xmrig | d80293d941468e66e1091d6c7aea664dd88d23cb1e0c18432f2fdb22dcd0bfde

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2cdde74a48fe2ada97836db93e872a0N.exe
Size

1.7MB
MD5

a2cdde74a48fe2ada97836db93e872a0
SHA1

f7cebe6bd46bd59a84a5a474ef40e4f967399ae6
SHA256

d80293d941468e66e1091d6c7aea664dd88d23cb1e0c18432f2fdb22dcd0bfde
SHA512

6608021407d6b3e49cd159531125e3991893fa96c5a4b7ce47f0b4e046f8ce400fc433d499fc170e50dead28392433e4a84fed737dbce12200ec23fd8d0ca228
SSDEEP

49152:Lz071uv4BPMkibTIA5I4TNrpDGsNtqnjR:NAB3

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/2628-72-0x00007FF633B00000-0x00007FF633EF2000-memory.dmp	xmrig
behavioral2/memory/1004-121-0x00007FF655390000-0x00007FF655782000-memory.dmp	xmrig
behavioral2/memory/4012-17-0x00007FF7C4090000-0x00007FF7C4482000-memory.dmp	xmrig
behavioral2/memory/408-229-0x00007FF797ED0000-0x00007FF7982C2000-memory.dmp	xmrig
behavioral2/memory/2200-227-0x00007FF79C330000-0x00007FF79C722000-memory.dmp	xmrig
behavioral2/memory/1928-203-0x00007FF7DFB20000-0x00007FF7DFF12000-memory.dmp	xmrig
behavioral2/memory/1932-173-0x00007FF6D5450000-0x00007FF6D5842000-memory.dmp	xmrig
behavioral2/memory/1000-267-0x00007FF6D2560000-0x00007FF6D2952000-memory.dmp	xmrig
behavioral2/memory/4136-297-0x00007FF69BB80000-0x00007FF69BF72000-memory.dmp	xmrig
behavioral2/memory/4016-481-0x00007FF73C3C0000-0x00007FF73C7B2000-memory.dmp	xmrig
behavioral2/memory/3296-484-0x00007FF72C9F0000-0x00007FF72CDE2000-memory.dmp	xmrig
behavioral2/memory/1340-483-0x00007FF66C760000-0x00007FF66CB52000-memory.dmp	xmrig
behavioral2/memory/4236-482-0x00007FF71B240000-0x00007FF71B632000-memory.dmp	xmrig
behavioral2/memory/624-480-0x00007FF638AF0000-0x00007FF638EE2000-memory.dmp	xmrig
behavioral2/memory/1276-479-0x00007FF7F9890000-0x00007FF7F9C82000-memory.dmp	xmrig
behavioral2/memory/3000-478-0x00007FF695400000-0x00007FF6957F2000-memory.dmp	xmrig
behavioral2/memory/2276-477-0x00007FF60CAC0000-0x00007FF60CEB2000-memory.dmp	xmrig
behavioral2/memory/4504-476-0x00007FF75A640000-0x00007FF75AA32000-memory.dmp	xmrig
behavioral2/memory/2876-475-0x00007FF63D8A0000-0x00007FF63DC92000-memory.dmp	xmrig
behavioral2/memory/3584-367-0x00007FF6F99C0000-0x00007FF6F9DB2000-memory.dmp	xmrig
behavioral2/memory/1964-349-0x00007FF66BE80000-0x00007FF66C272000-memory.dmp	xmrig
behavioral2/memory/924-348-0x00007FF65DA20000-0x00007FF65DE12000-memory.dmp	xmrig
behavioral2/memory/1340-4918-0x00007FF66C760000-0x00007FF66CB52000-memory.dmp	xmrig
behavioral2/memory/4136-4930-0x00007FF69BB80000-0x00007FF69BF72000-memory.dmp	xmrig
behavioral2/memory/1928-4924-0x00007FF7DFB20000-0x00007FF7DFF12000-memory.dmp	xmrig
behavioral2/memory/408-4994-0x00007FF797ED0000-0x00007FF7982C2000-memory.dmp	xmrig
behavioral2/memory/2200-4990-0x00007FF79C330000-0x00007FF79C722000-memory.dmp	xmrig
behavioral2/memory/1276-5015-0x00007FF7F9890000-0x00007FF7F9C82000-memory.dmp	xmrig
behavioral2/memory/624-5051-0x00007FF638AF0000-0x00007FF638EE2000-memory.dmp	xmrig
behavioral2/memory/3296-5035-0x00007FF72C9F0000-0x00007FF72CDE2000-memory.dmp	xmrig
behavioral2/memory/2876-5023-0x00007FF63D8A0000-0x00007FF63DC92000-memory.dmp	xmrig
behavioral2/memory/3000-5008-0x00007FF695400000-0x00007FF6957F2000-memory.dmp	xmrig
behavioral2/memory/3584-5003-0x00007FF6F99C0000-0x00007FF6F9DB2000-memory.dmp	xmrig
behavioral2/memory/4236-4985-0x00007FF71B240000-0x00007FF71B632000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
828	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4012	JQZURNy.exe
2068	tiIZnwl.exe
2628	OeCLCcb.exe
736	iRDJDbT.exe
1004	eBLCucA.exe
1932	IPbnwnf.exe
4016	XgFnQOw.exe
1928	qXhfhwv.exe
2200	hRBfplb.exe
408	ZXGDEal.exe
4236	AEGuUjj.exe
1000	rXkVMeL.exe
4136	ZiSSipv.exe
924	CtUsRjy.exe
1964	lozNquz.exe
1340	IPjPdsv.exe
3584	mmoAxLE.exe
2876	oFBJFfe.exe
4504	ALKSQgl.exe
2276	vKaNWQT.exe
3000	btCvqMR.exe
1276	LwHKKea.exe
3296	ihBHcBs.exe
624	VUbjVVI.exe
400	oGYmTLV.exe
232	AUDiaEv.exe
3596	FuaxBaC.exe
824	vWGVKfh.exe
4980	eWADRwc.exe
932	XBcWMKk.exe
1368	MMCVWlY.exe
4224	hSEPyer.exe
3308	fRHFTUu.exe
2248	nQZSafJ.exe
3128	RqOogzL.exe
3956	LqwUXzj.exe
2100	namtDoh.exe
3348	PDGOyJy.exe
4836	CUANbjx.exe
980	LEHPUvh.exe
2900	KIzmlws.exe
2872	EZXIkWG.exe
4032	nPZPNJl.exe
3936	QDSSdjG.exe
1080	jBVONqj.exe
2232	YbrYxGs.exe
3708	KhKMbYz.exe
2496	blSWVnQ.exe
2840	nEWsOtb.exe
1496	weEkUnc.exe
4900	ZSjePBT.exe
880	MFVANKd.exe
4884	roAyCNO.exe
2368	XVCTflY.exe
1160	ELvJZMk.exe
752	WLEkUXg.exe
4472	yPhxPFM.exe
3832	aBDBltm.exe
4820	GBVMUjv.exe
2624	VpiAZYg.exe
4680	PGdvYED.exe
2684	VDBetmU.exe
4408	EGjosqD.exe
4972	AmeKYns.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2884-0-0x00007FF6CC580000-0x00007FF6CC972000-memory.dmp	upx
behavioral2/files/0x000a00000002345f-5.dat	upx
behavioral2/files/0x0007000000023469-38.dat	upx
behavioral2/files/0x0007000000023470-55.dat	upx
behavioral2/files/0x0008000000023467-33.dat	upx
behavioral2/files/0x0007000000023471-85.dat	upx
behavioral2/files/0x0007000000023476-89.dat	upx
behavioral2/files/0x000700000002346e-82.dat	upx
behavioral2/files/0x0007000000023475-81.dat	upx
behavioral2/memory/736-79-0x00007FF62CD60000-0x00007FF62D152000-memory.dmp	upx
behavioral2/memory/2628-72-0x00007FF633B00000-0x00007FF633EF2000-memory.dmp	upx
behavioral2/files/0x0007000000023474-67.dat	upx
behavioral2/files/0x000700000002346c-62.dat	upx
behavioral2/files/0x000700000002346a-97.dat	upx
behavioral2/files/0x0007000000023472-57.dat	upx
behavioral2/files/0x0007000000023468-51.dat	upx
behavioral2/files/0x000700000002346f-47.dat	upx
behavioral2/files/0x0007000000023473-61.dat	upx
behavioral2/files/0x000700000002346b-60.dat	upx
behavioral2/memory/2068-48-0x00007FF635C90000-0x00007FF636082000-memory.dmp	upx
behavioral2/files/0x000700000002346d-31.dat	upx
behavioral2/files/0x000700000002347e-133.dat	upx
behavioral2/files/0x000700000002347d-132.dat	upx
behavioral2/files/0x0007000000023489-177.dat	upx
behavioral2/files/0x000700000002347c-127.dat	upx
behavioral2/memory/1004-121-0x00007FF655390000-0x00007FF655782000-memory.dmp	upx
behavioral2/files/0x000700000002347b-116.dat	upx
behavioral2/files/0x0007000000023484-160.dat	upx
behavioral2/files/0x000700000002347a-113.dat	upx
behavioral2/files/0x0007000000023479-108.dat	upx
behavioral2/files/0x0007000000023478-105.dat	upx
behavioral2/files/0x0007000000023477-103.dat	upx
behavioral2/memory/4012-17-0x00007FF7C4090000-0x00007FF7C4482000-memory.dmp	upx
behavioral2/files/0x000700000002347f-137.dat	upx
behavioral2/memory/408-229-0x00007FF797ED0000-0x00007FF7982C2000-memory.dmp	upx
behavioral2/memory/2200-227-0x00007FF79C330000-0x00007FF79C722000-memory.dmp	upx
behavioral2/memory/1928-203-0x00007FF7DFB20000-0x00007FF7DFF12000-memory.dmp	upx
behavioral2/files/0x0007000000023490-198.dat	upx
behavioral2/files/0x000700000002348f-197.dat	upx
behavioral2/files/0x000700000002348e-194.dat	upx
behavioral2/files/0x0007000000023482-193.dat	upx
behavioral2/files/0x0008000000023465-188.dat	upx
behavioral2/files/0x000700000002348c-187.dat	upx
behavioral2/files/0x000700000002348b-184.dat	upx
behavioral2/files/0x000700000002348a-181.dat	upx
behavioral2/files/0x0007000000023487-174.dat	upx
behavioral2/memory/1932-173-0x00007FF6D5450000-0x00007FF6D5842000-memory.dmp	upx
behavioral2/files/0x0007000000023485-164.dat	upx
behavioral2/files/0x0007000000023483-153.dat	upx
behavioral2/files/0x0007000000023480-142.dat	upx
behavioral2/files/0x0007000000023481-141.dat	upx
behavioral2/memory/1000-267-0x00007FF6D2560000-0x00007FF6D2952000-memory.dmp	upx
behavioral2/memory/4136-297-0x00007FF69BB80000-0x00007FF69BF72000-memory.dmp	upx
behavioral2/memory/4016-481-0x00007FF73C3C0000-0x00007FF73C7B2000-memory.dmp	upx
behavioral2/memory/3296-484-0x00007FF72C9F0000-0x00007FF72CDE2000-memory.dmp	upx
behavioral2/memory/1340-483-0x00007FF66C760000-0x00007FF66CB52000-memory.dmp	upx
behavioral2/memory/4236-482-0x00007FF71B240000-0x00007FF71B632000-memory.dmp	upx
behavioral2/memory/624-480-0x00007FF638AF0000-0x00007FF638EE2000-memory.dmp	upx
behavioral2/memory/1276-479-0x00007FF7F9890000-0x00007FF7F9C82000-memory.dmp	upx
behavioral2/memory/3000-478-0x00007FF695400000-0x00007FF6957F2000-memory.dmp	upx
behavioral2/memory/2276-477-0x00007FF60CAC0000-0x00007FF60CEB2000-memory.dmp	upx
behavioral2/memory/4504-476-0x00007FF75A640000-0x00007FF75AA32000-memory.dmp	upx
behavioral2/memory/2876-475-0x00007FF63D8A0000-0x00007FF63DC92000-memory.dmp	upx
behavioral2/memory/3584-367-0x00007FF6F99C0000-0x00007FF6F9DB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MKgUrBX.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\qTwiJcU.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\VMIubUa.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\SHZjWdN.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\ENRXWph.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\xcjWhxf.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\BxALWUx.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\lHSiyBU.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\NABjbTl.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\vAiteBH.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\LDYXuyb.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\JRBbdrs.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\CzkwuVB.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\nFXKwbD.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\nZtmAGl.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\DuAyAmt.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\sJuphgo.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\XSdlrIV.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\clIFYCJ.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\SMMxAAU.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\zXnlTwv.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\HmECGgy.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\uvmodmW.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\OuJeBKz.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\ivHcQbj.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\hzzyrLK.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\smlAqqt.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\zOIxkuc.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\oGHxbaP.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\btWBDIu.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\phhGImg.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\ENYWdBW.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\jooPgMF.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\OalqPmo.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\KeTKGIY.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\UiyTpaA.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\YvfmcUS.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\MBzfXMv.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\gzQPdmI.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\ZnATXrj.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\LVfznqZ.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\KNgWSdo.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\taIjNWh.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\aPMxrQT.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\zdCLGXZ.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\CFpNWLp.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\OaxTAri.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\wESVMbi.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\nGIOnui.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\mFqxoXw.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\lfINbLs.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\zLOMSwW.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\TBZyjac.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\oHsFuns.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\yIwfQdS.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\LysCEOM.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\FldOrtC.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\IyGUJvM.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\heXmEdh.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\zEwXAaO.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\kapkZDg.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\jtPLzxM.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\pNqRabv.exe	a2cdde74a48fe2ada97836db93e872a0N.exe
File created	C:\Windows\System\JVhgTgt.exe	a2cdde74a48fe2ada97836db93e872a0N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
828	powershell.exe
828	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2884	a2cdde74a48fe2ada97836db93e872a0N.exe
Token: SeLockMemoryPrivilege	2884	a2cdde74a48fe2ada97836db93e872a0N.exe
Token: SeDebugPrivilege	828	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 828	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	86
PID 2884 wrote to memory of 828	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	86
PID 2884 wrote to memory of 4012	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	87
PID 2884 wrote to memory of 4012	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	87
PID 2884 wrote to memory of 4016	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	88
PID 2884 wrote to memory of 4016	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	88
PID 2884 wrote to memory of 2068	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	89
PID 2884 wrote to memory of 2068	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	89
PID 2884 wrote to memory of 2628	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	90
PID 2884 wrote to memory of 2628	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	90
PID 2884 wrote to memory of 736	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	91
PID 2884 wrote to memory of 736	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	91
PID 2884 wrote to memory of 2200	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	92
PID 2884 wrote to memory of 2200	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	92
PID 2884 wrote to memory of 1004	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	93
PID 2884 wrote to memory of 1004	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	93
PID 2884 wrote to memory of 1932	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	94
PID 2884 wrote to memory of 1932	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	94
PID 2884 wrote to memory of 1928	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	95
PID 2884 wrote to memory of 1928	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	95
PID 2884 wrote to memory of 408	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	96
PID 2884 wrote to memory of 408	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	96
PID 2884 wrote to memory of 4236	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	97
PID 2884 wrote to memory of 4236	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	97
PID 2884 wrote to memory of 1000	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	98
PID 2884 wrote to memory of 1000	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	98
PID 2884 wrote to memory of 4136	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	99
PID 2884 wrote to memory of 4136	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	99
PID 2884 wrote to memory of 924	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	100
PID 2884 wrote to memory of 924	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	100
PID 2884 wrote to memory of 1964	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	101
PID 2884 wrote to memory of 1964	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	101
PID 2884 wrote to memory of 1340	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	102
PID 2884 wrote to memory of 1340	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	102
PID 2884 wrote to memory of 3584	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	103
PID 2884 wrote to memory of 3584	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	103
PID 2884 wrote to memory of 2876	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	104
PID 2884 wrote to memory of 2876	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	104
PID 2884 wrote to memory of 4504	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	105
PID 2884 wrote to memory of 4504	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	105
PID 2884 wrote to memory of 2276	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	106
PID 2884 wrote to memory of 2276	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	106
PID 2884 wrote to memory of 3000	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	107
PID 2884 wrote to memory of 3000	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	107
PID 2884 wrote to memory of 1276	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	108
PID 2884 wrote to memory of 1276	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	108
PID 2884 wrote to memory of 3296	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	109
PID 2884 wrote to memory of 3296	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	109
PID 2884 wrote to memory of 624	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	110
PID 2884 wrote to memory of 624	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	110
PID 2884 wrote to memory of 400	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	111
PID 2884 wrote to memory of 400	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	111
PID 2884 wrote to memory of 232	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	112
PID 2884 wrote to memory of 232	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	112
PID 2884 wrote to memory of 3596	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	113
PID 2884 wrote to memory of 3596	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	113
PID 2884 wrote to memory of 824	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	114
PID 2884 wrote to memory of 824	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	114
PID 2884 wrote to memory of 3348	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	115
PID 2884 wrote to memory of 3348	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	115
PID 2884 wrote to memory of 4980	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	116
PID 2884 wrote to memory of 4980	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	116
PID 2884 wrote to memory of 932	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	117
PID 2884 wrote to memory of 932	2884	a2cdde74a48fe2ada97836db93e872a0N.exe	117

C:\Users\Admin\AppData\Local\Temp\a2cdde74a48fe2ada97836db93e872a0N.exe
"C:\Users\Admin\AppData\Local\Temp\a2cdde74a48fe2ada97836db93e872a0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\System\JQZURNy.exe
  C:\Windows\System\JQZURNy.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\XgFnQOw.exe
  C:\Windows\System\XgFnQOw.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\tiIZnwl.exe
  C:\Windows\System\tiIZnwl.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\OeCLCcb.exe
  C:\Windows\System\OeCLCcb.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\iRDJDbT.exe
  C:\Windows\System\iRDJDbT.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\hRBfplb.exe
  C:\Windows\System\hRBfplb.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\eBLCucA.exe
  C:\Windows\System\eBLCucA.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\IPbnwnf.exe
  C:\Windows\System\IPbnwnf.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\qXhfhwv.exe
  C:\Windows\System\qXhfhwv.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\ZXGDEal.exe
  C:\Windows\System\ZXGDEal.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\AEGuUjj.exe
  C:\Windows\System\AEGuUjj.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\rXkVMeL.exe
  C:\Windows\System\rXkVMeL.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\ZiSSipv.exe
  C:\Windows\System\ZiSSipv.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\CtUsRjy.exe
  C:\Windows\System\CtUsRjy.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\lozNquz.exe
  C:\Windows\System\lozNquz.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\IPjPdsv.exe
  C:\Windows\System\IPjPdsv.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\mmoAxLE.exe
  C:\Windows\System\mmoAxLE.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\oFBJFfe.exe
  C:\Windows\System\oFBJFfe.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\ALKSQgl.exe
  C:\Windows\System\ALKSQgl.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\vKaNWQT.exe
  C:\Windows\System\vKaNWQT.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\btCvqMR.exe
  C:\Windows\System\btCvqMR.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\LwHKKea.exe
  C:\Windows\System\LwHKKea.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\ihBHcBs.exe
  C:\Windows\System\ihBHcBs.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\VUbjVVI.exe
  C:\Windows\System\VUbjVVI.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\oGYmTLV.exe
  C:\Windows\System\oGYmTLV.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\AUDiaEv.exe
  C:\Windows\System\AUDiaEv.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\FuaxBaC.exe
  C:\Windows\System\FuaxBaC.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\vWGVKfh.exe
  C:\Windows\System\vWGVKfh.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\PDGOyJy.exe
  C:\Windows\System\PDGOyJy.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\eWADRwc.exe
  C:\Windows\System\eWADRwc.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\XBcWMKk.exe
  C:\Windows\System\XBcWMKk.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\MMCVWlY.exe
  C:\Windows\System\MMCVWlY.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\nPZPNJl.exe
  C:\Windows\System\nPZPNJl.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\hSEPyer.exe
  C:\Windows\System\hSEPyer.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\YbrYxGs.exe
  C:\Windows\System\YbrYxGs.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\fRHFTUu.exe
  C:\Windows\System\fRHFTUu.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\nQZSafJ.exe
  C:\Windows\System\nQZSafJ.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\RqOogzL.exe
  C:\Windows\System\RqOogzL.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\LqwUXzj.exe
  C:\Windows\System\LqwUXzj.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\namtDoh.exe
  C:\Windows\System\namtDoh.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\weEkUnc.exe
  C:\Windows\System\weEkUnc.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\CUANbjx.exe
  C:\Windows\System\CUANbjx.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\LEHPUvh.exe
  C:\Windows\System\LEHPUvh.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\KIzmlws.exe
  C:\Windows\System\KIzmlws.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\EZXIkWG.exe
  C:\Windows\System\EZXIkWG.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\QDSSdjG.exe
  C:\Windows\System\QDSSdjG.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\jBVONqj.exe
  C:\Windows\System\jBVONqj.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\KhKMbYz.exe
  C:\Windows\System\KhKMbYz.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\blSWVnQ.exe
  C:\Windows\System\blSWVnQ.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\nEWsOtb.exe
  C:\Windows\System\nEWsOtb.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\ZSjePBT.exe
  C:\Windows\System\ZSjePBT.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\MFVANKd.exe
  C:\Windows\System\MFVANKd.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\roAyCNO.exe
  C:\Windows\System\roAyCNO.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\XVCTflY.exe
  C:\Windows\System\XVCTflY.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\ELvJZMk.exe
  C:\Windows\System\ELvJZMk.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\WLEkUXg.exe
  C:\Windows\System\WLEkUXg.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\yPhxPFM.exe
  C:\Windows\System\yPhxPFM.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\aBDBltm.exe
  C:\Windows\System\aBDBltm.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\GBVMUjv.exe
  C:\Windows\System\GBVMUjv.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\VpiAZYg.exe
  C:\Windows\System\VpiAZYg.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\PGdvYED.exe
  C:\Windows\System\PGdvYED.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\VDBetmU.exe
  C:\Windows\System\VDBetmU.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\lRkHYiC.exe
  C:\Windows\System\lRkHYiC.exe
  2⤵
  PID:4936
- C:\Windows\System\EGjosqD.exe
  C:\Windows\System\EGjosqD.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\AmeKYns.exe
  C:\Windows\System\AmeKYns.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\ayoCAcs.exe
  C:\Windows\System\ayoCAcs.exe
  2⤵
  PID:3792
- C:\Windows\System\JUZHvkb.exe
  C:\Windows\System\JUZHvkb.exe
  2⤵
  PID:1736
- C:\Windows\System\nTDQieV.exe
  C:\Windows\System\nTDQieV.exe
  2⤵
  PID:920
- C:\Windows\System\jkvVpKv.exe
  C:\Windows\System\jkvVpKv.exe
  2⤵
  PID:1516
- C:\Windows\System\lfINbLs.exe
  C:\Windows\System\lfINbLs.exe
  2⤵
  PID:3656
- C:\Windows\System\WvhQQHC.exe
  C:\Windows\System\WvhQQHC.exe
  2⤵
  PID:2968
- C:\Windows\System\ExgMUja.exe
  C:\Windows\System\ExgMUja.exe
  2⤵
  PID:2264
- C:\Windows\System\KDoVDli.exe
  C:\Windows\System\KDoVDli.exe
  2⤵
  PID:3508
- C:\Windows\System\nYaGqBD.exe
  C:\Windows\System\nYaGqBD.exe
  2⤵
  PID:680
- C:\Windows\System\UpubbwE.exe
  C:\Windows\System\UpubbwE.exe
  2⤵
  PID:4888
- C:\Windows\System\iJUyAfo.exe
  C:\Windows\System\iJUyAfo.exe
  2⤵
  PID:4480
- C:\Windows\System\tSopNLx.exe
  C:\Windows\System\tSopNLx.exe
  2⤵
  PID:2204
- C:\Windows\System\iVEiJvk.exe
  C:\Windows\System\iVEiJvk.exe
  2⤵
  PID:4064
- C:\Windows\System\zrwppeh.exe
  C:\Windows\System\zrwppeh.exe
  2⤵
  PID:2952
- C:\Windows\System\LeddZiQ.exe
  C:\Windows\System\LeddZiQ.exe
  2⤵
  PID:3388
- C:\Windows\System\Vduersj.exe
  C:\Windows\System\Vduersj.exe
  2⤵
  PID:1180
- C:\Windows\System\fnBHqKE.exe
  C:\Windows\System\fnBHqKE.exe
  2⤵
  PID:4364
- C:\Windows\System\OmeiDsH.exe
  C:\Windows\System\OmeiDsH.exe
  2⤵
  PID:2208
- C:\Windows\System\VayadgJ.exe
  C:\Windows\System\VayadgJ.exe
  2⤵
  PID:524
- C:\Windows\System\DyfuHRZ.exe
  C:\Windows\System\DyfuHRZ.exe
  2⤵
  PID:5128
- C:\Windows\System\HPHSIrV.exe
  C:\Windows\System\HPHSIrV.exe
  2⤵
  PID:5144
- C:\Windows\System\uWqXDAl.exe
  C:\Windows\System\uWqXDAl.exe
  2⤵
  PID:5168
- C:\Windows\System\aFGHmHe.exe
  C:\Windows\System\aFGHmHe.exe
  2⤵
  PID:5184
- C:\Windows\System\hcImlIf.exe
  C:\Windows\System\hcImlIf.exe
  2⤵
  PID:5220
- C:\Windows\System\rfOBGOs.exe
  C:\Windows\System\rfOBGOs.exe
  2⤵
  PID:5244
- C:\Windows\System\KowjNyG.exe
  C:\Windows\System\KowjNyG.exe
  2⤵
  PID:5268
- C:\Windows\System\vuYtExc.exe
  C:\Windows\System\vuYtExc.exe
  2⤵
  PID:5296
- C:\Windows\System\gSqYCmG.exe
  C:\Windows\System\gSqYCmG.exe
  2⤵
  PID:5316
- C:\Windows\System\zjtcilQ.exe
  C:\Windows\System\zjtcilQ.exe
  2⤵
  PID:5336
- C:\Windows\System\FdfTjGQ.exe
  C:\Windows\System\FdfTjGQ.exe
  2⤵
  PID:5360
- C:\Windows\System\GlYtakC.exe
  C:\Windows\System\GlYtakC.exe
  2⤵
  PID:5396
- C:\Windows\System\MNKJawH.exe
  C:\Windows\System\MNKJawH.exe
  2⤵
  PID:5412
- C:\Windows\System\DJYMiSB.exe
  C:\Windows\System\DJYMiSB.exe
  2⤵
  PID:5432
- C:\Windows\System\VCwUdcP.exe
  C:\Windows\System\VCwUdcP.exe
  2⤵
  PID:5448
- C:\Windows\System\htHUtLF.exe
  C:\Windows\System\htHUtLF.exe
  2⤵
  PID:5468
- C:\Windows\System\QFEeZqN.exe
  C:\Windows\System\QFEeZqN.exe
  2⤵
  PID:5484
- C:\Windows\System\jshXote.exe
  C:\Windows\System\jshXote.exe
  2⤵
  PID:5612
- C:\Windows\System\CDAMadc.exe
  C:\Windows\System\CDAMadc.exe
  2⤵
  PID:5628
- C:\Windows\System\GMMbOtq.exe
  C:\Windows\System\GMMbOtq.exe
  2⤵
  PID:5652
- C:\Windows\System\QEUUFXG.exe
  C:\Windows\System\QEUUFXG.exe
  2⤵
  PID:5672
- C:\Windows\System\EhzzyxP.exe
  C:\Windows\System\EhzzyxP.exe
  2⤵
  PID:5688
- C:\Windows\System\rYJwwkm.exe
  C:\Windows\System\rYJwwkm.exe
  2⤵
  PID:5708
- C:\Windows\System\cUQiKMr.exe
  C:\Windows\System\cUQiKMr.exe
  2⤵
  PID:5732
- C:\Windows\System\KeiAzGa.exe
  C:\Windows\System\KeiAzGa.exe
  2⤵
  PID:5760
- C:\Windows\System\UQrSpGH.exe
  C:\Windows\System\UQrSpGH.exe
  2⤵
  PID:5844
- C:\Windows\System\HQSvOjd.exe
  C:\Windows\System\HQSvOjd.exe
  2⤵
  PID:5868
- C:\Windows\System\ZeGBxdj.exe
  C:\Windows\System\ZeGBxdj.exe
  2⤵
  PID:5888
- C:\Windows\System\IPshyas.exe
  C:\Windows\System\IPshyas.exe
  2⤵
  PID:5904
- C:\Windows\System\EzDczrj.exe
  C:\Windows\System\EzDczrj.exe
  2⤵
  PID:5920
- C:\Windows\System\hPUzBvq.exe
  C:\Windows\System\hPUzBvq.exe
  2⤵
  PID:5944
- C:\Windows\System\MUUWqPn.exe
  C:\Windows\System\MUUWqPn.exe
  2⤵
  PID:5960
- C:\Windows\System\bLTZlyO.exe
  C:\Windows\System\bLTZlyO.exe
  2⤵
  PID:5976
- C:\Windows\System\pcaHPLk.exe
  C:\Windows\System\pcaHPLk.exe
  2⤵
  PID:5992
- C:\Windows\System\IOVDUnc.exe
  C:\Windows\System\IOVDUnc.exe
  2⤵
  PID:6012
- C:\Windows\System\JVvagHg.exe
  C:\Windows\System\JVvagHg.exe
  2⤵
  PID:6032
- C:\Windows\System\OQvruVB.exe
  C:\Windows\System\OQvruVB.exe
  2⤵
  PID:6076
- C:\Windows\System\OqokNTa.exe
  C:\Windows\System\OqokNTa.exe
  2⤵
  PID:6096
- C:\Windows\System\HGeSuWu.exe
  C:\Windows\System\HGeSuWu.exe
  2⤵
  PID:6116
- C:\Windows\System\kwVivlm.exe
  C:\Windows\System\kwVivlm.exe
  2⤵
  PID:6140
- C:\Windows\System\JDtHbXg.exe
  C:\Windows\System\JDtHbXg.exe
  2⤵
  PID:3592
- C:\Windows\System\VyIRaBb.exe
  C:\Windows\System\VyIRaBb.exe
  2⤵
  PID:3404
- C:\Windows\System\oROAeza.exe
  C:\Windows\System\oROAeza.exe
  2⤵
  PID:4700
- C:\Windows\System\PecIOxY.exe
  C:\Windows\System\PecIOxY.exe
  2⤵
  PID:3688
- C:\Windows\System\XgGoPTT.exe
  C:\Windows\System\XgGoPTT.exe
  2⤵
  PID:4424
- C:\Windows\System\ajUszWj.exe
  C:\Windows\System\ajUszWj.exe
  2⤵
  PID:3244
- C:\Windows\System\psoIGhE.exe
  C:\Windows\System\psoIGhE.exe
  2⤵
  PID:4172
- C:\Windows\System\GHXzfbp.exe
  C:\Windows\System\GHXzfbp.exe
  2⤵
  PID:5428
- C:\Windows\System\ksZpdmW.exe
  C:\Windows\System\ksZpdmW.exe
  2⤵
  PID:2212
- C:\Windows\System\chidpiT.exe
  C:\Windows\System\chidpiT.exe
  2⤵
  PID:4844
- C:\Windows\System\DGzvWUW.exe
  C:\Windows\System\DGzvWUW.exe
  2⤵
  PID:3700
- C:\Windows\System\mIrzaWR.exe
  C:\Windows\System\mIrzaWR.exe
  2⤵
  PID:2220
- C:\Windows\System\pjGIAQP.exe
  C:\Windows\System\pjGIAQP.exe
  2⤵
  PID:5404
- C:\Windows\System\eQQMuEQ.exe
  C:\Windows\System\eQQMuEQ.exe
  2⤵
  PID:5752
- C:\Windows\System\oMvbUMM.exe
  C:\Windows\System\oMvbUMM.exe
  2⤵
  PID:5052
- C:\Windows\System\EnTtyLq.exe
  C:\Windows\System\EnTtyLq.exe
  2⤵
  PID:5152
- C:\Windows\System\aEwGTqj.exe
  C:\Windows\System\aEwGTqj.exe
  2⤵
  PID:5180
- C:\Windows\System\FYTlitb.exe
  C:\Windows\System\FYTlitb.exe
  2⤵
  PID:5236
- C:\Windows\System\nuOSVMc.exe
  C:\Windows\System\nuOSVMc.exe
  2⤵
  PID:5276
- C:\Windows\System\feZaZnQ.exe
  C:\Windows\System\feZaZnQ.exe
  2⤵
  PID:5328
- C:\Windows\System\XcYKazD.exe
  C:\Windows\System\XcYKazD.exe
  2⤵
  PID:6436
- C:\Windows\System\LHzleqB.exe
  C:\Windows\System\LHzleqB.exe
  2⤵
  PID:6452
- C:\Windows\System\UsABUlc.exe
  C:\Windows\System\UsABUlc.exe
  2⤵
  PID:6468
- C:\Windows\System\PlRIMmA.exe
  C:\Windows\System\PlRIMmA.exe
  2⤵
  PID:6484
- C:\Windows\System\zFBMvJx.exe
  C:\Windows\System\zFBMvJx.exe
  2⤵
  PID:6500
- C:\Windows\System\GDjTfql.exe
  C:\Windows\System\GDjTfql.exe
  2⤵
  PID:6516
- C:\Windows\System\hnhwaln.exe
  C:\Windows\System\hnhwaln.exe
  2⤵
  PID:6532
- C:\Windows\System\PcqHZkb.exe
  C:\Windows\System\PcqHZkb.exe
  2⤵
  PID:6548
- C:\Windows\System\AysXswW.exe
  C:\Windows\System\AysXswW.exe
  2⤵
  PID:6564
- C:\Windows\System\LfWwwYU.exe
  C:\Windows\System\LfWwwYU.exe
  2⤵
  PID:6580
- C:\Windows\System\gjYYEpZ.exe
  C:\Windows\System\gjYYEpZ.exe
  2⤵
  PID:6596
- C:\Windows\System\lOUubpJ.exe
  C:\Windows\System\lOUubpJ.exe
  2⤵
  PID:6612
- C:\Windows\System\EwvOVTG.exe
  C:\Windows\System\EwvOVTG.exe
  2⤵
  PID:6628
- C:\Windows\System\KRutoXC.exe
  C:\Windows\System\KRutoXC.exe
  2⤵
  PID:6644
- C:\Windows\System\FdJOjDc.exe
  C:\Windows\System\FdJOjDc.exe
  2⤵
  PID:6660
- C:\Windows\System\FUsdtef.exe
  C:\Windows\System\FUsdtef.exe
  2⤵
  PID:6676
- C:\Windows\System\wjGETAf.exe
  C:\Windows\System\wjGETAf.exe
  2⤵
  PID:6692
- C:\Windows\System\FLhToun.exe
  C:\Windows\System\FLhToun.exe
  2⤵
  PID:6708
- C:\Windows\System\snozPyu.exe
  C:\Windows\System\snozPyu.exe
  2⤵
  PID:6724
- C:\Windows\System\KZrPlRl.exe
  C:\Windows\System\KZrPlRl.exe
  2⤵
  PID:6740
- C:\Windows\System\eoVRXuE.exe
  C:\Windows\System\eoVRXuE.exe
  2⤵
  PID:6756
- C:\Windows\System\cXPLpuV.exe
  C:\Windows\System\cXPLpuV.exe
  2⤵
  PID:6772
- C:\Windows\System\XEMZdNf.exe
  C:\Windows\System\XEMZdNf.exe
  2⤵
  PID:6792
- C:\Windows\System\GtkscCP.exe
  C:\Windows\System\GtkscCP.exe
  2⤵
  PID:6808
- C:\Windows\System\inwNTdJ.exe
  C:\Windows\System\inwNTdJ.exe
  2⤵
  PID:6832
- C:\Windows\System\DnDYDgU.exe
  C:\Windows\System\DnDYDgU.exe
  2⤵
  PID:6852
- C:\Windows\System\cWloTVa.exe
  C:\Windows\System\cWloTVa.exe
  2⤵
  PID:6876
- C:\Windows\System\VxwHwHp.exe
  C:\Windows\System\VxwHwHp.exe
  2⤵
  PID:6896
- C:\Windows\System\FByvwrp.exe
  C:\Windows\System\FByvwrp.exe
  2⤵
  PID:6916
- C:\Windows\System\WSroeLB.exe
  C:\Windows\System\WSroeLB.exe
  2⤵
  PID:6940
- C:\Windows\System\IrzgwWW.exe
  C:\Windows\System\IrzgwWW.exe
  2⤵
  PID:6956
- C:\Windows\System\JitShvn.exe
  C:\Windows\System\JitShvn.exe
  2⤵
  PID:6976
- C:\Windows\System\XuJFnOt.exe
  C:\Windows\System\XuJFnOt.exe
  2⤵
  PID:7000
- C:\Windows\System\OXdrCxm.exe
  C:\Windows\System\OXdrCxm.exe
  2⤵
  PID:7020
- C:\Windows\System\ZKPIedp.exe
  C:\Windows\System\ZKPIedp.exe
  2⤵
  PID:7040
- C:\Windows\System\CEPgzuf.exe
  C:\Windows\System\CEPgzuf.exe
  2⤵
  PID:7064
- C:\Windows\System\QFAvWbe.exe
  C:\Windows\System\QFAvWbe.exe
  2⤵
  PID:7084
- C:\Windows\System\VoxNALZ.exe
  C:\Windows\System\VoxNALZ.exe
  2⤵
  PID:7104
- C:\Windows\System\VpneoHl.exe
  C:\Windows\System\VpneoHl.exe
  2⤵
  PID:7120
- C:\Windows\System\NlgqCWP.exe
  C:\Windows\System\NlgqCWP.exe
  2⤵
  PID:7144
- C:\Windows\System\scQvpAv.exe
  C:\Windows\System\scQvpAv.exe
  2⤵
  PID:7160
- C:\Windows\System\SurWgVC.exe
  C:\Windows\System\SurWgVC.exe
  2⤵
  PID:5636
- C:\Windows\System\pgInWqx.exe
  C:\Windows\System\pgInWqx.exe
  2⤵
  PID:5684
- C:\Windows\System\OKwiSIK.exe
  C:\Windows\System\OKwiSIK.exe
  2⤵
  PID:5728
- C:\Windows\System\ZabmdmK.exe
  C:\Windows\System\ZabmdmK.exe
  2⤵
  PID:5784
- C:\Windows\System\cqDYEDU.exe
  C:\Windows\System\cqDYEDU.exe
  2⤵
  PID:5852
- C:\Windows\System\lVULXCH.exe
  C:\Windows\System\lVULXCH.exe
  2⤵
  PID:5896
- C:\Windows\System\iwLnCcd.exe
  C:\Windows\System\iwLnCcd.exe
  2⤵
  PID:5952
- C:\Windows\System\vKrEWRA.exe
  C:\Windows\System\vKrEWRA.exe
  2⤵
  PID:6044
- C:\Windows\System\uZONJAH.exe
  C:\Windows\System\uZONJAH.exe
  2⤵
  PID:6092
- C:\Windows\System\yaQgzJR.exe
  C:\Windows\System\yaQgzJR.exe
  2⤵
  PID:6136
- C:\Windows\System\JIrPhmK.exe
  C:\Windows\System\JIrPhmK.exe
  2⤵
  PID:3352
- C:\Windows\System\iqofsql.exe
  C:\Windows\System\iqofsql.exe
  2⤵
  PID:4216
- C:\Windows\System\CgQKtcI.exe
  C:\Windows\System\CgQKtcI.exe
  2⤵
  PID:4392
- C:\Windows\System\AVQWtXk.exe
  C:\Windows\System\AVQWtXk.exe
  2⤵
  PID:1460
- C:\Windows\System\funqQSA.exe
  C:\Windows\System\funqQSA.exe
  2⤵
  PID:2244
- C:\Windows\System\abbYXWF.exe
  C:\Windows\System\abbYXWF.exe
  2⤵
  PID:4372
- C:\Windows\System\NqIpJvV.exe
  C:\Windows\System\NqIpJvV.exe
  2⤵
  PID:2924
- C:\Windows\System\xuqbQRA.exe
  C:\Windows\System\xuqbQRA.exe
  2⤵
  PID:5200
- C:\Windows\System\EZNNoZX.exe
  C:\Windows\System\EZNNoZX.exe
  2⤵
  PID:4672
- C:\Windows\System\TBNvEKw.exe
  C:\Windows\System\TBNvEKw.exe
  2⤵
  PID:5552
- C:\Windows\System\CgRBjNg.exe
  C:\Windows\System\CgRBjNg.exe
  2⤵
  PID:2996
- C:\Windows\System\ixuEBhR.exe
  C:\Windows\System\ixuEBhR.exe
  2⤵
  PID:6364
- C:\Windows\System\vBeOrJE.exe
  C:\Windows\System\vBeOrJE.exe
  2⤵
  PID:5164
- C:\Windows\System\wjJnudG.exe
  C:\Windows\System\wjJnudG.exe
  2⤵
  PID:7184
- C:\Windows\System\vFmyUXm.exe
  C:\Windows\System\vFmyUXm.exe
  2⤵
  PID:7220
- C:\Windows\System\LowoYhN.exe
  C:\Windows\System\LowoYhN.exe
  2⤵
  PID:7608
- C:\Windows\System\fpAbwXs.exe
  C:\Windows\System\fpAbwXs.exe
  2⤵
  PID:7628
- C:\Windows\System\JqtpBWJ.exe
  C:\Windows\System\JqtpBWJ.exe
  2⤵
  PID:7692
- C:\Windows\System\wqKBHQX.exe
  C:\Windows\System\wqKBHQX.exe
  2⤵
  PID:7708
- C:\Windows\System\SEpKLxv.exe
  C:\Windows\System\SEpKLxv.exe
  2⤵
  PID:7724
- C:\Windows\System\ptzBTmk.exe
  C:\Windows\System\ptzBTmk.exe
  2⤵
  PID:7744
- C:\Windows\System\WFDaUSH.exe
  C:\Windows\System\WFDaUSH.exe
  2⤵
  PID:7760
- C:\Windows\System\zOIxkuc.exe
  C:\Windows\System\zOIxkuc.exe
  2⤵
  PID:7784
- C:\Windows\System\iFOVhVw.exe
  C:\Windows\System\iFOVhVw.exe
  2⤵
  PID:7800
- C:\Windows\System\ibFYmLs.exe
  C:\Windows\System\ibFYmLs.exe
  2⤵
  PID:7816
- C:\Windows\System\mkNiqgF.exe
  C:\Windows\System\mkNiqgF.exe
  2⤵
  PID:7840
- C:\Windows\System\oOWnGgV.exe
  C:\Windows\System\oOWnGgV.exe
  2⤵
  PID:7864
- C:\Windows\System\oNCFPQz.exe
  C:\Windows\System\oNCFPQz.exe
  2⤵
  PID:7880
- C:\Windows\System\cauHWRE.exe
  C:\Windows\System\cauHWRE.exe
  2⤵
  PID:7896
- C:\Windows\System\CVfIJDV.exe
  C:\Windows\System\CVfIJDV.exe
  2⤵
  PID:7920
- C:\Windows\System\DKQSaSI.exe
  C:\Windows\System\DKQSaSI.exe
  2⤵
  PID:7940
- C:\Windows\System\rvIZbpB.exe
  C:\Windows\System\rvIZbpB.exe
  2⤵
  PID:7960
- C:\Windows\System\Wezwohz.exe
  C:\Windows\System\Wezwohz.exe
  2⤵
  PID:7980
- C:\Windows\System\kSXPbej.exe
  C:\Windows\System\kSXPbej.exe
  2⤵
  PID:8000
- C:\Windows\System\PJBhXIf.exe
  C:\Windows\System\PJBhXIf.exe
  2⤵
  PID:8020
- C:\Windows\System\XZwrkrT.exe
  C:\Windows\System\XZwrkrT.exe
  2⤵
  PID:8040
- C:\Windows\System\qUxpRgY.exe
  C:\Windows\System\qUxpRgY.exe
  2⤵
  PID:8060
- C:\Windows\System\DhLUSei.exe
  C:\Windows\System\DhLUSei.exe
  2⤵
  PID:8076
- C:\Windows\System\DsalUzB.exe
  C:\Windows\System\DsalUzB.exe
  2⤵
  PID:8092
- C:\Windows\System\tijnQSa.exe
  C:\Windows\System\tijnQSa.exe
  2⤵
  PID:8116
- C:\Windows\System\pZBeaQk.exe
  C:\Windows\System\pZBeaQk.exe
  2⤵
  PID:8132
- C:\Windows\System\ZLUubRQ.exe
  C:\Windows\System\ZLUubRQ.exe
  2⤵
  PID:8156
- C:\Windows\System\KbcjsGp.exe
  C:\Windows\System\KbcjsGp.exe
  2⤵
  PID:8176
- C:\Windows\System\likfGAf.exe
  C:\Windows\System\likfGAf.exe
  2⤵
  PID:6356
- C:\Windows\System\xsxtFNf.exe
  C:\Windows\System\xsxtFNf.exe
  2⤵
  PID:6264
- C:\Windows\System\BGaLdIg.exe
  C:\Windows\System\BGaLdIg.exe
  2⤵
  PID:5348
- C:\Windows\System\ZrSGMPh.exe
  C:\Windows\System\ZrSGMPh.exe
  2⤵
  PID:6372
- C:\Windows\System\mejUhAc.exe
  C:\Windows\System\mejUhAc.exe
  2⤵
  PID:8196
- C:\Windows\System\cUGoVrY.exe
  C:\Windows\System\cUGoVrY.exe
  2⤵
  PID:8216
- C:\Windows\System\xhPQGQe.exe
  C:\Windows\System\xhPQGQe.exe
  2⤵
  PID:8232
- C:\Windows\System\TPMvWZn.exe
  C:\Windows\System\TPMvWZn.exe
  2⤵
  PID:8260
- C:\Windows\System\WgMfdyz.exe
  C:\Windows\System\WgMfdyz.exe
  2⤵
  PID:8280
- C:\Windows\System\JUrbIWZ.exe
  C:\Windows\System\JUrbIWZ.exe
  2⤵
  PID:8300
- C:\Windows\System\OgxkJdu.exe
  C:\Windows\System\OgxkJdu.exe
  2⤵
  PID:8324
- C:\Windows\System\iXsXeTm.exe
  C:\Windows\System\iXsXeTm.exe
  2⤵
  PID:8344
- C:\Windows\System\gVEmJaA.exe
  C:\Windows\System\gVEmJaA.exe
  2⤵
  PID:8364
- C:\Windows\System\CguDWCo.exe
  C:\Windows\System\CguDWCo.exe
  2⤵
  PID:8384
- C:\Windows\System\svGgFBD.exe
  C:\Windows\System\svGgFBD.exe
  2⤵
  PID:8404
- C:\Windows\System\JKtFTvy.exe
  C:\Windows\System\JKtFTvy.exe
  2⤵
  PID:8428
- C:\Windows\System\JFhvWvP.exe
  C:\Windows\System\JFhvWvP.exe
  2⤵
  PID:8448
- C:\Windows\System\JdLpxfi.exe
  C:\Windows\System\JdLpxfi.exe
  2⤵
  PID:8468
- C:\Windows\System\nwmcahC.exe
  C:\Windows\System\nwmcahC.exe
  2⤵
  PID:8492
- C:\Windows\System\rKiWaCi.exe
  C:\Windows\System\rKiWaCi.exe
  2⤵
  PID:8516
- C:\Windows\System\nWRAriG.exe
  C:\Windows\System\nWRAriG.exe
  2⤵
  PID:8536
- C:\Windows\System\WMfAPqd.exe
  C:\Windows\System\WMfAPqd.exe
  2⤵
  PID:8560
- C:\Windows\System\ZnFNFqg.exe
  C:\Windows\System\ZnFNFqg.exe
  2⤵
  PID:8780
- C:\Windows\System\uOuQAUy.exe
  C:\Windows\System\uOuQAUy.exe
  2⤵
  PID:8800
- C:\Windows\System\PMCrZkj.exe
  C:\Windows\System\PMCrZkj.exe
  2⤵
  PID:8816
- C:\Windows\System\iaJEslL.exe
  C:\Windows\System\iaJEslL.exe
  2⤵
  PID:8832
- C:\Windows\System\OEMhWxN.exe
  C:\Windows\System\OEMhWxN.exe
  2⤵
  PID:8848
- C:\Windows\System\YyBtnxC.exe
  C:\Windows\System\YyBtnxC.exe
  2⤵
  PID:8864
- C:\Windows\System\DhHSDiA.exe
  C:\Windows\System\DhHSDiA.exe
  2⤵
  PID:8880
- C:\Windows\System\joDGOIt.exe
  C:\Windows\System\joDGOIt.exe
  2⤵
  PID:8896
- C:\Windows\System\lXAnbFB.exe
  C:\Windows\System\lXAnbFB.exe
  2⤵
  PID:8912
- C:\Windows\System\qobWYXf.exe
  C:\Windows\System\qobWYXf.exe
  2⤵
  PID:8936
- C:\Windows\System\otLQVbg.exe
  C:\Windows\System\otLQVbg.exe
  2⤵
  PID:8956
- C:\Windows\System\QKtdzvE.exe
  C:\Windows\System\QKtdzvE.exe
  2⤵
  PID:8988
- C:\Windows\System\rCORuIJ.exe
  C:\Windows\System\rCORuIJ.exe
  2⤵
  PID:9008
- C:\Windows\System\MNgqxLX.exe
  C:\Windows\System\MNgqxLX.exe
  2⤵
  PID:9024
- C:\Windows\System\zudBvOx.exe
  C:\Windows\System\zudBvOx.exe
  2⤵
  PID:9044
- C:\Windows\System\lkOLMNr.exe
  C:\Windows\System\lkOLMNr.exe
  2⤵
  PID:9060
- C:\Windows\System\ORqmXjZ.exe
  C:\Windows\System\ORqmXjZ.exe
  2⤵
  PID:9080
- C:\Windows\System\gWcQzXO.exe
  C:\Windows\System\gWcQzXO.exe
  2⤵
  PID:9096
- C:\Windows\System\mxQJkyd.exe
  C:\Windows\System\mxQJkyd.exe
  2⤵
  PID:9112
- C:\Windows\System\MFbHoPw.exe
  C:\Windows\System\MFbHoPw.exe
  2⤵
  PID:9128
- C:\Windows\System\njGBseR.exe
  C:\Windows\System\njGBseR.exe
  2⤵
  PID:9148
- C:\Windows\System\IuribMU.exe
  C:\Windows\System\IuribMU.exe
  2⤵
  PID:9168
- C:\Windows\System\pFVUyxf.exe
  C:\Windows\System\pFVUyxf.exe
  2⤵
  PID:9192
- C:\Windows\System\aHpfBUM.exe
  C:\Windows\System\aHpfBUM.exe
  2⤵
  PID:6464
- C:\Windows\System\cSSKedr.exe
  C:\Windows\System\cSSKedr.exe
  2⤵
  PID:6496
- C:\Windows\System\gsmjFbO.exe
  C:\Windows\System\gsmjFbO.exe
  2⤵
  PID:6556
- C:\Windows\System\RGImEmr.exe
  C:\Windows\System\RGImEmr.exe
  2⤵
  PID:6592
- C:\Windows\System\UtNNqcQ.exe
  C:\Windows\System\UtNNqcQ.exe
  2⤵
  PID:6636
- C:\Windows\System\PwWBrYM.exe
  C:\Windows\System\PwWBrYM.exe
  2⤵
  PID:6668
- C:\Windows\System\PENIZnY.exe
  C:\Windows\System\PENIZnY.exe
  2⤵
  PID:6732
- C:\Windows\System\PUfCqIz.exe
  C:\Windows\System\PUfCqIz.exe
  2⤵
  PID:6764
- C:\Windows\System\ovutRzL.exe
  C:\Windows\System\ovutRzL.exe
  2⤵
  PID:6908
- C:\Windows\System\vpqVCCp.exe
  C:\Windows\System\vpqVCCp.exe
  2⤵
  PID:6936
- C:\Windows\System\woXHFFy.exe
  C:\Windows\System\woXHFFy.exe
  2⤵
  PID:6968
- C:\Windows\System\ZWvPwXd.exe
  C:\Windows\System\ZWvPwXd.exe
  2⤵
  PID:6996
- C:\Windows\System\zxzQYec.exe
  C:\Windows\System\zxzQYec.exe
  2⤵
  PID:7032
- C:\Windows\System\uPKIRcR.exe
  C:\Windows\System\uPKIRcR.exe
  2⤵
  PID:7076
- C:\Windows\System\rAeUOCN.exe
  C:\Windows\System\rAeUOCN.exe
  2⤵
  PID:7112
- C:\Windows\System\DRuaMru.exe
  C:\Windows\System\DRuaMru.exe
  2⤵
  PID:7156
- C:\Windows\System\HqFlJzV.exe
  C:\Windows\System\HqFlJzV.exe
  2⤵
  PID:5664
- C:\Windows\System\FSMzmCL.exe
  C:\Windows\System\FSMzmCL.exe
  2⤵
  PID:6048
- C:\Windows\System\VZLOmAC.exe
  C:\Windows\System\VZLOmAC.exe
  2⤵
  PID:5912
- C:\Windows\System\wGknlcr.exe
  C:\Windows\System\wGknlcr.exe
  2⤵
  PID:6084
- C:\Windows\System\HAOcybv.exe
  C:\Windows\System\HAOcybv.exe
  2⤵
  PID:4684
- C:\Windows\System\ZRbeEVZ.exe
  C:\Windows\System\ZRbeEVZ.exe
  2⤵
  PID:2912
- C:\Windows\System\NswUQWw.exe
  C:\Windows\System\NswUQWw.exe
  2⤵
  PID:4248
- C:\Windows\System\gJBDPDm.exe
  C:\Windows\System\gJBDPDm.exe
  2⤵
  PID:3468
- C:\Windows\System\QfoRIbX.exe
  C:\Windows\System\QfoRIbX.exe
  2⤵
  PID:5264
- C:\Windows\System\wTTcoJh.exe
  C:\Windows\System\wTTcoJh.exe
  2⤵
  PID:6168
- C:\Windows\System\NnbrYVY.exe
  C:\Windows\System\NnbrYVY.exe
  2⤵
  PID:6352
- C:\Windows\System\VzlNOWo.exe
  C:\Windows\System\VzlNOWo.exe
  2⤵
  PID:3016
- C:\Windows\System\CAvagWT.exe
  C:\Windows\System\CAvagWT.exe
  2⤵
  PID:7196
- C:\Windows\System\iBGOJIL.exe
  C:\Windows\System\iBGOJIL.exe
  2⤵
  PID:7636
- C:\Windows\System\AvyvfNR.exe
  C:\Windows\System\AvyvfNR.exe
  2⤵
  PID:7720
- C:\Windows\System\rgmdHiX.exe
  C:\Windows\System\rgmdHiX.exe
  2⤵
  PID:7796
- C:\Windows\System\pPUpKxD.exe
  C:\Windows\System\pPUpKxD.exe
  2⤵
  PID:7828
- C:\Windows\System\lObZMVH.exe
  C:\Windows\System\lObZMVH.exe
  2⤵
  PID:7856
- C:\Windows\System\JGffCZq.exe
  C:\Windows\System\JGffCZq.exe
  2⤵
  PID:7888
- C:\Windows\System\siqEVLc.exe
  C:\Windows\System\siqEVLc.exe
  2⤵
  PID:7932
- C:\Windows\System\ezmGryj.exe
  C:\Windows\System\ezmGryj.exe
  2⤵
  PID:7956
- C:\Windows\System\JfiKPDm.exe
  C:\Windows\System\JfiKPDm.exe
  2⤵
  PID:8008
- C:\Windows\System\pBjRBUo.exe
  C:\Windows\System\pBjRBUo.exe
  2⤵
  PID:8048
- C:\Windows\System\xBtHGfK.exe
  C:\Windows\System\xBtHGfK.exe
  2⤵
  PID:8084
- C:\Windows\System\VpqKitC.exe
  C:\Windows\System\VpqKitC.exe
  2⤵
  PID:8112
- C:\Windows\System\AJvmtGi.exe
  C:\Windows\System\AJvmtGi.exe
  2⤵
  PID:8144
- C:\Windows\System\VVADBVe.exe
  C:\Windows\System\VVADBVe.exe
  2⤵
  PID:8184
- C:\Windows\System\NHmJVLg.exe
  C:\Windows\System\NHmJVLg.exe
  2⤵
  PID:6332
- C:\Windows\System\RoIVmlJ.exe
  C:\Windows\System\RoIVmlJ.exe
  2⤵
  PID:8212
- C:\Windows\System\xMtkJHi.exe
  C:\Windows\System\xMtkJHi.exe
  2⤵
  PID:8292
- C:\Windows\System\NNUgrVy.exe
  C:\Windows\System\NNUgrVy.exe
  2⤵
  PID:8352
- C:\Windows\System\detDEPD.exe
  C:\Windows\System\detDEPD.exe
  2⤵
  PID:8420
- C:\Windows\System\pmJYhSM.exe
  C:\Windows\System\pmJYhSM.exe
  2⤵
  PID:8488
- C:\Windows\System\AksutsF.exe
  C:\Windows\System\AksutsF.exe
  2⤵
  PID:8556
- C:\Windows\System\gMBsrEP.exe
  C:\Windows\System\gMBsrEP.exe
  2⤵
  PID:7912
- C:\Windows\System\sUPMiok.exe
  C:\Windows\System\sUPMiok.exe
  2⤵
  PID:9204
- C:\Windows\System\BhxLCZT.exe
  C:\Windows\System\BhxLCZT.exe
  2⤵
  PID:6588
- C:\Windows\System\AauUbmL.exe
  C:\Windows\System\AauUbmL.exe
  2⤵
  PID:6752
- C:\Windows\System\CbyONnQ.exe
  C:\Windows\System\CbyONnQ.exe
  2⤵
  PID:8576
- C:\Windows\System\LJLtAHN.exe
  C:\Windows\System\LJLtAHN.exe
  2⤵
  PID:7600
- C:\Windows\System\SoQddpb.exe
  C:\Windows\System\SoQddpb.exe
  2⤵
  PID:7652
- C:\Windows\System\NCJliEo.exe
  C:\Windows\System\NCJliEo.exe
  2⤵
  PID:7672
- C:\Windows\System\iWDoHQM.exe
  C:\Windows\System\iWDoHQM.exe
  2⤵
  PID:7736
- C:\Windows\System\EWzOpiQ.exe
  C:\Windows\System\EWzOpiQ.exe
  2⤵
  PID:7792
- C:\Windows\System\TKjbrlU.exe
  C:\Windows\System\TKjbrlU.exe
  2⤵
  PID:7928
- C:\Windows\System\yitSZIJ.exe
  C:\Windows\System\yitSZIJ.exe
  2⤵
  PID:6248
- C:\Windows\System\lppWlaf.exe
  C:\Windows\System\lppWlaf.exe
  2⤵
  PID:6932
- C:\Windows\System\JvtXsld.exe
  C:\Windows\System\JvtXsld.exe
  2⤵
  PID:9228
- C:\Windows\System\ggVPmSe.exe
  C:\Windows\System\ggVPmSe.exe
  2⤵
  PID:9252
- C:\Windows\System\zqokUzW.exe
  C:\Windows\System\zqokUzW.exe
  2⤵
  PID:9276
- C:\Windows\System\smuDdcJ.exe
  C:\Windows\System\smuDdcJ.exe
  2⤵
  PID:9296
- C:\Windows\System\hqhvhih.exe
  C:\Windows\System\hqhvhih.exe
  2⤵
  PID:9316
- C:\Windows\System\pPOOVzJ.exe
  C:\Windows\System\pPOOVzJ.exe
  2⤵
  PID:9340
- C:\Windows\System\yKCAekR.exe
  C:\Windows\System\yKCAekR.exe
  2⤵
  PID:9360
- C:\Windows\System\CcjJoHN.exe
  C:\Windows\System\CcjJoHN.exe
  2⤵
  PID:9380
- C:\Windows\System\HgnCMLt.exe
  C:\Windows\System\HgnCMLt.exe
  2⤵
  PID:9404
- C:\Windows\System\BkVMaHc.exe
  C:\Windows\System\BkVMaHc.exe
  2⤵
  PID:9432
- C:\Windows\System\HbItvub.exe
  C:\Windows\System\HbItvub.exe
  2⤵
  PID:9456
- C:\Windows\System\UOsDMYK.exe
  C:\Windows\System\UOsDMYK.exe
  2⤵
  PID:9476
- C:\Windows\System\GAJHJhV.exe
  C:\Windows\System\GAJHJhV.exe
  2⤵
  PID:9496
- C:\Windows\System\pUITaEs.exe
  C:\Windows\System\pUITaEs.exe
  2⤵
  PID:9516
- C:\Windows\System\ISRhpZt.exe
  C:\Windows\System\ISRhpZt.exe
  2⤵
  PID:9540
- C:\Windows\System\HtLXcVF.exe
  C:\Windows\System\HtLXcVF.exe
  2⤵
  PID:9556
- C:\Windows\System\atIjWwd.exe
  C:\Windows\System\atIjWwd.exe
  2⤵
  PID:9584
- C:\Windows\System\UecaIUj.exe
  C:\Windows\System\UecaIUj.exe
  2⤵
  PID:9600
- C:\Windows\System\WcNvPPF.exe
  C:\Windows\System\WcNvPPF.exe
  2⤵
  PID:9624
- C:\Windows\System\zDDPIvZ.exe
  C:\Windows\System\zDDPIvZ.exe
  2⤵
  PID:9640
- C:\Windows\System\NloshdA.exe
  C:\Windows\System\NloshdA.exe
  2⤵
  PID:9660
- C:\Windows\System\AyKtTBi.exe
  C:\Windows\System\AyKtTBi.exe
  2⤵
  PID:9684
- C:\Windows\System\MAXxHwn.exe
  C:\Windows\System\MAXxHwn.exe
  2⤵
  PID:9704
- C:\Windows\System\NXLYTAS.exe
  C:\Windows\System\NXLYTAS.exe
  2⤵
  PID:9728
- C:\Windows\System\jGINvKY.exe
  C:\Windows\System\jGINvKY.exe
  2⤵
  PID:9748
- C:\Windows\System\erKffgc.exe
  C:\Windows\System\erKffgc.exe
  2⤵
  PID:9768
- C:\Windows\System\mMdTFCM.exe
  C:\Windows\System\mMdTFCM.exe
  2⤵
  PID:9788
- C:\Windows\System\wGxIbMK.exe
  C:\Windows\System\wGxIbMK.exe
  2⤵
  PID:9808
- C:\Windows\System\DyJskti.exe
  C:\Windows\System\DyJskti.exe
  2⤵
  PID:9824
- C:\Windows\System\QrNQaCd.exe
  C:\Windows\System\QrNQaCd.exe
  2⤵
  PID:9844
- C:\Windows\System\QCTtmai.exe
  C:\Windows\System\QCTtmai.exe
  2⤵
  PID:9860
- C:\Windows\System\NpqzeTo.exe
  C:\Windows\System\NpqzeTo.exe
  2⤵
  PID:9904
- C:\Windows\System\blesHud.exe
  C:\Windows\System\blesHud.exe
  2⤵
  PID:9920
- C:\Windows\System\vBmfafn.exe
  C:\Windows\System\vBmfafn.exe
  2⤵
  PID:9940
- C:\Windows\System\qnOpWor.exe
  C:\Windows\System\qnOpWor.exe
  2⤵
  PID:9968
- C:\Windows\System\Yykzuxf.exe
  C:\Windows\System\Yykzuxf.exe
  2⤵
  PID:9988
- C:\Windows\System\RjDblou.exe
  C:\Windows\System\RjDblou.exe
  2⤵
  PID:10008
- C:\Windows\System\nQJjTtj.exe
  C:\Windows\System\nQJjTtj.exe
  2⤵
  PID:10032
- C:\Windows\System\WhNZhXA.exe
  C:\Windows\System\WhNZhXA.exe
  2⤵
  PID:10052
- C:\Windows\System\fpGwKfq.exe
  C:\Windows\System\fpGwKfq.exe
  2⤵
  PID:10072
- C:\Windows\System\YpqcrMG.exe
  C:\Windows\System\YpqcrMG.exe
  2⤵
  PID:10132
- C:\Windows\System\HSESJKI.exe
  C:\Windows\System\HSESJKI.exe
  2⤵
  PID:10164
- C:\Windows\System\wGQOoGI.exe
  C:\Windows\System\wGQOoGI.exe
  2⤵
  PID:10196
- C:\Windows\System\zcpTuyn.exe
  C:\Windows\System\zcpTuyn.exe
  2⤵
  PID:10216
- C:\Windows\System\hTLAuAu.exe
  C:\Windows\System\hTLAuAu.exe
  2⤵
  PID:9200
- C:\Windows\System\JgVBHBT.exe
  C:\Windows\System\JgVBHBT.exe
  2⤵
  PID:7136
- C:\Windows\System\aJVfunx.exe
  C:\Windows\System\aJVfunx.exe
  2⤵
  PID:8464
- C:\Windows\System\OdgmaQu.exe
  C:\Windows\System\OdgmaQu.exe
  2⤵
  PID:6716
- C:\Windows\System\YeNYTAi.exe
  C:\Windows\System\YeNYTAi.exe
  2⤵
  PID:5372
- C:\Windows\System\JpKHZDN.exe
  C:\Windows\System\JpKHZDN.exe
  2⤵
  PID:8812
- C:\Windows\System\TnbgJEV.exe
  C:\Windows\System\TnbgJEV.exe
  2⤵
  PID:3732
- C:\Windows\System\aUCoyyl.exe
  C:\Windows\System\aUCoyyl.exe
  2⤵
  PID:8892
- C:\Windows\System\rAmiUfe.exe
  C:\Windows\System\rAmiUfe.exe
  2⤵
  PID:8932
- C:\Windows\System\IKwgEXC.exe
  C:\Windows\System\IKwgEXC.exe
  2⤵
  PID:8972
- C:\Windows\System\FputhGC.exe
  C:\Windows\System\FputhGC.exe
  2⤵
  PID:9004
- C:\Windows\System\sHrkrIc.exe
  C:\Windows\System\sHrkrIc.exe
  2⤵
  PID:9072
- C:\Windows\System\IAQpoYF.exe
  C:\Windows\System\IAQpoYF.exe
  2⤵
  PID:9124
- C:\Windows\System\iAScPYo.exe
  C:\Windows\System\iAScPYo.exe
  2⤵
  PID:8036
- C:\Windows\System\UJmoFyf.exe
  C:\Windows\System\UJmoFyf.exe
  2⤵
  PID:8376
- C:\Windows\System\HNduBAi.exe
  C:\Windows\System\HNduBAi.exe
  2⤵
  PID:7616
- C:\Windows\System\ZzlzfwN.exe
  C:\Windows\System\ZzlzfwN.exe
  2⤵
  PID:7776
- C:\Windows\System\TuOTdXA.exe
  C:\Windows\System\TuOTdXA.exe
  2⤵
  PID:6924
- C:\Windows\System\AZzHWNC.exe
  C:\Windows\System\AZzHWNC.exe
  2⤵
  PID:9244
- C:\Windows\System\MCDVJIN.exe
  C:\Windows\System\MCDVJIN.exe
  2⤵
  PID:7016
- C:\Windows\System\pTfwCRL.exe
  C:\Windows\System\pTfwCRL.exe
  2⤵
  PID:756
- C:\Windows\System\dAoFXrK.exe
  C:\Windows\System\dAoFXrK.exe
  2⤵
  PID:9420
- C:\Windows\System\qBPWZoU.exe
  C:\Windows\System\qBPWZoU.exe
  2⤵
  PID:10244
- C:\Windows\System\BkxBtfp.exe
  C:\Windows\System\BkxBtfp.exe
  2⤵
  PID:10268
- C:\Windows\System\wnFObgY.exe
  C:\Windows\System\wnFObgY.exe
  2⤵
  PID:10292
- C:\Windows\System\WOUanGw.exe
  C:\Windows\System\WOUanGw.exe
  2⤵
  PID:10316
- C:\Windows\System\UVtvGhA.exe
  C:\Windows\System\UVtvGhA.exe
  2⤵
  PID:10332
- C:\Windows\System\TWTJlPV.exe
  C:\Windows\System\TWTJlPV.exe
  2⤵
  PID:10356
- C:\Windows\System\IlpdBmb.exe
  C:\Windows\System\IlpdBmb.exe
  2⤵
  PID:10376
- C:\Windows\System\kdgIAZD.exe
  C:\Windows\System\kdgIAZD.exe
  2⤵
  PID:10400
- C:\Windows\System\LbjYoGN.exe
  C:\Windows\System\LbjYoGN.exe
  2⤵
  PID:10932
- C:\Windows\System\bhBXLVI.exe
  C:\Windows\System\bhBXLVI.exe
  2⤵
  PID:11004
- C:\Windows\System\yFXRqRG.exe
  C:\Windows\System\yFXRqRG.exe
  2⤵
  PID:11036
- C:\Windows\System\XVKouGU.exe
  C:\Windows\System\XVKouGU.exe
  2⤵
  PID:11060
- C:\Windows\System\sJzvqYj.exe
  C:\Windows\System\sJzvqYj.exe
  2⤵
  PID:11080
- C:\Windows\System\xgXJcQh.exe
  C:\Windows\System\xgXJcQh.exe
  2⤵
  PID:11096
- C:\Windows\System\FwGzLBk.exe
  C:\Windows\System\FwGzLBk.exe
  2⤵
  PID:11120
- C:\Windows\System\YXckQXr.exe
  C:\Windows\System\YXckQXr.exe
  2⤵
  PID:11140
- C:\Windows\System\AcUfnlL.exe
  C:\Windows\System\AcUfnlL.exe
  2⤵
  PID:11184
- C:\Windows\System\QhClkxO.exe
  C:\Windows\System\QhClkxO.exe
  2⤵
  PID:11200
- C:\Windows\System\edrWdBT.exe
  C:\Windows\System\edrWdBT.exe
  2⤵
  PID:11224
- C:\Windows\System\zOLSmkR.exe
  C:\Windows\System\zOLSmkR.exe
  2⤵
  PID:11248
- C:\Windows\System\qEfqnpX.exe
  C:\Windows\System\qEfqnpX.exe
  2⤵
  PID:9484
- C:\Windows\System\BIoglLY.exe
  C:\Windows\System\BIoglLY.exe
  2⤵
  PID:9592
- C:\Windows\System\ytmWeJV.exe
  C:\Windows\System\ytmWeJV.exe
  2⤵
  PID:9680
- C:\Windows\System\PLLePEX.exe
  C:\Windows\System\PLLePEX.exe
  2⤵
  PID:1524
- C:\Windows\System\SWghBPr.exe
  C:\Windows\System\SWghBPr.exe
  2⤵
  PID:5680
- C:\Windows\System\rqLaTUV.exe
  C:\Windows\System\rqLaTUV.exe
  2⤵
  PID:8140
- C:\Windows\System\zOKYDyW.exe
  C:\Windows\System\zOKYDyW.exe
  2⤵
  PID:6964
- C:\Windows\System\aHcNfmj.exe
  C:\Windows\System\aHcNfmj.exe
  2⤵
  PID:8476
- C:\Windows\System\KifNwRS.exe
  C:\Windows\System\KifNwRS.exe
  2⤵
  PID:6984
- C:\Windows\System\EVwlkBj.exe
  C:\Windows\System\EVwlkBj.exe
  2⤵
  PID:7668
- C:\Windows\System\DgztuGW.exe
  C:\Windows\System\DgztuGW.exe
  2⤵
  PID:9312
- C:\Windows\System\LYfIDqy.exe
  C:\Windows\System\LYfIDqy.exe
  2⤵
  PID:9288
- C:\Windows\System\ALrEKwr.exe
  C:\Windows\System\ALrEKwr.exe
  2⤵
  PID:9472
- C:\Windows\System\BKtLWrW.exe
  C:\Windows\System\BKtLWrW.exe
  2⤵
  PID:5660
- C:\Windows\System\BrzWFHi.exe
  C:\Windows\System\BrzWFHi.exe
  2⤵
  PID:10340
- C:\Windows\System\AWDHRIS.exe
  C:\Windows\System\AWDHRIS.exe
  2⤵
  PID:10392
- C:\Windows\System\BkEWDNr.exe
  C:\Windows\System\BkEWDNr.exe
  2⤵
  PID:6132
- C:\Windows\System\ecHijVs.exe
  C:\Windows\System\ecHijVs.exe
  2⤵
  PID:9764
- C:\Windows\System\nwAlHdJ.exe
  C:\Windows\System\nwAlHdJ.exe
  2⤵
  PID:9780
- C:\Windows\System\MrHKmeA.exe
  C:\Windows\System\MrHKmeA.exe
  2⤵
  PID:9816
- C:\Windows\System\AphdOvm.exe
  C:\Windows\System\AphdOvm.exe
  2⤵
  PID:3300
- C:\Windows\System\DDuAMAy.exe
  C:\Windows\System\DDuAMAy.exe
  2⤵
  PID:5176
- C:\Windows\System\QKbZEwm.exe
  C:\Windows\System\QKbZEwm.exe
  2⤵
  PID:6340
- C:\Windows\System\dagEPpE.exe
  C:\Windows\System\dagEPpE.exe
  2⤵
  PID:3184
- C:\Windows\System\OiNcaJG.exe
  C:\Windows\System\OiNcaJG.exe
  2⤵
  PID:7700
- C:\Windows\System\EHCHjfx.exe
  C:\Windows\System\EHCHjfx.exe
  2⤵
  PID:7836
- C:\Windows\System\gPXUOiR.exe
  C:\Windows\System\gPXUOiR.exe
  2⤵
  PID:7952
- C:\Windows\System\MYYkuZs.exe
  C:\Windows\System\MYYkuZs.exe
  2⤵
  PID:8108
- C:\Windows\System\LYWJEnB.exe
  C:\Windows\System\LYWJEnB.exe
  2⤵
  PID:8208
- C:\Windows\System\ZoDkBjA.exe
  C:\Windows\System\ZoDkBjA.exe
  2⤵
  PID:8400
- C:\Windows\System\tcqkToe.exe
  C:\Windows\System\tcqkToe.exe
  2⤵
  PID:7916
- C:\Windows\System\aNzYMSp.exe
  C:\Windows\System\aNzYMSp.exe
  2⤵
  PID:10236
- C:\Windows\System\cZSKjUT.exe
  C:\Windows\System\cZSKjUT.exe
  2⤵
  PID:8888
- C:\Windows\System\LqVuMgj.exe
  C:\Windows\System\LqVuMgj.exe
  2⤵
  PID:8968
- C:\Windows\System\lEaDLdo.exe
  C:\Windows\System\lEaDLdo.exe
  2⤵
  PID:9092
- C:\Windows\System\FczHVNz.exe
  C:\Windows\System\FczHVNz.exe
  2⤵
  PID:9388
- C:\Windows\System\MjwGSXR.exe
  C:\Windows\System\MjwGSXR.exe
  2⤵
  PID:7768
- C:\Windows\System\vNnUXaH.exe
  C:\Windows\System\vNnUXaH.exe
  2⤵
  PID:9616
- C:\Windows\System\xRHayUr.exe
  C:\Windows\System\xRHayUr.exe
  2⤵
  PID:9676
- C:\Windows\System\YAKeJpj.exe
  C:\Windows\System\YAKeJpj.exe
  2⤵
  PID:9720
- C:\Windows\System\hLxesvm.exe
  C:\Windows\System\hLxesvm.exe
  2⤵
  PID:11272
- C:\Windows\System\KBsfwzo.exe
  C:\Windows\System\KBsfwzo.exe
  2⤵
  PID:11388
- C:\Windows\System\xRPhSKg.exe
  C:\Windows\System\xRPhSKg.exe
  2⤵
  PID:11412
- C:\Windows\System\BpPsMWD.exe
  C:\Windows\System\BpPsMWD.exe
  2⤵
  PID:11440
- C:\Windows\System\WtYDBmd.exe
  C:\Windows\System\WtYDBmd.exe
  2⤵
  PID:11464
- C:\Windows\System\OTswusL.exe
  C:\Windows\System\OTswusL.exe
  2⤵
  PID:11484
- C:\Windows\System\lMlCCdN.exe
  C:\Windows\System\lMlCCdN.exe
  2⤵
  PID:11512
- C:\Windows\System\UocBHec.exe
  C:\Windows\System\UocBHec.exe
  2⤵
  PID:11536
- C:\Windows\System\hvDEGgE.exe
  C:\Windows\System\hvDEGgE.exe
  2⤵
  PID:11552
- C:\Windows\System\EucZAwg.exe
  C:\Windows\System\EucZAwg.exe
  2⤵
  PID:11576
- C:\Windows\System\itwEEZI.exe
  C:\Windows\System\itwEEZI.exe
  2⤵
  PID:11600
- C:\Windows\System\DOGdmhc.exe
  C:\Windows\System\DOGdmhc.exe
  2⤵
  PID:11620
- C:\Windows\System\ABvXevi.exe
  C:\Windows\System\ABvXevi.exe
  2⤵
  PID:11640
- C:\Windows\System\xUqdEZw.exe
  C:\Windows\System\xUqdEZw.exe
  2⤵
  PID:11664
- C:\Windows\System\MvVogkF.exe
  C:\Windows\System\MvVogkF.exe
  2⤵
  PID:11692
- C:\Windows\System\tkBJqMn.exe
  C:\Windows\System\tkBJqMn.exe
  2⤵
  PID:11716
- C:\Windows\System\gEVmvBT.exe
  C:\Windows\System\gEVmvBT.exe
  2⤵
  PID:11736
- C:\Windows\System\TmjOvss.exe
  C:\Windows\System\TmjOvss.exe
  2⤵
  PID:11760
- C:\Windows\System\ptyffqK.exe
  C:\Windows\System\ptyffqK.exe
  2⤵
  PID:11776
- C:\Windows\System\CgCnxUk.exe
  C:\Windows\System\CgCnxUk.exe
  2⤵
  PID:11804
- C:\Windows\System\CeZOpHw.exe
  C:\Windows\System\CeZOpHw.exe
  2⤵
  PID:11820
- C:\Windows\System\jstJTpM.exe
  C:\Windows\System\jstJTpM.exe
  2⤵
  PID:11840
- C:\Windows\System\RNaZyTz.exe
  C:\Windows\System\RNaZyTz.exe
  2⤵
  PID:11864
- C:\Windows\System\yQlaEar.exe
  C:\Windows\System\yQlaEar.exe
  2⤵
  PID:11884
- C:\Windows\System\SkqwcYZ.exe
  C:\Windows\System\SkqwcYZ.exe
  2⤵
  PID:11904
- C:\Windows\System\zALPxhV.exe
  C:\Windows\System\zALPxhV.exe
  2⤵
  PID:11920
- C:\Windows\System\WLwqMEC.exe
  C:\Windows\System\WLwqMEC.exe
  2⤵
  PID:11944
- C:\Windows\System\fjEHkOT.exe
  C:\Windows\System\fjEHkOT.exe
  2⤵
  PID:11960
- C:\Windows\System\CDprrtJ.exe
  C:\Windows\System\CDprrtJ.exe
  2⤵
  PID:11992
- C:\Windows\System\UeAhTvn.exe
  C:\Windows\System\UeAhTvn.exe
  2⤵
  PID:12012
- C:\Windows\System\mdVJqpr.exe
  C:\Windows\System\mdVJqpr.exe
  2⤵
  PID:12036
- C:\Windows\System\BCFuniE.exe
  C:\Windows\System\BCFuniE.exe
  2⤵
  PID:12056
- C:\Windows\System\JLWbGDk.exe
  C:\Windows\System\JLWbGDk.exe
  2⤵
  PID:12072
- C:\Windows\System\vTvXcQp.exe
  C:\Windows\System\vTvXcQp.exe
  2⤵
  PID:12088
- C:\Windows\System\wlxBnfM.exe
  C:\Windows\System\wlxBnfM.exe
  2⤵
  PID:12104
- C:\Windows\System\mXUJRIW.exe
  C:\Windows\System\mXUJRIW.exe
  2⤵
  PID:12120
- C:\Windows\System\iYZbpfz.exe
  C:\Windows\System\iYZbpfz.exe
  2⤵
  PID:12136
- C:\Windows\System\Iyyorvz.exe
  C:\Windows\System\Iyyorvz.exe
  2⤵
  PID:12152
- C:\Windows\System\wcfuWpc.exe
  C:\Windows\System\wcfuWpc.exe
  2⤵
  PID:12168
- C:\Windows\System\CfdFvEO.exe
  C:\Windows\System\CfdFvEO.exe
  2⤵
  PID:12184
- C:\Windows\System\PXezlKo.exe
  C:\Windows\System\PXezlKo.exe
  2⤵
  PID:12200
- C:\Windows\System\NdBauAB.exe
  C:\Windows\System\NdBauAB.exe
  2⤵
  PID:12216
- C:\Windows\System\XsEhtew.exe
  C:\Windows\System\XsEhtew.exe
  2⤵
  PID:12232
- C:\Windows\System\IoRESHt.exe
  C:\Windows\System\IoRESHt.exe
  2⤵
  PID:12252
- C:\Windows\System\OehbKbH.exe
  C:\Windows\System\OehbKbH.exe
  2⤵
  PID:12272
- C:\Windows\System\eeOimYb.exe
  C:\Windows\System\eeOimYb.exe
  2⤵
  PID:9868
- C:\Windows\System\SareCeU.exe
  C:\Windows\System\SareCeU.exe
  2⤵
  PID:9912
- C:\Windows\System\qTVrGdN.exe
  C:\Windows\System\qTVrGdN.exe
  2⤵
  PID:9960
- C:\Windows\System\BbBRkVV.exe
  C:\Windows\System\BbBRkVV.exe
  2⤵
  PID:10000
- C:\Windows\System\KkCYHHc.exe
  C:\Windows\System\KkCYHHc.exe
  2⤵
  PID:10044
- C:\Windows\System\QbKLnvT.exe
  C:\Windows\System\QbKLnvT.exe
  2⤵
  PID:10564
- C:\Windows\System\irIhLRY.exe
  C:\Windows\System\irIhLRY.exe
  2⤵
  PID:10148
- C:\Windows\System\QbMVdLY.exe
  C:\Windows\System\QbMVdLY.exe
  2⤵
  PID:5988
- C:\Windows\System\YMQKOyl.exe
  C:\Windows\System\YMQKOyl.exe
  2⤵
  PID:11012
- C:\Windows\System\twpwuHT.exe
  C:\Windows\System\twpwuHT.exe
  2⤵
  PID:11076
- C:\Windows\System\qTJkvcX.exe
  C:\Windows\System\qTJkvcX.exe
  2⤵
  PID:9036
- C:\Windows\System\lAttOEF.exe
  C:\Windows\System\lAttOEF.exe
  2⤵
  PID:9236
- C:\Windows\System\LTkOABq.exe
  C:\Windows\System\LTkOABq.exe
  2⤵
  PID:12292
- C:\Windows\System\HSlxYWb.exe
  C:\Windows\System\HSlxYWb.exe
  2⤵
  PID:12320
- C:\Windows\System\mwEUMco.exe
  C:\Windows\System\mwEUMco.exe
  2⤵
  PID:12348
- C:\Windows\System\sOgfVcH.exe
  C:\Windows\System\sOgfVcH.exe
  2⤵
  PID:12368
- C:\Windows\System\uhQMJRJ.exe
  C:\Windows\System\uhQMJRJ.exe
  2⤵
  PID:12388
- C:\Windows\System\jatFaes.exe
  C:\Windows\System\jatFaes.exe
  2⤵
  PID:12412
- C:\Windows\System\lvkBRDy.exe
  C:\Windows\System\lvkBRDy.exe
  2⤵
  PID:12432
- C:\Windows\System\MmvSbIS.exe
  C:\Windows\System\MmvSbIS.exe
  2⤵
  PID:12452
- C:\Windows\System\COCNeBu.exe
  C:\Windows\System\COCNeBu.exe
  2⤵
  PID:12472
- C:\Windows\System\LdddBiB.exe
  C:\Windows\System\LdddBiB.exe
  2⤵
  PID:12488
- C:\Windows\System\fuJDjyO.exe
  C:\Windows\System\fuJDjyO.exe
  2⤵
  PID:12504
- C:\Windows\System\DQHTzYH.exe
  C:\Windows\System\DQHTzYH.exe
  2⤵
  PID:12528
- C:\Windows\System\dVTQLsr.exe
  C:\Windows\System\dVTQLsr.exe
  2⤵
  PID:12548
- C:\Windows\System\pdhvdED.exe
  C:\Windows\System\pdhvdED.exe
  2⤵
  PID:12564
- C:\Windows\System\zcGzdZv.exe
  C:\Windows\System\zcGzdZv.exe
  2⤵
  PID:12584
- C:\Windows\System\oClCTOp.exe
  C:\Windows\System\oClCTOp.exe
  2⤵
  PID:12604
- C:\Windows\System\CcDXDlL.exe
  C:\Windows\System\CcDXDlL.exe
  2⤵
  PID:12628
- C:\Windows\System\UbZFSQJ.exe
  C:\Windows\System\UbZFSQJ.exe
  2⤵
  PID:12652
- C:\Windows\System\THfnRAy.exe
  C:\Windows\System\THfnRAy.exe
  2⤵
  PID:12672
- C:\Windows\System\FVuFwLv.exe
  C:\Windows\System\FVuFwLv.exe
  2⤵
  PID:12692
- C:\Windows\System\RvaEAWK.exe
  C:\Windows\System\RvaEAWK.exe
  2⤵
  PID:12712
- C:\Windows\System\xoXIzdO.exe
  C:\Windows\System\xoXIzdO.exe
  2⤵
  PID:12732
- C:\Windows\System\FqaxfWK.exe
  C:\Windows\System\FqaxfWK.exe
  2⤵
  PID:12752
- C:\Windows\System\ZPuupwo.exe
  C:\Windows\System\ZPuupwo.exe
  2⤵
  PID:12780
- C:\Windows\System\JqyqUzL.exe
  C:\Windows\System\JqyqUzL.exe
  2⤵
  PID:12796
- C:\Windows\System\aLMqdQg.exe
  C:\Windows\System\aLMqdQg.exe
  2⤵
  PID:12820
- C:\Windows\System\HVBPikM.exe
  C:\Windows\System\HVBPikM.exe
  2⤵
  PID:12840
- C:\Windows\System\tGDkmsF.exe
  C:\Windows\System\tGDkmsF.exe
  2⤵
  PID:12864
- C:\Windows\System\gyTVQHo.exe
  C:\Windows\System\gyTVQHo.exe
  2⤵
  PID:12888
- C:\Windows\System\CRdtTQp.exe
  C:\Windows\System\CRdtTQp.exe
  2⤵
  PID:12936
- C:\Windows\System\yZlZgEN.exe
  C:\Windows\System\yZlZgEN.exe
  2⤵
  PID:12952
- C:\Windows\System\tvaXdBY.exe
  C:\Windows\System\tvaXdBY.exe
  2⤵
  PID:12972
- C:\Windows\System\RygSUUW.exe
  C:\Windows\System\RygSUUW.exe
  2⤵
  PID:12996
- C:\Windows\System\GSVxhXv.exe
  C:\Windows\System\GSVxhXv.exe
  2⤵
  PID:13016
- C:\Windows\System\JolMxGY.exe
  C:\Windows\System\JolMxGY.exe
  2⤵
  PID:13036
- C:\Windows\System\alYPMib.exe
  C:\Windows\System\alYPMib.exe
  2⤵
  PID:13056
- C:\Windows\System\Aetxcsa.exe
  C:\Windows\System\Aetxcsa.exe
  2⤵
  PID:13124
- C:\Windows\System\gpNjuzK.exe
  C:\Windows\System\gpNjuzK.exe
  2⤵
  PID:13144
- C:\Windows\System\JbTSKyQ.exe
  C:\Windows\System\JbTSKyQ.exe
  2⤵
  PID:13160
- C:\Windows\System\AMeFRGo.exe
  C:\Windows\System\AMeFRGo.exe
  2⤵
  PID:13184
- C:\Windows\System\vPAYHmP.exe
  C:\Windows\System\vPAYHmP.exe
  2⤵
  PID:13204
- C:\Windows\System\eAhRrpd.exe
  C:\Windows\System\eAhRrpd.exe
  2⤵
  PID:12624
- C:\Windows\System\BuUEglj.exe
  C:\Windows\System\BuUEglj.exe
  2⤵
  PID:10888
- C:\Windows\System\wwyzaTj.exe
  C:\Windows\System\wwyzaTj.exe
  2⤵
  PID:11700
- C:\Windows\System\jjSOqCE.exe
  C:\Windows\System\jjSOqCE.exe
  2⤵
  PID:7872
- C:\Windows\System\HClBgPF.exe
  C:\Windows\System\HClBgPF.exe
  2⤵
  PID:9784
- C:\Windows\System\nEwdrDJ.exe
  C:\Windows\System\nEwdrDJ.exe
  2⤵
  PID:11280
- C:\Windows\System\GHiJQUC.exe
  C:\Windows\System\GHiJQUC.exe
  2⤵
  PID:11480
- C:\Windows\System\wqkEkkr.exe
  C:\Windows\System\wqkEkkr.exe
  2⤵
  PID:1968
- C:\Windows\System\ecfPFJr.exe
  C:\Windows\System\ecfPFJr.exe
  2⤵
  PID:10520
- C:\Windows\System\dOQuiWE.exe
  C:\Windows\System\dOQuiWE.exe
  2⤵
  PID:11708
- C:\Windows\System\PQfSwQS.exe
  C:\Windows\System\PQfSwQS.exe
  2⤵
  PID:6312
- C:\Windows\System\VMOKdmU.exe
  C:\Windows\System\VMOKdmU.exe
  2⤵
  PID:12400
- C:\Windows\System\zdNDyod.exe
  C:\Windows\System\zdNDyod.exe
  2⤵
  PID:3652
- C:\Windows\System\pKFEjVj.exe
  C:\Windows\System\pKFEjVj.exe
  2⤵
  PID:11132
- C:\Windows\System\cFkwdiK.exe
  C:\Windows\System\cFkwdiK.exe
  2⤵
  PID:8248
- C:\Windows\System\KxLCIHW.exe
  C:\Windows\System\KxLCIHW.exe
  2⤵
  PID:9956
- C:\Windows\System\YlNzxLX.exe
  C:\Windows\System\YlNzxLX.exe
  2⤵
  PID:12728
- C:\Windows\System\HrGbtWA.exe
  C:\Windows\System\HrGbtWA.exe
  2⤵
  PID:12788
- C:\Windows\System\qVrlTIJ.exe
  C:\Windows\System\qVrlTIJ.exe
  2⤵
  PID:12208
- C:\Windows\System\tAVkzsU.exe
  C:\Windows\System\tAVkzsU.exe
  2⤵
  PID:1020
- C:\Windows\System\XWPIGco.exe
  C:\Windows\System\XWPIGco.exe
  2⤵
  PID:13300
- C:\Windows\System\BhLOJCy.exe
  C:\Windows\System\BhLOJCy.exe
  2⤵
  PID:3884
- C:\Windows\System\WeQusOJ.exe
  C:\Windows\System\WeQusOJ.exe
  2⤵
  PID:3768
- C:\Windows\System\gwGNYux.exe
  C:\Windows\System\gwGNYux.exe
  2⤵
  PID:5356
- C:\Windows\System\BXyHfPa.exe
  C:\Windows\System\BXyHfPa.exe
  2⤵
  PID:3972
- C:\Windows\System\RURowid.exe
  C:\Windows\System\RURowid.exe
  2⤵
  PID:3616
- C:\Windows\System\tKlfVAb.exe
  C:\Windows\System\tKlfVAb.exe
  2⤵
  PID:11608
- C:\Windows\System\lBMdQEd.exe
  C:\Windows\System\lBMdQEd.exe
  2⤵
  PID:9744
- C:\Windows\System\RbkmiCf.exe
  C:\Windows\System\RbkmiCf.exe
  2⤵
  PID:11880
- C:\Windows\System\rtcJDXC.exe
  C:\Windows\System\rtcJDXC.exe
  2⤵
  PID:9608
- C:\Windows\System\YaoHaSV.exe
  C:\Windows\System\YaoHaSV.exe
  2⤵
  PID:12280
- C:\Windows\System\cBWLcCU.exe
  C:\Windows\System\cBWLcCU.exe
  2⤵
  PID:8072
- C:\Windows\System\HtPCGOb.exe
  C:\Windows\System\HtPCGOb.exe
  2⤵
  PID:12192
- C:\Windows\System\yHMOEba.exe
  C:\Windows\System\yHMOEba.exe
  2⤵
  PID:9932
- C:\Windows\System\hcnnzhp.exe
  C:\Windows\System\hcnnzhp.exe
  2⤵
  PID:2112
- C:\Windows\System\Ibjeiqx.exe
  C:\Windows\System\Ibjeiqx.exe
  2⤵
  PID:11196
- C:\Windows\System\NeCEfRM.exe
  C:\Windows\System\NeCEfRM.exe
  2⤵
  PID:11832
- C:\Windows\System\yrXsuHN.exe
  C:\Windows\System\yrXsuHN.exe
  2⤵
  PID:10412
- C:\Windows\System\NdaEtds.exe
  C:\Windows\System\NdaEtds.exe
  2⤵
  PID:12596
- C:\Windows\System\ceASsxa.exe
  C:\Windows\System\ceASsxa.exe
  2⤵
  PID:12520
- C:\Windows\System\zUWoXJL.exe
  C:\Windows\System\zUWoXJL.exe
  2⤵
  PID:9508
- C:\Windows\System\SOLiSfH.exe
  C:\Windows\System\SOLiSfH.exe
  2⤵
  PID:11684
- C:\Windows\System\criSBYR.exe
  C:\Windows\System\criSBYR.exe
  2⤵
  PID:12064
- C:\Windows\System\khLyMvH.exe
  C:\Windows\System\khLyMvH.exe
  2⤵
  PID:8964
- C:\Windows\System\gvgMQop.exe
  C:\Windows\System\gvgMQop.exe
  2⤵
  PID:10680
- C:\Windows\System\QfYwEnL.exe
  C:\Windows\System\QfYwEnL.exe
  2⤵
  PID:12268
- C:\Windows\System\IuDhwKr.exe
  C:\Windows\System\IuDhwKr.exe
  2⤵
  PID:7752
- C:\Windows\System\dbaDVcF.exe
  C:\Windows\System\dbaDVcF.exe
  2⤵
  PID:4740
- C:\Windows\System\vULMqvB.exe
  C:\Windows\System\vULMqvB.exe
  2⤵
  PID:12244
- C:\Windows\System\WpOqyPE.exe
  C:\Windows\System\WpOqyPE.exe
  2⤵
  PID:4332
- C:\Windows\System\yJJElpL.exe
  C:\Windows\System\yJJElpL.exe
  2⤵
  PID:11152
- C:\Windows\System\jExjwnc.exe
  C:\Windows\System\jExjwnc.exe
  2⤵
  PID:10280
- C:\Windows\System\kLQuOHn.exe
  C:\Windows\System\kLQuOHn.exe
  2⤵
  PID:10068
- C:\Windows\System\SiehEaq.exe
  C:\Windows\System\SiehEaq.exe
  2⤵
  PID:6868
- C:\Windows\System\hVyUubL.exe
  C:\Windows\System\hVyUubL.exe
  2⤵
  PID:7908
- C:\Windows\System\hfdlijh.exe
  C:\Windows\System\hfdlijh.exe
  2⤵
  PID:6020
- C:\Windows\System\XCkrmfQ.exe
  C:\Windows\System\XCkrmfQ.exe
  2⤵
  PID:9656
- C:\Windows\System\SGsBMMm.exe
  C:\Windows\System\SGsBMMm.exe
  2⤵
  PID:11268
- C:\Windows\System\MgfmNGq.exe
  C:\Windows\System\MgfmNGq.exe
  2⤵
  PID:11476
- C:\Windows\System\XiizdXZ.exe
  C:\Windows\System\XiizdXZ.exe
  2⤵
  PID:12852
- C:\Windows\System\dMZpXRc.exe
  C:\Windows\System\dMZpXRc.exe
  2⤵
  PID:11592
- C:\Windows\System\UWITpVY.exe
  C:\Windows\System\UWITpVY.exe
  2⤵
  PID:5100
- C:\Windows\System\FyPYTkY.exe
  C:\Windows\System\FyPYTkY.exe
  2⤵
  PID:1900
- C:\Windows\System\GHDOibP.exe
  C:\Windows\System\GHDOibP.exe
  2⤵
  PID:12484
- C:\Windows\System\PvxFNFs.exe
  C:\Windows\System\PvxFNFs.exe
  2⤵
  PID:10144
- C:\Windows\System\LuGIMBR.exe
  C:\Windows\System\LuGIMBR.exe
  2⤵
  PID:12300
- C:\Windows\System\OAyQtUo.exe
  C:\Windows\System\OAyQtUo.exe
  2⤵
  PID:6820
- C:\Windows\System\uMvAHxr.exe
  C:\Windows\System\uMvAHxr.exe
  2⤵
  PID:12988
- C:\Windows\System\vGFixbe.exe
  C:\Windows\System\vGFixbe.exe
  2⤵
  PID:11544
- C:\Windows\System\jYapVjH.exe
  C:\Windows\System\jYapVjH.exe
  2⤵
  PID:3484
- C:\Windows\System\ZMHfglC.exe
  C:\Windows\System\ZMHfglC.exe
  2⤵
  PID:2956
- C:\Windows\System\bIbdvJn.exe
  C:\Windows\System\bIbdvJn.exe
  2⤵
  PID:6200
- C:\Windows\System\fyXhiKA.exe
  C:\Windows\System\fyXhiKA.exe
  2⤵
  PID:6216
- C:\Windows\System\NmbTxEi.exe
  C:\Windows\System\NmbTxEi.exe
  2⤵
  PID:12360
- C:\Windows\System\kcOkpun.exe
  C:\Windows\System\kcOkpun.exe
  2⤵
  PID:3852
- C:\Windows\System\FuUITpa.exe
  C:\Windows\System\FuUITpa.exe
  2⤵
  PID:6180
- C:\Windows\System\BrfBGUP.exe
  C:\Windows\System\BrfBGUP.exe
  2⤵
  PID:8016
- C:\Windows\System\tVqOFRU.exe
  C:\Windows\System\tVqOFRU.exe
  2⤵
  PID:10544
- C:\Windows\System\bqXKxDP.exe
  C:\Windows\System\bqXKxDP.exe
  2⤵
  PID:4828
- C:\Windows\System\gdoupZH.exe
  C:\Windows\System\gdoupZH.exe
  2⤵
  PID:11432
- C:\Windows\System\aOXgQxf.exe
  C:\Windows\System\aOXgQxf.exe
  2⤵
  PID:7100
- C:\Windows\System\bceUWNf.exe
  C:\Windows\System\bceUWNf.exe
  2⤵
  PID:4564
- C:\Windows\System\culyYeN.exe
  C:\Windows\System\culyYeN.exe
  2⤵
  PID:6212
- C:\Windows\System\iCxjtCy.exe
  C:\Windows\System\iCxjtCy.exe
  2⤵
  PID:2844
- C:\Windows\System\HmECGgy.exe
  C:\Windows\System\HmECGgy.exe
  2⤵
  PID:3372
- C:\Windows\System\sKfHwax.exe
  C:\Windows\System\sKfHwax.exe
  2⤵
  PID:11452
- C:\Windows\System\kbtxTzu.exe
  C:\Windows\System\kbtxTzu.exe
  2⤵
  PID:12496
- C:\Windows\System\tvuBGxJ.exe
  C:\Windows\System\tvuBGxJ.exe
  2⤵
  PID:12468
- C:\Windows\System\EPXfKCR.exe
  C:\Windows\System\EPXfKCR.exe
  2⤵
  PID:3952
- C:\Windows\System\COGUGxU.exe
  C:\Windows\System\COGUGxU.exe
  2⤵
  PID:4076
- C:\Windows\System\XwAltFn.exe
  C:\Windows\System\XwAltFn.exe
  2⤵
  PID:4588
- C:\Windows\System\MmnoFlP.exe
  C:\Windows\System\MmnoFlP.exe
  2⤵
  PID:2552
- C:\Windows\System\nVwgUGv.exe
  C:\Windows\System\nVwgUGv.exe
  2⤵
  PID:1184
- C:\Windows\System\IHdEbpM.exe
  C:\Windows\System\IHdEbpM.exe
  2⤵
  PID:3976
- C:\Windows\System\HWpYUEw.exe
  C:\Windows\System\HWpYUEw.exe
  2⤵
  PID:4124
- C:\Windows\System\evKaDEZ.exe
  C:\Windows\System\evKaDEZ.exe
  2⤵
  PID:4160
- C:\Windows\System\DWWNegT.exe
  C:\Windows\System\DWWNegT.exe
  2⤵
  PID:3068
- C:\Windows\System\akAoNpN.exe
  C:\Windows\System\akAoNpN.exe
  2⤵
  PID:1408
- C:\Windows\System\gGutLZt.exe
  C:\Windows\System\gGutLZt.exe
  2⤵
  PID:4000
- C:\Windows\System\nkUqlKr.exe
  C:\Windows\System\nkUqlKr.exe
  2⤵
  PID:3756
- C:\Windows\System\cMmyHJS.exe
  C:\Windows\System\cMmyHJS.exe
  2⤵
  PID:13256
- C:\Windows\System\naeQJKZ.exe
  C:\Windows\System\naeQJKZ.exe
  2⤵
  PID:1604
- C:\Windows\System\KayGjjE.exe
  C:\Windows\System\KayGjjE.exe
  2⤵
  PID:2800
- C:\Windows\System\xDIJewd.exe
  C:\Windows\System\xDIJewd.exe
  2⤵
  PID:4128
- C:\Windows\System\yYulFvw.exe
  C:\Windows\System\yYulFvw.exe
  2⤵
  PID:4100
- C:\Windows\System\MpjpVxj.exe
  C:\Windows\System\MpjpVxj.exe
  2⤵
  PID:3964
- C:\Windows\System\DHHqfyL.exe
  C:\Windows\System\DHHqfyL.exe
  2⤵
  PID:3568
- C:\Windows\System\yfMcPvr.exe
  C:\Windows\System\yfMcPvr.exe
  2⤵
  PID:3980
- C:\Windows\System\SmjIKGu.exe
  C:\Windows\System\SmjIKGu.exe
  2⤵
  PID:3092
- C:\Windows\System\StfGDpX.exe
  C:\Windows\System\StfGDpX.exe
  2⤵
  PID:5532
- C:\Windows\System\VkqvGHv.exe
  C:\Windows\System\VkqvGHv.exe
  2⤵
  PID:1476
- C:\Windows\System\HbOIJfT.exe
  C:\Windows\System\HbOIJfT.exe
  2⤵
  PID:952
- C:\Windows\System\Wfxabya.exe
  C:\Windows\System\Wfxabya.exe
  2⤵
  PID:12020
- C:\Windows\System\YDgDPAH.exe
  C:\Windows\System\YDgDPAH.exe
  2⤵
  PID:4280
- C:\Windows\System\uLmlFbO.exe
  C:\Windows\System\uLmlFbO.exe
  2⤵
  PID:3392
- C:\Windows\System\ZFiPMSq.exe
  C:\Windows\System\ZFiPMSq.exe
  2⤵
  PID:3264
- C:\Windows\System\xNWmMHY.exe
  C:\Windows\System\xNWmMHY.exe
  2⤵
  PID:668
- C:\Windows\System\XLDkVxv.exe
  C:\Windows\System\XLDkVxv.exe
  2⤵
  PID:1788
- C:\Windows\System\QtanyzQ.exe
  C:\Windows\System\QtanyzQ.exe
  2⤵
  PID:4276
- C:\Windows\System\WfdXgur.exe
  C:\Windows\System\WfdXgur.exe
  2⤵
  PID:1364
- C:\Windows\System\LBPHrln.exe
  C:\Windows\System\LBPHrln.exe
  2⤵
  PID:4984
- C:\Windows\System\ighecag.exe
  C:\Windows\System\ighecag.exe
  2⤵
  PID:1140
- C:\Windows\System\lugEdZY.exe
  C:\Windows\System\lugEdZY.exe
  2⤵
  PID:2592
- C:\Windows\System\kWvnlej.exe
  C:\Windows\System\kWvnlej.exe
  2⤵
  PID:13436
- C:\Windows\System\mvhHLyg.exe
  C:\Windows\System\mvhHLyg.exe
  2⤵
  PID:13624
- C:\Windows\System\jKMTzEI.exe
  C:\Windows\System\jKMTzEI.exe
  2⤵
  PID:13652
- C:\Windows\System\InPFpvB.exe
  C:\Windows\System\InPFpvB.exe
  2⤵
  PID:13732
- C:\Windows\System\RNBrgYP.exe
  C:\Windows\System\RNBrgYP.exe
  2⤵
  PID:13764
- C:\Windows\System\yPdQHMK.exe
  C:\Windows\System\yPdQHMK.exe
  2⤵
  PID:13780
- C:\Windows\System\yLRfuiq.exe
  C:\Windows\System\yLRfuiq.exe
  2⤵
  PID:13796
- C:\Windows\System\FPCHOBi.exe
  C:\Windows\System\FPCHOBi.exe
  2⤵
  PID:13812
- C:\Windows\System\WJhpqct.exe
  C:\Windows\System\WJhpqct.exe
  2⤵
  PID:13828
- C:\Windows\System\OpLaxlt.exe
  C:\Windows\System\OpLaxlt.exe
  2⤵
  PID:13852
- C:\Windows\System\VmtIuYw.exe
  C:\Windows\System\VmtIuYw.exe
  2⤵
  PID:13868
- C:\Windows\System\TiYkRmZ.exe
  C:\Windows\System\TiYkRmZ.exe
  2⤵
  PID:13884
- C:\Windows\System\PbJRHMc.exe
  C:\Windows\System\PbJRHMc.exe
  2⤵
  PID:13900
- C:\Windows\System\eRAVjxe.exe
  C:\Windows\System\eRAVjxe.exe
  2⤵
  PID:13916
- C:\Windows\System\qRFkyeM.exe
  C:\Windows\System\qRFkyeM.exe
  2⤵
  PID:13944
- C:\Windows\System\PliZyWf.exe
  C:\Windows\System\PliZyWf.exe
  2⤵
  PID:13972
- C:\Windows\System\aURRtAc.exe
  C:\Windows\System\aURRtAc.exe
  2⤵
  PID:14008
- C:\Windows\System\UgZemLx.exe
  C:\Windows\System\UgZemLx.exe
  2⤵
  PID:14032
- C:\Windows\System\qCTWwLF.exe
  C:\Windows\System\qCTWwLF.exe
  2⤵
  PID:14048
- C:\Windows\System\UumyuXI.exe
  C:\Windows\System\UumyuXI.exe
  2⤵
  PID:14080
- C:\Windows\System\BqGwLJX.exe
  C:\Windows\System\BqGwLJX.exe
  2⤵
  PID:14100
- C:\Windows\System\MIMJKnb.exe
  C:\Windows\System\MIMJKnb.exe
  2⤵
  PID:14124
- C:\Windows\System\gOExSfW.exe
  C:\Windows\System\gOExSfW.exe
  2⤵
  PID:14156
- C:\Windows\System\HXAMAkE.exe
  C:\Windows\System\HXAMAkE.exe
  2⤵
  PID:14176
- C:\Windows\System\cwRWhiy.exe
  C:\Windows\System\cwRWhiy.exe
  2⤵
  PID:2776
- C:\Windows\System\arERUnj.exe
  C:\Windows\System\arERUnj.exe
  2⤵
  PID:2620
- C:\Windows\System\cpbpIpO.exe
  C:\Windows\System\cpbpIpO.exe
  2⤵
  PID:4568
- C:\Windows\System\hKnYmOa.exe
  C:\Windows\System\hKnYmOa.exe
  2⤵
  PID:3744
- C:\Windows\System\WpFWMsR.exe
  C:\Windows\System\WpFWMsR.exe
  2⤵
  PID:13464
- C:\Windows\System\PQTftUY.exe
  C:\Windows\System\PQTftUY.exe
  2⤵
  PID:13488
- C:\Windows\System\MeyXIxt.exe
  C:\Windows\System\MeyXIxt.exe
  2⤵
  PID:13316
- C:\Windows\System\GvXhxRD.exe
  C:\Windows\System\GvXhxRD.exe
  2⤵
  PID:4180
- C:\Windows\System\ijUoFDz.exe
  C:\Windows\System\ijUoFDz.exe
  2⤵
  PID:13348
- C:\Windows\System\gnrSvpb.exe
  C:\Windows\System\gnrSvpb.exe
  2⤵
  PID:13364
- C:\Windows\System\BcWyQsc.exe
  C:\Windows\System\BcWyQsc.exe
  2⤵
  PID:13404
- C:\Windows\System\YMJyJRS.exe
  C:\Windows\System\YMJyJRS.exe
  2⤵
  PID:5076
- C:\Windows\System\VHGxXmq.exe
  C:\Windows\System\VHGxXmq.exe
  2⤵
  PID:13428
- C:\Windows\System\JHWxQBq.exe
  C:\Windows\System\JHWxQBq.exe
  2⤵
  PID:13460
- C:\Windows\System\kmubhmr.exe
  C:\Windows\System\kmubhmr.exe
  2⤵
  PID:3532
- C:\Windows\System\fzZiDSM.exe
  C:\Windows\System\fzZiDSM.exe
  2⤵
  PID:4584
- C:\Windows\System\XbbzaSa.exe
  C:\Windows\System\XbbzaSa.exe
  2⤵
  PID:5028
- C:\Windows\System\YzsiVew.exe
  C:\Windows\System\YzsiVew.exe
  2⤵
  PID:13524
- C:\Windows\System\aGoMTjv.exe
  C:\Windows\System\aGoMTjv.exe
  2⤵
  PID:13552
- C:\Windows\System\jpsgFTj.exe
  C:\Windows\System\jpsgFTj.exe
  2⤵
  PID:13572
- C:\Windows\System\UGWSXwo.exe
  C:\Windows\System\UGWSXwo.exe
  2⤵
  PID:13596
- C:\Windows\System\KzBuGDB.exe
  C:\Windows\System\KzBuGDB.exe
  2⤵
  PID:13620
- C:\Windows\System\kNzdhMc.exe
  C:\Windows\System\kNzdhMc.exe
  2⤵
  PID:13668
- C:\Windows\System\vydGtRm.exe
  C:\Windows\System\vydGtRm.exe
  2⤵
  PID:5196
- C:\Windows\System\AJISkwv.exe
  C:\Windows\System\AJISkwv.exe
  2⤵
  PID:3208
- C:\Windows\System\tFXuWNr.exe
  C:\Windows\System\tFXuWNr.exe
  2⤵
  PID:3452
- C:\Windows\System\DNGdBQE.exe
  C:\Windows\System\DNGdBQE.exe
  2⤵
  PID:3740
- C:\Windows\System\lzmgMHi.exe
  C:\Windows\System\lzmgMHi.exe
  2⤵
  PID:2352
- C:\Windows\System\dNhheor.exe
  C:\Windows\System\dNhheor.exe
  2⤵
  PID:5564
- C:\Windows\System\ejXhijl.exe
  C:\Windows\System\ejXhijl.exe
  2⤵
  PID:5156
- C:\Windows\System\QKxZpMZ.exe
  C:\Windows\System\QKxZpMZ.exe
  2⤵
  PID:5600
- C:\Windows\System\oWJeZLf.exe
  C:\Windows\System\oWJeZLf.exe
  2⤵
  PID:5604
- C:\Windows\System\FYjlluy.exe
  C:\Windows\System\FYjlluy.exe
  2⤵
  PID:5380
- C:\Windows\System\YYgUmWw.exe
  C:\Windows\System\YYgUmWw.exe
  2⤵
  PID:13924
- C:\Windows\System\lyMLOhS.exe
  C:\Windows\System\lyMLOhS.exe
  2⤵
  PID:5288
- C:\Windows\System\blaQNbD.exe
  C:\Windows\System\blaQNbD.exe
  2⤵
  PID:14020
- C:\Windows\System\gqcEeTL.exe
  C:\Windows\System\gqcEeTL.exe
  2⤵
  PID:14092
- C:\Windows\System\ujLWRQy.exe
  C:\Windows\System\ujLWRQy.exe
  2⤵
  PID:14148
- C:\Windows\System\kpSBXRP.exe
  C:\Windows\System\kpSBXRP.exe
  2⤵
  PID:14212
- C:\Windows\System\snrkYIS.exe
  C:\Windows\System\snrkYIS.exe
  2⤵
  PID:14184
- C:\Windows\System\pFivPCv.exe
  C:\Windows\System\pFivPCv.exe
  2⤵
  PID:2288
- C:\Windows\System\xLLKAdq.exe
  C:\Windows\System\xLLKAdq.exe
  2⤵
  PID:6000
- C:\Windows\System\zHTyfhq.exe
  C:\Windows\System\zHTyfhq.exe
  2⤵
  PID:3248
- C:\Windows\System\sBNSpZn.exe
  C:\Windows\System\sBNSpZn.exe
  2⤵
  PID:5020
- C:\Windows\System\xrNGAbB.exe
  C:\Windows\System\xrNGAbB.exe
  2⤵
  PID:5816
- C:\Windows\System\jaagNBf.exe
  C:\Windows\System\jaagNBf.exe
  2⤵
  PID:5828
- C:\Windows\System\WgKsRoU.exe
  C:\Windows\System\WgKsRoU.exe
  2⤵
  PID:1680
- C:\Windows\System\QyJruQe.exe
  C:\Windows\System\QyJruQe.exe
  2⤵
  PID:6024
- C:\Windows\System\dAjAWbb.exe
  C:\Windows\System\dAjAWbb.exe
  2⤵
  PID:6172
- C:\Windows\System\ZRhWnPU.exe
  C:\Windows\System\ZRhWnPU.exe
  2⤵
  PID:5876
- C:\Windows\System\ZIgjMHa.exe
  C:\Windows\System\ZIgjMHa.exe
  2⤵
  PID:13824
- C:\Windows\System\uniSKgc.exe
  C:\Windows\System\uniSKgc.exe
  2⤵
  PID:13564
- C:\Windows\System\dqJMmNN.exe
  C:\Windows\System\dqJMmNN.exe
  2⤵
  PID:13584
- C:\Windows\System\PKKGoWt.exe
  C:\Windows\System\PKKGoWt.exe
  2⤵
  PID:13696
- C:\Windows\System\bQHdbRB.exe
  C:\Windows\System\bQHdbRB.exe
  2⤵
  PID:13748
- C:\Windows\System\rWIIQek.exe
  C:\Windows\System\rWIIQek.exe
  2⤵
  PID:5524
- C:\Windows\System\snoQurI.exe
  C:\Windows\System\snoQurI.exe
  2⤵
  PID:4656
- C:\Windows\System\XBoNoOS.exe
  C:\Windows\System\XBoNoOS.exe
  2⤵
  PID:13960
- C:\Windows\System\llyyMqK.exe
  C:\Windows\System\llyyMqK.exe
  2⤵
  PID:13952
- C:\Windows\System\qeGlUES.exe
  C:\Windows\System\qeGlUES.exe
  2⤵
  PID:5548
- C:\Windows\System\AxctPkK.exe
  C:\Windows\System\AxctPkK.exe
  2⤵
  PID:6268
- C:\Windows\System\MaiURTL.exe
  C:\Windows\System\MaiURTL.exe
  2⤵
  PID:5304
- C:\Windows\System\oSGVWOC.exe
  C:\Windows\System\oSGVWOC.exe
  2⤵
  PID:13964
- C:\Windows\System\cpSbdTO.exe
  C:\Windows\System\cpSbdTO.exe
  2⤵
  PID:6260
- C:\Windows\System\xofEnPx.exe
  C:\Windows\System\xofEnPx.exe
  2⤵
  PID:6052
- C:\Windows\System\mVRWnYK.exe
  C:\Windows\System\mVRWnYK.exe
  2⤵
  PID:13988
- C:\Windows\System\IfcqmOF.exe
  C:\Windows\System\IfcqmOF.exe
  2⤵
  PID:3428
- C:\Windows\System\PNBBZPz.exe
  C:\Windows\System\PNBBZPz.exe
  2⤵
  PID:6064
- C:\Windows\System\zUBHcDm.exe
  C:\Windows\System\zUBHcDm.exe
  2⤵
  PID:4320
- C:\Windows\System\CVNVnFy.exe
  C:\Windows\System\CVNVnFy.exe
  2⤵
  PID:5780
- C:\Windows\System\chnnSsB.exe
  C:\Windows\System\chnnSsB.exe
  2⤵
  PID:13372
- C:\Windows\System\HTOwAcz.exe
  C:\Windows\System\HTOwAcz.exe
  2⤵
  PID:6420
- C:\Windows\System\qwfXgIq.exe
  C:\Windows\System\qwfXgIq.exe
  2⤵
  PID:6368
- C:\Windows\System\OcwyFxy.exe
  C:\Windows\System\OcwyFxy.exe
  2⤵
  PID:2092
- C:\Windows\System\SxbLlLM.exe
  C:\Windows\System\SxbLlLM.exe
  2⤵
  PID:4452
- C:\Windows\System\OYQfsqB.exe
  C:\Windows\System\OYQfsqB.exe
  2⤵
  PID:6840
- C:\Windows\System\GGkkrLL.exe
  C:\Windows\System\GGkkrLL.exe
  2⤵
  PID:7244
- C:\Windows\System\dwEClPP.exe
  C:\Windows\System\dwEClPP.exe
  2⤵
  PID:2648
- C:\Windows\System\ezJclYs.exe
  C:\Windows\System\ezJclYs.exe
  2⤵
  PID:5464
- C:\Windows\System\DEUOYli.exe
  C:\Windows\System\DEUOYli.exe
  2⤵
  PID:13580
- C:\Windows\System\HAVpMko.exe
  C:\Windows\System\HAVpMko.exe
  2⤵
  PID:2072
- C:\Windows\System\bePzBVc.exe
  C:\Windows\System\bePzBVc.exe
  2⤵
  PID:13788
- C:\Windows\System\nrIztFG.exe
  C:\Windows\System\nrIztFG.exe
  2⤵
  PID:5772
- C:\Windows\System\YHPhTGC.exe
  C:\Windows\System\YHPhTGC.exe
  2⤵
  PID:5788
- C:\Windows\System\RwIOWSu.exe
  C:\Windows\System\RwIOWSu.exe
  2⤵
  PID:13328
- C:\Windows\System\NscCEvn.exe
  C:\Windows\System\NscCEvn.exe
  2⤵
  PID:5624
- C:\Windows\System\sVwQKii.exe
  C:\Windows\System\sVwQKii.exe
  2⤵
  PID:13516
- C:\Windows\System\QnVKNeD.exe
  C:\Windows\System\QnVKNeD.exe
  2⤵
  PID:7544
- C:\Windows\System\EnAwVUU.exe
  C:\Windows\System\EnAwVUU.exe
  2⤵
  PID:5544
- C:\Windows\System\GoxdQfj.exe
  C:\Windows\System\GoxdQfj.exe
  2⤵
  PID:6864
- C:\Windows\System\wiaGeAH.exe
  C:\Windows\System\wiaGeAH.exe
  2⤵
  PID:7280
- C:\Windows\System\WhruhvR.exe
  C:\Windows\System\WhruhvR.exe
  2⤵
  PID:3364
- C:\Windows\System\wuwsQRj.exe
  C:\Windows\System\wuwsQRj.exe
  2⤵
  PID:7540
- C:\Windows\System\lGWmXvy.exe
  C:\Windows\System\lGWmXvy.exe
  2⤵
  PID:2716
- C:\Windows\System\VeJIrrv.exe
  C:\Windows\System\VeJIrrv.exe
  2⤵
  PID:14068
- C:\Windows\System\NZZmqCf.exe
  C:\Windows\System\NZZmqCf.exe
  2⤵
  PID:14112
- C:\Windows\System\IUdYqWZ.exe
  C:\Windows\System\IUdYqWZ.exe
  2⤵
  PID:7208
- C:\Windows\System\arwxGzb.exe
  C:\Windows\System\arwxGzb.exe
  2⤵
  PID:1804
- C:\Windows\System\NxJsAkG.exe
  C:\Windows\System\NxJsAkG.exe
  2⤵
  PID:7576
- C:\Windows\System\zsKLpNU.exe
  C:\Windows\System\zsKLpNU.exe
  2⤵
  PID:6244
- C:\Windows\System\qcYQTRY.exe
  C:\Windows\System\qcYQTRY.exe
  2⤵
  PID:7408
- C:\Windows\System\BaIVqtO.exe
  C:\Windows\System\BaIVqtO.exe
  2⤵
  PID:5556
- C:\Windows\System\hqKymOp.exe
  C:\Windows\System\hqKymOp.exe
  2⤵
  PID:8724
- C:\Windows\System\nZNhLhO.exe
  C:\Windows\System\nZNhLhO.exe
  2⤵
  PID:7236
- C:\Windows\System\qKMofrW.exe
  C:\Windows\System\qKMofrW.exe
  2⤵
  PID:5984
- C:\Windows\System\PNolKov.exe
  C:\Windows\System\PNolKov.exe
  2⤵
  PID:7392
- C:\Windows\System\RtuJxzS.exe
  C:\Windows\System\RtuJxzS.exe
  2⤵
  PID:9144
- C:\Windows\System\puTCqba.exe
  C:\Windows\System\puTCqba.exe
  2⤵
  PID:8580
- C:\Windows\System\GaVXjgT.exe
  C:\Windows\System\GaVXjgT.exe
  2⤵
  PID:5140
- C:\Windows\System\PdIimSg.exe
  C:\Windows\System\PdIimSg.exe
  2⤵
  PID:4356
- C:\Windows\System\QHvRzdC.exe
  C:\Windows\System\QHvRzdC.exe
  2⤵
  PID:8732
- C:\Windows\System\aixgQCd.exe
  C:\Windows\System\aixgQCd.exe
  2⤵
  PID:5808
- C:\Windows\System\vkboFME.exe
  C:\Windows\System\vkboFME.exe
  2⤵
  PID:8660
- C:\Windows\System\mrrlPDt.exe
  C:\Windows\System\mrrlPDt.exe
  2⤵
  PID:7400
- C:\Windows\System\JfljKRj.exe
  C:\Windows\System\JfljKRj.exe
  2⤵
  PID:8676
- C:\Windows\System\KowNRtD.exe
  C:\Windows\System\KowNRtD.exe
  2⤵
  PID:13344
- C:\Windows\System\vnLRlgB.exe
  C:\Windows\System\vnLRlgB.exe
  2⤵
  PID:7504
- C:\Windows\System\vfPeKQJ.exe
  C:\Windows\System\vfPeKQJ.exe
  2⤵
  PID:7204
- C:\Windows\System\vopAFIz.exe
  C:\Windows\System\vopAFIz.exe
  2⤵
  PID:7008
- C:\Windows\System\XXezQpC.exe
  C:\Windows\System\XXezQpC.exe
  2⤵
  PID:6828
- C:\Windows\System\qTbIpmB.exe
  C:\Windows\System\qTbIpmB.exe
  2⤵
  PID:6540
- C:\Windows\System\cfflkvR.exe
  C:\Windows\System\cfflkvR.exe
  2⤵
  PID:5260
- C:\Windows\System\xkhlzVQ.exe
  C:\Windows\System\xkhlzVQ.exe
  2⤵
  PID:8640
- C:\Windows\System\RijQGVZ.exe
  C:\Windows\System\RijQGVZ.exe
  2⤵
  PID:7572
- C:\Windows\System\ClilNWl.exe
  C:\Windows\System\ClilNWl.exe
  2⤵
  PID:7560
- C:\Windows\System\PedqqYl.exe
  C:\Windows\System\PedqqYl.exe
  2⤵
  PID:7508
- C:\Windows\System\OYWbiXx.exe
  C:\Windows\System\OYWbiXx.exe
  2⤵
  PID:5384
- C:\Windows\System\sWvMXBn.exe
  C:\Windows\System\sWvMXBn.exe
  2⤵
  PID:8320
- C:\Windows\System\CaclVoI.exe
  C:\Windows\System\CaclVoI.exe
  2⤵
  PID:8624
- C:\Windows\System\pbVtZoV.exe
  C:\Windows\System\pbVtZoV.exe
  2⤵
  PID:7548
- C:\Windows\System\fqVqmUQ.exe
  C:\Windows\System\fqVqmUQ.exe
  2⤵
  PID:8604
- C:\Windows\System\KmNCGTz.exe
  C:\Windows\System\KmNCGTz.exe
  2⤵
  PID:8712
- C:\Windows\System\GcQMLTo.exe
  C:\Windows\System\GcQMLTo.exe
  2⤵
  PID:6056
- C:\Windows\System\snirmFT.exe
  C:\Windows\System\snirmFT.exe
  2⤵
  PID:5972
- C:\Windows\System\aodnKAj.exe
  C:\Windows\System\aodnKAj.exe
  2⤵
  PID:13640
- C:\Windows\System\zXIywOC.exe
  C:\Windows\System\zXIywOC.exe
  2⤵
  PID:6112
- C:\Windows\System\yIwfQdS.exe
  C:\Windows\System\yIwfQdS.exe
  2⤵
  PID:8544
- C:\Windows\System\MKgUrBX.exe
  C:\Windows\System\MKgUrBX.exe
  2⤵
  PID:8600
- C:\Windows\System\Kzgwmba.exe
  C:\Windows\System\Kzgwmba.exe
  2⤵
  PID:6412
- C:\Windows\System\UpqyRiL.exe
  C:\Windows\System\UpqyRiL.exe
  2⤵
  PID:6576
- C:\Windows\System\GQqLoOx.exe
  C:\Windows\System\GQqLoOx.exe
  2⤵
  PID:7552
- C:\Windows\System\whomhEf.exe
  C:\Windows\System\whomhEf.exe
  2⤵
  PID:7464
- C:\Windows\System\YUewJBs.exe
  C:\Windows\System\YUewJBs.exe
  2⤵
  PID:544
- C:\Windows\System\zjDbLnS.exe
  C:\Windows\System\zjDbLnS.exe
  2⤵
  PID:14380
- C:\Windows\System\izdpaRp.exe
  C:\Windows\System\izdpaRp.exe
  2⤵
  PID:14412
- C:\Windows\System\uDiIPmy.exe
  C:\Windows\System\uDiIPmy.exe
  2⤵
  PID:14432
- C:\Windows\System\LXmbFZg.exe
  C:\Windows\System\LXmbFZg.exe
  2⤵
  PID:14448
- C:\Windows\System\NkVaLrn.exe
  C:\Windows\System\NkVaLrn.exe
  2⤵
  PID:14500
- C:\Windows\System\ahbfPtX.exe
  C:\Windows\System\ahbfPtX.exe
  2⤵
  PID:14608
- C:\Windows\System\HBoPudF.exe
  C:\Windows\System\HBoPudF.exe
  2⤵
  PID:14708
- C:\Windows\System\CDqkGkW.exe
  C:\Windows\System\CDqkGkW.exe
  2⤵
  PID:14748
- C:\Windows\System\pCvbwcN.exe
  C:\Windows\System\pCvbwcN.exe
  2⤵
  PID:14844
- C:\Windows\System\OgYIEaP.exe
  C:\Windows\System\OgYIEaP.exe
  2⤵
  PID:14860
- C:\Windows\System\IXfdFjE.exe
  C:\Windows\System\IXfdFjE.exe
  2⤵
  PID:14896
- C:\Windows\System\oDrpSmx.exe
  C:\Windows\System\oDrpSmx.exe
  2⤵
  PID:14956
- C:\Windows\System\DAyUYDm.exe
  C:\Windows\System\DAyUYDm.exe
  2⤵
  PID:14980
- C:\Windows\System\RxcffvO.exe
  C:\Windows\System\RxcffvO.exe
  2⤵
  PID:15088
- C:\Windows\System\RdZSrti.exe
  C:\Windows\System\RdZSrti.exe
  2⤵
  PID:15120
- C:\Windows\System\cMEJXoh.exe
  C:\Windows\System\cMEJXoh.exe
  2⤵
  PID:15292
- C:\Windows\System\YfpWRYY.exe
  C:\Windows\System\YfpWRYY.exe
  2⤵
  PID:15328
- C:\Windows\System\aaCNtZv.exe
  C:\Windows\System\aaCNtZv.exe
  2⤵
  PID:5496
- C:\Windows\System\fGWBSlk.exe
  C:\Windows\System\fGWBSlk.exe
  2⤵
  PID:7656
- C:\Windows\System\VzFYiRL.exe
  C:\Windows\System\VzFYiRL.exe
  2⤵
  PID:8716
- C:\Windows\System\hIcotWn.exe
  C:\Windows\System\hIcotWn.exe
  2⤵
  PID:14652
- C:\Windows\System\zzCzYMS.exe
  C:\Windows\System\zzCzYMS.exe
  2⤵
  PID:4428
- C:\Windows\System\gBMLcAq.exe
  C:\Windows\System\gBMLcAq.exe
  2⤵
  PID:9724
- C:\Windows\System\CbuBAqc.exe
  C:\Windows\System\CbuBAqc.exe
  2⤵
  PID:9568
- C:\Windows\System\venhurv.exe
  C:\Windows\System\venhurv.exe
  2⤵
  PID:6824
- C:\Windows\System\ezJFMHu.exe
  C:\Windows\System\ezJFMHu.exe
  2⤵
  PID:14684
- C:\Windows\System\GZspxIj.exe
  C:\Windows\System\GZspxIj.exe
  2⤵
  PID:14728
- C:\Windows\System\dVrsifh.exe
  C:\Windows\System\dVrsifh.exe
  2⤵
  PID:8268
- C:\Windows\System\AuwWOjD.exe
  C:\Windows\System\AuwWOjD.exe
  2⤵
  PID:14420
- C:\Windows\System\qtRocJB.exe
  C:\Windows\System\qtRocJB.exe
  2⤵
  PID:10460
- C:\Windows\System\owgdNyq.exe
  C:\Windows\System\owgdNyq.exe
  2⤵
  PID:7496
- C:\Windows\System\ANOivaG.exe
  C:\Windows\System\ANOivaG.exe
  2⤵
  PID:14388
- C:\Windows\System\QKOUXbf.exe
  C:\Windows\System\QKOUXbf.exe
  2⤵
  PID:10092
- C:\Windows\System\xQIEFXZ.exe
  C:\Windows\System\xQIEFXZ.exe
  2⤵
  PID:8740
- C:\Windows\System\dkfMXtm.exe
  C:\Windows\System\dkfMXtm.exe
  2⤵
  PID:15288
- C:\Windows\System\MErdgIt.exe
  C:\Windows\System\MErdgIt.exe
  2⤵
  PID:9284
- C:\Windows\System\AaImwWS.exe
  C:\Windows\System\AaImwWS.exe
  2⤵
  PID:5648
- C:\Windows\System\HpjWFqt.exe
  C:\Windows\System\HpjWFqt.exe
  2⤵
  PID:15000
- C:\Windows\System\YnPVmiS.exe
  C:\Windows\System\YnPVmiS.exe
  2⤵
  PID:8796
- C:\Windows\System\kMFPJbd.exe
  C:\Windows\System\kMFPJbd.exe
  2⤵
  PID:7780
- C:\Windows\System\hnuGORd.exe
  C:\Windows\System\hnuGORd.exe
  2⤵
  PID:10852
- C:\Windows\System\EKYfyyL.exe
  C:\Windows\System\EKYfyyL.exe
  2⤵
  PID:14720
- C:\Windows\System\dqiMMZE.exe
  C:\Windows\System\dqiMMZE.exe
  2⤵
  PID:7532
- C:\Windows\System\DldCMoI.exe
  C:\Windows\System\DldCMoI.exe
  2⤵
  PID:9328
- C:\Windows\System\eocfTEA.exe
  C:\Windows\System\eocfTEA.exe
  2⤵
  PID:10484
- C:\Windows\System\LkUWFIr.exe
  C:\Windows\System\LkUWFIr.exe
  2⤵
  PID:9996
- C:\Windows\System\hdbolkX.exe
  C:\Windows\System\hdbolkX.exe
  2⤵
  PID:13932
- C:\Windows\System\AriBHpf.exe
  C:\Windows\System\AriBHpf.exe
  2⤵
  PID:6608
- C:\Windows\System\ntGeBdq.exe
  C:\Windows\System\ntGeBdq.exe
  2⤵
  PID:8684
- C:\Windows\System\epYNHlN.exe
  C:\Windows\System\epYNHlN.exe
  2⤵
  PID:15116
- C:\Windows\System\OblYjwy.exe
  C:\Windows\System\OblYjwy.exe
  2⤵
  PID:14688
- C:\Windows\System\iXxPGfq.exe
  C:\Windows\System\iXxPGfq.exe
  2⤵
  PID:4388
- C:\Windows\System\pgAaXcs.exe
  C:\Windows\System\pgAaXcs.exe
  2⤵
  PID:7256
- C:\Windows\System\USqSAOQ.exe
  C:\Windows\System\USqSAOQ.exe
  2⤵
  PID:8644
- C:\Windows\System\ZjfVvNb.exe
  C:\Windows\System\ZjfVvNb.exe
  2⤵
  PID:10444
- C:\Windows\System\vtxdVEg.exe
  C:\Windows\System\vtxdVEg.exe
  2⤵
  PID:9120
- C:\Windows\System\tYkXWcV.exe
  C:\Windows\System\tYkXWcV.exe
  2⤵
  PID:14564
- C:\Windows\System\WlnWduo.exe
  C:\Windows\System\WlnWduo.exe
  2⤵
  PID:14920
- C:\Windows\System\krsVJOc.exe
  C:\Windows\System\krsVJOc.exe
  2⤵
  PID:15024
- C:\Windows\System\CLQfLhO.exe
  C:\Windows\System\CLQfLhO.exe
  2⤵
  PID:15356
- C:\Windows\System\KhBsQva.exe
  C:\Windows\System\KhBsQva.exe
  2⤵
  PID:10900
- C:\Windows\System\FLXEjTH.exe
  C:\Windows\System\FLXEjTH.exe
  2⤵
  PID:15140
- C:\Windows\System\qYpdbVq.exe
  C:\Windows\System\qYpdbVq.exe
  2⤵
  PID:10264
- C:\Windows\System\tKPOQRf.exe
  C:\Windows\System\tKPOQRf.exe
  2⤵
  PID:11024
- C:\Windows\System\fuBxpfM.exe
  C:\Windows\System\fuBxpfM.exe
  2⤵
  PID:10948
- C:\Windows\System\tavNBGF.exe
  C:\Windows\System\tavNBGF.exe
  2⤵
  PID:10816
- C:\Windows\System\VQKxSwq.exe
  C:\Windows\System\VQKxSwq.exe
  2⤵
  PID:10432
- C:\Windows\System\dLZyRNh.exe
  C:\Windows\System\dLZyRNh.exe
  2⤵
  PID:10776
- C:\Windows\System\pDRJPET.exe
  C:\Windows\System\pDRJPET.exe
  2⤵
  PID:15276
- C:\Windows\System\atrpwUi.exe
  C:\Windows\System\atrpwUi.exe
  2⤵
  PID:9208
- C:\Windows\System\eTiUSAj.exe
  C:\Windows\System\eTiUSAj.exe
  2⤵
  PID:14952
- C:\Windows\System\DzFhCiK.exe
  C:\Windows\System\DzFhCiK.exe
  2⤵
  PID:14640
- C:\Windows\System\IPpoiXn.exe
  C:\Windows\System\IPpoiXn.exe
  2⤵
  PID:10488
- C:\Windows\System\aqFugYx.exe
  C:\Windows\System\aqFugYx.exe
  2⤵
  PID:8688
- C:\Windows\System\hLZScNi.exe
  C:\Windows\System\hLZScNi.exe
  2⤵
  PID:10684
- C:\Windows\System\moVvySN.exe
  C:\Windows\System\moVvySN.exe
  2⤵
  PID:9164
- C:\Windows\System\MxFusXE.exe
  C:\Windows\System\MxFusXE.exe
  2⤵
  PID:10256
- C:\Windows\System\DRbKLIj.exe
  C:\Windows\System\DRbKLIj.exe
  2⤵
  PID:15312
- C:\Windows\System\oOwFpYb.exe
  C:\Windows\System\oOwFpYb.exe
  2⤵
  PID:7092
- C:\Windows\System\jwiVmhc.exe
  C:\Windows\System\jwiVmhc.exe
  2⤵
  PID:14356
- C:\Windows\System\SiYwDnv.exe
  C:\Windows\System\SiYwDnv.exe
  2⤵
  PID:10620
- C:\Windows\System\ieMLBQm.exe
  C:\Windows\System\ieMLBQm.exe
  2⤵
  PID:13860
- C:\Windows\System\bIzKTxo.exe
  C:\Windows\System\bIzKTxo.exe
  2⤵
  PID:7876
- C:\Windows\System\aWvzVQa.exe
  C:\Windows\System\aWvzVQa.exe
  2⤵
  PID:14616
- C:\Windows\System\EDNYQYl.exe
  C:\Windows\System\EDNYQYl.exe
  2⤵
  PID:10100
- C:\Windows\System\NhiHwVs.exe
  C:\Windows\System\NhiHwVs.exe
  2⤵
  PID:15008
- C:\Windows\System\rDwAZHd.exe
  C:\Windows\System\rDwAZHd.exe
  2⤵
  PID:10764
- C:\Windows\System\mVGQAVB.exe
  C:\Windows\System\mVGQAVB.exe
  2⤵
  PID:15172
- C:\Windows\System\DvoUkTr.exe
  C:\Windows\System\DvoUkTr.exe
  2⤵
  PID:11972
- C:\Windows\System\RbRjfrQ.exe
  C:\Windows\System\RbRjfrQ.exe
  2⤵
  PID:10796
- C:\Windows\System\cvkdcsr.exe
  C:\Windows\System\cvkdcsr.exe
  2⤵
  PID:11108
- C:\Windows\System\hKtOhNf.exe
  C:\Windows\System\hKtOhNf.exe
  2⤵
  PID:10820
- C:\Windows\System\eUVDOry.exe
  C:\Windows\System\eUVDOry.exe
  2⤵
  PID:12896
- C:\Windows\System\sIZSzeJ.exe
  C:\Windows\System\sIZSzeJ.exe
  2⤵
  PID:14924
- C:\Windows\System\sRCXTKu.exe
  C:\Windows\System\sRCXTKu.exe
  2⤵
  PID:10224
- C:\Windows\System\CYyERgY.exe
  C:\Windows\System\CYyERgY.exe
  2⤵
  PID:13100
- C:\Windows\System\OzIepWQ.exe
  C:\Windows\System\OzIepWQ.exe
  2⤵
  PID:9948
- C:\Windows\System\kWmABIy.exe
  C:\Windows\System\kWmABIy.exe
  2⤵
  PID:15036
- C:\Windows\System\UufJpNt.exe
  C:\Windows\System\UufJpNt.exe
  2⤵
  PID:10368
- C:\Windows\System\FRxMwAr.exe
  C:\Windows\System\FRxMwAr.exe
  2⤵
  PID:11508
- C:\Windows\System\wMECZaW.exe
  C:\Windows\System\wMECZaW.exe
  2⤵
  PID:9504
- C:\Windows\System\oDCjNGL.exe
  C:\Windows\System\oDCjNGL.exe
  2⤵
  PID:15068
- C:\Windows\System\KmnipjU.exe
  C:\Windows\System\KmnipjU.exe
  2⤵
  PID:11628
- C:\Windows\System\ToqQcBg.exe
  C:\Windows\System\ToqQcBg.exe
  2⤵
  PID:9336
- C:\Windows\System\GHesfDF.exe
  C:\Windows\System\GHesfDF.exe
  2⤵
  PID:14428
- C:\Windows\System\suWofqZ.exe
  C:\Windows\System\suWofqZ.exe
  2⤵
  PID:14508
- C:\Windows\System\geCsViP.exe
  C:\Windows\System\geCsViP.exe
  2⤵
  PID:14968
- C:\Windows\System\TYiJpSa.exe
  C:\Windows\System\TYiJpSa.exe
  2⤵
  PID:14788
- C:\Windows\System\APRtCpW.exe
  C:\Windows\System\APRtCpW.exe
  2⤵
  PID:14856
- C:\Windows\System\dzFpxcr.exe
  C:\Windows\System\dzFpxcr.exe
  2⤵
  PID:10768
- C:\Windows\System\MkVGEOh.exe
  C:\Windows\System\MkVGEOh.exe
  2⤵
  PID:8808
- C:\Windows\System\cPyYDct.exe
  C:\Windows\System\cPyYDct.exe
  2⤵
  PID:11940
- C:\Windows\System\moBaMro.exe
  C:\Windows\System\moBaMro.exe
  2⤵
  PID:14464
- C:\Windows\System\VZPCCFV.exe
  C:\Windows\System\VZPCCFV.exe
  2⤵
  PID:13072
- C:\Windows\System\zKoiEGz.exe
  C:\Windows\System\zKoiEGz.exe
  2⤵
  PID:14488
- C:\Windows\System\mimIboR.exe
  C:\Windows\System\mimIboR.exe
  2⤵
  PID:10700
- C:\Windows\System\VOFYwEE.exe
  C:\Windows\System\VOFYwEE.exe
  2⤵
  PID:12308
- C:\Windows\System\vEullYh.exe
  C:\Windows\System\vEullYh.exe
  2⤵
  PID:10064
- C:\Windows\System\zqxHoyM.exe
  C:\Windows\System\zqxHoyM.exe
  2⤵
  PID:11116
- C:\Windows\System\jVMqXXG.exe
  C:\Windows\System\jVMqXXG.exe
  2⤵
  PID:15100
- C:\Windows\System\BfTkSdG.exe
  C:\Windows\System\BfTkSdG.exe
  2⤵
  PID:14948
- C:\Windows\System\bjaCOAK.exe
  C:\Windows\System\bjaCOAK.exe
  2⤵
  PID:11568
- C:\Windows\System\brrrVRH.exe
  C:\Windows\System\brrrVRH.exe
  2⤵
  PID:14628
- C:\Windows\System\UAxIqEw.exe
  C:\Windows\System\UAxIqEw.exe
  2⤵
  PID:9000
- C:\Windows\System\OHpxwHR.exe
  C:\Windows\System\OHpxwHR.exe
  2⤵
  PID:9700
- C:\Windows\System\zyGMPaH.exe
  C:\Windows\System\zyGMPaH.exe
  2⤵
  PID:7524
- C:\Windows\System\BKTXHyq.exe
  C:\Windows\System\BKTXHyq.exe
  2⤵
  PID:10640
- C:\Windows\System\XGVoPYG.exe
  C:\Windows\System\XGVoPYG.exe
  2⤵
  PID:11504
- C:\Windows\System\daCQqzF.exe
  C:\Windows\System\daCQqzF.exe
  2⤵
  PID:14816
- C:\Windows\System\azRGCVf.exe
  C:\Windows\System\azRGCVf.exe
  2⤵
  PID:9268
- C:\Windows\System\TasqtPD.exe
  C:\Windows\System\TasqtPD.exe
  2⤵
  PID:14876
- C:\Windows\System\xrRMyiR.exe
  C:\Windows\System\xrRMyiR.exe
  2⤵
  PID:6544
- C:\Windows\System\mEMoliH.exe
  C:\Windows\System\mEMoliH.exe
  2⤵
  PID:8332
- C:\Windows\System\sqikckf.exe
  C:\Windows\System\sqikckf.exe
  2⤵
  PID:10124
- C:\Windows\System\YDNAZTK.exe
  C:\Windows\System\YDNAZTK.exe
  2⤵
  PID:12008
- C:\Windows\System\NMaCcXD.exe
  C:\Windows\System\NMaCcXD.exe
  2⤵
  PID:11032
- C:\Windows\System\cRGNILK.exe
  C:\Windows\System\cRGNILK.exe
  2⤵
  PID:10988
- C:\Windows\System\ENFIqdr.exe
  C:\Windows\System\ENFIqdr.exe
  2⤵
  PID:12116
- C:\Windows\System\sQHkzgM.exe
  C:\Windows\System\sQHkzgM.exe
  2⤵
  PID:11632
- C:\Windows\System\YitKWLf.exe
  C:\Windows\System\YitKWLf.exe
  2⤵
  PID:15268
- C:\Windows\System\KaronpB.exe
  C:\Windows\System\KaronpB.exe
  2⤵
  PID:12744
- C:\Windows\System\sNAaaqU.exe
  C:\Windows\System\sNAaaqU.exe
  2⤵
  PID:10836
- C:\Windows\System\rtLXCRw.exe
  C:\Windows\System\rtLXCRw.exe
  2⤵
  PID:14540
- C:\Windows\System\DQgZPzp.exe
  C:\Windows\System\DQgZPzp.exe
  2⤵
  PID:8288
- C:\Windows\System\IUbPgCY.exe
  C:\Windows\System\IUbPgCY.exe
  2⤵
  PID:15168
- C:\Windows\System\pWYKeKi.exe
  C:\Windows\System\pWYKeKi.exe
  2⤵
  PID:10420
- C:\Windows\System\xIBMvWo.exe
  C:\Windows\System\xIBMvWo.exe
  2⤵
  PID:11752
- C:\Windows\System\rUDtDAW.exe
  C:\Windows\System\rUDtDAW.exe
  2⤵
  PID:12884
- C:\Windows\System\DTVLdrj.exe
  C:\Windows\System\DTVLdrj.exe
  2⤵
  PID:11192
- C:\Windows\System\dNFUyoO.exe
  C:\Windows\System\dNFUyoO.exe
  2⤵
  PID:9716
- C:\Windows\System\aBYUDGW.exe
  C:\Windows\System\aBYUDGW.exe
  2⤵
  PID:10716
- C:\Windows\System\HPIcKZb.exe
  C:\Windows\System\HPIcKZb.exe
  2⤵
  PID:9056
- C:\Windows\System\VuSFtiF.exe
  C:\Windows\System\VuSFtiF.exe
  2⤵
  PID:3316
- C:\Windows\System\FcSyXNZ.exe
  C:\Windows\System\FcSyXNZ.exe
  2⤵
  PID:10812
- C:\Windows\System\wILRlRm.exe
  C:\Windows\System\wILRlRm.exe
  2⤵
  PID:10660
- C:\Windows\System\JquqvDv.exe
  C:\Windows\System\JquqvDv.exe
  2⤵
  PID:10020
- C:\Windows\System\xWvlTNz.exe
  C:\Windows\System\xWvlTNz.exe
  2⤵
  PID:11348
- C:\Windows\System\GXuWTir.exe
  C:\Windows\System\GXuWTir.exe
  2⤵
  PID:8068
- C:\Windows\System\KvnGQki.exe
  C:\Windows\System\KvnGQki.exe
  2⤵
  PID:11164
- C:\Windows\System\BSHVmSY.exe
  C:\Windows\System\BSHVmSY.exe
  2⤵
  PID:11168
- C:\Windows\System\lJnbnka.exe
  C:\Windows\System\lJnbnka.exe
  2⤵
  PID:11420

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_swwqgd2b.34q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AEGuUjj.exe

Filesize
1.7MB

MD5
9e29cfee4e6dceb8821534be3cd21365

SHA1
e428891608bab005423707bb49cb13f588e3b133

SHA256
47a1fba241965d844456b2eab207b6983fccdea47714570cee91fa1637b59e7e

SHA512
ce01de2aafd9dc5c9e361cb50d449010639fe7fdb6a2bcbcffa184c260974a01750aa5c11262726762cf1ff11387de6598c1875a8699c0894e9a8d828875c021

Download Submit
C:\Windows\System\ALKSQgl.exe

Filesize
1.7MB

MD5
f84cce67aac76322bd6431c9732f84f6

SHA1
44e842cc144f08ac131d2d65d44c7367f8235429

SHA256
c7b592376ebc37c470be5af0ccfe4e441bc26d35868447cd9117c3097c2e0746

SHA512
fc578e11ea633d1ce5de2a152200aec54b2e5af538c3bf3807c9d03a7da545f1e92f8fb2d971056798eb874bbaa06572d178b38de93ca7aa0d9aaf1c20debff6

Download Submit
C:\Windows\System\AUDiaEv.exe

Filesize
1.7MB

MD5
c99df5daebeb6316b2696b1a94b01e3c

SHA1
58ae83817fdcb18c52f391e01518e3ffae6e04fb

SHA256
ece8e77d24320306405335361c703b9c877e39e408ba3d30899e02ffcd1c55bc

SHA512
47a31440415bc6121a5b35ef3505cd479c2fafc9b22e6c7ef61655367f8f6d851f88dc3cdc1c67ff2d75d78aa91298c377915f78226795a6b29a0dfb120f97e5

Download Submit
C:\Windows\System\CUANbjx.exe

Filesize
1.7MB

MD5
3f0659f76afe40c26d16eeca1ed4efaf

SHA1
9ad8d9bb9c96646aefae28552636d255fa3782e1

SHA256
2dd3e214119db9cb800e906fddd0cca1ce7d3572fe33f489b5860b183c798db8

SHA512
e3206c201d5cc6f4ce859fdb8d47c5370ea6f7a75fbcbf5680fdc7cf63ac4072490f206d882af9d8806d90d767a64a68ccff3303beeb2d9a81478ea7f5bc7713

Download Submit
C:\Windows\System\CtUsRjy.exe

Filesize
1.7MB

MD5
a69fe8023be73fe69508c12248e18e38

SHA1
5f0710f98128e14645b5bb26f08ab247e3a18e83

SHA256
71eac729d460a9ae66b83274ae683f3e4e42ad2e158935146d5a096cf9191289

SHA512
8bf4a3f4c52ca038469468362cb6dfec2e4e9fa53e4633f018e334b9b3bba7d224ce024d711e31430427966a6dbc5ac107e46181c39669450504611c20cfa3ea

Download Submit
C:\Windows\System\FuaxBaC.exe

Filesize
1.7MB

MD5
ecd49b244c79b9202b5d26293bcae6e3

SHA1
efb21242010439e3cf6d6844db0d0bdf62603bdd

SHA256
757a50b18688f4e347dfb763777635cd77d9170449396961a8f4520ae39b57a2

SHA512
1898db11e488ad83a08f6d9991f9a8451fc5f039e34830c134eec1ce02a5f68776a4be9fc3e50d86d1ff527dc8326ec621d5e27d28f986b0c32ffbf29635c9fd

Download Submit
C:\Windows\System\GTcDLqV.exe

Filesize
8B

MD5
2a5b21c9ce5908a8e8aacaf062e645c4

SHA1
6ed2c2c77297cd4695dcc9d6208deeeb31d24824

SHA256
a721f6a5dca6138e84731d10e06c140895f51186e02918e0cadadb4e634901ad

SHA512
f2af0758abf4f00fc332d8ce06abbb9dcf8e7a47126d054bb8023a0729fca612ed556c44a07f30396655d6914375cae3ffbece215e1944233fc94018eb86d3a1

Download Submit
C:\Windows\System\IPbnwnf.exe

Filesize
1.7MB

MD5
f0ec97fb3289e5b4f613bc91d248b681

SHA1
9c7c5b1f9297d4cdbd07fe1bfd6c20c9ff470a99

SHA256
1817ddaae16448c72ff1f53f5d51e7fa972c9e214fce66c04d1ed13a781145f4

SHA512
1d9f47b85608738fa6e07c1e356bd6073657715ed482dc5ed6376bea2a1797ab6f02653b8a4b75d7eea811520e9de6a0de14922873956453275727eeeba5bd58

Download Submit
C:\Windows\System\IPjPdsv.exe

Filesize
1.7MB

MD5
4f13baf11cce16650445153adf647748

SHA1
835506e31780cdb1f7b900a80801853db437e272

SHA256
acdb9d82e19abd4c6360bb1e74e93b31e07bb13177d933d318301dbe97b47a6e

SHA512
f0a105b2f5f49844532205d8bbb5fa810d9551dd13c4bf053dd9fc07e421d0a29a232f4ee1c9a7f62732c8c1efcbb897f1724646de88c3caa8216844ac021270

Download Submit
C:\Windows\System\JQZURNy.exe

Filesize
1.7MB

MD5
db0019c86181570c1385ad8ffa41d481

SHA1
ecd3e305aab5a972ad1e104f14f02a23de258586

SHA256
713a0c711feedd283865684365661f1907923431a6237e6cf45280c48d887ede

SHA512
c3abab616a446fd9a038fb02ba2a1613b608ce1ad5f57638408b543cafb63b0c867f1616a786ac161c7d9d3a63bef2558c702b5e05a117b4e69ac4d047b5c849

Download Submit
C:\Windows\System\KIzmlws.exe

Filesize
1.7MB

MD5
7dc7e0dc585674e1c1073ab7556dabaa

SHA1
5a17f063218d7600c5d37a72e718a6ca7aaab11f

SHA256
18dfad6c4fb5fd296e2fa4faa6a1ca35ada1da19a42df7d9c0bcce2bdd1e3316

SHA512
ff2f09354e7cb7a7b0b0f98df385a778c6cb12b20e72c381431f4b3d87293cc0c496a73a9c00930ee839c3fb9df9e5b1a2aef8f83f3a0a6cbcbc7afbef6aee51

Download Submit
C:\Windows\System\LEHPUvh.exe

Filesize
1.7MB

MD5
f4ddce35e21e70a874527fe2cdb7621b

SHA1
75fa3c5cf18a1869571cde152c3a935c7434c2be

SHA256
a273d87ba917123ac657425c21a45bbaa81ac355fa516e03e7aa2be4af4b9f85

SHA512
9ab1097ce7df8bd697cc20b7e1f9d45ccb45b8b7e1b1e193e20adc4c567fe77f9f8e136dc17caaa1cde035a86fae8d7fb310da22400e9312c06f5dd09096ca49

Download Submit
C:\Windows\System\LqwUXzj.exe

Filesize
1.7MB

MD5
9da332e4ee5b3c7484f8409c272309e8

SHA1
3ba92141b7499c9f8220f71fc5710517044706bb

SHA256
1bea6db68f9133bd1511fd5d3a7862f4359c7c621dc5f27cdef9c978ff76b96c

SHA512
e837120dfc0fdfde841a91943ab4891896dcc73ec981e86124a52a07561a85a857da32800c420ec066fda487ade5881ce33c1d6bb13f786ada3e094684d88214

Download Submit
C:\Windows\System\LwHKKea.exe

Filesize
1.7MB

MD5
33ff0b65cdffe183f6f86a88dc1e1d5f

SHA1
04d3be1692526a2164111735f2213acc6e88cebd

SHA256
cb77d3ffcda0856b68c36bf675720dd8b7d4ea192eb4041e7052a0b8a07f52db

SHA512
4e50f6b3dd21ea21bdda82164fb78cc26748610640093fa62012c11818f54fe883a1fd06c67eb162dece282835d50315602d971ab0e4cab05de125ada32cb032

Download Submit
C:\Windows\System\MMCVWlY.exe

Filesize
1.7MB

MD5
086bc491100dd59ef6f948720a1f3bda

SHA1
be77e34472782cf5745912b4458124e3c6f5718e

SHA256
da6aaac3f1d40db7e47cc1fb78fdad3b9f97cc96753dad9105bebb01e2a60754

SHA512
7a6c2e7cc11b5930f25a4bbf9f82b3534aff622e42e52fe3c7c7f79bcda055236c4796a7ca4aeb4c4acfce4602405bbf24d5d8bbb6fcbcbbf224f1410d95225e

Download Submit
C:\Windows\System\OeCLCcb.exe

Filesize
1.7MB

MD5
080595dedbf403b7232f45883df107b2

SHA1
0e79d6204fa9cfc2016a268513b8e6f6ea5a59bd

SHA256
f2d2ce3164a706cfdc2d94de242d047cd91b4e1e0e49b989a66f3416725e2831

SHA512
71594d4334968ee902a33b2de89e75155dc9a44a476620d05495cfc0d765edc5d4c0cde7aa877389777bb1ad20d7e8439b5b9519f9f0c612cd4b09411a3fa68b

Download Submit
C:\Windows\System\PDGOyJy.exe

Filesize
1.7MB

MD5
827240a03bb1650564321d1968b44cca

SHA1
a307644e95736e602b0a0343ab100a167060bf99

SHA256
ede145919cd90588b708f3af39e424b248e89c07c62f1c46eab029c8c3a926f9

SHA512
579e40e40277dbabfccd0d4af269a056ead4f6e562fbcb39051e6b7dc3ba1b08fe228119508d2b1705ed2deb591eaa5980a3a79c64278f47ecb0db027f8d05bf

Download Submit
C:\Windows\System\RqOogzL.exe

Filesize
1.7MB

MD5
7de3207596bc2c6ad3159c40fa977d15

SHA1
58e8eccbe2d3aab7aefc65f868a6f04cb2fd3f03

SHA256
56bfecad502ca2ae56a9c7c317f42857a507e8b9f4f3ceaadb50b3b7bd833552

SHA512
0a530f9d2d5dd0c64d089e4910b9a8ceba816096709139f0e76d1ad4286e5682216ce6cd081bb885508dc56ad75c06319de0bf944966b075d98cd46f585d0919

Download Submit
C:\Windows\System\VUbjVVI.exe

Filesize
1.7MB

MD5
fd7fbdaae8c3220954b3fa849ae53d3a

SHA1
943864bc5bb0f594b2916e7afdc57351b268e717

SHA256
d8973650b62e542ca93639f60eac48b8055741dfd549eb4608a014245f959a33

SHA512
2b6a83d1dfa5d76765e64abda00f17586af8765b31ffd440b4e5d002ea994ca38674bc615e4f6426c372702e4c636105fef1a1831e9648e42e73cb770f792690

Download Submit
C:\Windows\System\XBcWMKk.exe

Filesize
1.7MB

MD5
d26817d8abcb72b3699c0077dbbc502c

SHA1
537c3838b1e754b4d1594e92ceb199a3fab68a57

SHA256
9fac8103548b71fed3d7b828c788d18f05dd6666fdf7527c036c4a22e6404982

SHA512
2f4a288b1042fb69499b33434ff7b3e4529a61939c0fa9d2d5663088061a9edea90fbc9be270f0791e8406e3d4cea15dbd191408a95e24ba59cf7d001a56556b

Download Submit
C:\Windows\System\XgFnQOw.exe

Filesize
1.7MB

MD5
af6b4356b6c80ce318da883aa17d4cde

SHA1
3661efa7efb01e5762c2e3b2965417740b1e9e05

SHA256
fadc88f71ceafa60fc0c4478b258cad81b5e187c82a333c6f9422edc178e074e

SHA512
069ab7f81114baefff077ebe15f4cd967e84657c5448eb024b7a123950b09c7f4d4071c39b51ed65a9c6a58998aec390a8d31def313f081794ee32b5e587ffc0

Download Submit
C:\Windows\System\ZXGDEal.exe

Filesize
1.7MB

MD5
8f46d0bbb1a25ec4dadb8feb414f72a7

SHA1
1347c4ddb62d8b8c27ce3fafc4a77abacbd4908f

SHA256
e727f26a053933b99a43920c4a2d1416ae1715d27ac567564ab81b3241b00584

SHA512
b933dc655a0684f831a6a760c7a7c1e698cb22dd3f6cb93c93b252b4af9479b85ac3134a4bd8a813326d58abe55e5911425f645ee8ce520cfcfa9d0115461dab

Download Submit
C:\Windows\System\ZiSSipv.exe

Filesize
1.7MB

MD5
87c68fa732b287176ecb4ae42d95bd0d

SHA1
3295c0df30fad74f07535242ee776740cbed22b3

SHA256
cd02c82eddb6ab3f25b806d75d62b68c2982a6cd14508538b65fc945a338e543

SHA512
60721d911ed0914145705e2c19973e6a50308d8044488b364588c989be39fcadf94be30a0ddabba86977b5934424e99fca305e78da22f40949e7dbd6fc6d3f93

Download Submit
C:\Windows\System\btCvqMR.exe

Filesize
1.7MB

MD5
e3557fcca01db1ef4c8f8dc38dc8fe7f

SHA1
5b25ae56f986cf5b031818d2d57f516a131d3797

SHA256
7022642f098ebb8269c2ce7290fcd056a5286aa065cf28f9e49b64ce31c41ce6

SHA512
21baf0a5313bae43255accb23009b15d9b9ee2f70e27670c305699039f15cba46d33caec9c003ba33c4f3fa7b76c8240bf1d9c2a3108394eefe9f208759308f9

Download Submit
C:\Windows\System\eBLCucA.exe

Filesize
1.7MB

MD5
4510d8e3665ee822cc745b0a6b910cea

SHA1
0cf72f0d0341c279e08fbd843b7cce7a070a3d9b

SHA256
0db112dfe984702dd88ae70ff524af66d4315a2430f834acabd3838903f3ba7e

SHA512
2291651738aca18b01a4ed2faa7565c8c42fd53949b0d3b2724666f9dc4d1c55d69c1989f6dd4f4c245f6f1d769ce8bde50086e87338832bcc03fc84d11b2b65

Download Submit
C:\Windows\System\eWADRwc.exe

Filesize
1.7MB

MD5
7e4e28f09000dd8644d338b4275042d2

SHA1
bbc5fb1be143cc8d09faf57f6c88aa71516ee219

SHA256
a2604c0eb405dfe9de29f3ad7055a9ca083b690a2da798cbd47b6f292f4b9b76

SHA512
b587d87b7babea3b5d46d56acd524fb33bb9967d37b6f52dc74d4e770c6c5bcedb2ad071299f70c6ac7726e5738751a6b8ffbe537b2467224b343536755591b7

Download Submit
C:\Windows\System\fRHFTUu.exe

Filesize
1.7MB

MD5
1e7862a6fe832912c771bc3082082c93

SHA1
7c41fefcb00b9df8d51df3c75703dbeb3166349e

SHA256
685f78ce3baca781cfea8b7f49ed625fbdb451204c4c78a650bd776c03103453

SHA512
9faff710bed7aceceaff658e7fd3ebe05eadfeffc665d1e09a8b5e74b6e718e6820f1251d4270618721fff3d2ba298e669fe4888263adde5a923ed18610399bc

Download Submit
C:\Windows\System\hRBfplb.exe

Filesize
1.7MB

MD5
7e397e877364e5bfc382b5c76e3fc687

SHA1
8dc3a14bfaa069a0a059cdf0973c9eff5d1b3a22

SHA256
d5ad98090f8fca945cc780b3d323f2f6a14f45101e8da35209afce6707e6824b

SHA512
033204289aa9cab6c0aa0a712dc504dd77ec9a139d973a29bbed8cbf1464f3e1bb3bfc332d2183ca0a5e506fa788dbd729bf9243377b2c93cb090e4a9d5902dc

Download Submit
C:\Windows\System\hSEPyer.exe

Filesize
1.7MB

MD5
53d6cca34db79cb95c4f5e482b51526a

SHA1
4f13e6956b564df3c6f1bb908133e4d22256e1a1

SHA256
5855b063940ef4103930c61cedc5e4064bd83549829db012c1ccd87ca3787214

SHA512
b09c404f48d30a55886a1631a4602dad6c2d9e726e3287c7f89671baa8180c85d0c6093be62d66af880bfe366568e38047847b796c0e2bc48a4809a85cf3396c

Download Submit
C:\Windows\System\iRDJDbT.exe

Filesize
1.7MB

MD5
0fb5b75c3306f7ec6a660e22d2e2df3d

SHA1
7dc159a729c2c85f91de68e5a93fabc64a27010d

SHA256
9d030ae82ea8d673113da4a10346b504235fca7174e7277c95ca03c748ffae2c

SHA512
7fbae4ffddab92c7bd4de05cd3b4124299c45b528d8238702aa9b669d1928322adbc0f97510f04cf101a65b5602c261f5d48c8a035d3684acf20bce3098b21cf

Download Submit
C:\Windows\System\ihBHcBs.exe

Filesize
1.7MB

MD5
511b1a8e7a881d401f041512148c75ce

SHA1
561d65d82fa8b2ef1ef06617fc608ee9ef79ff18

SHA256
bb3654bc4b6b2cbf7453a206c03e9ae2ac5018bb4744095a67831906cd1b36da

SHA512
8ddb64311dcd8438fa076f3c1baa19c1edc1b8391ded1bb48f79a5c78015c7a3c1fc1e353bc1e31a572a44d42600cc14931b0f012d082918f2089c79cb715674

Download Submit
C:\Windows\System\lozNquz.exe

Filesize
1.7MB

MD5
f0d2935d57a24bf2be86b5c57d7291ee

SHA1
d7c564c698a9a78c66927499d5e9034c858de39c

SHA256
c3e490ade9baa597a857d2d7bc398cdc167a99f152d6d0c2f274cac723b24f0e

SHA512
cb31ff2cde85ad2ebb8cd6e9d41c0b54dcc8ee644d916851dd6a2b441a88b482492a3e3d6e53196a057721dd5d2637b4735ac13f10558a7879a47903c32da9c2

Download Submit
C:\Windows\System\mmoAxLE.exe

Filesize
1.7MB

MD5
1fab6269c7d350fa09ed659a90c4bafa

SHA1
12ac7d5948cf84e33c8d53d9f738858355558602

SHA256
3ba50af21da916e2e0698d47bc90842a44abe5654114f4e91da77e44b0d0afea

SHA512
fa0097ca82e1954593372c402ddb722b51c8351c65d299dd91a326782b1ab61e1c9831b92d4319c7fc05f37dda77af35ab2ed39707ac73c68e16e5c6f5cccab4

Download Submit
C:\Windows\System\nQZSafJ.exe

Filesize
1.7MB

MD5
2fdb44ca563c77f666b23106670ebef2

SHA1
179e87b67ab323307149b87f7d64bf8271551b68

SHA256
4ab948869a19627f65921d2c7990013134ed33f065ce85bcf58d334fec4027b1

SHA512
be33ed0cd80e3bfccfc92e8bb0398070bca21b8a457b13477008b4f062065a6f832cb5ae619d16e8048dc0ef827b696962da57430ee05d91382974ddd74b4dbd

Download Submit
C:\Windows\System\namtDoh.exe

Filesize
1.7MB

MD5
4a92e4af5ad5b50be5282057828956e9

SHA1
cc16af2adc5c4b437385de3d4fa62046925e2939

SHA256
0586aae5cc42491a825678328e02f72dc7001c17ea580a2a0aa4c98415a4616b

SHA512
58dbd428c9f4e494ff879ae7f90cd9111948dcb287c61a18985b015baa04f45ae56777b527f88810805dd831a76862147dccaa89d8da62d6add884a2d6661778

Download Submit
C:\Windows\System\oFBJFfe.exe

Filesize
1.7MB

MD5
6e40af5001188fbb1995087ebabf6b7b

SHA1
9673b83138c55c23f801eb8ac4084b057aa7b76f

SHA256
331d70da5e6eaf5a06d390cd1fee511547bd9a0001c28e842c5b0192d1847c7f

SHA512
59b8c13757e1ff89e368c8fdbbf0dc83e53a60d0d3ca803f79e62257a44bde992906d5b8ffe453375d7c194fe05c859cc8913279d7eb10b0ef1378e1a068d22a

Download Submit
C:\Windows\System\oGYmTLV.exe

Filesize
1.7MB

MD5
5bffe1881bcc6351f6ea81ed9bde771b

SHA1
094dbafc735085ddc72a55151f4591e11658f7fe

SHA256
e2922daf706fe64520c50fab5ae20f73ac8dd7d38c8c0d88848efb1b45689602

SHA512
7fd8c19de9d75345913d9260fa1694c35da21f722ecc5e840b7ed9c82269115cbf5b3ca03382fbed2bd5fd418c1c8bfcc5a76cc7e106c4b86e3220d786f20520

Download Submit
C:\Windows\System\qXhfhwv.exe

Filesize
1.7MB

MD5
eb3ebdd47f109b791c332d2a4d89a80c

SHA1
9b0bf7da01895d59357d0156c12cd86c8f1f1534

SHA256
e5755158661c95b512b18964cdeab9d26767f6324287564e84e5ae11a2760a0a

SHA512
75cc0f14c7813c3d350b6ff79d207615fb4b4ab20ca3da10e8f92ac711d5063321ee793fbeacc760904c0045b667d21cc4168849c6d797e707817c57539aa67e

Download Submit
C:\Windows\System\rXkVMeL.exe

Filesize
1.7MB

MD5
28f73a6e576ed9e0b7371e6f4e1a59b5

SHA1
57f48f401131d383c11cbe78eaea306b31f48612

SHA256
a21f636cbde5b58fe5c00ccd6fd5278217442ee8fffb06fb4a9512135650dfef

SHA512
4d3ab3542d2896fa9d5e2f5bba3ede7c887fba7f8f3dc987ec8ac2de2036967284463585e371f96f9bbf557037e1226b21e715fb822d3dea77fbde7b18449bb0

Download Submit
C:\Windows\System\tiIZnwl.exe

Filesize
1.7MB

MD5
c19adf486a306a9a183b0ec04b0024d2

SHA1
a4213e6c99bc7bc5f13681befbcd0635f60544d0

SHA256
028269d1c59f1e276bb23a1977f474c884375386ba496481e0dc83d7593f0fac

SHA512
1e5cd90dc5184c6b5df201b05f37310d274052e87195ed0a5032d391b3e5bacc47f495ba5b55cd72056fdbd7d8f023be1e214605fd935fc92d473b23edaf98b6

Download Submit
C:\Windows\System\vKaNWQT.exe

Filesize
1.7MB

MD5
42ed48710ace8f67e93e018caaef20d3

SHA1
2c01178cd3290f79bcb09e046ad60eca047b2fde

SHA256
4f5f6036e685af7618dc2f802865d91db857f75682ae2a43094e5581edd6c3f8

SHA512
9668725dc99bfb237869aa970b294703429445a3ce24e61a80fde77694e15d1d38b37e7e366aa6457dc2dbf2346aecf5ea9d60d285cb0551ebf2dd97fe87be3b

Download Submit
C:\Windows\System\vWGVKfh.exe

Filesize
1.7MB

MD5
3ba05ed5518c4583cac910822401e289

SHA1
6b397cf12379fbcc38e5e2619b24beda83cb3a70

SHA256
a15c484c4c56ebc612b3e74a38b30667d58391f8c789dda09a8f5cafe928b07d

SHA512
7d4507343f75b5fb8da74af083edf10e37a877550eaf3fe164ba267385623939e81ba93ad37fdbe304b447586bbd8b6443ae2ff318ebd4c04ba917ec8004849c

Download Submit
memory/408-4994-0x00007FF797ED0000-0x00007FF7982C2000-memory.dmp

Filesize
3.9MB

Download
memory/408-229-0x00007FF797ED0000-0x00007FF7982C2000-memory.dmp

Filesize
3.9MB

Download
memory/624-480-0x00007FF638AF0000-0x00007FF638EE2000-memory.dmp

Filesize
3.9MB

Download
memory/624-5051-0x00007FF638AF0000-0x00007FF638EE2000-memory.dmp

Filesize
3.9MB

Download
memory/736-79-0x00007FF62CD60000-0x00007FF62D152000-memory.dmp

Filesize
3.9MB

Download
memory/828-19-0x00007FFC10123000-0x00007FFC10125000-memory.dmp

Filesize
8KB

Download
memory/828-18-0x0000018B946B0000-0x0000018B946C0000-memory.dmp

Filesize
64KB

Download
memory/828-603-0x0000018B94680000-0x0000018B946A2000-memory.dmp

Filesize
136KB

Download
memory/828-468-0x00007FFC10120000-0x00007FFC10BE1000-memory.dmp

Filesize
10.8MB

Download
memory/924-348-0x00007FF65DA20000-0x00007FF65DE12000-memory.dmp

Filesize
3.9MB

Download
memory/1000-267-0x00007FF6D2560000-0x00007FF6D2952000-memory.dmp

Filesize
3.9MB

Download
memory/1004-121-0x00007FF655390000-0x00007FF655782000-memory.dmp

Filesize
3.9MB

Download
memory/1276-479-0x00007FF7F9890000-0x00007FF7F9C82000-memory.dmp

Filesize
3.9MB

Download
memory/1276-5015-0x00007FF7F9890000-0x00007FF7F9C82000-memory.dmp

Filesize
3.9MB

Download
memory/1340-4918-0x00007FF66C760000-0x00007FF66CB52000-memory.dmp

Filesize
3.9MB

Download
memory/1340-483-0x00007FF66C760000-0x00007FF66CB52000-memory.dmp

Filesize
3.9MB

Download
memory/1928-203-0x00007FF7DFB20000-0x00007FF7DFF12000-memory.dmp

Filesize
3.9MB

Download
memory/1928-4924-0x00007FF7DFB20000-0x00007FF7DFF12000-memory.dmp

Filesize
3.9MB

Download
memory/1932-173-0x00007FF6D5450000-0x00007FF6D5842000-memory.dmp

Filesize
3.9MB

Download
memory/1964-349-0x00007FF66BE80000-0x00007FF66C272000-memory.dmp

Filesize
3.9MB

Download
memory/2068-48-0x00007FF635C90000-0x00007FF636082000-memory.dmp

Filesize
3.9MB

Download
memory/2200-4990-0x00007FF79C330000-0x00007FF79C722000-memory.dmp

Filesize
3.9MB

Download
memory/2200-227-0x00007FF79C330000-0x00007FF79C722000-memory.dmp

Filesize
3.9MB

Download
memory/2276-477-0x00007FF60CAC0000-0x00007FF60CEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-72-0x00007FF633B00000-0x00007FF633EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-475-0x00007FF63D8A0000-0x00007FF63DC92000-memory.dmp

Filesize
3.9MB

Download
memory/2876-5023-0x00007FF63D8A0000-0x00007FF63DC92000-memory.dmp

Filesize
3.9MB

Download
memory/2884-1-0x0000027538630000-0x0000027538640000-memory.dmp

Filesize
64KB

Download
memory/2884-0-0x00007FF6CC580000-0x00007FF6CC972000-memory.dmp

Filesize
3.9MB

Download
memory/3000-5008-0x00007FF695400000-0x00007FF6957F2000-memory.dmp

Filesize
3.9MB

Download
memory/3000-478-0x00007FF695400000-0x00007FF6957F2000-memory.dmp

Filesize
3.9MB

Download
memory/3296-5035-0x00007FF72C9F0000-0x00007FF72CDE2000-memory.dmp

Filesize
3.9MB

Download
memory/3296-484-0x00007FF72C9F0000-0x00007FF72CDE2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-367-0x00007FF6F99C0000-0x00007FF6F9DB2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-5003-0x00007FF6F99C0000-0x00007FF6F9DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4012-17-0x00007FF7C4090000-0x00007FF7C4482000-memory.dmp

Filesize
3.9MB

Download
memory/4016-481-0x00007FF73C3C0000-0x00007FF73C7B2000-memory.dmp

Filesize
3.9MB

Download
memory/4136-4930-0x00007FF69BB80000-0x00007FF69BF72000-memory.dmp

Filesize
3.9MB

Download
memory/4136-297-0x00007FF69BB80000-0x00007FF69BF72000-memory.dmp

Filesize
3.9MB

Download
memory/4236-482-0x00007FF71B240000-0x00007FF71B632000-memory.dmp

Filesize
3.9MB

Download
memory/4236-4985-0x00007FF71B240000-0x00007FF71B632000-memory.dmp

Filesize
3.9MB

Download
memory/4504-476-0x00007FF75A640000-0x00007FF75AA32000-memory.dmp

Filesize
3.9MB

Download