xmrig | 686dc5419077046a015ac2bd70034bf8c214ceed88af53a2e1e26102a8243cf5

Analysis

max time kernel
115s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afea276ea4da6b808e2b73e1aa416df0N.exe
Size

1.9MB
MD5

afea276ea4da6b808e2b73e1aa416df0
SHA1

aacafee92f713aa970e77c6fe922789b630af8d2
SHA256

686dc5419077046a015ac2bd70034bf8c214ceed88af53a2e1e26102a8243cf5
SHA512

1031dc45232139719125f81c5a32684696c274e2be7a0a7d89f9cad3376c049ac8695046ec4ef46adb473605096579cc6f414fb89defb0d1bd300eb4997a68c5
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupQF4g6FReQwUzN6Rf0Zra+JsqAhV:Lz071uv4BPMki8CnfZFOzZu1

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/2136-112-0x00007FF6EDBA0000-0x00007FF6EDF92000-memory.dmp	xmrig
behavioral2/memory/4976-162-0x00007FF7844D0000-0x00007FF7848C2000-memory.dmp	xmrig
behavioral2/memory/4084-269-0x00007FF784780000-0x00007FF784B72000-memory.dmp	xmrig
behavioral2/memory/2468-388-0x00007FF6DD8E0000-0x00007FF6DDCD2000-memory.dmp	xmrig
behavioral2/memory/3680-440-0x00007FF725760000-0x00007FF725B52000-memory.dmp	xmrig
behavioral2/memory/4824-532-0x00007FF695E30000-0x00007FF696222000-memory.dmp	xmrig
behavioral2/memory/1456-540-0x00007FF6E0210000-0x00007FF6E0602000-memory.dmp	xmrig
behavioral2/memory/2116-572-0x00007FF7B9DF0000-0x00007FF7BA1E2000-memory.dmp	xmrig
behavioral2/memory/684-618-0x00007FF65A6D0000-0x00007FF65AAC2000-memory.dmp	xmrig
behavioral2/memory/5092-623-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp	xmrig
behavioral2/memory/60-622-0x00007FF7E0CB0000-0x00007FF7E10A2000-memory.dmp	xmrig
behavioral2/memory/4052-556-0x00007FF7E9640000-0x00007FF7E9A32000-memory.dmp	xmrig
behavioral2/memory/5040-554-0x00007FF6EF290000-0x00007FF6EF682000-memory.dmp	xmrig
behavioral2/memory/2196-476-0x00007FF77F6A0000-0x00007FF77FA92000-memory.dmp	xmrig
behavioral2/memory/3316-449-0x00007FF7F41A0000-0x00007FF7F4592000-memory.dmp	xmrig
behavioral2/memory/1632-448-0x00007FF7C51C0000-0x00007FF7C55B2000-memory.dmp	xmrig
behavioral2/memory/768-404-0x00007FF6841C0000-0x00007FF6845B2000-memory.dmp	xmrig
behavioral2/memory/3288-321-0x00007FF7528B0000-0x00007FF752CA2000-memory.dmp	xmrig
behavioral2/memory/4752-253-0x00007FF784BF0000-0x00007FF784FE2000-memory.dmp	xmrig
behavioral2/memory/652-208-0x00007FF6EE670000-0x00007FF6EEA62000-memory.dmp	xmrig
behavioral2/memory/3216-113-0x00007FF6AF3E0000-0x00007FF6AF7D2000-memory.dmp	xmrig
behavioral2/memory/1488-111-0x00007FF755C30000-0x00007FF756022000-memory.dmp	xmrig
behavioral2/memory/3684-52-0x00007FF7CA8E0000-0x00007FF7CACD2000-memory.dmp	xmrig
behavioral2/memory/684-3070-0x00007FF65A6D0000-0x00007FF65AAC2000-memory.dmp	xmrig
behavioral2/memory/652-3086-0x00007FF6EE670000-0x00007FF6EEA62000-memory.dmp	xmrig
behavioral2/memory/3216-3109-0x00007FF6AF3E0000-0x00007FF6AF7D2000-memory.dmp	xmrig
behavioral2/memory/4752-3107-0x00007FF784BF0000-0x00007FF784FE2000-memory.dmp	xmrig
behavioral2/memory/4976-3116-0x00007FF7844D0000-0x00007FF7848C2000-memory.dmp	xmrig
behavioral2/memory/2136-3123-0x00007FF6EDBA0000-0x00007FF6EDF92000-memory.dmp	xmrig
behavioral2/memory/4084-3140-0x00007FF784780000-0x00007FF784B72000-memory.dmp	xmrig
behavioral2/memory/4052-3212-0x00007FF7E9640000-0x00007FF7E9A32000-memory.dmp	xmrig
behavioral2/memory/1632-3223-0x00007FF7C51C0000-0x00007FF7C55B2000-memory.dmp	xmrig
behavioral2/memory/1456-3279-0x00007FF6E0210000-0x00007FF6E0602000-memory.dmp	xmrig
behavioral2/memory/5092-3294-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp	xmrig
behavioral2/memory/5040-3273-0x00007FF6EF290000-0x00007FF6EF682000-memory.dmp	xmrig
behavioral2/memory/3680-3217-0x00007FF725760000-0x00007FF725B52000-memory.dmp	xmrig
behavioral2/memory/3288-3190-0x00007FF7528B0000-0x00007FF752CA2000-memory.dmp	xmrig
behavioral2/memory/2196-3188-0x00007FF77F6A0000-0x00007FF77FA92000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
18	3148	powershell.exe
20	3148	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3148	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1728	uPVydSd.exe
3684	iFKKLZq.exe
2116	iRuKVbZ.exe
1488	sPlalGT.exe
2136	puKqeRR.exe
3216	muPnjuh.exe
4976	ndcPrni.exe
684	juNnCkM.exe
652	DWJkDXL.exe
4752	JxMDVza.exe
60	upDxJcs.exe
4084	EIijkGt.exe
3288	AkeqRUZ.exe
2468	JJxwAmF.exe
768	FQxjpKQ.exe
3680	sccWpow.exe
1632	SatPcay.exe
3316	nDIfPeQ.exe
2196	vwDgacD.exe
4824	wAIJxHm.exe
5092	dkIYTWX.exe
1456	pIageSO.exe
5040	qcfDhbP.exe
4052	OfqQspW.exe
628	WEakHjC.exe
4236	noxjbab.exe
1152	IAXtCpN.exe
1204	EDvGrCQ.exe
3472	pgkaHtE.exe
3780	kPuNfOl.exe
4040	UMeZuSO.exe
2368	OSezKmF.exe
960	wRnxYNo.exe
4708	QqXHLzm.exe
3712	JacGbwo.exe
3976	uOZTNnE.exe
4680	axZEZdd.exe
1348	GuzPieR.exe
4196	XaDzgqp.exe
3540	VVGBoQc.exe
3844	lSJxDQj.exe
740	qJMyirc.exe
224	sDwrgRy.exe
1424	yfyTyWp.exe
3972	sbEXDtD.exe
2596	ZTbJmWu.exe
4100	izuyoZj.exe
4780	zYGGItg.exe
4676	FPNlgYr.exe
1628	EUybgVL.exe
2504	htiJGnw.exe
4516	ffFzzjK.exe
5056	yBNaLZs.exe
4948	sHsGbha.exe
4308	GVKAaNA.exe
4380	yKoWtuX.exe
3484	YxYpsZT.exe
1496	neGUTgR.exe
2760	cjixLQg.exe
3604	cqaEKwd.exe
2304	eSbfLqY.exe
2276	szifMxF.exe
4360	LBItXyq.exe
4036	EvSQRRs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4416-0-0x00007FF718950000-0x00007FF718D42000-memory.dmp	upx
behavioral2/files/0x000800000002347a-10.dat	upx
behavioral2/files/0x000700000002347e-7.dat	upx
behavioral2/files/0x000a00000002345e-5.dat	upx
behavioral2/files/0x0007000000023480-24.dat	upx
behavioral2/files/0x0007000000023481-27.dat	upx
behavioral2/files/0x0007000000023487-57.dat	upx
behavioral2/files/0x0007000000023485-67.dat	upx
behavioral2/files/0x000700000002348a-100.dat	upx
behavioral2/files/0x000700000002348f-97.dat	upx
behavioral2/files/0x000700000002348e-96.dat	upx
behavioral2/files/0x0007000000023488-93.dat	upx
behavioral2/memory/2136-112-0x00007FF6EDBA0000-0x00007FF6EDF92000-memory.dmp	upx
behavioral2/memory/4976-162-0x00007FF7844D0000-0x00007FF7848C2000-memory.dmp	upx
behavioral2/files/0x00070000000234a6-212.dat	upx
behavioral2/memory/4084-269-0x00007FF784780000-0x00007FF784B72000-memory.dmp	upx
behavioral2/memory/2468-388-0x00007FF6DD8E0000-0x00007FF6DDCD2000-memory.dmp	upx
behavioral2/memory/3680-440-0x00007FF725760000-0x00007FF725B52000-memory.dmp	upx
behavioral2/memory/4824-532-0x00007FF695E30000-0x00007FF696222000-memory.dmp	upx
behavioral2/memory/1456-540-0x00007FF6E0210000-0x00007FF6E0602000-memory.dmp	upx
behavioral2/memory/2116-572-0x00007FF7B9DF0000-0x00007FF7BA1E2000-memory.dmp	upx
behavioral2/memory/684-618-0x00007FF65A6D0000-0x00007FF65AAC2000-memory.dmp	upx
behavioral2/memory/5092-623-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp	upx
behavioral2/memory/60-622-0x00007FF7E0CB0000-0x00007FF7E10A2000-memory.dmp	upx
behavioral2/memory/4052-556-0x00007FF7E9640000-0x00007FF7E9A32000-memory.dmp	upx
behavioral2/memory/5040-554-0x00007FF6EF290000-0x00007FF6EF682000-memory.dmp	upx
behavioral2/memory/2196-476-0x00007FF77F6A0000-0x00007FF77FA92000-memory.dmp	upx
behavioral2/memory/3316-449-0x00007FF7F41A0000-0x00007FF7F4592000-memory.dmp	upx
behavioral2/memory/1632-448-0x00007FF7C51C0000-0x00007FF7C55B2000-memory.dmp	upx
behavioral2/memory/768-404-0x00007FF6841C0000-0x00007FF6845B2000-memory.dmp	upx
behavioral2/memory/3288-321-0x00007FF7528B0000-0x00007FF752CA2000-memory.dmp	upx
behavioral2/memory/4752-253-0x00007FF784BF0000-0x00007FF784FE2000-memory.dmp	upx
behavioral2/files/0x000800000002349b-211.dat	upx
behavioral2/files/0x00070000000234a5-210.dat	upx
behavioral2/files/0x00070000000234a4-209.dat	upx
behavioral2/memory/652-208-0x00007FF6EE670000-0x00007FF6EEA62000-memory.dmp	upx
behavioral2/files/0x00070000000234a3-205.dat	upx
behavioral2/files/0x0007000000023490-202.dat	upx
behavioral2/files/0x00070000000234a1-196.dat	upx
behavioral2/files/0x00070000000234a0-190.dat	upx
behavioral2/files/0x000700000002348b-187.dat	upx
behavioral2/files/0x000700000002349e-183.dat	upx
behavioral2/files/0x000700000002349c-181.dat	upx
behavioral2/files/0x0007000000023493-176.dat	upx
behavioral2/files/0x0007000000023499-175.dat	upx
behavioral2/files/0x0007000000023486-153.dat	upx
behavioral2/files/0x000700000002348c-152.dat	upx
behavioral2/files/0x0007000000023498-149.dat	upx
behavioral2/files/0x0007000000023497-147.dat	upx
behavioral2/files/0x000700000002349f-186.dat	upx
behavioral2/files/0x0007000000023496-142.dat	upx
behavioral2/files/0x0007000000023489-138.dat	upx
behavioral2/files/0x000700000002348d-130.dat	upx
behavioral2/files/0x0007000000023494-129.dat	upx
behavioral2/files/0x0007000000023492-118.dat	upx
behavioral2/files/0x0007000000023491-115.dat	upx
behavioral2/files/0x000800000002347b-146.dat	upx
behavioral2/files/0x0007000000023495-132.dat	upx
behavioral2/memory/3216-113-0x00007FF6AF3E0000-0x00007FF6AF7D2000-memory.dmp	upx
behavioral2/memory/1488-111-0x00007FF755C30000-0x00007FF756022000-memory.dmp	upx
behavioral2/files/0x0007000000023482-88.dat	upx
behavioral2/memory/3684-52-0x00007FF7CA8E0000-0x00007FF7CACD2000-memory.dmp	upx
behavioral2/files/0x0007000000023484-45.dat	upx
behavioral2/files/0x000700000002347f-60.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
17	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ClXFkAt.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\lMIReWE.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\srBYlZM.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\ERjpgud.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\gBPCHjs.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\qzoNwGp.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\SjpwOfB.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\FihRIhl.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\EVohZUZ.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\kdVDNus.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\ockNwIA.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\sCTpfXd.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\SmUASMY.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\SGIguwO.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\ZLgaQcQ.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\jfndzES.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\VolWoxB.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\CqDsEoi.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\UoCsiZX.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\qtMKqrq.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\KOJIRHO.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\XTlmfBr.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\okeOnFb.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\HkZTEIP.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\fIQfXhN.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\jncarKv.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\WCWnOpf.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\CvAQxVQ.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\suMHUAz.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\bHmySRk.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\IFoNRkV.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\nGhmZkI.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\YCMLwZH.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\qnvCKrQ.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\biBmsWV.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\vOLmBRU.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\ZcSCASc.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\eNAksPj.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\eoKxMWj.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\hUiCYCA.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\OGXqpPP.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\bMvriQZ.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\XSlqkrO.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\CHLAvRS.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\lXrNegU.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\gnTbTPz.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\ZFapiqc.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\qoaqPpE.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\LRPDumS.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\hqkpqqu.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\YSUqvoi.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\lIXUUKR.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\yjQOoNW.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\SywMVDO.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\pdyeOmf.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\HNUgWNU.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\AEYBIgO.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\ifqDbBJ.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\XQlgHah.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\IVdjzbK.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\utMZwrD.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\iqnsbaT.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\kjrEKau.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\yusrfsK.exe	afea276ea4da6b808e2b73e1aa416df0N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3148	powershell.exe
3148	powershell.exe
3148	powershell.exe
3148	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	powershell.exe
Token: SeLockMemoryPrivilege	4416	afea276ea4da6b808e2b73e1aa416df0N.exe
Token: SeLockMemoryPrivilege	4416	afea276ea4da6b808e2b73e1aa416df0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 3148	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	85
PID 4416 wrote to memory of 3148	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	85
PID 4416 wrote to memory of 1728	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	86
PID 4416 wrote to memory of 1728	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	86
PID 4416 wrote to memory of 3684	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	87
PID 4416 wrote to memory of 3684	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	87
PID 4416 wrote to memory of 2116	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	88
PID 4416 wrote to memory of 2116	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	88
PID 4416 wrote to memory of 1488	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	89
PID 4416 wrote to memory of 1488	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	89
PID 4416 wrote to memory of 2136	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	90
PID 4416 wrote to memory of 2136	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	90
PID 4416 wrote to memory of 3216	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	91
PID 4416 wrote to memory of 3216	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	91
PID 4416 wrote to memory of 4976	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	92
PID 4416 wrote to memory of 4976	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	92
PID 4416 wrote to memory of 684	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	93
PID 4416 wrote to memory of 684	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	93
PID 4416 wrote to memory of 652	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	94
PID 4416 wrote to memory of 652	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	94
PID 4416 wrote to memory of 4752	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	95
PID 4416 wrote to memory of 4752	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	95
PID 4416 wrote to memory of 768	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	96
PID 4416 wrote to memory of 768	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	96
PID 4416 wrote to memory of 60	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	97
PID 4416 wrote to memory of 60	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	97
PID 4416 wrote to memory of 4084	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	98
PID 4416 wrote to memory of 4084	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	98
PID 4416 wrote to memory of 3288	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	99
PID 4416 wrote to memory of 3288	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	99
PID 4416 wrote to memory of 2468	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	100
PID 4416 wrote to memory of 2468	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	100
PID 4416 wrote to memory of 3680	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	101
PID 4416 wrote to memory of 3680	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	101
PID 4416 wrote to memory of 1632	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	102
PID 4416 wrote to memory of 1632	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	102
PID 4416 wrote to memory of 3316	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	103
PID 4416 wrote to memory of 3316	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	103
PID 4416 wrote to memory of 2196	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	104
PID 4416 wrote to memory of 2196	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	104
PID 4416 wrote to memory of 4824	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	105
PID 4416 wrote to memory of 4824	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	105
PID 4416 wrote to memory of 5092	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	106
PID 4416 wrote to memory of 5092	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	106
PID 4416 wrote to memory of 1456	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	107
PID 4416 wrote to memory of 1456	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	107
PID 4416 wrote to memory of 5040	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	108
PID 4416 wrote to memory of 5040	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	108
PID 4416 wrote to memory of 4052	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	109
PID 4416 wrote to memory of 4052	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	109
PID 4416 wrote to memory of 628	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	110
PID 4416 wrote to memory of 628	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	110
PID 4416 wrote to memory of 4236	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	111
PID 4416 wrote to memory of 4236	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	111
PID 4416 wrote to memory of 1152	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	112
PID 4416 wrote to memory of 1152	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	112
PID 4416 wrote to memory of 1204	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	113
PID 4416 wrote to memory of 1204	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	113
PID 4416 wrote to memory of 3472	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	114
PID 4416 wrote to memory of 3472	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	114
PID 4416 wrote to memory of 3780	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	115
PID 4416 wrote to memory of 3780	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	115
PID 4416 wrote to memory of 4040	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	116
PID 4416 wrote to memory of 4040	4416	afea276ea4da6b808e2b73e1aa416df0N.exe	116

C:\Users\Admin\AppData\Local\Temp\afea276ea4da6b808e2b73e1aa416df0N.exe
"C:\Users\Admin\AppData\Local\Temp\afea276ea4da6b808e2b73e1aa416df0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3148
- C:\Windows\System\uPVydSd.exe
  C:\Windows\System\uPVydSd.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\iFKKLZq.exe
  C:\Windows\System\iFKKLZq.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\iRuKVbZ.exe
  C:\Windows\System\iRuKVbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\sPlalGT.exe
  C:\Windows\System\sPlalGT.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\puKqeRR.exe
  C:\Windows\System\puKqeRR.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\muPnjuh.exe
  C:\Windows\System\muPnjuh.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\ndcPrni.exe
  C:\Windows\System\ndcPrni.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\juNnCkM.exe
  C:\Windows\System\juNnCkM.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\DWJkDXL.exe
  C:\Windows\System\DWJkDXL.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\JxMDVza.exe
  C:\Windows\System\JxMDVza.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\FQxjpKQ.exe
  C:\Windows\System\FQxjpKQ.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\upDxJcs.exe
  C:\Windows\System\upDxJcs.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\EIijkGt.exe
  C:\Windows\System\EIijkGt.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\AkeqRUZ.exe
  C:\Windows\System\AkeqRUZ.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\JJxwAmF.exe
  C:\Windows\System\JJxwAmF.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\sccWpow.exe
  C:\Windows\System\sccWpow.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\SatPcay.exe
  C:\Windows\System\SatPcay.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\nDIfPeQ.exe
  C:\Windows\System\nDIfPeQ.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\vwDgacD.exe
  C:\Windows\System\vwDgacD.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\wAIJxHm.exe
  C:\Windows\System\wAIJxHm.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\dkIYTWX.exe
  C:\Windows\System\dkIYTWX.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\pIageSO.exe
  C:\Windows\System\pIageSO.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\qcfDhbP.exe
  C:\Windows\System\qcfDhbP.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\OfqQspW.exe
  C:\Windows\System\OfqQspW.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\WEakHjC.exe
  C:\Windows\System\WEakHjC.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\noxjbab.exe
  C:\Windows\System\noxjbab.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\IAXtCpN.exe
  C:\Windows\System\IAXtCpN.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\EDvGrCQ.exe
  C:\Windows\System\EDvGrCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\pgkaHtE.exe
  C:\Windows\System\pgkaHtE.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\kPuNfOl.exe
  C:\Windows\System\kPuNfOl.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\UMeZuSO.exe
  C:\Windows\System\UMeZuSO.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\OSezKmF.exe
  C:\Windows\System\OSezKmF.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\sbEXDtD.exe
  C:\Windows\System\sbEXDtD.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\wRnxYNo.exe
  C:\Windows\System\wRnxYNo.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\QqXHLzm.exe
  C:\Windows\System\QqXHLzm.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\JacGbwo.exe
  C:\Windows\System\JacGbwo.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\uOZTNnE.exe
  C:\Windows\System\uOZTNnE.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\EUybgVL.exe
  C:\Windows\System\EUybgVL.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\axZEZdd.exe
  C:\Windows\System\axZEZdd.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\GuzPieR.exe
  C:\Windows\System\GuzPieR.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\XaDzgqp.exe
  C:\Windows\System\XaDzgqp.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\VVGBoQc.exe
  C:\Windows\System\VVGBoQc.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\lSJxDQj.exe
  C:\Windows\System\lSJxDQj.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\qJMyirc.exe
  C:\Windows\System\qJMyirc.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\sDwrgRy.exe
  C:\Windows\System\sDwrgRy.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\yfyTyWp.exe
  C:\Windows\System\yfyTyWp.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\ZTbJmWu.exe
  C:\Windows\System\ZTbJmWu.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\GVKAaNA.exe
  C:\Windows\System\GVKAaNA.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\izuyoZj.exe
  C:\Windows\System\izuyoZj.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\zYGGItg.exe
  C:\Windows\System\zYGGItg.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\FPNlgYr.exe
  C:\Windows\System\FPNlgYr.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\htiJGnw.exe
  C:\Windows\System\htiJGnw.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\ffFzzjK.exe
  C:\Windows\System\ffFzzjK.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\uMTRdld.exe
  C:\Windows\System\uMTRdld.exe
  2⤵
  PID:2092
- C:\Windows\System\yBNaLZs.exe
  C:\Windows\System\yBNaLZs.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\sHsGbha.exe
  C:\Windows\System\sHsGbha.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\RXDnHct.exe
  C:\Windows\System\RXDnHct.exe
  2⤵
  PID:3192
- C:\Windows\System\yKoWtuX.exe
  C:\Windows\System\yKoWtuX.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\YxYpsZT.exe
  C:\Windows\System\YxYpsZT.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\neGUTgR.exe
  C:\Windows\System\neGUTgR.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\cjixLQg.exe
  C:\Windows\System\cjixLQg.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\cqaEKwd.exe
  C:\Windows\System\cqaEKwd.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\eSbfLqY.exe
  C:\Windows\System\eSbfLqY.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\szifMxF.exe
  C:\Windows\System\szifMxF.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\LBItXyq.exe
  C:\Windows\System\LBItXyq.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\EvSQRRs.exe
  C:\Windows\System\EvSQRRs.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\MBSaUKZ.exe
  C:\Windows\System\MBSaUKZ.exe
  2⤵
  PID:1616
- C:\Windows\System\dccTXPb.exe
  C:\Windows\System\dccTXPb.exe
  2⤵
  PID:4820
- C:\Windows\System\NWpJyMN.exe
  C:\Windows\System\NWpJyMN.exe
  2⤵
  PID:2656
- C:\Windows\System\dZOnHgT.exe
  C:\Windows\System\dZOnHgT.exe
  2⤵
  PID:4560
- C:\Windows\System\qqewozF.exe
  C:\Windows\System\qqewozF.exe
  2⤵
  PID:2828
- C:\Windows\System\BoVQuMb.exe
  C:\Windows\System\BoVQuMb.exe
  2⤵
  PID:3040
- C:\Windows\System\Cigsnfm.exe
  C:\Windows\System\Cigsnfm.exe
  2⤵
  PID:3392
- C:\Windows\System\ZnyfzOY.exe
  C:\Windows\System\ZnyfzOY.exe
  2⤵
  PID:4468
- C:\Windows\System\OUlwgVq.exe
  C:\Windows\System\OUlwgVq.exe
  2⤵
  PID:2040
- C:\Windows\System\eaYiXGQ.exe
  C:\Windows\System\eaYiXGQ.exe
  2⤵
  PID:2584
- C:\Windows\System\fjvXfky.exe
  C:\Windows\System\fjvXfky.exe
  2⤵
  PID:2836
- C:\Windows\System\EQXemSk.exe
  C:\Windows\System\EQXemSk.exe
  2⤵
  PID:3960
- C:\Windows\System\tmtDNIE.exe
  C:\Windows\System\tmtDNIE.exe
  2⤵
  PID:4120
- C:\Windows\System\okeOnFb.exe
  C:\Windows\System\okeOnFb.exe
  2⤵
  PID:3608
- C:\Windows\System\msfANfZ.exe
  C:\Windows\System\msfANfZ.exe
  2⤵
  PID:448
- C:\Windows\System\cLTNKSJ.exe
  C:\Windows\System\cLTNKSJ.exe
  2⤵
  PID:2176
- C:\Windows\System\SUHeXRQ.exe
  C:\Windows\System\SUHeXRQ.exe
  2⤵
  PID:5136
- C:\Windows\System\uKfWkVf.exe
  C:\Windows\System\uKfWkVf.exe
  2⤵
  PID:5156
- C:\Windows\System\MktHuBR.exe
  C:\Windows\System\MktHuBR.exe
  2⤵
  PID:5184
- C:\Windows\System\aLPqGGf.exe
  C:\Windows\System\aLPqGGf.exe
  2⤵
  PID:5200
- C:\Windows\System\iitLVZh.exe
  C:\Windows\System\iitLVZh.exe
  2⤵
  PID:5224
- C:\Windows\System\gjEIoVw.exe
  C:\Windows\System\gjEIoVw.exe
  2⤵
  PID:5252
- C:\Windows\System\pgMyctN.exe
  C:\Windows\System\pgMyctN.exe
  2⤵
  PID:5268
- C:\Windows\System\jlPQRnR.exe
  C:\Windows\System\jlPQRnR.exe
  2⤵
  PID:5296
- C:\Windows\System\GTvYylb.exe
  C:\Windows\System\GTvYylb.exe
  2⤵
  PID:5316
- C:\Windows\System\xFnuZbg.exe
  C:\Windows\System\xFnuZbg.exe
  2⤵
  PID:5340
- C:\Windows\System\QYsGnPZ.exe
  C:\Windows\System\QYsGnPZ.exe
  2⤵
  PID:5356
- C:\Windows\System\ULGTVaI.exe
  C:\Windows\System\ULGTVaI.exe
  2⤵
  PID:5428
- C:\Windows\System\OgxyaeI.exe
  C:\Windows\System\OgxyaeI.exe
  2⤵
  PID:5448
- C:\Windows\System\YLxtvnF.exe
  C:\Windows\System\YLxtvnF.exe
  2⤵
  PID:5472
- C:\Windows\System\YSBDhuH.exe
  C:\Windows\System\YSBDhuH.exe
  2⤵
  PID:5488
- C:\Windows\System\vJvCJUK.exe
  C:\Windows\System\vJvCJUK.exe
  2⤵
  PID:5512
- C:\Windows\System\qXjpQtf.exe
  C:\Windows\System\qXjpQtf.exe
  2⤵
  PID:5536
- C:\Windows\System\efmBOzE.exe
  C:\Windows\System\efmBOzE.exe
  2⤵
  PID:5560
- C:\Windows\System\JpCidPT.exe
  C:\Windows\System\JpCidPT.exe
  2⤵
  PID:5584
- C:\Windows\System\fVKQZpx.exe
  C:\Windows\System\fVKQZpx.exe
  2⤵
  PID:5608
- C:\Windows\System\YdAMQNN.exe
  C:\Windows\System\YdAMQNN.exe
  2⤵
  PID:5628
- C:\Windows\System\QlmKYsE.exe
  C:\Windows\System\QlmKYsE.exe
  2⤵
  PID:5648
- C:\Windows\System\UdnWbxF.exe
  C:\Windows\System\UdnWbxF.exe
  2⤵
  PID:5664
- C:\Windows\System\sPGZFJo.exe
  C:\Windows\System\sPGZFJo.exe
  2⤵
  PID:5692
- C:\Windows\System\plGmGEn.exe
  C:\Windows\System\plGmGEn.exe
  2⤵
  PID:5712
- C:\Windows\System\YpluWgV.exe
  C:\Windows\System\YpluWgV.exe
  2⤵
  PID:5732
- C:\Windows\System\MEsJOeU.exe
  C:\Windows\System\MEsJOeU.exe
  2⤵
  PID:5756
- C:\Windows\System\IFPaDgO.exe
  C:\Windows\System\IFPaDgO.exe
  2⤵
  PID:5776
- C:\Windows\System\BhyRMCN.exe
  C:\Windows\System\BhyRMCN.exe
  2⤵
  PID:5804
- C:\Windows\System\tJsQYWg.exe
  C:\Windows\System\tJsQYWg.exe
  2⤵
  PID:5820
- C:\Windows\System\ZheQiQW.exe
  C:\Windows\System\ZheQiQW.exe
  2⤵
  PID:5840
- C:\Windows\System\SZsOoAy.exe
  C:\Windows\System\SZsOoAy.exe
  2⤵
  PID:5860
- C:\Windows\System\RDZZbUN.exe
  C:\Windows\System\RDZZbUN.exe
  2⤵
  PID:5884
- C:\Windows\System\nPYuSWw.exe
  C:\Windows\System\nPYuSWw.exe
  2⤵
  PID:6044
- C:\Windows\System\krTquar.exe
  C:\Windows\System\krTquar.exe
  2⤵
  PID:6060
- C:\Windows\System\TjGIGjd.exe
  C:\Windows\System\TjGIGjd.exe
  2⤵
  PID:6080
- C:\Windows\System\EKzkPLU.exe
  C:\Windows\System\EKzkPLU.exe
  2⤵
  PID:6096
- C:\Windows\System\WMahYHE.exe
  C:\Windows\System\WMahYHE.exe
  2⤵
  PID:6120
- C:\Windows\System\yGlUeSZ.exe
  C:\Windows\System\yGlUeSZ.exe
  2⤵
  PID:4296
- C:\Windows\System\mPXQXLk.exe
  C:\Windows\System\mPXQXLk.exe
  2⤵
  PID:2460
- C:\Windows\System\YCMLwZH.exe
  C:\Windows\System\YCMLwZH.exe
  2⤵
  PID:4328
- C:\Windows\System\OnGaUot.exe
  C:\Windows\System\OnGaUot.exe
  2⤵
  PID:1200
- C:\Windows\System\cVJrsMB.exe
  C:\Windows\System\cVJrsMB.exe
  2⤵
  PID:4592
- C:\Windows\System\xBeuLVx.exe
  C:\Windows\System\xBeuLVx.exe
  2⤵
  PID:3048
- C:\Windows\System\hfgZUsZ.exe
  C:\Windows\System\hfgZUsZ.exe
  2⤵
  PID:1268
- C:\Windows\System\dPGiBaj.exe
  C:\Windows\System\dPGiBaj.exe
  2⤵
  PID:4784
- C:\Windows\System\bBcmGwp.exe
  C:\Windows\System\bBcmGwp.exe
  2⤵
  PID:464
- C:\Windows\System\wMaKfeb.exe
  C:\Windows\System\wMaKfeb.exe
  2⤵
  PID:2600
- C:\Windows\System\fLxOmfe.exe
  C:\Windows\System\fLxOmfe.exe
  2⤵
  PID:5592
- C:\Windows\System\lpkzLIa.exe
  C:\Windows\System\lpkzLIa.exe
  2⤵
  PID:5552
- C:\Windows\System\LxHxyBe.exe
  C:\Windows\System\LxHxyBe.exe
  2⤵
  PID:5504
- C:\Windows\System\bOtSxuU.exe
  C:\Windows\System\bOtSxuU.exe
  2⤵
  PID:5456
- C:\Windows\System\ilFfduK.exe
  C:\Windows\System\ilFfduK.exe
  2⤵
  PID:5640
- C:\Windows\System\oNrAeFm.exe
  C:\Windows\System\oNrAeFm.exe
  2⤵
  PID:5680
- C:\Windows\System\ZLjxxyr.exe
  C:\Windows\System\ZLjxxyr.exe
  2⤵
  PID:5724
- C:\Windows\System\HhYDMPw.exe
  C:\Windows\System\HhYDMPw.exe
  2⤵
  PID:5772
- C:\Windows\System\OmHmnxd.exe
  C:\Windows\System\OmHmnxd.exe
  2⤵
  PID:6108
- C:\Windows\System\fZWiLjC.exe
  C:\Windows\System\fZWiLjC.exe
  2⤵
  PID:4972
- C:\Windows\System\gBPCHjs.exe
  C:\Windows\System\gBPCHjs.exe
  2⤵
  PID:6152
- C:\Windows\System\rBFgmXS.exe
  C:\Windows\System\rBFgmXS.exe
  2⤵
  PID:6176
- C:\Windows\System\hsCtniR.exe
  C:\Windows\System\hsCtniR.exe
  2⤵
  PID:6192
- C:\Windows\System\tTBSxwh.exe
  C:\Windows\System\tTBSxwh.exe
  2⤵
  PID:6216
- C:\Windows\System\dKZOYLv.exe
  C:\Windows\System\dKZOYLv.exe
  2⤵
  PID:6240
- C:\Windows\System\nJpAsLj.exe
  C:\Windows\System\nJpAsLj.exe
  2⤵
  PID:6260
- C:\Windows\System\TazwQAj.exe
  C:\Windows\System\TazwQAj.exe
  2⤵
  PID:6280
- C:\Windows\System\LNwhJKO.exe
  C:\Windows\System\LNwhJKO.exe
  2⤵
  PID:6300
- C:\Windows\System\AkQhhIR.exe
  C:\Windows\System\AkQhhIR.exe
  2⤵
  PID:6320
- C:\Windows\System\HHEmLWn.exe
  C:\Windows\System\HHEmLWn.exe
  2⤵
  PID:6344
- C:\Windows\System\FJrIDPS.exe
  C:\Windows\System\FJrIDPS.exe
  2⤵
  PID:6364
- C:\Windows\System\zGRxcOK.exe
  C:\Windows\System\zGRxcOK.exe
  2⤵
  PID:6384
- C:\Windows\System\TtPqWbm.exe
  C:\Windows\System\TtPqWbm.exe
  2⤵
  PID:6412
- C:\Windows\System\GFINLFp.exe
  C:\Windows\System\GFINLFp.exe
  2⤵
  PID:6432
- C:\Windows\System\KUBSpmq.exe
  C:\Windows\System\KUBSpmq.exe
  2⤵
  PID:6448
- C:\Windows\System\pokgdTa.exe
  C:\Windows\System\pokgdTa.exe
  2⤵
  PID:6464
- C:\Windows\System\YwnhanK.exe
  C:\Windows\System\YwnhanK.exe
  2⤵
  PID:6480
- C:\Windows\System\rJDMNeC.exe
  C:\Windows\System\rJDMNeC.exe
  2⤵
  PID:6636
- C:\Windows\System\JFctkmc.exe
  C:\Windows\System\JFctkmc.exe
  2⤵
  PID:6664
- C:\Windows\System\EnnQAEW.exe
  C:\Windows\System\EnnQAEW.exe
  2⤵
  PID:6692
- C:\Windows\System\cGHRJut.exe
  C:\Windows\System\cGHRJut.exe
  2⤵
  PID:6708
- C:\Windows\System\nDiWhXy.exe
  C:\Windows\System\nDiWhXy.exe
  2⤵
  PID:6932
- C:\Windows\System\WExLoYo.exe
  C:\Windows\System\WExLoYo.exe
  2⤵
  PID:7056
- C:\Windows\System\uCAtKSO.exe
  C:\Windows\System\uCAtKSO.exe
  2⤵
  PID:7072
- C:\Windows\System\GYNiZAv.exe
  C:\Windows\System\GYNiZAv.exe
  2⤵
  PID:7088
- C:\Windows\System\ZiMscsR.exe
  C:\Windows\System\ZiMscsR.exe
  2⤵
  PID:7104
- C:\Windows\System\hirOsrI.exe
  C:\Windows\System\hirOsrI.exe
  2⤵
  PID:7120
- C:\Windows\System\JIMkZLH.exe
  C:\Windows\System\JIMkZLH.exe
  2⤵
  PID:7136
- C:\Windows\System\sYzWrwv.exe
  C:\Windows\System\sYzWrwv.exe
  2⤵
  PID:7156
- C:\Windows\System\xQsFayS.exe
  C:\Windows\System\xQsFayS.exe
  2⤵
  PID:5704
- C:\Windows\System\znOLdYU.exe
  C:\Windows\System\znOLdYU.exe
  2⤵
  PID:2912
- C:\Windows\System\WSyJxZI.exe
  C:\Windows\System\WSyJxZI.exe
  2⤵
  PID:3948
- C:\Windows\System\aUofrbu.exe
  C:\Windows\System\aUofrbu.exe
  2⤵
  PID:2788
- C:\Windows\System\xBNbNxx.exe
  C:\Windows\System\xBNbNxx.exe
  2⤵
  PID:2496
- C:\Windows\System\sjVzDdB.exe
  C:\Windows\System\sjVzDdB.exe
  2⤵
  PID:532
- C:\Windows\System\doVUyNm.exe
  C:\Windows\System\doVUyNm.exe
  2⤵
  PID:6496
- C:\Windows\System\gkKQOCX.exe
  C:\Windows\System\gkKQOCX.exe
  2⤵
  PID:5508
- C:\Windows\System\dNJykPY.exe
  C:\Windows\System\dNJykPY.exe
  2⤵
  PID:5424
- C:\Windows\System\uHghVJA.exe
  C:\Windows\System\uHghVJA.exe
  2⤵
  PID:5656
- C:\Windows\System\YjKewUz.exe
  C:\Windows\System\YjKewUz.exe
  2⤵
  PID:5764
- C:\Windows\System\UzogRTV.exe
  C:\Windows\System\UzogRTV.exe
  2⤵
  PID:748
- C:\Windows\System\IQBesDc.exe
  C:\Windows\System\IQBesDc.exe
  2⤵
  PID:6336
- C:\Windows\System\lfeZgRD.exe
  C:\Windows\System\lfeZgRD.exe
  2⤵
  PID:6392
- C:\Windows\System\GkSQarq.exe
  C:\Windows\System\GkSQarq.exe
  2⤵
  PID:6784
- C:\Windows\System\GZxbLgf.exe
  C:\Windows\System\GZxbLgf.exe
  2⤵
  PID:6928
- C:\Windows\System\PHutcSG.exe
  C:\Windows\System\PHutcSG.exe
  2⤵
  PID:6956
- C:\Windows\System\DIQxDjp.exe
  C:\Windows\System\DIQxDjp.exe
  2⤵
  PID:7064
- C:\Windows\System\sILPOgo.exe
  C:\Windows\System\sILPOgo.exe
  2⤵
  PID:7112
- C:\Windows\System\dKoFhOL.exe
  C:\Windows\System\dKoFhOL.exe
  2⤵
  PID:7164
- C:\Windows\System\SJAZRAE.exe
  C:\Windows\System\SJAZRAE.exe
  2⤵
  PID:5020
- C:\Windows\System\LlBZGdx.exe
  C:\Windows\System\LlBZGdx.exe
  2⤵
  PID:2360
- C:\Windows\System\ErNphMz.exe
  C:\Windows\System\ErNphMz.exe
  2⤵
  PID:5376
- C:\Windows\System\DuAVnyz.exe
  C:\Windows\System\DuAVnyz.exe
  2⤵
  PID:5532
- C:\Windows\System\tzHVVki.exe
  C:\Windows\System\tzHVVki.exe
  2⤵
  PID:6352
- C:\Windows\System\sBquREE.exe
  C:\Windows\System\sBquREE.exe
  2⤵
  PID:7080
- C:\Windows\System\NQRMIMD.exe
  C:\Windows\System\NQRMIMD.exe
  2⤵
  PID:2028
- C:\Windows\System\GPHEeas.exe
  C:\Windows\System\GPHEeas.exe
  2⤵
  PID:2420
- C:\Windows\System\BYQyFPo.exe
  C:\Windows\System\BYQyFPo.exe
  2⤵
  PID:4808
- C:\Windows\System\RcFExwe.exe
  C:\Windows\System\RcFExwe.exe
  2⤵
  PID:6212
- C:\Windows\System\lhIpBDN.exe
  C:\Windows\System\lhIpBDN.exe
  2⤵
  PID:6172
- C:\Windows\System\rpclVwT.exe
  C:\Windows\System\rpclVwT.exe
  2⤵
  PID:5076
- C:\Windows\System\jtvAcRr.exe
  C:\Windows\System\jtvAcRr.exe
  2⤵
  PID:4844
- C:\Windows\System\KEJDlKl.exe
  C:\Windows\System\KEJDlKl.exe
  2⤵
  PID:6572
- C:\Windows\System\bhEfUzL.exe
  C:\Windows\System\bhEfUzL.exe
  2⤵
  PID:4404
- C:\Windows\System\WDaKxPz.exe
  C:\Windows\System\WDaKxPz.exe
  2⤵
  PID:820
- C:\Windows\System\aInIfYn.exe
  C:\Windows\System\aInIfYn.exe
  2⤵
  PID:2188
- C:\Windows\System\wXswTXF.exe
  C:\Windows\System\wXswTXF.exe
  2⤵
  PID:4440
- C:\Windows\System\oikaejd.exe
  C:\Windows\System\oikaejd.exe
  2⤵
  PID:2152
- C:\Windows\System\oSnPcTr.exe
  C:\Windows\System\oSnPcTr.exe
  2⤵
  PID:3060
- C:\Windows\System\AnleOhG.exe
  C:\Windows\System\AnleOhG.exe
  2⤵
  PID:904
- C:\Windows\System\SXdSQkZ.exe
  C:\Windows\System\SXdSQkZ.exe
  2⤵
  PID:4864
- C:\Windows\System\gZcabWo.exe
  C:\Windows\System\gZcabWo.exe
  2⤵
  PID:5308
- C:\Windows\System\CXOwUpw.exe
  C:\Windows\System\CXOwUpw.exe
  2⤵
  PID:6960
- C:\Windows\System\gNmIiwd.exe
  C:\Windows\System\gNmIiwd.exe
  2⤵
  PID:6168
- C:\Windows\System\koKXzwW.exe
  C:\Windows\System\koKXzwW.exe
  2⤵
  PID:1692
- C:\Windows\System\DIRKbQB.exe
  C:\Windows\System\DIRKbQB.exe
  2⤵
  PID:1588
- C:\Windows\System\uDyYaUB.exe
  C:\Windows\System\uDyYaUB.exe
  2⤵
  PID:556
- C:\Windows\System\qYAfokR.exe
  C:\Windows\System\qYAfokR.exe
  2⤵
  PID:2364
- C:\Windows\System\btFwZcm.exe
  C:\Windows\System\btFwZcm.exe
  2⤵
  PID:6856
- C:\Windows\System\hYtkvui.exe
  C:\Windows\System\hYtkvui.exe
  2⤵
  PID:1540
- C:\Windows\System\yvUtlnE.exe
  C:\Windows\System\yvUtlnE.exe
  2⤵
  PID:7188
- C:\Windows\System\yXFiHFK.exe
  C:\Windows\System\yXFiHFK.exe
  2⤵
  PID:7208
- C:\Windows\System\DHAOLwX.exe
  C:\Windows\System\DHAOLwX.exe
  2⤵
  PID:7228
- C:\Windows\System\lOLnorY.exe
  C:\Windows\System\lOLnorY.exe
  2⤵
  PID:7252
- C:\Windows\System\EPaibhi.exe
  C:\Windows\System\EPaibhi.exe
  2⤵
  PID:7280
- C:\Windows\System\lRGncAl.exe
  C:\Windows\System\lRGncAl.exe
  2⤵
  PID:7304
- C:\Windows\System\QvSJQgG.exe
  C:\Windows\System\QvSJQgG.exe
  2⤵
  PID:7324
- C:\Windows\System\atjkQQT.exe
  C:\Windows\System\atjkQQT.exe
  2⤵
  PID:7348
- C:\Windows\System\gJeNcSj.exe
  C:\Windows\System\gJeNcSj.exe
  2⤵
  PID:7372
- C:\Windows\System\XMilUyE.exe
  C:\Windows\System\XMilUyE.exe
  2⤵
  PID:7392
- C:\Windows\System\CYHWrxF.exe
  C:\Windows\System\CYHWrxF.exe
  2⤵
  PID:7424
- C:\Windows\System\LFQnGUv.exe
  C:\Windows\System\LFQnGUv.exe
  2⤵
  PID:7448
- C:\Windows\System\IdzZpWp.exe
  C:\Windows\System\IdzZpWp.exe
  2⤵
  PID:7468
- C:\Windows\System\EkFeeUc.exe
  C:\Windows\System\EkFeeUc.exe
  2⤵
  PID:7496
- C:\Windows\System\XZsVHea.exe
  C:\Windows\System\XZsVHea.exe
  2⤵
  PID:7516
- C:\Windows\System\cRNxJlP.exe
  C:\Windows\System\cRNxJlP.exe
  2⤵
  PID:7548
- C:\Windows\System\hOGdzhx.exe
  C:\Windows\System\hOGdzhx.exe
  2⤵
  PID:7568
- C:\Windows\System\imAPBYj.exe
  C:\Windows\System\imAPBYj.exe
  2⤵
  PID:7588
- C:\Windows\System\XnNoHzh.exe
  C:\Windows\System\XnNoHzh.exe
  2⤵
  PID:7616
- C:\Windows\System\XhRIXJP.exe
  C:\Windows\System\XhRIXJP.exe
  2⤵
  PID:7640
- C:\Windows\System\nxrprWX.exe
  C:\Windows\System\nxrprWX.exe
  2⤵
  PID:7660
- C:\Windows\System\HkZTEIP.exe
  C:\Windows\System\HkZTEIP.exe
  2⤵
  PID:7684
- C:\Windows\System\Nqupzgn.exe
  C:\Windows\System\Nqupzgn.exe
  2⤵
  PID:7704
- C:\Windows\System\VoSgrSQ.exe
  C:\Windows\System\VoSgrSQ.exe
  2⤵
  PID:7724
- C:\Windows\System\EZLPHYT.exe
  C:\Windows\System\EZLPHYT.exe
  2⤵
  PID:7740
- C:\Windows\System\QWhRgrG.exe
  C:\Windows\System\QWhRgrG.exe
  2⤵
  PID:7760
- C:\Windows\System\CxtAOFw.exe
  C:\Windows\System\CxtAOFw.exe
  2⤵
  PID:7792
- C:\Windows\System\zExjPYh.exe
  C:\Windows\System\zExjPYh.exe
  2⤵
  PID:7808
- C:\Windows\System\SmUASMY.exe
  C:\Windows\System\SmUASMY.exe
  2⤵
  PID:7832
- C:\Windows\System\CeSaKNM.exe
  C:\Windows\System\CeSaKNM.exe
  2⤵
  PID:7852
- C:\Windows\System\bQeHOGf.exe
  C:\Windows\System\bQeHOGf.exe
  2⤵
  PID:7872
- C:\Windows\System\lrZeTyC.exe
  C:\Windows\System\lrZeTyC.exe
  2⤵
  PID:7892
- C:\Windows\System\jztDJBJ.exe
  C:\Windows\System\jztDJBJ.exe
  2⤵
  PID:7912
- C:\Windows\System\naOrybe.exe
  C:\Windows\System\naOrybe.exe
  2⤵
  PID:7936
- C:\Windows\System\JHoDPBH.exe
  C:\Windows\System\JHoDPBH.exe
  2⤵
  PID:7964
- C:\Windows\System\AxyUZbz.exe
  C:\Windows\System\AxyUZbz.exe
  2⤵
  PID:7988
- C:\Windows\System\Xvpzemj.exe
  C:\Windows\System\Xvpzemj.exe
  2⤵
  PID:8008
- C:\Windows\System\cLbEfHL.exe
  C:\Windows\System\cLbEfHL.exe
  2⤵
  PID:8028
- C:\Windows\System\TCHKXPi.exe
  C:\Windows\System\TCHKXPi.exe
  2⤵
  PID:8052
- C:\Windows\System\ZQacrEf.exe
  C:\Windows\System\ZQacrEf.exe
  2⤵
  PID:8076
- C:\Windows\System\ToigFxO.exe
  C:\Windows\System\ToigFxO.exe
  2⤵
  PID:8096
- C:\Windows\System\CPQpOOi.exe
  C:\Windows\System\CPQpOOi.exe
  2⤵
  PID:8120
- C:\Windows\System\LhuTuCZ.exe
  C:\Windows\System\LhuTuCZ.exe
  2⤵
  PID:8136
- C:\Windows\System\oIzewiq.exe
  C:\Windows\System\oIzewiq.exe
  2⤵
  PID:8160
- C:\Windows\System\hIpvWtt.exe
  C:\Windows\System\hIpvWtt.exe
  2⤵
  PID:8180
- C:\Windows\System\wZiMEoY.exe
  C:\Windows\System\wZiMEoY.exe
  2⤵
  PID:4240
- C:\Windows\System\RRQcHwp.exe
  C:\Windows\System\RRQcHwp.exe
  2⤵
  PID:5896
- C:\Windows\System\uamjXaf.exe
  C:\Windows\System\uamjXaf.exe
  2⤵
  PID:4400
- C:\Windows\System\WrMSwka.exe
  C:\Windows\System\WrMSwka.exe
  2⤵
  PID:5232
- C:\Windows\System\RHLySTy.exe
  C:\Windows\System\RHLySTy.exe
  2⤵
  PID:1000
- C:\Windows\System\DXSegXc.exe
  C:\Windows\System\DXSegXc.exe
  2⤵
  PID:7388
- C:\Windows\System\JjdyLHt.exe
  C:\Windows\System\JjdyLHt.exe
  2⤵
  PID:7236
- C:\Windows\System\iTGGWtm.exe
  C:\Windows\System\iTGGWtm.exe
  2⤵
  PID:7268
- C:\Windows\System\OsQFDoB.exe
  C:\Windows\System\OsQFDoB.exe
  2⤵
  PID:7316
- C:\Windows\System\ycCdoFZ.exe
  C:\Windows\System\ycCdoFZ.exe
  2⤵
  PID:7584
- C:\Windows\System\hjaxndV.exe
  C:\Windows\System\hjaxndV.exe
  2⤵
  PID:7628
- C:\Windows\System\yxLnqfx.exe
  C:\Windows\System\yxLnqfx.exe
  2⤵
  PID:7204
- C:\Windows\System\BfwcTSi.exe
  C:\Windows\System\BfwcTSi.exe
  2⤵
  PID:7292
- C:\Windows\System\KVGJNIQ.exe
  C:\Windows\System\KVGJNIQ.exe
  2⤵
  PID:7356
- C:\Windows\System\BhTPtbA.exe
  C:\Windows\System\BhTPtbA.exe
  2⤵
  PID:7904
- C:\Windows\System\LfuUzcD.exe
  C:\Windows\System\LfuUzcD.exe
  2⤵
  PID:7444
- C:\Windows\System\wXqsVld.exe
  C:\Windows\System\wXqsVld.exe
  2⤵
  PID:7712
- C:\Windows\System\mYNbUES.exe
  C:\Windows\System\mYNbUES.exe
  2⤵
  PID:7504
- C:\Windows\System\EVvWCod.exe
  C:\Windows\System\EVvWCod.exe
  2⤵
  PID:8220
- C:\Windows\System\ppkxzQq.exe
  C:\Windows\System\ppkxzQq.exe
  2⤵
  PID:8244
- C:\Windows\System\BbLLWQp.exe
  C:\Windows\System\BbLLWQp.exe
  2⤵
  PID:8268
- C:\Windows\System\paIZcag.exe
  C:\Windows\System\paIZcag.exe
  2⤵
  PID:8288
- C:\Windows\System\YsyjAja.exe
  C:\Windows\System\YsyjAja.exe
  2⤵
  PID:8312
- C:\Windows\System\ISJIXoS.exe
  C:\Windows\System\ISJIXoS.exe
  2⤵
  PID:8344
- C:\Windows\System\xFycwpu.exe
  C:\Windows\System\xFycwpu.exe
  2⤵
  PID:8364
- C:\Windows\System\cFpfABg.exe
  C:\Windows\System\cFpfABg.exe
  2⤵
  PID:8404
- C:\Windows\System\iurMcgq.exe
  C:\Windows\System\iurMcgq.exe
  2⤵
  PID:8424
- C:\Windows\System\MOuNzub.exe
  C:\Windows\System\MOuNzub.exe
  2⤵
  PID:8444
- C:\Windows\System\AsshyrS.exe
  C:\Windows\System\AsshyrS.exe
  2⤵
  PID:8468
- C:\Windows\System\qjAYDat.exe
  C:\Windows\System\qjAYDat.exe
  2⤵
  PID:8492
- C:\Windows\System\mGDGvlQ.exe
  C:\Windows\System\mGDGvlQ.exe
  2⤵
  PID:8508
- C:\Windows\System\UrQSZbs.exe
  C:\Windows\System\UrQSZbs.exe
  2⤵
  PID:8532
- C:\Windows\System\AghCCkP.exe
  C:\Windows\System\AghCCkP.exe
  2⤵
  PID:8556
- C:\Windows\System\sdxKtkt.exe
  C:\Windows\System\sdxKtkt.exe
  2⤵
  PID:8576
- C:\Windows\System\BcMACnc.exe
  C:\Windows\System\BcMACnc.exe
  2⤵
  PID:8596
- C:\Windows\System\iIvfEZF.exe
  C:\Windows\System\iIvfEZF.exe
  2⤵
  PID:8616
- C:\Windows\System\HwfsCTw.exe
  C:\Windows\System\HwfsCTw.exe
  2⤵
  PID:8632
- C:\Windows\System\yvSbqxz.exe
  C:\Windows\System\yvSbqxz.exe
  2⤵
  PID:8652
- C:\Windows\System\uCggcue.exe
  C:\Windows\System\uCggcue.exe
  2⤵
  PID:8672
- C:\Windows\System\hOZNqHV.exe
  C:\Windows\System\hOZNqHV.exe
  2⤵
  PID:8700
- C:\Windows\System\GzrgzSH.exe
  C:\Windows\System\GzrgzSH.exe
  2⤵
  PID:8720
- C:\Windows\System\GwKRtrf.exe
  C:\Windows\System\GwKRtrf.exe
  2⤵
  PID:8740
- C:\Windows\System\NmJAwaQ.exe
  C:\Windows\System\NmJAwaQ.exe
  2⤵
  PID:8764
- C:\Windows\System\nvViNzG.exe
  C:\Windows\System\nvViNzG.exe
  2⤵
  PID:8784
- C:\Windows\System\xdueGeC.exe
  C:\Windows\System\xdueGeC.exe
  2⤵
  PID:8804
- C:\Windows\System\SpxoLBI.exe
  C:\Windows\System\SpxoLBI.exe
  2⤵
  PID:8828
- C:\Windows\System\yjCqHyd.exe
  C:\Windows\System\yjCqHyd.exe
  2⤵
  PID:8844
- C:\Windows\System\FAhoysf.exe
  C:\Windows\System\FAhoysf.exe
  2⤵
  PID:8868
- C:\Windows\System\HsuEHqP.exe
  C:\Windows\System\HsuEHqP.exe
  2⤵
  PID:8888
- C:\Windows\System\xrSypmx.exe
  C:\Windows\System\xrSypmx.exe
  2⤵
  PID:8912
- C:\Windows\System\avnkpkX.exe
  C:\Windows\System\avnkpkX.exe
  2⤵
  PID:8932
- C:\Windows\System\ICQRGJj.exe
  C:\Windows\System\ICQRGJj.exe
  2⤵
  PID:8956
- C:\Windows\System\ftQLvgW.exe
  C:\Windows\System\ftQLvgW.exe
  2⤵
  PID:8980
- C:\Windows\System\KrasMwY.exe
  C:\Windows\System\KrasMwY.exe
  2⤵
  PID:9004
- C:\Windows\System\WPWzlsv.exe
  C:\Windows\System\WPWzlsv.exe
  2⤵
  PID:9036
- C:\Windows\System\iGHGiOG.exe
  C:\Windows\System\iGHGiOG.exe
  2⤵
  PID:9052
- C:\Windows\System\gVuaoHz.exe
  C:\Windows\System\gVuaoHz.exe
  2⤵
  PID:9076
- C:\Windows\System\LdlTQDJ.exe
  C:\Windows\System\LdlTQDJ.exe
  2⤵
  PID:9096
- C:\Windows\System\NeQBzSi.exe
  C:\Windows\System\NeQBzSi.exe
  2⤵
  PID:9112
- C:\Windows\System\SUDMIBJ.exe
  C:\Windows\System\SUDMIBJ.exe
  2⤵
  PID:9136
- C:\Windows\System\jPFKJFb.exe
  C:\Windows\System\jPFKJFb.exe
  2⤵
  PID:9156
- C:\Windows\System\OnHshOS.exe
  C:\Windows\System\OnHshOS.exe
  2⤵
  PID:9176
- C:\Windows\System\IzKryaT.exe
  C:\Windows\System\IzKryaT.exe
  2⤵
  PID:9200
- C:\Windows\System\qkCvcCq.exe
  C:\Windows\System\qkCvcCq.exe
  2⤵
  PID:8092
- C:\Windows\System\rcPNwcR.exe
  C:\Windows\System\rcPNwcR.exe
  2⤵
  PID:7804
- C:\Windows\System\ZpTOFPi.exe
  C:\Windows\System\ZpTOFPi.exe
  2⤵
  PID:7556
- C:\Windows\System\ZsZdbVN.exe
  C:\Windows\System\ZsZdbVN.exe
  2⤵
  PID:7828
- C:\Windows\System\AKwCaSy.exe
  C:\Windows\System\AKwCaSy.exe
  2⤵
  PID:7884
- C:\Windows\System\TwivGtQ.exe
  C:\Windows\System\TwivGtQ.exe
  2⤵
  PID:7700
- C:\Windows\System\JcpKEim.exe
  C:\Windows\System\JcpKEim.exe
  2⤵
  PID:7652
- C:\Windows\System\fwhOARm.exe
  C:\Windows\System\fwhOARm.exe
  2⤵
  PID:7800
- C:\Windows\System\EeWnGHs.exe
  C:\Windows\System\EeWnGHs.exe
  2⤵
  PID:7840
- C:\Windows\System\KICwgJV.exe
  C:\Windows\System\KICwgJV.exe
  2⤵
  PID:7864
- C:\Windows\System\PAFznrt.exe
  C:\Windows\System\PAFznrt.exe
  2⤵
  PID:8372
- C:\Windows\System\VxsSFDE.exe
  C:\Windows\System\VxsSFDE.exe
  2⤵
  PID:7996
- C:\Windows\System\zqyugSa.exe
  C:\Windows\System\zqyugSa.exe
  2⤵
  PID:8024
- C:\Windows\System\NXTnxim.exe
  C:\Windows\System\NXTnxim.exe
  2⤵
  PID:8064
- C:\Windows\System\BrqhEXt.exe
  C:\Windows\System\BrqhEXt.exe
  2⤵
  PID:8152
- C:\Windows\System\JZIIEMA.exe
  C:\Windows\System\JZIIEMA.exe
  2⤵
  PID:3000
- C:\Windows\System\kTrjKoA.exe
  C:\Windows\System\kTrjKoA.exe
  2⤵
  PID:8328
- C:\Windows\System\nAmuWKi.exe
  C:\Windows\System\nAmuWKi.exe
  2⤵
  PID:8796
- C:\Windows\System\LPndPwH.exe
  C:\Windows\System\LPndPwH.exe
  2⤵
  PID:7196
- C:\Windows\System\XTlmfBr.exe
  C:\Windows\System\XTlmfBr.exe
  2⤵
  PID:7580
- C:\Windows\System\mSPaNrB.exe
  C:\Windows\System\mSPaNrB.exe
  2⤵
  PID:7608
- C:\Windows\System\LYayjtL.exe
  C:\Windows\System\LYayjtL.exe
  2⤵
  PID:7768
- C:\Windows\System\uHFjHDw.exe
  C:\Windows\System\uHFjHDw.exe
  2⤵
  PID:8480
- C:\Windows\System\VijSoLl.exe
  C:\Windows\System\VijSoLl.exe
  2⤵
  PID:8068
- C:\Windows\System\TFtFsJM.exe
  C:\Windows\System\TFtFsJM.exe
  2⤵
  PID:9232
- C:\Windows\System\CZAIHQj.exe
  C:\Windows\System\CZAIHQj.exe
  2⤵
  PID:9252
- C:\Windows\System\dbLBTIA.exe
  C:\Windows\System\dbLBTIA.exe
  2⤵
  PID:9276
- C:\Windows\System\ZIzbZoc.exe
  C:\Windows\System\ZIzbZoc.exe
  2⤵
  PID:9300
- C:\Windows\System\SaFdiud.exe
  C:\Windows\System\SaFdiud.exe
  2⤵
  PID:9320
- C:\Windows\System\VJHjmEa.exe
  C:\Windows\System\VJHjmEa.exe
  2⤵
  PID:9348
- C:\Windows\System\GYecwKQ.exe
  C:\Windows\System\GYecwKQ.exe
  2⤵
  PID:9372
- C:\Windows\System\LiEVHEh.exe
  C:\Windows\System\LiEVHEh.exe
  2⤵
  PID:9392
- C:\Windows\System\PeOBDXP.exe
  C:\Windows\System\PeOBDXP.exe
  2⤵
  PID:9412
- C:\Windows\System\pCvzShW.exe
  C:\Windows\System\pCvzShW.exe
  2⤵
  PID:9440
- C:\Windows\System\bFZkTsw.exe
  C:\Windows\System\bFZkTsw.exe
  2⤵
  PID:9464
- C:\Windows\System\iBLZRpH.exe
  C:\Windows\System\iBLZRpH.exe
  2⤵
  PID:9484
- C:\Windows\System\IJilbSl.exe
  C:\Windows\System\IJilbSl.exe
  2⤵
  PID:9500
- C:\Windows\System\bnnHhZL.exe
  C:\Windows\System\bnnHhZL.exe
  2⤵
  PID:9528
- C:\Windows\System\cBnHaBI.exe
  C:\Windows\System\cBnHaBI.exe
  2⤵
  PID:9548
- C:\Windows\System\DXRMgkh.exe
  C:\Windows\System\DXRMgkh.exe
  2⤵
  PID:9568
- C:\Windows\System\LRPDumS.exe
  C:\Windows\System\LRPDumS.exe
  2⤵
  PID:9592
- C:\Windows\System\iwYROlj.exe
  C:\Windows\System\iwYROlj.exe
  2⤵
  PID:9612
- C:\Windows\System\hOQiWcv.exe
  C:\Windows\System\hOQiWcv.exe
  2⤵
  PID:9632
- C:\Windows\System\ORyrreH.exe
  C:\Windows\System\ORyrreH.exe
  2⤵
  PID:9656
- C:\Windows\System\nDKVfym.exe
  C:\Windows\System\nDKVfym.exe
  2⤵
  PID:9676
- C:\Windows\System\oxHuttZ.exe
  C:\Windows\System\oxHuttZ.exe
  2⤵
  PID:9692
- C:\Windows\System\aVJvpPq.exe
  C:\Windows\System\aVJvpPq.exe
  2⤵
  PID:9712
- C:\Windows\System\nkPxjpN.exe
  C:\Windows\System\nkPxjpN.exe
  2⤵
  PID:9736
- C:\Windows\System\cIyZsTB.exe
  C:\Windows\System\cIyZsTB.exe
  2⤵
  PID:9756
- C:\Windows\System\pdQVDor.exe
  C:\Windows\System\pdQVDor.exe
  2⤵
  PID:9784
- C:\Windows\System\YlORobc.exe
  C:\Windows\System\YlORobc.exe
  2⤵
  PID:9832
- C:\Windows\System\TLKXMhW.exe
  C:\Windows\System\TLKXMhW.exe
  2⤵
  PID:9848
- C:\Windows\System\pBSvhCL.exe
  C:\Windows\System\pBSvhCL.exe
  2⤵
  PID:9868
- C:\Windows\System\XULBXtN.exe
  C:\Windows\System\XULBXtN.exe
  2⤵
  PID:9892
- C:\Windows\System\sAGuUOL.exe
  C:\Windows\System\sAGuUOL.exe
  2⤵
  PID:9912
- C:\Windows\System\CcJbIxU.exe
  C:\Windows\System\CcJbIxU.exe
  2⤵
  PID:9932
- C:\Windows\System\pqtQspk.exe
  C:\Windows\System\pqtQspk.exe
  2⤵
  PID:9956
- C:\Windows\System\OyQZwFp.exe
  C:\Windows\System\OyQZwFp.exe
  2⤵
  PID:9980
- C:\Windows\System\htXzNMY.exe
  C:\Windows\System\htXzNMY.exe
  2⤵
  PID:9996
- C:\Windows\System\QsXVxHD.exe
  C:\Windows\System\QsXVxHD.exe
  2⤵
  PID:10024
- C:\Windows\System\CIQYyaN.exe
  C:\Windows\System\CIQYyaN.exe
  2⤵
  PID:10048
- C:\Windows\System\QpDNJzL.exe
  C:\Windows\System\QpDNJzL.exe
  2⤵
  PID:10068
- C:\Windows\System\cOJolZO.exe
  C:\Windows\System\cOJolZO.exe
  2⤵
  PID:10092
- C:\Windows\System\mBaYYjM.exe
  C:\Windows\System\mBaYYjM.exe
  2⤵
  PID:10116
- C:\Windows\System\jKktlpS.exe
  C:\Windows\System\jKktlpS.exe
  2⤵
  PID:10136
- C:\Windows\System\TSOhohr.exe
  C:\Windows\System\TSOhohr.exe
  2⤵
  PID:10156
- C:\Windows\System\PITIvkj.exe
  C:\Windows\System\PITIvkj.exe
  2⤵
  PID:10180
- C:\Windows\System\wnVMlGW.exe
  C:\Windows\System\wnVMlGW.exe
  2⤵
  PID:10200
- C:\Windows\System\jZfPQVy.exe
  C:\Windows\System\jZfPQVy.exe
  2⤵
  PID:10228
- C:\Windows\System\VmPRgfV.exe
  C:\Windows\System\VmPRgfV.exe
  2⤵
  PID:9196
- C:\Windows\System\PeZsowa.exe
  C:\Windows\System\PeZsowa.exe
  2⤵
  PID:8644
- C:\Windows\System\DTTaMQj.exe
  C:\Windows\System\DTTaMQj.exe
  2⤵
  PID:8668
- C:\Windows\System\OdHyHzc.exe
  C:\Windows\System\OdHyHzc.exe
  2⤵
  PID:8728
- C:\Windows\System\XDeDdXq.exe
  C:\Windows\System\XDeDdXq.exe
  2⤵
  PID:8880
- C:\Windows\System\ufnNySd.exe
  C:\Windows\System\ufnNySd.exe
  2⤵
  PID:8952
- C:\Windows\System\FxbStMm.exe
  C:\Windows\System\FxbStMm.exe
  2⤵
  PID:9072
- C:\Windows\System\augxFPQ.exe
  C:\Windows\System\augxFPQ.exe
  2⤵
  PID:9088
- C:\Windows\System\EfHzlaw.exe
  C:\Windows\System\EfHzlaw.exe
  2⤵
  PID:9244
- C:\Windows\System\uXfTNJF.exe
  C:\Windows\System\uXfTNJF.exe
  2⤵
  PID:9184
- C:\Windows\System\OMXBCVV.exe
  C:\Windows\System\OMXBCVV.exe
  2⤵
  PID:9336
- C:\Windows\System\BJIXraj.exe
  C:\Windows\System\BJIXraj.exe
  2⤵
  PID:7888
- C:\Windows\System\ANhHmpE.exe
  C:\Windows\System\ANhHmpE.exe
  2⤵
  PID:8680
- C:\Windows\System\lxvAdyd.exe
  C:\Windows\System\lxvAdyd.exe
  2⤵
  PID:7720
- C:\Windows\System\mXkplSM.exe
  C:\Windows\System\mXkplSM.exe
  2⤵
  PID:8776
- C:\Windows\System\VrJinyt.exe
  C:\Windows\System\VrJinyt.exe
  2⤵
  PID:8816
- C:\Windows\System\JixnFhf.exe
  C:\Windows\System\JixnFhf.exe
  2⤵
  PID:8924
- C:\Windows\System\ncDuPzz.exe
  C:\Windows\System\ncDuPzz.exe
  2⤵
  PID:9708
- C:\Windows\System\TevxfRJ.exe
  C:\Windows\System\TevxfRJ.exe
  2⤵
  PID:7900
- C:\Windows\System\tmenGCh.exe
  C:\Windows\System\tmenGCh.exe
  2⤵
  PID:8216
- C:\Windows\System\JMVhZoB.exe
  C:\Windows\System\JMVhZoB.exe
  2⤵
  PID:9800
- C:\Windows\System\zDMASHv.exe
  C:\Windows\System\zDMASHv.exe
  2⤵
  PID:8732
- C:\Windows\System\kWkAAvg.exe
  C:\Windows\System\kWkAAvg.exe
  2⤵
  PID:10244
- C:\Windows\System\NtjZAgD.exe
  C:\Windows\System\NtjZAgD.exe
  2⤵
  PID:10264
- C:\Windows\System\tjnXPzl.exe
  C:\Windows\System\tjnXPzl.exe
  2⤵
  PID:10284
- C:\Windows\System\qpQTzdJ.exe
  C:\Windows\System\qpQTzdJ.exe
  2⤵
  PID:10304
- C:\Windows\System\eNwErMH.exe
  C:\Windows\System\eNwErMH.exe
  2⤵
  PID:10328
- C:\Windows\System\uStWKWA.exe
  C:\Windows\System\uStWKWA.exe
  2⤵
  PID:10348
- C:\Windows\System\xEEQlme.exe
  C:\Windows\System\xEEQlme.exe
  2⤵
  PID:10368
- C:\Windows\System\kUTNYFP.exe
  C:\Windows\System\kUTNYFP.exe
  2⤵
  PID:10388
- C:\Windows\System\fnUkuPh.exe
  C:\Windows\System\fnUkuPh.exe
  2⤵
  PID:10408
- C:\Windows\System\UVJXXQG.exe
  C:\Windows\System\UVJXXQG.exe
  2⤵
  PID:10428
- C:\Windows\System\jjwRaft.exe
  C:\Windows\System\jjwRaft.exe
  2⤵
  PID:10452
- C:\Windows\System\CMRWTpv.exe
  C:\Windows\System\CMRWTpv.exe
  2⤵
  PID:10480
- C:\Windows\System\yuEJUAZ.exe
  C:\Windows\System\yuEJUAZ.exe
  2⤵
  PID:10504
- C:\Windows\System\BNCbQkK.exe
  C:\Windows\System\BNCbQkK.exe
  2⤵
  PID:10532
- C:\Windows\System\tRYmsxY.exe
  C:\Windows\System\tRYmsxY.exe
  2⤵
  PID:10564
- C:\Windows\System\BWuePag.exe
  C:\Windows\System\BWuePag.exe
  2⤵
  PID:10584
- C:\Windows\System\JVvDrhg.exe
  C:\Windows\System\JVvDrhg.exe
  2⤵
  PID:10600
- C:\Windows\System\YLBEUPS.exe
  C:\Windows\System\YLBEUPS.exe
  2⤵
  PID:10624
- C:\Windows\System\YelzVSC.exe
  C:\Windows\System\YelzVSC.exe
  2⤵
  PID:10648
- C:\Windows\System\aHKsgRP.exe
  C:\Windows\System\aHKsgRP.exe
  2⤵
  PID:10668
- C:\Windows\System\JZBArdq.exe
  C:\Windows\System\JZBArdq.exe
  2⤵
  PID:10684
- C:\Windows\System\vIbZoNC.exe
  C:\Windows\System\vIbZoNC.exe
  2⤵
  PID:10712
- C:\Windows\System\ABoPnPv.exe
  C:\Windows\System\ABoPnPv.exe
  2⤵
  PID:10736
- C:\Windows\System\BTgziJo.exe
  C:\Windows\System\BTgziJo.exe
  2⤵
  PID:10756
- C:\Windows\System\cpVIJQU.exe
  C:\Windows\System\cpVIJQU.exe
  2⤵
  PID:10784
- C:\Windows\System\hDfOZQv.exe
  C:\Windows\System\hDfOZQv.exe
  2⤵
  PID:10812
- C:\Windows\System\PtnBwVm.exe
  C:\Windows\System\PtnBwVm.exe
  2⤵
  PID:10836
- C:\Windows\System\gTqfpMJ.exe
  C:\Windows\System\gTqfpMJ.exe
  2⤵
  PID:10856
- C:\Windows\System\jAGSDIO.exe
  C:\Windows\System\jAGSDIO.exe
  2⤵
  PID:10876
- C:\Windows\System\fkILrzE.exe
  C:\Windows\System\fkILrzE.exe
  2⤵
  PID:10900
- C:\Windows\System\ensUVrj.exe
  C:\Windows\System\ensUVrj.exe
  2⤵
  PID:10924
- C:\Windows\System\MjrQKON.exe
  C:\Windows\System\MjrQKON.exe
  2⤵
  PID:10944
- C:\Windows\System\WvmTFsX.exe
  C:\Windows\System\WvmTFsX.exe
  2⤵
  PID:10964
- C:\Windows\System\YWiAoEd.exe
  C:\Windows\System\YWiAoEd.exe
  2⤵
  PID:10984
- C:\Windows\System\IDxyAwR.exe
  C:\Windows\System\IDxyAwR.exe
  2⤵
  PID:11008
- C:\Windows\System\peTxjcV.exe
  C:\Windows\System\peTxjcV.exe
  2⤵
  PID:11028
- C:\Windows\System\SxuhCqi.exe
  C:\Windows\System\SxuhCqi.exe
  2⤵
  PID:11044
- C:\Windows\System\EUPRLwk.exe
  C:\Windows\System\EUPRLwk.exe
  2⤵
  PID:11068
- C:\Windows\System\RDESjEt.exe
  C:\Windows\System\RDESjEt.exe
  2⤵
  PID:11096
- C:\Windows\System\WjzJgJl.exe
  C:\Windows\System\WjzJgJl.exe
  2⤵
  PID:11116
- C:\Windows\System\uzKGhTF.exe
  C:\Windows\System\uzKGhTF.exe
  2⤵
  PID:11132
- C:\Windows\System\oTEXlKr.exe
  C:\Windows\System\oTEXlKr.exe
  2⤵
  PID:11148
- C:\Windows\System\TMIKsAU.exe
  C:\Windows\System\TMIKsAU.exe
  2⤵
  PID:11164
- C:\Windows\System\VmpkPdg.exe
  C:\Windows\System\VmpkPdg.exe
  2⤵
  PID:11180
- C:\Windows\System\RaUvcgZ.exe
  C:\Windows\System\RaUvcgZ.exe
  2⤵
  PID:11204
- C:\Windows\System\jxIfObz.exe
  C:\Windows\System\jxIfObz.exe
  2⤵
  PID:11224
- C:\Windows\System\SZNqFln.exe
  C:\Windows\System\SZNqFln.exe
  2⤵
  PID:11248
- C:\Windows\System\jYUgRTz.exe
  C:\Windows\System\jYUgRTz.exe
  2⤵
  PID:9108
- C:\Windows\System\xZSHKEm.exe
  C:\Windows\System\xZSHKEm.exe
  2⤵
  PID:9248
- C:\Windows\System\SagUekO.exe
  C:\Windows\System\SagUekO.exe
  2⤵
  PID:9272
- C:\Windows\System\HFDmGpo.exe
  C:\Windows\System\HFDmGpo.exe
  2⤵
  PID:10064
- C:\Windows\System\YnEXbDb.exe
  C:\Windows\System\YnEXbDb.exe
  2⤵
  PID:10088
- C:\Windows\System\dTlqjUq.exe
  C:\Windows\System\dTlqjUq.exe
  2⤵
  PID:9384
- C:\Windows\System\WweqNLt.exe
  C:\Windows\System\WweqNLt.exe
  2⤵
  PID:9480
- C:\Windows\System\GNTFiYr.exe
  C:\Windows\System\GNTFiYr.exe
  2⤵
  PID:9544
- C:\Windows\System\hODDTNT.exe
  C:\Windows\System\hODDTNT.exe
  2⤵
  PID:7976
- C:\Windows\System\kLkJxxX.exe
  C:\Windows\System\kLkJxxX.exe
  2⤵
  PID:8588
- C:\Windows\System\BSdWYbt.exe
  C:\Windows\System\BSdWYbt.exe
  2⤵
  PID:9640
- C:\Windows\System\ihZWFxC.exe
  C:\Windows\System\ihZWFxC.exe
  2⤵
  PID:9688
- C:\Windows\System\EfZgJaR.exe
  C:\Windows\System\EfZgJaR.exe
  2⤵
  PID:8792
- C:\Windows\System\TaGZSIp.exe
  C:\Windows\System\TaGZSIp.exe
  2⤵
  PID:9044
- C:\Windows\System\vMXorxp.exe
  C:\Windows\System\vMXorxp.exe
  2⤵
  PID:10296
- C:\Windows\System\hSBXvlz.exe
  C:\Windows\System\hSBXvlz.exe
  2⤵
  PID:8464
- C:\Windows\System\jTnyJcw.exe
  C:\Windows\System\jTnyJcw.exe
  2⤵
  PID:11268
- C:\Windows\System\jKVbQJn.exe
  C:\Windows\System\jKVbQJn.exe
  2⤵
  PID:11284
- C:\Windows\System\FzfhiuJ.exe
  C:\Windows\System\FzfhiuJ.exe
  2⤵
  PID:11304
- C:\Windows\System\hqkpqqu.exe
  C:\Windows\System\hqkpqqu.exe
  2⤵
  PID:11336
- C:\Windows\System\VwKjYvd.exe
  C:\Windows\System\VwKjYvd.exe
  2⤵
  PID:11356
- C:\Windows\System\uErgClK.exe
  C:\Windows\System\uErgClK.exe
  2⤵
  PID:11380
- C:\Windows\System\kzINrME.exe
  C:\Windows\System\kzINrME.exe
  2⤵
  PID:11404
- C:\Windows\System\iYfNolf.exe
  C:\Windows\System\iYfNolf.exe
  2⤵
  PID:11440
- C:\Windows\System\SFMvZvQ.exe
  C:\Windows\System\SFMvZvQ.exe
  2⤵
  PID:11460
- C:\Windows\System\DNgRwvK.exe
  C:\Windows\System\DNgRwvK.exe
  2⤵
  PID:11484
- C:\Windows\System\WtViubH.exe
  C:\Windows\System\WtViubH.exe
  2⤵
  PID:11504
- C:\Windows\System\OZpZIXV.exe
  C:\Windows\System\OZpZIXV.exe
  2⤵
  PID:11528
- C:\Windows\System\YkjUvYJ.exe
  C:\Windows\System\YkjUvYJ.exe
  2⤵
  PID:11552
- C:\Windows\System\TMvNUoh.exe
  C:\Windows\System\TMvNUoh.exe
  2⤵
  PID:11576
- C:\Windows\System\OqRmcRs.exe
  C:\Windows\System\OqRmcRs.exe
  2⤵
  PID:11604
- C:\Windows\System\dpWDWzJ.exe
  C:\Windows\System\dpWDWzJ.exe
  2⤵
  PID:11628
- C:\Windows\System\OGqXMZy.exe
  C:\Windows\System\OGqXMZy.exe
  2⤵
  PID:11652
- C:\Windows\System\tGkSZns.exe
  C:\Windows\System\tGkSZns.exe
  2⤵
  PID:11676
- C:\Windows\System\LSTLhda.exe
  C:\Windows\System\LSTLhda.exe
  2⤵
  PID:11696
- C:\Windows\System\fosLADu.exe
  C:\Windows\System\fosLADu.exe
  2⤵
  PID:11716
- C:\Windows\System\lmcHRiq.exe
  C:\Windows\System\lmcHRiq.exe
  2⤵
  PID:11748
- C:\Windows\System\thbDGeM.exe
  C:\Windows\System\thbDGeM.exe
  2⤵
  PID:11764
- C:\Windows\System\GdWHdqN.exe
  C:\Windows\System\GdWHdqN.exe
  2⤵
  PID:11784
- C:\Windows\System\eRrZXEg.exe
  C:\Windows\System\eRrZXEg.exe
  2⤵
  PID:11800
- C:\Windows\System\YEUaQYJ.exe
  C:\Windows\System\YEUaQYJ.exe
  2⤵
  PID:11816
- C:\Windows\System\oRREwIs.exe
  C:\Windows\System\oRREwIs.exe
  2⤵
  PID:11840
- C:\Windows\System\ygCMQHj.exe
  C:\Windows\System\ygCMQHj.exe
  2⤵
  PID:11860
- C:\Windows\System\yusrfsK.exe
  C:\Windows\System\yusrfsK.exe
  2⤵
  PID:11888
- C:\Windows\System\xCOxrla.exe
  C:\Windows\System\xCOxrla.exe
  2⤵
  PID:11916
- C:\Windows\System\ifmWCLN.exe
  C:\Windows\System\ifmWCLN.exe
  2⤵
  PID:11936
- C:\Windows\System\NmoBkoX.exe
  C:\Windows\System\NmoBkoX.exe
  2⤵
  PID:11964
- C:\Windows\System\ruHQtbl.exe
  C:\Windows\System\ruHQtbl.exe
  2⤵
  PID:11992
- C:\Windows\System\NIdMOZd.exe
  C:\Windows\System\NIdMOZd.exe
  2⤵
  PID:12008
- C:\Windows\System\JMaPiUV.exe
  C:\Windows\System\JMaPiUV.exe
  2⤵
  PID:12028
- C:\Windows\System\UcMMmLm.exe
  C:\Windows\System\UcMMmLm.exe
  2⤵
  PID:12044
- C:\Windows\System\QLQtbFN.exe
  C:\Windows\System\QLQtbFN.exe
  2⤵
  PID:12060
- C:\Windows\System\aruFemi.exe
  C:\Windows\System\aruFemi.exe
  2⤵
  PID:12076
- C:\Windows\System\XdAzXpN.exe
  C:\Windows\System\XdAzXpN.exe
  2⤵
  PID:12100
- C:\Windows\System\EEqHuaN.exe
  C:\Windows\System\EEqHuaN.exe
  2⤵
  PID:12116
- C:\Windows\System\xvlLJXc.exe
  C:\Windows\System\xvlLJXc.exe
  2⤵
  PID:12140
- C:\Windows\System\bYxDEgj.exe
  C:\Windows\System\bYxDEgj.exe
  2⤵
  PID:12164
- C:\Windows\System\QJzCWXP.exe
  C:\Windows\System\QJzCWXP.exe
  2⤵
  PID:12192
- C:\Windows\System\uQsMyLF.exe
  C:\Windows\System\uQsMyLF.exe
  2⤵
  PID:12212
- C:\Windows\System\kQVRJYe.exe
  C:\Windows\System\kQVRJYe.exe
  2⤵
  PID:12244
- C:\Windows\System\SelOThy.exe
  C:\Windows\System\SelOThy.exe
  2⤵
  PID:12268
- C:\Windows\System\IkEMQBQ.exe
  C:\Windows\System\IkEMQBQ.exe
  2⤵
  PID:10448
- C:\Windows\System\QnWHyGB.exe
  C:\Windows\System\QnWHyGB.exe
  2⤵
  PID:9340
- C:\Windows\System\PHeZNdg.exe
  C:\Windows\System\PHeZNdg.exe
  2⤵
  PID:10084
- C:\Windows\System\CKjXTol.exe
  C:\Windows\System\CKjXTol.exe
  2⤵
  PID:10632
- C:\Windows\System\UnCLQwx.exe
  C:\Windows\System\UnCLQwx.exe
  2⤵
  PID:10768
- C:\Windows\System\kArjHGt.exe
  C:\Windows\System\kArjHGt.exe
  2⤵
  PID:9472
- C:\Windows\System\uMozSvQ.exe
  C:\Windows\System\uMozSvQ.exe
  2⤵
  PID:8396
- C:\Windows\System\ZweZrvI.exe
  C:\Windows\System\ZweZrvI.exe
  2⤵
  PID:9316
- C:\Windows\System\WUiQsUE.exe
  C:\Windows\System\WUiQsUE.exe
  2⤵
  PID:11020
- C:\Windows\System\KMFPpcS.exe
  C:\Windows\System\KMFPpcS.exe
  2⤵
  PID:11076
- C:\Windows\System\LAQzyZC.exe
  C:\Windows\System\LAQzyZC.exe
  2⤵
  PID:8692
- C:\Windows\System\yjQOoNW.exe
  C:\Windows\System\yjQOoNW.exe
  2⤵
  PID:5324
- C:\Windows\System\GZcwvcA.exe
  C:\Windows\System\GZcwvcA.exe
  2⤵
  PID:11220
- C:\Windows\System\fBLrNZq.exe
  C:\Windows\System\fBLrNZq.exe
  2⤵
  PID:9600
- C:\Windows\System\XtawmcT.exe
  C:\Windows\System\XtawmcT.exe
  2⤵
  PID:11260
- C:\Windows\System\ofEHooF.exe
  C:\Windows\System\ofEHooF.exe
  2⤵
  PID:8996
- C:\Windows\System\BsPxIFW.exe
  C:\Windows\System\BsPxIFW.exe
  2⤵
  PID:10276
- C:\Windows\System\NGdzUwv.exe
  C:\Windows\System\NGdzUwv.exe
  2⤵
  PID:10300
- C:\Windows\System\HTbAFzi.exe
  C:\Windows\System\HTbAFzi.exe
  2⤵
  PID:10336
- C:\Windows\System\lOxVPON.exe
  C:\Windows\System\lOxVPON.exe
  2⤵
  PID:4136
- C:\Windows\System\tEPcSfZ.exe
  C:\Windows\System\tEPcSfZ.exe
  2⤵
  PID:9976
- C:\Windows\System\AcGScyk.exe
  C:\Windows\System\AcGScyk.exe
  2⤵
  PID:12308
- C:\Windows\System\hqlqfou.exe
  C:\Windows\System\hqlqfou.exe
  2⤵
  PID:12332
- C:\Windows\System\ogmqWsE.exe
  C:\Windows\System\ogmqWsE.exe
  2⤵
  PID:12352
- C:\Windows\System\sRcXtPF.exe
  C:\Windows\System\sRcXtPF.exe
  2⤵
  PID:12376
- C:\Windows\System\SJLjVxC.exe
  C:\Windows\System\SJLjVxC.exe
  2⤵
  PID:12392
- C:\Windows\System\gEiaGCg.exe
  C:\Windows\System\gEiaGCg.exe
  2⤵
  PID:12420
- C:\Windows\System\WijhpOM.exe
  C:\Windows\System\WijhpOM.exe
  2⤵
  PID:12440
- C:\Windows\System\rVCsdaF.exe
  C:\Windows\System\rVCsdaF.exe
  2⤵
  PID:12460
- C:\Windows\System\FPEctnB.exe
  C:\Windows\System\FPEctnB.exe
  2⤵
  PID:12484
- C:\Windows\System\BLjqYWc.exe
  C:\Windows\System\BLjqYWc.exe
  2⤵
  PID:12508
- C:\Windows\System\ZZTLfSO.exe
  C:\Windows\System\ZZTLfSO.exe
  2⤵
  PID:12532
- C:\Windows\System\ZeIiTNu.exe
  C:\Windows\System\ZeIiTNu.exe
  2⤵
  PID:12552
- C:\Windows\System\nslilql.exe
  C:\Windows\System\nslilql.exe
  2⤵
  PID:12592
- C:\Windows\System\asGQgpw.exe
  C:\Windows\System\asGQgpw.exe
  2⤵
  PID:12608
- C:\Windows\System\ScEssls.exe
  C:\Windows\System\ScEssls.exe
  2⤵
  PID:12632
- C:\Windows\System\cgbaAAe.exe
  C:\Windows\System\cgbaAAe.exe
  2⤵
  PID:12656
- C:\Windows\System\IMfvJog.exe
  C:\Windows\System\IMfvJog.exe
  2⤵
  PID:12680
- C:\Windows\System\qArxseJ.exe
  C:\Windows\System\qArxseJ.exe
  2⤵
  PID:12700
- C:\Windows\System\AmbAAmZ.exe
  C:\Windows\System\AmbAAmZ.exe
  2⤵
  PID:12720
- C:\Windows\System\OYDfNZa.exe
  C:\Windows\System\OYDfNZa.exe
  2⤵
  PID:12756
- C:\Windows\System\IEAvPaD.exe
  C:\Windows\System\IEAvPaD.exe
  2⤵
  PID:12780
- C:\Windows\System\RbBDWJB.exe
  C:\Windows\System\RbBDWJB.exe
  2⤵
  PID:12800
- C:\Windows\System\MzvdRdq.exe
  C:\Windows\System\MzvdRdq.exe
  2⤵
  PID:12820
- C:\Windows\System\MJKSBir.exe
  C:\Windows\System\MJKSBir.exe
  2⤵
  PID:12844
- C:\Windows\System\tUErXgI.exe
  C:\Windows\System\tUErXgI.exe
  2⤵
  PID:12872
- C:\Windows\System\lBpsLzJ.exe
  C:\Windows\System\lBpsLzJ.exe
  2⤵
  PID:12892
- C:\Windows\System\tKYiQYx.exe
  C:\Windows\System\tKYiQYx.exe
  2⤵
  PID:12920
- C:\Windows\System\OqlagAo.exe
  C:\Windows\System\OqlagAo.exe
  2⤵
  PID:12952
- C:\Windows\System\HhQNPlV.exe
  C:\Windows\System\HhQNPlV.exe
  2⤵
  PID:12976
- C:\Windows\System\yJEbQvk.exe
  C:\Windows\System\yJEbQvk.exe
  2⤵
  PID:12996
- C:\Windows\System\ksKxHez.exe
  C:\Windows\System\ksKxHez.exe
  2⤵
  PID:13016
- C:\Windows\System\vWitxyu.exe
  C:\Windows\System\vWitxyu.exe
  2⤵
  PID:13040
- C:\Windows\System\lVUNkPg.exe
  C:\Windows\System\lVUNkPg.exe
  2⤵
  PID:13056
- C:\Windows\System\kHPDJEZ.exe
  C:\Windows\System\kHPDJEZ.exe
  2⤵
  PID:13084
- C:\Windows\System\fRZOcre.exe
  C:\Windows\System\fRZOcre.exe
  2⤵
  PID:13108
- C:\Windows\System\ykFYMat.exe
  C:\Windows\System\ykFYMat.exe
  2⤵
  PID:13124
- C:\Windows\System\ItecjHV.exe
  C:\Windows\System\ItecjHV.exe
  2⤵
  PID:13148
- C:\Windows\System\WtgAxbm.exe
  C:\Windows\System\WtgAxbm.exe
  2⤵
  PID:12468
- C:\Windows\System\KZTBmJk.exe
  C:\Windows\System\KZTBmJk.exe
  2⤵
  PID:10596
- C:\Windows\System\OgtFCuC.exe
  C:\Windows\System\OgtFCuC.exe
  2⤵
  PID:12600
- C:\Windows\System\Eudyowy.exe
  C:\Windows\System\Eudyowy.exe
  2⤵
  PID:13096
- C:\Windows\System\uHglwbi.exe
  C:\Windows\System\uHglwbi.exe
  2⤵
  PID:13144
- C:\Windows\System\BtjJtVC.exe
  C:\Windows\System\BtjJtVC.exe
  2⤵
  PID:13168
- C:\Windows\System\XbUhnDi.exe
  C:\Windows\System\XbUhnDi.exe
  2⤵
  PID:13200
- C:\Windows\System\bkdRqgE.exe
  C:\Windows\System\bkdRqgE.exe
  2⤵
  PID:13228
- C:\Windows\System\VARmPLz.exe
  C:\Windows\System\VARmPLz.exe
  2⤵
  PID:12148
- C:\Windows\System\haZAmOt.exe
  C:\Windows\System\haZAmOt.exe
  2⤵
  PID:13280
- C:\Windows\System\UUiJQxC.exe
  C:\Windows\System\UUiJQxC.exe
  2⤵
  PID:11364
- C:\Windows\System\geVVVNj.exe
  C:\Windows\System\geVVVNj.exe
  2⤵
  PID:10188
- C:\Windows\System\QDoBjbv.exe
  C:\Windows\System\QDoBjbv.exe
  2⤵
  PID:11520
- C:\Windows\System\qmmpZDr.exe
  C:\Windows\System\qmmpZDr.exe
  2⤵
  PID:11560
- C:\Windows\System\MoznkmS.exe
  C:\Windows\System\MoznkmS.exe
  2⤵
  PID:11704
- C:\Windows\System\CaBEkhu.exe
  C:\Windows\System\CaBEkhu.exe
  2⤵
  PID:13248
- C:\Windows\System\XbLWaqG.exe
  C:\Windows\System\XbLWaqG.exe
  2⤵
  PID:10172
- C:\Windows\System\fjYRJvR.exe
  C:\Windows\System\fjYRJvR.exe
  2⤵
  PID:9452
- C:\Windows\System\LhGruOu.exe
  C:\Windows\System\LhGruOu.exe
  2⤵
  PID:10580
- C:\Windows\System\QFIYnAt.exe
  C:\Windows\System\QFIYnAt.exe
  2⤵
  PID:11036
- C:\Windows\System\IpWoKCt.exe
  C:\Windows\System\IpWoKCt.exe
  2⤵
  PID:9748
- C:\Windows\System\hUHosrn.exe
  C:\Windows\System\hUHosrn.exe
  2⤵
  PID:9132
- C:\Windows\System\VpLJQUd.exe
  C:\Windows\System\VpLJQUd.exe
  2⤵
  PID:7824
- C:\Windows\System\LUSftdF.exe
  C:\Windows\System\LUSftdF.exe
  2⤵
  PID:10012
- C:\Windows\System\bhIAUFO.exe
  C:\Windows\System\bhIAUFO.exe
  2⤵
  PID:12320
- C:\Windows\System\tIJCUGN.exe
  C:\Windows\System\tIJCUGN.exe
  2⤵
  PID:11124
- C:\Windows\System\fCXoCfO.exe
  C:\Windows\System\fCXoCfO.exe
  2⤵
  PID:8260
- C:\Windows\System\KQmFZVp.exe
  C:\Windows\System\KQmFZVp.exe
  2⤵
  PID:10376
- C:\Windows\System\kpixfBP.exe
  C:\Windows\System\kpixfBP.exe
  2⤵
  PID:12456
- C:\Windows\System\npmQldg.exe
  C:\Windows\System\npmQldg.exe
  2⤵
  PID:7400
- C:\Windows\System\IwxOrwf.exe
  C:\Windows\System\IwxOrwf.exe
  2⤵
  PID:12840
- C:\Windows\System\DQnOInj.exe
  C:\Windows\System\DQnOInj.exe
  2⤵
  PID:10728
- C:\Windows\System\UmmYLbh.exe
  C:\Windows\System\UmmYLbh.exe
  2⤵
  PID:8236
- C:\Windows\System\NJKIctG.exe
  C:\Windows\System\NJKIctG.exe
  2⤵
  PID:10384
- C:\Windows\System\fRwXCpX.exe
  C:\Windows\System\fRwXCpX.exe
  2⤵
  PID:10100
- C:\Windows\System\GWUqncI.exe
  C:\Windows\System\GWUqncI.exe
  2⤵
  PID:12652
- C:\Windows\System\LVcYvwZ.exe
  C:\Windows\System\LVcYvwZ.exe
  2⤵
  PID:12736
- C:\Windows\System\VfwKLDd.exe
  C:\Windows\System\VfwKLDd.exe
  2⤵
  PID:11792
- C:\Windows\System\OTlPfuz.exe
  C:\Windows\System\OTlPfuz.exe
  2⤵
  PID:12740
- C:\Windows\System\MueLlWu.exe
  C:\Windows\System\MueLlWu.exe
  2⤵
  PID:11980
- C:\Windows\System\jjTwhzW.exe
  C:\Windows\System\jjTwhzW.exe
  2⤵
  PID:11480
- C:\Windows\System\pnqtuth.exe
  C:\Windows\System\pnqtuth.exe
  2⤵
  PID:12112
- C:\Windows\System\MVlRYjQ.exe
  C:\Windows\System\MVlRYjQ.exe
  2⤵
  PID:13192
- C:\Windows\System\QMmnUJd.exe
  C:\Windows\System\QMmnUJd.exe
  2⤵
  PID:10884
- C:\Windows\System\XZcpRFR.exe
  C:\Windows\System\XZcpRFR.exe
  2⤵
  PID:10724
- C:\Windows\System\RWUSFeg.exe
  C:\Windows\System\RWUSFeg.exe
  2⤵
  PID:12788
- C:\Windows\System\qiMcVxE.exe
  C:\Windows\System\qiMcVxE.exe
  2⤵
  PID:12384
- C:\Windows\System\daQtiUk.exe
  C:\Windows\System\daQtiUk.exe
  2⤵
  PID:9752
- C:\Windows\System\tgbTijL.exe
  C:\Windows\System\tgbTijL.exe
  2⤵
  PID:12348
- C:\Windows\System\qizFfSB.exe
  C:\Windows\System\qizFfSB.exe
  2⤵
  PID:11420
- C:\Windows\System\Eftlewp.exe
  C:\Windows\System\Eftlewp.exe
  2⤵
  PID:13036
- C:\Windows\System\nPZiAWF.exe
  C:\Windows\System\nPZiAWF.exe
  2⤵
  PID:13164
- C:\Windows\System\zahMnNe.exe
  C:\Windows\System\zahMnNe.exe
  2⤵
  PID:12796
- C:\Windows\System\bwWHDMh.exe
  C:\Windows\System\bwWHDMh.exe
  2⤵
  PID:10468
- C:\Windows\System\tYSImpn.exe
  C:\Windows\System\tYSImpn.exe
  2⤵
  PID:12856
- C:\Windows\System\jiizghh.exe
  C:\Windows\System\jiizghh.exe
  2⤵
  PID:10124
- C:\Windows\System\loCTElx.exe
  C:\Windows\System\loCTElx.exe
  2⤵
  PID:9952
- C:\Windows\System\UjGjDhe.exe
  C:\Windows\System\UjGjDhe.exe
  2⤵
  PID:3624
- C:\Windows\System\AuiAQDF.exe
  C:\Windows\System\AuiAQDF.exe
  2⤵
  PID:11948
- C:\Windows\System\gqNgngM.exe
  C:\Windows\System\gqNgngM.exe
  2⤵
  PID:12004
- C:\Windows\System\QqKocTS.exe
  C:\Windows\System\QqKocTS.exe
  2⤵
  PID:12752
- C:\Windows\System\GRNPIsE.exe
  C:\Windows\System\GRNPIsE.exe
  2⤵
  PID:12372
- C:\Windows\System\aHlqAMw.exe
  C:\Windows\System\aHlqAMw.exe
  2⤵
  PID:12932
- C:\Windows\System\SxEFQrq.exe
  C:\Windows\System\SxEFQrq.exe
  2⤵
  PID:12972
- C:\Windows\System\bUxJnCl.exe
  C:\Windows\System\bUxJnCl.exe
  2⤵
  PID:9668
- C:\Windows\System\sYQbLSb.exe
  C:\Windows\System\sYQbLSb.exe
  2⤵
  PID:10524
- C:\Windows\System\fyXFMdz.exe
  C:\Windows\System\fyXFMdz.exe
  2⤵
  PID:12992
- C:\Windows\System\bXVWTKh.exe
  C:\Windows\System\bXVWTKh.exe
  2⤵
  PID:11040
- C:\Windows\System\PoeHkTh.exe
  C:\Windows\System\PoeHkTh.exe
  2⤵
  PID:6544
- C:\Windows\System\xXemsKE.exe
  C:\Windows\System\xXemsKE.exe
  2⤵
  PID:3588
- C:\Windows\System\jsvXwAc.exe
  C:\Windows\System\jsvXwAc.exe
  2⤵
  PID:10400
- C:\Windows\System\IElcvsW.exe
  C:\Windows\System\IElcvsW.exe
  2⤵
  PID:9152
- C:\Windows\System\HxpiUAr.exe
  C:\Windows\System\HxpiUAr.exe
  2⤵
  PID:8540
- C:\Windows\System\ELwrpoX.exe
  C:\Windows\System\ELwrpoX.exe
  2⤵
  PID:11596
- C:\Windows\System\VAurVfB.exe
  C:\Windows\System\VAurVfB.exe
  2⤵
  PID:2624
- C:\Windows\System\ttFxyFQ.exe
  C:\Windows\System\ttFxyFQ.exe
  2⤵
  PID:1772
- C:\Windows\System\KRzdrIw.exe
  C:\Windows\System\KRzdrIw.exe
  2⤵
  PID:10220
- C:\Windows\System\ABZCTvZ.exe
  C:\Windows\System\ABZCTvZ.exe
  2⤵
  PID:10976
- C:\Windows\System\syamKJR.exe
  C:\Windows\System\syamKJR.exe
  2⤵
  PID:11004
- C:\Windows\System\AdeqDNq.exe
  C:\Windows\System\AdeqDNq.exe
  2⤵
  PID:2232
- C:\Windows\System\wPDuLDU.exe
  C:\Windows\System\wPDuLDU.exe
  2⤵
  PID:12516
- C:\Windows\System\DBJwYMR.exe
  C:\Windows\System\DBJwYMR.exe
  2⤵
  PID:13336
- C:\Windows\System\dEAcwHm.exe
  C:\Windows\System\dEAcwHm.exe
  2⤵
  PID:13356
- C:\Windows\System\KuNBwaT.exe
  C:\Windows\System\KuNBwaT.exe
  2⤵
  PID:13908
- C:\Windows\System\WQYdTts.exe
  C:\Windows\System\WQYdTts.exe
  2⤵
  PID:13972
- C:\Windows\System\MARWiuH.exe
  C:\Windows\System\MARWiuH.exe
  2⤵
  PID:13768
- C:\Windows\System\YqKUEYi.exe
  C:\Windows\System\YqKUEYi.exe
  2⤵
  PID:13884
- C:\Windows\System\sgDmkKZ.exe
  C:\Windows\System\sgDmkKZ.exe
  2⤵
  PID:3212
- C:\Windows\System\fokmQdJ.exe
  C:\Windows\System\fokmQdJ.exe
  2⤵
  PID:13892
- C:\Windows\System\CJvlhJM.exe
  C:\Windows\System\CJvlhJM.exe
  2⤵
  PID:11592
- C:\Windows\System\REcClMi.exe
  C:\Windows\System\REcClMi.exe
  2⤵
  PID:13864
- C:\Windows\System\bqrmoJF.exe
  C:\Windows\System\bqrmoJF.exe
  2⤵
  PID:4388
- C:\Windows\System\FUPkIJM.exe
  C:\Windows\System\FUPkIJM.exe
  2⤵
  PID:13988
- C:\Windows\System\IYQIqbQ.exe
  C:\Windows\System\IYQIqbQ.exe
  2⤵
  PID:14024
- C:\Windows\System\NRNlhfC.exe
  C:\Windows\System\NRNlhfC.exe
  2⤵
  PID:14060
- C:\Windows\System\gGooIkS.exe
  C:\Windows\System\gGooIkS.exe
  2⤵
  PID:13920
- C:\Windows\System\AbVJyRt.exe
  C:\Windows\System\AbVJyRt.exe
  2⤵
  PID:14100
- C:\Windows\System\dstPoqK.exe
  C:\Windows\System\dstPoqK.exe
  2⤵
  PID:14132
- C:\Windows\System\ssVzbuN.exe
  C:\Windows\System\ssVzbuN.exe
  2⤵
  PID:14156
- C:\Windows\System\wHfzbuI.exe
  C:\Windows\System\wHfzbuI.exe
  2⤵
  PID:14176
- C:\Windows\System\ruiFaSl.exe
  C:\Windows\System\ruiFaSl.exe
  2⤵
  PID:14232
- C:\Windows\System\RBjKJtx.exe
  C:\Windows\System\RBjKJtx.exe
  2⤵
  PID:14292
- C:\Windows\System\KQMUszj.exe
  C:\Windows\System\KQMUszj.exe
  2⤵
  PID:14328
- C:\Windows\System\VPKYfrq.exe
  C:\Windows\System\VPKYfrq.exe
  2⤵
  PID:13324
- C:\Windows\System\ZDKhMJU.exe
  C:\Windows\System\ZDKhMJU.exe
  2⤵
  PID:13396
- C:\Windows\System\PTbnNwE.exe
  C:\Windows\System\PTbnNwE.exe
  2⤵
  PID:13532
- C:\Windows\System\iQHvGCw.exe
  C:\Windows\System\iQHvGCw.exe
  2⤵
  PID:13552
- C:\Windows\System\ifNofHW.exe
  C:\Windows\System\ifNofHW.exe
  2⤵
  PID:13588
- C:\Windows\System\UKjtjGw.exe
  C:\Windows\System\UKjtjGw.exe
  2⤵
  PID:6024
- C:\Windows\System\vhbAxaY.exe
  C:\Windows\System\vhbAxaY.exe
  2⤵
  PID:13604
- C:\Windows\System\UUwaMQt.exe
  C:\Windows\System\UUwaMQt.exe
  2⤵
  PID:13644
- C:\Windows\System\qqMGbME.exe
  C:\Windows\System\qqMGbME.exe
  2⤵
  PID:13672
- C:\Windows\System\FrfgZfy.exe
  C:\Windows\System\FrfgZfy.exe
  2⤵
  PID:13688
- C:\Windows\System\gnTbTPz.exe
  C:\Windows\System\gnTbTPz.exe
  2⤵
  PID:13704
- C:\Windows\System\bruGhha.exe
  C:\Windows\System\bruGhha.exe
  2⤵
  PID:13728
- C:\Windows\System\fCVfcKB.exe
  C:\Windows\System\fCVfcKB.exe
  2⤵
  PID:13756
- C:\Windows\System\MvmdqWn.exe
  C:\Windows\System\MvmdqWn.exe
  2⤵
  PID:13784
- C:\Windows\System\AoRkulX.exe
  C:\Windows\System\AoRkulX.exe
  2⤵
  PID:13804
- C:\Windows\System\KEwFSua.exe
  C:\Windows\System\KEwFSua.exe
  2⤵
  PID:13844
- C:\Windows\System\bsBnPHB.exe
  C:\Windows\System\bsBnPHB.exe
  2⤵
  PID:4224
- C:\Windows\System\qfzjxqY.exe
  C:\Windows\System\qfzjxqY.exe
  2⤵
  PID:12092
- C:\Windows\System\JmJBwaI.exe
  C:\Windows\System\JmJBwaI.exe
  2⤵
  PID:3200
- C:\Windows\System\RzviSVh.exe
  C:\Windows\System\RzviSVh.exe
  2⤵
  PID:4008
- C:\Windows\System\umMCqtY.exe
  C:\Windows\System\umMCqtY.exe
  2⤵
  PID:14116
- C:\Windows\System\aExpKMc.exe
  C:\Windows\System\aExpKMc.exe
  2⤵
  PID:14288
- C:\Windows\System\ZYzZiYu.exe
  C:\Windows\System\ZYzZiYu.exe
  2⤵
  PID:14316
- C:\Windows\System\twMfVhD.exe
  C:\Windows\System\twMfVhD.exe
  2⤵
  PID:13424
- C:\Windows\System\oSgrIlg.exe
  C:\Windows\System\oSgrIlg.exe
  2⤵
  PID:2984
- C:\Windows\System\QprAvNA.exe
  C:\Windows\System\QprAvNA.exe
  2⤵
  PID:13332
- C:\Windows\System\GXwgsgM.exe
  C:\Windows\System\GXwgsgM.exe
  2⤵
  PID:13556
- C:\Windows\System\XGOhJvM.exe
  C:\Windows\System\XGOhJvM.exe
  2⤵
  PID:1568
- C:\Windows\System\WfcjaRk.exe
  C:\Windows\System\WfcjaRk.exe
  2⤵
  PID:13524
- C:\Windows\System\oNxPqLD.exe
  C:\Windows\System\oNxPqLD.exe
  2⤵
  PID:13512
- C:\Windows\System\IaTzjKJ.exe
  C:\Windows\System\IaTzjKJ.exe
  2⤵
  PID:13720
- C:\Windows\System\mpGdbvW.exe
  C:\Windows\System\mpGdbvW.exe
  2⤵
  PID:13632
- C:\Windows\System\qSKLgVU.exe
  C:\Windows\System\qSKLgVU.exe
  2⤵
  PID:13812
- C:\Windows\System\SeFfZqb.exe
  C:\Windows\System\SeFfZqb.exe
  2⤵
  PID:13852
- C:\Windows\System\mhgTdRx.exe
  C:\Windows\System\mhgTdRx.exe
  2⤵
  PID:13680
- C:\Windows\System\XzOmIkJ.exe
  C:\Windows\System\XzOmIkJ.exe
  2⤵
  PID:13816
- C:\Windows\System\BPGwpLO.exe
  C:\Windows\System\BPGwpLO.exe
  2⤵
  PID:184
- C:\Windows\System\ESCTluQ.exe
  C:\Windows\System\ESCTluQ.exe
  2⤵
  PID:13836
- C:\Windows\System\mgbPjVB.exe
  C:\Windows\System\mgbPjVB.exe
  2⤵
  PID:13876
- C:\Windows\System\IVGSCZd.exe
  C:\Windows\System\IVGSCZd.exe
  2⤵
  PID:14188
- C:\Windows\System\rJqUpFX.exe
  C:\Windows\System\rJqUpFX.exe
  2⤵
  PID:5332
- C:\Windows\System\sJPrzYj.exe
  C:\Windows\System\sJPrzYj.exe
  2⤵
  PID:14000
- C:\Windows\System\WwFSIUG.exe
  C:\Windows\System\WwFSIUG.exe
  2⤵
  PID:1680
- C:\Windows\System\WgVEQPS.exe
  C:\Windows\System\WgVEQPS.exe
  2⤵
  PID:3184
- C:\Windows\System\BkRGgbI.exe
  C:\Windows\System\BkRGgbI.exe
  2⤵
  PID:6536
- C:\Windows\System\qJBWVYb.exe
  C:\Windows\System\qJBWVYb.exe
  2⤵
  PID:3044
- C:\Windows\System\erUpilk.exe
  C:\Windows\System\erUpilk.exe
  2⤵
  PID:13652
- C:\Windows\System\JcVKKFL.exe
  C:\Windows\System\JcVKKFL.exe
  2⤵
  PID:404
- C:\Windows\System\lGlPWeJ.exe
  C:\Windows\System\lGlPWeJ.exe
  2⤵
  PID:3080
- C:\Windows\System\sWccpbu.exe
  C:\Windows\System\sWccpbu.exe
  2⤵
  PID:13748
- C:\Windows\System\RrkKZgq.exe
  C:\Windows\System\RrkKZgq.exe
  2⤵
  PID:13960
- C:\Windows\System\wHNBBmh.exe
  C:\Windows\System\wHNBBmh.exe
  2⤵
  PID:2100
- C:\Windows\System\WCZCAxi.exe
  C:\Windows\System\WCZCAxi.exe
  2⤵
  PID:13952
- C:\Windows\System\WoPoOGW.exe
  C:\Windows\System\WoPoOGW.exe
  2⤵
  PID:5672
- C:\Windows\System\rARhgTm.exe
  C:\Windows\System\rARhgTm.exe
  2⤵
  PID:13364
- C:\Windows\System\EHQnpme.exe
  C:\Windows\System\EHQnpme.exe
  2⤵
  PID:4732
- C:\Windows\System\GdUugQC.exe
  C:\Windows\System\GdUugQC.exe
  2⤵
  PID:13408
- C:\Windows\System\VHbjoEA.exe
  C:\Windows\System\VHbjoEA.exe
  2⤵
  PID:13840
- C:\Windows\System\mHfJhgd.exe
  C:\Windows\System\mHfJhgd.exe
  2⤵
  PID:13484
- C:\Windows\System\PMpVUxc.exe
  C:\Windows\System\PMpVUxc.exe
  2⤵
  PID:13492
- C:\Windows\System\WlLANhx.exe
  C:\Windows\System\WlLANhx.exe
  2⤵
  PID:680
- C:\Windows\System\ZsykPMf.exe
  C:\Windows\System\ZsykPMf.exe
  2⤵
  PID:1172
- C:\Windows\System\vybvsgA.exe
  C:\Windows\System\vybvsgA.exe
  2⤵
  PID:5248
- C:\Windows\System\KJcipvW.exe
  C:\Windows\System\KJcipvW.exe
  2⤵
  PID:2228
- C:\Windows\System\NRnwJrh.exe
  C:\Windows\System\NRnwJrh.exe
  2⤵
  PID:13792
- C:\Windows\System\CIwKIBg.exe
  C:\Windows\System\CIwKIBg.exe
  2⤵
  PID:14044
- C:\Windows\System\ZiJzvAd.exe
  C:\Windows\System\ZiJzvAd.exe
  2⤵
  PID:4304
- C:\Windows\System\IjiscVM.exe
  C:\Windows\System\IjiscVM.exe
  2⤵
  PID:4916
- C:\Windows\System\VsJFgaZ.exe
  C:\Windows\System\VsJFgaZ.exe
  2⤵
  PID:5916
- C:\Windows\System\qnvCKrQ.exe
  C:\Windows\System\qnvCKrQ.exe
  2⤵
  PID:5964
- C:\Windows\System\tKPqtfO.exe
  C:\Windows\System\tKPqtfO.exe
  2⤵
  PID:5972
- C:\Windows\System\XBotyCj.exe
  C:\Windows\System\XBotyCj.exe
  2⤵
  PID:5956
- C:\Windows\System\OlhJUnO.exe
  C:\Windows\System\OlhJUnO.exe
  2⤵
  PID:5676
- C:\Windows\System\BIeRhpH.exe
  C:\Windows\System\BIeRhpH.exe
  2⤵
  PID:1688
- C:\Windows\System\avWCcXr.exe
  C:\Windows\System\avWCcXr.exe
  2⤵
  PID:5216
- C:\Windows\System\AVJlLyk.exe
  C:\Windows\System\AVJlLyk.exe
  2⤵
  PID:5800
- C:\Windows\System\WFYYBMv.exe
  C:\Windows\System\WFYYBMv.exe
  2⤵
  PID:2948
- C:\Windows\System\YLzlgvc.exe
  C:\Windows\System\YLzlgvc.exe
  2⤵
  PID:5372
- C:\Windows\System\xURNuTq.exe
  C:\Windows\System\xURNuTq.exe
  2⤵
  PID:348
- C:\Windows\System\TWBxgwM.exe
  C:\Windows\System\TWBxgwM.exe
  2⤵
  PID:14192
- C:\Windows\System\LuxuNDR.exe
  C:\Windows\System\LuxuNDR.exe
  2⤵
  PID:14252
- C:\Windows\System\pDKFTqP.exe
  C:\Windows\System\pDKFTqP.exe
  2⤵
  PID:2980
- C:\Windows\System\DBavlWe.exe
  C:\Windows\System\DBavlWe.exe
  2⤵
  PID:3508
- C:\Windows\System\QTyxkdF.exe
  C:\Windows\System\QTyxkdF.exe
  2⤵
  PID:6036
- C:\Windows\System\PmpYfJJ.exe
  C:\Windows\System\PmpYfJJ.exe
  2⤵
  PID:13540
- C:\Windows\System\Wklyarr.exe
  C:\Windows\System\Wklyarr.exe
  2⤵
  PID:1848
- C:\Windows\System\KaqKOhO.exe
  C:\Windows\System\KaqKOhO.exe
  2⤵
  PID:5328
- C:\Windows\System\OHAQvdl.exe
  C:\Windows\System\OHAQvdl.exe
  2⤵
  PID:5024
- C:\Windows\System\ZweExMw.exe
  C:\Windows\System\ZweExMw.exe
  2⤵
  PID:3004
- C:\Windows\System\DkdxXPe.exe
  C:\Windows\System\DkdxXPe.exe
  2⤵
  PID:2216
- C:\Windows\System\LAsMuyS.exe
  C:\Windows\System\LAsMuyS.exe
  2⤵
  PID:5280
- C:\Windows\System\UfUGiNu.exe
  C:\Windows\System\UfUGiNu.exe
  2⤵
  PID:592
- C:\Windows\System\AglcThA.exe
  C:\Windows\System\AglcThA.exe
  2⤵
  PID:1472
- C:\Windows\System\xECsboo.exe
  C:\Windows\System\xECsboo.exe
  2⤵
  PID:5768
- C:\Windows\System\CudrdEp.exe
  C:\Windows\System\CudrdEp.exe
  2⤵
  PID:13428
- C:\Windows\System\ByIzGPl.exe
  C:\Windows\System\ByIzGPl.exe
  2⤵
  PID:5812
- C:\Windows\System\DFsVRIu.exe
  C:\Windows\System\DFsVRIu.exe
  2⤵
  PID:14356
- C:\Windows\System\dNeDrnF.exe
  C:\Windows\System\dNeDrnF.exe
  2⤵
  PID:14388
- C:\Windows\System\HmsmMWj.exe
  C:\Windows\System\HmsmMWj.exe
  2⤵
  PID:14408
- C:\Windows\System\afLZqMD.exe
  C:\Windows\System\afLZqMD.exe
  2⤵
  PID:14472
- C:\Windows\System\SQXbghR.exe
  C:\Windows\System\SQXbghR.exe
  2⤵
  PID:14496
- C:\Windows\System\uFxKYTL.exe
  C:\Windows\System\uFxKYTL.exe
  2⤵
  PID:14516
- C:\Windows\System\mIWyGbQ.exe
  C:\Windows\System\mIWyGbQ.exe
  2⤵
  PID:14532
- C:\Windows\System\OpkCtLl.exe
  C:\Windows\System\OpkCtLl.exe
  2⤵
  PID:14560
- C:\Windows\System\IpvDQmt.exe
  C:\Windows\System\IpvDQmt.exe
  2⤵
  PID:14604
- C:\Windows\System\MUnZCwu.exe
  C:\Windows\System\MUnZCwu.exe
  2⤵
  PID:14620
- C:\Windows\System\vbITPyo.exe
  C:\Windows\System\vbITPyo.exe
  2⤵
  PID:14640
- C:\Windows\System\wysETsa.exe
  C:\Windows\System\wysETsa.exe
  2⤵
  PID:14656
- C:\Windows\System\BRKuPhy.exe
  C:\Windows\System\BRKuPhy.exe
  2⤵
  PID:14672
- C:\Windows\System\NGFsICN.exe
  C:\Windows\System\NGFsICN.exe
  2⤵
  PID:14700
- C:\Windows\System\eWPDKkj.exe
  C:\Windows\System\eWPDKkj.exe
  2⤵
  PID:14724
- C:\Windows\System\oOrdtaO.exe
  C:\Windows\System\oOrdtaO.exe
  2⤵
  PID:14756
- C:\Windows\System\wRJVJgk.exe
  C:\Windows\System\wRJVJgk.exe
  2⤵
  PID:14936
- C:\Windows\System\tNvSHzY.exe
  C:\Windows\System\tNvSHzY.exe
  2⤵
  PID:14956
- C:\Windows\System\bzrdKGr.exe
  C:\Windows\System\bzrdKGr.exe
  2⤵
  PID:14980
- C:\Windows\System\HSLFtXS.exe
  C:\Windows\System\HSLFtXS.exe
  2⤵
  PID:15008
- C:\Windows\System\JbqWpqQ.exe
  C:\Windows\System\JbqWpqQ.exe
  2⤵
  PID:15060
- C:\Windows\System\Hxqxpsu.exe
  C:\Windows\System\Hxqxpsu.exe
  2⤵
  PID:15108
- C:\Windows\System\mbHVOin.exe
  C:\Windows\System\mbHVOin.exe
  2⤵
  PID:15132
- C:\Windows\System\DMWAHhT.exe
  C:\Windows\System\DMWAHhT.exe
  2⤵
  PID:15164
- C:\Windows\System\QpzhBlj.exe
  C:\Windows\System\QpzhBlj.exe
  2⤵
  PID:15252
- C:\Windows\System\utHJoWG.exe
  C:\Windows\System\utHJoWG.exe
  2⤵
  PID:15280
- C:\Windows\System\FGcJgqS.exe
  C:\Windows\System\FGcJgqS.exe
  2⤵
  PID:15296
- C:\Windows\System\wYaNVdI.exe
  C:\Windows\System\wYaNVdI.exe
  2⤵
  PID:5624
- C:\Windows\System\kocfxgI.exe
  C:\Windows\System\kocfxgI.exe
  2⤵
  PID:14240
- C:\Windows\System\FoKnRte.exe
  C:\Windows\System\FoKnRte.exe
  2⤵
  PID:5816
- C:\Windows\System\TjxTEEb.exe
  C:\Windows\System\TjxTEEb.exe
  2⤵
  PID:5836
- C:\Windows\System\YgOFbBV.exe
  C:\Windows\System\YgOFbBV.exe
  2⤵
  PID:6056
- C:\Windows\System\GDcmHif.exe
  C:\Windows\System\GDcmHif.exe
  2⤵
  PID:14400
- C:\Windows\System\xeWvUGh.exe
  C:\Windows\System\xeWvUGh.exe
  2⤵
  PID:944
- C:\Windows\System\xHTvzvn.exe
  C:\Windows\System\xHTvzvn.exe
  2⤵
  PID:6500
- C:\Windows\System\cqgmCXQ.exe
  C:\Windows\System\cqgmCXQ.exe
  2⤵
  PID:3492
- C:\Windows\System\CyhnrSY.exe
  C:\Windows\System\CyhnrSY.exe
  2⤵
  PID:14380
- C:\Windows\System\yCDFQzT.exe
  C:\Windows\System\yCDFQzT.exe
  2⤵
  PID:6032
- C:\Windows\System\QqHCqKA.exe
  C:\Windows\System\QqHCqKA.exe
  2⤵
  PID:14504
- C:\Windows\System\kBVPSuq.exe
  C:\Windows\System\kBVPSuq.exe
  2⤵
  PID:14460
- C:\Windows\System\kqlCHoA.exe
  C:\Windows\System\kqlCHoA.exe
  2⤵
  PID:6372
- C:\Windows\System\FMXvTHr.exe
  C:\Windows\System\FMXvTHr.exe
  2⤵
  PID:14464
- C:\Windows\System\fVdWWRZ.exe
  C:\Windows\System\fVdWWRZ.exe
  2⤵
  PID:6332
- C:\Windows\System\wUaMwRq.exe
  C:\Windows\System\wUaMwRq.exe
  2⤵
  PID:6548
- C:\Windows\System\KLUFqDn.exe
  C:\Windows\System\KLUFqDn.exe
  2⤵
  PID:14652
- C:\Windows\System\QedBlZX.exe
  C:\Windows\System\QedBlZX.exe
  2⤵
  PID:14800
- C:\Windows\System\nRZMQcP.exe
  C:\Windows\System\nRZMQcP.exe
  2⤵
  PID:14716
- C:\Windows\System\sSaLXZF.exe
  C:\Windows\System\sSaLXZF.exe
  2⤵
  PID:14944
- C:\Windows\System\SOeUvUm.exe
  C:\Windows\System\SOeUvUm.exe
  2⤵
  PID:6552
- C:\Windows\System\ADmEGrV.exe
  C:\Windows\System\ADmEGrV.exe
  2⤵
  PID:14752
- C:\Windows\System\nYqfjdY.exe
  C:\Windows\System\nYqfjdY.exe
  2⤵
  PID:6308
- C:\Windows\System\uMNpQnz.exe
  C:\Windows\System\uMNpQnz.exe
  2⤵
  PID:6580
- C:\Windows\System\AFFAZZm.exe
  C:\Windows\System\AFFAZZm.exe
  2⤵
  PID:15328
- C:\Windows\System\RDfGiZC.exe
  C:\Windows\System\RDfGiZC.exe
  2⤵
  PID:13600
- C:\Windows\System\IyDPCFO.exe
  C:\Windows\System\IyDPCFO.exe
  2⤵
  PID:1624
- C:\Windows\System\IoUZZDF.exe
  C:\Windows\System\IoUZZDF.exe
  2⤵
  PID:6788
- C:\Windows\System\SiBbMWq.exe
  C:\Windows\System\SiBbMWq.exe
  2⤵
  PID:7004
- C:\Windows\System\ZznJHpJ.exe
  C:\Windows\System\ZznJHpJ.exe
  2⤵
  PID:1736
- C:\Windows\System\YNqovwx.exe
  C:\Windows\System\YNqovwx.exe
  2⤵
  PID:6508
- C:\Windows\System\SGqAUJd.exe
  C:\Windows\System\SGqAUJd.exe
  2⤵
  PID:14404
- C:\Windows\System\hRcmpCR.exe
  C:\Windows\System\hRcmpCR.exe
  2⤵
  PID:5876
- C:\Windows\System\EoEzAZQ.exe
  C:\Windows\System\EoEzAZQ.exe
  2⤵
  PID:14508
- C:\Windows\System\AKvnIfD.exe
  C:\Windows\System\AKvnIfD.exe
  2⤵
  PID:6516
- C:\Windows\System\FBKGpdZ.exe
  C:\Windows\System\FBKGpdZ.exe
  2⤵
  PID:7016
- C:\Windows\System\OyRsEDe.exe
  C:\Windows\System\OyRsEDe.exe
  2⤵
  PID:14584
- C:\Windows\System\vFvOtna.exe
  C:\Windows\System\vFvOtna.exe
  2⤵
  PID:14364
- C:\Windows\System\CvIwiVk.exe
  C:\Windows\System\CvIwiVk.exe
  2⤵
  PID:14828
- C:\Windows\System\lMBFzcK.exe
  C:\Windows\System\lMBFzcK.exe
  2⤵
  PID:14952
- C:\Windows\System\nmVolLB.exe
  C:\Windows\System\nmVolLB.exe
  2⤵
  PID:6916
- C:\Windows\System\gHEXOLR.exe
  C:\Windows\System\gHEXOLR.exe
  2⤵
  PID:4756
- C:\Windows\System\aHBXjhM.exe
  C:\Windows\System\aHBXjhM.exe
  2⤵
  PID:15028
- C:\Windows\System\diZBCxt.exe
  C:\Windows\System\diZBCxt.exe
  2⤵
  PID:14888
- C:\Windows\System\tHeRsHS.exe
  C:\Windows\System\tHeRsHS.exe
  2⤵
  PID:14924
- C:\Windows\System\BKLyxlw.exe
  C:\Windows\System\BKLyxlw.exe
  2⤵
  PID:15020
- C:\Windows\System\iRPFnGn.exe
  C:\Windows\System\iRPFnGn.exe
  2⤵
  PID:13348
- C:\Windows\System\WUNcMTL.exe
  C:\Windows\System\WUNcMTL.exe
  2⤵
  PID:7012
- C:\Windows\System\REQAPCw.exe
  C:\Windows\System\REQAPCw.exe
  2⤵
  PID:14848
- C:\Windows\System\NUGRqVI.exe
  C:\Windows\System\NUGRqVI.exe
  2⤵
  PID:15100
- C:\Windows\System\StLsrBb.exe
  C:\Windows\System\StLsrBb.exe
  2⤵
  PID:6008
- C:\Windows\System\PUOwShQ.exe
  C:\Windows\System\PUOwShQ.exe
  2⤵
  PID:6460
- C:\Windows\System\skjAeyB.exe
  C:\Windows\System\skjAeyB.exe
  2⤵
  PID:14692
- C:\Windows\System\CCICVfj.exe
  C:\Windows\System\CCICVfj.exe
  2⤵
  PID:14764
- C:\Windows\System\TFuFDmT.exe
  C:\Windows\System\TFuFDmT.exe
  2⤵
  PID:15220
- C:\Windows\System\HYqXXym.exe
  C:\Windows\System\HYqXXym.exe
  2⤵
  PID:15120
- C:\Windows\System\gvagcUC.exe
  C:\Windows\System\gvagcUC.exe
  2⤵
  PID:15240
- C:\Windows\System\THvRBYN.exe
  C:\Windows\System\THvRBYN.exe
  2⤵
  PID:6684
- C:\Windows\System\eqgFyMi.exe
  C:\Windows\System\eqgFyMi.exe
  2⤵
  PID:6776
- C:\Windows\System\KAGTbQm.exe
  C:\Windows\System\KAGTbQm.exe
  2⤵
  PID:6584
- C:\Windows\System\URoOBVA.exe
  C:\Windows\System\URoOBVA.exe
  2⤵
  PID:5048
- C:\Windows\System\BellKim.exe
  C:\Windows\System\BellKim.exe
  2⤵
  PID:14776
- C:\Windows\System\YlsQkOQ.exe
  C:\Windows\System\YlsQkOQ.exe
  2⤵
  PID:5944
- C:\Windows\System\KKUtJlL.exe
  C:\Windows\System\KKUtJlL.exe
  2⤵
  PID:2664
- C:\Windows\System\eLldwwe.exe
  C:\Windows\System\eLldwwe.exe
  2⤵
  PID:3444
- C:\Windows\System\fxbJaDT.exe
  C:\Windows\System\fxbJaDT.exe
  2⤵
  PID:6292
- C:\Windows\System\qYDleRd.exe
  C:\Windows\System\qYDleRd.exe
  2⤵
  PID:4856
- C:\Windows\System\YpLzoGa.exe
  C:\Windows\System\YpLzoGa.exe
  2⤵
  PID:6504
- C:\Windows\System\CrXYhEE.exe
  C:\Windows\System\CrXYhEE.exe
  2⤵
  PID:5420
- C:\Windows\System\vrXdFuO.exe
  C:\Windows\System\vrXdFuO.exe
  2⤵
  PID:5948
- C:\Windows\System\rQdXeXW.exe
  C:\Windows\System\rQdXeXW.exe
  2⤵
  PID:4672
- C:\Windows\System\pjMxjyP.exe
  C:\Windows\System\pjMxjyP.exe
  2⤵
  PID:6112
- C:\Windows\System\CsBjdFW.exe
  C:\Windows\System\CsBjdFW.exe
  2⤵
  PID:1612
- C:\Windows\System\Ceuilpn.exe
  C:\Windows\System\Ceuilpn.exe
  2⤵
  PID:14488
- C:\Windows\System\xomUzhM.exe
  C:\Windows\System\xomUzhM.exe
  2⤵
  PID:14540
- C:\Windows\System\RPjTLgr.exe
  C:\Windows\System\RPjTLgr.exe
  2⤵
  PID:1904
- C:\Windows\System\nUCKmoC.exe
  C:\Windows\System\nUCKmoC.exe
  2⤵
  PID:6088
- C:\Windows\System\WujHWoF.exe
  C:\Windows\System\WujHWoF.exe
  2⤵
  PID:1712
- C:\Windows\System\NqZfINU.exe
  C:\Windows\System\NqZfINU.exe
  2⤵
  PID:6924
- C:\Windows\System\QxlEbDC.exe
  C:\Windows\System\QxlEbDC.exe
  2⤵
  PID:6456
- C:\Windows\System\ETSLAeE.exe
  C:\Windows\System\ETSLAeE.exe
  2⤵
  PID:7532
- C:\Windows\System\fRhaTDB.exe
  C:\Windows\System\fRhaTDB.exe
  2⤵
  PID:6860
- C:\Windows\System\uOQCdYT.exe
  C:\Windows\System\uOQCdYT.exe
  2⤵
  PID:5568
- C:\Windows\System\bbCyZBl.exe
  C:\Windows\System\bbCyZBl.exe
  2⤵
  PID:7340
- C:\Windows\System\ZlLdndX.exe
  C:\Windows\System\ZlLdndX.exe
  2⤵
  PID:6600
- C:\Windows\System\HgWROKr.exe
  C:\Windows\System\HgWROKr.exe
  2⤵
  PID:14612
- C:\Windows\System\NLLZyGf.exe
  C:\Windows\System\NLLZyGf.exe
  2⤵
  PID:5576
- C:\Windows\System\rcJeBJL.exe
  C:\Windows\System\rcJeBJL.exe
  2⤵
  PID:14772
- C:\Windows\System\ZVzvAkN.exe
  C:\Windows\System\ZVzvAkN.exe
  2⤵
  PID:5856
- C:\Windows\System\vaseFGA.exe
  C:\Windows\System\vaseFGA.exe
  2⤵
  PID:7932
- C:\Windows\System\bujNTph.exe
  C:\Windows\System\bujNTph.exe
  2⤵
  PID:8148
- C:\Windows\System\yOTTPNg.exe
  C:\Windows\System\yOTTPNg.exe
  2⤵
  PID:14372
- C:\Windows\System\zYAnsNA.exe
  C:\Windows\System\zYAnsNA.exe
  2⤵
  PID:9312
- C:\Windows\System\MlOkmOS.exe
  C:\Windows\System\MlOkmOS.exe
  2⤵
  PID:6424
- C:\Windows\System\lYKXjVn.exe
  C:\Windows\System\lYKXjVn.exe
  2⤵
  PID:6820
- C:\Windows\System\OttALMu.exe
  C:\Windows\System\OttALMu.exe
  2⤵
  PID:6632
- C:\Windows\System\PqmsuWi.exe
  C:\Windows\System\PqmsuWi.exe
  2⤵
  PID:7300
- C:\Windows\System\ByouIOC.exe
  C:\Windows\System\ByouIOC.exe
  2⤵
  PID:11692
- C:\Windows\System\uorMexU.exe
  C:\Windows\System\uorMexU.exe
  2⤵
  PID:8412
- C:\Windows\System\NCsbHkB.exe
  C:\Windows\System\NCsbHkB.exe
  2⤵
  PID:7456
- C:\Windows\System\ELjrAkz.exe
  C:\Windows\System\ELjrAkz.exe
  2⤵
  PID:2804
- C:\Windows\System\WLVKjzd.exe
  C:\Windows\System\WLVKjzd.exe
  2⤵
  PID:7696
- C:\Windows\System\QkUhFbR.exe
  C:\Windows\System\QkUhFbR.exe
  2⤵
  PID:14628
- C:\Windows\System\YsdRdAb.exe
  C:\Windows\System\YsdRdAb.exe
  2⤵
  PID:8340
- C:\Windows\System\UZvZcoq.exe
  C:\Windows\System\UZvZcoq.exe
  2⤵
  PID:8072
- C:\Windows\System\pMNPvlT.exe
  C:\Windows\System\pMNPvlT.exe
  2⤵
  PID:6976
- C:\Windows\System\FLtayug.exe
  C:\Windows\System\FLtayug.exe
  2⤵
  PID:7748
- C:\Windows\System\VuOZadR.exe
  C:\Windows\System\VuOZadR.exe
  2⤵
  PID:7132
- C:\Windows\System\kAlCviv.exe
  C:\Windows\System\kAlCviv.exe
  2⤵
  PID:7692
- C:\Windows\System\PiqkrdW.exe
  C:\Windows\System\PiqkrdW.exe
  2⤵
  PID:8128
- C:\Windows\System\hNIUvnx.exe
  C:\Windows\System\hNIUvnx.exe
  2⤵
  PID:7152
- C:\Windows\System\cOPBaoC.exe
  C:\Windows\System\cOPBaoC.exe
  2⤵
  PID:8456
- C:\Windows\System\bWdPuAz.exe
  C:\Windows\System\bWdPuAz.exe
  2⤵
  PID:6312
- C:\Windows\System\QhJcDby.exe
  C:\Windows\System\QhJcDby.exe
  2⤵
  PID:7216
- C:\Windows\System\fXkOXYi.exe
  C:\Windows\System\fXkOXYi.exe
  2⤵
  PID:7920
- C:\Windows\System\TjBOPJC.exe
  C:\Windows\System\TjBOPJC.exe
  2⤵
  PID:7364
- C:\Windows\System\CjVhrFM.exe
  C:\Windows\System\CjVhrFM.exe
  2⤵
  PID:6908
- C:\Windows\System\LWwlPON.exe
  C:\Windows\System\LWwlPON.exe
  2⤵
  PID:6208
- C:\Windows\System\urSlvkk.exe
  C:\Windows\System\urSlvkk.exe
  2⤵
  PID:8228
- C:\Windows\System\sfHpiyx.exe
  C:\Windows\System\sfHpiyx.exe
  2⤵
  PID:8232
- C:\Windows\System\tUeTFob.exe
  C:\Windows\System\tUeTFob.exe
  2⤵
  PID:6476
- C:\Windows\System\gKzdMUi.exe
  C:\Windows\System\gKzdMUi.exe
  2⤵
  PID:8696
- C:\Windows\System\PIDHqty.exe
  C:\Windows\System\PIDHqty.exe
  2⤵
  PID:7240
- C:\Windows\System\LTixEUz.exe
  C:\Windows\System\LTixEUz.exe
  2⤵
  PID:9292
- C:\Windows\System\EDqkBZI.exe
  C:\Windows\System\EDqkBZI.exe
  2⤵
  PID:6952
- C:\Windows\System\rMlLHIX.exe
  C:\Windows\System\rMlLHIX.exe
  2⤵
  PID:8520
- C:\Windows\System\YmyQVJQ.exe
  C:\Windows\System\YmyQVJQ.exe
  2⤵
  PID:5620
- C:\Windows\System\ydxFZBB.exe
  C:\Windows\System\ydxFZBB.exe
  2⤵
  PID:3384
- C:\Windows\System\BouGjqM.exe
  C:\Windows\System\BouGjqM.exe
  2⤵
  PID:3032
- C:\Windows\System\wpZSnDl.exe
  C:\Windows\System\wpZSnDl.exe
  2⤵
  PID:664
- C:\Windows\System\CZiSIEm.exe
  C:\Windows\System\CZiSIEm.exe
  2⤵
  PID:12388
- C:\Windows\System\lwLFyzM.exe
  C:\Windows\System\lwLFyzM.exe
  2⤵
  PID:7484
- C:\Windows\System\AGGaNMx.exe
  C:\Windows\System\AGGaNMx.exe
  2⤵
  PID:7944
- C:\Windows\System\qhslqln.exe
  C:\Windows\System\qhslqln.exe
  2⤵
  PID:7600
- C:\Windows\System\qPrDuos.exe
  C:\Windows\System\qPrDuos.exe
  2⤵
  PID:7676
- C:\Windows\System\dhTOrOx.exe
  C:\Windows\System\dhTOrOx.exe
  2⤵
  PID:14548
- C:\Windows\System\fDSOhGy.exe
  C:\Windows\System\fDSOhGy.exe
  2⤵
  PID:9724
- C:\Windows\System\nzEnTnX.exe
  C:\Windows\System\nzEnTnX.exe
  2⤵
  PID:9744
- C:\Windows\System\zHlgDwK.exe
  C:\Windows\System\zHlgDwK.exe
  2⤵
  PID:8756
- C:\Windows\System\OHzfrSP.exe
  C:\Windows\System\OHzfrSP.exe
  2⤵
  PID:15312
- C:\Windows\System\WAVdhWF.exe
  C:\Windows\System\WAVdhWF.exe
  2⤵
  PID:8840
- C:\Windows\System\MqhEWZS.exe
  C:\Windows\System\MqhEWZS.exe
  2⤵
  PID:7380
- C:\Windows\System\yRWrJGp.exe
  C:\Windows\System\yRWrJGp.exe
  2⤵
  PID:10008
- C:\Windows\System\tfxacdY.exe
  C:\Windows\System\tfxacdY.exe
  2⤵
  PID:10476
- C:\Windows\System\azyZVlU.exe
  C:\Windows\System\azyZVlU.exe
  2⤵
  PID:9344
- C:\Windows\System\NqeeaSW.exe
  C:\Windows\System\NqeeaSW.exe
  2⤵
  PID:15196
- C:\Windows\System\QQDFLdz.exe
  C:\Windows\System\QQDFLdz.exe
  2⤵
  PID:8928
- C:\Windows\System\KYXhvBC.exe
  C:\Windows\System\KYXhvBC.exe
  2⤵
  PID:11092
- C:\Windows\System\cPiXVIM.exe
  C:\Windows\System\cPiXVIM.exe
  2⤵
  PID:8320
- C:\Windows\System\ZqLZPlF.exe
  C:\Windows\System\ZqLZPlF.exe
  2⤵
  PID:8920
- C:\Windows\System\eSYxjUJ.exe
  C:\Windows\System\eSYxjUJ.exe
  2⤵
  PID:2220
- C:\Windows\System\DnAtvau.exe
  C:\Windows\System\DnAtvau.exe
  2⤵
  PID:10312
- C:\Windows\System\uxPamAu.exe
  C:\Windows\System\uxPamAu.exe
  2⤵
  PID:7536
- C:\Windows\System\MFDxbru.exe
  C:\Windows\System\MFDxbru.exe
  2⤵
  PID:7924
- C:\Windows\System\quYZKMd.exe
  C:\Windows\System\quYZKMd.exe
  2⤵
  PID:9068
- C:\Windows\System\XEXiRhq.exe
  C:\Windows\System\XEXiRhq.exe
  2⤵
  PID:10404
- C:\Windows\System\OqoMRfL.exe
  C:\Windows\System\OqoMRfL.exe
  2⤵
  PID:6700
- C:\Windows\System\egCHbIn.exe
  C:\Windows\System\egCHbIn.exe
  2⤵
  PID:13032
- C:\Windows\System\TfbnCRr.exe
  C:\Windows\System\TfbnCRr.exe
  2⤵
  PID:12968
- C:\Windows\System\QWUIhnh.exe
  C:\Windows\System\QWUIhnh.exe
  2⤵
  PID:9288
- C:\Windows\System\jzjZyCL.exe
  C:\Windows\System\jzjZyCL.exe
  2⤵
  PID:8856
- C:\Windows\System\KeRhFit.exe
  C:\Windows\System\KeRhFit.exe
  2⤵
  PID:8976
- C:\Windows\System\JJvppTs.exe
  C:\Windows\System\JJvppTs.exe
  2⤵
  PID:9284
- C:\Windows\System\kEsTQXw.exe
  C:\Windows\System\kEsTQXw.exe
  2⤵
  PID:7320
- C:\Windows\System\ikbYpDe.exe
  C:\Windows\System\ikbYpDe.exe
  2⤵
  PID:9792
- C:\Windows\System\xTsouJJ.exe
  C:\Windows\System\xTsouJJ.exe
  2⤵
  PID:8476
- C:\Windows\System\qmmMSCf.exe
  C:\Windows\System\qmmMSCf.exe
  2⤵
  PID:8876
- C:\Windows\System\dVnotBS.exe
  C:\Windows\System\dVnotBS.exe
  2⤵
  PID:11876
- C:\Windows\System\wSCOZcH.exe
  C:\Windows\System\wSCOZcH.exe
  2⤵
  PID:11428
- C:\Windows\System\UpWzNhd.exe
  C:\Windows\System\UpWzNhd.exe
  2⤵
  PID:11064
- C:\Windows\System\ggRUrpt.exe
  C:\Windows\System\ggRUrpt.exe
  2⤵
  PID:13412
- C:\Windows\System\GBIZkPt.exe
  C:\Windows\System\GBIZkPt.exe
  2⤵
  PID:9420
- C:\Windows\System\PaSOTqv.exe
  C:\Windows\System\PaSOTqv.exe
  2⤵
  PID:11920
- C:\Windows\System\dvhJBxw.exe
  C:\Windows\System\dvhJBxw.exe
  2⤵
  PID:13504
- C:\Windows\System\FfRCEwZ.exe
  C:\Windows\System\FfRCEwZ.exe
  2⤵
  PID:10732
- C:\Windows\System\YFYWWtI.exe
  C:\Windows\System\YFYWWtI.exe
  2⤵
  PID:11192
- C:\Windows\System\QWQUsdB.exe
  C:\Windows\System\QWQUsdB.exe
  2⤵
  PID:10612
- C:\Windows\System\AzbjVIP.exe
  C:\Windows\System\AzbjVIP.exe
  2⤵
  PID:12664
- C:\Windows\System\OpayeKL.exe
  C:\Windows\System\OpayeKL.exe
  2⤵
  PID:212
- C:\Windows\System\LCGieOo.exe
  C:\Windows\System\LCGieOo.exe
  2⤵
  PID:9776
- C:\Windows\System\pOvSNAi.exe
  C:\Windows\System\pOvSNAi.exe
  2⤵
  PID:11000
- C:\Windows\System\zAIfTtT.exe
  C:\Windows\System\zAIfTtT.exe
  2⤵
  PID:5636
- C:\Windows\System\NNuTthA.exe
  C:\Windows\System\NNuTthA.exe
  2⤵
  PID:14492
- C:\Windows\System\vLGMOKV.exe
  C:\Windows\System\vLGMOKV.exe
  2⤵
  PID:9360
- C:\Windows\System\WaRozIm.exe
  C:\Windows\System\WaRozIm.exe
  2⤵
  PID:8552
- C:\Windows\System\OXCnAGY.exe
  C:\Windows\System\OXCnAGY.exe
  2⤵
  PID:12176
- C:\Windows\System\RbGJWnM.exe
  C:\Windows\System\RbGJWnM.exe
  2⤵
  PID:13184
- C:\Windows\System\xtATSJP.exe
  C:\Windows\System\xtATSJP.exe
  2⤵
  PID:9020
- C:\Windows\System\wmYrbYX.exe
  C:\Windows\System\wmYrbYX.exe
  2⤵
  PID:12024
- C:\Windows\System\fLzKeIr.exe
  C:\Windows\System\fLzKeIr.exe
  2⤵
  PID:10192
- C:\Windows\System\plgfKek.exe
  C:\Windows\System\plgfKek.exe
  2⤵
  PID:11256
- C:\Windows\System\hUweoMa.exe
  C:\Windows\System\hUweoMa.exe
  2⤵
  PID:12560
- C:\Windows\System\mDJqKDG.exe
  C:\Windows\System\mDJqKDG.exe
  2⤵
  PID:12568
- C:\Windows\System\OfFcVQm.exe
  C:\Windows\System\OfFcVQm.exe
  2⤵
  PID:9496
- C:\Windows\System\MmsmUnU.exe
  C:\Windows\System\MmsmUnU.exe
  2⤵
  PID:10952
- C:\Windows\System\bqTLvpz.exe
  C:\Windows\System\bqTLvpz.exe
  2⤵
  PID:9888
- C:\Windows\System\HwklZaa.exe
  C:\Windows\System\HwklZaa.exe
  2⤵
  PID:8604
- C:\Windows\System\egfVyRp.exe
  C:\Windows\System\egfVyRp.exe
  2⤵
  PID:9772
- C:\Windows\System\SyDDEMx.exe
  C:\Windows\System\SyDDEMx.exe
  2⤵
  PID:9524
- C:\Windows\System\rVbHDcj.exe
  C:\Windows\System\rVbHDcj.exe
  2⤵
  PID:9864
- C:\Windows\System\ggYAnxc.exe
  C:\Windows\System\ggYAnxc.exe
  2⤵
  PID:9476
- C:\Windows\System\SOZMOtV.exe
  C:\Windows\System\SOZMOtV.exe
  2⤵
  PID:12316
- C:\Windows\System\fgQNJPf.exe
  C:\Windows\System\fgQNJPf.exe
  2⤵
  PID:8432
- C:\Windows\System\VKwKroO.exe
  C:\Windows\System\VKwKroO.exe
  2⤵
  PID:11564
- C:\Windows\System\tlYTsCr.exe
  C:\Windows\System\tlYTsCr.exe
  2⤵
  PID:10636
- C:\Windows\System\yYDQKzY.exe
  C:\Windows\System\yYDQKzY.exe
  2⤵
  PID:11824
- C:\Windows\System\WgXONir.exe
  C:\Windows\System\WgXONir.exe
  2⤵
  PID:10744
- C:\Windows\System\SaJhTBf.exe
  C:\Windows\System\SaJhTBf.exe
  2⤵
  PID:9884
- C:\Windows\System\cxHDPrl.exe
  C:\Windows\System\cxHDPrl.exe
  2⤵
  PID:12868

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 776 -p 1472 -ip 1472
1⤵
PID:14464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gctqief2.pba.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AkeqRUZ.exe

Filesize
1.9MB

MD5
2b2521d28f238352a7966c56609312b3

SHA1
b59a589af54927acf98672da96cffba4f0aafeb5

SHA256
f91835ccc121dbbcfba00c388f61a04c8bcda0d56e17077cc0830cd8bc34401b

SHA512
1e2951b86a0105b6a3dd8bb0b42a57a3fe6139963e37286345dfefaaec5bb8eac07864f345f9081d9ae796565e0486f98ce100f2caf6575909943202318ef8b3

Download Submit
C:\Windows\System\DWJkDXL.exe

Filesize
1.9MB

MD5
25e73b7c5d78467239d269b2026bf0bd

SHA1
323397b9b0e0f22cbbbc469490d16f8e333c590f

SHA256
20d2007169ce306964d1f1e5a320aad612ed3d8c629169d1bcd315e7c72aab33

SHA512
579a702dc0b6b95a60f405238b0a15b62fe7e3fb6c430be2fc66a9ca856e410965f027279cf407823070fd3f4e2503ced850b869745493821b7607d083f986bf

Download Submit
C:\Windows\System\EDvGrCQ.exe

Filesize
1.9MB

MD5
f5ddef0fd251ec925d54099d9a9f03fb

SHA1
2db0c0f691d57e1616fa100d9e785b69264092c8

SHA256
9a4dd0de0a3999acc27ddbb6b7dbd1720888d27c5f45ca4f122113898022d286

SHA512
ad8ff8fc1d3884d8b54ac890e29c9e89e9e7a95095c7b5198cd3ab175d625bd4f0684633d8fd5e327c721318b3d9665ab1e9dd736c7b6b0707187cce28221c3d

Download Submit
C:\Windows\System\EIijkGt.exe

Filesize
1.9MB

MD5
f0edf60635809a5ccd8b09bed3d023e8

SHA1
e052203d4852fd1dc2c928db6d719ae878b57ce5

SHA256
ee0fbef0aa262bb93dff184dae1b19fc2a65aca6998b4803f767eb382dd4ec14

SHA512
24d007cdb715badc805999c023bb306ce05ae9c7e1d8b4d6d0ebecf8503a595307317fd0eea3ff1057fbf362dad52c7a0f2de54e2ba0bf55b9a4a818b568967d

Download Submit
C:\Windows\System\FQxjpKQ.exe

Filesize
1.9MB

MD5
58ea787be403ff7e2ccbae73ef17cccd

SHA1
f37c26b52e41b4d68c526619647afb39a9eb9c29

SHA256
4da7eede4ce97855a0c8b16e6698b02dbce8a12efaa593f9ef1a2a07e198ffc3

SHA512
dcafe013def4f73c74b2311c451e116dddf937cc19fd6876df1e9fc04fb09dc0f9ad01ea718abadbeef04cc097574cec63d125e044e255a7e5404c889c36c04a

Download Submit
C:\Windows\System\GaZKLhO.exe

Filesize
8B

MD5
13fe563eae77bf910d77f345ac790c40

SHA1
b0af09f8ae8466724f1637a00b96f5694c8d1917

SHA256
371dd3009defe57d02c4a8cd6a20a5aa84a5383952d0e3a304def2d54ac59e0f

SHA512
debd4d64d1f42c12b00fe279a66e1c4ea298bef924a23386a7bee4d52d0502808001b7e950c3cea6b727148e0ef64ce14eb60a82e5ee6422f3631bbb5068e5d5

Download Submit
C:\Windows\System\GuzPieR.exe

Filesize
1.9MB

MD5
480b5268e9fcfe7a70d3f79606258cbd

SHA1
53e6ccf519a2b9181833a5fb6daf9a24ea0076df

SHA256
4932d63769fbbb8152f49fe3134d89f14349db5ba2d17367aa17d6ce9d766904

SHA512
2ecdc31476bc8647af5a1ba5911f8e0c1e4a2bdd8acae4548e3de1c04b02fc431dcad5cd45b10e8d8899ae5df9b321c232ccc88ede14d6c92559a3d16796028b

Download Submit
C:\Windows\System\IAXtCpN.exe

Filesize
1.9MB

MD5
ce5194384b819a9b00bcb4daf113bcf5

SHA1
a564bd45130970524e36142468949760228fefba

SHA256
7bc2dbcce078752c53fbc091aad58d215fe74539e2015c7c87c65af87d8e4532

SHA512
c19a11be156fd159e689a4265662adf7a2e2d176f5667fe235eaf7377925f4ccb01097b49bc49c361aadc6fa1b30482061e69779e38c6ad3497dc14f5823b87e

Download Submit
C:\Windows\System\JJxwAmF.exe

Filesize
1.9MB

MD5
3d226d49d8877097c5089627e5f99989

SHA1
b816a0eeb5316ac4e60f34eba53298094ccd8bcc

SHA256
1aba2229da857eda0fa44f80f2bfdcbf4b7ade6751a97a61291f5c1fe41bca90

SHA512
471ecdb66c25470fe16b84d5d7f2b8d1b3faddcb91124683dd312b08c4051d8ab12c146c631c062cc547ccbc355c2badb50ba16c50dfbde1bb2b074f65662896

Download Submit
C:\Windows\System\JacGbwo.exe

Filesize
1.9MB

MD5
36cd943a27ee97fb4734dd307d7ed358

SHA1
14552e93604761048fc5cc569a3dbe0db5902238

SHA256
e73b40c13347d2da7579571e0e206e21aecbf156d458484de9fe0f25539e008b

SHA512
e823cd1e5bdfde9496bb06d7481c489f4589d5e24145b4103ebe9d3b53679c49640fd53a58c894af95484ec07ed03b94a5e3529f026942cc204c1e73f295d7fe

Download Submit
C:\Windows\System\JxMDVza.exe

Filesize
1.9MB

MD5
a335cca38eeaf1a48bbef03a397265a6

SHA1
9e9c317e10267aca1b522b4f3ce5ed8cdc81fe8a

SHA256
00570ffad9db3ddc489e0e1dd7d0cc7a0efb43c70c26a96cda4c12c1bcd301fe

SHA512
201030be5e6dd1a5ddd4714ac28b7465788af8be9bc6911c38a313645eefe2ebe5862d133c0afa8ef74353f3323607fff7d5bd7f7218324c61ab217a2685099d

Download Submit
C:\Windows\System\OSezKmF.exe

Filesize
1.9MB

MD5
9f18c51c556bdcbc53de3417feaf1c2d

SHA1
efd465c745d38ecf81f29fc26d0f35ac07b2d308

SHA256
552f4ebec85942bbd5dbe15321761e56db6201d72c7c8a61daed04ed147da0f3

SHA512
43a240427057c9b445b5b9046141b652b3b528ba62b24f17f181e8773e7fd700326714dacbe54756cb0088da2edaa9792f7e686ce48a721e490c2c6cf7eed000

Download Submit
C:\Windows\System\OfqQspW.exe

Filesize
1.9MB

MD5
d478755f204331eb6838f4de7e870c68

SHA1
ae317caaf795d7bfde0650a10bc131534deb5d7f

SHA256
08483ce6784658b24cb29371f1741ce61a88c8239799737c87a094537404b28e

SHA512
8d2081181cecbda276f24934eb14f380cea8e7d133973c1313833e40b24540756e8d9002164acbda05f22c5970d2bbfbcd9fbaf182a839c915c37f3708db58f9

Download Submit
C:\Windows\System\QqXHLzm.exe

Filesize
1.9MB

MD5
c33ecd346d9e32b7245dad774985fb01

SHA1
9cb9249f91d0ca15b43055956e7349048401af0e

SHA256
8d61a415be34968516a07cc71c6f4addffb88aeb4137089f834e309e2dcbbf0a

SHA512
0bb1673b945ea730b5c1e038836b749e038344ac5251d4b72a68beb026aa9fb3a416c0291396c4090df1016e27255a589834e750bc5e9ca90ed97a0a0278bd93

Download Submit
C:\Windows\System\SatPcay.exe

Filesize
1.9MB

MD5
d5b821da4dd2e3f557fed8bd49f05963

SHA1
b91b6e039fcf34bd40298252aefea1696ad584b7

SHA256
318b39c26dd46105c4d120acc9fba7dccc6c86f2b762ba555098b912ae98ed56

SHA512
fe3149810c5363867d147947974f042493a6de14511118a6df3d52e88981b220b3e09c981cc9e084ce50c9d87ab151c0085396bab2bd9fcaf2ec7a4bce865cce

Download Submit
C:\Windows\System\TJaqROH.exe

Filesize
18B

MD5
451875d077f89a781c341dc3831c3853

SHA1
e3abb9ba14e839b78c87d5c9865f61a5b3abc99f

SHA256
8221ec2e42bc4ee384d901916f7c5e57c95f59e7dd5f007cea530df57da34b08

SHA512
2c396c951ac9ee6844bd3a1c36b8e6cdd7ca3115c3d64d96a50b1dba414358d8d73fcd9a996abb179a6b6268e55aad9fecfac9439bdd33db84af20844a078169

Download Submit
C:\Windows\System\UMeZuSO.exe

Filesize
1.9MB

MD5
3d65fea1646487ea7e2dd9a930713c85

SHA1
7a6db3173a050a3595eae2807674cdb2c67e609b

SHA256
36da48b9f204438c3dace5bc45af09163537194bc91fc098a255e6ddc76e8d90

SHA512
bb3f8d46452202cae2a1853ace885eb5a0cb10e56a2590ce46b432532addfc207abcbb99413624f0317e0d37f0800d9b24b7bbb9abc750da690e8df3936514d5

Download Submit
C:\Windows\System\VVGBoQc.exe

Filesize
1.9MB

MD5
408db371b1640a71c804be9449bec7d4

SHA1
4c5ecf7494dbd67d2f2862b0b30ba305a92158d3

SHA256
44caa5cc77f7e821fa15b93838b0a3f432edadf4e00df3019aaa5392bb427376

SHA512
e5c337eafeac78e78ecc1152437a399a07d006cbbd22b96badefae6036f3cc1a0c8d5d018ca55c496af541788a65b256c800ce50a1c7c793f7b3569483dba542

Download Submit
C:\Windows\System\WEakHjC.exe

Filesize
1.9MB

MD5
4ea495c3add2e9933373151fe91891af

SHA1
f4efabf1ff9fb282f88c30b209f645c4080b8107

SHA256
0227847ac72e2e3afa757f6cd0aad8432f307a646d9633a6c7d9c42bae1fcb91

SHA512
8aafcef841f34c22099f346cfc603216261bf19b0d54c807ac8ba27efd638aa42f6b503c46e1c9c59db1aa6fdde5bef06b14a6c65a6372e359c8f9dcff8dd6c2

Download Submit
C:\Windows\System\XaDzgqp.exe

Filesize
1.9MB

MD5
e5e67b9842f0c81f73b2a07f0624e69c

SHA1
32b448fc2a1260d1f1fad24ba2b8c57b968e18b2

SHA256
f710cbf310ff16ba347480e944486b280738079b54e5d292e56d27dcd97416e1

SHA512
669326f18511cf97a6b6264d54a3dd388a605bf02088d359ebceea1967980024703c90a7becea06bd07f50e8158c5181c1f9ab1f5efa66c5c7cf7e6e28a239bf

Download Submit
C:\Windows\System\axZEZdd.exe

Filesize
1.9MB

MD5
c57bec86b203d4e990ef76160cd962c2

SHA1
6307df647208a9ecfc4d6a43bb190aca8474856c

SHA256
b1269b7b1c84ee1c64ddab9023c3f4b44a50c7bd06a091bdb35c5684a18cfcbc

SHA512
cee025975718b3b3e9bd33d2812cf1441d5f5b66154a04c929b418c79d139d0812226d6691fb574e77e445ae868a00b21c82ed8e8af08688de0934f5ea3197f2

Download Submit
C:\Windows\System\dkIYTWX.exe

Filesize
1.9MB

MD5
c35a6a05ed513a74519624d70a82490c

SHA1
ea66323df32f88b794210e4e7237ee9ffb2c18df

SHA256
428f93409a47fe607215afcaef9022de3c2732bb7a56a02e768e1e5713d14e18

SHA512
fdc46166f25b31203f212f7edfd88de45c16904a0354b5504274574891b83a73edb2b4712d96ee7e9db4e4cb53c3cec25533d106b341b6aa7ce953401eaa31d2

Download Submit
C:\Windows\System\iFKKLZq.exe

Filesize
1.9MB

MD5
b51be74aea4c90e9f726c874f3af387f

SHA1
109e5692d2be1133610241411b30dfc313461e74

SHA256
8ff8302daf730e7d745db2d4df1bd9fcff13592aae7fa7905e53a83bdb3936c1

SHA512
3fb8adbb44585392e832002d6133627e732d8cc02cd98b102baf3fbb7b2577e5ca4a3765db428e03bcf34e27125d397065261504188561427b0e9b0003925a7a

Download Submit
C:\Windows\System\iRuKVbZ.exe

Filesize
1.9MB

MD5
7ec2cf8164639b581d93fdbd5cfceadb

SHA1
7e4b725f4952f14273685725513f1440cb51e26e

SHA256
3b8e49a3624086fd609b979f7d717e9978b340db28f256a54a5ad8f2e81ddc58

SHA512
4362f0dffadabb77aca4fce6b672d0cc3fe0876380160b1c27c9249c54bf69970d469f408335a3630b9a88414fbeb778801d5b40c1d5f37de0a4e5e28abb96cb

Download Submit
C:\Windows\System\juNnCkM.exe

Filesize
1.9MB

MD5
4319b6dcf30cb2594ad03d0d5133f377

SHA1
c14e27248ed7c82722cab498908d01ae05cee21d

SHA256
cc2a1e93b0b7e82e7ba20db5b9013db3e61dc887171c751cb01ef7d4916c0eab

SHA512
3176654f00e98da67a841e6192638209828fbf6305cb355436724c5895b02eee1aad3c680457549009c3ebad1b62af28167b622d06695814455b024715102e70

Download Submit
C:\Windows\System\kPuNfOl.exe

Filesize
1.9MB

MD5
2a3494afca29e46ec715478e6817c413

SHA1
613c6a83e75787f692029d58b2f345b37d1890a1

SHA256
956e21bb3c52b588d23d018fa7af99389c5cdf273f1b26428985b1bd294029fc

SHA512
1c7056e2e6bd254f0ca3b2230bb426c36deede84cec15a7f0ef40ad7bb4047a418e28e9bef9da64460f79eec3a03ec8140480cf1a61454d6e1e24e3626d8ae29

Download Submit
C:\Windows\System\lSJxDQj.exe

Filesize
1.9MB

MD5
421bc83b956c87d2ae955289cc30251b

SHA1
62e5e36d3c14ff32678942065abb5403df345a37

SHA256
fa55224f3b3ca3fa8a1f9ee96b033758d9704b21665768f58ba961c9e6291ac7

SHA512
7d85b54f9a12bdf58a246b8b3390dfde0cb9fdab541c488c02202885c6212e4d6178ccd3e69bb76f5d77c734d76eaa1988135c82a0bebc085995b6b7086ab12e

Download Submit
C:\Windows\System\muPnjuh.exe

Filesize
1.9MB

MD5
f6dc924e1e38a8376381ca2bf1f0b4fe

SHA1
844d06213ba4c0c0f5eabbeec037c9e6ef94a9e1

SHA256
044cf7f01eb4dce05ca84cc9c86f8a5a87be6c5b7ea799d80a49d11c8d71e14e

SHA512
4ec5f7ecfafbf13a1c6d6abc7d5eed3e6bc4a8cfa1eaae5988f8b0de1077f2ab7f3bad67b27effc08cce7dc527eb8100c4c9e41c02b640a0952f767d4dc69af2

Download Submit
C:\Windows\System\nDIfPeQ.exe

Filesize
1.9MB

MD5
e3660666f1329895c34833a16a0715b4

SHA1
90adb161726ba5040cf684aab12a0b53bf9bd718

SHA256
5a34534357df9f7be304e13b5b337c6755325f3371b59ec5ea891370ffa35b1b

SHA512
e831202e4c5ae1469e7f7122e16a1986d99f90dce9402849a3eeae94e0b2bdd88303d9c22bdbb3aeb5a41aab5f780862e9382d04c123caedf04c383995207880

Download Submit
C:\Windows\System\ndcPrni.exe

Filesize
1.9MB

MD5
b89f3ed68100759c879a1bb8ce05548f

SHA1
96259ae3e61584d7137b095d58a1995937dd29bb

SHA256
af49f9541ac6e14dd956c2cc2e240614ccc0672e73df23206459b583b15eafcd

SHA512
877871a57448f55425e1c293a446e9be387948bacad8e3abe48de9ce8e2dfa3ecf3baeb110a1e0b3a920fc1beb96e7d86f4a1c22d1a34cc8fe39759bedfeda26

Download Submit
C:\Windows\System\noxjbab.exe

Filesize
1.9MB

MD5
1c6fb718d2437fcf022e47b775af4604

SHA1
06907aa184b9e6c0c7816b25613ae9bedd1c3861

SHA256
8a0131f958c3a66a4ced59a5c71efc56137fedc06bfcee55b0b3012ca9d09f71

SHA512
7d7bdf89d9514f3420aceefd38342ccf806d13c0ea119d026bd02fd7be093d1fe1761376201ca1c94474c36be8ef76294f15ee8663ce8e38acfc6411a56964db

Download Submit
C:\Windows\System\pIageSO.exe

Filesize
1.9MB

MD5
38156af4c4fd827f0450e4565da20fc1

SHA1
fa467a018fbf1c805b246a785d9ebbef290a0829

SHA256
a3b275b0db6ea4ac2f23e28c4e75c2b61d14312aeb22a95096e460bc9ccd7983

SHA512
21010895b6dc493573b5487940be995758e77878795f4b3f73c45a1aaf6c64b7d8911ea0e9903ac5e7a11d84a97232554b133a73f5c6d0c65da41d5ba569f411

Download Submit
C:\Windows\System\pgkaHtE.exe

Filesize
1.9MB

MD5
c0d04111f3d5c35c489b0b7bfe6e3a3e

SHA1
e4f817d6565ad0b4926a5c3a8e2054f968206a96

SHA256
625c1350a1f4f999d30d9d0dd91cbace02ba29f15fa052a1007ae43c0da302e7

SHA512
7fe875b74f70f2bec457b7b653e769af430c5f59cdc4f80e82f6f8f67801290bee070c0914ef046e31e8f30ec11367ddc25de98f7566792e09cd7d69339f9b90

Download Submit
C:\Windows\System\puKqeRR.exe

Filesize
1.9MB

MD5
9c33c48b11f4ff0e6c1421110382f01c

SHA1
e57fe5ae85f008fc0248851d49ce1c75aa3b1b4c

SHA256
07bc54c339938dcf83b9abb2b8ea4453873ef35292f5a046e70d85120f5bc4ac

SHA512
2b6e6655473408686f1cb3361890a7b7094497795a469f5754702f50c27c698ade1485061d9e93870378a4e3adba94153ad6cde868a50d9d8c0dbceafc40532c

Download Submit
C:\Windows\System\qcfDhbP.exe

Filesize
1.9MB

MD5
262f6f9bb3b040d75e59c8ef4b5b9599

SHA1
51cdefdbb6acca92aa84b32f9bc8fce5d7b6ab22

SHA256
6d174cf5c10dbe242ed2577e2a32f8b96e47bdd1649923fdb2e6b412b8cc3af8

SHA512
3ea8051251e530d458f72e04c32056b4cbafc2faf45063d3b343ecf95ed09bc36d92b2ea4616f0a150ab9a5c12ae1c06b47492affc60a3cccfaa3c4711c11a22

Download Submit
C:\Windows\System\sPlalGT.exe

Filesize
1.9MB

MD5
5a8297f41ce38240f49f6bf13fdfc1e0

SHA1
cc352b64b9095901e87baaee5724207f50f2fce8

SHA256
90cc0182118e5d63ff1e4ea5863cef17c395476571c881661148f78593ed569b

SHA512
0fbe7426dfe85c77ca5a2610244cab72fd45f061eb4fd64758604506c93a256f154f376fa98b2817245addbb1e0fa17465d9e12d77923680275c1f73bc38761d

Download Submit
C:\Windows\System\sccWpow.exe

Filesize
1.9MB

MD5
ce1fcab4280730ca900f77bfe4619312

SHA1
f847e643f5f4bec74aa3f319ffa5f63d379bfc99

SHA256
9702e4bca54ad9b9669f8933071faee61108c56378b0890d84296e10d9d7d628

SHA512
0e97ca645479d43d4058506dab0ab374deaf36505867de53f53f708af73339d53df35adacb919faa56b09d56d28dcfec43499e0208904cddaa38107b87bdc2df

Download Submit
C:\Windows\System\uOZTNnE.exe

Filesize
1.9MB

MD5
d8987580fbb56d1c7c2ad66d17299735

SHA1
9a437a16741b1175c0f90af6f05153f5f1225d6e

SHA256
c3429bbd3dba0a146cf59c22cc99f4bdc5bd354b8145d3968294c89ef4ccee17

SHA512
a46819e36bc671ac842965ade34b5e1aff5254ff14fb20df3263a3caa7296c38f884deba2ace8a7c54a4db615825f40853390454337e69def788fe3603d46f41

Download Submit
C:\Windows\System\uPVydSd.exe

Filesize
1.9MB

MD5
fea7bbf1de87ffd01304d2667d32015d

SHA1
77cc2d885fa66d883ed769c45ca40e0c4a77b2e9

SHA256
dd747dd7877629e1de4488c6072312580b1ba49f4170a8e51ed506a52ddd46e6

SHA512
2c85f2229adfd8089d17c6b37cfcb41c198ec90df741480213ef0dd04be4194703330cf1cf9f57c48ca860bbebedaf695da12a63b333cc895bebedf10d25a6a1

Download Submit
C:\Windows\System\upDxJcs.exe

Filesize
1.9MB

MD5
87a6c895aa980d3c0a280493b5f426a3

SHA1
aa2774558223f31c44f443fbd546b2d165de3418

SHA256
4b0ab5130d965f0ceb712619223ff527c024b211f3d1a94a2e4f882eca776082

SHA512
cc4890b748b36d5ea0b44853298378e1db91f6b0a45126dd0f9d893e276ab0f6b71ad58b2138ac59425a891a2802a677d69bc6daa49ff73a02975f55b59aa0bf

Download Submit
C:\Windows\System\vwDgacD.exe

Filesize
1.9MB

MD5
2f7ea0f2e90161ebc4c82a3d58de1403

SHA1
ea6084dce0e49106dfbf0ffb84f9da8d64cb27f8

SHA256
78c0c90e01eeb71b59fa79c9bcba334b8829e7a119356d83e242db9610172565

SHA512
b2a37902485baacd7414c6328ef4227bceece333640f897c7b3b62a0e1e4afe6ccf0c378551c589ed0bf6442689fe99e660431783b64a28e2bba4c08f0495c2e

Download Submit
C:\Windows\System\wAIJxHm.exe

Filesize
1.9MB

MD5
75ac7e5c99f2f16804ab44a786209d3f

SHA1
120d1db7f6532b9e24148afc8fdf9ec17acbe962

SHA256
202e79b7c80e95d6aca81dbc792b88e8717ec9b4427ee799122d79e1e7bc040f

SHA512
6e80a7525def5550cdaad0715d45659583d362bb0ca5223ae1824fc791f24913e6b052070fde51751edec0dfe853e4dd45a6a9338ba5d4d7bb62aaaad82e63d5

Download Submit
C:\Windows\System\wRnxYNo.exe

Filesize
1.9MB

MD5
bbb29e56e8ca8388857bbe694b0854d9

SHA1
b2ef27e61dc3d482d7bfe57ea4d095e4e229005d

SHA256
3e060cca03f957c3bb8d2a85dd9b49915bc5fe8562287164666f997d98940e2f

SHA512
dbc0b616cdfd3b5bc5788808486613064a8f2dac32d6d0848d15b5d2ec74a6e867aa9916fd92c20344b70cfdf6477ae6fde0eb7940ce4a4c905c7a8549425a43

Download Submit
memory/60-622-0x00007FF7E0CB0000-0x00007FF7E10A2000-memory.dmp

Filesize
3.9MB

Download
memory/652-208-0x00007FF6EE670000-0x00007FF6EEA62000-memory.dmp

Filesize
3.9MB

Download
memory/652-3086-0x00007FF6EE670000-0x00007FF6EEA62000-memory.dmp

Filesize
3.9MB

Download
memory/684-618-0x00007FF65A6D0000-0x00007FF65AAC2000-memory.dmp

Filesize
3.9MB

Download
memory/684-3070-0x00007FF65A6D0000-0x00007FF65AAC2000-memory.dmp

Filesize
3.9MB

Download
memory/768-404-0x00007FF6841C0000-0x00007FF6845B2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-540-0x00007FF6E0210000-0x00007FF6E0602000-memory.dmp

Filesize
3.9MB

Download
memory/1456-3279-0x00007FF6E0210000-0x00007FF6E0602000-memory.dmp

Filesize
3.9MB

Download
memory/1488-111-0x00007FF755C30000-0x00007FF756022000-memory.dmp

Filesize
3.9MB

Download
memory/1632-3223-0x00007FF7C51C0000-0x00007FF7C55B2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-448-0x00007FF7C51C0000-0x00007FF7C55B2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-21-0x00007FF7D5770000-0x00007FF7D5B62000-memory.dmp

Filesize
3.9MB

Download
memory/2116-572-0x00007FF7B9DF0000-0x00007FF7BA1E2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-112-0x00007FF6EDBA0000-0x00007FF6EDF92000-memory.dmp

Filesize
3.9MB

Download
memory/2136-3123-0x00007FF6EDBA0000-0x00007FF6EDF92000-memory.dmp

Filesize
3.9MB

Download
memory/2196-476-0x00007FF77F6A0000-0x00007FF77FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2196-3188-0x00007FF77F6A0000-0x00007FF77FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2468-388-0x00007FF6DD8E0000-0x00007FF6DDCD2000-memory.dmp

Filesize
3.9MB

Download
memory/3148-54-0x00007FFCC9A53000-0x00007FFCC9A55000-memory.dmp

Filesize
8KB

Download
memory/3148-161-0x000001F4DFF00000-0x000001F4DFF22000-memory.dmp

Filesize
136KB

Download
memory/3148-110-0x00007FFCC9A50000-0x00007FFCCA511000-memory.dmp

Filesize
10.8MB

Download
memory/3216-113-0x00007FF6AF3E0000-0x00007FF6AF7D2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-3109-0x00007FF6AF3E0000-0x00007FF6AF7D2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-3190-0x00007FF7528B0000-0x00007FF752CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-321-0x00007FF7528B0000-0x00007FF752CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3316-449-0x00007FF7F41A0000-0x00007FF7F4592000-memory.dmp

Filesize
3.9MB

Download
memory/3680-440-0x00007FF725760000-0x00007FF725B52000-memory.dmp

Filesize
3.9MB

Download
memory/3680-3217-0x00007FF725760000-0x00007FF725B52000-memory.dmp

Filesize
3.9MB

Download
memory/3684-52-0x00007FF7CA8E0000-0x00007FF7CACD2000-memory.dmp

Filesize
3.9MB

Download
memory/4052-556-0x00007FF7E9640000-0x00007FF7E9A32000-memory.dmp

Filesize
3.9MB

Download
memory/4052-3212-0x00007FF7E9640000-0x00007FF7E9A32000-memory.dmp

Filesize
3.9MB

Download
memory/4084-269-0x00007FF784780000-0x00007FF784B72000-memory.dmp

Filesize
3.9MB

Download
memory/4084-3140-0x00007FF784780000-0x00007FF784B72000-memory.dmp

Filesize
3.9MB

Download
memory/4416-0-0x00007FF718950000-0x00007FF718D42000-memory.dmp

Filesize
3.9MB

Download
memory/4416-1-0x0000027E95E20000-0x0000027E95E30000-memory.dmp

Filesize
64KB

Download
memory/4752-3107-0x00007FF784BF0000-0x00007FF784FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4752-253-0x00007FF784BF0000-0x00007FF784FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4824-532-0x00007FF695E30000-0x00007FF696222000-memory.dmp

Filesize
3.9MB

Download
memory/4976-3116-0x00007FF7844D0000-0x00007FF7848C2000-memory.dmp

Filesize
3.9MB

Download
memory/4976-162-0x00007FF7844D0000-0x00007FF7848C2000-memory.dmp

Filesize
3.9MB

Download
memory/5040-3273-0x00007FF6EF290000-0x00007FF6EF682000-memory.dmp

Filesize
3.9MB

Download
memory/5040-554-0x00007FF6EF290000-0x00007FF6EF682000-memory.dmp

Filesize
3.9MB

Download
memory/5092-3294-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp

Filesize
3.9MB

Download
memory/5092-623-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp

Filesize
3.9MB

Download