xmrig | 5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa

Analysis

max time kernel
133s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
Size

3.0MB
MD5

2715459f4b5af528947524c7e2fc967c
SHA1

080b3ebe0db38b384fd0ef36a70e6910e305c420
SHA256

5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa
SHA512

55a66d61a435f512b915936a4b6f6c1b95b676b11e7275224e60d80e6db8ec4185ec8ad433e6b1b6e3e5254c466fe24a60c46f8a1d024dea6ddcde1d6a5cee3e
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWF:7bBeSFkB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4500-0-0x00007FF762280000-0x00007FF762676000-memory.dmp	xmrig
behavioral2/files/0x00080000000234f1-5.dat	xmrig
behavioral2/files/0x00070000000234f8-9.dat	xmrig
behavioral2/memory/2872-17-0x00007FF7087F0000-0x00007FF708BE6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234fa-25.dat	xmrig
behavioral2/files/0x00070000000234fb-35.dat	xmrig
behavioral2/memory/2568-31-0x00007FF736790000-0x00007FF736B86000-memory.dmp	xmrig
behavioral2/files/0x00070000000234f9-28.dat	xmrig
behavioral2/memory/1968-26-0x00007FF6B7870000-0x00007FF6B7C66000-memory.dmp	xmrig
behavioral2/memory/4988-22-0x00007FF65F4E0000-0x00007FF65F8D6000-memory.dmp	xmrig
behavioral2/files/0x00080000000234f7-20.dat	xmrig
behavioral2/memory/64-14-0x00007FF6DC2B0000-0x00007FF6DC6A6000-memory.dmp	xmrig
behavioral2/memory/2944-49-0x00007FF70DD10000-0x00007FF70E106000-memory.dmp	xmrig
behavioral2/files/0x00070000000234fc-52.dat	xmrig
behavioral2/memory/372-57-0x00007FF6D7BA0000-0x00007FF6D7F96000-memory.dmp	xmrig
behavioral2/files/0x00080000000234f5-59.dat	xmrig
behavioral2/files/0x00080000000234fe-68.dat	xmrig
behavioral2/files/0x00080000000234fd-71.dat	xmrig
behavioral2/memory/1820-73-0x00007FF6AA300000-0x00007FF6AA6F6000-memory.dmp	xmrig
behavioral2/memory/2292-77-0x00007FF761ED0000-0x00007FF7622C6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234ff-79.dat	xmrig
behavioral2/memory/2212-78-0x00007FF678C50000-0x00007FF679046000-memory.dmp	xmrig
behavioral2/memory/208-64-0x00007FF612570000-0x00007FF612966000-memory.dmp	xmrig
behavioral2/files/0x0007000000023502-92.dat	xmrig
behavioral2/memory/4988-100-0x00007FF65F4E0000-0x00007FF65F8D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023505-110.dat	xmrig
behavioral2/files/0x0007000000023504-115.dat	xmrig
behavioral2/memory/1916-117-0x00007FF748EB0000-0x00007FF7492A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023506-120.dat	xmrig
behavioral2/files/0x0007000000023508-130.dat	xmrig
behavioral2/memory/4212-132-0x00007FF7A4830000-0x00007FF7A4C26000-memory.dmp	xmrig
behavioral2/memory/4208-134-0x00007FF718B40000-0x00007FF718F36000-memory.dmp	xmrig
behavioral2/files/0x0007000000023507-135.dat	xmrig
behavioral2/memory/1692-133-0x00007FF705F00000-0x00007FF7062F6000-memory.dmp	xmrig
behavioral2/memory/408-131-0x00007FF6640F0000-0x00007FF6644E6000-memory.dmp	xmrig
behavioral2/memory/1968-127-0x00007FF6B7870000-0x00007FF6B7C66000-memory.dmp	xmrig
behavioral2/memory/4800-123-0x00007FF797200000-0x00007FF7975F6000-memory.dmp	xmrig
behavioral2/memory/892-118-0x00007FF6BC780000-0x00007FF6BCB76000-memory.dmp	xmrig
behavioral2/files/0x0007000000023503-113.dat	xmrig
behavioral2/memory/4336-107-0x00007FF733E60000-0x00007FF734256000-memory.dmp	xmrig
behavioral2/files/0x0007000000023501-101.dat	xmrig
behavioral2/memory/2872-97-0x00007FF7087F0000-0x00007FF708BE6000-memory.dmp	xmrig
behavioral2/memory/788-96-0x00007FF618C80000-0x00007FF619076000-memory.dmp	xmrig
behavioral2/memory/4500-86-0x00007FF762280000-0x00007FF762676000-memory.dmp	xmrig
behavioral2/files/0x0007000000023500-89.dat	xmrig
behavioral2/files/0x0007000000023509-268.dat	xmrig
behavioral2/memory/2568-269-0x00007FF736790000-0x00007FF736B86000-memory.dmp	xmrig
behavioral2/files/0x0007000000023534-301.dat	xmrig
behavioral2/files/0x000700000002353e-310.dat	xmrig
behavioral2/files/0x0007000000023540-321.dat	xmrig
behavioral2/files/0x000700000002353f-329.dat	xmrig
behavioral2/files/0x000700000002353b-325.dat	xmrig
behavioral2/files/0x000700000002353a-320.dat	xmrig
behavioral2/files/0x0007000000023542-352.dat	xmrig
behavioral2/files/0x0007000000023539-315.dat	xmrig
behavioral2/memory/4676-309-0x00007FF7C8A00000-0x00007FF7C8DF6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023536-297.dat	xmrig
behavioral2/memory/4288-294-0x00007FF78BD80000-0x00007FF78C176000-memory.dmp	xmrig
behavioral2/memory/4032-293-0x00007FF64CFC0000-0x00007FF64D3B6000-memory.dmp	xmrig
behavioral2/memory/3100-272-0x00007FF6DCFC0000-0x00007FF6DD3B6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023548-417.dat	xmrig
behavioral2/files/0x0007000000023570-425.dat	xmrig
behavioral2/memory/208-753-0x00007FF612570000-0x00007FF612966000-memory.dmp	xmrig
behavioral2/memory/2212-1025-0x00007FF678C50000-0x00007FF679046000-memory.dmp	xmrig

Blocklisted process makes network request 10 IoCs

flow	pid	Process
3	3024	powershell.exe
5	3024	powershell.exe
10	3024	powershell.exe
11	3024	powershell.exe
13	3024	powershell.exe
14	3024	powershell.exe
16	3024	powershell.exe
21	3024	powershell.exe
23	3024	powershell.exe
26	3024	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3024	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
64	KrDZRoE.exe
4988	cwTaSpK.exe
2872	GSSaCqk.exe
1968	UhJzKjo.exe
2568	imJoEFl.exe
2944	bdbOxcl.exe
372	FOYLpdB.exe
208	ObbNrIm.exe
1820	IdumWCP.exe
2292	BXZrpaf.exe
2212	weltAXq.exe
788	SajfXla.exe
4336	AsruuiQ.exe
1916	pDCBUep.exe
408	iOgPjvi.exe
892	OwhgTTM.exe
4212	XaBaKQE.exe
4800	EiBNVqv.exe
4208	CFhvHsJ.exe
1692	RjGmVQR.exe
3100	BIztaZS.exe
4032	XeYkOBS.exe
4676	Ntllgfk.exe
4288	XhhofSu.exe
228	rgZfXRx.exe
4584	MDYhxcX.exe
2012	fFMVFWy.exe
1532	zlhTeWK.exe
3776	ooQcXJd.exe
4552	bsUzUyS.exe
1660	TOBKqRZ.exe
1244	sBQtlvA.exe
976	LHRtYHv.exe
3632	NDquceg.exe
3444	rWjKMBM.exe
2588	dNujYvE.exe
2144	WnURqWa.exe
2040	iVRwQEB.exe
4940	EctJoor.exe
2952	PprBiTd.exe
4060	klemMsP.exe
4384	MUMaaUQ.exe
1868	bmGEiZJ.exe
2232	SCrqDUV.exe
4648	zdvVFWS.exe
3544	FOkPvSs.exe
2972	UUmgKMe.exe
4516	HkEzkiB.exe
2472	ZuftSsP.exe
4064	BZvoqRq.exe
532	jqGztOS.exe
3536	ETaNQdx.exe
3136	tXRPHhu.exe
2836	iDgxSNB.exe
724	ckUJztJ.exe
5076	MYzbiKO.exe
2748	qKxDbIr.exe
3700	dtxXFxf.exe
2288	xCWvZsD.exe
4604	vntuwOP.exe
4072	GaQCHUu.exe
3044	EjEpxpF.exe
4240	WSxSlWc.exe
3464	DMTBrNt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4500-0-0x00007FF762280000-0x00007FF762676000-memory.dmp	upx
behavioral2/files/0x00080000000234f1-5.dat	upx
behavioral2/files/0x00070000000234f8-9.dat	upx
behavioral2/memory/2872-17-0x00007FF7087F0000-0x00007FF708BE6000-memory.dmp	upx
behavioral2/files/0x00070000000234fa-25.dat	upx
behavioral2/files/0x00070000000234fb-35.dat	upx
behavioral2/memory/2568-31-0x00007FF736790000-0x00007FF736B86000-memory.dmp	upx
behavioral2/files/0x00070000000234f9-28.dat	upx
behavioral2/memory/1968-26-0x00007FF6B7870000-0x00007FF6B7C66000-memory.dmp	upx
behavioral2/memory/4988-22-0x00007FF65F4E0000-0x00007FF65F8D6000-memory.dmp	upx
behavioral2/files/0x00080000000234f7-20.dat	upx
behavioral2/memory/64-14-0x00007FF6DC2B0000-0x00007FF6DC6A6000-memory.dmp	upx
behavioral2/memory/2944-49-0x00007FF70DD10000-0x00007FF70E106000-memory.dmp	upx
behavioral2/files/0x00070000000234fc-52.dat	upx
behavioral2/memory/372-57-0x00007FF6D7BA0000-0x00007FF6D7F96000-memory.dmp	upx
behavioral2/files/0x00080000000234f5-59.dat	upx
behavioral2/files/0x00080000000234fe-68.dat	upx
behavioral2/files/0x00080000000234fd-71.dat	upx
behavioral2/memory/1820-73-0x00007FF6AA300000-0x00007FF6AA6F6000-memory.dmp	upx
behavioral2/memory/2292-77-0x00007FF761ED0000-0x00007FF7622C6000-memory.dmp	upx
behavioral2/files/0x00070000000234ff-79.dat	upx
behavioral2/memory/2212-78-0x00007FF678C50000-0x00007FF679046000-memory.dmp	upx
behavioral2/memory/208-64-0x00007FF612570000-0x00007FF612966000-memory.dmp	upx
behavioral2/files/0x0007000000023502-92.dat	upx
behavioral2/memory/4988-100-0x00007FF65F4E0000-0x00007FF65F8D6000-memory.dmp	upx
behavioral2/files/0x0007000000023505-110.dat	upx
behavioral2/files/0x0007000000023504-115.dat	upx
behavioral2/memory/1916-117-0x00007FF748EB0000-0x00007FF7492A6000-memory.dmp	upx
behavioral2/files/0x0007000000023506-120.dat	upx
behavioral2/files/0x0007000000023508-130.dat	upx
behavioral2/memory/4212-132-0x00007FF7A4830000-0x00007FF7A4C26000-memory.dmp	upx
behavioral2/memory/4208-134-0x00007FF718B40000-0x00007FF718F36000-memory.dmp	upx
behavioral2/files/0x0007000000023507-135.dat	upx
behavioral2/memory/1692-133-0x00007FF705F00000-0x00007FF7062F6000-memory.dmp	upx
behavioral2/memory/408-131-0x00007FF6640F0000-0x00007FF6644E6000-memory.dmp	upx
behavioral2/memory/1968-127-0x00007FF6B7870000-0x00007FF6B7C66000-memory.dmp	upx
behavioral2/memory/4800-123-0x00007FF797200000-0x00007FF7975F6000-memory.dmp	upx
behavioral2/memory/892-118-0x00007FF6BC780000-0x00007FF6BCB76000-memory.dmp	upx
behavioral2/files/0x0007000000023503-113.dat	upx
behavioral2/memory/4336-107-0x00007FF733E60000-0x00007FF734256000-memory.dmp	upx
behavioral2/files/0x0007000000023501-101.dat	upx
behavioral2/memory/2872-97-0x00007FF7087F0000-0x00007FF708BE6000-memory.dmp	upx
behavioral2/memory/788-96-0x00007FF618C80000-0x00007FF619076000-memory.dmp	upx
behavioral2/memory/4500-86-0x00007FF762280000-0x00007FF762676000-memory.dmp	upx
behavioral2/files/0x0007000000023500-89.dat	upx
behavioral2/files/0x0007000000023509-268.dat	upx
behavioral2/memory/2568-269-0x00007FF736790000-0x00007FF736B86000-memory.dmp	upx
behavioral2/files/0x0007000000023534-301.dat	upx
behavioral2/files/0x000700000002353e-310.dat	upx
behavioral2/files/0x0007000000023540-321.dat	upx
behavioral2/files/0x000700000002353f-329.dat	upx
behavioral2/files/0x000700000002353b-325.dat	upx
behavioral2/files/0x000700000002353a-320.dat	upx
behavioral2/files/0x0007000000023542-352.dat	upx
behavioral2/files/0x0007000000023539-315.dat	upx
behavioral2/memory/4676-309-0x00007FF7C8A00000-0x00007FF7C8DF6000-memory.dmp	upx
behavioral2/files/0x0007000000023536-297.dat	upx
behavioral2/memory/4288-294-0x00007FF78BD80000-0x00007FF78C176000-memory.dmp	upx
behavioral2/memory/4032-293-0x00007FF64CFC0000-0x00007FF64D3B6000-memory.dmp	upx
behavioral2/memory/3100-272-0x00007FF6DCFC0000-0x00007FF6DD3B6000-memory.dmp	upx
behavioral2/files/0x0007000000023548-417.dat	upx
behavioral2/files/0x0007000000023570-425.dat	upx
behavioral2/memory/208-753-0x00007FF612570000-0x00007FF612966000-memory.dmp	upx
behavioral2/memory/2212-1025-0x00007FF678C50000-0x00007FF679046000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MlBTedQ.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\koGtnmJ.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\hNhUxta.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\ZcdQckN.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\DTYnewf.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\rzowTuR.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\obsJcHr.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\btPJJdO.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\TgBIcNH.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\RaoSsBd.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\xeLCmcj.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\aypdtaY.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\FoEWNBE.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\BJzOXmg.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\DtmQRxu.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\eUVRFFf.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\dQwqpnE.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\LyPErOw.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\HnXCKSk.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\mBoADWi.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\okpzunO.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\geyavwx.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\XIMbGbv.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\BqQqViP.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\eNJbgKL.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\peIEwbw.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\SalIjEI.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\qPYYSsO.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\YFNnEPj.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\YFqxrvn.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\NjpnJQM.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\osNRSTW.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\jldEwXL.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\wLYwame.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\MbAeDEZ.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\zxmnzgI.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\izkPcLp.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\wtXgWsg.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\ibbBfwD.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\hafKRZG.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\aYOGSLY.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\VydaAsi.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\ETlGseh.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\XzVBctf.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\oMJKxaW.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\MwpixcP.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\yhePZrr.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\rFsoioz.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\lxjKqaH.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\aNtsQcO.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\outGBtd.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\pNPgFba.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\vKPOaiF.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\tdQDYVH.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\UeCTcjl.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\FOYLpdB.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\IMlTRqa.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\iXdJyZL.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\nIMIgyr.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\mrGnVOc.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\DRzZwHD.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\dIXMUXZ.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\ZxwVPrP.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
File created	C:\Windows\System\HGiDnFR.exe	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3024	powershell.exe
3024	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
Token: SeLockMemoryPrivilege	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
Token: SeDebugPrivilege	3024	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3024	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	85
PID 4500 wrote to memory of 3024	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	85
PID 4500 wrote to memory of 64	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	86
PID 4500 wrote to memory of 64	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	86
PID 4500 wrote to memory of 4988	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	87
PID 4500 wrote to memory of 4988	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	87
PID 4500 wrote to memory of 2872	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	88
PID 4500 wrote to memory of 2872	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	88
PID 4500 wrote to memory of 1968	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	89
PID 4500 wrote to memory of 1968	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	89
PID 4500 wrote to memory of 2568	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	90
PID 4500 wrote to memory of 2568	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	90
PID 4500 wrote to memory of 2944	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	91
PID 4500 wrote to memory of 2944	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	91
PID 4500 wrote to memory of 372	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	92
PID 4500 wrote to memory of 372	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	92
PID 4500 wrote to memory of 208	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	93
PID 4500 wrote to memory of 208	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	93
PID 4500 wrote to memory of 1820	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	94
PID 4500 wrote to memory of 1820	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	94
PID 4500 wrote to memory of 2292	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	95
PID 4500 wrote to memory of 2292	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	95
PID 4500 wrote to memory of 2212	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	96
PID 4500 wrote to memory of 2212	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	96
PID 4500 wrote to memory of 788	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	97
PID 4500 wrote to memory of 788	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	97
PID 4500 wrote to memory of 1916	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	98
PID 4500 wrote to memory of 1916	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	98
PID 4500 wrote to memory of 4336	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	99
PID 4500 wrote to memory of 4336	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	99
PID 4500 wrote to memory of 408	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	100
PID 4500 wrote to memory of 408	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	100
PID 4500 wrote to memory of 892	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	101
PID 4500 wrote to memory of 892	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	101
PID 4500 wrote to memory of 4212	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	102
PID 4500 wrote to memory of 4212	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	102
PID 4500 wrote to memory of 4800	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	103
PID 4500 wrote to memory of 4800	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	103
PID 4500 wrote to memory of 4208	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	104
PID 4500 wrote to memory of 4208	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	104
PID 4500 wrote to memory of 1692	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	105
PID 4500 wrote to memory of 1692	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	105
PID 4500 wrote to memory of 3100	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	106
PID 4500 wrote to memory of 3100	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	106
PID 4500 wrote to memory of 4032	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	110
PID 4500 wrote to memory of 4032	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	110
PID 4500 wrote to memory of 4676	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	111
PID 4500 wrote to memory of 4676	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	111
PID 4500 wrote to memory of 4288	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	112
PID 4500 wrote to memory of 4288	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	112
PID 4500 wrote to memory of 228	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	113
PID 4500 wrote to memory of 228	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	113
PID 4500 wrote to memory of 4584	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	114
PID 4500 wrote to memory of 4584	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	114
PID 4500 wrote to memory of 2012	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	115
PID 4500 wrote to memory of 2012	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	115
PID 4500 wrote to memory of 1532	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	116
PID 4500 wrote to memory of 1532	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	116
PID 4500 wrote to memory of 3776	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	117
PID 4500 wrote to memory of 3776	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	117
PID 4500 wrote to memory of 4552	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	118
PID 4500 wrote to memory of 4552	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	118
PID 4500 wrote to memory of 1660	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	119
PID 4500 wrote to memory of 1660	4500	5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe	119

C:\Users\Admin\AppData\Local\Temp\5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe
"C:\Users\Admin\AppData\Local\Temp\5fe07b472ccdf79111076738535846cd89a861ccb8f29d785224f390e5bfcbaa.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\System\KrDZRoE.exe
  C:\Windows\System\KrDZRoE.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\cwTaSpK.exe
  C:\Windows\System\cwTaSpK.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\GSSaCqk.exe
  C:\Windows\System\GSSaCqk.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\UhJzKjo.exe
  C:\Windows\System\UhJzKjo.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\imJoEFl.exe
  C:\Windows\System\imJoEFl.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\bdbOxcl.exe
  C:\Windows\System\bdbOxcl.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\FOYLpdB.exe
  C:\Windows\System\FOYLpdB.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\ObbNrIm.exe
  C:\Windows\System\ObbNrIm.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\IdumWCP.exe
  C:\Windows\System\IdumWCP.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\BXZrpaf.exe
  C:\Windows\System\BXZrpaf.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\weltAXq.exe
  C:\Windows\System\weltAXq.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\SajfXla.exe
  C:\Windows\System\SajfXla.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\pDCBUep.exe
  C:\Windows\System\pDCBUep.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\AsruuiQ.exe
  C:\Windows\System\AsruuiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\iOgPjvi.exe
  C:\Windows\System\iOgPjvi.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\OwhgTTM.exe
  C:\Windows\System\OwhgTTM.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\XaBaKQE.exe
  C:\Windows\System\XaBaKQE.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\EiBNVqv.exe
  C:\Windows\System\EiBNVqv.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\CFhvHsJ.exe
  C:\Windows\System\CFhvHsJ.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\RjGmVQR.exe
  C:\Windows\System\RjGmVQR.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\BIztaZS.exe
  C:\Windows\System\BIztaZS.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\XeYkOBS.exe
  C:\Windows\System\XeYkOBS.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\Ntllgfk.exe
  C:\Windows\System\Ntllgfk.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\XhhofSu.exe
  C:\Windows\System\XhhofSu.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\rgZfXRx.exe
  C:\Windows\System\rgZfXRx.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\MDYhxcX.exe
  C:\Windows\System\MDYhxcX.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\fFMVFWy.exe
  C:\Windows\System\fFMVFWy.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\zlhTeWK.exe
  C:\Windows\System\zlhTeWK.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\ooQcXJd.exe
  C:\Windows\System\ooQcXJd.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\bsUzUyS.exe
  C:\Windows\System\bsUzUyS.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\TOBKqRZ.exe
  C:\Windows\System\TOBKqRZ.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\LHRtYHv.exe
  C:\Windows\System\LHRtYHv.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\sBQtlvA.exe
  C:\Windows\System\sBQtlvA.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\NDquceg.exe
  C:\Windows\System\NDquceg.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\rWjKMBM.exe
  C:\Windows\System\rWjKMBM.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\dNujYvE.exe
  C:\Windows\System\dNujYvE.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\WnURqWa.exe
  C:\Windows\System\WnURqWa.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\iVRwQEB.exe
  C:\Windows\System\iVRwQEB.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\EctJoor.exe
  C:\Windows\System\EctJoor.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\PprBiTd.exe
  C:\Windows\System\PprBiTd.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\klemMsP.exe
  C:\Windows\System\klemMsP.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\MUMaaUQ.exe
  C:\Windows\System\MUMaaUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\bmGEiZJ.exe
  C:\Windows\System\bmGEiZJ.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\SCrqDUV.exe
  C:\Windows\System\SCrqDUV.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\zdvVFWS.exe
  C:\Windows\System\zdvVFWS.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\FOkPvSs.exe
  C:\Windows\System\FOkPvSs.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\UUmgKMe.exe
  C:\Windows\System\UUmgKMe.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\HkEzkiB.exe
  C:\Windows\System\HkEzkiB.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\ZuftSsP.exe
  C:\Windows\System\ZuftSsP.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\BZvoqRq.exe
  C:\Windows\System\BZvoqRq.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\jqGztOS.exe
  C:\Windows\System\jqGztOS.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\ETaNQdx.exe
  C:\Windows\System\ETaNQdx.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\tXRPHhu.exe
  C:\Windows\System\tXRPHhu.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\iDgxSNB.exe
  C:\Windows\System\iDgxSNB.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\ckUJztJ.exe
  C:\Windows\System\ckUJztJ.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\MYzbiKO.exe
  C:\Windows\System\MYzbiKO.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\qKxDbIr.exe
  C:\Windows\System\qKxDbIr.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\dtxXFxf.exe
  C:\Windows\System\dtxXFxf.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\xCWvZsD.exe
  C:\Windows\System\xCWvZsD.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\vntuwOP.exe
  C:\Windows\System\vntuwOP.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\GaQCHUu.exe
  C:\Windows\System\GaQCHUu.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\EjEpxpF.exe
  C:\Windows\System\EjEpxpF.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\WSxSlWc.exe
  C:\Windows\System\WSxSlWc.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\DMTBrNt.exe
  C:\Windows\System\DMTBrNt.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\MQMQecP.exe
  C:\Windows\System\MQMQecP.exe
  2⤵
  PID:4348
- C:\Windows\System\TEoZyJw.exe
  C:\Windows\System\TEoZyJw.exe
  2⤵
  PID:4920
- C:\Windows\System\cbzpKea.exe
  C:\Windows\System\cbzpKea.exe
  2⤵
  PID:3064
- C:\Windows\System\JCIAfMv.exe
  C:\Windows\System\JCIAfMv.exe
  2⤵
  PID:60
- C:\Windows\System\vRwzPAC.exe
  C:\Windows\System\vRwzPAC.exe
  2⤵
  PID:780
- C:\Windows\System\udooZVc.exe
  C:\Windows\System\udooZVc.exe
  2⤵
  PID:4836
- C:\Windows\System\zDldnRD.exe
  C:\Windows\System\zDldnRD.exe
  2⤵
  PID:1344
- C:\Windows\System\zPPyzFX.exe
  C:\Windows\System\zPPyzFX.exe
  2⤵
  PID:1912
- C:\Windows\System\nWUjgJs.exe
  C:\Windows\System\nWUjgJs.exe
  2⤵
  PID:3496
- C:\Windows\System\JtUMQSP.exe
  C:\Windows\System\JtUMQSP.exe
  2⤵
  PID:3844
- C:\Windows\System\eCoULsD.exe
  C:\Windows\System\eCoULsD.exe
  2⤵
  PID:3732
- C:\Windows\System\EpCkcVf.exe
  C:\Windows\System\EpCkcVf.exe
  2⤵
  PID:3392
- C:\Windows\System\xwiQpVE.exe
  C:\Windows\System\xwiQpVE.exe
  2⤵
  PID:2740
- C:\Windows\System\UHXOtJs.exe
  C:\Windows\System\UHXOtJs.exe
  2⤵
  PID:1204
- C:\Windows\System\DpzuYzf.exe
  C:\Windows\System\DpzuYzf.exe
  2⤵
  PID:1452
- C:\Windows\System\dCQbBoO.exe
  C:\Windows\System\dCQbBoO.exe
  2⤵
  PID:2648
- C:\Windows\System\Qtsshff.exe
  C:\Windows\System\Qtsshff.exe
  2⤵
  PID:5132
- C:\Windows\System\RcyXAwL.exe
  C:\Windows\System\RcyXAwL.exe
  2⤵
  PID:5148
- C:\Windows\System\EOUMpBs.exe
  C:\Windows\System\EOUMpBs.exe
  2⤵
  PID:5184
- C:\Windows\System\gBIhNVm.exe
  C:\Windows\System\gBIhNVm.exe
  2⤵
  PID:5216
- C:\Windows\System\rVaYIBl.exe
  C:\Windows\System\rVaYIBl.exe
  2⤵
  PID:5248
- C:\Windows\System\hHrWsNB.exe
  C:\Windows\System\hHrWsNB.exe
  2⤵
  PID:5272
- C:\Windows\System\HZwkBaG.exe
  C:\Windows\System\HZwkBaG.exe
  2⤵
  PID:5288
- C:\Windows\System\lklRYFD.exe
  C:\Windows\System\lklRYFD.exe
  2⤵
  PID:5340
- C:\Windows\System\qYpMXHL.exe
  C:\Windows\System\qYpMXHL.exe
  2⤵
  PID:5368
- C:\Windows\System\roAYGoT.exe
  C:\Windows\System\roAYGoT.exe
  2⤵
  PID:5384
- C:\Windows\System\spnpyoO.exe
  C:\Windows\System\spnpyoO.exe
  2⤵
  PID:5404
- C:\Windows\System\unyxRxg.exe
  C:\Windows\System\unyxRxg.exe
  2⤵
  PID:5432
- C:\Windows\System\PcEaBkW.exe
  C:\Windows\System\PcEaBkW.exe
  2⤵
  PID:5456
- C:\Windows\System\zyHECkf.exe
  C:\Windows\System\zyHECkf.exe
  2⤵
  PID:5492
- C:\Windows\System\octYNka.exe
  C:\Windows\System\octYNka.exe
  2⤵
  PID:5528
- C:\Windows\System\uawgdFL.exe
  C:\Windows\System\uawgdFL.exe
  2⤵
  PID:5564
- C:\Windows\System\uUeprfp.exe
  C:\Windows\System\uUeprfp.exe
  2⤵
  PID:5592
- C:\Windows\System\OqdSSKN.exe
  C:\Windows\System\OqdSSKN.exe
  2⤵
  PID:5616
- C:\Windows\System\aiOziIe.exe
  C:\Windows\System\aiOziIe.exe
  2⤵
  PID:5640
- C:\Windows\System\flSsSCp.exe
  C:\Windows\System\flSsSCp.exe
  2⤵
  PID:5664
- C:\Windows\System\HHPMWfQ.exe
  C:\Windows\System\HHPMWfQ.exe
  2⤵
  PID:5696
- C:\Windows\System\OCPbKMX.exe
  C:\Windows\System\OCPbKMX.exe
  2⤵
  PID:5724
- C:\Windows\System\MGYqCtE.exe
  C:\Windows\System\MGYqCtE.exe
  2⤵
  PID:5752
- C:\Windows\System\pVdodXG.exe
  C:\Windows\System\pVdodXG.exe
  2⤵
  PID:5788
- C:\Windows\System\uWfWRwQ.exe
  C:\Windows\System\uWfWRwQ.exe
  2⤵
  PID:5804
- C:\Windows\System\gPXPqed.exe
  C:\Windows\System\gPXPqed.exe
  2⤵
  PID:5824
- C:\Windows\System\MIgfisT.exe
  C:\Windows\System\MIgfisT.exe
  2⤵
  PID:5860
- C:\Windows\System\XZhmUSC.exe
  C:\Windows\System\XZhmUSC.exe
  2⤵
  PID:5900
- C:\Windows\System\duBOtWU.exe
  C:\Windows\System\duBOtWU.exe
  2⤵
  PID:5928
- C:\Windows\System\LVAhySk.exe
  C:\Windows\System\LVAhySk.exe
  2⤵
  PID:5948
- C:\Windows\System\ixOEVbd.exe
  C:\Windows\System\ixOEVbd.exe
  2⤵
  PID:5988
- C:\Windows\System\xekXaFt.exe
  C:\Windows\System\xekXaFt.exe
  2⤵
  PID:6012
- C:\Windows\System\XjXkuqR.exe
  C:\Windows\System\XjXkuqR.exe
  2⤵
  PID:6028
- C:\Windows\System\EvGgkUZ.exe
  C:\Windows\System\EvGgkUZ.exe
  2⤵
  PID:6064
- C:\Windows\System\brreyfl.exe
  C:\Windows\System\brreyfl.exe
  2⤵
  PID:6096
- C:\Windows\System\vDxZiFY.exe
  C:\Windows\System\vDxZiFY.exe
  2⤵
  PID:6128
- C:\Windows\System\OlvVGMu.exe
  C:\Windows\System\OlvVGMu.exe
  2⤵
  PID:5144
- C:\Windows\System\RfEohQe.exe
  C:\Windows\System\RfEohQe.exe
  2⤵
  PID:5196
- C:\Windows\System\dtaWcmD.exe
  C:\Windows\System\dtaWcmD.exe
  2⤵
  PID:5300
- C:\Windows\System\stJShWB.exe
  C:\Windows\System\stJShWB.exe
  2⤵
  PID:5352
- C:\Windows\System\AaRbPrF.exe
  C:\Windows\System\AaRbPrF.exe
  2⤵
  PID:5400
- C:\Windows\System\kIpOufc.exe
  C:\Windows\System\kIpOufc.exe
  2⤵
  PID:5452
- C:\Windows\System\ZjlXSzk.exe
  C:\Windows\System\ZjlXSzk.exe
  2⤵
  PID:5516
- C:\Windows\System\UNRmzno.exe
  C:\Windows\System\UNRmzno.exe
  2⤵
  PID:5600
- C:\Windows\System\yiWfbLm.exe
  C:\Windows\System\yiWfbLm.exe
  2⤵
  PID:5656
- C:\Windows\System\LdiUPIq.exe
  C:\Windows\System\LdiUPIq.exe
  2⤵
  PID:5732
- C:\Windows\System\DGictvv.exe
  C:\Windows\System\DGictvv.exe
  2⤵
  PID:5812
- C:\Windows\System\SECHhyG.exe
  C:\Windows\System\SECHhyG.exe
  2⤵
  PID:5856
- C:\Windows\System\PNcECLa.exe
  C:\Windows\System\PNcECLa.exe
  2⤵
  PID:5940
- C:\Windows\System\iWdTWJD.exe
  C:\Windows\System\iWdTWJD.exe
  2⤵
  PID:6004
- C:\Windows\System\ZzgznJf.exe
  C:\Windows\System\ZzgznJf.exe
  2⤵
  PID:6056
- C:\Windows\System\kcFHebC.exe
  C:\Windows\System\kcFHebC.exe
  2⤵
  PID:6120
- C:\Windows\System\HHsuzXe.exe
  C:\Windows\System\HHsuzXe.exe
  2⤵
  PID:5256
- C:\Windows\System\bdfksxs.exe
  C:\Windows\System\bdfksxs.exe
  2⤵
  PID:5392
- C:\Windows\System\KdPMMLE.exe
  C:\Windows\System\KdPMMLE.exe
  2⤵
  PID:5524
- C:\Windows\System\yWULsir.exe
  C:\Windows\System\yWULsir.exe
  2⤵
  PID:5636
- C:\Windows\System\EMvtUWJ.exe
  C:\Windows\System\EMvtUWJ.exe
  2⤵
  PID:5736
- C:\Windows\System\wlultCa.exe
  C:\Windows\System\wlultCa.exe
  2⤵
  PID:5920
- C:\Windows\System\TSWfbSz.exe
  C:\Windows\System\TSWfbSz.exe
  2⤵
  PID:5160
- C:\Windows\System\Xtrmfjr.exe
  C:\Windows\System\Xtrmfjr.exe
  2⤵
  PID:5588
- C:\Windows\System\ZkSazVh.exe
  C:\Windows\System\ZkSazVh.exe
  2⤵
  PID:5892
- C:\Windows\System\lpCgkGk.exe
  C:\Windows\System\lpCgkGk.exe
  2⤵
  PID:5328
- C:\Windows\System\lJAWkGo.exe
  C:\Windows\System\lJAWkGo.exe
  2⤵
  PID:6116
- C:\Windows\System\HOQCkFq.exe
  C:\Windows\System\HOQCkFq.exe
  2⤵
  PID:6156
- C:\Windows\System\SZlkGJb.exe
  C:\Windows\System\SZlkGJb.exe
  2⤵
  PID:6180
- C:\Windows\System\lpLKBfG.exe
  C:\Windows\System\lpLKBfG.exe
  2⤵
  PID:6204
- C:\Windows\System\wPYlQyx.exe
  C:\Windows\System\wPYlQyx.exe
  2⤵
  PID:6232
- C:\Windows\System\nDZBBZj.exe
  C:\Windows\System\nDZBBZj.exe
  2⤵
  PID:6264
- C:\Windows\System\YEtpXKy.exe
  C:\Windows\System\YEtpXKy.exe
  2⤵
  PID:6292
- C:\Windows\System\hSreNUR.exe
  C:\Windows\System\hSreNUR.exe
  2⤵
  PID:6320
- C:\Windows\System\eXNoBYQ.exe
  C:\Windows\System\eXNoBYQ.exe
  2⤵
  PID:6344
- C:\Windows\System\zRlWlmp.exe
  C:\Windows\System\zRlWlmp.exe
  2⤵
  PID:6372
- C:\Windows\System\LxILmMF.exe
  C:\Windows\System\LxILmMF.exe
  2⤵
  PID:6400
- C:\Windows\System\JkwxIkZ.exe
  C:\Windows\System\JkwxIkZ.exe
  2⤵
  PID:6432
- C:\Windows\System\IIjFvqR.exe
  C:\Windows\System\IIjFvqR.exe
  2⤵
  PID:6456
- C:\Windows\System\hGCYzTZ.exe
  C:\Windows\System\hGCYzTZ.exe
  2⤵
  PID:6488
- C:\Windows\System\YnAgLri.exe
  C:\Windows\System\YnAgLri.exe
  2⤵
  PID:6512
- C:\Windows\System\MQJWgpU.exe
  C:\Windows\System\MQJWgpU.exe
  2⤵
  PID:6540
- C:\Windows\System\piETbpP.exe
  C:\Windows\System\piETbpP.exe
  2⤵
  PID:6572
- C:\Windows\System\BPmhTEZ.exe
  C:\Windows\System\BPmhTEZ.exe
  2⤵
  PID:6596
- C:\Windows\System\tUeGRNH.exe
  C:\Windows\System\tUeGRNH.exe
  2⤵
  PID:6632
- C:\Windows\System\SbQKFGT.exe
  C:\Windows\System\SbQKFGT.exe
  2⤵
  PID:6664
- C:\Windows\System\whpLOxy.exe
  C:\Windows\System\whpLOxy.exe
  2⤵
  PID:6692
- C:\Windows\System\OlQITAy.exe
  C:\Windows\System\OlQITAy.exe
  2⤵
  PID:6712
- C:\Windows\System\zuPLGEg.exe
  C:\Windows\System\zuPLGEg.exe
  2⤵
  PID:6756
- C:\Windows\System\bFfoDsU.exe
  C:\Windows\System\bFfoDsU.exe
  2⤵
  PID:6780
- C:\Windows\System\NAxkvFy.exe
  C:\Windows\System\NAxkvFy.exe
  2⤵
  PID:6800
- C:\Windows\System\OCvLJhZ.exe
  C:\Windows\System\OCvLJhZ.exe
  2⤵
  PID:6828
- C:\Windows\System\dIaQBLG.exe
  C:\Windows\System\dIaQBLG.exe
  2⤵
  PID:6860
- C:\Windows\System\uhucfZB.exe
  C:\Windows\System\uhucfZB.exe
  2⤵
  PID:6892
- C:\Windows\System\NoTNigz.exe
  C:\Windows\System\NoTNigz.exe
  2⤵
  PID:6920
- C:\Windows\System\FhJsDRy.exe
  C:\Windows\System\FhJsDRy.exe
  2⤵
  PID:6948
- C:\Windows\System\GBDVtWA.exe
  C:\Windows\System\GBDVtWA.exe
  2⤵
  PID:6972
- C:\Windows\System\mQtuQpg.exe
  C:\Windows\System\mQtuQpg.exe
  2⤵
  PID:6996
- C:\Windows\System\lEQZOYd.exe
  C:\Windows\System\lEQZOYd.exe
  2⤵
  PID:7028
- C:\Windows\System\CsrVJIu.exe
  C:\Windows\System\CsrVJIu.exe
  2⤵
  PID:7052
- C:\Windows\System\ShpANvu.exe
  C:\Windows\System\ShpANvu.exe
  2⤵
  PID:7084
- C:\Windows\System\dTRUXre.exe
  C:\Windows\System\dTRUXre.exe
  2⤵
  PID:7112
- C:\Windows\System\lThEkgZ.exe
  C:\Windows\System\lThEkgZ.exe
  2⤵
  PID:7144
- C:\Windows\System\YTfhOUb.exe
  C:\Windows\System\YTfhOUb.exe
  2⤵
  PID:7164
- C:\Windows\System\vaiiJsk.exe
  C:\Windows\System\vaiiJsk.exe
  2⤵
  PID:6200
- C:\Windows\System\FXhsAyE.exe
  C:\Windows\System\FXhsAyE.exe
  2⤵
  PID:6280
- C:\Windows\System\OOCZDBq.exe
  C:\Windows\System\OOCZDBq.exe
  2⤵
  PID:6336
- C:\Windows\System\HCUtpzD.exe
  C:\Windows\System\HCUtpzD.exe
  2⤵
  PID:6392
- C:\Windows\System\HPSZBlT.exe
  C:\Windows\System\HPSZBlT.exe
  2⤵
  PID:6468
- C:\Windows\System\xJxLgyL.exe
  C:\Windows\System\xJxLgyL.exe
  2⤵
  PID:6532
- C:\Windows\System\tfZmsrI.exe
  C:\Windows\System\tfZmsrI.exe
  2⤵
  PID:6588
- C:\Windows\System\qYAclea.exe
  C:\Windows\System\qYAclea.exe
  2⤵
  PID:6672
- C:\Windows\System\poQaoaJ.exe
  C:\Windows\System\poQaoaJ.exe
  2⤵
  PID:4168
- C:\Windows\System\CTKFIGP.exe
  C:\Windows\System\CTKFIGP.exe
  2⤵
  PID:4476
- C:\Windows\System\xeOBZcS.exe
  C:\Windows\System\xeOBZcS.exe
  2⤵
  PID:5048
- C:\Windows\System\ATRpAsp.exe
  C:\Windows\System\ATRpAsp.exe
  2⤵
  PID:6708
- C:\Windows\System\PwFGBdW.exe
  C:\Windows\System\PwFGBdW.exe
  2⤵
  PID:4576
- C:\Windows\System\fqeVIhp.exe
  C:\Windows\System\fqeVIhp.exe
  2⤵
  PID:6824
- C:\Windows\System\VdBKZSS.exe
  C:\Windows\System\VdBKZSS.exe
  2⤵
  PID:6900
- C:\Windows\System\rPsDFQF.exe
  C:\Windows\System\rPsDFQF.exe
  2⤵
  PID:6956
- C:\Windows\System\TLsFgWz.exe
  C:\Windows\System\TLsFgWz.exe
  2⤵
  PID:7020
- C:\Windows\System\oGUqGsP.exe
  C:\Windows\System\oGUqGsP.exe
  2⤵
  PID:7076
- C:\Windows\System\WAbyNEp.exe
  C:\Windows\System\WAbyNEp.exe
  2⤵
  PID:7152
- C:\Windows\System\pbEPfMt.exe
  C:\Windows\System\pbEPfMt.exe
  2⤵
  PID:6252
- C:\Windows\System\xeiuoyO.exe
  C:\Windows\System\xeiuoyO.exe
  2⤵
  PID:6384
- C:\Windows\System\KMtqKfv.exe
  C:\Windows\System\KMtqKfv.exe
  2⤵
  PID:6564
- C:\Windows\System\bTFFkoE.exe
  C:\Windows\System\bTFFkoE.exe
  2⤵
  PID:4260
- C:\Windows\System\UFeaqUH.exe
  C:\Windows\System\UFeaqUH.exe
  2⤵
  PID:1340
- C:\Windows\System\HreYzpM.exe
  C:\Windows\System\HreYzpM.exe
  2⤵
  PID:6796
- C:\Windows\System\ftGjSOc.exe
  C:\Windows\System\ftGjSOc.exe
  2⤵
  PID:6936
- C:\Windows\System\MRGQbvu.exe
  C:\Windows\System\MRGQbvu.exe
  2⤵
  PID:7072
- C:\Windows\System\gobwLyV.exe
  C:\Windows\System\gobwLyV.exe
  2⤵
  PID:6356
- C:\Windows\System\FBURPpS.exe
  C:\Windows\System\FBURPpS.exe
  2⤵
  PID:6704
- C:\Windows\System\xIsfbfK.exe
  C:\Windows\System\xIsfbfK.exe
  2⤵
  PID:6764
- C:\Windows\System\ganVcfN.exe
  C:\Windows\System\ganVcfN.exe
  2⤵
  PID:7132
- C:\Windows\System\giXuHDk.exe
  C:\Windows\System\giXuHDk.exe
  2⤵
  PID:4928
- C:\Windows\System\gugfYIN.exe
  C:\Windows\System\gugfYIN.exe
  2⤵
  PID:2640
- C:\Windows\System\SEabhlQ.exe
  C:\Windows\System\SEabhlQ.exe
  2⤵
  PID:7188
- C:\Windows\System\WooWIBX.exe
  C:\Windows\System\WooWIBX.exe
  2⤵
  PID:7212
- C:\Windows\System\jAeWArO.exe
  C:\Windows\System\jAeWArO.exe
  2⤵
  PID:7240
- C:\Windows\System\IGcIJrH.exe
  C:\Windows\System\IGcIJrH.exe
  2⤵
  PID:7272
- C:\Windows\System\ynwvydV.exe
  C:\Windows\System\ynwvydV.exe
  2⤵
  PID:7296
- C:\Windows\System\baTgCAu.exe
  C:\Windows\System\baTgCAu.exe
  2⤵
  PID:7324
- C:\Windows\System\mJnYpoa.exe
  C:\Windows\System\mJnYpoa.exe
  2⤵
  PID:7352
- C:\Windows\System\MkZSDub.exe
  C:\Windows\System\MkZSDub.exe
  2⤵
  PID:7380
- C:\Windows\System\KXEtREV.exe
  C:\Windows\System\KXEtREV.exe
  2⤵
  PID:7408
- C:\Windows\System\gUMFPtU.exe
  C:\Windows\System\gUMFPtU.exe
  2⤵
  PID:7440
- C:\Windows\System\PXxjaAt.exe
  C:\Windows\System\PXxjaAt.exe
  2⤵
  PID:7464
- C:\Windows\System\mVRsFCY.exe
  C:\Windows\System\mVRsFCY.exe
  2⤵
  PID:7500
- C:\Windows\System\lzfWqrA.exe
  C:\Windows\System\lzfWqrA.exe
  2⤵
  PID:7520
- C:\Windows\System\mPdPWCg.exe
  C:\Windows\System\mPdPWCg.exe
  2⤵
  PID:7544
- C:\Windows\System\CWYpMZj.exe
  C:\Windows\System\CWYpMZj.exe
  2⤵
  PID:7572
- C:\Windows\System\ioXxsiz.exe
  C:\Windows\System\ioXxsiz.exe
  2⤵
  PID:7604
- C:\Windows\System\hYKCDmB.exe
  C:\Windows\System\hYKCDmB.exe
  2⤵
  PID:7644
- C:\Windows\System\ovNETHz.exe
  C:\Windows\System\ovNETHz.exe
  2⤵
  PID:7668
- C:\Windows\System\DjCxajm.exe
  C:\Windows\System\DjCxajm.exe
  2⤵
  PID:7692
- C:\Windows\System\RmLjQsb.exe
  C:\Windows\System\RmLjQsb.exe
  2⤵
  PID:7720
- C:\Windows\System\YpNYJAH.exe
  C:\Windows\System\YpNYJAH.exe
  2⤵
  PID:7748
- C:\Windows\System\FTKkQFG.exe
  C:\Windows\System\FTKkQFG.exe
  2⤵
  PID:7776
- C:\Windows\System\kNrbVEK.exe
  C:\Windows\System\kNrbVEK.exe
  2⤵
  PID:7808
- C:\Windows\System\uTRJbLW.exe
  C:\Windows\System\uTRJbLW.exe
  2⤵
  PID:7836
- C:\Windows\System\bgpgyqI.exe
  C:\Windows\System\bgpgyqI.exe
  2⤵
  PID:7860
- C:\Windows\System\dScrbZk.exe
  C:\Windows\System\dScrbZk.exe
  2⤵
  PID:7888
- C:\Windows\System\XYjMuMa.exe
  C:\Windows\System\XYjMuMa.exe
  2⤵
  PID:7916
- C:\Windows\System\doFucrs.exe
  C:\Windows\System\doFucrs.exe
  2⤵
  PID:7948
- C:\Windows\System\CmAAgHd.exe
  C:\Windows\System\CmAAgHd.exe
  2⤵
  PID:7976
- C:\Windows\System\yZiuaWg.exe
  C:\Windows\System\yZiuaWg.exe
  2⤵
  PID:8000
- C:\Windows\System\BtCgWJW.exe
  C:\Windows\System\BtCgWJW.exe
  2⤵
  PID:8028
- C:\Windows\System\jtRHuEY.exe
  C:\Windows\System\jtRHuEY.exe
  2⤵
  PID:8056
- C:\Windows\System\bplihjZ.exe
  C:\Windows\System\bplihjZ.exe
  2⤵
  PID:8084
- C:\Windows\System\ZRrOGjU.exe
  C:\Windows\System\ZRrOGjU.exe
  2⤵
  PID:8116
- C:\Windows\System\BtaPHAe.exe
  C:\Windows\System\BtaPHAe.exe
  2⤵
  PID:8140
- C:\Windows\System\bNKtrqd.exe
  C:\Windows\System\bNKtrqd.exe
  2⤵
  PID:8168
- C:\Windows\System\adFxDuY.exe
  C:\Windows\System\adFxDuY.exe
  2⤵
  PID:7180
- C:\Windows\System\rGFaMoW.exe
  C:\Windows\System\rGFaMoW.exe
  2⤵
  PID:7252
- C:\Windows\System\dQEgaQH.exe
  C:\Windows\System\dQEgaQH.exe
  2⤵
  PID:7320
- C:\Windows\System\XYSmHGu.exe
  C:\Windows\System\XYSmHGu.exe
  2⤵
  PID:7392
- C:\Windows\System\vWpLpnV.exe
  C:\Windows\System\vWpLpnV.exe
  2⤵
  PID:7448
- C:\Windows\System\EDnPPXm.exe
  C:\Windows\System\EDnPPXm.exe
  2⤵
  PID:7508
- C:\Windows\System\NdzebWu.exe
  C:\Windows\System\NdzebWu.exe
  2⤵
  PID:7580
- C:\Windows\System\IrZlrxh.exe
  C:\Windows\System\IrZlrxh.exe
  2⤵
  PID:7656
- C:\Windows\System\AOfSvfN.exe
  C:\Windows\System\AOfSvfN.exe
  2⤵
  PID:7712
- C:\Windows\System\gifTkXH.exe
  C:\Windows\System\gifTkXH.exe
  2⤵
  PID:7772
- C:\Windows\System\oXplbEo.exe
  C:\Windows\System\oXplbEo.exe
  2⤵
  PID:7844
- C:\Windows\System\pSELmTb.exe
  C:\Windows\System\pSELmTb.exe
  2⤵
  PID:7900
- C:\Windows\System\bbgNEVT.exe
  C:\Windows\System\bbgNEVT.exe
  2⤵
  PID:7956
- C:\Windows\System\bjGhEzn.exe
  C:\Windows\System\bjGhEzn.exe
  2⤵
  PID:8020
- C:\Windows\System\TOtPXeW.exe
  C:\Windows\System\TOtPXeW.exe
  2⤵
  PID:8080
- C:\Windows\System\EdqInEU.exe
  C:\Windows\System\EdqInEU.exe
  2⤵
  PID:8152
- C:\Windows\System\QhoWJAZ.exe
  C:\Windows\System\QhoWJAZ.exe
  2⤵
  PID:7224
- C:\Windows\System\agoLDDU.exe
  C:\Windows\System\agoLDDU.exe
  2⤵
  PID:7372
- C:\Windows\System\aqzAAko.exe
  C:\Windows\System\aqzAAko.exe
  2⤵
  PID:7556
- C:\Windows\System\JRrpDKB.exe
  C:\Windows\System\JRrpDKB.exe
  2⤵
  PID:7688
- C:\Windows\System\GdxwjYI.exe
  C:\Windows\System\GdxwjYI.exe
  2⤵
  PID:7828
- C:\Windows\System\xnnXtSr.exe
  C:\Windows\System\xnnXtSr.exe
  2⤵
  PID:7984
- C:\Windows\System\UeDXFlW.exe
  C:\Windows\System\UeDXFlW.exe
  2⤵
  PID:8132
- C:\Windows\System\yqlkHsW.exe
  C:\Windows\System\yqlkHsW.exe
  2⤵
  PID:7344
- C:\Windows\System\DmdxGEE.exe
  C:\Windows\System\DmdxGEE.exe
  2⤵
  PID:7740
- C:\Windows\System\jfzceCO.exe
  C:\Windows\System\jfzceCO.exe
  2⤵
  PID:6620
- C:\Windows\System\SiESRjV.exe
  C:\Windows\System\SiESRjV.exe
  2⤵
  PID:6616
- C:\Windows\System\PmzkRHO.exe
  C:\Windows\System\PmzkRHO.exe
  2⤵
  PID:7292
- C:\Windows\System\YEXZQZY.exe
  C:\Windows\System\YEXZQZY.exe
  2⤵
  PID:8212
- C:\Windows\System\bTxlWQK.exe
  C:\Windows\System\bTxlWQK.exe
  2⤵
  PID:8240
- C:\Windows\System\TPSmcUZ.exe
  C:\Windows\System\TPSmcUZ.exe
  2⤵
  PID:8268
- C:\Windows\System\LovGyFi.exe
  C:\Windows\System\LovGyFi.exe
  2⤵
  PID:8296
- C:\Windows\System\eMIIKPD.exe
  C:\Windows\System\eMIIKPD.exe
  2⤵
  PID:8324
- C:\Windows\System\RyLXGjB.exe
  C:\Windows\System\RyLXGjB.exe
  2⤵
  PID:8352
- C:\Windows\System\wFzmeHQ.exe
  C:\Windows\System\wFzmeHQ.exe
  2⤵
  PID:8380
- C:\Windows\System\woVvInb.exe
  C:\Windows\System\woVvInb.exe
  2⤵
  PID:8408
- C:\Windows\System\qOtvsaC.exe
  C:\Windows\System\qOtvsaC.exe
  2⤵
  PID:8436
- C:\Windows\System\TALnYbu.exe
  C:\Windows\System\TALnYbu.exe
  2⤵
  PID:8464
- C:\Windows\System\QqMALlv.exe
  C:\Windows\System\QqMALlv.exe
  2⤵
  PID:8492
- C:\Windows\System\Uymdlye.exe
  C:\Windows\System\Uymdlye.exe
  2⤵
  PID:8520
- C:\Windows\System\cyryjsf.exe
  C:\Windows\System\cyryjsf.exe
  2⤵
  PID:8556
- C:\Windows\System\fvIbMrU.exe
  C:\Windows\System\fvIbMrU.exe
  2⤵
  PID:8576
- C:\Windows\System\kYPMDJN.exe
  C:\Windows\System\kYPMDJN.exe
  2⤵
  PID:8604
- C:\Windows\System\oMYXeZw.exe
  C:\Windows\System\oMYXeZw.exe
  2⤵
  PID:8632
- C:\Windows\System\oISXSyn.exe
  C:\Windows\System\oISXSyn.exe
  2⤵
  PID:8660
- C:\Windows\System\HPaKKIp.exe
  C:\Windows\System\HPaKKIp.exe
  2⤵
  PID:8688
- C:\Windows\System\KCULAux.exe
  C:\Windows\System\KCULAux.exe
  2⤵
  PID:8716
- C:\Windows\System\yRGoDPA.exe
  C:\Windows\System\yRGoDPA.exe
  2⤵
  PID:8744
- C:\Windows\System\dAgUFEP.exe
  C:\Windows\System\dAgUFEP.exe
  2⤵
  PID:8772
- C:\Windows\System\rlUxYey.exe
  C:\Windows\System\rlUxYey.exe
  2⤵
  PID:8800
- C:\Windows\System\EevTPJj.exe
  C:\Windows\System\EevTPJj.exe
  2⤵
  PID:8828
- C:\Windows\System\VcYIaEu.exe
  C:\Windows\System\VcYIaEu.exe
  2⤵
  PID:8860
- C:\Windows\System\ttXPuqp.exe
  C:\Windows\System\ttXPuqp.exe
  2⤵
  PID:8888
- C:\Windows\System\GSiHzcj.exe
  C:\Windows\System\GSiHzcj.exe
  2⤵
  PID:8916
- C:\Windows\System\DqvBkVM.exe
  C:\Windows\System\DqvBkVM.exe
  2⤵
  PID:8944
- C:\Windows\System\SEHexBx.exe
  C:\Windows\System\SEHexBx.exe
  2⤵
  PID:8972
- C:\Windows\System\OrErlgb.exe
  C:\Windows\System\OrErlgb.exe
  2⤵
  PID:9000
- C:\Windows\System\jKksyxY.exe
  C:\Windows\System\jKksyxY.exe
  2⤵
  PID:9028
- C:\Windows\System\QyIICdx.exe
  C:\Windows\System\QyIICdx.exe
  2⤵
  PID:9056
- C:\Windows\System\WXxoIFv.exe
  C:\Windows\System\WXxoIFv.exe
  2⤵
  PID:9084
- C:\Windows\System\xjvZGGv.exe
  C:\Windows\System\xjvZGGv.exe
  2⤵
  PID:9112
- C:\Windows\System\VHAUAEL.exe
  C:\Windows\System\VHAUAEL.exe
  2⤵
  PID:9140
- C:\Windows\System\KiJgdKc.exe
  C:\Windows\System\KiJgdKc.exe
  2⤵
  PID:9168
- C:\Windows\System\FrMiEFU.exe
  C:\Windows\System\FrMiEFU.exe
  2⤵
  PID:9196
- C:\Windows\System\ZnlaESP.exe
  C:\Windows\System\ZnlaESP.exe
  2⤵
  PID:8204
- C:\Windows\System\NMdQQCj.exe
  C:\Windows\System\NMdQQCj.exe
  2⤵
  PID:8284
- C:\Windows\System\isnRfFd.exe
  C:\Windows\System\isnRfFd.exe
  2⤵
  PID:8344
- C:\Windows\System\McJRevo.exe
  C:\Windows\System\McJRevo.exe
  2⤵
  PID:8404
- C:\Windows\System\xiRnYaC.exe
  C:\Windows\System\xiRnYaC.exe
  2⤵
  PID:8480
- C:\Windows\System\pBzyFdB.exe
  C:\Windows\System\pBzyFdB.exe
  2⤵
  PID:8544
- C:\Windows\System\GRyTEYF.exe
  C:\Windows\System\GRyTEYF.exe
  2⤵
  PID:8596
- C:\Windows\System\SqzqgYd.exe
  C:\Windows\System\SqzqgYd.exe
  2⤵
  PID:8644
- C:\Windows\System\IQVQasD.exe
  C:\Windows\System\IQVQasD.exe
  2⤵
  PID:8700
- C:\Windows\System\iiJRwBG.exe
  C:\Windows\System\iiJRwBG.exe
  2⤵
  PID:8768
- C:\Windows\System\OvYVoDs.exe
  C:\Windows\System\OvYVoDs.exe
  2⤵
  PID:8840
- C:\Windows\System\fLlhhQl.exe
  C:\Windows\System\fLlhhQl.exe
  2⤵
  PID:8884
- C:\Windows\System\DRNCcBu.exe
  C:\Windows\System\DRNCcBu.exe
  2⤵
  PID:8968
- C:\Windows\System\pTyZbid.exe
  C:\Windows\System\pTyZbid.exe
  2⤵
  PID:9040
- C:\Windows\System\UFBfLdY.exe
  C:\Windows\System\UFBfLdY.exe
  2⤵
  PID:9096
- C:\Windows\System\zcUrAVR.exe
  C:\Windows\System\zcUrAVR.exe
  2⤵
  PID:9192
- C:\Windows\System\oBcGRPO.exe
  C:\Windows\System\oBcGRPO.exe
  2⤵
  PID:8376
- C:\Windows\System\JjLdGnS.exe
  C:\Windows\System\JjLdGnS.exe
  2⤵
  PID:8456
- C:\Windows\System\MzzYJCQ.exe
  C:\Windows\System\MzzYJCQ.exe
  2⤵
  PID:8568
- C:\Windows\System\mNbWZYR.exe
  C:\Windows\System\mNbWZYR.exe
  2⤵
  PID:8740
- C:\Windows\System\aeyyHtB.exe
  C:\Windows\System\aeyyHtB.exe
  2⤵
  PID:8876
- C:\Windows\System\CQHorpx.exe
  C:\Windows\System\CQHorpx.exe
  2⤵
  PID:9068
- C:\Windows\System\nVjwrAp.exe
  C:\Windows\System\nVjwrAp.exe
  2⤵
  PID:1016
- C:\Windows\System\rQscGtq.exe
  C:\Windows\System\rQscGtq.exe
  2⤵
  PID:8848
- C:\Windows\System\lzTKiZR.exe
  C:\Windows\System\lzTKiZR.exe
  2⤵
  PID:8672
- C:\Windows\System\tAqEcAO.exe
  C:\Windows\System\tAqEcAO.exe
  2⤵
  PID:9012
- C:\Windows\System\xKnPlrL.exe
  C:\Windows\System\xKnPlrL.exe
  2⤵
  PID:8432
- C:\Windows\System\ChKVXmu.exe
  C:\Windows\System\ChKVXmu.exe
  2⤵
  PID:8336
- C:\Windows\System\jgGmncv.exe
  C:\Windows\System\jgGmncv.exe
  2⤵
  PID:9224
- C:\Windows\System\aigyQOY.exe
  C:\Windows\System\aigyQOY.exe
  2⤵
  PID:9252
- C:\Windows\System\KUTJZyF.exe
  C:\Windows\System\KUTJZyF.exe
  2⤵
  PID:9280
- C:\Windows\System\neoSTKk.exe
  C:\Windows\System\neoSTKk.exe
  2⤵
  PID:9308
- C:\Windows\System\REwpLhA.exe
  C:\Windows\System\REwpLhA.exe
  2⤵
  PID:9336
- C:\Windows\System\CVblzzX.exe
  C:\Windows\System\CVblzzX.exe
  2⤵
  PID:9364
- C:\Windows\System\rhJWOZm.exe
  C:\Windows\System\rhJWOZm.exe
  2⤵
  PID:9392
- C:\Windows\System\WLesCvZ.exe
  C:\Windows\System\WLesCvZ.exe
  2⤵
  PID:9420
- C:\Windows\System\eSxRLnE.exe
  C:\Windows\System\eSxRLnE.exe
  2⤵
  PID:9448
- C:\Windows\System\cYjEHAo.exe
  C:\Windows\System\cYjEHAo.exe
  2⤵
  PID:9476
- C:\Windows\System\gEXUguY.exe
  C:\Windows\System\gEXUguY.exe
  2⤵
  PID:9504
- C:\Windows\System\HMRWwwg.exe
  C:\Windows\System\HMRWwwg.exe
  2⤵
  PID:9532
- C:\Windows\System\xLOhpvE.exe
  C:\Windows\System\xLOhpvE.exe
  2⤵
  PID:9560
- C:\Windows\System\nqcOrdW.exe
  C:\Windows\System\nqcOrdW.exe
  2⤵
  PID:9588
- C:\Windows\System\aezgCTu.exe
  C:\Windows\System\aezgCTu.exe
  2⤵
  PID:9616
- C:\Windows\System\djMQOMb.exe
  C:\Windows\System\djMQOMb.exe
  2⤵
  PID:9644
- C:\Windows\System\cwhAkOA.exe
  C:\Windows\System\cwhAkOA.exe
  2⤵
  PID:9672
- C:\Windows\System\ojmyAUH.exe
  C:\Windows\System\ojmyAUH.exe
  2⤵
  PID:9700
- C:\Windows\System\lHzkMNm.exe
  C:\Windows\System\lHzkMNm.exe
  2⤵
  PID:9728
- C:\Windows\System\oVjSway.exe
  C:\Windows\System\oVjSway.exe
  2⤵
  PID:9756
- C:\Windows\System\ZtnElol.exe
  C:\Windows\System\ZtnElol.exe
  2⤵
  PID:9784
- C:\Windows\System\NyPbYwF.exe
  C:\Windows\System\NyPbYwF.exe
  2⤵
  PID:9812
- C:\Windows\System\iQGeLEU.exe
  C:\Windows\System\iQGeLEU.exe
  2⤵
  PID:9840
- C:\Windows\System\fLeXnWg.exe
  C:\Windows\System\fLeXnWg.exe
  2⤵
  PID:9868
- C:\Windows\System\LCLduYh.exe
  C:\Windows\System\LCLduYh.exe
  2⤵
  PID:9896
- C:\Windows\System\oaGdGlv.exe
  C:\Windows\System\oaGdGlv.exe
  2⤵
  PID:9924
- C:\Windows\System\VbTXOqA.exe
  C:\Windows\System\VbTXOqA.exe
  2⤵
  PID:9952
- C:\Windows\System\pgwTeev.exe
  C:\Windows\System\pgwTeev.exe
  2⤵
  PID:9980
- C:\Windows\System\WLXaUdy.exe
  C:\Windows\System\WLXaUdy.exe
  2⤵
  PID:10008
- C:\Windows\System\ONiRHov.exe
  C:\Windows\System\ONiRHov.exe
  2⤵
  PID:10036
- C:\Windows\System\PBMmswF.exe
  C:\Windows\System\PBMmswF.exe
  2⤵
  PID:10064
- C:\Windows\System\wDoFTOz.exe
  C:\Windows\System\wDoFTOz.exe
  2⤵
  PID:10092
- C:\Windows\System\lNLDGop.exe
  C:\Windows\System\lNLDGop.exe
  2⤵
  PID:10120
- C:\Windows\System\mPGQJju.exe
  C:\Windows\System\mPGQJju.exe
  2⤵
  PID:10148
- C:\Windows\System\fPImhpk.exe
  C:\Windows\System\fPImhpk.exe
  2⤵
  PID:10188
- C:\Windows\System\PaYcJvX.exe
  C:\Windows\System\PaYcJvX.exe
  2⤵
  PID:10204
- C:\Windows\System\kVFKJKR.exe
  C:\Windows\System\kVFKJKR.exe
  2⤵
  PID:10232
- C:\Windows\System\iwBfxcp.exe
  C:\Windows\System\iwBfxcp.exe
  2⤵
  PID:9268
- C:\Windows\System\HFwnSwq.exe
  C:\Windows\System\HFwnSwq.exe
  2⤵
  PID:9328
- C:\Windows\System\kSbISoN.exe
  C:\Windows\System\kSbISoN.exe
  2⤵
  PID:9388
- C:\Windows\System\oKklCoj.exe
  C:\Windows\System\oKklCoj.exe
  2⤵
  PID:9460
- C:\Windows\System\yHAIVFt.exe
  C:\Windows\System\yHAIVFt.exe
  2⤵
  PID:9524
- C:\Windows\System\poBkOAH.exe
  C:\Windows\System\poBkOAH.exe
  2⤵
  PID:9584
- C:\Windows\System\iKbJUVZ.exe
  C:\Windows\System\iKbJUVZ.exe
  2⤵
  PID:9656
- C:\Windows\System\PhScjzH.exe
  C:\Windows\System\PhScjzH.exe
  2⤵
  PID:9720
- C:\Windows\System\Yovmxzo.exe
  C:\Windows\System\Yovmxzo.exe
  2⤵
  PID:9776
- C:\Windows\System\hXyqYgj.exe
  C:\Windows\System\hXyqYgj.exe
  2⤵
  PID:9836
- C:\Windows\System\cTJmlVp.exe
  C:\Windows\System\cTJmlVp.exe
  2⤵
  PID:9908
- C:\Windows\System\AklZUsm.exe
  C:\Windows\System\AklZUsm.exe
  2⤵
  PID:9976
- C:\Windows\System\sMVXprv.exe
  C:\Windows\System\sMVXprv.exe
  2⤵
  PID:10048
- C:\Windows\System\AVemtls.exe
  C:\Windows\System\AVemtls.exe
  2⤵
  PID:10112
- C:\Windows\System\EMAYFBv.exe
  C:\Windows\System\EMAYFBv.exe
  2⤵
  PID:10172
- C:\Windows\System\kILCFNJ.exe
  C:\Windows\System\kILCFNJ.exe
  2⤵
  PID:10228
- C:\Windows\System\eBmqznl.exe
  C:\Windows\System\eBmqznl.exe
  2⤵
  PID:9356
- C:\Windows\System\ElUxlLB.exe
  C:\Windows\System\ElUxlLB.exe
  2⤵
  PID:9516
- C:\Windows\System\KLAfkGy.exe
  C:\Windows\System\KLAfkGy.exe
  2⤵
  PID:9640
- C:\Windows\System\ocKOrRp.exe
  C:\Windows\System\ocKOrRp.exe
  2⤵
  PID:9808
- C:\Windows\System\pncLDWS.exe
  C:\Windows\System\pncLDWS.exe
  2⤵
  PID:9964
- C:\Windows\System\FoHWmfC.exe
  C:\Windows\System\FoHWmfC.exe
  2⤵
  PID:10108
- C:\Windows\System\qOKuEui.exe
  C:\Windows\System\qOKuEui.exe
  2⤵
  PID:9248
- C:\Windows\System\VicPbqH.exe
  C:\Windows\System\VicPbqH.exe
  2⤵
  PID:9712
- C:\Windows\System\ivWDQIU.exe
  C:\Windows\System\ivWDQIU.exe
  2⤵
  PID:9940
- C:\Windows\System\FLQdBxM.exe
  C:\Windows\System\FLQdBxM.exe
  2⤵
  PID:9416
- C:\Windows\System\zXaZbND.exe
  C:\Windows\System\zXaZbND.exe
  2⤵
  PID:10216
- C:\Windows\System\HdDAAxn.exe
  C:\Windows\System\HdDAAxn.exe
  2⤵
  PID:10248
- C:\Windows\System\FitpVmf.exe
  C:\Windows\System\FitpVmf.exe
  2⤵
  PID:10276
- C:\Windows\System\UfcNDBA.exe
  C:\Windows\System\UfcNDBA.exe
  2⤵
  PID:10304
- C:\Windows\System\QGvAelP.exe
  C:\Windows\System\QGvAelP.exe
  2⤵
  PID:10332
- C:\Windows\System\DOBJOkn.exe
  C:\Windows\System\DOBJOkn.exe
  2⤵
  PID:10360
- C:\Windows\System\rqXUBvq.exe
  C:\Windows\System\rqXUBvq.exe
  2⤵
  PID:10396
- C:\Windows\System\nOlUFWL.exe
  C:\Windows\System\nOlUFWL.exe
  2⤵
  PID:10416
- C:\Windows\System\oYmsRtl.exe
  C:\Windows\System\oYmsRtl.exe
  2⤵
  PID:10444
- C:\Windows\System\cqnuBeZ.exe
  C:\Windows\System\cqnuBeZ.exe
  2⤵
  PID:10472
- C:\Windows\System\SIGCxPt.exe
  C:\Windows\System\SIGCxPt.exe
  2⤵
  PID:10500
- C:\Windows\System\jkOZrzC.exe
  C:\Windows\System\jkOZrzC.exe
  2⤵
  PID:10528
- C:\Windows\System\nieiFBK.exe
  C:\Windows\System\nieiFBK.exe
  2⤵
  PID:10556
- C:\Windows\System\mLWvtpT.exe
  C:\Windows\System\mLWvtpT.exe
  2⤵
  PID:10584
- C:\Windows\System\yXolnYT.exe
  C:\Windows\System\yXolnYT.exe
  2⤵
  PID:10612
- C:\Windows\System\ZRlabzY.exe
  C:\Windows\System\ZRlabzY.exe
  2⤵
  PID:10640
- C:\Windows\System\qIACfsA.exe
  C:\Windows\System\qIACfsA.exe
  2⤵
  PID:10668
- C:\Windows\System\eRFsZMG.exe
  C:\Windows\System\eRFsZMG.exe
  2⤵
  PID:10696
- C:\Windows\System\aMkHKyV.exe
  C:\Windows\System\aMkHKyV.exe
  2⤵
  PID:10724
- C:\Windows\System\bLyxIlu.exe
  C:\Windows\System\bLyxIlu.exe
  2⤵
  PID:10752
- C:\Windows\System\MtHWgbc.exe
  C:\Windows\System\MtHWgbc.exe
  2⤵
  PID:10780
- C:\Windows\System\ohLUCmd.exe
  C:\Windows\System\ohLUCmd.exe
  2⤵
  PID:10808
- C:\Windows\System\DlHQxXS.exe
  C:\Windows\System\DlHQxXS.exe
  2⤵
  PID:10836
- C:\Windows\System\gGOaDKp.exe
  C:\Windows\System\gGOaDKp.exe
  2⤵
  PID:10864
- C:\Windows\System\BhBdwZl.exe
  C:\Windows\System\BhBdwZl.exe
  2⤵
  PID:10892
- C:\Windows\System\bbVkJty.exe
  C:\Windows\System\bbVkJty.exe
  2⤵
  PID:10920
- C:\Windows\System\nLMZcub.exe
  C:\Windows\System\nLMZcub.exe
  2⤵
  PID:10948
- C:\Windows\System\XvfkeAC.exe
  C:\Windows\System\XvfkeAC.exe
  2⤵
  PID:10976
- C:\Windows\System\wIKqZVB.exe
  C:\Windows\System\wIKqZVB.exe
  2⤵
  PID:11004
- C:\Windows\System\sWrMQzg.exe
  C:\Windows\System\sWrMQzg.exe
  2⤵
  PID:11032
- C:\Windows\System\pcwticE.exe
  C:\Windows\System\pcwticE.exe
  2⤵
  PID:11060
- C:\Windows\System\kwiBppZ.exe
  C:\Windows\System\kwiBppZ.exe
  2⤵
  PID:11088
- C:\Windows\System\lGrxrUO.exe
  C:\Windows\System\lGrxrUO.exe
  2⤵
  PID:11116
- C:\Windows\System\qQuhpBW.exe
  C:\Windows\System\qQuhpBW.exe
  2⤵
  PID:11144
- C:\Windows\System\YXCRetN.exe
  C:\Windows\System\YXCRetN.exe
  2⤵
  PID:11172
- C:\Windows\System\uyvKxMa.exe
  C:\Windows\System\uyvKxMa.exe
  2⤵
  PID:11200
- C:\Windows\System\PJGhsIF.exe
  C:\Windows\System\PJGhsIF.exe
  2⤵
  PID:11228
- C:\Windows\System\CgSHIIh.exe
  C:\Windows\System\CgSHIIh.exe
  2⤵
  PID:11256
- C:\Windows\System\ZvxhMal.exe
  C:\Windows\System\ZvxhMal.exe
  2⤵
  PID:10296
- C:\Windows\System\mmnMBmw.exe
  C:\Windows\System\mmnMBmw.exe
  2⤵
  PID:10352
- C:\Windows\System\HGSKICE.exe
  C:\Windows\System\HGSKICE.exe
  2⤵
  PID:10428
- C:\Windows\System\ZzVoYVB.exe
  C:\Windows\System\ZzVoYVB.exe
  2⤵
  PID:10496
- C:\Windows\System\lKIfFIl.exe
  C:\Windows\System\lKIfFIl.exe
  2⤵
  PID:10552
- C:\Windows\System\sRwsica.exe
  C:\Windows\System\sRwsica.exe
  2⤵
  PID:10628
- C:\Windows\System\SnNpQqp.exe
  C:\Windows\System\SnNpQqp.exe
  2⤵
  PID:10688
- C:\Windows\System\JgABCit.exe
  C:\Windows\System\JgABCit.exe
  2⤵
  PID:10748
- C:\Windows\System\QdxKUmj.exe
  C:\Windows\System\QdxKUmj.exe
  2⤵
  PID:10824
- C:\Windows\System\tphBbgD.exe
  C:\Windows\System\tphBbgD.exe
  2⤵
  PID:10884
- C:\Windows\System\QGSjzTr.exe
  C:\Windows\System\QGSjzTr.exe
  2⤵
  PID:10940
- C:\Windows\System\GrWNDFS.exe
  C:\Windows\System\GrWNDFS.exe
  2⤵
  PID:11000
- C:\Windows\System\FlOXOuZ.exe
  C:\Windows\System\FlOXOuZ.exe
  2⤵
  PID:11072
- C:\Windows\System\odTBMpP.exe
  C:\Windows\System\odTBMpP.exe
  2⤵
  PID:11136
- C:\Windows\System\mhjrtPw.exe
  C:\Windows\System\mhjrtPw.exe
  2⤵
  PID:11196
- C:\Windows\System\SxalshH.exe
  C:\Windows\System\SxalshH.exe
  2⤵
  PID:10264
- C:\Windows\System\LxtXpAn.exe
  C:\Windows\System\LxtXpAn.exe
  2⤵
  PID:10408
- C:\Windows\System\REsQZmC.exe
  C:\Windows\System\REsQZmC.exe
  2⤵
  PID:10548
- C:\Windows\System\VENrfZO.exe
  C:\Windows\System\VENrfZO.exe
  2⤵
  PID:10716
- C:\Windows\System\uGjsprm.exe
  C:\Windows\System\uGjsprm.exe
  2⤵
  PID:10860
- C:\Windows\System\tqjbPtA.exe
  C:\Windows\System\tqjbPtA.exe
  2⤵
  PID:10988
- C:\Windows\System\XhvDDzx.exe
  C:\Windows\System\XhvDDzx.exe
  2⤵
  PID:11128
- C:\Windows\System\qFBytIm.exe
  C:\Windows\System\qFBytIm.exe
  2⤵
  PID:10324
- C:\Windows\System\lwuvKEs.exe
  C:\Windows\System\lwuvKEs.exe
  2⤵
  PID:10660
- C:\Windows\System\XUWFNwE.exe
  C:\Windows\System\XUWFNwE.exe
  2⤵
  PID:10972
- C:\Windows\System\bgjtEFe.exe
  C:\Windows\System\bgjtEFe.exe
  2⤵
  PID:10468
- C:\Windows\System\wLhtgGD.exe
  C:\Windows\System\wLhtgGD.exe
  2⤵
  PID:11248
- C:\Windows\System\ZuaUgVf.exe
  C:\Windows\System\ZuaUgVf.exe
  2⤵
  PID:11272
- C:\Windows\System\WaZRgaW.exe
  C:\Windows\System\WaZRgaW.exe
  2⤵
  PID:11300
- C:\Windows\System\FFJjHBm.exe
  C:\Windows\System\FFJjHBm.exe
  2⤵
  PID:11328
- C:\Windows\System\zpknVna.exe
  C:\Windows\System\zpknVna.exe
  2⤵
  PID:11356
- C:\Windows\System\BXZypof.exe
  C:\Windows\System\BXZypof.exe
  2⤵
  PID:11384
- C:\Windows\System\KCvxsQX.exe
  C:\Windows\System\KCvxsQX.exe
  2⤵
  PID:11412
- C:\Windows\System\sUDbPlB.exe
  C:\Windows\System\sUDbPlB.exe
  2⤵
  PID:11440
- C:\Windows\System\VMTMNfL.exe
  C:\Windows\System\VMTMNfL.exe
  2⤵
  PID:11468
- C:\Windows\System\jUecDcr.exe
  C:\Windows\System\jUecDcr.exe
  2⤵
  PID:11496
- C:\Windows\System\lxjKqaH.exe
  C:\Windows\System\lxjKqaH.exe
  2⤵
  PID:11524
- C:\Windows\System\lrVxraL.exe
  C:\Windows\System\lrVxraL.exe
  2⤵
  PID:11552
- C:\Windows\System\UJJvugA.exe
  C:\Windows\System\UJJvugA.exe
  2⤵
  PID:11580
- C:\Windows\System\pOBZmxQ.exe
  C:\Windows\System\pOBZmxQ.exe
  2⤵
  PID:11608
- C:\Windows\System\EksfMXN.exe
  C:\Windows\System\EksfMXN.exe
  2⤵
  PID:11636
- C:\Windows\System\GFmhcrt.exe
  C:\Windows\System\GFmhcrt.exe
  2⤵
  PID:11664
- C:\Windows\System\NIlqtgX.exe
  C:\Windows\System\NIlqtgX.exe
  2⤵
  PID:11692
- C:\Windows\System\xOElpUg.exe
  C:\Windows\System\xOElpUg.exe
  2⤵
  PID:11720
- C:\Windows\System\hasperj.exe
  C:\Windows\System\hasperj.exe
  2⤵
  PID:11748
- C:\Windows\System\YuReKmA.exe
  C:\Windows\System\YuReKmA.exe
  2⤵
  PID:11776
- C:\Windows\System\gypkUKp.exe
  C:\Windows\System\gypkUKp.exe
  2⤵
  PID:11804
- C:\Windows\System\iEaKNbj.exe
  C:\Windows\System\iEaKNbj.exe
  2⤵
  PID:11832
- C:\Windows\System\XHGZvyR.exe
  C:\Windows\System\XHGZvyR.exe
  2⤵
  PID:11860
- C:\Windows\System\TZZvSvm.exe
  C:\Windows\System\TZZvSvm.exe
  2⤵
  PID:11888
- C:\Windows\System\GeoTacw.exe
  C:\Windows\System\GeoTacw.exe
  2⤵
  PID:11916
- C:\Windows\System\QKCkzki.exe
  C:\Windows\System\QKCkzki.exe
  2⤵
  PID:11944
- C:\Windows\System\TYFmRhj.exe
  C:\Windows\System\TYFmRhj.exe
  2⤵
  PID:11976
- C:\Windows\System\USPBPKO.exe
  C:\Windows\System\USPBPKO.exe
  2⤵
  PID:12004
- C:\Windows\System\UWjHYDr.exe
  C:\Windows\System\UWjHYDr.exe
  2⤵
  PID:12032
- C:\Windows\System\hjLLBuf.exe
  C:\Windows\System\hjLLBuf.exe
  2⤵
  PID:12060
- C:\Windows\System\XIKWRsf.exe
  C:\Windows\System\XIKWRsf.exe
  2⤵
  PID:12088
- C:\Windows\System\KwCGaho.exe
  C:\Windows\System\KwCGaho.exe
  2⤵
  PID:12116
- C:\Windows\System\FMPZFXO.exe
  C:\Windows\System\FMPZFXO.exe
  2⤵
  PID:12144
- C:\Windows\System\QcqqvIo.exe
  C:\Windows\System\QcqqvIo.exe
  2⤵
  PID:12172
- C:\Windows\System\DjBgVps.exe
  C:\Windows\System\DjBgVps.exe
  2⤵
  PID:12200
- C:\Windows\System\VPmrnMm.exe
  C:\Windows\System\VPmrnMm.exe
  2⤵
  PID:12236
- C:\Windows\System\UeuLKDs.exe
  C:\Windows\System\UeuLKDs.exe
  2⤵
  PID:12264
- C:\Windows\System\LvqOAlW.exe
  C:\Windows\System\LvqOAlW.exe
  2⤵
  PID:11268
- C:\Windows\System\NsNqYeA.exe
  C:\Windows\System\NsNqYeA.exe
  2⤵
  PID:11344
- C:\Windows\System\SUsOKfi.exe
  C:\Windows\System\SUsOKfi.exe
  2⤵
  PID:11404
- C:\Windows\System\pZpoDUR.exe
  C:\Windows\System\pZpoDUR.exe
  2⤵
  PID:11464
- C:\Windows\System\edEhhYH.exe
  C:\Windows\System\edEhhYH.exe
  2⤵
  PID:11536
- C:\Windows\System\kOOfYpM.exe
  C:\Windows\System\kOOfYpM.exe
  2⤵
  PID:9892
- C:\Windows\System\KtsQiAY.exe
  C:\Windows\System\KtsQiAY.exe
  2⤵
  PID:11632
- C:\Windows\System\wVxLuMZ.exe
  C:\Windows\System\wVxLuMZ.exe
  2⤵
  PID:11684
- C:\Windows\System\WiattOF.exe
  C:\Windows\System\WiattOF.exe
  2⤵
  PID:11768
- C:\Windows\System\ogbzfux.exe
  C:\Windows\System\ogbzfux.exe
  2⤵
  PID:11828
- C:\Windows\System\ynHhVbv.exe
  C:\Windows\System\ynHhVbv.exe
  2⤵
  PID:11880
- C:\Windows\System\rnCghGn.exe
  C:\Windows\System\rnCghGn.exe
  2⤵
  PID:11972
- C:\Windows\System\pXuDAZC.exe
  C:\Windows\System\pXuDAZC.exe
  2⤵
  PID:12056
- C:\Windows\System\mjZFqQD.exe
  C:\Windows\System\mjZFqQD.exe
  2⤵
  PID:12128
- C:\Windows\System\qfUnpys.exe
  C:\Windows\System\qfUnpys.exe
  2⤵
  PID:12192
- C:\Windows\System\BKsEVEu.exe
  C:\Windows\System\BKsEVEu.exe
  2⤵
  PID:12260
- C:\Windows\System\oJGQDha.exe
  C:\Windows\System\oJGQDha.exe
  2⤵
  PID:11376
- C:\Windows\System\TgBIcNH.exe
  C:\Windows\System\TgBIcNH.exe
  2⤵
  PID:11516
- C:\Windows\System\HXlMrJP.exe
  C:\Windows\System\HXlMrJP.exe
  2⤵
  PID:11628
- C:\Windows\System\PUOPUtv.exe
  C:\Windows\System\PUOPUtv.exe
  2⤵
  PID:11800
- C:\Windows\System\aoKIfoz.exe
  C:\Windows\System\aoKIfoz.exe
  2⤵
  PID:11940
- C:\Windows\System\mRxBqLa.exe
  C:\Windows\System\mRxBqLa.exe
  2⤵
  PID:1956
- C:\Windows\System\bFXXwsO.exe
  C:\Windows\System\bFXXwsO.exe
  2⤵
  PID:3256
- C:\Windows\System\nRXkKaC.exe
  C:\Windows\System\nRXkKaC.exe
  2⤵
  PID:12228
- C:\Windows\System\oNYrxPX.exe
  C:\Windows\System\oNYrxPX.exe
  2⤵
  PID:11460
- C:\Windows\System\WUmHjFq.exe
  C:\Windows\System\WUmHjFq.exe
  2⤵
  PID:11796
- C:\Windows\System\djcrOVU.exe
  C:\Windows\System\djcrOVU.exe
  2⤵
  PID:1932
- C:\Windows\System\sGlEOLc.exe
  C:\Windows\System\sGlEOLc.exe
  2⤵
  PID:11324
- C:\Windows\System\XAohIjX.exe
  C:\Windows\System\XAohIjX.exe
  2⤵
  PID:12084
- C:\Windows\System\AnGvjLt.exe
  C:\Windows\System\AnGvjLt.exe
  2⤵
  PID:11600
- C:\Windows\System\xyWOXJp.exe
  C:\Windows\System\xyWOXJp.exe
  2⤵
  PID:12304
- C:\Windows\System\OyPsnst.exe
  C:\Windows\System\OyPsnst.exe
  2⤵
  PID:12332
- C:\Windows\System\xnKRhYC.exe
  C:\Windows\System\xnKRhYC.exe
  2⤵
  PID:12360
- C:\Windows\System\pZjTgCH.exe
  C:\Windows\System\pZjTgCH.exe
  2⤵
  PID:12388
- C:\Windows\System\XbXAgfX.exe
  C:\Windows\System\XbXAgfX.exe
  2⤵
  PID:12416
- C:\Windows\System\JvMgyij.exe
  C:\Windows\System\JvMgyij.exe
  2⤵
  PID:12444
- C:\Windows\System\muAsTFl.exe
  C:\Windows\System\muAsTFl.exe
  2⤵
  PID:12472
- C:\Windows\System\qfuLXXB.exe
  C:\Windows\System\qfuLXXB.exe
  2⤵
  PID:12500
- C:\Windows\System\uIEQLoR.exe
  C:\Windows\System\uIEQLoR.exe
  2⤵
  PID:12528
- C:\Windows\System\iBOOvea.exe
  C:\Windows\System\iBOOvea.exe
  2⤵
  PID:12564
- C:\Windows\System\krJbHdg.exe
  C:\Windows\System\krJbHdg.exe
  2⤵
  PID:12584
- C:\Windows\System\RiYFOXS.exe
  C:\Windows\System\RiYFOXS.exe
  2⤵
  PID:12616
- C:\Windows\System\MttvQUz.exe
  C:\Windows\System\MttvQUz.exe
  2⤵
  PID:12644
- C:\Windows\System\ULGToNo.exe
  C:\Windows\System\ULGToNo.exe
  2⤵
  PID:12672
- C:\Windows\System\IlVUpDG.exe
  C:\Windows\System\IlVUpDG.exe
  2⤵
  PID:12700
- C:\Windows\System\xICOKyd.exe
  C:\Windows\System\xICOKyd.exe
  2⤵
  PID:12728
- C:\Windows\System\IQouRHT.exe
  C:\Windows\System\IQouRHT.exe
  2⤵
  PID:12756
- C:\Windows\System\qccDncD.exe
  C:\Windows\System\qccDncD.exe
  2⤵
  PID:12784
- C:\Windows\System\YZyFVaz.exe
  C:\Windows\System\YZyFVaz.exe
  2⤵
  PID:12812
- C:\Windows\System\KLxpvCi.exe
  C:\Windows\System\KLxpvCi.exe
  2⤵
  PID:12852
- C:\Windows\System\ABuOYvb.exe
  C:\Windows\System\ABuOYvb.exe
  2⤵
  PID:12868
- C:\Windows\System\FJrtuQI.exe
  C:\Windows\System\FJrtuQI.exe
  2⤵
  PID:12896
- C:\Windows\System\GxYuIXv.exe
  C:\Windows\System\GxYuIXv.exe
  2⤵
  PID:12924
- C:\Windows\System\havBBiP.exe
  C:\Windows\System\havBBiP.exe
  2⤵
  PID:12952
- C:\Windows\System\sfketlQ.exe
  C:\Windows\System\sfketlQ.exe
  2⤵
  PID:12980
- C:\Windows\System\GEihyca.exe
  C:\Windows\System\GEihyca.exe
  2⤵
  PID:13008
- C:\Windows\System\qTmgPFV.exe
  C:\Windows\System\qTmgPFV.exe
  2⤵
  PID:13036
- C:\Windows\System\AIgSNCM.exe
  C:\Windows\System\AIgSNCM.exe
  2⤵
  PID:13064
- C:\Windows\System\BURpVoI.exe
  C:\Windows\System\BURpVoI.exe
  2⤵
  PID:13092
- C:\Windows\System\ZcbgHGN.exe
  C:\Windows\System\ZcbgHGN.exe
  2⤵
  PID:13120
- C:\Windows\System\zkAUUGm.exe
  C:\Windows\System\zkAUUGm.exe
  2⤵
  PID:13148
- C:\Windows\System\AlhhTkf.exe
  C:\Windows\System\AlhhTkf.exe
  2⤵
  PID:13176
- C:\Windows\System\bzpHSIl.exe
  C:\Windows\System\bzpHSIl.exe
  2⤵
  PID:13204
- C:\Windows\System\lCUzIRn.exe
  C:\Windows\System\lCUzIRn.exe
  2⤵
  PID:13232
- C:\Windows\System\fMLWVYW.exe
  C:\Windows\System\fMLWVYW.exe
  2⤵
  PID:13260
- C:\Windows\System\zYSzRiZ.exe
  C:\Windows\System\zYSzRiZ.exe
  2⤵
  PID:13288
- C:\Windows\System\DroxHms.exe
  C:\Windows\System\DroxHms.exe
  2⤵
  PID:12296
- C:\Windows\System\bPgxODh.exe
  C:\Windows\System\bPgxODh.exe
  2⤵
  PID:12356
- C:\Windows\System\gbAspqh.exe
  C:\Windows\System\gbAspqh.exe
  2⤵
  PID:12432
- C:\Windows\System\ZqeFqZc.exe
  C:\Windows\System\ZqeFqZc.exe
  2⤵
  PID:12492
- C:\Windows\System\TgTzTmc.exe
  C:\Windows\System\TgTzTmc.exe
  2⤵
  PID:12552
- C:\Windows\System\TjPDsyR.exe
  C:\Windows\System\TjPDsyR.exe
  2⤵
  PID:12628
- C:\Windows\System\OqIllKk.exe
  C:\Windows\System\OqIllKk.exe
  2⤵
  PID:12688
- C:\Windows\System\nKlbkaV.exe
  C:\Windows\System\nKlbkaV.exe
  2⤵
  PID:12752
- C:\Windows\System\ERrTngS.exe
  C:\Windows\System\ERrTngS.exe
  2⤵
  PID:12824
- C:\Windows\System\ZjHQNFZ.exe
  C:\Windows\System\ZjHQNFZ.exe
  2⤵
  PID:12888
- C:\Windows\System\ufIvRvS.exe
  C:\Windows\System\ufIvRvS.exe
  2⤵
  PID:12948
- C:\Windows\System\hdiAlZZ.exe
  C:\Windows\System\hdiAlZZ.exe
  2⤵
  PID:13024
- C:\Windows\System\MYRtCoS.exe
  C:\Windows\System\MYRtCoS.exe
  2⤵
  PID:13084
- C:\Windows\System\CAvuDjQ.exe
  C:\Windows\System\CAvuDjQ.exe
  2⤵
  PID:13144
- C:\Windows\System\tQimTyH.exe
  C:\Windows\System\tQimTyH.exe
  2⤵
  PID:13220
- C:\Windows\System\GuswQPe.exe
  C:\Windows\System\GuswQPe.exe
  2⤵
  PID:13284
- C:\Windows\System\ijZaJhg.exe
  C:\Windows\System\ijZaJhg.exe
  2⤵
  PID:12400
- C:\Windows\System\knvOihf.exe
  C:\Windows\System\knvOihf.exe
  2⤵
  PID:12520
- C:\Windows\System\OiNGfzf.exe
  C:\Windows\System\OiNGfzf.exe
  2⤵
  PID:13048
- C:\Windows\System\gFCfAcT.exe
  C:\Windows\System\gFCfAcT.exe
  2⤵
  PID:3728
- C:\Windows\System\GOlSwVE.exe
  C:\Windows\System\GOlSwVE.exe
  2⤵
  PID:548
- C:\Windows\System\lvJKZDD.exe
  C:\Windows\System\lvJKZDD.exe
  2⤵
  PID:12660
- C:\Windows\System\PWPIwsu.exe
  C:\Windows\System\PWPIwsu.exe
  2⤵
  PID:2180
- C:\Windows\System\FcYxeZK.exe
  C:\Windows\System\FcYxeZK.exe
  2⤵
  PID:12484
- C:\Windows\System\VSyGMtW.exe
  C:\Windows\System\VSyGMtW.exe
  2⤵
  PID:1492
- C:\Windows\System\ZNZJmIc.exe
  C:\Windows\System\ZNZJmIc.exe
  2⤵
  PID:3520
- C:\Windows\System\NPMYiGM.exe
  C:\Windows\System\NPMYiGM.exe
  2⤵
  PID:4752
- C:\Windows\System\EQJPzUB.exe
  C:\Windows\System\EQJPzUB.exe
  2⤵
  PID:2928
- C:\Windows\System\PkctjMn.exe
  C:\Windows\System\PkctjMn.exe
  2⤵
  PID:3440
- C:\Windows\System\LJNjDgt.exe
  C:\Windows\System\LJNjDgt.exe
  2⤵
  PID:4412
- C:\Windows\System\xJnCrlZ.exe
  C:\Windows\System\xJnCrlZ.exe
  2⤵
  PID:5876
- C:\Windows\System\MuDyarf.exe
  C:\Windows\System\MuDyarf.exe
  2⤵
  PID:744
- C:\Windows\System\OkGkpYz.exe
  C:\Windows\System\OkGkpYz.exe
  2⤵
  PID:6464
- C:\Windows\System\srnZyBw.exe
  C:\Windows\System\srnZyBw.exe
  2⤵
  PID:6500
- C:\Windows\System\DlMGfHf.exe
  C:\Windows\System\DlMGfHf.exe
  2⤵
  PID:2284
- C:\Windows\System\oylCwOo.exe
  C:\Windows\System\oylCwOo.exe
  2⤵
  PID:4760
- C:\Windows\System\nrcUbGE.exe
  C:\Windows\System\nrcUbGE.exe
  2⤵
  PID:5104
- C:\Windows\System\FRIMIcG.exe
  C:\Windows\System\FRIMIcG.exe
  2⤵
  PID:3168
- C:\Windows\System\ormFhte.exe
  C:\Windows\System\ormFhte.exe
  2⤵
  PID:6584
- C:\Windows\System\eNPcQSN.exe
  C:\Windows\System\eNPcQSN.exe
  2⤵
  PID:2784
- C:\Windows\System\EZxuaBF.exe
  C:\Windows\System\EZxuaBF.exe
  2⤵
  PID:1108
- C:\Windows\System\GYWSOrZ.exe
  C:\Windows\System\GYWSOrZ.exe
  2⤵
  PID:5424
- C:\Windows\System\xEZGUXr.exe
  C:\Windows\System\xEZGUXr.exe
  2⤵
  PID:1928
- C:\Windows\System\peIEwbw.exe
  C:\Windows\System\peIEwbw.exe
  2⤵
  PID:5716
- C:\Windows\System\hZsjKux.exe
  C:\Windows\System\hZsjKux.exe
  2⤵
  PID:12612
- C:\Windows\System\OUHkomR.exe
  C:\Windows\System\OUHkomR.exe
  2⤵
  PID:7040
- C:\Windows\System\UrukCKK.exe
  C:\Windows\System\UrukCKK.exe
  2⤵
  PID:5972
- C:\Windows\System\URfClhJ.exe
  C:\Windows\System\URfClhJ.exe
  2⤵
  PID:4812
- C:\Windows\System\ChGWQnj.exe
  C:\Windows\System\ChGWQnj.exe
  2⤵
  PID:8208
- C:\Windows\System\txfaCDX.exe
  C:\Windows\System\txfaCDX.exe
  2⤵
  PID:2204
- C:\Windows\System\qiAifJT.exe
  C:\Windows\System\qiAifJT.exe
  2⤵
  PID:3656
- C:\Windows\System\jwZQrqB.exe
  C:\Windows\System\jwZQrqB.exe
  2⤵
  PID:9296
- C:\Windows\System\mgIgaWt.exe
  C:\Windows\System\mgIgaWt.exe
  2⤵
  PID:6124
- C:\Windows\System\dQhrbkO.exe
  C:\Windows\System\dQhrbkO.exe
  2⤵
  PID:7140
- C:\Windows\System\LsAoOnO.exe
  C:\Windows\System\LsAoOnO.exe
  2⤵
  PID:9348
- C:\Windows\System\mywcRUl.exe
  C:\Windows\System\mywcRUl.exe
  2⤵
  PID:9376
- C:\Windows\System\cxowCMA.exe
  C:\Windows\System\cxowCMA.exe
  2⤵
  PID:6172
- C:\Windows\System\mGPivRR.exe
  C:\Windows\System\mGPivRR.exe
  2⤵
  PID:116
- C:\Windows\System\jrXtKDd.exe
  C:\Windows\System\jrXtKDd.exe
  2⤵
  PID:6272
- C:\Windows\System\CtKspLZ.exe
  C:\Windows\System\CtKspLZ.exe
  2⤵
  PID:2160
- C:\Windows\System\zJuKjsJ.exe
  C:\Windows\System\zJuKjsJ.exe
  2⤵
  PID:6424
- C:\Windows\System\TUmnfXm.exe
  C:\Windows\System\TUmnfXm.exe
  2⤵
  PID:9512
- C:\Windows\System\qklFukH.exe
  C:\Windows\System\qklFukH.exe
  2⤵
  PID:1876
- C:\Windows\System\aAEIxDI.exe
  C:\Windows\System\aAEIxDI.exe
  2⤵
  PID:9540
- C:\Windows\System\piAuwQq.exe
  C:\Windows\System\piAuwQq.exe
  2⤵
  PID:9576
- C:\Windows\System\suJCzds.exe
  C:\Windows\System\suJCzds.exe
  2⤵
  PID:6792
- C:\Windows\System\RsixqXv.exe
  C:\Windows\System\RsixqXv.exe
  2⤵
  PID:9596
- C:\Windows\System\KnIATLf.exe
  C:\Windows\System\KnIATLf.exe
  2⤵
  PID:7120
- C:\Windows\System\LMqVmIf.exe
  C:\Windows\System\LMqVmIf.exe
  2⤵
  PID:6444
- C:\Windows\System\FhIOLoo.exe
  C:\Windows\System\FhIOLoo.exe
  2⤵
  PID:3484
- C:\Windows\System\LiWUfyD.exe
  C:\Windows\System\LiWUfyD.exe
  2⤵
  PID:4644
- C:\Windows\System\YZvRSrV.exe
  C:\Windows\System\YZvRSrV.exe
  2⤵
  PID:6788
- C:\Windows\System\TtQJCEM.exe
  C:\Windows\System\TtQJCEM.exe
  2⤵
  PID:6504
- C:\Windows\System\zlSYKpT.exe
  C:\Windows\System\zlSYKpT.exe
  2⤵
  PID:6876
- C:\Windows\System\THREPIw.exe
  C:\Windows\System\THREPIw.exe
  2⤵
  PID:7172
- C:\Windows\System\uwdwtLu.exe
  C:\Windows\System\uwdwtLu.exe
  2⤵
  PID:7184
- C:\Windows\System\ANdLbIT.exe
  C:\Windows\System\ANdLbIT.exe
  2⤵
  PID:7248
- C:\Windows\System\saHrIxm.exe
  C:\Windows\System\saHrIxm.exe
  2⤵
  PID:9820
- C:\Windows\System\JHnHnxU.exe
  C:\Windows\System\JHnHnxU.exe
  2⤵
  PID:9848
- C:\Windows\System\TVeFaVm.exe
  C:\Windows\System\TVeFaVm.exe
  2⤵
  PID:9876
- C:\Windows\System\hCIfawq.exe
  C:\Windows\System\hCIfawq.exe
  2⤵
  PID:7708
- C:\Windows\System\WivNVKJ.exe
  C:\Windows\System\WivNVKJ.exe
  2⤵
  PID:7764
- C:\Windows\System\QpLJaCz.exe
  C:\Windows\System\QpLJaCz.exe
  2⤵
  PID:9904
- C:\Windows\System\VAtcePd.exe
  C:\Windows\System\VAtcePd.exe
  2⤵
  PID:7832
- C:\Windows\System\GTJMvLI.exe
  C:\Windows\System\GTJMvLI.exe
  2⤵
  PID:7944
- C:\Windows\System\bLDlBBK.exe
  C:\Windows\System\bLDlBBK.exe
  2⤵
  PID:9996
- C:\Windows\System\NpHtRgc.exe
  C:\Windows\System\NpHtRgc.exe
  2⤵
  PID:10020
- C:\Windows\System\ugxbHkZ.exe
  C:\Windows\System\ugxbHkZ.exe
  2⤵
  PID:8184
- C:\Windows\System\ZMosGJc.exe
  C:\Windows\System\ZMosGJc.exe
  2⤵
  PID:7264
- C:\Windows\System\KdXfcyY.exe
  C:\Windows\System\KdXfcyY.exe
  2⤵
  PID:7484
- C:\Windows\System\iGXWXHV.exe
  C:\Windows\System\iGXWXHV.exe
  2⤵
  PID:10100
- C:\Windows\System\dOhVdvr.exe
  C:\Windows\System\dOhVdvr.exe
  2⤵
  PID:7872
- C:\Windows\System\LBZIhUu.exe
  C:\Windows\System\LBZIhUu.exe
  2⤵
  PID:10128
- C:\Windows\System\BewzmCO.exe
  C:\Windows\System\BewzmCO.exe
  2⤵
  PID:10164
- C:\Windows\System\SFmPzPF.exe
  C:\Windows\System\SFmPzPF.exe
  2⤵
  PID:6148
- C:\Windows\System\UtAnPsm.exe
  C:\Windows\System\UtAnPsm.exe
  2⤵
  PID:7928
- C:\Windows\System\xGMbewz.exe
  C:\Windows\System\xGMbewz.exe
  2⤵
  PID:7612
- C:\Windows\System\JEnSYXa.exe
  C:\Windows\System\JEnSYXa.exe
  2⤵
  PID:7660
- C:\Windows\System\viMBoEf.exe
  C:\Windows\System\viMBoEf.exe
  2⤵
  PID:8276
- C:\Windows\System\JFGjaUC.exe
  C:\Windows\System\JFGjaUC.exe
  2⤵
  PID:8360
- C:\Windows\System\iOYBOsI.exe
  C:\Windows\System\iOYBOsI.exe
  2⤵
  PID:8444
- C:\Windows\System\WLMmiqf.exe
  C:\Windows\System\WLMmiqf.exe
  2⤵
  PID:8500
- C:\Windows\System\SfHhTyS.exe
  C:\Windows\System\SfHhTyS.exe
  2⤵
  PID:8592
- C:\Windows\System\AWrVEQe.exe
  C:\Windows\System\AWrVEQe.exe
  2⤵
  PID:8676
- C:\Windows\System\DyQClcn.exe
  C:\Windows\System\DyQClcn.exe
  2⤵
  PID:8760
- C:\Windows\System\sMMNiYc.exe
  C:\Windows\System\sMMNiYc.exe
  2⤵
  PID:8836
- C:\Windows\System\qyMXkWQ.exe
  C:\Windows\System\qyMXkWQ.exe
  2⤵
  PID:8904
- C:\Windows\System\OrpKJeo.exe
  C:\Windows\System\OrpKJeo.exe
  2⤵
  PID:9488
- C:\Windows\System\gOdPPAH.exe
  C:\Windows\System\gOdPPAH.exe
  2⤵
  PID:8988
- C:\Windows\System\ItrbhvA.exe
  C:\Windows\System\ItrbhvA.exe
  2⤵
  PID:9548
- C:\Windows\System\ZeInjPv.exe
  C:\Windows\System\ZeInjPv.exe
  2⤵
  PID:9124
- C:\Windows\System\AlLpiQn.exe
  C:\Windows\System\AlLpiQn.exe
  2⤵
  PID:5692
- C:\Windows\System\LobAwnI.exe
  C:\Windows\System\LobAwnI.exe
  2⤵
  PID:9204
- C:\Windows\System\UklwDxu.exe
  C:\Windows\System\UklwDxu.exe
  2⤵
  PID:3180
- C:\Windows\System\GxllozI.exe
  C:\Windows\System\GxllozI.exe
  2⤵
  PID:4472
- C:\Windows\System\OhWKiyI.exe
  C:\Windows\System\OhWKiyI.exe
  2⤵
  PID:8540
- C:\Windows\System\RTkMScX.exe
  C:\Windows\System\RTkMScX.exe
  2⤵
  PID:4964
- C:\Windows\System\KLYqRwM.exe
  C:\Windows\System\KLYqRwM.exe
  2⤵
  PID:13140
- C:\Windows\System\bEsIWUb.exe
  C:\Windows\System\bEsIWUb.exe
  2⤵
  PID:5236
- C:\Windows\System\QFiFaTw.exe
  C:\Windows\System\QFiFaTw.exe
  2⤵
  PID:8764
- C:\Windows\System\LbhhrcW.exe
  C:\Windows\System\LbhhrcW.exe
  2⤵
  PID:4652
- C:\Windows\System\CKhbzJb.exe
  C:\Windows\System\CKhbzJb.exe
  2⤵
  PID:5316
- C:\Windows\System\RXaGPoG.exe
  C:\Windows\System\RXaGPoG.exe
  2⤵
  PID:6688
- C:\Windows\System\EalJaye.exe
  C:\Windows\System\EalJaye.exe
  2⤵
  PID:10184
- C:\Windows\System\xPdcbvj.exe
  C:\Windows\System\xPdcbvj.exe
  2⤵
  PID:1980
- C:\Windows\System\riBZbPx.exe
  C:\Windows\System\riBZbPx.exe
  2⤵
  PID:5976
- C:\Windows\System\fWeirCv.exe
  C:\Windows\System\fWeirCv.exe
  2⤵
  PID:9292
- C:\Windows\System\dYgrCBz.exe
  C:\Windows\System\dYgrCBz.exe
  2⤵
  PID:1864
- C:\Windows\System\ikOQLKR.exe
  C:\Windows\System\ikOQLKR.exe
  2⤵
  PID:9128
- C:\Windows\System\MUmAaGa.exe
  C:\Windows\System\MUmAaGa.exe
  2⤵
  PID:2984
- C:\Windows\System\iSOQXQK.exe
  C:\Windows\System\iSOQXQK.exe
  2⤵
  PID:8236
- C:\Windows\System\sOfBkxq.exe
  C:\Windows\System\sOfBkxq.exe
  2⤵
  PID:5768
- C:\Windows\System\DxuTjMH.exe
  C:\Windows\System\DxuTjMH.exe
  2⤵
  PID:3304
- C:\Windows\System\hVAnHVS.exe
  C:\Windows\System\hVAnHVS.exe
  2⤵
  PID:6772
- C:\Windows\System\LZkQbKS.exe
  C:\Windows\System\LZkQbKS.exe
  2⤵
  PID:10032
- C:\Windows\System\IsBXESb.exe
  C:\Windows\System\IsBXESb.exe
  2⤵
  PID:3452
- C:\Windows\System\aYphyuj.exe
  C:\Windows\System\aYphyuj.exe
  2⤵
  PID:6808
- C:\Windows\System\qaeDTUs.exe
  C:\Windows\System\qaeDTUs.exe
  2⤵
  PID:12352
- C:\Windows\System\TmwMJJA.exe
  C:\Windows\System\TmwMJJA.exe
  2⤵
  PID:4876
- C:\Windows\System\gJyVgZt.exe
  C:\Windows\System\gJyVgZt.exe
  2⤵
  PID:2428
- C:\Windows\System\wjbuqkk.exe
  C:\Windows\System\wjbuqkk.exe
  2⤵
  PID:10256
- C:\Windows\System\urDKuho.exe
  C:\Windows\System\urDKuho.exe
  2⤵
  PID:10340
- C:\Windows\System\oCTloDW.exe
  C:\Windows\System\oCTloDW.exe
  2⤵
  PID:10456
- C:\Windows\System\KCkBmUZ.exe
  C:\Windows\System\KCkBmUZ.exe
  2⤵
  PID:10536
- C:\Windows\System\vFrHDXh.exe
  C:\Windows\System\vFrHDXh.exe
  2⤵
  PID:10648
- C:\Windows\System\nNsUbUE.exe
  C:\Windows\System\nNsUbUE.exe
  2⤵
  PID:10732
- C:\Windows\System\BKcMEmS.exe
  C:\Windows\System\BKcMEmS.exe
  2⤵
  PID:10816
- C:\Windows\System\RTYGOLi.exe
  C:\Windows\System\RTYGOLi.exe
  2⤵
  PID:10936
- C:\Windows\System\XmIXDLq.exe
  C:\Windows\System\XmIXDLq.exe
  2⤵
  PID:11020
- C:\Windows\System\JJHChVG.exe
  C:\Windows\System\JJHChVG.exe
  2⤵
  PID:11160
- C:\Windows\System\zxeDZeK.exe
  C:\Windows\System\zxeDZeK.exe
  2⤵
  PID:10244
- C:\Windows\System\jxavIth.exe
  C:\Windows\System\jxavIth.exe
  2⤵
  PID:1948
- C:\Windows\System\HwShkTn.exe
  C:\Windows\System\HwShkTn.exe
  2⤵
  PID:5800
- C:\Windows\System\FClHIoy.exe
  C:\Windows\System\FClHIoy.exe
  2⤵
  PID:10524
- C:\Windows\System\WGhwjUt.exe
  C:\Windows\System\WGhwjUt.exe
  2⤵
  PID:9164
- C:\Windows\System\RQLBlAl.exe
  C:\Windows\System\RQLBlAl.exe
  2⤵
  PID:10576
- C:\Windows\System\iNBWCbH.exe
  C:\Windows\System\iNBWCbH.exe
  2⤵
  PID:10720
- C:\Windows\System\QpTtvBp.exe
  C:\Windows\System\QpTtvBp.exe
  2⤵
  PID:6036
- C:\Windows\System\gykpawT.exe
  C:\Windows\System\gykpawT.exe
  2⤵
  PID:5512
- C:\Windows\System\FsqnrqL.exe
  C:\Windows\System\FsqnrqL.exe
  2⤵
  PID:6072
- C:\Windows\System\wYjbzvs.exe
  C:\Windows\System\wYjbzvs.exe
  2⤵
  PID:9136
- C:\Windows\System\pkagVbZ.exe
  C:\Windows\System\pkagVbZ.exe
  2⤵
  PID:1788
- C:\Windows\System\cIgXuHH.exe
  C:\Windows\System\cIgXuHH.exe
  2⤵
  PID:6248
- C:\Windows\System\vSyQIaP.exe
  C:\Windows\System\vSyQIaP.exe
  2⤵
  PID:6076
- C:\Windows\System\GjHfLBI.exe
  C:\Windows\System\GjHfLBI.exe
  2⤵
  PID:8856
- C:\Windows\System\ITihNDA.exe
  C:\Windows\System\ITihNDA.exe
  2⤵
  PID:3416
- C:\Windows\System\VPcECXo.exe
  C:\Windows\System\VPcECXo.exe
  2⤵
  PID:3828
- C:\Windows\System\NOeKHGp.exe
  C:\Windows\System\NOeKHGp.exe
  2⤵
  PID:6304
- C:\Windows\System\CbVuaww.exe
  C:\Windows\System\CbVuaww.exe
  2⤵
  PID:10464
- C:\Windows\System\NxvfTUB.exe
  C:\Windows\System\NxvfTUB.exe
  2⤵
  PID:10744
- C:\Windows\System\PBqGwfT.exe
  C:\Windows\System\PBqGwfT.exe
  2⤵
  PID:11028
- C:\Windows\System\PkaaUSL.exe
  C:\Windows\System\PkaaUSL.exe
  2⤵
  PID:6140
- C:\Windows\System\RuUTAgF.exe
  C:\Windows\System\RuUTAgF.exe
  2⤵
  PID:7136
- C:\Windows\System\ywaCHuf.exe
  C:\Windows\System\ywaCHuf.exe
  2⤵
  PID:11280
- C:\Windows\System\FHhuCYH.exe
  C:\Windows\System\FHhuCYH.exe
  2⤵
  PID:4040
- C:\Windows\System\dNjPprN.exe
  C:\Windows\System\dNjPprN.exe
  2⤵
  PID:11428
- C:\Windows\System\xedmwjC.exe
  C:\Windows\System\xedmwjC.exe
  2⤵
  PID:11484
- C:\Windows\System\aEDgvSM.exe
  C:\Windows\System\aEDgvSM.exe
  2⤵
  PID:11540
- C:\Windows\System\aEeVaig.exe
  C:\Windows\System\aEeVaig.exe
  2⤵
  PID:3564
- C:\Windows\System\SyGJAtL.exe
  C:\Windows\System\SyGJAtL.exe
  2⤵
  PID:11652
- C:\Windows\System\hfJehBR.exe
  C:\Windows\System\hfJehBR.exe
  2⤵
  PID:11700
- C:\Windows\System\KNWwBcX.exe
  C:\Windows\System\KNWwBcX.exe
  2⤵
  PID:11792
- C:\Windows\System\nxmuKcx.exe
  C:\Windows\System\nxmuKcx.exe
  2⤵
  PID:11848
- C:\Windows\System\tzjOkux.exe
  C:\Windows\System\tzjOkux.exe
  2⤵
  PID:6624
- C:\Windows\System\lMnGFAW.exe
  C:\Windows\System\lMnGFAW.exe
  2⤵
  PID:11952
- C:\Windows\System\sDOOHlZ.exe
  C:\Windows\System\sDOOHlZ.exe
  2⤵
  PID:4768
- C:\Windows\System\jiOimqZ.exe
  C:\Windows\System\jiOimqZ.exe
  2⤵
  PID:12132
- C:\Windows\System\OISsCAo.exe
  C:\Windows\System\OISsCAo.exe
  2⤵
  PID:5200
- C:\Windows\System\mFijmdV.exe
  C:\Windows\System\mFijmdV.exe
  2⤵
  PID:5244
- C:\Windows\System\KOTjFkS.exe
  C:\Windows\System\KOTjFkS.exe
  2⤵
  PID:6848
- C:\Windows\System\eOQMoqj.exe
  C:\Windows\System\eOQMoqj.exe
  2⤵
  PID:11368
- C:\Windows\System\LHggYzr.exe
  C:\Windows\System\LHggYzr.exe
  2⤵
  PID:11488
- C:\Windows\System\fpkZjpt.exe
  C:\Windows\System\fpkZjpt.exe
  2⤵
  PID:9660
- C:\Windows\System\puqHkRb.exe
  C:\Windows\System\puqHkRb.exe
  2⤵
  PID:11904
- C:\Windows\System\ruqiBpT.exe
  C:\Windows\System\ruqiBpT.exe
  2⤵
  PID:12016
- C:\Windows\System\PWkwErp.exe
  C:\Windows\System\PWkwErp.exe
  2⤵
  PID:12080
- C:\Windows\System\pNwMDmU.exe
  C:\Windows\System\pNwMDmU.exe
  2⤵
  PID:7128
- C:\Windows\System\loMQxye.exe
  C:\Windows\System\loMQxye.exe
  2⤵
  PID:11732
- C:\Windows\System\wdsOJBN.exe
  C:\Windows\System\wdsOJBN.exe
  2⤵
  PID:5772
- C:\Windows\System\wlkAQWk.exe
  C:\Windows\System\wlkAQWk.exe
  2⤵
  PID:1468
- C:\Windows\System\JDyxYMI.exe
  C:\Windows\System\JDyxYMI.exe
  2⤵
  PID:11296
- C:\Windows\System\OELUzQQ.exe
  C:\Windows\System\OELUzQQ.exe
  2⤵
  PID:1572
- C:\Windows\System\SMIFMiN.exe
  C:\Windows\System\SMIFMiN.exe
  2⤵
  PID:7200
- C:\Windows\System\rXtgPjr.exe
  C:\Windows\System\rXtgPjr.exe
  2⤵
  PID:12340
- C:\Windows\System\exMjRXA.exe
  C:\Windows\System\exMjRXA.exe
  2⤵
  PID:12428
- C:\Windows\System\kzapJCw.exe
  C:\Windows\System\kzapJCw.exe
  2⤵
  PID:12488
- C:\Windows\System\gNdNtAA.exe
  C:\Windows\System\gNdNtAA.exe
  2⤵
  PID:7368
- C:\Windows\System\AFahKIK.exe
  C:\Windows\System\AFahKIK.exe
  2⤵
  PID:12556
- C:\Windows\System\Tnvmlra.exe
  C:\Windows\System\Tnvmlra.exe
  2⤵
  PID:12624
- C:\Windows\System\pLvYRns.exe
  C:\Windows\System\pLvYRns.exe
  2⤵
  PID:12680
- C:\Windows\System\kWNHHnn.exe
  C:\Windows\System\kWNHHnn.exe
  2⤵
  PID:12764
- C:\Windows\System\uSMiapX.exe
  C:\Windows\System\uSMiapX.exe
  2⤵
  PID:516
- C:\Windows\System\hucMRlE.exe
  C:\Windows\System\hucMRlE.exe
  2⤵
  PID:4764
- C:\Windows\System\DGvifdV.exe
  C:\Windows\System\DGvifdV.exe
  2⤵
  PID:3620
- C:\Windows\System\aznYEnM.exe
  C:\Windows\System\aznYEnM.exe
  2⤵
  PID:12844
- C:\Windows\System\ksgcHPz.exe
  C:\Windows\System\ksgcHPz.exe
  2⤵
  PID:7868
- C:\Windows\System\xKkuCBL.exe
  C:\Windows\System\xKkuCBL.exe
  2⤵
  PID:8072
- C:\Windows\System\qPlEPYI.exe
  C:\Windows\System\qPlEPYI.exe
  2⤵
  PID:8092
- C:\Windows\System\QMOrFGT.exe
  C:\Windows\System\QMOrFGT.exe
  2⤵
  PID:7208
- C:\Windows\System\SjjOdLf.exe
  C:\Windows\System\SjjOdLf.exe
  2⤵
  PID:13080
- C:\Windows\System\zSvymgT.exe
  C:\Windows\System\zSvymgT.exe
  2⤵
  PID:13128
- C:\Windows\System\ffpLNQf.exe
  C:\Windows\System\ffpLNQf.exe
  2⤵
  PID:13188
- C:\Windows\System\zQzYdUt.exe
  C:\Windows\System\zQzYdUt.exe
  2⤵
  PID:13240
- C:\Windows\System\tGIeHYn.exe
  C:\Windows\System\tGIeHYn.exe
  2⤵
  PID:12328
- C:\Windows\System\CUziSmk.exe
  C:\Windows\System\CUziSmk.exe
  2⤵
  PID:12436
- C:\Windows\System\bJWodyd.exe
  C:\Windows\System\bJWodyd.exe
  2⤵
  PID:12576
- C:\Windows\System\QOQhAyt.exe
  C:\Windows\System\QOQhAyt.exe
  2⤵
  PID:7280
- C:\Windows\System\nccAePw.exe
  C:\Windows\System\nccAePw.exe
  2⤵
  PID:7532
- C:\Windows\System\SUQKeFV.exe
  C:\Windows\System\SUQKeFV.exe
  2⤵
  PID:8180
- C:\Windows\System\lMcPdhP.exe
  C:\Windows\System\lMcPdhP.exe
  2⤵
  PID:13168
- C:\Windows\System\wzPdcwf.exe
  C:\Windows\System\wzPdcwf.exe
  2⤵
  PID:7632
- C:\Windows\System\QVQszIv.exe
  C:\Windows\System\QVQszIv.exe
  2⤵
  PID:12720
- C:\Windows\System\EzaeMVW.exe
  C:\Windows\System\EzaeMVW.exe
  2⤵
  PID:8424
- C:\Windows\System\rojbzKO.exe
  C:\Windows\System\rojbzKO.exe
  2⤵
  PID:9300
- C:\Windows\System\cCTYqgk.exe
  C:\Windows\System\cCTYqgk.exe
  2⤵
  PID:8732
- C:\Windows\System\MlJvGFy.exe
  C:\Windows\System\MlJvGFy.exe
  2⤵
  PID:9412
- C:\Windows\System\TvmIcyM.exe
  C:\Windows\System\TvmIcyM.exe
  2⤵
  PID:7760
- C:\Windows\System\ohmYDJp.exe
  C:\Windows\System\ohmYDJp.exe
  2⤵
  PID:9148
- C:\Windows\System\lNVrswX.exe
  C:\Windows\System\lNVrswX.exe
  2⤵
  PID:6604
- C:\Windows\System\hrTFEjl.exe
  C:\Windows\System\hrTFEjl.exe
  2⤵
  PID:2608
- C:\Windows\System\HHLDgbq.exe
  C:\Windows\System\HHLDgbq.exe
  2⤵
  PID:2124
- C:\Windows\System\JKjlixB.exe
  C:\Windows\System\JKjlixB.exe
  2⤵
  PID:5296
- C:\Windows\System\qdvoKKC.exe
  C:\Windows\System\qdvoKKC.exe
  2⤵
  PID:7616
- C:\Windows\System\jUzhBCa.exe
  C:\Windows\System\jUzhBCa.exe
  2⤵
  PID:5836
- C:\Windows\System\BLFhTgT.exe
  C:\Windows\System\BLFhTgT.exe
  2⤵
  PID:6720
- C:\Windows\System\hBQDdRt.exe
  C:\Windows\System\hBQDdRt.exe
  2⤵
  PID:9740
- C:\Windows\System\lixRVaP.exe
  C:\Windows\System\lixRVaP.exe
  2⤵
  PID:1388
- C:\Windows\System\VvNeHbc.exe
  C:\Windows\System\VvNeHbc.exe
  2⤵
  PID:5844
- C:\Windows\System\aPNusNj.exe
  C:\Windows\System\aPNusNj.exe
  2⤵
  PID:4452
- C:\Windows\System\jxlqdHL.exe
  C:\Windows\System\jxlqdHL.exe
  2⤵
  PID:6816
- C:\Windows\System\PQZSyZK.exe
  C:\Windows\System\PQZSyZK.exe
  2⤵
  PID:1500
- C:\Windows\System\enpEdZy.exe
  C:\Windows\System\enpEdZy.exe
  2⤵
  PID:10380
- C:\Windows\System\LoVkgWk.exe
  C:\Windows\System\LoVkgWk.exe
  2⤵
  PID:10624
- C:\Windows\System\wFqRvNR.exe
  C:\Windows\System\wFqRvNR.exe
  2⤵
  PID:10820
- C:\Windows\System\JdJwYhn.exe
  C:\Windows\System\JdJwYhn.exe
  2⤵
  PID:11076
- C:\Windows\System\JMQWAiK.exe
  C:\Windows\System\JMQWAiK.exe
  2⤵
  PID:11236
- C:\Windows\System\OJpmEYs.exe
  C:\Windows\System\OJpmEYs.exe
  2⤵
  PID:8616
- C:\Windows\System\LaPImHF.exe
  C:\Windows\System\LaPImHF.exe
  2⤵
  PID:8996
- C:\Windows\System\bQqYYTa.exe
  C:\Windows\System\bQqYYTa.exe
  2⤵
  PID:8756
- C:\Windows\System\kefMHTo.exe
  C:\Windows\System\kefMHTo.exe
  2⤵
  PID:920
- C:\Windows\System\UXwFeAd.exe
  C:\Windows\System\UXwFeAd.exe
  2⤵
  PID:1552
- C:\Windows\System\kdZgfQw.exe
  C:\Windows\System\kdZgfQw.exe
  2⤵
  PID:6212
- C:\Windows\System\uuSKXnU.exe
  C:\Windows\System\uuSKXnU.exe
  2⤵
  PID:4444
- C:\Windows\System\vSTJwCG.exe
  C:\Windows\System\vSTJwCG.exe
  2⤵
  PID:5540
- C:\Windows\System\DIHQOzU.exe
  C:\Windows\System\DIHQOzU.exe
  2⤵
  PID:7080
- C:\Windows\System\WTTbiEV.exe
  C:\Windows\System\WTTbiEV.exe
  2⤵
  PID:1168
- C:\Windows\System\QgbVdnl.exe
  C:\Windows\System\QgbVdnl.exe
  2⤵
  PID:4328
- C:\Windows\System\OAzsxHe.exe
  C:\Windows\System\OAzsxHe.exe
  2⤵
  PID:11316
- C:\Windows\System\kxbJKwp.exe
  C:\Windows\System\kxbJKwp.exe
  2⤵
  PID:11448
- C:\Windows\System\hGOwpcX.exe
  C:\Windows\System\hGOwpcX.exe
  2⤵
  PID:11588
- C:\Windows\System\ghxvkfG.exe
  C:\Windows\System\ghxvkfG.exe
  2⤵
  PID:11736
- C:\Windows\System\ObwssYN.exe
  C:\Windows\System\ObwssYN.exe
  2⤵
  PID:6560
- C:\Windows\System\iDnNVju.exe
  C:\Windows\System\iDnNVju.exe
  2⤵
  PID:12040
- C:\Windows\System\VbUyGac.exe
  C:\Windows\System\VbUyGac.exe
  2⤵
  PID:12188
- C:\Windows\System\zZTOPpV.exe
  C:\Windows\System\zZTOPpV.exe
  2⤵
  PID:11312
- C:\Windows\System\TLPDtpo.exe
  C:\Windows\System\TLPDtpo.exe
  2⤵
  PID:11660
- C:\Windows\System\lzbSjyd.exe
  C:\Windows\System\lzbSjyd.exe
  2⤵
  PID:9688
- C:\Windows\System\gSMqSuG.exe
  C:\Windows\System\gSMqSuG.exe
  2⤵
  PID:12048
- C:\Windows\System\nMSyfzK.exe
  C:\Windows\System\nMSyfzK.exe
  2⤵
  PID:2308
- C:\Windows\System\YeCcDpP.exe
  C:\Windows\System\YeCcDpP.exe
  2⤵
  PID:11624
- C:\Windows\System\tLiWioO.exe
  C:\Windows\System\tLiWioO.exe
  2⤵
  PID:12320
- C:\Windows\System\rBjvNkS.exe
  C:\Windows\System\rBjvNkS.exe
  2⤵
  PID:12452
- C:\Windows\System\SBEJXxP.exe
  C:\Windows\System\SBEJXxP.exe
  2⤵
  PID:12600
- C:\Windows\System\cKNZzZJ.exe
  C:\Windows\System\cKNZzZJ.exe
  2⤵
  PID:12736
- C:\Windows\System\tosIqkQ.exe
  C:\Windows\System\tosIqkQ.exe
  2⤵
  PID:2104
- C:\Windows\System\FncAYEk.exe
  C:\Windows\System\FncAYEk.exe
  2⤵
  PID:12840
- C:\Windows\System\PCBtOGX.exe
  C:\Windows\System\PCBtOGX.exe
  2⤵
  PID:12876
- C:\Windows\System\IKWKeQs.exe
  C:\Windows\System\IKWKeQs.exe
  2⤵
  PID:7288
- C:\Windows\System\nHPZedG.exe
  C:\Windows\System\nHPZedG.exe
  2⤵
  PID:7336
- C:\Windows\System\NbxOTzo.exe
  C:\Windows\System\NbxOTzo.exe
  2⤵
  PID:11824
- C:\Windows\System\kCADIuy.exe
  C:\Windows\System\kCADIuy.exe
  2⤵
  PID:12464
- C:\Windows\System\MDhljaJ.exe
  C:\Windows\System\MDhljaJ.exe
  2⤵
  PID:12776
- C:\Windows\System\sSsupzO.exe
  C:\Windows\System\sSsupzO.exe
  2⤵
  PID:13104
- C:\Windows\System\lFfqKzw.exe
  C:\Windows\System\lFfqKzw.exe
  2⤵
  PID:12580
- C:\Windows\System\QtEkhvu.exe
  C:\Windows\System\QtEkhvu.exe
  2⤵
  PID:8552
- C:\Windows\System\DzvMYOu.exe
  C:\Windows\System\DzvMYOu.exe
  2⤵
  PID:8980
- C:\Windows\System\FiHpzyy.exe
  C:\Windows\System\FiHpzyy.exe
  2⤵
  PID:8448
- C:\Windows\System\bDuxuPb.exe
  C:\Windows\System\bDuxuPb.exe
  2⤵
  PID:4148
- C:\Windows\System\nCliBOq.exe
  C:\Windows\System\nCliBOq.exe
  2⤵
  PID:7624
- C:\Windows\System\mYRrbKl.exe
  C:\Windows\System\mYRrbKl.exe
  2⤵
  PID:6040
- C:\Windows\System\WZufEWr.exe
  C:\Windows\System\WZufEWr.exe
  2⤵
  PID:5336
- C:\Windows\System\MZyPrRk.exe
  C:\Windows\System\MZyPrRk.exe
  2⤵
  PID:5320
- C:\Windows\System\KbiJxrE.exe
  C:\Windows\System\KbiJxrE.exe
  2⤵
  PID:10344
- C:\Windows\System\HELaYrf.exe
  C:\Windows\System\HELaYrf.exe
  2⤵
  PID:10964
- C:\Windows\System\sDsEqkJ.exe
  C:\Windows\System\sDsEqkJ.exe
  2⤵
  PID:6884
- C:\Windows\System\tzRwBTn.exe
  C:\Windows\System\tzRwBTn.exe
  2⤵
  PID:5472
- C:\Windows\System\ctsmzqW.exe
  C:\Windows\System\ctsmzqW.exe
  2⤵
  PID:4508
- C:\Windows\System\OOfcaaO.exe
  C:\Windows\System\OOfcaaO.exe
  2⤵
  PID:11024
- C:\Windows\System\rcnWdvM.exe
  C:\Windows\System\rcnWdvM.exe
  2⤵
  PID:1064
- C:\Windows\System\rMfhSmk.exe
  C:\Windows\System\rMfhSmk.exe
  2⤵
  PID:13200
- C:\Windows\System\IFXOnvd.exe
  C:\Windows\System\IFXOnvd.exe
  2⤵
  PID:6300
- C:\Windows\System\YvbifvZ.exe
  C:\Windows\System\YvbifvZ.exe
  2⤵
  PID:11964
- C:\Windows\System\GxfyIvz.exe
  C:\Windows\System\GxfyIvz.exe
  2⤵
  PID:12272
- C:\Windows\System\CjnIrHZ.exe
  C:\Windows\System\CjnIrHZ.exe
  2⤵
  PID:12100
- C:\Windows\System\ugpakYS.exe
  C:\Windows\System\ugpakYS.exe
  2⤵
  PID:12112
- C:\Windows\System\SziGLgw.exe
  C:\Windows\System\SziGLgw.exe
  2⤵
  PID:5476
- C:\Windows\System\BkHyNtv.exe
  C:\Windows\System\BkHyNtv.exe
  2⤵
  PID:12708
- C:\Windows\System\lqZmLUq.exe
  C:\Windows\System\lqZmLUq.exe
  2⤵
  PID:7804
- C:\Windows\System\SisiLOM.exe
  C:\Windows\System\SisiLOM.exe
  2⤵
  PID:13164
- C:\Windows\System\BIcjYli.exe
  C:\Windows\System\BIcjYli.exe
  2⤵
  PID:8052
- C:\Windows\System\ZDDHmwF.exe
  C:\Windows\System\ZDDHmwF.exe
  2⤵
  PID:13308
- C:\Windows\System\CeXWCgT.exe
  C:\Windows\System\CeXWCgT.exe
  2⤵
  PID:8872
- C:\Windows\System\yKOhsds.exe
  C:\Windows\System\yKOhsds.exe
  2⤵
  PID:12684
- C:\Windows\System\pDAqxKj.exe
  C:\Windows\System\pDAqxKj.exe
  2⤵
  PID:10056
- C:\Windows\System\ghWtsMq.exe
  C:\Windows\System\ghWtsMq.exe
  2⤵
  PID:5364
- C:\Windows\System\msRQTqk.exe
  C:\Windows\System\msRQTqk.exe
  2⤵
  PID:10740
- C:\Windows\System\ZPWDzQX.exe
  C:\Windows\System\ZPWDzQX.exe
  2⤵
  PID:1020
- C:\Windows\System\GgGKtbb.exe
  C:\Windows\System\GgGKtbb.exe
  2⤵
  PID:9232
- C:\Windows\System\okonWfJ.exe
  C:\Windows\System\okonWfJ.exe
  2⤵
  PID:11508
- C:\Windows\System\NmlolOy.exe
  C:\Windows\System\NmlolOy.exe
  2⤵
  PID:11932
- C:\Windows\System\JfnNelv.exe
  C:\Windows\System\JfnNelv.exe
  2⤵
  PID:11788
- C:\Windows\System\DbjfiWe.exe
  C:\Windows\System\DbjfiWe.exe
  2⤵
  PID:12396
- C:\Windows\System\EkYlnUm.exe
  C:\Windows\System\EkYlnUm.exe
  2⤵
  PID:12820
- C:\Windows\System\tziaOKU.exe
  C:\Windows\System\tziaOKU.exe
  2⤵
  PID:1132
- C:\Windows\System\WCLuHhw.exe
  C:\Windows\System\WCLuHhw.exe
  2⤵
  PID:13196
- C:\Windows\System\aLSjPNa.exe
  C:\Windows\System\aLSjPNa.exe
  2⤵
  PID:9572
- C:\Windows\System\haDQlQb.exe
  C:\Windows\System\haDQlQb.exe
  2⤵
  PID:9180
- C:\Windows\System\FzsCWbr.exe
  C:\Windows\System\FzsCWbr.exe
  2⤵
  PID:4544
- C:\Windows\System\VeYsNwO.exe
  C:\Windows\System\VeYsNwO.exe
  2⤵
  PID:12516
- C:\Windows\System\WfwXrxe.exe
  C:\Windows\System\WfwXrxe.exe
  2⤵
  PID:13244
- C:\Windows\System\Zswugyf.exe
  C:\Windows\System\Zswugyf.exe
  2⤵
  PID:3596
- C:\Windows\System\TMQmugA.exe
  C:\Windows\System\TMQmugA.exe
  2⤵
  PID:12292
- C:\Windows\System\YfyJwxM.exe
  C:\Windows\System\YfyJwxM.exe
  2⤵
  PID:1052
- C:\Windows\System\LusjXop.exe
  C:\Windows\System\LusjXop.exe
  2⤵
  PID:1576
- C:\Windows\System\RyZubEb.exe
  C:\Windows\System\RyZubEb.exe
  2⤵
  PID:13324
- C:\Windows\System\dLPgTRw.exe
  C:\Windows\System\dLPgTRw.exe
  2⤵
  PID:13352
- C:\Windows\System\nFVKfYe.exe
  C:\Windows\System\nFVKfYe.exe
  2⤵
  PID:13380
- C:\Windows\System\oOlqlRb.exe
  C:\Windows\System\oOlqlRb.exe
  2⤵
  PID:13408
- C:\Windows\System\nSmvtrJ.exe
  C:\Windows\System\nSmvtrJ.exe
  2⤵
  PID:13436
- C:\Windows\System\aGHlocC.exe
  C:\Windows\System\aGHlocC.exe
  2⤵
  PID:13464
- C:\Windows\System\EVFUPKt.exe
  C:\Windows\System\EVFUPKt.exe
  2⤵
  PID:13492
- C:\Windows\System\SJokpLU.exe
  C:\Windows\System\SJokpLU.exe
  2⤵
  PID:13520
- C:\Windows\System\YNvwSJC.exe
  C:\Windows\System\YNvwSJC.exe
  2⤵
  PID:13548
- C:\Windows\System\JZmFBzY.exe
  C:\Windows\System\JZmFBzY.exe
  2⤵
  PID:13580
- C:\Windows\System\mZMwMrU.exe
  C:\Windows\System\mZMwMrU.exe
  2⤵
  PID:13608
- C:\Windows\System\vqTrGQb.exe
  C:\Windows\System\vqTrGQb.exe
  2⤵
  PID:13636
- C:\Windows\System\KEppvUz.exe
  C:\Windows\System\KEppvUz.exe
  2⤵
  PID:13664
- C:\Windows\System\JkJbdyT.exe
  C:\Windows\System\JkJbdyT.exe
  2⤵
  PID:13692
- C:\Windows\System\qassNVZ.exe
  C:\Windows\System\qassNVZ.exe
  2⤵
  PID:13720
- C:\Windows\System\AzShGpI.exe
  C:\Windows\System\AzShGpI.exe
  2⤵
  PID:13748
- C:\Windows\System\CbAAbgl.exe
  C:\Windows\System\CbAAbgl.exe
  2⤵
  PID:13776
- C:\Windows\System\MSnQoio.exe
  C:\Windows\System\MSnQoio.exe
  2⤵
  PID:13804
- C:\Windows\System\OEWIRlf.exe
  C:\Windows\System\OEWIRlf.exe
  2⤵
  PID:13832
- C:\Windows\System\KTwYUGM.exe
  C:\Windows\System\KTwYUGM.exe
  2⤵
  PID:13860
- C:\Windows\System\yHssKtG.exe
  C:\Windows\System\yHssKtG.exe
  2⤵
  PID:13888
- C:\Windows\System\sYaddyK.exe
  C:\Windows\System\sYaddyK.exe
  2⤵
  PID:13916
- C:\Windows\System\paFNKxs.exe
  C:\Windows\System\paFNKxs.exe
  2⤵
  PID:13944
- C:\Windows\System\dEvCyAz.exe
  C:\Windows\System\dEvCyAz.exe
  2⤵
  PID:13972
- C:\Windows\System\UxixhdF.exe
  C:\Windows\System\UxixhdF.exe
  2⤵
  PID:14000
- C:\Windows\System\CmldqbZ.exe
  C:\Windows\System\CmldqbZ.exe
  2⤵
  PID:14032
- C:\Windows\System\dreQxPo.exe
  C:\Windows\System\dreQxPo.exe
  2⤵
  PID:14060
- C:\Windows\System\ZGBEJZd.exe
  C:\Windows\System\ZGBEJZd.exe
  2⤵
  PID:14088
- C:\Windows\System\KKThpzf.exe
  C:\Windows\System\KKThpzf.exe
  2⤵
  PID:14116
- C:\Windows\System\cGdHVge.exe
  C:\Windows\System\cGdHVge.exe
  2⤵
  PID:14144
- C:\Windows\System\rLDswGT.exe
  C:\Windows\System\rLDswGT.exe
  2⤵
  PID:14172
- C:\Windows\System\bghdUhg.exe
  C:\Windows\System\bghdUhg.exe
  2⤵
  PID:14200
- C:\Windows\System\hOuuaVh.exe
  C:\Windows\System\hOuuaVh.exe
  2⤵
  PID:14228
- C:\Windows\System\DdmIIuH.exe
  C:\Windows\System\DdmIIuH.exe
  2⤵
  PID:14256
- C:\Windows\System\xvpNujz.exe
  C:\Windows\System\xvpNujz.exe
  2⤵
  PID:14284
- C:\Windows\System\gHOBoVT.exe
  C:\Windows\System\gHOBoVT.exe
  2⤵
  PID:14312
- C:\Windows\System\ksKOdLq.exe
  C:\Windows\System\ksKOdLq.exe
  2⤵
  PID:13320
- C:\Windows\System\CnvLgGm.exe
  C:\Windows\System\CnvLgGm.exe
  2⤵
  PID:13360
- C:\Windows\System\UzxyJGk.exe
  C:\Windows\System\UzxyJGk.exe
  2⤵
  PID:13404
- C:\Windows\System\xWZDeup.exe
  C:\Windows\System\xWZDeup.exe
  2⤵
  PID:13460
- C:\Windows\System\jkxQKVw.exe
  C:\Windows\System\jkxQKVw.exe
  2⤵
  PID:13508
- C:\Windows\System\ayBWxHJ.exe
  C:\Windows\System\ayBWxHJ.exe
  2⤵
  PID:13576
- C:\Windows\System\kGfOpQz.exe
  C:\Windows\System\kGfOpQz.exe
  2⤵
  PID:13644
- C:\Windows\System\cgcBSTb.exe
  C:\Windows\System\cgcBSTb.exe
  2⤵
  PID:13716
- C:\Windows\System\OEDKJej.exe
  C:\Windows\System\OEDKJej.exe
  2⤵
  PID:13784
- C:\Windows\System\vPOsopa.exe
  C:\Windows\System\vPOsopa.exe
  2⤵
  PID:13820
- C:\Windows\System\ZldObne.exe
  C:\Windows\System\ZldObne.exe
  2⤵
  PID:13884
- C:\Windows\System\HaJuItK.exe
  C:\Windows\System\HaJuItK.exe
  2⤵
  PID:13940
- C:\Windows\System\EeGCPfl.exe
  C:\Windows\System\EeGCPfl.exe
  2⤵
  PID:14008
- C:\Windows\System\IKAGOPY.exe
  C:\Windows\System\IKAGOPY.exe
  2⤵
  PID:14076
- C:\Windows\System\SwLgVgL.exe
  C:\Windows\System\SwLgVgL.exe
  2⤵
  PID:14140
- C:\Windows\System\VqdaWPh.exe
  C:\Windows\System\VqdaWPh.exe
  2⤵
  PID:14208
- C:\Windows\System\UxbDvuD.exe
  C:\Windows\System\UxbDvuD.exe
  2⤵
  PID:14272
- C:\Windows\System\obGXMZj.exe
  C:\Windows\System\obGXMZj.exe
  2⤵
  PID:1804
- C:\Windows\System\ZTcHJuH.exe
  C:\Windows\System\ZTcHJuH.exe
  2⤵
  PID:13424
- C:\Windows\System\pqglDqO.exe
  C:\Windows\System\pqglDqO.exe
  2⤵
  PID:13544
- C:\Windows\System\LrHqjuj.exe
  C:\Windows\System\LrHqjuj.exe
  2⤵
  PID:13708
- C:\Windows\System\zQNMxvT.exe
  C:\Windows\System\zQNMxvT.exe
  2⤵
  PID:13856
- C:\Windows\System\WZOufXN.exe
  C:\Windows\System\WZOufXN.exe
  2⤵
  PID:13980
- C:\Windows\System\OZrzobf.exe
  C:\Windows\System\OZrzobf.exe
  2⤵
  PID:14124
- C:\Windows\System\najfsge.exe
  C:\Windows\System\najfsge.exe
  2⤵
  PID:14292
- C:\Windows\System\qVlObCt.exe
  C:\Windows\System\qVlObCt.exe
  2⤵
  PID:13528
- C:\Windows\System\GKujlyW.exe
  C:\Windows\System\GKujlyW.exe
  2⤵
  PID:13812
- C:\Windows\System\xterFwC.exe
  C:\Windows\System\xterFwC.exe
  2⤵
  PID:14180
- C:\Windows\System\ohnplVm.exe
  C:\Windows\System\ohnplVm.exe
  2⤵
  PID:13688
- C:\Windows\System\FCyPDiK.exe
  C:\Windows\System\FCyPDiK.exe
  2⤵
  PID:13632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k32vuunn.2in.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AsruuiQ.exe

Filesize
3.0MB

MD5
8ab19e8390bc81b2d96c168d2bbb9384

SHA1
64bb99a264f5214295aa08a07e929171d9cc8087

SHA256
3bd896f057e05b328832ac6cfcd0efea58627255cc5d964a1540951b0cca0ddf

SHA512
dfc79c41dcfe4627e0b052b9d0152a6de16c9790f2ce05523deedccac0606a8f94caf8c7deee107df0a53e9160f8b097f99cdc9246aca3e81361f8c69a5597eb

Download Submit
C:\Windows\System\BIztaZS.exe

Filesize
3.0MB

MD5
9358ca59b4e2b492caea9e1f4da5383a

SHA1
9e19c2424835b1a9acd3c1a3e36500e848c54b98

SHA256
5565085e9cd5aa318d1ed62a1b4eda76b181dbc9136dd60cecdcb2b8319d6c89

SHA512
65a5e1792315582ffcd5a97beb188454f9ce43ddd0c3f424da3f9d023925c5b2e574edbc2b5d003bf7539100c7e607bbb0147e7f27bbd9be56dec25de7f060ed

Download Submit
C:\Windows\System\BXZrpaf.exe

Filesize
3.0MB

MD5
2cec2940770f635eef794b390b2edb4a

SHA1
abbe3d41aa13d6bd5e5bf6fad1ec6d301942545f

SHA256
bc3623b94634300700ddf5a34f8479bd83e0eba7e99a081fa1c9532787320323

SHA512
fc7d8b6718eef8335f75bd2c9adcc3fa3be8bab7af9d05f9aa1a15bf127da1073c950bb06603b91f820e004498381e5573e30d4c6706bd5b706c4e8475c9d036

Download Submit
C:\Windows\System\CFhvHsJ.exe

Filesize
3.0MB

MD5
821aca30bf2616f134a7379c79c785fc

SHA1
04fc21ed7b5c802cfaa966dad83ac5ce8fdbb92d

SHA256
8f677361b3777d64e565adde0dfe23a9b788453d4e61d9bbadc220cfc82bde86

SHA512
ded48e57fccae1946d9588000f7e07c0cf8dcf05073c9170660fd71af8ff330a6b659891aa0c10ce3a3b41f35da76632e480010a7d81c161b5367a5557064e0b

Download Submit
C:\Windows\System\EiBNVqv.exe

Filesize
3.0MB

MD5
affaa5b3ffad9ed79ab31de66e7fe6f4

SHA1
87e1dd54750cbed81997d648b45648e75430c241

SHA256
903b9bce04901be07252587be02b57dbb2c722196b568b1a911f20f510cffc8a

SHA512
47b2ce901bcf7d9ff31895961045180a4c4452dfbef7fdc0a765b025435a98744bf0fba79d2963b027e0c40546580b5b4a664b9ce7f8f86cbd7b9bf9f48a3e96

Download Submit
C:\Windows\System\FOYLpdB.exe

Filesize
3.0MB

MD5
a3d0f14355b130cd583ecbc9ad1f1504

SHA1
6cf518b486c4a58d303140d137f9ef8cca5882ba

SHA256
8a18c38cf7838cdf69bd75fe1d2aaaedd64e5fd3342a345ded32e1452409fa15

SHA512
167e7cb3af5e48bc8c3fd35b6964ead0dfc02ad379aba6dc0ee4fd144938d1577baaf293f2e74f33daf2aa557d72ddefdba66e9ed08db41d53b7f1de24553943

Download Submit
C:\Windows\System\GSSaCqk.exe

Filesize
3.0MB

MD5
c04df4dc75f16120241d4c5820ee53a7

SHA1
04ae11fb2896afa39f6dbc1188d63aa1f3061622

SHA256
f78ef5c6d94fe4cc10a662e881107fa413226a179744bc26672e5cb06a6eac0b

SHA512
28a8d748edf0cc58de71aa65d90ebefde8f1a9598ec52529107b4358442cab530bdc1e64b4cc54dfe9efe2ac41f755432fb201ead13c6679f5a8a8cf2ee2c741

Download Submit
C:\Windows\System\IdumWCP.exe

Filesize
3.0MB

MD5
38219b38fd939be2b042417b31389eec

SHA1
ac0fb938255a6a726da2f2c03fa6a83e3f083490

SHA256
365ea63256d7b292c5c2512b7839ee17e75911d495ef8ecc92bfe8c14ae7eb06

SHA512
83f530f8dc743e47ef5aeb50b47e4b9fad7e066fd68be590efbc4b9c9926bf55546b5f96658e3bd3976177dd533040c4f047f6ad0d22e81ca089768fecbb3bcb

Download Submit
C:\Windows\System\KrDZRoE.exe

Filesize
3.0MB

MD5
e1a428448b1dcdadadf2cfd5bcaf1657

SHA1
dfe702a5db6d6d3cda5385707a89fbedb61d8a48

SHA256
74fc67d9452c9b89fe342d9758a23cfc86da8d80a55f1602dc7bf4786bcb4077

SHA512
e3703dc912ae17ce122072dd37aa6108349a52c15eae63b16468dd169d7aa53cf0e3a816232ca3eee74aa8f191e1b0a4c2c8220e1a9c85e0645462c837cee8c6

Download Submit
C:\Windows\System\MDYhxcX.exe

Filesize
3.0MB

MD5
ffb48f75fe2ba6fcdeb6f1a37bcf332e

SHA1
83ec2e02a8f01fc05631b4545428b77e83d76e17

SHA256
69721da0b772ab504553d95cea625204fed5c40f31f5a5468ed801720953e2f0

SHA512
bc9fdab97b1b65fc13485d6d930aa1905b85385d9e5cc5829b01c061d5f4cd308961e1c2ecb5341b8c4a80a23782d5d30da94aa687ca2bcf2987482c0c92357f

Download Submit
C:\Windows\System\Ntllgfk.exe

Filesize
3.0MB

MD5
8f3a834e39e195a21475024f829fd756

SHA1
fa246182b5d9f414d7a4efe6f89e8263a80475d8

SHA256
c8c6a1ac2ba284db64694acd90df40120a636e153e05e22e7e324b1cf17eebc1

SHA512
d8aa53b13c18f3f41ff896a442e8d9d6a371e7dccadfc80ba92896fab46383570a91023b311203efaa599a8fcfddef211f1325beea76414123bcba1fd13e6344

Download Submit
C:\Windows\System\ObbNrIm.exe

Filesize
3.0MB

MD5
879a791c230b7f0a91e0902ad58d1ed9

SHA1
e128e2de0ef58c527c47f5e5a689c2b1e056e9ed

SHA256
bec51da92c5a797edebfd7067ee3afad658ade5e757922d59f98ef97e5899384

SHA512
352d43d172bdeb88092f5436257991a7a516c64d99ddad4ea9ffebe77d9b52a67f68f606d573942c6f275f8912bef42f4aa1aa0adf292cdbe933a58c9f40bd2b

Download Submit
C:\Windows\System\OwhgTTM.exe

Filesize
3.0MB

MD5
667b3ead0719d30493a5ff6612ab689d

SHA1
9a7dcef91de99d590b8b923935c03573c11e100f

SHA256
a1a50695e21860f90b8445b8af31c2bcd0a7d2345cb138ba97213a07065e1c5e

SHA512
464556082e8b36d0cd63d0e7c29ba977fc06b1f91d96eae9e6f89ff29236e17c1a16fe2109e623f11f76df9b90f293987d28a4aedbdbcf4519ed85f732a48b2b

Download Submit
C:\Windows\System\RjGmVQR.exe

Filesize
3.0MB

MD5
2adb2569d04a24a973c64719e3703f7e

SHA1
7a6b781bc404a6513a46d4ab0b530b074bfa83c0

SHA256
deb902fd8801e480e0fad5db2278322450a5a07b29cfc98f8a6fc35fe32cf0e3

SHA512
6b3d11c60115bd326700e57c4f05fb1ad72cb1f83a1226f3a58e973221da1886bb9e0afd70c40d67867cfe9a9ef796b527dd50cfb58843a26d558cfbb591967b

Download Submit
C:\Windows\System\SajfXla.exe

Filesize
3.0MB

MD5
3abc2de8e42c97f4ecfb5a4a5e871a7f

SHA1
1ecb6e8d128502c2e5ce2cebeb429ddd6587b233

SHA256
6e8fbfe698b096c4c986e74c482f6fb364d8a9c9fda4013f8708ddb3c5e78059

SHA512
c4ad837ccc07881c6b20bfb0c965713234013f700a9ee1ae3324be9c027c67d3f045968a8603733680bc596880affcc8a0d18f1028db3bb7206b119d06ae3932

Download Submit
C:\Windows\System\TOBKqRZ.exe

Filesize
3.0MB

MD5
a17741a9a52ddfbf2e57387bc05afbcb

SHA1
aa652403a3b5e6845386ec9dadeb59b1edfcedf1

SHA256
80d85adb95903c9cd82b8b496b72ab12a27053735a52227f3822be28e185013b

SHA512
e6a24ac9d2d16528fbc47b5775eb2a7116fde38e875dfa9d3740a799066c4bca8d607b175a478a4bf8cfa8fe2dc35b007b2f97c01363bbea1f6ab7f9d26187b6

Download Submit
C:\Windows\System\UhJzKjo.exe

Filesize
3.0MB

MD5
bb607bbc4639c15bd457a1df268bf326

SHA1
c23451ef995c103c7e9076231403429c95937e5a

SHA256
e894f706a24958468b2d943dd75f27ce372bd36d2d50188cb3b96ccea145d396

SHA512
0a82ff78ad2ba96cb3fe54f20aeb669563b52f356d5e396feae1e0bb8c6694e908b3e6c39953284c108a2dc31d261972d6eb595dcf625d4a51a24e8f26753963

Download Submit
C:\Windows\System\XaBaKQE.exe

Filesize
3.0MB

MD5
0324c6b7ab4b4028a8212e56524ad61e

SHA1
e7e56e021afc0bc0127e85d364ae40ad9c52d8f4

SHA256
600fd8112d5f6dd9ea69005666dced679006cdd9ae1adcb587c1d619ba609472

SHA512
03c86470926d97c5a2b73b479ebc9bdf3f80aea10ef8711597824870b23b084726aa03f177c30040d3b339302c9b1c99185e10ddef63b105dcf3f7652e263e25

Download Submit
C:\Windows\System\XeYkOBS.exe

Filesize
3.0MB

MD5
bc57585a63d8253a4ebec159797842b2

SHA1
4b2a9a8a92e32ee09faca8a447425b69deada0fd

SHA256
424b1ba8c62a62e33a3c61b42ef77c69f10a3243427086c8e496d5a6eed1a91e

SHA512
e729edc8c8b8f22c05310d13f3527905fc33707a5c719df475459a9e1dca8657c6553ee399da0fc0f993b53db55c7b5b470557d8e96bd48bb577b296b022d326

Download Submit
C:\Windows\System\XhhofSu.exe

Filesize
3.0MB

MD5
3471c0e305f6a84a44a3e7e6c11d69df

SHA1
dcec049ac81b0a8e138402c54cccb0aef7023e37

SHA256
4775847d75bc34220034bd68ca24309ba5174265335c3568b37bbfa0f669970c

SHA512
29f08db75197dc97c891192604504555226e05f9cb26e84958168652758eab0baf26c69bc1d9986d392d7dc05f10e146f0c97f1b0af2f933f250978d78ac352d

Download Submit
C:\Windows\System\aSfNPHK.exe

Filesize
8B

MD5
e216125f6ec8a71ed511fce858ed30eb

SHA1
050cc8d12c9a1af3716df8cd26567943726d3366

SHA256
2097394cabc160a9df2f746df2b02abe3caad35caebdb855f94e869ef6004673

SHA512
1ac9f8982e0ad73ffc5075b337a3e3f491f85f11a7d1a7e27a4798e5b39f52143905d90909f5a0732fa6e625f6b0719a56e5ded5ac563b3a5f32c20c4c30e446

Download Submit
C:\Windows\System\afIEREL.exe

Filesize
18B

MD5
d6bd6ca0c5d1525898ba25b0a43e9999

SHA1
ff1365016a76693cc2b66ba524de9655c1fc0f36

SHA256
0f8996699afea4c5fe8aad9de2f18c24a94508de02aa3a04f82c0b4c86fb557d

SHA512
82d0da5db1ecdb0ce533f39a24c98987ce3bd43f833406fef4929043a153e7dbafe3c7f2867fa4255e4a061009ca830b3c098ab710eb06e601073ee3c2592db9

Download Submit
C:\Windows\System\bdbOxcl.exe

Filesize
3.0MB

MD5
26b127e9377e8c004409ebf66f1e0192

SHA1
62bcd23f40e0b2a40fe55e71483d5f3fbaca6c1c

SHA256
b651924d3bbf940ded1a71d1e89ee67a0972ce051532f8d208c8229a348c3f09

SHA512
736709ed7417765c44448f31fb9565e7797872632875b3ba65cb6dcd085bbfbfc5dc9c63de31aa060dd15e5c50bb63729188118c41e727a6e26beafc634ab27a

Download Submit
C:\Windows\System\bsUzUyS.exe

Filesize
3.0MB

MD5
cd1e7f195d35e3be9dd44223a2dbaca4

SHA1
4dce1b307908bd65c52db058fe7c4c9d62c5e27a

SHA256
3a179170124892b3b374d16e8ae7246eb9c84cfb110d5d3f3fa75d0db39737aa

SHA512
c29cdf2f463cbc494055f74450b17fc4de4284f8b9de4e8c80579db140ea7fcfbb30e98e8908db2d3952ae63b926f30bc9e84dd73ea3c3e16cda20703d37c7e9

Download Submit
C:\Windows\System\cwTaSpK.exe

Filesize
3.0MB

MD5
950f7d6564dda25e2190cf765e6a15c9

SHA1
b90b290b1ac2f355b3e4e74cb3d26dcee36656d9

SHA256
8f140af85a03a17c84d00a6efd12d15765ccfcd612f8438d082059c06848ee7e

SHA512
91e3aca0ff480f1c7c81ed699c54ad4a1bc0f7ea4017ec2aee01eca263aae27bcc2e3a5653bd75606c48dfd6d9dd629ce9056fa5446cb555c92934d57b78b51b

Download Submit
C:\Windows\System\fFMVFWy.exe

Filesize
3.0MB

MD5
abec931de0b5c0bd7013399bc3404466

SHA1
9277350d1e27dd5c2e11470b29878221850b9e34

SHA256
95b5520f9a7f315098bd51a41eab33d3fd4ba600eb96bc56123ea22aa130d4be

SHA512
835cb90d5e51227bfc7d9b92ace7d17e3b9518b790a8b83ef3e480f002a8481988822e71076d27a6fc859c253dc002203a6753fbb15ec6e6175574a30ab7743e

Download Submit
C:\Windows\System\iOgPjvi.exe

Filesize
3.0MB

MD5
350fcc451a5a17655d0b0367499e826a

SHA1
4f0036df3411635cb67fc529d0425d1f38852cd0

SHA256
3d174b17c190eac800bc40baadf4e0dff1533ccf9c4b47a8dfed71d3adb8ae80

SHA512
5dce137b1c6408355cbc2faa65c0947aa41fd10876d64123a711923c86d1f9c7a915a1cb95a0909568c52fa67985e55a96832b9766a86a6eed7da4365f39bc07

Download Submit
C:\Windows\System\imJoEFl.exe

Filesize
3.0MB

MD5
2fa3026fde64307d6831e462a6be9db3

SHA1
7d75af27a8092a1aa88c6196a0eb2ebdf788271e

SHA256
768310df6e0a52eaaf400f2405e7b7071c54350fe2d048b499b3031534b4c634

SHA512
341305e2a4de986b3ecca6d30a8110173106368203f41e049f84496e3f0711e346f6e64f115406824a0f609882225576e9ebcf0f34c6a957e384b1c77e4e6e59

Download Submit
C:\Windows\System\ooQcXJd.exe

Filesize
3.0MB

MD5
accc99cb1c8c18d9647219d1a6abaaf4

SHA1
fa4064c59c533283c468dce0d0f3f25a85b96f5f

SHA256
1817e31b90b24c5a593c9b021e0892b73984816ef2d9d9119e9729e897cfbc8f

SHA512
0794bf2d1280a1ab3f8be83b02b314eebda162d70463e6c10ec6792096588de3a847a796b9f6891628a0c1db21f88e29db269a844c5eae5f615d8a5e7dd69638

Download Submit
C:\Windows\System\pDCBUep.exe

Filesize
3.0MB

MD5
d01ffd1a7f172ed0b2e7ecf59f035015

SHA1
b40a03abaa942c8086b98fed2f6d1b39fd5d92a8

SHA256
75aeac7f0db6a5573a94332c0a1b959ba7cb2166b48f807ae85513664abfe3b9

SHA512
269b274ba429b3008c981966b92adee0557e162d4ed739b32b22c277baec0e5c7a87865faad64d0cbce5e54daac47e1f6c417acc15249b8440b623109721a3f4

Download Submit
C:\Windows\System\rgZfXRx.exe

Filesize
3.0MB

MD5
f70952ef671f2ab101379872fb7deac6

SHA1
c6016a148c525672bdfd4a4a27ad36bbdd6e1b45

SHA256
7b9cef9392bf92231669c72368a8a7b5bc2778188d5e2499b02215417e1b2bf3

SHA512
d8a1a95b030ebc26d7ad82333fb1ee89a264a57bbd2e57e7146315d57a3d08a3336996345c1762aa0c191ff6487ea0fa4093e79aa94800950cb26d533b7dcf80

Download Submit
C:\Windows\System\sBQtlvA.exe

Filesize
3.0MB

MD5
1716b47879e92927e8b9adf744412948

SHA1
fb629db0210d710095973b4d637782bc1eca94de

SHA256
76111f46eab3044589759e6c34704031d2f9eefdeb6043b2abab49b8cebc78bb

SHA512
46982631bda19dd91cf23e26107d08826d1ac851efb60a52e541107a0b50c93b855298ba39a2b02a655fa13bdfd90c63ac7b04b208729628b8710bc5e8f2cc54

Download Submit
C:\Windows\System\weltAXq.exe

Filesize
3.0MB

MD5
b330e1f5a3e77013de340f379a7202e3

SHA1
4a50e920f00329100d6f937620da5580dcc75cb6

SHA256
1e8b94053dfa693dd6774dad34dd0ea66a08257cb8a264a833b14c12b2045305

SHA512
c811f7ccd5bbda2976ece7f149430f6dc78f83217b8e2838f5f121d6db2561f2b98fe89179e9ed9ebdb8c98d4011fa140584de8b361ab76c6ce7b3338ecb25ab

Download Submit
C:\Windows\System\zlhTeWK.exe

Filesize
3.0MB

MD5
b004880d592347cdf5339b61b37a4821

SHA1
7fa9b4a3b0d85f157b17a07e9b9f2d095865b2b4

SHA256
0ace3f5524831e25926af5ff4257ff2cf7e4794c4af55fd43ebaa5d091bc4320

SHA512
2f8adc076bf41ce9522822ede2768f7aa86bc08753226f4fa398441ee9ac747aeefd29b33026669897aba5a4ab0577620aa6b807d85250bebb79d86f9320d27e

Download Submit
memory/64-14-0x00007FF6DC2B0000-0x00007FF6DC6A6000-memory.dmp

Filesize
4.0MB

Download
memory/208-64-0x00007FF612570000-0x00007FF612966000-memory.dmp

Filesize
4.0MB

Download
memory/208-753-0x00007FF612570000-0x00007FF612966000-memory.dmp

Filesize
4.0MB

Download
memory/372-6357-0x00007FF6D7BA0000-0x00007FF6D7F96000-memory.dmp

Filesize
4.0MB

Download
memory/372-57-0x00007FF6D7BA0000-0x00007FF6D7F96000-memory.dmp

Filesize
4.0MB

Download
memory/408-131-0x00007FF6640F0000-0x00007FF6644E6000-memory.dmp

Filesize
4.0MB

Download
memory/408-6777-0x00007FF6640F0000-0x00007FF6644E6000-memory.dmp

Filesize
4.0MB

Download
memory/788-6775-0x00007FF618C80000-0x00007FF619076000-memory.dmp

Filesize
4.0MB

Download
memory/788-1310-0x00007FF618C80000-0x00007FF619076000-memory.dmp

Filesize
4.0MB

Download
memory/788-96-0x00007FF618C80000-0x00007FF619076000-memory.dmp

Filesize
4.0MB

Download
memory/892-118-0x00007FF6BC780000-0x00007FF6BCB76000-memory.dmp

Filesize
4.0MB

Download
memory/1692-2170-0x00007FF705F00000-0x00007FF7062F6000-memory.dmp

Filesize
4.0MB

Download
memory/1692-6778-0x00007FF705F00000-0x00007FF7062F6000-memory.dmp

Filesize
4.0MB

Download
memory/1692-133-0x00007FF705F00000-0x00007FF7062F6000-memory.dmp

Filesize
4.0MB

Download
memory/1820-73-0x00007FF6AA300000-0x00007FF6AA6F6000-memory.dmp

Filesize
4.0MB

Download
memory/1916-6773-0x00007FF748EB0000-0x00007FF7492A6000-memory.dmp

Filesize
4.0MB

Download
memory/1916-117-0x00007FF748EB0000-0x00007FF7492A6000-memory.dmp

Filesize
4.0MB

Download
memory/1968-26-0x00007FF6B7870000-0x00007FF6B7C66000-memory.dmp

Filesize
4.0MB

Download
memory/1968-127-0x00007FF6B7870000-0x00007FF6B7C66000-memory.dmp

Filesize
4.0MB

Download
memory/2212-6386-0x00007FF678C50000-0x00007FF679046000-memory.dmp

Filesize
4.0MB

Download
memory/2212-1025-0x00007FF678C50000-0x00007FF679046000-memory.dmp

Filesize
4.0MB

Download
memory/2212-78-0x00007FF678C50000-0x00007FF679046000-memory.dmp

Filesize
4.0MB

Download
memory/2292-6381-0x00007FF761ED0000-0x00007FF7622C6000-memory.dmp

Filesize
4.0MB

Download
memory/2292-77-0x00007FF761ED0000-0x00007FF7622C6000-memory.dmp

Filesize
4.0MB

Download
memory/2568-5565-0x00007FF736790000-0x00007FF736B86000-memory.dmp

Filesize
4.0MB

Download
memory/2568-269-0x00007FF736790000-0x00007FF736B86000-memory.dmp

Filesize
4.0MB

Download
memory/2568-31-0x00007FF736790000-0x00007FF736B86000-memory.dmp

Filesize
4.0MB

Download
memory/2872-17-0x00007FF7087F0000-0x00007FF708BE6000-memory.dmp

Filesize
4.0MB

Download
memory/2872-97-0x00007FF7087F0000-0x00007FF708BE6000-memory.dmp

Filesize
4.0MB

Download
memory/2944-49-0x00007FF70DD10000-0x00007FF70E106000-memory.dmp

Filesize
4.0MB

Download
memory/3024-46-0x000002A937190000-0x000002A9371B2000-memory.dmp

Filesize
136KB

Download
memory/3024-47-0x000002A937CB0000-0x000002A938456000-memory.dmp

Filesize
7.6MB

Download
memory/3100-272-0x00007FF6DCFC0000-0x00007FF6DD3B6000-memory.dmp

Filesize
4.0MB

Download
memory/4032-293-0x00007FF64CFC0000-0x00007FF64D3B6000-memory.dmp

Filesize
4.0MB

Download
memory/4032-2830-0x00007FF64CFC0000-0x00007FF64D3B6000-memory.dmp

Filesize
4.0MB

Download
memory/4208-134-0x00007FF718B40000-0x00007FF718F36000-memory.dmp

Filesize
4.0MB

Download
memory/4208-6780-0x00007FF718B40000-0x00007FF718F36000-memory.dmp

Filesize
4.0MB

Download
memory/4212-6779-0x00007FF7A4830000-0x00007FF7A4C26000-memory.dmp

Filesize
4.0MB

Download
memory/4212-132-0x00007FF7A4830000-0x00007FF7A4C26000-memory.dmp

Filesize
4.0MB

Download
memory/4288-294-0x00007FF78BD80000-0x00007FF78C176000-memory.dmp

Filesize
4.0MB

Download
memory/4336-107-0x00007FF733E60000-0x00007FF734256000-memory.dmp

Filesize
4.0MB

Download
memory/4500-86-0x00007FF762280000-0x00007FF762676000-memory.dmp

Filesize
4.0MB

Download
memory/4500-0-0x00007FF762280000-0x00007FF762676000-memory.dmp

Filesize
4.0MB

Download
memory/4500-1-0x00000179651E0000-0x00000179651F0000-memory.dmp

Filesize
64KB

Download
memory/4676-309-0x00007FF7C8A00000-0x00007FF7C8DF6000-memory.dmp

Filesize
4.0MB

Download
memory/4800-123-0x00007FF797200000-0x00007FF7975F6000-memory.dmp

Filesize
4.0MB

Download
memory/4800-6781-0x00007FF797200000-0x00007FF7975F6000-memory.dmp

Filesize
4.0MB

Download
memory/4800-1882-0x00007FF797200000-0x00007FF7975F6000-memory.dmp

Filesize
4.0MB

Download
memory/4988-22-0x00007FF65F4E0000-0x00007FF65F8D6000-memory.dmp

Filesize
4.0MB

Download
memory/4988-100-0x00007FF65F4E0000-0x00007FF65F8D6000-memory.dmp

Filesize
4.0MB

Download