xmrig | 260add1272da35b5caf03a1d3e5922b02f8e49995b05a4c4384f3eaf53784973

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

868bb5aca7ba4a443008ba25a47183f0N.exe
Size

2.0MB
MD5

868bb5aca7ba4a443008ba25a47183f0
SHA1

3a7765e11c2d85a4cce7248f773da237911a5243
SHA256

260add1272da35b5caf03a1d3e5922b02f8e49995b05a4c4384f3eaf53784973
SHA512

84e9e12e77c3420ab704bcd2e1ea472930090628b179f03dc6016c6f8b282b9933d758b62dec5fb4ed0506b3f33cd965b99000ffc64fee88d9bb6d56db6ad767
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZ204oVTUG7kieEHcYT0wA:Lz071uv4BPMkibTIA5JnJ1VZKR5p+2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral2/memory/2452-46-0x00007FF669DD0000-0x00007FF66A1C2000-memory.dmp	xmrig
behavioral2/memory/4992-168-0x00007FF6DFF30000-0x00007FF6E0322000-memory.dmp	xmrig
behavioral2/memory/1548-173-0x00007FF738C50000-0x00007FF739042000-memory.dmp	xmrig
behavioral2/memory/768-172-0x00007FF7D0CF0000-0x00007FF7D10E2000-memory.dmp	xmrig
behavioral2/memory/3220-171-0x00007FF6B1C80000-0x00007FF6B2072000-memory.dmp	xmrig
behavioral2/memory/1084-170-0x00007FF6CEC30000-0x00007FF6CF022000-memory.dmp	xmrig
behavioral2/memory/3116-169-0x00007FF730BD0000-0x00007FF730FC2000-memory.dmp	xmrig
behavioral2/memory/4468-156-0x00007FF71E460000-0x00007FF71E852000-memory.dmp	xmrig
behavioral2/memory/2364-155-0x00007FF684460000-0x00007FF684852000-memory.dmp	xmrig
behavioral2/memory/4800-131-0x00007FF66C640000-0x00007FF66CA32000-memory.dmp	xmrig
behavioral2/memory/3612-128-0x00007FF6074A0000-0x00007FF607892000-memory.dmp	xmrig
behavioral2/memory/3796-123-0x00007FF6E5A00000-0x00007FF6E5DF2000-memory.dmp	xmrig
behavioral2/memory/2112-113-0x00007FF7A9A20000-0x00007FF7A9E12000-memory.dmp	xmrig
behavioral2/memory/2024-18-0x00007FF638FB0000-0x00007FF6393A2000-memory.dmp	xmrig
behavioral2/memory/2448-1644-0x00007FF62B710000-0x00007FF62BB02000-memory.dmp	xmrig
behavioral2/memory/3656-1643-0x00007FF6002A0000-0x00007FF600692000-memory.dmp	xmrig
behavioral2/memory/348-2748-0x00007FF7A9B10000-0x00007FF7A9F02000-memory.dmp	xmrig
behavioral2/memory/4400-3743-0x00007FF7455A0000-0x00007FF745992000-memory.dmp	xmrig
behavioral2/memory/2112-3744-0x00007FF7A9A20000-0x00007FF7A9E12000-memory.dmp	xmrig
behavioral2/memory/2580-3748-0x00007FF774A50000-0x00007FF774E42000-memory.dmp	xmrig
behavioral2/memory/4600-4180-0x00007FF605340000-0x00007FF605732000-memory.dmp	xmrig
behavioral2/memory/2024-4775-0x00007FF638FB0000-0x00007FF6393A2000-memory.dmp	xmrig
behavioral2/memory/3796-5002-0x00007FF6E5A00000-0x00007FF6E5DF2000-memory.dmp	xmrig
behavioral2/memory/2112-5026-0x00007FF7A9A20000-0x00007FF7A9E12000-memory.dmp	xmrig
behavioral2/memory/4468-5068-0x00007FF71E460000-0x00007FF71E852000-memory.dmp	xmrig
behavioral2/memory/2580-5047-0x00007FF774A50000-0x00007FF774E42000-memory.dmp	xmrig
behavioral2/memory/768-5077-0x00007FF7D0CF0000-0x00007FF7D10E2000-memory.dmp	xmrig
behavioral2/memory/1084-5071-0x00007FF6CEC30000-0x00007FF6CF022000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
10	3244	powershell.exe
12	3244	powershell.exe
16	3244	powershell.exe
17	3244	powershell.exe
20	3244	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3244	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2448	tiZEGkJ.exe
2024	xGUZgEe.exe
1448	AyEUylP.exe
4512	kPOcqZX.exe
2452	FOLBclZ.exe
348	DEUHPgP.exe
4956	AIolGbV.exe
4456	ZxQvPSf.exe
4112	yDsZrpl.exe
4992	fxELRjO.exe
4400	kGrjRjk.exe
2112	LaBuDoB.exe
3796	iqgObNf.exe
3612	PCdQpnj.exe
3116	PsbXCSC.exe
4800	vyJmKCb.exe
1084	HodqzUJ.exe
3220	EWCZJzl.exe
2580	JpXhsGM.exe
2364	QYdfdUI.exe
4468	MiZQyYb.exe
768	WBRTipi.exe
4600	fnHNdmc.exe
1548	DhGpZNe.exe
532	TcNQlEn.exe
1396	LBekIBp.exe
5028	RyzXWXU.exe
2796	TyQzxhI.exe
804	WycMCQt.exe
3004	oIqkDfd.exe
4968	JHbZglM.exe
1360	axlSBqw.exe
232	iwjVAeI.exe
1564	Cziosek.exe
2636	HJFhsbH.exe
4412	FktzRVz.exe
2352	nfFTYyK.exe
1880	QRfqBHm.exe
1460	kNqMOOk.exe
5108	HrdeWxg.exe
4336	cmdcLVd.exe
1884	WDEUjPa.exe
3108	XTVumUd.exe
2788	ZqxGBfK.exe
4016	KGYucCw.exe
1264	NijFNoP.exe
3524	edBSKwx.exe
1568	WPIcdFS.exe
3896	SAfUtDC.exe
180	xMEFhHB.exe
2204	iKiFBFu.exe
3060	tOYCEsr.exe
2264	bDAPMsQ.exe
1260	LeOwKgc.exe
2000	gDQeLXA.exe
3228	TfmmMDK.exe
4972	dmdUVZc.exe
1796	CEGHREu.exe
4584	zYhDSLI.exe
4292	mZwNKJa.exe
4136	raDRDbl.exe
3296	tKvtlbe.exe
2332	EJWVJgT.exe
1680	dQujMOq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3656-0-0x00007FF6002A0000-0x00007FF600692000-memory.dmp	upx
behavioral2/files/0x0009000000023414-5.dat	upx
behavioral2/files/0x0007000000023470-8.dat	upx
behavioral2/files/0x000700000002346f-13.dat	upx
behavioral2/files/0x0007000000023471-23.dat	upx
behavioral2/files/0x0007000000023473-35.dat	upx
behavioral2/memory/2452-46-0x00007FF669DD0000-0x00007FF66A1C2000-memory.dmp	upx
behavioral2/files/0x0007000000023475-45.dat	upx
behavioral2/files/0x0007000000023477-88.dat	upx
behavioral2/files/0x000700000002347a-100.dat	upx
behavioral2/files/0x0007000000023482-118.dat	upx
behavioral2/files/0x000800000002346c-127.dat	upx
behavioral2/files/0x0008000000023478-133.dat	upx
behavioral2/files/0x0007000000023483-151.dat	upx
behavioral2/memory/4992-168-0x00007FF6DFF30000-0x00007FF6E0322000-memory.dmp	upx
behavioral2/memory/1548-173-0x00007FF738C50000-0x00007FF739042000-memory.dmp	upx
behavioral2/memory/768-172-0x00007FF7D0CF0000-0x00007FF7D10E2000-memory.dmp	upx
behavioral2/memory/3220-171-0x00007FF6B1C80000-0x00007FF6B2072000-memory.dmp	upx
behavioral2/memory/1084-170-0x00007FF6CEC30000-0x00007FF6CF022000-memory.dmp	upx
behavioral2/memory/3116-169-0x00007FF730BD0000-0x00007FF730FC2000-memory.dmp	upx
behavioral2/files/0x0007000000023487-166.dat	upx
behavioral2/files/0x0007000000023486-164.dat	upx
behavioral2/files/0x0007000000023485-162.dat	upx
behavioral2/memory/4600-161-0x00007FF605340000-0x00007FF605732000-memory.dmp	upx
behavioral2/files/0x0007000000023484-157.dat	upx
behavioral2/memory/4468-156-0x00007FF71E460000-0x00007FF71E852000-memory.dmp	upx
behavioral2/memory/2364-155-0x00007FF684460000-0x00007FF684852000-memory.dmp	upx
behavioral2/memory/2580-147-0x00007FF774A50000-0x00007FF774E42000-memory.dmp	upx
behavioral2/files/0x000700000002347f-142.dat	upx
behavioral2/files/0x0007000000023481-137.dat	upx
behavioral2/files/0x0007000000023480-135.dat	upx
behavioral2/memory/4800-131-0x00007FF66C640000-0x00007FF66CA32000-memory.dmp	upx
behavioral2/memory/3612-128-0x00007FF6074A0000-0x00007FF607892000-memory.dmp	upx
behavioral2/files/0x000700000002347e-124.dat	upx
behavioral2/memory/3796-123-0x00007FF6E5A00000-0x00007FF6E5DF2000-memory.dmp	upx
behavioral2/files/0x000700000002347d-121.dat	upx
behavioral2/memory/2112-113-0x00007FF7A9A20000-0x00007FF7A9E12000-memory.dmp	upx
behavioral2/files/0x000700000002347c-108.dat	upx
behavioral2/files/0x0008000000023479-97.dat	upx
behavioral2/memory/4400-96-0x00007FF7455A0000-0x00007FF745992000-memory.dmp	upx
behavioral2/files/0x000700000002347b-90.dat	upx
behavioral2/memory/4112-87-0x00007FF68DB90000-0x00007FF68DF82000-memory.dmp	upx
behavioral2/files/0x0007000000023476-78.dat	upx
behavioral2/files/0x0007000000023474-61.dat	upx
behavioral2/memory/4456-60-0x00007FF7E41A0000-0x00007FF7E4592000-memory.dmp	upx
behavioral2/memory/4956-49-0x00007FF77AEE0000-0x00007FF77B2D2000-memory.dmp	upx
behavioral2/memory/348-41-0x00007FF7A9B10000-0x00007FF7A9F02000-memory.dmp	upx
behavioral2/files/0x0007000000023488-179.dat	upx
behavioral2/files/0x000700000002348b-187.dat	upx
behavioral2/files/0x000700000002348d-197.dat	upx
behavioral2/files/0x000700000002348c-193.dat	upx
behavioral2/files/0x0007000000023489-192.dat	upx
behavioral2/memory/4512-33-0x00007FF7D91D0000-0x00007FF7D95C2000-memory.dmp	upx
behavioral2/files/0x0007000000023472-27.dat	upx
behavioral2/memory/1448-25-0x00007FF78EBF0000-0x00007FF78EFE2000-memory.dmp	upx
behavioral2/memory/2024-18-0x00007FF638FB0000-0x00007FF6393A2000-memory.dmp	upx
behavioral2/memory/2448-9-0x00007FF62B710000-0x00007FF62BB02000-memory.dmp	upx
behavioral2/memory/2448-1644-0x00007FF62B710000-0x00007FF62BB02000-memory.dmp	upx
behavioral2/memory/3656-1643-0x00007FF6002A0000-0x00007FF600692000-memory.dmp	upx
behavioral2/memory/348-2748-0x00007FF7A9B10000-0x00007FF7A9F02000-memory.dmp	upx
behavioral2/memory/4400-3743-0x00007FF7455A0000-0x00007FF745992000-memory.dmp	upx
behavioral2/memory/2112-3744-0x00007FF7A9A20000-0x00007FF7A9E12000-memory.dmp	upx
behavioral2/memory/2580-3748-0x00007FF774A50000-0x00007FF774E42000-memory.dmp	upx
behavioral2/memory/4600-4180-0x00007FF605340000-0x00007FF605732000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LJndSLf.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\hiMeapM.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\Pnoljmq.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\klFlbtP.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\GgykLXJ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\tleAkEZ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\vnxMeAL.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\aAEUzbI.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\MomiXiC.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\BucoyMs.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\famQHKy.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ogLYqAn.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\LwnbFbf.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\JmoSCTl.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\aqjTjVn.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\PiLgfKj.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ZuNjCqT.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\vdsZYJi.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\sjYgnSQ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\xUJZjJz.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\fcoZOBH.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\gyJyjlu.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\YZJyFll.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\llFkywQ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\XwCKyxV.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\AyCpoIF.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\xbwvcEZ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\eQYfooE.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ENLiWjk.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\sEthpHR.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\MCeiYqd.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\okJapfi.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\BWtagOs.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\CxJLtdz.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\CRHksIU.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\SPvaOTt.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\VszmORy.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\IYNLbmH.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\iMSinml.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\psyMqrR.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\erNyXxl.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\mPKWvAa.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ighcdMz.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\twsExAt.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\qfoAhTi.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\DFelEUd.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\nAZYegD.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\kQOkIdO.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\rzttSxP.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\DZkfSTc.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\iaANOWV.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\bodVBjr.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\EMdYGOY.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\lJitgmy.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ZhoqxXb.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\VeIYxTc.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\YPrUOJF.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\tytkPfZ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\xFgJgWk.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\LBIUOqN.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\IwSJrSn.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\TPTgIDT.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ygolFrG.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\FvpYObM.exe	868bb5aca7ba4a443008ba25a47183f0N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3656	868bb5aca7ba4a443008ba25a47183f0N.exe
Token: SeLockMemoryPrivilege	3656	868bb5aca7ba4a443008ba25a47183f0N.exe
Token: SeDebugPrivilege	3244	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3244	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	85
PID 3656 wrote to memory of 3244	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	85
PID 3656 wrote to memory of 2448	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	86
PID 3656 wrote to memory of 2448	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	86
PID 3656 wrote to memory of 2024	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	87
PID 3656 wrote to memory of 2024	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	87
PID 3656 wrote to memory of 1448	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	88
PID 3656 wrote to memory of 1448	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	88
PID 3656 wrote to memory of 4512	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	89
PID 3656 wrote to memory of 4512	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	89
PID 3656 wrote to memory of 2452	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	90
PID 3656 wrote to memory of 2452	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	90
PID 3656 wrote to memory of 348	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	91
PID 3656 wrote to memory of 348	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	91
PID 3656 wrote to memory of 4956	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	92
PID 3656 wrote to memory of 4956	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	92
PID 3656 wrote to memory of 4456	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	93
PID 3656 wrote to memory of 4456	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	93
PID 3656 wrote to memory of 4112	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	94
PID 3656 wrote to memory of 4112	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	94
PID 3656 wrote to memory of 4992	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	95
PID 3656 wrote to memory of 4992	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	95
PID 3656 wrote to memory of 4400	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	96
PID 3656 wrote to memory of 4400	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	96
PID 3656 wrote to memory of 2112	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	97
PID 3656 wrote to memory of 2112	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	97
PID 3656 wrote to memory of 3796	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	98
PID 3656 wrote to memory of 3796	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	98
PID 3656 wrote to memory of 3612	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	99
PID 3656 wrote to memory of 3612	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	99
PID 3656 wrote to memory of 3116	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	100
PID 3656 wrote to memory of 3116	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	100
PID 3656 wrote to memory of 4800	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	101
PID 3656 wrote to memory of 4800	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	101
PID 3656 wrote to memory of 1084	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	102
PID 3656 wrote to memory of 1084	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	102
PID 3656 wrote to memory of 4600	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	103
PID 3656 wrote to memory of 4600	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	103
PID 3656 wrote to memory of 3220	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	104
PID 3656 wrote to memory of 3220	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	104
PID 3656 wrote to memory of 2580	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	105
PID 3656 wrote to memory of 2580	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	105
PID 3656 wrote to memory of 2364	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	106
PID 3656 wrote to memory of 2364	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	106
PID 3656 wrote to memory of 4468	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	107
PID 3656 wrote to memory of 4468	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	107
PID 3656 wrote to memory of 768	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	108
PID 3656 wrote to memory of 768	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	108
PID 3656 wrote to memory of 1548	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	109
PID 3656 wrote to memory of 1548	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	109
PID 3656 wrote to memory of 532	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	110
PID 3656 wrote to memory of 532	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	110
PID 3656 wrote to memory of 1396	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	111
PID 3656 wrote to memory of 1396	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	111
PID 3656 wrote to memory of 5028	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	112
PID 3656 wrote to memory of 5028	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	112
PID 3656 wrote to memory of 2796	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	113
PID 3656 wrote to memory of 2796	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	113
PID 3656 wrote to memory of 804	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	115
PID 3656 wrote to memory of 804	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	115
PID 3656 wrote to memory of 3004	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	116
PID 3656 wrote to memory of 3004	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	116
PID 3656 wrote to memory of 4968	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	117
PID 3656 wrote to memory of 4968	3656	868bb5aca7ba4a443008ba25a47183f0N.exe	117

C:\Users\Admin\AppData\Local\Temp\868bb5aca7ba4a443008ba25a47183f0N.exe
"C:\Users\Admin\AppData\Local\Temp\868bb5aca7ba4a443008ba25a47183f0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\System\tiZEGkJ.exe
  C:\Windows\System\tiZEGkJ.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\xGUZgEe.exe
  C:\Windows\System\xGUZgEe.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\AyEUylP.exe
  C:\Windows\System\AyEUylP.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\kPOcqZX.exe
  C:\Windows\System\kPOcqZX.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\FOLBclZ.exe
  C:\Windows\System\FOLBclZ.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\DEUHPgP.exe
  C:\Windows\System\DEUHPgP.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\AIolGbV.exe
  C:\Windows\System\AIolGbV.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\ZxQvPSf.exe
  C:\Windows\System\ZxQvPSf.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\yDsZrpl.exe
  C:\Windows\System\yDsZrpl.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\fxELRjO.exe
  C:\Windows\System\fxELRjO.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\kGrjRjk.exe
  C:\Windows\System\kGrjRjk.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\LaBuDoB.exe
  C:\Windows\System\LaBuDoB.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\iqgObNf.exe
  C:\Windows\System\iqgObNf.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\PCdQpnj.exe
  C:\Windows\System\PCdQpnj.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\PsbXCSC.exe
  C:\Windows\System\PsbXCSC.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\vyJmKCb.exe
  C:\Windows\System\vyJmKCb.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\HodqzUJ.exe
  C:\Windows\System\HodqzUJ.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\fnHNdmc.exe
  C:\Windows\System\fnHNdmc.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\EWCZJzl.exe
  C:\Windows\System\EWCZJzl.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\JpXhsGM.exe
  C:\Windows\System\JpXhsGM.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\QYdfdUI.exe
  C:\Windows\System\QYdfdUI.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\MiZQyYb.exe
  C:\Windows\System\MiZQyYb.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\WBRTipi.exe
  C:\Windows\System\WBRTipi.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\DhGpZNe.exe
  C:\Windows\System\DhGpZNe.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\TcNQlEn.exe
  C:\Windows\System\TcNQlEn.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\LBekIBp.exe
  C:\Windows\System\LBekIBp.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\RyzXWXU.exe
  C:\Windows\System\RyzXWXU.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\TyQzxhI.exe
  C:\Windows\System\TyQzxhI.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\WycMCQt.exe
  C:\Windows\System\WycMCQt.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\oIqkDfd.exe
  C:\Windows\System\oIqkDfd.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\JHbZglM.exe
  C:\Windows\System\JHbZglM.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\axlSBqw.exe
  C:\Windows\System\axlSBqw.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\iwjVAeI.exe
  C:\Windows\System\iwjVAeI.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\Cziosek.exe
  C:\Windows\System\Cziosek.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\HJFhsbH.exe
  C:\Windows\System\HJFhsbH.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\FktzRVz.exe
  C:\Windows\System\FktzRVz.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\nfFTYyK.exe
  C:\Windows\System\nfFTYyK.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\QRfqBHm.exe
  C:\Windows\System\QRfqBHm.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\kNqMOOk.exe
  C:\Windows\System\kNqMOOk.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\HrdeWxg.exe
  C:\Windows\System\HrdeWxg.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\cmdcLVd.exe
  C:\Windows\System\cmdcLVd.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\WDEUjPa.exe
  C:\Windows\System\WDEUjPa.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\XTVumUd.exe
  C:\Windows\System\XTVumUd.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\ZqxGBfK.exe
  C:\Windows\System\ZqxGBfK.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\KGYucCw.exe
  C:\Windows\System\KGYucCw.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\NijFNoP.exe
  C:\Windows\System\NijFNoP.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\edBSKwx.exe
  C:\Windows\System\edBSKwx.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\WPIcdFS.exe
  C:\Windows\System\WPIcdFS.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\SAfUtDC.exe
  C:\Windows\System\SAfUtDC.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\xMEFhHB.exe
  C:\Windows\System\xMEFhHB.exe
  2⤵
  - Executes dropped EXE
  PID:180
- C:\Windows\System\iKiFBFu.exe
  C:\Windows\System\iKiFBFu.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\tOYCEsr.exe
  C:\Windows\System\tOYCEsr.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\bDAPMsQ.exe
  C:\Windows\System\bDAPMsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\LeOwKgc.exe
  C:\Windows\System\LeOwKgc.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\gDQeLXA.exe
  C:\Windows\System\gDQeLXA.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\TfmmMDK.exe
  C:\Windows\System\TfmmMDK.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\dmdUVZc.exe
  C:\Windows\System\dmdUVZc.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\CEGHREu.exe
  C:\Windows\System\CEGHREu.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\zYhDSLI.exe
  C:\Windows\System\zYhDSLI.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\mZwNKJa.exe
  C:\Windows\System\mZwNKJa.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\raDRDbl.exe
  C:\Windows\System\raDRDbl.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\EJWVJgT.exe
  C:\Windows\System\EJWVJgT.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\tKvtlbe.exe
  C:\Windows\System\tKvtlbe.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\dQujMOq.exe
  C:\Windows\System\dQujMOq.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\brPxJTk.exe
  C:\Windows\System\brPxJTk.exe
  2⤵
  PID:4216
- C:\Windows\System\ueZaqHR.exe
  C:\Windows\System\ueZaqHR.exe
  2⤵
  PID:2356
- C:\Windows\System\yxfClrL.exe
  C:\Windows\System\yxfClrL.exe
  2⤵
  PID:2432
- C:\Windows\System\rDnBLok.exe
  C:\Windows\System\rDnBLok.exe
  2⤵
  PID:3960
- C:\Windows\System\gUiLIkD.exe
  C:\Windows\System\gUiLIkD.exe
  2⤵
  PID:60
- C:\Windows\System\HkGvLsq.exe
  C:\Windows\System\HkGvLsq.exe
  2⤵
  PID:2296
- C:\Windows\System\Eqlmbqs.exe
  C:\Windows\System\Eqlmbqs.exe
  2⤵
  PID:2672
- C:\Windows\System\LEaLNhD.exe
  C:\Windows\System\LEaLNhD.exe
  2⤵
  PID:1808
- C:\Windows\System\DASuDfE.exe
  C:\Windows\System\DASuDfE.exe
  2⤵
  PID:2924
- C:\Windows\System\eDqeYnL.exe
  C:\Windows\System\eDqeYnL.exe
  2⤵
  PID:4428
- C:\Windows\System\ItrPEKC.exe
  C:\Windows\System\ItrPEKC.exe
  2⤵
  PID:3600
- C:\Windows\System\cvodprr.exe
  C:\Windows\System\cvodprr.exe
  2⤵
  PID:4340
- C:\Windows\System\yDCVPlN.exe
  C:\Windows\System\yDCVPlN.exe
  2⤵
  PID:876
- C:\Windows\System\geGDSdR.exe
  C:\Windows\System\geGDSdR.exe
  2⤵
  PID:1072
- C:\Windows\System\QJpWXOQ.exe
  C:\Windows\System\QJpWXOQ.exe
  2⤵
  PID:4036
- C:\Windows\System\Jzyiuha.exe
  C:\Windows\System\Jzyiuha.exe
  2⤵
  PID:1536
- C:\Windows\System\XADSteS.exe
  C:\Windows\System\XADSteS.exe
  2⤵
  PID:464
- C:\Windows\System\IZjrqxH.exe
  C:\Windows\System\IZjrqxH.exe
  2⤵
  PID:4504
- C:\Windows\System\pLBOAns.exe
  C:\Windows\System\pLBOAns.exe
  2⤵
  PID:1904
- C:\Windows\System\sWtwTiK.exe
  C:\Windows\System\sWtwTiK.exe
  2⤵
  PID:5060
- C:\Windows\System\OQGYmtB.exe
  C:\Windows\System\OQGYmtB.exe
  2⤵
  PID:2080
- C:\Windows\System\SdPMDIQ.exe
  C:\Windows\System\SdPMDIQ.exe
  2⤵
  PID:5168
- C:\Windows\System\hjjNIAt.exe
  C:\Windows\System\hjjNIAt.exe
  2⤵
  PID:5188
- C:\Windows\System\CLLlabm.exe
  C:\Windows\System\CLLlabm.exe
  2⤵
  PID:5256
- C:\Windows\System\aBravGG.exe
  C:\Windows\System\aBravGG.exe
  2⤵
  PID:5300
- C:\Windows\System\vjjYzRv.exe
  C:\Windows\System\vjjYzRv.exe
  2⤵
  PID:5364
- C:\Windows\System\qBRcdXs.exe
  C:\Windows\System\qBRcdXs.exe
  2⤵
  PID:5396
- C:\Windows\System\TPJfoQO.exe
  C:\Windows\System\TPJfoQO.exe
  2⤵
  PID:5416
- C:\Windows\System\ZWJfxDg.exe
  C:\Windows\System\ZWJfxDg.exe
  2⤵
  PID:5436
- C:\Windows\System\gnIAWFq.exe
  C:\Windows\System\gnIAWFq.exe
  2⤵
  PID:5460
- C:\Windows\System\jmBdWbp.exe
  C:\Windows\System\jmBdWbp.exe
  2⤵
  PID:5476
- C:\Windows\System\DcoVQwX.exe
  C:\Windows\System\DcoVQwX.exe
  2⤵
  PID:5496
- C:\Windows\System\lsbzdKx.exe
  C:\Windows\System\lsbzdKx.exe
  2⤵
  PID:5524
- C:\Windows\System\dyKcBvS.exe
  C:\Windows\System\dyKcBvS.exe
  2⤵
  PID:5540
- C:\Windows\System\UQvaDtz.exe
  C:\Windows\System\UQvaDtz.exe
  2⤵
  PID:5584
- C:\Windows\System\yXjWkpH.exe
  C:\Windows\System\yXjWkpH.exe
  2⤵
  PID:5616
- C:\Windows\System\PrxpZca.exe
  C:\Windows\System\PrxpZca.exe
  2⤵
  PID:5760
- C:\Windows\System\KRzDETf.exe
  C:\Windows\System\KRzDETf.exe
  2⤵
  PID:5812
- C:\Windows\System\YlmVvkg.exe
  C:\Windows\System\YlmVvkg.exe
  2⤵
  PID:5832
- C:\Windows\System\QuSkoVb.exe
  C:\Windows\System\QuSkoVb.exe
  2⤵
  PID:5868
- C:\Windows\System\kMeFcxq.exe
  C:\Windows\System\kMeFcxq.exe
  2⤵
  PID:5888
- C:\Windows\System\BPjYIqM.exe
  C:\Windows\System\BPjYIqM.exe
  2⤵
  PID:5932
- C:\Windows\System\TNNrPjp.exe
  C:\Windows\System\TNNrPjp.exe
  2⤵
  PID:5948
- C:\Windows\System\CRBdTtt.exe
  C:\Windows\System\CRBdTtt.exe
  2⤵
  PID:5980
- C:\Windows\System\AjmwXrG.exe
  C:\Windows\System\AjmwXrG.exe
  2⤵
  PID:5996
- C:\Windows\System\OfUZDgK.exe
  C:\Windows\System\OfUZDgK.exe
  2⤵
  PID:6048
- C:\Windows\System\AdOwOYb.exe
  C:\Windows\System\AdOwOYb.exe
  2⤵
  PID:6068
- C:\Windows\System\YmSkfgD.exe
  C:\Windows\System\YmSkfgD.exe
  2⤵
  PID:6092
- C:\Windows\System\bbbOfuO.exe
  C:\Windows\System\bbbOfuO.exe
  2⤵
  PID:112
- C:\Windows\System\lHeKmPg.exe
  C:\Windows\System\lHeKmPg.exe
  2⤵
  PID:1228
- C:\Windows\System\pLUIMNJ.exe
  C:\Windows\System\pLUIMNJ.exe
  2⤵
  PID:2992
- C:\Windows\System\NZkrqJY.exe
  C:\Windows\System\NZkrqJY.exe
  2⤵
  PID:4060
- C:\Windows\System\VdyFbpP.exe
  C:\Windows\System\VdyFbpP.exe
  2⤵
  PID:5236
- C:\Windows\System\TAKNFIE.exe
  C:\Windows\System\TAKNFIE.exe
  2⤵
  PID:5196
- C:\Windows\System\XShcugk.exe
  C:\Windows\System\XShcugk.exe
  2⤵
  PID:5240
- C:\Windows\System\QVCEBHb.exe
  C:\Windows\System\QVCEBHb.exe
  2⤵
  PID:5212
- C:\Windows\System\IMIejJk.exe
  C:\Windows\System\IMIejJk.exe
  2⤵
  PID:5320
- C:\Windows\System\GQVkFkP.exe
  C:\Windows\System\GQVkFkP.exe
  2⤵
  PID:5336
- C:\Windows\System\FxNuXfd.exe
  C:\Windows\System\FxNuXfd.exe
  2⤵
  PID:5344
- C:\Windows\System\yvllWHR.exe
  C:\Windows\System\yvllWHR.exe
  2⤵
  PID:5408
- C:\Windows\System\BynXVkc.exe
  C:\Windows\System\BynXVkc.exe
  2⤵
  PID:5444
- C:\Windows\System\IOIRcwS.exe
  C:\Windows\System\IOIRcwS.exe
  2⤵
  PID:5484
- C:\Windows\System\VxjfVGK.exe
  C:\Windows\System\VxjfVGK.exe
  2⤵
  PID:5552
- C:\Windows\System\WNZiBfT.exe
  C:\Windows\System\WNZiBfT.exe
  2⤵
  PID:5712
- C:\Windows\System\EPlpoHg.exe
  C:\Windows\System\EPlpoHg.exe
  2⤵
  PID:5800
- C:\Windows\System\Iudirtf.exe
  C:\Windows\System\Iudirtf.exe
  2⤵
  PID:5856
- C:\Windows\System\alYdvnw.exe
  C:\Windows\System\alYdvnw.exe
  2⤵
  PID:5880
- C:\Windows\System\xpTBUkk.exe
  C:\Windows\System\xpTBUkk.exe
  2⤵
  PID:5976
- C:\Windows\System\IfoSDlM.exe
  C:\Windows\System\IfoSDlM.exe
  2⤵
  PID:5988
- C:\Windows\System\GAEOxdK.exe
  C:\Windows\System\GAEOxdK.exe
  2⤵
  PID:6044
- C:\Windows\System\nHKzeaN.exe
  C:\Windows\System\nHKzeaN.exe
  2⤵
  PID:4664
- C:\Windows\System\ysCnvOS.exe
  C:\Windows\System\ysCnvOS.exe
  2⤵
  PID:5264
- C:\Windows\System\OHnfNFS.exe
  C:\Windows\System\OHnfNFS.exe
  2⤵
  PID:5288
- C:\Windows\System\liWWvJn.exe
  C:\Windows\System\liWWvJn.exe
  2⤵
  PID:5488
- C:\Windows\System\ddopvAQ.exe
  C:\Windows\System\ddopvAQ.exe
  2⤵
  PID:5428
- C:\Windows\System\sbQgsbE.exe
  C:\Windows\System\sbQgsbE.exe
  2⤵
  PID:5728
- C:\Windows\System\GojSifD.exe
  C:\Windows\System\GojSifD.exe
  2⤵
  PID:5796
- C:\Windows\System\aknOUbS.exe
  C:\Windows\System\aknOUbS.exe
  2⤵
  PID:3264
- C:\Windows\System\cBXqxGN.exe
  C:\Windows\System\cBXqxGN.exe
  2⤵
  PID:6036
- C:\Windows\System\PhMnaqZ.exe
  C:\Windows\System\PhMnaqZ.exe
  2⤵
  PID:5232
- C:\Windows\System\CCNXpdx.exe
  C:\Windows\System\CCNXpdx.exe
  2⤵
  PID:1100
- C:\Windows\System\uFFfqCX.exe
  C:\Windows\System\uFFfqCX.exe
  2⤵
  PID:5424
- C:\Windows\System\XcTPHgX.exe
  C:\Windows\System\XcTPHgX.exe
  2⤵
  PID:5852
- C:\Windows\System\atELLHe.exe
  C:\Windows\System\atELLHe.exe
  2⤵
  PID:5924
- C:\Windows\System\BhwafQG.exe
  C:\Windows\System\BhwafQG.exe
  2⤵
  PID:5184
- C:\Windows\System\zrdTpUr.exe
  C:\Windows\System\zrdTpUr.exe
  2⤵
  PID:5516
- C:\Windows\System\fggWYUa.exe
  C:\Windows\System\fggWYUa.exe
  2⤵
  PID:5676
- C:\Windows\System\pmCmOAz.exe
  C:\Windows\System\pmCmOAz.exe
  2⤵
  PID:5548
- C:\Windows\System\ZAqYRFD.exe
  C:\Windows\System\ZAqYRFD.exe
  2⤵
  PID:6164
- C:\Windows\System\UKPitke.exe
  C:\Windows\System\UKPitke.exe
  2⤵
  PID:6184
- C:\Windows\System\QxbYgSI.exe
  C:\Windows\System\QxbYgSI.exe
  2⤵
  PID:6208
- C:\Windows\System\WiRrVIy.exe
  C:\Windows\System\WiRrVIy.exe
  2⤵
  PID:6236
- C:\Windows\System\SGQwudH.exe
  C:\Windows\System\SGQwudH.exe
  2⤵
  PID:6256
- C:\Windows\System\AhCQlzf.exe
  C:\Windows\System\AhCQlzf.exe
  2⤵
  PID:6304
- C:\Windows\System\REcYoqg.exe
  C:\Windows\System\REcYoqg.exe
  2⤵
  PID:6324
- C:\Windows\System\VccqqMC.exe
  C:\Windows\System\VccqqMC.exe
  2⤵
  PID:6352
- C:\Windows\System\cbXdviJ.exe
  C:\Windows\System\cbXdviJ.exe
  2⤵
  PID:6380
- C:\Windows\System\KvNLmKA.exe
  C:\Windows\System\KvNLmKA.exe
  2⤵
  PID:6416
- C:\Windows\System\PovQVLE.exe
  C:\Windows\System\PovQVLE.exe
  2⤵
  PID:6440
- C:\Windows\System\StKEMNm.exe
  C:\Windows\System\StKEMNm.exe
  2⤵
  PID:6460
- C:\Windows\System\vYzxeQR.exe
  C:\Windows\System\vYzxeQR.exe
  2⤵
  PID:6480
- C:\Windows\System\HYokcNb.exe
  C:\Windows\System\HYokcNb.exe
  2⤵
  PID:6544
- C:\Windows\System\qbjimyT.exe
  C:\Windows\System\qbjimyT.exe
  2⤵
  PID:6576
- C:\Windows\System\uyiUhoD.exe
  C:\Windows\System\uyiUhoD.exe
  2⤵
  PID:6600
- C:\Windows\System\XtcSmxB.exe
  C:\Windows\System\XtcSmxB.exe
  2⤵
  PID:6632
- C:\Windows\System\CrMtEUT.exe
  C:\Windows\System\CrMtEUT.exe
  2⤵
  PID:6652
- C:\Windows\System\dngWkkJ.exe
  C:\Windows\System\dngWkkJ.exe
  2⤵
  PID:6672
- C:\Windows\System\iSJUznb.exe
  C:\Windows\System\iSJUznb.exe
  2⤵
  PID:6692
- C:\Windows\System\TkKDCmQ.exe
  C:\Windows\System\TkKDCmQ.exe
  2⤵
  PID:6720
- C:\Windows\System\LfFXGhM.exe
  C:\Windows\System\LfFXGhM.exe
  2⤵
  PID:6744
- C:\Windows\System\uIWBOYK.exe
  C:\Windows\System\uIWBOYK.exe
  2⤵
  PID:6760
- C:\Windows\System\niiyVcA.exe
  C:\Windows\System\niiyVcA.exe
  2⤵
  PID:6784
- C:\Windows\System\HoDYxls.exe
  C:\Windows\System\HoDYxls.exe
  2⤵
  PID:6848
- C:\Windows\System\xqHhBqH.exe
  C:\Windows\System\xqHhBqH.exe
  2⤵
  PID:6864
- C:\Windows\System\hYJkOoo.exe
  C:\Windows\System\hYJkOoo.exe
  2⤵
  PID:6896
- C:\Windows\System\ZUMnBCk.exe
  C:\Windows\System\ZUMnBCk.exe
  2⤵
  PID:6916
- C:\Windows\System\lQacKsz.exe
  C:\Windows\System\lQacKsz.exe
  2⤵
  PID:6964
- C:\Windows\System\OKyGaEO.exe
  C:\Windows\System\OKyGaEO.exe
  2⤵
  PID:6996
- C:\Windows\System\AkjZmPy.exe
  C:\Windows\System\AkjZmPy.exe
  2⤵
  PID:7020
- C:\Windows\System\mdoUhpj.exe
  C:\Windows\System\mdoUhpj.exe
  2⤵
  PID:7040
- C:\Windows\System\OYvcymD.exe
  C:\Windows\System\OYvcymD.exe
  2⤵
  PID:7060
- C:\Windows\System\sNmTFar.exe
  C:\Windows\System\sNmTFar.exe
  2⤵
  PID:7120
- C:\Windows\System\XsLyrFX.exe
  C:\Windows\System\XsLyrFX.exe
  2⤵
  PID:6216
- C:\Windows\System\NsakTxF.exe
  C:\Windows\System\NsakTxF.exe
  2⤵
  PID:6180
- C:\Windows\System\QPZrPHP.exe
  C:\Windows\System\QPZrPHP.exe
  2⤵
  PID:6252
- C:\Windows\System\YRGVxQL.exe
  C:\Windows\System\YRGVxQL.exe
  2⤵
  PID:6344
- C:\Windows\System\UGUYeFE.exe
  C:\Windows\System\UGUYeFE.exe
  2⤵
  PID:6376
- C:\Windows\System\pLLoIPp.exe
  C:\Windows\System\pLLoIPp.exe
  2⤵
  PID:6424
- C:\Windows\System\MVbdNsj.exe
  C:\Windows\System\MVbdNsj.exe
  2⤵
  PID:6496
- C:\Windows\System\jKqzrFl.exe
  C:\Windows\System\jKqzrFl.exe
  2⤵
  PID:6468
- C:\Windows\System\HZTicaI.exe
  C:\Windows\System\HZTicaI.exe
  2⤵
  PID:6564
- C:\Windows\System\najaXQq.exe
  C:\Windows\System\najaXQq.exe
  2⤵
  PID:6596
- C:\Windows\System\xyLvmhR.exe
  C:\Windows\System\xyLvmhR.exe
  2⤵
  PID:6708
- C:\Windows\System\FByhHvd.exe
  C:\Windows\System\FByhHvd.exe
  2⤵
  PID:6736
- C:\Windows\System\tLmbBuZ.exe
  C:\Windows\System\tLmbBuZ.exe
  2⤵
  PID:6768
- C:\Windows\System\nxheHip.exe
  C:\Windows\System\nxheHip.exe
  2⤵
  PID:6812
- C:\Windows\System\lphQfMW.exe
  C:\Windows\System\lphQfMW.exe
  2⤵
  PID:6912
- C:\Windows\System\utlgsCg.exe
  C:\Windows\System\utlgsCg.exe
  2⤵
  PID:6992
- C:\Windows\System\fFAxhNm.exe
  C:\Windows\System\fFAxhNm.exe
  2⤵
  PID:7096
- C:\Windows\System\EKIukIy.exe
  C:\Windows\System\EKIukIy.exe
  2⤵
  PID:7164
- C:\Windows\System\QGOwwku.exe
  C:\Windows\System\QGOwwku.exe
  2⤵
  PID:6508
- C:\Windows\System\uVHdEyg.exe
  C:\Windows\System\uVHdEyg.exe
  2⤵
  PID:6700
- C:\Windows\System\GXmxhmn.exe
  C:\Windows\System\GXmxhmn.exe
  2⤵
  PID:6856
- C:\Windows\System\jPFCWaY.exe
  C:\Windows\System\jPFCWaY.exe
  2⤵
  PID:7140
- C:\Windows\System\gHvKutu.exe
  C:\Windows\System\gHvKutu.exe
  2⤵
  PID:7136
- C:\Windows\System\WYNQheC.exe
  C:\Windows\System\WYNQheC.exe
  2⤵
  PID:5376
- C:\Windows\System\CtCrRVT.exe
  C:\Windows\System\CtCrRVT.exe
  2⤵
  PID:6332
- C:\Windows\System\DaSxwVh.exe
  C:\Windows\System\DaSxwVh.exe
  2⤵
  PID:6716
- C:\Windows\System\WqZyvrE.exe
  C:\Windows\System\WqZyvrE.exe
  2⤵
  PID:6840
- C:\Windows\System\PsbGoxN.exe
  C:\Windows\System\PsbGoxN.exe
  2⤵
  PID:6688
- C:\Windows\System\UsSgwsF.exe
  C:\Windows\System\UsSgwsF.exe
  2⤵
  PID:7116
- C:\Windows\System\iOnBVsj.exe
  C:\Windows\System\iOnBVsj.exe
  2⤵
  PID:7180
- C:\Windows\System\mSpJtIP.exe
  C:\Windows\System\mSpJtIP.exe
  2⤵
  PID:7212
- C:\Windows\System\yFdtuao.exe
  C:\Windows\System\yFdtuao.exe
  2⤵
  PID:7240
- C:\Windows\System\zdKUdvs.exe
  C:\Windows\System\zdKUdvs.exe
  2⤵
  PID:7280
- C:\Windows\System\lRuGCVU.exe
  C:\Windows\System\lRuGCVU.exe
  2⤵
  PID:7300
- C:\Windows\System\ADuTvRq.exe
  C:\Windows\System\ADuTvRq.exe
  2⤵
  PID:7324
- C:\Windows\System\XmgYqTh.exe
  C:\Windows\System\XmgYqTh.exe
  2⤵
  PID:7344
- C:\Windows\System\ZRGTMGR.exe
  C:\Windows\System\ZRGTMGR.exe
  2⤵
  PID:7372
- C:\Windows\System\AguQXvu.exe
  C:\Windows\System\AguQXvu.exe
  2⤵
  PID:7400
- C:\Windows\System\WwbjiXD.exe
  C:\Windows\System\WwbjiXD.exe
  2⤵
  PID:7432
- C:\Windows\System\PoRfaEu.exe
  C:\Windows\System\PoRfaEu.exe
  2⤵
  PID:7504
- C:\Windows\System\GxNIePU.exe
  C:\Windows\System\GxNIePU.exe
  2⤵
  PID:7556
- C:\Windows\System\JRciKKb.exe
  C:\Windows\System\JRciKKb.exe
  2⤵
  PID:7596
- C:\Windows\System\thnPubF.exe
  C:\Windows\System\thnPubF.exe
  2⤵
  PID:7612
- C:\Windows\System\fxMhmfU.exe
  C:\Windows\System\fxMhmfU.exe
  2⤵
  PID:7628
- C:\Windows\System\QAsGmsD.exe
  C:\Windows\System\QAsGmsD.exe
  2⤵
  PID:7644
- C:\Windows\System\FnTBdBC.exe
  C:\Windows\System\FnTBdBC.exe
  2⤵
  PID:7684
- C:\Windows\System\BMKapWN.exe
  C:\Windows\System\BMKapWN.exe
  2⤵
  PID:7700
- C:\Windows\System\jFoozgl.exe
  C:\Windows\System\jFoozgl.exe
  2⤵
  PID:7752
- C:\Windows\System\MBsuTEp.exe
  C:\Windows\System\MBsuTEp.exe
  2⤵
  PID:7784
- C:\Windows\System\yuQGcZG.exe
  C:\Windows\System\yuQGcZG.exe
  2⤵
  PID:7804
- C:\Windows\System\jaskDIb.exe
  C:\Windows\System\jaskDIb.exe
  2⤵
  PID:7828
- C:\Windows\System\TRKWGeL.exe
  C:\Windows\System\TRKWGeL.exe
  2⤵
  PID:7856
- C:\Windows\System\eBbaYtM.exe
  C:\Windows\System\eBbaYtM.exe
  2⤵
  PID:7880
- C:\Windows\System\fbzydkO.exe
  C:\Windows\System\fbzydkO.exe
  2⤵
  PID:7900
- C:\Windows\System\roImxVM.exe
  C:\Windows\System\roImxVM.exe
  2⤵
  PID:7920
- C:\Windows\System\XLCVwnz.exe
  C:\Windows\System\XLCVwnz.exe
  2⤵
  PID:7940
- C:\Windows\System\XubLISX.exe
  C:\Windows\System\XubLISX.exe
  2⤵
  PID:7968
- C:\Windows\System\UVtTFsV.exe
  C:\Windows\System\UVtTFsV.exe
  2⤵
  PID:8012
- C:\Windows\System\mfnBcpu.exe
  C:\Windows\System\mfnBcpu.exe
  2⤵
  PID:8036
- C:\Windows\System\YheLzlf.exe
  C:\Windows\System\YheLzlf.exe
  2⤵
  PID:8052
- C:\Windows\System\lJNSjhy.exe
  C:\Windows\System\lJNSjhy.exe
  2⤵
  PID:8072
- C:\Windows\System\RdsRQyE.exe
  C:\Windows\System\RdsRQyE.exe
  2⤵
  PID:8180
- C:\Windows\System\joGFCLv.exe
  C:\Windows\System\joGFCLv.exe
  2⤵
  PID:7224
- C:\Windows\System\ualLQvk.exe
  C:\Windows\System\ualLQvk.exe
  2⤵
  PID:7256
- C:\Windows\System\XaHQqZi.exe
  C:\Windows\System\XaHQqZi.exe
  2⤵
  PID:7316
- C:\Windows\System\ukGvhMY.exe
  C:\Windows\System\ukGvhMY.exe
  2⤵
  PID:7476
- C:\Windows\System\FsOUHIj.exe
  C:\Windows\System\FsOUHIj.exe
  2⤵
  PID:7544
- C:\Windows\System\qzIwWaT.exe
  C:\Windows\System\qzIwWaT.exe
  2⤵
  PID:7484
- C:\Windows\System\PqsZgdc.exe
  C:\Windows\System\PqsZgdc.exe
  2⤵
  PID:7564
- C:\Windows\System\ESmLWtG.exe
  C:\Windows\System\ESmLWtG.exe
  2⤵
  PID:7668
- C:\Windows\System\kFmAaxY.exe
  C:\Windows\System\kFmAaxY.exe
  2⤵
  PID:7624
- C:\Windows\System\PcqevkQ.exe
  C:\Windows\System\PcqevkQ.exe
  2⤵
  PID:7748
- C:\Windows\System\gTFNJXI.exe
  C:\Windows\System\gTFNJXI.exe
  2⤵
  PID:7680
- C:\Windows\System\DqItIKm.exe
  C:\Windows\System\DqItIKm.exe
  2⤵
  PID:7792
- C:\Windows\System\TdsZrrj.exe
  C:\Windows\System\TdsZrrj.exe
  2⤵
  PID:7840
- C:\Windows\System\PSkEHFi.exe
  C:\Windows\System\PSkEHFi.exe
  2⤵
  PID:8048
- C:\Windows\System\PeXXpne.exe
  C:\Windows\System\PeXXpne.exe
  2⤵
  PID:7912
- C:\Windows\System\gCFurNF.exe
  C:\Windows\System\gCFurNF.exe
  2⤵
  PID:8024
- C:\Windows\System\XOPEvcI.exe
  C:\Windows\System\XOPEvcI.exe
  2⤵
  PID:7208
- C:\Windows\System\gIugpyo.exe
  C:\Windows\System\gIugpyo.exe
  2⤵
  PID:8152
- C:\Windows\System\CuVWiVk.exe
  C:\Windows\System\CuVWiVk.exe
  2⤵
  PID:7352
- C:\Windows\System\znXYyJy.exe
  C:\Windows\System\znXYyJy.exe
  2⤵
  PID:7368
- C:\Windows\System\qxfIhrs.exe
  C:\Windows\System\qxfIhrs.exe
  2⤵
  PID:7516
- C:\Windows\System\FgdTgGx.exe
  C:\Windows\System\FgdTgGx.exe
  2⤵
  PID:7456
- C:\Windows\System\kTkkdQw.exe
  C:\Windows\System\kTkkdQw.exe
  2⤵
  PID:7588
- C:\Windows\System\oCgeYlY.exe
  C:\Windows\System\oCgeYlY.exe
  2⤵
  PID:7672
- C:\Windows\System\lalmApu.exe
  C:\Windows\System\lalmApu.exe
  2⤵
  PID:7892
- C:\Windows\System\OFzzTdm.exe
  C:\Windows\System\OFzzTdm.exe
  2⤵
  PID:7824
- C:\Windows\System\uHwkHsu.exe
  C:\Windows\System\uHwkHsu.exe
  2⤵
  PID:8132
- C:\Windows\System\XnFmWPZ.exe
  C:\Windows\System\XnFmWPZ.exe
  2⤵
  PID:7308
- C:\Windows\System\XQowjQB.exe
  C:\Windows\System\XQowjQB.exe
  2⤵
  PID:7656
- C:\Windows\System\vLGhoCc.exe
  C:\Windows\System\vLGhoCc.exe
  2⤵
  PID:7520
- C:\Windows\System\sGMEuym.exe
  C:\Windows\System\sGMEuym.exe
  2⤵
  PID:7536
- C:\Windows\System\bumpIeU.exe
  C:\Windows\System\bumpIeU.exe
  2⤵
  PID:8204
- C:\Windows\System\DKQDanE.exe
  C:\Windows\System\DKQDanE.exe
  2⤵
  PID:8224
- C:\Windows\System\JRiKDqP.exe
  C:\Windows\System\JRiKDqP.exe
  2⤵
  PID:8244
- C:\Windows\System\EKvzSnw.exe
  C:\Windows\System\EKvzSnw.exe
  2⤵
  PID:8268
- C:\Windows\System\iavtdmY.exe
  C:\Windows\System\iavtdmY.exe
  2⤵
  PID:8308
- C:\Windows\System\jJRvLIJ.exe
  C:\Windows\System\jJRvLIJ.exe
  2⤵
  PID:8332
- C:\Windows\System\xZeTkmV.exe
  C:\Windows\System\xZeTkmV.exe
  2⤵
  PID:8360
- C:\Windows\System\lcdegDE.exe
  C:\Windows\System\lcdegDE.exe
  2⤵
  PID:8412
- C:\Windows\System\wdLIrAp.exe
  C:\Windows\System\wdLIrAp.exe
  2⤵
  PID:8432
- C:\Windows\System\ysLdGBX.exe
  C:\Windows\System\ysLdGBX.exe
  2⤵
  PID:8468
- C:\Windows\System\SBsodYJ.exe
  C:\Windows\System\SBsodYJ.exe
  2⤵
  PID:8492
- C:\Windows\System\Wmdphmc.exe
  C:\Windows\System\Wmdphmc.exe
  2⤵
  PID:8540
- C:\Windows\System\TUrUJHW.exe
  C:\Windows\System\TUrUJHW.exe
  2⤵
  PID:8564
- C:\Windows\System\QnymZVA.exe
  C:\Windows\System\QnymZVA.exe
  2⤵
  PID:8604
- C:\Windows\System\vxEewBU.exe
  C:\Windows\System\vxEewBU.exe
  2⤵
  PID:8628
- C:\Windows\System\dEBinYu.exe
  C:\Windows\System\dEBinYu.exe
  2⤵
  PID:8648
- C:\Windows\System\NgzocVa.exe
  C:\Windows\System\NgzocVa.exe
  2⤵
  PID:8676
- C:\Windows\System\bqUiVIs.exe
  C:\Windows\System\bqUiVIs.exe
  2⤵
  PID:8712
- C:\Windows\System\BPewFzg.exe
  C:\Windows\System\BPewFzg.exe
  2⤵
  PID:8728
- C:\Windows\System\HMzEajC.exe
  C:\Windows\System\HMzEajC.exe
  2⤵
  PID:8756
- C:\Windows\System\kpIcWpQ.exe
  C:\Windows\System\kpIcWpQ.exe
  2⤵
  PID:8784
- C:\Windows\System\wZDvclt.exe
  C:\Windows\System\wZDvclt.exe
  2⤵
  PID:8800
- C:\Windows\System\JOfgLQd.exe
  C:\Windows\System\JOfgLQd.exe
  2⤵
  PID:8828
- C:\Windows\System\qNveLqn.exe
  C:\Windows\System\qNveLqn.exe
  2⤵
  PID:8852
- C:\Windows\System\ZAoXZWn.exe
  C:\Windows\System\ZAoXZWn.exe
  2⤵
  PID:8876
- C:\Windows\System\BPwDVWb.exe
  C:\Windows\System\BPwDVWb.exe
  2⤵
  PID:8908
- C:\Windows\System\qXIDmXG.exe
  C:\Windows\System\qXIDmXG.exe
  2⤵
  PID:8952
- C:\Windows\System\ixgbdSf.exe
  C:\Windows\System\ixgbdSf.exe
  2⤵
  PID:8972
- C:\Windows\System\iAWXODt.exe
  C:\Windows\System\iAWXODt.exe
  2⤵
  PID:9024
- C:\Windows\System\EcDwoOO.exe
  C:\Windows\System\EcDwoOO.exe
  2⤵
  PID:9060
- C:\Windows\System\ZYmDijV.exe
  C:\Windows\System\ZYmDijV.exe
  2⤵
  PID:9076
- C:\Windows\System\kdHDGlc.exe
  C:\Windows\System\kdHDGlc.exe
  2⤵
  PID:9096
- C:\Windows\System\lVuwepw.exe
  C:\Windows\System\lVuwepw.exe
  2⤵
  PID:9124
- C:\Windows\System\rNtSkZB.exe
  C:\Windows\System\rNtSkZB.exe
  2⤵
  PID:9148
- C:\Windows\System\iEKZSjx.exe
  C:\Windows\System\iEKZSjx.exe
  2⤵
  PID:9200
- C:\Windows\System\YuNjNlI.exe
  C:\Windows\System\YuNjNlI.exe
  2⤵
  PID:6372
- C:\Windows\System\MyreNvy.exe
  C:\Windows\System\MyreNvy.exe
  2⤵
  PID:8220
- C:\Windows\System\iWQzaRm.exe
  C:\Windows\System\iWQzaRm.exe
  2⤵
  PID:8280
- C:\Windows\System\MvaLEoA.exe
  C:\Windows\System\MvaLEoA.exe
  2⤵
  PID:8352
- C:\Windows\System\INZZciG.exe
  C:\Windows\System\INZZciG.exe
  2⤵
  PID:8368
- C:\Windows\System\JJoLUVP.exe
  C:\Windows\System\JJoLUVP.exe
  2⤵
  PID:8464
- C:\Windows\System\qdEsdbT.exe
  C:\Windows\System\qdEsdbT.exe
  2⤵
  PID:8532
- C:\Windows\System\EJLCFSe.exe
  C:\Windows\System\EJLCFSe.exe
  2⤵
  PID:8600
- C:\Windows\System\fcEJcHR.exe
  C:\Windows\System\fcEJcHR.exe
  2⤵
  PID:8636
- C:\Windows\System\vYRlVrE.exe
  C:\Windows\System\vYRlVrE.exe
  2⤵
  PID:8688
- C:\Windows\System\TOUZkol.exe
  C:\Windows\System\TOUZkol.exe
  2⤵
  PID:8808
- C:\Windows\System\jdficQI.exe
  C:\Windows\System\jdficQI.exe
  2⤵
  PID:8920
- C:\Windows\System\njgrPxC.exe
  C:\Windows\System\njgrPxC.exe
  2⤵
  PID:8964
- C:\Windows\System\HvQPlSF.exe
  C:\Windows\System\HvQPlSF.exe
  2⤵
  PID:9044
- C:\Windows\System\khyMEkI.exe
  C:\Windows\System\khyMEkI.exe
  2⤵
  PID:9072
- C:\Windows\System\DkQpdMB.exe
  C:\Windows\System\DkQpdMB.exe
  2⤵
  PID:9092
- C:\Windows\System\LkNdWPe.exe
  C:\Windows\System\LkNdWPe.exe
  2⤵
  PID:9164
- C:\Windows\System\tbPyxaR.exe
  C:\Windows\System\tbPyxaR.exe
  2⤵
  PID:8316
- C:\Windows\System\qgqppdi.exe
  C:\Windows\System\qgqppdi.exe
  2⤵
  PID:8424
- C:\Windows\System\wCWlOGI.exe
  C:\Windows\System\wCWlOGI.exe
  2⤵
  PID:8528
- C:\Windows\System\tmLOPSm.exe
  C:\Windows\System\tmLOPSm.exe
  2⤵
  PID:8640
- C:\Windows\System\qJtIdaf.exe
  C:\Windows\System\qJtIdaf.exe
  2⤵
  PID:8796
- C:\Windows\System\dIAxzqT.exe
  C:\Windows\System\dIAxzqT.exe
  2⤵
  PID:8932
- C:\Windows\System\AeEwAal.exe
  C:\Windows\System\AeEwAal.exe
  2⤵
  PID:9056
- C:\Windows\System\nqIzvFi.exe
  C:\Windows\System\nqIzvFi.exe
  2⤵
  PID:8460
- C:\Windows\System\HePAOGw.exe
  C:\Windows\System\HePAOGw.exe
  2⤵
  PID:8764
- C:\Windows\System\qGFbhPH.exe
  C:\Windows\System\qGFbhPH.exe
  2⤵
  PID:9068
- C:\Windows\System\dIQHJIx.exe
  C:\Windows\System\dIQHJIx.exe
  2⤵
  PID:8664
- C:\Windows\System\HXmdpHl.exe
  C:\Windows\System\HXmdpHl.exe
  2⤵
  PID:9240
- C:\Windows\System\eWjzFHJ.exe
  C:\Windows\System\eWjzFHJ.exe
  2⤵
  PID:9264
- C:\Windows\System\vJrrgsH.exe
  C:\Windows\System\vJrrgsH.exe
  2⤵
  PID:9296
- C:\Windows\System\FVIxSdS.exe
  C:\Windows\System\FVIxSdS.exe
  2⤵
  PID:9320
- C:\Windows\System\JkOPWic.exe
  C:\Windows\System\JkOPWic.exe
  2⤵
  PID:9348
- C:\Windows\System\zJAztIC.exe
  C:\Windows\System\zJAztIC.exe
  2⤵
  PID:9364
- C:\Windows\System\vDHhaah.exe
  C:\Windows\System\vDHhaah.exe
  2⤵
  PID:9416
- C:\Windows\System\rzsWjLw.exe
  C:\Windows\System\rzsWjLw.exe
  2⤵
  PID:9456
- C:\Windows\System\IesoyQG.exe
  C:\Windows\System\IesoyQG.exe
  2⤵
  PID:9476
- C:\Windows\System\BTKJCQh.exe
  C:\Windows\System\BTKJCQh.exe
  2⤵
  PID:9500
- C:\Windows\System\aDoqofN.exe
  C:\Windows\System\aDoqofN.exe
  2⤵
  PID:9548
- C:\Windows\System\ZUFnLzA.exe
  C:\Windows\System\ZUFnLzA.exe
  2⤵
  PID:9568
- C:\Windows\System\IMwBFzt.exe
  C:\Windows\System\IMwBFzt.exe
  2⤵
  PID:9592
- C:\Windows\System\UKmdExv.exe
  C:\Windows\System\UKmdExv.exe
  2⤵
  PID:9608
- C:\Windows\System\YmOrTFQ.exe
  C:\Windows\System\YmOrTFQ.exe
  2⤵
  PID:9644
- C:\Windows\System\FbFGDoC.exe
  C:\Windows\System\FbFGDoC.exe
  2⤵
  PID:9668
- C:\Windows\System\JvCFlDv.exe
  C:\Windows\System\JvCFlDv.exe
  2⤵
  PID:9688
- C:\Windows\System\WmEoisq.exe
  C:\Windows\System\WmEoisq.exe
  2⤵
  PID:9744
- C:\Windows\System\zznaODt.exe
  C:\Windows\System\zznaODt.exe
  2⤵
  PID:9768
- C:\Windows\System\dZOTDxz.exe
  C:\Windows\System\dZOTDxz.exe
  2⤵
  PID:9788
- C:\Windows\System\YEgEQoC.exe
  C:\Windows\System\YEgEQoC.exe
  2⤵
  PID:9808
- C:\Windows\System\RiQxtpf.exe
  C:\Windows\System\RiQxtpf.exe
  2⤵
  PID:9848
- C:\Windows\System\LdOrDkw.exe
  C:\Windows\System\LdOrDkw.exe
  2⤵
  PID:9864
- C:\Windows\System\fRoWCrl.exe
  C:\Windows\System\fRoWCrl.exe
  2⤵
  PID:9884
- C:\Windows\System\kckrDhp.exe
  C:\Windows\System\kckrDhp.exe
  2⤵
  PID:9904
- C:\Windows\System\MCeiYqd.exe
  C:\Windows\System\MCeiYqd.exe
  2⤵
  PID:9928
- C:\Windows\System\nURsLTz.exe
  C:\Windows\System\nURsLTz.exe
  2⤵
  PID:9952
- C:\Windows\System\CZbePaC.exe
  C:\Windows\System\CZbePaC.exe
  2⤵
  PID:9968
- C:\Windows\System\xEDgFJS.exe
  C:\Windows\System\xEDgFJS.exe
  2⤵
  PID:10032
- C:\Windows\System\rnSOoGS.exe
  C:\Windows\System\rnSOoGS.exe
  2⤵
  PID:10052
- C:\Windows\System\osFMwZK.exe
  C:\Windows\System\osFMwZK.exe
  2⤵
  PID:10116
- C:\Windows\System\RJDTupp.exe
  C:\Windows\System\RJDTupp.exe
  2⤵
  PID:10156
- C:\Windows\System\HnFbdlp.exe
  C:\Windows\System\HnFbdlp.exe
  2⤵
  PID:10176
- C:\Windows\System\POaRjsh.exe
  C:\Windows\System\POaRjsh.exe
  2⤵
  PID:10192
- C:\Windows\System\KekfjUG.exe
  C:\Windows\System\KekfjUG.exe
  2⤵
  PID:10212
- C:\Windows\System\vzuErty.exe
  C:\Windows\System\vzuErty.exe
  2⤵
  PID:9232
- C:\Windows\System\beqgKvm.exe
  C:\Windows\System\beqgKvm.exe
  2⤵
  PID:9144
- C:\Windows\System\wrQQpDl.exe
  C:\Windows\System\wrQQpDl.exe
  2⤵
  PID:9340
- C:\Windows\System\VRBQlUm.exe
  C:\Windows\System\VRBQlUm.exe
  2⤵
  PID:9372
- C:\Windows\System\RXoeYDo.exe
  C:\Windows\System\RXoeYDo.exe
  2⤵
  PID:9436
- C:\Windows\System\ECCZgYK.exe
  C:\Windows\System\ECCZgYK.exe
  2⤵
  PID:9492
- C:\Windows\System\LhUqpVF.exe
  C:\Windows\System\LhUqpVF.exe
  2⤵
  PID:9524
- C:\Windows\System\kfzOBhk.exe
  C:\Windows\System\kfzOBhk.exe
  2⤵
  PID:9628
- C:\Windows\System\GAbofWp.exe
  C:\Windows\System\GAbofWp.exe
  2⤵
  PID:9660
- C:\Windows\System\fzlDzGZ.exe
  C:\Windows\System\fzlDzGZ.exe
  2⤵
  PID:9756
- C:\Windows\System\alZUjec.exe
  C:\Windows\System\alZUjec.exe
  2⤵
  PID:9800
- C:\Windows\System\PnJPrXO.exe
  C:\Windows\System\PnJPrXO.exe
  2⤵
  PID:9856
- C:\Windows\System\XCJgWHa.exe
  C:\Windows\System\XCJgWHa.exe
  2⤵
  PID:9936
- C:\Windows\System\DLFyKDA.exe
  C:\Windows\System\DLFyKDA.exe
  2⤵
  PID:9996
- C:\Windows\System\udRiDag.exe
  C:\Windows\System\udRiDag.exe
  2⤵
  PID:10080
- C:\Windows\System\UIggVBy.exe
  C:\Windows\System\UIggVBy.exe
  2⤵
  PID:10132
- C:\Windows\System\bRtYMRy.exe
  C:\Windows\System\bRtYMRy.exe
  2⤵
  PID:10220
- C:\Windows\System\EOvdGLt.exe
  C:\Windows\System\EOvdGLt.exe
  2⤵
  PID:8296
- C:\Windows\System\axrTwcC.exe
  C:\Windows\System\axrTwcC.exe
  2⤵
  PID:9396
- C:\Windows\System\PYbogiB.exe
  C:\Windows\System\PYbogiB.exe
  2⤵
  PID:9560
- C:\Windows\System\VfvmlXZ.exe
  C:\Windows\System\VfvmlXZ.exe
  2⤵
  PID:8708
- C:\Windows\System\SkGUhsf.exe
  C:\Windows\System\SkGUhsf.exe
  2⤵
  PID:9964
- C:\Windows\System\hVhQWyP.exe
  C:\Windows\System\hVhQWyP.exe
  2⤵
  PID:9976
- C:\Windows\System\kVGskcL.exe
  C:\Windows\System\kVGskcL.exe
  2⤵
  PID:10204
- C:\Windows\System\mMGqFid.exe
  C:\Windows\System\mMGqFid.exe
  2⤵
  PID:2660
- C:\Windows\System\NKqbGid.exe
  C:\Windows\System\NKqbGid.exe
  2⤵
  PID:9412
- C:\Windows\System\uPChbqh.exe
  C:\Windows\System\uPChbqh.exe
  2⤵
  PID:9508
- C:\Windows\System\ihIYCSl.exe
  C:\Windows\System\ihIYCSl.exe
  2⤵
  PID:9252
- C:\Windows\System\jlbRTDF.exe
  C:\Windows\System\jlbRTDF.exe
  2⤵
  PID:9776
- C:\Windows\System\dOQtdyD.exe
  C:\Windows\System\dOQtdyD.exe
  2⤵
  PID:10288
- C:\Windows\System\WgGHSjF.exe
  C:\Windows\System\WgGHSjF.exe
  2⤵
  PID:10308
- C:\Windows\System\mDfkLhZ.exe
  C:\Windows\System\mDfkLhZ.exe
  2⤵
  PID:10332
- C:\Windows\System\vGQtljZ.exe
  C:\Windows\System\vGQtljZ.exe
  2⤵
  PID:10372
- C:\Windows\System\YeoJpnZ.exe
  C:\Windows\System\YeoJpnZ.exe
  2⤵
  PID:10392
- C:\Windows\System\rjNiSGC.exe
  C:\Windows\System\rjNiSGC.exe
  2⤵
  PID:10408
- C:\Windows\System\YmWYkmw.exe
  C:\Windows\System\YmWYkmw.exe
  2⤵
  PID:10428
- C:\Windows\System\jnfcjIw.exe
  C:\Windows\System\jnfcjIw.exe
  2⤵
  PID:10460
- C:\Windows\System\GjTqtKZ.exe
  C:\Windows\System\GjTqtKZ.exe
  2⤵
  PID:10480
- C:\Windows\System\DlKMoHM.exe
  C:\Windows\System\DlKMoHM.exe
  2⤵
  PID:10496
- C:\Windows\System\RwAWmWJ.exe
  C:\Windows\System\RwAWmWJ.exe
  2⤵
  PID:10544
- C:\Windows\System\yqTsZoy.exe
  C:\Windows\System\yqTsZoy.exe
  2⤵
  PID:10580
- C:\Windows\System\uTUxDDu.exe
  C:\Windows\System\uTUxDDu.exe
  2⤵
  PID:10604
- C:\Windows\System\tKICFEn.exe
  C:\Windows\System\tKICFEn.exe
  2⤵
  PID:10624
- C:\Windows\System\BlFNIQw.exe
  C:\Windows\System\BlFNIQw.exe
  2⤵
  PID:10648
- C:\Windows\System\nUlRUgO.exe
  C:\Windows\System\nUlRUgO.exe
  2⤵
  PID:10668
- C:\Windows\System\EUXAdwm.exe
  C:\Windows\System\EUXAdwm.exe
  2⤵
  PID:10708
- C:\Windows\System\wFQiEZx.exe
  C:\Windows\System\wFQiEZx.exe
  2⤵
  PID:10728
- C:\Windows\System\DHptFSZ.exe
  C:\Windows\System\DHptFSZ.exe
  2⤵
  PID:10768
- C:\Windows\System\iYLijxm.exe
  C:\Windows\System\iYLijxm.exe
  2⤵
  PID:10804
- C:\Windows\System\OVLdUEq.exe
  C:\Windows\System\OVLdUEq.exe
  2⤵
  PID:10824
- C:\Windows\System\SOQuyFh.exe
  C:\Windows\System\SOQuyFh.exe
  2⤵
  PID:10848
- C:\Windows\System\aBiZuKS.exe
  C:\Windows\System\aBiZuKS.exe
  2⤵
  PID:10864
- C:\Windows\System\tzGfZqj.exe
  C:\Windows\System\tzGfZqj.exe
  2⤵
  PID:10888
- C:\Windows\System\mRBeRQV.exe
  C:\Windows\System\mRBeRQV.exe
  2⤵
  PID:10924
- C:\Windows\System\PEKOeay.exe
  C:\Windows\System\PEKOeay.exe
  2⤵
  PID:10952
- C:\Windows\System\ggtAuBe.exe
  C:\Windows\System\ggtAuBe.exe
  2⤵
  PID:10972
- C:\Windows\System\LHonrbS.exe
  C:\Windows\System\LHonrbS.exe
  2⤵
  PID:10996
- C:\Windows\System\ugovMLm.exe
  C:\Windows\System\ugovMLm.exe
  2⤵
  PID:11060
- C:\Windows\System\XzDljyO.exe
  C:\Windows\System\XzDljyO.exe
  2⤵
  PID:11096
- C:\Windows\System\MeCWDqV.exe
  C:\Windows\System\MeCWDqV.exe
  2⤵
  PID:11116
- C:\Windows\System\oksbScw.exe
  C:\Windows\System\oksbScw.exe
  2⤵
  PID:11136
- C:\Windows\System\ZojLKKH.exe
  C:\Windows\System\ZojLKKH.exe
  2⤵
  PID:11156
- C:\Windows\System\JMsgzBG.exe
  C:\Windows\System\JMsgzBG.exe
  2⤵
  PID:11216
- C:\Windows\System\NxjjOjF.exe
  C:\Windows\System\NxjjOjF.exe
  2⤵
  PID:11256
- C:\Windows\System\ZTvFPGP.exe
  C:\Windows\System\ZTvFPGP.exe
  2⤵
  PID:10188
- C:\Windows\System\eahfXsB.exe
  C:\Windows\System\eahfXsB.exe
  2⤵
  PID:10300
- C:\Windows\System\HuSGXMG.exe
  C:\Windows\System\HuSGXMG.exe
  2⤵
  PID:10388
- C:\Windows\System\YMoiGpB.exe
  C:\Windows\System\YMoiGpB.exe
  2⤵
  PID:10420
- C:\Windows\System\BEHkliJ.exe
  C:\Windows\System\BEHkliJ.exe
  2⤵
  PID:10472
- C:\Windows\System\YebRpiF.exe
  C:\Windows\System\YebRpiF.exe
  2⤵
  PID:10524
- C:\Windows\System\WuyNtbG.exe
  C:\Windows\System\WuyNtbG.exe
  2⤵
  PID:10540
- C:\Windows\System\kzBFmsj.exe
  C:\Windows\System\kzBFmsj.exe
  2⤵
  PID:10616
- C:\Windows\System\GjJfoRE.exe
  C:\Windows\System\GjJfoRE.exe
  2⤵
  PID:10664
- C:\Windows\System\lWNHAPO.exe
  C:\Windows\System\lWNHAPO.exe
  2⤵
  PID:10724
- C:\Windows\System\kNmLftX.exe
  C:\Windows\System\kNmLftX.exe
  2⤵
  PID:4280
- C:\Windows\System\ZohCWGU.exe
  C:\Windows\System\ZohCWGU.exe
  2⤵
  PID:10872
- C:\Windows\System\DPklRnF.exe
  C:\Windows\System\DPklRnF.exe
  2⤵
  PID:10836
- C:\Windows\System\NJypqyU.exe
  C:\Windows\System\NJypqyU.exe
  2⤵
  PID:10904
- C:\Windows\System\XkArYJw.exe
  C:\Windows\System\XkArYJw.exe
  2⤵
  PID:11036
- C:\Windows\System\zYKXciC.exe
  C:\Windows\System\zYKXciC.exe
  2⤵
  PID:11152
- C:\Windows\System\VLIdmcz.exe
  C:\Windows\System\VLIdmcz.exe
  2⤵
  PID:9720
- C:\Windows\System\fVcvEnj.exe
  C:\Windows\System\fVcvEnj.exe
  2⤵
  PID:10284
- C:\Windows\System\KOAwxHB.exe
  C:\Windows\System\KOAwxHB.exe
  2⤵
  PID:10400
- C:\Windows\System\pYmRyNg.exe
  C:\Windows\System\pYmRyNg.exe
  2⤵
  PID:10620
- C:\Windows\System\OiNYFMk.exe
  C:\Windows\System\OiNYFMk.exe
  2⤵
  PID:10964
- C:\Windows\System\RZJyFvO.exe
  C:\Windows\System\RZJyFvO.exe
  2⤵
  PID:10884
- C:\Windows\System\ayqlhFT.exe
  C:\Windows\System\ayqlhFT.exe
  2⤵
  PID:10988
- C:\Windows\System\DkFyZSd.exe
  C:\Windows\System\DkFyZSd.exe
  2⤵
  PID:9288
- C:\Windows\System\iSSyVlF.exe
  C:\Windows\System\iSSyVlF.exe
  2⤵
  PID:10508
- C:\Windows\System\NmixphJ.exe
  C:\Windows\System\NmixphJ.exe
  2⤵
  PID:10764
- C:\Windows\System\HjJFEOc.exe
  C:\Windows\System\HjJFEOc.exe
  2⤵
  PID:10840
- C:\Windows\System\CZGjbCX.exe
  C:\Windows\System\CZGjbCX.exe
  2⤵
  PID:10280
- C:\Windows\System\oExWbCr.exe
  C:\Windows\System\oExWbCr.exe
  2⤵
  PID:10700
- C:\Windows\System\vICNOda.exe
  C:\Windows\System\vICNOda.exe
  2⤵
  PID:11288
- C:\Windows\System\wKQcCBe.exe
  C:\Windows\System\wKQcCBe.exe
  2⤵
  PID:11308
- C:\Windows\System\kDmIUiJ.exe
  C:\Windows\System\kDmIUiJ.exe
  2⤵
  PID:11336
- C:\Windows\System\NMLzXfM.exe
  C:\Windows\System\NMLzXfM.exe
  2⤵
  PID:11372
- C:\Windows\System\QtYsbbh.exe
  C:\Windows\System\QtYsbbh.exe
  2⤵
  PID:11404
- C:\Windows\System\CgybEVB.exe
  C:\Windows\System\CgybEVB.exe
  2⤵
  PID:11424
- C:\Windows\System\COkhZxY.exe
  C:\Windows\System\COkhZxY.exe
  2⤵
  PID:11460
- C:\Windows\System\euZqxJT.exe
  C:\Windows\System\euZqxJT.exe
  2⤵
  PID:11516
- C:\Windows\System\TSmbFEK.exe
  C:\Windows\System\TSmbFEK.exe
  2⤵
  PID:11540
- C:\Windows\System\ncBhykA.exe
  C:\Windows\System\ncBhykA.exe
  2⤵
  PID:11560
- C:\Windows\System\YItiCRr.exe
  C:\Windows\System\YItiCRr.exe
  2⤵
  PID:11580
- C:\Windows\System\kuRCdZJ.exe
  C:\Windows\System\kuRCdZJ.exe
  2⤵
  PID:11608
- C:\Windows\System\KCrkgVr.exe
  C:\Windows\System\KCrkgVr.exe
  2⤵
  PID:11656
- C:\Windows\System\EBbuHAo.exe
  C:\Windows\System\EBbuHAo.exe
  2⤵
  PID:11676
- C:\Windows\System\vNiBcFo.exe
  C:\Windows\System\vNiBcFo.exe
  2⤵
  PID:11696
- C:\Windows\System\bXqJWRd.exe
  C:\Windows\System\bXqJWRd.exe
  2⤵
  PID:11724
- C:\Windows\System\qEIDRBL.exe
  C:\Windows\System\qEIDRBL.exe
  2⤵
  PID:11748
- C:\Windows\System\cwqqclJ.exe
  C:\Windows\System\cwqqclJ.exe
  2⤵
  PID:11768
- C:\Windows\System\ixsUECO.exe
  C:\Windows\System\ixsUECO.exe
  2⤵
  PID:11788
- C:\Windows\System\cQkcDIN.exe
  C:\Windows\System\cQkcDIN.exe
  2⤵
  PID:11812
- C:\Windows\System\pmsIEfH.exe
  C:\Windows\System\pmsIEfH.exe
  2⤵
  PID:11840
- C:\Windows\System\msRXDah.exe
  C:\Windows\System\msRXDah.exe
  2⤵
  PID:11860
- C:\Windows\System\fOYQgXd.exe
  C:\Windows\System\fOYQgXd.exe
  2⤵
  PID:11896
- C:\Windows\System\pArEiWs.exe
  C:\Windows\System\pArEiWs.exe
  2⤵
  PID:11928
- C:\Windows\System\jReyXHD.exe
  C:\Windows\System\jReyXHD.exe
  2⤵
  PID:11948
- C:\Windows\System\ErdQHIo.exe
  C:\Windows\System\ErdQHIo.exe
  2⤵
  PID:11968
- C:\Windows\System\YbSdGEr.exe
  C:\Windows\System\YbSdGEr.exe
  2⤵
  PID:12008
- C:\Windows\System\yBgWqjW.exe
  C:\Windows\System\yBgWqjW.exe
  2⤵
  PID:12036
- C:\Windows\System\gsAcSbS.exe
  C:\Windows\System\gsAcSbS.exe
  2⤵
  PID:12064
- C:\Windows\System\CfIbnqo.exe
  C:\Windows\System\CfIbnqo.exe
  2⤵
  PID:12092
- C:\Windows\System\JEcxBOJ.exe
  C:\Windows\System\JEcxBOJ.exe
  2⤵
  PID:12136
- C:\Windows\System\XPgecQZ.exe
  C:\Windows\System\XPgecQZ.exe
  2⤵
  PID:12172
- C:\Windows\System\yrFfPDI.exe
  C:\Windows\System\yrFfPDI.exe
  2⤵
  PID:12192
- C:\Windows\System\puVsGwP.exe
  C:\Windows\System\puVsGwP.exe
  2⤵
  PID:12216
- C:\Windows\System\yuDzHra.exe
  C:\Windows\System\yuDzHra.exe
  2⤵
  PID:12240
- C:\Windows\System\wmvIzRw.exe
  C:\Windows\System\wmvIzRw.exe
  2⤵
  PID:12260
- C:\Windows\System\eIJzbTT.exe
  C:\Windows\System\eIJzbTT.exe
  2⤵
  PID:10936
- C:\Windows\System\OgHMudK.exe
  C:\Windows\System\OgHMudK.exe
  2⤵
  PID:11296
- C:\Windows\System\xwgifOV.exe
  C:\Windows\System\xwgifOV.exe
  2⤵
  PID:11364
- C:\Windows\System\cBpezKh.exe
  C:\Windows\System\cBpezKh.exe
  2⤵
  PID:11392
- C:\Windows\System\fkQcssp.exe
  C:\Windows\System\fkQcssp.exe
  2⤵
  PID:11492
- C:\Windows\System\GfmnEzA.exe
  C:\Windows\System\GfmnEzA.exe
  2⤵
  PID:11532
- C:\Windows\System\obYHtYR.exe
  C:\Windows\System\obYHtYR.exe
  2⤵
  PID:11576
- C:\Windows\System\mDFpkXP.exe
  C:\Windows\System\mDFpkXP.exe
  2⤵
  PID:11720
- C:\Windows\System\LhrAdDz.exe
  C:\Windows\System\LhrAdDz.exe
  2⤵
  PID:11776
- C:\Windows\System\VvDJXgH.exe
  C:\Windows\System\VvDJXgH.exe
  2⤵
  PID:11848
- C:\Windows\System\Ijrncim.exe
  C:\Windows\System\Ijrncim.exe
  2⤵
  PID:1556
- C:\Windows\System\dSPfpYG.exe
  C:\Windows\System\dSPfpYG.exe
  2⤵
  PID:11924
- C:\Windows\System\LysnfpG.exe
  C:\Windows\System\LysnfpG.exe
  2⤵
  PID:11964
- C:\Windows\System\NEFqAqk.exe
  C:\Windows\System\NEFqAqk.exe
  2⤵
  PID:12032
- C:\Windows\System\WolCFso.exe
  C:\Windows\System\WolCFso.exe
  2⤵
  PID:12080
- C:\Windows\System\HBZTfup.exe
  C:\Windows\System\HBZTfup.exe
  2⤵
  PID:12056
- C:\Windows\System\KkGbxlG.exe
  C:\Windows\System\KkGbxlG.exe
  2⤵
  PID:12124
- C:\Windows\System\pmYMrzG.exe
  C:\Windows\System\pmYMrzG.exe
  2⤵
  PID:12212
- C:\Windows\System\gBgXgnj.exe
  C:\Windows\System\gBgXgnj.exe
  2⤵
  PID:12164
- C:\Windows\System\CsKsuGq.exe
  C:\Windows\System\CsKsuGq.exe
  2⤵
  PID:12252
- C:\Windows\System\PocLWbL.exe
  C:\Windows\System\PocLWbL.exe
  2⤵
  PID:11304
- C:\Windows\System\DHmcwOS.exe
  C:\Windows\System\DHmcwOS.exe
  2⤵
  PID:10800
- C:\Windows\System\kGIEMpx.exe
  C:\Windows\System\kGIEMpx.exe
  2⤵
  PID:11452
- C:\Windows\System\zFRgLuh.exe
  C:\Windows\System\zFRgLuh.exe
  2⤵
  PID:12156
- C:\Windows\System\FfUxGKJ.exe
  C:\Windows\System\FfUxGKJ.exe
  2⤵
  PID:11344
- C:\Windows\System\EigNfLB.exe
  C:\Windows\System\EigNfLB.exe
  2⤵
  PID:10592
- C:\Windows\System\tyRnXeB.exe
  C:\Windows\System\tyRnXeB.exe
  2⤵
  PID:11648
- C:\Windows\System\ANgjDuj.exe
  C:\Windows\System\ANgjDuj.exe
  2⤵
  PID:12052
- C:\Windows\System\jVBcpQs.exe
  C:\Windows\System\jVBcpQs.exe
  2⤵
  PID:12184
- C:\Windows\System\ihfLNGD.exe
  C:\Windows\System\ihfLNGD.exe
  2⤵
  PID:12312
- C:\Windows\System\xCSIpEb.exe
  C:\Windows\System\xCSIpEb.exe
  2⤵
  PID:12344
- C:\Windows\System\dijvTOL.exe
  C:\Windows\System\dijvTOL.exe
  2⤵
  PID:12372
- C:\Windows\System\ZxluNGm.exe
  C:\Windows\System\ZxluNGm.exe
  2⤵
  PID:12436
- C:\Windows\System\AvwlHFl.exe
  C:\Windows\System\AvwlHFl.exe
  2⤵
  PID:12452
- C:\Windows\System\yWoQRfA.exe
  C:\Windows\System\yWoQRfA.exe
  2⤵
  PID:12480
- C:\Windows\System\NEwIrjw.exe
  C:\Windows\System\NEwIrjw.exe
  2⤵
  PID:12520
- C:\Windows\System\zMVYKzq.exe
  C:\Windows\System\zMVYKzq.exe
  2⤵
  PID:12540
- C:\Windows\System\sHKPewo.exe
  C:\Windows\System\sHKPewo.exe
  2⤵
  PID:12564
- C:\Windows\System\BvKGjho.exe
  C:\Windows\System\BvKGjho.exe
  2⤵
  PID:12608
- C:\Windows\System\jWYiFDA.exe
  C:\Windows\System\jWYiFDA.exe
  2⤵
  PID:12636
- C:\Windows\System\HmMocDc.exe
  C:\Windows\System\HmMocDc.exe
  2⤵
  PID:12664
- C:\Windows\System\buXCCEw.exe
  C:\Windows\System\buXCCEw.exe
  2⤵
  PID:12684
- C:\Windows\System\iFJnIpY.exe
  C:\Windows\System\iFJnIpY.exe
  2⤵
  PID:12708
- C:\Windows\System\XOPDISd.exe
  C:\Windows\System\XOPDISd.exe
  2⤵
  PID:12736
- C:\Windows\System\EeRpDPu.exe
  C:\Windows\System\EeRpDPu.exe
  2⤵
  PID:12764
- C:\Windows\System\wsmPgXC.exe
  C:\Windows\System\wsmPgXC.exe
  2⤵
  PID:12784
- C:\Windows\System\UBGbhyF.exe
  C:\Windows\System\UBGbhyF.exe
  2⤵
  PID:12804
- C:\Windows\System\bhaOFdV.exe
  C:\Windows\System\bhaOFdV.exe
  2⤵
  PID:12832
- C:\Windows\System\moUcXkM.exe
  C:\Windows\System\moUcXkM.exe
  2⤵
  PID:12852
- C:\Windows\System\wxdviUD.exe
  C:\Windows\System\wxdviUD.exe
  2⤵
  PID:12900
- C:\Windows\System\JbpNZOE.exe
  C:\Windows\System\JbpNZOE.exe
  2⤵
  PID:12920
- C:\Windows\System\ULNxTey.exe
  C:\Windows\System\ULNxTey.exe
  2⤵
  PID:12948
- C:\Windows\System\nbPBSbn.exe
  C:\Windows\System\nbPBSbn.exe
  2⤵
  PID:12972
- C:\Windows\System\ubFEwse.exe
  C:\Windows\System\ubFEwse.exe
  2⤵
  PID:13036
- C:\Windows\System\PUPAPLq.exe
  C:\Windows\System\PUPAPLq.exe
  2⤵
  PID:13056
- C:\Windows\System\FBmTMOS.exe
  C:\Windows\System\FBmTMOS.exe
  2⤵
  PID:13080
- C:\Windows\System\fFVfjKy.exe
  C:\Windows\System\fFVfjKy.exe
  2⤵
  PID:13120
- C:\Windows\System\lldRpcg.exe
  C:\Windows\System\lldRpcg.exe
  2⤵
  PID:13136
- C:\Windows\System\wyIKfty.exe
  C:\Windows\System\wyIKfty.exe
  2⤵
  PID:13164
- C:\Windows\System\cLRxnUc.exe
  C:\Windows\System\cLRxnUc.exe
  2⤵
  PID:13180
- C:\Windows\System\yhAOqtS.exe
  C:\Windows\System\yhAOqtS.exe
  2⤵
  PID:13196
- C:\Windows\System\JFoRlZJ.exe
  C:\Windows\System\JFoRlZJ.exe
  2⤵
  PID:11664
- C:\Windows\System\NaLEUXj.exe
  C:\Windows\System\NaLEUXj.exe
  2⤵
  PID:12308
- C:\Windows\System\nzoWXZi.exe
  C:\Windows\System\nzoWXZi.exe
  2⤵
  PID:12476
- C:\Windows\System\DjVhAFP.exe
  C:\Windows\System\DjVhAFP.exe
  2⤵
  PID:13304
- C:\Windows\System\SqhPLir.exe
  C:\Windows\System\SqhPLir.exe
  2⤵
  PID:11416
- C:\Windows\System\LBIUOqN.exe
  C:\Windows\System\LBIUOqN.exe
  2⤵
  PID:13204
- C:\Windows\System\TseWLpz.exe
  C:\Windows\System\TseWLpz.exe
  2⤵
  PID:3336
- C:\Windows\System\RZMVLaP.exe
  C:\Windows\System\RZMVLaP.exe
  2⤵
  PID:11984
- C:\Windows\System\szkDaiD.exe
  C:\Windows\System\szkDaiD.exe
  2⤵
  PID:13276
- C:\Windows\System\XGKuGxh.exe
  C:\Windows\System\XGKuGxh.exe
  2⤵
  PID:13300
- C:\Windows\System\qPvQRCx.exe
  C:\Windows\System\qPvQRCx.exe
  2⤵
  PID:13268
- C:\Windows\System\maBdQrJ.exe
  C:\Windows\System\maBdQrJ.exe
  2⤵
  PID:13052
- C:\Windows\System\gbaeRxO.exe
  C:\Windows\System\gbaeRxO.exe
  2⤵
  PID:13096
- C:\Windows\System\TXhJSCg.exe
  C:\Windows\System\TXhJSCg.exe
  2⤵
  PID:4552
- C:\Windows\System\KUjaSPk.exe
  C:\Windows\System\KUjaSPk.exe
  2⤵
  PID:13132
- C:\Windows\System\KsNVXKk.exe
  C:\Windows\System\KsNVXKk.exe
  2⤵
  PID:13192
- C:\Windows\System\GbVBxHt.exe
  C:\Windows\System\GbVBxHt.exe
  2⤵
  PID:2800
- C:\Windows\System\NHkfWze.exe
  C:\Windows\System\NHkfWze.exe
  2⤵
  PID:5008
- C:\Windows\System\rnUamNM.exe
  C:\Windows\System\rnUamNM.exe
  2⤵
  PID:4284
- C:\Windows\System\JONcVYb.exe
  C:\Windows\System\JONcVYb.exe
  2⤵
  PID:2972
- C:\Windows\System\DJZIado.exe
  C:\Windows\System\DJZIado.exe
  2⤵
  PID:1596
- C:\Windows\System\CMhklNb.exe
  C:\Windows\System\CMhklNb.exe
  2⤵
  PID:12780
- C:\Windows\System\WsQNrWz.exe
  C:\Windows\System\WsQNrWz.exe
  2⤵
  PID:12884
- C:\Windows\System\vRUOYMX.exe
  C:\Windows\System\vRUOYMX.exe
  2⤵
  PID:13284
- C:\Windows\System\npnWulX.exe
  C:\Windows\System\npnWulX.exe
  2⤵
  PID:12604
- C:\Windows\System\GeATnGj.exe
  C:\Windows\System\GeATnGj.exe
  2⤵
  PID:640
- C:\Windows\System\InIWfYq.exe
  C:\Windows\System\InIWfYq.exe
  2⤵
  PID:4056
- C:\Windows\System\jMZJvZh.exe
  C:\Windows\System\jMZJvZh.exe
  2⤵
  PID:12752
- C:\Windows\System\aCwyRxR.exe
  C:\Windows\System\aCwyRxR.exe
  2⤵
  PID:12956
- C:\Windows\System\MzXZUXV.exe
  C:\Windows\System\MzXZUXV.exe
  2⤵
  PID:1496
- C:\Windows\System\RcsvqZx.exe
  C:\Windows\System\RcsvqZx.exe
  2⤵
  PID:6104
- C:\Windows\System\cZvXaBs.exe
  C:\Windows\System\cZvXaBs.exe
  2⤵
  PID:2752
- C:\Windows\System\HXTBSYh.exe
  C:\Windows\System\HXTBSYh.exe
  2⤵
  PID:2780
- C:\Windows\System\ECQDSDu.exe
  C:\Windows\System\ECQDSDu.exe
  2⤵
  PID:796
- C:\Windows\System\PnBZDwa.exe
  C:\Windows\System\PnBZDwa.exe
  2⤵
  PID:1816
- C:\Windows\System\uxyvAhC.exe
  C:\Windows\System\uxyvAhC.exe
  2⤵
  PID:2312
- C:\Windows\System\DuOCQiC.exe
  C:\Windows\System\DuOCQiC.exe
  2⤵
  PID:1704
- C:\Windows\System\oDgicUa.exe
  C:\Windows\System\oDgicUa.exe
  2⤵
  PID:6396
- C:\Windows\System\FPjDUgy.exe
  C:\Windows\System\FPjDUgy.exe
  2⤵
  PID:3876
- C:\Windows\System\dZVIKwa.exe
  C:\Windows\System\dZVIKwa.exe
  2⤵
  PID:2428
- C:\Windows\System\SlSxCxN.exe
  C:\Windows\System\SlSxCxN.exe
  2⤵
  PID:6140
- C:\Windows\System\gOLpLHV.exe
  C:\Windows\System\gOLpLHV.exe
  2⤵
  PID:12496
- C:\Windows\System\GUNUqCU.exe
  C:\Windows\System\GUNUqCU.exe
  2⤵
  PID:3196
- C:\Windows\System\QgqEFKE.exe
  C:\Windows\System\QgqEFKE.exe
  2⤵
  PID:4480
- C:\Windows\System\SQffmAq.exe
  C:\Windows\System\SQffmAq.exe
  2⤵
  PID:1004
- C:\Windows\System\BNVaxxL.exe
  C:\Windows\System\BNVaxxL.exe
  2⤵
  PID:5596
- C:\Windows\System\HNysdZj.exe
  C:\Windows\System\HNysdZj.exe
  2⤵
  PID:9540
- C:\Windows\System\zOLjOTV.exe
  C:\Windows\System\zOLjOTV.exe
  2⤵
  PID:9088
- C:\Windows\System\ZhtzAjh.exe
  C:\Windows\System\ZhtzAjh.exe
  2⤵
  PID:10100
- C:\Windows\System\pLaNnug.exe
  C:\Windows\System\pLaNnug.exe
  2⤵
  PID:8088
- C:\Windows\System\nFATDBz.exe
  C:\Windows\System\nFATDBz.exe
  2⤵
  PID:10272
- C:\Windows\System\najwAqW.exe
  C:\Windows\System\najwAqW.exe
  2⤵
  PID:9332
- C:\Windows\System\lJgrPIp.exe
  C:\Windows\System\lJgrPIp.exe
  2⤵
  PID:7220
- C:\Windows\System\jrLRuRe.exe
  C:\Windows\System\jrLRuRe.exe
  2⤵
  PID:856
- C:\Windows\System\qrCpoHx.exe
  C:\Windows\System\qrCpoHx.exe
  2⤵
  PID:1196
- C:\Windows\System\NBKEuUz.exe
  C:\Windows\System\NBKEuUz.exe
  2⤵
  PID:4648
- C:\Windows\System\dCOVNMj.exe
  C:\Windows\System\dCOVNMj.exe
  2⤵
  PID:10716
- C:\Windows\System\OSBewCP.exe
  C:\Windows\System\OSBewCP.exe
  2⤵
  PID:10088
- C:\Windows\System\UUnLFng.exe
  C:\Windows\System\UUnLFng.exe
  2⤵
  PID:2344
- C:\Windows\System\rzttSxP.exe
  C:\Windows\System\rzttSxP.exe
  2⤵
  PID:7360
- C:\Windows\System\JTOBehX.exe
  C:\Windows\System\JTOBehX.exe
  2⤵
  PID:2740
- C:\Windows\System\hrZVjnA.exe
  C:\Windows\System\hrZVjnA.exe
  2⤵
  PID:3624
- C:\Windows\System\yDrjLBR.exe
  C:\Windows\System\yDrjLBR.exe
  2⤵
  PID:7696
- C:\Windows\System\qgiKYBI.exe
  C:\Windows\System\qgiKYBI.exe
  2⤵
  PID:8872
- C:\Windows\System\HLqvvJv.exe
  C:\Windows\System\HLqvvJv.exe
  2⤵
  PID:3256
- C:\Windows\System\NJPAEMH.exe
  C:\Windows\System\NJPAEMH.exe
  2⤵
  PID:6404
- C:\Windows\System\HXZYUjy.exe
  C:\Windows\System\HXZYUjy.exe
  2⤵
  PID:13112
- C:\Windows\System\pIkhdgm.exe
  C:\Windows\System\pIkhdgm.exe
  2⤵
  PID:2612
- C:\Windows\System\CSOTWFu.exe
  C:\Windows\System\CSOTWFu.exe
  2⤵
  PID:9728
- C:\Windows\System\zQQjGbG.exe
  C:\Windows\System\zQQjGbG.exe
  2⤵
  PID:12492
- C:\Windows\System\TJKJMtu.exe
  C:\Windows\System\TJKJMtu.exe
  2⤵
  PID:2276
- C:\Windows\System\iviIfjH.exe
  C:\Windows\System\iviIfjH.exe
  2⤵
  PID:9176
- C:\Windows\System\poctlHE.exe
  C:\Windows\System\poctlHE.exe
  2⤵
  PID:8504
- C:\Windows\System\iHkWyIj.exe
  C:\Windows\System\iHkWyIj.exe
  2⤵
  PID:3340
- C:\Windows\System\myfEyDf.exe
  C:\Windows\System\myfEyDf.exe
  2⤵
  PID:6924
- C:\Windows\System\peKKMXr.exe
  C:\Windows\System\peKKMXr.exe
  2⤵
  PID:9640
- C:\Windows\System\okHNYVL.exe
  C:\Windows\System\okHNYVL.exe
  2⤵
  PID:7260
- C:\Windows\System\SJacPBR.exe
  C:\Windows\System\SJacPBR.exe
  2⤵
  PID:4516
- C:\Windows\System\LhxLJvI.exe
  C:\Windows\System\LhxLJvI.exe
  2⤵
  PID:3324
- C:\Windows\System\KEXGSKZ.exe
  C:\Windows\System\KEXGSKZ.exe
  2⤵
  PID:9336
- C:\Windows\System\APYxrpK.exe
  C:\Windows\System\APYxrpK.exe
  2⤵
  PID:2968
- C:\Windows\System\FPGVbsp.exe
  C:\Windows\System\FPGVbsp.exe
  2⤵
  PID:8480
- C:\Windows\System\tqVJeAa.exe
  C:\Windows\System\tqVJeAa.exe
  2⤵
  PID:12912
- C:\Windows\System\xbKsVlP.exe
  C:\Windows\System\xbKsVlP.exe
  2⤵
  PID:13016
- C:\Windows\System\jpoBstC.exe
  C:\Windows\System\jpoBstC.exe
  2⤵
  PID:10596
- C:\Windows\System\gzrJLte.exe
  C:\Windows\System\gzrJLte.exe
  2⤵
  PID:10944
- C:\Windows\System\KkoyFpU.exe
  C:\Windows\System\KkoyFpU.exe
  2⤵
  PID:4068
- C:\Windows\System\fhzpCOE.exe
  C:\Windows\System\fhzpCOE.exe
  2⤵
  PID:11456
- C:\Windows\System\yTJSSJV.exe
  C:\Windows\System\yTJSSJV.exe
  2⤵
  PID:3664
- C:\Windows\System\AyCpoIF.exe
  C:\Windows\System\AyCpoIF.exe
  2⤵
  PID:11484
- C:\Windows\System\nxOewzs.exe
  C:\Windows\System\nxOewzs.exe
  2⤵
  PID:5024
- C:\Windows\System\KDHwbCH.exe
  C:\Windows\System\KDHwbCH.exe
  2⤵
  PID:2876
- C:\Windows\System\cBaefDA.exe
  C:\Windows\System\cBaefDA.exe
  2⤵
  PID:2724
- C:\Windows\System\aHjOwsi.exe
  C:\Windows\System\aHjOwsi.exe
  2⤵
  PID:1640
- C:\Windows\System\uNOQkHb.exe
  C:\Windows\System\uNOQkHb.exe
  2⤵
  PID:956
- C:\Windows\System\eCafuIw.exe
  C:\Windows\System\eCafuIw.exe
  2⤵
  PID:10000
- C:\Windows\System\XKMLjjh.exe
  C:\Windows\System\XKMLjjh.exe
  2⤵
  PID:1416
- C:\Windows\System\PVbkvrb.exe
  C:\Windows\System\PVbkvrb.exe
  2⤵
  PID:4900
- C:\Windows\System\FHjgYPP.exe
  C:\Windows\System\FHjgYPP.exe
  2⤵
  PID:8656
- C:\Windows\System\dsUcuuk.exe
  C:\Windows\System\dsUcuuk.exe
  2⤵
  PID:12820
- C:\Windows\System\VAokVUR.exe
  C:\Windows\System\VAokVUR.exe
  2⤵
  PID:10084
- C:\Windows\System\edatjBU.exe
  C:\Windows\System\edatjBU.exe
  2⤵
  PID:12204
- C:\Windows\System\bURgsrn.exe
  C:\Windows\System\bURgsrn.exe
  2⤵
  PID:4532
- C:\Windows\System\KwriiDt.exe
  C:\Windows\System\KwriiDt.exe
  2⤵
  PID:9256
- C:\Windows\System\suaSDVj.exe
  C:\Windows\System\suaSDVj.exe
  2⤵
  PID:11380
- C:\Windows\System\JgazAEB.exe
  C:\Windows\System\JgazAEB.exe
  2⤵
  PID:8816
- C:\Windows\System\zkRvOgw.exe
  C:\Windows\System\zkRvOgw.exe
  2⤵
  PID:8212
- C:\Windows\System\lMNqNaO.exe
  C:\Windows\System\lMNqNaO.exe
  2⤵
  PID:8904
- C:\Windows\System\nDRfzhd.exe
  C:\Windows\System\nDRfzhd.exe
  2⤵
  PID:10384
- C:\Windows\System\rZULntH.exe
  C:\Windows\System\rZULntH.exe
  2⤵
  PID:9520
- C:\Windows\System\FGSgnob.exe
  C:\Windows\System\FGSgnob.exe
  2⤵
  PID:5068
- C:\Windows\System\ciLciUb.exe
  C:\Windows\System\ciLciUb.exe
  2⤵
  PID:4556
- C:\Windows\System\llFkywQ.exe
  C:\Windows\System\llFkywQ.exe
  2⤵
  PID:5316
- C:\Windows\System\gVXzWnA.exe
  C:\Windows\System\gVXzWnA.exe
  2⤵
  PID:11332
- C:\Windows\System\JydmkMH.exe
  C:\Windows\System\JydmkMH.exe
  2⤵
  PID:5312
- C:\Windows\System\oOiYJND.exe
  C:\Windows\System\oOiYJND.exe
  2⤵
  PID:8960
- C:\Windows\System\nnjIWtK.exe
  C:\Windows\System\nnjIWtK.exe
  2⤵
  PID:9016
- C:\Windows\System\yLzLYpR.exe
  C:\Windows\System\yLzLYpR.exe
  2⤵
  PID:5356
- C:\Windows\System\pDilAZH.exe
  C:\Windows\System\pDilAZH.exe
  2⤵
  PID:5156
- C:\Windows\System\mEEeVRF.exe
  C:\Windows\System\mEEeVRF.exe
  2⤵
  PID:11324
- C:\Windows\System\NthPkmB.exe
  C:\Windows\System\NthPkmB.exe
  2⤵
  PID:2412
- C:\Windows\System\rMwxynK.exe
  C:\Windows\System\rMwxynK.exe
  2⤵
  PID:11784
- C:\Windows\System\MLcfKlR.exe
  C:\Windows\System\MLcfKlR.exe
  2⤵
  PID:10344
- C:\Windows\System\pvcoEUd.exe
  C:\Windows\System\pvcoEUd.exe
  2⤵
  PID:11760
- C:\Windows\System\fiYdhiq.exe
  C:\Windows\System\fiYdhiq.exe
  2⤵
  PID:12428
- C:\Windows\System\pjYAgVr.exe
  C:\Windows\System\pjYAgVr.exe
  2⤵
  PID:5128
- C:\Windows\System\wdsuxDe.exe
  C:\Windows\System\wdsuxDe.exe
  2⤵
  PID:3900
- C:\Windows\System\CefGceb.exe
  C:\Windows\System\CefGceb.exe
  2⤵
  PID:5536
- C:\Windows\System\lIMDEwm.exe
  C:\Windows\System\lIMDEwm.exe
  2⤵
  PID:5432
- C:\Windows\System\MgtZuUr.exe
  C:\Windows\System\MgtZuUr.exe
  2⤵
  PID:12932
- C:\Windows\System\fVdcvmI.exe
  C:\Windows\System\fVdcvmI.exe
  2⤵
  PID:5956
- C:\Windows\System\BwtkFHL.exe
  C:\Windows\System\BwtkFHL.exe
  2⤵
  PID:6060
- C:\Windows\System\JctodoD.exe
  C:\Windows\System\JctodoD.exe
  2⤵
  PID:6112
- C:\Windows\System\ERTRcTw.exe
  C:\Windows\System\ERTRcTw.exe
  2⤵
  PID:5848
- C:\Windows\System\OUmJcFo.exe
  C:\Windows\System\OUmJcFo.exe
  2⤵
  PID:11800
- C:\Windows\System\dWrZSXb.exe
  C:\Windows\System\dWrZSXb.exe
  2⤵
  PID:224
- C:\Windows\System\UIFbRrK.exe
  C:\Windows\System\UIFbRrK.exe
  2⤵
  PID:5208
- C:\Windows\System\PdarLvu.exe
  C:\Windows\System\PdarLvu.exe
  2⤵
  PID:924
- C:\Windows\System\qbyXkzx.exe
  C:\Windows\System\qbyXkzx.exe
  2⤵
  PID:6132
- C:\Windows\System\rnFYIHw.exe
  C:\Windows\System\rnFYIHw.exe
  2⤵
  PID:8524
- C:\Windows\System\hliWRLt.exe
  C:\Windows\System\hliWRLt.exe
  2⤵
  PID:5900
- C:\Windows\System\xruYHqn.exe
  C:\Windows\System\xruYHqn.exe
  2⤵
  PID:8216
- C:\Windows\System\yjUDSmU.exe
  C:\Windows\System\yjUDSmU.exe
  2⤵
  PID:7364
- C:\Windows\System\siIEMpc.exe
  C:\Windows\System\siIEMpc.exe
  2⤵
  PID:5808
- C:\Windows\System\fnMuEzm.exe
  C:\Windows\System\fnMuEzm.exe
  2⤵
  PID:6364
- C:\Windows\System\ivFDyuO.exe
  C:\Windows\System\ivFDyuO.exe
  2⤵
  PID:10568
- C:\Windows\System\QjwWvsP.exe
  C:\Windows\System\QjwWvsP.exe
  2⤵
  PID:6472
- C:\Windows\System\wxFvwES.exe
  C:\Windows\System\wxFvwES.exe
  2⤵
  PID:11956
- C:\Windows\System\LTYWmNK.exe
  C:\Windows\System\LTYWmNK.exe
  2⤵
  PID:7444
- C:\Windows\System\qdZQggT.exe
  C:\Windows\System\qdZQggT.exe
  2⤵
  PID:7084
- C:\Windows\System\EoheswY.exe
  C:\Windows\System\EoheswY.exe
  2⤵
  PID:6560
- C:\Windows\System\WhwVXvf.exe
  C:\Windows\System\WhwVXvf.exe
  2⤵
  PID:1700
- C:\Windows\System\ixOFeCQ.exe
  C:\Windows\System\ixOFeCQ.exe
  2⤵
  PID:6792
- C:\Windows\System\eqhQnqD.exe
  C:\Windows\System\eqhQnqD.exe
  2⤵
  PID:6928
- C:\Windows\System\OaVFMvo.exe
  C:\Windows\System\OaVFMvo.exe
  2⤵
  PID:10108
- C:\Windows\System\LjVeGtH.exe
  C:\Windows\System\LjVeGtH.exe
  2⤵
  PID:6936
- C:\Windows\System\zFYJyQn.exe
  C:\Windows\System\zFYJyQn.exe
  2⤵
  PID:7048
- C:\Windows\System\wjYqdvA.exe
  C:\Windows\System\wjYqdvA.exe
  2⤵
  PID:8584
- C:\Windows\System\KylwVJk.exe
  C:\Windows\System\KylwVJk.exe
  2⤵
  PID:2132
- C:\Windows\System\ZpWjJtx.exe
  C:\Windows\System\ZpWjJtx.exe
  2⤵
  PID:6292
- C:\Windows\System\RiCdPvx.exe
  C:\Windows\System\RiCdPvx.exe
  2⤵
  PID:7868
- C:\Windows\System\jZZWHyA.exe
  C:\Windows\System\jZZWHyA.exe
  2⤵
  PID:6616
- C:\Windows\System\SXnbOrF.exe
  C:\Windows\System\SXnbOrF.exe
  2⤵
  PID:9516
- C:\Windows\System\cuAIbDC.exe
  C:\Windows\System\cuAIbDC.exe
  2⤵
  PID:1096
- C:\Windows\System\WQBAyIL.exe
  C:\Windows\System\WQBAyIL.exe
  2⤵
  PID:4740
- C:\Windows\System\zqdTzwu.exe
  C:\Windows\System\zqdTzwu.exe
  2⤵
  PID:7112
- C:\Windows\System\klVaGDT.exe
  C:\Windows\System\klVaGDT.exe
  2⤵
  PID:7032
- C:\Windows\System\AOcvArs.exe
  C:\Windows\System\AOcvArs.exe
  2⤵
  PID:4988
- C:\Windows\System\DoirKlX.exe
  C:\Windows\System\DoirKlX.exe
  2⤵
  PID:6320
- C:\Windows\System\nNENmgn.exe
  C:\Windows\System\nNENmgn.exe
  2⤵
  PID:6584
- C:\Windows\System\TxWtibV.exe
  C:\Windows\System\TxWtibV.exe
  2⤵
  PID:6592
- C:\Windows\System\jHXENnk.exe
  C:\Windows\System\jHXENnk.exe
  2⤵
  PID:5664
- C:\Windows\System\hFZhNXD.exe
  C:\Windows\System\hFZhNXD.exe
  2⤵
  PID:9732
- C:\Windows\System\ixKRHSJ.exe
  C:\Windows\System\ixKRHSJ.exe
  2⤵
  PID:7228
- C:\Windows\System\kMOQnWO.exe
  C:\Windows\System\kMOQnWO.exe
  2⤵
  PID:9360
- C:\Windows\System\gEgMHTV.exe
  C:\Windows\System\gEgMHTV.exe
  2⤵
  PID:7384
- C:\Windows\System\xGlhBLX.exe
  C:\Windows\System\xGlhBLX.exe
  2⤵
  PID:9084
- C:\Windows\System\fEnaKgr.exe
  C:\Windows\System\fEnaKgr.exe
  2⤵
  PID:740
- C:\Windows\System\FKArIGh.exe
  C:\Windows\System\FKArIGh.exe
  2⤵
  PID:4192
- C:\Windows\System\ilcvdxX.exe
  C:\Windows\System\ilcvdxX.exe
  2⤵
  PID:7760
- C:\Windows\System\GmCReWV.exe
  C:\Windows\System\GmCReWV.exe
  2⤵
  PID:7708
- C:\Windows\System\ZlYMfzx.exe
  C:\Windows\System\ZlYMfzx.exe
  2⤵
  PID:7724
- C:\Windows\System\YDHRxII.exe
  C:\Windows\System\YDHRxII.exe
  2⤵
  PID:12324
- C:\Windows\System\RCJKJod.exe
  C:\Windows\System\RCJKJod.exe
  2⤵
  PID:5292
- C:\Windows\System\YJzEyPg.exe
  C:\Windows\System\YJzEyPg.exe
  2⤵
  PID:8112
- C:\Windows\System\haVGhdp.exe
  C:\Windows\System\haVGhdp.exe
  2⤵
  PID:8392
- C:\Windows\System\OWGKMpQ.exe
  C:\Windows\System\OWGKMpQ.exe
  2⤵
  PID:7996
- C:\Windows\System\YdCIJTZ.exe
  C:\Windows\System\YdCIJTZ.exe
  2⤵
  PID:7188
- C:\Windows\System\MUagvJr.exe
  C:\Windows\System\MUagvJr.exe
  2⤵
  PID:7192
- C:\Windows\System\gtYOwWd.exe
  C:\Windows\System\gtYOwWd.exe
  2⤵
  PID:5100
- C:\Windows\System\ryIPOSZ.exe
  C:\Windows\System\ryIPOSZ.exe
  2⤵
  PID:11824
- C:\Windows\System\iMHhODt.exe
  C:\Windows\System\iMHhODt.exe
  2⤵
  PID:7380
- C:\Windows\System\doQBYUd.exe
  C:\Windows\System\doQBYUd.exe
  2⤵
  PID:6456
- C:\Windows\System\oxGEnkC.exe
  C:\Windows\System\oxGEnkC.exe
  2⤵
  PID:6244
- C:\Windows\System\kCMsJzq.exe
  C:\Windows\System\kCMsJzq.exe
  2⤵
  PID:7428
- C:\Windows\System\zVSAxEQ.exe
  C:\Windows\System\zVSAxEQ.exe
  2⤵
  PID:3540
- C:\Windows\System\IaSsJoW.exe
  C:\Windows\System\IaSsJoW.exe
  2⤵
  PID:11736
- C:\Windows\System\syYPwPp.exe
  C:\Windows\System\syYPwPp.exe
  2⤵
  PID:6808
- C:\Windows\System\MmpJUNI.exe
  C:\Windows\System\MmpJUNI.exe
  2⤵
  PID:1892
- C:\Windows\System\ycSnpou.exe
  C:\Windows\System\ycSnpou.exe
  2⤵
  PID:6640
- C:\Windows\System\YsIKdTS.exe
  C:\Windows\System\YsIKdTS.exe
  2⤵
  PID:8444
- C:\Windows\System\TxkkNWK.exe
  C:\Windows\System\TxkkNWK.exe
  2⤵
  PID:6680
- C:\Windows\System\YSIIIab.exe
  C:\Windows\System\YSIIIab.exe
  2⤵
  PID:10136
- C:\Windows\System\RPCINyi.exe
  C:\Windows\System\RPCINyi.exe
  2⤵
  PID:8448
- C:\Windows\System\nYwIUmj.exe
  C:\Windows\System\nYwIUmj.exe
  2⤵
  PID:8456
- C:\Windows\System\mMjoZGi.exe
  C:\Windows\System\mMjoZGi.exe
  2⤵
  PID:8292
- C:\Windows\System\TBWPhUl.exe
  C:\Windows\System\TBWPhUl.exe
  2⤵
  PID:6644
- C:\Windows\System\muNDwIT.exe
  C:\Windows\System\muNDwIT.exe
  2⤵
  PID:7636
- C:\Windows\System\SblrDWT.exe
  C:\Windows\System\SblrDWT.exe
  2⤵
  PID:13028
- C:\Windows\System\MGMjOcg.exe
  C:\Windows\System\MGMjOcg.exe
  2⤵
  PID:8592
- C:\Windows\System\QTpkpIE.exe
  C:\Windows\System\QTpkpIE.exe
  2⤵
  PID:8616
- C:\Windows\System\FUsKzBh.exe
  C:\Windows\System\FUsKzBh.exe
  2⤵
  PID:10268
- C:\Windows\System\AESSZlv.exe
  C:\Windows\System\AESSZlv.exe
  2⤵
  PID:5220
- C:\Windows\System\saPgjSK.exe
  C:\Windows\System\saPgjSK.exe
  2⤵
  PID:6948
- C:\Windows\System\YWMobGt.exe
  C:\Windows\System\YWMobGt.exe
  2⤵
  PID:6032
- C:\Windows\System\MwkmYQu.exe
  C:\Windows\System\MwkmYQu.exe
  2⤵
  PID:10228
- C:\Windows\System\qbkJzhc.exe
  C:\Windows\System\qbkJzhc.exe
  2⤵
  PID:9136
- C:\Windows\System\anSEwYX.exe
  C:\Windows\System\anSEwYX.exe
  2⤵
  PID:8748
- C:\Windows\System\CYLOaGc.exe
  C:\Windows\System\CYLOaGc.exe
  2⤵
  PID:6232
- C:\Windows\System\vPXstzP.exe
  C:\Windows\System\vPXstzP.exe
  2⤵
  PID:7496
- C:\Windows\System\AzEZshr.exe
  C:\Windows\System\AzEZshr.exe
  2⤵
  PID:7248
- C:\Windows\System\IuoGrDm.exe
  C:\Windows\System\IuoGrDm.exe
  2⤵
  PID:8136
- C:\Windows\System\PzixyAV.exe
  C:\Windows\System\PzixyAV.exe
  2⤵
  PID:7852
- C:\Windows\System\jdSMOan.exe
  C:\Windows\System\jdSMOan.exe
  2⤵
  PID:7780
- C:\Windows\System\UxfknDu.exe
  C:\Windows\System\UxfknDu.exe
  2⤵
  PID:8108
- C:\Windows\System\mqHiZQz.exe
  C:\Windows\System\mqHiZQz.exe
  2⤵
  PID:9272
- C:\Windows\System\vZUkxaH.exe
  C:\Windows\System\vZUkxaH.exe
  2⤵
  PID:8084
- C:\Windows\System\pLaUMOM.exe
  C:\Windows\System\pLaUMOM.exe
  2⤵
  PID:5672
- C:\Windows\System\DWvfVQL.exe
  C:\Windows\System\DWvfVQL.exe
  2⤵
  PID:7980
- C:\Windows\System\eyjsfck.exe
  C:\Windows\System\eyjsfck.exe
  2⤵
  PID:7620
- C:\Windows\System\nFvHEFD.exe
  C:\Windows\System\nFvHEFD.exe
  2⤵
  PID:5916
- C:\Windows\System\WRhaBli.exe
  C:\Windows\System\WRhaBli.exe
  2⤵
  PID:9408
- C:\Windows\System\kdMwMvY.exe
  C:\Windows\System\kdMwMvY.exe
  2⤵
  PID:6004
- C:\Windows\System\RceRvrE.exe
  C:\Windows\System\RceRvrE.exe
  2⤵
  PID:6280
- C:\Windows\System\nqXBsWZ.exe
  C:\Windows\System\nqXBsWZ.exe
  2⤵
  PID:8092
- C:\Windows\System\CUTPMZf.exe
  C:\Windows\System\CUTPMZf.exe
  2⤵
  PID:9796
- C:\Windows\System\vpJYVzQ.exe
  C:\Windows\System\vpJYVzQ.exe
  2⤵
  PID:6064
- C:\Windows\System\gIGfagV.exe
  C:\Windows\System\gIGfagV.exe
  2⤵
  PID:10004
- C:\Windows\System\XNJjyod.exe
  C:\Windows\System\XNJjyod.exe
  2⤵
  PID:12672
- C:\Windows\System\ZaCmnwx.exe
  C:\Windows\System\ZaCmnwx.exe
  2⤵
  PID:7132
- C:\Windows\System\KivCEaS.exe
  C:\Windows\System\KivCEaS.exe
  2⤵
  PID:8176
- C:\Windows\System\ZBYjjwB.exe
  C:\Windows\System\ZBYjjwB.exe
  2⤵
  PID:9780
- C:\Windows\System\dPvtXrI.exe
  C:\Windows\System\dPvtXrI.exe
  2⤵
  PID:8372
- C:\Windows\System\dKYfIDs.exe
  C:\Windows\System\dKYfIDs.exe
  2⤵
  PID:9836
- C:\Windows\System\NOFsvGH.exe
  C:\Windows\System\NOFsvGH.exe
  2⤵
  PID:11248
- C:\Windows\System\iaANOWV.exe
  C:\Windows\System\iaANOWV.exe
  2⤵
  PID:4180
- C:\Windows\System\cHusxJS.exe
  C:\Windows\System\cHusxJS.exe
  2⤵
  PID:6176
- C:\Windows\System\bKWJDyX.exe
  C:\Windows\System\bKWJDyX.exe
  2⤵
  PID:10232
- C:\Windows\System\BQYikNs.exe
  C:\Windows\System\BQYikNs.exe
  2⤵
  PID:10168
- C:\Windows\System\vZHRCLd.exe
  C:\Windows\System\vZHRCLd.exe
  2⤵
  PID:9316
- C:\Windows\System\DiRGdEe.exe
  C:\Windows\System\DiRGdEe.exe
  2⤵
  PID:9400
- C:\Windows\System\NHgYmMh.exe
  C:\Windows\System\NHgYmMh.exe
  2⤵
  PID:6116
- C:\Windows\System\gfNVqzO.exe
  C:\Windows\System\gfNVqzO.exe
  2⤵
  PID:10348
- C:\Windows\System\JafUHdn.exe
  C:\Windows\System\JafUHdn.exe
  2⤵
  PID:9760
- C:\Windows\System\zSvnOeM.exe
  C:\Windows\System\zSvnOeM.exe
  2⤵
  PID:8768
- C:\Windows\System\rfoBCjl.exe
  C:\Windows\System\rfoBCjl.exe
  2⤵
  PID:10264
- C:\Windows\System\XXKQUpU.exe
  C:\Windows\System\XXKQUpU.exe
  2⤵
  PID:8004
- C:\Windows\System\ruKJGIF.exe
  C:\Windows\System\ruKJGIF.exe
  2⤵
  PID:7512
- C:\Windows\System\lEceBYj.exe
  C:\Windows\System\lEceBYj.exe
  2⤵
  PID:9380
- C:\Windows\System\mGiFefI.exe
  C:\Windows\System\mGiFefI.exe
  2⤵
  PID:7844
- C:\Windows\System\PvVhDvk.exe
  C:\Windows\System\PvVhDvk.exe
  2⤵
  PID:9388
- C:\Windows\System\pJjoQDB.exe
  C:\Windows\System\pJjoQDB.exe
  2⤵
  PID:10844
- C:\Windows\System\oYzgslN.exe
  C:\Windows\System\oYzgslN.exe
  2⤵
  PID:9440
- C:\Windows\System\ozGLuQD.exe
  C:\Windows\System\ozGLuQD.exe
  2⤵
  PID:6084
- C:\Windows\System\GPKSubk.exe
  C:\Windows\System\GPKSubk.exe
  2⤵
  PID:10876
- C:\Windows\System\SmLoMRh.exe
  C:\Windows\System\SmLoMRh.exe
  2⤵
  PID:11132
- C:\Windows\System\VSNHxIV.exe
  C:\Windows\System\VSNHxIV.exe
  2⤵
  PID:12824
- C:\Windows\System\FeKQaDW.exe
  C:\Windows\System\FeKQaDW.exe
  2⤵
  PID:5688
- C:\Windows\System\hoTdhQT.exe
  C:\Windows\System\hoTdhQT.exe
  2⤵
  PID:11028
- C:\Windows\System\QNHkqii.exe
  C:\Windows\System\QNHkqii.exe
  2⤵
  PID:7992
- C:\Windows\System\hWmqlvC.exe
  C:\Windows\System\hWmqlvC.exe
  2⤵
  PID:10012
- C:\Windows\System\Agvgidd.exe
  C:\Windows\System\Agvgidd.exe
  2⤵
  PID:10536
- C:\Windows\System\mvRBavA.exe
  C:\Windows\System\mvRBavA.exe
  2⤵
  PID:8388
- C:\Windows\System\invysCd.exe
  C:\Windows\System\invysCd.exe
  2⤵
  PID:4908
- C:\Windows\System\ktDLIaz.exe
  C:\Windows\System\ktDLIaz.exe
  2⤵
  PID:10016
- C:\Windows\System\XJlGCfk.exe
  C:\Windows\System\XJlGCfk.exe
  2⤵
  PID:11188
- C:\Windows\System\xnugZhm.exe
  C:\Windows\System\xnugZhm.exe
  2⤵
  PID:6080
- C:\Windows\System\IvIVxCo.exe
  C:\Windows\System\IvIVxCo.exe
  2⤵
  PID:8916
- C:\Windows\System\tjvVAxn.exe
  C:\Windows\System\tjvVAxn.exe
  2⤵
  PID:11148
- C:\Windows\System\XtwePHo.exe
  C:\Windows\System\XtwePHo.exe
  2⤵
  PID:6628
- C:\Windows\System\TPEUPKA.exe
  C:\Windows\System\TPEUPKA.exe
  2⤵
  PID:10820
- C:\Windows\System\tsAKkRh.exe
  C:\Windows\System\tsAKkRh.exe
  2⤵
  PID:10776
- C:\Windows\System\xiKiFVf.exe
  C:\Windows\System\xiKiFVf.exe
  2⤵
  PID:11128
- C:\Windows\System\EaIuQqb.exe
  C:\Windows\System\EaIuQqb.exe
  2⤵
  PID:7412
- C:\Windows\System\datTFVS.exe
  C:\Windows\System\datTFVS.exe
  2⤵
  PID:9132
- C:\Windows\System\SwGWQQJ.exe
  C:\Windows\System\SwGWQQJ.exe
  2⤵
  PID:11316
- C:\Windows\System\iOiqWgj.exe
  C:\Windows\System\iOiqWgj.exe
  2⤵
  PID:9924
- C:\Windows\System\hXUQZux.exe
  C:\Windows\System\hXUQZux.exe
  2⤵
  PID:11632
- C:\Windows\System\sMKqLVg.exe
  C:\Windows\System\sMKqLVg.exe
  2⤵
  PID:7524
- C:\Windows\System\yYfksFo.exe
  C:\Windows\System\yYfksFo.exe
  2⤵
  PID:11088
- C:\Windows\System\bkyHVhm.exe
  C:\Windows\System\bkyHVhm.exe
  2⤵
  PID:4044
- C:\Windows\System\rXzZUlw.exe
  C:\Windows\System\rXzZUlw.exe
  2⤵
  PID:10644
- C:\Windows\System\QIGzGqO.exe
  C:\Windows\System\QIGzGqO.exe
  2⤵
  PID:9844
- C:\Windows\System\GFneLYH.exe
  C:\Windows\System\GFneLYH.exe
  2⤵
  PID:10784
- C:\Windows\System\HsQdipU.exe
  C:\Windows\System\HsQdipU.exe
  2⤵
  PID:11284
- C:\Windows\System\nIDkjXC.exe
  C:\Windows\System\nIDkjXC.exe
  2⤵
  PID:9980
- C:\Windows\System\HaJeyWZ.exe
  C:\Windows\System\HaJeyWZ.exe
  2⤵
  PID:12104
- C:\Windows\System\yzlwYxk.exe
  C:\Windows\System\yzlwYxk.exe
  2⤵
  PID:12148
- C:\Windows\System\GlZnsnz.exe
  C:\Windows\System\GlZnsnz.exe
  2⤵
  PID:11672
- C:\Windows\System\XRStjAz.exe
  C:\Windows\System\XRStjAz.exe
  2⤵
  PID:11820
- C:\Windows\System\oFmSLfb.exe
  C:\Windows\System\oFmSLfb.exe
  2⤵
  PID:11180
- C:\Windows\System\fSZNpAV.exe
  C:\Windows\System\fSZNpAV.exe
  2⤵
  PID:11556
- C:\Windows\System\VuPjNnR.exe
  C:\Windows\System\VuPjNnR.exe
  2⤵
  PID:12276
- C:\Windows\System\liEeoZh.exe
  C:\Windows\System\liEeoZh.exe
  2⤵
  PID:11600
- C:\Windows\System\BRcTfHO.exe
  C:\Windows\System\BRcTfHO.exe
  2⤵
  PID:11668
- C:\Windows\System\rOlDunh.exe
  C:\Windows\System\rOlDunh.exe
  2⤵
  PID:9120
- C:\Windows\System\lhfGTLf.exe
  C:\Windows\System\lhfGTLf.exe
  2⤵
  PID:11828
- C:\Windows\System\SnnGHth.exe
  C:\Windows\System\SnnGHth.exe
  2⤵
  PID:10796
- C:\Windows\System\orZNqaw.exe
  C:\Windows\System\orZNqaw.exe
  2⤵
  PID:12256
- C:\Windows\System\BtWqVab.exe
  C:\Windows\System\BtWqVab.exe
  2⤵
  PID:6088
- C:\Windows\System\eGfglWs.exe
  C:\Windows\System\eGfglWs.exe
  2⤵
  PID:10896
- C:\Windows\System\mToRqEx.exe
  C:\Windows\System\mToRqEx.exe
  2⤵
  PID:10296
- C:\Windows\System\vqUUKUN.exe
  C:\Windows\System\vqUUKUN.exe
  2⤵
  PID:11024
- C:\Windows\System\woBicTJ.exe
  C:\Windows\System\woBicTJ.exe
  2⤵
  PID:9156
- C:\Windows\System\cXMNHCy.exe
  C:\Windows\System\cXMNHCy.exe
  2⤵
  PID:12588
- C:\Windows\System\HnTlHZe.exe
  C:\Windows\System\HnTlHZe.exe
  2⤵
  PID:10760
- C:\Windows\System\lqosbRt.exe
  C:\Windows\System\lqosbRt.exe
  2⤵
  PID:13068
- C:\Windows\System\EyBulgW.exe
  C:\Windows\System\EyBulgW.exe
  2⤵
  PID:4392
- C:\Windows\System\lRQgaGQ.exe
  C:\Windows\System\lRQgaGQ.exe
  2⤵
  PID:12828
- C:\Windows\System\rflwTfL.exe
  C:\Windows\System\rflwTfL.exe
  2⤵
  PID:1156
- C:\Windows\System\LZTqkHY.exe
  C:\Windows\System\LZTqkHY.exe
  2⤵
  PID:11832
- C:\Windows\System\OVYISnO.exe
  C:\Windows\System\OVYISnO.exe
  2⤵
  PID:6984
- C:\Windows\System\RYYPewW.exe
  C:\Windows\System\RYYPewW.exe
  2⤵
  PID:11976
- C:\Windows\System\QCstSbi.exe
  C:\Windows\System\QCstSbi.exe
  2⤵
  PID:10020
- C:\Windows\System\dMLpqZM.exe
  C:\Windows\System\dMLpqZM.exe
  2⤵
  PID:11496
- C:\Windows\System\EcRCXMz.exe
  C:\Windows\System\EcRCXMz.exe
  2⤵
  PID:9040
- C:\Windows\System\FNToHjy.exe
  C:\Windows\System\FNToHjy.exe
  2⤵
  PID:12760
- C:\Windows\System\hsSxxPj.exe
  C:\Windows\System\hsSxxPj.exe
  2⤵
  PID:8560
- C:\Windows\System\uZqthpF.exe
  C:\Windows\System\uZqthpF.exe
  2⤵
  PID:11572
- C:\Windows\System\pEeOAiq.exe
  C:\Windows\System\pEeOAiq.exe
  2⤵
  PID:6276
- C:\Windows\System\OkEMXcI.exe
  C:\Windows\System\OkEMXcI.exe
  2⤵
  PID:11704
- C:\Windows\System\XBEsyFK.exe
  C:\Windows\System\XBEsyFK.exe
  2⤵
  PID:12432
- C:\Windows\System\mxebriK.exe
  C:\Windows\System\mxebriK.exe
  2⤵
  PID:4836
- C:\Windows\System\URKpCUe.exe
  C:\Windows\System\URKpCUe.exe
  2⤵
  PID:9652
- C:\Windows\System\alxGHfZ.exe
  C:\Windows\System\alxGHfZ.exe
  2⤵
  PID:12160
- C:\Windows\System\eCODylB.exe
  C:\Windows\System\eCODylB.exe
  2⤵
  PID:13336
- C:\Windows\System\UKDeUgG.exe
  C:\Windows\System\UKDeUgG.exe
  2⤵
  PID:13364
- C:\Windows\System\slajkut.exe
  C:\Windows\System\slajkut.exe
  2⤵
  PID:13396
- C:\Windows\System\LEphZkl.exe
  C:\Windows\System\LEphZkl.exe
  2⤵
  PID:13432
- C:\Windows\System\utZpZSY.exe
  C:\Windows\System\utZpZSY.exe
  2⤵
  PID:13452
- C:\Windows\System\pKasDss.exe
  C:\Windows\System\pKasDss.exe
  2⤵
  PID:13480
- C:\Windows\System\lSfuQuM.exe
  C:\Windows\System\lSfuQuM.exe
  2⤵
  PID:13516
- C:\Windows\System\gQPPKhK.exe
  C:\Windows\System\gQPPKhK.exe
  2⤵
  PID:13556
- C:\Windows\System\oWAEzqx.exe
  C:\Windows\System\oWAEzqx.exe
  2⤵
  PID:13572
- C:\Windows\System\CLzoeYd.exe
  C:\Windows\System\CLzoeYd.exe
  2⤵
  PID:13600
- C:\Windows\System\gSKCxxB.exe
  C:\Windows\System\gSKCxxB.exe
  2⤵
  PID:13624
- C:\Windows\System\MOmceft.exe
  C:\Windows\System\MOmceft.exe
  2⤵
  PID:13656
- C:\Windows\System\rsjYHeM.exe
  C:\Windows\System\rsjYHeM.exe
  2⤵
  PID:13688
- C:\Windows\System\NriXqkT.exe
  C:\Windows\System\NriXqkT.exe
  2⤵
  PID:13724
- C:\Windows\System\JezLgqU.exe
  C:\Windows\System\JezLgqU.exe
  2⤵
  PID:13756
- C:\Windows\System\LRpTGZV.exe
  C:\Windows\System\LRpTGZV.exe
  2⤵
  PID:13776
- C:\Windows\System\jJVeNJd.exe
  C:\Windows\System\jJVeNJd.exe
  2⤵
  PID:13812
- C:\Windows\System\DNYoaIe.exe
  C:\Windows\System\DNYoaIe.exe
  2⤵
  PID:13844
- C:\Windows\System\cgCYVyJ.exe
  C:\Windows\System\cgCYVyJ.exe
  2⤵
  PID:13868
- C:\Windows\System\HkcpIuJ.exe
  C:\Windows\System\HkcpIuJ.exe
  2⤵
  PID:13900
- C:\Windows\System\rejmLSs.exe
  C:\Windows\System\rejmLSs.exe
  2⤵
  PID:13932
- C:\Windows\System\YwVuwIL.exe
  C:\Windows\System\YwVuwIL.exe
  2⤵
  PID:13948
- C:\Windows\System\YXaRiqr.exe
  C:\Windows\System\YXaRiqr.exe
  2⤵
  PID:13980
- C:\Windows\System\ZCIeUBG.exe
  C:\Windows\System\ZCIeUBG.exe
  2⤵
  PID:14012
- C:\Windows\System\oZyrOoZ.exe
  C:\Windows\System\oZyrOoZ.exe
  2⤵
  PID:14048
- C:\Windows\System\fBJsDmn.exe
  C:\Windows\System\fBJsDmn.exe
  2⤵
  PID:14064
- C:\Windows\System\LcBNsuy.exe
  C:\Windows\System\LcBNsuy.exe
  2⤵
  PID:14092
- C:\Windows\System\dtAnGsg.exe
  C:\Windows\System\dtAnGsg.exe
  2⤵
  PID:14128
- C:\Windows\System\uVYDltH.exe
  C:\Windows\System\uVYDltH.exe
  2⤵
  PID:14156
- C:\Windows\System\xjkKWhi.exe
  C:\Windows\System\xjkKWhi.exe
  2⤵
  PID:14184
- C:\Windows\System\MErPDcF.exe
  C:\Windows\System\MErPDcF.exe
  2⤵
  PID:14212
- C:\Windows\System\cpXfAwW.exe
  C:\Windows\System\cpXfAwW.exe
  2⤵
  PID:14240
- C:\Windows\System\MHwoqlO.exe
  C:\Windows\System\MHwoqlO.exe
  2⤵
  PID:14332
- C:\Windows\System\GIEtdVW.exe
  C:\Windows\System\GIEtdVW.exe
  2⤵
  PID:13344
- C:\Windows\System\NpjRWNg.exe
  C:\Windows\System\NpjRWNg.exe
  2⤵
  PID:13352
- C:\Windows\System\cAwdtyg.exe
  C:\Windows\System\cAwdtyg.exe
  2⤵
  PID:13428
- C:\Windows\System\kLQKdNz.exe
  C:\Windows\System\kLQKdNz.exe
  2⤵
  PID:13444
- C:\Windows\System\mZZFPsj.exe
  C:\Windows\System\mZZFPsj.exe
  2⤵
  PID:13468
- C:\Windows\System\VwrHfbN.exe
  C:\Windows\System\VwrHfbN.exe
  2⤵
  PID:13616
- C:\Windows\System\qcHjwtP.exe
  C:\Windows\System\qcHjwtP.exe
  2⤵
  PID:13648
- C:\Windows\System\fSvMbkk.exe
  C:\Windows\System\fSvMbkk.exe
  2⤵
  PID:13696
- C:\Windows\System\SjSVPZa.exe
  C:\Windows\System\SjSVPZa.exe
  2⤵
  PID:13736
- C:\Windows\System\NxICgXD.exe
  C:\Windows\System\NxICgXD.exe
  2⤵
  PID:13772
- C:\Windows\System\dCECfvA.exe
  C:\Windows\System\dCECfvA.exe
  2⤵
  PID:13856
- C:\Windows\System\TveNHUH.exe
  C:\Windows\System\TveNHUH.exe
  2⤵
  PID:14024
- C:\Windows\System\objxypR.exe
  C:\Windows\System\objxypR.exe
  2⤵
  PID:14120
- C:\Windows\System\UFhBYdm.exe
  C:\Windows\System\UFhBYdm.exe
  2⤵
  PID:14192
- C:\Windows\System\obcVZMV.exe
  C:\Windows\System\obcVZMV.exe
  2⤵
  PID:13448
- C:\Windows\System\WEQVyON.exe
  C:\Windows\System\WEQVyON.exe
  2⤵
  PID:14304
- C:\Windows\System\ESmxnuZ.exe
  C:\Windows\System\ESmxnuZ.exe
  2⤵
  PID:14252
- C:\Windows\System\dRCBwdt.exe
  C:\Windows\System\dRCBwdt.exe
  2⤵
  PID:14300
- C:\Windows\System\JsApurH.exe
  C:\Windows\System\JsApurH.exe
  2⤵
  PID:10520
- C:\Windows\System\nhZKBsg.exe
  C:\Windows\System\nhZKBsg.exe
  2⤵
  PID:13496
- C:\Windows\System\gGXnbmj.exe
  C:\Windows\System\gGXnbmj.exe
  2⤵
  PID:13708
- C:\Windows\System\tlhdiPJ.exe
  C:\Windows\System\tlhdiPJ.exe
  2⤵
  PID:13376
- C:\Windows\System\oMagjCI.exe
  C:\Windows\System\oMagjCI.exe
  2⤵
  PID:13908
- C:\Windows\System\NtXBWdd.exe
  C:\Windows\System\NtXBWdd.exe
  2⤵
  PID:14076
- C:\Windows\System\byhhQXs.exe
  C:\Windows\System\byhhQXs.exe
  2⤵
  PID:14236
- C:\Windows\System\cLSRDvR.exe
  C:\Windows\System\cLSRDvR.exe
  2⤵
  PID:14320
- C:\Windows\System\XaLIjVn.exe
  C:\Windows\System\XaLIjVn.exe
  2⤵
  PID:13528
- C:\Windows\System\uytZfEe.exe
  C:\Windows\System\uytZfEe.exe
  2⤵
  PID:13764
- C:\Windows\System\rLSALSH.exe
  C:\Windows\System\rLSALSH.exe
  2⤵
  PID:14148
- C:\Windows\System\yvTFPTv.exe
  C:\Windows\System\yvTFPTv.exe
  2⤵
  PID:13232
- C:\Windows\System\DMGKmwQ.exe
  C:\Windows\System\DMGKmwQ.exe
  2⤵
  PID:14104
- C:\Windows\System\rJRhTNU.exe
  C:\Windows\System\rJRhTNU.exe
  2⤵
  PID:13236
- C:\Windows\System\PoMAejZ.exe
  C:\Windows\System\PoMAejZ.exe
  2⤵
  PID:14352
- C:\Windows\System\yYydlSf.exe
  C:\Windows\System\yYydlSf.exe
  2⤵
  PID:14380
- C:\Windows\System\uQEtPtp.exe
  C:\Windows\System\uQEtPtp.exe
  2⤵
  PID:14408
- C:\Windows\System\YJvRcuI.exe
  C:\Windows\System\YJvRcuI.exe
  2⤵
  PID:14424
- C:\Windows\System\ZDDTeGx.exe
  C:\Windows\System\ZDDTeGx.exe
  2⤵
  PID:14452
- C:\Windows\System\EMFAGAs.exe
  C:\Windows\System\EMFAGAs.exe
  2⤵
  PID:14480
- C:\Windows\System\scDNnGh.exe
  C:\Windows\System\scDNnGh.exe
  2⤵
  PID:14516
- C:\Windows\System\CleYoZE.exe
  C:\Windows\System\CleYoZE.exe
  2⤵
  PID:14548
- C:\Windows\System\vCEoZvn.exe
  C:\Windows\System\vCEoZvn.exe
  2⤵
  PID:14564
- C:\Windows\System\nmJkMNJ.exe
  C:\Windows\System\nmJkMNJ.exe
  2⤵
  PID:14600
- C:\Windows\System\LrmMxfp.exe
  C:\Windows\System\LrmMxfp.exe
  2⤵
  PID:14636
- C:\Windows\System\MdkHBju.exe
  C:\Windows\System\MdkHBju.exe
  2⤵
  PID:14684
- C:\Windows\System\AkUKGKj.exe
  C:\Windows\System\AkUKGKj.exe
  2⤵
  PID:14712
- C:\Windows\System\KWDPEZw.exe
  C:\Windows\System\KWDPEZw.exe
  2⤵
  PID:14732
- C:\Windows\System\FvOkZMg.exe
  C:\Windows\System\FvOkZMg.exe
  2⤵
  PID:14776
- C:\Windows\System\sBgBSYD.exe
  C:\Windows\System\sBgBSYD.exe
  2⤵
  PID:14792
- C:\Windows\System\zSRzVTl.exe
  C:\Windows\System\zSRzVTl.exe
  2⤵
  PID:14824
- C:\Windows\System\bwPmYlH.exe
  C:\Windows\System\bwPmYlH.exe
  2⤵
  PID:14856
- C:\Windows\System\vBDUwCi.exe
  C:\Windows\System\vBDUwCi.exe
  2⤵
  PID:14880
- C:\Windows\System\NpxavLU.exe
  C:\Windows\System\NpxavLU.exe
  2⤵
  PID:14904
- C:\Windows\System\YVNLAtg.exe
  C:\Windows\System\YVNLAtg.exe
  2⤵
  PID:14920
- C:\Windows\System\vscLJxn.exe
  C:\Windows\System\vscLJxn.exe
  2⤵
  PID:14936
- C:\Windows\System\xfuIBOR.exe
  C:\Windows\System\xfuIBOR.exe
  2⤵
  PID:14952
- C:\Windows\System\VbCsDwj.exe
  C:\Windows\System\VbCsDwj.exe
  2⤵
  PID:14996
- C:\Windows\System\lELBEsq.exe
  C:\Windows\System\lELBEsq.exe
  2⤵
  PID:15032
- C:\Windows\System\salnlqX.exe
  C:\Windows\System\salnlqX.exe
  2⤵
  PID:15060
- C:\Windows\System\nmnSILo.exe
  C:\Windows\System\nmnSILo.exe
  2⤵
  PID:15084
- C:\Windows\System\WooKnCk.exe
  C:\Windows\System\WooKnCk.exe
  2⤵
  PID:15116
- C:\Windows\System\mRGDfrS.exe
  C:\Windows\System\mRGDfrS.exe
  2⤵
  PID:15144
- C:\Windows\System\OQseNZq.exe
  C:\Windows\System\OQseNZq.exe
  2⤵
  PID:15180
- C:\Windows\System\koereyH.exe
  C:\Windows\System\koereyH.exe
  2⤵
  PID:15212
- C:\Windows\System\vRDtysH.exe
  C:\Windows\System\vRDtysH.exe
  2⤵
  PID:15248
- C:\Windows\System\MxyybJP.exe
  C:\Windows\System\MxyybJP.exe
  2⤵
  PID:15280
- C:\Windows\System\qUJxUel.exe
  C:\Windows\System\qUJxUel.exe
  2⤵
  PID:15316
- C:\Windows\System\eNJKgkE.exe
  C:\Windows\System\eNJKgkE.exe
  2⤵
  PID:15336
- C:\Windows\System\MHMycSC.exe
  C:\Windows\System\MHMycSC.exe
  2⤵
  PID:14348
- C:\Windows\System\UcqWZld.exe
  C:\Windows\System\UcqWZld.exe
  2⤵
  PID:14416
- C:\Windows\System\LKCkJpn.exe
  C:\Windows\System\LKCkJpn.exe
  2⤵
  PID:14492
- C:\Windows\System\XCePPID.exe
  C:\Windows\System\XCePPID.exe
  2⤵
  PID:14540
- C:\Windows\System\hRrVmUb.exe
  C:\Windows\System\hRrVmUb.exe
  2⤵
  PID:14608
- C:\Windows\System\QQXTEOg.exe
  C:\Windows\System\QQXTEOg.exe
  2⤵
  PID:14652
- C:\Windows\System\JDPHRuj.exe
  C:\Windows\System\JDPHRuj.exe
  2⤵
  PID:14748
- C:\Windows\System\xflmyLk.exe
  C:\Windows\System\xflmyLk.exe
  2⤵
  PID:14872
- C:\Windows\System\JjnHxFL.exe
  C:\Windows\System\JjnHxFL.exe
  2⤵
  PID:14536
- C:\Windows\System\RsVRFsg.exe
  C:\Windows\System\RsVRFsg.exe
  2⤵
  PID:12968
- C:\Windows\System\FXteVLj.exe
  C:\Windows\System\FXteVLj.exe
  2⤵
  PID:15232
- C:\Windows\System\qbMQpNq.exe
  C:\Windows\System\qbMQpNq.exe
  2⤵
  PID:10224
- C:\Windows\System\eIHLUPA.exe
  C:\Windows\System\eIHLUPA.exe
  2⤵
  PID:15008
- C:\Windows\System\MmsHCWZ.exe
  C:\Windows\System\MmsHCWZ.exe
  2⤵
  PID:15168
- C:\Windows\System\oGNGjjZ.exe
  C:\Windows\System\oGNGjjZ.exe
  2⤵
  PID:8044
- C:\Windows\System\ObLPpAy.exe
  C:\Windows\System\ObLPpAy.exe
  2⤵
  PID:15296
- C:\Windows\System\xwxykII.exe
  C:\Windows\System\xwxykII.exe
  2⤵
  PID:14400
- C:\Windows\System\qWxyJFr.exe
  C:\Windows\System\qWxyJFr.exe
  2⤵
  PID:14808
- C:\Windows\System\fgkAUGN.exe
  C:\Windows\System\fgkAUGN.exe
  2⤵
  PID:14376
- C:\Windows\System\PZKlUqY.exe
  C:\Windows\System\PZKlUqY.exe
  2⤵
  PID:9988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4drwxrp0.pku.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AIolGbV.exe

Filesize
2.0MB

MD5
17dda08be041d2c26cede26d9c2d31ca

SHA1
b389e445560f1a92e0b2ce1ee8b52c85a648827a

SHA256
52bcc47f4deb53979a4549c54b8136ce797247c7d8d5b6a027c45f73da876bfe

SHA512
43214b539cb44371cf64c1d4d78a527c726f5c3364d5b8978e6c29708cd883dd316e38e2e8252af856e9175987594ba2c04e8af7080442c6758f0a01911dd5fa

Download Submit
C:\Windows\System\AyEUylP.exe

Filesize
2.0MB

MD5
4687e006064809c1e8e40991cce3ca2c

SHA1
3fb2e4277057aa97603ec099ed914815fc9b6b9f

SHA256
a13ff6608deea0a8a7380d8283ee81f8c528ff435ec0f3afbe077a015db15625

SHA512
c179d037d34d4f12509601974702cf8373492d68deed4d9eebfbf782f241f44dbcc99cc0745f4705d30d2bfafc64c4c87fa50c72082996bd93de0861b7e0435c

Download Submit
C:\Windows\System\DEUHPgP.exe

Filesize
2.0MB

MD5
0ce71a3bf3b51fa6b28279c240deba70

SHA1
7a478c7a61dc009a07bdfe72eac32a45079525fc

SHA256
65bcb17b66d1c65d79d9fb83f6780edd0aba17c637b9f98e207e71fc61d2a24c

SHA512
0ba2cfb984f4dbd13e018e6077028da20159ef1a19f25b3f787042fa5da1a9b189529ae476fc7f802e04b436aec4382cbe0b77265c6732a92332247deb89ed32

Download Submit
C:\Windows\System\DhGpZNe.exe

Filesize
2.0MB

MD5
17a6f6a4962b736422a0b5d49c1ec84e

SHA1
43d87681b6d411c1988117dee5121d86951fe52e

SHA256
e0da7b870558c6923e82e8accf375ce7d02a9f73ecb8adb56d9ec8b48c61faf8

SHA512
8cd520bd16d5cbd190db5055ed984483951dba59e210630beb63dc0747f296defc8609df1671cc134fbdf43b44e9acc2e7303392ced42a04a1a214751f753957

Download Submit
C:\Windows\System\EWCZJzl.exe

Filesize
2.0MB

MD5
524240a95d8b57d543cdf6e9877821be

SHA1
35a9ab9a4ebe4bd8a0d409981c129b1547673167

SHA256
b110ccfbc49d71eab18986e234d0bc6c6c78493cbaf2874c85ca29b8c9d86ccf

SHA512
dedebd515ccb002d87a5ccbe96bb23739726d12622d3d0adf2ae8153d08f4955f9a099f4d9132425724283eaa70c74a254d8b2e386f85c85e8aa67f9a1c40c38

Download Submit
C:\Windows\System\FOLBclZ.exe

Filesize
2.0MB

MD5
8bdad69453384981c8f07fbdb80f6e4b

SHA1
f74db73a567c5c7e14619c8c54911b43bf21c715

SHA256
d1d21173ccbdf3008fe73426127e3a764aee5b0cc41ffc0fdc97af90daf3e0d1

SHA512
2b218a387e09ba353026b0d0fafd2e3ad33206237b710c09eabaf5bbb4c5d30ef189cc3b85d3a4184ccacfeab8ef6a3cf092ea47cf1c49534b32cf71c3d97ee7

Download Submit
C:\Windows\System\HodqzUJ.exe

Filesize
2.0MB

MD5
1000e8b304850df38924a4c7be0a5d5d

SHA1
bb172e72c6c8cfbbd91568743cec79faf92a3727

SHA256
9bb57d6c93efbffb4bf2d2068ec9926cd65855655d4f946ff2911a46bde67e80

SHA512
81b512a5cf67707a3a5c6271bd86e43bc6a4f59c35a6fb06fb89bab86fa4215d7c68fd90d637fa966b0e16fc5051fd1012cbb08dfd408a30bc89c31f2230c86c

Download Submit
C:\Windows\System\JHbZglM.exe

Filesize
2.0MB

MD5
6f1e9b852801bd660e3d95cedee98b5a

SHA1
cf5643b2a941cd0c0458bb16a3fbbf1643079824

SHA256
c140be2af8b838ad897e2c7be5732adb9c0f604201aded047866bf53f318c357

SHA512
7a0abb613be2feb0f678fd7e734398c671982c15ddc8f4c2b74aa73e6e69c0afec120bbd8358916d3a97ab2bc1c1494bee8463422388c91cdce09d321d32ec62

Download Submit
C:\Windows\System\JpXhsGM.exe

Filesize
2.0MB

MD5
5ed561047fdd8541de6c0e9ee63fc79f

SHA1
f80a35c47806b460002fb86dcd2090dfe6f4fec9

SHA256
f331ec164049d8479b8cb9c33f478aaed430d9040d96908d0335350b4d401dc7

SHA512
c7a14daf9f3d26deb9c9919b042774da21c69c3b15db008d5898693e11fa5818d4aee23ff0ca52b4f7f4796545c4f49d5a5a6cee095b0626d6a83981aefef7a9

Download Submit
C:\Windows\System\LBekIBp.exe

Filesize
2.0MB

MD5
40ca9a2f6d7e380523fc3c3fb64867a7

SHA1
af2429843025b3207b2e7742e07f38197267fa8e

SHA256
35ad304a2e919e399ba72b1e9e28fa9d55dab24447ad84aff1c9b73dca9385a4

SHA512
a66d2d996e7e79e7db2990b85c5a491f467a99400d7a95ba348ef6cf1459c7a3bc7a1865b8acca0a72b3e16f17192927070fc1214156b27f9f3eb516702714af

Download Submit
C:\Windows\System\LaBuDoB.exe

Filesize
2.0MB

MD5
637dd3743aefab4686c72eac883d7d9e

SHA1
16fc390dcdaae88615cc2f3e131d5e49f7a2002b

SHA256
b1ccdfa03ad9c1910b518cf6b2750c5c670937f74c98a35bf67fe9ffbfb5fdad

SHA512
aaca539f9923b3c416e9d10582d8e421d830e1c8ef4a44f71805650846c086042ddb9cd74f48176c4e5fedbfcada401963591bc83cab469c3b8e90a28f084b3c

Download Submit
C:\Windows\System\MiZQyYb.exe

Filesize
2.0MB

MD5
6e67806a7120a989db8bb9bb7f9cdd0b

SHA1
43d3de01b88eaa68bb3bbabbfb2470a6bae0a6dd

SHA256
ddf6473ab8796d6c99fdeb37485213a61610bbc0dce8e555643dd3b67332e8df

SHA512
03d668b2126ff1d9bf366dc398545984c94de197a35e018ad33e874ffcd224604d9b7ad229e263e3a7fe97a237cf0a913ae5ab71d9c1ca0646c57005491885c9

Download Submit
C:\Windows\System\PCdQpnj.exe

Filesize
2.0MB

MD5
5e89ddb73ec0c275c01a1505f4f8e025

SHA1
58025f8557115c760ec6b0fed89b463abacb80bd

SHA256
24f1648e08512319bf4685d3a63ce7b5e46691db5643c23908deaa6c87947842

SHA512
cce069e0e2021b480c2877a718ca8e404e538669bd0b2245b86fb67f46283c300b0d0584f88aee352109fcc1632545cdd90188cf985da21fc8446cd7e8587e77

Download Submit
C:\Windows\System\PsbXCSC.exe

Filesize
2.0MB

MD5
9a52425907b66efa625bd5261cde0f6c

SHA1
17ee6787a5c1e916aa49a4d29eacddfc9f10e3bf

SHA256
7bbafb46b172929db2b0f4cf5df0ca910973958d9279379ff2c922e9afa05670

SHA512
5c1df794239b9954923cab66994838f88aec7a7a5a381aac7637ee3028429c906b2199fcc67994c13b26c808cae38365f95decd5227845ced0df6f14edced563

Download Submit
C:\Windows\System\QYdfdUI.exe

Filesize
2.0MB

MD5
4b316014a349d36cf6f4770ddc95cbe2

SHA1
aec2883c2357c28cbeaf5b861397ea0e52fa5049

SHA256
d16b4d8504764e8e416645e4877949a8a82737ce7aa5d1b91fe6a4885d22ad2f

SHA512
3e0009692c2317c041035714298be9c304701603242ed5ca28ac83f98c3915255a229bff65521e25c47c1684358b331937063b0502e1fc270f8adba0e90c2922

Download Submit
C:\Windows\System\RyzXWXU.exe

Filesize
2.0MB

MD5
0f6a792d1533c254d80b2ceaeba1ebe0

SHA1
e19b99b9c92ece459f272e6e22b577d0b5aa1e64

SHA256
c0dfc53a0f34717bd694c692ebb3c491178a8e27a8e5ca6cdfb13f1c4b10b556

SHA512
7fcecba09cd693b22dea1325e1cfd78048d9044b3efa5e452751ceb8a95523da47ab3a681492e3a5a29b118b4bc158d4f2a28e6d278b0954baa8729d3ce28907

Download Submit
C:\Windows\System\TUJVUhJ.exe

Filesize
18B

MD5
4452918af7e3350d7249e786b2650dc8

SHA1
14489853a08fcec2fb1b6609a05309cfca8eb81e

SHA256
0e531baca420ecd71ca59e22dbc5c00753ae42a7e71a1490508b6ecb1af9fea7

SHA512
94a7d3c4b0d905c93c7a89b6b5b0bdfd90faf7e50eb45b04fb676a2f329a18d749d20543583ed31ecb888f4cec9ef675bc9990f34c577019bf93cc01db10d9b1

Download Submit
C:\Windows\System\TcNQlEn.exe

Filesize
2.0MB

MD5
2258d9686496fa3b91cfc02b4fc4e7fb

SHA1
53df8f9266225434ec04589794225280821fe793

SHA256
e5f487594c12015ec0004c9d159b548b54c37f6770f241c05c4a649f9dbbe40e

SHA512
fc3a1e6453b86c107f3f939d33f3a7d02d23b4e7f925a861f34503e81f28500d62010228fb0994c00a1621d6e190e7b47ac9e05226d003b27637b5d1803f90d3

Download Submit
C:\Windows\System\TyQzxhI.exe

Filesize
2.0MB

MD5
4f5a2363d0060a625e4afbc81422fdbc

SHA1
eb68e94533005797411ef88facadf611c6741d6b

SHA256
013d36778f9eff4e4722fa7e3ea52fac2f8d5ade02457d9945b7c05823d25ab7

SHA512
77b4e520ce3be62bfd79673aa09015b489deed3312a8de17336bc24c26d2dc07dcd27a3b0c8856eb812a128d237e14a1af8906004c8517ee83de7fb1aa4ddd72

Download Submit
C:\Windows\System\WBRTipi.exe

Filesize
2.0MB

MD5
e651cc878e98ab92462b413c8c4a237e

SHA1
7e5b2feedf03c97fc2c3c24af0c9ecc78032ce9a

SHA256
677384eaea4db9e23a46ebbe5da1a71a990a4609e3a6a4fea2a965250c4eb211

SHA512
a5c9b886e96e9b09dd16edca76114d37b2085c818e9ded84eee56484b40c8207de98fc41074f177053214b3f387b7eb41d48eb7cda973429f28812d054959074

Download Submit
C:\Windows\System\WycMCQt.exe

Filesize
2.0MB

MD5
24f0be91b89105478defa28a89e0ae92

SHA1
4eac6fbf65f9ba5cb032d3cc512daa5f81fc4fe0

SHA256
269a3f573334a01200b6b5a9c8f248728ec806bfee4e9533066ec49f3c13d990

SHA512
529ffd7713d79a7c1159b08545d9a40fc4c67b2255ab86ece8d18904de1452e7d47c54f1c997d3b41152652988c6fcc5dbf3dbc94d5251f208be31f7ce4dfd68

Download Submit
C:\Windows\System\ZxQvPSf.exe

Filesize
2.0MB

MD5
cc4f52372633a8c0a4dd2380d6de2223

SHA1
f000dbd6a3dc5ca08db62ae7498128418da0d803

SHA256
d1e6b071bdb5a0f3f007c0c30cb6350379d14a1fca9e6f59450fe63f18aef0cd

SHA512
7be6873c8a8697a69d953746fa0833a4cf064552bce26e464630dfdc391f69d31591aa32cef7564267f5a8850f90566c004cdff638f0510ff805ee2576ff833e

Download Submit
C:\Windows\System\axlSBqw.exe

Filesize
2.0MB

MD5
bd94d32c8f00651f1196cd5f8402fdc5

SHA1
89827db8d3563c3984c0aadcb64b1831a6f76c42

SHA256
ae1450d85f095f0b26392c18634d4d2b0ac5c332b7e9e9d4486288337a005362

SHA512
dbdfc5d16e7d0433fb78c39695adda47ece831f060751e23621151a91f67bdcf77613f085f6604dcc326ef976076842f513acc02810d26c495566bf0ac541d23

Download Submit
C:\Windows\System\bBZOzlM.exe

Filesize
8B

MD5
19ed64bb534b635cfa50cc16b1874cf7

SHA1
5c0404d61b244586dd5161fd10780e683f60a61a

SHA256
99ea2dfb150b11a8df956a45e902b0f69fce164befa327de3d842dcc743731fc

SHA512
da7bd84c923486fc3967a32dfc6f3bb72abb428f58026de753a5604478f8874fee1d06bc289f924ed881a5baac503208c3c1a904086e530168fc6233b9b05425

Download Submit
C:\Windows\System\fnHNdmc.exe

Filesize
2.0MB

MD5
7127c89fccd9bc58ef84a328c03c0bf0

SHA1
e3d0033c38374e15bd20b83392d8c320381e207c

SHA256
d5ae189fd8a6e490a5bb38a2d9cf855a4679e495a5cb5f1d5f3caa7725f94d58

SHA512
c37042a7f7e2b5ee0c1488724b7660a9606a7f094b60a749b294cf7112c3b482c1b143d712214811143e6c6912959fd6b00f6b3c4e58498373046b34a7aeb109

Download Submit
C:\Windows\System\fxELRjO.exe

Filesize
2.0MB

MD5
d5294ffbb7a5d5b66ea389eb293500ab

SHA1
ebbe16e8c608df23f1e1d275f9cf70341b05ffc4

SHA256
182bc229787bd106fdba6dfbfd72f8cd5861c3f1bc1e31c2a477e3c2091dbceb

SHA512
3a3dfb4e70ded7be38a837bce55b98c4cb3d16a62fdaf89c0973a1d199d3106c107ea63229fe6acd2595678c67159778cce3978637cf02f0d15f2b5c0e8cb3e4

Download Submit
C:\Windows\System\iqgObNf.exe

Filesize
2.0MB

MD5
f1b24803d4b19cd683d409318c877891

SHA1
44b8a27adf08f5b73d41791e75174a96adafea06

SHA256
79e383441df62eddcb959758cad8c80e4669f7e057b1353e7446f09a8dd5f35d

SHA512
e3aca8a43f22cde3621120d83252af0dbf135b5f52b5fc15f9cabeab320fba239e69f9874adc7d22d05447d4fef23e5033d26423e4d93ad7b335592c0760f4d6

Download Submit
C:\Windows\System\kGrjRjk.exe

Filesize
2.0MB

MD5
9b90f7360a3b12adbd11f8d8e11d4b80

SHA1
a3b61fcd3b13a45c2baaac83b55d61f4ad49037d

SHA256
3d19285d79ab388d505d268f5ff3ccbafb24bb5386adf131b294969915246174

SHA512
353320c4e566713866f28619ffda42be2f24967d8530746fd16b831301ecf9b7812c1eb18651385fe0525e5923046d8d5b17865266c5e1cb4910d014c1b3f2d3

Download Submit
C:\Windows\System\kPOcqZX.exe

Filesize
2.0MB

MD5
d1b0bb9e005796d7bc4e8f0c8b54eaf1

SHA1
6576968fe1ea3178651dc9a6651127fcaeccdba9

SHA256
f8f2ac91f132c11010927ecb440e6a66139c1fd0fd2802d4b93af9686664bf2c

SHA512
78f81bde799fb8bbf8824d00a4a640df1cea7f4655442b4fcc2ff2dc7409eef4e8ded83af75843e25d0e62d80bfacba5a27ed03b5a9629a1cc7c8dc71d9b7f3b

Download Submit
C:\Windows\System\oIqkDfd.exe

Filesize
2.0MB

MD5
e6fc035d7564f156135e86a11c87d94d

SHA1
6384cdc6c9ba0dd200ef600907bfbca5213b63da

SHA256
831ab640f315cad1ff193b9d54982c0c7608e7d0eae28429f5011c0fe6dd5aad

SHA512
2eca82c6ee9c2cfa3504cae0c50202e282e10283780ff485289260ac6309fbf04ecf8eb9f7c1be4a5489299ffd21eaea3dd5ac971d922ff26f45f7d77f0afb65

Download Submit
C:\Windows\System\tiZEGkJ.exe

Filesize
2.0MB

MD5
23cba36df4c1e140a03cc84dd574fee5

SHA1
a863e3fb283b6152b639fafa27b274b16aae1826

SHA256
fbc6eb6bce98c3d756aca20301b7864b96d92da6a8286980513257eb544c89d3

SHA512
7a64c31a8312b45afc14f410ab74eda90ad64c679f224e138b80f891ecec25f8f3b0f5dc1dca40458d29427f59fbc2d3cb53d8ce8712772802558d232957c4ff

Download Submit
C:\Windows\System\vyJmKCb.exe

Filesize
2.0MB

MD5
03c9265ef77bc9cb7e71b684c2ce45bf

SHA1
eb994471c43985158b11a0a5f56b7b40c48ee26b

SHA256
c46db3564b200f86bd2981c5a68b3440dc2896938b5b8b10044b553f78eca832

SHA512
9cb5379c50d2da58b69bb85934fe920cbc2e7cf1544e233d76cd5a2963acec9fb671ddefbe7193ce3ccde38caad8c0ee75c317d81dca1af2e7e71752e5ec8f02

Download Submit
C:\Windows\System\xGUZgEe.exe

Filesize
2.0MB

MD5
9d0f748011dec125a6b925cf08ddc07b

SHA1
1953f0c1b71802c880b233434bf529de92a5fb8a

SHA256
52f601b4da3d51faa6377e2b8d921a2585750f3adb99940d2771a5899469952b

SHA512
aab7687f215e688d01f97cf6b245e4876b975cf459f0916900cccd24bd7fda0ab18a5bd62a92bbb5b3453e34e8bf8dce604f9100eff7916c792d73850494a295

Download Submit
C:\Windows\System\yDsZrpl.exe

Filesize
2.0MB

MD5
24c5a694f39f7af3d56fc6fd3dc6570c

SHA1
8041d37bb3499cb327d8c28cefdc835a4dda5da7

SHA256
d57ecfa4b35d4a5f48abbcf662bd4c889722044e64555140c16b670d8798096b

SHA512
b03997ba1c4baf127242858c2239fb39305352d37fac29cf96c5b804590998320d3a5562105750aa4f12da28be880f66fbf9fe82298f74a08c68e47806fb79c0

Download Submit
memory/348-41-0x00007FF7A9B10000-0x00007FF7A9F02000-memory.dmp

Filesize
3.9MB

Download
memory/348-2748-0x00007FF7A9B10000-0x00007FF7A9F02000-memory.dmp

Filesize
3.9MB

Download
memory/768-172-0x00007FF7D0CF0000-0x00007FF7D10E2000-memory.dmp

Filesize
3.9MB

Download
memory/768-5077-0x00007FF7D0CF0000-0x00007FF7D10E2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-170-0x00007FF6CEC30000-0x00007FF6CF022000-memory.dmp

Filesize
3.9MB

Download
memory/1084-5071-0x00007FF6CEC30000-0x00007FF6CF022000-memory.dmp

Filesize
3.9MB

Download
memory/1448-25-0x00007FF78EBF0000-0x00007FF78EFE2000-memory.dmp

Filesize
3.9MB

Download
memory/1548-173-0x00007FF738C50000-0x00007FF739042000-memory.dmp

Filesize
3.9MB

Download
memory/2024-4775-0x00007FF638FB0000-0x00007FF6393A2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-18-0x00007FF638FB0000-0x00007FF6393A2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-113-0x00007FF7A9A20000-0x00007FF7A9E12000-memory.dmp

Filesize
3.9MB

Download
memory/2112-5026-0x00007FF7A9A20000-0x00007FF7A9E12000-memory.dmp

Filesize
3.9MB

Download
memory/2112-3744-0x00007FF7A9A20000-0x00007FF7A9E12000-memory.dmp

Filesize
3.9MB

Download
memory/2364-155-0x00007FF684460000-0x00007FF684852000-memory.dmp

Filesize
3.9MB

Download
memory/2448-9-0x00007FF62B710000-0x00007FF62BB02000-memory.dmp

Filesize
3.9MB

Download
memory/2448-1644-0x00007FF62B710000-0x00007FF62BB02000-memory.dmp

Filesize
3.9MB

Download
memory/2452-46-0x00007FF669DD0000-0x00007FF66A1C2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-5047-0x00007FF774A50000-0x00007FF774E42000-memory.dmp

Filesize
3.9MB

Download
memory/2580-3748-0x00007FF774A50000-0x00007FF774E42000-memory.dmp

Filesize
3.9MB

Download
memory/2580-147-0x00007FF774A50000-0x00007FF774E42000-memory.dmp

Filesize
3.9MB

Download
memory/3116-169-0x00007FF730BD0000-0x00007FF730FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3220-171-0x00007FF6B1C80000-0x00007FF6B2072000-memory.dmp

Filesize
3.9MB

Download
memory/3244-2387-0x00007FFDA3623000-0x00007FFDA3625000-memory.dmp

Filesize
8KB

Download
memory/3244-59-0x000001FBE6DD0000-0x000001FBE6DF2000-memory.dmp

Filesize
136KB

Download
memory/3244-174-0x000001FC00000000-0x000001FC007A6000-memory.dmp

Filesize
7.6MB

Download
memory/3244-10-0x000001FBFF160000-0x000001FBFF170000-memory.dmp

Filesize
64KB

Download
memory/3244-11-0x00007FFDA3623000-0x00007FFDA3625000-memory.dmp

Filesize
8KB

Download
memory/3612-128-0x00007FF6074A0000-0x00007FF607892000-memory.dmp

Filesize
3.9MB

Download
memory/3656-1643-0x00007FF6002A0000-0x00007FF600692000-memory.dmp

Filesize
3.9MB

Download
memory/3656-1-0x0000010A49090000-0x0000010A490A0000-memory.dmp

Filesize
64KB

Download
memory/3656-0-0x00007FF6002A0000-0x00007FF600692000-memory.dmp

Filesize
3.9MB

Download
memory/3796-123-0x00007FF6E5A00000-0x00007FF6E5DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3796-5002-0x00007FF6E5A00000-0x00007FF6E5DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4112-87-0x00007FF68DB90000-0x00007FF68DF82000-memory.dmp

Filesize
3.9MB

Download
memory/4400-96-0x00007FF7455A0000-0x00007FF745992000-memory.dmp

Filesize
3.9MB

Download
memory/4400-3743-0x00007FF7455A0000-0x00007FF745992000-memory.dmp

Filesize
3.9MB

Download
memory/4456-60-0x00007FF7E41A0000-0x00007FF7E4592000-memory.dmp

Filesize
3.9MB

Download
memory/4468-156-0x00007FF71E460000-0x00007FF71E852000-memory.dmp

Filesize
3.9MB

Download
memory/4468-5068-0x00007FF71E460000-0x00007FF71E852000-memory.dmp

Filesize
3.9MB

Download
memory/4512-33-0x00007FF7D91D0000-0x00007FF7D95C2000-memory.dmp

Filesize
3.9MB

Download
memory/4600-4180-0x00007FF605340000-0x00007FF605732000-memory.dmp

Filesize
3.9MB

Download
memory/4600-161-0x00007FF605340000-0x00007FF605732000-memory.dmp

Filesize
3.9MB

Download
memory/4800-131-0x00007FF66C640000-0x00007FF66CA32000-memory.dmp

Filesize
3.9MB

Download
memory/4956-49-0x00007FF77AEE0000-0x00007FF77B2D2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-168-0x00007FF6DFF30000-0x00007FF6E0322000-memory.dmp

Filesize
3.9MB

Download