xmrig | fbf37417765d8dd26a25853646f4465af663312a6897b5b0686caee57bf105fd

Analysis

max time kernel
120s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fe302233b57c1c6df8cbe3910dbbb40N.exe
Size

1.2MB
MD5

4fe302233b57c1c6df8cbe3910dbbb40
SHA1

04c534e319a85fe03ab0636f6423de169b7aa714
SHA256

fbf37417765d8dd26a25853646f4465af663312a6897b5b0686caee57bf105fd
SHA512

ec3e377835dc3e01494d026cc0c2c655f0b2be58b01626125c324f03ab4201a4d88ec428f0f2da61a75ecd0694f3e332172f2e57cf006d5714d9eefcb718ff68
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZGRoz:Lz071uv4BPMkibTIA5Jnsoz

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/memory/4888-309-0x00007FF607520000-0x00007FF607912000-memory.dmp	xmrig
behavioral2/memory/3500-229-0x00007FF7F1A80000-0x00007FF7F1E72000-memory.dmp	xmrig
behavioral2/memory/4840-777-0x00007FF64D810000-0x00007FF64DC02000-memory.dmp	xmrig
behavioral2/memory/2504-909-0x00007FF7D2C90000-0x00007FF7D3082000-memory.dmp	xmrig
behavioral2/memory/4788-913-0x00007FF71B690000-0x00007FF71BA82000-memory.dmp	xmrig
behavioral2/memory/5088-916-0x00007FF6FF9B0000-0x00007FF6FFDA2000-memory.dmp	xmrig
behavioral2/memory/1264-920-0x00007FF71D740000-0x00007FF71DB32000-memory.dmp	xmrig
behavioral2/memory/636-924-0x00007FF782960000-0x00007FF782D52000-memory.dmp	xmrig
behavioral2/memory/756-923-0x00007FF615420000-0x00007FF615812000-memory.dmp	xmrig
behavioral2/memory/2972-922-0x00007FF778590000-0x00007FF778982000-memory.dmp	xmrig
behavioral2/memory/3596-921-0x00007FF747380000-0x00007FF747772000-memory.dmp	xmrig
behavioral2/memory/1460-919-0x00007FF6A0BC0000-0x00007FF6A0FB2000-memory.dmp	xmrig
behavioral2/memory/2276-918-0x00007FF704C50000-0x00007FF705042000-memory.dmp	xmrig
behavioral2/memory/5056-917-0x00007FF69D4D0000-0x00007FF69D8C2000-memory.dmp	xmrig
behavioral2/memory/2788-915-0x00007FF6961A0000-0x00007FF696592000-memory.dmp	xmrig
behavioral2/memory/952-914-0x00007FF7B7810000-0x00007FF7B7C02000-memory.dmp	xmrig
behavioral2/memory/4040-773-0x00007FF644270000-0x00007FF644662000-memory.dmp	xmrig
behavioral2/memory/3868-575-0x00007FF603DD0000-0x00007FF6041C2000-memory.dmp	xmrig
behavioral2/memory/4144-415-0x00007FF661B20000-0x00007FF661F12000-memory.dmp	xmrig
behavioral2/memory/2612-420-0x00007FF69CEA0000-0x00007FF69D292000-memory.dmp	xmrig
behavioral2/memory/3444-304-0x00007FF60C250000-0x00007FF60C642000-memory.dmp	xmrig
behavioral2/memory/1240-158-0x00007FF7DBC00000-0x00007FF7DBFF2000-memory.dmp	xmrig
behavioral2/memory/2764-155-0x00007FF615440000-0x00007FF615832000-memory.dmp	xmrig
behavioral2/memory/2116-2557-0x00007FF7CDDE0000-0x00007FF7CE1D2000-memory.dmp	xmrig
behavioral2/memory/2676-2551-0x00007FF7197F0000-0x00007FF719BE2000-memory.dmp	xmrig
behavioral2/memory/756-6024-0x00007FF615420000-0x00007FF615812000-memory.dmp	xmrig
behavioral2/memory/3596-6129-0x00007FF747380000-0x00007FF747772000-memory.dmp	xmrig
behavioral2/memory/636-6231-0x00007FF782960000-0x00007FF782D52000-memory.dmp	xmrig
behavioral2/memory/952-6229-0x00007FF7B7810000-0x00007FF7B7C02000-memory.dmp	xmrig
behavioral2/memory/1460-6244-0x00007FF6A0BC0000-0x00007FF6A0FB2000-memory.dmp	xmrig
behavioral2/memory/2612-6262-0x00007FF69CEA0000-0x00007FF69D292000-memory.dmp	xmrig
behavioral2/memory/2972-6505-0x00007FF778590000-0x00007FF778982000-memory.dmp	xmrig
behavioral2/memory/2276-6510-0x00007FF704C50000-0x00007FF705042000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3896	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2116	wvXbHbR.exe
2764	MHWqTrH.exe
1240	LuzBeqa.exe
3500	zdqxwmc.exe
3444	RCfRkXb.exe
4888	rliqXTA.exe
756	kgmdMYA.exe
4144	epERBhL.exe
2612	eeJGRFZ.exe
3868	jvfDixy.exe
4040	jbvjETN.exe
4840	XMIJORe.exe
2504	pqhCDVd.exe
4788	zQwyMUC.exe
952	OzpvanF.exe
2788	mkUAiJy.exe
5088	zbyCXOW.exe
5056	BReckWs.exe
2276	UGgZMqx.exe
1460	PvKAaRB.exe
636	aFSwgsi.exe
1264	ftXFJHQ.exe
3596	IJekLss.exe
2972	ptGFaTs.exe
2440	MMwwNuB.exe
4048	uXNIgiB.exe
4676	lOlwwhf.exe
5004	oLrMmgB.exe
4424	ZKFvSac.exe
3656	RWmbJEk.exe
2464	BWufGEI.exe
2244	KWTjAYa.exe
2964	HkFNthS.exe
2928	XkqjTWC.exe
2272	wsfFMFv.exe
528	gVyXlNG.exe
400	srndgJY.exe
5036	LrDKfrE.exe
744	QncOLkt.exe
2176	gAtCdAX.exe
3716	LCXDLTZ.exe
924	qbQbUSl.exe
4408	QIRJEwG.exe
4300	SlzoADt.exe
3044	tWdFzWQ.exe
4400	djCuBzh.exe
4436	KhRBjzi.exe
1468	RchkyzR.exe
2424	XTFShMk.exe
3380	CllSxOB.exe
4012	hvzNzKL.exe
916	LjVLZkP.exe
1944	GYXPAOE.exe
2068	jQVEXHS.exe
2944	WopGQBG.exe
60	HSKDhyW.exe
4016	eqvnuvv.exe
4172	ltqIAMn.exe
1600	bXCkbMY.exe
4228	WMJadIj.exe
404	tjUxNXh.exe
4384	XbcZhRn.exe
2188	GsQArUy.exe
996	eGBLmDL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2676-0-0x00007FF7197F0000-0x00007FF719BE2000-memory.dmp	upx
behavioral2/files/0x0007000000023427-7.dat	upx
behavioral2/memory/2116-13-0x00007FF7CDDE0000-0x00007FF7CE1D2000-memory.dmp	upx
behavioral2/files/0x000700000002342e-65.dat	upx
behavioral2/files/0x0007000000023447-148.dat	upx
behavioral2/files/0x0007000000023437-108.dat	upx
behavioral2/files/0x0007000000023436-107.dat	upx
behavioral2/files/0x0007000000023435-104.dat	upx
behavioral2/files/0x0007000000023434-103.dat	upx
behavioral2/files/0x0007000000023446-141.dat	upx
behavioral2/files/0x0007000000023445-140.dat	upx
behavioral2/files/0x000700000002342c-96.dat	upx
behavioral2/files/0x0007000000023432-94.dat	upx
behavioral2/files/0x0007000000023431-85.dat	upx
behavioral2/files/0x000700000002342b-76.dat	upx
behavioral2/files/0x000700000002343e-126.dat	upx
behavioral2/files/0x0007000000023449-152.dat	upx
behavioral2/memory/4888-309-0x00007FF607520000-0x00007FF607912000-memory.dmp	upx
behavioral2/memory/3500-229-0x00007FF7F1A80000-0x00007FF7F1E72000-memory.dmp	upx
behavioral2/files/0x0007000000023439-207.dat	upx
behavioral2/files/0x0007000000023450-202.dat	upx
behavioral2/files/0x000700000002344f-192.dat	upx
behavioral2/files/0x0007000000023433-182.dat	upx
behavioral2/files/0x0007000000023444-180.dat	upx
behavioral2/memory/4840-777-0x00007FF64D810000-0x00007FF64DC02000-memory.dmp	upx
behavioral2/memory/2504-909-0x00007FF7D2C90000-0x00007FF7D3082000-memory.dmp	upx
behavioral2/memory/4788-913-0x00007FF71B690000-0x00007FF71BA82000-memory.dmp	upx
behavioral2/memory/5088-916-0x00007FF6FF9B0000-0x00007FF6FFDA2000-memory.dmp	upx
behavioral2/memory/1264-920-0x00007FF71D740000-0x00007FF71DB32000-memory.dmp	upx
behavioral2/memory/636-924-0x00007FF782960000-0x00007FF782D52000-memory.dmp	upx
behavioral2/memory/756-923-0x00007FF615420000-0x00007FF615812000-memory.dmp	upx
behavioral2/memory/2972-922-0x00007FF778590000-0x00007FF778982000-memory.dmp	upx
behavioral2/memory/3596-921-0x00007FF747380000-0x00007FF747772000-memory.dmp	upx
behavioral2/memory/1460-919-0x00007FF6A0BC0000-0x00007FF6A0FB2000-memory.dmp	upx
behavioral2/memory/2276-918-0x00007FF704C50000-0x00007FF705042000-memory.dmp	upx
behavioral2/memory/5056-917-0x00007FF69D4D0000-0x00007FF69D8C2000-memory.dmp	upx
behavioral2/memory/2788-915-0x00007FF6961A0000-0x00007FF696592000-memory.dmp	upx
behavioral2/memory/952-914-0x00007FF7B7810000-0x00007FF7B7C02000-memory.dmp	upx
behavioral2/memory/4040-773-0x00007FF644270000-0x00007FF644662000-memory.dmp	upx
behavioral2/memory/3868-575-0x00007FF603DD0000-0x00007FF6041C2000-memory.dmp	upx
behavioral2/memory/4144-415-0x00007FF661B20000-0x00007FF661F12000-memory.dmp	upx
behavioral2/memory/2612-420-0x00007FF69CEA0000-0x00007FF69D292000-memory.dmp	upx
behavioral2/memory/3444-304-0x00007FF60C250000-0x00007FF60C642000-memory.dmp	upx
behavioral2/files/0x000700000002344e-179.dat	upx
behavioral2/files/0x000700000002344d-178.dat	upx
behavioral2/files/0x0007000000023442-177.dat	upx
behavioral2/files/0x0007000000023441-176.dat	upx
behavioral2/files/0x0007000000023440-175.dat	upx
behavioral2/files/0x000700000002343f-174.dat	upx
behavioral2/files/0x000700000002344c-173.dat	upx
behavioral2/files/0x0007000000023430-167.dat	upx
behavioral2/memory/1240-158-0x00007FF7DBC00000-0x00007FF7DBFF2000-memory.dmp	upx
behavioral2/memory/2764-155-0x00007FF615440000-0x00007FF615832000-memory.dmp	upx
behavioral2/files/0x0007000000023448-149.dat	upx
behavioral2/files/0x0007000000023438-144.dat	upx
behavioral2/files/0x0007000000023443-131.dat	upx
behavioral2/files/0x000700000002344b-172.dat	upx
behavioral2/files/0x000700000002344a-161.dat	upx
behavioral2/files/0x000700000002342f-122.dat	upx
behavioral2/files/0x000700000002343c-121.dat	upx
behavioral2/files/0x000700000002343b-119.dat	upx
behavioral2/files/0x000700000002343d-125.dat	upx
behavioral2/files/0x000700000002343a-118.dat	upx
behavioral2/files/0x000700000002342a-69.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YPPbHgd.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\mGRDJmL.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\YjhqZHh.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\ULbvxqX.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\kdQwNHt.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\zHUiyiY.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\DIuztxo.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\IZixvuu.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\FypfoSM.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\GtvTnKt.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\WEKmWgh.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\LfoIsTl.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\rclGlJf.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\xBRKpUt.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\dXjFRPz.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\LgPhjUI.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\YqMEVhl.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\zLUQGnB.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\OTDhasc.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\MTwyDTR.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\eTjMMlk.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\JlzjyHC.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\SYdYFzC.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\JQGssoH.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\XxFDxWN.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\gixzbJw.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\hjojwVn.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\hHNfseJ.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\oMiOYzD.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\kCJqpgk.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\JmyLOGq.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\WzxwLBW.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\YRrsbeE.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\bocDtCT.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\iBCHxRG.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\wHpvHyq.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\eseBwHp.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\vCfjejL.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\VZlCXHW.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\bbisROx.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\wlFvfVi.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\MxqWIRZ.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\icnuCPE.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\EQljHMI.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\XYJjGYj.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\FKQhKMX.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\sJfOahs.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\QUGXPlp.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\XUUWfGI.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\ivxOaTG.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\MhUskYg.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\FoXIqUI.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\rJmeWvW.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\AJWgAFn.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\iAJdZjc.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\wEUgUEI.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\gifcWCH.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\TdoOppX.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\ZHfHpgW.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\HjFSEmR.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\mjqqFqx.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\QtFwZkB.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\BxWdCQg.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\PwQNFOB.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3896	powershell.exe
3896	powershell.exe
3896	powershell.exe
3896	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe
Token: SeLockMemoryPrivilege	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe
Token: SeDebugPrivilege	3896	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 3896	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	84
PID 2676 wrote to memory of 3896	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	84
PID 2676 wrote to memory of 2116	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	85
PID 2676 wrote to memory of 2116	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	85
PID 2676 wrote to memory of 1240	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	86
PID 2676 wrote to memory of 1240	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	86
PID 2676 wrote to memory of 2764	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	87
PID 2676 wrote to memory of 2764	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	87
PID 2676 wrote to memory of 3500	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	88
PID 2676 wrote to memory of 3500	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	88
PID 2676 wrote to memory of 3444	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	89
PID 2676 wrote to memory of 3444	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	89
PID 2676 wrote to memory of 4888	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	90
PID 2676 wrote to memory of 4888	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	90
PID 2676 wrote to memory of 756	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	91
PID 2676 wrote to memory of 756	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	91
PID 2676 wrote to memory of 4144	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	92
PID 2676 wrote to memory of 4144	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	92
PID 2676 wrote to memory of 2612	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	93
PID 2676 wrote to memory of 2612	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	93
PID 2676 wrote to memory of 2504	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	94
PID 2676 wrote to memory of 2504	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	94
PID 2676 wrote to memory of 3868	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	95
PID 2676 wrote to memory of 3868	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	95
PID 2676 wrote to memory of 4040	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	96
PID 2676 wrote to memory of 4040	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	96
PID 2676 wrote to memory of 4840	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	97
PID 2676 wrote to memory of 4840	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	97
PID 2676 wrote to memory of 4788	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	98
PID 2676 wrote to memory of 4788	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	98
PID 2676 wrote to memory of 952	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	99
PID 2676 wrote to memory of 952	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	99
PID 2676 wrote to memory of 2788	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	100
PID 2676 wrote to memory of 2788	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	100
PID 2676 wrote to memory of 5088	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	101
PID 2676 wrote to memory of 5088	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	101
PID 2676 wrote to memory of 5056	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	102
PID 2676 wrote to memory of 5056	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	102
PID 2676 wrote to memory of 2276	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	103
PID 2676 wrote to memory of 2276	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	103
PID 2676 wrote to memory of 3656	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	104
PID 2676 wrote to memory of 3656	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	104
PID 2676 wrote to memory of 1460	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	105
PID 2676 wrote to memory of 1460	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	105
PID 2676 wrote to memory of 636	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	106
PID 2676 wrote to memory of 636	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	106
PID 2676 wrote to memory of 1264	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	107
PID 2676 wrote to memory of 1264	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	107
PID 2676 wrote to memory of 3596	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	108
PID 2676 wrote to memory of 3596	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	108
PID 2676 wrote to memory of 2972	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	109
PID 2676 wrote to memory of 2972	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	109
PID 2676 wrote to memory of 2440	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	110
PID 2676 wrote to memory of 2440	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	110
PID 2676 wrote to memory of 400	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	111
PID 2676 wrote to memory of 400	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	111
PID 2676 wrote to memory of 5036	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	112
PID 2676 wrote to memory of 5036	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	112
PID 2676 wrote to memory of 744	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	113
PID 2676 wrote to memory of 744	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	113
PID 2676 wrote to memory of 2176	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	114
PID 2676 wrote to memory of 2176	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	114
PID 2676 wrote to memory of 4048	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	115
PID 2676 wrote to memory of 4048	2676	4fe302233b57c1c6df8cbe3910dbbb40N.exe	115

C:\Users\Admin\AppData\Local\Temp\4fe302233b57c1c6df8cbe3910dbbb40N.exe
"C:\Users\Admin\AppData\Local\Temp\4fe302233b57c1c6df8cbe3910dbbb40N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3896
- C:\Windows\System\wvXbHbR.exe
  C:\Windows\System\wvXbHbR.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\LuzBeqa.exe
  C:\Windows\System\LuzBeqa.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\MHWqTrH.exe
  C:\Windows\System\MHWqTrH.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\zdqxwmc.exe
  C:\Windows\System\zdqxwmc.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\RCfRkXb.exe
  C:\Windows\System\RCfRkXb.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\rliqXTA.exe
  C:\Windows\System\rliqXTA.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\kgmdMYA.exe
  C:\Windows\System\kgmdMYA.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\epERBhL.exe
  C:\Windows\System\epERBhL.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\eeJGRFZ.exe
  C:\Windows\System\eeJGRFZ.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\pqhCDVd.exe
  C:\Windows\System\pqhCDVd.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\jvfDixy.exe
  C:\Windows\System\jvfDixy.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\jbvjETN.exe
  C:\Windows\System\jbvjETN.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\XMIJORe.exe
  C:\Windows\System\XMIJORe.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\zQwyMUC.exe
  C:\Windows\System\zQwyMUC.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\OzpvanF.exe
  C:\Windows\System\OzpvanF.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\mkUAiJy.exe
  C:\Windows\System\mkUAiJy.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\zbyCXOW.exe
  C:\Windows\System\zbyCXOW.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\BReckWs.exe
  C:\Windows\System\BReckWs.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\UGgZMqx.exe
  C:\Windows\System\UGgZMqx.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\RWmbJEk.exe
  C:\Windows\System\RWmbJEk.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\PvKAaRB.exe
  C:\Windows\System\PvKAaRB.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\aFSwgsi.exe
  C:\Windows\System\aFSwgsi.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\ftXFJHQ.exe
  C:\Windows\System\ftXFJHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\IJekLss.exe
  C:\Windows\System\IJekLss.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\ptGFaTs.exe
  C:\Windows\System\ptGFaTs.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\MMwwNuB.exe
  C:\Windows\System\MMwwNuB.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\srndgJY.exe
  C:\Windows\System\srndgJY.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\LrDKfrE.exe
  C:\Windows\System\LrDKfrE.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\QncOLkt.exe
  C:\Windows\System\QncOLkt.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\gAtCdAX.exe
  C:\Windows\System\gAtCdAX.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\uXNIgiB.exe
  C:\Windows\System\uXNIgiB.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\lOlwwhf.exe
  C:\Windows\System\lOlwwhf.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\oLrMmgB.exe
  C:\Windows\System\oLrMmgB.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\ZKFvSac.exe
  C:\Windows\System\ZKFvSac.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\BWufGEI.exe
  C:\Windows\System\BWufGEI.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\KWTjAYa.exe
  C:\Windows\System\KWTjAYa.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\HkFNthS.exe
  C:\Windows\System\HkFNthS.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\XkqjTWC.exe
  C:\Windows\System\XkqjTWC.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\wsfFMFv.exe
  C:\Windows\System\wsfFMFv.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\gVyXlNG.exe
  C:\Windows\System\gVyXlNG.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\LCXDLTZ.exe
  C:\Windows\System\LCXDLTZ.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\qbQbUSl.exe
  C:\Windows\System\qbQbUSl.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\QIRJEwG.exe
  C:\Windows\System\QIRJEwG.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\SlzoADt.exe
  C:\Windows\System\SlzoADt.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\tWdFzWQ.exe
  C:\Windows\System\tWdFzWQ.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\djCuBzh.exe
  C:\Windows\System\djCuBzh.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\KhRBjzi.exe
  C:\Windows\System\KhRBjzi.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\RchkyzR.exe
  C:\Windows\System\RchkyzR.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\bCBNGxm.exe
  C:\Windows\System\bCBNGxm.exe
  2⤵
  PID:3688
- C:\Windows\System\XTFShMk.exe
  C:\Windows\System\XTFShMk.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\CllSxOB.exe
  C:\Windows\System\CllSxOB.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\hvzNzKL.exe
  C:\Windows\System\hvzNzKL.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\LjVLZkP.exe
  C:\Windows\System\LjVLZkP.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\GYXPAOE.exe
  C:\Windows\System\GYXPAOE.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\jQVEXHS.exe
  C:\Windows\System\jQVEXHS.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\WopGQBG.exe
  C:\Windows\System\WopGQBG.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\HSKDhyW.exe
  C:\Windows\System\HSKDhyW.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\eqvnuvv.exe
  C:\Windows\System\eqvnuvv.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\ltqIAMn.exe
  C:\Windows\System\ltqIAMn.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\bXCkbMY.exe
  C:\Windows\System\bXCkbMY.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\WMJadIj.exe
  C:\Windows\System\WMJadIj.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\tjUxNXh.exe
  C:\Windows\System\tjUxNXh.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\XbcZhRn.exe
  C:\Windows\System\XbcZhRn.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\GsQArUy.exe
  C:\Windows\System\GsQArUy.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\eGBLmDL.exe
  C:\Windows\System\eGBLmDL.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\dxUlNjD.exe
  C:\Windows\System\dxUlNjD.exe
  2⤵
  PID:3428
- C:\Windows\System\cIITrDW.exe
  C:\Windows\System\cIITrDW.exe
  2⤵
  PID:1720
- C:\Windows\System\tLVMaRN.exe
  C:\Windows\System\tLVMaRN.exe
  2⤵
  PID:4920
- C:\Windows\System\eLjFjmO.exe
  C:\Windows\System\eLjFjmO.exe
  2⤵
  PID:3680
- C:\Windows\System\zgmRQQM.exe
  C:\Windows\System\zgmRQQM.exe
  2⤵
  PID:976
- C:\Windows\System\mbMCkvr.exe
  C:\Windows\System\mbMCkvr.exe
  2⤵
  PID:2004
- C:\Windows\System\WjUYyTJ.exe
  C:\Windows\System\WjUYyTJ.exe
  2⤵
  PID:4092
- C:\Windows\System\TquDgtA.exe
  C:\Windows\System\TquDgtA.exe
  2⤵
  PID:1680
- C:\Windows\System\mkEwfxn.exe
  C:\Windows\System\mkEwfxn.exe
  2⤵
  PID:5072
- C:\Windows\System\pOfqwib.exe
  C:\Windows\System\pOfqwib.exe
  2⤵
  PID:4848
- C:\Windows\System\yxDulRx.exe
  C:\Windows\System\yxDulRx.exe
  2⤵
  PID:3768
- C:\Windows\System\VbmxWMJ.exe
  C:\Windows\System\VbmxWMJ.exe
  2⤵
  PID:3140
- C:\Windows\System\eemRpmD.exe
  C:\Windows\System\eemRpmD.exe
  2⤵
  PID:4212
- C:\Windows\System\aYFTwff.exe
  C:\Windows\System\aYFTwff.exe
  2⤵
  PID:5128
- C:\Windows\System\PblmXSM.exe
  C:\Windows\System\PblmXSM.exe
  2⤵
  PID:5144
- C:\Windows\System\nnCpRBC.exe
  C:\Windows\System\nnCpRBC.exe
  2⤵
  PID:5164
- C:\Windows\System\lryxWNU.exe
  C:\Windows\System\lryxWNU.exe
  2⤵
  PID:5180
- C:\Windows\System\hopqeZl.exe
  C:\Windows\System\hopqeZl.exe
  2⤵
  PID:5196
- C:\Windows\System\ALJnhoF.exe
  C:\Windows\System\ALJnhoF.exe
  2⤵
  PID:5224
- C:\Windows\System\WingPlF.exe
  C:\Windows\System\WingPlF.exe
  2⤵
  PID:5248
- C:\Windows\System\tRbdgUR.exe
  C:\Windows\System\tRbdgUR.exe
  2⤵
  PID:5272
- C:\Windows\System\FNACgKW.exe
  C:\Windows\System\FNACgKW.exe
  2⤵
  PID:5292
- C:\Windows\System\jWMYDrB.exe
  C:\Windows\System\jWMYDrB.exe
  2⤵
  PID:5312
- C:\Windows\System\qyiSlbL.exe
  C:\Windows\System\qyiSlbL.exe
  2⤵
  PID:5328
- C:\Windows\System\tCmtxpe.exe
  C:\Windows\System\tCmtxpe.exe
  2⤵
  PID:5352
- C:\Windows\System\pHjijmB.exe
  C:\Windows\System\pHjijmB.exe
  2⤵
  PID:5368
- C:\Windows\System\JTaNDlj.exe
  C:\Windows\System\JTaNDlj.exe
  2⤵
  PID:5424
- C:\Windows\System\lJlRnaT.exe
  C:\Windows\System\lJlRnaT.exe
  2⤵
  PID:5440
- C:\Windows\System\fAyZRjf.exe
  C:\Windows\System\fAyZRjf.exe
  2⤵
  PID:5464
- C:\Windows\System\UkvMBVG.exe
  C:\Windows\System\UkvMBVG.exe
  2⤵
  PID:5504
- C:\Windows\System\fnkoAvi.exe
  C:\Windows\System\fnkoAvi.exe
  2⤵
  PID:5520
- C:\Windows\System\xpGIYNJ.exe
  C:\Windows\System\xpGIYNJ.exe
  2⤵
  PID:5540
- C:\Windows\System\eRhnDll.exe
  C:\Windows\System\eRhnDll.exe
  2⤵
  PID:5556
- C:\Windows\System\RzaMLCW.exe
  C:\Windows\System\RzaMLCW.exe
  2⤵
  PID:5592
- C:\Windows\System\qPMqXoh.exe
  C:\Windows\System\qPMqXoh.exe
  2⤵
  PID:5608
- C:\Windows\System\KXRQfjm.exe
  C:\Windows\System\KXRQfjm.exe
  2⤵
  PID:5632
- C:\Windows\System\KbHqzvY.exe
  C:\Windows\System\KbHqzvY.exe
  2⤵
  PID:5648
- C:\Windows\System\jkZghya.exe
  C:\Windows\System\jkZghya.exe
  2⤵
  PID:5668
- C:\Windows\System\IUhbDHM.exe
  C:\Windows\System\IUhbDHM.exe
  2⤵
  PID:5688
- C:\Windows\System\KmnmjpN.exe
  C:\Windows\System\KmnmjpN.exe
  2⤵
  PID:5720
- C:\Windows\System\GATECOT.exe
  C:\Windows\System\GATECOT.exe
  2⤵
  PID:5752
- C:\Windows\System\DCGHxBh.exe
  C:\Windows\System\DCGHxBh.exe
  2⤵
  PID:5772
- C:\Windows\System\qYPpDwl.exe
  C:\Windows\System\qYPpDwl.exe
  2⤵
  PID:5804
- C:\Windows\System\uNtmQXf.exe
  C:\Windows\System\uNtmQXf.exe
  2⤵
  PID:5820
- C:\Windows\System\NyYAXhT.exe
  C:\Windows\System\NyYAXhT.exe
  2⤵
  PID:5844
- C:\Windows\System\dlTdQgj.exe
  C:\Windows\System\dlTdQgj.exe
  2⤵
  PID:5864
- C:\Windows\System\rBTqyYA.exe
  C:\Windows\System\rBTqyYA.exe
  2⤵
  PID:5884
- C:\Windows\System\WhNcXWc.exe
  C:\Windows\System\WhNcXWc.exe
  2⤵
  PID:5904
- C:\Windows\System\rCegEBo.exe
  C:\Windows\System\rCegEBo.exe
  2⤵
  PID:5920
- C:\Windows\System\HLADUnE.exe
  C:\Windows\System\HLADUnE.exe
  2⤵
  PID:5940
- C:\Windows\System\OwLgmnS.exe
  C:\Windows\System\OwLgmnS.exe
  2⤵
  PID:5956
- C:\Windows\System\slrHdbZ.exe
  C:\Windows\System\slrHdbZ.exe
  2⤵
  PID:5972
- C:\Windows\System\jcGowyY.exe
  C:\Windows\System\jcGowyY.exe
  2⤵
  PID:6004
- C:\Windows\System\JaZPAZc.exe
  C:\Windows\System\JaZPAZc.exe
  2⤵
  PID:6028
- C:\Windows\System\aCRrxpu.exe
  C:\Windows\System\aCRrxpu.exe
  2⤵
  PID:6044
- C:\Windows\System\ZYFmORR.exe
  C:\Windows\System\ZYFmORR.exe
  2⤵
  PID:6064
- C:\Windows\System\GnSShyN.exe
  C:\Windows\System\GnSShyN.exe
  2⤵
  PID:6088
- C:\Windows\System\FPSVNxB.exe
  C:\Windows\System\FPSVNxB.exe
  2⤵
  PID:6108
- C:\Windows\System\GMUlKZc.exe
  C:\Windows\System\GMUlKZc.exe
  2⤵
  PID:6124
- C:\Windows\System\TSQKlvI.exe
  C:\Windows\System\TSQKlvI.exe
  2⤵
  PID:1652
- C:\Windows\System\poFCPJm.exe
  C:\Windows\System\poFCPJm.exe
  2⤵
  PID:3388
- C:\Windows\System\IdDxiUm.exe
  C:\Windows\System\IdDxiUm.exe
  2⤵
  PID:1964
- C:\Windows\System\mzrXlKL.exe
  C:\Windows\System\mzrXlKL.exe
  2⤵
  PID:1084
- C:\Windows\System\ZoBvsQd.exe
  C:\Windows\System\ZoBvsQd.exe
  2⤵
  PID:3108
- C:\Windows\System\ywyaCwz.exe
  C:\Windows\System\ywyaCwz.exe
  2⤵
  PID:2260
- C:\Windows\System\ARNCNGs.exe
  C:\Windows\System\ARNCNGs.exe
  2⤵
  PID:1020
- C:\Windows\System\FwHqdBe.exe
  C:\Windows\System\FwHqdBe.exe
  2⤵
  PID:5000
- C:\Windows\System\PlMrkzb.exe
  C:\Windows\System\PlMrkzb.exe
  2⤵
  PID:1808
- C:\Windows\System\FyBIBhR.exe
  C:\Windows\System\FyBIBhR.exe
  2⤵
  PID:4908
- C:\Windows\System\BNhvXnC.exe
  C:\Windows\System\BNhvXnC.exe
  2⤵
  PID:1464
- C:\Windows\System\CNFVEnG.exe
  C:\Windows\System\CNFVEnG.exe
  2⤵
  PID:4184
- C:\Windows\System\nkelSZM.exe
  C:\Windows\System\nkelSZM.exe
  2⤵
  PID:3400
- C:\Windows\System\gLoQhZP.exe
  C:\Windows\System\gLoQhZP.exe
  2⤵
  PID:5324
- C:\Windows\System\ePhTcrT.exe
  C:\Windows\System\ePhTcrT.exe
  2⤵
  PID:5064
- C:\Windows\System\jOelNwS.exe
  C:\Windows\System\jOelNwS.exe
  2⤵
  PID:6152
- C:\Windows\System\OOCYobT.exe
  C:\Windows\System\OOCYobT.exe
  2⤵
  PID:6180
- C:\Windows\System\ObAJgWV.exe
  C:\Windows\System\ObAJgWV.exe
  2⤵
  PID:6204
- C:\Windows\System\kcHflZa.exe
  C:\Windows\System\kcHflZa.exe
  2⤵
  PID:6224
- C:\Windows\System\zbDfNPQ.exe
  C:\Windows\System\zbDfNPQ.exe
  2⤵
  PID:6240
- C:\Windows\System\BWLcWym.exe
  C:\Windows\System\BWLcWym.exe
  2⤵
  PID:6264
- C:\Windows\System\pCSInTT.exe
  C:\Windows\System\pCSInTT.exe
  2⤵
  PID:6280
- C:\Windows\System\BCbENYH.exe
  C:\Windows\System\BCbENYH.exe
  2⤵
  PID:6300
- C:\Windows\System\EHnaIJz.exe
  C:\Windows\System\EHnaIJz.exe
  2⤵
  PID:6324
- C:\Windows\System\BHpDjTI.exe
  C:\Windows\System\BHpDjTI.exe
  2⤵
  PID:6340
- C:\Windows\System\BQknfIk.exe
  C:\Windows\System\BQknfIk.exe
  2⤵
  PID:6356
- C:\Windows\System\kxgrPyA.exe
  C:\Windows\System\kxgrPyA.exe
  2⤵
  PID:6400
- C:\Windows\System\uYjDpVA.exe
  C:\Windows\System\uYjDpVA.exe
  2⤵
  PID:6420
- C:\Windows\System\lqMnDsX.exe
  C:\Windows\System\lqMnDsX.exe
  2⤵
  PID:6444
- C:\Windows\System\nyhHHTa.exe
  C:\Windows\System\nyhHHTa.exe
  2⤵
  PID:6468
- C:\Windows\System\fDbprFI.exe
  C:\Windows\System\fDbprFI.exe
  2⤵
  PID:6488
- C:\Windows\System\GGrhLsn.exe
  C:\Windows\System\GGrhLsn.exe
  2⤵
  PID:6504
- C:\Windows\System\FImdUXU.exe
  C:\Windows\System\FImdUXU.exe
  2⤵
  PID:6524
- C:\Windows\System\DLHVFYY.exe
  C:\Windows\System\DLHVFYY.exe
  2⤵
  PID:6540
- C:\Windows\System\AlvrhGb.exe
  C:\Windows\System\AlvrhGb.exe
  2⤵
  PID:6560
- C:\Windows\System\dZvZUgE.exe
  C:\Windows\System\dZvZUgE.exe
  2⤵
  PID:6576
- C:\Windows\System\jbEACne.exe
  C:\Windows\System\jbEACne.exe
  2⤵
  PID:6592
- C:\Windows\System\vuJOIzg.exe
  C:\Windows\System\vuJOIzg.exe
  2⤵
  PID:6608
- C:\Windows\System\cmiEeys.exe
  C:\Windows\System\cmiEeys.exe
  2⤵
  PID:6624
- C:\Windows\System\csvchkF.exe
  C:\Windows\System\csvchkF.exe
  2⤵
  PID:6652
- C:\Windows\System\JEXdDcs.exe
  C:\Windows\System\JEXdDcs.exe
  2⤵
  PID:6676
- C:\Windows\System\qZrtUlc.exe
  C:\Windows\System\qZrtUlc.exe
  2⤵
  PID:6692
- C:\Windows\System\UwVXCBy.exe
  C:\Windows\System\UwVXCBy.exe
  2⤵
  PID:6712
- C:\Windows\System\kHcBKps.exe
  C:\Windows\System\kHcBKps.exe
  2⤵
  PID:6728
- C:\Windows\System\KWaqYta.exe
  C:\Windows\System\KWaqYta.exe
  2⤵
  PID:6744
- C:\Windows\System\lKjjGRN.exe
  C:\Windows\System\lKjjGRN.exe
  2⤵
  PID:6760
- C:\Windows\System\yVPbUON.exe
  C:\Windows\System\yVPbUON.exe
  2⤵
  PID:6780
- C:\Windows\System\EDNOxJS.exe
  C:\Windows\System\EDNOxJS.exe
  2⤵
  PID:6800
- C:\Windows\System\saHSiEk.exe
  C:\Windows\System\saHSiEk.exe
  2⤵
  PID:6816
- C:\Windows\System\OBBVVbF.exe
  C:\Windows\System\OBBVVbF.exe
  2⤵
  PID:6836
- C:\Windows\System\xFnKRil.exe
  C:\Windows\System\xFnKRil.exe
  2⤵
  PID:6860
- C:\Windows\System\dPCiTzq.exe
  C:\Windows\System\dPCiTzq.exe
  2⤵
  PID:6876
- C:\Windows\System\jYETsvr.exe
  C:\Windows\System\jYETsvr.exe
  2⤵
  PID:6900
- C:\Windows\System\PeNgegd.exe
  C:\Windows\System\PeNgegd.exe
  2⤵
  PID:6916
- C:\Windows\System\zOpbEjS.exe
  C:\Windows\System\zOpbEjS.exe
  2⤵
  PID:6932
- C:\Windows\System\ZIVIGwO.exe
  C:\Windows\System\ZIVIGwO.exe
  2⤵
  PID:6956
- C:\Windows\System\RAtIcdh.exe
  C:\Windows\System\RAtIcdh.exe
  2⤵
  PID:6976
- C:\Windows\System\aWQefTS.exe
  C:\Windows\System\aWQefTS.exe
  2⤵
  PID:6992
- C:\Windows\System\RoIaVLz.exe
  C:\Windows\System\RoIaVLz.exe
  2⤵
  PID:7016
- C:\Windows\System\FNfPUNI.exe
  C:\Windows\System\FNfPUNI.exe
  2⤵
  PID:7032
- C:\Windows\System\VKPxWEY.exe
  C:\Windows\System\VKPxWEY.exe
  2⤵
  PID:7060
- C:\Windows\System\hFJQGvS.exe
  C:\Windows\System\hFJQGvS.exe
  2⤵
  PID:7076
- C:\Windows\System\QzjvsEx.exe
  C:\Windows\System\QzjvsEx.exe
  2⤵
  PID:7096
- C:\Windows\System\XskncvM.exe
  C:\Windows\System\XskncvM.exe
  2⤵
  PID:7120
- C:\Windows\System\XCgjjtj.exe
  C:\Windows\System\XCgjjtj.exe
  2⤵
  PID:7136
- C:\Windows\System\ONEcAkT.exe
  C:\Windows\System\ONEcAkT.exe
  2⤵
  PID:7156
- C:\Windows\System\eNxMtJy.exe
  C:\Windows\System\eNxMtJy.exe
  2⤵
  PID:5644
- C:\Windows\System\VgPgpqe.exe
  C:\Windows\System\VgPgpqe.exe
  2⤵
  PID:3412
- C:\Windows\System\Kxfjebk.exe
  C:\Windows\System\Kxfjebk.exe
  2⤵
  PID:5704
- C:\Windows\System\HVRmZvi.exe
  C:\Windows\System\HVRmZvi.exe
  2⤵
  PID:2920
- C:\Windows\System\jYsDtXt.exe
  C:\Windows\System\jYsDtXt.exe
  2⤵
  PID:684
- C:\Windows\System\OIvcXyQ.exe
  C:\Windows\System\OIvcXyQ.exe
  2⤵
  PID:5852
- C:\Windows\System\IINjOwj.exe
  C:\Windows\System\IINjOwj.exe
  2⤵
  PID:2396
- C:\Windows\System\tjvzRQP.exe
  C:\Windows\System\tjvzRQP.exe
  2⤵
  PID:5212
- C:\Windows\System\CylspIC.exe
  C:\Windows\System\CylspIC.exe
  2⤵
  PID:6000
- C:\Windows\System\GRCAFOJ.exe
  C:\Windows\System\GRCAFOJ.exe
  2⤵
  PID:4820
- C:\Windows\System\ohMKczB.exe
  C:\Windows\System\ohMKczB.exe
  2⤵
  PID:5344
- C:\Windows\System\dQxqUvp.exe
  C:\Windows\System\dQxqUvp.exe
  2⤵
  PID:5364
- C:\Windows\System\fYueNct.exe
  C:\Windows\System\fYueNct.exe
  2⤵
  PID:3824
- C:\Windows\System\xKDdRwf.exe
  C:\Windows\System\xKDdRwf.exe
  2⤵
  PID:5436
- C:\Windows\System\DTNVjlv.exe
  C:\Windows\System\DTNVjlv.exe
  2⤵
  PID:2092
- C:\Windows\System\dYoEoHb.exe
  C:\Windows\System\dYoEoHb.exe
  2⤵
  PID:5032
- C:\Windows\System\fvpgVHW.exe
  C:\Windows\System\fvpgVHW.exe
  2⤵
  PID:5412
- C:\Windows\System\GQWfFST.exe
  C:\Windows\System\GQWfFST.exe
  2⤵
  PID:4944
- C:\Windows\System\gUwrbgP.exe
  C:\Windows\System\gUwrbgP.exe
  2⤵
  PID:2716
- C:\Windows\System\pyvBFZw.exe
  C:\Windows\System\pyvBFZw.exe
  2⤵
  PID:5600
- C:\Windows\System\NCSkqOl.exe
  C:\Windows\System\NCSkqOl.exe
  2⤵
  PID:7176
- C:\Windows\System\VaDZfgh.exe
  C:\Windows\System\VaDZfgh.exe
  2⤵
  PID:7196
- C:\Windows\System\DowzANt.exe
  C:\Windows\System\DowzANt.exe
  2⤵
  PID:7216
- C:\Windows\System\TyDGOqz.exe
  C:\Windows\System\TyDGOqz.exe
  2⤵
  PID:7236
- C:\Windows\System\QPKUGLz.exe
  C:\Windows\System\QPKUGLz.exe
  2⤵
  PID:7256
- C:\Windows\System\ZXTbhyi.exe
  C:\Windows\System\ZXTbhyi.exe
  2⤵
  PID:7284
- C:\Windows\System\NFRppiT.exe
  C:\Windows\System\NFRppiT.exe
  2⤵
  PID:7304
- C:\Windows\System\QWtUWoM.exe
  C:\Windows\System\QWtUWoM.exe
  2⤵
  PID:7328
- C:\Windows\System\LFkHpAx.exe
  C:\Windows\System\LFkHpAx.exe
  2⤵
  PID:7344
- C:\Windows\System\jUPYnkE.exe
  C:\Windows\System\jUPYnkE.exe
  2⤵
  PID:7364
- C:\Windows\System\BggQfyj.exe
  C:\Windows\System\BggQfyj.exe
  2⤵
  PID:7384
- C:\Windows\System\plVokRu.exe
  C:\Windows\System\plVokRu.exe
  2⤵
  PID:7404
- C:\Windows\System\aBiDcTd.exe
  C:\Windows\System\aBiDcTd.exe
  2⤵
  PID:7420
- C:\Windows\System\LgPhjUI.exe
  C:\Windows\System\LgPhjUI.exe
  2⤵
  PID:7440
- C:\Windows\System\LsMYIKT.exe
  C:\Windows\System\LsMYIKT.exe
  2⤵
  PID:7460
- C:\Windows\System\ozCvosW.exe
  C:\Windows\System\ozCvosW.exe
  2⤵
  PID:7492
- C:\Windows\System\MhHKqSn.exe
  C:\Windows\System\MhHKqSn.exe
  2⤵
  PID:7508
- C:\Windows\System\kINDvex.exe
  C:\Windows\System\kINDvex.exe
  2⤵
  PID:7524
- C:\Windows\System\PRAswQy.exe
  C:\Windows\System\PRAswQy.exe
  2⤵
  PID:7552
- C:\Windows\System\MemgkpP.exe
  C:\Windows\System\MemgkpP.exe
  2⤵
  PID:7572
- C:\Windows\System\aGUHGwG.exe
  C:\Windows\System\aGUHGwG.exe
  2⤵
  PID:7588
- C:\Windows\System\MssuDOn.exe
  C:\Windows\System\MssuDOn.exe
  2⤵
  PID:7608
- C:\Windows\System\gRshkZH.exe
  C:\Windows\System\gRshkZH.exe
  2⤵
  PID:7628
- C:\Windows\System\IdEAAjx.exe
  C:\Windows\System\IdEAAjx.exe
  2⤵
  PID:7648
- C:\Windows\System\pRSVQZF.exe
  C:\Windows\System\pRSVQZF.exe
  2⤵
  PID:7664
- C:\Windows\System\DAqgqMg.exe
  C:\Windows\System\DAqgqMg.exe
  2⤵
  PID:7688
- C:\Windows\System\BzVMrXA.exe
  C:\Windows\System\BzVMrXA.exe
  2⤵
  PID:7708
- C:\Windows\System\OHQeyDg.exe
  C:\Windows\System\OHQeyDg.exe
  2⤵
  PID:7724
- C:\Windows\System\TLFiyIv.exe
  C:\Windows\System\TLFiyIv.exe
  2⤵
  PID:7744
- C:\Windows\System\afNFiTG.exe
  C:\Windows\System\afNFiTG.exe
  2⤵
  PID:7764
- C:\Windows\System\FdGLlhr.exe
  C:\Windows\System\FdGLlhr.exe
  2⤵
  PID:7788
- C:\Windows\System\bmoKxXK.exe
  C:\Windows\System\bmoKxXK.exe
  2⤵
  PID:7808
- C:\Windows\System\nXWNpvD.exe
  C:\Windows\System\nXWNpvD.exe
  2⤵
  PID:7828
- C:\Windows\System\panrcvH.exe
  C:\Windows\System\panrcvH.exe
  2⤵
  PID:7848
- C:\Windows\System\VPwIPWs.exe
  C:\Windows\System\VPwIPWs.exe
  2⤵
  PID:7888
- C:\Windows\System\DQdpCiI.exe
  C:\Windows\System\DQdpCiI.exe
  2⤵
  PID:7912
- C:\Windows\System\CIuRRnK.exe
  C:\Windows\System\CIuRRnK.exe
  2⤵
  PID:7928
- C:\Windows\System\voNQgEu.exe
  C:\Windows\System\voNQgEu.exe
  2⤵
  PID:7956
- C:\Windows\System\OLTNuZh.exe
  C:\Windows\System\OLTNuZh.exe
  2⤵
  PID:7980
- C:\Windows\System\QslPUcu.exe
  C:\Windows\System\QslPUcu.exe
  2⤵
  PID:7996
- C:\Windows\System\erMwVGg.exe
  C:\Windows\System\erMwVGg.exe
  2⤵
  PID:8012
- C:\Windows\System\yYUIFBN.exe
  C:\Windows\System\yYUIFBN.exe
  2⤵
  PID:8032
- C:\Windows\System\LTIrfzi.exe
  C:\Windows\System\LTIrfzi.exe
  2⤵
  PID:8056
- C:\Windows\System\wtGFJEJ.exe
  C:\Windows\System\wtGFJEJ.exe
  2⤵
  PID:8076
- C:\Windows\System\nURwVXy.exe
  C:\Windows\System\nURwVXy.exe
  2⤵
  PID:8092
- C:\Windows\System\JCTmmOE.exe
  C:\Windows\System\JCTmmOE.exe
  2⤵
  PID:8116
- C:\Windows\System\hCdTMnU.exe
  C:\Windows\System\hCdTMnU.exe
  2⤵
  PID:8140
- C:\Windows\System\bcosBuH.exe
  C:\Windows\System\bcosBuH.exe
  2⤵
  PID:8156
- C:\Windows\System\OIjaqxg.exe
  C:\Windows\System\OIjaqxg.exe
  2⤵
  PID:8176
- C:\Windows\System\EUqnZoT.exe
  C:\Windows\System\EUqnZoT.exe
  2⤵
  PID:6316
- C:\Windows\System\YUIpHsh.exe
  C:\Windows\System\YUIpHsh.exe
  2⤵
  PID:5700
- C:\Windows\System\iAjKNUt.exe
  C:\Windows\System\iAjKNUt.exe
  2⤵
  PID:4004
- C:\Windows\System\FePGLKa.exe
  C:\Windows\System\FePGLKa.exe
  2⤵
  PID:3884
- C:\Windows\System\yfwNeZL.exe
  C:\Windows\System\yfwNeZL.exe
  2⤵
  PID:5872
- C:\Windows\System\nCRQeSb.exe
  C:\Windows\System\nCRQeSb.exe
  2⤵
  PID:6484
- C:\Windows\System\yVavUAn.exe
  C:\Windows\System\yVavUAn.exe
  2⤵
  PID:6532
- C:\Windows\System\AnpnBfO.exe
  C:\Windows\System\AnpnBfO.exe
  2⤵
  PID:5136
- C:\Windows\System\RVfYhZZ.exe
  C:\Windows\System\RVfYhZZ.exe
  2⤵
  PID:5172
- C:\Windows\System\MBSIAmq.exe
  C:\Windows\System\MBSIAmq.exe
  2⤵
  PID:5240
- C:\Windows\System\BADDLaa.exe
  C:\Windows\System\BADDLaa.exe
  2⤵
  PID:6052
- C:\Windows\System\HNxpmOa.exe
  C:\Windows\System\HNxpmOa.exe
  2⤵
  PID:6808
- C:\Windows\System\hORculg.exe
  C:\Windows\System\hORculg.exe
  2⤵
  PID:6828
- C:\Windows\System\pFHmDTN.exe
  C:\Windows\System\pFHmDTN.exe
  2⤵
  PID:6888
- C:\Windows\System\kjQtBxM.exe
  C:\Windows\System\kjQtBxM.exe
  2⤵
  PID:6136
- C:\Windows\System\pnprVPc.exe
  C:\Windows\System\pnprVPc.exe
  2⤵
  PID:2076
- C:\Windows\System\cgRtiPk.exe
  C:\Windows\System\cgRtiPk.exe
  2⤵
  PID:4176
- C:\Windows\System\taXyatR.exe
  C:\Windows\System\taXyatR.exe
  2⤵
  PID:7044
- C:\Windows\System\ebZoZpw.exe
  C:\Windows\System\ebZoZpw.exe
  2⤵
  PID:7112
- C:\Windows\System\CVfSUWD.exe
  C:\Windows\System\CVfSUWD.exe
  2⤵
  PID:1668
- C:\Windows\System\zsrqiSb.exe
  C:\Windows\System\zsrqiSb.exe
  2⤵
  PID:2180
- C:\Windows\System\YTBarhX.exe
  C:\Windows\System\YTBarhX.exe
  2⤵
  PID:6020
- C:\Windows\System\wARTTEZ.exe
  C:\Windows\System\wARTTEZ.exe
  2⤵
  PID:5320
- C:\Windows\System\AsWywSS.exe
  C:\Windows\System\AsWywSS.exe
  2⤵
  PID:8208
- C:\Windows\System\fAWTKmV.exe
  C:\Windows\System\fAWTKmV.exe
  2⤵
  PID:8224
- C:\Windows\System\JRfsPZp.exe
  C:\Windows\System\JRfsPZp.exe
  2⤵
  PID:8248
- C:\Windows\System\AfPjHXw.exe
  C:\Windows\System\AfPjHXw.exe
  2⤵
  PID:8268
- C:\Windows\System\pQoDkOY.exe
  C:\Windows\System\pQoDkOY.exe
  2⤵
  PID:8284
- C:\Windows\System\gkzPPYg.exe
  C:\Windows\System\gkzPPYg.exe
  2⤵
  PID:8308
- C:\Windows\System\YffcuaF.exe
  C:\Windows\System\YffcuaF.exe
  2⤵
  PID:8324
- C:\Windows\System\wWrVdpW.exe
  C:\Windows\System\wWrVdpW.exe
  2⤵
  PID:8340
- C:\Windows\System\ihkHQcO.exe
  C:\Windows\System\ihkHQcO.exe
  2⤵
  PID:8360
- C:\Windows\System\yvtFBBO.exe
  C:\Windows\System\yvtFBBO.exe
  2⤵
  PID:8376
- C:\Windows\System\hULZDAZ.exe
  C:\Windows\System\hULZDAZ.exe
  2⤵
  PID:8396
- C:\Windows\System\oOYvcRM.exe
  C:\Windows\System\oOYvcRM.exe
  2⤵
  PID:8416
- C:\Windows\System\hEiWOVr.exe
  C:\Windows\System\hEiWOVr.exe
  2⤵
  PID:8444
- C:\Windows\System\DWIISeM.exe
  C:\Windows\System\DWIISeM.exe
  2⤵
  PID:8460
- C:\Windows\System\kjcdznd.exe
  C:\Windows\System\kjcdznd.exe
  2⤵
  PID:8484
- C:\Windows\System\SVlfAMf.exe
  C:\Windows\System\SVlfAMf.exe
  2⤵
  PID:8508
- C:\Windows\System\cmMJOIr.exe
  C:\Windows\System\cmMJOIr.exe
  2⤵
  PID:8524
- C:\Windows\System\oBJhMPS.exe
  C:\Windows\System\oBJhMPS.exe
  2⤵
  PID:8548
- C:\Windows\System\lCIllaO.exe
  C:\Windows\System\lCIllaO.exe
  2⤵
  PID:8564
- C:\Windows\System\adeEDgX.exe
  C:\Windows\System\adeEDgX.exe
  2⤵
  PID:8588
- C:\Windows\System\TtbHCsh.exe
  C:\Windows\System\TtbHCsh.exe
  2⤵
  PID:8604
- C:\Windows\System\jgAhmNR.exe
  C:\Windows\System\jgAhmNR.exe
  2⤵
  PID:8620
- C:\Windows\System\hCOGxZv.exe
  C:\Windows\System\hCOGxZv.exe
  2⤵
  PID:8640
- C:\Windows\System\OcYyVet.exe
  C:\Windows\System\OcYyVet.exe
  2⤵
  PID:8660
- C:\Windows\System\jYPcNJO.exe
  C:\Windows\System\jYPcNJO.exe
  2⤵
  PID:8680
- C:\Windows\System\HcrPDMA.exe
  C:\Windows\System\HcrPDMA.exe
  2⤵
  PID:8704
- C:\Windows\System\hQERlnR.exe
  C:\Windows\System\hQERlnR.exe
  2⤵
  PID:8720
- C:\Windows\System\FxIXhtX.exe
  C:\Windows\System\FxIXhtX.exe
  2⤵
  PID:8736
- C:\Windows\System\NLmFBMu.exe
  C:\Windows\System\NLmFBMu.exe
  2⤵
  PID:8764
- C:\Windows\System\ZpzwOmu.exe
  C:\Windows\System\ZpzwOmu.exe
  2⤵
  PID:8788
- C:\Windows\System\BCmUFPa.exe
  C:\Windows\System\BCmUFPa.exe
  2⤵
  PID:8804
- C:\Windows\System\uNhRYAA.exe
  C:\Windows\System\uNhRYAA.exe
  2⤵
  PID:8836
- C:\Windows\System\xlKzPoi.exe
  C:\Windows\System\xlKzPoi.exe
  2⤵
  PID:8852
- C:\Windows\System\qCWViFX.exe
  C:\Windows\System\qCWViFX.exe
  2⤵
  PID:8872
- C:\Windows\System\zlRsILj.exe
  C:\Windows\System\zlRsILj.exe
  2⤵
  PID:8888
- C:\Windows\System\sQvzuBL.exe
  C:\Windows\System\sQvzuBL.exe
  2⤵
  PID:8912
- C:\Windows\System\BnQUQfT.exe
  C:\Windows\System\BnQUQfT.exe
  2⤵
  PID:8928
- C:\Windows\System\kVADRRE.exe
  C:\Windows\System\kVADRRE.exe
  2⤵
  PID:8956
- C:\Windows\System\NpxERns.exe
  C:\Windows\System\NpxERns.exe
  2⤵
  PID:8976
- C:\Windows\System\bPoofIL.exe
  C:\Windows\System\bPoofIL.exe
  2⤵
  PID:8992
- C:\Windows\System\kpbDlxW.exe
  C:\Windows\System\kpbDlxW.exe
  2⤵
  PID:9020
- C:\Windows\System\FWcyiXP.exe
  C:\Windows\System\FWcyiXP.exe
  2⤵
  PID:9044
- C:\Windows\System\kliBcIO.exe
  C:\Windows\System\kliBcIO.exe
  2⤵
  PID:9064
- C:\Windows\System\IXVWEFY.exe
  C:\Windows\System\IXVWEFY.exe
  2⤵
  PID:9080
- C:\Windows\System\qJcHBhM.exe
  C:\Windows\System\qJcHBhM.exe
  2⤵
  PID:9104
- C:\Windows\System\tZLBliI.exe
  C:\Windows\System\tZLBliI.exe
  2⤵
  PID:9120
- C:\Windows\System\DphdMOZ.exe
  C:\Windows\System\DphdMOZ.exe
  2⤵
  PID:9136
- C:\Windows\System\yEbxXhf.exe
  C:\Windows\System\yEbxXhf.exe
  2⤵
  PID:9152
- C:\Windows\System\YXcTNlN.exe
  C:\Windows\System\YXcTNlN.exe
  2⤵
  PID:9192
- C:\Windows\System\XPujkDM.exe
  C:\Windows\System\XPujkDM.exe
  2⤵
  PID:9208
- C:\Windows\System\VEfqvrg.exe
  C:\Windows\System\VEfqvrg.exe
  2⤵
  PID:5620
- C:\Windows\System\qKwbqxa.exe
  C:\Windows\System\qKwbqxa.exe
  2⤵
  PID:6220
- C:\Windows\System\qfHKuXT.exe
  C:\Windows\System\qfHKuXT.exe
  2⤵
  PID:1104
- C:\Windows\System\gtNzOXA.exe
  C:\Windows\System\gtNzOXA.exe
  2⤵
  PID:7232
- C:\Windows\System\YNBSPnQ.exe
  C:\Windows\System\YNBSPnQ.exe
  2⤵
  PID:7268
- C:\Windows\System\nOmyGdO.exe
  C:\Windows\System\nOmyGdO.exe
  2⤵
  PID:7360
- C:\Windows\System\JCxgNHz.exe
  C:\Windows\System\JCxgNHz.exe
  2⤵
  PID:7416
- C:\Windows\System\xaWVwUT.exe
  C:\Windows\System\xaWVwUT.exe
  2⤵
  PID:7452
- C:\Windows\System\vqvbLtA.exe
  C:\Windows\System\vqvbLtA.exe
  2⤵
  PID:5744
- C:\Windows\System\LslGoRd.exe
  C:\Windows\System\LslGoRd.exe
  2⤵
  PID:7540
- C:\Windows\System\aGXbFxb.exe
  C:\Windows\System\aGXbFxb.exe
  2⤵
  PID:7624
- C:\Windows\System\lZQrkya.exe
  C:\Windows\System\lZQrkya.exe
  2⤵
  PID:6456
- C:\Windows\System\zZboBiI.exe
  C:\Windows\System\zZboBiI.exe
  2⤵
  PID:5916
- C:\Windows\System\NvyPeLE.exe
  C:\Windows\System\NvyPeLE.exe
  2⤵
  PID:5948
- C:\Windows\System\YsoEyfx.exe
  C:\Windows\System\YsoEyfx.exe
  2⤵
  PID:5988
- C:\Windows\System\IQjbtwz.exe
  C:\Windows\System\IQjbtwz.exe
  2⤵
  PID:7948
- C:\Windows\System\sEGjmHV.exe
  C:\Windows\System\sEGjmHV.exe
  2⤵
  PID:7964
- C:\Windows\System\JjrTGnX.exe
  C:\Windows\System\JjrTGnX.exe
  2⤵
  PID:8536
- C:\Windows\System\SCobGKD.exe
  C:\Windows\System\SCobGKD.exe
  2⤵
  PID:7316
- C:\Windows\System\smtjkOh.exe
  C:\Windows\System\smtjkOh.exe
  2⤵
  PID:7340
- C:\Windows\System\IrIhTnk.exe
  C:\Windows\System\IrIhTnk.exe
  2⤵
  PID:7412
- C:\Windows\System\EGuuQwJ.exe
  C:\Windows\System\EGuuQwJ.exe
  2⤵
  PID:2460
- C:\Windows\System\NLOlcif.exe
  C:\Windows\System\NLOlcif.exe
  2⤵
  PID:6412
- C:\Windows\System\FlUkClw.exe
  C:\Windows\System\FlUkClw.exe
  2⤵
  PID:7620
- C:\Windows\System\LAGALDI.exe
  C:\Windows\System\LAGALDI.exe
  2⤵
  PID:6536
- C:\Windows\System\mRkrnCx.exe
  C:\Windows\System\mRkrnCx.exe
  2⤵
  PID:6584
- C:\Windows\System\iZCidug.exe
  C:\Windows\System\iZCidug.exe
  2⤵
  PID:8132
- C:\Windows\System\ysNgWRQ.exe
  C:\Windows\System\ysNgWRQ.exe
  2⤵
  PID:8188
- C:\Windows\System\VUbpHFf.exe
  C:\Windows\System\VUbpHFf.exe
  2⤵
  PID:3344
- C:\Windows\System\kyfxJok.exe
  C:\Windows\System\kyfxJok.exe
  2⤵
  PID:5860
- C:\Windows\System\iJAjKmU.exe
  C:\Windows\System\iJAjKmU.exe
  2⤵
  PID:6516
- C:\Windows\System\nZvfNgt.exe
  C:\Windows\System\nZvfNgt.exe
  2⤵
  PID:6568
- C:\Windows\System\uJbLcUj.exe
  C:\Windows\System\uJbLcUj.exe
  2⤵
  PID:5996
- C:\Windows\System\RJXxItD.exe
  C:\Windows\System\RJXxItD.exe
  2⤵
  PID:6104
- C:\Windows\System\oeWIilN.exe
  C:\Windows\System\oeWIilN.exe
  2⤵
  PID:6912
- C:\Windows\System\MdBHkyn.exe
  C:\Windows\System\MdBHkyn.exe
  2⤵
  PID:4996
- C:\Windows\System\eixqlhT.exe
  C:\Windows\System\eixqlhT.exe
  2⤵
  PID:5404
- C:\Windows\System\pjkdjXT.exe
  C:\Windows\System\pjkdjXT.exe
  2⤵
  PID:4524
- C:\Windows\System\WrRmKrU.exe
  C:\Windows\System\WrRmKrU.exe
  2⤵
  PID:5304
- C:\Windows\System\qBNnRdy.exe
  C:\Windows\System\qBNnRdy.exe
  2⤵
  PID:8220
- C:\Windows\System\sqQNwqG.exe
  C:\Windows\System\sqQNwqG.exe
  2⤵
  PID:8264
- C:\Windows\System\pxRVTGK.exe
  C:\Windows\System\pxRVTGK.exe
  2⤵
  PID:8300
- C:\Windows\System\WyJZtyP.exe
  C:\Windows\System\WyJZtyP.exe
  2⤵
  PID:8336
- C:\Windows\System\XceixvI.exe
  C:\Windows\System\XceixvI.exe
  2⤵
  PID:8372
- C:\Windows\System\qNooxOv.exe
  C:\Windows\System\qNooxOv.exe
  2⤵
  PID:8408
- C:\Windows\System\UKytObN.exe
  C:\Windows\System\UKytObN.exe
  2⤵
  PID:2012
- C:\Windows\System\Pjcvrxq.exe
  C:\Windows\System\Pjcvrxq.exe
  2⤵
  PID:2988
- C:\Windows\System\UgHnjSV.exe
  C:\Windows\System\UgHnjSV.exe
  2⤵
  PID:8480
- C:\Windows\System\KAzkzvn.exe
  C:\Windows\System\KAzkzvn.exe
  2⤵
  PID:8520
- C:\Windows\System\iGuYnLG.exe
  C:\Windows\System\iGuYnLG.exe
  2⤵
  PID:8556
- C:\Windows\System\EAlgLrc.exe
  C:\Windows\System\EAlgLrc.exe
  2⤵
  PID:8600
- C:\Windows\System\uBRaJzb.exe
  C:\Windows\System\uBRaJzb.exe
  2⤵
  PID:8632
- C:\Windows\System\fIQAyZp.exe
  C:\Windows\System\fIQAyZp.exe
  2⤵
  PID:8672
- C:\Windows\System\XDYujVx.exe
  C:\Windows\System\XDYujVx.exe
  2⤵
  PID:8696
- C:\Windows\System\bvHvlwO.exe
  C:\Windows\System\bvHvlwO.exe
  2⤵
  PID:8776
- C:\Windows\System\mYoIbAv.exe
  C:\Windows\System\mYoIbAv.exe
  2⤵
  PID:8828
- C:\Windows\System\fUiLQiW.exe
  C:\Windows\System\fUiLQiW.exe
  2⤵
  PID:8880
- C:\Windows\System\hKPhsfj.exe
  C:\Windows\System\hKPhsfj.exe
  2⤵
  PID:8908
- C:\Windows\System\APANbBt.exe
  C:\Windows\System\APANbBt.exe
  2⤵
  PID:8984
- C:\Windows\System\nwKqeDP.exe
  C:\Windows\System\nwKqeDP.exe
  2⤵
  PID:9056
- C:\Windows\System\xADvZYr.exe
  C:\Windows\System\xADvZYr.exe
  2⤵
  PID:9116
- C:\Windows\System\aUqKDsR.exe
  C:\Windows\System\aUqKDsR.exe
  2⤵
  PID:9148
- C:\Windows\System\kwogozf.exe
  C:\Windows\System\kwogozf.exe
  2⤵
  PID:4528
- C:\Windows\System\nVfzqrT.exe
  C:\Windows\System\nVfzqrT.exe
  2⤵
  PID:6272
- C:\Windows\System\phdtrWM.exe
  C:\Windows\System\phdtrWM.exe
  2⤵
  PID:5696
- C:\Windows\System\OYoTwVW.exe
  C:\Windows\System\OYoTwVW.exe
  2⤵
  PID:7584
- C:\Windows\System\STAzVol.exe
  C:\Windows\System\STAzVol.exe
  2⤵
  PID:7644
- C:\Windows\System\nZihvTj.exe
  C:\Windows\System\nZihvTj.exe
  2⤵
  PID:6756
- C:\Windows\System\YttNPAn.exe
  C:\Windows\System\YttNPAn.exe
  2⤵
  PID:9228
- C:\Windows\System\qldWhYf.exe
  C:\Windows\System\qldWhYf.exe
  2⤵
  PID:9252
- C:\Windows\System\shBjLqk.exe
  C:\Windows\System\shBjLqk.exe
  2⤵
  PID:9276
- C:\Windows\System\fGSVmyw.exe
  C:\Windows\System\fGSVmyw.exe
  2⤵
  PID:9308
- C:\Windows\System\EWLlEYC.exe
  C:\Windows\System\EWLlEYC.exe
  2⤵
  PID:9348
- C:\Windows\System\SDoFyje.exe
  C:\Windows\System\SDoFyje.exe
  2⤵
  PID:9376
- C:\Windows\System\QeVZnSw.exe
  C:\Windows\System\QeVZnSw.exe
  2⤵
  PID:9416
- C:\Windows\System\zAGuhgo.exe
  C:\Windows\System\zAGuhgo.exe
  2⤵
  PID:9440
- C:\Windows\System\hZsatTu.exe
  C:\Windows\System\hZsatTu.exe
  2⤵
  PID:9460
- C:\Windows\System\QHjnHKf.exe
  C:\Windows\System\QHjnHKf.exe
  2⤵
  PID:9484
- C:\Windows\System\wurUYob.exe
  C:\Windows\System\wurUYob.exe
  2⤵
  PID:9512
- C:\Windows\System\bsLaogR.exe
  C:\Windows\System\bsLaogR.exe
  2⤵
  PID:9544
- C:\Windows\System\zzKoVJA.exe
  C:\Windows\System\zzKoVJA.exe
  2⤵
  PID:9572
- C:\Windows\System\ErtbIQC.exe
  C:\Windows\System\ErtbIQC.exe
  2⤵
  PID:9608
- C:\Windows\System\gbrjZjH.exe
  C:\Windows\System\gbrjZjH.exe
  2⤵
  PID:9636
- C:\Windows\System\pgatAwu.exe
  C:\Windows\System\pgatAwu.exe
  2⤵
  PID:9660
- C:\Windows\System\oRstfez.exe
  C:\Windows\System\oRstfez.exe
  2⤵
  PID:9680
- C:\Windows\System\IvIlcjj.exe
  C:\Windows\System\IvIlcjj.exe
  2⤵
  PID:9704
- C:\Windows\System\jBRNdzj.exe
  C:\Windows\System\jBRNdzj.exe
  2⤵
  PID:9728
- C:\Windows\System\VrtHbym.exe
  C:\Windows\System\VrtHbym.exe
  2⤵
  PID:9760
- C:\Windows\System\kBqWCJJ.exe
  C:\Windows\System\kBqWCJJ.exe
  2⤵
  PID:9780
- C:\Windows\System\lzeOSFn.exe
  C:\Windows\System\lzeOSFn.exe
  2⤵
  PID:9808
- C:\Windows\System\lkZaVBa.exe
  C:\Windows\System\lkZaVBa.exe
  2⤵
  PID:9824
- C:\Windows\System\BwjffMm.exe
  C:\Windows\System\BwjffMm.exe
  2⤵
  PID:9848
- C:\Windows\System\nVtRaRO.exe
  C:\Windows\System\nVtRaRO.exe
  2⤵
  PID:9876
- C:\Windows\System\aAWokHM.exe
  C:\Windows\System\aAWokHM.exe
  2⤵
  PID:9908
- C:\Windows\System\zYoMHvH.exe
  C:\Windows\System\zYoMHvH.exe
  2⤵
  PID:9928
- C:\Windows\System\vgQQtep.exe
  C:\Windows\System\vgQQtep.exe
  2⤵
  PID:9952
- C:\Windows\System\uefnJtn.exe
  C:\Windows\System\uefnJtn.exe
  2⤵
  PID:9976
- C:\Windows\System\lkyzIIz.exe
  C:\Windows\System\lkyzIIz.exe
  2⤵
  PID:9996
- C:\Windows\System\juZhBwg.exe
  C:\Windows\System\juZhBwg.exe
  2⤵
  PID:10016
- C:\Windows\System\EkuAEDT.exe
  C:\Windows\System\EkuAEDT.exe
  2⤵
  PID:10040
- C:\Windows\System\qJzRdLF.exe
  C:\Windows\System\qJzRdLF.exe
  2⤵
  PID:10064
- C:\Windows\System\rYRtjnP.exe
  C:\Windows\System\rYRtjnP.exe
  2⤵
  PID:10100
- C:\Windows\System\xDomkcI.exe
  C:\Windows\System\xDomkcI.exe
  2⤵
  PID:10120
- C:\Windows\System\bBWzHHk.exe
  C:\Windows\System\bBWzHHk.exe
  2⤵
  PID:10144
- C:\Windows\System\LCRrEVs.exe
  C:\Windows\System\LCRrEVs.exe
  2⤵
  PID:10172
- C:\Windows\System\WkecZMi.exe
  C:\Windows\System\WkecZMi.exe
  2⤵
  PID:10192
- C:\Windows\System\QjzMgdw.exe
  C:\Windows\System\QjzMgdw.exe
  2⤵
  PID:10216
- C:\Windows\System\VjuCuDJ.exe
  C:\Windows\System\VjuCuDJ.exe
  2⤵
  PID:10248
- C:\Windows\System\IUYcXmB.exe
  C:\Windows\System\IUYcXmB.exe
  2⤵
  PID:10272
- C:\Windows\System\OlcbRJJ.exe
  C:\Windows\System\OlcbRJJ.exe
  2⤵
  PID:10300
- C:\Windows\System\YjIKNUd.exe
  C:\Windows\System\YjIKNUd.exe
  2⤵
  PID:10332
- C:\Windows\System\QsyRbtw.exe
  C:\Windows\System\QsyRbtw.exe
  2⤵
  PID:10352
- C:\Windows\System\hgxmAtF.exe
  C:\Windows\System\hgxmAtF.exe
  2⤵
  PID:10376
- C:\Windows\System\GvYeTGi.exe
  C:\Windows\System\GvYeTGi.exe
  2⤵
  PID:10396
- C:\Windows\System\alBYtRi.exe
  C:\Windows\System\alBYtRi.exe
  2⤵
  PID:10424
- C:\Windows\System\MWMPLVl.exe
  C:\Windows\System\MWMPLVl.exe
  2⤵
  PID:10444
- C:\Windows\System\DtRxnku.exe
  C:\Windows\System\DtRxnku.exe
  2⤵
  PID:10460
- C:\Windows\System\LRJmsdr.exe
  C:\Windows\System\LRJmsdr.exe
  2⤵
  PID:10484
- C:\Windows\System\QiAYHLB.exe
  C:\Windows\System\QiAYHLB.exe
  2⤵
  PID:10508
- C:\Windows\System\CZHfceT.exe
  C:\Windows\System\CZHfceT.exe
  2⤵
  PID:10536
- C:\Windows\System\ejiwRns.exe
  C:\Windows\System\ejiwRns.exe
  2⤵
  PID:10552
- C:\Windows\System\OcDNauv.exe
  C:\Windows\System\OcDNauv.exe
  2⤵
  PID:10572
- C:\Windows\System\rwqTcKw.exe
  C:\Windows\System\rwqTcKw.exe
  2⤵
  PID:10588
- C:\Windows\System\KdGaVrZ.exe
  C:\Windows\System\KdGaVrZ.exe
  2⤵
  PID:10608
- C:\Windows\System\kWYtler.exe
  C:\Windows\System\kWYtler.exe
  2⤵
  PID:10628
- C:\Windows\System\VoNgsXy.exe
  C:\Windows\System\VoNgsXy.exe
  2⤵
  PID:10644
- C:\Windows\System\omkncbb.exe
  C:\Windows\System\omkncbb.exe
  2⤵
  PID:10660
- C:\Windows\System\opvfJvf.exe
  C:\Windows\System\opvfJvf.exe
  2⤵
  PID:10680
- C:\Windows\System\YuPytxj.exe
  C:\Windows\System\YuPytxj.exe
  2⤵
  PID:10696
- C:\Windows\System\SZafWPP.exe
  C:\Windows\System\SZafWPP.exe
  2⤵
  PID:10712
- C:\Windows\System\wTMcVnr.exe
  C:\Windows\System\wTMcVnr.exe
  2⤵
  PID:10728
- C:\Windows\System\tOvlRXR.exe
  C:\Windows\System\tOvlRXR.exe
  2⤵
  PID:10744
- C:\Windows\System\SXodLSu.exe
  C:\Windows\System\SXodLSu.exe
  2⤵
  PID:10760
- C:\Windows\System\oWgXllD.exe
  C:\Windows\System\oWgXllD.exe
  2⤵
  PID:10776
- C:\Windows\System\mtyMScA.exe
  C:\Windows\System\mtyMScA.exe
  2⤵
  PID:10796
- C:\Windows\System\vaNRXlI.exe
  C:\Windows\System\vaNRXlI.exe
  2⤵
  PID:10816
- C:\Windows\System\xcdiEzS.exe
  C:\Windows\System\xcdiEzS.exe
  2⤵
  PID:10832
- C:\Windows\System\KiGjApQ.exe
  C:\Windows\System\KiGjApQ.exe
  2⤵
  PID:10848
- C:\Windows\System\DVybQXO.exe
  C:\Windows\System\DVybQXO.exe
  2⤵
  PID:10868
- C:\Windows\System\cYEvvGA.exe
  C:\Windows\System\cYEvvGA.exe
  2⤵
  PID:10888
- C:\Windows\System\bFjUSKt.exe
  C:\Windows\System\bFjUSKt.exe
  2⤵
  PID:10908
- C:\Windows\System\AsNkQbb.exe
  C:\Windows\System\AsNkQbb.exe
  2⤵
  PID:10924
- C:\Windows\System\fkSWRnT.exe
  C:\Windows\System\fkSWRnT.exe
  2⤵
  PID:10944
- C:\Windows\System\LWqmOxY.exe
  C:\Windows\System\LWqmOxY.exe
  2⤵
  PID:10960
- C:\Windows\System\SsDHbVd.exe
  C:\Windows\System\SsDHbVd.exe
  2⤵
  PID:10976
- C:\Windows\System\QaKryiO.exe
  C:\Windows\System\QaKryiO.exe
  2⤵
  PID:10996
- C:\Windows\System\EjQzTBT.exe
  C:\Windows\System\EjQzTBT.exe
  2⤵
  PID:11016
- C:\Windows\System\NMdhNVB.exe
  C:\Windows\System\NMdhNVB.exe
  2⤵
  PID:11032
- C:\Windows\System\PaWKcdP.exe
  C:\Windows\System\PaWKcdP.exe
  2⤵
  PID:11056
- C:\Windows\System\bBsveoY.exe
  C:\Windows\System\bBsveoY.exe
  2⤵
  PID:11072
- C:\Windows\System\QRQMkLV.exe
  C:\Windows\System\QRQMkLV.exe
  2⤵
  PID:11092
- C:\Windows\System\wrlOHQJ.exe
  C:\Windows\System\wrlOHQJ.exe
  2⤵
  PID:11112
- C:\Windows\System\tDOFmqQ.exe
  C:\Windows\System\tDOFmqQ.exe
  2⤵
  PID:11128
- C:\Windows\System\dwsWJhF.exe
  C:\Windows\System\dwsWJhF.exe
  2⤵
  PID:11148
- C:\Windows\System\GDTtcdV.exe
  C:\Windows\System\GDTtcdV.exe
  2⤵
  PID:11168
- C:\Windows\System\nBhsTlH.exe
  C:\Windows\System\nBhsTlH.exe
  2⤵
  PID:11184
- C:\Windows\System\kgNNouS.exe
  C:\Windows\System\kgNNouS.exe
  2⤵
  PID:11204
- C:\Windows\System\QclCQtT.exe
  C:\Windows\System\QclCQtT.exe
  2⤵
  PID:11220
- C:\Windows\System\lxMGeft.exe
  C:\Windows\System\lxMGeft.exe
  2⤵
  PID:11240
- C:\Windows\System\dybexpJ.exe
  C:\Windows\System\dybexpJ.exe
  2⤵
  PID:11260
- C:\Windows\System\FQQCghN.exe
  C:\Windows\System\FQQCghN.exe
  2⤵
  PID:11280
- C:\Windows\System\iHIdMFd.exe
  C:\Windows\System\iHIdMFd.exe
  2⤵
  PID:11300
- C:\Windows\System\fpyCcLp.exe
  C:\Windows\System\fpyCcLp.exe
  2⤵
  PID:11316
- C:\Windows\System\QEDXtqV.exe
  C:\Windows\System\QEDXtqV.exe
  2⤵
  PID:11336
- C:\Windows\System\STbNkWH.exe
  C:\Windows\System\STbNkWH.exe
  2⤵
  PID:11356
- C:\Windows\System\ZZvgofO.exe
  C:\Windows\System\ZZvgofO.exe
  2⤵
  PID:11372
- C:\Windows\System\nMcoUTb.exe
  C:\Windows\System\nMcoUTb.exe
  2⤵
  PID:11392
- C:\Windows\System\SQmDojT.exe
  C:\Windows\System\SQmDojT.exe
  2⤵
  PID:11412
- C:\Windows\System\KeKPHuS.exe
  C:\Windows\System\KeKPHuS.exe
  2⤵
  PID:11432
- C:\Windows\System\BuhXKLq.exe
  C:\Windows\System\BuhXKLq.exe
  2⤵
  PID:11452
- C:\Windows\System\MAHsbVe.exe
  C:\Windows\System\MAHsbVe.exe
  2⤵
  PID:11468
- C:\Windows\System\WPepxGd.exe
  C:\Windows\System\WPepxGd.exe
  2⤵
  PID:11488
- C:\Windows\System\sRzEGXY.exe
  C:\Windows\System\sRzEGXY.exe
  2⤵
  PID:11508
- C:\Windows\System\vIvceqP.exe
  C:\Windows\System\vIvceqP.exe
  2⤵
  PID:11524
- C:\Windows\System\xszQUrb.exe
  C:\Windows\System\xszQUrb.exe
  2⤵
  PID:11544
- C:\Windows\System\lYAKgcD.exe
  C:\Windows\System\lYAKgcD.exe
  2⤵
  PID:11560
- C:\Windows\System\blQmGXi.exe
  C:\Windows\System\blQmGXi.exe
  2⤵
  PID:11576
- C:\Windows\System\bzwEDaz.exe
  C:\Windows\System\bzwEDaz.exe
  2⤵
  PID:11600
- C:\Windows\System\IJMQvTx.exe
  C:\Windows\System\IJMQvTx.exe
  2⤵
  PID:11616
- C:\Windows\System\OweDPVC.exe
  C:\Windows\System\OweDPVC.exe
  2⤵
  PID:11636
- C:\Windows\System\oWJGLAh.exe
  C:\Windows\System\oWJGLAh.exe
  2⤵
  PID:11652
- C:\Windows\System\xLfYGUe.exe
  C:\Windows\System\xLfYGUe.exe
  2⤵
  PID:11672
- C:\Windows\System\SCekrsj.exe
  C:\Windows\System\SCekrsj.exe
  2⤵
  PID:11704
- C:\Windows\System\bJwPkkI.exe
  C:\Windows\System\bJwPkkI.exe
  2⤵
  PID:11720
- C:\Windows\System\RkeqsIt.exe
  C:\Windows\System\RkeqsIt.exe
  2⤵
  PID:11740
- C:\Windows\System\KFdtxeI.exe
  C:\Windows\System\KFdtxeI.exe
  2⤵
  PID:11756
- C:\Windows\System\RVLNMRn.exe
  C:\Windows\System\RVLNMRn.exe
  2⤵
  PID:11784
- C:\Windows\System\UGDQBmp.exe
  C:\Windows\System\UGDQBmp.exe
  2⤵
  PID:11800
- C:\Windows\System\KjTXCCP.exe
  C:\Windows\System\KjTXCCP.exe
  2⤵
  PID:11820
- C:\Windows\System\RGINvdi.exe
  C:\Windows\System\RGINvdi.exe
  2⤵
  PID:11840
- C:\Windows\System\jtxZRLz.exe
  C:\Windows\System\jtxZRLz.exe
  2⤵
  PID:11860
- C:\Windows\System\OtWjztU.exe
  C:\Windows\System\OtWjztU.exe
  2⤵
  PID:11880
- C:\Windows\System\ghGSNSp.exe
  C:\Windows\System\ghGSNSp.exe
  2⤵
  PID:11900
- C:\Windows\System\Flcvcdc.exe
  C:\Windows\System\Flcvcdc.exe
  2⤵
  PID:11916
- C:\Windows\System\rxrNwPW.exe
  C:\Windows\System\rxrNwPW.exe
  2⤵
  PID:11936
- C:\Windows\System\WJxmlLd.exe
  C:\Windows\System\WJxmlLd.exe
  2⤵
  PID:11952
- C:\Windows\System\udFVmuj.exe
  C:\Windows\System\udFVmuj.exe
  2⤵
  PID:12380
- C:\Windows\System\SIQfPeB.exe
  C:\Windows\System\SIQfPeB.exe
  2⤵
  PID:12400
- C:\Windows\System\RncbLNO.exe
  C:\Windows\System\RncbLNO.exe
  2⤵
  PID:12416
- C:\Windows\System\hRKJBtW.exe
  C:\Windows\System\hRKJBtW.exe
  2⤵
  PID:12436
- C:\Windows\System\Kvmmpgs.exe
  C:\Windows\System\Kvmmpgs.exe
  2⤵
  PID:12456
- C:\Windows\System\sMGmdlX.exe
  C:\Windows\System\sMGmdlX.exe
  2⤵
  PID:12472
- C:\Windows\System\EUKxYWo.exe
  C:\Windows\System\EUKxYWo.exe
  2⤵
  PID:12492
- C:\Windows\System\xReDOHI.exe
  C:\Windows\System\xReDOHI.exe
  2⤵
  PID:12508
- C:\Windows\System\UMqCeaw.exe
  C:\Windows\System\UMqCeaw.exe
  2⤵
  PID:12528
- C:\Windows\System\jGAXwIX.exe
  C:\Windows\System\jGAXwIX.exe
  2⤵
  PID:12544
- C:\Windows\System\ijGCzKG.exe
  C:\Windows\System\ijGCzKG.exe
  2⤵
  PID:12560
- C:\Windows\System\BnriAfs.exe
  C:\Windows\System\BnriAfs.exe
  2⤵
  PID:12576
- C:\Windows\System\Qiggaoq.exe
  C:\Windows\System\Qiggaoq.exe
  2⤵
  PID:12592
- C:\Windows\System\KYqLwQf.exe
  C:\Windows\System\KYqLwQf.exe
  2⤵
  PID:12608
- C:\Windows\System\mDFHVcc.exe
  C:\Windows\System\mDFHVcc.exe
  2⤵
  PID:12624
- C:\Windows\System\sZkoHpf.exe
  C:\Windows\System\sZkoHpf.exe
  2⤵
  PID:12640
- C:\Windows\System\bSYPoSv.exe
  C:\Windows\System\bSYPoSv.exe
  2⤵
  PID:12656
- C:\Windows\System\iMwehVv.exe
  C:\Windows\System\iMwehVv.exe
  2⤵
  PID:12672
- C:\Windows\System\dukBkWW.exe
  C:\Windows\System\dukBkWW.exe
  2⤵
  PID:12688
- C:\Windows\System\UrEVjvB.exe
  C:\Windows\System\UrEVjvB.exe
  2⤵
  PID:12708
- C:\Windows\System\RivfrSP.exe
  C:\Windows\System\RivfrSP.exe
  2⤵
  PID:12728
- C:\Windows\System\YtYRLes.exe
  C:\Windows\System\YtYRLes.exe
  2⤵
  PID:12744
- C:\Windows\System\MBPFCKA.exe
  C:\Windows\System\MBPFCKA.exe
  2⤵
  PID:12768
- C:\Windows\System\toorgSL.exe
  C:\Windows\System\toorgSL.exe
  2⤵
  PID:12788
- C:\Windows\System\iTAVyMW.exe
  C:\Windows\System\iTAVyMW.exe
  2⤵
  PID:12808
- C:\Windows\System\MEJGuXo.exe
  C:\Windows\System\MEJGuXo.exe
  2⤵
  PID:12828
- C:\Windows\System\KvOfuPR.exe
  C:\Windows\System\KvOfuPR.exe
  2⤵
  PID:12844
- C:\Windows\System\UPZwdRe.exe
  C:\Windows\System\UPZwdRe.exe
  2⤵
  PID:12860
- C:\Windows\System\sLZTYQi.exe
  C:\Windows\System\sLZTYQi.exe
  2⤵
  PID:12884
- C:\Windows\System\SwxTzWq.exe
  C:\Windows\System\SwxTzWq.exe
  2⤵
  PID:12904
- C:\Windows\System\qnanzja.exe
  C:\Windows\System\qnanzja.exe
  2⤵
  PID:12920
- C:\Windows\System\fppAMJT.exe
  C:\Windows\System\fppAMJT.exe
  2⤵
  PID:12940
- C:\Windows\System\lkmJPKV.exe
  C:\Windows\System\lkmJPKV.exe
  2⤵
  PID:12960
- C:\Windows\System\vzhZnlE.exe
  C:\Windows\System\vzhZnlE.exe
  2⤵
  PID:12980
- C:\Windows\System\aiUUSqx.exe
  C:\Windows\System\aiUUSqx.exe
  2⤵
  PID:12996
- C:\Windows\System\ejJHhDH.exe
  C:\Windows\System\ejJHhDH.exe
  2⤵
  PID:13016
- C:\Windows\System\sTMdHLC.exe
  C:\Windows\System\sTMdHLC.exe
  2⤵
  PID:13036
- C:\Windows\System\ubadDLf.exe
  C:\Windows\System\ubadDLf.exe
  2⤵
  PID:13056
- C:\Windows\System\ZIWIJmg.exe
  C:\Windows\System\ZIWIJmg.exe
  2⤵
  PID:13076
- C:\Windows\System\uxnNqUk.exe
  C:\Windows\System\uxnNqUk.exe
  2⤵
  PID:13092
- C:\Windows\System\RZEEweY.exe
  C:\Windows\System\RZEEweY.exe
  2⤵
  PID:13116
- C:\Windows\System\wZWOEGA.exe
  C:\Windows\System\wZWOEGA.exe
  2⤵
  PID:13132
- C:\Windows\System\WWgPZar.exe
  C:\Windows\System\WWgPZar.exe
  2⤵
  PID:13152
- C:\Windows\System\IHgwvRT.exe
  C:\Windows\System\IHgwvRT.exe
  2⤵
  PID:13172
- C:\Windows\System\dbLYKsV.exe
  C:\Windows\System\dbLYKsV.exe
  2⤵
  PID:13192
- C:\Windows\System\RPUCGIs.exe
  C:\Windows\System\RPUCGIs.exe
  2⤵
  PID:13208
- C:\Windows\System\hkiYhPc.exe
  C:\Windows\System\hkiYhPc.exe
  2⤵
  PID:13224
- C:\Windows\System\bfCUEQd.exe
  C:\Windows\System\bfCUEQd.exe
  2⤵
  PID:13240
- C:\Windows\System\nWfzuef.exe
  C:\Windows\System\nWfzuef.exe
  2⤵
  PID:13260
- C:\Windows\System\ozucXXd.exe
  C:\Windows\System\ozucXXd.exe
  2⤵
  PID:13276
- C:\Windows\System\vQsawxn.exe
  C:\Windows\System\vQsawxn.exe
  2⤵
  PID:13296
- C:\Windows\System\yMdqkMa.exe
  C:\Windows\System\yMdqkMa.exe
  2⤵
  PID:8676
- C:\Windows\System\rGYHkfJ.exe
  C:\Windows\System\rGYHkfJ.exe
  2⤵
  PID:5516
- C:\Windows\System\PNOYbnp.exe
  C:\Windows\System\PNOYbnp.exe
  2⤵
  PID:13728
- C:\Windows\System\mUgbhep.exe
  C:\Windows\System\mUgbhep.exe
  2⤵
  PID:14056
- C:\Windows\System\BbDlgjL.exe
  C:\Windows\System\BbDlgjL.exe
  2⤵
  PID:14072
- C:\Windows\System\hHKchbE.exe
  C:\Windows\System\hHKchbE.exe
  2⤵
  PID:14088
- C:\Windows\System\qAWvMcD.exe
  C:\Windows\System\qAWvMcD.exe
  2⤵
  PID:14104
- C:\Windows\System\zYRqYNa.exe
  C:\Windows\System\zYRqYNa.exe
  2⤵
  PID:14124
- C:\Windows\System\nfraUid.exe
  C:\Windows\System\nfraUid.exe
  2⤵
  PID:14144
- C:\Windows\System\CTGpSFj.exe
  C:\Windows\System\CTGpSFj.exe
  2⤵
  PID:14164
- C:\Windows\System\rxRUPVb.exe
  C:\Windows\System\rxRUPVb.exe
  2⤵
  PID:14184
- C:\Windows\System\eHBUTQP.exe
  C:\Windows\System\eHBUTQP.exe
  2⤵
  PID:14204
- C:\Windows\System\JrrjyEf.exe
  C:\Windows\System\JrrjyEf.exe
  2⤵
  PID:14224
- C:\Windows\System\mZyCHGq.exe
  C:\Windows\System\mZyCHGq.exe
  2⤵
  PID:14248
- C:\Windows\System\GUADyLQ.exe
  C:\Windows\System\GUADyLQ.exe
  2⤵
  PID:14272
- C:\Windows\System\bVVDgAc.exe
  C:\Windows\System\bVVDgAc.exe
  2⤵
  PID:14292
- C:\Windows\System\yYUarNg.exe
  C:\Windows\System\yYUarNg.exe
  2⤵
  PID:14308
- C:\Windows\System\EMgqkXF.exe
  C:\Windows\System\EMgqkXF.exe
  2⤵
  PID:10532
- C:\Windows\System\mHzkYvM.exe
  C:\Windows\System\mHzkYvM.exe
  2⤵
  PID:3604
- C:\Windows\System\wOolmJB.exe
  C:\Windows\System\wOolmJB.exe
  2⤵
  PID:11028
- C:\Windows\System\Hqamtpo.exe
  C:\Windows\System\Hqamtpo.exe
  2⤵
  PID:11200
- C:\Windows\System\ASHbime.exe
  C:\Windows\System\ASHbime.exe
  2⤵
  PID:11256
- C:\Windows\System\TKdiZKh.exe
  C:\Windows\System\TKdiZKh.exe
  2⤵
  PID:11324
- C:\Windows\System\eHBGFUX.exe
  C:\Windows\System\eHBGFUX.exe
  2⤵
  PID:4536
- C:\Windows\System\JYbpVHI.exe
  C:\Windows\System\JYbpVHI.exe
  2⤵
  PID:3524
- C:\Windows\System\baquLAc.exe
  C:\Windows\System\baquLAc.exe
  2⤵
  PID:11632
- C:\Windows\System\yDGJGqD.exe
  C:\Windows\System\yDGJGqD.exe
  2⤵
  PID:11836
- C:\Windows\System\SDBaJqJ.exe
  C:\Windows\System\SDBaJqJ.exe
  2⤵
  PID:8440
- C:\Windows\System\FnzWtPi.exe
  C:\Windows\System\FnzWtPi.exe
  2⤵
  PID:8544
- C:\Windows\System\MrAwWFT.exe
  C:\Windows\System\MrAwWFT.exe
  2⤵
  PID:11516
- C:\Windows\System\oOOTmoY.exe
  C:\Windows\System\oOOTmoY.exe
  2⤵
  PID:11440
- C:\Windows\System\hMoWNpP.exe
  C:\Windows\System\hMoWNpP.exe
  2⤵
  PID:11364
- C:\Windows\System\wYCyoRv.exe
  C:\Windows\System\wYCyoRv.exe
  2⤵
  PID:11288
- C:\Windows\System\dFwgYgQ.exe
  C:\Windows\System\dFwgYgQ.exe
  2⤵
  PID:11212
- C:\Windows\System\ZXarKPx.exe
  C:\Windows\System\ZXarKPx.exe
  2⤵
  PID:11100
- C:\Windows\System\nmySJYW.exe
  C:\Windows\System\nmySJYW.exe
  2⤵
  PID:10896
- C:\Windows\System\pFmmbEj.exe
  C:\Windows\System\pFmmbEj.exe
  2⤵
  PID:10280
- C:\Windows\System\iuBEvec.exe
  C:\Windows\System\iuBEvec.exe
  2⤵
  PID:10152
- C:\Windows\System\NdQXUDF.exe
  C:\Windows\System\NdQXUDF.exe
  2⤵
  PID:9964
- C:\Windows\System\ghudJbi.exe
  C:\Windows\System\ghudJbi.exe
  2⤵
  PID:9816
- C:\Windows\System\QxKHFLk.exe
  C:\Windows\System\QxKHFLk.exe
  2⤵
  PID:9716
- C:\Windows\System\PFENnMn.exe
  C:\Windows\System\PFENnMn.exe
  2⤵
  PID:9452
- C:\Windows\System\tZxqivR.exe
  C:\Windows\System\tZxqivR.exe
  2⤵
  PID:9236
- C:\Windows\System\TGoCJgh.exe
  C:\Windows\System\TGoCJgh.exe
  2⤵
  PID:9028
- C:\Windows\System\etGUIcB.exe
  C:\Windows\System\etGUIcB.exe
  2⤵
  PID:8796
- C:\Windows\System\tjTaIFQ.exe
  C:\Windows\System\tjTaIFQ.exe
  2⤵
  PID:11912
- C:\Windows\System\yOYZMke.exe
  C:\Windows\System\yOYZMke.exe
  2⤵
  PID:3608
- C:\Windows\System\iNFQoxV.exe
  C:\Windows\System\iNFQoxV.exe
  2⤵
  PID:2608
- C:\Windows\System\umyUzCW.exe
  C:\Windows\System\umyUzCW.exe
  2⤵
  PID:12428
- C:\Windows\System\RNoRjUL.exe
  C:\Windows\System\RNoRjUL.exe
  2⤵
  PID:12520
- C:\Windows\System\iSwiAII.exe
  C:\Windows\System\iSwiAII.exe
  2⤵
  PID:12556
- C:\Windows\System\lHBQwMS.exe
  C:\Windows\System\lHBQwMS.exe
  2⤵
  PID:12620
- C:\Windows\System\jjtnXnx.exe
  C:\Windows\System\jjtnXnx.exe
  2⤵
  PID:12680
- C:\Windows\System\dAmnfDw.exe
  C:\Windows\System\dAmnfDw.exe
  2⤵
  PID:12720
- C:\Windows\System\HZTwpyw.exe
  C:\Windows\System\HZTwpyw.exe
  2⤵
  PID:12796
- C:\Windows\System\hCjiTfa.exe
  C:\Windows\System\hCjiTfa.exe
  2⤵
  PID:12876
- C:\Windows\System\WMQJOEu.exe
  C:\Windows\System\WMQJOEu.exe
  2⤵
  PID:7820
- C:\Windows\System\YdARILC.exe
  C:\Windows\System\YdARILC.exe
  2⤵
  PID:12992
- C:\Windows\System\QyDLIWM.exe
  C:\Windows\System\QyDLIWM.exe
  2⤵
  PID:13072
- C:\Windows\System\IjelPNj.exe
  C:\Windows\System\IjelPNj.exe
  2⤵
  PID:13124
- C:\Windows\System\EoDDHoK.exe
  C:\Windows\System\EoDDHoK.exe
  2⤵
  PID:13204
- C:\Windows\System\aeRuhLT.exe
  C:\Windows\System\aeRuhLT.exe
  2⤵
  PID:13248
- C:\Windows\System\tCKMcIr.exe
  C:\Windows\System\tCKMcIr.exe
  2⤵
  PID:2200
- C:\Windows\System\uEoJqwy.exe
  C:\Windows\System\uEoJqwy.exe
  2⤵
  PID:8240
- C:\Windows\System\QpRLgsQ.exe
  C:\Windows\System\QpRLgsQ.exe
  2⤵
  PID:10084
- C:\Windows\System\lUsrqyK.exe
  C:\Windows\System\lUsrqyK.exe
  2⤵
  PID:13604
- C:\Windows\System\vqbBoqS.exe
  C:\Windows\System\vqbBoqS.exe
  2⤵
  PID:11888
- C:\Windows\System\DzvyRqR.exe
  C:\Windows\System\DzvyRqR.exe
  2⤵
  PID:11012
- C:\Windows\System\kvjcYiv.exe
  C:\Windows\System\kvjcYiv.exe
  2⤵
  PID:11404
- C:\Windows\System\bstQMws.exe
  C:\Windows\System\bstQMws.exe
  2⤵
  PID:2576
- C:\Windows\System\KkbIEhy.exe
  C:\Windows\System\KkbIEhy.exe
  2⤵
  PID:11648
- C:\Windows\System\FOxpLCe.exe
  C:\Windows\System\FOxpLCe.exe
  2⤵
  PID:11736
- C:\Windows\System\JqMAVLw.exe
  C:\Windows\System\JqMAVLw.exe
  2⤵
  PID:11064
- C:\Windows\System\CSjJCzs.exe
  C:\Windows\System\CSjJCzs.exe
  2⤵
  PID:10860
- C:\Windows\System\JZcehtt.exe
  C:\Windows\System\JZcehtt.exe
  2⤵
  PID:10560
- C:\Windows\System\NFPNmSO.exe
  C:\Windows\System\NFPNmSO.exe
  2⤵
  PID:9520
- C:\Windows\System\KHfibkC.exe
  C:\Windows\System\KHfibkC.exe
  2⤵
  PID:3448
- C:\Windows\System\lciLKPr.exe
  C:\Windows\System\lciLKPr.exe
  2⤵
  PID:7396
- C:\Windows\System\ZlpbcBX.exe
  C:\Windows\System\ZlpbcBX.exe
  2⤵
  PID:6396
- C:\Windows\System\TQEJMpt.exe
  C:\Windows\System\TQEJMpt.exe
  2⤵
  PID:2668
- C:\Windows\System\RNlsMWR.exe
  C:\Windows\System\RNlsMWR.exe
  2⤵
  PID:6620
- C:\Windows\System\WOvuNna.exe
  C:\Windows\System\WOvuNna.exe
  2⤵
  PID:8744
- C:\Windows\System\dFGeRzP.exe
  C:\Windows\System\dFGeRzP.exe
  2⤵
  PID:5512
- C:\Windows\System\HfBTNMl.exe
  C:\Windows\System\HfBTNMl.exe
  2⤵
  PID:7992
- C:\Windows\System\YzIFicI.exe
  C:\Windows\System\YzIFicI.exe
  2⤵
  PID:8168
- C:\Windows\System\RFCHHzp.exe
  C:\Windows\System\RFCHHzp.exe
  2⤵
  PID:9432
- C:\Windows\System\MePkRKU.exe
  C:\Windows\System\MePkRKU.exe
  2⤵
  PID:9532
- C:\Windows\System\mpYxcGW.exe
  C:\Windows\System\mpYxcGW.exe
  2⤵
  PID:12916
- C:\Windows\System\nHyKDAD.exe
  C:\Windows\System\nHyKDAD.exe
  2⤵
  PID:12968
- C:\Windows\System\wJXktOB.exe
  C:\Windows\System\wJXktOB.exe
  2⤵
  PID:13024
- C:\Windows\System\VUufEbU.exe
  C:\Windows\System\VUufEbU.exe
  2⤵
  PID:2916
- C:\Windows\System\lYbSJMB.exe
  C:\Windows\System\lYbSJMB.exe
  2⤵
  PID:10456
- C:\Windows\System\cNiETEf.exe
  C:\Windows\System\cNiETEf.exe
  2⤵
  PID:10604
- C:\Windows\System\RhRCHIO.exe
  C:\Windows\System\RhRCHIO.exe
  2⤵
  PID:10708
- C:\Windows\System\UvJPYbJ.exe
  C:\Windows\System\UvJPYbJ.exe
  2⤵
  PID:8868
- C:\Windows\System\cfRyQhY.exe
  C:\Windows\System\cfRyQhY.exe
  2⤵
  PID:11944
- C:\Windows\System\UKIMWOK.exe
  C:\Windows\System\UKIMWOK.exe
  2⤵
  PID:9200
- C:\Windows\System\nwbziAf.exe
  C:\Windows\System\nwbziAf.exe
  2⤵
  PID:9384
- C:\Windows\System\bOTtUyE.exe
  C:\Windows\System\bOTtUyE.exe
  2⤵
  PID:6636
- C:\Windows\System\SYzrGRU.exe
  C:\Windows\System\SYzrGRU.exe
  2⤵
  PID:12820
- C:\Windows\System\QwsyLIC.exe
  C:\Windows\System\QwsyLIC.exe
  2⤵
  PID:3204
- C:\Windows\System\VMFvwfP.exe
  C:\Windows\System\VMFvwfP.exe
  2⤵
  PID:12872
- C:\Windows\System\rEySwGF.exe
  C:\Windows\System\rEySwGF.exe
  2⤵
  PID:10724
- C:\Windows\System\NTyxfNR.exe
  C:\Windows\System\NTyxfNR.exe
  2⤵
  PID:9836
- C:\Windows\System\sYPJmZM.exe
  C:\Windows\System\sYPJmZM.exe
  2⤵
  PID:12948
- C:\Windows\System\sBupUMW.exe
  C:\Windows\System\sBupUMW.exe
  2⤵
  PID:11144
- C:\Windows\System\yiHhxof.exe
  C:\Windows\System\yiHhxof.exe
  2⤵
  PID:10580
- C:\Windows\System\cGuclFh.exe
  C:\Windows\System\cGuclFh.exe
  2⤵
  PID:6072
- C:\Windows\System\CJciQRE.exe
  C:\Windows\System\CJciQRE.exe
  2⤵
  PID:3484
- C:\Windows\System\SpQbnGJ.exe
  C:\Windows\System\SpQbnGJ.exe
  2⤵
  PID:1228
- C:\Windows\System\kJVfTMU.exe
  C:\Windows\System\kJVfTMU.exe
  2⤵
  PID:11592
- C:\Windows\System\aAJJfSO.exe
  C:\Windows\System\aAJJfSO.exe
  2⤵
  PID:4976
- C:\Windows\System\xAwewmM.exe
  C:\Windows\System\xAwewmM.exe
  2⤵
  PID:13900
- C:\Windows\System\BbLCqYX.exe
  C:\Windows\System\BbLCqYX.exe
  2⤵
  PID:4932
- C:\Windows\System\WcFnGia.exe
  C:\Windows\System\WcFnGia.exe
  2⤵
  PID:6364
- C:\Windows\System\cXkCkDI.exe
  C:\Windows\System\cXkCkDI.exe
  2⤵
  PID:10480
- C:\Windows\System\ZEYxxLy.exe
  C:\Windows\System\ZEYxxLy.exe
  2⤵
  PID:10672
- C:\Windows\System\BqWTKuf.exe
  C:\Windows\System\BqWTKuf.exe
  2⤵
  PID:6672
- C:\Windows\System\yYOmKSw.exe
  C:\Windows\System\yYOmKSw.exe
  2⤵
  PID:13232
- C:\Windows\System\gGEpWiD.exe
  C:\Windows\System\gGEpWiD.exe
  2⤵
  PID:11896
- C:\Windows\System\eZHUqfC.exe
  C:\Windows\System\eZHUqfC.exe
  2⤵
  PID:7336
- C:\Windows\System\mnVozYk.exe
  C:\Windows\System\mnVozYk.exe
  2⤵
  PID:6292
- C:\Windows\System\rnhipNP.exe
  C:\Windows\System\rnhipNP.exe
  2⤵
  PID:11792
- C:\Windows\System\MXLDJbK.exe
  C:\Windows\System\MXLDJbK.exe
  2⤵
  PID:14280
- C:\Windows\System\SQPPaHL.exe
  C:\Windows\System\SQPPaHL.exe
  2⤵
  PID:13140
- C:\Windows\System\ywFLeDn.exe
  C:\Windows\System\ywFLeDn.exe
  2⤵
  PID:12724
- C:\Windows\System\bxzCaTv.exe
  C:\Windows\System\bxzCaTv.exe
  2⤵
  PID:11484
- C:\Windows\System\OdpEFNE.exe
  C:\Windows\System\OdpEFNE.exe
  2⤵
  PID:10188
- C:\Windows\System\xoWUlJV.exe
  C:\Windows\System\xoWUlJV.exe
  2⤵
  PID:2368
- C:\Windows\System\mhpDgJL.exe
  C:\Windows\System\mhpDgJL.exe
  2⤵
  PID:13012
- C:\Windows\System\jczaehu.exe
  C:\Windows\System\jczaehu.exe
  2⤵
  PID:10652
- C:\Windows\System\AERFepX.exe
  C:\Windows\System\AERFepX.exe
  2⤵
  PID:14028
- C:\Windows\System\HVqgjqX.exe
  C:\Windows\System\HVqgjqX.exe
  2⤵
  PID:9776
- C:\Windows\System\HlyMDVY.exe
  C:\Windows\System\HlyMDVY.exe
  2⤵
  PID:9088
- C:\Windows\System\ystlKNJ.exe
  C:\Windows\System\ystlKNJ.exe
  2⤵
  PID:8296
- C:\Windows\System\edRdGQT.exe
  C:\Windows\System\edRdGQT.exe
  2⤵
  PID:5012
- C:\Windows\System\BgkHAYf.exe
  C:\Windows\System\BgkHAYf.exe
  2⤵
  PID:9500
- C:\Windows\System\mteCNCi.exe
  C:\Windows\System\mteCNCi.exe
  2⤵
  PID:14328
- C:\Windows\System\ulGGMRD.exe
  C:\Windows\System\ulGGMRD.exe
  2⤵
  PID:14000
- C:\Windows\System\YPyHaYM.exe
  C:\Windows\System\YPyHaYM.exe
  2⤵
  PID:9652
- C:\Windows\System\grFLRtu.exe
  C:\Windows\System\grFLRtu.exe
  2⤵
  PID:13968
- C:\Windows\System\FFeogkq.exe
  C:\Windows\System\FFeogkq.exe
  2⤵
  PID:12572
- C:\Windows\System\VoRKfaQ.exe
  C:\Windows\System\VoRKfaQ.exe
  2⤵
  PID:1796
- C:\Windows\System\YzPhSTr.exe
  C:\Windows\System\YzPhSTr.exe
  2⤵
  PID:10620
- C:\Windows\System\yIyIYis.exe
  C:\Windows\System\yIyIYis.exe
  2⤵
  PID:9676
- C:\Windows\System\vOpFVqu.exe
  C:\Windows\System\vOpFVqu.exe
  2⤵
  PID:12856
- C:\Windows\System\WkioFgi.exe
  C:\Windows\System\WkioFgi.exe
  2⤵
  PID:11236
- C:\Windows\System\dDUiMcS.exe
  C:\Windows\System\dDUiMcS.exe
  2⤵
  PID:14284
- C:\Windows\System\zxXwEGv.exe
  C:\Windows\System\zxXwEGv.exe
  2⤵
  PID:6172
- C:\Windows\System\HGNXEDj.exe
  C:\Windows\System\HGNXEDj.exe
  2⤵
  PID:11476
- C:\Windows\System\qRLvtXM.exe
  C:\Windows\System\qRLvtXM.exe
  2⤵
  PID:4724
- C:\Windows\System\swtcqTv.exe
  C:\Windows\System\swtcqTv.exe
  2⤵
  PID:8412
- C:\Windows\System\DanPZui.exe
  C:\Windows\System\DanPZui.exe
  2⤵
  PID:8468
- C:\Windows\System\MCTcQDx.exe
  C:\Windows\System\MCTcQDx.exe
  2⤵
  PID:9984
- C:\Windows\System\jwJlENM.exe
  C:\Windows\System\jwJlENM.exe
  2⤵
  PID:13004
- C:\Windows\System\VDffgym.exe
  C:\Windows\System\VDffgym.exe
  2⤵
  PID:11868
- C:\Windows\System\DLtWWmR.exe
  C:\Windows\System\DLtWWmR.exe
  2⤵
  PID:14244
- C:\Windows\System\vUuLNhW.exe
  C:\Windows\System\vUuLNhW.exe
  2⤵
  PID:14176
- C:\Windows\System\zHrfrhg.exe
  C:\Windows\System\zHrfrhg.exe
  2⤵
  PID:11536
- C:\Windows\System\pgHcTni.exe
  C:\Windows\System\pgHcTni.exe
  2⤵
  PID:10584
- C:\Windows\System\tIdEecB.exe
  C:\Windows\System\tIdEecB.exe
  2⤵
  PID:8200
- C:\Windows\System\wnKrEDY.exe
  C:\Windows\System\wnKrEDY.exe
  2⤵
  PID:5156
- C:\Windows\System\gsZQYDa.exe
  C:\Windows\System\gsZQYDa.exe
  2⤵
  PID:11308
- C:\Windows\System\fIEAfyj.exe
  C:\Windows\System\fIEAfyj.exe
  2⤵
  PID:10864
- C:\Windows\System\dpsoEVc.exe
  C:\Windows\System\dpsoEVc.exe
  2⤵
  PID:7208
- C:\Windows\System\fruTiQJ.exe
  C:\Windows\System\fruTiQJ.exe
  2⤵
  PID:6188
- C:\Windows\System\jTmaAWA.exe
  C:\Windows\System\jTmaAWA.exe
  2⤵
  PID:2604
- C:\Windows\System\HfmWttf.exe
  C:\Windows\System\HfmWttf.exe
  2⤵
  PID:10224
- C:\Windows\System\wSHNxHJ.exe
  C:\Windows\System\wSHNxHJ.exe
  2⤵
  PID:10548
- C:\Windows\System\iLXmadI.exe
  C:\Windows\System\iLXmadI.exe
  2⤵
  PID:12932
- C:\Windows\System\ChFAMoz.exe
  C:\Windows\System\ChFAMoz.exe
  2⤵
  PID:14020
- C:\Windows\System\joirujo.exe
  C:\Windows\System\joirujo.exe
  2⤵
  PID:10916
- C:\Windows\System\UlxvkCY.exe
  C:\Windows\System\UlxvkCY.exe
  2⤵
  PID:10404
- C:\Windows\System\RCKbMew.exe
  C:\Windows\System\RCKbMew.exe
  2⤵
  PID:824
- C:\Windows\System\JqxNMUP.exe
  C:\Windows\System\JqxNMUP.exe
  2⤵
  PID:4164
- C:\Windows\System\gxVtqvA.exe
  C:\Windows\System\gxVtqvA.exe
  2⤵
  PID:12500
- C:\Windows\System\fAzyzLa.exe
  C:\Windows\System\fAzyzLa.exe
  2⤵
  PID:3296
- C:\Windows\System\Doruxtd.exe
  C:\Windows\System\Doruxtd.exe
  2⤵
  PID:3288
- C:\Windows\System\HadJWLu.exe
  C:\Windows\System\HadJWLu.exe
  2⤵
  PID:11444
- C:\Windows\System\NnfFvIT.exe
  C:\Windows\System\NnfFvIT.exe
  2⤵
  PID:2708
- C:\Windows\System\PngItXY.exe
  C:\Windows\System\PngItXY.exe
  2⤵
  PID:6352
- C:\Windows\System\zXpBeOf.exe
  C:\Windows\System\zXpBeOf.exe
  2⤵
  PID:9260
- C:\Windows\System\fuAptms.exe
  C:\Windows\System\fuAptms.exe
  2⤵
  PID:11680
- C:\Windows\System\HHluMmW.exe
  C:\Windows\System\HHluMmW.exe
  2⤵
  PID:13948
- C:\Windows\System\vCinUbV.exe
  C:\Windows\System\vCinUbV.exe
  2⤵
  PID:1932
- C:\Windows\System\TyMecXL.exe
  C:\Windows\System\TyMecXL.exe
  2⤵
  PID:9832
- C:\Windows\System\mWBgKoE.exe
  C:\Windows\System\mWBgKoE.exe
  2⤵
  PID:4784
- C:\Windows\System\waURbFk.exe
  C:\Windows\System\waURbFk.exe
  2⤵
  PID:9560
- C:\Windows\System\UINzrkt.exe
  C:\Windows\System\UINzrkt.exe
  2⤵
  PID:12600
- C:\Windows\System\JulPKkk.exe
  C:\Windows\System\JulPKkk.exe
  2⤵
  PID:11748
- C:\Windows\System\gCWKCuR.exe
  C:\Windows\System\gCWKCuR.exe
  2⤵
  PID:6212
- C:\Windows\System\QOQvUWX.exe
  C:\Windows\System\QOQvUWX.exe
  2⤵
  PID:5488
- C:\Windows\System\LHoKYqQ.exe
  C:\Windows\System\LHoKYqQ.exe
  2⤵
  PID:5604
- C:\Windows\System\aFUEIcC.exe
  C:\Windows\System\aFUEIcC.exe
  2⤵
  PID:13028
- C:\Windows\System\TKUEYBn.exe
  C:\Windows\System\TKUEYBn.exe
  2⤵
  PID:11380
- C:\Windows\System\sQdBGvd.exe
  C:\Windows\System\sQdBGvd.exe
  2⤵
  PID:11008
- C:\Windows\System\qVTEHAe.exe
  C:\Windows\System\qVTEHAe.exe
  2⤵
  PID:932
- C:\Windows\System\TpFwElx.exe
  C:\Windows\System\TpFwElx.exe
  2⤵
  PID:4100
- C:\Windows\System\LXpyIMa.exe
  C:\Windows\System\LXpyIMa.exe
  2⤵
  PID:13780
- C:\Windows\System\PRJzjSW.exe
  C:\Windows\System\PRJzjSW.exe
  2⤵
  PID:2940
- C:\Windows\System\EbgOOao.exe
  C:\Windows\System\EbgOOao.exe
  2⤵
  PID:1260
- C:\Windows\System\UsxFQRi.exe
  C:\Windows\System\UsxFQRi.exe
  2⤵
  PID:14500
- C:\Windows\System\YNumXpF.exe
  C:\Windows\System\YNumXpF.exe
  2⤵
  PID:14580
- C:\Windows\System\ASLsUeG.exe
  C:\Windows\System\ASLsUeG.exe
  2⤵
  PID:14724
- C:\Windows\System\DwyBTeZ.exe
  C:\Windows\System\DwyBTeZ.exe
  2⤵
  PID:14788
- C:\Windows\System\qqaSonJ.exe
  C:\Windows\System\qqaSonJ.exe
  2⤵
  PID:14936
- C:\Windows\System\AoisHAS.exe
  C:\Windows\System\AoisHAS.exe
  2⤵
  PID:14968
- C:\Windows\System\glGFeGk.exe
  C:\Windows\System\glGFeGk.exe
  2⤵
  PID:15000
- C:\Windows\System\rehFgLd.exe
  C:\Windows\System\rehFgLd.exe
  2⤵
  PID:15016
- C:\Windows\System\rSEQull.exe
  C:\Windows\System\rSEQull.exe
  2⤵
  PID:15232
- C:\Windows\System\tfxxkAa.exe
  C:\Windows\System\tfxxkAa.exe
  2⤵
  PID:15256
- C:\Windows\System\RCgdIcf.exe
  C:\Windows\System\RCgdIcf.exe
  2⤵
  PID:4844
- C:\Windows\System\kMiphyZ.exe
  C:\Windows\System\kMiphyZ.exe
  2⤵
  PID:14368
- C:\Windows\System\pfmsSAw.exe
  C:\Windows\System\pfmsSAw.exe
  2⤵
  PID:14620
- C:\Windows\System\qSvNZIg.exe
  C:\Windows\System\qSvNZIg.exe
  2⤵
  PID:14640
- C:\Windows\System\OjNitCM.exe
  C:\Windows\System\OjNitCM.exe
  2⤵
  PID:14696
- C:\Windows\System\VlVTXYH.exe
  C:\Windows\System\VlVTXYH.exe
  2⤵
  PID:14760
- C:\Windows\System\MWQCVBt.exe
  C:\Windows\System\MWQCVBt.exe
  2⤵
  PID:14808
- C:\Windows\System\iyjnHkL.exe
  C:\Windows\System\iyjnHkL.exe
  2⤵
  PID:14920
- C:\Windows\System\kGwgAAL.exe
  C:\Windows\System\kGwgAAL.exe
  2⤵
  PID:14952
- C:\Windows\System\RCQjgBc.exe
  C:\Windows\System\RCQjgBc.exe
  2⤵
  PID:14948
- C:\Windows\System\DfZwIgE.exe
  C:\Windows\System\DfZwIgE.exe
  2⤵
  PID:14960
- C:\Windows\System\OAGiCFI.exe
  C:\Windows\System\OAGiCFI.exe
  2⤵
  PID:15060
- C:\Windows\System\MYRHnKg.exe
  C:\Windows\System\MYRHnKg.exe
  2⤵
  PID:3636
- C:\Windows\System\GhGmfPT.exe
  C:\Windows\System\GhGmfPT.exe
  2⤵
  PID:14556
- C:\Windows\System\qYQRhRo.exe
  C:\Windows\System\qYQRhRo.exe
  2⤵
  PID:14864
- C:\Windows\System\jUqgEBn.exe
  C:\Windows\System\jUqgEBn.exe
  2⤵
  PID:14520
- C:\Windows\System\DPDHyZp.exe
  C:\Windows\System\DPDHyZp.exe
  2⤵
  PID:14592
- C:\Windows\System\oOjOOpj.exe
  C:\Windows\System\oOjOOpj.exe
  2⤵
  PID:14956
- C:\Windows\System\kEQPzoj.exe
  C:\Windows\System\kEQPzoj.exe
  2⤵
  PID:15012
- C:\Windows\System\BLScyyc.exe
  C:\Windows\System\BLScyyc.exe
  2⤵
  PID:15028
- C:\Windows\System\fLFkuhN.exe
  C:\Windows\System\fLFkuhN.exe
  2⤵
  PID:3496
- C:\Windows\System\HbvaJPV.exe
  C:\Windows\System\HbvaJPV.exe
  2⤵
  PID:15144
- C:\Windows\System\LGTqfAY.exe
  C:\Windows\System\LGTqfAY.exe
  2⤵
  PID:5568
- C:\Windows\System\dcJKZNu.exe
  C:\Windows\System\dcJKZNu.exe
  2⤵
  PID:4368
- C:\Windows\System\VuBDEFW.exe
  C:\Windows\System\VuBDEFW.exe
  2⤵
  PID:5460
- C:\Windows\System\nMifgTw.exe
  C:\Windows\System\nMifgTw.exe
  2⤵
  PID:14356
- C:\Windows\System\qcksgvl.exe
  C:\Windows\System\qcksgvl.exe
  2⤵
  PID:6644
- C:\Windows\System\HbvJlJJ.exe
  C:\Windows\System\HbvJlJJ.exe
  2⤵
  PID:6856
- C:\Windows\System\JYVrpua.exe
  C:\Windows\System\JYVrpua.exe
  2⤵
  PID:6944
- C:\Windows\System\LQdFqpr.exe
  C:\Windows\System\LQdFqpr.exe
  2⤵
  PID:5116
- C:\Windows\System\ZCvcakj.exe
  C:\Windows\System\ZCvcakj.exe
  2⤵
  PID:14436
- C:\Windows\System\eQsWWJd.exe
  C:\Windows\System\eQsWWJd.exe
  2⤵
  PID:14480
- C:\Windows\System\BeoCgAV.exe
  C:\Windows\System\BeoCgAV.exe
  2⤵
  PID:5736
- C:\Windows\System\gANndjY.exe
  C:\Windows\System\gANndjY.exe
  2⤵
  PID:6648
- C:\Windows\System\YVYFWKN.exe
  C:\Windows\System\YVYFWKN.exe
  2⤵
  PID:14888
- C:\Windows\System\UVALJUQ.exe
  C:\Windows\System\UVALJUQ.exe
  2⤵
  PID:14780
- C:\Windows\System\sIEUmWj.exe
  C:\Windows\System\sIEUmWj.exe
  2⤵
  PID:14796
- C:\Windows\System\niDQgWa.exe
  C:\Windows\System\niDQgWa.exe
  2⤵
  PID:14692
- C:\Windows\System\FhmKMPV.exe
  C:\Windows\System\FhmKMPV.exe
  2⤵
  PID:14708
- C:\Windows\System\SjNUeIC.exe
  C:\Windows\System\SjNUeIC.exe
  2⤵
  PID:14868
- C:\Windows\System\GQrEJka.exe
  C:\Windows\System\GQrEJka.exe
  2⤵
  PID:7544
- C:\Windows\System\uPqCTPR.exe
  C:\Windows\System\uPqCTPR.exe
  2⤵
  PID:14980
- C:\Windows\System\ZYRhThP.exe
  C:\Windows\System\ZYRhThP.exe
  2⤵
  PID:14924
- C:\Windows\System\rOzELsE.exe
  C:\Windows\System\rOzELsE.exe
  2⤵
  PID:8184
- C:\Windows\System\NfZBmQq.exe
  C:\Windows\System\NfZBmQq.exe
  2⤵
  PID:15204
- C:\Windows\System\DTYRUBQ.exe
  C:\Windows\System\DTYRUBQ.exe
  2⤵
  PID:15268
- C:\Windows\System\lGsbdEx.exe
  C:\Windows\System\lGsbdEx.exe
  2⤵
  PID:7040
- C:\Windows\System\OeaHyMF.exe
  C:\Windows\System\OeaHyMF.exe
  2⤵
  PID:12952
- C:\Windows\System\mWPhcZe.exe
  C:\Windows\System\mWPhcZe.exe
  2⤵
  PID:5392
- C:\Windows\System\WFYlpDx.exe
  C:\Windows\System\WFYlpDx.exe
  2⤵
  PID:5528
- C:\Windows\System\kRtgtHI.exe
  C:\Windows\System\kRtgtHI.exe
  2⤵
  PID:6464
- C:\Windows\System\phsrMSi.exe
  C:\Windows\System\phsrMSi.exe
  2⤵
  PID:384
- C:\Windows\System\cDaEEKr.exe
  C:\Windows\System\cDaEEKr.exe
  2⤵
  PID:2732
- C:\Windows\System\jwyVDGB.exe
  C:\Windows\System\jwyVDGB.exe
  2⤵
  PID:3092
- C:\Windows\System\zlfDjmH.exe
  C:\Windows\System\zlfDjmH.exe
  2⤵
  PID:14412
- C:\Windows\System\yLtABCV.exe
  C:\Windows\System\yLtABCV.exe
  2⤵
  PID:14836
- C:\Windows\System\aTcpVCJ.exe
  C:\Windows\System\aTcpVCJ.exe
  2⤵
  PID:7068
- C:\Windows\System\ebuPvmq.exe
  C:\Windows\System\ebuPvmq.exe
  2⤵
  PID:12152
- C:\Windows\System\uutgYWd.exe
  C:\Windows\System\uutgYWd.exe
  2⤵
  PID:12312
- C:\Windows\System\OtfzsfH.exe
  C:\Windows\System\OtfzsfH.exe
  2⤵
  PID:14632
- C:\Windows\System\qyvVZHa.exe
  C:\Windows\System\qyvVZHa.exe
  2⤵
  PID:8988
- C:\Windows\System\ZbpDoGX.exe
  C:\Windows\System\ZbpDoGX.exe
  2⤵
  PID:8368
- C:\Windows\System\UhJMMTZ.exe
  C:\Windows\System\UhJMMTZ.exe
  2⤵
  PID:8456
- C:\Windows\System\vAMzRcc.exe
  C:\Windows\System\vAMzRcc.exe
  2⤵
  PID:7696
- C:\Windows\System\lnhAxzv.exe
  C:\Windows\System\lnhAxzv.exe
  2⤵
  PID:9300
- C:\Windows\System\VMNEmoH.exe
  C:\Windows\System\VMNEmoH.exe
  2⤵
  PID:4380
- C:\Windows\System\amWFpKY.exe
  C:\Windows\System\amWFpKY.exe
  2⤵
  PID:9176
- C:\Windows\System\TxWPBIJ.exe
  C:\Windows\System\TxWPBIJ.exe
  2⤵
  PID:13460
- C:\Windows\System\ZwOYHpg.exe
  C:\Windows\System\ZwOYHpg.exe
  2⤵
  PID:15156
- C:\Windows\System\rGdBVnp.exe
  C:\Windows\System\rGdBVnp.exe
  2⤵
  PID:10204
- C:\Windows\System\lfDTcmT.exe
  C:\Windows\System\lfDTcmT.exe
  2⤵
  PID:10244
- C:\Windows\System\ktYBrGV.exe
  C:\Windows\System\ktYBrGV.exe
  2⤵
  PID:15184
- C:\Windows\System\zAeAabd.exe
  C:\Windows\System\zAeAabd.exe
  2⤵
  PID:10372
- C:\Windows\System\mpQVGeS.exe
  C:\Windows\System\mpQVGeS.exe
  2⤵
  PID:8088
- C:\Windows\System\ZClECGP.exe
  C:\Windows\System\ZClECGP.exe
  2⤵
  PID:12112
- C:\Windows\System\HZTjOxj.exe
  C:\Windows\System\HZTjOxj.exe
  2⤵
  PID:12208
- C:\Windows\System\rsqVXep.exe
  C:\Windows\System\rsqVXep.exe
  2⤵
  PID:12264
- C:\Windows\System\JZDDxuv.exe
  C:\Windows\System\JZDDxuv.exe
  2⤵
  PID:7656
- C:\Windows\System\IXkubwi.exe
  C:\Windows\System\IXkubwi.exe
  2⤵
  PID:6200
- C:\Windows\System\TPHRKOU.exe
  C:\Windows\System\TPHRKOU.exe
  2⤵
  PID:13720
- C:\Windows\System\qzamdLJ.exe
  C:\Windows\System\qzamdLJ.exe
  2⤵
  PID:5340
- C:\Windows\System\aogdkNl.exe
  C:\Windows\System\aogdkNl.exe
  2⤵
  PID:464
- C:\Windows\System\dGkHqix.exe
  C:\Windows\System\dGkHqix.exe
  2⤵
  PID:14400
- C:\Windows\System\OuDFnsm.exe
  C:\Windows\System\OuDFnsm.exe
  2⤵
  PID:12108
- C:\Windows\System\dyFmzaR.exe
  C:\Windows\System\dyFmzaR.exe
  2⤵
  PID:14876
- C:\Windows\System\bgOVPpx.exe
  C:\Windows\System\bgOVPpx.exe
  2⤵
  PID:11976
- C:\Windows\System\xQuCQMx.exe
  C:\Windows\System\xQuCQMx.exe
  2⤵
  PID:14844
- C:\Windows\System\lSWIuQP.exe
  C:\Windows\System\lSWIuQP.exe
  2⤵
  PID:12212
- C:\Windows\System\fhtNgwU.exe
  C:\Windows\System\fhtNgwU.exe
  2⤵
  PID:2752
- C:\Windows\System\TzjKHyP.exe
  C:\Windows\System\TzjKHyP.exe
  2⤵
  PID:10312
- C:\Windows\System\niFMHvG.exe
  C:\Windows\System\niFMHvG.exe
  2⤵
  PID:12092
- C:\Windows\System\JcuZRQS.exe
  C:\Windows\System\JcuZRQS.exe
  2⤵
  PID:10812
- C:\Windows\System\VCtEmJc.exe
  C:\Windows\System\VCtEmJc.exe
  2⤵
  PID:13364
- C:\Windows\System\gPLjQgy.exe
  C:\Windows\System\gPLjQgy.exe
  2⤵
  PID:8732
- C:\Windows\System\YOvyQEv.exe
  C:\Windows\System\YOvyQEv.exe
  2⤵
  PID:12320
- C:\Windows\System\QkfBJIB.exe
  C:\Windows\System\QkfBJIB.exe
  2⤵
  PID:7944
- C:\Windows\System\sTurcfK.exe
  C:\Windows\System\sTurcfK.exe
  2⤵
  PID:7920
- C:\Windows\System\Vjuxssl.exe
  C:\Windows\System\Vjuxssl.exe
  2⤵
  PID:1624
- C:\Windows\System\aJEAJOp.exe
  C:\Windows\System\aJEAJOp.exe
  2⤵
  PID:14360
- C:\Windows\System\utZIctb.exe
  C:\Windows\System\utZIctb.exe
  2⤵
  PID:6964
- C:\Windows\System\sAwBjdn.exe
  C:\Windows\System\sAwBjdn.exe
  2⤵
  PID:14736
- C:\Windows\System\bAlZxqS.exe
  C:\Windows\System\bAlZxqS.exe
  2⤵
  PID:13784
- C:\Windows\System\NoJhBMN.exe
  C:\Windows\System\NoJhBMN.exe
  2⤵
  PID:6496
- C:\Windows\System\LqiLjXR.exe
  C:\Windows\System\LqiLjXR.exe
  2⤵
  PID:8756
- C:\Windows\System\LyAPHEb.exe
  C:\Windows\System\LyAPHEb.exe
  2⤵
  PID:5564
- C:\Windows\System\plVYbVs.exe
  C:\Windows\System\plVYbVs.exe
  2⤵
  PID:10060
- C:\Windows\System\YQfZTAe.exe
  C:\Windows\System\YQfZTAe.exe
  2⤵
  PID:10348
- C:\Windows\System\drMGeHV.exe
  C:\Windows\System\drMGeHV.exe
  2⤵
  PID:5912
- C:\Windows\System\ylRzuYy.exe
  C:\Windows\System\ylRzuYy.exe
  2⤵
  PID:9132
- C:\Windows\System\wJZiGeQ.exe
  C:\Windows\System\wJZiGeQ.exe
  2⤵
  PID:15100
- C:\Windows\System\PAqMcPl.exe
  C:\Windows\System\PAqMcPl.exe
  2⤵
  PID:7796
- C:\Windows\System\UKnfnnW.exe
  C:\Windows\System\UKnfnnW.exe
  2⤵
  PID:640
- C:\Windows\System\zhBOlzO.exe
  C:\Windows\System\zhBOlzO.exe
  2⤵
  PID:14332
- C:\Windows\System\wcQzfIj.exe
  C:\Windows\System\wcQzfIj.exe
  2⤵
  PID:5048
- C:\Windows\System\BMVDyTH.exe
  C:\Windows\System\BMVDyTH.exe
  2⤵
  PID:9220
- C:\Windows\System\aVCEJuF.exe
  C:\Windows\System\aVCEJuF.exe
  2⤵
  PID:7976
- C:\Windows\System\hytZbMX.exe
  C:\Windows\System\hytZbMX.exe
  2⤵
  PID:13444
- C:\Windows\System\ZFUWBJs.exe
  C:\Windows\System\ZFUWBJs.exe
  2⤵
  PID:8008
- C:\Windows\System\XfpPkSN.exe
  C:\Windows\System\XfpPkSN.exe
  2⤵
  PID:13492
- C:\Windows\System\rHIDQbB.exe
  C:\Windows\System\rHIDQbB.exe
  2⤵
  PID:13880
- C:\Windows\System\QfEzuAc.exe
  C:\Windows\System\QfEzuAc.exe
  2⤵
  PID:10472
- C:\Windows\System\WpZzfgP.exe
  C:\Windows\System\WpZzfgP.exe
  2⤵
  PID:13304
- C:\Windows\System\tDVKpqU.exe
  C:\Windows\System\tDVKpqU.exe
  2⤵
  PID:15228
- C:\Windows\System\RMFZuCz.exe
  C:\Windows\System\RMFZuCz.exe
  2⤵
  PID:8108
- C:\Windows\System\WLMunlO.exe
  C:\Windows\System\WLMunlO.exe
  2⤵
  PID:13824
- C:\Windows\System\icLhHMn.exe
  C:\Windows\System\icLhHMn.exe
  2⤵
  PID:13588
- C:\Windows\System\LziukOf.exe
  C:\Windows\System\LziukOf.exe
  2⤵
  PID:2720
- C:\Windows\System\rJNJHxo.exe
  C:\Windows\System\rJNJHxo.exe
  2⤵
  PID:3944
- C:\Windows\System\trwfFPs.exe
  C:\Windows\System\trwfFPs.exe
  2⤵
  PID:13760
- C:\Windows\System\wgttFCr.exe
  C:\Windows\System\wgttFCr.exe
  2⤵
  PID:11964
- C:\Windows\System\nriHtAo.exe
  C:\Windows\System\nriHtAo.exe
  2⤵
  PID:5856
- C:\Windows\System\piabJzW.exe
  C:\Windows\System\piabJzW.exe
  2⤵
  PID:7836
- C:\Windows\System\MIarXJj.exe
  C:\Windows\System\MIarXJj.exe
  2⤵
  PID:12480
- C:\Windows\System\IfRgwvR.exe
  C:\Windows\System\IfRgwvR.exe
  2⤵
  PID:14140
- C:\Windows\System\rOFKhAc.exe
  C:\Windows\System\rOFKhAc.exe
  2⤵
  PID:12752
- C:\Windows\System\miymmUT.exe
  C:\Windows\System\miymmUT.exe
  2⤵
  PID:13624
- C:\Windows\System\ovyDoMo.exe
  C:\Windows\System\ovyDoMo.exe
  2⤵
  PID:12408
- C:\Windows\System\VdwoLfz.exe
  C:\Windows\System\VdwoLfz.exe
  2⤵
  PID:12248
- C:\Windows\System\ySJaExJ.exe
  C:\Windows\System\ySJaExJ.exe
  2⤵
  PID:12220
- C:\Windows\System\aJjzrZT.exe
  C:\Windows\System\aJjzrZT.exe
  2⤵
  PID:14136
- C:\Windows\System\pZHdRVk.exe
  C:\Windows\System\pZHdRVk.exe
  2⤵
  PID:14236
- C:\Windows\System\OPHgntc.exe
  C:\Windows\System\OPHgntc.exe
  2⤵
  PID:13576
- C:\Windows\System\vEmIIRI.exe
  C:\Windows\System\vEmIIRI.exe
  2⤵
  PID:4548
- C:\Windows\System\cHrcLuU.exe
  C:\Windows\System\cHrcLuU.exe
  2⤵
  PID:14340
- C:\Windows\System\sWidAKM.exe
  C:\Windows\System\sWidAKM.exe
  2⤵
  PID:13608
- C:\Windows\System\iDPGarP.exe
  C:\Windows\System\iDPGarP.exe
  2⤵
  PID:13164
- C:\Windows\System\RXRCHpt.exe
  C:\Windows\System\RXRCHpt.exe
  2⤵
  PID:8492
- C:\Windows\System\nHBekju.exe
  C:\Windows\System\nHBekju.exe
  2⤵
  PID:9920
- C:\Windows\System\hZufKui.exe
  C:\Windows\System\hZufKui.exe
  2⤵
  PID:1768
- C:\Windows\System\itqUvxP.exe
  C:\Windows\System\itqUvxP.exe
  2⤵
  PID:6148
- C:\Windows\System\fSnFfCn.exe
  C:\Windows\System\fSnFfCn.exe
  2⤵
  PID:7072
- C:\Windows\System\iZmYWVZ.exe
  C:\Windows\System\iZmYWVZ.exe
  2⤵
  PID:8948
- C:\Windows\System\BGVfmwV.exe
  C:\Windows\System\BGVfmwV.exe
  2⤵
  PID:10184
- C:\Windows\System\vomDQom.exe
  C:\Windows\System\vomDQom.exe
  2⤵
  PID:3544
- C:\Windows\System\MvXQvcw.exe
  C:\Windows\System\MvXQvcw.exe
  2⤵
  PID:2132
- C:\Windows\System\ybqJynV.exe
  C:\Windows\System\ybqJynV.exe
  2⤵
  PID:5936
- C:\Windows\System\dZIvOvj.exe
  C:\Windows\System\dZIvOvj.exe
  2⤵
  PID:6824
- C:\Windows\System\QilgMwk.exe
  C:\Windows\System\QilgMwk.exe
  2⤵
  PID:4836
- C:\Windows\System\FiBhZqH.exe
  C:\Windows\System\FiBhZqH.exe
  2⤵
  PID:8972
- C:\Windows\System\nizqqOZ.exe
  C:\Windows\System\nizqqOZ.exe
  2⤵
  PID:14288
- C:\Windows\System\easfinB.exe
  C:\Windows\System\easfinB.exe
  2⤵
  PID:13348
- C:\Windows\System\vDmQXAq.exe
  C:\Windows\System\vDmQXAq.exe
  2⤵
  PID:11908
- C:\Windows\System\LsoitWK.exe
  C:\Windows\System\LsoitWK.exe
  2⤵
  PID:13860
- C:\Windows\System\AkqolyN.exe
  C:\Windows\System\AkqolyN.exe
  2⤵
  PID:6852
- C:\Windows\System\ecrrbia.exe
  C:\Windows\System\ecrrbia.exe
  2⤵
  PID:10804
- C:\Windows\System\SxDSHKd.exe
  C:\Windows\System\SxDSHKd.exe
  2⤵
  PID:13404
- C:\Windows\System\NrzWuPu.exe
  C:\Windows\System\NrzWuPu.exe
  2⤵
  PID:4496
- C:\Windows\System\NBVdLZV.exe
  C:\Windows\System\NBVdLZV.exe
  2⤵
  PID:7908
- C:\Windows\System\PDtOagf.exe
  C:\Windows\System\PDtOagf.exe
  2⤵
  PID:12332
- C:\Windows\System\RIZxuxX.exe
  C:\Windows\System\RIZxuxX.exe
  2⤵
  PID:8172
- C:\Windows\System\motpzTL.exe
  C:\Windows\System\motpzTL.exe
  2⤵
  PID:12292
- C:\Windows\System\WjqQNYJ.exe
  C:\Windows\System\WjqQNYJ.exe
  2⤵
  PID:13908
- C:\Windows\System\EwDPOSa.exe
  C:\Windows\System\EwDPOSa.exe
  2⤵
  PID:13924
- C:\Windows\System\ZkVaQYz.exe
  C:\Windows\System\ZkVaQYz.exe
  2⤵
  PID:4416
- C:\Windows\System\njNTjwF.exe
  C:\Windows\System\njNTjwF.exe
  2⤵
  PID:6616
- C:\Windows\System\vHqEogj.exe
  C:\Windows\System\vHqEogj.exe
  2⤵
  PID:13772
- C:\Windows\System\LXWeznc.exe
  C:\Windows\System\LXWeznc.exe
  2⤵
  PID:13820
- C:\Windows\System\mnqnIDF.exe
  C:\Windows\System\mnqnIDF.exe
  2⤵
  PID:7472
- C:\Windows\System\VLGjTMI.exe
  C:\Windows\System\VLGjTMI.exe
  2⤵
  PID:13828
- C:\Windows\System\mnIFjfC.exe
  C:\Windows\System\mnIFjfC.exe
  2⤵
  PID:712
- C:\Windows\System\bSCwiVM.exe
  C:\Windows\System\bSCwiVM.exe
  2⤵
  PID:10012
- C:\Windows\System\icynjhV.exe
  C:\Windows\System\icynjhV.exe
  2⤵
  PID:9552
- C:\Windows\System\YtZUPZr.exe
  C:\Windows\System\YtZUPZr.exe
  2⤵
  PID:12616
- C:\Windows\System\MFEkKIY.exe
  C:\Windows\System\MFEkKIY.exe
  2⤵
  PID:8824
- C:\Windows\System\hKsxdmu.exe
  C:\Windows\System\hKsxdmu.exe
  2⤵
  PID:14112
- C:\Windows\System\zchlKxk.exe
  C:\Windows\System\zchlKxk.exe
  2⤵
  PID:12696
- C:\Windows\System\jnJoczi.exe
  C:\Windows\System\jnJoczi.exe
  2⤵
  PID:9164
- C:\Windows\System\IjKPemt.exe
  C:\Windows\System\IjKPemt.exe
  2⤵
  PID:7760
- C:\Windows\System\TwQyJaK.exe
  C:\Windows\System\TwQyJaK.exe
  2⤵
  PID:3792
- C:\Windows\System\ZkwePuJ.exe
  C:\Windows\System\ZkwePuJ.exe
  2⤵
  PID:11552
- C:\Windows\System\IONCeUN.exe
  C:\Windows\System\IONCeUN.exe
  2⤵
  PID:6724
- C:\Windows\System\lXBttEc.exe
  C:\Windows\System\lXBttEc.exe
  2⤵
  PID:9592
- C:\Windows\System\FtoFVDW.exe
  C:\Windows\System\FtoFVDW.exe
  2⤵
  PID:13324
- C:\Windows\System\FlwjWcI.exe
  C:\Windows\System\FlwjWcI.exe
  2⤵
  PID:11400
- C:\Windows\System\MHhdyvH.exe
  C:\Windows\System\MHhdyvH.exe
  2⤵
  PID:14908
- C:\Windows\System\WSrvSKU.exe
  C:\Windows\System\WSrvSKU.exe
  2⤵
  PID:9368
- C:\Windows\System\RITBnUv.exe
  C:\Windows\System\RITBnUv.exe
  2⤵
  PID:13420
- C:\Windows\System\dAxjtUn.exe
  C:\Windows\System\dAxjtUn.exe
  2⤵
  PID:2352
- C:\Windows\System\TamVtJd.exe
  C:\Windows\System\TamVtJd.exe
  2⤵
  PID:9184
- C:\Windows\System\RfioIpU.exe
  C:\Windows\System\RfioIpU.exe
  2⤵
  PID:8712
- C:\Windows\System\khvFsGB.exe
  C:\Windows\System\khvFsGB.exe
  2⤵
  PID:11596
- C:\Windows\System\WaBqQbM.exe
  C:\Windows\System\WaBqQbM.exe
  2⤵
  PID:13424
- C:\Windows\System\qxxkTBx.exe
  C:\Windows\System\qxxkTBx.exe
  2⤵
  PID:4812
- C:\Windows\System\NIGiNKO.exe
  C:\Windows\System\NIGiNKO.exe
  2⤵
  PID:9264
- C:\Windows\System\bDdlujq.exe
  C:\Windows\System\bDdlujq.exe
  2⤵
  PID:4552
- C:\Windows\System\egcgKiM.exe
  C:\Windows\System\egcgKiM.exe
  2⤵
  PID:13508
- C:\Windows\System\fhfvBuH.exe
  C:\Windows\System\fhfvBuH.exe
  2⤵
  PID:5124
- C:\Windows\System\KMxUHRd.exe
  C:\Windows\System\KMxUHRd.exe
  2⤵
  PID:8496
- C:\Windows\System\yPOvNNF.exe
  C:\Windows\System\yPOvNNF.exe
  2⤵
  PID:11428
- C:\Windows\System\nbFlKsh.exe
  C:\Windows\System\nbFlKsh.exe
  2⤵
  PID:15200
- C:\Windows\System\cfelVAf.exe
  C:\Windows\System\cfelVAf.exe
  2⤵
  PID:5152
- C:\Windows\System\bubXeTk.exe
  C:\Windows\System\bubXeTk.exe
  2⤵
  PID:5260
- C:\Windows\System\ppiwgIm.exe
  C:\Windows\System\ppiwgIm.exe
  2⤵
  PID:10452
- C:\Windows\System\NviDYBj.exe
  C:\Windows\System\NviDYBj.exe
  2⤵
  PID:12136
- C:\Windows\System\vhSxqGh.exe
  C:\Windows\System\vhSxqGh.exe
  2⤵
  PID:13684
- C:\Windows\System\tpHSqIO.exe
  C:\Windows\System\tpHSqIO.exe
  2⤵
  PID:10624
- C:\Windows\System\xSpABpL.exe
  C:\Windows\System\xSpABpL.exe
  2⤵
  PID:14688
- C:\Windows\System\ttcVNkp.exe
  C:\Windows\System\ttcVNkp.exe
  2⤵
  PID:14036
- C:\Windows\System\raxrhVR.exe
  C:\Windows\System\raxrhVR.exe
  2⤵
  PID:13184
- C:\Windows\System\TMSEVbi.exe
  C:\Windows\System\TMSEVbi.exe
  2⤵
  PID:9968
- C:\Windows\System\bVkHxLZ.exe
  C:\Windows\System\bVkHxLZ.exe
  2⤵
  PID:10292
- C:\Windows\System\DHCSVsP.exe
  C:\Windows\System\DHCSVsP.exe
  2⤵
  PID:8028
- C:\Windows\System\azFahfr.exe
  C:\Windows\System\azFahfr.exe
  2⤵
  PID:4504
- C:\Windows\System\sMGFjGY.exe
  C:\Windows\System\sMGFjGY.exe
  2⤵
  PID:13680
- C:\Windows\System\jglMhwr.exe
  C:\Windows\System\jglMhwr.exe
  2⤵
  PID:12412
- C:\Windows\System\OYchkur.exe
  C:\Windows\System\OYchkur.exe
  2⤵
  PID:2432
- C:\Windows\System\PNjwbAG.exe
  C:\Windows\System\PNjwbAG.exe
  2⤵
  PID:9800
- C:\Windows\System\YFvrKPZ.exe
  C:\Windows\System\YFvrKPZ.exe
  2⤵
  PID:5992
- C:\Windows\System\pJTMaCa.exe
  C:\Windows\System\pJTMaCa.exe
  2⤵
  PID:14152
- C:\Windows\System\hUpLmMy.exe
  C:\Windows\System\hUpLmMy.exe
  2⤵
  PID:1364
- C:\Windows\System\XHSIuZX.exe
  C:\Windows\System\XHSIuZX.exe
  2⤵
  PID:8388
- C:\Windows\System\VRiYDNs.exe
  C:\Windows\System\VRiYDNs.exe
  2⤵
  PID:12024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a5clbykm.sa2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BReckWs.exe

Filesize
1.2MB

MD5
6b5bacef15c08e018cc1eaacbcebc96c

SHA1
fb47b948f8e510c60d8343b118a6d1ff60625fae

SHA256
d0a451c49555053f526cef911df45df330d1a2b49374b21de80f7d4c38038fa3

SHA512
6c450581b18cf59202f83ce0531a9b96928c7f101311f350433b7bccda2d8ba1783813908303d48fcb171cb65b93cc646e8da3ddcc461ca82c88a3ebb0693301

Download Submit
C:\Windows\System\BWufGEI.exe

Filesize
1.2MB

MD5
6bdb2b8b2c19708feff4d66dcc1738c3

SHA1
b0ae50959c48091ef521aa623679ac11f409020f

SHA256
103990b14aac557be401a08c5d935f4958414580bfbabd0343d0ddb6aa0992d5

SHA512
050cd69eb6da3930271aa8029f0514fc47524d1880beaebf44f4ada83794d6925d8ec5c32ae2509c97d91cd3aab50abd68d12f52303ab57666e7ad71729c5089

Download Submit
C:\Windows\System\HkFNthS.exe

Filesize
1.2MB

MD5
4d3d85b59c844fa3571b4f623d81e1b0

SHA1
b235e0f71bbf9df96a027b31d188dc69155b82f9

SHA256
82108ee3ee270d3b5e4d459776e02940013dfc96f56b60c56179e1f1d46a3cc5

SHA512
51b55c467d084b3b04dfbd6ebec0c05b79dbdc897165466a11ad23d3880e4775475455499ff3ec27c01d908f96a58d3e49ff00b7161c04ffcec24907a40e2237

Download Submit
C:\Windows\System\IJekLss.exe

Filesize
1.2MB

MD5
4f302a14756b905a579492e0eb10de50

SHA1
5c32899ad1d2f4a1b169b980ea8963dac62f7f78

SHA256
4075c047d61a2b03c9274caaf9a0e9983baf4675602138c136ac70367701f8d4

SHA512
64bfe2b7c4788b15cadc6f93c7ad8ce24a51222faeaf142610de2298f83b1b590b6f7f4aef4107103c20d401424decf63b3180c318df5da36b25412993a75aaa

Download Submit
C:\Windows\System\IrRaXjW.exe

Filesize
18B

MD5
62e737fa5bfcc7aae2c944fe6887f795

SHA1
b32af7867b93d4fc848b57818ea90a4241da9175

SHA256
bb7e708c153eb4a5a7dcdf499640b7784cdd33e6b604449b9e678d67347dabf6

SHA512
0d2ad93062677bad677b18b889b8ecdce36884304efff9cccc54248b3f61a0da4a26f00e9f26b8f87a50dfc722e6a3521d25202821fe229cb80378cfe84bbdbf

Download Submit
C:\Windows\System\KWTjAYa.exe

Filesize
1.2MB

MD5
ec4604cc689ee88c12989e007aba0ca5

SHA1
e094dd31f594a5b52a4b5825bf0e979489d597da

SHA256
f8245976c617a1384b378ffa610a72ef3aa96140cc9928e268e0e7f1c8128e3b

SHA512
611c5dd1ced29b9ed9edc957c4580bcf5765ac040df1435e6ebf9926fdf288870c35514e00877528ca2dc115cb168939be22c6bc14c596a40968176445fdb515

Download Submit
C:\Windows\System\LCXDLTZ.exe

Filesize
1.2MB

MD5
181484cdbc48327abeb575ca17aa2855

SHA1
c8b330c7549b3ac1387128655fd1f8a9d2508b40

SHA256
4b65ccd2983aeed783c72a60c8dccb4e48f2abd1290c6246ddd68ba28aa9d336

SHA512
466f95a2d6ce3d66491ee73202c23f2c590d0ecb5c1985f85cd4fc5c6f1c1a3e543d963f1427f4ab0c259894c5f9ce44ce9d1f6afb71fd5d556a102017682f3e

Download Submit
C:\Windows\System\LrDKfrE.exe

Filesize
1.2MB

MD5
eb7c32c98b8e585f28336c4d64470ff7

SHA1
65fc91c5015d7d09d117f72f043d545c6b68f87e

SHA256
e438607cd8db12669d7edd0a4c89dbbf7c05414d268414b0a457a08588574178

SHA512
55aafa0250bade684dbcf63554223402ab428b41fb6b2953a0a07f08f28a3cbf6f1e521dee75cbe62e97a3dfac388c7c9b8bbde969af80187943dacbdebc2576

Download Submit
C:\Windows\System\LuzBeqa.exe

Filesize
1.2MB

MD5
1b3b419adec97aeebbdde022b0832425

SHA1
822f7d04e1b3cc35c9a76d8730a395958c1ad406

SHA256
c6fa1a33088365d112d6d1ec80ce0d6a20cd281502ce6345392af16ccad30255

SHA512
71b7aad32b785071e258219d9db46c9d333f97756aa9aec6e9940178eb555feb8f24b259ebcc72aa1abf8018f5eca069d10be3f2f570be5f06ee06da7c88aed0

Download Submit
C:\Windows\System\MHWqTrH.exe

Filesize
1.2MB

MD5
998e17728c4e50b4aba22e47d15596ea

SHA1
158c85776ff38caad439435a73a7c7942f53a23d

SHA256
4116980de7c13eb7db1f3bba3795380cf82c90a3faff89bcf921914c98d4f78f

SHA512
b00ad77d43386cfb5c11cd252c96b761a880e17fead7d4018d7c38abe451c2a14b018e540dfce032c6d53ca83041da48a8bedacb551dd4d7008162fc157820a1

Download Submit
C:\Windows\System\MMwwNuB.exe

Filesize
1.2MB

MD5
29e2390253c8612acb8c25325de961d4

SHA1
32f4f4613201c3b2c57b6687b58e1ab4874e94b4

SHA256
32f26c1aac1b1f0e2223a39cbd462cd741ef3e28a2c596607b86f6de4634d843

SHA512
bdd93b220507a4d98d1fcf53d97aacedb9dd0c3e96db374869fc547cfded92707c7dbf9525e7d24d2eb901a6be095b86e9639fea367b9f2ead05b547b24777bd

Download Submit
C:\Windows\System\OzpvanF.exe

Filesize
1.2MB

MD5
fbcbaae05a398d2ed7b87a87987fbed8

SHA1
b8e8c0f346c05a5fe126dedbe9b0aafc24855286

SHA256
816c319ad5cff89ff169b48497c1b90c568073bf81cc7eb31f421a13b00e463c

SHA512
e897cee0b4418df0bdbe92df921301af1782bd268ef54c108a3d82f09267c47b091b603faa3a8815379bfd40a72aed366bef53b056c934238ac5d9812a715dab

Download Submit
C:\Windows\System\PvKAaRB.exe

Filesize
1.2MB

MD5
e954196525825d8528fe6292dc49e9e6

SHA1
c88d52cd0e0ca379f7c19d9d6c11e004f9292c6f

SHA256
ae6d52b11345f123d832ffdb077a0d9cbaef463edb9efccd5df164b5c093fca1

SHA512
9be0a46f33a19a2af830d36ee11e8cc5b9aaab0cfedc754f82409daa779645029adc30b8689ccf8285ca35c525e1ec7492c56072a76ff66a5d80a724bcada116

Download Submit
C:\Windows\System\QIRJEwG.exe

Filesize
1.2MB

MD5
7aa93584f7da5c5939b4f96cddca939a

SHA1
4c6a238fa8b46ea3a62e719b4bf7bba4feac7467

SHA256
188d26fa07a0469e55fc979e95052ca217e9641ea829783243ea8ef66df9d0f4

SHA512
18e1d6e4606f390619cc6ace138293bf927590ad5f8c60c4865b6e798673efd0dbf74140ebf54ba680ca0ecb3fd42bc6c5266dd136e4f153fcfeb5badc88b272

Download Submit
C:\Windows\System\QncOLkt.exe

Filesize
1.2MB

MD5
aee6b57451f4e85ecf7a36d0c4c99e3c

SHA1
a6f783f937718c25c10b2ceb4e60600966fa22f6

SHA256
8d52101a1d0170a68c43b70e1da78b678ce1eb53faa856ebf676ed21887372c8

SHA512
d7efce8bfd6e28e3554cebcd67e5901ae3896690ed71b1355ec663f3ddbf2e51fc2b1bfbb3eeecebf3cac77a250cf8871c3b1065bc7c09597af06c411ac54000

Download Submit
C:\Windows\System\RCfRkXb.exe

Filesize
1.2MB

MD5
f79d089ba249a4e5ec3a26c15a1941ae

SHA1
40c0bdd042f599708a6fc8809f7e77dc47e3fcd7

SHA256
e8ce7ecbc46e9feebdb85da976b64156e01b90ffdc2ba0169bb9b4437d9bf410

SHA512
d9afb00a494bd64980911aee25978138ec26ccadd4945a938e0e48e6030eb364bed19afe7b47e33e2a101f50ff129c9f402d5300e52c5f700f5344a4badcea50

Download Submit
C:\Windows\System\RWmbJEk.exe

Filesize
1.2MB

MD5
47607a69a4d8cf562dac224643678234

SHA1
5430a807496348a9fe07d412c0511575d10d1cd8

SHA256
3410e916308955acfe8d812410eb4813a7478423e8979a1174a364f999ac34e7

SHA512
5f7c6f0b98605434a9a6cc88810ed37c3949250d038ca7f29797203cc55fc80f44a469d955ef2500a86e0282f861a169719d56afc37fb1bd96a9f36ddcf71b12

Download Submit
C:\Windows\System\SlzoADt.exe

Filesize
1.2MB

MD5
361673bb31fbf17fcc6717e64508c569

SHA1
c244db49e3e6a54596cac39b1e8c3a5fea23ad06

SHA256
8da93c5a48ed222eab221a13d6078564d66ca65b697f140707e945fb20baab09

SHA512
c394699b73e73540f524c782c36aefa8cbab931367dc37faef130347c50cb0c1baddb9b62c44c20aed5c6b6cbd2b73c1ba91f5d1b1bbd1590d51dafafe124e6a

Download Submit
C:\Windows\System\UGgZMqx.exe

Filesize
1.2MB

MD5
b670b6a8cdeedb25b1985371863d203b

SHA1
b3720be4a4c84930b6b728660938a8ca71e29199

SHA256
d8203984967f0ae3499ca764399aa88469f65604efb5b459abdeb44caa28fde5

SHA512
a3f9c737ef92913e040c179cd6e6e74115825b42b3e68a8fc8658146f0871c04ffbea3962c4fc88ec153c419226d90df0356ecb691e7d642092bdf87074c3006

Download Submit
C:\Windows\System\XMIJORe.exe

Filesize
1.2MB

MD5
d2d3baff38d2677e9571072cb3267fb2

SHA1
027eb3eccd54f11b2b0e0ac4847082bf054183a4

SHA256
11d353fa4ff5997c517169667405b09504254e145177f9e3c592a0f53f383528

SHA512
78c3206753babbabd7c4bf53815edb42c0d634d7847d7bcc29bbe36aa420e933d33a661c400604e09cfc0f6f36b005334848f17f6179b067d99df331b621eeab

Download Submit
C:\Windows\System\XkqjTWC.exe

Filesize
1.2MB

MD5
2586abd369f55195239fae3d92c69c04

SHA1
26604ef7907d3cd253c25f287e775a5ae0417e72

SHA256
adcd106ce51873fbebedbb45c63aa45466703957c1c73a4f062ddc374f61312a

SHA512
e33f33460531b097735a74bd36253dcba79d16ccca3030c69e3eb8c078d7001530788e282be2bc4a5b74cad5f36d14e4dbdc86c9e1fec1eddf315313027b0375

Download Submit
C:\Windows\System\ZKFvSac.exe

Filesize
1.2MB

MD5
b295cf2b1935ba2f759c9fb475dcfe57

SHA1
e3baad78f2e8c1435d83235f2fbfd62a81b22a81

SHA256
f2c6f797bcec999e0e7ae2eac7f9db53c5463fe79dabdd571e81c95d96146e94

SHA512
af9b293542bc5e795ca71563abb90a91c845b14402cb42a3538a2ff55881b58edad396d5045cfcace033b963ab4d288eed21ee70545d509c8af650f02fbfd13a

Download Submit
C:\Windows\System\aFSwgsi.exe

Filesize
1.2MB

MD5
840ee5e66677d87be7122cc96b25ad16

SHA1
5afac002ec88fd2abaa0207dfe5c7adc487486f3

SHA256
34b219979c8062ee80d3c75d0118fcdcfa1be85945baed0961e42972ea33ab1a

SHA512
234d520ab60d13fca7aa789cc2d797a3eedbb1f9044cab4769f990672ea81bc9687a84502591bf9c42b2758f7b4e0cb89dbc33fd66951f366a4e525cfc9144f2

Download Submit
C:\Windows\System\eeJGRFZ.exe

Filesize
1.2MB

MD5
608305339539c9090ccd363e4f37d8bf

SHA1
5e4ed27269b298a5b504213110ed1f08bdb13af5

SHA256
7c28a3d8a319978e4e4e479fa6e9c4b7abf05b5125cba24e31fbc10f8f16f0ad

SHA512
49213a09f62ce2ee39cfe15502add4aaea8c63ec746b8813d291d3b79a4eb00c21ec6df4165c0cce5524c60874b50a10757ef4b749a64071601527d3f59cb3c7

Download Submit
C:\Windows\System\epERBhL.exe

Filesize
1.2MB

MD5
570406d08406369b8f7b755577dad55b

SHA1
35c4802f4f1813a569a733827543a9de6731dc2c

SHA256
5b9ccb19e0ab0bcf48a619b842a2cc6d8357756b23b4059566b68656762ef1b7

SHA512
b38028838affe9e28deb4077ea404340b2e0ea01ecae20f65a57cc8eed84e38d88a09d3f0d045180219953d4421eabd15efcb6d5eb4a1dab12d58ad11c16649e

Download Submit
C:\Windows\System\ftXFJHQ.exe

Filesize
1.2MB

MD5
40b7501dbb1e5eaf1e71f990f8aa0307

SHA1
fd994170cb93ff0e759eabbc51dfb0c07100472e

SHA256
4d59cbb54a1301045a9970a5923d0cf698e492357eb983836b83d07bbc3d333c

SHA512
6d3e05dd21cab10e49711ce2e6308fba316994a70b94f6c783271a1ca3e9ca2856f91ccf5365f48db76120d75b6f92b711b5b46b4a10ee9ec168f7dac7b404fa

Download Submit
C:\Windows\System\gAtCdAX.exe

Filesize
1.2MB

MD5
a38986e13ebf2df84e24407be5ba9943

SHA1
d631886de116437b2ae62dea6c0ac62e171635a7

SHA256
093a69acdef5aa67f0363770583241389307938f49191820679fbbe4a88a90a4

SHA512
140032b24d234a76aba2c80780d91ff0c4793e958df3adc9458a2ce1241389b60e283ef5e4a9c8ad919a042b8fff2bade432f184f7629665b50a7ee7f2d34cb4

Download Submit
C:\Windows\System\gVyXlNG.exe

Filesize
1.2MB

MD5
6fc49c1a996174c3eacf6dbe3431d7df

SHA1
355cdb50ffdca41417a0f30048588e89ee1c1cb9

SHA256
c36419e8e34343461ecb9204cf57441a275ea33d3947a110dcf7a0196642582f

SHA512
8ce71eeffb7aadb5392b28d3fe37237374c06429dd037d932067974444056efd141f317f880bcca875097aeca4f83aad884f0deed77db4a2e5a83c4e4658f4f1

Download Submit
C:\Windows\System\jbvjETN.exe

Filesize
1.2MB

MD5
50ac361f75ad2c1c06e2a41ab382033a

SHA1
a872d19c4b9d4370020b7a072a4c9550172103aa

SHA256
d114b3adb03a22b7239f15f92797881a5e49b0fc37b1c8521a6119619dcdbc21

SHA512
6b7daf9b1e2f19d84965d05d73107efdde35e681fd90455b04bf6afe3bb18d839a812a706b3f381a86980cd5674dec260923b2bb8dc55222d5dc28111b7b5716

Download Submit
C:\Windows\System\jvfDixy.exe

Filesize
1.2MB

MD5
3e2df24b37884d9238f41b479a6db6b9

SHA1
0634f0dae3846e3cfcce1e6b6e36cce7a749a6cc

SHA256
347f5b5a05ada9ae6780bb66b964b3dda16f259e258075c7227c971e44468d10

SHA512
d674a69482aed06d2c10a03ae2a0d8dbf2f4b7c5bf5cd1edbaf064fd022c68666cb2ad125bce7622293e6d5b3be4c161409c723314a79db1664d06200d40dddb

Download Submit
C:\Windows\System\kgmdMYA.exe

Filesize
1.2MB

MD5
0b26b2a8c5d9d73dbb5871f360a90194

SHA1
dc46cd08fc2c898880d2684c24649a459f1d5d82

SHA256
42eaf9c2c62a426547ef79263a87363c0f0fb71cd689e7511df5b08d011817bf

SHA512
fdb4c95ec7f4c38d3f1cef38f0f70c646e99e35f96dadf34c5a385a3ad2a67db38829e3a5916b88184d5403989dea6dd670f6aac16beba6335c6321b49691717

Download Submit
C:\Windows\System\lOlwwhf.exe

Filesize
1.2MB

MD5
4ba0ce8a04d1318cbc1c4236caacf44c

SHA1
fce76fb5b346b04333122a0cccee7ebc27d115ef

SHA256
cf1b1bbb0365d33580982df42d01ebe65464361bda93561dfb44af162ef024bb

SHA512
cab150a2349451233066629f15d4ea3357890e8f56534f0d38cb1341122498464539f50d4d7d05d3f416c0c6af22775c8151c009ff41b6dc5c97f62d81d3efb1

Download Submit
C:\Windows\System\mkUAiJy.exe

Filesize
1.2MB

MD5
307d171c601c94ddeecd522659f1fb35

SHA1
61ca8dfd86e8c47ef01f26bf4b7f5b5bf3a8154b

SHA256
f2eeae2d8a33c07c081ed10d9c25b18b3f4f806ff8988cdb6a2483c25875d60b

SHA512
6ccdbbdafff808e83040cbb97fdaf25d3da67cd8b043763f647cea2afbe86e7fe9c83f3a081c9f974415be3dbb277cb86323d24357569ba13134978c94d1ba53

Download Submit
C:\Windows\System\oLrMmgB.exe

Filesize
1.2MB

MD5
8c8e9864110f21660f7879ffc399e768

SHA1
b9fa986acf254497b9820c847c4522b93211d5ce

SHA256
5bbafddb6aca814b82bed27a0bf29816e17e295a4e1a89e2b00c43468f37431e

SHA512
f3242ae066479356c05ff12999eb14e382444119b293acd033bbf2d9d01608fba570a7e18d8f066c7f80e5482d3b3dc3f2de747bfab5ec0ead89efc1f726d214

Download Submit
C:\Windows\System\pqhCDVd.exe

Filesize
1.2MB

MD5
3b79e4cc39e66103e1206f93b7eb2b27

SHA1
fc8d59d7d1d9461640780ceaac77a2c758888a58

SHA256
a020a75429a0f9c5b03388ffa949d6e61207937a984d3bce1cfa9f812faa18ac

SHA512
0c42358530013906ca22179d13993067c821484e1ce4a3ab0430b5186d060c261566d9cd96a38b2a3e4bc396da0b987828ebf7c24aee24bd95be253b925d8cec

Download Submit
C:\Windows\System\ptGFaTs.exe

Filesize
1.2MB

MD5
047e4c3e71ab5dece9eff5283c185160

SHA1
4f3868dfb2cd9e72393f0b7d1c0ad817f16b2621

SHA256
948568447e00e4657e46947817ec5297190ddbe4f85817b55c1b5b8e61dea603

SHA512
8ed171a1dd254c8a36425e580696109f8ba1d3c782ce6c09b9f2f81dfedaba2fa33e956328a2edc61004b008016f44c926b183548a368851057e09569bf00ca6

Download Submit
C:\Windows\System\qbQbUSl.exe

Filesize
1.2MB

MD5
85f2970a72fa83ffd825e03f264a3609

SHA1
bf1cf47588e7237fe95e79b74f2a98250bffae87

SHA256
07072d1225436ed53bdbd2f55ff0b56e51be4a64c54208da5175d0388b569f74

SHA512
5fec136d783c6b8f05521f41b512bde208dc734aa0cbb03753b515a4afa81e768e2e11a464e1902f5e29a14d1f673a705e0c2182b36f1bcba9b79f68a21d23c1

Download Submit
C:\Windows\System\rliqXTA.exe

Filesize
1.2MB

MD5
b2f361991447ba7b94d6b0cb2e49d7b1

SHA1
09cd0e3f392dfa52711bd323e9bf4d4f1a17f13d

SHA256
3766b3a540785c0f7f2948a47d67ed3605a77e1a6fa70da242e4a7d1ab79db4b

SHA512
f7c8a960b8695502785ab7a66730046b6d4ee099ff187200ca9cfb5c028da58cdc825a6ff6caa3a1002b1ec7e88895bf3b60464361f7d12cd8131844bd73e5c8

Download Submit
C:\Windows\System\srndgJY.exe

Filesize
1.2MB

MD5
3ba7ac9a13586c549fba49813d7a8d33

SHA1
f4e96e12caad7f2917d9118e9c39f3fc3c6759df

SHA256
d19c4d2e4e207cd8e8d73cc9863a4ea3b47574608ee1342daf99c608e8c2b7ba

SHA512
b286f2d7811958da715926e8512eacccd17f351d69553fd07cf9d7ff3794da2c42e9b9044a0be361c333eecbd878ffacd31e52ffc759fe8471c5ee112fb52713

Download Submit
C:\Windows\System\uXNIgiB.exe

Filesize
1.2MB

MD5
2181fe8423edf991130b3d67ab656244

SHA1
a79bb31de6f953c3d42bb56b2488dac68be89b5f

SHA256
51fdb166a6e202282f6f487aa8111c608c097bf869c4c2281fc72049f3efeddc

SHA512
f0484a386fe653eb80c3d9d5494b95e9634fbdce2b84933a9f7087c9afc80543885fe4aef31398a35b382eec3e3253d74c0d8ecf426717d735a0bc7218a2b8b7

Download Submit
C:\Windows\System\wsfFMFv.exe

Filesize
1.2MB

MD5
bfcc1f56f33b47183206451eea5e2864

SHA1
d99054ac14ece1eff2e70b02489dc5a674839abe

SHA256
2936e91f274f271ce87a0336d57aac232cd2fd588adb10143866bbf094e7fbd2

SHA512
7ca7af788abc74863ec21daecf257f8b51f544eb7dbc6924c27e173aa1a1d7b15645426c58fc8f688ca133774322bfd7d3afb099e1b2f61c9408aba1ee4b53e8

Download Submit
C:\Windows\System\wvXbHbR.exe

Filesize
1.2MB

MD5
250103f3f9c7b1219e9f4c3d1974ffd4

SHA1
722f3e42f61d3b14da860c15668800027f48d1be

SHA256
8ab56062d173226d9e1c23372dae49fbfe4f19fb057dbc7678ddf8d9a1107df1

SHA512
bd462a4a1f91d98092961f732e1338d742813cbd98483357a75f546ea5b4739b322e64e3c41050b4359d7907134a5617775620f39e8799b2e18b06965fa1c468

Download Submit
C:\Windows\System\zQwyMUC.exe

Filesize
1.2MB

MD5
3bf7e5f4f8dcaaf9f0e8bb000860732a

SHA1
7ee13ee3ded80b8a17139279be98306adf0cc7ad

SHA256
1d8a81839a6f25428a9ad3cbdfac48f9eb5e624604bfe64d691f2513ea8a2c02

SHA512
4f19bf0f0e74f69d9dfc244fc7da0a9f319c32496c7bca0b52d22dd9c89d80201bdbd6ef5c754311952b1d0c1fe44b74761a44850bfcf78e52b076c2e6b5c705

Download Submit
C:\Windows\System\zbyCXOW.exe

Filesize
1.2MB

MD5
86bd1856e35ca1aac548bc5a60745b0e

SHA1
0e10538eeec6470ec9d912a0af4bc9db00ace533

SHA256
49e5a3370e9b6218710dbb82413a9ef63b771c34e98ea3e653e59535c1bdaf44

SHA512
6f37b42fe143f59365c50925e3c6888b86597a00bcc05338728859bcc698e4d628231b8a9486eb0e0a49241765d2b6e521e54d14fe9f243a10c4064b77074469

Download Submit
C:\Windows\System\zdqxwmc.exe

Filesize
1.2MB

MD5
406628465ef7576d67bd1b436fa26509

SHA1
c0dc346ea21e3b52983a5433e9637206cb9316c7

SHA256
e1c3c199a85a420ac00f3d51e6018d15c6167ded1fce5a66e2d0e6867481405d

SHA512
c178fa4bcb535706720a61b5bd2fb7fa82f7481ca5569f4e72acbe784d15554498158ac7108fecad5ee38f26adb3346777939ae117050cf7bea138874373084b

Download Submit
memory/636-6231-0x00007FF782960000-0x00007FF782D52000-memory.dmp

Filesize
3.9MB

Download
memory/636-924-0x00007FF782960000-0x00007FF782D52000-memory.dmp

Filesize
3.9MB

Download
memory/756-6024-0x00007FF615420000-0x00007FF615812000-memory.dmp

Filesize
3.9MB

Download
memory/756-923-0x00007FF615420000-0x00007FF615812000-memory.dmp

Filesize
3.9MB

Download
memory/952-914-0x00007FF7B7810000-0x00007FF7B7C02000-memory.dmp

Filesize
3.9MB

Download
memory/952-6229-0x00007FF7B7810000-0x00007FF7B7C02000-memory.dmp

Filesize
3.9MB

Download
memory/1240-158-0x00007FF7DBC00000-0x00007FF7DBFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1264-920-0x00007FF71D740000-0x00007FF71DB32000-memory.dmp

Filesize
3.9MB

Download
memory/1460-6244-0x00007FF6A0BC0000-0x00007FF6A0FB2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-919-0x00007FF6A0BC0000-0x00007FF6A0FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-13-0x00007FF7CDDE0000-0x00007FF7CE1D2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-2557-0x00007FF7CDDE0000-0x00007FF7CE1D2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-918-0x00007FF704C50000-0x00007FF705042000-memory.dmp

Filesize
3.9MB

Download
memory/2276-6510-0x00007FF704C50000-0x00007FF705042000-memory.dmp

Filesize
3.9MB

Download
memory/2504-909-0x00007FF7D2C90000-0x00007FF7D3082000-memory.dmp

Filesize
3.9MB

Download
memory/2612-420-0x00007FF69CEA0000-0x00007FF69D292000-memory.dmp

Filesize
3.9MB

Download
memory/2612-6262-0x00007FF69CEA0000-0x00007FF69D292000-memory.dmp

Filesize
3.9MB

Download
memory/2676-0-0x00007FF7197F0000-0x00007FF719BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-1-0x0000025803330000-0x0000025803340000-memory.dmp

Filesize
64KB

Download
memory/2676-2551-0x00007FF7197F0000-0x00007FF719BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-155-0x00007FF615440000-0x00007FF615832000-memory.dmp

Filesize
3.9MB

Download
memory/2788-915-0x00007FF6961A0000-0x00007FF696592000-memory.dmp

Filesize
3.9MB

Download
memory/2972-6505-0x00007FF778590000-0x00007FF778982000-memory.dmp

Filesize
3.9MB

Download
memory/2972-922-0x00007FF778590000-0x00007FF778982000-memory.dmp

Filesize
3.9MB

Download
memory/3444-304-0x00007FF60C250000-0x00007FF60C642000-memory.dmp

Filesize
3.9MB

Download
memory/3500-229-0x00007FF7F1A80000-0x00007FF7F1E72000-memory.dmp

Filesize
3.9MB

Download
memory/3596-6129-0x00007FF747380000-0x00007FF747772000-memory.dmp

Filesize
3.9MB

Download
memory/3596-921-0x00007FF747380000-0x00007FF747772000-memory.dmp

Filesize
3.9MB

Download
memory/3868-575-0x00007FF603DD0000-0x00007FF6041C2000-memory.dmp

Filesize
3.9MB

Download
memory/3896-912-0x00007FFF28350000-0x00007FFF28E11000-memory.dmp

Filesize
10.8MB

Download
memory/3896-15-0x00007FFF28353000-0x00007FFF28355000-memory.dmp

Filesize
8KB

Download
memory/3896-2781-0x00007FFF28353000-0x00007FFF28355000-memory.dmp

Filesize
8KB

Download
memory/3896-110-0x00007FFF28350000-0x00007FFF28E11000-memory.dmp

Filesize
10.8MB

Download
memory/3896-981-0x0000022648CD0000-0x0000022648CF2000-memory.dmp

Filesize
136KB

Download
memory/4040-773-0x00007FF644270000-0x00007FF644662000-memory.dmp

Filesize
3.9MB

Download
memory/4144-415-0x00007FF661B20000-0x00007FF661F12000-memory.dmp

Filesize
3.9MB

Download
memory/4788-913-0x00007FF71B690000-0x00007FF71BA82000-memory.dmp

Filesize
3.9MB

Download
memory/4840-777-0x00007FF64D810000-0x00007FF64DC02000-memory.dmp

Filesize
3.9MB

Download
memory/4888-309-0x00007FF607520000-0x00007FF607912000-memory.dmp

Filesize
3.9MB

Download
memory/5056-917-0x00007FF69D4D0000-0x00007FF69D8C2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-916-0x00007FF6FF9B0000-0x00007FF6FFDA2000-memory.dmp

Filesize
3.9MB

Download