.dmp

Filesize
3.9MB

Download
memory/3036-2062-0x00007FF771220000-0x00007FF771612000-memory.dmp

Filesize
3.9MB

Download
memory/3036-38-0x00007FF771220000-0x00007FF771612000-memory.dmp

Filesize
3.9MB

Download
memory/3104-2083-0x00007FF7DF1A0000-0x00007FF7DF592000-memory.dmp

Filesize
3.9MB

Download
memory/3104-54-0x00007FF7DF1A0000-0x00007FF7DF592000-memory.dmp

Filesize
3.9MB

Download
memory/3516-851-0x00007FF6F8310000-0x00007FF6F8702000-memory.dmp

Filesize
3.9MB

Download
memory/3516-2121-0x00007FF6F8310000-0x00007FF6F8702000-memory.dmp

Filesize
3.9MB

Download
memory/3720-31-0x00007FF774900000-0x00007FF774CF2000-memory.dmp

Filesize
3.9MB

Download
memory/3720-2048-0x00007FF774900000-0x00007FF774CF2000-memory.dmp

Filesize
3.9MB

Download
memory/3720-2064-0x00007FF774900000-0x00007FF774CF2000-memory.dmp

Filesize
3.9MB

Download
memory/3924-831-0x00007FF6B2B70000-0x00007FF6B2F62000-memory.dmp

Filesize
3.9MB

Download
memory/3924-2089-0x00007FF6B2B70000-0x00007FF6B2F62000-memory.dmp

Filesize
3.9MB

Download
memory/4032-2055-0x00007FF61D7D0000-0x00007FF61DBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4032-25-0x00007FF61D7D0000-0x00007FF61DBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4456-44-0x00007FF7CE010000-0x00007FF7CE402000-memory.dmp

Filesize
3.9MB

Download
memory/4456-2061-0x00007FF7CE010000-0x00007FF7CE402000-memory.dmp

Filesize
3.9MB

Download
memory/4636-822-0x00007FF743120000-0x00007FF743512000-memory.dmp

Filesize
3.9MB

Download
memory/4636-2069-0x00007FF743120000-0x00007FF743512000-memory.dmp

Filesize
3.9MB

Download
memory/4676-2077-0x00007FF64AA90000-0x00007FF64AE82000-memory.dmp

Filesize
3.9MB

Download
memory/4676-814-0x00007FF64AA90000-0x00007FF64AE82000-memory.dmp

Filesize
3.9MB

Download
memory/4680-2122-0x00007FF739DB0000-0x00007FF73A1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-850-0x00007FF739DB0000-0x00007FF73A1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4708-2052-0x00007FF748A30000-0x00007FF748E22000-memory.dmp

Filesize
3.9MB

Download
memory/4708-1677-0x00007FF748A30000-0x00007FF748E22000-memory.dmp

Filesize
3.9MB

Download
memory/4708-15-0x00007FF748A30000-0x00007FF748E22000-memory.dmp

Filesize
3.9MB

Download