xmrig | 9a973acadcedb870808cd6357a99853107e26d70d4a65fd388ecde2de3e1ed0d

Analysis

max time kernel
120s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9f2c1bf066ba691b543a85501ac0a50N.exe
Size

1.6MB
MD5

e9f2c1bf066ba691b543a85501ac0a50
SHA1

f9a23bab941d81aa4dfb6fbbd6706cc9690dcd6f
SHA256

9a973acadcedb870808cd6357a99853107e26d70d4a65fd388ecde2de3e1ed0d
SHA512

17beda123841920328ccf0fb22c6615d83003034e313d1c5b6e61253ed75ed164f0bbe718ec94815545553d86ad844adabdf4faed319f3044553878f23621933
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwLENt:Lz071uv4BPMkibTIA5CJzn

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral2/memory/3188-42-0x00007FF717480000-0x00007FF717872000-memory.dmp	xmrig
behavioral2/memory/4384-74-0x00007FF7FAC00000-0x00007FF7FAFF2000-memory.dmp	xmrig
behavioral2/memory/4672-214-0x00007FF62E260000-0x00007FF62E652000-memory.dmp	xmrig
behavioral2/memory/2020-1302-0x00007FF7C1840000-0x00007FF7C1C32000-memory.dmp	xmrig
behavioral2/memory/4056-1293-0x00007FF761510000-0x00007FF761902000-memory.dmp	xmrig
behavioral2/memory/2220-1541-0x00007FF6762D0000-0x00007FF6766C2000-memory.dmp	xmrig
behavioral2/memory/816-997-0x00007FF679320000-0x00007FF679712000-memory.dmp	xmrig
behavioral2/memory/2940-1001-0x00007FF790EB0000-0x00007FF7912A2000-memory.dmp	xmrig
behavioral2/memory/1944-806-0x00007FF695DB0000-0x00007FF6961A2000-memory.dmp	xmrig
behavioral2/memory/1160-638-0x00007FF74D050000-0x00007FF74D442000-memory.dmp	xmrig
behavioral2/memory/1128-642-0x00007FF62F8D0000-0x00007FF62FCC2000-memory.dmp	xmrig
behavioral2/memory/3916-479-0x00007FF7A12D0000-0x00007FF7A16C2000-memory.dmp	xmrig
behavioral2/memory/2924-478-0x00007FF764C90000-0x00007FF765082000-memory.dmp	xmrig
behavioral2/memory/3840-431-0x00007FF7B9AB0000-0x00007FF7B9EA2000-memory.dmp	xmrig
behavioral2/memory/1580-370-0x00007FF6B29E0000-0x00007FF6B2DD2000-memory.dmp	xmrig
behavioral2/memory/2584-308-0x00007FF639340000-0x00007FF639732000-memory.dmp	xmrig
behavioral2/memory/1936-298-0x00007FF62B260000-0x00007FF62B652000-memory.dmp	xmrig
behavioral2/memory/4524-255-0x00007FF7645F0000-0x00007FF7649E2000-memory.dmp	xmrig
behavioral2/memory/1472-3070-0x00007FF7F7100000-0x00007FF7F74F2000-memory.dmp	xmrig
behavioral2/memory/528-3075-0x00007FF7A8170000-0x00007FF7A8562000-memory.dmp	xmrig
behavioral2/memory/3916-5620-0x00007FF7A12D0000-0x00007FF7A16C2000-memory.dmp	xmrig
behavioral2/memory/4056-6629-0x00007FF761510000-0x00007FF761902000-memory.dmp	xmrig
behavioral2/memory/1128-6650-0x00007FF62F8D0000-0x00007FF62FCC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1168	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1472	dcVMWVw.exe
2976	VDWtUTi.exe
3188	fhQzRjG.exe
4384	WLHKAHe.exe
2020	VHgSezO.exe
528	lcvNFxG.exe
2220	bHZIpBW.exe
4672	jmBfexK.exe
4524	ZKRlpDK.exe
1936	gCAlrQO.exe
2584	OKHKZuq.exe
1580	sSkXCcw.exe
4036	PzMEXcC.exe
3840	IKtvIMJ.exe
1804	hfuMJxB.exe
2924	moifvhO.exe
3916	uclyTjO.exe
1160	SnsvDGc.exe
1128	ICNUTEF.exe
1944	GtbRmAY.exe
816	WzikPAq.exe
2940	vTNOLzR.exe
4056	uDKOqIv.exe
60	KRmQuib.exe
992	cmqanWw.exe
3096	TiasagV.exe
4520	XyJYNjJ.exe
836	nIvkeVP.exe
460	aZbDPnC.exe
4444	muKwinw.exe
4304	AkRVdZY.exe
4836	IbgBKLS.exe
4984	bNZsVic.exe
4976	cdWWMOG.exe
3740	mBCIVhB.exe
2128	kbigzfS.exe
3908	oqLzCEK.exe
4896	XtpetOD.exe
1108	hMsxftk.exe
1132	tnvlBAS.exe
1016	JOGVdOY.exe
4468	ShmSQVL.exe
1548	kHvQbrk.exe
3796	onYARAf.exe
3560	swZiaOk.exe
5008	RWPMhTD.exe
3144	dcOfcmk.exe
2880	tsCVtDK.exe
4388	bgQSTNd.exe
776	JYMoSLk.exe
680	NhZJTjK.exe
4784	byYyrFw.exe
2820	urHZzSU.exe
1496	GuxKIuh.exe
3272	BOcXYpG.exe
2808	FtsgRLK.exe
3616	VRSEudp.exe
3520	ZDELEOY.exe
2060	WsPGzXx.exe
4316	MuhMlZk.exe
3692	IRYItKi.exe
2564	ZXweeos.exe
2456	QlaATQN.exe
216	mlDMyee.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/904-0-0x00007FF65D100000-0x00007FF65D4F2000-memory.dmp	upx
behavioral2/files/0x0008000000023455-5.dat	upx
behavioral2/files/0x000700000002345c-22.dat	upx
behavioral2/memory/3188-42-0x00007FF717480000-0x00007FF717872000-memory.dmp	upx
behavioral2/memory/2976-36-0x00007FF703400000-0x00007FF7037F2000-memory.dmp	upx
behavioral2/files/0x000700000002345d-34.dat	upx
behavioral2/files/0x000700000002346a-95.dat	upx
behavioral2/files/0x000700000002345f-104.dat	upx
behavioral2/files/0x0007000000023465-102.dat	upx
behavioral2/files/0x000700000002345e-99.dat	upx
behavioral2/files/0x000700000002346c-98.dat	upx
behavioral2/files/0x000700000002346b-97.dat	upx
behavioral2/files/0x0007000000023462-91.dat	upx
behavioral2/files/0x0007000000023469-83.dat	upx
behavioral2/memory/4384-74-0x00007FF7FAC00000-0x00007FF7FAFF2000-memory.dmp	upx
behavioral2/files/0x0007000000023467-71.dat	upx
behavioral2/files/0x0007000000023466-70.dat	upx
behavioral2/files/0x0007000000023464-61.dat	upx
behavioral2/files/0x0007000000023463-60.dat	upx
behavioral2/files/0x0007000000023461-79.dat	upx
behavioral2/files/0x0007000000023468-77.dat	upx
behavioral2/files/0x0007000000023460-51.dat	upx
behavioral2/files/0x000700000002345b-48.dat	upx
behavioral2/memory/528-122-0x00007FF7A8170000-0x00007FF7A8562000-memory.dmp	upx
behavioral2/files/0x000700000002346e-117.dat	upx
behavioral2/files/0x000700000002346d-113.dat	upx
behavioral2/files/0x0007000000023474-145.dat	upx
behavioral2/files/0x0007000000023472-141.dat	upx
behavioral2/memory/4672-214-0x00007FF62E260000-0x00007FF62E652000-memory.dmp	upx
behavioral2/memory/2020-1302-0x00007FF7C1840000-0x00007FF7C1C32000-memory.dmp	upx
behavioral2/memory/4056-1293-0x00007FF761510000-0x00007FF761902000-memory.dmp	upx
behavioral2/memory/2220-1541-0x00007FF6762D0000-0x00007FF6766C2000-memory.dmp	upx
behavioral2/memory/816-997-0x00007FF679320000-0x00007FF679712000-memory.dmp	upx
behavioral2/memory/2940-1001-0x00007FF790EB0000-0x00007FF7912A2000-memory.dmp	upx
behavioral2/memory/1944-806-0x00007FF695DB0000-0x00007FF6961A2000-memory.dmp	upx
behavioral2/memory/1160-638-0x00007FF74D050000-0x00007FF74D442000-memory.dmp	upx
behavioral2/memory/1128-642-0x00007FF62F8D0000-0x00007FF62FCC2000-memory.dmp	upx
behavioral2/memory/3916-479-0x00007FF7A12D0000-0x00007FF7A16C2000-memory.dmp	upx
behavioral2/memory/2924-478-0x00007FF764C90000-0x00007FF765082000-memory.dmp	upx
behavioral2/memory/3840-431-0x00007FF7B9AB0000-0x00007FF7B9EA2000-memory.dmp	upx
behavioral2/memory/1580-370-0x00007FF6B29E0000-0x00007FF6B2DD2000-memory.dmp	upx
behavioral2/memory/2584-308-0x00007FF639340000-0x00007FF639732000-memory.dmp	upx
behavioral2/memory/1936-298-0x00007FF62B260000-0x00007FF62B652000-memory.dmp	upx
behavioral2/memory/4524-255-0x00007FF7645F0000-0x00007FF7649E2000-memory.dmp	upx
behavioral2/files/0x0007000000023481-171.dat	upx
behavioral2/files/0x0007000000023480-169.dat	upx
behavioral2/files/0x000700000002347f-166.dat	upx
behavioral2/files/0x0007000000023473-165.dat	upx
behavioral2/files/0x0007000000023477-164.dat	upx
behavioral2/files/0x000700000002347e-163.dat	upx
behavioral2/files/0x000700000002347d-162.dat	upx
behavioral2/files/0x000700000002347c-161.dat	upx
behavioral2/files/0x0007000000023470-160.dat	upx
behavioral2/files/0x000700000002347b-159.dat	upx
behavioral2/files/0x0007000000023478-158.dat	upx
behavioral2/files/0x0007000000023476-155.dat	upx
behavioral2/files/0x0007000000023471-135.dat	upx
behavioral2/files/0x000700000002346f-126.dat	upx
behavioral2/files/0x000700000002345a-31.dat	upx
behavioral2/files/0x0007000000023459-16.dat	upx
behavioral2/memory/1472-10-0x00007FF7F7100000-0x00007FF7F74F2000-memory.dmp	upx
behavioral2/memory/1472-3070-0x00007FF7F7100000-0x00007FF7F74F2000-memory.dmp	upx
behavioral2/memory/528-3075-0x00007FF7A8170000-0x00007FF7A8562000-memory.dmp	upx
behavioral2/memory/3916-5620-0x00007FF7A12D0000-0x00007FF7A16C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kODTVdp.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\KKMaZIY.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\MLOxSQQ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\kAPtKet.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\eAoTKUH.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\IRdDMWH.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\DPdfiEE.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\oGZcjjq.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\GeqFIWJ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\cFUeSKI.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\hMzaNcC.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\uNlaWTy.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\ixXRaBE.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\NGJvxAv.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\usibhqU.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\ubcSFUJ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\kGbQXSX.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\sujVngt.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\JPhObHH.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\uesPGiB.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\uVntVVr.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\cuhwSzQ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\riPWsiZ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\arfEIzn.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\qIRthyo.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\iqHEgHG.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\oHfzJmG.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\kygRgTa.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\yydTyRt.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\YiIUUwq.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\lifKtEO.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\tcEiGIz.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\gwHeeyi.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\UMhrlmh.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\ieGVLKN.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\HAuKPnH.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\mEQEyNb.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\XObNyRI.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\mikRBAm.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\WIMdJSM.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\XsRGwVZ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\DqWbjwk.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\SSQBwkT.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\QPQZKdf.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\jSsRLns.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\AXcsEHw.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\bGjvozL.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\LHIKzwD.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\eqGXjvr.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\sZOscno.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\ZlzGpmL.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\qLdUvGI.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\cVOfzUh.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\NHEPRZE.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\WZzwuBE.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\liNamoZ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\LWPhspa.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\KraiDBC.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\iKWtLXL.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\NQXGWWq.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\XzNjHUZ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\gXOjesh.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\tUXoPzG.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\AgjPNmN.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1168	powershell.exe
1168	powershell.exe
1168	powershell.exe
1168	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	904	e9f2c1bf066ba691b543a85501ac0a50N.exe
Token: SeLockMemoryPrivilege	904	e9f2c1bf066ba691b543a85501ac0a50N.exe
Token: SeDebugPrivilege	1168	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1168	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	86
PID 904 wrote to memory of 1168	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	86
PID 904 wrote to memory of 1472	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	87
PID 904 wrote to memory of 1472	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	87
PID 904 wrote to memory of 3188	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	88
PID 904 wrote to memory of 3188	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	88
PID 904 wrote to memory of 2976	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	89
PID 904 wrote to memory of 2976	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	89
PID 904 wrote to memory of 4384	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	90
PID 904 wrote to memory of 4384	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	90
PID 904 wrote to memory of 2020	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	91
PID 904 wrote to memory of 2020	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	91
PID 904 wrote to memory of 528	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	92
PID 904 wrote to memory of 528	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	92
PID 904 wrote to memory of 2220	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	93
PID 904 wrote to memory of 2220	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	93
PID 904 wrote to memory of 4672	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	94
PID 904 wrote to memory of 4672	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	94
PID 904 wrote to memory of 4524	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	95
PID 904 wrote to memory of 4524	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	95
PID 904 wrote to memory of 1936	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	96
PID 904 wrote to memory of 1936	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	96
PID 904 wrote to memory of 3916	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	97
PID 904 wrote to memory of 3916	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	97
PID 904 wrote to memory of 2584	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	98
PID 904 wrote to memory of 2584	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	98
PID 904 wrote to memory of 1580	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	99
PID 904 wrote to memory of 1580	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	99
PID 904 wrote to memory of 816	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	100
PID 904 wrote to memory of 816	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	100
PID 904 wrote to memory of 4036	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	101
PID 904 wrote to memory of 4036	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	101
PID 904 wrote to memory of 3840	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	102
PID 904 wrote to memory of 3840	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	102
PID 904 wrote to memory of 1804	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	103
PID 904 wrote to memory of 1804	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	103
PID 904 wrote to memory of 2924	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	104
PID 904 wrote to memory of 2924	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	104
PID 904 wrote to memory of 1160	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	105
PID 904 wrote to memory of 1160	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	105
PID 904 wrote to memory of 1128	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	106
PID 904 wrote to memory of 1128	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	106
PID 904 wrote to memory of 1944	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	107
PID 904 wrote to memory of 1944	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	107
PID 904 wrote to memory of 2940	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	108
PID 904 wrote to memory of 2940	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	108
PID 904 wrote to memory of 4056	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	109
PID 904 wrote to memory of 4056	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	109
PID 904 wrote to memory of 60	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	110
PID 904 wrote to memory of 60	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	110
PID 904 wrote to memory of 4836	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	111
PID 904 wrote to memory of 4836	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	111
PID 904 wrote to memory of 992	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	112
PID 904 wrote to memory of 992	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	112
PID 904 wrote to memory of 3096	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	113
PID 904 wrote to memory of 3096	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	113
PID 904 wrote to memory of 4520	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	114
PID 904 wrote to memory of 4520	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	114
PID 904 wrote to memory of 836	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	115
PID 904 wrote to memory of 836	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	115
PID 904 wrote to memory of 1132	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	116
PID 904 wrote to memory of 1132	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	116
PID 904 wrote to memory of 460	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	117
PID 904 wrote to memory of 460	904	e9f2c1bf066ba691b543a85501ac0a50N.exe	117

C:\Users\Admin\AppData\Local\Temp\e9f2c1bf066ba691b543a85501ac0a50N.exe
"C:\Users\Admin\AppData\Local\Temp\e9f2c1bf066ba691b543a85501ac0a50N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\System\dcVMWVw.exe
  C:\Windows\System\dcVMWVw.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\fhQzRjG.exe
  C:\Windows\System\fhQzRjG.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\VDWtUTi.exe
  C:\Windows\System\VDWtUTi.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\WLHKAHe.exe
  C:\Windows\System\WLHKAHe.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\VHgSezO.exe
  C:\Windows\System\VHgSezO.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\lcvNFxG.exe
  C:\Windows\System\lcvNFxG.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\bHZIpBW.exe
  C:\Windows\System\bHZIpBW.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\jmBfexK.exe
  C:\Windows\System\jmBfexK.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\ZKRlpDK.exe
  C:\Windows\System\ZKRlpDK.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\gCAlrQO.exe
  C:\Windows\System\gCAlrQO.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\uclyTjO.exe
  C:\Windows\System\uclyTjO.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\OKHKZuq.exe
  C:\Windows\System\OKHKZuq.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\sSkXCcw.exe
  C:\Windows\System\sSkXCcw.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\WzikPAq.exe
  C:\Windows\System\WzikPAq.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\PzMEXcC.exe
  C:\Windows\System\PzMEXcC.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\IKtvIMJ.exe
  C:\Windows\System\IKtvIMJ.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\hfuMJxB.exe
  C:\Windows\System\hfuMJxB.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\moifvhO.exe
  C:\Windows\System\moifvhO.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\SnsvDGc.exe
  C:\Windows\System\SnsvDGc.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\ICNUTEF.exe
  C:\Windows\System\ICNUTEF.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\GtbRmAY.exe
  C:\Windows\System\GtbRmAY.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\vTNOLzR.exe
  C:\Windows\System\vTNOLzR.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\uDKOqIv.exe
  C:\Windows\System\uDKOqIv.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\KRmQuib.exe
  C:\Windows\System\KRmQuib.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\IbgBKLS.exe
  C:\Windows\System\IbgBKLS.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\cmqanWw.exe
  C:\Windows\System\cmqanWw.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\TiasagV.exe
  C:\Windows\System\TiasagV.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\XyJYNjJ.exe
  C:\Windows\System\XyJYNjJ.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\nIvkeVP.exe
  C:\Windows\System\nIvkeVP.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\tnvlBAS.exe
  C:\Windows\System\tnvlBAS.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\aZbDPnC.exe
  C:\Windows\System\aZbDPnC.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\kbigzfS.exe
  C:\Windows\System\kbigzfS.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\muKwinw.exe
  C:\Windows\System\muKwinw.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\JOGVdOY.exe
  C:\Windows\System\JOGVdOY.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\ShmSQVL.exe
  C:\Windows\System\ShmSQVL.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\AkRVdZY.exe
  C:\Windows\System\AkRVdZY.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\bNZsVic.exe
  C:\Windows\System\bNZsVic.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\cdWWMOG.exe
  C:\Windows\System\cdWWMOG.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\mBCIVhB.exe
  C:\Windows\System\mBCIVhB.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\oqLzCEK.exe
  C:\Windows\System\oqLzCEK.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\XtpetOD.exe
  C:\Windows\System\XtpetOD.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\hMsxftk.exe
  C:\Windows\System\hMsxftk.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\kHvQbrk.exe
  C:\Windows\System\kHvQbrk.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\onYARAf.exe
  C:\Windows\System\onYARAf.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\swZiaOk.exe
  C:\Windows\System\swZiaOk.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\RWPMhTD.exe
  C:\Windows\System\RWPMhTD.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\dcOfcmk.exe
  C:\Windows\System\dcOfcmk.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\tsCVtDK.exe
  C:\Windows\System\tsCVtDK.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\bgQSTNd.exe
  C:\Windows\System\bgQSTNd.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\JYMoSLk.exe
  C:\Windows\System\JYMoSLk.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\NhZJTjK.exe
  C:\Windows\System\NhZJTjK.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\byYyrFw.exe
  C:\Windows\System\byYyrFw.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\urHZzSU.exe
  C:\Windows\System\urHZzSU.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\GuxKIuh.exe
  C:\Windows\System\GuxKIuh.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\BOcXYpG.exe
  C:\Windows\System\BOcXYpG.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\FtsgRLK.exe
  C:\Windows\System\FtsgRLK.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\VRSEudp.exe
  C:\Windows\System\VRSEudp.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\ZDELEOY.exe
  C:\Windows\System\ZDELEOY.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\WsPGzXx.exe
  C:\Windows\System\WsPGzXx.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\MuhMlZk.exe
  C:\Windows\System\MuhMlZk.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\IRYItKi.exe
  C:\Windows\System\IRYItKi.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\ZXweeos.exe
  C:\Windows\System\ZXweeos.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\QlaATQN.exe
  C:\Windows\System\QlaATQN.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\mlDMyee.exe
  C:\Windows\System\mlDMyee.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\RbKsCnM.exe
  C:\Windows\System\RbKsCnM.exe
  2⤵
  PID:1948
- C:\Windows\System\KCVcvju.exe
  C:\Windows\System\KCVcvju.exe
  2⤵
  PID:4360
- C:\Windows\System\bBTZgBY.exe
  C:\Windows\System\bBTZgBY.exe
  2⤵
  PID:3340
- C:\Windows\System\gCmlLtj.exe
  C:\Windows\System\gCmlLtj.exe
  2⤵
  PID:2372
- C:\Windows\System\hYBjdCc.exe
  C:\Windows\System\hYBjdCc.exe
  2⤵
  PID:4508
- C:\Windows\System\kEkNvdn.exe
  C:\Windows\System\kEkNvdn.exe
  2⤵
  PID:4584
- C:\Windows\System\iBxNcub.exe
  C:\Windows\System\iBxNcub.exe
  2⤵
  PID:1624
- C:\Windows\System\PkrnLXY.exe
  C:\Windows\System\PkrnLXY.exe
  2⤵
  PID:3984
- C:\Windows\System\wvcJCfa.exe
  C:\Windows\System\wvcJCfa.exe
  2⤵
  PID:2776
- C:\Windows\System\sRVjvbi.exe
  C:\Windows\System\sRVjvbi.exe
  2⤵
  PID:2164
- C:\Windows\System\LTKalhM.exe
  C:\Windows\System\LTKalhM.exe
  2⤵
  PID:3544
- C:\Windows\System\LpvuJkA.exe
  C:\Windows\System\LpvuJkA.exe
  2⤵
  PID:1836
- C:\Windows\System\YJrrBik.exe
  C:\Windows\System\YJrrBik.exe
  2⤵
  PID:808
- C:\Windows\System\fsjPFhK.exe
  C:\Windows\System\fsjPFhK.exe
  2⤵
  PID:4716
- C:\Windows\System\iZkSUVx.exe
  C:\Windows\System\iZkSUVx.exe
  2⤵
  PID:4904
- C:\Windows\System\myRuBdw.exe
  C:\Windows\System\myRuBdw.exe
  2⤵
  PID:2088
- C:\Windows\System\gFiGHeD.exe
  C:\Windows\System\gFiGHeD.exe
  2⤵
  PID:1004
- C:\Windows\System\yZcWlNv.exe
  C:\Windows\System\yZcWlNv.exe
  2⤵
  PID:4840
- C:\Windows\System\zzlnltZ.exe
  C:\Windows\System\zzlnltZ.exe
  2⤵
  PID:3952
- C:\Windows\System\TmUDyHy.exe
  C:\Windows\System\TmUDyHy.exe
  2⤵
  PID:372
- C:\Windows\System\UYwMAFp.exe
  C:\Windows\System\UYwMAFp.exe
  2⤵
  PID:5132
- C:\Windows\System\RFFRfqY.exe
  C:\Windows\System\RFFRfqY.exe
  2⤵
  PID:5148
- C:\Windows\System\EFTprmj.exe
  C:\Windows\System\EFTprmj.exe
  2⤵
  PID:5164
- C:\Windows\System\UjCjnoB.exe
  C:\Windows\System\UjCjnoB.exe
  2⤵
  PID:5188
- C:\Windows\System\jMuEdMV.exe
  C:\Windows\System\jMuEdMV.exe
  2⤵
  PID:5212
- C:\Windows\System\eGdVYVS.exe
  C:\Windows\System\eGdVYVS.exe
  2⤵
  PID:5232
- C:\Windows\System\TdOjEPB.exe
  C:\Windows\System\TdOjEPB.exe
  2⤵
  PID:5252
- C:\Windows\System\ENVHram.exe
  C:\Windows\System\ENVHram.exe
  2⤵
  PID:5268
- C:\Windows\System\USsgBbr.exe
  C:\Windows\System\USsgBbr.exe
  2⤵
  PID:5292
- C:\Windows\System\CvMQqpB.exe
  C:\Windows\System\CvMQqpB.exe
  2⤵
  PID:5312
- C:\Windows\System\VuiryoU.exe
  C:\Windows\System\VuiryoU.exe
  2⤵
  PID:5328
- C:\Windows\System\ftfNnCg.exe
  C:\Windows\System\ftfNnCg.exe
  2⤵
  PID:5352
- C:\Windows\System\SBgmvNZ.exe
  C:\Windows\System\SBgmvNZ.exe
  2⤵
  PID:5380
- C:\Windows\System\YEgltfX.exe
  C:\Windows\System\YEgltfX.exe
  2⤵
  PID:5400
- C:\Windows\System\IEFyjpV.exe
  C:\Windows\System\IEFyjpV.exe
  2⤵
  PID:5416
- C:\Windows\System\rnkKuUT.exe
  C:\Windows\System\rnkKuUT.exe
  2⤵
  PID:5448
- C:\Windows\System\XUYzrMi.exe
  C:\Windows\System\XUYzrMi.exe
  2⤵
  PID:5472
- C:\Windows\System\rAHJTGU.exe
  C:\Windows\System\rAHJTGU.exe
  2⤵
  PID:5496
- C:\Windows\System\HCGFDgi.exe
  C:\Windows\System\HCGFDgi.exe
  2⤵
  PID:5524
- C:\Windows\System\lderVIe.exe
  C:\Windows\System\lderVIe.exe
  2⤵
  PID:5540
- C:\Windows\System\FvWbVgf.exe
  C:\Windows\System\FvWbVgf.exe
  2⤵
  PID:5564
- C:\Windows\System\oSElXgF.exe
  C:\Windows\System\oSElXgF.exe
  2⤵
  PID:5588
- C:\Windows\System\NEklVdH.exe
  C:\Windows\System\NEklVdH.exe
  2⤵
  PID:5612
- C:\Windows\System\HXCoIRx.exe
  C:\Windows\System\HXCoIRx.exe
  2⤵
  PID:5632
- C:\Windows\System\kgKeYBn.exe
  C:\Windows\System\kgKeYBn.exe
  2⤵
  PID:5680
- C:\Windows\System\MBuIKCz.exe
  C:\Windows\System\MBuIKCz.exe
  2⤵
  PID:5696
- C:\Windows\System\EfuYvFi.exe
  C:\Windows\System\EfuYvFi.exe
  2⤵
  PID:5724
- C:\Windows\System\lvipVLJ.exe
  C:\Windows\System\lvipVLJ.exe
  2⤵
  PID:5740
- C:\Windows\System\mBMWavc.exe
  C:\Windows\System\mBMWavc.exe
  2⤵
  PID:5764
- C:\Windows\System\OGgnOwv.exe
  C:\Windows\System\OGgnOwv.exe
  2⤵
  PID:5780
- C:\Windows\System\fejRsRC.exe
  C:\Windows\System\fejRsRC.exe
  2⤵
  PID:5804
- C:\Windows\System\vqNfHCz.exe
  C:\Windows\System\vqNfHCz.exe
  2⤵
  PID:5828
- C:\Windows\System\HofCpPG.exe
  C:\Windows\System\HofCpPG.exe
  2⤵
  PID:5844
- C:\Windows\System\MFNnsGG.exe
  C:\Windows\System\MFNnsGG.exe
  2⤵
  PID:5860
- C:\Windows\System\mfkrZui.exe
  C:\Windows\System\mfkrZui.exe
  2⤵
  PID:5888
- C:\Windows\System\zzwnorW.exe
  C:\Windows\System\zzwnorW.exe
  2⤵
  PID:5904
- C:\Windows\System\qoPcAMs.exe
  C:\Windows\System\qoPcAMs.exe
  2⤵
  PID:5928
- C:\Windows\System\CqffRBK.exe
  C:\Windows\System\CqffRBK.exe
  2⤵
  PID:5944
- C:\Windows\System\Flrbqmh.exe
  C:\Windows\System\Flrbqmh.exe
  2⤵
  PID:5972
- C:\Windows\System\fuXbbiA.exe
  C:\Windows\System\fuXbbiA.exe
  2⤵
  PID:5988
- C:\Windows\System\PMbHeVl.exe
  C:\Windows\System\PMbHeVl.exe
  2⤵
  PID:6012
- C:\Windows\System\ItMtdgH.exe
  C:\Windows\System\ItMtdgH.exe
  2⤵
  PID:6028
- C:\Windows\System\bueTjyo.exe
  C:\Windows\System\bueTjyo.exe
  2⤵
  PID:6056
- C:\Windows\System\zOXSxNJ.exe
  C:\Windows\System\zOXSxNJ.exe
  2⤵
  PID:6088
- C:\Windows\System\JJIJEiH.exe
  C:\Windows\System\JJIJEiH.exe
  2⤵
  PID:6108
- C:\Windows\System\fsYjdSQ.exe
  C:\Windows\System\fsYjdSQ.exe
  2⤵
  PID:6128
- C:\Windows\System\CdLoUrg.exe
  C:\Windows\System\CdLoUrg.exe
  2⤵
  PID:3212
- C:\Windows\System\jFRklZo.exe
  C:\Windows\System\jFRklZo.exe
  2⤵
  PID:1644
- C:\Windows\System\QBQQEcO.exe
  C:\Windows\System\QBQQEcO.exe
  2⤵
  PID:4800
- C:\Windows\System\MrBSgqn.exe
  C:\Windows\System\MrBSgqn.exe
  2⤵
  PID:2296
- C:\Windows\System\IXXqZcM.exe
  C:\Windows\System\IXXqZcM.exe
  2⤵
  PID:3404
- C:\Windows\System\JLTngZO.exe
  C:\Windows\System\JLTngZO.exe
  2⤵
  PID:4232
- C:\Windows\System\ULDWNhN.exe
  C:\Windows\System\ULDWNhN.exe
  2⤵
  PID:4120
- C:\Windows\System\hOdxXJP.exe
  C:\Windows\System\hOdxXJP.exe
  2⤵
  PID:2412
- C:\Windows\System\qDCwmnf.exe
  C:\Windows\System\qDCwmnf.exe
  2⤵
  PID:3768
- C:\Windows\System\UnHGXvF.exe
  C:\Windows\System\UnHGXvF.exe
  2⤵
  PID:4028
- C:\Windows\System\iCtipfJ.exe
  C:\Windows\System\iCtipfJ.exe
  2⤵
  PID:4852
- C:\Windows\System\ZBUzpXW.exe
  C:\Windows\System\ZBUzpXW.exe
  2⤵
  PID:5084
- C:\Windows\System\TcpZcMg.exe
  C:\Windows\System\TcpZcMg.exe
  2⤵
  PID:2624
- C:\Windows\System\SvMzRJn.exe
  C:\Windows\System\SvMzRJn.exe
  2⤵
  PID:3496
- C:\Windows\System\vqrdblf.exe
  C:\Windows\System\vqrdblf.exe
  2⤵
  PID:4060
- C:\Windows\System\ILSwPMh.exe
  C:\Windows\System\ILSwPMh.exe
  2⤵
  PID:5280
- C:\Windows\System\ShsnPFH.exe
  C:\Windows\System\ShsnPFH.exe
  2⤵
  PID:5344
- C:\Windows\System\aiRuTcK.exe
  C:\Windows\System\aiRuTcK.exe
  2⤵
  PID:5412
- C:\Windows\System\HgImOiz.exe
  C:\Windows\System\HgImOiz.exe
  2⤵
  PID:2896
- C:\Windows\System\oEyIQvC.exe
  C:\Windows\System\oEyIQvC.exe
  2⤵
  PID:5488
- C:\Windows\System\LTtSvZC.exe
  C:\Windows\System\LTtSvZC.exe
  2⤵
  PID:5628
- C:\Windows\System\bWABMhb.exe
  C:\Windows\System\bWABMhb.exe
  2⤵
  PID:3412
- C:\Windows\System\mQWkrKz.exe
  C:\Windows\System\mQWkrKz.exe
  2⤵
  PID:5852
- C:\Windows\System\CPQNgkx.exe
  C:\Windows\System\CPQNgkx.exe
  2⤵
  PID:5936
- C:\Windows\System\RZFJDdF.exe
  C:\Windows\System\RZFJDdF.exe
  2⤵
  PID:5348
- C:\Windows\System\BXNiMiB.exe
  C:\Windows\System\BXNiMiB.exe
  2⤵
  PID:5968
- C:\Windows\System\UKwNloB.exe
  C:\Windows\System\UKwNloB.exe
  2⤵
  PID:6004
- C:\Windows\System\coKnkAk.exe
  C:\Windows\System\coKnkAk.exe
  2⤵
  PID:5484
- C:\Windows\System\QEnsQLV.exe
  C:\Windows\System\QEnsQLV.exe
  2⤵
  PID:6124
- C:\Windows\System\vduLyVD.exe
  C:\Windows\System\vduLyVD.exe
  2⤵
  PID:5184
- C:\Windows\System\qXONapp.exe
  C:\Windows\System\qXONapp.exe
  2⤵
  PID:5920
- C:\Windows\System\qDlbtUz.exe
  C:\Windows\System\qDlbtUz.exe
  2⤵
  PID:6160
- C:\Windows\System\RFmIxUb.exe
  C:\Windows\System\RFmIxUb.exe
  2⤵
  PID:6180
- C:\Windows\System\xBAoJtp.exe
  C:\Windows\System\xBAoJtp.exe
  2⤵
  PID:6200
- C:\Windows\System\VgTdORJ.exe
  C:\Windows\System\VgTdORJ.exe
  2⤵
  PID:6216
- C:\Windows\System\yHhUIcC.exe
  C:\Windows\System\yHhUIcC.exe
  2⤵
  PID:6240
- C:\Windows\System\LqmqPKq.exe
  C:\Windows\System\LqmqPKq.exe
  2⤵
  PID:6264
- C:\Windows\System\MecuAvj.exe
  C:\Windows\System\MecuAvj.exe
  2⤵
  PID:6280
- C:\Windows\System\CyQHDdu.exe
  C:\Windows\System\CyQHDdu.exe
  2⤵
  PID:6304
- C:\Windows\System\wOwDbZD.exe
  C:\Windows\System\wOwDbZD.exe
  2⤵
  PID:6320
- C:\Windows\System\nfbUmDu.exe
  C:\Windows\System\nfbUmDu.exe
  2⤵
  PID:6344
- C:\Windows\System\ywtBVPl.exe
  C:\Windows\System\ywtBVPl.exe
  2⤵
  PID:6368
- C:\Windows\System\byWIlAr.exe
  C:\Windows\System\byWIlAr.exe
  2⤵
  PID:6384
- C:\Windows\System\svicFAT.exe
  C:\Windows\System\svicFAT.exe
  2⤵
  PID:6412
- C:\Windows\System\ttMBIxu.exe
  C:\Windows\System\ttMBIxu.exe
  2⤵
  PID:6432
- C:\Windows\System\krcTaeO.exe
  C:\Windows\System\krcTaeO.exe
  2⤵
  PID:6452
- C:\Windows\System\xaSrjfq.exe
  C:\Windows\System\xaSrjfq.exe
  2⤵
  PID:6468
- C:\Windows\System\GtKUils.exe
  C:\Windows\System\GtKUils.exe
  2⤵
  PID:6492
- C:\Windows\System\XUsoAuS.exe
  C:\Windows\System\XUsoAuS.exe
  2⤵
  PID:6516
- C:\Windows\System\qhyJCfo.exe
  C:\Windows\System\qhyJCfo.exe
  2⤵
  PID:6532
- C:\Windows\System\dHPxDEI.exe
  C:\Windows\System\dHPxDEI.exe
  2⤵
  PID:6556
- C:\Windows\System\bfDwLnV.exe
  C:\Windows\System\bfDwLnV.exe
  2⤵
  PID:6572
- C:\Windows\System\DTRHjzA.exe
  C:\Windows\System\DTRHjzA.exe
  2⤵
  PID:6596
- C:\Windows\System\ATwBnCo.exe
  C:\Windows\System\ATwBnCo.exe
  2⤵
  PID:6620
- C:\Windows\System\oKlMRdi.exe
  C:\Windows\System\oKlMRdi.exe
  2⤵
  PID:6636
- C:\Windows\System\pqJhqkB.exe
  C:\Windows\System\pqJhqkB.exe
  2⤵
  PID:6664
- C:\Windows\System\upRCERS.exe
  C:\Windows\System\upRCERS.exe
  2⤵
  PID:6680
- C:\Windows\System\uWiTORz.exe
  C:\Windows\System\uWiTORz.exe
  2⤵
  PID:6700
- C:\Windows\System\PdBUAIR.exe
  C:\Windows\System\PdBUAIR.exe
  2⤵
  PID:6716
- C:\Windows\System\UnNlSCB.exe
  C:\Windows\System\UnNlSCB.exe
  2⤵
  PID:6732
- C:\Windows\System\qHDqByG.exe
  C:\Windows\System\qHDqByG.exe
  2⤵
  PID:6756
- C:\Windows\System\zROpZwg.exe
  C:\Windows\System\zROpZwg.exe
  2⤵
  PID:6780
- C:\Windows\System\lTTWtDN.exe
  C:\Windows\System\lTTWtDN.exe
  2⤵
  PID:6796
- C:\Windows\System\qNnVHdu.exe
  C:\Windows\System\qNnVHdu.exe
  2⤵
  PID:6820
- C:\Windows\System\wHmdpkl.exe
  C:\Windows\System\wHmdpkl.exe
  2⤵
  PID:6836
- C:\Windows\System\djmIZaL.exe
  C:\Windows\System\djmIZaL.exe
  2⤵
  PID:6860
- C:\Windows\System\RViPfhW.exe
  C:\Windows\System\RViPfhW.exe
  2⤵
  PID:6884
- C:\Windows\System\viIUelC.exe
  C:\Windows\System\viIUelC.exe
  2⤵
  PID:6900
- C:\Windows\System\rJiDNdb.exe
  C:\Windows\System\rJiDNdb.exe
  2⤵
  PID:6928
- C:\Windows\System\lQTBeaq.exe
  C:\Windows\System\lQTBeaq.exe
  2⤵
  PID:6952
- C:\Windows\System\jnDDeko.exe
  C:\Windows\System\jnDDeko.exe
  2⤵
  PID:6968
- C:\Windows\System\BdFtnOy.exe
  C:\Windows\System\BdFtnOy.exe
  2⤵
  PID:6992
- C:\Windows\System\sZJtAwQ.exe
  C:\Windows\System\sZJtAwQ.exe
  2⤵
  PID:7008
- C:\Windows\System\xFoPTId.exe
  C:\Windows\System\xFoPTId.exe
  2⤵
  PID:7032
- C:\Windows\System\esXUgcv.exe
  C:\Windows\System\esXUgcv.exe
  2⤵
  PID:7052
- C:\Windows\System\zJXwmMZ.exe
  C:\Windows\System\zJXwmMZ.exe
  2⤵
  PID:7072
- C:\Windows\System\fyssCFb.exe
  C:\Windows\System\fyssCFb.exe
  2⤵
  PID:7092
- C:\Windows\System\MyuSKks.exe
  C:\Windows\System\MyuSKks.exe
  2⤵
  PID:7108
- C:\Windows\System\LGFNNJP.exe
  C:\Windows\System\LGFNNJP.exe
  2⤵
  PID:7144
- C:\Windows\System\trOIBLk.exe
  C:\Windows\System\trOIBLk.exe
  2⤵
  PID:7160
- C:\Windows\System\zQPVuUT.exe
  C:\Windows\System\zQPVuUT.exe
  2⤵
  PID:5460
- C:\Windows\System\qlbOjHO.exe
  C:\Windows\System\qlbOjHO.exe
  2⤵
  PID:5504
- C:\Windows\System\JOoLwSG.exe
  C:\Windows\System\JOoLwSG.exe
  2⤵
  PID:5552
- C:\Windows\System\mGokohv.exe
  C:\Windows\System\mGokohv.exe
  2⤵
  PID:5600
- C:\Windows\System\WJczFak.exe
  C:\Windows\System\WJczFak.exe
  2⤵
  PID:7180
- C:\Windows\System\ZqqyNSr.exe
  C:\Windows\System\ZqqyNSr.exe
  2⤵
  PID:7204
- C:\Windows\System\SoKYOxg.exe
  C:\Windows\System\SoKYOxg.exe
  2⤵
  PID:7220
- C:\Windows\System\EamRNCg.exe
  C:\Windows\System\EamRNCg.exe
  2⤵
  PID:7244
- C:\Windows\System\FAziygf.exe
  C:\Windows\System\FAziygf.exe
  2⤵
  PID:7260
- C:\Windows\System\XhTnCbo.exe
  C:\Windows\System\XhTnCbo.exe
  2⤵
  PID:7276
- C:\Windows\System\NQMGUob.exe
  C:\Windows\System\NQMGUob.exe
  2⤵
  PID:7292
- C:\Windows\System\qIVuYpW.exe
  C:\Windows\System\qIVuYpW.exe
  2⤵
  PID:7308
- C:\Windows\System\TNxWDLJ.exe
  C:\Windows\System\TNxWDLJ.exe
  2⤵
  PID:7324
- C:\Windows\System\efNgaUs.exe
  C:\Windows\System\efNgaUs.exe
  2⤵
  PID:7344
- C:\Windows\System\SoGtIbx.exe
  C:\Windows\System\SoGtIbx.exe
  2⤵
  PID:7364
- C:\Windows\System\bphYxpV.exe
  C:\Windows\System\bphYxpV.exe
  2⤵
  PID:7384
- C:\Windows\System\LcPEzDz.exe
  C:\Windows\System\LcPEzDz.exe
  2⤵
  PID:7400
- C:\Windows\System\TntOGfe.exe
  C:\Windows\System\TntOGfe.exe
  2⤵
  PID:7424
- C:\Windows\System\BKJSNzC.exe
  C:\Windows\System\BKJSNzC.exe
  2⤵
  PID:7444
- C:\Windows\System\CyQRkgT.exe
  C:\Windows\System\CyQRkgT.exe
  2⤵
  PID:7464
- C:\Windows\System\oujQaVh.exe
  C:\Windows\System\oujQaVh.exe
  2⤵
  PID:7496
- C:\Windows\System\hMFjAGC.exe
  C:\Windows\System\hMFjAGC.exe
  2⤵
  PID:7516
- C:\Windows\System\sPDJHLo.exe
  C:\Windows\System\sPDJHLo.exe
  2⤵
  PID:7548
- C:\Windows\System\DYbErfC.exe
  C:\Windows\System\DYbErfC.exe
  2⤵
  PID:7572
- C:\Windows\System\gzOzMgf.exe
  C:\Windows\System\gzOzMgf.exe
  2⤵
  PID:7596
- C:\Windows\System\irZSozM.exe
  C:\Windows\System\irZSozM.exe
  2⤵
  PID:7620
- C:\Windows\System\ddVJCaP.exe
  C:\Windows\System\ddVJCaP.exe
  2⤵
  PID:7648
- C:\Windows\System\UlYBqjl.exe
  C:\Windows\System\UlYBqjl.exe
  2⤵
  PID:7664
- C:\Windows\System\JbnvHmy.exe
  C:\Windows\System\JbnvHmy.exe
  2⤵
  PID:7692
- C:\Windows\System\ullIWSf.exe
  C:\Windows\System\ullIWSf.exe
  2⤵
  PID:7716
- C:\Windows\System\IbJdCAX.exe
  C:\Windows\System\IbJdCAX.exe
  2⤵
  PID:7744
- C:\Windows\System\TZMMOSB.exe
  C:\Windows\System\TZMMOSB.exe
  2⤵
  PID:7760
- C:\Windows\System\pElxJvQ.exe
  C:\Windows\System\pElxJvQ.exe
  2⤵
  PID:7780
- C:\Windows\System\FQoLPrl.exe
  C:\Windows\System\FQoLPrl.exe
  2⤵
  PID:7808
- C:\Windows\System\iAGYNgM.exe
  C:\Windows\System\iAGYNgM.exe
  2⤵
  PID:7828
- C:\Windows\System\FolfYiY.exe
  C:\Windows\System\FolfYiY.exe
  2⤵
  PID:7848
- C:\Windows\System\IeSoMLC.exe
  C:\Windows\System\IeSoMLC.exe
  2⤵
  PID:7868
- C:\Windows\System\TYMJTVC.exe
  C:\Windows\System\TYMJTVC.exe
  2⤵
  PID:7888
- C:\Windows\System\xXVkgfn.exe
  C:\Windows\System\xXVkgfn.exe
  2⤵
  PID:7916
- C:\Windows\System\yEPybWu.exe
  C:\Windows\System\yEPybWu.exe
  2⤵
  PID:7932
- C:\Windows\System\JCPIjDI.exe
  C:\Windows\System\JCPIjDI.exe
  2⤵
  PID:7960
- C:\Windows\System\yGXUcRu.exe
  C:\Windows\System\yGXUcRu.exe
  2⤵
  PID:7996
- C:\Windows\System\SzpztCm.exe
  C:\Windows\System\SzpztCm.exe
  2⤵
  PID:8016
- C:\Windows\System\glydRJm.exe
  C:\Windows\System\glydRJm.exe
  2⤵
  PID:8036
- C:\Windows\System\ycFSuTE.exe
  C:\Windows\System\ycFSuTE.exe
  2⤵
  PID:8060
- C:\Windows\System\ZmgMhad.exe
  C:\Windows\System\ZmgMhad.exe
  2⤵
  PID:8076
- C:\Windows\System\pAfIwZe.exe
  C:\Windows\System\pAfIwZe.exe
  2⤵
  PID:8100
- C:\Windows\System\zHAdOgy.exe
  C:\Windows\System\zHAdOgy.exe
  2⤵
  PID:8120
- C:\Windows\System\HPENtZD.exe
  C:\Windows\System\HPENtZD.exe
  2⤵
  PID:8140
- C:\Windows\System\ohTEoJq.exe
  C:\Windows\System\ohTEoJq.exe
  2⤵
  PID:8160
- C:\Windows\System\hGQNWWU.exe
  C:\Windows\System\hGQNWWU.exe
  2⤵
  PID:8180
- C:\Windows\System\vkLSWBc.exe
  C:\Windows\System\vkLSWBc.exe
  2⤵
  PID:320
- C:\Windows\System\OzWCCrm.exe
  C:\Windows\System\OzWCCrm.exe
  2⤵
  PID:5652
- C:\Windows\System\rXmdDXG.exe
  C:\Windows\System\rXmdDXG.exe
  2⤵
  PID:5752
- C:\Windows\System\PrxBFdm.exe
  C:\Windows\System\PrxBFdm.exe
  2⤵
  PID:5788
- C:\Windows\System\fyXbzQi.exe
  C:\Windows\System\fyXbzQi.exe
  2⤵
  PID:5836
- C:\Windows\System\woDFaJR.exe
  C:\Windows\System\woDFaJR.exe
  2⤵
  PID:3380
- C:\Windows\System\jfHdxPw.exe
  C:\Windows\System\jfHdxPw.exe
  2⤵
  PID:6156
- C:\Windows\System\kYwkHoj.exe
  C:\Windows\System\kYwkHoj.exe
  2⤵
  PID:6212
- C:\Windows\System\QtnJalL.exe
  C:\Windows\System\QtnJalL.exe
  2⤵
  PID:6252
- C:\Windows\System\PgXYeEU.exe
  C:\Windows\System\PgXYeEU.exe
  2⤵
  PID:6328
- C:\Windows\System\JfzsTTb.exe
  C:\Windows\System\JfzsTTb.exe
  2⤵
  PID:6448
- C:\Windows\System\qzdRlTW.exe
  C:\Windows\System\qzdRlTW.exe
  2⤵
  PID:6504
- C:\Windows\System\wQtvYGc.exe
  C:\Windows\System\wQtvYGc.exe
  2⤵
  PID:5432
- C:\Windows\System\KdlWtXv.exe
  C:\Windows\System\KdlWtXv.exe
  2⤵
  PID:6676
- C:\Windows\System\BkyLRPA.exe
  C:\Windows\System\BkyLRPA.exe
  2⤵
  PID:6764
- C:\Windows\System\QRCfama.exe
  C:\Windows\System\QRCfama.exe
  2⤵
  PID:1088
- C:\Windows\System\tfTgKMj.exe
  C:\Windows\System\tfTgKMj.exe
  2⤵
  PID:7116
- C:\Windows\System\tWUctMa.exe
  C:\Windows\System\tWUctMa.exe
  2⤵
  PID:5360
- C:\Windows\System\lUGBnfI.exe
  C:\Windows\System\lUGBnfI.exe
  2⤵
  PID:5388
- C:\Windows\System\NYohUbl.exe
  C:\Windows\System\NYohUbl.exe
  2⤵
  PID:4996
- C:\Windows\System\QTfnvRt.exe
  C:\Windows\System\QTfnvRt.exe
  2⤵
  PID:6120
- C:\Windows\System\fLYFQiO.exe
  C:\Windows\System\fLYFQiO.exe
  2⤵
  PID:4752
- C:\Windows\System\kOKTPDJ.exe
  C:\Windows\System\kOKTPDJ.exe
  2⤵
  PID:4728
- C:\Windows\System\prulzpH.exe
  C:\Windows\System\prulzpH.exe
  2⤵
  PID:4712
- C:\Windows\System\IYNLyXu.exe
  C:\Windows\System\IYNLyXu.exe
  2⤵
  PID:8212
- C:\Windows\System\OFLENFk.exe
  C:\Windows\System\OFLENFk.exe
  2⤵
  PID:8228
- C:\Windows\System\vOXISOZ.exe
  C:\Windows\System\vOXISOZ.exe
  2⤵
  PID:8252
- C:\Windows\System\renVoOQ.exe
  C:\Windows\System\renVoOQ.exe
  2⤵
  PID:8272
- C:\Windows\System\BjcYpWf.exe
  C:\Windows\System\BjcYpWf.exe
  2⤵
  PID:8288
- C:\Windows\System\ssfkWGj.exe
  C:\Windows\System\ssfkWGj.exe
  2⤵
  PID:8308
- C:\Windows\System\iFnIuCD.exe
  C:\Windows\System\iFnIuCD.exe
  2⤵
  PID:8332
- C:\Windows\System\TGahBsL.exe
  C:\Windows\System\TGahBsL.exe
  2⤵
  PID:8348
- C:\Windows\System\yhRhFdb.exe
  C:\Windows\System\yhRhFdb.exe
  2⤵
  PID:8376
- C:\Windows\System\FNKvaqf.exe
  C:\Windows\System\FNKvaqf.exe
  2⤵
  PID:8400
- C:\Windows\System\EvibsBV.exe
  C:\Windows\System\EvibsBV.exe
  2⤵
  PID:8416
- C:\Windows\System\ZFPvZrF.exe
  C:\Windows\System\ZFPvZrF.exe
  2⤵
  PID:8444
- C:\Windows\System\AbRAHMu.exe
  C:\Windows\System\AbRAHMu.exe
  2⤵
  PID:8468
- C:\Windows\System\jCALCxG.exe
  C:\Windows\System\jCALCxG.exe
  2⤵
  PID:8488
- C:\Windows\System\preIdRL.exe
  C:\Windows\System\preIdRL.exe
  2⤵
  PID:8508
- C:\Windows\System\sujVngt.exe
  C:\Windows\System\sujVngt.exe
  2⤵
  PID:8524
- C:\Windows\System\ITWHQrj.exe
  C:\Windows\System\ITWHQrj.exe
  2⤵
  PID:8544
- C:\Windows\System\FETpMRl.exe
  C:\Windows\System\FETpMRl.exe
  2⤵
  PID:8560
- C:\Windows\System\JZGjnhO.exe
  C:\Windows\System\JZGjnhO.exe
  2⤵
  PID:8580
- C:\Windows\System\Anpojuk.exe
  C:\Windows\System\Anpojuk.exe
  2⤵
  PID:8600
- C:\Windows\System\LzhOuKs.exe
  C:\Windows\System\LzhOuKs.exe
  2⤵
  PID:8624
- C:\Windows\System\peYZpTv.exe
  C:\Windows\System\peYZpTv.exe
  2⤵
  PID:8640
- C:\Windows\System\lTsuNQe.exe
  C:\Windows\System\lTsuNQe.exe
  2⤵
  PID:8664
- C:\Windows\System\lmwIbAx.exe
  C:\Windows\System\lmwIbAx.exe
  2⤵
  PID:8684
- C:\Windows\System\MCoFLXh.exe
  C:\Windows\System\MCoFLXh.exe
  2⤵
  PID:8704
- C:\Windows\System\VqlCvAv.exe
  C:\Windows\System\VqlCvAv.exe
  2⤵
  PID:8720
- C:\Windows\System\PnSzCgK.exe
  C:\Windows\System\PnSzCgK.exe
  2⤵
  PID:8740
- C:\Windows\System\TpFeocL.exe
  C:\Windows\System\TpFeocL.exe
  2⤵
  PID:8760
- C:\Windows\System\mUgBgof.exe
  C:\Windows\System\mUgBgof.exe
  2⤵
  PID:8780
- C:\Windows\System\qwzlGME.exe
  C:\Windows\System\qwzlGME.exe
  2⤵
  PID:8800
- C:\Windows\System\VWAFAbT.exe
  C:\Windows\System\VWAFAbT.exe
  2⤵
  PID:8820
- C:\Windows\System\fUSyWgF.exe
  C:\Windows\System\fUSyWgF.exe
  2⤵
  PID:8840
- C:\Windows\System\cLVJzCW.exe
  C:\Windows\System\cLVJzCW.exe
  2⤵
  PID:8860
- C:\Windows\System\FgAfwNk.exe
  C:\Windows\System\FgAfwNk.exe
  2⤵
  PID:8888
- C:\Windows\System\wMqBRcj.exe
  C:\Windows\System\wMqBRcj.exe
  2⤵
  PID:8904
- C:\Windows\System\uVhLUSe.exe
  C:\Windows\System\uVhLUSe.exe
  2⤵
  PID:8924
- C:\Windows\System\niVsAmz.exe
  C:\Windows\System\niVsAmz.exe
  2⤵
  PID:8948
- C:\Windows\System\NkiUiFL.exe
  C:\Windows\System\NkiUiFL.exe
  2⤵
  PID:8976
- C:\Windows\System\GTudUqo.exe
  C:\Windows\System\GTudUqo.exe
  2⤵
  PID:8992
- C:\Windows\System\yANtBzO.exe
  C:\Windows\System\yANtBzO.exe
  2⤵
  PID:9020
- C:\Windows\System\XzMFJXG.exe
  C:\Windows\System\XzMFJXG.exe
  2⤵
  PID:9040
- C:\Windows\System\JQLxyeg.exe
  C:\Windows\System\JQLxyeg.exe
  2⤵
  PID:9064
- C:\Windows\System\ockhdsE.exe
  C:\Windows\System\ockhdsE.exe
  2⤵
  PID:9084
- C:\Windows\System\nqcbyEH.exe
  C:\Windows\System\nqcbyEH.exe
  2⤵
  PID:9104
- C:\Windows\System\OcIITwe.exe
  C:\Windows\System\OcIITwe.exe
  2⤵
  PID:9120
- C:\Windows\System\hplDsOU.exe
  C:\Windows\System\hplDsOU.exe
  2⤵
  PID:9136
- C:\Windows\System\cszEFAC.exe
  C:\Windows\System\cszEFAC.exe
  2⤵
  PID:9156
- C:\Windows\System\keYzrcb.exe
  C:\Windows\System\keYzrcb.exe
  2⤵
  PID:9180
- C:\Windows\System\SgtXMNM.exe
  C:\Windows\System\SgtXMNM.exe
  2⤵
  PID:9200
- C:\Windows\System\XtcVEEQ.exe
  C:\Windows\System\XtcVEEQ.exe
  2⤵
  PID:4124
- C:\Windows\System\TSrVoeO.exe
  C:\Windows\System\TSrVoeO.exe
  2⤵
  PID:7460
- C:\Windows\System\prWGkuA.exe
  C:\Windows\System\prWGkuA.exe
  2⤵
  PID:7524
- C:\Windows\System\pDQxewJ.exe
  C:\Windows\System\pDQxewJ.exe
  2⤵
  PID:6316
- C:\Windows\System\fbmJLlV.exe
  C:\Windows\System\fbmJLlV.exe
  2⤵
  PID:6408
- C:\Windows\System\VeSANpW.exe
  C:\Windows\System\VeSANpW.exe
  2⤵
  PID:6424
- C:\Windows\System\uqTJxWM.exe
  C:\Windows\System\uqTJxWM.exe
  2⤵
  PID:6460
- C:\Windows\System\gwHeeyi.exe
  C:\Windows\System\gwHeeyi.exe
  2⤵
  PID:6548
- C:\Windows\System\gXmiDYm.exe
  C:\Windows\System\gXmiDYm.exe
  2⤵
  PID:6612
- C:\Windows\System\LAGHJEq.exe
  C:\Windows\System\LAGHJEq.exe
  2⤵
  PID:7856
- C:\Windows\System\RrrWAaR.exe
  C:\Windows\System\RrrWAaR.exe
  2⤵
  PID:6692
- C:\Windows\System\iqsYYWL.exe
  C:\Windows\System\iqsYYWL.exe
  2⤵
  PID:7948
- C:\Windows\System\XVkjzjG.exe
  C:\Windows\System\XVkjzjG.exe
  2⤵
  PID:7956
- C:\Windows\System\hMaJOTi.exe
  C:\Windows\System\hMaJOTi.exe
  2⤵
  PID:6852
- C:\Windows\System\TIsyfIU.exe
  C:\Windows\System\TIsyfIU.exe
  2⤵
  PID:6896
- C:\Windows\System\ybHcXrW.exe
  C:\Windows\System\ybHcXrW.exe
  2⤵
  PID:8084
- C:\Windows\System\yVLHEUW.exe
  C:\Windows\System\yVLHEUW.exe
  2⤵
  PID:7104
- C:\Windows\System\SjATKbH.exe
  C:\Windows\System\SjATKbH.exe
  2⤵
  PID:7132
- C:\Windows\System\XCxmCrF.exe
  C:\Windows\System\XCxmCrF.exe
  2⤵
  PID:7156
- C:\Windows\System\NQXGWWq.exe
  C:\Windows\System\NQXGWWq.exe
  2⤵
  PID:6500
- C:\Windows\System\DCdyRgF.exe
  C:\Windows\System\DCdyRgF.exe
  2⤵
  PID:5596
- C:\Windows\System\ZKzczUu.exe
  C:\Windows\System\ZKzczUu.exe
  2⤵
  PID:6856
- C:\Windows\System\wUfroka.exe
  C:\Windows\System\wUfroka.exe
  2⤵
  PID:5392
- C:\Windows\System\VrGXFoO.exe
  C:\Windows\System\VrGXFoO.exe
  2⤵
  PID:4264
- C:\Windows\System\fAiORAo.exe
  C:\Windows\System\fAiORAo.exe
  2⤵
  PID:9228
- C:\Windows\System\WpJWjzJ.exe
  C:\Windows\System\WpJWjzJ.exe
  2⤵
  PID:9260
- C:\Windows\System\nOgyNYe.exe
  C:\Windows\System\nOgyNYe.exe
  2⤵
  PID:9280
- C:\Windows\System\vgynTJT.exe
  C:\Windows\System\vgynTJT.exe
  2⤵
  PID:9304
- C:\Windows\System\wmRXEtp.exe
  C:\Windows\System\wmRXEtp.exe
  2⤵
  PID:9328
- C:\Windows\System\QCdzBIY.exe
  C:\Windows\System\QCdzBIY.exe
  2⤵
  PID:9344
- C:\Windows\System\ZIJjJyZ.exe
  C:\Windows\System\ZIJjJyZ.exe
  2⤵
  PID:9364
- C:\Windows\System\IISteij.exe
  C:\Windows\System\IISteij.exe
  2⤵
  PID:9384
- C:\Windows\System\eVQADmf.exe
  C:\Windows\System\eVQADmf.exe
  2⤵
  PID:9408
- C:\Windows\System\iSWmgDG.exe
  C:\Windows\System\iSWmgDG.exe
  2⤵
  PID:9428
- C:\Windows\System\XrOTXnn.exe
  C:\Windows\System\XrOTXnn.exe
  2⤵
  PID:9444
- C:\Windows\System\xjOLXCo.exe
  C:\Windows\System\xjOLXCo.exe
  2⤵
  PID:9460
- C:\Windows\System\UlnUyLv.exe
  C:\Windows\System\UlnUyLv.exe
  2⤵
  PID:9476
- C:\Windows\System\ZVsqmrN.exe
  C:\Windows\System\ZVsqmrN.exe
  2⤵
  PID:9496
- C:\Windows\System\dKZoSXz.exe
  C:\Windows\System\dKZoSXz.exe
  2⤵
  PID:9512
- C:\Windows\System\HvFZYxy.exe
  C:\Windows\System\HvFZYxy.exe
  2⤵
  PID:9536
- C:\Windows\System\uMVIZzD.exe
  C:\Windows\System\uMVIZzD.exe
  2⤵
  PID:9576
- C:\Windows\System\eYLAmim.exe
  C:\Windows\System\eYLAmim.exe
  2⤵
  PID:9592
- C:\Windows\System\VazHPBe.exe
  C:\Windows\System\VazHPBe.exe
  2⤵
  PID:9612
- C:\Windows\System\nNTftmm.exe
  C:\Windows\System\nNTftmm.exe
  2⤵
  PID:9636
- C:\Windows\System\iBTsdWo.exe
  C:\Windows\System\iBTsdWo.exe
  2⤵
  PID:9656
- C:\Windows\System\pcvvKjb.exe
  C:\Windows\System\pcvvKjb.exe
  2⤵
  PID:9676
- C:\Windows\System\ulJXIWY.exe
  C:\Windows\System\ulJXIWY.exe
  2⤵
  PID:9700
- C:\Windows\System\kkhvPZG.exe
  C:\Windows\System\kkhvPZG.exe
  2⤵
  PID:9720
- C:\Windows\System\EQcMFOU.exe
  C:\Windows\System\EQcMFOU.exe
  2⤵
  PID:9740
- C:\Windows\System\qvedJlu.exe
  C:\Windows\System\qvedJlu.exe
  2⤵
  PID:9764
- C:\Windows\System\SmvuTTF.exe
  C:\Windows\System\SmvuTTF.exe
  2⤵
  PID:9780
- C:\Windows\System\YfRqXUB.exe
  C:\Windows\System\YfRqXUB.exe
  2⤵
  PID:9804
- C:\Windows\System\tmaJHNv.exe
  C:\Windows\System\tmaJHNv.exe
  2⤵
  PID:9828
- C:\Windows\System\FAObqwl.exe
  C:\Windows\System\FAObqwl.exe
  2⤵
  PID:9848
- C:\Windows\System\ZcUcdrh.exe
  C:\Windows\System\ZcUcdrh.exe
  2⤵
  PID:9868
- C:\Windows\System\GRqZtPm.exe
  C:\Windows\System\GRqZtPm.exe
  2⤵
  PID:9892
- C:\Windows\System\phqgYoN.exe
  C:\Windows\System\phqgYoN.exe
  2⤵
  PID:9912
- C:\Windows\System\WaBjDEv.exe
  C:\Windows\System\WaBjDEv.exe
  2⤵
  PID:9932
- C:\Windows\System\jZwWywS.exe
  C:\Windows\System\jZwWywS.exe
  2⤵
  PID:9956
- C:\Windows\System\IDRcjZc.exe
  C:\Windows\System\IDRcjZc.exe
  2⤵
  PID:9976
- C:\Windows\System\dUBMSmU.exe
  C:\Windows\System\dUBMSmU.exe
  2⤵
  PID:10000
- C:\Windows\System\KlovUuv.exe
  C:\Windows\System\KlovUuv.exe
  2⤵
  PID:10024
- C:\Windows\System\nhXtqnx.exe
  C:\Windows\System\nhXtqnx.exe
  2⤵
  PID:10044
- C:\Windows\System\pHfREWQ.exe
  C:\Windows\System\pHfREWQ.exe
  2⤵
  PID:10072
- C:\Windows\System\gehbIBA.exe
  C:\Windows\System\gehbIBA.exe
  2⤵
  PID:10092
- C:\Windows\System\fmaZJYe.exe
  C:\Windows\System\fmaZJYe.exe
  2⤵
  PID:10112
- C:\Windows\System\ZCfrEfJ.exe
  C:\Windows\System\ZCfrEfJ.exe
  2⤵
  PID:10132
- C:\Windows\System\wvWltlr.exe
  C:\Windows\System\wvWltlr.exe
  2⤵
  PID:10152
- C:\Windows\System\znqvynb.exe
  C:\Windows\System\znqvynb.exe
  2⤵
  PID:10176
- C:\Windows\System\FEbWXRL.exe
  C:\Windows\System\FEbWXRL.exe
  2⤵
  PID:10192
- C:\Windows\System\uVoZfBX.exe
  C:\Windows\System\uVoZfBX.exe
  2⤵
  PID:10220
- C:\Windows\System\SRcnodF.exe
  C:\Windows\System\SRcnodF.exe
  2⤵
  PID:10236
- C:\Windows\System\zsQtoZK.exe
  C:\Windows\System\zsQtoZK.exe
  2⤵
  PID:8224
- C:\Windows\System\ryBMWMe.exe
  C:\Windows\System\ryBMWMe.exe
  2⤵
  PID:7352
- C:\Windows\System\JKXtmSj.exe
  C:\Windows\System\JKXtmSj.exe
  2⤵
  PID:7392
- C:\Windows\System\TqzfNwv.exe
  C:\Windows\System\TqzfNwv.exe
  2⤵
  PID:7440
- C:\Windows\System\SMIEfgL.exe
  C:\Windows\System\SMIEfgL.exe
  2⤵
  PID:6152
- C:\Windows\System\LkfnjCW.exe
  C:\Windows\System\LkfnjCW.exe
  2⤵
  PID:8456
- C:\Windows\System\XbMbqgm.exe
  C:\Windows\System\XbMbqgm.exe
  2⤵
  PID:6296
- C:\Windows\System\IWlJqpR.exe
  C:\Windows\System\IWlJqpR.exe
  2⤵
  PID:7708
- C:\Windows\System\lNATSNr.exe
  C:\Windows\System\lNATSNr.exe
  2⤵
  PID:8572
- C:\Windows\System\LlMAuVv.exe
  C:\Windows\System\LlMAuVv.exe
  2⤵
  PID:8700
- C:\Windows\System\EjIgeaG.exe
  C:\Windows\System\EjIgeaG.exe
  2⤵
  PID:8728
- C:\Windows\System\YqUDOFv.exe
  C:\Windows\System\YqUDOFv.exe
  2⤵
  PID:8832
- C:\Windows\System\QNHSoug.exe
  C:\Windows\System\QNHSoug.exe
  2⤵
  PID:10248
- C:\Windows\System\DXrgmrF.exe
  C:\Windows\System\DXrgmrF.exe
  2⤵
  PID:10276
- C:\Windows\System\GfuzfBm.exe
  C:\Windows\System\GfuzfBm.exe
  2⤵
  PID:10296
- C:\Windows\System\NMZEmAk.exe
  C:\Windows\System\NMZEmAk.exe
  2⤵
  PID:10312
- C:\Windows\System\IqLmmMV.exe
  C:\Windows\System\IqLmmMV.exe
  2⤵
  PID:10336
- C:\Windows\System\pHYvjtb.exe
  C:\Windows\System\pHYvjtb.exe
  2⤵
  PID:10360
- C:\Windows\System\hPSFArt.exe
  C:\Windows\System\hPSFArt.exe
  2⤵
  PID:10380
- C:\Windows\System\wSGMDVG.exe
  C:\Windows\System\wSGMDVG.exe
  2⤵
  PID:10396
- C:\Windows\System\jbFxypF.exe
  C:\Windows\System\jbFxypF.exe
  2⤵
  PID:10420
- C:\Windows\System\kJwieJd.exe
  C:\Windows\System\kJwieJd.exe
  2⤵
  PID:10436
- C:\Windows\System\FoNMXMh.exe
  C:\Windows\System\FoNMXMh.exe
  2⤵
  PID:10452
- C:\Windows\System\YVHgRmr.exe
  C:\Windows\System\YVHgRmr.exe
  2⤵
  PID:10472
- C:\Windows\System\uerwwpM.exe
  C:\Windows\System\uerwwpM.exe
  2⤵
  PID:10488
- C:\Windows\System\yJNGVBv.exe
  C:\Windows\System\yJNGVBv.exe
  2⤵
  PID:10512
- C:\Windows\System\rSlGwFe.exe
  C:\Windows\System\rSlGwFe.exe
  2⤵
  PID:10532
- C:\Windows\System\ZMxHgyE.exe
  C:\Windows\System\ZMxHgyE.exe
  2⤵
  PID:10552
- C:\Windows\System\gONNLPF.exe
  C:\Windows\System\gONNLPF.exe
  2⤵
  PID:10576
- C:\Windows\System\BfamFvb.exe
  C:\Windows\System\BfamFvb.exe
  2⤵
  PID:10592
- C:\Windows\System\ULRqUGi.exe
  C:\Windows\System\ULRqUGi.exe
  2⤵
  PID:10620
- C:\Windows\System\qfPhfJe.exe
  C:\Windows\System\qfPhfJe.exe
  2⤵
  PID:10636
- C:\Windows\System\gXOAoPW.exe
  C:\Windows\System\gXOAoPW.exe
  2⤵
  PID:10660
- C:\Windows\System\HyUguQI.exe
  C:\Windows\System\HyUguQI.exe
  2⤵
  PID:10676
- C:\Windows\System\DeZiotY.exe
  C:\Windows\System\DeZiotY.exe
  2⤵
  PID:10704
- C:\Windows\System\rICkDju.exe
  C:\Windows\System\rICkDju.exe
  2⤵
  PID:10720
- C:\Windows\System\fmaOoLK.exe
  C:\Windows\System\fmaOoLK.exe
  2⤵
  PID:10744
- C:\Windows\System\UfaxiEX.exe
  C:\Windows\System\UfaxiEX.exe
  2⤵
  PID:10760
- C:\Windows\System\vpPSqXt.exe
  C:\Windows\System\vpPSqXt.exe
  2⤵
  PID:10780
- C:\Windows\System\MhfYwZl.exe
  C:\Windows\System\MhfYwZl.exe
  2⤵
  PID:10800
- C:\Windows\System\sUGmkXr.exe
  C:\Windows\System\sUGmkXr.exe
  2⤵
  PID:10820
- C:\Windows\System\zIyIxSW.exe
  C:\Windows\System\zIyIxSW.exe
  2⤵
  PID:10836
- C:\Windows\System\TuDqsXA.exe
  C:\Windows\System\TuDqsXA.exe
  2⤵
  PID:10852
- C:\Windows\System\MqkyNJQ.exe
  C:\Windows\System\MqkyNJQ.exe
  2⤵
  PID:10868
- C:\Windows\System\fPytodg.exe
  C:\Windows\System\fPytodg.exe
  2⤵
  PID:10884
- C:\Windows\System\wtrJDod.exe
  C:\Windows\System\wtrJDod.exe
  2⤵
  PID:10908
- C:\Windows\System\HSfCsza.exe
  C:\Windows\System\HSfCsza.exe
  2⤵
  PID:10924
- C:\Windows\System\WGtlgMW.exe
  C:\Windows\System\WGtlgMW.exe
  2⤵
  PID:10944
- C:\Windows\System\cVxkMWB.exe
  C:\Windows\System\cVxkMWB.exe
  2⤵
  PID:10964
- C:\Windows\System\nKGrdgz.exe
  C:\Windows\System\nKGrdgz.exe
  2⤵
  PID:10984
- C:\Windows\System\zHhmfmO.exe
  C:\Windows\System\zHhmfmO.exe
  2⤵
  PID:11012
- C:\Windows\System\oRVeoRj.exe
  C:\Windows\System\oRVeoRj.exe
  2⤵
  PID:11032
- C:\Windows\System\DEpvkSp.exe
  C:\Windows\System\DEpvkSp.exe
  2⤵
  PID:11052
- C:\Windows\System\PViqkxv.exe
  C:\Windows\System\PViqkxv.exe
  2⤵
  PID:11076
- C:\Windows\System\bGlBOPA.exe
  C:\Windows\System\bGlBOPA.exe
  2⤵
  PID:11096
- C:\Windows\System\TarcHNk.exe
  C:\Windows\System\TarcHNk.exe
  2⤵
  PID:11116
- C:\Windows\System\kyYVTdO.exe
  C:\Windows\System\kyYVTdO.exe
  2⤵
  PID:11140
- C:\Windows\System\SXJvCCc.exe
  C:\Windows\System\SXJvCCc.exe
  2⤵
  PID:11156
- C:\Windows\System\hCKVbCZ.exe
  C:\Windows\System\hCKVbCZ.exe
  2⤵
  PID:11180
- C:\Windows\System\VyXcoLP.exe
  C:\Windows\System\VyXcoLP.exe
  2⤵
  PID:11200
- C:\Windows\System\cFablkT.exe
  C:\Windows\System\cFablkT.exe
  2⤵
  PID:11224
- C:\Windows\System\BiJVrmT.exe
  C:\Windows\System\BiJVrmT.exe
  2⤵
  PID:11244
- C:\Windows\System\QdYpWge.exe
  C:\Windows\System\QdYpWge.exe
  2⤵
  PID:8848
- C:\Windows\System\BJCqkGS.exe
  C:\Windows\System\BJCqkGS.exe
  2⤵
  PID:6964
- C:\Windows\System\HwcweZF.exe
  C:\Windows\System\HwcweZF.exe
  2⤵
  PID:8920
- C:\Windows\System\Ntrjkkm.exe
  C:\Windows\System\Ntrjkkm.exe
  2⤵
  PID:7000
- C:\Windows\System\BEJDqZl.exe
  C:\Windows\System\BEJDqZl.exe
  2⤵
  PID:8056
- C:\Windows\System\OfVhrVT.exe
  C:\Windows\System\OfVhrVT.exe
  2⤵
  PID:9012
- C:\Windows\System\ixKHuBZ.exe
  C:\Windows\System\ixKHuBZ.exe
  2⤵
  PID:8156
- C:\Windows\System\VJpiiWV.exe
  C:\Windows\System\VJpiiWV.exe
  2⤵
  PID:8188
- C:\Windows\System\FnUKOfV.exe
  C:\Windows\System\FnUKOfV.exe
  2⤵
  PID:5692
- C:\Windows\System\ukRMCAU.exe
  C:\Windows\System\ukRMCAU.exe
  2⤵
  PID:9132
- C:\Windows\System\NlqvKEs.exe
  C:\Windows\System\NlqvKEs.exe
  2⤵
  PID:6248
- C:\Windows\System\aNbMyGg.exe
  C:\Windows\System\aNbMyGg.exe
  2⤵
  PID:6276
- C:\Windows\System\JPsiYGO.exe
  C:\Windows\System\JPsiYGO.exe
  2⤵
  PID:6476
- C:\Windows\System\IVBXPAV.exe
  C:\Windows\System\IVBXPAV.exe
  2⤵
  PID:7616
- C:\Windows\System\rDBtXrI.exe
  C:\Windows\System\rDBtXrI.exe
  2⤵
  PID:6392
- C:\Windows\System\yAZwwPD.exe
  C:\Windows\System\yAZwwPD.exe
  2⤵
  PID:6488
- C:\Windows\System\PjhWXAL.exe
  C:\Windows\System\PjhWXAL.exe
  2⤵
  PID:3196
- C:\Windows\System\xmYLKCZ.exe
  C:\Windows\System\xmYLKCZ.exe
  2⤵
  PID:6752
- C:\Windows\System\FotLJyI.exe
  C:\Windows\System\FotLJyI.exe
  2⤵
  PID:6100
- C:\Windows\System\voSXTPp.exe
  C:\Windows\System\voSXTPp.exe
  2⤵
  PID:8092
- C:\Windows\System\nPidloU.exe
  C:\Windows\System\nPidloU.exe
  2⤵
  PID:6048
- C:\Windows\System\zetLolp.exe
  C:\Windows\System\zetLolp.exe
  2⤵
  PID:7252
- C:\Windows\System\kGkKElK.exe
  C:\Windows\System\kGkKElK.exe
  2⤵
  PID:7300
- C:\Windows\System\AzoiKHB.exe
  C:\Windows\System\AzoiKHB.exe
  2⤵
  PID:8196
- C:\Windows\System\emdklNG.exe
  C:\Windows\System\emdklNG.exe
  2⤵
  PID:9356
- C:\Windows\System\tNtLeDi.exe
  C:\Windows\System\tNtLeDi.exe
  2⤵
  PID:7360
- C:\Windows\System\XPKcElA.exe
  C:\Windows\System\XPKcElA.exe
  2⤵
  PID:9468
- C:\Windows\System\kNHmrfR.exe
  C:\Windows\System\kNHmrfR.exe
  2⤵
  PID:9492
- C:\Windows\System\jtsnAAv.exe
  C:\Windows\System\jtsnAAv.exe
  2⤵
  PID:8412
- C:\Windows\System\vrPtUVu.exe
  C:\Windows\System\vrPtUVu.exe
  2⤵
  PID:11280
- C:\Windows\System\vhixETz.exe
  C:\Windows\System\vhixETz.exe
  2⤵
  PID:11300
- C:\Windows\System\tRRujhB.exe
  C:\Windows\System\tRRujhB.exe
  2⤵
  PID:11324
- C:\Windows\System\CmwCrJL.exe
  C:\Windows\System\CmwCrJL.exe
  2⤵
  PID:11344
- C:\Windows\System\xDGGMyF.exe
  C:\Windows\System\xDGGMyF.exe
  2⤵
  PID:11360
- C:\Windows\System\FZZnuVN.exe
  C:\Windows\System\FZZnuVN.exe
  2⤵
  PID:11384
- C:\Windows\System\nOYHiKz.exe
  C:\Windows\System\nOYHiKz.exe
  2⤵
  PID:11408
- C:\Windows\System\FXxRTaG.exe
  C:\Windows\System\FXxRTaG.exe
  2⤵
  PID:11424
- C:\Windows\System\kYgnkQL.exe
  C:\Windows\System\kYgnkQL.exe
  2⤵
  PID:11448
- C:\Windows\System\PSMicTx.exe
  C:\Windows\System\PSMicTx.exe
  2⤵
  PID:11480
- C:\Windows\System\YtvtQXC.exe
  C:\Windows\System\YtvtQXC.exe
  2⤵
  PID:11496
- C:\Windows\System\aSMJsQm.exe
  C:\Windows\System\aSMJsQm.exe
  2⤵
  PID:11524
- C:\Windows\System\ZJZfUfq.exe
  C:\Windows\System\ZJZfUfq.exe
  2⤵
  PID:11548
- C:\Windows\System\kvxptHZ.exe
  C:\Windows\System\kvxptHZ.exe
  2⤵
  PID:11576
- C:\Windows\System\ljdhxno.exe
  C:\Windows\System\ljdhxno.exe
  2⤵
  PID:11600
- C:\Windows\System\QiDCgMN.exe
  C:\Windows\System\QiDCgMN.exe
  2⤵
  PID:11616
- C:\Windows\System\BfqdYek.exe
  C:\Windows\System\BfqdYek.exe
  2⤵
  PID:11640
- C:\Windows\System\TFUbZUD.exe
  C:\Windows\System\TFUbZUD.exe
  2⤵
  PID:11664
- C:\Windows\System\vJlsehp.exe
  C:\Windows\System\vJlsehp.exe
  2⤵
  PID:11688
- C:\Windows\System\nqJSovv.exe
  C:\Windows\System\nqJSovv.exe
  2⤵
  PID:11724
- C:\Windows\System\XLyqFPx.exe
  C:\Windows\System\XLyqFPx.exe
  2⤵
  PID:11740
- C:\Windows\System\ghaBKvw.exe
  C:\Windows\System\ghaBKvw.exe
  2⤵
  PID:11756
- C:\Windows\System\JXpavfE.exe
  C:\Windows\System\JXpavfE.exe
  2⤵
  PID:11772
- C:\Windows\System\ranCrpw.exe
  C:\Windows\System\ranCrpw.exe
  2⤵
  PID:11788
- C:\Windows\System\PfEvYhb.exe
  C:\Windows\System\PfEvYhb.exe
  2⤵
  PID:11816
- C:\Windows\System\QesNzSP.exe
  C:\Windows\System\QesNzSP.exe
  2⤵
  PID:11832
- C:\Windows\System\RdxaPvX.exe
  C:\Windows\System\RdxaPvX.exe
  2⤵
  PID:11856
- C:\Windows\System\mMKACyU.exe
  C:\Windows\System\mMKACyU.exe
  2⤵
  PID:11872
- C:\Windows\System\doPczBC.exe
  C:\Windows\System\doPczBC.exe
  2⤵
  PID:11896
- C:\Windows\System\tfIDvOY.exe
  C:\Windows\System\tfIDvOY.exe
  2⤵
  PID:11916
- C:\Windows\System\TPfwrwO.exe
  C:\Windows\System\TPfwrwO.exe
  2⤵
  PID:11944
- C:\Windows\System\VoqsnzF.exe
  C:\Windows\System\VoqsnzF.exe
  2⤵
  PID:11960
- C:\Windows\System\guzBiAT.exe
  C:\Windows\System\guzBiAT.exe
  2⤵
  PID:11984
- C:\Windows\System\QokWUyU.exe
  C:\Windows\System\QokWUyU.exe
  2⤵
  PID:12008
- C:\Windows\System\ZXBYFpG.exe
  C:\Windows\System\ZXBYFpG.exe
  2⤵
  PID:12024
- C:\Windows\System\knzDQWr.exe
  C:\Windows\System\knzDQWr.exe
  2⤵
  PID:12052
- C:\Windows\System\NNWprEH.exe
  C:\Windows\System\NNWprEH.exe
  2⤵
  PID:12076
- C:\Windows\System\GcxwTub.exe
  C:\Windows\System\GcxwTub.exe
  2⤵
  PID:12096
- C:\Windows\System\RqhBObD.exe
  C:\Windows\System\RqhBObD.exe
  2⤵
  PID:12116
- C:\Windows\System\ZeDbsMa.exe
  C:\Windows\System\ZeDbsMa.exe
  2⤵
  PID:12140
- C:\Windows\System\KnvekGQ.exe
  C:\Windows\System\KnvekGQ.exe
  2⤵
  PID:12160
- C:\Windows\System\lDYcpxw.exe
  C:\Windows\System\lDYcpxw.exe
  2⤵
  PID:12184
- C:\Windows\System\ihEVfUc.exe
  C:\Windows\System\ihEVfUc.exe
  2⤵
  PID:12204
- C:\Windows\System\xtHvWet.exe
  C:\Windows\System\xtHvWet.exe
  2⤵
  PID:12224
- C:\Windows\System\BHmPlAx.exe
  C:\Windows\System\BHmPlAx.exe
  2⤵
  PID:12244
- C:\Windows\System\hUZkAcz.exe
  C:\Windows\System\hUZkAcz.exe
  2⤵
  PID:12272
- C:\Windows\System\bHCeqKK.exe
  C:\Windows\System\bHCeqKK.exe
  2⤵
  PID:7560
- C:\Windows\System\WPJMYoR.exe
  C:\Windows\System\WPJMYoR.exe
  2⤵
  PID:8460
- C:\Windows\System\TGJlcfT.exe
  C:\Windows\System\TGJlcfT.exe
  2⤵
  PID:7656
- C:\Windows\System\kVlbaQR.exe
  C:\Windows\System\kVlbaQR.exe
  2⤵
  PID:8516
- C:\Windows\System\xQoakxQ.exe
  C:\Windows\System\xQoakxQ.exe
  2⤵
  PID:9860
- C:\Windows\System\mCyALMh.exe
  C:\Windows\System\mCyALMh.exe
  2⤵
  PID:9924
- C:\Windows\System\qbpKQia.exe
  C:\Windows\System\qbpKQia.exe
  2⤵
  PID:9964
- C:\Windows\System\ryUAiFD.exe
  C:\Windows\System\ryUAiFD.exe
  2⤵
  PID:10084
- C:\Windows\System\HmXJvct.exe
  C:\Windows\System\HmXJvct.exe
  2⤵
  PID:8656
- C:\Windows\System\hTjJPKS.exe
  C:\Windows\System\hTjJPKS.exe
  2⤵
  PID:10172
- C:\Windows\System\QgcSphq.exe
  C:\Windows\System\QgcSphq.exe
  2⤵
  PID:8692
- C:\Windows\System\bzXtXMZ.exe
  C:\Windows\System\bzXtXMZ.exe
  2⤵
  PID:8712
- C:\Windows\System\opKXkMM.exe
  C:\Windows\System\opKXkMM.exe
  2⤵
  PID:7504
- C:\Windows\System\eBYKzBB.exe
  C:\Windows\System\eBYKzBB.exe
  2⤵
  PID:12296
- C:\Windows\System\BCcnWys.exe
  C:\Windows\System\BCcnWys.exe
  2⤵
  PID:12320
- C:\Windows\System\QneNVbz.exe
  C:\Windows\System\QneNVbz.exe
  2⤵
  PID:12340
- C:\Windows\System\PLUAwxs.exe
  C:\Windows\System\PLUAwxs.exe
  2⤵
  PID:12360
- C:\Windows\System\HgYEOFU.exe
  C:\Windows\System\HgYEOFU.exe
  2⤵
  PID:12376
- C:\Windows\System\DIhKFIp.exe
  C:\Windows\System\DIhKFIp.exe
  2⤵
  PID:12404
- C:\Windows\System\MNOXlyG.exe
  C:\Windows\System\MNOXlyG.exe
  2⤵
  PID:12420
- C:\Windows\System\JatAahJ.exe
  C:\Windows\System\JatAahJ.exe
  2⤵
  PID:12448
- C:\Windows\System\BTTSaEo.exe
  C:\Windows\System\BTTSaEo.exe
  2⤵
  PID:12468
- C:\Windows\System\gLajcmY.exe
  C:\Windows\System\gLajcmY.exe
  2⤵
  PID:12492
- C:\Windows\System\ffEzdRK.exe
  C:\Windows\System\ffEzdRK.exe
  2⤵
  PID:12512
- C:\Windows\System\AUakabT.exe
  C:\Windows\System\AUakabT.exe
  2⤵
  PID:9056
- C:\Windows\System\bSSBtgO.exe
  C:\Windows\System\bSSBtgO.exe
  2⤵
  PID:10584
- C:\Windows\System\oSaxSVU.exe
  C:\Windows\System\oSaxSVU.exe
  2⤵
  PID:6196
- C:\Windows\System\FPNlDTk.exe
  C:\Windows\System\FPNlDTk.exe
  2⤵
  PID:4964
- C:\Windows\System\InREksL.exe
  C:\Windows\System\InREksL.exe
  2⤵
  PID:1256
- C:\Windows\System\ToltuZF.exe
  C:\Windows\System\ToltuZF.exe
  2⤵
  PID:7736
- C:\Windows\System\RRIuyTP.exe
  C:\Windows\System\RRIuyTP.exe
  2⤵
  PID:7880
- C:\Windows\System\YiIUUwq.exe
  C:\Windows\System\YiIUUwq.exe
  2⤵
  PID:11236
- C:\Windows\System\BgvMhzG.exe
  C:\Windows\System\BgvMhzG.exe
  2⤵
  PID:644
- C:\Windows\System\tmVIhKW.exe
  C:\Windows\System\tmVIhKW.exe
  2⤵
  PID:7240
- C:\Windows\System\BhEiTvm.exe
  C:\Windows\System\BhEiTvm.exe
  2⤵
  PID:2744
- C:\Windows\System\ukKwSDH.exe
  C:\Windows\System\ukKwSDH.exe
  2⤵
  PID:9100
- C:\Windows\System\GdpMfcz.exe
  C:\Windows\System\GdpMfcz.exe
  2⤵
  PID:7396
- C:\Windows\System\oPHlPKe.exe
  C:\Windows\System\oPHlPKe.exe
  2⤵
  PID:8280
- C:\Windows\System\LAXcAzb.exe
  C:\Windows\System\LAXcAzb.exe
  2⤵
  PID:6776
- C:\Windows\System\DZzvGFO.exe
  C:\Windows\System\DZzvGFO.exe
  2⤵
  PID:9548
- C:\Windows\System\SWYQpGf.exe
  C:\Windows\System\SWYQpGf.exe
  2⤵
  PID:8424
- C:\Windows\System\fPaHtil.exe
  C:\Windows\System\fPaHtil.exe
  2⤵
  PID:9624
- C:\Windows\System\zAeHFQt.exe
  C:\Windows\System\zAeHFQt.exe
  2⤵
  PID:9684
- C:\Windows\System\mxeWRJq.exe
  C:\Windows\System\mxeWRJq.exe
  2⤵
  PID:11612
- C:\Windows\System\bRhzgit.exe
  C:\Windows\System\bRhzgit.exe
  2⤵
  PID:11908
- C:\Windows\System\nMeeOMR.exe
  C:\Windows\System\nMeeOMR.exe
  2⤵
  PID:12044
- C:\Windows\System\wKxkifU.exe
  C:\Windows\System\wKxkifU.exe
  2⤵
  PID:10020
- C:\Windows\System\iKJbWgJ.exe
  C:\Windows\System\iKJbWgJ.exe
  2⤵
  PID:8596
- C:\Windows\System\yknzBRu.exe
  C:\Windows\System\yknzBRu.exe
  2⤵
  PID:10120
- C:\Windows\System\NPLrqVb.exe
  C:\Windows\System\NPLrqVb.exe
  2⤵
  PID:12264
- C:\Windows\System\VfuCxgZ.exe
  C:\Windows\System\VfuCxgZ.exe
  2⤵
  PID:8248
- C:\Windows\System\yhuMbSm.exe
  C:\Windows\System\yhuMbSm.exe
  2⤵
  PID:8792
- C:\Windows\System\nFBnMXj.exe
  C:\Windows\System\nFBnMXj.exe
  2⤵
  PID:9252
- C:\Windows\System\JRXmlmm.exe
  C:\Windows\System\JRXmlmm.exe
  2⤵
  PID:9296
- C:\Windows\System\yzcoGmT.exe
  C:\Windows\System\yzcoGmT.exe
  2⤵
  PID:5800
- C:\Windows\System\TZajJOw.exe
  C:\Windows\System\TZajJOw.exe
  2⤵
  PID:3152
- C:\Windows\System\ahekKye.exe
  C:\Windows\System\ahekKye.exe
  2⤵
  PID:9196
- C:\Windows\System\BaAhGPd.exe
  C:\Windows\System\BaAhGPd.exe
  2⤵
  PID:8304
- C:\Windows\System\mvBszjL.exe
  C:\Windows\System\mvBszjL.exe
  2⤵
  PID:8396
- C:\Windows\System\IhOceQk.exe
  C:\Windows\System\IhOceQk.exe
  2⤵
  PID:9696
- C:\Windows\System\MUmjUhP.exe
  C:\Windows\System\MUmjUhP.exe
  2⤵
  PID:9400
- C:\Windows\System\XYpQopr.exe
  C:\Windows\System\XYpQopr.exe
  2⤵
  PID:11764
- C:\Windows\System\CMJMQyF.exe
  C:\Windows\System\CMJMQyF.exe
  2⤵
  PID:8776
- C:\Windows\System\JIGUYNP.exe
  C:\Windows\System\JIGUYNP.exe
  2⤵
  PID:12308
- C:\Windows\System\yCdNljy.exe
  C:\Windows\System\yCdNljy.exe
  2⤵
  PID:12864
- C:\Windows\System\zUlcYri.exe
  C:\Windows\System\zUlcYri.exe
  2⤵
  PID:8736
- C:\Windows\System\OVtCBgo.exe
  C:\Windows\System\OVtCBgo.exe
  2⤵
  PID:12332
- C:\Windows\System\xtpnPQY.exe
  C:\Windows\System\xtpnPQY.exe
  2⤵
  PID:8360
- C:\Windows\System\hNOSdcI.exe
  C:\Windows\System\hNOSdcI.exe
  2⤵
  PID:11368
- C:\Windows\System\YYvfoVC.exe
  C:\Windows\System\YYvfoVC.exe
  2⤵
  PID:12476
- C:\Windows\System\sNOPxqH.exe
  C:\Windows\System\sNOPxqH.exe
  2⤵
  PID:9376
- C:\Windows\System\OgqygKU.exe
  C:\Windows\System\OgqygKU.exe
  2⤵
  PID:9396
- C:\Windows\System\kmPVtqw.exe
  C:\Windows\System\kmPVtqw.exe
  2⤵
  PID:8172
- C:\Windows\System\BkNMSan.exe
  C:\Windows\System\BkNMSan.exe
  2⤵
  PID:11192
- C:\Windows\System\FaOHyOG.exe
  C:\Windows\System\FaOHyOG.exe
  2⤵
  PID:10812
- C:\Windows\System\odHqvrc.exe
  C:\Windows\System\odHqvrc.exe
  2⤵
  PID:12032
- C:\Windows\System\vHvocxQ.exe
  C:\Windows\System\vHvocxQ.exe
  2⤵
  PID:11008
- C:\Windows\System\Qeptzff.exe
  C:\Windows\System\Qeptzff.exe
  2⤵
  PID:9948
- C:\Windows\System\ZbLXgKl.exe
  C:\Windows\System\ZbLXgKl.exe
  2⤵
  PID:10844
- C:\Windows\System\YGNfSDc.exe
  C:\Windows\System\YGNfSDc.exe
  2⤵
  PID:11420
- C:\Windows\System\HKsSVpV.exe
  C:\Windows\System\HKsSVpV.exe
  2⤵
  PID:10860
- C:\Windows\System\ABKEvjd.exe
  C:\Windows\System\ABKEvjd.exe
  2⤵
  PID:10752
- C:\Windows\System\wUIKBJP.exe
  C:\Windows\System\wUIKBJP.exe
  2⤵
  PID:6728
- C:\Windows\System\WEgKekn.exe
  C:\Windows\System\WEgKekn.exe
  2⤵
  PID:12740
- C:\Windows\System\nEcZBsq.exe
  C:\Windows\System\nEcZBsq.exe
  2⤵
  PID:12280
- C:\Windows\System\KSNVtBv.exe
  C:\Windows\System\KSNVtBv.exe
  2⤵
  PID:9096
- C:\Windows\System\xxbqDvo.exe
  C:\Windows\System\xxbqDvo.exe
  2⤵
  PID:10608
- C:\Windows\System\bZIZBlO.exe
  C:\Windows\System\bZIZBlO.exe
  2⤵
  PID:11808
- C:\Windows\System\iEcHDBk.exe
  C:\Windows\System\iEcHDBk.exe
  2⤵
  PID:10672
- C:\Windows\System\bNFmFYc.exe
  C:\Windows\System\bNFmFYc.exe
  2⤵
  PID:6400
- C:\Windows\System\lwnzEaa.exe
  C:\Windows\System\lwnzEaa.exe
  2⤵
  PID:8408
- C:\Windows\System\beTXswM.exe
  C:\Windows\System\beTXswM.exe
  2⤵
  PID:13068
- C:\Windows\System\sTzsAuN.exe
  C:\Windows\System\sTzsAuN.exe
  2⤵
  PID:12020
- C:\Windows\System\qUowNfu.exe
  C:\Windows\System\qUowNfu.exe
  2⤵
  PID:13140
- C:\Windows\System\tQiVFcQ.exe
  C:\Windows\System\tQiVFcQ.exe
  2⤵
  PID:10756
- C:\Windows\System\obIOmGf.exe
  C:\Windows\System\obIOmGf.exe
  2⤵
  PID:10716
- C:\Windows\System\roMqDkW.exe
  C:\Windows\System\roMqDkW.exe
  2⤵
  PID:11652
- C:\Windows\System\IXUNJZk.exe
  C:\Windows\System\IXUNJZk.exe
  2⤵
  PID:3912
- C:\Windows\System\QneXWlM.exe
  C:\Windows\System\QneXWlM.exe
  2⤵
  PID:10996
- C:\Windows\System\BpLjjfI.exe
  C:\Windows\System\BpLjjfI.exe
  2⤵
  PID:13236
- C:\Windows\System\dWgajIb.exe
  C:\Windows\System\dWgajIb.exe
  2⤵
  PID:5364
- C:\Windows\System\OoHGJgI.exe
  C:\Windows\System\OoHGJgI.exe
  2⤵
  PID:13324
- C:\Windows\System\xzCDgnX.exe
  C:\Windows\System\xzCDgnX.exe
  2⤵
  PID:13340
- C:\Windows\System\XvthYSI.exe
  C:\Windows\System\XvthYSI.exe
  2⤵
  PID:13364
- C:\Windows\System\OwsGFwA.exe
  C:\Windows\System\OwsGFwA.exe
  2⤵
  PID:13392
- C:\Windows\System\IqpYCAY.exe
  C:\Windows\System\IqpYCAY.exe
  2⤵
  PID:13408
- C:\Windows\System\gfENYpU.exe
  C:\Windows\System\gfENYpU.exe
  2⤵
  PID:13432
- C:\Windows\System\CPvFYzn.exe
  C:\Windows\System\CPvFYzn.exe
  2⤵
  PID:13456
- C:\Windows\System\nAKlMRu.exe
  C:\Windows\System\nAKlMRu.exe
  2⤵
  PID:13480
- C:\Windows\System\arkAmrz.exe
  C:\Windows\System\arkAmrz.exe
  2⤵
  PID:13516
- C:\Windows\System\QzQVZYZ.exe
  C:\Windows\System\QzQVZYZ.exe
  2⤵
  PID:13532
- C:\Windows\System\zRgIlLK.exe
  C:\Windows\System\zRgIlLK.exe
  2⤵
  PID:13548
- C:\Windows\System\oLIkRAE.exe
  C:\Windows\System\oLIkRAE.exe
  2⤵
  PID:13576
- C:\Windows\System\BSjgYnC.exe
  C:\Windows\System\BSjgYnC.exe
  2⤵
  PID:13600
- C:\Windows\System\vTNrzYB.exe
  C:\Windows\System\vTNrzYB.exe
  2⤵
  PID:13620
- C:\Windows\System\gfhSUer.exe
  C:\Windows\System\gfhSUer.exe
  2⤵
  PID:13636
- C:\Windows\System\zUFiWKE.exe
  C:\Windows\System\zUFiWKE.exe
  2⤵
  PID:13652
- C:\Windows\System\ZLnKxzj.exe
  C:\Windows\System\ZLnKxzj.exe
  2⤵
  PID:13676
- C:\Windows\System\CwjbahV.exe
  C:\Windows\System\CwjbahV.exe
  2⤵
  PID:13700
- C:\Windows\System\dkPvbfh.exe
  C:\Windows\System\dkPvbfh.exe
  2⤵
  PID:13716
- C:\Windows\System\NQJfXFf.exe
  C:\Windows\System\NQJfXFf.exe
  2⤵
  PID:13736
- C:\Windows\System\bOPqBGw.exe
  C:\Windows\System\bOPqBGw.exe
  2⤵
  PID:13804
- C:\Windows\System\Ehchvce.exe
  C:\Windows\System\Ehchvce.exe
  2⤵
  PID:13824
- C:\Windows\System\UaSVHQv.exe
  C:\Windows\System\UaSVHQv.exe
  2⤵
  PID:13848
- C:\Windows\System\IZJXVwu.exe
  C:\Windows\System\IZJXVwu.exe
  2⤵
  PID:13880
- C:\Windows\System\YIaBFuU.exe
  C:\Windows\System\YIaBFuU.exe
  2⤵
  PID:14036
- C:\Windows\System\bbmzEiv.exe
  C:\Windows\System\bbmzEiv.exe
  2⤵
  PID:14104
- C:\Windows\System\WSIphMF.exe
  C:\Windows\System\WSIphMF.exe
  2⤵
  PID:14188
- C:\Windows\System\XbJDXWZ.exe
  C:\Windows\System\XbJDXWZ.exe
  2⤵
  PID:14208
- C:\Windows\System\pzZSzXy.exe
  C:\Windows\System\pzZSzXy.exe
  2⤵
  PID:14316
- C:\Windows\System\OLOMJXB.exe
  C:\Windows\System\OLOMJXB.exe
  2⤵
  PID:4960
- C:\Windows\System\lWSWquc.exe
  C:\Windows\System\lWSWquc.exe
  2⤵
  PID:12152
- C:\Windows\System\enhzVnw.exe
  C:\Windows\System\enhzVnw.exe
  2⤵
  PID:6380
- C:\Windows\System\WLmuMSN.exe
  C:\Windows\System\WLmuMSN.exe
  2⤵
  PID:5644
- C:\Windows\System\snoVhwS.exe
  C:\Windows\System\snoVhwS.exe
  2⤵
  PID:12088
- C:\Windows\System\ZInplav.exe
  C:\Windows\System\ZInplav.exe
  2⤵
  PID:13332
- C:\Windows\System\QPZrWDL.exe
  C:\Windows\System\QPZrWDL.exe
  2⤵
  PID:13612
- C:\Windows\System\YAxjhPj.exe
  C:\Windows\System\YAxjhPj.exe
  2⤵
  PID:9452
- C:\Windows\System\LxSQpYK.exe
  C:\Windows\System\LxSQpYK.exe
  2⤵
  PID:6188
- C:\Windows\System\SgsuBLy.exe
  C:\Windows\System\SgsuBLy.exe
  2⤵
  PID:13020
- C:\Windows\System\voZfNKA.exe
  C:\Windows\System\voZfNKA.exe
  2⤵
  PID:13764
- C:\Windows\System\itdkVmQ.exe
  C:\Windows\System\itdkVmQ.exe
  2⤵
  PID:13820
- C:\Windows\System\OyLWbZp.exe
  C:\Windows\System\OyLWbZp.exe
  2⤵
  PID:14112
- C:\Windows\System\mGqZsCA.exe
  C:\Windows\System\mGqZsCA.exe
  2⤵
  PID:14184
- C:\Windows\System\ymTgpVz.exe
  C:\Windows\System\ymTgpVz.exe
  2⤵
  PID:13472
- C:\Windows\System\fAPSRKc.exe
  C:\Windows\System\fAPSRKc.exe
  2⤵
  PID:14076
- C:\Windows\System\ZButEkm.exe
  C:\Windows\System\ZButEkm.exe
  2⤵
  PID:14096
- C:\Windows\System\CZjotMN.exe
  C:\Windows\System\CZjotMN.exe
  2⤵
  PID:14164
- C:\Windows\System\bcxEJJm.exe
  C:\Windows\System\bcxEJJm.exe
  2⤵
  PID:13872
- C:\Windows\System\FWztoJv.exe
  C:\Windows\System\FWztoJv.exe
  2⤵
  PID:14292
- C:\Windows\System\edUrFFH.exe
  C:\Windows\System\edUrFFH.exe
  2⤵
  PID:14308
- C:\Windows\System\VODuBLV.exe
  C:\Windows\System\VODuBLV.exe
  2⤵
  PID:2556
- C:\Windows\System\dFDXOWv.exe
  C:\Windows\System\dFDXOWv.exe
  2⤵
  PID:13728
- C:\Windows\System\ToMmMcO.exe
  C:\Windows\System\ToMmMcO.exe
  2⤵
  PID:13712
- C:\Windows\System\rkfyqfs.exe
  C:\Windows\System\rkfyqfs.exe
  2⤵
  PID:10128
- C:\Windows\System\wqGqZRY.exe
  C:\Windows\System\wqGqZRY.exe
  2⤵
  PID:13744
- C:\Windows\System\qaoejKM.exe
  C:\Windows\System\qaoejKM.exe
  2⤵
  PID:13752
- C:\Windows\System\kkDuBYw.exe
  C:\Windows\System\kkDuBYw.exe
  2⤵
  PID:13788
- C:\Windows\System\AltQmRs.exe
  C:\Windows\System\AltQmRs.exe
  2⤵
  PID:14024
- C:\Windows\System\zwetwdM.exe
  C:\Windows\System\zwetwdM.exe
  2⤵
  PID:14048
- C:\Windows\System\buZnjhc.exe
  C:\Windows\System\buZnjhc.exe
  2⤵
  PID:4680
- C:\Windows\System\rFupTcs.exe
  C:\Windows\System\rFupTcs.exe
  2⤵
  PID:464
- C:\Windows\System\bPEDnYD.exe
  C:\Windows\System\bPEDnYD.exe
  2⤵
  PID:3352
- C:\Windows\System\xZufFFt.exe
  C:\Windows\System\xZufFFt.exe
  2⤵
  PID:4324
- C:\Windows\System\MoNWvwY.exe
  C:\Windows\System\MoNWvwY.exe
  2⤵
  PID:12532
- C:\Windows\System\nAapSKv.exe
  C:\Windows\System\nAapSKv.exe
  2⤵
  PID:11492
- C:\Windows\System\SnDqlGy.exe
  C:\Windows\System\SnDqlGy.exe
  2⤵
  PID:11956
- C:\Windows\System\SHpphqs.exe
  C:\Windows\System\SHpphqs.exe
  2⤵
  PID:7212
- C:\Windows\System\mCreyAZ.exe
  C:\Windows\System\mCreyAZ.exe
  2⤵
  PID:12936
- C:\Windows\System\rrWUGrF.exe
  C:\Windows\System\rrWUGrF.exe
  2⤵
  PID:10816
- C:\Windows\System\tlZcGxZ.exe
  C:\Windows\System\tlZcGxZ.exe
  2⤵
  PID:13464
- C:\Windows\System\qmwXTaU.exe
  C:\Windows\System\qmwXTaU.exe
  2⤵
  PID:13352
- C:\Windows\System\UNvUWry.exe
  C:\Windows\System\UNvUWry.exe
  2⤵
  PID:5200
- C:\Windows\System\drJTdgK.exe
  C:\Windows\System\drJTdgK.exe
  2⤵
  PID:5276
- C:\Windows\System\mjhjXUD.exe
  C:\Windows\System\mjhjXUD.exe
  2⤵
  PID:1528
- C:\Windows\System\AlocLfI.exe
  C:\Windows\System\AlocLfI.exe
  2⤵
  PID:13660
- C:\Windows\System\VGlwySE.exe
  C:\Windows\System\VGlwySE.exe
  2⤵
  PID:13560
- C:\Windows\System\twPhRiS.exe
  C:\Windows\System\twPhRiS.exe
  2⤵
  PID:13672
- C:\Windows\System\Sqaumql.exe
  C:\Windows\System\Sqaumql.exe
  2⤵
  PID:13504
- C:\Windows\System\DUrlmjb.exe
  C:\Windows\System\DUrlmjb.exe
  2⤵
  PID:11004
- C:\Windows\System\bzLqaDA.exe
  C:\Windows\System\bzLqaDA.exe
  2⤵
  PID:13836
- C:\Windows\System\WSeehFZ.exe
  C:\Windows\System\WSeehFZ.exe
  2⤵
  PID:1688
- C:\Windows\System\oxWfABN.exe
  C:\Windows\System\oxWfABN.exe
  2⤵
  PID:5004
- C:\Windows\System\PqpkIbY.exe
  C:\Windows\System\PqpkIbY.exe
  2⤵
  PID:1536
- C:\Windows\System\uyfwfbP.exe
  C:\Windows\System\uyfwfbP.exe
  2⤵
  PID:13496
- C:\Windows\System\woNDfsu.exe
  C:\Windows\System\woNDfsu.exe
  2⤵
  PID:14244
- C:\Windows\System\VBtWZIF.exe
  C:\Windows\System\VBtWZIF.exe
  2⤵
  PID:14228
- C:\Windows\System\ppFTgFj.exe
  C:\Windows\System\ppFTgFj.exe
  2⤵
  PID:3184
- C:\Windows\System\NJZiGfH.exe
  C:\Windows\System\NJZiGfH.exe
  2⤵
  PID:8788
- C:\Windows\System\BSCmbUI.exe
  C:\Windows\System\BSCmbUI.exe
  2⤵
  PID:13644
- C:\Windows\System\irItTRX.exe
  C:\Windows\System\irItTRX.exe
  2⤵
  PID:4848
- C:\Windows\System\utdQsPN.exe
  C:\Windows\System\utdQsPN.exe
  2⤵
  PID:2960
- C:\Windows\System\PFjMxpe.exe
  C:\Windows\System\PFjMxpe.exe
  2⤵
  PID:1952
- C:\Windows\System\IYEfVgd.exe
  C:\Windows\System\IYEfVgd.exe
  2⤵
  PID:10356
- C:\Windows\System\jrZjoCU.exe
  C:\Windows\System\jrZjoCU.exe
  2⤵
  PID:4392
- C:\Windows\System\jHrjUku.exe
  C:\Windows\System\jHrjUku.exe
  2⤵
  PID:10464
- C:\Windows\System\vJXteJH.exe
  C:\Windows\System\vJXteJH.exe
  2⤵
  PID:14156
- C:\Windows\System\NpUGpmA.exe
  C:\Windows\System\NpUGpmA.exe
  2⤵
  PID:4236
- C:\Windows\System\PAhiAFo.exe
  C:\Windows\System\PAhiAFo.exe
  2⤵
  PID:8024
- C:\Windows\System\qhNCusH.exe
  C:\Windows\System\qhNCusH.exe
  2⤵
  PID:13428
- C:\Windows\System\OCHwxZn.exe
  C:\Windows\System\OCHwxZn.exe
  2⤵
  PID:6872
- C:\Windows\System\aPYlzrM.exe
  C:\Windows\System\aPYlzrM.exe
  2⤵
  PID:14016
- C:\Windows\System\wZaUFuU.exe
  C:\Windows\System\wZaUFuU.exe
  2⤵
  PID:1676
- C:\Windows\System\kxIBStx.exe
  C:\Windows\System\kxIBStx.exe
  2⤵
  PID:5032
- C:\Windows\System\skjsGPv.exe
  C:\Windows\System\skjsGPv.exe
  2⤵
  PID:4952
- C:\Windows\System\FcTBxub.exe
  C:\Windows\System\FcTBxub.exe
  2⤵
  PID:13964
- C:\Windows\System\VcjxIJc.exe
  C:\Windows\System\VcjxIJc.exe
  2⤵
  PID:656
- C:\Windows\System\dkpuelo.exe
  C:\Windows\System\dkpuelo.exe
  2⤵
  PID:11340
- C:\Windows\System\TXSfntf.exe
  C:\Windows\System\TXSfntf.exe
  2⤵
  PID:2636
- C:\Windows\System\QBbWlCz.exe
  C:\Windows\System\QBbWlCz.exe
  2⤵
  PID:13448
- C:\Windows\System\sTrUhjB.exe
  C:\Windows\System\sTrUhjB.exe
  2⤵
  PID:4432
- C:\Windows\System\JdlwQoh.exe
  C:\Windows\System\JdlwQoh.exe
  2⤵
  PID:1860
- C:\Windows\System\brkgqiD.exe
  C:\Windows\System\brkgqiD.exe
  2⤵
  PID:10412
- C:\Windows\System\LfOIKiw.exe
  C:\Windows\System\LfOIKiw.exe
  2⤵
  PID:8812
- C:\Windows\System\xSQQWfI.exe
  C:\Windows\System\xSQQWfI.exe
  2⤵
  PID:5468
- C:\Windows\System\HDDaakz.exe
  C:\Windows\System\HDDaakz.exe
  2⤵
  PID:4760
- C:\Windows\System\owiwcWS.exe
  C:\Windows\System\owiwcWS.exe
  2⤵
  PID:12948
- C:\Windows\System\zeaGYss.exe
  C:\Windows\System\zeaGYss.exe
  2⤵
  PID:13844
- C:\Windows\System\oPNkGcj.exe
  C:\Windows\System\oPNkGcj.exe
  2⤵
  PID:3240
- C:\Windows\System\tFKUcDm.exe
  C:\Windows\System\tFKUcDm.exe
  2⤵
  PID:5340
- C:\Windows\System\sRdBMhc.exe
  C:\Windows\System\sRdBMhc.exe
  2⤵
  PID:14028
- C:\Windows\System\qMOywae.exe
  C:\Windows\System\qMOywae.exe
  2⤵
  PID:3672
- C:\Windows\System\ammPCRJ.exe
  C:\Windows\System\ammPCRJ.exe
  2⤵
  PID:14284
- C:\Windows\System\WgoWnKM.exe
  C:\Windows\System\WgoWnKM.exe
  2⤵
  PID:14204
- C:\Windows\System\WPjcuCS.exe
  C:\Windows\System\WPjcuCS.exe
  2⤵
  PID:6444
- C:\Windows\System\Sjhcqxb.exe
  C:\Windows\System\Sjhcqxb.exe
  2⤵
  PID:812
- C:\Windows\System\PuAbxhf.exe
  C:\Windows\System\PuAbxhf.exe
  2⤵
  PID:5012
- C:\Windows\System\UourLCs.exe
  C:\Windows\System\UourLCs.exe
  2⤵
  PID:13388
- C:\Windows\System\PLErbMq.exe
  C:\Windows\System\PLErbMq.exe
  2⤵
  PID:5300
- C:\Windows\System\OubvXOU.exe
  C:\Windows\System\OubvXOU.exe
  2⤵
  PID:1412
- C:\Windows\System\aaJNgcZ.exe
  C:\Windows\System\aaJNgcZ.exe
  2⤵
  PID:4724
- C:\Windows\System\Mtrojwd.exe
  C:\Windows\System\Mtrojwd.exe
  2⤵
  PID:5308
- C:\Windows\System\CGKDxLE.exe
  C:\Windows\System\CGKDxLE.exe
  2⤵
  PID:5052
- C:\Windows\System\WnRuADY.exe
  C:\Windows\System\WnRuADY.exe
  2⤵
  PID:5444
- C:\Windows\System\gmgolHM.exe
  C:\Windows\System\gmgolHM.exe
  2⤵
  PID:5640
- C:\Windows\System\yYGvfXp.exe
  C:\Windows\System\yYGvfXp.exe
  2⤵
  PID:5824
- C:\Windows\System\OroGwso.exe
  C:\Windows\System\OroGwso.exe
  2⤵
  PID:6000
- C:\Windows\System\pDuEZgX.exe
  C:\Windows\System\pDuEZgX.exe
  2⤵
  PID:6584
- C:\Windows\System\VUCpNVP.exe
  C:\Windows\System\VUCpNVP.exe
  2⤵
  PID:7912
- C:\Windows\System\dNmtRJj.exe
  C:\Windows\System\dNmtRJj.exe
  2⤵
  PID:14136
- C:\Windows\System\gFpeGsQ.exe
  C:\Windows\System\gFpeGsQ.exe
  2⤵
  PID:7944
- C:\Windows\System\PLshqnb.exe
  C:\Windows\System\PLshqnb.exe
  2⤵
  PID:6876
- C:\Windows\System\pZcgPXg.exe
  C:\Windows\System\pZcgPXg.exe
  2⤵
  PID:13420
- C:\Windows\System\miuQVZb.exe
  C:\Windows\System\miuQVZb.exe
  2⤵
  PID:1012
- C:\Windows\System\HxySrfK.exe
  C:\Windows\System\HxySrfK.exe
  2⤵
  PID:6608
- C:\Windows\System\sOZLVkU.exe
  C:\Windows\System\sOZLVkU.exe
  2⤵
  PID:5604
- C:\Windows\System\EEoSOBG.exe
  C:\Windows\System\EEoSOBG.exe
  2⤵
  PID:6080
- C:\Windows\System\PNcJgdP.exe
  C:\Windows\System\PNcJgdP.exe
  2⤵
  PID:8972
- C:\Windows\System\seZYFrU.exe
  C:\Windows\System\seZYFrU.exe
  2⤵
  PID:9176
- C:\Windows\System\FNZiwyy.exe
  C:\Windows\System\FNZiwyy.exe
  2⤵
  PID:7412
- C:\Windows\System\BuAXdvq.exe
  C:\Windows\System\BuAXdvq.exe
  2⤵
  PID:6364
- C:\Windows\System\DAFzUaF.exe
  C:\Windows\System\DAFzUaF.exe
  2⤵
  PID:7628
- C:\Windows\System\GAciQuN.exe
  C:\Windows\System\GAciQuN.exe
  2⤵
  PID:9004
- C:\Windows\System\HVXLgbR.exe
  C:\Windows\System\HVXLgbR.exe
  2⤵
  PID:5180
- C:\Windows\System\bTNrPZN.exe
  C:\Windows\System\bTNrPZN.exe
  2⤵
  PID:4812
- C:\Windows\System\VdJEKUg.exe
  C:\Windows\System\VdJEKUg.exe
  2⤵
  PID:5532
- C:\Windows\System\dXzxdYI.exe
  C:\Windows\System\dXzxdYI.exe
  2⤵
  PID:6616
- C:\Windows\System\dbkomlG.exe
  C:\Windows\System\dbkomlG.exe
  2⤵
  PID:6648
- C:\Windows\System\QcuzVlL.exe
  C:\Windows\System\QcuzVlL.exe
  2⤵
  PID:4076
- C:\Windows\System\SgPhGJF.exe
  C:\Windows\System\SgPhGJF.exe
  2⤵
  PID:7608
- C:\Windows\System\uCdYpSK.exe
  C:\Windows\System\uCdYpSK.exe
  2⤵
  PID:7020
- C:\Windows\System\OTvVByn.exe
  C:\Windows\System\OTvVByn.exe
  2⤵
  PID:6940
- C:\Windows\System\EwDewBp.exe
  C:\Windows\System\EwDewBp.exe
  2⤵
  PID:2876
- C:\Windows\System\CdJNtHY.exe
  C:\Windows\System\CdJNtHY.exe
  2⤵
  PID:9208
- C:\Windows\System\KllsHKm.exe
  C:\Windows\System\KllsHKm.exe
  2⤵
  PID:7752
- C:\Windows\System\ZFStvaf.exe
  C:\Windows\System\ZFStvaf.exe
  2⤵
  PID:11208
- C:\Windows\System\BQlEtBJ.exe
  C:\Windows\System\BQlEtBJ.exe
  2⤵
  PID:7688
- C:\Windows\System\Vwyzqnw.exe
  C:\Windows\System\Vwyzqnw.exe
  2⤵
  PID:6428
- C:\Windows\System\ISRkRIH.exe
  C:\Windows\System\ISRkRIH.exe
  2⤵
  PID:7796
- C:\Windows\System\DSPCrkt.exe
  C:\Windows\System\DSPCrkt.exe
  2⤵
  PID:7604
- C:\Windows\System\JxgBqGi.exe
  C:\Windows\System\JxgBqGi.exe
  2⤵
  PID:9224
- C:\Windows\System\FMZWFGN.exe
  C:\Windows\System\FMZWFGN.exe
  2⤵
  PID:7904
- C:\Windows\System\CSjhgts.exe
  C:\Windows\System\CSjhgts.exe
  2⤵
  PID:3928
- C:\Windows\System\pNKQGOD.exe
  C:\Windows\System\pNKQGOD.exe
  2⤵
  PID:11796
- C:\Windows\System\MCJxmOn.exe
  C:\Windows\System\MCJxmOn.exe
  2⤵
  PID:6024
- C:\Windows\System\KdJyTcN.exe
  C:\Windows\System\KdJyTcN.exe
  2⤵
  PID:10140
- C:\Windows\System\LKqBbfF.exe
  C:\Windows\System\LKqBbfF.exe
  2⤵
  PID:380
- C:\Windows\System\tfgeqcG.exe
  C:\Windows\System\tfgeqcG.exe
  2⤵
  PID:8428
- C:\Windows\System\AIdgeII.exe
  C:\Windows\System\AIdgeII.exe
  2⤵
  PID:8588
- C:\Windows\System\AvPGPDu.exe
  C:\Windows\System\AvPGPDu.exe
  2⤵
  PID:5772
- C:\Windows\System\kApuJBR.exe
  C:\Windows\System\kApuJBR.exe
  2⤵
  PID:3804
- C:\Windows\System\tlyINPy.exe
  C:\Windows\System\tlyINPy.exe
  2⤵
  PID:7192
- C:\Windows\System\mubQtnM.exe
  C:\Windows\System\mubQtnM.exe
  2⤵
  PID:3776
- C:\Windows\System\sCbJXUh.exe
  C:\Windows\System\sCbJXUh.exe
  2⤵
  PID:12664
- C:\Windows\System\BPdiJmX.exe
  C:\Windows\System\BPdiJmX.exe
  2⤵
  PID:6084
- C:\Windows\System\fRPFUdN.exe
  C:\Windows\System\fRPFUdN.exe
  2⤵
  PID:10892
- C:\Windows\System\ATwSGBV.exe
  C:\Windows\System\ATwSGBV.exe
  2⤵
  PID:7372
- C:\Windows\System\yvItZUt.exe
  C:\Windows\System\yvItZUt.exe
  2⤵
  PID:4296
- C:\Windows\System\OTNHwsb.exe
  C:\Windows\System\OTNHwsb.exe
  2⤵
  PID:6944
- C:\Windows\System\ggYotSk.exe
  C:\Windows\System\ggYotSk.exe
  2⤵
  PID:3552
- C:\Windows\System\xDSwReE.exe
  C:\Windows\System\xDSwReE.exe
  2⤵
  PID:12808
- C:\Windows\System\kXNvsiF.exe
  C:\Windows\System\kXNvsiF.exe
  2⤵
  PID:12872
- C:\Windows\System\YFRsEso.exe
  C:\Windows\System\YFRsEso.exe
  2⤵
  PID:9752
- C:\Windows\System\vvsGcxz.exe
  C:\Windows\System\vvsGcxz.exe
  2⤵
  PID:9632
- C:\Windows\System\ZQNIGBw.exe
  C:\Windows\System\ZQNIGBw.exe
  2⤵
  PID:10204
- C:\Windows\System\EGbrVEp.exe
  C:\Windows\System\EGbrVEp.exe
  2⤵
  PID:11472
- C:\Windows\System\zrruZXs.exe
  C:\Windows\System\zrruZXs.exe
  2⤵
  PID:12528
- C:\Windows\System\cvPnsIS.exe
  C:\Windows\System\cvPnsIS.exe
  2⤵
  PID:6068
- C:\Windows\System\IekbhPv.exe
  C:\Windows\System\IekbhPv.exe
  2⤵
  PID:3204
- C:\Windows\System\ZJzbRhz.exe
  C:\Windows\System\ZJzbRhz.exe
  2⤵
  PID:5668
- C:\Windows\System\parrpRk.exe
  C:\Windows\System\parrpRk.exe
  2⤵
  PID:13248
- C:\Windows\System\bnhiVrr.exe
  C:\Windows\System\bnhiVrr.exe
  2⤵
  PID:12232
- C:\Windows\System\KcnSLBp.exe
  C:\Windows\System\KcnSLBp.exe
  2⤵
  PID:4796
- C:\Windows\System\ZBOQgRL.exe
  C:\Windows\System\ZBOQgRL.exe
  2⤵
  PID:9652
- C:\Windows\System\KuRGFxa.exe
  C:\Windows\System\KuRGFxa.exe
  2⤵
  PID:8636
- C:\Windows\System\GDLcjVa.exe
  C:\Windows\System\GDLcjVa.exe
  2⤵
  PID:8328
- C:\Windows\System\kdLoHgh.exe
  C:\Windows\System\kdLoHgh.exe
  2⤵
  PID:6948
- C:\Windows\System\PKzIWOA.exe
  C:\Windows\System\PKzIWOA.exe
  2⤵
  PID:5320
- C:\Windows\System\XxHrLqq.exe
  C:\Windows\System\XxHrLqq.exe
  2⤵
  PID:12488
- C:\Windows\System\lSfTdGK.exe
  C:\Windows\System\lSfTdGK.exe
  2⤵
  PID:7488
- C:\Windows\System\NIniZlx.exe
  C:\Windows\System\NIniZlx.exe
  2⤵
  PID:12688
- C:\Windows\System\TExqxUC.exe
  C:\Windows\System\TExqxUC.exe
  2⤵
  PID:13616
- C:\Windows\System\bFqULXF.exe
  C:\Windows\System\bFqULXF.exe
  2⤵
  PID:9000
- C:\Windows\System\CfaOLqG.exe
  C:\Windows\System\CfaOLqG.exe
  2⤵
  PID:12736
- C:\Windows\System\rsFdouh.exe
  C:\Windows\System\rsFdouh.exe
  2⤵
  PID:8208
- C:\Windows\System\FPMcKGX.exe
  C:\Windows\System\FPMcKGX.exe
  2⤵
  PID:12900
- C:\Windows\System\SuUkdWg.exe
  C:\Windows\System\SuUkdWg.exe
  2⤵
  PID:12892
- C:\Windows\System\BvydqDz.exe
  C:\Windows\System\BvydqDz.exe
  2⤵
  PID:14240
- C:\Windows\System\BXzxltr.exe
  C:\Windows\System\BXzxltr.exe
  2⤵
  PID:11464
- C:\Windows\System\KVqxddn.exe
  C:\Windows\System\KVqxddn.exe
  2⤵
  PID:13092
- C:\Windows\System\nMEMPFd.exe
  C:\Windows\System\nMEMPFd.exe
  2⤵
  PID:5952
- C:\Windows\System\dpiZwRJ.exe
  C:\Windows\System\dpiZwRJ.exe
  2⤵
  PID:9888
- C:\Windows\System\bqZgvsW.exe
  C:\Windows\System\bqZgvsW.exe
  2⤵
  PID:13116
- C:\Windows\System\mTorcSU.exe
  C:\Windows\System\mTorcSU.exe
  2⤵
  PID:2952
- C:\Windows\System\gtbsBwP.exe
  C:\Windows\System\gtbsBwP.exe
  2⤵
  PID:9732
- C:\Windows\System\hjLRWZv.exe
  C:\Windows\System\hjLRWZv.exe
  2⤵
  PID:7768
- C:\Windows\System\pYDJSdr.exe
  C:\Windows\System\pYDJSdr.exe
  2⤵
  PID:5900
- C:\Windows\System\twpSPfd.exe
  C:\Windows\System\twpSPfd.exe
  2⤵
  PID:11972
- C:\Windows\System\iqHEgHG.exe
  C:\Windows\System\iqHEgHG.exe
  2⤵
  PID:508
- C:\Windows\System\HkANwHT.exe
  C:\Windows\System\HkANwHT.exe
  2⤵
  PID:12560
- C:\Windows\System\hbVpRFF.exe
  C:\Windows\System\hbVpRFF.exe
  2⤵
  PID:12192
- C:\Windows\System\CnVPfBV.exe
  C:\Windows\System\CnVPfBV.exe
  2⤵
  PID:12644
- C:\Windows\System\STACnNr.exe
  C:\Windows\System\STACnNr.exe
  2⤵
  PID:2996
- C:\Windows\System\CzYrtBE.exe
  C:\Windows\System\CzYrtBE.exe
  2⤵
  PID:6672
- C:\Windows\System\pIFNhqd.exe
  C:\Windows\System\pIFNhqd.exe
  2⤵
  PID:5676
- C:\Windows\System\ZhvUHoT.exe
  C:\Windows\System\ZhvUHoT.exe
  2⤵
  PID:13888
- C:\Windows\System\ZdClGYd.exe
  C:\Windows\System\ZdClGYd.exe
  2⤵
  PID:12548
- C:\Windows\System\toovmHm.exe
  C:\Windows\System\toovmHm.exe
  2⤵
  PID:12544
- C:\Windows\System\VnuQIta.exe
  C:\Windows\System\VnuQIta.exe
  2⤵
  PID:5264
- C:\Windows\System\HZKgBSX.exe
  C:\Windows\System\HZKgBSX.exe
  2⤵
  PID:10960
- C:\Windows\System\YLgaZHf.exe
  C:\Windows\System\YLgaZHf.exe
  2⤵
  PID:12108
- C:\Windows\System\ZWmommp.exe
  C:\Windows\System\ZWmommp.exe
  2⤵
  PID:9144
- C:\Windows\System\CSKgojD.exe
  C:\Windows\System\CSKgojD.exe
  2⤵
  PID:12996
- C:\Windows\System\LgHdASq.exe
  C:\Windows\System\LgHdASq.exe
  2⤵
  PID:12760
- C:\Windows\System\rXGtodU.exe
  C:\Windows\System\rXGtodU.exe
  2⤵
  PID:11520
- C:\Windows\System\iPgtAAL.exe
  C:\Windows\System\iPgtAAL.exe
  2⤵
  PID:11476
- C:\Windows\System\mjUyFyT.exe
  C:\Windows\System\mjUyFyT.exe
  2⤵
  PID:5776
- C:\Windows\System\orsOIAv.exe
  C:\Windows\System\orsOIAv.exe
  2⤵
  PID:9256
- C:\Windows\System\YvcCxaO.exe
  C:\Windows\System\YvcCxaO.exe
  2⤵
  PID:10244
- C:\Windows\System\VALiwry.exe
  C:\Windows\System\VALiwry.exe
  2⤵
  PID:13076
- C:\Windows\System\GLHapGE.exe
  C:\Windows\System\GLHapGE.exe
  2⤵
  PID:8240
- C:\Windows\System\UzrWamj.exe
  C:\Windows\System\UzrWamj.exe
  2⤵
  PID:6976
- C:\Windows\System\RhEKBwv.exe
  C:\Windows\System\RhEKBwv.exe
  2⤵
  PID:11784
- C:\Windows\System\WYhCypD.exe
  C:\Windows\System\WYhCypD.exe
  2⤵
  PID:9984
- C:\Windows\System\wpaYhHh.exe
  C:\Windows\System\wpaYhHh.exe
  2⤵
  PID:11676
- C:\Windows\System\Uaqfznp.exe
  C:\Windows\System\Uaqfznp.exe
  2⤵
  PID:8440
- C:\Windows\System\zRAXGwD.exe
  C:\Windows\System\zRAXGwD.exe
  2⤵
  PID:11716
- C:\Windows\System\pOJTBkT.exe
  C:\Windows\System\pOJTBkT.exe
  2⤵
  PID:9416
- C:\Windows\System\rujsfhJ.exe
  C:\Windows\System\rujsfhJ.exe
  2⤵
  PID:13184
- C:\Windows\System\ZXeJbUi.exe
  C:\Windows\System\ZXeJbUi.exe
  2⤵
  PID:11432
- C:\Windows\System\HnBMchy.exe
  C:\Windows\System\HnBMchy.exe
  2⤵
  PID:14176
- C:\Windows\System\SChdfTv.exe
  C:\Windows\System\SChdfTv.exe
  2⤵
  PID:9748
- C:\Windows\System\jPUqGbj.exe
  C:\Windows\System\jPUqGbj.exe
  2⤵
  PID:2972
- C:\Windows\System\kidfYJU.exe
  C:\Windows\System\kidfYJU.exe
  2⤵
  PID:9380
- C:\Windows\System\TuNqfCc.exe
  C:\Windows\System\TuNqfCc.exe
  2⤵
  PID:13584
- C:\Windows\System\zxziBew.exe
  C:\Windows\System\zxziBew.exe
  2⤵
  PID:9940
- C:\Windows\System\vvOBrFq.exe
  C:\Windows\System\vvOBrFq.exe
  2⤵
  PID:6148
- C:\Windows\System\iTlWodr.exe
  C:\Windows\System\iTlWodr.exe
  2⤵
  PID:13160
- C:\Windows\System\kbTuibn.exe
  C:\Windows\System\kbTuibn.exe
  2⤵
  PID:10344
- C:\Windows\System\sPcZbMA.exe
  C:\Windows\System\sPcZbMA.exe
  2⤵
  PID:11444
- C:\Windows\System\efNijEr.exe
  C:\Windows\System\efNijEr.exe
  2⤵
  PID:2496
- C:\Windows\System\QyNlIdw.exe
  C:\Windows\System\QyNlIdw.exe
  2⤵
  PID:7080
- C:\Windows\System\WyuTKkP.exe
  C:\Windows\System\WyuTKkP.exe
  2⤵
  PID:6044
- C:\Windows\System\UnNupvq.exe
  C:\Windows\System\UnNupvq.exe
  2⤵
  PID:7980
- C:\Windows\System\JcnfXas.exe
  C:\Windows\System\JcnfXas.exe
  2⤵
  PID:11648
- C:\Windows\System\ZYYervG.exe
  C:\Windows\System\ZYYervG.exe
  2⤵
  PID:8520
- C:\Windows\System\XFblvMt.exe
  C:\Windows\System\XFblvMt.exe
  2⤵
  PID:8344
- C:\Windows\System\gFQezYB.exe
  C:\Windows\System\gFQezYB.exe
  2⤵
  PID:12592
- C:\Windows\System\mESdYhQ.exe
  C:\Windows\System\mESdYhQ.exe
  2⤵
  PID:11040
- C:\Windows\System\KSEWCVR.exe
  C:\Windows\System\KSEWCVR.exe
  2⤵
  PID:13196
- C:\Windows\System\ENPplyM.exe
  C:\Windows\System\ENPplyM.exe
  2⤵
  PID:13220
- C:\Windows\System\ImICMoW.exe
  C:\Windows\System\ImICMoW.exe
  2⤵
  PID:11216
- C:\Windows\System\jLfjYXQ.exe
  C:\Windows\System\jLfjYXQ.exe
  2⤵
  PID:12220
- C:\Windows\System\VazSEVA.exe
  C:\Windows\System\VazSEVA.exe
  2⤵
  PID:11736
- C:\Windows\System\NMaAyEl.exe
  C:\Windows\System\NMaAyEl.exe
  2⤵
  PID:8756
- C:\Windows\System\BrRyATt.exe
  C:\Windows\System\BrRyATt.exe
  2⤵
  PID:12860
- C:\Windows\System\wtHXRKa.exe
  C:\Windows\System\wtHXRKa.exe
  2⤵
  PID:10376
- C:\Windows\System\aFRaIwl.exe
  C:\Windows\System\aFRaIwl.exe
  2⤵
  PID:12240
- C:\Windows\System\QmgyAWM.exe
  C:\Windows\System\QmgyAWM.exe
  2⤵
  PID:2920
- C:\Windows\System\rkDnEPf.exe
  C:\Windows\System\rkDnEPf.exe
  2⤵
  PID:12844
- C:\Windows\System\xnPZKYh.exe
  C:\Windows\System\xnPZKYh.exe
  2⤵
  PID:12772
- C:\Windows\System\BZPZeSa.exe
  C:\Windows\System\BZPZeSa.exe
  2⤵
  PID:9236
- C:\Windows\System\uGhiYZW.exe
  C:\Windows\System\uGhiYZW.exe
  2⤵
  PID:7048
- C:\Windows\System\GrnlIea.exe
  C:\Windows\System\GrnlIea.exe
  2⤵
  PID:13052
- C:\Windows\System\HjJdyBN.exe
  C:\Windows\System\HjJdyBN.exe
  2⤵
  PID:11556
- C:\Windows\System\nyabBXq.exe
  C:\Windows\System\nyabBXq.exe
  2⤵
  PID:14224
- C:\Windows\System\zDxXYVQ.exe
  C:\Windows\System\zDxXYVQ.exe
  2⤵
  PID:13048
- C:\Windows\System\QWTHXhz.exe
  C:\Windows\System\QWTHXhz.exe
  2⤵
  PID:12068
- C:\Windows\System\WfgqKHo.exe
  C:\Windows\System\WfgqKHo.exe
  2⤵
  PID:1540
- C:\Windows\System\UPDdIGW.exe
  C:\Windows\System\UPDdIGW.exe
  2⤵
  PID:7272
- C:\Windows\System\BkKCnRy.exe
  C:\Windows\System\BkKCnRy.exe
  2⤵
  PID:11380
- C:\Windows\System\RlzgVVA.exe
  C:\Windows\System\RlzgVVA.exe
  2⤵
  PID:11928
- C:\Windows\System\vdiSWHr.exe
  C:\Windows\System\vdiSWHr.exe
  2⤵
  PID:13112
- C:\Windows\System\sMhHcOJ.exe
  C:\Windows\System\sMhHcOJ.exe
  2⤵
  PID:7568
- C:\Windows\System\sJxNfjH.exe
  C:\Windows\System\sJxNfjH.exe
  2⤵
  PID:13032
- C:\Windows\System\TuLsCbB.exe
  C:\Windows\System\TuLsCbB.exe
  2⤵
  PID:12680
- C:\Windows\System\trFJlTZ.exe
  C:\Windows\System\trFJlTZ.exe
  2⤵
  PID:2840
- C:\Windows\System\MDXKhgH.exe
  C:\Windows\System\MDXKhgH.exe
  2⤵
  PID:12292
- C:\Windows\System\KOIJNfh.exe
  C:\Windows\System\KOIJNfh.exe
  2⤵
  PID:8012
- C:\Windows\System\ABLYmLE.exe
  C:\Windows\System\ABLYmLE.exe
  2⤵
  PID:5880
- C:\Windows\System\VJMcQhb.exe
  C:\Windows\System\VJMcQhb.exe
  2⤵
  PID:10616
- C:\Windows\System\nrXITRo.exe
  C:\Windows\System\nrXITRo.exe
  2⤵
  PID:10284
- C:\Windows\System\etjIKpT.exe
  C:\Windows\System\etjIKpT.exe
  2⤵
  PID:7216
- C:\Windows\System\mEvKwtU.exe
  C:\Windows\System\mEvKwtU.exe
  2⤵
  PID:10272
- C:\Windows\System\YvPzaFT.exe
  C:\Windows\System\YvPzaFT.exe
  2⤵
  PID:6208
- C:\Windows\System\UhmJsUK.exe
  C:\Windows\System\UhmJsUK.exe
  2⤵
  PID:13588
- C:\Windows\System\dIlCjVa.exe
  C:\Windows\System\dIlCjVa.exe
  2⤵
  PID:3372
- C:\Windows\System\VvyHxOC.exe
  C:\Windows\System\VvyHxOC.exe
  2⤵
  PID:2348
- C:\Windows\System\eVOmCLc.exe
  C:\Windows\System\eVOmCLc.exe
  2⤵
  PID:13952
- C:\Windows\System\IkgUYOx.exe
  C:\Windows\System\IkgUYOx.exe
  2⤵
  PID:13268
- C:\Windows\System\YvqVQUD.exe
  C:\Windows\System\YvqVQUD.exe
  2⤵
  PID:12956
- C:\Windows\System\yekHiyg.exe
  C:\Windows\System\yekHiyg.exe
  2⤵
  PID:13996
- C:\Windows\System\OMywSaC.exe
  C:\Windows\System\OMywSaC.exe
  2⤵
  PID:11316
- C:\Windows\System\tnwaivs.exe
  C:\Windows\System\tnwaivs.exe
  2⤵
  PID:12940
- C:\Windows\System\HbkIkkL.exe
  C:\Windows\System\HbkIkkL.exe
  2⤵
  PID:8136
- C:\Windows\System\FZNQUHr.exe
  C:\Windows\System\FZNQUHr.exe
  2⤵
  PID:12780
- C:\Windows\System\kybvySY.exe
  C:\Windows\System\kybvySY.exe
  2⤵
  PID:11568
- C:\Windows\System\fLIEqDs.exe
  C:\Windows\System\fLIEqDs.exe
  2⤵
  PID:8896
- C:\Windows\System\LgiMoOq.exe
  C:\Windows\System\LgiMoOq.exe
  2⤵
  PID:8072
- C:\Windows\System\JZoJhgy.exe
  C:\Windows\System\JZoJhgy.exe
  2⤵
  PID:14196
- C:\Windows\System\IxRYGsf.exe
  C:\Windows\System\IxRYGsf.exe
  2⤵
  PID:10940
- C:\Windows\System\OmHqYFB.exe
  C:\Windows\System\OmHqYFB.exe
  2⤵
  PID:12980
- C:\Windows\System\hLpcxvP.exe
  C:\Windows\System\hLpcxvP.exe
  2⤵
  PID:11768
- C:\Windows\System\qWCalZC.exe
  C:\Windows\System\qWCalZC.exe
  2⤵
  PID:13316
- C:\Windows\System\daHsIom.exe
  C:\Windows\System\daHsIom.exe
  2⤵
  PID:11292
- C:\Windows\System\lhAiplX.exe
  C:\Windows\System\lhAiplX.exe
  2⤵
  PID:2852
- C:\Windows\System\XxQRSpa.exe
  C:\Windows\System\XxQRSpa.exe
  2⤵
  PID:11440
- C:\Windows\System\xCtfdBS.exe
  C:\Windows\System\xCtfdBS.exe
  2⤵
  PID:10936
- C:\Windows\System\aAJIOKl.exe
  C:\Windows\System\aAJIOKl.exe
  2⤵
  PID:12988
- C:\Windows\System\luHkwBI.exe
  C:\Windows\System\luHkwBI.exe
  2⤵
  PID:8068
- C:\Windows\System\mUerSvI.exe
  C:\Windows\System\mUerSvI.exe
  2⤵
  PID:9760
- C:\Windows\System\lbDLFQf.exe
  C:\Windows\System\lbDLFQf.exe
  2⤵
  PID:8032
- C:\Windows\System\PlNHrPA.exe
  C:\Windows\System\PlNHrPA.exe
  2⤵
  PID:5960
- C:\Windows\System\bwGgNhG.exe
  C:\Windows\System\bwGgNhG.exe
  2⤵
  PID:4924
- C:\Windows\System\IFdBGNi.exe
  C:\Windows\System\IFdBGNi.exe
  2⤵
  PID:14268
- C:\Windows\System\uzZamkb.exe
  C:\Windows\System\uzZamkb.exe
  2⤵
  PID:11932
- C:\Windows\System\JKYnCrc.exe
  C:\Windows\System\JKYnCrc.exe
  2⤵
  PID:8872
- C:\Windows\System\yZjxEkG.exe
  C:\Windows\System\yZjxEkG.exe
  2⤵
  PID:11884
- C:\Windows\System\uENlswA.exe
  C:\Windows\System\uENlswA.exe
  2⤵
  PID:13292
- C:\Windows\System\pEJUOCD.exe
  C:\Windows\System\pEJUOCD.exe
  2⤵
  PID:5244
- C:\Windows\System\bmkBYhT.exe
  C:\Windows\System\bmkBYhT.exe
  2⤵
  PID:13916
- C:\Windows\System\OrrmKkq.exe
  C:\Windows\System\OrrmKkq.exe
  2⤵
  PID:12728
- C:\Windows\System\rkgTEfD.exe
  C:\Windows\System\rkgTEfD.exe
  2⤵
  PID:10484
- C:\Windows\System\HfzcNyt.exe
  C:\Windows\System\HfzcNyt.exe
  2⤵
  PID:14216
- C:\Windows\System\GHNZjDV.exe
  C:\Windows\System\GHNZjDV.exe
  2⤵
  PID:10524
- C:\Windows\System\EHQrcuR.exe
  C:\Windows\System\EHQrcuR.exe
  2⤵
  PID:6300
- C:\Windows\System\rSdoGZZ.exe
  C:\Windows\System\rSdoGZZ.exe
  2⤵
  PID:14168
- C:\Windows\System\weASGvz.exe
  C:\Windows\System\weASGvz.exe
  2⤵
  PID:12764
- C:\Windows\System\rMrjPQb.exe
  C:\Windows\System\rMrjPQb.exe
  2⤵
  PID:12972
- C:\Windows\System\dYvgiHl.exe
  C:\Windows\System\dYvgiHl.exe
  2⤵
  PID:11852
- C:\Windows\System\usGOCmP.exe
  C:\Windows\System\usGOCmP.exe
  2⤵
  PID:12148
- C:\Windows\System\bfiRxhQ.exe
  C:\Windows\System\bfiRxhQ.exe
  2⤵
  PID:11804
- C:\Windows\System\XqUPSPu.exe
  C:\Windows\System\XqUPSPu.exe
  2⤵
  PID:12416
- C:\Windows\System\BUrwSjm.exe
  C:\Windows\System\BUrwSjm.exe
  2⤵
  PID:8356
- C:\Windows\System\NyzwRQq.exe
  C:\Windows\System\NyzwRQq.exe
  2⤵
  PID:11780
- C:\Windows\System\KfEpqtN.exe
  C:\Windows\System\KfEpqtN.exe
  2⤵
  PID:12572
- C:\Windows\System\rpVyhZE.exe
  C:\Windows\System\rpVyhZE.exe
  2⤵
  PID:9572
- C:\Windows\System\lnhzOje.exe
  C:\Windows\System\lnhzOje.exe
  2⤵
  PID:13860
- C:\Windows\System\qpgzJXY.exe
  C:\Windows\System\qpgzJXY.exe
  2⤵
  PID:7336
- C:\Windows\System\fjrDTMS.exe
  C:\Windows\System\fjrDTMS.exe
  2⤵
  PID:13912
- C:\Windows\System\YVRHXqa.exe
  C:\Windows\System\YVRHXqa.exe
  2⤵
  PID:13256
- C:\Windows\System\nQhdXGF.exe
  C:\Windows\System\nQhdXGF.exe
  2⤵
  PID:10632
- C:\Windows\System\OlTFBPK.exe
  C:\Windows\System\OlTFBPK.exe
  2⤵
  PID:9544
- C:\Windows\System\xbufJnT.exe
  C:\Windows\System\xbufJnT.exe
  2⤵
  PID:12004
- C:\Windows\System\dKXLYXg.exe
  C:\Windows\System\dKXLYXg.exe
  2⤵
  PID:14288
- C:\Windows\System\GIHygEV.exe
  C:\Windows\System\GIHygEV.exe
  2⤵
  PID:8612
- C:\Windows\System\FQchLZJ.exe
  C:\Windows\System\FQchLZJ.exe
  2⤵
  PID:8116
- C:\Windows\System\lmJBJvb.exe
  C:\Windows\System\lmJBJvb.exe
  2⤵
  PID:11992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:12032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/0x00070000000236cf-1687.dat

Filesize
8B

MD5
70d32c5686563edbb854aed29ea9d85c

SHA1
bd541445a50c65f1a6670fe5c95bea5d00e91b07

SHA256
7838364f90f7a979e688eff5ec314b7556d64c92bdfbd76fb1ec9602cec23e30

SHA512
23991ce500626bded4e2dc15b31393a89cfbbdda0d797292f12ec97001984de33a442b02e485bb8bd2704c63b7c242ef2cf2fc4fd62f7f428d253fd4da79e7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xxgk15qf.a5c.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AkRVdZY.exe

Filesize
1.6MB

MD5
fd5e777d0a682217d3521477d02ce5a6

SHA1
b4774009e36da93b87b02f36f5e3e16a33cecb52

SHA256
44590d9e60f7541b99d3a411089ebea7779aaf6d8b967cf97636c63e7a3dfbe3

SHA512
42b9db1d2a6e0a7f89f2838ae7b3b3d7a091dd98ed7a6ba41e8e7fba7fa2536d14d0c0b130e223db26b13322b3a4d8031788440a48b507a23a6c4c5f70901058

Download Submit
C:\Windows\System\GtbRmAY.exe

Filesize
1.6MB

MD5
6996967118fcc86ba93e9faafdf3cd3d

SHA1
ab7c9ac5fc50b4ba7fe97bf5ff392c53f5109561

SHA256
f426dd8907d315b0d7fe1fc8e4127f230725b4786024380cf3005d974fc85102

SHA512
e0fbc5188632a38efd8bc58ce23d046face5ab65f975ed34d327c3dbcf47ae41b2ba92820fce8696748e3b21f190c938f94a6fb73b478f3be1d84f4c599afd31

Download Submit
C:\Windows\System\ICNUTEF.exe

Filesize
1.6MB

MD5
38acc7226d079562dd40233b26d368e6

SHA1
ba895fc737212c8aeaefec841774020e327b2eff

SHA256
1a3c20abee8376c528b61a6251389fe28d0bd3d9a5c0ae5238775786a5cfcbda

SHA512
77db7641da1230a3f62596ccf3f40396b9ee0526de5a11074cef1a05ef2817d552bfebe60f71e777892e16c2c9e4218ad7099971730268456b3393ac16b8fd20

Download Submit
C:\Windows\System\IKtvIMJ.exe

Filesize
1.6MB

MD5
111e27842bdcc67facfe818f0e9ac2e3

SHA1
4ec9a909dc68186637e272fb5290cd07822dfec3

SHA256
7c669e385eb5344e123e52f5270a1505fe9cca72c6b78f7f50055e6297a06e0f

SHA512
eddd5e4e6e53e597e55a95000099de2d4d694996fb58270ec0d180360d1d1f826f723530a79a431638a6234ff2072ab86269ab964602933a33208919a5543d74

Download Submit
C:\Windows\System\IbgBKLS.exe

Filesize
1.6MB

MD5
cd9b93ab53f38e940bd9397afae4afe8

SHA1
9bfc53f4f1058c47dacb23cdef0862ff2acf8dba

SHA256
47184b2d07ad4989a6917959f5f78af15ec994088e4d3c0acdd91c8727eb7268

SHA512
9b057da9f26ebc2246c7dfb984d733a720b71b6c1fdc59e004341c6f090815ede36da2bc397ccd6d8f75a249ed71e54622ab9d9e69a8fbc1c15fb81627a2290f

Download Submit
C:\Windows\System\KRmQuib.exe

Filesize
1.6MB

MD5
95ca9647d3fa87793211f9a2078ebecf

SHA1
ff52e09604c5e6b79c188159f00f63fee156b498

SHA256
5c4b25908623010411c0d88f462d80bb372648a83a1132d83cb1deca0d32ebde

SHA512
f63b3a0261893772649c6db30400fcd367f3e6b13a0b49601902e052a86cad5561c7a72a684f4df4f514be6ccfd5616acdae59bba027bcaee5169eb5b90c8bb8

Download Submit
C:\Windows\System\NFcQSUG.exe

Filesize
18B

MD5
69712a8f9ef9a2cbe4907aa446157abb

SHA1
2b5c964a1748c4a6a2f7493dad88bc47a2d4511c

SHA256
b9cc1ff1554bd2f25357d0be7df90fe8a89296de72a2afbc4a6860c87a817497

SHA512
e050468b7108288e0fa907c0304cf8e8a182bd9da2b253d0061963594f6238ca0b6aa0d55af3b2e2ca64630286776467c06ed51b0e331ea22edb14321931191f

Download Submit
C:\Windows\System\OKHKZuq.exe

Filesize
1.6MB

MD5
2b5fc90002f41d10641cc8f6ed0e8498

SHA1
1c821469d817e25226039015228bd58f1b305a6f

SHA256
347be4e1a9e6a78e11a1500067fc73591d2472c8095765699c33c01f19ffac90

SHA512
2d4ab20573c263795fc58a17ba0b58271a43e377840afed74a3de68774c76c44921d7ae9ef9a0c8c852c760551f079a46b5e7ed30ab6d63b84070643e28c1d8b

Download Submit
C:\Windows\System\PzMEXcC.exe

Filesize
1.6MB

MD5
ad52ba94b0a89c4b052bb2ad329ff2a6

SHA1
33308c56283e96d9a78f4f8fc6581f0e48b9f2f9

SHA256
01ac6e5af3ad0fcf06ecad46bf6c8cfe92c7e0efbc96b30b47af9ebf48a0ea18

SHA512
1ff2b53fae30f05afbb6c64085bb4607657a8581c5a06c5a4cd5457489f8ce45018a6feecea0ea505e0e62188990b5cfeb32b028779e6394e8b1cf9c6fd3c3a8

Download Submit
C:\Windows\System\SnsvDGc.exe

Filesize
1.6MB

MD5
25c0f868da837f7fcd573995c36567f7

SHA1
d03b6557196d3e85a5eec2ee4848cae734a3793b

SHA256
779646d97c9d4cbe705ada6d00f0df7330475e247984eba8734326e3e4eaa820

SHA512
cdd7423c3b44a2a75f106810a2cd1483c8f2487207192ace9bc177cb3bca71eaa1a046ddd4209ecba28db51d5ed5dd22b56bbe6827dbaf9bef08159441fe9091

Download Submit
C:\Windows\System\TiasagV.exe

Filesize
1.6MB

MD5
5d4d325a991365af148973c384f27b79

SHA1
a168279e2d83ff3cf8c85c597834fca926f0347d

SHA256
f286ab2def81133a9d714bd80718092f0604753b5794f94360e7e99ec4239690

SHA512
ca018e22b2c130c6a08173b21f491a12c0021724a463ba7ddc3c41eda3f9c2ae575228e041614cfd479ed8e33a40a8a510f990ffa4bb3b2d4c36053ea2a98e73

Download Submit
C:\Windows\System\VDWtUTi.exe

Filesize
1.6MB

MD5
2ed8426abdfa2b3466e2f160803bc6ce

SHA1
957160a7fa4c8b3cda1bbbf9bfe680e961e619a8

SHA256
7a67d2c5bb6796126099dcc13a5dde0bb48db274635d3b433231150ea2c8d740

SHA512
2dd53f10c50fb53defe879080ad43bee8230a6f50d86f65d9ebc310ee48ca670c48ca69369fff7ff3268b933099cfaa4047218951cb92491c3799dd8b1cbf3e8

Download Submit
C:\Windows\System\VHgSezO.exe

Filesize
1.6MB

MD5
08bb7ffe684e5306a82f014b12c6eddd

SHA1
ce7362336837e91b995d6fecc1dce3070f1ec221

SHA256
93b528705b1eb7702b9d804e0e95b42d181112f9d57ffe3dc97172b998afb794

SHA512
da36eaa5f74045960788a0866ecef92c522790697be7a9bda2221c75031c5098f4444dd8cce3eea77104cdfd7575df6b4b1611f9cedce051ba86470d08690b9f

Download Submit
C:\Windows\System\WLHKAHe.exe

Filesize
1.6MB

MD5
e5abb07943ed1a62914f0966e6847a3e

SHA1
e28a5c3c8194b31f92d87d40b24bc8cebd39011c

SHA256
4f1bb744143a0412fa9a166121ee72e4ee2de6e5ba71ece5525e3a17071dcbdb

SHA512
1e6d61c4e703537ce9581a8ebfbad1b4cce8abb52f1eab708707763d309b1d559408c3fbab8efdd4127db2c64d1f02c85d59e7c4658b9137306e349c43cfffe6

Download Submit
C:\Windows\System\WzikPAq.exe

Filesize
1.6MB

MD5
3a2312b7450cb0e043565e160cf11d8e

SHA1
b2351e5469e0204144471feff46b2155b3d53d3f

SHA256
ed5918db4c04c0f1b9906c0cd2518c83a57b86174ad740863e059c8f17b3c3f0

SHA512
7f7f4e8eb9cafa93a6a11bfcbcfc341fef2a2de45816f6fafcfa30404ab9dce273ef6f63ca151049c216df6de8aad215c160c24a66063dabe9d8680f8434068d

Download Submit
C:\Windows\System\XtpetOD.exe

Filesize
576KB

MD5
c3d03a9d37f5edf2280ce6b2b3c5fbef

SHA1
f13d7156c1061252682d37ff0da0cac93c34953e

SHA256
87f048a961f73c31785d7e94921a9a359d719bf76105c9601eca055227d1c1db

SHA512
07bab652c526204ee9528b6d8bd65b22dc499a44c1267b60f71a7439366582f72e58adec4d23b764a0ff0478fd6ffd60597a561b86fe20b6db5ee2bd531950b5

Download Submit
C:\Windows\System\XyJYNjJ.exe

Filesize
1.6MB

MD5
29c2834b61c1bb6333dca905edced3dd

SHA1
958d3f06b8fafebe5b932ed5dcca037add1dbe77

SHA256
4f72fb5a971eb1c38d4843d62f70d16cd657b548cc39d0ab9cfc467a2192e9f8

SHA512
11da24c1ffe2b44edccbb20e5fef93abca4baaa9484ab385447c5da6d3fa553ede5cf411321bff385c810b8ee847da1248912b40c94207e23eb8a07a3f2c6eed

Download Submit
C:\Windows\System\ZKRlpDK.exe

Filesize
1.6MB

MD5
14afa22b52f99dfda8eb769532aeff1a

SHA1
04401a8d25578c92f612d1645b3abb6086f8b069

SHA256
0791a388ea7a9a407052e86da99b7de75fce5d119d3326d1c1c3b8d942c523bb

SHA512
cf574d5b5e3075f94975cd004d22019354e1a15bffe948d6cc8dafe633dbb32783ee2d0f5518a9c8bd26fd3e14946a02bfa5890407fa2bb3b8cf9797ec2d1929

Download Submit
C:\Windows\System\aZbDPnC.exe

Filesize
1.6MB

MD5
c2d64caaa61fa88ac31fa29c1cf2782d

SHA1
8488bb9a8a7f94b525dc337d562298cc64969ba6

SHA256
6282f6c9103efbb48a9a5474a02500eab2998f2acca256f95651d53f8f9dac95

SHA512
cc3a6e629c1ae1e5d47e86498c4c56096100fe73b8f21addde6347c10d872b4c765d949b6c06863c2a2fb30c8e2f720524127f643f4be42c2c16d19ee05d60fa

Download Submit
C:\Windows\System\bHZIpBW.exe

Filesize
1.6MB

MD5
d9e447a0179c0cd6cd5cb6fba722a825

SHA1
fc3c942af00e301e25a80e218827fbd406f3860c

SHA256
6b0c09c38d5c98bee95110c3d2a6dea84869826e0682c0ce726f9408faa202d2

SHA512
fde3d8268ab84af13bf057f325c3360dbbb54985dd706b4e601203dc54f6b98a9aee3fc837963dee9155da8c92dfc4297b227f1dc0032ce22dd82d615b651236

Download Submit
C:\Windows\System\bNZsVic.exe

Filesize
1.6MB

MD5
a59f8655e5c61cb0fb375f397eb38fd1

SHA1
82509f54ed8c685f52ecad9b17b41215642a3e6e

SHA256
f103695df7228b41ab558d0a123d9bf3ecad928748932a7703b2b99c2ede01b5

SHA512
7ddb97e03fa7abd085a0fb4d469cc92d1d2dfd0b719f92de27f2b7a044a482959f6a3b50ea14f44386863f017ad103a7aca13ab3c4dd086f9b6fa78ed0e4404a

Download Submit
C:\Windows\System\cdWWMOG.exe

Filesize
1.6MB

MD5
fe9847894750041dd509f9806aa61185

SHA1
d5fcab14921c943c9e25c6fe35b3c79313eda109

SHA256
fc84b5a3df2c78a23e8f173814e1a2fabdb932fd68ab0e97c15dbd8e1532d06d

SHA512
d12c0e55109527ba6c5b8a9effd8f3a6103a956a65c4d967fc0381a671d673e14fcb41ca4e1b591a6c300b182b64b9979a0a8ad99b42a6713ec06c158facb831

Download Submit
C:\Windows\System\cmqanWw.exe

Filesize
1.6MB

MD5
f7206862503dac3d6d9ee90b2c33515b

SHA1
2ed13f829dfe29ba82b6bed2bddece6471c8f4c2

SHA256
575fa58980dc899f27ef03ce15e4acfb0c9bc72fc0be6322af6ec349cc6cba01

SHA512
d6625616603721ca486f381e6678a56176ec5d5615eb41afd34a88171d4780bced2bb1f0407471c4ef771446e06e43d57b34010b771207d6ea6bdc2741e367e5

Download Submit
C:\Windows\System\dcVMWVw.exe

Filesize
1.6MB

MD5
909d162e93dde783188d2dca3911168b

SHA1
6f49b61ce0990db6b489eb04cd70fe28ead115ef

SHA256
0e2cb3db63727bb3c856bffe20ad3470c27250bcb4597092baae13c20ca1743a

SHA512
1387860f26ef3d4a2fa642338f0ef465ee21eea4bd289a409bfd767312928ef055c6d6d52e4f6828b7b0a4e87d5b452e90a1eb11df637d39494849727f501774

Download Submit
C:\Windows\System\fhQzRjG.exe

Filesize
1.6MB

MD5
9906935214d1b2b45a1dcf50b50fcb89

SHA1
8767095e67dbaf3f0ddfd0fa1b7261109623eacb

SHA256
67de426b5eb9636a194ef2287a5f43b0d76f9839a852f1440f61996ea0878e3e

SHA512
ca122950faf038db0951da4cc49b7bd577546c515f8b103b2818695ef7e0b615db69531091aea72b8406aaff8352066e686a266b7a6ca4055f2580c4c79c8c4a

Download Submit
C:\Windows\System\gCAlrQO.exe

Filesize
1.6MB

MD5
90a08763546ec53104891496699339e2

SHA1
c70135bf8c48298cfc1b9439d0d6e4e6d1b2e1c6

SHA256
419410f9cce0ae06ea26d4e94691a48e42e656272d7810afca5ee55b08616090

SHA512
296f9fd9be458af21579b4ef40e10509bcc00592fa237a23c8e8ed854776671b2bee37c22a334ff3625b55e0f946725dd19e4eb2d3fb01f64ae8d0dcd930aabb

Download Submit
C:\Windows\System\hMsxftk.exe

Filesize
1.6MB

MD5
2154d5c83c48c4b3ca60287b90a7bd6e

SHA1
c9bb4f443e494311535bf22b285e94234b002289

SHA256
c4ff193a51601015ee6228a7871a11cf6be3d788debc64003f5459a7a00c85c4

SHA512
f1b40937e1c203f328256415031d8693c5e9b2d90fcdfb82ef9478a199fb0014e4ae2b155f2c21022d58ed908e30254f0d3bb8871b92ef430b99fdec5b4482dd

Download Submit
C:\Windows\System\hfuMJxB.exe

Filesize
1.6MB

MD5
8ec9c5e129edf1d1971dc20f77a6d776

SHA1
61a805c08897b1f763396788f3b4664363741039

SHA256
9d2be621808aa78d0f84680b50b22cfc9fd23e430bd63ca3fbf422bc675863a9

SHA512
69bd133c27978ebf84574299d530bfd4e46264aacfd0b6cfb4f61bd62fcc0c862fdbc4a554073fbf4b847dfdca2ce92790275e2ca666cb88cf095f9370f33287

Download Submit
C:\Windows\System\jmBfexK.exe

Filesize
1.6MB

MD5
a7997fb9d017e2b3b2fb28c9a7c8cb73

SHA1
d94d66741926ac3da25bb9b40e5a6aca71fa63a6

SHA256
4fc2c8abfd0bf8b2c714b9a485026dde7e15517932ccbae90608aa89db4b77ee

SHA512
05dfd1d6ad1ab066dacbcb07dd69a725ad21242a2a05ef1e8ca64f9c4edb6eb2fff3bca6476722f932a7f54d616645a01d5c7b584444b0e2d6b12b2d696a0547

Download Submit
C:\Windows\System\kbigzfS.exe

Filesize
1.6MB

MD5
1496c71d404664844056f833a461a42f

SHA1
44f715a1cbca467cb296bba1182895506bf218ab

SHA256
6ded51fae3fab9a56a04c0567ca8563960be14768cb5995613b5e7a3f8a166ef

SHA512
7e743bf2e9ca3884c89b16fcde524895170e39cb41a7fb54b52e502c032ecb4326d5a2f820046e3297f4a6e2364f96cb6f5fa96cfd3e1749d646182a9bcb6a26

Download Submit
C:\Windows\System\lcvNFxG.exe

Filesize
1.6MB

MD5
09e71e5ab46810b893a99b6108146a03

SHA1
9504de26ea8ba28d1b4e68c3eb18d8417beba1a7

SHA256
bc0219a6f69c246c0034d74aedae7281ce8720192d3c40e577835cc589c21c8c

SHA512
fc41d0d56e0ada3f8c4b76176e669b58439243a9bb9fe9d22895c3eeec5f838e3a4395df050a49e9743cefaabc96fc42e77ce6c8428eb0b69cb276e2eda67027

Download Submit
C:\Windows\System\mBCIVhB.exe

Filesize
1.6MB

MD5
37c4611a5fed01be46f9526e70ae0a5d

SHA1
743211cc00d31049ac2a57f4bffc21c2dedfeee2

SHA256
82ea969db8929e2bfeeba93dea5585d4088c2b5d7cf37be03b1adcac266e58b6

SHA512
26420f4d5a2ee41806f78591c775c19c2be762bc5c2cd80a41ee4da8818ff3e2e1e1c4eb6a86f3dfbb1483cae985ceafd15a337f4318a7a3c7ca282431d731e5

Download Submit
C:\Windows\System\moifvhO.exe

Filesize
1.6MB

MD5
f1090a9dc979b57b2a127d98f763deab

SHA1
e14ce3bd451f31675fcb5146d104d6ec9e8789b6

SHA256
552faefbb401abfd1287863fbab33cf8bf427f89d1c206ad389a2a598c4d39a3

SHA512
77da3c87efc63ae79cdabc5a001ed3e03e33f0d95f3e2b5d0b4710c2e7163236222b3029dbbed54bf1be862b55d9d4c2261396fd261739c81bfcd38757859ba9

Download Submit
C:\Windows\System\muKwinw.exe

Filesize
1.6MB

MD5
e1c16cd27cee3727f46807fd3c868ffd

SHA1
821a252a8eb68882304a729f37cd7adde0daef8c

SHA256
18758dbac46da5fda4e59337ea84e53c705e791c9224cf6e0599a5e07ab285e8

SHA512
16600febf327238f5ba4d4c11ef49b3f39557ad47c76f7730deaa7c530b0715f761454ae617443076646dead9961ae7f19ad94a8d992c5a9eff435e623958d16

Download Submit
C:\Windows\System\nIvkeVP.exe

Filesize
1.6MB

MD5
ef60d4773022e88ba65b3b3e0faaa247

SHA1
a461af4eeb41070abf7b63adb2f4990535e5d5f6

SHA256
b8617e86bf0c7960bd43a1d3347f25424dfffb105bfe09038364654bcffadaa1

SHA512
6c01b16ca0dad6cc8ad08d279111452d82c8304ab8fe9ddc90bf41854dca2ce4bbce33809c305bc8aa43db3815a9d12bce48f3606216fee40ce0905957227f8a

Download Submit
C:\Windows\System\oqLzCEK.exe

Filesize
1.6MB

MD5
ac89596fb6bd941a25fff3e7dce0e04d

SHA1
3346f75c9ca3ce0eb7254f7f3cd7f07d5eb57518

SHA256
c71e45eec955a19fdcdc09765fa329d4c8432446ad9e0efd4feaf51f00514e29

SHA512
f23ff6dc68df193902dfd47a0e7d0b0cb85162e67f417cd71cf9ffa20f9b663e2c33e97e84983f1c6559112f517598f012f7ab2620738f318e38bc5fb1287e6e

Download Submit
C:\Windows\System\sSkXCcw.exe

Filesize
1.6MB

MD5
de4b3b00f83fedd6251cf02a4595cfc8

SHA1
f69f477575e08f91330469ace55e5716381015d8

SHA256
4b2ba3118382c41fff39bc6d01104886b4380166834ba1e8a543479fb5d2e700

SHA512
de19f22f015ba2db329ff80128347df58fc79b2586eceee2bbaf0a2edf2aaf13a38aa3f2e424cf9db84dc5351dd3e18efe33a9bd0efad610916f0b5d432bad85

Download Submit
C:\Windows\System\uDKOqIv.exe

Filesize
1.6MB

MD5
635255aee3c904dcd6731ed0ddb6407a

SHA1
9e512a59b28d488e5fe996819930f24ae85f7a74

SHA256
a9d2bb58eed11b7fee391601f5ee1976212fc071de474fcc6a7595733bd31534

SHA512
9c1cf2095c1e4bd1e956cd67973bda0827462673b6bb6160a129a83813f290b993b4dbdfb790c5297d43112e52962a7c4849c9d626e9f0b0fa4e67a43cabaa0d

Download Submit
C:\Windows\System\uclyTjO.exe

Filesize
1.6MB

MD5
b242b000f27cc09434ae693e8cdbe8fd

SHA1
b8c3298c1f549a6a0a7af6add2287fbd4d016478

SHA256
8b4c1bd34cd395d8828badbce850b5d0ed0389506e90e07f58dd5f6c86eb80c9

SHA512
f4892c6ce893efc46632b4ce7bcf3f872622689bdf1e787e97dbae7b93f941adab3aeed252a9722e34464611fc226ad5f941ac9caac08060e8fd6a59f0c75b70

Download Submit
C:\Windows\System\vTNOLzR.exe

Filesize
1.6MB

MD5
7ecc747ca9976a11be01dc79743f3e3a

SHA1
351cf2890fc767fb31a2898756c002cf98ffde2b

SHA256
7346c2ce8f39eedccf062c0cd0e484b15665c1c6291bb1a646c2db7d570848d7

SHA512
849ee8b88689c659fa78c25a94dc9a7fb002c711717694ad8a4f305127805364cafa600a119b1308fdd91b560815dd41bc70d9a22b504d3771991835680ed598

Download Submit
memory/528-122-0x00007FF7A8170000-0x00007FF7A8562000-memory.dmp

Filesize
3.9MB

Download
memory/528-3075-0x00007FF7A8170000-0x00007FF7A8562000-memory.dmp

Filesize
3.9MB

Download
memory/816-997-0x00007FF679320000-0x00007FF679712000-memory.dmp

Filesize
3.9MB

Download
memory/904-0-0x00007FF65D100000-0x00007FF65D4F2000-memory.dmp

Filesize
3.9MB

Download
memory/904-1-0x0000017D60540000-0x0000017D60550000-memory.dmp

Filesize
64KB

Download
memory/1128-6650-0x00007FF62F8D0000-0x00007FF62FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/1128-642-0x00007FF62F8D0000-0x00007FF62FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-638-0x00007FF74D050000-0x00007FF74D442000-memory.dmp

Filesize
3.9MB

Download
memory/1168-931-0x000002A1C2C60000-0x000002A1C2C82000-memory.dmp

Filesize
136KB

Download
memory/1472-10-0x00007FF7F7100000-0x00007FF7F74F2000-memory.dmp

Filesize
3.9MB

Download
memory/1472-3070-0x00007FF7F7100000-0x00007FF7F74F2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-370-0x00007FF6B29E0000-0x00007FF6B2DD2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-298-0x00007FF62B260000-0x00007FF62B652000-memory.dmp

Filesize
3.9MB

Download
memory/1944-806-0x00007FF695DB0000-0x00007FF6961A2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-1302-0x00007FF7C1840000-0x00007FF7C1C32000-memory.dmp

Filesize
3.9MB

Download
memory/2220-1541-0x00007FF6762D0000-0x00007FF6766C2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-308-0x00007FF639340000-0x00007FF639732000-memory.dmp

Filesize
3.9MB

Download
memory/2924-478-0x00007FF764C90000-0x00007FF765082000-memory.dmp

Filesize
3.9MB

Download
memory/2940-1001-0x00007FF790EB0000-0x00007FF7912A2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-36-0x00007FF703400000-0x00007FF7037F2000-memory.dmp

Filesize
3.9MB

Download
memory/3188-42-0x00007FF717480000-0x00007FF717872000-memory.dmp

Filesize
3.9MB

Download
memory/3840-431-0x00007FF7B9AB0000-0x00007FF7B9EA2000-memory.dmp

Filesize
3.9MB

Download
memory/3916-5620-0x00007FF7A12D0000-0x00007FF7A16C2000-memory.dmp

Filesize
3.9MB

Download
memory/3916-479-0x00007FF7A12D0000-0x00007FF7A16C2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-1293-0x00007FF761510000-0x00007FF761902000-memory.dmp

Filesize
3.9MB

Download
memory/4056-6629-0x00007FF761510000-0x00007FF761902000-memory.dmp

Filesize
3.9MB

Download
memory/4384-74-0x00007FF7FAC00000-0x00007FF7FAFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4524-255-0x00007FF7645F0000-0x00007FF7649E2000-memory.dmp

Filesize
3.9MB

Download
memory/4672-214-0x00007FF62E260000-0x00007FF62E652000-memory.dmp

Filesize
3.9MB

Download