xmrig | caaaffe2ece87c44d36115b08bf6dfcd01e2025a37101ab969dcce6c9a17d482

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

511c0f00ed149823b23cee88f85be330N.exe
Size

1.4MB
MD5

511c0f00ed149823b23cee88f85be330
SHA1

97bfa3d40103c20427561e7383333e1f1057e70b
SHA256

caaaffe2ece87c44d36115b08bf6dfcd01e2025a37101ab969dcce6c9a17d482
SHA512

f738c195f89f0ddacde7f0b9cca8c14a91efa75f1d89b7a2b6baa455c750464f469ca47c59a727a09057bac4676327b08a2a6b247076b816612e92cdabe670b8
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5OaD8VAEDzfJJRYEetNDoEkJ:Lz071uv4BPMkyW10/w16clC3oEm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral2/memory/3236-293-0x00007FF7CEE30000-0x00007FF7CF222000-memory.dmp	xmrig
behavioral2/memory/2868-294-0x00007FF6601F0000-0x00007FF6605E2000-memory.dmp	xmrig
behavioral2/memory/1808-435-0x00007FF695ED0000-0x00007FF6962C2000-memory.dmp	xmrig
behavioral2/memory/4152-438-0x00007FF62A0A0000-0x00007FF62A492000-memory.dmp	xmrig
behavioral2/memory/3960-514-0x00007FF61AA70000-0x00007FF61AE62000-memory.dmp	xmrig
behavioral2/memory/5104-609-0x00007FF684BE0000-0x00007FF684FD2000-memory.dmp	xmrig
behavioral2/memory/1656-803-0x00007FF666FB0000-0x00007FF6673A2000-memory.dmp	xmrig
behavioral2/memory/4788-727-0x00007FF797750000-0x00007FF797B42000-memory.dmp	xmrig
behavioral2/memory/1852-628-0x00007FF6BAD90000-0x00007FF6BB182000-memory.dmp	xmrig
behavioral2/memory/2760-513-0x00007FF793390000-0x00007FF793782000-memory.dmp	xmrig
behavioral2/memory/3952-442-0x00007FF753D70000-0x00007FF754162000-memory.dmp	xmrig
behavioral2/memory/4368-441-0x00007FF631E70000-0x00007FF632262000-memory.dmp	xmrig
behavioral2/memory/3064-440-0x00007FF7727C0000-0x00007FF772BB2000-memory.dmp	xmrig
behavioral2/memory/1988-439-0x00007FF6D5470000-0x00007FF6D5862000-memory.dmp	xmrig
behavioral2/memory/2696-437-0x00007FF6E0760000-0x00007FF6E0B52000-memory.dmp	xmrig
behavioral2/memory/1284-436-0x00007FF64B0C0000-0x00007FF64B4B2000-memory.dmp	xmrig
behavioral2/memory/2352-434-0x00007FF6FE730000-0x00007FF6FEB22000-memory.dmp	xmrig
behavioral2/memory/372-433-0x00007FF6D8FA0000-0x00007FF6D9392000-memory.dmp	xmrig
behavioral2/memory/724-432-0x00007FF79DA30000-0x00007FF79DE22000-memory.dmp	xmrig
behavioral2/memory/1676-431-0x00007FF64A240000-0x00007FF64A632000-memory.dmp	xmrig
behavioral2/memory/4020-242-0x00007FF729B00000-0x00007FF729EF2000-memory.dmp	xmrig
behavioral2/memory/1568-174-0x00007FF6EAA50000-0x00007FF6EAE42000-memory.dmp	xmrig
behavioral2/memory/1612-37-0x00007FF71E380000-0x00007FF71E772000-memory.dmp	xmrig
behavioral2/memory/2224-2822-0x00007FF714DC0000-0x00007FF7151B2000-memory.dmp	xmrig
behavioral2/memory/1456-2906-0x00007FF72CC90000-0x00007FF72D082000-memory.dmp	xmrig
behavioral2/memory/2224-4441-0x00007FF714DC0000-0x00007FF7151B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1384	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1456	EKVhKTF.exe
1612	XHhCpFP.exe
1568	krKTLUx.exe
1852	SbeWDvs.exe
4020	xcqqvSt.exe
3236	ZeQqCzr.exe
2868	XDdKfBT.exe
1676	aTWgese.exe
4788	sEpIihk.exe
724	YUNWicp.exe
372	VxFUFys.exe
2352	lLDrlMh.exe
1808	qUDmJnL.exe
1284	BnYPuDw.exe
2696	jWVmFDv.exe
4152	dFzlVWg.exe
1988	ejzuAYK.exe
3064	XxcSaeB.exe
4368	GSBZbea.exe
3952	gRPYOXE.exe
2760	rXmZtgC.exe
3960	VdHcHsF.exe
5104	BMEoxFp.exe
1656	jQNNMHf.exe
740	pLLtnDW.exe
1532	QHAxCyu.exe
4668	reijVwG.exe
1848	wFyenXa.exe
3804	rdtfuxG.exe
4876	xIazPny.exe
3456	WXtVnjM.exe
2148	AtZhSbX.exe
1940	hxBBkXJ.exe
4736	HHxIgpe.exe
3076	wJTdNsQ.exe
4924	NnfjLZg.exe
2888	VJifZXd.exe
3248	BbIaFiT.exe
2632	TUkNReb.exe
4196	qTkNgMi.exe
1388	JVSWQkE.exe
1548	hakAWla.exe
4860	wfZGqkE.exe
708	IbzIwBR.exe
5024	HYgcHkN.exe
344	vzdIbyl.exe
2944	uxTzJmL.exe
3040	oMNVkPx.exe
1928	jdwlsZj.exe
2984	owtqbkM.exe
3868	YdZjmVK.exe
4580	wOmeBNU.exe
2764	cZxrgXe.exe
1540	dUTbvkp.exe
2300	TlSsYXJ.exe
3268	icXQuTP.exe
4936	fwGCnce.exe
3608	lgKUQkK.exe
4584	FfGIjuk.exe
3212	CEIfZfs.exe
3052	OhmyryR.exe
1708	CtneSog.exe
4852	oytMAEG.exe
1964	JsMibvN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2224-0-0x00007FF714DC0000-0x00007FF7151B2000-memory.dmp	upx
behavioral2/files/0x0007000000023438-21.dat	upx
behavioral2/files/0x000700000002343c-30.dat	upx
behavioral2/files/0x0007000000023439-14.dat	upx
behavioral2/files/0x000700000002343f-38.dat	upx
behavioral2/files/0x0007000000023441-61.dat	upx
behavioral2/files/0x0007000000023447-93.dat	upx
behavioral2/files/0x000700000002345a-183.dat	upx
behavioral2/memory/3236-293-0x00007FF7CEE30000-0x00007FF7CF222000-memory.dmp	upx
behavioral2/memory/2868-294-0x00007FF6601F0000-0x00007FF6605E2000-memory.dmp	upx
behavioral2/memory/1808-435-0x00007FF695ED0000-0x00007FF6962C2000-memory.dmp	upx
behavioral2/memory/4152-438-0x00007FF62A0A0000-0x00007FF62A492000-memory.dmp	upx
behavioral2/memory/3960-514-0x00007FF61AA70000-0x00007FF61AE62000-memory.dmp	upx
behavioral2/memory/5104-609-0x00007FF684BE0000-0x00007FF684FD2000-memory.dmp	upx
behavioral2/memory/1656-803-0x00007FF666FB0000-0x00007FF6673A2000-memory.dmp	upx
behavioral2/memory/4788-727-0x00007FF797750000-0x00007FF797B42000-memory.dmp	upx
behavioral2/memory/1852-628-0x00007FF6BAD90000-0x00007FF6BB182000-memory.dmp	upx
behavioral2/memory/2760-513-0x00007FF793390000-0x00007FF793782000-memory.dmp	upx
behavioral2/memory/3952-442-0x00007FF753D70000-0x00007FF754162000-memory.dmp	upx
behavioral2/memory/4368-441-0x00007FF631E70000-0x00007FF632262000-memory.dmp	upx
behavioral2/memory/3064-440-0x00007FF7727C0000-0x00007FF772BB2000-memory.dmp	upx
behavioral2/memory/1988-439-0x00007FF6D5470000-0x00007FF6D5862000-memory.dmp	upx
behavioral2/memory/2696-437-0x00007FF6E0760000-0x00007FF6E0B52000-memory.dmp	upx
behavioral2/memory/1284-436-0x00007FF64B0C0000-0x00007FF64B4B2000-memory.dmp	upx
behavioral2/memory/2352-434-0x00007FF6FE730000-0x00007FF6FEB22000-memory.dmp	upx
behavioral2/memory/372-433-0x00007FF6D8FA0000-0x00007FF6D9392000-memory.dmp	upx
behavioral2/memory/724-432-0x00007FF79DA30000-0x00007FF79DE22000-memory.dmp	upx
behavioral2/memory/1676-431-0x00007FF64A240000-0x00007FF64A632000-memory.dmp	upx
behavioral2/memory/4020-242-0x00007FF729B00000-0x00007FF729EF2000-memory.dmp	upx
behavioral2/files/0x000700000002344a-218.dat	upx
behavioral2/files/0x0007000000023449-217.dat	upx
behavioral2/files/0x000700000002345c-216.dat	upx
behavioral2/files/0x0007000000023448-210.dat	upx
behavioral2/files/0x000700000002345b-191.dat	upx
behavioral2/memory/1568-174-0x00007FF6EAA50000-0x00007FF6EAE42000-memory.dmp	upx
behavioral2/files/0x000700000002344e-164.dat	upx
behavioral2/files/0x0007000000023457-159.dat	upx
behavioral2/files/0x000700000002344b-147.dat	upx
behavioral2/files/0x0007000000023456-143.dat	upx
behavioral2/files/0x0007000000023453-137.dat	upx
behavioral2/files/0x0007000000023455-136.dat	upx
behavioral2/files/0x0007000000023454-135.dat	upx
behavioral2/files/0x0007000000023452-131.dat	upx
behavioral2/files/0x0007000000023445-198.dat	upx
behavioral2/files/0x0007000000023444-192.dat	upx
behavioral2/files/0x0007000000023443-128.dat	upx
behavioral2/files/0x0007000000023451-127.dat	upx
behavioral2/files/0x0007000000023446-185.dat	upx
behavioral2/files/0x000700000002344f-177.dat	upx
behavioral2/files/0x0007000000023459-167.dat	upx
behavioral2/files/0x0007000000023458-163.dat	upx
behavioral2/files/0x000700000002343e-109.dat	upx
behavioral2/files/0x0007000000023450-122.dat	upx
behavioral2/files/0x000700000002344d-113.dat	upx
behavioral2/files/0x000700000002344c-112.dat	upx
behavioral2/files/0x000700000002343d-68.dat	upx
behavioral2/files/0x0007000000023442-94.dat	upx
behavioral2/files/0x000700000002343b-55.dat	upx
behavioral2/files/0x000700000002343a-54.dat	upx
behavioral2/files/0x0007000000023440-53.dat	upx
behavioral2/memory/1612-37-0x00007FF71E380000-0x00007FF71E772000-memory.dmp	upx
behavioral2/memory/1456-10-0x00007FF72CC90000-0x00007FF72D082000-memory.dmp	upx
behavioral2/files/0x0008000000023434-16.dat	upx
behavioral2/memory/2224-2822-0x00007FF714DC0000-0x00007FF7151B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VBhFKnz.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\BnAdtNo.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\LNrllNM.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\nBBkDSO.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\GtLSqxs.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\klApnzz.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\KntYuOq.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\IlNYxCe.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\NjedWqB.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\tFgLlZg.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\bSljvLK.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\AOCHEOx.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\RPfWZRB.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\duwLOPU.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\fqrTidH.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\uOougec.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\WAmnkvc.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\vnyfQaw.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\KCAHXVG.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\ZlipEph.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\aZfQLyN.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\LBanVVO.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\tjsvtWN.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\hKrAolq.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\bAVYWdW.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\tTSAlHw.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\QxvtgDf.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\OzhOyBB.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\BkDyCVt.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\DLaXLxh.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\dyuQjEO.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\WVedNGH.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\XGGQcsw.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\mjWoGan.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\MVaAGjm.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\zRBEHTO.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\ivpNZfW.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\fRggRIS.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\tcdGISZ.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\AetldlD.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\mipbaMa.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\xjNBOzw.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\SqgdXAz.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\cfPSgzC.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\xTejQEW.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\mwKbzwz.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\rHfGIHn.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\YJmPYSc.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\MqTXENI.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\FfGIjuk.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\ZpxkxqE.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\FIQCSYH.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\JmXQbsi.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\TNpyPaB.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\hLbORQx.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\PezIRnr.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\XRVLAbq.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\dQPfxxD.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\kEVoIZg.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\leYtRSP.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\DGNOIkU.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\wUjVoPe.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\ULIZsCc.exe	511c0f00ed149823b23cee88f85be330N.exe
File created	C:\Windows\System\juiDMfD.exe	511c0f00ed149823b23cee88f85be330N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
9884	Process not Found
1168	Process not Found
10188	Process not Found
9452	Process not Found
10264	Process not Found
1864	Process not Found
4224	Process not Found
5476	Process not Found
13048	Process not Found
11296	Process not Found
13676	Process not Found
7104	Process not Found
8836	Process not Found
3984	Process not Found
7936	Process not Found
9280	Process not Found
4504	Process not Found
8524	Process not Found
9432	Process not Found
7624	Process not Found
5736	Process not Found
9564	Process not Found
6844	Process not Found
10712	Process not Found
2092	Process not Found
11156	Process not Found
11448	Process not Found
8008	Process not Found
12100	Process not Found
9124	Process not Found
7228	Process not Found
11576	Process not Found
13656	Process not Found
10164	Process not Found
12460	Process not Found
7708	Process not Found
11656	Process not Found
13520	Process not Found
11452	Process not Found
14268	Process not Found
9096	Process not Found
12808	Process not Found
13504	Process not Found
12700	Process not Found
8796	Process not Found
6160	Process not Found
2400	Process not Found
1192	Process not Found
5088	Process not Found
1932	Process not Found
12688	Process not Found
10872	Process not Found
13480	Process not Found
12820	Process not Found
6204	Process not Found
9352	Process not Found
12704	Process not Found
6876	Process not Found
11928	Process not Found
8264	Process not Found
12712	Process not Found
15376	Process not Found
10928	Process not Found
13824	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeLockMemoryPrivilege	2224	511c0f00ed149823b23cee88f85be330N.exe
Token: SeLockMemoryPrivilege	2224	511c0f00ed149823b23cee88f85be330N.exe
Token: SeCreateGlobalPrivilege	13092	dwm.exe
Token: SeChangeNotifyPrivilege	13092	dwm.exe
Token: 33	13092	dwm.exe
Token: SeIncBasePriorityPrivilege	13092	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1384	2224	511c0f00ed149823b23cee88f85be330N.exe	85
PID 2224 wrote to memory of 1384	2224	511c0f00ed149823b23cee88f85be330N.exe	85
PID 2224 wrote to memory of 1456	2224	511c0f00ed149823b23cee88f85be330N.exe	86
PID 2224 wrote to memory of 1456	2224	511c0f00ed149823b23cee88f85be330N.exe	86
PID 2224 wrote to memory of 1568	2224	511c0f00ed149823b23cee88f85be330N.exe	87
PID 2224 wrote to memory of 1568	2224	511c0f00ed149823b23cee88f85be330N.exe	87
PID 2224 wrote to memory of 1612	2224	511c0f00ed149823b23cee88f85be330N.exe	88
PID 2224 wrote to memory of 1612	2224	511c0f00ed149823b23cee88f85be330N.exe	88
PID 2224 wrote to memory of 1852	2224	511c0f00ed149823b23cee88f85be330N.exe	89
PID 2224 wrote to memory of 1852	2224	511c0f00ed149823b23cee88f85be330N.exe	89
PID 2224 wrote to memory of 4020	2224	511c0f00ed149823b23cee88f85be330N.exe	90
PID 2224 wrote to memory of 4020	2224	511c0f00ed149823b23cee88f85be330N.exe	90
PID 2224 wrote to memory of 3236	2224	511c0f00ed149823b23cee88f85be330N.exe	91
PID 2224 wrote to memory of 3236	2224	511c0f00ed149823b23cee88f85be330N.exe	91
PID 2224 wrote to memory of 2868	2224	511c0f00ed149823b23cee88f85be330N.exe	92
PID 2224 wrote to memory of 2868	2224	511c0f00ed149823b23cee88f85be330N.exe	92
PID 2224 wrote to memory of 1676	2224	511c0f00ed149823b23cee88f85be330N.exe	93
PID 2224 wrote to memory of 1676	2224	511c0f00ed149823b23cee88f85be330N.exe	93
PID 2224 wrote to memory of 4788	2224	511c0f00ed149823b23cee88f85be330N.exe	94
PID 2224 wrote to memory of 4788	2224	511c0f00ed149823b23cee88f85be330N.exe	94
PID 2224 wrote to memory of 724	2224	511c0f00ed149823b23cee88f85be330N.exe	95
PID 2224 wrote to memory of 724	2224	511c0f00ed149823b23cee88f85be330N.exe	95
PID 2224 wrote to memory of 372	2224	511c0f00ed149823b23cee88f85be330N.exe	96
PID 2224 wrote to memory of 372	2224	511c0f00ed149823b23cee88f85be330N.exe	96
PID 2224 wrote to memory of 2352	2224	511c0f00ed149823b23cee88f85be330N.exe	97
PID 2224 wrote to memory of 2352	2224	511c0f00ed149823b23cee88f85be330N.exe	97
PID 2224 wrote to memory of 1808	2224	511c0f00ed149823b23cee88f85be330N.exe	98
PID 2224 wrote to memory of 1808	2224	511c0f00ed149823b23cee88f85be330N.exe	98
PID 2224 wrote to memory of 1284	2224	511c0f00ed149823b23cee88f85be330N.exe	99
PID 2224 wrote to memory of 1284	2224	511c0f00ed149823b23cee88f85be330N.exe	99
PID 2224 wrote to memory of 2696	2224	511c0f00ed149823b23cee88f85be330N.exe	100
PID 2224 wrote to memory of 2696	2224	511c0f00ed149823b23cee88f85be330N.exe	100
PID 2224 wrote to memory of 4152	2224	511c0f00ed149823b23cee88f85be330N.exe	101
PID 2224 wrote to memory of 4152	2224	511c0f00ed149823b23cee88f85be330N.exe	101
PID 2224 wrote to memory of 1988	2224	511c0f00ed149823b23cee88f85be330N.exe	102
PID 2224 wrote to memory of 1988	2224	511c0f00ed149823b23cee88f85be330N.exe	102
PID 2224 wrote to memory of 3064	2224	511c0f00ed149823b23cee88f85be330N.exe	103
PID 2224 wrote to memory of 3064	2224	511c0f00ed149823b23cee88f85be330N.exe	103
PID 2224 wrote to memory of 4368	2224	511c0f00ed149823b23cee88f85be330N.exe	104
PID 2224 wrote to memory of 4368	2224	511c0f00ed149823b23cee88f85be330N.exe	104
PID 2224 wrote to memory of 3952	2224	511c0f00ed149823b23cee88f85be330N.exe	105
PID 2224 wrote to memory of 3952	2224	511c0f00ed149823b23cee88f85be330N.exe	105
PID 2224 wrote to memory of 3456	2224	511c0f00ed149823b23cee88f85be330N.exe	106
PID 2224 wrote to memory of 3456	2224	511c0f00ed149823b23cee88f85be330N.exe	106
PID 2224 wrote to memory of 2760	2224	511c0f00ed149823b23cee88f85be330N.exe	107
PID 2224 wrote to memory of 2760	2224	511c0f00ed149823b23cee88f85be330N.exe	107
PID 2224 wrote to memory of 3960	2224	511c0f00ed149823b23cee88f85be330N.exe	108
PID 2224 wrote to memory of 3960	2224	511c0f00ed149823b23cee88f85be330N.exe	108
PID 2224 wrote to memory of 5104	2224	511c0f00ed149823b23cee88f85be330N.exe	109
PID 2224 wrote to memory of 5104	2224	511c0f00ed149823b23cee88f85be330N.exe	109
PID 2224 wrote to memory of 3076	2224	511c0f00ed149823b23cee88f85be330N.exe	110
PID 2224 wrote to memory of 3076	2224	511c0f00ed149823b23cee88f85be330N.exe	110
PID 2224 wrote to memory of 1656	2224	511c0f00ed149823b23cee88f85be330N.exe	111
PID 2224 wrote to memory of 1656	2224	511c0f00ed149823b23cee88f85be330N.exe	111
PID 2224 wrote to memory of 740	2224	511c0f00ed149823b23cee88f85be330N.exe	112
PID 2224 wrote to memory of 740	2224	511c0f00ed149823b23cee88f85be330N.exe	112
PID 2224 wrote to memory of 1532	2224	511c0f00ed149823b23cee88f85be330N.exe	113
PID 2224 wrote to memory of 1532	2224	511c0f00ed149823b23cee88f85be330N.exe	113
PID 2224 wrote to memory of 4668	2224	511c0f00ed149823b23cee88f85be330N.exe	114
PID 2224 wrote to memory of 4668	2224	511c0f00ed149823b23cee88f85be330N.exe	114
PID 2224 wrote to memory of 1848	2224	511c0f00ed149823b23cee88f85be330N.exe	115
PID 2224 wrote to memory of 1848	2224	511c0f00ed149823b23cee88f85be330N.exe	115
PID 2224 wrote to memory of 3804	2224	511c0f00ed149823b23cee88f85be330N.exe	116
PID 2224 wrote to memory of 3804	2224	511c0f00ed149823b23cee88f85be330N.exe	116

C:\Users\Admin\AppData\Local\Temp\511c0f00ed149823b23cee88f85be330N.exe
"C:\Users\Admin\AppData\Local\Temp\511c0f00ed149823b23cee88f85be330N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\System\EKVhKTF.exe
  C:\Windows\System\EKVhKTF.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\krKTLUx.exe
  C:\Windows\System\krKTLUx.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\XHhCpFP.exe
  C:\Windows\System\XHhCpFP.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\SbeWDvs.exe
  C:\Windows\System\SbeWDvs.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\xcqqvSt.exe
  C:\Windows\System\xcqqvSt.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\ZeQqCzr.exe
  C:\Windows\System\ZeQqCzr.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\XDdKfBT.exe
  C:\Windows\System\XDdKfBT.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\aTWgese.exe
  C:\Windows\System\aTWgese.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\sEpIihk.exe
  C:\Windows\System\sEpIihk.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\YUNWicp.exe
  C:\Windows\System\YUNWicp.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\VxFUFys.exe
  C:\Windows\System\VxFUFys.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\lLDrlMh.exe
  C:\Windows\System\lLDrlMh.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\qUDmJnL.exe
  C:\Windows\System\qUDmJnL.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\BnYPuDw.exe
  C:\Windows\System\BnYPuDw.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\jWVmFDv.exe
  C:\Windows\System\jWVmFDv.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\dFzlVWg.exe
  C:\Windows\System\dFzlVWg.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\ejzuAYK.exe
  C:\Windows\System\ejzuAYK.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\XxcSaeB.exe
  C:\Windows\System\XxcSaeB.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\GSBZbea.exe
  C:\Windows\System\GSBZbea.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\gRPYOXE.exe
  C:\Windows\System\gRPYOXE.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\WXtVnjM.exe
  C:\Windows\System\WXtVnjM.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\rXmZtgC.exe
  C:\Windows\System\rXmZtgC.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\VdHcHsF.exe
  C:\Windows\System\VdHcHsF.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\BMEoxFp.exe
  C:\Windows\System\BMEoxFp.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\wJTdNsQ.exe
  C:\Windows\System\wJTdNsQ.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\jQNNMHf.exe
  C:\Windows\System\jQNNMHf.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\pLLtnDW.exe
  C:\Windows\System\pLLtnDW.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\QHAxCyu.exe
  C:\Windows\System\QHAxCyu.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\reijVwG.exe
  C:\Windows\System\reijVwG.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\wFyenXa.exe
  C:\Windows\System\wFyenXa.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\rdtfuxG.exe
  C:\Windows\System\rdtfuxG.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\xIazPny.exe
  C:\Windows\System\xIazPny.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\AtZhSbX.exe
  C:\Windows\System\AtZhSbX.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\hxBBkXJ.exe
  C:\Windows\System\hxBBkXJ.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\HHxIgpe.exe
  C:\Windows\System\HHxIgpe.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\NnfjLZg.exe
  C:\Windows\System\NnfjLZg.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\VJifZXd.exe
  C:\Windows\System\VJifZXd.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\BbIaFiT.exe
  C:\Windows\System\BbIaFiT.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\TUkNReb.exe
  C:\Windows\System\TUkNReb.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\OhmyryR.exe
  C:\Windows\System\OhmyryR.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\qTkNgMi.exe
  C:\Windows\System\qTkNgMi.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\CtneSog.exe
  C:\Windows\System\CtneSog.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\JVSWQkE.exe
  C:\Windows\System\JVSWQkE.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\hakAWla.exe
  C:\Windows\System\hakAWla.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\wfZGqkE.exe
  C:\Windows\System\wfZGqkE.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\IbzIwBR.exe
  C:\Windows\System\IbzIwBR.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\HYgcHkN.exe
  C:\Windows\System\HYgcHkN.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\vzdIbyl.exe
  C:\Windows\System\vzdIbyl.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\uxTzJmL.exe
  C:\Windows\System\uxTzJmL.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\oMNVkPx.exe
  C:\Windows\System\oMNVkPx.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\jdwlsZj.exe
  C:\Windows\System\jdwlsZj.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\owtqbkM.exe
  C:\Windows\System\owtqbkM.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\YdZjmVK.exe
  C:\Windows\System\YdZjmVK.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\wOmeBNU.exe
  C:\Windows\System\wOmeBNU.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\cZxrgXe.exe
  C:\Windows\System\cZxrgXe.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\dUTbvkp.exe
  C:\Windows\System\dUTbvkp.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\TlSsYXJ.exe
  C:\Windows\System\TlSsYXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\icXQuTP.exe
  C:\Windows\System\icXQuTP.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\fwGCnce.exe
  C:\Windows\System\fwGCnce.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\lgKUQkK.exe
  C:\Windows\System\lgKUQkK.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\FfGIjuk.exe
  C:\Windows\System\FfGIjuk.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\CEIfZfs.exe
  C:\Windows\System\CEIfZfs.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\oytMAEG.exe
  C:\Windows\System\oytMAEG.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\JsMibvN.exe
  C:\Windows\System\JsMibvN.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\ynDqcsL.exe
  C:\Windows\System\ynDqcsL.exe
  2⤵
  PID:1760
- C:\Windows\System\TjmrISU.exe
  C:\Windows\System\TjmrISU.exe
  2⤵
  PID:3564
- C:\Windows\System\QoikiZL.exe
  C:\Windows\System\QoikiZL.exe
  2⤵
  PID:2292
- C:\Windows\System\ttKRQzq.exe
  C:\Windows\System\ttKRQzq.exe
  2⤵
  PID:4432
- C:\Windows\System\iSjPQXX.exe
  C:\Windows\System\iSjPQXX.exe
  2⤵
  PID:4500
- C:\Windows\System\nnlXrLh.exe
  C:\Windows\System\nnlXrLh.exe
  2⤵
  PID:1788
- C:\Windows\System\EKHnYaY.exe
  C:\Windows\System\EKHnYaY.exe
  2⤵
  PID:4128
- C:\Windows\System\ZlipEph.exe
  C:\Windows\System\ZlipEph.exe
  2⤵
  PID:980
- C:\Windows\System\qhZYVNf.exe
  C:\Windows\System\qhZYVNf.exe
  2⤵
  PID:1464
- C:\Windows\System\LONibcO.exe
  C:\Windows\System\LONibcO.exe
  2⤵
  PID:4644
- C:\Windows\System\MpstVYE.exe
  C:\Windows\System\MpstVYE.exe
  2⤵
  PID:4148
- C:\Windows\System\inqccas.exe
  C:\Windows\System\inqccas.exe
  2⤵
  PID:3104
- C:\Windows\System\QvVJKor.exe
  C:\Windows\System\QvVJKor.exe
  2⤵
  PID:3120
- C:\Windows\System\yepWagh.exe
  C:\Windows\System\yepWagh.exe
  2⤵
  PID:4192
- C:\Windows\System\PPXMVMv.exe
  C:\Windows\System\PPXMVMv.exe
  2⤵
  PID:636
- C:\Windows\System\ArObomp.exe
  C:\Windows\System\ArObomp.exe
  2⤵
  PID:3056
- C:\Windows\System\vwrVCjX.exe
  C:\Windows\System\vwrVCjX.exe
  2⤵
  PID:2536
- C:\Windows\System\JmCeGpK.exe
  C:\Windows\System\JmCeGpK.exe
  2⤵
  PID:3092
- C:\Windows\System\kQrJSBY.exe
  C:\Windows\System\kQrJSBY.exe
  2⤵
  PID:2000
- C:\Windows\System\okjKgLX.exe
  C:\Windows\System\okjKgLX.exe
  2⤵
  PID:2252
- C:\Windows\System\ldQReXQ.exe
  C:\Windows\System\ldQReXQ.exe
  2⤵
  PID:1628
- C:\Windows\System\gutElNC.exe
  C:\Windows\System\gutElNC.exe
  2⤵
  PID:1364
- C:\Windows\System\HAJQNri.exe
  C:\Windows\System\HAJQNri.exe
  2⤵
  PID:4868
- C:\Windows\System\jgCRPSU.exe
  C:\Windows\System\jgCRPSU.exe
  2⤵
  PID:5136
- C:\Windows\System\ruOLprG.exe
  C:\Windows\System\ruOLprG.exe
  2⤵
  PID:5160
- C:\Windows\System\vQdGuFo.exe
  C:\Windows\System\vQdGuFo.exe
  2⤵
  PID:5180
- C:\Windows\System\QWtbLyy.exe
  C:\Windows\System\QWtbLyy.exe
  2⤵
  PID:5200
- C:\Windows\System\xMaUJXZ.exe
  C:\Windows\System\xMaUJXZ.exe
  2⤵
  PID:5216
- C:\Windows\System\cHimaVu.exe
  C:\Windows\System\cHimaVu.exe
  2⤵
  PID:5244
- C:\Windows\System\NgzTIje.exe
  C:\Windows\System\NgzTIje.exe
  2⤵
  PID:5260
- C:\Windows\System\bxlKlYk.exe
  C:\Windows\System\bxlKlYk.exe
  2⤵
  PID:5292
- C:\Windows\System\zPLAdSB.exe
  C:\Windows\System\zPLAdSB.exe
  2⤵
  PID:5316
- C:\Windows\System\SbigxOl.exe
  C:\Windows\System\SbigxOl.exe
  2⤵
  PID:5364
- C:\Windows\System\IioceYk.exe
  C:\Windows\System\IioceYk.exe
  2⤵
  PID:5392
- C:\Windows\System\UOdbvxe.exe
  C:\Windows\System\UOdbvxe.exe
  2⤵
  PID:5408
- C:\Windows\System\kBevBGZ.exe
  C:\Windows\System\kBevBGZ.exe
  2⤵
  PID:5428
- C:\Windows\System\RedMsMx.exe
  C:\Windows\System\RedMsMx.exe
  2⤵
  PID:5448
- C:\Windows\System\boLEPYY.exe
  C:\Windows\System\boLEPYY.exe
  2⤵
  PID:5464
- C:\Windows\System\HFaiFaS.exe
  C:\Windows\System\HFaiFaS.exe
  2⤵
  PID:5492
- C:\Windows\System\KBBprhh.exe
  C:\Windows\System\KBBprhh.exe
  2⤵
  PID:5508
- C:\Windows\System\iyUgVcK.exe
  C:\Windows\System\iyUgVcK.exe
  2⤵
  PID:5528
- C:\Windows\System\ICFiLpX.exe
  C:\Windows\System\ICFiLpX.exe
  2⤵
  PID:5544
- C:\Windows\System\rpGbDjK.exe
  C:\Windows\System\rpGbDjK.exe
  2⤵
  PID:5568
- C:\Windows\System\oiMYojj.exe
  C:\Windows\System\oiMYojj.exe
  2⤵
  PID:5584
- C:\Windows\System\ucaXBPV.exe
  C:\Windows\System\ucaXBPV.exe
  2⤵
  PID:5608
- C:\Windows\System\owdKUqY.exe
  C:\Windows\System\owdKUqY.exe
  2⤵
  PID:5632
- C:\Windows\System\XpsbgbA.exe
  C:\Windows\System\XpsbgbA.exe
  2⤵
  PID:5656
- C:\Windows\System\lBSylTQ.exe
  C:\Windows\System\lBSylTQ.exe
  2⤵
  PID:5680
- C:\Windows\System\vnyfQaw.exe
  C:\Windows\System\vnyfQaw.exe
  2⤵
  PID:5696
- C:\Windows\System\vOzMWET.exe
  C:\Windows\System\vOzMWET.exe
  2⤵
  PID:5720
- C:\Windows\System\aFRyRHQ.exe
  C:\Windows\System\aFRyRHQ.exe
  2⤵
  PID:5744
- C:\Windows\System\wQIRmdm.exe
  C:\Windows\System\wQIRmdm.exe
  2⤵
  PID:5764
- C:\Windows\System\urSTNtU.exe
  C:\Windows\System\urSTNtU.exe
  2⤵
  PID:5788
- C:\Windows\System\ZPzaigo.exe
  C:\Windows\System\ZPzaigo.exe
  2⤵
  PID:5812
- C:\Windows\System\oPDyJGQ.exe
  C:\Windows\System\oPDyJGQ.exe
  2⤵
  PID:5832
- C:\Windows\System\wRUOfcc.exe
  C:\Windows\System\wRUOfcc.exe
  2⤵
  PID:5856
- C:\Windows\System\rVGWOqB.exe
  C:\Windows\System\rVGWOqB.exe
  2⤵
  PID:5880
- C:\Windows\System\VEPiwZG.exe
  C:\Windows\System\VEPiwZG.exe
  2⤵
  PID:5904
- C:\Windows\System\JyqIjtJ.exe
  C:\Windows\System\JyqIjtJ.exe
  2⤵
  PID:5924
- C:\Windows\System\sDNGOUT.exe
  C:\Windows\System\sDNGOUT.exe
  2⤵
  PID:5944
- C:\Windows\System\bhWBiNU.exe
  C:\Windows\System\bhWBiNU.exe
  2⤵
  PID:5960
- C:\Windows\System\JRxPVPx.exe
  C:\Windows\System\JRxPVPx.exe
  2⤵
  PID:5984
- C:\Windows\System\zqjJwoz.exe
  C:\Windows\System\zqjJwoz.exe
  2⤵
  PID:6004
- C:\Windows\System\xqGkoDu.exe
  C:\Windows\System\xqGkoDu.exe
  2⤵
  PID:6020
- C:\Windows\System\YqCiAdd.exe
  C:\Windows\System\YqCiAdd.exe
  2⤵
  PID:6040
- C:\Windows\System\QlUjISn.exe
  C:\Windows\System\QlUjISn.exe
  2⤵
  PID:6056
- C:\Windows\System\LBaGLvo.exe
  C:\Windows\System\LBaGLvo.exe
  2⤵
  PID:6076
- C:\Windows\System\sATCfOe.exe
  C:\Windows\System\sATCfOe.exe
  2⤵
  PID:6096
- C:\Windows\System\JWfQDIN.exe
  C:\Windows\System\JWfQDIN.exe
  2⤵
  PID:6112
- C:\Windows\System\xsijWyV.exe
  C:\Windows\System\xsijWyV.exe
  2⤵
  PID:6128
- C:\Windows\System\eiKPUpU.exe
  C:\Windows\System\eiKPUpU.exe
  2⤵
  PID:4780
- C:\Windows\System\yLsaavN.exe
  C:\Windows\System\yLsaavN.exe
  2⤵
  PID:2100
- C:\Windows\System\JrWmlww.exe
  C:\Windows\System\JrWmlww.exe
  2⤵
  PID:2236
- C:\Windows\System\gzfufuX.exe
  C:\Windows\System\gzfufuX.exe
  2⤵
  PID:1368
- C:\Windows\System\QUNugLd.exe
  C:\Windows\System\QUNugLd.exe
  2⤵
  PID:2836
- C:\Windows\System\SBCbFHm.exe
  C:\Windows\System\SBCbFHm.exe
  2⤵
  PID:856
- C:\Windows\System\TpJszyd.exe
  C:\Windows\System\TpJszyd.exe
  2⤵
  PID:4844
- C:\Windows\System\kCTDFFp.exe
  C:\Windows\System\kCTDFFp.exe
  2⤵
  PID:3924
- C:\Windows\System\LMRlHAp.exe
  C:\Windows\System\LMRlHAp.exe
  2⤵
  PID:3132
- C:\Windows\System\FIQCSYH.exe
  C:\Windows\System\FIQCSYH.exe
  2⤵
  PID:5276
- C:\Windows\System\MqwCuBr.exe
  C:\Windows\System\MqwCuBr.exe
  2⤵
  PID:4576
- C:\Windows\System\tSvfKdd.exe
  C:\Windows\System\tSvfKdd.exe
  2⤵
  PID:4624
- C:\Windows\System\YIbdVSm.exe
  C:\Windows\System\YIbdVSm.exe
  2⤵
  PID:6304
- C:\Windows\System\fgInRqU.exe
  C:\Windows\System\fgInRqU.exe
  2⤵
  PID:6320
- C:\Windows\System\OjWVYgk.exe
  C:\Windows\System\OjWVYgk.exe
  2⤵
  PID:6336
- C:\Windows\System\FbUtjCN.exe
  C:\Windows\System\FbUtjCN.exe
  2⤵
  PID:6352
- C:\Windows\System\EwzCAeu.exe
  C:\Windows\System\EwzCAeu.exe
  2⤵
  PID:6372
- C:\Windows\System\znnelgT.exe
  C:\Windows\System\znnelgT.exe
  2⤵
  PID:6388
- C:\Windows\System\VgioJIr.exe
  C:\Windows\System\VgioJIr.exe
  2⤵
  PID:6404
- C:\Windows\System\wwDvcvS.exe
  C:\Windows\System\wwDvcvS.exe
  2⤵
  PID:6420
- C:\Windows\System\FkVhHvb.exe
  C:\Windows\System\FkVhHvb.exe
  2⤵
  PID:6436
- C:\Windows\System\ZeaJifz.exe
  C:\Windows\System\ZeaJifz.exe
  2⤵
  PID:6452
- C:\Windows\System\XOxSfLe.exe
  C:\Windows\System\XOxSfLe.exe
  2⤵
  PID:6468
- C:\Windows\System\nsUvbvN.exe
  C:\Windows\System\nsUvbvN.exe
  2⤵
  PID:6484
- C:\Windows\System\VFyMuhB.exe
  C:\Windows\System\VFyMuhB.exe
  2⤵
  PID:6500
- C:\Windows\System\KRCeGOp.exe
  C:\Windows\System\KRCeGOp.exe
  2⤵
  PID:6520
- C:\Windows\System\USjsWIy.exe
  C:\Windows\System\USjsWIy.exe
  2⤵
  PID:6536
- C:\Windows\System\BxqKgiU.exe
  C:\Windows\System\BxqKgiU.exe
  2⤵
  PID:6556
- C:\Windows\System\MZEvxNn.exe
  C:\Windows\System\MZEvxNn.exe
  2⤵
  PID:6580
- C:\Windows\System\XwRxUXt.exe
  C:\Windows\System\XwRxUXt.exe
  2⤵
  PID:6596
- C:\Windows\System\WneVsCO.exe
  C:\Windows\System\WneVsCO.exe
  2⤵
  PID:6616
- C:\Windows\System\diONDMM.exe
  C:\Windows\System\diONDMM.exe
  2⤵
  PID:6636
- C:\Windows\System\uQeEvxY.exe
  C:\Windows\System\uQeEvxY.exe
  2⤵
  PID:6652
- C:\Windows\System\jPGszep.exe
  C:\Windows\System\jPGszep.exe
  2⤵
  PID:6672
- C:\Windows\System\iydBFfV.exe
  C:\Windows\System\iydBFfV.exe
  2⤵
  PID:6692
- C:\Windows\System\fTUOMXH.exe
  C:\Windows\System\fTUOMXH.exe
  2⤵
  PID:6732
- C:\Windows\System\ugpIGHx.exe
  C:\Windows\System\ugpIGHx.exe
  2⤵
  PID:6752
- C:\Windows\System\aOlycrK.exe
  C:\Windows\System\aOlycrK.exe
  2⤵
  PID:6768
- C:\Windows\System\HruYYDa.exe
  C:\Windows\System\HruYYDa.exe
  2⤵
  PID:6788
- C:\Windows\System\LznqZSs.exe
  C:\Windows\System\LznqZSs.exe
  2⤵
  PID:6808
- C:\Windows\System\SzJxKBa.exe
  C:\Windows\System\SzJxKBa.exe
  2⤵
  PID:6836
- C:\Windows\System\AKBZLVs.exe
  C:\Windows\System\AKBZLVs.exe
  2⤵
  PID:6852
- C:\Windows\System\EdypEyb.exe
  C:\Windows\System\EdypEyb.exe
  2⤵
  PID:6868
- C:\Windows\System\vcHaYrC.exe
  C:\Windows\System\vcHaYrC.exe
  2⤵
  PID:6884
- C:\Windows\System\TPNsqSz.exe
  C:\Windows\System\TPNsqSz.exe
  2⤵
  PID:6900
- C:\Windows\System\TgnfndK.exe
  C:\Windows\System\TgnfndK.exe
  2⤵
  PID:6916
- C:\Windows\System\VgULnqT.exe
  C:\Windows\System\VgULnqT.exe
  2⤵
  PID:6932
- C:\Windows\System\SMFIVra.exe
  C:\Windows\System\SMFIVra.exe
  2⤵
  PID:6948
- C:\Windows\System\zRBEHTO.exe
  C:\Windows\System\zRBEHTO.exe
  2⤵
  PID:6968
- C:\Windows\System\laIJWoI.exe
  C:\Windows\System\laIJWoI.exe
  2⤵
  PID:6992
- C:\Windows\System\zJSNSfX.exe
  C:\Windows\System\zJSNSfX.exe
  2⤵
  PID:7008
- C:\Windows\System\FQDfxMi.exe
  C:\Windows\System\FQDfxMi.exe
  2⤵
  PID:7024
- C:\Windows\System\ZrsCLCQ.exe
  C:\Windows\System\ZrsCLCQ.exe
  2⤵
  PID:7052
- C:\Windows\System\GAtfKcm.exe
  C:\Windows\System\GAtfKcm.exe
  2⤵
  PID:7072
- C:\Windows\System\rHUThWl.exe
  C:\Windows\System\rHUThWl.exe
  2⤵
  PID:7088
- C:\Windows\System\IozeaqW.exe
  C:\Windows\System\IozeaqW.exe
  2⤵
  PID:7116
- C:\Windows\System\lPqcOIM.exe
  C:\Windows\System\lPqcOIM.exe
  2⤵
  PID:7144
- C:\Windows\System\vQDNlwh.exe
  C:\Windows\System\vQDNlwh.exe
  2⤵
  PID:4716
- C:\Windows\System\KpSzyox.exe
  C:\Windows\System\KpSzyox.exe
  2⤵
  PID:2040
- C:\Windows\System\evpMbmj.exe
  C:\Windows\System\evpMbmj.exe
  2⤵
  PID:4424
- C:\Windows\System\zpEUfmB.exe
  C:\Windows\System\zpEUfmB.exe
  2⤵
  PID:4964
- C:\Windows\System\HsIBcAt.exe
  C:\Windows\System\HsIBcAt.exe
  2⤵
  PID:3188
- C:\Windows\System\VehNTvA.exe
  C:\Windows\System\VehNTvA.exe
  2⤵
  PID:4932
- C:\Windows\System\vLkYygc.exe
  C:\Windows\System\vLkYygc.exe
  2⤵
  PID:1516
- C:\Windows\System\rTVRAQn.exe
  C:\Windows\System\rTVRAQn.exe
  2⤵
  PID:4764
- C:\Windows\System\dLoPYCN.exe
  C:\Windows\System\dLoPYCN.exe
  2⤵
  PID:4816
- C:\Windows\System\fSjyoKY.exe
  C:\Windows\System\fSjyoKY.exe
  2⤵
  PID:5144
- C:\Windows\System\yQgGUAW.exe
  C:\Windows\System\yQgGUAW.exe
  2⤵
  PID:5420
- C:\Windows\System\erhYKou.exe
  C:\Windows\System\erhYKou.exe
  2⤵
  PID:5228
- C:\Windows\System\fMjAwXD.exe
  C:\Windows\System\fMjAwXD.exe
  2⤵
  PID:5308
- C:\Windows\System\xGkHLxW.exe
  C:\Windows\System\xGkHLxW.exe
  2⤵
  PID:5372
- C:\Windows\System\kjuiEFi.exe
  C:\Windows\System\kjuiEFi.exe
  2⤵
  PID:5668
- C:\Windows\System\mipbaMa.exe
  C:\Windows\System\mipbaMa.exe
  2⤵
  PID:5776
- C:\Windows\System\fpckMal.exe
  C:\Windows\System\fpckMal.exe
  2⤵
  PID:6000
- C:\Windows\System\cNmNzye.exe
  C:\Windows\System\cNmNzye.exe
  2⤵
  PID:2948
- C:\Windows\System\iJzfqiQ.exe
  C:\Windows\System\iJzfqiQ.exe
  2⤵
  PID:2736
- C:\Windows\System\OcClrTg.exe
  C:\Windows\System\OcClrTg.exe
  2⤵
  PID:5644
- C:\Windows\System\vdapuUs.exe
  C:\Windows\System\vdapuUs.exe
  2⤵
  PID:5692
- C:\Windows\System\cEyxKhV.exe
  C:\Windows\System\cEyxKhV.exe
  2⤵
  PID:5752
- C:\Windows\System\aJotrma.exe
  C:\Windows\System\aJotrma.exe
  2⤵
  PID:5796
- C:\Windows\System\ROivZzY.exe
  C:\Windows\System\ROivZzY.exe
  2⤵
  PID:5868
- C:\Windows\System\ZZrUmYa.exe
  C:\Windows\System\ZZrUmYa.exe
  2⤵
  PID:5936
- C:\Windows\System\XwDCUxn.exe
  C:\Windows\System\XwDCUxn.exe
  2⤵
  PID:5976
- C:\Windows\System\DbHJtDI.exe
  C:\Windows\System\DbHJtDI.exe
  2⤵
  PID:6016
- C:\Windows\System\gJVDvVg.exe
  C:\Windows\System\gJVDvVg.exe
  2⤵
  PID:6064
- C:\Windows\System\WVedNGH.exe
  C:\Windows\System\WVedNGH.exe
  2⤵
  PID:1432
- C:\Windows\System\sBjBAyL.exe
  C:\Windows\System\sBjBAyL.exe
  2⤵
  PID:6528
- C:\Windows\System\DZeVzFT.exe
  C:\Windows\System\DZeVzFT.exe
  2⤵
  PID:5828
- C:\Windows\System\LzUcsGY.exe
  C:\Windows\System\LzUcsGY.exe
  2⤵
  PID:6072
- C:\Windows\System\uKEnOMt.exe
  C:\Windows\System\uKEnOMt.exe
  2⤵
  PID:6108
- C:\Windows\System\SHVDkVh.exe
  C:\Windows\System\SHVDkVh.exe
  2⤵
  PID:1160
- C:\Windows\System\kxaFWVA.exe
  C:\Windows\System\kxaFWVA.exe
  2⤵
  PID:6796
- C:\Windows\System\ljZnUPt.exe
  C:\Windows\System\ljZnUPt.exe
  2⤵
  PID:2196
- C:\Windows\System\xdxhpuT.exe
  C:\Windows\System\xdxhpuT.exe
  2⤵
  PID:5416
- C:\Windows\System\hGayjVP.exe
  C:\Windows\System\hGayjVP.exe
  2⤵
  PID:5460
- C:\Windows\System\jRzsggK.exe
  C:\Windows\System\jRzsggK.exe
  2⤵
  PID:5536
- C:\Windows\System\hztlzHU.exe
  C:\Windows\System\hztlzHU.exe
  2⤵
  PID:5576
- C:\Windows\System\GlGASjS.exe
  C:\Windows\System\GlGASjS.exe
  2⤵
  PID:7080
- C:\Windows\System\SkbYeMK.exe
  C:\Windows\System\SkbYeMK.exe
  2⤵
  PID:7192
- C:\Windows\System\JurPUmj.exe
  C:\Windows\System\JurPUmj.exe
  2⤵
  PID:7232
- C:\Windows\System\nJKZJsA.exe
  C:\Windows\System\nJKZJsA.exe
  2⤵
  PID:7252
- C:\Windows\System\gTeiRDY.exe
  C:\Windows\System\gTeiRDY.exe
  2⤵
  PID:7292
- C:\Windows\System\ZKkOqls.exe
  C:\Windows\System\ZKkOqls.exe
  2⤵
  PID:7308
- C:\Windows\System\FOnEjNT.exe
  C:\Windows\System\FOnEjNT.exe
  2⤵
  PID:7324
- C:\Windows\System\dWDsSFO.exe
  C:\Windows\System\dWDsSFO.exe
  2⤵
  PID:7344
- C:\Windows\System\teuwYYR.exe
  C:\Windows\System\teuwYYR.exe
  2⤵
  PID:7364
- C:\Windows\System\goGNqJh.exe
  C:\Windows\System\goGNqJh.exe
  2⤵
  PID:7384
- C:\Windows\System\qxilJuR.exe
  C:\Windows\System\qxilJuR.exe
  2⤵
  PID:7400
- C:\Windows\System\xYjjOmx.exe
  C:\Windows\System\xYjjOmx.exe
  2⤵
  PID:7420
- C:\Windows\System\aCfqKNx.exe
  C:\Windows\System\aCfqKNx.exe
  2⤵
  PID:7436
- C:\Windows\System\jpeHJlP.exe
  C:\Windows\System\jpeHJlP.exe
  2⤵
  PID:7452
- C:\Windows\System\uWnkycT.exe
  C:\Windows\System\uWnkycT.exe
  2⤵
  PID:7472
- C:\Windows\System\KhUDvQR.exe
  C:\Windows\System\KhUDvQR.exe
  2⤵
  PID:7492
- C:\Windows\System\stLNGiT.exe
  C:\Windows\System\stLNGiT.exe
  2⤵
  PID:7512
- C:\Windows\System\HjjbLwo.exe
  C:\Windows\System\HjjbLwo.exe
  2⤵
  PID:7528
- C:\Windows\System\CSxkCEb.exe
  C:\Windows\System\CSxkCEb.exe
  2⤵
  PID:7544
- C:\Windows\System\mYhdWIP.exe
  C:\Windows\System\mYhdWIP.exe
  2⤵
  PID:7568
- C:\Windows\System\kWBZgOU.exe
  C:\Windows\System\kWBZgOU.exe
  2⤵
  PID:7600
- C:\Windows\System\UbxkLMa.exe
  C:\Windows\System\UbxkLMa.exe
  2⤵
  PID:7632
- C:\Windows\System\XQpfaop.exe
  C:\Windows\System\XQpfaop.exe
  2⤵
  PID:7660
- C:\Windows\System\jpWtVKz.exe
  C:\Windows\System\jpWtVKz.exe
  2⤵
  PID:7692
- C:\Windows\System\boyTVSj.exe
  C:\Windows\System\boyTVSj.exe
  2⤵
  PID:7712
- C:\Windows\System\rayTBbv.exe
  C:\Windows\System\rayTBbv.exe
  2⤵
  PID:7744
- C:\Windows\System\tjlRTkv.exe
  C:\Windows\System\tjlRTkv.exe
  2⤵
  PID:7772
- C:\Windows\System\xdACTHX.exe
  C:\Windows\System\xdACTHX.exe
  2⤵
  PID:7788
- C:\Windows\System\pBPiWtj.exe
  C:\Windows\System\pBPiWtj.exe
  2⤵
  PID:7812
- C:\Windows\System\XqHCaOU.exe
  C:\Windows\System\XqHCaOU.exe
  2⤵
  PID:7828
- C:\Windows\System\QOrMYRR.exe
  C:\Windows\System\QOrMYRR.exe
  2⤵
  PID:7844
- C:\Windows\System\wVFhmVZ.exe
  C:\Windows\System\wVFhmVZ.exe
  2⤵
  PID:7860
- C:\Windows\System\leYtRSP.exe
  C:\Windows\System\leYtRSP.exe
  2⤵
  PID:7876
- C:\Windows\System\kexwvoH.exe
  C:\Windows\System\kexwvoH.exe
  2⤵
  PID:7892
- C:\Windows\System\qDILMoo.exe
  C:\Windows\System\qDILMoo.exe
  2⤵
  PID:7908
- C:\Windows\System\WArtNNU.exe
  C:\Windows\System\WArtNNU.exe
  2⤵
  PID:7924
- C:\Windows\System\yAxHkfS.exe
  C:\Windows\System\yAxHkfS.exe
  2⤵
  PID:7940
- C:\Windows\System\DLaXLxh.exe
  C:\Windows\System\DLaXLxh.exe
  2⤵
  PID:7956
- C:\Windows\System\lBNMqUr.exe
  C:\Windows\System\lBNMqUr.exe
  2⤵
  PID:7972
- C:\Windows\System\leFwmeK.exe
  C:\Windows\System\leFwmeK.exe
  2⤵
  PID:8000
- C:\Windows\System\nQrTpWI.exe
  C:\Windows\System\nQrTpWI.exe
  2⤵
  PID:8032
- C:\Windows\System\chRfZTr.exe
  C:\Windows\System\chRfZTr.exe
  2⤵
  PID:8072
- C:\Windows\System\RApkhkb.exe
  C:\Windows\System\RApkhkb.exe
  2⤵
  PID:8112
- C:\Windows\System\tzHhdZX.exe
  C:\Windows\System\tzHhdZX.exe
  2⤵
  PID:8152
- C:\Windows\System\Ssgqqle.exe
  C:\Windows\System\Ssgqqle.exe
  2⤵
  PID:8188
- C:\Windows\System\hbBxwAT.exe
  C:\Windows\System\hbBxwAT.exe
  2⤵
  PID:5168
- C:\Windows\System\CIVuFND.exe
  C:\Windows\System\CIVuFND.exe
  2⤵
  PID:5516
- C:\Windows\System\iUZtYIl.exe
  C:\Windows\System\iUZtYIl.exe
  2⤵
  PID:6704
- C:\Windows\System\lmNBEgP.exe
  C:\Windows\System\lmNBEgP.exe
  2⤵
  PID:6348
- C:\Windows\System\wIQjsVi.exe
  C:\Windows\System\wIQjsVi.exe
  2⤵
  PID:6464
- C:\Windows\System\LBDWakD.exe
  C:\Windows\System\LBDWakD.exe
  2⤵
  PID:6512
- C:\Windows\System\UVTSqEi.exe
  C:\Windows\System\UVTSqEi.exe
  2⤵
  PID:6568
- C:\Windows\System\NSOTqAC.exe
  C:\Windows\System\NSOTqAC.exe
  2⤵
  PID:6604
- C:\Windows\System\mHDoYup.exe
  C:\Windows\System\mHDoYup.exe
  2⤵
  PID:6632
- C:\Windows\System\gMIZFDL.exe
  C:\Windows\System\gMIZFDL.exe
  2⤵
  PID:6664
- C:\Windows\System\ZOSSFzy.exe
  C:\Windows\System\ZOSSFzy.exe
  2⤵
  PID:6892
- C:\Windows\System\dmZFTru.exe
  C:\Windows\System\dmZFTru.exe
  2⤵
  PID:2788
- C:\Windows\System\jIYsNxr.exe
  C:\Windows\System\jIYsNxr.exe
  2⤵
  PID:7284
- C:\Windows\System\dXlojOI.exe
  C:\Windows\System\dXlojOI.exe
  2⤵
  PID:7376
- C:\Windows\System\rjRkCOb.exe
  C:\Windows\System\rjRkCOb.exe
  2⤵
  PID:7444
- C:\Windows\System\nLNXohM.exe
  C:\Windows\System\nLNXohM.exe
  2⤵
  PID:7564
- C:\Windows\System\qNITKyl.exe
  C:\Windows\System\qNITKyl.exe
  2⤵
  PID:7656
- C:\Windows\System\klApnzz.exe
  C:\Windows\System\klApnzz.exe
  2⤵
  PID:5968
- C:\Windows\System\UgCFAEC.exe
  C:\Windows\System\UgCFAEC.exe
  2⤵
  PID:6980
- C:\Windows\System\buNfJin.exe
  C:\Windows\System\buNfJin.exe
  2⤵
  PID:8200
- C:\Windows\System\BXahsBq.exe
  C:\Windows\System\BXahsBq.exe
  2⤵
  PID:8268
- C:\Windows\System\UdEHXSo.exe
  C:\Windows\System\UdEHXSo.exe
  2⤵
  PID:8308
- C:\Windows\System\mmJrzOw.exe
  C:\Windows\System\mmJrzOw.exe
  2⤵
  PID:8324
- C:\Windows\System\OqAssyJ.exe
  C:\Windows\System\OqAssyJ.exe
  2⤵
  PID:8352
- C:\Windows\System\kExLsHf.exe
  C:\Windows\System\kExLsHf.exe
  2⤵
  PID:8404
- C:\Windows\System\gfexQYx.exe
  C:\Windows\System\gfexQYx.exe
  2⤵
  PID:8420
- C:\Windows\System\UWpuTth.exe
  C:\Windows\System\UWpuTth.exe
  2⤵
  PID:8436
- C:\Windows\System\UZjSyAq.exe
  C:\Windows\System\UZjSyAq.exe
  2⤵
  PID:8452
- C:\Windows\System\kRbDBDp.exe
  C:\Windows\System\kRbDBDp.exe
  2⤵
  PID:8468
- C:\Windows\System\lFkIKTJ.exe
  C:\Windows\System\lFkIKTJ.exe
  2⤵
  PID:8484
- C:\Windows\System\FlQROPN.exe
  C:\Windows\System\FlQROPN.exe
  2⤵
  PID:8516
- C:\Windows\System\xBUsirH.exe
  C:\Windows\System\xBUsirH.exe
  2⤵
  PID:8532
- C:\Windows\System\mwKbzwz.exe
  C:\Windows\System\mwKbzwz.exe
  2⤵
  PID:8568
- C:\Windows\System\KCCTQNe.exe
  C:\Windows\System\KCCTQNe.exe
  2⤵
  PID:8596
- C:\Windows\System\NigVNQM.exe
  C:\Windows\System\NigVNQM.exe
  2⤵
  PID:8628
- C:\Windows\System\EAIgoBw.exe
  C:\Windows\System\EAIgoBw.exe
  2⤵
  PID:8644
- C:\Windows\System\GuBzyrE.exe
  C:\Windows\System\GuBzyrE.exe
  2⤵
  PID:8660
- C:\Windows\System\GgZGTmg.exe
  C:\Windows\System\GgZGTmg.exe
  2⤵
  PID:8676
- C:\Windows\System\pQMjJrE.exe
  C:\Windows\System\pQMjJrE.exe
  2⤵
  PID:8696
- C:\Windows\System\pRSGHsE.exe
  C:\Windows\System\pRSGHsE.exe
  2⤵
  PID:8712
- C:\Windows\System\fDpChuI.exe
  C:\Windows\System\fDpChuI.exe
  2⤵
  PID:8732
- C:\Windows\System\RdgeChu.exe
  C:\Windows\System\RdgeChu.exe
  2⤵
  PID:8752
- C:\Windows\System\NAfEWMI.exe
  C:\Windows\System\NAfEWMI.exe
  2⤵
  PID:8768
- C:\Windows\System\sYcJueP.exe
  C:\Windows\System\sYcJueP.exe
  2⤵
  PID:8788
- C:\Windows\System\gUzhKoF.exe
  C:\Windows\System\gUzhKoF.exe
  2⤵
  PID:8808
- C:\Windows\System\qDPmyDw.exe
  C:\Windows\System\qDPmyDw.exe
  2⤵
  PID:8824
- C:\Windows\System\gHwMTwq.exe
  C:\Windows\System\gHwMTwq.exe
  2⤵
  PID:8844
- C:\Windows\System\PHdxpyH.exe
  C:\Windows\System\PHdxpyH.exe
  2⤵
  PID:8864
- C:\Windows\System\WAmnkvc.exe
  C:\Windows\System\WAmnkvc.exe
  2⤵
  PID:8884
- C:\Windows\System\BHGeoOe.exe
  C:\Windows\System\BHGeoOe.exe
  2⤵
  PID:8900
- C:\Windows\System\ggibyWl.exe
  C:\Windows\System\ggibyWl.exe
  2⤵
  PID:8920
- C:\Windows\System\iFeeaDo.exe
  C:\Windows\System\iFeeaDo.exe
  2⤵
  PID:8936
- C:\Windows\System\FnkYxQY.exe
  C:\Windows\System\FnkYxQY.exe
  2⤵
  PID:8956
- C:\Windows\System\IxCDfEI.exe
  C:\Windows\System\IxCDfEI.exe
  2⤵
  PID:8976
- C:\Windows\System\vocfvkq.exe
  C:\Windows\System\vocfvkq.exe
  2⤵
  PID:8992
- C:\Windows\System\CVbIltg.exe
  C:\Windows\System\CVbIltg.exe
  2⤵
  PID:9012
- C:\Windows\System\gGaqfyA.exe
  C:\Windows\System\gGaqfyA.exe
  2⤵
  PID:9032
- C:\Windows\System\hUtrdCe.exe
  C:\Windows\System\hUtrdCe.exe
  2⤵
  PID:9052
- C:\Windows\System\IGZvVrQ.exe
  C:\Windows\System\IGZvVrQ.exe
  2⤵
  PID:9068
- C:\Windows\System\pfdamOA.exe
  C:\Windows\System\pfdamOA.exe
  2⤵
  PID:9088
- C:\Windows\System\QmgCaKv.exe
  C:\Windows\System\QmgCaKv.exe
  2⤵
  PID:9108
- C:\Windows\System\KNetgDP.exe
  C:\Windows\System\KNetgDP.exe
  2⤵
  PID:9128
- C:\Windows\System\qlQJPBv.exe
  C:\Windows\System\qlQJPBv.exe
  2⤵
  PID:9144
- C:\Windows\System\RnbJvZX.exe
  C:\Windows\System\RnbJvZX.exe
  2⤵
  PID:9164
- C:\Windows\System\uSWVaAB.exe
  C:\Windows\System\uSWVaAB.exe
  2⤵
  PID:9184
- C:\Windows\System\GweCMPN.exe
  C:\Windows\System\GweCMPN.exe
  2⤵
  PID:9200
- C:\Windows\System\GsVmsnt.exe
  C:\Windows\System\GsVmsnt.exe
  2⤵
  PID:8184
- C:\Windows\System\quVLsSM.exe
  C:\Windows\System\quVLsSM.exe
  2⤵
  PID:432
- C:\Windows\System\dmWuORX.exe
  C:\Windows\System\dmWuORX.exe
  2⤵
  PID:5488
- C:\Windows\System\WmRIySm.exe
  C:\Windows\System\WmRIySm.exe
  2⤵
  PID:5552
- C:\Windows\System\uYUENUJ.exe
  C:\Windows\System\uYUENUJ.exe
  2⤵
  PID:9228
- C:\Windows\System\FPITIZw.exe
  C:\Windows\System\FPITIZw.exe
  2⤵
  PID:9248
- C:\Windows\System\JJCILgv.exe
  C:\Windows\System\JJCILgv.exe
  2⤵
  PID:9264
- C:\Windows\System\gTTXBUi.exe
  C:\Windows\System\gTTXBUi.exe
  2⤵
  PID:9284
- C:\Windows\System\XhRXWCv.exe
  C:\Windows\System\XhRXWCv.exe
  2⤵
  PID:9304
- C:\Windows\System\duwLOPU.exe
  C:\Windows\System\duwLOPU.exe
  2⤵
  PID:9324
- C:\Windows\System\LCnXmkM.exe
  C:\Windows\System\LCnXmkM.exe
  2⤵
  PID:9340
- C:\Windows\System\XQjDrbS.exe
  C:\Windows\System\XQjDrbS.exe
  2⤵
  PID:9360
- C:\Windows\System\bLYwThS.exe
  C:\Windows\System\bLYwThS.exe
  2⤵
  PID:9380
- C:\Windows\System\EpOLJzA.exe
  C:\Windows\System\EpOLJzA.exe
  2⤵
  PID:9396
- C:\Windows\System\oHxZkjw.exe
  C:\Windows\System\oHxZkjw.exe
  2⤵
  PID:9416
- C:\Windows\System\JDxUbdW.exe
  C:\Windows\System\JDxUbdW.exe
  2⤵
  PID:9436
- C:\Windows\System\yGvyCos.exe
  C:\Windows\System\yGvyCos.exe
  2⤵
  PID:9456
- C:\Windows\System\KuSLfWB.exe
  C:\Windows\System\KuSLfWB.exe
  2⤵
  PID:9476
- C:\Windows\System\cjlVYRx.exe
  C:\Windows\System\cjlVYRx.exe
  2⤵
  PID:9496
- C:\Windows\System\QbHYHny.exe
  C:\Windows\System\QbHYHny.exe
  2⤵
  PID:9512
- C:\Windows\System\mugEppN.exe
  C:\Windows\System\mugEppN.exe
  2⤵
  PID:9532
- C:\Windows\System\rWuUgMA.exe
  C:\Windows\System\rWuUgMA.exe
  2⤵
  PID:9552
- C:\Windows\System\VBhFKnz.exe
  C:\Windows\System\VBhFKnz.exe
  2⤵
  PID:9572
- C:\Windows\System\CZXvaaW.exe
  C:\Windows\System\CZXvaaW.exe
  2⤵
  PID:9592
- C:\Windows\System\jPkCXAq.exe
  C:\Windows\System\jPkCXAq.exe
  2⤵
  PID:9612
- C:\Windows\System\NrNtepo.exe
  C:\Windows\System\NrNtepo.exe
  2⤵
  PID:9632
- C:\Windows\System\ArkgyUN.exe
  C:\Windows\System\ArkgyUN.exe
  2⤵
  PID:9648
- C:\Windows\System\TAsnXca.exe
  C:\Windows\System\TAsnXca.exe
  2⤵
  PID:9668
- C:\Windows\System\LFjLFVt.exe
  C:\Windows\System\LFjLFVt.exe
  2⤵
  PID:9688
- C:\Windows\System\UdZQcNL.exe
  C:\Windows\System\UdZQcNL.exe
  2⤵
  PID:9708
- C:\Windows\System\PXxAcpr.exe
  C:\Windows\System\PXxAcpr.exe
  2⤵
  PID:9728
- C:\Windows\System\SyqnQNQ.exe
  C:\Windows\System\SyqnQNQ.exe
  2⤵
  PID:9748
- C:\Windows\System\rYUpoMt.exe
  C:\Windows\System\rYUpoMt.exe
  2⤵
  PID:9764
- C:\Windows\System\iWAAnFJ.exe
  C:\Windows\System\iWAAnFJ.exe
  2⤵
  PID:9784
- C:\Windows\System\ZOvpnWW.exe
  C:\Windows\System\ZOvpnWW.exe
  2⤵
  PID:9804
- C:\Windows\System\PQxArMW.exe
  C:\Windows\System\PQxArMW.exe
  2⤵
  PID:9824
- C:\Windows\System\emCmEwZ.exe
  C:\Windows\System\emCmEwZ.exe
  2⤵
  PID:9848
- C:\Windows\System\TNnlMpr.exe
  C:\Windows\System\TNnlMpr.exe
  2⤵
  PID:9868
- C:\Windows\System\glnfGqO.exe
  C:\Windows\System\glnfGqO.exe
  2⤵
  PID:9888
- C:\Windows\System\zTzfJSy.exe
  C:\Windows\System\zTzfJSy.exe
  2⤵
  PID:9908
- C:\Windows\System\jpIidtE.exe
  C:\Windows\System\jpIidtE.exe
  2⤵
  PID:9924
- C:\Windows\System\zjJjxOn.exe
  C:\Windows\System\zjJjxOn.exe
  2⤵
  PID:9956
- C:\Windows\System\BnAdtNo.exe
  C:\Windows\System\BnAdtNo.exe
  2⤵
  PID:9976
- C:\Windows\System\NOAbwLK.exe
  C:\Windows\System\NOAbwLK.exe
  2⤵
  PID:9992
- C:\Windows\System\RhmHaaV.exe
  C:\Windows\System\RhmHaaV.exe
  2⤵
  PID:10008
- C:\Windows\System\YGZGnJS.exe
  C:\Windows\System\YGZGnJS.exe
  2⤵
  PID:10024
- C:\Windows\System\DlNQSNp.exe
  C:\Windows\System\DlNQSNp.exe
  2⤵
  PID:10044
- C:\Windows\System\eBuitRU.exe
  C:\Windows\System\eBuitRU.exe
  2⤵
  PID:10064
- C:\Windows\System\clwUwSL.exe
  C:\Windows\System\clwUwSL.exe
  2⤵
  PID:10084
- C:\Windows\System\qWuAOSP.exe
  C:\Windows\System\qWuAOSP.exe
  2⤵
  PID:10108
- C:\Windows\System\CNvDIwI.exe
  C:\Windows\System\CNvDIwI.exe
  2⤵
  PID:10124
- C:\Windows\System\EXrYeeQ.exe
  C:\Windows\System\EXrYeeQ.exe
  2⤵
  PID:10148
- C:\Windows\System\WsQswIR.exe
  C:\Windows\System\WsQswIR.exe
  2⤵
  PID:10176
- C:\Windows\System\tvVEJrd.exe
  C:\Windows\System\tvVEJrd.exe
  2⤵
  PID:10196
- C:\Windows\System\mVJSXwP.exe
  C:\Windows\System\mVJSXwP.exe
  2⤵
  PID:10216
- C:\Windows\System\tMaNaDA.exe
  C:\Windows\System\tMaNaDA.exe
  2⤵
  PID:5672
- C:\Windows\System\moGHFos.exe
  C:\Windows\System\moGHFos.exe
  2⤵
  PID:7240
- C:\Windows\System\kpRxDgo.exe
  C:\Windows\System\kpRxDgo.exe
  2⤵
  PID:7272
- C:\Windows\System\QIfkEBe.exe
  C:\Windows\System\QIfkEBe.exe
  2⤵
  PID:7356
- C:\Windows\System\sKlOWrc.exe
  C:\Windows\System\sKlOWrc.exe
  2⤵
  PID:7464
- C:\Windows\System\cDOqgWP.exe
  C:\Windows\System\cDOqgWP.exe
  2⤵
  PID:7520
- C:\Windows\System\PAnKeAr.exe
  C:\Windows\System\PAnKeAr.exe
  2⤵
  PID:7576
- C:\Windows\System\CReSTyM.exe
  C:\Windows\System\CReSTyM.exe
  2⤵
  PID:1008
- C:\Windows\System\ZVkfQVD.exe
  C:\Windows\System\ZVkfQVD.exe
  2⤵
  PID:10244
- C:\Windows\System\CoNFWiL.exe
  C:\Windows\System\CoNFWiL.exe
  2⤵
  PID:10272
- C:\Windows\System\cOEEkMN.exe
  C:\Windows\System\cOEEkMN.exe
  2⤵
  PID:10292
- C:\Windows\System\WkIHVna.exe
  C:\Windows\System\WkIHVna.exe
  2⤵
  PID:10316
- C:\Windows\System\NLtqmhe.exe
  C:\Windows\System\NLtqmhe.exe
  2⤵
  PID:10332
- C:\Windows\System\JTbfTlc.exe
  C:\Windows\System\JTbfTlc.exe
  2⤵
  PID:10360
- C:\Windows\System\kuhUwGg.exe
  C:\Windows\System\kuhUwGg.exe
  2⤵
  PID:10376
- C:\Windows\System\zJwczKS.exe
  C:\Windows\System\zJwczKS.exe
  2⤵
  PID:10400
- C:\Windows\System\HcTjyQA.exe
  C:\Windows\System\HcTjyQA.exe
  2⤵
  PID:10424
- C:\Windows\System\YWsZSsf.exe
  C:\Windows\System\YWsZSsf.exe
  2⤵
  PID:10444
- C:\Windows\System\HQSZWEX.exe
  C:\Windows\System\HQSZWEX.exe
  2⤵
  PID:10468
- C:\Windows\System\UGTQOHT.exe
  C:\Windows\System\UGTQOHT.exe
  2⤵
  PID:10488
- C:\Windows\System\mJfyQuA.exe
  C:\Windows\System\mJfyQuA.exe
  2⤵
  PID:10508
- C:\Windows\System\RCNAgOi.exe
  C:\Windows\System\RCNAgOi.exe
  2⤵
  PID:10532
- C:\Windows\System\WxwWHoa.exe
  C:\Windows\System\WxwWHoa.exe
  2⤵
  PID:10552
- C:\Windows\System\kshyadr.exe
  C:\Windows\System\kshyadr.exe
  2⤵
  PID:10572
- C:\Windows\System\ptLZWSc.exe
  C:\Windows\System\ptLZWSc.exe
  2⤵
  PID:10604
- C:\Windows\System\gNFpLAw.exe
  C:\Windows\System\gNFpLAw.exe
  2⤵
  PID:10620
- C:\Windows\System\WBOvSLU.exe
  C:\Windows\System\WBOvSLU.exe
  2⤵
  PID:10636
- C:\Windows\System\WTkyKUe.exe
  C:\Windows\System\WTkyKUe.exe
  2⤵
  PID:10652
- C:\Windows\System\CsVZKWo.exe
  C:\Windows\System\CsVZKWo.exe
  2⤵
  PID:10668
- C:\Windows\System\wGBSKRu.exe
  C:\Windows\System\wGBSKRu.exe
  2⤵
  PID:10684
- C:\Windows\System\EnZfOte.exe
  C:\Windows\System\EnZfOte.exe
  2⤵
  PID:10704
- C:\Windows\System\ARTzDAm.exe
  C:\Windows\System\ARTzDAm.exe
  2⤵
  PID:10728
- C:\Windows\System\bPMcVCN.exe
  C:\Windows\System\bPMcVCN.exe
  2⤵
  PID:10788
- C:\Windows\System\xxYcbay.exe
  C:\Windows\System\xxYcbay.exe
  2⤵
  PID:10840
- C:\Windows\System\fYzUnPD.exe
  C:\Windows\System\fYzUnPD.exe
  2⤵
  PID:10856
- C:\Windows\System\nSKipwG.exe
  C:\Windows\System\nSKipwG.exe
  2⤵
  PID:10884
- C:\Windows\System\uePCDPD.exe
  C:\Windows\System\uePCDPD.exe
  2⤵
  PID:10908
- C:\Windows\System\qnJmsci.exe
  C:\Windows\System\qnJmsci.exe
  2⤵
  PID:10936
- C:\Windows\System\SbLKomW.exe
  C:\Windows\System\SbLKomW.exe
  2⤵
  PID:10956
- C:\Windows\System\JYuQdjB.exe
  C:\Windows\System\JYuQdjB.exe
  2⤵
  PID:10984
- C:\Windows\System\dIaKhgp.exe
  C:\Windows\System\dIaKhgp.exe
  2⤵
  PID:11000
- C:\Windows\System\hAlPECo.exe
  C:\Windows\System\hAlPECo.exe
  2⤵
  PID:11040
- C:\Windows\System\VTHUZPv.exe
  C:\Windows\System\VTHUZPv.exe
  2⤵
  PID:11076
- C:\Windows\System\jrCdlIT.exe
  C:\Windows\System\jrCdlIT.exe
  2⤵
  PID:11104
- C:\Windows\System\FYKOXMU.exe
  C:\Windows\System\FYKOXMU.exe
  2⤵
  PID:11124
- C:\Windows\System\osGpqaG.exe
  C:\Windows\System\osGpqaG.exe
  2⤵
  PID:11144
- C:\Windows\System\buaeGhI.exe
  C:\Windows\System\buaeGhI.exe
  2⤵
  PID:11164
- C:\Windows\System\evYpUoC.exe
  C:\Windows\System\evYpUoC.exe
  2⤵
  PID:11184
- C:\Windows\System\VWjaNdd.exe
  C:\Windows\System\VWjaNdd.exe
  2⤵
  PID:11208
- C:\Windows\System\PutxlIL.exe
  C:\Windows\System\PutxlIL.exe
  2⤵
  PID:11232
- C:\Windows\System\nZotxMn.exe
  C:\Windows\System\nZotxMn.exe
  2⤵
  PID:11256
- C:\Windows\System\BfvrxhL.exe
  C:\Windows\System\BfvrxhL.exe
  2⤵
  PID:5780
- C:\Windows\System\aoHwGgA.exe
  C:\Windows\System\aoHwGgA.exe
  2⤵
  PID:5916
- C:\Windows\System\IZfhhKl.exe
  C:\Windows\System\IZfhhKl.exe
  2⤵
  PID:6012
- C:\Windows\System\NHhmeoE.exe
  C:\Windows\System\NHhmeoE.exe
  2⤵
  PID:2692
- C:\Windows\System\OWOaswS.exe
  C:\Windows\System\OWOaswS.exe
  2⤵
  PID:5996
- C:\Windows\System\SoesIIW.exe
  C:\Windows\System\SoesIIW.exe
  2⤵
  PID:6088
- C:\Windows\System\IGyWbNB.exe
  C:\Windows\System\IGyWbNB.exe
  2⤵
  PID:7948
- C:\Windows\System\rTlCiFC.exe
  C:\Windows\System\rTlCiFC.exe
  2⤵
  PID:8060
- C:\Windows\System\mBjLwOb.exe
  C:\Windows\System\mBjLwOb.exe
  2⤵
  PID:8296
- C:\Windows\System\crLpRFU.exe
  C:\Windows\System\crLpRFU.exe
  2⤵
  PID:5256
- C:\Windows\System\HryCJdN.exe
  C:\Windows\System\HryCJdN.exe
  2⤵
  PID:8460
- C:\Windows\System\MHxhVoE.exe
  C:\Windows\System\MHxhVoE.exe
  2⤵
  PID:11284
- C:\Windows\System\dODiyzQ.exe
  C:\Windows\System\dODiyzQ.exe
  2⤵
  PID:11300
- C:\Windows\System\YaDYgzV.exe
  C:\Windows\System\YaDYgzV.exe
  2⤵
  PID:12128
- C:\Windows\System\QvouKIA.exe
  C:\Windows\System\QvouKIA.exe
  2⤵
  PID:12160
- C:\Windows\System\pOQUbnp.exe
  C:\Windows\System\pOQUbnp.exe
  2⤵
  PID:12188
- C:\Windows\System\LzIjDjv.exe
  C:\Windows\System\LzIjDjv.exe
  2⤵
  PID:12208
- C:\Windows\System\ICgDcYC.exe
  C:\Windows\System\ICgDcYC.exe
  2⤵
  PID:12228
- C:\Windows\System\gHUWNoQ.exe
  C:\Windows\System\gHUWNoQ.exe
  2⤵
  PID:12252
- C:\Windows\System\lunpWOR.exe
  C:\Windows\System\lunpWOR.exe
  2⤵
  PID:12272
- C:\Windows\System\DGNOIkU.exe
  C:\Windows\System\DGNOIkU.exe
  2⤵
  PID:8584
- C:\Windows\System\MzfXjlz.exe
  C:\Windows\System\MzfXjlz.exe
  2⤵
  PID:8616
- C:\Windows\System\CijqiQU.exe
  C:\Windows\System\CijqiQU.exe
  2⤵
  PID:8656
- C:\Windows\System\lMGCcUz.exe
  C:\Windows\System\lMGCcUz.exe
  2⤵
  PID:8704
- C:\Windows\System\iIXiuQc.exe
  C:\Windows\System\iIXiuQc.exe
  2⤵
  PID:8776
- C:\Windows\System\nKwICBz.exe
  C:\Windows\System\nKwICBz.exe
  2⤵
  PID:8856
- C:\Windows\System\WwBGFHk.exe
  C:\Windows\System\WwBGFHk.exe
  2⤵
  PID:9244
- C:\Windows\System\WdoFdFH.exe
  C:\Windows\System\WdoFdFH.exe
  2⤵
  PID:9368
- C:\Windows\System\yMwQmqh.exe
  C:\Windows\System\yMwQmqh.exe
  2⤵
  PID:6448
- C:\Windows\System\PZMxZTY.exe
  C:\Windows\System\PZMxZTY.exe
  2⤵
  PID:9780
- C:\Windows\System\hFEJTmN.exe
  C:\Windows\System\hFEJTmN.exe
  2⤵
  PID:9800
- C:\Windows\System\GSKTBWZ.exe
  C:\Windows\System\GSKTBWZ.exe
  2⤵
  PID:7396
- C:\Windows\System\YLzbHIl.exe
  C:\Windows\System\YLzbHIl.exe
  2⤵
  PID:9948
- C:\Windows\System\AYmNUBO.exe
  C:\Windows\System\AYmNUBO.exe
  2⤵
  PID:7408
- C:\Windows\System\tJxpFNe.exe
  C:\Windows\System\tJxpFNe.exe
  2⤵
  PID:7432
- C:\Windows\System\miiGzAL.exe
  C:\Windows\System\miiGzAL.exe
  2⤵
  PID:7732
- C:\Windows\System\ZcTkkJH.exe
  C:\Windows\System\ZcTkkJH.exe
  2⤵
  PID:10304
- C:\Windows\System\ptGQJat.exe
  C:\Windows\System\ptGQJat.exe
  2⤵
  PID:10328
- C:\Windows\System\JtzPlaq.exe
  C:\Windows\System\JtzPlaq.exe
  2⤵
  PID:7820
- C:\Windows\System\gMpuPpn.exe
  C:\Windows\System\gMpuPpn.exe
  2⤵
  PID:7872
- C:\Windows\System\JeZKimC.exe
  C:\Windows\System\JeZKimC.exe
  2⤵
  PID:7964
- C:\Windows\System\SoWmBtX.exe
  C:\Windows\System\SoWmBtX.exe
  2⤵
  PID:8240
- C:\Windows\System\vgwYPDM.exe
  C:\Windows\System\vgwYPDM.exe
  2⤵
  PID:11196
- C:\Windows\System\AIRrGeb.exe
  C:\Windows\System\AIRrGeb.exe
  2⤵
  PID:11252
- C:\Windows\System\JMwoAOD.exe
  C:\Windows\System\JMwoAOD.exe
  2⤵
  PID:6760
- C:\Windows\System\EbhWvOz.exe
  C:\Windows\System\EbhWvOz.exe
  2⤵
  PID:11272
- C:\Windows\System\uZUIakt.exe
  C:\Windows\System\uZUIakt.exe
  2⤵
  PID:11332
- C:\Windows\System\mJjczPC.exe
  C:\Windows\System\mJjczPC.exe
  2⤵
  PID:11352
- C:\Windows\System\WJgXiIf.exe
  C:\Windows\System\WJgXiIf.exe
  2⤵
  PID:8912
- C:\Windows\System\LoAdHjp.exe
  C:\Windows\System\LoAdHjp.exe
  2⤵
  PID:8944
- C:\Windows\System\HNKALIX.exe
  C:\Windows\System\HNKALIX.exe
  2⤵
  PID:9220
- C:\Windows\System\YltqxuA.exe
  C:\Windows\System\YltqxuA.exe
  2⤵
  PID:9312
- C:\Windows\System\dVaduNr.exe
  C:\Windows\System\dVaduNr.exe
  2⤵
  PID:9336
- C:\Windows\System\QHjCBus.exe
  C:\Windows\System\QHjCBus.exe
  2⤵
  PID:9372
- C:\Windows\System\uEqjrbP.exe
  C:\Windows\System\uEqjrbP.exe
  2⤵
  PID:9388
- C:\Windows\System\bTQIbZG.exe
  C:\Windows\System\bTQIbZG.exe
  2⤵
  PID:9412
- C:\Windows\System\deVHZxC.exe
  C:\Windows\System\deVHZxC.exe
  2⤵
  PID:9444
- C:\Windows\System\dvbsjdr.exe
  C:\Windows\System\dvbsjdr.exe
  2⤵
  PID:9508
- C:\Windows\System\kyWnsYs.exe
  C:\Windows\System\kyWnsYs.exe
  2⤵
  PID:9544
- C:\Windows\System\kYMhvYl.exe
  C:\Windows\System\kYMhvYl.exe
  2⤵
  PID:9568
- C:\Windows\System\OQUHsOp.exe
  C:\Windows\System\OQUHsOp.exe
  2⤵
  PID:9600
- C:\Windows\System\mmwzakf.exe
  C:\Windows\System\mmwzakf.exe
  2⤵
  PID:9628
- C:\Windows\System\EpYKrkM.exe
  C:\Windows\System\EpYKrkM.exe
  2⤵
  PID:6728
- C:\Windows\System\uDJXvPV.exe
  C:\Windows\System\uDJXvPV.exe
  2⤵
  PID:9720
- C:\Windows\System\AMJTfYo.exe
  C:\Windows\System\AMJTfYo.exe
  2⤵
  PID:9756
- C:\Windows\System\wdlFYOb.exe
  C:\Windows\System\wdlFYOb.exe
  2⤵
  PID:9864
- C:\Windows\System\MlqkUHt.exe
  C:\Windows\System\MlqkUHt.exe
  2⤵
  PID:11580
- C:\Windows\System\eYFsySA.exe
  C:\Windows\System\eYFsySA.exe
  2⤵
  PID:7372
- C:\Windows\System\aZhwigI.exe
  C:\Windows\System\aZhwigI.exe
  2⤵
  PID:12300
- C:\Windows\System\eUDFJei.exe
  C:\Windows\System\eUDFJei.exe
  2⤵
  PID:12320
- C:\Windows\System\LhwrsDd.exe
  C:\Windows\System\LhwrsDd.exe
  2⤵
  PID:12344
- C:\Windows\System\BHnEWSR.exe
  C:\Windows\System\BHnEWSR.exe
  2⤵
  PID:12364
- C:\Windows\System\SpUWbAA.exe
  C:\Windows\System\SpUWbAA.exe
  2⤵
  PID:12380
- C:\Windows\System\bbdeYlu.exe
  C:\Windows\System\bbdeYlu.exe
  2⤵
  PID:12404
- C:\Windows\System\dtnkWXd.exe
  C:\Windows\System\dtnkWXd.exe
  2⤵
  PID:12432
- C:\Windows\System\iTtlMvy.exe
  C:\Windows\System\iTtlMvy.exe
  2⤵
  PID:12452
- C:\Windows\System\CzTqAgd.exe
  C:\Windows\System\CzTqAgd.exe
  2⤵
  PID:12472
- C:\Windows\System\LUBuoXU.exe
  C:\Windows\System\LUBuoXU.exe
  2⤵
  PID:12508
- C:\Windows\System\NffHSzW.exe
  C:\Windows\System\NffHSzW.exe
  2⤵
  PID:12532
- C:\Windows\System\bSljvLK.exe
  C:\Windows\System\bSljvLK.exe
  2⤵
  PID:12552
- C:\Windows\System\FMlhIbP.exe
  C:\Windows\System\FMlhIbP.exe
  2⤵
  PID:12576
- C:\Windows\System\WxAYKrU.exe
  C:\Windows\System\WxAYKrU.exe
  2⤵
  PID:12592
- C:\Windows\System\KvwPiza.exe
  C:\Windows\System\KvwPiza.exe
  2⤵
  PID:12624
- C:\Windows\System\apHygAO.exe
  C:\Windows\System\apHygAO.exe
  2⤵
  PID:12640
- C:\Windows\System\WSWvUjo.exe
  C:\Windows\System\WSWvUjo.exe
  2⤵
  PID:12668
- C:\Windows\System\HLSpvBK.exe
  C:\Windows\System\HLSpvBK.exe
  2⤵
  PID:12692
- C:\Windows\System\lNQxrRk.exe
  C:\Windows\System\lNQxrRk.exe
  2⤵
  PID:12864
- C:\Windows\System\jGLoopy.exe
  C:\Windows\System\jGLoopy.exe
  2⤵
  PID:12916
- C:\Windows\System\GtTYdpB.exe
  C:\Windows\System\GtTYdpB.exe
  2⤵
  PID:12932
- C:\Windows\System\CYOeuDJ.exe
  C:\Windows\System\CYOeuDJ.exe
  2⤵
  PID:12948
- C:\Windows\System\lNZtPqs.exe
  C:\Windows\System\lNZtPqs.exe
  2⤵
  PID:12968
- C:\Windows\System\sqnjYkF.exe
  C:\Windows\System\sqnjYkF.exe
  2⤵
  PID:12988
- C:\Windows\System\zrPkoLt.exe
  C:\Windows\System\zrPkoLt.exe
  2⤵
  PID:13004
- C:\Windows\System\xwpdFVK.exe
  C:\Windows\System\xwpdFVK.exe
  2⤵
  PID:13020
- C:\Windows\System\BkxsRWJ.exe
  C:\Windows\System\BkxsRWJ.exe
  2⤵
  PID:13036
- C:\Windows\System\rjRhUZN.exe
  C:\Windows\System\rjRhUZN.exe
  2⤵
  PID:13052
- C:\Windows\System\nYgURxd.exe
  C:\Windows\System\nYgURxd.exe
  2⤵
  PID:13068
- C:\Windows\System\PvzszGK.exe
  C:\Windows\System\PvzszGK.exe
  2⤵
  PID:13084
- C:\Windows\System\qWwmuYf.exe
  C:\Windows\System\qWwmuYf.exe
  2⤵
  PID:13112
- C:\Windows\System\HVBhEcf.exe
  C:\Windows\System\HVBhEcf.exe
  2⤵
  PID:13128
- C:\Windows\System\wHUKRab.exe
  C:\Windows\System\wHUKRab.exe
  2⤵
  PID:13148
- C:\Windows\System\ValJPqU.exe
  C:\Windows\System\ValJPqU.exe
  2⤵
  PID:13168
- C:\Windows\System\uiuKYkM.exe
  C:\Windows\System\uiuKYkM.exe
  2⤵
  PID:13192
- C:\Windows\System\rZKWFEH.exe
  C:\Windows\System\rZKWFEH.exe
  2⤵
  PID:13236
- C:\Windows\System\uFZsDIF.exe
  C:\Windows\System\uFZsDIF.exe
  2⤵
  PID:13260
- C:\Windows\System\HYevvmT.exe
  C:\Windows\System\HYevvmT.exe
  2⤵
  PID:13280
- C:\Windows\System\cZeGMpD.exe
  C:\Windows\System\cZeGMpD.exe
  2⤵
  PID:13300
- C:\Windows\System\ZMVGLtu.exe
  C:\Windows\System\ZMVGLtu.exe
  2⤵
  PID:6740
- C:\Windows\System\fnsyAVQ.exe
  C:\Windows\System\fnsyAVQ.exe
  2⤵
  PID:10580
- C:\Windows\System\dQPfxxD.exe
  C:\Windows\System\dQPfxxD.exe
  2⤵
  PID:316
- C:\Windows\System\EdBuCIa.exe
  C:\Windows\System\EdBuCIa.exe
  2⤵
  PID:7740
- C:\Windows\System\ggWDWXZ.exe
  C:\Windows\System\ggWDWXZ.exe
  2⤵
  PID:8428
- C:\Windows\System\krIWYiO.exe
  C:\Windows\System\krIWYiO.exe
  2⤵
  PID:6048
- C:\Windows\System\ZcARSAH.exe
  C:\Windows\System\ZcARSAH.exe
  2⤵
  PID:8140
- C:\Windows\System\dTpTVSh.exe
  C:\Windows\System\dTpTVSh.exe
  2⤵
  PID:8556
- C:\Windows\System\BAdcoho.exe
  C:\Windows\System\BAdcoho.exe
  2⤵
  PID:11276
- C:\Windows\System\SNYmyhR.exe
  C:\Windows\System\SNYmyhR.exe
  2⤵
  PID:8740
- C:\Windows\System\ivpNZfW.exe
  C:\Windows\System\ivpNZfW.exe
  2⤵
  PID:12168
- C:\Windows\System\HdsZXIo.exe
  C:\Windows\System\HdsZXIo.exe
  2⤵
  PID:13348
- C:\Windows\System\UKILfOF.exe
  C:\Windows\System\UKILfOF.exe
  2⤵
  PID:13816
- C:\Windows\System\PMVfrSH.exe
  C:\Windows\System\PMVfrSH.exe
  2⤵
  PID:13836
- C:\Windows\System\dhQOhXx.exe
  C:\Windows\System\dhQOhXx.exe
  2⤵
  PID:13864
- C:\Windows\System\yBBrdfE.exe
  C:\Windows\System\yBBrdfE.exe
  2⤵
  PID:13880
- C:\Windows\System\hForrBd.exe
  C:\Windows\System\hForrBd.exe
  2⤵
  PID:13916
- C:\Windows\System\jpxDqVK.exe
  C:\Windows\System\jpxDqVK.exe
  2⤵
  PID:9156
- C:\Windows\System\wmEcJYn.exe
  C:\Windows\System\wmEcJYn.exe
  2⤵
  PID:9192
- C:\Windows\System\tFgLlZg.exe
  C:\Windows\System\tFgLlZg.exe
  2⤵
  PID:1260
- C:\Windows\System\MwDhqBW.exe
  C:\Windows\System\MwDhqBW.exe
  2⤵
  PID:10628
- C:\Windows\System\kpNVJTT.exe
  C:\Windows\System\kpNVJTT.exe
  2⤵
  PID:10660
- C:\Windows\System\WjSdEfW.exe
  C:\Windows\System\WjSdEfW.exe
  2⤵
  PID:10700
- C:\Windows\System\inZgyIB.exe
  C:\Windows\System\inZgyIB.exe
  2⤵
  PID:10744
- C:\Windows\System\vJhRcZL.exe
  C:\Windows\System\vJhRcZL.exe
  2⤵
  PID:10796
- C:\Windows\System\pdRSCXX.exe
  C:\Windows\System\pdRSCXX.exe
  2⤵
  PID:11172
- C:\Windows\System\HSAVsMa.exe
  C:\Windows\System\HSAVsMa.exe
  2⤵
  PID:5772
- C:\Windows\System\owRrslu.exe
  C:\Windows\System\owRrslu.exe
  2⤵
  PID:3280
- C:\Windows\System\AhfbVZk.exe
  C:\Windows\System\AhfbVZk.exe
  2⤵
  PID:4596
- C:\Windows\System\cZvbJMs.exe
  C:\Windows\System\cZvbJMs.exe
  2⤵
  PID:4068
- C:\Windows\System\zwcawyc.exe
  C:\Windows\System\zwcawyc.exe
  2⤵
  PID:8576
- C:\Windows\System\TEEvaTg.exe
  C:\Windows\System\TEEvaTg.exe
  2⤵
  PID:8748
- C:\Windows\System\ctmLcXX.exe
  C:\Windows\System\ctmLcXX.exe
  2⤵
  PID:12224
- C:\Windows\System\AjdxuFK.exe
  C:\Windows\System\AjdxuFK.exe
  2⤵
  PID:13356
- C:\Windows\System\gqfyrYE.exe
  C:\Windows\System\gqfyrYE.exe
  2⤵
  PID:8764
- C:\Windows\System\fRggRIS.exe
  C:\Windows\System\fRggRIS.exe
  2⤵
  PID:7016
- C:\Windows\System\rAHrgkt.exe
  C:\Windows\System\rAHrgkt.exe
  2⤵
  PID:9840
- C:\Windows\System\tHuwPYe.exe
  C:\Windows\System\tHuwPYe.exe
  2⤵
  PID:13444
- C:\Windows\System\RGheLan.exe
  C:\Windows\System\RGheLan.exe
  2⤵
  PID:13712
- C:\Windows\System\zaHOCUU.exe
  C:\Windows\System\zaHOCUU.exe
  2⤵
  PID:12544
- C:\Windows\System\prRiQMh.exe
  C:\Windows\System\prRiQMh.exe
  2⤵
  PID:12564
- C:\Windows\System\gMRvsRV.exe
  C:\Windows\System\gMRvsRV.exe
  2⤵
  PID:12620
- C:\Windows\System\VsdLtek.exe
  C:\Windows\System\VsdLtek.exe
  2⤵
  PID:12656
- C:\Windows\System\BFiuorX.exe
  C:\Windows\System\BFiuorX.exe
  2⤵
  PID:12804
- C:\Windows\System\OzhOyBB.exe
  C:\Windows\System\OzhOyBB.exe
  2⤵
  PID:12872
- C:\Windows\System\urYgtQB.exe
  C:\Windows\System\urYgtQB.exe
  2⤵
  PID:12980
- C:\Windows\System\oCFMXwE.exe
  C:\Windows\System\oCFMXwE.exe
  2⤵
  PID:14000
- C:\Windows\System\LnyqMbs.exe
  C:\Windows\System\LnyqMbs.exe
  2⤵
  PID:13120
- C:\Windows\System\vFHjNoo.exe
  C:\Windows\System\vFHjNoo.exe
  2⤵
  PID:14140
- C:\Windows\System\DOFFvKC.exe
  C:\Windows\System\DOFFvKC.exe
  2⤵
  PID:9100
- C:\Windows\System\MnELzBP.exe
  C:\Windows\System\MnELzBP.exe
  2⤵
  PID:13592
- C:\Windows\System\IKMYrkq.exe
  C:\Windows\System\IKMYrkq.exe
  2⤵
  PID:13704
- C:\Windows\System\ulvuUUQ.exe
  C:\Windows\System\ulvuUUQ.exe
  2⤵
  PID:13764
- C:\Windows\System\LpQzhYo.exe
  C:\Windows\System\LpQzhYo.exe
  2⤵
  PID:14132
- C:\Windows\System\PTuKrpn.exe
  C:\Windows\System\PTuKrpn.exe
  2⤵
  PID:13844
- C:\Windows\System\eOzbqtm.exe
  C:\Windows\System\eOzbqtm.exe
  2⤵
  PID:13872
- C:\Windows\System\LvQpnqN.exe
  C:\Windows\System\LvQpnqN.exe
  2⤵
  PID:13896
- C:\Windows\System\vrPPRAV.exe
  C:\Windows\System\vrPPRAV.exe
  2⤵
  PID:13912
- C:\Windows\System\HaIlcea.exe
  C:\Windows\System\HaIlcea.exe
  2⤵
  PID:13944
- C:\Windows\System\avNNQbX.exe
  C:\Windows\System\avNNQbX.exe
  2⤵
  PID:13964
- C:\Windows\System\HWnDcIk.exe
  C:\Windows\System\HWnDcIk.exe
  2⤵
  PID:13988
- C:\Windows\System\aeAKGAL.exe
  C:\Windows\System\aeAKGAL.exe
  2⤵
  PID:14092
- C:\Windows\System\vqKzFlA.exe
  C:\Windows\System\vqKzFlA.exe
  2⤵
  PID:14168
- C:\Windows\System\wqNIVDi.exe
  C:\Windows\System\wqNIVDi.exe
  2⤵
  PID:14232
- C:\Windows\System\nZgVIDZ.exe
  C:\Windows\System\nZgVIDZ.exe
  2⤵
  PID:3396
- C:\Windows\System\WSeuexJ.exe
  C:\Windows\System\WSeuexJ.exe
  2⤵
  PID:14284
- C:\Windows\System\RxRkvET.exe
  C:\Windows\System\RxRkvET.exe
  2⤵
  PID:14304
- C:\Windows\System\BmuIEXM.exe
  C:\Windows\System\BmuIEXM.exe
  2⤵
  PID:14324
- C:\Windows\System\GBxVtZK.exe
  C:\Windows\System\GBxVtZK.exe
  2⤵
  PID:8968
- C:\Windows\System\WJqUeMA.exe
  C:\Windows\System\WJqUeMA.exe
  2⤵
  PID:9004
- C:\Windows\System\iCwnIES.exe
  C:\Windows\System\iCwnIES.exe
  2⤵
  PID:5500
- C:\Windows\System\MhyATiZ.exe
  C:\Windows\System\MhyATiZ.exe
  2⤵
  PID:11588
- C:\Windows\System\TMJSwMQ.exe
  C:\Windows\System\TMJSwMQ.exe
  2⤵
  PID:4920
- C:\Windows\System\vDMbpZp.exe
  C:\Windows\System\vDMbpZp.exe
  2⤵
  PID:10100
- C:\Windows\System\kFjKXIc.exe
  C:\Windows\System\kFjKXIc.exe
  2⤵
  PID:10504
- C:\Windows\System\HlxOmVp.exe
  C:\Windows\System\HlxOmVp.exe
  2⤵
  PID:4712
- C:\Windows\System\AJdnXdc.exe
  C:\Windows\System\AJdnXdc.exe
  2⤵
  PID:10368
- C:\Windows\System\itCYyjO.exe
  C:\Windows\System\itCYyjO.exe
  2⤵
  PID:10996
- C:\Windows\System\BuZulVi.exe
  C:\Windows\System\BuZulVi.exe
  2⤵
  PID:10464
- C:\Windows\System\rYrrbIa.exe
  C:\Windows\System\rYrrbIa.exe
  2⤵
  PID:11136
- C:\Windows\System\sfdcslk.exe
  C:\Windows\System\sfdcslk.exe
  2⤵
  PID:3548
- C:\Windows\System\wZEulzo.exe
  C:\Windows\System\wZEulzo.exe
  2⤵
  PID:5400
- C:\Windows\System\HhNTUrR.exe
  C:\Windows\System\HhNTUrR.exe
  2⤵
  PID:10384
- C:\Windows\System\NnKRiaO.exe
  C:\Windows\System\NnKRiaO.exe
  2⤵
  PID:11484
- C:\Windows\System\nJOlfcj.exe
  C:\Windows\System\nJOlfcj.exe
  2⤵
  PID:13296
- C:\Windows\System\MJLCSVE.exe
  C:\Windows\System\MJLCSVE.exe
  2⤵
  PID:8476
- C:\Windows\System\fvpiaqT.exe
  C:\Windows\System\fvpiaqT.exe
  2⤵
  PID:11120
- C:\Windows\System\TXKnCdv.exe
  C:\Windows\System\TXKnCdv.exe
  2⤵
  PID:11368
- C:\Windows\System\wZhDiFN.exe
  C:\Windows\System\wZhDiFN.exe
  2⤵
  PID:8880
- C:\Windows\System\YwWKPmo.exe
  C:\Windows\System\YwWKPmo.exe
  2⤵
  PID:10616
- C:\Windows\System\gBFSoVJ.exe
  C:\Windows\System\gBFSoVJ.exe
  2⤵
  PID:10716
- C:\Windows\System\UhiSEzb.exe
  C:\Windows\System\UhiSEzb.exe
  2⤵
  PID:10676
- C:\Windows\System\EHHgzvb.exe
  C:\Windows\System\EHHgzvb.exe
  2⤵
  PID:10804
- C:\Windows\System\JfCfwYW.exe
  C:\Windows\System\JfCfwYW.exe
  2⤵
  PID:9624
- C:\Windows\System\UPNajcO.exe
  C:\Windows\System\UPNajcO.exe
  2⤵
  PID:8552
- C:\Windows\System\LPvDSOJ.exe
  C:\Windows\System\LPvDSOJ.exe
  2⤵
  PID:13404
- C:\Windows\System\WGGVAQm.exe
  C:\Windows\System\WGGVAQm.exe
  2⤵
  PID:10020
- C:\Windows\System\LZEUSem.exe
  C:\Windows\System\LZEUSem.exe
  2⤵
  PID:14100
- C:\Windows\System\hzcqAdp.exe
  C:\Windows\System\hzcqAdp.exe
  2⤵
  PID:13472
- C:\Windows\System\JEqnTRW.exe
  C:\Windows\System\JEqnTRW.exe
  2⤵
  PID:7800
- C:\Windows\System\PebjzxZ.exe
  C:\Windows\System\PebjzxZ.exe
  2⤵
  PID:12024
- C:\Windows\System\xfVELbu.exe
  C:\Windows\System\xfVELbu.exe
  2⤵
  PID:9320
- C:\Windows\System\nKCHXNn.exe
  C:\Windows\System\nKCHXNn.exe
  2⤵
  PID:12072
- C:\Windows\System\SWbfBZv.exe
  C:\Windows\System\SWbfBZv.exe
  2⤵
  PID:13308
- C:\Windows\System\uOougec.exe
  C:\Windows\System\uOougec.exe
  2⤵
  PID:10952
- C:\Windows\System\KntYuOq.exe
  C:\Windows\System\KntYuOq.exe
  2⤵
  PID:12500
- C:\Windows\System\CpnjAoo.exe
  C:\Windows\System\CpnjAoo.exe
  2⤵
  PID:828
- C:\Windows\System\finkigi.exe
  C:\Windows\System\finkigi.exe
  2⤵
  PID:13096
- C:\Windows\System\HBpEEoB.exe
  C:\Windows\System\HBpEEoB.exe
  2⤵
  PID:2792
- C:\Windows\System\reXkHwe.exe
  C:\Windows\System\reXkHwe.exe
  2⤵
  PID:10224
- C:\Windows\System\HBYcfHB.exe
  C:\Windows\System\HBYcfHB.exe
  2⤵
  PID:7500
- C:\Windows\System\YANEflK.exe
  C:\Windows\System\YANEflK.exe
  2⤵
  PID:5564
- C:\Windows\System\WmUNSyu.exe
  C:\Windows\System\WmUNSyu.exe
  2⤵
  PID:10644
- C:\Windows\System\PHIasWh.exe
  C:\Windows\System\PHIasWh.exe
  2⤵
  PID:12444
- C:\Windows\System\LybJnJw.exe
  C:\Windows\System\LybJnJw.exe
  2⤵
  PID:10976
- C:\Windows\System\SwysSmX.exe
  C:\Windows\System\SwysSmX.exe
  2⤵
  PID:8652
- C:\Windows\System\mATDsjZ.exe
  C:\Windows\System\mATDsjZ.exe
  2⤵
  PID:10904
- C:\Windows\System\yVaCipv.exe
  C:\Windows\System\yVaCipv.exe
  2⤵
  PID:6176
- C:\Windows\System\gOOztHU.exe
  C:\Windows\System\gOOztHU.exe
  2⤵
  PID:6260
- C:\Windows\System\YAudDHD.exe
  C:\Windows\System\YAudDHD.exe
  2⤵
  PID:6252
- C:\Windows\System\jMHQkqt.exe
  C:\Windows\System\jMHQkqt.exe
  2⤵
  PID:14112
- C:\Windows\System\tKcSihg.exe
  C:\Windows\System\tKcSihg.exe
  2⤵
  PID:14224
- C:\Windows\System\CbLzpVK.exe
  C:\Windows\System\CbLzpVK.exe
  2⤵
  PID:6256
- C:\Windows\System\szipUXq.exe
  C:\Windows\System\szipUXq.exe
  2⤵
  PID:6288
- C:\Windows\System\UsGgCxi.exe
  C:\Windows\System\UsGgCxi.exe
  2⤵
  PID:10236
- C:\Windows\System\mkJGBCZ.exe
  C:\Windows\System\mkJGBCZ.exe
  2⤵
  PID:13204
- C:\Windows\System\VxxcGrC.exe
  C:\Windows\System\VxxcGrC.exe
  2⤵
  PID:11036
- C:\Windows\System\JErqsjh.exe
  C:\Windows\System\JErqsjh.exe
  2⤵
  PID:10568
- C:\Windows\System\cTWMvoq.exe
  C:\Windows\System\cTWMvoq.exe
  2⤵
  PID:11116
- C:\Windows\System\jCJSpKZ.exe
  C:\Windows\System\jCJSpKZ.exe
  2⤵
  PID:10868
- C:\Windows\System\tcilNAM.exe
  C:\Windows\System\tcilNAM.exe
  2⤵
  PID:11528
- C:\Windows\System\GjQbaNb.exe
  C:\Windows\System\GjQbaNb.exe
  2⤵
  PID:10452
- C:\Windows\System\IhGzQaa.exe
  C:\Windows\System\IhGzQaa.exe
  2⤵
  PID:11360
- C:\Windows\System\rWJZgWK.exe
  C:\Windows\System\rWJZgWK.exe
  2⤵
  PID:13384
- C:\Windows\System\QMRcpNZ.exe
  C:\Windows\System\QMRcpNZ.exe
  2⤵
  PID:13388
- C:\Windows\System\AIGIJcC.exe
  C:\Windows\System\AIGIJcC.exe
  2⤵
  PID:8840
- C:\Windows\System\HnbMbjm.exe
  C:\Windows\System\HnbMbjm.exe
  2⤵
  PID:14228
- C:\Windows\System\mnbYTVU.exe
  C:\Windows\System\mnbYTVU.exe
  2⤵
  PID:6588
- C:\Windows\System\yrSPDYW.exe
  C:\Windows\System\yrSPDYW.exe
  2⤵
  PID:11052
- C:\Windows\System\YlCAoKF.exe
  C:\Windows\System\YlCAoKF.exe
  2⤵
  PID:6576
- C:\Windows\System\rwcxJcT.exe
  C:\Windows\System\rwcxJcT.exe
  2⤵
  PID:5712
- C:\Windows\System\YbFUHEv.exe
  C:\Windows\System\YbFUHEv.exe
  2⤵
  PID:14080
- C:\Windows\System\WKrPziX.exe
  C:\Windows\System\WKrPziX.exe
  2⤵
  PID:6292
- C:\Windows\System\MTwlwlH.exe
  C:\Windows\System\MTwlwlH.exe
  2⤵
  PID:14236
- C:\Windows\System\PhpSkxL.exe
  C:\Windows\System\PhpSkxL.exe
  2⤵
  PID:12060
- C:\Windows\System\bMBKyOj.exe
  C:\Windows\System\bMBKyOj.exe
  2⤵
  PID:13632
- C:\Windows\System\eTpbDYL.exe
  C:\Windows\System\eTpbDYL.exe
  2⤵
  PID:11696
- C:\Windows\System\VfjUhKM.exe
  C:\Windows\System\VfjUhKM.exe
  2⤵
  PID:12588
- C:\Windows\System\CQRKVnR.exe
  C:\Windows\System\CQRKVnR.exe
  2⤵
  PID:13064
- C:\Windows\System\IuGYXkX.exe
  C:\Windows\System\IuGYXkX.exe
  2⤵
  PID:848
- C:\Windows\System\BrpLEPI.exe
  C:\Windows\System\BrpLEPI.exe
  2⤵
  PID:9468
- C:\Windows\System\Wltqlhw.exe
  C:\Windows\System\Wltqlhw.exe
  2⤵
  PID:3352
- C:\Windows\System\cplVnys.exe
  C:\Windows\System\cplVnys.exe
  2⤵
  PID:10964
- C:\Windows\System\mloVmTE.exe
  C:\Windows\System\mloVmTE.exe
  2⤵
  PID:13928
- C:\Windows\System\GfBostG.exe
  C:\Windows\System\GfBostG.exe
  2⤵
  PID:4660
- C:\Windows\System\RivBKAQ.exe
  C:\Windows\System\RivBKAQ.exe
  2⤵
  PID:6816
- C:\Windows\System\veElfsu.exe
  C:\Windows\System\veElfsu.exe
  2⤵
  PID:10104
- C:\Windows\System\gSXWMVQ.exe
  C:\Windows\System\gSXWMVQ.exe
  2⤵
  PID:1276
- C:\Windows\System\XOHKHSk.exe
  C:\Windows\System\XOHKHSk.exe
  2⤵
  PID:12120
- C:\Windows\System\RFdACrI.exe
  C:\Windows\System\RFdACrI.exe
  2⤵
  PID:12568
- C:\Windows\System\vUquqxK.exe
  C:\Windows\System\vUquqxK.exe
  2⤵
  PID:9024
- C:\Windows\System\XJWxzwK.exe
  C:\Windows\System\XJWxzwK.exe
  2⤵
  PID:14160
- C:\Windows\System\BLtbQQm.exe
  C:\Windows\System\BLtbQQm.exe
  2⤵
  PID:14312
- C:\Windows\System\saPWoBG.exe
  C:\Windows\System\saPWoBG.exe
  2⤵
  PID:13904
- C:\Windows\System\NjedWqB.exe
  C:\Windows\System\NjedWqB.exe
  2⤵
  PID:12940
- C:\Windows\System\ETiwPuK.exe
  C:\Windows\System\ETiwPuK.exe
  2⤵
  PID:9176
- C:\Windows\System\XRTTsah.exe
  C:\Windows\System\XRTTsah.exe
  2⤵
  PID:5100
- C:\Windows\System\uTtvJgY.exe
  C:\Windows\System\uTtvJgY.exe
  2⤵
  PID:1700
- C:\Windows\System\QlJQnEU.exe
  C:\Windows\System\QlJQnEU.exe
  2⤵
  PID:8876
- C:\Windows\System\DOBLvLI.exe
  C:\Windows\System\DOBLvLI.exe
  2⤵
  PID:12480
- C:\Windows\System\MaMhYlu.exe
  C:\Windows\System\MaMhYlu.exe
  2⤵
  PID:7672
- C:\Windows\System\hzzwTLb.exe
  C:\Windows\System\hzzwTLb.exe
  2⤵
  PID:3892
- C:\Windows\System\trQWLjZ.exe
  C:\Windows\System\trQWLjZ.exe
  2⤵
  PID:4760
- C:\Windows\System\bQpIPkt.exe
  C:\Windows\System\bQpIPkt.exe
  2⤵
  PID:1792
- C:\Windows\System\GNGnXoO.exe
  C:\Windows\System\GNGnXoO.exe
  2⤵
  PID:3408
- C:\Windows\System\vnUNXIt.exe
  C:\Windows\System\vnUNXIt.exe
  2⤵
  PID:10092
- C:\Windows\System\ZFMfvop.exe
  C:\Windows\System\ZFMfvop.exe
  2⤵
  PID:752
- C:\Windows\System\bjsONkz.exe
  C:\Windows\System\bjsONkz.exe
  2⤵
  PID:11096
- C:\Windows\System\tAIPsdN.exe
  C:\Windows\System\tAIPsdN.exe
  2⤵
  PID:6284
- C:\Windows\System\myqaALk.exe
  C:\Windows\System\myqaALk.exe
  2⤵
  PID:14056
- C:\Windows\System\YGzbysW.exe
  C:\Windows\System\YGzbysW.exe
  2⤵
  PID:13516
- C:\Windows\System\kCfStCx.exe
  C:\Windows\System\kCfStCx.exe
  2⤵
  PID:14116
- C:\Windows\System\CwTSQFT.exe
  C:\Windows\System\CwTSQFT.exe
  2⤵
  PID:13576
- C:\Windows\System\oVqJnJr.exe
  C:\Windows\System\oVqJnJr.exe
  2⤵
  PID:14104
- C:\Windows\System\BoVSdor.exe
  C:\Windows\System\BoVSdor.exe
  2⤵
  PID:13372
- C:\Windows\System\TKSRzYE.exe
  C:\Windows\System\TKSRzYE.exe
  2⤵
  PID:11816
- C:\Windows\System\NuuOLPD.exe
  C:\Windows\System\NuuOLPD.exe
  2⤵
  PID:9236
- C:\Windows\System\pVtCtGy.exe
  C:\Windows\System\pVtCtGy.exe
  2⤵
  PID:3468
- C:\Windows\System\zRzcWKu.exe
  C:\Windows\System\zRzcWKu.exe
  2⤵
  PID:14156
- C:\Windows\System\eYWBXzH.exe
  C:\Windows\System\eYWBXzH.exe
  2⤵
  PID:14292
- C:\Windows\System\fkxCdpu.exe
  C:\Windows\System\fkxCdpu.exe
  2⤵
  PID:9028
- C:\Windows\System\bropAam.exe
  C:\Windows\System\bropAam.exe
  2⤵
  PID:13744
- C:\Windows\System\fsZJVsp.exe
  C:\Windows\System\fsZJVsp.exe
  2⤵
  PID:8692
- C:\Windows\System\PnwVfqd.exe
  C:\Windows\System\PnwVfqd.exe
  2⤵
  PID:13556
- C:\Windows\System\vjGugGV.exe
  C:\Windows\System\vjGugGV.exe
  2⤵
  PID:11644
- C:\Windows\System\mrKuHmj.exe
  C:\Windows\System\mrKuHmj.exe
  2⤵
  PID:844
- C:\Windows\System\BFOHjyL.exe
  C:\Windows\System\BFOHjyL.exe
  2⤵
  PID:13992
- C:\Windows\System\qjyuDIc.exe
  C:\Windows\System\qjyuDIc.exe
  2⤵
  PID:1756
- C:\Windows\System\mkljuSz.exe
  C:\Windows\System\mkljuSz.exe
  2⤵
  PID:3932
- C:\Windows\System\uCHkyCY.exe
  C:\Windows\System\uCHkyCY.exe
  2⤵
  PID:2776
- C:\Windows\System\yHWzOel.exe
  C:\Windows\System\yHWzOel.exe
  2⤵
  PID:9484
- C:\Windows\System\oEZSEij.exe
  C:\Windows\System\oEZSEij.exe
  2⤵
  PID:9064
- C:\Windows\System\rijeYbG.exe
  C:\Windows\System\rijeYbG.exe
  2⤵
  PID:13552
- C:\Windows\System\aIchQSE.exe
  C:\Windows\System\aIchQSE.exe
  2⤵
  PID:1124
- C:\Windows\System\RdVnuKR.exe
  C:\Windows\System\RdVnuKR.exe
  2⤵
  PID:6124
- C:\Windows\System\TtKTXwO.exe
  C:\Windows\System\TtKTXwO.exe
  2⤵
  PID:2012
- C:\Windows\System\SANLvFF.exe
  C:\Windows\System\SANLvFF.exe
  2⤵
  PID:13436
- C:\Windows\System\bfRheGI.exe
  C:\Windows\System\bfRheGI.exe
  2⤵
  PID:13828
- C:\Windows\System\AbpjWjQ.exe
  C:\Windows\System\AbpjWjQ.exe
  2⤵
  PID:11344
- C:\Windows\System\hSFQPSj.exe
  C:\Windows\System\hSFQPSj.exe
  2⤵
  PID:11544
- C:\Windows\System\fdcFMZi.exe
  C:\Windows\System\fdcFMZi.exe
  2⤵
  PID:13400
- C:\Windows\System\iIntMAl.exe
  C:\Windows\System\iIntMAl.exe
  2⤵
  PID:11292
- C:\Windows\System\YnprJOD.exe
  C:\Windows\System\YnprJOD.exe
  2⤵
  PID:9020
- C:\Windows\System\wnkTzWy.exe
  C:\Windows\System\wnkTzWy.exe
  2⤵
  PID:5444
- C:\Windows\System\SBeyTmk.exe
  C:\Windows\System\SBeyTmk.exe
  2⤵
  PID:3288
- C:\Windows\System\bmPDFfk.exe
  C:\Windows\System\bmPDFfk.exe
  2⤵
  PID:5084
- C:\Windows\System\xkwwegJ.exe
  C:\Windows\System\xkwwegJ.exe
  2⤵
  PID:13496
- C:\Windows\System\dGoZzwQ.exe
  C:\Windows\System\dGoZzwQ.exe
  2⤵
  PID:1184
- C:\Windows\System\OyXuhZt.exe
  C:\Windows\System\OyXuhZt.exe
  2⤵
  PID:840
- C:\Windows\System\qajHcUH.exe
  C:\Windows\System\qajHcUH.exe
  2⤵
  PID:2996
- C:\Windows\System\cHkVivy.exe
  C:\Windows\System\cHkVivy.exe
  2⤵
  PID:3128
- C:\Windows\System\BgvIMaX.exe
  C:\Windows\System\BgvIMaX.exe
  2⤵
  PID:12636
- C:\Windows\System\tduNDJx.exe
  C:\Windows\System\tduNDJx.exe
  2⤵
  PID:12268
- C:\Windows\System\eVySYaT.exe
  C:\Windows\System\eVySYaT.exe
  2⤵
  PID:780
- C:\Windows\System\yAIkuBm.exe
  C:\Windows\System\yAIkuBm.exe
  2⤵
  PID:4076
- C:\Windows\System\IfsuFeq.exe
  C:\Windows\System\IfsuFeq.exe
  2⤵
  PID:2272
- C:\Windows\System\IsCiQjw.exe
  C:\Windows\System\IsCiQjw.exe
  2⤵
  PID:1132
- C:\Windows\System\wkwYYBl.exe
  C:\Windows\System\wkwYYBl.exe
  2⤵
  PID:13484
- C:\Windows\System\EGUsZvZ.exe
  C:\Windows\System\EGUsZvZ.exe
  2⤵
  PID:380
- C:\Windows\System\ouInmgM.exe
  C:\Windows\System\ouInmgM.exe
  2⤵
  PID:4864
- C:\Windows\System\ZESBPnM.exe
  C:\Windows\System\ZESBPnM.exe
  2⤵
  PID:7304
- C:\Windows\System\jilDhCB.exe
  C:\Windows\System\jilDhCB.exe
  2⤵
  PID:2460
- C:\Windows\System\gsLcdEu.exe
  C:\Windows\System\gsLcdEu.exe
  2⤵
  PID:836
- C:\Windows\System\mEicHSv.exe
  C:\Windows\System\mEicHSv.exe
  2⤵
  PID:14392
- C:\Windows\System\fqkxjQb.exe
  C:\Windows\System\fqkxjQb.exe
  2⤵
  PID:14408
- C:\Windows\System\PezIRnr.exe
  C:\Windows\System\PezIRnr.exe
  2⤵
  PID:14424
- C:\Windows\System\yBGniqS.exe
  C:\Windows\System\yBGniqS.exe
  2⤵
  PID:14508
- C:\Windows\System\jqxyyOh.exe
  C:\Windows\System\jqxyyOh.exe
  2⤵
  PID:14524
- C:\Windows\System\NVddiQr.exe
  C:\Windows\System\NVddiQr.exe
  2⤵
  PID:14624
- C:\Windows\System\nBBkDSO.exe
  C:\Windows\System\nBBkDSO.exe
  2⤵
  PID:14644
- C:\Windows\System\xwvgfoW.exe
  C:\Windows\System\xwvgfoW.exe
  2⤵
  PID:14672
- C:\Windows\System\ZJJZPPO.exe
  C:\Windows\System\ZJJZPPO.exe
  2⤵
  PID:14692
- C:\Windows\System\NggXwDa.exe
  C:\Windows\System\NggXwDa.exe
  2⤵
  PID:14712
- C:\Windows\System\SZASBVy.exe
  C:\Windows\System\SZASBVy.exe
  2⤵
  PID:14728
- C:\Windows\System\UOpLihu.exe
  C:\Windows\System\UOpLihu.exe
  2⤵
  PID:14744
- C:\Windows\System\cPIjkjx.exe
  C:\Windows\System\cPIjkjx.exe
  2⤵
  PID:14776
- C:\Windows\System\tlizLln.exe
  C:\Windows\System\tlizLln.exe
  2⤵
  PID:14800
- C:\Windows\System\sFQhQWS.exe
  C:\Windows\System\sFQhQWS.exe
  2⤵
  PID:14816
- C:\Windows\System\hZtChEe.exe
  C:\Windows\System\hZtChEe.exe
  2⤵
  PID:14832
- C:\Windows\System\WxygQCY.exe
  C:\Windows\System\WxygQCY.exe
  2⤵
  PID:14852
- C:\Windows\System\qgUeVWV.exe
  C:\Windows\System\qgUeVWV.exe
  2⤵
  PID:14868
- C:\Windows\System\fpbgNEX.exe
  C:\Windows\System\fpbgNEX.exe
  2⤵
  PID:14892
- C:\Windows\System\bpBXaiq.exe
  C:\Windows\System\bpBXaiq.exe
  2⤵
  PID:14916
- C:\Windows\System\BkfKQix.exe
  C:\Windows\System\BkfKQix.exe
  2⤵
  PID:14940
- C:\Windows\System\xNoHARV.exe
  C:\Windows\System\xNoHARV.exe
  2⤵
  PID:14960
- C:\Windows\System\wUjCjNh.exe
  C:\Windows\System\wUjCjNh.exe
  2⤵
  PID:14984
- C:\Windows\System\oxZAMWY.exe
  C:\Windows\System\oxZAMWY.exe
  2⤵
  PID:15004
- C:\Windows\System\cTXgQKc.exe
  C:\Windows\System\cTXgQKc.exe
  2⤵
  PID:15028
- C:\Windows\System\cRpYkxD.exe
  C:\Windows\System\cRpYkxD.exe
  2⤵
  PID:15044
- C:\Windows\System\sQEaPcp.exe
  C:\Windows\System\sQEaPcp.exe
  2⤵
  PID:15060
- C:\Windows\System\HbPSrDi.exe
  C:\Windows\System\HbPSrDi.exe
  2⤵
  PID:15080
- C:\Windows\System\KoPWcwU.exe
  C:\Windows\System\KoPWcwU.exe
  2⤵
  PID:15100
- C:\Windows\System\epAluUE.exe
  C:\Windows\System\epAluUE.exe
  2⤵
  PID:15200
- C:\Windows\System\BtyIrUw.exe
  C:\Windows\System\BtyIrUw.exe
  2⤵
  PID:15248
- C:\Windows\System\cFVvJBU.exe
  C:\Windows\System\cFVvJBU.exe
  2⤵
  PID:15272
- C:\Windows\System\xnRCwUD.exe
  C:\Windows\System\xnRCwUD.exe
  2⤵
  PID:15300
- C:\Windows\System\juiDMfD.exe
  C:\Windows\System\juiDMfD.exe
  2⤵
  PID:15348
- C:\Windows\System\mWNWlGQ.exe
  C:\Windows\System\mWNWlGQ.exe
  2⤵
  PID:5384
- C:\Windows\System\CSuAYts.exe
  C:\Windows\System\CSuAYts.exe
  2⤵
  PID:8832
- C:\Windows\System\cobeflK.exe
  C:\Windows\System\cobeflK.exe
  2⤵
  PID:14400
- C:\Windows\System\SepULmh.exe
  C:\Windows\System\SepULmh.exe
  2⤵
  PID:14352
- C:\Windows\System\qkWSvCV.exe
  C:\Windows\System\qkWSvCV.exe
  2⤵
  PID:14360
- C:\Windows\System\AyQIaoT.exe
  C:\Windows\System\AyQIaoT.exe
  2⤵
  PID:14460
- C:\Windows\System\WATyfxH.exe
  C:\Windows\System\WATyfxH.exe
  2⤵
  PID:13892
- C:\Windows\System\ZInSeTA.exe
  C:\Windows\System\ZInSeTA.exe
  2⤵
  PID:14420
- C:\Windows\System\LdRTyCN.exe
  C:\Windows\System\LdRTyCN.exe
  2⤵
  PID:4588
- C:\Windows\System\IjublNM.exe
  C:\Windows\System\IjublNM.exe
  2⤵
  PID:2708
- C:\Windows\System\xjNBOzw.exe
  C:\Windows\System\xjNBOzw.exe
  2⤵
  PID:14584
- C:\Windows\System\SrpWAWZ.exe
  C:\Windows\System\SrpWAWZ.exe
  2⤵
  PID:14520
- C:\Windows\System\AfvohcS.exe
  C:\Windows\System\AfvohcS.exe
  2⤵
  PID:4036
- C:\Windows\System\CxgPjeE.exe
  C:\Windows\System\CxgPjeE.exe
  2⤵
  PID:12332
- C:\Windows\System\CPGljQI.exe
  C:\Windows\System\CPGljQI.exe
  2⤵
  PID:14560
- C:\Windows\System\XcKBHrx.exe
  C:\Windows\System\XcKBHrx.exe
  2⤵
  PID:14660
- C:\Windows\System\TfvYxzv.exe
  C:\Windows\System\TfvYxzv.exe
  2⤵
  PID:13888
- C:\Windows\System\JzdSUoS.exe
  C:\Windows\System\JzdSUoS.exe
  2⤵
  PID:11424
- C:\Windows\System\oNBHKqV.exe
  C:\Windows\System\oNBHKqV.exe
  2⤵
  PID:14736
- C:\Windows\System\IXtJubQ.exe
  C:\Windows\System\IXtJubQ.exe
  2⤵
  PID:14992
- C:\Windows\System\DyIqTLH.exe
  C:\Windows\System\DyIqTLH.exe
  2⤵
  PID:14912
- C:\Windows\System\qRtKnZB.exe
  C:\Windows\System\qRtKnZB.exe
  2⤵
  PID:14864
- C:\Windows\System\nouuYXk.exe
  C:\Windows\System\nouuYXk.exe
  2⤵
  PID:15108
- C:\Windows\System\AURRgGm.exe
  C:\Windows\System\AURRgGm.exe
  2⤵
  PID:14904
- C:\Windows\System\emOSzDD.exe
  C:\Windows\System\emOSzDD.exe
  2⤵
  PID:15228
- C:\Windows\System\zasIhXg.exe
  C:\Windows\System\zasIhXg.exe
  2⤵
  PID:15156
- C:\Windows\System\tMMqVtY.exe
  C:\Windows\System\tMMqVtY.exe
  2⤵
  PID:15088
- C:\Windows\System\rrjNAks.exe
  C:\Windows\System\rrjNAks.exe
  2⤵
  PID:4052
- C:\Windows\System\UxZDVrT.exe
  C:\Windows\System\UxZDVrT.exe
  2⤵
  PID:15264
- C:\Windows\System\qKcxMPp.exe
  C:\Windows\System\qKcxMPp.exe
  2⤵
  PID:15172
- C:\Windows\System\bsaIcQp.exe
  C:\Windows\System\bsaIcQp.exe
  2⤵
  PID:14492
- C:\Windows\System\JQPCDrt.exe
  C:\Windows\System\JQPCDrt.exe
  2⤵
  PID:15288
- C:\Windows\System\MApKwUZ.exe
  C:\Windows\System\MApKwUZ.exe
  2⤵
  PID:15344
- C:\Windows\System\JGbcjOK.exe
  C:\Windows\System\JGbcjOK.exe
  2⤵
  PID:14372
- C:\Windows\System\MBORniY.exe
  C:\Windows\System\MBORniY.exe
  2⤵
  PID:14656
- C:\Windows\System\keeAXnP.exe
  C:\Windows\System\keeAXnP.exe
  2⤵
  PID:14636
- C:\Windows\System\IyVWpSL.exe
  C:\Windows\System\IyVWpSL.exe
  2⤵
  PID:14580
- C:\Windows\System\UqAwCKF.exe
  C:\Windows\System\UqAwCKF.exe
  2⤵
  PID:14652
- C:\Windows\System\GhPAWMu.exe
  C:\Windows\System\GhPAWMu.exe
  2⤵
  PID:14572
- C:\Windows\System\PeMGpYf.exe
  C:\Windows\System\PeMGpYf.exe
  2⤵
  PID:14700
- C:\Windows\System\AOCHEOx.exe
  C:\Windows\System\AOCHEOx.exe
  2⤵
  PID:14908
- C:\Windows\System\GcrzTZc.exe
  C:\Windows\System\GcrzTZc.exe
  2⤵
  PID:14928
- C:\Windows\System\AEkEJrm.exe
  C:\Windows\System\AEkEJrm.exe
  2⤵
  PID:15024
- C:\Windows\System\wJPDMDT.exe
  C:\Windows\System\wJPDMDT.exe
  2⤵
  PID:15132
- C:\Windows\System\Btsnjej.exe
  C:\Windows\System\Btsnjej.exe
  2⤵
  PID:15320
- C:\Windows\System\PfqhDOh.exe
  C:\Windows\System\PfqhDOh.exe
  2⤵
  PID:15160
- C:\Windows\System\yxBEPbY.exe
  C:\Windows\System\yxBEPbY.exe
  2⤵
  PID:14344
- C:\Windows\System\BcujNcq.exe
  C:\Windows\System\BcujNcq.exe
  2⤵
  PID:15260
- C:\Windows\System\SfjrlyW.exe
  C:\Windows\System\SfjrlyW.exe
  2⤵
  PID:15284
- C:\Windows\System\emTSAJQ.exe
  C:\Windows\System\emTSAJQ.exe
  2⤵
  PID:14808
- C:\Windows\System\fOYPPSN.exe
  C:\Windows\System\fOYPPSN.exe
  2⤵
  PID:14996
- C:\Windows\System\egPFcdu.exe
  C:\Windows\System\egPFcdu.exe
  2⤵
  PID:15328
- C:\Windows\System\kszJPnd.exe
  C:\Windows\System\kszJPnd.exe
  2⤵
  PID:15324
- C:\Windows\System\jnPzlTr.exe
  C:\Windows\System\jnPzlTr.exe
  2⤵
  PID:15280
- C:\Windows\System\VIuBCdn.exe
  C:\Windows\System\VIuBCdn.exe
  2⤵
  PID:14564
- C:\Windows\System\HUTngCN.exe
  C:\Windows\System\HUTngCN.exe
  2⤵
  PID:14640
- C:\Windows\System\ooXQvDG.exe
  C:\Windows\System\ooXQvDG.exe
  2⤵
  PID:1632
- C:\Windows\System\appRrFG.exe
  C:\Windows\System\appRrFG.exe
  2⤵
  PID:15240
- C:\Windows\System\TRfJUOF.exe
  C:\Windows\System\TRfJUOF.exe
  2⤵
  PID:15092
- C:\Windows\System\CdfwfYt.exe
  C:\Windows\System\CdfwfYt.exe
  2⤵
  PID:14708
- C:\Windows\System\MByWddr.exe
  C:\Windows\System\MByWddr.exe
  2⤵
  PID:14956
- C:\Windows\System\GysVdsI.exe
  C:\Windows\System\GysVdsI.exe
  2⤵
  PID:15184
- C:\Windows\System\XsmtBcu.exe
  C:\Windows\System\XsmtBcu.exe
  2⤵
  PID:15268
- C:\Windows\System\MaATQNQ.exe
  C:\Windows\System\MaATQNQ.exe
  2⤵
  PID:14968
- C:\Windows\System\JOGKYEF.exe
  C:\Windows\System\JOGKYEF.exe
  2⤵
  PID:14440
- C:\Windows\System\YGyWgSA.exe
  C:\Windows\System\YGyWgSA.exe
  2⤵
  PID:15192
- C:\Windows\System\tRYpsJg.exe
  C:\Windows\System\tRYpsJg.exe
  2⤵
  PID:14616
- C:\Windows\System\SKAsQne.exe
  C:\Windows\System\SKAsQne.exe
  2⤵
  PID:14608
- C:\Windows\System\VyWQvsD.exe
  C:\Windows\System\VyWQvsD.exe
  2⤵
  PID:15208
- C:\Windows\System\PIrKAxR.exe
  C:\Windows\System\PIrKAxR.exe
  2⤵
  PID:14844
- C:\Windows\System\MUNLZdO.exe
  C:\Windows\System\MUNLZdO.exe
  2⤵
  PID:15244
- C:\Windows\System\HlcFUcq.exe
  C:\Windows\System\HlcFUcq.exe
  2⤵
  PID:14416
- C:\Windows\System\mLDDFAB.exe
  C:\Windows\System\mLDDFAB.exe
  2⤵
  PID:15232
- C:\Windows\System\fqrTidH.exe
  C:\Windows\System\fqrTidH.exe
  2⤵
  PID:14532
- C:\Windows\System\fuSgxCd.exe
  C:\Windows\System\fuSgxCd.exe
  2⤵
  PID:14436
- C:\Windows\System\BkkeZdl.exe
  C:\Windows\System\BkkeZdl.exe
  2⤵
  PID:14576
- C:\Windows\System\emkRwHY.exe
  C:\Windows\System\emkRwHY.exe
  2⤵
  PID:14752
- C:\Windows\System\DybXMjb.exe
  C:\Windows\System\DybXMjb.exe
  2⤵
  PID:14952
- C:\Windows\System\oqyQPmQ.exe
  C:\Windows\System\oqyQPmQ.exe
  2⤵
  PID:1648
- C:\Windows\System\oyhhMPJ.exe
  C:\Windows\System\oyhhMPJ.exe
  2⤵
  PID:13804
- C:\Windows\System\NvXlrWN.exe
  C:\Windows\System\NvXlrWN.exe
  2⤵
  PID:14568
- C:\Windows\System\XdHknmX.exe
  C:\Windows\System\XdHknmX.exe
  2⤵
  PID:15128
- C:\Windows\System\DdpUfBB.exe
  C:\Windows\System\DdpUfBB.exe
  2⤵
  PID:14604
- C:\Windows\System\dyuQjEO.exe
  C:\Windows\System\dyuQjEO.exe
  2⤵
  PID:14756
- C:\Windows\System\zIBbqek.exe
  C:\Windows\System\zIBbqek.exe
  2⤵
  PID:4752
- C:\Windows\System\OsUPKMl.exe
  C:\Windows\System\OsUPKMl.exe
  2⤵
  PID:15016
- C:\Windows\System\eqLAPtg.exe
  C:\Windows\System\eqLAPtg.exe
  2⤵
  PID:14536
- C:\Windows\System\tphZdNa.exe
  C:\Windows\System\tphZdNa.exe
  2⤵
  PID:15220
- C:\Windows\System\rWutuxB.exe
  C:\Windows\System\rWutuxB.exe
  2⤵
  PID:14684
- C:\Windows\System\errPNuu.exe
  C:\Windows\System\errPNuu.exe
  2⤵
  PID:4108
- C:\Windows\System\FtwjdRn.exe
  C:\Windows\System\FtwjdRn.exe
  2⤵
  PID:4204
- C:\Windows\System\NtTRaLc.exe
  C:\Windows\System\NtTRaLc.exe
  2⤵
  PID:3492
- C:\Windows\System\OplzDnV.exe
  C:\Windows\System\OplzDnV.exe
  2⤵
  PID:14596
- C:\Windows\System\ukVIvTx.exe
  C:\Windows\System\ukVIvTx.exe
  2⤵
  PID:2600
- C:\Windows\System\vgNhIDl.exe
  C:\Windows\System\vgNhIDl.exe
  2⤵
  PID:3904
- C:\Windows\System\UnBSSOX.exe
  C:\Windows\System\UnBSSOX.exe
  2⤵
  PID:4200
- C:\Windows\System\zKhxHGc.exe
  C:\Windows\System\zKhxHGc.exe
  2⤵
  PID:4332
- C:\Windows\System\pGWOqRV.exe
  C:\Windows\System\pGWOqRV.exe
  2⤵
  PID:4840
- C:\Windows\System\aPajAQG.exe
  C:\Windows\System\aPajAQG.exe
  2⤵
  PID:3900
- C:\Windows\System\SHzUPJK.exe
  C:\Windows\System\SHzUPJK.exe
  2⤵
  PID:1144
- C:\Windows\System\OpbQQaC.exe
  C:\Windows\System\OpbQQaC.exe
  2⤵
  PID:2280
- C:\Windows\System\abPbLfW.exe
  C:\Windows\System\abPbLfW.exe
  2⤵
  PID:15420
- C:\Windows\System\uAqgrMw.exe
  C:\Windows\System\uAqgrMw.exe
  2⤵
  PID:15488
- C:\Windows\System\xUFGEMx.exe
  C:\Windows\System\xUFGEMx.exe
  2⤵
  PID:15544
- C:\Windows\System\GpPKZgm.exe
  C:\Windows\System\GpPKZgm.exe
  2⤵
  PID:15564
- C:\Windows\System\XBiclEw.exe
  C:\Windows\System\XBiclEw.exe
  2⤵
  PID:15584
- C:\Windows\System\jitFDLc.exe
  C:\Windows\System\jitFDLc.exe
  2⤵
  PID:15620
- C:\Windows\System\iIgOnLp.exe
  C:\Windows\System\iIgOnLp.exe
  2⤵
  PID:15688
- C:\Windows\System\mWDKCTo.exe
  C:\Windows\System\mWDKCTo.exe
  2⤵
  PID:15708
- C:\Windows\System\bDgpWwE.exe
  C:\Windows\System\bDgpWwE.exe
  2⤵
  PID:15728
- C:\Windows\System\ZiPHddm.exe
  C:\Windows\System\ZiPHddm.exe
  2⤵
  PID:15768
- C:\Windows\System\tNJehJQ.exe
  C:\Windows\System\tNJehJQ.exe
  2⤵
  PID:15788
- C:\Windows\System\sPVtfzy.exe
  C:\Windows\System\sPVtfzy.exe
  2⤵
  PID:15820
- C:\Windows\System\oUeWdqU.exe
  C:\Windows\System\oUeWdqU.exe
  2⤵
  PID:15840
- C:\Windows\System\cjXoJnm.exe
  C:\Windows\System\cjXoJnm.exe
  2⤵
  PID:15904
- C:\Windows\System\pumJPpO.exe
  C:\Windows\System\pumJPpO.exe
  2⤵
  PID:15952

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:13092

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:10092

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13484

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:11816

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14156

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:8692

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:9608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vd5ulqdp.5sy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AtZhSbX.exe

Filesize
1.4MB

MD5
eed8096ca5360e61802d7192482c9155

SHA1
fb0a81fa5dfa73bcf755efb5297341beadbf5996

SHA256
59e269ec3d16e150a40f5b6cd9b324e51f9bac7b4bb184c9de059e401dedafb1

SHA512
ef5bfa496134f03577eeebac0f147e44ab57370771242b4546f20fa81f4c685eea18681e4e0437d7d8b307d055b8e09df7f93bdf265c8080c3d6a2f3f515cdf2

Download Submit
C:\Windows\System\BMEoxFp.exe

Filesize
1.4MB

MD5
7b341831fe8073e6e9a4ee1988241ab7

SHA1
05c32c4c1ce9480c32112d3cdc9dd81350a6477f

SHA256
89fda455da2d0951e76bcc0036d443ef9dcf1f372f4cac81744d4873592f5ab2

SHA512
93bdcb8a0e1e353dfdc3749be39d48515f3d5aabc53f72a489050075efd19bec1b858c6d29e598b926ee28b510b25d0bb109c9b1a8e44cc5a94e0aa531cd9488

Download Submit
C:\Windows\System\BbIaFiT.exe

Filesize
1.4MB

MD5
264057e5ce241add9960447f459e74ca

SHA1
2af1ec89c843f4b37cf9e4a212b48737e639f2c1

SHA256
b0e92eabb0b539dab4efb1d18246ece7fb7ef7d0a023370f23e58f59f2fc13d8

SHA512
bdfd4256f4b83bc065676b253c63d3da8eeca614882287799fb0a362345d47447f95ccaa834c5ea2701943ade2be3a41dccbeb315743ffba8ea2539d92983d73

Download Submit
C:\Windows\System\BnYPuDw.exe

Filesize
1.4MB

MD5
4069563cfad6a16279a35845003d54fe

SHA1
ca0b32c108deb36f529c9ea7dad24f175a623016

SHA256
d3a805ba76c6214b5b3b4f547288bafe5aa2172a1a3e92c80a05affd41f603c4

SHA512
9525cb2bdf4dfbd973ecefad52b39294bd77008b7bf55ef879ced278d5241ebf14b34a0ceddf6ff5a4ae19554a324795400324b7ff7cdc365aaa2fe2fe003ca8

Download Submit
C:\Windows\System\EKVhKTF.exe

Filesize
1.4MB

MD5
bd2127660032757bb4287f3e327857ea

SHA1
97e3c377b7aad9c14be9033536d5eb80cd77ab83

SHA256
846bbc4ab6e9b0c30681f6356b7fa266ff98b1951914433d29a82720a2084e2f

SHA512
31cd8347d4057c923c3e06b756ffdf3fb648c84ef96dea3a1f698035eefe810855df1d4430d3a59f80eede51ca8d4b80abdc0a9d80793ea59ae55ee1fd13e03a

Download Submit
C:\Windows\System\GSBZbea.exe

Filesize
1.4MB

MD5
746438aea771bf569f73d4536050e721

SHA1
24b2ca6adbf4eb4716d7e96ffe09148278119f41

SHA256
dc784b3401b10ab5a89e8bf34ad171984082f9236b35ab0d8fbc86fae00761e1

SHA512
ebbe9f97f2c2862071208d99e85998fc09f203e040a9d25210825f2528d8fcb8a6b22497e196ad033b679ff18b4d1d0be531cab59fde91baec6183bc4121d1f5

Download Submit
C:\Windows\System\HHxIgpe.exe

Filesize
1.4MB

MD5
024f5dbf6b4b1ee4fa7cb2dd04a93afd

SHA1
8d5afce6ce6e36b7d19fe30c66b4d050026cb1a1

SHA256
2ea9b9b5c1a8e1fbe9069e21da2c7ae9dcad6afd18a139598f0ce6095309dfc0

SHA512
7623d9eba5248c4819ae549170f68da94a35a3a7738e72b0dcf81abe51898a7b58e3bd37b664bceaefac4779d8a3f8b8521c917a65dc31958dd2944a5ab58dd9

Download Submit
C:\Windows\System\NnfjLZg.exe

Filesize
1.4MB

MD5
337935f1338962f5d474faba5fe1ffe0

SHA1
b72ace58bfae268b11546d6ac1cf4c342529ac09

SHA256
12b6eb5f779cabe6c1df93c70ec4f92c7006cc21bc2e05866f346c04603dadac

SHA512
95d7a1d624a84d27ea1f8c3cff430300e977a437bf3f652269b2ac9d63779b93dbe537351e75ee991c9667b530346c917fa287264a2fc0cb24985cc186d4bb0e

Download Submit
C:\Windows\System\PklTPYl.exe

Filesize
8B

MD5
e71397695bfc95ac5fe1d82687725659

SHA1
45272317203fb987b8952f41b0170bd5a78944b0

SHA256
593106c260dc81c57565b84dcf164e3aba348716b31b67ed996f84e8eb33a8f2

SHA512
b0a8d0ea3899c2bbb7c006edeeb2ecf2f4894f56db8d8ff247c4e6fc5083c186ab234b2494615de540e99bc5dda8055b1dfec22d34c5a32a9febff889f810e0e

Download Submit
C:\Windows\System\QHAxCyu.exe

Filesize
1.4MB

MD5
226aa107acf655752a02d4ae3020c957

SHA1
ca1b9081dad22a407abaca4d4c1bb8d37e1192e8

SHA256
17c201f701f313954422944236ad9353244814040948a9c8079d6b3a46fa008d

SHA512
90d882a59b2f04286a3bdfc44d128ccd99fb621cf4748fe863bf202f700e8a9cb33bbe2c5620c745a9db0c6d1d9182ed8328735647d2172d1d694025276e1c3f

Download Submit
C:\Windows\System\SbeWDvs.exe

Filesize
1.4MB

MD5
21990e02c664d00f7d91575745213312

SHA1
625cf9a4a49814dec4c349bef6d71c53bdfcc5a6

SHA256
99f7f470dd43139544974a45589262f0a0cfd11454fcd06e817d8d230ffca6d5

SHA512
0e96b79237ad78e215efa668cdd2157e5fc6044c147064414f0980807b638bc7ce193365120c74af8bdb53b3ea29a14e6acee19a61011f663cb328c3aa64c919

Download Submit
C:\Windows\System\VJifZXd.exe

Filesize
1.4MB

MD5
8125145674010a24668bc74e8c649f21

SHA1
462c4a53c79960dfdff028418063fa28d81c061d

SHA256
82766dc7e4f83a6ca87c7b0aa35a9025253dba9667cb30e62509ad0fa5b516a1

SHA512
df1ed807f04780c108640c329bbcc854e161f633c17cf281cf5cd8944613ce09e4275df2f9ec60ee365f4ec9df46cfd8a1d01aebb695fd2c17a8babcbed2ed16

Download Submit
C:\Windows\System\VdHcHsF.exe

Filesize
1.4MB

MD5
6eda1fdc14c89cf4a4daceb0ad9b8bd7

SHA1
3fe5384ed6b0d0019c3333ac8edf2cf0559097b3

SHA256
8ef0568074f5ca980f3753ceef030af071f122ece9f66bead4bf69cb951386af

SHA512
e08f69c75ade14ce004209cd75281e6689b3823b3c58c59eb77acdaacfb4a23ca908f0a7658f4cbf121ff822af0ecbd9d53e667a0d35a6b44e680107dfc55a1b

Download Submit
C:\Windows\System\VxFUFys.exe

Filesize
1.4MB

MD5
82ea2618b1e6959e28ff795867b97dbf

SHA1
37438da956196258cb2b1264b736d1955f2265b3

SHA256
10f0f30fc22abe333ccae86f8ef876064f6b37892da7659334ba2c186ad15a9d

SHA512
aa20522af3c728209850198cb35580213836e75736367ae5cbfcb19a03e9c9530b01f7ae7776e1e5c075f0150d785057fb423d87cdb6a0db59e3f985e3a15532

Download Submit
C:\Windows\System\WXtVnjM.exe

Filesize
1.4MB

MD5
930a82fa730a11aa12cf94ba152627e9

SHA1
8753282a7a03b6b80599c81d07b4b888db4d6cc1

SHA256
cce86433db722dc01e5d37e990054d1f27a9196b6767dc6b688d858df81da3da

SHA512
c6275ead21aaca76ad534c32435d9b7bc6da68d00b42f63e1bd531a0386c7e743655a68d59609bff13919c9258b0727eea730b7bc81f0954c62d60c238baad0c

Download Submit
C:\Windows\System\XDdKfBT.exe

Filesize
1.4MB

MD5
0e2c9d9e5b63c5f3d36a7b8dcccac438

SHA1
52d54c9d3bbc583710a08d17147755709c1081ce

SHA256
870e2f5adf589238176e57398f69f7e72e179fc6838f5c77a46a6d99546caea2

SHA512
a75c9d10ff00eefbba7b8a3fd7efdaa16178884662c592a3994b5e0f19f5f84a48de6e26ef078c964a5e17ea667425f2a1e23c2c884ee07820a2c5ae929e7187

Download Submit
C:\Windows\System\XHhCpFP.exe

Filesize
1.4MB

MD5
d7745ab5589b855adfdbd36321bc2a98

SHA1
707f63800ed575b720c1d0d4d58fed01ef99e002

SHA256
9dd76b9b0e618f7dbb836354559b27738d7e7c5dbf941bc14374c3b0fedb0ae6

SHA512
06c33326392d79604020119e14361fe2ec532383de9e34ce9f504ead5bd70dc38e5b8d63fa5f95dbcc4c21c513461aa42b824adc4e73f2443b6e99991ccc04c0

Download Submit
C:\Windows\System\XxcSaeB.exe

Filesize
1.4MB

MD5
657db81ab99be17ce74797eca8285459

SHA1
5f50cf00293c61d3b797f05993370776011d4164

SHA256
2c6d60be89d2fb816eacc58f5fa3c93185f55a7b67589de506bc08d46dee33e4

SHA512
c6bb774c9710bc77fde065be3abc5b75a8e333c0b06cbbb24b1086042491c90b7f0af342371da431e298f08d5ffdec8beed125202b5a78e03118796d9db04def

Download Submit
C:\Windows\System\YUNWicp.exe

Filesize
1.4MB

MD5
02b73a58efbaf01d2c69a1bcb6a7ee8f

SHA1
1e9e3d76edefe22145c63dafcf6c46b168af9f3f

SHA256
bfd44b938f047badc1618fd288e9048f14b9f87aa5cd6f8d953a50fdd478b2dd

SHA512
4286d4d7296699b93beda43985f8658a7e459701c3220ebee5d61913d8e90dbbbfaef3349713f421baa23ec26511d339c1760094138e45676077d0554785f0ed

Download Submit
C:\Windows\System\ZeQqCzr.exe

Filesize
1.4MB

MD5
fdae0dc5e6f758d5ea1b8859475232d3

SHA1
254e243d9df7200f3f360515a358fd63fb83b202

SHA256
5a0f72bee7e49cc982121b830cae837db2a6210859ccec523a6d4aace14976d8

SHA512
ea753ed392374b64fd9a7126fba546b37af495612ce0eb5b037284c2d2983b5434746905e60e241e7100e07ee8cd81bdaef94fccee6a84a95148717ccf2ce999

Download Submit
C:\Windows\System\aTWgese.exe

Filesize
1.4MB

MD5
2969781a8f2577fbd63e209184d027db

SHA1
19d8af351219cb447bc9f14d3729ed53f325d26c

SHA256
1983dc45dd3ce1247f499ae0265aa177fa9cb3fd50e70f2bc6f8a6220c3d0313

SHA512
74e8322e0bc17300c99e040ec1857b69bf8f60dea2d0de56eb57e790d2f23d55200926d2520a63998e679bafe3ed8d0ad90fec17da204961089323825f304952

Download Submit
C:\Windows\System\dFzlVWg.exe

Filesize
1.4MB

MD5
81e2bee5f3c96d086c7a2c41d38a98a3

SHA1
01002506b7533e44ccf4e8011ad3bb75be53b6e7

SHA256
2a518793f28e3972cebf911c8a6f80e643ab5e0aebcfd0acab0fe4e7d1e2a78c

SHA512
a1b4eca83c1d3bb69d02a4731eb35e4ff43f8584ccc1502e0ed9d5a602633aa059d78de31c5a2468b1930372d771fb296f9887803b6b898bd6023632e3b169a6

Download Submit
C:\Windows\System\ejzuAYK.exe

Filesize
1.4MB

MD5
b7dd65e1cd61a2b8b0f33598a895b6b5

SHA1
819305673b897ad872d26df4c639772b8453492a

SHA256
945cc91991498d0c17a0f904a5cb53f6ebef7434c9de3fda5f259912aa9774fa

SHA512
09a1954e09759c687508f544c4bb1f1e12071a8928042dee233b1a28268f109f3b549565695f49b428eaf025436ce1246382b69a91627476bdbbb81b520f44b2

Download Submit
C:\Windows\System\gRPYOXE.exe

Filesize
1.4MB

MD5
3715f95e4546b510c7f27a1cf0792fc2

SHA1
e90507e37fe20fcac91d17d99c402bd0c220d020

SHA256
553608deffd4b3b11608528bb8cdc5c1249d0695af07144db272eb1c5d12aec5

SHA512
5de1c14490ba546ee62f83f92489e84c4cce2ba5a38ca19827a8dc23f3cff93186fbf8aa511205dbdedd8b2eabf9cbd33441e13b594d6f379402ed06d8e57eb9

Download Submit
C:\Windows\System\hxBBkXJ.exe

Filesize
1.4MB

MD5
6c0b425ddd9ad3c9979bbadc3b9edb5c

SHA1
60dbefaf35ca5fc9a5a8145efd7c763307bd9b6e

SHA256
5ec57b443d4e38e715016995fcef00f29300bb4e4224f249f0b12680a17dddb4

SHA512
af8e7b36191c23bcba8785a704b140e72023b7e292118fea4e8ed1a688899945d68d7ccb3deeb0ccbc08d1253992806e20d81af9b1f978835661045c84c80e9d

Download Submit
C:\Windows\System\jQNNMHf.exe

Filesize
1.4MB

MD5
906a99acab81a0e4d623d4957d8990ab

SHA1
0a44db06a1b9e7ea9e829bbc7eb230026a2c3523

SHA256
f145fd732ee9dad163c7d110a7d200da3f3517f4fe7e90a4104a393810feb1b2

SHA512
786a77fbe5865b30d9f530022d6aee4a85bf86552c2fa093eab07d0084451cb41a5928193e52d9b00da013e2e5024a228bc821ba7eb77ff43b6c05e7aa4a621b

Download Submit
C:\Windows\System\jWVmFDv.exe

Filesize
1.4MB

MD5
0bb79af5bbd656502f298eacac88d90e

SHA1
d98e2cc7361398429e93fcc58c7732e335ae641b

SHA256
4af2d5c763a63a70e00db8e26d9c3653a0ce3c70e16e6b383a0ab13777e558d1

SHA512
73ecca5e7bfd7fdf431f085207e16db00ceaa9c8a68841671936f27218250d318c1094f6afbd3417cb0ab61ce4bb36b45909c643c7549f574631a82ecf50e74d

Download Submit
C:\Windows\System\krKTLUx.exe

Filesize
1.4MB

MD5
08cd3c964268d5fec67513fb27caf83e

SHA1
d0865f9f5404f280f9f823aefbc49b1e99b36dfd

SHA256
71f5efd9231dba250f11f5d70932760ee3d22ce246c91c91e1fd497f0c7696c9

SHA512
d133cade239aa8e94d370f7f10cc6f0aeb712532a969100c62eca707f6cb34f1013762e817800593f35701fb0a66ca2f3452b0fabccb7d084fb9193011a1776a

Download Submit
C:\Windows\System\lLDrlMh.exe

Filesize
1.4MB

MD5
05bff08d549ddb9d5e80e2bd27789517

SHA1
74028e7757ab0fc24c59badcda7d8b953112e118

SHA256
c6a809b7002f68b632c2d2351f316680d96d8cfd672b2e8abec0915f4fa7906e

SHA512
a07b5ad60785a86cacdd17960e8422ca474f1d75a904e1a7356fed970dc4d1cec7a2b56c7945c1c23a071269866f78d0be2bb65a720e9c157a17efe0da9f9d24

Download Submit
C:\Windows\System\pLLtnDW.exe

Filesize
1.4MB

MD5
e35528b675080a684c88e3ef552e3f5f

SHA1
0cc77ed860793a769b5776635d2083b2a3ac8600

SHA256
5570cbe717f83ff7ff0c381a18e6b96b97d66131c11e55251cbaf964cddd0b96

SHA512
5941d2590774a8efd3651489ee6dbc51b81f0cea2d46344c8698a897435af923c8027ec833eba2e48be24677de7196749be176e51e78a5dbcd336788a62e09d0

Download Submit
C:\Windows\System\qUDmJnL.exe

Filesize
1.4MB

MD5
ea03d872ac4527e2ad66a046740e90a2

SHA1
056dbd7f38c16b68dff71d0a29f4942d4a81e364

SHA256
4a0e30d1a59404871a856d1ec4b0625e21a986d57d1aa84b3107da80e1d63dbd

SHA512
8d931a19e4e200cee0287e4c4dad29b9964ee9e4fc2b04ebb0a4ab6ba23f4c55f9641286808fe7941bc2fe2ea76b92cd003e7f22752dab88a335b9e603afb50b

Download Submit
C:\Windows\System\rXmZtgC.exe

Filesize
1.4MB

MD5
c1e8d1dfac39154dfbca9160a0ab1257

SHA1
ea0c148c580e397f25e09327f1b8e0bc6c0f628b

SHA256
54a71ddb48534ad49823b2c06d49fcfd6d08d8e8c0083b04d0273206c5719469

SHA512
aa8d65c98725c6cf1a0d63c4735247969b2cbe1d68c97ceca766506a4a2a9b9b0f1074f2305ec1074cee5e708057db18b626c594417edd9f8ce07f6bf131d0f8

Download Submit
C:\Windows\System\rdtfuxG.exe

Filesize
1.4MB

MD5
b934609eeefec1d89ff74004a9803477

SHA1
ad5a70addea7c102ceeb9a36246c94f7eca049ca

SHA256
5191234944d10bb6eb6f032ea84e88b024fd8732dadf6822cf398f52bc909c39

SHA512
3bd2d8624710c6c64b32233592da965565711ef63e220eaf40f91375872e574cf0cd7f05ffe0e00e93b78411089195aa4dab4cf46c679831c68281d851f0cb62

Download Submit
C:\Windows\System\reijVwG.exe

Filesize
1.4MB

MD5
5fa33d82c664a14ab9e415814f510f3e

SHA1
4cac27d5860f662fa37a06fde80af660bdb5ea47

SHA256
0b44b6e4ffc757031b0b554915e9954164a574479b9c6484ac51a758820437f2

SHA512
2000eac6b61c541e43d4a02d8a060fe679fdb2fc31b477e5921f9a96e48831068f3c817633da9a6b1e5388b1454ed738262024be531c34eb980cb782726e75aa

Download Submit
C:\Windows\System\sEpIihk.exe

Filesize
1.4MB

MD5
521244671af519354203d527061992d7

SHA1
31679b13adea6412481a62baecfaca0c6148618b

SHA256
7160e5f86666f9f3dc03fc0b7a116363e24b4e7f40b2352bd13ad07466c9259a

SHA512
518c310c70a18ff466ee1ffdf2a47b8880d7f2cab62a4d4289ca581bf9168d3e12e133e034e36319e357108b2287a1fca9e15247676d866e7f2cea571a2c46ef

Download Submit
C:\Windows\System\wFyenXa.exe

Filesize
1.4MB

MD5
b4e319e1497380973b4182c3bc66c7ae

SHA1
d647ce5a2b2d69e8846f4440f49ce7d3832d7c59

SHA256
cd4d9c011ffc82ca1afb0b559a886d3024107725baf50cc7ed592f825526f8ed

SHA512
59682d1acc60a72bfa0cb2fc78bc2f74c22d1fb7904abc3f02b6dc54ea61ac072fd5250c7208fa07bec6e836548fed65dfe9d35f6715df5c66841b8612ecb77c

Download Submit
C:\Windows\System\wJTdNsQ.exe

Filesize
1.4MB

MD5
cfce6ece721f2adf4b460f24f3ceb786

SHA1
0e06b75ed20540f5b0769c2c5144e3430e3034ad

SHA256
460e798459aa954f04b33455b9351dfb658cc9520b38849629431ff11f2703db

SHA512
9676b4c00557ec635453f614bae3c027e4521b0d78890edc89cb6fe13643d010b61c569c1834b107b17c3a1ba5cca536f6cc6238614424627b2ad39af9545956

Download Submit
C:\Windows\System\xIazPny.exe

Filesize
1.4MB

MD5
3d1c60590cbb2634117be2ef06c9906d

SHA1
b7f46c7b00715bca52310dace09b4fd57d21f20c

SHA256
fac391ee14a6f30ad527fdd4cf930bf36faa29a1e9591a9373620ad26c8c9827

SHA512
649e30ee6bd27be1497785c5b086a00c69043932371223db44d3264927990cbc8967cc4f6e0a6619d756ab8f788c4aa6c2b2a2bfe183e1760eae5a6e3790e5aa

Download Submit
C:\Windows\System\xcqqvSt.exe

Filesize
1.4MB

MD5
0ec4292814d120c095c5bb0ac3710cc5

SHA1
1097a773a13a9c2f7425fd251c25ee507fd02575

SHA256
a462c6ec4517316ff2eee0b85affdb7a1221311a7400eff8548220d2b7f46db6

SHA512
18537ee17316f9970a32d5899537e4a80480c40e40cd03098fd7e1d19a1914a508fe923c5f88d9075e3390d3cdd452f47256f32cb63a89d8ecaad7b5bcc7a78d

Download Submit
memory/372-433-0x00007FF6D8FA0000-0x00007FF6D9392000-memory.dmp

Filesize
3.9MB

Download
memory/724-432-0x00007FF79DA30000-0x00007FF79DE22000-memory.dmp

Filesize
3.9MB

Download
memory/1284-436-0x00007FF64B0C0000-0x00007FF64B4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1384-502-0x000002424B790000-0x000002424B7B2000-memory.dmp

Filesize
136KB

Download
memory/1384-117-0x00007FF8D3F40000-0x00007FF8D4A01000-memory.dmp

Filesize
10.8MB

Download
memory/1384-23-0x00007FF8D3F43000-0x00007FF8D3F45000-memory.dmp

Filesize
8KB

Download
memory/1384-430-0x00007FF8D3F40000-0x00007FF8D4A01000-memory.dmp

Filesize
10.8MB

Download
memory/1456-2906-0x00007FF72CC90000-0x00007FF72D082000-memory.dmp

Filesize
3.9MB

Download
memory/1456-10-0x00007FF72CC90000-0x00007FF72D082000-memory.dmp

Filesize
3.9MB

Download
memory/1568-174-0x00007FF6EAA50000-0x00007FF6EAE42000-memory.dmp

Filesize
3.9MB

Download
memory/1612-37-0x00007FF71E380000-0x00007FF71E772000-memory.dmp

Filesize
3.9MB

Download
memory/1656-803-0x00007FF666FB0000-0x00007FF6673A2000-memory.dmp

Filesize
3.9MB

Download
memory/1676-431-0x00007FF64A240000-0x00007FF64A632000-memory.dmp

Filesize
3.9MB

Download
memory/1808-435-0x00007FF695ED0000-0x00007FF6962C2000-memory.dmp

Filesize
3.9MB

Download
memory/1852-628-0x00007FF6BAD90000-0x00007FF6BB182000-memory.dmp

Filesize
3.9MB

Download
memory/1988-439-0x00007FF6D5470000-0x00007FF6D5862000-memory.dmp

Filesize
3.9MB

Download
memory/2224-0-0x00007FF714DC0000-0x00007FF7151B2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-4441-0x00007FF714DC0000-0x00007FF7151B2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-1-0x0000018795860000-0x0000018795870000-memory.dmp

Filesize
64KB

Download
memory/2224-2822-0x00007FF714DC0000-0x00007FF7151B2000-memory.dmp

Filesize
3.9MB

Download
memory/2352-434-0x00007FF6FE730000-0x00007FF6FEB22000-memory.dmp

Filesize
3.9MB

Download
memory/2696-437-0x00007FF6E0760000-0x00007FF6E0B52000-memory.dmp

Filesize
3.9MB

Download
memory/2760-513-0x00007FF793390000-0x00007FF793782000-memory.dmp

Filesize
3.9MB

Download
memory/2868-294-0x00007FF6601F0000-0x00007FF6605E2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-440-0x00007FF7727C0000-0x00007FF772BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3236-293-0x00007FF7CEE30000-0x00007FF7CF222000-memory.dmp

Filesize
3.9MB

Download
memory/3952-442-0x00007FF753D70000-0x00007FF754162000-memory.dmp

Filesize
3.9MB

Download
memory/3960-514-0x00007FF61AA70000-0x00007FF61AE62000-memory.dmp

Filesize
3.9MB

Download
memory/4020-242-0x00007FF729B00000-0x00007FF729EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4152-438-0x00007FF62A0A0000-0x00007FF62A492000-memory.dmp

Filesize
3.9MB

Download
memory/4368-441-0x00007FF631E70000-0x00007FF632262000-memory.dmp

Filesize
3.9MB

Download
memory/4788-727-0x00007FF797750000-0x00007FF797B42000-memory.dmp

Filesize
3.9MB

Download
memory/5104-609-0x00007FF684BE0000-0x00007FF684FD2000-memory.dmp

Filesize
3.9MB

Download