xmrig | cb7b31f4f3c5cdf92fe8f04f53fab885355c1b21f0c75d98287eb58806ba239b

Analysis

max time kernel
120s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c20e3de2981a125177c27e3197bf2a0N.exe
Size

1.6MB
MD5

0c20e3de2981a125177c27e3197bf2a0
SHA1

b2940580edb4ed08a1f55fa5acadbdd2403a82a1
SHA256

cb7b31f4f3c5cdf92fe8f04f53fab885355c1b21f0c75d98287eb58806ba239b
SHA512

1b6b2a278528ab84de5af40de897d3537647764fd2529a681cc56bac1fe1696ec73125e7531104ba8c6e89e368124d47658e0d8edc0be9f884feee3d924c5e50
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1p0NobAATyF8B9oq2pDQ7ootM7:Lz071uv4BPMkibTIA58No5y6IQe5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/2772-13-0x00007FF783260000-0x00007FF783652000-memory.dmp	xmrig
behavioral2/memory/2416-97-0x00007FF7BE050000-0x00007FF7BE442000-memory.dmp	xmrig
behavioral2/memory/3592-426-0x00007FF778AE0000-0x00007FF778ED2000-memory.dmp	xmrig
behavioral2/memory/2520-427-0x00007FF71EC10000-0x00007FF71F002000-memory.dmp	xmrig
behavioral2/memory/4980-422-0x00007FF70B1D0000-0x00007FF70B5C2000-memory.dmp	xmrig
behavioral2/memory/4796-430-0x00007FF68E9D0000-0x00007FF68EDC2000-memory.dmp	xmrig
behavioral2/memory/2752-432-0x00007FF6BC390000-0x00007FF6BC782000-memory.dmp	xmrig
behavioral2/memory/2944-112-0x00007FF7798B0000-0x00007FF779CA2000-memory.dmp	xmrig
behavioral2/memory/4228-106-0x00007FF61CAB0000-0x00007FF61CEA2000-memory.dmp	xmrig
behavioral2/memory/1124-105-0x00007FF7F6250000-0x00007FF7F6642000-memory.dmp	xmrig
behavioral2/memory/2036-101-0x00007FF74CD20000-0x00007FF74D112000-memory.dmp	xmrig
behavioral2/memory/3468-92-0x00007FF7705D0000-0x00007FF7709C2000-memory.dmp	xmrig
behavioral2/memory/4104-88-0x00007FF6F4750000-0x00007FF6F4B42000-memory.dmp	xmrig
behavioral2/memory/4044-87-0x00007FF6783A0000-0x00007FF678792000-memory.dmp	xmrig
behavioral2/memory/2568-82-0x00007FF728850000-0x00007FF728C42000-memory.dmp	xmrig
behavioral2/memory/2088-78-0x00007FF78C0D0000-0x00007FF78C4C2000-memory.dmp	xmrig
behavioral2/memory/3460-71-0x00007FF7A1F80000-0x00007FF7A2372000-memory.dmp	xmrig
behavioral2/memory/940-52-0x00007FF7E1D80000-0x00007FF7E2172000-memory.dmp	xmrig
behavioral2/memory/2164-1687-0x00007FF660780000-0x00007FF660B72000-memory.dmp	xmrig
behavioral2/memory/3460-2324-0x00007FF7A1F80000-0x00007FF7A2372000-memory.dmp	xmrig
behavioral2/memory/4496-2662-0x00007FF7EF5C0000-0x00007FF7EF9B2000-memory.dmp	xmrig
behavioral2/memory/4340-2674-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp	xmrig
behavioral2/memory/4440-2847-0x00007FF6ECE20000-0x00007FF6ED212000-memory.dmp	xmrig
behavioral2/memory/4580-3146-0x00007FF6F4BA0000-0x00007FF6F4F92000-memory.dmp	xmrig
behavioral2/memory/4436-3162-0x00007FF77B1E0000-0x00007FF77B5D2000-memory.dmp	xmrig
behavioral2/memory/3688-3186-0x00007FF603C80000-0x00007FF604072000-memory.dmp	xmrig
behavioral2/memory/2772-3630-0x00007FF783260000-0x00007FF783652000-memory.dmp	xmrig
behavioral2/memory/3468-3675-0x00007FF7705D0000-0x00007FF7709C2000-memory.dmp	xmrig
behavioral2/memory/940-3686-0x00007FF7E1D80000-0x00007FF7E2172000-memory.dmp	xmrig
behavioral2/memory/2416-3665-0x00007FF7BE050000-0x00007FF7BE442000-memory.dmp	xmrig
behavioral2/memory/4496-3699-0x00007FF7EF5C0000-0x00007FF7EF9B2000-memory.dmp	xmrig
behavioral2/memory/2568-3694-0x00007FF728850000-0x00007FF728C42000-memory.dmp	xmrig
behavioral2/memory/2036-3691-0x00007FF74CD20000-0x00007FF74D112000-memory.dmp	xmrig
behavioral2/memory/3460-3702-0x00007FF7A1F80000-0x00007FF7A2372000-memory.dmp	xmrig
behavioral2/memory/2088-3706-0x00007FF78C0D0000-0x00007FF78C4C2000-memory.dmp	xmrig
behavioral2/memory/4104-3712-0x00007FF6F4750000-0x00007FF6F4B42000-memory.dmp	xmrig
behavioral2/memory/4044-3711-0x00007FF6783A0000-0x00007FF678792000-memory.dmp	xmrig
behavioral2/memory/1124-3714-0x00007FF7F6250000-0x00007FF7F6642000-memory.dmp	xmrig
behavioral2/memory/4228-3718-0x00007FF61CAB0000-0x00007FF61CEA2000-memory.dmp	xmrig
behavioral2/memory/4340-3716-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp	xmrig
behavioral2/memory/2944-3724-0x00007FF7798B0000-0x00007FF779CA2000-memory.dmp	xmrig
behavioral2/memory/4580-3730-0x00007FF6F4BA0000-0x00007FF6F4F92000-memory.dmp	xmrig
behavioral2/memory/4440-3723-0x00007FF6ECE20000-0x00007FF6ED212000-memory.dmp	xmrig
behavioral2/memory/3688-3735-0x00007FF603C80000-0x00007FF604072000-memory.dmp	xmrig
behavioral2/memory/2520-3750-0x00007FF71EC10000-0x00007FF71F002000-memory.dmp	xmrig
behavioral2/memory/2752-3756-0x00007FF6BC390000-0x00007FF6BC782000-memory.dmp	xmrig
behavioral2/memory/4796-3754-0x00007FF68E9D0000-0x00007FF68EDC2000-memory.dmp	xmrig
behavioral2/memory/4980-3744-0x00007FF70B1D0000-0x00007FF70B5C2000-memory.dmp	xmrig
behavioral2/memory/3592-3740-0x00007FF778AE0000-0x00007FF778ED2000-memory.dmp	xmrig
behavioral2/memory/4436-3739-0x00007FF77B1E0000-0x00007FF77B5D2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1232	powershell.exe
5	1232	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1232	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2772	fxWwlJY.exe
3468	QZhCPeV.exe
2416	hRSfOCl.exe
940	sMCJoYh.exe
2036	itgNOdI.exe
4496	UeTZXxz.exe
3460	GhBuXHn.exe
2088	ulPcfFg.exe
2568	zXIesyg.exe
1124	yWlcOIk.exe
4044	fFcCiUN.exe
4104	FlRplqu.exe
4228	bymGmKC.exe
4340	yFktzrl.exe
2944	GwAIrca.exe
4440	iCjrbEZ.exe
4580	rYrIrbL.exe
4436	qKxBhew.exe
3688	eIbuDTg.exe
4980	MpqFNJb.exe
3592	ESolvky.exe
2520	wNtcccs.exe
4796	AXVhuIk.exe
2752	gOdNDOx.exe
3476	pvLoUCz.exe
548	GbBerlp.exe
1116	UlpcfIY.exe
3896	TiIiaDk.exe
4412	vBGVqmL.exe
4944	pCbdlvM.exe
3736	FgUfcbE.exe
3524	wURtKso.exe
2116	WwgOabE.exe
2016	DFxDkLE.exe
2304	LfNnFjb.exe
3060	NbAgBPb.exe
2848	XEgWLPK.exe
5020	DWXAVxK.exe
4740	ixlMBUz.exe
2580	MtTEimI.exe
5044	eyFavHx.exe
2232	IvJIsvN.exe
4160	WrmDVwG.exe
3200	WYPQTjy.exe
4844	NjjyEep.exe
4428	kMEmadV.exe
3048	imGbpuB.exe
3396	yZCKSpw.exe
2888	vjwFysh.exe
1396	bLrbOxp.exe
1644	cNlAXgA.exe
4848	PTfdRER.exe
884	VUixCeO.exe
4900	OoWSIgd.exe
3696	SARibvW.exe
1592	EcLeiaG.exe
448	cAVbYxF.exe
5104	UXuWDPZ.exe
3748	oMLWrGe.exe
4024	HnTMgvJ.exe
4164	oUxXHko.exe
4824	htDkbOm.exe
1004	KspqhUF.exe
2816	qCSLIwX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2164-0-0x00007FF660780000-0x00007FF660B72000-memory.dmp	upx
behavioral2/files/0x00090000000233eb-6.dat	upx
behavioral2/files/0x0008000000023452-11.dat	upx
behavioral2/memory/2772-13-0x00007FF783260000-0x00007FF783652000-memory.dmp	upx
behavioral2/files/0x0008000000023455-22.dat	upx
behavioral2/files/0x0007000000023456-29.dat	upx
behavioral2/files/0x000700000002345b-38.dat	upx
behavioral2/files/0x000700000002345d-54.dat	upx
behavioral2/files/0x000700000002345a-60.dat	upx
behavioral2/files/0x000700000002345c-66.dat	upx
behavioral2/files/0x0008000000023457-74.dat	upx
behavioral2/files/0x0008000000023458-73.dat	upx
behavioral2/files/0x000700000002345e-80.dat	upx
behavioral2/files/0x0007000000023460-86.dat	upx
behavioral2/memory/4340-89-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp	upx
behavioral2/memory/2416-97-0x00007FF7BE050000-0x00007FF7BE442000-memory.dmp	upx
behavioral2/files/0x0008000000023453-102.dat	upx
behavioral2/files/0x0007000000023462-109.dat	upx
behavioral2/files/0x0007000000023463-115.dat	upx
behavioral2/memory/4580-122-0x00007FF6F4BA0000-0x00007FF6F4F92000-memory.dmp	upx
behavioral2/files/0x0007000000023468-146.dat	upx
behavioral2/files/0x000700000002346a-160.dat	upx
behavioral2/files/0x000700000002346f-187.dat	upx
behavioral2/memory/3592-426-0x00007FF778AE0000-0x00007FF778ED2000-memory.dmp	upx
behavioral2/memory/2520-427-0x00007FF71EC10000-0x00007FF71F002000-memory.dmp	upx
behavioral2/memory/4980-422-0x00007FF70B1D0000-0x00007FF70B5C2000-memory.dmp	upx
behavioral2/memory/4796-430-0x00007FF68E9D0000-0x00007FF68EDC2000-memory.dmp	upx
behavioral2/memory/2752-432-0x00007FF6BC390000-0x00007FF6BC782000-memory.dmp	upx
behavioral2/files/0x0007000000023472-194.dat	upx
behavioral2/files/0x0007000000023470-192.dat	upx
behavioral2/files/0x0007000000023471-189.dat	upx
behavioral2/files/0x000700000002346e-182.dat	upx
behavioral2/files/0x000700000002346d-177.dat	upx
behavioral2/files/0x000700000002346c-172.dat	upx
behavioral2/files/0x000700000002346b-167.dat	upx
behavioral2/files/0x0007000000023469-155.dat	upx
behavioral2/files/0x0007000000023467-142.dat	upx
behavioral2/files/0x0007000000023466-137.dat	upx
behavioral2/files/0x0007000000023465-132.dat	upx
behavioral2/memory/3688-128-0x00007FF603C80000-0x00007FF604072000-memory.dmp	upx
behavioral2/files/0x0007000000023464-126.dat	upx
behavioral2/memory/4436-125-0x00007FF77B1E0000-0x00007FF77B5D2000-memory.dmp	upx
behavioral2/memory/4440-118-0x00007FF6ECE20000-0x00007FF6ED212000-memory.dmp	upx
behavioral2/memory/2944-112-0x00007FF7798B0000-0x00007FF779CA2000-memory.dmp	upx
behavioral2/files/0x0007000000023461-107.dat	upx
behavioral2/memory/4228-106-0x00007FF61CAB0000-0x00007FF61CEA2000-memory.dmp	upx
behavioral2/memory/1124-105-0x00007FF7F6250000-0x00007FF7F6642000-memory.dmp	upx
behavioral2/memory/2036-101-0x00007FF74CD20000-0x00007FF74D112000-memory.dmp	upx
behavioral2/files/0x000700000002345f-95.dat	upx
behavioral2/memory/3468-92-0x00007FF7705D0000-0x00007FF7709C2000-memory.dmp	upx
behavioral2/memory/4104-88-0x00007FF6F4750000-0x00007FF6F4B42000-memory.dmp	upx
behavioral2/memory/4044-87-0x00007FF6783A0000-0x00007FF678792000-memory.dmp	upx
behavioral2/memory/2568-82-0x00007FF728850000-0x00007FF728C42000-memory.dmp	upx
behavioral2/memory/2088-78-0x00007FF78C0D0000-0x00007FF78C4C2000-memory.dmp	upx
behavioral2/memory/3460-71-0x00007FF7A1F80000-0x00007FF7A2372000-memory.dmp	upx
behavioral2/memory/4496-63-0x00007FF7EF5C0000-0x00007FF7EF9B2000-memory.dmp	upx
behavioral2/files/0x0007000000023459-58.dat	upx
behavioral2/memory/940-52-0x00007FF7E1D80000-0x00007FF7E2172000-memory.dmp	upx
behavioral2/memory/2164-1687-0x00007FF660780000-0x00007FF660B72000-memory.dmp	upx
behavioral2/memory/3460-2324-0x00007FF7A1F80000-0x00007FF7A2372000-memory.dmp	upx
behavioral2/memory/4496-2662-0x00007FF7EF5C0000-0x00007FF7EF9B2000-memory.dmp	upx
behavioral2/memory/4340-2674-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp	upx
behavioral2/memory/4440-2847-0x00007FF6ECE20000-0x00007FF6ED212000-memory.dmp	upx
behavioral2/memory/4580-3146-0x00007FF6F4BA0000-0x00007FF6F4F92000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qVwOiuZ.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\hhsjtwj.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\usTErru.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\IAEjfwm.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\fvrKYBS.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\KXjCcWD.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\sAMhnRL.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\SdiYQBv.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\BvpcGUL.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\CjMGTlc.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\RgnfPXT.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\KNrMDXB.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\rnLqMPv.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\mdsITQe.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\wzTqxJa.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\hqqeZit.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\VJlHPmG.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\bjFLwxJ.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\uxephAk.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\LDzdvMb.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\dWwCEMW.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\WnaFRIm.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\TbSffgR.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\miabjPu.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\NYZcxMG.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\SuGpzqr.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\wPsoXXQ.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\VqmshSw.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\uUDvODS.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\IRtZmuv.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\NWDXLtE.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\dzmnbXd.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\vKgdSTe.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\mwNirVT.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\GGwPTyJ.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\gpEzGCN.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\KXRjzXP.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\nBPLZKl.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\NjOroWE.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\HbORkPG.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\OrOnDcI.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\CgJafaa.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\YBKlskK.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\stDAnOA.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\tGSClWs.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\PkrPCJE.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\zOAsDbU.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\NwUYvoj.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\YjVdjio.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\jTswMps.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\HtvtjbZ.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\pPuWGis.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\nKhUtII.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\QsKtlpN.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\vvdlKkV.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\wRSFUHX.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\GrlIcFg.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\bLjbrDA.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\YKxVnYK.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\HchbuvV.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\DLDsBOO.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\oJTbSXa.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\UKzOjKU.exe	0c20e3de2981a125177c27e3197bf2a0N.exe
File created	C:\Windows\System\aquRJZP.exe	0c20e3de2981a125177c27e3197bf2a0N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	powershell.exe
1232	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeLockMemoryPrivilege	2164	0c20e3de2981a125177c27e3197bf2a0N.exe
Token: SeLockMemoryPrivilege	2164	0c20e3de2981a125177c27e3197bf2a0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1232	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	82
PID 2164 wrote to memory of 1232	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	82
PID 2164 wrote to memory of 2772	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	83
PID 2164 wrote to memory of 2772	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	83
PID 2164 wrote to memory of 3468	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	84
PID 2164 wrote to memory of 3468	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	84
PID 2164 wrote to memory of 2416	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	85
PID 2164 wrote to memory of 2416	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	85
PID 2164 wrote to memory of 940	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	86
PID 2164 wrote to memory of 940	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	86
PID 2164 wrote to memory of 4496	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	87
PID 2164 wrote to memory of 4496	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	87
PID 2164 wrote to memory of 3460	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	88
PID 2164 wrote to memory of 3460	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	88
PID 2164 wrote to memory of 2036	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	89
PID 2164 wrote to memory of 2036	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	89
PID 2164 wrote to memory of 2088	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	90
PID 2164 wrote to memory of 2088	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	90
PID 2164 wrote to memory of 2568	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	91
PID 2164 wrote to memory of 2568	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	91
PID 2164 wrote to memory of 4044	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	92
PID 2164 wrote to memory of 4044	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	92
PID 2164 wrote to memory of 1124	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	93
PID 2164 wrote to memory of 1124	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	93
PID 2164 wrote to memory of 4104	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	94
PID 2164 wrote to memory of 4104	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	94
PID 2164 wrote to memory of 4228	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	95
PID 2164 wrote to memory of 4228	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	95
PID 2164 wrote to memory of 4340	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	96
PID 2164 wrote to memory of 4340	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	96
PID 2164 wrote to memory of 2944	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	97
PID 2164 wrote to memory of 2944	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	97
PID 2164 wrote to memory of 4440	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	98
PID 2164 wrote to memory of 4440	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	98
PID 2164 wrote to memory of 4580	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	99
PID 2164 wrote to memory of 4580	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	99
PID 2164 wrote to memory of 4436	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	100
PID 2164 wrote to memory of 4436	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	100
PID 2164 wrote to memory of 3688	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	101
PID 2164 wrote to memory of 3688	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	101
PID 2164 wrote to memory of 4980	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	102
PID 2164 wrote to memory of 4980	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	102
PID 2164 wrote to memory of 3592	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	103
PID 2164 wrote to memory of 3592	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	103
PID 2164 wrote to memory of 2520	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	104
PID 2164 wrote to memory of 2520	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	104
PID 2164 wrote to memory of 4796	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	105
PID 2164 wrote to memory of 4796	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	105
PID 2164 wrote to memory of 2752	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	106
PID 2164 wrote to memory of 2752	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	106
PID 2164 wrote to memory of 3476	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	107
PID 2164 wrote to memory of 3476	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	107
PID 2164 wrote to memory of 548	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	108
PID 2164 wrote to memory of 548	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	108
PID 2164 wrote to memory of 1116	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	109
PID 2164 wrote to memory of 1116	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	109
PID 2164 wrote to memory of 3896	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	110
PID 2164 wrote to memory of 3896	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	110
PID 2164 wrote to memory of 4412	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	111
PID 2164 wrote to memory of 4412	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	111
PID 2164 wrote to memory of 4944	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	112
PID 2164 wrote to memory of 4944	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	112
PID 2164 wrote to memory of 3736	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	113
PID 2164 wrote to memory of 3736	2164	0c20e3de2981a125177c27e3197bf2a0N.exe	113

C:\Users\Admin\AppData\Local\Temp\0c20e3de2981a125177c27e3197bf2a0N.exe
"C:\Users\Admin\AppData\Local\Temp\0c20e3de2981a125177c27e3197bf2a0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1232" "2920" "2840" "2924" "0" "0" "2928" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13120
- C:\Windows\System\fxWwlJY.exe
  C:\Windows\System\fxWwlJY.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\QZhCPeV.exe
  C:\Windows\System\QZhCPeV.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\hRSfOCl.exe
  C:\Windows\System\hRSfOCl.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\sMCJoYh.exe
  C:\Windows\System\sMCJoYh.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\UeTZXxz.exe
  C:\Windows\System\UeTZXxz.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\GhBuXHn.exe
  C:\Windows\System\GhBuXHn.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\itgNOdI.exe
  C:\Windows\System\itgNOdI.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\ulPcfFg.exe
  C:\Windows\System\ulPcfFg.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\zXIesyg.exe
  C:\Windows\System\zXIesyg.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\fFcCiUN.exe
  C:\Windows\System\fFcCiUN.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\yWlcOIk.exe
  C:\Windows\System\yWlcOIk.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\FlRplqu.exe
  C:\Windows\System\FlRplqu.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\bymGmKC.exe
  C:\Windows\System\bymGmKC.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\yFktzrl.exe
  C:\Windows\System\yFktzrl.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\GwAIrca.exe
  C:\Windows\System\GwAIrca.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\iCjrbEZ.exe
  C:\Windows\System\iCjrbEZ.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\rYrIrbL.exe
  C:\Windows\System\rYrIrbL.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\qKxBhew.exe
  C:\Windows\System\qKxBhew.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\eIbuDTg.exe
  C:\Windows\System\eIbuDTg.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\MpqFNJb.exe
  C:\Windows\System\MpqFNJb.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\ESolvky.exe
  C:\Windows\System\ESolvky.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\wNtcccs.exe
  C:\Windows\System\wNtcccs.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\AXVhuIk.exe
  C:\Windows\System\AXVhuIk.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\gOdNDOx.exe
  C:\Windows\System\gOdNDOx.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\pvLoUCz.exe
  C:\Windows\System\pvLoUCz.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\GbBerlp.exe
  C:\Windows\System\GbBerlp.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\UlpcfIY.exe
  C:\Windows\System\UlpcfIY.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\TiIiaDk.exe
  C:\Windows\System\TiIiaDk.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\vBGVqmL.exe
  C:\Windows\System\vBGVqmL.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\pCbdlvM.exe
  C:\Windows\System\pCbdlvM.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\FgUfcbE.exe
  C:\Windows\System\FgUfcbE.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\wURtKso.exe
  C:\Windows\System\wURtKso.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\WwgOabE.exe
  C:\Windows\System\WwgOabE.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\DFxDkLE.exe
  C:\Windows\System\DFxDkLE.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\LfNnFjb.exe
  C:\Windows\System\LfNnFjb.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\NbAgBPb.exe
  C:\Windows\System\NbAgBPb.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\XEgWLPK.exe
  C:\Windows\System\XEgWLPK.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\DWXAVxK.exe
  C:\Windows\System\DWXAVxK.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\ixlMBUz.exe
  C:\Windows\System\ixlMBUz.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\MtTEimI.exe
  C:\Windows\System\MtTEimI.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\eyFavHx.exe
  C:\Windows\System\eyFavHx.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\IvJIsvN.exe
  C:\Windows\System\IvJIsvN.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\WrmDVwG.exe
  C:\Windows\System\WrmDVwG.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\WYPQTjy.exe
  C:\Windows\System\WYPQTjy.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\NjjyEep.exe
  C:\Windows\System\NjjyEep.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\kMEmadV.exe
  C:\Windows\System\kMEmadV.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\imGbpuB.exe
  C:\Windows\System\imGbpuB.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\yZCKSpw.exe
  C:\Windows\System\yZCKSpw.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\vjwFysh.exe
  C:\Windows\System\vjwFysh.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\bLrbOxp.exe
  C:\Windows\System\bLrbOxp.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\cNlAXgA.exe
  C:\Windows\System\cNlAXgA.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\PTfdRER.exe
  C:\Windows\System\PTfdRER.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\VUixCeO.exe
  C:\Windows\System\VUixCeO.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\OoWSIgd.exe
  C:\Windows\System\OoWSIgd.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\SARibvW.exe
  C:\Windows\System\SARibvW.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\EcLeiaG.exe
  C:\Windows\System\EcLeiaG.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\cAVbYxF.exe
  C:\Windows\System\cAVbYxF.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\UXuWDPZ.exe
  C:\Windows\System\UXuWDPZ.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\oMLWrGe.exe
  C:\Windows\System\oMLWrGe.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\HnTMgvJ.exe
  C:\Windows\System\HnTMgvJ.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\oUxXHko.exe
  C:\Windows\System\oUxXHko.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\htDkbOm.exe
  C:\Windows\System\htDkbOm.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\KspqhUF.exe
  C:\Windows\System\KspqhUF.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\qCSLIwX.exe
  C:\Windows\System\qCSLIwX.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\zOsMQzZ.exe
  C:\Windows\System\zOsMQzZ.exe
  2⤵
  PID:3428
- C:\Windows\System\MJpUlNr.exe
  C:\Windows\System\MJpUlNr.exe
  2⤵
  PID:1428
- C:\Windows\System\buGTUzA.exe
  C:\Windows\System\buGTUzA.exe
  2⤵
  PID:3124
- C:\Windows\System\pLQmjYj.exe
  C:\Windows\System\pLQmjYj.exe
  2⤵
  PID:4360
- C:\Windows\System\TztOVVg.exe
  C:\Windows\System\TztOVVg.exe
  2⤵
  PID:3184
- C:\Windows\System\rAHhwYz.exe
  C:\Windows\System\rAHhwYz.exe
  2⤵
  PID:396
- C:\Windows\System\VZUSAqz.exe
  C:\Windows\System\VZUSAqz.exe
  2⤵
  PID:3552
- C:\Windows\System\BwfSjnq.exe
  C:\Windows\System\BwfSjnq.exe
  2⤵
  PID:4048
- C:\Windows\System\OlyeXOU.exe
  C:\Windows\System\OlyeXOU.exe
  2⤵
  PID:3948
- C:\Windows\System\XSLLORG.exe
  C:\Windows\System\XSLLORG.exe
  2⤵
  PID:4668
- C:\Windows\System\FDTNmEU.exe
  C:\Windows\System\FDTNmEU.exe
  2⤵
  PID:3520
- C:\Windows\System\FbrttUf.exe
  C:\Windows\System\FbrttUf.exe
  2⤵
  PID:4976
- C:\Windows\System\dVJexQg.exe
  C:\Windows\System\dVJexQg.exe
  2⤵
  PID:2248
- C:\Windows\System\ldkIQFr.exe
  C:\Windows\System\ldkIQFr.exe
  2⤵
  PID:5024
- C:\Windows\System\zMRsLYK.exe
  C:\Windows\System\zMRsLYK.exe
  2⤵
  PID:4328
- C:\Windows\System\MmQTKwb.exe
  C:\Windows\System\MmQTKwb.exe
  2⤵
  PID:1420
- C:\Windows\System\GuhIQXC.exe
  C:\Windows\System\GuhIQXC.exe
  2⤵
  PID:4588
- C:\Windows\System\jYwYcgM.exe
  C:\Windows\System\jYwYcgM.exe
  2⤵
  PID:3144
- C:\Windows\System\BpTGsQd.exe
  C:\Windows\System\BpTGsQd.exe
  2⤵
  PID:5148
- C:\Windows\System\yIuFUZl.exe
  C:\Windows\System\yIuFUZl.exe
  2⤵
  PID:5172
- C:\Windows\System\AsnOtVH.exe
  C:\Windows\System\AsnOtVH.exe
  2⤵
  PID:5224
- C:\Windows\System\xyTcAXC.exe
  C:\Windows\System\xyTcAXC.exe
  2⤵
  PID:5244
- C:\Windows\System\gSBDHsm.exe
  C:\Windows\System\gSBDHsm.exe
  2⤵
  PID:5272
- C:\Windows\System\JjnLAeo.exe
  C:\Windows\System\JjnLAeo.exe
  2⤵
  PID:5288
- C:\Windows\System\QQyujxH.exe
  C:\Windows\System\QQyujxH.exe
  2⤵
  PID:5316
- C:\Windows\System\RznFFOI.exe
  C:\Windows\System\RznFFOI.exe
  2⤵
  PID:5344
- C:\Windows\System\qJOswza.exe
  C:\Windows\System\qJOswza.exe
  2⤵
  PID:5368
- C:\Windows\System\TGmkcJs.exe
  C:\Windows\System\TGmkcJs.exe
  2⤵
  PID:5396
- C:\Windows\System\MCEnVei.exe
  C:\Windows\System\MCEnVei.exe
  2⤵
  PID:5428
- C:\Windows\System\FogiaUl.exe
  C:\Windows\System\FogiaUl.exe
  2⤵
  PID:5452
- C:\Windows\System\ahZIDyy.exe
  C:\Windows\System\ahZIDyy.exe
  2⤵
  PID:5484
- C:\Windows\System\HsDxlUR.exe
  C:\Windows\System\HsDxlUR.exe
  2⤵
  PID:5512
- C:\Windows\System\aRgJToQ.exe
  C:\Windows\System\aRgJToQ.exe
  2⤵
  PID:5540
- C:\Windows\System\NyfJiMf.exe
  C:\Windows\System\NyfJiMf.exe
  2⤵
  PID:5564
- C:\Windows\System\QPPcOnp.exe
  C:\Windows\System\QPPcOnp.exe
  2⤵
  PID:5596
- C:\Windows\System\LDQIvoU.exe
  C:\Windows\System\LDQIvoU.exe
  2⤵
  PID:5624
- C:\Windows\System\jtTxKHN.exe
  C:\Windows\System\jtTxKHN.exe
  2⤵
  PID:5648
- C:\Windows\System\huXnVMg.exe
  C:\Windows\System\huXnVMg.exe
  2⤵
  PID:5680
- C:\Windows\System\RlEKHgX.exe
  C:\Windows\System\RlEKHgX.exe
  2⤵
  PID:5708
- C:\Windows\System\GxWBpjN.exe
  C:\Windows\System\GxWBpjN.exe
  2⤵
  PID:5736
- C:\Windows\System\IiiLCfW.exe
  C:\Windows\System\IiiLCfW.exe
  2⤵
  PID:5764
- C:\Windows\System\QAQLpdL.exe
  C:\Windows\System\QAQLpdL.exe
  2⤵
  PID:5792
- C:\Windows\System\dAYHRJM.exe
  C:\Windows\System\dAYHRJM.exe
  2⤵
  PID:5828
- C:\Windows\System\pNxRTxP.exe
  C:\Windows\System\pNxRTxP.exe
  2⤵
  PID:5848
- C:\Windows\System\iIBXSHX.exe
  C:\Windows\System\iIBXSHX.exe
  2⤵
  PID:5876
- C:\Windows\System\GrUXfXr.exe
  C:\Windows\System\GrUXfXr.exe
  2⤵
  PID:5892
- C:\Windows\System\MnVykYv.exe
  C:\Windows\System\MnVykYv.exe
  2⤵
  PID:5984
- C:\Windows\System\oVkdmhn.exe
  C:\Windows\System\oVkdmhn.exe
  2⤵
  PID:6020
- C:\Windows\System\OaEAhGL.exe
  C:\Windows\System\OaEAhGL.exe
  2⤵
  PID:6044
- C:\Windows\System\ynIyDGk.exe
  C:\Windows\System\ynIyDGk.exe
  2⤵
  PID:6072
- C:\Windows\System\RIDxSAh.exe
  C:\Windows\System\RIDxSAh.exe
  2⤵
  PID:6088
- C:\Windows\System\mLxcuVV.exe
  C:\Windows\System\mLxcuVV.exe
  2⤵
  PID:6128
- C:\Windows\System\FaOYNkZ.exe
  C:\Windows\System\FaOYNkZ.exe
  2⤵
  PID:2956
- C:\Windows\System\Xixtitd.exe
  C:\Windows\System\Xixtitd.exe
  2⤵
  PID:4568
- C:\Windows\System\NJpuxeR.exe
  C:\Windows\System\NJpuxeR.exe
  2⤵
  PID:5144
- C:\Windows\System\IqUYdRE.exe
  C:\Windows\System\IqUYdRE.exe
  2⤵
  PID:5188
- C:\Windows\System\SDEjCAJ.exe
  C:\Windows\System\SDEjCAJ.exe
  2⤵
  PID:5208
- C:\Windows\System\fHhUKQF.exe
  C:\Windows\System\fHhUKQF.exe
  2⤵
  PID:5284
- C:\Windows\System\ioIQxPa.exe
  C:\Windows\System\ioIQxPa.exe
  2⤵
  PID:5336
- C:\Windows\System\DiBLrgJ.exe
  C:\Windows\System\DiBLrgJ.exe
  2⤵
  PID:5444
- C:\Windows\System\HreJdkW.exe
  C:\Windows\System\HreJdkW.exe
  2⤵
  PID:5528
- C:\Windows\System\vicTMGA.exe
  C:\Windows\System\vicTMGA.exe
  2⤵
  PID:5556
- C:\Windows\System\EejmmMx.exe
  C:\Windows\System\EejmmMx.exe
  2⤵
  PID:5584
- C:\Windows\System\RiISYdS.exe
  C:\Windows\System\RiISYdS.exe
  2⤵
  PID:5644
- C:\Windows\System\sEmBTRU.exe
  C:\Windows\System\sEmBTRU.exe
  2⤵
  PID:5720
- C:\Windows\System\ncyCxJp.exe
  C:\Windows\System\ncyCxJp.exe
  2⤵
  PID:5780
- C:\Windows\System\SEOhktN.exe
  C:\Windows\System\SEOhktN.exe
  2⤵
  PID:5816
- C:\Windows\System\owyenmO.exe
  C:\Windows\System\owyenmO.exe
  2⤵
  PID:5864
- C:\Windows\System\WLAXKul.exe
  C:\Windows\System\WLAXKul.exe
  2⤵
  PID:1652
- C:\Windows\System\WRlraBL.exe
  C:\Windows\System\WRlraBL.exe
  2⤵
  PID:4020
- C:\Windows\System\mjuJWCz.exe
  C:\Windows\System\mjuJWCz.exe
  2⤵
  PID:5884
- C:\Windows\System\JmkHdbj.exe
  C:\Windows\System\JmkHdbj.exe
  2⤵
  PID:1632
- C:\Windows\System\ixXhrSC.exe
  C:\Windows\System\ixXhrSC.exe
  2⤵
  PID:3088
- C:\Windows\System\XUPJMfC.exe
  C:\Windows\System\XUPJMfC.exe
  2⤵
  PID:6032
- C:\Windows\System\dQJIDCj.exe
  C:\Windows\System\dQJIDCj.exe
  2⤵
  PID:6084
- C:\Windows\System\PvMAdWY.exe
  C:\Windows\System\PvMAdWY.exe
  2⤵
  PID:3660
- C:\Windows\System\kgRrycO.exe
  C:\Windows\System\kgRrycO.exe
  2⤵
  PID:5132
- C:\Windows\System\nukqhPS.exe
  C:\Windows\System\nukqhPS.exe
  2⤵
  PID:5360
- C:\Windows\System\uNFeYgr.exe
  C:\Windows\System\uNFeYgr.exe
  2⤵
  PID:5504
- C:\Windows\System\qdhEPFD.exe
  C:\Windows\System\qdhEPFD.exe
  2⤵
  PID:5636
- C:\Windows\System\TFfWhnv.exe
  C:\Windows\System\TFfWhnv.exe
  2⤵
  PID:4352
- C:\Windows\System\ohfzdbv.exe
  C:\Windows\System\ohfzdbv.exe
  2⤵
  PID:5840
- C:\Windows\System\QyrKOnG.exe
  C:\Windows\System\QyrKOnG.exe
  2⤵
  PID:1496
- C:\Windows\System\foukAnV.exe
  C:\Windows\System\foukAnV.exe
  2⤵
  PID:1260
- C:\Windows\System\sJDbNkw.exe
  C:\Windows\System\sJDbNkw.exe
  2⤵
  PID:6028
- C:\Windows\System\jUAPXiJ.exe
  C:\Windows\System\jUAPXiJ.exe
  2⤵
  PID:4216
- C:\Windows\System\ualUsPO.exe
  C:\Windows\System\ualUsPO.exe
  2⤵
  PID:5752
- C:\Windows\System\nznGegl.exe
  C:\Windows\System\nznGegl.exe
  2⤵
  PID:2976
- C:\Windows\System\eKQehfY.exe
  C:\Windows\System\eKQehfY.exe
  2⤵
  PID:3488
- C:\Windows\System\YjvhBcF.exe
  C:\Windows\System\YjvhBcF.exe
  2⤵
  PID:896
- C:\Windows\System\clkprUy.exe
  C:\Windows\System\clkprUy.exe
  2⤵
  PID:6136
- C:\Windows\System\KgIIPaw.exe
  C:\Windows\System\KgIIPaw.exe
  2⤵
  PID:5364
- C:\Windows\System\szTOfsA.exe
  C:\Windows\System\szTOfsA.exe
  2⤵
  PID:6244
- C:\Windows\System\vcJSWVb.exe
  C:\Windows\System\vcJSWVb.exe
  2⤵
  PID:6268
- C:\Windows\System\EUEPGrm.exe
  C:\Windows\System\EUEPGrm.exe
  2⤵
  PID:6292
- C:\Windows\System\uYmOWvB.exe
  C:\Windows\System\uYmOWvB.exe
  2⤵
  PID:6308
- C:\Windows\System\EYXCkLl.exe
  C:\Windows\System\EYXCkLl.exe
  2⤵
  PID:6328
- C:\Windows\System\qsroVos.exe
  C:\Windows\System\qsroVos.exe
  2⤵
  PID:6356
- C:\Windows\System\OymWRUu.exe
  C:\Windows\System\OymWRUu.exe
  2⤵
  PID:6380
- C:\Windows\System\HMHcMdN.exe
  C:\Windows\System\HMHcMdN.exe
  2⤵
  PID:6400
- C:\Windows\System\qBCNgOn.exe
  C:\Windows\System\qBCNgOn.exe
  2⤵
  PID:6416
- C:\Windows\System\FctAkzw.exe
  C:\Windows\System\FctAkzw.exe
  2⤵
  PID:6448
- C:\Windows\System\RFmLtwL.exe
  C:\Windows\System\RFmLtwL.exe
  2⤵
  PID:6468
- C:\Windows\System\bFCQKGi.exe
  C:\Windows\System\bFCQKGi.exe
  2⤵
  PID:6488
- C:\Windows\System\MpDouOs.exe
  C:\Windows\System\MpDouOs.exe
  2⤵
  PID:6540
- C:\Windows\System\clEjQcp.exe
  C:\Windows\System\clEjQcp.exe
  2⤵
  PID:6588
- C:\Windows\System\MIPkozE.exe
  C:\Windows\System\MIPkozE.exe
  2⤵
  PID:6604
- C:\Windows\System\mbhpTbR.exe
  C:\Windows\System\mbhpTbR.exe
  2⤵
  PID:6628
- C:\Windows\System\rdsYKWc.exe
  C:\Windows\System\rdsYKWc.exe
  2⤵
  PID:6648
- C:\Windows\System\XjIWNEe.exe
  C:\Windows\System\XjIWNEe.exe
  2⤵
  PID:6664
- C:\Windows\System\EVmcrKu.exe
  C:\Windows\System\EVmcrKu.exe
  2⤵
  PID:6688
- C:\Windows\System\SgGEBTN.exe
  C:\Windows\System\SgGEBTN.exe
  2⤵
  PID:6708
- C:\Windows\System\UbOSMIO.exe
  C:\Windows\System\UbOSMIO.exe
  2⤵
  PID:6724
- C:\Windows\System\liCurzj.exe
  C:\Windows\System\liCurzj.exe
  2⤵
  PID:6752
- C:\Windows\System\qfyWoWA.exe
  C:\Windows\System\qfyWoWA.exe
  2⤵
  PID:6816
- C:\Windows\System\kDHeIdX.exe
  C:\Windows\System\kDHeIdX.exe
  2⤵
  PID:6836
- C:\Windows\System\infgCbr.exe
  C:\Windows\System\infgCbr.exe
  2⤵
  PID:6860
- C:\Windows\System\zBXTjOv.exe
  C:\Windows\System\zBXTjOv.exe
  2⤵
  PID:6876
- C:\Windows\System\WtEQOtN.exe
  C:\Windows\System\WtEQOtN.exe
  2⤵
  PID:6904
- C:\Windows\System\gMqsTuW.exe
  C:\Windows\System\gMqsTuW.exe
  2⤵
  PID:6920
- C:\Windows\System\bwhUVOm.exe
  C:\Windows\System\bwhUVOm.exe
  2⤵
  PID:6940
- C:\Windows\System\SvBmzjN.exe
  C:\Windows\System\SvBmzjN.exe
  2⤵
  PID:6984
- C:\Windows\System\ZDbDZRk.exe
  C:\Windows\System\ZDbDZRk.exe
  2⤵
  PID:7000
- C:\Windows\System\kTPVCFu.exe
  C:\Windows\System\kTPVCFu.exe
  2⤵
  PID:7024
- C:\Windows\System\ByzwqIk.exe
  C:\Windows\System\ByzwqIk.exe
  2⤵
  PID:7048
- C:\Windows\System\IRYkgXm.exe
  C:\Windows\System\IRYkgXm.exe
  2⤵
  PID:7072
- C:\Windows\System\HikQDEr.exe
  C:\Windows\System\HikQDEr.exe
  2⤵
  PID:7096
- C:\Windows\System\USfdypv.exe
  C:\Windows\System\USfdypv.exe
  2⤵
  PID:7156
- C:\Windows\System\rseumrg.exe
  C:\Windows\System\rseumrg.exe
  2⤵
  PID:6164
- C:\Windows\System\ucwZAUr.exe
  C:\Windows\System\ucwZAUr.exe
  2⤵
  PID:6264
- C:\Windows\System\uxbXeZq.exe
  C:\Windows\System\uxbXeZq.exe
  2⤵
  PID:6300
- C:\Windows\System\FSPdvBa.exe
  C:\Windows\System\FSPdvBa.exe
  2⤵
  PID:1076
- C:\Windows\System\qvwNEhd.exe
  C:\Windows\System\qvwNEhd.exe
  2⤵
  PID:6412
- C:\Windows\System\DLJMrGB.exe
  C:\Windows\System\DLJMrGB.exe
  2⤵
  PID:6508
- C:\Windows\System\WnUvAaI.exe
  C:\Windows\System\WnUvAaI.exe
  2⤵
  PID:6616
- C:\Windows\System\NbHKlcj.exe
  C:\Windows\System\NbHKlcj.exe
  2⤵
  PID:6660
- C:\Windows\System\NWDXLtE.exe
  C:\Windows\System\NWDXLtE.exe
  2⤵
  PID:6680
- C:\Windows\System\bgUXZDt.exe
  C:\Windows\System\bgUXZDt.exe
  2⤵
  PID:6792
- C:\Windows\System\ogFLLJR.exe
  C:\Windows\System\ogFLLJR.exe
  2⤵
  PID:6764
- C:\Windows\System\rAMJRYK.exe
  C:\Windows\System\rAMJRYK.exe
  2⤵
  PID:6928
- C:\Windows\System\LqTxhVu.exe
  C:\Windows\System\LqTxhVu.exe
  2⤵
  PID:6808
- C:\Windows\System\mpjfKUt.exe
  C:\Windows\System\mpjfKUt.exe
  2⤵
  PID:6996
- C:\Windows\System\TMMvhnp.exe
  C:\Windows\System\TMMvhnp.exe
  2⤵
  PID:7108
- C:\Windows\System\cQARfHH.exe
  C:\Windows\System\cQARfHH.exe
  2⤵
  PID:7020
- C:\Windows\System\aLvcKrx.exe
  C:\Windows\System\aLvcKrx.exe
  2⤵
  PID:7064
- C:\Windows\System\SWPHXXI.exe
  C:\Windows\System\SWPHXXI.exe
  2⤵
  PID:7148
- C:\Windows\System\jvNfHLl.exe
  C:\Windows\System\jvNfHLl.exe
  2⤵
  PID:6232
- C:\Windows\System\RxAZnuV.exe
  C:\Windows\System\RxAZnuV.exe
  2⤵
  PID:4320
- C:\Windows\System\xChmbkn.exe
  C:\Windows\System\xChmbkn.exe
  2⤵
  PID:6620
- C:\Windows\System\IgYIPgx.exe
  C:\Windows\System\IgYIPgx.exe
  2⤵
  PID:6744
- C:\Windows\System\SILkZZq.exe
  C:\Windows\System\SILkZZq.exe
  2⤵
  PID:6832
- C:\Windows\System\BuDefkO.exe
  C:\Windows\System\BuDefkO.exe
  2⤵
  PID:1916
- C:\Windows\System\Zipxwhu.exe
  C:\Windows\System\Zipxwhu.exe
  2⤵
  PID:1256
- C:\Windows\System\gHTaHzi.exe
  C:\Windows\System\gHTaHzi.exe
  2⤵
  PID:2672
- C:\Windows\System\nQHyIPq.exe
  C:\Windows\System\nQHyIPq.exe
  2⤵
  PID:3548
- C:\Windows\System\qLhnSem.exe
  C:\Windows\System\qLhnSem.exe
  2⤵
  PID:6460
- C:\Windows\System\djWlakl.exe
  C:\Windows\System\djWlakl.exe
  2⤵
  PID:6900
- C:\Windows\System\bdJYKRq.exe
  C:\Windows\System\bdJYKRq.exe
  2⤵
  PID:6872
- C:\Windows\System\tsvRhNS.exe
  C:\Windows\System\tsvRhNS.exe
  2⤵
  PID:7068
- C:\Windows\System\VoGbVjk.exe
  C:\Windows\System\VoGbVjk.exe
  2⤵
  PID:7204
- C:\Windows\System\JRtahHn.exe
  C:\Windows\System\JRtahHn.exe
  2⤵
  PID:7228
- C:\Windows\System\IMzfOJl.exe
  C:\Windows\System\IMzfOJl.exe
  2⤵
  PID:7276
- C:\Windows\System\TZSAifq.exe
  C:\Windows\System\TZSAifq.exe
  2⤵
  PID:7308
- C:\Windows\System\NnOxOWM.exe
  C:\Windows\System\NnOxOWM.exe
  2⤵
  PID:7332
- C:\Windows\System\CNfZftx.exe
  C:\Windows\System\CNfZftx.exe
  2⤵
  PID:7356
- C:\Windows\System\PXPIoBY.exe
  C:\Windows\System\PXPIoBY.exe
  2⤵
  PID:7372
- C:\Windows\System\wYTivIl.exe
  C:\Windows\System\wYTivIl.exe
  2⤵
  PID:7400
- C:\Windows\System\NBfidWd.exe
  C:\Windows\System\NBfidWd.exe
  2⤵
  PID:7424
- C:\Windows\System\ixXzmur.exe
  C:\Windows\System\ixXzmur.exe
  2⤵
  PID:7472
- C:\Windows\System\MuGAOBO.exe
  C:\Windows\System\MuGAOBO.exe
  2⤵
  PID:7488
- C:\Windows\System\wAsRVIc.exe
  C:\Windows\System\wAsRVIc.exe
  2⤵
  PID:7516
- C:\Windows\System\mDdHPhs.exe
  C:\Windows\System\mDdHPhs.exe
  2⤵
  PID:7560
- C:\Windows\System\vFkicKY.exe
  C:\Windows\System\vFkicKY.exe
  2⤵
  PID:7580
- C:\Windows\System\pZqQidz.exe
  C:\Windows\System\pZqQidz.exe
  2⤵
  PID:7616
- C:\Windows\System\mlHcujj.exe
  C:\Windows\System\mlHcujj.exe
  2⤵
  PID:7636
- C:\Windows\System\MypLyyi.exe
  C:\Windows\System\MypLyyi.exe
  2⤵
  PID:7676
- C:\Windows\System\UZsffFz.exe
  C:\Windows\System\UZsffFz.exe
  2⤵
  PID:7700
- C:\Windows\System\FFdLRzg.exe
  C:\Windows\System\FFdLRzg.exe
  2⤵
  PID:7724
- C:\Windows\System\HObvfxX.exe
  C:\Windows\System\HObvfxX.exe
  2⤵
  PID:7740
- C:\Windows\System\vyHjGdG.exe
  C:\Windows\System\vyHjGdG.exe
  2⤵
  PID:7768
- C:\Windows\System\GMBEJwk.exe
  C:\Windows\System\GMBEJwk.exe
  2⤵
  PID:7792
- C:\Windows\System\lRBLdOW.exe
  C:\Windows\System\lRBLdOW.exe
  2⤵
  PID:7812
- C:\Windows\System\tVOVjsi.exe
  C:\Windows\System\tVOVjsi.exe
  2⤵
  PID:7832
- C:\Windows\System\cGecOke.exe
  C:\Windows\System\cGecOke.exe
  2⤵
  PID:7876
- C:\Windows\System\lPiFUoR.exe
  C:\Windows\System\lPiFUoR.exe
  2⤵
  PID:7924
- C:\Windows\System\NziRKPL.exe
  C:\Windows\System\NziRKPL.exe
  2⤵
  PID:7944
- C:\Windows\System\LKSKEod.exe
  C:\Windows\System\LKSKEod.exe
  2⤵
  PID:7960
- C:\Windows\System\EdLxdds.exe
  C:\Windows\System\EdLxdds.exe
  2⤵
  PID:7980
- C:\Windows\System\MEtHFbR.exe
  C:\Windows\System\MEtHFbR.exe
  2⤵
  PID:8008
- C:\Windows\System\IxzLpbS.exe
  C:\Windows\System\IxzLpbS.exe
  2⤵
  PID:8024
- C:\Windows\System\FHpZYHe.exe
  C:\Windows\System\FHpZYHe.exe
  2⤵
  PID:8044
- C:\Windows\System\HCElClk.exe
  C:\Windows\System\HCElClk.exe
  2⤵
  PID:8076
- C:\Windows\System\ZqqRJYg.exe
  C:\Windows\System\ZqqRJYg.exe
  2⤵
  PID:8132
- C:\Windows\System\eOMhZnP.exe
  C:\Windows\System\eOMhZnP.exe
  2⤵
  PID:8152
- C:\Windows\System\ZFGOOCZ.exe
  C:\Windows\System\ZFGOOCZ.exe
  2⤵
  PID:8184
- C:\Windows\System\cePqibX.exe
  C:\Windows\System\cePqibX.exe
  2⤵
  PID:6284
- C:\Windows\System\lzmQxKw.exe
  C:\Windows\System\lzmQxKw.exe
  2⤵
  PID:5052
- C:\Windows\System\irQTRew.exe
  C:\Windows\System\irQTRew.exe
  2⤵
  PID:7200
- C:\Windows\System\QksQONO.exe
  C:\Windows\System\QksQONO.exe
  2⤵
  PID:7268
- C:\Windows\System\BBSFfDa.exe
  C:\Windows\System\BBSFfDa.exe
  2⤵
  PID:5956
- C:\Windows\System\TFarvcU.exe
  C:\Windows\System\TFarvcU.exe
  2⤵
  PID:7368
- C:\Windows\System\UJamnhP.exe
  C:\Windows\System\UJamnhP.exe
  2⤵
  PID:7436
- C:\Windows\System\cEyypuy.exe
  C:\Windows\System\cEyypuy.exe
  2⤵
  PID:7496
- C:\Windows\System\ZCjJZdS.exe
  C:\Windows\System\ZCjJZdS.exe
  2⤵
  PID:7576
- C:\Windows\System\NUasGEK.exe
  C:\Windows\System\NUasGEK.exe
  2⤵
  PID:7608
- C:\Windows\System\AGVigBq.exe
  C:\Windows\System\AGVigBq.exe
  2⤵
  PID:7720
- C:\Windows\System\axrXCaE.exe
  C:\Windows\System\axrXCaE.exe
  2⤵
  PID:7776
- C:\Windows\System\DvQbBwK.exe
  C:\Windows\System\DvQbBwK.exe
  2⤵
  PID:7828
- C:\Windows\System\TWHXfWs.exe
  C:\Windows\System\TWHXfWs.exe
  2⤵
  PID:7852
- C:\Windows\System\TvdkJRp.exe
  C:\Windows\System\TvdkJRp.exe
  2⤵
  PID:7912
- C:\Windows\System\TggZaiT.exe
  C:\Windows\System\TggZaiT.exe
  2⤵
  PID:7976
- C:\Windows\System\KcCljYG.exe
  C:\Windows\System\KcCljYG.exe
  2⤵
  PID:8000
- C:\Windows\System\GHHAPem.exe
  C:\Windows\System\GHHAPem.exe
  2⤵
  PID:8092
- C:\Windows\System\KRfQDyi.exe
  C:\Windows\System\KRfQDyi.exe
  2⤵
  PID:8120
- C:\Windows\System\YQwHLgM.exe
  C:\Windows\System\YQwHLgM.exe
  2⤵
  PID:8148
- C:\Windows\System\nChWCBS.exe
  C:\Windows\System\nChWCBS.exe
  2⤵
  PID:6532
- C:\Windows\System\vrpjDnA.exe
  C:\Windows\System\vrpjDnA.exe
  2⤵
  PID:7288
- C:\Windows\System\jywnnQn.exe
  C:\Windows\System\jywnnQn.exe
  2⤵
  PID:7396
- C:\Windows\System\dzDHEcR.exe
  C:\Windows\System\dzDHEcR.exe
  2⤵
  PID:7600
- C:\Windows\System\dxdwNys.exe
  C:\Windows\System\dxdwNys.exe
  2⤵
  PID:7748
- C:\Windows\System\iXjwAFK.exe
  C:\Windows\System\iXjwAFK.exe
  2⤵
  PID:7804
- C:\Windows\System\RMDVnMu.exe
  C:\Windows\System\RMDVnMu.exe
  2⤵
  PID:3220
- C:\Windows\System\DuVhweH.exe
  C:\Windows\System\DuVhweH.exe
  2⤵
  PID:8144
- C:\Windows\System\FwvZutP.exe
  C:\Windows\System\FwvZutP.exe
  2⤵
  PID:4396
- C:\Windows\System\kHCYGyX.exe
  C:\Windows\System\kHCYGyX.exe
  2⤵
  PID:1380
- C:\Windows\System\FxVPenx.exe
  C:\Windows\System\FxVPenx.exe
  2⤵
  PID:7708
- C:\Windows\System\wnjLqzZ.exe
  C:\Windows\System\wnjLqzZ.exe
  2⤵
  PID:7872
- C:\Windows\System\BcfSIlT.exe
  C:\Windows\System\BcfSIlT.exe
  2⤵
  PID:8220
- C:\Windows\System\RdVmJrN.exe
  C:\Windows\System\RdVmJrN.exe
  2⤵
  PID:8240
- C:\Windows\System\zIkCgjG.exe
  C:\Windows\System\zIkCgjG.exe
  2⤵
  PID:8260
- C:\Windows\System\dorcqXw.exe
  C:\Windows\System\dorcqXw.exe
  2⤵
  PID:8288
- C:\Windows\System\oAhWrDc.exe
  C:\Windows\System\oAhWrDc.exe
  2⤵
  PID:8328
- C:\Windows\System\DHysmgH.exe
  C:\Windows\System\DHysmgH.exe
  2⤵
  PID:8352
- C:\Windows\System\FOFxhbq.exe
  C:\Windows\System\FOFxhbq.exe
  2⤵
  PID:8384
- C:\Windows\System\AYpzbKb.exe
  C:\Windows\System\AYpzbKb.exe
  2⤵
  PID:8424
- C:\Windows\System\HlMJzmQ.exe
  C:\Windows\System\HlMJzmQ.exe
  2⤵
  PID:8440
- C:\Windows\System\MpRpQsD.exe
  C:\Windows\System\MpRpQsD.exe
  2⤵
  PID:8460
- C:\Windows\System\WEYRsWQ.exe
  C:\Windows\System\WEYRsWQ.exe
  2⤵
  PID:8496
- C:\Windows\System\rTvnxcN.exe
  C:\Windows\System\rTvnxcN.exe
  2⤵
  PID:8532
- C:\Windows\System\jZNkRzy.exe
  C:\Windows\System\jZNkRzy.exe
  2⤵
  PID:8580
- C:\Windows\System\TJWqqat.exe
  C:\Windows\System\TJWqqat.exe
  2⤵
  PID:8632
- C:\Windows\System\BHBApkB.exe
  C:\Windows\System\BHBApkB.exe
  2⤵
  PID:8652
- C:\Windows\System\pZgdFup.exe
  C:\Windows\System\pZgdFup.exe
  2⤵
  PID:8668
- C:\Windows\System\pGiOMxa.exe
  C:\Windows\System\pGiOMxa.exe
  2⤵
  PID:8684
- C:\Windows\System\PAkFGjA.exe
  C:\Windows\System\PAkFGjA.exe
  2⤵
  PID:8700
- C:\Windows\System\sEejPSt.exe
  C:\Windows\System\sEejPSt.exe
  2⤵
  PID:8720
- C:\Windows\System\PkLdlWg.exe
  C:\Windows\System\PkLdlWg.exe
  2⤵
  PID:8740
- C:\Windows\System\AvyUkEN.exe
  C:\Windows\System\AvyUkEN.exe
  2⤵
  PID:8756
- C:\Windows\System\WvSYvCw.exe
  C:\Windows\System\WvSYvCw.exe
  2⤵
  PID:8772
- C:\Windows\System\BKsUbhB.exe
  C:\Windows\System\BKsUbhB.exe
  2⤵
  PID:8788
- C:\Windows\System\qtjOwqK.exe
  C:\Windows\System\qtjOwqK.exe
  2⤵
  PID:8804
- C:\Windows\System\WBDAQxX.exe
  C:\Windows\System\WBDAQxX.exe
  2⤵
  PID:8820
- C:\Windows\System\DZRbBrZ.exe
  C:\Windows\System\DZRbBrZ.exe
  2⤵
  PID:8836
- C:\Windows\System\RmleZaT.exe
  C:\Windows\System\RmleZaT.exe
  2⤵
  PID:8852
- C:\Windows\System\JyZhtiq.exe
  C:\Windows\System\JyZhtiq.exe
  2⤵
  PID:8872
- C:\Windows\System\uxephAk.exe
  C:\Windows\System\uxephAk.exe
  2⤵
  PID:8960
- C:\Windows\System\FJprEJe.exe
  C:\Windows\System\FJprEJe.exe
  2⤵
  PID:8980
- C:\Windows\System\mtEZrJG.exe
  C:\Windows\System\mtEZrJG.exe
  2⤵
  PID:8996
- C:\Windows\System\ciKJxCw.exe
  C:\Windows\System\ciKJxCw.exe
  2⤵
  PID:9012
- C:\Windows\System\pTaiiNl.exe
  C:\Windows\System\pTaiiNl.exe
  2⤵
  PID:9036
- C:\Windows\System\hiUfwsq.exe
  C:\Windows\System\hiUfwsq.exe
  2⤵
  PID:9052
- C:\Windows\System\HhTdneE.exe
  C:\Windows\System\HhTdneE.exe
  2⤵
  PID:9068
- C:\Windows\System\gbIvJUW.exe
  C:\Windows\System\gbIvJUW.exe
  2⤵
  PID:9088
- C:\Windows\System\pantcHA.exe
  C:\Windows\System\pantcHA.exe
  2⤵
  PID:9104
- C:\Windows\System\KuFGzHp.exe
  C:\Windows\System\KuFGzHp.exe
  2⤵
  PID:9120
- C:\Windows\System\ARSmoQh.exe
  C:\Windows\System\ARSmoQh.exe
  2⤵
  PID:9196
- C:\Windows\System\THYGRJP.exe
  C:\Windows\System\THYGRJP.exe
  2⤵
  PID:7364
- C:\Windows\System\yzOndWe.exe
  C:\Windows\System\yzOndWe.exe
  2⤵
  PID:8032
- C:\Windows\System\sidTGBg.exe
  C:\Windows\System\sidTGBg.exe
  2⤵
  PID:8600
- C:\Windows\System\IcOQuBA.exe
  C:\Windows\System\IcOQuBA.exe
  2⤵
  PID:8452
- C:\Windows\System\nXMdkZt.exe
  C:\Windows\System\nXMdkZt.exe
  2⤵
  PID:8548
- C:\Windows\System\RtNxBWf.exe
  C:\Windows\System\RtNxBWf.exe
  2⤵
  PID:1468
- C:\Windows\System\PuhKwVY.exe
  C:\Windows\System\PuhKwVY.exe
  2⤵
  PID:8664
- C:\Windows\System\tfYmwZa.exe
  C:\Windows\System\tfYmwZa.exe
  2⤵
  PID:9096
- C:\Windows\System\usIIvVJ.exe
  C:\Windows\System\usIIvVJ.exe
  2⤵
  PID:8752
- C:\Windows\System\FZvEPqx.exe
  C:\Windows\System\FZvEPqx.exe
  2⤵
  PID:8844
- C:\Windows\System\STbcRys.exe
  C:\Windows\System\STbcRys.exe
  2⤵
  PID:8884
- C:\Windows\System\folzuIE.exe
  C:\Windows\System\folzuIE.exe
  2⤵
  PID:8912
- C:\Windows\System\tJdQEaK.exe
  C:\Windows\System\tJdQEaK.exe
  2⤵
  PID:9064
- C:\Windows\System\JIknSAx.exe
  C:\Windows\System\JIknSAx.exe
  2⤵
  PID:8796
- C:\Windows\System\vGsgKBZ.exe
  C:\Windows\System\vGsgKBZ.exe
  2⤵
  PID:8576
- C:\Windows\System\LdPcRzO.exe
  C:\Windows\System\LdPcRzO.exe
  2⤵
  PID:8236
- C:\Windows\System\MdRqlCw.exe
  C:\Windows\System\MdRqlCw.exe
  2⤵
  PID:8924
- C:\Windows\System\GfIshqo.exe
  C:\Windows\System\GfIshqo.exe
  2⤵
  PID:3204
- C:\Windows\System\fuVYwcl.exe
  C:\Windows\System\fuVYwcl.exe
  2⤵
  PID:8956
- C:\Windows\System\WghlcUb.exe
  C:\Windows\System\WghlcUb.exe
  2⤵
  PID:8716
- C:\Windows\System\gSKMbmC.exe
  C:\Windows\System\gSKMbmC.exe
  2⤵
  PID:9172
- C:\Windows\System\ITdYGMR.exe
  C:\Windows\System\ITdYGMR.exe
  2⤵
  PID:8620
- C:\Windows\System\ZLPRXcT.exe
  C:\Windows\System\ZLPRXcT.exe
  2⤵
  PID:9188
- C:\Windows\System\zBMscwz.exe
  C:\Windows\System\zBMscwz.exe
  2⤵
  PID:8596
- C:\Windows\System\uRqjndz.exe
  C:\Windows\System\uRqjndz.exe
  2⤵
  PID:9008
- C:\Windows\System\kSEdylQ.exe
  C:\Windows\System\kSEdylQ.exe
  2⤵
  PID:4484
- C:\Windows\System\VkEoJWx.exe
  C:\Windows\System\VkEoJWx.exe
  2⤵
  PID:8252
- C:\Windows\System\SucgoxA.exe
  C:\Windows\System\SucgoxA.exe
  2⤵
  PID:8612
- C:\Windows\System\UueNAyA.exe
  C:\Windows\System\UueNAyA.exe
  2⤵
  PID:9244
- C:\Windows\System\iDMGaKS.exe
  C:\Windows\System\iDMGaKS.exe
  2⤵
  PID:9268
- C:\Windows\System\xnIsCrd.exe
  C:\Windows\System\xnIsCrd.exe
  2⤵
  PID:9288
- C:\Windows\System\VONzTMp.exe
  C:\Windows\System\VONzTMp.exe
  2⤵
  PID:9312
- C:\Windows\System\rDMpglh.exe
  C:\Windows\System\rDMpglh.exe
  2⤵
  PID:9332
- C:\Windows\System\GIaoDrJ.exe
  C:\Windows\System\GIaoDrJ.exe
  2⤵
  PID:9356
- C:\Windows\System\RYzUHnV.exe
  C:\Windows\System\RYzUHnV.exe
  2⤵
  PID:9376
- C:\Windows\System\VtBYiOj.exe
  C:\Windows\System\VtBYiOj.exe
  2⤵
  PID:9392
- C:\Windows\System\RaqBZdw.exe
  C:\Windows\System\RaqBZdw.exe
  2⤵
  PID:9408
- C:\Windows\System\lvrkVKF.exe
  C:\Windows\System\lvrkVKF.exe
  2⤵
  PID:9468
- C:\Windows\System\PWqcdqv.exe
  C:\Windows\System\PWqcdqv.exe
  2⤵
  PID:9500
- C:\Windows\System\sGGCgiM.exe
  C:\Windows\System\sGGCgiM.exe
  2⤵
  PID:9520
- C:\Windows\System\anzUFAi.exe
  C:\Windows\System\anzUFAi.exe
  2⤵
  PID:9596
- C:\Windows\System\xflAipH.exe
  C:\Windows\System\xflAipH.exe
  2⤵
  PID:9648
- C:\Windows\System\EwAHRLA.exe
  C:\Windows\System\EwAHRLA.exe
  2⤵
  PID:9668
- C:\Windows\System\KEiwFFm.exe
  C:\Windows\System\KEiwFFm.exe
  2⤵
  PID:9688
- C:\Windows\System\OoPDWcL.exe
  C:\Windows\System\OoPDWcL.exe
  2⤵
  PID:9712
- C:\Windows\System\UzvRkaw.exe
  C:\Windows\System\UzvRkaw.exe
  2⤵
  PID:9732
- C:\Windows\System\lxNiirp.exe
  C:\Windows\System\lxNiirp.exe
  2⤵
  PID:9756
- C:\Windows\System\IZzoSRm.exe
  C:\Windows\System\IZzoSRm.exe
  2⤵
  PID:9784
- C:\Windows\System\BzBznwu.exe
  C:\Windows\System\BzBznwu.exe
  2⤵
  PID:9804
- C:\Windows\System\WLJRXdU.exe
  C:\Windows\System\WLJRXdU.exe
  2⤵
  PID:9828
- C:\Windows\System\GrlIcFg.exe
  C:\Windows\System\GrlIcFg.exe
  2⤵
  PID:9856
- C:\Windows\System\MiXqmNg.exe
  C:\Windows\System\MiXqmNg.exe
  2⤵
  PID:9876
- C:\Windows\System\bnfbWcn.exe
  C:\Windows\System\bnfbWcn.exe
  2⤵
  PID:9896
- C:\Windows\System\iwJexkQ.exe
  C:\Windows\System\iwJexkQ.exe
  2⤵
  PID:9916
- C:\Windows\System\vyXrLth.exe
  C:\Windows\System\vyXrLth.exe
  2⤵
  PID:9944
- C:\Windows\System\mrOiQMB.exe
  C:\Windows\System\mrOiQMB.exe
  2⤵
  PID:9996
- C:\Windows\System\Eefhlje.exe
  C:\Windows\System\Eefhlje.exe
  2⤵
  PID:10024
- C:\Windows\System\ZCxIOKM.exe
  C:\Windows\System\ZCxIOKM.exe
  2⤵
  PID:10076
- C:\Windows\System\hhsjtwj.exe
  C:\Windows\System\hhsjtwj.exe
  2⤵
  PID:10096
- C:\Windows\System\DoASFFp.exe
  C:\Windows\System\DoASFFp.exe
  2⤵
  PID:10112
- C:\Windows\System\GEDZArq.exe
  C:\Windows\System\GEDZArq.exe
  2⤵
  PID:10164
- C:\Windows\System\RmYdaRl.exe
  C:\Windows\System\RmYdaRl.exe
  2⤵
  PID:10184
- C:\Windows\System\XoLvPhT.exe
  C:\Windows\System\XoLvPhT.exe
  2⤵
  PID:10208
- C:\Windows\System\tRiqLVJ.exe
  C:\Windows\System\tRiqLVJ.exe
  2⤵
  PID:10232
- C:\Windows\System\rmUDTxS.exe
  C:\Windows\System\rmUDTxS.exe
  2⤵
  PID:8780
- C:\Windows\System\AxjIVDA.exe
  C:\Windows\System\AxjIVDA.exe
  2⤵
  PID:9224
- C:\Windows\System\jviCPPm.exe
  C:\Windows\System\jviCPPm.exe
  2⤵
  PID:9264
- C:\Windows\System\OfbVLVX.exe
  C:\Windows\System\OfbVLVX.exe
  2⤵
  PID:9496
- C:\Windows\System\jLYeZPe.exe
  C:\Windows\System\jLYeZPe.exe
  2⤵
  PID:9516
- C:\Windows\System\kfnZLFA.exe
  C:\Windows\System\kfnZLFA.exe
  2⤵
  PID:9604
- C:\Windows\System\oJTbSXa.exe
  C:\Windows\System\oJTbSXa.exe
  2⤵
  PID:9620
- C:\Windows\System\PzQkdjp.exe
  C:\Windows\System\PzQkdjp.exe
  2⤵
  PID:9700
- C:\Windows\System\WoZfKGC.exe
  C:\Windows\System\WoZfKGC.exe
  2⤵
  PID:9748
- C:\Windows\System\CMLVnXE.exe
  C:\Windows\System\CMLVnXE.exe
  2⤵
  PID:9800
- C:\Windows\System\LDQUivR.exe
  C:\Windows\System\LDQUivR.exe
  2⤵
  PID:9928
- C:\Windows\System\itXIzhI.exe
  C:\Windows\System\itXIzhI.exe
  2⤵
  PID:9892
- C:\Windows\System\nAETKPi.exe
  C:\Windows\System\nAETKPi.exe
  2⤵
  PID:9968
- C:\Windows\System\MbIYlBH.exe
  C:\Windows\System\MbIYlBH.exe
  2⤵
  PID:10104
- C:\Windows\System\tfLvdCu.exe
  C:\Windows\System\tfLvdCu.exe
  2⤵
  PID:10148
- C:\Windows\System\KMjTiTo.exe
  C:\Windows\System\KMjTiTo.exe
  2⤵
  PID:10220
- C:\Windows\System\rDHdtap.exe
  C:\Windows\System\rDHdtap.exe
  2⤵
  PID:9284
- C:\Windows\System\hASfsGh.exe
  C:\Windows\System\hASfsGh.exe
  2⤵
  PID:9544
- C:\Windows\System\AyVxyNc.exe
  C:\Windows\System\AyVxyNc.exe
  2⤵
  PID:9640
- C:\Windows\System\MiiHwby.exe
  C:\Windows\System\MiiHwby.exe
  2⤵
  PID:9740
- C:\Windows\System\jwDCijG.exe
  C:\Windows\System\jwDCijG.exe
  2⤵
  PID:9872
- C:\Windows\System\kCoXzBl.exe
  C:\Windows\System\kCoXzBl.exe
  2⤵
  PID:10140
- C:\Windows\System\HtWpVXd.exe
  C:\Windows\System\HtWpVXd.exe
  2⤵
  PID:7116
- C:\Windows\System\NpUtMZV.exe
  C:\Windows\System\NpUtMZV.exe
  2⤵
  PID:9456
- C:\Windows\System\HjJrHFJ.exe
  C:\Windows\System\HjJrHFJ.exe
  2⤵
  PID:9684
- C:\Windows\System\MeInMkq.exe
  C:\Windows\System\MeInMkq.exe
  2⤵
  PID:9308
- C:\Windows\System\FfcefOQ.exe
  C:\Windows\System\FfcefOQ.exe
  2⤵
  PID:10264
- C:\Windows\System\CnfjsSw.exe
  C:\Windows\System\CnfjsSw.exe
  2⤵
  PID:10288
- C:\Windows\System\xhxorMd.exe
  C:\Windows\System\xhxorMd.exe
  2⤵
  PID:10304
- C:\Windows\System\cNoicnb.exe
  C:\Windows\System\cNoicnb.exe
  2⤵
  PID:10340
- C:\Windows\System\pktDKRL.exe
  C:\Windows\System\pktDKRL.exe
  2⤵
  PID:10368
- C:\Windows\System\ahCeLBH.exe
  C:\Windows\System\ahCeLBH.exe
  2⤵
  PID:10384
- C:\Windows\System\HOwUYyW.exe
  C:\Windows\System\HOwUYyW.exe
  2⤵
  PID:10408
- C:\Windows\System\oJnjTrn.exe
  C:\Windows\System\oJnjTrn.exe
  2⤵
  PID:10424
- C:\Windows\System\LDzdvMb.exe
  C:\Windows\System\LDzdvMb.exe
  2⤵
  PID:10448
- C:\Windows\System\mbhizSG.exe
  C:\Windows\System\mbhizSG.exe
  2⤵
  PID:10480
- C:\Windows\System\qToNYBg.exe
  C:\Windows\System\qToNYBg.exe
  2⤵
  PID:10516
- C:\Windows\System\YAWmBKw.exe
  C:\Windows\System\YAWmBKw.exe
  2⤵
  PID:10556
- C:\Windows\System\OpRYZTT.exe
  C:\Windows\System\OpRYZTT.exe
  2⤵
  PID:10628
- C:\Windows\System\QDEEoCj.exe
  C:\Windows\System\QDEEoCj.exe
  2⤵
  PID:10644
- C:\Windows\System\sEGcYQj.exe
  C:\Windows\System\sEGcYQj.exe
  2⤵
  PID:10664
- C:\Windows\System\fPjMcMF.exe
  C:\Windows\System\fPjMcMF.exe
  2⤵
  PID:10680
- C:\Windows\System\NkiJHNO.exe
  C:\Windows\System\NkiJHNO.exe
  2⤵
  PID:10704
- C:\Windows\System\epFZXcV.exe
  C:\Windows\System\epFZXcV.exe
  2⤵
  PID:10720
- C:\Windows\System\IuOQYxX.exe
  C:\Windows\System\IuOQYxX.exe
  2⤵
  PID:10784
- C:\Windows\System\IQObSBq.exe
  C:\Windows\System\IQObSBq.exe
  2⤵
  PID:10808
- C:\Windows\System\uFXGVQX.exe
  C:\Windows\System\uFXGVQX.exe
  2⤵
  PID:10824
- C:\Windows\System\sTrVkSO.exe
  C:\Windows\System\sTrVkSO.exe
  2⤵
  PID:10848
- C:\Windows\System\bNQUTJJ.exe
  C:\Windows\System\bNQUTJJ.exe
  2⤵
  PID:10868
- C:\Windows\System\AqTBXgd.exe
  C:\Windows\System\AqTBXgd.exe
  2⤵
  PID:10896
- C:\Windows\System\lfjRNIW.exe
  C:\Windows\System\lfjRNIW.exe
  2⤵
  PID:10916
- C:\Windows\System\yncOvon.exe
  C:\Windows\System\yncOvon.exe
  2⤵
  PID:10936
- C:\Windows\System\HFRksmi.exe
  C:\Windows\System\HFRksmi.exe
  2⤵
  PID:10980
- C:\Windows\System\mztcouS.exe
  C:\Windows\System\mztcouS.exe
  2⤵
  PID:11004
- C:\Windows\System\LsAyjVy.exe
  C:\Windows\System\LsAyjVy.exe
  2⤵
  PID:11036
- C:\Windows\System\OEYIXQa.exe
  C:\Windows\System\OEYIXQa.exe
  2⤵
  PID:11068
- C:\Windows\System\kxlyMFP.exe
  C:\Windows\System\kxlyMFP.exe
  2⤵
  PID:11116
- C:\Windows\System\GzGVrfh.exe
  C:\Windows\System\GzGVrfh.exe
  2⤵
  PID:11136
- C:\Windows\System\JMwIQJb.exe
  C:\Windows\System\JMwIQJb.exe
  2⤵
  PID:11156
- C:\Windows\System\ENxlnks.exe
  C:\Windows\System\ENxlnks.exe
  2⤵
  PID:11184
- C:\Windows\System\GKJGmJQ.exe
  C:\Windows\System\GKJGmJQ.exe
  2⤵
  PID:11204
- C:\Windows\System\qavybpa.exe
  C:\Windows\System\qavybpa.exe
  2⤵
  PID:11228
- C:\Windows\System\TQjXfnq.exe
  C:\Windows\System\TQjXfnq.exe
  2⤵
  PID:11248
- C:\Windows\System\NknDEgZ.exe
  C:\Windows\System\NknDEgZ.exe
  2⤵
  PID:9796
- C:\Windows\System\vlsJDDh.exe
  C:\Windows\System\vlsJDDh.exe
  2⤵
  PID:10300
- C:\Windows\System\BQQEVDr.exe
  C:\Windows\System\BQQEVDr.exe
  2⤵
  PID:10364
- C:\Windows\System\nwQjTrr.exe
  C:\Windows\System\nwQjTrr.exe
  2⤵
  PID:10460
- C:\Windows\System\WdGEVBg.exe
  C:\Windows\System\WdGEVBg.exe
  2⤵
  PID:10492
- C:\Windows\System\htAWKNJ.exe
  C:\Windows\System\htAWKNJ.exe
  2⤵
  PID:10584
- C:\Windows\System\qkSIvKg.exe
  C:\Windows\System\qkSIvKg.exe
  2⤵
  PID:10640
- C:\Windows\System\IQUTLJI.exe
  C:\Windows\System\IQUTLJI.exe
  2⤵
  PID:10688
- C:\Windows\System\dWEaFef.exe
  C:\Windows\System\dWEaFef.exe
  2⤵
  PID:10796
- C:\Windows\System\djfjbBx.exe
  C:\Windows\System\djfjbBx.exe
  2⤵
  PID:10840
- C:\Windows\System\hgXBsQZ.exe
  C:\Windows\System\hgXBsQZ.exe
  2⤵
  PID:10912
- C:\Windows\System\cnyIcyd.exe
  C:\Windows\System\cnyIcyd.exe
  2⤵
  PID:10996
- C:\Windows\System\vjroTeE.exe
  C:\Windows\System\vjroTeE.exe
  2⤵
  PID:11056
- C:\Windows\System\UJHZMUT.exe
  C:\Windows\System\UJHZMUT.exe
  2⤵
  PID:11148
- C:\Windows\System\qhxOrTg.exe
  C:\Windows\System\qhxOrTg.exe
  2⤵
  PID:11112
- C:\Windows\System\ddoRIiU.exe
  C:\Windows\System\ddoRIiU.exe
  2⤵
  PID:11240
- C:\Windows\System\yucaEpq.exe
  C:\Windows\System\yucaEpq.exe
  2⤵
  PID:10052
- C:\Windows\System\ulHUuTx.exe
  C:\Windows\System\ulHUuTx.exe
  2⤵
  PID:10380
- C:\Windows\System\aeEUDFv.exe
  C:\Windows\System\aeEUDFv.exe
  2⤵
  PID:10672
- C:\Windows\System\BspjiPp.exe
  C:\Windows\System\BspjiPp.exe
  2⤵
  PID:10836
- C:\Windows\System\JGzkBel.exe
  C:\Windows\System\JGzkBel.exe
  2⤵
  PID:10904
- C:\Windows\System\ZzaKaWn.exe
  C:\Windows\System\ZzaKaWn.exe
  2⤵
  PID:11048
- C:\Windows\System\XIlDPnd.exe
  C:\Windows\System\XIlDPnd.exe
  2⤵
  PID:11128
- C:\Windows\System\VIxrqNk.exe
  C:\Windows\System\VIxrqNk.exe
  2⤵
  PID:10580
- C:\Windows\System\zgqDSlX.exe
  C:\Windows\System\zgqDSlX.exe
  2⤵
  PID:10888
- C:\Windows\System\VIpIsqV.exe
  C:\Windows\System\VIpIsqV.exe
  2⤵
  PID:11124
- C:\Windows\System\XYXLCjZ.exe
  C:\Windows\System\XYXLCjZ.exe
  2⤵
  PID:10992
- C:\Windows\System\xRVszQN.exe
  C:\Windows\System\xRVszQN.exe
  2⤵
  PID:10336
- C:\Windows\System\JYyuAnh.exe
  C:\Windows\System\JYyuAnh.exe
  2⤵
  PID:11280
- C:\Windows\System\seOeayT.exe
  C:\Windows\System\seOeayT.exe
  2⤵
  PID:11300
- C:\Windows\System\fjCkryj.exe
  C:\Windows\System\fjCkryj.exe
  2⤵
  PID:11328
- C:\Windows\System\sqqdaaX.exe
  C:\Windows\System\sqqdaaX.exe
  2⤵
  PID:11368
- C:\Windows\System\PgYldxk.exe
  C:\Windows\System\PgYldxk.exe
  2⤵
  PID:11424
- C:\Windows\System\LYdwVVW.exe
  C:\Windows\System\LYdwVVW.exe
  2⤵
  PID:11440
- C:\Windows\System\EnLcEjD.exe
  C:\Windows\System\EnLcEjD.exe
  2⤵
  PID:11496
- C:\Windows\System\cajtyXH.exe
  C:\Windows\System\cajtyXH.exe
  2⤵
  PID:11512
- C:\Windows\System\FQACRWT.exe
  C:\Windows\System\FQACRWT.exe
  2⤵
  PID:11532
- C:\Windows\System\AhZkIFN.exe
  C:\Windows\System\AhZkIFN.exe
  2⤵
  PID:11556
- C:\Windows\System\rKJoGwu.exe
  C:\Windows\System\rKJoGwu.exe
  2⤵
  PID:11572
- C:\Windows\System\qmsvwro.exe
  C:\Windows\System\qmsvwro.exe
  2⤵
  PID:11628
- C:\Windows\System\cdMXXMZ.exe
  C:\Windows\System\cdMXXMZ.exe
  2⤵
  PID:11656
- C:\Windows\System\Klbsoea.exe
  C:\Windows\System\Klbsoea.exe
  2⤵
  PID:11672
- C:\Windows\System\nsLLezY.exe
  C:\Windows\System\nsLLezY.exe
  2⤵
  PID:11688
- C:\Windows\System\GvsYatE.exe
  C:\Windows\System\GvsYatE.exe
  2⤵
  PID:11740
- C:\Windows\System\UovARHU.exe
  C:\Windows\System\UovARHU.exe
  2⤵
  PID:11768
- C:\Windows\System\gVYHSeB.exe
  C:\Windows\System\gVYHSeB.exe
  2⤵
  PID:11784
- C:\Windows\System\NsyimmC.exe
  C:\Windows\System\NsyimmC.exe
  2⤵
  PID:11824
- C:\Windows\System\lWAiUJG.exe
  C:\Windows\System\lWAiUJG.exe
  2⤵
  PID:11852
- C:\Windows\System\khAqPJR.exe
  C:\Windows\System\khAqPJR.exe
  2⤵
  PID:11872
- C:\Windows\System\CWkCOPH.exe
  C:\Windows\System\CWkCOPH.exe
  2⤵
  PID:11896
- C:\Windows\System\sncYObU.exe
  C:\Windows\System\sncYObU.exe
  2⤵
  PID:11924
- C:\Windows\System\twWDgyT.exe
  C:\Windows\System\twWDgyT.exe
  2⤵
  PID:11952
- C:\Windows\System\phbIgnT.exe
  C:\Windows\System\phbIgnT.exe
  2⤵
  PID:11980
- C:\Windows\System\NZOIRsB.exe
  C:\Windows\System\NZOIRsB.exe
  2⤵
  PID:12012
- C:\Windows\System\hVGStVD.exe
  C:\Windows\System\hVGStVD.exe
  2⤵
  PID:12036
- C:\Windows\System\hEVomJL.exe
  C:\Windows\System\hEVomJL.exe
  2⤵
  PID:12100
- C:\Windows\System\iBMGwLT.exe
  C:\Windows\System\iBMGwLT.exe
  2⤵
  PID:12116
- C:\Windows\System\rYAfdFz.exe
  C:\Windows\System\rYAfdFz.exe
  2⤵
  PID:12136
- C:\Windows\System\SpPxbgS.exe
  C:\Windows\System\SpPxbgS.exe
  2⤵
  PID:12164
- C:\Windows\System\tmGBNkT.exe
  C:\Windows\System\tmGBNkT.exe
  2⤵
  PID:12192
- C:\Windows\System\kwhnavX.exe
  C:\Windows\System\kwhnavX.exe
  2⤵
  PID:12216
- C:\Windows\System\sOmVRDL.exe
  C:\Windows\System\sOmVRDL.exe
  2⤵
  PID:12232
- C:\Windows\System\aKnEdqF.exe
  C:\Windows\System\aKnEdqF.exe
  2⤵
  PID:12256
- C:\Windows\System\RODGnUS.exe
  C:\Windows\System\RODGnUS.exe
  2⤵
  PID:12272
- C:\Windows\System\ebKszUI.exe
  C:\Windows\System\ebKszUI.exe
  2⤵
  PID:10552
- C:\Windows\System\vsdbtPH.exe
  C:\Windows\System\vsdbtPH.exe
  2⤵
  PID:11388
- C:\Windows\System\QuUaGvX.exe
  C:\Windows\System\QuUaGvX.exe
  2⤵
  PID:11432
- C:\Windows\System\egIUsQH.exe
  C:\Windows\System\egIUsQH.exe
  2⤵
  PID:11472
- C:\Windows\System\ogNuflV.exe
  C:\Windows\System\ogNuflV.exe
  2⤵
  PID:11544
- C:\Windows\System\wsHUkTA.exe
  C:\Windows\System\wsHUkTA.exe
  2⤵
  PID:11612
- C:\Windows\System\tRTxNpY.exe
  C:\Windows\System\tRTxNpY.exe
  2⤵
  PID:11736
- C:\Windows\System\piYFFDs.exe
  C:\Windows\System\piYFFDs.exe
  2⤵
  PID:11836
- C:\Windows\System\vOviyqp.exe
  C:\Windows\System\vOviyqp.exe
  2⤵
  PID:11848
- C:\Windows\System\xWCLaOQ.exe
  C:\Windows\System\xWCLaOQ.exe
  2⤵
  PID:11992
- C:\Windows\System\WmJrkAL.exe
  C:\Windows\System\WmJrkAL.exe
  2⤵
  PID:4456
- C:\Windows\System\dytuJag.exe
  C:\Windows\System\dytuJag.exe
  2⤵
  PID:12084
- C:\Windows\System\mHHqrzm.exe
  C:\Windows\System\mHHqrzm.exe
  2⤵
  PID:12112
- C:\Windows\System\nfZiChV.exe
  C:\Windows\System\nfZiChV.exe
  2⤵
  PID:12188
- C:\Windows\System\Vbjtial.exe
  C:\Windows\System\Vbjtial.exe
  2⤵
  PID:12228
- C:\Windows\System\TdppwPI.exe
  C:\Windows\System\TdppwPI.exe
  2⤵
  PID:11364
- C:\Windows\System\GkuxJRy.exe
  C:\Windows\System\GkuxJRy.exe
  2⤵
  PID:11524
- C:\Windows\System\lSIhKKd.exe
  C:\Windows\System\lSIhKKd.exe
  2⤵
  PID:11564
- C:\Windows\System\mJEoTkP.exe
  C:\Windows\System\mJEoTkP.exe
  2⤵
  PID:11776
- C:\Windows\System\bfSBcbG.exe
  C:\Windows\System\bfSBcbG.exe
  2⤵
  PID:11868
- C:\Windows\System\gwyjeQi.exe
  C:\Windows\System\gwyjeQi.exe
  2⤵
  PID:12064
- C:\Windows\System\EDNBuaN.exe
  C:\Windows\System\EDNBuaN.exe
  2⤵
  PID:12176
- C:\Windows\System\LOfEhPg.exe
  C:\Windows\System\LOfEhPg.exe
  2⤵
  PID:11452
- C:\Windows\System\cBLwIyn.exe
  C:\Windows\System\cBLwIyn.exe
  2⤵
  PID:11720
- C:\Windows\System\VLQtKGb.exe
  C:\Windows\System\VLQtKGb.exe
  2⤵
  PID:12052
- C:\Windows\System\bFvysRR.exe
  C:\Windows\System\bFvysRR.exe
  2⤵
  PID:11484
- C:\Windows\System\YfNuxeh.exe
  C:\Windows\System\YfNuxeh.exe
  2⤵
  PID:2324
- C:\Windows\System\RffMtEq.exe
  C:\Windows\System\RffMtEq.exe
  2⤵
  PID:12304
- C:\Windows\System\CQzngcj.exe
  C:\Windows\System\CQzngcj.exe
  2⤵
  PID:12344
- C:\Windows\System\VNzrxsy.exe
  C:\Windows\System\VNzrxsy.exe
  2⤵
  PID:12360
- C:\Windows\System\plUeRKK.exe
  C:\Windows\System\plUeRKK.exe
  2⤵
  PID:12388
- C:\Windows\System\NrJBCAj.exe
  C:\Windows\System\NrJBCAj.exe
  2⤵
  PID:12408
- C:\Windows\System\IbvdFuR.exe
  C:\Windows\System\IbvdFuR.exe
  2⤵
  PID:12428
- C:\Windows\System\jzTlsFG.exe
  C:\Windows\System\jzTlsFG.exe
  2⤵
  PID:12460
- C:\Windows\System\hvWbkLT.exe
  C:\Windows\System\hvWbkLT.exe
  2⤵
  PID:12484
- C:\Windows\System\tsxKmXr.exe
  C:\Windows\System\tsxKmXr.exe
  2⤵
  PID:12500
- C:\Windows\System\ONmFbpd.exe
  C:\Windows\System\ONmFbpd.exe
  2⤵
  PID:12528
- C:\Windows\System\FmpGrMb.exe
  C:\Windows\System\FmpGrMb.exe
  2⤵
  PID:12548
- C:\Windows\System\WOKDBwy.exe
  C:\Windows\System\WOKDBwy.exe
  2⤵
  PID:12584
- C:\Windows\System\lMJJUqS.exe
  C:\Windows\System\lMJJUqS.exe
  2⤵
  PID:12604
- C:\Windows\System\lScDTMq.exe
  C:\Windows\System\lScDTMq.exe
  2⤵
  PID:12628
- C:\Windows\System\kiZBaZV.exe
  C:\Windows\System\kiZBaZV.exe
  2⤵
  PID:12648
- C:\Windows\System\qCXNFFB.exe
  C:\Windows\System\qCXNFFB.exe
  2⤵
  PID:12668
- C:\Windows\System\PKIoYSV.exe
  C:\Windows\System\PKIoYSV.exe
  2⤵
  PID:12748
- C:\Windows\System\VBASIec.exe
  C:\Windows\System\VBASIec.exe
  2⤵
  PID:12812
- C:\Windows\System\dGyqYfk.exe
  C:\Windows\System\dGyqYfk.exe
  2⤵
  PID:12832
- C:\Windows\System\WnaFRIm.exe
  C:\Windows\System\WnaFRIm.exe
  2⤵
  PID:12848
- C:\Windows\System\SEsPERu.exe
  C:\Windows\System\SEsPERu.exe
  2⤵
  PID:12872
- C:\Windows\System\QjvophP.exe
  C:\Windows\System\QjvophP.exe
  2⤵
  PID:12888
- C:\Windows\System\unukLXM.exe
  C:\Windows\System\unukLXM.exe
  2⤵
  PID:12916
- C:\Windows\System\PZYZWWo.exe
  C:\Windows\System\PZYZWWo.exe
  2⤵
  PID:12964
- C:\Windows\System\cEWdGwz.exe
  C:\Windows\System\cEWdGwz.exe
  2⤵
  PID:12988
- C:\Windows\System\fFWRBBd.exe
  C:\Windows\System\fFWRBBd.exe
  2⤵
  PID:13016
- C:\Windows\System\YOeVEyB.exe
  C:\Windows\System\YOeVEyB.exe
  2⤵
  PID:13240
- C:\Windows\System\BLglZni.exe
  C:\Windows\System\BLglZni.exe
  2⤵
  PID:13252
- C:\Windows\System\zeNHRwP.exe
  C:\Windows\System\zeNHRwP.exe
  2⤵
  PID:13268
- C:\Windows\System\eWUXLcF.exe
  C:\Windows\System\eWUXLcF.exe
  2⤵
  PID:13300
- C:\Windows\System\AeqJGtk.exe
  C:\Windows\System\AeqJGtk.exe
  2⤵
  PID:11308
- C:\Windows\System\rlpVmei.exe
  C:\Windows\System\rlpVmei.exe
  2⤵
  PID:11800
- C:\Windows\System\nRnTySl.exe
  C:\Windows\System\nRnTySl.exe
  2⤵
  PID:12368
- C:\Windows\System\cDFoUnn.exe
  C:\Windows\System\cDFoUnn.exe
  2⤵
  PID:12400
- C:\Windows\System\rQYYtSl.exe
  C:\Windows\System\rQYYtSl.exe
  2⤵
  PID:3244
- C:\Windows\System\mwqAUpi.exe
  C:\Windows\System\mwqAUpi.exe
  2⤵
  PID:12456
- C:\Windows\System\FaJwQaJ.exe
  C:\Windows\System\FaJwQaJ.exe
  2⤵
  PID:4324
- C:\Windows\System\IHxNMLx.exe
  C:\Windows\System\IHxNMLx.exe
  2⤵
  PID:12740
- C:\Windows\System\Ythrffi.exe
  C:\Windows\System\Ythrffi.exe
  2⤵
  PID:6204
- C:\Windows\System\QFhGUjO.exe
  C:\Windows\System\QFhGUjO.exe
  2⤵
  PID:12800
- C:\Windows\System\DxlOKQE.exe
  C:\Windows\System\DxlOKQE.exe
  2⤵
  PID:12840
- C:\Windows\System\FuRGibt.exe
  C:\Windows\System\FuRGibt.exe
  2⤵
  PID:12868
- C:\Windows\System\OLQdhze.exe
  C:\Windows\System\OLQdhze.exe
  2⤵
  PID:12884
- C:\Windows\System\jCqIskd.exe
  C:\Windows\System\jCqIskd.exe
  2⤵
  PID:12944
- C:\Windows\System\SHKaaox.exe
  C:\Windows\System\SHKaaox.exe
  2⤵
  PID:12956
- C:\Windows\System\yAAIhcw.exe
  C:\Windows\System\yAAIhcw.exe
  2⤵
  PID:13148
- C:\Windows\System\kcLNimf.exe
  C:\Windows\System\kcLNimf.exe
  2⤵
  PID:13144
- C:\Windows\System\FQyeStw.exe
  C:\Windows\System\FQyeStw.exe
  2⤵
  PID:13168
- C:\Windows\System\yyTzKjY.exe
  C:\Windows\System\yyTzKjY.exe
  2⤵
  PID:13204
- C:\Windows\System\OLDxnxU.exe
  C:\Windows\System\OLDxnxU.exe
  2⤵
  PID:13208
- C:\Windows\System\iWOCwZp.exe
  C:\Windows\System\iWOCwZp.exe
  2⤵
  PID:12376
- C:\Windows\System\SPzrvOo.exe
  C:\Windows\System\SPzrvOo.exe
  2⤵
  PID:6200
- C:\Windows\System\YiJaiIj.exe
  C:\Windows\System\YiJaiIj.exe
  2⤵
  PID:12572
- C:\Windows\System\vfOpfcH.exe
  C:\Windows\System\vfOpfcH.exe
  2⤵
  PID:8116
- C:\Windows\System\bvNhbzK.exe
  C:\Windows\System\bvNhbzK.exe
  2⤵
  PID:12508
- C:\Windows\System\ANUCWob.exe
  C:\Windows\System\ANUCWob.exe
  2⤵
  PID:5472
- C:\Windows\System\hQAQXDP.exe
  C:\Windows\System\hQAQXDP.exe
  2⤵
  PID:12860
- C:\Windows\System\hKQIytD.exe
  C:\Windows\System\hKQIytD.exe
  2⤵
  PID:12940
- C:\Windows\System\bWHmgRO.exe
  C:\Windows\System\bWHmgRO.exe
  2⤵
  PID:13036
- C:\Windows\System\getmBpc.exe
  C:\Windows\System\getmBpc.exe
  2⤵
  PID:13028
- C:\Windows\System\kfVTdaW.exe
  C:\Windows\System\kfVTdaW.exe
  2⤵
  PID:13040
- C:\Windows\System\qpmsMTN.exe
  C:\Windows\System\qpmsMTN.exe
  2⤵
  PID:13096
- C:\Windows\System\pUrGRYp.exe
  C:\Windows\System\pUrGRYp.exe
  2⤵
  PID:13104
- C:\Windows\System\GzrBKyA.exe
  C:\Windows\System\GzrBKyA.exe
  2⤵
  PID:12788
- C:\Windows\System\zQWOyBJ.exe
  C:\Windows\System\zQWOyBJ.exe
  2⤵
  PID:13160
- C:\Windows\System\dxMRPRL.exe
  C:\Windows\System\dxMRPRL.exe
  2⤵
  PID:13184
- C:\Windows\System\SCrflTy.exe
  C:\Windows\System\SCrflTy.exe
  2⤵
  PID:13216
- C:\Windows\System\DXpcfew.exe
  C:\Windows\System\DXpcfew.exe
  2⤵
  PID:13264
- C:\Windows\System\GJGfGiQ.exe
  C:\Windows\System\GJGfGiQ.exe
  2⤵
  PID:12324
- C:\Windows\System\dCCPwKl.exe
  C:\Windows\System\dCCPwKl.exe
  2⤵
  PID:12340
- C:\Windows\System\gVykORH.exe
  C:\Windows\System\gVykORH.exe
  2⤵
  PID:4556
- C:\Windows\System\QREJwnv.exe
  C:\Windows\System\QREJwnv.exe
  2⤵
  PID:3820
- C:\Windows\System\itYedWz.exe
  C:\Windows\System\itYedWz.exe
  2⤵
  PID:13164
- C:\Windows\System\NHxfwJI.exe
  C:\Windows\System\NHxfwJI.exe
  2⤵
  PID:12536
- C:\Windows\System\qUjqVnW.exe
  C:\Windows\System\qUjqVnW.exe
  2⤵
  PID:12640
- C:\Windows\System\nvcibga.exe
  C:\Windows\System\nvcibga.exe
  2⤵
  PID:5408
- C:\Windows\System\ENBGKIg.exe
  C:\Windows\System\ENBGKIg.exe
  2⤵
  PID:3536
- C:\Windows\System\YAzupJc.exe
  C:\Windows\System\YAzupJc.exe
  2⤵
  PID:6196
- C:\Windows\System\bLjbrDA.exe
  C:\Windows\System\bLjbrDA.exe
  2⤵
  PID:12712
- C:\Windows\System\SqxgQMD.exe
  C:\Windows\System\SqxgQMD.exe
  2⤵
  PID:12744
- C:\Windows\System\SInVZkg.exe
  C:\Windows\System\SInVZkg.exe
  2⤵
  PID:12900
- C:\Windows\System\JanZItO.exe
  C:\Windows\System\JanZItO.exe
  2⤵
  PID:13000
- C:\Windows\System\NzKpYVN.exe
  C:\Windows\System\NzKpYVN.exe
  2⤵
  PID:13052
- C:\Windows\System\xrxYKKi.exe
  C:\Windows\System\xrxYKKi.exe
  2⤵
  PID:13112
- C:\Windows\System\Rlxaige.exe
  C:\Windows\System\Rlxaige.exe
  2⤵
  PID:5760
- C:\Windows\System\BotfOvY.exe
  C:\Windows\System\BotfOvY.exe
  2⤵
  PID:3472
- C:\Windows\System\gEVCRJG.exe
  C:\Windows\System\gEVCRJG.exe
  2⤵
  PID:5820
- C:\Windows\System\dYCRJxD.exe
  C:\Windows\System\dYCRJxD.exe
  2⤵
  PID:13308
- C:\Windows\System\vHGLyFv.exe
  C:\Windows\System\vHGLyFv.exe
  2⤵
  PID:1132
- C:\Windows\System\UXmDhbr.exe
  C:\Windows\System\UXmDhbr.exe
  2⤵
  PID:3156
- C:\Windows\System\vbWYLAO.exe
  C:\Windows\System\vbWYLAO.exe
  2⤵
  PID:3928
- C:\Windows\System\XzDbblT.exe
  C:\Windows\System\XzDbblT.exe
  2⤵
  PID:12664
- C:\Windows\System\TmKVgvE.exe
  C:\Windows\System\TmKVgvE.exe
  2⤵
  PID:13084
- C:\Windows\System\veskcRh.exe
  C:\Windows\System\veskcRh.exe
  2⤵
  PID:2996
- C:\Windows\System\BWgxdrV.exe
  C:\Windows\System\BWgxdrV.exe
  2⤵
  PID:5004
- C:\Windows\System\cnntzAM.exe
  C:\Windows\System\cnntzAM.exe
  2⤵
  PID:4572
- C:\Windows\System\hkbPBgD.exe
  C:\Windows\System\hkbPBgD.exe
  2⤵
  PID:12440
- C:\Windows\System\UZguCij.exe
  C:\Windows\System\UZguCij.exe
  2⤵
  PID:12820
- C:\Windows\System\LmLPePu.exe
  C:\Windows\System\LmLPePu.exe
  2⤵
  PID:13048
- C:\Windows\System\xbEQnXo.exe
  C:\Windows\System\xbEQnXo.exe
  2⤵
  PID:2112
- C:\Windows\System\OZhSbyG.exe
  C:\Windows\System\OZhSbyG.exe
  2⤵
  PID:5904
- C:\Windows\System\jVgYKgl.exe
  C:\Windows\System\jVgYKgl.exe
  2⤵
  PID:5996
- C:\Windows\System\qamNbRH.exe
  C:\Windows\System\qamNbRH.exe
  2⤵
  PID:2124
- C:\Windows\System\APlhQUf.exe
  C:\Windows\System\APlhQUf.exe
  2⤵
  PID:5688
- C:\Windows\System\tumAwoj.exe
  C:\Windows\System\tumAwoj.exe
  2⤵
  PID:13136
- C:\Windows\System\bNCHEmT.exe
  C:\Windows\System\bNCHEmT.exe
  2⤵
  PID:6068
- C:\Windows\System\OvDEjyR.exe
  C:\Windows\System\OvDEjyR.exe
  2⤵
  PID:5112
- C:\Windows\System\ikimLgA.exe
  C:\Windows\System\ikimLgA.exe
  2⤵
  PID:11664
- C:\Windows\System\tQFxVnJ.exe
  C:\Windows\System\tQFxVnJ.exe
  2⤵
  PID:2620
- C:\Windows\System\WepgJKI.exe
  C:\Windows\System\WepgJKI.exe
  2⤵
  PID:456
- C:\Windows\System\XiMYJUw.exe
  C:\Windows\System\XiMYJUw.exe
  2⤵
  PID:13124
- C:\Windows\System\XSkGaII.exe
  C:\Windows\System\XSkGaII.exe
  2⤵
  PID:12688
- C:\Windows\System\knbeKDZ.exe
  C:\Windows\System\knbeKDZ.exe
  2⤵
  PID:6552
- C:\Windows\System\YUILqWv.exe
  C:\Windows\System\YUILqWv.exe
  2⤵
  PID:12828
- C:\Windows\System\YpAVKMf.exe
  C:\Windows\System\YpAVKMf.exe
  2⤵
  PID:3824
- C:\Windows\System\phGyPmv.exe
  C:\Windows\System\phGyPmv.exe
  2⤵
  PID:5908
- C:\Windows\System\LITCcIw.exe
  C:\Windows\System\LITCcIw.exe
  2⤵
  PID:3980
- C:\Windows\System\ZvmbPjQ.exe
  C:\Windows\System\ZvmbPjQ.exe
  2⤵
  PID:4012
- C:\Windows\System\rIJGJBl.exe
  C:\Windows\System\rIJGJBl.exe
  2⤵
  PID:13140
- C:\Windows\System\LLuyGVO.exe
  C:\Windows\System\LLuyGVO.exe
  2⤵
  PID:12356
- C:\Windows\System\BvWMZbI.exe
  C:\Windows\System\BvWMZbI.exe
  2⤵
  PID:1576
- C:\Windows\System\JsroSoF.exe
  C:\Windows\System\JsroSoF.exe
  2⤵
  PID:1740
- C:\Windows\System\bSKOLCZ.exe
  C:\Windows\System\bSKOLCZ.exe
  2⤵
  PID:13012
- C:\Windows\System\RGXFtxv.exe
  C:\Windows\System\RGXFtxv.exe
  2⤵
  PID:3272
- C:\Windows\System\vazghYy.exe
  C:\Windows\System\vazghYy.exe
  2⤵
  PID:13060
- C:\Windows\System\ePRJoRR.exe
  C:\Windows\System\ePRJoRR.exe
  2⤵
  PID:13224
- C:\Windows\System\NHPitBI.exe
  C:\Windows\System\NHPitBI.exe
  2⤵
  PID:13120
- C:\Windows\System\OeMcFob.exe
  C:\Windows\System\OeMcFob.exe
  2⤵
  PID:13196
- C:\Windows\System\dvLQFbl.exe
  C:\Windows\System\dvLQFbl.exe
  2⤵
  PID:5728
- C:\Windows\System\sHYZUIn.exe
  C:\Windows\System\sHYZUIn.exe
  2⤵
  PID:4232
- C:\Windows\System\YtLSIcK.exe
  C:\Windows\System\YtLSIcK.exe
  2⤵
  PID:228
- C:\Windows\System\laoMzWx.exe
  C:\Windows\System\laoMzWx.exe
  2⤵
  PID:12520
- C:\Windows\System\wBQxcbp.exe
  C:\Windows\System\wBQxcbp.exe
  2⤵
  PID:6112
- C:\Windows\System\qGDFPzq.exe
  C:\Windows\System\qGDFPzq.exe
  2⤵
  PID:13100
- C:\Windows\System\sYPsBox.exe
  C:\Windows\System\sYPsBox.exe
  2⤵
  PID:13328
- C:\Windows\System\fomowxc.exe
  C:\Windows\System\fomowxc.exe
  2⤵
  PID:13344
- C:\Windows\System\jnAeSgj.exe
  C:\Windows\System\jnAeSgj.exe
  2⤵
  PID:13360
- C:\Windows\System\cmDhXre.exe
  C:\Windows\System\cmDhXre.exe
  2⤵
  PID:13376
- C:\Windows\System\VzGYvpj.exe
  C:\Windows\System\VzGYvpj.exe
  2⤵
  PID:13396
- C:\Windows\System\jLilOad.exe
  C:\Windows\System\jLilOad.exe
  2⤵
  PID:13412
- C:\Windows\System\HXypyHN.exe
  C:\Windows\System\HXypyHN.exe
  2⤵
  PID:13428
- C:\Windows\System\IHcFuCm.exe
  C:\Windows\System\IHcFuCm.exe
  2⤵
  PID:13444
- C:\Windows\System\WKIFDrN.exe
  C:\Windows\System\WKIFDrN.exe
  2⤵
  PID:13460
- C:\Windows\System\CruafrE.exe
  C:\Windows\System\CruafrE.exe
  2⤵
  PID:13476
- C:\Windows\System\OPUUbhE.exe
  C:\Windows\System\OPUUbhE.exe
  2⤵
  PID:13492
- C:\Windows\System\cKnYNKz.exe
  C:\Windows\System\cKnYNKz.exe
  2⤵
  PID:13508
- C:\Windows\System\dHlayWV.exe
  C:\Windows\System\dHlayWV.exe
  2⤵
  PID:13524
- C:\Windows\System\lZEMITO.exe
  C:\Windows\System\lZEMITO.exe
  2⤵
  PID:13540
- C:\Windows\System\ukYrAPV.exe
  C:\Windows\System\ukYrAPV.exe
  2⤵
  PID:13556
- C:\Windows\System\jeDrGdz.exe
  C:\Windows\System\jeDrGdz.exe
  2⤵
  PID:13572
- C:\Windows\System\MLjKAzk.exe
  C:\Windows\System\MLjKAzk.exe
  2⤵
  PID:13588
- C:\Windows\System\SwgCwUE.exe
  C:\Windows\System\SwgCwUE.exe
  2⤵
  PID:13604
- C:\Windows\System\XarDKGM.exe
  C:\Windows\System\XarDKGM.exe
  2⤵
  PID:13620
- C:\Windows\System\PeiBpnH.exe
  C:\Windows\System\PeiBpnH.exe
  2⤵
  PID:13636
- C:\Windows\System\vyswHJa.exe
  C:\Windows\System\vyswHJa.exe
  2⤵
  PID:13652
- C:\Windows\System\PqbBrgY.exe
  C:\Windows\System\PqbBrgY.exe
  2⤵
  PID:13668
- C:\Windows\System\SkOVWBg.exe
  C:\Windows\System\SkOVWBg.exe
  2⤵
  PID:13684
- C:\Windows\System\pdjHjXC.exe
  C:\Windows\System\pdjHjXC.exe
  2⤵
  PID:13700
- C:\Windows\System\xFwanxK.exe
  C:\Windows\System\xFwanxK.exe
  2⤵
  PID:13716
- C:\Windows\System\oMPwjqY.exe
  C:\Windows\System\oMPwjqY.exe
  2⤵
  PID:13732
- C:\Windows\System\WBSQopD.exe
  C:\Windows\System\WBSQopD.exe
  2⤵
  PID:13748
- C:\Windows\System\jujmxub.exe
  C:\Windows\System\jujmxub.exe
  2⤵
  PID:13764
- C:\Windows\System\rODzcSU.exe
  C:\Windows\System\rODzcSU.exe
  2⤵
  PID:13780
- C:\Windows\System\JGkJBYK.exe
  C:\Windows\System\JGkJBYK.exe
  2⤵
  PID:13796
- C:\Windows\System\tbAaQtp.exe
  C:\Windows\System\tbAaQtp.exe
  2⤵
  PID:13812
- C:\Windows\System\sYKMNRx.exe
  C:\Windows\System\sYKMNRx.exe
  2⤵
  PID:13828
- C:\Windows\System\GXJoDrA.exe
  C:\Windows\System\GXJoDrA.exe
  2⤵
  PID:13844
- C:\Windows\System\dfUBoIm.exe
  C:\Windows\System\dfUBoIm.exe
  2⤵
  PID:13860
- C:\Windows\System\HACQHHU.exe
  C:\Windows\System\HACQHHU.exe
  2⤵
  PID:13884
- C:\Windows\System\QywrOmX.exe
  C:\Windows\System\QywrOmX.exe
  2⤵
  PID:13904
- C:\Windows\System\ykxTiEd.exe
  C:\Windows\System\ykxTiEd.exe
  2⤵
  PID:13920
- C:\Windows\System\OChAjJm.exe
  C:\Windows\System\OChAjJm.exe
  2⤵
  PID:13936
- C:\Windows\System\spNkvSm.exe
  C:\Windows\System\spNkvSm.exe
  2⤵
  PID:13952
- C:\Windows\System\fdJEAQC.exe
  C:\Windows\System\fdJEAQC.exe
  2⤵
  PID:13968
- C:\Windows\System\ESIKjJu.exe
  C:\Windows\System\ESIKjJu.exe
  2⤵
  PID:13984
- C:\Windows\System\zOAsDbU.exe
  C:\Windows\System\zOAsDbU.exe
  2⤵
  PID:14000
- C:\Windows\System\IwpHdyZ.exe
  C:\Windows\System\IwpHdyZ.exe
  2⤵
  PID:14016
- C:\Windows\System\jcTJojc.exe
  C:\Windows\System\jcTJojc.exe
  2⤵
  PID:14032
- C:\Windows\System\XOIDvnp.exe
  C:\Windows\System\XOIDvnp.exe
  2⤵
  PID:14048
- C:\Windows\System\LPEfXVI.exe
  C:\Windows\System\LPEfXVI.exe
  2⤵
  PID:14064
- C:\Windows\System\TJoxVhV.exe
  C:\Windows\System\TJoxVhV.exe
  2⤵
  PID:14080
- C:\Windows\System\qkXSoAP.exe
  C:\Windows\System\qkXSoAP.exe
  2⤵
  PID:14096
- C:\Windows\System\aZQxMKC.exe
  C:\Windows\System\aZQxMKC.exe
  2⤵
  PID:14112
- C:\Windows\System\qoRogGN.exe
  C:\Windows\System\qoRogGN.exe
  2⤵
  PID:14128
- C:\Windows\System\aiPBBGr.exe
  C:\Windows\System\aiPBBGr.exe
  2⤵
  PID:14144
- C:\Windows\System\GFTgBCj.exe
  C:\Windows\System\GFTgBCj.exe
  2⤵
  PID:14160
- C:\Windows\System\ogSqsbg.exe
  C:\Windows\System\ogSqsbg.exe
  2⤵
  PID:14176
- C:\Windows\System\ZSMJlnz.exe
  C:\Windows\System\ZSMJlnz.exe
  2⤵
  PID:14192
- C:\Windows\System\HTtAlyJ.exe
  C:\Windows\System\HTtAlyJ.exe
  2⤵
  PID:14208
- C:\Windows\System\NmQYVNv.exe
  C:\Windows\System\NmQYVNv.exe
  2⤵
  PID:14224
- C:\Windows\System\DdvJukG.exe
  C:\Windows\System\DdvJukG.exe
  2⤵
  PID:14240
- C:\Windows\System\vjrrOyK.exe
  C:\Windows\System\vjrrOyK.exe
  2⤵
  PID:14256
- C:\Windows\System\RvDDmsz.exe
  C:\Windows\System\RvDDmsz.exe
  2⤵
  PID:14272
- C:\Windows\System\gLNosjq.exe
  C:\Windows\System\gLNosjq.exe
  2⤵
  PID:14288
- C:\Windows\System\uhbTxBa.exe
  C:\Windows\System\uhbTxBa.exe
  2⤵
  PID:14304
- C:\Windows\System\PWfOrkc.exe
  C:\Windows\System\PWfOrkc.exe
  2⤵
  PID:14324
- C:\Windows\System\GHoagol.exe
  C:\Windows\System\GHoagol.exe
  2⤵
  PID:13324
- C:\Windows\System\CCbkfKO.exe
  C:\Windows\System\CCbkfKO.exe
  2⤵
  PID:13356
- C:\Windows\System\QTAJNdQ.exe
  C:\Windows\System\QTAJNdQ.exe
  2⤵
  PID:13392
- C:\Windows\System\LcjeXwF.exe
  C:\Windows\System\LcjeXwF.exe
  2⤵
  PID:13424
- C:\Windows\System\aRgGLRF.exe
  C:\Windows\System\aRgGLRF.exe
  2⤵
  PID:13456
- C:\Windows\System\fYiPhys.exe
  C:\Windows\System\fYiPhys.exe
  2⤵
  PID:13488
- C:\Windows\System\VfDqEvn.exe
  C:\Windows\System\VfDqEvn.exe
  2⤵
  PID:13520
- C:\Windows\System\aITGOyO.exe
  C:\Windows\System\aITGOyO.exe
  2⤵
  PID:13552
- C:\Windows\System\mrCjJHl.exe
  C:\Windows\System\mrCjJHl.exe
  2⤵
  PID:13584
- C:\Windows\System\bWXFfSV.exe
  C:\Windows\System\bWXFfSV.exe
  2⤵
  PID:6052
- C:\Windows\System\YJcwjWv.exe
  C:\Windows\System\YJcwjWv.exe
  2⤵
  PID:13632
- C:\Windows\System\KyOgdyA.exe
  C:\Windows\System\KyOgdyA.exe
  2⤵
  PID:13660
- C:\Windows\System\tnIUvTr.exe
  C:\Windows\System\tnIUvTr.exe
  2⤵
  PID:13692
- C:\Windows\System\XVBedun.exe
  C:\Windows\System\XVBedun.exe
  2⤵
  PID:13724
- C:\Windows\System\apFBKbN.exe
  C:\Windows\System\apFBKbN.exe
  2⤵
  PID:6160
- C:\Windows\System\tDmQnXI.exe
  C:\Windows\System\tDmQnXI.exe
  2⤵
  PID:13776
- C:\Windows\System\VqmshSw.exe
  C:\Windows\System\VqmshSw.exe
  2⤵
  PID:6216
- C:\Windows\System\rMdUPRp.exe
  C:\Windows\System\rMdUPRp.exe
  2⤵
  PID:13808
- C:\Windows\System\JuATDqH.exe
  C:\Windows\System\JuATDqH.exe
  2⤵
  PID:13840
- C:\Windows\System\UFMySLx.exe
  C:\Windows\System\UFMySLx.exe
  2⤵
  PID:13856
- C:\Windows\System\iNwFwuP.exe
  C:\Windows\System\iNwFwuP.exe
  2⤵
  PID:13872
- C:\Windows\System\WEmCzAm.exe
  C:\Windows\System\WEmCzAm.exe
  2⤵
  PID:6388
- C:\Windows\System\ZffPheA.exe
  C:\Windows\System\ZffPheA.exe
  2⤵
  PID:13928
- C:\Windows\System\zgCfklL.exe
  C:\Windows\System\zgCfklL.exe
  2⤵
  PID:13960
- C:\Windows\System\OwQIiUb.exe
  C:\Windows\System\OwQIiUb.exe
  2⤵
  PID:13980
- C:\Windows\System\xnVibQE.exe
  C:\Windows\System\xnVibQE.exe
  2⤵
  PID:14012
- C:\Windows\System\pvvRqhA.exe
  C:\Windows\System\pvvRqhA.exe
  2⤵
  PID:14040
- C:\Windows\System\JEdCOcu.exe
  C:\Windows\System\JEdCOcu.exe
  2⤵
  PID:14072
- C:\Windows\System\yroadkT.exe
  C:\Windows\System\yroadkT.exe
  2⤵
  PID:14104
- C:\Windows\System\zZrlexS.exe
  C:\Windows\System\zZrlexS.exe
  2⤵
  PID:13384
- C:\Windows\System\wToyZpZ.exe
  C:\Windows\System\wToyZpZ.exe
  2⤵
  PID:14156
- C:\Windows\System\DaXLUjh.exe
  C:\Windows\System\DaXLUjh.exe
  2⤵
  PID:14184
- C:\Windows\System\OuYkPPL.exe
  C:\Windows\System\OuYkPPL.exe
  2⤵
  PID:14220
- C:\Windows\System\feIaWDf.exe
  C:\Windows\System\feIaWDf.exe
  2⤵
  PID:14248
- C:\Windows\System\NQQvHDW.exe
  C:\Windows\System\NQQvHDW.exe
  2⤵
  PID:6980
- C:\Windows\System\LciBSpR.exe
  C:\Windows\System\LciBSpR.exe
  2⤵
  PID:14300
- C:\Windows\System\EGOdHga.exe
  C:\Windows\System\EGOdHga.exe
  2⤵
  PID:13320
- C:\Windows\System\pZgxvPC.exe
  C:\Windows\System\pZgxvPC.exe
  2⤵
  PID:13388
- C:\Windows\System\mUtEAWF.exe
  C:\Windows\System\mUtEAWF.exe
  2⤵
  PID:13452
- C:\Windows\System\bIATPhp.exe
  C:\Windows\System\bIATPhp.exe
  2⤵
  PID:13516
- C:\Windows\System\rkHmMGK.exe
  C:\Windows\System\rkHmMGK.exe
  2⤵
  PID:13580
- C:\Windows\System\HVYQPsS.exe
  C:\Windows\System\HVYQPsS.exe
  2⤵
  PID:13628
- C:\Windows\System\btkSKRJ.exe
  C:\Windows\System\btkSKRJ.exe
  2⤵
  PID:13680
- C:\Windows\System\DMXFFqI.exe
  C:\Windows\System\DMXFFqI.exe
  2⤵
  PID:13744
- C:\Windows\System\uSbtlwq.exe
  C:\Windows\System\uSbtlwq.exe
  2⤵
  PID:6208
- C:\Windows\System\SasLZXw.exe
  C:\Windows\System\SasLZXw.exe
  2⤵
  PID:6572
- C:\Windows\System\WhNAiuj.exe
  C:\Windows\System\WhNAiuj.exe
  2⤵
  PID:13852
- C:\Windows\System\PmigMev.exe
  C:\Windows\System\PmigMev.exe
  2⤵
  PID:6340
- C:\Windows\System\wUOXRWV.exe
  C:\Windows\System\wUOXRWV.exe
  2⤵
  PID:6800
- C:\Windows\System\WAryFTj.exe
  C:\Windows\System\WAryFTj.exe
  2⤵
  PID:13916
- C:\Windows\System\HWjkToI.exe
  C:\Windows\System\HWjkToI.exe
  2⤵
  PID:13976
- C:\Windows\System\ejNupbv.exe
  C:\Windows\System\ejNupbv.exe
  2⤵
  PID:14028
- C:\Windows\System\fmzjhzT.exe
  C:\Windows\System\fmzjhzT.exe
  2⤵
  PID:14092
- C:\Windows\System\wXkOaZY.exe
  C:\Windows\System\wXkOaZY.exe
  2⤵
  PID:6892
- C:\Windows\System\JQFgYYP.exe
  C:\Windows\System\JQFgYYP.exe
  2⤵
  PID:14168
- C:\Windows\System\MmUHuHY.exe
  C:\Windows\System\MmUHuHY.exe
  2⤵
  PID:14204
- C:\Windows\System\zieCjVU.exe
  C:\Windows\System\zieCjVU.exe
  2⤵
  PID:14268
- C:\Windows\System\rMbsrXW.exe
  C:\Windows\System\rMbsrXW.exe
  2⤵
  PID:14332
- C:\Windows\System\XfeAryY.exe
  C:\Windows\System\XfeAryY.exe
  2⤵
  PID:13372
- C:\Windows\System\wSANvEB.exe
  C:\Windows\System\wSANvEB.exe
  2⤵
  PID:13504
- C:\Windows\System\ciXMOOj.exe
  C:\Windows\System\ciXMOOj.exe
  2⤵
  PID:13568
- C:\Windows\System\tloPbvx.exe
  C:\Windows\System\tloPbvx.exe
  2⤵
  PID:14312
- C:\Windows\System\iMaUdel.exe
  C:\Windows\System\iMaUdel.exe
  2⤵
  PID:13772
- C:\Windows\System\zRipwFo.exe
  C:\Windows\System\zRipwFo.exe
  2⤵
  PID:7012
- C:\Windows\System\hTxiOgR.exe
  C:\Windows\System\hTxiOgR.exe
  2⤵
  PID:13836
- C:\Windows\System\AHjxMQy.exe
  C:\Windows\System\AHjxMQy.exe
  2⤵
  PID:6784
- C:\Windows\System\taxDJlR.exe
  C:\Windows\System\taxDJlR.exe
  2⤵
  PID:13948
- C:\Windows\System\zjVvVvV.exe
  C:\Windows\System\zjVvVvV.exe
  2⤵
  PID:14060
- C:\Windows\System\MroziPg.exe
  C:\Windows\System\MroziPg.exe
  2⤵
  PID:14152
- C:\Windows\System\HRDvxBF.exe
  C:\Windows\System\HRDvxBF.exe
  2⤵
  PID:7272
- C:\Windows\System\eGizLNK.exe
  C:\Windows\System\eGizLNK.exe
  2⤵
  PID:14264
- C:\Windows\System\LoPICVo.exe
  C:\Windows\System\LoPICVo.exe
  2⤵
  PID:6320
- C:\Windows\System\ZEftHmt.exe
  C:\Windows\System\ZEftHmt.exe
  2⤵
  PID:7348
- C:\Windows\System\wdbitgi.exe
  C:\Windows\System\wdbitgi.exe
  2⤵
  PID:13616
- C:\Windows\System\EFsBVSX.exe
  C:\Windows\System\EFsBVSX.exe
  2⤵
  PID:13712
- C:\Windows\System\mcjcBGH.exe
  C:\Windows\System\mcjcBGH.exe
  2⤵
  PID:13804
- C:\Windows\System\DSskXEi.exe
  C:\Windows\System\DSskXEi.exe
  2⤵
  PID:7036
- C:\Windows\System\mGUHPmb.exe
  C:\Windows\System\mGUHPmb.exe
  2⤵
  PID:7556
- C:\Windows\System\HdzYMIE.exe
  C:\Windows\System\HdzYMIE.exe
  2⤵
  PID:13912
- C:\Windows\System\uiwrWVs.exe
  C:\Windows\System\uiwrWVs.exe
  2⤵
  PID:6556
- C:\Windows\System\syRkMwC.exe
  C:\Windows\System\syRkMwC.exe
  2⤵
  PID:7644
- C:\Windows\System\qvXndDs.exe
  C:\Windows\System\qvXndDs.exe
  2⤵
  PID:7684
- C:\Windows\System\aldFCol.exe
  C:\Windows\System\aldFCol.exe
  2⤵
  PID:14320
- C:\Windows\System\OChdKSV.exe
  C:\Windows\System\OChdKSV.exe
  2⤵
  PID:7756
- C:\Windows\System\IoJoacY.exe
  C:\Windows\System\IoJoacY.exe
  2⤵
  PID:4688
- C:\Windows\System\OYJPMpR.exe
  C:\Windows\System\OYJPMpR.exe
  2⤵
  PID:7860
- C:\Windows\System\qOIRuYb.exe
  C:\Windows\System\qOIRuYb.exe
  2⤵
  PID:7896
- C:\Windows\System\UCETNgz.exe
  C:\Windows\System\UCETNgz.exe
  2⤵
  PID:7904
- C:\Windows\System\zCjiWCa.exe
  C:\Windows\System\zCjiWCa.exe
  2⤵
  PID:6976
- C:\Windows\System\cpgyrws.exe
  C:\Windows\System\cpgyrws.exe
  2⤵
  PID:4512
- C:\Windows\System\fqmxVPj.exe
  C:\Windows\System\fqmxVPj.exe
  2⤵
  PID:7648
- C:\Windows\System\vakHwqN.exe
  C:\Windows\System\vakHwqN.exe
  2⤵
  PID:7512
- C:\Windows\System\ohOFSNi.exe
  C:\Windows\System\ohOFSNi.exe
  2⤵
  PID:14348
- C:\Windows\System\wWleiVF.exe
  C:\Windows\System\wWleiVF.exe
  2⤵
  PID:14364
- C:\Windows\System\CfsRIIK.exe
  C:\Windows\System\CfsRIIK.exe
  2⤵
  PID:14380
- C:\Windows\System\VtyTcFK.exe
  C:\Windows\System\VtyTcFK.exe
  2⤵
  PID:14396
- C:\Windows\System\bzvOZON.exe
  C:\Windows\System\bzvOZON.exe
  2⤵
  PID:14416
- C:\Windows\System\gZSdvgz.exe
  C:\Windows\System\gZSdvgz.exe
  2⤵
  PID:14436
- C:\Windows\System\CmHIAiJ.exe
  C:\Windows\System\CmHIAiJ.exe
  2⤵
  PID:14464
- C:\Windows\System\OcAsLHP.exe
  C:\Windows\System\OcAsLHP.exe
  2⤵
  PID:14484
- C:\Windows\System\zcWbjcv.exe
  C:\Windows\System\zcWbjcv.exe
  2⤵
  PID:14508
- C:\Windows\System\TbSffgR.exe
  C:\Windows\System\TbSffgR.exe
  2⤵
  PID:14540
- C:\Windows\System\rWqFNBc.exe
  C:\Windows\System\rWqFNBc.exe
  2⤵
  PID:14600
- C:\Windows\System\UzacIWe.exe
  C:\Windows\System\UzacIWe.exe
  2⤵
  PID:14624
- C:\Windows\System\rhDzOtV.exe
  C:\Windows\System\rhDzOtV.exe
  2⤵
  PID:14648
- C:\Windows\System\WEPSYfw.exe
  C:\Windows\System\WEPSYfw.exe
  2⤵
  PID:14672
- C:\Windows\System\EJMfCzu.exe
  C:\Windows\System\EJMfCzu.exe
  2⤵
  PID:14688
- C:\Windows\System\QZuhjtn.exe
  C:\Windows\System\QZuhjtn.exe
  2⤵
  PID:14724
- C:\Windows\System\XcZZRIV.exe
  C:\Windows\System\XcZZRIV.exe
  2⤵
  PID:14752
- C:\Windows\System\iJeDtYo.exe
  C:\Windows\System\iJeDtYo.exe
  2⤵
  PID:14768
- C:\Windows\System\eCcEIls.exe
  C:\Windows\System\eCcEIls.exe
  2⤵
  PID:14788
- C:\Windows\System\WEcXtFj.exe
  C:\Windows\System\WEcXtFj.exe
  2⤵
  PID:14820
- C:\Windows\System\RMSZEOp.exe
  C:\Windows\System\RMSZEOp.exe
  2⤵
  PID:14848
- C:\Windows\System\AVennwB.exe
  C:\Windows\System\AVennwB.exe
  2⤵
  PID:14892
- C:\Windows\System\ibddXJc.exe
  C:\Windows\System\ibddXJc.exe
  2⤵
  PID:14908
- C:\Windows\System\HooSxAZ.exe
  C:\Windows\System\HooSxAZ.exe
  2⤵
  PID:14924
- C:\Windows\System\GFczJGQ.exe
  C:\Windows\System\GFczJGQ.exe
  2⤵
  PID:14944
- C:\Windows\System\eIMsXER.exe
  C:\Windows\System\eIMsXER.exe
  2⤵
  PID:14964
- C:\Windows\System\PDkReyp.exe
  C:\Windows\System\PDkReyp.exe
  2⤵
  PID:14984
- C:\Windows\System\VvFlEhH.exe
  C:\Windows\System\VvFlEhH.exe
  2⤵
  PID:15004
- C:\Windows\System\NwUYvoj.exe
  C:\Windows\System\NwUYvoj.exe
  2⤵
  PID:15032
- C:\Windows\System\AGtluzX.exe
  C:\Windows\System\AGtluzX.exe
  2⤵
  PID:15048
- C:\Windows\System\LiscJFd.exe
  C:\Windows\System\LiscJFd.exe
  2⤵
  PID:15072
- C:\Windows\System\mzqleHb.exe
  C:\Windows\System\mzqleHb.exe
  2⤵
  PID:15088
- C:\Windows\System\ZWTWwig.exe
  C:\Windows\System\ZWTWwig.exe
  2⤵
  PID:15112
- C:\Windows\System\GphgQKI.exe
  C:\Windows\System\GphgQKI.exe
  2⤵
  PID:15128
- C:\Windows\System\hRCsDDI.exe
  C:\Windows\System\hRCsDDI.exe
  2⤵
  PID:15144
- C:\Windows\System\VVZReXB.exe
  C:\Windows\System\VVZReXB.exe
  2⤵
  PID:15164
- C:\Windows\System\ciMRfBF.exe
  C:\Windows\System\ciMRfBF.exe
  2⤵
  PID:15184
- C:\Windows\System\JAyeFMh.exe
  C:\Windows\System\JAyeFMh.exe
  2⤵
  PID:15204
- C:\Windows\System\CCGeCyz.exe
  C:\Windows\System\CCGeCyz.exe
  2⤵
  PID:15220
- C:\Windows\System\MLZwtTt.exe
  C:\Windows\System\MLZwtTt.exe
  2⤵
  PID:15236
- C:\Windows\System\JRTOYPd.exe
  C:\Windows\System\JRTOYPd.exe
  2⤵
  PID:15256
- C:\Windows\System\LrGPoIa.exe
  C:\Windows\System\LrGPoIa.exe
  2⤵
  PID:15272
- C:\Windows\System\PvmQpce.exe
  C:\Windows\System\PvmQpce.exe
  2⤵
  PID:15292
- C:\Windows\System\aQcfTtb.exe
  C:\Windows\System\aQcfTtb.exe
  2⤵
  PID:15308
- C:\Windows\System\RgtOnak.exe
  C:\Windows\System\RgtOnak.exe
  2⤵
  PID:15324
- C:\Windows\System\odKQQjw.exe
  C:\Windows\System\odKQQjw.exe
  2⤵
  PID:15340
- C:\Windows\System\ftsCWtF.exe
  C:\Windows\System\ftsCWtF.exe
  2⤵
  PID:2204
- C:\Windows\System\cvhwHhL.exe
  C:\Windows\System\cvhwHhL.exe
  2⤵
  PID:712
- C:\Windows\System\baTyjvg.exe
  C:\Windows\System\baTyjvg.exe
  2⤵
  PID:14296
- C:\Windows\System\DsBnYPm.exe
  C:\Windows\System\DsBnYPm.exe
  2⤵
  PID:7480
- C:\Windows\System\hYTCxJj.exe
  C:\Windows\System\hYTCxJj.exe
  2⤵
  PID:13440
- C:\Windows\System\CRdmKVJ.exe
  C:\Windows\System\CRdmKVJ.exe
  2⤵
  PID:6596
- C:\Windows\System\PQVSGPU.exe
  C:\Windows\System\PQVSGPU.exe
  2⤵
  PID:7716
- C:\Windows\System\EKAfcTF.exe
  C:\Windows\System\EKAfcTF.exe
  2⤵
  PID:13892
- C:\Windows\System\lZdtiEr.exe
  C:\Windows\System\lZdtiEr.exe
  2⤵
  PID:8060
- C:\Windows\System\xEwIBhp.exe
  C:\Windows\System\xEwIBhp.exe
  2⤵
  PID:14356
- C:\Windows\System\YsJIdMX.exe
  C:\Windows\System\YsJIdMX.exe
  2⤵
  PID:2172
- C:\Windows\System\fRhufuo.exe
  C:\Windows\System\fRhufuo.exe
  2⤵
  PID:14388
- C:\Windows\System\NLqyGBV.exe
  C:\Windows\System\NLqyGBV.exe
  2⤵
  PID:14428
- C:\Windows\System\RVGxvJZ.exe
  C:\Windows\System\RVGxvJZ.exe
  2⤵
  PID:2564
- C:\Windows\System\YDIIMVQ.exe
  C:\Windows\System\YDIIMVQ.exe
  2⤵
  PID:14444
- C:\Windows\System\GAeQMxC.exe
  C:\Windows\System\GAeQMxC.exe
  2⤵
  PID:14504
- C:\Windows\System\HopxxXR.exe
  C:\Windows\System\HopxxXR.exe
  2⤵
  PID:5096
- C:\Windows\System\erdgURn.exe
  C:\Windows\System\erdgURn.exe
  2⤵
  PID:4964
- C:\Windows\System\pSPFAlG.exe
  C:\Windows\System\pSPFAlG.exe
  2⤵
  PID:7184
- C:\Windows\System\JyQfZYb.exe
  C:\Windows\System\JyQfZYb.exe
  2⤵
  PID:7484
- C:\Windows\System\IZVWevb.exe
  C:\Windows\System\IZVWevb.exe
  2⤵
  PID:3568
- C:\Windows\System\pBkXDpd.exe
  C:\Windows\System\pBkXDpd.exe
  2⤵
  PID:4772
- C:\Windows\System\cHrmZdP.exe
  C:\Windows\System\cHrmZdP.exe
  2⤵
  PID:14560
- C:\Windows\System\RkjFonQ.exe
  C:\Windows\System\RkjFonQ.exe
  2⤵
  PID:2732
- C:\Windows\System\tfNttKj.exe
  C:\Windows\System\tfNttKj.exe
  2⤵
  PID:1656
- C:\Windows\System\Jtduigp.exe
  C:\Windows\System\Jtduigp.exe
  2⤵
  PID:4868
- C:\Windows\System\JHRCkxl.exe
  C:\Windows\System\JHRCkxl.exe
  2⤵
  PID:14592
- C:\Windows\System\aquRJZP.exe
  C:\Windows\System\aquRJZP.exe
  2⤵
  PID:8392
- C:\Windows\System\FxpQUDT.exe
  C:\Windows\System\FxpQUDT.exe
  2⤵
  PID:8448
- C:\Windows\System\PdchBeo.exe
  C:\Windows\System\PdchBeo.exe
  2⤵
  PID:4920
- C:\Windows\System\ssVkIVp.exe
  C:\Windows\System\ssVkIVp.exe
  2⤵
  PID:2180
- C:\Windows\System\roKdZgL.exe
  C:\Windows\System\roKdZgL.exe
  2⤵
  PID:14656
- C:\Windows\System\NYwRqDl.exe
  C:\Windows\System\NYwRqDl.exe
  2⤵
  PID:8904
- C:\Windows\System\ScAoThW.exe
  C:\Windows\System\ScAoThW.exe
  2⤵
  PID:4756
- C:\Windows\System\fZKNSeR.exe
  C:\Windows\System\fZKNSeR.exe
  2⤵
  PID:4992
- C:\Windows\System\zXGbPVD.exe
  C:\Windows\System\zXGbPVD.exe
  2⤵
  PID:3480
- C:\Windows\System\mSMwskx.exe
  C:\Windows\System\mSMwskx.exe
  2⤵
  PID:14716
- C:\Windows\System\MLVbPOp.exe
  C:\Windows\System\MLVbPOp.exe
  2⤵
  PID:14744
- C:\Windows\System\bYTpBvR.exe
  C:\Windows\System\bYTpBvR.exe
  2⤵
  PID:2408
- C:\Windows\System\xeRtCPQ.exe
  C:\Windows\System\xeRtCPQ.exe
  2⤵
  PID:14784
- C:\Windows\System\dFkDsYK.exe
  C:\Windows\System\dFkDsYK.exe
  2⤵
  PID:14808
- C:\Windows\System\dUAebJL.exe
  C:\Windows\System\dUAebJL.exe
  2⤵
  PID:14340
- C:\Windows\System\gpoHCrk.exe
  C:\Windows\System\gpoHCrk.exe
  2⤵
  PID:8880
- C:\Windows\System\VbVtZTZ.exe
  C:\Windows\System\VbVtZTZ.exe
  2⤵
  PID:8736
- C:\Windows\System\KbqSjff.exe
  C:\Windows\System\KbqSjff.exe
  2⤵
  PID:9076
- C:\Windows\System\MPVhDJo.exe
  C:\Windows\System\MPVhDJo.exe
  2⤵
  PID:8864
- C:\Windows\System\WzAhrWZ.exe
  C:\Windows\System\WzAhrWZ.exe
  2⤵
  PID:9208
- C:\Windows\System\nBLrxxV.exe
  C:\Windows\System\nBLrxxV.exe
  2⤵
  PID:8320
- C:\Windows\System\xlLVTKv.exe
  C:\Windows\System\xlLVTKv.exe
  2⤵
  PID:8436
- C:\Windows\System\JSehEZR.exe
  C:\Windows\System\JSehEZR.exe
  2⤵
  PID:4880
- C:\Windows\System\eOuRCBH.exe
  C:\Windows\System\eOuRCBH.exe
  2⤵
  PID:14884
- C:\Windows\System\DgrZESG.exe
  C:\Windows\System\DgrZESG.exe
  2⤵
  PID:14872
- C:\Windows\System\WsUvEBj.exe
  C:\Windows\System\WsUvEBj.exe
  2⤵
  PID:3744
- C:\Windows\System\npvmAsl.exe
  C:\Windows\System\npvmAsl.exe
  2⤵
  PID:14916
- C:\Windows\System\MaJzHut.exe
  C:\Windows\System\MaJzHut.exe
  2⤵
  PID:14940
- C:\Windows\System\ANZxPtl.exe
  C:\Windows\System\ANZxPtl.exe
  2⤵
  PID:14976
- C:\Windows\System\VxuKoWD.exe
  C:\Windows\System\VxuKoWD.exe
  2⤵
  PID:2632
- C:\Windows\System\muKnrCN.exe
  C:\Windows\System\muKnrCN.exe
  2⤵
  PID:15000
- C:\Windows\System\AoqWniU.exe
  C:\Windows\System\AoqWniU.exe
  2⤵
  PID:9416
- C:\Windows\System\UfadFXS.exe
  C:\Windows\System\UfadFXS.exe
  2⤵
  PID:9480
- C:\Windows\System\JuIjiiw.exe
  C:\Windows\System\JuIjiiw.exe
  2⤵
  PID:9488
- C:\Windows\System\hdPftQZ.exe
  C:\Windows\System\hdPftQZ.exe
  2⤵
  PID:1720
- C:\Windows\System\qGBGOmz.exe
  C:\Windows\System\qGBGOmz.exe
  2⤵
  PID:15012
- C:\Windows\System\HcNIbJA.exe
  C:\Windows\System\HcNIbJA.exe
  2⤵
  PID:15020
- C:\Windows\System\JALpJyB.exe
  C:\Windows\System\JALpJyB.exe
  2⤵
  PID:9624
- C:\Windows\System\OleLdBN.exe
  C:\Windows\System\OleLdBN.exe
  2⤵
  PID:2440
- C:\Windows\System\GCGKEcr.exe
  C:\Windows\System\GCGKEcr.exe
  2⤵
  PID:15068
- C:\Windows\System\bVITzgZ.exe
  C:\Windows\System\bVITzgZ.exe
  2⤵
  PID:15084
- C:\Windows\System\okUfdaJ.exe
  C:\Windows\System\okUfdaJ.exe
  2⤵
  PID:9720
- C:\Windows\System\ZIeGWIg.exe
  C:\Windows\System\ZIeGWIg.exe
  2⤵
  PID:4492
- C:\Windows\System\TgLUCeh.exe
  C:\Windows\System\TgLUCeh.exe
  2⤵
  PID:15140
- C:\Windows\System\ERBPTlL.exe
  C:\Windows\System\ERBPTlL.exe
  2⤵
  PID:2148
- C:\Windows\System\KklFXOY.exe
  C:\Windows\System\KklFXOY.exe
  2⤵
  PID:15180
- C:\Windows\System\pEpdKBo.exe
  C:\Windows\System\pEpdKBo.exe
  2⤵
  PID:15200
- C:\Windows\System\bbZNNqL.exe
  C:\Windows\System\bbZNNqL.exe
  2⤵
  PID:15216
- C:\Windows\System\clzYNXW.exe
  C:\Windows\System\clzYNXW.exe
  2⤵
  PID:1588
- C:\Windows\System\ADCeAHv.exe
  C:\Windows\System\ADCeAHv.exe
  2⤵
  PID:10004
- C:\Windows\System\gHMDGcd.exe
  C:\Windows\System\gHMDGcd.exe
  2⤵
  PID:14500
- C:\Windows\System\KVDJgEW.exe
  C:\Windows\System\KVDJgEW.exe
  2⤵
  PID:15288
- C:\Windows\System\iOLzJsl.exe
  C:\Windows\System\iOLzJsl.exe
  2⤵
  PID:10132
- C:\Windows\System\CjfjiWg.exe
  C:\Windows\System\CjfjiWg.exe
  2⤵
  PID:15356
- C:\Windows\System\NxwTDjl.exe
  C:\Windows\System\NxwTDjl.exe
  2⤵
  PID:14552
- C:\Windows\System\YEofWrH.exe
  C:\Windows\System\YEofWrH.exe
  2⤵
  PID:2100
- C:\Windows\System\wjpQGgF.exe
  C:\Windows\System\wjpQGgF.exe
  2⤵
  PID:3028
- C:\Windows\System\bZfHKLY.exe
  C:\Windows\System\bZfHKLY.exe
  2⤵
  PID:3444
- C:\Windows\System\fRCpQWd.exe
  C:\Windows\System\fRCpQWd.exe
  2⤵
  PID:4692
- C:\Windows\System\TEsGpAo.exe
  C:\Windows\System\TEsGpAo.exe
  2⤵
  PID:9588
- C:\Windows\System\ETkKqIP.exe
  C:\Windows\System\ETkKqIP.exe
  2⤵
  PID:7540
- C:\Windows\System\gZbYTFB.exe
  C:\Windows\System\gZbYTFB.exe
  2⤵
  PID:9680
- C:\Windows\System\tpXvopC.exe
  C:\Windows\System\tpXvopC.exe
  2⤵
  PID:14572
- C:\Windows\System\mlQuetk.exe
  C:\Windows\System\mlQuetk.exe
  2⤵
  PID:1684
- C:\Windows\System\NHzpWmy.exe
  C:\Windows\System\NHzpWmy.exe
  2⤵
  PID:14372
- C:\Windows\System\XbKTquW.exe
  C:\Windows\System\XbKTquW.exe
  2⤵
  PID:7992
- C:\Windows\System\wkSLnEc.exe
  C:\Windows\System\wkSLnEc.exe
  2⤵
  PID:1612
- C:\Windows\System\ZxcXwlo.exe
  C:\Windows\System\ZxcXwlo.exe
  2⤵
  PID:10176
- C:\Windows\System\XnhteXo.exe
  C:\Windows\System\XnhteXo.exe
  2⤵
  PID:2120
- C:\Windows\System\HYzBbhF.exe
  C:\Windows\System\HYzBbhF.exe
  2⤵
  PID:14840
- C:\Windows\System\EQfHZFx.exe
  C:\Windows\System\EQfHZFx.exe
  2⤵
  PID:4272
- C:\Windows\System\hHvPTyP.exe
  C:\Windows\System\hHvPTyP.exe
  2⤵
  PID:14532
- C:\Windows\System\YzAiEJC.exe
  C:\Windows\System\YzAiEJC.exe
  2⤵
  PID:10084
- C:\Windows\System\LXOOzAN.exe
  C:\Windows\System\LXOOzAN.exe
  2⤵
  PID:10196
- C:\Windows\System\sOeMait.exe
  C:\Windows\System\sOeMait.exe
  2⤵
  PID:7656
- C:\Windows\System\lBuJRxg.exe
  C:\Windows\System\lBuJRxg.exe
  2⤵
  PID:9660
- C:\Windows\System\ZzQRlNO.exe
  C:\Windows\System\ZzQRlNO.exe
  2⤵
  PID:7568
- C:\Windows\System\WmZGFxd.exe
  C:\Windows\System\WmZGFxd.exe
  2⤵
  PID:14576
- C:\Windows\System\bJhZPzM.exe
  C:\Windows\System\bJhZPzM.exe
  2⤵
  PID:9512
- C:\Windows\System\koQxAyR.exe
  C:\Windows\System\koQxAyR.exe
  2⤵
  PID:8248
- C:\Windows\System\wMPJzOi.exe
  C:\Windows\System\wMPJzOi.exe
  2⤵
  PID:10276
- C:\Windows\System\FONJzdk.exe
  C:\Windows\System\FONJzdk.exe
  2⤵
  PID:10324
- C:\Windows\System\bMUSObP.exe
  C:\Windows\System\bMUSObP.exe
  2⤵
  PID:10328
- C:\Windows\System\oFtydNz.exe
  C:\Windows\System\oFtydNz.exe
  2⤵
  PID:10360
- C:\Windows\System\YQAbsuO.exe
  C:\Windows\System\YQAbsuO.exe
  2⤵
  PID:1416
- C:\Windows\System\VvtQmSj.exe
  C:\Windows\System\VvtQmSj.exe
  2⤵
  PID:14612
- C:\Windows\System\crIZwAf.exe
  C:\Windows\System\crIZwAf.exe
  2⤵
  PID:4368
- C:\Windows\System\BxFMMKz.exe
  C:\Windows\System\BxFMMKz.exe
  2⤵
  PID:9032
- C:\Windows\System\qUbUPiU.exe
  C:\Windows\System\qUbUPiU.exe
  2⤵
  PID:2820
- C:\Windows\System\fFfycux.exe
  C:\Windows\System\fFfycux.exe
  2⤵
  PID:1100
- C:\Windows\System\CRNUHrO.exe
  C:\Windows\System\CRNUHrO.exe
  2⤵
  PID:3912
- C:\Windows\System\VVokmrs.exe
  C:\Windows\System\VVokmrs.exe
  2⤵
  PID:14696
- C:\Windows\System\aeTAexm.exe
  C:\Windows\System\aeTAexm.exe
  2⤵
  PID:10524
- C:\Windows\System\eJNXGPV.exe
  C:\Windows\System\eJNXGPV.exe
  2⤵
  PID:14764
- C:\Windows\System\cPteBFs.exe
  C:\Windows\System\cPteBFs.exe
  2⤵
  PID:10544
- C:\Windows\System\qnhbzzl.exe
  C:\Windows\System\qnhbzzl.exe
  2⤵
  PID:10592
- C:\Windows\System\eiErSqK.exe
  C:\Windows\System\eiErSqK.exe
  2⤵
  PID:14836
- C:\Windows\System\HDPJVhb.exe
  C:\Windows\System\HDPJVhb.exe
  2⤵
  PID:10600
- C:\Windows\System\uGXgDxA.exe
  C:\Windows\System\uGXgDxA.exe
  2⤵
  PID:8732
- C:\Windows\System\gTvtTiu.exe
  C:\Windows\System\gTvtTiu.exe
  2⤵
  PID:8640
- C:\Windows\System\Ugbordu.exe
  C:\Windows\System\Ugbordu.exe
  2⤵
  PID:14720
- C:\Windows\System\xMedsNy.exe
  C:\Windows\System\xMedsNy.exe
  2⤵
  PID:10800
- C:\Windows\System\MlwsJIw.exe
  C:\Windows\System\MlwsJIw.exe
  2⤵
  PID:10924
- C:\Windows\System\gKFqqkM.exe
  C:\Windows\System\gKFqqkM.exe
  2⤵
  PID:5040
- C:\Windows\System\hwgZmRw.exe
  C:\Windows\System\hwgZmRw.exe
  2⤵
  PID:10952
- C:\Windows\System\TvDznEw.exe
  C:\Windows\System\TvDznEw.exe
  2⤵
  PID:4940
- C:\Windows\System\vCTcDog.exe
  C:\Windows\System\vCTcDog.exe
  2⤵
  PID:11012
- C:\Windows\System\oebaxmm.exe
  C:\Windows\System\oebaxmm.exe
  2⤵
  PID:11044
- C:\Windows\System\HURRaSz.exe
  C:\Windows\System\HURRaSz.exe
  2⤵
  PID:11100
- C:\Windows\System\rMFLhae.exe
  C:\Windows\System\rMFLhae.exe
  2⤵
  PID:14960
- C:\Windows\System\SygqKII.exe
  C:\Windows\System\SygqKII.exe
  2⤵
  PID:1696
- C:\Windows\System\xXorpGV.exe
  C:\Windows\System\xXorpGV.exe
  2⤵
  PID:10180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pugg1qgf.3hi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AXVhuIk.exe

Filesize
1.6MB

MD5
56b9d8a642b1d2886cc3caa7ecbc738d

SHA1
82093747bedec7815f52edba34b1b89f7267c1fc

SHA256
64583c32c9cd1fc34befe096ba104118ddb72fd0f671dc9d057c545633d4a2be

SHA512
260f1dc4b5797adc81578fb37ed89c3a4caf8ac124d2d5acb71b43263548132d28f05f483c90712a9e4f4e8ee8617b6fd20bd1a9e0a9fbb5a79363b855dfc7e2

Download Submit
C:\Windows\System\BcfogeS.exe

Filesize
8B

MD5
f711adee27516b005fc25d05db275022

SHA1
37fddcc1329d6f4da1b8eb78665830cbf5074110

SHA256
a9de3e5771bb94f83a0011d6be0e78d5e9c1c91c97b1401206471b56740d49d4

SHA512
5a6cabfef649b40043c3bced543aeaa96cc1135167dc5f35eff4dd8aef45c34ed818a13fca66a04a1ce4848095ed467409b597f0ce727137f28b37a18328e1e0

Download Submit
C:\Windows\System\ESolvky.exe

Filesize
1.6MB

MD5
b53b4b07f2503fce3764333cbe81317d

SHA1
342c765419a82d70577948c7dad0b42eb176552d

SHA256
ce0e1302b91fe4ffcaa32515eeee8313e9f788a0496586a1152673706023fbf1

SHA512
74333d855492393a0051f751b587ff948b4169070fcce1960eae3244169099ded909f78d2c0cbbc044bfc72f02eb56e7ebe4a2d96a1e4510fb9aa3f56ec9f6c1

Download Submit
C:\Windows\System\FgUfcbE.exe

Filesize
1.6MB

MD5
b6696f5eb910543f7124eb08a95d2586

SHA1
1ab2b1603aa084fda2c5b63733b92d601053c624

SHA256
464c0284b2a788146cf5e99efdcbaa06d5961615af560fef216765c7f6146218

SHA512
52bfe3c1108aa2a5532de513029b0f007c0ef160ffd5397108ddd812684e8196c4886c308f4c7e1cc237f2413e156f9ccf58ba12e9bc9177965e7b79e63e0801

Download Submit
C:\Windows\System\FlRplqu.exe

Filesize
1.6MB

MD5
17e2310ad748285e32b4c88ce47c15f3

SHA1
2a832f83fc41a0ce3b55d3b6b841473e2069cc9a

SHA256
e31998514c7be478d45b8a138c67d7fb42a1e23bdcec8994f5b2cba8eb0a0bdc

SHA512
1b9acb689a00d211ad1607920578dd2e6da953f64ae7f128ca19b00ccc39e7c55214d8ef101e9a694af2de9f0371c244875358d30194d544122160ff2217f664

Download Submit
C:\Windows\System\GbBerlp.exe

Filesize
1.6MB

MD5
9f8b55f683e7dc6fc8cbf83ba4578bcc

SHA1
262e8f538ceb637ba9530fe8604cb0be071561fe

SHA256
2134ad0977d2862674bfd675f172623e1e5ea82c3f6ffd697851099c585b105e

SHA512
0f7df2e7404cb1d1644ca438cd68354ba0ea2780292d5d739ffeb0c3b6aec873a2d9b34c6bb28aa79694206a8d7e822fb057c5e6ecbdac2bf5569f980ba8b6ec

Download Submit
C:\Windows\System\GhBuXHn.exe

Filesize
1.6MB

MD5
aefa5656c46609b656f78a9490a16f6f

SHA1
bb0b8211ac5da158c60c6936e9d72dba238a5642

SHA256
8331f335c014118af705d0fe6ff483038e7e9e3a97ee51ef6be46c1cbf0bfa0d

SHA512
6a535cc707b4360b8732829c4c65f34084596e93bcec63086dd7ba4a4a10bbf1c6d9c412edecb0a1c20411af109ecf589dbe1b00176571f776f0848e8fc83ce9

Download Submit
C:\Windows\System\GwAIrca.exe

Filesize
1.6MB

MD5
202772de2b0682af32337a675f22ea53

SHA1
921bb13201711556a644770a4b5bada505d10f2b

SHA256
37af3e78bbab3a2f7e0195917f7b7029741c5fdbd6e25ee9b4b2cebd334a4145

SHA512
21f702f0aee6c75b783813af085202d6dd5065967246a160ebcc7c0eac4e72f6b9cc782b0e2050881e0fea631e48e8636407e1882cf6cdb4d253da7f869eb473

Download Submit
C:\Windows\System\MpqFNJb.exe

Filesize
1.6MB

MD5
456f6d47a05397214d801dc3980713d1

SHA1
33b19a247bb3371501ac974d1141d7c94a75af8b

SHA256
1b376534c2593e9b7e5fe6517126e3c70a48f5ed9f60bf7c10cee54054e02aea

SHA512
0a9c3050da8b68c88b3481a6df072f8364c01ae025181d5d463e0c924f58b44430a70739825835f2d4f443d7e63ba88997819e543d8b66b55f5fdfaf95896dad

Download Submit
C:\Windows\System\QZhCPeV.exe

Filesize
1.6MB

MD5
a138fd037898888b53461f2472623233

SHA1
93c7809f829378b9dfe760148655eba9c02e6f6c

SHA256
a100729a0cebbbba14e1b95836eaec12b2918412c98b08c08d740be2e98399ab

SHA512
29da0230e23d5d7dccf4b473e99b9a96e1863761b12022e56ae9e146df67777afbd1202605da8c19fe218f13fc598698796716acee675113eacea1a750bfd3d6

Download Submit
C:\Windows\System\TiIiaDk.exe

Filesize
1.6MB

MD5
7cd08755bf3f861e4d2ee3fb2ab92cc2

SHA1
0263f5222d1a4f2efdd737e8c5227a73b37e43bc

SHA256
267f7c04cc5e6d5e9047aa67c93da3100b501f46384812030bce5c852d715112

SHA512
136bf9acca31f56ae94e3f50a22251a8f8e1436da72293eb23447db0040a6b3e13832d27e27e2a01ab96f7752670fcd578b830bafd71a61044557492445057f4

Download Submit
C:\Windows\System\UeTZXxz.exe

Filesize
1.6MB

MD5
505f9b68dc88d7fb0c6d41d6cb0cca0e

SHA1
0c7b664dc01ce066d5c651affd6b1d4ac44ac398

SHA256
c0fbd8cd7578e2cd904f5975a625b3a63ab846e8311af2afd04b5e59a6f13e50

SHA512
a53bcaa4454a39545b4f601a64263df8ab3f07a9d55024a17ee2c7ea86cd72f6932414bb4ebcefe4762535f62b61ef926ef43e20393b4dd91b72173d0983e689

Download Submit
C:\Windows\System\UlpcfIY.exe

Filesize
1.6MB

MD5
d0072ad47f865f3d40f3cc5c02ba109a

SHA1
9228e86be1514a88b9d848d14ec2546004e1d81c

SHA256
37f41572a6921258016771a2e0fb4c1f17bf3427b572d35b30d40f3202a033e1

SHA512
9b5b5f117d94a8ffe4175bc059db5270ea423f5e96d9a4e0c30c4f87e5f03795146fbc1a83f173be3a14c1c47a68de32652d8d493541e02ab982a03185c797dd

Download Submit
C:\Windows\System\WwgOabE.exe

Filesize
1.6MB

MD5
298d4565fe30d5dd8ce5925223237260

SHA1
c3caf0e627d30df2a7d89f360729bb6f4dec28b4

SHA256
21dc7a2fddc38d94402150ffd707153e29dd54e5f22388ef929447ac2cb48fa1

SHA512
422ffe325d40b35d47a8678978d1265ebc6ac939b82bb013a2096ad43a1633354a2447663f2e0064b0707bdda8ae1b39c148ff016c692b065b12a656862bcf74

Download Submit
C:\Windows\System\bymGmKC.exe

Filesize
1.6MB

MD5
976423e2733565bbeb37c973d184546a

SHA1
202738106ff351a4c1ab7fc3734eccd509bac045

SHA256
676b8fb34215df7347a47ac0afcf3bd779789cd723a42332e7bae060d20647d4

SHA512
2705be161ea3b476e606315af2345c67137782ded38ab278cd4afba41e972c01ea562336e825dd7cf3e455a880cd90776a8a60fc3a471f0d0b333e206a03750b

Download Submit
C:\Windows\System\eIbuDTg.exe

Filesize
1.6MB

MD5
2041ba61a6d66785ea9340ac6c633fd8

SHA1
4496f3231096a67c8ceb50b95e87032c272d4f9d

SHA256
bdbd3b7a8c9dab17729aa8ccf383215244bacb4a6497bb6c76f1bd55c7519c09

SHA512
283bf2884ba83c673f26e205cadb9f03edcf2895b717da77edc6afe370cc41b494acd804c1bc8f48e00b67f00513ebe9eaeac32c57204a668d9c2ffeb0e1027f

Download Submit
C:\Windows\System\fFcCiUN.exe

Filesize
1.6MB

MD5
1f6deb1be806ae33471dba3baed7c254

SHA1
b04615919fa9c25e9885d4b9777f4f3c836db733

SHA256
51f21e4fba21466816118e54c482eba0f729a8555567f914db0e86fe7768626a

SHA512
7d76ac16c56b955623ad62a0440b0136b605d795f85f8204eb70f48255fe8eb911ef4f0b5648fb813d1aab160b17dd1a9e272326d4842d7116a4b7f07e7f1ea0

Download Submit
C:\Windows\System\fxWwlJY.exe

Filesize
1.6MB

MD5
351a21bd98e7a754292ece04e1dc011d

SHA1
464383285065100cb3301e5021979bd380df24e1

SHA256
02f73dde731314ac5e7fe7086218422a0943ca74dc47c6f120aa642786c7e979

SHA512
ff553d56115fc96d78e7d21b7d2fca9dd1201324ad313eb7fd9ec60ef5a2ac6a6264a153fe704f49c2137b1598dc3dd8feecf4c91118b2cf2f2ea0a5afa68835

Download Submit
C:\Windows\System\gOdNDOx.exe

Filesize
1.6MB

MD5
847977f806ec17d7891a985ec7228c03

SHA1
6459890ea279ab1350819d96e817ae01d24ff0a6

SHA256
f9b70a074a7d883dd32f801ae4e79874cbea90df35cc74ee57f146194574184c

SHA512
9e0454ae5e5fd4eb1c83586bc82a32b8c31c9a1a6990142cfd3dea692ac8c876eb5c1c2d8b146e3af61e59e96d4a427ab8a0d32db781171a638bacd0509a7a80

Download Submit
C:\Windows\System\hRSfOCl.exe

Filesize
1.6MB

MD5
41b47c5babac4f3f2677e77e72c3321d

SHA1
3e46a46e6421ddd4c06b0d3b2482df8cf5b4512f

SHA256
45cf9953d8e33fe15f2441dbd9103447e2af366beea527ccf2680665572eed6a

SHA512
dfb7b9ad5a26cb798695116b860ce34418370227066de882f9cf8e3b63e7b2dc7dbe7a7c75651cade3ee4f84b9c850de0eb7129b721f006de3fd96c32a7df45f

Download Submit
C:\Windows\System\iCjrbEZ.exe

Filesize
1.6MB

MD5
0658b5e3b1e3ff68dcac6d8e2801b29d

SHA1
c6f99c1a96ac87b75df8cd3632427d59b70e9f6d

SHA256
2e7a9b6ce7feb5438eda647e339a6ab9ccc801a47044bdf46833373daefb70f2

SHA512
a20ef207e44557d5bff69f9713ab63b520717b1d6d09230865a58d0005f07576d950fd7c7851c1b4cf95a2b7cf4a242f26aac22ae03dc47baab7cd84e0f210f1

Download Submit
C:\Windows\System\itgNOdI.exe

Filesize
1.6MB

MD5
7c6e2108da26ffd1618c0406977a4c62

SHA1
28fc37f8fe11aee1604fc0732f08852cdec1ab4b

SHA256
ead02ec09878d682d588944ea5b4881b69c5a874152cd20a14844501c2cfc701

SHA512
f7424f02c87dd7de903ef4bcf988f589904333f2fd276b67e6bc29b887e8d8c7c915c6f1f355d03f078ffb728fd3162e2509cebd7ce1bedccbe8bc1997ee391d

Download Submit
C:\Windows\System\pCbdlvM.exe

Filesize
1.6MB

MD5
2c73e5a9caf20660081a991fdff56232

SHA1
95be1fb3257f35080d8c26807ec087829247614a

SHA256
e025dfb03281a399545c28c0af6b754850e78772859a14336aee7d01b34956ef

SHA512
39c36c3366012c2e84c55030d499f319b91986604b0b4d4daae00ce780105bfc05c83452b604caf7be7b2c493f933387802f41dde46f3bf943b75092a9ee7e2e

Download Submit
C:\Windows\System\pvLoUCz.exe

Filesize
1.6MB

MD5
34b62342335aa1777bd040baa5ebaf62

SHA1
2b964534112320c37c7faa6f4464a8ca4129ea44

SHA256
aa99118a88ee589aaa8e04ee445aa51274446ccb43e14e427d7e8010f61107e8

SHA512
eb544265adf7120db3890bea4d35530e2e18bea3bb7b88181c53e2ee68998f5a21c5a362b97bd1fce25e5686688a4ada53cfb834513723af37cc2239d6f94b57

Download Submit
C:\Windows\System\qKxBhew.exe

Filesize
1.6MB

MD5
ad52957779d7a516fe48d7fb6e49fbb7

SHA1
36797a67cfa0c9a8dcd16db9b883573880665e10

SHA256
d9b7ed6ea1adc67d3b17bd10c2642e56820c28a42b091ede87d9b6ed10313eb1

SHA512
3eaa5b1441da07de80ebe213b3d74c35a1f4ddf8e1d5e3b3f06213de1008ce265128d663b16103251330aac1961a30444e81453f2cdb8282f4b726974de9618d

Download Submit
C:\Windows\System\rYrIrbL.exe

Filesize
1.6MB

MD5
6b5ee1da8cbd4b003f64fd6c27104f94

SHA1
0325974b7b4443693069a168718b665a203ef4fb

SHA256
b1be823f068f8bb2be73a96c3d0efedeeccf18e2a65c4bb2ca2af8aad5c7923c

SHA512
3180c699479b9b9d6d1a334f9983919a74317e6a7fbc5dbf22c141a5cd83dd02893a0110607a94a17626b7a7b3028d412c203537ff40efef0aa1cf3ff2bf920c

Download Submit
C:\Windows\System\sMCJoYh.exe

Filesize
1.6MB

MD5
643ab6e6fba83a0fc7b98af2960ea94d

SHA1
431259f11905d42493a2071a950190747a1ac4b7

SHA256
24bac928fc02d7001fda8e83707ce6ef62206fab469b347c2bccc31c4763fab6

SHA512
88772780bb8ef7edbd2340bca8cb2699f6f3b770976c4ed7ce2a82abfa85923a83ae35c20abe5b6045c6d3528b81bea7310316d192664e40df9a3ae640f3c7ea

Download Submit
C:\Windows\System\ulPcfFg.exe

Filesize
1.6MB

MD5
5a0460edc7c1f1a6a412388264cad3ec

SHA1
840fcc4ee321c63b220ad0be32913f9b3747366f

SHA256
b17bb7e1159ae478cf3533f80f68a9a3eb772266b49e7abb8a70b22c279bd8ce

SHA512
1d69477cb99d403792219856c894d2fe51bf71ee9bcf6d7218d198a04644e4feda118de2748d9996d80e8272a90244ccb80408d1d19572de7898c8b5e18b6e6f

Download Submit
C:\Windows\System\vBGVqmL.exe

Filesize
1.6MB

MD5
c986b4c921e84bdce1ebbf3c3d405381

SHA1
498dc7d8ab274c05a968f3abc07ca59d86aecbfb

SHA256
034bfc77ca235d4c9a710cef83fdbf604ce02a7a73fa8af605f880ec0636a977

SHA512
1f70d99cc26ebab3fa56197102b151fbc22f460bf62d31f434783c8419d29bbe10a3ba8f7cb035ff0040d365be0f894fb7acb75d162d6211495efaed8287b0b7

Download Submit
C:\Windows\System\wNtcccs.exe

Filesize
1.6MB

MD5
c757810b63a1d38733917bf2cc4883af

SHA1
0e1b09558d3bab6795e2ae79953d029d03dca6e3

SHA256
de1b7ee181f38dedc8635dcf2030ec75ec317d5a83d0892a704a3bee973cc96b

SHA512
0be38ecec00a8447ca08d6ec367d38d2fa85e3799d607dc64565722fd3a0c206b6250a14d7b100e04224f819095c5688937317fbb3370d73dc7c34beee9bbd29

Download Submit
C:\Windows\System\wURtKso.exe

Filesize
1.6MB

MD5
cb308b0bf26d52cdadefe0992133f79a

SHA1
bc2b87d764f578c80be0326006f8b9ff51a77570

SHA256
283719ef7d43035496ab1fc46f482456ba6d5e1137950aaf875c1181c4ca11a0

SHA512
b6ca36c3e9fc020a6b36d4f6ac223a2f0ba06a0d84d3290cfb31d7bfb4b4a79979ac077fc0f46f35db7afdc7ca1ca0af308e1fd534599c1b58a16ad3d60c326f

Download Submit
C:\Windows\System\yFktzrl.exe

Filesize
1.6MB

MD5
03e7b288c089e968f164c9c53be557e0

SHA1
397bee04bca2cf4410d138898c3799a396c5db66

SHA256
024f5a8e55ba065d4da05e35e4ba9d673237ca01500b7862b668bbfb1a138cbf

SHA512
c670861a78efc966b57c7d9cefef0a5165c688299f76b253dbb1b3038c02a39157dec1eeb46c41c7c4001778d3db8899438193a7653b9ac5a6355d1644cd77c2

Download Submit
C:\Windows\System\yWlcOIk.exe

Filesize
1.6MB

MD5
77200ff365874fa05b0d7868f67686e8

SHA1
4eee49f20d168d8244539dbd011a6a434adf5b3f

SHA256
ee3b6de93c096a9ccf40e425ca38228c28f95185840aac303ba28df19501b6d0

SHA512
3bf947270f73b5cac476d42428c55d37973cf5714e66c0d2eac13cfb96a9c0a9fb21efe47e180fdf6f2bb54b9d2384f7ab29b9b1c8f2baa9415c03071ce91755

Download Submit
C:\Windows\System\zXIesyg.exe

Filesize
1.6MB

MD5
645343ea864345c75e5a5881cf0fa335

SHA1
d79e5ae1aba5694703e40076d66361db9a52f85f

SHA256
1c1ad2927650ef7a5257223228943e3f2c9a45af65a578facf9e9f026454f95a

SHA512
a6c584119ebbe9fa1f36a829e26c235eb6bd06fb3299fc20661bf504b70f5ae51255591df843960fe40c8637ffae48ac91f1a3d056b7dedf53e51e50294a3e73

Download Submit
memory/940-3686-0x00007FF7E1D80000-0x00007FF7E2172000-memory.dmp

Filesize
3.9MB

Download
memory/940-52-0x00007FF7E1D80000-0x00007FF7E2172000-memory.dmp

Filesize
3.9MB

Download
memory/1124-105-0x00007FF7F6250000-0x00007FF7F6642000-memory.dmp

Filesize
3.9MB

Download
memory/1124-3714-0x00007FF7F6250000-0x00007FF7F6642000-memory.dmp

Filesize
3.9MB

Download
memory/1232-3229-0x00007FF9837D0000-0x00007FF984291000-memory.dmp

Filesize
10.8MB

Download
memory/1232-482-0x0000018BD7860000-0x0000018BD8006000-memory.dmp

Filesize
7.6MB

Download
memory/1232-46-0x0000018BD6960000-0x0000018BD6982000-memory.dmp

Filesize
136KB

Download
memory/1232-35-0x00007FF9837D0000-0x00007FF984291000-memory.dmp

Filesize
10.8MB

Download
memory/1232-5-0x00007FF9837D3000-0x00007FF9837D5000-memory.dmp

Filesize
8KB

Download
memory/2036-3691-0x00007FF74CD20000-0x00007FF74D112000-memory.dmp

Filesize
3.9MB

Download
memory/2036-101-0x00007FF74CD20000-0x00007FF74D112000-memory.dmp

Filesize
3.9MB

Download
memory/2088-3706-0x00007FF78C0D0000-0x00007FF78C4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-78-0x00007FF78C0D0000-0x00007FF78C4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-0-0x00007FF660780000-0x00007FF660B72000-memory.dmp

Filesize
3.9MB

Download
memory/2164-1-0x000001732ACE0000-0x000001732ACF0000-memory.dmp

Filesize
64KB

Download
memory/2164-1687-0x00007FF660780000-0x00007FF660B72000-memory.dmp

Filesize
3.9MB

Download
memory/2416-3665-0x00007FF7BE050000-0x00007FF7BE442000-memory.dmp

Filesize
3.9MB

Download
memory/2416-97-0x00007FF7BE050000-0x00007FF7BE442000-memory.dmp

Filesize
3.9MB

Download
memory/2520-3750-0x00007FF71EC10000-0x00007FF71F002000-memory.dmp

Filesize
3.9MB

Download
memory/2520-427-0x00007FF71EC10000-0x00007FF71F002000-memory.dmp

Filesize
3.9MB

Download
memory/2568-82-0x00007FF728850000-0x00007FF728C42000-memory.dmp

Filesize
3.9MB

Download
memory/2568-3694-0x00007FF728850000-0x00007FF728C42000-memory.dmp

Filesize
3.9MB

Download
memory/2752-3756-0x00007FF6BC390000-0x00007FF6BC782000-memory.dmp

Filesize
3.9MB

Download
memory/2752-432-0x00007FF6BC390000-0x00007FF6BC782000-memory.dmp

Filesize
3.9MB

Download
memory/2772-3630-0x00007FF783260000-0x00007FF783652000-memory.dmp

Filesize
3.9MB

Download
memory/2772-13-0x00007FF783260000-0x00007FF783652000-memory.dmp

Filesize
3.9MB

Download
memory/2944-112-0x00007FF7798B0000-0x00007FF779CA2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-3724-0x00007FF7798B0000-0x00007FF779CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3460-71-0x00007FF7A1F80000-0x00007FF7A2372000-memory.dmp

Filesize
3.9MB

Download
memory/3460-3702-0x00007FF7A1F80000-0x00007FF7A2372000-memory.dmp

Filesize
3.9MB

Download
memory/3460-2324-0x00007FF7A1F80000-0x00007FF7A2372000-memory.dmp

Filesize
3.9MB

Download
memory/3468-3675-0x00007FF7705D0000-0x00007FF7709C2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-92-0x00007FF7705D0000-0x00007FF7709C2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-426-0x00007FF778AE0000-0x00007FF778ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-3740-0x00007FF778AE0000-0x00007FF778ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-3186-0x00007FF603C80000-0x00007FF604072000-memory.dmp

Filesize
3.9MB

Download
memory/3688-128-0x00007FF603C80000-0x00007FF604072000-memory.dmp

Filesize
3.9MB

Download
memory/3688-3735-0x00007FF603C80000-0x00007FF604072000-memory.dmp

Filesize
3.9MB

Download
memory/4044-3711-0x00007FF6783A0000-0x00007FF678792000-memory.dmp

Filesize
3.9MB

Download
memory/4044-87-0x00007FF6783A0000-0x00007FF678792000-memory.dmp

Filesize
3.9MB

Download
memory/4104-3712-0x00007FF6F4750000-0x00007FF6F4B42000-memory.dmp

Filesize
3.9MB

Download
memory/4104-88-0x00007FF6F4750000-0x00007FF6F4B42000-memory.dmp

Filesize
3.9MB

Download
memory/4228-106-0x00007FF61CAB0000-0x00007FF61CEA2000-memory.dmp

Filesize
3.9MB

Download
memory/4228-3718-0x00007FF61CAB0000-0x00007FF61CEA2000-memory.dmp

Filesize
3.9MB

Download
memory/4340-3716-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp

Filesize
3.9MB

Download
memory/4340-2674-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp

Filesize
3.9MB

Download
memory/4340-89-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-125-0x00007FF77B1E0000-0x00007FF77B5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-3162-0x00007FF77B1E0000-0x00007FF77B5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-3739-0x00007FF77B1E0000-0x00007FF77B5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4440-2847-0x00007FF6ECE20000-0x00007FF6ED212000-memory.dmp

Filesize
3.9MB

Download
memory/4440-118-0x00007FF6ECE20000-0x00007FF6ED212000-memory.dmp

Filesize
3.9MB

Download
memory/4440-3723-0x00007FF6ECE20000-0x00007FF6ED212000-memory.dmp

Filesize
3.9MB

Download
memory/4496-3699-0x00007FF7EF5C0000-0x00007FF7EF9B2000-memory.dmp

Filesize
3.9MB

Download
memory/4496-2662-0x00007FF7EF5C0000-0x00007FF7EF9B2000-memory.dmp

Filesize
3.9MB

Download
memory/4496-63-0x00007FF7EF5C0000-0x00007FF7EF9B2000-memory.dmp

Filesize
3.9MB

Download
memory/4580-3730-0x00007FF6F4BA0000-0x00007FF6F4F92000-memory.dmp

Filesize
3.9MB

Download
memory/4580-122-0x00007FF6F4BA0000-0x00007FF6F4F92000-memory.dmp

Filesize
3.9MB

Download
memory/4580-3146-0x00007FF6F4BA0000-0x00007FF6F4F92000-memory.dmp

Filesize
3.9MB

Download
memory/4796-3754-0x00007FF68E9D0000-0x00007FF68EDC2000-memory.dmp

Filesize
3.9MB

Download
memory/4796-430-0x00007FF68E9D0000-0x00007FF68EDC2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-422-0x00007FF70B1D0000-0x00007FF70B5C2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-3744-0x00007FF70B1D0000-0x00007FF70B5C2000-memory.dmp

Filesize
3.9MB

Download