xmrig | 9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
Size

1.8MB
MD5

9574f2c78b14d4b4be76a056b375ff3f
SHA1

37c7a9c48c8a89ef296348b6d893292fba7fdea4
SHA256

9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022
SHA512

0d4b59e8dfce9c84b288cd71204bfbe5913f4c32301e92471bc2015b28475770588180bd19f3994463610ffb0654bdea50c0ae680368a93caf0985f4014a3533
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKMp6rdwwvi/XqwJclBVvNX0179l:Lz071uv4BPMkFfdk2afGwwvChEM1/

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/memory/2092-126-0x00007FF6F6B30000-0x00007FF6F6F22000-memory.dmp	xmrig
behavioral2/memory/3212-174-0x00007FF606E70000-0x00007FF607262000-memory.dmp	xmrig
behavioral2/memory/2108-195-0x00007FF650FE0000-0x00007FF6513D2000-memory.dmp	xmrig
behavioral2/memory/3848-207-0x00007FF737FE0000-0x00007FF7383D2000-memory.dmp	xmrig
behavioral2/memory/2772-210-0x00007FF6CE760000-0x00007FF6CEB52000-memory.dmp	xmrig
behavioral2/memory/2844-230-0x00007FF6AAC80000-0x00007FF6AB072000-memory.dmp	xmrig
behavioral2/memory/2504-237-0x00007FF752AD0000-0x00007FF752EC2000-memory.dmp	xmrig
behavioral2/memory/4216-243-0x00007FF6E25C0000-0x00007FF6E29B2000-memory.dmp	xmrig
behavioral2/memory/3800-249-0x00007FF68DDF0000-0x00007FF68E1E2000-memory.dmp	xmrig
behavioral2/memory/4232-252-0x00007FF74AC00000-0x00007FF74AFF2000-memory.dmp	xmrig
behavioral2/memory/1252-253-0x00007FF6C2900000-0x00007FF6C2CF2000-memory.dmp	xmrig
behavioral2/memory/1672-251-0x00007FF627730000-0x00007FF627B22000-memory.dmp	xmrig
behavioral2/memory/3836-250-0x00007FF7CD550000-0x00007FF7CD942000-memory.dmp	xmrig
behavioral2/memory/2560-248-0x00007FF7C0F30000-0x00007FF7C1322000-memory.dmp	xmrig
behavioral2/memory/4408-247-0x00007FF69A770000-0x00007FF69AB62000-memory.dmp	xmrig
behavioral2/memory/4016-246-0x00007FF6F6770000-0x00007FF6F6B62000-memory.dmp	xmrig
behavioral2/memory/4304-245-0x00007FF732FD0000-0x00007FF7333C2000-memory.dmp	xmrig
behavioral2/memory/2556-244-0x00007FF6E1990000-0x00007FF6E1D82000-memory.dmp	xmrig
behavioral2/memory/4196-242-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp	xmrig
behavioral2/memory/872-241-0x00007FF701900000-0x00007FF701CF2000-memory.dmp	xmrig
behavioral2/memory/2052-240-0x00007FF7FC530000-0x00007FF7FC922000-memory.dmp	xmrig
behavioral2/memory/5016-239-0x00007FF6466B0000-0x00007FF646AA2000-memory.dmp	xmrig
behavioral2/memory/900-235-0x00007FF793F90000-0x00007FF794382000-memory.dmp	xmrig
behavioral2/memory/3004-225-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp	xmrig
behavioral2/memory/2772-4053-0x00007FF6CE760000-0x00007FF6CEB52000-memory.dmp	xmrig
behavioral2/memory/2844-4060-0x00007FF6AAC80000-0x00007FF6AB072000-memory.dmp	xmrig
behavioral2/memory/5016-4081-0x00007FF6466B0000-0x00007FF646AA2000-memory.dmp	xmrig
behavioral2/memory/3916-4652-0x00007FF61C840000-0x00007FF61CC32000-memory.dmp	xmrig
behavioral2/memory/4232-4135-0x00007FF74AC00000-0x00007FF74AFF2000-memory.dmp	xmrig
behavioral2/memory/2052-4121-0x00007FF7FC530000-0x00007FF7FC922000-memory.dmp	xmrig
behavioral2/memory/900-4111-0x00007FF793F90000-0x00007FF794382000-memory.dmp	xmrig
behavioral2/memory/4216-4108-0x00007FF6E25C0000-0x00007FF6E29B2000-memory.dmp	xmrig
behavioral2/memory/872-4118-0x00007FF701900000-0x00007FF701CF2000-memory.dmp	xmrig
behavioral2/memory/4196-4106-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp	xmrig
behavioral2/memory/2504-4102-0x00007FF752AD0000-0x00007FF752EC2000-memory.dmp	xmrig
behavioral2/memory/2108-4069-0x00007FF650FE0000-0x00007FF6513D2000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	396	powershell.exe
5	396	powershell.exe
7	396	powershell.exe
8	396	powershell.exe
10	396	powershell.exe
11	396	powershell.exe
13	396	powershell.exe
18	396	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
396	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2092	oTqEsXu.exe
1672	rkHdOkG.exe
3212	nRJAMBT.exe
2108	LZVYtkW.exe
3848	sQsmAIN.exe
2772	pZsQkFj.exe
3004	YwfsxjD.exe
2844	HfPsKoI.exe
900	kqylZpE.exe
2504	hGTBRli.exe
5016	QfnEmWa.exe
2052	QOIwoGP.exe
872	cvLzkUc.exe
4232	CwTbkRJ.exe
4196	QEXAbwo.exe
4216	CTBYpxJ.exe
2556	DTyoFyS.exe
4304	lidvStd.exe
1252	wzsTVJV.exe
4016	iwuSpKi.exe
4408	ejbiDrd.exe
2560	rlAVokP.exe
3800	FjvEojO.exe
3836	SKPXpsr.exe
1684	GPzEAaY.exe
920	JxAvkBY.exe
1892	zoKPLxE.exe
2936	sriSdFU.exe
3428	ZlWampX.exe
1164	QYcNFCZ.exe
2196	hxwkZaW.exe
5000	uDPWdIG.exe
1852	hWMEXkH.exe
2380	BZgEzEx.exe
1080	PXNgBap.exe
2256	TAdCCAl.exe
4192	wOqSuJW.exe
3484	sirVHVw.exe
1664	yNWWUXI.exe
1044	AvGbERC.exe
4644	sIPjGog.exe
2648	ylINKgS.exe
3468	nSwsouQ.exe
1488	MTwUymH.exe
1952	xWDOHVO.exe
2632	iHDmCmf.exe
452	LvzGGzG.exe
3052	PocmpgK.exe
2968	ZKXQwBH.exe
4708	XkmqRVI.exe
3092	bEbNJnD.exe
4628	UUERgvM.exe
3644	EoKrEen.exe
2264	kevSmhJ.exe
828	PLFOxmH.exe
3864	ynBslhO.exe
3064	XfAZJyD.exe
544	GEchvIw.exe
2068	BzUyEWj.exe
1520	BMKfdwp.exe
4272	ZDjoOVm.exe
1512	EgismoO.exe
4888	GHESkuZ.exe
3216	pxUWguJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3916-0-0x00007FF61C840000-0x00007FF61CC32000-memory.dmp	upx
behavioral2/files/0x000d0000000233eb-8.dat	upx
behavioral2/files/0x00070000000234a3-7.dat	upx
behavioral2/files/0x00070000000234a4-17.dat	upx
behavioral2/files/0x00080000000234a2-10.dat	upx
behavioral2/files/0x00070000000234a7-36.dat	upx
behavioral2/files/0x00070000000234aa-70.dat	upx
behavioral2/files/0x00070000000234ae-100.dat	upx
behavioral2/memory/2092-126-0x00007FF6F6B30000-0x00007FF6F6F22000-memory.dmp	upx
behavioral2/memory/3212-174-0x00007FF606E70000-0x00007FF607262000-memory.dmp	upx
behavioral2/memory/2108-195-0x00007FF650FE0000-0x00007FF6513D2000-memory.dmp	upx
behavioral2/memory/3848-207-0x00007FF737FE0000-0x00007FF7383D2000-memory.dmp	upx
behavioral2/memory/2772-210-0x00007FF6CE760000-0x00007FF6CEB52000-memory.dmp	upx
behavioral2/memory/2844-230-0x00007FF6AAC80000-0x00007FF6AB072000-memory.dmp	upx
behavioral2/memory/2504-237-0x00007FF752AD0000-0x00007FF752EC2000-memory.dmp	upx
behavioral2/memory/4216-243-0x00007FF6E25C0000-0x00007FF6E29B2000-memory.dmp	upx
behavioral2/memory/3800-249-0x00007FF68DDF0000-0x00007FF68E1E2000-memory.dmp	upx
behavioral2/memory/4232-252-0x00007FF74AC00000-0x00007FF74AFF2000-memory.dmp	upx
behavioral2/memory/1252-253-0x00007FF6C2900000-0x00007FF6C2CF2000-memory.dmp	upx
behavioral2/memory/1672-251-0x00007FF627730000-0x00007FF627B22000-memory.dmp	upx
behavioral2/memory/3836-250-0x00007FF7CD550000-0x00007FF7CD942000-memory.dmp	upx
behavioral2/memory/2560-248-0x00007FF7C0F30000-0x00007FF7C1322000-memory.dmp	upx
behavioral2/memory/4408-247-0x00007FF69A770000-0x00007FF69AB62000-memory.dmp	upx
behavioral2/memory/4016-246-0x00007FF6F6770000-0x00007FF6F6B62000-memory.dmp	upx
behavioral2/memory/4304-245-0x00007FF732FD0000-0x00007FF7333C2000-memory.dmp	upx
behavioral2/memory/2556-244-0x00007FF6E1990000-0x00007FF6E1D82000-memory.dmp	upx
behavioral2/memory/4196-242-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp	upx
behavioral2/memory/872-241-0x00007FF701900000-0x00007FF701CF2000-memory.dmp	upx
behavioral2/memory/2052-240-0x00007FF7FC530000-0x00007FF7FC922000-memory.dmp	upx
behavioral2/memory/5016-239-0x00007FF6466B0000-0x00007FF646AA2000-memory.dmp	upx
behavioral2/memory/900-235-0x00007FF793F90000-0x00007FF794382000-memory.dmp	upx
behavioral2/memory/3004-225-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp	upx
behavioral2/files/0x00070000000234b6-186.dat	upx
behavioral2/files/0x00070000000234c7-183.dat	upx
behavioral2/files/0x00070000000234c5-178.dat	upx
behavioral2/files/0x00070000000234b8-175.dat	upx
behavioral2/files/0x00070000000234c4-173.dat	upx
behavioral2/files/0x00070000000234c2-171.dat	upx
behavioral2/files/0x00070000000234c1-170.dat	upx
behavioral2/files/0x00070000000234c0-169.dat	upx
behavioral2/files/0x00070000000234b5-168.dat	upx
behavioral2/files/0x00080000000234a0-166.dat	upx
behavioral2/files/0x00080000000234ba-165.dat	upx
behavioral2/files/0x00070000000234bf-161.dat	upx
behavioral2/files/0x00070000000234bb-184.dat	upx
behavioral2/files/0x00070000000234c6-182.dat	upx
behavioral2/files/0x00070000000234b2-156.dat	upx
behavioral2/files/0x00070000000234b7-151.dat	upx
behavioral2/files/0x00070000000234be-147.dat	upx
behavioral2/files/0x00070000000234bd-143.dat	upx
behavioral2/files/0x00070000000234c3-172.dat	upx
behavioral2/files/0x00070000000234bc-137.dat	upx
behavioral2/files/0x00070000000234b3-131.dat	upx
behavioral2/files/0x00070000000234b1-123.dat	upx
behavioral2/files/0x00070000000234b4-138.dat	upx
behavioral2/files/0x00070000000234ad-84.dat	upx
behavioral2/files/0x00070000000234ac-83.dat	upx
behavioral2/files/0x00070000000234af-81.dat	upx
behavioral2/files/0x00070000000234b0-75.dat	upx
behavioral2/files/0x00070000000234a9-69.dat	upx
behavioral2/files/0x00070000000234a8-48.dat	upx
behavioral2/files/0x00070000000234ab-62.dat	upx
behavioral2/files/0x00070000000234a6-43.dat	upx
behavioral2/files/0x00070000000234a5-41.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KpOyTLD.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\BbrIqKj.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\UrbBVWa.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\RWPrgKF.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\wtRQsOw.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\vJLKmsQ.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\pZsQkFj.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\CvvuZZE.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\aFXKKny.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\QWczdbl.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\QcnqxID.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\oSlAPyE.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\fBdYqBs.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\hFVybnw.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\hRbnzSB.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\nFopaJe.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\ioOqGZR.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\hoyBeNy.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\aTVeWWj.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\xFnokto.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\IDBBffD.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\CRRexbn.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\eTHbAPE.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\UiiXAPm.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\KPDYLNk.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\EbBuRzx.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\JFDkrxi.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\OCxkOBr.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\PUGXXfF.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\ACpWpbp.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\iannZnh.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\PzxMypG.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\parRpUF.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\jyGrrPZ.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\iCMYjTI.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\yeyYvdy.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\WFjCVnl.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\xuceKzx.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\ftNTicy.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\puelcZF.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\tQFTNLA.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\ntdDBBI.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\FZmumGs.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\ZJekRSo.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\EUJTRrH.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\hOXaEkO.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\IXmrJkx.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\VQbrsPr.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\AORjFAs.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\NdtKieu.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\pEQMymF.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\DAdYfJX.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\QDNJktd.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\GUDNZpw.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\KvPESPu.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\PoGjUeF.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\Ggxyoxk.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\JZJjGcz.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\XaMSHOM.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\KMbLzhz.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\ygEWQOr.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\agmERsQ.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\dFDcwPc.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
File created	C:\Windows\System\rwRDQZZ.exe	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
396	powershell.exe
396	powershell.exe
396	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3496	Process not Found
6320	Process not Found
4072	Process not Found
4844	Process not Found
1552	Process not Found
6680	Process not Found
7544	Process not Found
5684	Process not Found
4912	Process not Found
6220	Process not Found
3580	Process not Found
6800	Process not Found
6712	Process not Found
1036	Process not Found
6964	Process not Found
6380	Process not Found
7288	Process not Found
9140	Process not Found
7128	Process not Found
8472	Process not Found
11708	Process not Found
624	Process not Found
7252	Process not Found
3452	Process not Found
3696	Process not Found
9180	Process not Found
4308	Process not Found
9092	Process not Found
2928	Process not Found
9088	Process not Found
3752	Process not Found
7868	Process not Found
7776	Process not Found
14020	Process not Found
6812	Process not Found
8872	Process not Found
9168	Process not Found
4548	Process not Found
8304	Process not Found
6268	Process not Found
6476	Process not Found
9148	Process not Found
4672	Process not Found
8152	Process not Found
8092	Process not Found
9192	Process not Found
4996	Process not Found
9616	Process not Found
7380	Process not Found
9332	Process not Found
2468	Process not Found
7436	Process not Found
10100	Process not Found
1760	Process not Found
8660	Process not Found
10444	Process not Found
10568	Process not Found
10552	Process not Found
10508	Process not Found
11904	Process not Found
4692	Process not Found
4696	Process not Found
1856	Process not Found
1060	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeLockMemoryPrivilege	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 396	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	83
PID 3916 wrote to memory of 396	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	83
PID 3916 wrote to memory of 2092	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	84
PID 3916 wrote to memory of 2092	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	84
PID 3916 wrote to memory of 1672	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	85
PID 3916 wrote to memory of 1672	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	85
PID 3916 wrote to memory of 3848	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	86
PID 3916 wrote to memory of 3848	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	86
PID 3916 wrote to memory of 3212	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	87
PID 3916 wrote to memory of 3212	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	87
PID 3916 wrote to memory of 2108	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	88
PID 3916 wrote to memory of 2108	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	88
PID 3916 wrote to memory of 2772	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	89
PID 3916 wrote to memory of 2772	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	89
PID 3916 wrote to memory of 3004	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	90
PID 3916 wrote to memory of 3004	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	90
PID 3916 wrote to memory of 2844	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	91
PID 3916 wrote to memory of 2844	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	91
PID 3916 wrote to memory of 900	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	92
PID 3916 wrote to memory of 900	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	92
PID 3916 wrote to memory of 2504	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	93
PID 3916 wrote to memory of 2504	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	93
PID 3916 wrote to memory of 5016	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	94
PID 3916 wrote to memory of 5016	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	94
PID 3916 wrote to memory of 2052	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	95
PID 3916 wrote to memory of 2052	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	95
PID 3916 wrote to memory of 872	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	96
PID 3916 wrote to memory of 872	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	96
PID 3916 wrote to memory of 4232	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	97
PID 3916 wrote to memory of 4232	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	97
PID 3916 wrote to memory of 4196	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	98
PID 3916 wrote to memory of 4196	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	98
PID 3916 wrote to memory of 4216	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	99
PID 3916 wrote to memory of 4216	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	99
PID 3916 wrote to memory of 2556	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	100
PID 3916 wrote to memory of 2556	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	100
PID 3916 wrote to memory of 4304	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	101
PID 3916 wrote to memory of 4304	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	101
PID 3916 wrote to memory of 1252	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	102
PID 3916 wrote to memory of 1252	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	102
PID 3916 wrote to memory of 4016	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	103
PID 3916 wrote to memory of 4016	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	103
PID 3916 wrote to memory of 4408	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	104
PID 3916 wrote to memory of 4408	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	104
PID 3916 wrote to memory of 2560	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	105
PID 3916 wrote to memory of 2560	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	105
PID 3916 wrote to memory of 920	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	106
PID 3916 wrote to memory of 920	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	106
PID 3916 wrote to memory of 3428	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	107
PID 3916 wrote to memory of 3428	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	107
PID 3916 wrote to memory of 3800	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	108
PID 3916 wrote to memory of 3800	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	108
PID 3916 wrote to memory of 3836	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	109
PID 3916 wrote to memory of 3836	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	109
PID 3916 wrote to memory of 1684	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	110
PID 3916 wrote to memory of 1684	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	110
PID 3916 wrote to memory of 1892	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	111
PID 3916 wrote to memory of 1892	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	111
PID 3916 wrote to memory of 2936	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	112
PID 3916 wrote to memory of 2936	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	112
PID 3916 wrote to memory of 1164	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	113
PID 3916 wrote to memory of 1164	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	113
PID 3916 wrote to memory of 2196	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	114
PID 3916 wrote to memory of 2196	3916	9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe	114

C:\Users\Admin\AppData\Local\Temp\9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe
"C:\Users\Admin\AppData\Local\Temp\9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\System\oTqEsXu.exe
  C:\Windows\System\oTqEsXu.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\rkHdOkG.exe
  C:\Windows\System\rkHdOkG.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\sQsmAIN.exe
  C:\Windows\System\sQsmAIN.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\nRJAMBT.exe
  C:\Windows\System\nRJAMBT.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\LZVYtkW.exe
  C:\Windows\System\LZVYtkW.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\pZsQkFj.exe
  C:\Windows\System\pZsQkFj.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\YwfsxjD.exe
  C:\Windows\System\YwfsxjD.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\HfPsKoI.exe
  C:\Windows\System\HfPsKoI.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\kqylZpE.exe
  C:\Windows\System\kqylZpE.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\hGTBRli.exe
  C:\Windows\System\hGTBRli.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\QfnEmWa.exe
  C:\Windows\System\QfnEmWa.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\QOIwoGP.exe
  C:\Windows\System\QOIwoGP.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\cvLzkUc.exe
  C:\Windows\System\cvLzkUc.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\CwTbkRJ.exe
  C:\Windows\System\CwTbkRJ.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\QEXAbwo.exe
  C:\Windows\System\QEXAbwo.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\CTBYpxJ.exe
  C:\Windows\System\CTBYpxJ.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\DTyoFyS.exe
  C:\Windows\System\DTyoFyS.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\lidvStd.exe
  C:\Windows\System\lidvStd.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\wzsTVJV.exe
  C:\Windows\System\wzsTVJV.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\iwuSpKi.exe
  C:\Windows\System\iwuSpKi.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\ejbiDrd.exe
  C:\Windows\System\ejbiDrd.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\rlAVokP.exe
  C:\Windows\System\rlAVokP.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\JxAvkBY.exe
  C:\Windows\System\JxAvkBY.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\ZlWampX.exe
  C:\Windows\System\ZlWampX.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\FjvEojO.exe
  C:\Windows\System\FjvEojO.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\SKPXpsr.exe
  C:\Windows\System\SKPXpsr.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\GPzEAaY.exe
  C:\Windows\System\GPzEAaY.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\zoKPLxE.exe
  C:\Windows\System\zoKPLxE.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\sriSdFU.exe
  C:\Windows\System\sriSdFU.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\QYcNFCZ.exe
  C:\Windows\System\QYcNFCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\hxwkZaW.exe
  C:\Windows\System\hxwkZaW.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\uDPWdIG.exe
  C:\Windows\System\uDPWdIG.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\hWMEXkH.exe
  C:\Windows\System\hWMEXkH.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\BZgEzEx.exe
  C:\Windows\System\BZgEzEx.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\PXNgBap.exe
  C:\Windows\System\PXNgBap.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\TAdCCAl.exe
  C:\Windows\System\TAdCCAl.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\wOqSuJW.exe
  C:\Windows\System\wOqSuJW.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\sirVHVw.exe
  C:\Windows\System\sirVHVw.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\yNWWUXI.exe
  C:\Windows\System\yNWWUXI.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\AvGbERC.exe
  C:\Windows\System\AvGbERC.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\sIPjGog.exe
  C:\Windows\System\sIPjGog.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\ylINKgS.exe
  C:\Windows\System\ylINKgS.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\nSwsouQ.exe
  C:\Windows\System\nSwsouQ.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\MTwUymH.exe
  C:\Windows\System\MTwUymH.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\xWDOHVO.exe
  C:\Windows\System\xWDOHVO.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\iHDmCmf.exe
  C:\Windows\System\iHDmCmf.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\LvzGGzG.exe
  C:\Windows\System\LvzGGzG.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\PocmpgK.exe
  C:\Windows\System\PocmpgK.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\ZKXQwBH.exe
  C:\Windows\System\ZKXQwBH.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\XkmqRVI.exe
  C:\Windows\System\XkmqRVI.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\bEbNJnD.exe
  C:\Windows\System\bEbNJnD.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\UUERgvM.exe
  C:\Windows\System\UUERgvM.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\EoKrEen.exe
  C:\Windows\System\EoKrEen.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\kevSmhJ.exe
  C:\Windows\System\kevSmhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\PLFOxmH.exe
  C:\Windows\System\PLFOxmH.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\ynBslhO.exe
  C:\Windows\System\ynBslhO.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\XfAZJyD.exe
  C:\Windows\System\XfAZJyD.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\GEchvIw.exe
  C:\Windows\System\GEchvIw.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\BzUyEWj.exe
  C:\Windows\System\BzUyEWj.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\BMKfdwp.exe
  C:\Windows\System\BMKfdwp.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\ZDjoOVm.exe
  C:\Windows\System\ZDjoOVm.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\EgismoO.exe
  C:\Windows\System\EgismoO.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\GHESkuZ.exe
  C:\Windows\System\GHESkuZ.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\pxUWguJ.exe
  C:\Windows\System\pxUWguJ.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\CZCpKVR.exe
  C:\Windows\System\CZCpKVR.exe
  2⤵
  PID:3936
- C:\Windows\System\HKWHQjR.exe
  C:\Windows\System\HKWHQjR.exe
  2⤵
  PID:4684
- C:\Windows\System\uuYZmPE.exe
  C:\Windows\System\uuYZmPE.exe
  2⤵
  PID:1956
- C:\Windows\System\WNvakOn.exe
  C:\Windows\System\WNvakOn.exe
  2⤵
  PID:2352
- C:\Windows\System\EYXnMQu.exe
  C:\Windows\System\EYXnMQu.exe
  2⤵
  PID:2536
- C:\Windows\System\YEGgioW.exe
  C:\Windows\System\YEGgioW.exe
  2⤵
  PID:4508
- C:\Windows\System\PzxMypG.exe
  C:\Windows\System\PzxMypG.exe
  2⤵
  PID:2736
- C:\Windows\System\yVIfEet.exe
  C:\Windows\System\yVIfEet.exe
  2⤵
  PID:3796
- C:\Windows\System\JDBHQMj.exe
  C:\Windows\System\JDBHQMj.exe
  2⤵
  PID:1912
- C:\Windows\System\PoGjUeF.exe
  C:\Windows\System\PoGjUeF.exe
  2⤵
  PID:3300
- C:\Windows\System\NYNipuj.exe
  C:\Windows\System\NYNipuj.exe
  2⤵
  PID:2868
- C:\Windows\System\TlXGbvE.exe
  C:\Windows\System\TlXGbvE.exe
  2⤵
  PID:2408
- C:\Windows\System\DshNfkR.exe
  C:\Windows\System\DshNfkR.exe
  2⤵
  PID:100
- C:\Windows\System\fYlvxnn.exe
  C:\Windows\System\fYlvxnn.exe
  2⤵
  PID:4296
- C:\Windows\System\EkWgzfQ.exe
  C:\Windows\System\EkWgzfQ.exe
  2⤵
  PID:4860
- C:\Windows\System\OeeEuuG.exe
  C:\Windows\System\OeeEuuG.exe
  2⤵
  PID:2188
- C:\Windows\System\qAvcVdo.exe
  C:\Windows\System\qAvcVdo.exe
  2⤵
  PID:3680
- C:\Windows\System\jQGLPwD.exe
  C:\Windows\System\jQGLPwD.exe
  2⤵
  PID:1268
- C:\Windows\System\RvppXhh.exe
  C:\Windows\System\RvppXhh.exe
  2⤵
  PID:8
- C:\Windows\System\DwMANua.exe
  C:\Windows\System\DwMANua.exe
  2⤵
  PID:264
- C:\Windows\System\bZSsyNY.exe
  C:\Windows\System\bZSsyNY.exe
  2⤵
  PID:228
- C:\Windows\System\rSZLiEJ.exe
  C:\Windows\System\rSZLiEJ.exe
  2⤵
  PID:3540
- C:\Windows\System\BbgnHIy.exe
  C:\Windows\System\BbgnHIy.exe
  2⤵
  PID:4764
- C:\Windows\System\OrGBBXn.exe
  C:\Windows\System\OrGBBXn.exe
  2⤵
  PID:4276
- C:\Windows\System\svdeCPI.exe
  C:\Windows\System\svdeCPI.exe
  2⤵
  PID:3792
- C:\Windows\System\mddfyZW.exe
  C:\Windows\System\mddfyZW.exe
  2⤵
  PID:1788
- C:\Windows\System\lmscmth.exe
  C:\Windows\System\lmscmth.exe
  2⤵
  PID:1092
- C:\Windows\System\DBcBhgx.exe
  C:\Windows\System\DBcBhgx.exe
  2⤵
  PID:4636
- C:\Windows\System\otHAihk.exe
  C:\Windows\System\otHAihk.exe
  2⤵
  PID:4608
- C:\Windows\System\KnAsttH.exe
  C:\Windows\System\KnAsttH.exe
  2⤵
  PID:3904
- C:\Windows\System\qjxhryh.exe
  C:\Windows\System\qjxhryh.exe
  2⤵
  PID:2952
- C:\Windows\System\OJSmjcU.exe
  C:\Windows\System\OJSmjcU.exe
  2⤵
  PID:1544
- C:\Windows\System\fOxgSdx.exe
  C:\Windows\System\fOxgSdx.exe
  2⤵
  PID:4880
- C:\Windows\System\KTWyfcT.exe
  C:\Windows\System\KTWyfcT.exe
  2⤵
  PID:4068
- C:\Windows\System\Ggxyoxk.exe
  C:\Windows\System\Ggxyoxk.exe
  2⤵
  PID:2260
- C:\Windows\System\dilzXNX.exe
  C:\Windows\System\dilzXNX.exe
  2⤵
  PID:2668
- C:\Windows\System\LeBmAcQ.exe
  C:\Windows\System\LeBmAcQ.exe
  2⤵
  PID:3116
- C:\Windows\System\bjbwpjG.exe
  C:\Windows\System\bjbwpjG.exe
  2⤵
  PID:1732
- C:\Windows\System\KMbLzhz.exe
  C:\Windows\System\KMbLzhz.exe
  2⤵
  PID:3648
- C:\Windows\System\nYudnUj.exe
  C:\Windows\System\nYudnUj.exe
  2⤵
  PID:1640
- C:\Windows\System\jhqyQUN.exe
  C:\Windows\System\jhqyQUN.exe
  2⤵
  PID:5012
- C:\Windows\System\GEIVDfn.exe
  C:\Windows\System\GEIVDfn.exe
  2⤵
  PID:3284
- C:\Windows\System\PtTszvS.exe
  C:\Windows\System\PtTszvS.exe
  2⤵
  PID:5124
- C:\Windows\System\UizrPIi.exe
  C:\Windows\System\UizrPIi.exe
  2⤵
  PID:5160
- C:\Windows\System\oelzjtD.exe
  C:\Windows\System\oelzjtD.exe
  2⤵
  PID:5176
- C:\Windows\System\hjsWSlC.exe
  C:\Windows\System\hjsWSlC.exe
  2⤵
  PID:5200
- C:\Windows\System\TlLIPle.exe
  C:\Windows\System\TlLIPle.exe
  2⤵
  PID:5224
- C:\Windows\System\agmERsQ.exe
  C:\Windows\System\agmERsQ.exe
  2⤵
  PID:5244
- C:\Windows\System\HcKTUvE.exe
  C:\Windows\System\HcKTUvE.exe
  2⤵
  PID:5272
- C:\Windows\System\FCitjTd.exe
  C:\Windows\System\FCitjTd.exe
  2⤵
  PID:5288
- C:\Windows\System\dMLawni.exe
  C:\Windows\System\dMLawni.exe
  2⤵
  PID:5312
- C:\Windows\System\AqPCkGM.exe
  C:\Windows\System\AqPCkGM.exe
  2⤵
  PID:5332
- C:\Windows\System\rTSfmrE.exe
  C:\Windows\System\rTSfmrE.exe
  2⤵
  PID:5352
- C:\Windows\System\rdBrJkN.exe
  C:\Windows\System\rdBrJkN.exe
  2⤵
  PID:5380
- C:\Windows\System\NdtKieu.exe
  C:\Windows\System\NdtKieu.exe
  2⤵
  PID:5400
- C:\Windows\System\WbQHdPi.exe
  C:\Windows\System\WbQHdPi.exe
  2⤵
  PID:5424
- C:\Windows\System\YIiTleD.exe
  C:\Windows\System\YIiTleD.exe
  2⤵
  PID:5440
- C:\Windows\System\hRbnzSB.exe
  C:\Windows\System\hRbnzSB.exe
  2⤵
  PID:5468
- C:\Windows\System\LvLsJPB.exe
  C:\Windows\System\LvLsJPB.exe
  2⤵
  PID:5568
- C:\Windows\System\vRsxhkf.exe
  C:\Windows\System\vRsxhkf.exe
  2⤵
  PID:5592
- C:\Windows\System\NEnxwlK.exe
  C:\Windows\System\NEnxwlK.exe
  2⤵
  PID:5612
- C:\Windows\System\YPGwQZZ.exe
  C:\Windows\System\YPGwQZZ.exe
  2⤵
  PID:5636
- C:\Windows\System\ynPSmhK.exe
  C:\Windows\System\ynPSmhK.exe
  2⤵
  PID:5652
- C:\Windows\System\LMXkRHV.exe
  C:\Windows\System\LMXkRHV.exe
  2⤵
  PID:5676
- C:\Windows\System\LAdYFBu.exe
  C:\Windows\System\LAdYFBu.exe
  2⤵
  PID:5692
- C:\Windows\System\MnjgWzA.exe
  C:\Windows\System\MnjgWzA.exe
  2⤵
  PID:5716
- C:\Windows\System\ZKKTTlS.exe
  C:\Windows\System\ZKKTTlS.exe
  2⤵
  PID:5744
- C:\Windows\System\TdQxFeV.exe
  C:\Windows\System\TdQxFeV.exe
  2⤵
  PID:5764
- C:\Windows\System\ltHFJNn.exe
  C:\Windows\System\ltHFJNn.exe
  2⤵
  PID:5792
- C:\Windows\System\tmEhwmr.exe
  C:\Windows\System\tmEhwmr.exe
  2⤵
  PID:5808
- C:\Windows\System\JKqaQkq.exe
  C:\Windows\System\JKqaQkq.exe
  2⤵
  PID:5828
- C:\Windows\System\ngcpExJ.exe
  C:\Windows\System\ngcpExJ.exe
  2⤵
  PID:5852
- C:\Windows\System\dQYXkQo.exe
  C:\Windows\System\dQYXkQo.exe
  2⤵
  PID:5872
- C:\Windows\System\hYLRhfg.exe
  C:\Windows\System\hYLRhfg.exe
  2⤵
  PID:5896
- C:\Windows\System\DAdYfJX.exe
  C:\Windows\System\DAdYfJX.exe
  2⤵
  PID:5912
- C:\Windows\System\cvOVTbr.exe
  C:\Windows\System\cvOVTbr.exe
  2⤵
  PID:5936
- C:\Windows\System\agZVYlj.exe
  C:\Windows\System\agZVYlj.exe
  2⤵
  PID:5956
- C:\Windows\System\DIVYAQf.exe
  C:\Windows\System\DIVYAQf.exe
  2⤵
  PID:5984
- C:\Windows\System\DIkksQa.exe
  C:\Windows\System\DIkksQa.exe
  2⤵
  PID:6008
- C:\Windows\System\DrtItkG.exe
  C:\Windows\System\DrtItkG.exe
  2⤵
  PID:6036
- C:\Windows\System\zEAhVGv.exe
  C:\Windows\System\zEAhVGv.exe
  2⤵
  PID:6056
- C:\Windows\System\RNZtOjk.exe
  C:\Windows\System\RNZtOjk.exe
  2⤵
  PID:6076
- C:\Windows\System\DKENvFw.exe
  C:\Windows\System\DKENvFw.exe
  2⤵
  PID:6100
- C:\Windows\System\TkmTFAZ.exe
  C:\Windows\System\TkmTFAZ.exe
  2⤵
  PID:6124
- C:\Windows\System\FCvaIoq.exe
  C:\Windows\System\FCvaIoq.exe
  2⤵
  PID:5088
- C:\Windows\System\ViZXmWB.exe
  C:\Windows\System\ViZXmWB.exe
  2⤵
  PID:868
- C:\Windows\System\BpwYrVx.exe
  C:\Windows\System\BpwYrVx.exe
  2⤵
  PID:3436
- C:\Windows\System\zHYkTZu.exe
  C:\Windows\System\zHYkTZu.exe
  2⤵
  PID:5168
- C:\Windows\System\KonZEtB.exe
  C:\Windows\System\KonZEtB.exe
  2⤵
  PID:5196
- C:\Windows\System\HXBONRB.exe
  C:\Windows\System\HXBONRB.exe
  2⤵
  PID:4740
- C:\Windows\System\FLPMihM.exe
  C:\Windows\System\FLPMihM.exe
  2⤵
  PID:4352
- C:\Windows\System\jrujvdA.exe
  C:\Windows\System\jrujvdA.exe
  2⤵
  PID:4540
- C:\Windows\System\MtGBBoQ.exe
  C:\Windows\System\MtGBBoQ.exe
  2⤵
  PID:5436
- C:\Windows\System\IeEgObX.exe
  C:\Windows\System\IeEgObX.exe
  2⤵
  PID:2540
- C:\Windows\System\RNWoFAl.exe
  C:\Windows\System\RNWoFAl.exe
  2⤵
  PID:3840
- C:\Windows\System\nOylWoD.exe
  C:\Windows\System\nOylWoD.exe
  2⤵
  PID:5140
- C:\Windows\System\TyuxFRx.exe
  C:\Windows\System\TyuxFRx.exe
  2⤵
  PID:5420
- C:\Windows\System\DKhPtMS.exe
  C:\Windows\System\DKhPtMS.exe
  2⤵
  PID:5368
- C:\Windows\System\ZPGQGIS.exe
  C:\Windows\System\ZPGQGIS.exe
  2⤵
  PID:5252
- C:\Windows\System\NEIgksY.exe
  C:\Windows\System\NEIgksY.exe
  2⤵
  PID:5644
- C:\Windows\System\iMtGdfn.exe
  C:\Windows\System\iMtGdfn.exe
  2⤵
  PID:5712
- C:\Windows\System\AXDDnsm.exe
  C:\Windows\System\AXDDnsm.exe
  2⤵
  PID:5756
- C:\Windows\System\dwUBzSg.exe
  C:\Windows\System\dwUBzSg.exe
  2⤵
  PID:5884
- C:\Windows\System\kakSkXQ.exe
  C:\Windows\System\kakSkXQ.exe
  2⤵
  PID:5968
- C:\Windows\System\cmpWyVP.exe
  C:\Windows\System\cmpWyVP.exe
  2⤵
  PID:6004
- C:\Windows\System\GdhsfOM.exe
  C:\Windows\System\GdhsfOM.exe
  2⤵
  PID:5460
- C:\Windows\System\PpjPbtk.exe
  C:\Windows\System\PpjPbtk.exe
  2⤵
  PID:5564
- C:\Windows\System\HgpHaIm.exe
  C:\Windows\System\HgpHaIm.exe
  2⤵
  PID:6112
- C:\Windows\System\TtUHaGM.exe
  C:\Windows\System\TtUHaGM.exe
  2⤵
  PID:5700
- C:\Windows\System\aPtkfrr.exe
  C:\Windows\System\aPtkfrr.exe
  2⤵
  PID:4100
- C:\Windows\System\xPwXgdL.exe
  C:\Windows\System\xPwXgdL.exe
  2⤵
  PID:5780
- C:\Windows\System\VamRroK.exe
  C:\Windows\System\VamRroK.exe
  2⤵
  PID:6148
- C:\Windows\System\kTJSUHa.exe
  C:\Windows\System\kTJSUHa.exe
  2⤵
  PID:6168
- C:\Windows\System\sOYrLaf.exe
  C:\Windows\System\sOYrLaf.exe
  2⤵
  PID:6188
- C:\Windows\System\HikOxuR.exe
  C:\Windows\System\HikOxuR.exe
  2⤵
  PID:6208
- C:\Windows\System\bIrnkoV.exe
  C:\Windows\System\bIrnkoV.exe
  2⤵
  PID:6228
- C:\Windows\System\HZkegQo.exe
  C:\Windows\System\HZkegQo.exe
  2⤵
  PID:6252
- C:\Windows\System\JLnhkRE.exe
  C:\Windows\System\JLnhkRE.exe
  2⤵
  PID:6272
- C:\Windows\System\mTRwYgz.exe
  C:\Windows\System\mTRwYgz.exe
  2⤵
  PID:6292
- C:\Windows\System\QDNJktd.exe
  C:\Windows\System\QDNJktd.exe
  2⤵
  PID:6312
- C:\Windows\System\WEYneug.exe
  C:\Windows\System\WEYneug.exe
  2⤵
  PID:6336
- C:\Windows\System\MEoMaxq.exe
  C:\Windows\System\MEoMaxq.exe
  2⤵
  PID:6356
- C:\Windows\System\BdnlpdD.exe
  C:\Windows\System\BdnlpdD.exe
  2⤵
  PID:6372
- C:\Windows\System\smmwWWX.exe
  C:\Windows\System\smmwWWX.exe
  2⤵
  PID:6396
- C:\Windows\System\JzMSowy.exe
  C:\Windows\System\JzMSowy.exe
  2⤵
  PID:6412
- C:\Windows\System\CGxpvwN.exe
  C:\Windows\System\CGxpvwN.exe
  2⤵
  PID:6432
- C:\Windows\System\dfmPESu.exe
  C:\Windows\System\dfmPESu.exe
  2⤵
  PID:6452
- C:\Windows\System\fSoxIVB.exe
  C:\Windows\System\fSoxIVB.exe
  2⤵
  PID:6480
- C:\Windows\System\eOgEYgp.exe
  C:\Windows\System\eOgEYgp.exe
  2⤵
  PID:6500
- C:\Windows\System\qtplKjK.exe
  C:\Windows\System\qtplKjK.exe
  2⤵
  PID:6528
- C:\Windows\System\wwKASog.exe
  C:\Windows\System\wwKASog.exe
  2⤵
  PID:6544
- C:\Windows\System\jRJkPwN.exe
  C:\Windows\System\jRJkPwN.exe
  2⤵
  PID:6576
- C:\Windows\System\LosNVuL.exe
  C:\Windows\System\LosNVuL.exe
  2⤵
  PID:6596
- C:\Windows\System\aNuDKxy.exe
  C:\Windows\System\aNuDKxy.exe
  2⤵
  PID:6620
- C:\Windows\System\NFuJSGM.exe
  C:\Windows\System\NFuJSGM.exe
  2⤵
  PID:6648
- C:\Windows\System\ryAxPBG.exe
  C:\Windows\System\ryAxPBG.exe
  2⤵
  PID:6672
- C:\Windows\System\PiLPtjr.exe
  C:\Windows\System\PiLPtjr.exe
  2⤵
  PID:6692
- C:\Windows\System\RrFpsAK.exe
  C:\Windows\System\RrFpsAK.exe
  2⤵
  PID:6716
- C:\Windows\System\ZFKVPdq.exe
  C:\Windows\System\ZFKVPdq.exe
  2⤵
  PID:6732
- C:\Windows\System\NBxpYoI.exe
  C:\Windows\System\NBxpYoI.exe
  2⤵
  PID:6760
- C:\Windows\System\xFPtkdL.exe
  C:\Windows\System\xFPtkdL.exe
  2⤵
  PID:6780
- C:\Windows\System\JBqCfKB.exe
  C:\Windows\System\JBqCfKB.exe
  2⤵
  PID:6804
- C:\Windows\System\MoLSGEu.exe
  C:\Windows\System\MoLSGEu.exe
  2⤵
  PID:6824
- C:\Windows\System\MGderWO.exe
  C:\Windows\System\MGderWO.exe
  2⤵
  PID:6844
- C:\Windows\System\ntdDBBI.exe
  C:\Windows\System\ntdDBBI.exe
  2⤵
  PID:6868
- C:\Windows\System\cgeGDRV.exe
  C:\Windows\System\cgeGDRV.exe
  2⤵
  PID:6888
- C:\Windows\System\qvEliQX.exe
  C:\Windows\System\qvEliQX.exe
  2⤵
  PID:6908
- C:\Windows\System\NEzPiRk.exe
  C:\Windows\System\NEzPiRk.exe
  2⤵
  PID:6932
- C:\Windows\System\usWbdvk.exe
  C:\Windows\System\usWbdvk.exe
  2⤵
  PID:6952
- C:\Windows\System\aHYbFyS.exe
  C:\Windows\System\aHYbFyS.exe
  2⤵
  PID:6980
- C:\Windows\System\bXkanAO.exe
  C:\Windows\System\bXkanAO.exe
  2⤵
  PID:6996
- C:\Windows\System\NRTuXPd.exe
  C:\Windows\System\NRTuXPd.exe
  2⤵
  PID:7020
- C:\Windows\System\GckdvpH.exe
  C:\Windows\System\GckdvpH.exe
  2⤵
  PID:7040
- C:\Windows\System\EjTJvGX.exe
  C:\Windows\System\EjTJvGX.exe
  2⤵
  PID:7064
- C:\Windows\System\WfgCNYY.exe
  C:\Windows\System\WfgCNYY.exe
  2⤵
  PID:7084
- C:\Windows\System\tEfLqEM.exe
  C:\Windows\System\tEfLqEM.exe
  2⤵
  PID:7104
- C:\Windows\System\VfyZqUQ.exe
  C:\Windows\System\VfyZqUQ.exe
  2⤵
  PID:7132
- C:\Windows\System\AWrKPos.exe
  C:\Windows\System\AWrKPos.exe
  2⤵
  PID:7148
- C:\Windows\System\AzCYgQM.exe
  C:\Windows\System\AzCYgQM.exe
  2⤵
  PID:5840
- C:\Windows\System\hoPfZEI.exe
  C:\Windows\System\hoPfZEI.exe
  2⤵
  PID:5396
- C:\Windows\System\JjvkMru.exe
  C:\Windows\System\JjvkMru.exe
  2⤵
  PID:4852
- C:\Windows\System\tbmHrHE.exe
  C:\Windows\System\tbmHrHE.exe
  2⤵
  PID:5972
- C:\Windows\System\kJsxPbg.exe
  C:\Windows\System\kJsxPbg.exe
  2⤵
  PID:5280
- C:\Windows\System\gyfCiJa.exe
  C:\Windows\System\gyfCiJa.exe
  2⤵
  PID:5816
- C:\Windows\System\GQvwoxR.exe
  C:\Windows\System\GQvwoxR.exe
  2⤵
  PID:5624
- C:\Windows\System\LUOsOuo.exe
  C:\Windows\System\LUOsOuo.exe
  2⤵
  PID:5480
- C:\Windows\System\DLZIcAr.exe
  C:\Windows\System\DLZIcAr.exe
  2⤵
  PID:5608
- C:\Windows\System\BjUvoac.exe
  C:\Windows\System\BjUvoac.exe
  2⤵
  PID:5188
- C:\Windows\System\ELjbNxy.exe
  C:\Windows\System\ELjbNxy.exe
  2⤵
  PID:1860
- C:\Windows\System\UlsvmRQ.exe
  C:\Windows\System\UlsvmRQ.exe
  2⤵
  PID:6300
- C:\Windows\System\fQBRvWd.exe
  C:\Windows\System\fQBRvWd.exe
  2⤵
  PID:5132
- C:\Windows\System\lKkEhDX.exe
  C:\Windows\System\lKkEhDX.exe
  2⤵
  PID:5504
- C:\Windows\System\DxcmHXR.exe
  C:\Windows\System\DxcmHXR.exe
  2⤵
  PID:5728
- C:\Windows\System\eAJmQCG.exe
  C:\Windows\System\eAJmQCG.exe
  2⤵
  PID:6512
- C:\Windows\System\mdsMKUJ.exe
  C:\Windows\System\mdsMKUJ.exe
  2⤵
  PID:6552
- C:\Windows\System\xWDNFMA.exe
  C:\Windows\System\xWDNFMA.exe
  2⤵
  PID:6668
- C:\Windows\System\TZArIpi.exe
  C:\Windows\System\TZArIpi.exe
  2⤵
  PID:3612
- C:\Windows\System\jsgXqhI.exe
  C:\Windows\System\jsgXqhI.exe
  2⤵
  PID:2640
- C:\Windows\System\GdPKdis.exe
  C:\Windows\System\GdPKdis.exe
  2⤵
  PID:6216
- C:\Windows\System\JvKaOjw.exe
  C:\Windows\System\JvKaOjw.exe
  2⤵
  PID:6832
- C:\Windows\System\DZLwIJI.exe
  C:\Windows\System\DZLwIJI.exe
  2⤵
  PID:7180
- C:\Windows\System\lqEMVwQ.exe
  C:\Windows\System\lqEMVwQ.exe
  2⤵
  PID:7200
- C:\Windows\System\haIOzsF.exe
  C:\Windows\System\haIOzsF.exe
  2⤵
  PID:7224
- C:\Windows\System\uwHyWvI.exe
  C:\Windows\System\uwHyWvI.exe
  2⤵
  PID:7240
- C:\Windows\System\cERPPLj.exe
  C:\Windows\System\cERPPLj.exe
  2⤵
  PID:7276
- C:\Windows\System\LNXEUVa.exe
  C:\Windows\System\LNXEUVa.exe
  2⤵
  PID:7308
- C:\Windows\System\UBYVbLY.exe
  C:\Windows\System\UBYVbLY.exe
  2⤵
  PID:7336
- C:\Windows\System\voXUvCc.exe
  C:\Windows\System\voXUvCc.exe
  2⤵
  PID:7352
- C:\Windows\System\WIvqfwO.exe
  C:\Windows\System\WIvqfwO.exe
  2⤵
  PID:7372
- C:\Windows\System\EVJPaNf.exe
  C:\Windows\System\EVJPaNf.exe
  2⤵
  PID:7392
- C:\Windows\System\ygEWQOr.exe
  C:\Windows\System\ygEWQOr.exe
  2⤵
  PID:7428
- C:\Windows\System\jljpyrh.exe
  C:\Windows\System\jljpyrh.exe
  2⤵
  PID:7460
- C:\Windows\System\gxzxANJ.exe
  C:\Windows\System\gxzxANJ.exe
  2⤵
  PID:7480
- C:\Windows\System\wtRQsOw.exe
  C:\Windows\System\wtRQsOw.exe
  2⤵
  PID:7496
- C:\Windows\System\MhENYDJ.exe
  C:\Windows\System\MhENYDJ.exe
  2⤵
  PID:7512
- C:\Windows\System\dliBetm.exe
  C:\Windows\System\dliBetm.exe
  2⤵
  PID:7548
- C:\Windows\System\BGjNbuz.exe
  C:\Windows\System\BGjNbuz.exe
  2⤵
  PID:7568
- C:\Windows\System\dYLaOPv.exe
  C:\Windows\System\dYLaOPv.exe
  2⤵
  PID:7584
- C:\Windows\System\ohfEdxP.exe
  C:\Windows\System\ohfEdxP.exe
  2⤵
  PID:7612
- C:\Windows\System\IxrlUQW.exe
  C:\Windows\System\IxrlUQW.exe
  2⤵
  PID:7628
- C:\Windows\System\ALdVKrb.exe
  C:\Windows\System\ALdVKrb.exe
  2⤵
  PID:7644
- C:\Windows\System\oXxJGxY.exe
  C:\Windows\System\oXxJGxY.exe
  2⤵
  PID:7672
- C:\Windows\System\gJhMStl.exe
  C:\Windows\System\gJhMStl.exe
  2⤵
  PID:7688
- C:\Windows\System\QcnqxID.exe
  C:\Windows\System\QcnqxID.exe
  2⤵
  PID:7712
- C:\Windows\System\uxuLvWc.exe
  C:\Windows\System\uxuLvWc.exe
  2⤵
  PID:7736
- C:\Windows\System\bVehmLs.exe
  C:\Windows\System\bVehmLs.exe
  2⤵
  PID:7760
- C:\Windows\System\cMAJUeU.exe
  C:\Windows\System\cMAJUeU.exe
  2⤵
  PID:7780
- C:\Windows\System\KXrUEsh.exe
  C:\Windows\System\KXrUEsh.exe
  2⤵
  PID:7804
- C:\Windows\System\ChySSuX.exe
  C:\Windows\System\ChySSuX.exe
  2⤵
  PID:7828
- C:\Windows\System\ARNynAu.exe
  C:\Windows\System\ARNynAu.exe
  2⤵
  PID:7852
- C:\Windows\System\xGSQDQN.exe
  C:\Windows\System\xGSQDQN.exe
  2⤵
  PID:7872
- C:\Windows\System\SkXYkwK.exe
  C:\Windows\System\SkXYkwK.exe
  2⤵
  PID:7892
- C:\Windows\System\dBCuACy.exe
  C:\Windows\System\dBCuACy.exe
  2⤵
  PID:7916
- C:\Windows\System\Gowlmwx.exe
  C:\Windows\System\Gowlmwx.exe
  2⤵
  PID:7940
- C:\Windows\System\kuLxABJ.exe
  C:\Windows\System\kuLxABJ.exe
  2⤵
  PID:7960
- C:\Windows\System\TywKSFE.exe
  C:\Windows\System\TywKSFE.exe
  2⤵
  PID:7984
- C:\Windows\System\oQmGWDT.exe
  C:\Windows\System\oQmGWDT.exe
  2⤵
  PID:8008
- C:\Windows\System\GpmCQYp.exe
  C:\Windows\System\GpmCQYp.exe
  2⤵
  PID:8024
- C:\Windows\System\TICYXIT.exe
  C:\Windows\System\TICYXIT.exe
  2⤵
  PID:8048
- C:\Windows\System\uqsTRtq.exe
  C:\Windows\System\uqsTRtq.exe
  2⤵
  PID:8072
- C:\Windows\System\OrrtWkD.exe
  C:\Windows\System\OrrtWkD.exe
  2⤵
  PID:8096
- C:\Windows\System\ahSwFKj.exe
  C:\Windows\System\ahSwFKj.exe
  2⤵
  PID:8112
- C:\Windows\System\IFKVPqT.exe
  C:\Windows\System\IFKVPqT.exe
  2⤵
  PID:8136
- C:\Windows\System\jRHdSwy.exe
  C:\Windows\System\jRHdSwy.exe
  2⤵
  PID:8160
- C:\Windows\System\uQbTYSG.exe
  C:\Windows\System\uQbTYSG.exe
  2⤵
  PID:8180
- C:\Windows\System\szpeGvR.exe
  C:\Windows\System\szpeGvR.exe
  2⤵
  PID:6924
- C:\Windows\System\pEQMymF.exe
  C:\Windows\System\pEQMymF.exe
  2⤵
  PID:5928
- C:\Windows\System\GhyiFQe.exe
  C:\Windows\System\GhyiFQe.exe
  2⤵
  PID:6164
- C:\Windows\System\TeTOOEy.exe
  C:\Windows\System\TeTOOEy.exe
  2⤵
  PID:6184
- C:\Windows\System\uEBuqDb.exe
  C:\Windows\System\uEBuqDb.exe
  2⤵
  PID:6904
- C:\Windows\System\rnxJFJj.exe
  C:\Windows\System\rnxJFJj.exe
  2⤵
  PID:7220
- C:\Windows\System\CeVGPNz.exe
  C:\Windows\System\CeVGPNz.exe
  2⤵
  PID:8216
- C:\Windows\System\CRRexbn.exe
  C:\Windows\System\CRRexbn.exe
  2⤵
  PID:8236
- C:\Windows\System\GaxUwgA.exe
  C:\Windows\System\GaxUwgA.exe
  2⤵
  PID:8260
- C:\Windows\System\cVJvpQe.exe
  C:\Windows\System\cVJvpQe.exe
  2⤵
  PID:8280
- C:\Windows\System\Flaecgv.exe
  C:\Windows\System\Flaecgv.exe
  2⤵
  PID:8308
- C:\Windows\System\QUOAPbR.exe
  C:\Windows\System\QUOAPbR.exe
  2⤵
  PID:8324
- C:\Windows\System\gUlqqgm.exe
  C:\Windows\System\gUlqqgm.exe
  2⤵
  PID:8344
- C:\Windows\System\hzEVYdx.exe
  C:\Windows\System\hzEVYdx.exe
  2⤵
  PID:8368
- C:\Windows\System\pdCwMES.exe
  C:\Windows\System\pdCwMES.exe
  2⤵
  PID:8388
- C:\Windows\System\BUqYqVj.exe
  C:\Windows\System\BUqYqVj.exe
  2⤵
  PID:8412
- C:\Windows\System\zkRnQks.exe
  C:\Windows\System\zkRnQks.exe
  2⤵
  PID:8428
- C:\Windows\System\mTUMMjW.exe
  C:\Windows\System\mTUMMjW.exe
  2⤵
  PID:8448
- C:\Windows\System\hxIiYpQ.exe
  C:\Windows\System\hxIiYpQ.exe
  2⤵
  PID:8476
- C:\Windows\System\smwRKKH.exe
  C:\Windows\System\smwRKKH.exe
  2⤵
  PID:8496
- C:\Windows\System\YxaBJGN.exe
  C:\Windows\System\YxaBJGN.exe
  2⤵
  PID:8512
- C:\Windows\System\TkfWnzQ.exe
  C:\Windows\System\TkfWnzQ.exe
  2⤵
  PID:8532
- C:\Windows\System\BnGOPau.exe
  C:\Windows\System\BnGOPau.exe
  2⤵
  PID:8552
- C:\Windows\System\MpOFsaT.exe
  C:\Windows\System\MpOFsaT.exe
  2⤵
  PID:8568
- C:\Windows\System\LoHzIAe.exe
  C:\Windows\System\LoHzIAe.exe
  2⤵
  PID:8592
- C:\Windows\System\LkTssll.exe
  C:\Windows\System\LkTssll.exe
  2⤵
  PID:8612
- C:\Windows\System\hhYJAUC.exe
  C:\Windows\System\hhYJAUC.exe
  2⤵
  PID:8632
- C:\Windows\System\UXrxdnp.exe
  C:\Windows\System\UXrxdnp.exe
  2⤵
  PID:8652
- C:\Windows\System\kNnmClP.exe
  C:\Windows\System\kNnmClP.exe
  2⤵
  PID:8672
- C:\Windows\System\CwdtjHJ.exe
  C:\Windows\System\CwdtjHJ.exe
  2⤵
  PID:8700
- C:\Windows\System\PbvoONc.exe
  C:\Windows\System\PbvoONc.exe
  2⤵
  PID:8724
- C:\Windows\System\FERvlEL.exe
  C:\Windows\System\FERvlEL.exe
  2⤵
  PID:8740
- C:\Windows\System\zMDDBKN.exe
  C:\Windows\System\zMDDBKN.exe
  2⤵
  PID:8756
- C:\Windows\System\VXTIkSW.exe
  C:\Windows\System\VXTIkSW.exe
  2⤵
  PID:8772
- C:\Windows\System\mJfAdLk.exe
  C:\Windows\System\mJfAdLk.exe
  2⤵
  PID:8792
- C:\Windows\System\cRfNATC.exe
  C:\Windows\System\cRfNATC.exe
  2⤵
  PID:8816
- C:\Windows\System\SCwnyjd.exe
  C:\Windows\System\SCwnyjd.exe
  2⤵
  PID:8840
- C:\Windows\System\eEGdIrg.exe
  C:\Windows\System\eEGdIrg.exe
  2⤵
  PID:8864
- C:\Windows\System\mHbpEjJ.exe
  C:\Windows\System\mHbpEjJ.exe
  2⤵
  PID:8892
- C:\Windows\System\opnskyF.exe
  C:\Windows\System\opnskyF.exe
  2⤵
  PID:8912
- C:\Windows\System\IenonHG.exe
  C:\Windows\System\IenonHG.exe
  2⤵
  PID:8932
- C:\Windows\System\UXOHYFs.exe
  C:\Windows\System\UXOHYFs.exe
  2⤵
  PID:8956
- C:\Windows\System\BywZvSf.exe
  C:\Windows\System\BywZvSf.exe
  2⤵
  PID:8992
- C:\Windows\System\ynXtMHE.exe
  C:\Windows\System\ynXtMHE.exe
  2⤵
  PID:9208
- C:\Windows\System\aqmuDax.exe
  C:\Windows\System\aqmuDax.exe
  2⤵
  PID:6992
- C:\Windows\System\bRCsjmb.exe
  C:\Windows\System\bRCsjmb.exe
  2⤵
  PID:6324
- C:\Windows\System\lrzZfmF.exe
  C:\Windows\System\lrzZfmF.exe
  2⤵
  PID:6344
- C:\Windows\System\XSquEqn.exe
  C:\Windows\System\XSquEqn.exe
  2⤵
  PID:6388
- C:\Windows\System\UYVWqre.exe
  C:\Windows\System\UYVWqre.exe
  2⤵
  PID:6448
- C:\Windows\System\BrymUFb.exe
  C:\Windows\System\BrymUFb.exe
  2⤵
  PID:7324
- C:\Windows\System\exMPmMt.exe
  C:\Windows\System\exMPmMt.exe
  2⤵
  PID:6592
- C:\Windows\System\QEUVSdv.exe
  C:\Windows\System\QEUVSdv.exe
  2⤵
  PID:6612
- C:\Windows\System\QhyMfht.exe
  C:\Windows\System\QhyMfht.exe
  2⤵
  PID:6632
- C:\Windows\System\vdiBeou.exe
  C:\Windows\System\vdiBeou.exe
  2⤵
  PID:5584
- C:\Windows\System\mUqeMAv.exe
  C:\Windows\System\mUqeMAv.exe
  2⤵
  PID:6744
- C:\Windows\System\yFqYOoY.exe
  C:\Windows\System\yFqYOoY.exe
  2⤵
  PID:7452
- C:\Windows\System\QNTTTpn.exe
  C:\Windows\System\QNTTTpn.exe
  2⤵
  PID:6840
- C:\Windows\System\okeZTAG.exe
  C:\Windows\System\okeZTAG.exe
  2⤵
  PID:7528
- C:\Windows\System\dnZxBMh.exe
  C:\Windows\System\dnZxBMh.exe
  2⤵
  PID:7172
- C:\Windows\System\oJDvpTW.exe
  C:\Windows\System\oJDvpTW.exe
  2⤵
  PID:7604
- C:\Windows\System\UhNELqT.exe
  C:\Windows\System\UhNELqT.exe
  2⤵
  PID:7684
- C:\Windows\System\YjFfzjF.exe
  C:\Windows\System\YjFfzjF.exe
  2⤵
  PID:8004
- C:\Windows\System\iwURGUX.exe
  C:\Windows\System\iwURGUX.exe
  2⤵
  PID:8068
- C:\Windows\System\ScTPFwy.exe
  C:\Windows\System\ScTPFwy.exe
  2⤵
  PID:8172
- C:\Windows\System\LJhQhPT.exe
  C:\Windows\System\LJhQhPT.exe
  2⤵
  PID:4400
- C:\Windows\System\mSmPUpq.exe
  C:\Windows\System\mSmPUpq.exe
  2⤵
  PID:6900
- C:\Windows\System\qPUboZU.exe
  C:\Windows\System\qPUboZU.exe
  2⤵
  PID:8228
- C:\Windows\System\tqcGnIv.exe
  C:\Windows\System\tqcGnIv.exe
  2⤵
  PID:7232
- C:\Windows\System\ntsNGyk.exe
  C:\Windows\System\ntsNGyk.exe
  2⤵
  PID:8436
- C:\Windows\System\WawGTwh.exe
  C:\Windows\System\WawGTwh.exe
  2⤵
  PID:7100
- C:\Windows\System\piURcND.exe
  C:\Windows\System\piURcND.exe
  2⤵
  PID:7156
- C:\Windows\System\jSHBFCa.exe
  C:\Windows\System\jSHBFCa.exe
  2⤵
  PID:4688
- C:\Windows\System\sGjVogT.exe
  C:\Windows\System\sGjVogT.exe
  2⤵
  PID:7300
- C:\Windows\System\aIyDKij.exe
  C:\Windows\System\aIyDKij.exe
  2⤵
  PID:7792
- C:\Windows\System\wwPxEPg.exe
  C:\Windows\System\wwPxEPg.exe
  2⤵
  PID:7884
- C:\Windows\System\RByKWkl.exe
  C:\Windows\System\RByKWkl.exe
  2⤵
  PID:6496
- C:\Windows\System\hFEXsYU.exe
  C:\Windows\System\hFEXsYU.exe
  2⤵
  PID:8040
- C:\Windows\System\zNLrccT.exe
  C:\Windows\System\zNLrccT.exe
  2⤵
  PID:8200
- C:\Windows\System\iNOqbAr.exe
  C:\Windows\System\iNOqbAr.exe
  2⤵
  PID:8360
- C:\Windows\System\qfIjQwv.exe
  C:\Windows\System\qfIjQwv.exe
  2⤵
  PID:8484
- C:\Windows\System\fCoWcXR.exe
  C:\Windows\System\fCoWcXR.exe
  2⤵
  PID:5604
- C:\Windows\System\SLOaOPk.exe
  C:\Windows\System\SLOaOPk.exe
  2⤵
  PID:7416
- C:\Windows\System\EPuDixS.exe
  C:\Windows\System\EPuDixS.exe
  2⤵
  PID:6156
- C:\Windows\System\iCnqPLO.exe
  C:\Windows\System\iCnqPLO.exe
  2⤵
  PID:6368
- C:\Windows\System\GYyazth.exe
  C:\Windows\System\GYyazth.exe
  2⤵
  PID:8600
- C:\Windows\System\kHmrDvC.exe
  C:\Windows\System\kHmrDvC.exe
  2⤵
  PID:6660
- C:\Windows\System\wsIiKsd.exe
  C:\Windows\System\wsIiKsd.exe
  2⤵
  PID:7488
- C:\Windows\System\WtzrPAl.exe
  C:\Windows\System\WtzrPAl.exe
  2⤵
  PID:8696
- C:\Windows\System\MBctXjN.exe
  C:\Windows\System\MBctXjN.exe
  2⤵
  PID:8812
- C:\Windows\System\HcgqDzS.exe
  C:\Windows\System\HcgqDzS.exe
  2⤵
  PID:7580
- C:\Windows\System\tjszrFH.exe
  C:\Windows\System\tjszrFH.exe
  2⤵
  PID:7636
- C:\Windows\System\qNdHRHU.exe
  C:\Windows\System\qNdHRHU.exe
  2⤵
  PID:8984
- C:\Windows\System\GdWubeI.exe
  C:\Windows\System\GdWubeI.exe
  2⤵
  PID:9236
- C:\Windows\System\VEXigiq.exe
  C:\Windows\System\VEXigiq.exe
  2⤵
  PID:9260
- C:\Windows\System\UTlKtDr.exe
  C:\Windows\System\UTlKtDr.exe
  2⤵
  PID:9284
- C:\Windows\System\cGTyCAz.exe
  C:\Windows\System\cGTyCAz.exe
  2⤵
  PID:9312
- C:\Windows\System\nlChRnm.exe
  C:\Windows\System\nlChRnm.exe
  2⤵
  PID:9344
- C:\Windows\System\GAbajCb.exe
  C:\Windows\System\GAbajCb.exe
  2⤵
  PID:9360
- C:\Windows\System\SevrQDM.exe
  C:\Windows\System\SevrQDM.exe
  2⤵
  PID:9380
- C:\Windows\System\QSpDMlt.exe
  C:\Windows\System\QSpDMlt.exe
  2⤵
  PID:9400
- C:\Windows\System\qhdtmVs.exe
  C:\Windows\System\qhdtmVs.exe
  2⤵
  PID:9428
- C:\Windows\System\OseMJXH.exe
  C:\Windows\System\OseMJXH.exe
  2⤵
  PID:9444
- C:\Windows\System\NvpXHTg.exe
  C:\Windows\System\NvpXHTg.exe
  2⤵
  PID:9464
- C:\Windows\System\yuAAjHt.exe
  C:\Windows\System\yuAAjHt.exe
  2⤵
  PID:9484
- C:\Windows\System\hvKeKQf.exe
  C:\Windows\System\hvKeKQf.exe
  2⤵
  PID:9508
- C:\Windows\System\MDMKYlj.exe
  C:\Windows\System\MDMKYlj.exe
  2⤵
  PID:9524
- C:\Windows\System\mpeJVql.exe
  C:\Windows\System\mpeJVql.exe
  2⤵
  PID:9544
- C:\Windows\System\YHWqEkQ.exe
  C:\Windows\System\YHWqEkQ.exe
  2⤵
  PID:9564
- C:\Windows\System\UaxLnPs.exe
  C:\Windows\System\UaxLnPs.exe
  2⤵
  PID:9588
- C:\Windows\System\hpnNPsD.exe
  C:\Windows\System\hpnNPsD.exe
  2⤵
  PID:9608
- C:\Windows\System\oowFJsn.exe
  C:\Windows\System\oowFJsn.exe
  2⤵
  PID:9628
- C:\Windows\System\bzlMKvp.exe
  C:\Windows\System\bzlMKvp.exe
  2⤵
  PID:9652
- C:\Windows\System\MOWdIrK.exe
  C:\Windows\System\MOWdIrK.exe
  2⤵
  PID:9684
- C:\Windows\System\VCnoypB.exe
  C:\Windows\System\VCnoypB.exe
  2⤵
  PID:9704
- C:\Windows\System\ANUeBba.exe
  C:\Windows\System\ANUeBba.exe
  2⤵
  PID:9724
- C:\Windows\System\Uxwvacs.exe
  C:\Windows\System\Uxwvacs.exe
  2⤵
  PID:9748
- C:\Windows\System\hapwRnv.exe
  C:\Windows\System\hapwRnv.exe
  2⤵
  PID:9772
- C:\Windows\System\BfAnMig.exe
  C:\Windows\System\BfAnMig.exe
  2⤵
  PID:9792
- C:\Windows\System\GADRgCM.exe
  C:\Windows\System\GADRgCM.exe
  2⤵
  PID:9812
- C:\Windows\System\mGLvzuv.exe
  C:\Windows\System\mGLvzuv.exe
  2⤵
  PID:9836
- C:\Windows\System\vcerBSE.exe
  C:\Windows\System\vcerBSE.exe
  2⤵
  PID:9864
- C:\Windows\System\bxIJSMQ.exe
  C:\Windows\System\bxIJSMQ.exe
  2⤵
  PID:9896
- C:\Windows\System\DRlcaGT.exe
  C:\Windows\System\DRlcaGT.exe
  2⤵
  PID:9924
- C:\Windows\System\TGMhTTl.exe
  C:\Windows\System\TGMhTTl.exe
  2⤵
  PID:9944
- C:\Windows\System\wdPxitx.exe
  C:\Windows\System\wdPxitx.exe
  2⤵
  PID:9968
- C:\Windows\System\quBSglY.exe
  C:\Windows\System\quBSglY.exe
  2⤵
  PID:9992
- C:\Windows\System\eBeFMwg.exe
  C:\Windows\System\eBeFMwg.exe
  2⤵
  PID:10012
- C:\Windows\System\RBfRfUV.exe
  C:\Windows\System\RBfRfUV.exe
  2⤵
  PID:10032
- C:\Windows\System\vJLKmsQ.exe
  C:\Windows\System\vJLKmsQ.exe
  2⤵
  PID:10056
- C:\Windows\System\DlqNgIK.exe
  C:\Windows\System\DlqNgIK.exe
  2⤵
  PID:10080
- C:\Windows\System\pxucoJb.exe
  C:\Windows\System\pxucoJb.exe
  2⤵
  PID:10104
- C:\Windows\System\nRfemPc.exe
  C:\Windows\System\nRfemPc.exe
  2⤵
  PID:10124
- C:\Windows\System\KGPJTvy.exe
  C:\Windows\System\KGPJTvy.exe
  2⤵
  PID:10152
- C:\Windows\System\AunBxtZ.exe
  C:\Windows\System\AunBxtZ.exe
  2⤵
  PID:10180
- C:\Windows\System\XNVzMAF.exe
  C:\Windows\System\XNVzMAF.exe
  2⤵
  PID:10196
- C:\Windows\System\iccuOFG.exe
  C:\Windows\System\iccuOFG.exe
  2⤵
  PID:10216
- C:\Windows\System\UgDcuvW.exe
  C:\Windows\System\UgDcuvW.exe
  2⤵
  PID:10232
- C:\Windows\System\JZJjGcz.exe
  C:\Windows\System\JZJjGcz.exe
  2⤵
  PID:7732
- C:\Windows\System\aqUNlkW.exe
  C:\Windows\System\aqUNlkW.exe
  2⤵
  PID:8268
- C:\Windows\System\LwXSjJE.exe
  C:\Windows\System\LwXSjJE.exe
  2⤵
  PID:9196
- C:\Windows\System\NyMhomn.exe
  C:\Windows\System\NyMhomn.exe
  2⤵
  PID:7036
- C:\Windows\System\cYCTUZX.exe
  C:\Windows\System\cYCTUZX.exe
  2⤵
  PID:6444
- C:\Windows\System\Icskscr.exe
  C:\Windows\System\Icskscr.exe
  2⤵
  PID:7348
- C:\Windows\System\ReGbqkL.exe
  C:\Windows\System\ReGbqkL.exe
  2⤵
  PID:8640
- C:\Windows\System\omQxmWk.exe
  C:\Windows\System\omQxmWk.exe
  2⤵
  PID:6508
- C:\Windows\System\TGCfqDu.exe
  C:\Windows\System\TGCfqDu.exe
  2⤵
  PID:8784
- C:\Windows\System\imoptfB.exe
  C:\Windows\System\imoptfB.exe
  2⤵
  PID:7928
- C:\Windows\System\QoPenkF.exe
  C:\Windows\System\QoPenkF.exe
  2⤵
  PID:8156
- C:\Windows\System\qnrdNvN.exe
  C:\Windows\System\qnrdNvN.exe
  2⤵
  PID:10252
- C:\Windows\System\zqgdPpJ.exe
  C:\Windows\System\zqgdPpJ.exe
  2⤵
  PID:10272
- C:\Windows\System\McPtffK.exe
  C:\Windows\System\McPtffK.exe
  2⤵
  PID:10292
- C:\Windows\System\MSbPCzR.exe
  C:\Windows\System\MSbPCzR.exe
  2⤵
  PID:10316
- C:\Windows\System\NBQTYrs.exe
  C:\Windows\System\NBQTYrs.exe
  2⤵
  PID:10340
- C:\Windows\System\ffeIqNa.exe
  C:\Windows\System\ffeIqNa.exe
  2⤵
  PID:10360
- C:\Windows\System\NpcTmrt.exe
  C:\Windows\System\NpcTmrt.exe
  2⤵
  PID:10380
- C:\Windows\System\twFskHa.exe
  C:\Windows\System\twFskHa.exe
  2⤵
  PID:10404
- C:\Windows\System\EZsAMKj.exe
  C:\Windows\System\EZsAMKj.exe
  2⤵
  PID:10428
- C:\Windows\System\CJDUdcr.exe
  C:\Windows\System\CJDUdcr.exe
  2⤵
  PID:10448
- C:\Windows\System\CFofnGt.exe
  C:\Windows\System\CFofnGt.exe
  2⤵
  PID:10468
- C:\Windows\System\aJkygow.exe
  C:\Windows\System\aJkygow.exe
  2⤵
  PID:10488
- C:\Windows\System\PkvOTLz.exe
  C:\Windows\System\PkvOTLz.exe
  2⤵
  PID:10512
- C:\Windows\System\UKyINpM.exe
  C:\Windows\System\UKyINpM.exe
  2⤵
  PID:10532
- C:\Windows\System\AavzNGq.exe
  C:\Windows\System\AavzNGq.exe
  2⤵
  PID:10556
- C:\Windows\System\oSlAPyE.exe
  C:\Windows\System\oSlAPyE.exe
  2⤵
  PID:10576
- C:\Windows\System\xUZTzZW.exe
  C:\Windows\System\xUZTzZW.exe
  2⤵
  PID:10600
- C:\Windows\System\lQtHZBH.exe
  C:\Windows\System\lQtHZBH.exe
  2⤵
  PID:10624
- C:\Windows\System\YhwwsKf.exe
  C:\Windows\System\YhwwsKf.exe
  2⤵
  PID:10640
- C:\Windows\System\XQaxmay.exe
  C:\Windows\System\XQaxmay.exe
  2⤵
  PID:10660
- C:\Windows\System\LGXjMNI.exe
  C:\Windows\System\LGXjMNI.exe
  2⤵
  PID:10680
- C:\Windows\System\xKgXLht.exe
  C:\Windows\System\xKgXLht.exe
  2⤵
  PID:10704
- C:\Windows\System\ZMadAwU.exe
  C:\Windows\System\ZMadAwU.exe
  2⤵
  PID:10720
- C:\Windows\System\yNCOChH.exe
  C:\Windows\System\yNCOChH.exe
  2⤵
  PID:10748
- C:\Windows\System\ZDoChaU.exe
  C:\Windows\System\ZDoChaU.exe
  2⤵
  PID:10764
- C:\Windows\System\NKEUngy.exe
  C:\Windows\System\NKEUngy.exe
  2⤵
  PID:10796
- C:\Windows\System\wAfAdjy.exe
  C:\Windows\System\wAfAdjy.exe
  2⤵
  PID:10816
- C:\Windows\System\xQxOtXR.exe
  C:\Windows\System\xQxOtXR.exe
  2⤵
  PID:10848
- C:\Windows\System\ytxzwem.exe
  C:\Windows\System\ytxzwem.exe
  2⤵
  PID:10868
- C:\Windows\System\KLtsoRO.exe
  C:\Windows\System\KLtsoRO.exe
  2⤵
  PID:10888
- C:\Windows\System\JCDXsog.exe
  C:\Windows\System\JCDXsog.exe
  2⤵
  PID:10916
- C:\Windows\System\xUBshDl.exe
  C:\Windows\System\xUBshDl.exe
  2⤵
  PID:10940
- C:\Windows\System\ALTpXcj.exe
  C:\Windows\System\ALTpXcj.exe
  2⤵
  PID:10960
- C:\Windows\System\xGOxjuI.exe
  C:\Windows\System\xGOxjuI.exe
  2⤵
  PID:10980
- C:\Windows\System\yDocnJa.exe
  C:\Windows\System\yDocnJa.exe
  2⤵
  PID:11008
- C:\Windows\System\QnbYUvM.exe
  C:\Windows\System\QnbYUvM.exe
  2⤵
  PID:11028
- C:\Windows\System\jsGSSkR.exe
  C:\Windows\System\jsGSSkR.exe
  2⤵
  PID:11048
- C:\Windows\System\yhfQrMq.exe
  C:\Windows\System\yhfQrMq.exe
  2⤵
  PID:11072
- C:\Windows\System\jPtgDZx.exe
  C:\Windows\System\jPtgDZx.exe
  2⤵
  PID:11096
- C:\Windows\System\KpOyTLD.exe
  C:\Windows\System\KpOyTLD.exe
  2⤵
  PID:11116
- C:\Windows\System\qVFTyFV.exe
  C:\Windows\System\qVFTyFV.exe
  2⤵
  PID:11140
- C:\Windows\System\idHfluU.exe
  C:\Windows\System\idHfluU.exe
  2⤵
  PID:11160
- C:\Windows\System\aoPQlAM.exe
  C:\Windows\System\aoPQlAM.exe
  2⤵
  PID:11192
- C:\Windows\System\WPOslOl.exe
  C:\Windows\System\WPOslOl.exe
  2⤵
  PID:11212
- C:\Windows\System\jLLyywE.exe
  C:\Windows\System\jLLyywE.exe
  2⤵
  PID:11232
- C:\Windows\System\iHXinwj.exe
  C:\Windows\System\iHXinwj.exe
  2⤵
  PID:11256
- C:\Windows\System\DkEbpmP.exe
  C:\Windows\System\DkEbpmP.exe
  2⤵
  PID:8080
- C:\Windows\System\puPRjit.exe
  C:\Windows\System\puPRjit.exe
  2⤵
  PID:1572
- C:\Windows\System\cgBbYGK.exe
  C:\Windows\System\cgBbYGK.exe
  2⤵
  PID:8580
- C:\Windows\System\gaGBNsi.exe
  C:\Windows\System\gaGBNsi.exe
  2⤵
  PID:8848
- C:\Windows\System\jarEzoQ.exe
  C:\Windows\System\jarEzoQ.exe
  2⤵
  PID:9256
- C:\Windows\System\BmlXHNc.exe
  C:\Windows\System\BmlXHNc.exe
  2⤵
  PID:7708
- C:\Windows\System\nwtbYfx.exe
  C:\Windows\System\nwtbYfx.exe
  2⤵
  PID:9356
- C:\Windows\System\MxCOweX.exe
  C:\Windows\System\MxCOweX.exe
  2⤵
  PID:7820
- C:\Windows\System\SJxaDbi.exe
  C:\Windows\System\SJxaDbi.exe
  2⤵
  PID:7864
- C:\Windows\System\FZmumGs.exe
  C:\Windows\System\FZmumGs.exe
  2⤵
  PID:7888
- C:\Windows\System\HDWtHqM.exe
  C:\Windows\System\HDWtHqM.exe
  2⤵
  PID:7992
- C:\Windows\System\PLJXooI.exe
  C:\Windows\System\PLJXooI.exe
  2⤵
  PID:8020
- C:\Windows\System\WwAlUMD.exe
  C:\Windows\System\WwAlUMD.exe
  2⤵
  PID:9624
- C:\Windows\System\TVjUibW.exe
  C:\Windows\System\TVjUibW.exe
  2⤵
  PID:8352
- C:\Windows\System\CZamYSg.exe
  C:\Windows\System\CZamYSg.exe
  2⤵
  PID:9716
- C:\Windows\System\sykjssH.exe
  C:\Windows\System\sykjssH.exe
  2⤵
  PID:9780
- C:\Windows\System\OxtMFXK.exe
  C:\Windows\System\OxtMFXK.exe
  2⤵
  PID:9844
- C:\Windows\System\fdxotZf.exe
  C:\Windows\System\fdxotZf.exe
  2⤵
  PID:8524
- C:\Windows\System\Zmfgnik.exe
  C:\Windows\System\Zmfgnik.exe
  2⤵
  PID:7752
- C:\Windows\System\lRKkJih.exe
  C:\Windows\System\lRKkJih.exe
  2⤵
  PID:9952
- C:\Windows\System\xFDGUxc.exe
  C:\Windows\System\xFDGUxc.exe
  2⤵
  PID:10048
- C:\Windows\System\PfDkRty.exe
  C:\Windows\System\PfDkRty.exe
  2⤵
  PID:11276
- C:\Windows\System\PmprAGP.exe
  C:\Windows\System\PmprAGP.exe
  2⤵
  PID:11304
- C:\Windows\System\VYuMmLO.exe
  C:\Windows\System\VYuMmLO.exe
  2⤵
  PID:11320
- C:\Windows\System\SHsTdEs.exe
  C:\Windows\System\SHsTdEs.exe
  2⤵
  PID:11340
- C:\Windows\System\VufRxso.exe
  C:\Windows\System\VufRxso.exe
  2⤵
  PID:11356
- C:\Windows\System\fNVWKfb.exe
  C:\Windows\System\fNVWKfb.exe
  2⤵
  PID:11376
- C:\Windows\System\WREHOTz.exe
  C:\Windows\System\WREHOTz.exe
  2⤵
  PID:11400
- C:\Windows\System\pBFrngT.exe
  C:\Windows\System\pBFrngT.exe
  2⤵
  PID:11424
- C:\Windows\System\qFRPaFL.exe
  C:\Windows\System\qFRPaFL.exe
  2⤵
  PID:11444
- C:\Windows\System\UddWZbj.exe
  C:\Windows\System\UddWZbj.exe
  2⤵
  PID:11468
- C:\Windows\System\XHqZdgk.exe
  C:\Windows\System\XHqZdgk.exe
  2⤵
  PID:11496
- C:\Windows\System\RTOdCOW.exe
  C:\Windows\System\RTOdCOW.exe
  2⤵
  PID:11516
- C:\Windows\System\ZwOBYDu.exe
  C:\Windows\System\ZwOBYDu.exe
  2⤵
  PID:11540
- C:\Windows\System\jAVHBzs.exe
  C:\Windows\System\jAVHBzs.exe
  2⤵
  PID:11560
- C:\Windows\System\SYEjztN.exe
  C:\Windows\System\SYEjztN.exe
  2⤵
  PID:11584
- C:\Windows\System\kNldYGV.exe
  C:\Windows\System\kNldYGV.exe
  2⤵
  PID:11604
- C:\Windows\System\bOmnpAZ.exe
  C:\Windows\System\bOmnpAZ.exe
  2⤵
  PID:11624
- C:\Windows\System\tblrlLN.exe
  C:\Windows\System\tblrlLN.exe
  2⤵
  PID:11644
- C:\Windows\System\qmVvMFn.exe
  C:\Windows\System\qmVvMFn.exe
  2⤵
  PID:11668
- C:\Windows\System\SXfDkcJ.exe
  C:\Windows\System\SXfDkcJ.exe
  2⤵
  PID:11688
- C:\Windows\System\RNcFPaq.exe
  C:\Windows\System\RNcFPaq.exe
  2⤵
  PID:11712
- C:\Windows\System\lEnCnPi.exe
  C:\Windows\System\lEnCnPi.exe
  2⤵
  PID:11728
- C:\Windows\System\ruQrLOx.exe
  C:\Windows\System\ruQrLOx.exe
  2⤵
  PID:11752
- C:\Windows\System\xBrWYZY.exe
  C:\Windows\System\xBrWYZY.exe
  2⤵
  PID:11776
- C:\Windows\System\mBkOtFy.exe
  C:\Windows\System\mBkOtFy.exe
  2⤵
  PID:11796
- C:\Windows\System\oOKLmtl.exe
  C:\Windows\System\oOKLmtl.exe
  2⤵
  PID:11820
- C:\Windows\System\YGCbkqD.exe
  C:\Windows\System\YGCbkqD.exe
  2⤵
  PID:11840
- C:\Windows\System\FHrFUwg.exe
  C:\Windows\System\FHrFUwg.exe
  2⤵
  PID:11860
- C:\Windows\System\qZEhfLl.exe
  C:\Windows\System\qZEhfLl.exe
  2⤵
  PID:11884
- C:\Windows\System\zYNXmOo.exe
  C:\Windows\System\zYNXmOo.exe
  2⤵
  PID:11908
- C:\Windows\System\VJYVLfd.exe
  C:\Windows\System\VJYVLfd.exe
  2⤵
  PID:11928
- C:\Windows\System\zootxAL.exe
  C:\Windows\System\zootxAL.exe
  2⤵
  PID:11948
- C:\Windows\System\dvmFapq.exe
  C:\Windows\System\dvmFapq.exe
  2⤵
  PID:11964
- C:\Windows\System\rXscpiG.exe
  C:\Windows\System\rXscpiG.exe
  2⤵
  PID:11984
- C:\Windows\System\RXcejsM.exe
  C:\Windows\System\RXcejsM.exe
  2⤵
  PID:12008
- C:\Windows\System\atwRFfq.exe
  C:\Windows\System\atwRFfq.exe
  2⤵
  PID:12032
- C:\Windows\System\aRuVCsl.exe
  C:\Windows\System\aRuVCsl.exe
  2⤵
  PID:12048
- C:\Windows\System\LNGWqMu.exe
  C:\Windows\System\LNGWqMu.exe
  2⤵
  PID:12068
- C:\Windows\System\iXOUvhb.exe
  C:\Windows\System\iXOUvhb.exe
  2⤵
  PID:12092
- C:\Windows\System\LtoqZFw.exe
  C:\Windows\System\LtoqZFw.exe
  2⤵
  PID:12116
- C:\Windows\System\uohkAne.exe
  C:\Windows\System\uohkAne.exe
  2⤵
  PID:12136
- C:\Windows\System\YPMikcs.exe
  C:\Windows\System\YPMikcs.exe
  2⤵
  PID:12156
- C:\Windows\System\APKntHa.exe
  C:\Windows\System\APKntHa.exe
  2⤵
  PID:12176
- C:\Windows\System\PTtDiCW.exe
  C:\Windows\System\PTtDiCW.exe
  2⤵
  PID:12196
- C:\Windows\System\wQtzoqR.exe
  C:\Windows\System\wQtzoqR.exe
  2⤵
  PID:12216
- C:\Windows\System\RhGNybw.exe
  C:\Windows\System\RhGNybw.exe
  2⤵
  PID:12240
- C:\Windows\System\XaBuUxR.exe
  C:\Windows\System\XaBuUxR.exe
  2⤵
  PID:12260
- C:\Windows\System\PeTEEwy.exe
  C:\Windows\System\PeTEEwy.exe
  2⤵
  PID:12280
- C:\Windows\System\CsmWJng.exe
  C:\Windows\System\CsmWJng.exe
  2⤵
  PID:10164
- C:\Windows\System\wWYtoKX.exe
  C:\Windows\System\wWYtoKX.exe
  2⤵
  PID:8720
- C:\Windows\System\vaIgIZn.exe
  C:\Windows\System\vaIgIZn.exe
  2⤵
  PID:8292
- C:\Windows\System\lMtBZcw.exe
  C:\Windows\System\lMtBZcw.exe
  2⤵
  PID:7652
- C:\Windows\System\cxfEFfS.exe
  C:\Windows\System\cxfEFfS.exe
  2⤵
  PID:6308
- C:\Windows\System\osRtkZb.exe
  C:\Windows\System\osRtkZb.exe
  2⤵
  PID:8044
- C:\Windows\System\lJvtdJu.exe
  C:\Windows\System\lJvtdJu.exe
  2⤵
  PID:6072
- C:\Windows\System\tjVYqZb.exe
  C:\Windows\System\tjVYqZb.exe
  2⤵
  PID:7468
- C:\Windows\System\XUrKmYa.exe
  C:\Windows\System\XUrKmYa.exe
  2⤵
  PID:7208
- C:\Windows\System\YCOTMRv.exe
  C:\Windows\System\YCOTMRv.exe
  2⤵
  PID:7116
- C:\Windows\System\mkPyOEb.exe
  C:\Windows\System\mkPyOEb.exe
  2⤵
  PID:8404
- C:\Windows\System\BcbhyZh.exe
  C:\Windows\System\BcbhyZh.exe
  2⤵
  PID:8884
- C:\Windows\System\yXdCmPF.exe
  C:\Windows\System\yXdCmPF.exe
  2⤵
  PID:10268
- C:\Windows\System\OFWRrgQ.exe
  C:\Windows\System\OFWRrgQ.exe
  2⤵
  PID:7996
- C:\Windows\System\xYDMDNL.exe
  C:\Windows\System\xYDMDNL.exe
  2⤵
  PID:8464
- C:\Windows\System\GVSvOMd.exe
  C:\Windows\System\GVSvOMd.exe
  2⤵
  PID:5952
- C:\Windows\System\ioOqGZR.exe
  C:\Windows\System\ioOqGZR.exe
  2⤵
  PID:10520
- C:\Windows\System\SqXjSWV.exe
  C:\Windows\System\SqXjSWV.exe
  2⤵
  PID:10544
- C:\Windows\System\rTIkKlp.exe
  C:\Windows\System\rTIkKlp.exe
  2⤵
  PID:7620
- C:\Windows\System\zJPdiDO.exe
  C:\Windows\System\zJPdiDO.exe
  2⤵
  PID:9328
- C:\Windows\System\RCikpIO.exe
  C:\Windows\System\RCikpIO.exe
  2⤵
  PID:10716
- C:\Windows\System\WFjCVnl.exe
  C:\Windows\System\WFjCVnl.exe
  2⤵
  PID:10760
- C:\Windows\System\xOkHwRw.exe
  C:\Windows\System\xOkHwRw.exe
  2⤵
  PID:10784
- C:\Windows\System\QkkPaHZ.exe
  C:\Windows\System\QkkPaHZ.exe
  2⤵
  PID:9460
- C:\Windows\System\xgyiNcL.exe
  C:\Windows\System\xgyiNcL.exe
  2⤵
  PID:10864
- C:\Windows\System\hgBywwz.exe
  C:\Windows\System\hgBywwz.exe
  2⤵
  PID:12308
- C:\Windows\System\GaXNQsb.exe
  C:\Windows\System\GaXNQsb.exe
  2⤵
  PID:12328
- C:\Windows\System\tQVzrxX.exe
  C:\Windows\System\tQVzrxX.exe
  2⤵
  PID:12356
- C:\Windows\System\HMBUfps.exe
  C:\Windows\System\HMBUfps.exe
  2⤵
  PID:12376
- C:\Windows\System\jLVgDLp.exe
  C:\Windows\System\jLVgDLp.exe
  2⤵
  PID:12396
- C:\Windows\System\qZgvPho.exe
  C:\Windows\System\qZgvPho.exe
  2⤵
  PID:13132
- C:\Windows\System\nFopaJe.exe
  C:\Windows\System\nFopaJe.exe
  2⤵
  PID:13168
- C:\Windows\System\eTHbAPE.exe
  C:\Windows\System\eTHbAPE.exe
  2⤵
  PID:13208
- C:\Windows\System\yeHXEXz.exe
  C:\Windows\System\yeHXEXz.exe
  2⤵
  PID:13228
- C:\Windows\System\jkLUOHm.exe
  C:\Windows\System\jkLUOHm.exe
  2⤵
  PID:13248
- C:\Windows\System\OEfMEGd.exe
  C:\Windows\System\OEfMEGd.exe
  2⤵
  PID:13272
- C:\Windows\System\nObKDmW.exe
  C:\Windows\System\nObKDmW.exe
  2⤵
  PID:13296
- C:\Windows\System\GIBzVAj.exe
  C:\Windows\System\GIBzVAj.exe
  2⤵
  PID:10908
- C:\Windows\System\MBNWnxj.exe
  C:\Windows\System\MBNWnxj.exe
  2⤵
  PID:9692
- C:\Windows\System\rRxflSf.exe
  C:\Windows\System\rRxflSf.exe
  2⤵
  PID:9232
- C:\Windows\System\TEyRKxa.exe
  C:\Windows\System\TEyRKxa.exe
  2⤵
  PID:1616
- C:\Windows\System\gPOPvNy.exe
  C:\Windows\System\gPOPvNy.exe
  2⤵
  PID:7840
- C:\Windows\System\aVkNMzn.exe
  C:\Windows\System\aVkNMzn.exe
  2⤵
  PID:9912
- C:\Windows\System\vSKmAfC.exe
  C:\Windows\System\vSKmAfC.exe
  2⤵
  PID:6420
- C:\Windows\System\QvDcqNI.exe
  C:\Windows\System\QvDcqNI.exe
  2⤵
  PID:11312
- C:\Windows\System\FnlEplI.exe
  C:\Windows\System\FnlEplI.exe
  2⤵
  PID:132
- C:\Windows\System\HoLvPSz.exe
  C:\Windows\System\HoLvPSz.exe
  2⤵
  PID:6160
- C:\Windows\System\tAWThXr.exe
  C:\Windows\System\tAWThXr.exe
  2⤵
  PID:11620
- C:\Windows\System\ykvMAtV.exe
  C:\Windows\System\ykvMAtV.exe
  2⤵
  PID:11788
- C:\Windows\System\AUYJKwK.exe
  C:\Windows\System\AUYJKwK.exe
  2⤵
  PID:11836
- C:\Windows\System\kEdsqHQ.exe
  C:\Windows\System\kEdsqHQ.exe
  2⤵
  PID:3992
- C:\Windows\System\rxZqpUk.exe
  C:\Windows\System\rxZqpUk.exe
  2⤵
  PID:7076
- C:\Windows\System\gLZmCrN.exe
  C:\Windows\System\gLZmCrN.exe
  2⤵
  PID:12040
- C:\Windows\System\EixGXbn.exe
  C:\Windows\System\EixGXbn.exe
  2⤵
  PID:12088
- C:\Windows\System\iErtSmm.exe
  C:\Windows\System\iErtSmm.exe
  2⤵
  PID:12132
- C:\Windows\System\kKlOqfe.exe
  C:\Windows\System\kKlOqfe.exe
  2⤵
  PID:12184
- C:\Windows\System\uEPNpVu.exe
  C:\Windows\System\uEPNpVu.exe
  2⤵
  PID:10440
- C:\Windows\System\cFPlFUE.exe
  C:\Windows\System\cFPlFUE.exe
  2⤵
  PID:10092
- C:\Windows\System\YFIjays.exe
  C:\Windows\System\YFIjays.exe
  2⤵
  PID:8832
- C:\Windows\System\YvSphki.exe
  C:\Windows\System\YvSphki.exe
  2⤵
  PID:6536
- C:\Windows\System\iQtwUBS.exe
  C:\Windows\System\iQtwUBS.exe
  2⤵
  PID:9424
- C:\Windows\System\wXfDDAy.exe
  C:\Windows\System\wXfDDAy.exe
  2⤵
  PID:10008
- C:\Windows\System\gBySCuZ.exe
  C:\Windows\System\gBySCuZ.exe
  2⤵
  PID:9988
- C:\Windows\System\hbsSDPo.exe
  C:\Windows\System\hbsSDPo.exe
  2⤵
  PID:11288
- C:\Windows\System\SJygmrO.exe
  C:\Windows\System\SJygmrO.exe
  2⤵
  PID:10088
- C:\Windows\System\pEgvXFi.exe
  C:\Windows\System\pEgvXFi.exe
  2⤵
  PID:11352
- C:\Windows\System\iCMYjTI.exe
  C:\Windows\System\iCMYjTI.exe
  2⤵
  PID:10204
- C:\Windows\System\zMzojyT.exe
  C:\Windows\System\zMzojyT.exe
  2⤵
  PID:10224
- C:\Windows\System\zMzAAml.exe
  C:\Windows\System\zMzAAml.exe
  2⤵
  PID:12676
- C:\Windows\System\tHEEHjP.exe
  C:\Windows\System\tHEEHjP.exe
  2⤵
  PID:11792
- C:\Windows\System\ADMCRTl.exe
  C:\Windows\System\ADMCRTl.exe
  2⤵
  PID:11852
- C:\Windows\System\kBoSGLf.exe
  C:\Windows\System\kBoSGLf.exe
  2⤵
  PID:11944
- C:\Windows\System\RtrIEij.exe
  C:\Windows\System\RtrIEij.exe
  2⤵
  PID:10332
- C:\Windows\System\MiYefYf.exe
  C:\Windows\System\MiYefYf.exe
  2⤵
  PID:8088
- C:\Windows\System\xgdQKmR.exe
  C:\Windows\System\xgdQKmR.exe
  2⤵
  PID:10648
- C:\Windows\System\NzvIGFd.exe
  C:\Windows\System\NzvIGFd.exe
  2⤵
  PID:10692
- C:\Windows\System\VUxtwrQ.exe
  C:\Windows\System\VUxtwrQ.exe
  2⤵
  PID:12772
- C:\Windows\System\dodqbVj.exe
  C:\Windows\System\dodqbVj.exe
  2⤵
  PID:10952
- C:\Windows\System\sgvLgmZ.exe
  C:\Windows\System\sgvLgmZ.exe
  2⤵
  PID:10976
- C:\Windows\System\IOgbujh.exe
  C:\Windows\System\IOgbujh.exe
  2⤵
  PID:11080
- C:\Windows\System\aifVLNG.exe
  C:\Windows\System\aifVLNG.exe
  2⤵
  PID:11112
- C:\Windows\System\MjLbGYF.exe
  C:\Windows\System\MjLbGYF.exe
  2⤵
  PID:11148
- C:\Windows\System\rsJVYZk.exe
  C:\Windows\System\rsJVYZk.exe
  2⤵
  PID:11200
- C:\Windows\System\WzIphFZ.exe
  C:\Windows\System\WzIphFZ.exe
  2⤵
  PID:5844
- C:\Windows\System\vfWSFkg.exe
  C:\Windows\System\vfWSFkg.exe
  2⤵
  PID:9412
- C:\Windows\System\IsWIJce.exe
  C:\Windows\System\IsWIJce.exe
  2⤵
  PID:7976
- C:\Windows\System\QMzUGaJ.exe
  C:\Windows\System\QMzUGaJ.exe
  2⤵
  PID:9804
- C:\Windows\System\GMAUVpv.exe
  C:\Windows\System\GMAUVpv.exe
  2⤵
  PID:11456
- C:\Windows\System\jKFgUiU.exe
  C:\Windows\System\jKFgUiU.exe
  2⤵
  PID:11576
- C:\Windows\System\KsLjgvB.exe
  C:\Windows\System\KsLjgvB.exe
  2⤵
  PID:11748
- C:\Windows\System\OaDNKgC.exe
  C:\Windows\System\OaDNKgC.exe
  2⤵
  PID:11992
- C:\Windows\System\bqRgiZH.exe
  C:\Windows\System\bqRgiZH.exe
  2⤵
  PID:12212
- C:\Windows\System\UufZvxW.exe
  C:\Windows\System\UufZvxW.exe
  2⤵
  PID:8364
- C:\Windows\System\UybeNzW.exe
  C:\Windows\System\UybeNzW.exe
  2⤵
  PID:12348
- C:\Windows\System\moEshmL.exe
  C:\Windows\System\moEshmL.exe
  2⤵
  PID:12412
- C:\Windows\System\olLeOxy.exe
  C:\Windows\System\olLeOxy.exe
  2⤵
  PID:12520
- C:\Windows\System\ecymUtt.exe
  C:\Windows\System\ecymUtt.exe
  2⤵
  PID:12592
- C:\Windows\System\rTxetQy.exe
  C:\Windows\System\rTxetQy.exe
  2⤵
  PID:12868
- C:\Windows\System\zAGVMjt.exe
  C:\Windows\System\zAGVMjt.exe
  2⤵
  PID:12940
- C:\Windows\System\XeyWbbz.exe
  C:\Windows\System\XeyWbbz.exe
  2⤵
  PID:12972
- C:\Windows\System\duxOSDN.exe
  C:\Windows\System\duxOSDN.exe
  2⤵
  PID:12996
- C:\Windows\System\mTtdZbe.exe
  C:\Windows\System\mTtdZbe.exe
  2⤵
  PID:13016
- C:\Windows\System\bDNiRav.exe
  C:\Windows\System\bDNiRav.exe
  2⤵
  PID:13036
- C:\Windows\System\XAjKWeU.exe
  C:\Windows\System\XAjKWeU.exe
  2⤵
  PID:13060
- C:\Windows\System\MEeNPHs.exe
  C:\Windows\System\MEeNPHs.exe
  2⤵
  PID:12980
- C:\Windows\System\dNJXIRw.exe
  C:\Windows\System\dNJXIRw.exe
  2⤵
  PID:12928
- C:\Windows\System\dImMkkm.exe
  C:\Windows\System\dImMkkm.exe
  2⤵
  PID:13100
- C:\Windows\System\iyKIfRu.exe
  C:\Windows\System\iyKIfRu.exe
  2⤵
  PID:13044
- C:\Windows\System\pNeKEAM.exe
  C:\Windows\System\pNeKEAM.exe
  2⤵
  PID:13176
- C:\Windows\System\bpuhDbd.exe
  C:\Windows\System\bpuhDbd.exe
  2⤵
  PID:11056
- C:\Windows\System\cYCZwpi.exe
  C:\Windows\System\cYCZwpi.exe
  2⤵
  PID:9696
- C:\Windows\System\OAsaTcu.exe
  C:\Windows\System\OAsaTcu.exe
  2⤵
  PID:10004
- C:\Windows\System\hdSXoix.exe
  C:\Windows\System\hdSXoix.exe
  2⤵
  PID:9832
- C:\Windows\System\NSsjymn.exe
  C:\Windows\System\NSsjymn.exe
  2⤵
  PID:11368
- C:\Windows\System\GENhHzw.exe
  C:\Windows\System\GENhHzw.exe
  2⤵
  PID:11412
- C:\Windows\System\MiBZHyR.exe
  C:\Windows\System\MiBZHyR.exe
  2⤵
  PID:11640
- C:\Windows\System\dQgbKGF.exe
  C:\Windows\System\dQgbKGF.exe
  2⤵
  PID:13308
- C:\Windows\System\aZGwqut.exe
  C:\Windows\System\aZGwqut.exe
  2⤵
  PID:9920
- C:\Windows\System\pTHUHCs.exe
  C:\Windows\System\pTHUHCs.exe
  2⤵
  PID:6092
- C:\Windows\System\YONlotc.exe
  C:\Windows\System\YONlotc.exe
  2⤵
  PID:10712
- C:\Windows\System\ofHKezc.exe
  C:\Windows\System\ofHKezc.exe
  2⤵
  PID:12904
- C:\Windows\System\qpjWXXm.exe
  C:\Windows\System\qpjWXXm.exe
  2⤵
  PID:12640
- C:\Windows\System\jZojQMJ.exe
  C:\Windows\System\jZojQMJ.exe
  2⤵
  PID:11636
- C:\Windows\System\EfGbPgL.exe
  C:\Windows\System\EfGbPgL.exe
  2⤵
  PID:11868
- C:\Windows\System\FduhHiN.exe
  C:\Windows\System\FduhHiN.exe
  2⤵
  PID:11960
- C:\Windows\System\HilPtMh.exe
  C:\Windows\System\HilPtMh.exe
  2⤵
  PID:2860
- C:\Windows\System\oBOVfRQ.exe
  C:\Windows\System\oBOVfRQ.exe
  2⤵
  PID:12272
- C:\Windows\System\pdilJmf.exe
  C:\Windows\System\pdilJmf.exe
  2⤵
  PID:13292
- C:\Windows\System\EOMaQzT.exe
  C:\Windows\System\EOMaQzT.exe
  2⤵
  PID:8492
- C:\Windows\System\FpNyGSs.exe
  C:\Windows\System\FpNyGSs.exe
  2⤵
  PID:9908
- C:\Windows\System\GkCPCgZ.exe
  C:\Windows\System\GkCPCgZ.exe
  2⤵
  PID:10068
- C:\Windows\System\RwEpIFp.exe
  C:\Windows\System\RwEpIFp.exe
  2⤵
  PID:10192
- C:\Windows\System\ZImaxtP.exe
  C:\Windows\System\ZImaxtP.exe
  2⤵
  PID:12024
- C:\Windows\System\XvKGgLY.exe
  C:\Windows\System\XvKGgLY.exe
  2⤵
  PID:11760
- C:\Windows\System\jSCLgMr.exe
  C:\Windows\System\jSCLgMr.exe
  2⤵
  PID:4676
- C:\Windows\System\UyUiMEF.exe
  C:\Windows\System\UyUiMEF.exe
  2⤵
  PID:10416
- C:\Windows\System\rxyieHz.exe
  C:\Windows\System\rxyieHz.exe
  2⤵
  PID:6588
- C:\Windows\System\fmbvbcJ.exe
  C:\Windows\System\fmbvbcJ.exe
  2⤵
  PID:7144
- C:\Windows\System\BHVdQTQ.exe
  C:\Windows\System\BHVdQTQ.exe
  2⤵
  PID:8808
- C:\Windows\System\Gedflee.exe
  C:\Windows\System\Gedflee.exe
  2⤵
  PID:8768
- C:\Windows\System\tCGrLdV.exe
  C:\Windows\System\tCGrLdV.exe
  2⤵
  PID:10736
- C:\Windows\System\erwHPFu.exe
  C:\Windows\System\erwHPFu.exe
  2⤵
  PID:10972
- C:\Windows\System\psOasZd.exe
  C:\Windows\System\psOasZd.exe
  2⤵
  PID:11284
- C:\Windows\System\nDrrSOj.exe
  C:\Windows\System\nDrrSOj.exe
  2⤵
  PID:11224
- C:\Windows\System\FWsnpEm.exe
  C:\Windows\System\FWsnpEm.exe
  2⤵
  PID:9004
- C:\Windows\System\YStyflT.exe
  C:\Windows\System\YStyflT.exe
  2⤵
  PID:11956
- C:\Windows\System\TKNmCXC.exe
  C:\Windows\System\TKNmCXC.exe
  2⤵
  PID:12372
- C:\Windows\System\SIZNPOG.exe
  C:\Windows\System\SIZNPOG.exe
  2⤵
  PID:12564
- C:\Windows\System\RDfVNbf.exe
  C:\Windows\System\RDfVNbf.exe
  2⤵
  PID:10656
- C:\Windows\System\cTJSyiK.exe
  C:\Windows\System\cTJSyiK.exe
  2⤵
  PID:12544
- C:\Windows\System\dgEqlIt.exe
  C:\Windows\System\dgEqlIt.exe
  2⤵
  PID:11088
- C:\Windows\System\WGBNtfd.exe
  C:\Windows\System\WGBNtfd.exe
  2⤵
  PID:11180
- C:\Windows\System\SRHexSm.exe
  C:\Windows\System\SRHexSm.exe
  2⤵
  PID:9756
- C:\Windows\System\ItqOuYx.exe
  C:\Windows\System\ItqOuYx.exe
  2⤵
  PID:9940
- C:\Windows\System\SWBZfPj.exe
  C:\Windows\System\SWBZfPj.exe
  2⤵
  PID:12256
- C:\Windows\System\jzRqTIt.exe
  C:\Windows\System\jzRqTIt.exe
  2⤵
  PID:12816
- C:\Windows\System\IBpTsav.exe
  C:\Windows\System\IBpTsav.exe
  2⤵
  PID:3008
- C:\Windows\System\RXdvLpm.exe
  C:\Windows\System\RXdvLpm.exe
  2⤵
  PID:13144
- C:\Windows\System\ucjFGqW.exe
  C:\Windows\System\ucjFGqW.exe
  2⤵
  PID:10616
- C:\Windows\System\fItBleq.exe
  C:\Windows\System\fItBleq.exe
  2⤵
  PID:11536
- C:\Windows\System\VYGiJtF.exe
  C:\Windows\System\VYGiJtF.exe
  2⤵
  PID:8288
- C:\Windows\System\zSrCpFP.exe
  C:\Windows\System\zSrCpFP.exe
  2⤵
  PID:13328
- C:\Windows\System\EBLWiwd.exe
  C:\Windows\System\EBLWiwd.exe
  2⤵
  PID:13352
- C:\Windows\System\MpdtGUb.exe
  C:\Windows\System\MpdtGUb.exe
  2⤵
  PID:13816
- C:\Windows\System\HJGjVka.exe
  C:\Windows\System\HJGjVka.exe
  2⤵
  PID:13888
- C:\Windows\System\KsgYqMT.exe
  C:\Windows\System\KsgYqMT.exe
  2⤵
  PID:14032
- C:\Windows\System\iUQbcDf.exe
  C:\Windows\System\iUQbcDf.exe
  2⤵
  PID:14064
- C:\Windows\System\GJIJcyb.exe
  C:\Windows\System\GJIJcyb.exe
  2⤵
  PID:14088
- C:\Windows\System\IQQLrRC.exe
  C:\Windows\System\IQQLrRC.exe
  2⤵
  PID:14248
- C:\Windows\System\PSkDGBK.exe
  C:\Windows\System\PSkDGBK.exe
  2⤵
  PID:14292
- C:\Windows\System\LbomcIR.exe
  C:\Windows\System\LbomcIR.exe
  2⤵
  PID:10112
- C:\Windows\System\KWtHAFg.exe
  C:\Windows\System\KWtHAFg.exe
  2⤵
  PID:7096
- C:\Windows\System\SoEbRxi.exe
  C:\Windows\System\SoEbRxi.exe
  2⤵
  PID:13692
- C:\Windows\System\wKekQry.exe
  C:\Windows\System\wKekQry.exe
  2⤵
  PID:13824
- C:\Windows\System\KyvvOaU.exe
  C:\Windows\System\KyvvOaU.exe
  2⤵
  PID:13724
- C:\Windows\System\mhkYZfY.exe
  C:\Windows\System\mhkYZfY.exe
  2⤵
  PID:13752
- C:\Windows\System\mFvoyLw.exe
  C:\Windows\System\mFvoyLw.exe
  2⤵
  PID:13772
- C:\Windows\System\BKTSEOe.exe
  C:\Windows\System\BKTSEOe.exe
  2⤵
  PID:14056
- C:\Windows\System\Vfvphmn.exe
  C:\Windows\System\Vfvphmn.exe
  2⤵
  PID:13868
- C:\Windows\System\ZpTKSRy.exe
  C:\Windows\System\ZpTKSRy.exe
  2⤵
  PID:12504
- C:\Windows\System\lCmlpSe.exe
  C:\Windows\System\lCmlpSe.exe
  2⤵
  PID:12508
- C:\Windows\System\NQVEpCy.exe
  C:\Windows\System\NQVEpCy.exe
  2⤵
  PID:14028
- C:\Windows\System\PziLEST.exe
  C:\Windows\System\PziLEST.exe
  2⤵
  PID:14316
- C:\Windows\System\aswIZjU.exe
  C:\Windows\System\aswIZjU.exe
  2⤵
  PID:12964
- C:\Windows\System\GmUtYyN.exe
  C:\Windows\System\GmUtYyN.exe
  2⤵
  PID:13600
- C:\Windows\System\JGqLGjC.exe
  C:\Windows\System\JGqLGjC.exe
  2⤵
  PID:12988
- C:\Windows\System\fFFputj.exe
  C:\Windows\System\fFFputj.exe
  2⤵
  PID:13080
- C:\Windows\System\RibyybP.exe
  C:\Windows\System\RibyybP.exe
  2⤵
  PID:8620
- C:\Windows\System\otWjdIs.exe
  C:\Windows\System\otWjdIs.exe
  2⤵
  PID:13448
- C:\Windows\System\lqVPesN.exe
  C:\Windows\System\lqVPesN.exe
  2⤵
  PID:13240
- C:\Windows\System\ZkrnlOI.exe
  C:\Windows\System\ZkrnlOI.exe
  2⤵
  PID:13788
- C:\Windows\System\uSVPRLQ.exe
  C:\Windows\System\uSVPRLQ.exe
  2⤵
  PID:13932
- C:\Windows\System\YpyiZpo.exe
  C:\Windows\System\YpyiZpo.exe
  2⤵
  PID:14180
- C:\Windows\System\OQTgXIG.exe
  C:\Windows\System\OQTgXIG.exe
  2⤵
  PID:13996
- C:\Windows\System\zAHqzHC.exe
  C:\Windows\System\zAHqzHC.exe
  2⤵
  PID:14044
- C:\Windows\System\BgMqcBU.exe
  C:\Windows\System\BgMqcBU.exe
  2⤵
  PID:13220
- C:\Windows\System\AwBcQMQ.exe
  C:\Windows\System\AwBcQMQ.exe
  2⤵
  PID:10688
- C:\Windows\System\RswifAD.exe
  C:\Windows\System\RswifAD.exe
  2⤵
  PID:13320
- C:\Windows\System\HMdVISN.exe
  C:\Windows\System\HMdVISN.exe
  2⤵
  PID:13456
- C:\Windows\System\dScexdD.exe
  C:\Windows\System\dScexdD.exe
  2⤵
  PID:14304
- C:\Windows\System\dHyldvG.exe
  C:\Windows\System\dHyldvG.exe
  2⤵
  PID:10672
- C:\Windows\System\iannZnh.exe
  C:\Windows\System\iannZnh.exe
  2⤵
  PID:14260
- C:\Windows\System\UkISiya.exe
  C:\Windows\System\UkISiya.exe
  2⤵
  PID:13792
- C:\Windows\System\oSDtvyK.exe
  C:\Windows\System\oSDtvyK.exe
  2⤵
  PID:13324
- C:\Windows\System\VZGhChO.exe
  C:\Windows\System\VZGhChO.exe
  2⤵
  PID:13664
- C:\Windows\System\VaFCiIJ.exe
  C:\Windows\System\VaFCiIJ.exe
  2⤵
  PID:14208
- C:\Windows\System\MMZXklL.exe
  C:\Windows\System\MMZXklL.exe
  2⤵
  PID:13848
- C:\Windows\System\uHiQakz.exe
  C:\Windows\System\uHiQakz.exe
  2⤵
  PID:2848
- C:\Windows\System\nMySqtP.exe
  C:\Windows\System\nMySqtP.exe
  2⤵
  PID:14276
- C:\Windows\System\xpPBpOu.exe
  C:\Windows\System\xpPBpOu.exe
  2⤵
  PID:12900
- C:\Windows\System\zUMhABp.exe
  C:\Windows\System\zUMhABp.exe
  2⤵
  PID:13760
- C:\Windows\System\hikeegQ.exe
  C:\Windows\System\hikeegQ.exe
  2⤵
  PID:14332
- C:\Windows\System\DELjDWB.exe
  C:\Windows\System\DELjDWB.exe
  2⤵
  PID:14108
- C:\Windows\System\skiUDYW.exe
  C:\Windows\System\skiUDYW.exe
  2⤵
  PID:10308
- C:\Windows\System\WZhcRRz.exe
  C:\Windows\System\WZhcRRz.exe
  2⤵
  PID:13740
- C:\Windows\System\blvsLWG.exe
  C:\Windows\System\blvsLWG.exe
  2⤵
  PID:12952
- C:\Windows\System\gTwSjZa.exe
  C:\Windows\System\gTwSjZa.exe
  2⤵
  PID:13632
- C:\Windows\System\kqWmCGL.exe
  C:\Windows\System\kqWmCGL.exe
  2⤵
  PID:13584
- C:\Windows\System\klKJiAS.exe
  C:\Windows\System\klKJiAS.exe
  2⤵
  PID:11616
- C:\Windows\System\PFzfECZ.exe
  C:\Windows\System\PFzfECZ.exe
  2⤵
  PID:11484
- C:\Windows\System\vVFzzVf.exe
  C:\Windows\System\vVFzzVf.exe
  2⤵
  PID:11020
- C:\Windows\System\eCiMRyV.exe
  C:\Windows\System\eCiMRyV.exe
  2⤵
  PID:3704
- C:\Windows\System\RPYnMOI.exe
  C:\Windows\System\RPYnMOI.exe
  2⤵
  PID:11552
- C:\Windows\System\dCXqLpG.exe
  C:\Windows\System\dCXqLpG.exe
  2⤵
  PID:4444
- C:\Windows\System\RHKHbWk.exe
  C:\Windows\System\RHKHbWk.exe
  2⤵
  PID:8964
- C:\Windows\System\zArxsST.exe
  C:\Windows\System\zArxsST.exe
  2⤵
  PID:572
- C:\Windows\System\EXXgaYJ.exe
  C:\Windows\System\EXXgaYJ.exe
  2⤵
  PID:9620
- C:\Windows\System\qCyAgYj.exe
  C:\Windows\System\qCyAgYj.exe
  2⤵
  PID:13360
- C:\Windows\System\RQYxikL.exe
  C:\Windows\System\RQYxikL.exe
  2⤵
  PID:13540
- C:\Windows\System\fjSpyyd.exe
  C:\Windows\System\fjSpyyd.exe
  2⤵
  PID:1304
- C:\Windows\System\NGEaChe.exe
  C:\Windows\System\NGEaChe.exe
  2⤵
  PID:1692
- C:\Windows\System\wTuxXEn.exe
  C:\Windows\System\wTuxXEn.exe
  2⤵
  PID:13068
- C:\Windows\System\MUXlSvJ.exe
  C:\Windows\System\MUXlSvJ.exe
  2⤵
  PID:13628
- C:\Windows\System\NRHcMxu.exe
  C:\Windows\System\NRHcMxu.exe
  2⤵
  PID:4492
- C:\Windows\System\JyEBTTG.exe
  C:\Windows\System\JyEBTTG.exe
  2⤵
  PID:13556
- C:\Windows\System\tjgJemD.exe
  C:\Windows\System\tjgJemD.exe
  2⤵
  PID:13280
- C:\Windows\System\wKrJUQA.exe
  C:\Windows\System\wKrJUQA.exe
  2⤵
  PID:11272
- C:\Windows\System\ijaPQIF.exe
  C:\Windows\System\ijaPQIF.exe
  2⤵
  PID:9520
- C:\Windows\System\TanYwpA.exe
  C:\Windows\System\TanYwpA.exe
  2⤵
  PID:2972
- C:\Windows\System\onEwWMS.exe
  C:\Windows\System\onEwWMS.exe
  2⤵
  PID:3392
- C:\Windows\System\LcwvUfk.exe
  C:\Windows\System\LcwvUfk.exe
  2⤵
  PID:7360
- C:\Windows\System\tilaPCK.exe
  C:\Windows\System\tilaPCK.exe
  2⤵
  PID:860
- C:\Windows\System\fOKnqxl.exe
  C:\Windows\System\fOKnqxl.exe
  2⤵
  PID:4300
- C:\Windows\System\DfEbgWH.exe
  C:\Windows\System\DfEbgWH.exe
  2⤵
  PID:5076
- C:\Windows\System\jEixfDA.exe
  C:\Windows\System\jEixfDA.exe
  2⤵
  PID:4176
- C:\Windows\System\qyVRotc.exe
  C:\Windows\System\qyVRotc.exe
  2⤵
  PID:13684
- C:\Windows\System\LKjxQSK.exe
  C:\Windows\System\LKjxQSK.exe
  2⤵
  PID:9280
- C:\Windows\System\PFIGVfG.exe
  C:\Windows\System\PFIGVfG.exe
  2⤵
  PID:14204
- C:\Windows\System\ZqboyVO.exe
  C:\Windows\System\ZqboyVO.exe
  2⤵
  PID:1192
- C:\Windows\System\YgIdsmD.exe
  C:\Windows\System\YgIdsmD.exe
  2⤵
  PID:14280
- C:\Windows\System\hUwlvGJ.exe
  C:\Windows\System\hUwlvGJ.exe
  2⤵
  PID:14172
- C:\Windows\System\NBxGJvH.exe
  C:\Windows\System\NBxGJvH.exe
  2⤵
  PID:2924
- C:\Windows\System\wDVmNLP.exe
  C:\Windows\System\wDVmNLP.exe
  2⤵
  PID:10932
- C:\Windows\System\shQWXZY.exe
  C:\Windows\System\shQWXZY.exe
  2⤵
  PID:11452
- C:\Windows\System\kXaftlv.exe
  C:\Windows\System\kXaftlv.exe
  2⤵
  PID:12452
- C:\Windows\System\YrtXDrJ.exe
  C:\Windows\System\YrtXDrJ.exe
  2⤵
  PID:2268
- C:\Windows\System\ubcbmii.exe
  C:\Windows\System\ubcbmii.exe
  2⤵
  PID:4220
- C:\Windows\System\cRYUcNU.exe
  C:\Windows\System\cRYUcNU.exe
  2⤵
  PID:3928
- C:\Windows\System\YnUZrLC.exe
  C:\Windows\System\YnUZrLC.exe
  2⤵
  PID:4224
- C:\Windows\System\YkviBnB.exe
  C:\Windows\System\YkviBnB.exe
  2⤵
  PID:4592
- C:\Windows\System\OzeUdxM.exe
  C:\Windows\System\OzeUdxM.exe
  2⤵
  PID:11348
- C:\Windows\System\TzuVIoK.exe
  C:\Windows\System\TzuVIoK.exe
  2⤵
  PID:13808
- C:\Windows\System\qdesfQt.exe
  C:\Windows\System\qdesfQt.exe
  2⤵
  PID:14216
- C:\Windows\System\wcHxzTF.exe
  C:\Windows\System\wcHxzTF.exe
  2⤵
  PID:13968
- C:\Windows\System\sAceaab.exe
  C:\Windows\System\sAceaab.exe
  2⤵
  PID:9476
- C:\Windows\System\cxFoiXV.exe
  C:\Windows\System\cxFoiXV.exe
  2⤵
  PID:4228
- C:\Windows\System\PhlqaeV.exe
  C:\Windows\System\PhlqaeV.exe
  2⤵
  PID:4324
- C:\Windows\System\nMnJzOg.exe
  C:\Windows\System\nMnJzOg.exe
  2⤵
  PID:4180
- C:\Windows\System\Fgsjrdp.exe
  C:\Windows\System\Fgsjrdp.exe
  2⤵
  PID:1224
- C:\Windows\System\ERQkdSe.exe
  C:\Windows\System\ERQkdSe.exe
  2⤵
  PID:4128
- C:\Windows\System\DYMciAs.exe
  C:\Windows\System\DYMciAs.exe
  2⤵
  PID:4776
- C:\Windows\System\WuZGSHC.exe
  C:\Windows\System\WuZGSHC.exe
  2⤵
  PID:3288
- C:\Windows\System\MDJRqTE.exe
  C:\Windows\System\MDJRqTE.exe
  2⤵
  PID:568
- C:\Windows\System\fCeDUuq.exe
  C:\Windows\System\fCeDUuq.exe
  2⤵
  PID:1244
- C:\Windows\System\rCuxOXH.exe
  C:\Windows\System\rCuxOXH.exe
  2⤵
  PID:10116
- C:\Windows\System\GRphBZw.exe
  C:\Windows\System\GRphBZw.exe
  2⤵
  PID:14104
- C:\Windows\System\TfXAJmD.exe
  C:\Windows\System\TfXAJmD.exe
  2⤵
  PID:1456
- C:\Windows\System\lRINJFy.exe
  C:\Windows\System\lRINJFy.exe
  2⤵
  PID:2748
- C:\Windows\System\GlWsZyB.exe
  C:\Windows\System\GlWsZyB.exe
  2⤵
  PID:3528
- C:\Windows\System\ltPFdFT.exe
  C:\Windows\System\ltPFdFT.exe
  2⤵
  PID:4348
- C:\Windows\System\hqUdNzd.exe
  C:\Windows\System\hqUdNzd.exe
  2⤵
  PID:2996
- C:\Windows\System\HRiNYcl.exe
  C:\Windows\System\HRiNYcl.exe
  2⤵
  PID:9320
- C:\Windows\System\CjeLYtn.exe
  C:\Windows\System\CjeLYtn.exe
  2⤵
  PID:3240
- C:\Windows\System\SNGxBGM.exe
  C:\Windows\System\SNGxBGM.exe
  2⤵
  PID:13372
- C:\Windows\System\NbHFfCD.exe
  C:\Windows\System\NbHFfCD.exe
  2⤵
  PID:4840
- C:\Windows\System\rAujfkX.exe
  C:\Windows\System\rAujfkX.exe
  2⤵
  PID:1052
- C:\Windows\System\XYuAgMU.exe
  C:\Windows\System\XYuAgMU.exe
  2⤵
  PID:13072
- C:\Windows\System\lbpARuM.exe
  C:\Windows\System\lbpARuM.exe
  2⤵
  PID:12632
- C:\Windows\System\DLMczgN.exe
  C:\Windows\System\DLMczgN.exe
  2⤵
  PID:2700

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13572

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13756

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14040

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:784

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3340

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:9676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_riefhn5t.nld.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BZgEzEx.exe

Filesize
1.8MB

MD5
ace9791047d60c419df87b25fae2c9b7

SHA1
520f767c074832a7dbfaa1dfc934b7589a802028

SHA256
da10312ee8b885f6a999d0bcc16a0056ccd993720bc7882d2455155406697eab

SHA512
483f7c3012ea9ff2c55e3a91abcb690d25d38914ee2e3f46b6b67d4bde80b137d7f5e1909712506a791473bfad46594a577d3b037ce9699d04f16747214bcca0

Download Submit
C:\Windows\System\CTBYpxJ.exe

Filesize
1.8MB

MD5
e949e94a4b80d7d324bba2b3955d46ae

SHA1
43ed5e5d3cde4a82abbe0f114efcd2a54859ef2a

SHA256
15a204d18a0b42c10bd4b2a34f156ce3287b42806bf4fa5c6da80fb2ec15e075

SHA512
4bd2702a8553ac22a22308da11ee7332c94e202eee825400f38bb130d5eaab979be9f47390626821ba1236d92557370ffdc4eeed7bd79d45a40411e8df0af163

Download Submit
C:\Windows\System\CwTbkRJ.exe

Filesize
1.8MB

MD5
b7b0ff87c4737063f96b36bbba12e19e

SHA1
cfd54a8f1b03d9886d95c427758be009cbbb641b

SHA256
3d60bf7f1ed43ece6c505d47005a55125932587f958124921fa7520d224ab6d2

SHA512
a33c89084c357c1f3ff44b23b2b6680e8cbebcdb925886a3185bed8ccbea1c111f7a882814d2803ed494de447b382e8dd6a4e56fd866846030c183f3417a2e7b

Download Submit
C:\Windows\System\DTyoFyS.exe

Filesize
1.8MB

MD5
a5769d0105e536921c9bb9fb6b6922e4

SHA1
b5d88d77a739cb89b05e17cb12d4ebded298c6bb

SHA256
827a298c9a3b9272464b25b6887fbe3baf7ef57980c4d90691d24195d6ae36d2

SHA512
01e9312b871e493c99af735eace5ed27d23f85e6c0f939b95f58df80aa9224c294002f196dca4dbc5729cf95bae649559f5026494df62763732e77d8b27f6718

Download Submit
C:\Windows\System\FjvEojO.exe

Filesize
1.8MB

MD5
d07e05e69ffefc283f968e68ec769e1a

SHA1
9aad48c1f6dd092cb5c29bcff000530e6980cb10

SHA256
b9e0f1a78c65a452f19fe52987028510debc439a596a10a26468d2f9d6eb4602

SHA512
0d80ed62590ae0b08585061c650174e154aa6b913bca21e539680477b66066c1c314d133338ee6e76d5b3fe5bc4c3c617c0a72d8744632a1072ff2bc123ef853

Download Submit
C:\Windows\System\GPzEAaY.exe

Filesize
1.8MB

MD5
5d39e7146622ff413ad6e26d4ed11171

SHA1
e43f295f72ebd11b6d6bd8d06729cf193947a2fd

SHA256
b85c6a8493240400680985fd26d5eb30aec0dd872d1439c092b57c66eaf303d6

SHA512
532cf49aa91d34c4a3e4031030f580214bdbf851da3999d583e365a8b5381b028aec54f4244ea03b7a4d1bbc325b530be0e5f76d4829db69bc38707c6efc6be6

Download Submit
C:\Windows\System\HfPsKoI.exe

Filesize
1.8MB

MD5
6e0de374e201471494610653b6487bb7

SHA1
27a6674872618e9abb76eb88a13a334fbcda7032

SHA256
57cf93b15f5b2113537d52bd6b3c6ff068803ab3693851061512dbac5fc7c788

SHA512
79e1a706240c84439b6bbf18ad72375eecb0313e710f299f24fc9f458c0764d1b023d4b9016321a4fcfb3f50fab5f6f71f88c848670d8e53925b1f24da680942

Download Submit
C:\Windows\System\JxAvkBY.exe

Filesize
1.8MB

MD5
c053f71eae58ae605c442913c69c3b09

SHA1
7a68d65038f399d7832c6d32a5f66f874e1a069a

SHA256
027812d80a0f9cec659fc4943237598f9c49ad146e891f945d91573acaa497bb

SHA512
83111e35b5a1b45c7fdd43c72f5c66cf249b9864ac8929e566d8e05f8287b52f7c173301f037509aee8a108d97317489ae088763a29cc225ab8a02dacde279c7

Download Submit
C:\Windows\System\LZVYtkW.exe

Filesize
1.8MB

MD5
7fde8d0f0b4075ca159d2f8b48377fbc

SHA1
da87b4648df5c0dec6f086bd1ffb20e586499ce7

SHA256
703386c0903e5b78793407987cb7d9ba35ed66f7472ae835e036d01d05d0fbea

SHA512
89e7e37f98b5930ab3d79e99b08b02e82f191e1e6dfb6bd2648f91d0d7b0de245dc2d29098c2de4f18c4b0eb2b02d80035217d28d6d9491d422f844e2447c9e4

Download Submit
C:\Windows\System\PXNgBap.exe

Filesize
1.8MB

MD5
a7a22047dd6b9518747c3b8c8a3feb8c

SHA1
302fb08e9d9b5b6c79b37f0f58255509034e87e2

SHA256
0971585ce14415226b9e51173b836172865f7d07f3a8c24d0fe3f54aaf18912b

SHA512
fe7211ddcc8308d093225254a38bcc9e371449506de7660f6134bca32ca5c1d9b849db66dfaaa70dfee0ddc4273931c6d3286851871ded22f6afb3dddb09589a

Download Submit
C:\Windows\System\QEXAbwo.exe

Filesize
1.8MB

MD5
e7334d76f5dca0577dff8b6c059bc125

SHA1
e073330286b911fb16a0edc2b7d41fdced193fcd

SHA256
8b0611a659b53c62e2612e8125887441ac6d4ff870d96b3f7b696e15f5436dc9

SHA512
88d9b07c105993b0ab6bc870a8c937f50274d10f4f8976b09a2a93b2830f2aab68c74f15fd838b7e2db77a997d08727604c460a96712ddfc45c1294aa2ff084a

Download Submit
C:\Windows\System\QOIwoGP.exe

Filesize
1.8MB

MD5
db755ef4b05723ad6a385832d0847db5

SHA1
8a72f44231d3b637a4f5f0c91117221800f18c55

SHA256
95dd6b3546a44b210290c82e35cbd67a67763d31bd7d6e6ab5b705cfcfc3ac11

SHA512
544a77a345488e4db65f9f2091a32f716efa40476fcdfd2016b7e1f990b067dad50e3756f74a9051a16e58c2f7e88aad14ab11edd5aebe2905fc625c607f847c

Download Submit
C:\Windows\System\QYcNFCZ.exe

Filesize
1.8MB

MD5
26d4b472c015354b03d11a5918df2431

SHA1
247484748439370383b4e3a3c449c8c3d34a0a0c

SHA256
085618093761458bd3df860ffc98bec5429f30c6c9ba9e9e4b05ea14775c7bd4

SHA512
436a20c9da8a5f76cae0a23586c46cb76c08b29ea3087bca58cd77198b73a160b17df7ba367677361d30e18a797d3cc7152e7c0048b06c30969613956964ec57

Download Submit
C:\Windows\System\QfnEmWa.exe

Filesize
1.8MB

MD5
27a0c1f20b9c2f9c3f1048de917941a8

SHA1
d5a13f979461702fd0348402f44329c9047d2a68

SHA256
ad421aaea73a3bac27a79cd0ab5970fdea6e96a377548c50a0ee36d60e741917

SHA512
83e6aa77ee0d798af1a7d24239bc3686b4c5a0056f75ec2e052ae64b304689917f83985a0d110f12b54b41bc74ce1cb46b547be8101a08335717b98e9b777b68

Download Submit
C:\Windows\System\SKPXpsr.exe

Filesize
1.8MB

MD5
494c7d92ea16c26755035d201c936d83

SHA1
864684639ae30408c5a994a24f90c36fc441a5e2

SHA256
9e24c3ac8adcae7bc4d53dc53f698efbc556e7603df4147fceb1466995e50021

SHA512
fae48fcc4b6e5ec7b661caf5b446222e86ef2a95e1819495af4c5199b6d5dabe88f7f59fb1c3403c66173ea20af99e1ee38ebe4b3d4a44f62ee6e2508fcac924

Download Submit
C:\Windows\System\TAdCCAl.exe

Filesize
1.8MB

MD5
b02b55afc0648f9b411714cff898c6ed

SHA1
44fd236184fa96762f15a43b63ddbb67d1635b92

SHA256
135ce8e1e099db6f5d7f7de39feab611480116d682cd2937916810f406fd8b63

SHA512
db237583334bdf88e6cda95214be1fd2bd84e05898079051a257e6e7dc3a53c764b96ac7b77014a5b79ca19e1fd20c8e3eea3aa2eec9d23940e47ab3270ec2f9

Download Submit
C:\Windows\System\YwfsxjD.exe

Filesize
1.8MB

MD5
e0569dc8a84bd3eb4c938f4e1992201e

SHA1
56811bd9dfb3cd3add259219ca11d8674bfad85a

SHA256
ab10b9ca7e193c99ed9ed25b577efb6dbc0f03bb8520b59d2ac1ca54348e042e

SHA512
4fb975f29692a56df3c12c38d36a1882c54f016d2b8fc67967b185be6173944e33e16ce9789478047ae0b00d94554226b3c929736a68698a05d535fd85d8e112

Download Submit
C:\Windows\System\ZlWampX.exe

Filesize
1.8MB

MD5
2af5267e6f449fff9e06debffbd6f511

SHA1
d0787c69927b671875a6b2af72584108c490410b

SHA256
8513b8b9fdb657321739234d0da6ffa817c9340028140df2d7d403d09c3858a8

SHA512
290eefb34a03559e633c5aee469d6c3072f16805b931d41d24f89ba1afc160993b99259e753aeddbf0de448c8b49fff9419c427ba84b3a6bb72428732d439509

Download Submit
C:\Windows\System\cvLzkUc.exe

Filesize
1.8MB

MD5
369917e694e1e1ad6fbd7b497ecfb684

SHA1
aefeaea09c8fb1f5064290042f23b49a62339199

SHA256
ee359e7ae706c05fafdd0113cdceb3f18f73f9e22b72aa88a2192d5898fb64fd

SHA512
21ebc95de635758c2d5d7214ce6c2602ecace0d917362a7a900570a79679285a2a8151ef1058cce8a5d4502f12376747583b5e1efd8966c9e34171e4839ef03c

Download Submit
C:\Windows\System\ejbiDrd.exe

Filesize
1.8MB

MD5
6dd7b1fe2f57043b1e7d7dbadf859e4c

SHA1
fc579fd29ff0c509423a4c5ac644f490296cabb3

SHA256
c68b109bceaf21a8f1a49d9f68c32ef9fde640f59b68fffc9082582fce81c943

SHA512
7eae14e922a036a770d29c104cc14a030be73d520d777e034b38ced9eb42acd91664b267153212696f1e54da3ed68051f8794a4f81007b9496cd9934d1cc1974

Download Submit
C:\Windows\System\hGTBRli.exe

Filesize
1.8MB

MD5
90cf3f0142795606e22c61c58250b142

SHA1
31af61c2f2598821a63624192a1734a128353f23

SHA256
14028d3196eac151c9c72b98b7c95f497b83fe9b8487fa8f3170ae52a0ad0c91

SHA512
f6f4ca88558ef3e294a182a7a9b974dc4e66ded0aa2a80ddb82017a90bc401ea8b46124fccf1a0eb87c8c7f9b3486e351d638bc3f6b3687eafa3c3040b5077f9

Download Submit
C:\Windows\System\hWMEXkH.exe

Filesize
1.8MB

MD5
513f908c8d0d7c9f37a04bc03c0732b7

SHA1
fa4310987b0e6294d923e268549bbd7c5578e402

SHA256
1585553a4ead13201742ca0fbcd3f99c16ec4afa5773456e70bae52646e502be

SHA512
50f0b774efb6c93b1d5a574992ccb99e3dc0ed8c693807ece848c14c71f3e889f592467dfb0c80d7e0d1d53a277c7fe8572b035bd6763a0b32bc1cc734736e68

Download Submit
C:\Windows\System\hxwkZaW.exe

Filesize
1.8MB

MD5
35fc8295f686aff47230fc331ac59de8

SHA1
71ad9544c02a80cf43a3d921960beb29a281ace4

SHA256
0d7b6b391e8841f624a723eda24094876a3be0bceaff951691a7ad5ad14105d8

SHA512
4f92eb48b8f24576ce4701f401570c241527b8bcbddcd98d110f0cae4b99f35254160f781753da24df22bd1ea5800f7bf656864a9eec5116a9a2e946b74acec8

Download Submit
C:\Windows\System\iwuSpKi.exe

Filesize
1.8MB

MD5
643ee4e06c4c036fa95673c195e85978

SHA1
c17355758abc985f06dbfccb82c5a5e28deef3b9

SHA256
d77490e46c55fd48424d63f9289378210de67d0fd4f34282f4e931226d9b22b5

SHA512
81a83e349960472b4dbde32d7af54d418bfd5c26283cfb84c5b4b57de32e85fb11f5d6ad9fce4d6bd802ac28fd57fed4962235c2f3f70de2e4f04dee9b5e7734

Download Submit
C:\Windows\System\kcdfAMo.exe

Filesize
8B

MD5
0deb0bd776928ddbb7dba6c92ae63700

SHA1
6379b752947bdc9ab8854acb8b1e039e01dd6cab

SHA256
f77bff2b9d375f2224e7a2e932a7d34095f444055650a8c991abd53b12a52db3

SHA512
6857536eacbca3287a06706d5de02077365a329bb292e9e1dfadf525d26cf0a419890b6a3daa9c12b1fcc54e330a305e5e2fe16f21db65842df509994b2999a0

Download Submit
C:\Windows\System\kqylZpE.exe

Filesize
1.8MB

MD5
fe6a791697c2d88f88ee4bad50feb7df

SHA1
b7d9ffb28ba10ddbf7a360656b62efe562a17d45

SHA256
f2e71c32a7bb5c93218bed19ef3019296e110f1ebc7f95389cec0c513e0c1fdf

SHA512
43575538752f0e9fc7cee975635c4bf514f111d1123aa843dcfc6a18290c7cb442a122655705481dc329edc048c308c9174431dae60ceb6f56a02f6ac751eaaa

Download Submit
C:\Windows\System\lidvStd.exe

Filesize
1.8MB

MD5
56c563825af19c80df76dce427b950ba

SHA1
5f243166521873dd4264d5cc595480ca4b965ebd

SHA256
9391e5ae2bf7b9ab2fadd078f0bfb953d5420fdbdd68c53249c20c02d2f2f423

SHA512
72612efc40241560053768524b6941b1ad12c3a00b13538512697a45439c4ae1e117ff9036862e2d7583bfbf4beecc7e801e13d93245ca0dddd4d5ef57bce74f

Download Submit
C:\Windows\System\nRJAMBT.exe

Filesize
1.8MB

MD5
4ecdef90e00c9c1fdb47db0aabba61ae

SHA1
64ee9fba710043901abd408c6ba5926ed7215d2c

SHA256
34ab49ddaaa0d53b04d00270c2925db22d0368feececaec41e11bac40ace432b

SHA512
fd4bf592166cb095a5481f3bfb51e74859e61d4a61b7dabf0cf1448b42e2639aba28dfdb6f1aef202f54110fe785d013dcf2c69b39958e328deebb6d4ef8cce4

Download Submit
C:\Windows\System\oTqEsXu.exe

Filesize
1.8MB

MD5
2e4f99022f1d52fd20644cb04289e44b

SHA1
c641d734d44cc1e69c114f7c7fa0ba4ad16104ae

SHA256
08fa78eb6d7e84be55832bc66be3ae52558e5f25e97bd5a95c2434c8a04e2680

SHA512
7e9f7fd81a3021616d152c7148c9157d4e1a3453adfdceb813dc04f811d534641a296b4bdcbd9b6b40fdcd889a9eceda476e36598f10e95e4945530e97e5972d

Download Submit
C:\Windows\System\pZsQkFj.exe

Filesize
1.8MB

MD5
b75ec622b53d972ea1a98711795419cc

SHA1
6a8d953d88cafa9af6df2c1002e30daca38ef620

SHA256
f62796aa709a84e03649dd043cb5ae79921feb663d895e73e812f08bae3c1eeb

SHA512
cda88cb3dffe7236e634038f30951eb00dd6487c3551c8aa589731ca963c92bcef5f481b488d33a4aa31b643ca88dea037a6204667b711a9ae36369f2a142dc2

Download Submit
C:\Windows\System\rkHdOkG.exe

Filesize
1.8MB

MD5
29077c32767d1097e095673b2343fc0d

SHA1
d40a139bb65be7150fdb12214c6ceea8b8ac730c

SHA256
b4444dbbb504bf482e00812a69f8fb49fd85380829e1d1b5b939445dd642a845

SHA512
775f0db9d8533e9ac94aef96a2ce6769543b06958eec04382ef48b01c1562b49a6c1b4c341a9016812c76d99a04c7305475e66487e47cf3737969ce94af5f880

Download Submit
C:\Windows\System\rlAVokP.exe

Filesize
1.8MB

MD5
96069f9179a2c5b21ecb9160d6bc6c9e

SHA1
05bf81d3e8e8596c1eb648a747cd095ee06a8829

SHA256
140cf29e3fb0c78ea5b4f479021c6110ef6175d4fb971693e18c11034ac71693

SHA512
435445bdecf55bb18436bd48975bab12969ca34eae526063166b97c29c7a8c70c28313093c65f19e26ba45972792c7428bdce5879b5dbc55a7ffb03db3734e03

Download Submit
C:\Windows\System\sQsmAIN.exe

Filesize
1.8MB

MD5
7b4e0ee6b440aa2d4c7780be25083bc6

SHA1
bf01ded8e8209b0891b33c70e677f002ccdb818b

SHA256
d96a9136a26f4089cbda792c853a849a081dbedb92957e62c1fe4ebfc948de41

SHA512
65d65e3dff6d5e9549b9b0975c51eff96c4889c8acefde0d1331dea0b993ce4003b6b0a114d231303105ec6e3f07c23b0122f7fbe8525b2411c5252a1e3c94a3

Download Submit
C:\Windows\System\sirVHVw.exe

Filesize
1.8MB

MD5
cecc53ec82894186c0a221a28623180f

SHA1
44fed7e4a00675947611667d7f12fc8ea9b7ce36

SHA256
a6362873ac0a33cc90d84fc15fca8b02e6165e4b25ff8cfc606d622bb6942484

SHA512
5bd07159df6d9cf6ed227471875dff86a45facc69fb912bd2a2815f42556a158d8dfcc67b7d528d8022596175c22e98cd615b404545fa036a468c7ade5959de0

Download Submit
C:\Windows\System\sriSdFU.exe

Filesize
1.8MB

MD5
0ea2883cc22a7d56dedfd5f0938e1051

SHA1
46dc6c93ddb5c24ae679d6fa803dd5e6bf4c6c9e

SHA256
23f15bb72042def33e57f0c91e2700f722b39b7492dfff7f689453430733c1f7

SHA512
be3f8af5ed71e24f1c166e394d469b0d2db2921678d9f5f1d4032f162c6e00e4b6ef7ab548d047c9438ff82c55cc0c381d7b7ec26a5d6edfebf7d3b5ca9d3a68

Download Submit
C:\Windows\System\uDPWdIG.exe

Filesize
1.8MB

MD5
acfc29f5ebaf419ddd0a5f798d44233f

SHA1
a1f8ecccf3716ac8040db806fd2c285fa76787fb

SHA256
2d801bb7dcc8380d234cfab7df426b37e5c03475a4365072112eeec81db9ce8e

SHA512
ca1706d6fd5c83257654fd56b586f04ee56e7e006baf153e94bdf70383780ea902c13f3ce15b404dc546e64cb5907db3a63f6ba892a02d06cd20404e55109fe6

Download Submit
C:\Windows\System\wOqSuJW.exe

Filesize
1.8MB

MD5
18fa9b4f8a03691a6bce49d62e462f6a

SHA1
e8d626307ebaae33f98e118d505ec104e6d42a00

SHA256
b725981848c314cf44075d90a6a06307613cbf09b23ee9d20aa5686e0773ea51

SHA512
ff7b40e10c1e73bcc54ca0966d0b1ffcfbe7abd5fbd2bbbc457c11bd9def0c0148588f1cc4220ed854646081539972e0c63d5195fb683a8d900269d3cf927896

Download Submit
C:\Windows\System\wzsTVJV.exe

Filesize
1.8MB

MD5
1633235c27ad56cc0db27e8fe80f8a2f

SHA1
56d944c82f419b06d096516712cadf28b360761f

SHA256
6deeb942a8776395823a4710e7e9beba4057ff323edd27ef83869fc3b44f7823

SHA512
e182b222cc17f3157abedd949385449900e9b05d7bc1f479817004e95e6dea16e760c492676e9417928e4fbe1ba5d9405984e1f37c4bfa643f0dea6994486b95

Download Submit
C:\Windows\System\yNWWUXI.exe

Filesize
1.8MB

MD5
199a8a81349d280de4a3a10dfac20b90

SHA1
f562cf3e084d25aa3701b3eed5332201b50c39a6

SHA256
3d0ad2996e1db9a7adecf01ef25bbd63399f4b5d248caf6a2e97d7bd6d5d5a79

SHA512
9fcbe922ae01117d04c4331efdb348cc4eefec5b448ea8662271d84f650705e043d76d0dde18bdae03dcca5e6c360bb155513cfc66cc9986149014194b45ef13

Download Submit
C:\Windows\System\zoKPLxE.exe

Filesize
1.8MB

MD5
a7a075c13afc60263edd621fbf80d5c7

SHA1
909979cf7d7a4dd43e824cb2f59316e23b79e923

SHA256
f43451b4f86834cbd4fe9d0f43378ac63c3881e369ff0f562d3a03c66f3cffa9

SHA512
4e8ad66a3de5fdaf2387e2975bf30dc5f1cac357da20a1e80cb03eeda90ddab5d140e85c474c66dc15de1dc5715cdcad82a3d92159da0f08e1f2df4c56634fd1

Download Submit
memory/396-254-0x0000019C38410000-0x0000019C38BB6000-memory.dmp

Filesize
7.6MB

Download
memory/396-44-0x00007FFA2D900000-0x00007FFA2E3C1000-memory.dmp

Filesize
10.8MB

Download
memory/396-92-0x00007FFA2D900000-0x00007FFA2E3C1000-memory.dmp

Filesize
10.8MB

Download
memory/396-112-0x0000019C37440000-0x0000019C37462000-memory.dmp

Filesize
136KB

Download
memory/396-5-0x00007FFA2D903000-0x00007FFA2D905000-memory.dmp

Filesize
8KB

Download
memory/396-4653-0x00007FFA2D900000-0x00007FFA2E3C1000-memory.dmp

Filesize
10.8MB

Download
memory/872-241-0x00007FF701900000-0x00007FF701CF2000-memory.dmp

Filesize
3.9MB

Download
memory/872-4118-0x00007FF701900000-0x00007FF701CF2000-memory.dmp

Filesize
3.9MB

Download
memory/900-4111-0x00007FF793F90000-0x00007FF794382000-memory.dmp

Filesize
3.9MB

Download
memory/900-235-0x00007FF793F90000-0x00007FF794382000-memory.dmp

Filesize
3.9MB

Download
memory/1252-253-0x00007FF6C2900000-0x00007FF6C2CF2000-memory.dmp

Filesize
3.9MB

Download
memory/1672-251-0x00007FF627730000-0x00007FF627B22000-memory.dmp

Filesize
3.9MB

Download
memory/2052-4121-0x00007FF7FC530000-0x00007FF7FC922000-memory.dmp

Filesize
3.9MB

Download
memory/2052-240-0x00007FF7FC530000-0x00007FF7FC922000-memory.dmp

Filesize
3.9MB

Download
memory/2092-126-0x00007FF6F6B30000-0x00007FF6F6F22000-memory.dmp

Filesize
3.9MB

Download
memory/2108-195-0x00007FF650FE0000-0x00007FF6513D2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-4069-0x00007FF650FE0000-0x00007FF6513D2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-237-0x00007FF752AD0000-0x00007FF752EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-4102-0x00007FF752AD0000-0x00007FF752EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-244-0x00007FF6E1990000-0x00007FF6E1D82000-memory.dmp

Filesize
3.9MB

Download
memory/2560-248-0x00007FF7C0F30000-0x00007FF7C1322000-memory.dmp

Filesize
3.9MB

Download
memory/2772-210-0x00007FF6CE760000-0x00007FF6CEB52000-memory.dmp

Filesize
3.9MB

Download
memory/2772-4053-0x00007FF6CE760000-0x00007FF6CEB52000-memory.dmp

Filesize
3.9MB

Download
memory/2844-230-0x00007FF6AAC80000-0x00007FF6AB072000-memory.dmp

Filesize
3.9MB

Download
memory/2844-4060-0x00007FF6AAC80000-0x00007FF6AB072000-memory.dmp

Filesize
3.9MB

Download
memory/3004-225-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp

Filesize
3.9MB

Download
memory/3212-174-0x00007FF606E70000-0x00007FF607262000-memory.dmp

Filesize
3.9MB

Download
memory/3800-249-0x00007FF68DDF0000-0x00007FF68E1E2000-memory.dmp

Filesize
3.9MB

Download
memory/3836-250-0x00007FF7CD550000-0x00007FF7CD942000-memory.dmp

Filesize
3.9MB

Download
memory/3848-207-0x00007FF737FE0000-0x00007FF7383D2000-memory.dmp

Filesize
3.9MB

Download
memory/3916-4652-0x00007FF61C840000-0x00007FF61CC32000-memory.dmp

Filesize
3.9MB

Download
memory/3916-1-0x0000022F7A9B0000-0x0000022F7A9C0000-memory.dmp

Filesize
64KB

Download
memory/3916-0-0x00007FF61C840000-0x00007FF61CC32000-memory.dmp

Filesize
3.9MB

Download
memory/4016-246-0x00007FF6F6770000-0x00007FF6F6B62000-memory.dmp

Filesize
3.9MB

Download
memory/4196-242-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp

Filesize
3.9MB

Download
memory/4196-4106-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp

Filesize
3.9MB

Download
memory/4216-243-0x00007FF6E25C0000-0x00007FF6E29B2000-memory.dmp

Filesize
3.9MB

Download
memory/4216-4108-0x00007FF6E25C0000-0x00007FF6E29B2000-memory.dmp

Filesize
3.9MB

Download
memory/4232-252-0x00007FF74AC00000-0x00007FF74AFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4232-4135-0x00007FF74AC00000-0x00007FF74AFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4304-245-0x00007FF732FD0000-0x00007FF7333C2000-memory.dmp

Filesize
3.9MB

Download
memory/4408-247-0x00007FF69A770000-0x00007FF69AB62000-memory.dmp

Filesize
3.9MB

Download
memory/5016-239-0x00007FF6466B0000-0x00007FF646AA2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-4081-0x00007FF6466B0000-0x00007FF646AA2000-memory.dmp

Filesize
3.9MB

Download