xmrig | cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
Size

2.0MB
MD5

5a2a6bef68dee5b4a182ba639c44a496
SHA1

a937b9bbe34f2f2b0750360142da9aa904a24728
SHA256

cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6
SHA512

4623a3054c4e57fb85590ff9e8aef17f134d40a6a0d58f188f93d24645238c19cc041899edfa14b4a8490a2b0601e053fe23b2fdfe67cfc7b3817003a7fe8c30
SSDEEP

49152:Lz071uv4BPMkyW10/w16BvZX71Fq86zUPb:NABG

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/2364-356-0x00007FF6A5300000-0x00007FF6A56F2000-memory.dmp	xmrig
behavioral2/memory/3984-400-0x00007FF78A760000-0x00007FF78AB52000-memory.dmp	xmrig
behavioral2/memory/948-440-0x00007FF735910000-0x00007FF735D02000-memory.dmp	xmrig
behavioral2/memory/4664-512-0x00007FF690800000-0x00007FF690BF2000-memory.dmp	xmrig
behavioral2/memory/2420-535-0x00007FF799F30000-0x00007FF79A322000-memory.dmp	xmrig
behavioral2/memory/3716-570-0x00007FF63A4D0000-0x00007FF63A8C2000-memory.dmp	xmrig
behavioral2/memory/3752-645-0x00007FF6F9F70000-0x00007FF6FA362000-memory.dmp	xmrig
behavioral2/memory/4940-631-0x00007FF671B90000-0x00007FF671F82000-memory.dmp	xmrig
behavioral2/memory/2196-629-0x00007FF78BD30000-0x00007FF78C122000-memory.dmp	xmrig
behavioral2/memory/1960-625-0x00007FF75B120000-0x00007FF75B512000-memory.dmp	xmrig
behavioral2/memory/1348-604-0x00007FF6C4D00000-0x00007FF6C50F2000-memory.dmp	xmrig
behavioral2/memory/4752-569-0x00007FF769A00000-0x00007FF769DF2000-memory.dmp	xmrig
behavioral2/memory/2648-561-0x00007FF7A3B20000-0x00007FF7A3F12000-memory.dmp	xmrig
behavioral2/memory/448-529-0x00007FF6C8200000-0x00007FF6C85F2000-memory.dmp	xmrig
behavioral2/memory/2484-499-0x00007FF7C09F0000-0x00007FF7C0DE2000-memory.dmp	xmrig
behavioral2/memory/2692-922-0x00007FF7A7D40000-0x00007FF7A8132000-memory.dmp	xmrig
behavioral2/memory/4552-860-0x00007FF6B24D0000-0x00007FF6B28C2000-memory.dmp	xmrig
behavioral2/memory/2940-484-0x00007FF6DC390000-0x00007FF6DC782000-memory.dmp	xmrig
behavioral2/memory/2532-464-0x00007FF60D010000-0x00007FF60D402000-memory.dmp	xmrig
behavioral2/memory/2412-463-0x00007FF6E45C0000-0x00007FF6E49B2000-memory.dmp	xmrig
behavioral2/memory/3376-423-0x00007FF69CD20000-0x00007FF69D112000-memory.dmp	xmrig
behavioral2/memory/3856-306-0x00007FF63DC90000-0x00007FF63E082000-memory.dmp	xmrig
behavioral2/memory/3388-227-0x00007FF790690000-0x00007FF790A82000-memory.dmp	xmrig
behavioral2/memory/2248-17-0x00007FF760A00000-0x00007FF760DF2000-memory.dmp	xmrig
behavioral2/memory/2364-2811-0x00007FF6A5300000-0x00007FF6A56F2000-memory.dmp	xmrig
behavioral2/memory/4552-2837-0x00007FF6B24D0000-0x00007FF6B28C2000-memory.dmp	xmrig
behavioral2/memory/1348-2860-0x00007FF6C4D00000-0x00007FF6C50F2000-memory.dmp	xmrig
behavioral2/memory/2692-2910-0x00007FF7A7D40000-0x00007FF7A8132000-memory.dmp	xmrig
behavioral2/memory/2196-3034-0x00007FF78BD30000-0x00007FF78C122000-memory.dmp	xmrig
behavioral2/memory/4940-2995-0x00007FF671B90000-0x00007FF671F82000-memory.dmp	xmrig
behavioral2/memory/3716-2993-0x00007FF63A4D0000-0x00007FF63A8C2000-memory.dmp	xmrig
behavioral2/memory/2940-3004-0x00007FF6DC390000-0x00007FF6DC782000-memory.dmp	xmrig
behavioral2/memory/1960-2945-0x00007FF75B120000-0x00007FF75B512000-memory.dmp	xmrig
behavioral2/memory/2420-2941-0x00007FF799F30000-0x00007FF79A322000-memory.dmp	xmrig
behavioral2/memory/4752-2920-0x00007FF769A00000-0x00007FF769DF2000-memory.dmp	xmrig
behavioral2/memory/2648-2914-0x00007FF7A3B20000-0x00007FF7A3F12000-memory.dmp	xmrig
behavioral2/memory/448-2900-0x00007FF6C8200000-0x00007FF6C85F2000-memory.dmp	xmrig
behavioral2/memory/2532-2869-0x00007FF60D010000-0x00007FF60D402000-memory.dmp	xmrig
behavioral2/memory/2412-2873-0x00007FF6E45C0000-0x00007FF6E49B2000-memory.dmp	xmrig
behavioral2/memory/948-2863-0x00007FF735910000-0x00007FF735D02000-memory.dmp	xmrig
behavioral2/memory/2484-2853-0x00007FF7C09F0000-0x00007FF7C0DE2000-memory.dmp	xmrig
behavioral2/memory/3376-2833-0x00007FF69CD20000-0x00007FF69D112000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4788	powershell.exe
5	4788	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4788	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2248	xtlXwZS.exe
3752	YDdgcWm.exe
3388	MMUXPNB.exe
3856	cKedJmz.exe
2364	zXbSGkp.exe
4552	GVclIQT.exe
3984	rwQiqvH.exe
3376	xydIzAH.exe
948	ABvtysX.exe
2412	ehdDSRS.exe
2532	oQHLMzh.exe
2940	VcjcjvB.exe
2484	hUPJVUN.exe
2692	bHDFiED.exe
4664	YLxaIQX.exe
448	vlCsoEn.exe
2420	fMXFIZj.exe
2648	rFOnBBz.exe
4752	hbiokFu.exe
3716	XGQELAG.exe
1348	AggLawz.exe
1960	wZsCHhS.exe
2196	StZyYAX.exe
4940	kkDMZyb.exe
1948	FQqQxix.exe
1732	CvCOksN.exe
1472	VRtTzdS.exe
4020	qWxhyAy.exe
2956	tSzfTlu.exe
2800	ksDKsMJ.exe
1432	BGbRvGL.exe
2976	fknYebH.exe
3532	fuIryhY.exe
4164	fDtcwXL.exe
528	VTdxuDI.exe
2924	rOmjCwG.exe
4456	SZIQYGT.exe
3204	vmWUhMF.exe
1880	cjoYmfp.exe
1724	OPAlgnt.exe
1476	PhkzgTC.exe
2728	HAiVkKV.exe
3772	eaYIExs.exe
532	vSedtLp.exe
1728	JmmacPB.exe
1320	ngTfedw.exe
1144	KvdyWVm.exe
1208	imcxKtU.exe
4420	UOoygDB.exe
4832	JPSnHWz.exe
1636	rMUCcNG.exe
2368	DMxGTmA.exe
3068	YukQZix.exe
4736	JyYrayD.exe
4220	giiyVaB.exe
408	crwvuxm.exe
1108	nPkPPRq.exe
3432	BWJunLo.exe
3232	fwcJJQI.exe
4948	NazGoDr.exe
1232	FxSMVfH.exe
3416	JqprfOP.exe
1736	xniLjeT.exe
1784	YTSxEgG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4560-0-0x00007FF7B3A20000-0x00007FF7B3E12000-memory.dmp	upx
behavioral2/files/0x00070000000235d8-34.dat	upx
behavioral2/files/0x00070000000235db-48.dat	upx
behavioral2/files/0x00070000000235e9-82.dat	upx
behavioral2/files/0x00070000000235f1-170.dat	upx
behavioral2/files/0x00070000000235f0-169.dat	upx
behavioral2/files/0x00070000000235e5-158.dat	upx
behavioral2/files/0x00070000000235e2-154.dat	upx
behavioral2/files/0x00070000000235e1-150.dat	upx
behavioral2/files/0x00070000000235e0-147.dat	upx
behavioral2/files/0x00070000000235df-143.dat	upx
behavioral2/files/0x00070000000235e8-125.dat	upx
behavioral2/files/0x00070000000235ee-123.dat	upx
behavioral2/memory/2364-356-0x00007FF6A5300000-0x00007FF6A56F2000-memory.dmp	upx
behavioral2/memory/3984-400-0x00007FF78A760000-0x00007FF78AB52000-memory.dmp	upx
behavioral2/memory/948-440-0x00007FF735910000-0x00007FF735D02000-memory.dmp	upx
behavioral2/memory/4664-512-0x00007FF690800000-0x00007FF690BF2000-memory.dmp	upx
behavioral2/memory/2420-535-0x00007FF799F30000-0x00007FF79A322000-memory.dmp	upx
behavioral2/memory/3716-570-0x00007FF63A4D0000-0x00007FF63A8C2000-memory.dmp	upx
behavioral2/memory/3752-645-0x00007FF6F9F70000-0x00007FF6FA362000-memory.dmp	upx
behavioral2/memory/4940-631-0x00007FF671B90000-0x00007FF671F82000-memory.dmp	upx
behavioral2/memory/2196-629-0x00007FF78BD30000-0x00007FF78C122000-memory.dmp	upx
behavioral2/memory/1960-625-0x00007FF75B120000-0x00007FF75B512000-memory.dmp	upx
behavioral2/memory/1348-604-0x00007FF6C4D00000-0x00007FF6C50F2000-memory.dmp	upx
behavioral2/memory/4752-569-0x00007FF769A00000-0x00007FF769DF2000-memory.dmp	upx
behavioral2/memory/2648-561-0x00007FF7A3B20000-0x00007FF7A3F12000-memory.dmp	upx
behavioral2/memory/448-529-0x00007FF6C8200000-0x00007FF6C85F2000-memory.dmp	upx
behavioral2/memory/2484-499-0x00007FF7C09F0000-0x00007FF7C0DE2000-memory.dmp	upx
behavioral2/memory/2692-922-0x00007FF7A7D40000-0x00007FF7A8132000-memory.dmp	upx
behavioral2/memory/4552-860-0x00007FF6B24D0000-0x00007FF6B28C2000-memory.dmp	upx
behavioral2/memory/2940-484-0x00007FF6DC390000-0x00007FF6DC782000-memory.dmp	upx
behavioral2/memory/2532-464-0x00007FF60D010000-0x00007FF60D402000-memory.dmp	upx
behavioral2/memory/2412-463-0x00007FF6E45C0000-0x00007FF6E49B2000-memory.dmp	upx
behavioral2/memory/3376-423-0x00007FF69CD20000-0x00007FF69D112000-memory.dmp	upx
behavioral2/memory/3856-306-0x00007FF63DC90000-0x00007FF63E082000-memory.dmp	upx
behavioral2/memory/3388-227-0x00007FF790690000-0x00007FF790A82000-memory.dmp	upx
behavioral2/files/0x00070000000235e3-193.dat	upx
behavioral2/files/0x00070000000235fa-192.dat	upx
behavioral2/files/0x00070000000235f9-191.dat	upx
behavioral2/files/0x00070000000235f8-190.dat	upx
behavioral2/files/0x00070000000235f7-188.dat	upx
behavioral2/files/0x00070000000235ea-182.dat	upx
behavioral2/files/0x00070000000235f6-181.dat	upx
behavioral2/files/0x00070000000235f5-178.dat	upx
behavioral2/files/0x00070000000235f4-173.dat	upx
behavioral2/files/0x00070000000235f3-172.dat	upx
behavioral2/files/0x00070000000235f2-171.dat	upx
behavioral2/files/0x00070000000235ed-120.dat	upx
behavioral2/files/0x00070000000235ec-119.dat	upx
behavioral2/files/0x00080000000235d2-118.dat	upx
behavioral2/files/0x00070000000235eb-117.dat	upx
behavioral2/files/0x00070000000235e7-113.dat	upx
behavioral2/files/0x00070000000235e6-111.dat	upx
behavioral2/files/0x00070000000235da-108.dat	upx
behavioral2/files/0x00070000000235dc-107.dat	upx
behavioral2/files/0x00070000000235e4-98.dat	upx
behavioral2/files/0x00070000000235de-92.dat	upx
behavioral2/files/0x00070000000235d9-85.dat	upx
behavioral2/files/0x00070000000235ef-124.dat	upx
behavioral2/files/0x00070000000235dd-61.dat	upx
behavioral2/files/0x00070000000235d6-54.dat	upx
behavioral2/files/0x00080000000235d4-47.dat	upx
behavioral2/files/0x00070000000235d7-44.dat	upx
behavioral2/files/0x00070000000235d5-26.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VLtHMFB.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\jaApUSv.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\OqrMGGO.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\uiiMGgE.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\EiHVinA.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\LfVpQMH.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\UaCfImj.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\yoBgamV.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\UamCqWJ.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\ezdjwID.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\RTiVHMw.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\VyTbeJf.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\ztXpNmE.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\iqrAhFv.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\YDZCIyq.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\PBtlfDr.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\csOIROx.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\lYiowwj.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\NrEcCJh.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\rYvdjPY.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\YpdsQtc.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\jMltIQx.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\DmwtNuT.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\jgaXOji.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\VIYmuax.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\JWZoHQz.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\TWjZSnG.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\DrvdsBd.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\fiAlSbp.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\lejtZGO.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\MkAwJjN.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\LpfYpjW.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\GvwOQTi.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\CZoBdWe.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\kDKqvtP.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\KeoLbol.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\eWfcIdf.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\UkeIzEH.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\YWCggjF.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\fOqXUyr.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\HgXQfqO.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\MsuMABv.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\fEaTyqD.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\Rsmbhlv.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\TmXekcv.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\SmfLdwm.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\GNnpJVY.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\ZEavArb.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\AWNMraC.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\fneVSLA.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\XOqxyIK.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\jbvULYq.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\uhHofNX.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\QnEinSk.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\YOZjIzw.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\knCSuDS.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\eosOvIs.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\YpcFIMB.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\uwKWvmL.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\yXPPvUz.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\NLamVUM.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\cPdxQuu.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\JuWqIPN.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
File created	C:\Windows\System\CCoxMmL.exe	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeLockMemoryPrivilege	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4788	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	81
PID 4560 wrote to memory of 4788	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	81
PID 4560 wrote to memory of 2248	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	83
PID 4560 wrote to memory of 2248	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	83
PID 4560 wrote to memory of 3752	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	84
PID 4560 wrote to memory of 3752	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	84
PID 4560 wrote to memory of 3388	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	85
PID 4560 wrote to memory of 3388	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	85
PID 4560 wrote to memory of 3856	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	86
PID 4560 wrote to memory of 3856	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	86
PID 4560 wrote to memory of 2364	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	87
PID 4560 wrote to memory of 2364	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	87
PID 4560 wrote to memory of 4552	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	88
PID 4560 wrote to memory of 4552	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	88
PID 4560 wrote to memory of 3984	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	89
PID 4560 wrote to memory of 3984	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	89
PID 4560 wrote to memory of 3376	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	90
PID 4560 wrote to memory of 3376	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	90
PID 4560 wrote to memory of 948	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	91
PID 4560 wrote to memory of 948	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	91
PID 4560 wrote to memory of 2412	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	92
PID 4560 wrote to memory of 2412	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	92
PID 4560 wrote to memory of 2532	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	93
PID 4560 wrote to memory of 2532	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	93
PID 4560 wrote to memory of 2940	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	94
PID 4560 wrote to memory of 2940	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	94
PID 4560 wrote to memory of 2484	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	95
PID 4560 wrote to memory of 2484	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	95
PID 4560 wrote to memory of 448	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	96
PID 4560 wrote to memory of 448	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	96
PID 4560 wrote to memory of 2420	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	97
PID 4560 wrote to memory of 2420	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	97
PID 4560 wrote to memory of 2648	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	98
PID 4560 wrote to memory of 2648	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	98
PID 4560 wrote to memory of 4752	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	99
PID 4560 wrote to memory of 4752	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	99
PID 4560 wrote to memory of 3716	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	100
PID 4560 wrote to memory of 3716	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	100
PID 4560 wrote to memory of 1348	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	101
PID 4560 wrote to memory of 1348	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	101
PID 4560 wrote to memory of 1960	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	102
PID 4560 wrote to memory of 1960	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	102
PID 4560 wrote to memory of 2196	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	103
PID 4560 wrote to memory of 2196	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	103
PID 4560 wrote to memory of 4940	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	104
PID 4560 wrote to memory of 4940	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	104
PID 4560 wrote to memory of 2692	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	105
PID 4560 wrote to memory of 2692	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	105
PID 4560 wrote to memory of 4664	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	106
PID 4560 wrote to memory of 4664	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	106
PID 4560 wrote to memory of 1948	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	107
PID 4560 wrote to memory of 1948	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	107
PID 4560 wrote to memory of 1732	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	108
PID 4560 wrote to memory of 1732	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	108
PID 4560 wrote to memory of 1472	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	109
PID 4560 wrote to memory of 1472	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	109
PID 4560 wrote to memory of 4020	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	110
PID 4560 wrote to memory of 4020	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	110
PID 4560 wrote to memory of 2956	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	111
PID 4560 wrote to memory of 2956	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	111
PID 4560 wrote to memory of 2800	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	112
PID 4560 wrote to memory of 2800	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	112
PID 4560 wrote to memory of 1432	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	113
PID 4560 wrote to memory of 1432	4560	cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe	113

C:\Users\Admin\AppData\Local\Temp\cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe
"C:\Users\Admin\AppData\Local\Temp\cd974daccae2a0d5cf177e6bf30b10bd09c0b53d3060ca1e9c1ccdaa49db7be6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\System\xtlXwZS.exe
  C:\Windows\System\xtlXwZS.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\YDdgcWm.exe
  C:\Windows\System\YDdgcWm.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\MMUXPNB.exe
  C:\Windows\System\MMUXPNB.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\cKedJmz.exe
  C:\Windows\System\cKedJmz.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\zXbSGkp.exe
  C:\Windows\System\zXbSGkp.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\GVclIQT.exe
  C:\Windows\System\GVclIQT.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\rwQiqvH.exe
  C:\Windows\System\rwQiqvH.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\xydIzAH.exe
  C:\Windows\System\xydIzAH.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\ABvtysX.exe
  C:\Windows\System\ABvtysX.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\ehdDSRS.exe
  C:\Windows\System\ehdDSRS.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\oQHLMzh.exe
  C:\Windows\System\oQHLMzh.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\VcjcjvB.exe
  C:\Windows\System\VcjcjvB.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\hUPJVUN.exe
  C:\Windows\System\hUPJVUN.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\vlCsoEn.exe
  C:\Windows\System\vlCsoEn.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\fMXFIZj.exe
  C:\Windows\System\fMXFIZj.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\rFOnBBz.exe
  C:\Windows\System\rFOnBBz.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\hbiokFu.exe
  C:\Windows\System\hbiokFu.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\XGQELAG.exe
  C:\Windows\System\XGQELAG.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\AggLawz.exe
  C:\Windows\System\AggLawz.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\wZsCHhS.exe
  C:\Windows\System\wZsCHhS.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\StZyYAX.exe
  C:\Windows\System\StZyYAX.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\kkDMZyb.exe
  C:\Windows\System\kkDMZyb.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\bHDFiED.exe
  C:\Windows\System\bHDFiED.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\YLxaIQX.exe
  C:\Windows\System\YLxaIQX.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\FQqQxix.exe
  C:\Windows\System\FQqQxix.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\CvCOksN.exe
  C:\Windows\System\CvCOksN.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\VRtTzdS.exe
  C:\Windows\System\VRtTzdS.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\qWxhyAy.exe
  C:\Windows\System\qWxhyAy.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\tSzfTlu.exe
  C:\Windows\System\tSzfTlu.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\ksDKsMJ.exe
  C:\Windows\System\ksDKsMJ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\BGbRvGL.exe
  C:\Windows\System\BGbRvGL.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\fknYebH.exe
  C:\Windows\System\fknYebH.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\fuIryhY.exe
  C:\Windows\System\fuIryhY.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\fDtcwXL.exe
  C:\Windows\System\fDtcwXL.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\VTdxuDI.exe
  C:\Windows\System\VTdxuDI.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\rOmjCwG.exe
  C:\Windows\System\rOmjCwG.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\SZIQYGT.exe
  C:\Windows\System\SZIQYGT.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\vmWUhMF.exe
  C:\Windows\System\vmWUhMF.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\cjoYmfp.exe
  C:\Windows\System\cjoYmfp.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\OPAlgnt.exe
  C:\Windows\System\OPAlgnt.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\PhkzgTC.exe
  C:\Windows\System\PhkzgTC.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\HAiVkKV.exe
  C:\Windows\System\HAiVkKV.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\JyYrayD.exe
  C:\Windows\System\JyYrayD.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\eaYIExs.exe
  C:\Windows\System\eaYIExs.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\vSedtLp.exe
  C:\Windows\System\vSedtLp.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\JmmacPB.exe
  C:\Windows\System\JmmacPB.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\ngTfedw.exe
  C:\Windows\System\ngTfedw.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\KvdyWVm.exe
  C:\Windows\System\KvdyWVm.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\imcxKtU.exe
  C:\Windows\System\imcxKtU.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\UOoygDB.exe
  C:\Windows\System\UOoygDB.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\JPSnHWz.exe
  C:\Windows\System\JPSnHWz.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\rMUCcNG.exe
  C:\Windows\System\rMUCcNG.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\DMxGTmA.exe
  C:\Windows\System\DMxGTmA.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\YukQZix.exe
  C:\Windows\System\YukQZix.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\giiyVaB.exe
  C:\Windows\System\giiyVaB.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\crwvuxm.exe
  C:\Windows\System\crwvuxm.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\nPkPPRq.exe
  C:\Windows\System\nPkPPRq.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\BWJunLo.exe
  C:\Windows\System\BWJunLo.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\fwcJJQI.exe
  C:\Windows\System\fwcJJQI.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\NazGoDr.exe
  C:\Windows\System\NazGoDr.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\FxSMVfH.exe
  C:\Windows\System\FxSMVfH.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\JqprfOP.exe
  C:\Windows\System\JqprfOP.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\xniLjeT.exe
  C:\Windows\System\xniLjeT.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\YTSxEgG.exe
  C:\Windows\System\YTSxEgG.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\NzdKTyr.exe
  C:\Windows\System\NzdKTyr.exe
  2⤵
  PID:1844
- C:\Windows\System\DoNogdk.exe
  C:\Windows\System\DoNogdk.exe
  2⤵
  PID:4580
- C:\Windows\System\sCfmxGN.exe
  C:\Windows\System\sCfmxGN.exe
  2⤵
  PID:636
- C:\Windows\System\KTMDFQG.exe
  C:\Windows\System\KTMDFQG.exe
  2⤵
  PID:2960
- C:\Windows\System\DrYoisW.exe
  C:\Windows\System\DrYoisW.exe
  2⤵
  PID:4852
- C:\Windows\System\zzehBwn.exe
  C:\Windows\System\zzehBwn.exe
  2⤵
  PID:1740
- C:\Windows\System\ndKXUOv.exe
  C:\Windows\System\ndKXUOv.exe
  2⤵
  PID:3780
- C:\Windows\System\UHynIRo.exe
  C:\Windows\System\UHynIRo.exe
  2⤵
  PID:812
- C:\Windows\System\wnUxtPm.exe
  C:\Windows\System\wnUxtPm.exe
  2⤵
  PID:4748
- C:\Windows\System\wwEzkMY.exe
  C:\Windows\System\wwEzkMY.exe
  2⤵
  PID:2936
- C:\Windows\System\jpEBkyk.exe
  C:\Windows\System\jpEBkyk.exe
  2⤵
  PID:1512
- C:\Windows\System\yXKUGXi.exe
  C:\Windows\System\yXKUGXi.exe
  2⤵
  PID:932
- C:\Windows\System\qeKIphQ.exe
  C:\Windows\System\qeKIphQ.exe
  2⤵
  PID:2004
- C:\Windows\System\QNQfrRI.exe
  C:\Windows\System\QNQfrRI.exe
  2⤵
  PID:540
- C:\Windows\System\SzMcsED.exe
  C:\Windows\System\SzMcsED.exe
  2⤵
  PID:3744
- C:\Windows\System\rjrlltZ.exe
  C:\Windows\System\rjrlltZ.exe
  2⤵
  PID:348
- C:\Windows\System\iAhKDsN.exe
  C:\Windows\System\iAhKDsN.exe
  2⤵
  PID:4936
- C:\Windows\System\ZdugUOR.exe
  C:\Windows\System\ZdugUOR.exe
  2⤵
  PID:3172
- C:\Windows\System\mxHkDHM.exe
  C:\Windows\System\mxHkDHM.exe
  2⤵
  PID:1952
- C:\Windows\System\UKPRUbx.exe
  C:\Windows\System\UKPRUbx.exe
  2⤵
  PID:4188
- C:\Windows\System\kWzekGe.exe
  C:\Windows\System\kWzekGe.exe
  2⤵
  PID:3264
- C:\Windows\System\CcADFkp.exe
  C:\Windows\System\CcADFkp.exe
  2⤵
  PID:2068
- C:\Windows\System\pnVaAXt.exe
  C:\Windows\System\pnVaAXt.exe
  2⤵
  PID:1028
- C:\Windows\System\XukvGXJ.exe
  C:\Windows\System\XukvGXJ.exe
  2⤵
  PID:3748
- C:\Windows\System\ztTzXsf.exe
  C:\Windows\System\ztTzXsf.exe
  2⤵
  PID:3248
- C:\Windows\System\xtzDhvk.exe
  C:\Windows\System\xtzDhvk.exe
  2⤵
  PID:1496
- C:\Windows\System\YyhZlQq.exe
  C:\Windows\System\YyhZlQq.exe
  2⤵
  PID:4056
- C:\Windows\System\pfoZuIt.exe
  C:\Windows\System\pfoZuIt.exe
  2⤵
  PID:3592
- C:\Windows\System\tqDNJNN.exe
  C:\Windows\System\tqDNJNN.exe
  2⤵
  PID:5132
- C:\Windows\System\KYRRzEM.exe
  C:\Windows\System\KYRRzEM.exe
  2⤵
  PID:5168
- C:\Windows\System\kurzmfs.exe
  C:\Windows\System\kurzmfs.exe
  2⤵
  PID:5188
- C:\Windows\System\pPlNDdA.exe
  C:\Windows\System\pPlNDdA.exe
  2⤵
  PID:5212
- C:\Windows\System\iasOaJP.exe
  C:\Windows\System\iasOaJP.exe
  2⤵
  PID:5236
- C:\Windows\System\yKCtpdE.exe
  C:\Windows\System\yKCtpdE.exe
  2⤵
  PID:5256
- C:\Windows\System\mauOZYB.exe
  C:\Windows\System\mauOZYB.exe
  2⤵
  PID:5276
- C:\Windows\System\khUiOki.exe
  C:\Windows\System\khUiOki.exe
  2⤵
  PID:5296
- C:\Windows\System\tBYJvbf.exe
  C:\Windows\System\tBYJvbf.exe
  2⤵
  PID:5320
- C:\Windows\System\TVwfTul.exe
  C:\Windows\System\TVwfTul.exe
  2⤵
  PID:5344
- C:\Windows\System\yrInfOk.exe
  C:\Windows\System\yrInfOk.exe
  2⤵
  PID:5372
- C:\Windows\System\yeaBqPd.exe
  C:\Windows\System\yeaBqPd.exe
  2⤵
  PID:5404
- C:\Windows\System\xLPNhmQ.exe
  C:\Windows\System\xLPNhmQ.exe
  2⤵
  PID:5428
- C:\Windows\System\gbMESmY.exe
  C:\Windows\System\gbMESmY.exe
  2⤵
  PID:5444
- C:\Windows\System\GcgQRzC.exe
  C:\Windows\System\GcgQRzC.exe
  2⤵
  PID:5460
- C:\Windows\System\pklqKmE.exe
  C:\Windows\System\pklqKmE.exe
  2⤵
  PID:5500
- C:\Windows\System\VDqdvHu.exe
  C:\Windows\System\VDqdvHu.exe
  2⤵
  PID:5516
- C:\Windows\System\vCSTNBF.exe
  C:\Windows\System\vCSTNBF.exe
  2⤵
  PID:5532
- C:\Windows\System\mIIyLqt.exe
  C:\Windows\System\mIIyLqt.exe
  2⤵
  PID:5548
- C:\Windows\System\IOFjOvZ.exe
  C:\Windows\System\IOFjOvZ.exe
  2⤵
  PID:5568
- C:\Windows\System\bwvDVWg.exe
  C:\Windows\System\bwvDVWg.exe
  2⤵
  PID:5628
- C:\Windows\System\GsHiPse.exe
  C:\Windows\System\GsHiPse.exe
  2⤵
  PID:5652
- C:\Windows\System\zXfJWnj.exe
  C:\Windows\System\zXfJWnj.exe
  2⤵
  PID:5672
- C:\Windows\System\ijTNSJK.exe
  C:\Windows\System\ijTNSJK.exe
  2⤵
  PID:5688
- C:\Windows\System\oZiJbgw.exe
  C:\Windows\System\oZiJbgw.exe
  2⤵
  PID:5712
- C:\Windows\System\evBKJuj.exe
  C:\Windows\System\evBKJuj.exe
  2⤵
  PID:5728
- C:\Windows\System\bRWNPxK.exe
  C:\Windows\System\bRWNPxK.exe
  2⤵
  PID:5760
- C:\Windows\System\rtgimDe.exe
  C:\Windows\System\rtgimDe.exe
  2⤵
  PID:5780
- C:\Windows\System\OjTcFEX.exe
  C:\Windows\System\OjTcFEX.exe
  2⤵
  PID:5800
- C:\Windows\System\KwOOHnv.exe
  C:\Windows\System\KwOOHnv.exe
  2⤵
  PID:5820
- C:\Windows\System\dBLhbYM.exe
  C:\Windows\System\dBLhbYM.exe
  2⤵
  PID:5840
- C:\Windows\System\FKAACfC.exe
  C:\Windows\System\FKAACfC.exe
  2⤵
  PID:5864
- C:\Windows\System\GDTPpaw.exe
  C:\Windows\System\GDTPpaw.exe
  2⤵
  PID:5888
- C:\Windows\System\xhiUEKq.exe
  C:\Windows\System\xhiUEKq.exe
  2⤵
  PID:5908
- C:\Windows\System\ghmUrJm.exe
  C:\Windows\System\ghmUrJm.exe
  2⤵
  PID:5932
- C:\Windows\System\knjhhHc.exe
  C:\Windows\System\knjhhHc.exe
  2⤵
  PID:5960
- C:\Windows\System\AlhUvwC.exe
  C:\Windows\System\AlhUvwC.exe
  2⤵
  PID:5976
- C:\Windows\System\DlsBKWv.exe
  C:\Windows\System\DlsBKWv.exe
  2⤵
  PID:5164
- C:\Windows\System\tUpDiXo.exe
  C:\Windows\System\tUpDiXo.exe
  2⤵
  PID:5204
- C:\Windows\System\yETuWen.exe
  C:\Windows\System\yETuWen.exe
  2⤵
  PID:5232
- C:\Windows\System\cnQfRjn.exe
  C:\Windows\System\cnQfRjn.exe
  2⤵
  PID:5292
- C:\Windows\System\TTEoutc.exe
  C:\Windows\System\TTEoutc.exe
  2⤵
  PID:5412
- C:\Windows\System\zUcjQGI.exe
  C:\Windows\System\zUcjQGI.exe
  2⤵
  PID:5664
- C:\Windows\System\MVpvTgi.exe
  C:\Windows\System\MVpvTgi.exe
  2⤵
  PID:5720
- C:\Windows\System\PYtTkLs.exe
  C:\Windows\System\PYtTkLs.exe
  2⤵
  PID:5940
- C:\Windows\System\zDFVCav.exe
  C:\Windows\System\zDFVCav.exe
  2⤵
  PID:5836
- C:\Windows\System\PLosXMX.exe
  C:\Windows\System\PLosXMX.exe
  2⤵
  PID:5816
- C:\Windows\System\CAFQGZF.exe
  C:\Windows\System\CAFQGZF.exe
  2⤵
  PID:5768
- C:\Windows\System\ZBOENgz.exe
  C:\Windows\System\ZBOENgz.exe
  2⤵
  PID:5832
- C:\Windows\System\nszJnGA.exe
  C:\Windows\System\nszJnGA.exe
  2⤵
  PID:6124
- C:\Windows\System\TsJXZzt.exe
  C:\Windows\System\TsJXZzt.exe
  2⤵
  PID:392
- C:\Windows\System\EyqhZgY.exe
  C:\Windows\System\EyqhZgY.exe
  2⤵
  PID:1796
- C:\Windows\System\xXgcyUe.exe
  C:\Windows\System\xXgcyUe.exe
  2⤵
  PID:4720
- C:\Windows\System\chGBAuI.exe
  C:\Windows\System\chGBAuI.exe
  2⤵
  PID:4872
- C:\Windows\System\IQNikoW.exe
  C:\Windows\System\IQNikoW.exe
  2⤵
  PID:5144
- C:\Windows\System\vWTxjVe.exe
  C:\Windows\System\vWTxjVe.exe
  2⤵
  PID:5264
- C:\Windows\System\XbnMraO.exe
  C:\Windows\System\XbnMraO.exe
  2⤵
  PID:5508
- C:\Windows\System\ryJJSnQ.exe
  C:\Windows\System\ryJJSnQ.exe
  2⤵
  PID:6148
- C:\Windows\System\PZvWoNN.exe
  C:\Windows\System\PZvWoNN.exe
  2⤵
  PID:6208
- C:\Windows\System\KFUvLJC.exe
  C:\Windows\System\KFUvLJC.exe
  2⤵
  PID:6224
- C:\Windows\System\IxleXHf.exe
  C:\Windows\System\IxleXHf.exe
  2⤵
  PID:6240
- C:\Windows\System\UHfCZMs.exe
  C:\Windows\System\UHfCZMs.exe
  2⤵
  PID:6256
- C:\Windows\System\lyLNvSu.exe
  C:\Windows\System\lyLNvSu.exe
  2⤵
  PID:6272
- C:\Windows\System\TTAxuNr.exe
  C:\Windows\System\TTAxuNr.exe
  2⤵
  PID:6288
- C:\Windows\System\rTGxrSY.exe
  C:\Windows\System\rTGxrSY.exe
  2⤵
  PID:6304
- C:\Windows\System\jZXrPxK.exe
  C:\Windows\System\jZXrPxK.exe
  2⤵
  PID:6320
- C:\Windows\System\LMrkygQ.exe
  C:\Windows\System\LMrkygQ.exe
  2⤵
  PID:6336
- C:\Windows\System\BrITjBy.exe
  C:\Windows\System\BrITjBy.exe
  2⤵
  PID:6352
- C:\Windows\System\JRktXJL.exe
  C:\Windows\System\JRktXJL.exe
  2⤵
  PID:6372
- C:\Windows\System\SaysJCN.exe
  C:\Windows\System\SaysJCN.exe
  2⤵
  PID:6392
- C:\Windows\System\QzpczDz.exe
  C:\Windows\System\QzpczDz.exe
  2⤵
  PID:6416
- C:\Windows\System\AzbPQpx.exe
  C:\Windows\System\AzbPQpx.exe
  2⤵
  PID:6476
- C:\Windows\System\MqHPWHk.exe
  C:\Windows\System\MqHPWHk.exe
  2⤵
  PID:6500
- C:\Windows\System\PLCyVZU.exe
  C:\Windows\System\PLCyVZU.exe
  2⤵
  PID:6516
- C:\Windows\System\HKkRams.exe
  C:\Windows\System\HKkRams.exe
  2⤵
  PID:6540
- C:\Windows\System\eyzRDCI.exe
  C:\Windows\System\eyzRDCI.exe
  2⤵
  PID:6564
- C:\Windows\System\iXCVjWx.exe
  C:\Windows\System\iXCVjWx.exe
  2⤵
  PID:6588
- C:\Windows\System\CyIdXlq.exe
  C:\Windows\System\CyIdXlq.exe
  2⤵
  PID:6604
- C:\Windows\System\RSzaAmF.exe
  C:\Windows\System\RSzaAmF.exe
  2⤵
  PID:6620
- C:\Windows\System\GRbbIQe.exe
  C:\Windows\System\GRbbIQe.exe
  2⤵
  PID:6636
- C:\Windows\System\kkcioST.exe
  C:\Windows\System\kkcioST.exe
  2⤵
  PID:6652
- C:\Windows\System\sMWfQqQ.exe
  C:\Windows\System\sMWfQqQ.exe
  2⤵
  PID:6668
- C:\Windows\System\PWaQEsM.exe
  C:\Windows\System\PWaQEsM.exe
  2⤵
  PID:6688
- C:\Windows\System\LNImNPD.exe
  C:\Windows\System\LNImNPD.exe
  2⤵
  PID:6704
- C:\Windows\System\uxWtJVW.exe
  C:\Windows\System\uxWtJVW.exe
  2⤵
  PID:6724
- C:\Windows\System\aWEwNsD.exe
  C:\Windows\System\aWEwNsD.exe
  2⤵
  PID:6740
- C:\Windows\System\GItwEbm.exe
  C:\Windows\System\GItwEbm.exe
  2⤵
  PID:6760
- C:\Windows\System\tkXwplo.exe
  C:\Windows\System\tkXwplo.exe
  2⤵
  PID:6788
- C:\Windows\System\ZvSmmyk.exe
  C:\Windows\System\ZvSmmyk.exe
  2⤵
  PID:6804
- C:\Windows\System\eTmQmTj.exe
  C:\Windows\System\eTmQmTj.exe
  2⤵
  PID:6828
- C:\Windows\System\CaOTdYR.exe
  C:\Windows\System\CaOTdYR.exe
  2⤵
  PID:6852
- C:\Windows\System\jvqGdZd.exe
  C:\Windows\System\jvqGdZd.exe
  2⤵
  PID:6872
- C:\Windows\System\cCTBnTH.exe
  C:\Windows\System\cCTBnTH.exe
  2⤵
  PID:7100
- C:\Windows\System\MPQPHef.exe
  C:\Windows\System\MPQPHef.exe
  2⤵
  PID:7128
- C:\Windows\System\YWwwong.exe
  C:\Windows\System\YWwwong.exe
  2⤵
  PID:7144
- C:\Windows\System\BKixBAC.exe
  C:\Windows\System\BKixBAC.exe
  2⤵
  PID:7160
- C:\Windows\System\pOzTIHF.exe
  C:\Windows\System\pOzTIHF.exe
  2⤵
  PID:6112
- C:\Windows\System\weaQrPi.exe
  C:\Windows\System\weaQrPi.exe
  2⤵
  PID:2592
- C:\Windows\System\qxWaopP.exe
  C:\Windows\System\qxWaopP.exe
  2⤵
  PID:5196
- C:\Windows\System\inxKZVW.exe
  C:\Windows\System\inxKZVW.exe
  2⤵
  PID:5524
- C:\Windows\System\mxJfFWc.exe
  C:\Windows\System\mxJfFWc.exe
  2⤵
  PID:5660
- C:\Windows\System\IAFUQDO.exe
  C:\Windows\System\IAFUQDO.exe
  2⤵
  PID:6160
- C:\Windows\System\onVCWSo.exe
  C:\Windows\System\onVCWSo.exe
  2⤵
  PID:6264
- C:\Windows\System\efJnslG.exe
  C:\Windows\System\efJnslG.exe
  2⤵
  PID:6232
- C:\Windows\System\ZsisqQv.exe
  C:\Windows\System\ZsisqQv.exe
  2⤵
  PID:6284
- C:\Windows\System\jfivBes.exe
  C:\Windows\System\jfivBes.exe
  2⤵
  PID:6316
- C:\Windows\System\SnuTdKs.exe
  C:\Windows\System\SnuTdKs.exe
  2⤵
  PID:6348
- C:\Windows\System\RPnQiej.exe
  C:\Windows\System\RPnQiej.exe
  2⤵
  PID:6384
- C:\Windows\System\xgyqFvA.exe
  C:\Windows\System\xgyqFvA.exe
  2⤵
  PID:6424
- C:\Windows\System\YwctuSe.exe
  C:\Windows\System\YwctuSe.exe
  2⤵
  PID:6736
- C:\Windows\System\dZeNxJq.exe
  C:\Windows\System\dZeNxJq.exe
  2⤵
  PID:6484
- C:\Windows\System\lUxozzr.exe
  C:\Windows\System\lUxozzr.exe
  2⤵
  PID:6512
- C:\Windows\System\NAlqMeW.exe
  C:\Windows\System\NAlqMeW.exe
  2⤵
  PID:6548
- C:\Windows\System\mmxDAMx.exe
  C:\Windows\System\mmxDAMx.exe
  2⤵
  PID:6612
- C:\Windows\System\gLHtTrB.exe
  C:\Windows\System\gLHtTrB.exe
  2⤵
  PID:6644
- C:\Windows\System\CqfjEFX.exe
  C:\Windows\System\CqfjEFX.exe
  2⤵
  PID:6680
- C:\Windows\System\QtDJXwF.exe
  C:\Windows\System\QtDJXwF.exe
  2⤵
  PID:6696
- C:\Windows\System\NGQbcpv.exe
  C:\Windows\System\NGQbcpv.exe
  2⤵
  PID:7172
- C:\Windows\System\EvsTvjA.exe
  C:\Windows\System\EvsTvjA.exe
  2⤵
  PID:7208
- C:\Windows\System\BpqTSIs.exe
  C:\Windows\System\BpqTSIs.exe
  2⤵
  PID:7228
- C:\Windows\System\LVGvOZe.exe
  C:\Windows\System\LVGvOZe.exe
  2⤵
  PID:7252
- C:\Windows\System\XiGnsaR.exe
  C:\Windows\System\XiGnsaR.exe
  2⤵
  PID:7280
- C:\Windows\System\nqZKZBX.exe
  C:\Windows\System\nqZKZBX.exe
  2⤵
  PID:7308
- C:\Windows\System\ydroTCQ.exe
  C:\Windows\System\ydroTCQ.exe
  2⤵
  PID:7332
- C:\Windows\System\MfeYkGW.exe
  C:\Windows\System\MfeYkGW.exe
  2⤵
  PID:7400
- C:\Windows\System\BfhOdQr.exe
  C:\Windows\System\BfhOdQr.exe
  2⤵
  PID:7420
- C:\Windows\System\mQPSEOu.exe
  C:\Windows\System\mQPSEOu.exe
  2⤵
  PID:7436
- C:\Windows\System\MSHwrWj.exe
  C:\Windows\System\MSHwrWj.exe
  2⤵
  PID:7468
- C:\Windows\System\uBSWDXX.exe
  C:\Windows\System\uBSWDXX.exe
  2⤵
  PID:7504
- C:\Windows\System\sqCSVOa.exe
  C:\Windows\System\sqCSVOa.exe
  2⤵
  PID:7552
- C:\Windows\System\ROsxYnS.exe
  C:\Windows\System\ROsxYnS.exe
  2⤵
  PID:7568
- C:\Windows\System\xoKDPpQ.exe
  C:\Windows\System\xoKDPpQ.exe
  2⤵
  PID:7584
- C:\Windows\System\uasfZdB.exe
  C:\Windows\System\uasfZdB.exe
  2⤵
  PID:7600
- C:\Windows\System\ECUAEhu.exe
  C:\Windows\System\ECUAEhu.exe
  2⤵
  PID:7620
- C:\Windows\System\jEunVqd.exe
  C:\Windows\System\jEunVqd.exe
  2⤵
  PID:7668
- C:\Windows\System\Tjalzad.exe
  C:\Windows\System\Tjalzad.exe
  2⤵
  PID:7704
- C:\Windows\System\IngzbpJ.exe
  C:\Windows\System\IngzbpJ.exe
  2⤵
  PID:7724
- C:\Windows\System\OfkVsIl.exe
  C:\Windows\System\OfkVsIl.exe
  2⤵
  PID:7800
- C:\Windows\System\EHZzRDb.exe
  C:\Windows\System\EHZzRDb.exe
  2⤵
  PID:7824
- C:\Windows\System\saBYrXA.exe
  C:\Windows\System\saBYrXA.exe
  2⤵
  PID:7840
- C:\Windows\System\FyiSOzI.exe
  C:\Windows\System\FyiSOzI.exe
  2⤵
  PID:7868
- C:\Windows\System\pHOcXLV.exe
  C:\Windows\System\pHOcXLV.exe
  2⤵
  PID:7888
- C:\Windows\System\VEstdgQ.exe
  C:\Windows\System\VEstdgQ.exe
  2⤵
  PID:7912
- C:\Windows\System\jIQlEeX.exe
  C:\Windows\System\jIQlEeX.exe
  2⤵
  PID:7936
- C:\Windows\System\wxspxbM.exe
  C:\Windows\System\wxspxbM.exe
  2⤵
  PID:7960
- C:\Windows\System\wVnfMVw.exe
  C:\Windows\System\wVnfMVw.exe
  2⤵
  PID:7984
- C:\Windows\System\QPbubiJ.exe
  C:\Windows\System\QPbubiJ.exe
  2⤵
  PID:8004
- C:\Windows\System\kBUPkqq.exe
  C:\Windows\System\kBUPkqq.exe
  2⤵
  PID:8032
- C:\Windows\System\IstSiXu.exe
  C:\Windows\System\IstSiXu.exe
  2⤵
  PID:8056
- C:\Windows\System\nZbbies.exe
  C:\Windows\System\nZbbies.exe
  2⤵
  PID:8084
- C:\Windows\System\rZNSRqm.exe
  C:\Windows\System\rZNSRqm.exe
  2⤵
  PID:8100
- C:\Windows\System\bsiKNKr.exe
  C:\Windows\System\bsiKNKr.exe
  2⤵
  PID:8128
- C:\Windows\System\YRHgEug.exe
  C:\Windows\System\YRHgEug.exe
  2⤵
  PID:8148
- C:\Windows\System\GNjOVtC.exe
  C:\Windows\System\GNjOVtC.exe
  2⤵
  PID:8172
- C:\Windows\System\xDjURsO.exe
  C:\Windows\System\xDjURsO.exe
  2⤵
  PID:7112
- C:\Windows\System\sRJQmRF.exe
  C:\Windows\System\sRJQmRF.exe
  2⤵
  PID:6784
- C:\Windows\System\egiFHmw.exe
  C:\Windows\System\egiFHmw.exe
  2⤵
  PID:6824
- C:\Windows\System\nPJaifm.exe
  C:\Windows\System\nPJaifm.exe
  2⤵
  PID:6860
- C:\Windows\System\gcAAFgo.exe
  C:\Windows\System\gcAAFgo.exe
  2⤵
  PID:3372
- C:\Windows\System\bkPCpSR.exe
  C:\Windows\System\bkPCpSR.exe
  2⤵
  PID:6972
- C:\Windows\System\YmsxCDO.exe
  C:\Windows\System\YmsxCDO.exe
  2⤵
  PID:7316
- C:\Windows\System\ylrITRy.exe
  C:\Windows\System\ylrITRy.exe
  2⤵
  PID:1328
- C:\Windows\System\bTzyqZh.exe
  C:\Windows\System\bTzyqZh.exe
  2⤵
  PID:7008
- C:\Windows\System\ZYyJIFA.exe
  C:\Windows\System\ZYyJIFA.exe
  2⤵
  PID:7040
- C:\Windows\System\HwxVXdH.exe
  C:\Windows\System\HwxVXdH.exe
  2⤵
  PID:7108
- C:\Windows\System\WanhZiB.exe
  C:\Windows\System\WanhZiB.exe
  2⤵
  PID:7480
- C:\Windows\System\UfLLZTA.exe
  C:\Windows\System\UfLLZTA.exe
  2⤵
  PID:5708
- C:\Windows\System\AkUtUQM.exe
  C:\Windows\System\AkUtUQM.exe
  2⤵
  PID:3092
- C:\Windows\System\EiGzTAE.exe
  C:\Windows\System\EiGzTAE.exe
  2⤵
  PID:6312
- C:\Windows\System\tEtxxAy.exe
  C:\Windows\System\tEtxxAy.exe
  2⤵
  PID:6388
- C:\Windows\System\AjcjGnS.exe
  C:\Windows\System\AjcjGnS.exe
  2⤵
  PID:4928
- C:\Windows\System\DlKcnfR.exe
  C:\Windows\System\DlKcnfR.exe
  2⤵
  PID:6572
- C:\Windows\System\eGwETAu.exe
  C:\Windows\System\eGwETAu.exe
  2⤵
  PID:6660
- C:\Windows\System\pkqqSVk.exe
  C:\Windows\System\pkqqSVk.exe
  2⤵
  PID:7408
- C:\Windows\System\vcKXuUB.exe
  C:\Windows\System\vcKXuUB.exe
  2⤵
  PID:7444
- C:\Windows\System\MDAreOC.exe
  C:\Windows\System\MDAreOC.exe
  2⤵
  PID:7460
- C:\Windows\System\igShqGx.exe
  C:\Windows\System\igShqGx.exe
  2⤵
  PID:8196
- C:\Windows\System\fiAlSbp.exe
  C:\Windows\System\fiAlSbp.exe
  2⤵
  PID:8220
- C:\Windows\System\QWAvXIE.exe
  C:\Windows\System\QWAvXIE.exe
  2⤵
  PID:8236
- C:\Windows\System\hyeiJGS.exe
  C:\Windows\System\hyeiJGS.exe
  2⤵
  PID:8264
- C:\Windows\System\KtCWZqG.exe
  C:\Windows\System\KtCWZqG.exe
  2⤵
  PID:8284
- C:\Windows\System\WPNYqOm.exe
  C:\Windows\System\WPNYqOm.exe
  2⤵
  PID:8300
- C:\Windows\System\BSRZSlm.exe
  C:\Windows\System\BSRZSlm.exe
  2⤵
  PID:8316
- C:\Windows\System\eCalroJ.exe
  C:\Windows\System\eCalroJ.exe
  2⤵
  PID:8336
- C:\Windows\System\sACIAum.exe
  C:\Windows\System\sACIAum.exe
  2⤵
  PID:8352
- C:\Windows\System\DOIMHeh.exe
  C:\Windows\System\DOIMHeh.exe
  2⤵
  PID:8372
- C:\Windows\System\HFzavhD.exe
  C:\Windows\System\HFzavhD.exe
  2⤵
  PID:8388
- C:\Windows\System\MaIPPxB.exe
  C:\Windows\System\MaIPPxB.exe
  2⤵
  PID:8408
- C:\Windows\System\DUbSLWm.exe
  C:\Windows\System\DUbSLWm.exe
  2⤵
  PID:8428
- C:\Windows\System\HfhnrXX.exe
  C:\Windows\System\HfhnrXX.exe
  2⤵
  PID:8444
- C:\Windows\System\FeeFUVm.exe
  C:\Windows\System\FeeFUVm.exe
  2⤵
  PID:8468
- C:\Windows\System\EnqbuAh.exe
  C:\Windows\System\EnqbuAh.exe
  2⤵
  PID:8492
- C:\Windows\System\bvdNvqq.exe
  C:\Windows\System\bvdNvqq.exe
  2⤵
  PID:8508
- C:\Windows\System\TJpPLYk.exe
  C:\Windows\System\TJpPLYk.exe
  2⤵
  PID:8532
- C:\Windows\System\VykaytW.exe
  C:\Windows\System\VykaytW.exe
  2⤵
  PID:8668
- C:\Windows\System\axOJFCC.exe
  C:\Windows\System\axOJFCC.exe
  2⤵
  PID:8684
- C:\Windows\System\HSEBADG.exe
  C:\Windows\System\HSEBADG.exe
  2⤵
  PID:8704
- C:\Windows\System\zwchfzP.exe
  C:\Windows\System\zwchfzP.exe
  2⤵
  PID:8724
- C:\Windows\System\zWNBhOX.exe
  C:\Windows\System\zWNBhOX.exe
  2⤵
  PID:8744
- C:\Windows\System\VewyzfT.exe
  C:\Windows\System\VewyzfT.exe
  2⤵
  PID:8768
- C:\Windows\System\yhTsbXq.exe
  C:\Windows\System\yhTsbXq.exe
  2⤵
  PID:8792
- C:\Windows\System\UibclMk.exe
  C:\Windows\System\UibclMk.exe
  2⤵
  PID:8812
- C:\Windows\System\DPxwZoI.exe
  C:\Windows\System\DPxwZoI.exe
  2⤵
  PID:8836
- C:\Windows\System\TjpAKLr.exe
  C:\Windows\System\TjpAKLr.exe
  2⤵
  PID:8856
- C:\Windows\System\kstujMd.exe
  C:\Windows\System\kstujMd.exe
  2⤵
  PID:8880
- C:\Windows\System\JQLoKzg.exe
  C:\Windows\System\JQLoKzg.exe
  2⤵
  PID:8904
- C:\Windows\System\ifXTSME.exe
  C:\Windows\System\ifXTSME.exe
  2⤵
  PID:8928
- C:\Windows\System\jqGdtFR.exe
  C:\Windows\System\jqGdtFR.exe
  2⤵
  PID:8952
- C:\Windows\System\KvihMDp.exe
  C:\Windows\System\KvihMDp.exe
  2⤵
  PID:8972
- C:\Windows\System\bNgmAnL.exe
  C:\Windows\System\bNgmAnL.exe
  2⤵
  PID:7996
- C:\Windows\System\LTFPvBV.exe
  C:\Windows\System\LTFPvBV.exe
  2⤵
  PID:8024
- C:\Windows\System\GxmhZEB.exe
  C:\Windows\System\GxmhZEB.exe
  2⤵
  PID:8052
- C:\Windows\System\CJgLcnk.exe
  C:\Windows\System\CJgLcnk.exe
  2⤵
  PID:8092
- C:\Windows\System\RgFBuXR.exe
  C:\Windows\System\RgFBuXR.exe
  2⤵
  PID:8124
- C:\Windows\System\cDggSMa.exe
  C:\Windows\System\cDggSMa.exe
  2⤵
  PID:8156
- C:\Windows\System\MGKoGwR.exe
  C:\Windows\System\MGKoGwR.exe
  2⤵
  PID:6840
- C:\Windows\System\QIDkhZc.exe
  C:\Windows\System\QIDkhZc.exe
  2⤵
  PID:6084
- C:\Windows\System\NhEvNbL.exe
  C:\Windows\System\NhEvNbL.exe
  2⤵
  PID:7072
- C:\Windows\System\OtXGxYm.exe
  C:\Windows\System\OtXGxYm.exe
  2⤵
  PID:7140
- C:\Windows\System\CEznXHx.exe
  C:\Windows\System\CEznXHx.exe
  2⤵
  PID:6248
- C:\Windows\System\jMitQbk.exe
  C:\Windows\System\jMitQbk.exe
  2⤵
  PID:6360
- C:\Windows\System\YLYSIjG.exe
  C:\Windows\System\YLYSIjG.exe
  2⤵
  PID:6508
- C:\Windows\System\WSiGUUo.exe
  C:\Windows\System\WSiGUUo.exe
  2⤵
  PID:6632
- C:\Windows\System\RoZnOIW.exe
  C:\Windows\System\RoZnOIW.exe
  2⤵
  PID:5900
- C:\Windows\System\RqsJnhM.exe
  C:\Windows\System\RqsJnhM.exe
  2⤵
  PID:7388
- C:\Windows\System\fTHXsXz.exe
  C:\Windows\System\fTHXsXz.exe
  2⤵
  PID:8296
- C:\Windows\System\LNsXlfq.exe
  C:\Windows\System\LNsXlfq.exe
  2⤵
  PID:8332
- C:\Windows\System\lKhmqIS.exe
  C:\Windows\System\lKhmqIS.exe
  2⤵
  PID:8380
- C:\Windows\System\nBuOjBF.exe
  C:\Windows\System\nBuOjBF.exe
  2⤵
  PID:8424
- C:\Windows\System\CCcghvs.exe
  C:\Windows\System\CCcghvs.exe
  2⤵
  PID:8476
- C:\Windows\System\wDPtnLU.exe
  C:\Windows\System\wDPtnLU.exe
  2⤵
  PID:8524
- C:\Windows\System\qRDecYf.exe
  C:\Windows\System\qRDecYf.exe
  2⤵
  PID:8592
- C:\Windows\System\NkAXTSN.exe
  C:\Windows\System\NkAXTSN.exe
  2⤵
  PID:8624
- C:\Windows\System\rtvcqWf.exe
  C:\Windows\System\rtvcqWf.exe
  2⤵
  PID:8680
- C:\Windows\System\tLzGpFK.exe
  C:\Windows\System\tLzGpFK.exe
  2⤵
  PID:8720
- C:\Windows\System\PtUdsqL.exe
  C:\Windows\System\PtUdsqL.exe
  2⤵
  PID:8764
- C:\Windows\System\DDJOqlO.exe
  C:\Windows\System\DDJOqlO.exe
  2⤵
  PID:8820
- C:\Windows\System\YONJknj.exe
  C:\Windows\System\YONJknj.exe
  2⤵
  PID:4084
- C:\Windows\System\vjgjSyo.exe
  C:\Windows\System\vjgjSyo.exe
  2⤵
  PID:8888
- C:\Windows\System\ZMMVdpo.exe
  C:\Windows\System\ZMMVdpo.exe
  2⤵
  PID:1336
- C:\Windows\System\soBLzFs.exe
  C:\Windows\System\soBLzFs.exe
  2⤵
  PID:9236
- C:\Windows\System\otqXuWi.exe
  C:\Windows\System\otqXuWi.exe
  2⤵
  PID:9252
- C:\Windows\System\ArGQLpc.exe
  C:\Windows\System\ArGQLpc.exe
  2⤵
  PID:9276
- C:\Windows\System\uusDWod.exe
  C:\Windows\System\uusDWod.exe
  2⤵
  PID:9308
- C:\Windows\System\MgeXEzB.exe
  C:\Windows\System\MgeXEzB.exe
  2⤵
  PID:9324
- C:\Windows\System\JgzOwzl.exe
  C:\Windows\System\JgzOwzl.exe
  2⤵
  PID:9352
- C:\Windows\System\DfdgQec.exe
  C:\Windows\System\DfdgQec.exe
  2⤵
  PID:9380
- C:\Windows\System\PGCzBsA.exe
  C:\Windows\System\PGCzBsA.exe
  2⤵
  PID:9400
- C:\Windows\System\PzdfwSi.exe
  C:\Windows\System\PzdfwSi.exe
  2⤵
  PID:9420
- C:\Windows\System\ZANiXLv.exe
  C:\Windows\System\ZANiXLv.exe
  2⤵
  PID:9444
- C:\Windows\System\abyJLGG.exe
  C:\Windows\System\abyJLGG.exe
  2⤵
  PID:9464
- C:\Windows\System\ucrjdTH.exe
  C:\Windows\System\ucrjdTH.exe
  2⤵
  PID:9484
- C:\Windows\System\FABUePB.exe
  C:\Windows\System\FABUePB.exe
  2⤵
  PID:9500
- C:\Windows\System\GbPXcwD.exe
  C:\Windows\System\GbPXcwD.exe
  2⤵
  PID:9524
- C:\Windows\System\JULBzCj.exe
  C:\Windows\System\JULBzCj.exe
  2⤵
  PID:9540
- C:\Windows\System\XHGWemN.exe
  C:\Windows\System\XHGWemN.exe
  2⤵
  PID:9564
- C:\Windows\System\chZyyQK.exe
  C:\Windows\System\chZyyQK.exe
  2⤵
  PID:9584
- C:\Windows\System\GGDsrqB.exe
  C:\Windows\System\GGDsrqB.exe
  2⤵
  PID:9776
- C:\Windows\System\JUhqGNw.exe
  C:\Windows\System\JUhqGNw.exe
  2⤵
  PID:9792
- C:\Windows\System\FXQkjXY.exe
  C:\Windows\System\FXQkjXY.exe
  2⤵
  PID:9808
- C:\Windows\System\bhFuUZE.exe
  C:\Windows\System\bhFuUZE.exe
  2⤵
  PID:9824
- C:\Windows\System\HlGlQMc.exe
  C:\Windows\System\HlGlQMc.exe
  2⤵
  PID:9840
- C:\Windows\System\csOIROx.exe
  C:\Windows\System\csOIROx.exe
  2⤵
  PID:9880
- C:\Windows\System\CADDASA.exe
  C:\Windows\System\CADDASA.exe
  2⤵
  PID:9900
- C:\Windows\System\JHkbbKj.exe
  C:\Windows\System\JHkbbKj.exe
  2⤵
  PID:9924
- C:\Windows\System\eUBxydC.exe
  C:\Windows\System\eUBxydC.exe
  2⤵
  PID:9952
- C:\Windows\System\KCyhzqn.exe
  C:\Windows\System\KCyhzqn.exe
  2⤵
  PID:9972
- C:\Windows\System\LZwKolH.exe
  C:\Windows\System\LZwKolH.exe
  2⤵
  PID:10000
- C:\Windows\System\OgdhMZM.exe
  C:\Windows\System\OgdhMZM.exe
  2⤵
  PID:10020
- C:\Windows\System\KFdygqH.exe
  C:\Windows\System\KFdygqH.exe
  2⤵
  PID:10040
- C:\Windows\System\JPlNKTb.exe
  C:\Windows\System\JPlNKTb.exe
  2⤵
  PID:10064
- C:\Windows\System\uaDWPte.exe
  C:\Windows\System\uaDWPte.exe
  2⤵
  PID:10088
- C:\Windows\System\ICOvrdD.exe
  C:\Windows\System\ICOvrdD.exe
  2⤵
  PID:10108
- C:\Windows\System\abcGyzU.exe
  C:\Windows\System\abcGyzU.exe
  2⤵
  PID:10128
- C:\Windows\System\yhHpYhy.exe
  C:\Windows\System\yhHpYhy.exe
  2⤵
  PID:10148
- C:\Windows\System\xOXMpwc.exe
  C:\Windows\System\xOXMpwc.exe
  2⤵
  PID:10168
- C:\Windows\System\DiPnAnY.exe
  C:\Windows\System\DiPnAnY.exe
  2⤵
  PID:10184
- C:\Windows\System\Mssjtqa.exe
  C:\Windows\System\Mssjtqa.exe
  2⤵
  PID:10208
- C:\Windows\System\jqhhFcS.exe
  C:\Windows\System\jqhhFcS.exe
  2⤵
  PID:10232
- C:\Windows\System\gkOWQTG.exe
  C:\Windows\System\gkOWQTG.exe
  2⤵
  PID:8944
- C:\Windows\System\pIgtJjY.exe
  C:\Windows\System\pIgtJjY.exe
  2⤵
  PID:960
- C:\Windows\System\bxekOyt.exe
  C:\Windows\System\bxekOyt.exe
  2⤵
  PID:2372
- C:\Windows\System\WbcXfpH.exe
  C:\Windows\System\WbcXfpH.exe
  2⤵
  PID:7432
- C:\Windows\System\tgQNYQJ.exe
  C:\Windows\System\tgQNYQJ.exe
  2⤵
  PID:9232
- C:\Windows\System\rntgZjh.exe
  C:\Windows\System\rntgZjh.exe
  2⤵
  PID:2796
- C:\Windows\System\lrFFxOG.exe
  C:\Windows\System\lrFFxOG.exe
  2⤵
  PID:8324
- C:\Windows\System\YNNpPLR.exe
  C:\Windows\System\YNNpPLR.exe
  2⤵
  PID:8548
- C:\Windows\System\qQGfwXZ.exe
  C:\Windows\System\qQGfwXZ.exe
  2⤵
  PID:8788
- C:\Windows\System\PPZOUCV.exe
  C:\Windows\System\PPZOUCV.exe
  2⤵
  PID:4152
- C:\Windows\System\XYMGnOm.exe
  C:\Windows\System\XYMGnOm.exe
  2⤵
  PID:8068
- C:\Windows\System\rNsLNkJ.exe
  C:\Windows\System\rNsLNkJ.exe
  2⤵
  PID:8168
- C:\Windows\System\KoWkjCU.exe
  C:\Windows\System\KoWkjCU.exe
  2⤵
  PID:6196
- C:\Windows\System\rVOgrFF.exe
  C:\Windows\System\rVOgrFF.exe
  2⤵
  PID:8312
- C:\Windows\System\qaIowDf.exe
  C:\Windows\System\qaIowDf.exe
  2⤵
  PID:8228
- C:\Windows\System\uXRVUeQ.exe
  C:\Windows\System\uXRVUeQ.exe
  2⤵
  PID:8204
- C:\Windows\System\TruiuVF.exe
  C:\Windows\System\TruiuVF.exe
  2⤵
  PID:8520
- C:\Windows\System\qOgZuTP.exe
  C:\Windows\System\qOgZuTP.exe
  2⤵
  PID:8500
- C:\Windows\System\IEGNwxp.exe
  C:\Windows\System\IEGNwxp.exe
  2⤵
  PID:8716
- C:\Windows\System\BFVVSXA.exe
  C:\Windows\System\BFVVSXA.exe
  2⤵
  PID:8780
- C:\Windows\System\nVbrUUh.exe
  C:\Windows\System\nVbrUUh.exe
  2⤵
  PID:9224
- C:\Windows\System\XHjIuYs.exe
  C:\Windows\System\XHjIuYs.exe
  2⤵
  PID:9264
- C:\Windows\System\skDGyza.exe
  C:\Windows\System\skDGyza.exe
  2⤵
  PID:2972
- C:\Windows\System\EjYlhKw.exe
  C:\Windows\System\EjYlhKw.exe
  2⤵
  PID:9332
- C:\Windows\System\eAoUqpL.exe
  C:\Windows\System\eAoUqpL.exe
  2⤵
  PID:9368
- C:\Windows\System\bZPdrvs.exe
  C:\Windows\System\bZPdrvs.exe
  2⤵
  PID:9408
- C:\Windows\System\MjpMGaW.exe
  C:\Windows\System\MjpMGaW.exe
  2⤵
  PID:9432
- C:\Windows\System\iOQBxPv.exe
  C:\Windows\System\iOQBxPv.exe
  2⤵
  PID:9472
- C:\Windows\System\TsYxSGk.exe
  C:\Windows\System\TsYxSGk.exe
  2⤵
  PID:9536
- C:\Windows\System\kiVvEGq.exe
  C:\Windows\System\kiVvEGq.exe
  2⤵
  PID:9580
- C:\Windows\System\MHgNhJY.exe
  C:\Windows\System\MHgNhJY.exe
  2⤵
  PID:3304
- C:\Windows\System\bMjJBiq.exe
  C:\Windows\System\bMjJBiq.exe
  2⤵
  PID:2444
- C:\Windows\System\bciBIRV.exe
  C:\Windows\System\bciBIRV.exe
  2⤵
  PID:3084
- C:\Windows\System\eDCrEZO.exe
  C:\Windows\System\eDCrEZO.exe
  2⤵
  PID:4944
- C:\Windows\System\bAzypkz.exe
  C:\Windows\System\bAzypkz.exe
  2⤵
  PID:1444
- C:\Windows\System\kIIvvLG.exe
  C:\Windows\System\kIIvvLG.exe
  2⤵
  PID:1700
- C:\Windows\System\yaAZfAV.exe
  C:\Windows\System\yaAZfAV.exe
  2⤵
  PID:10052
- C:\Windows\System\vuXtqMi.exe
  C:\Windows\System\vuXtqMi.exe
  2⤵
  PID:10200
- C:\Windows\System\uoXQRwD.exe
  C:\Windows\System\uoXQRwD.exe
  2⤵
  PID:9756
- C:\Windows\System\GTxQFST.exe
  C:\Windows\System\GTxQFST.exe
  2⤵
  PID:9760
- C:\Windows\System\diKYmlP.exe
  C:\Windows\System\diKYmlP.exe
  2⤵
  PID:7560
- C:\Windows\System\OAoAwIB.exe
  C:\Windows\System\OAoAwIB.exe
  2⤵
  PID:10136
- C:\Windows\System\zGSBwln.exe
  C:\Windows\System\zGSBwln.exe
  2⤵
  PID:10268
- C:\Windows\System\oGWmPRw.exe
  C:\Windows\System\oGWmPRw.exe
  2⤵
  PID:10292
- C:\Windows\System\ZdgFoyW.exe
  C:\Windows\System\ZdgFoyW.exe
  2⤵
  PID:10312
- C:\Windows\System\SWZbtzB.exe
  C:\Windows\System\SWZbtzB.exe
  2⤵
  PID:10332
- C:\Windows\System\kMyaxsl.exe
  C:\Windows\System\kMyaxsl.exe
  2⤵
  PID:10356
- C:\Windows\System\XkhwAET.exe
  C:\Windows\System\XkhwAET.exe
  2⤵
  PID:10376
- C:\Windows\System\PUCbWFr.exe
  C:\Windows\System\PUCbWFr.exe
  2⤵
  PID:10400
- C:\Windows\System\EaEkyFc.exe
  C:\Windows\System\EaEkyFc.exe
  2⤵
  PID:10420
- C:\Windows\System\ysgHNPB.exe
  C:\Windows\System\ysgHNPB.exe
  2⤵
  PID:10436
- C:\Windows\System\jjWuqkU.exe
  C:\Windows\System\jjWuqkU.exe
  2⤵
  PID:10452
- C:\Windows\System\kHNBiWv.exe
  C:\Windows\System\kHNBiWv.exe
  2⤵
  PID:10476
- C:\Windows\System\MrINvUC.exe
  C:\Windows\System\MrINvUC.exe
  2⤵
  PID:10500
- C:\Windows\System\xsmlCPG.exe
  C:\Windows\System\xsmlCPG.exe
  2⤵
  PID:10524
- C:\Windows\System\QrgaJpa.exe
  C:\Windows\System\QrgaJpa.exe
  2⤵
  PID:10544
- C:\Windows\System\MitOqls.exe
  C:\Windows\System\MitOqls.exe
  2⤵
  PID:10568
- C:\Windows\System\oBouVKI.exe
  C:\Windows\System\oBouVKI.exe
  2⤵
  PID:10592
- C:\Windows\System\rMZElnm.exe
  C:\Windows\System\rMZElnm.exe
  2⤵
  PID:10616
- C:\Windows\System\YWxpKFu.exe
  C:\Windows\System\YWxpKFu.exe
  2⤵
  PID:10636
- C:\Windows\System\NHeSdCM.exe
  C:\Windows\System\NHeSdCM.exe
  2⤵
  PID:10656
- C:\Windows\System\HdHPkEv.exe
  C:\Windows\System\HdHPkEv.exe
  2⤵
  PID:10676
- C:\Windows\System\lYiowwj.exe
  C:\Windows\System\lYiowwj.exe
  2⤵
  PID:10692
- C:\Windows\System\nJofsvv.exe
  C:\Windows\System\nJofsvv.exe
  2⤵
  PID:10716
- C:\Windows\System\rPWooug.exe
  C:\Windows\System\rPWooug.exe
  2⤵
  PID:10740
- C:\Windows\System\vQsoxfM.exe
  C:\Windows\System\vQsoxfM.exe
  2⤵
  PID:10768
- C:\Windows\System\YLIQYtO.exe
  C:\Windows\System\YLIQYtO.exe
  2⤵
  PID:10792
- C:\Windows\System\OWUjODr.exe
  C:\Windows\System\OWUjODr.exe
  2⤵
  PID:10808
- C:\Windows\System\mJaDnAV.exe
  C:\Windows\System\mJaDnAV.exe
  2⤵
  PID:10828
- C:\Windows\System\mhNowJJ.exe
  C:\Windows\System\mhNowJJ.exe
  2⤵
  PID:10852
- C:\Windows\System\sBQQxbW.exe
  C:\Windows\System\sBQQxbW.exe
  2⤵
  PID:10880
- C:\Windows\System\MYjixMx.exe
  C:\Windows\System\MYjixMx.exe
  2⤵
  PID:10900
- C:\Windows\System\KWoHcKn.exe
  C:\Windows\System\KWoHcKn.exe
  2⤵
  PID:10920
- C:\Windows\System\aJhZvWP.exe
  C:\Windows\System\aJhZvWP.exe
  2⤵
  PID:10948
- C:\Windows\System\PAdNqRP.exe
  C:\Windows\System\PAdNqRP.exe
  2⤵
  PID:10968
- C:\Windows\System\eTVPHjL.exe
  C:\Windows\System\eTVPHjL.exe
  2⤵
  PID:11000
- C:\Windows\System\AOirEXK.exe
  C:\Windows\System\AOirEXK.exe
  2⤵
  PID:11024
- C:\Windows\System\dMKRJyC.exe
  C:\Windows\System\dMKRJyC.exe
  2⤵
  PID:9816
- C:\Windows\System\IblaCSv.exe
  C:\Windows\System\IblaCSv.exe
  2⤵
  PID:10204
- C:\Windows\System\dhSyorQ.exe
  C:\Windows\System\dhSyorQ.exe
  2⤵
  PID:10220
- C:\Windows\System\TFZPEiZ.exe
  C:\Windows\System\TFZPEiZ.exe
  2⤵
  PID:8488
- C:\Windows\System\cWOoBXA.exe
  C:\Windows\System\cWOoBXA.exe
  2⤵
  PID:6664
- C:\Windows\System\gVQXwFB.exe
  C:\Windows\System\gVQXwFB.exe
  2⤵
  PID:9992
- C:\Windows\System\cJoTHqY.exe
  C:\Windows\System\cJoTHqY.exe
  2⤵
  PID:10032
- C:\Windows\System\BFlHLUn.exe
  C:\Windows\System\BFlHLUn.exe
  2⤵
  PID:10072
- C:\Windows\System\NZddPCx.exe
  C:\Windows\System\NZddPCx.exe
  2⤵
  PID:10096
- C:\Windows\System\tSbsvmh.exe
  C:\Windows\System\tSbsvmh.exe
  2⤵
  PID:9768
- C:\Windows\System\mkjootD.exe
  C:\Windows\System\mkjootD.exe
  2⤵
  PID:10384
- C:\Windows\System\FLLWbZF.exe
  C:\Windows\System\FLLWbZF.exe
  2⤵
  PID:8940
- C:\Windows\System\jPiGnXD.exe
  C:\Windows\System\jPiGnXD.exe
  2⤵
  PID:7136
- C:\Windows\System\PHcMwDs.exe
  C:\Windows\System\PHcMwDs.exe
  2⤵
  PID:8360
- C:\Windows\System\fsiqnSH.exe
  C:\Windows\System\fsiqnSH.exe
  2⤵
  PID:3940
- C:\Windows\System\pJZNxur.exe
  C:\Windows\System\pJZNxur.exe
  2⤵
  PID:10836
- C:\Windows\System\fCVHBNe.exe
  C:\Windows\System\fCVHBNe.exe
  2⤵
  PID:9856
- C:\Windows\System\ZxPmpvA.exe
  C:\Windows\System\ZxPmpvA.exe
  2⤵
  PID:8676
- C:\Windows\System\blPgdQc.exe
  C:\Windows\System\blPgdQc.exe
  2⤵
  PID:8752
- C:\Windows\System\hZymAel.exe
  C:\Windows\System\hZymAel.exe
  2⤵
  PID:9292
- C:\Windows\System\bAhFLHS.exe
  C:\Windows\System\bAhFLHS.exe
  2⤵
  PID:9316
- C:\Windows\System\MchDfyR.exe
  C:\Windows\System\MchDfyR.exe
  2⤵
  PID:10820
- C:\Windows\System\dzfGFxB.exe
  C:\Windows\System\dzfGFxB.exe
  2⤵
  PID:10460
- C:\Windows\System\bpcckvf.exe
  C:\Windows\System\bpcckvf.exe
  2⤵
  PID:10580
- C:\Windows\System\fTFuwOp.exe
  C:\Windows\System\fTFuwOp.exe
  2⤵
  PID:10324
- C:\Windows\System\nmtiBWX.exe
  C:\Windows\System\nmtiBWX.exe
  2⤵
  PID:10536
- C:\Windows\System\NjmHSJj.exe
  C:\Windows\System\NjmHSJj.exe
  2⤵
  PID:9560
- C:\Windows\System\jXOOgZX.exe
  C:\Windows\System\jXOOgZX.exe
  2⤵
  PID:4440
- C:\Windows\System\OktkNjh.exe
  C:\Windows\System\OktkNjh.exe
  2⤵
  PID:10872
- C:\Windows\System\gdpGStn.exe
  C:\Windows\System\gdpGStn.exe
  2⤵
  PID:9784
- C:\Windows\System\TJflBKu.exe
  C:\Windows\System\TJflBKu.exe
  2⤵
  PID:9960
- C:\Windows\System\tYrHwIZ.exe
  C:\Windows\System\tYrHwIZ.exe
  2⤵
  PID:11012
- C:\Windows\System\gOiokKU.exe
  C:\Windows\System\gOiokKU.exe
  2⤵
  PID:10416
- C:\Windows\System\qDkotyb.exe
  C:\Windows\System\qDkotyb.exe
  2⤵
  PID:11272
- C:\Windows\System\WvjmCJp.exe
  C:\Windows\System\WvjmCJp.exe
  2⤵
  PID:11304
- C:\Windows\System\urpIpsz.exe
  C:\Windows\System\urpIpsz.exe
  2⤵
  PID:11324
- C:\Windows\System\haReXCK.exe
  C:\Windows\System\haReXCK.exe
  2⤵
  PID:11356
- C:\Windows\System\OnnkRxG.exe
  C:\Windows\System\OnnkRxG.exe
  2⤵
  PID:11380
- C:\Windows\System\MfryNvs.exe
  C:\Windows\System\MfryNvs.exe
  2⤵
  PID:11404
- C:\Windows\System\KOoCiSg.exe
  C:\Windows\System\KOoCiSg.exe
  2⤵
  PID:11440
- C:\Windows\System\YxMEnzB.exe
  C:\Windows\System\YxMEnzB.exe
  2⤵
  PID:11460
- C:\Windows\System\IbxWevJ.exe
  C:\Windows\System\IbxWevJ.exe
  2⤵
  PID:11484
- C:\Windows\System\oQJwvhi.exe
  C:\Windows\System\oQJwvhi.exe
  2⤵
  PID:11504
- C:\Windows\System\RMjCCWR.exe
  C:\Windows\System\RMjCCWR.exe
  2⤵
  PID:11524
- C:\Windows\System\VFRLqSi.exe
  C:\Windows\System\VFRLqSi.exe
  2⤵
  PID:11552
- C:\Windows\System\AjuXSIs.exe
  C:\Windows\System\AjuXSIs.exe
  2⤵
  PID:11568
- C:\Windows\System\VGbGFqI.exe
  C:\Windows\System\VGbGFqI.exe
  2⤵
  PID:11592
- C:\Windows\System\SOnJQwD.exe
  C:\Windows\System\SOnJQwD.exe
  2⤵
  PID:11620
- C:\Windows\System\iiGKCNz.exe
  C:\Windows\System\iiGKCNz.exe
  2⤵
  PID:11648
- C:\Windows\System\SSSWlth.exe
  C:\Windows\System\SSSWlth.exe
  2⤵
  PID:11676
- C:\Windows\System\LZpCBoL.exe
  C:\Windows\System\LZpCBoL.exe
  2⤵
  PID:11700
- C:\Windows\System\ZKmQUBc.exe
  C:\Windows\System\ZKmQUBc.exe
  2⤵
  PID:11724
- C:\Windows\System\eJOpvRd.exe
  C:\Windows\System\eJOpvRd.exe
  2⤵
  PID:11744
- C:\Windows\System\VrRpPld.exe
  C:\Windows\System\VrRpPld.exe
  2⤵
  PID:11768
- C:\Windows\System\EJBXmdJ.exe
  C:\Windows\System\EJBXmdJ.exe
  2⤵
  PID:11804
- C:\Windows\System\LGKgxDV.exe
  C:\Windows\System\LGKgxDV.exe
  2⤵
  PID:11824
- C:\Windows\System\EphaVLL.exe
  C:\Windows\System\EphaVLL.exe
  2⤵
  PID:11840
- C:\Windows\System\IDiiwPL.exe
  C:\Windows\System\IDiiwPL.exe
  2⤵
  PID:11856
- C:\Windows\System\FcvclIq.exe
  C:\Windows\System\FcvclIq.exe
  2⤵
  PID:11876
- C:\Windows\System\lmCbUaK.exe
  C:\Windows\System\lmCbUaK.exe
  2⤵
  PID:11904
- C:\Windows\System\mHjieAI.exe
  C:\Windows\System\mHjieAI.exe
  2⤵
  PID:11928
- C:\Windows\System\teqvHNH.exe
  C:\Windows\System\teqvHNH.exe
  2⤵
  PID:11952
- C:\Windows\System\HsyqBGK.exe
  C:\Windows\System\HsyqBGK.exe
  2⤵
  PID:11968
- C:\Windows\System\savVnWV.exe
  C:\Windows\System\savVnWV.exe
  2⤵
  PID:11988
- C:\Windows\System\DVTloUS.exe
  C:\Windows\System\DVTloUS.exe
  2⤵
  PID:12012
- C:\Windows\System\KUsVwrS.exe
  C:\Windows\System\KUsVwrS.exe
  2⤵
  PID:12028
- C:\Windows\System\KXgZAEl.exe
  C:\Windows\System\KXgZAEl.exe
  2⤵
  PID:12052
- C:\Windows\System\uVMGEkn.exe
  C:\Windows\System\uVMGEkn.exe
  2⤵
  PID:12072
- C:\Windows\System\saztahx.exe
  C:\Windows\System\saztahx.exe
  2⤵
  PID:12092
- C:\Windows\System\fBDUsxI.exe
  C:\Windows\System\fBDUsxI.exe
  2⤵
  PID:12116
- C:\Windows\System\fwLFBxG.exe
  C:\Windows\System\fwLFBxG.exe
  2⤵
  PID:12144
- C:\Windows\System\sWtlZod.exe
  C:\Windows\System\sWtlZod.exe
  2⤵
  PID:12164
- C:\Windows\System\nOftCiv.exe
  C:\Windows\System\nOftCiv.exe
  2⤵
  PID:12196
- C:\Windows\System\zRVoXPd.exe
  C:\Windows\System\zRVoXPd.exe
  2⤵
  PID:12212
- C:\Windows\System\tJXRpPz.exe
  C:\Windows\System\tJXRpPz.exe
  2⤵
  PID:12232
- C:\Windows\System\sAXPefR.exe
  C:\Windows\System\sAXPefR.exe
  2⤵
  PID:12256
- C:\Windows\System\VFkkpWL.exe
  C:\Windows\System\VFkkpWL.exe
  2⤵
  PID:12276
- C:\Windows\System\eGLYnQc.exe
  C:\Windows\System\eGLYnQc.exe
  2⤵
  PID:10508
- C:\Windows\System\gdgGPtq.exe
  C:\Windows\System\gdgGPtq.exe
  2⤵
  PID:9896
- C:\Windows\System\xMdzocX.exe
  C:\Windows\System\xMdzocX.exe
  2⤵
  PID:4888
- C:\Windows\System\GpIeXxr.exe
  C:\Windows\System\GpIeXxr.exe
  2⤵
  PID:10724
- C:\Windows\System\PNsdgHr.exe
  C:\Windows\System\PNsdgHr.exe
  2⤵
  PID:7156
- C:\Windows\System\ALJJwov.exe
  C:\Windows\System\ALJJwov.exe
  2⤵
  PID:10896
- C:\Windows\System\DxufZIq.exe
  C:\Windows\System\DxufZIq.exe
  2⤵
  PID:9460
- C:\Windows\System\JpWYlDT.exe
  C:\Windows\System\JpWYlDT.exe
  2⤵
  PID:10860
- C:\Windows\System\reiubAN.exe
  C:\Windows\System\reiubAN.exe
  2⤵
  PID:8872
- C:\Windows\System\dpyQfnq.exe
  C:\Windows\System\dpyQfnq.exe
  2⤵
  PID:9440
- C:\Windows\System\NIdKvkK.exe
  C:\Windows\System\NIdKvkK.exe
  2⤵
  PID:9984
- C:\Windows\System\fauLntS.exe
  C:\Windows\System\fauLntS.exe
  2⤵
  PID:11104
- C:\Windows\System\WICTHgc.exe
  C:\Windows\System\WICTHgc.exe
  2⤵
  PID:8616
- C:\Windows\System\YgpNuiM.exe
  C:\Windows\System\YgpNuiM.exe
  2⤵
  PID:11640
- C:\Windows\System\zHKzndK.exe
  C:\Windows\System\zHKzndK.exe
  2⤵
  PID:8832
- C:\Windows\System\rxMpSBZ.exe
  C:\Windows\System\rxMpSBZ.exe
  2⤵
  PID:11716
- C:\Windows\System\UfoqlZe.exe
  C:\Windows\System\UfoqlZe.exe
  2⤵
  PID:10560
- C:\Windows\System\IsshQzS.exe
  C:\Windows\System\IsshQzS.exe
  2⤵
  PID:11252
- C:\Windows\System\XEvLXgf.exe
  C:\Windows\System\XEvLXgf.exe
  2⤵
  PID:10164
- C:\Windows\System\SJvMnCF.exe
  C:\Windows\System\SJvMnCF.exe
  2⤵
  PID:12300
- C:\Windows\System\dbpUsWo.exe
  C:\Windows\System\dbpUsWo.exe
  2⤵
  PID:12332
- C:\Windows\System\bMaKLsY.exe
  C:\Windows\System\bMaKLsY.exe
  2⤵
  PID:12348
- C:\Windows\System\tsZLKoC.exe
  C:\Windows\System\tsZLKoC.exe
  2⤵
  PID:12364
- C:\Windows\System\zGgiAaL.exe
  C:\Windows\System\zGgiAaL.exe
  2⤵
  PID:12384
- C:\Windows\System\EsOZmbm.exe
  C:\Windows\System\EsOZmbm.exe
  2⤵
  PID:12400
- C:\Windows\System\caQaejF.exe
  C:\Windows\System\caQaejF.exe
  2⤵
  PID:12420
- C:\Windows\System\VCZtmlE.exe
  C:\Windows\System\VCZtmlE.exe
  2⤵
  PID:12436
- C:\Windows\System\bVESkiv.exe
  C:\Windows\System\bVESkiv.exe
  2⤵
  PID:12456
- C:\Windows\System\tOSNSOM.exe
  C:\Windows\System\tOSNSOM.exe
  2⤵
  PID:12476
- C:\Windows\System\eylIMcK.exe
  C:\Windows\System\eylIMcK.exe
  2⤵
  PID:12492
- C:\Windows\System\yclRPnM.exe
  C:\Windows\System\yclRPnM.exe
  2⤵
  PID:12520
- C:\Windows\System\juTqOYb.exe
  C:\Windows\System\juTqOYb.exe
  2⤵
  PID:12544
- C:\Windows\System\wWPFbef.exe
  C:\Windows\System\wWPFbef.exe
  2⤵
  PID:12564
- C:\Windows\System\hIxKxvk.exe
  C:\Windows\System\hIxKxvk.exe
  2⤵
  PID:12584
- C:\Windows\System\ssClqkf.exe
  C:\Windows\System\ssClqkf.exe
  2⤵
  PID:12608
- C:\Windows\System\FIfIhUY.exe
  C:\Windows\System\FIfIhUY.exe
  2⤵
  PID:13120
- C:\Windows\System\NQezEVQ.exe
  C:\Windows\System\NQezEVQ.exe
  2⤵
  PID:11396
- C:\Windows\System\msalQKt.exe
  C:\Windows\System\msalQKt.exe
  2⤵
  PID:9260
- C:\Windows\System\LJVRugG.exe
  C:\Windows\System\LJVRugG.exe
  2⤵
  PID:11564
- C:\Windows\System\JCcYYIf.exe
  C:\Windows\System\JCcYYIf.exe
  2⤵
  PID:10252
- C:\Windows\System\kCQCCfn.exe
  C:\Windows\System\kCQCCfn.exe
  2⤵
  PID:9940
- C:\Windows\System\BVRLMTU.exe
  C:\Windows\System\BVRLMTU.exe
  2⤵
  PID:11284
- C:\Windows\System\PqGzuyG.exe
  C:\Windows\System\PqGzuyG.exe
  2⤵
  PID:11316
- C:\Windows\System\CQtYhiJ.exe
  C:\Windows\System\CQtYhiJ.exe
  2⤵
  PID:12484
- C:\Windows\System\mGkvpoF.exe
  C:\Windows\System\mGkvpoF.exe
  2⤵
  PID:11616
- C:\Windows\System\OgYrPag.exe
  C:\Windows\System\OgYrPag.exe
  2⤵
  PID:11688
- C:\Windows\System\qzOyvaY.exe
  C:\Windows\System\qzOyvaY.exe
  2⤵
  PID:10264
- C:\Windows\System\XihsRnh.exe
  C:\Windows\System\XihsRnh.exe
  2⤵
  PID:12360
- C:\Windows\System\kVLLFez.exe
  C:\Windows\System\kVLLFez.exe
  2⤵
  PID:12380
- C:\Windows\System\pAvDAvf.exe
  C:\Windows\System\pAvDAvf.exe
  2⤵
  PID:12432
- C:\Windows\System\FGsPrrk.exe
  C:\Windows\System\FGsPrrk.exe
  2⤵
  PID:12704
- C:\Windows\System\MJsgTbW.exe
  C:\Windows\System\MJsgTbW.exe
  2⤵
  PID:12772
- C:\Windows\System\hCiGQDH.exe
  C:\Windows\System\hCiGQDH.exe
  2⤵
  PID:12936
- C:\Windows\System\JMZkCOP.exe
  C:\Windows\System\JMZkCOP.exe
  2⤵
  PID:1776
- C:\Windows\System\UHljDqe.exe
  C:\Windows\System\UHljDqe.exe
  2⤵
  PID:13080
- C:\Windows\System\Tteaqip.exe
  C:\Windows\System\Tteaqip.exe
  2⤵
  PID:13112
- C:\Windows\System\iCQlqsM.exe
  C:\Windows\System\iCQlqsM.exe
  2⤵
  PID:11660
- C:\Windows\System\lMilzhU.exe
  C:\Windows\System\lMilzhU.exe
  2⤵
  PID:12264
- C:\Windows\System\CLXgOsA.exe
  C:\Windows\System\CLXgOsA.exe
  2⤵
  PID:12284
- C:\Windows\System\WwppDkc.exe
  C:\Windows\System\WwppDkc.exe
  2⤵
  PID:11456
- C:\Windows\System\bKSXozC.exe
  C:\Windows\System\bKSXozC.exe
  2⤵
  PID:10532
- C:\Windows\System\XyrdJqE.exe
  C:\Windows\System\XyrdJqE.exe
  2⤵
  PID:10520
- C:\Windows\System\CPRqkWc.exe
  C:\Windows\System\CPRqkWc.exe
  2⤵
  PID:10684
- C:\Windows\System\NIqchQj.exe
  C:\Windows\System\NIqchQj.exe
  2⤵
  PID:10492
- C:\Windows\System\PSUHsGs.exe
  C:\Windows\System\PSUHsGs.exe
  2⤵
  PID:11560
- C:\Windows\System\JEPWljJ.exe
  C:\Windows\System\JEPWljJ.exe
  2⤵
  PID:11836
- C:\Windows\System\cRkuTyz.exe
  C:\Windows\System\cRkuTyz.exe
  2⤵
  PID:12676
- C:\Windows\System\GRlIkgX.exe
  C:\Windows\System\GRlIkgX.exe
  2⤵
  PID:12112
- C:\Windows\System\qdOjuME.exe
  C:\Windows\System\qdOjuME.exe
  2⤵
  PID:12220
- C:\Windows\System\hfZGKzQ.exe
  C:\Windows\System\hfZGKzQ.exe
  2⤵
  PID:9392
- C:\Windows\System\dvAFfLp.exe
  C:\Windows\System\dvAFfLp.exe
  2⤵
  PID:2400
- C:\Windows\System\XIKrhoa.exe
  C:\Windows\System\XIKrhoa.exe
  2⤵
  PID:10644
- C:\Windows\System\MnRZXKJ.exe
  C:\Windows\System\MnRZXKJ.exe
  2⤵
  PID:12912
- C:\Windows\System\vEVduqc.exe
  C:\Windows\System\vEVduqc.exe
  2⤵
  PID:12988
- C:\Windows\System\aONYStG.exe
  C:\Windows\System\aONYStG.exe
  2⤵
  PID:13288
- C:\Windows\System\rObhWna.exe
  C:\Windows\System\rObhWna.exe
  2⤵
  PID:12780
- C:\Windows\System\fwLIeug.exe
  C:\Windows\System\fwLIeug.exe
  2⤵
  PID:10584
- C:\Windows\System\gOvjRnK.exe
  C:\Windows\System\gOvjRnK.exe
  2⤵
  PID:12592
- C:\Windows\System\GQzJwbE.exe
  C:\Windows\System\GQzJwbE.exe
  2⤵
  PID:13144
- C:\Windows\System\xjLWyGf.exe
  C:\Windows\System\xjLWyGf.exe
  2⤵
  PID:11268
- C:\Windows\System\DXkZfYA.exe
  C:\Windows\System\DXkZfYA.exe
  2⤵
  PID:8416
- C:\Windows\System\iABzirE.exe
  C:\Windows\System\iABzirE.exe
  2⤵
  PID:13156
- C:\Windows\System\YWEryfO.exe
  C:\Windows\System\YWEryfO.exe
  2⤵
  PID:13272
- C:\Windows\System\fYNqLfu.exe
  C:\Windows\System\fYNqLfu.exe
  2⤵
  PID:1532
- C:\Windows\System\zookwWk.exe
  C:\Windows\System\zookwWk.exe
  2⤵
  PID:9388
- C:\Windows\System\BJyqtGC.exe
  C:\Windows\System\BJyqtGC.exe
  2⤵
  PID:5904
- C:\Windows\System\FcfayOs.exe
  C:\Windows\System\FcfayOs.exe
  2⤵
  PID:13092
- C:\Windows\System\nhvnrez.exe
  C:\Windows\System\nhvnrez.exe
  2⤵
  PID:376
- C:\Windows\System\cxAfrYg.exe
  C:\Windows\System\cxAfrYg.exe
  2⤵
  PID:11944
- C:\Windows\System\aZCzpqq.exe
  C:\Windows\System\aZCzpqq.exe
  2⤵
  PID:5880
- C:\Windows\System\BqPowrj.exe
  C:\Windows\System\BqPowrj.exe
  2⤵
  PID:5640
- C:\Windows\System\VFFZqVm.exe
  C:\Windows\System\VFFZqVm.exe
  2⤵
  PID:12992
- C:\Windows\System\eIGXypA.exe
  C:\Windows\System\eIGXypA.exe
  2⤵
  PID:11868
- C:\Windows\System\mpetvWq.exe
  C:\Windows\System\mpetvWq.exe
  2⤵
  PID:12800
- C:\Windows\System\cbwqAca.exe
  C:\Windows\System\cbwqAca.exe
  2⤵
  PID:13248
- C:\Windows\System\ZezRpRg.exe
  C:\Windows\System\ZezRpRg.exe
  2⤵
  PID:13148
- C:\Windows\System\qNVXNpR.exe
  C:\Windows\System\qNVXNpR.exe
  2⤵
  PID:13164
- C:\Windows\System\yOTHyRd.exe
  C:\Windows\System\yOTHyRd.exe
  2⤵
  PID:8260
- C:\Windows\System\biZhHpF.exe
  C:\Windows\System\biZhHpF.exe
  2⤵
  PID:13216
- C:\Windows\System\HzmOnTq.exe
  C:\Windows\System\HzmOnTq.exe
  2⤵
  PID:9872
- C:\Windows\System\fsxkRfx.exe
  C:\Windows\System\fsxkRfx.exe
  2⤵
  PID:11896
- C:\Windows\System\RDKBQvg.exe
  C:\Windows\System\RDKBQvg.exe
  2⤵
  PID:10940
- C:\Windows\System\mPJLGBK.exe
  C:\Windows\System\mPJLGBK.exe
  2⤵
  PID:11472
- C:\Windows\System\osxCGjK.exe
  C:\Windows\System\osxCGjK.exe
  2⤵
  PID:6968
- C:\Windows\System\MMVgYdt.exe
  C:\Windows\System\MMVgYdt.exe
  2⤵
  PID:11792
- C:\Windows\System\NsLVZqt.exe
  C:\Windows\System\NsLVZqt.exe
  2⤵
  PID:12040
- C:\Windows\System\PjuWglQ.exe
  C:\Windows\System\PjuWglQ.exe
  2⤵
  PID:7392
- C:\Windows\System\syMkNgU.exe
  C:\Windows\System\syMkNgU.exe
  2⤵
  PID:2076
- C:\Windows\System\UbNEjUb.exe
  C:\Windows\System\UbNEjUb.exe
  2⤵
  PID:3624
- C:\Windows\System\BtfhtlA.exe
  C:\Windows\System\BtfhtlA.exe
  2⤵
  PID:13256
- C:\Windows\System\OfjNbZV.exe
  C:\Windows\System\OfjNbZV.exe
  2⤵
  PID:12944
- C:\Windows\System\gBTJgoF.exe
  C:\Windows\System\gBTJgoF.exe
  2⤵
  PID:12532
- C:\Windows\System\vMEVhmY.exe
  C:\Windows\System\vMEVhmY.exe
  2⤵
  PID:13300
- C:\Windows\System\AwoCKui.exe
  C:\Windows\System\AwoCKui.exe
  2⤵
  PID:6976
- C:\Windows\System\TjcobBr.exe
  C:\Windows\System\TjcobBr.exe
  2⤵
  PID:3260
- C:\Windows\System\cgCPaky.exe
  C:\Windows\System\cgCPaky.exe
  2⤵
  PID:11740
- C:\Windows\System\tsDwuGW.exe
  C:\Windows\System\tsDwuGW.exe
  2⤵
  PID:4912
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4912 -s 28
    3⤵
    PID:13168
- C:\Windows\System\BObXDHo.exe
  C:\Windows\System\BObXDHo.exe
  2⤵
  PID:2360
- C:\Windows\System\EEzBaVi.exe
  C:\Windows\System\EEzBaVi.exe
  2⤵
  PID:3272
- C:\Windows\System\oQEnQtY.exe
  C:\Windows\System\oQEnQtY.exe
  2⤵
  PID:3288
- C:\Windows\System\axdlQsV.exe
  C:\Windows\System\axdlQsV.exe
  2⤵
  PID:2228
- C:\Windows\System\cUayKEk.exe
  C:\Windows\System\cUayKEk.exe
  2⤵
  PID:3004
- C:\Windows\System\ELnMsrS.exe
  C:\Windows\System\ELnMsrS.exe
  2⤵
  PID:12788
- C:\Windows\System\VXisQhd.exe
  C:\Windows\System\VXisQhd.exe
  2⤵
  PID:13180
- C:\Windows\System\pvdOnda.exe
  C:\Windows\System\pvdOnda.exe
  2⤵
  PID:7348
- C:\Windows\System\ghXjQov.exe
  C:\Windows\System\ghXjQov.exe
  2⤵
  PID:3280
- C:\Windows\System\bHaRSDe.exe
  C:\Windows\System\bHaRSDe.exe
  2⤵
  PID:872
- C:\Windows\System\dORMiFO.exe
  C:\Windows\System\dORMiFO.exe
  2⤵
  PID:2932
- C:\Windows\System\wDaoQTq.exe
  C:\Windows\System\wDaoQTq.exe
  2⤵
  PID:12152
- C:\Windows\System\xUXQqqq.exe
  C:\Windows\System\xUXQqqq.exe
  2⤵
  PID:4036
- C:\Windows\System\bNxiCag.exe
  C:\Windows\System\bNxiCag.exe
  2⤵
  PID:3144
- C:\Windows\System\ibTKSwe.exe
  C:\Windows\System\ibTKSwe.exe
  2⤵
  PID:13328
- C:\Windows\System\HtPjpVA.exe
  C:\Windows\System\HtPjpVA.exe
  2⤵
  PID:13344
- C:\Windows\System\oyRwRvR.exe
  C:\Windows\System\oyRwRvR.exe
  2⤵
  PID:13368
- C:\Windows\System\ETSdbFg.exe
  C:\Windows\System\ETSdbFg.exe
  2⤵
  PID:13388
- C:\Windows\System\naFyeYu.exe
  C:\Windows\System\naFyeYu.exe
  2⤵
  PID:13436
- C:\Windows\System\KRPOHvb.exe
  C:\Windows\System\KRPOHvb.exe
  2⤵
  PID:13464
- C:\Windows\System\bBrPhHr.exe
  C:\Windows\System\bBrPhHr.exe
  2⤵
  PID:13484
- C:\Windows\System\NYzhDKQ.exe
  C:\Windows\System\NYzhDKQ.exe
  2⤵
  PID:13544
- C:\Windows\System\CWvGiaw.exe
  C:\Windows\System\CWvGiaw.exe
  2⤵
  PID:13572
- C:\Windows\System\fvNIVRn.exe
  C:\Windows\System\fvNIVRn.exe
  2⤵
  PID:13588
- C:\Windows\System\jJQKsmD.exe
  C:\Windows\System\jJQKsmD.exe
  2⤵
  PID:13616
- C:\Windows\System\rCSDCnB.exe
  C:\Windows\System\rCSDCnB.exe
  2⤵
  PID:13644
- C:\Windows\System\AilVAmz.exe
  C:\Windows\System\AilVAmz.exe
  2⤵
  PID:13692
- C:\Windows\System\IUmGxkf.exe
  C:\Windows\System\IUmGxkf.exe
  2⤵
  PID:13824
- C:\Windows\System\yfLjzUF.exe
  C:\Windows\System\yfLjzUF.exe
  2⤵
  PID:13904
- C:\Windows\System\zycWmSg.exe
  C:\Windows\System\zycWmSg.exe
  2⤵
  PID:13924
- C:\Windows\System\ORFFqlR.exe
  C:\Windows\System\ORFFqlR.exe
  2⤵
  PID:13952
- C:\Windows\System\puZlvNd.exe
  C:\Windows\System\puZlvNd.exe
  2⤵
  PID:13968
- C:\Windows\System\LStwGpH.exe
  C:\Windows\System\LStwGpH.exe
  2⤵
  PID:13984
- C:\Windows\System\nxCKwVq.exe
  C:\Windows\System\nxCKwVq.exe
  2⤵
  PID:14008
- C:\Windows\System\AMDUszv.exe
  C:\Windows\System\AMDUszv.exe
  2⤵
  PID:14032
- C:\Windows\System\GFRZffI.exe
  C:\Windows\System\GFRZffI.exe
  2⤵
  PID:14060
- C:\Windows\System\NEkVtbk.exe
  C:\Windows\System\NEkVtbk.exe
  2⤵
  PID:14084
- C:\Windows\System\EXKmQuL.exe
  C:\Windows\System\EXKmQuL.exe
  2⤵
  PID:14104
- C:\Windows\System\uQhUlyH.exe
  C:\Windows\System\uQhUlyH.exe
  2⤵
  PID:14128
- C:\Windows\System\qzkchmz.exe
  C:\Windows\System\qzkchmz.exe
  2⤵
  PID:14144
- C:\Windows\System\fNHSuso.exe
  C:\Windows\System\fNHSuso.exe
  2⤵
  PID:14160
- C:\Windows\System\EfOtUPr.exe
  C:\Windows\System\EfOtUPr.exe
  2⤵
  PID:14180
- C:\Windows\System\QwVAcAF.exe
  C:\Windows\System\QwVAcAF.exe
  2⤵
  PID:14212
- C:\Windows\System\VYuIbtw.exe
  C:\Windows\System\VYuIbtw.exe
  2⤵
  PID:14228
- C:\Windows\System\ZjkjThH.exe
  C:\Windows\System\ZjkjThH.exe
  2⤵
  PID:14300
- C:\Windows\System\Fjrhouk.exe
  C:\Windows\System\Fjrhouk.exe
  2⤵
  PID:14324
- C:\Windows\System\APaKqof.exe
  C:\Windows\System\APaKqof.exe
  2⤵
  PID:4968
- C:\Windows\System\ougWHLs.exe
  C:\Windows\System\ougWHLs.exe
  2⤵
  PID:3764
- C:\Windows\System\OedtVER.exe
  C:\Windows\System\OedtVER.exe
  2⤵
  PID:13380
- C:\Windows\System\bWwrIUp.exe
  C:\Windows\System\bWwrIUp.exe
  2⤵
  PID:6448
- C:\Windows\System\hRDtNCb.exe
  C:\Windows\System\hRDtNCb.exe
  2⤵
  PID:13280
- C:\Windows\System\fCNquxt.exe
  C:\Windows\System\fCNquxt.exe
  2⤵
  PID:5012
- C:\Windows\System\JeNwtSZ.exe
  C:\Windows\System\JeNwtSZ.exe
  2⤵
  PID:13008
- C:\Windows\System\eNJNFYT.exe
  C:\Windows\System\eNJNFYT.exe
  2⤵
  PID:4032
- C:\Windows\System\lQgPLpN.exe
  C:\Windows\System\lQgPLpN.exe
  2⤵
  PID:13340
- C:\Windows\System\MUEsKxr.exe
  C:\Windows\System\MUEsKxr.exe
  2⤵
  PID:13520
- C:\Windows\System\YuynxZI.exe
  C:\Windows\System\YuynxZI.exe
  2⤵
  PID:13420
- C:\Windows\System\asQBuZG.exe
  C:\Windows\System\asQBuZG.exe
  2⤵
  PID:13456
- C:\Windows\System\TvVJeSe.exe
  C:\Windows\System\TvVJeSe.exe
  2⤵
  PID:13168
- C:\Windows\System\DGVPNDK.exe
  C:\Windows\System\DGVPNDK.exe
  2⤵
  PID:13496
- C:\Windows\System\aDIFOed.exe
  C:\Windows\System\aDIFOed.exe
  2⤵
  PID:13532
- C:\Windows\System\ubWquEg.exe
  C:\Windows\System\ubWquEg.exe
  2⤵
  PID:13568
- C:\Windows\System\cofiyPr.exe
  C:\Windows\System\cofiyPr.exe
  2⤵
  PID:13636
- C:\Windows\System\AQGLZnJ.exe
  C:\Windows\System\AQGLZnJ.exe
  2⤵
  PID:5228
- C:\Windows\System\oJvmYcR.exe
  C:\Windows\System\oJvmYcR.exe
  2⤵
  PID:5472
- C:\Windows\System\KbZlAVQ.exe
  C:\Windows\System\KbZlAVQ.exe
  2⤵
  PID:4088
- C:\Windows\System\NIDstWO.exe
  C:\Windows\System\NIDstWO.exe
  2⤵
  PID:996
- C:\Windows\System\AzSSEkU.exe
  C:\Windows\System\AzSSEkU.exe
  2⤵
  PID:5176
- C:\Windows\System\yimdVTB.exe
  C:\Windows\System\yimdVTB.exe
  2⤵
  PID:14188
- C:\Windows\System\nqNUlAV.exe
  C:\Windows\System\nqNUlAV.exe
  2⤵
  PID:14220
- C:\Windows\System\mDiEDEK.exe
  C:\Windows\System\mDiEDEK.exe
  2⤵
  PID:14296
- C:\Windows\System\TIoBOiB.exe
  C:\Windows\System\TIoBOiB.exe
  2⤵
  PID:12296
- C:\Windows\System\pCxDZUZ.exe
  C:\Windows\System\pCxDZUZ.exe
  2⤵
  PID:5600
- C:\Windows\System\IwjGDuz.exe
  C:\Windows\System\IwjGDuz.exe
  2⤵
  PID:13516
- C:\Windows\System\EdhBNmX.exe
  C:\Windows\System\EdhBNmX.exe
  2⤵
  PID:14288
- C:\Windows\System\YyGmXfg.exe
  C:\Windows\System\YyGmXfg.exe
  2⤵
  PID:13400
- C:\Windows\System\LvJLFJU.exe
  C:\Windows\System\LvJLFJU.exe
  2⤵
  PID:13712
- C:\Windows\System\vOnmYGk.exe
  C:\Windows\System\vOnmYGk.exe
  2⤵
  PID:4376
- C:\Windows\System\ieRVxxY.exe
  C:\Windows\System\ieRVxxY.exe
  2⤵
  PID:9724
- C:\Windows\System\npjDTrh.exe
  C:\Windows\System\npjDTrh.exe
  2⤵
  PID:13628
- C:\Windows\System\ySxSeqE.exe
  C:\Windows\System\ySxSeqE.exe
  2⤵
  PID:5744
- C:\Windows\System\cNrAmmM.exe
  C:\Windows\System\cNrAmmM.exe
  2⤵
  PID:5284
- C:\Windows\System\xnGjqBn.exe
  C:\Windows\System\xnGjqBn.exe
  2⤵
  PID:5308
- C:\Windows\System\HFIQHfl.exe
  C:\Windows\System\HFIQHfl.exe
  2⤵
  PID:13964
- C:\Windows\System\pLhereP.exe
  C:\Windows\System\pLhereP.exe
  2⤵
  PID:3464
- C:\Windows\System\VSQLQtL.exe
  C:\Windows\System\VSQLQtL.exe
  2⤵
  PID:5496
- C:\Windows\System\hkXcdzu.exe
  C:\Windows\System\hkXcdzu.exe
  2⤵
  PID:14020
- C:\Windows\System\gsxCfrF.exe
  C:\Windows\System\gsxCfrF.exe
  2⤵
  PID:4024
- C:\Windows\System\rZDtlpK.exe
  C:\Windows\System\rZDtlpK.exe
  2⤵
  PID:5896
- C:\Windows\System\ZollGWL.exe
  C:\Windows\System\ZollGWL.exe
  2⤵
  PID:5392
- C:\Windows\System\ZNlMOxg.exe
  C:\Windows\System\ZNlMOxg.exe
  2⤵
  PID:14308
- C:\Windows\System\VwjqAqg.exe
  C:\Windows\System\VwjqAqg.exe
  2⤵
  PID:13360
- C:\Windows\System\PxhzKEL.exe
  C:\Windows\System\PxhzKEL.exe
  2⤵
  PID:13608
- C:\Windows\System\CaQqVak.exe
  C:\Windows\System\CaQqVak.exe
  2⤵
  PID:4712
- C:\Windows\System\DMQSVXB.exe
  C:\Windows\System\DMQSVXB.exe
  2⤵
  PID:1564
- C:\Windows\System\mmduLvJ.exe
  C:\Windows\System\mmduLvJ.exe
  2⤵
  PID:5648
- C:\Windows\System\dpdVXmS.exe
  C:\Windows\System\dpdVXmS.exe
  2⤵
  PID:13580
- C:\Windows\System\wuKFNwB.exe
  C:\Windows\System\wuKFNwB.exe
  2⤵
  PID:13728
- C:\Windows\System\rfFRtMl.exe
  C:\Windows\System\rfFRtMl.exe
  2⤵
  PID:548
- C:\Windows\System\nvvCjCd.exe
  C:\Windows\System\nvvCjCd.exe
  2⤵
  PID:840
- C:\Windows\System\bIABffg.exe
  C:\Windows\System\bIABffg.exe
  2⤵
  PID:14116
- C:\Windows\System\GeQMFtT.exe
  C:\Windows\System\GeQMFtT.exe
  2⤵
  PID:6088
- C:\Windows\System\KPNdLyP.exe
  C:\Windows\System\KPNdLyP.exe
  2⤵
  PID:4212
- C:\Windows\System\LkwifUm.exe
  C:\Windows\System\LkwifUm.exe
  2⤵
  PID:13780
- C:\Windows\System\nXhcCnS.exe
  C:\Windows\System\nXhcCnS.exe
  2⤵
  PID:5388
- C:\Windows\System\ZFPIwCB.exe
  C:\Windows\System\ZFPIwCB.exe
  2⤵
  PID:3472
- C:\Windows\System\NkCoaXG.exe
  C:\Windows\System\NkCoaXG.exe
  2⤵
  PID:5316
- C:\Windows\System\gEkRDWr.exe
  C:\Windows\System\gEkRDWr.exe
  2⤵
  PID:6100
- C:\Windows\System\ydKUqow.exe
  C:\Windows\System\ydKUqow.exe
  2⤵
  PID:2564
- C:\Windows\System\SCFjsTw.exe
  C:\Windows\System\SCFjsTw.exe
  2⤵
  PID:14048
- C:\Windows\System\aftnamH.exe
  C:\Windows\System\aftnamH.exe
  2⤵
  PID:14264
- C:\Windows\System\JtMUCqd.exe
  C:\Windows\System\JtMUCqd.exe
  2⤵
  PID:1932
- C:\Windows\System\MtXQpwc.exe
  C:\Windows\System\MtXQpwc.exe
  2⤵
  PID:6132
- C:\Windows\System\gaKgdac.exe
  C:\Windows\System\gaKgdac.exe
  2⤵
  PID:2456
- C:\Windows\System\fALUuoe.exe
  C:\Windows\System\fALUuoe.exe
  2⤵
  PID:4960
- C:\Windows\System\WgBWscD.exe
  C:\Windows\System\WgBWscD.exe
  2⤵
  PID:6092
- C:\Windows\System\NwgMPMC.exe
  C:\Windows\System\NwgMPMC.exe
  2⤵
  PID:13676
- C:\Windows\System\olvPsbM.exe
  C:\Windows\System\olvPsbM.exe
  2⤵
  PID:3212
- C:\Windows\System\MKwGqBH.exe
  C:\Windows\System\MKwGqBH.exe
  2⤵
  PID:6136
- C:\Windows\System\rDXaPBZ.exe
  C:\Windows\System\rDXaPBZ.exe
  2⤵
  PID:3276
- C:\Windows\System\EtmdIYO.exe
  C:\Windows\System\EtmdIYO.exe
  2⤵
  PID:3000
- C:\Windows\System\ECUPXGr.exe
  C:\Windows\System\ECUPXGr.exe
  2⤵
  PID:9708
- C:\Windows\System\lUbfBzQ.exe
  C:\Windows\System\lUbfBzQ.exe
  2⤵
  PID:3692
- C:\Windows\System\YWIRWWg.exe
  C:\Windows\System\YWIRWWg.exe
  2⤵
  PID:14056
- C:\Windows\System\trHFqVT.exe
  C:\Windows\System\trHFqVT.exe
  2⤵
  PID:14040
- C:\Windows\System\wKgQvQH.exe
  C:\Windows\System\wKgQvQH.exe
  2⤵
  PID:3904
- C:\Windows\System\AjwTGDg.exe
  C:\Windows\System\AjwTGDg.exe
  2⤵
  PID:880
- C:\Windows\System\MdEjzZe.exe
  C:\Windows\System\MdEjzZe.exe
  2⤵
  PID:2912
- C:\Windows\System\ViwYrNF.exe
  C:\Windows\System\ViwYrNF.exe
  2⤵
  PID:13460
- C:\Windows\System\tdYhpjz.exe
  C:\Windows\System\tdYhpjz.exe
  2⤵
  PID:2724
- C:\Windows\System\kcKeSNi.exe
  C:\Windows\System\kcKeSNi.exe
  2⤵
  PID:864
- C:\Windows\System\BvgykvR.exe
  C:\Windows\System\BvgykvR.exe
  2⤵
  PID:6108
- C:\Windows\System\SbzteaU.exe
  C:\Windows\System\SbzteaU.exe
  2⤵
  PID:6096
- C:\Windows\System\pOClwYN.exe
  C:\Windows\System\pOClwYN.exe
  2⤵
  PID:4836
- C:\Windows\System\rxUoerX.exe
  C:\Windows\System\rxUoerX.exe
  2⤵
  PID:13504
- C:\Windows\System\lPhdCbo.exe
  C:\Windows\System\lPhdCbo.exe
  2⤵
  PID:5576
- C:\Windows\System\EmCCXGg.exe
  C:\Windows\System\EmCCXGg.exe
  2⤵
  PID:3680
- C:\Windows\System\jNmCPkL.exe
  C:\Windows\System\jNmCPkL.exe
  2⤵
  PID:4060
- C:\Windows\System\eBbuvKk.exe
  C:\Windows\System\eBbuvKk.exe
  2⤵
  PID:6172
- C:\Windows\System\yVTZtUQ.exe
  C:\Windows\System\yVTZtUQ.exe
  2⤵
  PID:13932
- C:\Windows\System\LPEtBLO.exe
  C:\Windows\System\LPEtBLO.exe
  2⤵
  PID:13744
- C:\Windows\System\ZrrvMFQ.exe
  C:\Windows\System\ZrrvMFQ.exe
  2⤵
  PID:4240
- C:\Windows\System\QscNsnu.exe
  C:\Windows\System\QscNsnu.exe
  2⤵
  PID:6436
- C:\Windows\System\BODyBgc.exe
  C:\Windows\System\BODyBgc.exe
  2⤵
  PID:6200
- C:\Windows\System\FXCRBOx.exe
  C:\Windows\System\FXCRBOx.exe
  2⤵
  PID:5452
- C:\Windows\System\EgdqVPw.exe
  C:\Windows\System\EgdqVPw.exe
  2⤵
  PID:14052
- C:\Windows\System\kgXsMeH.exe
  C:\Windows\System\kgXsMeH.exe
  2⤵
  PID:6432
- C:\Windows\System\ypcTMeA.exe
  C:\Windows\System\ypcTMeA.exe
  2⤵
  PID:5624
- C:\Windows\System\CQHwYPD.exe
  C:\Windows\System\CQHwYPD.exe
  2⤵
  PID:6180
- C:\Windows\System\ErlGMam.exe
  C:\Windows\System\ErlGMam.exe
  2⤵
  PID:4576
- C:\Windows\System\YzwnJfa.exe
  C:\Windows\System\YzwnJfa.exe
  2⤵
  PID:5756
- C:\Windows\System\dOdAmPW.exe
  C:\Windows\System\dOdAmPW.exe
  2⤵
  PID:5972
- C:\Windows\System\HHloPHU.exe
  C:\Windows\System\HHloPHU.exe
  2⤵
  PID:12968
- C:\Windows\System\lbEVXwA.exe
  C:\Windows\System\lbEVXwA.exe
  2⤵
  PID:6528
- C:\Windows\System\xIABmlv.exe
  C:\Windows\System\xIABmlv.exe
  2⤵
  PID:1760
- C:\Windows\System\spskuUZ.exe
  C:\Windows\System\spskuUZ.exe
  2⤵
  PID:6556
- C:\Windows\System\zkSMLij.exe
  C:\Windows\System\zkSMLij.exe
  2⤵
  PID:6468
- C:\Windows\System\jslvgwA.exe
  C:\Windows\System\jslvgwA.exe
  2⤵
  PID:14392
- C:\Windows\System\rXnHZey.exe
  C:\Windows\System\rXnHZey.exe
  2⤵
  PID:14408
- C:\Windows\System\OrtknKq.exe
  C:\Windows\System\OrtknKq.exe
  2⤵
  PID:14436
- C:\Windows\System\BfWxSCC.exe
  C:\Windows\System\BfWxSCC.exe
  2⤵
  PID:14460
- C:\Windows\System\paNiWnT.exe
  C:\Windows\System\paNiWnT.exe
  2⤵
  PID:14480
- C:\Windows\System\aDaBcAq.exe
  C:\Windows\System\aDaBcAq.exe
  2⤵
  PID:14500
- C:\Windows\System\DwLPSwW.exe
  C:\Windows\System\DwLPSwW.exe
  2⤵
  PID:14520
- C:\Windows\System\cspldyC.exe
  C:\Windows\System\cspldyC.exe
  2⤵
  PID:14540
- C:\Windows\System\yKOjapD.exe
  C:\Windows\System\yKOjapD.exe
  2⤵
  PID:14564
- C:\Windows\System\jKtnJwf.exe
  C:\Windows\System\jKtnJwf.exe
  2⤵
  PID:14596
- C:\Windows\System\AMgNIPs.exe
  C:\Windows\System\AMgNIPs.exe
  2⤵
  PID:14636
- C:\Windows\System\PTplWgU.exe
  C:\Windows\System\PTplWgU.exe
  2⤵
  PID:14692
- C:\Windows\System\BFVSbDu.exe
  C:\Windows\System\BFVSbDu.exe
  2⤵
  PID:14784
- C:\Windows\System\ujLJZJv.exe
  C:\Windows\System\ujLJZJv.exe
  2⤵
  PID:14884
- C:\Windows\System\gMIXuwb.exe
  C:\Windows\System\gMIXuwb.exe
  2⤵
  PID:14908
- C:\Windows\System\BgvfIcZ.exe
  C:\Windows\System\BgvfIcZ.exe
  2⤵
  PID:14932
- C:\Windows\System\reAlcgm.exe
  C:\Windows\System\reAlcgm.exe
  2⤵
  PID:14972
- C:\Windows\System\bIuAFZe.exe
  C:\Windows\System\bIuAFZe.exe
  2⤵
  PID:14996
- C:\Windows\System\QhUOWrP.exe
  C:\Windows\System\QhUOWrP.exe
  2⤵
  PID:15020
- C:\Windows\System\jhRfHzV.exe
  C:\Windows\System\jhRfHzV.exe
  2⤵
  PID:15044
- C:\Windows\System\AhqAlzy.exe
  C:\Windows\System\AhqAlzy.exe
  2⤵
  PID:15064
- C:\Windows\System\SmZZUpk.exe
  C:\Windows\System\SmZZUpk.exe
  2⤵
  PID:15096
- C:\Windows\System\fVgPsnW.exe
  C:\Windows\System\fVgPsnW.exe
  2⤵
  PID:15120
- C:\Windows\System\CGaFpLy.exe
  C:\Windows\System\CGaFpLy.exe
  2⤵
  PID:15176
- C:\Windows\System\didzBQJ.exe
  C:\Windows\System\didzBQJ.exe
  2⤵
  PID:15196
- C:\Windows\System\rIQAKQF.exe
  C:\Windows\System\rIQAKQF.exe
  2⤵
  PID:15220
- C:\Windows\System\DtbZTwx.exe
  C:\Windows\System\DtbZTwx.exe
  2⤵
  PID:15236
- C:\Windows\System\tgIMTCH.exe
  C:\Windows\System\tgIMTCH.exe
  2⤵
  PID:15260
- C:\Windows\System\cvNNGxi.exe
  C:\Windows\System\cvNNGxi.exe
  2⤵
  PID:15280
- C:\Windows\System\icdTIba.exe
  C:\Windows\System\icdTIba.exe
  2⤵
  PID:15300
- C:\Windows\System\RCsZWPs.exe
  C:\Windows\System\RCsZWPs.exe
  2⤵
  PID:15324
- C:\Windows\System\HGwHqEF.exe
  C:\Windows\System\HGwHqEF.exe
  2⤵
  PID:15348
- C:\Windows\System\Hmaxlsc.exe
  C:\Windows\System\Hmaxlsc.exe
  2⤵
  PID:6452
- C:\Windows\System\RqMbMzc.exe
  C:\Windows\System\RqMbMzc.exe
  2⤵
  PID:13528
- C:\Windows\System\oNbjwCi.exe
  C:\Windows\System\oNbjwCi.exe
  2⤵
  PID:3632
- C:\Windows\System\aymSNUT.exe
  C:\Windows\System\aymSNUT.exe
  2⤵
  PID:4040
- C:\Windows\System\lhJzHTs.exe
  C:\Windows\System\lhJzHTs.exe
  2⤵
  PID:5988
- C:\Windows\System\PGPdCwm.exe
  C:\Windows\System\PGPdCwm.exe
  2⤵
  PID:14004
- C:\Windows\System\pCFqvxP.exe
  C:\Windows\System\pCFqvxP.exe
  2⤵
  PID:10412
- C:\Windows\System\jzdJepZ.exe
  C:\Windows\System\jzdJepZ.exe
  2⤵
  PID:6440
- C:\Windows\System\ClIGdfI.exe
  C:\Windows\System\ClIGdfI.exe
  2⤵
  PID:14532
- C:\Windows\System\vMsjFrR.exe
  C:\Windows\System\vMsjFrR.exe
  2⤵
  PID:1196
- C:\Windows\System\oBcAsQo.exe
  C:\Windows\System\oBcAsQo.exe
  2⤵
  PID:14676
- C:\Windows\System\xxFJcRA.exe
  C:\Windows\System\xxFJcRA.exe
  2⤵
  PID:13884
- C:\Windows\System\ZtZdFZS.exe
  C:\Windows\System\ZtZdFZS.exe
  2⤵
  PID:14836
- C:\Windows\System\vqWLlUR.exe
  C:\Windows\System\vqWLlUR.exe
  2⤵
  PID:14780
- C:\Windows\System\DnbanNz.exe
  C:\Windows\System\DnbanNz.exe
  2⤵
  PID:15156
- C:\Windows\System\zKCLWFF.exe
  C:\Windows\System\zKCLWFF.exe
  2⤵
  PID:14940
- C:\Windows\System\ydJPNjn.exe
  C:\Windows\System\ydJPNjn.exe
  2⤵
  PID:15268
- C:\Windows\System\vvdMRcP.exe
  C:\Windows\System\vvdMRcP.exe
  2⤵
  PID:2772
- C:\Windows\System\wXLFQJS.exe
  C:\Windows\System\wXLFQJS.exe
  2⤵
  PID:15308
- C:\Windows\System\edoAotY.exe
  C:\Windows\System\edoAotY.exe
  2⤵
  PID:14864
- C:\Windows\System\USzrJne.exe
  C:\Windows\System\USzrJne.exe
  2⤵
  PID:6168
- C:\Windows\System\LODSrlL.exe
  C:\Windows\System\LODSrlL.exe
  2⤵
  PID:15356
- C:\Windows\System\ggLWmRs.exe
  C:\Windows\System\ggLWmRs.exe
  2⤵
  PID:6944
- C:\Windows\System\UDueVRe.exe
  C:\Windows\System\UDueVRe.exe
  2⤵
  PID:1380
- C:\Windows\System\jRlpnyG.exe
  C:\Windows\System\jRlpnyG.exe
  2⤵
  PID:7060
- C:\Windows\System\BpviObb.exe
  C:\Windows\System\BpviObb.exe
  2⤵
  PID:14708
- C:\Windows\System\OfjstUQ.exe
  C:\Windows\System\OfjstUQ.exe
  2⤵
  PID:7188
- C:\Windows\System\pCTROEj.exe
  C:\Windows\System\pCTROEj.exe
  2⤵
  PID:7992
- C:\Windows\System\gwwJFqq.exe
  C:\Windows\System\gwwJFqq.exe
  2⤵
  PID:4052
- C:\Windows\System\YgudzIl.exe
  C:\Windows\System\YgudzIl.exe
  2⤵
  PID:7220
- C:\Windows\System\vqYPJsk.exe
  C:\Windows\System\vqYPJsk.exe
  2⤵
  PID:14764
- C:\Windows\System\fchWkjM.exe
  C:\Windows\System\fchWkjM.exe
  2⤵
  PID:4812
- C:\Windows\System\GhbzCnV.exe
  C:\Windows\System\GhbzCnV.exe
  2⤵
  PID:7300
- C:\Windows\System\AnwPawV.exe
  C:\Windows\System\AnwPawV.exe
  2⤵
  PID:14712
- C:\Windows\System\Uuvbnbj.exe
  C:\Windows\System\Uuvbnbj.exe
  2⤵
  PID:5044
- C:\Windows\System\OkOUfbr.exe
  C:\Windows\System\OkOUfbr.exe
  2⤵
  PID:14660
- C:\Windows\System\OBzREHy.exe
  C:\Windows\System\OBzREHy.exe
  2⤵
  PID:2056
- C:\Windows\System\aqucWiG.exe
  C:\Windows\System\aqucWiG.exe
  2⤵
  PID:7012
- C:\Windows\System\wDewMkz.exe
  C:\Windows\System\wDewMkz.exe
  2⤵
  PID:14772
- C:\Windows\System\tbzKZro.exe
  C:\Windows\System\tbzKZro.exe
  2⤵
  PID:4524
- C:\Windows\System\thuaGaQ.exe
  C:\Windows\System\thuaGaQ.exe
  2⤵
  PID:7364
- C:\Windows\System\qCKgKxM.exe
  C:\Windows\System\qCKgKxM.exe
  2⤵
  PID:7240
- C:\Windows\System\nJYKMaR.exe
  C:\Windows\System\nJYKMaR.exe
  2⤵
  PID:7772
- C:\Windows\System\OFhghBe.exe
  C:\Windows\System\OFhghBe.exe
  2⤵
  PID:15104
- C:\Windows\System\eCPAMFi.exe
  C:\Windows\System\eCPAMFi.exe
  2⤵
  PID:7756
- C:\Windows\System\tnuyhqL.exe
  C:\Windows\System\tnuyhqL.exe
  2⤵
  PID:4396
- C:\Windows\System\WhNyabZ.exe
  C:\Windows\System\WhNyabZ.exe
  2⤵
  PID:15184
- C:\Windows\System\nDhYCgX.exe
  C:\Windows\System\nDhYCgX.exe
  2⤵
  PID:8016
- C:\Windows\System\JTMdKvY.exe
  C:\Windows\System\JTMdKvY.exe
  2⤵
  PID:8256
- C:\Windows\System\NSIMjKC.exe
  C:\Windows\System\NSIMjKC.exe
  2⤵
  PID:14968
- C:\Windows\System\HdEohHG.exe
  C:\Windows\System\HdEohHG.exe
  2⤵
  PID:7268
- C:\Windows\System\gVaZSpv.exe
  C:\Windows\System\gVaZSpv.exe
  2⤵
  PID:15132
- C:\Windows\System\mQvAXjn.exe
  C:\Windows\System\mQvAXjn.exe
  2⤵
  PID:15052
- C:\Windows\System\JsrwtbH.exe
  C:\Windows\System\JsrwtbH.exe
  2⤵
  PID:8248
- C:\Windows\System\qlrIVhu.exe
  C:\Windows\System\qlrIVhu.exe
  2⤵
  PID:15252
- C:\Windows\System\Mplwqkw.exe
  C:\Windows\System\Mplwqkw.exe
  2⤵
  PID:1928
- C:\Windows\System\xSDtEgr.exe
  C:\Windows\System\xSDtEgr.exe
  2⤵
  PID:14448
- C:\Windows\System\rwMgKDa.exe
  C:\Windows\System\rwMgKDa.exe
  2⤵
  PID:7292
- C:\Windows\System\uFvVNTe.exe
  C:\Windows\System\uFvVNTe.exe
  2⤵
  PID:15316
- C:\Windows\System\eoFWGKB.exe
  C:\Windows\System\eoFWGKB.exe
  2⤵
  PID:7748
- C:\Windows\System\PNiquhd.exe
  C:\Windows\System\PNiquhd.exe
  2⤵
  PID:14680
- C:\Windows\System\GRCWdVN.exe
  C:\Windows\System\GRCWdVN.exe
  2⤵
  PID:7044
- C:\Windows\System\nlSBMhB.exe
  C:\Windows\System\nlSBMhB.exe
  2⤵
  PID:14900
- C:\Windows\System\BKdDyPx.exe
  C:\Windows\System\BKdDyPx.exe
  2⤵
  PID:14916
- C:\Windows\System\TeaPGEy.exe
  C:\Windows\System\TeaPGEy.exe
  2⤵
  PID:9100
- C:\Windows\System\KKqaVGU.exe
  C:\Windows\System\KKqaVGU.exe
  2⤵
  PID:15208
- C:\Windows\System\RymatRW.exe
  C:\Windows\System\RymatRW.exe
  2⤵
  PID:1040
- C:\Windows\System\RTvKuuT.exe
  C:\Windows\System\RTvKuuT.exe
  2⤵
  PID:6580
- C:\Windows\System\tqcKijW.exe
  C:\Windows\System\tqcKijW.exe
  2⤵
  PID:3460
- C:\Windows\System\UMGtbjr.exe
  C:\Windows\System\UMGtbjr.exe
  2⤵
  PID:7736
- C:\Windows\System\wNKLCRJ.exe
  C:\Windows\System\wNKLCRJ.exe
  2⤵
  PID:15040
- C:\Windows\System\xRyripB.exe
  C:\Windows\System\xRyripB.exe
  2⤵
  PID:14112
- C:\Windows\System\ulataeo.exe
  C:\Windows\System\ulataeo.exe
  2⤵
  PID:14340
- C:\Windows\System\upbRCBU.exe
  C:\Windows\System\upbRCBU.exe
  2⤵
  PID:7836
- C:\Windows\System\UoJSLZi.exe
  C:\Windows\System\UoJSLZi.exe
  2⤵
  PID:7248
- C:\Windows\System\yWyHGun.exe
  C:\Windows\System\yWyHGun.exe
  2⤵
  PID:7760
- C:\Windows\System\efwzcuO.exe
  C:\Windows\System\efwzcuO.exe
  2⤵
  PID:14744
- C:\Windows\System\HNfcHVS.exe
  C:\Windows\System\HNfcHVS.exe
  2⤵
  PID:7328
- C:\Windows\System\nutckiv.exe
  C:\Windows\System\nutckiv.exe
  2⤵
  PID:6848
- C:\Windows\System\aJrOEYm.exe
  C:\Windows\System\aJrOEYm.exe
  2⤵
  PID:14684
- C:\Windows\System\TXTLhet.exe
  C:\Windows\System\TXTLhet.exe
  2⤵
  PID:7864
- C:\Windows\System\bZJcnKg.exe
  C:\Windows\System\bZJcnKg.exe
  2⤵
  PID:8584
- C:\Windows\System\WIHllxG.exe
  C:\Windows\System\WIHllxG.exe
  2⤵
  PID:14424
- C:\Windows\System\PFdDMim.exe
  C:\Windows\System\PFdDMim.exe
  2⤵
  PID:9064
- C:\Windows\System\cgtYCtv.exe
  C:\Windows\System\cgtYCtv.exe
  2⤵
  PID:9044
- C:\Windows\System\zVOVQfu.exe
  C:\Windows\System\zVOVQfu.exe
  2⤵
  PID:14808
- C:\Windows\System\aUhIbNA.exe
  C:\Windows\System\aUhIbNA.exe
  2⤵
  PID:9196
- C:\Windows\System\tsnaxxl.exe
  C:\Windows\System\tsnaxxl.exe
  2⤵
  PID:8560
- C:\Windows\System\GFhnqws.exe
  C:\Windows\System\GFhnqws.exe
  2⤵
  PID:8188
- C:\Windows\System\pJzOlRu.exe
  C:\Windows\System\pJzOlRu.exe
  2⤵
  PID:8580
- C:\Windows\System\SIQsaIM.exe
  C:\Windows\System\SIQsaIM.exe
  2⤵
  PID:8600
- C:\Windows\System\XRhRCwK.exe
  C:\Windows\System\XRhRCwK.exe
  2⤵
  PID:7740
- C:\Windows\System\keaibEB.exe
  C:\Windows\System\keaibEB.exe
  2⤵
  PID:8612
- C:\Windows\System\uuWtDTc.exe
  C:\Windows\System\uuWtDTc.exe
  2⤵
  PID:5332
- C:\Windows\System\lhGTVso.exe
  C:\Windows\System\lhGTVso.exe
  2⤵
  PID:9620
- C:\Windows\System\dPrSONs.exe
  C:\Windows\System\dPrSONs.exe
  2⤵
  PID:8996
- C:\Windows\System\ddTYiXk.exe
  C:\Windows\System\ddTYiXk.exe
  2⤵
  PID:7656
- C:\Windows\System\LCjulLp.exe
  C:\Windows\System\LCjulLp.exe
  2⤵
  PID:5968
- C:\Windows\System\PtuecVF.exe
  C:\Windows\System\PtuecVF.exe
  2⤵
  PID:7076
- C:\Windows\System\cAJNFoj.exe
  C:\Windows\System\cAJNFoj.exe
  2⤵
  PID:7024
- C:\Windows\System\ChjEZQc.exe
  C:\Windows\System\ChjEZQc.exe
  2⤵
  PID:7576
- C:\Windows\System\cUEmLvS.exe
  C:\Windows\System\cUEmLvS.exe
  2⤵
  PID:7120
- C:\Windows\System\SyfZVbw.exe
  C:\Windows\System\SyfZVbw.exe
  2⤵
  PID:6716
- C:\Windows\System\ODVlKLG.exe
  C:\Windows\System\ODVlKLG.exe
  2⤵
  PID:7676
- C:\Windows\System\Yicgwsy.exe
  C:\Windows\System\Yicgwsy.exe
  2⤵
  PID:7660
- C:\Windows\System\whbtURV.exe
  C:\Windows\System\whbtURV.exe
  2⤵
  PID:9208
- C:\Windows\System\rYHCvuc.exe
  C:\Windows\System\rYHCvuc.exe
  2⤵
  PID:9112
- C:\Windows\System\smfVbiP.exe
  C:\Windows\System\smfVbiP.exe
  2⤵
  PID:7776
- C:\Windows\System\woBmOJo.exe
  C:\Windows\System\woBmOJo.exe
  2⤵
  PID:8640
- C:\Windows\System\wArJQQR.exe
  C:\Windows\System\wArJQQR.exe
  2⤵
  PID:14776
- C:\Windows\System\jPXwSKl.exe
  C:\Windows\System\jPXwSKl.exe
  2⤵
  PID:8948
- C:\Windows\System\TlVvdal.exe
  C:\Windows\System\TlVvdal.exe
  2⤵
  PID:7644
- C:\Windows\System\nzEVojF.exe
  C:\Windows\System\nzEVojF.exe
  2⤵
  PID:13444
- C:\Windows\System\CYToPzQ.exe
  C:\Windows\System\CYToPzQ.exe
  2⤵
  PID:9184
- C:\Windows\System\sFtjukv.exe
  C:\Windows\System\sFtjukv.exe
  2⤵
  PID:316
- C:\Windows\System\PBbVGyv.exe
  C:\Windows\System\PBbVGyv.exe
  2⤵
  PID:7028
- C:\Windows\System\IQWjnlb.exe
  C:\Windows\System\IQWjnlb.exe
  2⤵
  PID:7596
- C:\Windows\System\ESxfLek.exe
  C:\Windows\System\ESxfLek.exe
  2⤵
  PID:7744
- C:\Windows\System\AnJVHFG.exe
  C:\Windows\System\AnJVHFG.exe
  2⤵
  PID:7752
- C:\Windows\System\UXDpQqD.exe
  C:\Windows\System\UXDpQqD.exe
  2⤵
  PID:6916
- C:\Windows\System\ezdjwID.exe
  C:\Windows\System\ezdjwID.exe
  2⤵
  PID:7484
- C:\Windows\System\NwYmPwv.exe
  C:\Windows\System\NwYmPwv.exe
  2⤵
  PID:9052
- C:\Windows\System\DjlMFis.exe
  C:\Windows\System\DjlMFis.exe
  2⤵
  PID:4920
- C:\Windows\System\OrYtIfS.exe
  C:\Windows\System\OrYtIfS.exe
  2⤵
  PID:9104
- C:\Windows\System\tjKSqOG.exe
  C:\Windows\System\tjKSqOG.exe
  2⤵
  PID:13508
- C:\Windows\System\DkQLdoo.exe
  C:\Windows\System\DkQLdoo.exe
  2⤵
  PID:9012
- C:\Windows\System\uOWSEZI.exe
  C:\Windows\System\uOWSEZI.exe
  2⤵
  PID:7808
- C:\Windows\System\IcklSmD.exe
  C:\Windows\System\IcklSmD.exe
  2⤵
  PID:7848
- C:\Windows\System\SQvPJTA.exe
  C:\Windows\System\SQvPJTA.exe
  2⤵
  PID:9616
- C:\Windows\System\DTFpUqd.exe
  C:\Windows\System\DTFpUqd.exe
  2⤵
  PID:14652
- C:\Windows\System\SIxdIvI.exe
  C:\Windows\System\SIxdIvI.exe
  2⤵
  PID:7788
- C:\Windows\System\reySPab.exe
  C:\Windows\System\reySPab.exe
  2⤵
  PID:7244
- C:\Windows\System\BubdxRN.exe
  C:\Windows\System\BubdxRN.exe
  2⤵
  PID:3312
- C:\Windows\System\ofKKuVZ.exe
  C:\Windows\System\ofKKuVZ.exe
  2⤵
  PID:9520
- C:\Windows\System\qmsCfiK.exe
  C:\Windows\System\qmsCfiK.exe
  2⤵
  PID:6296
- C:\Windows\System\nLJPLXw.exe
  C:\Windows\System\nLJPLXw.exe
  2⤵
  PID:9980
- C:\Windows\System\tCVUHJR.exe
  C:\Windows\System\tCVUHJR.exe
  2⤵
  PID:9692
- C:\Windows\System\GKdWnRW.exe
  C:\Windows\System\GKdWnRW.exe
  2⤵
  PID:6472
- C:\Windows\System\HUzVCiN.exe
  C:\Windows\System\HUzVCiN.exe
  2⤵
  PID:9360
- C:\Windows\System\MikkTwK.exe
  C:\Windows\System\MikkTwK.exe
  2⤵
  PID:8436
- C:\Windows\System\vJprmuj.exe
  C:\Windows\System\vJprmuj.exe
  2⤵
  PID:436
- C:\Windows\System\XNAghUE.exe
  C:\Windows\System\XNAghUE.exe
  2⤵
  PID:9612
- C:\Windows\System\XApYomw.exe
  C:\Windows\System\XApYomw.exe
  2⤵
  PID:5060
- C:\Windows\System\UYSKfXZ.exe
  C:\Windows\System\UYSKfXZ.exe
  2⤵
  PID:5076
- C:\Windows\System\qMTHClE.exe
  C:\Windows\System\qMTHClE.exe
  2⤵
  PID:8700
- C:\Windows\System\tfKisRc.exe
  C:\Windows\System\tfKisRc.exe
  2⤵
  PID:8216
- C:\Windows\System\ZuJZAms.exe
  C:\Windows\System\ZuJZAms.exe
  2⤵
  PID:208
- C:\Windows\System\auOXkml.exe
  C:\Windows\System\auOXkml.exe
  2⤵
  PID:15372
- C:\Windows\System\IkIInXD.exe
  C:\Windows\System\IkIInXD.exe
  2⤵
  PID:15396
- C:\Windows\System\yOklysV.exe
  C:\Windows\System\yOklysV.exe
  2⤵
  PID:15468
- C:\Windows\System\zWbPmyP.exe
  C:\Windows\System\zWbPmyP.exe
  2⤵
  PID:15568
- C:\Windows\System\mTccOjS.exe
  C:\Windows\System\mTccOjS.exe
  2⤵
  PID:15588
- C:\Windows\System\bLUthVQ.exe
  C:\Windows\System\bLUthVQ.exe
  2⤵
  PID:15784
- C:\Windows\System\vmCJWQt.exe
  C:\Windows\System\vmCJWQt.exe
  2⤵
  PID:15824
- C:\Windows\System\qhrNgHw.exe
  C:\Windows\System\qhrNgHw.exe
  2⤵
  PID:15840
- C:\Windows\System\VzGoHEK.exe
  C:\Windows\System\VzGoHEK.exe
  2⤵
  PID:15872
- C:\Windows\System\RQjaNTM.exe
  C:\Windows\System\RQjaNTM.exe
  2⤵
  PID:15892
- C:\Windows\System\tOPvlAp.exe
  C:\Windows\System\tOPvlAp.exe
  2⤵
  PID:15920
- C:\Windows\System\vCCRNij.exe
  C:\Windows\System\vCCRNij.exe
  2⤵
  PID:15944
- C:\Windows\System\UFtieGq.exe
  C:\Windows\System\UFtieGq.exe
  2⤵
  PID:15968
- C:\Windows\System\ZFtqPoU.exe
  C:\Windows\System\ZFtqPoU.exe
  2⤵
  PID:16012
- C:\Windows\System\zbDRNii.exe
  C:\Windows\System\zbDRNii.exe
  2⤵
  PID:16032
- C:\Windows\System\oZTnZro.exe
  C:\Windows\System\oZTnZro.exe
  2⤵
  PID:16056
- C:\Windows\System\KXFBEkB.exe
  C:\Windows\System\KXFBEkB.exe
  2⤵
  PID:16080
- C:\Windows\System\aYXWqzJ.exe
  C:\Windows\System\aYXWqzJ.exe
  2⤵
  PID:16188
- C:\Windows\System\tUmCYlg.exe
  C:\Windows\System\tUmCYlg.exe
  2⤵
  PID:16248
- C:\Windows\System\hvCzSvR.exe
  C:\Windows\System\hvCzSvR.exe
  2⤵
  PID:16272
- C:\Windows\System\vZdEfae.exe
  C:\Windows\System\vZdEfae.exe
  2⤵
  PID:16292
- C:\Windows\System\RuQBqNe.exe
  C:\Windows\System\RuQBqNe.exe
  2⤵
  PID:16308
- C:\Windows\System\eTNtuOV.exe
  C:\Windows\System\eTNtuOV.exe
  2⤵
  PID:8848
- C:\Windows\System\ldfHZoW.exe
  C:\Windows\System\ldfHZoW.exe
  2⤵
  PID:15436
- C:\Windows\System\XdWKCrU.exe
  C:\Windows\System\XdWKCrU.exe
  2⤵
  PID:9600
- C:\Windows\System\arhzIkL.exe
  C:\Windows\System\arhzIkL.exe
  2⤵
  PID:15488
- C:\Windows\System\BVBVNwA.exe
  C:\Windows\System\BVBVNwA.exe
  2⤵
  PID:9172
- C:\Windows\System\ySwZzNg.exe
  C:\Windows\System\ySwZzNg.exe
  2⤵
  PID:15716
- C:\Windows\System\PUiqgzd.exe
  C:\Windows\System\PUiqgzd.exe
  2⤵
  PID:15768
- C:\Windows\System\rsISJzg.exe
  C:\Windows\System\rsISJzg.exe
  2⤵
  PID:15684
- C:\Windows\System\iBbvTwq.exe
  C:\Windows\System\iBbvTwq.exe
  2⤵
  PID:4972
- C:\Windows\System\nOmKwGr.exe
  C:\Windows\System\nOmKwGr.exe
  2⤵
  PID:10472
- C:\Windows\System\RuDpZzw.exe
  C:\Windows\System\RuDpZzw.exe
  2⤵
  PID:10276
- C:\Windows\System\GxpaWFa.exe
  C:\Windows\System\GxpaWFa.exe
  2⤵
  PID:15820
- C:\Windows\System\XzwyMff.exe
  C:\Windows\System\XzwyMff.exe
  2⤵
  PID:15836
- C:\Windows\System\WmEomvG.exe
  C:\Windows\System\WmEomvG.exe
  2⤵
  PID:15724
- C:\Windows\System\OITKsTX.exe
  C:\Windows\System\OITKsTX.exe
  2⤵
  PID:10408
- C:\Windows\System\jdtuvdF.exe
  C:\Windows\System\jdtuvdF.exe
  2⤵
  PID:16068
- C:\Windows\System\LwnJlsr.exe
  C:\Windows\System\LwnJlsr.exe
  2⤵
  PID:15996
- C:\Windows\System\cCVaPCA.exe
  C:\Windows\System\cCVaPCA.exe
  2⤵
  PID:15916
- C:\Windows\System\tJxQghL.exe
  C:\Windows\System\tJxQghL.exe
  2⤵
  PID:10248
- C:\Windows\System\hnKguyI.exe
  C:\Windows\System\hnKguyI.exe
  2⤵
  PID:10668
- C:\Windows\System\dOSHSoW.exe
  C:\Windows\System\dOSHSoW.exe
  2⤵
  PID:11164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j2ewwijs.dmf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ABvtysX.exe

Filesize
2.0MB

MD5
67943a80ce0f9f5053859da23909d005

SHA1
f0df3ca0e3775937a5baa6c9e40835f22573fd67

SHA256
51c7f0715beaa15b9975b2a8400156866f92591a849883d7cca1159691e202b1

SHA512
d55975040090a25758d9fb257939fb725fd02ebea49ae9a8a050821f5bb21cd010c43859ad49ba7f23818ab8a4eb7ece98ba43ae6f5fa2d37c027311a2f889fb

Download Submit
C:\Windows\System\AggLawz.exe

Filesize
2.0MB

MD5
4197941f21fc72a26312d648c817dbd5

SHA1
4dbebcf04e08e82b9595e16937ebdf357bfaea33

SHA256
dadb23e83bb797bebcef2273b3113c51dd14d8757a00fd7702e3bff4cb9a0390

SHA512
9c2e710219c270b6d2b0c25a276d0774a1af846d74519d29926c52cab59b5bb3394430e8d5f8719be0d276a8d30fe14e397ad56b88da1a8ecc9c40c85d9d1f58

Download Submit
C:\Windows\System\BGbRvGL.exe

Filesize
2.0MB

MD5
2c57359191436e00042b7c04473bb563

SHA1
2a1da90c9d9be71daf523e2e7d3f7c0919368ad1

SHA256
9a23a39ce33fe723d9cef96af245c9a1560f41f3a547030bfacf7d7f3decc639

SHA512
00be3ab23d2ab8eb6109ad21f34ddc137da889ae45a921d474085976a13b8c47ae4646af3d7f1722eead59896ef78ec58b9b38a8b8b6234e3486a6bf4968f83e

Download Submit
C:\Windows\System\CvCOksN.exe

Filesize
2.0MB

MD5
484357f0a36e98aa038dedeedfa97e1f

SHA1
4c777208140ccb66b0ac0ae1ae62edf386f0ccb5

SHA256
1cb8bc9fb56b585f9a0c051911e6f24754cd21e7129619d220f87cc67337b715

SHA512
3c850e48c26180d1970667f7079ea790337a476c94aa8654b51ee158666fde78e40a2309021bc6f6c0b9448bf0c66f459204874e8e3b138bf4ec8e9a740f4409

Download Submit
C:\Windows\System\FQqQxix.exe

Filesize
2.0MB

MD5
a804d8344879cc7707aeb99799401e31

SHA1
4877f39005976344f86de11a86f8a96004d0aa41

SHA256
cf19336cf517be7a160aaa303174d5c7792520b26e437d4c9e2379d866f8cafd

SHA512
443208e43d5cfa4419c1967a5facae9c7e4185ec47e9d6327795a0edcf6aa7b27dde45820ee86661d0d0c4916e879091f0a0df0711d3de187a0cba74b4e3b24c

Download Submit
C:\Windows\System\GVclIQT.exe

Filesize
2.0MB

MD5
ca0ef50c45305e5dca05be75cac64d15

SHA1
e19287dec9b02be2b8eae3ca96537719f8ff94cf

SHA256
5cb062fa159b96d7bdfbcd03f9fec3ceac697b68ea600eea5597eb9943ab94c9

SHA512
42111e1c871a191d27fbbd1425448c4f6c2414c6b484adb513492542bd7dbe5d5b6a687222f4eb3362aa7f539f8008cb8c510e192102f3e5480d2e6ce67f5851

Download Submit
C:\Windows\System\HAiVkKV.exe

Filesize
2.0MB

MD5
3d1ea783c914c3227ca402ca1305cc95

SHA1
7731ca6432e3422968820fd72c965446d03db074

SHA256
414a925b88969919b7aff1ceddc17f790f04e07cfae122224b302e6842fdff34

SHA512
3144ce0e25d887cb280e749a89d011c2a6bb068b7cfada3c8e767c7ae692131d9c6622a497b61f9ac58fc24c54d401086f60448fe7b79e794ed10a62d27ce801

Download Submit
C:\Windows\System\MMUXPNB.exe

Filesize
2.0MB

MD5
a6e308d9f8d036bbc36beaf202f25865

SHA1
1102fc86f5934399cd5e32e820517f710f225cc4

SHA256
e8a5f9b4c8d44668050571824b1917fda6797dce3ab09bd6e668a745cd331f0d

SHA512
d781dacda9f6e05e5ed2021f7e9ff680a4ecd47a078467c40f897e059d5a4e8afa0cb8a50fc12165cdc143a03cc3f66ac7bbbebe1ac8f6897948a21ec97499c4

Download Submit
C:\Windows\System\OPAlgnt.exe

Filesize
2.0MB

MD5
fec99d46ef276ba0b31578f046947cc2

SHA1
bc8fd4c636a1dfa26871c58791dbda5051b61428

SHA256
7fc02be33db75164a6dfa0b73ce8eca6401199c2a06563a6c9fcdbf71d49b1dc

SHA512
3ce700e34bff41cbe1142152c77431e453d83f0787fd7ea68dc592832299ad33d7219fa8ce820286796f88eff62f7c07ac2e7da365892eac8d267cd64405c96d

Download Submit
C:\Windows\System\PhkzgTC.exe

Filesize
2.0MB

MD5
482480990d69f555ae8a3e120c274671

SHA1
a309929959827fa7aecf4fa0e460f3019d154d6f

SHA256
35873d3fdcb75f612f83177d36bedb32a1fc7b94ec885a138953ca8ec3747e1d

SHA512
bf53996548175658a8c138c5965e2cf2cc2a03052cf31daf9e8b69216d1a2368562ec6f02c63f305d5666fbd33b8d989f524c9be8a26fd869b7956446651feb3

Download Submit
C:\Windows\System\SZIQYGT.exe

Filesize
2.0MB

MD5
b6c5631a7a651737b4d86446e12ad0dd

SHA1
19f1e4bcc77556f2609fcbd1be3533ab0eca7b39

SHA256
9f8d951116936f7a79901963b49847c98fd472bffc48c71284418296af94f471

SHA512
a9757b1b92fe43b02e9b38698ce818933bfd30feebecb90612a291c18c86ff26cc351c4e784dcd1ec6f6ef0d3f625c458817335055687cd6c48afe67232fbb3f

Download Submit
C:\Windows\System\StZyYAX.exe

Filesize
2.0MB

MD5
ed8f8794b2fed4c264f181803b4d9980

SHA1
9232d06e2e69947d322343ab8df3bedeb16fbe79

SHA256
ba51a199dab0702ed57669c34dd0002298846e18d0c95f42fc5cb3a044f44edd

SHA512
01af0a328ae906627f9d92d14e8bf749c8441acc50c1eb05bcf6a21a848a63091c7a3eba709a4b2d4dd1b678ad45da6e93b6c748eccf223f0ca110536e1adcab

Download Submit
C:\Windows\System\VRtTzdS.exe

Filesize
2.0MB

MD5
8ac0d737548419bcdc71ae97bae1973d

SHA1
66eee81b956a8493fc87aeb7d14212d406024c81

SHA256
6b550455e0c21377ad2647b2ed60d6d0d31bdc8fbead13db2011d0f6040d35f1

SHA512
ea058067b48844283c4ec626f931acd028d6e9fd9eb301e9c2bf4965294c7c95343309497bdc87e03632724c887477f7d6b1a4ff8dbe716cc971577ba279370a

Download Submit
C:\Windows\System\VTdxuDI.exe

Filesize
2.0MB

MD5
93cf3a78c9da2c338809e8c1a330c753

SHA1
5664696d90ae7f736d0ca79051f0ac9d24d81648

SHA256
8a5e9504870a91f992863f5c38e9ca115c5133404fc40670cffb8972a5ac5e91

SHA512
0327db949c30ee47819c21b1358a8a7e0118264ea3031e47030525771912126572b17f1ed90a3f1e4e9d4b3c0bbea39cfb6cfa796d5e5a397538fe9855a029cf

Download Submit
C:\Windows\System\VcjcjvB.exe

Filesize
2.0MB

MD5
ab0c042e77685b87acc227a451ae9b5f

SHA1
12d9e59bcd13ca48843499bbeffae11f82ec876d

SHA256
ab93132b1de7d4ced5e9efbf45602429acde0481fa83945f2d4da9cdd8b9ef41

SHA512
08e9c0024505b9bf0fbefcbcb4a5f195b8a1568562538c028f5e1ce25d9d55ea18a62e5d54b9882baaeadaeb964b51a0c1464f7c1174a5dfbe5d006439e18318

Download Submit
C:\Windows\System\XGQELAG.exe

Filesize
2.0MB

MD5
b590efc3e91f5695d46d3dd6306863fc

SHA1
4942487c14bdb0a4f37d19941d0973e43da02b79

SHA256
0ae25161a21c95ab8d922b30ad51c54168955c8067d137232f0a0202a3fe44f4

SHA512
6087239c8d23d4dcf9b5eaa30c22acaba8e4679ea640866f4972e134bfad8a8395471766c8b876817eea809c99a9668cc187539fa961f7f741c2acc2adb01947

Download Submit
C:\Windows\System\YDdgcWm.exe

Filesize
2.0MB

MD5
feae05fc076824100c320406d43419c7

SHA1
b532740b40b932aabe66a2c50d2b96d14f62d95e

SHA256
4f7803be05490eb28cc5522808d1c5ba8127866c7b80bb9b44d735c77b1d5e62

SHA512
e194de8458be19edc414d1dd937ce5ba223e9aaafa7c8a42dc5669bc43b77a3d035a407d0d9beee9616b75d845211f1adfc2a43eff07cb44ce8624563eb3475c

Download Submit
C:\Windows\System\YLxaIQX.exe

Filesize
2.0MB

MD5
35a032c4787ba9fed914e2e69163edfd

SHA1
12c6853f56c0099c106b390337246aa04bcc9035

SHA256
4364a51adf119cf2eb385c0da8becd4bd852b41cbdb636cb69ca27f27c0d66b2

SHA512
8c14a74fea5b98e6c91610d15c2fccd5a7a4600e93d11633db8c9d8a4219e66454e727da1cd381b34f055fec7d65d503e0fd5d3ddf41a82b4db24eb1d352befe

Download Submit
C:\Windows\System\bHDFiED.exe

Filesize
2.0MB

MD5
6e71771bcdc1e46180bfe50ee97d42d0

SHA1
c03d39dfd1b95e66292ed6541fa685761d3f8e3e

SHA256
1b68e54f8ca0945c62673bc08e34eb448810911d74ac884f510f98cc8d5ec968

SHA512
95a9e2b469684742a7891e9bb6a541636e2182f6956149974ae553fa1111917df8acb1b49897e98a2bf79b96baa7dfd1919608bd6d9db45c920834ec258415f9

Download Submit
C:\Windows\System\cKedJmz.exe

Filesize
2.0MB

MD5
f511cf2ce680ae687749997584436b27

SHA1
450c8dad9a0d79c8c07c93b974292fca0790cf20

SHA256
7417ea74a8401d1f903ac5563318c89156e02f72bcf56ede5d0f79b4f0ddd225

SHA512
45ca2ebc6f98aa9544ba7b881474aec3009c978698f5f0374c587754439e809cc6e11185cb8148be9bfecf9875f1d04e14398893e4009c724b0637350e079cfd

Download Submit
C:\Windows\System\cjoYmfp.exe

Filesize
2.0MB

MD5
83de4dd702de37214ae025b1d9c01ad5

SHA1
6df622fd5c06d41501b67a39cccc039430f76411

SHA256
866dfbc40f903df57e364f3d8cfcac18efee6753a4bfe2ad13d877c5849e5c16

SHA512
351ce28b4d00edae83a2f508d30246cb3dfb8ed953e4ef44ad10a6fd96910add851b8a56d078099c0080975ec034139b29560d0a9d954e13438f72b8e4d68d18

Download Submit
C:\Windows\System\ehdDSRS.exe

Filesize
2.0MB

MD5
d279cfc521187136499238d3376946aa

SHA1
82bd26455f0a0043c49eb7b0f00b6c128e3e5d74

SHA256
be2752f05dd42c5ec48191d99827251e97337dc3a6f6e459411515d2cd7bfb90

SHA512
dae8852b4cb48d3eb045527e0238deab2ada2af4f97f89d46788bf4de65d0425c310da0a7e59d82dbc2d9e2e902071874f94fc35b3aca09cb898000c05e2a125

Download Submit
C:\Windows\System\fDtcwXL.exe

Filesize
2.0MB

MD5
b07c09e9cfbc29dbc8809ed740a967ff

SHA1
e2f23264e45184dbab013f766812e7cb15d89e77

SHA256
1b1963177e780f7260ea562b596e2ab587b4080e6f3e505eb31e834b1c9de82c

SHA512
7a8b195a2dba22d4a6087e3652c61410bed95f5c9ce096b66ae92b3e3ce773f1c4989a158539003b7b9c41d8351a891309f8c090bafaea2161ef484c8b706dbe

Download Submit
C:\Windows\System\fMXFIZj.exe

Filesize
2.0MB

MD5
f1e79cfa6976cd07aa8f697fb018eaac

SHA1
ec336aec8b0390a698e5988c7638d0734d6b00a7

SHA256
d2a1ad81ab6c5f5cc5129bd71acda9aded844a57763e41e453bfa7a2f94025eb

SHA512
302ecf66677fbf6276691f3963dd54f2c45fff903883c0a5d519b4a5c3ab28a7a50c846a2aa860dbc05f9d4370c72be9987b21aef7c8d948f7584847c06361db

Download Submit
C:\Windows\System\fknYebH.exe

Filesize
2.0MB

MD5
7ed62a3795e362c828737cb1f0f096e6

SHA1
3d1ebda59292e3903d91d67fedd9f95b9dcaa187

SHA256
6ac5ab2753c4bc689fc11e0debbb5d7f0bc0d4ea4f23737583c8838242b6d383

SHA512
0b02b4b905b1c711eff6f9fd432dfe386f7237edaa9beffcc472651e991159e2366a3f931500c9a7f80861f0974e5565319e98fbdaeb993339136d3eb254b3e1

Download Submit
C:\Windows\System\fnHdrBO.exe

Filesize
18B

MD5
86b2bd2a1c5b503db6068a06743b627f

SHA1
644b52f79c6a2eb0efae14be490427eef7c9ced4

SHA256
90fcdf666f6075fbf44637df6214158f77410fcd29208c8cede77d16eb2bd111

SHA512
c858b69983ca77bf7fe8b37aa87b9425d1690e149418627a1f76e372e3ec9f8309a7441fa7dcd2b3ca7a63e06025c03ca6346e22eb8339841933907a2b26d3c2

Download Submit
C:\Windows\System\fuIryhY.exe

Filesize
2.0MB

MD5
29d29901d4f5aea06afc7e40ccbb3b06

SHA1
3df0c31bcd48d039bf8bbdd950e5c19e58fc4028

SHA256
9dc0c31e7d64615ebddd822ebe46233ff60eaff7232d0972c0e84e573916cae6

SHA512
65766bb4e81b45ef8646dcbc83e6c91499cf0326613b7996d018415d7fde434cc80880ae7c129df9b7bc89db8bb9f6f70e4105c60677e9a6edf56ab32d31f1fa

Download Submit
C:\Windows\System\hUPJVUN.exe

Filesize
2.0MB

MD5
3a2706e197cfa2ee39cd340ed5b043f4

SHA1
51489a05b30dd1b8dd5e163e5384da0daa6ff1f8

SHA256
b872325c387544062afbdf1a9995ceb6ad0f160695f89a2cfd80382b05def6c6

SHA512
ac3b56dfec29fb0db40e89c3865456fa280c82e19f70324c229b72fb2a21551ab8232890317f2c74dddb274c46fb3ecc872e74746b8c91cd913bc9f93561c0f4

Download Submit
C:\Windows\System\hbiokFu.exe

Filesize
2.0MB

MD5
5a81bf66689d825181d1d40ac87a3140

SHA1
f7fad9f55de839869b07757c887d3c27e0165ea7

SHA256
29285fb9b696facb93234fb4e47f553b05ba303505df3f6aaadcf77b7781ed64

SHA512
720dbd6199ad447f320a778377547fb69586902e4bfde3e057cf7249bc499d6b413b61dc9f511756898158cf35fcf970cced05ba36ff3906578fff130e4fd35e

Download Submit
C:\Windows\System\kkDMZyb.exe

Filesize
2.0MB

MD5
7802e86d683a42bf27a6d42d7c0c36ca

SHA1
905ef8d6fc73aca7ca49b8a14c6fa6497eb87833

SHA256
ee510b96042585bcf5973246b1975403ccbac2bb7eeaf580decedea05b7376a1

SHA512
a25b7e6b6360000a9d2217016c241e9bec872b3aa71e3137229a718ea0019a487010322c37f191937a6ca68ef477ffa9da8c4db5cfbdbb418e03a4573a76b6a7

Download Submit
C:\Windows\System\ksDKsMJ.exe

Filesize
2.0MB

MD5
a4a04137ea322ed46449ab58a5985ac1

SHA1
0ddaf1cef2932f1925eec401dbbff5a51d584c36

SHA256
1e03c10b2f1c590535976e6df07cd7e9f68619c39b3f3b7b423cca4b2f840b0f

SHA512
174db71dfdd16686438ec3c5fce66377fd409beec906e9d9ed9ec5e4ee9103f69469f4f936005fa89cd1dbfa5fd36c8411c153a9e5d38e32ab463ca2e2724ffb

Download Submit
C:\Windows\System\oQHLMzh.exe

Filesize
2.0MB

MD5
408b21dec1fe2f2a0bf46f066fd47bff

SHA1
60a4a9601cbbeef85e13b0223685bcf58e9fb928

SHA256
2ef86911713e0fc6a8c4d0ac1bc7f52a5b141b459087980b08189107d57771ca

SHA512
817958376847a518d3920751674c7393c48033787ff30b25552c47ac284889ad70e872059151fe93874ba635027a8a8f3e2a312b389b2b3b08647c8d65be47fd

Download Submit
C:\Windows\System\qWxhyAy.exe

Filesize
2.0MB

MD5
2efa0bfa26c78722807f1f01927ec808

SHA1
b70438224180e62cb632dcdf423fc5569fb882b8

SHA256
c0fb0a01cbf0f13d6327d354cec2ee649afadd5004a97d0cb11a061865476ad8

SHA512
63c23e3f1b9e1621f3e8e8faec9b227fcfe325506afa1ca5860cd38123498b033d2f0b2a7870fcb456fa6e57573cc23a3d6ec5b699b70dcd71d076d926d30cc5

Download Submit
C:\Windows\System\rFOnBBz.exe

Filesize
2.0MB

MD5
a1525ddfcb527d290ba17a896e47937d

SHA1
5bb7ee676ec6726de2126c812bdbbc7be251687a

SHA256
17741730096b1eef3184917c4c266c82631fd92550625c82c6e453f7d5f77379

SHA512
b4036c418225320f64b6d888cf7af0810ee4227615a3c69dc57aca4a569ac93336505bc6011697195d4154e09dc60c146253cebe7729fdaf8cfebcfa3a005896

Download Submit
C:\Windows\System\rOmjCwG.exe

Filesize
2.0MB

MD5
a697a4583d5ca452626eeadf08a02eaa

SHA1
4e25473bf383ed4a8294828a0ef54e38f198e246

SHA256
bcb394b6deb3850557a5d10bf6d7d9d319e3c7b62d6ba9602aef744f1a25cf89

SHA512
1f9d7e4a04389f05dcade8c5c747ace1665c9d04f362385ad8417d980a28a9f2559f2c4395a6775def483b2519158398b02d10a257129d7fe860e39ce22ef19b

Download Submit
C:\Windows\System\rVCGWZq.exe

Filesize
8B

MD5
77d7bf33fc4f12bfdb9e86136d3b03c4

SHA1
97d97c8d5ae00436ac2d2202db990baabc4e4d94

SHA256
a079985e5dcd4e5003f1d0cfa79ba591507ffd065b7459f4b6f1fe6835c1aebc

SHA512
31a189517e8f007e33c776dddb91ad4e752c628e5f64dec1a48a29302de6a9ffe3541221f6c58119e49f66669bc0b1de454057d727c5323655bbae427b0917a2

Download Submit
C:\Windows\System\rwQiqvH.exe

Filesize
2.0MB

MD5
8033a8482860249beaa446dbc5114c13

SHA1
9cf5bb566641eb1a61a775c7e92884d2b9c2c00f

SHA256
9cd508538d073c62e11a528ed901f7f42a0d30338d45119444c7f2c69db71d1c

SHA512
13e0ebba590164109fdc496d2114410756a545ae260f91033cacda4d9d40b9357d872e311f482325e9799a7e0eda97a921b17631982f6067ca1883a99153ce4b

Download Submit
C:\Windows\System\tSzfTlu.exe

Filesize
2.0MB

MD5
d020c29cd14cf2f4e24d8089365aaa22

SHA1
141c4a143cb21552bede279e9778cd3f227aa0e0

SHA256
f029d246760d9064463948a6b70b68ef0d022edbab2eb9c9363bdbb09a0a2b27

SHA512
6a64c41f52535fc913690562fb1de8214014c9868a192f047fa38d63bd4102628d2c22525c9ba53aeca88993cd511130b5610c290d91db17d4b01aad3e368907

Download Submit
C:\Windows\System\vlCsoEn.exe

Filesize
2.0MB

MD5
6d1c01f1d2923f07a71e3dd12e04b78b

SHA1
2399d11ccb4b2a1db90d097bd6d356ae439bd7e9

SHA256
97087d9eab807501fbf6394f52b6ed1d08051a54e072eb05eeb10c70a6cd1a40

SHA512
f5126cd92939c51381a7dd63db9c3ad8ead7fcab78116660d8b4778a02f0f8521c282330188aad4324cffeaa44395ad88f0320db1afffc0430426ebfe7a0920d

Download Submit
C:\Windows\System\vmWUhMF.exe

Filesize
2.0MB

MD5
0a418f926f7adabc5415f9aec49d9d35

SHA1
667c71bc1fa132bca9bba1dadd81e554b9f030d8

SHA256
ebaa3e33cbb7e896fcbf52f4c97b239dd0a6f8d97c100540f21d41eddfa5bdcc

SHA512
f5049995f1f9041065ae2afc36408c4ddd8c1d1453a95622c86bb925cb330914fcd72123d2c15d7b7757b6bbe3be8b0e9437739791dd9dd62612d1764f82d600

Download Submit
C:\Windows\System\wZsCHhS.exe

Filesize
2.0MB

MD5
ba5ff2a4d8f841677f4531742540aac0

SHA1
39eaf5ca91857f415404e71041214dda801c12b4

SHA256
016c905258ac7644e2a257912f60a7a0fce3a126af7de1ed04b4c946f0150e28

SHA512
9f88c950bb0fcad91eb93c770de8f042dcf9f5a267349ac01a0418ed62d15af15c9ebb9ca472064287f907555a77b94f06e9be926de2afbfe2427efacff430ac

Download Submit
C:\Windows\System\xtlXwZS.exe

Filesize
2.0MB

MD5
54eb8f6e147d35518c3b5b23a4391029

SHA1
4bd4856e3190fb8c4ac6d2c279f53bd589d70a3c

SHA256
80d3866500efc8f5d839ec54a7f81ef0d0d2120d1cb9547374bfc8a828738183

SHA512
b3e4dab8a851037b0a70dde3735f526f3a135789820698d244158f68b62d94c4d9b5dd7582522d9a268d2f484a8cf98bf555880f197745e79f5ea8a0537578df

Download Submit
C:\Windows\System\xydIzAH.exe

Filesize
2.0MB

MD5
0fa0e2515373c00c9f9dbf8a84ef90d4

SHA1
2f9a2e04f95a592abd2f870fede2fd76f346ca54

SHA256
70ffd905319bf9694c9afc62550e760c0a0cc732fee76d66875048f47b15d726

SHA512
c718e213f7bfda03af9654e31aa5d20d7eb913d8c5fedc89b1280916c6351374447a362345f1cf090cd1d2486913edb529ab14b0198afe1fc0fd55b97c889a8c

Download Submit
C:\Windows\System\zXbSGkp.exe

Filesize
2.0MB

MD5
eac168487f2b544a6909c23f396b9180

SHA1
6301f6635b3be948fe3e209972971428b2eecc16

SHA256
f87d416826dbf9b37e2a9b90e4610b48e1b4720a46932d74a4df1c80c275609b

SHA512
c1569f5fc4d412506e51efba422bac8e0c57bbba95a9e15636c1a3252f891dbe86417db9f0e4de34de1c4c936ada3aab274327469643515cfe5ba9e6472714d1

Download Submit
memory/448-2900-0x00007FF6C8200000-0x00007FF6C85F2000-memory.dmp

Filesize
3.9MB

Download
memory/448-529-0x00007FF6C8200000-0x00007FF6C85F2000-memory.dmp

Filesize
3.9MB

Download
memory/948-440-0x00007FF735910000-0x00007FF735D02000-memory.dmp

Filesize
3.9MB

Download
memory/948-2863-0x00007FF735910000-0x00007FF735D02000-memory.dmp

Filesize
3.9MB

Download
memory/1348-2860-0x00007FF6C4D00000-0x00007FF6C50F2000-memory.dmp

Filesize
3.9MB

Download
memory/1348-604-0x00007FF6C4D00000-0x00007FF6C50F2000-memory.dmp

Filesize
3.9MB

Download
memory/1960-2945-0x00007FF75B120000-0x00007FF75B512000-memory.dmp

Filesize
3.9MB

Download
memory/1960-625-0x00007FF75B120000-0x00007FF75B512000-memory.dmp

Filesize
3.9MB

Download
memory/2196-3034-0x00007FF78BD30000-0x00007FF78C122000-memory.dmp

Filesize
3.9MB

Download
memory/2196-629-0x00007FF78BD30000-0x00007FF78C122000-memory.dmp

Filesize
3.9MB

Download
memory/2248-17-0x00007FF760A00000-0x00007FF760DF2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-2811-0x00007FF6A5300000-0x00007FF6A56F2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-356-0x00007FF6A5300000-0x00007FF6A56F2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-2873-0x00007FF6E45C0000-0x00007FF6E49B2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-463-0x00007FF6E45C0000-0x00007FF6E49B2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-535-0x00007FF799F30000-0x00007FF79A322000-memory.dmp

Filesize
3.9MB

Download
memory/2420-2941-0x00007FF799F30000-0x00007FF79A322000-memory.dmp

Filesize
3.9MB

Download
memory/2484-499-0x00007FF7C09F0000-0x00007FF7C0DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-2853-0x00007FF7C09F0000-0x00007FF7C0DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-464-0x00007FF60D010000-0x00007FF60D402000-memory.dmp

Filesize
3.9MB

Download
memory/2532-2869-0x00007FF60D010000-0x00007FF60D402000-memory.dmp

Filesize
3.9MB

Download
memory/2648-2914-0x00007FF7A3B20000-0x00007FF7A3F12000-memory.dmp

Filesize
3.9MB

Download
memory/2648-561-0x00007FF7A3B20000-0x00007FF7A3F12000-memory.dmp

Filesize
3.9MB

Download
memory/2692-2910-0x00007FF7A7D40000-0x00007FF7A8132000-memory.dmp

Filesize
3.9MB

Download
memory/2692-922-0x00007FF7A7D40000-0x00007FF7A8132000-memory.dmp

Filesize
3.9MB

Download
memory/2940-3004-0x00007FF6DC390000-0x00007FF6DC782000-memory.dmp

Filesize
3.9MB

Download
memory/2940-484-0x00007FF6DC390000-0x00007FF6DC782000-memory.dmp

Filesize
3.9MB

Download
memory/3376-423-0x00007FF69CD20000-0x00007FF69D112000-memory.dmp

Filesize
3.9MB

Download
memory/3376-2833-0x00007FF69CD20000-0x00007FF69D112000-memory.dmp

Filesize
3.9MB

Download
memory/3388-227-0x00007FF790690000-0x00007FF790A82000-memory.dmp

Filesize
3.9MB

Download
memory/3716-2993-0x00007FF63A4D0000-0x00007FF63A8C2000-memory.dmp

Filesize
3.9MB

Download
memory/3716-570-0x00007FF63A4D0000-0x00007FF63A8C2000-memory.dmp

Filesize
3.9MB

Download
memory/3752-645-0x00007FF6F9F70000-0x00007FF6FA362000-memory.dmp

Filesize
3.9MB

Download
memory/3856-306-0x00007FF63DC90000-0x00007FF63E082000-memory.dmp

Filesize
3.9MB

Download
memory/3984-400-0x00007FF78A760000-0x00007FF78AB52000-memory.dmp

Filesize
3.9MB

Download
memory/4552-2837-0x00007FF6B24D0000-0x00007FF6B28C2000-memory.dmp

Filesize
3.9MB

Download
memory/4552-860-0x00007FF6B24D0000-0x00007FF6B28C2000-memory.dmp

Filesize
3.9MB

Download
memory/4560-1-0x000001C7DF8A0000-0x000001C7DF8B0000-memory.dmp

Filesize
64KB

Download
memory/4560-0-0x00007FF7B3A20000-0x00007FF7B3E12000-memory.dmp

Filesize
3.9MB

Download
memory/4664-512-0x00007FF690800000-0x00007FF690BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4752-2920-0x00007FF769A00000-0x00007FF769DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4752-569-0x00007FF769A00000-0x00007FF769DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4788-32-0x00007FFCB2B63000-0x00007FFCB2B65000-memory.dmp

Filesize
8KB

Download
memory/4788-278-0x000001756B7C0000-0x000001756B7E2000-memory.dmp

Filesize
136KB

Download
memory/4788-74-0x00007FFCB2B60000-0x00007FFCB3621000-memory.dmp

Filesize
10.8MB

Download
memory/4788-183-0x00007FFCB2B60000-0x00007FFCB3621000-memory.dmp

Filesize
10.8MB

Download
memory/4940-2995-0x00007FF671B90000-0x00007FF671F82000-memory.dmp

Filesize
3.9MB

Download
memory/4940-631-0x00007FF671B90000-0x00007FF671F82000-memory.dmp

Filesize
3.9MB

Download