xmrig | 59ea51809308390cd150c22af7b95f60e88e83cc082cc7d5e992416886e92cea

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d10d30aaea0965e61c8c5c0da8bc0de0N.exe
Size

2.0MB
MD5

d10d30aaea0965e61c8c5c0da8bc0de0
SHA1

bdae9199df6d2f89023da8fb60bf2c08372e9fc6
SHA256

59ea51809308390cd150c22af7b95f60e88e83cc082cc7d5e992416886e92cea
SHA512

c5980944771c2ee6351aa6df60eefb59d9bc224cceb17dcff3199f1d82a600150a91795b422513be846632c9520931ff9bc862e4dc7db1210bb9c894c9dd8085
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHqx4EKeLp:NABM

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3336 created 516	3336	WerFaultSecure.exe	78

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/3796-52-0x00007FF7D10A0000-0x00007FF7D1492000-memory.dmp	xmrig
behavioral2/memory/2264-59-0x00007FF6B18F0000-0x00007FF6B1CE2000-memory.dmp	xmrig
behavioral2/memory/3948-61-0x00007FF6B8A60000-0x00007FF6B8E52000-memory.dmp	xmrig
behavioral2/memory/4132-64-0x00007FF799610000-0x00007FF799A02000-memory.dmp	xmrig
behavioral2/memory/2244-66-0x00007FF74F1F0000-0x00007FF74F5E2000-memory.dmp	xmrig
behavioral2/memory/5092-65-0x00007FF64D840000-0x00007FF64DC32000-memory.dmp	xmrig
behavioral2/memory/2972-62-0x00007FF7BEAC0000-0x00007FF7BEEB2000-memory.dmp	xmrig
behavioral2/memory/3112-60-0x00007FF6E4BF0000-0x00007FF6E4FE2000-memory.dmp	xmrig
behavioral2/memory/1500-57-0x00007FF69A6E0000-0x00007FF69AAD2000-memory.dmp	xmrig
behavioral2/memory/2676-91-0x00007FF6FB910000-0x00007FF6FBD02000-memory.dmp	xmrig
behavioral2/memory/3216-133-0x00007FF67CBC0000-0x00007FF67CFB2000-memory.dmp	xmrig
behavioral2/memory/2392-134-0x00007FF737840000-0x00007FF737C32000-memory.dmp	xmrig
behavioral2/memory/400-128-0x00007FF61B490000-0x00007FF61B882000-memory.dmp	xmrig
behavioral2/memory/572-121-0x00007FF6A8D70000-0x00007FF6A9162000-memory.dmp	xmrig
behavioral2/memory/1512-108-0x00007FF7AC380000-0x00007FF7AC772000-memory.dmp	xmrig
behavioral2/memory/2764-103-0x00007FF690200000-0x00007FF6905F2000-memory.dmp	xmrig
behavioral2/memory/4080-102-0x00007FF7DFED0000-0x00007FF7E02C2000-memory.dmp	xmrig
behavioral2/memory/4920-182-0x00007FF6ABB80000-0x00007FF6ABF72000-memory.dmp	xmrig
behavioral2/memory/4880-929-0x00007FF719E50000-0x00007FF71A242000-memory.dmp	xmrig
behavioral2/memory/2980-1615-0x00007FF6B5870000-0x00007FF6B5C62000-memory.dmp	xmrig
behavioral2/memory/4940-3029-0x00007FF7A28C0000-0x00007FF7A2CB2000-memory.dmp	xmrig
behavioral2/memory/1996-3362-0x00007FF72E850000-0x00007FF72EC42000-memory.dmp	xmrig
behavioral2/memory/1500-4257-0x00007FF69A6E0000-0x00007FF69AAD2000-memory.dmp	xmrig
behavioral2/memory/3948-4271-0x00007FF6B8A60000-0x00007FF6B8E52000-memory.dmp	xmrig
behavioral2/memory/3796-4264-0x00007FF7D10A0000-0x00007FF7D1492000-memory.dmp	xmrig
behavioral2/memory/2244-4283-0x00007FF74F1F0000-0x00007FF74F5E2000-memory.dmp	xmrig
behavioral2/memory/2972-4281-0x00007FF7BEAC0000-0x00007FF7BEEB2000-memory.dmp	xmrig
behavioral2/memory/5092-4278-0x00007FF64D840000-0x00007FF64DC32000-memory.dmp	xmrig
behavioral2/memory/3112-4273-0x00007FF6E4BF0000-0x00007FF6E4FE2000-memory.dmp	xmrig
behavioral2/memory/4880-4288-0x00007FF719E50000-0x00007FF71A242000-memory.dmp	xmrig
behavioral2/memory/2980-4286-0x00007FF6B5870000-0x00007FF6B5C62000-memory.dmp	xmrig
behavioral2/memory/2676-4384-0x00007FF6FB910000-0x00007FF6FBD02000-memory.dmp	xmrig
behavioral2/memory/4080-4387-0x00007FF7DFED0000-0x00007FF7E02C2000-memory.dmp	xmrig
behavioral2/memory/2764-4395-0x00007FF690200000-0x00007FF6905F2000-memory.dmp	xmrig
behavioral2/memory/1512-4398-0x00007FF7AC380000-0x00007FF7AC772000-memory.dmp	xmrig
behavioral2/memory/772-4429-0x00007FF6A2FF0000-0x00007FF6A33E2000-memory.dmp	xmrig
behavioral2/memory/2392-4402-0x00007FF737840000-0x00007FF737C32000-memory.dmp	xmrig
behavioral2/memory/4940-4449-0x00007FF7A28C0000-0x00007FF7A2CB2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2268	powershell.exe
7	2268	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2268	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4132	xskBWPG.exe
3796	MwuMQRl.exe
1500	rfdrBqi.exe
2264	rFBeDnt.exe
3112	VcZEqsK.exe
5092	TkZsGyk.exe
3948	nFfwcoz.exe
2972	DyjpLqC.exe
2244	WywnCDb.exe
4880	UmZJkVb.exe
2980	dEszwcZ.exe
2676	Mhdgmuo.exe
4080	xOVVUIw.exe
2764	ZEDuNnm.exe
1512	KtQxqZD.exe
572	eJOVBgs.exe
2392	tBmwPnY.exe
400	aPZPmmR.exe
3760	foEuhCt.exe
772	ifZmTbR.exe
4940	IHBdYgZ.exe
1996	xycUEJc.exe
3540	eRQqwtk.exe
4920	Bqjhotg.exe
4044	efdDPXh.exe
1012	SYEwTLm.exe
1236	KHbQuqG.exe
4228	pNNgoYA.exe
2304	hYgckVE.exe
4828	LQeZSiJ.exe
4984	jGTFQcY.exe
4540	PJQhMsN.exe
4760	yXSlwOy.exe
3704	vFbvQRz.exe
1040	wDeEKSH.exe
1244	IpZTBlb.exe
1900	yAHRYUY.exe
5068	qtjVEWb.exe
3036	VerHToV.exe
920	FApXGcg.exe
3468	hggDpKn.exe
3232	kKqhPlZ.exe
1556	bEXERiy.exe
2656	DNBBlDj.exe
2788	nIprrWm.exe
1748	ddYoTIX.exe
3856	bDtStJf.exe
4956	moyZNQT.exe
2348	XeMUBtC.exe
3880	KHtLWnR.exe
4392	BvglfsX.exe
3168	UfOpzci.exe
1716	QojeRBR.exe
4788	EeWdaHF.exe
4868	Xkvljzf.exe
3268	ZnNnbSE.exe
4024	CkSAYYM.exe
4640	gzqbQub.exe
3772	pEiEjuU.exe
1204	EDPiTKB.exe
4140	ByYAMYD.exe
4628	ckXAyGZ.exe
3716	JmoeTyG.exe
4972	uhxpKpr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3216-0-0x00007FF67CBC0000-0x00007FF67CFB2000-memory.dmp	upx
behavioral2/files/0x00070000000234cb-8.dat	upx
behavioral2/files/0x000c00000002347e-6.dat	upx
behavioral2/files/0x00090000000234ca-9.dat	upx
behavioral2/files/0x00070000000234cd-22.dat	upx
behavioral2/files/0x00070000000234ce-28.dat	upx
behavioral2/files/0x00070000000234cf-33.dat	upx
behavioral2/memory/3796-52-0x00007FF7D10A0000-0x00007FF7D1492000-memory.dmp	upx
behavioral2/files/0x00070000000234d3-58.dat	upx
behavioral2/memory/2264-59-0x00007FF6B18F0000-0x00007FF6B1CE2000-memory.dmp	upx
behavioral2/memory/3948-61-0x00007FF6B8A60000-0x00007FF6B8E52000-memory.dmp	upx
behavioral2/memory/4880-63-0x00007FF719E50000-0x00007FF71A242000-memory.dmp	upx
behavioral2/memory/4132-64-0x00007FF799610000-0x00007FF799A02000-memory.dmp	upx
behavioral2/memory/2980-67-0x00007FF6B5870000-0x00007FF6B5C62000-memory.dmp	upx
behavioral2/files/0x00070000000234d2-68.dat	upx
behavioral2/memory/2244-66-0x00007FF74F1F0000-0x00007FF74F5E2000-memory.dmp	upx
behavioral2/memory/5092-65-0x00007FF64D840000-0x00007FF64DC32000-memory.dmp	upx
behavioral2/memory/2972-62-0x00007FF7BEAC0000-0x00007FF7BEEB2000-memory.dmp	upx
behavioral2/memory/3112-60-0x00007FF6E4BF0000-0x00007FF6E4FE2000-memory.dmp	upx
behavioral2/memory/1500-57-0x00007FF69A6E0000-0x00007FF69AAD2000-memory.dmp	upx
behavioral2/files/0x00070000000234d1-51.dat	upx
behavioral2/files/0x00070000000234d0-41.dat	upx
behavioral2/files/0x00070000000234cc-18.dat	upx
behavioral2/files/0x00070000000234d4-85.dat	upx
behavioral2/files/0x00090000000234c4-92.dat	upx
behavioral2/files/0x00080000000234d5-93.dat	upx
behavioral2/memory/2676-91-0x00007FF6FB910000-0x00007FF6FBD02000-memory.dmp	upx
behavioral2/files/0x00080000000234d6-101.dat	upx
behavioral2/files/0x00070000000234d7-111.dat	upx
behavioral2/files/0x00070000000234d8-119.dat	upx
behavioral2/files/0x00070000000234d9-123.dat	upx
behavioral2/files/0x00070000000234dc-130.dat	upx
behavioral2/memory/4940-132-0x00007FF7A28C0000-0x00007FF7A2CB2000-memory.dmp	upx
behavioral2/memory/3216-133-0x00007FF67CBC0000-0x00007FF67CFB2000-memory.dmp	upx
behavioral2/files/0x00070000000234db-137.dat	upx
behavioral2/files/0x00070000000234da-136.dat	upx
behavioral2/memory/772-135-0x00007FF6A2FF0000-0x00007FF6A33E2000-memory.dmp	upx
behavioral2/memory/2392-134-0x00007FF737840000-0x00007FF737C32000-memory.dmp	upx
behavioral2/memory/3760-131-0x00007FF652AB0000-0x00007FF652EA2000-memory.dmp	upx
behavioral2/memory/400-128-0x00007FF61B490000-0x00007FF61B882000-memory.dmp	upx
behavioral2/memory/572-121-0x00007FF6A8D70000-0x00007FF6A9162000-memory.dmp	upx
behavioral2/memory/1512-108-0x00007FF7AC380000-0x00007FF7AC772000-memory.dmp	upx
behavioral2/memory/2764-103-0x00007FF690200000-0x00007FF6905F2000-memory.dmp	upx
behavioral2/memory/4080-102-0x00007FF7DFED0000-0x00007FF7E02C2000-memory.dmp	upx
behavioral2/files/0x00070000000234dd-145.dat	upx
behavioral2/files/0x00070000000234e0-169.dat	upx
behavioral2/files/0x00070000000234e1-177.dat	upx
behavioral2/files/0x00070000000234e4-194.dat	upx
behavioral2/files/0x00070000000234e7-204.dat	upx
behavioral2/files/0x00070000000234e6-200.dat	upx
behavioral2/files/0x00070000000234e5-197.dat	upx
behavioral2/files/0x00070000000234e3-192.dat	upx
behavioral2/files/0x00070000000234e2-187.dat	upx
behavioral2/memory/4920-182-0x00007FF6ABB80000-0x00007FF6ABF72000-memory.dmp	upx
behavioral2/files/0x00070000000234df-174.dat	upx
behavioral2/memory/3540-164-0x00007FF685B40000-0x00007FF685F32000-memory.dmp	upx
behavioral2/files/0x00070000000234de-160.dat	upx
behavioral2/memory/1996-155-0x00007FF72E850000-0x00007FF72EC42000-memory.dmp	upx
behavioral2/memory/4880-929-0x00007FF719E50000-0x00007FF71A242000-memory.dmp	upx
behavioral2/memory/2980-1615-0x00007FF6B5870000-0x00007FF6B5C62000-memory.dmp	upx
behavioral2/memory/4940-3029-0x00007FF7A28C0000-0x00007FF7A2CB2000-memory.dmp	upx
behavioral2/memory/1996-3362-0x00007FF72E850000-0x00007FF72EC42000-memory.dmp	upx
behavioral2/memory/1500-4257-0x00007FF69A6E0000-0x00007FF69AAD2000-memory.dmp	upx
behavioral2/memory/3948-4271-0x00007FF6B8A60000-0x00007FF6B8E52000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vjyjoSF.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\WYQRJdx.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\LLCaGbi.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\sicgkHp.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\lhozghg.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\OQIbzYQ.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\gtCNPdQ.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\mMsbQrk.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\xrjmFYP.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\PywfSPU.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\OewvIfd.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\JYQUilk.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\PsPvnGs.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\NdUIlwB.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\qvBAcqB.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\AMWJHTL.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\xNvhUVz.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\cwmTVEF.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\nVpuHxS.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\KLAnaKY.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\WFLfReB.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\arPxcHG.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\ajchgtf.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\sLufkPh.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\srvOBQZ.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\kWUKecg.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\BsUTSBR.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\poyoTYq.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\eqpUZoP.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\wgVjYcV.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\XfvJfuC.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\oQWNwWa.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\vOzvsyd.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\XUzaquP.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\bfNxnmp.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\prjjWoR.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\SwaPNOU.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\FGHlkKP.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\YEkgSBG.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\gnNjujT.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\nHWopof.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\ecISuYu.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\prSrihA.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\jcQqozl.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\lJCdyPA.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\lfAyCFZ.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\MQFIede.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\OhuxNrR.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\uUPrKZd.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\mwtWvMy.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\INmfldq.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\KfjcyhD.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\fWWXcMi.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\DUQkaCC.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\vFTwEvu.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\GHLNtzl.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\PStAjuE.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\NvevkdL.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\cAyWuxf.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\pdyYVTF.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\PNHOWYW.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\ffByVqo.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\nlxiLMM.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
File created	C:\Windows\System\HxQtKWR.exe	d10d30aaea0965e61c8c5c0da8bc0de0N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2268	powershell.exe
2268	powershell.exe
5280	WerFaultSecure.exe
5280	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
Token: SeLockMemoryPrivilege	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe
Token: SeDebugPrivilege	2268	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2268	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	84
PID 3216 wrote to memory of 2268	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	84
PID 3216 wrote to memory of 4132	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	85
PID 3216 wrote to memory of 4132	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	85
PID 3216 wrote to memory of 3796	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	86
PID 3216 wrote to memory of 3796	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	86
PID 3216 wrote to memory of 1500	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	87
PID 3216 wrote to memory of 1500	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	87
PID 3216 wrote to memory of 2264	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	88
PID 3216 wrote to memory of 2264	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	88
PID 3216 wrote to memory of 3112	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	89
PID 3216 wrote to memory of 3112	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	89
PID 3216 wrote to memory of 5092	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	90
PID 3216 wrote to memory of 5092	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	90
PID 3216 wrote to memory of 3948	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	91
PID 3216 wrote to memory of 3948	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	91
PID 3216 wrote to memory of 2972	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	92
PID 3216 wrote to memory of 2972	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	92
PID 3216 wrote to memory of 2244	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	93
PID 3216 wrote to memory of 2244	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	93
PID 3216 wrote to memory of 4880	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	94
PID 3216 wrote to memory of 4880	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	94
PID 3216 wrote to memory of 2980	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	95
PID 3216 wrote to memory of 2980	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	95
PID 3216 wrote to memory of 2676	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	96
PID 3216 wrote to memory of 2676	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	96
PID 3216 wrote to memory of 4080	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	98
PID 3216 wrote to memory of 4080	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	98
PID 3216 wrote to memory of 2764	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	99
PID 3216 wrote to memory of 2764	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	99
PID 3216 wrote to memory of 1512	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	100
PID 3216 wrote to memory of 1512	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	100
PID 3216 wrote to memory of 572	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	101
PID 3216 wrote to memory of 572	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	101
PID 3216 wrote to memory of 2392	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	102
PID 3216 wrote to memory of 2392	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	102
PID 3216 wrote to memory of 400	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	103
PID 3216 wrote to memory of 400	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	103
PID 3216 wrote to memory of 3760	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	104
PID 3216 wrote to memory of 3760	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	104
PID 3216 wrote to memory of 772	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	105
PID 3216 wrote to memory of 772	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	105
PID 3216 wrote to memory of 4940	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	106
PID 3216 wrote to memory of 4940	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	106
PID 3216 wrote to memory of 1996	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	109
PID 3216 wrote to memory of 1996	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	109
PID 3216 wrote to memory of 3540	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	110
PID 3216 wrote to memory of 3540	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	110
PID 3216 wrote to memory of 4044	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	111
PID 3216 wrote to memory of 4044	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	111
PID 3216 wrote to memory of 4920	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	112
PID 3216 wrote to memory of 4920	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	112
PID 3216 wrote to memory of 1236	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	113
PID 3216 wrote to memory of 1236	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	113
PID 3216 wrote to memory of 1012	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	114
PID 3216 wrote to memory of 1012	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	114
PID 3216 wrote to memory of 4228	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	115
PID 3216 wrote to memory of 4228	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	115
PID 3216 wrote to memory of 2304	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	116
PID 3216 wrote to memory of 2304	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	116
PID 3216 wrote to memory of 4828	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	117
PID 3216 wrote to memory of 4828	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	117
PID 3216 wrote to memory of 4984	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	118
PID 3216 wrote to memory of 4984	3216	d10d30aaea0965e61c8c5c0da8bc0de0N.exe	118

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv BCNYiLKrR0WnU2zyMH/Tew.0
1⤵
PID:516
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 516 -s 392
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5280

C:\Users\Admin\AppData\Local\Temp\d10d30aaea0965e61c8c5c0da8bc0de0N.exe
"C:\Users\Admin\AppData\Local\Temp\d10d30aaea0965e61c8c5c0da8bc0de0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2268" "2916" "2880" "2920" "0" "0" "2924" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4444
- C:\Windows\System\xskBWPG.exe
  C:\Windows\System\xskBWPG.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\MwuMQRl.exe
  C:\Windows\System\MwuMQRl.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\rfdrBqi.exe
  C:\Windows\System\rfdrBqi.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\rFBeDnt.exe
  C:\Windows\System\rFBeDnt.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\VcZEqsK.exe
  C:\Windows\System\VcZEqsK.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\TkZsGyk.exe
  C:\Windows\System\TkZsGyk.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\nFfwcoz.exe
  C:\Windows\System\nFfwcoz.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\DyjpLqC.exe
  C:\Windows\System\DyjpLqC.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\WywnCDb.exe
  C:\Windows\System\WywnCDb.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\UmZJkVb.exe
  C:\Windows\System\UmZJkVb.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\dEszwcZ.exe
  C:\Windows\System\dEszwcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\Mhdgmuo.exe
  C:\Windows\System\Mhdgmuo.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\xOVVUIw.exe
  C:\Windows\System\xOVVUIw.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\ZEDuNnm.exe
  C:\Windows\System\ZEDuNnm.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\KtQxqZD.exe
  C:\Windows\System\KtQxqZD.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\eJOVBgs.exe
  C:\Windows\System\eJOVBgs.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\tBmwPnY.exe
  C:\Windows\System\tBmwPnY.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\aPZPmmR.exe
  C:\Windows\System\aPZPmmR.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\foEuhCt.exe
  C:\Windows\System\foEuhCt.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\ifZmTbR.exe
  C:\Windows\System\ifZmTbR.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\IHBdYgZ.exe
  C:\Windows\System\IHBdYgZ.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\xycUEJc.exe
  C:\Windows\System\xycUEJc.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\eRQqwtk.exe
  C:\Windows\System\eRQqwtk.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\efdDPXh.exe
  C:\Windows\System\efdDPXh.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\Bqjhotg.exe
  C:\Windows\System\Bqjhotg.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\KHbQuqG.exe
  C:\Windows\System\KHbQuqG.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\SYEwTLm.exe
  C:\Windows\System\SYEwTLm.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\pNNgoYA.exe
  C:\Windows\System\pNNgoYA.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\hYgckVE.exe
  C:\Windows\System\hYgckVE.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\LQeZSiJ.exe
  C:\Windows\System\LQeZSiJ.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\jGTFQcY.exe
  C:\Windows\System\jGTFQcY.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\PJQhMsN.exe
  C:\Windows\System\PJQhMsN.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\yXSlwOy.exe
  C:\Windows\System\yXSlwOy.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\vFbvQRz.exe
  C:\Windows\System\vFbvQRz.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\wDeEKSH.exe
  C:\Windows\System\wDeEKSH.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\IpZTBlb.exe
  C:\Windows\System\IpZTBlb.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\yAHRYUY.exe
  C:\Windows\System\yAHRYUY.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\qtjVEWb.exe
  C:\Windows\System\qtjVEWb.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\VerHToV.exe
  C:\Windows\System\VerHToV.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\FApXGcg.exe
  C:\Windows\System\FApXGcg.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\hggDpKn.exe
  C:\Windows\System\hggDpKn.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\kKqhPlZ.exe
  C:\Windows\System\kKqhPlZ.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\bEXERiy.exe
  C:\Windows\System\bEXERiy.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\DNBBlDj.exe
  C:\Windows\System\DNBBlDj.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ddYoTIX.exe
  C:\Windows\System\ddYoTIX.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\nIprrWm.exe
  C:\Windows\System\nIprrWm.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\bDtStJf.exe
  C:\Windows\System\bDtStJf.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\moyZNQT.exe
  C:\Windows\System\moyZNQT.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\XeMUBtC.exe
  C:\Windows\System\XeMUBtC.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\KHtLWnR.exe
  C:\Windows\System\KHtLWnR.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\BvglfsX.exe
  C:\Windows\System\BvglfsX.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\UfOpzci.exe
  C:\Windows\System\UfOpzci.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\QojeRBR.exe
  C:\Windows\System\QojeRBR.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\EeWdaHF.exe
  C:\Windows\System\EeWdaHF.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\Xkvljzf.exe
  C:\Windows\System\Xkvljzf.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\ZnNnbSE.exe
  C:\Windows\System\ZnNnbSE.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\ByYAMYD.exe
  C:\Windows\System\ByYAMYD.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\ckXAyGZ.exe
  C:\Windows\System\ckXAyGZ.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\CkSAYYM.exe
  C:\Windows\System\CkSAYYM.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\gzqbQub.exe
  C:\Windows\System\gzqbQub.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\pEiEjuU.exe
  C:\Windows\System\pEiEjuU.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\EDPiTKB.exe
  C:\Windows\System\EDPiTKB.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\JmoeTyG.exe
  C:\Windows\System\JmoeTyG.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\uhxpKpr.exe
  C:\Windows\System\uhxpKpr.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\yINlrHn.exe
  C:\Windows\System\yINlrHn.exe
  2⤵
  PID:3192
- C:\Windows\System\EIfhCxE.exe
  C:\Windows\System\EIfhCxE.exe
  2⤵
  PID:4936
- C:\Windows\System\rvZomeu.exe
  C:\Windows\System\rvZomeu.exe
  2⤵
  PID:4528
- C:\Windows\System\LTailMM.exe
  C:\Windows\System\LTailMM.exe
  2⤵
  PID:1672
- C:\Windows\System\dBefJDj.exe
  C:\Windows\System\dBefJDj.exe
  2⤵
  PID:4192
- C:\Windows\System\zBibsnL.exe
  C:\Windows\System\zBibsnL.exe
  2⤵
  PID:5104
- C:\Windows\System\cPsFwnI.exe
  C:\Windows\System\cPsFwnI.exe
  2⤵
  PID:1400
- C:\Windows\System\fhcDezm.exe
  C:\Windows\System\fhcDezm.exe
  2⤵
  PID:2228
- C:\Windows\System\wFzJzuZ.exe
  C:\Windows\System\wFzJzuZ.exe
  2⤵
  PID:3272
- C:\Windows\System\cZyqiqx.exe
  C:\Windows\System\cZyqiqx.exe
  2⤵
  PID:3896
- C:\Windows\System\Dfiznhw.exe
  C:\Windows\System\Dfiznhw.exe
  2⤵
  PID:3936
- C:\Windows\System\aWNOWZg.exe
  C:\Windows\System\aWNOWZg.exe
  2⤵
  PID:4016
- C:\Windows\System\CsGftgD.exe
  C:\Windows\System\CsGftgD.exe
  2⤵
  PID:3960
- C:\Windows\System\vPZynqc.exe
  C:\Windows\System\vPZynqc.exe
  2⤵
  PID:4740
- C:\Windows\System\tVJOhZS.exe
  C:\Windows\System\tVJOhZS.exe
  2⤵
  PID:2144
- C:\Windows\System\qAKYYJO.exe
  C:\Windows\System\qAKYYJO.exe
  2⤵
  PID:4148
- C:\Windows\System\JUiScBo.exe
  C:\Windows\System\JUiScBo.exe
  2⤵
  PID:4968
- C:\Windows\System\dBUYsis.exe
  C:\Windows\System\dBUYsis.exe
  2⤵
  PID:2440
- C:\Windows\System\QkkhjkR.exe
  C:\Windows\System\QkkhjkR.exe
  2⤵
  PID:4644
- C:\Windows\System\vnmqrAI.exe
  C:\Windows\System\vnmqrAI.exe
  2⤵
  PID:2180
- C:\Windows\System\TUfbOLM.exe
  C:\Windows\System\TUfbOLM.exe
  2⤵
  PID:3484
- C:\Windows\System\jnsQxkd.exe
  C:\Windows\System\jnsQxkd.exe
  2⤵
  PID:2932
- C:\Windows\System\HnUBlfg.exe
  C:\Windows\System\HnUBlfg.exe
  2⤵
  PID:2448
- C:\Windows\System\iUwVWNw.exe
  C:\Windows\System\iUwVWNw.exe
  2⤵
  PID:3432
- C:\Windows\System\XvJXiPq.exe
  C:\Windows\System\XvJXiPq.exe
  2⤵
  PID:2648
- C:\Windows\System\HNDShpk.exe
  C:\Windows\System\HNDShpk.exe
  2⤵
  PID:5136
- C:\Windows\System\BClRqhV.exe
  C:\Windows\System\BClRqhV.exe
  2⤵
  PID:5164
- C:\Windows\System\vzlQUyI.exe
  C:\Windows\System\vzlQUyI.exe
  2⤵
  PID:5188
- C:\Windows\System\JcQeARr.exe
  C:\Windows\System\JcQeARr.exe
  2⤵
  PID:5208
- C:\Windows\System\OcgfQzS.exe
  C:\Windows\System\OcgfQzS.exe
  2⤵
  PID:5260
- C:\Windows\System\ZwuXKyO.exe
  C:\Windows\System\ZwuXKyO.exe
  2⤵
  PID:5324
- C:\Windows\System\KRmcLtx.exe
  C:\Windows\System\KRmcLtx.exe
  2⤵
  PID:5340
- C:\Windows\System\wgFGyEn.exe
  C:\Windows\System\wgFGyEn.exe
  2⤵
  PID:5360
- C:\Windows\System\IXPqfHX.exe
  C:\Windows\System\IXPqfHX.exe
  2⤵
  PID:5384
- C:\Windows\System\xRtHAFa.exe
  C:\Windows\System\xRtHAFa.exe
  2⤵
  PID:5404
- C:\Windows\System\skMgsLl.exe
  C:\Windows\System\skMgsLl.exe
  2⤵
  PID:5428
- C:\Windows\System\VNxEHMf.exe
  C:\Windows\System\VNxEHMf.exe
  2⤵
  PID:5448
- C:\Windows\System\BzPljFN.exe
  C:\Windows\System\BzPljFN.exe
  2⤵
  PID:5488
- C:\Windows\System\MypnyPv.exe
  C:\Windows\System\MypnyPv.exe
  2⤵
  PID:5520
- C:\Windows\System\qgFTzAF.exe
  C:\Windows\System\qgFTzAF.exe
  2⤵
  PID:5540
- C:\Windows\System\pyclZIS.exe
  C:\Windows\System\pyclZIS.exe
  2⤵
  PID:5568
- C:\Windows\System\DtoGRTN.exe
  C:\Windows\System\DtoGRTN.exe
  2⤵
  PID:5588
- C:\Windows\System\sCmAzon.exe
  C:\Windows\System\sCmAzon.exe
  2⤵
  PID:5612
- C:\Windows\System\fFymEex.exe
  C:\Windows\System\fFymEex.exe
  2⤵
  PID:5632
- C:\Windows\System\espclPT.exe
  C:\Windows\System\espclPT.exe
  2⤵
  PID:5668
- C:\Windows\System\fygqzQF.exe
  C:\Windows\System\fygqzQF.exe
  2⤵
  PID:5736
- C:\Windows\System\uSQohnB.exe
  C:\Windows\System\uSQohnB.exe
  2⤵
  PID:5752
- C:\Windows\System\JbUUYCU.exe
  C:\Windows\System\JbUUYCU.exe
  2⤵
  PID:5776
- C:\Windows\System\LnCHbcy.exe
  C:\Windows\System\LnCHbcy.exe
  2⤵
  PID:5796
- C:\Windows\System\aGPDmmc.exe
  C:\Windows\System\aGPDmmc.exe
  2⤵
  PID:5824
- C:\Windows\System\rNIGjJD.exe
  C:\Windows\System\rNIGjJD.exe
  2⤵
  PID:5844
- C:\Windows\System\lHdtfGp.exe
  C:\Windows\System\lHdtfGp.exe
  2⤵
  PID:5900
- C:\Windows\System\ZpqBela.exe
  C:\Windows\System\ZpqBela.exe
  2⤵
  PID:5920
- C:\Windows\System\WEwGVYm.exe
  C:\Windows\System\WEwGVYm.exe
  2⤵
  PID:5940
- C:\Windows\System\yZEXnIA.exe
  C:\Windows\System\yZEXnIA.exe
  2⤵
  PID:5968
- C:\Windows\System\ldYjsrX.exe
  C:\Windows\System\ldYjsrX.exe
  2⤵
  PID:5996
- C:\Windows\System\FoORlRB.exe
  C:\Windows\System\FoORlRB.exe
  2⤵
  PID:6024
- C:\Windows\System\HVArRxZ.exe
  C:\Windows\System\HVArRxZ.exe
  2⤵
  PID:6052
- C:\Windows\System\fdIdIjF.exe
  C:\Windows\System\fdIdIjF.exe
  2⤵
  PID:6076
- C:\Windows\System\AvqbYMM.exe
  C:\Windows\System\AvqbYMM.exe
  2⤵
  PID:6092
- C:\Windows\System\qmJwlMf.exe
  C:\Windows\System\qmJwlMf.exe
  2⤵
  PID:6120
- C:\Windows\System\AilIPDk.exe
  C:\Windows\System\AilIPDk.exe
  2⤵
  PID:6140
- C:\Windows\System\DlCyquz.exe
  C:\Windows\System\DlCyquz.exe
  2⤵
  PID:1276
- C:\Windows\System\noEwhOp.exe
  C:\Windows\System\noEwhOp.exe
  2⤵
  PID:5228
- C:\Windows\System\feXkSKc.exe
  C:\Windows\System\feXkSKc.exe
  2⤵
  PID:5320
- C:\Windows\System\SPKWHpQ.exe
  C:\Windows\System\SPKWHpQ.exe
  2⤵
  PID:5372
- C:\Windows\System\BbrJVfp.exe
  C:\Windows\System\BbrJVfp.exe
  2⤵
  PID:5400
- C:\Windows\System\vDsQNgJ.exe
  C:\Windows\System\vDsQNgJ.exe
  2⤵
  PID:5444
- C:\Windows\System\DtIDgTs.exe
  C:\Windows\System\DtIDgTs.exe
  2⤵
  PID:5476
- C:\Windows\System\KnBTMnY.exe
  C:\Windows\System\KnBTMnY.exe
  2⤵
  PID:5528
- C:\Windows\System\NqecuyX.exe
  C:\Windows\System\NqecuyX.exe
  2⤵
  PID:5608
- C:\Windows\System\tTvpxaH.exe
  C:\Windows\System\tTvpxaH.exe
  2⤵
  PID:5564
- C:\Windows\System\NGDqHoG.exe
  C:\Windows\System\NGDqHoG.exe
  2⤵
  PID:5688
- C:\Windows\System\qTRDoMY.exe
  C:\Windows\System\qTRDoMY.exe
  2⤵
  PID:5724
- C:\Windows\System\KxODRgo.exe
  C:\Windows\System\KxODRgo.exe
  2⤵
  PID:5792
- C:\Windows\System\wxfKEjH.exe
  C:\Windows\System\wxfKEjH.exe
  2⤵
  PID:5872
- C:\Windows\System\lRJBMZU.exe
  C:\Windows\System\lRJBMZU.exe
  2⤵
  PID:6032
- C:\Windows\System\WEMgqws.exe
  C:\Windows\System\WEMgqws.exe
  2⤵
  PID:1044
- C:\Windows\System\odXVqsL.exe
  C:\Windows\System\odXVqsL.exe
  2⤵
  PID:2928
- C:\Windows\System\QfxswbN.exe
  C:\Windows\System\QfxswbN.exe
  2⤵
  PID:5180
- C:\Windows\System\xpKeaSf.exe
  C:\Windows\System\xpKeaSf.exe
  2⤵
  PID:5356
- C:\Windows\System\iKaahzT.exe
  C:\Windows\System\iKaahzT.exe
  2⤵
  PID:5552
- C:\Windows\System\HYwsYLy.exe
  C:\Windows\System\HYwsYLy.exe
  2⤵
  PID:5628
- C:\Windows\System\nIYTAEW.exe
  C:\Windows\System\nIYTAEW.exe
  2⤵
  PID:5624
- C:\Windows\System\Pxoynvs.exe
  C:\Windows\System\Pxoynvs.exe
  2⤵
  PID:5928
- C:\Windows\System\lNoqBOR.exe
  C:\Windows\System\lNoqBOR.exe
  2⤵
  PID:5988
- C:\Windows\System\EeJWwUf.exe
  C:\Windows\System\EeJWwUf.exe
  2⤵
  PID:5156
- C:\Windows\System\TnhQNIU.exe
  C:\Windows\System\TnhQNIU.exe
  2⤵
  PID:5160
- C:\Windows\System\gQIOGIK.exe
  C:\Windows\System\gQIOGIK.exe
  2⤵
  PID:5584
- C:\Windows\System\NCqlDwH.exe
  C:\Windows\System\NCqlDwH.exe
  2⤵
  PID:6128
- C:\Windows\System\cqRqRhQ.exe
  C:\Windows\System\cqRqRhQ.exe
  2⤵
  PID:6152
- C:\Windows\System\UudXyXX.exe
  C:\Windows\System\UudXyXX.exe
  2⤵
  PID:6180
- C:\Windows\System\ryGwUeS.exe
  C:\Windows\System\ryGwUeS.exe
  2⤵
  PID:6196
- C:\Windows\System\sZCgwbG.exe
  C:\Windows\System\sZCgwbG.exe
  2⤵
  PID:6248
- C:\Windows\System\TAGsemO.exe
  C:\Windows\System\TAGsemO.exe
  2⤵
  PID:6264
- C:\Windows\System\qgeKRia.exe
  C:\Windows\System\qgeKRia.exe
  2⤵
  PID:6284
- C:\Windows\System\cWCWClz.exe
  C:\Windows\System\cWCWClz.exe
  2⤵
  PID:6348
- C:\Windows\System\uUquKCs.exe
  C:\Windows\System\uUquKCs.exe
  2⤵
  PID:6392
- C:\Windows\System\TTjCuoq.exe
  C:\Windows\System\TTjCuoq.exe
  2⤵
  PID:6416
- C:\Windows\System\ktwXFFC.exe
  C:\Windows\System\ktwXFFC.exe
  2⤵
  PID:6436
- C:\Windows\System\lQJoGNG.exe
  C:\Windows\System\lQJoGNG.exe
  2⤵
  PID:6464
- C:\Windows\System\YKTSseF.exe
  C:\Windows\System\YKTSseF.exe
  2⤵
  PID:6492
- C:\Windows\System\WjzUzls.exe
  C:\Windows\System\WjzUzls.exe
  2⤵
  PID:6508
- C:\Windows\System\AwogUue.exe
  C:\Windows\System\AwogUue.exe
  2⤵
  PID:6556
- C:\Windows\System\UisZsSA.exe
  C:\Windows\System\UisZsSA.exe
  2⤵
  PID:6576
- C:\Windows\System\MyFQPKe.exe
  C:\Windows\System\MyFQPKe.exe
  2⤵
  PID:6604
- C:\Windows\System\OADspGp.exe
  C:\Windows\System\OADspGp.exe
  2⤵
  PID:6624
- C:\Windows\System\OWAxVUu.exe
  C:\Windows\System\OWAxVUu.exe
  2⤵
  PID:6644
- C:\Windows\System\uLLlXqr.exe
  C:\Windows\System\uLLlXqr.exe
  2⤵
  PID:6664
- C:\Windows\System\farfNFr.exe
  C:\Windows\System\farfNFr.exe
  2⤵
  PID:6684
- C:\Windows\System\hvEBmft.exe
  C:\Windows\System\hvEBmft.exe
  2⤵
  PID:6736
- C:\Windows\System\mlwQvFt.exe
  C:\Windows\System\mlwQvFt.exe
  2⤵
  PID:6776
- C:\Windows\System\DYpIerY.exe
  C:\Windows\System\DYpIerY.exe
  2⤵
  PID:6796
- C:\Windows\System\DpJOkhz.exe
  C:\Windows\System\DpJOkhz.exe
  2⤵
  PID:6816
- C:\Windows\System\DKDnrCc.exe
  C:\Windows\System\DKDnrCc.exe
  2⤵
  PID:6856
- C:\Windows\System\GJmcpYv.exe
  C:\Windows\System\GJmcpYv.exe
  2⤵
  PID:6884
- C:\Windows\System\EiMowFk.exe
  C:\Windows\System\EiMowFk.exe
  2⤵
  PID:6900
- C:\Windows\System\sSjFBTl.exe
  C:\Windows\System\sSjFBTl.exe
  2⤵
  PID:6924
- C:\Windows\System\wXBLAFl.exe
  C:\Windows\System\wXBLAFl.exe
  2⤵
  PID:6948
- C:\Windows\System\bHRnhog.exe
  C:\Windows\System\bHRnhog.exe
  2⤵
  PID:6964
- C:\Windows\System\wkeDImn.exe
  C:\Windows\System\wkeDImn.exe
  2⤵
  PID:6980
- C:\Windows\System\UCZZcCa.exe
  C:\Windows\System\UCZZcCa.exe
  2⤵
  PID:7048
- C:\Windows\System\heVSKHn.exe
  C:\Windows\System\heVSKHn.exe
  2⤵
  PID:7064
- C:\Windows\System\zVHYRYc.exe
  C:\Windows\System\zVHYRYc.exe
  2⤵
  PID:7084
- C:\Windows\System\xOuBPMG.exe
  C:\Windows\System\xOuBPMG.exe
  2⤵
  PID:7136
- C:\Windows\System\QVEcqHB.exe
  C:\Windows\System\QVEcqHB.exe
  2⤵
  PID:5856
- C:\Windows\System\JpwcrYy.exe
  C:\Windows\System\JpwcrYy.exe
  2⤵
  PID:4736
- C:\Windows\System\ajdqOoA.exe
  C:\Windows\System\ajdqOoA.exe
  2⤵
  PID:6276
- C:\Windows\System\IcWEThr.exe
  C:\Windows\System\IcWEThr.exe
  2⤵
  PID:6232
- C:\Windows\System\xWIgvzB.exe
  C:\Windows\System\xWIgvzB.exe
  2⤵
  PID:6368
- C:\Windows\System\EbcOVxK.exe
  C:\Windows\System\EbcOVxK.exe
  2⤵
  PID:6404
- C:\Windows\System\foWsnXN.exe
  C:\Windows\System\foWsnXN.exe
  2⤵
  PID:6444
- C:\Windows\System\iQCjORe.exe
  C:\Windows\System\iQCjORe.exe
  2⤵
  PID:6660
- C:\Windows\System\ALfWlak.exe
  C:\Windows\System\ALfWlak.exe
  2⤵
  PID:6676
- C:\Windows\System\NeQZOfJ.exe
  C:\Windows\System\NeQZOfJ.exe
  2⤵
  PID:6788
- C:\Windows\System\QMsbMup.exe
  C:\Windows\System\QMsbMup.exe
  2⤵
  PID:6812
- C:\Windows\System\yMbiYlJ.exe
  C:\Windows\System\yMbiYlJ.exe
  2⤵
  PID:6864
- C:\Windows\System\pAPZRsP.exe
  C:\Windows\System\pAPZRsP.exe
  2⤵
  PID:6936
- C:\Windows\System\vjBEzjw.exe
  C:\Windows\System\vjBEzjw.exe
  2⤵
  PID:7008
- C:\Windows\System\VNIorwd.exe
  C:\Windows\System\VNIorwd.exe
  2⤵
  PID:6976
- C:\Windows\System\BNXvcCg.exe
  C:\Windows\System\BNXvcCg.exe
  2⤵
  PID:5652
- C:\Windows\System\jGsgnlH.exe
  C:\Windows\System\jGsgnlH.exe
  2⤵
  PID:6160
- C:\Windows\System\CehfkOf.exe
  C:\Windows\System\CehfkOf.exe
  2⤵
  PID:6320
- C:\Windows\System\roGbeeA.exe
  C:\Windows\System\roGbeeA.exe
  2⤵
  PID:6432
- C:\Windows\System\pXzwzDh.exe
  C:\Windows\System\pXzwzDh.exe
  2⤵
  PID:6632
- C:\Windows\System\xbTQRwH.exe
  C:\Windows\System\xbTQRwH.exe
  2⤵
  PID:6720
- C:\Windows\System\DLhvuPL.exe
  C:\Windows\System\DLhvuPL.exe
  2⤵
  PID:6836
- C:\Windows\System\syfzzCf.exe
  C:\Windows\System\syfzzCf.exe
  2⤵
  PID:7020
- C:\Windows\System\cpvKIjI.exe
  C:\Windows\System\cpvKIjI.exe
  2⤵
  PID:6536
- C:\Windows\System\eXFTKjI.exe
  C:\Windows\System\eXFTKjI.exe
  2⤵
  PID:6712
- C:\Windows\System\gunKQIB.exe
  C:\Windows\System\gunKQIB.exe
  2⤵
  PID:7164
- C:\Windows\System\OXieksN.exe
  C:\Windows\System\OXieksN.exe
  2⤵
  PID:6992
- C:\Windows\System\gGIAvkE.exe
  C:\Windows\System\gGIAvkE.exe
  2⤵
  PID:7176
- C:\Windows\System\JRQDCBO.exe
  C:\Windows\System\JRQDCBO.exe
  2⤵
  PID:7228
- C:\Windows\System\eOonYmR.exe
  C:\Windows\System\eOonYmR.exe
  2⤵
  PID:7256
- C:\Windows\System\dSWTGfY.exe
  C:\Windows\System\dSWTGfY.exe
  2⤵
  PID:7272
- C:\Windows\System\DouWPoy.exe
  C:\Windows\System\DouWPoy.exe
  2⤵
  PID:7296
- C:\Windows\System\ZrNnBXZ.exe
  C:\Windows\System\ZrNnBXZ.exe
  2⤵
  PID:7324
- C:\Windows\System\IUzHniQ.exe
  C:\Windows\System\IUzHniQ.exe
  2⤵
  PID:7364
- C:\Windows\System\QyhJuFA.exe
  C:\Windows\System\QyhJuFA.exe
  2⤵
  PID:7396
- C:\Windows\System\ppPQDdV.exe
  C:\Windows\System\ppPQDdV.exe
  2⤵
  PID:7416
- C:\Windows\System\ecDBAmN.exe
  C:\Windows\System\ecDBAmN.exe
  2⤵
  PID:7456
- C:\Windows\System\nDHFfVH.exe
  C:\Windows\System\nDHFfVH.exe
  2⤵
  PID:7472
- C:\Windows\System\HCFUbyG.exe
  C:\Windows\System\HCFUbyG.exe
  2⤵
  PID:7492
- C:\Windows\System\jHYVoXj.exe
  C:\Windows\System\jHYVoXj.exe
  2⤵
  PID:7520
- C:\Windows\System\zqVuyTF.exe
  C:\Windows\System\zqVuyTF.exe
  2⤵
  PID:7548
- C:\Windows\System\ICOcGGD.exe
  C:\Windows\System\ICOcGGD.exe
  2⤵
  PID:7580
- C:\Windows\System\VHJcUoI.exe
  C:\Windows\System\VHJcUoI.exe
  2⤵
  PID:7600
- C:\Windows\System\yGJjQGQ.exe
  C:\Windows\System\yGJjQGQ.exe
  2⤵
  PID:7620
- C:\Windows\System\yXgJISH.exe
  C:\Windows\System\yXgJISH.exe
  2⤵
  PID:7672
- C:\Windows\System\CpXpWSY.exe
  C:\Windows\System\CpXpWSY.exe
  2⤵
  PID:7704
- C:\Windows\System\lNOKHot.exe
  C:\Windows\System\lNOKHot.exe
  2⤵
  PID:7724
- C:\Windows\System\WZdhcGo.exe
  C:\Windows\System\WZdhcGo.exe
  2⤵
  PID:7744
- C:\Windows\System\LCnONev.exe
  C:\Windows\System\LCnONev.exe
  2⤵
  PID:7768
- C:\Windows\System\fNFfZzl.exe
  C:\Windows\System\fNFfZzl.exe
  2⤵
  PID:7788
- C:\Windows\System\INmfldq.exe
  C:\Windows\System\INmfldq.exe
  2⤵
  PID:7816
- C:\Windows\System\uGMHbhJ.exe
  C:\Windows\System\uGMHbhJ.exe
  2⤵
  PID:7840
- C:\Windows\System\WjpKntw.exe
  C:\Windows\System\WjpKntw.exe
  2⤵
  PID:7876
- C:\Windows\System\onIUaFS.exe
  C:\Windows\System\onIUaFS.exe
  2⤵
  PID:7904
- C:\Windows\System\ysjkpUr.exe
  C:\Windows\System\ysjkpUr.exe
  2⤵
  PID:7928
- C:\Windows\System\ABsLhGb.exe
  C:\Windows\System\ABsLhGb.exe
  2⤵
  PID:7952
- C:\Windows\System\lFiSreL.exe
  C:\Windows\System\lFiSreL.exe
  2⤵
  PID:7996
- C:\Windows\System\KmPGTBn.exe
  C:\Windows\System\KmPGTBn.exe
  2⤵
  PID:8024
- C:\Windows\System\jDwsdXR.exe
  C:\Windows\System\jDwsdXR.exe
  2⤵
  PID:8052
- C:\Windows\System\OJyEwBj.exe
  C:\Windows\System\OJyEwBj.exe
  2⤵
  PID:8084
- C:\Windows\System\XtczqbY.exe
  C:\Windows\System\XtczqbY.exe
  2⤵
  PID:8112
- C:\Windows\System\GpZMtNG.exe
  C:\Windows\System\GpZMtNG.exe
  2⤵
  PID:8136
- C:\Windows\System\WfMwHQD.exe
  C:\Windows\System\WfMwHQD.exe
  2⤵
  PID:8156
- C:\Windows\System\VhmBsJO.exe
  C:\Windows\System\VhmBsJO.exe
  2⤵
  PID:6588
- C:\Windows\System\IyTpunN.exe
  C:\Windows\System\IyTpunN.exe
  2⤵
  PID:7224
- C:\Windows\System\aansiOw.exe
  C:\Windows\System\aansiOw.exe
  2⤵
  PID:7440
- C:\Windows\System\XpBpsYI.exe
  C:\Windows\System\XpBpsYI.exe
  2⤵
  PID:7488
- C:\Windows\System\gkRzpOY.exe
  C:\Windows\System\gkRzpOY.exe
  2⤵
  PID:7544
- C:\Windows\System\drNSYhy.exe
  C:\Windows\System\drNSYhy.exe
  2⤵
  PID:7568
- C:\Windows\System\RRUvwwr.exe
  C:\Windows\System\RRUvwwr.exe
  2⤵
  PID:7628
- C:\Windows\System\iWpqKxg.exe
  C:\Windows\System\iWpqKxg.exe
  2⤵
  PID:7612
- C:\Windows\System\nCSkoLM.exe
  C:\Windows\System\nCSkoLM.exe
  2⤵
  PID:7668
- C:\Windows\System\PzvDQBL.exe
  C:\Windows\System\PzvDQBL.exe
  2⤵
  PID:7716
- C:\Windows\System\RrbsHEd.exe
  C:\Windows\System\RrbsHEd.exe
  2⤵
  PID:7760
- C:\Windows\System\VFNyqfX.exe
  C:\Windows\System\VFNyqfX.exe
  2⤵
  PID:7808
- C:\Windows\System\qPEPbNW.exe
  C:\Windows\System\qPEPbNW.exe
  2⤵
  PID:7868
- C:\Windows\System\ecISuYu.exe
  C:\Windows\System\ecISuYu.exe
  2⤵
  PID:7856
- C:\Windows\System\CLmIwQA.exe
  C:\Windows\System\CLmIwQA.exe
  2⤵
  PID:7920
- C:\Windows\System\yWTIwMF.exe
  C:\Windows\System\yWTIwMF.exe
  2⤵
  PID:7992
- C:\Windows\System\vhoqnmO.exe
  C:\Windows\System\vhoqnmO.exe
  2⤵
  PID:7944
- C:\Windows\System\FpMaCMF.exe
  C:\Windows\System\FpMaCMF.exe
  2⤵
  PID:8016
- C:\Windows\System\chMmjvi.exe
  C:\Windows\System\chMmjvi.exe
  2⤵
  PID:8036
- C:\Windows\System\YRWrlTA.exe
  C:\Windows\System\YRWrlTA.exe
  2⤵
  PID:8100
- C:\Windows\System\EWwEoyt.exe
  C:\Windows\System\EWwEoyt.exe
  2⤵
  PID:8144
- C:\Windows\System\ReiNhbc.exe
  C:\Windows\System\ReiNhbc.exe
  2⤵
  PID:7528
- C:\Windows\System\uFiarZN.exe
  C:\Windows\System\uFiarZN.exe
  2⤵
  PID:7648
- C:\Windows\System\sqCMLMC.exe
  C:\Windows\System\sqCMLMC.exe
  2⤵
  PID:7408
- C:\Windows\System\LHhZRZF.exe
  C:\Windows\System\LHhZRZF.exe
  2⤵
  PID:7356
- C:\Windows\System\cLLhcbh.exe
  C:\Windows\System\cLLhcbh.exe
  2⤵
  PID:7436
- C:\Windows\System\rEVzpsZ.exe
  C:\Windows\System\rEVzpsZ.exe
  2⤵
  PID:7664
- C:\Windows\System\CZhkuia.exe
  C:\Windows\System\CZhkuia.exe
  2⤵
  PID:8236
- C:\Windows\System\ZBsEaHy.exe
  C:\Windows\System\ZBsEaHy.exe
  2⤵
  PID:8252
- C:\Windows\System\ihwqQLy.exe
  C:\Windows\System\ihwqQLy.exe
  2⤵
  PID:8276
- C:\Windows\System\RiFJqkq.exe
  C:\Windows\System\RiFJqkq.exe
  2⤵
  PID:8372
- C:\Windows\System\yAsqAOY.exe
  C:\Windows\System\yAsqAOY.exe
  2⤵
  PID:8412
- C:\Windows\System\slCpqPL.exe
  C:\Windows\System\slCpqPL.exe
  2⤵
  PID:8440
- C:\Windows\System\nWlggKC.exe
  C:\Windows\System\nWlggKC.exe
  2⤵
  PID:8456
- C:\Windows\System\xaAkKqB.exe
  C:\Windows\System\xaAkKqB.exe
  2⤵
  PID:8472
- C:\Windows\System\fTTTLhu.exe
  C:\Windows\System\fTTTLhu.exe
  2⤵
  PID:8496
- C:\Windows\System\NJQTSUO.exe
  C:\Windows\System\NJQTSUO.exe
  2⤵
  PID:8516
- C:\Windows\System\PDPpeQG.exe
  C:\Windows\System\PDPpeQG.exe
  2⤵
  PID:8568
- C:\Windows\System\pfrMkvE.exe
  C:\Windows\System\pfrMkvE.exe
  2⤵
  PID:8592
- C:\Windows\System\eJPUjpY.exe
  C:\Windows\System\eJPUjpY.exe
  2⤵
  PID:8660
- C:\Windows\System\PppNGeL.exe
  C:\Windows\System\PppNGeL.exe
  2⤵
  PID:8680
- C:\Windows\System\Ffbciri.exe
  C:\Windows\System\Ffbciri.exe
  2⤵
  PID:8700
- C:\Windows\System\ySVXeit.exe
  C:\Windows\System\ySVXeit.exe
  2⤵
  PID:8740
- C:\Windows\System\qtMBEkm.exe
  C:\Windows\System\qtMBEkm.exe
  2⤵
  PID:8760
- C:\Windows\System\tkOUJSj.exe
  C:\Windows\System\tkOUJSj.exe
  2⤵
  PID:8788
- C:\Windows\System\ObSTkDp.exe
  C:\Windows\System\ObSTkDp.exe
  2⤵
  PID:8824
- C:\Windows\System\YpmFjgf.exe
  C:\Windows\System\YpmFjgf.exe
  2⤵
  PID:8844
- C:\Windows\System\wcENXwO.exe
  C:\Windows\System\wcENXwO.exe
  2⤵
  PID:8868
- C:\Windows\System\ByNVZIu.exe
  C:\Windows\System\ByNVZIu.exe
  2⤵
  PID:8908
- C:\Windows\System\CsoYOZO.exe
  C:\Windows\System\CsoYOZO.exe
  2⤵
  PID:8932
- C:\Windows\System\xkKsKqq.exe
  C:\Windows\System\xkKsKqq.exe
  2⤵
  PID:8964
- C:\Windows\System\AisLkCB.exe
  C:\Windows\System\AisLkCB.exe
  2⤵
  PID:8980
- C:\Windows\System\JSHAKmh.exe
  C:\Windows\System\JSHAKmh.exe
  2⤵
  PID:9000
- C:\Windows\System\DwnWJbM.exe
  C:\Windows\System\DwnWJbM.exe
  2⤵
  PID:9016
- C:\Windows\System\PGAhFRZ.exe
  C:\Windows\System\PGAhFRZ.exe
  2⤵
  PID:9040
- C:\Windows\System\ugwLmku.exe
  C:\Windows\System\ugwLmku.exe
  2⤵
  PID:9072
- C:\Windows\System\akQWqJi.exe
  C:\Windows\System\akQWqJi.exe
  2⤵
  PID:9120
- C:\Windows\System\WyiWSTv.exe
  C:\Windows\System\WyiWSTv.exe
  2⤵
  PID:9144
- C:\Windows\System\gqSXvQt.exe
  C:\Windows\System\gqSXvQt.exe
  2⤵
  PID:9172
- C:\Windows\System\wHLwpjO.exe
  C:\Windows\System\wHLwpjO.exe
  2⤵
  PID:9192
- C:\Windows\System\sbSvyId.exe
  C:\Windows\System\sbSvyId.exe
  2⤵
  PID:7824
- C:\Windows\System\HIVuzVG.exe
  C:\Windows\System\HIVuzVG.exe
  2⤵
  PID:7360
- C:\Windows\System\AUnBrPR.exe
  C:\Windows\System\AUnBrPR.exe
  2⤵
  PID:8284
- C:\Windows\System\tDOSkWA.exe
  C:\Windows\System\tDOSkWA.exe
  2⤵
  PID:7344
- C:\Windows\System\fotqRjH.exe
  C:\Windows\System\fotqRjH.exe
  2⤵
  PID:8200
- C:\Windows\System\rkbJMhk.exe
  C:\Windows\System\rkbJMhk.exe
  2⤵
  PID:8336
- C:\Windows\System\GVeaZuU.exe
  C:\Windows\System\GVeaZuU.exe
  2⤵
  PID:8380
- C:\Windows\System\ZRgstMQ.exe
  C:\Windows\System\ZRgstMQ.exe
  2⤵
  PID:8436
- C:\Windows\System\wRpUJHx.exe
  C:\Windows\System\wRpUJHx.exe
  2⤵
  PID:8484
- C:\Windows\System\HkoUvxh.exe
  C:\Windows\System\HkoUvxh.exe
  2⤵
  PID:8584
- C:\Windows\System\faHoHMQ.exe
  C:\Windows\System\faHoHMQ.exe
  2⤵
  PID:8552
- C:\Windows\System\MipuPbV.exe
  C:\Windows\System\MipuPbV.exe
  2⤵
  PID:8652
- C:\Windows\System\RrFsJHI.exe
  C:\Windows\System\RrFsJHI.exe
  2⤵
  PID:8852
- C:\Windows\System\dtzCtWw.exe
  C:\Windows\System\dtzCtWw.exe
  2⤵
  PID:8856
- C:\Windows\System\MFXpKkg.exe
  C:\Windows\System\MFXpKkg.exe
  2⤵
  PID:8916
- C:\Windows\System\UIoYEeW.exe
  C:\Windows\System\UIoYEeW.exe
  2⤵
  PID:8976
- C:\Windows\System\yMmevpf.exe
  C:\Windows\System\yMmevpf.exe
  2⤵
  PID:9036
- C:\Windows\System\hLXInSD.exe
  C:\Windows\System\hLXInSD.exe
  2⤵
  PID:9064
- C:\Windows\System\TeOERSK.exe
  C:\Windows\System\TeOERSK.exe
  2⤵
  PID:7804
- C:\Windows\System\mEmezwg.exe
  C:\Windows\System\mEmezwg.exe
  2⤵
  PID:7988
- C:\Windows\System\SbDYqSA.exe
  C:\Windows\System\SbDYqSA.exe
  2⤵
  PID:8332
- C:\Windows\System\CdxjyYl.exe
  C:\Windows\System\CdxjyYl.exe
  2⤵
  PID:8512
- C:\Windows\System\WsHQBEz.exe
  C:\Windows\System\WsHQBEz.exe
  2⤵
  PID:8556
- C:\Windows\System\fgcvzZx.exe
  C:\Windows\System\fgcvzZx.exe
  2⤵
  PID:8836
- C:\Windows\System\DiOvQxY.exe
  C:\Windows\System\DiOvQxY.exe
  2⤵
  PID:8960
- C:\Windows\System\qtoLRfZ.exe
  C:\Windows\System\qtoLRfZ.exe
  2⤵
  PID:9108
- C:\Windows\System\FmdhITE.exe
  C:\Windows\System\FmdhITE.exe
  2⤵
  PID:9180
- C:\Windows\System\QiactyJ.exe
  C:\Windows\System\QiactyJ.exe
  2⤵
  PID:7740
- C:\Windows\System\kJpcyQO.exe
  C:\Windows\System\kJpcyQO.exe
  2⤵
  PID:8768
- C:\Windows\System\oYNdIip.exe
  C:\Windows\System\oYNdIip.exe
  2⤵
  PID:9008
- C:\Windows\System\LaMvROv.exe
  C:\Windows\System\LaMvROv.exe
  2⤵
  PID:9200
- C:\Windows\System\tyyLzMs.exe
  C:\Windows\System\tyyLzMs.exe
  2⤵
  PID:8544
- C:\Windows\System\tOVCfdC.exe
  C:\Windows\System\tOVCfdC.exe
  2⤵
  PID:9236
- C:\Windows\System\tTDMFmv.exe
  C:\Windows\System\tTDMFmv.exe
  2⤵
  PID:9264
- C:\Windows\System\OssKQbH.exe
  C:\Windows\System\OssKQbH.exe
  2⤵
  PID:9284
- C:\Windows\System\qeajHsj.exe
  C:\Windows\System\qeajHsj.exe
  2⤵
  PID:9308
- C:\Windows\System\PZgcBgI.exe
  C:\Windows\System\PZgcBgI.exe
  2⤵
  PID:9336
- C:\Windows\System\sPhbVkS.exe
  C:\Windows\System\sPhbVkS.exe
  2⤵
  PID:9388
- C:\Windows\System\eRSADsp.exe
  C:\Windows\System\eRSADsp.exe
  2⤵
  PID:9412
- C:\Windows\System\ggPCEhk.exe
  C:\Windows\System\ggPCEhk.exe
  2⤵
  PID:9432
- C:\Windows\System\pnuBnzp.exe
  C:\Windows\System\pnuBnzp.exe
  2⤵
  PID:9456
- C:\Windows\System\SiCtcSF.exe
  C:\Windows\System\SiCtcSF.exe
  2⤵
  PID:9472
- C:\Windows\System\UKUjpty.exe
  C:\Windows\System\UKUjpty.exe
  2⤵
  PID:9492
- C:\Windows\System\ddxpFwJ.exe
  C:\Windows\System\ddxpFwJ.exe
  2⤵
  PID:9508
- C:\Windows\System\EdNBHKB.exe
  C:\Windows\System\EdNBHKB.exe
  2⤵
  PID:9548
- C:\Windows\System\ixlYHST.exe
  C:\Windows\System\ixlYHST.exe
  2⤵
  PID:9600
- C:\Windows\System\zSNHfJF.exe
  C:\Windows\System\zSNHfJF.exe
  2⤵
  PID:9624
- C:\Windows\System\WKHFgNB.exe
  C:\Windows\System\WKHFgNB.exe
  2⤵
  PID:9660
- C:\Windows\System\LjUCIdp.exe
  C:\Windows\System\LjUCIdp.exe
  2⤵
  PID:9676
- C:\Windows\System\XurZxVw.exe
  C:\Windows\System\XurZxVw.exe
  2⤵
  PID:9716
- C:\Windows\System\fofmoeW.exe
  C:\Windows\System\fofmoeW.exe
  2⤵
  PID:9736
- C:\Windows\System\OBMrcjH.exe
  C:\Windows\System\OBMrcjH.exe
  2⤵
  PID:9756
- C:\Windows\System\FSzGCXc.exe
  C:\Windows\System\FSzGCXc.exe
  2⤵
  PID:9780
- C:\Windows\System\xydHZcn.exe
  C:\Windows\System\xydHZcn.exe
  2⤵
  PID:9812
- C:\Windows\System\alAnAgX.exe
  C:\Windows\System\alAnAgX.exe
  2⤵
  PID:9844
- C:\Windows\System\ppsTlQM.exe
  C:\Windows\System\ppsTlQM.exe
  2⤵
  PID:9864
- C:\Windows\System\gTUYaKL.exe
  C:\Windows\System\gTUYaKL.exe
  2⤵
  PID:9888
- C:\Windows\System\SccmSBC.exe
  C:\Windows\System\SccmSBC.exe
  2⤵
  PID:9912
- C:\Windows\System\kdOufyo.exe
  C:\Windows\System\kdOufyo.exe
  2⤵
  PID:9960
- C:\Windows\System\lRvAJuj.exe
  C:\Windows\System\lRvAJuj.exe
  2⤵
  PID:9996
- C:\Windows\System\ytxCaMJ.exe
  C:\Windows\System\ytxCaMJ.exe
  2⤵
  PID:10024
- C:\Windows\System\nbbDncq.exe
  C:\Windows\System\nbbDncq.exe
  2⤵
  PID:10064
- C:\Windows\System\tXttNix.exe
  C:\Windows\System\tXttNix.exe
  2⤵
  PID:10088
- C:\Windows\System\jaIJhUA.exe
  C:\Windows\System\jaIJhUA.exe
  2⤵
  PID:10124
- C:\Windows\System\uCHwCKr.exe
  C:\Windows\System\uCHwCKr.exe
  2⤵
  PID:10148
- C:\Windows\System\hxKpRhp.exe
  C:\Windows\System\hxKpRhp.exe
  2⤵
  PID:10168
- C:\Windows\System\DmYLsPt.exe
  C:\Windows\System\DmYLsPt.exe
  2⤵
  PID:10200
- C:\Windows\System\DoQqNEE.exe
  C:\Windows\System\DoQqNEE.exe
  2⤵
  PID:10216
- C:\Windows\System\jyiuNmZ.exe
  C:\Windows\System\jyiuNmZ.exe
  2⤵
  PID:9260
- C:\Windows\System\qrLfbmF.exe
  C:\Windows\System\qrLfbmF.exe
  2⤵
  PID:9316
- C:\Windows\System\fYOGXqv.exe
  C:\Windows\System\fYOGXqv.exe
  2⤵
  PID:9384
- C:\Windows\System\BpWzSNp.exe
  C:\Windows\System\BpWzSNp.exe
  2⤵
  PID:9464
- C:\Windows\System\jDBDTDk.exe
  C:\Windows\System\jDBDTDk.exe
  2⤵
  PID:9484
- C:\Windows\System\LEKiTyf.exe
  C:\Windows\System\LEKiTyf.exe
  2⤵
  PID:9544
- C:\Windows\System\nXESpWy.exe
  C:\Windows\System\nXESpWy.exe
  2⤵
  PID:9620
- C:\Windows\System\TCtYxDV.exe
  C:\Windows\System\TCtYxDV.exe
  2⤵
  PID:9724
- C:\Windows\System\NbCUfMn.exe
  C:\Windows\System\NbCUfMn.exe
  2⤵
  PID:9772
- C:\Windows\System\ackLDjA.exe
  C:\Windows\System\ackLDjA.exe
  2⤵
  PID:9908
- C:\Windows\System\nVLAafO.exe
  C:\Windows\System\nVLAafO.exe
  2⤵
  PID:9880
- C:\Windows\System\YjRXJNd.exe
  C:\Windows\System\YjRXJNd.exe
  2⤵
  PID:9928
- C:\Windows\System\OVEAFzS.exe
  C:\Windows\System\OVEAFzS.exe
  2⤵
  PID:10004
- C:\Windows\System\lytFHpU.exe
  C:\Windows\System\lytFHpU.exe
  2⤵
  PID:10112
- C:\Windows\System\EhJxFIE.exe
  C:\Windows\System\EhJxFIE.exe
  2⤵
  PID:10176
- C:\Windows\System\qrWDzjO.exe
  C:\Windows\System\qrWDzjO.exe
  2⤵
  PID:10232
- C:\Windows\System\ThhPgzn.exe
  C:\Windows\System\ThhPgzn.exe
  2⤵
  PID:9380
- C:\Windows\System\XvPlkCM.exe
  C:\Windows\System\XvPlkCM.exe
  2⤵
  PID:9440
- C:\Windows\System\TtskgbO.exe
  C:\Windows\System\TtskgbO.exe
  2⤵
  PID:9532
- C:\Windows\System\LHpfkXC.exe
  C:\Windows\System\LHpfkXC.exe
  2⤵
  PID:9728
- C:\Windows\System\tndnRqa.exe
  C:\Windows\System\tndnRqa.exe
  2⤵
  PID:9872
- C:\Windows\System\KewBMFn.exe
  C:\Windows\System\KewBMFn.exe
  2⤵
  PID:10056
- C:\Windows\System\Tvzhgzb.exe
  C:\Windows\System\Tvzhgzb.exe
  2⤵
  PID:10212
- C:\Windows\System\jcyCJCh.exe
  C:\Windows\System\jcyCJCh.exe
  2⤵
  PID:10040
- C:\Windows\System\TbwMqoc.exe
  C:\Windows\System\TbwMqoc.exe
  2⤵
  PID:9936
- C:\Windows\System\FqggahD.exe
  C:\Windows\System\FqggahD.exe
  2⤵
  PID:9428
- C:\Windows\System\aaodaQh.exe
  C:\Windows\System\aaodaQh.exe
  2⤵
  PID:10252
- C:\Windows\System\QiXOZoL.exe
  C:\Windows\System\QiXOZoL.exe
  2⤵
  PID:10268
- C:\Windows\System\cweKGec.exe
  C:\Windows\System\cweKGec.exe
  2⤵
  PID:10284
- C:\Windows\System\OEpzCiQ.exe
  C:\Windows\System\OEpzCiQ.exe
  2⤵
  PID:10300
- C:\Windows\System\oZzgVDl.exe
  C:\Windows\System\oZzgVDl.exe
  2⤵
  PID:10336
- C:\Windows\System\emdiQuw.exe
  C:\Windows\System\emdiQuw.exe
  2⤵
  PID:10368
- C:\Windows\System\HlgSXhG.exe
  C:\Windows\System\HlgSXhG.exe
  2⤵
  PID:10396
- C:\Windows\System\sIakvtl.exe
  C:\Windows\System\sIakvtl.exe
  2⤵
  PID:10428
- C:\Windows\System\qBsBJRD.exe
  C:\Windows\System\qBsBJRD.exe
  2⤵
  PID:10464
- C:\Windows\System\vLSxtYU.exe
  C:\Windows\System\vLSxtYU.exe
  2⤵
  PID:10480
- C:\Windows\System\gpNdBUr.exe
  C:\Windows\System\gpNdBUr.exe
  2⤵
  PID:10500
- C:\Windows\System\jDblxmQ.exe
  C:\Windows\System\jDblxmQ.exe
  2⤵
  PID:10524
- C:\Windows\System\NoNrNBN.exe
  C:\Windows\System\NoNrNBN.exe
  2⤵
  PID:10544
- C:\Windows\System\TqTMUSc.exe
  C:\Windows\System\TqTMUSc.exe
  2⤵
  PID:10584
- C:\Windows\System\bVwmQYj.exe
  C:\Windows\System\bVwmQYj.exe
  2⤵
  PID:10608
- C:\Windows\System\EFsimwi.exe
  C:\Windows\System\EFsimwi.exe
  2⤵
  PID:10628
- C:\Windows\System\YIWpfYw.exe
  C:\Windows\System\YIWpfYw.exe
  2⤵
  PID:10652
- C:\Windows\System\zWcazzV.exe
  C:\Windows\System\zWcazzV.exe
  2⤵
  PID:10672
- C:\Windows\System\wDTftjZ.exe
  C:\Windows\System\wDTftjZ.exe
  2⤵
  PID:10692
- C:\Windows\System\SEumJNL.exe
  C:\Windows\System\SEumJNL.exe
  2⤵
  PID:10724
- C:\Windows\System\YCfmJBD.exe
  C:\Windows\System\YCfmJBD.exe
  2⤵
  PID:10744
- C:\Windows\System\kDMCEKu.exe
  C:\Windows\System\kDMCEKu.exe
  2⤵
  PID:10820
- C:\Windows\System\LxcrePb.exe
  C:\Windows\System\LxcrePb.exe
  2⤵
  PID:10840
- C:\Windows\System\TOLVuWs.exe
  C:\Windows\System\TOLVuWs.exe
  2⤵
  PID:10860
- C:\Windows\System\zmDrwlm.exe
  C:\Windows\System\zmDrwlm.exe
  2⤵
  PID:10876
- C:\Windows\System\kbKrvrP.exe
  C:\Windows\System\kbKrvrP.exe
  2⤵
  PID:10928
- C:\Windows\System\OphxEhg.exe
  C:\Windows\System\OphxEhg.exe
  2⤵
  PID:10964
- C:\Windows\System\evQaQxM.exe
  C:\Windows\System\evQaQxM.exe
  2⤵
  PID:10984
- C:\Windows\System\qvbsVxL.exe
  C:\Windows\System\qvbsVxL.exe
  2⤵
  PID:11008
- C:\Windows\System\sztfKoH.exe
  C:\Windows\System\sztfKoH.exe
  2⤵
  PID:11028
- C:\Windows\System\TCCFWle.exe
  C:\Windows\System\TCCFWle.exe
  2⤵
  PID:11076
- C:\Windows\System\nukPdkI.exe
  C:\Windows\System\nukPdkI.exe
  2⤵
  PID:11092
- C:\Windows\System\hBBqJMT.exe
  C:\Windows\System\hBBqJMT.exe
  2⤵
  PID:11112
- C:\Windows\System\oEzGkXH.exe
  C:\Windows\System\oEzGkXH.exe
  2⤵
  PID:11132
- C:\Windows\System\QmBDTnr.exe
  C:\Windows\System\QmBDTnr.exe
  2⤵
  PID:11160
- C:\Windows\System\JeMQaxM.exe
  C:\Windows\System\JeMQaxM.exe
  2⤵
  PID:11188
- C:\Windows\System\IDclSPB.exe
  C:\Windows\System\IDclSPB.exe
  2⤵
  PID:11216
- C:\Windows\System\ByooNxP.exe
  C:\Windows\System\ByooNxP.exe
  2⤵
  PID:11240
- C:\Windows\System\oXCbaiX.exe
  C:\Windows\System\oXCbaiX.exe
  2⤵
  PID:11256
- C:\Windows\System\oDEMQPZ.exe
  C:\Windows\System\oDEMQPZ.exe
  2⤵
  PID:10260
- C:\Windows\System\zJnNeNd.exe
  C:\Windows\System\zJnNeNd.exe
  2⤵
  PID:10296
- C:\Windows\System\mFKKeAH.exe
  C:\Windows\System\mFKKeAH.exe
  2⤵
  PID:10352
- C:\Windows\System\uuWsqmx.exe
  C:\Windows\System\uuWsqmx.exe
  2⤵
  PID:10424
- C:\Windows\System\FXicSID.exe
  C:\Windows\System\FXicSID.exe
  2⤵
  PID:10452
- C:\Windows\System\JezLnoN.exe
  C:\Windows\System\JezLnoN.exe
  2⤵
  PID:10508
- C:\Windows\System\FEiNhjs.exe
  C:\Windows\System\FEiNhjs.exe
  2⤵
  PID:10624
- C:\Windows\System\HXixzyA.exe
  C:\Windows\System\HXixzyA.exe
  2⤵
  PID:10716
- C:\Windows\System\bcxOfqC.exe
  C:\Windows\System\bcxOfqC.exe
  2⤵
  PID:10764
- C:\Windows\System\atgWBlS.exe
  C:\Windows\System\atgWBlS.exe
  2⤵
  PID:10832
- C:\Windows\System\qcxGGdp.exe
  C:\Windows\System\qcxGGdp.exe
  2⤵
  PID:10940
- C:\Windows\System\ZwvThpz.exe
  C:\Windows\System\ZwvThpz.exe
  2⤵
  PID:10956
- C:\Windows\System\HoGHvpB.exe
  C:\Windows\System\HoGHvpB.exe
  2⤵
  PID:11052
- C:\Windows\System\sjyyqEj.exe
  C:\Windows\System\sjyyqEj.exe
  2⤵
  PID:11100
- C:\Windows\System\SQeRZYi.exe
  C:\Windows\System\SQeRZYi.exe
  2⤵
  PID:11204
- C:\Windows\System\OBKmWhy.exe
  C:\Windows\System\OBKmWhy.exe
  2⤵
  PID:10476
- C:\Windows\System\bdpiDzy.exe
  C:\Windows\System\bdpiDzy.exe
  2⤵
  PID:10604
- C:\Windows\System\EnNOcaB.exe
  C:\Windows\System\EnNOcaB.exe
  2⤵
  PID:10828
- C:\Windows\System\hVZnJvE.exe
  C:\Windows\System\hVZnJvE.exe
  2⤵
  PID:10856
- C:\Windows\System\jiwSzHu.exe
  C:\Windows\System\jiwSzHu.exe
  2⤵
  PID:11128
- C:\Windows\System\GrTPkfF.exe
  C:\Windows\System\GrTPkfF.exe
  2⤵
  PID:11180
- C:\Windows\System\ueDkYcf.exe
  C:\Windows\System\ueDkYcf.exe
  2⤵
  PID:10392
- C:\Windows\System\GPYqnhg.exe
  C:\Windows\System\GPYqnhg.exe
  2⤵
  PID:10900
- C:\Windows\System\jzqbiez.exe
  C:\Windows\System\jzqbiez.exe
  2⤵
  PID:9692
- C:\Windows\System\lqYhRmI.exe
  C:\Windows\System\lqYhRmI.exe
  2⤵
  PID:10640
- C:\Windows\System\ITwhoVd.exe
  C:\Windows\System\ITwhoVd.exe
  2⤵
  PID:11124
- C:\Windows\System\SqKVGpK.exe
  C:\Windows\System\SqKVGpK.exe
  2⤵
  PID:11272
- C:\Windows\System\IuIgazR.exe
  C:\Windows\System\IuIgazR.exe
  2⤵
  PID:11296
- C:\Windows\System\ksByLzu.exe
  C:\Windows\System\ksByLzu.exe
  2⤵
  PID:11316
- C:\Windows\System\kybKuMg.exe
  C:\Windows\System\kybKuMg.exe
  2⤵
  PID:11340
- C:\Windows\System\GKYTieM.exe
  C:\Windows\System\GKYTieM.exe
  2⤵
  PID:11384
- C:\Windows\System\NvgRFsE.exe
  C:\Windows\System\NvgRFsE.exe
  2⤵
  PID:11404
- C:\Windows\System\lHDLjdS.exe
  C:\Windows\System\lHDLjdS.exe
  2⤵
  PID:11424
- C:\Windows\System\SSLRlmE.exe
  C:\Windows\System\SSLRlmE.exe
  2⤵
  PID:11456
- C:\Windows\System\PyHANPk.exe
  C:\Windows\System\PyHANPk.exe
  2⤵
  PID:11480
- C:\Windows\System\ThNDFpk.exe
  C:\Windows\System\ThNDFpk.exe
  2⤵
  PID:11504
- C:\Windows\System\NorpWiL.exe
  C:\Windows\System\NorpWiL.exe
  2⤵
  PID:11524
- C:\Windows\System\zhwiMnU.exe
  C:\Windows\System\zhwiMnU.exe
  2⤵
  PID:11604
- C:\Windows\System\tUbycEm.exe
  C:\Windows\System\tUbycEm.exe
  2⤵
  PID:11676
- C:\Windows\System\MYpudCa.exe
  C:\Windows\System\MYpudCa.exe
  2⤵
  PID:11692
- C:\Windows\System\lCEuTdo.exe
  C:\Windows\System\lCEuTdo.exe
  2⤵
  PID:11708
- C:\Windows\System\MPHOQNe.exe
  C:\Windows\System\MPHOQNe.exe
  2⤵
  PID:11724
- C:\Windows\System\OaLziSp.exe
  C:\Windows\System\OaLziSp.exe
  2⤵
  PID:11740
- C:\Windows\System\xAKBgUU.exe
  C:\Windows\System\xAKBgUU.exe
  2⤵
  PID:11756
- C:\Windows\System\HJwUxVn.exe
  C:\Windows\System\HJwUxVn.exe
  2⤵
  PID:11772
- C:\Windows\System\qzOzFOs.exe
  C:\Windows\System\qzOzFOs.exe
  2⤵
  PID:11788
- C:\Windows\System\JSQYQzP.exe
  C:\Windows\System\JSQYQzP.exe
  2⤵
  PID:11824
- C:\Windows\System\mjcIaLH.exe
  C:\Windows\System\mjcIaLH.exe
  2⤵
  PID:11852
- C:\Windows\System\CvWJYWu.exe
  C:\Windows\System\CvWJYWu.exe
  2⤵
  PID:11868
- C:\Windows\System\EQyfpOY.exe
  C:\Windows\System\EQyfpOY.exe
  2⤵
  PID:11932
- C:\Windows\System\tZnbMMX.exe
  C:\Windows\System\tZnbMMX.exe
  2⤵
  PID:11972
- C:\Windows\System\gEulXcf.exe
  C:\Windows\System\gEulXcf.exe
  2⤵
  PID:11992
- C:\Windows\System\raCOwaX.exe
  C:\Windows\System\raCOwaX.exe
  2⤵
  PID:12072
- C:\Windows\System\ekzZTMc.exe
  C:\Windows\System\ekzZTMc.exe
  2⤵
  PID:12096
- C:\Windows\System\LeZoENq.exe
  C:\Windows\System\LeZoENq.exe
  2⤵
  PID:12116
- C:\Windows\System\uOANdfz.exe
  C:\Windows\System\uOANdfz.exe
  2⤵
  PID:12168
- C:\Windows\System\LeuhJTo.exe
  C:\Windows\System\LeuhJTo.exe
  2⤵
  PID:12184
- C:\Windows\System\KEtdzgh.exe
  C:\Windows\System\KEtdzgh.exe
  2⤵
  PID:12220
- C:\Windows\System\KVhXKWj.exe
  C:\Windows\System\KVhXKWj.exe
  2⤵
  PID:12244
- C:\Windows\System\pgQIaXl.exe
  C:\Windows\System\pgQIaXl.exe
  2⤵
  PID:12260
- C:\Windows\System\CuSjGDY.exe
  C:\Windows\System\CuSjGDY.exe
  2⤵
  PID:11284
- C:\Windows\System\fjCfDNq.exe
  C:\Windows\System\fjCfDNq.exe
  2⤵
  PID:11308
- C:\Windows\System\WSzsmFg.exe
  C:\Windows\System\WSzsmFg.exe
  2⤵
  PID:11416
- C:\Windows\System\jnJwBPW.exe
  C:\Windows\System\jnJwBPW.exe
  2⤵
  PID:11476
- C:\Windows\System\CkiWzPP.exe
  C:\Windows\System\CkiWzPP.exe
  2⤵
  PID:11516
- C:\Windows\System\SWMxrfu.exe
  C:\Windows\System\SWMxrfu.exe
  2⤵
  PID:11636
- C:\Windows\System\aTNBiQt.exe
  C:\Windows\System\aTNBiQt.exe
  2⤵
  PID:11652
- C:\Windows\System\xycbzcp.exe
  C:\Windows\System\xycbzcp.exe
  2⤵
  PID:11572
- C:\Windows\System\QxRmhjy.exe
  C:\Windows\System\QxRmhjy.exe
  2⤵
  PID:11580
- C:\Windows\System\spuppIR.exe
  C:\Windows\System\spuppIR.exe
  2⤵
  PID:11704
- C:\Windows\System\uCMHuFF.exe
  C:\Windows\System\uCMHuFF.exe
  2⤵
  PID:11864
- C:\Windows\System\mGpGUZx.exe
  C:\Windows\System\mGpGUZx.exe
  2⤵
  PID:11900
- C:\Windows\System\stgrBxv.exe
  C:\Windows\System\stgrBxv.exe
  2⤵
  PID:11924
- C:\Windows\System\oXyRwqZ.exe
  C:\Windows\System\oXyRwqZ.exe
  2⤵
  PID:12028
- C:\Windows\System\OBYVzLW.exe
  C:\Windows\System\OBYVzLW.exe
  2⤵
  PID:12084
- C:\Windows\System\EbXlWmr.exe
  C:\Windows\System\EbXlWmr.exe
  2⤵
  PID:12112
- C:\Windows\System\bIdNGeg.exe
  C:\Windows\System\bIdNGeg.exe
  2⤵
  PID:12232
- C:\Windows\System\tQCHRNG.exe
  C:\Windows\System\tQCHRNG.exe
  2⤵
  PID:12280
- C:\Windows\System\hFPGFtd.exe
  C:\Windows\System\hFPGFtd.exe
  2⤵
  PID:11332
- C:\Windows\System\qFptEFS.exe
  C:\Windows\System\qFptEFS.exe
  2⤵
  PID:11452
- C:\Windows\System\DxgBMoa.exe
  C:\Windows\System\DxgBMoa.exe
  2⤵
  PID:11544
- C:\Windows\System\EmKCeUe.exe
  C:\Windows\System\EmKCeUe.exe
  2⤵
  PID:11672
- C:\Windows\System\IOALaEu.exe
  C:\Windows\System\IOALaEu.exe
  2⤵
  PID:11768
- C:\Windows\System\NpknjXI.exe
  C:\Windows\System\NpknjXI.exe
  2⤵
  PID:11848
- C:\Windows\System\VvJyCjZ.exe
  C:\Windows\System\VvJyCjZ.exe
  2⤵
  PID:12012
- C:\Windows\System\HkWoXyA.exe
  C:\Windows\System\HkWoXyA.exe
  2⤵
  PID:11472
- C:\Windows\System\AvBsmYC.exe
  C:\Windows\System\AvBsmYC.exe
  2⤵
  PID:12256
- C:\Windows\System\wSerdAS.exe
  C:\Windows\System\wSerdAS.exe
  2⤵
  PID:11644
- C:\Windows\System\NGUkyPU.exe
  C:\Windows\System\NGUkyPU.exe
  2⤵
  PID:11780
- C:\Windows\System\qtNLoBj.exe
  C:\Windows\System\qtNLoBj.exe
  2⤵
  PID:3188
- C:\Windows\System\BVfIeya.exe
  C:\Windows\System\BVfIeya.exe
  2⤵
  PID:11016
- C:\Windows\System\KObgfal.exe
  C:\Windows\System\KObgfal.exe
  2⤵
  PID:12296
- C:\Windows\System\oAsNvek.exe
  C:\Windows\System\oAsNvek.exe
  2⤵
  PID:12332
- C:\Windows\System\OSXYnKw.exe
  C:\Windows\System\OSXYnKw.exe
  2⤵
  PID:12352
- C:\Windows\System\RIBKKCL.exe
  C:\Windows\System\RIBKKCL.exe
  2⤵
  PID:12372
- C:\Windows\System\ZVhAXsz.exe
  C:\Windows\System\ZVhAXsz.exe
  2⤵
  PID:12392
- C:\Windows\System\RXRMwoe.exe
  C:\Windows\System\RXRMwoe.exe
  2⤵
  PID:12424
- C:\Windows\System\hxrSThA.exe
  C:\Windows\System\hxrSThA.exe
  2⤵
  PID:12476
- C:\Windows\System\pETsxPA.exe
  C:\Windows\System\pETsxPA.exe
  2⤵
  PID:12492
- C:\Windows\System\JGdkTEA.exe
  C:\Windows\System\JGdkTEA.exe
  2⤵
  PID:12528
- C:\Windows\System\tPBCvok.exe
  C:\Windows\System\tPBCvok.exe
  2⤵
  PID:12552
- C:\Windows\System\HSZashM.exe
  C:\Windows\System\HSZashM.exe
  2⤵
  PID:12584
- C:\Windows\System\OXfGHgS.exe
  C:\Windows\System\OXfGHgS.exe
  2⤵
  PID:12616
- C:\Windows\System\WjNTNyt.exe
  C:\Windows\System\WjNTNyt.exe
  2⤵
  PID:12640
- C:\Windows\System\pLQFRCk.exe
  C:\Windows\System\pLQFRCk.exe
  2⤵
  PID:12684
- C:\Windows\System\VwlYqyK.exe
  C:\Windows\System\VwlYqyK.exe
  2⤵
  PID:12708
- C:\Windows\System\iMZokmC.exe
  C:\Windows\System\iMZokmC.exe
  2⤵
  PID:12724
- C:\Windows\System\OSKyERx.exe
  C:\Windows\System\OSKyERx.exe
  2⤵
  PID:12748
- C:\Windows\System\SBRekjE.exe
  C:\Windows\System\SBRekjE.exe
  2⤵
  PID:12792
- C:\Windows\System\KUzQkzl.exe
  C:\Windows\System\KUzQkzl.exe
  2⤵
  PID:12808
- C:\Windows\System\eOaMbnP.exe
  C:\Windows\System\eOaMbnP.exe
  2⤵
  PID:12832
- C:\Windows\System\rAjtpGf.exe
  C:\Windows\System\rAjtpGf.exe
  2⤵
  PID:12864
- C:\Windows\System\vJpXMuc.exe
  C:\Windows\System\vJpXMuc.exe
  2⤵
  PID:12884
- C:\Windows\System\AspIYto.exe
  C:\Windows\System\AspIYto.exe
  2⤵
  PID:12928
- C:\Windows\System\TZfncZY.exe
  C:\Windows\System\TZfncZY.exe
  2⤵
  PID:12952
- C:\Windows\System\RkxTAZR.exe
  C:\Windows\System\RkxTAZR.exe
  2⤵
  PID:12976
- C:\Windows\System\HPoSFIG.exe
  C:\Windows\System\HPoSFIG.exe
  2⤵
  PID:12996
- C:\Windows\System\jItzMFV.exe
  C:\Windows\System\jItzMFV.exe
  2⤵
  PID:13024
- C:\Windows\System\ZjZfkxT.exe
  C:\Windows\System\ZjZfkxT.exe
  2⤵
  PID:13048
- C:\Windows\System\OlexMqg.exe
  C:\Windows\System\OlexMqg.exe
  2⤵
  PID:13092
- C:\Windows\System\CfVtPVn.exe
  C:\Windows\System\CfVtPVn.exe
  2⤵
  PID:13136
- C:\Windows\System\ChXzGfF.exe
  C:\Windows\System\ChXzGfF.exe
  2⤵
  PID:13160
- C:\Windows\System\WVWkduH.exe
  C:\Windows\System\WVWkduH.exe
  2⤵
  PID:13176
- C:\Windows\System\taXUeKq.exe
  C:\Windows\System\taXUeKq.exe
  2⤵
  PID:13196
- C:\Windows\System\BhWOuSp.exe
  C:\Windows\System\BhWOuSp.exe
  2⤵
  PID:13224
- C:\Windows\System\EOfdDAE.exe
  C:\Windows\System\EOfdDAE.exe
  2⤵
  PID:13252
- C:\Windows\System\DOQSBZA.exe
  C:\Windows\System\DOQSBZA.exe
  2⤵
  PID:13300
- C:\Windows\System\PymZZxJ.exe
  C:\Windows\System\PymZZxJ.exe
  2⤵
  PID:4488
- C:\Windows\System\ILMOvtN.exe
  C:\Windows\System\ILMOvtN.exe
  2⤵
  PID:12292
- C:\Windows\System\iJikhkQ.exe
  C:\Windows\System\iJikhkQ.exe
  2⤵
  PID:12348
- C:\Windows\System\mEqIZZI.exe
  C:\Windows\System\mEqIZZI.exe
  2⤵
  PID:12412
- C:\Windows\System\XIyJFtU.exe
  C:\Windows\System\XIyJFtU.exe
  2⤵
  PID:12508
- C:\Windows\System\ByDcvgj.exe
  C:\Windows\System\ByDcvgj.exe
  2⤵
  PID:12576
- C:\Windows\System\lXCPOFR.exe
  C:\Windows\System\lXCPOFR.exe
  2⤵
  PID:12656
- C:\Windows\System\wyycyzB.exe
  C:\Windows\System\wyycyzB.exe
  2⤵
  PID:12652
- C:\Windows\System\XraSENX.exe
  C:\Windows\System\XraSENX.exe
  2⤵
  PID:12736
- C:\Windows\System\kIyLsLD.exe
  C:\Windows\System\kIyLsLD.exe
  2⤵
  PID:12800
- C:\Windows\System\uKcfCmD.exe
  C:\Windows\System\uKcfCmD.exe
  2⤵
  PID:12840
- C:\Windows\System\XdqcjyX.exe
  C:\Windows\System\XdqcjyX.exe
  2⤵
  PID:12960
- C:\Windows\System\nILNhWG.exe
  C:\Windows\System\nILNhWG.exe
  2⤵
  PID:12984
- C:\Windows\System\cMXXZgH.exe
  C:\Windows\System\cMXXZgH.exe
  2⤵
  PID:13144
- C:\Windows\System\QwwQFEO.exe
  C:\Windows\System\QwwQFEO.exe
  2⤵
  PID:13188
- C:\Windows\System\YERRqdS.exe
  C:\Windows\System\YERRqdS.exe
  2⤵
  PID:13220
- C:\Windows\System\MgvQteW.exe
  C:\Windows\System\MgvQteW.exe
  2⤵
  PID:13292
- C:\Windows\System\rdsOfzk.exe
  C:\Windows\System\rdsOfzk.exe
  2⤵
  PID:12324
- C:\Windows\System\gaQASRW.exe
  C:\Windows\System\gaQASRW.exe
  2⤵
  PID:12388
- C:\Windows\System\CGFUnGt.exe
  C:\Windows\System\CGFUnGt.exe
  2⤵
  PID:12580
- C:\Windows\System\SSYaZOK.exe
  C:\Windows\System\SSYaZOK.exe
  2⤵
  PID:12892
- C:\Windows\System\NiOMwbA.exe
  C:\Windows\System\NiOMwbA.exe
  2⤵
  PID:13008
- C:\Windows\System\tKvUaVx.exe
  C:\Windows\System\tKvUaVx.exe
  2⤵
  PID:13152
- C:\Windows\System\yoQxaBb.exe
  C:\Windows\System\yoQxaBb.exe
  2⤵
  PID:13308
- C:\Windows\System\ffByVqo.exe
  C:\Windows\System\ffByVqo.exe
  2⤵
  PID:12144
- C:\Windows\System\TclIsHm.exe
  C:\Windows\System\TclIsHm.exe
  2⤵
  PID:12740
- C:\Windows\System\mmbZPpI.exe
  C:\Windows\System\mmbZPpI.exe
  2⤵
  PID:13076
- C:\Windows\System\dhWTgdv.exe
  C:\Windows\System\dhWTgdv.exe
  2⤵
  PID:2444
- C:\Windows\System\YfQRjVo.exe
  C:\Windows\System\YfQRjVo.exe
  2⤵
  PID:4672
- C:\Windows\System\QQbXzlN.exe
  C:\Windows\System\QQbXzlN.exe
  2⤵
  PID:13172
- C:\Windows\System\lLHhUSa.exe
  C:\Windows\System\lLHhUSa.exe
  2⤵
  PID:428
- C:\Windows\System\wfRrgsd.exe
  C:\Windows\System\wfRrgsd.exe
  2⤵
  PID:4816
- C:\Windows\System\kNGJEUU.exe
  C:\Windows\System\kNGJEUU.exe
  2⤵
  PID:4804
- C:\Windows\System\KzEHTDc.exe
  C:\Windows\System\KzEHTDc.exe
  2⤵
  PID:12784
- C:\Windows\System\EIxsBtA.exe
  C:\Windows\System\EIxsBtA.exe
  2⤵
  PID:2280
- C:\Windows\System\gfyoLmI.exe
  C:\Windows\System\gfyoLmI.exe
  2⤵
  PID:2768
- C:\Windows\System\PhufGdt.exe
  C:\Windows\System\PhufGdt.exe
  2⤵
  PID:2880
- C:\Windows\System\FzPHHuD.exe
  C:\Windows\System\FzPHHuD.exe
  2⤵
  PID:1920
- C:\Windows\System\iqvUVFG.exe
  C:\Windows\System\iqvUVFG.exe
  2⤵
  PID:2080
- C:\Windows\System\pooNpNs.exe
  C:\Windows\System\pooNpNs.exe
  2⤵
  PID:12544
- C:\Windows\System\UiFYlsR.exe
  C:\Windows\System\UiFYlsR.exe
  2⤵
  PID:1856
- C:\Windows\System\wTwCooP.exe
  C:\Windows\System\wTwCooP.exe
  2⤵
  PID:5152
- C:\Windows\System\yXrzQgQ.exe
  C:\Windows\System\yXrzQgQ.exe
  2⤵
  PID:5256
- C:\Windows\System\MCqWdbx.exe
  C:\Windows\System\MCqWdbx.exe
  2⤵
  PID:5272
- C:\Windows\System\xcGnSim.exe
  C:\Windows\System\xcGnSim.exe
  2⤵
  PID:5348
- C:\Windows\System\MQFIede.exe
  C:\Windows\System\MQFIede.exe
  2⤵
  PID:3300
- C:\Windows\System\DudbXGX.exe
  C:\Windows\System\DudbXGX.exe
  2⤵
  PID:2940
- C:\Windows\System\WLLpwKL.exe
  C:\Windows\System\WLLpwKL.exe
  2⤵
  PID:5504
- C:\Windows\System\xnvnhrS.exe
  C:\Windows\System\xnvnhrS.exe
  2⤵
  PID:3368
- C:\Windows\System\mDPFIsY.exe
  C:\Windows\System\mDPFIsY.exe
  2⤵
  PID:2452
- C:\Windows\System\tNqDRrN.exe
  C:\Windows\System\tNqDRrN.exe
  2⤵
  PID:5644
- C:\Windows\System\DNFlFiA.exe
  C:\Windows\System\DNFlFiA.exe
  2⤵
  PID:5716
- C:\Windows\System\jTzPWnN.exe
  C:\Windows\System\jTzPWnN.exe
  2⤵
  PID:5732
- C:\Windows\System\PDMpusu.exe
  C:\Windows\System\PDMpusu.exe
  2⤵
  PID:5876
- C:\Windows\System\qZsbgSf.exe
  C:\Windows\System\qZsbgSf.exe
  2⤵
  PID:5948
- C:\Windows\System\keuXzbi.exe
  C:\Windows\System\keuXzbi.exe
  2⤵
  PID:5956
- C:\Windows\System\bBNHoUv.exe
  C:\Windows\System\bBNHoUv.exe
  2⤵
  PID:6036
- C:\Windows\System\vQPdqZv.exe
  C:\Windows\System\vQPdqZv.exe
  2⤵
  PID:12500
- C:\Windows\System\vxUXNPb.exe
  C:\Windows\System\vxUXNPb.exe
  2⤵
  PID:3392
- C:\Windows\System\QFyFXcK.exe
  C:\Windows\System\QFyFXcK.exe
  2⤵
  PID:3372
- C:\Windows\System\rclmgAd.exe
  C:\Windows\System\rclmgAd.exe
  2⤵
  PID:2176
- C:\Windows\System\FtQhuaC.exe
  C:\Windows\System\FtQhuaC.exe
  2⤵
  PID:4684
- C:\Windows\System\PZlJDgU.exe
  C:\Windows\System\PZlJDgU.exe
  2⤵
  PID:11632
- C:\Windows\System\jXZelEH.exe
  C:\Windows\System\jXZelEH.exe
  2⤵
  PID:5236
- C:\Windows\System\sdRkqxr.exe
  C:\Windows\System\sdRkqxr.exe
  2⤵
  PID:264
- C:\Windows\System\btImJNr.exe
  C:\Windows\System\btImJNr.exe
  2⤵
  PID:2076
- C:\Windows\System\pGbmypg.exe
  C:\Windows\System\pGbmypg.exe
  2⤵
  PID:5288
- C:\Windows\System\tcWkTCv.exe
  C:\Windows\System\tcWkTCv.exe
  2⤵
  PID:1700
- C:\Windows\System\gbyzQDZ.exe
  C:\Windows\System\gbyzQDZ.exe
  2⤵
  PID:3312
- C:\Windows\System\ciGpYxf.exe
  C:\Windows\System\ciGpYxf.exe
  2⤵
  PID:3532
- C:\Windows\System\FMhWgCI.exe
  C:\Windows\System\FMhWgCI.exe
  2⤵
  PID:3320
- C:\Windows\System\GtotkFp.exe
  C:\Windows\System\GtotkFp.exe
  2⤵
  PID:2416
- C:\Windows\System\MXfXLHM.exe
  C:\Windows\System\MXfXLHM.exe
  2⤵
  PID:5072
- C:\Windows\System\LIOwRoO.exe
  C:\Windows\System\LIOwRoO.exe
  2⤵
  PID:5700
- C:\Windows\System\evPNjlu.exe
  C:\Windows\System\evPNjlu.exe
  2⤵
  PID:6048
- C:\Windows\System\LYfsFYf.exe
  C:\Windows\System\LYfsFYf.exe
  2⤵
  PID:5496
- C:\Windows\System\AFyGzED.exe
  C:\Windows\System\AFyGzED.exe
  2⤵
  PID:3448
- C:\Windows\System\WIjVQEh.exe
  C:\Windows\System\WIjVQEh.exe
  2⤵
  PID:6308
- C:\Windows\System\PYfwJuv.exe
  C:\Windows\System\PYfwJuv.exe
  2⤵
  PID:5696
- C:\Windows\System\JvSVLnc.exe
  C:\Windows\System\JvSVLnc.exe
  2⤵
  PID:6544
- C:\Windows\System\kNcEqhU.exe
  C:\Windows\System\kNcEqhU.exe
  2⤵
  PID:5932
- C:\Windows\System\NpWMyqq.exe
  C:\Windows\System\NpWMyqq.exe
  2⤵
  PID:2760
- C:\Windows\System\GEeCsls.exe
  C:\Windows\System\GEeCsls.exe
  2⤵
  PID:3388
- C:\Windows\System\tNnlipO.exe
  C:\Windows\System\tNnlipO.exe
  2⤵
  PID:2732
- C:\Windows\System\BwDCAQk.exe
  C:\Windows\System\BwDCAQk.exe
  2⤵
  PID:2672
- C:\Windows\System\OvDafWD.exe
  C:\Windows\System\OvDafWD.exe
  2⤵
  PID:5480
- C:\Windows\System\YCmTLCj.exe
  C:\Windows\System\YCmTLCj.exe
  2⤵
  PID:5788
- C:\Windows\System\wPyXGjP.exe
  C:\Windows\System\wPyXGjP.exe
  2⤵
  PID:5660
- C:\Windows\System\tjbrBxw.exe
  C:\Windows\System\tjbrBxw.exe
  2⤵
  PID:5048
- C:\Windows\System\nZbqhoJ.exe
  C:\Windows\System\nZbqhoJ.exe
  2⤵
  PID:4336
- C:\Windows\System\sIiugMm.exe
  C:\Windows\System\sIiugMm.exe
  2⤵
  PID:536
- C:\Windows\System\vTYngXs.exe
  C:\Windows\System\vTYngXs.exe
  2⤵
  PID:4404
- C:\Windows\System\QvTBptH.exe
  C:\Windows\System\QvTBptH.exe
  2⤵
  PID:2924
- C:\Windows\System\dXGBrdh.exe
  C:\Windows\System\dXGBrdh.exe
  2⤵
  PID:2584
- C:\Windows\System\LNdrnpy.exe
  C:\Windows\System\LNdrnpy.exe
  2⤵
  PID:6824
- C:\Windows\System\HDVGloI.exe
  C:\Windows\System\HDVGloI.exe
  2⤵
  PID:8164
- C:\Windows\System\oErbyHU.exe
  C:\Windows\System\oErbyHU.exe
  2⤵
  PID:4848
- C:\Windows\System\iAkrxGF.exe
  C:\Windows\System\iAkrxGF.exe
  2⤵
  PID:7980
- C:\Windows\System\ztIkjhI.exe
  C:\Windows\System\ztIkjhI.exe
  2⤵
  PID:8072
- C:\Windows\System\qyeBMGD.exe
  C:\Windows\System\qyeBMGD.exe
  2⤵
  PID:8184
- C:\Windows\System\thvOEuP.exe
  C:\Windows\System\thvOEuP.exe
  2⤵
  PID:3336
- C:\Windows\System\rsdKlhr.exe
  C:\Windows\System\rsdKlhr.exe
  2⤵
  PID:4776
- C:\Windows\System\fxfbxMf.exe
  C:\Windows\System\fxfbxMf.exe
  2⤵
  PID:6500
- C:\Windows\System\RPMbASC.exe
  C:\Windows\System\RPMbASC.exe
  2⤵
  PID:5516
- C:\Windows\System\ODtcXEe.exe
  C:\Windows\System\ODtcXEe.exe
  2⤵
  PID:2160
- C:\Windows\System\ZHLxQTw.exe
  C:\Windows\System\ZHLxQTw.exe
  2⤵
  PID:5304
- C:\Windows\System\BFGBJkm.exe
  C:\Windows\System\BFGBJkm.exe
  2⤵
  PID:3416
- C:\Windows\System\NNXSBgV.exe
  C:\Windows\System\NNXSBgV.exe
  2⤵
  PID:2700
- C:\Windows\System\juymSte.exe
  C:\Windows\System\juymSte.exe
  2⤵
  PID:3396
- C:\Windows\System\FqgoSFF.exe
  C:\Windows\System\FqgoSFF.exe
  2⤵
  PID:6844
- C:\Windows\System\srQudjX.exe
  C:\Windows\System\srQudjX.exe
  2⤵
  PID:5864
- C:\Windows\System\ueiRFrs.exe
  C:\Windows\System\ueiRFrs.exe
  2⤵
  PID:8292
- C:\Windows\System\fHEtfTW.exe
  C:\Windows\System\fHEtfTW.exe
  2⤵
  PID:8208
- C:\Windows\System\tuozkbW.exe
  C:\Windows\System\tuozkbW.exe
  2⤵
  PID:8216
- C:\Windows\System\FcrOsaY.exe
  C:\Windows\System\FcrOsaY.exe
  2⤵
  PID:8316
- C:\Windows\System\ASHaicj.exe
  C:\Windows\System\ASHaicj.exe
  2⤵
  PID:7884
- C:\Windows\System\MpXzvtM.exe
  C:\Windows\System\MpXzvtM.exe
  2⤵
  PID:8092
- C:\Windows\System\dEAVlHq.exe
  C:\Windows\System\dEAVlHq.exe
  2⤵
  PID:8304
- C:\Windows\System\pWmsoCg.exe
  C:\Windows\System\pWmsoCg.exe
  2⤵
  PID:9164
- C:\Windows\System\PxNBCcZ.exe
  C:\Windows\System\PxNBCcZ.exe
  2⤵
  PID:8328
- C:\Windows\System\LapqLci.exe
  C:\Windows\System\LapqLci.exe
  2⤵
  PID:8344
- C:\Windows\System\ynqCWTJ.exe
  C:\Windows\System\ynqCWTJ.exe
  2⤵
  PID:8532
- C:\Windows\System\YgEeXck.exe
  C:\Windows\System\YgEeXck.exe
  2⤵
  PID:4480
- C:\Windows\System\qkqOXWT.exe
  C:\Windows\System\qkqOXWT.exe
  2⤵
  PID:8648
- C:\Windows\System\RuVdxVz.exe
  C:\Windows\System\RuVdxVz.exe
  2⤵
  PID:8640
- C:\Windows\System\duQivsK.exe
  C:\Windows\System\duQivsK.exe
  2⤵
  PID:8708
- C:\Windows\System\QtAOONn.exe
  C:\Windows\System\QtAOONn.exe
  2⤵
  PID:8748
- C:\Windows\System\tueowXl.exe
  C:\Windows\System\tueowXl.exe
  2⤵
  PID:6300
- C:\Windows\System\jHTgxut.exe
  C:\Windows\System\jHTgxut.exe
  2⤵
  PID:8860
- C:\Windows\System\RYfHnwn.exe
  C:\Windows\System\RYfHnwn.exe
  2⤵
  PID:7208
- C:\Windows\System\KfGKqaF.exe
  C:\Windows\System\KfGKqaF.exe
  2⤵
  PID:8896
- C:\Windows\System\OJKInMu.exe
  C:\Windows\System\OJKInMu.exe
  2⤵
  PID:9096
- C:\Windows\System\EEKwBvA.exe
  C:\Windows\System\EEKwBvA.exe
  2⤵
  PID:2192
- C:\Windows\System\pEEcZBm.exe
  C:\Windows\System\pEEcZBm.exe
  2⤵
  PID:2424
- C:\Windows\System\iXcieEK.exe
  C:\Windows\System\iXcieEK.exe
  2⤵
  PID:7316
- C:\Windows\System\zivikZN.exe
  C:\Windows\System\zivikZN.exe
  2⤵
  PID:3816
- C:\Windows\System\hOzqxID.exe
  C:\Windows\System\hOzqxID.exe
  2⤵
  PID:5676
- C:\Windows\System\EkhjlDK.exe
  C:\Windows\System\EkhjlDK.exe
  2⤵
  PID:4428
- C:\Windows\System\SOgUAOx.exe
  C:\Windows\System\SOgUAOx.exe
  2⤵
  PID:6488
- C:\Windows\System\zYhUIye.exe
  C:\Windows\System\zYhUIye.exe
  2⤵
  PID:5984
- C:\Windows\System\FvHuQex.exe
  C:\Windows\System\FvHuQex.exe
  2⤵
  PID:7608
- C:\Windows\System\zvuJWAV.exe
  C:\Windows\System\zvuJWAV.exe
  2⤵
  PID:9488
- C:\Windows\System\TBheMsD.exe
  C:\Windows\System\TBheMsD.exe
  2⤵
  PID:7452
- C:\Windows\System\mkAkDfw.exe
  C:\Windows\System\mkAkDfw.exe
  2⤵
  PID:6040
- C:\Windows\System\pVtbByp.exe
  C:\Windows\System\pVtbByp.exe
  2⤵
  PID:2772
- C:\Windows\System\oaNCUuB.exe
  C:\Windows\System\oaNCUuB.exe
  2⤵
  PID:9708
- C:\Windows\System\kXtEUXU.exe
  C:\Windows\System\kXtEUXU.exe
  2⤵
  PID:7684
- C:\Windows\System\HZOhplC.exe
  C:\Windows\System\HZOhplC.exe
  2⤵
  PID:7776
- C:\Windows\System\FvnUFCW.exe
  C:\Windows\System\FvnUFCW.exe
  2⤵
  PID:9752
- C:\Windows\System\hTxoBKx.exe
  C:\Windows\System\hTxoBKx.exe
  2⤵
  PID:5784
- C:\Windows\System\RriiHuI.exe
  C:\Windows\System\RriiHuI.exe
  2⤵
  PID:7848
- C:\Windows\System\SEaWunD.exe
  C:\Windows\System\SEaWunD.exe
  2⤵
  PID:7984
- C:\Windows\System\expXrYY.exe
  C:\Windows\System\expXrYY.exe
  2⤵
  PID:3172
- C:\Windows\System\agRsMEi.exe
  C:\Windows\System\agRsMEi.exe
  2⤵
  PID:4668
- C:\Windows\System\mfpPzpf.exe
  C:\Windows\System\mfpPzpf.exe
  2⤵
  PID:748
- C:\Windows\System\jrenTwa.exe
  C:\Windows\System\jrenTwa.exe
  2⤵
  PID:2116
- C:\Windows\System\fnyhuyl.exe
  C:\Windows\System\fnyhuyl.exe
  2⤵
  PID:1232
- C:\Windows\System\zBZeqEv.exe
  C:\Windows\System\zBZeqEv.exe
  2⤵
  PID:1632
- C:\Windows\System\LlwIuMK.exe
  C:\Windows\System\LlwIuMK.exe
  2⤵
  PID:7124
- C:\Windows\System\tKSOiiv.exe
  C:\Windows\System\tKSOiiv.exe
  2⤵
  PID:9616
- C:\Windows\System\WrCTvFD.exe
  C:\Windows\System\WrCTvFD.exe
  2⤵
  PID:5268
- C:\Windows\System\xAWuZSs.exe
  C:\Windows\System\xAWuZSs.exe
  2⤵
  PID:5548
- C:\Windows\System\eVnuije.exe
  C:\Windows\System\eVnuije.exe
  2⤵
  PID:5220
- C:\Windows\System\gNeOQVh.exe
  C:\Windows\System\gNeOQVh.exe
  2⤵
  PID:668
- C:\Windows\System\zPnLvwa.exe
  C:\Windows\System\zPnLvwa.exe
  2⤵
  PID:8724
- C:\Windows\System\YryPiPc.exe
  C:\Windows\System\YryPiPc.exe
  2⤵
  PID:9896
- C:\Windows\System\LTlsyJC.exe
  C:\Windows\System\LTlsyJC.exe
  2⤵
  PID:4784
- C:\Windows\System\QBIBHTp.exe
  C:\Windows\System\QBIBHTp.exe
  2⤵
  PID:516
- C:\Windows\System\wrPdzNH.exe
  C:\Windows\System\wrPdzNH.exe
  2⤵
  PID:10332
- C:\Windows\System\dwtQUmA.exe
  C:\Windows\System\dwtQUmA.exe
  2⤵
  PID:10412
- C:\Windows\System\LpeooCB.exe
  C:\Windows\System\LpeooCB.exe
  2⤵
  PID:8232
- C:\Windows\System\WWJHzlN.exe
  C:\Windows\System\WWJHzlN.exe
  2⤵
  PID:7912
- C:\Windows\System\bslGYPW.exe
  C:\Windows\System\bslGYPW.exe
  2⤵
  PID:8388
- C:\Windows\System\YYCjzLb.exe
  C:\Windows\System\YYCjzLb.exe
  2⤵
  PID:8340
- C:\Windows\System\dSTrruP.exe
  C:\Windows\System\dSTrruP.exe
  2⤵
  PID:8420
- C:\Windows\System\GJRCnXw.exe
  C:\Windows\System\GJRCnXw.exe
  2⤵
  PID:10892
- C:\Windows\System\hpCfSvG.exe
  C:\Windows\System\hpCfSvG.exe
  2⤵
  PID:1976
- C:\Windows\System\cXYGXKq.exe
  C:\Windows\System\cXYGXKq.exe
  2⤵
  PID:10948
- C:\Windows\System\fgqjLfK.exe
  C:\Windows\System\fgqjLfK.exe
  2⤵
  PID:4492
- C:\Windows\System\ejMJxQl.exe
  C:\Windows\System\ejMJxQl.exe
  2⤵
  PID:11072
- C:\Windows\System\NiwXOfR.exe
  C:\Windows\System\NiwXOfR.exe
  2⤵
  PID:11144
- C:\Windows\System\sKtXcRA.exe
  C:\Windows\System\sKtXcRA.exe
  2⤵
  PID:4400
- C:\Windows\System\kBfxcGG.exe
  C:\Windows\System\kBfxcGG.exe
  2⤵
  PID:8776
- C:\Windows\System\ywHVNfj.exe
  C:\Windows\System\ywHVNfj.exe
  2⤵
  PID:10188
- C:\Windows\System\EHjPsFx.exe
  C:\Windows\System\EHjPsFx.exe
  2⤵
  PID:1172
- C:\Windows\System\ZRmwmxA.exe
  C:\Windows\System\ZRmwmxA.exe
  2⤵
  PID:4944
- C:\Windows\System\WRDZCHE.exe
  C:\Windows\System\WRDZCHE.exe
  2⤵
  PID:8348
- C:\Windows\System\uBazZyA.exe
  C:\Windows\System\uBazZyA.exe
  2⤵
  PID:10456
- C:\Windows\System\pTsSEIz.exe
  C:\Windows\System\pTsSEIz.exe
  2⤵
  PID:10780
- C:\Windows\System\ojyTFQy.exe
  C:\Windows\System\ojyTFQy.exe
  2⤵
  PID:10952
- C:\Windows\System\nyHvGGe.exe
  C:\Windows\System\nyHvGGe.exe
  2⤵
  PID:4808
- C:\Windows\System\UWhvgNb.exe
  C:\Windows\System\UWhvgNb.exe
  2⤵
  PID:1948
- C:\Windows\System\ljuZpXZ.exe
  C:\Windows\System\ljuZpXZ.exe
  2⤵
  PID:7384
- C:\Windows\System\uunHJnW.exe
  C:\Windows\System\uunHJnW.exe
  2⤵
  PID:3768
- C:\Windows\System\ngMwzuH.exe
  C:\Windows\System\ngMwzuH.exe
  2⤵
  PID:1736
- C:\Windows\System\WoAGxwB.exe
  C:\Windows\System\WoAGxwB.exe
  2⤵
  PID:11352
- C:\Windows\System\DGmdIaM.exe
  C:\Windows\System\DGmdIaM.exe
  2⤵
  PID:11468
- C:\Windows\System\JYKlySV.exe
  C:\Windows\System\JYKlySV.exe
  2⤵
  PID:6764
- C:\Windows\System\hltVfTm.exe
  C:\Windows\System\hltVfTm.exe
  2⤵
  PID:7480
- C:\Windows\System\iunXFxv.exe
  C:\Windows\System\iunXFxv.exe
  2⤵
  PID:7560
- C:\Windows\System\ViACMAf.exe
  C:\Windows\System\ViACMAf.exe
  2⤵
  PID:4800
- C:\Windows\System\jrkOwib.exe
  C:\Windows\System\jrkOwib.exe
  2⤵
  PID:1968
- C:\Windows\System\sjxJmhY.exe
  C:\Windows\System\sjxJmhY.exe
  2⤵
  PID:8032
- C:\Windows\System\GBJJFOT.exe
  C:\Windows\System\GBJJFOT.exe
  2⤵
  PID:10052
- C:\Windows\System\WVRNhzC.exe
  C:\Windows\System\WVRNhzC.exe
  2⤵
  PID:9856
- C:\Windows\System\mZsMEmI.exe
  C:\Windows\System\mZsMEmI.exe
  2⤵
  PID:10020
- C:\Windows\System\WOFJWca.exe
  C:\Windows\System\WOFJWca.exe
  2⤵
  PID:7268
- C:\Windows\System\WWoNXUV.exe
  C:\Windows\System\WWoNXUV.exe
  2⤵
  PID:7888
- C:\Windows\System\KDqTANF.exe
  C:\Windows\System\KDqTANF.exe
  2⤵
  PID:7960
- C:\Windows\System\EYTIcfa.exe
  C:\Windows\System\EYTIcfa.exe
  2⤵
  PID:1264
- C:\Windows\System\FAbGzpe.exe
  C:\Windows\System\FAbGzpe.exe
  2⤵
  PID:12240
- C:\Windows\System\clAfQHP.exe
  C:\Windows\System\clAfQHP.exe
  2⤵
  PID:4456
- C:\Windows\System\NTbZwoj.exe
  C:\Windows\System\NTbZwoj.exe
  2⤵
  PID:1972
- C:\Windows\System\Lxvlgbh.exe
  C:\Windows\System\Lxvlgbh.exe
  2⤵
  PID:6920
- C:\Windows\System\dWbBCQz.exe
  C:\Windows\System\dWbBCQz.exe
  2⤵
  PID:10136
- C:\Windows\System\vgiNhtG.exe
  C:\Windows\System\vgiNhtG.exe
  2⤵
  PID:3452
- C:\Windows\System\cfmtJWC.exe
  C:\Windows\System\cfmtJWC.exe
  2⤵
  PID:912
- C:\Windows\System\dBOSXrt.exe
  C:\Windows\System\dBOSXrt.exe
  2⤵
  PID:5300
- C:\Windows\System\rDToOAY.exe
  C:\Windows\System\rDToOAY.exe
  2⤵
  PID:5216
- C:\Windows\System\HaSfXzG.exe
  C:\Windows\System\HaSfXzG.exe
  2⤵
  PID:9244
- C:\Windows\System\Lpuplvj.exe
  C:\Windows\System\Lpuplvj.exe
  2⤵
  PID:9684
- C:\Windows\System\pJfvRmg.exe
  C:\Windows\System\pJfvRmg.exe
  2⤵
  PID:6784
- C:\Windows\System\HNbnKYz.exe
  C:\Windows\System\HNbnKYz.exe
  2⤵
  PID:8068
- C:\Windows\System\oxFfris.exe
  C:\Windows\System\oxFfris.exe
  2⤵
  PID:10460
- C:\Windows\System\EOEIsah.exe
  C:\Windows\System\EOEIsah.exe
  2⤵
  PID:10440
- C:\Windows\System\jdOHGsP.exe
  C:\Windows\System\jdOHGsP.exe
  2⤵
  PID:11464
- C:\Windows\System\lBGThnP.exe
  C:\Windows\System\lBGThnP.exe
  2⤵
  PID:11648
- C:\Windows\System\QNKGqDJ.exe
  C:\Windows\System\QNKGqDJ.exe
  2⤵
  PID:8404
- C:\Windows\System\zFyvhfj.exe
  C:\Windows\System\zFyvhfj.exe
  2⤵
  PID:10888
- C:\Windows\System\RYzxuiY.exe
  C:\Windows\System\RYzxuiY.exe
  2⤵
  PID:10944
- C:\Windows\System\eYInrYj.exe
  C:\Windows\System\eYInrYj.exe
  2⤵
  PID:11004
- C:\Windows\System\BDfNIdT.exe
  C:\Windows\System\BDfNIdT.exe
  2⤵
  PID:6116
- C:\Windows\System\xLZKaBa.exe
  C:\Windows\System\xLZKaBa.exe
  2⤵
  PID:12380
- C:\Windows\System\kzYZdZt.exe
  C:\Windows\System\kzYZdZt.exe
  2⤵
  PID:11148
- C:\Windows\System\wglhoCM.exe
  C:\Windows\System\wglhoCM.exe
  2⤵
  PID:11176
- C:\Windows\System\qzuNQQS.exe
  C:\Windows\System\qzuNQQS.exe
  2⤵
  PID:5316
- C:\Windows\System\LenNYua.exe
  C:\Windows\System\LenNYua.exe
  2⤵
  PID:5596
- C:\Windows\System\pvFfVJZ.exe
  C:\Windows\System\pvFfVJZ.exe
  2⤵
  PID:1072
- C:\Windows\System\AGiSmQg.exe
  C:\Windows\System\AGiSmQg.exe
  2⤵
  PID:5052
- C:\Windows\System\LsCHyeF.exe
  C:\Windows\System\LsCHyeF.exe
  2⤵
  PID:8888
- C:\Windows\System\haSkxOU.exe
  C:\Windows\System\haSkxOU.exe
  2⤵
  PID:12756
- C:\Windows\System\WRCFEvO.exe
  C:\Windows\System\WRCFEvO.exe
  2⤵
  PID:13032
- C:\Windows\System\dCgPRkF.exe
  C:\Windows\System\dCgPRkF.exe
  2⤵
  PID:5836
- C:\Windows\System\LBmvwfE.exe
  C:\Windows\System\LBmvwfE.exe
  2⤵
  PID:4332
- C:\Windows\System\SZNslhB.exe
  C:\Windows\System\SZNslhB.exe
  2⤵
  PID:1428
- C:\Windows\System\vAtLnch.exe
  C:\Windows\System\vAtLnch.exe
  2⤵
  PID:6064
- C:\Windows\System\SFIDMnz.exe
  C:\Windows\System\SFIDMnz.exe
  2⤵
  PID:5840
- C:\Windows\System\QIhowkR.exe
  C:\Windows\System\QIhowkR.exe
  2⤵
  PID:13184
- C:\Windows\System\DrhFang.exe
  C:\Windows\System\DrhFang.exe
  2⤵
  PID:5760
- C:\Windows\System\jIEMSbh.exe
  C:\Windows\System\jIEMSbh.exe
  2⤵
  PID:6108
- C:\Windows\System\NKazUQX.exe
  C:\Windows\System\NKazUQX.exe
  2⤵
  PID:8928
- C:\Windows\System\coyAsfx.exe
  C:\Windows\System\coyAsfx.exe
  2⤵
  PID:6240
- C:\Windows\System\suJCqvU.exe
  C:\Windows\System\suJCqvU.exe
  2⤵
  PID:4636
- C:\Windows\System\WjbMpCk.exe
  C:\Windows\System\WjbMpCk.exe
  2⤵
  PID:12304
- C:\Windows\System\DIPVuyG.exe
  C:\Windows\System\DIPVuyG.exe
  2⤵
  PID:3128
- C:\Windows\System\YfiezBw.exe
  C:\Windows\System\YfiezBw.exe
  2⤵
  PID:6316
- C:\Windows\System\YyoboKL.exe
  C:\Windows\System\YyoboKL.exe
  2⤵
  PID:6376
- C:\Windows\System\JrgWExm.exe
  C:\Windows\System\JrgWExm.exe
  2⤵
  PID:6400
- C:\Windows\System\yuBpHWM.exe
  C:\Windows\System\yuBpHWM.exe
  2⤵
  PID:1128
- C:\Windows\System\pDWYbRH.exe
  C:\Windows\System\pDWYbRH.exe
  2⤵
  PID:12828
- C:\Windows\System\XYvgjJN.exe
  C:\Windows\System\XYvgjJN.exe
  2⤵
  PID:7576
- C:\Windows\System\RWocyrz.exe
  C:\Windows\System\RWocyrz.exe
  2⤵
  PID:6516
- C:\Windows\System\eWnsrTM.exe
  C:\Windows\System\eWnsrTM.exe
  2⤵
  PID:13112
- C:\Windows\System\FWmNtYG.exe
  C:\Windows\System\FWmNtYG.exe
  2⤵
  PID:13260
- C:\Windows\System\GfYmCXQ.exe
  C:\Windows\System\GfYmCXQ.exe
  2⤵
  PID:7448
- C:\Windows\System\GQgNdQz.exe
  C:\Windows\System\GQgNdQz.exe
  2⤵
  PID:6696
- C:\Windows\System\IrGvBwp.exe
  C:\Windows\System\IrGvBwp.exe
  2⤵
  PID:9128
- C:\Windows\System\fONHkuV.exe
  C:\Windows\System\fONHkuV.exe
  2⤵
  PID:7872
- C:\Windows\System\yDDKFsZ.exe
  C:\Windows\System\yDDKFsZ.exe
  2⤵
  PID:9132
- C:\Windows\System\rShYMpO.exe
  C:\Windows\System\rShYMpO.exe
  2⤵
  PID:12788
- C:\Windows\System\EAuDZWC.exe
  C:\Windows\System\EAuDZWC.exe
  2⤵
  PID:6944
- C:\Windows\System\KEgaDwV.exe
  C:\Windows\System\KEgaDwV.exe
  2⤵
  PID:3148
- C:\Windows\System\eBXZxJL.exe
  C:\Windows\System\eBXZxJL.exe
  2⤵
  PID:9732
- C:\Windows\System\znxXvVL.exe
  C:\Windows\System\znxXvVL.exe
  2⤵
  PID:7288
- C:\Windows\System\TWFJqmM.exe
  C:\Windows\System\TWFJqmM.exe
  2⤵
  PID:6256
- C:\Windows\System\rhokrUE.exe
  C:\Windows\System\rhokrUE.exe
  2⤵
  PID:6484
- C:\Windows\System\uAXJFSz.exe
  C:\Windows\System\uAXJFSz.exe
  2⤵
  PID:4520
- C:\Windows\System\NcUOvtX.exe
  C:\Windows\System\NcUOvtX.exe
  2⤵
  PID:4584
- C:\Windows\System\TGIosCV.exe
  C:\Windows\System\TGIosCV.exe
  2⤵
  PID:6572
- C:\Windows\System\ZaldMJR.exe
  C:\Windows\System\ZaldMJR.exe
  2⤵
  PID:2208
- C:\Windows\System\XJFVbQb.exe
  C:\Windows\System\XJFVbQb.exe
  2⤵
  PID:12284
- C:\Windows\System\yOSaDAN.exe
  C:\Windows\System\yOSaDAN.exe
  2⤵
  PID:6260
- C:\Windows\System\BdXgEHU.exe
  C:\Windows\System\BdXgEHU.exe
  2⤵
  PID:9952
- C:\Windows\System\KOlhIJL.exe
  C:\Windows\System\KOlhIJL.exe
  2⤵
  PID:9792
- C:\Windows\System\AdAzHQq.exe
  C:\Windows\System\AdAzHQq.exe
  2⤵
  PID:6656
- C:\Windows\System\XrDUNgl.exe
  C:\Windows\System\XrDUNgl.exe
  2⤵
  PID:9276
- C:\Windows\System\SAFvObB.exe
  C:\Windows\System\SAFvObB.exe
  2⤵
  PID:11556
- C:\Windows\System\IRhGruS.exe
  C:\Windows\System\IRhGruS.exe
  2⤵
  PID:6224
- C:\Windows\System\sQWjueU.exe
  C:\Windows\System\sQWjueU.exe
  2⤵
  PID:11564
- C:\Windows\System\ofPWXLb.exe
  C:\Windows\System\ofPWXLb.exe
  2⤵
  PID:6932
- C:\Windows\System\IzZHiHU.exe
  C:\Windows\System\IzZHiHU.exe
  2⤵
  PID:5392
- C:\Windows\System\amustXP.exe
  C:\Windows\System\amustXP.exe
  2⤵
  PID:5420
- C:\Windows\System\UKSuZVA.exe
  C:\Windows\System\UKSuZVA.exe
  2⤵
  PID:7200
- C:\Windows\System\bTdKxqL.exe
  C:\Windows\System\bTdKxqL.exe
  2⤵
  PID:10408
- C:\Windows\System\dtnaeJR.exe
  C:\Windows\System\dtnaeJR.exe
  2⤵
  PID:8300
- C:\Windows\System\CgnRXjU.exe
  C:\Windows\System\CgnRXjU.exe
  2⤵
  PID:7348
- C:\Windows\System\VvzQtjR.exe
  C:\Windows\System\VvzQtjR.exe
  2⤵
  PID:10884
- C:\Windows\System\eBKTKaz.exe
  C:\Windows\System\eBKTKaz.exe
  2⤵
  PID:8504
- C:\Windows\System\SVmByjn.exe
  C:\Windows\System\SVmByjn.exe
  2⤵
  PID:2996
- C:\Windows\System\JzOIJRl.exe
  C:\Windows\System\JzOIJRl.exe
  2⤵
  PID:1068
- C:\Windows\System\hBCATlW.exe
  C:\Windows\System\hBCATlW.exe
  2⤵
  PID:4756
- C:\Windows\System\WnJadsv.exe
  C:\Windows\System\WnJadsv.exe
  2⤵
  PID:3864
- C:\Windows\System\BigryVr.exe
  C:\Windows\System\BigryVr.exe
  2⤵
  PID:3140
- C:\Windows\System\stJXIqd.exe
  C:\Windows\System\stJXIqd.exe
  2⤵
  PID:12468
- C:\Windows\System\fIPeszC.exe
  C:\Windows\System\fIPeszC.exe
  2⤵
  PID:5352
- C:\Windows\System\SkAKiWc.exe
  C:\Windows\System\SkAKiWc.exe
  2⤵
  PID:3096
- C:\Windows\System\PzgSmdO.exe
  C:\Windows\System\PzgSmdO.exe
  2⤵
  PID:9220
- C:\Windows\System\GAgfEAM.exe
  C:\Windows\System\GAgfEAM.exe
  2⤵
  PID:5912
- C:\Windows\System\VGkobvB.exe
  C:\Windows\System\VGkobvB.exe
  2⤵
  PID:8120
- C:\Windows\System\AAPiYgs.exe
  C:\Windows\System\AAPiYgs.exe
  2⤵
  PID:8176
- C:\Windows\System\qdGiMRV.exe
  C:\Windows\System\qdGiMRV.exe
  2⤵
  PID:9360
- C:\Windows\System\kuFxjeO.exe
  C:\Windows\System\kuFxjeO.exe
  2⤵
  PID:7972
- C:\Windows\System\ajTLAYQ.exe
  C:\Windows\System\ajTLAYQ.exe
  2⤵
  PID:13264
- C:\Windows\System\bOSHySA.exe
  C:\Windows\System\bOSHySA.exe
  2⤵
  PID:5244
- C:\Windows\System\WhmRZpZ.exe
  C:\Windows\System\WhmRZpZ.exe
  2⤵
  PID:8948
- C:\Windows\System\YwVzbCr.exe
  C:\Windows\System\YwVzbCr.exe
  2⤵
  PID:2900
- C:\Windows\System\cLcuISU.exe
  C:\Windows\System\cLcuISU.exe
  2⤵
  PID:7280
- C:\Windows\System\YAZgDkY.exe
  C:\Windows\System\YAZgDkY.exe
  2⤵
  PID:6204
- C:\Windows\System\lKAvXDz.exe
  C:\Windows\System\lKAvXDz.exe
  2⤵
  PID:6296
- C:\Windows\System\IbqOoex.exe
  C:\Windows\System\IbqOoex.exe
  2⤵
  PID:12488
- C:\Windows\System\VBdKcms.exe
  C:\Windows\System\VBdKcms.exe
  2⤵
  PID:6372
- C:\Windows\System\PmEVwRf.exe
  C:\Windows\System\PmEVwRf.exe
  2⤵
  PID:9396
- C:\Windows\System\GHLNtzl.exe
  C:\Windows\System\GHLNtzl.exe
  2⤵
  PID:1984
- C:\Windows\System\LSncidc.exe
  C:\Windows\System\LSncidc.exe
  2⤵
  PID:8628
- C:\Windows\System\FfOvYUC.exe
  C:\Windows\System\FfOvYUC.exe
  2⤵
  PID:6452
- C:\Windows\System\FijnMhV.exe
  C:\Windows\System\FijnMhV.exe
  2⤵
  PID:824
- C:\Windows\System\ynOdjdb.exe
  C:\Windows\System\ynOdjdb.exe
  2⤵
  PID:13064
- C:\Windows\System\EbTCcIi.exe
  C:\Windows\System\EbTCcIi.exe
  2⤵
  PID:5884
- C:\Windows\System\xBAiiMD.exe
  C:\Windows\System\xBAiiMD.exe
  2⤵
  PID:8904
- C:\Windows\System\fEYdKAR.exe
  C:\Windows\System\fEYdKAR.exe
  2⤵
  PID:6692
- C:\Windows\System\kOEBKPp.exe
  C:\Windows\System\kOEBKPp.exe
  2⤵
  PID:6840
- C:\Windows\System\rPBjvxg.exe
  C:\Windows\System\rPBjvxg.exe
  2⤵
  PID:6716
- C:\Windows\System\NYXWjZL.exe
  C:\Windows\System\NYXWjZL.exe
  2⤵
  PID:12880
- C:\Windows\System\kWUKecg.exe
  C:\Windows\System\kWUKecg.exe
  2⤵
  PID:7640
- C:\Windows\System\kOKeRSU.exe
  C:\Windows\System\kOKeRSU.exe
  2⤵
  PID:7152
- C:\Windows\System\gQliCjB.exe
  C:\Windows\System\gQliCjB.exe
  2⤵
  PID:9212
- C:\Windows\System\OfTXDLm.exe
  C:\Windows\System\OfTXDLm.exe
  2⤵
  PID:6940
- C:\Windows\System\FaCAEty.exe
  C:\Windows\System\FaCAEty.exe
  2⤵
  PID:7160
- C:\Windows\System\FRYoMQx.exe
  C:\Windows\System\FRYoMQx.exe
  2⤵
  PID:7860
- C:\Windows\System\aaDmfEj.exe
  C:\Windows\System\aaDmfEj.exe
  2⤵
  PID:8352
- C:\Windows\System\pRAtYkT.exe
  C:\Windows\System\pRAtYkT.exe
  2⤵
  PID:8668
- C:\Windows\System\blfDsGY.exe
  C:\Windows\System\blfDsGY.exe
  2⤵
  PID:8688
- C:\Windows\System\YeGfCZQ.exe
  C:\Windows\System\YeGfCZQ.exe
  2⤵
  PID:7976
- C:\Windows\System\SBBsxJM.exe
  C:\Windows\System\SBBsxJM.exe
  2⤵
  PID:7940
- C:\Windows\System\BjVGFPn.exe
  C:\Windows\System\BjVGFPn.exe
  2⤵
  PID:9140
- C:\Windows\System\mminkrP.exe
  C:\Windows\System\mminkrP.exe
  2⤵
  PID:12276
- C:\Windows\System\HdojEWh.exe
  C:\Windows\System\HdojEWh.exe
  2⤵
  PID:6680
- C:\Windows\System\EqUgtBa.exe
  C:\Windows\System\EqUgtBa.exe
  2⤵
  PID:7392
- C:\Windows\System\OTLRoJQ.exe
  C:\Windows\System\OTLRoJQ.exe
  2⤵
  PID:11616
- C:\Windows\System\molYhWy.exe
  C:\Windows\System\molYhWy.exe
  2⤵
  PID:2472
- C:\Windows\System\LcbljPh.exe
  C:\Windows\System\LcbljPh.exe
  2⤵
  PID:6456
- C:\Windows\System\ZMLxejj.exe
  C:\Windows\System\ZMLxejj.exe
  2⤵
  PID:5280
- C:\Windows\System\PjjDILh.exe
  C:\Windows\System\PjjDILh.exe
  2⤵
  PID:3260
- C:\Windows\System\TOXueIW.exe
  C:\Windows\System\TOXueIW.exe
  2⤵
  PID:9048
- C:\Windows\System\QDnShII.exe
  C:\Windows\System\QDnShII.exe
  2⤵
  PID:4588
- C:\Windows\System\PLFOAlr.exe
  C:\Windows\System\PLFOAlr.exe
  2⤵
  PID:1704
- C:\Windows\System\ekoMYoh.exe
  C:\Windows\System\ekoMYoh.exe
  2⤵
  PID:7132
- C:\Windows\System\mACybpX.exe
  C:\Windows\System\mACybpX.exe
  2⤵
  PID:9332
- C:\Windows\System\xGhbcQS.exe
  C:\Windows\System\xGhbcQS.exe
  2⤵
  PID:1604
- C:\Windows\System\cLxQSgW.exe
  C:\Windows\System\cLxQSgW.exe
  2⤵
  PID:6552
- C:\Windows\System\bbsDZzj.exe
  C:\Windows\System\bbsDZzj.exe
  2⤵
  PID:9644
- C:\Windows\System\nYMtbyg.exe
  C:\Windows\System\nYMtbyg.exe
  2⤵
  PID:9596
- C:\Windows\System\JhJfXkd.exe
  C:\Windows\System\JhJfXkd.exe
  2⤵
  PID:7032
- C:\Windows\System\WwSMaRm.exe
  C:\Windows\System\WwSMaRm.exe
  2⤵
  PID:9652
- C:\Windows\System\TfKVAoS.exe
  C:\Windows\System\TfKVAoS.exe
  2⤵
  PID:9700
- C:\Windows\System\cWnFkXZ.exe
  C:\Windows\System\cWnFkXZ.exe
  2⤵
  PID:6620
- C:\Windows\System\ZdaRusk.exe
  C:\Windows\System\ZdaRusk.exe
  2⤵
  PID:12228
- C:\Windows\System\OBFyAdJ.exe
  C:\Windows\System\OBFyAdJ.exe
  2⤵
  PID:9836
- C:\Windows\System\vujpwuz.exe
  C:\Windows\System\vujpwuz.exe
  2⤵
  PID:9944
- C:\Windows\System\VYpTsnw.exe
  C:\Windows\System\VYpTsnw.exe
  2⤵
  PID:8392
- C:\Windows\System\ORmYhSs.exe
  C:\Windows\System\ORmYhSs.exe
  2⤵
  PID:10036
- C:\Windows\System\MnJgtDe.exe
  C:\Windows\System\MnJgtDe.exe
  2⤵
  PID:10808
- C:\Windows\System\fFofsdJ.exe
  C:\Windows\System\fFofsdJ.exe
  2⤵
  PID:10960
- C:\Windows\System\sbuIdIQ.exe
  C:\Windows\System\sbuIdIQ.exe
  2⤵
  PID:11044
- C:\Windows\System\cZHaxyh.exe
  C:\Windows\System\cZHaxyh.exe
  2⤵
  PID:3460
- C:\Windows\System\QmSyEYf.exe
  C:\Windows\System\QmSyEYf.exe
  2⤵
  PID:3612
- C:\Windows\System\DXULPyu.exe
  C:\Windows\System\DXULPyu.exe
  2⤵
  PID:2344
- C:\Windows\System\fBQejoR.exe
  C:\Windows\System\fBQejoR.exe
  2⤵
  PID:5200
- C:\Windows\System\qmtiAaf.exe
  C:\Windows\System\qmtiAaf.exe
  2⤵
  PID:2168
- C:\Windows\System\LocivWm.exe
  C:\Windows\System\LocivWm.exe
  2⤵
  PID:1600
- C:\Windows\System\EGAyUdk.exe
  C:\Windows\System\EGAyUdk.exe
  2⤵
  PID:12648
- C:\Windows\System\bXqbsel.exe
  C:\Windows\System\bXqbsel.exe
  2⤵
  PID:9280
- C:\Windows\System\hUPcEbZ.exe
  C:\Windows\System\hUPcEbZ.exe
  2⤵
  PID:8924
- C:\Windows\System\pFaMsSa.exe
  C:\Windows\System\pFaMsSa.exe
  2⤵
  PID:10100
- C:\Windows\System\lfKmMVR.exe
  C:\Windows\System\lfKmMVR.exe
  2⤵
  PID:13156
- C:\Windows\System\IYQaRQH.exe
  C:\Windows\System\IYQaRQH.exe
  2⤵
  PID:7192
- C:\Windows\System\KKcjqHh.exe
  C:\Windows\System\KKcjqHh.exe
  2⤵
  PID:6060
- C:\Windows\System\nVcJamS.exe
  C:\Windows\System\nVcJamS.exe
  2⤵
  PID:5456
- C:\Windows\System\nVfdgPu.exe
  C:\Windows\System\nVfdgPu.exe
  2⤵
  PID:7864
- C:\Windows\System\aUEdtrK.exe
  C:\Windows\System\aUEdtrK.exe
  2⤵
  PID:6216
- C:\Windows\System\owkOFlB.exe
  C:\Windows\System\owkOFlB.exe
  2⤵
  PID:10360
- C:\Windows\System\BjmmdIc.exe
  C:\Windows\System\BjmmdIc.exe
  2⤵
  PID:10980
- C:\Windows\System\HcDcKjr.exe
  C:\Windows\System\HcDcKjr.exe
  2⤵
  PID:10512
- C:\Windows\System\jNojsHw.exe
  C:\Windows\System\jNojsHw.exe
  2⤵
  PID:10552
- C:\Windows\System\lOPJKDJ.exe
  C:\Windows\System\lOPJKDJ.exe
  2⤵
  PID:12608
- C:\Windows\System\ibxULtx.exe
  C:\Windows\System\ibxULtx.exe
  2⤵
  PID:10616
- C:\Windows\System\NOgdffB.exe
  C:\Windows\System\NOgdffB.exe
  2⤵
  PID:10704
- C:\Windows\System\aQpciHm.exe
  C:\Windows\System\aQpciHm.exe
  2⤵
  PID:12820
- C:\Windows\System\HICDFsH.exe
  C:\Windows\System\HICDFsH.exe
  2⤵
  PID:6476
- C:\Windows\System\aOBpYnA.exe
  C:\Windows\System\aOBpYnA.exe
  2⤵
  PID:12920
- C:\Windows\System\UBLPRrw.exe
  C:\Windows\System\UBLPRrw.exe
  2⤵
  PID:1816
- C:\Windows\System\VRnCEPX.exe
  C:\Windows\System\VRnCEPX.exe
  2⤵
  PID:11040
- C:\Windows\System\pLUFtNu.exe
  C:\Windows\System\pLUFtNu.exe
  2⤵
  PID:6592
- C:\Windows\System\jMmVUmw.exe
  C:\Windows\System\jMmVUmw.exe
  2⤵
  PID:2368
- C:\Windows\System\sTjziWy.exe
  C:\Windows\System\sTjziWy.exe
  2⤵
  PID:10620
- C:\Windows\System\ylfmjQG.exe
  C:\Windows\System\ylfmjQG.exe
  2⤵
  PID:10132
- C:\Windows\System\EeCcSjB.exe
  C:\Windows\System\EeCcSjB.exe
  2⤵
  PID:7012
- C:\Windows\System\tWTiBJr.exe
  C:\Windows\System\tWTiBJr.exe
  2⤵
  PID:6832
- C:\Windows\System\FRAUpNr.exe
  C:\Windows\System\FRAUpNr.exe
  2⤵
  PID:6996
- C:\Windows\System\JnZMRsS.exe
  C:\Windows\System\JnZMRsS.exe
  2⤵
  PID:7044
- C:\Windows\System\aPLVHhV.exe
  C:\Windows\System\aPLVHhV.exe
  2⤵
  PID:6892
- C:\Windows\System\UWbMkvz.exe
  C:\Windows\System\UWbMkvz.exe
  2⤵
  PID:8672
- C:\Windows\System\lvIZfPp.exe
  C:\Windows\System\lvIZfPp.exe
  2⤵
  PID:10868
- C:\Windows\System\xGwaLEW.exe
  C:\Windows\System\xGwaLEW.exe
  2⤵
  PID:10816
- C:\Windows\System\zMpjJCz.exe
  C:\Windows\System\zMpjJCz.exe
  2⤵
  PID:11156
- C:\Windows\System\CxzyrQj.exe
  C:\Windows\System\CxzyrQj.exe
  2⤵
  PID:9404
- C:\Windows\System\YiEYyLg.exe
  C:\Windows\System\YiEYyLg.exe
  2⤵
  PID:10444
- C:\Windows\System\RsTTFEu.exe
  C:\Windows\System\RsTTFEu.exe
  2⤵
  PID:8816
- C:\Windows\System\ghGRYQo.exe
  C:\Windows\System\ghGRYQo.exe
  2⤵
  PID:10976
- C:\Windows\System\fAAtcuo.exe
  C:\Windows\System\fAAtcuo.exe
  2⤵
  PID:10904
- C:\Windows\System\sBXppPt.exe
  C:\Windows\System\sBXppPt.exe
  2⤵
  PID:3200
- C:\Windows\System\dKjSvNO.exe
  C:\Windows\System\dKjSvNO.exe
  2⤵
  PID:11232
- C:\Windows\System\dHHNUVI.exe
  C:\Windows\System\dHHNUVI.exe
  2⤵
  PID:12272
- C:\Windows\System\qwtOfOC.exe
  C:\Windows\System\qwtOfOC.exe
  2⤵
  PID:6584
- C:\Windows\System\cLVQNJy.exe
  C:\Windows\System\cLVQNJy.exe
  2⤵
  PID:9208
- C:\Windows\System\ujpaifm.exe
  C:\Windows\System\ujpaifm.exe
  2⤵
  PID:2256
- C:\Windows\System\sLqpmaf.exe
  C:\Windows\System\sLqpmaf.exe
  2⤵
  PID:11368
- C:\Windows\System\SVCKhaA.exe
  C:\Windows\System\SVCKhaA.exe
  2⤵
  PID:11500
- C:\Windows\System\ReVVYYy.exe
  C:\Windows\System\ReVVYYy.exe
  2⤵
  PID:3472
- C:\Windows\System\TDfiSKW.exe
  C:\Windows\System\TDfiSKW.exe
  2⤵
  PID:7040
- C:\Windows\System\nBEgHJG.exe
  C:\Windows\System\nBEgHJG.exe
  2⤵
  PID:3644
- C:\Windows\System\oOfdjdo.exe
  C:\Windows\System\oOfdjdo.exe
  2⤵
  PID:6596
- C:\Windows\System\bknxBfZ.exe
  C:\Windows\System\bknxBfZ.exe
  2⤵
  PID:11536
- C:\Windows\System\LHFRgCS.exe
  C:\Windows\System\LHFRgCS.exe
  2⤵
  PID:9636
- C:\Windows\System\WqmZnIt.exe
  C:\Windows\System\WqmZnIt.exe
  2⤵
  PID:11800
- C:\Windows\System\UzCFaYx.exe
  C:\Windows\System\UzCFaYx.exe
  2⤵
  PID:8524
- C:\Windows\System\fKmBPHI.exe
  C:\Windows\System\fKmBPHI.exe
  2⤵
  PID:11844
- C:\Windows\System\mLfNvIH.exe
  C:\Windows\System\mLfNvIH.exe
  2⤵
  PID:9292
- C:\Windows\System\VBUIfMS.exe
  C:\Windows\System\VBUIfMS.exe
  2⤵
  PID:9368
- C:\Windows\System\tNxJbKQ.exe
  C:\Windows\System\tNxJbKQ.exe
  2⤵
  PID:9364
- C:\Windows\System\XTBHnTa.exe
  C:\Windows\System\XTBHnTa.exe
  2⤵
  PID:2808
- C:\Windows\System\QECWtUH.exe
  C:\Windows\System\QECWtUH.exe
  2⤵
  PID:11888
- C:\Windows\System\AJgpOHN.exe
  C:\Windows\System\AJgpOHN.exe
  2⤵
  PID:6504
- C:\Windows\System\YszrPOo.exe
  C:\Windows\System\YszrPOo.exe
  2⤵
  PID:3688
- C:\Windows\System\ITBEXZP.exe
  C:\Windows\System\ITBEXZP.exe
  2⤵
  PID:9592
- C:\Windows\System\jVwFLMB.exe
  C:\Windows\System\jVwFLMB.exe
  2⤵
  PID:11904

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 516 -i 516 -h 464 -j 468 -s 476 -d 2224
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dtwgzveh.sp4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\Bqjhotg.exe

Filesize
2.0MB

MD5
8c76b40dc305acc72e58f02d66462c14

SHA1
05aa3381cef70ea8b45113eab361517afc718e36

SHA256
7ddd2f77cb5ab5f811210e4db345a0aabafd60711098474aaabaf11ff34f3bf8

SHA512
dbca2a9b2a7d76eb4c016951925b6f059f07ebaef57b5fecc5c21bd3e860ee5acfb6fb0a573785ff292bd48a96351e7da9a1709a7ff2fba1b33a3d7f43c47b36

Download Submit
C:\Windows\System\DyjpLqC.exe

Filesize
2.0MB

MD5
d86a00ce01f1a79c6198a99208514905

SHA1
ccdcae257c7568241e2b20d5ec95c6676efa7d58

SHA256
2f8892f180c2a69352297c7de0c9439087d07e442898d2b0ecdab72349df9429

SHA512
1bd22c7ccf9ad1299cbc57c81b071b6fe5bbeddb4c29aed3aaefef5fc3267c0e97f102d331f6585ab27b4e3bd5c7691b155ab094b323f2235bd1a00bf9c2665e

Download Submit
C:\Windows\System\IHBdYgZ.exe

Filesize
2.0MB

MD5
3778f644449e890851b9bba806d4ccbd

SHA1
978d303fdcc49ba04925838042cb0afaeb899a4a

SHA256
a65f52101fe81f81dedda96183db91a2133d2264da91af1980d6d81c8369b63b

SHA512
add70beb6fe12528ce2f4731bba57aad62b4ca0c7904066d13273aed8babf1d51f61464a4627d8dbcb7910703e522833ae7ec21050a8835ad5eb7f94ec516bac

Download Submit
C:\Windows\System\KHbQuqG.exe

Filesize
2.0MB

MD5
051ad3ffe0542bd820db0055bb76b20e

SHA1
8c1539cec3366bd2c4319e2a7542c51f1e2bf0f1

SHA256
f6f1400183283aee16d45b07ab107ac051c2ed529982069ec5acf54b724ae1ee

SHA512
4edfc4725eb758847ce28f365a2a46f47e7c2eed509f881a11abd89cd697dc982bba2a5b8856c3d176a1d2c4701b300d521b57fc50460d6fa35a6795306fe510

Download Submit
C:\Windows\System\KtQxqZD.exe

Filesize
2.0MB

MD5
83abd9483a547b3dc49875e5e36283aa

SHA1
f69ecee65df4ab36a38f9a2b5cd700ac783888dd

SHA256
8bbc24e942036ed87b359e76e9b2e33bb91dbc2b69bdc2f73d36551d421560ee

SHA512
3565cb7c4fab9c530d3c23518d28708e05633848d24724157c5e604850039cdaed0eba296085aca13fec8e1b164987f27d0153baa813ebe76a429442219926b5

Download Submit
C:\Windows\System\LQeZSiJ.exe

Filesize
2.0MB

MD5
558084721493856bec132359f55461f7

SHA1
f157655ab586939db995b570db3c0394efa6fac9

SHA256
4beaa9a3d8d793e00fcfa690f65e6c0ddd4103f0aeccac3ede3c95edf6bfd935

SHA512
2468e99a0307e1fdecd97ab9cff20d98296b416b442884fa46404e22a58b5303c6088ee752516598b62e4b15af17af69a7fe67b7d3c0eb6ce0e044448620004c

Download Submit
C:\Windows\System\Mhdgmuo.exe

Filesize
2.0MB

MD5
ca47d5a50e0cb276a6676e1875fb7ccb

SHA1
efaee99450af069a5e1783f77eec6a86eb46702a

SHA256
6210104792e19e8a8da86a148dacb6ccf5d8c777a752e48574d0c1e301d7b8a4

SHA512
f76faa39e7c393ef66f92b2816821be3edcc61b3adee46fd54a1d66f7c45a1f9ae68d82435c9ff7ef8ac7fd42e397253ceb50037fab54e4eeb0186808ad55443

Download Submit
C:\Windows\System\MwuMQRl.exe

Filesize
2.0MB

MD5
5bcfca4d14d3aa3fc9a2aa35c0ba37b3

SHA1
98ddc2c8b923448e5503580614b0daa8951c7ecc

SHA256
6919fbdff07c83d82938261e85b3f6978b74af413526119a20c8e579ceb60fa5

SHA512
e7f29cd68bd0f3d4926b8f1460418a1f6215a778abf264ed9cbe9b2bed0038562b4e5f88d882e36a9f99c507c14363f9b8c309c2a17e0c9c51d459e6010f203f

Download Submit
C:\Windows\System\PJQhMsN.exe

Filesize
2.0MB

MD5
d0e2eb485cd25f1c020b64620b096ead

SHA1
912cae93ccaae5f046ede55802fb4882e306fde7

SHA256
6a6ba4a77a51c3a47e9d1e56c52aebe0d5175804ceb181fec6bb994a457432ad

SHA512
d6aec3e9c60d2e18b6a4309e566fafecaa57bc17fc894ba54ced646f1ac361c9cb2e85b8fddc0aa7bd24c9ca7f4befa57e947329eb65ccfa464769fdc4c0e68d

Download Submit
C:\Windows\System\SYEwTLm.exe

Filesize
2.0MB

MD5
bc1f4c27da93bb283234703c6e0c3f35

SHA1
3b14adb3e7d4043b877228eef1caa1a22078e197

SHA256
1641ca2926d6ce1343732c7c933f225809e67fa2c1691e8c7dd40b2d821ab4b1

SHA512
601801de4d5a0dafc5bdec45f69ca74d8f9b8852e875551ebf467f4f9534e6f0d043c31e65901a10ae26d4d017cce15dbf239e6bbb2818487854f9081aba703c

Download Submit
C:\Windows\System\TkZsGyk.exe

Filesize
2.0MB

MD5
2a28e21b63786f245e2bf1d8a6485ec8

SHA1
640f420a297dc105b91f553fb3c20a1df8c06dc0

SHA256
7291cf68c68baa98c7099295b1b24a059a505777012685a0905ed899f975656f

SHA512
446455156e9d38811e0a3e855e8f1f60ac55da17b239b0cdfa5f7c8b7700b0e61adf781c50fdab492fa7d1a75b94882992edec12d0d1a6f94f3d5444ef3d5939

Download Submit
C:\Windows\System\UmZJkVb.exe

Filesize
2.0MB

MD5
9b9085e961519b41632493126d737afa

SHA1
d6dc5a5e616ebf45e3d8eac8b3cfee1df9cca506

SHA256
b388946a9fafece97985098d0495432122475d1117e739bb8ab4563576f6156e

SHA512
861c5b261447494f0f7685f4b7d2635921a4b186febd138b46b93922a3e9b5f9da8a25f3a0b70d9c131e39728c990cd78d362e3e391c63ea0197d251bcc5b7d2

Download Submit
C:\Windows\System\VcZEqsK.exe

Filesize
2.0MB

MD5
406a6ace78724cd1c686004830a474e0

SHA1
a6de9506739399bfc0c32fc4f06325b9ebf34800

SHA256
ea5d9e5ee302e7ed1a0501e1f9c78cd41bc2636db7f4050b23cafc7badadf606

SHA512
67af54a4ec52072abaef883894d89d8fc535cebe15746c1abe6d06ac2e30ff1faa9f4988b159341d4698b05037aa4517e9e2178686e6b7c53f56e787a8b4deaa

Download Submit
C:\Windows\System\WywnCDb.exe

Filesize
2.0MB

MD5
4e8aa5aa2c71b8d7fe7108e8154ec5af

SHA1
05c9d731c2d6ec34b2f89c5678b26e129416c84b

SHA256
007335bcb243f1b158767d81e60b72072cf6dccc28a1264664ecfa6d4d288242

SHA512
0cd69a67be57210a905dc22f9ea7b57c20b734c9fb93972513c062af37657ee5980408d0ddd200c62ea2039c614e788cb74be0f1d210aab66935394d6aee3238

Download Submit
C:\Windows\System\ZEDuNnm.exe

Filesize
2.0MB

MD5
48631f3946a20e45769986cb377df9d4

SHA1
393c6bed709fc4c0a7d2edbec9883f407f45a406

SHA256
cc219b4406e68f3c025f4069f31e13c60ba21b5a4e08d308dec4054bd0aebaa9

SHA512
1644dd7be964ccded5517bc45cec4d1059d48c6fbdea66a292806abedc238c21609b351ba8299541bfbf4a2dbfab06f526367f993c65f70744649373de1d76e1

Download Submit
C:\Windows\System\aPZPmmR.exe

Filesize
2.0MB

MD5
ee5b91eb21a32e8023202dd8fd90e342

SHA1
152547cb04313fbd0c8dac7f4c55a03a9d966e5b

SHA256
67ebdf7c5b69310abc18157ebb8fb917bb9c52e13715c1200c032e81043b8201

SHA512
11798378285e59394d47aa9c98222aef0de3ba628029115f615fc40c5b1c93f234c6b8c761a2ce8702778e8ba5b2f8cfa76db97b31c3db6972d738f541687d3b

Download Submit
C:\Windows\System\dEszwcZ.exe

Filesize
2.0MB

MD5
9691cf55c00a2836ecab6d395a072928

SHA1
39153166f0e044dc0fb714f85795b257514fd584

SHA256
86c32269d332978d4cbf5e9de62eee08db2149e7ff8e36cdda4ff2f346186ec7

SHA512
92dc7da1df820f13d93d1e710d421e27463e46c26874a4e8fde11ec908891417e050689ae37697a95d4665eda1077df35b08cc63f00e607af5dc5787738dbeab

Download Submit
C:\Windows\System\eJOVBgs.exe

Filesize
2.0MB

MD5
b2ecb0e98c4992b34ed0522e30bd74fe

SHA1
330326f6f19e39c0eff5027cef40b2b235129899

SHA256
8203e5c02047d3ebbc2c20bbb6c55891b75e3c8368ae3685b4c7381944a67652

SHA512
d6b7438a911a3ff42c9b6b69b269d46de99d2952a4f84f5a69d707c4407c5d26e88d278458c36690bf905a5880e2123b0cd6fe189a93b8b9c359eaf0dfe74e2e

Download Submit
C:\Windows\System\eRQqwtk.exe

Filesize
2.0MB

MD5
a312803bbbe020c7bc43dc446b592e44

SHA1
5a8928e5871dd48a1d83d74c75cb9a34995d0ff3

SHA256
cc136f642641b878bfe4bc0307b04ec871fff2cc1efa2e79c6c5ccc1596b3beb

SHA512
f311b4b6bd76401612a2e3f7cc2685acc268cd3e3f5bd01f72aa734841a3ed2bd1f5f53c322e35579c3eff50182e55b2f77118dac4ce215e1634746e000e8ee4

Download Submit
C:\Windows\System\efdDPXh.exe

Filesize
2.0MB

MD5
cba04dad97cfbca6af169d8753d7fad6

SHA1
db11556a403a8b6233e009e07770ce0d375e2f67

SHA256
d9f79f3dd930b0d51c2e3414d36590ca8b4f8f079c3c58d695257f4dfa7e392f

SHA512
5508f882a7ab84887c0e1f75cf3e6aa2979a562bbf32e42cf136c90c5d543c2560847d7898d841c91db80720916d53d31dd4afba3bed3825da191a86c2e20c2e

Download Submit
C:\Windows\System\foEuhCt.exe

Filesize
2.0MB

MD5
63aac40b2c1d2a28979b1398a371e13d

SHA1
0dcd4d52697ba22ea4fc3e8b9aa4e368f5c23c2b

SHA256
1357f0b2110f1bf0db8d629d49d713ee7262b47a25c4282895be97c750de6c26

SHA512
7de19197743478a997df3d55ccb85b2680035cd4e068f6239bd887ba51cb2941d8179d1daa05966d98140446e7c5c9cd850507d6b88c14c140f3fa263560207c

Download Submit
C:\Windows\System\hYgckVE.exe

Filesize
2.0MB

MD5
0152e1fae71b974ef3b9a7e23dcdfd9e

SHA1
3f45120db8c235966c9bbd133eb5ffec518d45fe

SHA256
358ed3fc802e9be6a1a64b453b0340da570433714e90162765015d88f759cc26

SHA512
609a07da9d78858c8088825dedf5c1bdfd93c6738a760a575a9454872020653feb8a7f384b511e0666f8ec54d0279eaefdfc9578c4a483a1627791c9c8bc0f7b

Download Submit
C:\Windows\System\hgZDFGB.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\ifZmTbR.exe

Filesize
2.0MB

MD5
1a20e18bc8d97a512765d64a8191874d

SHA1
842f5e86e995b143af6ce0d972b461fb3fb129a6

SHA256
1306727f49be9f093ad99985bca124eddcb3671e9a6c4c4f5dad78e30c1db76d

SHA512
c471725ac3ed0afaf7fd9ef5782d062d50868e099974761ed944304e91eba9fec40828630580cf9c4e2f38f9077ddb13526be09120c49624006665b089a36347

Download Submit
C:\Windows\System\jGTFQcY.exe

Filesize
2.0MB

MD5
648251ddca420674cf4c5a9746f56049

SHA1
9fd454fe7e8e5b8c1efac918190bc11b1bef6c50

SHA256
d7313df55b98fa64a5ee356fec3ddc067f9a79ac6f918e1fabe546087f82ebcc

SHA512
4ca155193cfaa96e584fa203ea07097b6231125fdf0b33e6c15b81ddfab2301bf875b763dae51bc83c563dd3b71e9f5326a5d5fb1275844eed0c0838ed9f72e1

Download Submit
C:\Windows\System\nFfwcoz.exe

Filesize
2.0MB

MD5
e416f0452d4ea17e1b7b510094be34ab

SHA1
cba9b0b5a1cccc17f97d5b14cbf54d58ac067696

SHA256
10bbb87a9ff2afb20597fcf276bbffb7741389c06590080bba08cb1625e858cc

SHA512
bbbd9d01a7635337d2422f8c027cdf26859e58e4ffc6b069be6c08721fb62d4ef9ee60a78648ebb424b521b9a8a8cecf4cfc511bf344af0b9450793bcf04a397

Download Submit
C:\Windows\System\pNNgoYA.exe

Filesize
2.0MB

MD5
276aa2ae8861a427a967491048767f60

SHA1
272d9395b3465f96946982b978b3701e44806a0d

SHA256
25823043cf03c091b65d538ddcab91dc212694aa0d7ab0288601aaba624a6ab5

SHA512
67a8b62b6151293384670e00ce0cec68ee26b5d645682f02d256d3e529a975920ae6996136f86a0a36908f46c7c6cb96cb03975a7ad98cf15793d44b4bce52a6

Download Submit
C:\Windows\System\rFBeDnt.exe

Filesize
2.0MB

MD5
fc13290c14edfa15dbac9bea92f271d1

SHA1
d5e4e79a09b9fac2564ddcba2944ab2dbf1b032d

SHA256
ce2a4c2fb72cde778c9c0de4f6de6a15e632621f38eda501ae2871463ffee831

SHA512
302b7c7dbaf368bf2faa5f8fb9cfd4ac4c52d385966677f8764f7c3a55ca5e1b26abc75cf40c74b5314ad51344aa9a61cfa19f6cf4d0f7dd148bab7b1bb06e27

Download Submit
C:\Windows\System\rfdrBqi.exe

Filesize
2.0MB

MD5
ac0df176d41f1091b8780e196a34e502

SHA1
68b2f34b07cbfbb6e8edff29208b482951175474

SHA256
a6d1eec1a0282a50d47023fb197609ce8d63b8dbc8375072fcb3063b96a69cf0

SHA512
bda3c6ffbf5425fdde7b6853b15dfedde43e87c17a48b332a0165cb063cf8f8c7bc99768a2e0fcc543c809cbc29743efba2b2091f9e3155c088b2e6a7b419978

Download Submit
C:\Windows\System\tBmwPnY.exe

Filesize
2.0MB

MD5
5ad3ece088300d605809692c8a895ba7

SHA1
e9ad38cf23515368644fbb5a40751497cb87c88d

SHA256
776f9c92d5bac0975cabca24a9f18231abec0d8a29cbb22ac5f70dea40f6d00c

SHA512
141dc5151f734da128bef4eb98abb966e4a51459deb11609ecbd423996036ec1b2475c98390c8f36163078b5be51f0c988a84d85238631087cc0a7270a5bbefe

Download Submit
C:\Windows\System\xOVVUIw.exe

Filesize
2.0MB

MD5
85d3b42b9fd2ce3a52b5bebe8bb190a9

SHA1
c9b56fdc155dee92cea3ede22582b7845cfa81e8

SHA256
08371d19262d59adecf9fc8f78d71000afad707537623bddee5f18a54e2baa26

SHA512
5591e318431cd1090df34e69d824acc1da49627eebc0fd9a0c902aed5ba464e9d7c813b9a0ca562eb03d12028f385a8d335f10905ef6f1d58a1885629d6848b2

Download Submit
C:\Windows\System\xskBWPG.exe

Filesize
2.0MB

MD5
7b5e9854fcd807866997d77c5caacfab

SHA1
75b793eee1d46d00f41714c63f074771f1820df1

SHA256
1d00a710b6a7f4b0100631c221904c900b617ec57c3ed6b0ea4f4f5841dd24d7

SHA512
c90288e71abec856d79956187dd0147a067b8a62ee6adff983623bb5ee9e7abd0e40590fa31044c838e7e029f1f08d5eba37e1998c9fda446c3fc6542c2483e3

Download Submit
C:\Windows\System\xycUEJc.exe

Filesize
2.0MB

MD5
bdd31ab688a522546a69109e9663adc5

SHA1
d75b37dae2286480b7943fba75ff1550f1b73682

SHA256
9281809128652a09355e587243cc2470842ab7f88bcea92e99dcbd33bb5f859b

SHA512
6bd403c8e0312602cb12d1e575975c5d84bb8d889393397f344dbb2ae816d2b3e72088c95eec29cf59bb147a488d5cd68b6144caa7ea97f602b243a6be10104c

Download Submit
memory/400-128-0x00007FF61B490000-0x00007FF61B882000-memory.dmp

Filesize
3.9MB

Download
memory/572-121-0x00007FF6A8D70000-0x00007FF6A9162000-memory.dmp

Filesize
3.9MB

Download
memory/772-135-0x00007FF6A2FF0000-0x00007FF6A33E2000-memory.dmp

Filesize
3.9MB

Download
memory/772-4429-0x00007FF6A2FF0000-0x00007FF6A33E2000-memory.dmp

Filesize
3.9MB

Download
memory/1500-57-0x00007FF69A6E0000-0x00007FF69AAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1500-4257-0x00007FF69A6E0000-0x00007FF69AAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1512-4398-0x00007FF7AC380000-0x00007FF7AC772000-memory.dmp

Filesize
3.9MB

Download
memory/1512-108-0x00007FF7AC380000-0x00007FF7AC772000-memory.dmp

Filesize
3.9MB

Download
memory/1996-3362-0x00007FF72E850000-0x00007FF72EC42000-memory.dmp

Filesize
3.9MB

Download
memory/1996-155-0x00007FF72E850000-0x00007FF72EC42000-memory.dmp

Filesize
3.9MB

Download
memory/2244-66-0x00007FF74F1F0000-0x00007FF74F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-4283-0x00007FF74F1F0000-0x00007FF74F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2264-59-0x00007FF6B18F0000-0x00007FF6B1CE2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-81-0x000001D364CC0000-0x000001D364CE2000-memory.dmp

Filesize
136KB

Download
memory/2268-5-0x00007FFA7F9B3000-0x00007FFA7F9B5000-memory.dmp

Filesize
8KB

Download
memory/2268-180-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

Filesize
10.8MB

Download
memory/2268-4314-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

Filesize
10.8MB

Download
memory/2268-284-0x000001D365890000-0x000001D366036000-memory.dmp

Filesize
7.6MB

Download
memory/2268-47-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

Filesize
10.8MB

Download
memory/2268-23-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

Filesize
10.8MB

Download
memory/2392-134-0x00007FF737840000-0x00007FF737C32000-memory.dmp

Filesize
3.9MB

Download
memory/2392-4402-0x00007FF737840000-0x00007FF737C32000-memory.dmp

Filesize
3.9MB

Download
memory/2676-91-0x00007FF6FB910000-0x00007FF6FBD02000-memory.dmp

Filesize
3.9MB

Download
memory/2676-4384-0x00007FF6FB910000-0x00007FF6FBD02000-memory.dmp

Filesize
3.9MB

Download
memory/2764-103-0x00007FF690200000-0x00007FF6905F2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-4395-0x00007FF690200000-0x00007FF6905F2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-62-0x00007FF7BEAC0000-0x00007FF7BEEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-4281-0x00007FF7BEAC0000-0x00007FF7BEEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-4286-0x00007FF6B5870000-0x00007FF6B5C62000-memory.dmp

Filesize
3.9MB

Download
memory/2980-1615-0x00007FF6B5870000-0x00007FF6B5C62000-memory.dmp

Filesize
3.9MB

Download
memory/2980-67-0x00007FF6B5870000-0x00007FF6B5C62000-memory.dmp

Filesize
3.9MB

Download
memory/3112-60-0x00007FF6E4BF0000-0x00007FF6E4FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3112-4273-0x00007FF6E4BF0000-0x00007FF6E4FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-133-0x00007FF67CBC0000-0x00007FF67CFB2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-1-0x0000023E99430000-0x0000023E99440000-memory.dmp

Filesize
64KB

Download
memory/3216-0-0x00007FF67CBC0000-0x00007FF67CFB2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-164-0x00007FF685B40000-0x00007FF685F32000-memory.dmp

Filesize
3.9MB

Download
memory/3760-131-0x00007FF652AB0000-0x00007FF652EA2000-memory.dmp

Filesize
3.9MB

Download
memory/3796-4264-0x00007FF7D10A0000-0x00007FF7D1492000-memory.dmp

Filesize
3.9MB

Download
memory/3796-52-0x00007FF7D10A0000-0x00007FF7D1492000-memory.dmp

Filesize
3.9MB

Download
memory/3948-4271-0x00007FF6B8A60000-0x00007FF6B8E52000-memory.dmp

Filesize
3.9MB

Download
memory/3948-61-0x00007FF6B8A60000-0x00007FF6B8E52000-memory.dmp

Filesize
3.9MB

Download
memory/4080-4387-0x00007FF7DFED0000-0x00007FF7E02C2000-memory.dmp

Filesize
3.9MB

Download
memory/4080-102-0x00007FF7DFED0000-0x00007FF7E02C2000-memory.dmp

Filesize
3.9MB

Download
memory/4132-64-0x00007FF799610000-0x00007FF799A02000-memory.dmp

Filesize
3.9MB

Download
memory/4880-4288-0x00007FF719E50000-0x00007FF71A242000-memory.dmp

Filesize
3.9MB

Download
memory/4880-63-0x00007FF719E50000-0x00007FF71A242000-memory.dmp

Filesize
3.9MB

Download
memory/4880-929-0x00007FF719E50000-0x00007FF71A242000-memory.dmp

Filesize
3.9MB

Download
memory/4920-182-0x00007FF6ABB80000-0x00007FF6ABF72000-memory.dmp

Filesize
3.9MB

Download
memory/4940-3029-0x00007FF7A28C0000-0x00007FF7A2CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4940-132-0x00007FF7A28C0000-0x00007FF7A2CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4940-4449-0x00007FF7A28C0000-0x00007FF7A2CB2000-memory.dmp

Filesize
3.9MB

Download
memory/5092-4278-0x00007FF64D840000-0x00007FF64DC32000-memory.dmp

Filesize
3.9MB

Download
memory/5092-65-0x00007FF64D840000-0x00007FF64DC32000-memory.dmp

Filesize
3.9MB

Download