xmrig | dd936983df5f839872f48b90f6561d80b593cc2f79c1911f9e9bfc9a4849bae3

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

858b802b194651af245342b452631580N.exe
Size

1.3MB
MD5

858b802b194651af245342b452631580
SHA1

1d257ad2d4a485f823b7657bd6655875ced760ba
SHA256

dd936983df5f839872f48b90f6561d80b593cc2f79c1911f9e9bfc9a4849bae3
SHA512

e0c46e355ad2f041385fd09a8145f52bb95ea7950cb5815fde605dd268f70f8eccf363a8c7130bfd914e57c85ee09c856dfcc7d2021f66d419beaa4abe8fc02e
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPLa/J:Lz071uv4BPMkibTIA5LDGTmB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/1612-134-0x00007FF6DE690000-0x00007FF6DEA82000-memory.dmp	xmrig
behavioral2/memory/368-175-0x00007FF6D7310000-0x00007FF6D7702000-memory.dmp	xmrig
behavioral2/memory/1572-205-0x00007FF671230000-0x00007FF671622000-memory.dmp	xmrig
behavioral2/memory/3432-217-0x00007FF6F3A40000-0x00007FF6F3E32000-memory.dmp	xmrig
behavioral2/memory/5084-213-0x00007FF73A050000-0x00007FF73A442000-memory.dmp	xmrig
behavioral2/memory/3632-209-0x00007FF7BA560000-0x00007FF7BA952000-memory.dmp	xmrig
behavioral2/memory/2568-201-0x00007FF7F9670000-0x00007FF7F9A62000-memory.dmp	xmrig
behavioral2/memory/3312-192-0x00007FF7B3300000-0x00007FF7B36F2000-memory.dmp	xmrig
behavioral2/memory/2100-181-0x00007FF752250000-0x00007FF752642000-memory.dmp	xmrig
behavioral2/memory/4992-169-0x00007FF72A1F0000-0x00007FF72A5E2000-memory.dmp	xmrig
behavioral2/memory/1452-158-0x00007FF7929C0000-0x00007FF792DB2000-memory.dmp	xmrig
behavioral2/memory/4424-152-0x00007FF6ADD40000-0x00007FF6AE132000-memory.dmp	xmrig
behavioral2/memory/2960-146-0x00007FF7D4FE0000-0x00007FF7D53D2000-memory.dmp	xmrig
behavioral2/memory/1536-140-0x00007FF78E5C0000-0x00007FF78E9B2000-memory.dmp	xmrig
behavioral2/memory/3244-128-0x00007FF636200000-0x00007FF6365F2000-memory.dmp	xmrig
behavioral2/memory/4032-122-0x00007FF758890000-0x00007FF758C82000-memory.dmp	xmrig
behavioral2/memory/436-111-0x00007FF71E570000-0x00007FF71E962000-memory.dmp	xmrig
behavioral2/memory/1668-107-0x00007FF67D190000-0x00007FF67D582000-memory.dmp	xmrig
behavioral2/memory/532-101-0x00007FF720920000-0x00007FF720D12000-memory.dmp	xmrig
behavioral2/memory/3740-94-0x00007FF76AF70000-0x00007FF76B362000-memory.dmp	xmrig
behavioral2/memory/1960-90-0x00007FF6C68D0000-0x00007FF6C6CC2000-memory.dmp	xmrig
behavioral2/memory/5076-84-0x00007FF7A2FC0000-0x00007FF7A33B2000-memory.dmp	xmrig
behavioral2/memory/3160-72-0x00007FF620AD0000-0x00007FF620EC2000-memory.dmp	xmrig
behavioral2/memory/4032-2631-0x00007FF758890000-0x00007FF758C82000-memory.dmp	xmrig
behavioral2/memory/3244-2635-0x00007FF636200000-0x00007FF6365F2000-memory.dmp	xmrig
behavioral2/memory/1612-2665-0x00007FF6DE690000-0x00007FF6DEA82000-memory.dmp	xmrig
behavioral2/memory/368-2739-0x00007FF6D7310000-0x00007FF6D7702000-memory.dmp	xmrig
behavioral2/memory/2100-2749-0x00007FF752250000-0x00007FF752642000-memory.dmp	xmrig
behavioral2/memory/2568-2757-0x00007FF7F9670000-0x00007FF7F9A62000-memory.dmp	xmrig
behavioral2/memory/1572-2759-0x00007FF671230000-0x00007FF671622000-memory.dmp	xmrig
behavioral2/memory/3312-2755-0x00007FF7B3300000-0x00007FF7B36F2000-memory.dmp	xmrig
behavioral2/memory/4992-2735-0x00007FF72A1F0000-0x00007FF72A5E2000-memory.dmp	xmrig
behavioral2/memory/1452-2727-0x00007FF7929C0000-0x00007FF792DB2000-memory.dmp	xmrig
behavioral2/memory/4424-2724-0x00007FF6ADD40000-0x00007FF6AE132000-memory.dmp	xmrig
behavioral2/memory/436-2712-0x00007FF71E570000-0x00007FF71E962000-memory.dmp	xmrig
behavioral2/memory/532-2705-0x00007FF720920000-0x00007FF720D12000-memory.dmp	xmrig
behavioral2/memory/1668-2701-0x00007FF67D190000-0x00007FF67D582000-memory.dmp	xmrig
behavioral2/memory/3740-2698-0x00007FF76AF70000-0x00007FF76B362000-memory.dmp	xmrig
behavioral2/memory/2960-2691-0x00007FF7D4FE0000-0x00007FF7D53D2000-memory.dmp	xmrig
behavioral2/memory/1536-2686-0x00007FF78E5C0000-0x00007FF78E9B2000-memory.dmp	xmrig
behavioral2/memory/1960-2679-0x00007FF6C68D0000-0x00007FF6C6CC2000-memory.dmp	xmrig
behavioral2/memory/5084-2782-0x00007FF73A050000-0x00007FF73A442000-memory.dmp	xmrig
behavioral2/memory/3432-2777-0x00007FF6F3A40000-0x00007FF6F3E32000-memory.dmp	xmrig
behavioral2/memory/3632-2769-0x00007FF7BA560000-0x00007FF7BA952000-memory.dmp	xmrig
behavioral2/memory/3160-2659-0x00007FF620AD0000-0x00007FF620EC2000-memory.dmp	xmrig
behavioral2/memory/5076-2644-0x00007FF7A2FC0000-0x00007FF7A33B2000-memory.dmp	xmrig
behavioral2/memory/2528-2619-0x00007FF784600000-0x00007FF7849F2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	4748	powershell.exe
8	4748	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4748	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2528	GlaAhcx.exe
4032	NVDoZWv.exe
3244	cKhbRvW.exe
3160	oFHXbFB.exe
5076	XMKhXrA.exe
1612	hqldsCY.exe
1960	hBFLVXm.exe
1536	PCIaSOg.exe
2960	XbzsPlm.exe
3740	DBozjJG.exe
532	pNeuQCe.exe
1668	COqgQIf.exe
436	GjPLbBB.exe
4424	iCCSjXQ.exe
1452	IQpFCPc.exe
4992	KMCoLKN.exe
368	HKRnlJB.exe
2100	VpfXjLi.exe
3312	YXhFtJH.exe
2568	lpdjmeZ.exe
1572	CTLciMv.exe
3632	Rgqsiyg.exe
5084	LqhKpWu.exe
3432	xwckIoc.exe
3068	NWbDYAK.exe
1772	sjNgTde.exe
1072	LlBNPWz.exe
3408	GgMeTKw.exe
4108	gJIyYhL.exe
4368	DdSHqte.exe
1504	htAdwHh.exe
2704	BVmmYit.exe
508	UjtvfaO.exe
2532	WskMOjr.exe
2468	wwyhmId.exe
2484	OpGDZdu.exe
4860	sQPmrND.exe
1216	lMqWdoV.exe
1220	fiSWTms.exe
3000	pHoOWwh.exe
1196	ahOSRwE.exe
1884	oOvABXw.exe
2876	Qwqgygr.exe
1120	ShlzLQw.exe
2236	pXBJKLD.exe
3716	IwyXczr.exe
956	FXRtdTA.exe
876	GsDcyXp.exe
1456	NiKYKKE.exe
4028	XyeLUKE.exe
1128	buShzwa.exe
2628	PETCidi.exe
4776	qCwyQWx.exe
2768	ZplEBKI.exe
3772	kxuTHNt.exe
3964	tsuSIWn.exe
3608	YRlthqH.exe
5012	aehSYNQ.exe
3816	bqmOCED.exe
1908	qrpmwQM.exe
400	UYcjawL.exe
544	fOuinYu.exe
4928	NdWHoKf.exe
3216	AvvocDN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4500-0-0x00007FF7CFA00000-0x00007FF7CFDF2000-memory.dmp	upx
behavioral2/files/0x000a00000002341b-6.dat	upx
behavioral2/memory/2528-12-0x00007FF784600000-0x00007FF7849F2000-memory.dmp	upx
behavioral2/files/0x0007000000023425-22.dat	upx
behavioral2/files/0x0007000000023426-25.dat	upx
behavioral2/files/0x0007000000023427-35.dat	upx
behavioral2/files/0x0007000000023428-53.dat	upx
behavioral2/files/0x000700000002342f-75.dat	upx
behavioral2/files/0x0007000000023430-79.dat	upx
behavioral2/files/0x0007000000023431-86.dat	upx
behavioral2/files/0x0008000000023420-93.dat	upx
behavioral2/files/0x0007000000023432-117.dat	upx
behavioral2/memory/1612-134-0x00007FF6DE690000-0x00007FF6DEA82000-memory.dmp	upx
behavioral2/files/0x0007000000023436-141.dat	upx
behavioral2/files/0x000700000002343a-164.dat	upx
behavioral2/memory/368-175-0x00007FF6D7310000-0x00007FF6D7702000-memory.dmp	upx
behavioral2/files/0x000700000002343f-184.dat	upx
behavioral2/memory/1572-205-0x00007FF671230000-0x00007FF671622000-memory.dmp	upx
behavioral2/memory/3432-217-0x00007FF6F3A40000-0x00007FF6F3E32000-memory.dmp	upx
behavioral2/memory/5084-213-0x00007FF73A050000-0x00007FF73A442000-memory.dmp	upx
behavioral2/memory/3632-209-0x00007FF7BA560000-0x00007FF7BA952000-memory.dmp	upx
behavioral2/memory/2568-201-0x00007FF7F9670000-0x00007FF7F9A62000-memory.dmp	upx
behavioral2/files/0x0007000000023441-195.dat	upx
behavioral2/memory/3312-192-0x00007FF7B3300000-0x00007FF7B36F2000-memory.dmp	upx
behavioral2/files/0x0007000000023440-189.dat	upx
behavioral2/files/0x000700000002343e-187.dat	upx
behavioral2/files/0x000700000002343d-182.dat	upx
behavioral2/memory/2100-181-0x00007FF752250000-0x00007FF752642000-memory.dmp	upx
behavioral2/files/0x000700000002343c-176.dat	upx
behavioral2/files/0x000700000002343b-170.dat	upx
behavioral2/memory/4992-169-0x00007FF72A1F0000-0x00007FF72A5E2000-memory.dmp	upx
behavioral2/files/0x0007000000023439-159.dat	upx
behavioral2/memory/1452-158-0x00007FF7929C0000-0x00007FF792DB2000-memory.dmp	upx
behavioral2/files/0x0007000000023438-153.dat	upx
behavioral2/memory/4424-152-0x00007FF6ADD40000-0x00007FF6AE132000-memory.dmp	upx
behavioral2/files/0x0007000000023437-147.dat	upx
behavioral2/memory/2960-146-0x00007FF7D4FE0000-0x00007FF7D53D2000-memory.dmp	upx
behavioral2/memory/1536-140-0x00007FF78E5C0000-0x00007FF78E9B2000-memory.dmp	upx
behavioral2/files/0x0007000000023435-135.dat	upx
behavioral2/files/0x0007000000023434-129.dat	upx
behavioral2/memory/3244-128-0x00007FF636200000-0x00007FF6365F2000-memory.dmp	upx
behavioral2/files/0x0007000000023433-123.dat	upx
behavioral2/memory/4032-122-0x00007FF758890000-0x00007FF758C82000-memory.dmp	upx
behavioral2/files/0x000800000002342b-112.dat	upx
behavioral2/memory/436-111-0x00007FF71E570000-0x00007FF71E962000-memory.dmp	upx
behavioral2/memory/1668-107-0x00007FF67D190000-0x00007FF67D582000-memory.dmp	upx
behavioral2/memory/532-101-0x00007FF720920000-0x00007FF720D12000-memory.dmp	upx
behavioral2/memory/3740-94-0x00007FF76AF70000-0x00007FF76B362000-memory.dmp	upx
behavioral2/memory/1960-90-0x00007FF6C68D0000-0x00007FF6C6CC2000-memory.dmp	upx
behavioral2/memory/5076-84-0x00007FF7A2FC0000-0x00007FF7A33B2000-memory.dmp	upx
behavioral2/files/0x000800000002342c-83.dat	upx
behavioral2/files/0x000700000002342e-78.dat	upx
behavioral2/files/0x000700000002342d-74.dat	upx
behavioral2/memory/3160-72-0x00007FF620AD0000-0x00007FF620EC2000-memory.dmp	upx
behavioral2/files/0x000700000002342a-71.dat	upx
behavioral2/files/0x0007000000023429-66.dat	upx
behavioral2/files/0x0007000000023423-11.dat	upx
behavioral2/files/0x0007000000023424-18.dat	upx
behavioral2/memory/4032-2631-0x00007FF758890000-0x00007FF758C82000-memory.dmp	upx
behavioral2/memory/3244-2635-0x00007FF636200000-0x00007FF6365F2000-memory.dmp	upx
behavioral2/memory/1612-2665-0x00007FF6DE690000-0x00007FF6DEA82000-memory.dmp	upx
behavioral2/memory/368-2739-0x00007FF6D7310000-0x00007FF6D7702000-memory.dmp	upx
behavioral2/memory/2100-2749-0x00007FF752250000-0x00007FF752642000-memory.dmp	upx
behavioral2/memory/2568-2757-0x00007FF7F9670000-0x00007FF7F9A62000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GsDcyXp.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\eYmtUVM.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\ozvJLWY.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\snsQwSA.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\xQQMIYc.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\PihttWb.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\NHQHIjy.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\nOsMpQZ.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\ECXpcgI.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\qjMQXNO.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\bXxEbsb.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\vLYufDs.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\VSZIXFU.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\gIvwBAe.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\CxKQpRc.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\aUyjRhg.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\KqiCQVV.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\QGRPBFw.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\zJuNWIP.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\hUvXEve.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\nNTSZfm.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\rcdaJDN.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\OmpsFju.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\ZWLizxf.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\fpTFAJg.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\qoqLhqm.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\PSHLwPg.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\MDsSQEy.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\mLxPSQt.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\DdGiboi.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\AJPqbtZ.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\YDQrhdc.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\IeVILmX.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\jYKxfOV.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\RaPQxJg.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\qePeFbU.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\AIaYJuw.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\ghwlrVl.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\uInuTXB.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\DunejZk.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\QibaRNZ.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\XtKWmTr.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\QpJuOfb.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\RIRmLPb.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\ZswUHcJ.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\jEKfivB.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\GaJrEwL.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\pZSkgFr.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\pqjDHtJ.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\zaKbQQL.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\ysymWxu.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\zseYcPj.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\ZkvCCPJ.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\YDXapVv.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\rRedMGO.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\qLeVbJG.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\JNaEUAe.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\MYQZiuX.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\iiutPsr.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\WaEfXSB.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\qauCuRf.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\FOuxcjr.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\JHrSGZU.exe	858b802b194651af245342b452631580N.exe
File created	C:\Windows\System\uermbqP.exe	858b802b194651af245342b452631580N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4748	powershell.exe
4748	powershell.exe
4748	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4500	858b802b194651af245342b452631580N.exe
Token: SeLockMemoryPrivilege	4500	858b802b194651af245342b452631580N.exe
Token: SeDebugPrivilege	4748	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4748	4500	858b802b194651af245342b452631580N.exe	85
PID 4500 wrote to memory of 4748	4500	858b802b194651af245342b452631580N.exe	85
PID 4500 wrote to memory of 2528	4500	858b802b194651af245342b452631580N.exe	86
PID 4500 wrote to memory of 2528	4500	858b802b194651af245342b452631580N.exe	86
PID 4500 wrote to memory of 4032	4500	858b802b194651af245342b452631580N.exe	87
PID 4500 wrote to memory of 4032	4500	858b802b194651af245342b452631580N.exe	87
PID 4500 wrote to memory of 3244	4500	858b802b194651af245342b452631580N.exe	88
PID 4500 wrote to memory of 3244	4500	858b802b194651af245342b452631580N.exe	88
PID 4500 wrote to memory of 3160	4500	858b802b194651af245342b452631580N.exe	89
PID 4500 wrote to memory of 3160	4500	858b802b194651af245342b452631580N.exe	89
PID 4500 wrote to memory of 5076	4500	858b802b194651af245342b452631580N.exe	90
PID 4500 wrote to memory of 5076	4500	858b802b194651af245342b452631580N.exe	90
PID 4500 wrote to memory of 1612	4500	858b802b194651af245342b452631580N.exe	91
PID 4500 wrote to memory of 1612	4500	858b802b194651af245342b452631580N.exe	91
PID 4500 wrote to memory of 1960	4500	858b802b194651af245342b452631580N.exe	92
PID 4500 wrote to memory of 1960	4500	858b802b194651af245342b452631580N.exe	92
PID 4500 wrote to memory of 1536	4500	858b802b194651af245342b452631580N.exe	93
PID 4500 wrote to memory of 1536	4500	858b802b194651af245342b452631580N.exe	93
PID 4500 wrote to memory of 2960	4500	858b802b194651af245342b452631580N.exe	94
PID 4500 wrote to memory of 2960	4500	858b802b194651af245342b452631580N.exe	94
PID 4500 wrote to memory of 532	4500	858b802b194651af245342b452631580N.exe	95
PID 4500 wrote to memory of 532	4500	858b802b194651af245342b452631580N.exe	95
PID 4500 wrote to memory of 3740	4500	858b802b194651af245342b452631580N.exe	96
PID 4500 wrote to memory of 3740	4500	858b802b194651af245342b452631580N.exe	96
PID 4500 wrote to memory of 1668	4500	858b802b194651af245342b452631580N.exe	97
PID 4500 wrote to memory of 1668	4500	858b802b194651af245342b452631580N.exe	97
PID 4500 wrote to memory of 436	4500	858b802b194651af245342b452631580N.exe	98
PID 4500 wrote to memory of 436	4500	858b802b194651af245342b452631580N.exe	98
PID 4500 wrote to memory of 4424	4500	858b802b194651af245342b452631580N.exe	99
PID 4500 wrote to memory of 4424	4500	858b802b194651af245342b452631580N.exe	99
PID 4500 wrote to memory of 1452	4500	858b802b194651af245342b452631580N.exe	100
PID 4500 wrote to memory of 1452	4500	858b802b194651af245342b452631580N.exe	100
PID 4500 wrote to memory of 4992	4500	858b802b194651af245342b452631580N.exe	101
PID 4500 wrote to memory of 4992	4500	858b802b194651af245342b452631580N.exe	101
PID 4500 wrote to memory of 368	4500	858b802b194651af245342b452631580N.exe	102
PID 4500 wrote to memory of 368	4500	858b802b194651af245342b452631580N.exe	102
PID 4500 wrote to memory of 2100	4500	858b802b194651af245342b452631580N.exe	103
PID 4500 wrote to memory of 2100	4500	858b802b194651af245342b452631580N.exe	103
PID 4500 wrote to memory of 3312	4500	858b802b194651af245342b452631580N.exe	104
PID 4500 wrote to memory of 3312	4500	858b802b194651af245342b452631580N.exe	104
PID 4500 wrote to memory of 2568	4500	858b802b194651af245342b452631580N.exe	105
PID 4500 wrote to memory of 2568	4500	858b802b194651af245342b452631580N.exe	105
PID 4500 wrote to memory of 1572	4500	858b802b194651af245342b452631580N.exe	106
PID 4500 wrote to memory of 1572	4500	858b802b194651af245342b452631580N.exe	106
PID 4500 wrote to memory of 3632	4500	858b802b194651af245342b452631580N.exe	107
PID 4500 wrote to memory of 3632	4500	858b802b194651af245342b452631580N.exe	107
PID 4500 wrote to memory of 5084	4500	858b802b194651af245342b452631580N.exe	108
PID 4500 wrote to memory of 5084	4500	858b802b194651af245342b452631580N.exe	108
PID 4500 wrote to memory of 3432	4500	858b802b194651af245342b452631580N.exe	109
PID 4500 wrote to memory of 3432	4500	858b802b194651af245342b452631580N.exe	109
PID 4500 wrote to memory of 3068	4500	858b802b194651af245342b452631580N.exe	110
PID 4500 wrote to memory of 3068	4500	858b802b194651af245342b452631580N.exe	110
PID 4500 wrote to memory of 1772	4500	858b802b194651af245342b452631580N.exe	111
PID 4500 wrote to memory of 1772	4500	858b802b194651af245342b452631580N.exe	111
PID 4500 wrote to memory of 1072	4500	858b802b194651af245342b452631580N.exe	112
PID 4500 wrote to memory of 1072	4500	858b802b194651af245342b452631580N.exe	112
PID 4500 wrote to memory of 3408	4500	858b802b194651af245342b452631580N.exe	113
PID 4500 wrote to memory of 3408	4500	858b802b194651af245342b452631580N.exe	113
PID 4500 wrote to memory of 4108	4500	858b802b194651af245342b452631580N.exe	114
PID 4500 wrote to memory of 4108	4500	858b802b194651af245342b452631580N.exe	114
PID 4500 wrote to memory of 4368	4500	858b802b194651af245342b452631580N.exe	115
PID 4500 wrote to memory of 4368	4500	858b802b194651af245342b452631580N.exe	115
PID 4500 wrote to memory of 1504	4500	858b802b194651af245342b452631580N.exe	116
PID 4500 wrote to memory of 1504	4500	858b802b194651af245342b452631580N.exe	116

C:\Users\Admin\AppData\Local\Temp\858b802b194651af245342b452631580N.exe
"C:\Users\Admin\AppData\Local\Temp\858b802b194651af245342b452631580N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4748" "2912" "2872" "2916" "0" "0" "2920" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13252
- C:\Windows\System\GlaAhcx.exe
  C:\Windows\System\GlaAhcx.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\NVDoZWv.exe
  C:\Windows\System\NVDoZWv.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\cKhbRvW.exe
  C:\Windows\System\cKhbRvW.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\oFHXbFB.exe
  C:\Windows\System\oFHXbFB.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\XMKhXrA.exe
  C:\Windows\System\XMKhXrA.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\hqldsCY.exe
  C:\Windows\System\hqldsCY.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\hBFLVXm.exe
  C:\Windows\System\hBFLVXm.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\PCIaSOg.exe
  C:\Windows\System\PCIaSOg.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\XbzsPlm.exe
  C:\Windows\System\XbzsPlm.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\pNeuQCe.exe
  C:\Windows\System\pNeuQCe.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\DBozjJG.exe
  C:\Windows\System\DBozjJG.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\COqgQIf.exe
  C:\Windows\System\COqgQIf.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\GjPLbBB.exe
  C:\Windows\System\GjPLbBB.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\iCCSjXQ.exe
  C:\Windows\System\iCCSjXQ.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\IQpFCPc.exe
  C:\Windows\System\IQpFCPc.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\KMCoLKN.exe
  C:\Windows\System\KMCoLKN.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\HKRnlJB.exe
  C:\Windows\System\HKRnlJB.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\VpfXjLi.exe
  C:\Windows\System\VpfXjLi.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\YXhFtJH.exe
  C:\Windows\System\YXhFtJH.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\lpdjmeZ.exe
  C:\Windows\System\lpdjmeZ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\CTLciMv.exe
  C:\Windows\System\CTLciMv.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\Rgqsiyg.exe
  C:\Windows\System\Rgqsiyg.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\LqhKpWu.exe
  C:\Windows\System\LqhKpWu.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\xwckIoc.exe
  C:\Windows\System\xwckIoc.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\NWbDYAK.exe
  C:\Windows\System\NWbDYAK.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\sjNgTde.exe
  C:\Windows\System\sjNgTde.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\LlBNPWz.exe
  C:\Windows\System\LlBNPWz.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\GgMeTKw.exe
  C:\Windows\System\GgMeTKw.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\gJIyYhL.exe
  C:\Windows\System\gJIyYhL.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\DdSHqte.exe
  C:\Windows\System\DdSHqte.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\htAdwHh.exe
  C:\Windows\System\htAdwHh.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\BVmmYit.exe
  C:\Windows\System\BVmmYit.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\UjtvfaO.exe
  C:\Windows\System\UjtvfaO.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\WskMOjr.exe
  C:\Windows\System\WskMOjr.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\wwyhmId.exe
  C:\Windows\System\wwyhmId.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\OpGDZdu.exe
  C:\Windows\System\OpGDZdu.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\sQPmrND.exe
  C:\Windows\System\sQPmrND.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\lMqWdoV.exe
  C:\Windows\System\lMqWdoV.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\fiSWTms.exe
  C:\Windows\System\fiSWTms.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\pHoOWwh.exe
  C:\Windows\System\pHoOWwh.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\ahOSRwE.exe
  C:\Windows\System\ahOSRwE.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\oOvABXw.exe
  C:\Windows\System\oOvABXw.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\Qwqgygr.exe
  C:\Windows\System\Qwqgygr.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\ShlzLQw.exe
  C:\Windows\System\ShlzLQw.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\pXBJKLD.exe
  C:\Windows\System\pXBJKLD.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\IwyXczr.exe
  C:\Windows\System\IwyXczr.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\FXRtdTA.exe
  C:\Windows\System\FXRtdTA.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\GsDcyXp.exe
  C:\Windows\System\GsDcyXp.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\NiKYKKE.exe
  C:\Windows\System\NiKYKKE.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\XyeLUKE.exe
  C:\Windows\System\XyeLUKE.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\buShzwa.exe
  C:\Windows\System\buShzwa.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\PETCidi.exe
  C:\Windows\System\PETCidi.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\qCwyQWx.exe
  C:\Windows\System\qCwyQWx.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\ZplEBKI.exe
  C:\Windows\System\ZplEBKI.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\kxuTHNt.exe
  C:\Windows\System\kxuTHNt.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\tsuSIWn.exe
  C:\Windows\System\tsuSIWn.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\YRlthqH.exe
  C:\Windows\System\YRlthqH.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\aehSYNQ.exe
  C:\Windows\System\aehSYNQ.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\bqmOCED.exe
  C:\Windows\System\bqmOCED.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\qrpmwQM.exe
  C:\Windows\System\qrpmwQM.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\UYcjawL.exe
  C:\Windows\System\UYcjawL.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\fOuinYu.exe
  C:\Windows\System\fOuinYu.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\NdWHoKf.exe
  C:\Windows\System\NdWHoKf.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\AvvocDN.exe
  C:\Windows\System\AvvocDN.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\LudLPSh.exe
  C:\Windows\System\LudLPSh.exe
  2⤵
  PID:1700
- C:\Windows\System\yqOfzfU.exe
  C:\Windows\System\yqOfzfU.exe
  2⤵
  PID:816
- C:\Windows\System\lReaHQW.exe
  C:\Windows\System\lReaHQW.exe
  2⤵
  PID:2232
- C:\Windows\System\TOWEnbN.exe
  C:\Windows\System\TOWEnbN.exe
  2⤵
  PID:4324
- C:\Windows\System\wzkCnQL.exe
  C:\Windows\System\wzkCnQL.exe
  2⤵
  PID:2284
- C:\Windows\System\pcsOmEU.exe
  C:\Windows\System\pcsOmEU.exe
  2⤵
  PID:1640
- C:\Windows\System\UXYVkUW.exe
  C:\Windows\System\UXYVkUW.exe
  2⤵
  PID:624
- C:\Windows\System\BRHMNqN.exe
  C:\Windows\System\BRHMNqN.exe
  2⤵
  PID:4796
- C:\Windows\System\RNwGJRI.exe
  C:\Windows\System\RNwGJRI.exe
  2⤵
  PID:1732
- C:\Windows\System\doLzYzW.exe
  C:\Windows\System\doLzYzW.exe
  2⤵
  PID:4220
- C:\Windows\System\tpAPdlV.exe
  C:\Windows\System\tpAPdlV.exe
  2⤵
  PID:4392
- C:\Windows\System\YDoylfK.exe
  C:\Windows\System\YDoylfK.exe
  2⤵
  PID:1872
- C:\Windows\System\fSYAhEK.exe
  C:\Windows\System\fSYAhEK.exe
  2⤵
  PID:1676
- C:\Windows\System\CEjSnyI.exe
  C:\Windows\System\CEjSnyI.exe
  2⤵
  PID:3188
- C:\Windows\System\jVLoaEk.exe
  C:\Windows\System\jVLoaEk.exe
  2⤵
  PID:3228
- C:\Windows\System\ajqKjHo.exe
  C:\Windows\System\ajqKjHo.exe
  2⤵
  PID:4548
- C:\Windows\System\lBXgFsv.exe
  C:\Windows\System\lBXgFsv.exe
  2⤵
  PID:1088
- C:\Windows\System\XqQeHwW.exe
  C:\Windows\System\XqQeHwW.exe
  2⤵
  PID:5124
- C:\Windows\System\NxGXwzA.exe
  C:\Windows\System\NxGXwzA.exe
  2⤵
  PID:5156
- C:\Windows\System\rmQoxOF.exe
  C:\Windows\System\rmQoxOF.exe
  2⤵
  PID:5184
- C:\Windows\System\LFHRLXT.exe
  C:\Windows\System\LFHRLXT.exe
  2⤵
  PID:5216
- C:\Windows\System\usETVQO.exe
  C:\Windows\System\usETVQO.exe
  2⤵
  PID:5260
- C:\Windows\System\NmSnqoi.exe
  C:\Windows\System\NmSnqoi.exe
  2⤵
  PID:5280
- C:\Windows\System\IMRvszs.exe
  C:\Windows\System\IMRvszs.exe
  2⤵
  PID:5308
- C:\Windows\System\FfewcaA.exe
  C:\Windows\System\FfewcaA.exe
  2⤵
  PID:5324
- C:\Windows\System\HHymhhi.exe
  C:\Windows\System\HHymhhi.exe
  2⤵
  PID:5348
- C:\Windows\System\ozFbjJa.exe
  C:\Windows\System\ozFbjJa.exe
  2⤵
  PID:5380
- C:\Windows\System\GEEoHzj.exe
  C:\Windows\System\GEEoHzj.exe
  2⤵
  PID:5408
- C:\Windows\System\qdYJjPr.exe
  C:\Windows\System\qdYJjPr.exe
  2⤵
  PID:5432
- C:\Windows\System\RCRZAhC.exe
  C:\Windows\System\RCRZAhC.exe
  2⤵
  PID:5460
- C:\Windows\System\tzYNxJr.exe
  C:\Windows\System\tzYNxJr.exe
  2⤵
  PID:5488
- C:\Windows\System\JLcMEhC.exe
  C:\Windows\System\JLcMEhC.exe
  2⤵
  PID:5520
- C:\Windows\System\dWWAavp.exe
  C:\Windows\System\dWWAavp.exe
  2⤵
  PID:5544
- C:\Windows\System\PTKmBgo.exe
  C:\Windows\System\PTKmBgo.exe
  2⤵
  PID:5572
- C:\Windows\System\CGeTaph.exe
  C:\Windows\System\CGeTaph.exe
  2⤵
  PID:5600
- C:\Windows\System\lJmSqCh.exe
  C:\Windows\System\lJmSqCh.exe
  2⤵
  PID:5632
- C:\Windows\System\ngKEmYL.exe
  C:\Windows\System\ngKEmYL.exe
  2⤵
  PID:5688
- C:\Windows\System\VJPyLNE.exe
  C:\Windows\System\VJPyLNE.exe
  2⤵
  PID:5712
- C:\Windows\System\MAJMsEd.exe
  C:\Windows\System\MAJMsEd.exe
  2⤵
  PID:5728
- C:\Windows\System\GZGIylO.exe
  C:\Windows\System\GZGIylO.exe
  2⤵
  PID:5756
- C:\Windows\System\FrLMdeT.exe
  C:\Windows\System\FrLMdeT.exe
  2⤵
  PID:5780
- C:\Windows\System\TGFKkpC.exe
  C:\Windows\System\TGFKkpC.exe
  2⤵
  PID:5800
- C:\Windows\System\NOSCXCo.exe
  C:\Windows\System\NOSCXCo.exe
  2⤵
  PID:5828
- C:\Windows\System\JiXqLpo.exe
  C:\Windows\System\JiXqLpo.exe
  2⤵
  PID:5856
- C:\Windows\System\hhgXpnk.exe
  C:\Windows\System\hhgXpnk.exe
  2⤵
  PID:5884
- C:\Windows\System\BeNnDXo.exe
  C:\Windows\System\BeNnDXo.exe
  2⤵
  PID:5912
- C:\Windows\System\TxcuRmc.exe
  C:\Windows\System\TxcuRmc.exe
  2⤵
  PID:5956
- C:\Windows\System\MogkxiS.exe
  C:\Windows\System\MogkxiS.exe
  2⤵
  PID:5972
- C:\Windows\System\qrhTxIt.exe
  C:\Windows\System\qrhTxIt.exe
  2⤵
  PID:6004
- C:\Windows\System\tvaOlqR.exe
  C:\Windows\System\tvaOlqR.exe
  2⤵
  PID:6032
- C:\Windows\System\gCmabae.exe
  C:\Windows\System\gCmabae.exe
  2⤵
  PID:6048
- C:\Windows\System\lXrRuBF.exe
  C:\Windows\System\lXrRuBF.exe
  2⤵
  PID:6068
- C:\Windows\System\VNZIXHg.exe
  C:\Windows\System\VNZIXHg.exe
  2⤵
  PID:6088
- C:\Windows\System\RfFKsgc.exe
  C:\Windows\System\RfFKsgc.exe
  2⤵
  PID:6128
- C:\Windows\System\GdDRCIS.exe
  C:\Windows\System\GdDRCIS.exe
  2⤵
  PID:4048
- C:\Windows\System\DHeYRNj.exe
  C:\Windows\System\DHeYRNj.exe
  2⤵
  PID:888
- C:\Windows\System\digHbZl.exe
  C:\Windows\System\digHbZl.exe
  2⤵
  PID:64
- C:\Windows\System\PXzCyjZ.exe
  C:\Windows\System\PXzCyjZ.exe
  2⤵
  PID:5144
- C:\Windows\System\ONKqiCU.exe
  C:\Windows\System\ONKqiCU.exe
  2⤵
  PID:5176
- C:\Windows\System\HghMifv.exe
  C:\Windows\System\HghMifv.exe
  2⤵
  PID:5232
- C:\Windows\System\mzqxvCG.exe
  C:\Windows\System\mzqxvCG.exe
  2⤵
  PID:5276
- C:\Windows\System\nzANAhm.exe
  C:\Windows\System\nzANAhm.exe
  2⤵
  PID:5344
- C:\Windows\System\MhMyOTB.exe
  C:\Windows\System\MhMyOTB.exe
  2⤵
  PID:1648
- C:\Windows\System\WmSbIMQ.exe
  C:\Windows\System\WmSbIMQ.exe
  2⤵
  PID:5456
- C:\Windows\System\uLUPBTv.exe
  C:\Windows\System\uLUPBTv.exe
  2⤵
  PID:4612
- C:\Windows\System\wFjgsoG.exe
  C:\Windows\System\wFjgsoG.exe
  2⤵
  PID:3140
- C:\Windows\System\EyQMoRF.exe
  C:\Windows\System\EyQMoRF.exe
  2⤵
  PID:5560
- C:\Windows\System\GUgRUsi.exe
  C:\Windows\System\GUgRUsi.exe
  2⤵
  PID:5588
- C:\Windows\System\xwguJuV.exe
  C:\Windows\System\xwguJuV.exe
  2⤵
  PID:5616
- C:\Windows\System\UCbQolp.exe
  C:\Windows\System\UCbQolp.exe
  2⤵
  PID:4660
- C:\Windows\System\DcyfLDV.exe
  C:\Windows\System\DcyfLDV.exe
  2⤵
  PID:4784
- C:\Windows\System\GLwxyrG.exe
  C:\Windows\System\GLwxyrG.exe
  2⤵
  PID:5696
- C:\Windows\System\aLghrzk.exe
  C:\Windows\System\aLghrzk.exe
  2⤵
  PID:5720
- C:\Windows\System\KxliaXq.exe
  C:\Windows\System\KxliaXq.exe
  2⤵
  PID:4592
- C:\Windows\System\IIqDdkw.exe
  C:\Windows\System\IIqDdkw.exe
  2⤵
  PID:3144
- C:\Windows\System\xdZSvlP.exe
  C:\Windows\System\xdZSvlP.exe
  2⤵
  PID:3332
- C:\Windows\System\QcCZZvf.exe
  C:\Windows\System\QcCZZvf.exe
  2⤵
  PID:2996
- C:\Windows\System\hKimYsi.exe
  C:\Windows\System\hKimYsi.exe
  2⤵
  PID:5872
- C:\Windows\System\oBhfyHP.exe
  C:\Windows\System\oBhfyHP.exe
  2⤵
  PID:5876
- C:\Windows\System\TFpvdov.exe
  C:\Windows\System\TFpvdov.exe
  2⤵
  PID:4192
- C:\Windows\System\dtPCUdn.exe
  C:\Windows\System\dtPCUdn.exe
  2⤵
  PID:5224
- C:\Windows\System\BprYdYr.exe
  C:\Windows\System\BprYdYr.exe
  2⤵
  PID:3064
- C:\Windows\System\ihhfMxw.exe
  C:\Windows\System\ihhfMxw.exe
  2⤵
  PID:5256
- C:\Windows\System\APRBWxn.exe
  C:\Windows\System\APRBWxn.exe
  2⤵
  PID:5336
- C:\Windows\System\gmpkiyb.exe
  C:\Windows\System\gmpkiyb.exe
  2⤵
  PID:5400
- C:\Windows\System\CBcIlVq.exe
  C:\Windows\System\CBcIlVq.exe
  2⤵
  PID:5536
- C:\Windows\System\dqzlDJc.exe
  C:\Windows\System\dqzlDJc.exe
  2⤵
  PID:5644
- C:\Windows\System\nyAhTag.exe
  C:\Windows\System\nyAhTag.exe
  2⤵
  PID:5676
- C:\Windows\System\woyOUmz.exe
  C:\Windows\System\woyOUmz.exe
  2⤵
  PID:2052
- C:\Windows\System\iqsguSm.exe
  C:\Windows\System\iqsguSm.exe
  2⤵
  PID:5740
- C:\Windows\System\prmRipt.exe
  C:\Windows\System\prmRipt.exe
  2⤵
  PID:5868
- C:\Windows\System\UVoHTib.exe
  C:\Windows\System\UVoHTib.exe
  2⤵
  PID:6012
- C:\Windows\System\kShydhm.exe
  C:\Windows\System\kShydhm.exe
  2⤵
  PID:4740
- C:\Windows\System\SLINfIb.exe
  C:\Windows\System\SLINfIb.exe
  2⤵
  PID:5952
- C:\Windows\System\bFcnXsE.exe
  C:\Windows\System\bFcnXsE.exe
  2⤵
  PID:3192
- C:\Windows\System\WUkZHIS.exe
  C:\Windows\System\WUkZHIS.exe
  2⤵
  PID:5140
- C:\Windows\System\oFvbFCl.exe
  C:\Windows\System\oFvbFCl.exe
  2⤵
  PID:1040
- C:\Windows\System\BRFDnaa.exe
  C:\Windows\System\BRFDnaa.exe
  2⤵
  PID:3620
- C:\Windows\System\pGHYwnY.exe
  C:\Windows\System\pGHYwnY.exe
  2⤵
  PID:2068
- C:\Windows\System\qMySPVp.exe
  C:\Windows\System\qMySPVp.exe
  2⤵
  PID:4468
- C:\Windows\System\yKrmsAP.exe
  C:\Windows\System\yKrmsAP.exe
  2⤵
  PID:2248
- C:\Windows\System\HVormgQ.exe
  C:\Windows\System\HVormgQ.exe
  2⤵
  PID:620
- C:\Windows\System\chivJoI.exe
  C:\Windows\System\chivJoI.exe
  2⤵
  PID:6152
- C:\Windows\System\heehAZX.exe
  C:\Windows\System\heehAZX.exe
  2⤵
  PID:6176
- C:\Windows\System\EVAsGVb.exe
  C:\Windows\System\EVAsGVb.exe
  2⤵
  PID:6232
- C:\Windows\System\uoQfiok.exe
  C:\Windows\System\uoQfiok.exe
  2⤵
  PID:6292
- C:\Windows\System\bedrvgp.exe
  C:\Windows\System\bedrvgp.exe
  2⤵
  PID:6308
- C:\Windows\System\PXYyzzB.exe
  C:\Windows\System\PXYyzzB.exe
  2⤵
  PID:6324
- C:\Windows\System\vOinfKg.exe
  C:\Windows\System\vOinfKg.exe
  2⤵
  PID:6352
- C:\Windows\System\OQBjqBr.exe
  C:\Windows\System\OQBjqBr.exe
  2⤵
  PID:6376
- C:\Windows\System\LEgwSwV.exe
  C:\Windows\System\LEgwSwV.exe
  2⤵
  PID:6396
- C:\Windows\System\rqjzSNm.exe
  C:\Windows\System\rqjzSNm.exe
  2⤵
  PID:6484
- C:\Windows\System\qZksSHY.exe
  C:\Windows\System\qZksSHY.exe
  2⤵
  PID:6524
- C:\Windows\System\olwIBuN.exe
  C:\Windows\System\olwIBuN.exe
  2⤵
  PID:6552
- C:\Windows\System\mBTGBMq.exe
  C:\Windows\System\mBTGBMq.exe
  2⤵
  PID:6568
- C:\Windows\System\hyHdvzt.exe
  C:\Windows\System\hyHdvzt.exe
  2⤵
  PID:6604
- C:\Windows\System\dzzaiBB.exe
  C:\Windows\System\dzzaiBB.exe
  2⤵
  PID:6628
- C:\Windows\System\ptvFMMP.exe
  C:\Windows\System\ptvFMMP.exe
  2⤵
  PID:6656
- C:\Windows\System\oawnlGd.exe
  C:\Windows\System\oawnlGd.exe
  2⤵
  PID:6676
- C:\Windows\System\rYwuFtj.exe
  C:\Windows\System\rYwuFtj.exe
  2⤵
  PID:6720
- C:\Windows\System\hHQGxhh.exe
  C:\Windows\System\hHQGxhh.exe
  2⤵
  PID:6736
- C:\Windows\System\AvdRamv.exe
  C:\Windows\System\AvdRamv.exe
  2⤵
  PID:6764
- C:\Windows\System\emcQUgx.exe
  C:\Windows\System\emcQUgx.exe
  2⤵
  PID:6800
- C:\Windows\System\aotYhvs.exe
  C:\Windows\System\aotYhvs.exe
  2⤵
  PID:6820
- C:\Windows\System\AgGiKEe.exe
  C:\Windows\System\AgGiKEe.exe
  2⤵
  PID:6860
- C:\Windows\System\xoHtRBx.exe
  C:\Windows\System\xoHtRBx.exe
  2⤵
  PID:6876
- C:\Windows\System\RWFOolp.exe
  C:\Windows\System\RWFOolp.exe
  2⤵
  PID:6908
- C:\Windows\System\dgKGqxK.exe
  C:\Windows\System\dgKGqxK.exe
  2⤵
  PID:6956
- C:\Windows\System\lASQFha.exe
  C:\Windows\System\lASQFha.exe
  2⤵
  PID:6988
- C:\Windows\System\SuVBjab.exe
  C:\Windows\System\SuVBjab.exe
  2⤵
  PID:7012
- C:\Windows\System\bmskIKs.exe
  C:\Windows\System\bmskIKs.exe
  2⤵
  PID:7028
- C:\Windows\System\SVhkOmZ.exe
  C:\Windows\System\SVhkOmZ.exe
  2⤵
  PID:7068
- C:\Windows\System\LyqZunm.exe
  C:\Windows\System\LyqZunm.exe
  2⤵
  PID:7088
- C:\Windows\System\qgycDnU.exe
  C:\Windows\System\qgycDnU.exe
  2⤵
  PID:7128
- C:\Windows\System\IKDTXQw.exe
  C:\Windows\System\IKDTXQw.exe
  2⤵
  PID:7148
- C:\Windows\System\xjayKHn.exe
  C:\Windows\System\xjayKHn.exe
  2⤵
  PID:1880
- C:\Windows\System\yddtJLZ.exe
  C:\Windows\System\yddtJLZ.exe
  2⤵
  PID:6168
- C:\Windows\System\zAeNLol.exe
  C:\Windows\System\zAeNLol.exe
  2⤵
  PID:5108
- C:\Windows\System\QFlVYwz.exe
  C:\Windows\System\QFlVYwz.exe
  2⤵
  PID:1932
- C:\Windows\System\AamHSUp.exe
  C:\Windows\System\AamHSUp.exe
  2⤵
  PID:6272
- C:\Windows\System\OrbtEjU.exe
  C:\Windows\System\OrbtEjU.exe
  2⤵
  PID:6224
- C:\Windows\System\bMynhzm.exe
  C:\Windows\System\bMynhzm.exe
  2⤵
  PID:6316
- C:\Windows\System\UpaTUDn.exe
  C:\Windows\System\UpaTUDn.exe
  2⤵
  PID:6420
- C:\Windows\System\sgAHiRh.exe
  C:\Windows\System\sgAHiRh.exe
  2⤵
  PID:6564
- C:\Windows\System\kcwqVox.exe
  C:\Windows\System\kcwqVox.exe
  2⤵
  PID:6648
- C:\Windows\System\ljYyWkX.exe
  C:\Windows\System\ljYyWkX.exe
  2⤵
  PID:5044
- C:\Windows\System\kjVXUbU.exe
  C:\Windows\System\kjVXUbU.exe
  2⤵
  PID:6712
- C:\Windows\System\kEvUmGC.exe
  C:\Windows\System\kEvUmGC.exe
  2⤵
  PID:6744
- C:\Windows\System\OggPTKb.exe
  C:\Windows\System\OggPTKb.exe
  2⤵
  PID:6900
- C:\Windows\System\RNhhZQn.exe
  C:\Windows\System\RNhhZQn.exe
  2⤵
  PID:6940
- C:\Windows\System\vLTzxzH.exe
  C:\Windows\System\vLTzxzH.exe
  2⤵
  PID:7064
- C:\Windows\System\nydfgdv.exe
  C:\Windows\System\nydfgdv.exe
  2⤵
  PID:7104
- C:\Windows\System\FBNJtkr.exe
  C:\Windows\System\FBNJtkr.exe
  2⤵
  PID:7080
- C:\Windows\System\ZHHVCfR.exe
  C:\Windows\System\ZHHVCfR.exe
  2⤵
  PID:4540
- C:\Windows\System\nitFIpM.exe
  C:\Windows\System\nitFIpM.exe
  2⤵
  PID:6220
- C:\Windows\System\ZtAHgEE.exe
  C:\Windows\System\ZtAHgEE.exe
  2⤵
  PID:3100
- C:\Windows\System\DSrPuEa.exe
  C:\Windows\System\DSrPuEa.exe
  2⤵
  PID:6268
- C:\Windows\System\eoaRDRO.exe
  C:\Windows\System\eoaRDRO.exe
  2⤵
  PID:6548
- C:\Windows\System\XzHmhti.exe
  C:\Windows\System\XzHmhti.exe
  2⤵
  PID:6612
- C:\Windows\System\AjdlBHH.exe
  C:\Windows\System\AjdlBHH.exe
  2⤵
  PID:6508
- C:\Windows\System\GojSZcs.exe
  C:\Windows\System\GojSZcs.exe
  2⤵
  PID:7052
- C:\Windows\System\juWTQTT.exe
  C:\Windows\System\juWTQTT.exe
  2⤵
  PID:7020
- C:\Windows\System\gdKRlgL.exe
  C:\Windows\System\gdKRlgL.exe
  2⤵
  PID:7120
- C:\Windows\System\mnhrdeH.exe
  C:\Windows\System\mnhrdeH.exe
  2⤵
  PID:6776
- C:\Windows\System\zaKbQQL.exe
  C:\Windows\System\zaKbQQL.exe
  2⤵
  PID:6512
- C:\Windows\System\YJRtNBB.exe
  C:\Windows\System\YJRtNBB.exe
  2⤵
  PID:7176
- C:\Windows\System\erUrYep.exe
  C:\Windows\System\erUrYep.exe
  2⤵
  PID:7220
- C:\Windows\System\ghLBJNz.exe
  C:\Windows\System\ghLBJNz.exe
  2⤵
  PID:7288
- C:\Windows\System\UfYUHOZ.exe
  C:\Windows\System\UfYUHOZ.exe
  2⤵
  PID:7332
- C:\Windows\System\OkRAarF.exe
  C:\Windows\System\OkRAarF.exe
  2⤵
  PID:7348
- C:\Windows\System\VolDpWV.exe
  C:\Windows\System\VolDpWV.exe
  2⤵
  PID:7368
- C:\Windows\System\cZUoooF.exe
  C:\Windows\System\cZUoooF.exe
  2⤵
  PID:7384
- C:\Windows\System\FAJyDVR.exe
  C:\Windows\System\FAJyDVR.exe
  2⤵
  PID:7412
- C:\Windows\System\hiMBGdn.exe
  C:\Windows\System\hiMBGdn.exe
  2⤵
  PID:7428
- C:\Windows\System\vCbLDwQ.exe
  C:\Windows\System\vCbLDwQ.exe
  2⤵
  PID:7456
- C:\Windows\System\nGYsDkS.exe
  C:\Windows\System\nGYsDkS.exe
  2⤵
  PID:7472
- C:\Windows\System\YmyKOdh.exe
  C:\Windows\System\YmyKOdh.exe
  2⤵
  PID:7516
- C:\Windows\System\IyHNzjF.exe
  C:\Windows\System\IyHNzjF.exe
  2⤵
  PID:7532
- C:\Windows\System\tHKRGbG.exe
  C:\Windows\System\tHKRGbG.exe
  2⤵
  PID:7560
- C:\Windows\System\YRizwSX.exe
  C:\Windows\System\YRizwSX.exe
  2⤵
  PID:7608
- C:\Windows\System\lWDOWan.exe
  C:\Windows\System\lWDOWan.exe
  2⤵
  PID:7656
- C:\Windows\System\WAOdYWP.exe
  C:\Windows\System\WAOdYWP.exe
  2⤵
  PID:7672
- C:\Windows\System\oexyCdp.exe
  C:\Windows\System\oexyCdp.exe
  2⤵
  PID:7692
- C:\Windows\System\rwHvIEy.exe
  C:\Windows\System\rwHvIEy.exe
  2⤵
  PID:7716
- C:\Windows\System\jUKFAoi.exe
  C:\Windows\System\jUKFAoi.exe
  2⤵
  PID:7736
- C:\Windows\System\yRyXtRE.exe
  C:\Windows\System\yRyXtRE.exe
  2⤵
  PID:7760
- C:\Windows\System\aWsCJCV.exe
  C:\Windows\System\aWsCJCV.exe
  2⤵
  PID:7780
- C:\Windows\System\RlNZodX.exe
  C:\Windows\System\RlNZodX.exe
  2⤵
  PID:7800
- C:\Windows\System\kvAKoXd.exe
  C:\Windows\System\kvAKoXd.exe
  2⤵
  PID:7824
- C:\Windows\System\RRBKTrU.exe
  C:\Windows\System\RRBKTrU.exe
  2⤵
  PID:7840
- C:\Windows\System\tqqnShm.exe
  C:\Windows\System\tqqnShm.exe
  2⤵
  PID:7900
- C:\Windows\System\xgIfvig.exe
  C:\Windows\System\xgIfvig.exe
  2⤵
  PID:7920
- C:\Windows\System\GKgudCn.exe
  C:\Windows\System\GKgudCn.exe
  2⤵
  PID:7940
- C:\Windows\System\JxJpVDY.exe
  C:\Windows\System\JxJpVDY.exe
  2⤵
  PID:7960
- C:\Windows\System\CUFsDff.exe
  C:\Windows\System\CUFsDff.exe
  2⤵
  PID:7992
- C:\Windows\System\amzfJaR.exe
  C:\Windows\System\amzfJaR.exe
  2⤵
  PID:8040
- C:\Windows\System\xfNbWRU.exe
  C:\Windows\System\xfNbWRU.exe
  2⤵
  PID:8060
- C:\Windows\System\CPQMrnA.exe
  C:\Windows\System\CPQMrnA.exe
  2⤵
  PID:8112
- C:\Windows\System\rgdHDLK.exe
  C:\Windows\System\rgdHDLK.exe
  2⤵
  PID:8132
- C:\Windows\System\ocSCgDP.exe
  C:\Windows\System\ocSCgDP.exe
  2⤵
  PID:8184
- C:\Windows\System\IfkqRCw.exe
  C:\Windows\System\IfkqRCw.exe
  2⤵
  PID:7116
- C:\Windows\System\FRzXKVY.exe
  C:\Windows\System\FRzXKVY.exe
  2⤵
  PID:6920
- C:\Windows\System\NNiTNQh.exe
  C:\Windows\System\NNiTNQh.exe
  2⤵
  PID:7228
- C:\Windows\System\qErVZit.exe
  C:\Windows\System\qErVZit.exe
  2⤵
  PID:7280
- C:\Windows\System\clIYiCQ.exe
  C:\Windows\System\clIYiCQ.exe
  2⤵
  PID:7340
- C:\Windows\System\IOJWfAr.exe
  C:\Windows\System\IOJWfAr.exe
  2⤵
  PID:7436
- C:\Windows\System\bWrhBmk.exe
  C:\Windows\System\bWrhBmk.exe
  2⤵
  PID:7524
- C:\Windows\System\vdeuJuv.exe
  C:\Windows\System\vdeuJuv.exe
  2⤵
  PID:7728
- C:\Windows\System\WHUKmdw.exe
  C:\Windows\System\WHUKmdw.exe
  2⤵
  PID:7688
- C:\Windows\System\tHSyixj.exe
  C:\Windows\System\tHSyixj.exe
  2⤵
  PID:7732
- C:\Windows\System\LrnaSao.exe
  C:\Windows\System\LrnaSao.exe
  2⤵
  PID:7756
- C:\Windows\System\iOIwAlz.exe
  C:\Windows\System\iOIwAlz.exe
  2⤵
  PID:7768
- C:\Windows\System\FlVxfCi.exe
  C:\Windows\System\FlVxfCi.exe
  2⤵
  PID:7952
- C:\Windows\System\ixNYOxG.exe
  C:\Windows\System\ixNYOxG.exe
  2⤵
  PID:7984
- C:\Windows\System\dgErogU.exe
  C:\Windows\System\dgErogU.exe
  2⤵
  PID:8052
- C:\Windows\System\jNfboBP.exe
  C:\Windows\System\jNfboBP.exe
  2⤵
  PID:8032
- C:\Windows\System\oTwKfQN.exe
  C:\Windows\System\oTwKfQN.exe
  2⤵
  PID:8096
- C:\Windows\System\CdJwIYU.exe
  C:\Windows\System\CdJwIYU.exe
  2⤵
  PID:6332
- C:\Windows\System\ijdcENG.exe
  C:\Windows\System\ijdcENG.exe
  2⤵
  PID:7076
- C:\Windows\System\hmDpdjc.exe
  C:\Windows\System\hmDpdjc.exe
  2⤵
  PID:7424
- C:\Windows\System\qAjypyM.exe
  C:\Windows\System\qAjypyM.exe
  2⤵
  PID:7708
- C:\Windows\System\kVMLXQb.exe
  C:\Windows\System\kVMLXQb.exe
  2⤵
  PID:7832
- C:\Windows\System\XCmmkpS.exe
  C:\Windows\System\XCmmkpS.exe
  2⤵
  PID:7936
- C:\Windows\System\KkAExiy.exe
  C:\Windows\System\KkAExiy.exe
  2⤵
  PID:8124
- C:\Windows\System\GAzXRfr.exe
  C:\Windows\System\GAzXRfr.exe
  2⤵
  PID:7704
- C:\Windows\System\KcFKDZT.exe
  C:\Windows\System\KcFKDZT.exe
  2⤵
  PID:7808
- C:\Windows\System\kiCkdRx.exe
  C:\Windows\System\kiCkdRx.exe
  2⤵
  PID:7600
- C:\Windows\System\VfBFweO.exe
  C:\Windows\System\VfBFweO.exe
  2⤵
  PID:8196
- C:\Windows\System\PQebDTi.exe
  C:\Windows\System\PQebDTi.exe
  2⤵
  PID:8220
- C:\Windows\System\sqFklFA.exe
  C:\Windows\System\sqFklFA.exe
  2⤵
  PID:8236
- C:\Windows\System\vhBwqKv.exe
  C:\Windows\System\vhBwqKv.exe
  2⤵
  PID:8256
- C:\Windows\System\vGdshCn.exe
  C:\Windows\System\vGdshCn.exe
  2⤵
  PID:8272
- C:\Windows\System\smPOMqV.exe
  C:\Windows\System\smPOMqV.exe
  2⤵
  PID:8296
- C:\Windows\System\uiIHtWG.exe
  C:\Windows\System\uiIHtWG.exe
  2⤵
  PID:8312
- C:\Windows\System\EkvSWUN.exe
  C:\Windows\System\EkvSWUN.exe
  2⤵
  PID:8332
- C:\Windows\System\LzxTlXt.exe
  C:\Windows\System\LzxTlXt.exe
  2⤵
  PID:8356
- C:\Windows\System\zNRBSxU.exe
  C:\Windows\System\zNRBSxU.exe
  2⤵
  PID:8372
- C:\Windows\System\zNXkuQJ.exe
  C:\Windows\System\zNXkuQJ.exe
  2⤵
  PID:8416
- C:\Windows\System\BZmHKOg.exe
  C:\Windows\System\BZmHKOg.exe
  2⤵
  PID:8436
- C:\Windows\System\TBaBVAu.exe
  C:\Windows\System\TBaBVAu.exe
  2⤵
  PID:8456
- C:\Windows\System\RQItsSj.exe
  C:\Windows\System\RQItsSj.exe
  2⤵
  PID:8512
- C:\Windows\System\UtMJILk.exe
  C:\Windows\System\UtMJILk.exe
  2⤵
  PID:8536
- C:\Windows\System\sOfEVhZ.exe
  C:\Windows\System\sOfEVhZ.exe
  2⤵
  PID:8556
- C:\Windows\System\RlpZKgT.exe
  C:\Windows\System\RlpZKgT.exe
  2⤵
  PID:8592
- C:\Windows\System\OkhOOYY.exe
  C:\Windows\System\OkhOOYY.exe
  2⤵
  PID:8624
- C:\Windows\System\LyMLqSI.exe
  C:\Windows\System\LyMLqSI.exe
  2⤵
  PID:8652
- C:\Windows\System\uDsHnLi.exe
  C:\Windows\System\uDsHnLi.exe
  2⤵
  PID:8672
- C:\Windows\System\IFoXNPF.exe
  C:\Windows\System\IFoXNPF.exe
  2⤵
  PID:8712
- C:\Windows\System\ApReMWp.exe
  C:\Windows\System\ApReMWp.exe
  2⤵
  PID:8728
- C:\Windows\System\ZswUHcJ.exe
  C:\Windows\System\ZswUHcJ.exe
  2⤵
  PID:8776
- C:\Windows\System\PExPgAd.exe
  C:\Windows\System\PExPgAd.exe
  2⤵
  PID:8816
- C:\Windows\System\OJMTrqP.exe
  C:\Windows\System\OJMTrqP.exe
  2⤵
  PID:8836
- C:\Windows\System\DEPJtRM.exe
  C:\Windows\System\DEPJtRM.exe
  2⤵
  PID:8876
- C:\Windows\System\BuPUyPS.exe
  C:\Windows\System\BuPUyPS.exe
  2⤵
  PID:8900
- C:\Windows\System\MfrleEE.exe
  C:\Windows\System\MfrleEE.exe
  2⤵
  PID:8928
- C:\Windows\System\qSckKLO.exe
  C:\Windows\System\qSckKLO.exe
  2⤵
  PID:8948
- C:\Windows\System\tLuFNIJ.exe
  C:\Windows\System\tLuFNIJ.exe
  2⤵
  PID:8976
- C:\Windows\System\YiOIapk.exe
  C:\Windows\System\YiOIapk.exe
  2⤵
  PID:8992
- C:\Windows\System\HfEIEtd.exe
  C:\Windows\System\HfEIEtd.exe
  2⤵
  PID:9012
- C:\Windows\System\kUncslU.exe
  C:\Windows\System\kUncslU.exe
  2⤵
  PID:9056
- C:\Windows\System\ZPeJATN.exe
  C:\Windows\System\ZPeJATN.exe
  2⤵
  PID:9076
- C:\Windows\System\tFSujai.exe
  C:\Windows\System\tFSujai.exe
  2⤵
  PID:9100
- C:\Windows\System\JGBVUkJ.exe
  C:\Windows\System\JGBVUkJ.exe
  2⤵
  PID:9120
- C:\Windows\System\skEtdQv.exe
  C:\Windows\System\skEtdQv.exe
  2⤵
  PID:9140
- C:\Windows\System\tCQwFjw.exe
  C:\Windows\System\tCQwFjw.exe
  2⤵
  PID:9176
- C:\Windows\System\kwfohGP.exe
  C:\Windows\System\kwfohGP.exe
  2⤵
  PID:8228
- C:\Windows\System\SSAINFv.exe
  C:\Windows\System\SSAINFv.exe
  2⤵
  PID:8244
- C:\Windows\System\jmXwVGC.exe
  C:\Windows\System\jmXwVGC.exe
  2⤵
  PID:8288
- C:\Windows\System\nYESWeH.exe
  C:\Windows\System\nYESWeH.exe
  2⤵
  PID:8344
- C:\Windows\System\fhDlugu.exe
  C:\Windows\System\fhDlugu.exe
  2⤵
  PID:8308
- C:\Windows\System\MWEwsMX.exe
  C:\Windows\System\MWEwsMX.exe
  2⤵
  PID:8408
- C:\Windows\System\BxRNTkI.exe
  C:\Windows\System\BxRNTkI.exe
  2⤵
  PID:8564
- C:\Windows\System\aTXMEol.exe
  C:\Windows\System\aTXMEol.exe
  2⤵
  PID:8532
- C:\Windows\System\BtaOUay.exe
  C:\Windows\System\BtaOUay.exe
  2⤵
  PID:8580
- C:\Windows\System\mufUbMT.exe
  C:\Windows\System\mufUbMT.exe
  2⤵
  PID:8608
- C:\Windows\System\iXpVmyy.exe
  C:\Windows\System\iXpVmyy.exe
  2⤵
  PID:8800
- C:\Windows\System\EvLPSut.exe
  C:\Windows\System\EvLPSut.exe
  2⤵
  PID:8768
- C:\Windows\System\lahszQe.exe
  C:\Windows\System\lahszQe.exe
  2⤵
  PID:8868
- C:\Windows\System\whXwfaf.exe
  C:\Windows\System\whXwfaf.exe
  2⤵
  PID:8944
- C:\Windows\System\IRnrbEd.exe
  C:\Windows\System\IRnrbEd.exe
  2⤵
  PID:9036
- C:\Windows\System\XUiTJGl.exe
  C:\Windows\System\XUiTJGl.exe
  2⤵
  PID:9048
- C:\Windows\System\DSbHBRO.exe
  C:\Windows\System\DSbHBRO.exe
  2⤵
  PID:9204
- C:\Windows\System\puPvuak.exe
  C:\Windows\System\puPvuak.exe
  2⤵
  PID:8212
- C:\Windows\System\HryvTJN.exe
  C:\Windows\System\HryvTJN.exe
  2⤵
  PID:8684
- C:\Windows\System\iZNFHNn.exe
  C:\Windows\System\iZNFHNn.exe
  2⤵
  PID:8524
- C:\Windows\System\BvtewxR.exe
  C:\Windows\System\BvtewxR.exe
  2⤵
  PID:8668
- C:\Windows\System\tZMTInY.exe
  C:\Windows\System\tZMTInY.exe
  2⤵
  PID:8748
- C:\Windows\System\BLYOvyy.exe
  C:\Windows\System\BLYOvyy.exe
  2⤵
  PID:9128
- C:\Windows\System\ZMONSlF.exe
  C:\Windows\System\ZMONSlF.exe
  2⤵
  PID:8028
- C:\Windows\System\acZJdTn.exe
  C:\Windows\System\acZJdTn.exe
  2⤵
  PID:4376
- C:\Windows\System\RFwnzfj.exe
  C:\Windows\System\RFwnzfj.exe
  2⤵
  PID:8432
- C:\Windows\System\uCbgvHv.exe
  C:\Windows\System\uCbgvHv.exe
  2⤵
  PID:8856
- C:\Windows\System\ZooOJTY.exe
  C:\Windows\System\ZooOJTY.exe
  2⤵
  PID:9224
- C:\Windows\System\qGlhymt.exe
  C:\Windows\System\qGlhymt.exe
  2⤵
  PID:9248
- C:\Windows\System\HCyCuQD.exe
  C:\Windows\System\HCyCuQD.exe
  2⤵
  PID:9264
- C:\Windows\System\XpiHfab.exe
  C:\Windows\System\XpiHfab.exe
  2⤵
  PID:9288
- C:\Windows\System\SceNCMq.exe
  C:\Windows\System\SceNCMq.exe
  2⤵
  PID:9308
- C:\Windows\System\jnUuupi.exe
  C:\Windows\System\jnUuupi.exe
  2⤵
  PID:9324
- C:\Windows\System\bSOcpSt.exe
  C:\Windows\System\bSOcpSt.exe
  2⤵
  PID:9344
- C:\Windows\System\pFhWsEc.exe
  C:\Windows\System\pFhWsEc.exe
  2⤵
  PID:9360
- C:\Windows\System\vTQyIpE.exe
  C:\Windows\System\vTQyIpE.exe
  2⤵
  PID:9380
- C:\Windows\System\vLJErcd.exe
  C:\Windows\System\vLJErcd.exe
  2⤵
  PID:9404
- C:\Windows\System\xTEcsum.exe
  C:\Windows\System\xTEcsum.exe
  2⤵
  PID:9448
- C:\Windows\System\QRixDHi.exe
  C:\Windows\System\QRixDHi.exe
  2⤵
  PID:9516
- C:\Windows\System\NRilekH.exe
  C:\Windows\System\NRilekH.exe
  2⤵
  PID:9540
- C:\Windows\System\dmLVDUj.exe
  C:\Windows\System\dmLVDUj.exe
  2⤵
  PID:9572
- C:\Windows\System\DTJxbEM.exe
  C:\Windows\System\DTJxbEM.exe
  2⤵
  PID:9592
- C:\Windows\System\VYctNUs.exe
  C:\Windows\System\VYctNUs.exe
  2⤵
  PID:9692
- C:\Windows\System\fbwoQCA.exe
  C:\Windows\System\fbwoQCA.exe
  2⤵
  PID:9712
- C:\Windows\System\Wpllbsj.exe
  C:\Windows\System\Wpllbsj.exe
  2⤵
  PID:9764
- C:\Windows\System\HcAIUey.exe
  C:\Windows\System\HcAIUey.exe
  2⤵
  PID:9780
- C:\Windows\System\FpHSdnU.exe
  C:\Windows\System\FpHSdnU.exe
  2⤵
  PID:9820
- C:\Windows\System\wLDMgde.exe
  C:\Windows\System\wLDMgde.exe
  2⤵
  PID:9844
- C:\Windows\System\ESkJvLx.exe
  C:\Windows\System\ESkJvLx.exe
  2⤵
  PID:9860
- C:\Windows\System\toYvaqF.exe
  C:\Windows\System\toYvaqF.exe
  2⤵
  PID:9880
- C:\Windows\System\hWbCMQt.exe
  C:\Windows\System\hWbCMQt.exe
  2⤵
  PID:9896
- C:\Windows\System\sjPbYsa.exe
  C:\Windows\System\sjPbYsa.exe
  2⤵
  PID:9920
- C:\Windows\System\jDUwVdt.exe
  C:\Windows\System\jDUwVdt.exe
  2⤵
  PID:9936
- C:\Windows\System\VQvZKRF.exe
  C:\Windows\System\VQvZKRF.exe
  2⤵
  PID:9956
- C:\Windows\System\XGhAkhf.exe
  C:\Windows\System\XGhAkhf.exe
  2⤵
  PID:9980
- C:\Windows\System\otbWTBl.exe
  C:\Windows\System\otbWTBl.exe
  2⤵
  PID:10000
- C:\Windows\System\seiOFfg.exe
  C:\Windows\System\seiOFfg.exe
  2⤵
  PID:10020
- C:\Windows\System\fxVebeT.exe
  C:\Windows\System\fxVebeT.exe
  2⤵
  PID:10060
- C:\Windows\System\MFoqbJz.exe
  C:\Windows\System\MFoqbJz.exe
  2⤵
  PID:10080
- C:\Windows\System\wglhpFd.exe
  C:\Windows\System\wglhpFd.exe
  2⤵
  PID:10136
- C:\Windows\System\PcUVkGd.exe
  C:\Windows\System\PcUVkGd.exe
  2⤵
  PID:10176
- C:\Windows\System\aciwynm.exe
  C:\Windows\System\aciwynm.exe
  2⤵
  PID:10196
- C:\Windows\System\NbvDZtL.exe
  C:\Windows\System\NbvDZtL.exe
  2⤵
  PID:10216
- C:\Windows\System\QYHvZyr.exe
  C:\Windows\System\QYHvZyr.exe
  2⤵
  PID:10236
- C:\Windows\System\fGIcxPZ.exe
  C:\Windows\System\fGIcxPZ.exe
  2⤵
  PID:8812
- C:\Windows\System\LZNcoNk.exe
  C:\Windows\System\LZNcoNk.exe
  2⤵
  PID:8848
- C:\Windows\System\SYiphoV.exe
  C:\Windows\System\SYiphoV.exe
  2⤵
  PID:9260
- C:\Windows\System\uOhTFyO.exe
  C:\Windows\System\uOhTFyO.exe
  2⤵
  PID:9412
- C:\Windows\System\APyWhKC.exe
  C:\Windows\System\APyWhKC.exe
  2⤵
  PID:9440
- C:\Windows\System\MPwTbPQ.exe
  C:\Windows\System\MPwTbPQ.exe
  2⤵
  PID:9548
- C:\Windows\System\wCFLURO.exe
  C:\Windows\System\wCFLURO.exe
  2⤵
  PID:9704
- C:\Windows\System\JHrSGZU.exe
  C:\Windows\System\JHrSGZU.exe
  2⤵
  PID:9752
- C:\Windows\System\WJgdVXV.exe
  C:\Windows\System\WJgdVXV.exe
  2⤵
  PID:9828
- C:\Windows\System\qKwVOPF.exe
  C:\Windows\System\qKwVOPF.exe
  2⤵
  PID:9876
- C:\Windows\System\dZBYpZm.exe
  C:\Windows\System\dZBYpZm.exe
  2⤵
  PID:9992
- C:\Windows\System\UQnbYSj.exe
  C:\Windows\System\UQnbYSj.exe
  2⤵
  PID:9852
- C:\Windows\System\AvNCBFc.exe
  C:\Windows\System\AvNCBFc.exe
  2⤵
  PID:10068
- C:\Windows\System\XeDzXbD.exe
  C:\Windows\System\XeDzXbD.exe
  2⤵
  PID:10212
- C:\Windows\System\awdxgAE.exe
  C:\Windows\System\awdxgAE.exe
  2⤵
  PID:9232
- C:\Windows\System\sxMSjCb.exe
  C:\Windows\System\sxMSjCb.exe
  2⤵
  PID:9528
- C:\Windows\System\YdcZUCp.exe
  C:\Windows\System\YdcZUCp.exe
  2⤵
  PID:9612
- C:\Windows\System\lnPRciB.exe
  C:\Windows\System\lnPRciB.exe
  2⤵
  PID:10008
- C:\Windows\System\QEVbakH.exe
  C:\Windows\System\QEVbakH.exe
  2⤵
  PID:10208
- C:\Windows\System\jDFDsPx.exe
  C:\Windows\System\jDFDsPx.exe
  2⤵
  PID:9740
- C:\Windows\System\wMrqdIZ.exe
  C:\Windows\System\wMrqdIZ.exe
  2⤵
  PID:9708
- C:\Windows\System\hDrNcmH.exe
  C:\Windows\System\hDrNcmH.exe
  2⤵
  PID:10260
- C:\Windows\System\UkeAppR.exe
  C:\Windows\System\UkeAppR.exe
  2⤵
  PID:10280
- C:\Windows\System\arVUrpU.exe
  C:\Windows\System\arVUrpU.exe
  2⤵
  PID:10296
- C:\Windows\System\SfbvKJb.exe
  C:\Windows\System\SfbvKJb.exe
  2⤵
  PID:10312
- C:\Windows\System\SePBcoB.exe
  C:\Windows\System\SePBcoB.exe
  2⤵
  PID:10372
- C:\Windows\System\uSKVfrp.exe
  C:\Windows\System\uSKVfrp.exe
  2⤵
  PID:10388
- C:\Windows\System\razsRHH.exe
  C:\Windows\System\razsRHH.exe
  2⤵
  PID:10408
- C:\Windows\System\jbQKfaD.exe
  C:\Windows\System\jbQKfaD.exe
  2⤵
  PID:10424
- C:\Windows\System\xpeaiUN.exe
  C:\Windows\System\xpeaiUN.exe
  2⤵
  PID:10476
- C:\Windows\System\kWoEsju.exe
  C:\Windows\System\kWoEsju.exe
  2⤵
  PID:10568
- C:\Windows\System\PDpUpIp.exe
  C:\Windows\System\PDpUpIp.exe
  2⤵
  PID:10592
- C:\Windows\System\VRmYmQG.exe
  C:\Windows\System\VRmYmQG.exe
  2⤵
  PID:10632
- C:\Windows\System\XDnSDtd.exe
  C:\Windows\System\XDnSDtd.exe
  2⤵
  PID:10648
- C:\Windows\System\JLMruzw.exe
  C:\Windows\System\JLMruzw.exe
  2⤵
  PID:10668
- C:\Windows\System\KQMXwAv.exe
  C:\Windows\System\KQMXwAv.exe
  2⤵
  PID:10732
- C:\Windows\System\qFACtPS.exe
  C:\Windows\System\qFACtPS.exe
  2⤵
  PID:10760
- C:\Windows\System\BymmYxd.exe
  C:\Windows\System\BymmYxd.exe
  2⤵
  PID:10776
- C:\Windows\System\WMDlPyF.exe
  C:\Windows\System\WMDlPyF.exe
  2⤵
  PID:10796
- C:\Windows\System\jnDLZEM.exe
  C:\Windows\System\jnDLZEM.exe
  2⤵
  PID:10820
- C:\Windows\System\CtrPqRu.exe
  C:\Windows\System\CtrPqRu.exe
  2⤵
  PID:10836
- C:\Windows\System\MHJyveL.exe
  C:\Windows\System\MHJyveL.exe
  2⤵
  PID:10888
- C:\Windows\System\IYCeEjL.exe
  C:\Windows\System\IYCeEjL.exe
  2⤵
  PID:10920
- C:\Windows\System\mlpmhwt.exe
  C:\Windows\System\mlpmhwt.exe
  2⤵
  PID:10940
- C:\Windows\System\zLbhGIQ.exe
  C:\Windows\System\zLbhGIQ.exe
  2⤵
  PID:10968
- C:\Windows\System\HdjPfsb.exe
  C:\Windows\System\HdjPfsb.exe
  2⤵
  PID:11008
- C:\Windows\System\jWUcojG.exe
  C:\Windows\System\jWUcojG.exe
  2⤵
  PID:11052
- C:\Windows\System\iIBMSOg.exe
  C:\Windows\System\iIBMSOg.exe
  2⤵
  PID:11072
- C:\Windows\System\omdsGSd.exe
  C:\Windows\System\omdsGSd.exe
  2⤵
  PID:11092
- C:\Windows\System\zCEzHpY.exe
  C:\Windows\System\zCEzHpY.exe
  2⤵
  PID:11112
- C:\Windows\System\vnBGhJM.exe
  C:\Windows\System\vnBGhJM.exe
  2⤵
  PID:11156
- C:\Windows\System\pYqdWvY.exe
  C:\Windows\System\pYqdWvY.exe
  2⤵
  PID:11172
- C:\Windows\System\EVpkVZm.exe
  C:\Windows\System\EVpkVZm.exe
  2⤵
  PID:11220
- C:\Windows\System\JQTyewy.exe
  C:\Windows\System\JQTyewy.exe
  2⤵
  PID:11244
- C:\Windows\System\BcELhmw.exe
  C:\Windows\System\BcELhmw.exe
  2⤵
  PID:9840
- C:\Windows\System\RrkXQEr.exe
  C:\Windows\System\RrkXQEr.exe
  2⤵
  PID:9944
- C:\Windows\System\FbWXjlc.exe
  C:\Windows\System\FbWXjlc.exe
  2⤵
  PID:10308
- C:\Windows\System\ZdfLCcN.exe
  C:\Windows\System\ZdfLCcN.exe
  2⤵
  PID:10348
- C:\Windows\System\nvEVvQp.exe
  C:\Windows\System\nvEVvQp.exe
  2⤵
  PID:9656
- C:\Windows\System\dXBFYHl.exe
  C:\Windows\System\dXBFYHl.exe
  2⤵
  PID:9584
- C:\Windows\System\vndBKBX.exe
  C:\Windows\System\vndBKBX.exe
  2⤵
  PID:10400
- C:\Windows\System\eWmwxos.exe
  C:\Windows\System\eWmwxos.exe
  2⤵
  PID:10272
- C:\Windows\System\qjMQXNO.exe
  C:\Windows\System\qjMQXNO.exe
  2⤵
  PID:10384
- C:\Windows\System\CHKoqaO.exe
  C:\Windows\System\CHKoqaO.exe
  2⤵
  PID:10488
- C:\Windows\System\bRzoJYP.exe
  C:\Windows\System\bRzoJYP.exe
  2⤵
  PID:10472
- C:\Windows\System\yLubhZm.exe
  C:\Windows\System\yLubhZm.exe
  2⤵
  PID:10560
- C:\Windows\System\EeyWCxO.exe
  C:\Windows\System\EeyWCxO.exe
  2⤵
  PID:10584
- C:\Windows\System\LOkXTlV.exe
  C:\Windows\System\LOkXTlV.exe
  2⤵
  PID:10708
- C:\Windows\System\RaPQxJg.exe
  C:\Windows\System\RaPQxJg.exe
  2⤵
  PID:10720
- C:\Windows\System\HIUQrgO.exe
  C:\Windows\System\HIUQrgO.exe
  2⤵
  PID:10804
- C:\Windows\System\EWcLDvX.exe
  C:\Windows\System\EWcLDvX.exe
  2⤵
  PID:10928
- C:\Windows\System\qjBOddA.exe
  C:\Windows\System\qjBOddA.exe
  2⤵
  PID:10876
- C:\Windows\System\IbrDdIH.exe
  C:\Windows\System\IbrDdIH.exe
  2⤵
  PID:10988
- C:\Windows\System\HhjNQqI.exe
  C:\Windows\System\HhjNQqI.exe
  2⤵
  PID:11060
- C:\Windows\System\vbJrYaY.exe
  C:\Windows\System\vbJrYaY.exe
  2⤵
  PID:11164
- C:\Windows\System\oTtGASR.exe
  C:\Windows\System\oTtGASR.exe
  2⤵
  PID:9816
- C:\Windows\System\APIQkwk.exe
  C:\Windows\System\APIQkwk.exe
  2⤵
  PID:8160
- C:\Windows\System\EzyeTCF.exe
  C:\Windows\System\EzyeTCF.exe
  2⤵
  PID:10160
- C:\Windows\System\wdMzUsW.exe
  C:\Windows\System\wdMzUsW.exe
  2⤵
  PID:10344
- C:\Windows\System\DTWSbZC.exe
  C:\Windows\System\DTWSbZC.exe
  2⤵
  PID:10544
- C:\Windows\System\KSaqnvq.exe
  C:\Windows\System\KSaqnvq.exe
  2⤵
  PID:10852
- C:\Windows\System\emcyIay.exe
  C:\Windows\System\emcyIay.exe
  2⤵
  PID:10788
- C:\Windows\System\nJzAByE.exe
  C:\Windows\System\nJzAByE.exe
  2⤵
  PID:11200
- C:\Windows\System\xnCgLun.exe
  C:\Windows\System\xnCgLun.exe
  2⤵
  PID:11216
- C:\Windows\System\eOXDLVv.exe
  C:\Windows\System\eOXDLVv.exe
  2⤵
  PID:9792
- C:\Windows\System\lSwQNQU.exe
  C:\Windows\System\lSwQNQU.exe
  2⤵
  PID:10320
- C:\Windows\System\EPGQppM.exe
  C:\Windows\System\EPGQppM.exe
  2⤵
  PID:10948
- C:\Windows\System\jHYYerc.exe
  C:\Windows\System\jHYYerc.exe
  2⤵
  PID:11152
- C:\Windows\System\TzffJLP.exe
  C:\Windows\System\TzffJLP.exe
  2⤵
  PID:8488
- C:\Windows\System\wtpWICy.exe
  C:\Windows\System\wtpWICy.exe
  2⤵
  PID:10712
- C:\Windows\System\NyMXAFt.exe
  C:\Windows\System\NyMXAFt.exe
  2⤵
  PID:11288
- C:\Windows\System\aTYREcV.exe
  C:\Windows\System\aTYREcV.exe
  2⤵
  PID:11316
- C:\Windows\System\LYTZZgD.exe
  C:\Windows\System\LYTZZgD.exe
  2⤵
  PID:11332
- C:\Windows\System\ZfyOnfQ.exe
  C:\Windows\System\ZfyOnfQ.exe
  2⤵
  PID:11348
- C:\Windows\System\hRbVkwN.exe
  C:\Windows\System\hRbVkwN.exe
  2⤵
  PID:11412
- C:\Windows\System\aBQhJia.exe
  C:\Windows\System\aBQhJia.exe
  2⤵
  PID:11440
- C:\Windows\System\rOSZdrO.exe
  C:\Windows\System\rOSZdrO.exe
  2⤵
  PID:11464
- C:\Windows\System\smuCETM.exe
  C:\Windows\System\smuCETM.exe
  2⤵
  PID:11500
- C:\Windows\System\wBnVyEp.exe
  C:\Windows\System\wBnVyEp.exe
  2⤵
  PID:11540
- C:\Windows\System\PHZrHQe.exe
  C:\Windows\System\PHZrHQe.exe
  2⤵
  PID:11572
- C:\Windows\System\IsFkbgl.exe
  C:\Windows\System\IsFkbgl.exe
  2⤵
  PID:11592
- C:\Windows\System\yRMSIFi.exe
  C:\Windows\System\yRMSIFi.exe
  2⤵
  PID:11616
- C:\Windows\System\UNSnJCz.exe
  C:\Windows\System\UNSnJCz.exe
  2⤵
  PID:11632
- C:\Windows\System\EtTtcfz.exe
  C:\Windows\System\EtTtcfz.exe
  2⤵
  PID:11652
- C:\Windows\System\wChxmSh.exe
  C:\Windows\System\wChxmSh.exe
  2⤵
  PID:11704
- C:\Windows\System\dUDCfVl.exe
  C:\Windows\System\dUDCfVl.exe
  2⤵
  PID:11724
- C:\Windows\System\poEUPLQ.exe
  C:\Windows\System\poEUPLQ.exe
  2⤵
  PID:11740
- C:\Windows\System\oBTjQyF.exe
  C:\Windows\System\oBTjQyF.exe
  2⤵
  PID:11772
- C:\Windows\System\fuMqtub.exe
  C:\Windows\System\fuMqtub.exe
  2⤵
  PID:11800
- C:\Windows\System\WruvVQp.exe
  C:\Windows\System\WruvVQp.exe
  2⤵
  PID:11824
- C:\Windows\System\xaOmpHE.exe
  C:\Windows\System\xaOmpHE.exe
  2⤵
  PID:11852
- C:\Windows\System\fSKEPeE.exe
  C:\Windows\System\fSKEPeE.exe
  2⤵
  PID:11892
- C:\Windows\System\UZonDNZ.exe
  C:\Windows\System\UZonDNZ.exe
  2⤵
  PID:11912
- C:\Windows\System\deWNyrD.exe
  C:\Windows\System\deWNyrD.exe
  2⤵
  PID:11932
- C:\Windows\System\IdTTKwZ.exe
  C:\Windows\System\IdTTKwZ.exe
  2⤵
  PID:11952
- C:\Windows\System\SsWKqOa.exe
  C:\Windows\System\SsWKqOa.exe
  2⤵
  PID:11976
- C:\Windows\System\vXqqFIc.exe
  C:\Windows\System\vXqqFIc.exe
  2⤵
  PID:12008
- C:\Windows\System\UFbLDpy.exe
  C:\Windows\System\UFbLDpy.exe
  2⤵
  PID:12036
- C:\Windows\System\XgUZwMZ.exe
  C:\Windows\System\XgUZwMZ.exe
  2⤵
  PID:12056
- C:\Windows\System\MBdavlL.exe
  C:\Windows\System\MBdavlL.exe
  2⤵
  PID:12096
- C:\Windows\System\iPdnUbr.exe
  C:\Windows\System\iPdnUbr.exe
  2⤵
  PID:12120
- C:\Windows\System\nMPkeyK.exe
  C:\Windows\System\nMPkeyK.exe
  2⤵
  PID:12136
- C:\Windows\System\hVcJAxM.exe
  C:\Windows\System\hVcJAxM.exe
  2⤵
  PID:12164
- C:\Windows\System\qFDgPNd.exe
  C:\Windows\System\qFDgPNd.exe
  2⤵
  PID:12232
- C:\Windows\System\OqCWMOZ.exe
  C:\Windows\System\OqCWMOZ.exe
  2⤵
  PID:12264
- C:\Windows\System\EEWFMUw.exe
  C:\Windows\System\EEWFMUw.exe
  2⤵
  PID:12280
- C:\Windows\System\DdCwkCZ.exe
  C:\Windows\System\DdCwkCZ.exe
  2⤵
  PID:11000
- C:\Windows\System\uKsJARE.exe
  C:\Windows\System\uKsJARE.exe
  2⤵
  PID:11324
- C:\Windows\System\IzjqXZU.exe
  C:\Windows\System\IzjqXZU.exe
  2⤵
  PID:11428
- C:\Windows\System\JjyRdmW.exe
  C:\Windows\System\JjyRdmW.exe
  2⤵
  PID:11480
- C:\Windows\System\UgBpoHJ.exe
  C:\Windows\System\UgBpoHJ.exe
  2⤵
  PID:11532
- C:\Windows\System\PYEHHFc.exe
  C:\Windows\System\PYEHHFc.exe
  2⤵
  PID:11624
- C:\Windows\System\MkNvGPE.exe
  C:\Windows\System\MkNvGPE.exe
  2⤵
  PID:11608
- C:\Windows\System\gdHiPoi.exe
  C:\Windows\System\gdHiPoi.exe
  2⤵
  PID:11628
- C:\Windows\System\hwLPhkH.exe
  C:\Windows\System\hwLPhkH.exe
  2⤵
  PID:11732
- C:\Windows\System\HnkrRWO.exe
  C:\Windows\System\HnkrRWO.exe
  2⤵
  PID:11808
- C:\Windows\System\OHLcHJO.exe
  C:\Windows\System\OHLcHJO.exe
  2⤵
  PID:11820
- C:\Windows\System\gKTkcwG.exe
  C:\Windows\System\gKTkcwG.exe
  2⤵
  PID:11944
- C:\Windows\System\ANFrMRb.exe
  C:\Windows\System\ANFrMRb.exe
  2⤵
  PID:12092
- C:\Windows\System\CkcRXiz.exe
  C:\Windows\System\CkcRXiz.exe
  2⤵
  PID:12048
- C:\Windows\System\wgibMGF.exe
  C:\Windows\System\wgibMGF.exe
  2⤵
  PID:12156
- C:\Windows\System\woVaFTs.exe
  C:\Windows\System\woVaFTs.exe
  2⤵
  PID:1352
- C:\Windows\System\bXxEbsb.exe
  C:\Windows\System\bXxEbsb.exe
  2⤵
  PID:1096
- C:\Windows\System\iRfqzlL.exe
  C:\Windows\System\iRfqzlL.exe
  2⤵
  PID:12276
- C:\Windows\System\lWOLbcs.exe
  C:\Windows\System\lWOLbcs.exe
  2⤵
  PID:11396
- C:\Windows\System\nnzBKzf.exe
  C:\Windows\System\nnzBKzf.exe
  2⤵
  PID:11492
- C:\Windows\System\lutRJiB.exe
  C:\Windows\System\lutRJiB.exe
  2⤵
  PID:11644
- C:\Windows\System\GeFBxhQ.exe
  C:\Windows\System\GeFBxhQ.exe
  2⤵
  PID:11692
- C:\Windows\System\nnApaVC.exe
  C:\Windows\System\nnApaVC.exe
  2⤵
  PID:11788
- C:\Windows\System\atmEiwS.exe
  C:\Windows\System\atmEiwS.exe
  2⤵
  PID:12032
- C:\Windows\System\xQnELka.exe
  C:\Windows\System\xQnELka.exe
  2⤵
  PID:10588
- C:\Windows\System\BTDponG.exe
  C:\Windows\System\BTDponG.exe
  2⤵
  PID:11280
- C:\Windows\System\tSATPNu.exe
  C:\Windows\System\tSATPNu.exe
  2⤵
  PID:11668
- C:\Windows\System\eGjGasz.exe
  C:\Windows\System\eGjGasz.exe
  2⤵
  PID:12044
- C:\Windows\System\OydtNYj.exe
  C:\Windows\System\OydtNYj.exe
  2⤵
  PID:12024
- C:\Windows\System\dhTRRwK.exe
  C:\Windows\System\dhTRRwK.exe
  2⤵
  PID:11712
- C:\Windows\System\tFmgvkJ.exe
  C:\Windows\System\tFmgvkJ.exe
  2⤵
  PID:12312
- C:\Windows\System\BxKgcXh.exe
  C:\Windows\System\BxKgcXh.exe
  2⤵
  PID:12328
- C:\Windows\System\bjJRSpA.exe
  C:\Windows\System\bjJRSpA.exe
  2⤵
  PID:12376
- C:\Windows\System\AIaYJuw.exe
  C:\Windows\System\AIaYJuw.exe
  2⤵
  PID:12392
- C:\Windows\System\WBvFKbZ.exe
  C:\Windows\System\WBvFKbZ.exe
  2⤵
  PID:12416
- C:\Windows\System\NGWqjaK.exe
  C:\Windows\System\NGWqjaK.exe
  2⤵
  PID:12436
- C:\Windows\System\eXuVOMp.exe
  C:\Windows\System\eXuVOMp.exe
  2⤵
  PID:12460
- C:\Windows\System\QwAyQgc.exe
  C:\Windows\System\QwAyQgc.exe
  2⤵
  PID:12492
- C:\Windows\System\InfUGPq.exe
  C:\Windows\System\InfUGPq.exe
  2⤵
  PID:12512
- C:\Windows\System\HIVWkgZ.exe
  C:\Windows\System\HIVWkgZ.exe
  2⤵
  PID:12532
- C:\Windows\System\rUXIjCm.exe
  C:\Windows\System\rUXIjCm.exe
  2⤵
  PID:12560
- C:\Windows\System\jPQckTc.exe
  C:\Windows\System\jPQckTc.exe
  2⤵
  PID:12608
- C:\Windows\System\PRVZqbf.exe
  C:\Windows\System\PRVZqbf.exe
  2⤵
  PID:12628
- C:\Windows\System\OguEtEz.exe
  C:\Windows\System\OguEtEz.exe
  2⤵
  PID:12652
- C:\Windows\System\lEdXclS.exe
  C:\Windows\System\lEdXclS.exe
  2⤵
  PID:12712
- C:\Windows\System\snsMKlg.exe
  C:\Windows\System\snsMKlg.exe
  2⤵
  PID:12732
- C:\Windows\System\ShYAEnP.exe
  C:\Windows\System\ShYAEnP.exe
  2⤵
  PID:12780
- C:\Windows\System\fopAZuy.exe
  C:\Windows\System\fopAZuy.exe
  2⤵
  PID:12800
- C:\Windows\System\lQJSFDR.exe
  C:\Windows\System\lQJSFDR.exe
  2⤵
  PID:12836
- C:\Windows\System\HsPZNTi.exe
  C:\Windows\System\HsPZNTi.exe
  2⤵
  PID:12880
- C:\Windows\System\JVYBLBk.exe
  C:\Windows\System\JVYBLBk.exe
  2⤵
  PID:12896
- C:\Windows\System\FsmXYKK.exe
  C:\Windows\System\FsmXYKK.exe
  2⤵
  PID:12912
- C:\Windows\System\YqVOcJw.exe
  C:\Windows\System\YqVOcJw.exe
  2⤵
  PID:12932
- C:\Windows\System\KHpQhqh.exe
  C:\Windows\System\KHpQhqh.exe
  2⤵
  PID:12272
- C:\Windows\System\rFmYLWp.exe
  C:\Windows\System\rFmYLWp.exe
  2⤵
  PID:12324
- C:\Windows\System\igQwcBf.exe
  C:\Windows\System\igQwcBf.exe
  2⤵
  PID:13048
- C:\Windows\System\LKJBeNk.exe
  C:\Windows\System\LKJBeNk.exe
  2⤵
  PID:12144
- C:\Windows\System\DkDoONA.exe
  C:\Windows\System\DkDoONA.exe
  2⤵
  PID:12468
- C:\Windows\System\zopZIEa.exe
  C:\Windows\System\zopZIEa.exe
  2⤵
  PID:12404
- C:\Windows\System\lFvhDXK.exe
  C:\Windows\System\lFvhDXK.exe
  2⤵
  PID:4300
- C:\Windows\System\ihmvcXa.exe
  C:\Windows\System\ihmvcXa.exe
  2⤵
  PID:12452
- C:\Windows\System\xtBxUBp.exe
  C:\Windows\System\xtBxUBp.exe
  2⤵
  PID:12540
- C:\Windows\System\PmKcmRD.exe
  C:\Windows\System\PmKcmRD.exe
  2⤵
  PID:12688
- C:\Windows\System\oUsyiMU.exe
  C:\Windows\System\oUsyiMU.exe
  2⤵
  PID:12620
- C:\Windows\System\EQAKoqZ.exe
  C:\Windows\System\EQAKoqZ.exe
  2⤵
  PID:12484
- C:\Windows\System\uqLxDgg.exe
  C:\Windows\System\uqLxDgg.exe
  2⤵
  PID:12808
- C:\Windows\System\praTubP.exe
  C:\Windows\System\praTubP.exe
  2⤵
  PID:12792
- C:\Windows\System\WfoWVpL.exe
  C:\Windows\System\WfoWVpL.exe
  2⤵
  PID:12860
- C:\Windows\System\CgWCMiw.exe
  C:\Windows\System\CgWCMiw.exe
  2⤵
  PID:3308
- C:\Windows\System\kDXAlZF.exe
  C:\Windows\System\kDXAlZF.exe
  2⤵
  PID:12528
- C:\Windows\System\KxNeTka.exe
  C:\Windows\System\KxNeTka.exe
  2⤵
  PID:12640
- C:\Windows\System\LOpfhAa.exe
  C:\Windows\System\LOpfhAa.exe
  2⤵
  PID:12668
- C:\Windows\System\GCXYYbI.exe
  C:\Windows\System\GCXYYbI.exe
  2⤵
  PID:13008
- C:\Windows\System\IRHEhPU.exe
  C:\Windows\System\IRHEhPU.exe
  2⤵
  PID:3404
- C:\Windows\System\qQtTnUp.exe
  C:\Windows\System\qQtTnUp.exe
  2⤵
  PID:12972
- C:\Windows\System\gFdlALQ.exe
  C:\Windows\System\gFdlALQ.exe
  2⤵
  PID:13016
- C:\Windows\System\KVfpnvD.exe
  C:\Windows\System\KVfpnvD.exe
  2⤵
  PID:13056
- C:\Windows\System\yRxbEXz.exe
  C:\Windows\System\yRxbEXz.exe
  2⤵
  PID:13084
- C:\Windows\System\UyTGMUT.exe
  C:\Windows\System\UyTGMUT.exe
  2⤵
  PID:13116
- C:\Windows\System\QfZFiVv.exe
  C:\Windows\System\QfZFiVv.exe
  2⤵
  PID:13132
- C:\Windows\System\ZwHEjNR.exe
  C:\Windows\System\ZwHEjNR.exe
  2⤵
  PID:13156
- C:\Windows\System\caXWQub.exe
  C:\Windows\System\caXWQub.exe
  2⤵
  PID:13164
- C:\Windows\System\uMzivFj.exe
  C:\Windows\System\uMzivFj.exe
  2⤵
  PID:13244
- C:\Windows\System\AhzEgIk.exe
  C:\Windows\System\AhzEgIk.exe
  2⤵
  PID:13224
- C:\Windows\System\NYMCSDt.exe
  C:\Windows\System\NYMCSDt.exe
  2⤵
  PID:1212
- C:\Windows\System\cAPIHwR.exe
  C:\Windows\System\cAPIHwR.exe
  2⤵
  PID:13284
- C:\Windows\System\sUoXogc.exe
  C:\Windows\System\sUoXogc.exe
  2⤵
  PID:13204
- C:\Windows\System\nntjcgk.exe
  C:\Windows\System\nntjcgk.exe
  2⤵
  PID:224
- C:\Windows\System\LTHZwJy.exe
  C:\Windows\System\LTHZwJy.exe
  2⤵
  PID:13024
- C:\Windows\System\ZEmTzbc.exe
  C:\Windows\System\ZEmTzbc.exe
  2⤵
  PID:1900
- C:\Windows\System\IUAlMhJ.exe
  C:\Windows\System\IUAlMhJ.exe
  2⤵
  PID:13308
- C:\Windows\System\QQkOHyB.exe
  C:\Windows\System\QQkOHyB.exe
  2⤵
  PID:11260
- C:\Windows\System\sVojcNt.exe
  C:\Windows\System\sVojcNt.exe
  2⤵
  PID:12504
- C:\Windows\System\tDCufJV.exe
  C:\Windows\System\tDCufJV.exe
  2⤵
  PID:12868
- C:\Windows\System\BUescEv.exe
  C:\Windows\System\BUescEv.exe
  2⤵
  PID:12552
- C:\Windows\System\UzEZYnx.exe
  C:\Windows\System\UzEZYnx.exe
  2⤵
  PID:12956
- C:\Windows\System\ZvpfmSM.exe
  C:\Windows\System\ZvpfmSM.exe
  2⤵
  PID:3472
- C:\Windows\System\whChxoa.exe
  C:\Windows\System\whChxoa.exe
  2⤵
  PID:13080
- C:\Windows\System\PMZYoOV.exe
  C:\Windows\System\PMZYoOV.exe
  2⤵
  PID:13096
- C:\Windows\System\jBuQvJs.exe
  C:\Windows\System\jBuQvJs.exe
  2⤵
  PID:13144
- C:\Windows\System\jnZlFLI.exe
  C:\Windows\System\jnZlFLI.exe
  2⤵
  PID:13272
- C:\Windows\System\FYBtlJa.exe
  C:\Windows\System\FYBtlJa.exe
  2⤵
  PID:4416
- C:\Windows\System\bWiwUaL.exe
  C:\Windows\System\bWiwUaL.exe
  2⤵
  PID:13196
- C:\Windows\System\hMfAChE.exe
  C:\Windows\System\hMfAChE.exe
  2⤵
  PID:5104
- C:\Windows\System\eOpFSJw.exe
  C:\Windows\System\eOpFSJw.exe
  2⤵
  PID:4584
- C:\Windows\System\gVzpTEW.exe
  C:\Windows\System\gVzpTEW.exe
  2⤵
  PID:12692
- C:\Windows\System\mkRBhSs.exe
  C:\Windows\System\mkRBhSs.exe
  2⤵
  PID:12952
- C:\Windows\System\tvgOOAH.exe
  C:\Windows\System\tvgOOAH.exe
  2⤵
  PID:12720
- C:\Windows\System\WkSqMih.exe
  C:\Windows\System\WkSqMih.exe
  2⤵
  PID:13076
- C:\Windows\System\bUJhIlX.exe
  C:\Windows\System\bUJhIlX.exe
  2⤵
  PID:5568
- C:\Windows\System\oGmhwzE.exe
  C:\Windows\System\oGmhwzE.exe
  2⤵
  PID:13184
- C:\Windows\System\UiHveRk.exe
  C:\Windows\System\UiHveRk.exe
  2⤵
  PID:1428
- C:\Windows\System\yVuHhZz.exe
  C:\Windows\System\yVuHhZz.exe
  2⤵
  PID:13100
- C:\Windows\System\fzjHbfD.exe
  C:\Windows\System\fzjHbfD.exe
  2⤵
  PID:13200
- C:\Windows\System\CZsPrLh.exe
  C:\Windows\System\CZsPrLh.exe
  2⤵
  PID:12348
- C:\Windows\System\dofDavQ.exe
  C:\Windows\System\dofDavQ.exe
  2⤵
  PID:3868
- C:\Windows\System\fTnbOcy.exe
  C:\Windows\System\fTnbOcy.exe
  2⤵
  PID:12388
- C:\Windows\System\AyxOSaY.exe
  C:\Windows\System\AyxOSaY.exe
  2⤵
  PID:12920
- C:\Windows\System\NDeOQuz.exe
  C:\Windows\System\NDeOQuz.exe
  2⤵
  PID:13160
- C:\Windows\System\dAXlZai.exe
  C:\Windows\System\dAXlZai.exe
  2⤵
  PID:12724
- C:\Windows\System\gHQzquS.exe
  C:\Windows\System\gHQzquS.exe
  2⤵
  PID:12856
- C:\Windows\System\fhgkTjo.exe
  C:\Windows\System\fhgkTjo.exe
  2⤵
  PID:3828
- C:\Windows\System\LPGnknS.exe
  C:\Windows\System\LPGnknS.exe
  2⤵
  PID:12508
- C:\Windows\System\RcReYbc.exe
  C:\Windows\System\RcReYbc.exe
  2⤵
  PID:2696
- C:\Windows\System\znhiYJn.exe
  C:\Windows\System\znhiYJn.exe
  2⤵
  PID:3392
- C:\Windows\System\IXNatXy.exe
  C:\Windows\System\IXNatXy.exe
  2⤵
  PID:3508
- C:\Windows\System\Shjzoqb.exe
  C:\Windows\System\Shjzoqb.exe
  2⤵
  PID:13136
- C:\Windows\System\OsHXWsk.exe
  C:\Windows\System\OsHXWsk.exe
  2⤵
  PID:12016
- C:\Windows\System\LvHKybZ.exe
  C:\Windows\System\LvHKybZ.exe
  2⤵
  PID:1488
- C:\Windows\System\uBwkvrt.exe
  C:\Windows\System\uBwkvrt.exe
  2⤵
  PID:12760
- C:\Windows\System\ZpygIzM.exe
  C:\Windows\System\ZpygIzM.exe
  2⤵
  PID:13332
- C:\Windows\System\tUXkIWH.exe
  C:\Windows\System\tUXkIWH.exe
  2⤵
  PID:13348
- C:\Windows\System\eKABSnz.exe
  C:\Windows\System\eKABSnz.exe
  2⤵
  PID:13364
- C:\Windows\System\icFOHYE.exe
  C:\Windows\System\icFOHYE.exe
  2⤵
  PID:13380
- C:\Windows\System\PcDMiyr.exe
  C:\Windows\System\PcDMiyr.exe
  2⤵
  PID:13396
- C:\Windows\System\HkfTdUf.exe
  C:\Windows\System\HkfTdUf.exe
  2⤵
  PID:13416
- C:\Windows\System\RsatZlF.exe
  C:\Windows\System\RsatZlF.exe
  2⤵
  PID:13436
- C:\Windows\System\tIbzZzi.exe
  C:\Windows\System\tIbzZzi.exe
  2⤵
  PID:13452
- C:\Windows\System\WTDbJIq.exe
  C:\Windows\System\WTDbJIq.exe
  2⤵
  PID:13476
- C:\Windows\System\WcOzycE.exe
  C:\Windows\System\WcOzycE.exe
  2⤵
  PID:13512
- C:\Windows\System\leFgjRX.exe
  C:\Windows\System\leFgjRX.exe
  2⤵
  PID:13532
- C:\Windows\System\SLYMTop.exe
  C:\Windows\System\SLYMTop.exe
  2⤵
  PID:13552
- C:\Windows\System\GXpYrui.exe
  C:\Windows\System\GXpYrui.exe
  2⤵
  PID:13576
- C:\Windows\System\ykKFrSo.exe
  C:\Windows\System\ykKFrSo.exe
  2⤵
  PID:13600
- C:\Windows\System\rxcLeNd.exe
  C:\Windows\System\rxcLeNd.exe
  2⤵
  PID:13620
- C:\Windows\System\tYcFDQf.exe
  C:\Windows\System\tYcFDQf.exe
  2⤵
  PID:13640
- C:\Windows\System\IRpPHcQ.exe
  C:\Windows\System\IRpPHcQ.exe
  2⤵
  PID:13660
- C:\Windows\System\WGIOGRJ.exe
  C:\Windows\System\WGIOGRJ.exe
  2⤵
  PID:13676
- C:\Windows\System\UekGZcD.exe
  C:\Windows\System\UekGZcD.exe
  2⤵
  PID:13692
- C:\Windows\System\LJIPRzn.exe
  C:\Windows\System\LJIPRzn.exe
  2⤵
  PID:13708
- C:\Windows\System\iIZKKHc.exe
  C:\Windows\System\iIZKKHc.exe
  2⤵
  PID:13724
- C:\Windows\System\hsIrawE.exe
  C:\Windows\System\hsIrawE.exe
  2⤵
  PID:13756
- C:\Windows\System\WoRnAfD.exe
  C:\Windows\System\WoRnAfD.exe
  2⤵
  PID:13772
- C:\Windows\System\peHmVAB.exe
  C:\Windows\System\peHmVAB.exe
  2⤵
  PID:13788
- C:\Windows\System\WqucLQQ.exe
  C:\Windows\System\WqucLQQ.exe
  2⤵
  PID:13808
- C:\Windows\System\xeiMKqZ.exe
  C:\Windows\System\xeiMKqZ.exe
  2⤵
  PID:13828
- C:\Windows\System\LiozjwS.exe
  C:\Windows\System\LiozjwS.exe
  2⤵
  PID:13852
- C:\Windows\System\XNpuoAe.exe
  C:\Windows\System\XNpuoAe.exe
  2⤵
  PID:13872
- C:\Windows\System\PdyimmM.exe
  C:\Windows\System\PdyimmM.exe
  2⤵
  PID:13892
- C:\Windows\System\kvBUSzU.exe
  C:\Windows\System\kvBUSzU.exe
  2⤵
  PID:13912
- C:\Windows\System\EwuPCLm.exe
  C:\Windows\System\EwuPCLm.exe
  2⤵
  PID:13932
- C:\Windows\System\xfZOLUC.exe
  C:\Windows\System\xfZOLUC.exe
  2⤵
  PID:13972
- C:\Windows\System\iiutPsr.exe
  C:\Windows\System\iiutPsr.exe
  2⤵
  PID:14028
- C:\Windows\System\gjDpJsA.exe
  C:\Windows\System\gjDpJsA.exe
  2⤵
  PID:14044
- C:\Windows\System\rLfxbCn.exe
  C:\Windows\System\rLfxbCn.exe
  2⤵
  PID:14060
- C:\Windows\System\PPvvYHw.exe
  C:\Windows\System\PPvvYHw.exe
  2⤵
  PID:14080
- C:\Windows\System\xIAGoQz.exe
  C:\Windows\System\xIAGoQz.exe
  2⤵
  PID:14108
- C:\Windows\System\hkVfLTu.exe
  C:\Windows\System\hkVfLTu.exe
  2⤵
  PID:14144
- C:\Windows\System\wIsdnxp.exe
  C:\Windows\System\wIsdnxp.exe
  2⤵
  PID:14172
- C:\Windows\System\NJTUYfk.exe
  C:\Windows\System\NJTUYfk.exe
  2⤵
  PID:14208
- C:\Windows\System\UfuWaWf.exe
  C:\Windows\System\UfuWaWf.exe
  2⤵
  PID:14252
- C:\Windows\System\QprMAAR.exe
  C:\Windows\System\QprMAAR.exe
  2⤵
  PID:14292
- C:\Windows\System\TPeHfEk.exe
  C:\Windows\System\TPeHfEk.exe
  2⤵
  PID:4072
- C:\Windows\System\aibdrsN.exe
  C:\Windows\System\aibdrsN.exe
  2⤵
  PID:3720
- C:\Windows\System\pkTxGib.exe
  C:\Windows\System\pkTxGib.exe
  2⤵
  PID:13128
- C:\Windows\System\vSaUiis.exe
  C:\Windows\System\vSaUiis.exe
  2⤵
  PID:3316
- C:\Windows\System\UMILedd.exe
  C:\Windows\System\UMILedd.exe
  2⤵
  PID:13344
- C:\Windows\System\qoqLhqm.exe
  C:\Windows\System\qoqLhqm.exe
  2⤵
  PID:3248
- C:\Windows\System\MoSwfBP.exe
  C:\Windows\System\MoSwfBP.exe
  2⤵
  PID:4328
- C:\Windows\System\fhfsHWB.exe
  C:\Windows\System\fhfsHWB.exe
  2⤵
  PID:13492
- C:\Windows\System\pOSvSgt.exe
  C:\Windows\System\pOSvSgt.exe
  2⤵
  PID:13324
- C:\Windows\System\rZXKlpI.exe
  C:\Windows\System\rZXKlpI.exe
  2⤵
  PID:13408
- C:\Windows\System\nlkGkoJ.exe
  C:\Windows\System\nlkGkoJ.exe
  2⤵
  PID:13444
- C:\Windows\System\bLKVjkQ.exe
  C:\Windows\System\bLKVjkQ.exe
  2⤵
  PID:4996
- C:\Windows\System\tsVwiev.exe
  C:\Windows\System\tsVwiev.exe
  2⤵
  PID:3756
- C:\Windows\System\DxlzFGW.exe
  C:\Windows\System\DxlzFGW.exe
  2⤵
  PID:3252
- C:\Windows\System\OMqYBHw.exe
  C:\Windows\System\OMqYBHw.exe
  2⤵
  PID:764
- C:\Windows\System\DcFoxDh.exe
  C:\Windows\System\DcFoxDh.exe
  2⤵
  PID:13656
- C:\Windows\System\gIvwBAe.exe
  C:\Windows\System\gIvwBAe.exe
  2⤵
  PID:2980
- C:\Windows\System\VefVZwH.exe
  C:\Windows\System\VefVZwH.exe
  2⤵
  PID:13560
- C:\Windows\System\POqgdkw.exe
  C:\Windows\System\POqgdkw.exe
  2⤵
  PID:13592
- C:\Windows\System\SzKQmlm.exe
  C:\Windows\System\SzKQmlm.exe
  2⤵
  PID:2088
- C:\Windows\System\XGljGft.exe
  C:\Windows\System\XGljGft.exe
  2⤵
  PID:2016
- C:\Windows\System\onhWnTF.exe
  C:\Windows\System\onhWnTF.exe
  2⤵
  PID:13684
- C:\Windows\System\TVjAYzT.exe
  C:\Windows\System\TVjAYzT.exe
  2⤵
  PID:13704
- C:\Windows\System\AXYTOaz.exe
  C:\Windows\System\AXYTOaz.exe
  2⤵
  PID:4336
- C:\Windows\System\pCOABYf.exe
  C:\Windows\System\pCOABYf.exe
  2⤵
  PID:13764
- C:\Windows\System\wtAdVhg.exe
  C:\Windows\System\wtAdVhg.exe
  2⤵
  PID:13172
- C:\Windows\System\hUXnALK.exe
  C:\Windows\System\hUXnALK.exe
  2⤵
  PID:13804
- C:\Windows\System\ygByHop.exe
  C:\Windows\System\ygByHop.exe
  2⤵
  PID:6596
- C:\Windows\System\VqDkufF.exe
  C:\Windows\System\VqDkufF.exe
  2⤵
  PID:3788
- C:\Windows\System\mlvhvBp.exe
  C:\Windows\System\mlvhvBp.exe
  2⤵
  PID:13844
- C:\Windows\System\NpBWwFo.exe
  C:\Windows\System\NpBWwFo.exe
  2⤵
  PID:13944
- C:\Windows\System\dMWmCUj.exe
  C:\Windows\System\dMWmCUj.exe
  2⤵
  PID:1776
- C:\Windows\System\bdIuJfk.exe
  C:\Windows\System\bdIuJfk.exe
  2⤵
  PID:13996
- C:\Windows\System\TBFfHtQ.exe
  C:\Windows\System\TBFfHtQ.exe
  2⤵
  PID:3496
- C:\Windows\System\VdsMdGm.exe
  C:\Windows\System\VdsMdGm.exe
  2⤵
  PID:3856
- C:\Windows\System\WwnEeDT.exe
  C:\Windows\System\WwnEeDT.exe
  2⤵
  PID:4360
- C:\Windows\System\azPwRYh.exe
  C:\Windows\System\azPwRYh.exe
  2⤵
  PID:4780
- C:\Windows\System\KdFrEoB.exe
  C:\Windows\System\KdFrEoB.exe
  2⤵
  PID:3532
- C:\Windows\System\dtbJflH.exe
  C:\Windows\System\dtbJflH.exe
  2⤵
  PID:4400
- C:\Windows\System\OPzpSlG.exe
  C:\Windows\System\OPzpSlG.exe
  2⤵
  PID:12776
- C:\Windows\System\iqTWhJn.exe
  C:\Windows\System\iqTWhJn.exe
  2⤵
  PID:6616
- C:\Windows\System\janoWVg.exe
  C:\Windows\System\janoWVg.exe
  2⤵
  PID:7668
- C:\Windows\System\tZRjMRg.exe
  C:\Windows\System\tZRjMRg.exe
  2⤵
  PID:4140
- C:\Windows\System\LQzjFsy.exe
  C:\Windows\System\LQzjFsy.exe
  2⤵
  PID:3340
- C:\Windows\System\ShgGkkB.exe
  C:\Windows\System\ShgGkkB.exe
  2⤵
  PID:13840
- C:\Windows\System\QHYdsSQ.exe
  C:\Windows\System\QHYdsSQ.exe
  2⤵
  PID:13564
- C:\Windows\System\mLxPSQt.exe
  C:\Windows\System\mLxPSQt.exe
  2⤵
  PID:4296
- C:\Windows\System\LQXvRVU.exe
  C:\Windows\System\LQXvRVU.exe
  2⤵
  PID:6836
- C:\Windows\System\NexguTE.exe
  C:\Windows\System\NexguTE.exe
  2⤵
  PID:6896
- C:\Windows\System\vxnPcGc.exe
  C:\Windows\System\vxnPcGc.exe
  2⤵
  PID:6924
- C:\Windows\System\StUOmWI.exe
  C:\Windows\System\StUOmWI.exe
  2⤵
  PID:7056
- C:\Windows\System\GhCjVEN.exe
  C:\Windows\System\GhCjVEN.exe
  2⤵
  PID:7108
- C:\Windows\System\MiVOgWU.exe
  C:\Windows\System\MiVOgWU.exe
  2⤵
  PID:7100
- C:\Windows\System\ZpMqOMN.exe
  C:\Windows\System\ZpMqOMN.exe
  2⤵
  PID:6148
- C:\Windows\System\MgaJnzk.exe
  C:\Windows\System\MgaJnzk.exe
  2⤵
  PID:6364
- C:\Windows\System\GOzrqJI.exe
  C:\Windows\System\GOzrqJI.exe
  2⤵
  PID:6544
- C:\Windows\System\OlKMjJJ.exe
  C:\Windows\System\OlKMjJJ.exe
  2⤵
  PID:6580
- C:\Windows\System\qDvkbPx.exe
  C:\Windows\System\qDvkbPx.exe
  2⤵
  PID:6728
- C:\Windows\System\MSRzkov.exe
  C:\Windows\System\MSRzkov.exe
  2⤵
  PID:6904
- C:\Windows\System\jpHulSB.exe
  C:\Windows\System\jpHulSB.exe
  2⤵
  PID:6832
- C:\Windows\System\GegGfTa.exe
  C:\Windows\System\GegGfTa.exe
  2⤵
  PID:6588
- C:\Windows\System\wMbNOel.exe
  C:\Windows\System\wMbNOel.exe
  2⤵
  PID:6284
- C:\Windows\System\okuXUTp.exe
  C:\Windows\System\okuXUTp.exe
  2⤵
  PID:7196
- C:\Windows\System\fDHRPgu.exe
  C:\Windows\System\fDHRPgu.exe
  2⤵
  PID:7208
- C:\Windows\System\bybbHOh.exe
  C:\Windows\System\bybbHOh.exe
  2⤵
  PID:7240
- C:\Windows\System\dMOruSU.exe
  C:\Windows\System\dMOruSU.exe
  2⤵
  PID:7276
- C:\Windows\System\KmKUIkW.exe
  C:\Windows\System\KmKUIkW.exe
  2⤵
  PID:7448
- C:\Windows\System\BdFUnIF.exe
  C:\Windows\System\BdFUnIF.exe
  2⤵
  PID:7480
- C:\Windows\System\kcYVSvb.exe
  C:\Windows\System\kcYVSvb.exe
  2⤵
  PID:7580
- C:\Windows\System\QxlfQtf.exe
  C:\Windows\System\QxlfQtf.exe
  2⤵
  PID:7588
- C:\Windows\System\QJgRogP.exe
  C:\Windows\System\QJgRogP.exe
  2⤵
  PID:7652
- C:\Windows\System\FPNujXy.exe
  C:\Windows\System\FPNujXy.exe
  2⤵
  PID:7868
- C:\Windows\System\LgyzHgx.exe
  C:\Windows\System\LgyzHgx.exe
  2⤵
  PID:7880
- C:\Windows\System\IRnwsGX.exe
  C:\Windows\System\IRnwsGX.exe
  2⤵
  PID:7908
- C:\Windows\System\zLUMbdb.exe
  C:\Windows\System\zLUMbdb.exe
  2⤵
  PID:8076
- C:\Windows\System\hQFtHrf.exe
  C:\Windows\System\hQFtHrf.exe
  2⤵
  PID:8004
- C:\Windows\System\UaYqRAJ.exe
  C:\Windows\System\UaYqRAJ.exe
  2⤵
  PID:8088
- C:\Windows\System\BrlKMaO.exe
  C:\Windows\System\BrlKMaO.exe
  2⤵
  PID:8140
- C:\Windows\System\McrlLzM.exe
  C:\Windows\System\McrlLzM.exe
  2⤵
  PID:7216
- C:\Windows\System\KVmwlhT.exe
  C:\Windows\System\KVmwlhT.exe
  2⤵
  PID:7496
- C:\Windows\System\gDOiPQL.exe
  C:\Windows\System\gDOiPQL.exe
  2⤵
  PID:7876
- C:\Windows\System\DqEJEPA.exe
  C:\Windows\System\DqEJEPA.exe
  2⤵
  PID:7380
- C:\Windows\System\BrkrtiA.exe
  C:\Windows\System\BrkrtiA.exe
  2⤵
  PID:7400
- C:\Windows\System\elpprCC.exe
  C:\Windows\System\elpprCC.exe
  2⤵
  PID:13956
- C:\Windows\System\LPpGiKN.exe
  C:\Windows\System\LPpGiKN.exe
  2⤵
  PID:7792
- C:\Windows\System\GkKABoO.exe
  C:\Windows\System\GkKABoO.exe
  2⤵
  PID:14024
- C:\Windows\System\IDkQIEJ.exe
  C:\Windows\System\IDkQIEJ.exe
  2⤵
  PID:1820
- C:\Windows\System\NBGYzpP.exe
  C:\Windows\System\NBGYzpP.exe
  2⤵
  PID:8176
- C:\Windows\System\MuZnVCh.exe
  C:\Windows\System\MuZnVCh.exe
  2⤵
  PID:6872
- C:\Windows\System\UjZWZtr.exe
  C:\Windows\System\UjZWZtr.exe
  2⤵
  PID:14068
- C:\Windows\System\kZsNpeE.exe
  C:\Windows\System\kZsNpeE.exe
  2⤵
  PID:3548
- C:\Windows\System\wfgxSNu.exe
  C:\Windows\System\wfgxSNu.exe
  2⤵
  PID:3464
- C:\Windows\System\HNSoFSW.exe
  C:\Windows\System\HNSoFSW.exe
  2⤵
  PID:14136
- C:\Windows\System\FtTmxXD.exe
  C:\Windows\System\FtTmxXD.exe
  2⤵
  PID:4768
- C:\Windows\System\LiYlZuZ.exe
  C:\Windows\System\LiYlZuZ.exe
  2⤵
  PID:3232
- C:\Windows\System\WdLEejD.exe
  C:\Windows\System\WdLEejD.exe
  2⤵
  PID:2688
- C:\Windows\System\VDHYjqg.exe
  C:\Windows\System\VDHYjqg.exe
  2⤵
  PID:2252
- C:\Windows\System\VgAfBsi.exe
  C:\Windows\System\VgAfBsi.exe
  2⤵
  PID:384
- C:\Windows\System\NnCdiZd.exe
  C:\Windows\System\NnCdiZd.exe
  2⤵
  PID:2572
- C:\Windows\System\iWAOCeE.exe
  C:\Windows\System\iWAOCeE.exe
  2⤵
  PID:2928
- C:\Windows\System\mhoWfpR.exe
  C:\Windows\System\mhoWfpR.exe
  2⤵
  PID:3376
- C:\Windows\System\FoKJKbR.exe
  C:\Windows\System\FoKJKbR.exe
  2⤵
  PID:2552
- C:\Windows\System\BbtyFCA.exe
  C:\Windows\System\BbtyFCA.exe
  2⤵
  PID:4068
- C:\Windows\System\YBFzqHv.exe
  C:\Windows\System\YBFzqHv.exe
  2⤵
  PID:1628
- C:\Windows\System\AlfmDPp.exe
  C:\Windows\System\AlfmDPp.exe
  2⤵
  PID:14312
- C:\Windows\System\wcYeXaK.exe
  C:\Windows\System\wcYeXaK.exe
  2⤵
  PID:14320
- C:\Windows\System\qOqONhM.exe
  C:\Windows\System\qOqONhM.exe
  2⤵
  PID:2216
- C:\Windows\System\MDPfVNf.exe
  C:\Windows\System\MDPfVNf.exe
  2⤵
  PID:4896
- C:\Windows\System\wjOzqEX.exe
  C:\Windows\System\wjOzqEX.exe
  2⤵
  PID:4556
- C:\Windows\System\yrpYnMJ.exe
  C:\Windows\System\yrpYnMJ.exe
  2⤵
  PID:1176
- C:\Windows\System\eqruTgl.exe
  C:\Windows\System\eqruTgl.exe
  2⤵
  PID:13376
- C:\Windows\System\XXGsGKc.exe
  C:\Windows\System\XXGsGKc.exe
  2⤵
  PID:4772
- C:\Windows\System\jpOUHHs.exe
  C:\Windows\System\jpOUHHs.exe
  2⤵
  PID:4232
- C:\Windows\System\jROuffZ.exe
  C:\Windows\System\jROuffZ.exe
  2⤵
  PID:14124
- C:\Windows\System\mXNfeUU.exe
  C:\Windows\System\mXNfeUU.exe
  2⤵
  PID:14196
- C:\Windows\System\QibaRNZ.exe
  C:\Windows\System\QibaRNZ.exe
  2⤵
  PID:8736
- C:\Windows\System\BAWVVkC.exe
  C:\Windows\System\BAWVVkC.exe
  2⤵
  PID:13168
- C:\Windows\System\AJPqbtZ.exe
  C:\Windows\System\AJPqbtZ.exe
  2⤵
  PID:14260
- C:\Windows\System\cjHFEiX.exe
  C:\Windows\System\cjHFEiX.exe
  2⤵
  PID:14280
- C:\Windows\System\yxRyLlQ.exe
  C:\Windows\System\yxRyLlQ.exe
  2⤵
  PID:13720
- C:\Windows\System\bFkmEOc.exe
  C:\Windows\System\bFkmEOc.exe
  2⤵
  PID:14308
- C:\Windows\System\LHWBZbv.exe
  C:\Windows\System\LHWBZbv.exe
  2⤵
  PID:13800
- C:\Windows\System\TqIBOmP.exe
  C:\Windows\System\TqIBOmP.exe
  2⤵
  PID:2304
- C:\Windows\System\JOupxBn.exe
  C:\Windows\System\JOupxBn.exe
  2⤵
  PID:12296
- C:\Windows\System\SWyFigH.exe
  C:\Windows\System\SWyFigH.exe
  2⤵
  PID:12924
- C:\Windows\System\jpfLFuY.exe
  C:\Windows\System\jpfLFuY.exe
  2⤵
  PID:432
- C:\Windows\System\cMzTLNt.exe
  C:\Windows\System\cMzTLNt.exe
  2⤵
  PID:4948
- C:\Windows\System\wORfgWs.exe
  C:\Windows\System\wORfgWs.exe
  2⤵
  PID:8632
- C:\Windows\System\OHsnIig.exe
  C:\Windows\System\OHsnIig.exe
  2⤵
  PID:14092
- C:\Windows\System\uzFKTOK.exe
  C:\Windows\System\uzFKTOK.exe
  2⤵
  PID:14104
- C:\Windows\System\hcGfZEu.exe
  C:\Windows\System\hcGfZEu.exe
  2⤵
  PID:3092
- C:\Windows\System\yKopRjx.exe
  C:\Windows\System\yKopRjx.exe
  2⤵
  PID:12988
- C:\Windows\System\cVTcCPd.exe
  C:\Windows\System\cVTcCPd.exe
  2⤵
  PID:13960
- C:\Windows\System\FLkXlRm.exe
  C:\Windows\System\FLkXlRm.exe
  2⤵
  PID:14168
- C:\Windows\System\AwlOCXd.exe
  C:\Windows\System\AwlOCXd.exe
  2⤵
  PID:14184
- C:\Windows\System\BVGmTOD.exe
  C:\Windows\System\BVGmTOD.exe
  2⤵
  PID:1792
- C:\Windows\System\YgWTRcI.exe
  C:\Windows\System\YgWTRcI.exe
  2⤵
  PID:13636
- C:\Windows\System\ipJnSyH.exe
  C:\Windows\System\ipJnSyH.exe
  2⤵
  PID:13228
- C:\Windows\System\EHWfFAq.exe
  C:\Windows\System\EHWfFAq.exe
  2⤵
  PID:13588
- C:\Windows\System\hVYhQGx.exe
  C:\Windows\System\hVYhQGx.exe
  2⤵
  PID:14268
- C:\Windows\System\YZZNXVn.exe
  C:\Windows\System\YZZNXVn.exe
  2⤵
  PID:13520
- C:\Windows\System\voeARPt.exe
  C:\Windows\System\voeARPt.exe
  2⤵
  PID:3276
- C:\Windows\System\pSfFykO.exe
  C:\Windows\System\pSfFykO.exe
  2⤵
  PID:228
- C:\Windows\System\KqiCQVV.exe
  C:\Windows\System\KqiCQVV.exe
  2⤵
  PID:13508
- C:\Windows\System\fZJYvor.exe
  C:\Windows\System\fZJYvor.exe
  2⤵
  PID:5132
- C:\Windows\System\uaLGLdm.exe
  C:\Windows\System\uaLGLdm.exe
  2⤵
  PID:13528
- C:\Windows\System\AFbPdyl.exe
  C:\Windows\System\AFbPdyl.exe
  2⤵
  PID:5332
- C:\Windows\System\iloxWDR.exe
  C:\Windows\System\iloxWDR.exe
  2⤵
  PID:13748
- C:\Windows\System\pLPDtEx.exe
  C:\Windows\System\pLPDtEx.exe
  2⤵
  PID:5248
- C:\Windows\System\usESUNq.exe
  C:\Windows\System\usESUNq.exe
  2⤵
  PID:6772
- C:\Windows\System\AgRYWNB.exe
  C:\Windows\System\AgRYWNB.exe
  2⤵
  PID:5444
- C:\Windows\System\fBDuHOv.exe
  C:\Windows\System\fBDuHOv.exe
  2⤵
  PID:6592
- C:\Windows\System\xcYNiJO.exe
  C:\Windows\System\xcYNiJO.exe
  2⤵
  PID:13888
- C:\Windows\System\NORBFIb.exe
  C:\Windows\System\NORBFIb.exe
  2⤵
  PID:552
- C:\Windows\System\VTwLpoG.exe
  C:\Windows\System\VTwLpoG.exe
  2⤵
  PID:6984
- C:\Windows\System\dRqfaaV.exe
  C:\Windows\System\dRqfaaV.exe
  2⤵
  PID:116
- C:\Windows\System\lJkSwNP.exe
  C:\Windows\System\lJkSwNP.exe
  2⤵
  PID:6388
- C:\Windows\System\zDvAtpn.exe
  C:\Windows\System\zDvAtpn.exe
  2⤵
  PID:7044
- C:\Windows\System\sJvjKYE.exe
  C:\Windows\System\sJvjKYE.exe
  2⤵
  PID:7096
- C:\Windows\System\niXjoAr.exe
  C:\Windows\System\niXjoAr.exe
  2⤵
  PID:5656
- C:\Windows\System\NvSeLhe.exe
  C:\Windows\System\NvSeLhe.exe
  2⤵
  PID:6080
- C:\Windows\System\ErZOSWB.exe
  C:\Windows\System\ErZOSWB.exe
  2⤵
  PID:7200
- C:\Windows\System\uiGszTJ.exe
  C:\Windows\System\uiGszTJ.exe
  2⤵
  PID:9644
- C:\Windows\System\pjNgTUv.exe
  C:\Windows\System\pjNgTUv.exe
  2⤵
  PID:7296
- C:\Windows\System\bIcmzBq.exe
  C:\Windows\System\bIcmzBq.exe
  2⤵
  PID:9720
- C:\Windows\System\jKwWtkP.exe
  C:\Windows\System\jKwWtkP.exe
  2⤵
  PID:6848
- C:\Windows\System\csPacAY.exe
  C:\Windows\System\csPacAY.exe
  2⤵
  PID:5680
- C:\Windows\System\ekwmZUQ.exe
  C:\Windows\System\ekwmZUQ.exe
  2⤵
  PID:7556
- C:\Windows\System\IbfZpGl.exe
  C:\Windows\System\IbfZpGl.exe
  2⤵
  PID:7268
- C:\Windows\System\qrzielM.exe
  C:\Windows\System\qrzielM.exe
  2⤵
  PID:5736
- C:\Windows\System\fHxWlsQ.exe
  C:\Windows\System\fHxWlsQ.exe
  2⤵
  PID:7584
- C:\Windows\System\ohmaiDN.exe
  C:\Windows\System\ohmaiDN.exe
  2⤵
  PID:7628
- C:\Windows\System\ayeJPWF.exe
  C:\Windows\System\ayeJPWF.exe
  2⤵
  PID:5764
- C:\Windows\System\HRWuYHV.exe
  C:\Windows\System\HRWuYHV.exe
  2⤵
  PID:5824
- C:\Windows\System\VMqEhti.exe
  C:\Windows\System\VMqEhti.exe
  2⤵
  PID:7948
- C:\Windows\System\IOTSHCc.exe
  C:\Windows\System\IOTSHCc.exe
  2⤵
  PID:8148
- C:\Windows\System\HKrTtUT.exe
  C:\Windows\System\HKrTtUT.exe
  2⤵
  PID:7172
- C:\Windows\System\BxsKBur.exe
  C:\Windows\System\BxsKBur.exe
  2⤵
  PID:8180
- C:\Windows\System\URnuxKN.exe
  C:\Windows\System\URnuxKN.exe
  2⤵
  PID:14156
- C:\Windows\System\sVYMSvO.exe
  C:\Windows\System\sVYMSvO.exe
  2⤵
  PID:9316
- C:\Windows\System\QQtOypE.exe
  C:\Windows\System\QQtOypE.exe
  2⤵
  PID:9376
- C:\Windows\System\eUbRoPI.exe
  C:\Windows\System\eUbRoPI.exe
  2⤵
  PID:9604
- C:\Windows\System\EyEQCSr.exe
  C:\Windows\System\EyEQCSr.exe
  2⤵
  PID:9724
- C:\Windows\System\SVREzvs.exe
  C:\Windows\System\SVREzvs.exe
  2⤵
  PID:9856
- C:\Windows\System\tVjQRTq.exe
  C:\Windows\System\tVjQRTq.exe
  2⤵
  PID:9972
- C:\Windows\System\UMPVTYd.exe
  C:\Windows\System\UMPVTYd.exe
  2⤵
  PID:7836
- C:\Windows\System\QNZUwwQ.exe
  C:\Windows\System\QNZUwwQ.exe
  2⤵
  PID:7204
- C:\Windows\System\aFofxBo.exe
  C:\Windows\System\aFofxBo.exe
  2⤵
  PID:10152
- C:\Windows\System\TKvWIUo.exe
  C:\Windows\System\TKvWIUo.exe
  2⤵
  PID:7636
- C:\Windows\System\RtnkVbA.exe
  C:\Windows\System\RtnkVbA.exe
  2⤵
  PID:452
- C:\Windows\System\yLATTDa.exe
  C:\Windows\System\yLATTDa.exe
  2⤵
  PID:7392
- C:\Windows\System\SaKLwuu.exe
  C:\Windows\System\SaKLwuu.exe
  2⤵
  PID:6936
- C:\Windows\System\gDRizJV.exe
  C:\Windows\System\gDRizJV.exe
  2⤵
  PID:1020
- C:\Windows\System\kvVjYlx.exe
  C:\Windows\System\kvVjYlx.exe
  2⤵
  PID:7004
- C:\Windows\System\pnFdEPN.exe
  C:\Windows\System\pnFdEPN.exe
  2⤵
  PID:2632
- C:\Windows\System\fXfNFKU.exe
  C:\Windows\System\fXfNFKU.exe
  2⤵
  PID:1508
- C:\Windows\System\eywZgDv.exe
  C:\Windows\System\eywZgDv.exe
  2⤵
  PID:2680
- C:\Windows\System\RJsOXqo.exe
  C:\Windows\System\RJsOXqo.exe
  2⤵
  PID:1356
- C:\Windows\System\HqQaCnN.exe
  C:\Windows\System\HqQaCnN.exe
  2⤵
  PID:1804
- C:\Windows\System\ugcURYU.exe
  C:\Windows\System\ugcURYU.exe
  2⤵
  PID:2012
- C:\Windows\System\YHRCENC.exe
  C:\Windows\System\YHRCENC.exe
  2⤵
  PID:780
- C:\Windows\System\cahEDRn.exe
  C:\Windows\System\cahEDRn.exe
  2⤵
  PID:1416
- C:\Windows\System\XXvQLGE.exe
  C:\Windows\System\XXvQLGE.exe
  2⤵
  PID:3992
- C:\Windows\System\hPUAKeU.exe
  C:\Windows\System\hPUAKeU.exe
  2⤵
  PID:3104
- C:\Windows\System\JckSoMN.exe
  C:\Windows\System\JckSoMN.exe
  2⤵
  PID:4304
- C:\Windows\System\LHQqmEN.exe
  C:\Windows\System\LHQqmEN.exe
  2⤵
  PID:4960
- C:\Windows\System\JIAVHVX.exe
  C:\Windows\System\JIAVHVX.exe
  2⤵
  PID:4448
- C:\Windows\System\DUFVyoP.exe
  C:\Windows\System\DUFVyoP.exe
  2⤵
  PID:1188
- C:\Windows\System\JVsBPJg.exe
  C:\Windows\System\JVsBPJg.exe
  2⤵
  PID:14120
- C:\Windows\System\TvXKRen.exe
  C:\Windows\System\TvXKRen.exe
  2⤵
  PID:14200
- C:\Windows\System\orBNkYl.exe
  C:\Windows\System\orBNkYl.exe
  2⤵
  PID:5168
- C:\Windows\System\oknpCiZ.exe
  C:\Windows\System\oknpCiZ.exe
  2⤵
  PID:4840
- C:\Windows\System\olzBrAW.exe
  C:\Windows\System\olzBrAW.exe
  2⤵
  PID:14276
- C:\Windows\System\GutPrTg.exe
  C:\Windows\System\GutPrTg.exe
  2⤵
  PID:5236
- C:\Windows\System\EcenVYr.exe
  C:\Windows\System\EcenVYr.exe
  2⤵
  PID:13784
- C:\Windows\System\GpfWiiv.exe
  C:\Windows\System\GpfWiiv.exe
  2⤵
  PID:10856
- C:\Windows\System\SgOvZYI.exe
  C:\Windows\System\SgOvZYI.exe
  2⤵
  PID:10880
- C:\Windows\System\zNHVbJX.exe
  C:\Windows\System\zNHVbJX.exe
  2⤵
  PID:220
- C:\Windows\System\qtuQAho.exe
  C:\Windows\System\qtuQAho.exe
  2⤵
  PID:12360
- C:\Windows\System\yFINfMa.exe
  C:\Windows\System\yFINfMa.exe
  2⤵
  PID:13372
- C:\Windows\System\oRHeaWo.exe
  C:\Windows\System\oRHeaWo.exe
  2⤵
  PID:14116
- C:\Windows\System\NtLgiIt.exe
  C:\Windows\System\NtLgiIt.exe
  2⤵
  PID:1288
- C:\Windows\System\IHiJRKx.exe
  C:\Windows\System\IHiJRKx.exe
  2⤵
  PID:13340
- C:\Windows\System\pUcbiwf.exe
  C:\Windows\System\pUcbiwf.exe
  2⤵
  PID:14164
- C:\Windows\System\detroxv.exe
  C:\Windows\System\detroxv.exe
  2⤵
  PID:13472
- C:\Windows\System\dToFeWz.exe
  C:\Windows\System\dToFeWz.exe
  2⤵
  PID:14236
- C:\Windows\System\oNgEajQ.exe
  C:\Windows\System\oNgEajQ.exe
  2⤵
  PID:5392
- C:\Windows\System\PeuyNAM.exe
  C:\Windows\System\PeuyNAM.exe
  2⤵
  PID:5532
- C:\Windows\System\NYaInAi.exe
  C:\Windows\System\NYaInAi.exe
  2⤵
  PID:6056
- C:\Windows\System\BzFHdFE.exe
  C:\Windows\System\BzFHdFE.exe
  2⤵
  PID:5896
- C:\Windows\System\zTNKoeN.exe
  C:\Windows\System\zTNKoeN.exe
  2⤵
  PID:4576
- C:\Windows\System\dviGjDd.exe
  C:\Windows\System\dviGjDd.exe
  2⤵
  PID:5288
- C:\Windows\System\vbiMpmT.exe
  C:\Windows\System\vbiMpmT.exe
  2⤵
  PID:5204
- C:\Windows\System\pfYkZLd.exe
  C:\Windows\System\pfYkZLd.exe
  2⤵
  PID:9168
- C:\Windows\System\CmnkYpx.exe
  C:\Windows\System\CmnkYpx.exe
  2⤵
  PID:13744
- C:\Windows\System\XBqlpJu.exe
  C:\Windows\System\XBqlpJu.exe
  2⤵
  PID:9484
- C:\Windows\System\uGZlUrP.exe
  C:\Windows\System\uGZlUrP.exe
  2⤵
  PID:10552
- C:\Windows\System\rOTIueS.exe
  C:\Windows\System\rOTIueS.exe
  2⤵
  PID:13504
- C:\Windows\System\zNJaYDJ.exe
  C:\Windows\System\zNJaYDJ.exe
  2⤵
  PID:13904
- C:\Windows\System\CbGCiAI.exe
  C:\Windows\System\CbGCiAI.exe
  2⤵
  PID:6868
- C:\Windows\System\LKICslM.exe
  C:\Windows\System\LKICslM.exe
  2⤵
  PID:6040
- C:\Windows\System\AngkOMw.exe
  C:\Windows\System\AngkOMw.exe
  2⤵
  PID:10692
- C:\Windows\System\vrEfoea.exe
  C:\Windows\System\vrEfoea.exe
  2⤵
  PID:6136
- C:\Windows\System\orxyJuG.exe
  C:\Windows\System\orxyJuG.exe
  2⤵
  PID:5356
- C:\Windows\System\rbSdCsu.exe
  C:\Windows\System\rbSdCsu.exe
  2⤵
  PID:6304
- C:\Windows\System\vNawStt.exe
  C:\Windows\System\vNawStt.exe
  2⤵
  PID:6100
- C:\Windows\System\QnlDaXG.exe
  C:\Windows\System\QnlDaXG.exe
  2⤵
  PID:2476
- C:\Windows\System\wVDPRUI.exe
  C:\Windows\System\wVDPRUI.exe
  2⤵
  PID:6828
- C:\Windows\System\RaeuUAa.exe
  C:\Windows\System\RaeuUAa.exe
  2⤵
  PID:6932
- C:\Windows\System\bVpSrBP.exe
  C:\Windows\System\bVpSrBP.exe
  2⤵
  PID:11508
- C:\Windows\System\aSgCVII.exe
  C:\Windows\System\aSgCVII.exe
  2⤵
  PID:5552
- C:\Windows\System\mePBbVG.exe
  C:\Windows\System\mePBbVG.exe
  2⤵
  PID:7060
- C:\Windows\System\tqiZdnR.exe
  C:\Windows\System\tqiZdnR.exe
  2⤵
  PID:5796
- C:\Windows\System\CTvBPlr.exe
  C:\Windows\System\CTvBPlr.exe
  2⤵
  PID:7232
- C:\Windows\System\QcQnUuG.exe
  C:\Windows\System\QcQnUuG.exe
  2⤵
  PID:7264
- C:\Windows\System\VSZIXFU.exe
  C:\Windows\System\VSZIXFU.exe
  2⤵
  PID:5668
- C:\Windows\System\hGahGes.exe
  C:\Windows\System\hGahGes.exe
  2⤵
  PID:7812
- C:\Windows\System\DUXJIHY.exe
  C:\Windows\System\DUXJIHY.exe
  2⤵
  PID:1432
- C:\Windows\System\KLqoTJF.exe
  C:\Windows\System\KLqoTJF.exe
  2⤵
  PID:7452
- C:\Windows\System\yFPFtSs.exe
  C:\Windows\System\yFPFtSs.exe
  2⤵
  PID:11676
- C:\Windows\System\Bwabtdy.exe
  C:\Windows\System\Bwabtdy.exe
  2⤵
  PID:2028
- C:\Windows\System\YFLFNbb.exe
  C:\Windows\System\YFLFNbb.exe
  2⤵
  PID:5396
- C:\Windows\System\kDKKvsg.exe
  C:\Windows\System\kDKKvsg.exe
  2⤵
  PID:2396
- C:\Windows\System\QUpHbFu.exe
  C:\Windows\System\QUpHbFu.exe
  2⤵
  PID:9588
- C:\Windows\System\rQVUMTB.exe
  C:\Windows\System\rQVUMTB.exe
  2⤵
  PID:5864
- C:\Windows\System\gYUSTiz.exe
  C:\Windows\System\gYUSTiz.exe
  2⤵
  PID:9836
- C:\Windows\System\qTBvfDm.exe
  C:\Windows\System\qTBvfDm.exe
  2⤵
  PID:9888
- C:\Windows\System\EljPYDK.exe
  C:\Windows\System\EljPYDK.exe
  2⤵
  PID:11996
- C:\Windows\System\UsFZoKz.exe
  C:\Windows\System\UsFZoKz.exe
  2⤵
  PID:7444
- C:\Windows\System\zFdAhBo.exe
  C:\Windows\System\zFdAhBo.exe
  2⤵
  PID:14128
- C:\Windows\System\BoFVATt.exe
  C:\Windows\System\BoFVATt.exe
  2⤵
  PID:10204
- C:\Windows\System\OeFpLil.exe
  C:\Windows\System\OeFpLil.exe
  2⤵
  PID:968
- C:\Windows\System\ygvWFrg.exe
  C:\Windows\System\ygvWFrg.exe
  2⤵
  PID:14056
- C:\Windows\System\sMWKlBt.exe
  C:\Windows\System\sMWKlBt.exe
  2⤵
  PID:11460
- C:\Windows\System\liYNBim.exe
  C:\Windows\System\liYNBim.exe
  2⤵
  PID:6124
- C:\Windows\System\RpyBvZc.exe
  C:\Windows\System\RpyBvZc.exe
  2⤵
  PID:2592
- C:\Windows\System\EbhAdyy.exe
  C:\Windows\System\EbhAdyy.exe
  2⤵
  PID:2864
- C:\Windows\System\dizgIds.exe
  C:\Windows\System\dizgIds.exe
  2⤵
  PID:3036
- C:\Windows\System\XjbitrD.exe
  C:\Windows\System\XjbitrD.exe
  2⤵
  PID:12116
- C:\Windows\System\LqsowkH.exe
  C:\Windows\System\LqsowkH.exe
  2⤵
  PID:6256
- C:\Windows\System\SfhRkER.exe
  C:\Windows\System\SfhRkER.exe
  2⤵
  PID:13404
- C:\Windows\System\fhfXVZr.exe
  C:\Windows\System\fhfXVZr.exe
  2⤵
  PID:3560
- C:\Windows\System\FUGKzAH.exe
  C:\Windows\System\FUGKzAH.exe
  2⤵
  PID:3168
- C:\Windows\System\ZUjzpvm.exe
  C:\Windows\System\ZUjzpvm.exe
  2⤵
  PID:14232
- C:\Windows\System\FatvPmZ.exe
  C:\Windows\System\FatvPmZ.exe
  2⤵
  PID:8892
- C:\Windows\System\ZsvtIwp.exe
  C:\Windows\System\ZsvtIwp.exe
  2⤵
  PID:8864
- C:\Windows\System\HgAaBOH.exe
  C:\Windows\System\HgAaBOH.exe
  2⤵
  PID:5316
- C:\Windows\System\BzIpHyr.exe
  C:\Windows\System\BzIpHyr.exe
  2⤵
  PID:14284
- C:\Windows\System\gUcURup.exe
  C:\Windows\System\gUcURup.exe
  2⤵
  PID:14300
- C:\Windows\System\SwqHqlS.exe
  C:\Windows\System\SwqHqlS.exe
  2⤵
  PID:9196
- C:\Windows\System\EtEaBaw.exe
  C:\Windows\System\EtEaBaw.exe
  2⤵
  PID:5304
- C:\Windows\System\YUEkcIn.exe
  C:\Windows\System\YUEkcIn.exe
  2⤵
  PID:3460
- C:\Windows\System\ZsJzKpC.exe
  C:\Windows\System\ZsJzKpC.exe
  2⤵
  PID:11928
- C:\Windows\System\yuPIjiK.exe
  C:\Windows\System\yuPIjiK.exe
  2⤵
  PID:3860
- C:\Windows\System\oJzWBFl.exe
  C:\Windows\System\oJzWBFl.exe
  2⤵
  PID:13328
- C:\Windows\System\eTWkEdW.exe
  C:\Windows\System\eTWkEdW.exe
  2⤵
  PID:6460
- C:\Windows\System\mmeLqqz.exe
  C:\Windows\System\mmeLqqz.exe
  2⤵
  PID:4084
- C:\Windows\System\aLLXGrD.exe
  C:\Windows\System\aLLXGrD.exe
  2⤵
  PID:5136
- C:\Windows\System\mhrLuhp.exe
  C:\Windows\System\mhrLuhp.exe
  2⤵
  PID:2004
- C:\Windows\System\CDBEkAh.exe
  C:\Windows\System\CDBEkAh.exe
  2⤵
  PID:5364
- C:\Windows\System\XidTACZ.exe
  C:\Windows\System\XidTACZ.exe
  2⤵
  PID:2992
- C:\Windows\System\vhtlGuO.exe
  C:\Windows\System\vhtlGuO.exe
  2⤵
  PID:13740
- C:\Windows\System\kIonIhn.exe
  C:\Windows\System\kIonIhn.exe
  2⤵
  PID:13572
- C:\Windows\System\YDQrhdc.exe
  C:\Windows\System\YDQrhdc.exe
  2⤵
  PID:10304
- C:\Windows\System\NYRNNnq.exe
  C:\Windows\System\NYRNNnq.exe
  2⤵
  PID:14180
- C:\Windows\System\DoqwCFO.exe
  C:\Windows\System\DoqwCFO.exe
  2⤵
  PID:4920
- C:\Windows\System\GvSqZgL.exe
  C:\Windows\System\GvSqZgL.exe
  2⤵
  PID:6116
- C:\Windows\System\bQyjkhE.exe
  C:\Windows\System\bQyjkhE.exe
  2⤵
  PID:3848
- C:\Windows\System\QgZeBeV.exe
  C:\Windows\System\QgZeBeV.exe
  2⤵
  PID:6708
- C:\Windows\System\cVejKgI.exe
  C:\Windows\System\cVejKgI.exe
  2⤵
  PID:6944
- C:\Windows\System\OzrCGUb.exe
  C:\Windows\System\OzrCGUb.exe
  2⤵
  PID:2472
- C:\Windows\System\nOEbPUg.exe
  C:\Windows\System\nOEbPUg.exe
  2⤵
  PID:6852
- C:\Windows\System\AvJEIvj.exe
  C:\Windows\System\AvJEIvj.exe
  2⤵
  PID:7048
- C:\Windows\System\HwOZacJ.exe
  C:\Windows\System\HwOZacJ.exe
  2⤵
  PID:5748
- C:\Windows\System\xTRwlGp.exe
  C:\Windows\System\xTRwlGp.exe
  2⤵
  PID:5612
- C:\Windows\System\xjNHmmS.exe
  C:\Windows\System\xjNHmmS.exe
  2⤵
  PID:5372
- C:\Windows\System\YQuhyAm.exe
  C:\Windows\System\YQuhyAm.exe
  2⤵
  PID:652
- C:\Windows\System\uIzRxPx.exe
  C:\Windows\System\uIzRxPx.exe
  2⤵
  PID:5788
- C:\Windows\System\pEeTXVI.exe
  C:\Windows\System\pEeTXVI.exe
  2⤵
  PID:5596
- C:\Windows\System\JbSviHm.exe
  C:\Windows\System\JbSviHm.exe
  2⤵
  PID:7620
- C:\Windows\System\CPrYuXd.exe
  C:\Windows\System\CPrYuXd.exe
  2⤵
  PID:9336
- C:\Windows\System\rFgFbPC.exe
  C:\Windows\System\rFgFbPC.exe
  2⤵
  PID:7500
- C:\Windows\System\QEqVyBt.exe
  C:\Windows\System\QEqVyBt.exe
  2⤵
  PID:6216
- C:\Windows\System\RjWgbue.exe
  C:\Windows\System\RjWgbue.exe
  2⤵
  PID:8036
- C:\Windows\System\ZDDnaCw.exe
  C:\Windows\System\ZDDnaCw.exe
  2⤵
  PID:9444
- C:\Windows\System\WbjQdxx.exe
  C:\Windows\System\WbjQdxx.exe
  2⤵
  PID:5980
- C:\Windows\System\ZGYyAhk.exe
  C:\Windows\System\ZGYyAhk.exe
  2⤵
  PID:3900
- C:\Windows\System\rEwongX.exe
  C:\Windows\System\rEwongX.exe
  2⤵
  PID:4836
- C:\Windows\System\tgpTZpi.exe
  C:\Windows\System\tgpTZpi.exe
  2⤵
  PID:3456
- C:\Windows\System\lyMSuaz.exe
  C:\Windows\System\lyMSuaz.exe
  2⤵
  PID:6228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p1ufx03k.hnw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BVmmYit.exe

Filesize
1.3MB

MD5
68ca76efd93e57607451ea9761e18b87

SHA1
b3de498fb282381e07012bb16ab3bac84d1fa86c

SHA256
88f002992b5435ddc6a34ef4a01fa9f1c5c02c440c7b8bd72731cb0934a8527b

SHA512
99d332e3adf5ec482fd1e8bccf58e663d419ea75a9aae1d4085d643f53c1fc3ebf42991774f3d3166f9eeee7e8ac15932716c235ccd260f19555c6e408e45522

Download Submit
C:\Windows\System\COqgQIf.exe

Filesize
1.3MB

MD5
f1c43fa3c0ca06bb3bef9760eeeacdd3

SHA1
45877462c45a45feb74d4871a074332ce7e1b911

SHA256
bb1168b3e554e16080cc7cd051d8e3b54a83958f1491d14b4229b1dc0777de79

SHA512
1c24b3c64413bda8da1b784a3655bfffe679de9cd4b8be16da51977af0ad46e248dc0a8f20c0c550e23a7258f60c90991d9d1d696b3b29ff3bc85c6e88aa308f

Download Submit
C:\Windows\System\CTLciMv.exe

Filesize
1.3MB

MD5
7b79b74ea38c088d9d96b923700b67a5

SHA1
9b8108305ab055df48a3558cff8d684265d75e56

SHA256
e4a165c6cc7762064aece96e1d3857972ee04b923b8c3d356d9614e0bf64baaa

SHA512
2a2732c3c2b9c97f8546f4cee54be26e662b8633be16d801da5b971113ed69a7d06cc81421c79aa05c9e79d4e05135d357b683db57a93853bbec4905b3ceba36

Download Submit
C:\Windows\System\DBozjJG.exe

Filesize
1.3MB

MD5
9c53b52a541dcc5a14ab3313209c4c4a

SHA1
49d3d12146f6630d5ed91e2108ff8e5bd90549f7

SHA256
dd21c23a4272a25823dac37791b72ae20edfab43fdfce4fcad828a508c5c0a55

SHA512
b2ca1369944ea6b5dd28e1946bd0bf320386bec018b482abbc086595e23bd7b94f3887cbca3e67350730dc764aad97d8e1c996afa342805d7ffd81db79701aa7

Download Submit
C:\Windows\System\DdSHqte.exe

Filesize
1.3MB

MD5
e2418df06276038a2c9c6e3c65d8776a

SHA1
fc111cedb52a2198e1c0c05d49716a8d20f392cc

SHA256
b4567ea13f4aee4c5e56de65ffbda5389a5fc9bd0a62961804599ce4611a3fe5

SHA512
49ac47b4c48453e910afbf0b259676ebd62a569f4447861f60b30801a4a091edba169500a8d3e69761a39645405a45e3a5e36da4b76692155ae45de35c6af6fe

Download Submit
C:\Windows\System\GgMeTKw.exe

Filesize
1.3MB

MD5
e6f770d25b91e39e7a9c95fdace16ad6

SHA1
e88f98b77ed06755b3f0748de5979756da330752

SHA256
39e9011571c3bfb34629987e03295467a47d6a4322c5668afd1227e4b4dc9ffc

SHA512
3f27aa5f8172ff51d2d5e3734cdb7e4a86d0f1575595307f8201bf629cda67ff0c15269a4ef7993e3e24cbd3c49c9e247c1a5974e868565e4d4160999a3b2692

Download Submit
C:\Windows\System\GjPLbBB.exe

Filesize
1.3MB

MD5
82b6b700ed33ae0118a85925adfbdc81

SHA1
36e3056bbf95b3a56117d42487536628011aea05

SHA256
64c1add13a433c3680d25f83a8897639bca761abb27473f3b07dd2536ae6f460

SHA512
c63d1eacf165b1b0fb099a43043fe7dc38e647bee40fba371d94b1b306ac01963a8d9a04055668730b693af5420ef303935bf9926add4cd35b8efcc73cf911f2

Download Submit
C:\Windows\System\GlaAhcx.exe

Filesize
1.3MB

MD5
b5ea6257504672b6a7bf7078657f6eaa

SHA1
bdd9935d571db6b1844c0f4239a06d4b7469b658

SHA256
0163bffba62ca7777b20ce918a600049f9149f5447240244cd2855ba95f4f94f

SHA512
b503f156d113a6a6f9a3287951cf1d1855f0847bb0109c01460642a923755a1d194d1a53f44dfda1bf545d156093ef2b01087ce45d349ea50c29d98c4c52d3f8

Download Submit
C:\Windows\System\HKRnlJB.exe

Filesize
1.3MB

MD5
fc75b951da9053c54076a61ecb0bfc4f

SHA1
fd5b973937b648bd0e183a7cd1f5210e5b732a86

SHA256
cef036e1a896b42e1d49bf543334c07b699a6b37a44a928b6e1b3b2505757acf

SHA512
339cbc71c65fbcd68f38af6723fbdd05d3af9fcf51c789747243cfc9d798c83f9489491189620cf645e1b2bb14cad225a3f4b248e4616e1c889ee9266b007698

Download Submit
C:\Windows\System\IQpFCPc.exe

Filesize
1.3MB

MD5
c799e2f3cd73b56bd3da739668578ca8

SHA1
7f1e213940009bd1b05430226f20f00748ddfaa4

SHA256
b212070a470d0b08136f413cc7952f9120753ce2f58915f8ef9a53f9b9cc4ac2

SHA512
0bd93cf7b82007626285d10444e94ef690c5fb810bfaf07e914cbb7449efa7425203e3635cdcc432afa82519dac41cd9973e202281a2e013f512121bdc742493

Download Submit
C:\Windows\System\KMCoLKN.exe

Filesize
1.3MB

MD5
cc7a1e92186819d280a1cd1659cbb136

SHA1
024294d667f23b95b32dfe4e756cc749f86c19ca

SHA256
0b387163d429e9047ed0863b8b069e508254aeeb0694ddbfe5244bdfbeb19ca6

SHA512
c95102fc0b64da3e2c95b119fc6f8bf48cc5e05092531a09c8ef6a6a6c0ffbb502dd0a8867a3fa8934d9036100e3dba2617cd57fa7599e4869f2f8c5ba62cb1e

Download Submit
C:\Windows\System\LlBNPWz.exe

Filesize
1.3MB

MD5
e5866fcb57183edf57301f8bea75bd52

SHA1
cc2a4bec34df5a45233a0cf4f2865d6bc5552233

SHA256
08b000f49c914b2e16e52304d4606f3bff680134de5c7551193b6a4298b7be3c

SHA512
d58f41a2f4d1028f316dbac696cef99dbb730d9770adf3255a949c047e40dc74bbc94ec8be58e5a21454e877fa958d8c703abf29977c69d0a2ef4b09965c96ee

Download Submit
C:\Windows\System\LqhKpWu.exe

Filesize
1.3MB

MD5
5f74e87e31b9579ca6ca34293e7390e4

SHA1
f15d0577d35dec56e6bf2c4f5d03c38b890fe5cf

SHA256
ac91db9229a2208a88e48050d23ae970e08cf8dc52c224840999decdc546f80d

SHA512
ad807af314d6f6800bbcab9e1bf2584fb5386613cec2984cc376c02eb135bb4cf9d2876a183043e2705029f813a2145006fae6b65e40fe79a96ee7db52aa7d08

Download Submit
C:\Windows\System\MPyXMfA.exe

Filesize
8B

MD5
8e1226661f8ca09fc62a1fef1fd7fcb8

SHA1
5b44def3d0e8d434236fee53ad977e411181a3d8

SHA256
7c2ccee11204a3d84ff9c71237bbe484161717fa152009f68b3a2efb0ad9c1c9

SHA512
45cc72f2ca6df3fbb9deac023207f7093a2e236cf6702146e776d1f3b55a9e5f29fbb748ba3deb570ab4a7bdfa68cee4df84414f0ac4a063de36a2a303bd6323

Download Submit
C:\Windows\System\NVDoZWv.exe

Filesize
1.3MB

MD5
f268ddef09fde92dc2356327dc320c0c

SHA1
77c9edb731e376bf107541f41f0b2fa58dfd4e52

SHA256
36f78b44f9529df5e05ff95c08f1c17664f9abb40d68de8013be6772c3cd37dc

SHA512
587a02153a54a71e7a0ab233f4985c68f9fb45453afe2a31f4104769a96ac2a10f7f987dc1d9af9593bdecf9cba4896fe49090e9f3f9a3e3fd0c0f4cf3aa20d7

Download Submit
C:\Windows\System\NWbDYAK.exe

Filesize
1.3MB

MD5
1814ff91d604d64113d8753f46e97bc3

SHA1
d2d26195ab99e82cf47b22e3ff0bf0fbbba6d9b8

SHA256
724c9ebb32c0e533fc074aac5708d25a0c57e57424a9d66597238a0b8015e7ac

SHA512
83f663a159c7e08be354f16ecdac1833851a495a04bbfe112fac73b72116106db593f717117a76ad7f917e1ca110f35f26dd0db1b611780d8e2c3cab3d4ccb00

Download Submit
C:\Windows\System\PCIaSOg.exe

Filesize
1.3MB

MD5
4b6f72b2a1f66f09abc51fe907269ba1

SHA1
e87bc8a949fdaa87f8c59116835a70b251828a85

SHA256
054c5c53d3e07115d695431c0b64bfa480d079ac5edc6762233d0652a1f46882

SHA512
cf905a3205b65929c5ee6cca24f304d2b0b30e0dca19573ad28c8e1da2546a5a11c7d9554eab42bea68239197003233c445ab26515551c39dde597bb0bce9608

Download Submit
C:\Windows\System\Rgqsiyg.exe

Filesize
1.3MB

MD5
10542f66407806c3fe242cc3a1e9bb08

SHA1
91fa2d11da47e2166dc7c7bda0fd1c8c22b6b114

SHA256
dc8f72c43f2ba3f99ab3f7c91256187e7b3b7aff0ee3f29c21da386b2a12ba75

SHA512
615601c83e8b534a88c5fa75d8839ef4176527ce8c58db3c21d1976e18dcd48b15a282af0f0737ec126e4bd1af4f0cb3e22143a893379054fc7107b606bfaa46

Download Submit
C:\Windows\System\UjtvfaO.exe

Filesize
1.3MB

MD5
c4a0d65a1ad551a261bcb60a7a169484

SHA1
a93e61a0390fcea756166cb2d8fcf60bf3d4b01e

SHA256
6cb5ba08a86d79d653518136be26cb76ae8d884433a5a4dc6f17ef88ae2eefa9

SHA512
999d56b379ee73e2c3498f53fa25b7b62a755084697aedcacd3658839d5e8ed27d128f8e461e18cf522aa322a7eb58c51f7ac043e91819c39c1a07050b3fe109

Download Submit
C:\Windows\System\VpfXjLi.exe

Filesize
1.3MB

MD5
3d0c21d78ee20a7e2e0e9df5cbf1b2f6

SHA1
488dba6bd7d72b3d3cc493ef692eb904c1b0e080

SHA256
da9040ae19f8aa7e363f6159b4f9a937a77c57e9c71f22af12656a3ccb412076

SHA512
d80ed779362da47b3456084a024b18a98683d4faf002869c7400d0008b660ed4c407d67617f2ab0b35a67500d37fef6ffaeb89fd453e69d1ff0af63b3e3685e4

Download Submit
C:\Windows\System\XMKhXrA.exe

Filesize
1.3MB

MD5
bd3d320fe0cd13c92022d8353c2a7855

SHA1
4a98ece41992664157396f7deba49892f90fadf2

SHA256
8669c48e5ceb4a0aabfcec30bfa47d25fd707fb930d96a5776a867074d6feec6

SHA512
884706084e9c3055c531031fcdcad98dc46dd161d8a9b02e87e3c1fec81d70706c904581d23024c913505a05beeec5eb7667d0ef3ba230f5632ab6a7a1bca57d

Download Submit
C:\Windows\System\XbzsPlm.exe

Filesize
1.3MB

MD5
e2670948b2e3e1ad3cbab536a0702087

SHA1
3ac63438bd36e2d1408c4efc6fdcbf79a3b43a44

SHA256
55761117eb06f498a4725b2af3205df444588c29c207e0d054cda92056dc7171

SHA512
9b0e68aa5c948a7cbb2e1c32d53ae6419ce160f0349f985384735562f917f2bfbbc900a635eb554ebc6c9c3d16f62e441ead46a9e0e21933781b1e328f7fab23

Download Submit
C:\Windows\System\YXhFtJH.exe

Filesize
1.3MB

MD5
bccf5c286a8038dab94c4caa56db28c6

SHA1
8a1c2ed4c4d16dc35f98fef31f56304a58f05f50

SHA256
af94a851f7e595e06659afbe851dd9d0ce4986a351e78088cb355177a9868986

SHA512
d769caa12232392a8fcbf0178a8479ce28125ae9764f8843a974b7f0a9fc227c27c40488fa3cd882c3487ae7403b9bd42c500c58a3032b363a04c4b66c6a634d

Download Submit
C:\Windows\System\cKhbRvW.exe

Filesize
1.3MB

MD5
81cfe89b28050db5019b47cf41b6c8d7

SHA1
b53627899d12029c651c92dae2ad29dd1882cdf7

SHA256
8ea572249dbef434ecbc551c09ac5c48389e8253aa6651471141fa1357b07e8e

SHA512
9b6a206a677177d4e9c19271499d95c394a9291479f9109c1ec04b26781ac6f9ee39e0367b093a7fbe27d603fd0a461cee87ec893070acc5f941d15a72da948e

Download Submit
C:\Windows\System\gJIyYhL.exe

Filesize
1.3MB

MD5
631c20fcd5df5de409b6820dba14a796

SHA1
45cc95440554903c39d4a286403e870acdc834e6

SHA256
44b6a36780acdb6abb69916554c4a8bd4f6332e4476b1f649b478fd34976d78e

SHA512
5d5d55bb3cd8aa763ec0c3ee572c580af9814211e7d36bcc7d1e6f660f62afeab0aa12b0a3a960a83ce4080fdfcb9d9b0d0a57b3456a3cf3527e851037a9933f

Download Submit
C:\Windows\System\hBFLVXm.exe

Filesize
1.3MB

MD5
683bc991ec09b10dbdd74d64134eb717

SHA1
d67886cec7582405a19d45d4e00b1f536acfd4ef

SHA256
55ca7de352722e3f74f316e260c43cd21107a0ae792a4c14840a9fa0a55390dd

SHA512
263ec31e553fbad7ea45f66e05a1f51b896b5ffac8b77255db4b26a35e4e2cfa142ed39f5f11ed2b4b2a5235488b6d04845537187ec7ecf5a72c34707878fed0

Download Submit
C:\Windows\System\hqldsCY.exe

Filesize
1.3MB

MD5
45853019acd9322d792158c43270199c

SHA1
684560490c5a352a156b8e8932df3c0d10c8f44a

SHA256
6fcbcd7c34933dbbb1350bdc30730bfe6faef6ea1e2311f1b9132a0991be3983

SHA512
bddc568b6ace418d6db948c4ed0442a7e8615d3800a8cd4294cf81ffe9986a63674cfe9aafc32c03ee88b9fdcdbf8c5af7e70e2243ddc8889ce6973e9bb9468b

Download Submit
C:\Windows\System\htAdwHh.exe

Filesize
1.3MB

MD5
6f06c6811ebd955c784f77adcfbc970f

SHA1
ba19d2227e49e52780ad80611e564b2649fceade

SHA256
7ed42e28759a3dc469965fae1d0ad5f6f0c228ffc06e4ce1ba094a8dc94cf4aa

SHA512
ebe778e181b9002a8a0640b110e649a65c9eb087424946ba7db17a9dffcf2623fca25e795ed77daba4f0dae0334b87a3e682bc04faf68ecde3c006d5b540b59c

Download Submit
C:\Windows\System\iCCSjXQ.exe

Filesize
1.3MB

MD5
0c018b601203c4e65ce443eb38c30fd3

SHA1
62898b22c00d6bccb73e9d4322e5fbc8a03bfc72

SHA256
99ce7dce034cda496b8ad304328eabab32a9a91f8c1ebebcedcc319ba7f2e514

SHA512
17b96346897317e19faeb55ea2d7ae5d3c95cc087e95b0154a4e08b8687b47eec2cdaf38d11789a667bedc7931b45df48d46aef50d1f20125f9d71e67a69c3d5

Download Submit
C:\Windows\System\lpdjmeZ.exe

Filesize
1.3MB

MD5
e54c1cad94e86146b832c62aee8c0423

SHA1
381ac75f1f6fb0bfbf96b5d8d2ae01175c388ddd

SHA256
115bb5bad1a3adf6fcbae747c34e2312bd425a13a14e5e0e51948163ea0319f9

SHA512
48148a595724539b1a4f0b9123637b3a6cfaaa01b9c97cdaa07717313f5db59c803188802c0fd0f6338b1ba599a26e8b320b91fa8d3aa4cb67c161774dcaddd3

Download Submit
C:\Windows\System\oFHXbFB.exe

Filesize
1.3MB

MD5
d483718751ac0b4723fe6dfaf1b1061a

SHA1
b95169fd712c35248a3153b763e3d1ad718a8def

SHA256
86961c44efa797eb6f65973f19eaa0b271f074e291d2dc785c2d42af50ab98ca

SHA512
18ef0e550f5a1ff16a2385fc704befc654f0c8f84839b003d441827ef943c5ebe1d9e0381dd1bdbb00e087d70e29ae9cd2e2edb355a8305a77e6876a27f9d9b6

Download Submit
C:\Windows\System\pNeuQCe.exe

Filesize
1.3MB

MD5
0f48327a1337d4adbb4443f04ca8327e

SHA1
3414362d45f40deb5aedd4c63bcc2a52b1074d8c

SHA256
0ff46226829ae9bec1c28ae7bda5df5655fbf64aa9a98ab6131199e0302161bf

SHA512
4b9067ee802da4ca18d0e542373d17888cc62c0a6a9ac306e8d6e131d1af949545f4975f81cfb34888893b91c082d1cc6fd034e9420dcc8b6eb9054b59ad47ff

Download Submit
C:\Windows\System\sjNgTde.exe

Filesize
1.3MB

MD5
03bfb0cfee8590702e368621236f432f

SHA1
0ca7e3ca70296451683b4f7a8e72c4fe301288fc

SHA256
1e25daf184e7abe8c3152ca0683d2f3cdc580985f51495faca94af72eaf7b887

SHA512
c83d8e2d93d4d5bc9721d312304808ec66cbb1adbd3f10ea45a485f1be6d83c3ca8f3f6966896f2de401adb3aa28883244774be9c4639f6dabc2c1563a89d25d

Download Submit
C:\Windows\System\xwckIoc.exe

Filesize
1.3MB

MD5
5952bb604e528285e790e28a8ba6b8a0

SHA1
9b938142f0c6ec7aba753af1bbd45db00037f3a3

SHA256
b961b8a62119453ecea4142a61a24e3d7464c64a1322f8dd172e30ca6a9d3d1b

SHA512
931817484c5fe39fc0f37ea8f6ca19fad7e48dad5fd87f2a4a80a71e72311349e04ec3fd871b861914d6e17466564ef9269d541ca3f7e160d869ac57e4d43e84

Download Submit
memory/368-2739-0x00007FF6D7310000-0x00007FF6D7702000-memory.dmp

Filesize
3.9MB

Download
memory/368-175-0x00007FF6D7310000-0x00007FF6D7702000-memory.dmp

Filesize
3.9MB

Download
memory/436-111-0x00007FF71E570000-0x00007FF71E962000-memory.dmp

Filesize
3.9MB

Download
memory/436-2712-0x00007FF71E570000-0x00007FF71E962000-memory.dmp

Filesize
3.9MB

Download
memory/532-101-0x00007FF720920000-0x00007FF720D12000-memory.dmp

Filesize
3.9MB

Download
memory/532-2705-0x00007FF720920000-0x00007FF720D12000-memory.dmp

Filesize
3.9MB

Download
memory/1452-158-0x00007FF7929C0000-0x00007FF792DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1452-2727-0x00007FF7929C0000-0x00007FF792DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1536-140-0x00007FF78E5C0000-0x00007FF78E9B2000-memory.dmp

Filesize
3.9MB

Download
memory/1536-2686-0x00007FF78E5C0000-0x00007FF78E9B2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-2759-0x00007FF671230000-0x00007FF671622000-memory.dmp

Filesize
3.9MB

Download
memory/1572-205-0x00007FF671230000-0x00007FF671622000-memory.dmp

Filesize
3.9MB

Download
memory/1612-2665-0x00007FF6DE690000-0x00007FF6DEA82000-memory.dmp

Filesize
3.9MB

Download
memory/1612-134-0x00007FF6DE690000-0x00007FF6DEA82000-memory.dmp

Filesize
3.9MB

Download
memory/1668-2701-0x00007FF67D190000-0x00007FF67D582000-memory.dmp

Filesize
3.9MB

Download
memory/1668-107-0x00007FF67D190000-0x00007FF67D582000-memory.dmp

Filesize
3.9MB

Download
memory/1960-90-0x00007FF6C68D0000-0x00007FF6C6CC2000-memory.dmp

Filesize
3.9MB

Download
memory/1960-2679-0x00007FF6C68D0000-0x00007FF6C6CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-2749-0x00007FF752250000-0x00007FF752642000-memory.dmp

Filesize
3.9MB

Download
memory/2100-181-0x00007FF752250000-0x00007FF752642000-memory.dmp

Filesize
3.9MB

Download
memory/2528-2619-0x00007FF784600000-0x00007FF7849F2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-12-0x00007FF784600000-0x00007FF7849F2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2757-0x00007FF7F9670000-0x00007FF7F9A62000-memory.dmp

Filesize
3.9MB

Download
memory/2568-201-0x00007FF7F9670000-0x00007FF7F9A62000-memory.dmp

Filesize
3.9MB

Download
memory/2960-2691-0x00007FF7D4FE0000-0x00007FF7D53D2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-146-0x00007FF7D4FE0000-0x00007FF7D53D2000-memory.dmp

Filesize
3.9MB

Download
memory/3160-72-0x00007FF620AD0000-0x00007FF620EC2000-memory.dmp

Filesize
3.9MB

Download
memory/3160-2659-0x00007FF620AD0000-0x00007FF620EC2000-memory.dmp

Filesize
3.9MB

Download
memory/3244-2635-0x00007FF636200000-0x00007FF6365F2000-memory.dmp

Filesize
3.9MB

Download
memory/3244-128-0x00007FF636200000-0x00007FF6365F2000-memory.dmp

Filesize
3.9MB

Download
memory/3312-2755-0x00007FF7B3300000-0x00007FF7B36F2000-memory.dmp

Filesize
3.9MB

Download
memory/3312-192-0x00007FF7B3300000-0x00007FF7B36F2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-2777-0x00007FF6F3A40000-0x00007FF6F3E32000-memory.dmp

Filesize
3.9MB

Download
memory/3432-217-0x00007FF6F3A40000-0x00007FF6F3E32000-memory.dmp

Filesize
3.9MB

Download
memory/3632-2769-0x00007FF7BA560000-0x00007FF7BA952000-memory.dmp

Filesize
3.9MB

Download
memory/3632-209-0x00007FF7BA560000-0x00007FF7BA952000-memory.dmp

Filesize
3.9MB

Download
memory/3740-2698-0x00007FF76AF70000-0x00007FF76B362000-memory.dmp

Filesize
3.9MB

Download
memory/3740-94-0x00007FF76AF70000-0x00007FF76B362000-memory.dmp

Filesize
3.9MB

Download
memory/4032-2631-0x00007FF758890000-0x00007FF758C82000-memory.dmp

Filesize
3.9MB

Download
memory/4032-122-0x00007FF758890000-0x00007FF758C82000-memory.dmp

Filesize
3.9MB

Download
memory/4424-2724-0x00007FF6ADD40000-0x00007FF6AE132000-memory.dmp

Filesize
3.9MB

Download
memory/4424-152-0x00007FF6ADD40000-0x00007FF6AE132000-memory.dmp

Filesize
3.9MB

Download
memory/4500-1-0x0000014B27D10000-0x0000014B27D20000-memory.dmp

Filesize
64KB

Download
memory/4500-0-0x00007FF7CFA00000-0x00007FF7CFDF2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-54-0x00007FFF45670000-0x00007FFF46131000-memory.dmp

Filesize
10.8MB

Download
memory/4748-30-0x00007FFF45670000-0x00007FFF46131000-memory.dmp

Filesize
10.8MB

Download
memory/4748-2617-0x00007FFF45670000-0x00007FFF46131000-memory.dmp

Filesize
10.8MB

Download
memory/4748-464-0x000001EC1F630000-0x000001EC1FDD6000-memory.dmp

Filesize
7.6MB

Download
memory/4748-65-0x000001EC1C560000-0x000001EC1C582000-memory.dmp

Filesize
136KB

Download
memory/4748-2479-0x00007FFF45673000-0x00007FFF45675000-memory.dmp

Filesize
8KB

Download
memory/4748-5-0x00007FFF45673000-0x00007FFF45675000-memory.dmp

Filesize
8KB

Download
memory/4992-2735-0x00007FF72A1F0000-0x00007FF72A5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-169-0x00007FF72A1F0000-0x00007FF72A5E2000-memory.dmp

Filesize
3.9MB

Download
memory/5076-84-0x00007FF7A2FC0000-0x00007FF7A33B2000-memory.dmp

Filesize
3.9MB

Download
memory/5076-2644-0x00007FF7A2FC0000-0x00007FF7A33B2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-213-0x00007FF73A050000-0x00007FF73A442000-memory.dmp

Filesize
3.9MB

Download
memory/5084-2782-0x00007FF73A050000-0x00007FF73A442000-memory.dmp

Filesize
3.9MB

Download