xmrig | 1e40af59069f4075086b4554507562e6ceae52cc1687c4fcd9a0a30cbaf655e7

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27fa828604b3f93a3241b73b74019ae0N.exe
Size

1.9MB
MD5

27fa828604b3f93a3241b73b74019ae0
SHA1

b63dcb801844978f51718d42f919362326e90a53
SHA256

1e40af59069f4075086b4554507562e6ceae52cc1687c4fcd9a0a30cbaf655e7
SHA512

2505edbc9e2d5ebae0223fefe7566e604941c4f843ee72e9dc970922fcb58fd0ea463f16646eb4136659e3270f65d14be6b2163332db51a44dcaae34581021c2
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTd7mCsY2YWIJJh6Egf/px:Lz071uv4BPMkFfdk2auTxw5x

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/1352-294-0x00007FF75B4F0000-0x00007FF75B8E2000-memory.dmp	xmrig
behavioral2/memory/2320-327-0x00007FF775E70000-0x00007FF776262000-memory.dmp	xmrig
behavioral2/memory/2032-332-0x00007FF7D9340000-0x00007FF7D9732000-memory.dmp	xmrig
behavioral2/memory/4320-333-0x00007FF6C9C80000-0x00007FF6CA072000-memory.dmp	xmrig
behavioral2/memory/3532-336-0x00007FF6CA520000-0x00007FF6CA912000-memory.dmp	xmrig
behavioral2/memory/3008-339-0x00007FF693A40000-0x00007FF693E32000-memory.dmp	xmrig
behavioral2/memory/4468-340-0x00007FF6722B0000-0x00007FF6726A2000-memory.dmp	xmrig
behavioral2/memory/2308-343-0x00007FF71FB80000-0x00007FF71FF72000-memory.dmp	xmrig
behavioral2/memory/680-347-0x00007FF642310000-0x00007FF642702000-memory.dmp	xmrig
behavioral2/memory/1456-353-0x00007FF60C350000-0x00007FF60C742000-memory.dmp	xmrig
behavioral2/memory/3400-365-0x00007FF69AE60000-0x00007FF69B252000-memory.dmp	xmrig
behavioral2/memory/1284-350-0x00007FF6467C0000-0x00007FF646BB2000-memory.dmp	xmrig
behavioral2/memory/3892-349-0x00007FF761B90000-0x00007FF761F82000-memory.dmp	xmrig
behavioral2/memory/2152-348-0x00007FF7425B0000-0x00007FF7429A2000-memory.dmp	xmrig
behavioral2/memory/4420-346-0x00007FF6A4940000-0x00007FF6A4D32000-memory.dmp	xmrig
behavioral2/memory/3908-345-0x00007FF61F810000-0x00007FF61FC02000-memory.dmp	xmrig
behavioral2/memory/2604-344-0x00007FF7531E0000-0x00007FF7535D2000-memory.dmp	xmrig
behavioral2/memory/3028-342-0x00007FF6040C0000-0x00007FF6044B2000-memory.dmp	xmrig
behavioral2/memory/3004-341-0x00007FF693890000-0x00007FF693C82000-memory.dmp	xmrig
behavioral2/memory/3704-338-0x00007FF775FD0000-0x00007FF7763C2000-memory.dmp	xmrig
behavioral2/memory/2404-337-0x00007FF68C3B0000-0x00007FF68C7A2000-memory.dmp	xmrig
behavioral2/memory/1052-335-0x00007FF60D3D0000-0x00007FF60D7C2000-memory.dmp	xmrig
behavioral2/memory/1508-334-0x00007FF7EE640000-0x00007FF7EEA32000-memory.dmp	xmrig
behavioral2/memory/1272-262-0x00007FF63E840000-0x00007FF63EC32000-memory.dmp	xmrig
behavioral2/memory/4320-3405-0x00007FF6C9C80000-0x00007FF6CA072000-memory.dmp	xmrig
behavioral2/memory/1052-3410-0x00007FF60D3D0000-0x00007FF60D7C2000-memory.dmp	xmrig
behavioral2/memory/1508-3435-0x00007FF7EE640000-0x00007FF7EEA32000-memory.dmp	xmrig
behavioral2/memory/2032-3425-0x00007FF7D9340000-0x00007FF7D9732000-memory.dmp	xmrig
behavioral2/memory/4468-3480-0x00007FF6722B0000-0x00007FF6726A2000-memory.dmp	xmrig
behavioral2/memory/2604-3497-0x00007FF7531E0000-0x00007FF7535D2000-memory.dmp	xmrig
behavioral2/memory/2308-3512-0x00007FF71FB80000-0x00007FF71FF72000-memory.dmp	xmrig
behavioral2/memory/3400-3542-0x00007FF69AE60000-0x00007FF69B252000-memory.dmp	xmrig
behavioral2/memory/3908-3548-0x00007FF61F810000-0x00007FF61FC02000-memory.dmp	xmrig
behavioral2/memory/680-3595-0x00007FF642310000-0x00007FF642702000-memory.dmp	xmrig
behavioral2/memory/3892-3560-0x00007FF761B90000-0x00007FF761F82000-memory.dmp	xmrig
behavioral2/memory/1284-3547-0x00007FF6467C0000-0x00007FF646BB2000-memory.dmp	xmrig
behavioral2/memory/3028-3557-0x00007FF6040C0000-0x00007FF6044B2000-memory.dmp	xmrig
behavioral2/memory/2152-3541-0x00007FF7425B0000-0x00007FF7429A2000-memory.dmp	xmrig
behavioral2/memory/4420-3537-0x00007FF6A4940000-0x00007FF6A4D32000-memory.dmp	xmrig
behavioral2/memory/3004-3500-0x00007FF693890000-0x00007FF693C82000-memory.dmp	xmrig
behavioral2/memory/3704-3489-0x00007FF775FD0000-0x00007FF7763C2000-memory.dmp	xmrig
behavioral2/memory/3008-3467-0x00007FF693A40000-0x00007FF693E32000-memory.dmp	xmrig
behavioral2/memory/2320-3409-0x00007FF775E70000-0x00007FF776262000-memory.dmp	xmrig
behavioral2/memory/1352-3414-0x00007FF75B4F0000-0x00007FF75B8E2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	3932	powershell.exe
13	3932	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3932	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1456	IHRtKKO.exe
1272	FjewxCg.exe
1352	YdDJimU.exe
2320	sDqXthh.exe
2032	vmMvldp.exe
4320	AavwJcX.exe
1508	unRJCsj.exe
1052	qcAbYEG.exe
3532	CvRhMbH.exe
2404	kRbxxwd.exe
3704	ciYPkyn.exe
3008	NUSvvhX.exe
4468	SckbuxI.exe
3004	IZNxbIZ.exe
3028	BtrFkrc.exe
2308	JqeJAOX.exe
2604	gIZAbXL.exe
3908	jYBBWYG.exe
4420	XlJsKqo.exe
680	GqmQAEn.exe
2152	gVLampK.exe
3892	whBiBYg.exe
3400	BzxsFnF.exe
1284	FnFKczB.exe
2240	YjqUAdF.exe
3912	sXkfGBg.exe
1764	fVsxWUA.exe
652	NTApQcE.exe
3640	aLaMRRZ.exe
3116	gsbieVd.exe
1856	XJqseNz.exe
3540	uMGYaha.exe
4060	iTmJoyi.exe
3992	MkrOwTu.exe
1348	UpcjlMD.exe
2696	zmGxGjw.exe
440	EoAmwVX.exe
2768	wDiVKgP.exe
1612	KrQPGNO.exe
2880	eHSKEjU.exe
3612	AvDafES.exe
3752	ouXOKpq.exe
3844	LyYZPzF.exe
4512	Kabejqj.exe
4448	KUThNAZ.exe
3068	nNUcwcL.exe
3836	SuxlzzV.exe
2792	AwwTXxH.exe
4980	xpMDmSL.exe
3848	poocbzW.exe
2980	ZlAaShC.exe
1344	QnaDuZC.exe
1536	zdmylDQ.exe
4632	AIyCNdD.exe
4292	mhujofH.exe
3268	SPElIXa.exe
5040	rUkZYBf.exe
2884	rlIQDYg.exe
2104	QJrHLgi.exe
3600	VGRNyCr.exe
2140	ycYpfnP.exe
2096	bpmCyUI.exe
4856	gnossBA.exe
1712	OvDRpOV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3372-0-0x00007FF7236C0000-0x00007FF723AB2000-memory.dmp	upx
behavioral2/files/0x000a00000002347c-6.dat	upx
behavioral2/files/0x00070000000234a1-8.dat	upx
behavioral2/files/0x00070000000234a0-11.dat	upx
behavioral2/files/0x00070000000234b4-112.dat	upx
behavioral2/files/0x00070000000234b3-107.dat	upx
behavioral2/files/0x000800000002349d-106.dat	upx
behavioral2/files/0x00070000000234b2-105.dat	upx
behavioral2/memory/1352-294-0x00007FF75B4F0000-0x00007FF75B8E2000-memory.dmp	upx
behavioral2/memory/2320-327-0x00007FF775E70000-0x00007FF776262000-memory.dmp	upx
behavioral2/memory/2032-332-0x00007FF7D9340000-0x00007FF7D9732000-memory.dmp	upx
behavioral2/memory/4320-333-0x00007FF6C9C80000-0x00007FF6CA072000-memory.dmp	upx
behavioral2/memory/3532-336-0x00007FF6CA520000-0x00007FF6CA912000-memory.dmp	upx
behavioral2/memory/3008-339-0x00007FF693A40000-0x00007FF693E32000-memory.dmp	upx
behavioral2/memory/4468-340-0x00007FF6722B0000-0x00007FF6726A2000-memory.dmp	upx
behavioral2/memory/2308-343-0x00007FF71FB80000-0x00007FF71FF72000-memory.dmp	upx
behavioral2/memory/680-347-0x00007FF642310000-0x00007FF642702000-memory.dmp	upx
behavioral2/memory/1456-353-0x00007FF60C350000-0x00007FF60C742000-memory.dmp	upx
behavioral2/memory/3400-365-0x00007FF69AE60000-0x00007FF69B252000-memory.dmp	upx
behavioral2/memory/1284-350-0x00007FF6467C0000-0x00007FF646BB2000-memory.dmp	upx
behavioral2/memory/3892-349-0x00007FF761B90000-0x00007FF761F82000-memory.dmp	upx
behavioral2/memory/2152-348-0x00007FF7425B0000-0x00007FF7429A2000-memory.dmp	upx
behavioral2/memory/4420-346-0x00007FF6A4940000-0x00007FF6A4D32000-memory.dmp	upx
behavioral2/memory/3908-345-0x00007FF61F810000-0x00007FF61FC02000-memory.dmp	upx
behavioral2/memory/2604-344-0x00007FF7531E0000-0x00007FF7535D2000-memory.dmp	upx
behavioral2/memory/3028-342-0x00007FF6040C0000-0x00007FF6044B2000-memory.dmp	upx
behavioral2/memory/3004-341-0x00007FF693890000-0x00007FF693C82000-memory.dmp	upx
behavioral2/memory/3704-338-0x00007FF775FD0000-0x00007FF7763C2000-memory.dmp	upx
behavioral2/memory/2404-337-0x00007FF68C3B0000-0x00007FF68C7A2000-memory.dmp	upx
behavioral2/memory/1052-335-0x00007FF60D3D0000-0x00007FF60D7C2000-memory.dmp	upx
behavioral2/memory/1508-334-0x00007FF7EE640000-0x00007FF7EEA32000-memory.dmp	upx
behavioral2/memory/1272-262-0x00007FF63E840000-0x00007FF63EC32000-memory.dmp	upx
behavioral2/files/0x00070000000234c4-199.dat	upx
behavioral2/files/0x00070000000234b5-193.dat	upx
behavioral2/files/0x00070000000234c3-189.dat	upx
behavioral2/files/0x00070000000234c2-184.dat	upx
behavioral2/files/0x00070000000234c1-181.dat	upx
behavioral2/files/0x00070000000234bb-180.dat	upx
behavioral2/files/0x00070000000234ae-178.dat	upx
behavioral2/files/0x00070000000234b9-167.dat	upx
behavioral2/files/0x00070000000234b8-163.dat	upx
behavioral2/files/0x00070000000234c0-159.dat	upx
behavioral2/files/0x00070000000234b1-155.dat	upx
behavioral2/files/0x00070000000234b7-152.dat	upx
behavioral2/files/0x00070000000234bc-149.dat	upx
behavioral2/files/0x00070000000234b6-197.dat	upx
behavioral2/files/0x00070000000234af-142.dat	upx
behavioral2/files/0x00070000000234ba-134.dat	upx
behavioral2/files/0x00070000000234ac-133.dat	upx
behavioral2/files/0x00070000000234ad-132.dat	upx
behavioral2/files/0x00070000000234b0-94.dat	upx
behavioral2/files/0x00070000000234a8-87.dat	upx
behavioral2/files/0x00070000000234a7-83.dat	upx
behavioral2/files/0x00070000000234aa-70.dat	upx
behavioral2/files/0x00070000000234a9-66.dat	upx
behavioral2/files/0x00070000000234ab-73.dat	upx
behavioral2/files/0x00070000000234a5-55.dat	upx
behavioral2/files/0x00070000000234a3-48.dat	upx
behavioral2/files/0x00070000000234a6-40.dat	upx
behavioral2/files/0x00070000000234a4-33.dat	upx
behavioral2/files/0x00070000000234a2-17.dat	upx
behavioral2/memory/4320-3405-0x00007FF6C9C80000-0x00007FF6CA072000-memory.dmp	upx
behavioral2/memory/1052-3410-0x00007FF60D3D0000-0x00007FF60D7C2000-memory.dmp	upx
behavioral2/memory/1508-3435-0x00007FF7EE640000-0x00007FF7EEA32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ySAeEJA.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\UGgnOjE.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\ZZveZCL.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\kURCJIl.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\lJzgRke.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\jQijDCS.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\MqzXgxg.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\ovIVKXJ.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\BfNHdui.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\QohMLwq.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\kLDcrGM.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\pjTSoWp.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\tfePWDn.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\rtuzWXz.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\NHRKvUM.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\ccFhiGT.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\ksmlZxu.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\lNPgWqu.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\VYrtnnd.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\kJulzAi.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\FdxOLog.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\LCuxnjP.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\YgdLJIY.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\gJogwnA.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\jkqgCPn.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\vSSKbwB.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\apJnYuu.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\wmXNaFL.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\NqTTcyH.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\FnGnket.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\msbsFNb.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\TjDEPrC.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\oxYbyMq.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\XKCRZDu.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\OWZNGkx.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\pfaOphN.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\KmfermV.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\MCtbCtD.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\EdIvMGx.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\gsTYbBk.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\dCMttTL.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\cexJOAp.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\wBqkVKC.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\EpeSbAc.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\SebCkkh.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\TLoVytZ.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\ZqHHlVS.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\GjOgzHY.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\HDSKZaP.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\vuPlzIZ.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\OwrJPWn.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\qAbClXw.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\VpphrSj.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\prRKCVd.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\CQNkyzh.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\jcphMiG.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\psuPMOg.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\wtUmCWW.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\ebpvsRT.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\kHaXhsp.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\JijIiSo.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\qtSaLoI.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\eOBJplV.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\heaDeBa.exe	27fa828604b3f93a3241b73b74019ae0N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3372	27fa828604b3f93a3241b73b74019ae0N.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeLockMemoryPrivilege	3372	27fa828604b3f93a3241b73b74019ae0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3932	3372	27fa828604b3f93a3241b73b74019ae0N.exe	85
PID 3372 wrote to memory of 3932	3372	27fa828604b3f93a3241b73b74019ae0N.exe	85
PID 3372 wrote to memory of 1456	3372	27fa828604b3f93a3241b73b74019ae0N.exe	86
PID 3372 wrote to memory of 1456	3372	27fa828604b3f93a3241b73b74019ae0N.exe	86
PID 3372 wrote to memory of 1272	3372	27fa828604b3f93a3241b73b74019ae0N.exe	87
PID 3372 wrote to memory of 1272	3372	27fa828604b3f93a3241b73b74019ae0N.exe	87
PID 3372 wrote to memory of 1352	3372	27fa828604b3f93a3241b73b74019ae0N.exe	88
PID 3372 wrote to memory of 1352	3372	27fa828604b3f93a3241b73b74019ae0N.exe	88
PID 3372 wrote to memory of 2320	3372	27fa828604b3f93a3241b73b74019ae0N.exe	89
PID 3372 wrote to memory of 2320	3372	27fa828604b3f93a3241b73b74019ae0N.exe	89
PID 3372 wrote to memory of 2032	3372	27fa828604b3f93a3241b73b74019ae0N.exe	90
PID 3372 wrote to memory of 2032	3372	27fa828604b3f93a3241b73b74019ae0N.exe	90
PID 3372 wrote to memory of 4320	3372	27fa828604b3f93a3241b73b74019ae0N.exe	91
PID 3372 wrote to memory of 4320	3372	27fa828604b3f93a3241b73b74019ae0N.exe	91
PID 3372 wrote to memory of 1508	3372	27fa828604b3f93a3241b73b74019ae0N.exe	92
PID 3372 wrote to memory of 1508	3372	27fa828604b3f93a3241b73b74019ae0N.exe	92
PID 3372 wrote to memory of 1052	3372	27fa828604b3f93a3241b73b74019ae0N.exe	93
PID 3372 wrote to memory of 1052	3372	27fa828604b3f93a3241b73b74019ae0N.exe	93
PID 3372 wrote to memory of 3532	3372	27fa828604b3f93a3241b73b74019ae0N.exe	94
PID 3372 wrote to memory of 3532	3372	27fa828604b3f93a3241b73b74019ae0N.exe	94
PID 3372 wrote to memory of 3008	3372	27fa828604b3f93a3241b73b74019ae0N.exe	95
PID 3372 wrote to memory of 3008	3372	27fa828604b3f93a3241b73b74019ae0N.exe	95
PID 3372 wrote to memory of 4468	3372	27fa828604b3f93a3241b73b74019ae0N.exe	96
PID 3372 wrote to memory of 4468	3372	27fa828604b3f93a3241b73b74019ae0N.exe	96
PID 3372 wrote to memory of 2404	3372	27fa828604b3f93a3241b73b74019ae0N.exe	97
PID 3372 wrote to memory of 2404	3372	27fa828604b3f93a3241b73b74019ae0N.exe	97
PID 3372 wrote to memory of 3704	3372	27fa828604b3f93a3241b73b74019ae0N.exe	98
PID 3372 wrote to memory of 3704	3372	27fa828604b3f93a3241b73b74019ae0N.exe	98
PID 3372 wrote to memory of 4420	3372	27fa828604b3f93a3241b73b74019ae0N.exe	99
PID 3372 wrote to memory of 4420	3372	27fa828604b3f93a3241b73b74019ae0N.exe	99
PID 3372 wrote to memory of 3004	3372	27fa828604b3f93a3241b73b74019ae0N.exe	100
PID 3372 wrote to memory of 3004	3372	27fa828604b3f93a3241b73b74019ae0N.exe	100
PID 3372 wrote to memory of 3028	3372	27fa828604b3f93a3241b73b74019ae0N.exe	101
PID 3372 wrote to memory of 3028	3372	27fa828604b3f93a3241b73b74019ae0N.exe	101
PID 3372 wrote to memory of 2308	3372	27fa828604b3f93a3241b73b74019ae0N.exe	102
PID 3372 wrote to memory of 2308	3372	27fa828604b3f93a3241b73b74019ae0N.exe	102
PID 3372 wrote to memory of 2604	3372	27fa828604b3f93a3241b73b74019ae0N.exe	103
PID 3372 wrote to memory of 2604	3372	27fa828604b3f93a3241b73b74019ae0N.exe	103
PID 3372 wrote to memory of 3908	3372	27fa828604b3f93a3241b73b74019ae0N.exe	104
PID 3372 wrote to memory of 3908	3372	27fa828604b3f93a3241b73b74019ae0N.exe	104
PID 3372 wrote to memory of 680	3372	27fa828604b3f93a3241b73b74019ae0N.exe	105
PID 3372 wrote to memory of 680	3372	27fa828604b3f93a3241b73b74019ae0N.exe	105
PID 3372 wrote to memory of 2152	3372	27fa828604b3f93a3241b73b74019ae0N.exe	106
PID 3372 wrote to memory of 2152	3372	27fa828604b3f93a3241b73b74019ae0N.exe	106
PID 3372 wrote to memory of 3892	3372	27fa828604b3f93a3241b73b74019ae0N.exe	107
PID 3372 wrote to memory of 3892	3372	27fa828604b3f93a3241b73b74019ae0N.exe	107
PID 3372 wrote to memory of 3400	3372	27fa828604b3f93a3241b73b74019ae0N.exe	108
PID 3372 wrote to memory of 3400	3372	27fa828604b3f93a3241b73b74019ae0N.exe	108
PID 3372 wrote to memory of 1284	3372	27fa828604b3f93a3241b73b74019ae0N.exe	109
PID 3372 wrote to memory of 1284	3372	27fa828604b3f93a3241b73b74019ae0N.exe	109
PID 3372 wrote to memory of 2240	3372	27fa828604b3f93a3241b73b74019ae0N.exe	110
PID 3372 wrote to memory of 2240	3372	27fa828604b3f93a3241b73b74019ae0N.exe	110
PID 3372 wrote to memory of 3912	3372	27fa828604b3f93a3241b73b74019ae0N.exe	111
PID 3372 wrote to memory of 3912	3372	27fa828604b3f93a3241b73b74019ae0N.exe	111
PID 3372 wrote to memory of 1764	3372	27fa828604b3f93a3241b73b74019ae0N.exe	112
PID 3372 wrote to memory of 1764	3372	27fa828604b3f93a3241b73b74019ae0N.exe	112
PID 3372 wrote to memory of 3540	3372	27fa828604b3f93a3241b73b74019ae0N.exe	113
PID 3372 wrote to memory of 3540	3372	27fa828604b3f93a3241b73b74019ae0N.exe	113
PID 3372 wrote to memory of 652	3372	27fa828604b3f93a3241b73b74019ae0N.exe	114
PID 3372 wrote to memory of 652	3372	27fa828604b3f93a3241b73b74019ae0N.exe	114
PID 3372 wrote to memory of 3640	3372	27fa828604b3f93a3241b73b74019ae0N.exe	115
PID 3372 wrote to memory of 3640	3372	27fa828604b3f93a3241b73b74019ae0N.exe	115
PID 3372 wrote to memory of 3116	3372	27fa828604b3f93a3241b73b74019ae0N.exe	116
PID 3372 wrote to memory of 3116	3372	27fa828604b3f93a3241b73b74019ae0N.exe	116

C:\Users\Admin\AppData\Local\Temp\27fa828604b3f93a3241b73b74019ae0N.exe
"C:\Users\Admin\AppData\Local\Temp\27fa828604b3f93a3241b73b74019ae0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3932" "2836" "2780" "2840" "0" "0" "2844" "0" "0" "0" "0" "0"
    3⤵
    PID:9264
- C:\Windows\System\IHRtKKO.exe
  C:\Windows\System\IHRtKKO.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\FjewxCg.exe
  C:\Windows\System\FjewxCg.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\YdDJimU.exe
  C:\Windows\System\YdDJimU.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\sDqXthh.exe
  C:\Windows\System\sDqXthh.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\vmMvldp.exe
  C:\Windows\System\vmMvldp.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\AavwJcX.exe
  C:\Windows\System\AavwJcX.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\unRJCsj.exe
  C:\Windows\System\unRJCsj.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\qcAbYEG.exe
  C:\Windows\System\qcAbYEG.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\CvRhMbH.exe
  C:\Windows\System\CvRhMbH.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\NUSvvhX.exe
  C:\Windows\System\NUSvvhX.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\SckbuxI.exe
  C:\Windows\System\SckbuxI.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\kRbxxwd.exe
  C:\Windows\System\kRbxxwd.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\ciYPkyn.exe
  C:\Windows\System\ciYPkyn.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\XlJsKqo.exe
  C:\Windows\System\XlJsKqo.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\IZNxbIZ.exe
  C:\Windows\System\IZNxbIZ.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\BtrFkrc.exe
  C:\Windows\System\BtrFkrc.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\JqeJAOX.exe
  C:\Windows\System\JqeJAOX.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\gIZAbXL.exe
  C:\Windows\System\gIZAbXL.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\jYBBWYG.exe
  C:\Windows\System\jYBBWYG.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\GqmQAEn.exe
  C:\Windows\System\GqmQAEn.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\gVLampK.exe
  C:\Windows\System\gVLampK.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\whBiBYg.exe
  C:\Windows\System\whBiBYg.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\BzxsFnF.exe
  C:\Windows\System\BzxsFnF.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\FnFKczB.exe
  C:\Windows\System\FnFKczB.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\YjqUAdF.exe
  C:\Windows\System\YjqUAdF.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\sXkfGBg.exe
  C:\Windows\System\sXkfGBg.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\fVsxWUA.exe
  C:\Windows\System\fVsxWUA.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\uMGYaha.exe
  C:\Windows\System\uMGYaha.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\NTApQcE.exe
  C:\Windows\System\NTApQcE.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\aLaMRRZ.exe
  C:\Windows\System\aLaMRRZ.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\gsbieVd.exe
  C:\Windows\System\gsbieVd.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\eHSKEjU.exe
  C:\Windows\System\eHSKEjU.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\XJqseNz.exe
  C:\Windows\System\XJqseNz.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\iTmJoyi.exe
  C:\Windows\System\iTmJoyi.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\MkrOwTu.exe
  C:\Windows\System\MkrOwTu.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\UpcjlMD.exe
  C:\Windows\System\UpcjlMD.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\zmGxGjw.exe
  C:\Windows\System\zmGxGjw.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\EoAmwVX.exe
  C:\Windows\System\EoAmwVX.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\wDiVKgP.exe
  C:\Windows\System\wDiVKgP.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\KrQPGNO.exe
  C:\Windows\System\KrQPGNO.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\AvDafES.exe
  C:\Windows\System\AvDafES.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ouXOKpq.exe
  C:\Windows\System\ouXOKpq.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\LyYZPzF.exe
  C:\Windows\System\LyYZPzF.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\Kabejqj.exe
  C:\Windows\System\Kabejqj.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\KUThNAZ.exe
  C:\Windows\System\KUThNAZ.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\nNUcwcL.exe
  C:\Windows\System\nNUcwcL.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\SuxlzzV.exe
  C:\Windows\System\SuxlzzV.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\AwwTXxH.exe
  C:\Windows\System\AwwTXxH.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\xpMDmSL.exe
  C:\Windows\System\xpMDmSL.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\poocbzW.exe
  C:\Windows\System\poocbzW.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\ZlAaShC.exe
  C:\Windows\System\ZlAaShC.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\QnaDuZC.exe
  C:\Windows\System\QnaDuZC.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\zdmylDQ.exe
  C:\Windows\System\zdmylDQ.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\AIyCNdD.exe
  C:\Windows\System\AIyCNdD.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\mhujofH.exe
  C:\Windows\System\mhujofH.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\SPElIXa.exe
  C:\Windows\System\SPElIXa.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\rUkZYBf.exe
  C:\Windows\System\rUkZYBf.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\BXRocvc.exe
  C:\Windows\System\BXRocvc.exe
  2⤵
  PID:1452
- C:\Windows\System\uaKRuEG.exe
  C:\Windows\System\uaKRuEG.exe
  2⤵
  PID:1492
- C:\Windows\System\Vtktqyr.exe
  C:\Windows\System\Vtktqyr.exe
  2⤵
  PID:1836
- C:\Windows\System\MNaSWZr.exe
  C:\Windows\System\MNaSWZr.exe
  2⤵
  PID:1228
- C:\Windows\System\FdYCjEq.exe
  C:\Windows\System\FdYCjEq.exe
  2⤵
  PID:3200
- C:\Windows\System\rlIQDYg.exe
  C:\Windows\System\rlIQDYg.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\QJrHLgi.exe
  C:\Windows\System\QJrHLgi.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\VGRNyCr.exe
  C:\Windows\System\VGRNyCr.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\ycYpfnP.exe
  C:\Windows\System\ycYpfnP.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\bpmCyUI.exe
  C:\Windows\System\bpmCyUI.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\gnossBA.exe
  C:\Windows\System\gnossBA.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\OvDRpOV.exe
  C:\Windows\System\OvDRpOV.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\eZrVCXF.exe
  C:\Windows\System\eZrVCXF.exe
  2⤵
  PID:3076
- C:\Windows\System\kxJxkDZ.exe
  C:\Windows\System\kxJxkDZ.exe
  2⤵
  PID:408
- C:\Windows\System\kRxhzTw.exe
  C:\Windows\System\kRxhzTw.exe
  2⤵
  PID:1276
- C:\Windows\System\VYYWhkV.exe
  C:\Windows\System\VYYWhkV.exe
  2⤵
  PID:4336
- C:\Windows\System\XDcumLB.exe
  C:\Windows\System\XDcumLB.exe
  2⤵
  PID:396
- C:\Windows\System\nhxSwbg.exe
  C:\Windows\System\nhxSwbg.exe
  2⤵
  PID:1976
- C:\Windows\System\SiJOLxD.exe
  C:\Windows\System\SiJOLxD.exe
  2⤵
  PID:1660
- C:\Windows\System\UTAyiSe.exe
  C:\Windows\System\UTAyiSe.exe
  2⤵
  PID:844
- C:\Windows\System\mOuyviC.exe
  C:\Windows\System\mOuyviC.exe
  2⤵
  PID:5128
- C:\Windows\System\FzCYEWR.exe
  C:\Windows\System\FzCYEWR.exe
  2⤵
  PID:5156
- C:\Windows\System\EpMbHQz.exe
  C:\Windows\System\EpMbHQz.exe
  2⤵
  PID:5172
- C:\Windows\System\uSSDReM.exe
  C:\Windows\System\uSSDReM.exe
  2⤵
  PID:5200
- C:\Windows\System\xwnyuFS.exe
  C:\Windows\System\xwnyuFS.exe
  2⤵
  PID:5256
- C:\Windows\System\odVtgNE.exe
  C:\Windows\System\odVtgNE.exe
  2⤵
  PID:5276
- C:\Windows\System\ochZqJJ.exe
  C:\Windows\System\ochZqJJ.exe
  2⤵
  PID:5296
- C:\Windows\System\CsBkeqV.exe
  C:\Windows\System\CsBkeqV.exe
  2⤵
  PID:5320
- C:\Windows\System\iFjSDaS.exe
  C:\Windows\System\iFjSDaS.exe
  2⤵
  PID:5340
- C:\Windows\System\kCycMmA.exe
  C:\Windows\System\kCycMmA.exe
  2⤵
  PID:5368
- C:\Windows\System\zLXtTvK.exe
  C:\Windows\System\zLXtTvK.exe
  2⤵
  PID:5384
- C:\Windows\System\PyUYuSf.exe
  C:\Windows\System\PyUYuSf.exe
  2⤵
  PID:5408
- C:\Windows\System\IBEhIlj.exe
  C:\Windows\System\IBEhIlj.exe
  2⤵
  PID:5436
- C:\Windows\System\datOqNZ.exe
  C:\Windows\System\datOqNZ.exe
  2⤵
  PID:5480
- C:\Windows\System\lPRpeOM.exe
  C:\Windows\System\lPRpeOM.exe
  2⤵
  PID:5516
- C:\Windows\System\Bzstflv.exe
  C:\Windows\System\Bzstflv.exe
  2⤵
  PID:5536
- C:\Windows\System\ipndsIE.exe
  C:\Windows\System\ipndsIE.exe
  2⤵
  PID:5556
- C:\Windows\System\tuKgECB.exe
  C:\Windows\System\tuKgECB.exe
  2⤵
  PID:5580
- C:\Windows\System\kBWQQAm.exe
  C:\Windows\System\kBWQQAm.exe
  2⤵
  PID:5724
- C:\Windows\System\mfHnJZF.exe
  C:\Windows\System\mfHnJZF.exe
  2⤵
  PID:5740
- C:\Windows\System\lXZeifD.exe
  C:\Windows\System\lXZeifD.exe
  2⤵
  PID:5756
- C:\Windows\System\lcPfbNJ.exe
  C:\Windows\System\lcPfbNJ.exe
  2⤵
  PID:5772
- C:\Windows\System\SPLOPcw.exe
  C:\Windows\System\SPLOPcw.exe
  2⤵
  PID:5788
- C:\Windows\System\LhRxbPM.exe
  C:\Windows\System\LhRxbPM.exe
  2⤵
  PID:5804
- C:\Windows\System\kWcuwMm.exe
  C:\Windows\System\kWcuwMm.exe
  2⤵
  PID:5824
- C:\Windows\System\mecKEwI.exe
  C:\Windows\System\mecKEwI.exe
  2⤵
  PID:5840
- C:\Windows\System\rrbxhIi.exe
  C:\Windows\System\rrbxhIi.exe
  2⤵
  PID:5864
- C:\Windows\System\aFQQMXf.exe
  C:\Windows\System\aFQQMXf.exe
  2⤵
  PID:5896
- C:\Windows\System\qCdQjNE.exe
  C:\Windows\System\qCdQjNE.exe
  2⤵
  PID:5920
- C:\Windows\System\RMIGzze.exe
  C:\Windows\System\RMIGzze.exe
  2⤵
  PID:5944
- C:\Windows\System\QcQQqBY.exe
  C:\Windows\System\QcQQqBY.exe
  2⤵
  PID:5976
- C:\Windows\System\BchUasL.exe
  C:\Windows\System\BchUasL.exe
  2⤵
  PID:6000
- C:\Windows\System\xOTmaeA.exe
  C:\Windows\System\xOTmaeA.exe
  2⤵
  PID:6016
- C:\Windows\System\heaDeBa.exe
  C:\Windows\System\heaDeBa.exe
  2⤵
  PID:6040
- C:\Windows\System\XJdvgMj.exe
  C:\Windows\System\XJdvgMj.exe
  2⤵
  PID:6060
- C:\Windows\System\kXkgRtZ.exe
  C:\Windows\System\kXkgRtZ.exe
  2⤵
  PID:6080
- C:\Windows\System\RzrquGn.exe
  C:\Windows\System\RzrquGn.exe
  2⤵
  PID:6104
- C:\Windows\System\lFyiEzr.exe
  C:\Windows\System\lFyiEzr.exe
  2⤵
  PID:6124
- C:\Windows\System\QrVjjeA.exe
  C:\Windows\System\QrVjjeA.exe
  2⤵
  PID:3692
- C:\Windows\System\RFIjziH.exe
  C:\Windows\System\RFIjziH.exe
  2⤵
  PID:1900
- C:\Windows\System\FqhBynu.exe
  C:\Windows\System\FqhBynu.exe
  2⤵
  PID:1048
- C:\Windows\System\ZVMkwXg.exe
  C:\Windows\System\ZVMkwXg.exe
  2⤵
  PID:4028
- C:\Windows\System\vanNrLK.exe
  C:\Windows\System\vanNrLK.exe
  2⤵
  PID:4936
- C:\Windows\System\Kzumfkw.exe
  C:\Windows\System\Kzumfkw.exe
  2⤵
  PID:2244
- C:\Windows\System\hbkAbZv.exe
  C:\Windows\System\hbkAbZv.exe
  2⤵
  PID:1464
- C:\Windows\System\VUnsYLs.exe
  C:\Windows\System\VUnsYLs.exe
  2⤵
  PID:4964
- C:\Windows\System\UsUvKVF.exe
  C:\Windows\System\UsUvKVF.exe
  2⤵
  PID:4240
- C:\Windows\System\TAbmRHJ.exe
  C:\Windows\System\TAbmRHJ.exe
  2⤵
  PID:4312
- C:\Windows\System\ULPYfdT.exe
  C:\Windows\System\ULPYfdT.exe
  2⤵
  PID:2164
- C:\Windows\System\FiEhXlV.exe
  C:\Windows\System\FiEhXlV.exe
  2⤵
  PID:5076
- C:\Windows\System\yBnzsPJ.exe
  C:\Windows\System\yBnzsPJ.exe
  2⤵
  PID:5376
- C:\Windows\System\TPOeXqG.exe
  C:\Windows\System\TPOeXqG.exe
  2⤵
  PID:2760
- C:\Windows\System\ooJTVBe.exe
  C:\Windows\System\ooJTVBe.exe
  2⤵
  PID:780
- C:\Windows\System\rcTzlrI.exe
  C:\Windows\System\rcTzlrI.exe
  2⤵
  PID:2624
- C:\Windows\System\nrbquNT.exe
  C:\Windows\System\nrbquNT.exe
  2⤵
  PID:2796
- C:\Windows\System\mDVAdrW.exe
  C:\Windows\System\mDVAdrW.exe
  2⤵
  PID:1384
- C:\Windows\System\peTRJGq.exe
  C:\Windows\System\peTRJGq.exe
  2⤵
  PID:5780
- C:\Windows\System\KsJjLhF.exe
  C:\Windows\System\KsJjLhF.exe
  2⤵
  PID:6156
- C:\Windows\System\YVKsdrd.exe
  C:\Windows\System\YVKsdrd.exe
  2⤵
  PID:6276
- C:\Windows\System\PHrIYBV.exe
  C:\Windows\System\PHrIYBV.exe
  2⤵
  PID:6296
- C:\Windows\System\SEyKthb.exe
  C:\Windows\System\SEyKthb.exe
  2⤵
  PID:6316
- C:\Windows\System\ChwtGLF.exe
  C:\Windows\System\ChwtGLF.exe
  2⤵
  PID:6332
- C:\Windows\System\scMuHBH.exe
  C:\Windows\System\scMuHBH.exe
  2⤵
  PID:6436
- C:\Windows\System\dDAxHTO.exe
  C:\Windows\System\dDAxHTO.exe
  2⤵
  PID:6452
- C:\Windows\System\sHXJOpO.exe
  C:\Windows\System\sHXJOpO.exe
  2⤵
  PID:6476
- C:\Windows\System\uWHyejo.exe
  C:\Windows\System\uWHyejo.exe
  2⤵
  PID:6504
- C:\Windows\System\ccFhiGT.exe
  C:\Windows\System\ccFhiGT.exe
  2⤵
  PID:6524
- C:\Windows\System\DOGszsv.exe
  C:\Windows\System\DOGszsv.exe
  2⤵
  PID:6552
- C:\Windows\System\wnbAxdx.exe
  C:\Windows\System\wnbAxdx.exe
  2⤵
  PID:6580
- C:\Windows\System\nVINeUH.exe
  C:\Windows\System\nVINeUH.exe
  2⤵
  PID:6608
- C:\Windows\System\BHlsdCZ.exe
  C:\Windows\System\BHlsdCZ.exe
  2⤵
  PID:6632
- C:\Windows\System\luKyFEt.exe
  C:\Windows\System\luKyFEt.exe
  2⤵
  PID:6660
- C:\Windows\System\MtOwuwm.exe
  C:\Windows\System\MtOwuwm.exe
  2⤵
  PID:6680
- C:\Windows\System\fvyeVoR.exe
  C:\Windows\System\fvyeVoR.exe
  2⤵
  PID:6712
- C:\Windows\System\bjrwfMY.exe
  C:\Windows\System\bjrwfMY.exe
  2⤵
  PID:6728
- C:\Windows\System\CmkymDo.exe
  C:\Windows\System\CmkymDo.exe
  2⤵
  PID:6752
- C:\Windows\System\AiGqZRO.exe
  C:\Windows\System\AiGqZRO.exe
  2⤵
  PID:6768
- C:\Windows\System\OVRHeaL.exe
  C:\Windows\System\OVRHeaL.exe
  2⤵
  PID:6784
- C:\Windows\System\jGLgTCt.exe
  C:\Windows\System\jGLgTCt.exe
  2⤵
  PID:6800
- C:\Windows\System\LGLFtjf.exe
  C:\Windows\System\LGLFtjf.exe
  2⤵
  PID:6820
- C:\Windows\System\FUAEArd.exe
  C:\Windows\System\FUAEArd.exe
  2⤵
  PID:6960
- C:\Windows\System\hNTTumn.exe
  C:\Windows\System\hNTTumn.exe
  2⤵
  PID:6984
- C:\Windows\System\PxKOvii.exe
  C:\Windows\System\PxKOvii.exe
  2⤵
  PID:7000
- C:\Windows\System\mOggVIa.exe
  C:\Windows\System\mOggVIa.exe
  2⤵
  PID:7020
- C:\Windows\System\CXLHcuI.exe
  C:\Windows\System\CXLHcuI.exe
  2⤵
  PID:7040
- C:\Windows\System\dnlYiBX.exe
  C:\Windows\System\dnlYiBX.exe
  2⤵
  PID:7060
- C:\Windows\System\TfOAvAA.exe
  C:\Windows\System\TfOAvAA.exe
  2⤵
  PID:7076
- C:\Windows\System\IXDNhjO.exe
  C:\Windows\System\IXDNhjO.exe
  2⤵
  PID:7096
- C:\Windows\System\MNshhTQ.exe
  C:\Windows\System\MNshhTQ.exe
  2⤵
  PID:7112
- C:\Windows\System\vRvhlsP.exe
  C:\Windows\System\vRvhlsP.exe
  2⤵
  PID:7128
- C:\Windows\System\arVYfAq.exe
  C:\Windows\System\arVYfAq.exe
  2⤵
  PID:5832
- C:\Windows\System\EQezoaf.exe
  C:\Windows\System\EQezoaf.exe
  2⤵
  PID:5880
- C:\Windows\System\OVydwGu.exe
  C:\Windows\System\OVydwGu.exe
  2⤵
  PID:5928
- C:\Windows\System\NKKjHVn.exe
  C:\Windows\System\NKKjHVn.exe
  2⤵
  PID:5972
- C:\Windows\System\NCRAnnc.exe
  C:\Windows\System\NCRAnnc.exe
  2⤵
  PID:6008
- C:\Windows\System\hfJXLxh.exe
  C:\Windows\System\hfJXLxh.exe
  2⤵
  PID:6088
- C:\Windows\System\zsTHCLw.exe
  C:\Windows\System\zsTHCLw.exe
  2⤵
  PID:4828
- C:\Windows\System\LofQwpy.exe
  C:\Windows\System\LofQwpy.exe
  2⤵
  PID:3212
- C:\Windows\System\EGRTpkE.exe
  C:\Windows\System\EGRTpkE.exe
  2⤵
  PID:5020
- C:\Windows\System\rHUHGDS.exe
  C:\Windows\System\rHUHGDS.exe
  2⤵
  PID:5236
- C:\Windows\System\juAwxCd.exe
  C:\Windows\System\juAwxCd.exe
  2⤵
  PID:5640
- C:\Windows\System\CZKLeHQ.exe
  C:\Windows\System\CZKLeHQ.exe
  2⤵
  PID:6312
- C:\Windows\System\LFqZleq.exe
  C:\Windows\System\LFqZleq.exe
  2⤵
  PID:6180
- C:\Windows\System\WxEvgjD.exe
  C:\Windows\System\WxEvgjD.exe
  2⤵
  PID:5424
- C:\Windows\System\RaEOsIo.exe
  C:\Windows\System\RaEOsIo.exe
  2⤵
  PID:5544
- C:\Windows\System\YagTmfh.exe
  C:\Windows\System\YagTmfh.exe
  2⤵
  PID:5796
- C:\Windows\System\GFloqRG.exe
  C:\Windows\System\GFloqRG.exe
  2⤵
  PID:6764
- C:\Windows\System\pjTSoWp.exe
  C:\Windows\System\pjTSoWp.exe
  2⤵
  PID:6348
- C:\Windows\System\ihlrJlj.exe
  C:\Windows\System\ihlrJlj.exe
  2⤵
  PID:6224
- C:\Windows\System\WZyjJTu.exe
  C:\Windows\System\WZyjJTu.exe
  2⤵
  PID:6264
- C:\Windows\System\zcirwSx.exe
  C:\Windows\System\zcirwSx.exe
  2⤵
  PID:7036
- C:\Windows\System\cevWTtf.exe
  C:\Windows\System\cevWTtf.exe
  2⤵
  PID:6832
- C:\Windows\System\Pyzgwuf.exe
  C:\Windows\System\Pyzgwuf.exe
  2⤵
  PID:1020
- C:\Windows\System\MckgNwt.exe
  C:\Windows\System\MckgNwt.exe
  2⤵
  PID:6792
- C:\Windows\System\vvifZsB.exe
  C:\Windows\System\vvifZsB.exe
  2⤵
  PID:6744
- C:\Windows\System\EFgWXVp.exe
  C:\Windows\System\EFgWXVp.exe
  2⤵
  PID:6652
- C:\Windows\System\AEMwXgW.exe
  C:\Windows\System\AEMwXgW.exe
  2⤵
  PID:6544
- C:\Windows\System\VPbhgsC.exe
  C:\Windows\System\VPbhgsC.exe
  2⤵
  PID:6484
- C:\Windows\System\CVPHAoA.exe
  C:\Windows\System\CVPHAoA.exe
  2⤵
  PID:6444
- C:\Windows\System\YrGSoWr.exe
  C:\Windows\System\YrGSoWr.exe
  2⤵
  PID:6904
- C:\Windows\System\bvjvBQp.exe
  C:\Windows\System\bvjvBQp.exe
  2⤵
  PID:7008
- C:\Windows\System\PFTMMPU.exe
  C:\Windows\System\PFTMMPU.exe
  2⤵
  PID:7108
- C:\Windows\System\FdxOLog.exe
  C:\Windows\System\FdxOLog.exe
  2⤵
  PID:1436
- C:\Windows\System\cyjpEhc.exe
  C:\Windows\System\cyjpEhc.exe
  2⤵
  PID:7208
- C:\Windows\System\jUCZwxm.exe
  C:\Windows\System\jUCZwxm.exe
  2⤵
  PID:7224
- C:\Windows\System\zUqQTnX.exe
  C:\Windows\System\zUqQTnX.exe
  2⤵
  PID:7248
- C:\Windows\System\tXrXUpS.exe
  C:\Windows\System\tXrXUpS.exe
  2⤵
  PID:7264
- C:\Windows\System\oKBVspH.exe
  C:\Windows\System\oKBVspH.exe
  2⤵
  PID:7284
- C:\Windows\System\VpRnmzh.exe
  C:\Windows\System\VpRnmzh.exe
  2⤵
  PID:7304
- C:\Windows\System\SfwpSEp.exe
  C:\Windows\System\SfwpSEp.exe
  2⤵
  PID:7352
- C:\Windows\System\OakfxZs.exe
  C:\Windows\System\OakfxZs.exe
  2⤵
  PID:7368
- C:\Windows\System\cEWOSGR.exe
  C:\Windows\System\cEWOSGR.exe
  2⤵
  PID:7388
- C:\Windows\System\YtqfPZS.exe
  C:\Windows\System\YtqfPZS.exe
  2⤵
  PID:7404
- C:\Windows\System\jYdSoYa.exe
  C:\Windows\System\jYdSoYa.exe
  2⤵
  PID:7432
- C:\Windows\System\qAiKvWz.exe
  C:\Windows\System\qAiKvWz.exe
  2⤵
  PID:7456
- C:\Windows\System\mHxpUPu.exe
  C:\Windows\System\mHxpUPu.exe
  2⤵
  PID:7476
- C:\Windows\System\SXOIHBl.exe
  C:\Windows\System\SXOIHBl.exe
  2⤵
  PID:7500
- C:\Windows\System\JVgarhE.exe
  C:\Windows\System\JVgarhE.exe
  2⤵
  PID:7520
- C:\Windows\System\tdVguaL.exe
  C:\Windows\System\tdVguaL.exe
  2⤵
  PID:7544
- C:\Windows\System\BikmgXn.exe
  C:\Windows\System\BikmgXn.exe
  2⤵
  PID:7568
- C:\Windows\System\vymQJzu.exe
  C:\Windows\System\vymQJzu.exe
  2⤵
  PID:7584
- C:\Windows\System\UsrENRK.exe
  C:\Windows\System\UsrENRK.exe
  2⤵
  PID:7600
- C:\Windows\System\qHTFOhd.exe
  C:\Windows\System\qHTFOhd.exe
  2⤵
  PID:7616
- C:\Windows\System\HfolTqo.exe
  C:\Windows\System\HfolTqo.exe
  2⤵
  PID:7632
- C:\Windows\System\brSBmdM.exe
  C:\Windows\System\brSBmdM.exe
  2⤵
  PID:7668
- C:\Windows\System\NKsdnJp.exe
  C:\Windows\System\NKsdnJp.exe
  2⤵
  PID:7692
- C:\Windows\System\ABfwedC.exe
  C:\Windows\System\ABfwedC.exe
  2⤵
  PID:7712
- C:\Windows\System\MGWavfK.exe
  C:\Windows\System\MGWavfK.exe
  2⤵
  PID:7736
- C:\Windows\System\pucNpiv.exe
  C:\Windows\System\pucNpiv.exe
  2⤵
  PID:7756
- C:\Windows\System\OIutZqL.exe
  C:\Windows\System\OIutZqL.exe
  2⤵
  PID:7772
- C:\Windows\System\QvqQROy.exe
  C:\Windows\System\QvqQROy.exe
  2⤵
  PID:7832
- C:\Windows\System\OPrGWRf.exe
  C:\Windows\System\OPrGWRf.exe
  2⤵
  PID:7856
- C:\Windows\System\MNpmZQl.exe
  C:\Windows\System\MNpmZQl.exe
  2⤵
  PID:7876
- C:\Windows\System\ZKbLjqG.exe
  C:\Windows\System\ZKbLjqG.exe
  2⤵
  PID:7900
- C:\Windows\System\mKxiJaT.exe
  C:\Windows\System\mKxiJaT.exe
  2⤵
  PID:7920
- C:\Windows\System\xUApJTt.exe
  C:\Windows\System\xUApJTt.exe
  2⤵
  PID:7944
- C:\Windows\System\IbdnEoi.exe
  C:\Windows\System\IbdnEoi.exe
  2⤵
  PID:7972
- C:\Windows\System\DOvEukV.exe
  C:\Windows\System\DOvEukV.exe
  2⤵
  PID:7992
- C:\Windows\System\PezbxgW.exe
  C:\Windows\System\PezbxgW.exe
  2⤵
  PID:8012
- C:\Windows\System\HiwqMIo.exe
  C:\Windows\System\HiwqMIo.exe
  2⤵
  PID:8036
- C:\Windows\System\MTzWrSa.exe
  C:\Windows\System\MTzWrSa.exe
  2⤵
  PID:8068
- C:\Windows\System\prRKCVd.exe
  C:\Windows\System\prRKCVd.exe
  2⤵
  PID:8088
- C:\Windows\System\TJbAuKN.exe
  C:\Windows\System\TJbAuKN.exe
  2⤵
  PID:8108
- C:\Windows\System\iHJoIAl.exe
  C:\Windows\System\iHJoIAl.exe
  2⤵
  PID:6704
- C:\Windows\System\GkdvDbX.exe
  C:\Windows\System\GkdvDbX.exe
  2⤵
  PID:6112
- C:\Windows\System\qzVDwDd.exe
  C:\Windows\System\qzVDwDd.exe
  2⤵
  PID:1304
- C:\Windows\System\eojOZJx.exe
  C:\Windows\System\eojOZJx.exe
  2⤵
  PID:7068
- C:\Windows\System\YDeEZdY.exe
  C:\Windows\System\YDeEZdY.exe
  2⤵
  PID:6460
- C:\Windows\System\dyIGzRE.exe
  C:\Windows\System\dyIGzRE.exe
  2⤵
  PID:5848
- C:\Windows\System\msbsFNb.exe
  C:\Windows\System\msbsFNb.exe
  2⤵
  PID:920
- C:\Windows\System\LrJrpcb.exe
  C:\Windows\System\LrJrpcb.exe
  2⤵
  PID:7016
- C:\Windows\System\HMmPaIf.exe
  C:\Windows\System\HMmPaIf.exe
  2⤵
  PID:7216
- C:\Windows\System\ebpvsRT.exe
  C:\Windows\System\ebpvsRT.exe
  2⤵
  PID:7136
- C:\Windows\System\pygaqUh.exe
  C:\Windows\System\pygaqUh.exe
  2⤵
  PID:7400
- C:\Windows\System\ReLVIvU.exe
  C:\Windows\System\ReLVIvU.exe
  2⤵
  PID:7084
- C:\Windows\System\bgiiMxn.exe
  C:\Windows\System\bgiiMxn.exe
  2⤵
  PID:7320
- C:\Windows\System\pvDLulS.exe
  C:\Windows\System\pvDLulS.exe
  2⤵
  PID:7344
- C:\Windows\System\JvxlUjH.exe
  C:\Windows\System\JvxlUjH.exe
  2⤵
  PID:7376
- C:\Windows\System\BwnouRt.exe
  C:\Windows\System\BwnouRt.exe
  2⤵
  PID:3184
- C:\Windows\System\IHSkTvJ.exe
  C:\Windows\System\IHSkTvJ.exe
  2⤵
  PID:7464
- C:\Windows\System\KGjOUIu.exe
  C:\Windows\System\KGjOUIu.exe
  2⤵
  PID:7516
- C:\Windows\System\BUtKGJL.exe
  C:\Windows\System\BUtKGJL.exe
  2⤵
  PID:7564
- C:\Windows\System\xUXqluj.exe
  C:\Windows\System\xUXqluj.exe
  2⤵
  PID:2256
- C:\Windows\System\TBVtSzl.exe
  C:\Windows\System\TBVtSzl.exe
  2⤵
  PID:7624
- C:\Windows\System\IiJWDKT.exe
  C:\Windows\System\IiJWDKT.exe
  2⤵
  PID:7684
- C:\Windows\System\EupabnF.exe
  C:\Windows\System\EupabnF.exe
  2⤵
  PID:7752
- C:\Windows\System\kYGxNOD.exe
  C:\Windows\System\kYGxNOD.exe
  2⤵
  PID:2960
- C:\Windows\System\yvMAycZ.exe
  C:\Windows\System\yvMAycZ.exe
  2⤵
  PID:7868
- C:\Windows\System\mgUxmJp.exe
  C:\Windows\System\mgUxmJp.exe
  2⤵
  PID:7928
- C:\Windows\System\NOCvsIh.exe
  C:\Windows\System\NOCvsIh.exe
  2⤵
  PID:7988
- C:\Windows\System\akfzLHE.exe
  C:\Windows\System\akfzLHE.exe
  2⤵
  PID:8080
- C:\Windows\System\RAGAwkA.exe
  C:\Windows\System\RAGAwkA.exe
  2⤵
  PID:4036
- C:\Windows\System\fZYPgAm.exe
  C:\Windows\System\fZYPgAm.exe
  2⤵
  PID:2812
- C:\Windows\System\Jcvfona.exe
  C:\Windows\System\Jcvfona.exe
  2⤵
  PID:5628
- C:\Windows\System\JUCNsVy.exe
  C:\Windows\System\JUCNsVy.exe
  2⤵
  PID:5648
- C:\Windows\System\dfYSLKq.exe
  C:\Windows\System\dfYSLKq.exe
  2⤵
  PID:5676
- C:\Windows\System\WKQZZHy.exe
  C:\Windows\System\WKQZZHy.exe
  2⤵
  PID:5672
- C:\Windows\System\emVGNwG.exe
  C:\Windows\System\emVGNwG.exe
  2⤵
  PID:4756
- C:\Windows\System\HhXphgg.exe
  C:\Windows\System\HhXphgg.exe
  2⤵
  PID:1868
- C:\Windows\System\ZnvPTMn.exe
  C:\Windows\System\ZnvPTMn.exe
  2⤵
  PID:4508
- C:\Windows\System\smDnVdH.exe
  C:\Windows\System\smDnVdH.exe
  2⤵
  PID:6344
- C:\Windows\System\HLWcYVK.exe
  C:\Windows\System\HLWcYVK.exe
  2⤵
  PID:7764
- C:\Windows\System\EmvfNCK.exe
  C:\Windows\System\EmvfNCK.exe
  2⤵
  PID:7888
- C:\Windows\System\PotNPpl.exe
  C:\Windows\System\PotNPpl.exe
  2⤵
  PID:8076
- C:\Windows\System\DdZBNWr.exe
  C:\Windows\System\DdZBNWr.exe
  2⤵
  PID:7176
- C:\Windows\System\vCAFkxd.exe
  C:\Windows\System\vCAFkxd.exe
  2⤵
  PID:6676
- C:\Windows\System\oBHIaAf.exe
  C:\Windows\System\oBHIaAf.exe
  2⤵
  PID:4888
- C:\Windows\System\ocYNMCe.exe
  C:\Windows\System\ocYNMCe.exe
  2⤵
  PID:7704
- C:\Windows\System\BQZlpuK.exe
  C:\Windows\System\BQZlpuK.exe
  2⤵
  PID:7748
- C:\Windows\System\lkFKhPc.exe
  C:\Windows\System\lkFKhPc.exe
  2⤵
  PID:6760
- C:\Windows\System\LcEeIdT.exe
  C:\Windows\System\LcEeIdT.exe
  2⤵
  PID:692
- C:\Windows\System\LIRXrgQ.exe
  C:\Windows\System\LIRXrgQ.exe
  2⤵
  PID:7124
- C:\Windows\System\usDuCHt.exe
  C:\Windows\System\usDuCHt.exe
  2⤵
  PID:6184
- C:\Windows\System\IlGPDUL.exe
  C:\Windows\System\IlGPDUL.exe
  2⤵
  PID:2944
- C:\Windows\System\xBiOIoz.exe
  C:\Windows\System\xBiOIoz.exe
  2⤵
  PID:8204
- C:\Windows\System\aXdCCoy.exe
  C:\Windows\System\aXdCCoy.exe
  2⤵
  PID:8228
- C:\Windows\System\oCyRGpU.exe
  C:\Windows\System\oCyRGpU.exe
  2⤵
  PID:8248
- C:\Windows\System\VZXmWIu.exe
  C:\Windows\System\VZXmWIu.exe
  2⤵
  PID:8276
- C:\Windows\System\cFsdrVg.exe
  C:\Windows\System\cFsdrVg.exe
  2⤵
  PID:8296
- C:\Windows\System\uKTtrEd.exe
  C:\Windows\System\uKTtrEd.exe
  2⤵
  PID:8316
- C:\Windows\System\cwjRMQB.exe
  C:\Windows\System\cwjRMQB.exe
  2⤵
  PID:8340
- C:\Windows\System\eqPtxcf.exe
  C:\Windows\System\eqPtxcf.exe
  2⤵
  PID:8360
- C:\Windows\System\XbpfEUz.exe
  C:\Windows\System\XbpfEUz.exe
  2⤵
  PID:8388
- C:\Windows\System\DbyasMA.exe
  C:\Windows\System\DbyasMA.exe
  2⤵
  PID:8408
- C:\Windows\System\FHorKFv.exe
  C:\Windows\System\FHorKFv.exe
  2⤵
  PID:8436
- C:\Windows\System\vrkLncT.exe
  C:\Windows\System\vrkLncT.exe
  2⤵
  PID:8464
- C:\Windows\System\TokcyRT.exe
  C:\Windows\System\TokcyRT.exe
  2⤵
  PID:8484
- C:\Windows\System\YRTEgYz.exe
  C:\Windows\System\YRTEgYz.exe
  2⤵
  PID:8504
- C:\Windows\System\vkwVNVe.exe
  C:\Windows\System\vkwVNVe.exe
  2⤵
  PID:8532
- C:\Windows\System\rZqnRUU.exe
  C:\Windows\System\rZqnRUU.exe
  2⤵
  PID:8556
- C:\Windows\System\RMsETXo.exe
  C:\Windows\System\RMsETXo.exe
  2⤵
  PID:8580
- C:\Windows\System\HBsMBMW.exe
  C:\Windows\System\HBsMBMW.exe
  2⤵
  PID:8604
- C:\Windows\System\YIxvFMz.exe
  C:\Windows\System\YIxvFMz.exe
  2⤵
  PID:8836
- C:\Windows\System\EjsrOLF.exe
  C:\Windows\System\EjsrOLF.exe
  2⤵
  PID:8856
- C:\Windows\System\hkHjgkB.exe
  C:\Windows\System\hkHjgkB.exe
  2⤵
  PID:8872
- C:\Windows\System\ZXRbCIl.exe
  C:\Windows\System\ZXRbCIl.exe
  2⤵
  PID:8892
- C:\Windows\System\KUcHejU.exe
  C:\Windows\System\KUcHejU.exe
  2⤵
  PID:8920
- C:\Windows\System\GpQaLKd.exe
  C:\Windows\System\GpQaLKd.exe
  2⤵
  PID:8944
- C:\Windows\System\SUetdfu.exe
  C:\Windows\System\SUetdfu.exe
  2⤵
  PID:8976
- C:\Windows\System\rYfzqSO.exe
  C:\Windows\System\rYfzqSO.exe
  2⤵
  PID:8996
- C:\Windows\System\bEsPHYo.exe
  C:\Windows\System\bEsPHYo.exe
  2⤵
  PID:9032
- C:\Windows\System\HfzYpZY.exe
  C:\Windows\System\HfzYpZY.exe
  2⤵
  PID:9064
- C:\Windows\System\AhOcOMq.exe
  C:\Windows\System\AhOcOMq.exe
  2⤵
  PID:9088
- C:\Windows\System\YntYqEV.exe
  C:\Windows\System\YntYqEV.exe
  2⤵
  PID:9128
- C:\Windows\System\pczXQSY.exe
  C:\Windows\System\pczXQSY.exe
  2⤵
  PID:9156
- C:\Windows\System\bgyMYcK.exe
  C:\Windows\System\bgyMYcK.exe
  2⤵
  PID:9184
- C:\Windows\System\PVcXHDh.exe
  C:\Windows\System\PVcXHDh.exe
  2⤵
  PID:9208
- C:\Windows\System\kqvbtIk.exe
  C:\Windows\System\kqvbtIk.exe
  2⤵
  PID:7848
- C:\Windows\System\yOiwvyY.exe
  C:\Windows\System\yOiwvyY.exe
  2⤵
  PID:5748
- C:\Windows\System\RZHPDip.exe
  C:\Windows\System\RZHPDip.exe
  2⤵
  PID:5248
- C:\Windows\System\BlXjzZL.exe
  C:\Windows\System\BlXjzZL.exe
  2⤵
  PID:5680
- C:\Windows\System\PlZdFuN.exe
  C:\Windows\System\PlZdFuN.exe
  2⤵
  PID:7364
- C:\Windows\System\CXpJgrR.exe
  C:\Windows\System\CXpJgrR.exe
  2⤵
  PID:7448
- C:\Windows\System\JnZSRjM.exe
  C:\Windows\System\JnZSRjM.exe
  2⤵
  PID:7552
- C:\Windows\System\LtQsolo.exe
  C:\Windows\System\LtQsolo.exe
  2⤵
  PID:7640
- C:\Windows\System\kZhnAkG.exe
  C:\Windows\System\kZhnAkG.exe
  2⤵
  PID:3408
- C:\Windows\System\kWrpMlW.exe
  C:\Windows\System\kWrpMlW.exe
  2⤵
  PID:8472
- C:\Windows\System\pzVaHac.exe
  C:\Windows\System\pzVaHac.exe
  2⤵
  PID:8000
- C:\Windows\System\KEigqOg.exe
  C:\Windows\System\KEigqOg.exe
  2⤵
  PID:2216
- C:\Windows\System\Jcideyh.exe
  C:\Windows\System\Jcideyh.exe
  2⤵
  PID:8216
- C:\Windows\System\OmswzNA.exe
  C:\Windows\System\OmswzNA.exe
  2⤵
  PID:7984
- C:\Windows\System\ZPITKin.exe
  C:\Windows\System\ZPITKin.exe
  2⤵
  PID:8200
- C:\Windows\System\zAdXCyo.exe
  C:\Windows\System\zAdXCyo.exe
  2⤵
  PID:8720
- C:\Windows\System\iSEqVVt.exe
  C:\Windows\System\iSEqVVt.exe
  2⤵
  PID:5312
- C:\Windows\System\Nzontgf.exe
  C:\Windows\System\Nzontgf.exe
  2⤵
  PID:8544
- C:\Windows\System\QPJABQj.exe
  C:\Windows\System\QPJABQj.exe
  2⤵
  PID:8616
- C:\Windows\System\VTCrjue.exe
  C:\Windows\System\VTCrjue.exe
  2⤵
  PID:8452
- C:\Windows\System\xfOtInW.exe
  C:\Windows\System\xfOtInW.exe
  2⤵
  PID:8844
- C:\Windows\System\YAzvBSc.exe
  C:\Windows\System\YAzvBSc.exe
  2⤵
  PID:8644
- C:\Windows\System\MXYTPNd.exe
  C:\Windows\System\MXYTPNd.exe
  2⤵
  PID:8676
- C:\Windows\System\RrkxERg.exe
  C:\Windows\System\RrkxERg.exe
  2⤵
  PID:9048
- C:\Windows\System\DEXyRoM.exe
  C:\Windows\System\DEXyRoM.exe
  2⤵
  PID:8704
- C:\Windows\System\HyRyyyX.exe
  C:\Windows\System\HyRyyyX.exe
  2⤵
  PID:8348
- C:\Windows\System\ImzgVcf.exe
  C:\Windows\System\ImzgVcf.exe
  2⤵
  PID:8784
- C:\Windows\System\gmLxOXQ.exe
  C:\Windows\System\gmLxOXQ.exe
  2⤵
  PID:9136
- C:\Windows\System\VGUScxZ.exe
  C:\Windows\System\VGUScxZ.exe
  2⤵
  PID:8496
- C:\Windows\System\AxlMKZt.exe
  C:\Windows\System\AxlMKZt.exe
  2⤵
  PID:8308
- C:\Windows\System\IJIINkY.exe
  C:\Windows\System\IJIINkY.exe
  2⤵
  PID:8868
- C:\Windows\System\BUTKhUC.exe
  C:\Windows\System\BUTKhUC.exe
  2⤵
  PID:9236
- C:\Windows\System\ceerGPl.exe
  C:\Windows\System\ceerGPl.exe
  2⤵
  PID:9268
- C:\Windows\System\nNpOoxC.exe
  C:\Windows\System\nNpOoxC.exe
  2⤵
  PID:9288
- C:\Windows\System\egIYPFW.exe
  C:\Windows\System\egIYPFW.exe
  2⤵
  PID:9312
- C:\Windows\System\DWekYwH.exe
  C:\Windows\System\DWekYwH.exe
  2⤵
  PID:9336
- C:\Windows\System\DUeXMgB.exe
  C:\Windows\System\DUeXMgB.exe
  2⤵
  PID:9360
- C:\Windows\System\FoECMsy.exe
  C:\Windows\System\FoECMsy.exe
  2⤵
  PID:9380
- C:\Windows\System\CkhKXRq.exe
  C:\Windows\System\CkhKXRq.exe
  2⤵
  PID:9408
- C:\Windows\System\oGEyWjb.exe
  C:\Windows\System\oGEyWjb.exe
  2⤵
  PID:9424
- C:\Windows\System\EcGBsIM.exe
  C:\Windows\System\EcGBsIM.exe
  2⤵
  PID:9440
- C:\Windows\System\qpROOHK.exe
  C:\Windows\System\qpROOHK.exe
  2⤵
  PID:9468
- C:\Windows\System\EoPKhvz.exe
  C:\Windows\System\EoPKhvz.exe
  2⤵
  PID:9488
- C:\Windows\System\BSExmYx.exe
  C:\Windows\System\BSExmYx.exe
  2⤵
  PID:9520
- C:\Windows\System\aMdtSUr.exe
  C:\Windows\System\aMdtSUr.exe
  2⤵
  PID:9544
- C:\Windows\System\CwdoWEG.exe
  C:\Windows\System\CwdoWEG.exe
  2⤵
  PID:9568
- C:\Windows\System\NWGIlvj.exe
  C:\Windows\System\NWGIlvj.exe
  2⤵
  PID:9592
- C:\Windows\System\flzlOZV.exe
  C:\Windows\System\flzlOZV.exe
  2⤵
  PID:9608
- C:\Windows\System\IqTpukg.exe
  C:\Windows\System\IqTpukg.exe
  2⤵
  PID:9632
- C:\Windows\System\fXqnMDk.exe
  C:\Windows\System\fXqnMDk.exe
  2⤵
  PID:9652
- C:\Windows\System\VshUtQN.exe
  C:\Windows\System\VshUtQN.exe
  2⤵
  PID:9676
- C:\Windows\System\dgQbClH.exe
  C:\Windows\System\dgQbClH.exe
  2⤵
  PID:9692
- C:\Windows\System\HCYkAoJ.exe
  C:\Windows\System\HCYkAoJ.exe
  2⤵
  PID:9708
- C:\Windows\System\BcJvjNG.exe
  C:\Windows\System\BcJvjNG.exe
  2⤵
  PID:9728
- C:\Windows\System\MDbNrOV.exe
  C:\Windows\System\MDbNrOV.exe
  2⤵
  PID:9752
- C:\Windows\System\kzNrECa.exe
  C:\Windows\System\kzNrECa.exe
  2⤵
  PID:9776
- C:\Windows\System\YYTfSIP.exe
  C:\Windows\System\YYTfSIP.exe
  2⤵
  PID:9796
- C:\Windows\System\RLWSFmk.exe
  C:\Windows\System\RLWSFmk.exe
  2⤵
  PID:9828
- C:\Windows\System\oVtNESs.exe
  C:\Windows\System\oVtNESs.exe
  2⤵
  PID:9856
- C:\Windows\System\WZldCoI.exe
  C:\Windows\System\WZldCoI.exe
  2⤵
  PID:9880
- C:\Windows\System\MEwCGkX.exe
  C:\Windows\System\MEwCGkX.exe
  2⤵
  PID:9900
- C:\Windows\System\CgeBZEl.exe
  C:\Windows\System\CgeBZEl.exe
  2⤵
  PID:9924
- C:\Windows\System\RIKdFQF.exe
  C:\Windows\System\RIKdFQF.exe
  2⤵
  PID:9944
- C:\Windows\System\KCtnLPW.exe
  C:\Windows\System\KCtnLPW.exe
  2⤵
  PID:9968
- C:\Windows\System\znfizuf.exe
  C:\Windows\System\znfizuf.exe
  2⤵
  PID:9992
- C:\Windows\System\qHFgUBv.exe
  C:\Windows\System\qHFgUBv.exe
  2⤵
  PID:10012
- C:\Windows\System\xlKWZFw.exe
  C:\Windows\System\xlKWZFw.exe
  2⤵
  PID:10032
- C:\Windows\System\numuwSz.exe
  C:\Windows\System\numuwSz.exe
  2⤵
  PID:10060
- C:\Windows\System\vzPsCMY.exe
  C:\Windows\System\vzPsCMY.exe
  2⤵
  PID:10084
- C:\Windows\System\wNNppua.exe
  C:\Windows\System\wNNppua.exe
  2⤵
  PID:10108
- C:\Windows\System\OzPiZTv.exe
  C:\Windows\System\OzPiZTv.exe
  2⤵
  PID:10128
- C:\Windows\System\PAZwKGf.exe
  C:\Windows\System\PAZwKGf.exe
  2⤵
  PID:10148
- C:\Windows\System\EJaTAth.exe
  C:\Windows\System\EJaTAth.exe
  2⤵
  PID:10168
- C:\Windows\System\sQjRdYR.exe
  C:\Windows\System\sQjRdYR.exe
  2⤵
  PID:10188
- C:\Windows\System\cmpEcTm.exe
  C:\Windows\System\cmpEcTm.exe
  2⤵
  PID:10216
- C:\Windows\System\tXJaYoH.exe
  C:\Windows\System\tXJaYoH.exe
  2⤵
  PID:7328
- C:\Windows\System\FlwVjNm.exe
  C:\Windows\System\FlwVjNm.exe
  2⤵
  PID:8928
- C:\Windows\System\bCbPQtO.exe
  C:\Windows\System\bCbPQtO.exe
  2⤵
  PID:8960
- C:\Windows\System\HgFHaeI.exe
  C:\Windows\System\HgFHaeI.exe
  2⤵
  PID:8024
- C:\Windows\System\zXYzkXz.exe
  C:\Windows\System\zXYzkXz.exe
  2⤵
  PID:9196
- C:\Windows\System\cZbZjIz.exe
  C:\Windows\System\cZbZjIz.exe
  2⤵
  PID:8880
- C:\Windows\System\GkpGjeq.exe
  C:\Windows\System\GkpGjeq.exe
  2⤵
  PID:7380
- C:\Windows\System\lEMfZKz.exe
  C:\Windows\System\lEMfZKz.exe
  2⤵
  PID:5708
- C:\Windows\System\UqRjpcL.exe
  C:\Windows\System\UqRjpcL.exe
  2⤵
  PID:7032
- C:\Windows\System\qssouYF.exe
  C:\Windows\System\qssouYF.exe
  2⤵
  PID:9284
- C:\Windows\System\USIZZzK.exe
  C:\Windows\System\USIZZzK.exe
  2⤵
  PID:6928
- C:\Windows\System\LvqotPJ.exe
  C:\Windows\System\LvqotPJ.exe
  2⤵
  PID:8992
- C:\Windows\System\qHZEsek.exe
  C:\Windows\System\qHZEsek.exe
  2⤵
  PID:8516
- C:\Windows\System\DrUDOOz.exe
  C:\Windows\System\DrUDOOz.exe
  2⤵
  PID:8884
- C:\Windows\System\hmUClOe.exe
  C:\Windows\System\hmUClOe.exe
  2⤵
  PID:7396
- C:\Windows\System\PyaweRc.exe
  C:\Windows\System\PyaweRc.exe
  2⤵
  PID:7840
- C:\Windows\System\CQAjktq.exe
  C:\Windows\System\CQAjktq.exe
  2⤵
  PID:9532
- C:\Windows\System\iurwrMo.exe
  C:\Windows\System\iurwrMo.exe
  2⤵
  PID:9192
- C:\Windows\System\MBiCXkZ.exe
  C:\Windows\System\MBiCXkZ.exe
  2⤵
  PID:4484
- C:\Windows\System\edBmSUV.exe
  C:\Windows\System\edBmSUV.exe
  2⤵
  PID:9736
- C:\Windows\System\FolAsUM.exe
  C:\Windows\System\FolAsUM.exe
  2⤵
  PID:9768
- C:\Windows\System\ohWsekY.exe
  C:\Windows\System\ohWsekY.exe
  2⤵
  PID:9840
- C:\Windows\System\VUbJUcq.exe
  C:\Windows\System\VUbJUcq.exe
  2⤵
  PID:10264
- C:\Windows\System\akuAWus.exe
  C:\Windows\System\akuAWus.exe
  2⤵
  PID:10288
- C:\Windows\System\MSOnJlh.exe
  C:\Windows\System\MSOnJlh.exe
  2⤵
  PID:10308
- C:\Windows\System\rbuUiij.exe
  C:\Windows\System\rbuUiij.exe
  2⤵
  PID:10332
- C:\Windows\System\nMntzyz.exe
  C:\Windows\System\nMntzyz.exe
  2⤵
  PID:10352
- C:\Windows\System\AuiEhLq.exe
  C:\Windows\System\AuiEhLq.exe
  2⤵
  PID:10384
- C:\Windows\System\wlHDVqh.exe
  C:\Windows\System\wlHDVqh.exe
  2⤵
  PID:10416
- C:\Windows\System\TUxNYOZ.exe
  C:\Windows\System\TUxNYOZ.exe
  2⤵
  PID:10440
- C:\Windows\System\GDvXxYk.exe
  C:\Windows\System\GDvXxYk.exe
  2⤵
  PID:10464
- C:\Windows\System\UirDZwR.exe
  C:\Windows\System\UirDZwR.exe
  2⤵
  PID:10488
- C:\Windows\System\JHGxuFE.exe
  C:\Windows\System\JHGxuFE.exe
  2⤵
  PID:10508
- C:\Windows\System\krsFVKW.exe
  C:\Windows\System\krsFVKW.exe
  2⤵
  PID:10536
- C:\Windows\System\WPyvHBC.exe
  C:\Windows\System\WPyvHBC.exe
  2⤵
  PID:10564
- C:\Windows\System\ZOdVKHK.exe
  C:\Windows\System\ZOdVKHK.exe
  2⤵
  PID:10584
- C:\Windows\System\EzNMbZx.exe
  C:\Windows\System\EzNMbZx.exe
  2⤵
  PID:10600
- C:\Windows\System\HaOiNln.exe
  C:\Windows\System\HaOiNln.exe
  2⤵
  PID:10632
- C:\Windows\System\RqcoYVM.exe
  C:\Windows\System\RqcoYVM.exe
  2⤵
  PID:10656
- C:\Windows\System\SJfAZUQ.exe
  C:\Windows\System\SJfAZUQ.exe
  2⤵
  PID:10680
- C:\Windows\System\mHgXcze.exe
  C:\Windows\System\mHgXcze.exe
  2⤵
  PID:10704
- C:\Windows\System\wbRwLWD.exe
  C:\Windows\System\wbRwLWD.exe
  2⤵
  PID:10728
- C:\Windows\System\VcZfNtY.exe
  C:\Windows\System\VcZfNtY.exe
  2⤵
  PID:10752
- C:\Windows\System\PNlUvWq.exe
  C:\Windows\System\PNlUvWq.exe
  2⤵
  PID:10784
- C:\Windows\System\ZkhLIhJ.exe
  C:\Windows\System\ZkhLIhJ.exe
  2⤵
  PID:10808
- C:\Windows\System\oGOgjDU.exe
  C:\Windows\System\oGOgjDU.exe
  2⤵
  PID:10836
- C:\Windows\System\SHoCUzz.exe
  C:\Windows\System\SHoCUzz.exe
  2⤵
  PID:10864
- C:\Windows\System\EfQNkeu.exe
  C:\Windows\System\EfQNkeu.exe
  2⤵
  PID:10888
- C:\Windows\System\ksmlZxu.exe
  C:\Windows\System\ksmlZxu.exe
  2⤵
  PID:10912
- C:\Windows\System\EedqgTg.exe
  C:\Windows\System\EedqgTg.exe
  2⤵
  PID:10928
- C:\Windows\System\NoIjpQY.exe
  C:\Windows\System\NoIjpQY.exe
  2⤵
  PID:10952
- C:\Windows\System\KbgjHxM.exe
  C:\Windows\System\KbgjHxM.exe
  2⤵
  PID:10976
- C:\Windows\System\DxDssfu.exe
  C:\Windows\System\DxDssfu.exe
  2⤵
  PID:10996
- C:\Windows\System\DrnxtWz.exe
  C:\Windows\System\DrnxtWz.exe
  2⤵
  PID:11020
- C:\Windows\System\bZYHjMZ.exe
  C:\Windows\System\bZYHjMZ.exe
  2⤵
  PID:11040
- C:\Windows\System\dmizpvt.exe
  C:\Windows\System\dmizpvt.exe
  2⤵
  PID:11060
- C:\Windows\System\venVAbI.exe
  C:\Windows\System\venVAbI.exe
  2⤵
  PID:11080
- C:\Windows\System\TDVZVcB.exe
  C:\Windows\System\TDVZVcB.exe
  2⤵
  PID:11100
- C:\Windows\System\PSURneH.exe
  C:\Windows\System\PSURneH.exe
  2⤵
  PID:11124
- C:\Windows\System\dSHVxET.exe
  C:\Windows\System\dSHVxET.exe
  2⤵
  PID:11152
- C:\Windows\System\jUjWWah.exe
  C:\Windows\System\jUjWWah.exe
  2⤵
  PID:11172
- C:\Windows\System\ehnTXDk.exe
  C:\Windows\System\ehnTXDk.exe
  2⤵
  PID:11200
- C:\Windows\System\wzTjYfr.exe
  C:\Windows\System\wzTjYfr.exe
  2⤵
  PID:11216
- C:\Windows\System\aHpwzwe.exe
  C:\Windows\System\aHpwzwe.exe
  2⤵
  PID:11248
- C:\Windows\System\lOnZBbC.exe
  C:\Windows\System\lOnZBbC.exe
  2⤵
  PID:9280
- C:\Windows\System\IrUUdXj.exe
  C:\Windows\System\IrUUdXj.exe
  2⤵
  PID:9344
- C:\Windows\System\iBBlZCE.exe
  C:\Windows\System\iBBlZCE.exe
  2⤵
  PID:9940
- C:\Windows\System\OjVsDOy.exe
  C:\Windows\System\OjVsDOy.exe
  2⤵
  PID:9964
- C:\Windows\System\foTAoDM.exe
  C:\Windows\System\foTAoDM.exe
  2⤵
  PID:10076
- C:\Windows\System\XWJsBkG.exe
  C:\Windows\System\XWJsBkG.exe
  2⤵
  PID:9436
- C:\Windows\System\qurarPU.exe
  C:\Windows\System\qurarPU.exe
  2⤵
  PID:9496
- C:\Windows\System\eHoTOUp.exe
  C:\Windows\System\eHoTOUp.exe
  2⤵
  PID:8416
- C:\Windows\System\sxGDrvk.exe
  C:\Windows\System\sxGDrvk.exe
  2⤵
  PID:9624
- C:\Windows\System\nBeJqNz.exe
  C:\Windows\System\nBeJqNz.exe
  2⤵
  PID:9660
- C:\Windows\System\RCngoGw.exe
  C:\Windows\System\RCngoGw.exe
  2⤵
  PID:9688
- C:\Windows\System\EiDOLnj.exe
  C:\Windows\System\EiDOLnj.exe
  2⤵
  PID:8700
- C:\Windows\System\vlPFtiS.exe
  C:\Windows\System\vlPFtiS.exe
  2⤵
  PID:9812
- C:\Windows\System\BZEXyGi.exe
  C:\Windows\System\BZEXyGi.exe
  2⤵
  PID:10248
- C:\Windows\System\WqJLZUh.exe
  C:\Windows\System\WqJLZUh.exe
  2⤵
  PID:9892
- C:\Windows\System\xPJzdAf.exe
  C:\Windows\System\xPJzdAf.exe
  2⤵
  PID:10408
- C:\Windows\System\yQJaRJg.exe
  C:\Windows\System\yQJaRJg.exe
  2⤵
  PID:10056
- C:\Windows\System\UecfkLW.exe
  C:\Windows\System\UecfkLW.exe
  2⤵
  PID:10140
- C:\Windows\System\pJRUisC.exe
  C:\Windows\System\pJRUisC.exe
  2⤵
  PID:10668
- C:\Windows\System\BnBkTmv.exe
  C:\Windows\System\BnBkTmv.exe
  2⤵
  PID:10772
- C:\Windows\System\UZHdMrZ.exe
  C:\Windows\System\UZHdMrZ.exe
  2⤵
  PID:7444
- C:\Windows\System\ZyJliWU.exe
  C:\Windows\System\ZyJliWU.exe
  2⤵
  PID:11268
- C:\Windows\System\LlniKay.exe
  C:\Windows\System\LlniKay.exe
  2⤵
  PID:11288
- C:\Windows\System\CxQKGJh.exe
  C:\Windows\System\CxQKGJh.exe
  2⤵
  PID:11316
- C:\Windows\System\zihGarZ.exe
  C:\Windows\System\zihGarZ.exe
  2⤵
  PID:11336
- C:\Windows\System\PAHmRof.exe
  C:\Windows\System\PAHmRof.exe
  2⤵
  PID:11356
- C:\Windows\System\oaBPKsk.exe
  C:\Windows\System\oaBPKsk.exe
  2⤵
  PID:11372
- C:\Windows\System\ELCOjDm.exe
  C:\Windows\System\ELCOjDm.exe
  2⤵
  PID:11396
- C:\Windows\System\zFEyuLW.exe
  C:\Windows\System\zFEyuLW.exe
  2⤵
  PID:11420
- C:\Windows\System\TbLdLNX.exe
  C:\Windows\System\TbLdLNX.exe
  2⤵
  PID:11440
- C:\Windows\System\OTqmQdR.exe
  C:\Windows\System\OTqmQdR.exe
  2⤵
  PID:11464
- C:\Windows\System\NFgmWMf.exe
  C:\Windows\System\NFgmWMf.exe
  2⤵
  PID:11480
- C:\Windows\System\qAbClXw.exe
  C:\Windows\System\qAbClXw.exe
  2⤵
  PID:11504
- C:\Windows\System\tcgnWUM.exe
  C:\Windows\System\tcgnWUM.exe
  2⤵
  PID:11528
- C:\Windows\System\wecuQaT.exe
  C:\Windows\System\wecuQaT.exe
  2⤵
  PID:11560
- C:\Windows\System\jlCGRXO.exe
  C:\Windows\System\jlCGRXO.exe
  2⤵
  PID:11576
- C:\Windows\System\CGhZydP.exe
  C:\Windows\System\CGhZydP.exe
  2⤵
  PID:11600
- C:\Windows\System\kprfNIe.exe
  C:\Windows\System\kprfNIe.exe
  2⤵
  PID:11628
- C:\Windows\System\oPbkuSj.exe
  C:\Windows\System\oPbkuSj.exe
  2⤵
  PID:11648
- C:\Windows\System\SApRnvJ.exe
  C:\Windows\System\SApRnvJ.exe
  2⤵
  PID:11672
- C:\Windows\System\VtbLZHh.exe
  C:\Windows\System\VtbLZHh.exe
  2⤵
  PID:11696
- C:\Windows\System\NRFOEIM.exe
  C:\Windows\System\NRFOEIM.exe
  2⤵
  PID:11720
- C:\Windows\System\rWvTxGi.exe
  C:\Windows\System\rWvTxGi.exe
  2⤵
  PID:11740
- C:\Windows\System\sSBQnwD.exe
  C:\Windows\System\sSBQnwD.exe
  2⤵
  PID:11760
- C:\Windows\System\palSSim.exe
  C:\Windows\System\palSSim.exe
  2⤵
  PID:11780
- C:\Windows\System\IIPxrzW.exe
  C:\Windows\System\IIPxrzW.exe
  2⤵
  PID:11800
- C:\Windows\System\fYHxZzA.exe
  C:\Windows\System\fYHxZzA.exe
  2⤵
  PID:11820
- C:\Windows\System\ZXEWGFn.exe
  C:\Windows\System\ZXEWGFn.exe
  2⤵
  PID:11836
- C:\Windows\System\JKVSojF.exe
  C:\Windows\System\JKVSojF.exe
  2⤵
  PID:11852
- C:\Windows\System\HyVhHdL.exe
  C:\Windows\System\HyVhHdL.exe
  2⤵
  PID:11868
- C:\Windows\System\JvpdIVj.exe
  C:\Windows\System\JvpdIVj.exe
  2⤵
  PID:11884
- C:\Windows\System\MxZBTfh.exe
  C:\Windows\System\MxZBTfh.exe
  2⤵
  PID:11900
- C:\Windows\System\pUmPDFY.exe
  C:\Windows\System\pUmPDFY.exe
  2⤵
  PID:11920
- C:\Windows\System\NWEUyaQ.exe
  C:\Windows\System\NWEUyaQ.exe
  2⤵
  PID:11944
- C:\Windows\System\rIEfwWt.exe
  C:\Windows\System\rIEfwWt.exe
  2⤵
  PID:11972
- C:\Windows\System\YArCygx.exe
  C:\Windows\System\YArCygx.exe
  2⤵
  PID:11992
- C:\Windows\System\QlTQVqe.exe
  C:\Windows\System\QlTQVqe.exe
  2⤵
  PID:12020
- C:\Windows\System\zdgdZUJ.exe
  C:\Windows\System\zdgdZUJ.exe
  2⤵
  PID:12044
- C:\Windows\System\YCBRbrd.exe
  C:\Windows\System\YCBRbrd.exe
  2⤵
  PID:12068
- C:\Windows\System\OZuVUps.exe
  C:\Windows\System\OZuVUps.exe
  2⤵
  PID:12084
- C:\Windows\System\OttuMJx.exe
  C:\Windows\System\OttuMJx.exe
  2⤵
  PID:12104
- C:\Windows\System\Jvuymbc.exe
  C:\Windows\System\Jvuymbc.exe
  2⤵
  PID:12124
- C:\Windows\System\wTszxtb.exe
  C:\Windows\System\wTszxtb.exe
  2⤵
  PID:12148
- C:\Windows\System\EpeSbAc.exe
  C:\Windows\System\EpeSbAc.exe
  2⤵
  PID:12168
- C:\Windows\System\LoDEece.exe
  C:\Windows\System\LoDEece.exe
  2⤵
  PID:12188
- C:\Windows\System\zPklVEy.exe
  C:\Windows\System\zPklVEy.exe
  2⤵
  PID:12212
- C:\Windows\System\vqVUlkI.exe
  C:\Windows\System\vqVUlkI.exe
  2⤵
  PID:12236
- C:\Windows\System\OmLBmXo.exe
  C:\Windows\System\OmLBmXo.exe
  2⤵
  PID:12256
- C:\Windows\System\amzNZrA.exe
  C:\Windows\System\amzNZrA.exe
  2⤵
  PID:12280
- C:\Windows\System\ZfBLaRy.exe
  C:\Windows\System\ZfBLaRy.exe
  2⤵
  PID:8236
- C:\Windows\System\OCyZYEU.exe
  C:\Windows\System\OCyZYEU.exe
  2⤵
  PID:7576
- C:\Windows\System\fyByABV.exe
  C:\Windows\System\fyByABV.exe
  2⤵
  PID:9748
- C:\Windows\System\WrqnAri.exe
  C:\Windows\System\WrqnAri.exe
  2⤵
  PID:9724
- C:\Windows\System\MLSDEMM.exe
  C:\Windows\System\MLSDEMM.exe
  2⤵
  PID:11148
- C:\Windows\System\LqVWOdX.exe
  C:\Windows\System\LqVWOdX.exe
  2⤵
  PID:11168
- C:\Windows\System\KQjLILU.exe
  C:\Windows\System\KQjLILU.exe
  2⤵
  PID:11212
- C:\Windows\System\UXKpYJH.exe
  C:\Windows\System\UXKpYJH.exe
  2⤵
  PID:10348
- C:\Windows\System\pjHEqHG.exe
  C:\Windows\System\pjHEqHG.exe
  2⤵
  PID:10008
- C:\Windows\System\efCbXeB.exe
  C:\Windows\System\efCbXeB.exe
  2⤵
  PID:10432
- C:\Windows\System\TqJXunx.exe
  C:\Windows\System\TqJXunx.exe
  2⤵
  PID:10532
- C:\Windows\System\HYXpCCf.exe
  C:\Windows\System\HYXpCCf.exe
  2⤵
  PID:10524
- C:\Windows\System\JUxMqxX.exe
  C:\Windows\System\JUxMqxX.exe
  2⤵
  PID:10640
- C:\Windows\System\YHnamlr.exe
  C:\Windows\System\YHnamlr.exe
  2⤵
  PID:9684
- C:\Windows\System\ikPegoG.exe
  C:\Windows\System\ikPegoG.exe
  2⤵
  PID:8376
- C:\Windows\System\krmnSZR.exe
  C:\Windows\System\krmnSZR.exe
  2⤵
  PID:10760
- C:\Windows\System\PaWSRyd.exe
  C:\Windows\System\PaWSRyd.exe
  2⤵
  PID:10880
- C:\Windows\System\xTHNFvX.exe
  C:\Windows\System\xTHNFvX.exe
  2⤵
  PID:10924
- C:\Windows\System\NEjeEPw.exe
  C:\Windows\System\NEjeEPw.exe
  2⤵
  PID:11332
- C:\Windows\System\jAWReXZ.exe
  C:\Windows\System\jAWReXZ.exe
  2⤵
  PID:11416
- C:\Windows\System\XKYuSqb.exe
  C:\Windows\System\XKYuSqb.exe
  2⤵
  PID:12308
- C:\Windows\System\uEtBRcS.exe
  C:\Windows\System\uEtBRcS.exe
  2⤵
  PID:12328
- C:\Windows\System\ybojILL.exe
  C:\Windows\System\ybojILL.exe
  2⤵
  PID:12348
- C:\Windows\System\PTEXEEV.exe
  C:\Windows\System\PTEXEEV.exe
  2⤵
  PID:12368
- C:\Windows\System\KBLQqNB.exe
  C:\Windows\System\KBLQqNB.exe
  2⤵
  PID:12388
- C:\Windows\System\uDyLysg.exe
  C:\Windows\System\uDyLysg.exe
  2⤵
  PID:12408
- C:\Windows\System\dmJfFwa.exe
  C:\Windows\System\dmJfFwa.exe
  2⤵
  PID:12424
- C:\Windows\System\ErajsaQ.exe
  C:\Windows\System\ErajsaQ.exe
  2⤵
  PID:12440
- C:\Windows\System\CucfFdI.exe
  C:\Windows\System\CucfFdI.exe
  2⤵
  PID:12456
- C:\Windows\System\HnKNQhp.exe
  C:\Windows\System\HnKNQhp.exe
  2⤵
  PID:12476
- C:\Windows\System\fbqLFBb.exe
  C:\Windows\System\fbqLFBb.exe
  2⤵
  PID:12492
- C:\Windows\System\fDxsaIY.exe
  C:\Windows\System\fDxsaIY.exe
  2⤵
  PID:12508
- C:\Windows\System\mfDMsXW.exe
  C:\Windows\System\mfDMsXW.exe
  2⤵
  PID:12536
- C:\Windows\System\VZCmWWl.exe
  C:\Windows\System\VZCmWWl.exe
  2⤵
  PID:12556
- C:\Windows\System\vcYpORt.exe
  C:\Windows\System\vcYpORt.exe
  2⤵
  PID:12576
- C:\Windows\System\GLknWLa.exe
  C:\Windows\System\GLknWLa.exe
  2⤵
  PID:12596
- C:\Windows\System\dgfiKxk.exe
  C:\Windows\System\dgfiKxk.exe
  2⤵
  PID:12628
- C:\Windows\System\SIEjecS.exe
  C:\Windows\System\SIEjecS.exe
  2⤵
  PID:12648
- C:\Windows\System\LmgceLZ.exe
  C:\Windows\System\LmgceLZ.exe
  2⤵
  PID:12664
- C:\Windows\System\WVyHCKK.exe
  C:\Windows\System\WVyHCKK.exe
  2⤵
  PID:12688
- C:\Windows\System\nxDSbJg.exe
  C:\Windows\System\nxDSbJg.exe
  2⤵
  PID:12708
- C:\Windows\System\givSMWw.exe
  C:\Windows\System\givSMWw.exe
  2⤵
  PID:12732
- C:\Windows\System\hYkKprn.exe
  C:\Windows\System\hYkKprn.exe
  2⤵
  PID:12752
- C:\Windows\System\DfbDbrM.exe
  C:\Windows\System\DfbDbrM.exe
  2⤵
  PID:12772
- C:\Windows\System\ZKzlonR.exe
  C:\Windows\System\ZKzlonR.exe
  2⤵
  PID:12792
- C:\Windows\System\zRcfLDr.exe
  C:\Windows\System\zRcfLDr.exe
  2⤵
  PID:12816
- C:\Windows\System\kmkjwiy.exe
  C:\Windows\System\kmkjwiy.exe
  2⤵
  PID:12848
- C:\Windows\System\ldNNMLo.exe
  C:\Windows\System\ldNNMLo.exe
  2⤵
  PID:12868
- C:\Windows\System\YUpjTMt.exe
  C:\Windows\System\YUpjTMt.exe
  2⤵
  PID:12904
- C:\Windows\System\bJoVqKc.exe
  C:\Windows\System\bJoVqKc.exe
  2⤵
  PID:12932
- C:\Windows\System\HPwPtsM.exe
  C:\Windows\System\HPwPtsM.exe
  2⤵
  PID:12956
- C:\Windows\System\TNJNbuE.exe
  C:\Windows\System\TNJNbuE.exe
  2⤵
  PID:11880
- C:\Windows\System\wfDoUoi.exe
  C:\Windows\System\wfDoUoi.exe
  2⤵
  PID:12804
- C:\Windows\System\nTAlBkr.exe
  C:\Windows\System\nTAlBkr.exe
  2⤵
  PID:12132
- C:\Windows\System\JbIYliw.exe
  C:\Windows\System\JbIYliw.exe
  2⤵
  PID:12976
- C:\Windows\System\xtXiVEs.exe
  C:\Windows\System\xtXiVEs.exe
  2⤵
  PID:8988
- C:\Windows\System\ruFNYZK.exe
  C:\Windows\System\ruFNYZK.exe
  2⤵
  PID:12356
- C:\Windows\System\DpkjLzX.exe
  C:\Windows\System\DpkjLzX.exe
  2⤵
  PID:13108
- C:\Windows\System\AXgnpZA.exe
  C:\Windows\System\AXgnpZA.exe
  2⤵
  PID:12592
- C:\Windows\System\oVNzrRV.exe
  C:\Windows\System\oVNzrRV.exe
  2⤵
  PID:12612
- C:\Windows\System\rxHbZNC.exe
  C:\Windows\System\rxHbZNC.exe
  2⤵
  PID:13152
- C:\Windows\System\jjmEtrX.exe
  C:\Windows\System\jjmEtrX.exe
  2⤵
  PID:12916
- C:\Windows\System\nnjzCWt.exe
  C:\Windows\System\nnjzCWt.exe
  2⤵
  PID:13192
- C:\Windows\System\wnWPqGc.exe
  C:\Windows\System\wnWPqGc.exe
  2⤵
  PID:10936
- C:\Windows\System\MTtaxQF.exe
  C:\Windows\System\MTtaxQF.exe
  2⤵
  PID:13216
- C:\Windows\System\nPubtDs.exe
  C:\Windows\System\nPubtDs.exe
  2⤵
  PID:12296
- C:\Windows\System\PejaSmc.exe
  C:\Windows\System\PejaSmc.exe
  2⤵
  PID:13128
- C:\Windows\System\UcbGpqX.exe
  C:\Windows\System\UcbGpqX.exe
  2⤵
  PID:13292
- C:\Windows\System\gALgDuj.exe
  C:\Windows\System\gALgDuj.exe
  2⤵
  PID:13308
- C:\Windows\System\IZVaASa.exe
  C:\Windows\System\IZVaASa.exe
  2⤵
  PID:10972
- C:\Windows\System\CwdZmUo.exe
  C:\Windows\System\CwdZmUo.exe
  2⤵
  PID:3448
- C:\Windows\System\tgQXrla.exe
  C:\Windows\System\tgQXrla.exe
  2⤵
  PID:11960
- C:\Windows\System\IpkdyUt.exe
  C:\Windows\System\IpkdyUt.exe
  2⤵
  PID:12028
- C:\Windows\System\kUtTOLf.exe
  C:\Windows\System\kUtTOLf.exe
  2⤵
  PID:11680
- C:\Windows\System\xyTCnkn.exe
  C:\Windows\System\xyTCnkn.exe
  2⤵
  PID:13144
- C:\Windows\System\QMLUAYl.exe
  C:\Windows\System\QMLUAYl.exe
  2⤵
  PID:7536
- C:\Windows\System\zmrCOBa.exe
  C:\Windows\System\zmrCOBa.exe
  2⤵
  PID:11276
- C:\Windows\System\dNFRfmJ.exe
  C:\Windows\System\dNFRfmJ.exe
  2⤵
  PID:12572
- C:\Windows\System\SFiVyya.exe
  C:\Windows\System\SFiVyya.exe
  2⤵
  PID:12448
- C:\Windows\System\eIukjuq.exe
  C:\Windows\System\eIukjuq.exe
  2⤵
  PID:12744
- C:\Windows\System\KxktcGF.exe
  C:\Windows\System\KxktcGF.exe
  2⤵
  PID:11828
- C:\Windows\System\tLwzMeq.exe
  C:\Windows\System\tLwzMeq.exe
  2⤵
  PID:12224
- C:\Windows\System\GxtOeTh.exe
  C:\Windows\System\GxtOeTh.exe
  2⤵
  PID:13048
- C:\Windows\System\IPmhEuk.exe
  C:\Windows\System\IPmhEuk.exe
  2⤵
  PID:12100
- C:\Windows\System\BIoLoyO.exe
  C:\Windows\System\BIoLoyO.exe
  2⤵
  PID:11620
- C:\Windows\System\KoncIEx.exe
  C:\Windows\System\KoncIEx.exe
  2⤵
  PID:12184
- C:\Windows\System\thaEzRn.exe
  C:\Windows\System\thaEzRn.exe
  2⤵
  PID:8224
- C:\Windows\System\fCICqWY.exe
  C:\Windows\System\fCICqWY.exe
  2⤵
  PID:12376
- C:\Windows\System\JOiwKUL.exe
  C:\Windows\System\JOiwKUL.exe
  2⤵
  PID:12220
- C:\Windows\System\DrJMBQk.exe
  C:\Windows\System\DrJMBQk.exe
  2⤵
  PID:11656
- C:\Windows\System\GsYjbYy.exe
  C:\Windows\System\GsYjbYy.exe
  2⤵
  PID:11668
- C:\Windows\System\fEBrHSH.exe
  C:\Windows\System\fEBrHSH.exe
  2⤵
  PID:13260
- C:\Windows\System\zsfAztK.exe
  C:\Windows\System\zsfAztK.exe
  2⤵
  PID:12320
- C:\Windows\System\GGAGmwM.exe
  C:\Windows\System\GGAGmwM.exe
  2⤵
  PID:1732
- C:\Windows\System\iZINBDd.exe
  C:\Windows\System\iZINBDd.exe
  2⤵
  PID:13304
- C:\Windows\System\opXqGpG.exe
  C:\Windows\System\opXqGpG.exe
  2⤵
  PID:8368
- C:\Windows\System\WKJRzqY.exe
  C:\Windows\System\WKJRzqY.exe
  2⤵
  PID:12076
- C:\Windows\System\cLhmeWK.exe
  C:\Windows\System\cLhmeWK.exe
  2⤵
  PID:11848
- C:\Windows\System\WezSHJb.exe
  C:\Windows\System\WezSHJb.exe
  2⤵
  PID:11552
- C:\Windows\System\DwWDBgb.exe
  C:\Windows\System\DwWDBgb.exe
  2⤵
  PID:12324
- C:\Windows\System\fnyzzJh.exe
  C:\Windows\System\fnyzzJh.exe
  2⤵
  PID:11120
- C:\Windows\System\rxiRyNk.exe
  C:\Windows\System\rxiRyNk.exe
  2⤵
  PID:12684
- C:\Windows\System\aHQphkS.exe
  C:\Windows\System\aHQphkS.exe
  2⤵
  PID:12336
- C:\Windows\System\PQbbjMJ.exe
  C:\Windows\System\PQbbjMJ.exe
  2⤵
  PID:10816
- C:\Windows\System\deWPMFM.exe
  C:\Windows\System\deWPMFM.exe
  2⤵
  PID:12040
- C:\Windows\System\QJiPesw.exe
  C:\Windows\System\QJiPesw.exe
  2⤵
  PID:9936
- C:\Windows\System\CBVJzrg.exe
  C:\Windows\System\CBVJzrg.exe
  2⤵
  PID:11512
- C:\Windows\System\tmXuwlw.exe
  C:\Windows\System\tmXuwlw.exe
  2⤵
  PID:13096
- C:\Windows\System\gyjlbYl.exe
  C:\Windows\System\gyjlbYl.exe
  2⤵
  PID:11056
- C:\Windows\System\upRdRWi.exe
  C:\Windows\System\upRdRWi.exe
  2⤵
  PID:12400
- C:\Windows\System\IBZyRgG.exe
  C:\Windows\System\IBZyRgG.exe
  2⤵
  PID:9484
- C:\Windows\System\lukDKwm.exe
  C:\Windows\System\lukDKwm.exe
  2⤵
  PID:11548
- C:\Windows\System\KLDyTfw.exe
  C:\Windows\System\KLDyTfw.exe
  2⤵
  PID:12380
- C:\Windows\System\vUlffXr.exe
  C:\Windows\System\vUlffXr.exe
  2⤵
  PID:2192
- C:\Windows\System\kPZYYEv.exe
  C:\Windows\System\kPZYYEv.exe
  2⤵
  PID:3484
- C:\Windows\System\bVKZeEZ.exe
  C:\Windows\System\bVKZeEZ.exe
  2⤵
  PID:11568
- C:\Windows\System\ypCUQPa.exe
  C:\Windows\System\ypCUQPa.exe
  2⤵
  PID:10404
- C:\Windows\System\NnMkDrQ.exe
  C:\Windows\System\NnMkDrQ.exe
  2⤵
  PID:11788
- C:\Windows\System\tAraPof.exe
  C:\Windows\System\tAraPof.exe
  2⤵
  PID:4064
- C:\Windows\System\yqCPcCu.exe
  C:\Windows\System\yqCPcCu.exe
  2⤵
  PID:12316
- C:\Windows\System\cDunHvq.exe
  C:\Windows\System\cDunHvq.exe
  2⤵
  PID:208
- C:\Windows\System\pyIVPsV.exe
  C:\Windows\System\pyIVPsV.exe
  2⤵
  PID:2280
- C:\Windows\System\chWwjqn.exe
  C:\Windows\System\chWwjqn.exe
  2⤵
  PID:3840
- C:\Windows\System\AswRxgA.exe
  C:\Windows\System\AswRxgA.exe
  2⤵
  PID:12768
- C:\Windows\System\hmxcLRh.exe
  C:\Windows\System\hmxcLRh.exe
  2⤵
  PID:10004
- C:\Windows\System\ABoLNSY.exe
  C:\Windows\System\ABoLNSY.exe
  2⤵
  PID:7200
- C:\Windows\System\RQlWKgt.exe
  C:\Windows\System\RQlWKgt.exe
  2⤵
  PID:3928
- C:\Windows\System\oQZApBe.exe
  C:\Windows\System\oQZApBe.exe
  2⤵
  PID:516
- C:\Windows\System\PAhUoMZ.exe
  C:\Windows\System\PAhUoMZ.exe
  2⤵
  PID:10556
- C:\Windows\System\ZXhkfWt.exe
  C:\Windows\System\ZXhkfWt.exe
  2⤵
  PID:5476
- C:\Windows\System\GlnYSRB.exe
  C:\Windows\System\GlnYSRB.exe
  2⤵
  PID:13420
- C:\Windows\System\njMqSAK.exe
  C:\Windows\System\njMqSAK.exe
  2⤵
  PID:13752
- C:\Windows\System\RwkZsWi.exe
  C:\Windows\System\RwkZsWi.exe
  2⤵
  PID:13768
- C:\Windows\System\XQmwGBI.exe
  C:\Windows\System\XQmwGBI.exe
  2⤵
  PID:13800
- C:\Windows\System\rOXIoiu.exe
  C:\Windows\System\rOXIoiu.exe
  2⤵
  PID:13824
- C:\Windows\System\EwaauYj.exe
  C:\Windows\System\EwaauYj.exe
  2⤵
  PID:13856
- C:\Windows\System\CmIWEOV.exe
  C:\Windows\System\CmIWEOV.exe
  2⤵
  PID:13892
- C:\Windows\System\TIWxgsf.exe
  C:\Windows\System\TIWxgsf.exe
  2⤵
  PID:13912
- C:\Windows\System\UgOZRrH.exe
  C:\Windows\System\UgOZRrH.exe
  2⤵
  PID:11876
- C:\Windows\System\SaaPnld.exe
  C:\Windows\System\SaaPnld.exe
  2⤵
  PID:10764
- C:\Windows\System\inoCqZW.exe
  C:\Windows\System\inoCqZW.exe
  2⤵
  PID:13956
- C:\Windows\System\IVAZAMw.exe
  C:\Windows\System\IVAZAMw.exe
  2⤵
  PID:13984
- C:\Windows\System\DbCmoVk.exe
  C:\Windows\System\DbCmoVk.exe
  2⤵
  PID:14084
- C:\Windows\System\PAPGagR.exe
  C:\Windows\System\PAPGagR.exe
  2⤵
  PID:14120
- C:\Windows\System\pGcumio.exe
  C:\Windows\System\pGcumio.exe
  2⤵
  PID:14136
- C:\Windows\System\MAICNij.exe
  C:\Windows\System\MAICNij.exe
  2⤵
  PID:14152
- C:\Windows\System\TEdVfxI.exe
  C:\Windows\System\TEdVfxI.exe
  2⤵
  PID:14180
- C:\Windows\System\VlVNKqr.exe
  C:\Windows\System\VlVNKqr.exe
  2⤵
  PID:14212
- C:\Windows\System\jKHmJUR.exe
  C:\Windows\System\jKHmJUR.exe
  2⤵
  PID:14252
- C:\Windows\System\ckgCpmX.exe
  C:\Windows\System\ckgCpmX.exe
  2⤵
  PID:5088
- C:\Windows\System\XKUSgST.exe
  C:\Windows\System\XKUSgST.exe
  2⤵
  PID:14276
- C:\Windows\System\JCVUVmS.exe
  C:\Windows\System\JCVUVmS.exe
  2⤵
  PID:14308
- C:\Windows\System\jBojgjK.exe
  C:\Windows\System\jBojgjK.exe
  2⤵
  PID:14324
- C:\Windows\System\RcnXnOr.exe
  C:\Windows\System\RcnXnOr.exe
  2⤵
  PID:13368
- C:\Windows\System\jrYigHr.exe
  C:\Windows\System\jrYigHr.exe
  2⤵
  PID:13404
- C:\Windows\System\WQNXXZl.exe
  C:\Windows\System\WQNXXZl.exe
  2⤵
  PID:13440
- C:\Windows\System\syWPhKB.exe
  C:\Windows\System\syWPhKB.exe
  2⤵
  PID:13480
- C:\Windows\System\RXVPZyq.exe
  C:\Windows\System\RXVPZyq.exe
  2⤵
  PID:1236
- C:\Windows\System\scxiPll.exe
  C:\Windows\System\scxiPll.exe
  2⤵
  PID:13636
- C:\Windows\System\LmCUlDQ.exe
  C:\Windows\System\LmCUlDQ.exe
  2⤵
  PID:13652
- C:\Windows\System\SZIoyUf.exe
  C:\Windows\System\SZIoyUf.exe
  2⤵
  PID:13672
- C:\Windows\System\rbiQWuD.exe
  C:\Windows\System\rbiQWuD.exe
  2⤵
  PID:13692
- C:\Windows\System\UbJILhy.exe
  C:\Windows\System\UbJILhy.exe
  2⤵
  PID:13712
- C:\Windows\System\LPwjkmx.exe
  C:\Windows\System\LPwjkmx.exe
  2⤵
  PID:13720
- C:\Windows\System\WXrSLvn.exe
  C:\Windows\System\WXrSLvn.exe
  2⤵
  PID:13732
- C:\Windows\System\awAYCNc.exe
  C:\Windows\System\awAYCNc.exe
  2⤵
  PID:4932
- C:\Windows\System\uxPUPTV.exe
  C:\Windows\System\uxPUPTV.exe
  2⤵
  PID:4356
- C:\Windows\System\NBuozcb.exe
  C:\Windows\System\NBuozcb.exe
  2⤵
  PID:13788
- C:\Windows\System\fXKYDNC.exe
  C:\Windows\System\fXKYDNC.exe
  2⤵
  PID:13884
- C:\Windows\System\aRJXyxr.exe
  C:\Windows\System\aRJXyxr.exe
  2⤵
  PID:13848
- C:\Windows\System\oHdwvmL.exe
  C:\Windows\System\oHdwvmL.exe
  2⤵
  PID:4640
- C:\Windows\System\kMGKVaB.exe
  C:\Windows\System\kMGKVaB.exe
  2⤵
  PID:11364
- C:\Windows\System\KmeiBwD.exe
  C:\Windows\System\KmeiBwD.exe
  2⤵
  PID:13996
- C:\Windows\System\ASpbxNR.exe
  C:\Windows\System\ASpbxNR.exe
  2⤵
  PID:13992
- C:\Windows\System\uRGGeUW.exe
  C:\Windows\System\uRGGeUW.exe
  2⤵
  PID:14052
- C:\Windows\System\FoYDOXQ.exe
  C:\Windows\System\FoYDOXQ.exe
  2⤵
  PID:4996
- C:\Windows\System\tlVmexh.exe
  C:\Windows\System\tlVmexh.exe
  2⤵
  PID:14096
- C:\Windows\System\dPEdaDY.exe
  C:\Windows\System\dPEdaDY.exe
  2⤵
  PID:628
- C:\Windows\System\fBujBBc.exe
  C:\Windows\System\fBujBBc.exe
  2⤵
  PID:14292
- C:\Windows\System\mffCYhU.exe
  C:\Windows\System\mffCYhU.exe
  2⤵
  PID:14284
- C:\Windows\System\oBkUtWo.exe
  C:\Windows\System\oBkUtWo.exe
  2⤵
  PID:13320
- C:\Windows\System\YpxlVqj.exe
  C:\Windows\System\YpxlVqj.exe
  2⤵
  PID:13532
- C:\Windows\System\emTobIE.exe
  C:\Windows\System\emTobIE.exe
  2⤵
  PID:4192
- C:\Windows\System\efagovt.exe
  C:\Windows\System\efagovt.exe
  2⤵
  PID:3708
- C:\Windows\System\nEgHbAw.exe
  C:\Windows\System\nEgHbAw.exe
  2⤵
  PID:13592
- C:\Windows\System\jxSNMzr.exe
  C:\Windows\System\jxSNMzr.exe
  2⤵
  PID:4212
- C:\Windows\System\KiKdqPL.exe
  C:\Windows\System\KiKdqPL.exe
  2⤵
  PID:13764
- C:\Windows\System\efLYVUb.exe
  C:\Windows\System\efLYVUb.exe
  2⤵
  PID:13644
- C:\Windows\System\aWngTrP.exe
  C:\Windows\System\aWngTrP.exe
  2⤵
  PID:13736
- C:\Windows\System\rBCMnvk.exe
  C:\Windows\System\rBCMnvk.exe
  2⤵
  PID:2560
- C:\Windows\System\JQbDFjf.exe
  C:\Windows\System\JQbDFjf.exe
  2⤵
  PID:2788
- C:\Windows\System\IfGtNcH.exe
  C:\Windows\System\IfGtNcH.exe
  2⤵
  PID:3048
- C:\Windows\System\adLXrFa.exe
  C:\Windows\System\adLXrFa.exe
  2⤵
  PID:13812
- C:\Windows\System\RLNZClh.exe
  C:\Windows\System\RLNZClh.exe
  2⤵
  PID:11344
- C:\Windows\System\lWNwFLv.exe
  C:\Windows\System\lWNwFLv.exe
  2⤵
  PID:6628
- C:\Windows\System\kCmMEye.exe
  C:\Windows\System\kCmMEye.exe
  2⤵
  PID:4884
- C:\Windows\System\nzEFQgs.exe
  C:\Windows\System\nzEFQgs.exe
  2⤵
  PID:4452
- C:\Windows\System\UKtKuJf.exe
  C:\Windows\System\UKtKuJf.exe
  2⤵
  PID:5220
- C:\Windows\System\JZpmPeX.exe
  C:\Windows\System\JZpmPeX.exe
  2⤵
  PID:14156
- C:\Windows\System\yhTcdKf.exe
  C:\Windows\System\yhTcdKf.exe
  2⤵
  PID:13376
- C:\Windows\System\jfIIQtm.exe
  C:\Windows\System\jfIIQtm.exe
  2⤵
  PID:13472
- C:\Windows\System\NCRskur.exe
  C:\Windows\System\NCRskur.exe
  2⤵
  PID:1316
- C:\Windows\System\VfLqQjU.exe
  C:\Windows\System\VfLqQjU.exe
  2⤵
  PID:13588
- C:\Windows\System\BTNjVPN.exe
  C:\Windows\System\BTNjVPN.exe
  2⤵
  PID:5496
- C:\Windows\System\hcZrQXu.exe
  C:\Windows\System\hcZrQXu.exe
  2⤵
  PID:13520
- C:\Windows\System\XkPpOWu.exe
  C:\Windows\System\XkPpOWu.exe
  2⤵
  PID:13536
- C:\Windows\System\ZuJdiMb.exe
  C:\Windows\System\ZuJdiMb.exe
  2⤵
  PID:1300
- C:\Windows\System\SoublRE.exe
  C:\Windows\System\SoublRE.exe
  2⤵
  PID:13628
- C:\Windows\System\RRMhTeo.exe
  C:\Windows\System\RRMhTeo.exe
  2⤵
  PID:13660
- C:\Windows\System\sBBzjge.exe
  C:\Windows\System\sBBzjge.exe
  2⤵
  PID:13688
- C:\Windows\System\hZycYYA.exe
  C:\Windows\System\hZycYYA.exe
  2⤵
  PID:3280
- C:\Windows\System\YmevJdv.exe
  C:\Windows\System\YmevJdv.exe
  2⤵
  PID:13680
- C:\Windows\System\ldsLbVA.exe
  C:\Windows\System\ldsLbVA.exe
  2⤵
  PID:13760
- C:\Windows\System\ZjIweWD.exe
  C:\Windows\System\ZjIweWD.exe
  2⤵
  PID:13816
- C:\Windows\System\cgJhmYI.exe
  C:\Windows\System\cgJhmYI.exe
  2⤵
  PID:14316
- C:\Windows\System\MEsxoHL.exe
  C:\Windows\System\MEsxoHL.exe
  2⤵
  PID:2556
- C:\Windows\System\loAqRCM.exe
  C:\Windows\System\loAqRCM.exe
  2⤵
  PID:14260
- C:\Windows\System\NYYMaFC.exe
  C:\Windows\System\NYYMaFC.exe
  2⤵
  PID:5244
- C:\Windows\System\cRLvAsS.exe
  C:\Windows\System\cRLvAsS.exe
  2⤵
  PID:5148
- C:\Windows\System\BqJqZcN.exe
  C:\Windows\System\BqJqZcN.exe
  2⤵
  PID:10100
- C:\Windows\System\wYUWuGV.exe
  C:\Windows\System\wYUWuGV.exe
  2⤵
  PID:5364
- C:\Windows\System\uugnSBh.exe
  C:\Windows\System\uugnSBh.exe
  2⤵
  PID:6976
- C:\Windows\System\FAkrgVV.exe
  C:\Windows\System\FAkrgVV.exe
  2⤵
  PID:5656
- C:\Windows\System\jeMCPDA.exe
  C:\Windows\System\jeMCPDA.exe
  2⤵
  PID:7540
- C:\Windows\System\nVgQaiG.exe
  C:\Windows\System\nVgQaiG.exe
  2⤵
  PID:7644
- C:\Windows\System\RlXLDaw.exe
  C:\Windows\System\RlXLDaw.exe
  2⤵
  PID:8044
- C:\Windows\System\ciHXBJP.exe
  C:\Windows\System\ciHXBJP.exe
  2⤵
  PID:13548
- C:\Windows\System\wtxDbPV.exe
  C:\Windows\System\wtxDbPV.exe
  2⤵
  PID:2764
- C:\Windows\System\YxIfcpp.exe
  C:\Windows\System\YxIfcpp.exe
  2⤵
  PID:2116
- C:\Windows\System\AVCXrBP.exe
  C:\Windows\System\AVCXrBP.exe
  2⤵
  PID:5348
- C:\Windows\System\aQRCAnh.exe
  C:\Windows\System\aQRCAnh.exe
  2⤵
  PID:4636
- C:\Windows\System\xOzYHMx.exe
  C:\Windows\System\xOzYHMx.exe
  2⤵
  PID:1132
- C:\Windows\System\xOjactz.exe
  C:\Windows\System\xOjactz.exe
  2⤵
  PID:13544
- C:\Windows\System\dEbQmtr.exe
  C:\Windows\System\dEbQmtr.exe
  2⤵
  PID:1268
- C:\Windows\System\uUchAsp.exe
  C:\Windows\System\uUchAsp.exe
  2⤵
  PID:5288
- C:\Windows\System\cWvPWiT.exe
  C:\Windows\System\cWvPWiT.exe
  2⤵
  PID:2284
- C:\Windows\System\ZyodqUm.exe
  C:\Windows\System\ZyodqUm.exe
  2⤵
  PID:5032
- C:\Windows\System\ZFgzXRa.exe
  C:\Windows\System\ZFgzXRa.exe
  2⤵
  PID:3940
- C:\Windows\System\sdALoTi.exe
  C:\Windows\System\sdALoTi.exe
  2⤵
  PID:13656
- C:\Windows\System\XbVrPsS.exe
  C:\Windows\System\XbVrPsS.exe
  2⤵
  PID:14032
- C:\Windows\System\UGHOcTc.exe
  C:\Windows\System\UGHOcTc.exe
  2⤵
  PID:13564
- C:\Windows\System\PKmkDKY.exe
  C:\Windows\System\PKmkDKY.exe
  2⤵
  PID:13744
- C:\Windows\System\vHtwSDi.exe
  C:\Windows\System\vHtwSDi.exe
  2⤵
  PID:5352
- C:\Windows\System\kvRFiIz.exe
  C:\Windows\System\kvRFiIz.exe
  2⤵
  PID:6364
- C:\Windows\System\YTSwtfH.exe
  C:\Windows\System\YTSwtfH.exe
  2⤵
  PID:1356
- C:\Windows\System\FSbQjbV.exe
  C:\Windows\System\FSbQjbV.exe
  2⤵
  PID:5500
- C:\Windows\System\AMUKNHP.exe
  C:\Windows\System\AMUKNHP.exe
  2⤵
  PID:6384
- C:\Windows\System\qMumtgi.exe
  C:\Windows\System\qMumtgi.exe
  2⤵
  PID:13380
- C:\Windows\System\YjRZwAE.exe
  C:\Windows\System\YjRZwAE.exe
  2⤵
  PID:5268
- C:\Windows\System\HYveIvK.exe
  C:\Windows\System\HYveIvK.exe
  2⤵
  PID:13676
- C:\Windows\System\XRyCPJZ.exe
  C:\Windows\System\XRyCPJZ.exe
  2⤵
  PID:348
- C:\Windows\System\TziYNyv.exe
  C:\Windows\System\TziYNyv.exe
  2⤵
  PID:4440
- C:\Windows\System\hngQNbZ.exe
  C:\Windows\System\hngQNbZ.exe
  2⤵
  PID:6888
- C:\Windows\System\tTfSgVu.exe
  C:\Windows\System\tTfSgVu.exe
  2⤵
  PID:13972
- C:\Windows\System\elOJrdN.exe
  C:\Windows\System\elOJrdN.exe
  2⤵
  PID:6408
- C:\Windows\System\blvkrUH.exe
  C:\Windows\System\blvkrUH.exe
  2⤵
  PID:6864
- C:\Windows\System\UPXzBEO.exe
  C:\Windows\System\UPXzBEO.exe
  2⤵
  PID:6376
- C:\Windows\System\DUlmiOH.exe
  C:\Windows\System\DUlmiOH.exe
  2⤵
  PID:6872
- C:\Windows\System\ispikkC.exe
  C:\Windows\System\ispikkC.exe
  2⤵
  PID:5472
- C:\Windows\System\nScnqtA.exe
  C:\Windows\System\nScnqtA.exe
  2⤵
  PID:6900
- C:\Windows\System\OiPmcai.exe
  C:\Windows\System\OiPmcai.exe
  2⤵
  PID:14320
- C:\Windows\System\ynlmvdE.exe
  C:\Windows\System\ynlmvdE.exe
  2⤵
  PID:5444
- C:\Windows\System\VJskRuf.exe
  C:\Windows\System\VJskRuf.exe
  2⤵
  PID:4652
- C:\Windows\System\PCZFaGO.exe
  C:\Windows\System\PCZFaGO.exe
  2⤵
  PID:6228
- C:\Windows\System\jWWDGXn.exe
  C:\Windows\System\jWWDGXn.exe
  2⤵
  PID:1896
- C:\Windows\System\ubiuyKS.exe
  C:\Windows\System\ubiuyKS.exe
  2⤵
  PID:13836
- C:\Windows\System\VYSKlKP.exe
  C:\Windows\System\VYSKlKP.exe
  2⤵
  PID:13872
- C:\Windows\System\XqDpgoJ.exe
  C:\Windows\System\XqDpgoJ.exe
  2⤵
  PID:5152
- C:\Windows\System\erNYOvj.exe
  C:\Windows\System\erNYOvj.exe
  2⤵
  PID:6028
- C:\Windows\System\evMcTzb.exe
  C:\Windows\System\evMcTzb.exe
  2⤵
  PID:6648
- C:\Windows\System\jhWZOsY.exe
  C:\Windows\System\jhWZOsY.exe
  2⤵
  PID:5196
- C:\Windows\System\IJrAYUB.exe
  C:\Windows\System\IJrAYUB.exe
  2⤵
  PID:14344
- C:\Windows\System\qDnhxYw.exe
  C:\Windows\System\qDnhxYw.exe
  2⤵
  PID:14360
- C:\Windows\System\qhaaUqq.exe
  C:\Windows\System\qhaaUqq.exe
  2⤵
  PID:14376
- C:\Windows\System\NFYYqGe.exe
  C:\Windows\System\NFYYqGe.exe
  2⤵
  PID:14392
- C:\Windows\System\cYKBQRY.exe
  C:\Windows\System\cYKBQRY.exe
  2⤵
  PID:14412
- C:\Windows\System\sGFCfZo.exe
  C:\Windows\System\sGFCfZo.exe
  2⤵
  PID:14524
- C:\Windows\System\HwiOfsW.exe
  C:\Windows\System\HwiOfsW.exe
  2⤵
  PID:14548
- C:\Windows\System\ejuCCWb.exe
  C:\Windows\System\ejuCCWb.exe
  2⤵
  PID:14572
- C:\Windows\System\skFEVuu.exe
  C:\Windows\System\skFEVuu.exe
  2⤵
  PID:14632
- C:\Windows\System\IsfgQoh.exe
  C:\Windows\System\IsfgQoh.exe
  2⤵
  PID:14648
- C:\Windows\System\TcAqRPq.exe
  C:\Windows\System\TcAqRPq.exe
  2⤵
  PID:14664
- C:\Windows\System\hlXeWBX.exe
  C:\Windows\System\hlXeWBX.exe
  2⤵
  PID:14680
- C:\Windows\System\BRlCoAT.exe
  C:\Windows\System\BRlCoAT.exe
  2⤵
  PID:14696
- C:\Windows\System\VQuurSC.exe
  C:\Windows\System\VQuurSC.exe
  2⤵
  PID:14712
- C:\Windows\System\whtjbUy.exe
  C:\Windows\System\whtjbUy.exe
  2⤵
  PID:14728
- C:\Windows\System\KQBGZgb.exe
  C:\Windows\System\KQBGZgb.exe
  2⤵
  PID:14760
- C:\Windows\System\CLCtjDy.exe
  C:\Windows\System\CLCtjDy.exe
  2⤵
  PID:14904
- C:\Windows\System\OiSCUCG.exe
  C:\Windows\System\OiSCUCG.exe
  2⤵
  PID:14920
- C:\Windows\System\HwILfZa.exe
  C:\Windows\System\HwILfZa.exe
  2⤵
  PID:14940
- C:\Windows\System\hehzlEU.exe
  C:\Windows\System\hehzlEU.exe
  2⤵
  PID:14964
- C:\Windows\System\YzHQkWg.exe
  C:\Windows\System\YzHQkWg.exe
  2⤵
  PID:14980
- C:\Windows\System\CgXEblF.exe
  C:\Windows\System\CgXEblF.exe
  2⤵
  PID:15008
- C:\Windows\System\nBSMndw.exe
  C:\Windows\System\nBSMndw.exe
  2⤵
  PID:15060
- C:\Windows\System\nNcRaHi.exe
  C:\Windows\System\nNcRaHi.exe
  2⤵
  PID:15080
- C:\Windows\System\eKUAgzI.exe
  C:\Windows\System\eKUAgzI.exe
  2⤵
  PID:15120
- C:\Windows\System\xfftOJb.exe
  C:\Windows\System\xfftOJb.exe
  2⤵
  PID:6220
- C:\Windows\System\hQJxQuD.exe
  C:\Windows\System\hQJxQuD.exe
  2⤵
  PID:14436
- C:\Windows\System\bvsLKAs.exe
  C:\Windows\System\bvsLKAs.exe
  2⤵
  PID:14708
- C:\Windows\System\PJrSVNJ.exe
  C:\Windows\System\PJrSVNJ.exe
  2⤵
  PID:14480
- C:\Windows\System\hyPJoNr.exe
  C:\Windows\System\hyPJoNr.exe
  2⤵
  PID:14768
- C:\Windows\System\nBEMhRU.exe
  C:\Windows\System\nBEMhRU.exe
  2⤵
  PID:2400
- C:\Windows\System\LxTBeNc.exe
  C:\Windows\System\LxTBeNc.exe
  2⤵
  PID:14368
- C:\Windows\System\UGkwLYh.exe
  C:\Windows\System\UGkwLYh.exe
  2⤵
  PID:14520
- C:\Windows\System\lEqFECK.exe
  C:\Windows\System\lEqFECK.exe
  2⤵
  PID:14540
- C:\Windows\System\HqVZzzA.exe
  C:\Windows\System\HqVZzzA.exe
  2⤵
  PID:15048
- C:\Windows\System\ZHeqqUo.exe
  C:\Windows\System\ZHeqqUo.exe
  2⤵
  PID:15068
- C:\Windows\System\WNzRIkU.exe
  C:\Windows\System\WNzRIkU.exe
  2⤵
  PID:2716
- C:\Windows\System\HQLeEJr.exe
  C:\Windows\System\HQLeEJr.exe
  2⤵
  PID:15108
- C:\Windows\System\pSbyAXO.exe
  C:\Windows\System\pSbyAXO.exe
  2⤵
  PID:14752
- C:\Windows\System\OgGKFVW.exe
  C:\Windows\System\OgGKFVW.exe
  2⤵
  PID:14780
- C:\Windows\System\hLdHnyv.exe
  C:\Windows\System\hLdHnyv.exe
  2⤵
  PID:14988
- C:\Windows\System\wAHEWXs.exe
  C:\Windows\System\wAHEWXs.exe
  2⤵
  PID:14816
- C:\Windows\System\vaEGbAn.exe
  C:\Windows\System\vaEGbAn.exe
  2⤵
  PID:15036
- C:\Windows\System\RiKSWHa.exe
  C:\Windows\System\RiKSWHa.exe
  2⤵
  PID:15248
- C:\Windows\System\oYQYIuf.exe
  C:\Windows\System\oYQYIuf.exe
  2⤵
  PID:7184
- C:\Windows\System\eshmTKy.exe
  C:\Windows\System\eshmTKy.exe
  2⤵
  PID:14912
- C:\Windows\System\hRhqWmO.exe
  C:\Windows\System\hRhqWmO.exe
  2⤵
  PID:6816
- C:\Windows\System\ooieKNz.exe
  C:\Windows\System\ooieKNz.exe
  2⤵
  PID:568
- C:\Windows\System\ihAfidm.exe
  C:\Windows\System\ihAfidm.exe
  2⤵
  PID:6100
- C:\Windows\System\DvelIJV.exe
  C:\Windows\System\DvelIJV.exe
  2⤵
  PID:4692
- C:\Windows\System\eDfifdI.exe
  C:\Windows\System\eDfifdI.exe
  2⤵
  PID:7236
- C:\Windows\System\kmkBdKE.exe
  C:\Windows\System\kmkBdKE.exe
  2⤵
  PID:15348
- C:\Windows\System\RwsktWS.exe
  C:\Windows\System\RwsktWS.exe
  2⤵
  PID:5456
- C:\Windows\System\nKjlBAz.exe
  C:\Windows\System\nKjlBAz.exe
  2⤵
  PID:7816
- C:\Windows\System\XRgYxIr.exe
  C:\Windows\System\XRgYxIr.exe
  2⤵
  PID:6936
- C:\Windows\System\PZLyvgY.exe
  C:\Windows\System\PZLyvgY.exe
  2⤵
  PID:7140
- C:\Windows\System\xsdDSsa.exe
  C:\Windows\System\xsdDSsa.exe
  2⤵
  PID:1444
- C:\Windows\System\KURqLQJ.exe
  C:\Windows\System\KURqLQJ.exe
  2⤵
  PID:15324
- C:\Windows\System\HaDzwsb.exe
  C:\Windows\System\HaDzwsb.exe
  2⤵
  PID:6940
- C:\Windows\System\WzrlqZU.exe
  C:\Windows\System\WzrlqZU.exe
  2⤵
  PID:6700
- C:\Windows\System\rHQJvEn.exe
  C:\Windows\System\rHQJvEn.exe
  2⤵
  PID:15344
- C:\Windows\System\mrjAfqr.exe
  C:\Windows\System\mrjAfqr.exe
  2⤵
  PID:7656
- C:\Windows\System\pbPAGOY.exe
  C:\Windows\System\pbPAGOY.exe
  2⤵
  PID:14400
- C:\Windows\System\AIbBgSH.exe
  C:\Windows\System\AIbBgSH.exe
  2⤵
  PID:1504
- C:\Windows\System\vqeAKAc.exe
  C:\Windows\System\vqeAKAc.exe
  2⤵
  PID:8172
- C:\Windows\System\CxyLqOY.exe
  C:\Windows\System\CxyLqOY.exe
  2⤵
  PID:6048
- C:\Windows\System\pkoHAze.exe
  C:\Windows\System\pkoHAze.exe
  2⤵
  PID:14808
- C:\Windows\System\ufzLLhT.exe
  C:\Windows\System\ufzLLhT.exe
  2⤵
  PID:6116
- C:\Windows\System\mAztGTT.exe
  C:\Windows\System\mAztGTT.exe
  2⤵
  PID:14600
- C:\Windows\System\EvjxpsI.exe
  C:\Windows\System\EvjxpsI.exe
  2⤵
  PID:5904
- C:\Windows\System\RddTjcq.exe
  C:\Windows\System\RddTjcq.exe
  2⤵
  PID:7956
- C:\Windows\System\EhEReYt.exe
  C:\Windows\System\EhEReYt.exe
  2⤵
  PID:14408
- C:\Windows\System\VcqIijT.exe
  C:\Windows\System\VcqIijT.exe
  2⤵
  PID:15340
- C:\Windows\System\QiOaQPO.exe
  C:\Windows\System\QiOaQPO.exe
  2⤵
  PID:14244
- C:\Windows\System\IxjYmPo.exe
  C:\Windows\System\IxjYmPo.exe
  2⤵
  PID:14532
- C:\Windows\System\pbRQGeh.exe
  C:\Windows\System\pbRQGeh.exe
  2⤵
  PID:4252
- C:\Windows\System\SDeHZwS.exe
  C:\Windows\System\SDeHZwS.exe
  2⤵
  PID:5916
- C:\Windows\System\tVJVLjZ.exe
  C:\Windows\System\tVJVLjZ.exe
  2⤵
  PID:8020
- C:\Windows\System\KIxhzFG.exe
  C:\Windows\System\KIxhzFG.exe
  2⤵
  PID:6412
- C:\Windows\System\BIfCFle.exe
  C:\Windows\System\BIfCFle.exe
  2⤵
  PID:14688
- C:\Windows\System\POnPnXB.exe
  C:\Windows\System\POnPnXB.exe
  2⤵
  PID:14776
- C:\Windows\System\qQkZgqT.exe
  C:\Windows\System\qQkZgqT.exe
  2⤵
  PID:14872
- C:\Windows\System\QFSFKYy.exe
  C:\Windows\System\QFSFKYy.exe
  2⤵
  PID:15300
- C:\Windows\System\YiiHEHx.exe
  C:\Windows\System\YiiHEHx.exe
  2⤵
  PID:15204
- C:\Windows\System\BpqrfWO.exe
  C:\Windows\System\BpqrfWO.exe
  2⤵
  PID:15148
- C:\Windows\System\xkEHIzm.exe
  C:\Windows\System\xkEHIzm.exe
  2⤵
  PID:15228
- C:\Windows\System\EtozshP.exe
  C:\Windows\System\EtozshP.exe
  2⤵
  PID:14892
- C:\Windows\System\yZpXMZj.exe
  C:\Windows\System\yZpXMZj.exe
  2⤵
  PID:15328
- C:\Windows\System\JKcumSw.exe
  C:\Windows\System\JKcumSw.exe
  2⤵
  PID:4100
- C:\Windows\System\GsftiwI.exe
  C:\Windows\System\GsftiwI.exe
  2⤵
  PID:7660
- C:\Windows\System\UXXprlm.exe
  C:\Windows\System\UXXprlm.exe
  2⤵
  PID:7648
- C:\Windows\System\ywSDTmA.exe
  C:\Windows\System\ywSDTmA.exe
  2⤵
  PID:15284
- C:\Windows\System\OxEGPSp.exe
  C:\Windows\System\OxEGPSp.exe
  2⤵
  PID:1576
- C:\Windows\System\gxfimku.exe
  C:\Windows\System\gxfimku.exe
  2⤵
  PID:7316
- C:\Windows\System\wPzIkLQ.exe
  C:\Windows\System\wPzIkLQ.exe
  2⤵
  PID:8180
- C:\Windows\System\xavFSWT.exe
  C:\Windows\System\xavFSWT.exe
  2⤵
  PID:6168
- C:\Windows\System\grevDqY.exe
  C:\Windows\System\grevDqY.exe
  2⤵
  PID:4864
- C:\Windows\System\DScKzIs.exe
  C:\Windows\System\DScKzIs.exe
  2⤵
  PID:1792
- C:\Windows\System\pEEQgIt.exe
  C:\Windows\System\pEEQgIt.exe
  2⤵
  PID:6860
- C:\Windows\System\YvhSZqY.exe
  C:\Windows\System\YvhSZqY.exe
  2⤵
  PID:14616
- C:\Windows\System\ndhCnxX.exe
  C:\Windows\System\ndhCnxX.exe
  2⤵
  PID:8096
- C:\Windows\System\CrSrvNU.exe
  C:\Windows\System\CrSrvNU.exe
  2⤵
  PID:14932
- C:\Windows\System\xkmHqPZ.exe
  C:\Windows\System\xkmHqPZ.exe
  2⤵
  PID:15140
- C:\Windows\System\kZcUVQX.exe
  C:\Windows\System\kZcUVQX.exe
  2⤵
  PID:15196
- C:\Windows\System\PiMqvnU.exe
  C:\Windows\System\PiMqvnU.exe
  2⤵
  PID:5812
- C:\Windows\System\AQVTEYK.exe
  C:\Windows\System\AQVTEYK.exe
  2⤵
  PID:6596
- C:\Windows\System\hLCRmth.exe
  C:\Windows\System\hLCRmth.exe
  2⤵
  PID:8548
- C:\Windows\System\zsvtgVt.exe
  C:\Windows\System\zsvtgVt.exe
  2⤵
  PID:14756
- C:\Windows\System\CzjSHJy.exe
  C:\Windows\System\CzjSHJy.exe
  2⤵
  PID:12500
- C:\Windows\System\OHiKSfh.exe
  C:\Windows\System\OHiKSfh.exe
  2⤵
  PID:14424
- C:\Windows\System\GInfqPw.exe
  C:\Windows\System\GInfqPw.exe
  2⤵
  PID:7560
- C:\Windows\System\kcvNkxt.exe
  C:\Windows\System\kcvNkxt.exe
  2⤵
  PID:7608
- C:\Windows\System\rBJdMra.exe
  C:\Windows\System\rBJdMra.exe
  2⤵
  PID:14372
- C:\Windows\System\RWRfiHY.exe
  C:\Windows\System\RWRfiHY.exe
  2⤵
  PID:1980
- C:\Windows\System\whXfDXQ.exe
  C:\Windows\System\whXfDXQ.exe
  2⤵
  PID:8652
- C:\Windows\System\KuMEPnl.exe
  C:\Windows\System\KuMEPnl.exe
  2⤵
  PID:8152
- C:\Windows\System\qszseWN.exe
  C:\Windows\System\qszseWN.exe
  2⤵
  PID:6164
- C:\Windows\System\ujhiArP.exe
  C:\Windows\System\ujhiArP.exe
  2⤵
  PID:5316
- C:\Windows\System\sAERJLs.exe
  C:\Windows\System\sAERJLs.exe
  2⤵
  PID:8384
- C:\Windows\System\hQsbhwh.exe
  C:\Windows\System\hQsbhwh.exe
  2⤵
  PID:8420
- C:\Windows\System\MnacLfX.exe
  C:\Windows\System\MnacLfX.exe
  2⤵
  PID:8148
- C:\Windows\System\QhLWGxX.exe
  C:\Windows\System\QhLWGxX.exe
  2⤵
  PID:2976
- C:\Windows\System\BrnIeEA.exe
  C:\Windows\System\BrnIeEA.exe
  2⤵
  PID:8632
- C:\Windows\System\dxCLAds.exe
  C:\Windows\System\dxCLAds.exe
  2⤵
  PID:15016
- C:\Windows\System\hjbwOJI.exe
  C:\Windows\System\hjbwOJI.exe
  2⤵
  PID:6932
- C:\Windows\System\HBXqYGj.exe
  C:\Windows\System\HBXqYGj.exe
  2⤵
  PID:9112
- C:\Windows\System\hbqZCED.exe
  C:\Windows\System\hbqZCED.exe
  2⤵
  PID:10648
- C:\Windows\System\aVkxWpk.exe
  C:\Windows\System\aVkxWpk.exe
  2⤵
  PID:9152
- C:\Windows\System\zxDBEvi.exe
  C:\Windows\System\zxDBEvi.exe
  2⤵
  PID:8812
- C:\Windows\System\FynmCiw.exe
  C:\Windows\System\FynmCiw.exe
  2⤵
  PID:4384
- C:\Windows\System\glJsKzw.exe
  C:\Windows\System\glJsKzw.exe
  2⤵
  PID:8592
- C:\Windows\System\zqmaXYZ.exe
  C:\Windows\System\zqmaXYZ.exe
  2⤵
  PID:14432
- C:\Windows\System\ujoQQjU.exe
  C:\Windows\System\ujoQQjU.exe
  2⤵
  PID:6392
- C:\Windows\System\uGDMJcO.exe
  C:\Windows\System\uGDMJcO.exe
  2⤵
  PID:7916
- C:\Windows\System\HeYAtRh.exe
  C:\Windows\System\HeYAtRh.exe
  2⤵
  PID:6856
- C:\Windows\System\lfUTImq.exe
  C:\Windows\System\lfUTImq.exe
  2⤵
  PID:9604
- C:\Windows\System\EnAoZmu.exe
  C:\Windows\System\EnAoZmu.exe
  2⤵
  PID:8520
- C:\Windows\System\OBLaWdR.exe
  C:\Windows\System\OBLaWdR.exe
  2⤵
  PID:8900
- C:\Windows\System\bdIsxgU.exe
  C:\Windows\System\bdIsxgU.exe
  2⤵
  PID:11164
- C:\Windows\System\GaOAwgT.exe
  C:\Windows\System\GaOAwgT.exe
  2⤵
  PID:8816
- C:\Windows\System\bSkIgEN.exe
  C:\Windows\System\bSkIgEN.exe
  2⤵
  PID:8792
- C:\Windows\System\MWfjcgz.exe
  C:\Windows\System\MWfjcgz.exe
  2⤵
  PID:8768
- C:\Windows\System\khjEIVe.exe
  C:\Windows\System\khjEIVe.exe
  2⤵
  PID:8220
- C:\Windows\System\tXNVoXx.exe
  C:\Windows\System\tXNVoXx.exe
  2⤵
  PID:13280
- C:\Windows\System\rZmnEIF.exe
  C:\Windows\System\rZmnEIF.exe
  2⤵
  PID:8128
- C:\Windows\System\XUkwCvw.exe
  C:\Windows\System\XUkwCvw.exe
  2⤵
  PID:9556
- C:\Windows\System\LvIRbUB.exe
  C:\Windows\System\LvIRbUB.exe
  2⤵
  PID:9356
- C:\Windows\System\aEeheWq.exe
  C:\Windows\System\aEeheWq.exe
  2⤵
  PID:6340
- C:\Windows\System\WUSAGDc.exe
  C:\Windows\System\WUSAGDc.exe
  2⤵
  PID:6532
- C:\Windows\System\OrpHQrw.exe
  C:\Windows\System\OrpHQrw.exe
  2⤵
  PID:9224
- C:\Windows\System\DutyLxI.exe
  C:\Windows\System\DutyLxI.exe
  2⤵
  PID:9672
- C:\Windows\System\zIbWzkz.exe
  C:\Windows\System\zIbWzkz.exe
  2⤵
  PID:9012
- C:\Windows\System\FTZGvhZ.exe
  C:\Windows\System\FTZGvhZ.exe
  2⤵
  PID:8672
- C:\Windows\System\RNYHuUN.exe
  C:\Windows\System\RNYHuUN.exe
  2⤵
  PID:10340
- C:\Windows\System\jDqYYrt.exe
  C:\Windows\System\jDqYYrt.exe
  2⤵
  PID:8660
- C:\Windows\System\CvWjNzP.exe
  C:\Windows\System\CvWjNzP.exe
  2⤵
  PID:6468
- C:\Windows\System\vjVJSnV.exe
  C:\Windows\System\vjVJSnV.exe
  2⤵
  PID:8848
- C:\Windows\System\yVkUOkF.exe
  C:\Windows\System\yVkUOkF.exe
  2⤵
  PID:9704
- C:\Windows\System\fUFXTfD.exe
  C:\Windows\System\fUFXTfD.exe
  2⤵
  PID:5572
- C:\Windows\System\vZmpMil.exe
  C:\Windows\System\vZmpMil.exe
  2⤵
  PID:8984
- C:\Windows\System\unIqkbG.exe
  C:\Windows\System\unIqkbG.exe
  2⤵
  PID:9108
- C:\Windows\System\fQrJkTO.exe
  C:\Windows\System\fQrJkTO.exe
  2⤵
  PID:10048
- C:\Windows\System\uPvUgNa.exe
  C:\Windows\System\uPvUgNa.exe
  2⤵
  PID:9932
- C:\Windows\System\YgwKGTX.exe
  C:\Windows\System\YgwKGTX.exe
  2⤵
  PID:10400
- C:\Windows\System\xUjYvik.exe
  C:\Windows\System\xUjYvik.exe
  2⤵
  PID:10436
- C:\Windows\System\GDFiHGJ.exe
  C:\Windows\System\GDFiHGJ.exe
  2⤵
  PID:9852
- C:\Windows\System\AsyJLQs.exe
  C:\Windows\System\AsyJLQs.exe
  2⤵
  PID:12164
- C:\Windows\System\gMEalgS.exe
  C:\Windows\System\gMEalgS.exe
  2⤵
  PID:3896
- C:\Windows\System\YPgclax.exe
  C:\Windows\System\YPgclax.exe
  2⤵
  PID:9620
- C:\Windows\System\EjysBDw.exe
  C:\Windows\System\EjysBDw.exe
  2⤵
  PID:8448
- C:\Windows\System\ayQYZeW.exe
  C:\Windows\System\ayQYZeW.exe
  2⤵
  PID:9588
- C:\Windows\System\ooyAcOq.exe
  C:\Windows\System\ooyAcOq.exe
  2⤵
  PID:9140
- C:\Windows\System\AHNVwoN.exe
  C:\Windows\System\AHNVwoN.exe
  2⤵
  PID:11008
- C:\Windows\System\NHeKSJy.exe
  C:\Windows\System\NHeKSJy.exe
  2⤵
  PID:9248
- C:\Windows\System\ZWPtVhw.exe
  C:\Windows\System\ZWPtVhw.exe
  2⤵
  PID:13328
- C:\Windows\System\gXHniyU.exe
  C:\Windows\System\gXHniyU.exe
  2⤵
  PID:13384
- C:\Windows\System\tTkHSRz.exe
  C:\Windows\System\tTkHSRz.exe
  2⤵
  PID:8324
- C:\Windows\System\WyeeLyk.exe
  C:\Windows\System\WyeeLyk.exe
  2⤵
  PID:8624
- C:\Windows\System\QMulzpI.exe
  C:\Windows\System\QMulzpI.exe
  2⤵
  PID:9072
- C:\Windows\System\sfozVog.exe
  C:\Windows\System\sfozVog.exe
  2⤵
  PID:15380
- C:\Windows\System\hDVhjmM.exe
  C:\Windows\System\hDVhjmM.exe
  2⤵
  PID:15404
- C:\Windows\System\ihvXJwz.exe
  C:\Windows\System\ihvXJwz.exe
  2⤵
  PID:15428
- C:\Windows\System\kPObsce.exe
  C:\Windows\System\kPObsce.exe
  2⤵
  PID:15456
- C:\Windows\System\uUMzvvM.exe
  C:\Windows\System\uUMzvvM.exe
  2⤵
  PID:15484
- C:\Windows\System\nVHwSxv.exe
  C:\Windows\System\nVHwSxv.exe
  2⤵
  PID:15512
- C:\Windows\System\AhNOIzL.exe
  C:\Windows\System\AhNOIzL.exe
  2⤵
  PID:15540
- C:\Windows\System\BMDWeBt.exe
  C:\Windows\System\BMDWeBt.exe
  2⤵
  PID:15608
- C:\Windows\System\izoFfSX.exe
  C:\Windows\System\izoFfSX.exe
  2⤵
  PID:15640
- C:\Windows\System\jylCgNz.exe
  C:\Windows\System\jylCgNz.exe
  2⤵
  PID:15660
- C:\Windows\System\MgYcsyt.exe
  C:\Windows\System\MgYcsyt.exe
  2⤵
  PID:15684
- C:\Windows\System\IPlQRSZ.exe
  C:\Windows\System\IPlQRSZ.exe
  2⤵
  PID:15708
- C:\Windows\System\bXprenc.exe
  C:\Windows\System\bXprenc.exe
  2⤵
  PID:15724
- C:\Windows\System\vEdQKmO.exe
  C:\Windows\System\vEdQKmO.exe
  2⤵
  PID:15752
- C:\Windows\System\mUmVduJ.exe
  C:\Windows\System\mUmVduJ.exe
  2⤵
  PID:15772
- C:\Windows\System\UvpTBaW.exe
  C:\Windows\System\UvpTBaW.exe
  2⤵
  PID:15960
- C:\Windows\System\WnzKEMS.exe
  C:\Windows\System\WnzKEMS.exe
  2⤵
  PID:15984
- C:\Windows\System\DXTAdaC.exe
  C:\Windows\System\DXTAdaC.exe
  2⤵
  PID:16012
- C:\Windows\System\JZZmJxL.exe
  C:\Windows\System\JZZmJxL.exe
  2⤵
  PID:16028
- C:\Windows\System\ZzkPisq.exe
  C:\Windows\System\ZzkPisq.exe
  2⤵
  PID:16044
- C:\Windows\System\RxcvXEU.exe
  C:\Windows\System\RxcvXEU.exe
  2⤵
  PID:16064
- C:\Windows\System\ZVjuNDr.exe
  C:\Windows\System\ZVjuNDr.exe
  2⤵
  PID:10228
- C:\Windows\System\AFckndt.exe
  C:\Windows\System\AFckndt.exe
  2⤵
  PID:10856
- C:\Windows\System\DDGWDUU.exe
  C:\Windows\System\DDGWDUU.exe
  2⤵
  PID:10780
- C:\Windows\System\eOkoMik.exe
  C:\Windows\System\eOkoMik.exe
  2⤵
  PID:13116
- C:\Windows\System\caUhaOk.exe
  C:\Windows\System\caUhaOk.exe
  2⤵
  PID:10372
- C:\Windows\System\qtSaLoI.exe
  C:\Windows\System\qtSaLoI.exe
  2⤵
  PID:9716
- C:\Windows\System\bMYVnmc.exe
  C:\Windows\System\bMYVnmc.exe
  2⤵
  PID:7508
- C:\Windows\System\WhiGHaf.exe
  C:\Windows\System\WhiGHaf.exe
  2⤵
  PID:9452
- C:\Windows\System\zfRePrU.exe
  C:\Windows\System\zfRePrU.exe
  2⤵
  PID:9820
- C:\Windows\System\saLRsFX.exe
  C:\Windows\System\saLRsFX.exe
  2⤵
  PID:15392
- C:\Windows\System\iVhlqoU.exe
  C:\Windows\System\iVhlqoU.exe
  2⤵
  PID:10528
- C:\Windows\System\AQkkNib.exe
  C:\Windows\System\AQkkNib.exe
  2⤵
  PID:9016
- C:\Windows\System\PRCRDnz.exe
  C:\Windows\System\PRCRDnz.exe
  2⤵
  PID:15572
- C:\Windows\System\hrXDkZA.exe
  C:\Windows\System\hrXDkZA.exe
  2⤵
  PID:15576
- C:\Windows\System\qQGNBps.exe
  C:\Windows\System\qQGNBps.exe
  2⤵
  PID:4072
- C:\Windows\System\ZlTKpOB.exe
  C:\Windows\System\ZlTKpOB.exe
  2⤵
  PID:11052
- C:\Windows\System\iKrSjRe.exe
  C:\Windows\System\iKrSjRe.exe
  2⤵
  PID:10320
- C:\Windows\System\lATitZV.exe
  C:\Windows\System\lATitZV.exe
  2⤵
  PID:11160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oyea3zpm.p4s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AavwJcX.exe

Filesize
1.9MB

MD5
2da6a407b2f109099ca7382d528aa472

SHA1
9c5953e7537df434905a0f8357a033eac10d0dcb

SHA256
4863c33886e0bbdee1c0e2d4ff0f5bd5ed6e1391b718d71930686f433773279d

SHA512
dbd0ad86c0ebbc950bcffbfb90f7cfbb09c7565eff5f7511f73b03576130ed2eaf310d226a907f8d70fc96f655bd01ed75477f87c34096984355aa0099d67363

Download Submit
C:\Windows\System\BtrFkrc.exe

Filesize
1.9MB

MD5
a96328d237e27e7b73762744d2b95b5b

SHA1
75461faaa492338c3b859abffbc4a64a0d471e8a

SHA256
7f90b66df2ea592c803cce57ae330460ba3815b119bbbb92e7e100350a7d6622

SHA512
df02c9ba31666a312d890e46a8c9ff9a9f80df434667374b0a1ffda2ea86d947ed419b88fa6674a8281aed3566cec81146dfef3e91eb1e5369163099f46fe4a7

Download Submit
C:\Windows\System\BzxsFnF.exe

Filesize
1.9MB

MD5
7371414b5077634d4f6f67fce9e0c9fa

SHA1
577c92aa5d3dfaa035d713f698f7b55510496746

SHA256
82535ff9e4fbc3af2d16fb8973d118ee2918b16860c308ec4063ac8772b26051

SHA512
3c2e600b39138744cca3fa26b81c52403733a7f082cddaaa4ebb536801965d1f4543faa9fdfeeb0fb1a882a65cb370168b53380cb27f3ebe05ffde8232f71ac0

Download Submit
C:\Windows\System\CvRhMbH.exe

Filesize
1.9MB

MD5
3a0601406459a02fd359d6e91e7fb367

SHA1
0deb428abf9220d6ec7c36ff6e810dab3e0324eb

SHA256
f59dd286dad5f6da350822aa1863206f505bd89571a06475f94fc14d5e1fdacf

SHA512
dc89e2046b429360d8a004cfde9b4a7fb821b3c47d68dcceeffa4b13f0ee7cf850c6df333b1c86fb5eb3c126521c9dcc7d686796de1255581c70a3c76f057a71

Download Submit
C:\Windows\System\FjewxCg.exe

Filesize
1.9MB

MD5
fbbb700c9a93f05e0f56a45f2fb20be3

SHA1
05e69180ff6b19a58e7e4e1c13c533228c196055

SHA256
e5dba46ed186563479c7a8ebe8bc4d4e1137fc5299bb00f44c74e92930679937

SHA512
b1200b25dc3e7928fa87cf5930008d4de18f5432f4d18b2a84687f0f508a2b2a9c3f25aa22183c5fedad89e2e7bb2ea01b9c523126e806f338d7cbc80ca1c710

Download Submit
C:\Windows\System\FnFKczB.exe

Filesize
1.9MB

MD5
641cee22df1d9dbfd95d5de0d1f7e38d

SHA1
f1ead181b7b827a93e63f47151c0706d98a63fda

SHA256
9de1c2c57e3cb3aae922c45c2384960d4234ca12e2c171fb5879734e271e279d

SHA512
53b1f6093545b0068e0a2409f865d370c9224d31f8b07d9420f4df013db40f5ea9ec43f2e06cf9974696f32d1180810481a794ad6947ba6aac28e98e5a18e36e

Download Submit
C:\Windows\System\GqmQAEn.exe

Filesize
1.9MB

MD5
27e2546acbbcb14e52aac4fc25d8531c

SHA1
e9541409b2d115019c9196d82d331ea22abd50a9

SHA256
710fd9ad28b757ea0a800203e343ea10116d1f9de51649fe15ab1508e20a8bb4

SHA512
e1922a772cf66b5d645155fa27ca8c58819d52f509e25378817bee0cec29d894579da3e71cf71b82a2419ba096b457b9093e49aad880f111866eb594db06e3f0

Download Submit
C:\Windows\System\IHRtKKO.exe

Filesize
1.9MB

MD5
eb5a24a4496134993c7a6e4596df6065

SHA1
1c9bbd06bd0c3571b87b211b22378e4b6c6ea547

SHA256
c09124ad8b885ecc3793d1a536299111592b6effdae1d4f85f5f7d22251722e7

SHA512
eff03ed24a3ce04459b03e58dfbeeb8306610d481f6e6c1aad6156aa06a879cd77ede328c7c95392b7590e4bcc08817355b2246cacea4e224f176a4ceedc2021

Download Submit
C:\Windows\System\IZNxbIZ.exe

Filesize
1.9MB

MD5
625c2494ab5894197e8c505b01ccc464

SHA1
e5936392bb55df8ac1b48c0cc4b872ec1cbf8b19

SHA256
d4c03589fb78f051e6dadbafbcf9946ada5f7dc8fdbe3233ecffc4900c2262d9

SHA512
1405298b09f995f61adb6ea4d1627aa84caa33c12b8175d512cc0e45b4c8cda932be6270beb161a61fee97c666dc2486549384286ebf72199ff20f5e9018344c

Download Submit
C:\Windows\System\JqeJAOX.exe

Filesize
1.9MB

MD5
58fdb51b20385a4d925e3cf9e83125cc

SHA1
0dcea815e1c5fb44bde21fad695f57095a3d00cc

SHA256
4c6c4e372d884e9d8058a9af23fd1dea1c9376f7964acf34c87287d0e29e59b8

SHA512
260a46301740ea88db2d126da30ed8d1b15122f40f92fab6d84ed98d9c63e2d2d849097b815fbec2e7156769adcae5f43f2b3ebe4aadfc1b314a02033d0b710c

Download Submit
C:\Windows\System\MkrOwTu.exe

Filesize
1.9MB

MD5
61405bda90d29acf88dccead7c594fcf

SHA1
77b44a9d89f43c7f9e77e360481ec82c3b276334

SHA256
d98385ee53a477ffe4e1a321a0f01d38550216427fa8c3db5c6cdbb995c7971f

SHA512
0e2d3f38b8f75cfa5b10115c18ddf9b87bd0622b75fabaec6cc38206e122b3c00311309f657cd71cd76cdae11a54ecd3f3fbdba1737823d2ef893aac66c1a651

Download Submit
C:\Windows\System\NTApQcE.exe

Filesize
1.9MB

MD5
2585932433c742c181508d5a8542cbe9

SHA1
3e5a02b3f3af8bd9ac954acf055851525ea6d2b9

SHA256
34410eb5888b117f63bc88e92aee38091238ef06ee0999d50dd7afa201053df9

SHA512
23b499002709c23adec6b6912f11f05aaaf8c4a3af1bfd39eb862321b1642b31d72222bfd5c12e6b0851749e4f76e547fa86dd58c803c7b8b77d87166e129d84

Download Submit
C:\Windows\System\NUSvvhX.exe

Filesize
1.9MB

MD5
e944e9bc1a6bd1da23653dd7764750cf

SHA1
c237d04113e5557d17b44397cec38a7dad570a5a

SHA256
dac1b3ca267d2bec82012c05f8b2834e593b49a881c0f9b7c114f0ef702f5521

SHA512
7ad1753f57f6152f3485b991bce7a64112df4b45f9a7ea8ec7140ea6533d246ac417a9e78992d6c0345e8e0b8cec013224823dd20bd6b94f0af08278bec768aa

Download Submit
C:\Windows\System\SckbuxI.exe

Filesize
1.9MB

MD5
a9e2bb11cf6d2913f44c8c8372fe363b

SHA1
29febaf9e504aeadab24de96ac07d94eaac55a7c

SHA256
fd7ab282458761a7d72b735dabc044b56cfb27d6a7024befb9fb494c4203413a

SHA512
998d80b71b6164f26d40c17d7ed9d806e0de7a3be3d07127adaa53af2364dfccb56d8a0a5078f445605a41815e3b5e0c18949f26384e23656cee0b93030571dd

Download Submit
C:\Windows\System\UpcjlMD.exe

Filesize
1.9MB

MD5
b0e57880cad72f2136a8e940f970c858

SHA1
52ac17fe21afa4b0836775b2e52c7f3ca4e41906

SHA256
444c418a65dd92da5d6e49dfd3317f6c6f83e0b36ce9326fe136869c7bfa1a87

SHA512
408fd20ec21f5beb85b42f9b17502a17cf6f5b14909eac9b9a852c9a45dadf8db750133ed2f68dcd7627ace4d3cb31d93e44bc526f5531c13bd7ed3d5366ebbb

Download Submit
C:\Windows\System\XJqseNz.exe

Filesize
1.9MB

MD5
3a70cdfa7cd6c51fdd362bc7e7e6745f

SHA1
6fbee2d363159a95b19cd2eaa46f4c06e5179bbe

SHA256
e1fc9764fb4f41da5168989f8dfdc2a9df6c1457bc3f409b0e7a8deb7a260c4b

SHA512
bc7e3690bd240b1e2875cc53c6421ac462b7d5a07cefef119a258d471aaa7c610f9705058b56b678fdc988e4f7dc8f2d4dd0e2749bf080866521bc897a3ac12f

Download Submit
C:\Windows\System\XlJsKqo.exe

Filesize
1.9MB

MD5
5460cd2c89f268ff4662110a0b2cf009

SHA1
efc04fae7c3a02a270be3e9d8b1e255dcaec9d03

SHA256
5de158536e29806693d0cd59bab3c9be87f84fedcb196f9a57fab66cc106171f

SHA512
1b2915adde72897ba2f9f794758751d42f530403f78b48e6dfc67ffe66274985f755160867c736dc50c1c85d4b1ca21337953d3799b9fdeeaa587033492b7e69

Download Submit
C:\Windows\System\YdDJimU.exe

Filesize
1.9MB

MD5
93ff2f292e73a32a1115be34a0068ee2

SHA1
9b5fb7c368d21a352b581c3a5d0f9cc48a4d8a01

SHA256
10a54eff124e02f70c12dcb8c980f2537549f5c509b1b1a4173521e9aa7bb073

SHA512
162bb9eafaa52b889548174c2d0a6df0e60f91f99ab065e77f0e999ba399d1273e43dba97489a6b25fdfd33fb0a1071a3a4ee71dbeac7beaa7f19c0d9f2d3d36

Download Submit
C:\Windows\System\YjqUAdF.exe

Filesize
1.9MB

MD5
35a11d49d4b7eb17117c0c0c697a1b59

SHA1
41876daf60223d4bf61ab080595696fd2331722d

SHA256
8c79065f96605bd4dfab433eb53cb08b62c3307ed2a9d91e142109845fa9dd5e

SHA512
d05e13aed1e2823641f1b69326b52c6ef508d257fc1510688bf45eada9d8564324a7965030414dcf971aba50b2a819db246d9c1985c2e85499834f29a4ae784d

Download Submit
C:\Windows\System\aLaMRRZ.exe

Filesize
1.9MB

MD5
7de6fba761ababf1d60eeef03c418db0

SHA1
56f8fcd74599f094985d53ddb4ac42b6df2307f7

SHA256
c4a7fdf7266be32a4c6b3bad1052c93812727f5512fea016ddadcb306c98b443

SHA512
ba2f8d846266a0b7192ac485bb779b3722399d1e8d8e625d759047bf8a996677c7cd190a3466526bd631fa34deda5412b29e5284854b2a12db948f1ba7bebd27

Download Submit
C:\Windows\System\ciYPkyn.exe

Filesize
1.9MB

MD5
7ea47188c1a32235a8fdb17be7695930

SHA1
fed0e9cfdf79623f1ec19e87df42e53085266a2b

SHA256
89e37b4e0b3858e1fce7e5cd4b85b267b3a796001894af887806963c3783c5ec

SHA512
7621099c11c132d154a613bb2398126cc0074ae9949965451215cf6eb5124bad8342d7448106a1e4ff644cbe115bcd46f1740c53335bdd1b8d05eed4eb339e09

Download Submit
C:\Windows\System\fVsxWUA.exe

Filesize
1.9MB

MD5
74f92da56c0c34b6eb84da1f6b0fb910

SHA1
933ed1d133f63fb339955e182d7e96b4d833e429

SHA256
8d479070765efe6624e64e94cb1208f6cc75dd30e8d7a1665a16481c976dc371

SHA512
e054b6c33ba5c8c1326ef9988de21da504543e7ec48accb26f6d96c98f52c4f9a68bc6dbe866bda0c2bc6cb2ea704b8a54b589d3af44cedb60be974eb10030f3

Download Submit
C:\Windows\System\fZFzGix.exe

Filesize
8B

MD5
bbb5190eff45a62c43cde634094759c0

SHA1
45cda8be7c649ba00340a832715a0757e8ce9b9b

SHA256
4b7c7c791bd2893e065fd5e4934dccf3152aeac2fce4808132b05acefb80891a

SHA512
213d190bfff285fb6040740f8a61d201e24cba89077f90495986109a6840ce2f9df148c3ae6f113d24bbce88876d227a01aea3f25c0103630fa1669df46f16db

Download Submit
C:\Windows\System\gIZAbXL.exe

Filesize
1.9MB

MD5
3463b527f3580adf983f478713997a46

SHA1
46fde3296a7be20f9734341376724f827143efea

SHA256
f037a20fc6f8f49f90a02e3f37cd84da7aeabf7073985df80e5bd9e151073573

SHA512
c61e9f534503faed791f5fadc1b5602c98db0efd004d66c3ab930ce22176b0a22b86a592212510d720a421f18f85785e04d46f49217bb21a140b2021b35f8e36

Download Submit
C:\Windows\System\gVLampK.exe

Filesize
1.9MB

MD5
69ba4f7340aa69ab276720ce3b7bfa9a

SHA1
85b6c750ddd821d82f456f004adc72e98fdf3c1e

SHA256
db108df925408d814eb1ee1f316bedaa198b43ae3e4aa9a68ab71412cd5eea07

SHA512
a09110f36ab8b3d0fc8844e28cab209fe88ece8b58c9a28994ef7b643628187f5be4a440ff959b84be2c4ad4495889acf0b7c567cc64a52a6b199684357c13b8

Download Submit
C:\Windows\System\gsbieVd.exe

Filesize
1.9MB

MD5
2633515312b3fd50afdc3f48e0e37622

SHA1
40e46ecf84199332eeba2fe464420902012c7c0a

SHA256
99a750637aae44c21f3e4b17bc0b1e6f5a69be5ba70d8ed64a36963573fbe7d3

SHA512
6d3c0b974d8ad243e3f63dbe850342580b3dd4ae68e0a2c11dea34547ec9cdf9e9692ff3d4da2f7965d8523573f57808f1f02df81c32526c8a1d23ab181f6814

Download Submit
C:\Windows\System\iTmJoyi.exe

Filesize
1.9MB

MD5
e81b5b3ced1138f28fe22f31d154f385

SHA1
1ea63b52d911f57af54feeffad6815d0320e16d6

SHA256
869a6e652780d68834eb8b6dfc1b502227fd774f662426e52e3e16768c09acb1

SHA512
aea4e6a6da78f5242ca4e83498ca518a9cc1277fddabeb2a76b55bd9226d624749da9ce5f765ca5c2a8242209fed1c1d849d070312060e3679e1b3657d8077f5

Download Submit
C:\Windows\System\jYBBWYG.exe

Filesize
1.9MB

MD5
73ffb6cf027aefa961fcac8427945559

SHA1
2ad83f9feb149c8d56ccf9c603a17b90b8f8b92e

SHA256
471b2820c7c55ea9d5fe0760a9053ebdf9bc4c83ba0bd806369474d2d4269bcb

SHA512
2e8d616fd2e23cf9b897a6b303f16cb51cd75c81605c01dabd685c42975c7c8b8c639bd4807e8d22cca2bfcc8ac2a258c6d450bb7bc72b6cd1e07fa7b9414828

Download Submit
C:\Windows\System\kRbxxwd.exe

Filesize
1.9MB

MD5
e0b443e0413d26ac8a6411d576deba68

SHA1
017fa86ec645e6b8f86154972ce571672345edb0

SHA256
8e33a240b585552737044a3809beaa0058ef6d36708fbfafaceeb5ee1aa08be9

SHA512
8364bf0a3c192f53b0ccaccc3f957ec9ccd6691f5dfb0da94af001a93b7121f5b5a2769ef4a6722e70e7a29756e313a4e17431c84750cbe6f5ed11729c8e884e

Download Submit
C:\Windows\System\qcAbYEG.exe

Filesize
1.9MB

MD5
d6301508d05393e14ca63564e9d88fb6

SHA1
632b9a0bc8f5483581ecdc0851dbec221f6371d2

SHA256
c640d81efaa0f4f095f7ff1a06c4ad4587bc5589b9e278ba04074815c8471709

SHA512
4af1b5d00491f035a47c4e7f9b95d817c9971bb3bd48ad42e3dd39470e96bbfc47081edff3db47ed7b62664d0ccf355f4ae9921b0e4dd53bc3e3f38bb6bc4dac

Download Submit
C:\Windows\System\sDqXthh.exe

Filesize
1.9MB

MD5
65fc737fae6c9a1cddf6c502a3a13eac

SHA1
ab02217f7509aec696ec23c395d4755afc0721fc

SHA256
7e57f5050ca015840f2c482fc4bfff901e3b8295bb01bed87a53ed215f73b12d

SHA512
0d852ac8d7ae3837f8a1e0cb019ec3a0dc3ce3595ed63ec30b86860db2249540913c54d2457aec19d954adb86aef88efed1dab69790f8ff7d02f0051c1800aca

Download Submit
C:\Windows\System\sXkfGBg.exe

Filesize
1.9MB

MD5
acc2b3a5afdc3defba2e7f37a889a2ac

SHA1
86e612d18c30275f7aadf85ec4bfa353745bd62d

SHA256
7e8a7240c4faf316bcb845961e517c9581c415167bbf7ec5a4a0f9d3c8056c51

SHA512
47519e9f9d41af60ff0aeae3fcc3336c7a8262e33c84a72f266651518288dee6425fe99a61f548f5fb2de01249a0309a38a90054d3d2d5ce7e4a4e3be52219e1

Download Submit
C:\Windows\System\uMGYaha.exe

Filesize
1.9MB

MD5
8d5d14b14f1c873ee10719e626403c6b

SHA1
2c5805a2ebcf072460f663855018f5b583b085c2

SHA256
1b56f05f647c1bc1b6312015b4d264cf55a4b47eed654228e819560f117fc5a5

SHA512
9b7e1dfde95c9d637bd2aef249487a8823815738bfa8d854219e79db775dcef5d8eacee4240f58d15ecd389968171e0085c69aa7edb2fc055ac3aae90d65d6a0

Download Submit
C:\Windows\System\unRJCsj.exe

Filesize
1.9MB

MD5
ef50f7788ca2fc3c97cee8d607cbc5dc

SHA1
1062e1913cbb2062ba8a4eb36eab60cf2c3fcc91

SHA256
05c2bb2fe443e4782c527ec77f29ef60025d4c3ae47919b3a047139b47c1bb95

SHA512
c2955d27ac668219091892a5e862b4c8b5e59d439551e39d4c20d58a6296a17dffd4271165ff3728f33a301548241f6d7af64d3f04f1003d318e910414e5f3cb

Download Submit
C:\Windows\System\vmMvldp.exe

Filesize
1.9MB

MD5
a5881abbf339f8ec085d0895a47f49eb

SHA1
d0e963d045fe9dd0b960fa230fe68ff4b881d96f

SHA256
dd16c984a9a890c8dd29f74be9dadde0243e128a87498e2c033da8aae4a3e5aa

SHA512
b70e1ac49e8344c3b69f8bb2ab0bc49f5a88168d0cf26f17716d95fb247062bdbd8444601575f8dc959b670a713f4af372e3677e0166e568f7dd580b78fc4dca

Download Submit
C:\Windows\System\whBiBYg.exe

Filesize
1.9MB

MD5
1f8c8e48c7ee999fcb7400c3ade5b2bb

SHA1
1e42aae535d38c95d74a6f9a23d4a155f2cad039

SHA256
46af654ca2e165846c31abd7c432a0be10e01248b24f8bba3815379da8069465

SHA512
300b22ece3936a4e170b1a95c5d1e94efb1a9a7f46b0b0119a0cf7bb74052f0d4344b4a12f6293481472905a6adbaf3ef70becefb38d660ee723e18ce9e26dbc

Download Submit
C:\Windows\System\zmGxGjw.exe

Filesize
1.9MB

MD5
55df061218899faa7de1a3cfeeb432e2

SHA1
9269175be552b3f79568854ed8cc0eebfb30ed0f

SHA256
0d43269a9263ae80a7dcc80889ddc1e99444c3c5c7b6b0c88fb3bbe2ff361729

SHA512
e548d301a16686a0a6b996c0e5ecf63379c254d01c81b1af951a9e74f04fe00ae87ab2fc9fc8aa6859665f838a00b1baedb7d055694d6b51d3201515a8803f9c

Download Submit
memory/680-347-0x00007FF642310000-0x00007FF642702000-memory.dmp

Filesize
3.9MB

Download
memory/680-3595-0x00007FF642310000-0x00007FF642702000-memory.dmp

Filesize
3.9MB

Download
memory/1052-335-0x00007FF60D3D0000-0x00007FF60D7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1052-3410-0x00007FF60D3D0000-0x00007FF60D7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1272-262-0x00007FF63E840000-0x00007FF63EC32000-memory.dmp

Filesize
3.9MB

Download
memory/1284-350-0x00007FF6467C0000-0x00007FF646BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-3547-0x00007FF6467C0000-0x00007FF646BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1352-3414-0x00007FF75B4F0000-0x00007FF75B8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1352-294-0x00007FF75B4F0000-0x00007FF75B8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-353-0x00007FF60C350000-0x00007FF60C742000-memory.dmp

Filesize
3.9MB

Download
memory/1508-3435-0x00007FF7EE640000-0x00007FF7EEA32000-memory.dmp

Filesize
3.9MB

Download
memory/1508-334-0x00007FF7EE640000-0x00007FF7EEA32000-memory.dmp

Filesize
3.9MB

Download
memory/2032-3425-0x00007FF7D9340000-0x00007FF7D9732000-memory.dmp

Filesize
3.9MB

Download
memory/2032-332-0x00007FF7D9340000-0x00007FF7D9732000-memory.dmp

Filesize
3.9MB

Download
memory/2152-348-0x00007FF7425B0000-0x00007FF7429A2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-3541-0x00007FF7425B0000-0x00007FF7429A2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-343-0x00007FF71FB80000-0x00007FF71FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2308-3512-0x00007FF71FB80000-0x00007FF71FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2320-327-0x00007FF775E70000-0x00007FF776262000-memory.dmp

Filesize
3.9MB

Download
memory/2320-3409-0x00007FF775E70000-0x00007FF776262000-memory.dmp

Filesize
3.9MB

Download
memory/2404-337-0x00007FF68C3B0000-0x00007FF68C7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-3497-0x00007FF7531E0000-0x00007FF7535D2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-344-0x00007FF7531E0000-0x00007FF7535D2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-3500-0x00007FF693890000-0x00007FF693C82000-memory.dmp

Filesize
3.9MB

Download
memory/3004-341-0x00007FF693890000-0x00007FF693C82000-memory.dmp

Filesize
3.9MB

Download
memory/3008-3467-0x00007FF693A40000-0x00007FF693E32000-memory.dmp

Filesize
3.9MB

Download
memory/3008-339-0x00007FF693A40000-0x00007FF693E32000-memory.dmp

Filesize
3.9MB

Download
memory/3028-3557-0x00007FF6040C0000-0x00007FF6044B2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-342-0x00007FF6040C0000-0x00007FF6044B2000-memory.dmp

Filesize
3.9MB

Download
memory/3372-1-0x000001E318830000-0x000001E318840000-memory.dmp

Filesize
64KB

Download
memory/3372-0-0x00007FF7236C0000-0x00007FF723AB2000-memory.dmp

Filesize
3.9MB

Download
memory/3400-3542-0x00007FF69AE60000-0x00007FF69B252000-memory.dmp

Filesize
3.9MB

Download
memory/3400-365-0x00007FF69AE60000-0x00007FF69B252000-memory.dmp

Filesize
3.9MB

Download
memory/3532-336-0x00007FF6CA520000-0x00007FF6CA912000-memory.dmp

Filesize
3.9MB

Download
memory/3704-338-0x00007FF775FD0000-0x00007FF7763C2000-memory.dmp

Filesize
3.9MB

Download
memory/3704-3489-0x00007FF775FD0000-0x00007FF7763C2000-memory.dmp

Filesize
3.9MB

Download
memory/3892-3560-0x00007FF761B90000-0x00007FF761F82000-memory.dmp

Filesize
3.9MB

Download
memory/3892-349-0x00007FF761B90000-0x00007FF761F82000-memory.dmp

Filesize
3.9MB

Download
memory/3908-345-0x00007FF61F810000-0x00007FF61FC02000-memory.dmp

Filesize
3.9MB

Download
memory/3908-3548-0x00007FF61F810000-0x00007FF61FC02000-memory.dmp

Filesize
3.9MB

Download
memory/3932-81-0x00007FFD4F140000-0x00007FFD4FC01000-memory.dmp

Filesize
10.8MB

Download
memory/3932-194-0x00007FFD4F140000-0x00007FFD4FC01000-memory.dmp

Filesize
10.8MB

Download
memory/3932-5-0x00007FFD4F143000-0x00007FFD4F145000-memory.dmp

Filesize
8KB

Download
memory/3932-128-0x0000015DDCCA0000-0x0000015DDCCC2000-memory.dmp

Filesize
136KB

Download
memory/4320-3405-0x00007FF6C9C80000-0x00007FF6CA072000-memory.dmp

Filesize
3.9MB

Download
memory/4320-333-0x00007FF6C9C80000-0x00007FF6CA072000-memory.dmp

Filesize
3.9MB

Download
memory/4420-3537-0x00007FF6A4940000-0x00007FF6A4D32000-memory.dmp

Filesize
3.9MB

Download
memory/4420-346-0x00007FF6A4940000-0x00007FF6A4D32000-memory.dmp

Filesize
3.9MB

Download
memory/4468-3480-0x00007FF6722B0000-0x00007FF6726A2000-memory.dmp

Filesize
3.9MB

Download
memory/4468-340-0x00007FF6722B0000-0x00007FF6726A2000-memory.dmp

Filesize
3.9MB

Download