xmrig | 7a8e7d41499ebc815fbaa61d2bb324a3167fd041254ff3aa9b395928fa00893f

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a41ca2f8089198574a9894a404cc5880N.exe
Size

3.1MB
MD5

a41ca2f8089198574a9894a404cc5880
SHA1

8767f84f3fa1a0d58f552c5473442097f628b4e7
SHA256

7a8e7d41499ebc815fbaa61d2bb324a3167fd041254ff3aa9b395928fa00893f
SHA512

36e98c684a48c9026ddb93c61ac323a08f080ff67d8d2ed66f0612b43c0a250a4ac1990d694b95a56101fb4cab43b5f5d6cbf0992edbf9faa8bc3e280ea53ec6
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWx:7bBeSFkF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4940-0-0x00007FF69A490000-0x00007FF69A886000-memory.dmp	xmrig
behavioral2/files/0x0007000000023457-7.dat	xmrig
behavioral2/files/0x0007000000023458-18.dat	xmrig
behavioral2/memory/3076-28-0x00007FF791510000-0x00007FF791906000-memory.dmp	xmrig
behavioral2/files/0x000700000002345a-27.dat	xmrig
behavioral2/memory/2788-24-0x00007FF6D1610000-0x00007FF6D1A06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023459-21.dat	xmrig
behavioral2/files/0x0007000000023456-19.dat	xmrig
behavioral2/memory/2272-36-0x00007FF6EAAD0000-0x00007FF6EAEC6000-memory.dmp	xmrig
behavioral2/files/0x000700000002345c-47.dat	xmrig
behavioral2/memory/1828-55-0x00007FF728E10000-0x00007FF729206000-memory.dmp	xmrig
behavioral2/memory/1768-62-0x00007FF72C450000-0x00007FF72C846000-memory.dmp	xmrig
behavioral2/memory/2752-67-0x00007FF68BAF0000-0x00007FF68BEE6000-memory.dmp	xmrig
behavioral2/memory/2476-70-0x00007FF6A2540000-0x00007FF6A2936000-memory.dmp	xmrig
behavioral2/memory/4380-75-0x00007FF671B10000-0x00007FF671F06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023461-77.dat	xmrig
behavioral2/memory/1232-92-0x00007FF745E00000-0x00007FF7461F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023462-95.dat	xmrig
behavioral2/memory/1516-104-0x00007FF67DC10000-0x00007FF67E006000-memory.dmp	xmrig
behavioral2/files/0x0007000000023466-115.dat	xmrig
behavioral2/memory/3144-127-0x00007FF73E090000-0x00007FF73E486000-memory.dmp	xmrig
behavioral2/memory/2948-144-0x00007FF7BA3B0000-0x00007FF7BA7A6000-memory.dmp	xmrig
behavioral2/files/0x000700000002346a-147.dat	xmrig
behavioral2/memory/1452-163-0x00007FF7C3620000-0x00007FF7C3A16000-memory.dmp	xmrig
behavioral2/files/0x0007000000023470-173.dat	xmrig
behavioral2/files/0x000700000002346f-172.dat	xmrig
behavioral2/files/0x000700000002346e-171.dat	xmrig
behavioral2/files/0x000700000002346d-170.dat	xmrig
behavioral2/files/0x000800000002346c-169.dat	xmrig
behavioral2/memory/4236-168-0x00007FF7D2B50000-0x00007FF7D2F46000-memory.dmp	xmrig
behavioral2/memory/3596-167-0x00007FF773410000-0x00007FF773806000-memory.dmp	xmrig
behavioral2/memory/4940-164-0x00007FF69A490000-0x00007FF69A886000-memory.dmp	xmrig
behavioral2/files/0x0007000000023469-133.dat	xmrig
behavioral2/memory/4044-132-0x00007FF779BE0000-0x00007FF779FD6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023468-130.dat	xmrig
behavioral2/files/0x0007000000023467-128.dat	xmrig
behavioral2/files/0x0007000000023465-123.dat	xmrig
behavioral2/memory/2076-121-0x00007FF7974C0000-0x00007FF7978B6000-memory.dmp	xmrig
behavioral2/memory/3336-120-0x00007FF68BC30000-0x00007FF68C026000-memory.dmp	xmrig
behavioral2/memory/2244-103-0x00007FF77F630000-0x00007FF77FA26000-memory.dmp	xmrig
behavioral2/files/0x0007000000023464-101.dat	xmrig
behavioral2/files/0x0007000000023463-99.dat	xmrig
behavioral2/files/0x0008000000023453-97.dat	xmrig
behavioral2/memory/3444-94-0x00007FF7954D0000-0x00007FF7958C6000-memory.dmp	xmrig
behavioral2/memory/5044-93-0x00007FF72B6D0000-0x00007FF72BAC6000-memory.dmp	xmrig
behavioral2/memory/2800-76-0x00007FF61D8E0000-0x00007FF61DCD6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023460-71.dat	xmrig
behavioral2/files/0x000700000002345f-68.dat	xmrig
behavioral2/files/0x000700000002345e-65.dat	xmrig
behavioral2/memory/4768-64-0x00007FF7E10A0000-0x00007FF7E1496000-memory.dmp	xmrig
behavioral2/files/0x000700000002345d-59.dat	xmrig
behavioral2/files/0x000700000002345b-58.dat	xmrig
behavioral2/memory/2092-50-0x00007FF7CA3F0000-0x00007FF7CA7E6000-memory.dmp	xmrig
behavioral2/memory/3596-12-0x00007FF773410000-0x00007FF773806000-memory.dmp	xmrig
behavioral2/files/0x0009000000023452-10.dat	xmrig
behavioral2/memory/2788-289-0x00007FF6D1610000-0x00007FF6D1A06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023471-288.dat	xmrig
behavioral2/files/0x0007000000023495-306.dat	xmrig
behavioral2/files/0x000700000002349b-316.dat	xmrig
behavioral2/files/0x000700000002349e-323.dat	xmrig
behavioral2/files/0x000700000002349c-326.dat	xmrig
behavioral2/memory/2272-432-0x00007FF6EAAD0000-0x00007FF6EAEC6000-memory.dmp	xmrig
behavioral2/memory/1828-442-0x00007FF728E10000-0x00007FF729206000-memory.dmp	xmrig
behavioral2/memory/2752-626-0x00007FF68BAF0000-0x00007FF68BEE6000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
10	1260	powershell.exe
12	1260	powershell.exe
14	1260	powershell.exe
15	1260	powershell.exe
17	1260	powershell.exe
22	1260	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1260	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3596	vrzeeWQ.exe
2788	uXZZJqg.exe
2092	cYPtVAV.exe
3076	igdHbPF.exe
2272	qwXoXTm.exe
1828	pTWUtGN.exe
2476	XoPPudj.exe
1768	IrbwUNs.exe
4768	oCvTdyv.exe
4380	tRtWZqi.exe
2752	VFMcngw.exe
2800	bDsTQuU.exe
1232	YxsnmwE.exe
1516	obgfUVX.exe
5044	TcdUwNA.exe
3444	yAPfTUU.exe
2244	DlDGDtL.exe
3336	uWMrkXO.exe
2076	QRvzXCF.exe
4044	fKwjvvX.exe
3144	FcBfDbB.exe
2948	OkcuiKJ.exe
1452	xkPMmSQ.exe
4236	fHyqMfq.exe
812	aUSDQXZ.exe
2240	jaWwzxm.exe
2648	bjTZeNs.exe
4544	UppjVhK.exe
4988	zFqFhZD.exe
1136	zZzqmdT.exe
3924	CalzMIt.exe
2932	opzBilB.exe
2592	QPVLAWM.exe
3272	TuNeQen.exe
3112	tYpwPok.exe
4972	srfkYMJ.exe
4316	HolYuop.exe
3928	pngHXxX.exe
3148	yapwzxQ.exe
984	vNEguKJ.exe
3768	ThoKQGc.exe
3824	HgNOgmp.exe
3008	QeVqlAt.exe
4664	ffHeiNp.exe
1100	zxJQaxj.exe
3224	NSJbyep.exe
1708	VFDXoDs.exe
1440	gbDRJyo.exe
1600	OXnMNmr.exe
1888	EDJFGch.exe
3660	RQJHuFS.exe
2892	AbnJLBt.exe
4072	iWWhDTY.exe
4192	GAMoNTF.exe
2488	RRLFAik.exe
3828	HGUjcRU.exe
3192	bLwyvsV.exe
3172	tXXtfGL.exe
4328	iVDgBPX.exe
4028	ubRSnWn.exe
1364	HiMOvES.exe
4612	UvjXWWP.exe
4900	HJxEdbq.exe
1948	tOsZuKs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4940-0-0x00007FF69A490000-0x00007FF69A886000-memory.dmp	upx
behavioral2/files/0x0007000000023457-7.dat	upx
behavioral2/files/0x0007000000023458-18.dat	upx
behavioral2/memory/3076-28-0x00007FF791510000-0x00007FF791906000-memory.dmp	upx
behavioral2/files/0x000700000002345a-27.dat	upx
behavioral2/memory/2788-24-0x00007FF6D1610000-0x00007FF6D1A06000-memory.dmp	upx
behavioral2/files/0x0007000000023459-21.dat	upx
behavioral2/files/0x0007000000023456-19.dat	upx
behavioral2/memory/2272-36-0x00007FF6EAAD0000-0x00007FF6EAEC6000-memory.dmp	upx
behavioral2/files/0x000700000002345c-47.dat	upx
behavioral2/memory/1828-55-0x00007FF728E10000-0x00007FF729206000-memory.dmp	upx
behavioral2/memory/1768-62-0x00007FF72C450000-0x00007FF72C846000-memory.dmp	upx
behavioral2/memory/2752-67-0x00007FF68BAF0000-0x00007FF68BEE6000-memory.dmp	upx
behavioral2/memory/2476-70-0x00007FF6A2540000-0x00007FF6A2936000-memory.dmp	upx
behavioral2/memory/4380-75-0x00007FF671B10000-0x00007FF671F06000-memory.dmp	upx
behavioral2/files/0x0007000000023461-77.dat	upx
behavioral2/memory/1232-92-0x00007FF745E00000-0x00007FF7461F6000-memory.dmp	upx
behavioral2/files/0x0007000000023462-95.dat	upx
behavioral2/memory/1516-104-0x00007FF67DC10000-0x00007FF67E006000-memory.dmp	upx
behavioral2/files/0x0007000000023466-115.dat	upx
behavioral2/memory/3144-127-0x00007FF73E090000-0x00007FF73E486000-memory.dmp	upx
behavioral2/memory/2948-144-0x00007FF7BA3B0000-0x00007FF7BA7A6000-memory.dmp	upx
behavioral2/files/0x000700000002346a-147.dat	upx
behavioral2/memory/1452-163-0x00007FF7C3620000-0x00007FF7C3A16000-memory.dmp	upx
behavioral2/files/0x0007000000023470-173.dat	upx
behavioral2/files/0x000700000002346f-172.dat	upx
behavioral2/files/0x000700000002346e-171.dat	upx
behavioral2/files/0x000700000002346d-170.dat	upx
behavioral2/files/0x000800000002346c-169.dat	upx
behavioral2/memory/4236-168-0x00007FF7D2B50000-0x00007FF7D2F46000-memory.dmp	upx
behavioral2/memory/3596-167-0x00007FF773410000-0x00007FF773806000-memory.dmp	upx
behavioral2/memory/4940-164-0x00007FF69A490000-0x00007FF69A886000-memory.dmp	upx
behavioral2/files/0x0007000000023469-133.dat	upx
behavioral2/memory/4044-132-0x00007FF779BE0000-0x00007FF779FD6000-memory.dmp	upx
behavioral2/files/0x0007000000023468-130.dat	upx
behavioral2/files/0x0007000000023467-128.dat	upx
behavioral2/files/0x0007000000023465-123.dat	upx
behavioral2/memory/2076-121-0x00007FF7974C0000-0x00007FF7978B6000-memory.dmp	upx
behavioral2/memory/3336-120-0x00007FF68BC30000-0x00007FF68C026000-memory.dmp	upx
behavioral2/memory/2244-103-0x00007FF77F630000-0x00007FF77FA26000-memory.dmp	upx
behavioral2/files/0x0007000000023464-101.dat	upx
behavioral2/files/0x0007000000023463-99.dat	upx
behavioral2/files/0x0008000000023453-97.dat	upx
behavioral2/memory/3444-94-0x00007FF7954D0000-0x00007FF7958C6000-memory.dmp	upx
behavioral2/memory/5044-93-0x00007FF72B6D0000-0x00007FF72BAC6000-memory.dmp	upx
behavioral2/memory/2800-76-0x00007FF61D8E0000-0x00007FF61DCD6000-memory.dmp	upx
behavioral2/files/0x0007000000023460-71.dat	upx
behavioral2/files/0x000700000002345f-68.dat	upx
behavioral2/files/0x000700000002345e-65.dat	upx
behavioral2/memory/4768-64-0x00007FF7E10A0000-0x00007FF7E1496000-memory.dmp	upx
behavioral2/files/0x000700000002345d-59.dat	upx
behavioral2/files/0x000700000002345b-58.dat	upx
behavioral2/memory/2092-50-0x00007FF7CA3F0000-0x00007FF7CA7E6000-memory.dmp	upx
behavioral2/memory/3596-12-0x00007FF773410000-0x00007FF773806000-memory.dmp	upx
behavioral2/files/0x0009000000023452-10.dat	upx
behavioral2/memory/2788-289-0x00007FF6D1610000-0x00007FF6D1A06000-memory.dmp	upx
behavioral2/files/0x0007000000023471-288.dat	upx
behavioral2/files/0x0007000000023495-306.dat	upx
behavioral2/files/0x000700000002349b-316.dat	upx
behavioral2/files/0x000700000002349e-323.dat	upx
behavioral2/files/0x000700000002349c-326.dat	upx
behavioral2/memory/2272-432-0x00007FF6EAAD0000-0x00007FF6EAEC6000-memory.dmp	upx
behavioral2/memory/1828-442-0x00007FF728E10000-0x00007FF729206000-memory.dmp	upx
behavioral2/memory/2752-626-0x00007FF68BAF0000-0x00007FF68BEE6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yrCWhMj.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\lGfqVpk.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\LkcUQDu.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\zQhMIdo.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\nFuwhPp.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\hFCKkaA.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\WoMzEav.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\jKvEsBt.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\EiZGjNh.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\ZtqxAti.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\aMXQSBi.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\WJMjYeT.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\mDMFzbd.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\OfIJgrA.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\wDOruTk.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\iEVDGYL.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\dKfFWnM.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\tdPnZZH.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\hAbGJbg.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\qWQVxMT.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\unuxCHl.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\IrwHuNW.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\VRJNfMT.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\gXnQnOe.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\qprGdvZ.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\BwQzZem.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\HngkBhP.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\mBMTxra.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\NcMbiyI.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\jvJpXOQ.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\nsySZdD.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\MJZgdsq.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\iXEjVFu.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\kxoLnIX.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\IPWWfjd.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\ZiNjJSK.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\qAXRlMQ.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\oTaInNx.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\YaYBfLM.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\MNWudCl.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\vFcbXdG.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\hypJzyP.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\BCVDmGo.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\ENoKeip.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\GXozRbU.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\NWDGylH.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\csBXmxE.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\fyZzRqk.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\sVacYzN.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\eGMREoN.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\jbNQGLw.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\UnCsgsO.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\KHfBoKD.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\JmusLFa.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\lxnrpzX.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\veUlENx.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\xFQKXdk.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\YZnePwm.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\QcusLOy.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\WdFzteR.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\sCSnCip.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\nSDOjbA.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\HdoOlRS.exe	a41ca2f8089198574a9894a404cc5880N.exe
File created	C:\Windows\System\CLAmyKB.exe	a41ca2f8089198574a9894a404cc5880N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1260	powershell.exe
1260	powershell.exe
1260	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4940	a41ca2f8089198574a9894a404cc5880N.exe
Token: SeLockMemoryPrivilege	4940	a41ca2f8089198574a9894a404cc5880N.exe
Token: SeDebugPrivilege	1260	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 1260	4940	a41ca2f8089198574a9894a404cc5880N.exe	87
PID 4940 wrote to memory of 1260	4940	a41ca2f8089198574a9894a404cc5880N.exe	87
PID 4940 wrote to memory of 3596	4940	a41ca2f8089198574a9894a404cc5880N.exe	88
PID 4940 wrote to memory of 3596	4940	a41ca2f8089198574a9894a404cc5880N.exe	88
PID 4940 wrote to memory of 2788	4940	a41ca2f8089198574a9894a404cc5880N.exe	89
PID 4940 wrote to memory of 2788	4940	a41ca2f8089198574a9894a404cc5880N.exe	89
PID 4940 wrote to memory of 3076	4940	a41ca2f8089198574a9894a404cc5880N.exe	90
PID 4940 wrote to memory of 3076	4940	a41ca2f8089198574a9894a404cc5880N.exe	90
PID 4940 wrote to memory of 2092	4940	a41ca2f8089198574a9894a404cc5880N.exe	91
PID 4940 wrote to memory of 2092	4940	a41ca2f8089198574a9894a404cc5880N.exe	91
PID 4940 wrote to memory of 2272	4940	a41ca2f8089198574a9894a404cc5880N.exe	92
PID 4940 wrote to memory of 2272	4940	a41ca2f8089198574a9894a404cc5880N.exe	92
PID 4940 wrote to memory of 1828	4940	a41ca2f8089198574a9894a404cc5880N.exe	93
PID 4940 wrote to memory of 1828	4940	a41ca2f8089198574a9894a404cc5880N.exe	93
PID 4940 wrote to memory of 2476	4940	a41ca2f8089198574a9894a404cc5880N.exe	94
PID 4940 wrote to memory of 2476	4940	a41ca2f8089198574a9894a404cc5880N.exe	94
PID 4940 wrote to memory of 1768	4940	a41ca2f8089198574a9894a404cc5880N.exe	95
PID 4940 wrote to memory of 1768	4940	a41ca2f8089198574a9894a404cc5880N.exe	95
PID 4940 wrote to memory of 4768	4940	a41ca2f8089198574a9894a404cc5880N.exe	96
PID 4940 wrote to memory of 4768	4940	a41ca2f8089198574a9894a404cc5880N.exe	96
PID 4940 wrote to memory of 4380	4940	a41ca2f8089198574a9894a404cc5880N.exe	97
PID 4940 wrote to memory of 4380	4940	a41ca2f8089198574a9894a404cc5880N.exe	97
PID 4940 wrote to memory of 2752	4940	a41ca2f8089198574a9894a404cc5880N.exe	98
PID 4940 wrote to memory of 2752	4940	a41ca2f8089198574a9894a404cc5880N.exe	98
PID 4940 wrote to memory of 2800	4940	a41ca2f8089198574a9894a404cc5880N.exe	99
PID 4940 wrote to memory of 2800	4940	a41ca2f8089198574a9894a404cc5880N.exe	99
PID 4940 wrote to memory of 1232	4940	a41ca2f8089198574a9894a404cc5880N.exe	100
PID 4940 wrote to memory of 1232	4940	a41ca2f8089198574a9894a404cc5880N.exe	100
PID 4940 wrote to memory of 1516	4940	a41ca2f8089198574a9894a404cc5880N.exe	101
PID 4940 wrote to memory of 1516	4940	a41ca2f8089198574a9894a404cc5880N.exe	101
PID 4940 wrote to memory of 5044	4940	a41ca2f8089198574a9894a404cc5880N.exe	102
PID 4940 wrote to memory of 5044	4940	a41ca2f8089198574a9894a404cc5880N.exe	102
PID 4940 wrote to memory of 3444	4940	a41ca2f8089198574a9894a404cc5880N.exe	103
PID 4940 wrote to memory of 3444	4940	a41ca2f8089198574a9894a404cc5880N.exe	103
PID 4940 wrote to memory of 2244	4940	a41ca2f8089198574a9894a404cc5880N.exe	104
PID 4940 wrote to memory of 2244	4940	a41ca2f8089198574a9894a404cc5880N.exe	104
PID 4940 wrote to memory of 3336	4940	a41ca2f8089198574a9894a404cc5880N.exe	105
PID 4940 wrote to memory of 3336	4940	a41ca2f8089198574a9894a404cc5880N.exe	105
PID 4940 wrote to memory of 2076	4940	a41ca2f8089198574a9894a404cc5880N.exe	106
PID 4940 wrote to memory of 2076	4940	a41ca2f8089198574a9894a404cc5880N.exe	106
PID 4940 wrote to memory of 4044	4940	a41ca2f8089198574a9894a404cc5880N.exe	107
PID 4940 wrote to memory of 4044	4940	a41ca2f8089198574a9894a404cc5880N.exe	107
PID 4940 wrote to memory of 3144	4940	a41ca2f8089198574a9894a404cc5880N.exe	108
PID 4940 wrote to memory of 3144	4940	a41ca2f8089198574a9894a404cc5880N.exe	108
PID 4940 wrote to memory of 2948	4940	a41ca2f8089198574a9894a404cc5880N.exe	109
PID 4940 wrote to memory of 2948	4940	a41ca2f8089198574a9894a404cc5880N.exe	109
PID 4940 wrote to memory of 1452	4940	a41ca2f8089198574a9894a404cc5880N.exe	110
PID 4940 wrote to memory of 1452	4940	a41ca2f8089198574a9894a404cc5880N.exe	110
PID 4940 wrote to memory of 4236	4940	a41ca2f8089198574a9894a404cc5880N.exe	111
PID 4940 wrote to memory of 4236	4940	a41ca2f8089198574a9894a404cc5880N.exe	111
PID 4940 wrote to memory of 812	4940	a41ca2f8089198574a9894a404cc5880N.exe	112
PID 4940 wrote to memory of 812	4940	a41ca2f8089198574a9894a404cc5880N.exe	112
PID 4940 wrote to memory of 2240	4940	a41ca2f8089198574a9894a404cc5880N.exe	113
PID 4940 wrote to memory of 2240	4940	a41ca2f8089198574a9894a404cc5880N.exe	113
PID 4940 wrote to memory of 2648	4940	a41ca2f8089198574a9894a404cc5880N.exe	114
PID 4940 wrote to memory of 2648	4940	a41ca2f8089198574a9894a404cc5880N.exe	114
PID 4940 wrote to memory of 4544	4940	a41ca2f8089198574a9894a404cc5880N.exe	115
PID 4940 wrote to memory of 4544	4940	a41ca2f8089198574a9894a404cc5880N.exe	115
PID 4940 wrote to memory of 4988	4940	a41ca2f8089198574a9894a404cc5880N.exe	116
PID 4940 wrote to memory of 4988	4940	a41ca2f8089198574a9894a404cc5880N.exe	116
PID 4940 wrote to memory of 1136	4940	a41ca2f8089198574a9894a404cc5880N.exe	117
PID 4940 wrote to memory of 1136	4940	a41ca2f8089198574a9894a404cc5880N.exe	117
PID 4940 wrote to memory of 3924	4940	a41ca2f8089198574a9894a404cc5880N.exe	118
PID 4940 wrote to memory of 3924	4940	a41ca2f8089198574a9894a404cc5880N.exe	118

C:\Users\Admin\AppData\Local\Temp\a41ca2f8089198574a9894a404cc5880N.exe
"C:\Users\Admin\AppData\Local\Temp\a41ca2f8089198574a9894a404cc5880N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\System\vrzeeWQ.exe
  C:\Windows\System\vrzeeWQ.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\uXZZJqg.exe
  C:\Windows\System\uXZZJqg.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\igdHbPF.exe
  C:\Windows\System\igdHbPF.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\cYPtVAV.exe
  C:\Windows\System\cYPtVAV.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\qwXoXTm.exe
  C:\Windows\System\qwXoXTm.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\pTWUtGN.exe
  C:\Windows\System\pTWUtGN.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\XoPPudj.exe
  C:\Windows\System\XoPPudj.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\IrbwUNs.exe
  C:\Windows\System\IrbwUNs.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\oCvTdyv.exe
  C:\Windows\System\oCvTdyv.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\tRtWZqi.exe
  C:\Windows\System\tRtWZqi.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\VFMcngw.exe
  C:\Windows\System\VFMcngw.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\bDsTQuU.exe
  C:\Windows\System\bDsTQuU.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\YxsnmwE.exe
  C:\Windows\System\YxsnmwE.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\obgfUVX.exe
  C:\Windows\System\obgfUVX.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\TcdUwNA.exe
  C:\Windows\System\TcdUwNA.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\yAPfTUU.exe
  C:\Windows\System\yAPfTUU.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\DlDGDtL.exe
  C:\Windows\System\DlDGDtL.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\uWMrkXO.exe
  C:\Windows\System\uWMrkXO.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\QRvzXCF.exe
  C:\Windows\System\QRvzXCF.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\fKwjvvX.exe
  C:\Windows\System\fKwjvvX.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\FcBfDbB.exe
  C:\Windows\System\FcBfDbB.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\OkcuiKJ.exe
  C:\Windows\System\OkcuiKJ.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\xkPMmSQ.exe
  C:\Windows\System\xkPMmSQ.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\fHyqMfq.exe
  C:\Windows\System\fHyqMfq.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\aUSDQXZ.exe
  C:\Windows\System\aUSDQXZ.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\jaWwzxm.exe
  C:\Windows\System\jaWwzxm.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\bjTZeNs.exe
  C:\Windows\System\bjTZeNs.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\UppjVhK.exe
  C:\Windows\System\UppjVhK.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\zFqFhZD.exe
  C:\Windows\System\zFqFhZD.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\zZzqmdT.exe
  C:\Windows\System\zZzqmdT.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\CalzMIt.exe
  C:\Windows\System\CalzMIt.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\opzBilB.exe
  C:\Windows\System\opzBilB.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\QPVLAWM.exe
  C:\Windows\System\QPVLAWM.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\TuNeQen.exe
  C:\Windows\System\TuNeQen.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\tYpwPok.exe
  C:\Windows\System\tYpwPok.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\srfkYMJ.exe
  C:\Windows\System\srfkYMJ.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\HolYuop.exe
  C:\Windows\System\HolYuop.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\pngHXxX.exe
  C:\Windows\System\pngHXxX.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\yapwzxQ.exe
  C:\Windows\System\yapwzxQ.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\vNEguKJ.exe
  C:\Windows\System\vNEguKJ.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\ThoKQGc.exe
  C:\Windows\System\ThoKQGc.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\HgNOgmp.exe
  C:\Windows\System\HgNOgmp.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\QeVqlAt.exe
  C:\Windows\System\QeVqlAt.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\ffHeiNp.exe
  C:\Windows\System\ffHeiNp.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\zxJQaxj.exe
  C:\Windows\System\zxJQaxj.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\NSJbyep.exe
  C:\Windows\System\NSJbyep.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\VFDXoDs.exe
  C:\Windows\System\VFDXoDs.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\OXnMNmr.exe
  C:\Windows\System\OXnMNmr.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\gbDRJyo.exe
  C:\Windows\System\gbDRJyo.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\EDJFGch.exe
  C:\Windows\System\EDJFGch.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\RQJHuFS.exe
  C:\Windows\System\RQJHuFS.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\AbnJLBt.exe
  C:\Windows\System\AbnJLBt.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\iWWhDTY.exe
  C:\Windows\System\iWWhDTY.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\GAMoNTF.exe
  C:\Windows\System\GAMoNTF.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\RRLFAik.exe
  C:\Windows\System\RRLFAik.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\HGUjcRU.exe
  C:\Windows\System\HGUjcRU.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\bLwyvsV.exe
  C:\Windows\System\bLwyvsV.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\tXXtfGL.exe
  C:\Windows\System\tXXtfGL.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\iVDgBPX.exe
  C:\Windows\System\iVDgBPX.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\ubRSnWn.exe
  C:\Windows\System\ubRSnWn.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\HiMOvES.exe
  C:\Windows\System\HiMOvES.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\UvjXWWP.exe
  C:\Windows\System\UvjXWWP.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\HJxEdbq.exe
  C:\Windows\System\HJxEdbq.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\tOsZuKs.exe
  C:\Windows\System\tOsZuKs.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\iWFclpc.exe
  C:\Windows\System\iWFclpc.exe
  2⤵
  PID:2588
- C:\Windows\System\ikBqxVQ.exe
  C:\Windows\System\ikBqxVQ.exe
  2⤵
  PID:2700
- C:\Windows\System\sYYoEsq.exe
  C:\Windows\System\sYYoEsq.exe
  2⤵
  PID:4372
- C:\Windows\System\YQDgNLx.exe
  C:\Windows\System\YQDgNLx.exe
  2⤵
  PID:2680
- C:\Windows\System\ZVAhRAt.exe
  C:\Windows\System\ZVAhRAt.exe
  2⤵
  PID:3628
- C:\Windows\System\atLQTkp.exe
  C:\Windows\System\atLQTkp.exe
  2⤵
  PID:2280
- C:\Windows\System\JRGCqvM.exe
  C:\Windows\System\JRGCqvM.exe
  2⤵
  PID:4936
- C:\Windows\System\nMjULgi.exe
  C:\Windows\System\nMjULgi.exe
  2⤵
  PID:1580
- C:\Windows\System\CWjhfyN.exe
  C:\Windows\System\CWjhfyN.exe
  2⤵
  PID:2212
- C:\Windows\System\NjLVdmq.exe
  C:\Windows\System\NjLVdmq.exe
  2⤵
  PID:2300
- C:\Windows\System\eAodwna.exe
  C:\Windows\System\eAodwna.exe
  2⤵
  PID:1720
- C:\Windows\System\iZuTPLs.exe
  C:\Windows\System\iZuTPLs.exe
  2⤵
  PID:1360
- C:\Windows\System\pcZfELf.exe
  C:\Windows\System\pcZfELf.exe
  2⤵
  PID:1056
- C:\Windows\System\TdTWtDc.exe
  C:\Windows\System\TdTWtDc.exe
  2⤵
  PID:2504
- C:\Windows\System\iDIRZml.exe
  C:\Windows\System\iDIRZml.exe
  2⤵
  PID:744
- C:\Windows\System\iyXZVYd.exe
  C:\Windows\System\iyXZVYd.exe
  2⤵
  PID:5148
- C:\Windows\System\EIyztnD.exe
  C:\Windows\System\EIyztnD.exe
  2⤵
  PID:5172
- C:\Windows\System\CogjOyc.exe
  C:\Windows\System\CogjOyc.exe
  2⤵
  PID:5200
- C:\Windows\System\sHEqARv.exe
  C:\Windows\System\sHEqARv.exe
  2⤵
  PID:5228
- C:\Windows\System\TjUeQIw.exe
  C:\Windows\System\TjUeQIw.exe
  2⤵
  PID:5264
- C:\Windows\System\rsYyyoC.exe
  C:\Windows\System\rsYyyoC.exe
  2⤵
  PID:5296
- C:\Windows\System\pFHREFN.exe
  C:\Windows\System\pFHREFN.exe
  2⤵
  PID:5336
- C:\Windows\System\iFsSnJH.exe
  C:\Windows\System\iFsSnJH.exe
  2⤵
  PID:5364
- C:\Windows\System\lsqlmKT.exe
  C:\Windows\System\lsqlmKT.exe
  2⤵
  PID:5396
- C:\Windows\System\vIBJLfI.exe
  C:\Windows\System\vIBJLfI.exe
  2⤵
  PID:5428
- C:\Windows\System\EdJgvqK.exe
  C:\Windows\System\EdJgvqK.exe
  2⤵
  PID:5448
- C:\Windows\System\ZjMmnmq.exe
  C:\Windows\System\ZjMmnmq.exe
  2⤵
  PID:5484
- C:\Windows\System\NAmntbY.exe
  C:\Windows\System\NAmntbY.exe
  2⤵
  PID:5500
- C:\Windows\System\QzgkZRF.exe
  C:\Windows\System\QzgkZRF.exe
  2⤵
  PID:5552
- C:\Windows\System\FbphoNx.exe
  C:\Windows\System\FbphoNx.exe
  2⤵
  PID:5572
- C:\Windows\System\GlGLGtP.exe
  C:\Windows\System\GlGLGtP.exe
  2⤵
  PID:5616
- C:\Windows\System\HRHRqQA.exe
  C:\Windows\System\HRHRqQA.exe
  2⤵
  PID:5648
- C:\Windows\System\JEgsYrX.exe
  C:\Windows\System\JEgsYrX.exe
  2⤵
  PID:5664
- C:\Windows\System\pdIoLLC.exe
  C:\Windows\System\pdIoLLC.exe
  2⤵
  PID:5684
- C:\Windows\System\BDjeaAW.exe
  C:\Windows\System\BDjeaAW.exe
  2⤵
  PID:5708
- C:\Windows\System\RrEmhtv.exe
  C:\Windows\System\RrEmhtv.exe
  2⤵
  PID:5724
- C:\Windows\System\KVqLhjm.exe
  C:\Windows\System\KVqLhjm.exe
  2⤵
  PID:5740
- C:\Windows\System\HlnDzyW.exe
  C:\Windows\System\HlnDzyW.exe
  2⤵
  PID:5792
- C:\Windows\System\XSbsXTn.exe
  C:\Windows\System\XSbsXTn.exe
  2⤵
  PID:5824
- C:\Windows\System\kMXpQfn.exe
  C:\Windows\System\kMXpQfn.exe
  2⤵
  PID:5868
- C:\Windows\System\UYTSXmT.exe
  C:\Windows\System\UYTSXmT.exe
  2⤵
  PID:5912
- C:\Windows\System\LtkUZyr.exe
  C:\Windows\System\LtkUZyr.exe
  2⤵
  PID:5944
- C:\Windows\System\qQOlwUV.exe
  C:\Windows\System\qQOlwUV.exe
  2⤵
  PID:5980
- C:\Windows\System\kMEIZaq.exe
  C:\Windows\System\kMEIZaq.exe
  2⤵
  PID:6056
- C:\Windows\System\ixkkmrN.exe
  C:\Windows\System\ixkkmrN.exe
  2⤵
  PID:6080
- C:\Windows\System\PeYIvUG.exe
  C:\Windows\System\PeYIvUG.exe
  2⤵
  PID:6100
- C:\Windows\System\RhYbMWo.exe
  C:\Windows\System\RhYbMWo.exe
  2⤵
  PID:6132
- C:\Windows\System\qIohcWy.exe
  C:\Windows\System\qIohcWy.exe
  2⤵
  PID:5132
- C:\Windows\System\CXsVmmX.exe
  C:\Windows\System\CXsVmmX.exe
  2⤵
  PID:5160
- C:\Windows\System\GVcifKz.exe
  C:\Windows\System\GVcifKz.exe
  2⤵
  PID:5260
- C:\Windows\System\AolBmfU.exe
  C:\Windows\System\AolBmfU.exe
  2⤵
  PID:5328
- C:\Windows\System\hJcDToB.exe
  C:\Windows\System\hJcDToB.exe
  2⤵
  PID:5436
- C:\Windows\System\wOfOnhv.exe
  C:\Windows\System\wOfOnhv.exe
  2⤵
  PID:5456
- C:\Windows\System\uWxKFkD.exe
  C:\Windows\System\uWxKFkD.exe
  2⤵
  PID:5512
- C:\Windows\System\ARjBxlX.exe
  C:\Windows\System\ARjBxlX.exe
  2⤵
  PID:5588
- C:\Windows\System\bZwapzx.exe
  C:\Windows\System\bZwapzx.exe
  2⤵
  PID:5644
- C:\Windows\System\OvyxuUh.exe
  C:\Windows\System\OvyxuUh.exe
  2⤵
  PID:5696
- C:\Windows\System\SJPfUUR.exe
  C:\Windows\System\SJPfUUR.exe
  2⤵
  PID:5804
- C:\Windows\System\AlSojNb.exe
  C:\Windows\System\AlSojNb.exe
  2⤵
  PID:5908
- C:\Windows\System\islPPMN.exe
  C:\Windows\System\islPPMN.exe
  2⤵
  PID:5976
- C:\Windows\System\uWQZKfo.exe
  C:\Windows\System\uWQZKfo.exe
  2⤵
  PID:5680
- C:\Windows\System\UoYUoBS.exe
  C:\Windows\System\UoYUoBS.exe
  2⤵
  PID:6096
- C:\Windows\System\JYMTddL.exe
  C:\Windows\System\JYMTddL.exe
  2⤵
  PID:5168
- C:\Windows\System\kuQbaBR.exe
  C:\Windows\System\kuQbaBR.exe
  2⤵
  PID:5144
- C:\Windows\System\cnZdPgV.exe
  C:\Windows\System\cnZdPgV.exe
  2⤵
  PID:5388
- C:\Windows\System\vsukXVS.exe
  C:\Windows\System\vsukXVS.exe
  2⤵
  PID:5304
- C:\Windows\System\WsBybTX.exe
  C:\Windows\System\WsBybTX.exe
  2⤵
  PID:5536
- C:\Windows\System\rZaBtCd.exe
  C:\Windows\System\rZaBtCd.exe
  2⤵
  PID:5736
- C:\Windows\System\NOafljM.exe
  C:\Windows\System\NOafljM.exe
  2⤵
  PID:5888
- C:\Windows\System\FIsXqGu.exe
  C:\Windows\System\FIsXqGu.exe
  2⤵
  PID:2432
- C:\Windows\System\FbEsKlD.exe
  C:\Windows\System\FbEsKlD.exe
  2⤵
  PID:6072
- C:\Windows\System\KBRxNMA.exe
  C:\Windows\System\KBRxNMA.exe
  2⤵
  PID:5240
- C:\Windows\System\DwiBGNs.exe
  C:\Windows\System\DwiBGNs.exe
  2⤵
  PID:5624
- C:\Windows\System\tsulcHm.exe
  C:\Windows\System\tsulcHm.exe
  2⤵
  PID:5964
- C:\Windows\System\kqubfkM.exe
  C:\Windows\System\kqubfkM.exe
  2⤵
  PID:5084
- C:\Windows\System\yFniyzG.exe
  C:\Windows\System\yFniyzG.exe
  2⤵
  PID:6124
- C:\Windows\System\eCbffXS.exe
  C:\Windows\System\eCbffXS.exe
  2⤵
  PID:3136
- C:\Windows\System\QAGQClR.exe
  C:\Windows\System\QAGQClR.exe
  2⤵
  PID:6152
- C:\Windows\System\GIvVLzg.exe
  C:\Windows\System\GIvVLzg.exe
  2⤵
  PID:6180
- C:\Windows\System\iXEjVFu.exe
  C:\Windows\System\iXEjVFu.exe
  2⤵
  PID:6220
- C:\Windows\System\bhZOcOM.exe
  C:\Windows\System\bhZOcOM.exe
  2⤵
  PID:6236
- C:\Windows\System\fImMznZ.exe
  C:\Windows\System\fImMznZ.exe
  2⤵
  PID:6264
- C:\Windows\System\ANmpXuN.exe
  C:\Windows\System\ANmpXuN.exe
  2⤵
  PID:6304
- C:\Windows\System\eKeIycb.exe
  C:\Windows\System\eKeIycb.exe
  2⤵
  PID:6332
- C:\Windows\System\tgFZrnv.exe
  C:\Windows\System\tgFZrnv.exe
  2⤵
  PID:6348
- C:\Windows\System\GYGDbXr.exe
  C:\Windows\System\GYGDbXr.exe
  2⤵
  PID:6408
- C:\Windows\System\owtbcAU.exe
  C:\Windows\System\owtbcAU.exe
  2⤵
  PID:6436
- C:\Windows\System\EcEtSbc.exe
  C:\Windows\System\EcEtSbc.exe
  2⤵
  PID:6480
- C:\Windows\System\prnZPTV.exe
  C:\Windows\System\prnZPTV.exe
  2⤵
  PID:6500
- C:\Windows\System\RIKMtFi.exe
  C:\Windows\System\RIKMtFi.exe
  2⤵
  PID:6528
- C:\Windows\System\nSPwtwX.exe
  C:\Windows\System\nSPwtwX.exe
  2⤵
  PID:6548
- C:\Windows\System\AUFuhVj.exe
  C:\Windows\System\AUFuhVj.exe
  2⤵
  PID:6572
- C:\Windows\System\tlWHfOq.exe
  C:\Windows\System\tlWHfOq.exe
  2⤵
  PID:6612
- C:\Windows\System\kaXLDrI.exe
  C:\Windows\System\kaXLDrI.exe
  2⤵
  PID:6628
- C:\Windows\System\ElitoxO.exe
  C:\Windows\System\ElitoxO.exe
  2⤵
  PID:6664
- C:\Windows\System\npLinRS.exe
  C:\Windows\System\npLinRS.exe
  2⤵
  PID:6684
- C:\Windows\System\YeHkhLG.exe
  C:\Windows\System\YeHkhLG.exe
  2⤵
  PID:6724
- C:\Windows\System\bfvWIWI.exe
  C:\Windows\System\bfvWIWI.exe
  2⤵
  PID:6740
- C:\Windows\System\WtiYAdy.exe
  C:\Windows\System\WtiYAdy.exe
  2⤵
  PID:6760
- C:\Windows\System\lSYWjNS.exe
  C:\Windows\System\lSYWjNS.exe
  2⤵
  PID:6788
- C:\Windows\System\ltQPxjj.exe
  C:\Windows\System\ltQPxjj.exe
  2⤵
  PID:6812
- C:\Windows\System\nqeNXCd.exe
  C:\Windows\System\nqeNXCd.exe
  2⤵
  PID:6852
- C:\Windows\System\jzcXARW.exe
  C:\Windows\System\jzcXARW.exe
  2⤵
  PID:6884
- C:\Windows\System\hfsyNjB.exe
  C:\Windows\System\hfsyNjB.exe
  2⤵
  PID:6920
- C:\Windows\System\fwechly.exe
  C:\Windows\System\fwechly.exe
  2⤵
  PID:6948
- C:\Windows\System\HfAaxEc.exe
  C:\Windows\System\HfAaxEc.exe
  2⤵
  PID:6972
- C:\Windows\System\jyUuMiM.exe
  C:\Windows\System\jyUuMiM.exe
  2⤵
  PID:6996
- C:\Windows\System\kLtgcSE.exe
  C:\Windows\System\kLtgcSE.exe
  2⤵
  PID:7024
- C:\Windows\System\atlRtLH.exe
  C:\Windows\System\atlRtLH.exe
  2⤵
  PID:7040
- C:\Windows\System\PIqLZGF.exe
  C:\Windows\System\PIqLZGF.exe
  2⤵
  PID:7072
- C:\Windows\System\KvUaUUl.exe
  C:\Windows\System\KvUaUUl.exe
  2⤵
  PID:7120
- C:\Windows\System\yFNVtIM.exe
  C:\Windows\System\yFNVtIM.exe
  2⤵
  PID:7148
- C:\Windows\System\nYQTzmz.exe
  C:\Windows\System\nYQTzmz.exe
  2⤵
  PID:7164
- C:\Windows\System\oMMLyxU.exe
  C:\Windows\System\oMMLyxU.exe
  2⤵
  PID:6168
- C:\Windows\System\aoCNwCd.exe
  C:\Windows\System\aoCNwCd.exe
  2⤵
  PID:6192
- C:\Windows\System\UhIhbWi.exe
  C:\Windows\System\UhIhbWi.exe
  2⤵
  PID:6276
- C:\Windows\System\naUYOcN.exe
  C:\Windows\System\naUYOcN.exe
  2⤵
  PID:6360
- C:\Windows\System\smqfCbv.exe
  C:\Windows\System\smqfCbv.exe
  2⤵
  PID:6420
- C:\Windows\System\WPvkDbY.exe
  C:\Windows\System\WPvkDbY.exe
  2⤵
  PID:6488
- C:\Windows\System\NbsaAXp.exe
  C:\Windows\System\NbsaAXp.exe
  2⤵
  PID:6544
- C:\Windows\System\YUkLlUG.exe
  C:\Windows\System\YUkLlUG.exe
  2⤵
  PID:6624
- C:\Windows\System\nsjyLYa.exe
  C:\Windows\System\nsjyLYa.exe
  2⤵
  PID:6736
- C:\Windows\System\HYNAKIm.exe
  C:\Windows\System\HYNAKIm.exe
  2⤵
  PID:6772
- C:\Windows\System\IPoLfFB.exe
  C:\Windows\System\IPoLfFB.exe
  2⤵
  PID:6796
- C:\Windows\System\auVhHrs.exe
  C:\Windows\System\auVhHrs.exe
  2⤵
  PID:6904
- C:\Windows\System\PChjvQh.exe
  C:\Windows\System\PChjvQh.exe
  2⤵
  PID:7036
- C:\Windows\System\cNVIdwE.exe
  C:\Windows\System\cNVIdwE.exe
  2⤵
  PID:7140
- C:\Windows\System\DGUGZWp.exe
  C:\Windows\System\DGUGZWp.exe
  2⤵
  PID:7160
- C:\Windows\System\gqFUyCn.exe
  C:\Windows\System\gqFUyCn.exe
  2⤵
  PID:6252
- C:\Windows\System\LJcqOHY.exe
  C:\Windows\System\LJcqOHY.exe
  2⤵
  PID:6564
- C:\Windows\System\cAScXHn.exe
  C:\Windows\System\cAScXHn.exe
  2⤵
  PID:6800
- C:\Windows\System\IlUlkQa.exe
  C:\Windows\System\IlUlkQa.exe
  2⤵
  PID:6880
- C:\Windows\System\EPEdbEy.exe
  C:\Windows\System\EPEdbEy.exe
  2⤵
  PID:6248
- C:\Windows\System\CSoNMso.exe
  C:\Windows\System\CSoNMso.exe
  2⤵
  PID:6892
- C:\Windows\System\bzYgLjL.exe
  C:\Windows\System\bzYgLjL.exe
  2⤵
  PID:4492
- C:\Windows\System\FJECxnV.exe
  C:\Windows\System\FJECxnV.exe
  2⤵
  PID:7100
- C:\Windows\System\BIQNkwB.exe
  C:\Windows\System\BIQNkwB.exe
  2⤵
  PID:7212
- C:\Windows\System\RdySlOJ.exe
  C:\Windows\System\RdySlOJ.exe
  2⤵
  PID:7252
- C:\Windows\System\pElFtzc.exe
  C:\Windows\System\pElFtzc.exe
  2⤵
  PID:7268
- C:\Windows\System\xqbbJjd.exe
  C:\Windows\System\xqbbJjd.exe
  2⤵
  PID:7288
- C:\Windows\System\QUKEYKX.exe
  C:\Windows\System\QUKEYKX.exe
  2⤵
  PID:7324
- C:\Windows\System\HwTZPSs.exe
  C:\Windows\System\HwTZPSs.exe
  2⤵
  PID:7352
- C:\Windows\System\VyUDyPw.exe
  C:\Windows\System\VyUDyPw.exe
  2⤵
  PID:7376
- C:\Windows\System\LPSKcMB.exe
  C:\Windows\System\LPSKcMB.exe
  2⤵
  PID:7408
- C:\Windows\System\xbGgjEX.exe
  C:\Windows\System\xbGgjEX.exe
  2⤵
  PID:7436
- C:\Windows\System\Tgcalxm.exe
  C:\Windows\System\Tgcalxm.exe
  2⤵
  PID:7452
- C:\Windows\System\wDqZxsK.exe
  C:\Windows\System\wDqZxsK.exe
  2⤵
  PID:7488
- C:\Windows\System\GTwNogu.exe
  C:\Windows\System\GTwNogu.exe
  2⤵
  PID:7508
- C:\Windows\System\YQHiLnf.exe
  C:\Windows\System\YQHiLnf.exe
  2⤵
  PID:7548
- C:\Windows\System\hZArmZl.exe
  C:\Windows\System\hZArmZl.exe
  2⤵
  PID:7568
- C:\Windows\System\VIADdGJ.exe
  C:\Windows\System\VIADdGJ.exe
  2⤵
  PID:7604
- C:\Windows\System\olTxMSb.exe
  C:\Windows\System\olTxMSb.exe
  2⤵
  PID:7660
- C:\Windows\System\OascaHm.exe
  C:\Windows\System\OascaHm.exe
  2⤵
  PID:7680
- C:\Windows\System\nmHVWhc.exe
  C:\Windows\System\nmHVWhc.exe
  2⤵
  PID:7700
- C:\Windows\System\qtHrOIL.exe
  C:\Windows\System\qtHrOIL.exe
  2⤵
  PID:7728
- C:\Windows\System\iZcnZur.exe
  C:\Windows\System\iZcnZur.exe
  2⤵
  PID:7756
- C:\Windows\System\vrhbXNm.exe
  C:\Windows\System\vrhbXNm.exe
  2⤵
  PID:7780
- C:\Windows\System\pjHfNew.exe
  C:\Windows\System\pjHfNew.exe
  2⤵
  PID:7796
- C:\Windows\System\svZWCly.exe
  C:\Windows\System\svZWCly.exe
  2⤵
  PID:7816
- C:\Windows\System\CEkjbPE.exe
  C:\Windows\System\CEkjbPE.exe
  2⤵
  PID:7848
- C:\Windows\System\hxMOOjf.exe
  C:\Windows\System\hxMOOjf.exe
  2⤵
  PID:7876
- C:\Windows\System\uBYNnvC.exe
  C:\Windows\System\uBYNnvC.exe
  2⤵
  PID:7912
- C:\Windows\System\OORfMIh.exe
  C:\Windows\System\OORfMIh.exe
  2⤵
  PID:7960
- C:\Windows\System\feQZRdC.exe
  C:\Windows\System\feQZRdC.exe
  2⤵
  PID:7988
- C:\Windows\System\hqHMEMO.exe
  C:\Windows\System\hqHMEMO.exe
  2⤵
  PID:8016
- C:\Windows\System\GIvaUyW.exe
  C:\Windows\System\GIvaUyW.exe
  2⤵
  PID:8044
- C:\Windows\System\kBQRYGT.exe
  C:\Windows\System\kBQRYGT.exe
  2⤵
  PID:8088
- C:\Windows\System\iJFXUkx.exe
  C:\Windows\System\iJFXUkx.exe
  2⤵
  PID:8116
- C:\Windows\System\VukYEzX.exe
  C:\Windows\System\VukYEzX.exe
  2⤵
  PID:8136
- C:\Windows\System\PjUdjoB.exe
  C:\Windows\System\PjUdjoB.exe
  2⤵
  PID:8164
- C:\Windows\System\tAXeyaG.exe
  C:\Windows\System\tAXeyaG.exe
  2⤵
  PID:7176
- C:\Windows\System\KSsHbyg.exe
  C:\Windows\System\KSsHbyg.exe
  2⤵
  PID:7196
- C:\Windows\System\xpOCNcZ.exe
  C:\Windows\System\xpOCNcZ.exe
  2⤵
  PID:7232
- C:\Windows\System\doLZWbo.exe
  C:\Windows\System\doLZWbo.exe
  2⤵
  PID:7276
- C:\Windows\System\aezsIyk.exe
  C:\Windows\System\aezsIyk.exe
  2⤵
  PID:7360
- C:\Windows\System\DRkrprl.exe
  C:\Windows\System\DRkrprl.exe
  2⤵
  PID:7464
- C:\Windows\System\hHfFcOg.exe
  C:\Windows\System\hHfFcOg.exe
  2⤵
  PID:7520
- C:\Windows\System\HqBVgTY.exe
  C:\Windows\System\HqBVgTY.exe
  2⤵
  PID:7596
- C:\Windows\System\UTkRpki.exe
  C:\Windows\System\UTkRpki.exe
  2⤵
  PID:7692
- C:\Windows\System\WuvpKsY.exe
  C:\Windows\System\WuvpKsY.exe
  2⤵
  PID:7560
- C:\Windows\System\VZbvWKj.exe
  C:\Windows\System\VZbvWKj.exe
  2⤵
  PID:7860
- C:\Windows\System\oPtbmXo.exe
  C:\Windows\System\oPtbmXo.exe
  2⤵
  PID:7896
- C:\Windows\System\mKvFYxG.exe
  C:\Windows\System\mKvFYxG.exe
  2⤵
  PID:7976
- C:\Windows\System\alSLOsI.exe
  C:\Windows\System\alSLOsI.exe
  2⤵
  PID:8084
- C:\Windows\System\IOVXpEs.exe
  C:\Windows\System\IOVXpEs.exe
  2⤵
  PID:8152
- C:\Windows\System\klKZlRj.exe
  C:\Windows\System\klKZlRj.exe
  2⤵
  PID:7296
- C:\Windows\System\xixtkBz.exe
  C:\Windows\System\xixtkBz.exe
  2⤵
  PID:7404
- C:\Windows\System\tfWxPKq.exe
  C:\Windows\System\tfWxPKq.exe
  2⤵
  PID:7480
- C:\Windows\System\lVPqycE.exe
  C:\Windows\System\lVPqycE.exe
  2⤵
  PID:7768
- C:\Windows\System\rqVotOa.exe
  C:\Windows\System\rqVotOa.exe
  2⤵
  PID:7920
- C:\Windows\System\BbesCiv.exe
  C:\Windows\System\BbesCiv.exe
  2⤵
  PID:6048
- C:\Windows\System\TNKJyFf.exe
  C:\Windows\System\TNKJyFf.exe
  2⤵
  PID:7668
- C:\Windows\System\CXAahbv.exe
  C:\Windows\System\CXAahbv.exe
  2⤵
  PID:7228
- C:\Windows\System\rxUuMTN.exe
  C:\Windows\System\rxUuMTN.exe
  2⤵
  PID:8224
- C:\Windows\System\rTkwalW.exe
  C:\Windows\System\rTkwalW.exe
  2⤵
  PID:8248
- C:\Windows\System\XRBgkhR.exe
  C:\Windows\System\XRBgkhR.exe
  2⤵
  PID:8280
- C:\Windows\System\HfAcPbH.exe
  C:\Windows\System\HfAcPbH.exe
  2⤵
  PID:8324
- C:\Windows\System\GYnpPqP.exe
  C:\Windows\System\GYnpPqP.exe
  2⤵
  PID:8344
- C:\Windows\System\YJEqLAU.exe
  C:\Windows\System\YJEqLAU.exe
  2⤵
  PID:8372
- C:\Windows\System\UlIsXaJ.exe
  C:\Windows\System\UlIsXaJ.exe
  2⤵
  PID:8396
- C:\Windows\System\iteHbeC.exe
  C:\Windows\System\iteHbeC.exe
  2⤵
  PID:8440
- C:\Windows\System\BGbssqH.exe
  C:\Windows\System\BGbssqH.exe
  2⤵
  PID:8468
- C:\Windows\System\rqhswPA.exe
  C:\Windows\System\rqhswPA.exe
  2⤵
  PID:8492
- C:\Windows\System\yhmHArx.exe
  C:\Windows\System\yhmHArx.exe
  2⤵
  PID:8524
- C:\Windows\System\OpqGkGk.exe
  C:\Windows\System\OpqGkGk.exe
  2⤵
  PID:8548
- C:\Windows\System\wDIkNzs.exe
  C:\Windows\System\wDIkNzs.exe
  2⤵
  PID:8576
- C:\Windows\System\SGlEwrh.exe
  C:\Windows\System\SGlEwrh.exe
  2⤵
  PID:8620
- C:\Windows\System\jHCeIEo.exe
  C:\Windows\System\jHCeIEo.exe
  2⤵
  PID:8660
- C:\Windows\System\gnbxKxT.exe
  C:\Windows\System\gnbxKxT.exe
  2⤵
  PID:8688
- C:\Windows\System\AEIpCFm.exe
  C:\Windows\System\AEIpCFm.exe
  2⤵
  PID:8704
- C:\Windows\System\dEfxgVB.exe
  C:\Windows\System\dEfxgVB.exe
  2⤵
  PID:8736
- C:\Windows\System\cVpkeAD.exe
  C:\Windows\System\cVpkeAD.exe
  2⤵
  PID:8768
- C:\Windows\System\abenElp.exe
  C:\Windows\System\abenElp.exe
  2⤵
  PID:8796
- C:\Windows\System\yPpqseU.exe
  C:\Windows\System\yPpqseU.exe
  2⤵
  PID:8836
- C:\Windows\System\YynRrIP.exe
  C:\Windows\System\YynRrIP.exe
  2⤵
  PID:8868
- C:\Windows\System\zwcKdKK.exe
  C:\Windows\System\zwcKdKK.exe
  2⤵
  PID:8904
- C:\Windows\System\dQRmyGV.exe
  C:\Windows\System\dQRmyGV.exe
  2⤵
  PID:8924
- C:\Windows\System\MHOvUvW.exe
  C:\Windows\System\MHOvUvW.exe
  2⤵
  PID:8968
- C:\Windows\System\VEouFuT.exe
  C:\Windows\System\VEouFuT.exe
  2⤵
  PID:8996
- C:\Windows\System\FciSdHw.exe
  C:\Windows\System\FciSdHw.exe
  2⤵
  PID:9024
- C:\Windows\System\lQColVi.exe
  C:\Windows\System\lQColVi.exe
  2⤵
  PID:9052
- C:\Windows\System\NiPSfwq.exe
  C:\Windows\System\NiPSfwq.exe
  2⤵
  PID:9080
- C:\Windows\System\miYtAxj.exe
  C:\Windows\System\miYtAxj.exe
  2⤵
  PID:9108
- C:\Windows\System\JvXpVug.exe
  C:\Windows\System\JvXpVug.exe
  2⤵
  PID:9140
- C:\Windows\System\UXwfDHd.exe
  C:\Windows\System\UXwfDHd.exe
  2⤵
  PID:9156
- C:\Windows\System\IHyoUFe.exe
  C:\Windows\System\IHyoUFe.exe
  2⤵
  PID:9184
- C:\Windows\System\eTmbOtA.exe
  C:\Windows\System\eTmbOtA.exe
  2⤵
  PID:9212
- C:\Windows\System\zXiLrhD.exe
  C:\Windows\System\zXiLrhD.exe
  2⤵
  PID:8240
- C:\Windows\System\IykxxkB.exe
  C:\Windows\System\IykxxkB.exe
  2⤵
  PID:8304
- C:\Windows\System\bXoiBRr.exe
  C:\Windows\System\bXoiBRr.exe
  2⤵
  PID:8392
- C:\Windows\System\zyoREbY.exe
  C:\Windows\System\zyoREbY.exe
  2⤵
  PID:8388
- C:\Windows\System\vWzhpyJ.exe
  C:\Windows\System\vWzhpyJ.exe
  2⤵
  PID:8464
- C:\Windows\System\MepPGlZ.exe
  C:\Windows\System\MepPGlZ.exe
  2⤵
  PID:4816
- C:\Windows\System\osSRbZA.exe
  C:\Windows\System\osSRbZA.exe
  2⤵
  PID:8628
- C:\Windows\System\DNkYfTr.exe
  C:\Windows\System\DNkYfTr.exe
  2⤵
  PID:8696
- C:\Windows\System\KQHYPmM.exe
  C:\Windows\System\KQHYPmM.exe
  2⤵
  PID:8748
- C:\Windows\System\JExoknp.exe
  C:\Windows\System\JExoknp.exe
  2⤵
  PID:8804
- C:\Windows\System\ZZjGUUt.exe
  C:\Windows\System\ZZjGUUt.exe
  2⤵
  PID:8852
- C:\Windows\System\ovNgUQL.exe
  C:\Windows\System\ovNgUQL.exe
  2⤵
  PID:8900
- C:\Windows\System\TdQlGtd.exe
  C:\Windows\System\TdQlGtd.exe
  2⤵
  PID:8960
- C:\Windows\System\ewVdhmC.exe
  C:\Windows\System\ewVdhmC.exe
  2⤵
  PID:9012
- C:\Windows\System\tkEEbRD.exe
  C:\Windows\System\tkEEbRD.exe
  2⤵
  PID:9092
- C:\Windows\System\bKfJvbZ.exe
  C:\Windows\System\bKfJvbZ.exe
  2⤵
  PID:9192
- C:\Windows\System\RJxnWdf.exe
  C:\Windows\System\RJxnWdf.exe
  2⤵
  PID:8216
- C:\Windows\System\DUOKhIX.exe
  C:\Windows\System\DUOKhIX.exe
  2⤵
  PID:8536
- C:\Windows\System\GnLVHSG.exe
  C:\Windows\System\GnLVHSG.exe
  2⤵
  PID:8948
- C:\Windows\System\QmFIeDF.exe
  C:\Windows\System\QmFIeDF.exe
  2⤵
  PID:9072
- C:\Windows\System\DHRcxri.exe
  C:\Windows\System\DHRcxri.exe
  2⤵
  PID:8268
- C:\Windows\System\SfEatDX.exe
  C:\Windows\System\SfEatDX.exe
  2⤵
  PID:8460
- C:\Windows\System\NndtgMW.exe
  C:\Windows\System\NndtgMW.exe
  2⤵
  PID:8516
- C:\Windows\System\cxruALo.exe
  C:\Windows\System\cxruALo.exe
  2⤵
  PID:7792
- C:\Windows\System\PRAanLr.exe
  C:\Windows\System\PRAanLr.exe
  2⤵
  PID:8420
- C:\Windows\System\JYGHfbD.exe
  C:\Windows\System\JYGHfbD.exe
  2⤵
  PID:8384
- C:\Windows\System\qzgZogk.exe
  C:\Windows\System\qzgZogk.exe
  2⤵
  PID:9244
- C:\Windows\System\YwqPqvr.exe
  C:\Windows\System\YwqPqvr.exe
  2⤵
  PID:9268
- C:\Windows\System\yEmVxuh.exe
  C:\Windows\System\yEmVxuh.exe
  2⤵
  PID:9292
- C:\Windows\System\ClyfwJj.exe
  C:\Windows\System\ClyfwJj.exe
  2⤵
  PID:9320
- C:\Windows\System\gwAVAEJ.exe
  C:\Windows\System\gwAVAEJ.exe
  2⤵
  PID:9360
- C:\Windows\System\RmsvDEs.exe
  C:\Windows\System\RmsvDEs.exe
  2⤵
  PID:9388
- C:\Windows\System\EAlFkTE.exe
  C:\Windows\System\EAlFkTE.exe
  2⤵
  PID:9404
- C:\Windows\System\XnlbFvv.exe
  C:\Windows\System\XnlbFvv.exe
  2⤵
  PID:9428
- C:\Windows\System\sRREanf.exe
  C:\Windows\System\sRREanf.exe
  2⤵
  PID:9468
- C:\Windows\System\yMjUQEf.exe
  C:\Windows\System\yMjUQEf.exe
  2⤵
  PID:9500
- C:\Windows\System\TNBfDMU.exe
  C:\Windows\System\TNBfDMU.exe
  2⤵
  PID:9516
- C:\Windows\System\kvnPKMU.exe
  C:\Windows\System\kvnPKMU.exe
  2⤵
  PID:9540
- C:\Windows\System\aueClIs.exe
  C:\Windows\System\aueClIs.exe
  2⤵
  PID:9560
- C:\Windows\System\ovVQalz.exe
  C:\Windows\System\ovVQalz.exe
  2⤵
  PID:9612
- C:\Windows\System\tdIerbK.exe
  C:\Windows\System\tdIerbK.exe
  2⤵
  PID:9640
- C:\Windows\System\YGPQVTo.exe
  C:\Windows\System\YGPQVTo.exe
  2⤵
  PID:9668
- C:\Windows\System\jWYCSIp.exe
  C:\Windows\System\jWYCSIp.exe
  2⤵
  PID:9700
- C:\Windows\System\RYUHueX.exe
  C:\Windows\System\RYUHueX.exe
  2⤵
  PID:9724
- C:\Windows\System\AXqejKC.exe
  C:\Windows\System\AXqejKC.exe
  2⤵
  PID:9740
- C:\Windows\System\ixvgpDv.exe
  C:\Windows\System\ixvgpDv.exe
  2⤵
  PID:9756
- C:\Windows\System\wMZDMDA.exe
  C:\Windows\System\wMZDMDA.exe
  2⤵
  PID:9804
- C:\Windows\System\pNhGmLY.exe
  C:\Windows\System\pNhGmLY.exe
  2⤵
  PID:9828
- C:\Windows\System\tNMysrl.exe
  C:\Windows\System\tNMysrl.exe
  2⤵
  PID:9864
- C:\Windows\System\NSTAAAb.exe
  C:\Windows\System\NSTAAAb.exe
  2⤵
  PID:9892
- C:\Windows\System\FvpgnrZ.exe
  C:\Windows\System\FvpgnrZ.exe
  2⤵
  PID:9908
- C:\Windows\System\FmViUeb.exe
  C:\Windows\System\FmViUeb.exe
  2⤵
  PID:9936
- C:\Windows\System\aglUXgg.exe
  C:\Windows\System\aglUXgg.exe
  2⤵
  PID:9964
- C:\Windows\System\HHQKiRg.exe
  C:\Windows\System\HHQKiRg.exe
  2⤵
  PID:10000
- C:\Windows\System\tAmZZmr.exe
  C:\Windows\System\tAmZZmr.exe
  2⤵
  PID:10028
- C:\Windows\System\vqGOOpN.exe
  C:\Windows\System\vqGOOpN.exe
  2⤵
  PID:10060
- C:\Windows\System\LBLRibj.exe
  C:\Windows\System\LBLRibj.exe
  2⤵
  PID:10076
- C:\Windows\System\LJselvg.exe
  C:\Windows\System\LJselvg.exe
  2⤵
  PID:10112
- C:\Windows\System\HKlwWqo.exe
  C:\Windows\System\HKlwWqo.exe
  2⤵
  PID:10152
- C:\Windows\System\PLJTHMu.exe
  C:\Windows\System\PLJTHMu.exe
  2⤵
  PID:10176
- C:\Windows\System\BGnvNIs.exe
  C:\Windows\System\BGnvNIs.exe
  2⤵
  PID:10220
- C:\Windows\System\JqwPoWA.exe
  C:\Windows\System\JqwPoWA.exe
  2⤵
  PID:9256
- C:\Windows\System\HZhVPVa.exe
  C:\Windows\System\HZhVPVa.exe
  2⤵
  PID:9316
- C:\Windows\System\TUdnaDG.exe
  C:\Windows\System\TUdnaDG.exe
  2⤵
  PID:9352
- C:\Windows\System\JXoEpMh.exe
  C:\Windows\System\JXoEpMh.exe
  2⤵
  PID:9448
- C:\Windows\System\EVtvxxO.exe
  C:\Windows\System\EVtvxxO.exe
  2⤵
  PID:9532
- C:\Windows\System\BlosqwW.exe
  C:\Windows\System\BlosqwW.exe
  2⤵
  PID:9580
- C:\Windows\System\lErfZkr.exe
  C:\Windows\System\lErfZkr.exe
  2⤵
  PID:9660
- C:\Windows\System\RQDoUPL.exe
  C:\Windows\System\RQDoUPL.exe
  2⤵
  PID:9692
- C:\Windows\System\KQupxnA.exe
  C:\Windows\System\KQupxnA.exe
  2⤵
  PID:9812
- C:\Windows\System\MAdOhYb.exe
  C:\Windows\System\MAdOhYb.exe
  2⤵
  PID:9836
- C:\Windows\System\wKdytiv.exe
  C:\Windows\System\wKdytiv.exe
  2⤵
  PID:9904
- C:\Windows\System\IbpUCNy.exe
  C:\Windows\System\IbpUCNy.exe
  2⤵
  PID:9976
- C:\Windows\System\JXJrNLw.exe
  C:\Windows\System\JXJrNLw.exe
  2⤵
  PID:10012
- C:\Windows\System\HbSdBYS.exe
  C:\Windows\System\HbSdBYS.exe
  2⤵
  PID:10048
- C:\Windows\System\opyWZFo.exe
  C:\Windows\System\opyWZFo.exe
  2⤵
  PID:10140
- C:\Windows\System\ogNfyDN.exe
  C:\Windows\System\ogNfyDN.exe
  2⤵
  PID:10200
- C:\Windows\System\IGnbuJa.exe
  C:\Windows\System\IGnbuJa.exe
  2⤵
  PID:9304
- C:\Windows\System\kBXLlWd.exe
  C:\Windows\System\kBXLlWd.exe
  2⤵
  PID:9464
- C:\Windows\System\RZLnUIX.exe
  C:\Windows\System\RZLnUIX.exe
  2⤵
  PID:9572
- C:\Windows\System\PGXUXKQ.exe
  C:\Windows\System\PGXUXKQ.exe
  2⤵
  PID:9776
- C:\Windows\System\OLDalRX.exe
  C:\Windows\System\OLDalRX.exe
  2⤵
  PID:4320
- C:\Windows\System\fzdScRB.exe
  C:\Windows\System\fzdScRB.exe
  2⤵
  PID:10100
- C:\Windows\System\wFOXfVl.exe
  C:\Windows\System\wFOXfVl.exe
  2⤵
  PID:9788
- C:\Windows\System\AIoirIk.exe
  C:\Windows\System\AIoirIk.exe
  2⤵
  PID:10044
- C:\Windows\System\GcfTJJv.exe
  C:\Windows\System\GcfTJJv.exe
  2⤵
  PID:9624
- C:\Windows\System\bwxyaYh.exe
  C:\Windows\System\bwxyaYh.exe
  2⤵
  PID:10244
- C:\Windows\System\HPyRinZ.exe
  C:\Windows\System\HPyRinZ.exe
  2⤵
  PID:10276
- C:\Windows\System\gtMaQTe.exe
  C:\Windows\System\gtMaQTe.exe
  2⤵
  PID:10292
- C:\Windows\System\ZDihyQx.exe
  C:\Windows\System\ZDihyQx.exe
  2⤵
  PID:10332
- C:\Windows\System\fDyEetP.exe
  C:\Windows\System\fDyEetP.exe
  2⤵
  PID:10360
- C:\Windows\System\GFxdGQo.exe
  C:\Windows\System\GFxdGQo.exe
  2⤵
  PID:10388
- C:\Windows\System\aSuSWMP.exe
  C:\Windows\System\aSuSWMP.exe
  2⤵
  PID:10416
- C:\Windows\System\IxDunmh.exe
  C:\Windows\System\IxDunmh.exe
  2⤵
  PID:10444
- C:\Windows\System\VYuyHCo.exe
  C:\Windows\System\VYuyHCo.exe
  2⤵
  PID:10472
- C:\Windows\System\QNNwqhx.exe
  C:\Windows\System\QNNwqhx.exe
  2⤵
  PID:10500
- C:\Windows\System\vcQshAB.exe
  C:\Windows\System\vcQshAB.exe
  2⤵
  PID:10528
- C:\Windows\System\zKrHlBC.exe
  C:\Windows\System\zKrHlBC.exe
  2⤵
  PID:10556
- C:\Windows\System\IjDSFsI.exe
  C:\Windows\System\IjDSFsI.exe
  2⤵
  PID:10588
- C:\Windows\System\rhqIgZi.exe
  C:\Windows\System\rhqIgZi.exe
  2⤵
  PID:10616
- C:\Windows\System\LkXmhnK.exe
  C:\Windows\System\LkXmhnK.exe
  2⤵
  PID:10644
- C:\Windows\System\tLGaNGE.exe
  C:\Windows\System\tLGaNGE.exe
  2⤵
  PID:10672
- C:\Windows\System\WCZhAcE.exe
  C:\Windows\System\WCZhAcE.exe
  2⤵
  PID:10700
- C:\Windows\System\accclMx.exe
  C:\Windows\System\accclMx.exe
  2⤵
  PID:10728
- C:\Windows\System\mLtfPSE.exe
  C:\Windows\System\mLtfPSE.exe
  2⤵
  PID:10756
- C:\Windows\System\BDyzROG.exe
  C:\Windows\System\BDyzROG.exe
  2⤵
  PID:10784
- C:\Windows\System\FQLrkdM.exe
  C:\Windows\System\FQLrkdM.exe
  2⤵
  PID:10812
- C:\Windows\System\qPHBBNy.exe
  C:\Windows\System\qPHBBNy.exe
  2⤵
  PID:10840
- C:\Windows\System\MeQbfVX.exe
  C:\Windows\System\MeQbfVX.exe
  2⤵
  PID:10868
- C:\Windows\System\RotScDh.exe
  C:\Windows\System\RotScDh.exe
  2⤵
  PID:10896
- C:\Windows\System\djTLRCi.exe
  C:\Windows\System\djTLRCi.exe
  2⤵
  PID:10924
- C:\Windows\System\CGAEJeW.exe
  C:\Windows\System\CGAEJeW.exe
  2⤵
  PID:10956
- C:\Windows\System\gTcGGiM.exe
  C:\Windows\System\gTcGGiM.exe
  2⤵
  PID:10984
- C:\Windows\System\PIAbSRs.exe
  C:\Windows\System\PIAbSRs.exe
  2⤵
  PID:11012
- C:\Windows\System\XsEwSAT.exe
  C:\Windows\System\XsEwSAT.exe
  2⤵
  PID:11040
- C:\Windows\System\UfKOCbU.exe
  C:\Windows\System\UfKOCbU.exe
  2⤵
  PID:11100
- C:\Windows\System\OHPSwvZ.exe
  C:\Windows\System\OHPSwvZ.exe
  2⤵
  PID:11124
- C:\Windows\System\arjVSYh.exe
  C:\Windows\System\arjVSYh.exe
  2⤵
  PID:11152
- C:\Windows\System\LdjYggv.exe
  C:\Windows\System\LdjYggv.exe
  2⤵
  PID:11180
- C:\Windows\System\CXymBav.exe
  C:\Windows\System\CXymBav.exe
  2⤵
  PID:11208
- C:\Windows\System\mwbyeru.exe
  C:\Windows\System\mwbyeru.exe
  2⤵
  PID:11236
- C:\Windows\System\lCCYzLO.exe
  C:\Windows\System\lCCYzLO.exe
  2⤵
  PID:9420
- C:\Windows\System\DEXkVjA.exe
  C:\Windows\System\DEXkVjA.exe
  2⤵
  PID:10284
- C:\Windows\System\WaeYdfh.exe
  C:\Windows\System\WaeYdfh.exe
  2⤵
  PID:10348
- C:\Windows\System\lszmvru.exe
  C:\Windows\System\lszmvru.exe
  2⤵
  PID:10412
- C:\Windows\System\EuvOpFg.exe
  C:\Windows\System\EuvOpFg.exe
  2⤵
  PID:10484
- C:\Windows\System\CimporY.exe
  C:\Windows\System\CimporY.exe
  2⤵
  PID:10548
- C:\Windows\System\MpcbwbP.exe
  C:\Windows\System\MpcbwbP.exe
  2⤵
  PID:10612
- C:\Windows\System\dMdzPis.exe
  C:\Windows\System\dMdzPis.exe
  2⤵
  PID:10696
- C:\Windows\System\XlopqDL.exe
  C:\Windows\System\XlopqDL.exe
  2⤵
  PID:10752
- C:\Windows\System\efjhnCa.exe
  C:\Windows\System\efjhnCa.exe
  2⤵
  PID:10824
- C:\Windows\System\wbIsSor.exe
  C:\Windows\System\wbIsSor.exe
  2⤵
  PID:10880
- C:\Windows\System\mlMsNtd.exe
  C:\Windows\System\mlMsNtd.exe
  2⤵
  PID:10948
- C:\Windows\System\ODduYtE.exe
  C:\Windows\System\ODduYtE.exe
  2⤵
  PID:11008
- C:\Windows\System\JcFrqtp.exe
  C:\Windows\System\JcFrqtp.exe
  2⤵
  PID:11076
- C:\Windows\System\qvwMSiv.exe
  C:\Windows\System\qvwMSiv.exe
  2⤵
  PID:11136
- C:\Windows\System\QkePpkQ.exe
  C:\Windows\System\QkePpkQ.exe
  2⤵
  PID:11220
- C:\Windows\System\pRaCjhP.exe
  C:\Windows\System\pRaCjhP.exe
  2⤵
  PID:10272
- C:\Windows\System\sIRjXVl.exe
  C:\Windows\System\sIRjXVl.exe
  2⤵
  PID:10384
- C:\Windows\System\GRvwBSq.exe
  C:\Windows\System\GRvwBSq.exe
  2⤵
  PID:10580
- C:\Windows\System\NAXXzgn.exe
  C:\Windows\System\NAXXzgn.exe
  2⤵
  PID:10740
- C:\Windows\System\pyPoTnC.exe
  C:\Windows\System\pyPoTnC.exe
  2⤵
  PID:10864
- C:\Windows\System\DmwjhEf.exe
  C:\Windows\System\DmwjhEf.exe
  2⤵
  PID:11036
- C:\Windows\System\QDNxfeR.exe
  C:\Windows\System\QDNxfeR.exe
  2⤵
  PID:11200
- C:\Windows\System\fkTcDvV.exe
  C:\Windows\System\fkTcDvV.exe
  2⤵
  PID:10380
- C:\Windows\System\JlBboTN.exe
  C:\Windows\System\JlBboTN.exe
  2⤵
  PID:10804
- C:\Windows\System\VplahPt.exe
  C:\Windows\System\VplahPt.exe
  2⤵
  PID:11148
- C:\Windows\System\eZbbdCW.exe
  C:\Windows\System\eZbbdCW.exe
  2⤵
  PID:10724
- C:\Windows\System\GZRdGCM.exe
  C:\Windows\System\GZRdGCM.exe
  2⤵
  PID:4036
- C:\Windows\System\tEyrtsN.exe
  C:\Windows\System\tEyrtsN.exe
  2⤵
  PID:11284
- C:\Windows\System\hBuruia.exe
  C:\Windows\System\hBuruia.exe
  2⤵
  PID:11312
- C:\Windows\System\mAiTXtQ.exe
  C:\Windows\System\mAiTXtQ.exe
  2⤵
  PID:11340
- C:\Windows\System\DaYAIrq.exe
  C:\Windows\System\DaYAIrq.exe
  2⤵
  PID:11368
- C:\Windows\System\xOQDseT.exe
  C:\Windows\System\xOQDseT.exe
  2⤵
  PID:11396
- C:\Windows\System\mXLBtmj.exe
  C:\Windows\System\mXLBtmj.exe
  2⤵
  PID:11424
- C:\Windows\System\eVHRfBy.exe
  C:\Windows\System\eVHRfBy.exe
  2⤵
  PID:11452
- C:\Windows\System\uoToxgD.exe
  C:\Windows\System\uoToxgD.exe
  2⤵
  PID:11480
- C:\Windows\System\JqnryaX.exe
  C:\Windows\System\JqnryaX.exe
  2⤵
  PID:11512
- C:\Windows\System\iPNffzO.exe
  C:\Windows\System\iPNffzO.exe
  2⤵
  PID:11540
- C:\Windows\System\ebGJgEe.exe
  C:\Windows\System\ebGJgEe.exe
  2⤵
  PID:11568
- C:\Windows\System\AaqDBwD.exe
  C:\Windows\System\AaqDBwD.exe
  2⤵
  PID:11596
- C:\Windows\System\WdbALcF.exe
  C:\Windows\System\WdbALcF.exe
  2⤵
  PID:11624
- C:\Windows\System\hPLGkcv.exe
  C:\Windows\System\hPLGkcv.exe
  2⤵
  PID:11652
- C:\Windows\System\uLHClFj.exe
  C:\Windows\System\uLHClFj.exe
  2⤵
  PID:11680
- C:\Windows\System\bemdJcU.exe
  C:\Windows\System\bemdJcU.exe
  2⤵
  PID:11708
- C:\Windows\System\YdRAArE.exe
  C:\Windows\System\YdRAArE.exe
  2⤵
  PID:11740
- C:\Windows\System\faKkOCs.exe
  C:\Windows\System\faKkOCs.exe
  2⤵
  PID:11768
- C:\Windows\System\QQTFvSm.exe
  C:\Windows\System\QQTFvSm.exe
  2⤵
  PID:11796
- C:\Windows\System\dTqLmlD.exe
  C:\Windows\System\dTqLmlD.exe
  2⤵
  PID:11824
- C:\Windows\System\cLOLHnY.exe
  C:\Windows\System\cLOLHnY.exe
  2⤵
  PID:11852
- C:\Windows\System\EnBGKlT.exe
  C:\Windows\System\EnBGKlT.exe
  2⤵
  PID:11888
- C:\Windows\System\xgxGTsz.exe
  C:\Windows\System\xgxGTsz.exe
  2⤵
  PID:11916
- C:\Windows\System\JFupKuD.exe
  C:\Windows\System\JFupKuD.exe
  2⤵
  PID:11944
- C:\Windows\System\XJLOHwg.exe
  C:\Windows\System\XJLOHwg.exe
  2⤵
  PID:11972
- C:\Windows\System\GySvMvz.exe
  C:\Windows\System\GySvMvz.exe
  2⤵
  PID:12000
- C:\Windows\System\PWIerfc.exe
  C:\Windows\System\PWIerfc.exe
  2⤵
  PID:12028
- C:\Windows\System\oWONBEQ.exe
  C:\Windows\System\oWONBEQ.exe
  2⤵
  PID:12056
- C:\Windows\System\eqPWSUh.exe
  C:\Windows\System\eqPWSUh.exe
  2⤵
  PID:12084
- C:\Windows\System\ureTxIN.exe
  C:\Windows\System\ureTxIN.exe
  2⤵
  PID:12112
- C:\Windows\System\VqKAYsd.exe
  C:\Windows\System\VqKAYsd.exe
  2⤵
  PID:12156
- C:\Windows\System\BhfhrVN.exe
  C:\Windows\System\BhfhrVN.exe
  2⤵
  PID:12200
- C:\Windows\System\jqEGeeD.exe
  C:\Windows\System\jqEGeeD.exe
  2⤵
  PID:12240
- C:\Windows\System\MyBYduy.exe
  C:\Windows\System\MyBYduy.exe
  2⤵
  PID:12272
- C:\Windows\System\ZByzfdQ.exe
  C:\Windows\System\ZByzfdQ.exe
  2⤵
  PID:11332
- C:\Windows\System\MQnpHvG.exe
  C:\Windows\System\MQnpHvG.exe
  2⤵
  PID:11364
- C:\Windows\System\TyCSUUj.exe
  C:\Windows\System\TyCSUUj.exe
  2⤵
  PID:11492
- C:\Windows\System\lgUHwIU.exe
  C:\Windows\System\lgUHwIU.exe
  2⤵
  PID:11588
- C:\Windows\System\eWuXMSS.exe
  C:\Windows\System\eWuXMSS.exe
  2⤵
  PID:11648
- C:\Windows\System\xeJyEjY.exe
  C:\Windows\System\xeJyEjY.exe
  2⤵
  PID:11760
- C:\Windows\System\edkXnDy.exe
  C:\Windows\System\edkXnDy.exe
  2⤵
  PID:11820
- C:\Windows\System\deDDAeq.exe
  C:\Windows\System\deDDAeq.exe
  2⤵
  PID:11884
- C:\Windows\System\EpAVlZa.exe
  C:\Windows\System\EpAVlZa.exe
  2⤵
  PID:11912
- C:\Windows\System\nmFRShh.exe
  C:\Windows\System\nmFRShh.exe
  2⤵
  PID:11984
- C:\Windows\System\nsAcRDT.exe
  C:\Windows\System\nsAcRDT.exe
  2⤵
  PID:12024
- C:\Windows\System\RslYosX.exe
  C:\Windows\System\RslYosX.exe
  2⤵
  PID:12108
- C:\Windows\System\WIpEToQ.exe
  C:\Windows\System\WIpEToQ.exe
  2⤵
  PID:12236
- C:\Windows\System\YJdAIUm.exe
  C:\Windows\System\YJdAIUm.exe
  2⤵
  PID:11464
- C:\Windows\System\ULzxjah.exe
  C:\Windows\System\ULzxjah.exe
  2⤵
  PID:11644
- C:\Windows\System\lLnYgvm.exe
  C:\Windows\System\lLnYgvm.exe
  2⤵
  PID:11816
- C:\Windows\System\IzIXNgx.exe
  C:\Windows\System\IzIXNgx.exe
  2⤵
  PID:11968
- C:\Windows\System\GvWAZns.exe
  C:\Windows\System\GvWAZns.exe
  2⤵
  PID:12076
- C:\Windows\System\BLMagtU.exe
  C:\Windows\System\BLMagtU.exe
  2⤵
  PID:11360
- C:\Windows\System\OOjwVQd.exe
  C:\Windows\System\OOjwVQd.exe
  2⤵
  PID:11792
- C:\Windows\System\LXecKnV.exe
  C:\Windows\System\LXecKnV.exe
  2⤵
  PID:11552
- C:\Windows\System\aGuiHid.exe
  C:\Windows\System\aGuiHid.exe
  2⤵
  PID:12296
- C:\Windows\System\EUfkNKw.exe
  C:\Windows\System\EUfkNKw.exe
  2⤵
  PID:12332
- C:\Windows\System\mzpATTP.exe
  C:\Windows\System\mzpATTP.exe
  2⤵
  PID:12364
- C:\Windows\System\jJobTWO.exe
  C:\Windows\System\jJobTWO.exe
  2⤵
  PID:12392
- C:\Windows\System\FIfiDbI.exe
  C:\Windows\System\FIfiDbI.exe
  2⤵
  PID:12420
- C:\Windows\System\QrEAReH.exe
  C:\Windows\System\QrEAReH.exe
  2⤵
  PID:12448
- C:\Windows\System\uhJoStD.exe
  C:\Windows\System\uhJoStD.exe
  2⤵
  PID:12476
- C:\Windows\System\qebrHDR.exe
  C:\Windows\System\qebrHDR.exe
  2⤵
  PID:12504
- C:\Windows\System\sNzIYSc.exe
  C:\Windows\System\sNzIYSc.exe
  2⤵
  PID:12532
- C:\Windows\System\ZBjqBqX.exe
  C:\Windows\System\ZBjqBqX.exe
  2⤵
  PID:12568
- C:\Windows\System\OtJBwhr.exe
  C:\Windows\System\OtJBwhr.exe
  2⤵
  PID:12608
- C:\Windows\System\ZpPHpNm.exe
  C:\Windows\System\ZpPHpNm.exe
  2⤵
  PID:12636
- C:\Windows\System\XVjNRvH.exe
  C:\Windows\System\XVjNRvH.exe
  2⤵
  PID:12664
- C:\Windows\System\tAiCriz.exe
  C:\Windows\System\tAiCriz.exe
  2⤵
  PID:12708
- C:\Windows\System\TqsRUXA.exe
  C:\Windows\System\TqsRUXA.exe
  2⤵
  PID:12740
- C:\Windows\System\HadTEKF.exe
  C:\Windows\System\HadTEKF.exe
  2⤵
  PID:12768
- C:\Windows\System\CCqqSNC.exe
  C:\Windows\System\CCqqSNC.exe
  2⤵
  PID:12796
- C:\Windows\System\vdrYimr.exe
  C:\Windows\System\vdrYimr.exe
  2⤵
  PID:12828
- C:\Windows\System\HpRtKRA.exe
  C:\Windows\System\HpRtKRA.exe
  2⤵
  PID:12860
- C:\Windows\System\BVlDDYV.exe
  C:\Windows\System\BVlDDYV.exe
  2⤵
  PID:12888
- C:\Windows\System\nRUIRAG.exe
  C:\Windows\System\nRUIRAG.exe
  2⤵
  PID:12916
- C:\Windows\System\aMLxMBq.exe
  C:\Windows\System\aMLxMBq.exe
  2⤵
  PID:12944
- C:\Windows\System\KgzRHQL.exe
  C:\Windows\System\KgzRHQL.exe
  2⤵
  PID:12972
- C:\Windows\System\aHrfqsU.exe
  C:\Windows\System\aHrfqsU.exe
  2⤵
  PID:13000
- C:\Windows\System\yZaaTSg.exe
  C:\Windows\System\yZaaTSg.exe
  2⤵
  PID:13036
- C:\Windows\System\lpLQzUO.exe
  C:\Windows\System\lpLQzUO.exe
  2⤵
  PID:13068
- C:\Windows\System\QNAgxBi.exe
  C:\Windows\System\QNAgxBi.exe
  2⤵
  PID:13096
- C:\Windows\System\PEznzke.exe
  C:\Windows\System\PEznzke.exe
  2⤵
  PID:13124
- C:\Windows\System\zkWyiHf.exe
  C:\Windows\System\zkWyiHf.exe
  2⤵
  PID:13152
- C:\Windows\System\GLSDbCy.exe
  C:\Windows\System\GLSDbCy.exe
  2⤵
  PID:13180
- C:\Windows\System\OUWoIsc.exe
  C:\Windows\System\OUWoIsc.exe
  2⤵
  PID:13208
- C:\Windows\System\HyetKek.exe
  C:\Windows\System\HyetKek.exe
  2⤵
  PID:13236
- C:\Windows\System\WcKXTdm.exe
  C:\Windows\System\WcKXTdm.exe
  2⤵
  PID:13264
- C:\Windows\System\znFlvwp.exe
  C:\Windows\System\znFlvwp.exe
  2⤵
  PID:13292
- C:\Windows\System\nkKItNr.exe
  C:\Windows\System\nkKItNr.exe
  2⤵
  PID:12304
- C:\Windows\System\kdpNTOY.exe
  C:\Windows\System\kdpNTOY.exe
  2⤵
  PID:12360
- C:\Windows\System\XbjnXeR.exe
  C:\Windows\System\XbjnXeR.exe
  2⤵
  PID:12432
- C:\Windows\System\lYeVUxw.exe
  C:\Windows\System\lYeVUxw.exe
  2⤵
  PID:12500
- C:\Windows\System\gUzQUoB.exe
  C:\Windows\System\gUzQUoB.exe
  2⤵
  PID:12564
- C:\Windows\System\RmFxKtE.exe
  C:\Windows\System\RmFxKtE.exe
  2⤵
  PID:12648
- C:\Windows\System\NIjtzrg.exe
  C:\Windows\System\NIjtzrg.exe
  2⤵
  PID:12732
- C:\Windows\System\nyFfyAG.exe
  C:\Windows\System\nyFfyAG.exe
  2⤵
  PID:12792
- C:\Windows\System\yecYcfE.exe
  C:\Windows\System\yecYcfE.exe
  2⤵
  PID:12884
- C:\Windows\System\tWsRONU.exe
  C:\Windows\System\tWsRONU.exe
  2⤵
  PID:3520
- C:\Windows\System\IhRETmo.exe
  C:\Windows\System\IhRETmo.exe
  2⤵
  PID:12912
- C:\Windows\System\pSbGObj.exe
  C:\Windows\System\pSbGObj.exe
  2⤵
  PID:12984
- C:\Windows\System\RFQIPUu.exe
  C:\Windows\System\RFQIPUu.exe
  2⤵
  PID:13060
- C:\Windows\System\ZoYNvgA.exe
  C:\Windows\System\ZoYNvgA.exe
  2⤵
  PID:13120
- C:\Windows\System\VbcKWpd.exe
  C:\Windows\System\VbcKWpd.exe
  2⤵
  PID:13192
- C:\Windows\System\VUlakRU.exe
  C:\Windows\System\VUlakRU.exe
  2⤵
  PID:13256
- C:\Windows\System\cfiFVjz.exe
  C:\Windows\System\cfiFVjz.exe
  2⤵
  PID:12292
- C:\Windows\System\JUaXPUu.exe
  C:\Windows\System\JUaXPUu.exe
  2⤵
  PID:12488
- C:\Windows\System\sOIpITu.exe
  C:\Windows\System\sOIpITu.exe
  2⤵
  PID:12632
- C:\Windows\System\fyZgPZO.exe
  C:\Windows\System\fyZgPZO.exe
  2⤵
  PID:12824
- C:\Windows\System\iieHpip.exe
  C:\Windows\System\iieHpip.exe
  2⤵
  PID:12940
- C:\Windows\System\CzlTsrW.exe
  C:\Windows\System\CzlTsrW.exe
  2⤵
  PID:13116
- C:\Windows\System\atcAude.exe
  C:\Windows\System\atcAude.exe
  2⤵
  PID:13248
- C:\Windows\System\UOJjLTf.exe
  C:\Windows\System\UOJjLTf.exe
  2⤵
  PID:12544
- C:\Windows\System\GGRTpXS.exe
  C:\Windows\System\GGRTpXS.exe
  2⤵
  PID:12908
- C:\Windows\System\DTBfuTT.exe
  C:\Windows\System\DTBfuTT.exe
  2⤵
  PID:13228
- C:\Windows\System\rfpkZBx.exe
  C:\Windows\System\rfpkZBx.exe
  2⤵
  PID:13088
- C:\Windows\System\dtYajSJ.exe
  C:\Windows\System\dtYajSJ.exe
  2⤵
  PID:12804
- C:\Windows\System\LZvTfsG.exe
  C:\Windows\System\LZvTfsG.exe
  2⤵
  PID:13340
- C:\Windows\System\Nulmjjp.exe
  C:\Windows\System\Nulmjjp.exe
  2⤵
  PID:13368
- C:\Windows\System\LVSjZVJ.exe
  C:\Windows\System\LVSjZVJ.exe
  2⤵
  PID:13396
- C:\Windows\System\NbByebn.exe
  C:\Windows\System\NbByebn.exe
  2⤵
  PID:13424
- C:\Windows\System\hjQBHpL.exe
  C:\Windows\System\hjQBHpL.exe
  2⤵
  PID:13452
- C:\Windows\System\abLGmDq.exe
  C:\Windows\System\abLGmDq.exe
  2⤵
  PID:13480
- C:\Windows\System\FdybQbo.exe
  C:\Windows\System\FdybQbo.exe
  2⤵
  PID:13508
- C:\Windows\System\LoVOQXU.exe
  C:\Windows\System\LoVOQXU.exe
  2⤵
  PID:13536
- C:\Windows\System\szcIXzt.exe
  C:\Windows\System\szcIXzt.exe
  2⤵
  PID:13564
- C:\Windows\System\UixxVLY.exe
  C:\Windows\System\UixxVLY.exe
  2⤵
  PID:13600
- C:\Windows\System\pFvwYEP.exe
  C:\Windows\System\pFvwYEP.exe
  2⤵
  PID:13632
- C:\Windows\System\UMHkpDL.exe
  C:\Windows\System\UMHkpDL.exe
  2⤵
  PID:13660
- C:\Windows\System\MFNowLP.exe
  C:\Windows\System\MFNowLP.exe
  2⤵
  PID:13688
- C:\Windows\System\syFjqiY.exe
  C:\Windows\System\syFjqiY.exe
  2⤵
  PID:13716
- C:\Windows\System\uhJxmSl.exe
  C:\Windows\System\uhJxmSl.exe
  2⤵
  PID:13744
- C:\Windows\System\WFOWVsG.exe
  C:\Windows\System\WFOWVsG.exe
  2⤵
  PID:13772
- C:\Windows\System\qWDYfcO.exe
  C:\Windows\System\qWDYfcO.exe
  2⤵
  PID:13800
- C:\Windows\System\DFNMoqC.exe
  C:\Windows\System\DFNMoqC.exe
  2⤵
  PID:13828
- C:\Windows\System\ePtkCkx.exe
  C:\Windows\System\ePtkCkx.exe
  2⤵
  PID:13856
- C:\Windows\System\sqNrJiA.exe
  C:\Windows\System\sqNrJiA.exe
  2⤵
  PID:13884
- C:\Windows\System\wnWTihg.exe
  C:\Windows\System\wnWTihg.exe
  2⤵
  PID:13912
- C:\Windows\System\cSJhpSE.exe
  C:\Windows\System\cSJhpSE.exe
  2⤵
  PID:13940
- C:\Windows\System\NSMEOUy.exe
  C:\Windows\System\NSMEOUy.exe
  2⤵
  PID:13968
- C:\Windows\System\eOxvSof.exe
  C:\Windows\System\eOxvSof.exe
  2⤵
  PID:13984
- C:\Windows\System\AzFKqHf.exe
  C:\Windows\System\AzFKqHf.exe
  2⤵
  PID:14024
- C:\Windows\System\RNLXDsT.exe
  C:\Windows\System\RNLXDsT.exe
  2⤵
  PID:14052
- C:\Windows\System\ujgHwOk.exe
  C:\Windows\System\ujgHwOk.exe
  2⤵
  PID:14080
- C:\Windows\System\MWwYKZR.exe
  C:\Windows\System\MWwYKZR.exe
  2⤵
  PID:14108
- C:\Windows\System\hMPhThY.exe
  C:\Windows\System\hMPhThY.exe
  2⤵
  PID:14136
- C:\Windows\System\NOfgBBS.exe
  C:\Windows\System\NOfgBBS.exe
  2⤵
  PID:14220
- C:\Windows\System\nhyYfzP.exe
  C:\Windows\System\nhyYfzP.exe
  2⤵
  PID:14236
- C:\Windows\System\rvkOrjm.exe
  C:\Windows\System\rvkOrjm.exe
  2⤵
  PID:14272
- C:\Windows\System\DvbWweN.exe
  C:\Windows\System\DvbWweN.exe
  2⤵
  PID:14300
- C:\Windows\System\VQdHMfb.exe
  C:\Windows\System\VQdHMfb.exe
  2⤵
  PID:14328
- C:\Windows\System\WpdlQkh.exe
  C:\Windows\System\WpdlQkh.exe
  2⤵
  PID:13388
- C:\Windows\System\QPuSydf.exe
  C:\Windows\System\QPuSydf.exe
  2⤵
  PID:3276
- C:\Windows\System\HfplQkR.exe
  C:\Windows\System\HfplQkR.exe
  2⤵
  PID:14208
- C:\Windows\System\MKexnKv.exe
  C:\Windows\System\MKexnKv.exe
  2⤵
  PID:12404
- C:\Windows\System\jYwzlrh.exe
  C:\Windows\System\jYwzlrh.exe
  2⤵
  PID:14248
- C:\Windows\System\jpHsLNI.exe
  C:\Windows\System\jpHsLNI.exe
  2⤵
  PID:11504
- C:\Windows\System\yOhHymy.exe
  C:\Windows\System\yOhHymy.exe
  2⤵
  PID:14296
- C:\Windows\System\dXnUgTj.exe
  C:\Windows\System\dXnUgTj.exe
  2⤵
  PID:4800
- C:\Windows\System\spgckij.exe
  C:\Windows\System\spgckij.exe
  2⤵
  PID:13476
- C:\Windows\System\pKIApbd.exe
  C:\Windows\System\pKIApbd.exe
  2⤵
  PID:13560
- C:\Windows\System\kIzcrlo.exe
  C:\Windows\System\kIzcrlo.exe
  2⤵
  PID:13680
- C:\Windows\System\dKlCKkh.exe
  C:\Windows\System\dKlCKkh.exe
  2⤵
  PID:1676
- C:\Windows\System\miLjxlp.exe
  C:\Windows\System\miLjxlp.exe
  2⤵
  PID:6324
- C:\Windows\System\eEbZQWl.exe
  C:\Windows\System\eEbZQWl.exe
  2⤵
  PID:7104
- C:\Windows\System\QEvtsKU.exe
  C:\Windows\System\QEvtsKU.exe
  2⤵
  PID:2428
- C:\Windows\System\SWgaOLx.exe
  C:\Windows\System\SWgaOLx.exe
  2⤵
  PID:4088
- C:\Windows\System\mSgjkpO.exe
  C:\Windows\System\mSgjkpO.exe
  2⤵
  PID:808
- C:\Windows\System\ydjkUFm.exe
  C:\Windows\System\ydjkUFm.exe
  2⤵
  PID:2180
- C:\Windows\System\KfJpqoJ.exe
  C:\Windows\System\KfJpqoJ.exe
  2⤵
  PID:3500
- C:\Windows\System\sbuQQcQ.exe
  C:\Windows\System\sbuQQcQ.exe
  2⤵
  PID:1504
- C:\Windows\System\AcMVYDw.exe
  C:\Windows\System\AcMVYDw.exe
  2⤵
  PID:1704
- C:\Windows\System\zTEkzTT.exe
  C:\Windows\System\zTEkzTT.exe
  2⤵
  PID:440
- C:\Windows\System\UGKnFqD.exe
  C:\Windows\System\UGKnFqD.exe
  2⤵
  PID:14076
- C:\Windows\System\WruHdBh.exe
  C:\Windows\System\WruHdBh.exe
  2⤵
  PID:4984
- C:\Windows\System\sXXXJYW.exe
  C:\Windows\System\sXXXJYW.exe
  2⤵
  PID:2084
- C:\Windows\System\KfRFSGR.exe
  C:\Windows\System\KfRFSGR.exe
  2⤵
  PID:4908
- C:\Windows\System\wvdbSDF.exe
  C:\Windows\System\wvdbSDF.exe
  2⤵
  PID:4780
- C:\Windows\System\JLynbcq.exe
  C:\Windows\System\JLynbcq.exe
  2⤵
  PID:14048
- C:\Windows\System\DgeSwgB.exe
  C:\Windows\System\DgeSwgB.exe
  2⤵
  PID:13868
- C:\Windows\System\qUtMdHc.exe
  C:\Windows\System\qUtMdHc.exe
  2⤵
  PID:4400
- C:\Windows\System\xmzsmAv.exe
  C:\Windows\System\xmzsmAv.exe
  2⤵
  PID:6244
- C:\Windows\System\WgAQhZZ.exe
  C:\Windows\System\WgAQhZZ.exe
  2⤵
  PID:8004
- C:\Windows\System\CTJHEaJ.exe
  C:\Windows\System\CTJHEaJ.exe
  2⤵
  PID:9328
- C:\Windows\System\xxXPIJX.exe
  C:\Windows\System\xxXPIJX.exe
  2⤵
  PID:9356
- C:\Windows\System\bQRiGNF.exe
  C:\Windows\System\bQRiGNF.exe
  2⤵
  PID:840
- C:\Windows\System\bfjsMQd.exe
  C:\Windows\System\bfjsMQd.exe
  2⤵
  PID:8096
- C:\Windows\System\JIBAZZS.exe
  C:\Windows\System\JIBAZZS.exe
  2⤵
  PID:5036
- C:\Windows\System\NitxAIQ.exe
  C:\Windows\System\NitxAIQ.exe
  2⤵
  PID:14176
- C:\Windows\System\qMiJbwO.exe
  C:\Windows\System\qMiJbwO.exe
  2⤵
  PID:8180
- C:\Windows\System\CqECuQo.exe
  C:\Windows\System\CqECuQo.exe
  2⤵
  PID:9592
- C:\Windows\System\TsRbSst.exe
  C:\Windows\System\TsRbSst.exe
  2⤵
  PID:6588
- C:\Windows\System\Rekaajr.exe
  C:\Windows\System\Rekaajr.exe
  2⤵
  PID:6700
- C:\Windows\System\StLpoWj.exe
  C:\Windows\System\StLpoWj.exe
  2⤵
  PID:9792
- C:\Windows\System\TWzdTyz.exe
  C:\Windows\System\TWzdTyz.exe
  2⤵
  PID:9784
- C:\Windows\System\wNRrczw.exe
  C:\Windows\System\wNRrczw.exe
  2⤵
  PID:9872
- C:\Windows\System\NnGLxld.exe
  C:\Windows\System\NnGLxld.exe
  2⤵
  PID:7836
- C:\Windows\System\deDZjlT.exe
  C:\Windows\System\deDZjlT.exe
  2⤵
  PID:2336
- C:\Windows\System\JyrtGIC.exe
  C:\Windows\System\JyrtGIC.exe
  2⤵
  PID:9972
- C:\Windows\System\wkfSrtR.exe
  C:\Windows\System\wkfSrtR.exe
  2⤵
  PID:8036
- C:\Windows\System\pViqUVU.exe
  C:\Windows\System\pViqUVU.exe
  2⤵
  PID:10016
- C:\Windows\System\VFLNkZT.exe
  C:\Windows\System\VFLNkZT.exe
  2⤵
  PID:7016
- C:\Windows\System\mDSYkXf.exe
  C:\Windows\System\mDSYkXf.exe
  2⤵
  PID:10084
- C:\Windows\System\TxATjzc.exe
  C:\Windows\System\TxATjzc.exe
  2⤵
  PID:10160
- C:\Windows\System\jUVCKYt.exe
  C:\Windows\System\jUVCKYt.exe
  2⤵
  PID:7688
- C:\Windows\System\uJfzMws.exe
  C:\Windows\System\uJfzMws.exe
  2⤵
  PID:1856
- C:\Windows\System\pheAMLX.exe
  C:\Windows\System\pheAMLX.exe
  2⤵
  PID:8028
- C:\Windows\System\tQyIfTJ.exe
  C:\Windows\System\tQyIfTJ.exe
  2⤵
  PID:9400
- C:\Windows\System\HzwtLTL.exe
  C:\Windows\System\HzwtLTL.exe
  2⤵
  PID:7824
- C:\Windows\System\qHEInbI.exe
  C:\Windows\System\qHEInbI.exe
  2⤵
  PID:9440
- C:\Windows\System\GsCJXat.exe
  C:\Windows\System\GsCJXat.exe
  2⤵
  PID:3592
- C:\Windows\System\QeJxapi.exe
  C:\Windows\System\QeJxapi.exe
  2⤵
  PID:5280
- C:\Windows\System\MStqebh.exe
  C:\Windows\System\MStqebh.exe
  2⤵
  PID:9608
- C:\Windows\System\XuGiTZd.exe
  C:\Windows\System\XuGiTZd.exe
  2⤵
  PID:3304
- C:\Windows\System\meRqqfd.exe
  C:\Windows\System\meRqqfd.exe
  2⤵
  PID:9716
- C:\Windows\System\YwuKTNs.exe
  C:\Windows\System\YwuKTNs.exe
  2⤵
  PID:8404
- C:\Windows\System\Lvjkgiw.exe
  C:\Windows\System\Lvjkgiw.exe
  2⤵
  PID:6840
- C:\Windows\System\uCqMqCg.exe
  C:\Windows\System\uCqMqCg.exe
  2⤵
  PID:8476
- C:\Windows\System\SjIpqii.exe
  C:\Windows\System\SjIpqii.exe
  2⤵
  PID:14284
- C:\Windows\System\dCSndUk.exe
  C:\Windows\System\dCSndUk.exe
  2⤵
  PID:5508
- C:\Windows\System\nFuwhPp.exe
  C:\Windows\System\nFuwhPp.exe
  2⤵
  PID:8532
- C:\Windows\System\wgIeAbB.exe
  C:\Windows\System\wgIeAbB.exe
  2⤵
  PID:5640
- C:\Windows\System\EslGxlN.exe
  C:\Windows\System\EslGxlN.exe
  2⤵
  PID:3376
- C:\Windows\System\BpXEOXJ.exe
  C:\Windows\System\BpXEOXJ.exe
  2⤵
  PID:8632
- C:\Windows\System\zlvSXIH.exe
  C:\Windows\System\zlvSXIH.exe
  2⤵
  PID:1672
- C:\Windows\System\dbEUEHL.exe
  C:\Windows\System\dbEUEHL.exe
  2⤵
  PID:10104
- C:\Windows\System\jMrhugk.exe
  C:\Windows\System\jMrhugk.exe
  2⤵
  PID:10204
- C:\Windows\System\sWfKIkM.exe
  C:\Windows\System\sWfKIkM.exe
  2⤵
  PID:6172
- C:\Windows\System\kmPEany.exe
  C:\Windows\System\kmPEany.exe
  2⤵
  PID:5900
- C:\Windows\System\qIUWjHX.exe
  C:\Windows\System\qIUWjHX.exe
  2⤵
  PID:10052
- C:\Windows\System\JKrKqWK.exe
  C:\Windows\System\JKrKqWK.exe
  2⤵
  PID:13472
- C:\Windows\System\iJgdjwm.exe
  C:\Windows\System\iJgdjwm.exe
  2⤵
  PID:5920
- C:\Windows\System\RenJgyh.exe
  C:\Windows\System\RenJgyh.exe
  2⤵
  PID:10264
- C:\Windows\System\cZwPDmN.exe
  C:\Windows\System\cZwPDmN.exe
  2⤵
  PID:8848
- C:\Windows\System\EZlyVyP.exe
  C:\Windows\System\EZlyVyP.exe
  2⤵
  PID:8952
- C:\Windows\System\xrvMXiQ.exe
  C:\Windows\System\xrvMXiQ.exe
  2⤵
  PID:6000
- C:\Windows\System\HsOwHFK.exe
  C:\Windows\System\HsOwHFK.exe
  2⤵
  PID:10424
- C:\Windows\System\cbmrRfQ.exe
  C:\Windows\System\cbmrRfQ.exe
  2⤵
  PID:10488
- C:\Windows\System\ttdogdS.exe
  C:\Windows\System\ttdogdS.exe
  2⤵
  PID:10604
- C:\Windows\System\StJIQZW.exe
  C:\Windows\System\StJIQZW.exe
  2⤵
  PID:6024
- C:\Windows\System\mIanyVH.exe
  C:\Windows\System\mIanyVH.exe
  2⤵
  PID:6112
- C:\Windows\System\ZmhvmrO.exe
  C:\Windows\System\ZmhvmrO.exe
  2⤵
  PID:10736
- C:\Windows\System\KSNXDGj.exe
  C:\Windows\System\KSNXDGj.exe
  2⤵
  PID:9048
- C:\Windows\System\SlmohLI.exe
  C:\Windows\System\SlmohLI.exe
  2⤵
  PID:10800
- C:\Windows\System\nEvYRRw.exe
  C:\Windows\System\nEvYRRw.exe
  2⤵
  PID:13628
- C:\Windows\System\RMBRuxD.exe
  C:\Windows\System\RMBRuxD.exe
  2⤵
  PID:10884
- C:\Windows\System\AwNtzky.exe
  C:\Windows\System\AwNtzky.exe
  2⤵
  PID:5380
- C:\Windows\System\UfZKEyv.exe
  C:\Windows\System\UfZKEyv.exe
  2⤵
  PID:5384
- C:\Windows\System\lMoWYVH.exe
  C:\Windows\System\lMoWYVH.exe
  2⤵
  PID:10964
- C:\Windows\System\QQFYhmz.exe
  C:\Windows\System\QQFYhmz.exe
  2⤵
  PID:2292
- C:\Windows\System\WRrVsfx.exe
  C:\Windows\System\WRrVsfx.exe
  2⤵
  PID:13612
- C:\Windows\System\MpFxVCr.exe
  C:\Windows\System\MpFxVCr.exe
  2⤵
  PID:11048
- C:\Windows\System\uEgpXtY.exe
  C:\Windows\System\uEgpXtY.exe
  2⤵
  PID:2364
- C:\Windows\System\uQMCQIv.exe
  C:\Windows\System\uQMCQIv.exe
  2⤵
  PID:3724
- C:\Windows\System\dsztLfL.exe
  C:\Windows\System\dsztLfL.exe
  2⤵
  PID:1084
- C:\Windows\System\nEoOttk.exe
  C:\Windows\System\nEoOttk.exe
  2⤵
  PID:8408
- C:\Windows\System\KSeGNAI.exe
  C:\Windows\System\KSeGNAI.exe
  2⤵
  PID:5700
- C:\Windows\System\QTvDwsT.exe
  C:\Windows\System\QTvDwsT.exe
  2⤵
  PID:11144
- C:\Windows\System\utaIAUR.exe
  C:\Windows\System\utaIAUR.exe
  2⤵
  PID:1644
- C:\Windows\System\zQQIHnK.exe
  C:\Windows\System\zQQIHnK.exe
  2⤵
  PID:8644
- C:\Windows\System\lxnrpzX.exe
  C:\Windows\System\lxnrpzX.exe
  2⤵
  PID:11252
- C:\Windows\System\huEPpoC.exe
  C:\Windows\System\huEPpoC.exe
  2⤵
  PID:8124
- C:\Windows\System\CXRZAQM.exe
  C:\Windows\System\CXRZAQM.exe
  2⤵
  PID:2160
- C:\Windows\System\NbrWZWd.exe
  C:\Windows\System\NbrWZWd.exe
  2⤵
  PID:7396
- C:\Windows\System\Radgkhz.exe
  C:\Windows\System\Radgkhz.exe
  2⤵
  PID:1460
- C:\Windows\System\vfbDenV.exe
  C:\Windows\System\vfbDenV.exe
  2⤵
  PID:10456
- C:\Windows\System\XMYexpy.exe
  C:\Windows\System\XMYexpy.exe
  2⤵
  PID:7416
- C:\Windows\System\FxCxKfM.exe
  C:\Windows\System\FxCxKfM.exe
  2⤵
  PID:7460
- C:\Windows\System\whgvZmp.exe
  C:\Windows\System\whgvZmp.exe
  2⤵
  PID:13952
- C:\Windows\System\JgWjnvu.exe
  C:\Windows\System\JgWjnvu.exe
  2⤵
  PID:10796
- C:\Windows\System\jVrLCRl.exe
  C:\Windows\System\jVrLCRl.exe
  2⤵
  PID:10916
- C:\Windows\System\hDjLTsL.exe
  C:\Windows\System\hDjLTsL.exe
  2⤵
  PID:8612
- C:\Windows\System\jMirNhE.exe
  C:\Windows\System\jMirNhE.exe
  2⤵
  PID:5496
- C:\Windows\System\nCJJfoP.exe
  C:\Windows\System\nCJJfoP.exe
  2⤵
  PID:7516
- C:\Windows\System\RmFkkHd.exe
  C:\Windows\System\RmFkkHd.exe
  2⤵
  PID:11164
- C:\Windows\System\LpQAUxH.exe
  C:\Windows\System\LpQAUxH.exe
  2⤵
  PID:10320
- C:\Windows\System\cyfwPix.exe
  C:\Windows\System\cyfwPix.exe
  2⤵
  PID:2740
- C:\Windows\System\uicDdHi.exe
  C:\Windows\System\uicDdHi.exe
  2⤵
  PID:5472
- C:\Windows\System\ElKlOIv.exe
  C:\Windows\System\ElKlOIv.exe
  2⤵
  PID:5468
- C:\Windows\System\QNhIQpA.exe
  C:\Windows\System\QNhIQpA.exe
  2⤵
  PID:11120
- C:\Windows\System\efLRnUL.exe
  C:\Windows\System\efLRnUL.exe
  2⤵
  PID:4448
- C:\Windows\System\TkriqXD.exe
  C:\Windows\System\TkriqXD.exe
  2⤵
  PID:14012
- C:\Windows\System\ijTqjWN.exe
  C:\Windows\System\ijTqjWN.exe
  2⤵
  PID:13896
- C:\Windows\System\LTNGBQt.exe
  C:\Windows\System\LTNGBQt.exe
  2⤵
  PID:1624
- C:\Windows\System\gLWepJT.exe
  C:\Windows\System\gLWepJT.exe
  2⤵
  PID:14020
- C:\Windows\System\ClvAbiw.exe
  C:\Windows\System\ClvAbiw.exe
  2⤵
  PID:13996
- C:\Windows\System\xUuZyFz.exe
  C:\Windows\System\xUuZyFz.exe
  2⤵
  PID:11292
- C:\Windows\System\NytLhJE.exe
  C:\Windows\System\NytLhJE.exe
  2⤵
  PID:11320
- C:\Windows\System\RoAvwuv.exe
  C:\Windows\System\RoAvwuv.exe
  2⤵
  PID:4912
- C:\Windows\System\YFgAqZm.exe
  C:\Windows\System\YFgAqZm.exe
  2⤵
  PID:8880
- C:\Windows\System\OOoggnF.exe
  C:\Windows\System\OOoggnF.exe
  2⤵
  PID:11432
- C:\Windows\System\UqwyIUH.exe
  C:\Windows\System\UqwyIUH.exe
  2⤵
  PID:1512
- C:\Windows\System\PqFqqMz.exe
  C:\Windows\System\PqFqqMz.exe
  2⤵
  PID:8716
- C:\Windows\System\gtqZcYc.exe
  C:\Windows\System\gtqZcYc.exe
  2⤵
  PID:11520
- C:\Windows\System\bWIbivp.exe
  C:\Windows\System\bWIbivp.exe
  2⤵
  PID:7968
- C:\Windows\System\tGIHdKs.exe
  C:\Windows\System\tGIHdKs.exe
  2⤵
  PID:11632
- C:\Windows\System\ZSBTJKK.exe
  C:\Windows\System\ZSBTJKK.exe
  2⤵
  PID:8024
- C:\Windows\System\RNvbFbf.exe
  C:\Windows\System\RNvbFbf.exe
  2⤵
  PID:11720
- C:\Windows\System\JdGwjBR.exe
  C:\Windows\System\JdGwjBR.exe
  2⤵
  PID:6476
- C:\Windows\System\hHZqpXI.exe
  C:\Windows\System\hHZqpXI.exe
  2⤵
  PID:11832
- C:\Windows\System\SlYBwYn.exe
  C:\Windows\System\SlYBwYn.exe
  2⤵
  PID:11876
- C:\Windows\System\XYweBhy.exe
  C:\Windows\System\XYweBhy.exe
  2⤵
  PID:11904
- C:\Windows\System\TwIpHar.exe
  C:\Windows\System\TwIpHar.exe
  2⤵
  PID:6600
- C:\Windows\System\CPRjBSk.exe
  C:\Windows\System\CPRjBSk.exe
  2⤵
  PID:6652
- C:\Windows\System\IHtTDdm.exe
  C:\Windows\System\IHtTDdm.exe
  2⤵
  PID:9648
- C:\Windows\System\sNtQXEO.exe
  C:\Windows\System\sNtQXEO.exe
  2⤵
  PID:13528
- C:\Windows\System\AFVAslQ.exe
  C:\Windows\System\AFVAslQ.exe
  2⤵
  PID:4888
- C:\Windows\System\YtfVUqs.exe
  C:\Windows\System\YtfVUqs.exe
  2⤵
  PID:12168
- C:\Windows\System\iujBain.exe
  C:\Windows\System\iujBain.exe
  2⤵
  PID:7544
- C:\Windows\System\bBbbvtG.exe
  C:\Windows\System\bBbbvtG.exe
  2⤵
  PID:212
- C:\Windows\System\jfCRlvY.exe
  C:\Windows\System\jfCRlvY.exe
  2⤵
  PID:11112
- C:\Windows\System\ClBNgdm.exe
  C:\Windows\System\ClBNgdm.exe
  2⤵
  PID:11508
- C:\Windows\System\kjeCBuq.exe
  C:\Windows\System\kjeCBuq.exe
  2⤵
  PID:6872
- C:\Windows\System\MrLsqKd.exe
  C:\Windows\System\MrLsqKd.exe
  2⤵
  PID:7772
- C:\Windows\System\eQASOHI.exe
  C:\Windows\System\eQASOHI.exe
  2⤵
  PID:6860
- C:\Windows\System\sWzxXrB.exe
  C:\Windows\System\sWzxXrB.exe
  2⤵
  PID:9932
- C:\Windows\System\sHPMNHO.exe
  C:\Windows\System\sHPMNHO.exe
  2⤵
  PID:12284
- C:\Windows\System\ZUCMIct.exe
  C:\Windows\System\ZUCMIct.exe
  2⤵
  PID:7812
- C:\Windows\System\ZexzJeh.exe
  C:\Windows\System\ZexzJeh.exe
  2⤵
  PID:11676
- C:\Windows\System\PEgnmXP.exe
  C:\Windows\System\PEgnmXP.exe
  2⤵
  PID:4980
- C:\Windows\System\WSosJcu.exe
  C:\Windows\System\WSosJcu.exe
  2⤵
  PID:3668
- C:\Windows\System\FNabQnD.exe
  C:\Windows\System\FNabQnD.exe
  2⤵
  PID:12232
- C:\Windows\System\coYVaFp.exe
  C:\Windows\System\coYVaFp.exe
  2⤵
  PID:10208
- C:\Windows\System\OjjoLvM.exe
  C:\Windows\System\OjjoLvM.exe
  2⤵
  PID:12348
- C:\Windows\System\vHDgVHq.exe
  C:\Windows\System\vHDgVHq.exe
  2⤵
  PID:7088
- C:\Windows\System\lByHtLx.exe
  C:\Windows\System\lByHtLx.exe
  2⤵
  PID:12436
- C:\Windows\System\cHCrWSh.exe
  C:\Windows\System\cHCrWSh.exe
  2⤵
  PID:12492
- C:\Windows\System\XNsEGqi.exe
  C:\Windows\System\XNsEGqi.exe
  2⤵
  PID:7128
- C:\Windows\System\CRCNnZQ.exe
  C:\Windows\System\CRCNnZQ.exe
  2⤵
  PID:5208
- C:\Windows\System\LUQFxLe.exe
  C:\Windows\System\LUQFxLe.exe
  2⤵
  PID:12652
- C:\Windows\System\dcoLAQg.exe
  C:\Windows\System\dcoLAQg.exe
  2⤵
  PID:12684
- C:\Windows\System\LJTcCSh.exe
  C:\Windows\System\LJTcCSh.exe
  2⤵
  PID:12776
- C:\Windows\System\IbGStKX.exe
  C:\Windows\System\IbGStKX.exe
  2⤵
  PID:12904
- C:\Windows\System\tMGGxuT.exe
  C:\Windows\System\tMGGxuT.exe
  2⤵
  PID:13008
- C:\Windows\System\AajbdcV.exe
  C:\Windows\System\AajbdcV.exe
  2⤵
  PID:13112
- C:\Windows\System\iUmRdhh.exe
  C:\Windows\System\iUmRdhh.exe
  2⤵
  PID:5784
- C:\Windows\System\zsRhOfw.exe
  C:\Windows\System\zsRhOfw.exe
  2⤵
  PID:13160
- C:\Windows\System\DZibTbI.exe
  C:\Windows\System\DZibTbI.exe
  2⤵
  PID:5860
- C:\Windows\System\RTaKYAd.exe
  C:\Windows\System\RTaKYAd.exe
  2⤵
  PID:5440
- C:\Windows\System\dbWfrHy.exe
  C:\Windows\System\dbWfrHy.exe
  2⤵
  PID:10576
- C:\Windows\System\rmJTZCb.exe
  C:\Windows\System\rmJTZCb.exe
  2⤵
  PID:5524
- C:\Windows\System\zfEvBYz.exe
  C:\Windows\System\zfEvBYz.exe
  2⤵
  PID:12416
- C:\Windows\System\sRyWWAr.exe
  C:\Windows\System\sRyWWAr.exe
  2⤵
  PID:10168
- C:\Windows\System\gHaIwBI.exe
  C:\Windows\System\gHaIwBI.exe
  2⤵
  PID:8604
- C:\Windows\System\FVFZGNR.exe
  C:\Windows\System\FVFZGNR.exe
  2⤵
  PID:12756
- C:\Windows\System\eWrRsSn.exe
  C:\Windows\System\eWrRsSn.exe
  2⤵
  PID:2348
- C:\Windows\System\fhLVCqc.exe
  C:\Windows\System\fhLVCqc.exe
  2⤵
  PID:2320
- C:\Windows\System\IsbfqSn.exe
  C:\Windows\System\IsbfqSn.exe
  2⤵
  PID:764
- C:\Windows\System\vOpGdVO.exe
  C:\Windows\System\vOpGdVO.exe
  2⤵
  PID:5820
- C:\Windows\System\xsgucKG.exe
  C:\Windows\System\xsgucKG.exe
  2⤵
  PID:13144
- C:\Windows\System\JJOZofo.exe
  C:\Windows\System\JJOZofo.exe
  2⤵
  PID:6608
- C:\Windows\System\VlpoPDb.exe
  C:\Windows\System\VlpoPDb.exe
  2⤵
  PID:12356
- C:\Windows\System\ABHTAYc.exe
  C:\Windows\System\ABHTAYc.exe
  2⤵
  PID:6992
- C:\Windows\System\SLrZoyu.exe
  C:\Windows\System\SLrZoyu.exe
  2⤵
  PID:13024
- C:\Windows\System\Pyimler.exe
  C:\Windows\System\Pyimler.exe
  2⤵
  PID:8940
- C:\Windows\System\GCEwoHw.exe
  C:\Windows\System\GCEwoHw.exe
  2⤵
  PID:10376
- C:\Windows\System\cfjFinV.exe
  C:\Windows\System\cfjFinV.exe
  2⤵
  PID:10480
- C:\Windows\System\ThNjTuh.exe
  C:\Windows\System\ThNjTuh.exe
  2⤵
  PID:13220
- C:\Windows\System\XPtljSO.exe
  C:\Windows\System\XPtljSO.exe
  2⤵
  PID:13356
- C:\Windows\System\iQHvRpS.exe
  C:\Windows\System\iQHvRpS.exe
  2⤵
  PID:6932
- C:\Windows\System\ukdMFeU.exe
  C:\Windows\System\ukdMFeU.exe
  2⤵
  PID:5164
- C:\Windows\System\FhtsQjS.exe
  C:\Windows\System\FhtsQjS.exe
  2⤵
  PID:4792
- C:\Windows\System\rUxccsf.exe
  C:\Windows\System\rUxccsf.exe
  2⤵
  PID:13648
- C:\Windows\System\njGKnTW.exe
  C:\Windows\System\njGKnTW.exe
  2⤵
  PID:6620
- C:\Windows\System\rzeQPBe.exe
  C:\Windows\System\rzeQPBe.exe
  2⤵
  PID:13624
- C:\Windows\System\vjHBkYj.exe
  C:\Windows\System\vjHBkYj.exe
  2⤵
  PID:13676
- C:\Windows\System\YXyIucK.exe
  C:\Windows\System\YXyIucK.exe
  2⤵
  PID:4956
- C:\Windows\System\gjTJMjO.exe
  C:\Windows\System\gjTJMjO.exe
  2⤵
  PID:13760
- C:\Windows\System\GsOiTZI.exe
  C:\Windows\System\GsOiTZI.exe
  2⤵
  PID:13796
- C:\Windows\System\JcCOOUn.exe
  C:\Windows\System\JcCOOUn.exe
  2⤵
  PID:13808
- C:\Windows\System\uDnUzUy.exe
  C:\Windows\System\uDnUzUy.exe
  2⤵
  PID:13900
- C:\Windows\System\FaHLnQd.exe
  C:\Windows\System\FaHLnQd.exe
  2⤵
  PID:13928
- C:\Windows\System\gsLmsNw.exe
  C:\Windows\System\gsLmsNw.exe
  2⤵
  PID:7240
- C:\Windows\System\ikIpfMJ.exe
  C:\Windows\System\ikIpfMJ.exe
  2⤵
  PID:8600
- C:\Windows\System\EnJLTbd.exe
  C:\Windows\System\EnJLTbd.exe
  2⤵
  PID:7280
- C:\Windows\System\dBDnTLQ.exe
  C:\Windows\System\dBDnTLQ.exe
  2⤵
  PID:14088
- C:\Windows\System\sYzOpYw.exe
  C:\Windows\System\sYzOpYw.exe
  2⤵
  PID:11700
- C:\Windows\System\CDWRMEh.exe
  C:\Windows\System\CDWRMEh.exe
  2⤵
  PID:7332
- C:\Windows\System\PhHBemD.exe
  C:\Windows\System\PhHBemD.exe
  2⤵
  PID:6676
- C:\Windows\System\WLZGaGs.exe
  C:\Windows\System\WLZGaGs.exe
  2⤵
  PID:7432
- C:\Windows\System\ppykYEO.exe
  C:\Windows\System\ppykYEO.exe
  2⤵
  PID:6808
- C:\Windows\System\IexVLsn.exe
  C:\Windows\System\IexVLsn.exe
  2⤵
  PID:6292
- C:\Windows\System\BxTtMzQ.exe
  C:\Windows\System\BxTtMzQ.exe
  2⤵
  PID:6848
- C:\Windows\System\bKOIVZd.exe
  C:\Windows\System\bKOIVZd.exe
  2⤵
  PID:10980
- C:\Windows\System\LFguYsY.exe
  C:\Windows\System\LFguYsY.exe
  2⤵
  PID:11032
- C:\Windows\System\ofuRhZc.exe
  C:\Windows\System\ofuRhZc.exe
  2⤵
  PID:6960
- C:\Windows\System\qRPwZqQ.exe
  C:\Windows\System\qRPwZqQ.exe
  2⤵
  PID:7588
- C:\Windows\System\MJJcjlU.exe
  C:\Windows\System\MJJcjlU.exe
  2⤵
  PID:10976
- C:\Windows\System\Elmiedr.exe
  C:\Windows\System\Elmiedr.exe
  2⤵
  PID:6432
- C:\Windows\System\apifXLE.exe
  C:\Windows\System\apifXLE.exe
  2⤵
  PID:10540
- C:\Windows\System\lgKRBWn.exe
  C:\Windows\System\lgKRBWn.exe
  2⤵
  PID:6464
- C:\Windows\System\ukfOaPt.exe
  C:\Windows\System\ukfOaPt.exe
  2⤵
  PID:6768
- C:\Windows\System\XCNqcum.exe
  C:\Windows\System\XCNqcum.exe
  2⤵
  PID:11300
- C:\Windows\System\yCIAsyU.exe
  C:\Windows\System\yCIAsyU.exe
  2⤵
  PID:864
- C:\Windows\System\nWtPazG.exe
  C:\Windows\System\nWtPazG.exe
  2⤵
  PID:6196
- C:\Windows\System\aFEYTfw.exe
  C:\Windows\System\aFEYTfw.exe
  2⤵
  PID:14196
- C:\Windows\System\mZElWRL.exe
  C:\Windows\System\mZElWRL.exe
  2⤵
  PID:11488
- C:\Windows\System\dawHNpY.exe
  C:\Windows\System\dawHNpY.exe
  2⤵
  PID:11604
- C:\Windows\System\wLjExWe.exe
  C:\Windows\System\wLjExWe.exe
  2⤵
  PID:11748
- C:\Windows\System\PzLTmqS.exe
  C:\Windows\System\PzLTmqS.exe
  2⤵
  PID:2060
- C:\Windows\System\EWeWtho.exe
  C:\Windows\System\EWeWtho.exe
  2⤵
  PID:11924
- C:\Windows\System\egyecgL.exe
  C:\Windows\System\egyecgL.exe
  2⤵
  PID:1884
- C:\Windows\System\ayosCpY.exe
  C:\Windows\System\ayosCpY.exe
  2⤵
  PID:2608
- C:\Windows\System\NVpErMa.exe
  C:\Windows\System\NVpErMa.exe
  2⤵
  PID:1404
- C:\Windows\System\dHmDjci.exe
  C:\Windows\System\dHmDjci.exe
  2⤵
  PID:3940
- C:\Windows\System\kXlCRKY.exe
  C:\Windows\System\kXlCRKY.exe
  2⤵
  PID:7616
- C:\Windows\System\XFdMbiw.exe
  C:\Windows\System\XFdMbiw.exe
  2⤵
  PID:6876
- C:\Windows\System\xsVYGGs.exe
  C:\Windows\System\xsVYGGs.exe
  2⤵
  PID:12048
- C:\Windows\System\hAwYTmD.exe
  C:\Windows\System\hAwYTmD.exe
  2⤵
  PID:14204
- C:\Windows\System\UoHgGXm.exe
  C:\Windows\System\UoHgGXm.exe
  2⤵
  PID:1092
- C:\Windows\System\EhdYHNv.exe
  C:\Windows\System\EhdYHNv.exe
  2⤵
  PID:4060
- C:\Windows\System\sVFAnnU.exe
  C:\Windows\System\sVFAnnU.exe
  2⤵
  PID:6968
- C:\Windows\System\tYHOKGn.exe
  C:\Windows\System\tYHOKGn.exe
  2⤵
  PID:12372
- C:\Windows\System\hFCKkaA.exe
  C:\Windows\System\hFCKkaA.exe
  2⤵
  PID:3268
- C:\Windows\System\cuxSzrJ.exe
  C:\Windows\System\cuxSzrJ.exe
  2⤵
  PID:9552
- C:\Windows\System\xXeoDdN.exe
  C:\Windows\System\xXeoDdN.exe
  2⤵
  PID:12748
- C:\Windows\System\HYoKWKU.exe
  C:\Windows\System\HYoKWKU.exe
  2⤵
  PID:12988
- C:\Windows\System\nBSfnos.exe
  C:\Windows\System\nBSfnos.exe
  2⤵
  PID:3504
- C:\Windows\System\HBGjQpU.exe
  C:\Windows\System\HBGjQpU.exe
  2⤵
  PID:5408
- C:\Windows\System\DXhjhUz.exe
  C:\Windows\System\DXhjhUz.exe
  2⤵
  PID:4760
- C:\Windows\System\wHQiIkp.exe
  C:\Windows\System\wHQiIkp.exe
  2⤵
  PID:7012
- C:\Windows\System\WSCgpTS.exe
  C:\Windows\System\WSCgpTS.exe
  2⤵
  PID:8196
- C:\Windows\System\FTecEnJ.exe
  C:\Windows\System\FTecEnJ.exe
  2⤵
  PID:11716
- C:\Windows\System\DZjCMkU.exe
  C:\Windows\System\DZjCMkU.exe
  2⤵
  PID:12844
- C:\Windows\System\cMKgQnB.exe
  C:\Windows\System\cMKgQnB.exe
  2⤵
  PID:8432
- C:\Windows\System\MRvOPQz.exe
  C:\Windows\System\MRvOPQz.exe
  2⤵
  PID:2632
- C:\Windows\System\FtFonqZ.exe
  C:\Windows\System\FtFonqZ.exe
  2⤵
  PID:8520
- C:\Windows\System\ITPjmdW.exe
  C:\Windows\System\ITPjmdW.exe
  2⤵
  PID:5952
- C:\Windows\System\aMXQSBi.exe
  C:\Windows\System\aMXQSBi.exe
  2⤵
  PID:10324
- C:\Windows\System\YFDqaTQ.exe
  C:\Windows\System\YFDqaTQ.exe
  2⤵
  PID:12704
- C:\Windows\System\DWjLCJS.exe
  C:\Windows\System\DWjLCJS.exe
  2⤵
  PID:10660
- C:\Windows\System\lJDSuFj.exe
  C:\Windows\System\lJDSuFj.exe
  2⤵
  PID:10764
- C:\Windows\System\mWvtGKW.exe
  C:\Windows\System\mWvtGKW.exe
  2⤵
  PID:13544
- C:\Windows\System\JbaKpWK.exe
  C:\Windows\System\JbaKpWK.exe
  2⤵
  PID:13696
- C:\Windows\System\NzKbtPy.exe
  C:\Windows\System\NzKbtPy.exe
  2⤵
  PID:9172
- C:\Windows\System\NmfOnjo.exe
  C:\Windows\System\NmfOnjo.exe
  2⤵
  PID:3952
- C:\Windows\System\JiWRmze.exe
  C:\Windows\System\JiWRmze.exe
  2⤵
  PID:8316
- C:\Windows\System\JRumWEo.exe
  C:\Windows\System\JRumWEo.exe
  2⤵
  PID:7220
- C:\Windows\System\IGZxPWH.exe
  C:\Windows\System\IGZxPWH.exe
  2⤵
  PID:8752
- C:\Windows\System\IPOsFuJ.exe
  C:\Windows\System\IPOsFuJ.exe
  2⤵
  PID:11216
- C:\Windows\System\ZDcVHFC.exe
  C:\Windows\System\ZDcVHFC.exe
  2⤵
  PID:2012
- C:\Windows\System\MTHrqge.exe
  C:\Windows\System\MTHrqge.exe
  2⤵
  PID:9064
- C:\Windows\System\BJscZyB.exe
  C:\Windows\System\BJscZyB.exe
  2⤵
  PID:6784
- C:\Windows\System\OMLApMh.exe
  C:\Windows\System\OMLApMh.exe
  2⤵
  PID:9040
- C:\Windows\System\UIhZTDY.exe
  C:\Windows\System\UIhZTDY.exe
  2⤵
  PID:8984
- C:\Windows\System\cOGtckF.exe
  C:\Windows\System\cOGtckF.exe
  2⤵
  PID:5956
- C:\Windows\System\agBRjLY.exe
  C:\Windows\System\agBRjLY.exe
  2⤵
  PID:6344
- C:\Windows\System\ofqgPzL.exe
  C:\Windows\System\ofqgPzL.exe
  2⤵
  PID:6592
- C:\Windows\System\MFRuBIW.exe
  C:\Windows\System\MFRuBIW.exe
  2⤵
  PID:6648
- C:\Windows\System\OBdjewy.exe
  C:\Windows\System\OBdjewy.exe
  2⤵
  PID:6936
- C:\Windows\System\BoPjcLv.exe
  C:\Windows\System\BoPjcLv.exe
  2⤵
  PID:7980
- C:\Windows\System\YErlQpV.exe
  C:\Windows\System\YErlQpV.exe
  2⤵
  PID:8060
- C:\Windows\System\vcNNLwu.exe
  C:\Windows\System\vcNNLwu.exe
  2⤵
  PID:6596
- C:\Windows\System\ksQKMTr.exe
  C:\Windows\System\ksQKMTr.exe
  2⤵
  PID:4724
- C:\Windows\System\NVTNodG.exe
  C:\Windows\System\NVTNodG.exe
  2⤵
  PID:12280
- C:\Windows\System\tqATgnN.exe
  C:\Windows\System\tqATgnN.exe
  2⤵
  PID:4324
- C:\Windows\System\smJFEGy.exe
  C:\Windows\System\smJFEGy.exe
  2⤵
  PID:9548
- C:\Windows\System\Qcrtffv.exe
  C:\Windows\System\Qcrtffv.exe
  2⤵
  PID:7776
- C:\Windows\System\aOYDber.exe
  C:\Windows\System\aOYDber.exe
  2⤵
  PID:9236
- C:\Windows\System\BRZBRmQ.exe
  C:\Windows\System\BRZBRmQ.exe
  2⤵
  PID:5252
- C:\Windows\System\nedNbVc.exe
  C:\Windows\System\nedNbVc.exe
  2⤵
  PID:12840
- C:\Windows\System\SboYAwl.exe
  C:\Windows\System\SboYAwl.exe
  2⤵
  PID:1816
- C:\Windows\System\bUSalKF.exe
  C:\Windows\System\bUSalKF.exe
  2⤵
  PID:7020
- C:\Windows\System\uMdkZkH.exe
  C:\Windows\System\uMdkZkH.exe
  2⤵
  PID:8212
- C:\Windows\System\eidyDbI.exe
  C:\Windows\System\eidyDbI.exe
  2⤵
  PID:14324
- C:\Windows\System\zrmSRnD.exe
  C:\Windows\System\zrmSRnD.exe
  2⤵
  PID:9952
- C:\Windows\System\rOUYnOW.exe
  C:\Windows\System\rOUYnOW.exe
  2⤵
  PID:10316
- C:\Windows\System\EsblbKI.exe
  C:\Windows\System\EsblbKI.exe
  2⤵
  PID:13044
- C:\Windows\System\RDjQpRv.exe
  C:\Windows\System\RDjQpRv.exe
  2⤵
  PID:13440
- C:\Windows\System\SOsdrnE.exe
  C:\Windows\System\SOsdrnE.exe
  2⤵
  PID:13616
- C:\Windows\System\hcsDZxD.exe
  C:\Windows\System\hcsDZxD.exe
  2⤵
  PID:7868
- C:\Windows\System\CcNPPfn.exe
  C:\Windows\System\CcNPPfn.exe
  2⤵
  PID:11188
- C:\Windows\System\WiJnXkt.exe
  C:\Windows\System\WiJnXkt.exe
  2⤵
  PID:8108
- C:\Windows\System\diDBVmm.exe
  C:\Windows\System\diDBVmm.exe
  2⤵
  PID:8428
- C:\Windows\System\SsxTbmi.exe
  C:\Windows\System\SsxTbmi.exe
  2⤵
  PID:9920
- C:\Windows\System\OWXvQJR.exe
  C:\Windows\System\OWXvQJR.exe
  2⤵
  PID:7624
- C:\Windows\System\KTucfGq.exe
  C:\Windows\System\KTucfGq.exe
  2⤵
  PID:3404
- C:\Windows\System\xYOWTCi.exe
  C:\Windows\System\xYOWTCi.exe
  2⤵
  PID:9368
- C:\Windows\System\BDRxOWB.exe
  C:\Windows\System\BDRxOWB.exe
  2⤵
  PID:9340
- C:\Windows\System\bKYsmMv.exe
  C:\Windows\System\bKYsmMv.exe
  2⤵
  PID:556
- C:\Windows\System\iCKHXpb.exe
  C:\Windows\System\iCKHXpb.exe
  2⤵
  PID:7892
- C:\Windows\System\WDxiCBD.exe
  C:\Windows\System\WDxiCBD.exe
  2⤵
  PID:12952
- C:\Windows\System\BBPXBck.exe
  C:\Windows\System\BBPXBck.exe
  2⤵
  PID:8260
- C:\Windows\System\LHQnKnP.exe
  C:\Windows\System\LHQnKnP.exe
  2⤵
  PID:9680
- C:\Windows\System\nEpbBDn.exe
  C:\Windows\System\nEpbBDn.exe
  2⤵
  PID:9232
- C:\Windows\System\ySAYmZG.exe
  C:\Windows\System\ySAYmZG.exe
  2⤵
  PID:13652
- C:\Windows\System\WQCsZXa.exe
  C:\Windows\System\WQCsZXa.exe
  2⤵
  PID:9004
- C:\Windows\System\ovYJWON.exe
  C:\Windows\System\ovYJWON.exe
  2⤵
  PID:7872
- C:\Windows\System\CzGTxsa.exe
  C:\Windows\System\CzGTxsa.exe
  2⤵
  PID:6868
- C:\Windows\System\RJwNvAF.exe
  C:\Windows\System\RJwNvAF.exe
  2⤵
  PID:14160
- C:\Windows\System\FsvTlOu.exe
  C:\Windows\System\FsvTlOu.exe
  2⤵
  PID:1152
- C:\Windows\System\UbjpSFr.exe
  C:\Windows\System\UbjpSFr.exe
  2⤵
  PID:12720
- C:\Windows\System\hmNhyOo.exe
  C:\Windows\System\hmNhyOo.exe
  2⤵
  PID:13580
- C:\Windows\System\VxWiSKM.exe
  C:\Windows\System\VxWiSKM.exe
  2⤵
  PID:10712
- C:\Windows\System\BBJQbsE.exe
  C:\Windows\System\BBJQbsE.exe
  2⤵
  PID:11388
- C:\Windows\System\IpIvzmg.exe
  C:\Windows\System\IpIvzmg.exe
  2⤵
  PID:5924
- C:\Windows\System\FXbPgCv.exe
  C:\Windows\System\FXbPgCv.exe
  2⤵
  PID:6604
- C:\Windows\System\wrFqJvr.exe
  C:\Windows\System\wrFqJvr.exe
  2⤵
  PID:9736
- C:\Windows\System\VlTBBiz.exe
  C:\Windows\System\VlTBBiz.exe
  2⤵
  PID:14352
- C:\Windows\System\nLnaMFt.exe
  C:\Windows\System\nLnaMFt.exe
  2⤵
  PID:14376
- C:\Windows\System\URBVVGq.exe
  C:\Windows\System\URBVVGq.exe
  2⤵
  PID:14404
- C:\Windows\System\eViafYi.exe
  C:\Windows\System\eViafYi.exe
  2⤵
  PID:14432
- C:\Windows\System\jCcFyzn.exe
  C:\Windows\System\jCcFyzn.exe
  2⤵
  PID:14464
- C:\Windows\System\kjjIxdC.exe
  C:\Windows\System\kjjIxdC.exe
  2⤵
  PID:14488
- C:\Windows\System\qIwCETA.exe
  C:\Windows\System\qIwCETA.exe
  2⤵
  PID:14512
- C:\Windows\System\HztLCWF.exe
  C:\Windows\System\HztLCWF.exe
  2⤵
  PID:14540
- C:\Windows\System\EKeliXE.exe
  C:\Windows\System\EKeliXE.exe
  2⤵
  PID:14580
- C:\Windows\System\muljNLY.exe
  C:\Windows\System\muljNLY.exe
  2⤵
  PID:14600
- C:\Windows\System\CLnnzwI.exe
  C:\Windows\System\CLnnzwI.exe
  2⤵
  PID:14628
- C:\Windows\System\IgZpkwa.exe
  C:\Windows\System\IgZpkwa.exe
  2⤵
  PID:14664
- C:\Windows\System\nzmmuYP.exe
  C:\Windows\System\nzmmuYP.exe
  2⤵
  PID:14696
- C:\Windows\System\eyYvjap.exe
  C:\Windows\System\eyYvjap.exe
  2⤵
  PID:14720
- C:\Windows\System\aPQCtQr.exe
  C:\Windows\System\aPQCtQr.exe
  2⤵
  PID:14744
- C:\Windows\System\SPTDway.exe
  C:\Windows\System\SPTDway.exe
  2⤵
  PID:14768
- C:\Windows\System\hySNRNV.exe
  C:\Windows\System\hySNRNV.exe
  2⤵
  PID:14808
- C:\Windows\System\DKtwGvt.exe
  C:\Windows\System\DKtwGvt.exe
  2⤵
  PID:14828
- C:\Windows\System\ZmIFGzy.exe
  C:\Windows\System\ZmIFGzy.exe
  2⤵
  PID:14864
- C:\Windows\System\WlXPEjx.exe
  C:\Windows\System\WlXPEjx.exe
  2⤵
  PID:14892
- C:\Windows\System\wmbuotL.exe
  C:\Windows\System\wmbuotL.exe
  2⤵
  PID:14912
- C:\Windows\System\hBrEFwg.exe
  C:\Windows\System\hBrEFwg.exe
  2⤵
  PID:14948
- C:\Windows\System\DHrgLLj.exe
  C:\Windows\System\DHrgLLj.exe
  2⤵
  PID:14968
- C:\Windows\System\hOnjvJA.exe
  C:\Windows\System\hOnjvJA.exe
  2⤵
  PID:15000
- C:\Windows\System\FTRFeFV.exe
  C:\Windows\System\FTRFeFV.exe
  2⤵
  PID:15032
- C:\Windows\System\OqJQnDa.exe
  C:\Windows\System\OqJQnDa.exe
  2⤵
  PID:15056
- C:\Windows\System\rEWzFcq.exe
  C:\Windows\System\rEWzFcq.exe
  2⤵
  PID:15084
- C:\Windows\System\YGZodTR.exe
  C:\Windows\System\YGZodTR.exe
  2⤵
  PID:15116
- C:\Windows\System\UJChqUy.exe
  C:\Windows\System\UJChqUy.exe
  2⤵
  PID:15140
- C:\Windows\System\YPlvTNQ.exe
  C:\Windows\System\YPlvTNQ.exe
  2⤵
  PID:15164
- C:\Windows\System\AEdaYWf.exe
  C:\Windows\System\AEdaYWf.exe
  2⤵
  PID:15200
- C:\Windows\System\oGtvTZU.exe
  C:\Windows\System\oGtvTZU.exe
  2⤵
  PID:15224
- C:\Windows\System\hVqgbAt.exe
  C:\Windows\System\hVqgbAt.exe
  2⤵
  PID:15244
- C:\Windows\System\yiMogTs.exe
  C:\Windows\System\yiMogTs.exe
  2⤵
  PID:15284
- C:\Windows\System\HwQrVre.exe
  C:\Windows\System\HwQrVre.exe
  2⤵
  PID:15312
- C:\Windows\System\selrHlk.exe
  C:\Windows\System\selrHlk.exe
  2⤵
  PID:15336
- C:\Windows\System\lorDXzf.exe
  C:\Windows\System\lorDXzf.exe
  2⤵
  PID:14340
- C:\Windows\System\AJjhnEG.exe
  C:\Windows\System\AJjhnEG.exe
  2⤵
  PID:8896
- C:\Windows\System\sqXolKT.exe
  C:\Windows\System\sqXolKT.exe
  2⤵
  PID:14452
- C:\Windows\System\cQivkvj.exe
  C:\Windows\System\cQivkvj.exe
  2⤵
  PID:14528
- C:\Windows\System\xYWIKSE.exe
  C:\Windows\System\xYWIKSE.exe
  2⤵
  PID:14588
- C:\Windows\System\mXguLqZ.exe
  C:\Windows\System\mXguLqZ.exe
  2⤵
  PID:14672
- C:\Windows\System\FqAXuJi.exe
  C:\Windows\System\FqAXuJi.exe
  2⤵
  PID:14732
- C:\Windows\System\aWztECb.exe
  C:\Windows\System\aWztECb.exe
  2⤵
  PID:14800
- C:\Windows\System\ZMEYuaK.exe
  C:\Windows\System\ZMEYuaK.exe
  2⤵
  PID:14856
- C:\Windows\System\VIdWIWF.exe
  C:\Windows\System\VIdWIWF.exe
  2⤵
  PID:14944
- C:\Windows\System\PZmoazC.exe
  C:\Windows\System\PZmoazC.exe
  2⤵
  PID:15012
- C:\Windows\System\bBTHLwY.exe
  C:\Windows\System\bBTHLwY.exe
  2⤵
  PID:11864
- C:\Windows\System\rbmniEE.exe
  C:\Windows\System\rbmniEE.exe
  2⤵
  PID:15112
- C:\Windows\System\NMAkoIh.exe
  C:\Windows\System\NMAkoIh.exe
  2⤵
  PID:15148
- C:\Windows\System\IwOKgsq.exe
  C:\Windows\System\IwOKgsq.exe
  2⤵
  PID:15180
- C:\Windows\System\PUkjNTu.exe
  C:\Windows\System\PUkjNTu.exe
  2⤵
  PID:15236
- C:\Windows\System\KNJOMwk.exe
  C:\Windows\System\KNJOMwk.exe
  2⤵
  PID:15280
- C:\Windows\System\PEMTOJa.exe
  C:\Windows\System\PEMTOJa.exe
  2⤵
  PID:15348
- C:\Windows\System\oXGxpcC.exe
  C:\Windows\System\oXGxpcC.exe
  2⤵
  PID:14648
- C:\Windows\System\kdaaAep.exe
  C:\Windows\System\kdaaAep.exe
  2⤵
  PID:14568
- C:\Windows\System\oNLVplX.exe
  C:\Windows\System\oNLVplX.exe
  2⤵
  PID:14708
- C:\Windows\System\GsXozEy.exe
  C:\Windows\System\GsXozEy.exe
  2⤵
  PID:14836
- C:\Windows\System\qAZHWqv.exe
  C:\Windows\System\qAZHWqv.exe
  2⤵
  PID:14984
- C:\Windows\System\TrqeZVM.exe
  C:\Windows\System\TrqeZVM.exe
  2⤵
  PID:4520
- C:\Windows\System\lMlSwlX.exe
  C:\Windows\System\lMlSwlX.exe
  2⤵
  PID:15232
- C:\Windows\System\ffyeOIg.exe
  C:\Windows\System\ffyeOIg.exe
  2⤵
  PID:14364
- C:\Windows\System\SyADoyY.exe
  C:\Windows\System\SyADoyY.exe
  2⤵
  PID:14684
- C:\Windows\System\mKtkxJu.exe
  C:\Windows\System\mKtkxJu.exe
  2⤵
  PID:15064
- C:\Windows\System\hBxyYKP.exe
  C:\Windows\System\hBxyYKP.exe
  2⤵
  PID:15320
- C:\Windows\System\QjqwBIA.exe
  C:\Windows\System\QjqwBIA.exe
  2⤵
  PID:14788
- C:\Windows\System\iYgmpgr.exe
  C:\Windows\System\iYgmpgr.exe
  2⤵
  PID:11560
- C:\Windows\System\myLOTUQ.exe
  C:\Windows\System\myLOTUQ.exe
  2⤵
  PID:15372
- C:\Windows\System\ZimFTmU.exe
  C:\Windows\System\ZimFTmU.exe
  2⤵
  PID:15400
- C:\Windows\System\wdioknH.exe
  C:\Windows\System\wdioknH.exe
  2⤵
  PID:15432
- C:\Windows\System\YzNzkAt.exe
  C:\Windows\System\YzNzkAt.exe
  2⤵
  PID:15460
- C:\Windows\System\KbqLlGZ.exe
  C:\Windows\System\KbqLlGZ.exe
  2⤵
  PID:15476
- C:\Windows\System\LeeaObt.exe
  C:\Windows\System\LeeaObt.exe
  2⤵
  PID:15508
- C:\Windows\System\gzmgqRo.exe
  C:\Windows\System\gzmgqRo.exe
  2⤵
  PID:15532
- C:\Windows\System\qysvHrk.exe
  C:\Windows\System\qysvHrk.exe
  2⤵
  PID:15568
- C:\Windows\System\ltxHSQz.exe
  C:\Windows\System\ltxHSQz.exe
  2⤵
  PID:15588
- C:\Windows\System\KXLcrAK.exe
  C:\Windows\System\KXLcrAK.exe
  2⤵
  PID:15620
- C:\Windows\System\MKPFSpr.exe
  C:\Windows\System\MKPFSpr.exe
  2⤵
  PID:15652
- C:\Windows\System\dspgoRY.exe
  C:\Windows\System\dspgoRY.exe
  2⤵
  PID:15684
- C:\Windows\System\dKZsHyo.exe
  C:\Windows\System\dKZsHyo.exe
  2⤵
  PID:15712
- C:\Windows\System\tFZOAmX.exe
  C:\Windows\System\tFZOAmX.exe
  2⤵
  PID:15732
- C:\Windows\System\hNWAlPt.exe
  C:\Windows\System\hNWAlPt.exe
  2⤵
  PID:15768
- C:\Windows\System\CxWmcPs.exe
  C:\Windows\System\CxWmcPs.exe
  2⤵
  PID:15792
- C:\Windows\System\Jcsknne.exe
  C:\Windows\System\Jcsknne.exe
  2⤵
  PID:15824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvfoejhj.olh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CalzMIt.exe

Filesize
3.1MB

MD5
aac278bdcafc36f71c7a6e52f6c08d6e

SHA1
44e767efa67986d7822c18f9089b82e639011d6f

SHA256
5c5502dca32ea1fcfdd82899e919baa9d5bd4d179b815d98b693090484840cf3

SHA512
8ce48626158259a8013da5b52e277a474a54f6f68239ae3bc93541b83f3a2339c9f18bf8d77ac1eb94804341bffb0daee3fa94acfa7960e746f30cb8b9d2dc98

Download Submit
C:\Windows\System\DlDGDtL.exe

Filesize
3.1MB

MD5
b270d44d2f52d374bb87a335dec9777e

SHA1
0411577f41739a30849d22266ed4c956a2b9cee0

SHA256
c78af03cbbd18fa0f9d830b72d69eb123be65531476b547a2d6c6f0be6f598b5

SHA512
59415b847648ccb22fd5c29c65b3a450ba9aedeabf944416ca3fb14e8c6a60c2b7fb4de70831deee7a3f38b8d27f9b3a1976d25ed39d9d38028a64d44a97e87d

Download Submit
C:\Windows\System\FcBfDbB.exe

Filesize
3.1MB

MD5
f971af2b38e49f4a041005a48243bb19

SHA1
78e67edd96c487a920d7f091b1bc6907dad528f7

SHA256
e4ca4b7c7f9bd0ffd993cc4be5da872f735c452bc96068458212fba3c5d39300

SHA512
6e900d44f95250f6934394219c16eefede571ccbcd647df0f1b4dd1358fe5f813c36f2e46cb1c96fcd83aae3dfb15b83d0e7c9a81a9aec24db3bc4d14372c825

Download Submit
C:\Windows\System\IrbwUNs.exe

Filesize
3.1MB

MD5
10fdbacb15c53445cfaac56101a4aa31

SHA1
14c0762f2ff3dcdc10166df2a295b350e985261b

SHA256
06277b870dc0673ec0928bb4fb0cfc135c3039ddf3c7336d171fd0ca09ea9b8f

SHA512
9b4dcf8d4c12f94090972988d4fe5ca599e75945ba8bf27d4fe356add2da661ba8abad49da5475c803f2767475ec3bd89c7c24b759b32237b839de7dc84bf8e5

Download Submit
C:\Windows\System\NnIRmOs.exe

Filesize
8B

MD5
82418d06dad393c8146fecaa4b8d10d0

SHA1
cb08eb24daa3403d78c04db57235bb49f45faa08

SHA256
a57eb53cff5c38b8ddae307a2853f61c42772c68bd8aadda85fbc842ad15b6a2

SHA512
261809c20f80f880e2042c29acddf83eba9da278ff74e8462519f302c2ce8ed26d4d55b91a63fc6416c131e33d72faf8de995998fb2d97930b98f4a182fbfeff

Download Submit
C:\Windows\System\OkcuiKJ.exe

Filesize
3.1MB

MD5
41626411bbb54ebe82d6e4a2861152d4

SHA1
9241f63d769d723d81f844bb3567db0f940dd631

SHA256
ea3566430821dab199e646c6392f0e1cd6498adecca83f7e9333094c9f3023e7

SHA512
e43802ae56d19b6f64c3d8f7c6792661a099969cd72c74a296c27fa17c584a8f3fff3678faf91f7d9b63c1bd1f8adda0c26f520c971f8b9f6580ce2b1fd0a097

Download Submit
C:\Windows\System\QPVLAWM.exe

Filesize
3.1MB

MD5
2d80db8e354ef26797ff5e0341ce46d3

SHA1
0a03c65ecabcda151e597b6a166fddb65bc58f78

SHA256
b546fc37ddffb9a05adccb3d8c22e0213228e33167b5fe32d7572731609203bf

SHA512
a70777028c6e72f320e6bce453678ab244aa9a92df3d0339fc46b6abfbbe0e740134b197ee2bc0587d63b3bd93c1bc538642ceb09b0dae7375f91646392a5f80

Download Submit
C:\Windows\System\QRvzXCF.exe

Filesize
3.1MB

MD5
73cfd93623a8bce35c5c4c17ee6b6f2d

SHA1
052e5a451c441381f41a7ada06f96f3ab02ec95a

SHA256
ab2bfd8133f95a591a80d87098eb8229be3253343c983edb71ac10a956e0c8ca

SHA512
f534c1dca8c8b87fddae5306bd0308f4dce1206f276a964968120ade9eb34f570e2036902ed698a02c733cdf73d9292d6cb97672c10c48a096dd3676790b125c

Download Submit
C:\Windows\System\TcdUwNA.exe

Filesize
3.1MB

MD5
6b5f34fce8992c60a2458db2f60660a6

SHA1
a3016e337fcd267d81b7c5180c46e904fbbf747b

SHA256
07ea6c89df090870bacf24c81490eafd59e51cb12dfe70ddb10a918991601ecc

SHA512
b1cc051dba95b429347e34a905c10c4dae72b5cdd0a3abcd9b78a1586e0dc34ec243694a881fb38abbeffabaf65abce003a6920ad6705aa3b9b058ca9708f0a5

Download Submit
C:\Windows\System\UppjVhK.exe

Filesize
3.1MB

MD5
9481e97c9124961b5129dd16c332baba

SHA1
cb0eee09d3a73f869c2b0e6c1ef999358a21e282

SHA256
f649f9887f03baed0de45a797869655f57cde92544bf147c9dcd8b4232bb527d

SHA512
e8a895159f3d3b98b2df72300c0ec6fed527c82e32563d52267d8b49d6d6d32077bf9b07a2e3a67b35709dad493810d3e504713bf36722efedbaadcbd17e9977

Download Submit
C:\Windows\System\VFMcngw.exe

Filesize
3.1MB

MD5
75123378b782d13f0bd1a8f94365a1e5

SHA1
fe88ae7e05a4d6b316ae21715cc28cee1e77bbf1

SHA256
53b963afe444843e4ae824a55b8ba34bf4fcc0afe6c593701cc0d536e6595b49

SHA512
434c5110424410d2d41159ebec37737842006b6add762ab4a19331e2c1cf7ec2c29cd1b3dfbd275242213aab415dafc727c040f3da4d402dfbbfcb77e8313405

Download Submit
C:\Windows\System\XoPPudj.exe

Filesize
3.1MB

MD5
84baa68ff58b15e5af50a4e4339ecd98

SHA1
91347044d5fcce5d274742508076eee59e5e44d7

SHA256
140d40051b133f1de11528d86edafa494859c8901d9538a4a8732a9d4393d6a1

SHA512
f1fa4dc5b32f0f8544d12c2af1ad48a6f3713699dd6d161e8ae197592d2c2ea052ac56f8c7ab9ffef4cf4757ba821cbfcf19174240606cf8972a5981b81fbf03

Download Submit
C:\Windows\System\YxsnmwE.exe

Filesize
3.1MB

MD5
7f6b2ca504e416c977c5c19a27822f28

SHA1
adf265d726bb1180d54ed2122853fa9bbe673302

SHA256
8f889b75e33a5db779126298fc01e3594638ef58c9a2d6c4de86d3d5862fd09b

SHA512
49086078cf67fe931ab417e3680e110a67cde87cc8ad3c4bca42d60648105856e8aa9c700f40f490d4ba316b6ec253e9880bc6c08016024142236f272ec461c8

Download Submit
C:\Windows\System\aUSDQXZ.exe

Filesize
3.1MB

MD5
46cd2aec33b477c0f15d47b4bf03d1b9

SHA1
bc96b742e452f3d36f2b00cdc5f8c4393e95fbc6

SHA256
937fe8016b8b76f18ca2cd4c0eb3b174d1ab7200c4f6447a436ef6b3cca4b867

SHA512
d4e3b20fb6d4a930dec8e778157deceffc1200503bbc7a38dadde89cfb5041ff5ec1f86809878e2b52b895733beadb8ad11b2578817c8d287fcfa904b205cdf2

Download Submit
C:\Windows\System\bDsTQuU.exe

Filesize
3.1MB

MD5
a1391cac63e9108880f80d42775b8da8

SHA1
03318e5f2a84821bdaa011175a9797b97b43a10c

SHA256
5873616f7a1238b329cf899b8c23b8b5cc133b4b762c9683c10ea46e171e48ce

SHA512
79ae08bead22c698b7b02878d9e37dc6252cc8bdd39006365d03ddec5e924bd9c920e7bc0cc76cab014f75273218bd1e41a8cc91ab17ac21641f7bd6fd7cdf3b

Download Submit
C:\Windows\System\bjTZeNs.exe

Filesize
3.1MB

MD5
2ce16f10a985452e8ae7fd166a6dcf63

SHA1
aedc83ef837606ede072c9e81c7a0cc19ea90b27

SHA256
947308bf7ba8122ef2617a5acbd50f7701593743aeaa78c516e4e7044c9424ef

SHA512
54e13e52fa74a4516b027c8f93550d8b85864af36fb3ecf4aea87dae327b1d231ff752fb12d190058d3c768553690b63071923a6d843c73e65c1b419e58fe74d

Download Submit
C:\Windows\System\cYPtVAV.exe

Filesize
3.1MB

MD5
ceabb2ab5524600e8bd499339d12ba89

SHA1
b1cd8960605b01347d0e36e4505c8f78f9daec8a

SHA256
b0249b1e117f4b15f34928132fdec9e4d1c6b4ba4220088d62053c9f60e430e6

SHA512
150b8e36a98fd67f39b9480d5792ec98ad95243d669b635a4ee12651749642ddf21c69f5bbea863ed6d4bd814a41ae16dfde189f04583510a939582f062b7e9c

Download Submit
C:\Windows\System\fHyqMfq.exe

Filesize
3.1MB

MD5
30d951b8b18cac8aec1a3f7cb3c2b1ca

SHA1
5585d1754480c6f2d01b123b218bc8d700948d6d

SHA256
b13e1f07b2b509f843a4f3a5d3a8968e115e46067763234df0ff2575a03c71b8

SHA512
5aff26e8fc64c66111e9158e860a6b98e3f1480f307bc13dba2e87cc144f1532a7f7526716f09b81157206794f5b86bc87e48c3b655a6a4de2934d3c330a87dc

Download Submit
C:\Windows\System\fKwjvvX.exe

Filesize
3.1MB

MD5
8433babf39e4cd7d0cf350f3242e5e9a

SHA1
143bbae314c44e3bb47c107396e20fc9fd981650

SHA256
266e9ab56b5fb426ad1f79e6ad4c5523228a85551a2f8bfb34d8e8b86c96ea2e

SHA512
1a4a042f50dfed8830b35637818d8b240bbd0a50d0708a3419020c1603accaae570fdc58e02da5256c86ac06ae4959d5101a4192ba80162e8c799d6a7d19d062

Download Submit
C:\Windows\System\igdHbPF.exe

Filesize
3.1MB

MD5
0eb174aae911e0e8d86c3469866811be

SHA1
8e42f23071ed6269cc3c3fac2a2656b3ec18125e

SHA256
5eb5ef181bea8909f77a43350bcdecaeb84e0fabb6815a4cc1ae3a9178c2ea6b

SHA512
a8c8d49256b704b33144d1cb2d346ea44b4f1559be0b22ac38bfd96b5b0a5e74f309c3e68a44313f7361943bee79ebe84291ed91cf40e0de7686b06d9efd3aa1

Download Submit
C:\Windows\System\jaWwzxm.exe

Filesize
3.1MB

MD5
7c70452cccbeb7aa239e901a1d3e7d5d

SHA1
3a0513910363c99c94c73d8c600994ce27b50ab7

SHA256
6db3b1c6d3fa19da83bf7bafb8675d825a2a9725e2e84b276737856c560ab025

SHA512
4751194dc8ea6bd577b44a1e180632ce3221b96e3907aae9250e87ec3753f6d5840fd4359dd9d3be30fdc18b8f1ba7c575326964dda3f42adf2d2dd0be907a17

Download Submit
C:\Windows\System\oCvTdyv.exe

Filesize
3.1MB

MD5
9e63fdca60af11cbac5eb28bd63b58ec

SHA1
cb9ef75d17e47d86dbc1461170114cecf1696f7e

SHA256
ca6ba6b2cf1508054020dfb1b90dacde2898a111d8e026214df59b6c9bd46a03

SHA512
3f2e84cb2110448098e1480214b4a2cb8012b4f44d1d0ab24bfbad20a7af2687a886727b4dc2e105fda039c3e6092bdc35c81742b344754756a4f6a614e897be

Download Submit
C:\Windows\System\obgfUVX.exe

Filesize
3.1MB

MD5
f3184c28d20954e2c2d309a15e01e92b

SHA1
cd800adb302d9c7531b9a28f13b1e0904587e577

SHA256
2d2ded77a37ebb6ca2c93d6a5bcb8c23c4470ee5885966ec900e7cd0756091f9

SHA512
86ce00a45838891376c0037c306da4b4c5dfe537ccf0002086911134b2d4dd768e3feec4b03b4ff28116d9f28e739c352ecd611e2f902a30561dba283bf94872

Download Submit
C:\Windows\System\opzBilB.exe

Filesize
3.1MB

MD5
b4adb59b34c8eec8c66dfa1c2d37d3d4

SHA1
1b72a2fea46e796d16e6e6e9ded5bd71123d8bf9

SHA256
0776d38f74c182c88dd9a87cd839047a7e223f6ab9c73386f734ecdec4a6e792

SHA512
1808a5aa9e61902cc9b544df72a50f61555e3d153e41648e8c79301fd97de27565542836fc24462d1e83710c8b6d0d2efdf6e71d1cdd99262eab230392c0b303

Download Submit
C:\Windows\System\pTWUtGN.exe

Filesize
3.1MB

MD5
a20022a3c3e9a4ac05303159e7351c75

SHA1
cfa1cc7bb5dea5e3e298295bb190758f146b258f

SHA256
cc7b9adf5b1ddfde15caa0a9a43f44a8561993ebf5c697ec93f5512675903e9e

SHA512
f4c3087731899f5ed0943a7cd7633311067b52ad0efecb8351812541b48e2f07e947ae385b7abc31188f85e41c280c6c144c973dd221da554ca2d7d12e72a35b

Download Submit
C:\Windows\System\qwXoXTm.exe

Filesize
3.1MB

MD5
1129edae3f9bee83d0f00d6ca5f0c354

SHA1
efe65db8f927b48ff455c758b9132ef17d94cb77

SHA256
6b94048ca7a79c76813adf0e950b3f23e55e063f20d86eae97664c974759d96f

SHA512
86a2fb636c4cd8859b2eb79fb9401f39ae24f199a70604fa620b227df2e34bba73869bc65e72f0795f3518c93ed4724856bf8bcd7392c790078ad5d591cf6d47

Download Submit
C:\Windows\System\svSHENu.exe

Filesize
18B

MD5
5ed14536d6a60edfb7165a68d0621225

SHA1
a8eef22392fe135675d9e4ff0ba361612e99a014

SHA256
c87bd3982d0ceab7daa5b5a992c93857b4f862470c6d151262fc51e39b2853d5

SHA512
0033d0dc43b1de6b9d2771d4cff80b3cc39c4a8ee19f4d82e3f1624c695e1bba02bda4489193b34a4111ddce406769b3260e1fca75a3e73aca9b095634a0f02e

Download Submit
C:\Windows\System\tRtWZqi.exe

Filesize
3.1MB

MD5
00b34541ec9997656728473e830dedad

SHA1
c6d5ae247d942daec965d384df1adef47acc3bee

SHA256
1fe6027203b3266981b01f070b413943b660d851ecee14d4b8bec64801d10ead

SHA512
ab0bd51534b1519d64762ef1745f51482a56d5fa5d0f522751719cdfb49266ec2227cba517852b4788849028e98d92e02a9d8ab1697fdc211228c736a886c372

Download Submit
C:\Windows\System\uWMrkXO.exe

Filesize
3.1MB

MD5
edb868c7873034799f33424c326b6a1b

SHA1
947376c217e41f2fb42e76234f71d8e1e6556de1

SHA256
fb0442c247ee9b74eeabc1f438f5835a136a50447557336c4d1c876ca9cb43e2

SHA512
e2c706a682178892f66d688d325d76e38be90fd962e2ef564ef7ae892e465c97588fc2a61ea576187dbc7423e245f7343be6879f8d23946fd2ddcc713ede5aa9

Download Submit
C:\Windows\System\uXZZJqg.exe

Filesize
3.1MB

MD5
65ded3c215f15d79b71840f01325e17e

SHA1
b957beb94e7295f2b5c1c5ad2c2ea85cb3884ce6

SHA256
629a44c41108bd83ef2a356511fa67608a5671980ecc4447e22e32966736caf4

SHA512
b626058c828668cea4bdbd01bc95c445c0da174a2d472164ddb570776f86248a428957339f77a602eabd305f6ae4738e5834d0814524fc6a49b4ec3a6a99714c

Download Submit
C:\Windows\System\vrzeeWQ.exe

Filesize
3.1MB

MD5
815810d18159f5625b0b2a133a8eae34

SHA1
56d736e089f73f1e21ab196e2e9fa7716efb7ece

SHA256
d86efe58cf83e4a3bfb3fc96e488ea0790d55cbbcb09bd8813d7a1eea556e7c8

SHA512
caf009097c8e05f02b2cfdec5bb099cae274cec33016e55e44b125df378a373fd66afaa5df20669ec89aff9ad581e6159afd913d82a18bf05663aee5552f82b2

Download Submit
C:\Windows\System\xkPMmSQ.exe

Filesize
3.1MB

MD5
9a026b19ef5544d2ddfb9836923b07e1

SHA1
276fd0c120ee37784dcfe33180d3c910ee1ef898

SHA256
de1ec6347153c78ab42ec2ebbf593bdf08d73ac7dde7c63c8d32e6fa5eed6300

SHA512
db653f65c6cd49024c34aa8e63a712d15863cab4e8956afa752708ced1c97f4db5f46225259e06eb126f38794bfa45a16833bff863bdf0576570a10ea47f85f7

Download Submit
C:\Windows\System\yAPfTUU.exe

Filesize
3.1MB

MD5
905535bcb452c92f4f9aa035d2924b24

SHA1
52b3fae6193c53ba0503e99ab5b7c41adc4e4dc2

SHA256
4448e128c740fc2927a1c47c785103fd0005dc1aef15f844ee971f19617637c3

SHA512
2450ae2b501f722a25e327d19634584d14046554ef3fb0a69e194cb5a086cef01fa1f02139b4b0a6cadc448d7050cfd8d8d2604b0eab378c7fd5fe609a298c22

Download Submit
C:\Windows\System\zFqFhZD.exe

Filesize
3.1MB

MD5
48ca73df4c769223e15f02e8a78e3f31

SHA1
d629b912e738260c70d3efe08e499b6444c44761

SHA256
750a8ff7b1f86a9886b974bb9ba6077329c6c6262f0cfbad1ba2962977e947c5

SHA512
91da6e6f23971d6af343ad7bf26d625e0ef8e4e052cba336ac858338f0bd37ce4a0b1e6fd40292bc3ccd80d118bb230f4bda957b62f439ecc6953cfccf5fac56

Download Submit
C:\Windows\System\zZzqmdT.exe

Filesize
3.1MB

MD5
8c0aa80f551e7715bb38720572791c26

SHA1
5ad1f11ce3d8eb38e4b8623ba97ff17d0c49e978

SHA256
9f437a3e19d872562e17bba7af2d2a6dccf405992bcef33ce0e22daa4b062a83

SHA512
b6c90fb24c94b1e23386a04af7760ce53f0c7ad161136d77110ca559e0f943bb78dab69bf662973fd90b745db8b8e0212866fef896c49bd6a0752b6f888d1e56

Download Submit
memory/1232-2433-0x00007FF745E00000-0x00007FF7461F6000-memory.dmp

Filesize
4.0MB

Download
memory/1232-782-0x00007FF745E00000-0x00007FF7461F6000-memory.dmp

Filesize
4.0MB

Download
memory/1232-92-0x00007FF745E00000-0x00007FF7461F6000-memory.dmp

Filesize
4.0MB

Download
memory/1260-179-0x0000015A4BA20000-0x0000015A4C1C6000-memory.dmp

Filesize
7.6MB

Download
memory/1260-105-0x0000015A489E0000-0x0000015A48A02000-memory.dmp

Filesize
136KB

Download
memory/1452-163-0x00007FF7C3620000-0x00007FF7C3A16000-memory.dmp

Filesize
4.0MB

Download
memory/1452-2512-0x00007FF7C3620000-0x00007FF7C3A16000-memory.dmp

Filesize
4.0MB

Download
memory/1452-1262-0x00007FF7C3620000-0x00007FF7C3A16000-memory.dmp

Filesize
4.0MB

Download
memory/1516-104-0x00007FF67DC10000-0x00007FF67E006000-memory.dmp

Filesize
4.0MB

Download
memory/1768-62-0x00007FF72C450000-0x00007FF72C846000-memory.dmp

Filesize
4.0MB

Download
memory/1768-2406-0x00007FF72C450000-0x00007FF72C846000-memory.dmp

Filesize
4.0MB

Download
memory/1828-55-0x00007FF728E10000-0x00007FF729206000-memory.dmp

Filesize
4.0MB

Download
memory/1828-442-0x00007FF728E10000-0x00007FF729206000-memory.dmp

Filesize
4.0MB

Download
memory/2076-121-0x00007FF7974C0000-0x00007FF7978B6000-memory.dmp

Filesize
4.0MB

Download
memory/2076-1131-0x00007FF7974C0000-0x00007FF7978B6000-memory.dmp

Filesize
4.0MB

Download
memory/2076-2476-0x00007FF7974C0000-0x00007FF7978B6000-memory.dmp

Filesize
4.0MB

Download
memory/2092-50-0x00007FF7CA3F0000-0x00007FF7CA7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2244-906-0x00007FF77F630000-0x00007FF77FA26000-memory.dmp

Filesize
4.0MB

Download
memory/2244-103-0x00007FF77F630000-0x00007FF77FA26000-memory.dmp

Filesize
4.0MB

Download
memory/2244-2439-0x00007FF77F630000-0x00007FF77FA26000-memory.dmp

Filesize
4.0MB

Download
memory/2272-432-0x00007FF6EAAD0000-0x00007FF6EAEC6000-memory.dmp

Filesize
4.0MB

Download
memory/2272-36-0x00007FF6EAAD0000-0x00007FF6EAEC6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-70-0x00007FF6A2540000-0x00007FF6A2936000-memory.dmp

Filesize
4.0MB

Download
memory/2752-67-0x00007FF68BAF0000-0x00007FF68BEE6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-626-0x00007FF68BAF0000-0x00007FF68BEE6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-2424-0x00007FF68BAF0000-0x00007FF68BEE6000-memory.dmp

Filesize
4.0MB

Download
memory/2788-24-0x00007FF6D1610000-0x00007FF6D1A06000-memory.dmp

Filesize
4.0MB

Download
memory/2788-289-0x00007FF6D1610000-0x00007FF6D1A06000-memory.dmp

Filesize
4.0MB

Download
memory/2800-2425-0x00007FF61D8E0000-0x00007FF61DCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2800-76-0x00007FF61D8E0000-0x00007FF61DCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2948-1261-0x00007FF7BA3B0000-0x00007FF7BA7A6000-memory.dmp

Filesize
4.0MB

Download
memory/2948-144-0x00007FF7BA3B0000-0x00007FF7BA7A6000-memory.dmp

Filesize
4.0MB

Download
memory/3076-28-0x00007FF791510000-0x00007FF791906000-memory.dmp

Filesize
4.0MB

Download
memory/3144-127-0x00007FF73E090000-0x00007FF73E486000-memory.dmp

Filesize
4.0MB

Download
memory/3144-1012-0x00007FF73E090000-0x00007FF73E486000-memory.dmp

Filesize
4.0MB

Download
memory/3144-2473-0x00007FF73E090000-0x00007FF73E486000-memory.dmp

Filesize
4.0MB

Download
memory/3336-2459-0x00007FF68BC30000-0x00007FF68C026000-memory.dmp

Filesize
4.0MB

Download
memory/3336-1010-0x00007FF68BC30000-0x00007FF68C026000-memory.dmp

Filesize
4.0MB

Download
memory/3336-120-0x00007FF68BC30000-0x00007FF68C026000-memory.dmp

Filesize
4.0MB

Download
memory/3444-900-0x00007FF7954D0000-0x00007FF7958C6000-memory.dmp

Filesize
4.0MB

Download
memory/3444-2448-0x00007FF7954D0000-0x00007FF7958C6000-memory.dmp

Filesize
4.0MB

Download
memory/3444-94-0x00007FF7954D0000-0x00007FF7958C6000-memory.dmp

Filesize
4.0MB

Download
memory/3596-12-0x00007FF773410000-0x00007FF773806000-memory.dmp

Filesize
4.0MB

Download
memory/3596-167-0x00007FF773410000-0x00007FF773806000-memory.dmp

Filesize
4.0MB

Download
memory/4044-1256-0x00007FF779BE0000-0x00007FF779FD6000-memory.dmp

Filesize
4.0MB

Download
memory/4044-132-0x00007FF779BE0000-0x00007FF779FD6000-memory.dmp

Filesize
4.0MB

Download
memory/4236-2522-0x00007FF7D2B50000-0x00007FF7D2F46000-memory.dmp

Filesize
4.0MB

Download
memory/4236-168-0x00007FF7D2B50000-0x00007FF7D2F46000-memory.dmp

Filesize
4.0MB

Download
memory/4236-1468-0x00007FF7D2B50000-0x00007FF7D2F46000-memory.dmp

Filesize
4.0MB

Download
memory/4380-75-0x00007FF671B10000-0x00007FF671F06000-memory.dmp

Filesize
4.0MB

Download
memory/4380-2422-0x00007FF671B10000-0x00007FF671F06000-memory.dmp

Filesize
4.0MB

Download
memory/4768-64-0x00007FF7E10A0000-0x00007FF7E1496000-memory.dmp

Filesize
4.0MB

Download
memory/4940-164-0x00007FF69A490000-0x00007FF69A886000-memory.dmp

Filesize
4.0MB

Download
memory/4940-0-0x00007FF69A490000-0x00007FF69A886000-memory.dmp

Filesize
4.0MB

Download
memory/4940-1-0x0000021A45230000-0x0000021A45240000-memory.dmp

Filesize
64KB

Download
memory/5044-2441-0x00007FF72B6D0000-0x00007FF72BAC6000-memory.dmp

Filesize
4.0MB

Download
memory/5044-897-0x00007FF72B6D0000-0x00007FF72BAC6000-memory.dmp

Filesize
4.0MB

Download
memory/5044-93-0x00007FF72B6D0000-0x00007FF72BAC6000-memory.dmp

Filesize
4.0MB

Download