xmrig | 2c445e03bb1a5e76e915bdc64fc44c4ce24ab422c337eb63e19f2b1aa751bd27

Analysis

max time kernel
150s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e0889f3b006e7d0e2fd702cc41480a0.exe
Size

1.1MB
MD5

3e0889f3b006e7d0e2fd702cc41480a0
SHA1

f368b18a54729f10d3f6333ac72b252b9d59be54
SHA256

2c445e03bb1a5e76e915bdc64fc44c4ce24ab422c337eb63e19f2b1aa751bd27
SHA512

2b0777177044540989fd0526b5a3825a90ca46b8d45644ed21ab1da9a77715ea32ec64aec5ca5a54d74644616efaf7668edcb08e12cd9f2db6f37b1778117d4d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipfzaCt3Bbm6zzLA5JgLTCMY:Lz071uv4BPMki8CfVzz0yTS

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/memory/3536-466-0x00007FF7C4C90000-0x00007FF7C5082000-memory.dmp	xmrig
behavioral2/memory/3624-531-0x00007FF720E90000-0x00007FF721282000-memory.dmp	xmrig
behavioral2/memory/4244-685-0x00007FF790640000-0x00007FF790A32000-memory.dmp	xmrig
behavioral2/memory/1736-720-0x00007FF682CE0000-0x00007FF6830D2000-memory.dmp	xmrig
behavioral2/memory/324-2130-0x00007FF782CC0000-0x00007FF7830B2000-memory.dmp	xmrig
behavioral2/memory/2152-2066-0x00007FF6CF2F0000-0x00007FF6CF6E2000-memory.dmp	xmrig
behavioral2/memory/3920-2063-0x00007FF75F250000-0x00007FF75F642000-memory.dmp	xmrig
behavioral2/memory/3200-2069-0x00007FF7BE720000-0x00007FF7BEB12000-memory.dmp	xmrig
behavioral2/memory/1208-1972-0x00007FF6C3A90000-0x00007FF6C3E82000-memory.dmp	xmrig
behavioral2/memory/1620-1208-0x00007FF626A10000-0x00007FF626E02000-memory.dmp	xmrig
behavioral2/memory/3292-1007-0x00007FF74B7C0000-0x00007FF74BBB2000-memory.dmp	xmrig
behavioral2/memory/3112-1004-0x00007FF7EB870000-0x00007FF7EBC62000-memory.dmp	xmrig
behavioral2/memory/660-908-0x00007FF6960E0000-0x00007FF6964D2000-memory.dmp	xmrig
behavioral2/memory/1032-905-0x00007FF6ED8B0000-0x00007FF6EDCA2000-memory.dmp	xmrig
behavioral2/memory/2588-902-0x00007FF78C9D0000-0x00007FF78CDC2000-memory.dmp	xmrig
behavioral2/memory/4828-815-0x00007FF7D9610000-0x00007FF7D9A02000-memory.dmp	xmrig
behavioral2/memory/2344-814-0x00007FF692150000-0x00007FF692542000-memory.dmp	xmrig
behavioral2/memory/4932-600-0x00007FF6327E0000-0x00007FF632BD2000-memory.dmp	xmrig
behavioral2/memory/3340-261-0x00007FF646C30000-0x00007FF647022000-memory.dmp	xmrig
behavioral2/memory/4828-4922-0x00007FF7D9610000-0x00007FF7D9A02000-memory.dmp	xmrig
behavioral2/memory/2588-4978-0x00007FF78C9D0000-0x00007FF78CDC2000-memory.dmp	xmrig
behavioral2/memory/3112-4974-0x00007FF7EB870000-0x00007FF7EBC62000-memory.dmp	xmrig
behavioral2/memory/3292-4980-0x00007FF74B7C0000-0x00007FF74BBB2000-memory.dmp	xmrig
behavioral2/memory/1736-4972-0x00007FF682CE0000-0x00007FF6830D2000-memory.dmp	xmrig
behavioral2/memory/660-4971-0x00007FF6960E0000-0x00007FF6964D2000-memory.dmp	xmrig
behavioral2/memory/4244-4976-0x00007FF790640000-0x00007FF790A32000-memory.dmp	xmrig
behavioral2/memory/4932-4885-0x00007FF6327E0000-0x00007FF632BD2000-memory.dmp	xmrig
behavioral2/memory/1032-4993-0x00007FF6ED8B0000-0x00007FF6EDCA2000-memory.dmp	xmrig
behavioral2/memory/3920-4994-0x00007FF75F250000-0x00007FF75F642000-memory.dmp	xmrig
behavioral2/memory/1208-5010-0x00007FF6C3A90000-0x00007FF6C3E82000-memory.dmp	xmrig
behavioral2/memory/1620-5012-0x00007FF626A10000-0x00007FF626E02000-memory.dmp	xmrig
behavioral2/memory/3200-5008-0x00007FF7BE720000-0x00007FF7BEB12000-memory.dmp	xmrig
behavioral2/memory/324-5005-0x00007FF782CC0000-0x00007FF7830B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1244	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
400	CDDfoVq.exe
3340	FYerkXF.exe
3536	nbogcPW.exe
3100	QlQUuke.exe
4424	AfirUUV.exe
3624	TBeMisT.exe
4932	FAXsPOY.exe
4244	mTRhjHf.exe
1736	NNwwjuT.exe
2344	chxOtgY.exe
4828	XtoPOzV.exe
2588	hwkGheo.exe
1032	bHKnkFq.exe
660	piqFedE.exe
3112	DyCIGhq.exe
3292	fnvIKnJ.exe
1620	TxwitPm.exe
1208	BCncyuC.exe
3920	dlDkyig.exe
2152	jiPVMOB.exe
3200	EeTJTgh.exe
324	coUZRWJ.exe
4080	tDTBAxU.exe
236	YVpKUlw.exe
740	PciGUQI.exe
3116	thNprLr.exe
4592	bZPGkNP.exe
2068	XWbxzKI.exe
2180	kWuNlqx.exe
996	IrQJczH.exe
2788	hJxXnhu.exe
3716	bMWBvTY.exe
1400	vKpWYpy.exe
4336	chdhXsR.exe
2420	jJaxssX.exe
4472	WBONyim.exe
1616	xyyrCvv.exe
4860	BXZowJk.exe
372	gSERumQ.exe
3848	uegbPyL.exe
4024	fMTUeHQ.exe
2032	rzJySOq.exe
2332	EuaFswx.exe
4880	PcFzVbL.exe
4896	wiyaTvp.exe
1508	tCfvVXz.exe
2140	FsjMLTm.exe
904	hScQqzJ.exe
1172	ZRazvHx.exe
1580	EhxInho.exe
420	shlhZag.exe
3464	gJcDsVA.exe
2888	fTCgvSE.exe
2612	etTdVeE.exe
3612	vZjsqht.exe
3804	ZpdaaTK.exe
1456	pVoEPcQ.exe
4444	AwFQAGb.exe
2108	lnQgRlp.exe
2532	bGTekxD.exe
2704	DCZSGQB.exe
3480	RTXTBrN.exe
2652	eKGiaNR.exe
4836	yRBYZjW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3460-0-0x00007FF744D30000-0x00007FF745122000-memory.dmp	upx
behavioral2/files/0x00070000000234bd-6.dat	upx
behavioral2/files/0x00070000000234c7-51.dat	upx
behavioral2/files/0x00070000000234c1-41.dat	upx
behavioral2/files/0x00070000000234c0-40.dat	upx
behavioral2/files/0x00070000000234c5-50.dat	upx
behavioral2/files/0x00070000000234bf-32.dat	upx
behavioral2/files/0x00070000000234c2-44.dat	upx
behavioral2/files/0x00060000000232d4-27.dat	upx
behavioral2/memory/400-24-0x00007FF797350000-0x00007FF797742000-memory.dmp	upx
behavioral2/files/0x00070000000234be-19.dat	upx
behavioral2/files/0x00080000000234bc-12.dat	upx
behavioral2/files/0x00070000000234c9-88.dat	upx
behavioral2/files/0x00070000000234d4-133.dat	upx
behavioral2/files/0x00070000000234d6-163.dat	upx
behavioral2/memory/3536-466-0x00007FF7C4C90000-0x00007FF7C5082000-memory.dmp	upx
behavioral2/memory/3624-531-0x00007FF720E90000-0x00007FF721282000-memory.dmp	upx
behavioral2/memory/4244-685-0x00007FF790640000-0x00007FF790A32000-memory.dmp	upx
behavioral2/memory/1736-720-0x00007FF682CE0000-0x00007FF6830D2000-memory.dmp	upx
behavioral2/memory/324-2130-0x00007FF782CC0000-0x00007FF7830B2000-memory.dmp	upx
behavioral2/memory/2152-2066-0x00007FF6CF2F0000-0x00007FF6CF6E2000-memory.dmp	upx
behavioral2/memory/3920-2063-0x00007FF75F250000-0x00007FF75F642000-memory.dmp	upx
behavioral2/memory/3200-2069-0x00007FF7BE720000-0x00007FF7BEB12000-memory.dmp	upx
behavioral2/memory/1208-1972-0x00007FF6C3A90000-0x00007FF6C3E82000-memory.dmp	upx
behavioral2/memory/1620-1208-0x00007FF626A10000-0x00007FF626E02000-memory.dmp	upx
behavioral2/memory/3292-1007-0x00007FF74B7C0000-0x00007FF74BBB2000-memory.dmp	upx
behavioral2/memory/3112-1004-0x00007FF7EB870000-0x00007FF7EBC62000-memory.dmp	upx
behavioral2/memory/660-908-0x00007FF6960E0000-0x00007FF6964D2000-memory.dmp	upx
behavioral2/memory/1032-905-0x00007FF6ED8B0000-0x00007FF6EDCA2000-memory.dmp	upx
behavioral2/memory/2588-902-0x00007FF78C9D0000-0x00007FF78CDC2000-memory.dmp	upx
behavioral2/memory/4828-815-0x00007FF7D9610000-0x00007FF7D9A02000-memory.dmp	upx
behavioral2/memory/2344-814-0x00007FF692150000-0x00007FF692542000-memory.dmp	upx
behavioral2/memory/4932-600-0x00007FF6327E0000-0x00007FF632BD2000-memory.dmp	upx
behavioral2/memory/3340-261-0x00007FF646C30000-0x00007FF647022000-memory.dmp	upx
behavioral2/files/0x00070000000234d8-169.dat	upx
behavioral2/files/0x00070000000234e3-168.dat	upx
behavioral2/files/0x00070000000234e2-167.dat	upx
behavioral2/files/0x00070000000234cc-166.dat	upx
behavioral2/files/0x00070000000234d7-165.dat	upx
behavioral2/files/0x00070000000234e1-164.dat	upx
behavioral2/files/0x00070000000234e0-162.dat	upx
behavioral2/files/0x00070000000234df-161.dat	upx
behavioral2/files/0x00070000000234de-160.dat	upx
behavioral2/files/0x00070000000234d3-159.dat	upx
behavioral2/files/0x00070000000234dd-155.dat	upx
behavioral2/files/0x00070000000234dc-154.dat	upx
behavioral2/files/0x00070000000234db-153.dat	upx
behavioral2/files/0x00070000000234da-152.dat	upx
behavioral2/files/0x00070000000234d9-151.dat	upx
behavioral2/files/0x00070000000234cd-145.dat	upx
behavioral2/files/0x00070000000234cb-144.dat	upx
behavioral2/files/0x00070000000234ca-137.dat	upx
behavioral2/files/0x00070000000234d5-134.dat	upx
behavioral2/files/0x00070000000234d2-126.dat	upx
behavioral2/files/0x00070000000234d1-125.dat	upx
behavioral2/files/0x00070000000234d0-124.dat	upx
behavioral2/files/0x00070000000234c6-123.dat	upx
behavioral2/files/0x00070000000234cf-115.dat	upx
behavioral2/files/0x00070000000234ce-111.dat	upx
behavioral2/files/0x00070000000234c3-95.dat	upx
behavioral2/files/0x00070000000234c8-84.dat	upx
behavioral2/files/0x00070000000234c4-60.dat	upx
behavioral2/memory/4828-4922-0x00007FF7D9610000-0x00007FF7D9A02000-memory.dmp	upx
behavioral2/memory/2588-4978-0x00007FF78C9D0000-0x00007FF78CDC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XCnUTcg.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\wWVCeaz.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\zcGWQaE.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\dTDLeQT.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\nDMAzUv.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\AyBqgvV.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\vvvXYHp.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\fkIqzww.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\gcAtPjD.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\cpqCHRe.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\mKDWHwG.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\Hfnbhox.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\mhpnogG.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\qDHebib.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\kTATzCg.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\QkhDnRg.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\MGFsNpf.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\bSgFkPa.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\KSiDfdO.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\AlZDNbf.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\ACyaSGz.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\IBbbEvd.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\spOtrJn.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\JSXeqSC.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\KsqoIpe.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\AusmfPL.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\CMyOuaZ.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\HgQMPRO.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\nwhBNhf.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\ZtiQxGA.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\ewjzYUL.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\qdOCWOL.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\mhstELJ.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\iKKZUqd.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\SHbvtUQ.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\srUgsyZ.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\RoLSlUC.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\AMfXNRc.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\fxNwXGS.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\NiVHnwj.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\YQposxQ.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\NxTENLo.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\xoirVdP.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\zElSeox.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\VypLfUP.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\JQmFVcr.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\gNhVOxI.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\VsjOCyo.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\qJFKFKG.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\IwureoL.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\QiIPmZc.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\udawncN.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\yDqcvbz.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\zTXLzTI.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\CcCXmMV.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\pTuCMIC.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\iSmRsec.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\jcFyhyf.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\FbccRjn.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\ynyMZGz.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\mgqwhPp.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\RTJEvni.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\vJPBgkl.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\KUHezgI.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe

Modifies data under HKEY_USERS 53 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t\|0"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	Process not Found

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1244	powershell.exe
1244	powershell.exe
1244	powershell.exe
1244	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeLockMemoryPrivilege	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
14020	Process not Found
7356	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 1244	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	83
PID 3460 wrote to memory of 1244	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	83
PID 3460 wrote to memory of 400	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	84
PID 3460 wrote to memory of 400	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	84
PID 3460 wrote to memory of 3340	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	85
PID 3460 wrote to memory of 3340	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	85
PID 3460 wrote to memory of 3536	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	86
PID 3460 wrote to memory of 3536	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	86
PID 3460 wrote to memory of 3100	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	87
PID 3460 wrote to memory of 3100	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	87
PID 3460 wrote to memory of 4424	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	88
PID 3460 wrote to memory of 4424	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	88
PID 3460 wrote to memory of 3624	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	89
PID 3460 wrote to memory of 3624	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	89
PID 3460 wrote to memory of 4932	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	90
PID 3460 wrote to memory of 4932	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	90
PID 3460 wrote to memory of 4244	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	91
PID 3460 wrote to memory of 4244	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	91
PID 3460 wrote to memory of 1736	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	92
PID 3460 wrote to memory of 1736	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	92
PID 3460 wrote to memory of 2344	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	93
PID 3460 wrote to memory of 2344	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	93
PID 3460 wrote to memory of 4828	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	94
PID 3460 wrote to memory of 4828	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	94
PID 3460 wrote to memory of 1032	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	95
PID 3460 wrote to memory of 1032	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	95
PID 3460 wrote to memory of 2588	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	96
PID 3460 wrote to memory of 2588	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	96
PID 3460 wrote to memory of 660	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	97
PID 3460 wrote to memory of 660	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	97
PID 3460 wrote to memory of 3112	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	98
PID 3460 wrote to memory of 3112	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	98
PID 3460 wrote to memory of 3292	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	99
PID 3460 wrote to memory of 3292	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	99
PID 3460 wrote to memory of 2180	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	100
PID 3460 wrote to memory of 2180	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	100
PID 3460 wrote to memory of 1620	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	101
PID 3460 wrote to memory of 1620	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	101
PID 3460 wrote to memory of 1208	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	102
PID 3460 wrote to memory of 1208	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	102
PID 3460 wrote to memory of 3920	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	103
PID 3460 wrote to memory of 3920	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	103
PID 3460 wrote to memory of 2152	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	104
PID 3460 wrote to memory of 2152	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	104
PID 3460 wrote to memory of 3200	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	105
PID 3460 wrote to memory of 3200	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	105
PID 3460 wrote to memory of 324	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	106
PID 3460 wrote to memory of 324	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	106
PID 3460 wrote to memory of 4080	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	107
PID 3460 wrote to memory of 4080	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	107
PID 3460 wrote to memory of 236	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	108
PID 3460 wrote to memory of 236	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	108
PID 3460 wrote to memory of 740	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	109
PID 3460 wrote to memory of 740	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	109
PID 3460 wrote to memory of 3116	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	110
PID 3460 wrote to memory of 3116	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	110
PID 3460 wrote to memory of 4592	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	111
PID 3460 wrote to memory of 4592	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	111
PID 3460 wrote to memory of 2068	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	112
PID 3460 wrote to memory of 2068	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	112
PID 3460 wrote to memory of 996	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	113
PID 3460 wrote to memory of 996	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	113
PID 3460 wrote to memory of 2788	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	114
PID 3460 wrote to memory of 2788	3460	3e0889f3b006e7d0e2fd702cc41480a0.exe	114

C:\Users\Admin\AppData\Local\Temp\3e0889f3b006e7d0e2fd702cc41480a0.exe
"C:\Users\Admin\AppData\Local\Temp\3e0889f3b006e7d0e2fd702cc41480a0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\System\CDDfoVq.exe
  C:\Windows\System\CDDfoVq.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\FYerkXF.exe
  C:\Windows\System\FYerkXF.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\nbogcPW.exe
  C:\Windows\System\nbogcPW.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\QlQUuke.exe
  C:\Windows\System\QlQUuke.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\AfirUUV.exe
  C:\Windows\System\AfirUUV.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\TBeMisT.exe
  C:\Windows\System\TBeMisT.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\FAXsPOY.exe
  C:\Windows\System\FAXsPOY.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\mTRhjHf.exe
  C:\Windows\System\mTRhjHf.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\NNwwjuT.exe
  C:\Windows\System\NNwwjuT.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\chxOtgY.exe
  C:\Windows\System\chxOtgY.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\XtoPOzV.exe
  C:\Windows\System\XtoPOzV.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\bHKnkFq.exe
  C:\Windows\System\bHKnkFq.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\hwkGheo.exe
  C:\Windows\System\hwkGheo.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\piqFedE.exe
  C:\Windows\System\piqFedE.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\DyCIGhq.exe
  C:\Windows\System\DyCIGhq.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\fnvIKnJ.exe
  C:\Windows\System\fnvIKnJ.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\kWuNlqx.exe
  C:\Windows\System\kWuNlqx.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\TxwitPm.exe
  C:\Windows\System\TxwitPm.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\BCncyuC.exe
  C:\Windows\System\BCncyuC.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\dlDkyig.exe
  C:\Windows\System\dlDkyig.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\jiPVMOB.exe
  C:\Windows\System\jiPVMOB.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\EeTJTgh.exe
  C:\Windows\System\EeTJTgh.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\coUZRWJ.exe
  C:\Windows\System\coUZRWJ.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\tDTBAxU.exe
  C:\Windows\System\tDTBAxU.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\YVpKUlw.exe
  C:\Windows\System\YVpKUlw.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\PciGUQI.exe
  C:\Windows\System\PciGUQI.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\thNprLr.exe
  C:\Windows\System\thNprLr.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\bZPGkNP.exe
  C:\Windows\System\bZPGkNP.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\XWbxzKI.exe
  C:\Windows\System\XWbxzKI.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\IrQJczH.exe
  C:\Windows\System\IrQJczH.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\hJxXnhu.exe
  C:\Windows\System\hJxXnhu.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\bMWBvTY.exe
  C:\Windows\System\bMWBvTY.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\vKpWYpy.exe
  C:\Windows\System\vKpWYpy.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\chdhXsR.exe
  C:\Windows\System\chdhXsR.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\jJaxssX.exe
  C:\Windows\System\jJaxssX.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\WBONyim.exe
  C:\Windows\System\WBONyim.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\xyyrCvv.exe
  C:\Windows\System\xyyrCvv.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\BXZowJk.exe
  C:\Windows\System\BXZowJk.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\gSERumQ.exe
  C:\Windows\System\gSERumQ.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\uegbPyL.exe
  C:\Windows\System\uegbPyL.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\fMTUeHQ.exe
  C:\Windows\System\fMTUeHQ.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\rzJySOq.exe
  C:\Windows\System\rzJySOq.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\EuaFswx.exe
  C:\Windows\System\EuaFswx.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\PcFzVbL.exe
  C:\Windows\System\PcFzVbL.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\wiyaTvp.exe
  C:\Windows\System\wiyaTvp.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\tCfvVXz.exe
  C:\Windows\System\tCfvVXz.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\FsjMLTm.exe
  C:\Windows\System\FsjMLTm.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\hScQqzJ.exe
  C:\Windows\System\hScQqzJ.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\ZRazvHx.exe
  C:\Windows\System\ZRazvHx.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\eKGiaNR.exe
  C:\Windows\System\eKGiaNR.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\EhxInho.exe
  C:\Windows\System\EhxInho.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\shlhZag.exe
  C:\Windows\System\shlhZag.exe
  2⤵
  - Executes dropped EXE
  PID:420
- C:\Windows\System\gJcDsVA.exe
  C:\Windows\System\gJcDsVA.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\fTCgvSE.exe
  C:\Windows\System\fTCgvSE.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\etTdVeE.exe
  C:\Windows\System\etTdVeE.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\PuSpBlX.exe
  C:\Windows\System\PuSpBlX.exe
  2⤵
  PID:1856
- C:\Windows\System\vZjsqht.exe
  C:\Windows\System\vZjsqht.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ZpdaaTK.exe
  C:\Windows\System\ZpdaaTK.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\pVoEPcQ.exe
  C:\Windows\System\pVoEPcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\AwFQAGb.exe
  C:\Windows\System\AwFQAGb.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\lnQgRlp.exe
  C:\Windows\System\lnQgRlp.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\bGTekxD.exe
  C:\Windows\System\bGTekxD.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\DCZSGQB.exe
  C:\Windows\System\DCZSGQB.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\RTXTBrN.exe
  C:\Windows\System\RTXTBrN.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\yRBYZjW.exe
  C:\Windows\System\yRBYZjW.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\aLGJGcw.exe
  C:\Windows\System\aLGJGcw.exe
  2⤵
  PID:2868
- C:\Windows\System\doUTmxp.exe
  C:\Windows\System\doUTmxp.exe
  2⤵
  PID:4676
- C:\Windows\System\WkvSMCW.exe
  C:\Windows\System\WkvSMCW.exe
  2⤵
  PID:736
- C:\Windows\System\oOdMnMQ.exe
  C:\Windows\System\oOdMnMQ.exe
  2⤵
  PID:1220
- C:\Windows\System\dobsUYI.exe
  C:\Windows\System\dobsUYI.exe
  2⤵
  PID:648
- C:\Windows\System\AuIIWlY.exe
  C:\Windows\System\AuIIWlY.exe
  2⤵
  PID:1584
- C:\Windows\System\ygxUXSl.exe
  C:\Windows\System\ygxUXSl.exe
  2⤵
  PID:3248
- C:\Windows\System\TuhcAXu.exe
  C:\Windows\System\TuhcAXu.exe
  2⤵
  PID:3532
- C:\Windows\System\tPNAOyu.exe
  C:\Windows\System\tPNAOyu.exe
  2⤵
  PID:3256
- C:\Windows\System\uArcUMs.exe
  C:\Windows\System\uArcUMs.exe
  2⤵
  PID:872
- C:\Windows\System\sYRJPlC.exe
  C:\Windows\System\sYRJPlC.exe
  2⤵
  PID:788
- C:\Windows\System\qNmxLtK.exe
  C:\Windows\System\qNmxLtK.exe
  2⤵
  PID:2468
- C:\Windows\System\QqtkEkj.exe
  C:\Windows\System\QqtkEkj.exe
  2⤵
  PID:4016
- C:\Windows\System\fAsegpP.exe
  C:\Windows\System\fAsegpP.exe
  2⤵
  PID:1932
- C:\Windows\System\TAizxnF.exe
  C:\Windows\System\TAizxnF.exe
  2⤵
  PID:3888
- C:\Windows\System\KhguxfR.exe
  C:\Windows\System\KhguxfR.exe
  2⤵
  PID:1188
- C:\Windows\System\MbNzbhJ.exe
  C:\Windows\System\MbNzbhJ.exe
  2⤵
  PID:3060
- C:\Windows\System\LDQAuGT.exe
  C:\Windows\System\LDQAuGT.exe
  2⤵
  PID:1452
- C:\Windows\System\PzEkZNG.exe
  C:\Windows\System\PzEkZNG.exe
  2⤵
  PID:3628
- C:\Windows\System\MCpfJKI.exe
  C:\Windows\System\MCpfJKI.exe
  2⤵
  PID:3952
- C:\Windows\System\ZFVRsXa.exe
  C:\Windows\System\ZFVRsXa.exe
  2⤵
  PID:4700
- C:\Windows\System\HyfawRj.exe
  C:\Windows\System\HyfawRj.exe
  2⤵
  PID:1332
- C:\Windows\System\AWYPUpn.exe
  C:\Windows\System\AWYPUpn.exe
  2⤵
  PID:5132
- C:\Windows\System\RfPwuhQ.exe
  C:\Windows\System\RfPwuhQ.exe
  2⤵
  PID:5156
- C:\Windows\System\heHLhog.exe
  C:\Windows\System\heHLhog.exe
  2⤵
  PID:5180
- C:\Windows\System\Ukyqaix.exe
  C:\Windows\System\Ukyqaix.exe
  2⤵
  PID:5200
- C:\Windows\System\wLTFwJg.exe
  C:\Windows\System\wLTFwJg.exe
  2⤵
  PID:5216
- C:\Windows\System\zwKncZQ.exe
  C:\Windows\System\zwKncZQ.exe
  2⤵
  PID:5264
- C:\Windows\System\KLAhWwD.exe
  C:\Windows\System\KLAhWwD.exe
  2⤵
  PID:5280
- C:\Windows\System\TiwBLQf.exe
  C:\Windows\System\TiwBLQf.exe
  2⤵
  PID:5296
- C:\Windows\System\FTcCsHJ.exe
  C:\Windows\System\FTcCsHJ.exe
  2⤵
  PID:5324
- C:\Windows\System\yrtxhnl.exe
  C:\Windows\System\yrtxhnl.exe
  2⤵
  PID:5340
- C:\Windows\System\mHIbHZj.exe
  C:\Windows\System\mHIbHZj.exe
  2⤵
  PID:5360
- C:\Windows\System\YpUTjBK.exe
  C:\Windows\System\YpUTjBK.exe
  2⤵
  PID:5376
- C:\Windows\System\PjvzUTB.exe
  C:\Windows\System\PjvzUTB.exe
  2⤵
  PID:5392
- C:\Windows\System\DutqslY.exe
  C:\Windows\System\DutqslY.exe
  2⤵
  PID:5408
- C:\Windows\System\KoEibEb.exe
  C:\Windows\System\KoEibEb.exe
  2⤵
  PID:5464
- C:\Windows\System\xYaJrKW.exe
  C:\Windows\System\xYaJrKW.exe
  2⤵
  PID:5480
- C:\Windows\System\qtPWAMx.exe
  C:\Windows\System\qtPWAMx.exe
  2⤵
  PID:5500
- C:\Windows\System\hIIhhZU.exe
  C:\Windows\System\hIIhhZU.exe
  2⤵
  PID:5516
- C:\Windows\System\jiBxSOK.exe
  C:\Windows\System\jiBxSOK.exe
  2⤵
  PID:5532
- C:\Windows\System\BDDAKju.exe
  C:\Windows\System\BDDAKju.exe
  2⤵
  PID:5552
- C:\Windows\System\dFsFHsY.exe
  C:\Windows\System\dFsFHsY.exe
  2⤵
  PID:5568
- C:\Windows\System\ZRKluaP.exe
  C:\Windows\System\ZRKluaP.exe
  2⤵
  PID:5584
- C:\Windows\System\ZFqmVCT.exe
  C:\Windows\System\ZFqmVCT.exe
  2⤵
  PID:5612
- C:\Windows\System\MUnlNjq.exe
  C:\Windows\System\MUnlNjq.exe
  2⤵
  PID:5632
- C:\Windows\System\josuDBn.exe
  C:\Windows\System\josuDBn.exe
  2⤵
  PID:5660
- C:\Windows\System\TpjSXDs.exe
  C:\Windows\System\TpjSXDs.exe
  2⤵
  PID:5680
- C:\Windows\System\znVPdrY.exe
  C:\Windows\System\znVPdrY.exe
  2⤵
  PID:5700
- C:\Windows\System\mZFbdtB.exe
  C:\Windows\System\mZFbdtB.exe
  2⤵
  PID:5716
- C:\Windows\System\iBIVYnJ.exe
  C:\Windows\System\iBIVYnJ.exe
  2⤵
  PID:5752
- C:\Windows\System\wCbvNLt.exe
  C:\Windows\System\wCbvNLt.exe
  2⤵
  PID:5768
- C:\Windows\System\ysVPVDk.exe
  C:\Windows\System\ysVPVDk.exe
  2⤵
  PID:5788
- C:\Windows\System\fkyXKuP.exe
  C:\Windows\System\fkyXKuP.exe
  2⤵
  PID:5824
- C:\Windows\System\LUFuWZu.exe
  C:\Windows\System\LUFuWZu.exe
  2⤵
  PID:5844
- C:\Windows\System\xqBGSPy.exe
  C:\Windows\System\xqBGSPy.exe
  2⤵
  PID:5860
- C:\Windows\System\GTWpqoo.exe
  C:\Windows\System\GTWpqoo.exe
  2⤵
  PID:5880
- C:\Windows\System\ypuXJln.exe
  C:\Windows\System\ypuXJln.exe
  2⤵
  PID:5896
- C:\Windows\System\WyxrKPS.exe
  C:\Windows\System\WyxrKPS.exe
  2⤵
  PID:5916
- C:\Windows\System\FpRpIkN.exe
  C:\Windows\System\FpRpIkN.exe
  2⤵
  PID:6136
- C:\Windows\System\mHXqIgQ.exe
  C:\Windows\System\mHXqIgQ.exe
  2⤵
  PID:1816
- C:\Windows\System\JOBzzaZ.exe
  C:\Windows\System\JOBzzaZ.exe
  2⤵
  PID:4320
- C:\Windows\System\Vnuuhef.exe
  C:\Windows\System\Vnuuhef.exe
  2⤵
  PID:1132
- C:\Windows\System\XMotHPU.exe
  C:\Windows\System\XMotHPU.exe
  2⤵
  PID:3436
- C:\Windows\System\AcYLfhu.exe
  C:\Windows\System\AcYLfhu.exe
  2⤵
  PID:4884
- C:\Windows\System\CMopzaz.exe
  C:\Windows\System\CMopzaz.exe
  2⤵
  PID:3372
- C:\Windows\System\RUZymuP.exe
  C:\Windows\System\RUZymuP.exe
  2⤵
  PID:1704
- C:\Windows\System\MuFRgsz.exe
  C:\Windows\System\MuFRgsz.exe
  2⤵
  PID:4904
- C:\Windows\System\ZLcgDKS.exe
  C:\Windows\System\ZLcgDKS.exe
  2⤵
  PID:4876
- C:\Windows\System\XYJFBPK.exe
  C:\Windows\System\XYJFBPK.exe
  2⤵
  PID:4572
- C:\Windows\System\yqWfiUG.exe
  C:\Windows\System\yqWfiUG.exe
  2⤵
  PID:5388
- C:\Windows\System\XSGayKC.exe
  C:\Windows\System\XSGayKC.exe
  2⤵
  PID:4764
- C:\Windows\System\UvWxhnD.exe
  C:\Windows\System\UvWxhnD.exe
  2⤵
  PID:840
- C:\Windows\System\CWhVxdU.exe
  C:\Windows\System\CWhVxdU.exe
  2⤵
  PID:1868
- C:\Windows\System\HhssUQk.exe
  C:\Windows\System\HhssUQk.exe
  2⤵
  PID:4352
- C:\Windows\System\mnOTbzI.exe
  C:\Windows\System\mnOTbzI.exe
  2⤵
  PID:4340
- C:\Windows\System\NpTQCgb.exe
  C:\Windows\System\NpTQCgb.exe
  2⤵
  PID:5764
- C:\Windows\System\dpClCAm.exe
  C:\Windows\System\dpClCAm.exe
  2⤵
  PID:1624
- C:\Windows\System\rXySqEu.exe
  C:\Windows\System\rXySqEu.exe
  2⤵
  PID:4928
- C:\Windows\System\zTOIJSX.exe
  C:\Windows\System\zTOIJSX.exe
  2⤵
  PID:5940
- C:\Windows\System\VbrzXHt.exe
  C:\Windows\System\VbrzXHt.exe
  2⤵
  PID:5152
- C:\Windows\System\mvoywCV.exe
  C:\Windows\System\mvoywCV.exe
  2⤵
  PID:1312
- C:\Windows\System\YglaYtZ.exe
  C:\Windows\System\YglaYtZ.exe
  2⤵
  PID:1804
- C:\Windows\System\SVEexiG.exe
  C:\Windows\System\SVEexiG.exe
  2⤵
  PID:5232
- C:\Windows\System\gQlSCEd.exe
  C:\Windows\System\gQlSCEd.exe
  2⤵
  PID:5276
- C:\Windows\System\FVhAwaq.exe
  C:\Windows\System\FVhAwaq.exe
  2⤵
  PID:5320
- C:\Windows\System\PfKoDpR.exe
  C:\Windows\System\PfKoDpR.exe
  2⤵
  PID:5808
- C:\Windows\System\FUFDwky.exe
  C:\Windows\System\FUFDwky.exe
  2⤵
  PID:5400
- C:\Windows\System\cmlItnH.exe
  C:\Windows\System\cmlItnH.exe
  2⤵
  PID:6168
- C:\Windows\System\IpRWohS.exe
  C:\Windows\System\IpRWohS.exe
  2⤵
  PID:6184
- C:\Windows\System\TJHuorT.exe
  C:\Windows\System\TJHuorT.exe
  2⤵
  PID:6212
- C:\Windows\System\zZmnBBb.exe
  C:\Windows\System\zZmnBBb.exe
  2⤵
  PID:6232
- C:\Windows\System\PowusIQ.exe
  C:\Windows\System\PowusIQ.exe
  2⤵
  PID:6264
- C:\Windows\System\ggNMhZn.exe
  C:\Windows\System\ggNMhZn.exe
  2⤵
  PID:6284
- C:\Windows\System\rzfLQQF.exe
  C:\Windows\System\rzfLQQF.exe
  2⤵
  PID:6300
- C:\Windows\System\HItNCiu.exe
  C:\Windows\System\HItNCiu.exe
  2⤵
  PID:6320
- C:\Windows\System\YLQQVCJ.exe
  C:\Windows\System\YLQQVCJ.exe
  2⤵
  PID:6340
- C:\Windows\System\PzIQSzA.exe
  C:\Windows\System\PzIQSzA.exe
  2⤵
  PID:6360
- C:\Windows\System\WELJTaZ.exe
  C:\Windows\System\WELJTaZ.exe
  2⤵
  PID:6376
- C:\Windows\System\JUqclPc.exe
  C:\Windows\System\JUqclPc.exe
  2⤵
  PID:6404
- C:\Windows\System\GtyaCKA.exe
  C:\Windows\System\GtyaCKA.exe
  2⤵
  PID:6448
- C:\Windows\System\dOLHphU.exe
  C:\Windows\System\dOLHphU.exe
  2⤵
  PID:6468
- C:\Windows\System\OPfTxra.exe
  C:\Windows\System\OPfTxra.exe
  2⤵
  PID:6484
- C:\Windows\System\fJJnxSp.exe
  C:\Windows\System\fJJnxSp.exe
  2⤵
  PID:6500
- C:\Windows\System\sDrnAJK.exe
  C:\Windows\System\sDrnAJK.exe
  2⤵
  PID:6520
- C:\Windows\System\TStimuz.exe
  C:\Windows\System\TStimuz.exe
  2⤵
  PID:6540
- C:\Windows\System\GOuFJsK.exe
  C:\Windows\System\GOuFJsK.exe
  2⤵
  PID:6560
- C:\Windows\System\eCpyQFZ.exe
  C:\Windows\System\eCpyQFZ.exe
  2⤵
  PID:6792
- C:\Windows\System\wNJWaMs.exe
  C:\Windows\System\wNJWaMs.exe
  2⤵
  PID:6816
- C:\Windows\System\aHuWvcH.exe
  C:\Windows\System\aHuWvcH.exe
  2⤵
  PID:6840
- C:\Windows\System\moRiwrh.exe
  C:\Windows\System\moRiwrh.exe
  2⤵
  PID:6860
- C:\Windows\System\LSrjYoJ.exe
  C:\Windows\System\LSrjYoJ.exe
  2⤵
  PID:6876
- C:\Windows\System\AaXDfGz.exe
  C:\Windows\System\AaXDfGz.exe
  2⤵
  PID:6900
- C:\Windows\System\agLFRuG.exe
  C:\Windows\System\agLFRuG.exe
  2⤵
  PID:6928
- C:\Windows\System\qtSVAfX.exe
  C:\Windows\System\qtSVAfX.exe
  2⤵
  PID:7052
- C:\Windows\System\UybTBxd.exe
  C:\Windows\System\UybTBxd.exe
  2⤵
  PID:7072
- C:\Windows\System\kRHaAvK.exe
  C:\Windows\System\kRHaAvK.exe
  2⤵
  PID:7088
- C:\Windows\System\ircWoYD.exe
  C:\Windows\System\ircWoYD.exe
  2⤵
  PID:7104
- C:\Windows\System\aciLuAo.exe
  C:\Windows\System\aciLuAo.exe
  2⤵
  PID:7120
- C:\Windows\System\GMDCCSZ.exe
  C:\Windows\System\GMDCCSZ.exe
  2⤵
  PID:7144
- C:\Windows\System\PIujetl.exe
  C:\Windows\System\PIujetl.exe
  2⤵
  PID:7164
- C:\Windows\System\pwBQuSS.exe
  C:\Windows\System\pwBQuSS.exe
  2⤵
  PID:864
- C:\Windows\System\TwsodmG.exe
  C:\Windows\System\TwsodmG.exe
  2⤵
  PID:2076
- C:\Windows\System\JlMdKcn.exe
  C:\Windows\System\JlMdKcn.exe
  2⤵
  PID:3956
- C:\Windows\System\ZHGshNj.exe
  C:\Windows\System\ZHGshNj.exe
  2⤵
  PID:5444
- C:\Windows\System\FxRkIGr.exe
  C:\Windows\System\FxRkIGr.exe
  2⤵
  PID:5492
- C:\Windows\System\moncMUC.exe
  C:\Windows\System\moncMUC.exe
  2⤵
  PID:5528
- C:\Windows\System\EvpIBSn.exe
  C:\Windows\System\EvpIBSn.exe
  2⤵
  PID:5564
- C:\Windows\System\LokIePM.exe
  C:\Windows\System\LokIePM.exe
  2⤵
  PID:5644
- C:\Windows\System\RhzyjLl.exe
  C:\Windows\System\RhzyjLl.exe
  2⤵
  PID:5604
- C:\Windows\System\owkDKwG.exe
  C:\Windows\System\owkDKwG.exe
  2⤵
  PID:5576
- C:\Windows\System\IhGAwcV.exe
  C:\Windows\System\IhGAwcV.exe
  2⤵
  PID:5712
- C:\Windows\System\IuMWTPy.exe
  C:\Windows\System\IuMWTPy.exe
  2⤵
  PID:5748
- C:\Windows\System\vqKPmzB.exe
  C:\Windows\System\vqKPmzB.exe
  2⤵
  PID:5820
- C:\Windows\System\LrusYPQ.exe
  C:\Windows\System\LrusYPQ.exe
  2⤵
  PID:6512
- C:\Windows\System\xXTMoIU.exe
  C:\Windows\System\xXTMoIU.exe
  2⤵
  PID:6436
- C:\Windows\System\rqgcvoN.exe
  C:\Windows\System\rqgcvoN.exe
  2⤵
  PID:6328
- C:\Windows\System\qSgYFyu.exe
  C:\Windows\System\qSgYFyu.exe
  2⤵
  PID:6224
- C:\Windows\System\yqPQwlP.exe
  C:\Windows\System\yqPQwlP.exe
  2⤵
  PID:6508
- C:\Windows\System\ILDYfWO.exe
  C:\Windows\System\ILDYfWO.exe
  2⤵
  PID:4408
- C:\Windows\System\JpudtWR.exe
  C:\Windows\System\JpudtWR.exe
  2⤵
  PID:5512
- C:\Windows\System\WnMBkIC.exe
  C:\Windows\System\WnMBkIC.exe
  2⤵
  PID:5692
- C:\Windows\System\AIEIZky.exe
  C:\Windows\System\AIEIZky.exe
  2⤵
  PID:5800
- C:\Windows\System\WyQXHbj.exe
  C:\Windows\System\WyQXHbj.exe
  2⤵
  PID:5872
- C:\Windows\System\HdvPiic.exe
  C:\Windows\System\HdvPiic.exe
  2⤵
  PID:7188
- C:\Windows\System\JlskePO.exe
  C:\Windows\System\JlskePO.exe
  2⤵
  PID:7204
- C:\Windows\System\PudNQcf.exe
  C:\Windows\System\PudNQcf.exe
  2⤵
  PID:7224
- C:\Windows\System\pBabkGo.exe
  C:\Windows\System\pBabkGo.exe
  2⤵
  PID:7240
- C:\Windows\System\xfWkhzR.exe
  C:\Windows\System\xfWkhzR.exe
  2⤵
  PID:7256
- C:\Windows\System\loWkcJP.exe
  C:\Windows\System\loWkcJP.exe
  2⤵
  PID:7276
- C:\Windows\System\gWawMgP.exe
  C:\Windows\System\gWawMgP.exe
  2⤵
  PID:7296
- C:\Windows\System\nabjipe.exe
  C:\Windows\System\nabjipe.exe
  2⤵
  PID:7312
- C:\Windows\System\TLtDory.exe
  C:\Windows\System\TLtDory.exe
  2⤵
  PID:7328
- C:\Windows\System\kEWVMYX.exe
  C:\Windows\System\kEWVMYX.exe
  2⤵
  PID:7344
- C:\Windows\System\pvWvBzw.exe
  C:\Windows\System\pvWvBzw.exe
  2⤵
  PID:7388
- C:\Windows\System\bsbXHhe.exe
  C:\Windows\System\bsbXHhe.exe
  2⤵
  PID:7412
- C:\Windows\System\nFrojCc.exe
  C:\Windows\System\nFrojCc.exe
  2⤵
  PID:7428
- C:\Windows\System\YyfAOoE.exe
  C:\Windows\System\YyfAOoE.exe
  2⤵
  PID:7456
- C:\Windows\System\KiQPusl.exe
  C:\Windows\System\KiQPusl.exe
  2⤵
  PID:7472
- C:\Windows\System\nhpDBzU.exe
  C:\Windows\System\nhpDBzU.exe
  2⤵
  PID:7492
- C:\Windows\System\MZbxKfb.exe
  C:\Windows\System\MZbxKfb.exe
  2⤵
  PID:7508
- C:\Windows\System\ZcBlXQm.exe
  C:\Windows\System\ZcBlXQm.exe
  2⤵
  PID:7524
- C:\Windows\System\wufkyHn.exe
  C:\Windows\System\wufkyHn.exe
  2⤵
  PID:7540
- C:\Windows\System\kghRVJM.exe
  C:\Windows\System\kghRVJM.exe
  2⤵
  PID:7560
- C:\Windows\System\MKpmWlD.exe
  C:\Windows\System\MKpmWlD.exe
  2⤵
  PID:7580
- C:\Windows\System\jIPlXRh.exe
  C:\Windows\System\jIPlXRh.exe
  2⤵
  PID:7600
- C:\Windows\System\gXuYzWr.exe
  C:\Windows\System\gXuYzWr.exe
  2⤵
  PID:7636
- C:\Windows\System\TlNqOYk.exe
  C:\Windows\System\TlNqOYk.exe
  2⤵
  PID:7652
- C:\Windows\System\BWmYyFN.exe
  C:\Windows\System\BWmYyFN.exe
  2⤵
  PID:7676
- C:\Windows\System\GDJXZdk.exe
  C:\Windows\System\GDJXZdk.exe
  2⤵
  PID:7692
- C:\Windows\System\SXRyhOe.exe
  C:\Windows\System\SXRyhOe.exe
  2⤵
  PID:7716
- C:\Windows\System\gGRTcIn.exe
  C:\Windows\System\gGRTcIn.exe
  2⤵
  PID:7732
- C:\Windows\System\xRzPbPH.exe
  C:\Windows\System\xRzPbPH.exe
  2⤵
  PID:7756
- C:\Windows\System\SHmQCwP.exe
  C:\Windows\System\SHmQCwP.exe
  2⤵
  PID:7772
- C:\Windows\System\tfwpPCb.exe
  C:\Windows\System\tfwpPCb.exe
  2⤵
  PID:7796
- C:\Windows\System\pHuAhsP.exe
  C:\Windows\System\pHuAhsP.exe
  2⤵
  PID:7812
- C:\Windows\System\eTZWrAe.exe
  C:\Windows\System\eTZWrAe.exe
  2⤵
  PID:7836
- C:\Windows\System\xZnrfaT.exe
  C:\Windows\System\xZnrfaT.exe
  2⤵
  PID:7852
- C:\Windows\System\Yskzxdg.exe
  C:\Windows\System\Yskzxdg.exe
  2⤵
  PID:7876
- C:\Windows\System\VbtCXXZ.exe
  C:\Windows\System\VbtCXXZ.exe
  2⤵
  PID:7896
- C:\Windows\System\BWRDDJB.exe
  C:\Windows\System\BWRDDJB.exe
  2⤵
  PID:7916
- C:\Windows\System\EapyPRw.exe
  C:\Windows\System\EapyPRw.exe
  2⤵
  PID:7932
- C:\Windows\System\niZiVse.exe
  C:\Windows\System\niZiVse.exe
  2⤵
  PID:7956
- C:\Windows\System\BGgunFV.exe
  C:\Windows\System\BGgunFV.exe
  2⤵
  PID:7972
- C:\Windows\System\YHOEIbq.exe
  C:\Windows\System\YHOEIbq.exe
  2⤵
  PID:7996
- C:\Windows\System\PQmhuTc.exe
  C:\Windows\System\PQmhuTc.exe
  2⤵
  PID:8012
- C:\Windows\System\uucKUHr.exe
  C:\Windows\System\uucKUHr.exe
  2⤵
  PID:8036
- C:\Windows\System\eLAJqgy.exe
  C:\Windows\System\eLAJqgy.exe
  2⤵
  PID:8052
- C:\Windows\System\VQdufcP.exe
  C:\Windows\System\VQdufcP.exe
  2⤵
  PID:8084
- C:\Windows\System\UZQnaYv.exe
  C:\Windows\System\UZQnaYv.exe
  2⤵
  PID:8112
- C:\Windows\System\DIlqGLL.exe
  C:\Windows\System\DIlqGLL.exe
  2⤵
  PID:8128
- C:\Windows\System\TWnsDSQ.exe
  C:\Windows\System\TWnsDSQ.exe
  2⤵
  PID:8144
- C:\Windows\System\mhpnogG.exe
  C:\Windows\System\mhpnogG.exe
  2⤵
  PID:8168
- C:\Windows\System\QwXmJVr.exe
  C:\Windows\System\QwXmJVr.exe
  2⤵
  PID:8188
- C:\Windows\System\JsZJpgT.exe
  C:\Windows\System\JsZJpgT.exe
  2⤵
  PID:3600
- C:\Windows\System\VaaHHMD.exe
  C:\Windows\System\VaaHHMD.exe
  2⤵
  PID:5640
- C:\Windows\System\qBEJnZk.exe
  C:\Windows\System\qBEJnZk.exe
  2⤵
  PID:6476
- C:\Windows\System\nsLKSMK.exe
  C:\Windows\System\nsLKSMK.exe
  2⤵
  PID:6176
- C:\Windows\System\BuzkwOQ.exe
  C:\Windows\System\BuzkwOQ.exe
  2⤵
  PID:5488
- C:\Windows\System\acnwHbA.exe
  C:\Windows\System\acnwHbA.exe
  2⤵
  PID:5836
- C:\Windows\System\ryQbAmN.exe
  C:\Windows\System\ryQbAmN.exe
  2⤵
  PID:7200
- C:\Windows\System\HYInzHF.exe
  C:\Windows\System\HYInzHF.exe
  2⤵
  PID:6776
- C:\Windows\System\ivlhOIY.exe
  C:\Windows\System\ivlhOIY.exe
  2⤵
  PID:6992
- C:\Windows\System\qeiYoZU.exe
  C:\Windows\System\qeiYoZU.exe
  2⤵
  PID:7064
- C:\Windows\System\wZDjJLh.exe
  C:\Windows\System\wZDjJLh.exe
  2⤵
  PID:7096
- C:\Windows\System\yRVWknk.exe
  C:\Windows\System\yRVWknk.exe
  2⤵
  PID:7128
- C:\Windows\System\toENgRF.exe
  C:\Windows\System\toENgRF.exe
  2⤵
  PID:7160
- C:\Windows\System\EtNzECE.exe
  C:\Windows\System\EtNzECE.exe
  2⤵
  PID:1516
- C:\Windows\System\SBhJQAS.exe
  C:\Windows\System\SBhJQAS.exe
  2⤵
  PID:5652
- C:\Windows\System\uVnZGwD.exe
  C:\Windows\System\uVnZGwD.exe
  2⤵
  PID:6108
- C:\Windows\System\BggytBO.exe
  C:\Windows\System\BggytBO.exe
  2⤵
  PID:7176
- C:\Windows\System\MUoXNKW.exe
  C:\Windows\System\MUoXNKW.exe
  2⤵
  PID:2088
- C:\Windows\System\ZKegVYb.exe
  C:\Windows\System\ZKegVYb.exe
  2⤵
  PID:7908
- C:\Windows\System\AHYUNWy.exe
  C:\Windows\System\AHYUNWy.exe
  2⤵
  PID:7668
- C:\Windows\System\oYDroEl.exe
  C:\Windows\System\oYDroEl.exe
  2⤵
  PID:7764
- C:\Windows\System\gsMAtgX.exe
  C:\Windows\System\gsMAtgX.exe
  2⤵
  PID:7844
- C:\Windows\System\rfGSVqN.exe
  C:\Windows\System\rfGSVqN.exe
  2⤵
  PID:7968
- C:\Windows\System\BKMYTwv.exe
  C:\Windows\System\BKMYTwv.exe
  2⤵
  PID:8044
- C:\Windows\System\dNhSDSn.exe
  C:\Windows\System\dNhSDSn.exe
  2⤵
  PID:2552
- C:\Windows\System\EFyCFtU.exe
  C:\Windows\System\EFyCFtU.exe
  2⤵
  PID:5336
- C:\Windows\System\FmKfPTV.exe
  C:\Windows\System\FmKfPTV.exe
  2⤵
  PID:6384
- C:\Windows\System\WPAtlCC.exe
  C:\Windows\System\WPAtlCC.exe
  2⤵
  PID:6332
- C:\Windows\System\WnjWnRo.exe
  C:\Windows\System\WnjWnRo.exe
  2⤵
  PID:6228
- C:\Windows\System\tyAJYrb.exe
  C:\Windows\System\tyAJYrb.exe
  2⤵
  PID:5348
- C:\Windows\System\PmjkVFZ.exe
  C:\Windows\System\PmjkVFZ.exe
  2⤵
  PID:4760
- C:\Windows\System\lyIMOWA.exe
  C:\Windows\System\lyIMOWA.exe
  2⤵
  PID:1084
- C:\Windows\System\YEjxOXi.exe
  C:\Windows\System\YEjxOXi.exe
  2⤵
  PID:8164
- C:\Windows\System\EOhlDvw.exe
  C:\Windows\System\EOhlDvw.exe
  2⤵
  PID:7468
- C:\Windows\System\xfzQrrA.exe
  C:\Windows\System\xfzQrrA.exe
  2⤵
  PID:8208
- C:\Windows\System\AGUFbkL.exe
  C:\Windows\System\AGUFbkL.exe
  2⤵
  PID:8228
- C:\Windows\System\qhusBlI.exe
  C:\Windows\System\qhusBlI.exe
  2⤵
  PID:8252
- C:\Windows\System\luRCTNo.exe
  C:\Windows\System\luRCTNo.exe
  2⤵
  PID:8272
- C:\Windows\System\fgHNOkf.exe
  C:\Windows\System\fgHNOkf.exe
  2⤵
  PID:8292
- C:\Windows\System\pySAHkw.exe
  C:\Windows\System\pySAHkw.exe
  2⤵
  PID:8312
- C:\Windows\System\wFmHBaA.exe
  C:\Windows\System\wFmHBaA.exe
  2⤵
  PID:8328
- C:\Windows\System\SLWvXro.exe
  C:\Windows\System\SLWvXro.exe
  2⤵
  PID:8360
- C:\Windows\System\NdISdhn.exe
  C:\Windows\System\NdISdhn.exe
  2⤵
  PID:8380
- C:\Windows\System\ZXNYFiw.exe
  C:\Windows\System\ZXNYFiw.exe
  2⤵
  PID:8416
- C:\Windows\System\djgcwVw.exe
  C:\Windows\System\djgcwVw.exe
  2⤵
  PID:8432
- C:\Windows\System\mkCfwnr.exe
  C:\Windows\System\mkCfwnr.exe
  2⤵
  PID:8452
- C:\Windows\System\RCOwCmU.exe
  C:\Windows\System\RCOwCmU.exe
  2⤵
  PID:8472
- C:\Windows\System\OQojpnI.exe
  C:\Windows\System\OQojpnI.exe
  2⤵
  PID:8512
- C:\Windows\System\xIqOqpt.exe
  C:\Windows\System\xIqOqpt.exe
  2⤵
  PID:8540
- C:\Windows\System\PLYQoGA.exe
  C:\Windows\System\PLYQoGA.exe
  2⤵
  PID:8556
- C:\Windows\System\xrvZfuq.exe
  C:\Windows\System\xrvZfuq.exe
  2⤵
  PID:8576
- C:\Windows\System\EReXazw.exe
  C:\Windows\System\EReXazw.exe
  2⤵
  PID:8596
- C:\Windows\System\QTJxWww.exe
  C:\Windows\System\QTJxWww.exe
  2⤵
  PID:8624
- C:\Windows\System\AgFkIpH.exe
  C:\Windows\System\AgFkIpH.exe
  2⤵
  PID:8648
- C:\Windows\System\GERRosP.exe
  C:\Windows\System\GERRosP.exe
  2⤵
  PID:8668
- C:\Windows\System\HjZBoNn.exe
  C:\Windows\System\HjZBoNn.exe
  2⤵
  PID:8684
- C:\Windows\System\TUKKAbe.exe
  C:\Windows\System\TUKKAbe.exe
  2⤵
  PID:8700
- C:\Windows\System\XzuIpgE.exe
  C:\Windows\System\XzuIpgE.exe
  2⤵
  PID:8720
- C:\Windows\System\ZBsSdBJ.exe
  C:\Windows\System\ZBsSdBJ.exe
  2⤵
  PID:8736
- C:\Windows\System\KFfrxpM.exe
  C:\Windows\System\KFfrxpM.exe
  2⤵
  PID:8752
- C:\Windows\System\lGoSGaQ.exe
  C:\Windows\System\lGoSGaQ.exe
  2⤵
  PID:8772
- C:\Windows\System\JpgZCNu.exe
  C:\Windows\System\JpgZCNu.exe
  2⤵
  PID:8796
- C:\Windows\System\mFEuJxX.exe
  C:\Windows\System\mFEuJxX.exe
  2⤵
  PID:8816
- C:\Windows\System\nylxevk.exe
  C:\Windows\System\nylxevk.exe
  2⤵
  PID:8840
- C:\Windows\System\tIfsObd.exe
  C:\Windows\System\tIfsObd.exe
  2⤵
  PID:8860
- C:\Windows\System\jKrZUFM.exe
  C:\Windows\System\jKrZUFM.exe
  2⤵
  PID:8876
- C:\Windows\System\yMcaYyv.exe
  C:\Windows\System\yMcaYyv.exe
  2⤵
  PID:8904
- C:\Windows\System\ZefLUkp.exe
  C:\Windows\System\ZefLUkp.exe
  2⤵
  PID:8932
- C:\Windows\System\nbWYPRd.exe
  C:\Windows\System\nbWYPRd.exe
  2⤵
  PID:8948
- C:\Windows\System\SNnNvJB.exe
  C:\Windows\System\SNnNvJB.exe
  2⤵
  PID:8968
- C:\Windows\System\jhaxrHe.exe
  C:\Windows\System\jhaxrHe.exe
  2⤵
  PID:8988
- C:\Windows\System\YYWhQtf.exe
  C:\Windows\System\YYWhQtf.exe
  2⤵
  PID:9012
- C:\Windows\System\ewGwIYj.exe
  C:\Windows\System\ewGwIYj.exe
  2⤵
  PID:9032
- C:\Windows\System\YfCzdAB.exe
  C:\Windows\System\YfCzdAB.exe
  2⤵
  PID:9052
- C:\Windows\System\tZZKBGy.exe
  C:\Windows\System\tZZKBGy.exe
  2⤵
  PID:9072
- C:\Windows\System\gTJQHoQ.exe
  C:\Windows\System\gTJQHoQ.exe
  2⤵
  PID:9096
- C:\Windows\System\bRFyRhM.exe
  C:\Windows\System\bRFyRhM.exe
  2⤵
  PID:9120
- C:\Windows\System\EoukHfr.exe
  C:\Windows\System\EoukHfr.exe
  2⤵
  PID:9148
- C:\Windows\System\pfwvFqg.exe
  C:\Windows\System\pfwvFqg.exe
  2⤵
  PID:9164
- C:\Windows\System\GvvhsIP.exe
  C:\Windows\System\GvvhsIP.exe
  2⤵
  PID:9204
- C:\Windows\System\ZCQnHAW.exe
  C:\Windows\System\ZCQnHAW.exe
  2⤵
  PID:7536
- C:\Windows\System\wxtPtbz.exe
  C:\Windows\System\wxtPtbz.exe
  2⤵
  PID:7252
- C:\Windows\System\cVyodvr.exe
  C:\Windows\System\cVyodvr.exe
  2⤵
  PID:7292
- C:\Windows\System\OyZOfyK.exe
  C:\Windows\System\OyZOfyK.exe
  2⤵
  PID:7324
- C:\Windows\System\enuprMC.exe
  C:\Windows\System\enuprMC.exe
  2⤵
  PID:7380
- C:\Windows\System\gGRyxqC.exe
  C:\Windows\System\gGRyxqC.exe
  2⤵
  PID:7404
- C:\Windows\System\HmyERSv.exe
  C:\Windows\System\HmyERSv.exe
  2⤵
  PID:7828
- C:\Windows\System\jCjqRvj.exe
  C:\Windows\System\jCjqRvj.exe
  2⤵
  PID:8176
- C:\Windows\System\EgMKtiH.exe
  C:\Windows\System\EgMKtiH.exe
  2⤵
  PID:5688
- C:\Windows\System\SkLsVNi.exe
  C:\Windows\System\SkLsVNi.exe
  2⤵
  PID:8080
- C:\Windows\System\ivYzjxE.exe
  C:\Windows\System\ivYzjxE.exe
  2⤵
  PID:6192
- C:\Windows\System\fJMAMZO.exe
  C:\Windows\System\fJMAMZO.exe
  2⤵
  PID:7180
- C:\Windows\System\maAcPWb.exe
  C:\Windows\System\maAcPWb.exe
  2⤵
  PID:8264
- C:\Windows\System\WXPBnRI.exe
  C:\Windows\System\WXPBnRI.exe
  2⤵
  PID:8428
- C:\Windows\System\zhNWHCO.exe
  C:\Windows\System\zhNWHCO.exe
  2⤵
  PID:9228
- C:\Windows\System\srRHtUR.exe
  C:\Windows\System\srRHtUR.exe
  2⤵
  PID:9256
- C:\Windows\System\XGmWPIf.exe
  C:\Windows\System\XGmWPIf.exe
  2⤵
  PID:9276
- C:\Windows\System\YSPlLuf.exe
  C:\Windows\System\YSPlLuf.exe
  2⤵
  PID:9300
- C:\Windows\System\cQszcrm.exe
  C:\Windows\System\cQszcrm.exe
  2⤵
  PID:9316
- C:\Windows\System\PQwWCxS.exe
  C:\Windows\System\PQwWCxS.exe
  2⤵
  PID:9336
- C:\Windows\System\MJbHtwA.exe
  C:\Windows\System\MJbHtwA.exe
  2⤵
  PID:9352
- C:\Windows\System\KLdUZHz.exe
  C:\Windows\System\KLdUZHz.exe
  2⤵
  PID:9376
- C:\Windows\System\yQuFUkN.exe
  C:\Windows\System\yQuFUkN.exe
  2⤵
  PID:9396
- C:\Windows\System\NPJPjMA.exe
  C:\Windows\System\NPJPjMA.exe
  2⤵
  PID:9416
- C:\Windows\System\QuYiBAU.exe
  C:\Windows\System\QuYiBAU.exe
  2⤵
  PID:9436
- C:\Windows\System\FvtaVGV.exe
  C:\Windows\System\FvtaVGV.exe
  2⤵
  PID:9456
- C:\Windows\System\ANuiAJp.exe
  C:\Windows\System\ANuiAJp.exe
  2⤵
  PID:9480
- C:\Windows\System\SrvNqWO.exe
  C:\Windows\System\SrvNqWO.exe
  2⤵
  PID:9500
- C:\Windows\System\ZyGuNTR.exe
  C:\Windows\System\ZyGuNTR.exe
  2⤵
  PID:9520
- C:\Windows\System\mCEjCzh.exe
  C:\Windows\System\mCEjCzh.exe
  2⤵
  PID:9536
- C:\Windows\System\JbEhIBa.exe
  C:\Windows\System\JbEhIBa.exe
  2⤵
  PID:9560
- C:\Windows\System\nJfbpUw.exe
  C:\Windows\System\nJfbpUw.exe
  2⤵
  PID:9588
- C:\Windows\System\RIbpMTt.exe
  C:\Windows\System\RIbpMTt.exe
  2⤵
  PID:9604
- C:\Windows\System\JBdZLQH.exe
  C:\Windows\System\JBdZLQH.exe
  2⤵
  PID:9628
- C:\Windows\System\jYhYbER.exe
  C:\Windows\System\jYhYbER.exe
  2⤵
  PID:9652
- C:\Windows\System\ToHxGLN.exe
  C:\Windows\System\ToHxGLN.exe
  2⤵
  PID:9668
- C:\Windows\System\ZxrbmIB.exe
  C:\Windows\System\ZxrbmIB.exe
  2⤵
  PID:9688
- C:\Windows\System\EqGPvbf.exe
  C:\Windows\System\EqGPvbf.exe
  2⤵
  PID:9704
- C:\Windows\System\dLxwban.exe
  C:\Windows\System\dLxwban.exe
  2⤵
  PID:9720
- C:\Windows\System\mHqRlTU.exe
  C:\Windows\System\mHqRlTU.exe
  2⤵
  PID:9736
- C:\Windows\System\kvlypwX.exe
  C:\Windows\System\kvlypwX.exe
  2⤵
  PID:9756
- C:\Windows\System\JlqNOxy.exe
  C:\Windows\System\JlqNOxy.exe
  2⤵
  PID:9776
- C:\Windows\System\TKaLHRI.exe
  C:\Windows\System\TKaLHRI.exe
  2⤵
  PID:9808
- C:\Windows\System\mNxEJzL.exe
  C:\Windows\System\mNxEJzL.exe
  2⤵
  PID:9828
- C:\Windows\System\UemKRBZ.exe
  C:\Windows\System\UemKRBZ.exe
  2⤵
  PID:9848
- C:\Windows\System\FoNnieu.exe
  C:\Windows\System\FoNnieu.exe
  2⤵
  PID:9868
- C:\Windows\System\TqNMgnU.exe
  C:\Windows\System\TqNMgnU.exe
  2⤵
  PID:9892
- C:\Windows\System\gWwbGoR.exe
  C:\Windows\System\gWwbGoR.exe
  2⤵
  PID:9912
- C:\Windows\System\EwwQHnp.exe
  C:\Windows\System\EwwQHnp.exe
  2⤵
  PID:9928
- C:\Windows\System\VjtlglB.exe
  C:\Windows\System\VjtlglB.exe
  2⤵
  PID:9948
- C:\Windows\System\ULgnaNQ.exe
  C:\Windows\System\ULgnaNQ.exe
  2⤵
  PID:9968
- C:\Windows\System\ykCkSuC.exe
  C:\Windows\System\ykCkSuC.exe
  2⤵
  PID:9984
- C:\Windows\System\ZySaccB.exe
  C:\Windows\System\ZySaccB.exe
  2⤵
  PID:10000
- C:\Windows\System\JiiTrtI.exe
  C:\Windows\System\JiiTrtI.exe
  2⤵
  PID:10016
- C:\Windows\System\claPlJK.exe
  C:\Windows\System\claPlJK.exe
  2⤵
  PID:10032
- C:\Windows\System\eiaComF.exe
  C:\Windows\System\eiaComF.exe
  2⤵
  PID:10052
- C:\Windows\System\saULjgP.exe
  C:\Windows\System\saULjgP.exe
  2⤵
  PID:10068
- C:\Windows\System\jlUOwIZ.exe
  C:\Windows\System\jlUOwIZ.exe
  2⤵
  PID:10096
- C:\Windows\System\tFSOejd.exe
  C:\Windows\System\tFSOejd.exe
  2⤵
  PID:10112
- C:\Windows\System\BVWTAXK.exe
  C:\Windows\System\BVWTAXK.exe
  2⤵
  PID:10132
- C:\Windows\System\WJzxAKn.exe
  C:\Windows\System\WJzxAKn.exe
  2⤵
  PID:10156
- C:\Windows\System\DYjruGo.exe
  C:\Windows\System\DYjruGo.exe
  2⤵
  PID:10176
- C:\Windows\System\xXJEzlS.exe
  C:\Windows\System\xXJEzlS.exe
  2⤵
  PID:10196
- C:\Windows\System\MntMhBv.exe
  C:\Windows\System\MntMhBv.exe
  2⤵
  PID:10220
- C:\Windows\System\UkTRdFl.exe
  C:\Windows\System\UkTRdFl.exe
  2⤵
  PID:7592
- C:\Windows\System\ZrHtQDc.exe
  C:\Windows\System\ZrHtQDc.exe
  2⤵
  PID:7648
- C:\Windows\System\ZwRmtEo.exe
  C:\Windows\System\ZwRmtEo.exe
  2⤵
  PID:7728
- C:\Windows\System\Dyppdfs.exe
  C:\Windows\System\Dyppdfs.exe
  2⤵
  PID:7808
- C:\Windows\System\IlPfABz.exe
  C:\Windows\System\IlPfABz.exe
  2⤵
  PID:7888
- C:\Windows\System\qgxSFtm.exe
  C:\Windows\System\qgxSFtm.exe
  2⤵
  PID:7940
- C:\Windows\System\cuWdYup.exe
  C:\Windows\System\cuWdYup.exe
  2⤵
  PID:8096
- C:\Windows\System\JHgKVrf.exe
  C:\Windows\System\JHgKVrf.exe
  2⤵
  PID:2976
- C:\Windows\System\ayaWYZQ.exe
  C:\Windows\System\ayaWYZQ.exe
  2⤵
  PID:8152
- C:\Windows\System\cONqsSw.exe
  C:\Windows\System\cONqsSw.exe
  2⤵
  PID:7628
- C:\Windows\System\RUGBgRE.exe
  C:\Windows\System\RUGBgRE.exe
  2⤵
  PID:8196
- C:\Windows\System\SrhUvXE.exe
  C:\Windows\System\SrhUvXE.exe
  2⤵
  PID:9048
- C:\Windows\System\HjCJdji.exe
  C:\Windows\System\HjCJdji.exe
  2⤵
  PID:9064
- C:\Windows\System\GIyNYlv.exe
  C:\Windows\System\GIyNYlv.exe
  2⤵
  PID:10244
- C:\Windows\System\QVsMsYC.exe
  C:\Windows\System\QVsMsYC.exe
  2⤵
  PID:10260
- C:\Windows\System\dGTJRZK.exe
  C:\Windows\System\dGTJRZK.exe
  2⤵
  PID:10280
- C:\Windows\System\RUZdAIS.exe
  C:\Windows\System\RUZdAIS.exe
  2⤵
  PID:10300
- C:\Windows\System\UMiTrQO.exe
  C:\Windows\System\UMiTrQO.exe
  2⤵
  PID:10316
- C:\Windows\System\yqeXeZW.exe
  C:\Windows\System\yqeXeZW.exe
  2⤵
  PID:10332
- C:\Windows\System\NqTYLEz.exe
  C:\Windows\System\NqTYLEz.exe
  2⤵
  PID:10348
- C:\Windows\System\LTKJIfc.exe
  C:\Windows\System\LTKJIfc.exe
  2⤵
  PID:10364
- C:\Windows\System\igEXAMX.exe
  C:\Windows\System\igEXAMX.exe
  2⤵
  PID:10380
- C:\Windows\System\RpCDFkX.exe
  C:\Windows\System\RpCDFkX.exe
  2⤵
  PID:10396
- C:\Windows\System\BeKtqEc.exe
  C:\Windows\System\BeKtqEc.exe
  2⤵
  PID:10412
- C:\Windows\System\AjVLysJ.exe
  C:\Windows\System\AjVLysJ.exe
  2⤵
  PID:10444
- C:\Windows\System\EtSAClF.exe
  C:\Windows\System\EtSAClF.exe
  2⤵
  PID:10472
- C:\Windows\System\BVeOnDx.exe
  C:\Windows\System\BVeOnDx.exe
  2⤵
  PID:10496
- C:\Windows\System\bPVjeQC.exe
  C:\Windows\System\bPVjeQC.exe
  2⤵
  PID:10512
- C:\Windows\System\mmtvfeK.exe
  C:\Windows\System\mmtvfeK.exe
  2⤵
  PID:10532
- C:\Windows\System\ILrsOdM.exe
  C:\Windows\System\ILrsOdM.exe
  2⤵
  PID:10556
- C:\Windows\System\dqAKojE.exe
  C:\Windows\System\dqAKojE.exe
  2⤵
  PID:10580
- C:\Windows\System\lpQNjJg.exe
  C:\Windows\System\lpQNjJg.exe
  2⤵
  PID:10596
- C:\Windows\System\rRcfqXu.exe
  C:\Windows\System\rRcfqXu.exe
  2⤵
  PID:10620
- C:\Windows\System\INkxhHK.exe
  C:\Windows\System\INkxhHK.exe
  2⤵
  PID:10636
- C:\Windows\System\nyyscEd.exe
  C:\Windows\System\nyyscEd.exe
  2⤵
  PID:10664
- C:\Windows\System\lLHgvKn.exe
  C:\Windows\System\lLHgvKn.exe
  2⤵
  PID:10680
- C:\Windows\System\gWOosZW.exe
  C:\Windows\System\gWOosZW.exe
  2⤵
  PID:10700
- C:\Windows\System\csiTNPw.exe
  C:\Windows\System\csiTNPw.exe
  2⤵
  PID:10720
- C:\Windows\System\FpizZEX.exe
  C:\Windows\System\FpizZEX.exe
  2⤵
  PID:10748
- C:\Windows\System\nisvlUW.exe
  C:\Windows\System\nisvlUW.exe
  2⤵
  PID:10764
- C:\Windows\System\HxLXiUW.exe
  C:\Windows\System\HxLXiUW.exe
  2⤵
  PID:10780
- C:\Windows\System\kyHuyFX.exe
  C:\Windows\System\kyHuyFX.exe
  2⤵
  PID:10800
- C:\Windows\System\sHwhfey.exe
  C:\Windows\System\sHwhfey.exe
  2⤵
  PID:10820
- C:\Windows\System\BprGgUE.exe
  C:\Windows\System\BprGgUE.exe
  2⤵
  PID:10836
- C:\Windows\System\zgZcLMa.exe
  C:\Windows\System\zgZcLMa.exe
  2⤵
  PID:10860
- C:\Windows\System\wMFvvhw.exe
  C:\Windows\System\wMFvvhw.exe
  2⤵
  PID:10880
- C:\Windows\System\oafWaUV.exe
  C:\Windows\System\oafWaUV.exe
  2⤵
  PID:10904
- C:\Windows\System\Jfhpkqa.exe
  C:\Windows\System\Jfhpkqa.exe
  2⤵
  PID:10928
- C:\Windows\System\BIZxsmS.exe
  C:\Windows\System\BIZxsmS.exe
  2⤵
  PID:10952
- C:\Windows\System\wStBXyF.exe
  C:\Windows\System\wStBXyF.exe
  2⤵
  PID:10972
- C:\Windows\System\ijfZMGH.exe
  C:\Windows\System\ijfZMGH.exe
  2⤵
  PID:10996
- C:\Windows\System\dzyjdvc.exe
  C:\Windows\System\dzyjdvc.exe
  2⤵
  PID:11012
- C:\Windows\System\dPksMPV.exe
  C:\Windows\System\dPksMPV.exe
  2⤵
  PID:11036
- C:\Windows\System\qTlqUHR.exe
  C:\Windows\System\qTlqUHR.exe
  2⤵
  PID:11056
- C:\Windows\System\tobTWXO.exe
  C:\Windows\System\tobTWXO.exe
  2⤵
  PID:11072
- C:\Windows\System\xzUyCIm.exe
  C:\Windows\System\xzUyCIm.exe
  2⤵
  PID:11088
- C:\Windows\System\UflQCFN.exe
  C:\Windows\System\UflQCFN.exe
  2⤵
  PID:11104
- C:\Windows\System\rWIfefW.exe
  C:\Windows\System\rWIfefW.exe
  2⤵
  PID:11120
- C:\Windows\System\btDDDii.exe
  C:\Windows\System\btDDDii.exe
  2⤵
  PID:11140
- C:\Windows\System\AnGgxEh.exe
  C:\Windows\System\AnGgxEh.exe
  2⤵
  PID:11156
- C:\Windows\System\FucjWTi.exe
  C:\Windows\System\FucjWTi.exe
  2⤵
  PID:11180
- C:\Windows\System\hHXGCIy.exe
  C:\Windows\System\hHXGCIy.exe
  2⤵
  PID:11200
- C:\Windows\System\VJYANEs.exe
  C:\Windows\System\VJYANEs.exe
  2⤵
  PID:11220
- C:\Windows\System\KqMChae.exe
  C:\Windows\System\KqMChae.exe
  2⤵
  PID:11240
- C:\Windows\System\aKidMcY.exe
  C:\Windows\System\aKidMcY.exe
  2⤵
  PID:1728
- C:\Windows\System\uEWrFQh.exe
  C:\Windows\System\uEWrFQh.exe
  2⤵
  PID:3948
- C:\Windows\System\hAIoPQX.exe
  C:\Windows\System\hAIoPQX.exe
  2⤵
  PID:5372
- C:\Windows\System\ShBIMzH.exe
  C:\Windows\System\ShBIMzH.exe
  2⤵
  PID:9248
- C:\Windows\System\KUtTDBM.exe
  C:\Windows\System\KUtTDBM.exe
  2⤵
  PID:9360
- C:\Windows\System\vCFuSGQ.exe
  C:\Windows\System\vCFuSGQ.exe
  2⤵
  PID:9428
- C:\Windows\System\OclZtqj.exe
  C:\Windows\System\OclZtqj.exe
  2⤵
  PID:9528
- C:\Windows\System\ETjSgjG.exe
  C:\Windows\System\ETjSgjG.exe
  2⤵
  PID:1692
- C:\Windows\System\OxkoYGE.exe
  C:\Windows\System\OxkoYGE.exe
  2⤵
  PID:9684
- C:\Windows\System\HNKulKR.exe
  C:\Windows\System\HNKulKR.exe
  2⤵
  PID:9728
- C:\Windows\System\XBILqIO.exe
  C:\Windows\System\XBILqIO.exe
  2⤵
  PID:11276
- C:\Windows\System\Rmpowuf.exe
  C:\Windows\System\Rmpowuf.exe
  2⤵
  PID:11292
- C:\Windows\System\giCxWYl.exe
  C:\Windows\System\giCxWYl.exe
  2⤵
  PID:11312
- C:\Windows\System\weczsbc.exe
  C:\Windows\System\weczsbc.exe
  2⤵
  PID:11328
- C:\Windows\System\WUhdPRT.exe
  C:\Windows\System\WUhdPRT.exe
  2⤵
  PID:11348
- C:\Windows\System\WfnSlfy.exe
  C:\Windows\System\WfnSlfy.exe
  2⤵
  PID:11368
- C:\Windows\System\mbcVmBC.exe
  C:\Windows\System\mbcVmBC.exe
  2⤵
  PID:11384
- C:\Windows\System\ipPcRPk.exe
  C:\Windows\System\ipPcRPk.exe
  2⤵
  PID:11404
- C:\Windows\System\TTGUEVT.exe
  C:\Windows\System\TTGUEVT.exe
  2⤵
  PID:11420
- C:\Windows\System\KFCHYFu.exe
  C:\Windows\System\KFCHYFu.exe
  2⤵
  PID:11444
- C:\Windows\System\vTDXRyv.exe
  C:\Windows\System\vTDXRyv.exe
  2⤵
  PID:11464
- C:\Windows\System\xpjGDjI.exe
  C:\Windows\System\xpjGDjI.exe
  2⤵
  PID:11488
- C:\Windows\System\pBYpdIJ.exe
  C:\Windows\System\pBYpdIJ.exe
  2⤵
  PID:11504
- C:\Windows\System\KUsjwfj.exe
  C:\Windows\System\KUsjwfj.exe
  2⤵
  PID:11528
- C:\Windows\System\uliogSv.exe
  C:\Windows\System\uliogSv.exe
  2⤵
  PID:11548
- C:\Windows\System\MRdtZhi.exe
  C:\Windows\System\MRdtZhi.exe
  2⤵
  PID:11564
- C:\Windows\System\INPgDHG.exe
  C:\Windows\System\INPgDHG.exe
  2⤵
  PID:11580
- C:\Windows\System\pDDCUIA.exe
  C:\Windows\System\pDDCUIA.exe
  2⤵
  PID:11596
- C:\Windows\System\DpiXhJu.exe
  C:\Windows\System\DpiXhJu.exe
  2⤵
  PID:11620
- C:\Windows\System\JoBCGeN.exe
  C:\Windows\System\JoBCGeN.exe
  2⤵
  PID:11636
- C:\Windows\System\xkBFbKt.exe
  C:\Windows\System\xkBFbKt.exe
  2⤵
  PID:11656
- C:\Windows\System\rGWTUib.exe
  C:\Windows\System\rGWTUib.exe
  2⤵
  PID:11672
- C:\Windows\System\BVYRZhI.exe
  C:\Windows\System\BVYRZhI.exe
  2⤵
  PID:11692
- C:\Windows\System\zvtkByo.exe
  C:\Windows\System\zvtkByo.exe
  2⤵
  PID:11712
- C:\Windows\System\HHjGeLH.exe
  C:\Windows\System\HHjGeLH.exe
  2⤵
  PID:11732
- C:\Windows\System\FXjRMXU.exe
  C:\Windows\System\FXjRMXU.exe
  2⤵
  PID:11752
- C:\Windows\System\npMItRO.exe
  C:\Windows\System\npMItRO.exe
  2⤵
  PID:11772
- C:\Windows\System\KSWghmb.exe
  C:\Windows\System\KSWghmb.exe
  2⤵
  PID:11788
- C:\Windows\System\doyoeOa.exe
  C:\Windows\System\doyoeOa.exe
  2⤵
  PID:11804
- C:\Windows\System\YrjUvSr.exe
  C:\Windows\System\YrjUvSr.exe
  2⤵
  PID:11824
- C:\Windows\System\AkgGgqu.exe
  C:\Windows\System\AkgGgqu.exe
  2⤵
  PID:11840
- C:\Windows\System\HEuKhJs.exe
  C:\Windows\System\HEuKhJs.exe
  2⤵
  PID:11856
- C:\Windows\System\HdBEvSM.exe
  C:\Windows\System\HdBEvSM.exe
  2⤵
  PID:11876
- C:\Windows\System\GxletjC.exe
  C:\Windows\System\GxletjC.exe
  2⤵
  PID:11896
- C:\Windows\System\qRNWnHe.exe
  C:\Windows\System\qRNWnHe.exe
  2⤵
  PID:11912
- C:\Windows\System\efpPoqH.exe
  C:\Windows\System\efpPoqH.exe
  2⤵
  PID:11932
- C:\Windows\System\igaejOJ.exe
  C:\Windows\System\igaejOJ.exe
  2⤵
  PID:11948
- C:\Windows\System\CHcVVdK.exe
  C:\Windows\System\CHcVVdK.exe
  2⤵
  PID:11968
- C:\Windows\System\chFACfN.exe
  C:\Windows\System\chFACfN.exe
  2⤵
  PID:12000
- C:\Windows\System\goLwAPu.exe
  C:\Windows\System\goLwAPu.exe
  2⤵
  PID:12028
- C:\Windows\System\KvhBLBf.exe
  C:\Windows\System\KvhBLBf.exe
  2⤵
  PID:12056
- C:\Windows\System\zdNOEBL.exe
  C:\Windows\System\zdNOEBL.exe
  2⤵
  PID:12080
- C:\Windows\System\ZXLlXrg.exe
  C:\Windows\System\ZXLlXrg.exe
  2⤵
  PID:12096
- C:\Windows\System\eAkXpnz.exe
  C:\Windows\System\eAkXpnz.exe
  2⤵
  PID:12124
- C:\Windows\System\chJWNlR.exe
  C:\Windows\System\chJWNlR.exe
  2⤵
  PID:12144
- C:\Windows\System\kJrxban.exe
  C:\Windows\System\kJrxban.exe
  2⤵
  PID:12164
- C:\Windows\System\QVFGWkI.exe
  C:\Windows\System\QVFGWkI.exe
  2⤵
  PID:12188
- C:\Windows\System\UJdEyvd.exe
  C:\Windows\System\UJdEyvd.exe
  2⤵
  PID:12208
- C:\Windows\System\kubKCjQ.exe
  C:\Windows\System\kubKCjQ.exe
  2⤵
  PID:12228
- C:\Windows\System\KtNZnzp.exe
  C:\Windows\System\KtNZnzp.exe
  2⤵
  PID:12244
- C:\Windows\System\NyaVLVE.exe
  C:\Windows\System\NyaVLVE.exe
  2⤵
  PID:12280
- C:\Windows\System\RPzLWXl.exe
  C:\Windows\System\RPzLWXl.exe
  2⤵
  PID:7048
- C:\Windows\System\aOsDlOR.exe
  C:\Windows\System\aOsDlOR.exe
  2⤵
  PID:7152
- C:\Windows\System\tSNwkDh.exe
  C:\Windows\System\tSNwkDh.exe
  2⤵
  PID:5560
- C:\Windows\System\nFAyDiG.exe
  C:\Windows\System\nFAyDiG.exe
  2⤵
  PID:5724
- C:\Windows\System\Urnsxxp.exe
  C:\Windows\System\Urnsxxp.exe
  2⤵
  PID:2264
- C:\Windows\System\UMusxOE.exe
  C:\Windows\System\UMusxOE.exe
  2⤵
  PID:2556
- C:\Windows\System\bZBhYlI.exe
  C:\Windows\System\bZBhYlI.exe
  2⤵
  PID:9980
- C:\Windows\System\putfeJw.exe
  C:\Windows\System\putfeJw.exe
  2⤵
  PID:10060
- C:\Windows\System\WUtEsyw.exe
  C:\Windows\System\WUtEsyw.exe
  2⤵
  PID:10104
- C:\Windows\System\MxloJSw.exe
  C:\Windows\System\MxloJSw.exe
  2⤵
  PID:10192
- C:\Windows\System\Ylcxqeh.exe
  C:\Windows\System\Ylcxqeh.exe
  2⤵
  PID:10236
- C:\Windows\System\tjdLopl.exe
  C:\Windows\System\tjdLopl.exe
  2⤵
  PID:7672
- C:\Windows\System\HznmdDa.exe
  C:\Windows\System\HznmdDa.exe
  2⤵
  PID:7780
- C:\Windows\System\oDtHskJ.exe
  C:\Windows\System\oDtHskJ.exe
  2⤵
  PID:7848
- C:\Windows\System\lsAOtUI.exe
  C:\Windows\System\lsAOtUI.exe
  2⤵
  PID:8696
- C:\Windows\System\yETcltO.exe
  C:\Windows\System\yETcltO.exe
  2⤵
  PID:8732
- C:\Windows\System\JfyWGje.exe
  C:\Windows\System\JfyWGje.exe
  2⤵
  PID:8888
- C:\Windows\System\ABDNpnL.exe
  C:\Windows\System\ABDNpnL.exe
  2⤵
  PID:6244
- C:\Windows\System\gmQCbii.exe
  C:\Windows\System\gmQCbii.exe
  2⤵
  PID:6296
- C:\Windows\System\NViuVJE.exe
  C:\Windows\System\NViuVJE.exe
  2⤵
  PID:4264
- C:\Windows\System\UUeBxCq.exe
  C:\Windows\System\UUeBxCq.exe
  2⤵
  PID:8220
- C:\Windows\System\iFbOgvm.exe
  C:\Windows\System\iFbOgvm.exe
  2⤵
  PID:9084
- C:\Windows\System\hPFIiFz.exe
  C:\Windows\System\hPFIiFz.exe
  2⤵
  PID:9092
- C:\Windows\System\jtpfxGv.exe
  C:\Windows\System\jtpfxGv.exe
  2⤵
  PID:9176
- C:\Windows\System\iLpnHdv.exe
  C:\Windows\System\iLpnHdv.exe
  2⤵
  PID:12300
- C:\Windows\System\VDvyUQu.exe
  C:\Windows\System\VDvyUQu.exe
  2⤵
  PID:12320
- C:\Windows\System\IHUsUju.exe
  C:\Windows\System\IHUsUju.exe
  2⤵
  PID:12340
- C:\Windows\System\azKCmfc.exe
  C:\Windows\System\azKCmfc.exe
  2⤵
  PID:12360
- C:\Windows\System\tjhhGMF.exe
  C:\Windows\System\tjhhGMF.exe
  2⤵
  PID:12388
- C:\Windows\System\jeHjTJN.exe
  C:\Windows\System\jeHjTJN.exe
  2⤵
  PID:12404
- C:\Windows\System\XwVySyc.exe
  C:\Windows\System\XwVySyc.exe
  2⤵
  PID:12424
- C:\Windows\System\SGdyRhS.exe
  C:\Windows\System\SGdyRhS.exe
  2⤵
  PID:12440
- C:\Windows\System\FqDtuBz.exe
  C:\Windows\System\FqDtuBz.exe
  2⤵
  PID:12456
- C:\Windows\System\jLMwkZu.exe
  C:\Windows\System\jLMwkZu.exe
  2⤵
  PID:12476
- C:\Windows\System\GiCUsTO.exe
  C:\Windows\System\GiCUsTO.exe
  2⤵
  PID:12492
- C:\Windows\System\IeYUhpZ.exe
  C:\Windows\System\IeYUhpZ.exe
  2⤵
  PID:12520
- C:\Windows\System\krTrJVG.exe
  C:\Windows\System\krTrJVG.exe
  2⤵
  PID:12536
- C:\Windows\System\RxvQIcu.exe
  C:\Windows\System\RxvQIcu.exe
  2⤵
  PID:12564
- C:\Windows\System\svHqWCS.exe
  C:\Windows\System\svHqWCS.exe
  2⤵
  PID:12580
- C:\Windows\System\aKqwVZe.exe
  C:\Windows\System\aKqwVZe.exe
  2⤵
  PID:12596
- C:\Windows\System\LIBmMrX.exe
  C:\Windows\System\LIBmMrX.exe
  2⤵
  PID:12616
- C:\Windows\System\xKbBdYt.exe
  C:\Windows\System\xKbBdYt.exe
  2⤵
  PID:12632
- C:\Windows\System\KKRpAcr.exe
  C:\Windows\System\KKRpAcr.exe
  2⤵
  PID:12652
- C:\Windows\System\dbOlrmo.exe
  C:\Windows\System\dbOlrmo.exe
  2⤵
  PID:12668
- C:\Windows\System\LRSleWp.exe
  C:\Windows\System\LRSleWp.exe
  2⤵
  PID:12688
- C:\Windows\System\lKuwXUV.exe
  C:\Windows\System\lKuwXUV.exe
  2⤵
  PID:12708
- C:\Windows\System\uKmiSfS.exe
  C:\Windows\System\uKmiSfS.exe
  2⤵
  PID:12724
- C:\Windows\System\fPnvKKG.exe
  C:\Windows\System\fPnvKKG.exe
  2⤵
  PID:12740
- C:\Windows\System\mXlBuFE.exe
  C:\Windows\System\mXlBuFE.exe
  2⤵
  PID:12756
- C:\Windows\System\AgINSER.exe
  C:\Windows\System\AgINSER.exe
  2⤵
  PID:12776
- C:\Windows\System\cFAhkjm.exe
  C:\Windows\System\cFAhkjm.exe
  2⤵
  PID:12796
- C:\Windows\System\rtlLpGW.exe
  C:\Windows\System\rtlLpGW.exe
  2⤵
  PID:12812
- C:\Windows\System\UYvnUcq.exe
  C:\Windows\System\UYvnUcq.exe
  2⤵
  PID:12828
- C:\Windows\System\UCHaaao.exe
  C:\Windows\System\UCHaaao.exe
  2⤵
  PID:12872
- C:\Windows\System\IQXPMFt.exe
  C:\Windows\System\IQXPMFt.exe
  2⤵
  PID:12900
- C:\Windows\System\aYQpYCX.exe
  C:\Windows\System\aYQpYCX.exe
  2⤵
  PID:12936
- C:\Windows\System\MlnYnFr.exe
  C:\Windows\System\MlnYnFr.exe
  2⤵
  PID:12956
- C:\Windows\System\SwWxTLc.exe
  C:\Windows\System\SwWxTLc.exe
  2⤵
  PID:12972
- C:\Windows\System\AyknnwP.exe
  C:\Windows\System\AyknnwP.exe
  2⤵
  PID:12992
- C:\Windows\System\GXlxjiW.exe
  C:\Windows\System\GXlxjiW.exe
  2⤵
  PID:13008
- C:\Windows\System\RHskNuZ.exe
  C:\Windows\System\RHskNuZ.exe
  2⤵
  PID:13028
- C:\Windows\System\sOrtcOX.exe
  C:\Windows\System\sOrtcOX.exe
  2⤵
  PID:13048
- C:\Windows\System\HrdoFFj.exe
  C:\Windows\System\HrdoFFj.exe
  2⤵
  PID:13064
- C:\Windows\System\BUVGnSZ.exe
  C:\Windows\System\BUVGnSZ.exe
  2⤵
  PID:13084
- C:\Windows\System\cqDlLFv.exe
  C:\Windows\System\cqDlLFv.exe
  2⤵
  PID:13108
- C:\Windows\System\kMFRYRF.exe
  C:\Windows\System\kMFRYRF.exe
  2⤵
  PID:13220
- C:\Windows\System\BWfNmMX.exe
  C:\Windows\System\BWfNmMX.exe
  2⤵
  PID:8764
- C:\Windows\System\xbCHLOA.exe
  C:\Windows\System\xbCHLOA.exe
  2⤵
  PID:8848
- C:\Windows\System\GEyhERs.exe
  C:\Windows\System\GEyhERs.exe
  2⤵
  PID:8924
- C:\Windows\System\WEbNVRN.exe
  C:\Windows\System\WEbNVRN.exe
  2⤵
  PID:9512
- C:\Windows\System\AprPGyH.exe
  C:\Windows\System\AprPGyH.exe
  2⤵
  PID:3696
- C:\Windows\System\RVQnDfl.exe
  C:\Windows\System\RVQnDfl.exe
  2⤵
  PID:1896
- C:\Windows\System\oJGGJrd.exe
  C:\Windows\System\oJGGJrd.exe
  2⤵
  PID:4252
- C:\Windows\System\NHXHWxf.exe
  C:\Windows\System\NHXHWxf.exe
  2⤵
  PID:9368
- C:\Windows\System\NuhcZbV.exe
  C:\Windows\System\NuhcZbV.exe
  2⤵
  PID:11008
- C:\Windows\System\ZSQLoLl.exe
  C:\Windows\System\ZSQLoLl.exe
  2⤵
  PID:9020
- C:\Windows\System\mYeSfkp.exe
  C:\Windows\System\mYeSfkp.exe
  2⤵
  PID:11484
- C:\Windows\System\nzMVCFW.exe
  C:\Windows\System\nzMVCFW.exe
  2⤵
  PID:13172
- C:\Windows\System\LRoPsrn.exe
  C:\Windows\System\LRoPsrn.exe
  2⤵
  PID:8944
- C:\Windows\System\nBddUjK.exe
  C:\Windows\System\nBddUjK.exe
  2⤵
  PID:3840
- C:\Windows\System\LgKILqN.exe
  C:\Windows\System\LgKILqN.exe
  2⤵
  PID:9160
- C:\Windows\System\isTCIFW.exe
  C:\Windows\System\isTCIFW.exe
  2⤵
  PID:4648
- C:\Windows\System\ZjMGgXJ.exe
  C:\Windows\System\ZjMGgXJ.exe
  2⤵
  PID:10968
- C:\Windows\System\RwWPxVJ.exe
  C:\Windows\System\RwWPxVJ.exe
  2⤵
  PID:12916
- C:\Windows\System\zCBVMRw.exe
  C:\Windows\System\zCBVMRw.exe
  2⤵
  PID:13056
- C:\Windows\System\JFsbgEH.exe
  C:\Windows\System\JFsbgEH.exe
  2⤵
  PID:13076
- C:\Windows\System\Ojzzxlq.exe
  C:\Windows\System\Ojzzxlq.exe
  2⤵
  PID:12352
- C:\Windows\System\KDNnEUC.exe
  C:\Windows\System\KDNnEUC.exe
  2⤵
  PID:12356
- C:\Windows\System\SsrmFfh.exe
  C:\Windows\System\SsrmFfh.exe
  2⤵
  PID:13188
- C:\Windows\System\LGHpDbX.exe
  C:\Windows\System\LGHpDbX.exe
  2⤵
  PID:9640
- C:\Windows\System\NPiSWLE.exe
  C:\Windows\System\NPiSWLE.exe
  2⤵
  PID:12136
- C:\Windows\System\OoSfrmH.exe
  C:\Windows\System\OoSfrmH.exe
  2⤵
  PID:11668
- C:\Windows\System\YGmNzHa.exe
  C:\Windows\System\YGmNzHa.exe
  2⤵
  PID:11416
- C:\Windows\System\xtmtDEU.exe
  C:\Windows\System\xtmtDEU.exe
  2⤵
  PID:11024
- C:\Windows\System\lCtBkEf.exe
  C:\Windows\System\lCtBkEf.exe
  2⤵
  PID:8336
- C:\Windows\System\arJGryk.exe
  C:\Windows\System\arJGryk.exe
  2⤵
  PID:12700
- C:\Windows\System\fqseECx.exe
  C:\Windows\System\fqseECx.exe
  2⤵
  PID:12512
- C:\Windows\System\BrQtZqT.exe
  C:\Windows\System\BrQtZqT.exe
  2⤵
  PID:13096
- C:\Windows\System\vHxuclX.exe
  C:\Windows\System\vHxuclX.exe
  2⤵
  PID:12896
- C:\Windows\System\CuisTVF.exe
  C:\Windows\System\CuisTVF.exe
  2⤵
  PID:11944
- C:\Windows\System\mnVXplF.exe
  C:\Windows\System\mnVXplF.exe
  2⤵
  PID:8964
- C:\Windows\System\yteQflO.exe
  C:\Windows\System\yteQflO.exe
  2⤵
  PID:9464
- C:\Windows\System\PUZvaBn.exe
  C:\Windows\System\PUZvaBn.exe
  2⤵
  PID:10440
- C:\Windows\System\WeIvOTi.exe
  C:\Windows\System\WeIvOTi.exe
  2⤵
  PID:11252
- C:\Windows\System\eLZBVJt.exe
  C:\Windows\System\eLZBVJt.exe
  2⤵
  PID:7548
- C:\Windows\System\mlokttf.exe
  C:\Windows\System\mlokttf.exe
  2⤵
  PID:13420
- C:\Windows\System\qAlRCWu.exe
  C:\Windows\System\qAlRCWu.exe
  2⤵
  PID:13440
- C:\Windows\System\aXXTWjF.exe
  C:\Windows\System\aXXTWjF.exe
  2⤵
  PID:13476
- C:\Windows\System\wxkUFSA.exe
  C:\Windows\System\wxkUFSA.exe
  2⤵
  PID:13500
- C:\Windows\System\TDxAYoW.exe
  C:\Windows\System\TDxAYoW.exe
  2⤵
  PID:13516
- C:\Windows\System\LRwUeWe.exe
  C:\Windows\System\LRwUeWe.exe
  2⤵
  PID:13536
- C:\Windows\System\nFROrNb.exe
  C:\Windows\System\nFROrNb.exe
  2⤵
  PID:13552
- C:\Windows\System\AZhbHYJ.exe
  C:\Windows\System\AZhbHYJ.exe
  2⤵
  PID:13568
- C:\Windows\System\BidcJsz.exe
  C:\Windows\System\BidcJsz.exe
  2⤵
  PID:13588
- C:\Windows\System\ZiTZZeu.exe
  C:\Windows\System\ZiTZZeu.exe
  2⤵
  PID:13604
- C:\Windows\System\CoTsLrS.exe
  C:\Windows\System\CoTsLrS.exe
  2⤵
  PID:13628
- C:\Windows\System\pjNTbAz.exe
  C:\Windows\System\pjNTbAz.exe
  2⤵
  PID:13644
- C:\Windows\System\sDZIzzV.exe
  C:\Windows\System\sDZIzzV.exe
  2⤵
  PID:13660
- C:\Windows\System\lXUoeJv.exe
  C:\Windows\System\lXUoeJv.exe
  2⤵
  PID:13676
- C:\Windows\System\sDqCtRv.exe
  C:\Windows\System\sDqCtRv.exe
  2⤵
  PID:13692
- C:\Windows\System\nyNUaXK.exe
  C:\Windows\System\nyNUaXK.exe
  2⤵
  PID:13712
- C:\Windows\System\PPAyHfk.exe
  C:\Windows\System\PPAyHfk.exe
  2⤵
  PID:13836
- C:\Windows\System\cpVCeDW.exe
  C:\Windows\System\cpVCeDW.exe
  2⤵
  PID:12840
- C:\Windows\System\hrdbyBn.exe
  C:\Windows\System\hrdbyBn.exe
  2⤵
  PID:11380
- C:\Windows\System\SfVqFHC.exe
  C:\Windows\System\SfVqFHC.exe
  2⤵
  PID:10144
- C:\Windows\System\TYUATcG.exe
  C:\Windows\System\TYUATcG.exe
  2⤵
  PID:11540
- C:\Windows\System\amlXCaq.exe
  C:\Windows\System\amlXCaq.exe
  2⤵
  PID:9324
- C:\Windows\System\xiVuzeG.exe
  C:\Windows\System\xiVuzeG.exe
  2⤵
  PID:12884
- C:\Windows\System\ptfvcSI.exe
  C:\Windows\System\ptfvcSI.exe
  2⤵
  PID:11964
- C:\Windows\System\qrhhWto.exe
  C:\Windows\System\qrhhWto.exe
  2⤵
  PID:10632
- C:\Windows\System\JYavvyI.exe
  C:\Windows\System\JYavvyI.exe
  2⤵
  PID:13724
- C:\Windows\System\XhtOsEp.exe
  C:\Windows\System\XhtOsEp.exe
  2⤵
  PID:13760
- C:\Windows\System\htxErAB.exe
  C:\Windows\System\htxErAB.exe
  2⤵
  PID:12644
- C:\Windows\System\bgkejDw.exe
  C:\Windows\System\bgkejDw.exe
  2⤵
  PID:13024
- C:\Windows\System\JvyNEJL.exe
  C:\Windows\System\JvyNEJL.exe
  2⤵
  PID:1544
- C:\Windows\System\gAbvJeH.exe
  C:\Windows\System\gAbvJeH.exe
  2⤵
  PID:13372
- C:\Windows\System\qMedcru.exe
  C:\Windows\System\qMedcru.exe
  2⤵
  PID:13408
- C:\Windows\System\txUdPIA.exe
  C:\Windows\System\txUdPIA.exe
  2⤵
  PID:13432
- C:\Windows\System\hmZtxER.exe
  C:\Windows\System\hmZtxER.exe
  2⤵
  PID:13460
- C:\Windows\System\dWOrVYt.exe
  C:\Windows\System\dWOrVYt.exe
  2⤵
  PID:13468
- C:\Windows\System\eNAMqsk.exe
  C:\Windows\System\eNAMqsk.exe
  2⤵
  PID:13512
- C:\Windows\System\WVTFPqg.exe
  C:\Windows\System\WVTFPqg.exe
  2⤵
  PID:13584
- C:\Windows\System\XhCFJSP.exe
  C:\Windows\System\XhCFJSP.exe
  2⤵
  PID:13636
- C:\Windows\System\ztEBcNY.exe
  C:\Windows\System\ztEBcNY.exe
  2⤵
  PID:13672
- C:\Windows\System\aAbVngH.exe
  C:\Windows\System\aAbVngH.exe
  2⤵
  PID:13764
- C:\Windows\System\XpmWFLw.exe
  C:\Windows\System\XpmWFLw.exe
  2⤵
  PID:13792
- C:\Windows\System\lNzBBaq.exe
  C:\Windows\System\lNzBBaq.exe
  2⤵
  PID:13820
- C:\Windows\System\mfGtZpw.exe
  C:\Windows\System\mfGtZpw.exe
  2⤵
  PID:13860
- C:\Windows\System\vkwumkw.exe
  C:\Windows\System\vkwumkw.exe
  2⤵
  PID:13880
- C:\Windows\System\AQjKwzx.exe
  C:\Windows\System\AQjKwzx.exe
  2⤵
  PID:13900
- C:\Windows\System\tNHWilm.exe
  C:\Windows\System\tNHWilm.exe
  2⤵
  PID:13940
- C:\Windows\System\EAvxuiE.exe
  C:\Windows\System\EAvxuiE.exe
  2⤵
  PID:9820
- C:\Windows\System\ZnNICOK.exe
  C:\Windows\System\ZnNICOK.exe
  2⤵
  PID:10812
- C:\Windows\System\PbagmfU.exe
  C:\Windows\System\PbagmfU.exe
  2⤵
  PID:14248
- C:\Windows\System\RwjRnAf.exe
  C:\Windows\System\RwjRnAf.exe
  2⤵
  PID:4260
- C:\Windows\System\IEeHZgS.exe
  C:\Windows\System\IEeHZgS.exe
  2⤵
  PID:10988
- C:\Windows\System\nBsJTRE.exe
  C:\Windows\System\nBsJTRE.exe
  2⤵
  PID:13324
- C:\Windows\System\uXArrOt.exe
  C:\Windows\System\uXArrOt.exe
  2⤵
  PID:10608
- C:\Windows\System\EGzxjpT.exe
  C:\Windows\System\EGzxjpT.exe
  2⤵
  PID:13524
- C:\Windows\System\LLXyfqA.exe
  C:\Windows\System\LLXyfqA.exe
  2⤵
  PID:14056
- C:\Windows\System\SDzFBtF.exe
  C:\Windows\System\SDzFBtF.exe
  2⤵
  PID:12336
- C:\Windows\System\RFizkXx.exe
  C:\Windows\System\RFizkXx.exe
  2⤵
  PID:13736
- C:\Windows\System\HpVSyHg.exe
  C:\Windows\System\HpVSyHg.exe
  2⤵
  PID:4544
- C:\Windows\System\gGphNOM.exe
  C:\Windows\System\gGphNOM.exe
  2⤵
  PID:11872
- C:\Windows\System\ZbDKjtS.exe
  C:\Windows\System\ZbDKjtS.exe
  2⤵
  PID:4588
- C:\Windows\System\CHfcIcY.exe
  C:\Windows\System\CHfcIcY.exe
  2⤵
  PID:10084
- C:\Windows\System\GsFaPDO.exe
  C:\Windows\System\GsFaPDO.exe
  2⤵
  PID:10744
- C:\Windows\System\IrVNXAY.exe
  C:\Windows\System\IrVNXAY.exe
  2⤵
  PID:11684
- C:\Windows\System\PReFrMQ.exe
  C:\Windows\System\PReFrMQ.exe
  2⤵
  PID:3120
- C:\Windows\System\rpFjOSz.exe
  C:\Windows\System\rpFjOSz.exe
  2⤵
  PID:8884
- C:\Windows\System\wTpVcxd.exe
  C:\Windows\System\wTpVcxd.exe
  2⤵
  PID:3928
- C:\Windows\System\bwQimqN.exe
  C:\Windows\System\bwQimqN.exe
  2⤵
  PID:13564
- C:\Windows\System\yYtyIgB.exe
  C:\Windows\System\yYtyIgB.exe
  2⤵
  PID:12240
- C:\Windows\System\JQUbNFm.exe
  C:\Windows\System\JQUbNFm.exe
  2⤵
  PID:12328
- C:\Windows\System\oZYmVAl.exe
  C:\Windows\System\oZYmVAl.exe
  2⤵
  PID:12792
- C:\Windows\System\hHNVguB.exe
  C:\Windows\System\hHNVguB.exe
  2⤵
  PID:13212
- C:\Windows\System\eZtEKzr.exe
  C:\Windows\System\eZtEKzr.exe
  2⤵
  PID:13748
- C:\Windows\System\HbYoMEA.exe
  C:\Windows\System\HbYoMEA.exe
  2⤵
  PID:13832
- C:\Windows\System\bTCUQXY.exe
  C:\Windows\System\bTCUQXY.exe
  2⤵
  PID:13928
- C:\Windows\System\wOmzBkP.exe
  C:\Windows\System\wOmzBkP.exe
  2⤵
  PID:11100
- C:\Windows\System\ZFpzAwr.exe
  C:\Windows\System\ZFpzAwr.exe
  2⤵
  PID:9412
- C:\Windows\System\SttMGzT.exe
  C:\Windows\System\SttMGzT.exe
  2⤵
  PID:9008
- C:\Windows\System\EHfkppw.exe
  C:\Windows\System\EHfkppw.exe
  2⤵
  PID:4100
- C:\Windows\System\SXMavJl.exe
  C:\Windows\System\SXMavJl.exe
  2⤵
  PID:4664
- C:\Windows\System\NUcPsxg.exe
  C:\Windows\System\NUcPsxg.exe
  2⤵
  PID:4092
- C:\Windows\System\gaRAiJL.exe
  C:\Windows\System\gaRAiJL.exe
  2⤵
  PID:10232
- C:\Windows\System\PIigCsX.exe
  C:\Windows\System\PIigCsX.exe
  2⤵
  PID:10868
- C:\Windows\System\iIkuOfm.exe
  C:\Windows\System\iIkuOfm.exe
  2⤵
  PID:1248
- C:\Windows\System\EUhJZgF.exe
  C:\Windows\System\EUhJZgF.exe
  2⤵
  PID:10308
- C:\Windows\System\bDjJwxU.exe
  C:\Windows\System\bDjJwxU.exe
  2⤵
  PID:5124
- C:\Windows\System\BvMtVFF.exe
  C:\Windows\System\BvMtVFF.exe
  2⤵
  PID:4164
- C:\Windows\System\hmhhbpn.exe
  C:\Windows\System\hmhhbpn.exe
  2⤵
  PID:4716
- C:\Windows\System\fUbKryg.exe
  C:\Windows\System\fUbKryg.exe
  2⤵
  PID:8480
- C:\Windows\System\CEHaDDH.exe
  C:\Windows\System\CEHaDDH.exe
  2⤵
  PID:456
- C:\Windows\System\iOiJWad.exe
  C:\Windows\System\iOiJWad.exe
  2⤵
  PID:14188
- C:\Windows\System\oYAzckV.exe
  C:\Windows\System\oYAzckV.exe
  2⤵
  PID:10492
- C:\Windows\System\VTQUVkY.exe
  C:\Windows\System\VTQUVkY.exe
  2⤵
  PID:11336
- C:\Windows\System\nSnJCYq.exe
  C:\Windows\System\nSnJCYq.exe
  2⤵
  PID:11688
- C:\Windows\System\YlCuLQQ.exe
  C:\Windows\System\YlCuLQQ.exe
  2⤵
  PID:5428
- C:\Windows\System\aqmLRbF.exe
  C:\Windows\System\aqmLRbF.exe
  2⤵
  PID:5740
- C:\Windows\System\TnXCioT.exe
  C:\Windows\System\TnXCioT.exe
  2⤵
  PID:6132
- C:\Windows\System\vHxxZIv.exe
  C:\Windows\System\vHxxZIv.exe
  2⤵
  PID:404
- C:\Windows\System\dxcCMaI.exe
  C:\Windows\System\dxcCMaI.exe
  2⤵
  PID:12224
- C:\Windows\System\EEoSVjE.exe
  C:\Windows\System\EEoSVjE.exe
  2⤵
  PID:6068
- C:\Windows\System\ZKmDtbQ.exe
  C:\Windows\System\ZKmDtbQ.exe
  2⤵
  PID:2244
- C:\Windows\System\nEcDYfM.exe
  C:\Windows\System\nEcDYfM.exe
  2⤵
  PID:4872
- C:\Windows\System\sWaQnEz.exe
  C:\Windows\System\sWaQnEz.exe
  2⤵
  PID:5668
- C:\Windows\System\oVlViNj.exe
  C:\Windows\System\oVlViNj.exe
  2⤵
  PID:13168
- C:\Windows\System\EEyjcJu.exe
  C:\Windows\System\EEyjcJu.exe
  2⤵
  PID:632
- C:\Windows\System\nIgZuHb.exe
  C:\Windows\System\nIgZuHb.exe
  2⤵
  PID:3188
- C:\Windows\System\rJrMyPL.exe
  C:\Windows\System\rJrMyPL.exe
  2⤵
  PID:8960
- C:\Windows\System\gJBLsos.exe
  C:\Windows\System\gJBLsos.exe
  2⤵
  PID:13288
- C:\Windows\System\LWnyaox.exe
  C:\Windows\System\LWnyaox.exe
  2⤵
  PID:5368
- C:\Windows\System\BDjtEpI.exe
  C:\Windows\System\BDjtEpI.exe
  2⤵
  PID:5036
- C:\Windows\System\msMGMES.exe
  C:\Windows\System\msMGMES.exe
  2⤵
  PID:6616
- C:\Windows\System\VjZZAPg.exe
  C:\Windows\System\VjZZAPg.exe
  2⤵
  PID:10420
- C:\Windows\System\YbgPswF.exe
  C:\Windows\System\YbgPswF.exe
  2⤵
  PID:6528
- C:\Windows\System\DYoBIxd.exe
  C:\Windows\System\DYoBIxd.exe
  2⤵
  PID:5024
- C:\Windows\System\EglGMgf.exe
  C:\Windows\System\EglGMgf.exe
  2⤵
  PID:1376
- C:\Windows\System\xVjxIut.exe
  C:\Windows\System\xVjxIut.exe
  2⤵
  PID:3524
- C:\Windows\System\hYCAHaw.exe
  C:\Windows\System\hYCAHaw.exe
  2⤵
  PID:7044
- C:\Windows\System\wAWMKrm.exe
  C:\Windows\System\wAWMKrm.exe
  2⤵
  PID:14104
- C:\Windows\System\eQUzYYH.exe
  C:\Windows\System\eQUzYYH.exe
  2⤵
  PID:3916
- C:\Windows\System\TZhwKpR.exe
  C:\Windows\System\TZhwKpR.exe
  2⤵
  PID:7024
- C:\Windows\System\OxiTShn.exe
  C:\Windows\System\OxiTShn.exe
  2⤵
  PID:13044
- C:\Windows\System\eEsGtIk.exe
  C:\Windows\System\eEsGtIk.exe
  2⤵
  PID:6752
- C:\Windows\System\aMVfpks.exe
  C:\Windows\System\aMVfpks.exe
  2⤵
  PID:1388
- C:\Windows\System\evRwNke.exe
  C:\Windows\System\evRwNke.exe
  2⤵
  PID:2672
- C:\Windows\System\PIFNHfw.exe
  C:\Windows\System\PIFNHfw.exe
  2⤵
  PID:5892
- C:\Windows\System\oTEkyxI.exe
  C:\Windows\System\oTEkyxI.exe
  2⤵
  PID:6704
- C:\Windows\System\rXcKbvF.exe
  C:\Windows\System\rXcKbvF.exe
  2⤵
  PID:6812
- C:\Windows\System\BeVZIlR.exe
  C:\Windows\System\BeVZIlR.exe
  2⤵
  PID:6668
- C:\Windows\System\ylFlOSE.exe
  C:\Windows\System\ylFlOSE.exe
  2⤵
  PID:5140
- C:\Windows\System\KRUHDDr.exe
  C:\Windows\System\KRUHDDr.exe
  2⤵
  PID:14060
- C:\Windows\System\dNvvKdS.exe
  C:\Windows\System\dNvvKdS.exe
  2⤵
  PID:7444
- C:\Windows\System\sOzTFeh.exe
  C:\Windows\System\sOzTFeh.exe
  2⤵
  PID:1524
- C:\Windows\System\zehPkHe.exe
  C:\Windows\System\zehPkHe.exe
  2⤵
  PID:2648
- C:\Windows\System\HnAstvx.exe
  C:\Windows\System\HnAstvx.exe
  2⤵
  PID:13980
- C:\Windows\System\DKPbwut.exe
  C:\Windows\System\DKPbwut.exe
  2⤵
  PID:5068
- C:\Windows\System\orwHjTa.exe
  C:\Windows\System\orwHjTa.exe
  2⤵
  PID:6124
- C:\Windows\System\vKWcKdF.exe
  C:\Windows\System\vKWcKdF.exe
  2⤵
  PID:6828
- C:\Windows\System\uesEEKw.exe
  C:\Windows\System\uesEEKw.exe
  2⤵
  PID:5996
- C:\Windows\System\LLcpHZz.exe
  C:\Windows\System\LLcpHZz.exe
  2⤵
  PID:8108
- C:\Windows\System\BKtOhdj.exe
  C:\Windows\System\BKtOhdj.exe
  2⤵
  PID:2036
- C:\Windows\System\zWXObxx.exe
  C:\Windows\System\zWXObxx.exe
  2⤵
  PID:8928
- C:\Windows\System\vaekkLK.exe
  C:\Windows\System\vaekkLK.exe
  2⤵
  PID:8216
- C:\Windows\System\mQgiSFr.exe
  C:\Windows\System\mQgiSFr.exe
  2⤵
  PID:8300
- C:\Windows\System\WAMHVGS.exe
  C:\Windows\System\WAMHVGS.exe
  2⤵
  PID:8028
- C:\Windows\System\WETzLtG.exe
  C:\Windows\System\WETzLtG.exe
  2⤵
  PID:9580
- C:\Windows\System\tZNqgOp.exe
  C:\Windows\System\tZNqgOp.exe
  2⤵
  PID:5252
- C:\Windows\System\MhRvunB.exe
  C:\Windows\System\MhRvunB.exe
  2⤵
  PID:8680
- C:\Windows\System\HykiqiW.exe
  C:\Windows\System\HykiqiW.exe
  2⤵
  PID:2456
- C:\Windows\System\juJwqRt.exe
  C:\Windows\System\juJwqRt.exe
  2⤵
  PID:6636
- C:\Windows\System\rUORuUI.exe
  C:\Windows\System\rUORuUI.exe
  2⤵
  PID:9548
- C:\Windows\System\LNHnUWl.exe
  C:\Windows\System\LNHnUWl.exe
  2⤵
  PID:6256
- C:\Windows\System\lYZFGfz.exe
  C:\Windows\System\lYZFGfz.exe
  2⤵
  PID:1732
- C:\Windows\System\wjCafgF.exe
  C:\Windows\System\wjCafgF.exe
  2⤵
  PID:11364
- C:\Windows\System\UyabaLq.exe
  C:\Windows\System\UyabaLq.exe
  2⤵
  PID:7004
- C:\Windows\System\Rjytwjm.exe
  C:\Windows\System\Rjytwjm.exe
  2⤵
  PID:2592
- C:\Windows\System\ATVgcnI.exe
  C:\Windows\System\ATVgcnI.exe
  2⤵
  PID:5048
- C:\Windows\System\terxrqJ.exe
  C:\Windows\System\terxrqJ.exe
  2⤵
  PID:8396
- C:\Windows\System\Jztrfnq.exe
  C:\Windows\System\Jztrfnq.exe
  2⤵
  PID:13072
- C:\Windows\System\WiOGhyj.exe
  C:\Windows\System\WiOGhyj.exe
  2⤵
  PID:10960
- C:\Windows\System\SupNMKC.exe
  C:\Windows\System\SupNMKC.exe
  2⤵
  PID:13176
- C:\Windows\System\mkwxkTv.exe
  C:\Windows\System\mkwxkTv.exe
  2⤵
  PID:7340
- C:\Windows\System\KMrUiKz.exe
  C:\Windows\System\KMrUiKz.exe
  2⤵
  PID:8288
- C:\Windows\System\lcGpVVB.exe
  C:\Windows\System\lcGpVVB.exe
  2⤵
  PID:13488
- C:\Windows\System\VmWRVNn.exe
  C:\Windows\System\VmWRVNn.exe
  2⤵
  PID:6924
- C:\Windows\System\pCLRoDl.exe
  C:\Windows\System\pCLRoDl.exe
  2⤵
  PID:11608
- C:\Windows\System\DEAUOgY.exe
  C:\Windows\System\DEAUOgY.exe
  2⤵
  PID:6708
- C:\Windows\System\ntdajdQ.exe
  C:\Windows\System\ntdajdQ.exe
  2⤵
  PID:8444
- C:\Windows\System\CvyzzZs.exe
  C:\Windows\System\CvyzzZs.exe
  2⤵
  PID:8716
- C:\Windows\System\CnpJVVI.exe
  C:\Windows\System\CnpJVVI.exe
  2⤵
  PID:9240
- C:\Windows\System\icvFOfe.exe
  C:\Windows\System\icvFOfe.exe
  2⤵
  PID:10356
- C:\Windows\System\WIvRxat.exe
  C:\Windows\System\WIvRxat.exe
  2⤵
  PID:8824
- C:\Windows\System\hdGHpDQ.exe
  C:\Windows\System\hdGHpDQ.exe
  2⤵
  PID:10468
- C:\Windows\System\PiJAYYt.exe
  C:\Windows\System\PiJAYYt.exe
  2⤵
  PID:6784
- C:\Windows\System\ziMHoZn.exe
  C:\Windows\System\ziMHoZn.exe
  2⤵
  PID:11052
- C:\Windows\System\ZjCToPn.exe
  C:\Windows\System\ZjCToPn.exe
  2⤵
  PID:6948
- C:\Windows\System\XjKiBNf.exe
  C:\Windows\System\XjKiBNf.exe
  2⤵
  PID:14332
- C:\Windows\System\njEPbRC.exe
  C:\Windows\System\njEPbRC.exe
  2⤵
  PID:4768
- C:\Windows\System\SqRGtld.exe
  C:\Windows\System\SqRGtld.exe
  2⤵
  PID:6824
- C:\Windows\System\iWjYPhV.exe
  C:\Windows\System\iWjYPhV.exe
  2⤵
  PID:6848
- C:\Windows\System\PevJrRZ.exe
  C:\Windows\System\PevJrRZ.exe
  2⤵
  PID:11432
- C:\Windows\System\kSlAtsA.exe
  C:\Windows\System\kSlAtsA.exe
  2⤵
  PID:7824
- C:\Windows\System\LIfQDPk.exe
  C:\Windows\System\LIfQDPk.exe
  2⤵
  PID:10508
- C:\Windows\System\EPeXUDu.exe
  C:\Windows\System\EPeXUDu.exe
  2⤵
  PID:8656
- C:\Windows\System\IZxqXCp.exe
  C:\Windows\System\IZxqXCp.exe
  2⤵
  PID:5476
- C:\Windows\System\gpIMfNA.exe
  C:\Windows\System\gpIMfNA.exe
  2⤵
  PID:5656
- C:\Windows\System\QvAQNhu.exe
  C:\Windows\System\QvAQNhu.exe
  2⤵
  PID:4772
- C:\Windows\System\DEKfzfX.exe
  C:\Windows\System\DEKfzfX.exe
  2⤵
  PID:10736
- C:\Windows\System\mTJOqFp.exe
  C:\Windows\System\mTJOqFp.exe
  2⤵
  PID:6180
- C:\Windows\System\NmYAwtC.exe
  C:\Windows\System\NmYAwtC.exe
  2⤵
  PID:6056
- C:\Windows\System\DaCoIWd.exe
  C:\Windows\System\DaCoIWd.exe
  2⤵
  PID:6492
- C:\Windows\System\iHwtopi.exe
  C:\Windows\System\iHwtopi.exe
  2⤵
  PID:7832
- C:\Windows\System\UZNjLNs.exe
  C:\Windows\System\UZNjLNs.exe
  2⤵
  PID:8856
- C:\Windows\System\ruXMYuT.exe
  C:\Windows\System\ruXMYuT.exe
  2⤵
  PID:12624
- C:\Windows\System\HtepWEQ.exe
  C:\Windows\System\HtepWEQ.exe
  2⤵
  PID:12604
- C:\Windows\System\eewtYfH.exe
  C:\Windows\System\eewtYfH.exe
  2⤵
  PID:7196
- C:\Windows\System\KjOlIcy.exe
  C:\Windows\System\KjOlIcy.exe
  2⤵
  PID:9080
- C:\Windows\System\TKMWgeu.exe
  C:\Windows\System\TKMWgeu.exe
  2⤵
  PID:3456
- C:\Windows\System\KmdBroz.exe
  C:\Windows\System\KmdBroz.exe
  2⤵
  PID:13080
- C:\Windows\System\yvsqZMx.exe
  C:\Windows\System\yvsqZMx.exe
  2⤵
  PID:12788
- C:\Windows\System\rWcuWOM.exe
  C:\Windows\System\rWcuWOM.exe
  2⤵
  PID:4704
- C:\Windows\System\mCpYFPH.exe
  C:\Windows\System\mCpYFPH.exe
  2⤵
  PID:10540
- C:\Windows\System\FiUJVeX.exe
  C:\Windows\System\FiUJVeX.exe
  2⤵
  PID:10660
- C:\Windows\System\puWnWJf.exe
  C:\Windows\System\puWnWJf.exe
  2⤵
  PID:9296
- C:\Windows\System\mnVsnaS.exe
  C:\Windows\System\mnVsnaS.exe
  2⤵
  PID:9408
- C:\Windows\System\xpJUxab.exe
  C:\Windows\System\xpJUxab.exe
  2⤵
  PID:9264
- C:\Windows\System\FbusOhD.exe
  C:\Windows\System\FbusOhD.exe
  2⤵
  PID:11728
- C:\Windows\System\jNJtKsd.exe
  C:\Windows\System\jNJtKsd.exe
  2⤵
  PID:7752
- C:\Windows\System\bkOdGdc.exe
  C:\Windows\System\bkOdGdc.exe
  2⤵
  PID:7588
- C:\Windows\System\bzwbKet.exe
  C:\Windows\System\bzwbKet.exe
  2⤵
  PID:8124
- C:\Windows\System\OSOrkCX.exe
  C:\Windows\System\OSOrkCX.exe
  2⤵
  PID:9844
- C:\Windows\System\nNvXCrU.exe
  C:\Windows\System\nNvXCrU.exe
  2⤵
  PID:6072
- C:\Windows\System\bNENkNo.exe
  C:\Windows\System\bNENkNo.exe
  2⤵
  PID:3824
- C:\Windows\System\PxulNhE.exe
  C:\Windows\System\PxulNhE.exe
  2⤵
  PID:5316
- C:\Windows\System\gQVFrQd.exe
  C:\Windows\System\gQVFrQd.exe
  2⤵
  PID:3520
- C:\Windows\System\gNPoIun.exe
  C:\Windows\System\gNPoIun.exe
  2⤵
  PID:9700
- C:\Windows\System\ENsoVOf.exe
  C:\Windows\System\ENsoVOf.exe
  2⤵
  PID:13868
- C:\Windows\System\SkIWWTq.exe
  C:\Windows\System\SkIWWTq.exe
  2⤵
  PID:4684
- C:\Windows\System\ZGYCytH.exe
  C:\Windows\System\ZGYCytH.exe
  2⤵
  PID:9900
- C:\Windows\System\JbZtGKs.exe
  C:\Windows\System\JbZtGKs.exe
  2⤵
  PID:12372
- C:\Windows\System\YvDSxGt.exe
  C:\Windows\System\YvDSxGt.exe
  2⤵
  PID:12848
- C:\Windows\System\pPazTLo.exe
  C:\Windows\System\pPazTLo.exe
  2⤵
  PID:8368
- C:\Windows\System\JraFmro.exe
  C:\Windows\System\JraFmro.exe
  2⤵
  PID:8004
- C:\Windows\System\bAjgMsN.exe
  C:\Windows\System\bAjgMsN.exe
  2⤵
  PID:2116
- C:\Windows\System\wwOfrag.exe
  C:\Windows\System\wwOfrag.exe
  2⤵
  PID:10964
- C:\Windows\System\mzHAmMM.exe
  C:\Windows\System\mzHAmMM.exe
  2⤵
  PID:9876
- C:\Windows\System\lfJBEfq.exe
  C:\Windows\System\lfJBEfq.exe
  2⤵
  PID:5832
- C:\Windows\System\nCytdNC.exe
  C:\Windows\System\nCytdNC.exe
  2⤵
  PID:11044
- C:\Windows\System\FOmisil.exe
  C:\Windows\System\FOmisil.exe
  2⤵
  PID:11816
- C:\Windows\System\VyEyQfI.exe
  C:\Windows\System\VyEyQfI.exe
  2⤵
  PID:7860
- C:\Windows\System\cCuhMli.exe
  C:\Windows\System\cCuhMli.exe
  2⤵
  PID:7748
- C:\Windows\System\eqdOBsE.exe
  C:\Windows\System\eqdOBsE.exe
  2⤵
  PID:12116
- C:\Windows\System\ufFIkWy.exe
  C:\Windows\System\ufFIkWy.exe
  2⤵
  PID:9192
- C:\Windows\System\yUrzeDu.exe
  C:\Windows\System\yUrzeDu.exe
  2⤵
  PID:8356
- C:\Windows\System\opGwoVM.exe
  C:\Windows\System\opGwoVM.exe
  2⤵
  PID:12040
- C:\Windows\System\CbpyUSW.exe
  C:\Windows\System\CbpyUSW.exe
  2⤵
  PID:9824
- C:\Windows\System\RuMNsSi.exe
  C:\Windows\System\RuMNsSi.exe
  2⤵
  PID:10564
- C:\Windows\System\fDXhVAM.exe
  C:\Windows\System\fDXhVAM.exe
  2⤵
  PID:8780
- C:\Windows\System\OoLUUhs.exe
  C:\Windows\System\OoLUUhs.exe
  2⤵
  PID:6952
- C:\Windows\System\IDTGaqa.exe
  C:\Windows\System\IDTGaqa.exe
  2⤵
  PID:13036
- C:\Windows\System\vGFrTwL.exe
  C:\Windows\System\vGFrTwL.exe
  2⤵
  PID:11852
- C:\Windows\System\LqjftTT.exe
  C:\Windows\System\LqjftTT.exe
  2⤵
  PID:3016
- C:\Windows\System\NJiSTlg.exe
  C:\Windows\System\NJiSTlg.exe
  2⤵
  PID:11304
- C:\Windows\System\GkIZdAA.exe
  C:\Windows\System\GkIZdAA.exe
  2⤵
  PID:7272
- C:\Windows\System\dnMigrF.exe
  C:\Windows\System\dnMigrF.exe
  2⤵
  PID:8728
- C:\Windows\System\DiETYui.exe
  C:\Windows\System\DiETYui.exe
  2⤵
  PID:10808
- C:\Windows\System\LjvwoME.exe
  C:\Windows\System\LjvwoME.exe
  2⤵
  PID:5004
- C:\Windows\System\ZHMoFME.exe
  C:\Windows\System\ZHMoFME.exe
  2⤵
  PID:12072
- C:\Windows\System\DXvofrS.exe
  C:\Windows\System\DXvofrS.exe
  2⤵
  PID:9496
- C:\Windows\System\DcFGEDW.exe
  C:\Windows\System\DcFGEDW.exe
  2⤵
  PID:8940
- C:\Windows\System\JHWdmaP.exe
  C:\Windows\System\JHWdmaP.exe
  2⤵
  PID:12264
- C:\Windows\System\iQSMNOj.exe
  C:\Windows\System\iQSMNOj.exe
  2⤵
  PID:9116
- C:\Windows\System\CfBiRNC.exe
  C:\Windows\System\CfBiRNC.exe
  2⤵
  PID:9676
- C:\Windows\System\GmINLaC.exe
  C:\Windows\System\GmINLaC.exe
  2⤵
  PID:6720
- C:\Windows\System\ggpoexT.exe
  C:\Windows\System\ggpoexT.exe
  2⤵
  PID:11400
- C:\Windows\System\svujOOh.exe
  C:\Windows\System\svujOOh.exe
  2⤵
  PID:13252
- C:\Windows\System\ITYZxBE.exe
  C:\Windows\System\ITYZxBE.exe
  2⤵
  PID:8528
- C:\Windows\System\qFTHJHP.exe
  C:\Windows\System\qFTHJHP.exe
  2⤵
  PID:9716
- C:\Windows\System\UKcpjJl.exe
  C:\Windows\System\UKcpjJl.exe
  2⤵
  PID:9288
- C:\Windows\System\BpkyuZp.exe
  C:\Windows\System\BpkyuZp.exe
  2⤵
  PID:9764
- C:\Windows\System\ktueRpp.exe
  C:\Windows\System\ktueRpp.exe
  2⤵
  PID:12012
- C:\Windows\System\nPXEVPV.exe
  C:\Windows\System\nPXEVPV.exe
  2⤵
  PID:10360
- C:\Windows\System\yYZyZSL.exe
  C:\Windows\System\yYZyZSL.exe
  2⤵
  PID:14016
- C:\Windows\System\wkXzXKk.exe
  C:\Windows\System\wkXzXKk.exe
  2⤵
  PID:14068
- C:\Windows\System\vNXOBae.exe
  C:\Windows\System\vNXOBae.exe
  2⤵
  PID:14084
- C:\Windows\System\CBKfgby.exe
  C:\Windows\System\CBKfgby.exe
  2⤵
  PID:8784
- C:\Windows\System\PUGZbfV.exe
  C:\Windows\System\PUGZbfV.exe
  2⤵
  PID:10792
- C:\Windows\System\hYhkghD.exe
  C:\Windows\System\hYhkghD.exe
  2⤵
  PID:14080
- C:\Windows\System\bAtfDKE.exe
  C:\Windows\System\bAtfDKE.exe
  2⤵
  PID:2184
- C:\Windows\System\HVQckFb.exe
  C:\Windows\System\HVQckFb.exe
  2⤵
  PID:12488
- C:\Windows\System\ZCdIUYP.exe
  C:\Windows\System\ZCdIUYP.exe
  2⤵
  PID:6548
- C:\Windows\System\XgUfzCG.exe
  C:\Windows\System\XgUfzCG.exe
  2⤵
  PID:7372
- C:\Windows\System\KrHqbYW.exe
  C:\Windows\System\KrHqbYW.exe
  2⤵
  PID:3540
- C:\Windows\System\TBQncsY.exe
  C:\Windows\System\TBQncsY.exe
  2⤵
  PID:4396
- C:\Windows\System\fXIqGSv.exe
  C:\Windows\System\fXIqGSv.exe
  2⤵
  PID:13988
- C:\Windows\System\fArquwz.exe
  C:\Windows\System\fArquwz.exe
  2⤵
  PID:2008
- C:\Windows\System\DZtOfDA.exe
  C:\Windows\System\DZtOfDA.exe
  2⤵
  PID:9924
- C:\Windows\System\NdIVCkl.exe
  C:\Windows\System\NdIVCkl.exe
  2⤵
  PID:12676
- C:\Windows\System\XqahPOb.exe
  C:\Windows\System\XqahPOb.exe
  2⤵
  PID:5972
- C:\Windows\System\qhEDWFV.exe
  C:\Windows\System\qhEDWFV.exe
  2⤵
  PID:12984
- C:\Windows\System\fVFgHKY.exe
  C:\Windows\System\fVFgHKY.exe
  2⤵
  PID:11148
- C:\Windows\System\aRkKtXg.exe
  C:\Windows\System\aRkKtXg.exe
  2⤵
  PID:12252
- C:\Windows\System\SSADwjY.exe
  C:\Windows\System\SSADwjY.exe
  2⤵
  PID:2072
- C:\Windows\System\fmiCrey.exe
  C:\Windows\System\fmiCrey.exe
  2⤵
  PID:11232
- C:\Windows\System\cwVjhLK.exe
  C:\Windows\System\cwVjhLK.exe
  2⤵
  PID:9344
- C:\Windows\System\cSaHYYa.exe
  C:\Windows\System\cSaHYYa.exe
  2⤵
  PID:10464
- C:\Windows\System\vTFDSgq.exe
  C:\Windows\System\vTFDSgq.exe
  2⤵
  PID:14328
- C:\Windows\System\fXgxGpJ.exe
  C:\Windows\System\fXgxGpJ.exe
  2⤵
  PID:5812
- C:\Windows\System\PCneZPe.exe
  C:\Windows\System\PCneZPe.exe
  2⤵
  PID:5816
- C:\Windows\System\sqILCdq.exe
  C:\Windows\System\sqILCdq.exe
  2⤵
  PID:11740
- C:\Windows\System\sffAgzM.exe
  C:\Windows\System\sffAgzM.exe
  2⤵
  PID:6028
- C:\Windows\System\zTBNJLJ.exe
  C:\Windows\System\zTBNJLJ.exe
  2⤵
  PID:13548
- C:\Windows\System\NaCFHbx.exe
  C:\Windows\System\NaCFHbx.exe
  2⤵
  PID:8980
- C:\Windows\System\dQmdWim.exe
  C:\Windows\System\dQmdWim.exe
  2⤵
  PID:12948
- C:\Windows\System\kYSHKgL.exe
  C:\Windows\System\kYSHKgL.exe
  2⤵
  PID:6396
- C:\Windows\System\cICJMPG.exe
  C:\Windows\System\cICJMPG.exe
  2⤵
  PID:3048
- C:\Windows\System\LXDGFwo.exe
  C:\Windows\System\LXDGFwo.exe
  2⤵
  PID:14312
- C:\Windows\System\zwkBHpl.exe
  C:\Windows\System\zwkBHpl.exe
  2⤵
  PID:14232
- C:\Windows\System\ivtwXnR.exe
  C:\Windows\System\ivtwXnR.exe
  2⤵
  PID:11236
- C:\Windows\System\oxGwLHN.exe
  C:\Windows\System\oxGwLHN.exe
  2⤵
  PID:6640
- C:\Windows\System\ytjFlXn.exe
  C:\Windows\System\ytjFlXn.exe
  2⤵
  PID:10604
- C:\Windows\System\KKXoKHJ.exe
  C:\Windows\System\KKXoKHJ.exe
  2⤵
  PID:8240
- C:\Windows\System\XVVqrit.exe
  C:\Windows\System\XVVqrit.exe
  2⤵
  PID:9236
- C:\Windows\System\CxazGbB.exe
  C:\Windows\System\CxazGbB.exe
  2⤵
  PID:6260
- C:\Windows\System\JJXREFY.exe
  C:\Windows\System\JJXREFY.exe
  2⤵
  PID:10712
- C:\Windows\System\OvdXHyJ.exe
  C:\Windows\System\OvdXHyJ.exe
  2⤵
  PID:8068
- C:\Windows\System\sMQPokJ.exe
  C:\Windows\System\sMQPokJ.exe
  2⤵
  PID:11152
- C:\Windows\System\TRgLqAD.exe
  C:\Windows\System\TRgLqAD.exe
  2⤵
  PID:10552
- C:\Windows\System\nuBGaAj.exe
  C:\Windows\System\nuBGaAj.exe
  2⤵
  PID:12064
- C:\Windows\System\CfATCeO.exe
  C:\Windows\System\CfATCeO.exe
  2⤵
  PID:10796
- C:\Windows\System\sCdclef.exe
  C:\Windows\System\sCdclef.exe
  2⤵
  PID:13656
- C:\Windows\System\ScHwTZB.exe
  C:\Windows\System\ScHwTZB.exe
  2⤵
  PID:2984
- C:\Windows\System\gRLBkGv.exe
  C:\Windows\System\gRLBkGv.exe
  2⤵
  PID:10488
- C:\Windows\System\zHJAUWE.exe
  C:\Windows\System\zHJAUWE.exe
  2⤵
  PID:10940
- C:\Windows\System\KcvjdJa.exe
  C:\Windows\System\KcvjdJa.exe
  2⤵
  PID:12608
- C:\Windows\System\LWxguzA.exe
  C:\Windows\System\LWxguzA.exe
  2⤵
  PID:12472
- C:\Windows\System\pdhfRNJ.exe
  C:\Windows\System\pdhfRNJ.exe
  2⤵
  PID:12736
- C:\Windows\System\fPJJLFy.exe
  C:\Windows\System\fPJJLFy.exe
  2⤵
  PID:1520
- C:\Windows\System\OlUczRZ.exe
  C:\Windows\System\OlUczRZ.exe
  2⤵
  PID:10168
- C:\Windows\System\nhbqyzG.exe
  C:\Windows\System\nhbqyzG.exe
  2⤵
  PID:11924
- C:\Windows\System\jsaYLjB.exe
  C:\Windows\System\jsaYLjB.exe
  2⤵
  PID:10080
- C:\Windows\System\nLCaSxr.exe
  C:\Windows\System\nLCaSxr.exe
  2⤵
  PID:12880
- C:\Windows\System\EkDjukE.exe
  C:\Windows\System\EkDjukE.exe
  2⤵
  PID:10152
- C:\Windows\System\SkaksJA.exe
  C:\Windows\System\SkaksJA.exe
  2⤵
  PID:4596
- C:\Windows\System\OQWojRu.exe
  C:\Windows\System\OQWojRu.exe
  2⤵
  PID:6764
- C:\Windows\System\fVjQUze.exe
  C:\Windows\System\fVjQUze.exe
  2⤵
  PID:4608
- C:\Windows\System\JlrHjln.exe
  C:\Windows\System\JlrHjln.exe
  2⤵
  PID:6024
- C:\Windows\System\mWSLLmN.exe
  C:\Windows\System\mWSLLmN.exe
  2⤵
  PID:11020
- C:\Windows\System\NaACjPU.exe
  C:\Windows\System\NaACjPU.exe
  2⤵
  PID:6032
- C:\Windows\System\QzmLnYp.exe
  C:\Windows\System\QzmLnYp.exe
  2⤵
  PID:11208
- C:\Windows\System\kacznCF.exe
  C:\Windows\System\kacznCF.exe
  2⤵
  PID:12448
- C:\Windows\System\mdYxbfE.exe
  C:\Windows\System\mdYxbfE.exe
  2⤵
  PID:4792
- C:\Windows\System\bnKAhFw.exe
  C:\Windows\System\bnKAhFw.exe
  2⤵
  PID:11216
- C:\Windows\System\YywagQW.exe
  C:\Windows\System\YywagQW.exe
  2⤵
  PID:7304
- C:\Windows\System\fZKkBQJ.exe
  C:\Windows\System\fZKkBQJ.exe
  2⤵
  PID:13000
- C:\Windows\System\IYWzNji.exe
  C:\Windows\System\IYWzNji.exe
  2⤵
  PID:13296
- C:\Windows\System\LViQYVl.exe
  C:\Windows\System\LViQYVl.exe
  2⤵
  PID:11976
- C:\Windows\System\sLvrREl.exe
  C:\Windows\System\sLvrREl.exe
  2⤵
  PID:13876
- C:\Windows\System\zZmfpUl.exe
  C:\Windows\System\zZmfpUl.exe
  2⤵
  PID:8828
- C:\Windows\System\lbiqOaW.exe
  C:\Windows\System\lbiqOaW.exe
  2⤵
  PID:13916
- C:\Windows\System\uerwYnQ.exe
  C:\Windows\System\uerwYnQ.exe
  2⤵
  PID:7012
- C:\Windows\System\cTOmUqV.exe
  C:\Windows\System\cTOmUqV.exe
  2⤵
  PID:13004
- C:\Windows\System\jcmxAkB.exe
  C:\Windows\System\jcmxAkB.exe
  2⤵
  PID:14308
- C:\Windows\System\rLJcVbF.exe
  C:\Windows\System\rLJcVbF.exe
  2⤵
  PID:8180
- C:\Windows\System\pQxAJrm.exe
  C:\Windows\System\pQxAJrm.exe
  2⤵
  PID:5164
- C:\Windows\System\vFnqTom.exe
  C:\Windows\System\vFnqTom.exe
  2⤵
  PID:7552
- C:\Windows\System\jUsDcEi.exe
  C:\Windows\System\jUsDcEi.exe
  2⤵
  PID:13596
- C:\Windows\System\uYqSlnV.exe
  C:\Windows\System\uYqSlnV.exe
  2⤵
  PID:440
- C:\Windows\System\PWsmFso.exe
  C:\Windows\System\PWsmFso.exe
  2⤵
  PID:12220
- C:\Windows\System\LJTWzTq.exe
  C:\Windows\System\LJTWzTq.exe
  2⤵
  PID:13208
- C:\Windows\System\SFTJFWE.exe
  C:\Windows\System\SFTJFWE.exe
  2⤵
  PID:12396
- C:\Windows\System\fTGbBgg.exe
  C:\Windows\System\fTGbBgg.exe
  2⤵
  PID:11172
- C:\Windows\System\ITygThx.exe
  C:\Windows\System\ITygThx.exe
  2⤵
  PID:6516
- C:\Windows\System\fkVvDso.exe
  C:\Windows\System\fkVvDso.exe
  2⤵
  PID:12988
- C:\Windows\System\qHLNJqk.exe
  C:\Windows\System\qHLNJqk.exe
  2⤵
  PID:10628
- C:\Windows\System\BszYQpT.exe
  C:\Windows\System\BszYQpT.exe
  2⤵
  PID:5888
- C:\Windows\System\McLShmU.exe
  C:\Windows\System\McLShmU.exe
  2⤵
  PID:10272
- C:\Windows\System\QqAquUy.exe
  C:\Windows\System\QqAquUy.exe
  2⤵
  PID:6120
- C:\Windows\System\dlOofTm.exe
  C:\Windows\System\dlOofTm.exe
  2⤵
  PID:10452
- C:\Windows\System\tVsFFKM.exe
  C:\Windows\System\tVsFFKM.exe
  2⤵
  PID:6944
- C:\Windows\System\qkkKqvH.exe
  C:\Windows\System\qkkKqvH.exe
  2⤵
  PID:8520
- C:\Windows\System\zIgVDNx.exe
  C:\Windows\System\zIgVDNx.exe
  2⤵
  PID:1604
- C:\Windows\System\XGZnSDm.exe
  C:\Windows\System\XGZnSDm.exe
  2⤵
  PID:3768
- C:\Windows\System\zRlNWwY.exe
  C:\Windows\System\zRlNWwY.exe
  2⤵
  PID:10436
- C:\Windows\System\gyULUwf.exe
  C:\Windows\System\gyULUwf.exe
  2⤵
  PID:11412
- C:\Windows\System\gPLSSkc.exe
  C:\Windows\System\gPLSSkc.exe
  2⤵
  PID:8744
- C:\Windows\System\ZCnRtnX.exe
  C:\Windows\System\ZCnRtnX.exe
  2⤵
  PID:13816
- C:\Windows\System\lJWcxZR.exe
  C:\Windows\System\lJWcxZR.exe
  2⤵
  PID:7480
- C:\Windows\System\zVbJiWf.exe
  C:\Windows\System\zVbJiWf.exe
  2⤵
  PID:13400
- C:\Windows\System\HRDZlRz.exe
  C:\Windows\System\HRDZlRz.exe
  2⤵
  PID:6804
- C:\Windows\System\BdObAJb.exe
  C:\Windows\System\BdObAJb.exe
  2⤵
  PID:9112
- C:\Windows\System\PlDdWRy.exe
  C:\Windows\System\PlDdWRy.exe
  2⤵
  PID:10388
- C:\Windows\System\jhyyVAE.exe
  C:\Windows\System\jhyyVAE.exe
  2⤵
  PID:12260
- C:\Windows\System\eQbEbiQ.exe
  C:\Windows\System\eQbEbiQ.exe
  2⤵
  PID:6040
- C:\Windows\System\nnnIegK.exe
  C:\Windows\System\nnnIegK.exe
  2⤵
  PID:4236
- C:\Windows\System\KvfragH.exe
  C:\Windows\System\KvfragH.exe
  2⤵
  PID:11128
- C:\Windows\System\EvrAJXB.exe
  C:\Windows\System\EvrAJXB.exe
  2⤵
  PID:9556
- C:\Windows\System\QYJfVQn.exe
  C:\Windows\System\QYJfVQn.exe
  2⤵
  PID:6496
- C:\Windows\System\WSsAiLt.exe
  C:\Windows\System\WSsAiLt.exe
  2⤵
  PID:10892
- C:\Windows\System\mAcmzeA.exe
  C:\Windows\System\mAcmzeA.exe
  2⤵
  PID:10480
- C:\Windows\System\IzpQTtP.exe
  C:\Windows\System\IzpQTtP.exe
  2⤵
  PID:13384
- C:\Windows\System\NKZeODR.exe
  C:\Windows\System\NKZeODR.exe
  2⤵
  PID:6092
- C:\Windows\System\ciRZIBx.exe
  C:\Windows\System\ciRZIBx.exe
  2⤵
  PID:9956
- C:\Windows\System\EAEITpq.exe
  C:\Windows\System\EAEITpq.exe
  2⤵
  PID:3548
- C:\Windows\System\rhBFnQv.exe
  C:\Windows\System\rhBFnQv.exe
  2⤵
  PID:11664
- C:\Windows\System\CXeejWJ.exe
  C:\Windows\System\CXeejWJ.exe
  2⤵
  PID:12852
- C:\Windows\System\FOPjeSR.exe
  C:\Windows\System\FOPjeSR.exe
  2⤵
  PID:7336
- C:\Windows\System\RvGOiHD.exe
  C:\Windows\System\RvGOiHD.exe
  2⤵
  PID:14236
- C:\Windows\System\HAGMDct.exe
  C:\Windows\System\HAGMDct.exe
  2⤵
  PID:684
- C:\Windows\System\mggYoKu.exe
  C:\Windows\System\mggYoKu.exe
  2⤵
  PID:13144
- C:\Windows\System\mhJVtzd.exe
  C:\Windows\System\mhJVtzd.exe
  2⤵
  PID:8304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2eovb1gg.qb0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AfirUUV.exe

Filesize
1.1MB

MD5
872841bd675cf7cdc2c78fcceba4bcf1

SHA1
279547d5272f71d72bc80d097fd68e9632cc1a96

SHA256
84bb4811f1f0c58ebb11e8425c46ee42c58c2570780452149e72549547e9b193

SHA512
3f84ed24ee9d46227dca2a058b68b526d03d9abdd99afead82765ea25e3b568e6cc059f12a028b55b739f052491ea5edc296b5de2c7b66222c00f1d14bd29c93

Download Submit
C:\Windows\System\BCncyuC.exe

Filesize
1.1MB

MD5
f6b629b568dc04f3caf938fd7c234842

SHA1
047f82366653b4931758a713bc5cb023cb1c89e5

SHA256
5a0342154a2d60250c89873dc3fb278e62eaebb8c7fbb026dd0d2d6ecbf2ab2b

SHA512
18c04f9fd04bc3aad0bcaafb611a1fd4c5e7a601c14124ff4e8cd2035d3756477f99d8f21b420fad1c12d0fc84825801ea65e648d41042a21c67feadf0ea4b9d

Download Submit
C:\Windows\System\BXZowJk.exe

Filesize
1.1MB

MD5
75020472560290cb9729412b1a133c85

SHA1
26d6c07292d0306ad9eec13f5afcbf4137b017c3

SHA256
51dd512b247b0eac4121d84ce66a579a27b03c17e6cf7dbbc1a655e726684725

SHA512
4bcdc502dd228ec426bead6c09618c659b66cce9c89e043cd1ca941ac6f75c55ba240f43ae5423a93ee9b94feeafd4334ed313cd71f42cd1ff71aa13792697cb

Download Submit
C:\Windows\System\CDDfoVq.exe

Filesize
1.1MB

MD5
dc9f4f50481440234b026ac5e91dd2ca

SHA1
e938d6668a2e8dadabae829c54512e7a9be97d4f

SHA256
6366403e6bab535e0e125c548d8f4074106d1da20ad12509f380e3425378999f

SHA512
c749df5ac6bc1077aedb0696f4c05982e2f5ef9f0e245bfa84255a3e69bf409fb4aef21319c05c617af7f3a4c43cd856abe4f1d113a29b7ffd416a2d962b87bb

Download Submit
C:\Windows\System\DyCIGhq.exe

Filesize
1.1MB

MD5
6a9c487fb5f8ded3c4834f48a368dc67

SHA1
90510398923fcaa34b8f76eb07477e6d0deef0cb

SHA256
5a9b95937b4954a1cc11f1ccaa34b028a4075b40000a99a7c65b6556078e2410

SHA512
d768b4c4aab3a8b444929c5d6cad3d8a959a93410971897caab346a665ab51774fe16a8fd4878d8aaca37011765e9d3534b32145aa40aaff2110bc5d0c9f93dc

Download Submit
C:\Windows\System\EeTJTgh.exe

Filesize
1.1MB

MD5
516e182d62f89e68cfddf24e98477aa2

SHA1
c325db530c9607e128ffbec33704fbe4ba615d3c

SHA256
19aa72ac8736423b72131d054055237df0c3e86ce6f211790acf01f66691dd20

SHA512
99513c5b118e0d434a508d80f67fefb53508e096ec8854a03a17ec07a510991a979a0026bb72e0fe4a86d80c12ab4ae0df61c06baa292509a9a4ddea2c8ad0ce

Download Submit
C:\Windows\System\FAXsPOY.exe

Filesize
1.1MB

MD5
dcf331324fb0e054eba67b0e6cd3cd47

SHA1
45f16d6b33896e1d933b1f22d4aa22949d0a3ec5

SHA256
ca438a311daf9bf717f81ff14d0026c87ce66050db652948f747a29e674560fa

SHA512
f1ef6434f79a7064f1a316202d5a34d9dd0b1a55d4dd598f54f313b00e46d13628e93b336cde2dcf13be8ead40570b2ddbd5a10810f00134150bdba325fab36b

Download Submit
C:\Windows\System\FYerkXF.exe

Filesize
1.1MB

MD5
9a6c50d25e1f37bb647ca5a2c31dc5e6

SHA1
7d1cdf10a8855d2f7dc680333f57e5672411598e

SHA256
65c03cc1eb41c09b37393fe5b9bd95564c0795c63b9674a96dd05e7ce1c79d2e

SHA512
b063a4a32a411053d44439c5f7b59e91b27d18709b9a5acf2e4912be7ab66a2e4fdc512362fa379f7b076dac5d938e819460efc0060c006997eee8f8e4c5cfdc

Download Submit
C:\Windows\System\IrQJczH.exe

Filesize
1.1MB

MD5
90c827808538bb39311291f9459bcdd5

SHA1
bacb7d8124ad060e1b786ae6b52e1cec237bc5f3

SHA256
48fd7e86cc48ca9e14196cce1141045d7a212b7615b7ab36a3c4a2b50e927a68

SHA512
ab7db9bfcceb7c48490e4cbe284783f7b6e5ded9f41624ee4cfa9f81d1cca3d2b8cd883e5805d98e1df042a9920555600e962bd710e2dc3b0c4d5b735120539c

Download Submit
C:\Windows\System\NNwwjuT.exe

Filesize
1.1MB

MD5
6c8e773f9d1e61a0f479347954c95d6f

SHA1
0b8f621804a090581a25f76a8390bab59291de97

SHA256
31d62bdefddac1a879b39bd158e9786665a001c3703b2f376b3663d312a807d9

SHA512
27c7a53cac97ee8bfa649624ff335944a303eaab02505a0128fb25559dc29529da27f55a408b328649854a8fd357c237905a38cf15ab16ba9480693dc210db1f

Download Submit
C:\Windows\System\PciGUQI.exe

Filesize
1.1MB

MD5
a73c8d4717363c78d1cad968fe9264bb

SHA1
b11b66df60f04038b15ac08e0ae7ccc477c2066b

SHA256
cb202ee966caaf76456f799e2cd06dd38be85868ef624bad2e4730443439a3aa

SHA512
a130ebcef06cbabd85006cdf97c3499cfd9ec9c819aa306c8eb7fe04e44055c3a3c7657dafc3498b633e005edf3179b5c802379ea9b3c8d27c995cf2767bb78b

Download Submit
C:\Windows\System\QlQUuke.exe

Filesize
1.1MB

MD5
35866c43488eafe821a4b4eb8f17a4d3

SHA1
e3c8938692bddf86531c4bbd669010b3c3e72ec5

SHA256
7845bac375bd507e97e663191faa8cc969147a73434e2694a7bf058349ffc7e0

SHA512
cae59069e62928b91fe3991ce5b8d4b9e13e251d7ed540540320d88d7e2d97b8beb6ec696fb95f7aff6b12cc03c39968a94f67dbe93ab2c2bb76fc260c565aad

Download Submit
C:\Windows\System\TBeMisT.exe

Filesize
1.1MB

MD5
c349d4651507c881cdbec06e40ffd9eb

SHA1
682060add6c478690579a88d40728c885d80a44b

SHA256
0dd421a9fa0284817099a3bb281869ff1926e3c4861344d748440a5dd97e3fff

SHA512
ca5cf6ae89fed96debdbb4fe689010ffc7e3362046dfa82e37a1b8221b5ef9b38bad745ae01a5145c3744c08bed08dd0df929463fbe97bb899ef2ba8836d5ab4

Download Submit
C:\Windows\System\TxwitPm.exe

Filesize
1.1MB

MD5
ae2ffa8bde7698ed1f492a39047fdc0d

SHA1
44f7f3f6cabdca07c6d9c048e096dd04d48b78ca

SHA256
8f9f50c0a09222f3d5a9f8412f889dc3a400ec1dd8ce3a6096d5dbb6c5395857

SHA512
2ebc2c96c8795c5425f2635c8e6f258659d5621234e7d456f2b0c5a8ca669f015522c2c4f5ee400e82842fa35cb63bce66918d5e66c83b99d9b4717ba8583eb0

Download Submit
C:\Windows\System\WBONyim.exe

Filesize
1.1MB

MD5
ae49d7662b757cbca112502b509d0b63

SHA1
584fb9d56235f6e463ae8f044a9eeffcc86ae3d1

SHA256
b52d1c6274db864b24d648f7fead8c34f9cb31116e547181610e3da87dc97953

SHA512
7519e39b8c4a0eb1bf4492dec88466fddf7d2726fffdb5e07111db99fc6237b00e8e1375965d7d6657064a8be976a7350addaa11d832454cf1e2a406d38e9945

Download Submit
C:\Windows\System\XWbxzKI.exe

Filesize
1.1MB

MD5
e6a27e0884c22cde291e917fb615b0aa

SHA1
0c49113789560dca5a5c10676fb1495eceaea3e8

SHA256
c467283f64d21f989412e95a3ef6fb9ec1b08a3d31bd9f9cb00ba0ae42f64387

SHA512
8e5172747d1c4f7ebe6bf11b9c323f172516df146b1ab874ba636f55e7baf7fe9b550e2bd195e40f246e64df2c937a09d7eabbc37e10c904c665a329de0181fc

Download Submit
C:\Windows\System\XtoPOzV.exe

Filesize
1.1MB

MD5
2c9c32e46482690d53872a8ea4a67b9c

SHA1
6657b560394b98e3927e57a27594facd8790ca51

SHA256
20c6cbab3dce26e0e36ed48fd33e43c3de55f34fa163b721a9d8396d3f5806d3

SHA512
3c4d707a9025e6492d01258a3d771340ff2907a20e7c009fe6873c70c825282114e249f1a28dfbcdb54db85d6184e75a7acb8a6af55a3f2602e74f093e9e3a3d

Download Submit
C:\Windows\System\YVpKUlw.exe

Filesize
1.1MB

MD5
ee31642177cdcd9bcb0ebc6fe9507166

SHA1
591ba2f85aa89e6712ed364ab65edcf0eb7b5a4a

SHA256
a9e0914d4e771bab89d72be24a03da80b8ff2049b54d87cc10c977a3a66a9bb5

SHA512
15e2e2098c4a5601888a8916fe260eb19322790c7d1c4b2032527a59c5959515811c9c170ccb97af2ad8b39b5ef50d10a1d5d021badf1b7c80f02b22a4108394

Download Submit
C:\Windows\System\bHKnkFq.exe

Filesize
1.1MB

MD5
8783097849b415aa529b09f1abddf168

SHA1
e30f34edec0c0a778f803a3b700ae9f255c2b2e8

SHA256
3770f19916c1bcc206b8088101a63ceaf444e902ca78bcbaf3085104d9ead298

SHA512
626d9da2b999004844ea33454097d75a51cebae8547f1548941a193ccd707a8a644469e79cdb19574e57440721896883270e974b7ccb38ef2c86535f6d661d5d

Download Submit
C:\Windows\System\bMWBvTY.exe

Filesize
1.1MB

MD5
f94a41b228109001edd004d07783b75d

SHA1
59bf98afa23c02c55054a8e727370cfcc885bdb6

SHA256
0530c250b8b8da39d9287a66acdc1aebf98758718527f1bf62074272eee501a1

SHA512
a57bf20d9ef40c56b4e6ddd17302d2c50b27cbd97d945644e53b8c1c7723a5e71ea375ab48e0df4122ce965d9f12992fc6accba652228fc702b6d7a7c49c1d72

Download Submit
C:\Windows\System\bYbrtyK.exe

Filesize
8B

MD5
6fdb1702562aa4eb62c31e7f2e5c85ba

SHA1
458d14d390269da34219976616d41a00503920d9

SHA256
f14547a545ba630311f5cf47701517efa42b7b80bae6f52a4ae13713e909e9bb

SHA512
9c396aa42f4265bde3984ad215250c59f18e0f25acfe458841d318efa09de4fe66561d119b9dbe36debcef7ee7f7506c52d4eff5bcb5d15c5f0fe96c9a74297a

Download Submit
C:\Windows\System\bZPGkNP.exe

Filesize
1.1MB

MD5
679b019f9c14ea0f95b4a7d2c626b85b

SHA1
a5e55a86ca71f4faca6f7cd13a03d378ae48f12e

SHA256
08eea9ed0a4c9d593f19fe45a52f4935d2f4dc3a8376efe166f6077435f9307a

SHA512
ce295fb518057882af61fd5b54110d887d7cb90eef753b0874aa1b24263cb3dfe6a901c989e996a06611ba714088a6e360039dbb9ec35e11c9c536184cfc1355

Download Submit
C:\Windows\System\chdhXsR.exe

Filesize
1.1MB

MD5
cf1ceb9acce546f903283821a736e86f

SHA1
52c754f3598f85dc124d6d750585d60cb69aaf06

SHA256
57e52424a5f39b5ef9f45fafd63d8e97ba1c533f004edc0c1d6404980a52a239

SHA512
658128ea58bb8b00571b44ca8c9654553e25c55c3b685a244545e6a63fd85b5f298196c8dbcdab1a32d612e0e7d007085ce8e75c33d0b7ae089324b2a7bb3119

Download Submit
C:\Windows\System\chxOtgY.exe

Filesize
1.1MB

MD5
905f122a8d2ba6f2427de56e88b4b7ed

SHA1
1a9e31519067d78c3295c789f8664c4e5f06528c

SHA256
4722aa7a8e8258cb4d42209c51d42ad709f48a29f9eb8fdb79856948168a66a1

SHA512
b45c9d3e099167a25336be77bd165559a965d7cd8418234cca02c59228a4c4a0d34c6e66deb9096aafb08bebaebcfaa462e116f126a1785983499b89751323c0

Download Submit
C:\Windows\System\coUZRWJ.exe

Filesize
1.1MB

MD5
db94ceedc8785d090bc8b61eeee2ef74

SHA1
39cf5cf915617fb389c39532a52c54b0bb3f781c

SHA256
cc91fe09aeaaa655874d26b079bc8da38ad51e94a26597c4c33431e78c8dd35e

SHA512
24ef8020bb0ea00ba44b2dd0fe7979a3dce2688063476908dc6f2f17eb30b76f46dd2416d1cd9ec415992aa9160d80d6ae097558c1f4844d8e639b7b300b736f

Download Submit
C:\Windows\System\dlDkyig.exe

Filesize
1.1MB

MD5
e86f687bbe80809f2a1d107053c61e8a

SHA1
b7f5e06b6c0349fb04837c910dd1823978637b51

SHA256
48dd3e6fd681a6e1d069f02ed4d129fad5938fdfa5a555af36035827ce8de847

SHA512
62d59e763f710f74573134a391a5cbe0ad91bd21b11189ba11e992141fb0727cb47e6af16422f266d2f6bb525c2fdb880530448765679a4589f3183e227cc70f

Download Submit
C:\Windows\System\fMTUeHQ.exe

Filesize
1.1MB

MD5
45ce468eb2169705bb8c789f96a58a3a

SHA1
29113fffbbb05f596d56bb22da1015736c1f7f87

SHA256
5dc9951f5ac1318868cfc10ed3074d5a616fce1437190b5f92344b28dbdfb82a

SHA512
d2a2614b7517956ccfa6a96c2c7463f0713249a7eef78401ce1068c4c22aa561d75a34a0f29851a822b2f409da02d279f508020d0e4cb4c414c0895c0103c5a4

Download Submit
C:\Windows\System\fnvIKnJ.exe

Filesize
1.1MB

MD5
dd73a8598f9b6b0d3b19d34004306e96

SHA1
9857a8f5c3a8e02daaf5d5d55b454fac49061803

SHA256
08f3fed0232583ac8243a57a5c7313fde9b0d9fe9618601b7a5f8522ead168f7

SHA512
461175224c49f476c97abc587c38c85f9fd7115a71ebf3346fc49f1d285d8e1b5444a4e9593f731d2344ab48da49918fc202d5c325a2054e643276771c7216e9

Download Submit
C:\Windows\System\gSERumQ.exe

Filesize
1.1MB

MD5
7a6b3b12631e01cb09ceb66b20a314e5

SHA1
0adc1ccb143b39fd677041aba35c8915ceb4938b

SHA256
155b9addfa44024b70b2a7db7e4d41aca888aac6091f2bb80424128a397f43ab

SHA512
dffeebc460b37853470ba7a91358abdf410e0f41b2fa5243ae73964ede8d395ad812dbe9179605f8dd2544b69146a78bdd586b476aef2c26c262ca1ceebdea91

Download Submit
C:\Windows\System\hJxXnhu.exe

Filesize
1.1MB

MD5
e79a8175e6707bc23bb77421d5b48d93

SHA1
c1925a0d25ccf9988919e5e8348902eabc0f68ae

SHA256
c8c8051d97d9420669f7ae7f194e2ec70aab6404678cc21dd43dd955381e10b5

SHA512
f55ef8487d74c2004830a26499d50a77d5e0717a10802e3df9d6b759b61bed64fe3f35a766c6c16a2c7ce08aafa5864475d88368b1cc996bffbf398b397e1ce4

Download Submit
C:\Windows\System\hwkGheo.exe

Filesize
1.1MB

MD5
b225a70c4deda5129d0b45ff865e2f99

SHA1
1ca8f8d4ae20046cf9f55557b822b1c8c785c64a

SHA256
dc0c7782b5e70a53dcd6dbd5811069cdb9e2a6b737e9c1ec9ad0c811c89b3244

SHA512
a973273301a2ebc7f7d87cc0a74ab514bb0c43c83765d63f547f38e96e2dbaa616e944ab4f118b0a39e10f480c6fa76cde85a8cce338fad25a8e06814886ab18

Download Submit
C:\Windows\System\jJaxssX.exe

Filesize
1.1MB

MD5
fb178ad734cd60bd4f7ba3f37e9d5981

SHA1
5065ac37d68237e9a27dea343cdfb982cbe38973

SHA256
390daacb55cadf38bda768ece996bccf21dc47164adf593d0d6bf94cf48960cd

SHA512
78aca74476d5c05a87870fff7eac5c5745007269e21b3322e3d74c74d99abfad900902c0c614e134ae6068733f68825f31401ad0dbbe614dd3e790cbc46a3bf5

Download Submit
C:\Windows\System\jiPVMOB.exe

Filesize
1.1MB

MD5
8163ac2461007f92543fe028b440f10e

SHA1
f56b99e49a29fadcd1941bafcc97b508dd46b0c0

SHA256
381a5c9cb141d002501cc1aa869296266c1f1712bec734e6067413b5518bb450

SHA512
17a1b0635757f73c926bf3949d11990e06f5ae852de1e08fd7391cad78979e75a69b8f90a032959ce68b823afa1b0d012e1888aef391644c3445f599786d0bce

Download Submit
C:\Windows\System\kWuNlqx.exe

Filesize
1.1MB

MD5
88cad4f72158f2a00e9e1fb2714f713e

SHA1
402ddc65ea8aa1695ce8240fbe4baad9add5a8ac

SHA256
0bfc5bbfcdb80905c3a930efa6e08d88b802799cfe9f0f6a81fc1bd52d53f993

SHA512
015765f22e9c46a9accedd747094980e431c82bd579408f03867448a20ebd2170c4ca9f4fb0255e730f7a94a9f2a66fe12a1968f26ed503c99744ccd8705c72a

Download Submit
C:\Windows\System\mTRhjHf.exe

Filesize
1.1MB

MD5
1b99c4008a2f51c2c770148385280172

SHA1
2c143f53dc7d0e35e660011fc650b68f6765ab8a

SHA256
e90d4ebde5e41ad1bdaa89f3feec084ef6ab7ff79afdc190ed8b0b370a05b554

SHA512
67187a84f514d0291f409d961300c94ed64242e8025236b0dfab65b606e35d7707a418a75428f300ddff677f6802c3470aa9198ebf1c969cd2a2b5f135c6cead

Download Submit
C:\Windows\System\nbogcPW.exe

Filesize
1.1MB

MD5
fd88b94e538fd2b718019590af850546

SHA1
10a601e8d869ecc6e7e50207e8fde32be7a07543

SHA256
01aceadf198db21fc78413039de0b23d5e52bfa062f436a9bf3b84c81a7ecd10

SHA512
03cf150c26975bc237010ed18133f04844a8493fa212c1bed3efbda7480dc8954a0627b390da1379cc25c49f2adf5283ef91ffec6c63a0e7fb5e680c671fecd0

Download Submit
C:\Windows\System\piqFedE.exe

Filesize
1.1MB

MD5
83d017187cce1e8a5d72c8c1a1f30cc2

SHA1
a167e39981efb5d21e68eabe2544934b85606c28

SHA256
1288837e929632dff6ee2652abb80142f82c12203a95fddb2cd9e76c360ce67b

SHA512
098f1ecfbb1610a4d290e16d0af7d307d036e77c8763733fe2b88480bff60baa4f73d73ccf37d65468b4e590933552cd3e2eb27b3937f75426cd3fa1cd3fff96

Download Submit
C:\Windows\System\tDTBAxU.exe

Filesize
1.1MB

MD5
56115cc2ca59683f3b334e2056116b0b

SHA1
0903999e9875e445d197296bc75faf227e1374e3

SHA256
88b6a993bfbf7f2361ec0a4acadd048416108326012d9c5eae67050e60b304ea

SHA512
fff8fc7f96f7a592192c317d53d4c614c07e0f455e81e936e464cecd06facecf8894d8a47486276d7d79fc05a862f2c8c2589e67348c13cfaec024ab84c5197e

Download Submit
C:\Windows\System\thNprLr.exe

Filesize
1.1MB

MD5
f5c3d6c81cbb3e22da9f5ee665e2088d

SHA1
45b4d77d81b62af26a679615f43d858c9d357b14

SHA256
20f3ede8924408b4299494dcbe86fc4a881a7c0c23762b3c44b6b9fbfd016079

SHA512
de333db48591c743c9b2818e537566fc2c2a05fd9b26f84c558003d84386ce1be817d595b0fe6ab345f0b6da0b9fd62e33d5071ddc5096cdeaec2a522c57e2a5

Download Submit
C:\Windows\System\uegbPyL.exe

Filesize
1.1MB

MD5
c392113cbf4e4d912e3d620b3dcfbe06

SHA1
6becad26e6c4c55ff66b0aa41bb1feb8b54e937e

SHA256
703cc6d9ef6f395f668d54d506290f2e17754204db9fa7f0d4265834edfe78ee

SHA512
98be929393b0c1dfe331d9599f7b64c7964d6c62e1309bf53139de2243c0d9816445f1340367071384d15acba9670b498eb409034c82ca725f6ca0ea01d374d5

Download Submit
C:\Windows\System\vKpWYpy.exe

Filesize
1.1MB

MD5
34c63bc007c7482bd88c0093071c1b76

SHA1
e4e698f64a7bb9c57964eb6270b1e8b887890b39

SHA256
27880b01cc849eb6738f0da2ec4bf1d73448ec0e56469544a38fd767070241f1

SHA512
6800066029ce75d589a0b44cbe55e767553fe53edc4ec6f242d72c7b3993aacfb7982b38c43dd7cdb68a1e33e7fbd64863692fa59dfa236d48307ac2d792a819

Download Submit
C:\Windows\System\xyyrCvv.exe

Filesize
1.1MB

MD5
675b213b0726bb4d78eb698e3650c8e1

SHA1
b7feddc7251b52cca2a6bf1ac34b8def98c9f5ab

SHA256
396abd213051661f7896afd2bd8142ab8b20260567e0ca9031f7140d3ed44d15

SHA512
e58633091dd670476a55e8135289044aa43e0df23d4055e5aa1ad9e439c26e7fb3f0d2d1e8a5f843360541bc7f29cae4fcbeeacc507427a3334ebbc4ad444591

Download Submit
memory/324-2130-0x00007FF782CC0000-0x00007FF7830B2000-memory.dmp

Filesize
3.9MB

Download
memory/324-5005-0x00007FF782CC0000-0x00007FF7830B2000-memory.dmp

Filesize
3.9MB

Download
memory/400-24-0x00007FF797350000-0x00007FF797742000-memory.dmp

Filesize
3.9MB

Download
memory/660-4971-0x00007FF6960E0000-0x00007FF6964D2000-memory.dmp

Filesize
3.9MB

Download
memory/660-908-0x00007FF6960E0000-0x00007FF6964D2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-4993-0x00007FF6ED8B0000-0x00007FF6EDCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-905-0x00007FF6ED8B0000-0x00007FF6EDCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1208-1972-0x00007FF6C3A90000-0x00007FF6C3E82000-memory.dmp

Filesize
3.9MB

Download
memory/1208-5010-0x00007FF6C3A90000-0x00007FF6C3E82000-memory.dmp

Filesize
3.9MB

Download
memory/1244-1959-0x00007FF82EA50000-0x00007FF82F511000-memory.dmp

Filesize
10.8MB

Download
memory/1244-156-0x00007FF82EA50000-0x00007FF82F511000-memory.dmp

Filesize
10.8MB

Download
memory/1244-26-0x00007FF82EA53000-0x00007FF82EA55000-memory.dmp

Filesize
8KB

Download
memory/1244-407-0x00007FF82EA50000-0x00007FF82F511000-memory.dmp

Filesize
10.8MB

Download
memory/1244-275-0x0000015CB85D0000-0x0000015CB85F2000-memory.dmp

Filesize
136KB

Download
memory/1620-1208-0x00007FF626A10000-0x00007FF626E02000-memory.dmp

Filesize
3.9MB

Download
memory/1620-5012-0x00007FF626A10000-0x00007FF626E02000-memory.dmp

Filesize
3.9MB

Download
memory/1736-720-0x00007FF682CE0000-0x00007FF6830D2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-4972-0x00007FF682CE0000-0x00007FF6830D2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-2066-0x00007FF6CF2F0000-0x00007FF6CF6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-814-0x00007FF692150000-0x00007FF692542000-memory.dmp

Filesize
3.9MB

Download
memory/2588-4978-0x00007FF78C9D0000-0x00007FF78CDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-902-0x00007FF78C9D0000-0x00007FF78CDC2000-memory.dmp

Filesize
3.9MB

Download
memory/3112-4974-0x00007FF7EB870000-0x00007FF7EBC62000-memory.dmp

Filesize
3.9MB

Download
memory/3112-1004-0x00007FF7EB870000-0x00007FF7EBC62000-memory.dmp

Filesize
3.9MB

Download
memory/3200-2069-0x00007FF7BE720000-0x00007FF7BEB12000-memory.dmp

Filesize
3.9MB

Download
memory/3200-5008-0x00007FF7BE720000-0x00007FF7BEB12000-memory.dmp

Filesize
3.9MB

Download
memory/3292-1007-0x00007FF74B7C0000-0x00007FF74BBB2000-memory.dmp

Filesize
3.9MB

Download
memory/3292-4980-0x00007FF74B7C0000-0x00007FF74BBB2000-memory.dmp

Filesize
3.9MB

Download
memory/3340-261-0x00007FF646C30000-0x00007FF647022000-memory.dmp

Filesize
3.9MB

Download
memory/3460-1-0x0000012D9DEB0000-0x0000012D9DEC0000-memory.dmp

Filesize
64KB

Download
memory/3460-0-0x00007FF744D30000-0x00007FF745122000-memory.dmp

Filesize
3.9MB

Download
memory/3536-466-0x00007FF7C4C90000-0x00007FF7C5082000-memory.dmp

Filesize
3.9MB

Download
memory/3624-531-0x00007FF720E90000-0x00007FF721282000-memory.dmp

Filesize
3.9MB

Download
memory/3920-2063-0x00007FF75F250000-0x00007FF75F642000-memory.dmp

Filesize
3.9MB

Download
memory/3920-4994-0x00007FF75F250000-0x00007FF75F642000-memory.dmp

Filesize
3.9MB

Download
memory/4244-4976-0x00007FF790640000-0x00007FF790A32000-memory.dmp

Filesize
3.9MB

Download
memory/4244-685-0x00007FF790640000-0x00007FF790A32000-memory.dmp

Filesize
3.9MB

Download
memory/4828-815-0x00007FF7D9610000-0x00007FF7D9A02000-memory.dmp

Filesize
3.9MB

Download
memory/4828-4922-0x00007FF7D9610000-0x00007FF7D9A02000-memory.dmp

Filesize
3.9MB

Download
memory/4932-4885-0x00007FF6327E0000-0x00007FF632BD2000-memory.dmp

Filesize
3.9MB

Download
memory/4932-600-0x00007FF6327E0000-0x00007FF632BD2000-memory.dmp

Filesize
3.9MB

Download