xmrig | cb1b422aaa665f3e07aeafef788ed6d34016463c0d596168437374087ae10026

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d39c0e1f00ae0b952caedb50c2c2980.exe
Size

2.9MB
MD5

1d39c0e1f00ae0b952caedb50c2c2980
SHA1

03dd9768c4418410c7dd6a5e941d1c93c1426e3d
SHA256

cb1b422aaa665f3e07aeafef788ed6d34016463c0d596168437374087ae10026
SHA512

f0b82864cb9daac6fbbbfc09c5428391f7b454e11e5a3fe727043924888893926c04558c8105013eef28bc872985d04199ec0752f585423e2f1982cc476d6870
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BWgacx:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2424-0-0x00007FF7D82E0000-0x00007FF7D86D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023289-8.dat	xmrig
behavioral2/files/0x0007000000023474-7.dat	xmrig
behavioral2/files/0x0007000000023476-25.dat	xmrig
behavioral2/files/0x0007000000023475-28.dat	xmrig
behavioral2/files/0x000700000002347a-45.dat	xmrig
behavioral2/files/0x000700000002347c-56.dat	xmrig
behavioral2/files/0x000700000002347e-81.dat	xmrig
behavioral2/files/0x0007000000023480-85.dat	xmrig
behavioral2/files/0x0008000000023471-99.dat	xmrig
behavioral2/memory/1020-112-0x00007FF7B4320000-0x00007FF7B4716000-memory.dmp	xmrig
behavioral2/files/0x0007000000023486-124.dat	xmrig
behavioral2/memory/3972-127-0x00007FF6D8D50000-0x00007FF6D9146000-memory.dmp	xmrig
behavioral2/memory/4820-132-0x00007FF782420000-0x00007FF782816000-memory.dmp	xmrig
behavioral2/memory/3452-135-0x00007FF7696B0000-0x00007FF769AA6000-memory.dmp	xmrig
behavioral2/memory/2132-138-0x00007FF7A7050000-0x00007FF7A7446000-memory.dmp	xmrig
behavioral2/memory/1480-140-0x00007FF70E300000-0x00007FF70E6F6000-memory.dmp	xmrig
behavioral2/memory/3556-139-0x00007FF6836C0000-0x00007FF683AB6000-memory.dmp	xmrig
behavioral2/memory/4560-137-0x00007FF79FFA0000-0x00007FF7A0396000-memory.dmp	xmrig
behavioral2/memory/1624-136-0x00007FF6A6310000-0x00007FF6A6706000-memory.dmp	xmrig
behavioral2/memory/760-134-0x00007FF79EEA0000-0x00007FF79F296000-memory.dmp	xmrig
behavioral2/memory/4644-133-0x00007FF687A00000-0x00007FF687DF6000-memory.dmp	xmrig
behavioral2/memory/2192-131-0x00007FF699AD0000-0x00007FF699EC6000-memory.dmp	xmrig
behavioral2/memory/3164-130-0x00007FF626C50000-0x00007FF627046000-memory.dmp	xmrig
behavioral2/memory/3400-129-0x00007FF633A80000-0x00007FF633E76000-memory.dmp	xmrig
behavioral2/memory/1456-128-0x00007FF78DED0000-0x00007FF78E2C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023485-122.dat	xmrig
behavioral2/files/0x0007000000023483-120.dat	xmrig
behavioral2/files/0x0007000000023484-118.dat	xmrig
behavioral2/memory/5072-117-0x00007FF673BF0000-0x00007FF673FE6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023482-115.dat	xmrig
behavioral2/files/0x000700000002347f-109.dat	xmrig
behavioral2/memory/1468-103-0x00007FF7A3DC0000-0x00007FF7A41B6000-memory.dmp	xmrig
behavioral2/memory/2464-93-0x00007FF741FD0000-0x00007FF7423C6000-memory.dmp	xmrig
behavioral2/files/0x000700000002347d-79.dat	xmrig
behavioral2/memory/5064-67-0x00007FF7BA5B0000-0x00007FF7BA9A6000-memory.dmp	xmrig
behavioral2/files/0x000700000002347b-61.dat	xmrig
behavioral2/memory/3096-58-0x00007FF731580000-0x00007FF731976000-memory.dmp	xmrig
behavioral2/files/0x0007000000023479-54.dat	xmrig
behavioral2/files/0x0007000000023478-50.dat	xmrig
behavioral2/memory/3540-37-0x00007FF67ECD0000-0x00007FF67F0C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023477-33.dat	xmrig
behavioral2/files/0x0008000000023473-10.dat	xmrig
behavioral2/files/0x0007000000023487-270.dat	xmrig
behavioral2/files/0x00070000000234b0-276.dat	xmrig
behavioral2/memory/4060-289-0x00007FF6291C0000-0x00007FF6295B6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234b5-299.dat	xmrig
behavioral2/files/0x00070000000234b8-312.dat	xmrig
behavioral2/files/0x00070000000234b9-315.dat	xmrig
behavioral2/memory/1160-300-0x00007FF76D640000-0x00007FF76DA36000-memory.dmp	xmrig
behavioral2/files/0x00070000000234b2-295.dat	xmrig
behavioral2/memory/4808-294-0x00007FF7B25A0000-0x00007FF7B2996000-memory.dmp	xmrig
behavioral2/files/0x00070000000234bb-390.dat	xmrig
behavioral2/files/0x00070000000234de-395.dat	xmrig
behavioral2/files/0x00070000000234df-403.dat	xmrig
behavioral2/files/0x00070000000234e2-417.dat	xmrig
behavioral2/files/0x00070000000234ec-423.dat	xmrig
behavioral2/memory/2424-1841-0x00007FF7D82E0000-0x00007FF7D86D6000-memory.dmp	xmrig
behavioral2/memory/3540-2502-0x00007FF67ECD0000-0x00007FF67F0C6000-memory.dmp	xmrig
behavioral2/memory/3452-2503-0x00007FF7696B0000-0x00007FF769AA6000-memory.dmp	xmrig
behavioral2/memory/3096-2504-0x00007FF731580000-0x00007FF731976000-memory.dmp	xmrig
behavioral2/memory/5064-2505-0x00007FF7BA5B0000-0x00007FF7BA9A6000-memory.dmp	xmrig
behavioral2/memory/2464-2506-0x00007FF741FD0000-0x00007FF7423C6000-memory.dmp	xmrig
behavioral2/memory/1468-2507-0x00007FF7A3DC0000-0x00007FF7A41B6000-memory.dmp	xmrig

Blocklisted process makes network request 10 IoCs

flow	pid	Process
3	3600	powershell.exe
5	3600	powershell.exe
7	3600	powershell.exe
8	3600	powershell.exe
10	3600	powershell.exe
11	3600	powershell.exe
13	3600	powershell.exe
18	3600	powershell.exe
19	3600	powershell.exe
20	3600	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3600	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3452	gWJMmpy.exe
3540	UExcxFZ.exe
3096	xaPcONC.exe
5064	BMtWjmB.exe
2464	bKnlzQM.exe
1468	hgqrdtE.exe
1020	ucWQjuG.exe
1624	hLTyHaR.exe
5072	LlyEhdf.exe
3972	DrNzMlK.exe
1456	GsNqBQn.exe
3400	YMEIbcY.exe
4560	XTqQSZt.exe
3164	gKHroFK.exe
2132	GLyAZQw.exe
3556	ltDYhQa.exe
2192	FNgjUZI.exe
1480	mZAbnhf.exe
4820	QcfRDam.exe
4644	tvWakbu.exe
760	tfVXGum.exe
4060	ozCORmS.exe
4808	VXgPFWq.exe
1160	SqKbDNP.exe
3416	uWZHmVI.exe
428	qIAAwuh.exe
3456	xdmwdgE.exe
2988	faPEnat.exe
3976	IDZzRFi.exe
4788	gXoPzAp.exe
4984	RSJlgTM.exe
1832	BVazcjV.exe
3372	YoCNBcd.exe
4904	NbiTMrF.exe
2228	BKXjWqd.exe
2232	XBavcJj.exe
2000	hBSrrNu.exe
1288	FUyeQgl.exe
1564	EHDQAOk.exe
2784	GDdaxHn.exe
3028	QBXrlqd.exe
2900	ijdqvaK.exe
4556	TMwPXLE.exe
1436	VNBlGXG.exe
3920	dDXNTcS.exe
4656	IXlKGyR.exe
3796	vBkFaqa.exe
4164	JDiuaIb.exe
2320	jUSWoBm.exe
2432	ZWLaQqN.exe
3732	mUuDwFs.exe
1040	GrCBaFy.exe
2284	NGheXfo.exe
3476	vUIPUoA.exe
3636	GKvGGTy.exe
4136	kORhYGU.exe
816	XShhxDJ.exe
3012	TiwbFKp.exe
964	YEhCWSD.exe
4704	QxpATAy.exe
4492	dxbUKLU.exe
748	GRhSkKK.exe
4088	QtIfdgQ.exe
3576	ZIGyzxm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2424-0-0x00007FF7D82E0000-0x00007FF7D86D6000-memory.dmp	upx
behavioral2/files/0x0007000000023289-8.dat	upx
behavioral2/files/0x0007000000023474-7.dat	upx
behavioral2/files/0x0007000000023476-25.dat	upx
behavioral2/files/0x0007000000023475-28.dat	upx
behavioral2/files/0x000700000002347a-45.dat	upx
behavioral2/files/0x000700000002347c-56.dat	upx
behavioral2/files/0x000700000002347e-81.dat	upx
behavioral2/files/0x0007000000023480-85.dat	upx
behavioral2/files/0x0008000000023471-99.dat	upx
behavioral2/memory/1020-112-0x00007FF7B4320000-0x00007FF7B4716000-memory.dmp	upx
behavioral2/files/0x0007000000023486-124.dat	upx
behavioral2/memory/3972-127-0x00007FF6D8D50000-0x00007FF6D9146000-memory.dmp	upx
behavioral2/memory/4820-132-0x00007FF782420000-0x00007FF782816000-memory.dmp	upx
behavioral2/memory/3452-135-0x00007FF7696B0000-0x00007FF769AA6000-memory.dmp	upx
behavioral2/memory/2132-138-0x00007FF7A7050000-0x00007FF7A7446000-memory.dmp	upx
behavioral2/memory/1480-140-0x00007FF70E300000-0x00007FF70E6F6000-memory.dmp	upx
behavioral2/memory/3556-139-0x00007FF6836C0000-0x00007FF683AB6000-memory.dmp	upx
behavioral2/memory/4560-137-0x00007FF79FFA0000-0x00007FF7A0396000-memory.dmp	upx
behavioral2/memory/1624-136-0x00007FF6A6310000-0x00007FF6A6706000-memory.dmp	upx
behavioral2/memory/760-134-0x00007FF79EEA0000-0x00007FF79F296000-memory.dmp	upx
behavioral2/memory/4644-133-0x00007FF687A00000-0x00007FF687DF6000-memory.dmp	upx
behavioral2/memory/2192-131-0x00007FF699AD0000-0x00007FF699EC6000-memory.dmp	upx
behavioral2/memory/3164-130-0x00007FF626C50000-0x00007FF627046000-memory.dmp	upx
behavioral2/memory/3400-129-0x00007FF633A80000-0x00007FF633E76000-memory.dmp	upx
behavioral2/memory/1456-128-0x00007FF78DED0000-0x00007FF78E2C6000-memory.dmp	upx
behavioral2/files/0x0007000000023485-122.dat	upx
behavioral2/files/0x0007000000023483-120.dat	upx
behavioral2/files/0x0007000000023484-118.dat	upx
behavioral2/memory/5072-117-0x00007FF673BF0000-0x00007FF673FE6000-memory.dmp	upx
behavioral2/files/0x0008000000023482-115.dat	upx
behavioral2/files/0x000700000002347f-109.dat	upx
behavioral2/memory/1468-103-0x00007FF7A3DC0000-0x00007FF7A41B6000-memory.dmp	upx
behavioral2/memory/2464-93-0x00007FF741FD0000-0x00007FF7423C6000-memory.dmp	upx
behavioral2/files/0x000700000002347d-79.dat	upx
behavioral2/memory/5064-67-0x00007FF7BA5B0000-0x00007FF7BA9A6000-memory.dmp	upx
behavioral2/files/0x000700000002347b-61.dat	upx
behavioral2/memory/3096-58-0x00007FF731580000-0x00007FF731976000-memory.dmp	upx
behavioral2/files/0x0007000000023479-54.dat	upx
behavioral2/files/0x0007000000023478-50.dat	upx
behavioral2/memory/3540-37-0x00007FF67ECD0000-0x00007FF67F0C6000-memory.dmp	upx
behavioral2/files/0x0007000000023477-33.dat	upx
behavioral2/files/0x0008000000023473-10.dat	upx
behavioral2/files/0x0007000000023487-270.dat	upx
behavioral2/files/0x00070000000234b0-276.dat	upx
behavioral2/memory/4060-289-0x00007FF6291C0000-0x00007FF6295B6000-memory.dmp	upx
behavioral2/files/0x00070000000234b5-299.dat	upx
behavioral2/files/0x00070000000234b8-312.dat	upx
behavioral2/files/0x00070000000234b9-315.dat	upx
behavioral2/memory/1160-300-0x00007FF76D640000-0x00007FF76DA36000-memory.dmp	upx
behavioral2/files/0x00070000000234b2-295.dat	upx
behavioral2/memory/4808-294-0x00007FF7B25A0000-0x00007FF7B2996000-memory.dmp	upx
behavioral2/files/0x00070000000234bb-390.dat	upx
behavioral2/files/0x00070000000234de-395.dat	upx
behavioral2/files/0x00070000000234df-403.dat	upx
behavioral2/files/0x00070000000234e2-417.dat	upx
behavioral2/files/0x00070000000234ec-423.dat	upx
behavioral2/memory/2424-1841-0x00007FF7D82E0000-0x00007FF7D86D6000-memory.dmp	upx
behavioral2/memory/3540-2502-0x00007FF67ECD0000-0x00007FF67F0C6000-memory.dmp	upx
behavioral2/memory/3452-2503-0x00007FF7696B0000-0x00007FF769AA6000-memory.dmp	upx
behavioral2/memory/3096-2504-0x00007FF731580000-0x00007FF731976000-memory.dmp	upx
behavioral2/memory/5064-2505-0x00007FF7BA5B0000-0x00007FF7BA9A6000-memory.dmp	upx
behavioral2/memory/2464-2506-0x00007FF741FD0000-0x00007FF7423C6000-memory.dmp	upx
behavioral2/memory/1468-2507-0x00007FF7A3DC0000-0x00007FF7A41B6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UCXAsxM.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\hvZSssU.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\fQfOujr.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\NlBSvLw.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\GzZkFBe.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\amsoaic.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\wRTgZeX.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\lnUpBpb.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\dPXoUPq.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\bpuCrua.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\toMFano.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\QNDRqlg.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\kydlGCl.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\empjvmv.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\PpywgSS.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\yfvSKoi.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\zENrACi.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\bIYyvRW.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\vrcdVVR.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\MTafLOp.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\hlnauHE.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\UtFVXfw.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\dikRYQf.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\rDIEDGF.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\DJGkGIP.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\IEKrfle.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\Tswslpk.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\jqhQFZg.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\iNKJHaI.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\eGooYGH.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\ZWRQvtE.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\LQULjuZ.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\qKaQNsJ.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\GogJvbV.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\GpOnbEz.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\dajiQiW.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\PqlzHqo.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\ITBjYHd.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\bDbFSvZ.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\sGfZwxQ.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\HSBjtAd.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\WbEvbWd.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\WQrZklc.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\aRvwjaC.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\lcdVbdA.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\tPpUQqS.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\uNmdkta.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\mjjHwBE.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\gLehzEb.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\fiZKfvf.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\yFKDOwA.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\DgJUIQI.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\sbrnKnC.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\GjLOppZ.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\nlpvyQY.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\cKgYzoa.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\URJzXya.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\zfkoRoV.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\GIafOPw.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\bkVYIeU.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\YUbhejN.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\PFBGmjD.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\QfYJLWi.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\zNEcfAS.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3600	powershell.exe
3600	powershell.exe
3600	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeLockMemoryPrivilege	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe
Token: SeLockMemoryPrivilege	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3600	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	83
PID 2424 wrote to memory of 3600	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	83
PID 2424 wrote to memory of 3452	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	85
PID 2424 wrote to memory of 3452	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	85
PID 2424 wrote to memory of 3540	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	86
PID 2424 wrote to memory of 3540	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	86
PID 2424 wrote to memory of 3096	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	87
PID 2424 wrote to memory of 3096	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	87
PID 2424 wrote to memory of 5064	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	88
PID 2424 wrote to memory of 5064	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	88
PID 2424 wrote to memory of 2464	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	89
PID 2424 wrote to memory of 2464	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	89
PID 2424 wrote to memory of 1468	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	90
PID 2424 wrote to memory of 1468	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	90
PID 2424 wrote to memory of 1020	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	91
PID 2424 wrote to memory of 1020	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	91
PID 2424 wrote to memory of 5072	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	92
PID 2424 wrote to memory of 5072	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	92
PID 2424 wrote to memory of 1624	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	93
PID 2424 wrote to memory of 1624	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	93
PID 2424 wrote to memory of 3972	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	94
PID 2424 wrote to memory of 3972	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	94
PID 2424 wrote to memory of 1456	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	95
PID 2424 wrote to memory of 1456	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	95
PID 2424 wrote to memory of 3400	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	96
PID 2424 wrote to memory of 3400	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	96
PID 2424 wrote to memory of 4560	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	97
PID 2424 wrote to memory of 4560	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	97
PID 2424 wrote to memory of 3164	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	98
PID 2424 wrote to memory of 3164	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	98
PID 2424 wrote to memory of 2132	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	99
PID 2424 wrote to memory of 2132	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	99
PID 2424 wrote to memory of 4820	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	100
PID 2424 wrote to memory of 4820	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	100
PID 2424 wrote to memory of 3556	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	101
PID 2424 wrote to memory of 3556	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	101
PID 2424 wrote to memory of 2192	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	102
PID 2424 wrote to memory of 2192	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	102
PID 2424 wrote to memory of 1480	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	103
PID 2424 wrote to memory of 1480	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	103
PID 2424 wrote to memory of 4644	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	104
PID 2424 wrote to memory of 4644	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	104
PID 2424 wrote to memory of 760	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	105
PID 2424 wrote to memory of 760	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	105
PID 2424 wrote to memory of 4060	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	107
PID 2424 wrote to memory of 4060	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	107
PID 2424 wrote to memory of 4808	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	108
PID 2424 wrote to memory of 4808	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	108
PID 2424 wrote to memory of 1160	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	109
PID 2424 wrote to memory of 1160	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	109
PID 2424 wrote to memory of 3416	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	110
PID 2424 wrote to memory of 3416	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	110
PID 2424 wrote to memory of 428	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	111
PID 2424 wrote to memory of 428	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	111
PID 2424 wrote to memory of 3456	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	113
PID 2424 wrote to memory of 3456	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	113
PID 2424 wrote to memory of 2988	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	114
PID 2424 wrote to memory of 2988	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	114
PID 2424 wrote to memory of 3976	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	115
PID 2424 wrote to memory of 3976	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	115
PID 2424 wrote to memory of 4788	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	116
PID 2424 wrote to memory of 4788	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	116
PID 2424 wrote to memory of 4984	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	117
PID 2424 wrote to memory of 4984	2424	1d39c0e1f00ae0b952caedb50c2c2980.exe	117

C:\Users\Admin\AppData\Local\Temp\1d39c0e1f00ae0b952caedb50c2c2980.exe
"C:\Users\Admin\AppData\Local\Temp\1d39c0e1f00ae0b952caedb50c2c2980.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Windows\System\gWJMmpy.exe
  C:\Windows\System\gWJMmpy.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\UExcxFZ.exe
  C:\Windows\System\UExcxFZ.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\xaPcONC.exe
  C:\Windows\System\xaPcONC.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\BMtWjmB.exe
  C:\Windows\System\BMtWjmB.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\bKnlzQM.exe
  C:\Windows\System\bKnlzQM.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\hgqrdtE.exe
  C:\Windows\System\hgqrdtE.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\ucWQjuG.exe
  C:\Windows\System\ucWQjuG.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\LlyEhdf.exe
  C:\Windows\System\LlyEhdf.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\hLTyHaR.exe
  C:\Windows\System\hLTyHaR.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\DrNzMlK.exe
  C:\Windows\System\DrNzMlK.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\GsNqBQn.exe
  C:\Windows\System\GsNqBQn.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\YMEIbcY.exe
  C:\Windows\System\YMEIbcY.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\XTqQSZt.exe
  C:\Windows\System\XTqQSZt.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\gKHroFK.exe
  C:\Windows\System\gKHroFK.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\GLyAZQw.exe
  C:\Windows\System\GLyAZQw.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\QcfRDam.exe
  C:\Windows\System\QcfRDam.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\ltDYhQa.exe
  C:\Windows\System\ltDYhQa.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\FNgjUZI.exe
  C:\Windows\System\FNgjUZI.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\mZAbnhf.exe
  C:\Windows\System\mZAbnhf.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\tvWakbu.exe
  C:\Windows\System\tvWakbu.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\tfVXGum.exe
  C:\Windows\System\tfVXGum.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ozCORmS.exe
  C:\Windows\System\ozCORmS.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\VXgPFWq.exe
  C:\Windows\System\VXgPFWq.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\SqKbDNP.exe
  C:\Windows\System\SqKbDNP.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\uWZHmVI.exe
  C:\Windows\System\uWZHmVI.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\qIAAwuh.exe
  C:\Windows\System\qIAAwuh.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\xdmwdgE.exe
  C:\Windows\System\xdmwdgE.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\faPEnat.exe
  C:\Windows\System\faPEnat.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\IDZzRFi.exe
  C:\Windows\System\IDZzRFi.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\gXoPzAp.exe
  C:\Windows\System\gXoPzAp.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\RSJlgTM.exe
  C:\Windows\System\RSJlgTM.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\BVazcjV.exe
  C:\Windows\System\BVazcjV.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\YoCNBcd.exe
  C:\Windows\System\YoCNBcd.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\NbiTMrF.exe
  C:\Windows\System\NbiTMrF.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\BKXjWqd.exe
  C:\Windows\System\BKXjWqd.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\XBavcJj.exe
  C:\Windows\System\XBavcJj.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\hBSrrNu.exe
  C:\Windows\System\hBSrrNu.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\FUyeQgl.exe
  C:\Windows\System\FUyeQgl.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\EHDQAOk.exe
  C:\Windows\System\EHDQAOk.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\GDdaxHn.exe
  C:\Windows\System\GDdaxHn.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\QBXrlqd.exe
  C:\Windows\System\QBXrlqd.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\ijdqvaK.exe
  C:\Windows\System\ijdqvaK.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\TMwPXLE.exe
  C:\Windows\System\TMwPXLE.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\VNBlGXG.exe
  C:\Windows\System\VNBlGXG.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\dDXNTcS.exe
  C:\Windows\System\dDXNTcS.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\IXlKGyR.exe
  C:\Windows\System\IXlKGyR.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\vBkFaqa.exe
  C:\Windows\System\vBkFaqa.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\JDiuaIb.exe
  C:\Windows\System\JDiuaIb.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\jUSWoBm.exe
  C:\Windows\System\jUSWoBm.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\ZWLaQqN.exe
  C:\Windows\System\ZWLaQqN.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\mUuDwFs.exe
  C:\Windows\System\mUuDwFs.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\GrCBaFy.exe
  C:\Windows\System\GrCBaFy.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\NGheXfo.exe
  C:\Windows\System\NGheXfo.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\vUIPUoA.exe
  C:\Windows\System\vUIPUoA.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\GKvGGTy.exe
  C:\Windows\System\GKvGGTy.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\kORhYGU.exe
  C:\Windows\System\kORhYGU.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\XShhxDJ.exe
  C:\Windows\System\XShhxDJ.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\TiwbFKp.exe
  C:\Windows\System\TiwbFKp.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\YEhCWSD.exe
  C:\Windows\System\YEhCWSD.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\QxpATAy.exe
  C:\Windows\System\QxpATAy.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\dxbUKLU.exe
  C:\Windows\System\dxbUKLU.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\GRhSkKK.exe
  C:\Windows\System\GRhSkKK.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\QtIfdgQ.exe
  C:\Windows\System\QtIfdgQ.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\ZIGyzxm.exe
  C:\Windows\System\ZIGyzxm.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\VWsSUdD.exe
  C:\Windows\System\VWsSUdD.exe
  2⤵
  PID:4512
- C:\Windows\System\pPHmirr.exe
  C:\Windows\System\pPHmirr.exe
  2⤵
  PID:1136
- C:\Windows\System\xLKevtn.exe
  C:\Windows\System\xLKevtn.exe
  2⤵
  PID:1548
- C:\Windows\System\iWNLNZC.exe
  C:\Windows\System\iWNLNZC.exe
  2⤵
  PID:1920
- C:\Windows\System\JFcYQXa.exe
  C:\Windows\System\JFcYQXa.exe
  2⤵
  PID:4408
- C:\Windows\System\XMXJrxF.exe
  C:\Windows\System\XMXJrxF.exe
  2⤵
  PID:2280
- C:\Windows\System\zPcOUDV.exe
  C:\Windows\System\zPcOUDV.exe
  2⤵
  PID:3528
- C:\Windows\System\KoNvBKD.exe
  C:\Windows\System\KoNvBKD.exe
  2⤵
  PID:2744
- C:\Windows\System\OMhIDsb.exe
  C:\Windows\System\OMhIDsb.exe
  2⤵
  PID:2300
- C:\Windows\System\SIRHgJB.exe
  C:\Windows\System\SIRHgJB.exe
  2⤵
  PID:3296
- C:\Windows\System\HdtDRPa.exe
  C:\Windows\System\HdtDRPa.exe
  2⤵
  PID:1268
- C:\Windows\System\xxShjLy.exe
  C:\Windows\System\xxShjLy.exe
  2⤵
  PID:4876
- C:\Windows\System\GsgeSKy.exe
  C:\Windows\System\GsgeSKy.exe
  2⤵
  PID:2188
- C:\Windows\System\mzOfjZF.exe
  C:\Windows\System\mzOfjZF.exe
  2⤵
  PID:320
- C:\Windows\System\WOsodsm.exe
  C:\Windows\System\WOsodsm.exe
  2⤵
  PID:3088
- C:\Windows\System\vAthQZQ.exe
  C:\Windows\System\vAthQZQ.exe
  2⤵
  PID:1552
- C:\Windows\System\YadzoyM.exe
  C:\Windows\System\YadzoyM.exe
  2⤵
  PID:548
- C:\Windows\System\mqXvceh.exe
  C:\Windows\System\mqXvceh.exe
  2⤵
  PID:4220
- C:\Windows\System\ojqypGO.exe
  C:\Windows\System\ojqypGO.exe
  2⤵
  PID:4244
- C:\Windows\System\qFaKNXR.exe
  C:\Windows\System\qFaKNXR.exe
  2⤵
  PID:4872
- C:\Windows\System\rPODimx.exe
  C:\Windows\System\rPODimx.exe
  2⤵
  PID:3512
- C:\Windows\System\kQqZkcg.exe
  C:\Windows\System\kQqZkcg.exe
  2⤵
  PID:2104
- C:\Windows\System\xgdHPGm.exe
  C:\Windows\System\xgdHPGm.exe
  2⤵
  PID:1528
- C:\Windows\System\ybNDKqS.exe
  C:\Windows\System\ybNDKqS.exe
  2⤵
  PID:4004
- C:\Windows\System\viyqwWN.exe
  C:\Windows\System\viyqwWN.exe
  2⤵
  PID:4032
- C:\Windows\System\GsuGsOx.exe
  C:\Windows\System\GsuGsOx.exe
  2⤵
  PID:4924
- C:\Windows\System\jNENhbu.exe
  C:\Windows\System\jNENhbu.exe
  2⤵
  PID:2168
- C:\Windows\System\kuBMQgV.exe
  C:\Windows\System\kuBMQgV.exe
  2⤵
  PID:2916
- C:\Windows\System\ArHPjZK.exe
  C:\Windows\System\ArHPjZK.exe
  2⤵
  PID:5124
- C:\Windows\System\NqeZbQl.exe
  C:\Windows\System\NqeZbQl.exe
  2⤵
  PID:5152
- C:\Windows\System\ACNudiL.exe
  C:\Windows\System\ACNudiL.exe
  2⤵
  PID:5172
- C:\Windows\System\IPsMfwZ.exe
  C:\Windows\System\IPsMfwZ.exe
  2⤵
  PID:5200
- C:\Windows\System\bdsUWnd.exe
  C:\Windows\System\bdsUWnd.exe
  2⤵
  PID:5228
- C:\Windows\System\NhEuiFj.exe
  C:\Windows\System\NhEuiFj.exe
  2⤵
  PID:5256
- C:\Windows\System\bRpvDmD.exe
  C:\Windows\System\bRpvDmD.exe
  2⤵
  PID:5288
- C:\Windows\System\ylhTZLg.exe
  C:\Windows\System\ylhTZLg.exe
  2⤵
  PID:5312
- C:\Windows\System\UBlSehy.exe
  C:\Windows\System\UBlSehy.exe
  2⤵
  PID:5352
- C:\Windows\System\FhiQRLR.exe
  C:\Windows\System\FhiQRLR.exe
  2⤵
  PID:5372
- C:\Windows\System\CmpsSQE.exe
  C:\Windows\System\CmpsSQE.exe
  2⤵
  PID:5408
- C:\Windows\System\QNruZRL.exe
  C:\Windows\System\QNruZRL.exe
  2⤵
  PID:5436
- C:\Windows\System\adRmKlC.exe
  C:\Windows\System\adRmKlC.exe
  2⤵
  PID:5464
- C:\Windows\System\aNbZdMA.exe
  C:\Windows\System\aNbZdMA.exe
  2⤵
  PID:5492
- C:\Windows\System\ZpOQZIB.exe
  C:\Windows\System\ZpOQZIB.exe
  2⤵
  PID:5520
- C:\Windows\System\CyoRaLi.exe
  C:\Windows\System\CyoRaLi.exe
  2⤵
  PID:5548
- C:\Windows\System\DuUEmxg.exe
  C:\Windows\System\DuUEmxg.exe
  2⤵
  PID:5576
- C:\Windows\System\yHJxSHJ.exe
  C:\Windows\System\yHJxSHJ.exe
  2⤵
  PID:5604
- C:\Windows\System\ZJIhqSc.exe
  C:\Windows\System\ZJIhqSc.exe
  2⤵
  PID:5632
- C:\Windows\System\ZsVBBRg.exe
  C:\Windows\System\ZsVBBRg.exe
  2⤵
  PID:5660
- C:\Windows\System\gjGyijL.exe
  C:\Windows\System\gjGyijL.exe
  2⤵
  PID:5688
- C:\Windows\System\ZqqbQWK.exe
  C:\Windows\System\ZqqbQWK.exe
  2⤵
  PID:5716
- C:\Windows\System\vMfDiCz.exe
  C:\Windows\System\vMfDiCz.exe
  2⤵
  PID:5756
- C:\Windows\System\JDFJNgt.exe
  C:\Windows\System\JDFJNgt.exe
  2⤵
  PID:5780
- C:\Windows\System\FOjqQxS.exe
  C:\Windows\System\FOjqQxS.exe
  2⤵
  PID:5796
- C:\Windows\System\xHeuFwh.exe
  C:\Windows\System\xHeuFwh.exe
  2⤵
  PID:5824
- C:\Windows\System\PLVVFgk.exe
  C:\Windows\System\PLVVFgk.exe
  2⤵
  PID:5864
- C:\Windows\System\nqAurrr.exe
  C:\Windows\System\nqAurrr.exe
  2⤵
  PID:5884
- C:\Windows\System\kiTjcmH.exe
  C:\Windows\System\kiTjcmH.exe
  2⤵
  PID:5908
- C:\Windows\System\YjAlUkT.exe
  C:\Windows\System\YjAlUkT.exe
  2⤵
  PID:5948
- C:\Windows\System\nIsljTw.exe
  C:\Windows\System\nIsljTw.exe
  2⤵
  PID:5976
- C:\Windows\System\purZpvE.exe
  C:\Windows\System\purZpvE.exe
  2⤵
  PID:6004
- C:\Windows\System\IPpxEHh.exe
  C:\Windows\System\IPpxEHh.exe
  2⤵
  PID:6032
- C:\Windows\System\nLsPtnv.exe
  C:\Windows\System\nLsPtnv.exe
  2⤵
  PID:6060
- C:\Windows\System\wLXdFCT.exe
  C:\Windows\System\wLXdFCT.exe
  2⤵
  PID:6088
- C:\Windows\System\tKRBwMJ.exe
  C:\Windows\System\tKRBwMJ.exe
  2⤵
  PID:6116
- C:\Windows\System\DpspsXG.exe
  C:\Windows\System\DpspsXG.exe
  2⤵
  PID:756
- C:\Windows\System\swpXLxG.exe
  C:\Windows\System\swpXLxG.exe
  2⤵
  PID:5180
- C:\Windows\System\KNMnAYu.exe
  C:\Windows\System\KNMnAYu.exe
  2⤵
  PID:5208
- C:\Windows\System\nkWQZyu.exe
  C:\Windows\System\nkWQZyu.exe
  2⤵
  PID:5272
- C:\Windows\System\yxsbWBA.exe
  C:\Windows\System\yxsbWBA.exe
  2⤵
  PID:5296
- C:\Windows\System\lHuwPud.exe
  C:\Windows\System\lHuwPud.exe
  2⤵
  PID:5420
- C:\Windows\System\ZpqOPBb.exe
  C:\Windows\System\ZpqOPBb.exe
  2⤵
  PID:5476
- C:\Windows\System\cJCkdrn.exe
  C:\Windows\System\cJCkdrn.exe
  2⤵
  PID:5568
- C:\Windows\System\IZYCGst.exe
  C:\Windows\System\IZYCGst.exe
  2⤵
  PID:5620
- C:\Windows\System\DnFZVpO.exe
  C:\Windows\System\DnFZVpO.exe
  2⤵
  PID:5684
- C:\Windows\System\hKJnxyZ.exe
  C:\Windows\System\hKJnxyZ.exe
  2⤵
  PID:5808
- C:\Windows\System\znGzEvY.exe
  C:\Windows\System\znGzEvY.exe
  2⤵
  PID:5856
- C:\Windows\System\EWZexfI.exe
  C:\Windows\System\EWZexfI.exe
  2⤵
  PID:5904
- C:\Windows\System\wuqMkvK.exe
  C:\Windows\System\wuqMkvK.exe
  2⤵
  PID:5988
- C:\Windows\System\HvUhkLc.exe
  C:\Windows\System\HvUhkLc.exe
  2⤵
  PID:6028
- C:\Windows\System\EKqrNUv.exe
  C:\Windows\System\EKqrNUv.exe
  2⤵
  PID:6076
- C:\Windows\System\vbDjlWk.exe
  C:\Windows\System\vbDjlWk.exe
  2⤵
  PID:5144
- C:\Windows\System\OVOxUnb.exe
  C:\Windows\System\OVOxUnb.exe
  2⤵
  PID:5380
- C:\Windows\System\oVairOB.exe
  C:\Windows\System\oVairOB.exe
  2⤵
  PID:5504
- C:\Windows\System\wDoCbEc.exe
  C:\Windows\System\wDoCbEc.exe
  2⤵
  PID:5588
- C:\Windows\System\XMyWRuu.exe
  C:\Windows\System\XMyWRuu.exe
  2⤵
  PID:5764
- C:\Windows\System\EhGJUgl.exe
  C:\Windows\System\EhGJUgl.exe
  2⤵
  PID:5944
- C:\Windows\System\SZTRIQW.exe
  C:\Windows\System\SZTRIQW.exe
  2⤵
  PID:6048
- C:\Windows\System\giLeJVu.exe
  C:\Windows\System\giLeJVu.exe
  2⤵
  PID:5448
- C:\Windows\System\wpEKfJg.exe
  C:\Windows\System\wpEKfJg.exe
  2⤵
  PID:5744
- C:\Windows\System\dOgvNym.exe
  C:\Windows\System\dOgvNym.exe
  2⤵
  PID:6016
- C:\Windows\System\wSRQVmS.exe
  C:\Windows\System\wSRQVmS.exe
  2⤵
  PID:5872
- C:\Windows\System\YDMwbVs.exe
  C:\Windows\System\YDMwbVs.exe
  2⤵
  PID:5680
- C:\Windows\System\RshVmZo.exe
  C:\Windows\System\RshVmZo.exe
  2⤵
  PID:6168
- C:\Windows\System\OZWQWKU.exe
  C:\Windows\System\OZWQWKU.exe
  2⤵
  PID:6208
- C:\Windows\System\ixfYEjy.exe
  C:\Windows\System\ixfYEjy.exe
  2⤵
  PID:6232
- C:\Windows\System\UuBvmoP.exe
  C:\Windows\System\UuBvmoP.exe
  2⤵
  PID:6260
- C:\Windows\System\TdazhMI.exe
  C:\Windows\System\TdazhMI.exe
  2⤵
  PID:6284
- C:\Windows\System\Pklcrmf.exe
  C:\Windows\System\Pklcrmf.exe
  2⤵
  PID:6312
- C:\Windows\System\YyupAlK.exe
  C:\Windows\System\YyupAlK.exe
  2⤵
  PID:6344
- C:\Windows\System\JRxFMDn.exe
  C:\Windows\System\JRxFMDn.exe
  2⤵
  PID:6372
- C:\Windows\System\KOWDqNv.exe
  C:\Windows\System\KOWDqNv.exe
  2⤵
  PID:6400
- C:\Windows\System\GizzIvh.exe
  C:\Windows\System\GizzIvh.exe
  2⤵
  PID:6428
- C:\Windows\System\rXASqfU.exe
  C:\Windows\System\rXASqfU.exe
  2⤵
  PID:6456
- C:\Windows\System\RFowlZE.exe
  C:\Windows\System\RFowlZE.exe
  2⤵
  PID:6484
- C:\Windows\System\wGVLqJp.exe
  C:\Windows\System\wGVLqJp.exe
  2⤵
  PID:6508
- C:\Windows\System\EUgnkNP.exe
  C:\Windows\System\EUgnkNP.exe
  2⤵
  PID:6536
- C:\Windows\System\JkLPihD.exe
  C:\Windows\System\JkLPihD.exe
  2⤵
  PID:6564
- C:\Windows\System\QXQpdop.exe
  C:\Windows\System\QXQpdop.exe
  2⤵
  PID:6592
- C:\Windows\System\wchxtOj.exe
  C:\Windows\System\wchxtOj.exe
  2⤵
  PID:6628
- C:\Windows\System\kDdIgyw.exe
  C:\Windows\System\kDdIgyw.exe
  2⤵
  PID:6660
- C:\Windows\System\bgyiUvW.exe
  C:\Windows\System\bgyiUvW.exe
  2⤵
  PID:6684
- C:\Windows\System\rzUfoxq.exe
  C:\Windows\System\rzUfoxq.exe
  2⤵
  PID:6708
- C:\Windows\System\tCfKKaX.exe
  C:\Windows\System\tCfKKaX.exe
  2⤵
  PID:6740
- C:\Windows\System\QMQjobN.exe
  C:\Windows\System\QMQjobN.exe
  2⤵
  PID:6764
- C:\Windows\System\iCftMmo.exe
  C:\Windows\System\iCftMmo.exe
  2⤵
  PID:6792
- C:\Windows\System\VXmKHIU.exe
  C:\Windows\System\VXmKHIU.exe
  2⤵
  PID:6820
- C:\Windows\System\KxFMSit.exe
  C:\Windows\System\KxFMSit.exe
  2⤵
  PID:6852
- C:\Windows\System\fyGGxzK.exe
  C:\Windows\System\fyGGxzK.exe
  2⤵
  PID:6872
- C:\Windows\System\XUzdCyB.exe
  C:\Windows\System\XUzdCyB.exe
  2⤵
  PID:6908
- C:\Windows\System\YUSmGuP.exe
  C:\Windows\System\YUSmGuP.exe
  2⤵
  PID:6944
- C:\Windows\System\FZWJlOc.exe
  C:\Windows\System\FZWJlOc.exe
  2⤵
  PID:6964
- C:\Windows\System\EivpzJm.exe
  C:\Windows\System\EivpzJm.exe
  2⤵
  PID:6992
- C:\Windows\System\taXbNwL.exe
  C:\Windows\System\taXbNwL.exe
  2⤵
  PID:7024
- C:\Windows\System\JqDYBgV.exe
  C:\Windows\System\JqDYBgV.exe
  2⤵
  PID:7048
- C:\Windows\System\hLuUnDj.exe
  C:\Windows\System\hLuUnDj.exe
  2⤵
  PID:7076
- C:\Windows\System\YecEBBs.exe
  C:\Windows\System\YecEBBs.exe
  2⤵
  PID:7108
- C:\Windows\System\FEjnnRd.exe
  C:\Windows\System\FEjnnRd.exe
  2⤵
  PID:7140
- C:\Windows\System\LbgXVGm.exe
  C:\Windows\System\LbgXVGm.exe
  2⤵
  PID:5340
- C:\Windows\System\snFQaKN.exe
  C:\Windows\System\snFQaKN.exe
  2⤵
  PID:6188
- C:\Windows\System\JmJGJim.exe
  C:\Windows\System\JmJGJim.exe
  2⤵
  PID:6252
- C:\Windows\System\ShNbhnB.exe
  C:\Windows\System\ShNbhnB.exe
  2⤵
  PID:6336
- C:\Windows\System\xeJCDNt.exe
  C:\Windows\System\xeJCDNt.exe
  2⤵
  PID:6388
- C:\Windows\System\hXXsrTP.exe
  C:\Windows\System\hXXsrTP.exe
  2⤵
  PID:6464
- C:\Windows\System\DGxrNth.exe
  C:\Windows\System\DGxrNth.exe
  2⤵
  PID:6528
- C:\Windows\System\SaOKjNb.exe
  C:\Windows\System\SaOKjNb.exe
  2⤵
  PID:6584
- C:\Windows\System\MvLzVsF.exe
  C:\Windows\System\MvLzVsF.exe
  2⤵
  PID:6648
- C:\Windows\System\GdQlShm.exe
  C:\Windows\System\GdQlShm.exe
  2⤵
  PID:6700
- C:\Windows\System\WTIamMH.exe
  C:\Windows\System\WTIamMH.exe
  2⤵
  PID:6780
- C:\Windows\System\jaPChxF.exe
  C:\Windows\System\jaPChxF.exe
  2⤵
  PID:6836
- C:\Windows\System\QrXaseg.exe
  C:\Windows\System\QrXaseg.exe
  2⤵
  PID:6900
- C:\Windows\System\vXgRQHj.exe
  C:\Windows\System\vXgRQHj.exe
  2⤵
  PID:6988
- C:\Windows\System\meXNwfn.exe
  C:\Windows\System\meXNwfn.exe
  2⤵
  PID:7060
- C:\Windows\System\jZIahGh.exe
  C:\Windows\System\jZIahGh.exe
  2⤵
  PID:7100
- C:\Windows\System\HKaEqqo.exe
  C:\Windows\System\HKaEqqo.exe
  2⤵
  PID:6152
- C:\Windows\System\LoCAwoT.exe
  C:\Windows\System\LoCAwoT.exe
  2⤵
  PID:6304
- C:\Windows\System\YyDmpnH.exe
  C:\Windows\System\YyDmpnH.exe
  2⤵
  PID:6444
- C:\Windows\System\CFOSKeS.exe
  C:\Windows\System\CFOSKeS.exe
  2⤵
  PID:6612
- C:\Windows\System\FBfrMop.exe
  C:\Windows\System\FBfrMop.exe
  2⤵
  PID:6728
- C:\Windows\System\FwVTNaE.exe
  C:\Windows\System\FwVTNaE.exe
  2⤵
  PID:4276
- C:\Windows\System\VCQNrpN.exe
  C:\Windows\System\VCQNrpN.exe
  2⤵
  PID:7032
- C:\Windows\System\CdpDaDl.exe
  C:\Windows\System\CdpDaDl.exe
  2⤵
  PID:7152
- C:\Windows\System\gTozlJT.exe
  C:\Windows\System\gTozlJT.exe
  2⤵
  PID:6436
- C:\Windows\System\tYLPpin.exe
  C:\Windows\System\tYLPpin.exe
  2⤵
  PID:6668
- C:\Windows\System\WqwuBpf.exe
  C:\Windows\System\WqwuBpf.exe
  2⤵
  PID:7088
- C:\Windows\System\mIqtNdv.exe
  C:\Windows\System\mIqtNdv.exe
  2⤵
  PID:6576
- C:\Windows\System\NCUdMev.exe
  C:\Windows\System\NCUdMev.exe
  2⤵
  PID:6364
- C:\Windows\System\hOtykEi.exe
  C:\Windows\System\hOtykEi.exe
  2⤵
  PID:7184
- C:\Windows\System\bXenntr.exe
  C:\Windows\System\bXenntr.exe
  2⤵
  PID:7200
- C:\Windows\System\otVqudg.exe
  C:\Windows\System\otVqudg.exe
  2⤵
  PID:7228
- C:\Windows\System\bwdcJlu.exe
  C:\Windows\System\bwdcJlu.exe
  2⤵
  PID:7260
- C:\Windows\System\CiierOy.exe
  C:\Windows\System\CiierOy.exe
  2⤵
  PID:7288
- C:\Windows\System\zmlBszH.exe
  C:\Windows\System\zmlBszH.exe
  2⤵
  PID:7316
- C:\Windows\System\nZzClTK.exe
  C:\Windows\System\nZzClTK.exe
  2⤵
  PID:7344
- C:\Windows\System\lIuTdxS.exe
  C:\Windows\System\lIuTdxS.exe
  2⤵
  PID:7372
- C:\Windows\System\awrASZJ.exe
  C:\Windows\System\awrASZJ.exe
  2⤵
  PID:7404
- C:\Windows\System\aCxmios.exe
  C:\Windows\System\aCxmios.exe
  2⤵
  PID:7436
- C:\Windows\System\RBYsIny.exe
  C:\Windows\System\RBYsIny.exe
  2⤵
  PID:7456
- C:\Windows\System\wiINyie.exe
  C:\Windows\System\wiINyie.exe
  2⤵
  PID:7488
- C:\Windows\System\jGtEDzT.exe
  C:\Windows\System\jGtEDzT.exe
  2⤵
  PID:7512
- C:\Windows\System\sBNvmiz.exe
  C:\Windows\System\sBNvmiz.exe
  2⤵
  PID:7544
- C:\Windows\System\jEztwSy.exe
  C:\Windows\System\jEztwSy.exe
  2⤵
  PID:7568
- C:\Windows\System\ZIySyrT.exe
  C:\Windows\System\ZIySyrT.exe
  2⤵
  PID:7600
- C:\Windows\System\ibQqZqX.exe
  C:\Windows\System\ibQqZqX.exe
  2⤵
  PID:7636
- C:\Windows\System\mujrgLO.exe
  C:\Windows\System\mujrgLO.exe
  2⤵
  PID:7664
- C:\Windows\System\OkRQsCS.exe
  C:\Windows\System\OkRQsCS.exe
  2⤵
  PID:7688
- C:\Windows\System\MTafLOp.exe
  C:\Windows\System\MTafLOp.exe
  2⤵
  PID:7716
- C:\Windows\System\fMVDEeq.exe
  C:\Windows\System\fMVDEeq.exe
  2⤵
  PID:7744
- C:\Windows\System\JHNhZyJ.exe
  C:\Windows\System\JHNhZyJ.exe
  2⤵
  PID:7772
- C:\Windows\System\PNPdTGV.exe
  C:\Windows\System\PNPdTGV.exe
  2⤵
  PID:7808
- C:\Windows\System\AqrHTud.exe
  C:\Windows\System\AqrHTud.exe
  2⤵
  PID:7836
- C:\Windows\System\pdJFbQB.exe
  C:\Windows\System\pdJFbQB.exe
  2⤵
  PID:7880
- C:\Windows\System\hwSPzzu.exe
  C:\Windows\System\hwSPzzu.exe
  2⤵
  PID:7904
- C:\Windows\System\gYSOOux.exe
  C:\Windows\System\gYSOOux.exe
  2⤵
  PID:7924
- C:\Windows\System\Mbbtluh.exe
  C:\Windows\System\Mbbtluh.exe
  2⤵
  PID:7952
- C:\Windows\System\qAxUYXU.exe
  C:\Windows\System\qAxUYXU.exe
  2⤵
  PID:7980
- C:\Windows\System\eyBApCC.exe
  C:\Windows\System\eyBApCC.exe
  2⤵
  PID:8008
- C:\Windows\System\EZZcTJK.exe
  C:\Windows\System\EZZcTJK.exe
  2⤵
  PID:8036
- C:\Windows\System\SRUbcbF.exe
  C:\Windows\System\SRUbcbF.exe
  2⤵
  PID:8068
- C:\Windows\System\cVKOdya.exe
  C:\Windows\System\cVKOdya.exe
  2⤵
  PID:8100
- C:\Windows\System\hINybNI.exe
  C:\Windows\System\hINybNI.exe
  2⤵
  PID:8128
- C:\Windows\System\lWVGoTy.exe
  C:\Windows\System\lWVGoTy.exe
  2⤵
  PID:8148
- C:\Windows\System\eZJQWsD.exe
  C:\Windows\System\eZJQWsD.exe
  2⤵
  PID:8176
- C:\Windows\System\BZLgvHH.exe
  C:\Windows\System\BZLgvHH.exe
  2⤵
  PID:7196
- C:\Windows\System\lyJsiTP.exe
  C:\Windows\System\lyJsiTP.exe
  2⤵
  PID:7268
- C:\Windows\System\PWRyriS.exe
  C:\Windows\System\PWRyriS.exe
  2⤵
  PID:7336
- C:\Windows\System\yTpcXWz.exe
  C:\Windows\System\yTpcXWz.exe
  2⤵
  PID:7396
- C:\Windows\System\iueHZYY.exe
  C:\Windows\System\iueHZYY.exe
  2⤵
  PID:7468
- C:\Windows\System\KoiOyVn.exe
  C:\Windows\System\KoiOyVn.exe
  2⤵
  PID:7532
- C:\Windows\System\kMueqeH.exe
  C:\Windows\System\kMueqeH.exe
  2⤵
  PID:7612
- C:\Windows\System\FXiaeMU.exe
  C:\Windows\System\FXiaeMU.exe
  2⤵
  PID:7680
- C:\Windows\System\hZRUNoi.exe
  C:\Windows\System\hZRUNoi.exe
  2⤵
  PID:7740
- C:\Windows\System\zNSiKHy.exe
  C:\Windows\System\zNSiKHy.exe
  2⤵
  PID:7820
- C:\Windows\System\aadcRzr.exe
  C:\Windows\System\aadcRzr.exe
  2⤵
  PID:7848
- C:\Windows\System\yMVxGSc.exe
  C:\Windows\System\yMVxGSc.exe
  2⤵
  PID:2108
- C:\Windows\System\NILTsPs.exe
  C:\Windows\System\NILTsPs.exe
  2⤵
  PID:2388
- C:\Windows\System\MpCHpAC.exe
  C:\Windows\System\MpCHpAC.exe
  2⤵
  PID:7876
- C:\Windows\System\wOekEEB.exe
  C:\Windows\System\wOekEEB.exe
  2⤵
  PID:7920
- C:\Windows\System\dDGvTwJ.exe
  C:\Windows\System\dDGvTwJ.exe
  2⤵
  PID:7992
- C:\Windows\System\GYyBZPW.exe
  C:\Windows\System\GYyBZPW.exe
  2⤵
  PID:8056
- C:\Windows\System\zIoutqH.exe
  C:\Windows\System\zIoutqH.exe
  2⤵
  PID:8112
- C:\Windows\System\CnZkoNM.exe
  C:\Windows\System\CnZkoNM.exe
  2⤵
  PID:8172
- C:\Windows\System\aOvhrpG.exe
  C:\Windows\System\aOvhrpG.exe
  2⤵
  PID:7296
- C:\Windows\System\mEHkxtz.exe
  C:\Windows\System\mEHkxtz.exe
  2⤵
  PID:7452
- C:\Windows\System\JePeowU.exe
  C:\Windows\System\JePeowU.exe
  2⤵
  PID:7672
- C:\Windows\System\PeFpWsm.exe
  C:\Windows\System\PeFpWsm.exe
  2⤵
  PID:7768
- C:\Windows\System\bxdXYgZ.exe
  C:\Windows\System\bxdXYgZ.exe
  2⤵
  PID:1236
- C:\Windows\System\fzolVwA.exe
  C:\Windows\System\fzolVwA.exe
  2⤵
  PID:7860
- C:\Windows\System\QXwtGkO.exe
  C:\Windows\System\QXwtGkO.exe
  2⤵
  PID:8020
- C:\Windows\System\rNRtdTd.exe
  C:\Windows\System\rNRtdTd.exe
  2⤵
  PID:8160
- C:\Windows\System\FiSyEKs.exe
  C:\Windows\System\FiSyEKs.exe
  2⤵
  PID:7424
- C:\Windows\System\TLBNrPe.exe
  C:\Windows\System\TLBNrPe.exe
  2⤵
  PID:3300
- C:\Windows\System\kNAUylY.exe
  C:\Windows\System\kNAUylY.exe
  2⤵
  PID:7972
- C:\Windows\System\vbtNBNh.exe
  C:\Windows\System\vbtNBNh.exe
  2⤵
  PID:7384
- C:\Windows\System\QCgMIJN.exe
  C:\Windows\System\QCgMIJN.exe
  2⤵
  PID:8140
- C:\Windows\System\GuSfauP.exe
  C:\Windows\System\GuSfauP.exe
  2⤵
  PID:8196
- C:\Windows\System\VgRkqIl.exe
  C:\Windows\System\VgRkqIl.exe
  2⤵
  PID:8224
- C:\Windows\System\XhqaGiA.exe
  C:\Windows\System\XhqaGiA.exe
  2⤵
  PID:8252
- C:\Windows\System\MHFGZAP.exe
  C:\Windows\System\MHFGZAP.exe
  2⤵
  PID:8280
- C:\Windows\System\EIjjhks.exe
  C:\Windows\System\EIjjhks.exe
  2⤵
  PID:8308
- C:\Windows\System\WWsSBPq.exe
  C:\Windows\System\WWsSBPq.exe
  2⤵
  PID:8336
- C:\Windows\System\zGdTUqU.exe
  C:\Windows\System\zGdTUqU.exe
  2⤵
  PID:8364
- C:\Windows\System\tgDtuiN.exe
  C:\Windows\System\tgDtuiN.exe
  2⤵
  PID:8392
- C:\Windows\System\JxjFvPR.exe
  C:\Windows\System\JxjFvPR.exe
  2⤵
  PID:8420
- C:\Windows\System\OsseBHU.exe
  C:\Windows\System\OsseBHU.exe
  2⤵
  PID:8448
- C:\Windows\System\rKCCDCK.exe
  C:\Windows\System\rKCCDCK.exe
  2⤵
  PID:8464
- C:\Windows\System\zUVzBAY.exe
  C:\Windows\System\zUVzBAY.exe
  2⤵
  PID:8488
- C:\Windows\System\rcuZMSo.exe
  C:\Windows\System\rcuZMSo.exe
  2⤵
  PID:8508
- C:\Windows\System\kRWEfhT.exe
  C:\Windows\System\kRWEfhT.exe
  2⤵
  PID:8544
- C:\Windows\System\IahWOGC.exe
  C:\Windows\System\IahWOGC.exe
  2⤵
  PID:8580
- C:\Windows\System\yWHWSNR.exe
  C:\Windows\System\yWHWSNR.exe
  2⤵
  PID:8596
- C:\Windows\System\YysgEEc.exe
  C:\Windows\System\YysgEEc.exe
  2⤵
  PID:8640
- C:\Windows\System\fRdqyqO.exe
  C:\Windows\System\fRdqyqO.exe
  2⤵
  PID:8668
- C:\Windows\System\mlBZBBk.exe
  C:\Windows\System\mlBZBBk.exe
  2⤵
  PID:8688
- C:\Windows\System\gFKVNqZ.exe
  C:\Windows\System\gFKVNqZ.exe
  2⤵
  PID:8728
- C:\Windows\System\HStIBVL.exe
  C:\Windows\System\HStIBVL.exe
  2⤵
  PID:8756
- C:\Windows\System\cGTojUc.exe
  C:\Windows\System\cGTojUc.exe
  2⤵
  PID:8784
- C:\Windows\System\BEHegQw.exe
  C:\Windows\System\BEHegQw.exe
  2⤵
  PID:8812
- C:\Windows\System\ZhfKBZv.exe
  C:\Windows\System\ZhfKBZv.exe
  2⤵
  PID:8844
- C:\Windows\System\bKyshWb.exe
  C:\Windows\System\bKyshWb.exe
  2⤵
  PID:8872
- C:\Windows\System\qVKFMHH.exe
  C:\Windows\System\qVKFMHH.exe
  2⤵
  PID:8900
- C:\Windows\System\KjeECde.exe
  C:\Windows\System\KjeECde.exe
  2⤵
  PID:8928
- C:\Windows\System\nEufUTk.exe
  C:\Windows\System\nEufUTk.exe
  2⤵
  PID:8956
- C:\Windows\System\NUCjgYS.exe
  C:\Windows\System\NUCjgYS.exe
  2⤵
  PID:8984
- C:\Windows\System\iuHIXif.exe
  C:\Windows\System\iuHIXif.exe
  2⤵
  PID:9012
- C:\Windows\System\WqnJCRX.exe
  C:\Windows\System\WqnJCRX.exe
  2⤵
  PID:9040
- C:\Windows\System\QMecPeZ.exe
  C:\Windows\System\QMecPeZ.exe
  2⤵
  PID:9068
- C:\Windows\System\fzPFOyk.exe
  C:\Windows\System\fzPFOyk.exe
  2⤵
  PID:9096
- C:\Windows\System\iEApQzF.exe
  C:\Windows\System\iEApQzF.exe
  2⤵
  PID:9124
- C:\Windows\System\fRwbkUU.exe
  C:\Windows\System\fRwbkUU.exe
  2⤵
  PID:9152
- C:\Windows\System\IwmDuIM.exe
  C:\Windows\System\IwmDuIM.exe
  2⤵
  PID:9180
- C:\Windows\System\hvjSfdC.exe
  C:\Windows\System\hvjSfdC.exe
  2⤵
  PID:9208
- C:\Windows\System\QefvITt.exe
  C:\Windows\System\QefvITt.exe
  2⤵
  PID:8236
- C:\Windows\System\GMIvISK.exe
  C:\Windows\System\GMIvISK.exe
  2⤵
  PID:8300
- C:\Windows\System\tdVrCQj.exe
  C:\Windows\System\tdVrCQj.exe
  2⤵
  PID:8360
- C:\Windows\System\bYbodsB.exe
  C:\Windows\System\bYbodsB.exe
  2⤵
  PID:8432
- C:\Windows\System\WdfcfmB.exe
  C:\Windows\System\WdfcfmB.exe
  2⤵
  PID:8456
- C:\Windows\System\DRuUVFi.exe
  C:\Windows\System\DRuUVFi.exe
  2⤵
  PID:7592
- C:\Windows\System\koENavn.exe
  C:\Windows\System\koENavn.exe
  2⤵
  PID:8612
- C:\Windows\System\EkRPjrB.exe
  C:\Windows\System\EkRPjrB.exe
  2⤵
  PID:8660
- C:\Windows\System\KHdWJfN.exe
  C:\Windows\System\KHdWJfN.exe
  2⤵
  PID:8748
- C:\Windows\System\UWYGFTx.exe
  C:\Windows\System\UWYGFTx.exe
  2⤵
  PID:8804
- C:\Windows\System\QikWtyc.exe
  C:\Windows\System\QikWtyc.exe
  2⤵
  PID:8884
- C:\Windows\System\iLAqcQQ.exe
  C:\Windows\System\iLAqcQQ.exe
  2⤵
  PID:8948
- C:\Windows\System\lQskOeR.exe
  C:\Windows\System\lQskOeR.exe
  2⤵
  PID:9008
- C:\Windows\System\sXvVygD.exe
  C:\Windows\System\sXvVygD.exe
  2⤵
  PID:9080
- C:\Windows\System\wTQrQbC.exe
  C:\Windows\System\wTQrQbC.exe
  2⤵
  PID:9144
- C:\Windows\System\dzorJwy.exe
  C:\Windows\System\dzorJwy.exe
  2⤵
  PID:9172
- C:\Windows\System\SSzoTcS.exe
  C:\Windows\System\SSzoTcS.exe
  2⤵
  PID:8264
- C:\Windows\System\ItqpVGz.exe
  C:\Windows\System\ItqpVGz.exe
  2⤵
  PID:8412
- C:\Windows\System\HREScXc.exe
  C:\Windows\System\HREScXc.exe
  2⤵
  PID:8540
- C:\Windows\System\AJhDQEl.exe
  C:\Windows\System\AJhDQEl.exe
  2⤵
  PID:8712
- C:\Windows\System\JGHdLDG.exe
  C:\Windows\System\JGHdLDG.exe
  2⤵
  PID:8868
- C:\Windows\System\mDsERZk.exe
  C:\Windows\System\mDsERZk.exe
  2⤵
  PID:9004
- C:\Windows\System\KlMQdfx.exe
  C:\Windows\System\KlMQdfx.exe
  2⤵
  PID:5004
- C:\Windows\System\kMkzRmr.exe
  C:\Windows\System\kMkzRmr.exe
  2⤵
  PID:8348
- C:\Windows\System\deLIXcN.exe
  C:\Windows\System\deLIXcN.exe
  2⤵
  PID:8636
- C:\Windows\System\OeGBPnx.exe
  C:\Windows\System\OeGBPnx.exe
  2⤵
  PID:9052
- C:\Windows\System\TvnHgUK.exe
  C:\Windows\System\TvnHgUK.exe
  2⤵
  PID:8676
- C:\Windows\System\tlErAPQ.exe
  C:\Windows\System\tlErAPQ.exe
  2⤵
  PID:8328
- C:\Windows\System\yxnOUIw.exe
  C:\Windows\System\yxnOUIw.exe
  2⤵
  PID:9228
- C:\Windows\System\WTtcoUm.exe
  C:\Windows\System\WTtcoUm.exe
  2⤵
  PID:9256
- C:\Windows\System\EucVmFc.exe
  C:\Windows\System\EucVmFc.exe
  2⤵
  PID:9284
- C:\Windows\System\MmiUdvM.exe
  C:\Windows\System\MmiUdvM.exe
  2⤵
  PID:9312
- C:\Windows\System\DGYrXMb.exe
  C:\Windows\System\DGYrXMb.exe
  2⤵
  PID:9340
- C:\Windows\System\NHHqeWw.exe
  C:\Windows\System\NHHqeWw.exe
  2⤵
  PID:9368
- C:\Windows\System\otpHbGe.exe
  C:\Windows\System\otpHbGe.exe
  2⤵
  PID:9396
- C:\Windows\System\LBCwVgl.exe
  C:\Windows\System\LBCwVgl.exe
  2⤵
  PID:9424
- C:\Windows\System\noXwwgC.exe
  C:\Windows\System\noXwwgC.exe
  2⤵
  PID:9452
- C:\Windows\System\ZtcNBpX.exe
  C:\Windows\System\ZtcNBpX.exe
  2⤵
  PID:9484
- C:\Windows\System\FMoCqvR.exe
  C:\Windows\System\FMoCqvR.exe
  2⤵
  PID:9512
- C:\Windows\System\RuwaAFy.exe
  C:\Windows\System\RuwaAFy.exe
  2⤵
  PID:9540
- C:\Windows\System\CvLlzcc.exe
  C:\Windows\System\CvLlzcc.exe
  2⤵
  PID:9568
- C:\Windows\System\bFmRucR.exe
  C:\Windows\System\bFmRucR.exe
  2⤵
  PID:9596
- C:\Windows\System\vNnTKxy.exe
  C:\Windows\System\vNnTKxy.exe
  2⤵
  PID:9624
- C:\Windows\System\aXoXecl.exe
  C:\Windows\System\aXoXecl.exe
  2⤵
  PID:9652
- C:\Windows\System\oDMdmZE.exe
  C:\Windows\System\oDMdmZE.exe
  2⤵
  PID:9680
- C:\Windows\System\EEHLsEX.exe
  C:\Windows\System\EEHLsEX.exe
  2⤵
  PID:9708
- C:\Windows\System\PolbVjx.exe
  C:\Windows\System\PolbVjx.exe
  2⤵
  PID:9736
- C:\Windows\System\jWYPzyx.exe
  C:\Windows\System\jWYPzyx.exe
  2⤵
  PID:9764
- C:\Windows\System\yQWWlzS.exe
  C:\Windows\System\yQWWlzS.exe
  2⤵
  PID:9792
- C:\Windows\System\GMEoXTX.exe
  C:\Windows\System\GMEoXTX.exe
  2⤵
  PID:9820
- C:\Windows\System\JrWmVbr.exe
  C:\Windows\System\JrWmVbr.exe
  2⤵
  PID:9848
- C:\Windows\System\FpgdFXq.exe
  C:\Windows\System\FpgdFXq.exe
  2⤵
  PID:9876
- C:\Windows\System\vIftzjq.exe
  C:\Windows\System\vIftzjq.exe
  2⤵
  PID:9904
- C:\Windows\System\yxGKMwg.exe
  C:\Windows\System\yxGKMwg.exe
  2⤵
  PID:9932
- C:\Windows\System\wfRDPRC.exe
  C:\Windows\System\wfRDPRC.exe
  2⤵
  PID:9960
- C:\Windows\System\IpgmHvo.exe
  C:\Windows\System\IpgmHvo.exe
  2⤵
  PID:9988
- C:\Windows\System\AvjYFCN.exe
  C:\Windows\System\AvjYFCN.exe
  2⤵
  PID:10024
- C:\Windows\System\unTlviO.exe
  C:\Windows\System\unTlviO.exe
  2⤵
  PID:10044
- C:\Windows\System\AWWqtXN.exe
  C:\Windows\System\AWWqtXN.exe
  2⤵
  PID:10072
- C:\Windows\System\hInCqWQ.exe
  C:\Windows\System\hInCqWQ.exe
  2⤵
  PID:10100
- C:\Windows\System\dzGcmnl.exe
  C:\Windows\System\dzGcmnl.exe
  2⤵
  PID:10128
- C:\Windows\System\pOuieeD.exe
  C:\Windows\System\pOuieeD.exe
  2⤵
  PID:10156
- C:\Windows\System\VZQbaAQ.exe
  C:\Windows\System\VZQbaAQ.exe
  2⤵
  PID:10184
- C:\Windows\System\uGIuFVg.exe
  C:\Windows\System\uGIuFVg.exe
  2⤵
  PID:10212
- C:\Windows\System\DzmoBOC.exe
  C:\Windows\System\DzmoBOC.exe
  2⤵
  PID:8976
- C:\Windows\System\QJHNrKB.exe
  C:\Windows\System\QJHNrKB.exe
  2⤵
  PID:9276
- C:\Windows\System\TIvqTbQ.exe
  C:\Windows\System\TIvqTbQ.exe
  2⤵
  PID:9336
- C:\Windows\System\yPCkQaD.exe
  C:\Windows\System\yPCkQaD.exe
  2⤵
  PID:9408
- C:\Windows\System\UirRIQW.exe
  C:\Windows\System\UirRIQW.exe
  2⤵
  PID:9472
- C:\Windows\System\etKfOTO.exe
  C:\Windows\System\etKfOTO.exe
  2⤵
  PID:9532
- C:\Windows\System\CUVpkCR.exe
  C:\Windows\System\CUVpkCR.exe
  2⤵
  PID:9608
- C:\Windows\System\CdzWDWE.exe
  C:\Windows\System\CdzWDWE.exe
  2⤵
  PID:9668
- C:\Windows\System\AGqNGAz.exe
  C:\Windows\System\AGqNGAz.exe
  2⤵
  PID:9732
- C:\Windows\System\dikRYQf.exe
  C:\Windows\System\dikRYQf.exe
  2⤵
  PID:9804
- C:\Windows\System\WryuCHc.exe
  C:\Windows\System\WryuCHc.exe
  2⤵
  PID:9868
- C:\Windows\System\OCPNmvs.exe
  C:\Windows\System\OCPNmvs.exe
  2⤵
  PID:9900
- C:\Windows\System\pyOhvFP.exe
  C:\Windows\System\pyOhvFP.exe
  2⤵
  PID:9956
- C:\Windows\System\tQsARvY.exe
  C:\Windows\System\tQsARvY.exe
  2⤵
  PID:10008
- C:\Windows\System\ejuejXl.exe
  C:\Windows\System\ejuejXl.exe
  2⤵
  PID:10124
- C:\Windows\System\CzkIBuU.exe
  C:\Windows\System\CzkIBuU.exe
  2⤵
  PID:10196
- C:\Windows\System\axwSAaU.exe
  C:\Windows\System\axwSAaU.exe
  2⤵
  PID:9244
- C:\Windows\System\htxlOST.exe
  C:\Windows\System\htxlOST.exe
  2⤵
  PID:9448
- C:\Windows\System\CnbnPFw.exe
  C:\Windows\System\CnbnPFw.exe
  2⤵
  PID:9564
- C:\Windows\System\irwWoyN.exe
  C:\Windows\System\irwWoyN.exe
  2⤵
  PID:9720
- C:\Windows\System\UztpsZv.exe
  C:\Windows\System\UztpsZv.exe
  2⤵
  PID:9860
- C:\Windows\System\LiGxuyM.exe
  C:\Windows\System\LiGxuyM.exe
  2⤵
  PID:10000
- C:\Windows\System\HfoLBdI.exe
  C:\Windows\System\HfoLBdI.exe
  2⤵
  PID:10152
- C:\Windows\System\CMeEQQp.exe
  C:\Windows\System\CMeEQQp.exe
  2⤵
  PID:9364
- C:\Windows\System\HkfKWUU.exe
  C:\Windows\System\HkfKWUU.exe
  2⤵
  PID:9700
- C:\Windows\System\YQwxbSE.exe
  C:\Windows\System\YQwxbSE.exe
  2⤵
  PID:10112
- C:\Windows\System\ApgwXfl.exe
  C:\Windows\System\ApgwXfl.exe
  2⤵
  PID:9664
- C:\Windows\System\BkfpMGA.exe
  C:\Windows\System\BkfpMGA.exe
  2⤵
  PID:10056
- C:\Windows\System\YPtzmAM.exe
  C:\Windows\System\YPtzmAM.exe
  2⤵
  PID:10268
- C:\Windows\System\TzLdBSy.exe
  C:\Windows\System\TzLdBSy.exe
  2⤵
  PID:10296
- C:\Windows\System\oMsZCIk.exe
  C:\Windows\System\oMsZCIk.exe
  2⤵
  PID:10324
- C:\Windows\System\PukYFdO.exe
  C:\Windows\System\PukYFdO.exe
  2⤵
  PID:10352
- C:\Windows\System\YVmwmKY.exe
  C:\Windows\System\YVmwmKY.exe
  2⤵
  PID:10380
- C:\Windows\System\bPDDqnE.exe
  C:\Windows\System\bPDDqnE.exe
  2⤵
  PID:10408
- C:\Windows\System\VbfkTpL.exe
  C:\Windows\System\VbfkTpL.exe
  2⤵
  PID:10436
- C:\Windows\System\qQBuQDp.exe
  C:\Windows\System\qQBuQDp.exe
  2⤵
  PID:10464
- C:\Windows\System\ZKFMswB.exe
  C:\Windows\System\ZKFMswB.exe
  2⤵
  PID:10492
- C:\Windows\System\yKmTTFq.exe
  C:\Windows\System\yKmTTFq.exe
  2⤵
  PID:10520
- C:\Windows\System\nfpwpnA.exe
  C:\Windows\System\nfpwpnA.exe
  2⤵
  PID:10548
- C:\Windows\System\mulrIhl.exe
  C:\Windows\System\mulrIhl.exe
  2⤵
  PID:10576
- C:\Windows\System\BCsSaOr.exe
  C:\Windows\System\BCsSaOr.exe
  2⤵
  PID:10604
- C:\Windows\System\OXxEkTj.exe
  C:\Windows\System\OXxEkTj.exe
  2⤵
  PID:10632
- C:\Windows\System\RnmvNoR.exe
  C:\Windows\System\RnmvNoR.exe
  2⤵
  PID:10660
- C:\Windows\System\wYZRmBO.exe
  C:\Windows\System\wYZRmBO.exe
  2⤵
  PID:10688
- C:\Windows\System\HszYHAr.exe
  C:\Windows\System\HszYHAr.exe
  2⤵
  PID:10716
- C:\Windows\System\rUXDWiM.exe
  C:\Windows\System\rUXDWiM.exe
  2⤵
  PID:10744
- C:\Windows\System\DaCazyU.exe
  C:\Windows\System\DaCazyU.exe
  2⤵
  PID:10772
- C:\Windows\System\hfeHNWJ.exe
  C:\Windows\System\hfeHNWJ.exe
  2⤵
  PID:10800
- C:\Windows\System\BVKQZMw.exe
  C:\Windows\System\BVKQZMw.exe
  2⤵
  PID:10828
- C:\Windows\System\nbPexcs.exe
  C:\Windows\System\nbPexcs.exe
  2⤵
  PID:10856
- C:\Windows\System\egoREhQ.exe
  C:\Windows\System\egoREhQ.exe
  2⤵
  PID:10884
- C:\Windows\System\CCoiuNn.exe
  C:\Windows\System\CCoiuNn.exe
  2⤵
  PID:10912
- C:\Windows\System\cmOwuTR.exe
  C:\Windows\System\cmOwuTR.exe
  2⤵
  PID:10948
- C:\Windows\System\MCaLenX.exe
  C:\Windows\System\MCaLenX.exe
  2⤵
  PID:10968
- C:\Windows\System\BxhoYoj.exe
  C:\Windows\System\BxhoYoj.exe
  2⤵
  PID:10996
- C:\Windows\System\JDOIBha.exe
  C:\Windows\System\JDOIBha.exe
  2⤵
  PID:11024
- C:\Windows\System\hkfTJOi.exe
  C:\Windows\System\hkfTJOi.exe
  2⤵
  PID:11052
- C:\Windows\System\bizxCTp.exe
  C:\Windows\System\bizxCTp.exe
  2⤵
  PID:11080
- C:\Windows\System\HYdqqwq.exe
  C:\Windows\System\HYdqqwq.exe
  2⤵
  PID:11108
- C:\Windows\System\HhNoZzn.exe
  C:\Windows\System\HhNoZzn.exe
  2⤵
  PID:11136
- C:\Windows\System\fAbOIHt.exe
  C:\Windows\System\fAbOIHt.exe
  2⤵
  PID:11164
- C:\Windows\System\JhQljHb.exe
  C:\Windows\System\JhQljHb.exe
  2⤵
  PID:11192
- C:\Windows\System\XpTvllw.exe
  C:\Windows\System\XpTvllw.exe
  2⤵
  PID:11220
- C:\Windows\System\eKjavmo.exe
  C:\Windows\System\eKjavmo.exe
  2⤵
  PID:11248
- C:\Windows\System\GIOJEkG.exe
  C:\Windows\System\GIOJEkG.exe
  2⤵
  PID:10260
- C:\Windows\System\aBvDMJS.exe
  C:\Windows\System\aBvDMJS.exe
  2⤵
  PID:10316
- C:\Windows\System\AxcRcGu.exe
  C:\Windows\System\AxcRcGu.exe
  2⤵
  PID:10392
- C:\Windows\System\gqniNGk.exe
  C:\Windows\System\gqniNGk.exe
  2⤵
  PID:10456
- C:\Windows\System\PUvAeyo.exe
  C:\Windows\System\PUvAeyo.exe
  2⤵
  PID:10516
- C:\Windows\System\gLJQSYP.exe
  C:\Windows\System\gLJQSYP.exe
  2⤵
  PID:10588
- C:\Windows\System\ojynQTK.exe
  C:\Windows\System\ojynQTK.exe
  2⤵
  PID:10652
- C:\Windows\System\qQvQbZw.exe
  C:\Windows\System\qQvQbZw.exe
  2⤵
  PID:10712
- C:\Windows\System\LzktWiY.exe
  C:\Windows\System\LzktWiY.exe
  2⤵
  PID:10784
- C:\Windows\System\eGtVCKM.exe
  C:\Windows\System\eGtVCKM.exe
  2⤵
  PID:10852
- C:\Windows\System\uJqCsIN.exe
  C:\Windows\System\uJqCsIN.exe
  2⤵
  PID:10924
- C:\Windows\System\hBjYBrE.exe
  C:\Windows\System\hBjYBrE.exe
  2⤵
  PID:10988
- C:\Windows\System\jNYBsTn.exe
  C:\Windows\System\jNYBsTn.exe
  2⤵
  PID:11048
- C:\Windows\System\fzsmsqd.exe
  C:\Windows\System\fzsmsqd.exe
  2⤵
  PID:11120
- C:\Windows\System\TbptQtc.exe
  C:\Windows\System\TbptQtc.exe
  2⤵
  PID:11176
- C:\Windows\System\EFMMNQW.exe
  C:\Windows\System\EFMMNQW.exe
  2⤵
  PID:11240
- C:\Windows\System\LQGogCR.exe
  C:\Windows\System\LQGogCR.exe
  2⤵
  PID:10320
- C:\Windows\System\eowxNkG.exe
  C:\Windows\System\eowxNkG.exe
  2⤵
  PID:10484
- C:\Windows\System\uuVrzDh.exe
  C:\Windows\System\uuVrzDh.exe
  2⤵
  PID:10624
- C:\Windows\System\zdMRiFI.exe
  C:\Windows\System\zdMRiFI.exe
  2⤵
  PID:10764
- C:\Windows\System\pRiHaLR.exe
  C:\Windows\System\pRiHaLR.exe
  2⤵
  PID:10956
- C:\Windows\System\WwixqjJ.exe
  C:\Windows\System\WwixqjJ.exe
  2⤵
  PID:11100
- C:\Windows\System\oOpWrVn.exe
  C:\Windows\System\oOpWrVn.exe
  2⤵
  PID:11212
- C:\Windows\System\OtPzbOY.exe
  C:\Windows\System\OtPzbOY.exe
  2⤵
  PID:10544
- C:\Windows\System\MEQQDBn.exe
  C:\Windows\System\MEQQDBn.exe
  2⤵
  PID:10908
- C:\Windows\System\TCLyxLW.exe
  C:\Windows\System\TCLyxLW.exe
  2⤵
  PID:11204
- C:\Windows\System\spgAPqM.exe
  C:\Windows\System\spgAPqM.exe
  2⤵
  PID:11076
- C:\Windows\System\dTTDSaK.exe
  C:\Windows\System\dTTDSaK.exe
  2⤵
  PID:11272
- C:\Windows\System\NSauAfB.exe
  C:\Windows\System\NSauAfB.exe
  2⤵
  PID:11300
- C:\Windows\System\ecMFTTm.exe
  C:\Windows\System\ecMFTTm.exe
  2⤵
  PID:11328
- C:\Windows\System\fmmRkoL.exe
  C:\Windows\System\fmmRkoL.exe
  2⤵
  PID:11356
- C:\Windows\System\brBHFPo.exe
  C:\Windows\System\brBHFPo.exe
  2⤵
  PID:11384
- C:\Windows\System\NgIKYiL.exe
  C:\Windows\System\NgIKYiL.exe
  2⤵
  PID:11412
- C:\Windows\System\lrvbxSX.exe
  C:\Windows\System\lrvbxSX.exe
  2⤵
  PID:11440
- C:\Windows\System\EaIsQwa.exe
  C:\Windows\System\EaIsQwa.exe
  2⤵
  PID:11468
- C:\Windows\System\caOWewg.exe
  C:\Windows\System\caOWewg.exe
  2⤵
  PID:11496
- C:\Windows\System\alVjfLi.exe
  C:\Windows\System\alVjfLi.exe
  2⤵
  PID:11524
- C:\Windows\System\JlKMeQt.exe
  C:\Windows\System\JlKMeQt.exe
  2⤵
  PID:11552
- C:\Windows\System\FTPwmwX.exe
  C:\Windows\System\FTPwmwX.exe
  2⤵
  PID:11580
- C:\Windows\System\xfZdEXZ.exe
  C:\Windows\System\xfZdEXZ.exe
  2⤵
  PID:11608
- C:\Windows\System\rDadjVS.exe
  C:\Windows\System\rDadjVS.exe
  2⤵
  PID:11636
- C:\Windows\System\ZNAsdsA.exe
  C:\Windows\System\ZNAsdsA.exe
  2⤵
  PID:11664
- C:\Windows\System\qqMWlig.exe
  C:\Windows\System\qqMWlig.exe
  2⤵
  PID:11692
- C:\Windows\System\eJrpFAV.exe
  C:\Windows\System\eJrpFAV.exe
  2⤵
  PID:11720
- C:\Windows\System\RiscYir.exe
  C:\Windows\System\RiscYir.exe
  2⤵
  PID:11748
- C:\Windows\System\BFbbJVq.exe
  C:\Windows\System\BFbbJVq.exe
  2⤵
  PID:11776
- C:\Windows\System\zkgynbd.exe
  C:\Windows\System\zkgynbd.exe
  2⤵
  PID:11796
- C:\Windows\System\RBLDLmO.exe
  C:\Windows\System\RBLDLmO.exe
  2⤵
  PID:11812
- C:\Windows\System\ACiHQes.exe
  C:\Windows\System\ACiHQes.exe
  2⤵
  PID:11884
- C:\Windows\System\QGXNVrN.exe
  C:\Windows\System\QGXNVrN.exe
  2⤵
  PID:11900
- C:\Windows\System\KmSmIXt.exe
  C:\Windows\System\KmSmIXt.exe
  2⤵
  PID:11928
- C:\Windows\System\EIMDJJo.exe
  C:\Windows\System\EIMDJJo.exe
  2⤵
  PID:11944
- C:\Windows\System\eIVCePe.exe
  C:\Windows\System\eIVCePe.exe
  2⤵
  PID:11976
- C:\Windows\System\kMQWlOD.exe
  C:\Windows\System\kMQWlOD.exe
  2⤵
  PID:12012
- C:\Windows\System\GoOdGhs.exe
  C:\Windows\System\GoOdGhs.exe
  2⤵
  PID:12028
- C:\Windows\System\NPmIECG.exe
  C:\Windows\System\NPmIECG.exe
  2⤵
  PID:12068
- C:\Windows\System\blRwoJj.exe
  C:\Windows\System\blRwoJj.exe
  2⤵
  PID:12096
- C:\Windows\System\oelbLfv.exe
  C:\Windows\System\oelbLfv.exe
  2⤵
  PID:12124
- C:\Windows\System\rxHKsFD.exe
  C:\Windows\System\rxHKsFD.exe
  2⤵
  PID:12152
- C:\Windows\System\VOvTSTx.exe
  C:\Windows\System\VOvTSTx.exe
  2⤵
  PID:12180
- C:\Windows\System\vmQzOSn.exe
  C:\Windows\System\vmQzOSn.exe
  2⤵
  PID:12208
- C:\Windows\System\LBwFFcQ.exe
  C:\Windows\System\LBwFFcQ.exe
  2⤵
  PID:12236
- C:\Windows\System\ttLECYW.exe
  C:\Windows\System\ttLECYW.exe
  2⤵
  PID:12264
- C:\Windows\System\zciMhRh.exe
  C:\Windows\System\zciMhRh.exe
  2⤵
  PID:10448
- C:\Windows\System\sNvDEqx.exe
  C:\Windows\System\sNvDEqx.exe
  2⤵
  PID:11324
- C:\Windows\System\gNQWIhH.exe
  C:\Windows\System\gNQWIhH.exe
  2⤵
  PID:11396
- C:\Windows\System\GfxqxZW.exe
  C:\Windows\System\GfxqxZW.exe
  2⤵
  PID:11460
- C:\Windows\System\TcQbEvB.exe
  C:\Windows\System\TcQbEvB.exe
  2⤵
  PID:11520
- C:\Windows\System\NlBmrkL.exe
  C:\Windows\System\NlBmrkL.exe
  2⤵
  PID:11592
- C:\Windows\System\sbTEHtB.exe
  C:\Windows\System\sbTEHtB.exe
  2⤵
  PID:11656
- C:\Windows\System\GKVwnOO.exe
  C:\Windows\System\GKVwnOO.exe
  2⤵
  PID:11716
- C:\Windows\System\kEycXHd.exe
  C:\Windows\System\kEycXHd.exe
  2⤵
  PID:11788
- C:\Windows\System\OFXNoWo.exe
  C:\Windows\System\OFXNoWo.exe
  2⤵
  PID:11844
- C:\Windows\System\randJmJ.exe
  C:\Windows\System\randJmJ.exe
  2⤵
  PID:1612
- C:\Windows\System\DZyLBAb.exe
  C:\Windows\System\DZyLBAb.exe
  2⤵
  PID:11896
- C:\Windows\System\NMIvDxs.exe
  C:\Windows\System\NMIvDxs.exe
  2⤵
  PID:11960
- C:\Windows\System\gOmrFhg.exe
  C:\Windows\System\gOmrFhg.exe
  2⤵
  PID:12048
- C:\Windows\System\UHriycw.exe
  C:\Windows\System\UHriycw.exe
  2⤵
  PID:12088
- C:\Windows\System\dvqZcQB.exe
  C:\Windows\System\dvqZcQB.exe
  2⤵
  PID:12148
- C:\Windows\System\SgeDRaF.exe
  C:\Windows\System\SgeDRaF.exe
  2⤵
  PID:12220
- C:\Windows\System\kDmAZTB.exe
  C:\Windows\System\kDmAZTB.exe
  2⤵
  PID:12284
- C:\Windows\System\gjcuGQF.exe
  C:\Windows\System\gjcuGQF.exe
  2⤵
  PID:11380
- C:\Windows\System\hXmWTVo.exe
  C:\Windows\System\hXmWTVo.exe
  2⤵
  PID:11548
- C:\Windows\System\duYhPWG.exe
  C:\Windows\System\duYhPWG.exe
  2⤵
  PID:11704
- C:\Windows\System\lBCEfMN.exe
  C:\Windows\System\lBCEfMN.exe
  2⤵
  PID:11836
- C:\Windows\System\nCuUTcv.exe
  C:\Windows\System\nCuUTcv.exe
  2⤵
  PID:11916
- C:\Windows\System\triKHjF.exe
  C:\Windows\System\triKHjF.exe
  2⤵
  PID:12064
- C:\Windows\System\VITNuPw.exe
  C:\Windows\System\VITNuPw.exe
  2⤵
  PID:12176
- C:\Windows\System\atqzTEB.exe
  C:\Windows\System\atqzTEB.exe
  2⤵
  PID:11432
- C:\Windows\System\KDcvRRQ.exe
  C:\Windows\System\KDcvRRQ.exe
  2⤵
  PID:11880
- C:\Windows\System\lOQbmIY.exe
  C:\Windows\System\lOQbmIY.exe
  2⤵
  PID:11828
- C:\Windows\System\tCdeyto.exe
  C:\Windows\System\tCdeyto.exe
  2⤵
  PID:11376
- C:\Windows\System\gHWUObT.exe
  C:\Windows\System\gHWUObT.exe
  2⤵
  PID:12204
- C:\Windows\System\rvoLFEM.exe
  C:\Windows\System\rvoLFEM.exe
  2⤵
  PID:12296
- C:\Windows\System\TsJHMqt.exe
  C:\Windows\System\TsJHMqt.exe
  2⤵
  PID:12328
- C:\Windows\System\qtGIyJc.exe
  C:\Windows\System\qtGIyJc.exe
  2⤵
  PID:12356
- C:\Windows\System\VngFogS.exe
  C:\Windows\System\VngFogS.exe
  2⤵
  PID:12384
- C:\Windows\System\PjZxZvl.exe
  C:\Windows\System\PjZxZvl.exe
  2⤵
  PID:12412
- C:\Windows\System\OwTGlCi.exe
  C:\Windows\System\OwTGlCi.exe
  2⤵
  PID:12440
- C:\Windows\System\PIUiTuy.exe
  C:\Windows\System\PIUiTuy.exe
  2⤵
  PID:12468
- C:\Windows\System\FemwKLf.exe
  C:\Windows\System\FemwKLf.exe
  2⤵
  PID:12496
- C:\Windows\System\BRGjEGS.exe
  C:\Windows\System\BRGjEGS.exe
  2⤵
  PID:12524
- C:\Windows\System\vRjMank.exe
  C:\Windows\System\vRjMank.exe
  2⤵
  PID:12552
- C:\Windows\System\eOcPIKL.exe
  C:\Windows\System\eOcPIKL.exe
  2⤵
  PID:12580
- C:\Windows\System\aFivqhw.exe
  C:\Windows\System\aFivqhw.exe
  2⤵
  PID:12608
- C:\Windows\System\QKllTnU.exe
  C:\Windows\System\QKllTnU.exe
  2⤵
  PID:12636
- C:\Windows\System\BTJbpBJ.exe
  C:\Windows\System\BTJbpBJ.exe
  2⤵
  PID:12664
- C:\Windows\System\chjFaJY.exe
  C:\Windows\System\chjFaJY.exe
  2⤵
  PID:12692
- C:\Windows\System\UptopAx.exe
  C:\Windows\System\UptopAx.exe
  2⤵
  PID:12720
- C:\Windows\System\pIilgaR.exe
  C:\Windows\System\pIilgaR.exe
  2⤵
  PID:12748
- C:\Windows\System\nhvayly.exe
  C:\Windows\System\nhvayly.exe
  2⤵
  PID:12776
- C:\Windows\System\bBjZuxs.exe
  C:\Windows\System\bBjZuxs.exe
  2⤵
  PID:12804
- C:\Windows\System\vjQjIDr.exe
  C:\Windows\System\vjQjIDr.exe
  2⤵
  PID:12832
- C:\Windows\System\VtUFDbp.exe
  C:\Windows\System\VtUFDbp.exe
  2⤵
  PID:12860
- C:\Windows\System\QNmWcRt.exe
  C:\Windows\System\QNmWcRt.exe
  2⤵
  PID:12888
- C:\Windows\System\Gplefnc.exe
  C:\Windows\System\Gplefnc.exe
  2⤵
  PID:12916
- C:\Windows\System\WZPKpqY.exe
  C:\Windows\System\WZPKpqY.exe
  2⤵
  PID:12944
- C:\Windows\System\avVQHFc.exe
  C:\Windows\System\avVQHFc.exe
  2⤵
  PID:12972
- C:\Windows\System\blBETMD.exe
  C:\Windows\System\blBETMD.exe
  2⤵
  PID:13012
- C:\Windows\System\fkCvDsD.exe
  C:\Windows\System\fkCvDsD.exe
  2⤵
  PID:13028
- C:\Windows\System\rFBbHMS.exe
  C:\Windows\System\rFBbHMS.exe
  2⤵
  PID:12376
- C:\Windows\System\CdDdvnY.exe
  C:\Windows\System\CdDdvnY.exe
  2⤵
  PID:12408
- C:\Windows\System\wkmiCep.exe
  C:\Windows\System\wkmiCep.exe
  2⤵
  PID:12452
- C:\Windows\System\YQiIfuW.exe
  C:\Windows\System\YQiIfuW.exe
  2⤵
  PID:12488
- C:\Windows\System\oLqKIbY.exe
  C:\Windows\System\oLqKIbY.exe
  2⤵
  PID:12548
- C:\Windows\System\LWpXeCB.exe
  C:\Windows\System\LWpXeCB.exe
  2⤵
  PID:12592
- C:\Windows\System\vQWUChu.exe
  C:\Windows\System\vQWUChu.exe
  2⤵
  PID:12628
- C:\Windows\System\GQcuCPJ.exe
  C:\Windows\System\GQcuCPJ.exe
  2⤵
  PID:12684
- C:\Windows\System\LxVIyVr.exe
  C:\Windows\System\LxVIyVr.exe
  2⤵
  PID:12744
- C:\Windows\System\ayPiJjd.exe
  C:\Windows\System\ayPiJjd.exe
  2⤵
  PID:12824
- C:\Windows\System\IdJQpPc.exe
  C:\Windows\System\IdJQpPc.exe
  2⤵
  PID:12928
- C:\Windows\System\ORFEBqB.exe
  C:\Windows\System\ORFEBqB.exe
  2⤵
  PID:13044
- C:\Windows\System\MfjNinT.exe
  C:\Windows\System\MfjNinT.exe
  2⤵
  PID:13092
- C:\Windows\System\gEuqCxf.exe
  C:\Windows\System\gEuqCxf.exe
  2⤵
  PID:13120
- C:\Windows\System\nhyhFmE.exe
  C:\Windows\System\nhyhFmE.exe
  2⤵
  PID:12656
- C:\Windows\System\FPePjMm.exe
  C:\Windows\System\FPePjMm.exe
  2⤵
  PID:12772
- C:\Windows\System\Vvvrypj.exe
  C:\Windows\System\Vvvrypj.exe
  2⤵
  PID:2912
- C:\Windows\System\jwwWSrA.exe
  C:\Windows\System\jwwWSrA.exe
  2⤵
  PID:13040
- C:\Windows\System\VoSolAQ.exe
  C:\Windows\System\VoSolAQ.exe
  2⤵
  PID:13144
- C:\Windows\System\kzxkfBP.exe
  C:\Windows\System\kzxkfBP.exe
  2⤵
  PID:4920
- C:\Windows\System\lmrAHNK.exe
  C:\Windows\System\lmrAHNK.exe
  2⤵
  PID:884
- C:\Windows\System\RuNiXug.exe
  C:\Windows\System\RuNiXug.exe
  2⤵
  PID:12396
- C:\Windows\System\dufoTvH.exe
  C:\Windows\System\dufoTvH.exe
  2⤵
  PID:12576
- C:\Windows\System\TTIPcgB.exe
  C:\Windows\System\TTIPcgB.exe
  2⤵
  PID:924
- C:\Windows\System\wFpLWoW.exe
  C:\Windows\System\wFpLWoW.exe
  2⤵
  PID:3076
- C:\Windows\System\uoTPkEJ.exe
  C:\Windows\System\uoTPkEJ.exe
  2⤵
  PID:1824
- C:\Windows\System\HgHTiKY.exe
  C:\Windows\System\HgHTiKY.exe
  2⤵
  PID:464
- C:\Windows\System\qkUjCiP.exe
  C:\Windows\System\qkUjCiP.exe
  2⤵
  PID:3656
- C:\Windows\System\ceXQXeE.exe
  C:\Windows\System\ceXQXeE.exe
  2⤵
  PID:3016
- C:\Windows\System\OPAYPod.exe
  C:\Windows\System\OPAYPod.exe
  2⤵
  PID:1688
- C:\Windows\System\AiTrYhL.exe
  C:\Windows\System\AiTrYhL.exe
  2⤵
  PID:768
- C:\Windows\System\fmeKtfP.exe
  C:\Windows\System\fmeKtfP.exe
  2⤵
  PID:4612
- C:\Windows\System\QsVARTz.exe
  C:\Windows\System\QsVARTz.exe
  2⤵
  PID:1384
- C:\Windows\System\RxtHQbU.exe
  C:\Windows\System\RxtHQbU.exe
  2⤵
  PID:4144
- C:\Windows\System\nxUJLUY.exe
  C:\Windows\System\nxUJLUY.exe
  2⤵
  PID:1444
- C:\Windows\System\QKANTYu.exe
  C:\Windows\System\QKANTYu.exe
  2⤵
  PID:12740
- C:\Windows\System\FtNaOeJ.exe
  C:\Windows\System\FtNaOeJ.exe
  2⤵
  PID:3268
- C:\Windows\System\znXcOJN.exe
  C:\Windows\System\znXcOJN.exe
  2⤵
  PID:1672
- C:\Windows\System\leOBKmT.exe
  C:\Windows\System\leOBKmT.exe
  2⤵
  PID:452
- C:\Windows\System\sLRSRSx.exe
  C:\Windows\System\sLRSRSx.exe
  2⤵
  PID:640
- C:\Windows\System\AWrWbkI.exe
  C:\Windows\System\AWrWbkI.exe
  2⤵
  PID:13168
- C:\Windows\System\cuTOrwE.exe
  C:\Windows\System\cuTOrwE.exe
  2⤵
  PID:7136
- C:\Windows\System\WCOxhLj.exe
  C:\Windows\System\WCOxhLj.exe
  2⤵
  PID:6324
- C:\Windows\System\lCgvIss.exe
  C:\Windows\System\lCgvIss.exe
  2⤵
  PID:6556
- C:\Windows\System\cgLVtYO.exe
  C:\Windows\System\cgLVtYO.exe
  2⤵
  PID:5488
- C:\Windows\System\AQfboWi.exe
  C:\Windows\System\AQfboWi.exe
  2⤵
  PID:5368
- C:\Windows\System\xpDiAOz.exe
  C:\Windows\System\xpDiAOz.exe
  2⤵
  PID:6176
- C:\Windows\System\keSijdZ.exe
  C:\Windows\System\keSijdZ.exe
  2⤵
  PID:8936
- C:\Windows\System\SjsMKtQ.exe
  C:\Windows\System\SjsMKtQ.exe
  2⤵
  PID:2056
- C:\Windows\System\WWMScJV.exe
  C:\Windows\System\WWMScJV.exe
  2⤵
  PID:7400
- C:\Windows\System\hzPJxiL.exe
  C:\Windows\System\hzPJxiL.exe
  2⤵
  PID:3068
- C:\Windows\System\BxmfLMJ.exe
  C:\Windows\System\BxmfLMJ.exe
  2⤵
  PID:12968
- C:\Windows\System\zwnoOdo.exe
  C:\Windows\System\zwnoOdo.exe
  2⤵
  PID:7528
- C:\Windows\System\VbWesuk.exe
  C:\Windows\System\VbWesuk.exe
  2⤵
  PID:4204
- C:\Windows\System\scpEgJg.exe
  C:\Windows\System\scpEgJg.exe
  2⤵
  PID:7576
- C:\Windows\System\oGxEYcZ.exe
  C:\Windows\System\oGxEYcZ.exe
  2⤵
  PID:3948
- C:\Windows\System\UGbwgxd.exe
  C:\Windows\System\UGbwgxd.exe
  2⤵
  PID:7696
- C:\Windows\System\ZYERFEx.exe
  C:\Windows\System\ZYERFEx.exe
  2⤵
  PID:8684
- C:\Windows\System\MsWojCA.exe
  C:\Windows\System\MsWojCA.exe
  2⤵
  PID:2792
- C:\Windows\System\LMGKOZq.exe
  C:\Windows\System\LMGKOZq.exe
  2⤵
  PID:1424
- C:\Windows\System\svLfkcp.exe
  C:\Windows\System\svLfkcp.exe
  2⤵
  PID:8836
- C:\Windows\System\zadUFaT.exe
  C:\Windows\System\zadUFaT.exe
  2⤵
  PID:3956
- C:\Windows\System\vQvVRsO.exe
  C:\Windows\System\vQvVRsO.exe
  2⤵
  PID:4076
- C:\Windows\System\jqAzKWQ.exe
  C:\Windows\System\jqAzKWQ.exe
  2⤵
  PID:9116
- C:\Windows\System\hZvzuuM.exe
  C:\Windows\System\hZvzuuM.exe
  2⤵
  PID:4064
- C:\Windows\System\gcAdJWh.exe
  C:\Windows\System\gcAdJWh.exe
  2⤵
  PID:4240
- C:\Windows\System\TWLtMvI.exe
  C:\Windows\System\TWLtMvI.exe
  2⤵
  PID:8292
- C:\Windows\System\JmFlPmk.exe
  C:\Windows\System\JmFlPmk.exe
  2⤵
  PID:7940
- C:\Windows\System\jsFLwkY.exe
  C:\Windows\System\jsFLwkY.exe
  2⤵
  PID:8460
- C:\Windows\System\USeIpaU.exe
  C:\Windows\System\USeIpaU.exe
  2⤵
  PID:3612
- C:\Windows\System\BYAgeNG.exe
  C:\Windows\System\BYAgeNG.exe
  2⤵
  PID:8044
- C:\Windows\System\SnpzTPx.exe
  C:\Windows\System\SnpzTPx.exe
  2⤵
  PID:688
- C:\Windows\System\mMGgSII.exe
  C:\Windows\System\mMGgSII.exe
  2⤵
  PID:8912
- C:\Windows\System\fgvQowG.exe
  C:\Windows\System\fgvQowG.exe
  2⤵
  PID:9120
- C:\Windows\System\pLtqsaJ.exe
  C:\Windows\System\pLtqsaJ.exe
  2⤵
  PID:12536
- C:\Windows\System\ArgoACY.exe
  C:\Windows\System\ArgoACY.exe
  2⤵
  PID:8156
- C:\Windows\System\ITpwIrZ.exe
  C:\Windows\System\ITpwIrZ.exe
  2⤵
  PID:8184
- C:\Windows\System\QgxTKFL.exe
  C:\Windows\System\QgxTKFL.exe
  2⤵
  PID:8840
- C:\Windows\System\MhRkNWA.exe
  C:\Windows\System\MhRkNWA.exe
  2⤵
  PID:8220
- C:\Windows\System\ZYNukvT.exe
  C:\Windows\System\ZYNukvT.exe
  2⤵
  PID:8980
- C:\Windows\System\hsJUWYp.exe
  C:\Windows\System\hsJUWYp.exe
  2⤵
  PID:9272
- C:\Windows\System\UFRkUAs.exe
  C:\Windows\System\UFRkUAs.exe
  2⤵
  PID:9348
- C:\Windows\System\FapBJLg.exe
  C:\Windows\System\FapBJLg.exe
  2⤵
  PID:2260
- C:\Windows\System\pGKamAu.exe
  C:\Windows\System\pGKamAu.exe
  2⤵
  PID:9548
- C:\Windows\System\CBXsaMj.exe
  C:\Windows\System\CBXsaMj.exe
  2⤵
  PID:9632
- C:\Windows\System\JrIPAKA.exe
  C:\Windows\System\JrIPAKA.exe
  2⤵
  PID:4392
- C:\Windows\System\yguNKku.exe
  C:\Windows\System\yguNKku.exe
  2⤵
  PID:9752
- C:\Windows\System\dYKZeUv.exe
  C:\Windows\System\dYKZeUv.exe
  2⤵
  PID:5628
- C:\Windows\System\MwAXyLH.exe
  C:\Windows\System\MwAXyLH.exe
  2⤵
  PID:9772
- C:\Windows\System\WZgoeBx.exe
  C:\Windows\System\WZgoeBx.exe
  2⤵
  PID:7552
- C:\Windows\System\XRgHcto.exe
  C:\Windows\System\XRgHcto.exe
  2⤵
  PID:9836
- C:\Windows\System\kuEQPBz.exe
  C:\Windows\System\kuEQPBz.exe
  2⤵
  PID:9864
- C:\Windows\System\xsBGqIj.exe
  C:\Windows\System\xsBGqIj.exe
  2⤵
  PID:9892
- C:\Windows\System\tKOzaRo.exe
  C:\Windows\System\tKOzaRo.exe
  2⤵
  PID:5964
- C:\Windows\System\jeKsaXt.exe
  C:\Windows\System\jeKsaXt.exe
  2⤵
  PID:6020
- C:\Windows\System\ZfXsohh.exe
  C:\Windows\System\ZfXsohh.exe
  2⤵
  PID:6068
- C:\Windows\System\gMmVFZB.exe
  C:\Windows\System\gMmVFZB.exe
  2⤵
  PID:9996
- C:\Windows\System\fmrpVGh.exe
  C:\Windows\System\fmrpVGh.exe
  2⤵
  PID:5336
- C:\Windows\System\iWoJMlb.exe
  C:\Windows\System\iWoJMlb.exe
  2⤵
  PID:10052
- C:\Windows\System\kHiOGXj.exe
  C:\Windows\System\kHiOGXj.exe
  2⤵
  PID:7888
- C:\Windows\System\zTUzuxF.exe
  C:\Windows\System\zTUzuxF.exe
  2⤵
  PID:10116
- C:\Windows\System\bogNNof.exe
  C:\Windows\System\bogNNof.exe
  2⤵
  PID:6104
- C:\Windows\System\uCCBgrt.exe
  C:\Windows\System\uCCBgrt.exe
  2⤵
  PID:5252
- C:\Windows\System\uFlnEgV.exe
  C:\Windows\System\uFlnEgV.exe
  2⤵
  PID:10164
- C:\Windows\System\ptaqQxI.exe
  C:\Windows\System\ptaqQxI.exe
  2⤵
  PID:5672
- C:\Windows\System\HylShGj.exe
  C:\Windows\System\HylShGj.exe
  2⤵
  PID:5196
- C:\Windows\System\stYNzmV.exe
  C:\Windows\System\stYNzmV.exe
  2⤵
  PID:9252
- C:\Windows\System\jTnBTjB.exe
  C:\Windows\System\jTnBTjB.exe
  2⤵
  PID:9296
- C:\Windows\System\wgjWWsy.exe
  C:\Windows\System\wgjWWsy.exe
  2⤵
  PID:9380
- C:\Windows\System\ghLbhxs.exe
  C:\Windows\System\ghLbhxs.exe
  2⤵
  PID:7588
- C:\Windows\System\fEldySf.exe
  C:\Windows\System\fEldySf.exe
  2⤵
  PID:6340
- C:\Windows\System\DQYdOuO.exe
  C:\Windows\System\DQYdOuO.exe
  2⤵
  PID:9580
- C:\Windows\System\uYQiZsY.exe
  C:\Windows\System\uYQiZsY.exe
  2⤵
  PID:6452
- C:\Windows\System\qZZnljt.exe
  C:\Windows\System\qZZnljt.exe
  2⤵
  PID:9704
- C:\Windows\System\UzOXiDC.exe
  C:\Windows\System\UzOXiDC.exe
  2⤵
  PID:6580
- C:\Windows\System\alDTcjj.exe
  C:\Windows\System\alDTcjj.exe
  2⤵
  PID:6608
- C:\Windows\System\SwstmxF.exe
  C:\Windows\System\SwstmxF.exe
  2⤵
  PID:6680
- C:\Windows\System\uuddoUY.exe
  C:\Windows\System\uuddoUY.exe
  2⤵
  PID:6736
- C:\Windows\System\vtGzeJL.exe
  C:\Windows\System\vtGzeJL.exe
  2⤵
  PID:9928
- C:\Windows\System\UfNnwKS.exe
  C:\Windows\System\UfNnwKS.exe
  2⤵
  PID:10064
- C:\Windows\System\qDWPzlp.exe
  C:\Windows\System\qDWPzlp.exe
  2⤵
  PID:13116
- C:\Windows\System\ZqALnPW.exe
  C:\Windows\System\ZqALnPW.exe
  2⤵
  PID:10168
- C:\Windows\System\FYxwOjZ.exe
  C:\Windows\System\FYxwOjZ.exe
  2⤵
  PID:6972
- C:\Windows\System\yEVprxF.exe
  C:\Windows\System\yEVprxF.exe
  2⤵
  PID:7084
- C:\Windows\System\hJrSqKD.exe
  C:\Windows\System\hJrSqKD.exe
  2⤵
  PID:4156
- C:\Windows\System\cGfGnqN.exe
  C:\Windows\System\cGfGnqN.exe
  2⤵
  PID:8260
- C:\Windows\System\nKitdyG.exe
  C:\Windows\System\nKitdyG.exe
  2⤵
  PID:1076
- C:\Windows\System\nribMTr.exe
  C:\Windows\System\nribMTr.exe
  2⤵
  PID:8344
- C:\Windows\System\eHSqKsJ.exe
  C:\Windows\System\eHSqKsJ.exe
  2⤵
  PID:8400
- C:\Windows\System\ULUHVGx.exe
  C:\Windows\System\ULUHVGx.exe
  2⤵
  PID:6296
- C:\Windows\System\BOtJent.exe
  C:\Windows\System\BOtJent.exe
  2⤵
  PID:8528
- C:\Windows\System\vhHzfRK.exe
  C:\Windows\System\vhHzfRK.exe
  2⤵
  PID:6604
- C:\Windows\System\qtCGtGr.exe
  C:\Windows\System\qtCGtGr.exe
  2⤵
  PID:8648
- C:\Windows\System\aavOYOc.exe
  C:\Windows\System\aavOYOc.exe
  2⤵
  PID:9636
- C:\Windows\System\VkaFLQQ.exe
  C:\Windows\System\VkaFLQQ.exe
  2⤵
  PID:8744
- C:\Windows\System\KvAPERg.exe
  C:\Windows\System\KvAPERg.exe
  2⤵
  PID:8792
- C:\Windows\System\wINSUBC.exe
  C:\Windows\System\wINSUBC.exe
  2⤵
  PID:13232
- C:\Windows\System\wOJlCHz.exe
  C:\Windows\System\wOJlCHz.exe
  2⤵
  PID:8860
- C:\Windows\System\BoHlBTB.exe
  C:\Windows\System\BoHlBTB.exe
  2⤵
  PID:6952
- C:\Windows\System\mQyDhDA.exe
  C:\Windows\System\mQyDhDA.exe
  2⤵
  PID:2968
- C:\Windows\System\tpjHIKY.exe
  C:\Windows\System\tpjHIKY.exe
  2⤵
  PID:4048
- C:\Windows\System\GEEUmCj.exe
  C:\Windows\System\GEEUmCj.exe
  2⤵
  PID:10340
- C:\Windows\System\BnByZjA.exe
  C:\Windows\System\BnByZjA.exe
  2⤵
  PID:6500
- C:\Windows\System\lNrxExV.exe
  C:\Windows\System\lNrxExV.exe
  2⤵
  PID:10396
- C:\Windows\System\RiolgCf.exe
  C:\Windows\System\RiolgCf.exe
  2⤵
  PID:2600
- C:\Windows\System\IaSbjzk.exe
  C:\Windows\System\IaSbjzk.exe
  2⤵
  PID:6960
- C:\Windows\System\RLACrVE.exe
  C:\Windows\System\RLACrVE.exe
  2⤵
  PID:1680
- C:\Windows\System\DWYZFxi.exe
  C:\Windows\System\DWYZFxi.exe
  2⤵
  PID:10480
- C:\Windows\System\flCJgie.exe
  C:\Windows\System\flCJgie.exe
  2⤵
  PID:10508
- C:\Windows\System\OmwQlVN.exe
  C:\Windows\System\OmwQlVN.exe
  2⤵
  PID:7012
- C:\Windows\System\YobGcEn.exe
  C:\Windows\System\YobGcEn.exe
  2⤵
  PID:6892
- C:\Windows\System\ZlGCPTy.exe
  C:\Windows\System\ZlGCPTy.exe
  2⤵
  PID:7176
- C:\Windows\System\QGxnAOW.exe
  C:\Windows\System\QGxnAOW.exe
  2⤵
  PID:9132
- C:\Windows\System\zwiCKuo.exe
  C:\Windows\System\zwiCKuo.exe
  2⤵
  PID:3084
- C:\Windows\System\GjMEmdY.exe
  C:\Windows\System\GjMEmdY.exe
  2⤵
  PID:10612
- C:\Windows\System\upPdnVz.exe
  C:\Windows\System\upPdnVz.exe
  2⤵
  PID:10676
- C:\Windows\System\hsUrtKl.exe
  C:\Windows\System\hsUrtKl.exe
  2⤵
  PID:4608
- C:\Windows\System\dYzePFi.exe
  C:\Windows\System\dYzePFi.exe
  2⤵
  PID:7352
- C:\Windows\System\URuDsjj.exe
  C:\Windows\System\URuDsjj.exe
  2⤵
  PID:10724
- C:\Windows\System\MyEwNFf.exe
  C:\Windows\System\MyEwNFf.exe
  2⤵
  PID:8320
- C:\Windows\System\pjzeyYU.exe
  C:\Windows\System\pjzeyYU.exe
  2⤵
  PID:10808
- C:\Windows\System\qrTMECq.exe
  C:\Windows\System\qrTMECq.exe
  2⤵
  PID:10872
- C:\Windows\System\gZDlrCx.exe
  C:\Windows\System\gZDlrCx.exe
  2⤵
  PID:10920
- C:\Windows\System\AHmoRon.exe
  C:\Windows\System\AHmoRon.exe
  2⤵
  PID:10976
- C:\Windows\System\AUromxW.exe
  C:\Windows\System\AUromxW.exe
  2⤵
  PID:11040
- C:\Windows\System\hTqGZsc.exe
  C:\Windows\System\hTqGZsc.exe
  2⤵
  PID:11096
- C:\Windows\System\pNXzZKQ.exe
  C:\Windows\System\pNXzZKQ.exe
  2⤵
  PID:11144
- C:\Windows\System\pNQbCaS.exe
  C:\Windows\System\pNQbCaS.exe
  2⤵
  PID:8780
- C:\Windows\System\xXfAhMu.exe
  C:\Windows\System\xXfAhMu.exe
  2⤵
  PID:7824
- C:\Windows\System\qtNpJwb.exe
  C:\Windows\System\qtNpJwb.exe
  2⤵
  PID:8920
- C:\Windows\System\TEYRHyc.exe
  C:\Windows\System\TEYRHyc.exe
  2⤵
  PID:10404
- C:\Windows\System\UmhKpQu.exe
  C:\Windows\System\UmhKpQu.exe
  2⤵
  PID:10628
- C:\Windows\System\LdBWyjy.exe
  C:\Windows\System\LdBWyjy.exe
  2⤵
  PID:3696
- C:\Windows\System\LfYEEZQ.exe
  C:\Windows\System\LfYEEZQ.exe
  2⤵
  PID:10896
- C:\Windows\System\COXbVla.exe
  C:\Windows\System\COXbVla.exe
  2⤵
  PID:11020
- C:\Windows\System\lyIEZSI.exe
  C:\Windows\System\lyIEZSI.exe
  2⤵
  PID:208
- C:\Windows\System\WqPhjic.exe
  C:\Windows\System\WqPhjic.exe
  2⤵
  PID:4672
- C:\Windows\System\upqIfZp.exe
  C:\Windows\System\upqIfZp.exe
  2⤵
  PID:3124
- C:\Windows\System\AQFXcZf.exe
  C:\Windows\System\AQFXcZf.exe
  2⤵
  PID:10840
- C:\Windows\System\lKatBSl.exe
  C:\Windows\System\lKatBSl.exe
  2⤵
  PID:7996
- C:\Windows\System\MhZmRti.exe
  C:\Windows\System\MhZmRti.exe
  2⤵
  PID:8016
- C:\Windows\System\XcWsCRL.exe
  C:\Windows\System\XcWsCRL.exe
  2⤵
  PID:10376
- C:\Windows\System\lcjlwNg.exe
  C:\Windows\System\lcjlwNg.exe
  2⤵
  PID:11280
- C:\Windows\System\UUBSyyC.exe
  C:\Windows\System\UUBSyyC.exe
  2⤵
  PID:11336
- C:\Windows\System\sXFDVHc.exe
  C:\Windows\System\sXFDVHc.exe
  2⤵
  PID:11392
- C:\Windows\System\LHXkFiU.exe
  C:\Windows\System\LHXkFiU.exe
  2⤵
  PID:11456
- C:\Windows\System\yNUNLCx.exe
  C:\Windows\System\yNUNLCx.exe
  2⤵
  PID:11512
- C:\Windows\System\oyDobBC.exe
  C:\Windows\System\oyDobBC.exe
  2⤵
  PID:11568
- C:\Windows\System\RUyYtUe.exe
  C:\Windows\System\RUyYtUe.exe
  2⤵
  PID:7220
- C:\Windows\System\CGvNCtu.exe
  C:\Windows\System\CGvNCtu.exe
  2⤵
  PID:7280
- C:\Windows\System\xunHSfb.exe
  C:\Windows\System\xunHSfb.exe
  2⤵
  PID:11708
- C:\Windows\System\YTlPneR.exe
  C:\Windows\System\YTlPneR.exe
  2⤵
  PID:9300
- C:\Windows\System\wePREMx.exe
  C:\Windows\System\wePREMx.exe
  2⤵
  PID:5268
- C:\Windows\System\NfzHoaG.exe
  C:\Windows\System\NfzHoaG.exe
  2⤵
  PID:9528
- C:\Windows\System\TlsLbBM.exe
  C:\Windows\System\TlsLbBM.exe
  2⤵
  PID:9644
- C:\Windows\System\LqMYQMl.exe
  C:\Windows\System\LqMYQMl.exe
  2⤵
  PID:5528
- C:\Windows\System\UIHSzcn.exe
  C:\Windows\System\UIHSzcn.exe
  2⤵
  PID:900
- C:\Windows\System\wlFexbS.exe
  C:\Windows\System\wlFexbS.exe
  2⤵
  PID:11908
- C:\Windows\System\GJrwQTs.exe
  C:\Windows\System\GJrwQTs.exe
  2⤵
  PID:12036
- C:\Windows\System\VTMxfIq.exe
  C:\Windows\System\VTMxfIq.exe
  2⤵
  PID:12104
- C:\Windows\System\iVxhEPw.exe
  C:\Windows\System\iVxhEPw.exe
  2⤵
  PID:12224
- C:\Windows\System\giRUUbx.exe
  C:\Windows\System\giRUUbx.exe
  2⤵
  PID:11284
- C:\Windows\System\mtXWRmc.exe
  C:\Windows\System\mtXWRmc.exe
  2⤵
  PID:11564
- C:\Windows\System\OuPNLnK.exe
  C:\Windows\System\OuPNLnK.exe
  2⤵
  PID:11740
- C:\Windows\System\bcpxQko.exe
  C:\Windows\System\bcpxQko.exe
  2⤵
  PID:5768
- C:\Windows\System\IkEuIkz.exe
  C:\Windows\System\IkEuIkz.exe
  2⤵
  PID:5536
- C:\Windows\System\duoIxMd.exe
  C:\Windows\System\duoIxMd.exe
  2⤵
  PID:12040
- C:\Windows\System\yxfkiFy.exe
  C:\Windows\System\yxfkiFy.exe
  2⤵
  PID:5844
- C:\Windows\System\WfVOjtx.exe
  C:\Windows\System\WfVOjtx.exe
  2⤵
  PID:12232
- C:\Windows\System\uthtJSE.exe
  C:\Windows\System\uthtJSE.exe
  2⤵
  PID:9912
- C:\Windows\System\YLBwPsr.exe
  C:\Windows\System\YLBwPsr.exe
  2⤵
  PID:11744
- C:\Windows\System\XhlLEFU.exe
  C:\Windows\System\XhlLEFU.exe
  2⤵
  PID:9968
- C:\Windows\System\incQWHu.exe
  C:\Windows\System\incQWHu.exe
  2⤵
  PID:11312
- C:\Windows\System\PMOJMuS.exe
  C:\Windows\System\PMOJMuS.exe
  2⤵
  PID:6124
- C:\Windows\System\xBOhbkY.exe
  C:\Windows\System\xBOhbkY.exe
  2⤵
  PID:5616
- C:\Windows\System\JtDnyLk.exe
  C:\Windows\System\JtDnyLk.exe
  2⤵
  PID:9800
- C:\Windows\System\QQjTtmZ.exe
  C:\Windows\System\QQjTtmZ.exe
  2⤵
  PID:13112
- C:\Windows\System\JhKpiDN.exe
  C:\Windows\System\JhKpiDN.exe
  2⤵
  PID:12420
- C:\Windows\System\wJGhSaw.exe
  C:\Windows\System\wJGhSaw.exe
  2⤵
  PID:6140
- C:\Windows\System\DaVRIhl.exe
  C:\Windows\System\DaVRIhl.exe
  2⤵
  PID:12504
- C:\Windows\System\sqLOYDR.exe
  C:\Windows\System\sqLOYDR.exe
  2⤵
  PID:12560
- C:\Windows\System\FWNIaGu.exe
  C:\Windows\System\FWNIaGu.exe
  2⤵
  PID:5624
- C:\Windows\System\HOBVeGL.exe
  C:\Windows\System\HOBVeGL.exe
  2⤵
  PID:9304
- C:\Windows\System\mQJoLfl.exe
  C:\Windows\System\mQJoLfl.exe
  2⤵
  PID:6204
- C:\Windows\System\qdwABNh.exe
  C:\Windows\System\qdwABNh.exe
  2⤵
  PID:6292
- C:\Windows\System\GWuJwJz.exe
  C:\Windows\System\GWuJwJz.exe
  2⤵
  PID:6328
- C:\Windows\System\DYSEVBy.exe
  C:\Windows\System\DYSEVBy.exe
  2⤵
  PID:12868
- C:\Windows\System\BpJgcxl.exe
  C:\Windows\System\BpJgcxl.exe
  2⤵
  PID:9640
- C:\Windows\System\SclYtwN.exe
  C:\Windows\System\SclYtwN.exe
  2⤵
  PID:12980
- C:\Windows\System\HSsMIHo.exe
  C:\Windows\System\HSsMIHo.exe
  2⤵
  PID:6600
- C:\Windows\System\mdoIrgp.exe
  C:\Windows\System\mdoIrgp.exe
  2⤵
  PID:6720
- C:\Windows\System\ccZuHSa.exe
  C:\Windows\System\ccZuHSa.exe
  2⤵
  PID:6788
- C:\Windows\System\xVqvNBw.exe
  C:\Windows\System\xVqvNBw.exe
  2⤵
  PID:6920
- C:\Windows\System\aJnkxor.exe
  C:\Windows\System\aJnkxor.exe
  2⤵
  PID:7056
- C:\Windows\System\WOCSCwf.exe
  C:\Windows\System\WOCSCwf.exe
  2⤵
  PID:9436
- C:\Windows\System\bLmtzsJ.exe
  C:\Windows\System\bLmtzsJ.exe
  2⤵
  PID:9780
- C:\Windows\System\QTqliGj.exe
  C:\Windows\System\QTqliGj.exe
  2⤵
  PID:8516
- C:\Windows\System\fIWWCzc.exe
  C:\Windows\System\fIWWCzc.exe
  2⤵
  PID:8620
- C:\Windows\System\HGoUvki.exe
  C:\Windows\System\HGoUvki.exe
  2⤵
  PID:8704
- C:\Windows\System\cUiUCBU.exe
  C:\Windows\System\cUiUCBU.exe
  2⤵
  PID:12964
- C:\Windows\System\PTAZArD.exe
  C:\Windows\System\PTAZArD.exe
  2⤵
  PID:13220
- C:\Windows\System\DCJrRYC.exe
  C:\Windows\System\DCJrRYC.exe
  2⤵
  PID:13128
- C:\Windows\System\jwuahNI.exe
  C:\Windows\System\jwuahNI.exe
  2⤵
  PID:8764
- C:\Windows\System\ipZeuEZ.exe
  C:\Windows\System\ipZeuEZ.exe
  2⤵
  PID:10276
- C:\Windows\System\kENhNct.exe
  C:\Windows\System\kENhNct.exe
  2⤵
  PID:1328
- C:\Windows\System\deggSSN.exe
  C:\Windows\System\deggSSN.exe
  2⤵
  PID:2540
- C:\Windows\System\sEOCTNK.exe
  C:\Windows\System\sEOCTNK.exe
  2⤵
  PID:1416
- C:\Windows\System\QhHyKbW.exe
  C:\Windows\System\QhHyKbW.exe
  2⤵
  PID:976
- C:\Windows\System\GrKLpnG.exe
  C:\Windows\System\GrKLpnG.exe
  2⤵
  PID:620
- C:\Windows\System\zgdzgpr.exe
  C:\Windows\System\zgdzgpr.exe
  2⤵
  PID:10556
- C:\Windows\System\mZkHyWV.exe
  C:\Windows\System\mZkHyWV.exe
  2⤵
  PID:7236
- C:\Windows\System\zBZRsow.exe
  C:\Windows\System\zBZRsow.exe
  2⤵
  PID:7284
- C:\Windows\System\XVIkUtW.exe
  C:\Windows\System\XVIkUtW.exe
  2⤵
  PID:7416
- C:\Windows\System\ACYkEIW.exe
  C:\Windows\System\ACYkEIW.exe
  2⤵
  PID:4588
- C:\Windows\System\mjXRWEe.exe
  C:\Windows\System\mjXRWEe.exe
  2⤵
  PID:10984
- C:\Windows\System\IntoFrS.exe
  C:\Windows\System\IntoFrS.exe
  2⤵
  PID:7676
- C:\Windows\System\FIKRdaE.exe
  C:\Windows\System\FIKRdaE.exe
  2⤵
  PID:11236
- C:\Windows\System\ZYqePdh.exe
  C:\Windows\System\ZYqePdh.exe
  2⤵
  PID:4464
- C:\Windows\System\OnlxJUr.exe
  C:\Windows\System\OnlxJUr.exe
  2⤵
  PID:10736
- C:\Windows\System\xsFHJuO.exe
  C:\Windows\System\xsFHJuO.exe
  2⤵
  PID:4352
- C:\Windows\System\TcCmNJk.exe
  C:\Windows\System\TcCmNJk.exe
  2⤵
  PID:10708
- C:\Windows\System\qsQCBHw.exe
  C:\Windows\System\qsQCBHw.exe
  2⤵
  PID:10292
- C:\Windows\System\iADLRud.exe
  C:\Windows\System\iADLRud.exe
  2⤵
  PID:11288
- C:\Windows\System\sqeTJog.exe
  C:\Windows\System\sqeTJog.exe
  2⤵
  PID:12908
- C:\Windows\System\oZGsGnZ.exe
  C:\Windows\System\oZGsGnZ.exe
  2⤵
  PID:13132
- C:\Windows\System\lbhVuFl.exe
  C:\Windows\System\lbhVuFl.exe
  2⤵
  PID:5244
- C:\Windows\System\XRbuDbG.exe
  C:\Windows\System\XRbuDbG.exe
  2⤵
  PID:7240
- C:\Windows\System\QWwGtfa.exe
  C:\Windows\System\QWwGtfa.exe
  2⤵
  PID:11680
- C:\Windows\System\bhmRkLS.exe
  C:\Windows\System\bhmRkLS.exe
  2⤵
  PID:5276
- C:\Windows\System\eMpgtEi.exe
  C:\Windows\System\eMpgtEi.exe
  2⤵
  PID:11868
- C:\Windows\System\HnGQudo.exe
  C:\Windows\System\HnGQudo.exe
  2⤵
  PID:7444
- C:\Windows\System\qAbgqiW.exe
  C:\Windows\System\qAbgqiW.exe
  2⤵
  PID:8664
- C:\Windows\System\awSxxnW.exe
  C:\Windows\System\awSxxnW.exe
  2⤵
  PID:12044
- C:\Windows\System\DRhJAAq.exe
  C:\Windows\System\DRhJAAq.exe
  2⤵
  PID:11348
- C:\Windows\System\EWmSxVC.exe
  C:\Windows\System\EWmSxVC.exe
  2⤵
  PID:11760
- C:\Windows\System\VwebHiq.exe
  C:\Windows\System\VwebHiq.exe
  2⤵
  PID:5396
- C:\Windows\System\nTOafcY.exe
  C:\Windows\System\nTOafcY.exe
  2⤵
  PID:12256
- C:\Windows\System\cKgLYlh.exe
  C:\Windows\System\cKgLYlh.exe
  2⤵
  PID:1152
- C:\Windows\System\HpVnVPe.exe
  C:\Windows\System\HpVnVPe.exe
  2⤵
  PID:2288
- C:\Windows\System\yyWxLGt.exe
  C:\Windows\System\yyWxLGt.exe
  2⤵
  PID:456
- C:\Windows\System\lGSPEAX.exe
  C:\Windows\System\lGSPEAX.exe
  2⤵
  PID:12432
- C:\Windows\System\OECwWgO.exe
  C:\Windows\System\OECwWgO.exe
  2⤵
  PID:12532
- C:\Windows\System\bPpnYRX.exe
  C:\Windows\System\bPpnYRX.exe
  2⤵
  PID:7392
- C:\Windows\System\hIezxIH.exe
  C:\Windows\System\hIezxIH.exe
  2⤵
  PID:12728
- C:\Windows\System\BCMUfFa.exe
  C:\Windows\System\BCMUfFa.exe
  2⤵
  PID:11488
- C:\Windows\System\NPkwXUS.exe
  C:\Windows\System\NPkwXUS.exe
  2⤵
  PID:13004
- C:\Windows\System\VozmRMw.exe
  C:\Windows\System\VozmRMw.exe
  2⤵
  PID:6832
- C:\Windows\System\xRkhovF.exe
  C:\Windows\System\xRkhovF.exe
  2⤵
  PID:7312
- C:\Windows\System\gnDqrwV.exe
  C:\Windows\System\gnDqrwV.exe
  2⤵
  PID:7128
- C:\Windows\System\pefJjwi.exe
  C:\Windows\System\pefJjwi.exe
  2⤵
  PID:12828
- C:\Windows\System\NXLJQRC.exe
  C:\Windows\System\NXLJQRC.exe
  2⤵
  PID:3624
- C:\Windows\System\QUMmXRs.exe
  C:\Windows\System\QUMmXRs.exe
  2⤵
  PID:8852
- C:\Windows\System\LZunlfw.exe
  C:\Windows\System\LZunlfw.exe
  2⤵
  PID:6360
- C:\Windows\System\ZRwPUbX.exe
  C:\Windows\System\ZRwPUbX.exe
  2⤵
  PID:1472
- C:\Windows\System\BTXIAre.exe
  C:\Windows\System\BTXIAre.exe
  2⤵
  PID:7216
- C:\Windows\System\gkfmObA.exe
  C:\Windows\System\gkfmObA.exe
  2⤵
  PID:7380
- C:\Windows\System\xTVTmoN.exe
  C:\Windows\System\xTVTmoN.exe
  2⤵
  PID:10928
- C:\Windows\System\cPgBedB.exe
  C:\Windows\System\cPgBedB.exe
  2⤵
  PID:11208
- C:\Windows\System\ZAtbPIx.exe
  C:\Windows\System\ZAtbPIx.exe
  2⤵
  PID:372
- C:\Windows\System\cqdbFQR.exe
  C:\Windows\System\cqdbFQR.exe
  2⤵
  PID:10980
- C:\Windows\System\sLHHCcl.exe
  C:\Windows\System\sLHHCcl.exe
  2⤵
  PID:13024
- C:\Windows\System\YqeNJKm.exe
  C:\Windows\System\YqeNJKm.exe
  2⤵
  PID:8164
- C:\Windows\System\qEzjGLj.exe
  C:\Windows\System\qEzjGLj.exe
  2⤵
  PID:9356
- C:\Windows\System\yeaUpJU.exe
  C:\Windows\System\yeaUpJU.exe
  2⤵
  PID:8552
- C:\Windows\System\XcWOPhB.exe
  C:\Windows\System\XcWOPhB.exe
  2⤵
  PID:12160
- C:\Windows\System\OlUwwdA.exe
  C:\Windows\System\OlUwwdA.exe
  2⤵
  PID:5300
- C:\Windows\System\fzETcnE.exe
  C:\Windows\System\fzETcnE.exe
  2⤵
  PID:11632
- C:\Windows\System\FGzlzyS.exe
  C:\Windows\System\FGzlzyS.exe
  2⤵
  PID:12400
- C:\Windows\System\mksSpfh.exe
  C:\Windows\System\mksSpfh.exe
  2⤵
  PID:12708
- C:\Windows\System\OXfYAim.exe
  C:\Windows\System\OXfYAim.exe
  2⤵
  PID:4460
- C:\Windows\System\FuUVxAp.exe
  C:\Windows\System\FuUVxAp.exe
  2⤵
  PID:6888
- C:\Windows\System\hROeEyN.exe
  C:\Windows\System\hROeEyN.exe
  2⤵
  PID:12996
- C:\Windows\System\ECEMOoA.exe
  C:\Windows\System\ECEMOoA.exe
  2⤵
  PID:7044
- C:\Windows\System\pAecWwv.exe
  C:\Windows\System\pAecWwv.exe
  2⤵
  PID:6248
- C:\Windows\System\fBZBMwj.exe
  C:\Windows\System\fBZBMwj.exe
  2⤵
  PID:1756
- C:\Windows\System\RadsVTH.exe
  C:\Windows\System\RadsVTH.exe
  2⤵
  PID:12512
- C:\Windows\System\bXhskmH.exe
  C:\Windows\System\bXhskmH.exe
  2⤵
  PID:11316
- C:\Windows\System\mhqcgCm.exe
  C:\Windows\System\mhqcgCm.exe
  2⤵
  PID:9492
- C:\Windows\System\ISXtHIN.exe
  C:\Windows\System\ISXtHIN.exe
  2⤵
  PID:11824
- C:\Windows\System\JuWZEdb.exe
  C:\Windows\System\JuWZEdb.exe
  2⤵
  PID:12336
- C:\Windows\System\LChajKe.exe
  C:\Windows\System\LChajKe.exe
  2⤵
  PID:6624
- C:\Windows\System\HwnrHfE.exe
  C:\Windows\System\HwnrHfE.exe
  2⤵
  PID:11764
- C:\Windows\System\ZOasixk.exe
  C:\Windows\System\ZOasixk.exe
  2⤵
  PID:11848
- C:\Windows\System\GYJdyQD.exe
  C:\Windows\System\GYJdyQD.exe
  2⤵
  PID:11060
- C:\Windows\System\xyJUfKK.exe
  C:\Windows\System\xyJUfKK.exe
  2⤵
  PID:9236
- C:\Windows\System\xWUiasJ.exe
  C:\Windows\System\xWUiasJ.exe
  2⤵
  PID:12784
- C:\Windows\System\AUuknME.exe
  C:\Windows\System\AUuknME.exe
  2⤵
  PID:876
- C:\Windows\System\chkRdjc.exe
  C:\Windows\System\chkRdjc.exe
  2⤵
  PID:11992
- C:\Windows\System\GEsQnQu.exe
  C:\Windows\System\GEsQnQu.exe
  2⤵
  PID:6380
- C:\Windows\System\RKwyIEJ.exe
  C:\Windows\System\RKwyIEJ.exe
  2⤵
  PID:10068
- C:\Windows\System\QUlQnlH.exe
  C:\Windows\System\QUlQnlH.exe
  2⤵
  PID:13340
- C:\Windows\System\UjjVXjC.exe
  C:\Windows\System\UjjVXjC.exe
  2⤵
  PID:13368
- C:\Windows\System\ekSYYJI.exe
  C:\Windows\System\ekSYYJI.exe
  2⤵
  PID:13396
- C:\Windows\System\sjnzzew.exe
  C:\Windows\System\sjnzzew.exe
  2⤵
  PID:13424
- C:\Windows\System\XtjmvRn.exe
  C:\Windows\System\XtjmvRn.exe
  2⤵
  PID:13452
- C:\Windows\System\zMFgIpp.exe
  C:\Windows\System\zMFgIpp.exe
  2⤵
  PID:13480
- C:\Windows\System\vBpQxCF.exe
  C:\Windows\System\vBpQxCF.exe
  2⤵
  PID:13508
- C:\Windows\System\VjPImZk.exe
  C:\Windows\System\VjPImZk.exe
  2⤵
  PID:13536
- C:\Windows\System\oSxBxPr.exe
  C:\Windows\System\oSxBxPr.exe
  2⤵
  PID:13564
- C:\Windows\System\lRJFCyG.exe
  C:\Windows\System\lRJFCyG.exe
  2⤵
  PID:13592
- C:\Windows\System\ukWXdhG.exe
  C:\Windows\System\ukWXdhG.exe
  2⤵
  PID:13620
- C:\Windows\System\CrgKgBw.exe
  C:\Windows\System\CrgKgBw.exe
  2⤵
  PID:13648
- C:\Windows\System\sJDAbGW.exe
  C:\Windows\System\sJDAbGW.exe
  2⤵
  PID:13676
- C:\Windows\System\CypQuJZ.exe
  C:\Windows\System\CypQuJZ.exe
  2⤵
  PID:13704
- C:\Windows\System\ZHzodAM.exe
  C:\Windows\System\ZHzodAM.exe
  2⤵
  PID:13732
- C:\Windows\System\KAdhjwB.exe
  C:\Windows\System\KAdhjwB.exe
  2⤵
  PID:13760
- C:\Windows\System\ONxqxCl.exe
  C:\Windows\System\ONxqxCl.exe
  2⤵
  PID:13788
- C:\Windows\System\WgaQmir.exe
  C:\Windows\System\WgaQmir.exe
  2⤵
  PID:13808
- C:\Windows\System\oLJQutv.exe
  C:\Windows\System\oLJQutv.exe
  2⤵
  PID:13844
- C:\Windows\System\BUFAmRB.exe
  C:\Windows\System\BUFAmRB.exe
  2⤵
  PID:13872
- C:\Windows\System\AAwFUrR.exe
  C:\Windows\System\AAwFUrR.exe
  2⤵
  PID:13904
- C:\Windows\System\sWIDLYN.exe
  C:\Windows\System\sWIDLYN.exe
  2⤵
  PID:13932
- C:\Windows\System\BpPxWcx.exe
  C:\Windows\System\BpPxWcx.exe
  2⤵
  PID:13948
- C:\Windows\System\nVAfHjK.exe
  C:\Windows\System\nVAfHjK.exe
  2⤵
  PID:13988
- C:\Windows\System\gVVmuOJ.exe
  C:\Windows\System\gVVmuOJ.exe
  2⤵
  PID:14016
- C:\Windows\System\SBJgDxY.exe
  C:\Windows\System\SBJgDxY.exe
  2⤵
  PID:14044
- C:\Windows\System\BkztNVZ.exe
  C:\Windows\System\BkztNVZ.exe
  2⤵
  PID:14072
- C:\Windows\System\oPltXxm.exe
  C:\Windows\System\oPltXxm.exe
  2⤵
  PID:14100
- C:\Windows\System\qCuOGVx.exe
  C:\Windows\System\qCuOGVx.exe
  2⤵
  PID:14128
- C:\Windows\System\fnZTePr.exe
  C:\Windows\System\fnZTePr.exe
  2⤵
  PID:14156
- C:\Windows\System\CoerpUI.exe
  C:\Windows\System\CoerpUI.exe
  2⤵
  PID:14184
- C:\Windows\System\xLJlqxU.exe
  C:\Windows\System\xLJlqxU.exe
  2⤵
  PID:14212
- C:\Windows\System\cJaFCdi.exe
  C:\Windows\System\cJaFCdi.exe
  2⤵
  PID:14240
- C:\Windows\System\TmQongt.exe
  C:\Windows\System\TmQongt.exe
  2⤵
  PID:14268
- C:\Windows\System\tBmrWqw.exe
  C:\Windows\System\tBmrWqw.exe
  2⤵
  PID:14296
- C:\Windows\System\QTTQHmI.exe
  C:\Windows\System\QTTQHmI.exe
  2⤵
  PID:14324
- C:\Windows\System\HLuhFxN.exe
  C:\Windows\System\HLuhFxN.exe
  2⤵
  PID:13348
- C:\Windows\System\VfmJzqW.exe
  C:\Windows\System\VfmJzqW.exe
  2⤵
  PID:13412
- C:\Windows\System\cUJfEpe.exe
  C:\Windows\System\cUJfEpe.exe
  2⤵
  PID:13476
- C:\Windows\System\kmptLXr.exe
  C:\Windows\System\kmptLXr.exe
  2⤵
  PID:13532
- C:\Windows\System\jeXINCf.exe
  C:\Windows\System\jeXINCf.exe
  2⤵
  PID:13608
- C:\Windows\System\icIXQkF.exe
  C:\Windows\System\icIXQkF.exe
  2⤵
  PID:13672
- C:\Windows\System\KSiuBFy.exe
  C:\Windows\System\KSiuBFy.exe
  2⤵
  PID:7180
- C:\Windows\System\nIrBUjS.exe
  C:\Windows\System\nIrBUjS.exe
  2⤵
  PID:12704
- C:\Windows\System\NeeLMzt.exe
  C:\Windows\System\NeeLMzt.exe
  2⤵
  PID:13804
- C:\Windows\System\SRDzQbr.exe
  C:\Windows\System\SRDzQbr.exe
  2⤵
  PID:13868
- C:\Windows\System\rRHRmqE.exe
  C:\Windows\System\rRHRmqE.exe
  2⤵
  PID:13940
- C:\Windows\System\pFaNsWQ.exe
  C:\Windows\System\pFaNsWQ.exe
  2⤵
  PID:14004
- C:\Windows\System\YwMUIgZ.exe
  C:\Windows\System\YwMUIgZ.exe
  2⤵
  PID:14068
- C:\Windows\System\oFxGymD.exe
  C:\Windows\System\oFxGymD.exe
  2⤵
  PID:14136
- C:\Windows\System\dUtJTXO.exe
  C:\Windows\System\dUtJTXO.exe
  2⤵
  PID:14200
- C:\Windows\System\YEZQvxY.exe
  C:\Windows\System\YEZQvxY.exe
  2⤵
  PID:14264
- C:\Windows\System\JrZfwwJ.exe
  C:\Windows\System\JrZfwwJ.exe
  2⤵
  PID:14332
- C:\Windows\System\SFBnyVO.exe
  C:\Windows\System\SFBnyVO.exe
  2⤵
  PID:13448
- C:\Windows\System\QftAbfn.exe
  C:\Windows\System\QftAbfn.exe
  2⤵
  PID:13580
- C:\Windows\System\zJkjjOh.exe
  C:\Windows\System\zJkjjOh.exe
  2⤵
  PID:12508
- C:\Windows\System\sIQbgkp.exe
  C:\Windows\System\sIQbgkp.exe
  2⤵
  PID:13824
- C:\Windows\System\RWwWoad.exe
  C:\Windows\System\RWwWoad.exe
  2⤵
  PID:13976
- C:\Windows\System\AOHFhiZ.exe
  C:\Windows\System\AOHFhiZ.exe
  2⤵
  PID:14060
- C:\Windows\System\PESEuGB.exe
  C:\Windows\System\PESEuGB.exe
  2⤵
  PID:14284
- C:\Windows\System\YKELMhD.exe
  C:\Windows\System\YKELMhD.exe
  2⤵
  PID:13552
- C:\Windows\System\vEXJXjI.exe
  C:\Windows\System\vEXJXjI.exe
  2⤵
  PID:13796
- C:\Windows\System\JnzFNHl.exe
  C:\Windows\System\JnzFNHl.exe
  2⤵
  PID:14172
- C:\Windows\System\iCrBrOC.exe
  C:\Windows\System\iCrBrOC.exe
  2⤵
  PID:13712
- C:\Windows\System\VToONJk.exe
  C:\Windows\System\VToONJk.exe
  2⤵
  PID:13432
- C:\Windows\System\iKiXteL.exe
  C:\Windows\System\iKiXteL.exe
  2⤵
  PID:14344
- C:\Windows\System\GFJZgOw.exe
  C:\Windows\System\GFJZgOw.exe
  2⤵
  PID:14372
- C:\Windows\System\adSbYeJ.exe
  C:\Windows\System\adSbYeJ.exe
  2⤵
  PID:14404
- C:\Windows\System\plsYEFo.exe
  C:\Windows\System\plsYEFo.exe
  2⤵
  PID:14432
- C:\Windows\System\cuolkBT.exe
  C:\Windows\System\cuolkBT.exe
  2⤵
  PID:14460
- C:\Windows\System\YhYTvSc.exe
  C:\Windows\System\YhYTvSc.exe
  2⤵
  PID:14488
- C:\Windows\System\GqUCJac.exe
  C:\Windows\System\GqUCJac.exe
  2⤵
  PID:14516
- C:\Windows\System\npwUbXM.exe
  C:\Windows\System\npwUbXM.exe
  2⤵
  PID:14544
- C:\Windows\System\HgwjJRj.exe
  C:\Windows\System\HgwjJRj.exe
  2⤵
  PID:14572
- C:\Windows\System\TrGLoNa.exe
  C:\Windows\System\TrGLoNa.exe
  2⤵
  PID:14600
- C:\Windows\System\vgUKFjG.exe
  C:\Windows\System\vgUKFjG.exe
  2⤵
  PID:14628
- C:\Windows\System\iUIvClK.exe
  C:\Windows\System\iUIvClK.exe
  2⤵
  PID:14664
- C:\Windows\System\LdasbXN.exe
  C:\Windows\System\LdasbXN.exe
  2⤵
  PID:14696
- C:\Windows\System\lsYiwyg.exe
  C:\Windows\System\lsYiwyg.exe
  2⤵
  PID:14724
- C:\Windows\System\rqLcTcU.exe
  C:\Windows\System\rqLcTcU.exe
  2⤵
  PID:14752
- C:\Windows\System\ZyGZARG.exe
  C:\Windows\System\ZyGZARG.exe
  2⤵
  PID:14780
- C:\Windows\System\otWTnhL.exe
  C:\Windows\System\otWTnhL.exe
  2⤵
  PID:14808
- C:\Windows\System\hKFjxya.exe
  C:\Windows\System\hKFjxya.exe
  2⤵
  PID:14836
- C:\Windows\System\JleJDif.exe
  C:\Windows\System\JleJDif.exe
  2⤵
  PID:14864
- C:\Windows\System\qFMPDMY.exe
  C:\Windows\System\qFMPDMY.exe
  2⤵
  PID:14892
- C:\Windows\System\PHNxjfE.exe
  C:\Windows\System\PHNxjfE.exe
  2⤵
  PID:14920
- C:\Windows\System\vSQVIuo.exe
  C:\Windows\System\vSQVIuo.exe
  2⤵
  PID:14948
- C:\Windows\System\mUIhDNL.exe
  C:\Windows\System\mUIhDNL.exe
  2⤵
  PID:14976
- C:\Windows\System\HTQTpCU.exe
  C:\Windows\System\HTQTpCU.exe
  2⤵
  PID:15004
- C:\Windows\System\mzKAich.exe
  C:\Windows\System\mzKAich.exe
  2⤵
  PID:15032
- C:\Windows\System\uEOJhEv.exe
  C:\Windows\System\uEOJhEv.exe
  2⤵
  PID:15048
- C:\Windows\System\WpTZIMH.exe
  C:\Windows\System\WpTZIMH.exe
  2⤵
  PID:15092
- C:\Windows\System\NnELbil.exe
  C:\Windows\System\NnELbil.exe
  2⤵
  PID:15120
- C:\Windows\System\nVJRpLk.exe
  C:\Windows\System\nVJRpLk.exe
  2⤵
  PID:15148
- C:\Windows\System\aFUIjuX.exe
  C:\Windows\System\aFUIjuX.exe
  2⤵
  PID:15176
- C:\Windows\System\UEhLPNA.exe
  C:\Windows\System\UEhLPNA.exe
  2⤵
  PID:15204
- C:\Windows\System\LqPvYgy.exe
  C:\Windows\System\LqPvYgy.exe
  2⤵
  PID:15232
- C:\Windows\System\cIzvdzD.exe
  C:\Windows\System\cIzvdzD.exe
  2⤵
  PID:15260
- C:\Windows\System\pEpiyzs.exe
  C:\Windows\System\pEpiyzs.exe
  2⤵
  PID:15288
- C:\Windows\System\cnNMXtI.exe
  C:\Windows\System\cnNMXtI.exe
  2⤵
  PID:15316
- C:\Windows\System\CwgWYWs.exe
  C:\Windows\System\CwgWYWs.exe
  2⤵
  PID:15344
- C:\Windows\System\oPbiaiA.exe
  C:\Windows\System\oPbiaiA.exe
  2⤵
  PID:14360
- C:\Windows\System\BAZNHGT.exe
  C:\Windows\System\BAZNHGT.exe
  2⤵
  PID:14428
- C:\Windows\System\YICTtQf.exe
  C:\Windows\System\YICTtQf.exe
  2⤵
  PID:14496
- C:\Windows\System\eBfSFfR.exe
  C:\Windows\System\eBfSFfR.exe
  2⤵
  PID:14560
- C:\Windows\System\dMxkSus.exe
  C:\Windows\System\dMxkSus.exe
  2⤵
  PID:14624
- C:\Windows\System\AKHtRMs.exe
  C:\Windows\System\AKHtRMs.exe
  2⤵
  PID:14640
- C:\Windows\System\ppYziiy.exe
  C:\Windows\System\ppYziiy.exe
  2⤵
  PID:14732
- C:\Windows\System\XPGcGFe.exe
  C:\Windows\System\XPGcGFe.exe
  2⤵
  PID:14800
- C:\Windows\System\GQMdjpb.exe
  C:\Windows\System\GQMdjpb.exe
  2⤵
  PID:14856
- C:\Windows\System\VMLHMPg.exe
  C:\Windows\System\VMLHMPg.exe
  2⤵
  PID:14916
- C:\Windows\System\rcGgnYK.exe
  C:\Windows\System\rcGgnYK.exe
  2⤵
  PID:14984
- C:\Windows\System\SrLINRS.exe
  C:\Windows\System\SrLINRS.exe
  2⤵
  PID:15044
- C:\Windows\System\ilADLks.exe
  C:\Windows\System\ilADLks.exe
  2⤵
  PID:15116
- C:\Windows\System\JhsCSvN.exe
  C:\Windows\System\JhsCSvN.exe
  2⤵
  PID:888
- C:\Windows\System\bulBvFR.exe
  C:\Windows\System\bulBvFR.exe
  2⤵
  PID:15220
- C:\Windows\System\cpHwpgD.exe
  C:\Windows\System\cpHwpgD.exe
  2⤵
  PID:15284
- C:\Windows\System\vkVZKTl.exe
  C:\Windows\System\vkVZKTl.exe
  2⤵
  PID:15352
- C:\Windows\System\WMfRyOT.exe
  C:\Windows\System\WMfRyOT.exe
  2⤵
  PID:14468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjf1qzf1.pnv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BMtWjmB.exe

Filesize
2.9MB

MD5
158d6e53061c8458c33e4641ab95406d

SHA1
1f983f8bb44d59af7c37c7eff3a2f211b1df5ecc

SHA256
322f1715b6345e9ad14f56d895d674c6f7ef7a4dfb7e1d1647e9778a1ae2c57b

SHA512
9dd3521dfa7041ec461803835bce81427dd9eb9b97537c8133f235b9418f119e3f911d7289094f73a5659e136caab50a2fb6cc42138f476ef80c9493aa1c88be

Download Submit
C:\Windows\System\BVazcjV.exe

Filesize
2.9MB

MD5
5874263462da4dc6178c4a981d621066

SHA1
f203ce0254a28a28155480ec62dce1067e86569e

SHA256
9c590850bf17d3f262e99822d80aabb2db2957b9ff22f99487d13848109106ee

SHA512
4caea7ad8988425a25b45cac479ab96ca509bc778688cde5d93fc830e0ccfe778571302d231c7004eee4d684a0a35d7f9dae11546f69a74d0525d70437b1d3db

Download Submit
C:\Windows\System\DrNzMlK.exe

Filesize
2.9MB

MD5
5fdbd2ab1daf9e1979a99a7e20fa0084

SHA1
ed9116e82f4e74e00e20264f0075166557f2a498

SHA256
45f7ab896812b421f394cde2c25e13eb69074fc2336335682cd9364142206dec

SHA512
9761e7b57f78b85e8d7eceffab4a7815d4e584451faefdff4813d7ed4e7586e1d249e5cb21d01bce7fdd0698af97074c565257f1e87361f02fbcd2315c6c34c7

Download Submit
C:\Windows\System\FNgjUZI.exe

Filesize
2.9MB

MD5
ee5c6d44398670dbc64ba3b38c631993

SHA1
be2657ed78a23628892a35922bebcab1f709731d

SHA256
a03c84910f38ad1c0cb47e31985d440c5efdcf4f2e2f47bba0e67bd4c6723876

SHA512
aa2c09ba53defe2dd25e099d75b05ede8294ae4e611d6d58f54f3982ae1de2d6cd6e43c47e9ee2e29c669a0009b3527ef05cce7da3349e27e2cb56017ce097f2

Download Submit
C:\Windows\System\GLyAZQw.exe

Filesize
2.9MB

MD5
ccc9bfbcb84879c23c9ad86cc87e3098

SHA1
87813d914da0017554f929a33e69132d8cc04ad4

SHA256
720faff4d61a31767e00ba339074ba8b09fe9d3f5f11163a304680c8a2240a45

SHA512
c7ec9ac9e85ee641fdc312c40c649720034e2fcf740bfe970b0913aa7c8368fdd133503431d51d41db981ff9cbbde137c86b8ffe92aa138ebed59e64185b7a8a

Download Submit
C:\Windows\System\GsNqBQn.exe

Filesize
2.9MB

MD5
b3439ee5d5094e96c5c2b0a0cb3fdea8

SHA1
121f338f6af033ff6c12d31b8e9eca9140701740

SHA256
e9000b68a15ce306e615e587da7ae62fc6c04a17e21077a8aef6ffc922a0fcae

SHA512
9d906c6212e4c1e72f9ad78e5499a4281ee7ee47825aba7545178389e1f76e288e6adbbd3cfc361e0a2ea55c8d47fd06855b6a05935a7d64b3e542dc4ff26368

Download Submit
C:\Windows\System\IDZzRFi.exe

Filesize
2.9MB

MD5
4f67393cb5f1d67cb0fbc6d8616da2ac

SHA1
ae0690940a93a49f53b01c90ff3cd187fe143bf4

SHA256
85d8b7c973d255c452b6759a2c06ec858773291b5cb94510bfff4f4300b5d971

SHA512
6f9e63bf14556223238e9664e57dd6b43c874a287772afdce29236f0f611f1a8183f44a518304ba10c53a50eb0bf4c7c458f96abc0649a5033a79508f607c6d4

Download Submit
C:\Windows\System\LlyEhdf.exe

Filesize
2.9MB

MD5
dc0fc4bca114f39a2f74be2faeed0134

SHA1
6e9cff2f3f0f5582005aa2f24147cc9bc42813d6

SHA256
35c7de240a42bfcb1d620eb489c1029b0ca48ea7e7171a27a3eb6352337dd4af

SHA512
393c18e9e11f605b4d849fc3022ca65cce16c745a694d29b421ad30e9181cea71050f3f0d65f690c0c36c280c22ae65adc6bcfcf8900ff2542ee875f783ac594

Download Submit
C:\Windows\System\QcfRDam.exe

Filesize
2.9MB

MD5
61f4822c026defd65ac50b58c90025b6

SHA1
484d15a3f22fad6e19e73038ca4fefc916b36fb0

SHA256
d4bd74bfee01402113a0a6435f1e0bd40d6c621cc83c7bdda66f5bb0f16d81b5

SHA512
69500d7408067c4e13d297319c7f56c1fe59ece2e5f0dcf27dab556008c5f9886aeab177d9d83b7a7a642bcf2ba1b9c6dc39401caf3d1a51b98fc091d67644bc

Download Submit
C:\Windows\System\RSJlgTM.exe

Filesize
2.9MB

MD5
94d5c4f9fd4b6b1a0690a1db5a43f741

SHA1
15400941fbf44a13d780f5eb820948697ebae510

SHA256
d780136526e338cecb67605dd9091c21decd0197659a0d1ef92603efc5bd8a1d

SHA512
74d94664522fcafaf7a762d6d26274a35231a4485faa3cb89b5c149b890dce49885ac80b84286ce52b8024bdeb963fe9c6694bd18392be8350ad80a7af6f4815

Download Submit
C:\Windows\System\SqKbDNP.exe

Filesize
2.9MB

MD5
cf7c5a28d399637dbe23c7b962b149f5

SHA1
493258f4fe7c4678a8846243e84399043e09b1a0

SHA256
0f4714f4863b6a09333d65e5627520c1e21ce0e1609b7465b5411bf5d8d63480

SHA512
7b2bbe54de490223a433dbd7f86dab8463f74f052e47dab7f6fa1395410c463f9f6501ab4a7a976dd9d234744ca7b870eac5e432648f54716b012522795acf7f

Download Submit
C:\Windows\System\UExcxFZ.exe

Filesize
2.9MB

MD5
d300de7b19c8ad182ffafe6ccd037a83

SHA1
14855fb138c6ff54f4c9370fcfcd3ceec59374e5

SHA256
847b6e4424977a9bdba785f913d581731c2a61668a2b36ff6dc16ecf36c58aac

SHA512
5dd89784243d2d17ad54a8967142e5adc333716198700b27fb7e4ef9cc08e10ce99e26c28434ef128213e92ef657427ae703d108bb022896fbc244bd71a6c63c

Download Submit
C:\Windows\System\VXgPFWq.exe

Filesize
2.9MB

MD5
633f6341c71157a5570da40a72f123cc

SHA1
ad7c020fbd94315837bbe76dca37dd6ca8620a2f

SHA256
d17647286192b784a4d2c6aee6e46277368d43370df204fd99877c9f48a0be99

SHA512
60ffa96ad0ab7cda9b45673f1ec7a5cc08ddc51bf5720fd886076b0a4ad5316d476941a52a596962888b7ba1588378a136eb83e4b1a2a8278635077007e4a446

Download Submit
C:\Windows\System\XTqQSZt.exe

Filesize
2.9MB

MD5
5cadf628b4b7bfc6329ac2b6fcfdd66d

SHA1
997176b40f58c0c3d8e30ea950150af93cf5082e

SHA256
d9f008cf8b3f32350c7e837d129e5f41404f7f5ba3c45511035e7741bc339080

SHA512
11860b8419e588421ad86480d0bcc109cae8356c52176df8d99fb9aa74fc63fcfd8a9ebf8b984623b7ec345f899db7e47117850dc8cbb1071b8ed166383928a2

Download Submit
C:\Windows\System\YMEIbcY.exe

Filesize
2.9MB

MD5
af66c181a29c9efa0011716a32f46e40

SHA1
ffca888a51e42bde08387b363ce1a16b81a90e86

SHA256
46912575e5aea370d35fd6c816dcd0af611b0df32a4df60dc75bc7f3042c8594

SHA512
d2b9aceda3a143da58d4e508b9c434448bbfd629e7d43fe9894f6a85e53f0a266e569bd4ddb8f6b4f512c7a2cb16f68607c670be75b123794d90489c18aad839

Download Submit
C:\Windows\System\bKnlzQM.exe

Filesize
2.9MB

MD5
8a14b05bee183588c1373dca7690706b

SHA1
877fabe4fcbb0e01ddf1091da3bd0699f8d739ed

SHA256
acb883a941f565a1c10dcc2e54feec722efad570a5063c520616a35b27bbf457

SHA512
e77a0cdc351d3d1fa7905ff3943bae98f5ec70d1af4ee7e78ef18341d3f3ee3edec04538ffa25de5d2fba0ec721f5b5cca09cee3a63afc6081649e984bb83ca9

Download Submit
C:\Windows\System\faPEnat.exe

Filesize
2.9MB

MD5
7b5859be3e85634c8a729a5b65c65dc8

SHA1
8b06ab40206e2c9dfec1fddf2fb070f9de394b28

SHA256
9458cd30c8e15ffd9ba5d2e0545c44cfee2e27c4ea5d19c1960436d5503875b8

SHA512
c13e695005ed29a56112ccfd1fa07501c9274ffa1f15b455240a04b0b1aca728bc192d414657a87ce17de29c3c85e78697872dbbd1aa0e8cef32d04df4547810

Download Submit
C:\Windows\System\gKHroFK.exe

Filesize
2.9MB

MD5
61566e628e25790d4fe112b7a40045c0

SHA1
0eb63b6d60bd03b02bfc978d1c860a32b95c046e

SHA256
5a7cd72430b3273b8b36a6e5ece17844a7996b5c86422bfbe929da410c710968

SHA512
2dd9d2faacd6c0e55cd15404fbe59c69e8909e4f20bbdd2636f0417379df0c5c3aea586e216b4bed31dba0ce7f734301be635a1e2f8367d9522d9302078fd50a

Download Submit
C:\Windows\System\gWJMmpy.exe

Filesize
2.9MB

MD5
7da07d3d2581d1d1b0851dace20f11d1

SHA1
70803ad6fcd79add232930f1fd1afc2ff6ff812d

SHA256
412531ea0133f7c9908674db861af205e9fcdb798dec689c6b145624c6c4262d

SHA512
43b2d96e5a71a91f1377509c559f0a55a6dc36633059762d7cd9e3f7323bc6cd83482c95ffa970ae9d629bb3d70155c34fe375261b49f876a0a03c11ddfd2bd2

Download Submit
C:\Windows\System\gXoPzAp.exe

Filesize
2.9MB

MD5
4e20b47977fdc03ae32406e56f755512

SHA1
4e722c681449c8fe54da42b1f9e9b7b1e318c89b

SHA256
c371b65e7ccee0207f6b6018e9e69f4c58087b5bad8ad4e876739823071f5052

SHA512
7c02118e2e75352338770ab7e837df5b3cfa68efe23b1005619129e7712593587657cee6aa9d285aa069601378da4000b9a6f8d44443ad5ed80525e16b33a0a0

Download Submit
C:\Windows\System\hLTyHaR.exe

Filesize
2.9MB

MD5
88c28281459783b29fd9327a1fb15626

SHA1
8bbdd7b20d5db478f71087c475308961f4f5e163

SHA256
d09b6f9a40f8def2a8c9e14a416ad4a8ed01d25f63ca4056cb4cccba08559faa

SHA512
1fa56bb4cd5ae90bbec3eb82685ea9cc2951cb1959238979df005bf8eab3d33a8e2e42d51f572a7327a626fbd4d5a87819f4ee9131245b843917a6a7b935bd2d

Download Submit
C:\Windows\System\hgqrdtE.exe

Filesize
2.9MB

MD5
a6fc2a3ad824ab64d3c158d77ac7e678

SHA1
52bdf16ecfe0b1afed2286ef5ab27ab7af039092

SHA256
1db6f273cf32e5df27047c76ad2f6c1b025c9759d43a628ca65368747ef16e1b

SHA512
2f80f36c65c0bf9289d2212b31ff3618e8aa011aea4c6805e69ca6e16b24d9418d252e14cddba379474a0d0e3bbcab8f25d778f55227857c7a9adcb09f5d52c1

Download Submit
C:\Windows\System\ltDYhQa.exe

Filesize
2.9MB

MD5
b8bdec381ae0a6ff01ba1f773666e0ad

SHA1
d807a314cd6de16a34fe2b7dd86ee28270b9b704

SHA256
82ab7d9a9dac1b9f058061217835c7e330cc544e4a6d073a9ce59cbf2c520acf

SHA512
2b2f26698dfe9696b5c67a4aae73a3d5711afa5319c34ef74f7bc8377259ef45445d9f7547e9d6e984186225d8b59cd32afbc12b350b136114eebe1e736bf086

Download Submit
C:\Windows\System\mZAbnhf.exe

Filesize
2.9MB

MD5
b150178f59f1f64adf3d88bdd98f9360

SHA1
ea0a545edc70bf1bbf962608c9455eabee41f555

SHA256
38972e42734699e05ad1ec5c6502656dfa8842cb1fa21fc4e719714d0b0b024d

SHA512
8ef8de7a1398ed0a58be68ead7f2eaff5b1f3ce0673d6b87c710417d748adf194a49ae030a4ec25eb2d7d4f55974804c5e4769a60e70ebd46b2ca6c3cd42ce47

Download Submit
C:\Windows\System\ozCORmS.exe

Filesize
2.9MB

MD5
608621efa370d949fb97dc43923fd0f2

SHA1
661da9bbafb2847b5b50e64a6a00a89e1aa66413

SHA256
2934378ea31c32bdaac5aff7b7b386dabb30bcf367bb4130b6cfd84915b86faf

SHA512
04582fcf144f123100e3e55b6e00457908b75f062970d587771c6284bde854d9b5589b026ab668c6257675ecff8966682cfa54296f733728dfae56651a5af38f

Download Submit
C:\Windows\System\ozZHiaK.exe

Filesize
8B

MD5
f5de367e14d93143ef1faedf842e5b6d

SHA1
53c34a3e3da8f1f6c2e9e53890e9edf2ff008d74

SHA256
36e55333ae3d5576ba03b741cb1c838f247aac6b1cd7cdcee267d53cebe8decc

SHA512
0b231b233512c747cdbb209c99fd8472d55d97087002ae2f0851082cba32457ea0555a830f41369229ad1917eed68b9237ee47ec40ef110da72ae97f30abe677

Download Submit
C:\Windows\System\qIAAwuh.exe

Filesize
2.9MB

MD5
2df69622d81db16c6a4cc30b46eb4a4a

SHA1
23cf5bb7039d60b15ac3a579a4b2365a7e424179

SHA256
3c18597565c58b215a2b033730fc2150a3e3cc92b7b84a76278cfbfbd1170e47

SHA512
93ac756266e15712b18948fd1f733474c6597c9b7f164f74e669b2639cb287a4a7cec7a13e3eadaae86735cfdfc603d38911dbfd19d02947482f2901757ab8e8

Download Submit
C:\Windows\System\tfVXGum.exe

Filesize
2.9MB

MD5
351e0400d9098806f4b9e701dace5abd

SHA1
cd9b433bfb9dc22d5beea7dd338492c2dc4d5eb8

SHA256
57cbab0b11eff1fe9637f93595c6cfc618c505b55084047a16050d3d3c0726fc

SHA512
be2c770643387d265f1ff0a6b7cbee1756e1a6948cded6814e84cacb7b2ca14956af0a3c8ba7ce7bb2eb884d8a0477ce8090ea06f74a85241d4394467f61e863

Download Submit
C:\Windows\System\tvWakbu.exe

Filesize
2.9MB

MD5
a79bf8541ae592c85ae633220057c817

SHA1
0c3c6c921ef3f2fc0f105f52f389386d390961a1

SHA256
e0d8dc52f2259d54cd90d0d852e3f9feb3f693e47526481a597b7e5393810476

SHA512
03fba152eaff6f6785b995b1e31a85e128d92a76ba04028ba238a1e52874636ad51ebf7b6bf6597cc830d5834da990abe2e54a4161fbd1988c3d25e8d3ce56e4

Download Submit
C:\Windows\System\uWZHmVI.exe

Filesize
2.9MB

MD5
d6f7e78f15b6cc6cf08a46e82edfa16a

SHA1
cee02814a5fba9224eaf8d829d9105e71fd88f5f

SHA256
5c3f17555723178db3682c6b1a4535ff90b2fafdf09d207b3a31e4835e3da839

SHA512
2d798a72f7761d3b03324ce49c7b721766593a2509fd262835a3b7c71e4e20a53da017233c00b0ed8b46aad7e432429ff48279ddc59a924db08ca6b64b566c9f

Download Submit
C:\Windows\System\ucWQjuG.exe

Filesize
2.9MB

MD5
9222a9f68c662fdedfc4ab00ca60a121

SHA1
b786a3b9aac3edc4cd78c29cab4782349e5d4beb

SHA256
495003e7101800e23a67fdefe7c48d4345fd640356383d4569f1dea185b7a077

SHA512
bacb9ceb8491f9832b7426f2495b795d8b85fc8babf2457255f550f6ad20741d6834bb1ee3b59d1ef77107b6b4a3fb78375b53f9450a5e1a0d1aecc02624a1dc

Download Submit
C:\Windows\System\xaPcONC.exe

Filesize
2.9MB

MD5
d3a774d69cfd6a36ba1bb6477e352f39

SHA1
d5b94097571de5056697f6654df6300ba3dbf20e

SHA256
601aa67a26dff54d979ea6423a85e420e8a7d2686eadaa0ccbc13992e4c012f3

SHA512
45fe9e05b03e1870480f17fb8d9c8e9802a9553dfc276d9ab7aff28ba43811c263cbda57a232eb0ecd9ec3df2d8cf96e123283934ccb4fe70e1649987fec0550

Download Submit
C:\Windows\System\xdmwdgE.exe

Filesize
2.9MB

MD5
5fc5e9eff58414f2f5c517f0faea3a0c

SHA1
b7033a1ca1f0a6140318d6c7a414df18e6c7c3e4

SHA256
4924f3bb5b071e4ad4ee2ea468da4fccf6304e111f9c81c14ced7dbc5069b2e1

SHA512
16827aad0507783762908afabfdcdb62457001882d4ad913f678e5289c6f7a7aaa2afe82e81f165d1551d5765c3ca11786dec67a91b0f15a7ba92bc55501c401

Download Submit
memory/760-134-0x00007FF79EEA0000-0x00007FF79F296000-memory.dmp

Filesize
4.0MB

Download
memory/760-2512-0x00007FF79EEA0000-0x00007FF79F296000-memory.dmp

Filesize
4.0MB

Download
memory/1020-112-0x00007FF7B4320000-0x00007FF7B4716000-memory.dmp

Filesize
4.0MB

Download
memory/1020-2510-0x00007FF7B4320000-0x00007FF7B4716000-memory.dmp

Filesize
4.0MB

Download
memory/1160-300-0x00007FF76D640000-0x00007FF76DA36000-memory.dmp

Filesize
4.0MB

Download
memory/1160-2826-0x00007FF76D640000-0x00007FF76DA36000-memory.dmp

Filesize
4.0MB

Download
memory/1456-2511-0x00007FF78DED0000-0x00007FF78E2C6000-memory.dmp

Filesize
4.0MB

Download
memory/1456-128-0x00007FF78DED0000-0x00007FF78E2C6000-memory.dmp

Filesize
4.0MB

Download
memory/1468-2507-0x00007FF7A3DC0000-0x00007FF7A41B6000-memory.dmp

Filesize
4.0MB

Download
memory/1468-103-0x00007FF7A3DC0000-0x00007FF7A41B6000-memory.dmp

Filesize
4.0MB

Download
memory/1480-140-0x00007FF70E300000-0x00007FF70E6F6000-memory.dmp

Filesize
4.0MB

Download
memory/1480-2518-0x00007FF70E300000-0x00007FF70E6F6000-memory.dmp

Filesize
4.0MB

Download
memory/1624-2508-0x00007FF6A6310000-0x00007FF6A6706000-memory.dmp

Filesize
4.0MB

Download
memory/1624-136-0x00007FF6A6310000-0x00007FF6A6706000-memory.dmp

Filesize
4.0MB

Download
memory/2132-138-0x00007FF7A7050000-0x00007FF7A7446000-memory.dmp

Filesize
4.0MB

Download
memory/2132-2515-0x00007FF7A7050000-0x00007FF7A7446000-memory.dmp

Filesize
4.0MB

Download
memory/2192-131-0x00007FF699AD0000-0x00007FF699EC6000-memory.dmp

Filesize
4.0MB

Download
memory/2192-2522-0x00007FF699AD0000-0x00007FF699EC6000-memory.dmp

Filesize
4.0MB

Download
memory/2424-1841-0x00007FF7D82E0000-0x00007FF7D86D6000-memory.dmp

Filesize
4.0MB

Download
memory/2424-1-0x0000022B3D770000-0x0000022B3D780000-memory.dmp

Filesize
64KB

Download
memory/2424-0-0x00007FF7D82E0000-0x00007FF7D86D6000-memory.dmp

Filesize
4.0MB

Download
memory/2464-2506-0x00007FF741FD0000-0x00007FF7423C6000-memory.dmp

Filesize
4.0MB

Download
memory/2464-93-0x00007FF741FD0000-0x00007FF7423C6000-memory.dmp

Filesize
4.0MB

Download
memory/3096-58-0x00007FF731580000-0x00007FF731976000-memory.dmp

Filesize
4.0MB

Download
memory/3096-2504-0x00007FF731580000-0x00007FF731976000-memory.dmp

Filesize
4.0MB

Download
memory/3164-2520-0x00007FF626C50000-0x00007FF627046000-memory.dmp

Filesize
4.0MB

Download
memory/3164-130-0x00007FF626C50000-0x00007FF627046000-memory.dmp

Filesize
4.0MB

Download
memory/3400-2513-0x00007FF633A80000-0x00007FF633E76000-memory.dmp

Filesize
4.0MB

Download
memory/3400-129-0x00007FF633A80000-0x00007FF633E76000-memory.dmp

Filesize
4.0MB

Download
memory/3452-135-0x00007FF7696B0000-0x00007FF769AA6000-memory.dmp

Filesize
4.0MB

Download
memory/3452-2503-0x00007FF7696B0000-0x00007FF769AA6000-memory.dmp

Filesize
4.0MB

Download
memory/3540-2502-0x00007FF67ECD0000-0x00007FF67F0C6000-memory.dmp

Filesize
4.0MB

Download
memory/3540-37-0x00007FF67ECD0000-0x00007FF67F0C6000-memory.dmp

Filesize
4.0MB

Download
memory/3556-139-0x00007FF6836C0000-0x00007FF683AB6000-memory.dmp

Filesize
4.0MB

Download
memory/3556-2519-0x00007FF6836C0000-0x00007FF683AB6000-memory.dmp

Filesize
4.0MB

Download
memory/3600-5-0x00007FFF528C3000-0x00007FFF528C5000-memory.dmp

Filesize
8KB

Download
memory/3600-80-0x000001F3F50A0000-0x000001F3F50C2000-memory.dmp

Filesize
136KB

Download
memory/3600-2128-0x00007FFF528C3000-0x00007FFF528C5000-memory.dmp

Filesize
8KB

Download
memory/3600-51-0x00007FFF528C0000-0x00007FFF53381000-memory.dmp

Filesize
10.8MB

Download
memory/3600-141-0x000001F3F5C30000-0x000001F3F63D6000-memory.dmp

Filesize
7.6MB

Download
memory/3600-1848-0x00007FFF528C0000-0x00007FFF53381000-memory.dmp

Filesize
10.8MB

Download
memory/3600-36-0x00007FFF528C0000-0x00007FFF53381000-memory.dmp

Filesize
10.8MB

Download
memory/3972-127-0x00007FF6D8D50000-0x00007FF6D9146000-memory.dmp

Filesize
4.0MB

Download
memory/3972-2514-0x00007FF6D8D50000-0x00007FF6D9146000-memory.dmp

Filesize
4.0MB

Download
memory/4060-289-0x00007FF6291C0000-0x00007FF6295B6000-memory.dmp

Filesize
4.0MB

Download
memory/4560-137-0x00007FF79FFA0000-0x00007FF7A0396000-memory.dmp

Filesize
4.0MB

Download
memory/4560-2521-0x00007FF79FFA0000-0x00007FF7A0396000-memory.dmp

Filesize
4.0MB

Download
memory/4644-133-0x00007FF687A00000-0x00007FF687DF6000-memory.dmp

Filesize
4.0MB

Download
memory/4644-2516-0x00007FF687A00000-0x00007FF687DF6000-memory.dmp

Filesize
4.0MB

Download
memory/4808-294-0x00007FF7B25A0000-0x00007FF7B2996000-memory.dmp

Filesize
4.0MB

Download
memory/4820-2517-0x00007FF782420000-0x00007FF782816000-memory.dmp

Filesize
4.0MB

Download
memory/4820-132-0x00007FF782420000-0x00007FF782816000-memory.dmp

Filesize
4.0MB

Download
memory/5064-2505-0x00007FF7BA5B0000-0x00007FF7BA9A6000-memory.dmp

Filesize
4.0MB

Download
memory/5064-67-0x00007FF7BA5B0000-0x00007FF7BA9A6000-memory.dmp

Filesize
4.0MB

Download
memory/5072-2509-0x00007FF673BF0000-0x00007FF673FE6000-memory.dmp

Filesize
4.0MB

Download
memory/5072-117-0x00007FF673BF0000-0x00007FF673FE6000-memory.dmp

Filesize
4.0MB

Download