xmrig | 11aec9575b828c4ddc8663c09303d4fb3e711c486a58c798203352aaaf3935a1

Analysis

max time kernel
120s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4bc2ff37dfcff1b4d1916609475d860N.exe
Size

1.9MB
MD5

c4bc2ff37dfcff1b4d1916609475d860
SHA1

3493b6c21a540bc5bb587ed0862c6ffb962c4fa4
SHA256

11aec9575b828c4ddc8663c09303d4fb3e711c486a58c798203352aaaf3935a1
SHA512

67d368683401607d9864c674e8fc0894b08e0fa76189ce9e5dc72cd65651119d471a8d1addf128b270e0208489b075a14fcce98a5ed1a8fabca1730e7942f22e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SIpj0f:NABm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/2196-39-0x00007FF675E10000-0x00007FF676202000-memory.dmp	xmrig
behavioral2/memory/3408-68-0x00007FF62A1B0000-0x00007FF62A5A2000-memory.dmp	xmrig
behavioral2/memory/4628-375-0x00007FF680C20000-0x00007FF681012000-memory.dmp	xmrig
behavioral2/memory/4612-377-0x00007FF789330000-0x00007FF789722000-memory.dmp	xmrig
behavioral2/memory/1932-378-0x00007FF784160000-0x00007FF784552000-memory.dmp	xmrig
behavioral2/memory/3580-379-0x00007FF66A160000-0x00007FF66A552000-memory.dmp	xmrig
behavioral2/memory/4016-376-0x00007FF6B1EA0000-0x00007FF6B2292000-memory.dmp	xmrig
behavioral2/memory/2584-380-0x00007FF686920000-0x00007FF686D12000-memory.dmp	xmrig
behavioral2/memory/1460-381-0x00007FF7612C0000-0x00007FF7616B2000-memory.dmp	xmrig
behavioral2/memory/1992-1040-0x00007FF76E990000-0x00007FF76ED82000-memory.dmp	xmrig
behavioral2/memory/4960-1037-0x00007FF78C2C0000-0x00007FF78C6B2000-memory.dmp	xmrig
behavioral2/memory/3004-91-0x00007FF7F64D0000-0x00007FF7F68C2000-memory.dmp	xmrig
behavioral2/memory/1184-84-0x00007FF774220000-0x00007FF774612000-memory.dmp	xmrig
behavioral2/memory/100-67-0x00007FF7F35D0000-0x00007FF7F39C2000-memory.dmp	xmrig
behavioral2/memory/4532-60-0x00007FF7F00B0000-0x00007FF7F04A2000-memory.dmp	xmrig
behavioral2/memory/3332-48-0x00007FF79C460000-0x00007FF79C852000-memory.dmp	xmrig
behavioral2/memory/4024-42-0x00007FF61BB40000-0x00007FF61BF32000-memory.dmp	xmrig
behavioral2/memory/1660-33-0x00007FF72DA00000-0x00007FF72DDF2000-memory.dmp	xmrig
behavioral2/memory/2092-2820-0x00007FF6A8090000-0x00007FF6A8482000-memory.dmp	xmrig
behavioral2/memory/2944-3194-0x00007FF6DFC40000-0x00007FF6E0032000-memory.dmp	xmrig
behavioral2/memory/776-3761-0x00007FF6C7E40000-0x00007FF6C8232000-memory.dmp	xmrig
behavioral2/memory/1992-4188-0x00007FF76E990000-0x00007FF76ED82000-memory.dmp	xmrig
behavioral2/memory/1660-4196-0x00007FF72DA00000-0x00007FF72DDF2000-memory.dmp	xmrig
behavioral2/memory/4024-4207-0x00007FF61BB40000-0x00007FF61BF32000-memory.dmp	xmrig
behavioral2/memory/3332-4212-0x00007FF79C460000-0x00007FF79C852000-memory.dmp	xmrig
behavioral2/memory/2196-4201-0x00007FF675E10000-0x00007FF676202000-memory.dmp	xmrig
behavioral2/memory/100-4218-0x00007FF7F35D0000-0x00007FF7F39C2000-memory.dmp	xmrig
behavioral2/memory/4532-4219-0x00007FF7F00B0000-0x00007FF7F04A2000-memory.dmp	xmrig
behavioral2/memory/3408-4225-0x00007FF62A1B0000-0x00007FF62A5A2000-memory.dmp	xmrig
behavioral2/memory/3468-4229-0x00007FF64ECF0000-0x00007FF64F0E2000-memory.dmp	xmrig
behavioral2/memory/3004-4233-0x00007FF7F64D0000-0x00007FF7F68C2000-memory.dmp	xmrig
behavioral2/memory/2092-4248-0x00007FF6A8090000-0x00007FF6A8482000-memory.dmp	xmrig
behavioral2/memory/548-4241-0x00007FF6A42D0000-0x00007FF6A46C2000-memory.dmp	xmrig
behavioral2/memory/1184-4235-0x00007FF774220000-0x00007FF774612000-memory.dmp	xmrig
behavioral2/memory/2944-4263-0x00007FF6DFC40000-0x00007FF6E0032000-memory.dmp	xmrig
behavioral2/memory/776-4259-0x00007FF6C7E40000-0x00007FF6C8232000-memory.dmp	xmrig
behavioral2/memory/1612-4258-0x00007FF7BD150000-0x00007FF7BD542000-memory.dmp	xmrig
behavioral2/memory/4016-4273-0x00007FF6B1EA0000-0x00007FF6B2292000-memory.dmp	xmrig
behavioral2/memory/4612-4277-0x00007FF789330000-0x00007FF789722000-memory.dmp	xmrig
behavioral2/memory/1932-4279-0x00007FF784160000-0x00007FF784552000-memory.dmp	xmrig
behavioral2/memory/4628-4267-0x00007FF680C20000-0x00007FF681012000-memory.dmp	xmrig
behavioral2/memory/3580-4321-0x00007FF66A160000-0x00007FF66A552000-memory.dmp	xmrig
behavioral2/memory/2584-4320-0x00007FF686920000-0x00007FF686D12000-memory.dmp	xmrig
behavioral2/memory/1460-4308-0x00007FF7612C0000-0x00007FF7616B2000-memory.dmp	xmrig
behavioral2/memory/2380-4510-0x00007FF7F1F70000-0x00007FF7F2362000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	2808	powershell.exe
11	2808	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2808	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1992	ybkBdtH.exe
1660	yyWoUCp.exe
2196	uIAOPrJ.exe
4024	ExbvbDx.exe
3332	wxbLdAP.exe
4532	qtBFjjF.exe
100	DgLynpS.exe
3408	QBtPWsA.exe
3468	eMiYHVe.exe
1184	QwmPlQN.exe
3004	pcdXHtq.exe
548	VvrvDOc.exe
2092	UdLSEmq.exe
2380	SGuaAMp.exe
2944	QjaTpnw.exe
1612	WJMEIgM.exe
776	MFqYFEM.exe
4628	ovowdNN.exe
4016	GRzVjap.exe
4612	GBPeMGM.exe
1932	GSZLaOW.exe
3580	EGFOhWn.exe
2584	rreJQEh.exe
1460	VAXnVGh.exe
4700	KQvsOaL.exe
1144	iZSphTh.exe
2864	wAbgOoF.exe
2324	nHMmRKc.exe
3940	MApWcvq.exe
456	WkXhKot.exe
3108	MzuETiP.exe
2500	KuEoQWg.exe
2984	VsxkUYP.exe
2676	VLVgqyH.exe
3712	orAfUUa.exe
4812	WQSUBSh.exe
1120	aLqNoWH.exe
4244	gutNqkG.exe
4160	HEuXtGa.exe
2384	gGkfKZY.exe
1720	cNAsAAT.exe
3392	BkMbSzm.exe
216	CczdnaH.exe
2592	PKejRWI.exe
4348	hUfsAtB.exe
2692	YwxriBT.exe
1936	MmzVXZP.exe
464	CKEbqlU.exe
5100	bWtoaNe.exe
4528	qlXDEiS.exe
1600	jdpJEgr.exe
5000	lphUWQA.exe
4520	vlhUjqL.exe
3216	SokqfFy.exe
4640	pIOXzLf.exe
3324	LkZfRWc.exe
2312	EYXMudz.exe
1384	Sxfwnrp.exe
4224	EMpBHCh.exe
208	Cwmtdvr.exe
5092	vkZQkOl.exe
2360	rHDERTN.exe
1864	oHaWDKd.exe
1820	SskPfxV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4960-0-0x00007FF78C2C0000-0x00007FF78C6B2000-memory.dmp	upx
behavioral2/files/0x00070000000234d0-8.dat	upx
behavioral2/files/0x00070000000234d1-22.dat	upx
behavioral2/memory/2196-39-0x00007FF675E10000-0x00007FF676202000-memory.dmp	upx
behavioral2/files/0x00070000000234d5-45.dat	upx
behavioral2/files/0x00070000000234d6-63.dat	upx
behavioral2/memory/3408-68-0x00007FF62A1B0000-0x00007FF62A5A2000-memory.dmp	upx
behavioral2/files/0x00070000000234dd-102.dat	upx
behavioral2/files/0x000a0000000234c9-108.dat	upx
behavioral2/files/0x00080000000234dc-114.dat	upx
behavioral2/files/0x00070000000234df-120.dat	upx
behavioral2/files/0x00070000000234e3-142.dat	upx
behavioral2/files/0x00070000000234e6-157.dat	upx
behavioral2/memory/4628-375-0x00007FF680C20000-0x00007FF681012000-memory.dmp	upx
behavioral2/memory/4612-377-0x00007FF789330000-0x00007FF789722000-memory.dmp	upx
behavioral2/memory/1932-378-0x00007FF784160000-0x00007FF784552000-memory.dmp	upx
behavioral2/memory/3580-379-0x00007FF66A160000-0x00007FF66A552000-memory.dmp	upx
behavioral2/memory/4016-376-0x00007FF6B1EA0000-0x00007FF6B2292000-memory.dmp	upx
behavioral2/memory/2584-380-0x00007FF686920000-0x00007FF686D12000-memory.dmp	upx
behavioral2/memory/1460-381-0x00007FF7612C0000-0x00007FF7616B2000-memory.dmp	upx
behavioral2/memory/1992-1040-0x00007FF76E990000-0x00007FF76ED82000-memory.dmp	upx
behavioral2/memory/4960-1037-0x00007FF78C2C0000-0x00007FF78C6B2000-memory.dmp	upx
behavioral2/files/0x00070000000234ed-192.dat	upx
behavioral2/files/0x00070000000234eb-190.dat	upx
behavioral2/files/0x00070000000234ec-187.dat	upx
behavioral2/files/0x00070000000234ea-185.dat	upx
behavioral2/files/0x00070000000234e9-180.dat	upx
behavioral2/files/0x00070000000234e8-175.dat	upx
behavioral2/files/0x00070000000234e7-170.dat	upx
behavioral2/files/0x00070000000234e5-160.dat	upx
behavioral2/files/0x00070000000234e4-155.dat	upx
behavioral2/files/0x00070000000234e2-145.dat	upx
behavioral2/files/0x00070000000234e1-138.dat	upx
behavioral2/files/0x00070000000234e0-132.dat	upx
behavioral2/files/0x00080000000234db-128.dat	upx
behavioral2/memory/776-116-0x00007FF6C7E40000-0x00007FF6C8232000-memory.dmp	upx
behavioral2/files/0x00070000000234de-112.dat	upx
behavioral2/memory/1612-111-0x00007FF7BD150000-0x00007FF7BD542000-memory.dmp	upx
behavioral2/memory/2944-110-0x00007FF6DFC40000-0x00007FF6E0032000-memory.dmp	upx
behavioral2/memory/2380-106-0x00007FF7F1F70000-0x00007FF7F2362000-memory.dmp	upx
behavioral2/files/0x00070000000234da-98.dat	upx
behavioral2/memory/2092-96-0x00007FF6A8090000-0x00007FF6A8482000-memory.dmp	upx
behavioral2/memory/3004-91-0x00007FF7F64D0000-0x00007FF7F68C2000-memory.dmp	upx
behavioral2/files/0x00070000000234d9-88.dat	upx
behavioral2/files/0x00070000000234d8-85.dat	upx
behavioral2/memory/1184-84-0x00007FF774220000-0x00007FF774612000-memory.dmp	upx
behavioral2/memory/548-83-0x00007FF6A42D0000-0x00007FF6A46C2000-memory.dmp	upx
behavioral2/files/0x00070000000234d7-69.dat	upx
behavioral2/memory/100-67-0x00007FF7F35D0000-0x00007FF7F39C2000-memory.dmp	upx
behavioral2/memory/4532-60-0x00007FF7F00B0000-0x00007FF7F04A2000-memory.dmp	upx
behavioral2/memory/3468-53-0x00007FF64ECF0000-0x00007FF64F0E2000-memory.dmp	upx
behavioral2/files/0x00070000000234d4-49.dat	upx
behavioral2/memory/3332-48-0x00007FF79C460000-0x00007FF79C852000-memory.dmp	upx
behavioral2/files/0x00070000000234d3-47.dat	upx
behavioral2/memory/4024-42-0x00007FF61BB40000-0x00007FF61BF32000-memory.dmp	upx
behavioral2/files/0x00070000000234d2-36.dat	upx
behavioral2/memory/1660-33-0x00007FF72DA00000-0x00007FF72DDF2000-memory.dmp	upx
behavioral2/files/0x00090000000234c7-27.dat	upx
behavioral2/memory/1992-14-0x00007FF76E990000-0x00007FF76ED82000-memory.dmp	upx
behavioral2/files/0x0009000000023474-6.dat	upx
behavioral2/memory/2092-2820-0x00007FF6A8090000-0x00007FF6A8482000-memory.dmp	upx
behavioral2/memory/2944-3194-0x00007FF6DFC40000-0x00007FF6E0032000-memory.dmp	upx
behavioral2/memory/776-3761-0x00007FF6C7E40000-0x00007FF6C8232000-memory.dmp	upx
behavioral2/memory/1992-4188-0x00007FF76E990000-0x00007FF76ED82000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oYTzQpb.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\EukGhje.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\JcAmuDm.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\ZrKSLgY.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\LYPuaAV.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\daTOimo.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\JqfpIFQ.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\hwcTdtI.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\bgzHaGl.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\zJRisOk.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\DNkobYM.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\KmnZsfj.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\qViGtnF.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\azmVrbV.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\cfgwaGv.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\DpjXhoc.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\JIYDCDH.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\uOAlhzi.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\TxVFaak.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\CEceDAk.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\ylVWiqp.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\XIaIYDV.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\BzwOIHk.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\ONELaRU.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\xDLYWza.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\WYpnUzX.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\FzgrZVj.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\XicKarV.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\eSIlqFt.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\txBvczS.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\svSzWCg.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\KMjomMX.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\KUBwucl.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\CuFHTuA.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\ukjCYAz.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\xAIDgJm.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\RlZIcwM.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\wqsmmHR.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\jIKzMiP.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\aXCXDvd.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\qTSLrjJ.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\YaYzsrx.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\jCpYSWQ.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\OTYFUcG.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\sgJZAYV.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\oDqnkeG.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\bxuGQqN.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\oeoldqw.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\MNiIwHq.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\BsiYyPV.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\fWZIzhb.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\pYmobpA.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\DJQIfnY.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\MzuETiP.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\KscJhON.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\pgaAVnN.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\BluFJWE.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\QMFgaaF.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\UTQbUMe.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\lLuHChK.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\FHRwvQd.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\wkFNiQd.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\nUQrywn.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe
File created	C:\Windows\System\EOtgVgO.exe	c4bc2ff37dfcff1b4d1916609475d860N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2808	powershell.exe
2808	powershell.exe
2808	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeLockMemoryPrivilege	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe
Token: SeLockMemoryPrivilege	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 2808	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	85
PID 4960 wrote to memory of 2808	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	85
PID 4960 wrote to memory of 1992	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	86
PID 4960 wrote to memory of 1992	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	86
PID 4960 wrote to memory of 2196	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	87
PID 4960 wrote to memory of 2196	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	87
PID 4960 wrote to memory of 1660	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	88
PID 4960 wrote to memory of 1660	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	88
PID 4960 wrote to memory of 4024	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	89
PID 4960 wrote to memory of 4024	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	89
PID 4960 wrote to memory of 3332	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	90
PID 4960 wrote to memory of 3332	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	90
PID 4960 wrote to memory of 4532	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	91
PID 4960 wrote to memory of 4532	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	91
PID 4960 wrote to memory of 100	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	92
PID 4960 wrote to memory of 100	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	92
PID 4960 wrote to memory of 3408	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	93
PID 4960 wrote to memory of 3408	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	93
PID 4960 wrote to memory of 3468	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	94
PID 4960 wrote to memory of 3468	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	94
PID 4960 wrote to memory of 1184	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	95
PID 4960 wrote to memory of 1184	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	95
PID 4960 wrote to memory of 3004	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	96
PID 4960 wrote to memory of 3004	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	96
PID 4960 wrote to memory of 548	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	97
PID 4960 wrote to memory of 548	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	97
PID 4960 wrote to memory of 2092	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	98
PID 4960 wrote to memory of 2092	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	98
PID 4960 wrote to memory of 2380	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	99
PID 4960 wrote to memory of 2380	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	99
PID 4960 wrote to memory of 2944	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	100
PID 4960 wrote to memory of 2944	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	100
PID 4960 wrote to memory of 1612	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	101
PID 4960 wrote to memory of 1612	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	101
PID 4960 wrote to memory of 776	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	102
PID 4960 wrote to memory of 776	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	102
PID 4960 wrote to memory of 4628	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	103
PID 4960 wrote to memory of 4628	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	103
PID 4960 wrote to memory of 4016	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	104
PID 4960 wrote to memory of 4016	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	104
PID 4960 wrote to memory of 4612	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	105
PID 4960 wrote to memory of 4612	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	105
PID 4960 wrote to memory of 1932	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	106
PID 4960 wrote to memory of 1932	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	106
PID 4960 wrote to memory of 3580	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	107
PID 4960 wrote to memory of 3580	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	107
PID 4960 wrote to memory of 2584	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	108
PID 4960 wrote to memory of 2584	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	108
PID 4960 wrote to memory of 1460	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	109
PID 4960 wrote to memory of 1460	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	109
PID 4960 wrote to memory of 4700	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	110
PID 4960 wrote to memory of 4700	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	110
PID 4960 wrote to memory of 1144	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	111
PID 4960 wrote to memory of 1144	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	111
PID 4960 wrote to memory of 2864	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	112
PID 4960 wrote to memory of 2864	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	112
PID 4960 wrote to memory of 2324	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	113
PID 4960 wrote to memory of 2324	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	113
PID 4960 wrote to memory of 3940	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	114
PID 4960 wrote to memory of 3940	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	114
PID 4960 wrote to memory of 456	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	115
PID 4960 wrote to memory of 456	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	115
PID 4960 wrote to memory of 3108	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	116
PID 4960 wrote to memory of 3108	4960	c4bc2ff37dfcff1b4d1916609475d860N.exe	116

C:\Users\Admin\AppData\Local\Temp\c4bc2ff37dfcff1b4d1916609475d860N.exe
"C:\Users\Admin\AppData\Local\Temp\c4bc2ff37dfcff1b4d1916609475d860N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2808" "2960" "2892" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12620
- C:\Windows\System\ybkBdtH.exe
  C:\Windows\System\ybkBdtH.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\uIAOPrJ.exe
  C:\Windows\System\uIAOPrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\yyWoUCp.exe
  C:\Windows\System\yyWoUCp.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ExbvbDx.exe
  C:\Windows\System\ExbvbDx.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\wxbLdAP.exe
  C:\Windows\System\wxbLdAP.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\qtBFjjF.exe
  C:\Windows\System\qtBFjjF.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\DgLynpS.exe
  C:\Windows\System\DgLynpS.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\QBtPWsA.exe
  C:\Windows\System\QBtPWsA.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\eMiYHVe.exe
  C:\Windows\System\eMiYHVe.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\QwmPlQN.exe
  C:\Windows\System\QwmPlQN.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\pcdXHtq.exe
  C:\Windows\System\pcdXHtq.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\VvrvDOc.exe
  C:\Windows\System\VvrvDOc.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\UdLSEmq.exe
  C:\Windows\System\UdLSEmq.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\SGuaAMp.exe
  C:\Windows\System\SGuaAMp.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\QjaTpnw.exe
  C:\Windows\System\QjaTpnw.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\WJMEIgM.exe
  C:\Windows\System\WJMEIgM.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\MFqYFEM.exe
  C:\Windows\System\MFqYFEM.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\ovowdNN.exe
  C:\Windows\System\ovowdNN.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\GRzVjap.exe
  C:\Windows\System\GRzVjap.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\GBPeMGM.exe
  C:\Windows\System\GBPeMGM.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\GSZLaOW.exe
  C:\Windows\System\GSZLaOW.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\EGFOhWn.exe
  C:\Windows\System\EGFOhWn.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\rreJQEh.exe
  C:\Windows\System\rreJQEh.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\VAXnVGh.exe
  C:\Windows\System\VAXnVGh.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\KQvsOaL.exe
  C:\Windows\System\KQvsOaL.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\iZSphTh.exe
  C:\Windows\System\iZSphTh.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\wAbgOoF.exe
  C:\Windows\System\wAbgOoF.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\nHMmRKc.exe
  C:\Windows\System\nHMmRKc.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\MApWcvq.exe
  C:\Windows\System\MApWcvq.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\WkXhKot.exe
  C:\Windows\System\WkXhKot.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\MzuETiP.exe
  C:\Windows\System\MzuETiP.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\KuEoQWg.exe
  C:\Windows\System\KuEoQWg.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\VsxkUYP.exe
  C:\Windows\System\VsxkUYP.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\VLVgqyH.exe
  C:\Windows\System\VLVgqyH.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\orAfUUa.exe
  C:\Windows\System\orAfUUa.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\WQSUBSh.exe
  C:\Windows\System\WQSUBSh.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\aLqNoWH.exe
  C:\Windows\System\aLqNoWH.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\gutNqkG.exe
  C:\Windows\System\gutNqkG.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\HEuXtGa.exe
  C:\Windows\System\HEuXtGa.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\gGkfKZY.exe
  C:\Windows\System\gGkfKZY.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\cNAsAAT.exe
  C:\Windows\System\cNAsAAT.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\BkMbSzm.exe
  C:\Windows\System\BkMbSzm.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\CczdnaH.exe
  C:\Windows\System\CczdnaH.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\PKejRWI.exe
  C:\Windows\System\PKejRWI.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\hUfsAtB.exe
  C:\Windows\System\hUfsAtB.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\YwxriBT.exe
  C:\Windows\System\YwxriBT.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\MmzVXZP.exe
  C:\Windows\System\MmzVXZP.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\CKEbqlU.exe
  C:\Windows\System\CKEbqlU.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\bWtoaNe.exe
  C:\Windows\System\bWtoaNe.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\qlXDEiS.exe
  C:\Windows\System\qlXDEiS.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\jdpJEgr.exe
  C:\Windows\System\jdpJEgr.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\lphUWQA.exe
  C:\Windows\System\lphUWQA.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\vlhUjqL.exe
  C:\Windows\System\vlhUjqL.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\SokqfFy.exe
  C:\Windows\System\SokqfFy.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\pIOXzLf.exe
  C:\Windows\System\pIOXzLf.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\LkZfRWc.exe
  C:\Windows\System\LkZfRWc.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\EYXMudz.exe
  C:\Windows\System\EYXMudz.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\Sxfwnrp.exe
  C:\Windows\System\Sxfwnrp.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\EMpBHCh.exe
  C:\Windows\System\EMpBHCh.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\Cwmtdvr.exe
  C:\Windows\System\Cwmtdvr.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\vkZQkOl.exe
  C:\Windows\System\vkZQkOl.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\rHDERTN.exe
  C:\Windows\System\rHDERTN.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\oHaWDKd.exe
  C:\Windows\System\oHaWDKd.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\SskPfxV.exe
  C:\Windows\System\SskPfxV.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\lOLYhgN.exe
  C:\Windows\System\lOLYhgN.exe
  2⤵
  PID:4652
- C:\Windows\System\LghIXXc.exe
  C:\Windows\System\LghIXXc.exe
  2⤵
  PID:2180
- C:\Windows\System\YlVfJpv.exe
  C:\Windows\System\YlVfJpv.exe
  2⤵
  PID:4596
- C:\Windows\System\ptmnNkH.exe
  C:\Windows\System\ptmnNkH.exe
  2⤵
  PID:3128
- C:\Windows\System\fMLWnpV.exe
  C:\Windows\System\fMLWnpV.exe
  2⤵
  PID:4128
- C:\Windows\System\PuAHXOM.exe
  C:\Windows\System\PuAHXOM.exe
  2⤵
  PID:3276
- C:\Windows\System\mhWycGj.exe
  C:\Windows\System\mhWycGj.exe
  2⤵
  PID:4784
- C:\Windows\System\EeLmKiJ.exe
  C:\Windows\System\EeLmKiJ.exe
  2⤵
  PID:1372
- C:\Windows\System\PVkETxv.exe
  C:\Windows\System\PVkETxv.exe
  2⤵
  PID:2936
- C:\Windows\System\BlFSzNv.exe
  C:\Windows\System\BlFSzNv.exe
  2⤵
  PID:3316
- C:\Windows\System\EYkHPVV.exe
  C:\Windows\System\EYkHPVV.exe
  2⤵
  PID:1572
- C:\Windows\System\JCigSrx.exe
  C:\Windows\System\JCigSrx.exe
  2⤵
  PID:452
- C:\Windows\System\XPeopXo.exe
  C:\Windows\System\XPeopXo.exe
  2⤵
  PID:3052
- C:\Windows\System\fJeMCXF.exe
  C:\Windows\System\fJeMCXF.exe
  2⤵
  PID:968
- C:\Windows\System\LhtWYjS.exe
  C:\Windows\System\LhtWYjS.exe
  2⤵
  PID:5148
- C:\Windows\System\BkHRueA.exe
  C:\Windows\System\BkHRueA.exe
  2⤵
  PID:5180
- C:\Windows\System\VvQjjRV.exe
  C:\Windows\System\VvQjjRV.exe
  2⤵
  PID:5208
- C:\Windows\System\DNkobYM.exe
  C:\Windows\System\DNkobYM.exe
  2⤵
  PID:5240
- C:\Windows\System\MIDUACl.exe
  C:\Windows\System\MIDUACl.exe
  2⤵
  PID:5264
- C:\Windows\System\vyazrnj.exe
  C:\Windows\System\vyazrnj.exe
  2⤵
  PID:5296
- C:\Windows\System\qScKSyf.exe
  C:\Windows\System\qScKSyf.exe
  2⤵
  PID:5324
- C:\Windows\System\HyzjDnl.exe
  C:\Windows\System\HyzjDnl.exe
  2⤵
  PID:5352
- C:\Windows\System\xEJowcP.exe
  C:\Windows\System\xEJowcP.exe
  2⤵
  PID:5380
- C:\Windows\System\GrUAQkz.exe
  C:\Windows\System\GrUAQkz.exe
  2⤵
  PID:5404
- C:\Windows\System\etAZSAo.exe
  C:\Windows\System\etAZSAo.exe
  2⤵
  PID:5432
- C:\Windows\System\yxVSblv.exe
  C:\Windows\System\yxVSblv.exe
  2⤵
  PID:5464
- C:\Windows\System\iOGPStl.exe
  C:\Windows\System\iOGPStl.exe
  2⤵
  PID:5492
- C:\Windows\System\SFWjnKK.exe
  C:\Windows\System\SFWjnKK.exe
  2⤵
  PID:5520
- C:\Windows\System\qcEZAtQ.exe
  C:\Windows\System\qcEZAtQ.exe
  2⤵
  PID:5548
- C:\Windows\System\nXjkwtO.exe
  C:\Windows\System\nXjkwtO.exe
  2⤵
  PID:5576
- C:\Windows\System\dgcuIwt.exe
  C:\Windows\System\dgcuIwt.exe
  2⤵
  PID:5672
- C:\Windows\System\mBhSXjT.exe
  C:\Windows\System\mBhSXjT.exe
  2⤵
  PID:5696
- C:\Windows\System\eePszwK.exe
  C:\Windows\System\eePszwK.exe
  2⤵
  PID:5716
- C:\Windows\System\JRTgpTo.exe
  C:\Windows\System\JRTgpTo.exe
  2⤵
  PID:5736
- C:\Windows\System\EwwEolj.exe
  C:\Windows\System\EwwEolj.exe
  2⤵
  PID:5760
- C:\Windows\System\RbAodsP.exe
  C:\Windows\System\RbAodsP.exe
  2⤵
  PID:5784
- C:\Windows\System\BVyjQnG.exe
  C:\Windows\System\BVyjQnG.exe
  2⤵
  PID:5804
- C:\Windows\System\KrovFZt.exe
  C:\Windows\System\KrovFZt.exe
  2⤵
  PID:5824
- C:\Windows\System\uvztryy.exe
  C:\Windows\System\uvztryy.exe
  2⤵
  PID:5852
- C:\Windows\System\yJubmRY.exe
  C:\Windows\System\yJubmRY.exe
  2⤵
  PID:5876
- C:\Windows\System\IZTENvm.exe
  C:\Windows\System\IZTENvm.exe
  2⤵
  PID:5896
- C:\Windows\System\WYaluoI.exe
  C:\Windows\System\WYaluoI.exe
  2⤵
  PID:5956
- C:\Windows\System\FLRoEGV.exe
  C:\Windows\System\FLRoEGV.exe
  2⤵
  PID:5980
- C:\Windows\System\zSKOMrA.exe
  C:\Windows\System\zSKOMrA.exe
  2⤵
  PID:6004
- C:\Windows\System\vzIMstx.exe
  C:\Windows\System\vzIMstx.exe
  2⤵
  PID:6056
- C:\Windows\System\JdLQdnz.exe
  C:\Windows\System\JdLQdnz.exe
  2⤵
  PID:6076
- C:\Windows\System\JJiAULu.exe
  C:\Windows\System\JJiAULu.exe
  2⤵
  PID:6092
- C:\Windows\System\ZoacFHM.exe
  C:\Windows\System\ZoacFHM.exe
  2⤵
  PID:6116
- C:\Windows\System\pMbPPjd.exe
  C:\Windows\System\pMbPPjd.exe
  2⤵
  PID:2728
- C:\Windows\System\XoosGcL.exe
  C:\Windows\System\XoosGcL.exe
  2⤵
  PID:772
- C:\Windows\System\bxuGQqN.exe
  C:\Windows\System\bxuGQqN.exe
  2⤵
  PID:2436
- C:\Windows\System\YqMOzaf.exe
  C:\Windows\System\YqMOzaf.exe
  2⤵
  PID:404
- C:\Windows\System\woPDYyY.exe
  C:\Windows\System\woPDYyY.exe
  2⤵
  PID:5172
- C:\Windows\System\SoyMTzR.exe
  C:\Windows\System\SoyMTzR.exe
  2⤵
  PID:5288
- C:\Windows\System\fwyJHXr.exe
  C:\Windows\System\fwyJHXr.exe
  2⤵
  PID:3568
- C:\Windows\System\njamYKc.exe
  C:\Windows\System\njamYKc.exe
  2⤵
  PID:5480
- C:\Windows\System\LkyQuSP.exe
  C:\Windows\System\LkyQuSP.exe
  2⤵
  PID:5516
- C:\Windows\System\CgxQWOw.exe
  C:\Windows\System\CgxQWOw.exe
  2⤵
  PID:5544
- C:\Windows\System\mGfCwPM.exe
  C:\Windows\System\mGfCwPM.exe
  2⤵
  PID:5064
- C:\Windows\System\MZaUYCE.exe
  C:\Windows\System\MZaUYCE.exe
  2⤵
  PID:4088
- C:\Windows\System\bJUNXhc.exe
  C:\Windows\System\bJUNXhc.exe
  2⤵
  PID:2192
- C:\Windows\System\GxZFvXc.exe
  C:\Windows\System\GxZFvXc.exe
  2⤵
  PID:4656
- C:\Windows\System\zsEAKhH.exe
  C:\Windows\System\zsEAKhH.exe
  2⤵
  PID:2364
- C:\Windows\System\OfoFoSz.exe
  C:\Windows\System\OfoFoSz.exe
  2⤵
  PID:224
- C:\Windows\System\XoSxeRB.exe
  C:\Windows\System\XoSxeRB.exe
  2⤵
  PID:4040
- C:\Windows\System\cevptaH.exe
  C:\Windows\System\cevptaH.exe
  2⤵
  PID:1240
- C:\Windows\System\qXKOIfV.exe
  C:\Windows\System\qXKOIfV.exe
  2⤵
  PID:2712
- C:\Windows\System\hQogPQe.exe
  C:\Windows\System\hQogPQe.exe
  2⤵
  PID:5792
- C:\Windows\System\DyhYkzQ.exe
  C:\Windows\System\DyhYkzQ.exe
  2⤵
  PID:5712
- C:\Windows\System\OCnibkJ.exe
  C:\Windows\System\OCnibkJ.exe
  2⤵
  PID:5872
- C:\Windows\System\RuJOJiP.exe
  C:\Windows\System\RuJOJiP.exe
  2⤵
  PID:5936
- C:\Windows\System\QamEtZr.exe
  C:\Windows\System\QamEtZr.exe
  2⤵
  PID:5976
- C:\Windows\System\PHtCIqt.exe
  C:\Windows\System\PHtCIqt.exe
  2⤵
  PID:6052
- C:\Windows\System\uYyXrDJ.exe
  C:\Windows\System\uYyXrDJ.exe
  2⤵
  PID:6084
- C:\Windows\System\jaIFGJf.exe
  C:\Windows\System\jaIFGJf.exe
  2⤵
  PID:3240
- C:\Windows\System\wUjOeqo.exe
  C:\Windows\System\wUjOeqo.exe
  2⤵
  PID:2632
- C:\Windows\System\XMzFdFt.exe
  C:\Windows\System\XMzFdFt.exe
  2⤵
  PID:5168
- C:\Windows\System\YQyUypP.exe
  C:\Windows\System\YQyUypP.exe
  2⤵
  PID:5228
- C:\Windows\System\FIoartC.exe
  C:\Windows\System\FIoartC.exe
  2⤵
  PID:5368
- C:\Windows\System\keYlzII.exe
  C:\Windows\System\keYlzII.exe
  2⤵
  PID:5448
- C:\Windows\System\xVKzTTs.exe
  C:\Windows\System\xVKzTTs.exe
  2⤵
  PID:1044
- C:\Windows\System\zpNrNUi.exe
  C:\Windows\System\zpNrNUi.exe
  2⤵
  PID:4180
- C:\Windows\System\ilxDQbx.exe
  C:\Windows\System\ilxDQbx.exe
  2⤵
  PID:856
- C:\Windows\System\DympKKs.exe
  C:\Windows\System\DympKKs.exe
  2⤵
  PID:4876
- C:\Windows\System\fcBhpCV.exe
  C:\Windows\System\fcBhpCV.exe
  2⤵
  PID:5820
- C:\Windows\System\wGRdCWR.exe
  C:\Windows\System\wGRdCWR.exe
  2⤵
  PID:5816
- C:\Windows\System\ymHhdSL.exe
  C:\Windows\System\ymHhdSL.exe
  2⤵
  PID:5908
- C:\Windows\System\sArklfQ.exe
  C:\Windows\System\sArklfQ.exe
  2⤵
  PID:6112
- C:\Windows\System\cvVgWQj.exe
  C:\Windows\System\cvVgWQj.exe
  2⤵
  PID:5280
- C:\Windows\System\emamTYC.exe
  C:\Windows\System\emamTYC.exe
  2⤵
  PID:5392
- C:\Windows\System\RjjkQiI.exe
  C:\Windows\System\RjjkQiI.exe
  2⤵
  PID:2248
- C:\Windows\System\MkstuQy.exe
  C:\Windows\System\MkstuQy.exe
  2⤵
  PID:3492
- C:\Windows\System\oldwKnp.exe
  C:\Windows\System\oldwKnp.exe
  2⤵
  PID:5996
- C:\Windows\System\FPbniJQ.exe
  C:\Windows\System\FPbniJQ.exe
  2⤵
  PID:4032
- C:\Windows\System\JGmpSbw.exe
  C:\Windows\System\JGmpSbw.exe
  2⤵
  PID:3684
- C:\Windows\System\WjpPpAl.exe
  C:\Windows\System\WjpPpAl.exe
  2⤵
  PID:4768
- C:\Windows\System\NxiRTSO.exe
  C:\Windows\System\NxiRTSO.exe
  2⤵
  PID:6148
- C:\Windows\System\FMaCfpY.exe
  C:\Windows\System\FMaCfpY.exe
  2⤵
  PID:6168
- C:\Windows\System\xzWkCVj.exe
  C:\Windows\System\xzWkCVj.exe
  2⤵
  PID:6204
- C:\Windows\System\mbWCGor.exe
  C:\Windows\System\mbWCGor.exe
  2⤵
  PID:6220
- C:\Windows\System\dePQqAY.exe
  C:\Windows\System\dePQqAY.exe
  2⤵
  PID:6240
- C:\Windows\System\PQzTHgH.exe
  C:\Windows\System\PQzTHgH.exe
  2⤵
  PID:6264
- C:\Windows\System\XboMAZM.exe
  C:\Windows\System\XboMAZM.exe
  2⤵
  PID:6292
- C:\Windows\System\AxCHoWH.exe
  C:\Windows\System\AxCHoWH.exe
  2⤵
  PID:6356
- C:\Windows\System\DpBQCLn.exe
  C:\Windows\System\DpBQCLn.exe
  2⤵
  PID:6380
- C:\Windows\System\MWZTMpx.exe
  C:\Windows\System\MWZTMpx.exe
  2⤵
  PID:6396
- C:\Windows\System\ZEhCMqH.exe
  C:\Windows\System\ZEhCMqH.exe
  2⤵
  PID:6440
- C:\Windows\System\dDaKpVe.exe
  C:\Windows\System\dDaKpVe.exe
  2⤵
  PID:6464
- C:\Windows\System\NFeunsh.exe
  C:\Windows\System\NFeunsh.exe
  2⤵
  PID:6492
- C:\Windows\System\EiVepPX.exe
  C:\Windows\System\EiVepPX.exe
  2⤵
  PID:6524
- C:\Windows\System\QXpEiqq.exe
  C:\Windows\System\QXpEiqq.exe
  2⤵
  PID:6548
- C:\Windows\System\NBqYDZf.exe
  C:\Windows\System\NBqYDZf.exe
  2⤵
  PID:6568
- C:\Windows\System\KZgXBGx.exe
  C:\Windows\System\KZgXBGx.exe
  2⤵
  PID:6588
- C:\Windows\System\JtvEbJz.exe
  C:\Windows\System\JtvEbJz.exe
  2⤵
  PID:6616
- C:\Windows\System\IwZKwhj.exe
  C:\Windows\System\IwZKwhj.exe
  2⤵
  PID:6664
- C:\Windows\System\EfrpISZ.exe
  C:\Windows\System\EfrpISZ.exe
  2⤵
  PID:6688
- C:\Windows\System\BRyZsvp.exe
  C:\Windows\System\BRyZsvp.exe
  2⤵
  PID:6716
- C:\Windows\System\RIcjAnW.exe
  C:\Windows\System\RIcjAnW.exe
  2⤵
  PID:6744
- C:\Windows\System\vrrEAcG.exe
  C:\Windows\System\vrrEAcG.exe
  2⤵
  PID:6760
- C:\Windows\System\HWynBHn.exe
  C:\Windows\System\HWynBHn.exe
  2⤵
  PID:6784
- C:\Windows\System\lYZRSZU.exe
  C:\Windows\System\lYZRSZU.exe
  2⤵
  PID:6824
- C:\Windows\System\fQtAUwW.exe
  C:\Windows\System\fQtAUwW.exe
  2⤵
  PID:6844
- C:\Windows\System\FRXjQVP.exe
  C:\Windows\System\FRXjQVP.exe
  2⤵
  PID:6888
- C:\Windows\System\VZRRbba.exe
  C:\Windows\System\VZRRbba.exe
  2⤵
  PID:6912
- C:\Windows\System\YgSGVhk.exe
  C:\Windows\System\YgSGVhk.exe
  2⤵
  PID:6940
- C:\Windows\System\gODzeKm.exe
  C:\Windows\System\gODzeKm.exe
  2⤵
  PID:6960
- C:\Windows\System\gOVEiuD.exe
  C:\Windows\System\gOVEiuD.exe
  2⤵
  PID:6980
- C:\Windows\System\LwbVTPJ.exe
  C:\Windows\System\LwbVTPJ.exe
  2⤵
  PID:7016
- C:\Windows\System\wzYqYYK.exe
  C:\Windows\System\wzYqYYK.exe
  2⤵
  PID:7056
- C:\Windows\System\HvbdGCZ.exe
  C:\Windows\System\HvbdGCZ.exe
  2⤵
  PID:7076
- C:\Windows\System\RbETCWb.exe
  C:\Windows\System\RbETCWb.exe
  2⤵
  PID:7108
- C:\Windows\System\oYGOzta.exe
  C:\Windows\System\oYGOzta.exe
  2⤵
  PID:7128
- C:\Windows\System\rBBpwsm.exe
  C:\Windows\System\rBBpwsm.exe
  2⤵
  PID:7144
- C:\Windows\System\BXNCZIv.exe
  C:\Windows\System\BXNCZIv.exe
  2⤵
  PID:7164
- C:\Windows\System\WYMXocL.exe
  C:\Windows\System\WYMXocL.exe
  2⤵
  PID:6216
- C:\Windows\System\QHWRngT.exe
  C:\Windows\System\QHWRngT.exe
  2⤵
  PID:6252
- C:\Windows\System\hFhtGSd.exe
  C:\Windows\System\hFhtGSd.exe
  2⤵
  PID:6344
- C:\Windows\System\gJssbsC.exe
  C:\Windows\System\gJssbsC.exe
  2⤵
  PID:6388
- C:\Windows\System\DybXLJh.exe
  C:\Windows\System\DybXLJh.exe
  2⤵
  PID:6436
- C:\Windows\System\izxJHYF.exe
  C:\Windows\System\izxJHYF.exe
  2⤵
  PID:6516
- C:\Windows\System\wiipjfP.exe
  C:\Windows\System\wiipjfP.exe
  2⤵
  PID:6560
- C:\Windows\System\qomcCwX.exe
  C:\Windows\System\qomcCwX.exe
  2⤵
  PID:6676
- C:\Windows\System\OfKLzhT.exe
  C:\Windows\System\OfKLzhT.exe
  2⤵
  PID:6724
- C:\Windows\System\EBTVeff.exe
  C:\Windows\System\EBTVeff.exe
  2⤵
  PID:6796
- C:\Windows\System\ryrgzsF.exe
  C:\Windows\System\ryrgzsF.exe
  2⤵
  PID:6836
- C:\Windows\System\XDIYhUt.exe
  C:\Windows\System\XDIYhUt.exe
  2⤵
  PID:6908
- C:\Windows\System\RtdUXAF.exe
  C:\Windows\System\RtdUXAF.exe
  2⤵
  PID:6972
- C:\Windows\System\VngRljm.exe
  C:\Windows\System\VngRljm.exe
  2⤵
  PID:7032
- C:\Windows\System\FEjDanS.exe
  C:\Windows\System\FEjDanS.exe
  2⤵
  PID:7052
- C:\Windows\System\MyrIRPP.exe
  C:\Windows\System\MyrIRPP.exe
  2⤵
  PID:5632
- C:\Windows\System\GLNHynA.exe
  C:\Windows\System\GLNHynA.exe
  2⤵
  PID:7156
- C:\Windows\System\LrzHyes.exe
  C:\Windows\System\LrzHyes.exe
  2⤵
  PID:6180
- C:\Windows\System\ZdNLzen.exe
  C:\Windows\System\ZdNLzen.exe
  2⤵
  PID:6124
- C:\Windows\System\EuByqGo.exe
  C:\Windows\System\EuByqGo.exe
  2⤵
  PID:6484
- C:\Windows\System\kZekRjf.exe
  C:\Windows\System\kZekRjf.exe
  2⤵
  PID:6612
- C:\Windows\System\IauEWQL.exe
  C:\Windows\System\IauEWQL.exe
  2⤵
  PID:6832
- C:\Windows\System\rqjyXoD.exe
  C:\Windows\System\rqjyXoD.exe
  2⤵
  PID:6868
- C:\Windows\System\nyrQeHQ.exe
  C:\Windows\System\nyrQeHQ.exe
  2⤵
  PID:7072
- C:\Windows\System\ffjhMNp.exe
  C:\Windows\System\ffjhMNp.exe
  2⤵
  PID:6504
- C:\Windows\System\MQaPOdL.exe
  C:\Windows\System\MQaPOdL.exe
  2⤵
  PID:6584
- C:\Windows\System\fAgnvWk.exe
  C:\Windows\System\fAgnvWk.exe
  2⤵
  PID:5628
- C:\Windows\System\VGSAQux.exe
  C:\Windows\System\VGSAQux.exe
  2⤵
  PID:7140
- C:\Windows\System\ScRvjaC.exe
  C:\Windows\System\ScRvjaC.exe
  2⤵
  PID:7176
- C:\Windows\System\mDsokzg.exe
  C:\Windows\System\mDsokzg.exe
  2⤵
  PID:7204
- C:\Windows\System\WYRlTeu.exe
  C:\Windows\System\WYRlTeu.exe
  2⤵
  PID:7244
- C:\Windows\System\XlhAnAO.exe
  C:\Windows\System\XlhAnAO.exe
  2⤵
  PID:7272
- C:\Windows\System\YqwAPec.exe
  C:\Windows\System\YqwAPec.exe
  2⤵
  PID:7292
- C:\Windows\System\fwLuVDF.exe
  C:\Windows\System\fwLuVDF.exe
  2⤵
  PID:7316
- C:\Windows\System\IVoCMWG.exe
  C:\Windows\System\IVoCMWG.exe
  2⤵
  PID:7336
- C:\Windows\System\TySHQbS.exe
  C:\Windows\System\TySHQbS.exe
  2⤵
  PID:7352
- C:\Windows\System\mDuTHeh.exe
  C:\Windows\System\mDuTHeh.exe
  2⤵
  PID:7376
- C:\Windows\System\KkJICKN.exe
  C:\Windows\System\KkJICKN.exe
  2⤵
  PID:7404
- C:\Windows\System\wEBEpIM.exe
  C:\Windows\System\wEBEpIM.exe
  2⤵
  PID:7436
- C:\Windows\System\aAyhFOe.exe
  C:\Windows\System\aAyhFOe.exe
  2⤵
  PID:7464
- C:\Windows\System\yGLhsPE.exe
  C:\Windows\System\yGLhsPE.exe
  2⤵
  PID:7484
- C:\Windows\System\NsnPboS.exe
  C:\Windows\System\NsnPboS.exe
  2⤵
  PID:7504
- C:\Windows\System\GvagjEm.exe
  C:\Windows\System\GvagjEm.exe
  2⤵
  PID:7528
- C:\Windows\System\gUXIWvf.exe
  C:\Windows\System\gUXIWvf.exe
  2⤵
  PID:7552
- C:\Windows\System\JZeVRUQ.exe
  C:\Windows\System\JZeVRUQ.exe
  2⤵
  PID:7608
- C:\Windows\System\AAlxRYg.exe
  C:\Windows\System\AAlxRYg.exe
  2⤵
  PID:7628
- C:\Windows\System\XAEmvDG.exe
  C:\Windows\System\XAEmvDG.exe
  2⤵
  PID:7656
- C:\Windows\System\qwFSGak.exe
  C:\Windows\System\qwFSGak.exe
  2⤵
  PID:7672
- C:\Windows\System\aCLxGDK.exe
  C:\Windows\System\aCLxGDK.exe
  2⤵
  PID:7716
- C:\Windows\System\kGzoEAV.exe
  C:\Windows\System\kGzoEAV.exe
  2⤵
  PID:7740
- C:\Windows\System\pYjmPOj.exe
  C:\Windows\System\pYjmPOj.exe
  2⤵
  PID:7760
- C:\Windows\System\wXTHMbo.exe
  C:\Windows\System\wXTHMbo.exe
  2⤵
  PID:7784
- C:\Windows\System\VXILWCi.exe
  C:\Windows\System\VXILWCi.exe
  2⤵
  PID:7816
- C:\Windows\System\RqtLjuG.exe
  C:\Windows\System\RqtLjuG.exe
  2⤵
  PID:7840
- C:\Windows\System\FRBdhRv.exe
  C:\Windows\System\FRBdhRv.exe
  2⤵
  PID:7884
- C:\Windows\System\xnkmZzw.exe
  C:\Windows\System\xnkmZzw.exe
  2⤵
  PID:7920
- C:\Windows\System\zPnZHFd.exe
  C:\Windows\System\zPnZHFd.exe
  2⤵
  PID:7944
- C:\Windows\System\snDRWcv.exe
  C:\Windows\System\snDRWcv.exe
  2⤵
  PID:7964
- C:\Windows\System\jOqdzdh.exe
  C:\Windows\System\jOqdzdh.exe
  2⤵
  PID:8000
- C:\Windows\System\SmAEaqL.exe
  C:\Windows\System\SmAEaqL.exe
  2⤵
  PID:8036
- C:\Windows\System\AKYEaZE.exe
  C:\Windows\System\AKYEaZE.exe
  2⤵
  PID:8056
- C:\Windows\System\RofBXZB.exe
  C:\Windows\System\RofBXZB.exe
  2⤵
  PID:8084
- C:\Windows\System\QLDReCX.exe
  C:\Windows\System\QLDReCX.exe
  2⤵
  PID:8108
- C:\Windows\System\ZhjHnyv.exe
  C:\Windows\System\ZhjHnyv.exe
  2⤵
  PID:8128
- C:\Windows\System\ChKaegC.exe
  C:\Windows\System\ChKaegC.exe
  2⤵
  PID:8180
- C:\Windows\System\qfpGrbw.exe
  C:\Windows\System\qfpGrbw.exe
  2⤵
  PID:6780
- C:\Windows\System\GvRVQXm.exe
  C:\Windows\System\GvRVQXm.exe
  2⤵
  PID:7196
- C:\Windows\System\TgkcNyz.exe
  C:\Windows\System\TgkcNyz.exe
  2⤵
  PID:7312
- C:\Windows\System\cQKoTGT.exe
  C:\Windows\System\cQKoTGT.exe
  2⤵
  PID:7328
- C:\Windows\System\iCSNAYn.exe
  C:\Windows\System\iCSNAYn.exe
  2⤵
  PID:7428
- C:\Windows\System\JnzEAVo.exe
  C:\Windows\System\JnzEAVo.exe
  2⤵
  PID:7496
- C:\Windows\System\UXdqLNA.exe
  C:\Windows\System\UXdqLNA.exe
  2⤵
  PID:7512
- C:\Windows\System\htAlEcW.exe
  C:\Windows\System\htAlEcW.exe
  2⤵
  PID:7588
- C:\Windows\System\dHvLUhF.exe
  C:\Windows\System\dHvLUhF.exe
  2⤵
  PID:7756
- C:\Windows\System\sMQyTPj.exe
  C:\Windows\System\sMQyTPj.exe
  2⤵
  PID:7808
- C:\Windows\System\wndxnHv.exe
  C:\Windows\System\wndxnHv.exe
  2⤵
  PID:7832
- C:\Windows\System\lnywoBA.exe
  C:\Windows\System\lnywoBA.exe
  2⤵
  PID:7960
- C:\Windows\System\eYbNVju.exe
  C:\Windows\System\eYbNVju.exe
  2⤵
  PID:7916
- C:\Windows\System\zOnnWYW.exe
  C:\Windows\System\zOnnWYW.exe
  2⤵
  PID:8092
- C:\Windows\System\uOAlhzi.exe
  C:\Windows\System\uOAlhzi.exe
  2⤵
  PID:8148
- C:\Windows\System\EVPWIBP.exe
  C:\Windows\System\EVPWIBP.exe
  2⤵
  PID:8172
- C:\Windows\System\LZVtsVR.exe
  C:\Windows\System\LZVtsVR.exe
  2⤵
  PID:7260
- C:\Windows\System\xoxrUet.exe
  C:\Windows\System\xoxrUet.exe
  2⤵
  PID:7368
- C:\Windows\System\eHVpgtW.exe
  C:\Windows\System\eHVpgtW.exe
  2⤵
  PID:7492
- C:\Windows\System\MKyklZF.exe
  C:\Windows\System\MKyklZF.exe
  2⤵
  PID:7568
- C:\Windows\System\vRrpaCt.exe
  C:\Windows\System\vRrpaCt.exe
  2⤵
  PID:7708
- C:\Windows\System\msvnWCH.exe
  C:\Windows\System\msvnWCH.exe
  2⤵
  PID:7804
- C:\Windows\System\TpGeFnW.exe
  C:\Windows\System\TpGeFnW.exe
  2⤵
  PID:7956
- C:\Windows\System\whomTpP.exe
  C:\Windows\System\whomTpP.exe
  2⤵
  PID:7240
- C:\Windows\System\liNXeCR.exe
  C:\Windows\System\liNXeCR.exe
  2⤵
  PID:7548
- C:\Windows\System\bvmKYNI.exe
  C:\Windows\System\bvmKYNI.exe
  2⤵
  PID:8204
- C:\Windows\System\becxTMV.exe
  C:\Windows\System\becxTMV.exe
  2⤵
  PID:8220
- C:\Windows\System\YPOlXYN.exe
  C:\Windows\System\YPOlXYN.exe
  2⤵
  PID:8236
- C:\Windows\System\AvtYuoQ.exe
  C:\Windows\System\AvtYuoQ.exe
  2⤵
  PID:8256
- C:\Windows\System\HtGgHbT.exe
  C:\Windows\System\HtGgHbT.exe
  2⤵
  PID:8364
- C:\Windows\System\FafxDHT.exe
  C:\Windows\System\FafxDHT.exe
  2⤵
  PID:8380
- C:\Windows\System\riIdOlF.exe
  C:\Windows\System\riIdOlF.exe
  2⤵
  PID:8396
- C:\Windows\System\HwyAEcf.exe
  C:\Windows\System\HwyAEcf.exe
  2⤵
  PID:8412
- C:\Windows\System\sJGIyLS.exe
  C:\Windows\System\sJGIyLS.exe
  2⤵
  PID:8428
- C:\Windows\System\OgBykcL.exe
  C:\Windows\System\OgBykcL.exe
  2⤵
  PID:8444
- C:\Windows\System\DBIsUfW.exe
  C:\Windows\System\DBIsUfW.exe
  2⤵
  PID:8460
- C:\Windows\System\hkkrvJq.exe
  C:\Windows\System\hkkrvJq.exe
  2⤵
  PID:8476
- C:\Windows\System\MCXZVcq.exe
  C:\Windows\System\MCXZVcq.exe
  2⤵
  PID:8492
- C:\Windows\System\jJjhmKq.exe
  C:\Windows\System\jJjhmKq.exe
  2⤵
  PID:8508
- C:\Windows\System\rBxojDs.exe
  C:\Windows\System\rBxojDs.exe
  2⤵
  PID:8532
- C:\Windows\System\iQWpvGw.exe
  C:\Windows\System\iQWpvGw.exe
  2⤵
  PID:8564
- C:\Windows\System\EVaLWQd.exe
  C:\Windows\System\EVaLWQd.exe
  2⤵
  PID:8636
- C:\Windows\System\bhMqUZX.exe
  C:\Windows\System\bhMqUZX.exe
  2⤵
  PID:8704
- C:\Windows\System\LDErurR.exe
  C:\Windows\System\LDErurR.exe
  2⤵
  PID:8724
- C:\Windows\System\uFAeAkg.exe
  C:\Windows\System\uFAeAkg.exe
  2⤵
  PID:8744
- C:\Windows\System\xGyacgK.exe
  C:\Windows\System\xGyacgK.exe
  2⤵
  PID:8900
- C:\Windows\System\hoCAYyJ.exe
  C:\Windows\System\hoCAYyJ.exe
  2⤵
  PID:8920
- C:\Windows\System\gGHGoVk.exe
  C:\Windows\System\gGHGoVk.exe
  2⤵
  PID:8944
- C:\Windows\System\GsRgOlT.exe
  C:\Windows\System\GsRgOlT.exe
  2⤵
  PID:8964
- C:\Windows\System\gsxJlFA.exe
  C:\Windows\System\gsxJlFA.exe
  2⤵
  PID:8992
- C:\Windows\System\jsKdvRZ.exe
  C:\Windows\System\jsKdvRZ.exe
  2⤵
  PID:9036
- C:\Windows\System\JPTGPno.exe
  C:\Windows\System\JPTGPno.exe
  2⤵
  PID:9084
- C:\Windows\System\TLMeQzo.exe
  C:\Windows\System\TLMeQzo.exe
  2⤵
  PID:9116
- C:\Windows\System\mRyMYZt.exe
  C:\Windows\System\mRyMYZt.exe
  2⤵
  PID:9140
- C:\Windows\System\QxljuWJ.exe
  C:\Windows\System\QxljuWJ.exe
  2⤵
  PID:9160
- C:\Windows\System\ZNIycGU.exe
  C:\Windows\System\ZNIycGU.exe
  2⤵
  PID:9208
- C:\Windows\System\WcIAeKs.exe
  C:\Windows\System\WcIAeKs.exe
  2⤵
  PID:7896
- C:\Windows\System\dVkxqgW.exe
  C:\Windows\System\dVkxqgW.exe
  2⤵
  PID:7256
- C:\Windows\System\NGDiVed.exe
  C:\Windows\System\NGDiVed.exe
  2⤵
  PID:8104
- C:\Windows\System\smSwqpt.exe
  C:\Windows\System\smSwqpt.exe
  2⤵
  PID:7624
- C:\Windows\System\UwQZXzV.exe
  C:\Windows\System\UwQZXzV.exe
  2⤵
  PID:8248
- C:\Windows\System\iHmUrbd.exe
  C:\Windows\System\iHmUrbd.exe
  2⤵
  PID:8292
- C:\Windows\System\ZOtOdOJ.exe
  C:\Windows\System\ZOtOdOJ.exe
  2⤵
  PID:8312
- C:\Windows\System\EXjueqa.exe
  C:\Windows\System\EXjueqa.exe
  2⤵
  PID:8456
- C:\Windows\System\TxVFaak.exe
  C:\Windows\System\TxVFaak.exe
  2⤵
  PID:8344
- C:\Windows\System\dORTzPd.exe
  C:\Windows\System\dORTzPd.exe
  2⤵
  PID:8520
- C:\Windows\System\jWeLNPr.exe
  C:\Windows\System\jWeLNPr.exe
  2⤵
  PID:8616
- C:\Windows\System\tQooCWc.exe
  C:\Windows\System\tQooCWc.exe
  2⤵
  PID:8592
- C:\Windows\System\tETGiBz.exe
  C:\Windows\System\tETGiBz.exe
  2⤵
  PID:8720
- C:\Windows\System\Tipefjw.exe
  C:\Windows\System\Tipefjw.exe
  2⤵
  PID:8772
- C:\Windows\System\oSAcIxX.exe
  C:\Windows\System\oSAcIxX.exe
  2⤵
  PID:8852
- C:\Windows\System\LkuUBhG.exe
  C:\Windows\System\LkuUBhG.exe
  2⤵
  PID:8952
- C:\Windows\System\KrJJgLc.exe
  C:\Windows\System\KrJJgLc.exe
  2⤵
  PID:8988
- C:\Windows\System\nGoNYHL.exe
  C:\Windows\System\nGoNYHL.exe
  2⤵
  PID:9044
- C:\Windows\System\CSkewjw.exe
  C:\Windows\System\CSkewjw.exe
  2⤵
  PID:9076
- C:\Windows\System\NrxgsPH.exe
  C:\Windows\System\NrxgsPH.exe
  2⤵
  PID:9152
- C:\Windows\System\RhdnmEn.exe
  C:\Windows\System\RhdnmEn.exe
  2⤵
  PID:9200
- C:\Windows\System\iPxHtcq.exe
  C:\Windows\System\iPxHtcq.exe
  2⤵
  PID:7524
- C:\Windows\System\baMCewb.exe
  C:\Windows\System\baMCewb.exe
  2⤵
  PID:8280
- C:\Windows\System\NKdGnCs.exe
  C:\Windows\System\NKdGnCs.exe
  2⤵
  PID:8316
- C:\Windows\System\vwwLasV.exe
  C:\Windows\System\vwwLasV.exe
  2⤵
  PID:8652
- C:\Windows\System\TuVBmsh.exe
  C:\Windows\System\TuVBmsh.exe
  2⤵
  PID:8800
- C:\Windows\System\gXnyUIP.exe
  C:\Windows\System\gXnyUIP.exe
  2⤵
  PID:8960
- C:\Windows\System\FtEXPur.exe
  C:\Windows\System\FtEXPur.exe
  2⤵
  PID:9068
- C:\Windows\System\kgTmXGO.exe
  C:\Windows\System\kgTmXGO.exe
  2⤵
  PID:8484
- C:\Windows\System\GwYLNIY.exe
  C:\Windows\System\GwYLNIY.exe
  2⤵
  PID:8268
- C:\Windows\System\tBxFqNh.exe
  C:\Windows\System\tBxFqNh.exe
  2⤵
  PID:8588
- C:\Windows\System\rHNVmsX.exe
  C:\Windows\System\rHNVmsX.exe
  2⤵
  PID:8916
- C:\Windows\System\oCxpUgi.exe
  C:\Windows\System\oCxpUgi.exe
  2⤵
  PID:9132
- C:\Windows\System\jmDGBJV.exe
  C:\Windows\System\jmDGBJV.exe
  2⤵
  PID:9240
- C:\Windows\System\RMYllyU.exe
  C:\Windows\System\RMYllyU.exe
  2⤵
  PID:9268
- C:\Windows\System\ONELaRU.exe
  C:\Windows\System\ONELaRU.exe
  2⤵
  PID:9296
- C:\Windows\System\VMKdhbl.exe
  C:\Windows\System\VMKdhbl.exe
  2⤵
  PID:9316
- C:\Windows\System\NUXfZVM.exe
  C:\Windows\System\NUXfZVM.exe
  2⤵
  PID:9344
- C:\Windows\System\ajtcsMh.exe
  C:\Windows\System\ajtcsMh.exe
  2⤵
  PID:9364
- C:\Windows\System\slrXKOA.exe
  C:\Windows\System\slrXKOA.exe
  2⤵
  PID:9384
- C:\Windows\System\THfJqBJ.exe
  C:\Windows\System\THfJqBJ.exe
  2⤵
  PID:9432
- C:\Windows\System\jRPsmtM.exe
  C:\Windows\System\jRPsmtM.exe
  2⤵
  PID:9456
- C:\Windows\System\CdZBGqf.exe
  C:\Windows\System\CdZBGqf.exe
  2⤵
  PID:9496
- C:\Windows\System\AERvQPr.exe
  C:\Windows\System\AERvQPr.exe
  2⤵
  PID:9520
- C:\Windows\System\cRbeNuN.exe
  C:\Windows\System\cRbeNuN.exe
  2⤵
  PID:9536
- C:\Windows\System\cCltYIJ.exe
  C:\Windows\System\cCltYIJ.exe
  2⤵
  PID:9568
- C:\Windows\System\WDsLIZo.exe
  C:\Windows\System\WDsLIZo.exe
  2⤵
  PID:9588
- C:\Windows\System\Kgbcetx.exe
  C:\Windows\System\Kgbcetx.exe
  2⤵
  PID:9608
- C:\Windows\System\YLDqwwy.exe
  C:\Windows\System\YLDqwwy.exe
  2⤵
  PID:9656
- C:\Windows\System\VbmzKym.exe
  C:\Windows\System\VbmzKym.exe
  2⤵
  PID:9676
- C:\Windows\System\UxwMEHH.exe
  C:\Windows\System\UxwMEHH.exe
  2⤵
  PID:9708
- C:\Windows\System\mIjwBni.exe
  C:\Windows\System\mIjwBni.exe
  2⤵
  PID:9744
- C:\Windows\System\veVkPby.exe
  C:\Windows\System\veVkPby.exe
  2⤵
  PID:9760
- C:\Windows\System\MRDeQtu.exe
  C:\Windows\System\MRDeQtu.exe
  2⤵
  PID:9788
- C:\Windows\System\EYeWTBy.exe
  C:\Windows\System\EYeWTBy.exe
  2⤵
  PID:9824
- C:\Windows\System\siiIDtL.exe
  C:\Windows\System\siiIDtL.exe
  2⤵
  PID:9852
- C:\Windows\System\IsNvPvh.exe
  C:\Windows\System\IsNvPvh.exe
  2⤵
  PID:9892
- C:\Windows\System\JlWFLzK.exe
  C:\Windows\System\JlWFLzK.exe
  2⤵
  PID:9912
- C:\Windows\System\eamjdAW.exe
  C:\Windows\System\eamjdAW.exe
  2⤵
  PID:9936
- C:\Windows\System\yBgRDlC.exe
  C:\Windows\System\yBgRDlC.exe
  2⤵
  PID:9964
- C:\Windows\System\ooyGFDD.exe
  C:\Windows\System\ooyGFDD.exe
  2⤵
  PID:10008
- C:\Windows\System\tWgJdtr.exe
  C:\Windows\System\tWgJdtr.exe
  2⤵
  PID:10032
- C:\Windows\System\KKuUWbP.exe
  C:\Windows\System\KKuUWbP.exe
  2⤵
  PID:10052
- C:\Windows\System\GrAtWBh.exe
  C:\Windows\System\GrAtWBh.exe
  2⤵
  PID:10092
- C:\Windows\System\dQfaOjd.exe
  C:\Windows\System\dQfaOjd.exe
  2⤵
  PID:10116
- C:\Windows\System\lgFeduY.exe
  C:\Windows\System\lgFeduY.exe
  2⤵
  PID:10136
- C:\Windows\System\xtYcaei.exe
  C:\Windows\System\xtYcaei.exe
  2⤵
  PID:10160
- C:\Windows\System\tQpzPQm.exe
  C:\Windows\System\tQpzPQm.exe
  2⤵
  PID:10180
- C:\Windows\System\vVtzwPb.exe
  C:\Windows\System\vVtzwPb.exe
  2⤵
  PID:10196
- C:\Windows\System\kVLeDhm.exe
  C:\Windows\System\kVLeDhm.exe
  2⤵
  PID:5744
- C:\Windows\System\jrqtUYs.exe
  C:\Windows\System\jrqtUYs.exe
  2⤵
  PID:9236
- C:\Windows\System\pxICmWs.exe
  C:\Windows\System\pxICmWs.exe
  2⤵
  PID:9312
- C:\Windows\System\qNioDNU.exe
  C:\Windows\System\qNioDNU.exe
  2⤵
  PID:9360
- C:\Windows\System\bYcpyZO.exe
  C:\Windows\System\bYcpyZO.exe
  2⤵
  PID:9420
- C:\Windows\System\DxFxJxn.exe
  C:\Windows\System\DxFxJxn.exe
  2⤵
  PID:9472
- C:\Windows\System\vLTjbDB.exe
  C:\Windows\System\vLTjbDB.exe
  2⤵
  PID:9508
- C:\Windows\System\CDHwtll.exe
  C:\Windows\System\CDHwtll.exe
  2⤵
  PID:9576
- C:\Windows\System\uDkEOlA.exe
  C:\Windows\System\uDkEOlA.exe
  2⤵
  PID:9600
- C:\Windows\System\aKXYqGM.exe
  C:\Windows\System\aKXYqGM.exe
  2⤵
  PID:9784
- C:\Windows\System\EDMYjLM.exe
  C:\Windows\System\EDMYjLM.exe
  2⤵
  PID:9816
- C:\Windows\System\Ytlinyd.exe
  C:\Windows\System\Ytlinyd.exe
  2⤵
  PID:9876
- C:\Windows\System\pwENmqV.exe
  C:\Windows\System\pwENmqV.exe
  2⤵
  PID:9924
- C:\Windows\System\UWkRoPu.exe
  C:\Windows\System\UWkRoPu.exe
  2⤵
  PID:9996
- C:\Windows\System\WBmXuEB.exe
  C:\Windows\System\WBmXuEB.exe
  2⤵
  PID:10044
- C:\Windows\System\LPOhHwa.exe
  C:\Windows\System\LPOhHwa.exe
  2⤵
  PID:10068
- C:\Windows\System\tFECKFO.exe
  C:\Windows\System\tFECKFO.exe
  2⤵
  PID:10132
- C:\Windows\System\bvoRTkG.exe
  C:\Windows\System\bvoRTkG.exe
  2⤵
  PID:10176
- C:\Windows\System\JUirWJy.exe
  C:\Windows\System\JUirWJy.exe
  2⤵
  PID:9328
- C:\Windows\System\LJlLSck.exe
  C:\Windows\System\LJlLSck.exe
  2⤵
  PID:9504
- C:\Windows\System\nsoHJJi.exe
  C:\Windows\System\nsoHJJi.exe
  2⤵
  PID:9544
- C:\Windows\System\nBDLPmU.exe
  C:\Windows\System\nBDLPmU.exe
  2⤵
  PID:9908
- C:\Windows\System\emwpEcd.exe
  C:\Windows\System\emwpEcd.exe
  2⤵
  PID:10004
- C:\Windows\System\dzoxJpw.exe
  C:\Windows\System\dzoxJpw.exe
  2⤵
  PID:10072
- C:\Windows\System\TrgKRvA.exe
  C:\Windows\System\TrgKRvA.exe
  2⤵
  PID:9396
- C:\Windows\System\HljdHdi.exe
  C:\Windows\System\HljdHdi.exe
  2⤵
  PID:9276
- C:\Windows\System\qdtkesE.exe
  C:\Windows\System\qdtkesE.exe
  2⤵
  PID:9700
- C:\Windows\System\fhjHQZH.exe
  C:\Windows\System\fhjHQZH.exe
  2⤵
  PID:9756
- C:\Windows\System\kJUALzx.exe
  C:\Windows\System\kJUALzx.exe
  2⤵
  PID:10232
- C:\Windows\System\ngOUhUb.exe
  C:\Windows\System\ngOUhUb.exe
  2⤵
  PID:9728
- C:\Windows\System\hIEzzSe.exe
  C:\Windows\System\hIEzzSe.exe
  2⤵
  PID:10272
- C:\Windows\System\NwKLJUT.exe
  C:\Windows\System\NwKLJUT.exe
  2⤵
  PID:10308
- C:\Windows\System\DRzxiHV.exe
  C:\Windows\System\DRzxiHV.exe
  2⤵
  PID:10336
- C:\Windows\System\FxOchkB.exe
  C:\Windows\System\FxOchkB.exe
  2⤵
  PID:10352
- C:\Windows\System\pxSbaaJ.exe
  C:\Windows\System\pxSbaaJ.exe
  2⤵
  PID:10376
- C:\Windows\System\IcOiHbr.exe
  C:\Windows\System\IcOiHbr.exe
  2⤵
  PID:10404
- C:\Windows\System\oeoldqw.exe
  C:\Windows\System\oeoldqw.exe
  2⤵
  PID:10456
- C:\Windows\System\qLbGacb.exe
  C:\Windows\System\qLbGacb.exe
  2⤵
  PID:10480
- C:\Windows\System\jlzeTog.exe
  C:\Windows\System\jlzeTog.exe
  2⤵
  PID:10500
- C:\Windows\System\MnBroZG.exe
  C:\Windows\System\MnBroZG.exe
  2⤵
  PID:10544
- C:\Windows\System\FkWwZIr.exe
  C:\Windows\System\FkWwZIr.exe
  2⤵
  PID:10564
- C:\Windows\System\sswNGen.exe
  C:\Windows\System\sswNGen.exe
  2⤵
  PID:10588
- C:\Windows\System\YTQgjlw.exe
  C:\Windows\System\YTQgjlw.exe
  2⤵
  PID:10616
- C:\Windows\System\WQazhvU.exe
  C:\Windows\System\WQazhvU.exe
  2⤵
  PID:10644
- C:\Windows\System\cCaPmaF.exe
  C:\Windows\System\cCaPmaF.exe
  2⤵
  PID:10672
- C:\Windows\System\YKAxEdu.exe
  C:\Windows\System\YKAxEdu.exe
  2⤵
  PID:10692
- C:\Windows\System\tHJsviO.exe
  C:\Windows\System\tHJsviO.exe
  2⤵
  PID:10716
- C:\Windows\System\SDPrPXi.exe
  C:\Windows\System\SDPrPXi.exe
  2⤵
  PID:10732
- C:\Windows\System\AzxZnim.exe
  C:\Windows\System\AzxZnim.exe
  2⤵
  PID:10752
- C:\Windows\System\xJGFfBG.exe
  C:\Windows\System\xJGFfBG.exe
  2⤵
  PID:10808
- C:\Windows\System\XGZEHPw.exe
  C:\Windows\System\XGZEHPw.exe
  2⤵
  PID:10840
- C:\Windows\System\XnzZKAq.exe
  C:\Windows\System\XnzZKAq.exe
  2⤵
  PID:10868
- C:\Windows\System\VRXyCqC.exe
  C:\Windows\System\VRXyCqC.exe
  2⤵
  PID:10896
- C:\Windows\System\FMpnhXz.exe
  C:\Windows\System\FMpnhXz.exe
  2⤵
  PID:10920
- C:\Windows\System\cxSuFrv.exe
  C:\Windows\System\cxSuFrv.exe
  2⤵
  PID:10936
- C:\Windows\System\jNIDDog.exe
  C:\Windows\System\jNIDDog.exe
  2⤵
  PID:10968
- C:\Windows\System\UaYKJVF.exe
  C:\Windows\System\UaYKJVF.exe
  2⤵
  PID:10992
- C:\Windows\System\jIKzMiP.exe
  C:\Windows\System\jIKzMiP.exe
  2⤵
  PID:11016
- C:\Windows\System\qpwlcHn.exe
  C:\Windows\System\qpwlcHn.exe
  2⤵
  PID:11040
- C:\Windows\System\Ehojopa.exe
  C:\Windows\System\Ehojopa.exe
  2⤵
  PID:11092
- C:\Windows\System\oLyEeRo.exe
  C:\Windows\System\oLyEeRo.exe
  2⤵
  PID:11120
- C:\Windows\System\CSKoKaX.exe
  C:\Windows\System\CSKoKaX.exe
  2⤵
  PID:11140
- C:\Windows\System\mdqNMby.exe
  C:\Windows\System\mdqNMby.exe
  2⤵
  PID:11168
- C:\Windows\System\kdNZepO.exe
  C:\Windows\System\kdNZepO.exe
  2⤵
  PID:11188
- C:\Windows\System\rZVwdby.exe
  C:\Windows\System\rZVwdby.exe
  2⤵
  PID:11204
- C:\Windows\System\AhDCIAo.exe
  C:\Windows\System\AhDCIAo.exe
  2⤵
  PID:11224
- C:\Windows\System\wfxErBj.exe
  C:\Windows\System\wfxErBj.exe
  2⤵
  PID:11256
- C:\Windows\System\hPFKrNH.exe
  C:\Windows\System\hPFKrNH.exe
  2⤵
  PID:10172
- C:\Windows\System\YeHMPtw.exe
  C:\Windows\System\YeHMPtw.exe
  2⤵
  PID:10392
- C:\Windows\System\LfJCufH.exe
  C:\Windows\System\LfJCufH.exe
  2⤵
  PID:10432
- C:\Windows\System\GrMxXvF.exe
  C:\Windows\System\GrMxXvF.exe
  2⤵
  PID:10464
- C:\Windows\System\CTXIcQM.exe
  C:\Windows\System\CTXIcQM.exe
  2⤵
  PID:10556
- C:\Windows\System\RqCkyzs.exe
  C:\Windows\System\RqCkyzs.exe
  2⤵
  PID:10584
- C:\Windows\System\nuFlkui.exe
  C:\Windows\System\nuFlkui.exe
  2⤵
  PID:10640
- C:\Windows\System\fOVpyQU.exe
  C:\Windows\System\fOVpyQU.exe
  2⤵
  PID:10728
- C:\Windows\System\CBqiRYj.exe
  C:\Windows\System\CBqiRYj.exe
  2⤵
  PID:10784
- C:\Windows\System\qfACtXw.exe
  C:\Windows\System\qfACtXw.exe
  2⤵
  PID:10904
- C:\Windows\System\HxKPvoO.exe
  C:\Windows\System\HxKPvoO.exe
  2⤵
  PID:10964
- C:\Windows\System\TtIUztj.exe
  C:\Windows\System\TtIUztj.exe
  2⤵
  PID:11000
- C:\Windows\System\ooPRlFT.exe
  C:\Windows\System\ooPRlFT.exe
  2⤵
  PID:11068
- C:\Windows\System\ZmZtiCu.exe
  C:\Windows\System\ZmZtiCu.exe
  2⤵
  PID:11116
- C:\Windows\System\RjsRhSu.exe
  C:\Windows\System\RjsRhSu.exe
  2⤵
  PID:11176
- C:\Windows\System\nifpqmF.exe
  C:\Windows\System\nifpqmF.exe
  2⤵
  PID:11236
- C:\Windows\System\JFcDVnk.exe
  C:\Windows\System\JFcDVnk.exe
  2⤵
  PID:10300
- C:\Windows\System\LvnfcoQ.exe
  C:\Windows\System\LvnfcoQ.exe
  2⤵
  PID:10436
- C:\Windows\System\TlMvodA.exe
  C:\Windows\System\TlMvodA.exe
  2⤵
  PID:10560
- C:\Windows\System\kpNGwuG.exe
  C:\Windows\System\kpNGwuG.exe
  2⤵
  PID:10744
- C:\Windows\System\HeoBDiv.exe
  C:\Windows\System\HeoBDiv.exe
  2⤵
  PID:10932
- C:\Windows\System\sXIZVtv.exe
  C:\Windows\System\sXIZVtv.exe
  2⤵
  PID:11136
- C:\Windows\System\XIdWhbJ.exe
  C:\Windows\System\XIdWhbJ.exe
  2⤵
  PID:10124
- C:\Windows\System\KXlJvGw.exe
  C:\Windows\System\KXlJvGw.exe
  2⤵
  PID:10368
- C:\Windows\System\ylHcbjH.exe
  C:\Windows\System\ylHcbjH.exe
  2⤵
  PID:10816
- C:\Windows\System\JAVGiEV.exe
  C:\Windows\System\JAVGiEV.exe
  2⤵
  PID:9416
- C:\Windows\System\WGRWgfS.exe
  C:\Windows\System\WGRWgfS.exe
  2⤵
  PID:11272
- C:\Windows\System\VqaDKMw.exe
  C:\Windows\System\VqaDKMw.exe
  2⤵
  PID:11308
- C:\Windows\System\XsaeBfL.exe
  C:\Windows\System\XsaeBfL.exe
  2⤵
  PID:11340
- C:\Windows\System\XQwexhx.exe
  C:\Windows\System\XQwexhx.exe
  2⤵
  PID:11376
- C:\Windows\System\jDDRDhO.exe
  C:\Windows\System\jDDRDhO.exe
  2⤵
  PID:11392
- C:\Windows\System\QZFnPjL.exe
  C:\Windows\System\QZFnPjL.exe
  2⤵
  PID:11412
- C:\Windows\System\BcmFbAc.exe
  C:\Windows\System\BcmFbAc.exe
  2⤵
  PID:11428
- C:\Windows\System\YadvmKp.exe
  C:\Windows\System\YadvmKp.exe
  2⤵
  PID:11452
- C:\Windows\System\LMjbhun.exe
  C:\Windows\System\LMjbhun.exe
  2⤵
  PID:11476
- C:\Windows\System\GdqwsVE.exe
  C:\Windows\System\GdqwsVE.exe
  2⤵
  PID:11500
- C:\Windows\System\gAPpwCQ.exe
  C:\Windows\System\gAPpwCQ.exe
  2⤵
  PID:11520
- C:\Windows\System\Kocqplg.exe
  C:\Windows\System\Kocqplg.exe
  2⤵
  PID:11540
- C:\Windows\System\hKMJFQo.exe
  C:\Windows\System\hKMJFQo.exe
  2⤵
  PID:11576
- C:\Windows\System\oiduMzp.exe
  C:\Windows\System\oiduMzp.exe
  2⤵
  PID:11632
- C:\Windows\System\RMuijuu.exe
  C:\Windows\System\RMuijuu.exe
  2⤵
  PID:11652
- C:\Windows\System\OIahvol.exe
  C:\Windows\System\OIahvol.exe
  2⤵
  PID:11700
- C:\Windows\System\NirldfA.exe
  C:\Windows\System\NirldfA.exe
  2⤵
  PID:11744
- C:\Windows\System\xUEjjOi.exe
  C:\Windows\System\xUEjjOi.exe
  2⤵
  PID:11772
- C:\Windows\System\IFskDiY.exe
  C:\Windows\System\IFskDiY.exe
  2⤵
  PID:11796
- C:\Windows\System\kmwiYHJ.exe
  C:\Windows\System\kmwiYHJ.exe
  2⤵
  PID:11844
- C:\Windows\System\JlehroP.exe
  C:\Windows\System\JlehroP.exe
  2⤵
  PID:11864
- C:\Windows\System\dubJnDG.exe
  C:\Windows\System\dubJnDG.exe
  2⤵
  PID:11884
- C:\Windows\System\jIbaoJk.exe
  C:\Windows\System\jIbaoJk.exe
  2⤵
  PID:11912
- C:\Windows\System\MSoxegA.exe
  C:\Windows\System\MSoxegA.exe
  2⤵
  PID:11980
- C:\Windows\System\dfVrQus.exe
  C:\Windows\System\dfVrQus.exe
  2⤵
  PID:12000
- C:\Windows\System\GHybecY.exe
  C:\Windows\System\GHybecY.exe
  2⤵
  PID:12020
- C:\Windows\System\xmqhaMq.exe
  C:\Windows\System\xmqhaMq.exe
  2⤵
  PID:12036
- C:\Windows\System\bTVCoNz.exe
  C:\Windows\System\bTVCoNz.exe
  2⤵
  PID:12068
- C:\Windows\System\eiGryok.exe
  C:\Windows\System\eiGryok.exe
  2⤵
  PID:12120
- C:\Windows\System\koAvzGj.exe
  C:\Windows\System\koAvzGj.exe
  2⤵
  PID:12144
- C:\Windows\System\MNiIwHq.exe
  C:\Windows\System\MNiIwHq.exe
  2⤵
  PID:12168
- C:\Windows\System\aXCXDvd.exe
  C:\Windows\System\aXCXDvd.exe
  2⤵
  PID:12196
- C:\Windows\System\XemUsSM.exe
  C:\Windows\System\XemUsSM.exe
  2⤵
  PID:12224
- C:\Windows\System\QcAebTG.exe
  C:\Windows\System\QcAebTG.exe
  2⤵
  PID:12240
- C:\Windows\System\YmdRxNP.exe
  C:\Windows\System\YmdRxNP.exe
  2⤵
  PID:12272
- C:\Windows\System\ajVsilW.exe
  C:\Windows\System\ajVsilW.exe
  2⤵
  PID:10492
- C:\Windows\System\rKQzsKr.exe
  C:\Windows\System\rKQzsKr.exe
  2⤵
  PID:11268
- C:\Windows\System\mdCjMxw.exe
  C:\Windows\System\mdCjMxw.exe
  2⤵
  PID:11336
- C:\Windows\System\xbezCAO.exe
  C:\Windows\System\xbezCAO.exe
  2⤵
  PID:11468
- C:\Windows\System\zxqxLLc.exe
  C:\Windows\System\zxqxLLc.exe
  2⤵
  PID:11420
- C:\Windows\System\NaQSTNG.exe
  C:\Windows\System\NaQSTNG.exe
  2⤵
  PID:11460
- C:\Windows\System\RuSmisZ.exe
  C:\Windows\System\RuSmisZ.exe
  2⤵
  PID:11572
- C:\Windows\System\VmTwcAp.exe
  C:\Windows\System\VmTwcAp.exe
  2⤵
  PID:11620
- C:\Windows\System\AfBcqBX.exe
  C:\Windows\System\AfBcqBX.exe
  2⤵
  PID:11724
- C:\Windows\System\DeLvAse.exe
  C:\Windows\System\DeLvAse.exe
  2⤵
  PID:11928
- C:\Windows\System\cGxMVrS.exe
  C:\Windows\System\cGxMVrS.exe
  2⤵
  PID:3760
- C:\Windows\System\RfZFlTQ.exe
  C:\Windows\System\RfZFlTQ.exe
  2⤵
  PID:11976
- C:\Windows\System\pxIdEHV.exe
  C:\Windows\System\pxIdEHV.exe
  2⤵
  PID:11996
- C:\Windows\System\fVRFYAD.exe
  C:\Windows\System\fVRFYAD.exe
  2⤵
  PID:12096
- C:\Windows\System\VnYFLfZ.exe
  C:\Windows\System\VnYFLfZ.exe
  2⤵
  PID:12136
- C:\Windows\System\zioasRd.exe
  C:\Windows\System\zioasRd.exe
  2⤵
  PID:12188
- C:\Windows\System\CkvGcPB.exe
  C:\Windows\System\CkvGcPB.exe
  2⤵
  PID:11820
- C:\Windows\System\CIUiYaw.exe
  C:\Windows\System\CIUiYaw.exe
  2⤵
  PID:10248
- C:\Windows\System\McrcylP.exe
  C:\Windows\System\McrcylP.exe
  2⤵
  PID:11368
- C:\Windows\System\GLgZeze.exe
  C:\Windows\System\GLgZeze.exe
  2⤵
  PID:11644
- C:\Windows\System\FZGQgMt.exe
  C:\Windows\System\FZGQgMt.exe
  2⤵
  PID:11856
- C:\Windows\System\zUHaAYl.exe
  C:\Windows\System\zUHaAYl.exe
  2⤵
  PID:11932
- C:\Windows\System\mmnSCPH.exe
  C:\Windows\System\mmnSCPH.exe
  2⤵
  PID:11992
- C:\Windows\System\NmLxaoV.exe
  C:\Windows\System\NmLxaoV.exe
  2⤵
  PID:12012
- C:\Windows\System\uOHmbbj.exe
  C:\Windows\System\uOHmbbj.exe
  2⤵
  PID:12232
- C:\Windows\System\hgjBHsB.exe
  C:\Windows\System\hgjBHsB.exe
  2⤵
  PID:10516
- C:\Windows\System\SKVTYDR.exe
  C:\Windows\System\SKVTYDR.exe
  2⤵
  PID:11764
- C:\Windows\System\fQQHdVT.exe
  C:\Windows\System\fQQHdVT.exe
  2⤵
  PID:4556
- C:\Windows\System\cvRGtnv.exe
  C:\Windows\System\cvRGtnv.exe
  2⤵
  PID:11356
- C:\Windows\System\WmaryZQ.exe
  C:\Windows\System\WmaryZQ.exe
  2⤵
  PID:11792
- C:\Windows\System\pWpiBxW.exe
  C:\Windows\System\pWpiBxW.exe
  2⤵
  PID:12300
- C:\Windows\System\EpyaSsN.exe
  C:\Windows\System\EpyaSsN.exe
  2⤵
  PID:12320
- C:\Windows\System\eZLyDrV.exe
  C:\Windows\System\eZLyDrV.exe
  2⤵
  PID:12336
- C:\Windows\System\TsDQaEK.exe
  C:\Windows\System\TsDQaEK.exe
  2⤵
  PID:12364
- C:\Windows\System\JtzNtjv.exe
  C:\Windows\System\JtzNtjv.exe
  2⤵
  PID:12424
- C:\Windows\System\fFDzEKN.exe
  C:\Windows\System\fFDzEKN.exe
  2⤵
  PID:12468
- C:\Windows\System\jjCefvv.exe
  C:\Windows\System\jjCefvv.exe
  2⤵
  PID:12512
- C:\Windows\System\crcTHca.exe
  C:\Windows\System\crcTHca.exe
  2⤵
  PID:12536
- C:\Windows\System\NrIkgmA.exe
  C:\Windows\System\NrIkgmA.exe
  2⤵
  PID:12560
- C:\Windows\System\SxYkQNr.exe
  C:\Windows\System\SxYkQNr.exe
  2⤵
  PID:12588
- C:\Windows\System\suEDkhl.exe
  C:\Windows\System\suEDkhl.exe
  2⤵
  PID:12608
- C:\Windows\System\kwohlNz.exe
  C:\Windows\System\kwohlNz.exe
  2⤵
  PID:12628
- C:\Windows\System\DVqZRfn.exe
  C:\Windows\System\DVqZRfn.exe
  2⤵
  PID:12652
- C:\Windows\System\kVrZlxG.exe
  C:\Windows\System\kVrZlxG.exe
  2⤵
  PID:12676
- C:\Windows\System\rKpEEMu.exe
  C:\Windows\System\rKpEEMu.exe
  2⤵
  PID:12696
- C:\Windows\System\nsfkyWX.exe
  C:\Windows\System\nsfkyWX.exe
  2⤵
  PID:12736
- C:\Windows\System\xotKStZ.exe
  C:\Windows\System\xotKStZ.exe
  2⤵
  PID:12784
- C:\Windows\System\VztpQLH.exe
  C:\Windows\System\VztpQLH.exe
  2⤵
  PID:12816
- C:\Windows\System\ZIpbfAk.exe
  C:\Windows\System\ZIpbfAk.exe
  2⤵
  PID:12832
- C:\Windows\System\PKJXsVB.exe
  C:\Windows\System\PKJXsVB.exe
  2⤵
  PID:12852
- C:\Windows\System\xCCLoxz.exe
  C:\Windows\System\xCCLoxz.exe
  2⤵
  PID:12904
- C:\Windows\System\vyAidDg.exe
  C:\Windows\System\vyAidDg.exe
  2⤵
  PID:12936
- C:\Windows\System\JeYAKIv.exe
  C:\Windows\System\JeYAKIv.exe
  2⤵
  PID:12964
- C:\Windows\System\OACNlRE.exe
  C:\Windows\System\OACNlRE.exe
  2⤵
  PID:12984
- C:\Windows\System\YrQKleB.exe
  C:\Windows\System\YrQKleB.exe
  2⤵
  PID:13020
- C:\Windows\System\iMfpJqm.exe
  C:\Windows\System\iMfpJqm.exe
  2⤵
  PID:13040
- C:\Windows\System\IXstBCU.exe
  C:\Windows\System\IXstBCU.exe
  2⤵
  PID:13060
- C:\Windows\System\IwhoMjD.exe
  C:\Windows\System\IwhoMjD.exe
  2⤵
  PID:13088
- C:\Windows\System\UWrVLUl.exe
  C:\Windows\System\UWrVLUl.exe
  2⤵
  PID:13116
- C:\Windows\System\xPOXrlm.exe
  C:\Windows\System\xPOXrlm.exe
  2⤵
  PID:13136
- C:\Windows\System\eGSHcHg.exe
  C:\Windows\System\eGSHcHg.exe
  2⤵
  PID:13152
- C:\Windows\System\ibgLdXY.exe
  C:\Windows\System\ibgLdXY.exe
  2⤵
  PID:13184
- C:\Windows\System\rwMuEnh.exe
  C:\Windows\System\rwMuEnh.exe
  2⤵
  PID:13208
- C:\Windows\System\aqtSYwV.exe
  C:\Windows\System\aqtSYwV.exe
  2⤵
  PID:13244
- C:\Windows\System\ezmElMC.exe
  C:\Windows\System\ezmElMC.exe
  2⤵
  PID:13272
- C:\Windows\System\RIoeNPb.exe
  C:\Windows\System\RIoeNPb.exe
  2⤵
  PID:12156
- C:\Windows\System\bDmcmcu.exe
  C:\Windows\System\bDmcmcu.exe
  2⤵
  PID:12372
- C:\Windows\System\JtdnfUA.exe
  C:\Windows\System\JtdnfUA.exe
  2⤵
  PID:12408
- C:\Windows\System\BYYrBoy.exe
  C:\Windows\System\BYYrBoy.exe
  2⤵
  PID:12392
- C:\Windows\System\EYbIVbD.exe
  C:\Windows\System\EYbIVbD.exe
  2⤵
  PID:12912
- C:\Windows\System\ZkwqSnO.exe
  C:\Windows\System\ZkwqSnO.exe
  2⤵
  PID:12928
- C:\Windows\System\sOxyehA.exe
  C:\Windows\System\sOxyehA.exe
  2⤵
  PID:12976
- C:\Windows\System\bBPGcWx.exe
  C:\Windows\System\bBPGcWx.exe
  2⤵
  PID:13080
- C:\Windows\System\uUBLbWY.exe
  C:\Windows\System\uUBLbWY.exe
  2⤵
  PID:5036
- C:\Windows\System\PpfKCNI.exe
  C:\Windows\System\PpfKCNI.exe
  2⤵
  PID:13056
- C:\Windows\System\KtUMVNj.exe
  C:\Windows\System\KtUMVNj.exe
  2⤵
  PID:13240
- C:\Windows\System\AKcunjk.exe
  C:\Windows\System\AKcunjk.exe
  2⤵
  PID:13288
- C:\Windows\System\iuDqCfb.exe
  C:\Windows\System\iuDqCfb.exe
  2⤵
  PID:5312
- C:\Windows\System\sbHhibf.exe
  C:\Windows\System\sbHhibf.exe
  2⤵
  PID:12760
- C:\Windows\System\adxYQmA.exe
  C:\Windows\System\adxYQmA.exe
  2⤵
  PID:12636
- C:\Windows\System\kaHqCbV.exe
  C:\Windows\System\kaHqCbV.exe
  2⤵
  PID:4408
- C:\Windows\System\fkazxRr.exe
  C:\Windows\System\fkazxRr.exe
  2⤵
  PID:13036
- C:\Windows\System\RwRbIyN.exe
  C:\Windows\System\RwRbIyN.exe
  2⤵
  PID:2484
- C:\Windows\System\lxnefDC.exe
  C:\Windows\System\lxnefDC.exe
  2⤵
  PID:6020
- C:\Windows\System\cuZCebp.exe
  C:\Windows\System\cuZCebp.exe
  2⤵
  PID:12896
- C:\Windows\System\gmZkKkW.exe
  C:\Windows\System\gmZkKkW.exe
  2⤵
  PID:3864
- C:\Windows\System\GcGEMeM.exe
  C:\Windows\System\GcGEMeM.exe
  2⤵
  PID:13008
- C:\Windows\System\qtRLcrs.exe
  C:\Windows\System\qtRLcrs.exe
  2⤵
  PID:2144
- C:\Windows\System\MQFXAem.exe
  C:\Windows\System\MQFXAem.exe
  2⤵
  PID:13100
- C:\Windows\System\EAKDQQO.exe
  C:\Windows\System\EAKDQQO.exe
  2⤵
  PID:13160
- C:\Windows\System\usmmxyc.exe
  C:\Windows\System\usmmxyc.exe
  2⤵
  PID:13176
- C:\Windows\System\WifYRxr.exe
  C:\Windows\System\WifYRxr.exe
  2⤵
  PID:13204
- C:\Windows\System\nAVMsrC.exe
  C:\Windows\System\nAVMsrC.exe
  2⤵
  PID:13308
- C:\Windows\System\DjgXwTu.exe
  C:\Windows\System\DjgXwTu.exe
  2⤵
  PID:4424
- C:\Windows\System\ysLMgAT.exe
  C:\Windows\System\ysLMgAT.exe
  2⤵
  PID:4072
- C:\Windows\System\kJDVnlv.exe
  C:\Windows\System\kJDVnlv.exe
  2⤵
  PID:4264
- C:\Windows\System\RhDZOKI.exe
  C:\Windows\System\RhDZOKI.exe
  2⤵
  PID:5680
- C:\Windows\System\DJKCKIG.exe
  C:\Windows\System\DJKCKIG.exe
  2⤵
  PID:12600
- C:\Windows\System\DwpNyYj.exe
  C:\Windows\System\DwpNyYj.exe
  2⤵
  PID:12644
- C:\Windows\System\vgPkhSR.exe
  C:\Windows\System\vgPkhSR.exe
  2⤵
  PID:12668
- C:\Windows\System\KAeUFLw.exe
  C:\Windows\System\KAeUFLw.exe
  2⤵
  PID:13256
- C:\Windows\System\mvSZaRE.exe
  C:\Windows\System\mvSZaRE.exe
  2⤵
  PID:12744
- C:\Windows\System\jvraiYy.exe
  C:\Windows\System\jvraiYy.exe
  2⤵
  PID:12604
- C:\Windows\System\aSyGZbt.exe
  C:\Windows\System\aSyGZbt.exe
  2⤵
  PID:12780
- C:\Windows\System\ygjMZUR.exe
  C:\Windows\System\ygjMZUR.exe
  2⤵
  PID:12956
- C:\Windows\System\MaciXfB.exe
  C:\Windows\System\MaciXfB.exe
  2⤵
  PID:13068
- C:\Windows\System\zhHqUhl.exe
  C:\Windows\System\zhHqUhl.exe
  2⤵
  PID:4996
- C:\Windows\System\hELeKuQ.exe
  C:\Windows\System\hELeKuQ.exe
  2⤵
  PID:12440
- C:\Windows\System\QEhAFUI.exe
  C:\Windows\System\QEhAFUI.exe
  2⤵
  PID:13180
- C:\Windows\System\EybnoWS.exe
  C:\Windows\System\EybnoWS.exe
  2⤵
  PID:12292
- C:\Windows\System\GKGsscW.exe
  C:\Windows\System\GKGsscW.exe
  2⤵
  PID:12556
- C:\Windows\System\tyZzGFZ.exe
  C:\Windows\System\tyZzGFZ.exe
  2⤵
  PID:4376
- C:\Windows\System\SofWgoH.exe
  C:\Windows\System\SofWgoH.exe
  2⤵
  PID:5608
- C:\Windows\System\soYJuNB.exe
  C:\Windows\System\soYJuNB.exe
  2⤵
  PID:12776
- C:\Windows\System\DfXQHgE.exe
  C:\Windows\System\DfXQHgE.exe
  2⤵
  PID:12980
- C:\Windows\System\szdEAlT.exe
  C:\Windows\System\szdEAlT.exe
  2⤵
  PID:13028
- C:\Windows\System\RznLaAp.exe
  C:\Windows\System\RznLaAp.exe
  2⤵
  PID:1632
- C:\Windows\System\GoskvsK.exe
  C:\Windows\System\GoskvsK.exe
  2⤵
  PID:5848
- C:\Windows\System\OiScDif.exe
  C:\Windows\System\OiScDif.exe
  2⤵
  PID:12624
- C:\Windows\System\jZEFsgV.exe
  C:\Windows\System\jZEFsgV.exe
  2⤵
  PID:12764
- C:\Windows\System\RSBClop.exe
  C:\Windows\System\RSBClop.exe
  2⤵
  PID:5568
- C:\Windows\System\HDvJazp.exe
  C:\Windows\System\HDvJazp.exe
  2⤵
  PID:1048
- C:\Windows\System\yAyFJma.exe
  C:\Windows\System\yAyFJma.exe
  2⤵
  PID:12280
- C:\Windows\System\LUNcGHD.exe
  C:\Windows\System\LUNcGHD.exe
  2⤵
  PID:12520
- C:\Windows\System\JkDSOCo.exe
  C:\Windows\System\JkDSOCo.exe
  2⤵
  PID:12332
- C:\Windows\System\FszxSmc.exe
  C:\Windows\System\FszxSmc.exe
  2⤵
  PID:4584
- C:\Windows\System\pxrAHBt.exe
  C:\Windows\System\pxrAHBt.exe
  2⤵
  PID:3000
- C:\Windows\System\YPVeChy.exe
  C:\Windows\System\YPVeChy.exe
  2⤵
  PID:3308
- C:\Windows\System\wlCBZAo.exe
  C:\Windows\System\wlCBZAo.exe
  2⤵
  PID:4992
- C:\Windows\System\tCOvxCw.exe
  C:\Windows\System\tCOvxCw.exe
  2⤵
  PID:4460
- C:\Windows\System\VbJWmoO.exe
  C:\Windows\System\VbJWmoO.exe
  2⤵
  PID:12060
- C:\Windows\System\pBnmZnU.exe
  C:\Windows\System\pBnmZnU.exe
  2⤵
  PID:12524
- C:\Windows\System\ZFvdbAX.exe
  C:\Windows\System\ZFvdbAX.exe
  2⤵
  PID:13148
- C:\Windows\System\QpnPCKm.exe
  C:\Windows\System\QpnPCKm.exe
  2⤵
  PID:3620
- C:\Windows\System\aSoKowS.exe
  C:\Windows\System\aSoKowS.exe
  2⤵
  PID:12688
- C:\Windows\System\tTQPZEE.exe
  C:\Windows\System\tTQPZEE.exe
  2⤵
  PID:112
- C:\Windows\System\pFFrPVk.exe
  C:\Windows\System\pFFrPVk.exe
  2⤵
  PID:12828
- C:\Windows\System\AJeLWtF.exe
  C:\Windows\System\AJeLWtF.exe
  2⤵
  PID:1984
- C:\Windows\System\DaVDnKd.exe
  C:\Windows\System\DaVDnKd.exe
  2⤵
  PID:1312
- C:\Windows\System\TbOwxem.exe
  C:\Windows\System\TbOwxem.exe
  2⤵
  PID:6480
- C:\Windows\System\jlEucNc.exe
  C:\Windows\System\jlEucNc.exe
  2⤵
  PID:2228
- C:\Windows\System\QMJCuch.exe
  C:\Windows\System\QMJCuch.exe
  2⤵
  PID:12620
- C:\Windows\System\NYMiEcn.exe
  C:\Windows\System\NYMiEcn.exe
  2⤵
  PID:2304
- C:\Windows\System\FPliaZl.exe
  C:\Windows\System\FPliaZl.exe
  2⤵
  PID:1944
- C:\Windows\System\oRloAmz.exe
  C:\Windows\System\oRloAmz.exe
  2⤵
  PID:6696
- C:\Windows\System\lLKCjfj.exe
  C:\Windows\System\lLKCjfj.exe
  2⤵
  PID:6772
- C:\Windows\System\QqMbowC.exe
  C:\Windows\System\QqMbowC.exe
  2⤵
  PID:408
- C:\Windows\System\geEuZUu.exe
  C:\Windows\System\geEuZUu.exe
  2⤵
  PID:6880
- C:\Windows\System\EAuLHbw.exe
  C:\Windows\System\EAuLHbw.exe
  2⤵
  PID:3948
- C:\Windows\System\kphpCrO.exe
  C:\Windows\System\kphpCrO.exe
  2⤵
  PID:6712
- C:\Windows\System\LgeCKuj.exe
  C:\Windows\System\LgeCKuj.exe
  2⤵
  PID:3872
- C:\Windows\System\UuLYSiT.exe
  C:\Windows\System\UuLYSiT.exe
  2⤵
  PID:7040
- C:\Windows\System\jwbOxzR.exe
  C:\Windows\System\jwbOxzR.exe
  2⤵
  PID:7064
- C:\Windows\System\fvwFHhd.exe
  C:\Windows\System\fvwFHhd.exe
  2⤵
  PID:1392
- C:\Windows\System\NKOZyBd.exe
  C:\Windows\System\NKOZyBd.exe
  2⤵
  PID:6544
- C:\Windows\System\CLWzpNF.exe
  C:\Windows\System\CLWzpNF.exe
  2⤵
  PID:6320
- C:\Windows\System\bijXjem.exe
  C:\Windows\System\bijXjem.exe
  2⤵
  PID:6668
- C:\Windows\System\fRcbkSD.exe
  C:\Windows\System\fRcbkSD.exe
  2⤵
  PID:6364
- C:\Windows\System\fQdDfQg.exe
  C:\Windows\System\fQdDfQg.exe
  2⤵
  PID:6376
- C:\Windows\System\hvYztdL.exe
  C:\Windows\System\hvYztdL.exe
  2⤵
  PID:6864
- C:\Windows\System\ehBbgbS.exe
  C:\Windows\System\ehBbgbS.exe
  2⤵
  PID:7100
- C:\Windows\System\bsEGitP.exe
  C:\Windows\System\bsEGitP.exe
  2⤵
  PID:1524
- C:\Windows\System\gznKQle.exe
  C:\Windows\System\gznKQle.exe
  2⤵
  PID:6988
- C:\Windows\System\iCwPOSq.exe
  C:\Windows\System\iCwPOSq.exe
  2⤵
  PID:6564
- C:\Windows\System\uLioRQv.exe
  C:\Windows\System\uLioRQv.exe
  2⤵
  PID:2220
- C:\Windows\System\XGxQhDk.exe
  C:\Windows\System\XGxQhDk.exe
  2⤵
  PID:6876
- C:\Windows\System\sAHJPDG.exe
  C:\Windows\System\sAHJPDG.exe
  2⤵
  PID:4932
- C:\Windows\System\MSxDQXx.exe
  C:\Windows\System\MSxDQXx.exe
  2⤵
  PID:7184
- C:\Windows\System\zwzZGcq.exe
  C:\Windows\System\zwzZGcq.exe
  2⤵
  PID:7500
- C:\Windows\System\dJEXMSS.exe
  C:\Windows\System\dJEXMSS.exe
  2⤵
  PID:7596
- C:\Windows\System\PUKyMTN.exe
  C:\Windows\System\PUKyMTN.exe
  2⤵
  PID:7680
- C:\Windows\System\etZTsuf.exe
  C:\Windows\System\etZTsuf.exe
  2⤵
  PID:1224
- C:\Windows\System\UlLvAlO.exe
  C:\Windows\System\UlLvAlO.exe
  2⤵
  PID:7872
- C:\Windows\System\EZZxuLe.exe
  C:\Windows\System\EZZxuLe.exe
  2⤵
  PID:1416
- C:\Windows\System\djKCCdP.exe
  C:\Windows\System\djKCCdP.exe
  2⤵
  PID:6728
- C:\Windows\System\MQnDftd.exe
  C:\Windows\System\MQnDftd.exe
  2⤵
  PID:2028
- C:\Windows\System\FlVmefz.exe
  C:\Windows\System\FlVmefz.exe
  2⤵
  PID:1840
- C:\Windows\System\YptXFsr.exe
  C:\Windows\System\YptXFsr.exe
  2⤵
  PID:3432
- C:\Windows\System\YvPLTZf.exe
  C:\Windows\System\YvPLTZf.exe
  2⤵
  PID:6580
- C:\Windows\System\FBlVpyC.exe
  C:\Windows\System\FBlVpyC.exe
  2⤵
  PID:8160
- C:\Windows\System\GRqcdTz.exe
  C:\Windows\System\GRqcdTz.exe
  2⤵
  PID:8168
- C:\Windows\System\IOWTImz.exe
  C:\Windows\System\IOWTImz.exe
  2⤵
  PID:7268
- C:\Windows\System\qViGtnF.exe
  C:\Windows\System\qViGtnF.exe
  2⤵
  PID:7348
- C:\Windows\System\UuYkiFV.exe
  C:\Windows\System\UuYkiFV.exe
  2⤵
  PID:7540
- C:\Windows\System\tdrLcCf.exe
  C:\Windows\System\tdrLcCf.exe
  2⤵
  PID:7712
- C:\Windows\System\daTOimo.exe
  C:\Windows\System\daTOimo.exe
  2⤵
  PID:7824
- C:\Windows\System\JyumTze.exe
  C:\Windows\System\JyumTze.exe
  2⤵
  PID:7992
- C:\Windows\System\dAhxqXz.exe
  C:\Windows\System\dAhxqXz.exe
  2⤵
  PID:7224
- C:\Windows\System\odFKPHJ.exe
  C:\Windows\System\odFKPHJ.exe
  2⤵
  PID:8028
- C:\Windows\System\grtYHwm.exe
  C:\Windows\System\grtYHwm.exe
  2⤵
  PID:8052
- C:\Windows\System\uSmnNSE.exe
  C:\Windows\System\uSmnNSE.exe
  2⤵
  PID:8272
- C:\Windows\System\XlonoRb.exe
  C:\Windows\System\XlonoRb.exe
  2⤵
  PID:8360
- C:\Windows\System\AVvuOLu.exe
  C:\Windows\System\AVvuOLu.exe
  2⤵
  PID:8572
- C:\Windows\System\geIjOFG.exe
  C:\Windows\System\geIjOFG.exe
  2⤵
  PID:8648
- C:\Windows\System\QKFhGRP.exe
  C:\Windows\System\QKFhGRP.exe
  2⤵
  PID:8848
- C:\Windows\System\iRtnXSP.exe
  C:\Windows\System\iRtnXSP.exe
  2⤵
  PID:8828
- C:\Windows\System\nPAvFJp.exe
  C:\Windows\System\nPAvFJp.exe
  2⤵
  PID:8840
- C:\Windows\System\ksxNcCv.exe
  C:\Windows\System\ksxNcCv.exe
  2⤵
  PID:8928
- C:\Windows\System\GMHsgkm.exe
  C:\Windows\System\GMHsgkm.exe
  2⤵
  PID:5488
- C:\Windows\System\sjJefEw.exe
  C:\Windows\System\sjJefEw.exe
  2⤵
  PID:7044
- C:\Windows\System\qPSRNUc.exe
  C:\Windows\System\qPSRNUc.exe
  2⤵
  PID:4824
- C:\Windows\System\GQgGJVx.exe
  C:\Windows\System\GQgGJVx.exe
  2⤵
  PID:4816
- C:\Windows\System\qeADMZi.exe
  C:\Windows\System\qeADMZi.exe
  2⤵
  PID:9024
- C:\Windows\System\DIvTWLN.exe
  C:\Windows\System\DIvTWLN.exe
  2⤵
  PID:5104
- C:\Windows\System\jQFdoQL.exe
  C:\Windows\System\jQFdoQL.exe
  2⤵
  PID:1296
- C:\Windows\System\JBwBdVs.exe
  C:\Windows\System\JBwBdVs.exe
  2⤵
  PID:2392
- C:\Windows\System\AAJxccf.exe
  C:\Windows\System\AAJxccf.exe
  2⤵
  PID:1872
- C:\Windows\System\YSTBvPG.exe
  C:\Windows\System\YSTBvPG.exe
  2⤵
  PID:3700
- C:\Windows\System\pCakGKv.exe
  C:\Windows\System\pCakGKv.exe
  2⤵
  PID:1592
- C:\Windows\System\dpXALUy.exe
  C:\Windows\System\dpXALUy.exe
  2⤵
  PID:1644
- C:\Windows\System\mxWUTbo.exe
  C:\Windows\System\mxWUTbo.exe
  2⤵
  PID:3968
- C:\Windows\System\OfdkvTO.exe
  C:\Windows\System\OfdkvTO.exe
  2⤵
  PID:7220
- C:\Windows\System\XVgdlbN.exe
  C:\Windows\System\XVgdlbN.exe
  2⤵
  PID:8156
- C:\Windows\System\YLfDqyb.exe
  C:\Windows\System\YLfDqyb.exe
  2⤵
  PID:7372
- C:\Windows\System\lflTMcy.exe
  C:\Windows\System\lflTMcy.exe
  2⤵
  PID:1876
- C:\Windows\System\zGydPTT.exe
  C:\Windows\System\zGydPTT.exe
  2⤵
  PID:1512
- C:\Windows\System\MIuURUx.exe
  C:\Windows\System\MIuURUx.exe
  2⤵
  PID:7416
- C:\Windows\System\SMjzvcj.exe
  C:\Windows\System\SMjzvcj.exe
  2⤵
  PID:7600
- C:\Windows\System\MZFycFN.exe
  C:\Windows\System\MZFycFN.exe
  2⤵
  PID:7448
- C:\Windows\System\TfNGBfZ.exe
  C:\Windows\System\TfNGBfZ.exe
  2⤵
  PID:8584
- C:\Windows\System\aYZnZxZ.exe
  C:\Windows\System\aYZnZxZ.exe
  2⤵
  PID:1740
- C:\Windows\System\GuPnjbs.exe
  C:\Windows\System\GuPnjbs.exe
  2⤵
  PID:7652
- C:\Windows\System\MAqMaNW.exe
  C:\Windows\System\MAqMaNW.exe
  2⤵
  PID:8892
- C:\Windows\System\fNPLbMQ.exe
  C:\Windows\System\fNPLbMQ.exe
  2⤵
  PID:4352
- C:\Windows\System\AVYjdTP.exe
  C:\Windows\System\AVYjdTP.exe
  2⤵
  PID:852
- C:\Windows\System\NKCBAKO.exe
  C:\Windows\System\NKCBAKO.exe
  2⤵
  PID:8912
- C:\Windows\System\ohxLvXi.exe
  C:\Windows\System\ohxLvXi.exe
  2⤵
  PID:7868
- C:\Windows\System\PZGRqYi.exe
  C:\Windows\System\PZGRqYi.exe
  2⤵
  PID:6428
- C:\Windows\System\ZpZIVBY.exe
  C:\Windows\System\ZpZIVBY.exe
  2⤵
  PID:3548
- C:\Windows\System\dZDBqYx.exe
  C:\Windows\System\dZDBqYx.exe
  2⤵
  PID:3008
- C:\Windows\System\nHQzTQh.exe
  C:\Windows\System\nHQzTQh.exe
  2⤵
  PID:4164
- C:\Windows\System\RdocRsz.exe
  C:\Windows\System\RdocRsz.exe
  2⤵
  PID:4012
- C:\Windows\System\FYGQGSQ.exe
  C:\Windows\System\FYGQGSQ.exe
  2⤵
  PID:8404
- C:\Windows\System\MccPmON.exe
  C:\Windows\System\MccPmON.exe
  2⤵
  PID:7972
- C:\Windows\System\OcgiWBf.exe
  C:\Windows\System\OcgiWBf.exe
  2⤵
  PID:7456
- C:\Windows\System\VOBBdpF.exe
  C:\Windows\System\VOBBdpF.exe
  2⤵
  PID:8392
- C:\Windows\System\EhkiITa.exe
  C:\Windows\System\EhkiITa.exe
  2⤵
  PID:9184
- C:\Windows\System\uNKZXOb.exe
  C:\Windows\System\uNKZXOb.exe
  2⤵
  PID:8844
- C:\Windows\System\lRNGntp.exe
  C:\Windows\System\lRNGntp.exe
  2⤵
  PID:9264
- C:\Windows\System\PpBqRtc.exe
  C:\Windows\System\PpBqRtc.exe
  2⤵
  PID:1940
- C:\Windows\System\NCZFYkU.exe
  C:\Windows\System\NCZFYkU.exe
  2⤵
  PID:2316
- C:\Windows\System\sESWKfQ.exe
  C:\Windows\System\sESWKfQ.exe
  2⤵
  PID:4356
- C:\Windows\System\nyTZEgQ.exe
  C:\Windows\System\nyTZEgQ.exe
  2⤵
  PID:7688
- C:\Windows\System\jQLowhI.exe
  C:\Windows\System\jQLowhI.exe
  2⤵
  PID:9324
- C:\Windows\System\zdubqkm.exe
  C:\Windows\System\zdubqkm.exe
  2⤵
  PID:3152
- C:\Windows\System\elWkMDR.exe
  C:\Windows\System\elWkMDR.exe
  2⤵
  PID:2072
- C:\Windows\System\LRASqCU.exe
  C:\Windows\System\LRASqCU.exe
  2⤵
  PID:8144
- C:\Windows\System\pSVbZWE.exe
  C:\Windows\System\pSVbZWE.exe
  2⤵
  PID:9404
- C:\Windows\System\PTzVmPA.exe
  C:\Windows\System\PTzVmPA.exe
  2⤵
  PID:7200
- C:\Windows\System\PLzGROJ.exe
  C:\Windows\System\PLzGROJ.exe
  2⤵
  PID:9476
- C:\Windows\System\bnZumqf.exe
  C:\Windows\System\bnZumqf.exe
  2⤵
  PID:7520
- C:\Windows\System\YFHXiZT.exe
  C:\Windows\System\YFHXiZT.exe
  2⤵
  PID:7684
- C:\Windows\System\TcDpYoV.exe
  C:\Windows\System\TcDpYoV.exe
  2⤵
  PID:9516
- C:\Windows\System\jfmVAkh.exe
  C:\Windows\System\jfmVAkh.exe
  2⤵
  PID:9552
- C:\Windows\System\fhYhSjw.exe
  C:\Windows\System\fhYhSjw.exe
  2⤵
  PID:9596
- C:\Windows\System\lBbTDFd.exe
  C:\Windows\System\lBbTDFd.exe
  2⤵
  PID:8072
- C:\Windows\System\JpOpjgz.exe
  C:\Windows\System\JpOpjgz.exe
  2⤵
  PID:9624
- C:\Windows\System\yWausIn.exe
  C:\Windows\System\yWausIn.exe
  2⤵
  PID:1892
- C:\Windows\System\FHhjUmj.exe
  C:\Windows\System\FHhjUmj.exe
  2⤵
  PID:4832
- C:\Windows\System\TPhZJwp.exe
  C:\Windows\System\TPhZJwp.exe
  2⤵
  PID:8020
- C:\Windows\System\roKBAvd.exe
  C:\Windows\System\roKBAvd.exe
  2⤵
  PID:5644
- C:\Windows\System\NAWAtcX.exe
  C:\Windows\System\NAWAtcX.exe
  2⤵
  PID:8352
- C:\Windows\System\DTvpUrB.exe
  C:\Windows\System\DTvpUrB.exe
  2⤵
  PID:8348
- C:\Windows\System\OlyJWhx.exe
  C:\Windows\System\OlyJWhx.exe
  2⤵
  PID:8548
- C:\Windows\System\laaFreI.exe
  C:\Windows\System\laaFreI.exe
  2⤵
  PID:8644
- C:\Windows\System\XCfYaSv.exe
  C:\Windows\System\XCfYaSv.exe
  2⤵
  PID:5164
- C:\Windows\System\VcyryyJ.exe
  C:\Windows\System\VcyryyJ.exe
  2⤵
  PID:9960
- C:\Windows\System\EtiwTPg.exe
  C:\Windows\System\EtiwTPg.exe
  2⤵
  PID:8864
- C:\Windows\System\rpXHNEg.exe
  C:\Windows\System\rpXHNEg.exe
  2⤵
  PID:8780
- C:\Windows\System\IvySPoT.exe
  C:\Windows\System\IvySPoT.exe
  2⤵
  PID:10060
- C:\Windows\System\JcAmuDm.exe
  C:\Windows\System\JcAmuDm.exe
  2⤵
  PID:8760
- C:\Windows\System\TspIlFO.exe
  C:\Windows\System\TspIlFO.exe
  2⤵
  PID:8872
- C:\Windows\System\QkxdUpE.exe
  C:\Windows\System\QkxdUpE.exe
  2⤵
  PID:5236
- C:\Windows\System\QKwPAuQ.exe
  C:\Windows\System\QKwPAuQ.exe
  2⤵
  PID:8660
- C:\Windows\System\QXoMjVw.exe
  C:\Windows\System\QXoMjVw.exe
  2⤵
  PID:1404
- C:\Windows\System\NwoscOv.exe
  C:\Windows\System\NwoscOv.exe
  2⤵
  PID:3504
- C:\Windows\System\ahRHIUY.exe
  C:\Windows\System\ahRHIUY.exe
  2⤵
  PID:8856
- C:\Windows\System\diyLugB.exe
  C:\Windows\System\diyLugB.exe
  2⤵
  PID:8836
- C:\Windows\System\FjKKxBt.exe
  C:\Windows\System\FjKKxBt.exe
  2⤵
  PID:1400
- C:\Windows\System\xFRechB.exe
  C:\Windows\System\xFRechB.exe
  2⤵
  PID:5292
- C:\Windows\System\iZrnRlJ.exe
  C:\Windows\System\iZrnRlJ.exe
  2⤵
  PID:6708
- C:\Windows\System\xRdmbfz.exe
  C:\Windows\System\xRdmbfz.exe
  2⤵
  PID:6520
- C:\Windows\System\RjpuDhw.exe
  C:\Windows\System\RjpuDhw.exe
  2⤵
  PID:9372
- C:\Windows\System\oUDwYjd.exe
  C:\Windows\System\oUDwYjd.exe
  2⤵
  PID:5332
- C:\Windows\System\YdLKbxB.exe
  C:\Windows\System\YdLKbxB.exe
  2⤵
  PID:1672
- C:\Windows\System\uUQtxDF.exe
  C:\Windows\System\uUQtxDF.exe
  2⤵
  PID:5360
- C:\Windows\System\aEJSgcv.exe
  C:\Windows\System\aEJSgcv.exe
  2⤵
  PID:5112
- C:\Windows\System\cPaDbSc.exe
  C:\Windows\System\cPaDbSc.exe
  2⤵
  PID:6232
- C:\Windows\System\viutxpZ.exe
  C:\Windows\System\viutxpZ.exe
  2⤵
  PID:9688
- C:\Windows\System\rCkYWEs.exe
  C:\Windows\System\rCkYWEs.exe
  2⤵
  PID:1332
- C:\Windows\System\riXnvQx.exe
  C:\Windows\System\riXnvQx.exe
  2⤵
  PID:2876
- C:\Windows\System\NdDTgZn.exe
  C:\Windows\System\NdDTgZn.exe
  2⤵
  PID:7460
- C:\Windows\System\DNZcjXL.exe
  C:\Windows\System\DNZcjXL.exe
  2⤵
  PID:5500
- C:\Windows\System\ohOffIy.exe
  C:\Windows\System\ohOffIy.exe
  2⤵
  PID:5504
- C:\Windows\System\DhcqbVN.exe
  C:\Windows\System\DhcqbVN.exe
  2⤵
  PID:5556
- C:\Windows\System\hXTVKVw.exe
  C:\Windows\System\hXTVKVw.exe
  2⤵
  PID:3220
- C:\Windows\System\ItucxTm.exe
  C:\Windows\System\ItucxTm.exe
  2⤵
  PID:10040
- C:\Windows\System\rxxQBXS.exe
  C:\Windows\System\rxxQBXS.exe
  2⤵
  PID:4588
- C:\Windows\System\QsGpckL.exe
  C:\Windows\System\QsGpckL.exe
  2⤵
  PID:10188
- C:\Windows\System\ZMHpFCg.exe
  C:\Windows\System\ZMHpFCg.exe
  2⤵
  PID:8804
- C:\Windows\System\TzRMmlN.exe
  C:\Windows\System\TzRMmlN.exe
  2⤵
  PID:6732
- C:\Windows\System\JhNmyQY.exe
  C:\Windows\System\JhNmyQY.exe
  2⤵
  PID:7584
- C:\Windows\System\zgVPHvP.exe
  C:\Windows\System\zgVPHvP.exe
  2⤵
  PID:9652
- C:\Windows\System\WITJIix.exe
  C:\Windows\System\WITJIix.exe
  2⤵
  PID:3544
- C:\Windows\System\rQXlhEY.exe
  C:\Windows\System\rQXlhEY.exe
  2⤵
  PID:6328
- C:\Windows\System\mWjjPcj.exe
  C:\Windows\System\mWjjPcj.exe
  2⤵
  PID:3800
- C:\Windows\System\KQfTvHX.exe
  C:\Windows\System\KQfTvHX.exe
  2⤵
  PID:7120
- C:\Windows\System\aQMsLKX.exe
  C:\Windows\System\aQMsLKX.exe
  2⤵
  PID:8596
- C:\Windows\System\nANLAxs.exe
  C:\Windows\System\nANLAxs.exe
  2⤵
  PID:8500
- C:\Windows\System\RMBLIae.exe
  C:\Windows\System\RMBLIae.exe
  2⤵
  PID:8216
- C:\Windows\System\BNIfnIz.exe
  C:\Windows\System\BNIfnIz.exe
  2⤵
  PID:1688
- C:\Windows\System\lISCERN.exe
  C:\Windows\System\lISCERN.exe
  2⤵
  PID:10520
- C:\Windows\System\FDCBbSS.exe
  C:\Windows\System\FDCBbSS.exe
  2⤵
  PID:10576
- C:\Windows\System\jOsKUCZ.exe
  C:\Windows\System\jOsKUCZ.exe
  2⤵
  PID:8152
- C:\Windows\System\JSciJMT.exe
  C:\Windows\System\JSciJMT.exe
  2⤵
  PID:7324
- C:\Windows\System\UWIUtWn.exe
  C:\Windows\System\UWIUtWn.exe
  2⤵
  PID:4140
- C:\Windows\System\MOZdbbK.exe
  C:\Windows\System\MOZdbbK.exe
  2⤵
  PID:10780
- C:\Windows\System\TDosnnE.exe
  C:\Windows\System\TDosnnE.exe
  2⤵
  PID:9548
- C:\Windows\System\eEIkKSY.exe
  C:\Windows\System\eEIkKSY.exe
  2⤵
  PID:10908
- C:\Windows\System\OsmfXap.exe
  C:\Windows\System\OsmfXap.exe
  2⤵
  PID:1700
- C:\Windows\System\qfiBbLt.exe
  C:\Windows\System\qfiBbLt.exe
  2⤵
  PID:6920
- C:\Windows\System\PfoJjhh.exe
  C:\Windows\System\PfoJjhh.exe
  2⤵
  PID:11056
- C:\Windows\System\aDZJbdF.exe
  C:\Windows\System\aDZJbdF.exe
  2⤵
  PID:5132
- C:\Windows\System\CMfBFMc.exe
  C:\Windows\System\CMfBFMc.exe
  2⤵
  PID:9864
- C:\Windows\System\HQrqsdn.exe
  C:\Windows\System\HQrqsdn.exe
  2⤵
  PID:8668
- C:\Windows\System\WUFheNw.exe
  C:\Windows\System\WUFheNw.exe
  2⤵
  PID:8876
- C:\Windows\System\aqWXTdB.exe
  C:\Windows\System\aqWXTdB.exe
  2⤵
  PID:10076
- C:\Windows\System\EunDuus.exe
  C:\Windows\System\EunDuus.exe
  2⤵
  PID:10100
- C:\Windows\System\pqLWsCU.exe
  C:\Windows\System\pqLWsCU.exe
  2⤵
  PID:8776
- C:\Windows\System\wKVmfHr.exe
  C:\Windows\System\wKVmfHr.exe
  2⤵
  PID:5248
- C:\Windows\System\rQcSFfC.exe
  C:\Windows\System\rQcSFfC.exe
  2⤵
  PID:8752
- C:\Windows\System\vzDDiCP.exe
  C:\Windows\System\vzDDiCP.exe
  2⤵
  PID:10836
- C:\Windows\System\pRkRnRY.exe
  C:\Windows\System\pRkRnRY.exe
  2⤵
  PID:3964
- C:\Windows\System\nKOAEpi.exe
  C:\Windows\System\nKOAEpi.exe
  2⤵
  PID:3704
- C:\Windows\System\jxGcwVe.exe
  C:\Windows\System\jxGcwVe.exe
  2⤵
  PID:9356
- C:\Windows\System\sMXbdsg.exe
  C:\Windows\System\sMXbdsg.exe
  2⤵
  PID:6340
- C:\Windows\System\ACmUQGZ.exe
  C:\Windows\System\ACmUQGZ.exe
  2⤵
  PID:10372
- C:\Windows\System\atGcPEU.exe
  C:\Windows\System\atGcPEU.exe
  2⤵
  PID:10636
- C:\Windows\System\oYrAYZe.exe
  C:\Windows\System\oYrAYZe.exe
  2⤵
  PID:10864
- C:\Windows\System\wyKJYfw.exe
  C:\Windows\System\wyKJYfw.exe
  2⤵
  PID:9092
- C:\Windows\System\HbjEpFA.exe
  C:\Windows\System\HbjEpFA.exe
  2⤵
  PID:10704
- C:\Windows\System\LxLUNVi.exe
  C:\Windows\System\LxLUNVi.exe
  2⤵
  PID:10344
- C:\Windows\System\abOOkMY.exe
  C:\Windows\System\abOOkMY.exe
  2⤵
  PID:7564
- C:\Windows\System\DjkPuId.exe
  C:\Windows\System\DjkPuId.exe
  2⤵
  PID:2504
- C:\Windows\System\FLvEjfp.exe
  C:\Windows\System\FLvEjfp.exe
  2⤵
  PID:5416
- C:\Windows\System\IcQwpkG.exe
  C:\Windows\System\IcQwpkG.exe
  2⤵
  PID:7228
- C:\Windows\System\mzgycTt.exe
  C:\Windows\System\mzgycTt.exe
  2⤵
  PID:5412
- C:\Windows\System\rJGXjNl.exe
  C:\Windows\System\rJGXjNl.exe
  2⤵
  PID:6704
- C:\Windows\System\BAylCZg.exe
  C:\Windows\System\BAylCZg.exe
  2⤵
  PID:11596
- C:\Windows\System\TrodeZG.exe
  C:\Windows\System\TrodeZG.exe
  2⤵
  PID:4964
- C:\Windows\System\VyKGaeJ.exe
  C:\Windows\System\VyKGaeJ.exe
  2⤵
  PID:5108
- C:\Windows\System\lLCTAml.exe
  C:\Windows\System\lLCTAml.exe
  2⤵
  PID:9736
- C:\Windows\System\LomAMGr.exe
  C:\Windows\System\LomAMGr.exe
  2⤵
  PID:11720
- C:\Windows\System\otSzKLn.exe
  C:\Windows\System\otSzKLn.exe
  2⤵
  PID:8688
- C:\Windows\System\mCmfhPy.exe
  C:\Windows\System\mCmfhPy.exe
  2⤵
  PID:10212
- C:\Windows\System\oVqAWdY.exe
  C:\Windows\System\oVqAWdY.exe
  2⤵
  PID:5944
- C:\Windows\System\EYpPVxc.exe
  C:\Windows\System\EYpPVxc.exe
  2⤵
  PID:992
- C:\Windows\System\YmsPCea.exe
  C:\Windows\System\YmsPCea.exe
  2⤵
  PID:9812
- C:\Windows\System\chWztXp.exe
  C:\Windows\System\chWztXp.exe
  2⤵
  PID:5868
- C:\Windows\System\sneFBOy.exe
  C:\Windows\System\sneFBOy.exe
  2⤵
  PID:10128
- C:\Windows\System\oHRSbjI.exe
  C:\Windows\System\oHRSbjI.exe
  2⤵
  PID:6040
- C:\Windows\System\JFVTJJR.exe
  C:\Windows\System\JFVTJJR.exe
  2⤵
  PID:10260
- C:\Windows\System\eOpQIjh.exe
  C:\Windows\System\eOpQIjh.exe
  2⤵
  PID:6132
- C:\Windows\System\iPHTsbv.exe
  C:\Windows\System\iPHTsbv.exe
  2⤵
  PID:9032
- C:\Windows\System\xUPKlwZ.exe
  C:\Windows\System\xUPKlwZ.exe
  2⤵
  PID:10384
- C:\Windows\System\KWCRNRB.exe
  C:\Windows\System\KWCRNRB.exe
  2⤵
  PID:8096
- C:\Windows\System\ZPXnWkI.exe
  C:\Windows\System\ZPXnWkI.exe
  2⤵
  PID:4000
- C:\Windows\System\jlpPIwM.exe
  C:\Windows\System\jlpPIwM.exe
  2⤵
  PID:4092
- C:\Windows\System\BzXiNHV.exe
  C:\Windows\System\BzXiNHV.exe
  2⤵
  PID:2736
- C:\Windows\System\kzYtmEw.exe
  C:\Windows\System\kzYtmEw.exe
  2⤵
  PID:5088
- C:\Windows\System\hcPhuHx.exe
  C:\Windows\System\hcPhuHx.exe
  2⤵
  PID:9644
- C:\Windows\System\vImiNDO.exe
  C:\Windows\System\vImiNDO.exe
  2⤵
  PID:5224
- C:\Windows\System\yCdivyA.exe
  C:\Windows\System\yCdivyA.exe
  2⤵
  PID:7724
- C:\Windows\System\OjxDWQg.exe
  C:\Windows\System\OjxDWQg.exe
  2⤵
  PID:5364
- C:\Windows\System\kdrKKhC.exe
  C:\Windows\System\kdrKKhC.exe
  2⤵
  PID:1956
- C:\Windows\System\rFzwNPc.exe
  C:\Windows\System\rFzwNPc.exe
  2⤵
  PID:11048
- C:\Windows\System\ZrKSLgY.exe
  C:\Windows\System\ZrKSLgY.exe
  2⤵
  PID:5128
- C:\Windows\System\LVcqQOq.exe
  C:\Windows\System\LVcqQOq.exe
  2⤵
  PID:12164
- C:\Windows\System\NDcqGQp.exe
  C:\Windows\System\NDcqGQp.exe
  2⤵
  PID:9880
- C:\Windows\System\dXWSfyL.exe
  C:\Windows\System\dXWSfyL.exe
  2⤵
  PID:9948
- C:\Windows\System\lHIDviu.exe
  C:\Windows\System\lHIDviu.exe
  2⤵
  PID:10452
- C:\Windows\System\BQEEOtb.exe
  C:\Windows\System\BQEEOtb.exe
  2⤵
  PID:4340
- C:\Windows\System\hXewxTw.exe
  C:\Windows\System\hXewxTw.exe
  2⤵
  PID:11496
- C:\Windows\System\SllGQcw.exe
  C:\Windows\System\SllGQcw.exe
  2⤵
  PID:5192
- C:\Windows\System\VVJnlFz.exe
  C:\Windows\System\VVJnlFz.exe
  2⤵
  PID:11756
- C:\Windows\System\oIqrbiK.exe
  C:\Windows\System\oIqrbiK.exe
  2⤵
  PID:11196
- C:\Windows\System\KytfGEY.exe
  C:\Windows\System\KytfGEY.exe
  2⤵
  PID:5396
- C:\Windows\System\JHXCprr.exe
  C:\Windows\System\JHXCprr.exe
  2⤵
  PID:7360
- C:\Windows\System\qyBzirX.exe
  C:\Windows\System\qyBzirX.exe
  2⤵
  PID:9100
- C:\Windows\System\FZCwVdJ.exe
  C:\Windows\System\FZCwVdJ.exe
  2⤵
  PID:8488
- C:\Windows\System\VqnSNxy.exe
  C:\Windows\System\VqnSNxy.exe
  2⤵
  PID:556
- C:\Windows\System\BSkFbIu.exe
  C:\Windows\System\BSkFbIu.exe
  2⤵
  PID:5572
- C:\Windows\System\xOjpgdU.exe
  C:\Windows\System\xOjpgdU.exe
  2⤵
  PID:9672
- C:\Windows\System\XFMIuhV.exe
  C:\Windows\System\XFMIuhV.exe
  2⤵
  PID:11592
- C:\Windows\System\ogjQVtd.exe
  C:\Windows\System\ogjQVtd.exe
  2⤵
  PID:5472
- C:\Windows\System\uSubJgK.exe
  C:\Windows\System\uSubJgK.exe
  2⤵
  PID:7308
- C:\Windows\System\mzWLSOJ.exe
  C:\Windows\System\mzWLSOJ.exe
  2⤵
  PID:4840
- C:\Windows\System\oVIvZBZ.exe
  C:\Windows\System\oVIvZBZ.exe
  2⤵
  PID:11464
- C:\Windows\System\ifJIZVq.exe
  C:\Windows\System\ifJIZVq.exe
  2⤵
  PID:5812
- C:\Windows\System\tXmxdYw.exe
  C:\Windows\System\tXmxdYw.exe
  2⤵
  PID:1108
- C:\Windows\System\RNqgkKG.exe
  C:\Windows\System\RNqgkKG.exe
  2⤵
  PID:4936
- C:\Windows\System\bDPueDO.exe
  C:\Windows\System\bDPueDO.exe
  2⤵
  PID:5728
- C:\Windows\System\EDZvGBL.exe
  C:\Windows\System\EDZvGBL.exe
  2⤵
  PID:4436
- C:\Windows\System\pJhbwmF.exe
  C:\Windows\System\pJhbwmF.exe
  2⤵
  PID:1216
- C:\Windows\System\kEtNKrH.exe
  C:\Windows\System\kEtNKrH.exe
  2⤵
  PID:1376
- C:\Windows\System\KxGgzQU.exe
  C:\Windows\System\KxGgzQU.exe
  2⤵
  PID:5968
- C:\Windows\System\YUXQvOz.exe
  C:\Windows\System\YUXQvOz.exe
  2⤵
  PID:10020
- C:\Windows\System\vjXXGvH.exe
  C:\Windows\System\vjXXGvH.exe
  2⤵
  PID:11816
- C:\Windows\System\JeYaNBB.exe
  C:\Windows\System\JeYaNBB.exe
  2⤵
  PID:2396
- C:\Windows\System\JJOloVe.exe
  C:\Windows\System\JJOloVe.exe
  2⤵
  PID:5204
- C:\Windows\System\KOESdFs.exe
  C:\Windows\System\KOESdFs.exe
  2⤵
  PID:1328
- C:\Windows\System\XrQscaJ.exe
  C:\Windows\System\XrQscaJ.exe
  2⤵
  PID:5256
- C:\Windows\System\BSUgqbd.exe
  C:\Windows\System\BSUgqbd.exe
  2⤵
  PID:3172
- C:\Windows\System\lSFWemT.exe
  C:\Windows\System\lSFWemT.exe
  2⤵
  PID:5252
- C:\Windows\System\irVruDX.exe
  C:\Windows\System\irVruDX.exe
  2⤵
  PID:12772
- C:\Windows\System\FGVSVmh.exe
  C:\Windows\System\FGVSVmh.exe
  2⤵
  PID:7880
- C:\Windows\System\hKAoqSh.exe
  C:\Windows\System\hKAoqSh.exe
  2⤵
  PID:5260
- C:\Windows\System\cLVpHil.exe
  C:\Windows\System\cLVpHil.exe
  2⤵
  PID:3972
- C:\Windows\System\LcgurSR.exe
  C:\Windows\System\LcgurSR.exe
  2⤵
  PID:7752
- C:\Windows\System\BeLCQLB.exe
  C:\Windows\System\BeLCQLB.exe
  2⤵
  PID:796
- C:\Windows\System\ImpuRko.exe
  C:\Windows\System\ImpuRko.exe
  2⤵
  PID:12044
- C:\Windows\System\ODshFvr.exe
  C:\Windows\System\ODshFvr.exe
  2⤵
  PID:12952
- C:\Windows\System\qBKFjJe.exe
  C:\Windows\System\qBKFjJe.exe
  2⤵
  PID:4404
- C:\Windows\System\qmtVAxn.exe
  C:\Windows\System\qmtVAxn.exe
  2⤵
  PID:8576
- C:\Windows\System\RqOidlS.exe
  C:\Windows\System\RqOidlS.exe
  2⤵
  PID:12268
- C:\Windows\System\eTeXuLW.exe
  C:\Windows\System\eTeXuLW.exe
  2⤵
  PID:13048
- C:\Windows\System\SSDzxny.exe
  C:\Windows\System\SSDzxny.exe
  2⤵
  PID:5272
- C:\Windows\System\sGtOyxv.exe
  C:\Windows\System\sGtOyxv.exe
  2⤵
  PID:11692
- C:\Windows\System\iogsEPX.exe
  C:\Windows\System\iogsEPX.exe
  2⤵
  PID:5892
- C:\Windows\System\vTFaPBO.exe
  C:\Windows\System\vTFaPBO.exe
  2⤵
  PID:11904
- C:\Windows\System\UTQbUMe.exe
  C:\Windows\System\UTQbUMe.exe
  2⤵
  PID:7412
- C:\Windows\System\zeEdtqh.exe
  C:\Windows\System\zeEdtqh.exe
  2⤵
  PID:13232
- C:\Windows\System\tuiZkQC.exe
  C:\Windows\System\tuiZkQC.exe
  2⤵
  PID:3040
- C:\Windows\System\cKmGmiL.exe
  C:\Windows\System\cKmGmiL.exe
  2⤵
  PID:3064
- C:\Windows\System\KKQaPXo.exe
  C:\Windows\System\KKQaPXo.exe
  2⤵
  PID:2972
- C:\Windows\System\YNfJqxt.exe
  C:\Windows\System\YNfJqxt.exe
  2⤵
  PID:6196
- C:\Windows\System\ImxJzUi.exe
  C:\Windows\System\ImxJzUi.exe
  2⤵
  PID:4624
- C:\Windows\System\EYABAse.exe
  C:\Windows\System\EYABAse.exe
  2⤵
  PID:11332
- C:\Windows\System\srLDgYC.exe
  C:\Windows\System\srLDgYC.exe
  2⤵
  PID:12104
- C:\Windows\System\tkZWfbZ.exe
  C:\Windows\System\tkZWfbZ.exe
  2⤵
  PID:6300
- C:\Windows\System\xbAOClK.exe
  C:\Windows\System\xbAOClK.exe
  2⤵
  PID:1452
- C:\Windows\System\CaxNpHC.exe
  C:\Windows\System\CaxNpHC.exe
  2⤵
  PID:6332
- C:\Windows\System\AYQWNYV.exe
  C:\Windows\System\AYQWNYV.exe
  2⤵
  PID:3140
- C:\Windows\System\IdTNwlH.exe
  C:\Windows\System\IdTNwlH.exe
  2⤵
  PID:2408
- C:\Windows\System\pazaIRo.exe
  C:\Windows\System\pazaIRo.exe
  2⤵
  PID:5964
- C:\Windows\System\PyTCgdW.exe
  C:\Windows\System\PyTCgdW.exe
  2⤵
  PID:12404
- C:\Windows\System\CniGHzk.exe
  C:\Windows\System\CniGHzk.exe
  2⤵
  PID:5704
- C:\Windows\System\pJVdvaY.exe
  C:\Windows\System\pJVdvaY.exe
  2⤵
  PID:8188
- C:\Windows\System\BrunXmx.exe
  C:\Windows\System\BrunXmx.exe
  2⤵
  PID:6048
- C:\Windows\System\jHBZQXk.exe
  C:\Windows\System\jHBZQXk.exe
  2⤵
  PID:5140
- C:\Windows\System\pDWMPbe.exe
  C:\Windows\System\pDWMPbe.exe
  2⤵
  PID:11972
- C:\Windows\System\eGNVbFq.exe
  C:\Windows\System\eGNVbFq.exe
  2⤵
  PID:7980
- C:\Windows\System\wPzwMnK.exe
  C:\Windows\System\wPzwMnK.exe
  2⤵
  PID:12892
- C:\Windows\System\hPpwjji.exe
  C:\Windows\System\hPpwjji.exe
  2⤵
  PID:10604
- C:\Windows\System\eGGrroK.exe
  C:\Windows\System\eGGrroK.exe
  2⤵
  PID:4720
- C:\Windows\System\cUlDNTm.exe
  C:\Windows\System\cUlDNTm.exe
  2⤵
  PID:5284
- C:\Windows\System\TfNFbGA.exe
  C:\Windows\System\TfNFbGA.exe
  2⤵
  PID:12880
- C:\Windows\System\mOLJZrV.exe
  C:\Windows\System\mOLJZrV.exe
  2⤵
  PID:564
- C:\Windows\System\AKSXTzX.exe
  C:\Windows\System\AKSXTzX.exe
  2⤵
  PID:6636
- C:\Windows\System\beLVbsF.exe
  C:\Windows\System\beLVbsF.exe
  2⤵
  PID:12924
- C:\Windows\System\vsLFzPY.exe
  C:\Windows\System\vsLFzPY.exe
  2⤵
  PID:6808
- C:\Windows\System\CdUxMIE.exe
  C:\Windows\System\CdUxMIE.exe
  2⤵
  PID:6852
- C:\Windows\System\idTFxMm.exe
  C:\Windows\System\idTFxMm.exe
  2⤵
  PID:9860
- C:\Windows\System\ZlojvJu.exe
  C:\Windows\System\ZlojvJu.exe
  2⤵
  PID:8888
- C:\Windows\System\IBLuKNz.exe
  C:\Windows\System\IBLuKNz.exe
  2⤵
  PID:1564
- C:\Windows\System\TwJzDbP.exe
  C:\Windows\System\TwJzDbP.exe
  2⤵
  PID:11852
- C:\Windows\System\XFMeBmZ.exe
  C:\Windows\System\XFMeBmZ.exe
  2⤵
  PID:11568
- C:\Windows\System\TsrsiQO.exe
  C:\Windows\System\TsrsiQO.exe
  2⤵
  PID:3476
- C:\Windows\System\nDTuJSc.exe
  C:\Windows\System\nDTuJSc.exe
  2⤵
  PID:6176
- C:\Windows\System\rSwIsye.exe
  C:\Windows\System\rSwIsye.exe
  2⤵
  PID:6184
- C:\Windows\System\nGXntmq.exe
  C:\Windows\System\nGXntmq.exe
  2⤵
  PID:3732
- C:\Windows\System\zljeqLr.exe
  C:\Windows\System\zljeqLr.exe
  2⤵
  PID:11640
- C:\Windows\System\mxXaadZ.exe
  C:\Windows\System\mxXaadZ.exe
  2⤵
  PID:2956
- C:\Windows\System\lKxWkWp.exe
  C:\Windows\System\lKxWkWp.exe
  2⤵
  PID:11436
- C:\Windows\System\hgLVMTp.exe
  C:\Windows\System\hgLVMTp.exe
  2⤵
  PID:6540
- C:\Windows\System\ACnyJGu.exe
  C:\Windows\System\ACnyJGu.exe
  2⤵
  PID:5948
- C:\Windows\System\wzXmgtM.exe
  C:\Windows\System\wzXmgtM.exe
  2⤵
  PID:10400
- C:\Windows\System\YKFkqtY.exe
  C:\Windows\System\YKFkqtY.exe
  2⤵
  PID:4888
- C:\Windows\System\HOWeyTd.exe
  C:\Windows\System\HOWeyTd.exe
  2⤵
  PID:5864
- C:\Windows\System\fPNpoeT.exe
  C:\Windows\System\fPNpoeT.exe
  2⤵
  PID:7124
- C:\Windows\System\nFkDscT.exe
  C:\Windows\System\nFkDscT.exe
  2⤵
  PID:7136
- C:\Windows\System\XbvXMiF.exe
  C:\Windows\System\XbvXMiF.exe
  2⤵
  PID:1476
- C:\Windows\System\IkbFfqK.exe
  C:\Windows\System\IkbFfqK.exe
  2⤵
  PID:4372
- C:\Windows\System\CzLagcq.exe
  C:\Windows\System\CzLagcq.exe
  2⤵
  PID:6736
- C:\Windows\System\wqRhmkx.exe
  C:\Windows\System\wqRhmkx.exe
  2⤵
  PID:5972
- C:\Windows\System\shOcPOQ.exe
  C:\Windows\System\shOcPOQ.exe
  2⤵
  PID:7116
- C:\Windows\System\NuMBkVS.exe
  C:\Windows\System\NuMBkVS.exe
  2⤵
  PID:1824
- C:\Windows\System\wngcFgC.exe
  C:\Windows\System\wngcFgC.exe
  2⤵
  PID:12528
- C:\Windows\System\YZNbFCN.exe
  C:\Windows\System\YZNbFCN.exe
  2⤵
  PID:6956
- C:\Windows\System\qYLyYWN.exe
  C:\Windows\System\qYLyYWN.exe
  2⤵
  PID:6740
- C:\Windows\System\ypqNvog.exe
  C:\Windows\System\ypqNvog.exe
  2⤵
  PID:5768
- C:\Windows\System\vKRGrHC.exe
  C:\Windows\System\vKRGrHC.exe
  2⤵
  PID:6872
- C:\Windows\System\uaahVPA.exe
  C:\Windows\System\uaahVPA.exe
  2⤵
  PID:5428
- C:\Windows\System\ZVOMgfX.exe
  C:\Windows\System\ZVOMgfX.exe
  2⤵
  PID:3748
- C:\Windows\System\xQLymat.exe
  C:\Windows\System\xQLymat.exe
  2⤵
  PID:13268
- C:\Windows\System\PVuLTFg.exe
  C:\Windows\System\PVuLTFg.exe
  2⤵
  PID:5336
- C:\Windows\System\GeCSawT.exe
  C:\Windows\System\GeCSawT.exe
  2⤵
  PID:6276
- C:\Windows\System\QobvEcR.exe
  C:\Windows\System\QobvEcR.exe
  2⤵
  PID:7700
- C:\Windows\System\iYcXpIS.exe
  C:\Windows\System\iYcXpIS.exe
  2⤵
  PID:8212
- C:\Windows\System\LLqbmTY.exe
  C:\Windows\System\LLqbmTY.exe
  2⤵
  PID:4008
- C:\Windows\System\txBvczS.exe
  C:\Windows\System\txBvczS.exe
  2⤵
  PID:5560
- C:\Windows\System\bVkNRMM.exe
  C:\Windows\System\bVkNRMM.exe
  2⤵
  PID:7800
- C:\Windows\System\mVaRKZl.exe
  C:\Windows\System\mVaRKZl.exe
  2⤵
  PID:5932
- C:\Windows\System\DKCzWnl.exe
  C:\Windows\System\DKCzWnl.exe
  2⤵
  PID:12456
- C:\Windows\System\bJNikpN.exe
  C:\Windows\System\bJNikpN.exe
  2⤵
  PID:5748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xghei30e.mwu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DgLynpS.exe

Filesize
1.9MB

MD5
0d4fe5c03a1b5959a4b50211485d6c3e

SHA1
4fa965fbe9edef5edceeabadf7a47b4fc5871537

SHA256
a26406df4c5ef9541ef72a4dfaa6ebc8f3e77dec4fff675873ac0b333943a026

SHA512
090e17d9b6edd311e6ad58b29fbf42c74fc1ee1cfa7e313f57059ff8e88879b0fbac06f33164b105d486f543008b4d4f982a61009398fa4129bf3e39533c4382

Download Submit
C:\Windows\System\EGFOhWn.exe

Filesize
1.9MB

MD5
29ef8e104520f3bc57035350d0aec464

SHA1
dafe06b762f35abc500863afb2f2175c45b6f756

SHA256
677bc8f4698ab3893b95c0d55e01f968eb4383f064680b18081837d0c59e7f05

SHA512
4a505fce4951d5d5a9ae69a2b0e2394f19e0e8593a94a02d1f17a16769c5add3503b4079991d9cb8ffa79dad45cbc7f75fd7e8b02ce9b73f507d76ef3eb00925

Download Submit
C:\Windows\System\ExbvbDx.exe

Filesize
1.9MB

MD5
09b74167fb1d244e53bd48dd496076df

SHA1
369c57d467dc8509bcef7c9cd637de7cd1b64259

SHA256
05cb699b90858b76c721cfa104389a45e23ec8e2fdf5f2c9282505a3e7a0ad39

SHA512
718918a4ee4101c7a5f07b0d1260e8ea257a30c7e4ca0dd9ea9f0e82b69ce18b08103442a866caa107474bb219a55fcc0cabe74ab7bfa2a38f42be1b86fe9ba6

Download Submit
C:\Windows\System\GBPeMGM.exe

Filesize
1.9MB

MD5
3609b303bf4bf9f611ca618961d2e1cb

SHA1
c6a53eb64d53e3a0d580557f58a956edda0faabb

SHA256
fd5f3c6d0f3f49735f11987eeea9c36825813518ee5de0be666dacc0939bf50d

SHA512
186368bcd21d984c056a09c6461762d03ec2b81c794bde4fa1d0b29019b9e92a9331361e911a32e6e3ceac0bb2c68714a5623cff0c870e217ecb5878cb75fb10

Download Submit
C:\Windows\System\GRzVjap.exe

Filesize
1.9MB

MD5
4322d853cc21610dcca296916138ddc0

SHA1
532e60abf8ce1f46b6857e7ded7ab0139e11758c

SHA256
5e092fe63fc05c7077b852e9afd979aa75061f4a50fe11452bbbbee097ba5c0b

SHA512
590bdeeddaf63b37a16a52506a425d54cba9c649f5c93730c27feaaa9692c5b60256c2466244a1426367a8ae62cef079c388f6bbb713171ba6cbb467fe121f14

Download Submit
C:\Windows\System\GSZLaOW.exe

Filesize
1.9MB

MD5
66403f3a402cc0361f5e806783729e5f

SHA1
7c3fee419eeed836fc08e66cd774fe10c864f07d

SHA256
b5b6a395e68591f501f381523d6213d88ab201bc7dcb83bf71948419d6030f88

SHA512
31b242b961bd016aae95e83a515b9f4d6eefcb5022a1d2bceb6003d78058a354eb241d3b866e4a1b52f11ca77bef6e22f60d1ad0cc268eac7d325759f71b9b08

Download Submit
C:\Windows\System\KQvsOaL.exe

Filesize
1.9MB

MD5
467d6d796120ee57612d9cef6de6ee97

SHA1
108c5c2ef1642ade9f6fabff6f50ad43ffe43222

SHA256
7cd59d2c6fddc621075ee3f43127587c9915d6950559e98975777b394b3544c8

SHA512
0820cfcadc1fd93d5075c592d995e84d2d94130eae70f5956a86f9729c8d94a6a4fab5a76637f9bef7c144ce4770a20d3e5c63db0501d6e6ff8f3903323be69d

Download Submit
C:\Windows\System\KuEoQWg.exe

Filesize
1.9MB

MD5
2f69c147c5dc757c10aba8c8735b437e

SHA1
dfb2227cfb7e382bb529ca30b5e319dc4580bce6

SHA256
19c09f9cddebfbed4d36ff0617793e7b8cfcdeffd718d7ec506975f651d85ab8

SHA512
1e3f3e9404d85e5614bf4cafdd379f99d688f94416d299bce0e447e84c0489e6c849a3116914c30278278780aca328e18851d4aa2b5ea698b2ff061329cfec83

Download Submit
C:\Windows\System\MApWcvq.exe

Filesize
1.9MB

MD5
b4ebe9a32f7c6d5006701050be10d285

SHA1
7ece3f3630e0444aea25f8cfb6a69e81518f41cd

SHA256
6e544dd461f30ed677c5cd0b4cd07f95bbe3a3c3a46ced77b3b6bcbcad36d1b2

SHA512
add5e9f5e034b83adb53c32e31b18231ec5985b67c7e31ddbf63f305ef59abe2c82423dc3b77b410b4e4c2aab7919096b7807222383b9c6d1f219ae986ab4d4e

Download Submit
C:\Windows\System\MFqYFEM.exe

Filesize
1.9MB

MD5
65ed9837d07cee18edad01238771b665

SHA1
6ad580eacc1a1c0b1493861e0a260da116e0058e

SHA256
f323e5cfb046673dd4148f82f44812731012bfafe929c6b193193380fd8a49e7

SHA512
9eeec8c1721dc54cf953d564ec705243af5e71df94d6dbd6ced80ecc4151f20d2becb16783c5eeec60cb6aef5720e4144747cb0a67c5161ac49db3aeef704d9d

Download Submit
C:\Windows\System\MzuETiP.exe

Filesize
1.9MB

MD5
5fb07196b0e5dd0f987437f8574d40f0

SHA1
846c6182fd99dad0445adbc3d616cc14c658b0ee

SHA256
7b7627cbcdadf6392a7e6e437423e54df463cef8d85e0a523629fdf5999726c1

SHA512
8df014a2df570cfc71a66201222ca77867ba9bae5044fd99d744465557d5f93e8fb34206725e54603a3953473233d64201e93419f22a36b55af8c837a1d69255

Download Submit
C:\Windows\System\QBtPWsA.exe

Filesize
1.9MB

MD5
6af80299d06f6c95f0970b3f0d62a0c2

SHA1
0655c25487f0f34a9322577f1dd5962f2ad30324

SHA256
1b43cac55374be9d599dcdfbdc7ae68e48cb6208ad7994afb49ecb9141a4c266

SHA512
0851e59971db27ffa8d86e46345e9904a952bdac51157e344239c8771426c29a6ef7a645c37198a02d289ecc1ade6a70f2cb2ed7c3a33afc0b1c1ea05c933400

Download Submit
C:\Windows\System\QjaTpnw.exe

Filesize
1.9MB

MD5
ed94bb6f9a48ffe7adadfaf5bd8827b4

SHA1
057af0b9422ba9fe413d60b45578281c0deb95e6

SHA256
ef98bf38ae9d85c66753ab77c00db2af99cde14a91f4dd6931fbce09b0b008ed

SHA512
6c99927013c039f9a41df98ef4e6fd46d6cbc7ec27b44f6919dbb772e65c56edc69416ea5dbaa3b917cf3622f9406d7442bbef8c694ec10c74a23127a989b087

Download Submit
C:\Windows\System\QwmPlQN.exe

Filesize
1.9MB

MD5
d0fcf39ad05c50d4da066d52a6fc571e

SHA1
c50777b9d9c4bb80cc3d650832957a03cded71ca

SHA256
12b3b467d8a4e645bc6e2baa382a9c450b7346666d42d2da0cc0634abe186916

SHA512
9ce7363a3788e2fa9cde9537978350bbfe2dc54541392b301b699d6db51ca5bf7bbf1e2ce0154bd5f516dca91159c3f92d114aae3eb4acbc35f444d3770aaf84

Download Submit
C:\Windows\System\SGuaAMp.exe

Filesize
1.9MB

MD5
e8fe6af9e3341dc2c3c6d16f88183b7c

SHA1
85ab60c98623bf34233d1f10e677bde935b443b7

SHA256
e93f36627d6fd01edd28a098fbaf64124027dd6f0130cd8267c3bcfba62fd277

SHA512
80bc10844bbd39484ac9f2dd3ab9b48b3cda96fd901f4608c4b799845556adf42baecab1e77801c6f13e443192a7744cbe35457765f811fcdff16d9fbecb8aa3

Download Submit
C:\Windows\System\UdLSEmq.exe

Filesize
1.9MB

MD5
7c039adc0910c469461481d7e09984b6

SHA1
7449eeaf4bebef34ce1756a4965863b425375028

SHA256
137770f1ef260367354d5c25d46ab234020687427df604853f6fb2f8519cba21

SHA512
71277bc58e1d63f3ec56f706a045c19dccda881314c7d35aa0651552faa22925218e27d5155622075e363ac0def61a350762bb9781ffbfd5092fa561037ef4f2

Download Submit
C:\Windows\System\VAXnVGh.exe

Filesize
1.9MB

MD5
38d118ed7a3a66583dceb73239a8df0b

SHA1
f9f3b7042d20fba46efef921882e79cd9d902a5d

SHA256
d83d0ab28b133ad573d25ef43cb3644e04ae39f66c37850f241becec374123db

SHA512
57a85639b052c166a89d3e9d3617306d385d097a1bd0c1cc023570adf3d5a5f67e2302fd817ee845c35b9c6b7e69816bbe45311e08fb518c574cffcb3a5b6777

Download Submit
C:\Windows\System\VsxkUYP.exe

Filesize
1.9MB

MD5
1ea8cdc4847fcc38ba37967af170a8b7

SHA1
19e907cfaadedc8fc570df49d0537df1b86ec69a

SHA256
2f96cea88c9808f6d15f32f549a2ee64865eef1f64951780ecd3c049b00b4191

SHA512
dab07058086534b9b6baa9056b68173d820fe84a4faa6c534510379976713170ca1f53f82aaeca485f6fd1a5e80d3ff211f27e5426d11ba6a61682841500200a

Download Submit
C:\Windows\System\VvrvDOc.exe

Filesize
1.9MB

MD5
efda389be30b5b782d5efefdd8e5d99e

SHA1
1db2456427ade21ebba1582af719e26b251e0c7f

SHA256
035ee47ca7d45adc2bdaddd49c93e0397e27399bd40d5fbe4bc944a8b0333e1f

SHA512
79d53d61b8040c7c4abf9a9eeea4d7c37d871759af97097abb34b19934f0a4950340074dfbd0efab3908314edf110f3f05d78e36a21a8ef21f1d3daf5d7d494d

Download Submit
C:\Windows\System\WJMEIgM.exe

Filesize
1.9MB

MD5
1f8bff59fa6325ee8fd568a391d16437

SHA1
5ab98b2ff816fcf3dfc2b636cc86dc4b557732cb

SHA256
0cee4b2596abc8619b2941af4a84a95125e84e7f5e0fc2e5d278d07c122a7ff4

SHA512
a34a51cfdb5cd751cca83cfddc06e384434b4609aba79f1a6bdfe2a4cb00ae4d70105c61d02857fd94523a924a703c26281073be0ef0e8d5b821c0d01ff39d38

Download Submit
C:\Windows\System\WkXhKot.exe

Filesize
1.9MB

MD5
26c3d0dc5e3d9357bc11aa028049c55e

SHA1
fb0407a45305c07f3ce5bc5747153dce67a0f56a

SHA256
fd1041399bfed9e94eedce89627cddd7039725fabcebc60e2cff248f1e5beac3

SHA512
77373ccd68561fd5583a7792439f8e85e2a15a237cca002948fd43866891ed02d44372f49a6c14df2ca5645f03dab1ae2935c8ba4ca2c8e1232d222c1623a4eb

Download Submit
C:\Windows\System\eMiYHVe.exe

Filesize
1.9MB

MD5
891b0dc82411cfd16dbb5dc1936a301f

SHA1
a3fd737dc92caf4f54e1410c8a3129a6ec0e6d15

SHA256
52d6393c9d8ee098da43d866bdb3f8e2a37c915018e3ec4dac0cbe00bbdabd2a

SHA512
8086d541890c7492d392a992801922827af8e5ac1ba92710837592122de8395c5877e7469215879c8e927cee73497306e5a595eef50c3bf402dc9d1b3e2defd6

Download Submit
C:\Windows\System\iZSphTh.exe

Filesize
1.9MB

MD5
530bd99677a6a381b9807b9363beb4ed

SHA1
54dd950fd41885a7cebaca49fbd23f54403c352b

SHA256
780f7bbd569206e1941199c112ee22d4bfcd2a6f5bbe33dbffaef925edf5b9b8

SHA512
22641cb6706e7ca24efe76a4b5376e502b67a93ba98e81c190f99be2b7ee61141bb292842fe70fa15d0ebcfed45d04f38bc74b4e0b8e58f5e28e01d8daf61262

Download Submit
C:\Windows\System\nHMmRKc.exe

Filesize
1.9MB

MD5
3ed105fd9df634a46da10137ab4d1ae8

SHA1
afa16f2b77b3bdff1acb1f07621aae3b1081d2eb

SHA256
c82b903f4763e0834209c4f167c03c1bb6c0314c9ee2c9c11d06013ed82ea5f1

SHA512
447b94199e3ab7e26d50e6727ac51fd4d91f3f78d208fa1863914afe14d958ebe1ef36ec3fb6d8c45bc9a4159b8f165fb3575e836920262478ee80a867e1a46d

Download Submit
C:\Windows\System\ovowdNN.exe

Filesize
1.9MB

MD5
916fc20039a1031503b47c67b27c620e

SHA1
6fb6af41d5411285cd17a5717969c766fbf8d156

SHA256
1c568e9bcc15fb5c5cdbc7c76de050955775f83f84a40ae46d146a4b54067db1

SHA512
7643bd86ff71aedc8d2637c986e24be1041bf0296781510a5afe6adb60f04c329063c68ce9bb9d96af61f78b724e5c4e03b04f23d7e3e31c93926afe5e23b5d8

Download Submit
C:\Windows\System\pcdXHtq.exe

Filesize
1.9MB

MD5
bd11f22b3606a95b0d9b0a496b7618f4

SHA1
941e3081b46456a179712e639d97d805ea9c9120

SHA256
fddd6ed94b772ebf1846f0d02520328286108b3eff6c8ee41825a8ab3c4139d0

SHA512
6c09ac2082c3788c784f16c0b6f966a765437c97e62e68676a704182d0ff86677396a6a0a8f2f4034bc99989bbe4bb96913cdd0b73f5e4d0626582bef96e0210

Download Submit
C:\Windows\System\qtBFjjF.exe

Filesize
1.9MB

MD5
1996ae54cb58159d2195e1dfa8861917

SHA1
b2be76ad7305a654ec8470772cb9bf1dbd115f37

SHA256
495b8a3cdfceaab20a23ae93743751c132cd7151c65d53190a6411c37dda6f6d

SHA512
4f2a823099a45d7f34afdbd48271ab32745304943fceb3f602d178136278f726a224c7083050d8e152f72c5f8a277a2135bc17b5a1fd73b91c497dd46ee47d67

Download Submit
C:\Windows\System\rreJQEh.exe

Filesize
1.9MB

MD5
f22f7d3903d72e7756f672954ec9ba39

SHA1
0532ffb19510533a9272e4da56e6130d07427b85

SHA256
3ec611b3c9bd36e873413546aa6292e5889bfa87f968703d2a45730f65a5e238

SHA512
c56d75994d81b6acf139d2f4859c678fb8196e8c4445e778b4e2d55a9a41cf88bfc17016349d479e0d1534a2d1b51ccb58a4e873bea64e593c2c8c3d4b5d7138

Download Submit
C:\Windows\System\uCaeqqk.exe

Filesize
8B

MD5
2540f5a22abd079d65577fea9954086e

SHA1
43ee36370cd812b4ab125afc29bf94eca1ca950b

SHA256
d6929e4d5762879288e36ce846b5a5f69c3228153530cd5018d142430e98f2bf

SHA512
04a896e60a68aad71e3c63a328e2f451d7d8044e718aafd713268fbb6b7d2e67988755f4f7b0c10f37a34057c0f46697390f244f6a14ef89bc042a9ddd6f2842

Download Submit
C:\Windows\System\uIAOPrJ.exe

Filesize
1.9MB

MD5
cb48f1f96ed1edf26ac7e4de86fa082d

SHA1
2bbe76a6d85366d3353a929363f42ff87f51ac24

SHA256
43a0a521302d1a12b9275446c0d3118bf1e7e7b9bbc62f596cd3d9ab6af382ea

SHA512
465e350f0659af90a506179a20ae141c02cbb7ffd4db05dca2e214408dc5dfd4f7243f7cd7ede4571eebe12426a99cb5eb5f58bfe91b93f152c4bcfb40dc38be

Download Submit
C:\Windows\System\wAbgOoF.exe

Filesize
1.9MB

MD5
6da8fe714fb5383e6fb82e8408d83b72

SHA1
f833466bdac976f158a40e0e0dba1cfec7e7ffbc

SHA256
1ecd6b2f78ca1dbc39d3e3f1405559bf292697262450b942a405b255a6c28c20

SHA512
8bfb69a823e5af3496c0d9ab578dfbf5fdf068f937aaecc069b55f18ebed27b1196c5d3b4d9a5857338b6f015939fdb44843cc814b0acfa595da82f69b142a68

Download Submit
C:\Windows\System\wxbLdAP.exe

Filesize
1.9MB

MD5
5661b069acde9429bdec1468a47ed4a5

SHA1
6118176a15d70dc0548f45289abe3f85a612f5a3

SHA256
53a17284520523f15113a21087d3c97dabd6c934f0195d686799995f35d85f74

SHA512
d96637b6bab5afcba94b614b07d251d57c341fc2d8b5261ceb3108945d5715a1a2726d26a8430fd86ea265645a4546bd576a664b038901620725157f63df243b

Download Submit
C:\Windows\System\ybkBdtH.exe

Filesize
1.9MB

MD5
efc888ec062d282efdaa67cabc2cb199

SHA1
7701c24b837c54cd3b7e27712e96819aefc17468

SHA256
c3c07fba1385fc809b1addad12aa6178b42bedc5606e402777ddbd69c654dabb

SHA512
f731d6f5bef7d166d811239e1648c50ecfafe3c8d80bfede5222a544c20b35e904b94611aac67a507c398007c1b18e9c805150defa29d3bc10254fcb4fb22363

Download Submit
C:\Windows\System\yyWoUCp.exe

Filesize
1.9MB

MD5
8e30484dc868fb0664adecea63c4cb1c

SHA1
c2272dec6423ae0d5510faa94863bf66b868a2ed

SHA256
8483415d545d341603f492fdcd47696dd935a04592ff0b552450dabcbba3ef56

SHA512
5487a0d01f1cce3ebb829cd4db7ec9cb36dc4795cc21c60fa6058796023eb672d5c0785fd9f5ab3d65302f9e577540533dff4d3e82fac8df995251ef0fd0b47f

Download Submit
memory/100-4218-0x00007FF7F35D0000-0x00007FF7F39C2000-memory.dmp

Filesize
3.9MB

Download
memory/100-67-0x00007FF7F35D0000-0x00007FF7F39C2000-memory.dmp

Filesize
3.9MB

Download
memory/548-4241-0x00007FF6A42D0000-0x00007FF6A46C2000-memory.dmp

Filesize
3.9MB

Download
memory/548-83-0x00007FF6A42D0000-0x00007FF6A46C2000-memory.dmp

Filesize
3.9MB

Download
memory/776-116-0x00007FF6C7E40000-0x00007FF6C8232000-memory.dmp

Filesize
3.9MB

Download
memory/776-4259-0x00007FF6C7E40000-0x00007FF6C8232000-memory.dmp

Filesize
3.9MB

Download
memory/776-3761-0x00007FF6C7E40000-0x00007FF6C8232000-memory.dmp

Filesize
3.9MB

Download
memory/1184-84-0x00007FF774220000-0x00007FF774612000-memory.dmp

Filesize
3.9MB

Download
memory/1184-4235-0x00007FF774220000-0x00007FF774612000-memory.dmp

Filesize
3.9MB

Download
memory/1460-381-0x00007FF7612C0000-0x00007FF7616B2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-4308-0x00007FF7612C0000-0x00007FF7616B2000-memory.dmp

Filesize
3.9MB

Download
memory/1612-111-0x00007FF7BD150000-0x00007FF7BD542000-memory.dmp

Filesize
3.9MB

Download
memory/1612-4258-0x00007FF7BD150000-0x00007FF7BD542000-memory.dmp

Filesize
3.9MB

Download
memory/1660-4196-0x00007FF72DA00000-0x00007FF72DDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-33-0x00007FF72DA00000-0x00007FF72DDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-378-0x00007FF784160000-0x00007FF784552000-memory.dmp

Filesize
3.9MB

Download
memory/1932-4279-0x00007FF784160000-0x00007FF784552000-memory.dmp

Filesize
3.9MB

Download
memory/1992-1040-0x00007FF76E990000-0x00007FF76ED82000-memory.dmp

Filesize
3.9MB

Download
memory/1992-14-0x00007FF76E990000-0x00007FF76ED82000-memory.dmp

Filesize
3.9MB

Download
memory/1992-4188-0x00007FF76E990000-0x00007FF76ED82000-memory.dmp

Filesize
3.9MB

Download
memory/2092-4248-0x00007FF6A8090000-0x00007FF6A8482000-memory.dmp

Filesize
3.9MB

Download
memory/2092-96-0x00007FF6A8090000-0x00007FF6A8482000-memory.dmp

Filesize
3.9MB

Download
memory/2092-2820-0x00007FF6A8090000-0x00007FF6A8482000-memory.dmp

Filesize
3.9MB

Download
memory/2196-39-0x00007FF675E10000-0x00007FF676202000-memory.dmp

Filesize
3.9MB

Download
memory/2196-4201-0x00007FF675E10000-0x00007FF676202000-memory.dmp

Filesize
3.9MB

Download
memory/2380-4510-0x00007FF7F1F70000-0x00007FF7F2362000-memory.dmp

Filesize
3.9MB

Download
memory/2380-106-0x00007FF7F1F70000-0x00007FF7F2362000-memory.dmp

Filesize
3.9MB

Download
memory/2584-4320-0x00007FF686920000-0x00007FF686D12000-memory.dmp

Filesize
3.9MB

Download
memory/2584-380-0x00007FF686920000-0x00007FF686D12000-memory.dmp

Filesize
3.9MB

Download
memory/2808-82-0x0000022492F90000-0x0000022492FB2000-memory.dmp

Filesize
136KB

Download
memory/2808-15-0x0000022492E20000-0x0000022492E30000-memory.dmp

Filesize
64KB

Download
memory/2808-1634-0x0000022492E20000-0x0000022492E30000-memory.dmp

Filesize
64KB

Download
memory/2808-16-0x0000022492E20000-0x0000022492E30000-memory.dmp

Filesize
64KB

Download
memory/2808-17-0x00007FF9CF463000-0x00007FF9CF465000-memory.dmp

Filesize
8KB

Download
memory/2808-374-0x00000224ABFE0000-0x00000224AC786000-memory.dmp

Filesize
7.6MB

Download
memory/2944-110-0x00007FF6DFC40000-0x00007FF6E0032000-memory.dmp

Filesize
3.9MB

Download
memory/2944-3194-0x00007FF6DFC40000-0x00007FF6E0032000-memory.dmp

Filesize
3.9MB

Download
memory/2944-4263-0x00007FF6DFC40000-0x00007FF6E0032000-memory.dmp

Filesize
3.9MB

Download
memory/3004-4233-0x00007FF7F64D0000-0x00007FF7F68C2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-91-0x00007FF7F64D0000-0x00007FF7F68C2000-memory.dmp

Filesize
3.9MB

Download
memory/3332-48-0x00007FF79C460000-0x00007FF79C852000-memory.dmp

Filesize
3.9MB

Download
memory/3332-4212-0x00007FF79C460000-0x00007FF79C852000-memory.dmp

Filesize
3.9MB

Download
memory/3408-68-0x00007FF62A1B0000-0x00007FF62A5A2000-memory.dmp

Filesize
3.9MB

Download
memory/3408-4225-0x00007FF62A1B0000-0x00007FF62A5A2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-4229-0x00007FF64ECF0000-0x00007FF64F0E2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-53-0x00007FF64ECF0000-0x00007FF64F0E2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-379-0x00007FF66A160000-0x00007FF66A552000-memory.dmp

Filesize
3.9MB

Download
memory/3580-4321-0x00007FF66A160000-0x00007FF66A552000-memory.dmp

Filesize
3.9MB

Download
memory/4016-4273-0x00007FF6B1EA0000-0x00007FF6B2292000-memory.dmp

Filesize
3.9MB

Download
memory/4016-376-0x00007FF6B1EA0000-0x00007FF6B2292000-memory.dmp

Filesize
3.9MB

Download
memory/4024-42-0x00007FF61BB40000-0x00007FF61BF32000-memory.dmp

Filesize
3.9MB

Download
memory/4024-4207-0x00007FF61BB40000-0x00007FF61BF32000-memory.dmp

Filesize
3.9MB

Download
memory/4532-4219-0x00007FF7F00B0000-0x00007FF7F04A2000-memory.dmp

Filesize
3.9MB

Download
memory/4532-60-0x00007FF7F00B0000-0x00007FF7F04A2000-memory.dmp

Filesize
3.9MB

Download
memory/4612-4277-0x00007FF789330000-0x00007FF789722000-memory.dmp

Filesize
3.9MB

Download
memory/4612-377-0x00007FF789330000-0x00007FF789722000-memory.dmp

Filesize
3.9MB

Download
memory/4628-375-0x00007FF680C20000-0x00007FF681012000-memory.dmp

Filesize
3.9MB

Download
memory/4628-4267-0x00007FF680C20000-0x00007FF681012000-memory.dmp

Filesize
3.9MB

Download
memory/4960-1037-0x00007FF78C2C0000-0x00007FF78C6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-1-0x0000017BD78D0000-0x0000017BD78E0000-memory.dmp

Filesize
64KB

Download
memory/4960-0-0x00007FF78C2C0000-0x00007FF78C6B2000-memory.dmp

Filesize
3.9MB

Download