xmrig | 11e6c00cdd5becce1c7eb3de1e806ca0664594b8492a9fc6a231ba531629ed7d

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3152e01c2caed30e062314ad70229de0N.exe
Size

1.8MB
MD5

3152e01c2caed30e062314ad70229de0
SHA1

40399067b627eebcacd1842870cb7c572ad0cf14
SHA256

11e6c00cdd5becce1c7eb3de1e806ca0664594b8492a9fc6a231ba531629ed7d
SHA512

47d92c73f86a263fd283368a2d460b10608dc4a8338f17fc7468a4bc0e01c30a6515cbd0507510ee35a49555bd3557318da05c7bba0c38459ea97aa03811e564
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pbKYccd/2:NAB+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/2460-234-0x00007FF7F5650000-0x00007FF7F5A42000-memory.dmp	xmrig
behavioral2/memory/4328-210-0x00007FF70CD20000-0x00007FF70D112000-memory.dmp	xmrig
behavioral2/memory/2264-207-0x00007FF6AAC80000-0x00007FF6AB072000-memory.dmp	xmrig
behavioral2/memory/376-137-0x00007FF731BA0000-0x00007FF731F92000-memory.dmp	xmrig
behavioral2/memory/2456-102-0x00007FF625C90000-0x00007FF626082000-memory.dmp	xmrig
behavioral2/memory/876-488-0x00007FF7B4B10000-0x00007FF7B4F02000-memory.dmp	xmrig
behavioral2/memory/3924-565-0x00007FF70CC10000-0x00007FF70D002000-memory.dmp	xmrig
behavioral2/memory/4040-576-0x00007FF62C080000-0x00007FF62C472000-memory.dmp	xmrig
behavioral2/memory/2216-622-0x00007FF7034D0000-0x00007FF7038C2000-memory.dmp	xmrig
behavioral2/memory/4744-624-0x00007FF694970000-0x00007FF694D62000-memory.dmp	xmrig
behavioral2/memory/1036-623-0x00007FF7DECE0000-0x00007FF7DF0D2000-memory.dmp	xmrig
behavioral2/memory/4220-612-0x00007FF7F2190000-0x00007FF7F2582000-memory.dmp	xmrig
behavioral2/memory/3560-564-0x00007FF65A4B0000-0x00007FF65A8A2000-memory.dmp	xmrig
behavioral2/memory/4264-554-0x00007FF708CE0000-0x00007FF7090D2000-memory.dmp	xmrig
behavioral2/memory/2004-432-0x00007FF651D10000-0x00007FF652102000-memory.dmp	xmrig
behavioral2/memory/4156-342-0x00007FF7070A0000-0x00007FF707492000-memory.dmp	xmrig
behavioral2/memory/4864-338-0x00007FF781FF0000-0x00007FF7823E2000-memory.dmp	xmrig
behavioral2/memory/792-289-0x00007FF6DB860000-0x00007FF6DBC52000-memory.dmp	xmrig
behavioral2/memory/2528-285-0x00007FF6B81F0000-0x00007FF6B85E2000-memory.dmp	xmrig
behavioral2/memory/3204-81-0x00007FF673F70000-0x00007FF674362000-memory.dmp	xmrig
behavioral2/memory/3484-40-0x00007FF63DE50000-0x00007FF63E242000-memory.dmp	xmrig
behavioral2/memory/2536-49-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp	xmrig
behavioral2/memory/2536-5167-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp	xmrig
behavioral2/memory/2456-5178-0x00007FF625C90000-0x00007FF626082000-memory.dmp	xmrig
behavioral2/memory/3204-5181-0x00007FF673F70000-0x00007FF674362000-memory.dmp	xmrig
behavioral2/memory/4328-5192-0x00007FF70CD20000-0x00007FF70D112000-memory.dmp	xmrig
behavioral2/memory/376-5189-0x00007FF731BA0000-0x00007FF731F92000-memory.dmp	xmrig
behavioral2/memory/1036-5203-0x00007FF7DECE0000-0x00007FF7DF0D2000-memory.dmp	xmrig
behavioral2/memory/4264-5221-0x00007FF708CE0000-0x00007FF7090D2000-memory.dmp	xmrig
behavioral2/memory/3924-5250-0x00007FF70CC10000-0x00007FF70D002000-memory.dmp	xmrig
behavioral2/memory/876-5259-0x00007FF7B4B10000-0x00007FF7B4F02000-memory.dmp	xmrig
behavioral2/memory/4220-5253-0x00007FF7F2190000-0x00007FF7F2582000-memory.dmp	xmrig
behavioral2/memory/3560-5246-0x00007FF65A4B0000-0x00007FF65A8A2000-memory.dmp	xmrig
behavioral2/memory/4040-5243-0x00007FF62C080000-0x00007FF62C472000-memory.dmp	xmrig
behavioral2/memory/2004-5239-0x00007FF651D10000-0x00007FF652102000-memory.dmp	xmrig
behavioral2/memory/1628-5235-0x00007FF6716A0000-0x00007FF671A92000-memory.dmp	xmrig
behavioral2/memory/4864-5233-0x00007FF781FF0000-0x00007FF7823E2000-memory.dmp	xmrig
behavioral2/memory/792-5229-0x00007FF6DB860000-0x00007FF6DBC52000-memory.dmp	xmrig
behavioral2/memory/2528-5225-0x00007FF6B81F0000-0x00007FF6B85E2000-memory.dmp	xmrig
behavioral2/memory/2460-5217-0x00007FF7F5650000-0x00007FF7F5A42000-memory.dmp	xmrig
behavioral2/memory/4156-5214-0x00007FF7070A0000-0x00007FF707492000-memory.dmp	xmrig
behavioral2/memory/2216-5211-0x00007FF7034D0000-0x00007FF7038C2000-memory.dmp	xmrig
behavioral2/memory/4744-5200-0x00007FF694970000-0x00007FF694D62000-memory.dmp	xmrig
behavioral2/memory/2264-5206-0x00007FF6AAC80000-0x00007FF6AB072000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2680	powershell.exe
5	2680	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2680	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2188	TYroyky.exe
3484	wxqbydR.exe
2536	pUjAmqu.exe
3204	ccWORme.exe
2456	CDJwFrQ.exe
2216	VaRRdUk.exe
376	rRXmvJS.exe
1036	XQbGpoT.exe
1628	bDrspEl.exe
2264	vzKxCrR.exe
4328	TuAZYJe.exe
2460	zBuuEbE.exe
2528	XdMtlHN.exe
792	OtUlKOo.exe
4864	WNVBzTo.exe
4156	lAfFjMr.exe
2004	UeMnGVQ.exe
876	CIFkfZD.exe
4264	cUSQQpj.exe
3560	FWEpPRV.exe
3924	UCYKxKy.exe
4040	wlhRwPQ.exe
4220	wGQNVlR.exe
4744	lsIitxf.exe
4668	efaoYqU.exe
5052	RRNeEgV.exe
1460	YMrThdW.exe
5024	TltMhHy.exe
2896	AlKhGUs.exe
836	rYCOtoK.exe
3124	wMjXqZl.exe
2756	ZrIbXgR.exe
3300	kLCxVme.exe
3592	vOCqvDh.exe
448	oKXQXiS.exe
3792	oldFEMC.exe
2672	mHVtQmc.exe
3800	oeyzIPn.exe
1816	jSDweqO.exe
3324	XVsrXTs.exe
2760	kismhyd.exe
3692	eMZOHHN.exe
2200	ZIeaYPx.exe
4964	lRiqijv.exe
2144	SmIeIkb.exe
968	dFSttNv.exe
2012	sNpbuCZ.exe
3652	uyhtrAx.exe
4080	HmtWrUB.exe
1468	ZzCHgVE.exe
4024	OshDMJx.exe
1484	MnboIkq.exe
1436	eHfCteX.exe
3372	ZPxctEN.exe
2156	OJOMjQO.exe
2808	fyqxAMA.exe
2024	MlCqppZ.exe
4796	gGHCJUG.exe
2844	FEdptsp.exe
4980	mNmdDPN.exe
1492	AWyeNZM.exe
2728	oHPHYbF.exe
3136	xZfFOFI.exe
4476	ZOXzcaY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3684-0-0x00007FF712D30000-0x00007FF713122000-memory.dmp	upx
behavioral2/files/0x000800000002347e-5.dat	upx
behavioral2/files/0x000700000002348b-61.dat	upx
behavioral2/files/0x000700000002348c-88.dat	upx
behavioral2/files/0x000700000002349b-190.dat	upx
behavioral2/memory/2460-234-0x00007FF7F5650000-0x00007FF7F5A42000-memory.dmp	upx
behavioral2/memory/4328-210-0x00007FF70CD20000-0x00007FF70D112000-memory.dmp	upx
behavioral2/memory/2264-207-0x00007FF6AAC80000-0x00007FF6AB072000-memory.dmp	upx
behavioral2/files/0x000700000002348e-192.dat	upx
behavioral2/files/0x00070000000234a5-189.dat	upx
behavioral2/files/0x0008000000023482-188.dat	upx
behavioral2/memory/1628-184-0x00007FF6716A0000-0x00007FF671A92000-memory.dmp	upx
behavioral2/files/0x00070000000234a3-178.dat	upx
behavioral2/files/0x00070000000234a1-175.dat	upx
behavioral2/files/0x00070000000234a0-171.dat	upx
behavioral2/files/0x000700000002349e-167.dat	upx
behavioral2/files/0x0007000000023490-163.dat	upx
behavioral2/files/0x0007000000023499-160.dat	upx
behavioral2/files/0x0007000000023498-156.dat	upx
behavioral2/files/0x0007000000023497-155.dat	upx
behavioral2/files/0x000700000002349d-153.dat	upx
behavioral2/files/0x000700000002349c-151.dat	upx
behavioral2/files/0x0007000000023494-146.dat	upx
behavioral2/files/0x0007000000023492-142.dat	upx
behavioral2/files/0x00070000000234a4-187.dat	upx
behavioral2/memory/376-137-0x00007FF731BA0000-0x00007FF731F92000-memory.dmp	upx
behavioral2/files/0x00070000000234a2-176.dat	upx
behavioral2/files/0x000700000002349f-170.dat	upx
behavioral2/files/0x000700000002348f-120.dat	upx
behavioral2/files/0x0007000000023496-118.dat	upx
behavioral2/files/0x0007000000023495-117.dat	upx
behavioral2/files/0x000700000002348d-115.dat	upx
behavioral2/files/0x0007000000023493-111.dat	upx
behavioral2/files/0x000700000002348a-110.dat	upx
behavioral2/files/0x0007000000023489-104.dat	upx
behavioral2/files/0x0007000000023491-131.dat	upx
behavioral2/memory/2456-102-0x00007FF625C90000-0x00007FF626082000-memory.dmp	upx
behavioral2/memory/876-488-0x00007FF7B4B10000-0x00007FF7B4F02000-memory.dmp	upx
behavioral2/memory/3924-565-0x00007FF70CC10000-0x00007FF70D002000-memory.dmp	upx
behavioral2/memory/4040-576-0x00007FF62C080000-0x00007FF62C472000-memory.dmp	upx
behavioral2/memory/2216-622-0x00007FF7034D0000-0x00007FF7038C2000-memory.dmp	upx
behavioral2/memory/4744-624-0x00007FF694970000-0x00007FF694D62000-memory.dmp	upx
behavioral2/memory/1036-623-0x00007FF7DECE0000-0x00007FF7DF0D2000-memory.dmp	upx
behavioral2/memory/4220-612-0x00007FF7F2190000-0x00007FF7F2582000-memory.dmp	upx
behavioral2/memory/3560-564-0x00007FF65A4B0000-0x00007FF65A8A2000-memory.dmp	upx
behavioral2/memory/4264-554-0x00007FF708CE0000-0x00007FF7090D2000-memory.dmp	upx
behavioral2/memory/2004-432-0x00007FF651D10000-0x00007FF652102000-memory.dmp	upx
behavioral2/memory/4156-342-0x00007FF7070A0000-0x00007FF707492000-memory.dmp	upx
behavioral2/memory/4864-338-0x00007FF781FF0000-0x00007FF7823E2000-memory.dmp	upx
behavioral2/memory/792-289-0x00007FF6DB860000-0x00007FF6DBC52000-memory.dmp	upx
behavioral2/memory/2528-285-0x00007FF6B81F0000-0x00007FF6B85E2000-memory.dmp	upx
behavioral2/files/0x000700000002349a-105.dat	upx
behavioral2/memory/3204-81-0x00007FF673F70000-0x00007FF674362000-memory.dmp	upx
behavioral2/files/0x0007000000023487-62.dat	upx
behavioral2/files/0x0007000000023488-84.dat	upx
behavioral2/files/0x0007000000023485-43.dat	upx
behavioral2/memory/3484-40-0x00007FF63DE50000-0x00007FF63E242000-memory.dmp	upx
behavioral2/memory/2536-49-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp	upx
behavioral2/files/0x0007000000023486-48.dat	upx
behavioral2/files/0x0008000000023484-30.dat	upx
behavioral2/files/0x0008000000023481-19.dat	upx
behavioral2/memory/2188-12-0x00007FF74E2C0000-0x00007FF74E6B2000-memory.dmp	upx
behavioral2/memory/2536-5167-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp	upx
behavioral2/memory/2456-5178-0x00007FF625C90000-0x00007FF626082000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qccUXpP.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\BwBDESx.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\VeHlwCm.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\QJXKbdo.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\RenuTte.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\lNsQQGo.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\lLTarlU.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\DKeaBQe.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\OUMyZgQ.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\AwzhbSj.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\mgapWEa.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\PrDaHHj.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\enclttA.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\hLQtmUa.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\ehNIkbe.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\MWzPPPM.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\yWesyBs.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\dQpAwsZ.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\zHbtviQ.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\fibRTvQ.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\mEfYRVY.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\tkzxRcd.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\hdiaWZi.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\rxGFAwH.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\hbFwIYh.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\SNuMfJw.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\JPUgYce.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\lXuOrNg.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\hlRbWhI.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\riEBOJI.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\KrIOFZL.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\dBUpzoH.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\YOPxigI.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\OxUmYQS.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\noImgNC.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\VIfxrdH.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\iagdaBf.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\VqvXNFK.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\uzhNJts.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\oITwheL.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\Xgbcgbq.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\FwhCmRy.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\glAIKKP.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\AlApuNp.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\ccXcUKE.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\XtqEGlh.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\pwsWdhz.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\cJGhEvx.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\bkcIBte.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\TDqmuFc.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\cuAHaOl.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\vDCwQgP.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\doZifpy.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\DGgZhJL.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\efXBLXa.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\DWSCnIN.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\UVMBMhD.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\koNimop.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\SCAuFFe.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\utICqyD.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\VwoQqaz.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\ZmTpYvr.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\LovNjBr.exe	3152e01c2caed30e062314ad70229de0N.exe
File created	C:\Windows\System\jjUSDCb.exe	3152e01c2caed30e062314ad70229de0N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2680	powershell.exe
2680	powershell.exe
2680	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeLockMemoryPrivilege	3684	3152e01c2caed30e062314ad70229de0N.exe
Token: SeLockMemoryPrivilege	3684	3152e01c2caed30e062314ad70229de0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 2680	3684	3152e01c2caed30e062314ad70229de0N.exe	83
PID 3684 wrote to memory of 2680	3684	3152e01c2caed30e062314ad70229de0N.exe	83
PID 3684 wrote to memory of 2188	3684	3152e01c2caed30e062314ad70229de0N.exe	84
PID 3684 wrote to memory of 2188	3684	3152e01c2caed30e062314ad70229de0N.exe	84
PID 3684 wrote to memory of 3484	3684	3152e01c2caed30e062314ad70229de0N.exe	85
PID 3684 wrote to memory of 3484	3684	3152e01c2caed30e062314ad70229de0N.exe	85
PID 3684 wrote to memory of 2536	3684	3152e01c2caed30e062314ad70229de0N.exe	86
PID 3684 wrote to memory of 2536	3684	3152e01c2caed30e062314ad70229de0N.exe	86
PID 3684 wrote to memory of 3204	3684	3152e01c2caed30e062314ad70229de0N.exe	87
PID 3684 wrote to memory of 3204	3684	3152e01c2caed30e062314ad70229de0N.exe	87
PID 3684 wrote to memory of 2456	3684	3152e01c2caed30e062314ad70229de0N.exe	88
PID 3684 wrote to memory of 2456	3684	3152e01c2caed30e062314ad70229de0N.exe	88
PID 3684 wrote to memory of 376	3684	3152e01c2caed30e062314ad70229de0N.exe	89
PID 3684 wrote to memory of 376	3684	3152e01c2caed30e062314ad70229de0N.exe	89
PID 3684 wrote to memory of 2216	3684	3152e01c2caed30e062314ad70229de0N.exe	90
PID 3684 wrote to memory of 2216	3684	3152e01c2caed30e062314ad70229de0N.exe	90
PID 3684 wrote to memory of 1036	3684	3152e01c2caed30e062314ad70229de0N.exe	91
PID 3684 wrote to memory of 1036	3684	3152e01c2caed30e062314ad70229de0N.exe	91
PID 3684 wrote to memory of 1628	3684	3152e01c2caed30e062314ad70229de0N.exe	92
PID 3684 wrote to memory of 1628	3684	3152e01c2caed30e062314ad70229de0N.exe	92
PID 3684 wrote to memory of 2264	3684	3152e01c2caed30e062314ad70229de0N.exe	93
PID 3684 wrote to memory of 2264	3684	3152e01c2caed30e062314ad70229de0N.exe	93
PID 3684 wrote to memory of 4328	3684	3152e01c2caed30e062314ad70229de0N.exe	94
PID 3684 wrote to memory of 4328	3684	3152e01c2caed30e062314ad70229de0N.exe	94
PID 3684 wrote to memory of 2460	3684	3152e01c2caed30e062314ad70229de0N.exe	95
PID 3684 wrote to memory of 2460	3684	3152e01c2caed30e062314ad70229de0N.exe	95
PID 3684 wrote to memory of 876	3684	3152e01c2caed30e062314ad70229de0N.exe	96
PID 3684 wrote to memory of 876	3684	3152e01c2caed30e062314ad70229de0N.exe	96
PID 3684 wrote to memory of 2528	3684	3152e01c2caed30e062314ad70229de0N.exe	97
PID 3684 wrote to memory of 2528	3684	3152e01c2caed30e062314ad70229de0N.exe	97
PID 3684 wrote to memory of 3924	3684	3152e01c2caed30e062314ad70229de0N.exe	98
PID 3684 wrote to memory of 3924	3684	3152e01c2caed30e062314ad70229de0N.exe	98
PID 3684 wrote to memory of 792	3684	3152e01c2caed30e062314ad70229de0N.exe	99
PID 3684 wrote to memory of 792	3684	3152e01c2caed30e062314ad70229de0N.exe	99
PID 3684 wrote to memory of 4864	3684	3152e01c2caed30e062314ad70229de0N.exe	100
PID 3684 wrote to memory of 4864	3684	3152e01c2caed30e062314ad70229de0N.exe	100
PID 3684 wrote to memory of 4156	3684	3152e01c2caed30e062314ad70229de0N.exe	101
PID 3684 wrote to memory of 4156	3684	3152e01c2caed30e062314ad70229de0N.exe	101
PID 3684 wrote to memory of 2004	3684	3152e01c2caed30e062314ad70229de0N.exe	102
PID 3684 wrote to memory of 2004	3684	3152e01c2caed30e062314ad70229de0N.exe	102
PID 3684 wrote to memory of 5052	3684	3152e01c2caed30e062314ad70229de0N.exe	103
PID 3684 wrote to memory of 5052	3684	3152e01c2caed30e062314ad70229de0N.exe	103
PID 3684 wrote to memory of 4264	3684	3152e01c2caed30e062314ad70229de0N.exe	104
PID 3684 wrote to memory of 4264	3684	3152e01c2caed30e062314ad70229de0N.exe	104
PID 3684 wrote to memory of 3560	3684	3152e01c2caed30e062314ad70229de0N.exe	105
PID 3684 wrote to memory of 3560	3684	3152e01c2caed30e062314ad70229de0N.exe	105
PID 3684 wrote to memory of 4040	3684	3152e01c2caed30e062314ad70229de0N.exe	106
PID 3684 wrote to memory of 4040	3684	3152e01c2caed30e062314ad70229de0N.exe	106
PID 3684 wrote to memory of 4220	3684	3152e01c2caed30e062314ad70229de0N.exe	107
PID 3684 wrote to memory of 4220	3684	3152e01c2caed30e062314ad70229de0N.exe	107
PID 3684 wrote to memory of 4744	3684	3152e01c2caed30e062314ad70229de0N.exe	108
PID 3684 wrote to memory of 4744	3684	3152e01c2caed30e062314ad70229de0N.exe	108
PID 3684 wrote to memory of 4668	3684	3152e01c2caed30e062314ad70229de0N.exe	109
PID 3684 wrote to memory of 4668	3684	3152e01c2caed30e062314ad70229de0N.exe	109
PID 3684 wrote to memory of 1460	3684	3152e01c2caed30e062314ad70229de0N.exe	110
PID 3684 wrote to memory of 1460	3684	3152e01c2caed30e062314ad70229de0N.exe	110
PID 3684 wrote to memory of 5024	3684	3152e01c2caed30e062314ad70229de0N.exe	111
PID 3684 wrote to memory of 5024	3684	3152e01c2caed30e062314ad70229de0N.exe	111
PID 3684 wrote to memory of 2896	3684	3152e01c2caed30e062314ad70229de0N.exe	112
PID 3684 wrote to memory of 2896	3684	3152e01c2caed30e062314ad70229de0N.exe	112
PID 3684 wrote to memory of 836	3684	3152e01c2caed30e062314ad70229de0N.exe	113
PID 3684 wrote to memory of 836	3684	3152e01c2caed30e062314ad70229de0N.exe	113
PID 3684 wrote to memory of 3124	3684	3152e01c2caed30e062314ad70229de0N.exe	114
PID 3684 wrote to memory of 3124	3684	3152e01c2caed30e062314ad70229de0N.exe	114

C:\Users\Admin\AppData\Local\Temp\3152e01c2caed30e062314ad70229de0N.exe
"C:\Users\Admin\AppData\Local\Temp\3152e01c2caed30e062314ad70229de0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2680" "2988" "2924" "2992" "0" "0" "2996" "0" "0" "0" "0" "0"
    3⤵
    PID:12824
- C:\Windows\System\TYroyky.exe
  C:\Windows\System\TYroyky.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\wxqbydR.exe
  C:\Windows\System\wxqbydR.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\pUjAmqu.exe
  C:\Windows\System\pUjAmqu.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\ccWORme.exe
  C:\Windows\System\ccWORme.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\CDJwFrQ.exe
  C:\Windows\System\CDJwFrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\rRXmvJS.exe
  C:\Windows\System\rRXmvJS.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\VaRRdUk.exe
  C:\Windows\System\VaRRdUk.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\XQbGpoT.exe
  C:\Windows\System\XQbGpoT.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\bDrspEl.exe
  C:\Windows\System\bDrspEl.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\vzKxCrR.exe
  C:\Windows\System\vzKxCrR.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\TuAZYJe.exe
  C:\Windows\System\TuAZYJe.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\zBuuEbE.exe
  C:\Windows\System\zBuuEbE.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\CIFkfZD.exe
  C:\Windows\System\CIFkfZD.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\XdMtlHN.exe
  C:\Windows\System\XdMtlHN.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\UCYKxKy.exe
  C:\Windows\System\UCYKxKy.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\OtUlKOo.exe
  C:\Windows\System\OtUlKOo.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\WNVBzTo.exe
  C:\Windows\System\WNVBzTo.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\lAfFjMr.exe
  C:\Windows\System\lAfFjMr.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\UeMnGVQ.exe
  C:\Windows\System\UeMnGVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\RRNeEgV.exe
  C:\Windows\System\RRNeEgV.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\cUSQQpj.exe
  C:\Windows\System\cUSQQpj.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\FWEpPRV.exe
  C:\Windows\System\FWEpPRV.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\wlhRwPQ.exe
  C:\Windows\System\wlhRwPQ.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\wGQNVlR.exe
  C:\Windows\System\wGQNVlR.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\lsIitxf.exe
  C:\Windows\System\lsIitxf.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\efaoYqU.exe
  C:\Windows\System\efaoYqU.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\YMrThdW.exe
  C:\Windows\System\YMrThdW.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\TltMhHy.exe
  C:\Windows\System\TltMhHy.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\AlKhGUs.exe
  C:\Windows\System\AlKhGUs.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\rYCOtoK.exe
  C:\Windows\System\rYCOtoK.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\wMjXqZl.exe
  C:\Windows\System\wMjXqZl.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\ZrIbXgR.exe
  C:\Windows\System\ZrIbXgR.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\kLCxVme.exe
  C:\Windows\System\kLCxVme.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\vOCqvDh.exe
  C:\Windows\System\vOCqvDh.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\oKXQXiS.exe
  C:\Windows\System\oKXQXiS.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\oldFEMC.exe
  C:\Windows\System\oldFEMC.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\mHVtQmc.exe
  C:\Windows\System\mHVtQmc.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\oeyzIPn.exe
  C:\Windows\System\oeyzIPn.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\jSDweqO.exe
  C:\Windows\System\jSDweqO.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\XVsrXTs.exe
  C:\Windows\System\XVsrXTs.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\kismhyd.exe
  C:\Windows\System\kismhyd.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\eMZOHHN.exe
  C:\Windows\System\eMZOHHN.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\ZIeaYPx.exe
  C:\Windows\System\ZIeaYPx.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\lRiqijv.exe
  C:\Windows\System\lRiqijv.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\SmIeIkb.exe
  C:\Windows\System\SmIeIkb.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\dFSttNv.exe
  C:\Windows\System\dFSttNv.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\sNpbuCZ.exe
  C:\Windows\System\sNpbuCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\uyhtrAx.exe
  C:\Windows\System\uyhtrAx.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\HmtWrUB.exe
  C:\Windows\System\HmtWrUB.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\ZzCHgVE.exe
  C:\Windows\System\ZzCHgVE.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\OshDMJx.exe
  C:\Windows\System\OshDMJx.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\WdZaCNK.exe
  C:\Windows\System\WdZaCNK.exe
  2⤵
  PID:2736
- C:\Windows\System\MnboIkq.exe
  C:\Windows\System\MnboIkq.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\eHfCteX.exe
  C:\Windows\System\eHfCteX.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\ZPxctEN.exe
  C:\Windows\System\ZPxctEN.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\OJOMjQO.exe
  C:\Windows\System\OJOMjQO.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\fyqxAMA.exe
  C:\Windows\System\fyqxAMA.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\MlCqppZ.exe
  C:\Windows\System\MlCqppZ.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\gGHCJUG.exe
  C:\Windows\System\gGHCJUG.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\FEdptsp.exe
  C:\Windows\System\FEdptsp.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\mNmdDPN.exe
  C:\Windows\System\mNmdDPN.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\AWyeNZM.exe
  C:\Windows\System\AWyeNZM.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\oHPHYbF.exe
  C:\Windows\System\oHPHYbF.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\xZfFOFI.exe
  C:\Windows\System\xZfFOFI.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\ZOXzcaY.exe
  C:\Windows\System\ZOXzcaY.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\mEfYRVY.exe
  C:\Windows\System\mEfYRVY.exe
  2⤵
  PID:4472
- C:\Windows\System\kXwqmrn.exe
  C:\Windows\System\kXwqmrn.exe
  2⤵
  PID:2648
- C:\Windows\System\RuJwArj.exe
  C:\Windows\System\RuJwArj.exe
  2⤵
  PID:2940
- C:\Windows\System\CZhwWFu.exe
  C:\Windows\System\CZhwWFu.exe
  2⤵
  PID:1048
- C:\Windows\System\qmTgtke.exe
  C:\Windows\System\qmTgtke.exe
  2⤵
  PID:1568
- C:\Windows\System\thYpCBo.exe
  C:\Windows\System\thYpCBo.exe
  2⤵
  PID:1104
- C:\Windows\System\ulBwUpB.exe
  C:\Windows\System\ulBwUpB.exe
  2⤵
  PID:2068
- C:\Windows\System\fpcPHfX.exe
  C:\Windows\System\fpcPHfX.exe
  2⤵
  PID:996
- C:\Windows\System\QrXyKVQ.exe
  C:\Windows\System\QrXyKVQ.exe
  2⤵
  PID:4108
- C:\Windows\System\DWSCnIN.exe
  C:\Windows\System\DWSCnIN.exe
  2⤵
  PID:2724
- C:\Windows\System\KfXwjsm.exe
  C:\Windows\System\KfXwjsm.exe
  2⤵
  PID:1396
- C:\Windows\System\jWdmWji.exe
  C:\Windows\System\jWdmWji.exe
  2⤵
  PID:4724
- C:\Windows\System\thLWmSE.exe
  C:\Windows\System\thLWmSE.exe
  2⤵
  PID:5064
- C:\Windows\System\DItZkyI.exe
  C:\Windows\System\DItZkyI.exe
  2⤵
  PID:60
- C:\Windows\System\UlyUPHe.exe
  C:\Windows\System\UlyUPHe.exe
  2⤵
  PID:5000
- C:\Windows\System\lcAwrsZ.exe
  C:\Windows\System\lcAwrsZ.exe
  2⤵
  PID:2876
- C:\Windows\System\YiWFUFJ.exe
  C:\Windows\System\YiWFUFJ.exe
  2⤵
  PID:388
- C:\Windows\System\PeSDCla.exe
  C:\Windows\System\PeSDCla.exe
  2⤵
  PID:4680
- C:\Windows\System\dOEjKVq.exe
  C:\Windows\System\dOEjKVq.exe
  2⤵
  PID:828
- C:\Windows\System\ikMLfnY.exe
  C:\Windows\System\ikMLfnY.exe
  2⤵
  PID:2228
- C:\Windows\System\dHKnWrQ.exe
  C:\Windows\System\dHKnWrQ.exe
  2⤵
  PID:2428
- C:\Windows\System\OaXvMoA.exe
  C:\Windows\System\OaXvMoA.exe
  2⤵
  PID:2384
- C:\Windows\System\Jnxevsi.exe
  C:\Windows\System\Jnxevsi.exe
  2⤵
  PID:1412
- C:\Windows\System\XfgCisJ.exe
  C:\Windows\System\XfgCisJ.exe
  2⤵
  PID:5140
- C:\Windows\System\iHehXXY.exe
  C:\Windows\System\iHehXXY.exe
  2⤵
  PID:5156
- C:\Windows\System\noJYEaG.exe
  C:\Windows\System\noJYEaG.exe
  2⤵
  PID:5176
- C:\Windows\System\ZMgrLJk.exe
  C:\Windows\System\ZMgrLJk.exe
  2⤵
  PID:5192
- C:\Windows\System\PaOiLcy.exe
  C:\Windows\System\PaOiLcy.exe
  2⤵
  PID:5208
- C:\Windows\System\siPAETm.exe
  C:\Windows\System\siPAETm.exe
  2⤵
  PID:5228
- C:\Windows\System\dWuKesq.exe
  C:\Windows\System\dWuKesq.exe
  2⤵
  PID:5248
- C:\Windows\System\kBIMNlZ.exe
  C:\Windows\System\kBIMNlZ.exe
  2⤵
  PID:5272
- C:\Windows\System\KIGYEfb.exe
  C:\Windows\System\KIGYEfb.exe
  2⤵
  PID:5288
- C:\Windows\System\VpGAMbB.exe
  C:\Windows\System\VpGAMbB.exe
  2⤵
  PID:5312
- C:\Windows\System\QWDnaQL.exe
  C:\Windows\System\QWDnaQL.exe
  2⤵
  PID:5328
- C:\Windows\System\pDXPcMl.exe
  C:\Windows\System\pDXPcMl.exe
  2⤵
  PID:5348
- C:\Windows\System\mTTUhDR.exe
  C:\Windows\System\mTTUhDR.exe
  2⤵
  PID:5368
- C:\Windows\System\vpFYevv.exe
  C:\Windows\System\vpFYevv.exe
  2⤵
  PID:5388
- C:\Windows\System\ujaKCxw.exe
  C:\Windows\System\ujaKCxw.exe
  2⤵
  PID:5412
- C:\Windows\System\saimlNS.exe
  C:\Windows\System\saimlNS.exe
  2⤵
  PID:5428
- C:\Windows\System\uZZyGnM.exe
  C:\Windows\System\uZZyGnM.exe
  2⤵
  PID:5448
- C:\Windows\System\naIFEkD.exe
  C:\Windows\System\naIFEkD.exe
  2⤵
  PID:5476
- C:\Windows\System\pODuzpe.exe
  C:\Windows\System\pODuzpe.exe
  2⤵
  PID:5496
- C:\Windows\System\fvkOVin.exe
  C:\Windows\System\fvkOVin.exe
  2⤵
  PID:5512
- C:\Windows\System\wUZRyTf.exe
  C:\Windows\System\wUZRyTf.exe
  2⤵
  PID:5536
- C:\Windows\System\eeJXsuc.exe
  C:\Windows\System\eeJXsuc.exe
  2⤵
  PID:5560
- C:\Windows\System\giBtWCH.exe
  C:\Windows\System\giBtWCH.exe
  2⤵
  PID:5580
- C:\Windows\System\gQpfQca.exe
  C:\Windows\System\gQpfQca.exe
  2⤵
  PID:5604
- C:\Windows\System\uPLdAMJ.exe
  C:\Windows\System\uPLdAMJ.exe
  2⤵
  PID:5624
- C:\Windows\System\BBaUDgm.exe
  C:\Windows\System\BBaUDgm.exe
  2⤵
  PID:5684
- C:\Windows\System\CIWbzPo.exe
  C:\Windows\System\CIWbzPo.exe
  2⤵
  PID:5700
- C:\Windows\System\CYzmtGG.exe
  C:\Windows\System\CYzmtGG.exe
  2⤵
  PID:5716
- C:\Windows\System\ZZvFLJh.exe
  C:\Windows\System\ZZvFLJh.exe
  2⤵
  PID:5736
- C:\Windows\System\RIsvqQW.exe
  C:\Windows\System\RIsvqQW.exe
  2⤵
  PID:5752
- C:\Windows\System\NGYPBfC.exe
  C:\Windows\System\NGYPBfC.exe
  2⤵
  PID:5768
- C:\Windows\System\dSyiLEF.exe
  C:\Windows\System\dSyiLEF.exe
  2⤵
  PID:5784
- C:\Windows\System\LjrjURj.exe
  C:\Windows\System\LjrjURj.exe
  2⤵
  PID:5800
- C:\Windows\System\EDUJxRw.exe
  C:\Windows\System\EDUJxRw.exe
  2⤵
  PID:5824
- C:\Windows\System\iwfWIcg.exe
  C:\Windows\System\iwfWIcg.exe
  2⤵
  PID:5856
- C:\Windows\System\NFimigl.exe
  C:\Windows\System\NFimigl.exe
  2⤵
  PID:5888
- C:\Windows\System\WquvbMU.exe
  C:\Windows\System\WquvbMU.exe
  2⤵
  PID:5904
- C:\Windows\System\botRfyt.exe
  C:\Windows\System\botRfyt.exe
  2⤵
  PID:5924
- C:\Windows\System\RRdOGru.exe
  C:\Windows\System\RRdOGru.exe
  2⤵
  PID:5944
- C:\Windows\System\fFFJUJc.exe
  C:\Windows\System\fFFJUJc.exe
  2⤵
  PID:5964
- C:\Windows\System\siepdPZ.exe
  C:\Windows\System\siepdPZ.exe
  2⤵
  PID:5988
- C:\Windows\System\WbYyoOU.exe
  C:\Windows\System\WbYyoOU.exe
  2⤵
  PID:6004
- C:\Windows\System\euIyKtG.exe
  C:\Windows\System\euIyKtG.exe
  2⤵
  PID:6028
- C:\Windows\System\qqipgLS.exe
  C:\Windows\System\qqipgLS.exe
  2⤵
  PID:6060
- C:\Windows\System\iTNuMot.exe
  C:\Windows\System\iTNuMot.exe
  2⤵
  PID:6080
- C:\Windows\System\NkwcZrW.exe
  C:\Windows\System\NkwcZrW.exe
  2⤵
  PID:6096
- C:\Windows\System\KAwNaec.exe
  C:\Windows\System\KAwNaec.exe
  2⤵
  PID:6116
- C:\Windows\System\ozaMsUp.exe
  C:\Windows\System\ozaMsUp.exe
  2⤵
  PID:6132
- C:\Windows\System\bNeRoSc.exe
  C:\Windows\System\bNeRoSc.exe
  2⤵
  PID:2880
- C:\Windows\System\bkjbrFV.exe
  C:\Windows\System\bkjbrFV.exe
  2⤵
  PID:4516
- C:\Windows\System\aHEAnNp.exe
  C:\Windows\System\aHEAnNp.exe
  2⤵
  PID:4152
- C:\Windows\System\ubhCVBQ.exe
  C:\Windows\System\ubhCVBQ.exe
  2⤵
  PID:4440
- C:\Windows\System\mgapWEa.exe
  C:\Windows\System\mgapWEa.exe
  2⤵
  PID:404
- C:\Windows\System\oHrBEqL.exe
  C:\Windows\System\oHrBEqL.exe
  2⤵
  PID:5128
- C:\Windows\System\TofvKmu.exe
  C:\Windows\System\TofvKmu.exe
  2⤵
  PID:4460
- C:\Windows\System\JCLgELS.exe
  C:\Windows\System\JCLgELS.exe
  2⤵
  PID:5260
- C:\Windows\System\JwlPJhZ.exe
  C:\Windows\System\JwlPJhZ.exe
  2⤵
  PID:5384
- C:\Windows\System\CEmXVAc.exe
  C:\Windows\System\CEmXVAc.exe
  2⤵
  PID:6160
- C:\Windows\System\wrLPTfK.exe
  C:\Windows\System\wrLPTfK.exe
  2⤵
  PID:6176
- C:\Windows\System\tMRfLfv.exe
  C:\Windows\System\tMRfLfv.exe
  2⤵
  PID:6204
- C:\Windows\System\SRljREa.exe
  C:\Windows\System\SRljREa.exe
  2⤵
  PID:6220
- C:\Windows\System\xKFJQlj.exe
  C:\Windows\System\xKFJQlj.exe
  2⤵
  PID:6248
- C:\Windows\System\tyXALFo.exe
  C:\Windows\System\tyXALFo.exe
  2⤵
  PID:6264
- C:\Windows\System\NDJwJph.exe
  C:\Windows\System\NDJwJph.exe
  2⤵
  PID:6288
- C:\Windows\System\FViytDK.exe
  C:\Windows\System\FViytDK.exe
  2⤵
  PID:6304
- C:\Windows\System\ZoDrsKt.exe
  C:\Windows\System\ZoDrsKt.exe
  2⤵
  PID:6320
- C:\Windows\System\MkzbThv.exe
  C:\Windows\System\MkzbThv.exe
  2⤵
  PID:6412
- C:\Windows\System\HFKiDml.exe
  C:\Windows\System\HFKiDml.exe
  2⤵
  PID:6428
- C:\Windows\System\krlBxWW.exe
  C:\Windows\System\krlBxWW.exe
  2⤵
  PID:6448
- C:\Windows\System\CZfCdHV.exe
  C:\Windows\System\CZfCdHV.exe
  2⤵
  PID:6468
- C:\Windows\System\CDeBVnH.exe
  C:\Windows\System\CDeBVnH.exe
  2⤵
  PID:6488
- C:\Windows\System\mffLkVf.exe
  C:\Windows\System\mffLkVf.exe
  2⤵
  PID:6512
- C:\Windows\System\FjnlDJo.exe
  C:\Windows\System\FjnlDJo.exe
  2⤵
  PID:6532
- C:\Windows\System\Psnaxuq.exe
  C:\Windows\System\Psnaxuq.exe
  2⤵
  PID:6552
- C:\Windows\System\bVHTlXP.exe
  C:\Windows\System\bVHTlXP.exe
  2⤵
  PID:6572
- C:\Windows\System\eiKcSdd.exe
  C:\Windows\System\eiKcSdd.exe
  2⤵
  PID:6592
- C:\Windows\System\xgkkPBr.exe
  C:\Windows\System\xgkkPBr.exe
  2⤵
  PID:6612
- C:\Windows\System\WTcIYin.exe
  C:\Windows\System\WTcIYin.exe
  2⤵
  PID:6636
- C:\Windows\System\NSjbCIF.exe
  C:\Windows\System\NSjbCIF.exe
  2⤵
  PID:6652
- C:\Windows\System\vMLeLKH.exe
  C:\Windows\System\vMLeLKH.exe
  2⤵
  PID:6676
- C:\Windows\System\dOwWiEv.exe
  C:\Windows\System\dOwWiEv.exe
  2⤵
  PID:6696
- C:\Windows\System\CwSJhDS.exe
  C:\Windows\System\CwSJhDS.exe
  2⤵
  PID:6716
- C:\Windows\System\nsvDYUm.exe
  C:\Windows\System\nsvDYUm.exe
  2⤵
  PID:6736
- C:\Windows\System\BkHcOta.exe
  C:\Windows\System\BkHcOta.exe
  2⤵
  PID:6760
- C:\Windows\System\delxYpM.exe
  C:\Windows\System\delxYpM.exe
  2⤵
  PID:6780
- C:\Windows\System\QBKoaER.exe
  C:\Windows\System\QBKoaER.exe
  2⤵
  PID:6800
- C:\Windows\System\tFaGAul.exe
  C:\Windows\System\tFaGAul.exe
  2⤵
  PID:6816
- C:\Windows\System\AGcBqPE.exe
  C:\Windows\System\AGcBqPE.exe
  2⤵
  PID:6840
- C:\Windows\System\jHGjQlx.exe
  C:\Windows\System\jHGjQlx.exe
  2⤵
  PID:6864
- C:\Windows\System\cvdePMj.exe
  C:\Windows\System\cvdePMj.exe
  2⤵
  PID:6880
- C:\Windows\System\dVPMOOl.exe
  C:\Windows\System\dVPMOOl.exe
  2⤵
  PID:7040
- C:\Windows\System\fanWHcb.exe
  C:\Windows\System\fanWHcb.exe
  2⤵
  PID:5872
- C:\Windows\System\AbWQawS.exe
  C:\Windows\System\AbWQawS.exe
  2⤵
  PID:5820
- C:\Windows\System\WGqwZbM.exe
  C:\Windows\System\WGqwZbM.exe
  2⤵
  PID:5780
- C:\Windows\System\jqEeuio.exe
  C:\Windows\System\jqEeuio.exe
  2⤵
  PID:4588
- C:\Windows\System\GKixsqV.exe
  C:\Windows\System\GKixsqV.exe
  2⤵
  PID:5724
- C:\Windows\System\HmlMmeS.exe
  C:\Windows\System\HmlMmeS.exe
  2⤵
  PID:5692
- C:\Windows\System\pljpWWT.exe
  C:\Windows\System\pljpWWT.exe
  2⤵
  PID:6056
- C:\Windows\System\bTDLTbA.exe
  C:\Windows\System\bTDLTbA.exe
  2⤵
  PID:6092
- C:\Windows\System\qLsDizI.exe
  C:\Windows\System\qLsDizI.exe
  2⤵
  PID:6128
- C:\Windows\System\hEJjLHJ.exe
  C:\Windows\System\hEJjLHJ.exe
  2⤵
  PID:2560
- C:\Windows\System\vAZkLQG.exe
  C:\Windows\System\vAZkLQG.exe
  2⤵
  PID:5356
- C:\Windows\System\DoZoiiO.exe
  C:\Windows\System\DoZoiiO.exe
  2⤵
  PID:6316
- C:\Windows\System\YteOTMc.exe
  C:\Windows\System\YteOTMc.exe
  2⤵
  PID:6436
- C:\Windows\System\nQxSNNt.exe
  C:\Windows\System\nQxSNNt.exe
  2⤵
  PID:6500
- C:\Windows\System\heAtAOO.exe
  C:\Windows\System\heAtAOO.exe
  2⤵
  PID:6528
- C:\Windows\System\aKUOIyG.exe
  C:\Windows\System\aKUOIyG.exe
  2⤵
  PID:6932
- C:\Windows\System\PVUOUka.exe
  C:\Windows\System\PVUOUka.exe
  2⤵
  PID:7016
- C:\Windows\System\oFwoWin.exe
  C:\Windows\System\oFwoWin.exe
  2⤵
  PID:7076
- C:\Windows\System\sNuUTqx.exe
  C:\Windows\System\sNuUTqx.exe
  2⤵
  PID:2588
- C:\Windows\System\bkWMZbr.exe
  C:\Windows\System\bkWMZbr.exe
  2⤵
  PID:2476
- C:\Windows\System\BUfcxyG.exe
  C:\Windows\System\BUfcxyG.exe
  2⤵
  PID:3896
- C:\Windows\System\EIiGXdN.exe
  C:\Windows\System\EIiGXdN.exe
  2⤵
  PID:216
- C:\Windows\System\KQAqFPf.exe
  C:\Windows\System\KQAqFPf.exe
  2⤵
  PID:5256
- C:\Windows\System\XzqjMDo.exe
  C:\Windows\System\XzqjMDo.exe
  2⤵
  PID:6240
- C:\Windows\System\jpdOyrB.exe
  C:\Windows\System\jpdOyrB.exe
  2⤵
  PID:6564
- C:\Windows\System\AGyOvPp.exe
  C:\Windows\System\AGyOvPp.exe
  2⤵
  PID:6848
- C:\Windows\System\orgUNtm.exe
  C:\Windows\System\orgUNtm.exe
  2⤵
  PID:5880
- C:\Windows\System\grrfifn.exe
  C:\Windows\System\grrfifn.exe
  2⤵
  PID:5764
- C:\Windows\System\tKUyiUX.exe
  C:\Windows\System\tKUyiUX.exe
  2⤵
  PID:6044
- C:\Windows\System\ebPZKax.exe
  C:\Windows\System\ebPZKax.exe
  2⤵
  PID:2416
- C:\Windows\System\CCFtreq.exe
  C:\Windows\System\CCFtreq.exe
  2⤵
  PID:1476
- C:\Windows\System\YzYJkbs.exe
  C:\Windows\System\YzYJkbs.exe
  2⤵
  PID:7356
- C:\Windows\System\SRMnipv.exe
  C:\Windows\System\SRMnipv.exe
  2⤵
  PID:7400
- C:\Windows\System\oReEdSG.exe
  C:\Windows\System\oReEdSG.exe
  2⤵
  PID:7420
- C:\Windows\System\xUWBEcW.exe
  C:\Windows\System\xUWBEcW.exe
  2⤵
  PID:7488
- C:\Windows\System\ZwYpkez.exe
  C:\Windows\System\ZwYpkez.exe
  2⤵
  PID:7516
- C:\Windows\System\HDZUoby.exe
  C:\Windows\System\HDZUoby.exe
  2⤵
  PID:7532
- C:\Windows\System\cRFJDiz.exe
  C:\Windows\System\cRFJDiz.exe
  2⤵
  PID:7556
- C:\Windows\System\qIXmwnI.exe
  C:\Windows\System\qIXmwnI.exe
  2⤵
  PID:7604
- C:\Windows\System\AQtLaml.exe
  C:\Windows\System\AQtLaml.exe
  2⤵
  PID:7628
- C:\Windows\System\lNhErnq.exe
  C:\Windows\System\lNhErnq.exe
  2⤵
  PID:7704
- C:\Windows\System\owQJcWg.exe
  C:\Windows\System\owQJcWg.exe
  2⤵
  PID:7724
- C:\Windows\System\YnECpOH.exe
  C:\Windows\System\YnECpOH.exe
  2⤵
  PID:7744
- C:\Windows\System\sVhuDLc.exe
  C:\Windows\System\sVhuDLc.exe
  2⤵
  PID:7768
- C:\Windows\System\aNtynzn.exe
  C:\Windows\System\aNtynzn.exe
  2⤵
  PID:7796
- C:\Windows\System\RsGGffp.exe
  C:\Windows\System\RsGGffp.exe
  2⤵
  PID:7812
- C:\Windows\System\DXPGorB.exe
  C:\Windows\System\DXPGorB.exe
  2⤵
  PID:7840
- C:\Windows\System\dAHogNM.exe
  C:\Windows\System\dAHogNM.exe
  2⤵
  PID:7856
- C:\Windows\System\ozMIPyo.exe
  C:\Windows\System\ozMIPyo.exe
  2⤵
  PID:7876
- C:\Windows\System\ykNqyuT.exe
  C:\Windows\System\ykNqyuT.exe
  2⤵
  PID:7896
- C:\Windows\System\OTCrUFi.exe
  C:\Windows\System\OTCrUFi.exe
  2⤵
  PID:7916
- C:\Windows\System\MsyffLG.exe
  C:\Windows\System\MsyffLG.exe
  2⤵
  PID:7936
- C:\Windows\System\htQOmQt.exe
  C:\Windows\System\htQOmQt.exe
  2⤵
  PID:7956
- C:\Windows\System\cRFMhVS.exe
  C:\Windows\System\cRFMhVS.exe
  2⤵
  PID:7976
- C:\Windows\System\nnICLJX.exe
  C:\Windows\System\nnICLJX.exe
  2⤵
  PID:8000
- C:\Windows\System\zCGJEGL.exe
  C:\Windows\System\zCGJEGL.exe
  2⤵
  PID:8020
- C:\Windows\System\sfzGypl.exe
  C:\Windows\System\sfzGypl.exe
  2⤵
  PID:8044
- C:\Windows\System\gApCHZH.exe
  C:\Windows\System\gApCHZH.exe
  2⤵
  PID:8068
- C:\Windows\System\iGNdjKG.exe
  C:\Windows\System\iGNdjKG.exe
  2⤵
  PID:8088
- C:\Windows\System\OCAqSXq.exe
  C:\Windows\System\OCAqSXq.exe
  2⤵
  PID:8116
- C:\Windows\System\PkSJJrN.exe
  C:\Windows\System\PkSJJrN.exe
  2⤵
  PID:8140
- C:\Windows\System\nlLwfCw.exe
  C:\Windows\System\nlLwfCw.exe
  2⤵
  PID:8160
- C:\Windows\System\ORIdTCh.exe
  C:\Windows\System\ORIdTCh.exe
  2⤵
  PID:8184
- C:\Windows\System\WRIStfP.exe
  C:\Windows\System\WRIStfP.exe
  2⤵
  PID:6312
- C:\Windows\System\YGEdgWL.exe
  C:\Windows\System\YGEdgWL.exe
  2⤵
  PID:6480
- C:\Windows\System\iWNoiNF.exe
  C:\Windows\System\iWNoiNF.exe
  2⤵
  PID:6600
- C:\Windows\System\LjSQSZr.exe
  C:\Windows\System\LjSQSZr.exe
  2⤵
  PID:6956
- C:\Windows\System\hBrkDFJ.exe
  C:\Windows\System\hBrkDFJ.exe
  2⤵
  PID:5600
- C:\Windows\System\VXiVpee.exe
  C:\Windows\System\VXiVpee.exe
  2⤵
  PID:5224
- C:\Windows\System\gahdvPR.exe
  C:\Windows\System\gahdvPR.exe
  2⤵
  PID:5616
- C:\Windows\System\mcpXXuB.exe
  C:\Windows\System\mcpXXuB.exe
  2⤵
  PID:6976
- C:\Windows\System\PtipwXG.exe
  C:\Windows\System\PtipwXG.exe
  2⤵
  PID:5696
- C:\Windows\System\izsHJXD.exe
  C:\Windows\System\izsHJXD.exe
  2⤵
  PID:7204
- C:\Windows\System\qxbToob.exe
  C:\Windows\System\qxbToob.exe
  2⤵
  PID:7260
- C:\Windows\System\zbbqjGi.exe
  C:\Windows\System\zbbqjGi.exe
  2⤵
  PID:4732
- C:\Windows\System\FCqJBZX.exe
  C:\Windows\System\FCqJBZX.exe
  2⤵
  PID:4148
- C:\Windows\System\YGiEzVr.exe
  C:\Windows\System\YGiEzVr.exe
  2⤵
  PID:1312
- C:\Windows\System\nAXaPPu.exe
  C:\Windows\System\nAXaPPu.exe
  2⤵
  PID:2244
- C:\Windows\System\iKfBUMi.exe
  C:\Windows\System\iKfBUMi.exe
  2⤵
  PID:2976
- C:\Windows\System\VdcYWVk.exe
  C:\Windows\System\VdcYWVk.exe
  2⤵
  PID:2848
- C:\Windows\System\eJIeOpx.exe
  C:\Windows\System\eJIeOpx.exe
  2⤵
  PID:5072
- C:\Windows\System\sQnoRGG.exe
  C:\Windows\System\sQnoRGG.exe
  2⤵
  PID:1688
- C:\Windows\System\oQvGhic.exe
  C:\Windows\System\oQvGhic.exe
  2⤵
  PID:3288
- C:\Windows\System\RWKVmIu.exe
  C:\Windows\System\RWKVmIu.exe
  2⤵
  PID:6112
- C:\Windows\System\MWchzNd.exe
  C:\Windows\System\MWchzNd.exe
  2⤵
  PID:2268
- C:\Windows\System\Jczrkwm.exe
  C:\Windows\System\Jczrkwm.exe
  2⤵
  PID:4804
- C:\Windows\System\Xxstzkr.exe
  C:\Windows\System\Xxstzkr.exe
  2⤵
  PID:1956
- C:\Windows\System\TznMBIH.exe
  C:\Windows\System\TznMBIH.exe
  2⤵
  PID:4164
- C:\Windows\System\gpqFhwq.exe
  C:\Windows\System\gpqFhwq.exe
  2⤵
  PID:5708
- C:\Windows\System\hgBIsYV.exe
  C:\Windows\System\hgBIsYV.exe
  2⤵
  PID:7388
- C:\Windows\System\NtruJhd.exe
  C:\Windows\System\NtruJhd.exe
  2⤵
  PID:7480
- C:\Windows\System\JXFborV.exe
  C:\Windows\System\JXFborV.exe
  2⤵
  PID:7500
- C:\Windows\System\TWQAJYW.exe
  C:\Windows\System\TWQAJYW.exe
  2⤵
  PID:7540
- C:\Windows\System\LQDWyrg.exe
  C:\Windows\System\LQDWyrg.exe
  2⤵
  PID:7596
- C:\Windows\System\hYfteRV.exe
  C:\Windows\System\hYfteRV.exe
  2⤵
  PID:7636
- C:\Windows\System\vMowKWr.exe
  C:\Windows\System\vMowKWr.exe
  2⤵
  PID:3188
- C:\Windows\System\MEoRADr.exe
  C:\Windows\System\MEoRADr.exe
  2⤵
  PID:5264
- C:\Windows\System\qiLmRSX.exe
  C:\Windows\System\qiLmRSX.exe
  2⤵
  PID:5980
- C:\Windows\System\DfhhjSQ.exe
  C:\Windows\System\DfhhjSQ.exe
  2⤵
  PID:7760
- C:\Windows\System\hnbcffK.exe
  C:\Windows\System\hnbcffK.exe
  2⤵
  PID:7740
- C:\Windows\System\MQpoHpE.exe
  C:\Windows\System\MQpoHpE.exe
  2⤵
  PID:7784
- C:\Windows\System\gnCXLpM.exe
  C:\Windows\System\gnCXLpM.exe
  2⤵
  PID:7944
- C:\Windows\System\VBbymiE.exe
  C:\Windows\System\VBbymiE.exe
  2⤵
  PID:7968
- C:\Windows\System\HlivzZl.exe
  C:\Windows\System\HlivzZl.exe
  2⤵
  PID:8012
- C:\Windows\System\NaGCFNz.exe
  C:\Windows\System\NaGCFNz.exe
  2⤵
  PID:8016
- C:\Windows\System\OtrSrFb.exe
  C:\Windows\System\OtrSrFb.exe
  2⤵
  PID:6364
- C:\Windows\System\yOWasOK.exe
  C:\Windows\System\yOWasOK.exe
  2⤵
  PID:6812
- C:\Windows\System\aelDEeI.exe
  C:\Windows\System\aelDEeI.exe
  2⤵
  PID:7148
- C:\Windows\System\RTQjbDA.exe
  C:\Windows\System\RTQjbDA.exe
  2⤵
  PID:5204
- C:\Windows\System\GAmVrVt.exe
  C:\Windows\System\GAmVrVt.exe
  2⤵
  PID:7244
- C:\Windows\System\GOWHumV.exe
  C:\Windows\System\GOWHumV.exe
  2⤵
  PID:8176
- C:\Windows\System\VcPGUJT.exe
  C:\Windows\System\VcPGUJT.exe
  2⤵
  PID:7072
- C:\Windows\System\HrGfCeL.exe
  C:\Windows\System\HrGfCeL.exe
  2⤵
  PID:864
- C:\Windows\System\qhSEVlR.exe
  C:\Windows\System\qhSEVlR.exe
  2⤵
  PID:6524
- C:\Windows\System\OBxJKBl.exe
  C:\Windows\System\OBxJKBl.exe
  2⤵
  PID:6792
- C:\Windows\System\FnuegqX.exe
  C:\Windows\System\FnuegqX.exe
  2⤵
  PID:7484
- C:\Windows\System\GfYIOJB.exe
  C:\Windows\System\GfYIOJB.exe
  2⤵
  PID:6124
- C:\Windows\System\zLbeOzc.exe
  C:\Windows\System\zLbeOzc.exe
  2⤵
  PID:544
- C:\Windows\System\MRGomgu.exe
  C:\Windows\System\MRGomgu.exe
  2⤵
  PID:2504
- C:\Windows\System\zRRgGeh.exe
  C:\Windows\System\zRRgGeh.exe
  2⤵
  PID:7996
- C:\Windows\System\DsRfoZb.exe
  C:\Windows\System\DsRfoZb.exe
  2⤵
  PID:8200
- C:\Windows\System\STcASjI.exe
  C:\Windows\System\STcASjI.exe
  2⤵
  PID:8224
- C:\Windows\System\RpVgaju.exe
  C:\Windows\System\RpVgaju.exe
  2⤵
  PID:8244
- C:\Windows\System\fJRyevn.exe
  C:\Windows\System\fJRyevn.exe
  2⤵
  PID:8268
- C:\Windows\System\VTROPOi.exe
  C:\Windows\System\VTROPOi.exe
  2⤵
  PID:8292
- C:\Windows\System\VVaJsDr.exe
  C:\Windows\System\VVaJsDr.exe
  2⤵
  PID:8312
- C:\Windows\System\fgqNMfx.exe
  C:\Windows\System\fgqNMfx.exe
  2⤵
  PID:8332
- C:\Windows\System\uSIKqbY.exe
  C:\Windows\System\uSIKqbY.exe
  2⤵
  PID:8352
- C:\Windows\System\CkAfHIH.exe
  C:\Windows\System\CkAfHIH.exe
  2⤵
  PID:8372
- C:\Windows\System\zYkkSxZ.exe
  C:\Windows\System\zYkkSxZ.exe
  2⤵
  PID:8396
- C:\Windows\System\MFjfzEx.exe
  C:\Windows\System\MFjfzEx.exe
  2⤵
  PID:8420
- C:\Windows\System\HuSFaIN.exe
  C:\Windows\System\HuSFaIN.exe
  2⤵
  PID:8440
- C:\Windows\System\ovKGDIB.exe
  C:\Windows\System\ovKGDIB.exe
  2⤵
  PID:8460
- C:\Windows\System\mtnELRr.exe
  C:\Windows\System\mtnELRr.exe
  2⤵
  PID:8488
- C:\Windows\System\pTedpho.exe
  C:\Windows\System\pTedpho.exe
  2⤵
  PID:8504
- C:\Windows\System\tbRdAxx.exe
  C:\Windows\System\tbRdAxx.exe
  2⤵
  PID:8528
- C:\Windows\System\wmWlGSx.exe
  C:\Windows\System\wmWlGSx.exe
  2⤵
  PID:8548
- C:\Windows\System\hquxCQU.exe
  C:\Windows\System\hquxCQU.exe
  2⤵
  PID:8572
- C:\Windows\System\EoyscjS.exe
  C:\Windows\System\EoyscjS.exe
  2⤵
  PID:8592
- C:\Windows\System\UKJZbRK.exe
  C:\Windows\System\UKJZbRK.exe
  2⤵
  PID:8612
- C:\Windows\System\OGeTvAv.exe
  C:\Windows\System\OGeTvAv.exe
  2⤵
  PID:8632
- C:\Windows\System\EzOVkFW.exe
  C:\Windows\System\EzOVkFW.exe
  2⤵
  PID:8656
- C:\Windows\System\ilvDSkr.exe
  C:\Windows\System\ilvDSkr.exe
  2⤵
  PID:8676
- C:\Windows\System\KFXGsqA.exe
  C:\Windows\System\KFXGsqA.exe
  2⤵
  PID:8704
- C:\Windows\System\lwWpvqP.exe
  C:\Windows\System\lwWpvqP.exe
  2⤵
  PID:8728
- C:\Windows\System\gLGlpwi.exe
  C:\Windows\System\gLGlpwi.exe
  2⤵
  PID:8744
- C:\Windows\System\FiVkVCf.exe
  C:\Windows\System\FiVkVCf.exe
  2⤵
  PID:8768
- C:\Windows\System\gynyhKN.exe
  C:\Windows\System\gynyhKN.exe
  2⤵
  PID:8792
- C:\Windows\System\OEkowDZ.exe
  C:\Windows\System\OEkowDZ.exe
  2⤵
  PID:8816
- C:\Windows\System\bGKeFcq.exe
  C:\Windows\System\bGKeFcq.exe
  2⤵
  PID:8840
- C:\Windows\System\ONPaaPh.exe
  C:\Windows\System\ONPaaPh.exe
  2⤵
  PID:8860
- C:\Windows\System\mwUlfDJ.exe
  C:\Windows\System\mwUlfDJ.exe
  2⤵
  PID:8888
- C:\Windows\System\xTFAfyG.exe
  C:\Windows\System\xTFAfyG.exe
  2⤵
  PID:8908
- C:\Windows\System\IrdTaDe.exe
  C:\Windows\System\IrdTaDe.exe
  2⤵
  PID:8928
- C:\Windows\System\KpAjclX.exe
  C:\Windows\System\KpAjclX.exe
  2⤵
  PID:8952
- C:\Windows\System\DlMmKgx.exe
  C:\Windows\System\DlMmKgx.exe
  2⤵
  PID:8972
- C:\Windows\System\APQPoBG.exe
  C:\Windows\System\APQPoBG.exe
  2⤵
  PID:9000
- C:\Windows\System\JnsKdUP.exe
  C:\Windows\System\JnsKdUP.exe
  2⤵
  PID:9016
- C:\Windows\System\PfOFdTt.exe
  C:\Windows\System\PfOFdTt.exe
  2⤵
  PID:9040
- C:\Windows\System\wBZQRaQ.exe
  C:\Windows\System\wBZQRaQ.exe
  2⤵
  PID:9068
- C:\Windows\System\KmiXlNq.exe
  C:\Windows\System\KmiXlNq.exe
  2⤵
  PID:9084
- C:\Windows\System\SCAuFFe.exe
  C:\Windows\System\SCAuFFe.exe
  2⤵
  PID:9104
- C:\Windows\System\gVRfFpF.exe
  C:\Windows\System\gVRfFpF.exe
  2⤵
  PID:9124
- C:\Windows\System\iNQDiEY.exe
  C:\Windows\System\iNQDiEY.exe
  2⤵
  PID:9148
- C:\Windows\System\QZIencg.exe
  C:\Windows\System\QZIencg.exe
  2⤵
  PID:9168
- C:\Windows\System\EHoMidA.exe
  C:\Windows\System\EHoMidA.exe
  2⤵
  PID:9188
- C:\Windows\System\ohLbMLu.exe
  C:\Windows\System\ohLbMLu.exe
  2⤵
  PID:8084
- C:\Windows\System\kpbNoPj.exe
  C:\Windows\System\kpbNoPj.exe
  2⤵
  PID:8040
- C:\Windows\System\ZqQmpzD.exe
  C:\Windows\System\ZqQmpzD.exe
  2⤵
  PID:4376
- C:\Windows\System\rXhsTRY.exe
  C:\Windows\System\rXhsTRY.exe
  2⤵
  PID:4720
- C:\Windows\System\hojstas.exe
  C:\Windows\System\hojstas.exe
  2⤵
  PID:212
- C:\Windows\System\ZhSPuir.exe
  C:\Windows\System\ZhSPuir.exe
  2⤵
  PID:7688
- C:\Windows\System\nCmcnZn.exe
  C:\Windows\System\nCmcnZn.exe
  2⤵
  PID:1244
- C:\Windows\System\PtskpgF.exe
  C:\Windows\System\PtskpgF.exe
  2⤵
  PID:7808
- C:\Windows\System\byFFmDj.exe
  C:\Windows\System\byFFmDj.exe
  2⤵
  PID:7752
- C:\Windows\System\ggmplPL.exe
  C:\Windows\System\ggmplPL.exe
  2⤵
  PID:7872
- C:\Windows\System\KZnmBDt.exe
  C:\Windows\System\KZnmBDt.exe
  2⤵
  PID:7412
- C:\Windows\System\lOuENOw.exe
  C:\Windows\System\lOuENOw.exe
  2⤵
  PID:7588
- C:\Windows\System\wSqvUsI.exe
  C:\Windows\System\wSqvUsI.exe
  2⤵
  PID:3732
- C:\Windows\System\yRchHKL.exe
  C:\Windows\System\yRchHKL.exe
  2⤵
  PID:6972
- C:\Windows\System\FVVrKwS.exe
  C:\Windows\System\FVVrKwS.exe
  2⤵
  PID:8520
- C:\Windows\System\kCvXtwu.exe
  C:\Windows\System\kCvXtwu.exe
  2⤵
  PID:8580
- C:\Windows\System\Xkrcxib.exe
  C:\Windows\System\Xkrcxib.exe
  2⤵
  PID:7892
- C:\Windows\System\JPUgYce.exe
  C:\Windows\System\JPUgYce.exe
  2⤵
  PID:8736
- C:\Windows\System\HUhPawN.exe
  C:\Windows\System\HUhPawN.exe
  2⤵
  PID:9220
- C:\Windows\System\flbYLfm.exe
  C:\Windows\System\flbYLfm.exe
  2⤵
  PID:9244
- C:\Windows\System\wCCHUtK.exe
  C:\Windows\System\wCCHUtK.exe
  2⤵
  PID:9272
- C:\Windows\System\envtwgA.exe
  C:\Windows\System\envtwgA.exe
  2⤵
  PID:9288
- C:\Windows\System\lVqAjui.exe
  C:\Windows\System\lVqAjui.exe
  2⤵
  PID:9312
- C:\Windows\System\bTSUUlC.exe
  C:\Windows\System\bTSUUlC.exe
  2⤵
  PID:9332
- C:\Windows\System\mKBOaeK.exe
  C:\Windows\System\mKBOaeK.exe
  2⤵
  PID:9352
- C:\Windows\System\lHUqbcd.exe
  C:\Windows\System\lHUqbcd.exe
  2⤵
  PID:9376
- C:\Windows\System\IdsVNaC.exe
  C:\Windows\System\IdsVNaC.exe
  2⤵
  PID:9404
- C:\Windows\System\eLiKzOm.exe
  C:\Windows\System\eLiKzOm.exe
  2⤵
  PID:9428
- C:\Windows\System\nySZSSK.exe
  C:\Windows\System\nySZSSK.exe
  2⤵
  PID:9452
- C:\Windows\System\OxUmYQS.exe
  C:\Windows\System\OxUmYQS.exe
  2⤵
  PID:9476
- C:\Windows\System\dARNpQe.exe
  C:\Windows\System\dARNpQe.exe
  2⤵
  PID:9496
- C:\Windows\System\ZCyXFqh.exe
  C:\Windows\System\ZCyXFqh.exe
  2⤵
  PID:9516
- C:\Windows\System\WhAljBZ.exe
  C:\Windows\System\WhAljBZ.exe
  2⤵
  PID:9548
- C:\Windows\System\RmERlqJ.exe
  C:\Windows\System\RmERlqJ.exe
  2⤵
  PID:9564
- C:\Windows\System\WrJvmCD.exe
  C:\Windows\System\WrJvmCD.exe
  2⤵
  PID:9592
- C:\Windows\System\EIwoEtF.exe
  C:\Windows\System\EIwoEtF.exe
  2⤵
  PID:9608
- C:\Windows\System\WLjAlNC.exe
  C:\Windows\System\WLjAlNC.exe
  2⤵
  PID:9632
- C:\Windows\System\fsJBvke.exe
  C:\Windows\System\fsJBvke.exe
  2⤵
  PID:9652
- C:\Windows\System\HDmbkCh.exe
  C:\Windows\System\HDmbkCh.exe
  2⤵
  PID:9672
- C:\Windows\System\lATDvQZ.exe
  C:\Windows\System\lATDvQZ.exe
  2⤵
  PID:9700
- C:\Windows\System\FcqVLHd.exe
  C:\Windows\System\FcqVLHd.exe
  2⤵
  PID:9720
- C:\Windows\System\jFeWHVh.exe
  C:\Windows\System\jFeWHVh.exe
  2⤵
  PID:9740
- C:\Windows\System\UBdHLzK.exe
  C:\Windows\System\UBdHLzK.exe
  2⤵
  PID:9772
- C:\Windows\System\yFInlkg.exe
  C:\Windows\System\yFInlkg.exe
  2⤵
  PID:9792
- C:\Windows\System\GFkBftu.exe
  C:\Windows\System\GFkBftu.exe
  2⤵
  PID:9816
- C:\Windows\System\jhCScbz.exe
  C:\Windows\System\jhCScbz.exe
  2⤵
  PID:9840
- C:\Windows\System\qZELnHn.exe
  C:\Windows\System\qZELnHn.exe
  2⤵
  PID:9860
- C:\Windows\System\ijXNEfW.exe
  C:\Windows\System\ijXNEfW.exe
  2⤵
  PID:9892
- C:\Windows\System\BOKkabg.exe
  C:\Windows\System\BOKkabg.exe
  2⤵
  PID:9912
- C:\Windows\System\zchwpgA.exe
  C:\Windows\System\zchwpgA.exe
  2⤵
  PID:9932
- C:\Windows\System\UfqVEQS.exe
  C:\Windows\System\UfqVEQS.exe
  2⤵
  PID:9952
- C:\Windows\System\ShbXYUt.exe
  C:\Windows\System\ShbXYUt.exe
  2⤵
  PID:9976
- C:\Windows\System\bkLLNpA.exe
  C:\Windows\System\bkLLNpA.exe
  2⤵
  PID:9996
- C:\Windows\System\auhheAK.exe
  C:\Windows\System\auhheAK.exe
  2⤵
  PID:10020
- C:\Windows\System\QrAAMlA.exe
  C:\Windows\System\QrAAMlA.exe
  2⤵
  PID:10040
- C:\Windows\System\Hsoladx.exe
  C:\Windows\System\Hsoladx.exe
  2⤵
  PID:10064
- C:\Windows\System\zxHrNrT.exe
  C:\Windows\System\zxHrNrT.exe
  2⤵
  PID:10080
- C:\Windows\System\UVMBMhD.exe
  C:\Windows\System\UVMBMhD.exe
  2⤵
  PID:10104
- C:\Windows\System\chyIAnq.exe
  C:\Windows\System\chyIAnq.exe
  2⤵
  PID:10128
- C:\Windows\System\sHMSDJe.exe
  C:\Windows\System\sHMSDJe.exe
  2⤵
  PID:10148
- C:\Windows\System\zJjRpUH.exe
  C:\Windows\System\zJjRpUH.exe
  2⤵
  PID:10168
- C:\Windows\System\oeSVPSK.exe
  C:\Windows\System\oeSVPSK.exe
  2⤵
  PID:10188
- C:\Windows\System\iGrZcZa.exe
  C:\Windows\System\iGrZcZa.exe
  2⤵
  PID:10208
- C:\Windows\System\dJQAAYf.exe
  C:\Windows\System\dJQAAYf.exe
  2⤵
  PID:10232
- C:\Windows\System\giyxPCB.exe
  C:\Windows\System\giyxPCB.exe
  2⤵
  PID:8832
- C:\Windows\System\QOAMtPP.exe
  C:\Windows\System\QOAMtPP.exe
  2⤵
  PID:8920
- C:\Windows\System\tsQxZhz.exe
  C:\Windows\System\tsQxZhz.exe
  2⤵
  PID:8968
- C:\Windows\System\zdXfUcv.exe
  C:\Windows\System\zdXfUcv.exe
  2⤵
  PID:8392
- C:\Windows\System\BkZKpSB.exe
  C:\Windows\System\BkZKpSB.exe
  2⤵
  PID:9060
- C:\Windows\System\BeFWwNO.exe
  C:\Windows\System\BeFWwNO.exe
  2⤵
  PID:9096
- C:\Windows\System\bZLfYWI.exe
  C:\Windows\System\bZLfYWI.exe
  2⤵
  PID:9164
- C:\Windows\System\kZnmKec.exe
  C:\Windows\System\kZnmKec.exe
  2⤵
  PID:8588
- C:\Windows\System\bFAwaPO.exe
  C:\Windows\System\bFAwaPO.exe
  2⤵
  PID:7852
- C:\Windows\System\KAklzbp.exe
  C:\Windows\System\KAklzbp.exe
  2⤵
  PID:8648
- C:\Windows\System\ikZjhFk.exe
  C:\Windows\System\ikZjhFk.exe
  2⤵
  PID:8688
- C:\Windows\System\uyicJRB.exe
  C:\Windows\System\uyicJRB.exe
  2⤵
  PID:7580
- C:\Windows\System\dssPQAm.exe
  C:\Windows\System\dssPQAm.exe
  2⤵
  PID:8716
- C:\Windows\System\DoAbsFn.exe
  C:\Windows\System\DoAbsFn.exe
  2⤵
  PID:8196
- C:\Windows\System\XeEIPox.exe
  C:\Windows\System\XeEIPox.exe
  2⤵
  PID:9240
- C:\Windows\System\dwdrYaQ.exe
  C:\Windows\System\dwdrYaQ.exe
  2⤵
  PID:8868
- C:\Windows\System\MjcQxOd.exe
  C:\Windows\System\MjcQxOd.exe
  2⤵
  PID:9280
- C:\Windows\System\lKeRDMg.exe
  C:\Windows\System\lKeRDMg.exe
  2⤵
  PID:8964
- C:\Windows\System\INvqKEz.exe
  C:\Windows\System\INvqKEz.exe
  2⤵
  PID:8432
- C:\Windows\System\CgSQzRa.exe
  C:\Windows\System\CgSQzRa.exe
  2⤵
  PID:9400
- C:\Windows\System\suNkYHt.exe
  C:\Windows\System\suNkYHt.exe
  2⤵
  PID:9440
- C:\Windows\System\hLKyWds.exe
  C:\Windows\System\hLKyWds.exe
  2⤵
  PID:9512
- C:\Windows\System\EAcHHRa.exe
  C:\Windows\System\EAcHHRa.exe
  2⤵
  PID:9648
- C:\Windows\System\yrUXyyA.exe
  C:\Windows\System\yrUXyyA.exe
  2⤵
  PID:7548
- C:\Windows\System\ntOBErV.exe
  C:\Windows\System\ntOBErV.exe
  2⤵
  PID:4176
- C:\Windows\System\SkMkkcN.exe
  C:\Windows\System\SkMkkcN.exe
  2⤵
  PID:10252
- C:\Windows\System\XfPxNsZ.exe
  C:\Windows\System\XfPxNsZ.exe
  2⤵
  PID:10276
- C:\Windows\System\oKMBJOG.exe
  C:\Windows\System\oKMBJOG.exe
  2⤵
  PID:10296
- C:\Windows\System\yBfWzxD.exe
  C:\Windows\System\yBfWzxD.exe
  2⤵
  PID:10312
- C:\Windows\System\WifFwje.exe
  C:\Windows\System\WifFwje.exe
  2⤵
  PID:10332
- C:\Windows\System\kNvkwiU.exe
  C:\Windows\System\kNvkwiU.exe
  2⤵
  PID:10356
- C:\Windows\System\cmDxaQv.exe
  C:\Windows\System\cmDxaQv.exe
  2⤵
  PID:10376
- C:\Windows\System\GQlOWvD.exe
  C:\Windows\System\GQlOWvD.exe
  2⤵
  PID:10396
- C:\Windows\System\IJaGrVk.exe
  C:\Windows\System\IJaGrVk.exe
  2⤵
  PID:10416
- C:\Windows\System\tGqYdeZ.exe
  C:\Windows\System\tGqYdeZ.exe
  2⤵
  PID:10436
- C:\Windows\System\dtJYrhl.exe
  C:\Windows\System\dtJYrhl.exe
  2⤵
  PID:10460
- C:\Windows\System\IECLIfF.exe
  C:\Windows\System\IECLIfF.exe
  2⤵
  PID:10480
- C:\Windows\System\rsPbuMx.exe
  C:\Windows\System\rsPbuMx.exe
  2⤵
  PID:10496
- C:\Windows\System\rvxJpZI.exe
  C:\Windows\System\rvxJpZI.exe
  2⤵
  PID:10516
- C:\Windows\System\rOltteZ.exe
  C:\Windows\System\rOltteZ.exe
  2⤵
  PID:10536
- C:\Windows\System\ikYhyPK.exe
  C:\Windows\System\ikYhyPK.exe
  2⤵
  PID:10560
- C:\Windows\System\VNhfbeP.exe
  C:\Windows\System\VNhfbeP.exe
  2⤵
  PID:10580
- C:\Windows\System\YgqMVQH.exe
  C:\Windows\System\YgqMVQH.exe
  2⤵
  PID:10608
- C:\Windows\System\awuzeSI.exe
  C:\Windows\System\awuzeSI.exe
  2⤵
  PID:10628
- C:\Windows\System\YuxRNZY.exe
  C:\Windows\System\YuxRNZY.exe
  2⤵
  PID:10648
- C:\Windows\System\LGGqhRB.exe
  C:\Windows\System\LGGqhRB.exe
  2⤵
  PID:10668
- C:\Windows\System\KbsMCFj.exe
  C:\Windows\System\KbsMCFj.exe
  2⤵
  PID:10696
- C:\Windows\System\lmFqpnR.exe
  C:\Windows\System\lmFqpnR.exe
  2⤵
  PID:10716
- C:\Windows\System\JPhrqaR.exe
  C:\Windows\System\JPhrqaR.exe
  2⤵
  PID:10740
- C:\Windows\System\PVhAYQV.exe
  C:\Windows\System\PVhAYQV.exe
  2⤵
  PID:10760
- C:\Windows\System\DaMqzWV.exe
  C:\Windows\System\DaMqzWV.exe
  2⤵
  PID:10788
- C:\Windows\System\bYWYgHG.exe
  C:\Windows\System\bYWYgHG.exe
  2⤵
  PID:10808
- C:\Windows\System\WkbOtpt.exe
  C:\Windows\System\WkbOtpt.exe
  2⤵
  PID:10836
- C:\Windows\System\RxjKchq.exe
  C:\Windows\System\RxjKchq.exe
  2⤵
  PID:10856
- C:\Windows\System\SIHJRrA.exe
  C:\Windows\System\SIHJRrA.exe
  2⤵
  PID:10880
- C:\Windows\System\rnwPhTb.exe
  C:\Windows\System\rnwPhTb.exe
  2⤵
  PID:10904
- C:\Windows\System\msFSWBH.exe
  C:\Windows\System\msFSWBH.exe
  2⤵
  PID:10928
- C:\Windows\System\iawfgiL.exe
  C:\Windows\System\iawfgiL.exe
  2⤵
  PID:10944
- C:\Windows\System\YezMFFU.exe
  C:\Windows\System\YezMFFU.exe
  2⤵
  PID:10972
- C:\Windows\System\JkvLFYB.exe
  C:\Windows\System\JkvLFYB.exe
  2⤵
  PID:11000
- C:\Windows\System\KbrCYjA.exe
  C:\Windows\System\KbrCYjA.exe
  2⤵
  PID:11020
- C:\Windows\System\WMKOLvI.exe
  C:\Windows\System\WMKOLvI.exe
  2⤵
  PID:11040
- C:\Windows\System\rfyptAF.exe
  C:\Windows\System\rfyptAF.exe
  2⤵
  PID:11060
- C:\Windows\System\etCEYgD.exe
  C:\Windows\System\etCEYgD.exe
  2⤵
  PID:11088
- C:\Windows\System\AHksWMX.exe
  C:\Windows\System\AHksWMX.exe
  2⤵
  PID:11104
- C:\Windows\System\vHMMAEQ.exe
  C:\Windows\System\vHMMAEQ.exe
  2⤵
  PID:11128
- C:\Windows\System\iweQqru.exe
  C:\Windows\System\iweQqru.exe
  2⤵
  PID:11156
- C:\Windows\System\FiEQJZv.exe
  C:\Windows\System\FiEQJZv.exe
  2⤵
  PID:11176
- C:\Windows\System\uaEvXGK.exe
  C:\Windows\System\uaEvXGK.exe
  2⤵
  PID:11200
- C:\Windows\System\WGKYQxR.exe
  C:\Windows\System\WGKYQxR.exe
  2⤵
  PID:11224
- C:\Windows\System\Ofcfuca.exe
  C:\Windows\System\Ofcfuca.exe
  2⤵
  PID:11244
- C:\Windows\System\qnIHRAv.exe
  C:\Windows\System\qnIHRAv.exe
  2⤵
  PID:9784
- C:\Windows\System\uFmwPAo.exe
  C:\Windows\System\uFmwPAo.exe
  2⤵
  PID:9832
- C:\Windows\System\SUDvlmY.exe
  C:\Windows\System\SUDvlmY.exe
  2⤵
  PID:8684
- C:\Windows\System\jSMAFOp.exe
  C:\Windows\System\jSMAFOp.exe
  2⤵
  PID:9904
- C:\Windows\System\CfSSObw.exe
  C:\Windows\System\CfSSObw.exe
  2⤵
  PID:11232
- C:\Windows\System\shIresk.exe
  C:\Windows\System\shIresk.exe
  2⤵
  PID:9584
- C:\Windows\System\yOJXldD.exe
  C:\Windows\System\yOJXldD.exe
  2⤵
  PID:9640
- C:\Windows\System\jkAltfK.exe
  C:\Windows\System\jkAltfK.exe
  2⤵
  PID:6788
- C:\Windows\System\qAwOpbp.exe
  C:\Windows\System\qAwOpbp.exe
  2⤵
  PID:8480
- C:\Windows\System\YKlCBIk.exe
  C:\Windows\System\YKlCBIk.exe
  2⤵
  PID:10404
- C:\Windows\System\xdgfyvz.exe
  C:\Windows\System\xdgfyvz.exe
  2⤵
  PID:9012
- C:\Windows\System\JpSJEgR.exe
  C:\Windows\System\JpSJEgR.exe
  2⤵
  PID:10472
- C:\Windows\System\oyQCNpc.exe
  C:\Windows\System\oyQCNpc.exe
  2⤵
  PID:10576
- C:\Windows\System\dvGNzVQ.exe
  C:\Windows\System\dvGNzVQ.exe
  2⤵
  PID:11280
- C:\Windows\System\IcjbpGI.exe
  C:\Windows\System\IcjbpGI.exe
  2⤵
  PID:11308
- C:\Windows\System\irpLwCR.exe
  C:\Windows\System\irpLwCR.exe
  2⤵
  PID:11332
- C:\Windows\System\lZwlbQm.exe
  C:\Windows\System\lZwlbQm.exe
  2⤵
  PID:11352
- C:\Windows\System\YroAPFK.exe
  C:\Windows\System\YroAPFK.exe
  2⤵
  PID:11372
- C:\Windows\System\WZnOjim.exe
  C:\Windows\System\WZnOjim.exe
  2⤵
  PID:11400
- C:\Windows\System\LrfwgKA.exe
  C:\Windows\System\LrfwgKA.exe
  2⤵
  PID:11420
- C:\Windows\System\wFFdnMX.exe
  C:\Windows\System\wFFdnMX.exe
  2⤵
  PID:11448
- C:\Windows\System\xmaLfsk.exe
  C:\Windows\System\xmaLfsk.exe
  2⤵
  PID:11492
- C:\Windows\System\SiLgzjp.exe
  C:\Windows\System\SiLgzjp.exe
  2⤵
  PID:11520
- C:\Windows\System\SCyZwbE.exe
  C:\Windows\System\SCyZwbE.exe
  2⤵
  PID:11536
- C:\Windows\System\cbluapI.exe
  C:\Windows\System\cbluapI.exe
  2⤵
  PID:11560
- C:\Windows\System\BftUGIn.exe
  C:\Windows\System\BftUGIn.exe
  2⤵
  PID:11584
- C:\Windows\System\GIYtWWk.exe
  C:\Windows\System\GIYtWWk.exe
  2⤵
  PID:11604
- C:\Windows\System\ljUAuym.exe
  C:\Windows\System\ljUAuym.exe
  2⤵
  PID:11628
- C:\Windows\System\wXGVHXK.exe
  C:\Windows\System\wXGVHXK.exe
  2⤵
  PID:11648
- C:\Windows\System\bPeKWKE.exe
  C:\Windows\System\bPeKWKE.exe
  2⤵
  PID:11676
- C:\Windows\System\QPjNDEI.exe
  C:\Windows\System\QPjNDEI.exe
  2⤵
  PID:11700
- C:\Windows\System\RsUjTLp.exe
  C:\Windows\System\RsUjTLp.exe
  2⤵
  PID:11724
- C:\Windows\System\CzlhqNI.exe
  C:\Windows\System\CzlhqNI.exe
  2⤵
  PID:11740
- C:\Windows\System\SYHiZOQ.exe
  C:\Windows\System\SYHiZOQ.exe
  2⤵
  PID:11756
- C:\Windows\System\nRntjCY.exe
  C:\Windows\System\nRntjCY.exe
  2⤵
  PID:11772
- C:\Windows\System\FNgIJuN.exe
  C:\Windows\System\FNgIJuN.exe
  2⤵
  PID:11788
- C:\Windows\System\xrLjTTl.exe
  C:\Windows\System\xrLjTTl.exe
  2⤵
  PID:11804
- C:\Windows\System\HaQYEtF.exe
  C:\Windows\System\HaQYEtF.exe
  2⤵
  PID:11824
- C:\Windows\System\cZwUMWe.exe
  C:\Windows\System\cZwUMWe.exe
  2⤵
  PID:11840
- C:\Windows\System\jCvySNJ.exe
  C:\Windows\System\jCvySNJ.exe
  2⤵
  PID:11856
- C:\Windows\System\RfhzSbE.exe
  C:\Windows\System\RfhzSbE.exe
  2⤵
  PID:11872
- C:\Windows\System\hMIzjPD.exe
  C:\Windows\System\hMIzjPD.exe
  2⤵
  PID:11892
- C:\Windows\System\iCBBYtD.exe
  C:\Windows\System\iCBBYtD.exe
  2⤵
  PID:11912
- C:\Windows\System\PScuBUx.exe
  C:\Windows\System\PScuBUx.exe
  2⤵
  PID:11940
- C:\Windows\System\aTAiXQg.exe
  C:\Windows\System\aTAiXQg.exe
  2⤵
  PID:11960
- C:\Windows\System\RjsxrZa.exe
  C:\Windows\System\RjsxrZa.exe
  2⤵
  PID:12000
- C:\Windows\System\RenWJaF.exe
  C:\Windows\System\RenWJaF.exe
  2⤵
  PID:12020
- C:\Windows\System\XtOAmrt.exe
  C:\Windows\System\XtOAmrt.exe
  2⤵
  PID:12044
- C:\Windows\System\aJTtQAx.exe
  C:\Windows\System\aJTtQAx.exe
  2⤵
  PID:12068
- C:\Windows\System\MfmibVR.exe
  C:\Windows\System\MfmibVR.exe
  2⤵
  PID:12088
- C:\Windows\System\PInagIN.exe
  C:\Windows\System\PInagIN.exe
  2⤵
  PID:12108
- C:\Windows\System\IiWXuDX.exe
  C:\Windows\System\IiWXuDX.exe
  2⤵
  PID:12136
- C:\Windows\System\ltzCHFA.exe
  C:\Windows\System\ltzCHFA.exe
  2⤵
  PID:12168
- C:\Windows\System\WXweeFs.exe
  C:\Windows\System\WXweeFs.exe
  2⤵
  PID:12192
- C:\Windows\System\UALaVBV.exe
  C:\Windows\System\UALaVBV.exe
  2⤵
  PID:12212
- C:\Windows\System\eIkuXaW.exe
  C:\Windows\System\eIkuXaW.exe
  2⤵
  PID:12236
- C:\Windows\System\cXNePce.exe
  C:\Windows\System\cXNePce.exe
  2⤵
  PID:12256
- C:\Windows\System\KIfVSjW.exe
  C:\Windows\System\KIfVSjW.exe
  2⤵
  PID:12276
- C:\Windows\System\ocIJGYz.exe
  C:\Windows\System\ocIJGYz.exe
  2⤵
  PID:10180
- C:\Windows\System\cepWPxh.exe
  C:\Windows\System\cepWPxh.exe
  2⤵
  PID:8368
- C:\Windows\System\ScJBPUt.exe
  C:\Windows\System\ScJBPUt.exe
  2⤵
  PID:10996
- C:\Windows\System\XWJrgyj.exe
  C:\Windows\System\XWJrgyj.exe
  2⤵
  PID:11100
- C:\Windows\System\XzBdzhU.exe
  C:\Windows\System\XzBdzhU.exe
  2⤵
  PID:11168
- C:\Windows\System\kSFMoBW.exe
  C:\Windows\System\kSFMoBW.exe
  2⤵
  PID:10072
- C:\Windows\System\VvPbDrK.exe
  C:\Windows\System\VvPbDrK.exe
  2⤵
  PID:10088
- C:\Windows\System\bJdysgO.exe
  C:\Windows\System\bJdysgO.exe
  2⤵
  PID:10292
- C:\Windows\System\pIdCPuy.exe
  C:\Windows\System\pIdCPuy.exe
  2⤵
  PID:12304
- C:\Windows\System\UDlkXzL.exe
  C:\Windows\System\UDlkXzL.exe
  2⤵
  PID:12336
- C:\Windows\System\AMppIOw.exe
  C:\Windows\System\AMppIOw.exe
  2⤵
  PID:12368
- C:\Windows\System\rzyWHkZ.exe
  C:\Windows\System\rzyWHkZ.exe
  2⤵
  PID:12392
- C:\Windows\System\diIrwpi.exe
  C:\Windows\System\diIrwpi.exe
  2⤵
  PID:12416
- C:\Windows\System\efDDHgM.exe
  C:\Windows\System\efDDHgM.exe
  2⤵
  PID:12444
- C:\Windows\System\IuMhEpC.exe
  C:\Windows\System\IuMhEpC.exe
  2⤵
  PID:12464
- C:\Windows\System\zBVRywt.exe
  C:\Windows\System\zBVRywt.exe
  2⤵
  PID:12484
- C:\Windows\System\qUqjirA.exe
  C:\Windows\System\qUqjirA.exe
  2⤵
  PID:12504
- C:\Windows\System\DKeaBQe.exe
  C:\Windows\System\DKeaBQe.exe
  2⤵
  PID:12528
- C:\Windows\System\xtiNDwT.exe
  C:\Windows\System\xtiNDwT.exe
  2⤵
  PID:12552
- C:\Windows\System\GnVJZsv.exe
  C:\Windows\System\GnVJZsv.exe
  2⤵
  PID:12576
- C:\Windows\System\YsSvwvD.exe
  C:\Windows\System\YsSvwvD.exe
  2⤵
  PID:12596
- C:\Windows\System\uuukqJZ.exe
  C:\Windows\System\uuukqJZ.exe
  2⤵
  PID:12620
- C:\Windows\System\FWZundg.exe
  C:\Windows\System\FWZundg.exe
  2⤵
  PID:12644
- C:\Windows\System\eqsleLo.exe
  C:\Windows\System\eqsleLo.exe
  2⤵
  PID:12668
- C:\Windows\System\UWSixaA.exe
  C:\Windows\System\UWSixaA.exe
  2⤵
  PID:12696
- C:\Windows\System\jKsTepu.exe
  C:\Windows\System\jKsTepu.exe
  2⤵
  PID:12712
- C:\Windows\System\sAzqyst.exe
  C:\Windows\System\sAzqyst.exe
  2⤵
  PID:12728
- C:\Windows\System\ppyWWzc.exe
  C:\Windows\System\ppyWWzc.exe
  2⤵
  PID:12744
- C:\Windows\System\fHqlInA.exe
  C:\Windows\System\fHqlInA.exe
  2⤵
  PID:12764
- C:\Windows\System\DPoCwKe.exe
  C:\Windows\System\DPoCwKe.exe
  2⤵
  PID:12780
- C:\Windows\System\MGROETJ.exe
  C:\Windows\System\MGROETJ.exe
  2⤵
  PID:12796
- C:\Windows\System\XmJDuiR.exe
  C:\Windows\System\XmJDuiR.exe
  2⤵
  PID:12812
- C:\Windows\System\rrOBplB.exe
  C:\Windows\System\rrOBplB.exe
  2⤵
  PID:12828
- C:\Windows\System\lSVImGT.exe
  C:\Windows\System\lSVImGT.exe
  2⤵
  PID:12844
- C:\Windows\System\WRLfbHQ.exe
  C:\Windows\System\WRLfbHQ.exe
  2⤵
  PID:12860
- C:\Windows\System\SIsoiML.exe
  C:\Windows\System\SIsoiML.exe
  2⤵
  PID:12876
- C:\Windows\System\iDYeAwe.exe
  C:\Windows\System\iDYeAwe.exe
  2⤵
  PID:12900
- C:\Windows\System\CVrDyuY.exe
  C:\Windows\System\CVrDyuY.exe
  2⤵
  PID:12920
- C:\Windows\System\NCXxFbi.exe
  C:\Windows\System\NCXxFbi.exe
  2⤵
  PID:12948
- C:\Windows\System\tggEAOn.exe
  C:\Windows\System\tggEAOn.exe
  2⤵
  PID:12972
- C:\Windows\System\PNRUsLi.exe
  C:\Windows\System\PNRUsLi.exe
  2⤵
  PID:13000
- C:\Windows\System\DgcTlby.exe
  C:\Windows\System\DgcTlby.exe
  2⤵
  PID:13020
- C:\Windows\System\rPEYBJo.exe
  C:\Windows\System\rPEYBJo.exe
  2⤵
  PID:13044
- C:\Windows\System\eEofjpX.exe
  C:\Windows\System\eEofjpX.exe
  2⤵
  PID:13064
- C:\Windows\System\dBUpzoH.exe
  C:\Windows\System\dBUpzoH.exe
  2⤵
  PID:13088
- C:\Windows\System\kUCBTDA.exe
  C:\Windows\System\kUCBTDA.exe
  2⤵
  PID:13108
- C:\Windows\System\ViiHoDL.exe
  C:\Windows\System\ViiHoDL.exe
  2⤵
  PID:13132
- C:\Windows\System\LBSBwev.exe
  C:\Windows\System\LBSBwev.exe
  2⤵
  PID:13156
- C:\Windows\System\LfoLRdn.exe
  C:\Windows\System\LfoLRdn.exe
  2⤵
  PID:13172
- C:\Windows\System\rtxFJSP.exe
  C:\Windows\System\rtxFJSP.exe
  2⤵
  PID:13188
- C:\Windows\System\EGaiooA.exe
  C:\Windows\System\EGaiooA.exe
  2⤵
  PID:13204
- C:\Windows\System\MjIuclD.exe
  C:\Windows\System\MjIuclD.exe
  2⤵
  PID:13224
- C:\Windows\System\SdpGpzx.exe
  C:\Windows\System\SdpGpzx.exe
  2⤵
  PID:13244
- C:\Windows\System\XCwUAlI.exe
  C:\Windows\System\XCwUAlI.exe
  2⤵
  PID:13264
- C:\Windows\System\BLADgay.exe
  C:\Windows\System\BLADgay.exe
  2⤵
  PID:10912
- C:\Windows\System\tpEBBQU.exe
  C:\Windows\System\tpEBBQU.exe
  2⤵
  PID:11888
- C:\Windows\System\YgIyAGQ.exe
  C:\Windows\System\YgIyAGQ.exe
  2⤵
  PID:11272
- C:\Windows\System\koMZpts.exe
  C:\Windows\System\koMZpts.exe
  2⤵
  PID:9692
- C:\Windows\System\CJawqbV.exe
  C:\Windows\System\CJawqbV.exe
  2⤵
  PID:10852
- C:\Windows\System\CbZKPCK.exe
  C:\Windows\System\CbZKPCK.exe
  2⤵
  PID:13056
- C:\Windows\System\GXQexJQ.exe
  C:\Windows\System\GXQexJQ.exe
  2⤵
  PID:8848
- C:\Windows\System\glAIKKP.exe
  C:\Windows\System\glAIKKP.exe
  2⤵
  PID:9076
- C:\Windows\System\ZfEXMbv.exe
  C:\Windows\System\ZfEXMbv.exe
  2⤵
  PID:12432
- C:\Windows\System\SRIVYIy.exe
  C:\Windows\System\SRIVYIy.exe
  2⤵
  PID:11764
- C:\Windows\System\pWhEWZd.exe
  C:\Windows\System\pWhEWZd.exe
  2⤵
  PID:9008
- C:\Windows\System\afioQFc.exe
  C:\Windows\System\afioQFc.exe
  2⤵
  PID:8948
- C:\Windows\System\vYIPEpN.exe
  C:\Windows\System\vYIPEpN.exe
  2⤵
  PID:11636
- C:\Windows\System\wugLDSe.exe
  C:\Windows\System\wugLDSe.exe
  2⤵
  PID:12144
- C:\Windows\System\POJffMz.exe
  C:\Windows\System\POJffMz.exe
  2⤵
  PID:12916
- C:\Windows\System\SqPCaPg.exe
  C:\Windows\System\SqPCaPg.exe
  2⤵
  PID:12856
- C:\Windows\System\sxhVzjl.exe
  C:\Windows\System\sxhVzjl.exe
  2⤵
  PID:11544
- C:\Windows\System\LQnsYVv.exe
  C:\Windows\System\LQnsYVv.exe
  2⤵
  PID:13304
- C:\Windows\System\qqtfLXY.exe
  C:\Windows\System\qqtfLXY.exe
  2⤵
  PID:3580
- C:\Windows\System\jbzKVBn.exe
  C:\Windows\System\jbzKVBn.exe
  2⤵
  PID:12960
- C:\Windows\System\sCzUOaJ.exe
  C:\Windows\System\sCzUOaJ.exe
  2⤵
  PID:12836
- C:\Windows\System\ODVSaRJ.exe
  C:\Windows\System\ODVSaRJ.exe
  2⤵
  PID:12012
- C:\Windows\System\cyUSQLd.exe
  C:\Windows\System\cyUSQLd.exe
  2⤵
  PID:12984
- C:\Windows\System\zemthGe.exe
  C:\Windows\System\zemthGe.exe
  2⤵
  PID:10268
- C:\Windows\System\FTmMAzh.exe
  C:\Windows\System\FTmMAzh.exe
  2⤵
  PID:12544
- C:\Windows\System\GCECRAZ.exe
  C:\Windows\System\GCECRAZ.exe
  2⤵
  PID:13196
- C:\Windows\System\wvgSTLc.exe
  C:\Windows\System\wvgSTLc.exe
  2⤵
  PID:12104
- C:\Windows\System\GNXktom.exe
  C:\Windows\System\GNXktom.exe
  2⤵
  PID:10924
- C:\Windows\System\ZwBjOFO.exe
  C:\Windows\System\ZwBjOFO.exe
  2⤵
  PID:12516
- C:\Windows\System\jxhZxhe.exe
  C:\Windows\System\jxhZxhe.exe
  2⤵
  PID:7692
- C:\Windows\System\YIHNyXN.exe
  C:\Windows\System\YIHNyXN.exe
  2⤵
  PID:8428
- C:\Windows\System\ECSEpaI.exe
  C:\Windows\System\ECSEpaI.exe
  2⤵
  PID:9256
- C:\Windows\System\YtUaqfW.exe
  C:\Windows\System\YtUaqfW.exe
  2⤵
  PID:11440
- C:\Windows\System\yTFZMhU.exe
  C:\Windows\System\yTFZMhU.exe
  2⤵
  PID:12540
- C:\Windows\System\bmgVgQm.exe
  C:\Windows\System\bmgVgQm.exe
  2⤵
  PID:12132
- C:\Windows\System\OxbokxJ.exe
  C:\Windows\System\OxbokxJ.exe
  2⤵
  PID:12708
- C:\Windows\System\xqUhArO.exe
  C:\Windows\System\xqUhArO.exe
  2⤵
  PID:10724
- C:\Windows\System\nxFvKWl.exe
  C:\Windows\System\nxFvKWl.exe
  2⤵
  PID:10624
- C:\Windows\System\DZeNqFb.exe
  C:\Windows\System\DZeNqFb.exe
  2⤵
  PID:10328
- C:\Windows\System\AKwejPp.exe
  C:\Windows\System\AKwejPp.exe
  2⤵
  PID:9556
- C:\Windows\System\vaonRAK.exe
  C:\Windows\System\vaonRAK.exe
  2⤵
  PID:10004
- C:\Windows\System\dleTkaN.exe
  C:\Windows\System\dleTkaN.exe
  2⤵
  PID:9468
- C:\Windows\System\FawlRLB.exe
  C:\Windows\System\FawlRLB.exe
  2⤵
  PID:8448
- C:\Windows\System\pKHDmXo.exe
  C:\Windows\System\pKHDmXo.exe
  2⤵
  PID:1128
- C:\Windows\System\vAyWhDW.exe
  C:\Windows\System\vAyWhDW.exe
  2⤵
  PID:11600
- C:\Windows\System\IjhVdQf.exe
  C:\Windows\System\IjhVdQf.exe
  2⤵
  PID:13036
- C:\Windows\System\NqXPMGd.exe
  C:\Windows\System\NqXPMGd.exe
  2⤵
  PID:12888
- C:\Windows\System\rtBwmvP.exe
  C:\Windows\System\rtBwmvP.exe
  2⤵
  PID:3144
- C:\Windows\System\ZGlLvWk.exe
  C:\Windows\System\ZGlLvWk.exe
  2⤵
  PID:12872
- C:\Windows\System\XGjZaKU.exe
  C:\Windows\System\XGjZaKU.exe
  2⤵
  PID:3408
- C:\Windows\System\uQDXAKc.exe
  C:\Windows\System\uQDXAKc.exe
  2⤵
  PID:1972
- C:\Windows\System\gZLVqgY.exe
  C:\Windows\System\gZLVqgY.exe
  2⤵
  PID:3444
- C:\Windows\System\lgESMYH.exe
  C:\Windows\System\lgESMYH.exe
  2⤵
  PID:12776
- C:\Windows\System\PPQWqDm.exe
  C:\Windows\System\PPQWqDm.exe
  2⤵
  PID:12756
- C:\Windows\System\zrdxnbD.exe
  C:\Windows\System\zrdxnbD.exe
  2⤵
  PID:10824
- C:\Windows\System\mcsNXOT.exe
  C:\Windows\System\mcsNXOT.exe
  2⤵
  PID:11068
- C:\Windows\System\lUaXzyQ.exe
  C:\Windows\System\lUaXzyQ.exe
  2⤵
  PID:13296
- C:\Windows\System\OUvvKpw.exe
  C:\Windows\System\OUvvKpw.exe
  2⤵
  PID:1900
- C:\Windows\System\UhMYGih.exe
  C:\Windows\System\UhMYGih.exe
  2⤵
  PID:32
- C:\Windows\System\PdxCahG.exe
  C:\Windows\System\PdxCahG.exe
  2⤵
  PID:9424
- C:\Windows\System\rwqJoCf.exe
  C:\Windows\System\rwqJoCf.exe
  2⤵
  PID:13164
- C:\Windows\System\swxMBqs.exe
  C:\Windows\System\swxMBqs.exe
  2⤵
  PID:12500
- C:\Windows\System\fdAiNHs.exe
  C:\Windows\System\fdAiNHs.exe
  2⤵
  PID:1056
- C:\Windows\System\ASIOhvo.exe
  C:\Windows\System\ASIOhvo.exe
  2⤵
  PID:12220
- C:\Windows\System\VEgNZIY.exe
  C:\Windows\System\VEgNZIY.exe
  2⤵
  PID:12852
- C:\Windows\System\cUkRZcf.exe
  C:\Windows\System\cUkRZcf.exe
  2⤵
  PID:8856
- C:\Windows\System\eKVeHEl.exe
  C:\Windows\System\eKVeHEl.exe
  2⤵
  PID:924
- C:\Windows\System\RfauRSf.exe
  C:\Windows\System\RfauRSf.exe
  2⤵
  PID:4540
- C:\Windows\System\GGYjqqT.exe
  C:\Windows\System\GGYjqqT.exe
  2⤵
  PID:1428
- C:\Windows\System\ZlLSyHF.exe
  C:\Windows\System\ZlLSyHF.exe
  2⤵
  PID:10124
- C:\Windows\System\EvSxjRf.exe
  C:\Windows\System\EvSxjRf.exe
  2⤵
  PID:11736
- C:\Windows\System\ROkbBIT.exe
  C:\Windows\System\ROkbBIT.exe
  2⤵
  PID:9788
- C:\Windows\System\atdSmmE.exe
  C:\Windows\System\atdSmmE.exe
  2⤵
  PID:4816
- C:\Windows\System\ofdWiSS.exe
  C:\Windows\System\ofdWiSS.exe
  2⤵
  PID:3412
- C:\Windows\System\WxZShJp.exe
  C:\Windows\System\WxZShJp.exe
  2⤵
  PID:9344
- C:\Windows\System\jGiCrWf.exe
  C:\Windows\System\jGiCrWf.exe
  2⤵
  PID:12808
- C:\Windows\System\UXBHddM.exe
  C:\Windows\System\UXBHddM.exe
  2⤵
  PID:7320
- C:\Windows\System\gDIUxub.exe
  C:\Windows\System\gDIUxub.exe
  2⤵
  PID:2720
- C:\Windows\System\HztypMN.exe
  C:\Windows\System\HztypMN.exe
  2⤵
  PID:11720
- C:\Windows\System\sKwTtJM.exe
  C:\Windows\System\sKwTtJM.exe
  2⤵
  PID:1016
- C:\Windows\System\kFUVdQi.exe
  C:\Windows\System\kFUVdQi.exe
  2⤵
  PID:3612
- C:\Windows\System\MfSFrcn.exe
  C:\Windows\System\MfSFrcn.exe
  2⤵
  PID:11748
- C:\Windows\System\PuRhAAy.exe
  C:\Windows\System\PuRhAAy.exe
  2⤵
  PID:11408
- C:\Windows\System\NFfFvkC.exe
  C:\Windows\System\NFfFvkC.exe
  2⤵
  PID:12824
- C:\Windows\System\enclttA.exe
  C:\Windows\System\enclttA.exe
  2⤵
  PID:1848
- C:\Windows\System\dybWPGX.exe
  C:\Windows\System\dybWPGX.exe
  2⤵
  PID:4408
- C:\Windows\System\qWuQbbf.exe
  C:\Windows\System\qWuQbbf.exe
  2⤵
  PID:6420
- C:\Windows\System\dgcMcEa.exe
  C:\Windows\System\dgcMcEa.exe
  2⤵
  PID:12956
- C:\Windows\System\DqXHqBE.exe
  C:\Windows\System\DqXHqBE.exe
  2⤵
  PID:10492
- C:\Windows\System\yROdfzh.exe
  C:\Windows\System\yROdfzh.exe
  2⤵
  PID:8348
- C:\Windows\System\zkibAnk.exe
  C:\Windows\System\zkibAnk.exe
  2⤵
  PID:8516
- C:\Windows\System\RuEYVDO.exe
  C:\Windows\System\RuEYVDO.exe
  2⤵
  PID:7324
- C:\Windows\System\NIxqkHn.exe
  C:\Windows\System\NIxqkHn.exe
  2⤵
  PID:1660
- C:\Windows\System\shwUrMt.exe
  C:\Windows\System\shwUrMt.exe
  2⤵
  PID:12364
- C:\Windows\System\wlUXxfH.exe
  C:\Windows\System\wlUXxfH.exe
  2⤵
  PID:11300
- C:\Windows\System\TBmjxVp.exe
  C:\Windows\System\TBmjxVp.exe
  2⤵
  PID:2832
- C:\Windows\System\BBeoVGX.exe
  C:\Windows\System\BBeoVGX.exe
  2⤵
  PID:11712
- C:\Windows\System\IsaCkkp.exe
  C:\Windows\System\IsaCkkp.exe
  2⤵
  PID:12052
- C:\Windows\System\HwQKGCW.exe
  C:\Windows\System\HwQKGCW.exe
  2⤵
  PID:2996
- C:\Windows\System\nJDSyTa.exe
  C:\Windows\System\nJDSyTa.exe
  2⤵
  PID:3864
- C:\Windows\System\UzXTrsF.exe
  C:\Windows\System\UzXTrsF.exe
  2⤵
  PID:6424
- C:\Windows\System\aXvRtHf.exe
  C:\Windows\System\aXvRtHf.exe
  2⤵
  PID:11920
- C:\Windows\System\cebCfYp.exe
  C:\Windows\System\cebCfYp.exe
  2⤵
  PID:13320
- C:\Windows\System\MEGhZxp.exe
  C:\Windows\System\MEGhZxp.exe
  2⤵
  PID:13336
- C:\Windows\System\INaQbQi.exe
  C:\Windows\System\INaQbQi.exe
  2⤵
  PID:13352
- C:\Windows\System\QHPmjJQ.exe
  C:\Windows\System\QHPmjJQ.exe
  2⤵
  PID:13368
- C:\Windows\System\hLQtmUa.exe
  C:\Windows\System\hLQtmUa.exe
  2⤵
  PID:13388
- C:\Windows\System\HPSbzNp.exe
  C:\Windows\System\HPSbzNp.exe
  2⤵
  PID:13404
- C:\Windows\System\Snsqsxo.exe
  C:\Windows\System\Snsqsxo.exe
  2⤵
  PID:13428
- C:\Windows\System\TEzBFSF.exe
  C:\Windows\System\TEzBFSF.exe
  2⤵
  PID:13444
- C:\Windows\System\ZiAfMuT.exe
  C:\Windows\System\ZiAfMuT.exe
  2⤵
  PID:13464
- C:\Windows\System\BIuMDgQ.exe
  C:\Windows\System\BIuMDgQ.exe
  2⤵
  PID:13484
- C:\Windows\System\JitFZlz.exe
  C:\Windows\System\JitFZlz.exe
  2⤵
  PID:13504
- C:\Windows\System\nNNrblU.exe
  C:\Windows\System\nNNrblU.exe
  2⤵
  PID:13520
- C:\Windows\System\omxlLfq.exe
  C:\Windows\System\omxlLfq.exe
  2⤵
  PID:13536
- C:\Windows\System\hssaRVw.exe
  C:\Windows\System\hssaRVw.exe
  2⤵
  PID:13564
- C:\Windows\System\qOmaRPW.exe
  C:\Windows\System\qOmaRPW.exe
  2⤵
  PID:13580
- C:\Windows\System\AWKDLKy.exe
  C:\Windows\System\AWKDLKy.exe
  2⤵
  PID:13596
- C:\Windows\System\smJdptN.exe
  C:\Windows\System\smJdptN.exe
  2⤵
  PID:13612
- C:\Windows\System\dtdGpLk.exe
  C:\Windows\System\dtdGpLk.exe
  2⤵
  PID:13632
- C:\Windows\System\kaJWEpf.exe
  C:\Windows\System\kaJWEpf.exe
  2⤵
  PID:13648
- C:\Windows\System\enDdOSm.exe
  C:\Windows\System\enDdOSm.exe
  2⤵
  PID:13664
- C:\Windows\System\fLIISxR.exe
  C:\Windows\System\fLIISxR.exe
  2⤵
  PID:13680
- C:\Windows\System\jgqAPFa.exe
  C:\Windows\System\jgqAPFa.exe
  2⤵
  PID:13696
- C:\Windows\System\FAKfhRO.exe
  C:\Windows\System\FAKfhRO.exe
  2⤵
  PID:13712
- C:\Windows\System\fAklcgr.exe
  C:\Windows\System\fAklcgr.exe
  2⤵
  PID:13752
- C:\Windows\System\qPsPFBb.exe
  C:\Windows\System\qPsPFBb.exe
  2⤵
  PID:14132
- C:\Windows\System\SxLbyFA.exe
  C:\Windows\System\SxLbyFA.exe
  2⤵
  PID:13800
- C:\Windows\System\Blmglmo.exe
  C:\Windows\System\Blmglmo.exe
  2⤵
  PID:14308
- C:\Windows\System\GVkaSxT.exe
  C:\Windows\System\GVkaSxT.exe
  2⤵
  PID:13872
- C:\Windows\System\KGMFuWD.exe
  C:\Windows\System\KGMFuWD.exe
  2⤵
  PID:13892
- C:\Windows\System\aiNcXqe.exe
  C:\Windows\System\aiNcXqe.exe
  2⤵
  PID:13916
- C:\Windows\System\ZlnInEQ.exe
  C:\Windows\System\ZlnInEQ.exe
  2⤵
  PID:13844
- C:\Windows\System\YHxNwlF.exe
  C:\Windows\System\YHxNwlF.exe
  2⤵
  PID:2272
- C:\Windows\System\lKbgCkX.exe
  C:\Windows\System\lKbgCkX.exe
  2⤵
  PID:13912
- C:\Windows\System\RUqBYha.exe
  C:\Windows\System\RUqBYha.exe
  2⤵
  PID:2916
- C:\Windows\System\nilYsem.exe
  C:\Windows\System\nilYsem.exe
  2⤵
  PID:14028
- C:\Windows\System\WyhcHWk.exe
  C:\Windows\System\WyhcHWk.exe
  2⤵
  PID:14008
- C:\Windows\System\nTtmlZd.exe
  C:\Windows\System\nTtmlZd.exe
  2⤵
  PID:14064
- C:\Windows\System\zHbtviQ.exe
  C:\Windows\System\zHbtviQ.exe
  2⤵
  PID:14076
- C:\Windows\System\RenuTte.exe
  C:\Windows\System\RenuTte.exe
  2⤵
  PID:14116
- C:\Windows\System\kyPNlEq.exe
  C:\Windows\System\kyPNlEq.exe
  2⤵
  PID:3956
- C:\Windows\System\JqWQoll.exe
  C:\Windows\System\JqWQoll.exe
  2⤵
  PID:14148
- C:\Windows\System\GTHxDqP.exe
  C:\Windows\System\GTHxDqP.exe
  2⤵
  PID:12036
- C:\Windows\System\UDmRkEb.exe
  C:\Windows\System\UDmRkEb.exe
  2⤵
  PID:13788
- C:\Windows\System\MTzWVTu.exe
  C:\Windows\System\MTzWVTu.exe
  2⤵
  PID:4084
- C:\Windows\System\aKtWAwy.exe
  C:\Windows\System\aKtWAwy.exe
  2⤵
  PID:14248
- C:\Windows\System\Bthnlpu.exe
  C:\Windows\System\Bthnlpu.exe
  2⤵
  PID:14288
- C:\Windows\System\OOHSBQJ.exe
  C:\Windows\System\OOHSBQJ.exe
  2⤵
  PID:14328
- C:\Windows\System\IiwCzXY.exe
  C:\Windows\System\IiwCzXY.exe
  2⤵
  PID:13316
- C:\Windows\System\pljSYhN.exe
  C:\Windows\System\pljSYhN.exe
  2⤵
  PID:13364
- C:\Windows\System\fRzHDBc.exe
  C:\Windows\System\fRzHDBc.exe
  2⤵
  PID:13400
- C:\Windows\System\XlMIxTr.exe
  C:\Windows\System\XlMIxTr.exe
  2⤵
  PID:13424
- C:\Windows\System\BwFkVNC.exe
  C:\Windows\System\BwFkVNC.exe
  2⤵
  PID:13496
- C:\Windows\System\EumDIpB.exe
  C:\Windows\System\EumDIpB.exe
  2⤵
  PID:13516
- C:\Windows\System\uNooDPQ.exe
  C:\Windows\System\uNooDPQ.exe
  2⤵
  PID:13576
- C:\Windows\System\OReIbAS.exe
  C:\Windows\System\OReIbAS.exe
  2⤵
  PID:13624
- C:\Windows\System\xyRYOBM.exe
  C:\Windows\System\xyRYOBM.exe
  2⤵
  PID:13656
- C:\Windows\System\ABLsUuH.exe
  C:\Windows\System\ABLsUuH.exe
  2⤵
  PID:13660
- C:\Windows\System\sPYXMdf.exe
  C:\Windows\System\sPYXMdf.exe
  2⤵
  PID:13692
- C:\Windows\System\GXyNTbD.exe
  C:\Windows\System\GXyNTbD.exe
  2⤵
  PID:13732
- C:\Windows\System\DCkjQIv.exe
  C:\Windows\System\DCkjQIv.exe
  2⤵
  PID:13748
- C:\Windows\System\quRByed.exe
  C:\Windows\System\quRByed.exe
  2⤵
  PID:13792
- C:\Windows\System\VranVcT.exe
  C:\Windows\System\VranVcT.exe
  2⤵
  PID:14068
- C:\Windows\System\XyGECVm.exe
  C:\Windows\System\XyGECVm.exe
  2⤵
  PID:7572
- C:\Windows\System\brHGitZ.exe
  C:\Windows\System\brHGitZ.exe
  2⤵
  PID:4124
- C:\Windows\System\ybwFMsu.exe
  C:\Windows\System\ybwFMsu.exe
  2⤵
  PID:13868
- C:\Windows\System\FjTkuOs.exe
  C:\Windows\System\FjTkuOs.exe
  2⤵
  PID:4776
- C:\Windows\System\rXRvDnt.exe
  C:\Windows\System\rXRvDnt.exe
  2⤵
  PID:13952
- C:\Windows\System\UeDYfEC.exe
  C:\Windows\System\UeDYfEC.exe
  2⤵
  PID:13940
- C:\Windows\System\znSakIB.exe
  C:\Windows\System\znSakIB.exe
  2⤵
  PID:3640
- C:\Windows\System\otpQbua.exe
  C:\Windows\System\otpQbua.exe
  2⤵
  PID:436
- C:\Windows\System\bLeAZED.exe
  C:\Windows\System\bLeAZED.exe
  2⤵
  PID:1316
- C:\Windows\System\VKMockW.exe
  C:\Windows\System\VKMockW.exe
  2⤵
  PID:1432
- C:\Windows\System\aeDYqgB.exe
  C:\Windows\System\aeDYqgB.exe
  2⤵
  PID:13996
- C:\Windows\System\oNWpMyd.exe
  C:\Windows\System\oNWpMyd.exe
  2⤵
  PID:3316
- C:\Windows\System\lKuiYnf.exe
  C:\Windows\System\lKuiYnf.exe
  2⤵
  PID:4204
- C:\Windows\System\OweiClu.exe
  C:\Windows\System\OweiClu.exe
  2⤵
  PID:14152
- C:\Windows\System\XtqEGlh.exe
  C:\Windows\System\XtqEGlh.exe
  2⤵
  PID:1440
- C:\Windows\System\zaYTWGp.exe
  C:\Windows\System\zaYTWGp.exe
  2⤵
  PID:1480
- C:\Windows\System\kmyHEVI.exe
  C:\Windows\System\kmyHEVI.exe
  2⤵
  PID:14208
- C:\Windows\System\jQPlcSe.exe
  C:\Windows\System\jQPlcSe.exe
  2⤵
  PID:14224
- C:\Windows\System\fFSdOxn.exe
  C:\Windows\System\fFSdOxn.exe
  2⤵
  PID:14228
- C:\Windows\System\HMsNoss.exe
  C:\Windows\System\HMsNoss.exe
  2⤵
  PID:8104
- C:\Windows\System\ZQPieFj.exe
  C:\Windows\System\ZQPieFj.exe
  2⤵
  PID:6392
- C:\Windows\System\MbXmNkw.exe
  C:\Windows\System\MbXmNkw.exe
  2⤵
  PID:3508
- C:\Windows\System\ebbLbba.exe
  C:\Windows\System\ebbLbba.exe
  2⤵
  PID:4132
- C:\Windows\System\fXGwyOY.exe
  C:\Windows\System\fXGwyOY.exe
  2⤵
  PID:5048
- C:\Windows\System\DxAZWNu.exe
  C:\Windows\System\DxAZWNu.exe
  2⤵
  PID:3312
- C:\Windows\System\QvumLZJ.exe
  C:\Windows\System\QvumLZJ.exe
  2⤵
  PID:3728
- C:\Windows\System\oqLfQsL.exe
  C:\Windows\System\oqLfQsL.exe
  2⤵
  PID:1008
- C:\Windows\System\lNsQQGo.exe
  C:\Windows\System\lNsQQGo.exe
  2⤵
  PID:14284
- C:\Windows\System\OnHomWN.exe
  C:\Windows\System\OnHomWN.exe
  2⤵
  PID:14304
- C:\Windows\System\WJjbxOx.exe
  C:\Windows\System\WJjbxOx.exe
  2⤵
  PID:14264
- C:\Windows\System\zcuQfZJ.exe
  C:\Windows\System\zcuQfZJ.exe
  2⤵
  PID:13436
- C:\Windows\System\yvUmNGd.exe
  C:\Windows\System\yvUmNGd.exe
  2⤵
  PID:3588
- C:\Windows\System\eKatSgO.exe
  C:\Windows\System\eKatSgO.exe
  2⤵
  PID:5644
- C:\Windows\System\Hfhsfka.exe
  C:\Windows\System\Hfhsfka.exe
  2⤵
  PID:1380
- C:\Windows\System\oHYhZSi.exe
  C:\Windows\System\oHYhZSi.exe
  2⤵
  PID:13440
- C:\Windows\System\GMRsvXk.exe
  C:\Windows\System\GMRsvXk.exe
  2⤵
  PID:5656
- C:\Windows\System\JSStEnA.exe
  C:\Windows\System\JSStEnA.exe
  2⤵
  PID:1224
- C:\Windows\System\UxWRDJT.exe
  C:\Windows\System\UxWRDJT.exe
  2⤵
  PID:3384
- C:\Windows\System\RBGIPRC.exe
  C:\Windows\System\RBGIPRC.exe
  2⤵
  PID:13724
- C:\Windows\System\YnvMEvP.exe
  C:\Windows\System\YnvMEvP.exe
  2⤵
  PID:5676
- C:\Windows\System\ITvMHPo.exe
  C:\Windows\System\ITvMHPo.exe
  2⤵
  PID:13768
- C:\Windows\System\HBORolQ.exe
  C:\Windows\System\HBORolQ.exe
  2⤵
  PID:13776
- C:\Windows\System\QoZHiRJ.exe
  C:\Windows\System\QoZHiRJ.exe
  2⤵
  PID:4596
- C:\Windows\System\fNnrVgl.exe
  C:\Windows\System\fNnrVgl.exe
  2⤵
  PID:2364
- C:\Windows\System\pTdcDqo.exe
  C:\Windows\System\pTdcDqo.exe
  2⤵
  PID:13816
- C:\Windows\System\Glyfxsn.exe
  C:\Windows\System\Glyfxsn.exe
  2⤵
  PID:3784
- C:\Windows\System\feyUJEB.exe
  C:\Windows\System\feyUJEB.exe
  2⤵
  PID:13832
- C:\Windows\System\rPeEnLr.exe
  C:\Windows\System\rPeEnLr.exe
  2⤵
  PID:7652
- C:\Windows\System\uOaTaIu.exe
  C:\Windows\System\uOaTaIu.exe
  2⤵
  PID:13944
- C:\Windows\System\YSbmKbH.exe
  C:\Windows\System\YSbmKbH.exe
  2⤵
  PID:13972
- C:\Windows\System\wpJKBGk.exe
  C:\Windows\System\wpJKBGk.exe
  2⤵
  PID:13968
- C:\Windows\System\svcNNow.exe
  C:\Windows\System\svcNNow.exe
  2⤵
  PID:5244
- C:\Windows\System\VMfxEgm.exe
  C:\Windows\System\VMfxEgm.exe
  2⤵
  PID:5524
- C:\Windows\System\qzTWkMs.exe
  C:\Windows\System\qzTWkMs.exe
  2⤵
  PID:6200
- C:\Windows\System\yYJrsJb.exe
  C:\Windows\System\yYJrsJb.exe
  2⤵
  PID:13848
- C:\Windows\System\MhnMwtp.exe
  C:\Windows\System\MhnMwtp.exe
  2⤵
  PID:3532
- C:\Windows\System\BjUMJQc.exe
  C:\Windows\System\BjUMJQc.exe
  2⤵
  PID:14032
- C:\Windows\System\LyIPOrx.exe
  C:\Windows\System\LyIPOrx.exe
  2⤵
  PID:14096
- C:\Windows\System\pIjGzcJ.exe
  C:\Windows\System\pIjGzcJ.exe
  2⤵
  PID:4048
- C:\Windows\System\kjCHRsp.exe
  C:\Windows\System\kjCHRsp.exe
  2⤵
  PID:14080
- C:\Windows\System\hvwCBCG.exe
  C:\Windows\System\hvwCBCG.exe
  2⤵
  PID:14128
- C:\Windows\System\ZyJaSaN.exe
  C:\Windows\System\ZyJaSaN.exe
  2⤵
  PID:6360
- C:\Windows\System\NRgvwPj.exe
  C:\Windows\System\NRgvwPj.exe
  2⤵
  PID:4128
- C:\Windows\System\TZBACKi.exe
  C:\Windows\System\TZBACKi.exe
  2⤵
  PID:2108
- C:\Windows\System\AchVLmp.exe
  C:\Windows\System\AchVLmp.exe
  2⤵
  PID:2964
- C:\Windows\System\LdUivkk.exe
  C:\Windows\System\LdUivkk.exe
  2⤵
  PID:4364
- C:\Windows\System\yHCiBhX.exe
  C:\Windows\System\yHCiBhX.exe
  2⤵
  PID:14204
- C:\Windows\System\txKzZKL.exe
  C:\Windows\System\txKzZKL.exe
  2⤵
  PID:14236
- C:\Windows\System\DPwvDtH.exe
  C:\Windows\System\DPwvDtH.exe
  2⤵
  PID:8056
- C:\Windows\System\mTJBodK.exe
  C:\Windows\System\mTJBodK.exe
  2⤵
  PID:6852
- C:\Windows\System\TDSmtsR.exe
  C:\Windows\System\TDSmtsR.exe
  2⤵
  PID:2804
- C:\Windows\System\hnhUOqr.exe
  C:\Windows\System\hnhUOqr.exe
  2⤵
  PID:6748
- C:\Windows\System\PgJgLeI.exe
  C:\Windows\System\PgJgLeI.exe
  2⤵
  PID:5552
- C:\Windows\System\jxSrzeM.exe
  C:\Windows\System\jxSrzeM.exe
  2⤵
  PID:6232
- C:\Windows\System\YcVqTFU.exe
  C:\Windows\System\YcVqTFU.exe
  2⤵
  PID:3636
- C:\Windows\System\PDQEBgJ.exe
  C:\Windows\System\PDQEBgJ.exe
  2⤵
  PID:3360
- C:\Windows\System\enqeAVa.exe
  C:\Windows\System\enqeAVa.exe
  2⤵
  PID:4912
- C:\Windows\System\qaPZVCv.exe
  C:\Windows\System\qaPZVCv.exe
  2⤵
  PID:6900
- C:\Windows\System\rWIZXwx.exe
  C:\Windows\System\rWIZXwx.exe
  2⤵
  PID:13396
- C:\Windows\System\AkbmANP.exe
  C:\Windows\System\AkbmANP.exe
  2⤵
  PID:3876
- C:\Windows\System\wHlMWnG.exe
  C:\Windows\System\wHlMWnG.exe
  2⤵
  PID:6276
- C:\Windows\System\ouImkVP.exe
  C:\Windows\System\ouImkVP.exe
  2⤵
  PID:3320
- C:\Windows\System\ymhCxsE.exe
  C:\Windows\System\ymhCxsE.exe
  2⤵
  PID:13532
- C:\Windows\System\ojqbLCV.exe
  C:\Windows\System\ojqbLCV.exe
  2⤵
  PID:13604
- C:\Windows\System\CEpOdDu.exe
  C:\Windows\System\CEpOdDu.exe
  2⤵
  PID:5652
- C:\Windows\System\YAinwFw.exe
  C:\Windows\System\YAinwFw.exe
  2⤵
  PID:13640
- C:\Windows\System\xstEHIf.exe
  C:\Windows\System\xstEHIf.exe
  2⤵
  PID:7060
- C:\Windows\System\duaGUjT.exe
  C:\Windows\System\duaGUjT.exe
  2⤵
  PID:5664
- C:\Windows\System\fzIqvBX.exe
  C:\Windows\System\fzIqvBX.exe
  2⤵
  PID:13988
- C:\Windows\System\AbEfbUC.exe
  C:\Windows\System\AbEfbUC.exe
  2⤵
  PID:2348
- C:\Windows\System\whTfSQl.exe
  C:\Windows\System\whTfSQl.exe
  2⤵
  PID:6756
- C:\Windows\System\nAomnCl.exe
  C:\Windows\System\nAomnCl.exe
  2⤵
  PID:14176
- C:\Windows\System\RgSiKIW.exe
  C:\Windows\System\RgSiKIW.exe
  2⤵
  PID:13708
- C:\Windows\System\JwSAXwi.exe
  C:\Windows\System\JwSAXwi.exe
  2⤵
  PID:7092
- C:\Windows\System\apVqaEk.exe
  C:\Windows\System\apVqaEk.exe
  2⤵
  PID:1084
- C:\Windows\System\MVahipz.exe
  C:\Windows\System\MVahipz.exe
  2⤵
  PID:7104
- C:\Windows\System\jZYMDYu.exe
  C:\Windows\System\jZYMDYu.exe
  2⤵
  PID:5816
- C:\Windows\System\nTqMWmn.exe
  C:\Windows\System\nTqMWmn.exe
  2⤵
  PID:3988
- C:\Windows\System\AVfbrPl.exe
  C:\Windows\System\AVfbrPl.exe
  2⤵
  PID:6936
- C:\Windows\System\FMXKnJp.exe
  C:\Windows\System\FMXKnJp.exe
  2⤵
  PID:1488
- C:\Windows\System\FKcQIuu.exe
  C:\Windows\System\FKcQIuu.exe
  2⤵
  PID:7120
- C:\Windows\System\hXQhBgA.exe
  C:\Windows\System\hXQhBgA.exe
  2⤵
  PID:13964
- C:\Windows\System\aQkmKJu.exe
  C:\Windows\System\aQkmKJu.exe
  2⤵
  PID:7152
- C:\Windows\System\NYEVBPf.exe
  C:\Windows\System\NYEVBPf.exe
  2⤵
  PID:7156
- C:\Windows\System\ebjhxaz.exe
  C:\Windows\System\ebjhxaz.exe
  2⤵
  PID:5308
- C:\Windows\System\QgnDmoK.exe
  C:\Windows\System\QgnDmoK.exe
  2⤵
  PID:4984
- C:\Windows\System\QmPcfwU.exe
  C:\Windows\System\QmPcfwU.exe
  2⤵
  PID:1576
- C:\Windows\System\birUxig.exe
  C:\Windows\System\birUxig.exe
  2⤵
  PID:13896
- C:\Windows\System\onlNNkl.exe
  C:\Windows\System\onlNNkl.exe
  2⤵
  PID:5576
- C:\Windows\System\QfNoeBe.exe
  C:\Windows\System\QfNoeBe.exe
  2⤵
  PID:3348
- C:\Windows\System\DUctfBO.exe
  C:\Windows\System\DUctfBO.exe
  2⤵
  PID:4664
- C:\Windows\System\XeIalcF.exe
  C:\Windows\System\XeIalcF.exe
  2⤵
  PID:4988
- C:\Windows\System\ShKwwQm.exe
  C:\Windows\System\ShKwwQm.exe
  2⤵
  PID:3200
- C:\Windows\System\qTVswOi.exe
  C:\Windows\System\qTVswOi.exe
  2⤵
  PID:3268
- C:\Windows\System\vtSkpdH.exe
  C:\Windows\System\vtSkpdH.exe
  2⤵
  PID:2732
- C:\Windows\System\UMtfUpS.exe
  C:\Windows\System\UMtfUpS.exe
  2⤵
  PID:4672
- C:\Windows\System\JckdqDN.exe
  C:\Windows\System\JckdqDN.exe
  2⤵
  PID:6380
- C:\Windows\System\WRqjbAw.exe
  C:\Windows\System\WRqjbAw.exe
  2⤵
  PID:6016
- C:\Windows\System\fApzyzT.exe
  C:\Windows\System\fApzyzT.exe
  2⤵
  PID:5088
- C:\Windows\System\juIvImf.exe
  C:\Windows\System\juIvImf.exe
  2⤵
  PID:1984
- C:\Windows\System\LMnzoAU.exe
  C:\Windows\System\LMnzoAU.exe
  2⤵
  PID:5444
- C:\Windows\System\uXCrNEq.exe
  C:\Windows\System\uXCrNEq.exe
  2⤵
  PID:1392
- C:\Windows\System\nLKitow.exe
  C:\Windows\System\nLKitow.exe
  2⤵
  PID:2540
- C:\Windows\System\IscmLIZ.exe
  C:\Windows\System\IscmLIZ.exe
  2⤵
  PID:4624
- C:\Windows\System\ofgUrYG.exe
  C:\Windows\System\ofgUrYG.exe
  2⤵
  PID:8172
- C:\Windows\System\uYORWZB.exe
  C:\Windows\System\uYORWZB.exe
  2⤵
  PID:6648
- C:\Windows\System\YHjtbgU.exe
  C:\Windows\System\YHjtbgU.exe
  2⤵
  PID:4592
- C:\Windows\System\HPaWbON.exe
  C:\Windows\System\HPaWbON.exe
  2⤵
  PID:1540
- C:\Windows\System\ddvAMdS.exe
  C:\Windows\System\ddvAMdS.exe
  2⤵
  PID:6660
- C:\Windows\System\YsDzfFU.exe
  C:\Windows\System\YsDzfFU.exe
  2⤵
  PID:6192
- C:\Windows\System\HPylskE.exe
  C:\Windows\System\HPylskE.exe
  2⤵
  PID:4404
- C:\Windows\System\kxkaRfd.exe
  C:\Windows\System\kxkaRfd.exe
  2⤵
  PID:6196
- C:\Windows\System\JwqxbuZ.exe
  C:\Windows\System\JwqxbuZ.exe
  2⤵
  PID:6344
- C:\Windows\System\eunNDvE.exe
  C:\Windows\System\eunNDvE.exe
  2⤵
  PID:5340
- C:\Windows\System\ZahpbpM.exe
  C:\Windows\System\ZahpbpM.exe
  2⤵
  PID:13932
- C:\Windows\System\DOgCgeF.exe
  C:\Windows\System\DOgCgeF.exe
  2⤵
  PID:6172
- C:\Windows\System\zDjfruW.exe
  C:\Windows\System\zDjfruW.exe
  2⤵
  PID:6024
- C:\Windows\System\qAjMRav.exe
  C:\Windows\System\qAjMRav.exe
  2⤵
  PID:13332
- C:\Windows\System\TeqWkOM.exe
  C:\Windows\System\TeqWkOM.exe
  2⤵
  PID:7068
- C:\Windows\System\pjqzkLc.exe
  C:\Windows\System\pjqzkLc.exe
  2⤵
  PID:3392
- C:\Windows\System\duYQcOW.exe
  C:\Windows\System\duYQcOW.exe
  2⤵
  PID:6456
- C:\Windows\System\QXArJEh.exe
  C:\Windows\System\QXArJEh.exe
  2⤵
  PID:14272
- C:\Windows\System\fyKqZYn.exe
  C:\Windows\System\fyKqZYn.exe
  2⤵
  PID:13984
- C:\Windows\System\aQBTRbg.exe
  C:\Windows\System\aQBTRbg.exe
  2⤵
  PID:6540
- C:\Windows\System\MYMBIin.exe
  C:\Windows\System\MYMBIin.exe
  2⤵
  PID:5152
- C:\Windows\System\KZmQcfc.exe
  C:\Windows\System\KZmQcfc.exe
  2⤵
  PID:2624
- C:\Windows\System\KtLUWHJ.exe
  C:\Windows\System\KtLUWHJ.exe
  2⤵
  PID:14084
- C:\Windows\System\QxDoits.exe
  C:\Windows\System\QxDoits.exe
  2⤵
  PID:5932
- C:\Windows\System\UkpJjwB.exe
  C:\Windows\System\UkpJjwB.exe
  2⤵
  PID:14164
- C:\Windows\System\QLcpYXh.exe
  C:\Windows\System\QLcpYXh.exe
  2⤵
  PID:5660
- C:\Windows\System\rPOinuC.exe
  C:\Windows\System\rPOinuC.exe
  2⤵
  PID:7064
- C:\Windows\System\xZZpuTj.exe
  C:\Windows\System\xZZpuTj.exe
  2⤵
  PID:14052
- C:\Windows\System\vTlbRNO.exe
  C:\Windows\System\vTlbRNO.exe
  2⤵
  PID:14240
- C:\Windows\System\SchCdmP.exe
  C:\Windows\System\SchCdmP.exe
  2⤵
  PID:5732
- C:\Windows\System\BpQmYOM.exe
  C:\Windows\System\BpQmYOM.exe
  2⤵
  PID:7100
- C:\Windows\System\opQbsWk.exe
  C:\Windows\System\opQbsWk.exe
  2⤵
  PID:6928
- C:\Windows\System\xrrdhBg.exe
  C:\Windows\System\xrrdhBg.exe
  2⤵
  PID:4492
- C:\Windows\System\cplYVjZ.exe
  C:\Windows\System\cplYVjZ.exe
  2⤵
  PID:13824
- C:\Windows\System\IAoDBri.exe
  C:\Windows\System\IAoDBri.exe
  2⤵
  PID:4972
- C:\Windows\System\WDuTGfW.exe
  C:\Windows\System\WDuTGfW.exe
  2⤵
  PID:5896
- C:\Windows\System\ILqIRtw.exe
  C:\Windows\System\ILqIRtw.exe
  2⤵
  PID:6372
- C:\Windows\System\tseirDJ.exe
  C:\Windows\System\tseirDJ.exe
  2⤵
  PID:2016
- C:\Windows\System\VsUfcGB.exe
  C:\Windows\System\VsUfcGB.exe
  2⤵
  PID:3596
- C:\Windows\System\sxdpgkb.exe
  C:\Windows\System\sxdpgkb.exe
  2⤵
  PID:7164
- C:\Windows\System\dcdpzoU.exe
  C:\Windows\System\dcdpzoU.exe
  2⤵
  PID:7028
- C:\Windows\System\JAalNdz.exe
  C:\Windows\System\JAalNdz.exe
  2⤵
  PID:1736
- C:\Windows\System\qyGXDqY.exe
  C:\Windows\System\qyGXDqY.exe
  2⤵
  PID:5380
- C:\Windows\System\gZAMcOO.exe
  C:\Windows\System\gZAMcOO.exe
  2⤵
  PID:5832
- C:\Windows\System\HiIdXWl.exe
  C:\Windows\System\HiIdXWl.exe
  2⤵
  PID:1760
- C:\Windows\System\WcqCveZ.exe
  C:\Windows\System\WcqCveZ.exe
  2⤵
  PID:5012
- C:\Windows\System\ZJLDbuM.exe
  C:\Windows\System\ZJLDbuM.exe
  2⤵
  PID:3024
- C:\Windows\System\PiLtOSm.exe
  C:\Windows\System\PiLtOSm.exe
  2⤵
  PID:14140
- C:\Windows\System\DLcnhrD.exe
  C:\Windows\System\DLcnhrD.exe
  2⤵
  PID:244
- C:\Windows\System\YTYUZHE.exe
  C:\Windows\System\YTYUZHE.exe
  2⤵
  PID:4236
- C:\Windows\System\KVOhSbN.exe
  C:\Windows\System\KVOhSbN.exe
  2⤵
  PID:5984
- C:\Windows\System\XGJlJvS.exe
  C:\Windows\System\XGJlJvS.exe
  2⤵
  PID:3116
- C:\Windows\System\dvxkDNg.exe
  C:\Windows\System\dvxkDNg.exe
  2⤵
  PID:7008
- C:\Windows\System\gpYbdrO.exe
  C:\Windows\System\gpYbdrO.exe
  2⤵
  PID:4976
- C:\Windows\System\YeMPYHq.exe
  C:\Windows\System\YeMPYHq.exe
  2⤵
  PID:560
- C:\Windows\System\nTLoQOa.exe
  C:\Windows\System\nTLoQOa.exe
  2⤵
  PID:5420
- C:\Windows\System\ZUHyQhI.exe
  C:\Windows\System\ZUHyQhI.exe
  2⤵
  PID:6140
- C:\Windows\System\JJlEjcr.exe
  C:\Windows\System\JJlEjcr.exe
  2⤵
  PID:6776
- C:\Windows\System\qTRSxht.exe
  C:\Windows\System\qTRSxht.exe
  2⤵
  PID:5528
- C:\Windows\System\TLjbbJE.exe
  C:\Windows\System\TLjbbJE.exe
  2⤵
  PID:2128
- C:\Windows\System\QfultZK.exe
  C:\Windows\System\QfultZK.exe
  2⤵
  PID:764
- C:\Windows\System\OcCNXvs.exe
  C:\Windows\System\OcCNXvs.exe
  2⤵
  PID:6708
- C:\Windows\System\vLGruMu.exe
  C:\Windows\System\vLGruMu.exe
  2⤵
  PID:5588
- C:\Windows\System\vNGBSIv.exe
  C:\Windows\System\vNGBSIv.exe
  2⤵
  PID:1556
- C:\Windows\System\lkekooR.exe
  C:\Windows\System\lkekooR.exe
  2⤵
  PID:5188
- C:\Windows\System\XFHnjQr.exe
  C:\Windows\System\XFHnjQr.exe
  2⤵
  PID:4420
- C:\Windows\System\mfySsWT.exe
  C:\Windows\System\mfySsWT.exe
  2⤵
  PID:5364
- C:\Windows\System\QyVeyND.exe
  C:\Windows\System\QyVeyND.exe
  2⤵
  PID:5320
- C:\Windows\System\scNcucB.exe
  C:\Windows\System\scNcucB.exe
  2⤵
  PID:4916
- C:\Windows\System\OMUuKFT.exe
  C:\Windows\System\OMUuKFT.exe
  2⤵
  PID:5456
- C:\Windows\System\MAYdDXe.exe
  C:\Windows\System\MAYdDXe.exe
  2⤵
  PID:5468
- C:\Windows\System\ScfkCIs.exe
  C:\Windows\System\ScfkCIs.exe
  2⤵
  PID:14268
- C:\Windows\System\kOugBNT.exe
  C:\Windows\System\kOugBNT.exe
  2⤵
  PID:5172
- C:\Windows\System\SsNxjNY.exe
  C:\Windows\System\SsNxjNY.exe
  2⤵
  PID:8
- C:\Windows\System\vQJpCSd.exe
  C:\Windows\System\vQJpCSd.exe
  2⤵
  PID:7216
- C:\Windows\System\TacdtoK.exe
  C:\Windows\System\TacdtoK.exe
  2⤵
  PID:14280
- C:\Windows\System\OJeVYWj.exe
  C:\Windows\System\OJeVYWj.exe
  2⤵
  PID:1252
- C:\Windows\System\mRZCaFl.exe
  C:\Windows\System\mRZCaFl.exe
  2⤵
  PID:5300
- C:\Windows\System\ihtXQZj.exe
  C:\Windows\System\ihtXQZj.exe
  2⤵
  PID:3016
- C:\Windows\System\ZaAenjp.exe
  C:\Windows\System\ZaAenjp.exe
  2⤵
  PID:7288
- C:\Windows\System\pNbTexZ.exe
  C:\Windows\System\pNbTexZ.exe
  2⤵
  PID:6496
- C:\Windows\System\yTRGeae.exe
  C:\Windows\System\yTRGeae.exe
  2⤵
  PID:13572
- C:\Windows\System\OUMyZgQ.exe
  C:\Windows\System\OUMyZgQ.exe
  2⤵
  PID:6632
- C:\Windows\System\tAsddge.exe
  C:\Windows\System\tAsddge.exe
  2⤵
  PID:7272
- C:\Windows\System\GPohMlh.exe
  C:\Windows\System\GPohMlh.exe
  2⤵
  PID:7280
- C:\Windows\System\RtiQPAO.exe
  C:\Windows\System\RtiQPAO.exe
  2⤵
  PID:5936
- C:\Windows\System\LYGEGAb.exe
  C:\Windows\System\LYGEGAb.exe
  2⤵
  PID:7084
- C:\Windows\System\TSQFHIl.exe
  C:\Windows\System\TSQFHIl.exe
  2⤵
  PID:6828
- C:\Windows\System\gJEQEPY.exe
  C:\Windows\System\gJEQEPY.exe
  2⤵
  PID:4580
- C:\Windows\System\HsLxhOR.exe
  C:\Windows\System\HsLxhOR.exe
  2⤵
  PID:5852
- C:\Windows\System\tGUjoow.exe
  C:\Windows\System\tGUjoow.exe
  2⤵
  PID:5304
- C:\Windows\System\FRhyrOu.exe
  C:\Windows\System\FRhyrOu.exe
  2⤵
  PID:6584
- C:\Windows\System\yZVXIGA.exe
  C:\Windows\System\yZVXIGA.exe
  2⤵
  PID:5344
- C:\Windows\System\husrjjY.exe
  C:\Windows\System\husrjjY.exe
  2⤵
  PID:5572
- C:\Windows\System\fJAOEKX.exe
  C:\Windows\System\fJAOEKX.exe
  2⤵
  PID:7128
- C:\Windows\System\RslrVLW.exe
  C:\Windows\System\RslrVLW.exe
  2⤵
  PID:4044
- C:\Windows\System\KSuqbpN.exe
  C:\Windows\System\KSuqbpN.exe
  2⤵
  PID:4352
- C:\Windows\System\iWgosLb.exe
  C:\Windows\System\iWgosLb.exe
  2⤵
  PID:3296
- C:\Windows\System\ayTdyAu.exe
  C:\Windows\System\ayTdyAu.exe
  2⤵
  PID:4012
- C:\Windows\System\pqdVtjV.exe
  C:\Windows\System\pqdVtjV.exe
  2⤵
  PID:5220
- C:\Windows\System\zYQTEWN.exe
  C:\Windows\System\zYQTEWN.exe
  2⤵
  PID:6408
- C:\Windows\System\DmAiYCK.exe
  C:\Windows\System\DmAiYCK.exe
  2⤵
  PID:468
- C:\Windows\System\kzfchjE.exe
  C:\Windows\System\kzfchjE.exe
  2⤵
  PID:6888
- C:\Windows\System\uqsrFIY.exe
  C:\Windows\System\uqsrFIY.exe
  2⤵
  PID:4504
- C:\Windows\System\mCYTlNK.exe
  C:\Windows\System\mCYTlNK.exe
  2⤵
  PID:8132
- C:\Windows\System\pncJxxw.exe
  C:\Windows\System\pncJxxw.exe
  2⤵
  PID:3416
- C:\Windows\System\pXIAZws.exe
  C:\Windows\System\pXIAZws.exe
  2⤵
  PID:7056
- C:\Windows\System\MzeEXLG.exe
  C:\Windows\System\MzeEXLG.exe
  2⤵
  PID:6168
- C:\Windows\System\zLZSKWR.exe
  C:\Windows\System\zLZSKWR.exe
  2⤵
  PID:2664
- C:\Windows\System\xZsrImn.exe
  C:\Windows\System\xZsrImn.exe
  2⤵
  PID:7196
- C:\Windows\System\HExffOz.exe
  C:\Windows\System\HExffOz.exe
  2⤵
  PID:5844
- C:\Windows\System\ZQUWQih.exe
  C:\Windows\System\ZQUWQih.exe
  2⤵
  PID:5556
- C:\Windows\System\LBpcViw.exe
  C:\Windows\System\LBpcViw.exe
  2⤵
  PID:7240
- C:\Windows\System\oCPwMaf.exe
  C:\Windows\System\oCPwMaf.exe
  2⤵
  PID:5360
- C:\Windows\System\xgMhqVn.exe
  C:\Windows\System\xgMhqVn.exe
  2⤵
  PID:7208
- C:\Windows\System\BKDullQ.exe
  C:\Windows\System\BKDullQ.exe
  2⤵
  PID:3796
- C:\Windows\System\rDogHmU.exe
  C:\Windows\System\rDogHmU.exe
  2⤵
  PID:5728
- C:\Windows\System\QrZIeTp.exe
  C:\Windows\System\QrZIeTp.exe
  2⤵
  PID:6992
- C:\Windows\System\xDVsezW.exe
  C:\Windows\System\xDVsezW.exe
  2⤵
  PID:7296
- C:\Windows\System\qVkhZEZ.exe
  C:\Windows\System\qVkhZEZ.exe
  2⤵
  PID:6388
- C:\Windows\System\TdcYpxv.exe
  C:\Windows\System\TdcYpxv.exe
  2⤵
  PID:5124
- C:\Windows\System\ccExxxY.exe
  C:\Windows\System\ccExxxY.exe
  2⤵
  PID:4056
- C:\Windows\System\NIxptsu.exe
  C:\Windows\System\NIxptsu.exe
  2⤵
  PID:648
- C:\Windows\System\UlBdeni.exe
  C:\Windows\System\UlBdeni.exe
  2⤵
  PID:6012
- C:\Windows\System\QRMAzOv.exe
  C:\Windows\System\QRMAzOv.exe
  2⤵
  PID:7232
- C:\Windows\System\bOAYYBB.exe
  C:\Windows\System\bOAYYBB.exe
  2⤵
  PID:7112
- C:\Windows\System\oYRyOaF.exe
  C:\Windows\System\oYRyOaF.exe
  2⤵
  PID:13876
- C:\Windows\System\RcETalM.exe
  C:\Windows\System\RcETalM.exe
  2⤵
  PID:3676
- C:\Windows\System\KdKanLE.exe
  C:\Windows\System\KdKanLE.exe
  2⤵
  PID:14244
- C:\Windows\System\mssVtkj.exe
  C:\Windows\System\mssVtkj.exe
  2⤵
  PID:14156
- C:\Windows\System\HPZjhYQ.exe
  C:\Windows\System\HPZjhYQ.exe
  2⤵
  PID:4468
- C:\Windows\System\WtmAlje.exe
  C:\Windows\System\WtmAlje.exe
  2⤵
  PID:2772
- C:\Windows\System\TyMbiQv.exe
  C:\Windows\System\TyMbiQv.exe
  2⤵
  PID:6188
- C:\Windows\System\JMneBAD.exe
  C:\Windows\System\JMneBAD.exe
  2⤵
  PID:6892
- C:\Windows\System\IpgkZoj.exe
  C:\Windows\System\IpgkZoj.exe
  2⤵
  PID:6228
- C:\Windows\System\XKxVNSK.exe
  C:\Windows\System\XKxVNSK.exe
  2⤵
  PID:5996
- C:\Windows\System\cYTdqjl.exe
  C:\Windows\System\cYTdqjl.exe
  2⤵
  PID:6296
- C:\Windows\System\lAbJPty.exe
  C:\Windows\System\lAbJPty.exe
  2⤵
  PID:2248
- C:\Windows\System\wAVPWUQ.exe
  C:\Windows\System\wAVPWUQ.exe
  2⤵
  PID:1788
- C:\Windows\System\DOHCNIw.exe
  C:\Windows\System\DOHCNIw.exe
  2⤵
  PID:7200
- C:\Windows\System\IlNvmqC.exe
  C:\Windows\System\IlNvmqC.exe
  2⤵
  PID:7264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cvnkcjnf.ak1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AlKhGUs.exe

Filesize
1.8MB

MD5
8663b8c34f1383dcebe025914f8ad577

SHA1
be4b639c2f58ea08bb47e447a73eab3b220abf60

SHA256
2122466f16308a1eaf0712cd41d34775216ab8d30a0e57c531bb366369acd1ef

SHA512
17b14d62eb77a0274e452ac8cdb05f3a6f535e7a3b58656d53712f8912e70e8da6f1c750c3a81da9ed497ff13025df114106e3837b741e610acd66fe2943a26f

Download Submit
C:\Windows\System\CDJwFrQ.exe

Filesize
1.8MB

MD5
c19f02eca421b904ce2b07397a83bf93

SHA1
09f512d5544c953007cf0778a4a68faa5451a4e7

SHA256
fd01e1f8d3f7e7fe6f84a1ce49eedfe8dd4a0d17ae97a6fa7c5c1b38476f6b99

SHA512
ce7fc04e8106242b5c79094bec27aa183ee241b2a6219634c023afbb92f8c5ae11404898cf2b29319764a482c4119e624dd46bd658d2041a8b059bb4e03014b5

Download Submit
C:\Windows\System\CIFkfZD.exe

Filesize
1.8MB

MD5
7e97526c042162d817417c76d4b98bd7

SHA1
a0b2796902fb34f0a9a3af335785928f110fe96d

SHA256
87ed532ec9469474985e995e516b0748d1f3f46ee842cd6aa85c2f964d749607

SHA512
80ab45c103055bbd88bbb7d72a61307f0244605828daf1a782c49d70a298081b2c7c44fab5ddc90d1e9bf5a9e1ab4c1423850739ef9cf260695f576207accd5f

Download Submit
C:\Windows\System\FWEpPRV.exe

Filesize
1.8MB

MD5
d4a602b2261b4f3888fe22b054a08766

SHA1
3422e19fc817f60aad4b7677be7bdb1c3b835a69

SHA256
5b10375042312ae1821f7be7e3f368c05074c76e7e08ed3be7e9485e3ff784e2

SHA512
89db89f3b34506549f91e9473c0bc0be2de71d7071f52001976b87a08b95541f590c7f0c20381c44a559983ef613ae70033aa0771e080e0f8d0aed0ee8495ad7

Download Submit
C:\Windows\System\OtUlKOo.exe

Filesize
1.8MB

MD5
c1e00f6e3307e5f5ee12c74096ec18fa

SHA1
a04023c4e7a61212f3d77dfaaa29c351577c42c9

SHA256
1f9be1cdbe9c4e5d5745c30694a685e20762e14b7fa5914d8a4c6e9e579b92fc

SHA512
747baf1b0a9f33921b11e3bf2f0f93d4d6f1e300af0768691537c663c9a8ad5d9272255aa3be7c3e669dc20b62f048da9ba03f63f922a935437ac8180b14f344

Download Submit
C:\Windows\System\RRNeEgV.exe

Filesize
1.8MB

MD5
9e5c60b720ddaaf8b81c1a4a53010857

SHA1
1a441e295ab705da5b6d67a26e2158e35008a4ca

SHA256
2cdeec52c376ba5d077ee1e4bb0e2463af72267e891921674e61965ea63d4302

SHA512
35720bad46a4201b935456922c5a1b985953de1741c78979fad6a6718c6300ee9b2136653c4aaabd25edf388429887dbd50e2248f564d211ef0bc5fb863b0934

Download Submit
C:\Windows\System\TYroyky.exe

Filesize
1.8MB

MD5
c017a87221198cc73d3f86f33a73a582

SHA1
0a0b3e3c13e46b949292406f3a21f933eaa7626a

SHA256
e4bfb0d0f73281c4fd8bdeb7d18f39c1907bf912dbfdeee2e20de9fbbcbe7350

SHA512
3158697318a4eec63568d6a0fdf945bb9906bb6649e123587a8a969d7109b1e2b1cb38f0a7477441cf682c91dc00068271249bf7e71134117b5d20d094c47f80

Download Submit
C:\Windows\System\TltMhHy.exe

Filesize
1.8MB

MD5
5fa34c2d8182f6da99718c8131c125da

SHA1
7841699d37a4d81d84aeaeb61115e744bc4ea161

SHA256
029c44d7bfcf49c29f654f2101909739fcc0f54eb9753f48928f86aa8e6d483d

SHA512
7b28b9c43a29ddf9fc67906cdd2c66a6e17567d258b471eb0d27a748ef5267797a7d34c35233a304bda01779a2ed1afc7e4ca320e67923da82b67fdd279900bd

Download Submit
C:\Windows\System\TuAZYJe.exe

Filesize
1.8MB

MD5
0e7b280276821a565599806bd78bb5c4

SHA1
27e3a86d57e329f92b70f9548df9a33c48c0e5ca

SHA256
7c560715f9268036bf18fd72616f5e9dfe961e748e19e2201befebb760ee09f4

SHA512
1fb1f8d55c5336c8e16d743f30bed8fa283355c0ccf819fc9428f7dea0d168fe66919a85a3d321002c3edd53e45584ae8c1fd754837e2cde00b3a8795c467ec8

Download Submit
C:\Windows\System\UCYKxKy.exe

Filesize
1.8MB

MD5
1b794539d60eefcd3bb0e5f9ebfbcd64

SHA1
9c111fee0ac90873e39a7bebbfc3925efe1c16d9

SHA256
54c3e349bb49714b681be4757cd2e93a777f269c81e1de6929d4e96f5d394206

SHA512
9d05c6aa23ca08c955f47f52a09819ed5f1f540fa513cfe2f99d47333903998f9c4d4f76dce7c6313321e330352027d58f5f2218f58bad9acf2c2a980696171c

Download Submit
C:\Windows\System\UeMnGVQ.exe

Filesize
1.8MB

MD5
3ec4c9bf0a699bf0cc86421c0bcda591

SHA1
0fb5ec46e6c9f1b22b88f3dc7738af16f8e8d928

SHA256
766bf37196e17d2232e387d3de577a9ca796e4a3678d3641f977e03402c88041

SHA512
f055b919840868772e9877ecaeb5bc6e3bd45cfaaaa327c35c404b2ead36dfdf0d3993544bb30e1eb228e73db93c9c65ea19dd7779546dee258a5fb1225dfa31

Download Submit
C:\Windows\System\VaRRdUk.exe

Filesize
1.8MB

MD5
7d8d76429658c4be7a72428ecb5e1603

SHA1
b8fded0e09717b04ceb018636851886c9aa3067e

SHA256
02b39ef2388d46f6ec6bf024d70fc630786996eb97dc17941b9704316672f30a

SHA512
3276f2a8adc02e0789533ac3c90ab5f5cbf3bf9505cf366268beda2ea1fbd86f44f91d11d8cb0635cd9215fdd90b82a7926367d95e7812b20f89b43646b83fb4

Download Submit
C:\Windows\System\WNVBzTo.exe

Filesize
1.8MB

MD5
0b7de7d36e947cd03967b5384df2afa2

SHA1
cb61401eaa754a4a0a8e638c266ca4aa4c62dd5a

SHA256
9ebb4983797aebdae61c74fa7d78a093b7641655ae40d8a7dcc09af5c7b46142

SHA512
5b4be67c039b1505d7787353249b8fd75d0dd6a7540f94b5d622eb78576cd9981bf98f0b110d3e9e5604f40178a13508972cf4d01ebb20a61f353a1e7a00ab17

Download Submit
C:\Windows\System\WfZnpyV.exe

Filesize
8B

MD5
0a09bd2e5542320a20ec8eafd2246c28

SHA1
7106c9c7587e96586e92363c5ef70ad925a395b7

SHA256
a2d90ea83d8a1ec8d2d933492892f6a19aa1f0a0628b1cc62b162e5271ee863b

SHA512
994b306b70fd71b0a462a50b9fc03457eac19be8a156ca56f4b5a47c058947eb0f9ce4c706b5ff16df4ad9b5c6da35585e95b3f5ce9ff8ead75dc92e4757e9c1

Download Submit
C:\Windows\System\XQbGpoT.exe

Filesize
1.8MB

MD5
1817635b535cbe635d04d16a228e6694

SHA1
2ce7a27b1389627675548e98c067e79dd4d81fde

SHA256
e060df535cebbc471f144cdea6c15244690daaf92a5cbe68d9cd57947194a7f1

SHA512
51b2c4e666484b0e1bc312e57e6287943d048fa05cd9b78705a419f0c01cdc94def6ba20e34622c78bddf448b31e05a4de807ff8a7e3157e4b34e0bd848f45f3

Download Submit
C:\Windows\System\XdMtlHN.exe

Filesize
1.8MB

MD5
c663c08a4a5b75f5143963baa7fb823e

SHA1
cc6118415c3e19d84e8a7d72bb09d9a4bc807a58

SHA256
d86c1c1e17d486f2251d5466454a96896c30547b44465abb3909439ba8ee8e5e

SHA512
7c3c264cae73ac45a85aa9c071aba1cfbe70082417e9ae7c3d597682b6621bcbfc3e424b1cc4e03053460c8f3511e9a25309efbd45ae1d9d1a1496fea6ec60ff

Download Submit
C:\Windows\System\YMrThdW.exe

Filesize
1.8MB

MD5
90c468c0eaa54e468e1c983438e8c65e

SHA1
823afafd8a9225241863494a6d3384af34935d1f

SHA256
ab562b7eb00f82b2267c94a4cc5325e8a3135ac9e4e8ccb28db8ba75e0718c36

SHA512
280bb4dec5fcd893b7f30b24ff5409db565f72efc21d57f51481e160891fceda5f0c667b7cfccc9b860eb8ebdc3c66684d02c94197f3546b0858c513423230b5

Download Submit
C:\Windows\System\ZrIbXgR.exe

Filesize
1.8MB

MD5
32b24ec9ede1a5a7427c15f23653ccd8

SHA1
d98db1484d0ab1ec16faa2bcc516632298f1ca13

SHA256
7f9e7418276b5d02486c94e4ff4f6f547234cef2f1c2ac6e08111abe07cf8144

SHA512
efd7022dd07390d3ee499b88d200936055ad0e1913bc102a5c6ac51d65f170dc7a09ed93ee2270cc986d606ec66202772ed763464c0daec5d60d3debc021225c

Download Submit
C:\Windows\System\bDrspEl.exe

Filesize
1.8MB

MD5
d7b1ff49b1153b0bf4ceccb1fe70b679

SHA1
c6b6e93ba302e52d996faf2f4154ef6b2ec5f63e

SHA256
c9ac50615ec346cf37e537e1b9d48b89d8fb9319fa190bf57182c0360822a97b

SHA512
84ee5da5066c2aa907f139bfd7c525cbb4dc12d75d02ecdf2eafd45e4c48a7d1c510941b18861636ca181e12ea0b7bb5fe35fb351fae0f09f4a1d3a2aff6df06

Download Submit
C:\Windows\System\cUSQQpj.exe

Filesize
1.8MB

MD5
f1445ef917ad6d80498f1de8314d5475

SHA1
8f5d15d4a9e038d31e292c3b93857348fe818e2a

SHA256
4d4139656599a70d0e5de5c1bb8276e2e1d8a8201b8793b2a473f8a6c9d71226

SHA512
43b137bd8c2c3b8ccd54aa819532f9fd0304deaf232908049938684357a0b851063a828f65d28cdf0ff5ee254e2041f86243452de98330e77b9aa046f7d87fde

Download Submit
C:\Windows\System\ccWORme.exe

Filesize
1.8MB

MD5
ee9335e0505381d2adec9cf3abee4962

SHA1
654f46bd03021b7e4406591bb535feb5ff206ff1

SHA256
5748e2630a88b7303d4f9ac3d23e750ce86d8e2a2d42a3717e80e956d56fcb02

SHA512
2cd691a22234ea10e9df4dbe480f5e4a78a4d6bc85a74fa400f6980bf05b91bbf959ac0a44ddb7b2e16b7e299248340d2ff390cbe25069385b4aa5325e40fd59

Download Submit
C:\Windows\System\efaoYqU.exe

Filesize
1.8MB

MD5
8c1efea14d2986f33e026a1aa2ba4e8b

SHA1
dfdf9e2c0eb5090e75d5214b315b51bc5a11ccf1

SHA256
c50f64ec86642f0b24c6e5be82d2c39660cb85f8751341f1b06ecb09c6cdb0e5

SHA512
8fcb4bafd98e79bf383c944329f883b376a976e7d05c1339f9e1b77fb086e0b8f606b8fdaad87de8c64629302b21d7cc9d74c4eeab360810404af5da1eee9e9d

Download Submit
C:\Windows\System\kLCxVme.exe

Filesize
1.8MB

MD5
83bf3a26147a7b0eec4ed9e07706d61e

SHA1
da2a4b82c230d9889dd7b491f65c883d0e39f13c

SHA256
c3a4ab482d10cc2686c456e34314165e8b9a3aa2a59f5dd878b11a8fdbdf991b

SHA512
0dc4f8be8e185cd041d976db2b65f56bb29df94e7323601ae55b5718e93b0b3b2c6995b9da34803eee6ea3c58fc14e94100dd23ef2f4878b7a2008a2797d1fd9

Download Submit
C:\Windows\System\lAfFjMr.exe

Filesize
1.8MB

MD5
70e6e34d9b31afff01b529aafb6e2e68

SHA1
d4837c3aeb4eb6d98073654fc0be70ae9930fa4a

SHA256
e3e6c359e45c77f19aa41a211aeda684d5b9eb9babbc9e3a4dafaacd94d045ac

SHA512
2a1aa701cc3694e30282d5c2f7f9a4c201d8bf22f5253afd4f055416fc30425070363255f49f2808dccde59feeb7170af10a7846e1d23b629de86402cd6bafe6

Download Submit
C:\Windows\System\lsIitxf.exe

Filesize
1.8MB

MD5
5d0f6c5f15224a4d2c468d5fd8dba82f

SHA1
a68de571af246ade6bc9cb534e63e2fcec89e5c6

SHA256
c44e5317d598380f44b0d90c7b475afe3a9621c92817fe7a170b4cebc289db17

SHA512
587e12bf5c1ff12a98ac357b2a18ad039e0f10f3ca7429b745b7f09f3c46bc1179b8fe9d186bdaa96b8d6e91204e57bbf06e8d4a88ca12132cefa4094650d3c0

Download Submit
C:\Windows\System\mHVtQmc.exe

Filesize
1.8MB

MD5
568159c70160d6bb40b98efea212ca38

SHA1
fdb938e4864bd61994f58843535e91804cec8605

SHA256
519506850cdd90930efb3e9a55785e4a7b34ff17c784e919c1eb03fe73c8d7fb

SHA512
8f31af608de14d93ac29edc4eb854fcf3b88e6a94ea2df224912c570ef4fce79b9dccb9daa2609a411a2461fc62bb5d7df5d498d85c09acbbc9a30a428fdebce

Download Submit
C:\Windows\System\oKXQXiS.exe

Filesize
1.8MB

MD5
acf8bcad35fc76eff0bde3f53f517296

SHA1
822544b56bd50d5b8fd457846c79409bf58e52c5

SHA256
fe23ee543ca52a187a6fa52fca2ea4b6323174fdd2df5eed7469184359908b74

SHA512
27e09930ce77deae1a2ebff0b02b65eca61688127eab3710c3eed46599a699a121205afdffd3d2fb8276331b673f256a7ef24887614a3af7cf8cd86398dd2b68

Download Submit
C:\Windows\System\oldFEMC.exe

Filesize
1.8MB

MD5
9f1ab2ad673e6e3db56f085c2c1e9c22

SHA1
fce98d41b564e9d6a14109ef262d76082dc3b633

SHA256
0dea9c0b020ce5b8f37d9b546c48bd73d2358a0efbbfcacee1771b1813a0a403

SHA512
ae161de5ad24c1cab058c7d342f74dd0a9800953677380db135bd1a69dfb57504f75b6a93fe586817506fe1d4918a5241ea253b07d5128527db002b8ac071cef

Download Submit
C:\Windows\System\pUjAmqu.exe

Filesize
1.8MB

MD5
221e5b44b9054319c7725e11055042e3

SHA1
deb664b69947b3096571eeda7d8f684766553165

SHA256
824bd9bf241da0b95417e5303f67e151272524e706063953a32d7839d8893765

SHA512
1766258d53091d31bc5e791ee5214d025ebb745674a9f86abee1116fbdc73f4182383a20e7853881037a7954874a53d55bf447db74f51ef7c0a7d90d8bcb2539

Download Submit
C:\Windows\System\rRXmvJS.exe

Filesize
1.8MB

MD5
435472b58ff331dadadc834ae553fe0d

SHA1
96d9cf1080c675dab8fe9226f178bb814cf6d0bb

SHA256
07de2bf435e954ce8460602aa9934d4455432fd5cd7763a066ead58cdbff8ac8

SHA512
365168b5d447786c5277749c5adb3c2e1f228c16bac17da7e59f9ac870504aadd9a4d768d9c0af08fc2641602a479f0816f6dec5666227ad854a717a024e9243

Download Submit
C:\Windows\System\rYCOtoK.exe

Filesize
1.8MB

MD5
1c61204b9fde2e0d952678b2f9b84957

SHA1
faa990c84fbce1f1b08689e1be6d52624554849e

SHA256
0aa290fa350da06735a3d9e6954e8b8ea184f74ab6cac047a59195f757c6b41f

SHA512
dbcb09346925bebbfc163d12021ed94a91167a57e3daa477e7be78aa450f7d147e186277d244947c84e7945af722364ee67f51ada2ac0efa20d7b986467a842a

Download Submit
C:\Windows\System\vOCqvDh.exe

Filesize
1.8MB

MD5
e02d970832229ee254a4bda6f7a191fe

SHA1
190d988a62d018d067e4cf4998bf9018b02ec8fe

SHA256
6232b710080c3936a6cf3473a95aafef9eb84a3c94369ff9f787c5f64e1cf513

SHA512
0f5a5c8df05e36218743c80c79e64963c295812d9353eeda8bed04c7339f752a7feeb51d31b5d4e31ee77488bdb3e92de2d99a895d0bd09246299fd3f1dc55ad

Download Submit
C:\Windows\System\vzKxCrR.exe

Filesize
1.8MB

MD5
bae82580430ae76d9ec764058c539b73

SHA1
215841728294870d11732feb1f849d82a9af86de

SHA256
3ab96f5e69074b603cab8888d3b81c0e8ef7ce2adbd5bfcced275c94904d6b80

SHA512
4a4cbb3e9ed5583532329ec8602e3620446df7f51bffcc01d34a8bd3d4e8cdabf3213edb838d1aa221b1b17840a50e7a37b91b855f49bb07f0ff8dffb1da80c3

Download Submit
C:\Windows\System\wGQNVlR.exe

Filesize
1.8MB

MD5
62d3c2a16d3489b76cd01c4942b10037

SHA1
53e5dd86cb52475f016797b869516f311669339a

SHA256
d35357a09ac951d849f55f9411d75963df869ff2462220742b99c16ddbd1d3c5

SHA512
1d1ea5e04047910f44be7cc67dcb513709ca3f22d781f9d3b9bf07d76e888bdcd671c5970ec06af2778a5d5bcfce833610b0d97908a07c7915459e76f81ebdb3

Download Submit
C:\Windows\System\wMjXqZl.exe

Filesize
1.8MB

MD5
ae5e2f57696c78f83a0aa24c950c1bbd

SHA1
656aa7d9f890d5a9135cb8966a055e44897f077a

SHA256
c9144d12b4050e48d1d294919bb137fbea507a5c38366b04f14b5aa4c936e06a

SHA512
84ffe3d2ef670f4de1edf8db5428c1030ae2367ec8420f4b41505a680f9eac2b95694175aa15091f23a618cf5ffdb3159d2cff1ec8b1bace8956e1ed3fac7dc1

Download Submit
C:\Windows\System\wlhRwPQ.exe

Filesize
1.8MB

MD5
955493920970c113b029366495743964

SHA1
00e78da7ca592ae4cb9847830208f2e99af741c1

SHA256
afe217c241c765456126d2a89d21afdbfcd7c8ab8c8ef01058ad008c5ebb93b1

SHA512
1754e9f7ab4ff0f2922d65685186111639ea19e721bfc1859a1cde04503ad3c9e78a1911d8586a0567497388f31b863f2ee688ff40cccf3216a25d10065e0d29

Download Submit
C:\Windows\System\wxqbydR.exe

Filesize
1.8MB

MD5
0c59c7561a67f27310cc5893762accb7

SHA1
2ad597328ed7b438ad28df473d36ae0caeddef73

SHA256
c4e6abedd55a0e89e0b9ec24a8058537a67b607abdc51bc41e6c0dad2504d100

SHA512
b6c5a31f38aa1514adc945819905b713d74363387e26db57558a594920f3e9fad32b1ff044c40bf617c54c2d35f3841bce414064c5239d43aa5dffc3fbcf7f7e

Download Submit
C:\Windows\System\zBuuEbE.exe

Filesize
1.8MB

MD5
a84d61a9627ba078c06b20331c89cc54

SHA1
e10d9acc475e1dd0ddee4ee0b3d683a497c49860

SHA256
83ba96fdca1e576396e5f8cc6a021ad16874e5c7c99b84a124a2034f3822ab2d

SHA512
0db76d89ce982914ff7f1f4169c3089a882af4d6bc7b5cbfb0c5ec7c273096817da117d4843106e2fc9025b9a902c8512c613d95c4ed5b584da722f9f8425862

Download Submit
memory/376-137-0x00007FF731BA0000-0x00007FF731F92000-memory.dmp

Filesize
3.9MB

Download
memory/376-5189-0x00007FF731BA0000-0x00007FF731F92000-memory.dmp

Filesize
3.9MB

Download
memory/792-5229-0x00007FF6DB860000-0x00007FF6DBC52000-memory.dmp

Filesize
3.9MB

Download
memory/792-289-0x00007FF6DB860000-0x00007FF6DBC52000-memory.dmp

Filesize
3.9MB

Download
memory/876-488-0x00007FF7B4B10000-0x00007FF7B4F02000-memory.dmp

Filesize
3.9MB

Download
memory/876-5259-0x00007FF7B4B10000-0x00007FF7B4F02000-memory.dmp

Filesize
3.9MB

Download
memory/1036-5203-0x00007FF7DECE0000-0x00007FF7DF0D2000-memory.dmp

Filesize
3.9MB

Download
memory/1036-623-0x00007FF7DECE0000-0x00007FF7DF0D2000-memory.dmp

Filesize
3.9MB

Download
memory/1628-184-0x00007FF6716A0000-0x00007FF671A92000-memory.dmp

Filesize
3.9MB

Download
memory/1628-5235-0x00007FF6716A0000-0x00007FF671A92000-memory.dmp

Filesize
3.9MB

Download
memory/2004-5239-0x00007FF651D10000-0x00007FF652102000-memory.dmp

Filesize
3.9MB

Download
memory/2004-432-0x00007FF651D10000-0x00007FF652102000-memory.dmp

Filesize
3.9MB

Download
memory/2188-12-0x00007FF74E2C0000-0x00007FF74E6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-622-0x00007FF7034D0000-0x00007FF7038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-5211-0x00007FF7034D0000-0x00007FF7038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2264-5206-0x00007FF6AAC80000-0x00007FF6AB072000-memory.dmp

Filesize
3.9MB

Download
memory/2264-207-0x00007FF6AAC80000-0x00007FF6AB072000-memory.dmp

Filesize
3.9MB

Download
memory/2456-5178-0x00007FF625C90000-0x00007FF626082000-memory.dmp

Filesize
3.9MB

Download
memory/2456-102-0x00007FF625C90000-0x00007FF626082000-memory.dmp

Filesize
3.9MB

Download
memory/2460-234-0x00007FF7F5650000-0x00007FF7F5A42000-memory.dmp

Filesize
3.9MB

Download
memory/2460-5217-0x00007FF7F5650000-0x00007FF7F5A42000-memory.dmp

Filesize
3.9MB

Download
memory/2528-5225-0x00007FF6B81F0000-0x00007FF6B85E2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-285-0x00007FF6B81F0000-0x00007FF6B85E2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-49-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp

Filesize
3.9MB

Download
memory/2536-5167-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp

Filesize
3.9MB

Download
memory/2680-14-0x000001960D3D0000-0x000001960D3E0000-memory.dmp

Filesize
64KB

Download
memory/2680-13-0x000001960D3D0000-0x000001960D3E0000-memory.dmp

Filesize
64KB

Download
memory/2680-15-0x00007FFC3A243000-0x00007FFC3A245000-memory.dmp

Filesize
8KB

Download
memory/2680-276-0x000001960DA40000-0x000001960DA62000-memory.dmp

Filesize
136KB

Download
memory/3204-81-0x00007FF673F70000-0x00007FF674362000-memory.dmp

Filesize
3.9MB

Download
memory/3204-5181-0x00007FF673F70000-0x00007FF674362000-memory.dmp

Filesize
3.9MB

Download
memory/3484-40-0x00007FF63DE50000-0x00007FF63E242000-memory.dmp

Filesize
3.9MB

Download
memory/3560-5246-0x00007FF65A4B0000-0x00007FF65A8A2000-memory.dmp

Filesize
3.9MB

Download
memory/3560-564-0x00007FF65A4B0000-0x00007FF65A8A2000-memory.dmp

Filesize
3.9MB

Download
memory/3684-0-0x00007FF712D30000-0x00007FF713122000-memory.dmp

Filesize
3.9MB

Download
memory/3684-1-0x000002C383420000-0x000002C383430000-memory.dmp

Filesize
64KB

Download
memory/3924-565-0x00007FF70CC10000-0x00007FF70D002000-memory.dmp

Filesize
3.9MB

Download
memory/3924-5250-0x00007FF70CC10000-0x00007FF70D002000-memory.dmp

Filesize
3.9MB

Download
memory/4040-576-0x00007FF62C080000-0x00007FF62C472000-memory.dmp

Filesize
3.9MB

Download
memory/4040-5243-0x00007FF62C080000-0x00007FF62C472000-memory.dmp

Filesize
3.9MB

Download
memory/4156-342-0x00007FF7070A0000-0x00007FF707492000-memory.dmp

Filesize
3.9MB

Download
memory/4156-5214-0x00007FF7070A0000-0x00007FF707492000-memory.dmp

Filesize
3.9MB

Download
memory/4220-5253-0x00007FF7F2190000-0x00007FF7F2582000-memory.dmp

Filesize
3.9MB

Download
memory/4220-612-0x00007FF7F2190000-0x00007FF7F2582000-memory.dmp

Filesize
3.9MB

Download
memory/4264-554-0x00007FF708CE0000-0x00007FF7090D2000-memory.dmp

Filesize
3.9MB

Download
memory/4264-5221-0x00007FF708CE0000-0x00007FF7090D2000-memory.dmp

Filesize
3.9MB

Download
memory/4328-210-0x00007FF70CD20000-0x00007FF70D112000-memory.dmp

Filesize
3.9MB

Download
memory/4328-5192-0x00007FF70CD20000-0x00007FF70D112000-memory.dmp

Filesize
3.9MB

Download
memory/4744-624-0x00007FF694970000-0x00007FF694D62000-memory.dmp

Filesize
3.9MB

Download
memory/4744-5200-0x00007FF694970000-0x00007FF694D62000-memory.dmp

Filesize
3.9MB

Download
memory/4864-5233-0x00007FF781FF0000-0x00007FF7823E2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-338-0x00007FF781FF0000-0x00007FF7823E2000-memory.dmp

Filesize
3.9MB

Download