xmrig | a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b

Analysis

max time kernel
148s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
Size

1.7MB
MD5

9f6ef1867a1293da8f2640c45f7a7fc1
SHA1

dca9b83c3e28e79071249db473268d25fc78cf76
SHA256

a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b
SHA512

fa3a8e3522055cd2c3d8b1605d1c030e7c39f3cc86aaf038ad5bc17404cdab8582d710cee1892ae7fd3d064ffcf7d73fed06fc3f7ab049f430de5ce7c3586bee
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwV0L4ff:Lz071uv4BPMkFfdg6NsIRSwVf3

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 29 IoCs

miner

resource	yara_rule
behavioral2/memory/4636-185-0x00007FF7CCA60000-0x00007FF7CCE52000-memory.dmp	xmrig
behavioral2/memory/2228-247-0x00007FF76AEC0000-0x00007FF76B2B2000-memory.dmp	xmrig
behavioral2/memory/4248-251-0x00007FF696740000-0x00007FF696B32000-memory.dmp	xmrig
behavioral2/memory/4420-256-0x00007FF736F00000-0x00007FF7372F2000-memory.dmp	xmrig
behavioral2/memory/3124-395-0x00007FF79F160000-0x00007FF79F552000-memory.dmp	xmrig
behavioral2/memory/4840-2558-0x00007FF66AC10000-0x00007FF66B002000-memory.dmp	xmrig
behavioral2/memory/3112-796-0x00007FF697290000-0x00007FF697682000-memory.dmp	xmrig
behavioral2/memory/1828-718-0x00007FF644F30000-0x00007FF645322000-memory.dmp	xmrig
behavioral2/memory/4560-642-0x00007FF645000000-0x00007FF6453F2000-memory.dmp	xmrig
behavioral2/memory/3876-579-0x00007FF70BC10000-0x00007FF70C002000-memory.dmp	xmrig
behavioral2/memory/1632-511-0x00007FF729A90000-0x00007FF729E82000-memory.dmp	xmrig
behavioral2/memory/2360-463-0x00007FF6C8AF0000-0x00007FF6C8EE2000-memory.dmp	xmrig
behavioral2/memory/3160-394-0x00007FF6E56D0000-0x00007FF6E5AC2000-memory.dmp	xmrig
behavioral2/memory/1040-257-0x00007FF7DE390000-0x00007FF7DE782000-memory.dmp	xmrig
behavioral2/memory/3728-255-0x00007FF6332B0000-0x00007FF6336A2000-memory.dmp	xmrig
behavioral2/memory/1144-254-0x00007FF6BD860000-0x00007FF6BDC52000-memory.dmp	xmrig
behavioral2/memory/4592-258-0x00007FF72A3B0000-0x00007FF72A7A2000-memory.dmp	xmrig
behavioral2/memory/1236-253-0x00007FF606E40000-0x00007FF607232000-memory.dmp	xmrig
behavioral2/memory/1136-252-0x00007FF7B3E10000-0x00007FF7B4202000-memory.dmp	xmrig
behavioral2/memory/4904-250-0x00007FF782C20000-0x00007FF783012000-memory.dmp	xmrig
behavioral2/memory/4600-249-0x00007FF7B2690000-0x00007FF7B2A82000-memory.dmp	xmrig
behavioral2/memory/2796-248-0x00007FF622210000-0x00007FF622602000-memory.dmp	xmrig
behavioral2/memory/4188-198-0x00007FF676110000-0x00007FF676502000-memory.dmp	xmrig
behavioral2/memory/4472-127-0x00007FF7CAE20000-0x00007FF7CB212000-memory.dmp	xmrig
behavioral2/memory/2796-5081-0x00007FF622210000-0x00007FF622602000-memory.dmp	xmrig
behavioral2/memory/3124-5270-0x00007FF79F160000-0x00007FF79F552000-memory.dmp	xmrig
behavioral2/memory/2360-5286-0x00007FF6C8AF0000-0x00007FF6C8EE2000-memory.dmp	xmrig
behavioral2/memory/3876-5303-0x00007FF70BC10000-0x00007FF70C002000-memory.dmp	xmrig
behavioral2/memory/1632-5311-0x00007FF729A90000-0x00007FF729E82000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4852	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4840	CjTsxWc.exe
4472	zOWTMJU.exe
4636	pNkzXMj.exe
4188	OGELnWn.exe
1828	NoEhfaA.exe
2228	OhrwMWf.exe
2796	WJVAxql.exe
4600	oZckNvT.exe
4904	tGhUJuw.exe
4248	fDrbylm.exe
1136	RXcHNzA.exe
1236	XPLEqFh.exe
1144	LmbzPLN.exe
3728	moRDorb.exe
3112	mtkGmfP.exe
4420	XUSpaNX.exe
1040	hllSUTO.exe
4592	zkaaOiE.exe
3160	rItmPHe.exe
3124	ChsxcSh.exe
2360	bEBEZoP.exe
1632	lQsMXIC.exe
3876	OpwtmJV.exe
4560	sQQRUeF.exe
2312	QgsrlVE.exe
1436	GrGFzfS.exe
4268	vOUNvId.exe
5000	LPdlsiN.exe
4160	SgacnIj.exe
2180	lhDRepz.exe
1884	ZVOuuYL.exe
4612	gyQCBQB.exe
3856	YymhXLQ.exe
4780	nGvLdwy.exe
3176	cgTywxP.exe
3552	dqWDYUV.exe
4900	Wpughmt.exe
2676	LcgtJJA.exe
2988	nWOgoGX.exe
4548	FvlNFlz.exe
4416	KCfSovZ.exe
824	sHNoSqH.exe
1204	eVGsMNP.exe
4108	oPZnxyR.exe
4552	yqRxtza.exe
4624	iROXYPV.exe
3464	cOviMtR.exe
4148	bACadLt.exe
1920	Qgrxacq.exe
4356	UaLtEmA.exe
3132	LHeRAAI.exe
4428	OeGIcRj.exe
1424	CiJIeGm.exe
3228	HLiLvou.exe
3028	UtpmRQa.exe
2936	fkUeIIa.exe
1536	etdkRTT.exe
448	GFLuKUi.exe
1008	gcwuLEm.exe
1160	AllXIQC.exe
4380	gtmBpIK.exe
4924	rJXVxAo.exe
3448	cOZwSij.exe
740	mcuJzIl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3336-0-0x00007FF6E6200000-0x00007FF6E65F2000-memory.dmp	upx
behavioral2/files/0x0007000000023458-7.dat	upx
behavioral2/files/0x0007000000023457-15.dat	upx
behavioral2/files/0x000700000002345d-61.dat	upx
behavioral2/memory/4636-185-0x00007FF7CCA60000-0x00007FF7CCE52000-memory.dmp	upx
behavioral2/files/0x000700000002347f-204.dat	upx
behavioral2/memory/2228-247-0x00007FF76AEC0000-0x00007FF76B2B2000-memory.dmp	upx
behavioral2/memory/4248-251-0x00007FF696740000-0x00007FF696B32000-memory.dmp	upx
behavioral2/memory/4420-256-0x00007FF736F00000-0x00007FF7372F2000-memory.dmp	upx
behavioral2/memory/3124-395-0x00007FF79F160000-0x00007FF79F552000-memory.dmp	upx
behavioral2/memory/4840-2558-0x00007FF66AC10000-0x00007FF66B002000-memory.dmp	upx
behavioral2/memory/3112-796-0x00007FF697290000-0x00007FF697682000-memory.dmp	upx
behavioral2/memory/1828-718-0x00007FF644F30000-0x00007FF645322000-memory.dmp	upx
behavioral2/memory/4560-642-0x00007FF645000000-0x00007FF6453F2000-memory.dmp	upx
behavioral2/memory/3876-579-0x00007FF70BC10000-0x00007FF70C002000-memory.dmp	upx
behavioral2/memory/1632-511-0x00007FF729A90000-0x00007FF729E82000-memory.dmp	upx
behavioral2/memory/2360-463-0x00007FF6C8AF0000-0x00007FF6C8EE2000-memory.dmp	upx
behavioral2/memory/3160-394-0x00007FF6E56D0000-0x00007FF6E5AC2000-memory.dmp	upx
behavioral2/memory/1040-257-0x00007FF7DE390000-0x00007FF7DE782000-memory.dmp	upx
behavioral2/memory/3728-255-0x00007FF6332B0000-0x00007FF6336A2000-memory.dmp	upx
behavioral2/memory/1144-254-0x00007FF6BD860000-0x00007FF6BDC52000-memory.dmp	upx
behavioral2/memory/4592-258-0x00007FF72A3B0000-0x00007FF72A7A2000-memory.dmp	upx
behavioral2/memory/1236-253-0x00007FF606E40000-0x00007FF607232000-memory.dmp	upx
behavioral2/memory/1136-252-0x00007FF7B3E10000-0x00007FF7B4202000-memory.dmp	upx
behavioral2/memory/4904-250-0x00007FF782C20000-0x00007FF783012000-memory.dmp	upx
behavioral2/memory/4600-249-0x00007FF7B2690000-0x00007FF7B2A82000-memory.dmp	upx
behavioral2/memory/2796-248-0x00007FF622210000-0x00007FF622602000-memory.dmp	upx
behavioral2/files/0x000700000002347e-203.dat	upx
behavioral2/memory/4188-198-0x00007FF676110000-0x00007FF676502000-memory.dmp	upx
behavioral2/files/0x000700000002346f-193.dat	upx
behavioral2/files/0x000700000002347c-192.dat	upx
behavioral2/files/0x000700000002347b-191.dat	upx
behavioral2/files/0x0007000000023478-184.dat	upx
behavioral2/files/0x000700000002347a-183.dat	upx
behavioral2/files/0x0007000000023479-182.dat	upx
behavioral2/files/0x0007000000023465-169.dat	upx
behavioral2/files/0x0007000000023477-168.dat	upx
behavioral2/files/0x0007000000023476-167.dat	upx
behavioral2/files/0x0007000000023475-164.dat	upx
behavioral2/files/0x0007000000023474-163.dat	upx
behavioral2/files/0x0007000000023473-162.dat	upx
behavioral2/files/0x0007000000023471-158.dat	upx
behavioral2/files/0x0007000000023481-208.dat	upx
behavioral2/files/0x0007000000023463-152.dat	upx
behavioral2/files/0x0007000000023470-147.dat	upx
behavioral2/files/0x0007000000023480-205.dat	upx
behavioral2/files/0x0007000000023468-144.dat	upx
behavioral2/files/0x0007000000023462-141.dat	upx
behavioral2/files/0x000700000002347d-200.dat	upx
behavioral2/files/0x000700000002346e-130.dat	upx
behavioral2/files/0x0007000000023460-119.dat	upx
behavioral2/files/0x000700000002345f-107.dat	upx
behavioral2/files/0x000700000002345e-105.dat	upx
behavioral2/files/0x0007000000023472-161.dat	upx
behavioral2/files/0x000700000002346c-96.dat	upx
behavioral2/files/0x000700000002346b-95.dat	upx
behavioral2/files/0x000700000002346a-94.dat	upx
behavioral2/files/0x0007000000023461-86.dat	upx
behavioral2/memory/4472-127-0x00007FF7CAE20000-0x00007FF7CB212000-memory.dmp	upx
behavioral2/files/0x0007000000023467-83.dat	upx
behavioral2/files/0x000700000002346d-121.dat	upx
behavioral2/files/0x0007000000023466-79.dat	upx
behavioral2/files/0x0007000000023464-113.dat	upx
behavioral2/files/0x000700000002345c-99.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fVlccSl.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\VEtgNur.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\qVFUurY.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\LrVXFkm.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\SCwvQsL.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\rTizkgG.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\gWZTXqH.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\viiVSbZ.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\SfijaVv.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\klEykyU.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\XwumcgT.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\zZJnDgO.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\hgNGPBx.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\Gopaute.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\tTOatBL.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\kbGOCfq.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\OLUVscw.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\zsJSglr.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\YJDqsSR.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\LRlbkhl.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\uxcrjyL.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\tFvDDza.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\kOcGGvk.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\aZazBrj.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\YUArMVB.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\OidFqbL.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\XOBIrJJ.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\hpQrUsb.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\ekDVaQi.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\KCtGtFF.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\rBQsQwy.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\SgUWPnL.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\TIqdUml.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\rHcWhvT.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\GFmpZVC.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\qFkgLWx.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\GQjvPIn.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\wBEhnXJ.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\WqTzDsR.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\uusgFlq.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\loRfrNB.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\ymUFbPh.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\ntvLcuy.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\JJSSBhd.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\PRhKhje.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\BQXTCIe.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\cQhFWxS.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\uqfKFpX.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\uhGhTUA.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\ubHNXsc.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\DdGQTfT.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\PBXjFiP.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\pIFIrlt.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\ZIzpTvD.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\blQlGuX.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\aYgPGxr.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\YFSGiob.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\YiEFrRM.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\oidZCNl.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\ZdgpNXP.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\HAPLsxd.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\arGNkmn.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\ZSsQHcx.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
File created	C:\Windows\System\rZSpear.exe	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
Token: SeLockMemoryPrivilege	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
Token: SeDebugPrivilege	4852	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4852	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	83
PID 3336 wrote to memory of 4852	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	83
PID 3336 wrote to memory of 4840	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	84
PID 3336 wrote to memory of 4840	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	84
PID 3336 wrote to memory of 4636	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	85
PID 3336 wrote to memory of 4636	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	85
PID 3336 wrote to memory of 4472	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	86
PID 3336 wrote to memory of 4472	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	86
PID 3336 wrote to memory of 4188	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	87
PID 3336 wrote to memory of 4188	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	87
PID 3336 wrote to memory of 1828	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	88
PID 3336 wrote to memory of 1828	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	88
PID 3336 wrote to memory of 2228	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	89
PID 3336 wrote to memory of 2228	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	89
PID 3336 wrote to memory of 2796	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	90
PID 3336 wrote to memory of 2796	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	90
PID 3336 wrote to memory of 1136	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	91
PID 3336 wrote to memory of 1136	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	91
PID 3336 wrote to memory of 4600	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	92
PID 3336 wrote to memory of 4600	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	92
PID 3336 wrote to memory of 4904	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	93
PID 3336 wrote to memory of 4904	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	93
PID 3336 wrote to memory of 4248	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	94
PID 3336 wrote to memory of 4248	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	94
PID 3336 wrote to memory of 1236	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	95
PID 3336 wrote to memory of 1236	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	95
PID 3336 wrote to memory of 1144	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	96
PID 3336 wrote to memory of 1144	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	96
PID 3336 wrote to memory of 3728	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	97
PID 3336 wrote to memory of 3728	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	97
PID 3336 wrote to memory of 3112	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	98
PID 3336 wrote to memory of 3112	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	98
PID 3336 wrote to memory of 4420	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	99
PID 3336 wrote to memory of 4420	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	99
PID 3336 wrote to memory of 1040	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	100
PID 3336 wrote to memory of 1040	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	100
PID 3336 wrote to memory of 4592	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	101
PID 3336 wrote to memory of 4592	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	101
PID 3336 wrote to memory of 3160	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	102
PID 3336 wrote to memory of 3160	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	102
PID 3336 wrote to memory of 3124	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	103
PID 3336 wrote to memory of 3124	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	103
PID 3336 wrote to memory of 2360	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	104
PID 3336 wrote to memory of 2360	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	104
PID 3336 wrote to memory of 1632	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	105
PID 3336 wrote to memory of 1632	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	105
PID 3336 wrote to memory of 3876	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	106
PID 3336 wrote to memory of 3876	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	106
PID 3336 wrote to memory of 4560	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	107
PID 3336 wrote to memory of 4560	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	107
PID 3336 wrote to memory of 2312	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	108
PID 3336 wrote to memory of 2312	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	108
PID 3336 wrote to memory of 1436	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	109
PID 3336 wrote to memory of 1436	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	109
PID 3336 wrote to memory of 4268	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	110
PID 3336 wrote to memory of 4268	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	110
PID 3336 wrote to memory of 5000	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	111
PID 3336 wrote to memory of 5000	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	111
PID 3336 wrote to memory of 4160	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	112
PID 3336 wrote to memory of 4160	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	112
PID 3336 wrote to memory of 2180	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	113
PID 3336 wrote to memory of 2180	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	113
PID 3336 wrote to memory of 1884	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	114
PID 3336 wrote to memory of 1884	3336	a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe	114

C:\Users\Admin\AppData\Local\Temp\a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe
"C:\Users\Admin\AppData\Local\Temp\a264b783840ed6631cbe7dcd7496cc8d7b1c1d98ceac22d392974c98bfa66a7b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- C:\Windows\System\CjTsxWc.exe
  C:\Windows\System\CjTsxWc.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\pNkzXMj.exe
  C:\Windows\System\pNkzXMj.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\zOWTMJU.exe
  C:\Windows\System\zOWTMJU.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\OGELnWn.exe
  C:\Windows\System\OGELnWn.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\NoEhfaA.exe
  C:\Windows\System\NoEhfaA.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\OhrwMWf.exe
  C:\Windows\System\OhrwMWf.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\WJVAxql.exe
  C:\Windows\System\WJVAxql.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\RXcHNzA.exe
  C:\Windows\System\RXcHNzA.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\oZckNvT.exe
  C:\Windows\System\oZckNvT.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\tGhUJuw.exe
  C:\Windows\System\tGhUJuw.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\fDrbylm.exe
  C:\Windows\System\fDrbylm.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\XPLEqFh.exe
  C:\Windows\System\XPLEqFh.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\LmbzPLN.exe
  C:\Windows\System\LmbzPLN.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\moRDorb.exe
  C:\Windows\System\moRDorb.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\mtkGmfP.exe
  C:\Windows\System\mtkGmfP.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\XUSpaNX.exe
  C:\Windows\System\XUSpaNX.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\hllSUTO.exe
  C:\Windows\System\hllSUTO.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\zkaaOiE.exe
  C:\Windows\System\zkaaOiE.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\rItmPHe.exe
  C:\Windows\System\rItmPHe.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\ChsxcSh.exe
  C:\Windows\System\ChsxcSh.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\bEBEZoP.exe
  C:\Windows\System\bEBEZoP.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\lQsMXIC.exe
  C:\Windows\System\lQsMXIC.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\OpwtmJV.exe
  C:\Windows\System\OpwtmJV.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\sQQRUeF.exe
  C:\Windows\System\sQQRUeF.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\QgsrlVE.exe
  C:\Windows\System\QgsrlVE.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\GrGFzfS.exe
  C:\Windows\System\GrGFzfS.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\vOUNvId.exe
  C:\Windows\System\vOUNvId.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\LPdlsiN.exe
  C:\Windows\System\LPdlsiN.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\SgacnIj.exe
  C:\Windows\System\SgacnIj.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\lhDRepz.exe
  C:\Windows\System\lhDRepz.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\ZVOuuYL.exe
  C:\Windows\System\ZVOuuYL.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\gyQCBQB.exe
  C:\Windows\System\gyQCBQB.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\YymhXLQ.exe
  C:\Windows\System\YymhXLQ.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\nGvLdwy.exe
  C:\Windows\System\nGvLdwy.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\cgTywxP.exe
  C:\Windows\System\cgTywxP.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\dqWDYUV.exe
  C:\Windows\System\dqWDYUV.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\Wpughmt.exe
  C:\Windows\System\Wpughmt.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\LcgtJJA.exe
  C:\Windows\System\LcgtJJA.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\nWOgoGX.exe
  C:\Windows\System\nWOgoGX.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\FvlNFlz.exe
  C:\Windows\System\FvlNFlz.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\KCfSovZ.exe
  C:\Windows\System\KCfSovZ.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\sHNoSqH.exe
  C:\Windows\System\sHNoSqH.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\eVGsMNP.exe
  C:\Windows\System\eVGsMNP.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\oPZnxyR.exe
  C:\Windows\System\oPZnxyR.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\yqRxtza.exe
  C:\Windows\System\yqRxtza.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\iROXYPV.exe
  C:\Windows\System\iROXYPV.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\cOviMtR.exe
  C:\Windows\System\cOviMtR.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\bACadLt.exe
  C:\Windows\System\bACadLt.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\Qgrxacq.exe
  C:\Windows\System\Qgrxacq.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\UaLtEmA.exe
  C:\Windows\System\UaLtEmA.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\LHeRAAI.exe
  C:\Windows\System\LHeRAAI.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\OeGIcRj.exe
  C:\Windows\System\OeGIcRj.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\CiJIeGm.exe
  C:\Windows\System\CiJIeGm.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\HLiLvou.exe
  C:\Windows\System\HLiLvou.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\UtpmRQa.exe
  C:\Windows\System\UtpmRQa.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\fkUeIIa.exe
  C:\Windows\System\fkUeIIa.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\etdkRTT.exe
  C:\Windows\System\etdkRTT.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\GFLuKUi.exe
  C:\Windows\System\GFLuKUi.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\gcwuLEm.exe
  C:\Windows\System\gcwuLEm.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\AllXIQC.exe
  C:\Windows\System\AllXIQC.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\gtmBpIK.exe
  C:\Windows\System\gtmBpIK.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\rJXVxAo.exe
  C:\Windows\System\rJXVxAo.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\cOZwSij.exe
  C:\Windows\System\cOZwSij.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\mcuJzIl.exe
  C:\Windows\System\mcuJzIl.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\yiBHwOD.exe
  C:\Windows\System\yiBHwOD.exe
  2⤵
  PID:1708
- C:\Windows\System\cdwzfSB.exe
  C:\Windows\System\cdwzfSB.exe
  2⤵
  PID:2200
- C:\Windows\System\qzqOBjf.exe
  C:\Windows\System\qzqOBjf.exe
  2⤵
  PID:3408
- C:\Windows\System\GGTluHK.exe
  C:\Windows\System\GGTluHK.exe
  2⤵
  PID:3128
- C:\Windows\System\tDNXOzm.exe
  C:\Windows\System\tDNXOzm.exe
  2⤵
  PID:4988
- C:\Windows\System\jwqvfBr.exe
  C:\Windows\System\jwqvfBr.exe
  2⤵
  PID:5096
- C:\Windows\System\aAjodyb.exe
  C:\Windows\System\aAjodyb.exe
  2⤵
  PID:3152
- C:\Windows\System\wmeJIma.exe
  C:\Windows\System\wmeJIma.exe
  2⤵
  PID:2076
- C:\Windows\System\UsfLaji.exe
  C:\Windows\System\UsfLaji.exe
  2⤵
  PID:4236
- C:\Windows\System\NnACEpd.exe
  C:\Windows\System\NnACEpd.exe
  2⤵
  PID:4952
- C:\Windows\System\HLiJxNb.exe
  C:\Windows\System\HLiJxNb.exe
  2⤵
  PID:932
- C:\Windows\System\rVxWtwr.exe
  C:\Windows\System\rVxWtwr.exe
  2⤵
  PID:1820
- C:\Windows\System\jhRnzpU.exe
  C:\Windows\System\jhRnzpU.exe
  2⤵
  PID:3456
- C:\Windows\System\uFooUib.exe
  C:\Windows\System\uFooUib.exe
  2⤵
  PID:620
- C:\Windows\System\HGwsmib.exe
  C:\Windows\System\HGwsmib.exe
  2⤵
  PID:5056
- C:\Windows\System\mzeNOMp.exe
  C:\Windows\System\mzeNOMp.exe
  2⤵
  PID:2920
- C:\Windows\System\JasmXil.exe
  C:\Windows\System\JasmXil.exe
  2⤵
  PID:4436
- C:\Windows\System\xfFgcrc.exe
  C:\Windows\System\xfFgcrc.exe
  2⤵
  PID:3288
- C:\Windows\System\XqmEbOF.exe
  C:\Windows\System\XqmEbOF.exe
  2⤵
  PID:692
- C:\Windows\System\JCFuoAF.exe
  C:\Windows\System\JCFuoAF.exe
  2⤵
  PID:116
- C:\Windows\System\dYwLAHm.exe
  C:\Windows\System\dYwLAHm.exe
  2⤵
  PID:1432
- C:\Windows\System\GFFdmjm.exe
  C:\Windows\System\GFFdmjm.exe
  2⤵
  PID:2792
- C:\Windows\System\fIgADRL.exe
  C:\Windows\System\fIgADRL.exe
  2⤵
  PID:4004
- C:\Windows\System\rCydxww.exe
  C:\Windows\System\rCydxww.exe
  2⤵
  PID:3648
- C:\Windows\System\GyJRZGQ.exe
  C:\Windows\System\GyJRZGQ.exe
  2⤵
  PID:4368
- C:\Windows\System\HPpiUaZ.exe
  C:\Windows\System\HPpiUaZ.exe
  2⤵
  PID:760
- C:\Windows\System\HlnqwoN.exe
  C:\Windows\System\HlnqwoN.exe
  2⤵
  PID:744
- C:\Windows\System\ZItqLxz.exe
  C:\Windows\System\ZItqLxz.exe
  2⤵
  PID:5136
- C:\Windows\System\NybadVY.exe
  C:\Windows\System\NybadVY.exe
  2⤵
  PID:5160
- C:\Windows\System\LuHNSwb.exe
  C:\Windows\System\LuHNSwb.exe
  2⤵
  PID:5180
- C:\Windows\System\rhbVNai.exe
  C:\Windows\System\rhbVNai.exe
  2⤵
  PID:5204
- C:\Windows\System\oKiLYCc.exe
  C:\Windows\System\oKiLYCc.exe
  2⤵
  PID:5236
- C:\Windows\System\jgkdvHJ.exe
  C:\Windows\System\jgkdvHJ.exe
  2⤵
  PID:5256
- C:\Windows\System\vGfRubN.exe
  C:\Windows\System\vGfRubN.exe
  2⤵
  PID:5280
- C:\Windows\System\ndHTGAQ.exe
  C:\Windows\System\ndHTGAQ.exe
  2⤵
  PID:5296
- C:\Windows\System\ERQSyRN.exe
  C:\Windows\System\ERQSyRN.exe
  2⤵
  PID:5316
- C:\Windows\System\MeVenSK.exe
  C:\Windows\System\MeVenSK.exe
  2⤵
  PID:5336
- C:\Windows\System\bxAlwAd.exe
  C:\Windows\System\bxAlwAd.exe
  2⤵
  PID:5360
- C:\Windows\System\kjGQPUw.exe
  C:\Windows\System\kjGQPUw.exe
  2⤵
  PID:5376
- C:\Windows\System\YOwORFH.exe
  C:\Windows\System\YOwORFH.exe
  2⤵
  PID:5412
- C:\Windows\System\jqjUbmW.exe
  C:\Windows\System\jqjUbmW.exe
  2⤵
  PID:5428
- C:\Windows\System\WNCKXTU.exe
  C:\Windows\System\WNCKXTU.exe
  2⤵
  PID:5448
- C:\Windows\System\oeXixPs.exe
  C:\Windows\System\oeXixPs.exe
  2⤵
  PID:5468
- C:\Windows\System\NSVlmfe.exe
  C:\Windows\System\NSVlmfe.exe
  2⤵
  PID:5492
- C:\Windows\System\yScvmhr.exe
  C:\Windows\System\yScvmhr.exe
  2⤵
  PID:5508
- C:\Windows\System\HIHjWAb.exe
  C:\Windows\System\HIHjWAb.exe
  2⤵
  PID:5528
- C:\Windows\System\BincIwZ.exe
  C:\Windows\System\BincIwZ.exe
  2⤵
  PID:5564
- C:\Windows\System\LNwTMxn.exe
  C:\Windows\System\LNwTMxn.exe
  2⤵
  PID:5604
- C:\Windows\System\XMerQXZ.exe
  C:\Windows\System\XMerQXZ.exe
  2⤵
  PID:5640
- C:\Windows\System\CMSRSYS.exe
  C:\Windows\System\CMSRSYS.exe
  2⤵
  PID:5656
- C:\Windows\System\bpzLowE.exe
  C:\Windows\System\bpzLowE.exe
  2⤵
  PID:5680
- C:\Windows\System\oZzvIXc.exe
  C:\Windows\System\oZzvIXc.exe
  2⤵
  PID:5712
- C:\Windows\System\qlKQFgA.exe
  C:\Windows\System\qlKQFgA.exe
  2⤵
  PID:5728
- C:\Windows\System\bCVpliD.exe
  C:\Windows\System\bCVpliD.exe
  2⤵
  PID:5748
- C:\Windows\System\mpHYjmf.exe
  C:\Windows\System\mpHYjmf.exe
  2⤵
  PID:5768
- C:\Windows\System\haCSGTT.exe
  C:\Windows\System\haCSGTT.exe
  2⤵
  PID:5788
- C:\Windows\System\YQfBXtp.exe
  C:\Windows\System\YQfBXtp.exe
  2⤵
  PID:5808
- C:\Windows\System\wjIfGOQ.exe
  C:\Windows\System\wjIfGOQ.exe
  2⤵
  PID:5832
- C:\Windows\System\GVNEnfy.exe
  C:\Windows\System\GVNEnfy.exe
  2⤵
  PID:5848
- C:\Windows\System\mvrkGpz.exe
  C:\Windows\System\mvrkGpz.exe
  2⤵
  PID:5864
- C:\Windows\System\OHcmgGM.exe
  C:\Windows\System\OHcmgGM.exe
  2⤵
  PID:5888
- C:\Windows\System\NDeYDdf.exe
  C:\Windows\System\NDeYDdf.exe
  2⤵
  PID:5908
- C:\Windows\System\CVGgVgT.exe
  C:\Windows\System\CVGgVgT.exe
  2⤵
  PID:5924
- C:\Windows\System\waamSxf.exe
  C:\Windows\System\waamSxf.exe
  2⤵
  PID:5940
- C:\Windows\System\vrfQcGU.exe
  C:\Windows\System\vrfQcGU.exe
  2⤵
  PID:5956
- C:\Windows\System\LVYoRGO.exe
  C:\Windows\System\LVYoRGO.exe
  2⤵
  PID:6036
- C:\Windows\System\RBfJLaa.exe
  C:\Windows\System\RBfJLaa.exe
  2⤵
  PID:6056
- C:\Windows\System\ZcRpxgq.exe
  C:\Windows\System\ZcRpxgq.exe
  2⤵
  PID:6080
- C:\Windows\System\pieJklL.exe
  C:\Windows\System\pieJklL.exe
  2⤵
  PID:6108
- C:\Windows\System\CIpYzth.exe
  C:\Windows\System\CIpYzth.exe
  2⤵
  PID:6132
- C:\Windows\System\wJkvqXm.exe
  C:\Windows\System\wJkvqXm.exe
  2⤵
  PID:1188
- C:\Windows\System\QdBlZjq.exe
  C:\Windows\System\QdBlZjq.exe
  2⤵
  PID:1604
- C:\Windows\System\mJBQXTO.exe
  C:\Windows\System\mJBQXTO.exe
  2⤵
  PID:5288
- C:\Windows\System\qnXcAtE.exe
  C:\Windows\System\qnXcAtE.exe
  2⤵
  PID:5344
- C:\Windows\System\zBqAZaM.exe
  C:\Windows\System\zBqAZaM.exe
  2⤵
  PID:5384
- C:\Windows\System\VsjQhra.exe
  C:\Windows\System\VsjQhra.exe
  2⤵
  PID:3684
- C:\Windows\System\usggZsb.exe
  C:\Windows\System\usggZsb.exe
  2⤵
  PID:2376
- C:\Windows\System\koecPMP.exe
  C:\Windows\System\koecPMP.exe
  2⤵
  PID:5484
- C:\Windows\System\TBAEWtY.exe
  C:\Windows\System\TBAEWtY.exe
  2⤵
  PID:6156
- C:\Windows\System\wGSWftC.exe
  C:\Windows\System\wGSWftC.exe
  2⤵
  PID:6172
- C:\Windows\System\naSSWxm.exe
  C:\Windows\System\naSSWxm.exe
  2⤵
  PID:6204
- C:\Windows\System\nioqTeW.exe
  C:\Windows\System\nioqTeW.exe
  2⤵
  PID:6220
- C:\Windows\System\fYBQVjr.exe
  C:\Windows\System\fYBQVjr.exe
  2⤵
  PID:6240
- C:\Windows\System\qYaqsOD.exe
  C:\Windows\System\qYaqsOD.exe
  2⤵
  PID:6260
- C:\Windows\System\PxrmCwk.exe
  C:\Windows\System\PxrmCwk.exe
  2⤵
  PID:6288
- C:\Windows\System\KHEkUlo.exe
  C:\Windows\System\KHEkUlo.exe
  2⤵
  PID:6304
- C:\Windows\System\KwjtzmP.exe
  C:\Windows\System\KwjtzmP.exe
  2⤵
  PID:6332
- C:\Windows\System\KnoTYlC.exe
  C:\Windows\System\KnoTYlC.exe
  2⤵
  PID:6384
- C:\Windows\System\tLMEuCg.exe
  C:\Windows\System\tLMEuCg.exe
  2⤵
  PID:6408
- C:\Windows\System\jDZsXDs.exe
  C:\Windows\System\jDZsXDs.exe
  2⤵
  PID:6428
- C:\Windows\System\PkzAnGx.exe
  C:\Windows\System\PkzAnGx.exe
  2⤵
  PID:6448
- C:\Windows\System\wXJijPT.exe
  C:\Windows\System\wXJijPT.exe
  2⤵
  PID:6472
- C:\Windows\System\EsmZFkY.exe
  C:\Windows\System\EsmZFkY.exe
  2⤵
  PID:6488
- C:\Windows\System\GgnYlqE.exe
  C:\Windows\System\GgnYlqE.exe
  2⤵
  PID:6512
- C:\Windows\System\TCIXgDO.exe
  C:\Windows\System\TCIXgDO.exe
  2⤵
  PID:6532
- C:\Windows\System\BnABjxu.exe
  C:\Windows\System\BnABjxu.exe
  2⤵
  PID:6564
- C:\Windows\System\UHZsqPC.exe
  C:\Windows\System\UHZsqPC.exe
  2⤵
  PID:6584
- C:\Windows\System\ymAAFzM.exe
  C:\Windows\System\ymAAFzM.exe
  2⤵
  PID:6644
- C:\Windows\System\uqNlloM.exe
  C:\Windows\System\uqNlloM.exe
  2⤵
  PID:6664
- C:\Windows\System\CFdkhWu.exe
  C:\Windows\System\CFdkhWu.exe
  2⤵
  PID:6684
- C:\Windows\System\SSVgvrL.exe
  C:\Windows\System\SSVgvrL.exe
  2⤵
  PID:6708
- C:\Windows\System\tgyMEnk.exe
  C:\Windows\System\tgyMEnk.exe
  2⤵
  PID:6732
- C:\Windows\System\bBpGWma.exe
  C:\Windows\System\bBpGWma.exe
  2⤵
  PID:7040
- C:\Windows\System\ogczsSN.exe
  C:\Windows\System\ogczsSN.exe
  2⤵
  PID:7056
- C:\Windows\System\CLjtOcV.exe
  C:\Windows\System\CLjtOcV.exe
  2⤵
  PID:7088
- C:\Windows\System\FDEcDyv.exe
  C:\Windows\System\FDEcDyv.exe
  2⤵
  PID:7104
- C:\Windows\System\yqKNEDM.exe
  C:\Windows\System\yqKNEDM.exe
  2⤵
  PID:7132
- C:\Windows\System\YCIeQII.exe
  C:\Windows\System\YCIeQII.exe
  2⤵
  PID:7156
- C:\Windows\System\NFLOllX.exe
  C:\Windows\System\NFLOllX.exe
  2⤵
  PID:5572
- C:\Windows\System\eoiDgoe.exe
  C:\Windows\System\eoiDgoe.exe
  2⤵
  PID:5620
- C:\Windows\System\EAmyICi.exe
  C:\Windows\System\EAmyICi.exe
  2⤵
  PID:5636
- C:\Windows\System\UhDEtpf.exe
  C:\Windows\System\UhDEtpf.exe
  2⤵
  PID:2596
- C:\Windows\System\VrcHrGi.exe
  C:\Windows\System\VrcHrGi.exe
  2⤵
  PID:2364
- C:\Windows\System\wvyGDse.exe
  C:\Windows\System\wvyGDse.exe
  2⤵
  PID:1508
- C:\Windows\System\Xzihvyw.exe
  C:\Windows\System\Xzihvyw.exe
  2⤵
  PID:5816
- C:\Windows\System\MqrsQpv.exe
  C:\Windows\System\MqrsQpv.exe
  2⤵
  PID:2500
- C:\Windows\System\OrkDKPa.exe
  C:\Windows\System\OrkDKPa.exe
  2⤵
  PID:3100
- C:\Windows\System\qAFpwEZ.exe
  C:\Windows\System\qAFpwEZ.exe
  2⤵
  PID:4604
- C:\Windows\System\PeMcmgV.exe
  C:\Windows\System\PeMcmgV.exe
  2⤵
  PID:6128
- C:\Windows\System\IDhRukb.exe
  C:\Windows\System\IDhRukb.exe
  2⤵
  PID:2680
- C:\Windows\System\xGYganp.exe
  C:\Windows\System\xGYganp.exe
  2⤵
  PID:3688
- C:\Windows\System\zUbJYFa.exe
  C:\Windows\System\zUbJYFa.exe
  2⤵
  PID:5504
- C:\Windows\System\ImQyNAl.exe
  C:\Windows\System\ImQyNAl.exe
  2⤵
  PID:6192
- C:\Windows\System\HCXbvVe.exe
  C:\Windows\System\HCXbvVe.exe
  2⤵
  PID:6228
- C:\Windows\System\ZRfjRKq.exe
  C:\Windows\System\ZRfjRKq.exe
  2⤵
  PID:5736
- C:\Windows\System\iWHqxpC.exe
  C:\Windows\System\iWHqxpC.exe
  2⤵
  PID:1992
- C:\Windows\System\pdpDAJn.exe
  C:\Windows\System\pdpDAJn.exe
  2⤵
  PID:516
- C:\Windows\System\CcPkLro.exe
  C:\Windows\System\CcPkLro.exe
  2⤵
  PID:2104
- C:\Windows\System\rJQdrlm.exe
  C:\Windows\System\rJQdrlm.exe
  2⤵
  PID:6528
- C:\Windows\System\vIdpZvO.exe
  C:\Windows\System\vIdpZvO.exe
  2⤵
  PID:2480
- C:\Windows\System\VdVBgDT.exe
  C:\Windows\System\VdVBgDT.exe
  2⤵
  PID:4620
- C:\Windows\System\KAOUgFw.exe
  C:\Windows\System\KAOUgFw.exe
  2⤵
  PID:4972
- C:\Windows\System\ZkskPOj.exe
  C:\Windows\System\ZkskPOj.exe
  2⤵
  PID:4820
- C:\Windows\System\ICbICTx.exe
  C:\Windows\System\ICbICTx.exe
  2⤵
  PID:3572
- C:\Windows\System\oAEsbbT.exe
  C:\Windows\System\oAEsbbT.exe
  2⤵
  PID:5176
- C:\Windows\System\cfilNim.exe
  C:\Windows\System\cfilNim.exe
  2⤵
  PID:5228
- C:\Windows\System\CcRIozL.exe
  C:\Windows\System\CcRIozL.exe
  2⤵
  PID:5276
- C:\Windows\System\SWoXXKn.exe
  C:\Windows\System\SWoXXKn.exe
  2⤵
  PID:6480
- C:\Windows\System\fMzbnpo.exe
  C:\Windows\System\fMzbnpo.exe
  2⤵
  PID:6892
- C:\Windows\System\dpLfwNX.exe
  C:\Windows\System\dpLfwNX.exe
  2⤵
  PID:6624
- C:\Windows\System\iTdFixY.exe
  C:\Windows\System\iTdFixY.exe
  2⤵
  PID:6676
- C:\Windows\System\BdDfzmd.exe
  C:\Windows\System\BdDfzmd.exe
  2⤵
  PID:6720
- C:\Windows\System\pSOzGvt.exe
  C:\Windows\System\pSOzGvt.exe
  2⤵
  PID:4832
- C:\Windows\System\aMPXTQO.exe
  C:\Windows\System\aMPXTQO.exe
  2⤵
  PID:7176
- C:\Windows\System\cbMbQHH.exe
  C:\Windows\System\cbMbQHH.exe
  2⤵
  PID:7196
- C:\Windows\System\qUtOhCo.exe
  C:\Windows\System\qUtOhCo.exe
  2⤵
  PID:7212
- C:\Windows\System\DaggZto.exe
  C:\Windows\System\DaggZto.exe
  2⤵
  PID:7236
- C:\Windows\System\xwZYIgS.exe
  C:\Windows\System\xwZYIgS.exe
  2⤵
  PID:7256
- C:\Windows\System\dQEPyKp.exe
  C:\Windows\System\dQEPyKp.exe
  2⤵
  PID:7272
- C:\Windows\System\MIfBbPy.exe
  C:\Windows\System\MIfBbPy.exe
  2⤵
  PID:7288
- C:\Windows\System\QStdgaD.exe
  C:\Windows\System\QStdgaD.exe
  2⤵
  PID:7304
- C:\Windows\System\cJgtJzA.exe
  C:\Windows\System\cJgtJzA.exe
  2⤵
  PID:7324
- C:\Windows\System\zxDnLdK.exe
  C:\Windows\System\zxDnLdK.exe
  2⤵
  PID:7344
- C:\Windows\System\UXieIBN.exe
  C:\Windows\System\UXieIBN.exe
  2⤵
  PID:7360
- C:\Windows\System\DulawBH.exe
  C:\Windows\System\DulawBH.exe
  2⤵
  PID:7384
- C:\Windows\System\eAXJLus.exe
  C:\Windows\System\eAXJLus.exe
  2⤵
  PID:7408
- C:\Windows\System\ryJQzgX.exe
  C:\Windows\System\ryJQzgX.exe
  2⤵
  PID:7424
- C:\Windows\System\sZpBtoR.exe
  C:\Windows\System\sZpBtoR.exe
  2⤵
  PID:7444
- C:\Windows\System\SdbsDEj.exe
  C:\Windows\System\SdbsDEj.exe
  2⤵
  PID:7464
- C:\Windows\System\hDkMHKj.exe
  C:\Windows\System\hDkMHKj.exe
  2⤵
  PID:7484
- C:\Windows\System\LhOemKB.exe
  C:\Windows\System\LhOemKB.exe
  2⤵
  PID:7504
- C:\Windows\System\NFyriVd.exe
  C:\Windows\System\NFyriVd.exe
  2⤵
  PID:7524
- C:\Windows\System\lvjDrmT.exe
  C:\Windows\System\lvjDrmT.exe
  2⤵
  PID:7552
- C:\Windows\System\pYGcgio.exe
  C:\Windows\System\pYGcgio.exe
  2⤵
  PID:7576
- C:\Windows\System\lKGkOub.exe
  C:\Windows\System\lKGkOub.exe
  2⤵
  PID:7592
- C:\Windows\System\dBjVbuI.exe
  C:\Windows\System\dBjVbuI.exe
  2⤵
  PID:7608
- C:\Windows\System\woXStAl.exe
  C:\Windows\System\woXStAl.exe
  2⤵
  PID:7636
- C:\Windows\System\MilxdOW.exe
  C:\Windows\System\MilxdOW.exe
  2⤵
  PID:7652
- C:\Windows\System\bTZglJZ.exe
  C:\Windows\System\bTZglJZ.exe
  2⤵
  PID:7684
- C:\Windows\System\jMsAlGV.exe
  C:\Windows\System\jMsAlGV.exe
  2⤵
  PID:7708
- C:\Windows\System\MLVpmZr.exe
  C:\Windows\System\MLVpmZr.exe
  2⤵
  PID:7724
- C:\Windows\System\VYmFmoP.exe
  C:\Windows\System\VYmFmoP.exe
  2⤵
  PID:7748
- C:\Windows\System\RLUWHza.exe
  C:\Windows\System\RLUWHza.exe
  2⤵
  PID:7772
- C:\Windows\System\XhJlKkS.exe
  C:\Windows\System\XhJlKkS.exe
  2⤵
  PID:7788
- C:\Windows\System\xrYKAgx.exe
  C:\Windows\System\xrYKAgx.exe
  2⤵
  PID:7804
- C:\Windows\System\UlTFfKT.exe
  C:\Windows\System\UlTFfKT.exe
  2⤵
  PID:7832
- C:\Windows\System\cSxqaMs.exe
  C:\Windows\System\cSxqaMs.exe
  2⤵
  PID:7856
- C:\Windows\System\rBAwKRV.exe
  C:\Windows\System\rBAwKRV.exe
  2⤵
  PID:7924
- C:\Windows\System\ztGHFJL.exe
  C:\Windows\System\ztGHFJL.exe
  2⤵
  PID:7944
- C:\Windows\System\ThCscGW.exe
  C:\Windows\System\ThCscGW.exe
  2⤵
  PID:7964
- C:\Windows\System\bNnkdkr.exe
  C:\Windows\System\bNnkdkr.exe
  2⤵
  PID:7984
- C:\Windows\System\jLjoeBY.exe
  C:\Windows\System\jLjoeBY.exe
  2⤵
  PID:8000
- C:\Windows\System\lZHXNiZ.exe
  C:\Windows\System\lZHXNiZ.exe
  2⤵
  PID:8024
- C:\Windows\System\LwtehXq.exe
  C:\Windows\System\LwtehXq.exe
  2⤵
  PID:8044
- C:\Windows\System\PEseBNF.exe
  C:\Windows\System\PEseBNF.exe
  2⤵
  PID:8064
- C:\Windows\System\KOGXoqs.exe
  C:\Windows\System\KOGXoqs.exe
  2⤵
  PID:8084
- C:\Windows\System\emkBhCP.exe
  C:\Windows\System\emkBhCP.exe
  2⤵
  PID:8108
- C:\Windows\System\SvvZxtR.exe
  C:\Windows\System\SvvZxtR.exe
  2⤵
  PID:8128
- C:\Windows\System\MHsFInr.exe
  C:\Windows\System\MHsFInr.exe
  2⤵
  PID:8172
- C:\Windows\System\RvLbXhK.exe
  C:\Windows\System\RvLbXhK.exe
  2⤵
  PID:8188
- C:\Windows\System\eXYljOx.exe
  C:\Windows\System\eXYljOx.exe
  2⤵
  PID:5588
- C:\Windows\System\haCfyHV.exe
  C:\Windows\System\haCfyHV.exe
  2⤵
  PID:5652
- C:\Windows\System\eSTojUR.exe
  C:\Windows\System\eSTojUR.exe
  2⤵
  PID:5760
- C:\Windows\System\uXUjkKx.exe
  C:\Windows\System\uXUjkKx.exe
  2⤵
  PID:5820
- C:\Windows\System\AasuuCE.exe
  C:\Windows\System\AasuuCE.exe
  2⤵
  PID:6148
- C:\Windows\System\sRalTJr.exe
  C:\Windows\System\sRalTJr.exe
  2⤵
  PID:5500
- C:\Windows\System\hBgUxHf.exe
  C:\Windows\System\hBgUxHf.exe
  2⤵
  PID:4180
- C:\Windows\System\HWUPKuh.exe
  C:\Windows\System\HWUPKuh.exe
  2⤵
  PID:6960
- C:\Windows\System\qwgQwrQ.exe
  C:\Windows\System\qwgQwrQ.exe
  2⤵
  PID:7048
- C:\Windows\System\HBAdPqh.exe
  C:\Windows\System\HBAdPqh.exe
  2⤵
  PID:5540
- C:\Windows\System\IEpKlCK.exe
  C:\Windows\System\IEpKlCK.exe
  2⤵
  PID:7284
- C:\Windows\System\vJejAZB.exe
  C:\Windows\System\vJejAZB.exe
  2⤵
  PID:5804
- C:\Windows\System\TyNHoaO.exe
  C:\Windows\System\TyNHoaO.exe
  2⤵
  PID:7380
- C:\Windows\System\XnXGcLx.exe
  C:\Windows\System\XnXGcLx.exe
  2⤵
  PID:3412
- C:\Windows\System\WZKHtwl.exe
  C:\Windows\System\WZKHtwl.exe
  2⤵
  PID:5404
- C:\Windows\System\DwzwfIf.exe
  C:\Windows\System\DwzwfIf.exe
  2⤵
  PID:6044
- C:\Windows\System\hAYICRQ.exe
  C:\Windows\System\hAYICRQ.exe
  2⤵
  PID:6268
- C:\Windows\System\FNqtlIp.exe
  C:\Windows\System\FNqtlIp.exe
  2⤵
  PID:440
- C:\Windows\System\XxwAnVR.exe
  C:\Windows\System\XxwAnVR.exe
  2⤵
  PID:6560
- C:\Windows\System\wqfqZMh.exe
  C:\Windows\System\wqfqZMh.exe
  2⤵
  PID:2128
- C:\Windows\System\nrldfBR.exe
  C:\Windows\System\nrldfBR.exe
  2⤵
  PID:7820
- C:\Windows\System\SpwOsFy.exe
  C:\Windows\System\SpwOsFy.exe
  2⤵
  PID:5224
- C:\Windows\System\LwCzQSm.exe
  C:\Windows\System\LwCzQSm.exe
  2⤵
  PID:2932
- C:\Windows\System\YiQWqMO.exe
  C:\Windows\System\YiQWqMO.exe
  2⤵
  PID:7868
- C:\Windows\System\LKendFJ.exe
  C:\Windows\System\LKendFJ.exe
  2⤵
  PID:5936
- C:\Windows\System\jqxwtyh.exe
  C:\Windows\System\jqxwtyh.exe
  2⤵
  PID:7296
- C:\Windows\System\SYJEUJt.exe
  C:\Windows\System\SYJEUJt.exe
  2⤵
  PID:8056
- C:\Windows\System\BOspooO.exe
  C:\Windows\System\BOspooO.exe
  2⤵
  PID:7472
- C:\Windows\System\zobWDmp.exe
  C:\Windows\System\zobWDmp.exe
  2⤵
  PID:8184
- C:\Windows\System\KCISDgm.exe
  C:\Windows\System\KCISDgm.exe
  2⤵
  PID:8212
- C:\Windows\System\qHSVTqi.exe
  C:\Windows\System\qHSVTqi.exe
  2⤵
  PID:8232
- C:\Windows\System\gijVBaE.exe
  C:\Windows\System\gijVBaE.exe
  2⤵
  PID:8252
- C:\Windows\System\vyZDuhh.exe
  C:\Windows\System\vyZDuhh.exe
  2⤵
  PID:8272
- C:\Windows\System\GCFHNpW.exe
  C:\Windows\System\GCFHNpW.exe
  2⤵
  PID:8288
- C:\Windows\System\EsBCypA.exe
  C:\Windows\System\EsBCypA.exe
  2⤵
  PID:8304
- C:\Windows\System\BAdzKhu.exe
  C:\Windows\System\BAdzKhu.exe
  2⤵
  PID:8320
- C:\Windows\System\ZzLSqVx.exe
  C:\Windows\System\ZzLSqVx.exe
  2⤵
  PID:8348
- C:\Windows\System\bwZvrOM.exe
  C:\Windows\System\bwZvrOM.exe
  2⤵
  PID:8368
- C:\Windows\System\TRcYjaO.exe
  C:\Windows\System\TRcYjaO.exe
  2⤵
  PID:8384
- C:\Windows\System\YvYBHcI.exe
  C:\Windows\System\YvYBHcI.exe
  2⤵
  PID:8420
- C:\Windows\System\HFQFEGd.exe
  C:\Windows\System\HFQFEGd.exe
  2⤵
  PID:8436
- C:\Windows\System\vsbMMTj.exe
  C:\Windows\System\vsbMMTj.exe
  2⤵
  PID:8452
- C:\Windows\System\mgbOIeO.exe
  C:\Windows\System\mgbOIeO.exe
  2⤵
  PID:8468
- C:\Windows\System\qlIUMAX.exe
  C:\Windows\System\qlIUMAX.exe
  2⤵
  PID:8484
- C:\Windows\System\qOulOMV.exe
  C:\Windows\System\qOulOMV.exe
  2⤵
  PID:8504
- C:\Windows\System\UXbrYsT.exe
  C:\Windows\System\UXbrYsT.exe
  2⤵
  PID:8528
- C:\Windows\System\pJKifSM.exe
  C:\Windows\System\pJKifSM.exe
  2⤵
  PID:8548
- C:\Windows\System\fMWJAjk.exe
  C:\Windows\System\fMWJAjk.exe
  2⤵
  PID:8600
- C:\Windows\System\cAuhsSI.exe
  C:\Windows\System\cAuhsSI.exe
  2⤵
  PID:8616
- C:\Windows\System\pQAnAFm.exe
  C:\Windows\System\pQAnAFm.exe
  2⤵
  PID:8640
- C:\Windows\System\KYdgEOf.exe
  C:\Windows\System\KYdgEOf.exe
  2⤵
  PID:8660
- C:\Windows\System\hTOuCcw.exe
  C:\Windows\System\hTOuCcw.exe
  2⤵
  PID:8692
- C:\Windows\System\IizqYql.exe
  C:\Windows\System\IizqYql.exe
  2⤵
  PID:8708
- C:\Windows\System\XRkagPz.exe
  C:\Windows\System\XRkagPz.exe
  2⤵
  PID:8732
- C:\Windows\System\PawFebn.exe
  C:\Windows\System\PawFebn.exe
  2⤵
  PID:8764
- C:\Windows\System\SgEChKE.exe
  C:\Windows\System\SgEChKE.exe
  2⤵
  PID:8784
- C:\Windows\System\GNWVkvx.exe
  C:\Windows\System\GNWVkvx.exe
  2⤵
  PID:8808
- C:\Windows\System\eFnXtnk.exe
  C:\Windows\System\eFnXtnk.exe
  2⤵
  PID:8828
- C:\Windows\System\YlYygaq.exe
  C:\Windows\System\YlYygaq.exe
  2⤵
  PID:8844
- C:\Windows\System\RLTmDcY.exe
  C:\Windows\System\RLTmDcY.exe
  2⤵
  PID:8868
- C:\Windows\System\UOdMfGc.exe
  C:\Windows\System\UOdMfGc.exe
  2⤵
  PID:8884
- C:\Windows\System\DaCdbpR.exe
  C:\Windows\System\DaCdbpR.exe
  2⤵
  PID:8900
- C:\Windows\System\ckxDZGz.exe
  C:\Windows\System\ckxDZGz.exe
  2⤵
  PID:8920
- C:\Windows\System\yeSGRAo.exe
  C:\Windows\System\yeSGRAo.exe
  2⤵
  PID:8936
- C:\Windows\System\emCRbzH.exe
  C:\Windows\System\emCRbzH.exe
  2⤵
  PID:8960
- C:\Windows\System\obVSkAE.exe
  C:\Windows\System\obVSkAE.exe
  2⤵
  PID:8988
- C:\Windows\System\Wwelzzq.exe
  C:\Windows\System\Wwelzzq.exe
  2⤵
  PID:9012
- C:\Windows\System\KiEdACY.exe
  C:\Windows\System\KiEdACY.exe
  2⤵
  PID:9032
- C:\Windows\System\gWZTXqH.exe
  C:\Windows\System\gWZTXqH.exe
  2⤵
  PID:9052
- C:\Windows\System\BwRJelr.exe
  C:\Windows\System\BwRJelr.exe
  2⤵
  PID:9072
- C:\Windows\System\OOZsoyR.exe
  C:\Windows\System\OOZsoyR.exe
  2⤵
  PID:9096
- C:\Windows\System\UbEwmcO.exe
  C:\Windows\System\UbEwmcO.exe
  2⤵
  PID:9120
- C:\Windows\System\mGTuZaj.exe
  C:\Windows\System\mGTuZaj.exe
  2⤵
  PID:9144
- C:\Windows\System\DXaDXYj.exe
  C:\Windows\System\DXaDXYj.exe
  2⤵
  PID:9164
- C:\Windows\System\siZDiJS.exe
  C:\Windows\System\siZDiJS.exe
  2⤵
  PID:9184
- C:\Windows\System\csNHnSe.exe
  C:\Windows\System\csNHnSe.exe
  2⤵
  PID:9208
- C:\Windows\System\zYggXoY.exe
  C:\Windows\System\zYggXoY.exe
  2⤵
  PID:3680
- C:\Windows\System\IUebshH.exe
  C:\Windows\System\IUebshH.exe
  2⤵
  PID:6352
- C:\Windows\System\jzVuJoE.exe
  C:\Windows\System\jzVuJoE.exe
  2⤵
  PID:6576
- C:\Windows\System\XAGYbBL.exe
  C:\Windows\System\XAGYbBL.exe
  2⤵
  PID:6380
- C:\Windows\System\UYlgHTQ.exe
  C:\Windows\System\UYlgHTQ.exe
  2⤵
  PID:6272
- C:\Windows\System\AXZQtZc.exe
  C:\Windows\System\AXZQtZc.exe
  2⤵
  PID:6704
- C:\Windows\System\zOALyPl.exe
  C:\Windows\System\zOALyPl.exe
  2⤵
  PID:7172
- C:\Windows\System\fHeOTYx.exe
  C:\Windows\System\fHeOTYx.exe
  2⤵
  PID:7204
- C:\Windows\System\csqaDTo.exe
  C:\Windows\System\csqaDTo.exe
  2⤵
  PID:7232
- C:\Windows\System\CdOlsiH.exe
  C:\Windows\System\CdOlsiH.exe
  2⤵
  PID:7920
- C:\Windows\System\GTldhUx.exe
  C:\Windows\System\GTldhUx.exe
  2⤵
  PID:7972
- C:\Windows\System\yJpowFe.exe
  C:\Windows\System\yJpowFe.exe
  2⤵
  PID:8016
- C:\Windows\System\hLrFaAI.exe
  C:\Windows\System\hLrFaAI.exe
  2⤵
  PID:7848
- C:\Windows\System\aqnXWLB.exe
  C:\Windows\System\aqnXWLB.exe
  2⤵
  PID:7420
- C:\Windows\System\UCOYeIR.exe
  C:\Windows\System\UCOYeIR.exe
  2⤵
  PID:8076
- C:\Windows\System\qcHsJxa.exe
  C:\Windows\System\qcHsJxa.exe
  2⤵
  PID:8140
- C:\Windows\System\UuzpwxZ.exe
  C:\Windows\System\UuzpwxZ.exe
  2⤵
  PID:5632
- C:\Windows\System\oRJKnNZ.exe
  C:\Windows\System\oRJKnNZ.exe
  2⤵
  PID:8312
- C:\Windows\System\lsIBeiT.exe
  C:\Windows\System\lsIBeiT.exe
  2⤵
  PID:5724
- C:\Windows\System\mqojFrg.exe
  C:\Windows\System\mqojFrg.exe
  2⤵
  PID:7560
- C:\Windows\System\BkLhxqs.exe
  C:\Windows\System\BkLhxqs.exe
  2⤵
  PID:6784
- C:\Windows\System\fxTWyZS.exe
  C:\Windows\System\fxTWyZS.exe
  2⤵
  PID:7584
- C:\Windows\System\HpoNujF.exe
  C:\Windows\System\HpoNujF.exe
  2⤵
  PID:7620
- C:\Windows\System\hOVwvyC.exe
  C:\Windows\System\hOVwvyC.exe
  2⤵
  PID:9220
- C:\Windows\System\kXgBsOL.exe
  C:\Windows\System\kXgBsOL.exe
  2⤵
  PID:9244
- C:\Windows\System\HdYkruE.exe
  C:\Windows\System\HdYkruE.exe
  2⤵
  PID:9264
- C:\Windows\System\FgPgyQo.exe
  C:\Windows\System\FgPgyQo.exe
  2⤵
  PID:9292
- C:\Windows\System\oXDYzCe.exe
  C:\Windows\System\oXDYzCe.exe
  2⤵
  PID:9316
- C:\Windows\System\oYgDjnC.exe
  C:\Windows\System\oYgDjnC.exe
  2⤵
  PID:9336
- C:\Windows\System\MyqIhRn.exe
  C:\Windows\System\MyqIhRn.exe
  2⤵
  PID:9368
- C:\Windows\System\fyjujLk.exe
  C:\Windows\System\fyjujLk.exe
  2⤵
  PID:9388
- C:\Windows\System\NumsqkP.exe
  C:\Windows\System\NumsqkP.exe
  2⤵
  PID:9404
- C:\Windows\System\dGYCUxf.exe
  C:\Windows\System\dGYCUxf.exe
  2⤵
  PID:9420
- C:\Windows\System\ycLHOfp.exe
  C:\Windows\System\ycLHOfp.exe
  2⤵
  PID:9440
- C:\Windows\System\qDKzxMa.exe
  C:\Windows\System\qDKzxMa.exe
  2⤵
  PID:9476
- C:\Windows\System\UlrwGSy.exe
  C:\Windows\System\UlrwGSy.exe
  2⤵
  PID:9500
- C:\Windows\System\JDKWdXt.exe
  C:\Windows\System\JDKWdXt.exe
  2⤵
  PID:9520
- C:\Windows\System\qwmOnVr.exe
  C:\Windows\System\qwmOnVr.exe
  2⤵
  PID:9540
- C:\Windows\System\mvRpnrP.exe
  C:\Windows\System\mvRpnrP.exe
  2⤵
  PID:9564
- C:\Windows\System\wYSlVpO.exe
  C:\Windows\System\wYSlVpO.exe
  2⤵
  PID:9584
- C:\Windows\System\ALuuZxu.exe
  C:\Windows\System\ALuuZxu.exe
  2⤵
  PID:9608
- C:\Windows\System\eDCXwAM.exe
  C:\Windows\System\eDCXwAM.exe
  2⤵
  PID:9628
- C:\Windows\System\cHqfpYO.exe
  C:\Windows\System\cHqfpYO.exe
  2⤵
  PID:9644
- C:\Windows\System\PSoGMzV.exe
  C:\Windows\System\PSoGMzV.exe
  2⤵
  PID:9664
- C:\Windows\System\FUMWPgr.exe
  C:\Windows\System\FUMWPgr.exe
  2⤵
  PID:9688
- C:\Windows\System\dlJcYlC.exe
  C:\Windows\System\dlJcYlC.exe
  2⤵
  PID:9708
- C:\Windows\System\PHiJsKV.exe
  C:\Windows\System\PHiJsKV.exe
  2⤵
  PID:9732
- C:\Windows\System\wvtunwn.exe
  C:\Windows\System\wvtunwn.exe
  2⤵
  PID:9752
- C:\Windows\System\uNzorTU.exe
  C:\Windows\System\uNzorTU.exe
  2⤵
  PID:9768
- C:\Windows\System\OLAEJor.exe
  C:\Windows\System\OLAEJor.exe
  2⤵
  PID:9792
- C:\Windows\System\LQUeVeK.exe
  C:\Windows\System\LQUeVeK.exe
  2⤵
  PID:9808
- C:\Windows\System\pKVMLbe.exe
  C:\Windows\System\pKVMLbe.exe
  2⤵
  PID:9828
- C:\Windows\System\QzvgqvX.exe
  C:\Windows\System\QzvgqvX.exe
  2⤵
  PID:9848
- C:\Windows\System\rEBGnTr.exe
  C:\Windows\System\rEBGnTr.exe
  2⤵
  PID:9876
- C:\Windows\System\wXAFHWL.exe
  C:\Windows\System\wXAFHWL.exe
  2⤵
  PID:9896
- C:\Windows\System\Owtojgp.exe
  C:\Windows\System\Owtojgp.exe
  2⤵
  PID:9916
- C:\Windows\System\rBaNeoC.exe
  C:\Windows\System\rBaNeoC.exe
  2⤵
  PID:9936
- C:\Windows\System\QUfoVFw.exe
  C:\Windows\System\QUfoVFw.exe
  2⤵
  PID:9960
- C:\Windows\System\uTbVSDD.exe
  C:\Windows\System\uTbVSDD.exe
  2⤵
  PID:9980
- C:\Windows\System\AmXEqad.exe
  C:\Windows\System\AmXEqad.exe
  2⤵
  PID:10004
- C:\Windows\System\ouAsKtz.exe
  C:\Windows\System\ouAsKtz.exe
  2⤵
  PID:10024
- C:\Windows\System\kgWQdzN.exe
  C:\Windows\System\kgWQdzN.exe
  2⤵
  PID:10044
- C:\Windows\System\rJHzTcC.exe
  C:\Windows\System\rJHzTcC.exe
  2⤵
  PID:10068
- C:\Windows\System\tqCoMhy.exe
  C:\Windows\System\tqCoMhy.exe
  2⤵
  PID:10100
- C:\Windows\System\QBxRUUN.exe
  C:\Windows\System\QBxRUUN.exe
  2⤵
  PID:10120
- C:\Windows\System\iGIbYOb.exe
  C:\Windows\System\iGIbYOb.exe
  2⤵
  PID:10148
- C:\Windows\System\rpFtAOf.exe
  C:\Windows\System\rpFtAOf.exe
  2⤵
  PID:10168
- C:\Windows\System\CFRukKQ.exe
  C:\Windows\System\CFRukKQ.exe
  2⤵
  PID:10196
- C:\Windows\System\sJRjjcR.exe
  C:\Windows\System\sJRjjcR.exe
  2⤵
  PID:10212
- C:\Windows\System\DHWvjdp.exe
  C:\Windows\System\DHWvjdp.exe
  2⤵
  PID:10236
- C:\Windows\System\GnXRdcp.exe
  C:\Windows\System\GnXRdcp.exe
  2⤵
  PID:7660
- C:\Windows\System\WVGbLyd.exe
  C:\Windows\System\WVGbLyd.exe
  2⤵
  PID:8564
- C:\Windows\System\xlBMieX.exe
  C:\Windows\System\xlBMieX.exe
  2⤵
  PID:7744
- C:\Windows\System\XRbsReu.exe
  C:\Windows\System\XRbsReu.exe
  2⤵
  PID:7764
- C:\Windows\System\EeZnHXs.exe
  C:\Windows\System\EeZnHXs.exe
  2⤵
  PID:8656
- C:\Windows\System\myBqjdg.exe
  C:\Windows\System\myBqjdg.exe
  2⤵
  PID:8716
- C:\Windows\System\hCeUrLM.exe
  C:\Windows\System\hCeUrLM.exe
  2⤵
  PID:2696
- C:\Windows\System\JiSDSuQ.exe
  C:\Windows\System\JiSDSuQ.exe
  2⤵
  PID:3660
- C:\Windows\System\ccmmbuW.exe
  C:\Windows\System\ccmmbuW.exe
  2⤵
  PID:7904
- C:\Windows\System\PbsEFYN.exe
  C:\Windows\System\PbsEFYN.exe
  2⤵
  PID:7980
- C:\Windows\System\kjzmYdx.exe
  C:\Windows\System\kjzmYdx.exe
  2⤵
  PID:2788
- C:\Windows\System\gnJIvix.exe
  C:\Windows\System\gnJIvix.exe
  2⤵
  PID:8968
- C:\Windows\System\NdvTujc.exe
  C:\Windows\System\NdvTujc.exe
  2⤵
  PID:8976
- C:\Windows\System\KbVkGQa.exe
  C:\Windows\System\KbVkGQa.exe
  2⤵
  PID:9008
- C:\Windows\System\icQtJKt.exe
  C:\Windows\System\icQtJKt.exe
  2⤵
  PID:9044
- C:\Windows\System\MYWDQCo.exe
  C:\Windows\System\MYWDQCo.exe
  2⤵
  PID:9092
- C:\Windows\System\BzJySen.exe
  C:\Windows\System\BzJySen.exe
  2⤵
  PID:5952
- C:\Windows\System\pkaxDNd.exe
  C:\Windows\System\pkaxDNd.exe
  2⤵
  PID:4352
- C:\Windows\System\UGOuwVX.exe
  C:\Windows\System\UGOuwVX.exe
  2⤵
  PID:6696
- C:\Windows\System\hkOsiZi.exe
  C:\Windows\System\hkOsiZi.exe
  2⤵
  PID:7192
- C:\Windows\System\ULUhGoC.exe
  C:\Windows\System\ULUhGoC.exe
  2⤵
  PID:10252
- C:\Windows\System\zxuJrLN.exe
  C:\Windows\System\zxuJrLN.exe
  2⤵
  PID:10268
- C:\Windows\System\rsUQKkE.exe
  C:\Windows\System\rsUQKkE.exe
  2⤵
  PID:10288
- C:\Windows\System\wvLkcSJ.exe
  C:\Windows\System\wvLkcSJ.exe
  2⤵
  PID:10312
- C:\Windows\System\XPDlPnc.exe
  C:\Windows\System\XPDlPnc.exe
  2⤵
  PID:10336
- C:\Windows\System\ECBFSRH.exe
  C:\Windows\System\ECBFSRH.exe
  2⤵
  PID:10356
- C:\Windows\System\fpbYTsn.exe
  C:\Windows\System\fpbYTsn.exe
  2⤵
  PID:10384
- C:\Windows\System\mrnKQCX.exe
  C:\Windows\System\mrnKQCX.exe
  2⤵
  PID:10400
- C:\Windows\System\qwaogOC.exe
  C:\Windows\System\qwaogOC.exe
  2⤵
  PID:10428
- C:\Windows\System\YMvCAJp.exe
  C:\Windows\System\YMvCAJp.exe
  2⤵
  PID:10444
- C:\Windows\System\wbNalIq.exe
  C:\Windows\System\wbNalIq.exe
  2⤵
  PID:10468
- C:\Windows\System\TWNeMsU.exe
  C:\Windows\System\TWNeMsU.exe
  2⤵
  PID:10492
- C:\Windows\System\IEHYPRI.exe
  C:\Windows\System\IEHYPRI.exe
  2⤵
  PID:10508
- C:\Windows\System\rhypTTP.exe
  C:\Windows\System\rhypTTP.exe
  2⤵
  PID:10528
- C:\Windows\System\ZHJWFhW.exe
  C:\Windows\System\ZHJWFhW.exe
  2⤵
  PID:10548
- C:\Windows\System\CTqLpIX.exe
  C:\Windows\System\CTqLpIX.exe
  2⤵
  PID:10584
- C:\Windows\System\kYwtHOQ.exe
  C:\Windows\System\kYwtHOQ.exe
  2⤵
  PID:10636
- C:\Windows\System\imYtvEH.exe
  C:\Windows\System\imYtvEH.exe
  2⤵
  PID:10680
- C:\Windows\System\CftlPJJ.exe
  C:\Windows\System\CftlPJJ.exe
  2⤵
  PID:10704
- C:\Windows\System\otZLMVr.exe
  C:\Windows\System\otZLMVr.exe
  2⤵
  PID:10720
- C:\Windows\System\kKALjnY.exe
  C:\Windows\System\kKALjnY.exe
  2⤵
  PID:10740
- C:\Windows\System\jzwWiya.exe
  C:\Windows\System\jzwWiya.exe
  2⤵
  PID:10764
- C:\Windows\System\lknZqKY.exe
  C:\Windows\System\lknZqKY.exe
  2⤵
  PID:10804
- C:\Windows\System\LhSSnLK.exe
  C:\Windows\System\LhSSnLK.exe
  2⤵
  PID:10828
- C:\Windows\System\yFriGEk.exe
  C:\Windows\System\yFriGEk.exe
  2⤵
  PID:10848
- C:\Windows\System\OETExhq.exe
  C:\Windows\System\OETExhq.exe
  2⤵
  PID:10868
- C:\Windows\System\ceoiOHQ.exe
  C:\Windows\System\ceoiOHQ.exe
  2⤵
  PID:10892
- C:\Windows\System\uxPvxHw.exe
  C:\Windows\System\uxPvxHw.exe
  2⤵
  PID:10912
- C:\Windows\System\VAOovIJ.exe
  C:\Windows\System\VAOovIJ.exe
  2⤵
  PID:10928
- C:\Windows\System\SaSgTsu.exe
  C:\Windows\System\SaSgTsu.exe
  2⤵
  PID:10956
- C:\Windows\System\vxdrfko.exe
  C:\Windows\System\vxdrfko.exe
  2⤵
  PID:10984
- C:\Windows\System\yuQhFwy.exe
  C:\Windows\System\yuQhFwy.exe
  2⤵
  PID:11004
- C:\Windows\System\LcKOaak.exe
  C:\Windows\System\LcKOaak.exe
  2⤵
  PID:11020
- C:\Windows\System\OWpiqnE.exe
  C:\Windows\System\OWpiqnE.exe
  2⤵
  PID:11052
- C:\Windows\System\tLVXXvo.exe
  C:\Windows\System\tLVXXvo.exe
  2⤵
  PID:11076
- C:\Windows\System\gFDfBQR.exe
  C:\Windows\System\gFDfBQR.exe
  2⤵
  PID:11096
- C:\Windows\System\jqARdaI.exe
  C:\Windows\System\jqARdaI.exe
  2⤵
  PID:11120
- C:\Windows\System\WZLRPpp.exe
  C:\Windows\System\WZLRPpp.exe
  2⤵
  PID:11140
- C:\Windows\System\gWGvPax.exe
  C:\Windows\System\gWGvPax.exe
  2⤵
  PID:11164
- C:\Windows\System\fRVVpPE.exe
  C:\Windows\System\fRVVpPE.exe
  2⤵
  PID:11188
- C:\Windows\System\DWhRNJp.exe
  C:\Windows\System\DWhRNJp.exe
  2⤵
  PID:11232
- C:\Windows\System\LVGrEKG.exe
  C:\Windows\System\LVGrEKG.exe
  2⤵
  PID:11248
- C:\Windows\System\GoUAMwc.exe
  C:\Windows\System\GoUAMwc.exe
  2⤵
  PID:8096
- C:\Windows\System\eUELbKC.exe
  C:\Windows\System\eUELbKC.exe
  2⤵
  PID:7516
- C:\Windows\System\LjFdghb.exe
  C:\Windows\System\LjFdghb.exe
  2⤵
  PID:8268
- C:\Windows\System\ZRXpVBH.exe
  C:\Windows\System\ZRXpVBH.exe
  2⤵
  PID:9304
- C:\Windows\System\VxZzOvV.exe
  C:\Windows\System\VxZzOvV.exe
  2⤵
  PID:5580
- C:\Windows\System\PUTFtGF.exe
  C:\Windows\System\PUTFtGF.exe
  2⤵
  PID:7332
- C:\Windows\System\TwvtEAd.exe
  C:\Windows\System\TwvtEAd.exe
  2⤵
  PID:9516
- C:\Windows\System\gFYyTmv.exe
  C:\Windows\System\gFYyTmv.exe
  2⤵
  PID:7480
- C:\Windows\System\jHRrRuV.exe
  C:\Windows\System\jHRrRuV.exe
  2⤵
  PID:9816
- C:\Windows\System\JWGQTPO.exe
  C:\Windows\System\JWGQTPO.exe
  2⤵
  PID:8932
- C:\Windows\System\CZxDwIc.exe
  C:\Windows\System\CZxDwIc.exe
  2⤵
  PID:9948
- C:\Windows\System\gRidSxv.exe
  C:\Windows\System\gRidSxv.exe
  2⤵
  PID:10088
- C:\Windows\System\JEtzJrM.exe
  C:\Windows\System\JEtzJrM.exe
  2⤵
  PID:10136
- C:\Windows\System\mxHuTLW.exe
  C:\Windows\System\mxHuTLW.exe
  2⤵
  PID:10184
- C:\Windows\System\URLhJKQ.exe
  C:\Windows\System\URLhJKQ.exe
  2⤵
  PID:7672
- C:\Windows\System\oecUego.exe
  C:\Windows\System\oecUego.exe
  2⤵
  PID:9196
- C:\Windows\System\laksBVi.exe
  C:\Windows\System\laksBVi.exe
  2⤵
  PID:8648
- C:\Windows\System\BnGYNmV.exe
  C:\Windows\System\BnGYNmV.exe
  2⤵
  PID:11280
- C:\Windows\System\cvGOOTu.exe
  C:\Windows\System\cvGOOTu.exe
  2⤵
  PID:11300
- C:\Windows\System\piFnwhL.exe
  C:\Windows\System\piFnwhL.exe
  2⤵
  PID:11320
- C:\Windows\System\ANmKipS.exe
  C:\Windows\System\ANmKipS.exe
  2⤵
  PID:11340
- C:\Windows\System\pBjDWQY.exe
  C:\Windows\System\pBjDWQY.exe
  2⤵
  PID:11364
- C:\Windows\System\rNVrVVS.exe
  C:\Windows\System\rNVrVVS.exe
  2⤵
  PID:11380
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11380 -s 180
    3⤵
    PID:11260
- C:\Windows\System\MkYkrwi.exe
  C:\Windows\System\MkYkrwi.exe
  2⤵
  PID:11408
- C:\Windows\System\lOOLdAg.exe
  C:\Windows\System\lOOLdAg.exe
  2⤵
  PID:11428
- C:\Windows\System\ETUpNjX.exe
  C:\Windows\System\ETUpNjX.exe
  2⤵
  PID:11448
- C:\Windows\System\QgGXKfw.exe
  C:\Windows\System\QgGXKfw.exe
  2⤵
  PID:11472
- C:\Windows\System\zmQrpsK.exe
  C:\Windows\System\zmQrpsK.exe
  2⤵
  PID:11488
- C:\Windows\System\mMrGucz.exe
  C:\Windows\System\mMrGucz.exe
  2⤵
  PID:11512
- C:\Windows\System\ffhQKBX.exe
  C:\Windows\System\ffhQKBX.exe
  2⤵
  PID:11536
- C:\Windows\System\rZTaTbe.exe
  C:\Windows\System\rZTaTbe.exe
  2⤵
  PID:11560
- C:\Windows\System\iwiaTva.exe
  C:\Windows\System\iwiaTva.exe
  2⤵
  PID:11576
- C:\Windows\System\KholilZ.exe
  C:\Windows\System\KholilZ.exe
  2⤵
  PID:11604
- C:\Windows\System\UxSyrTc.exe
  C:\Windows\System\UxSyrTc.exe
  2⤵
  PID:11628
- C:\Windows\System\MShSKhP.exe
  C:\Windows\System\MShSKhP.exe
  2⤵
  PID:11656
- C:\Windows\System\KWIFOPT.exe
  C:\Windows\System\KWIFOPT.exe
  2⤵
  PID:11676
- C:\Windows\System\yHyTSKW.exe
  C:\Windows\System\yHyTSKW.exe
  2⤵
  PID:11696
- C:\Windows\System\hYyBlgz.exe
  C:\Windows\System\hYyBlgz.exe
  2⤵
  PID:11728
- C:\Windows\System\NwgcqeV.exe
  C:\Windows\System\NwgcqeV.exe
  2⤵
  PID:11752
- C:\Windows\System\boTiecP.exe
  C:\Windows\System\boTiecP.exe
  2⤵
  PID:11768
- C:\Windows\System\hVqqyJF.exe
  C:\Windows\System\hVqqyJF.exe
  2⤵
  PID:11792
- C:\Windows\System\bJGyPaW.exe
  C:\Windows\System\bJGyPaW.exe
  2⤵
  PID:11808
- C:\Windows\System\bcVbbfh.exe
  C:\Windows\System\bcVbbfh.exe
  2⤵
  PID:11824
- C:\Windows\System\uHoLiNr.exe
  C:\Windows\System\uHoLiNr.exe
  2⤵
  PID:11844
- C:\Windows\System\DDHKzfW.exe
  C:\Windows\System\DDHKzfW.exe
  2⤵
  PID:11864
- C:\Windows\System\exufSKu.exe
  C:\Windows\System\exufSKu.exe
  2⤵
  PID:11884
- C:\Windows\System\aFQKesG.exe
  C:\Windows\System\aFQKesG.exe
  2⤵
  PID:11916
- C:\Windows\System\FAsHgAT.exe
  C:\Windows\System\FAsHgAT.exe
  2⤵
  PID:11932
- C:\Windows\System\eunyNqe.exe
  C:\Windows\System\eunyNqe.exe
  2⤵
  PID:11948
- C:\Windows\System\dZSYICF.exe
  C:\Windows\System\dZSYICF.exe
  2⤵
  PID:11972
- C:\Windows\System\DLqlbtJ.exe
  C:\Windows\System\DLqlbtJ.exe
  2⤵
  PID:11988
- C:\Windows\System\aTWwGdS.exe
  C:\Windows\System\aTWwGdS.exe
  2⤵
  PID:12008
- C:\Windows\System\TURnONt.exe
  C:\Windows\System\TURnONt.exe
  2⤵
  PID:12036
- C:\Windows\System\NaJlgSx.exe
  C:\Windows\System\NaJlgSx.exe
  2⤵
  PID:12056
- C:\Windows\System\oYGUoqE.exe
  C:\Windows\System\oYGUoqE.exe
  2⤵
  PID:12080
- C:\Windows\System\dUDLSsB.exe
  C:\Windows\System\dUDLSsB.exe
  2⤵
  PID:12108
- C:\Windows\System\rytqlha.exe
  C:\Windows\System\rytqlha.exe
  2⤵
  PID:12128
- C:\Windows\System\oNJyTPA.exe
  C:\Windows\System\oNJyTPA.exe
  2⤵
  PID:12156
- C:\Windows\System\ilVGSAn.exe
  C:\Windows\System\ilVGSAn.exe
  2⤵
  PID:12176
- C:\Windows\System\wCpPEnE.exe
  C:\Windows\System\wCpPEnE.exe
  2⤵
  PID:12196
- C:\Windows\System\ljpNstF.exe
  C:\Windows\System\ljpNstF.exe
  2⤵
  PID:12224
- C:\Windows\System\qGVqpna.exe
  C:\Windows\System\qGVqpna.exe
  2⤵
  PID:12256
- C:\Windows\System\MfAVkmj.exe
  C:\Windows\System\MfAVkmj.exe
  2⤵
  PID:12272
- C:\Windows\System\eejrMXp.exe
  C:\Windows\System\eejrMXp.exe
  2⤵
  PID:8032
- C:\Windows\System\zVyoshz.exe
  C:\Windows\System\zVyoshz.exe
  2⤵
  PID:8740
- C:\Windows\System\FgDHZUF.exe
  C:\Windows\System\FgDHZUF.exe
  2⤵
  PID:8824
- C:\Windows\System\eEKAQGy.exe
  C:\Windows\System\eEKAQGy.exe
  2⤵
  PID:8392
- C:\Windows\System\IahvRdR.exe
  C:\Windows\System\IahvRdR.exe
  2⤵
  PID:5152
- C:\Windows\System\eVCiRCd.exe
  C:\Windows\System\eVCiRCd.exe
  2⤵
  PID:10244
- C:\Windows\System\BYjUSSa.exe
  C:\Windows\System\BYjUSSa.exe
  2⤵
  PID:10264
- C:\Windows\System\iGthCzS.exe
  C:\Windows\System\iGthCzS.exe
  2⤵
  PID:10300
- C:\Windows\System\cqLxKFn.exe
  C:\Windows\System\cqLxKFn.exe
  2⤵
  PID:8464
- C:\Windows\System\vpHoqsA.exe
  C:\Windows\System\vpHoqsA.exe
  2⤵
  PID:8284
- C:\Windows\System\wBUljJP.exe
  C:\Windows\System\wBUljJP.exe
  2⤵
  PID:4388
- C:\Windows\System\CDrnWOD.exe
  C:\Windows\System\CDrnWOD.exe
  2⤵
  PID:7572
- C:\Windows\System\FCwmWHM.exe
  C:\Windows\System\FCwmWHM.exe
  2⤵
  PID:7604
- C:\Windows\System\lVgIxjy.exe
  C:\Windows\System\lVgIxjy.exe
  2⤵
  PID:10376
- C:\Windows\System\GeZlPbh.exe
  C:\Windows\System\GeZlPbh.exe
  2⤵
  PID:8536
- C:\Windows\System\UkFnNKX.exe
  C:\Windows\System\UkFnNKX.exe
  2⤵
  PID:9332
- C:\Windows\System\VOWOPAf.exe
  C:\Windows\System\VOWOPAf.exe
  2⤵
  PID:9352
- C:\Windows\System\uJmlQFt.exe
  C:\Windows\System\uJmlQFt.exe
  2⤵
  PID:12304
- C:\Windows\System\qNLJcbR.exe
  C:\Windows\System\qNLJcbR.exe
  2⤵
  PID:12320
- C:\Windows\System\aAqVrlq.exe
  C:\Windows\System\aAqVrlq.exe
  2⤵
  PID:12336
- C:\Windows\System\xvpaUjB.exe
  C:\Windows\System\xvpaUjB.exe
  2⤵
  PID:12352
- C:\Windows\System\IUOYOjJ.exe
  C:\Windows\System\IUOYOjJ.exe
  2⤵
  PID:12372
- C:\Windows\System\IYHAtXc.exe
  C:\Windows\System\IYHAtXc.exe
  2⤵
  PID:12420
- C:\Windows\System\ujomjgy.exe
  C:\Windows\System\ujomjgy.exe
  2⤵
  PID:12444
- C:\Windows\System\nVZvTBj.exe
  C:\Windows\System\nVZvTBj.exe
  2⤵
  PID:12460
- C:\Windows\System\seMcFoA.exe
  C:\Windows\System\seMcFoA.exe
  2⤵
  PID:12480
- C:\Windows\System\IEzKUXE.exe
  C:\Windows\System\IEzKUXE.exe
  2⤵
  PID:12504
- C:\Windows\System\oYgDyDS.exe
  C:\Windows\System\oYgDyDS.exe
  2⤵
  PID:12520
- C:\Windows\System\zFKdZwM.exe
  C:\Windows\System\zFKdZwM.exe
  2⤵
  PID:12540
- C:\Windows\System\VKUdiGm.exe
  C:\Windows\System\VKUdiGm.exe
  2⤵
  PID:12556
- C:\Windows\System\DNrcZXb.exe
  C:\Windows\System\DNrcZXb.exe
  2⤵
  PID:12580
- C:\Windows\System\zmihHcs.exe
  C:\Windows\System\zmihHcs.exe
  2⤵
  PID:12600
- C:\Windows\System\aaUNllI.exe
  C:\Windows\System\aaUNllI.exe
  2⤵
  PID:12620
- C:\Windows\System\pZaGLBp.exe
  C:\Windows\System\pZaGLBp.exe
  2⤵
  PID:12644
- C:\Windows\System\prMypJc.exe
  C:\Windows\System\prMypJc.exe
  2⤵
  PID:12668
- C:\Windows\System\GCGCNOe.exe
  C:\Windows\System\GCGCNOe.exe
  2⤵
  PID:12684
- C:\Windows\System\pifdHki.exe
  C:\Windows\System\pifdHki.exe
  2⤵
  PID:10668
- C:\Windows\System\PzrZyCI.exe
  C:\Windows\System\PzrZyCI.exe
  2⤵
  PID:8624
- C:\Windows\System\SrxCmTE.exe
  C:\Windows\System\SrxCmTE.exe
  2⤵
  PID:10856
- C:\Windows\System\qoFUofJ.exe
  C:\Windows\System\qoFUofJ.exe
  2⤵
  PID:4000
- C:\Windows\System\jfpCVvH.exe
  C:\Windows\System\jfpCVvH.exe
  2⤵
  PID:7316
- C:\Windows\System\CwVzCdq.exe
  C:\Windows\System\CwVzCdq.exe
  2⤵
  PID:4828
- C:\Windows\System\zQEVItt.exe
  C:\Windows\System\zQEVItt.exe
  2⤵
  PID:11544
- C:\Windows\System\EXUeSeL.exe
  C:\Windows\System\EXUeSeL.exe
  2⤵
  PID:9252
- C:\Windows\System\BaaZZCY.exe
  C:\Windows\System\BaaZZCY.exe
  2⤵
  PID:12204
- C:\Windows\System\ilMYdZk.exe
  C:\Windows\System\ilMYdZk.exe
  2⤵
  PID:9288
- C:\Windows\System\XqKKoIH.exe
  C:\Windows\System\XqKKoIH.exe
  2⤵
  PID:3996
- C:\Windows\System\BASbbNa.exe
  C:\Windows\System\BASbbNa.exe
  2⤵
  PID:9348
- C:\Windows\System\bNwZqBR.exe
  C:\Windows\System\bNwZqBR.exe
  2⤵
  PID:10688
- C:\Windows\System\LTIwovc.exe
  C:\Windows\System\LTIwovc.exe
  2⤵
  PID:2340
- C:\Windows\System\SdICDQH.exe
  C:\Windows\System\SdICDQH.exe
  2⤵
  PID:10416
- C:\Windows\System\xItZJSH.exe
  C:\Windows\System\xItZJSH.exe
  2⤵
  PID:11312
- C:\Windows\System\gNsjPkL.exe
  C:\Windows\System\gNsjPkL.exe
  2⤵
  PID:11904
- C:\Windows\System\eygGBYz.exe
  C:\Windows\System\eygGBYz.exe
  2⤵
  PID:12316
- C:\Windows\System\DqaRbNL.exe
  C:\Windows\System\DqaRbNL.exe
  2⤵
  PID:12664
- C:\Windows\System\feKXTqN.exe
  C:\Windows\System\feKXTqN.exe
  2⤵
  PID:12700
- C:\Windows\System\VHjLBwP.exe
  C:\Windows\System\VHjLBwP.exe
  2⤵
  PID:2136
- C:\Windows\System\lBTBQuP.exe
  C:\Windows\System\lBTBQuP.exe
  2⤵
  PID:12864
- C:\Windows\System\aLWDwbN.exe
  C:\Windows\System\aLWDwbN.exe
  2⤵
  PID:10280
- C:\Windows\System\mPxUlJj.exe
  C:\Windows\System\mPxUlJj.exe
  2⤵
  PID:7148
- C:\Windows\System\WUDDjti.exe
  C:\Windows\System\WUDDjti.exe
  2⤵
  PID:1972
- C:\Windows\System\LtNNYEP.exe
  C:\Windows\System\LtNNYEP.exe
  2⤵
  PID:11784
- C:\Windows\System\fSwMcwh.exe
  C:\Windows\System\fSwMcwh.exe
  2⤵
  PID:9892
- C:\Windows\System\zozpWpO.exe
  C:\Windows\System\zozpWpO.exe
  2⤵
  PID:11944
- C:\Windows\System\uMllLLT.exe
  C:\Windows\System\uMllLLT.exe
  2⤵
  PID:9156
- C:\Windows\System\pESKvdV.exe
  C:\Windows\System\pESKvdV.exe
  2⤵
  PID:10224
- C:\Windows\System\ufaZSZO.exe
  C:\Windows\System\ufaZSZO.exe
  2⤵
  PID:12496
- C:\Windows\System\kLPIVfp.exe
  C:\Windows\System\kLPIVfp.exe
  2⤵
  PID:4540
- C:\Windows\System\gbwCwWq.exe
  C:\Windows\System\gbwCwWq.exe
  2⤵
  PID:10456
- C:\Windows\System\mdJxJKh.exe
  C:\Windows\System\mdJxJKh.exe
  2⤵
  PID:6524
- C:\Windows\System\MKKfRoj.exe
  C:\Windows\System\MKKfRoj.exe
  2⤵
  PID:10440
- C:\Windows\System\qreNmkE.exe
  C:\Windows\System\qreNmkE.exe
  2⤵
  PID:11720
- C:\Windows\System\SBLaQtp.exe
  C:\Windows\System\SBLaQtp.exe
  2⤵
  PID:11820
- C:\Windows\System\lSluJFB.exe
  C:\Windows\System\lSluJFB.exe
  2⤵
  PID:10664
- C:\Windows\System\lZzGWNT.exe
  C:\Windows\System\lZzGWNT.exe
  2⤵
  PID:1612
- C:\Windows\System\DhRcrsD.exe
  C:\Windows\System\DhRcrsD.exe
  2⤵
  PID:12104
- C:\Windows\System\fStRAQO.exe
  C:\Windows\System\fStRAQO.exe
  2⤵
  PID:9528
- C:\Windows\System\wdPVhFG.exe
  C:\Windows\System\wdPVhFG.exe
  2⤵
  PID:12000
- C:\Windows\System\kGWWsFE.exe
  C:\Windows\System\kGWWsFE.exe
  2⤵
  PID:11288
- C:\Windows\System\FgnAGwA.exe
  C:\Windows\System\FgnAGwA.exe
  2⤵
  PID:9716
- C:\Windows\System\OUSPpDg.exe
  C:\Windows\System\OUSPpDg.exe
  2⤵
  PID:11444
- C:\Windows\System\BlEZaAv.exe
  C:\Windows\System\BlEZaAv.exe
  2⤵
  PID:9824
- C:\Windows\System\wesYplk.exe
  C:\Windows\System\wesYplk.exe
  2⤵
  PID:10084
- C:\Windows\System\oAPkLkd.exe
  C:\Windows\System\oAPkLkd.exe
  2⤵
  PID:11688
- C:\Windows\System\McGdTlH.exe
  C:\Windows\System\McGdTlH.exe
  2⤵
  PID:2904
- C:\Windows\System\yXdoBcT.exe
  C:\Windows\System\yXdoBcT.exe
  2⤵
  PID:10772
- C:\Windows\System\SXiGdqP.exe
  C:\Windows\System\SXiGdqP.exe
  2⤵
  PID:8208
- C:\Windows\System\xIsZggk.exe
  C:\Windows\System\xIsZggk.exe
  2⤵
  PID:12636
- C:\Windows\System\iHqSVbb.exe
  C:\Windows\System\iHqSVbb.exe
  2⤵
  PID:2900
- C:\Windows\System\UZBiQga.exe
  C:\Windows\System\UZBiQga.exe
  2⤵
  PID:9328
- C:\Windows\System\eAaIlxn.exe
  C:\Windows\System\eAaIlxn.exe
  2⤵
  PID:13060
- C:\Windows\System\XUQrSsH.exe
  C:\Windows\System\XUQrSsH.exe
  2⤵
  PID:11200
- C:\Windows\System\VyclGIv.exe
  C:\Windows\System\VyclGIv.exe
  2⤵
  PID:12408
- C:\Windows\System\aRWZOGO.exe
  C:\Windows\System\aRWZOGO.exe
  2⤵
  PID:10940
- C:\Windows\System\OInOfFT.exe
  C:\Windows\System\OInOfFT.exe
  2⤵
  PID:10788
- C:\Windows\System\FkorhHH.exe
  C:\Windows\System\FkorhHH.exe
  2⤵
  PID:12016
- C:\Windows\System\CQoGchc.exe
  C:\Windows\System\CQoGchc.exe
  2⤵
  PID:9228
- C:\Windows\System\McqtNga.exe
  C:\Windows\System\McqtNga.exe
  2⤵
  PID:8480
- C:\Windows\System\UBXbdTu.exe
  C:\Windows\System\UBXbdTu.exe
  2⤵
  PID:12640
- C:\Windows\System\vtMycwQ.exe
  C:\Windows\System\vtMycwQ.exe
  2⤵
  PID:12692
- C:\Windows\System\BOFsIBF.exe
  C:\Windows\System\BOFsIBF.exe
  2⤵
  PID:9344
- C:\Windows\System\TSrvmzZ.exe
  C:\Windows\System\TSrvmzZ.exe
  2⤵
  PID:13004
- C:\Windows\System\bFyiZLb.exe
  C:\Windows\System\bFyiZLb.exe
  2⤵
  PID:11260
- C:\Windows\System\OIMFfzV.exe
  C:\Windows\System\OIMFfzV.exe
  2⤵
  PID:4696
- C:\Windows\System\eRErkcd.exe
  C:\Windows\System\eRErkcd.exe
  2⤵
  PID:8524
- C:\Windows\System\qEbcXLQ.exe
  C:\Windows\System\qEbcXLQ.exe
  2⤵
  PID:11672
- C:\Windows\System\UJPmBZu.exe
  C:\Windows\System\UJPmBZu.exe
  2⤵
  PID:4344
- C:\Windows\System\EjpEjXd.exe
  C:\Windows\System\EjpEjXd.exe
  2⤵
  PID:11724
- C:\Windows\System\VDZEfHZ.exe
  C:\Windows\System\VDZEfHZ.exe
  2⤵
  PID:9400
- C:\Windows\System\UDisFig.exe
  C:\Windows\System\UDisFig.exe
  2⤵
  PID:5044
- C:\Windows\System\FlyPqWc.exe
  C:\Windows\System\FlyPqWc.exe
  2⤵
  PID:10260
- C:\Windows\System\KCfJRxr.exe
  C:\Windows\System\KCfJRxr.exe
  2⤵
  PID:12628
- C:\Windows\System\RHnUXIL.exe
  C:\Windows\System\RHnUXIL.exe
  2⤵
  PID:11804
- C:\Windows\System\CcYSZiK.exe
  C:\Windows\System\CcYSZiK.exe
  2⤵
  PID:10180
- C:\Windows\System\ogttoXf.exe
  C:\Windows\System\ogttoXf.exe
  2⤵
  PID:10576
- C:\Windows\System\bdQafhA.exe
  C:\Windows\System\bdQafhA.exe
  2⤵
  PID:11852
- C:\Windows\System\aPNqicI.exe
  C:\Windows\System\aPNqicI.exe
  2⤵
  PID:7676
- C:\Windows\System\Kidbdfw.exe
  C:\Windows\System\Kidbdfw.exe
  2⤵
  PID:11648
- C:\Windows\System\yiozMvW.exe
  C:\Windows\System\yiozMvW.exe
  2⤵
  PID:12492
- C:\Windows\System\Cpqjpwd.exe
  C:\Windows\System\Cpqjpwd.exe
  2⤵
  PID:13136
- C:\Windows\System\PQjVkKo.exe
  C:\Windows\System\PQjVkKo.exe
  2⤵
  PID:11424
- C:\Windows\System\ihXKZGi.exe
  C:\Windows\System\ihXKZGi.exe
  2⤵
  PID:10732
- C:\Windows\System\IkHdysv.exe
  C:\Windows\System\IkHdysv.exe
  2⤵
  PID:2712
- C:\Windows\System\hXaypMf.exe
  C:\Windows\System\hXaypMf.exe
  2⤵
  PID:9432
- C:\Windows\System\GLqjqkv.exe
  C:\Windows\System\GLqjqkv.exe
  2⤵
  PID:10824
- C:\Windows\System\EPDiOdE.exe
  C:\Windows\System\EPDiOdE.exe
  2⤵
  PID:11496
- C:\Windows\System\cZZZxzp.exe
  C:\Windows\System\cZZZxzp.exe
  2⤵
  PID:10296
- C:\Windows\System\nbSKAaz.exe
  C:\Windows\System\nbSKAaz.exe
  2⤵
  PID:868
- C:\Windows\System\WcxGdCr.exe
  C:\Windows\System\WcxGdCr.exe
  2⤵
  PID:8608
- C:\Windows\System\WaqDIem.exe
  C:\Windows\System\WaqDIem.exe
  2⤵
  PID:3416
- C:\Windows\System\pIBbMWU.exe
  C:\Windows\System\pIBbMWU.exe
  2⤵
  PID:10412
- C:\Windows\System\gGTiSwb.exe
  C:\Windows\System\gGTiSwb.exe
  2⤵
  PID:6068
- C:\Windows\System\KTVtJfc.exe
  C:\Windows\System\KTVtJfc.exe
  2⤵
  PID:5672
- C:\Windows\System\JCYxnGr.exe
  C:\Windows\System\JCYxnGr.exe
  2⤵
  PID:11704
- C:\Windows\System\rtsXVJK.exe
  C:\Windows\System\rtsXVJK.exe
  2⤵
  PID:4992
- C:\Windows\System\kzDjkCT.exe
  C:\Windows\System\kzDjkCT.exe
  2⤵
  PID:5896
- C:\Windows\System\vMDuFVE.exe
  C:\Windows\System\vMDuFVE.exe
  2⤵
  PID:9720
- C:\Windows\System\wiJrJOo.exe
  C:\Windows\System\wiJrJOo.exe
  2⤵
  PID:11924
- C:\Windows\System\GaamwcY.exe
  C:\Windows\System\GaamwcY.exe
  2⤵
  PID:3932
- C:\Windows\System\aggHUIl.exe
  C:\Windows\System\aggHUIl.exe
  2⤵
  PID:11780
- C:\Windows\System\bdTTlFN.exe
  C:\Windows\System\bdTTlFN.exe
  2⤵
  PID:3276
- C:\Windows\System\HILaNvO.exe
  C:\Windows\System\HILaNvO.exe
  2⤵
  PID:3280
- C:\Windows\System\AwuyosW.exe
  C:\Windows\System\AwuyosW.exe
  2⤵
  PID:8880
- C:\Windows\System\yzeKuMm.exe
  C:\Windows\System\yzeKuMm.exe
  2⤵
  PID:13156
- C:\Windows\System\RpGTkKg.exe
  C:\Windows\System\RpGTkKg.exe
  2⤵
  PID:1680
- C:\Windows\System\mjsgBUU.exe
  C:\Windows\System\mjsgBUU.exe
  2⤵
  PID:13324
- C:\Windows\System\PpVXZXo.exe
  C:\Windows\System\PpVXZXo.exe
  2⤵
  PID:13344
- C:\Windows\System\FlJDJnz.exe
  C:\Windows\System\FlJDJnz.exe
  2⤵
  PID:13360
- C:\Windows\System\xuFXYfr.exe
  C:\Windows\System\xuFXYfr.exe
  2⤵
  PID:13380
- C:\Windows\System\xSuXuol.exe
  C:\Windows\System\xSuXuol.exe
  2⤵
  PID:13408
- C:\Windows\System\hzSihvo.exe
  C:\Windows\System\hzSihvo.exe
  2⤵
  PID:13424
- C:\Windows\System\MDMGhES.exe
  C:\Windows\System\MDMGhES.exe
  2⤵
  PID:13444
- C:\Windows\System\HKYlDLp.exe
  C:\Windows\System\HKYlDLp.exe
  2⤵
  PID:13464
- C:\Windows\System\xSDGaQh.exe
  C:\Windows\System\xSDGaQh.exe
  2⤵
  PID:13484
- C:\Windows\System\Evewcwu.exe
  C:\Windows\System\Evewcwu.exe
  2⤵
  PID:13524
- C:\Windows\System\ZmBpTkH.exe
  C:\Windows\System\ZmBpTkH.exe
  2⤵
  PID:13540
- C:\Windows\System\JHgHSOm.exe
  C:\Windows\System\JHgHSOm.exe
  2⤵
  PID:13604
- C:\Windows\System\bfxQsFR.exe
  C:\Windows\System\bfxQsFR.exe
  2⤵
  PID:13632
- C:\Windows\System\OpGplgf.exe
  C:\Windows\System\OpGplgf.exe
  2⤵
  PID:13676
- C:\Windows\System\EWRpiZu.exe
  C:\Windows\System\EWRpiZu.exe
  2⤵
  PID:13700
- C:\Windows\System\TxxiSWr.exe
  C:\Windows\System\TxxiSWr.exe
  2⤵
  PID:13724
- C:\Windows\System\LiuLMdN.exe
  C:\Windows\System\LiuLMdN.exe
  2⤵
  PID:13748
- C:\Windows\System\JOFWYEE.exe
  C:\Windows\System\JOFWYEE.exe
  2⤵
  PID:13772
- C:\Windows\System\XhEokko.exe
  C:\Windows\System\XhEokko.exe
  2⤵
  PID:14040
- C:\Windows\System\ZCQGVbs.exe
  C:\Windows\System\ZCQGVbs.exe
  2⤵
  PID:14064
- C:\Windows\System\HnIuzGX.exe
  C:\Windows\System\HnIuzGX.exe
  2⤵
  PID:14088
- C:\Windows\System\vmLTpFs.exe
  C:\Windows\System\vmLTpFs.exe
  2⤵
  PID:14120
- C:\Windows\System\LxkgCGe.exe
  C:\Windows\System\LxkgCGe.exe
  2⤵
  PID:14140
- C:\Windows\System\VCsVSwT.exe
  C:\Windows\System\VCsVSwT.exe
  2⤵
  PID:14188
- C:\Windows\System\dQfGwCH.exe
  C:\Windows\System\dQfGwCH.exe
  2⤵
  PID:14312
- C:\Windows\System\KXguktT.exe
  C:\Windows\System\KXguktT.exe
  2⤵
  PID:14328
- C:\Windows\System\WvCganH.exe
  C:\Windows\System\WvCganH.exe
  2⤵
  PID:13436
- C:\Windows\System\yEBwsSJ.exe
  C:\Windows\System\yEBwsSJ.exe
  2⤵
  PID:13388
- C:\Windows\System\AmNqKnG.exe
  C:\Windows\System\AmNqKnG.exe
  2⤵
  PID:13320
- C:\Windows\System\KOhdWhR.exe
  C:\Windows\System\KOhdWhR.exe
  2⤵
  PID:13580
- C:\Windows\System\qxTUmcR.exe
  C:\Windows\System\qxTUmcR.exe
  2⤵
  PID:13800
- C:\Windows\System\TtAoTQd.exe
  C:\Windows\System\TtAoTQd.exe
  2⤵
  PID:800
- C:\Windows\System\IifKaBN.exe
  C:\Windows\System\IifKaBN.exe
  2⤵
  PID:13732
- C:\Windows\System\egYdxpA.exe
  C:\Windows\System\egYdxpA.exe
  2⤵
  PID:13900
- C:\Windows\System\oOCxdvh.exe
  C:\Windows\System\oOCxdvh.exe
  2⤵
  PID:4976
- C:\Windows\System\reGcZdX.exe
  C:\Windows\System\reGcZdX.exe
  2⤵
  PID:13968
- C:\Windows\System\DYnnZlm.exe
  C:\Windows\System\DYnnZlm.exe
  2⤵
  PID:13420
- C:\Windows\System\HWwENqf.exe
  C:\Windows\System\HWwENqf.exe
  2⤵
  PID:13316
- C:\Windows\System\xyYlXoY.exe
  C:\Windows\System\xyYlXoY.exe
  2⤵
  PID:13460
- C:\Windows\System\tEglogM.exe
  C:\Windows\System\tEglogM.exe
  2⤵
  PID:13796
- C:\Windows\System\fhXWsAb.exe
  C:\Windows\System\fhXWsAb.exe
  2⤵
  PID:4496
- C:\Windows\System\ckeydWz.exe
  C:\Windows\System\ckeydWz.exe
  2⤵
  PID:13884
- C:\Windows\System\vBLbwrd.exe
  C:\Windows\System\vBLbwrd.exe
  2⤵
  PID:14244
- C:\Windows\System\ofLzsYR.exe
  C:\Windows\System\ofLzsYR.exe
  2⤵
  PID:4028
- C:\Windows\System\OtOZRBf.exe
  C:\Windows\System\OtOZRBf.exe
  2⤵
  PID:14308
- C:\Windows\System\zJvmKUU.exe
  C:\Windows\System\zJvmKUU.exe
  2⤵
  PID:2184
- C:\Windows\System\DrJXJDP.exe
  C:\Windows\System\DrJXJDP.exe
  2⤵
  PID:14272
- C:\Windows\System\qffvORT.exe
  C:\Windows\System\qffvORT.exe
  2⤵
  PID:2524
- C:\Windows\System\XbIsxKM.exe
  C:\Windows\System\XbIsxKM.exe
  2⤵
  PID:11980
- C:\Windows\System\FuuyFxr.exe
  C:\Windows\System\FuuyFxr.exe
  2⤵
  PID:13940
- C:\Windows\System\oXNweyf.exe
  C:\Windows\System\oXNweyf.exe
  2⤵
  PID:13612
- C:\Windows\System\BbEqUjL.exe
  C:\Windows\System\BbEqUjL.exe
  2⤵
  PID:13744
- C:\Windows\System\LOSUNtv.exe
  C:\Windows\System\LOSUNtv.exe
  2⤵
  PID:13880
- C:\Windows\System\DwEiVjI.exe
  C:\Windows\System\DwEiVjI.exe
  2⤵
  PID:14176
- C:\Windows\System\SaRhlLc.exe
  C:\Windows\System\SaRhlLc.exe
  2⤵
  PID:1420
- C:\Windows\System\JwBwRHw.exe
  C:\Windows\System\JwBwRHw.exe
  2⤵
  PID:14028
- C:\Windows\System\JhaElIr.exe
  C:\Windows\System\JhaElIr.exe
  2⤵
  PID:2280
- C:\Windows\System\fhcgHSC.exe
  C:\Windows\System\fhcgHSC.exe
  2⤵
  PID:1568
- C:\Windows\System\YchaKUq.exe
  C:\Windows\System\YchaKUq.exe
  2⤵
  PID:14240
- C:\Windows\System\ofTTvBP.exe
  C:\Windows\System\ofTTvBP.exe
  2⤵
  PID:4404
- C:\Windows\System\DGFuOKO.exe
  C:\Windows\System\DGFuOKO.exe
  2⤵
  PID:3604
- C:\Windows\System\TsFxPdl.exe
  C:\Windows\System\TsFxPdl.exe
  2⤵
  PID:13504
- C:\Windows\System\BtsmSiF.exe
  C:\Windows\System\BtsmSiF.exe
  2⤵
  PID:228
- C:\Windows\System\CvDiRLP.exe
  C:\Windows\System\CvDiRLP.exe
  2⤵
  PID:2684
- C:\Windows\System\GDEquYn.exe
  C:\Windows\System\GDEquYn.exe
  2⤵
  PID:5996
- C:\Windows\System\fLOecuN.exe
  C:\Windows\System\fLOecuN.exe
  2⤵
  PID:6092
- C:\Windows\System\yJdtYZT.exe
  C:\Windows\System\yJdtYZT.exe
  2⤵
  PID:864
- C:\Windows\System\IknKANi.exe
  C:\Windows\System\IknKANi.exe
  2⤵
  PID:13984
- C:\Windows\System\wuBZKJf.exe
  C:\Windows\System\wuBZKJf.exe
  2⤵
  PID:3236
- C:\Windows\System\KYRnnev.exe
  C:\Windows\System\KYRnnev.exe
  2⤵
  PID:5704
- C:\Windows\System\McAuNFB.exe
  C:\Windows\System\McAuNFB.exe
  2⤵
  PID:5012
- C:\Windows\System\PSMYXMD.exe
  C:\Windows\System\PSMYXMD.exe
  2⤵
  PID:3164
- C:\Windows\System\aovikbD.exe
  C:\Windows\System\aovikbD.exe
  2⤵
  PID:2016
- C:\Windows\System\fpydRzl.exe
  C:\Windows\System\fpydRzl.exe
  2⤵
  PID:2516
- C:\Windows\System\DkCnWIZ.exe
  C:\Windows\System\DkCnWIZ.exe
  2⤵
  PID:960
- C:\Windows\System\aozDzEX.exe
  C:\Windows\System\aozDzEX.exe
  2⤵
  PID:4848
- C:\Windows\System\WSDIgWI.exe
  C:\Windows\System\WSDIgWI.exe
  2⤵
  PID:636
- C:\Windows\System\SYDhZrK.exe
  C:\Windows\System\SYDhZrK.exe
  2⤵
  PID:14116
- C:\Windows\System\BcEDEdi.exe
  C:\Windows\System\BcEDEdi.exe
  2⤵
  PID:14220
- C:\Windows\System\YIOwVkw.exe
  C:\Windows\System\YIOwVkw.exe
  2⤵
  PID:4632
- C:\Windows\System\JqpLweI.exe
  C:\Windows\System\JqpLweI.exe
  2⤵
  PID:5992
- C:\Windows\System\rpPVcJc.exe
  C:\Windows\System\rpPVcJc.exe
  2⤵
  PID:6796
- C:\Windows\System\oPytTnH.exe
  C:\Windows\System\oPytTnH.exe
  2⤵
  PID:6808
- C:\Windows\System\EGTbwYG.exe
  C:\Windows\System\EGTbwYG.exe
  2⤵
  PID:6864
- C:\Windows\System\cavvhMt.exe
  C:\Windows\System\cavvhMt.exe
  2⤵
  PID:6360
- C:\Windows\System\ecvkRGv.exe
  C:\Windows\System\ecvkRGv.exe
  2⤵
  PID:13640
- C:\Windows\System\rgqekim.exe
  C:\Windows\System\rgqekim.exe
  2⤵
  PID:6984
- C:\Windows\System\eyMBHjg.exe
  C:\Windows\System\eyMBHjg.exe
  2⤵
  PID:7520
- C:\Windows\System\eYBPTfp.exe
  C:\Windows\System\eYBPTfp.exe
  2⤵
  PID:5400
- C:\Windows\System\bfWAHDj.exe
  C:\Windows\System\bfWAHDj.exe
  2⤵
  PID:13372
- C:\Windows\System\AzPFYuI.exe
  C:\Windows\System\AzPFYuI.exe
  2⤵
  PID:6124
- C:\Windows\System\uFxqcvs.exe
  C:\Windows\System\uFxqcvs.exe
  2⤵
  PID:6280
- C:\Windows\System\bSOnFSl.exe
  C:\Windows\System\bSOnFSl.exe
  2⤵
  PID:6376
- C:\Windows\System\IZFqmTx.exe
  C:\Windows\System\IZFqmTx.exe
  2⤵
  PID:6816
- C:\Windows\System\zhfyptl.exe
  C:\Windows\System\zhfyptl.exe
  2⤵
  PID:6464
- C:\Windows\System\AkGHLsi.exe
  C:\Windows\System\AkGHLsi.exe
  2⤵
  PID:13820
- C:\Windows\System\GKiBFpX.exe
  C:\Windows\System\GKiBFpX.exe
  2⤵
  PID:13716
- C:\Windows\System\PoBAhjv.exe
  C:\Windows\System\PoBAhjv.exe
  2⤵
  PID:6012
- C:\Windows\System\HVbrbFG.exe
  C:\Windows\System\HVbrbFG.exe
  2⤵
  PID:4556
- C:\Windows\System\muQBIVY.exe
  C:\Windows\System\muQBIVY.exe
  2⤵
  PID:14060
- C:\Windows\System\iRnraZN.exe
  C:\Windows\System\iRnraZN.exe
  2⤵
  PID:5744
- C:\Windows\System\DitViVB.exe
  C:\Windows\System\DitViVB.exe
  2⤵
  PID:6076
- C:\Windows\System\NzXUNry.exe
  C:\Windows\System\NzXUNry.exe
  2⤵
  PID:6436
- C:\Windows\System\hLhowWo.exe
  C:\Windows\System\hLhowWo.exe
  2⤵
  PID:6900
- C:\Windows\System\qMyPucH.exe
  C:\Windows\System\qMyPucH.exe
  2⤵
  PID:7008
- C:\Windows\System\QIIdLzM.exe
  C:\Windows\System\QIIdLzM.exe
  2⤵
  PID:2236
- C:\Windows\System\beGyBkm.exe
  C:\Windows\System\beGyBkm.exe
  2⤵
  PID:6968
- C:\Windows\System\yFKvLTO.exe
  C:\Windows\System\yFKvLTO.exe
  2⤵
  PID:1108
- C:\Windows\System\fHXHriq.exe
  C:\Windows\System\fHXHriq.exe
  2⤵
  PID:5480
- C:\Windows\System\UvNpUVh.exe
  C:\Windows\System\UvNpUVh.exe
  2⤵
  PID:3420
- C:\Windows\System\axcanul.exe
  C:\Windows\System\axcanul.exe
  2⤵
  PID:2612
- C:\Windows\System\vjslckL.exe
  C:\Windows\System\vjslckL.exe
  2⤵
  PID:4156
- C:\Windows\System\ddfRvVm.exe
  C:\Windows\System\ddfRvVm.exe
  2⤵
  PID:6236
- C:\Windows\System\GrDVrYO.exe
  C:\Windows\System\GrDVrYO.exe
  2⤵
  PID:3700
- C:\Windows\System\pZwQsNS.exe
  C:\Windows\System\pZwQsNS.exe
  2⤵
  PID:14184
- C:\Windows\System\lUmgJXK.exe
  C:\Windows\System\lUmgJXK.exe
  2⤵
  PID:6572
- C:\Windows\System\ZaYYDQC.exe
  C:\Windows\System\ZaYYDQC.exe
  2⤵
  PID:14096
- C:\Windows\System\mNhtBFD.exe
  C:\Windows\System\mNhtBFD.exe
  2⤵
  PID:14196
- C:\Windows\System\qEklzVN.exe
  C:\Windows\System\qEklzVN.exe
  2⤵
  PID:2520
- C:\Windows\System\PHqCzcF.exe
  C:\Windows\System\PHqCzcF.exe
  2⤵
  PID:5664
- C:\Windows\System\DobPJgw.exe
  C:\Windows\System\DobPJgw.exe
  2⤵
  PID:6052
- C:\Windows\System\AssaguT.exe
  C:\Windows\System\AssaguT.exe
  2⤵
  PID:5756
- C:\Windows\System\tDzjtyb.exe
  C:\Windows\System\tDzjtyb.exe
  2⤵
  PID:6164
- C:\Windows\System\XxkDXJe.exe
  C:\Windows\System\XxkDXJe.exe
  2⤵
  PID:6856
- C:\Windows\System\vEdAyMn.exe
  C:\Windows\System\vEdAyMn.exe
  2⤵
  PID:6028
- C:\Windows\System\fPbpcPC.exe
  C:\Windows\System\fPbpcPC.exe
  2⤵
  PID:5824
- C:\Windows\System\PvlwtSQ.exe
  C:\Windows\System\PvlwtSQ.exe
  2⤵
  PID:6996
- C:\Windows\System\oetYETz.exe
  C:\Windows\System\oetYETz.exe
  2⤵
  PID:6508
- C:\Windows\System\OcXsoQk.exe
  C:\Windows\System\OcXsoQk.exe
  2⤵
  PID:2540
- C:\Windows\System\vCPDhvM.exe
  C:\Windows\System\vCPDhvM.exe
  2⤵
  PID:6772
- C:\Windows\System\LRbMaFU.exe
  C:\Windows\System\LRbMaFU.exe
  2⤵
  PID:3200
- C:\Windows\System\IzhCgWT.exe
  C:\Windows\System\IzhCgWT.exe
  2⤵
  PID:5988
- C:\Windows\System\qpQpLbR.exe
  C:\Windows\System\qpQpLbR.exe
  2⤵
  PID:7888
- C:\Windows\System\AulEhJv.exe
  C:\Windows\System\AulEhJv.exe
  2⤵
  PID:6320
- C:\Windows\System\HpGCnjQ.exe
  C:\Windows\System\HpGCnjQ.exe
  2⤵
  PID:13928
- C:\Windows\System\GzbAfWR.exe
  C:\Windows\System\GzbAfWR.exe
  2⤵
  PID:7908
- C:\Windows\System\TSnjOZI.exe
  C:\Windows\System\TSnjOZI.exe
  2⤵
  PID:7536
- C:\Windows\System\SbsZCIQ.exe
  C:\Windows\System\SbsZCIQ.exe
  2⤵
  PID:7012
- C:\Windows\System\dlYDFMA.exe
  C:\Windows\System\dlYDFMA.exe
  2⤵
  PID:6896
- C:\Windows\System\zTZbBfo.exe
  C:\Windows\System\zTZbBfo.exe
  2⤵
  PID:9532
- C:\Windows\System\LzLzCZa.exe
  C:\Windows\System\LzLzCZa.exe
  2⤵
  PID:6104
- C:\Windows\System\PBmnniT.exe
  C:\Windows\System\PBmnniT.exe
  2⤵
  PID:1224
- C:\Windows\System\arUGCST.exe
  C:\Windows\System\arUGCST.exe
  2⤵
  PID:6860
- C:\Windows\System\JWKqvEz.exe
  C:\Windows\System\JWKqvEz.exe
  2⤵
  PID:856
- C:\Windows\System\FfNFCeJ.exe
  C:\Windows\System\FfNFCeJ.exe
  2⤵
  PID:6592
- C:\Windows\System\cjsxlAq.exe
  C:\Windows\System\cjsxlAq.exe
  2⤵
  PID:14268
- C:\Windows\System\ewrmWgR.exe
  C:\Windows\System\ewrmWgR.exe
  2⤵
  PID:7452
- C:\Windows\System\NqPkkxn.exe
  C:\Windows\System\NqPkkxn.exe
  2⤵
  PID:5144
- C:\Windows\System\gmrmrwR.exe
  C:\Windows\System\gmrmrwR.exe
  2⤵
  PID:6792
- C:\Windows\System\DkjvSib.exe
  C:\Windows\System\DkjvSib.exe
  2⤵
  PID:7824
- C:\Windows\System\LnFfYsU.exe
  C:\Windows\System\LnFfYsU.exe
  2⤵
  PID:2836
- C:\Windows\System\viTTPfm.exe
  C:\Windows\System\viTTPfm.exe
  2⤵
  PID:7072
- C:\Windows\System\mtcXyPo.exe
  C:\Windows\System\mtcXyPo.exe
  2⤵
  PID:6024
- C:\Windows\System\mRjfEJp.exe
  C:\Windows\System\mRjfEJp.exe
  2⤵
  PID:14212
- C:\Windows\System\YjlSUcT.exe
  C:\Windows\System\YjlSUcT.exe
  2⤵
  PID:8116
- C:\Windows\System\ZbTJHpC.exe
  C:\Windows\System\ZbTJHpC.exe
  2⤵
  PID:2448
- C:\Windows\System\xeyYOZa.exe
  C:\Windows\System\xeyYOZa.exe
  2⤵
  PID:3368
- C:\Windows\System\KArBuCG.exe
  C:\Windows\System\KArBuCG.exe
  2⤵
  PID:14924
- C:\Windows\System\vXLbZpH.exe
  C:\Windows\System\vXLbZpH.exe
  2⤵
  PID:15092
- C:\Windows\System\jsEbhzs.exe
  C:\Windows\System\jsEbhzs.exe
  2⤵
  PID:15172
- C:\Windows\System\TtZqJhj.exe
  C:\Windows\System\TtZqJhj.exe
  2⤵
  PID:15188
- C:\Windows\System\QDHtzRq.exe
  C:\Windows\System\QDHtzRq.exe
  2⤵
  PID:15232
- C:\Windows\System\gRwTmYE.exe
  C:\Windows\System\gRwTmYE.exe
  2⤵
  PID:15268
- C:\Windows\System\vRuOUlV.exe
  C:\Windows\System\vRuOUlV.exe
  2⤵
  PID:15288
- C:\Windows\System\gDOBPWV.exe
  C:\Windows\System\gDOBPWV.exe
  2⤵
  PID:15308
- C:\Windows\System\XGGHDnV.exe
  C:\Windows\System\XGGHDnV.exe
  2⤵
  PID:15328
- C:\Windows\System\WthOtAw.exe
  C:\Windows\System\WthOtAw.exe
  2⤵
  PID:15352
- C:\Windows\System\lHpaiLq.exe
  C:\Windows\System\lHpaiLq.exe
  2⤵
  PID:7876
- C:\Windows\System\XTKoIzZ.exe
  C:\Windows\System\XTKoIzZ.exe
  2⤵
  PID:6416
- C:\Windows\System\fcpwXDs.exe
  C:\Windows\System\fcpwXDs.exe
  2⤵
  PID:6340
- C:\Windows\System\ZZJLshm.exe
  C:\Windows\System\ZZJLshm.exe
  2⤵
  PID:6992
- C:\Windows\System\AlYPUyh.exe
  C:\Windows\System\AlYPUyh.exe
  2⤵
  PID:14420
- C:\Windows\System\dmHJipF.exe
  C:\Windows\System\dmHJipF.exe
  2⤵
  PID:7828
- C:\Windows\System\JmHTViW.exe
  C:\Windows\System\JmHTViW.exe
  2⤵
  PID:14344
- C:\Windows\System\hPIBAuU.exe
  C:\Windows\System\hPIBAuU.exe
  2⤵
  PID:14496
- C:\Windows\System\cYOodqt.exe
  C:\Windows\System\cYOodqt.exe
  2⤵
  PID:14560
- C:\Windows\System\hLhPcIa.exe
  C:\Windows\System\hLhPcIa.exe
  2⤵
  PID:14464
- C:\Windows\System\aRZzBRR.exe
  C:\Windows\System\aRZzBRR.exe
  2⤵
  PID:14708
- C:\Windows\System\lZBjEeD.exe
  C:\Windows\System\lZBjEeD.exe
  2⤵
  PID:14728
- C:\Windows\System\ybYDbzc.exe
  C:\Windows\System\ybYDbzc.exe
  2⤵
  PID:7416
- C:\Windows\System\cGUspkO.exe
  C:\Windows\System\cGUspkO.exe
  2⤵
  PID:14756
- C:\Windows\System\anIGKIA.exe
  C:\Windows\System\anIGKIA.exe
  2⤵
  PID:14576
- C:\Windows\System\upyFkSy.exe
  C:\Windows\System\upyFkSy.exe
  2⤵
  PID:14608
- C:\Windows\System\nZebbjd.exe
  C:\Windows\System\nZebbjd.exe
  2⤵
  PID:14628
- C:\Windows\System\cBekIMn.exe
  C:\Windows\System\cBekIMn.exe
  2⤵
  PID:14664
- C:\Windows\System\VVFkRFA.exe
  C:\Windows\System\VVFkRFA.exe
  2⤵
  PID:14896
- C:\Windows\System\BIGEVPa.exe
  C:\Windows\System\BIGEVPa.exe
  2⤵
  PID:14932
- C:\Windows\System\nbZQxQZ.exe
  C:\Windows\System\nbZQxQZ.exe
  2⤵
  PID:5424
- C:\Windows\System\YWlKCae.exe
  C:\Windows\System\YWlKCae.exe
  2⤵
  PID:8164
- C:\Windows\System\StIzzKE.exe
  C:\Windows\System\StIzzKE.exe
  2⤵
  PID:14988
- C:\Windows\System\BqLCvhs.exe
  C:\Windows\System\BqLCvhs.exe
  2⤵
  PID:14592
- C:\Windows\System\RUTJGEV.exe
  C:\Windows\System\RUTJGEV.exe
  2⤵
  PID:14776
- C:\Windows\System\yIAtSLY.exe
  C:\Windows\System\yIAtSLY.exe
  2⤵
  PID:14780
- C:\Windows\System\nPXXGUk.exe
  C:\Windows\System\nPXXGUk.exe
  2⤵
  PID:14616
- C:\Windows\System\CVvqQDZ.exe
  C:\Windows\System\CVvqQDZ.exe
  2⤵
  PID:15136
- C:\Windows\System\VBTQVXY.exe
  C:\Windows\System\VBTQVXY.exe
  2⤵
  PID:5860
- C:\Windows\System\JtgJEIU.exe
  C:\Windows\System\JtgJEIU.exe
  2⤵
  PID:15068
- C:\Windows\System\yZCKfIz.exe
  C:\Windows\System\yZCKfIz.exe
  2⤵
  PID:9496
- C:\Windows\System\pkapzWt.exe
  C:\Windows\System\pkapzWt.exe
  2⤵
  PID:8744
- C:\Windows\System\qexgNFs.exe
  C:\Windows\System\qexgNFs.exe
  2⤵
  PID:8792
- C:\Windows\System\NsFzRMr.exe
  C:\Windows\System\NsFzRMr.exe
  2⤵
  PID:15248
- C:\Windows\System\rbsQaWY.exe
  C:\Windows\System\rbsQaWY.exe
  2⤵
  PID:15280
- C:\Windows\System\KYleBfW.exe
  C:\Windows\System\KYleBfW.exe
  2⤵
  PID:6424
- C:\Windows\System\DllcDUh.exe
  C:\Windows\System\DllcDUh.exe
  2⤵
  PID:10188
- C:\Windows\System\mEbTiEg.exe
  C:\Windows\System\mEbTiEg.exe
  2⤵
  PID:15340
- C:\Windows\System\ySCsLjy.exe
  C:\Windows\System\ySCsLjy.exe
  2⤵
  PID:10228
- C:\Windows\System\HKFqSZQ.exe
  C:\Windows\System\HKFqSZQ.exe
  2⤵
  PID:6504
- C:\Windows\System\HNxVZuD.exe
  C:\Windows\System\HNxVZuD.exe
  2⤵
  PID:14368
- C:\Windows\System\RLBsGCm.exe
  C:\Windows\System\RLBsGCm.exe
  2⤵
  PID:13904
- C:\Windows\System\TMkTaqw.exe
  C:\Windows\System\TMkTaqw.exe
  2⤵
  PID:14340
- C:\Windows\System\rJjYzxl.exe
  C:\Windows\System\rJjYzxl.exe
  2⤵
  PID:10480
- C:\Windows\System\yMzzbdr.exe
  C:\Windows\System\yMzzbdr.exe
  2⤵
  PID:10796
- C:\Windows\System\Bobykwd.exe
  C:\Windows\System\Bobykwd.exe
  2⤵
  PID:14748
- C:\Windows\System\BZghWUt.exe
  C:\Windows\System\BZghWUt.exe
  2⤵
  PID:8672
- C:\Windows\System\iOEtCxf.exe
  C:\Windows\System\iOEtCxf.exe
  2⤵
  PID:14588
- C:\Windows\System\xdVaHpP.exe
  C:\Windows\System\xdVaHpP.exe
  2⤵
  PID:4824
- C:\Windows\System\HZmbxWE.exe
  C:\Windows\System\HZmbxWE.exe
  2⤵
  PID:14680
- C:\Windows\System\iLCWwTN.exe
  C:\Windows\System\iLCWwTN.exe
  2⤵
  PID:14908
- C:\Windows\System\EElkZFS.exe
  C:\Windows\System\EElkZFS.exe
  2⤵
  PID:10944
- C:\Windows\System\fYGHIdH.exe
  C:\Windows\System\fYGHIdH.exe
  2⤵
  PID:11072
- C:\Windows\System\emciVXn.exe
  C:\Windows\System\emciVXn.exe
  2⤵
  PID:9140
- C:\Windows\System\AOQWXom.exe
  C:\Windows\System\AOQWXom.exe
  2⤵
  PID:9696
- C:\Windows\System\MuqKytp.exe
  C:\Windows\System\MuqKytp.exe
  2⤵
  PID:1980
- C:\Windows\System\QhIVSAA.exe
  C:\Windows\System\QhIVSAA.exe
  2⤵
  PID:8396
- C:\Windows\System\RogEtlG.exe
  C:\Windows\System\RogEtlG.exe
  2⤵
  PID:5692
- C:\Windows\System\CmSOWRm.exe
  C:\Windows\System\CmSOWRm.exe
  2⤵
  PID:5264
- C:\Windows\System\RCiOMmz.exe
  C:\Windows\System\RCiOMmz.exe
  2⤵
  PID:10276
- C:\Windows\System\TJXVLXa.exe
  C:\Windows\System\TJXVLXa.exe
  2⤵
  PID:8956
- C:\Windows\System\gNVBSyG.exe
  C:\Windows\System\gNVBSyG.exe
  2⤵
  PID:12220
- C:\Windows\System\HIzuBzE.exe
  C:\Windows\System\HIzuBzE.exe
  2⤵
  PID:2740
- C:\Windows\System\bUoyHzM.exe
  C:\Windows\System\bUoyHzM.exe
  2⤵
  PID:10380
- C:\Windows\System\YDGgxPW.exe
  C:\Windows\System\YDGgxPW.exe
  2⤵
  PID:10012
- C:\Windows\System\bKgNurV.exe
  C:\Windows\System\bKgNurV.exe
  2⤵
  PID:14792
- C:\Windows\System\FFEtbEy.exe
  C:\Windows\System\FFEtbEy.exe
  2⤵
  PID:14520
- C:\Windows\System\kGyZAWv.exe
  C:\Windows\System\kGyZAWv.exe
  2⤵
  PID:14808
- C:\Windows\System\BRkXZzA.exe
  C:\Windows\System\BRkXZzA.exe
  2⤵
  PID:8240
- C:\Windows\System\ZqssZzu.exe
  C:\Windows\System\ZqssZzu.exe
  2⤵
  PID:9904
- C:\Windows\System\LVgihGT.exe
  C:\Windows\System\LVgihGT.exe
  2⤵
  PID:15032
- C:\Windows\System\kTBTsVQ.exe
  C:\Windows\System\kTBTsVQ.exe
  2⤵
  PID:4144
- C:\Windows\System\GTWroMx.exe
  C:\Windows\System\GTWroMx.exe
  2⤵
  PID:15180
- C:\Windows\System\wfrDxzx.exe
  C:\Windows\System\wfrDxzx.exe
  2⤵
  PID:15012
- C:\Windows\System\uDpGaTe.exe
  C:\Windows\System\uDpGaTe.exe
  2⤵
  PID:12820
- C:\Windows\System\AQrOUdj.exe
  C:\Windows\System\AQrOUdj.exe
  2⤵
  PID:12708
- C:\Windows\System\snvDREQ.exe
  C:\Windows\System\snvDREQ.exe
  2⤵
  PID:12816
- C:\Windows\System\rqADkfx.exe
  C:\Windows\System\rqADkfx.exe
  2⤵
  PID:7784
- C:\Windows\System\IgCqHGW.exe
  C:\Windows\System\IgCqHGW.exe
  2⤵
  PID:7816
- C:\Windows\System\euPNGlh.exe
  C:\Windows\System\euPNGlh.exe
  2⤵
  PID:10304
- C:\Windows\System\lfxVqiY.exe
  C:\Windows\System\lfxVqiY.exe
  2⤵
  PID:9004
- C:\Windows\System\LISzKuu.exe
  C:\Windows\System\LISzKuu.exe
  2⤵
  PID:964
- C:\Windows\System\qTPgPVI.exe
  C:\Windows\System\qTPgPVI.exe
  2⤵
  PID:9084
- C:\Windows\System\TNeXVaq.exe
  C:\Windows\System\TNeXVaq.exe
  2⤵
  PID:6872
- C:\Windows\System\fdfJASp.exe
  C:\Windows\System\fdfJASp.exe
  2⤵
  PID:11272
- C:\Windows\System\JSLTwFt.exe
  C:\Windows\System\JSLTwFt.exe
  2⤵
  PID:11436
- C:\Windows\System\EkUVkyQ.exe
  C:\Windows\System\EkUVkyQ.exe
  2⤵
  PID:11872
- C:\Windows\System\JWnMECE.exe
  C:\Windows\System\JWnMECE.exe
  2⤵
  PID:10952
- C:\Windows\System\dxYzrVQ.exe
  C:\Windows\System\dxYzrVQ.exe
  2⤵
  PID:8952
- C:\Windows\System\SCQOGbF.exe
  C:\Windows\System\SCQOGbF.exe
  2⤵
  PID:9508
- C:\Windows\System\qbqKfrc.exe
  C:\Windows\System\qbqKfrc.exe
  2⤵
  PID:9456
- C:\Windows\System\VNpQBha.exe
  C:\Windows\System\VNpQBha.exe
  2⤵
  PID:12984
- C:\Windows\System\dyuclnR.exe
  C:\Windows\System\dyuclnR.exe
  2⤵
  PID:14872
- C:\Windows\System\ZfAOSYu.exe
  C:\Windows\System\ZfAOSYu.exe
  2⤵
  PID:10464
- C:\Windows\System\pauohTm.exe
  C:\Windows\System\pauohTm.exe
  2⤵
  PID:12232
- C:\Windows\System\sTDUUYk.exe
  C:\Windows\System\sTDUUYk.exe
  2⤵
  PID:12960
- C:\Windows\System\DspxUbY.exe
  C:\Windows\System\DspxUbY.exe
  2⤵
  PID:14508
- C:\Windows\System\pattbZy.exe
  C:\Windows\System\pattbZy.exe
  2⤵
  PID:13172
- C:\Windows\System\ePrMKcX.exe
  C:\Windows\System\ePrMKcX.exe
  2⤵
  PID:14208
- C:\Windows\System\qEhyhEE.exe
  C:\Windows\System\qEhyhEE.exe
  2⤵
  PID:13168
- C:\Windows\System\tWKszUM.exe
  C:\Windows\System\tWKszUM.exe
  2⤵
  PID:12844
- C:\Windows\System\BBAINwC.exe
  C:\Windows\System\BBAINwC.exe
  2⤵
  PID:3320
- C:\Windows\System\CrknCUg.exe
  C:\Windows\System\CrknCUg.exe
  2⤵
  PID:11736
- C:\Windows\System\GgPqjoB.exe
  C:\Windows\System\GgPqjoB.exe
  2⤵
  PID:12440
- C:\Windows\System\nIjyVbj.exe
  C:\Windows\System\nIjyVbj.exe
  2⤵
  PID:10876
- C:\Windows\System\gXAgybl.exe
  C:\Windows\System\gXAgybl.exe
  2⤵
  PID:14364
- C:\Windows\System\IjwuJwZ.exe
  C:\Windows\System\IjwuJwZ.exe
  2⤵
  PID:15344
- C:\Windows\System\RYEMwrX.exe
  C:\Windows\System\RYEMwrX.exe
  2⤵
  PID:15020
- C:\Windows\System\MfwSZRE.exe
  C:\Windows\System\MfwSZRE.exe
  2⤵
  PID:14720
- C:\Windows\System\bIeFlqX.exe
  C:\Windows\System\bIeFlqX.exe
  2⤵
  PID:11524
- C:\Windows\System\ITbuiBc.exe
  C:\Windows\System\ITbuiBc.exe
  2⤵
  PID:14688
- C:\Windows\System\Claoglv.exe
  C:\Windows\System\Claoglv.exe
  2⤵
  PID:9724
- C:\Windows\System\qjQfASZ.exe
  C:\Windows\System\qjQfASZ.exe
  2⤵
  PID:11712
- C:\Windows\System\vekPscu.exe
  C:\Windows\System\vekPscu.exe
  2⤵
  PID:12976
- C:\Windows\System\hxMvtmB.exe
  C:\Windows\System\hxMvtmB.exe
  2⤵
  PID:13284
- C:\Windows\System\cFYdUih.exe
  C:\Windows\System\cFYdUih.exe
  2⤵
  PID:14992
- C:\Windows\System\luRnViT.exe
  C:\Windows\System\luRnViT.exe
  2⤵
  PID:13692
- C:\Windows\System\GIPpNwZ.exe
  C:\Windows\System\GIPpNwZ.exe
  2⤵
  PID:9976
- C:\Windows\System\WnKlWEE.exe
  C:\Windows\System\WnKlWEE.exe
  2⤵
  PID:12868
- C:\Windows\System\OKUNfya.exe
  C:\Windows\System\OKUNfya.exe
  2⤵
  PID:216
- C:\Windows\System\nHqchnJ.exe
  C:\Windows\System\nHqchnJ.exe
  2⤵
  PID:13020
- C:\Windows\System\CXUWIsn.exe
  C:\Windows\System\CXUWIsn.exe
  2⤵
  PID:9596
- C:\Windows\System\GUYLxHA.exe
  C:\Windows\System\GUYLxHA.exe
  2⤵
  PID:9700
- C:\Windows\System\cLFdafV.exe
  C:\Windows\System\cLFdafV.exe
  2⤵
  PID:13108
- C:\Windows\System\xgYCPWg.exe
  C:\Windows\System\xgYCPWg.exe
  2⤵
  PID:10424
- C:\Windows\System\FJJaqYi.exe
  C:\Windows\System\FJJaqYi.exe
  2⤵
  PID:8596
- C:\Windows\System\sQHYkXA.exe
  C:\Windows\System\sQHYkXA.exe
  2⤵
  PID:14656
- C:\Windows\System\yInvJOk.exe
  C:\Windows\System\yInvJOk.exe
  2⤵
  PID:10700
- C:\Windows\System\PFYrYDg.exe
  C:\Windows\System\PFYrYDg.exe
  2⤵
  PID:12576
- C:\Windows\System\uFANOzX.exe
  C:\Windows\System\uFANOzX.exe
  2⤵
  PID:7396
- C:\Windows\System\KKUvMnG.exe
  C:\Windows\System\KKUvMnG.exe
  2⤵
  PID:8748
- C:\Windows\System\vDwercG.exe
  C:\Windows\System\vDwercG.exe
  2⤵
  PID:12968
- C:\Windows\System\sbEinxG.exe
  C:\Windows\System\sbEinxG.exe
  2⤵
  PID:13044
- C:\Windows\System\LhRSsCo.exe
  C:\Windows\System\LhRSsCo.exe
  2⤵
  PID:11160
- C:\Windows\System\NvoJWjZ.exe
  C:\Windows\System\NvoJWjZ.exe
  2⤵
  PID:15320
- C:\Windows\System\fceXkeA.exe
  C:\Windows\System\fceXkeA.exe
  2⤵
  PID:8540
- C:\Windows\System\pzTMXbN.exe
  C:\Windows\System\pzTMXbN.exe
  2⤵
  PID:3392
- C:\Windows\System\qcjkkge.exe
  C:\Windows\System\qcjkkge.exe
  2⤵
  PID:10524
- C:\Windows\System\wWFtemd.exe
  C:\Windows\System\wWFtemd.exe
  2⤵
  PID:13072
- C:\Windows\System\hcuTLDE.exe
  C:\Windows\System\hcuTLDE.exe
  2⤵
  PID:6096
- C:\Windows\System\JSUyfJs.exe
  C:\Windows\System\JSUyfJs.exe
  2⤵
  PID:12928
- C:\Windows\System\xBxeAko.exe
  C:\Windows\System\xBxeAko.exe
  2⤵
  PID:13036
- C:\Windows\System\NklTMoi.exe
  C:\Windows\System\NklTMoi.exe
  2⤵
  PID:11956
- C:\Windows\System\qXtlHWs.exe
  C:\Windows\System\qXtlHWs.exe
  2⤵
  PID:8816
- C:\Windows\System\wfFdKno.exe
  C:\Windows\System\wfFdKno.exe
  2⤵
  PID:11468
- C:\Windows\System\efFwkKR.exe
  C:\Windows\System\efFwkKR.exe
  2⤵
  PID:11148
- C:\Windows\System\rPcNEPu.exe
  C:\Windows\System\rPcNEPu.exe
  2⤵
  PID:7852
- C:\Windows\System\kdluMCv.exe
  C:\Windows\System\kdluMCv.exe
  2⤵
  PID:12972
- C:\Windows\System\fDQZbWB.exe
  C:\Windows\System\fDQZbWB.exe
  2⤵
  PID:12020
- C:\Windows\System\XQhsIxO.exe
  C:\Windows\System\XQhsIxO.exe
  2⤵
  PID:13220
- C:\Windows\System\azbkRmV.exe
  C:\Windows\System\azbkRmV.exe
  2⤵
  PID:12896
- C:\Windows\System\iArJJej.exe
  C:\Windows\System\iArJJej.exe
  2⤵
  PID:12772
- C:\Windows\System\FvOkjJB.exe
  C:\Windows\System\FvOkjJB.exe
  2⤵
  PID:9160
- C:\Windows\System\EpDFXVs.exe
  C:\Windows\System\EpDFXVs.exe
  2⤵
  PID:9560
- C:\Windows\System\nNCXBdG.exe
  C:\Windows\System\nNCXBdG.exe
  2⤵
  PID:12788
- C:\Windows\System\zPapVIJ.exe
  C:\Windows\System\zPapVIJ.exe
  2⤵
  PID:7716
- C:\Windows\System\OuXBoyG.exe
  C:\Windows\System\OuXBoyG.exe
  2⤵
  PID:10052
- C:\Windows\System\HtaBYTA.exe
  C:\Windows\System\HtaBYTA.exe
  2⤵
  PID:7368
- C:\Windows\System\pgEsQnw.exe
  C:\Windows\System\pgEsQnw.exe
  2⤵
  PID:10076
- C:\Windows\System\mIpEWoT.exe
  C:\Windows\System\mIpEWoT.exe
  2⤵
  PID:12076
- C:\Windows\System\VhdbjTv.exe
  C:\Windows\System\VhdbjTv.exe
  2⤵
  PID:10972
- C:\Windows\System\AmfSHiE.exe
  C:\Windows\System\AmfSHiE.exe
  2⤵
  PID:13160
- C:\Windows\System\FkGRzDh.exe
  C:\Windows\System\FkGRzDh.exe
  2⤵
  PID:11556
- C:\Windows\System\FptLDjP.exe
  C:\Windows\System\FptLDjP.exe
  2⤵
  PID:10672
- C:\Windows\System\NIRhDfv.exe
  C:\Windows\System\NIRhDfv.exe
  2⤵
  PID:6768
- C:\Windows\System\WZiLvdo.exe
  C:\Windows\System\WZiLvdo.exe
  2⤵
  PID:12836
- C:\Windows\System\AjiLqOH.exe
  C:\Windows\System\AjiLqOH.exe
  2⤵
  PID:6660
- C:\Windows\System\BGGfFfm.exe
  C:\Windows\System\BGGfFfm.exe
  2⤵
  PID:12908
- C:\Windows\System\AHNaBnf.exe
  C:\Windows\System\AHNaBnf.exe
  2⤵
  PID:9088
- C:\Windows\System\EMgBEtJ.exe
  C:\Windows\System\EMgBEtJ.exe
  2⤵
  PID:10760
- C:\Windows\System\HShyBAF.exe
  C:\Windows\System\HShyBAF.exe
  2⤵
  PID:8572
- C:\Windows\System\NoasOMe.exe
  C:\Windows\System\NoasOMe.exe
  2⤵
  PID:2976
- C:\Windows\System\GLxbdth.exe
  C:\Windows\System\GLxbdth.exe
  2⤵
  PID:11044
- C:\Windows\System\cSbphsE.exe
  C:\Windows\System\cSbphsE.exe
  2⤵
  PID:10572
- C:\Windows\System\kMCmvyn.exe
  C:\Windows\System\kMCmvyn.exe
  2⤵
  PID:12768
- C:\Windows\System\qGQmImZ.exe
  C:\Windows\System\qGQmImZ.exe
  2⤵
  PID:12876
- C:\Windows\System\FPFfGwm.exe
  C:\Windows\System\FPFfGwm.exe
  2⤵
  PID:7956
- C:\Windows\System\vBWNYLE.exe
  C:\Windows\System\vBWNYLE.exe
  2⤵
  PID:10344
- C:\Windows\System\AnMmHio.exe
  C:\Windows\System\AnMmHio.exe
  2⤵
  PID:11644
- C:\Windows\System\bgURrbu.exe
  C:\Windows\System\bgURrbu.exe
  2⤵
  PID:512
- C:\Windows\System\HlgIoZo.exe
  C:\Windows\System\HlgIoZo.exe
  2⤵
  PID:9740
- C:\Windows\System\qJqdCvb.exe
  C:\Windows\System\qJqdCvb.exe
  2⤵
  PID:3388
- C:\Windows\System\tzQqQla.exe
  C:\Windows\System\tzQqQla.exe
  2⤵
  PID:13132

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 9628 -ip 9628
1⤵
PID:10732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lwtkzeqg.cie.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ChsxcSh.exe

Filesize
1.7MB

MD5
e5d2c36ce29d724051bb7c6918987bab

SHA1
4b976dd43003413eb909e8384423fb03adc2dd49

SHA256
472cf9a4f82cde0c8980caceef13e3a748e60744fad35b5b1072dc0400368840

SHA512
00cb7e47b2c20dc9a4d8dea4ef897fa17d22ce793119f44c8836025fe78425a033f9cbba8e97f98d3e0ff19c09ecd4bf4d14aa4687213296b28c89fba6452dfd

Download Submit
C:\Windows\System\CjTsxWc.exe

Filesize
1.7MB

MD5
41a7618a57e95c0643c132e27700cac3

SHA1
8f04ae3e25605b11ac6fa7c4444e07669f198363

SHA256
f828f0083799e20410fee928e56c305c9c594adc8a30a0896260747ab73389bb

SHA512
17d83c9b6939d5eae2ecdb1f5fee7f85dcde44501b44b4ddcbfeea218f020bac3587195b48441cae4c42fa26abee302d6b1a02958a997ae8ce9ddc9926a7df6e

Download Submit
C:\Windows\System\FvlNFlz.exe

Filesize
1.7MB

MD5
63b8a5a17b2abe2a9d76a3eaedf29c2d

SHA1
99328c1e25613294793a423220a303aeddc8db7e

SHA256
36b0c2b97a1b8aa523313f7be83a01fb96ccc4aad80d9119a4d1525fcbc858fc

SHA512
b2cafd6c6f3757aa50c51ca1dd7f92c3e090647683b12989e762240f66e08e55532fc0fc092b9d10bc5ffc069ce05308ce3e53f6de09aefe7c7f5e65e82a5ea4

Download Submit
C:\Windows\System\GrGFzfS.exe

Filesize
1.7MB

MD5
70a22778a8cac9881b38bc65787f2721

SHA1
59238ee4d6e03489efd10532388979e0834fb380

SHA256
d11dfd78624123a8a87512d287e6b074ded7294a597697bd78c1364a7f527803

SHA512
686618555d8d1ba10bf758e3c789e4251097be18e9fcd0dd35a0c0abd6ea29b5aa03af011ae0bf29ad8351581f31c4bb17c24cb1043766ae18e81214483ad906

Download Submit
C:\Windows\System\KCfSovZ.exe

Filesize
1.7MB

MD5
b7cd9e0fe5af7fe1938020b7605ca6c6

SHA1
1f9633b7b81defc541ffbded5ac981b4ec30254e

SHA256
700671131d5427b778985dc2ed5a91b26164f77d6a6c3d8062e15481fd84a07c

SHA512
82d0bd47a350a4b24e3da8153035a19c26dfc31bb045691b89bf9aae6d8d1820b9f037408c8a345106a57f542a4bfa0cf0d3c614c11a218e849d581a9492213f

Download Submit
C:\Windows\System\LPdlsiN.exe

Filesize
1.7MB

MD5
5c37cdc49712f07fa3be11f1dd369157

SHA1
cf21057fdda09ffdb1bb802e6b1ec8d6c50d5456

SHA256
053339afbaa4a6ba04c7fa106e8ee9d2e0ccf19b4b8e3bd83ac5782f12944c69

SHA512
90d069497e62567efcfd626b612f44318c633b14b93c68ab289859599ce9ac761e2b7cb02fffb7058795f5f464a656b60a6fd59bb61ec3ab88908ba7abe6b6d1

Download Submit
C:\Windows\System\LcgtJJA.exe

Filesize
1.7MB

MD5
214cfc8c4e673b184c5b954616e3e1ce

SHA1
c92d238e296941673bd69583424607bea484a757

SHA256
c5afa167cb5cbf3a8b236f466d65e6061cdf7c81c0a31ac77c9c0e4429972af7

SHA512
7f691f2213ddd0d57380d424c9a3bb4ca3807ef90334f4ca8cf74941b040934bd98da61a20ff36bd3f8392094c7054d68aba55bd4fe0aa41f58c0b9ede9f6105

Download Submit
C:\Windows\System\LmbzPLN.exe

Filesize
1.7MB

MD5
7cc39787c837c11dc5b809360d8cd006

SHA1
25dea7c0469842f95d643722a0f5a106d35f965e

SHA256
0039f56b9ff82e9f7b8204810de7aaee4065546ec8e30b04d15d708badb39432

SHA512
d799d9632ebc69c37d5e1def50604114d25a739b22dca72e693eec59c0799d6afe6ad51deecfec84c7d1f9805427b7b42751612d08b40d90901adc548c475abf

Download Submit
C:\Windows\System\MHlhDow.exe

Filesize
8B

MD5
35b23d571bbad4492faca789c3ae9e51

SHA1
adce24f573b6f217562802fd70c52d63ff8f138a

SHA256
3a560e0248da85dda9072e5a99566240ff722f60e9e834efc9c2c23440409d68

SHA512
9c03280067c140373673e9c5ab78127be909959b13e02da8c3ebcce17541a63329fa3cb35a4d2a7b2bb1a50a364108f4e9b1ca429acacd7bf3a5a9d83fb6ba39

Download Submit
C:\Windows\System\NoEhfaA.exe

Filesize
1.7MB

MD5
e0581112ea7904cbb50652c0d7bc185c

SHA1
7f40c1e4d041af8b690f6d78a75a06902bd0630a

SHA256
ddb9c02891632c836efc21e98f5932dbfc03e10a9d7498e8c92bd9da564b9078

SHA512
cd44f255a5f69707792820587edf8fffb5e242bd247213bd18c44723241f59fd0585f82872da92628db73c06d4a8a7353900afa51690e145b3280166d6efa0cd

Download Submit
C:\Windows\System\OGELnWn.exe

Filesize
1.7MB

MD5
cffd8d01058e3b63e39278185c7862d6

SHA1
0a93476524f0759d3d871afd9d939511bc833585

SHA256
746a1112da006b918837d90e764fe53e8f863490af91a8340a5bbc0041ae2ea9

SHA512
be60e4a0049db601b3748873a730218d2731c9f9b33ea6b1c70b78826ceb52ed5a7240171d8dfdb7890764ea5a187c9a2d1e1076d3e9c91eb1651b533662470c

Download Submit
C:\Windows\System\OhrwMWf.exe

Filesize
1.7MB

MD5
6a43867f4f4ce40027efd1020e922a21

SHA1
0901f3d14ab941b083f7d51d52e6461931641c19

SHA256
fc4e28a1511a2e81a530436e190e2c8cd2a791b97932de157e61f2718c5bb11e

SHA512
1af9bd1a5f6bb64602d984e6dd06ea275d0e846317966c5996c3999d1c5b15cfd73834b67651bb896f14a6b6e470a5d6693366fafc3d1a8a21c7e94a5047562c

Download Submit
C:\Windows\System\OpwtmJV.exe

Filesize
1.7MB

MD5
dd556bfab002663eeb5c742f040036dd

SHA1
5d0b090349e295870a310a944b8237e31b70e2a4

SHA256
8740ff6cfc3b39c9842970f49843cf3c7ca206519284368c8e78c705b65ddbfa

SHA512
3730e7872ae30a07212bca361c858ad2ab746af9b008b7735a1dea5be3b4b8808182be8cf294607c4d778b92ac176ffd3f6bb4f442a1ef3a6874979020991080

Download Submit
C:\Windows\System\QgsrlVE.exe

Filesize
1.7MB

MD5
992cc6f483f3b80c8a54227760401acd

SHA1
d73f5ad256b5bc66a015dd38a77b237586548090

SHA256
ee379ee6a133620581fbb048d34cbdaa88323e8bdead5725ee76e39d39096e23

SHA512
44c5d803485374faa976bfb4ee4e44b2a96a99c87130d2ee877d7b1e302d120028a9bfc2dd2c2c23f0c20ca97d901cb612210a7b2315f38158e1fd9314c86a9f

Download Submit
C:\Windows\System\RXcHNzA.exe

Filesize
1.7MB

MD5
8da1bae663ca0ec38502c2d59018325b

SHA1
6e9bc926765d40b057ba5281e848e845bbfe9489

SHA256
5222d93581397da822b77761dcf2af468b3b7b815eceea07db5c60f9b595a0ff

SHA512
9f89817440ce06567b1ba53e7abbfe941a42521493c48ca5593c132b9fe69024273e58ae3f158f5b6c2181f53c9976f006248fff7cbf23e25102388f10320dc8

Download Submit
C:\Windows\System\SgacnIj.exe

Filesize
1.7MB

MD5
7566c624f93a860f4b6caecabf164250

SHA1
23404d6d89f7a76a30d1f5c495a11316b0462a1d

SHA256
9ec112c2aa3993b390a8ba8dd437e22fe06a2b7638e7dacaabe59e8bd5d77c60

SHA512
c76889db09886cc324a42236d7abe9f79fdcf599a1dbab3ccf012c454c9c1206afa4bdfc2815ffb7b72ee89cff05216a43a336b9eef3108b03b6a21e33328416

Download Submit
C:\Windows\System\WJVAxql.exe

Filesize
1.7MB

MD5
49e7c563826730474375ae2e7e0ba968

SHA1
99c51c4c3833bf57eaea1488d4c3162ee55c29d7

SHA256
3261b11927dc328b163a36d437b273dd16c42389f49ba75032dd521c761f6672

SHA512
1438a610b0a8cb3f3cb957d7aba1bdb2c908211caeb0ee9811ba28ff9e12a77bfd44a15916727155a96bd83c0ade0c1a512cfb7fae5fd6cf258fb16f2aa78245

Download Submit
C:\Windows\System\Wpughmt.exe

Filesize
1.7MB

MD5
e7d117c3bba50ef7986b467ce3dc598b

SHA1
bd61051274424ebbfeb579344012a0b1ced041ab

SHA256
92a7fe545bbebc8de52a64955f5ed3e18d6f8a3c46f4655e348e42456f817ee6

SHA512
50e34e9617d1a24a08a441113a5d0ef3a4f9ff1ae5b66462fd7f2d9db235a9ebf932ef0c19b9308b9e11bb7c8229c4be997404dc21991e2588d1392ff497a953

Download Submit
C:\Windows\System\XPLEqFh.exe

Filesize
1.7MB

MD5
e3f228a8235ab60c1ba900af3891fc5d

SHA1
1a76d74401e1572e2f308424ff470ea62f92feea

SHA256
ea2e1dcdbb5928e95afe13860e39511366bc565b74bf66dc09490e553d53190f

SHA512
08b8486a2aa0cc142a71d0bed483e44a12bdf80191c5508e2fd21772b655c915c2abcc51ca777de6c241a33d81dd1f90edadb53a9ebaa0738325195777089b4d

Download Submit
C:\Windows\System\XUSpaNX.exe

Filesize
1.7MB

MD5
252a596105f3807ba86aedefa94e2e8a

SHA1
2c1a937dd2e0ff44e0be598a9503dc7c705fb78c

SHA256
5b16caaa71482584dcc4a93f7808ef7883a1f1365ede8230703a097ae665f9a9

SHA512
888541275a5e91e4112348a886b62c131251c6fcf49c50e798d379a9e59cb7c9309fcde1226ad61e600c8922f3794739fa1b37c6de82d9dd3fca085ebb0ff2c7

Download Submit
C:\Windows\System\YymhXLQ.exe

Filesize
1.7MB

MD5
da341dab64f60b97f61465da37606419

SHA1
a4259fd480469db30a92a27711c19136c2ac2d83

SHA256
c57e1afbffa5373e66baf8f075bd1489f66c58e4ba949b42a139018930766b14

SHA512
a0c6756d88e9e06a360b84756521db0299bfb261d474c7e4d64343adac624d8bb0c9ca46d483ef5667361954ef7333424df227307160571524b7ca8b42208be0

Download Submit
C:\Windows\System\ZVOuuYL.exe

Filesize
1.7MB

MD5
3d3a6c59db1569e63bf6efd4113727de

SHA1
9a04bd06c30e9ff69f44f4680ab02a06f168ba81

SHA256
b302a07aceb71e5589bf203ac8e6d8319dacb741732db3be5ac07b6f6cb87b12

SHA512
71415aae047e0ddbd5bf6f21abef212461b5adcb5530f995c7298a9838a0d3999d095268529f2daf9c273e426a9cb7af3e6dd5a661f81311c8417c715f00f5cc

Download Submit
C:\Windows\System\bEBEZoP.exe

Filesize
1.7MB

MD5
ee54ba4c8fd841717e03ce2c403e10c9

SHA1
b47067df63e4f9d90e35f1795daa74d8ed5847ec

SHA256
19cc241c536647d3962ee6eccbd738fdcedf0c0ce117764977c3a74c60295076

SHA512
6f41b8cb94b79d5f7e2f57fcd01aebc862e38be1f995edf0361bb9d7a98ddf4d31c091e92ffb323714e98bcdf22638775ef930a1c4f41e621fad58d578f4942b

Download Submit
C:\Windows\System\cgTywxP.exe

Filesize
1.7MB

MD5
2d8dbd985b211507d331f409f06f3ae2

SHA1
8ba2d4b5e77ef948b1128994de640fa45c9dcb97

SHA256
18e0d70a507cda253543c47301743e683413351f0fb35c5596d5a57e0466874e

SHA512
b32bd3c1db1f9102597c13e36c38dd9006fe4cf6640725cc485401026d818e5c53b2452ec0a142c127ae827370fca66e80872b52e24c06b092ac2842e161efb1

Download Submit
C:\Windows\System\dqWDYUV.exe

Filesize
1.7MB

MD5
5690484a67316be57360b370ebc08e47

SHA1
dbc5cb2fd4ed3e300e606e3c7a0917b4b400b854

SHA256
17487267a38cecbc0507e9d38af6028c1f0904e53910163eeb1535c949638651

SHA512
fe3f56f48f2998eac5202f9e2341ddf755e755053f42cb8c0dbf2f43f913765f6c3c66695eec21e190e8b11bf45ccfc58866e95b64526f3f7c414a361630e542

Download Submit
C:\Windows\System\eVGsMNP.exe

Filesize
1.7MB

MD5
c8089dec4bf800540069e9359f1f7cfa

SHA1
f2b4d125a34cd7698b7612d8ecb490c1818fa8f9

SHA256
efa56301d13b7cba770ed3ce3852248f139c0f9b05bc16a8b10a06316ef1b7be

SHA512
7f722a887d65ab3df31d3646ed24759bb7ac94998beda2d31ba0c4915734e626c02e7eb0a2b1742f2fc7b925faa06b3170e73fc565f88fbf9a40ee95b760b6a6

Download Submit
C:\Windows\System\fDrbylm.exe

Filesize
1.7MB

MD5
d2e590e62a300ee589216bb49e44251b

SHA1
c51f73cdf1c8bba42f359ad77257e2a69ef8af56

SHA256
8ce7b3039c9e2308f0e76f8e241ddfbea5930ac723a65d27c916315e001979ff

SHA512
caa5d8e884e8b39d16b1c5c40a9073ae8f2ab4e305e8dfe83580e472c7d3fddaec60f09ad341670725bb01ad04b7b44a12bcdf37eb7e1f5c3453de11decd277f

Download Submit
C:\Windows\System\gyQCBQB.exe

Filesize
1.7MB

MD5
d1608169f21c7d2bfd45709657fa5fc5

SHA1
2e0021dc40d5a828319d6a52222e8944d95dd08b

SHA256
73342c897bd9fab02a5f5b73dbdc90f14d7f20a6f1777d87963538926a71f0fa

SHA512
b981436bb7ca2e540dcc2f91aba576818974630f6491bfd377ce94415bca109a119e1236451a31dfa7fdf8d29cb023261e107b9f17b487dc9b5c489d5732f417

Download Submit
C:\Windows\System\hllSUTO.exe

Filesize
1.7MB

MD5
673fa29de82220e3befa20486de8f18e

SHA1
f56d5cb2308c9b8cfe7ac0d568c69ee0f080c616

SHA256
269d8899d328c1b12a117a10738c705e4f34f5e56d7073c0b98663afd88399ca

SHA512
3392fe0eb14582c7e29568aca681d077659ca6ee62f9063a69d3edc0df95015c5d1d9c39de8a5a5dac674f44017beb575f24388479b70e0e2e00bd60e3a7fdce

Download Submit
C:\Windows\System\lQsMXIC.exe

Filesize
1.7MB

MD5
db0f99d2c21812b1ce224ff6c83de82d

SHA1
e422212791e0a0776bb2bfef666eb48ee0939356

SHA256
c097fc787172dc55168985526b28e1a2cb89366a70947cc9b2782116227b870e

SHA512
5ef8845eb3ebf1e80722e39e2fcd4169aaae94c4cb57b6b31b299699d6729e4259e88d964c6a064927f0859d41417e109a452de17674229772fb1f1a1ffa43b1

Download Submit
C:\Windows\System\lhDRepz.exe

Filesize
1.7MB

MD5
46670596d86265de35f1b2a73ce8eb78

SHA1
2daafb4fc0f64a63883aa56dfaf9e7278fd51313

SHA256
b71fd844e03c5006d06d7f03551b4ab4b6c090d665ead59f70a4529ac6e97306

SHA512
8533c7a171b1da2e3e9ed35e2eacb4ebe30abe465e5ea15c9152c3934ea61a63519834b7a9c63016dd3924f835051696c0e867aac768a3be037394a0efd9b4e1

Download Submit
C:\Windows\System\mMNcNSr.exe

Filesize
18B

MD5
1b604118dd653add85591d186ed16083

SHA1
be04a7be4cbfb4f5425c87a4b8318be588d66910

SHA256
8cee1df18a324a2d7eede941f1794df20d96f025ea76e37db2b3adbf486b8e2e

SHA512
669be955020f3eb1cfdd44943f854b319a772426a57944c88693379a0d93507a3c5cbcebb6f65a6e156808261fdd2a3a0a33868894cadf8adc3a0621c40036ad

Download Submit
C:\Windows\System\moRDorb.exe

Filesize
1.7MB

MD5
cd6eb3036c75fa6a0327405febc33b87

SHA1
6e7f90d1eae61d3eddfe75e42c4040a327c681ed

SHA256
065a1aa4b2e9e0c1e19083731fdbb419b01a5a46addac3374c3cd74746e17b2c

SHA512
195a48bdc9569c0bd5ec7324c81b0034384ff1b49cf1f923b6de5f10ea94c0c9b32c889bc7c3d51f0d56165e15c0e25964525f413faec7264713c7f39f9c22a4

Download Submit
C:\Windows\System\mtkGmfP.exe

Filesize
1.7MB

MD5
a3c99eeb27d31a95735eed1028897190

SHA1
5a3ae71e8e68575606872174d56fcf1d74839d9b

SHA256
a8ba03930bae3110ee92187bdcbe09b1d32037dee0a83d9c765c5254d84bac29

SHA512
05b1b04be84b5f105e4be93f7027808713d46748d9ed1a0060ed19ecaa6af7a4f5621a81aca22eea4fa85a331aec0dd65392c3621533894e179508dd06a51305

Download Submit
C:\Windows\System\nGvLdwy.exe

Filesize
1.7MB

MD5
96a46e1d49aed86b58708b16a2b20002

SHA1
dfa03448e946bb2a4c29430847c4065624f53070

SHA256
d184029131ce2af80e51444508f08286ecf819d80955c6b3d208a2cb4470a9ea

SHA512
26df0de4c8d0116891dca105d665184461c57ebb05998b67d3d23215e6a1fc3eeb6bf99269e93b3d6d600ed54057df8b8b26f7709e3d579da1b40b24a1f26056

Download Submit
C:\Windows\System\nWOgoGX.exe

Filesize
1.7MB

MD5
31c3c7d7a5f7eaa886118279241f985d

SHA1
5fa4d32ac416e6db3f27fb249725be3f60e8938c

SHA256
17e97c5989d9555a6b27a7d2e64fe4cdcbd319d4cd033b174390a1f0681d55c6

SHA512
028e642ec01a694c61469334743adff592aa426ab78c7e999983f705f186837045f4a1d3686b4e478141832f3905834a7ae2e5c4141b7c0f86378ae6d73874e4

Download Submit
C:\Windows\System\oPZnxyR.exe

Filesize
1.7MB

MD5
51f49682362067b2dff5f35d0a8d1953

SHA1
7607eb6e4e7ca2d7ec454065d4d3fa390c0d601b

SHA256
0c4fd8bb5eca2c352c20d151c8ec9ffb390110d8dfa70d8dc7071f59b048ec7d

SHA512
8acb51fef3a39fb469503bcb6ee310278700bf92f8b5b60225db91da920bf9161b8f30e2317e9753ca352c71cc6c3e5de44acc29a4df11bef3337c333bc2b62f

Download Submit
C:\Windows\System\oZckNvT.exe

Filesize
1.7MB

MD5
173e3beb306f7bcd72a259625263b0ae

SHA1
6fb7030c7023db70edc4fdf5c37520ad20094966

SHA256
f4b26dd14b23ed5e5eaf59f56abe3c8d12406e06d0f7782c72874ae8a87865b2

SHA512
0e380c7c33dd443696bc0fc1408e0ebb3fdec9223dc5123b2733f7c27a03e9a5e305ff6dcb9c16b64cbc0009cfe74017261df0957ce9dd2d5eee4f4327efb1ce

Download Submit
C:\Windows\System\pNkzXMj.exe

Filesize
1.7MB

MD5
cbbc20657db2eb7d8f0f73e93e371445

SHA1
24b0cb8df3de6a37ae62621740483f33375a8829

SHA256
8bb35f8d58470e04ee4a12606ecadbd9fc36dfa77542d72746c569423ed11f9e

SHA512
c2dd7cf3d8d4c5485f7974b7c7404608d947a6a5d154fd0e6d48472901a5bb497f3e17de0b5b3fec7e8e84b61b0971d7a169e4a0d261f86fe55c47f519571486

Download Submit
C:\Windows\System\rItmPHe.exe

Filesize
1.7MB

MD5
64db425750895fe2add4661c9219055b

SHA1
c153b3ed4727cf5f060eb95be84a27197ed01131

SHA256
2a18caf4ac1def3367eb0d3c093085b07b6c962048507d01f7a7f711c67ea16e

SHA512
ba28f4d4837976f58d400351a16e590ff2be88e224c2e8f02e50046a0ecf1a34e51bf774dc0b31968224121ae319687f2477d706d2ab58d9cd0ec3ce3545f341

Download Submit
C:\Windows\System\sHNoSqH.exe

Filesize
1.7MB

MD5
f4b9c98c6971c62d78c66e0c8a9f0cfd

SHA1
396470a645bbe471fcf785cb9040fefa4d0fbf8d

SHA256
0f323e9ddb6ed13e7ca65e2b9afac5525a894e210f7d06bcce2e3d2de6dcf755

SHA512
8c0f1ccfbfb9e156a38a34a35d22fbf50e4f9b2abb11a3da79f36a6ddcb7239f0fc7e8fabb8350c094a1e479f1b713424a223f13e3d197f06752012beff43463

Download Submit
C:\Windows\System\sQQRUeF.exe

Filesize
1.7MB

MD5
de3fd719c09da36e2e8c33a3878beff8

SHA1
9f995b5f639372bbef84161985379d80d78e5724

SHA256
f278c821ef921af43736a811feff5733c41b58fd1d6506e74809f033b887aba3

SHA512
552a2cf2675d79ff5864cf0b50ca41fc84d0bc8a402c1742e4484e9063a59c6ecda32caad01ec8ad1d86007786e9ee9bce635419de1c0093707ce9c493afc46f

Download Submit
C:\Windows\System\tGhUJuw.exe

Filesize
1.7MB

MD5
3abb5168418d6140b5b5189191c10fbf

SHA1
af7d42e442287e67c3588a0f77d3b6a28b7ec2ad

SHA256
2fc97492dd47b18c40ffd435e888bb02db4781b9f97a5f480c8356cd1e66e596

SHA512
2d979f5ae65a10100e2bd94ee96484a89b025fc71fa0c0096230082456d0ecf85f656a6e118cf73418c446762cd9327354edf33dcd71a5d7ecdd233b184a2372

Download Submit
C:\Windows\System\vOUNvId.exe

Filesize
1.7MB

MD5
642e35081343f95b90c39e6fef42e052

SHA1
1b8982c325d525e4bd14a90117660fd239580825

SHA256
ba18a439d85ec68426663eaa9bb681f286d131a4f6463539f4b4169f2f1b2d9f

SHA512
a1546dce9aeb7c2e58234d155778881c3e4ae56aea9b8d108a9d0165a882b3e1c985102a6dc035795e741d92be6d29f437c02219229859665f24d229af88a6be

Download Submit
C:\Windows\System\zOWTMJU.exe

Filesize
1.7MB

MD5
811ba01853787805fef27d3f5c3fe72b

SHA1
e987254239c781ffd963cf811546ebd51493b680

SHA256
e5708308956ebb797040a4981512388af455969f5130bac3fb398804be762f57

SHA512
f69ff989595e14069b54344da3dd397740915bb36104b4673499e1f36c1ccc30d98fe583bae8b31042760d9d81384dff0f487b6774e6f3ef4e2cf2ccdf9d8c9f

Download Submit
C:\Windows\System\zkaaOiE.exe

Filesize
1.7MB

MD5
e5ef5ce2eaab8ea8af2348abf4070c08

SHA1
e536f4ec0b627fa02f047de104602816293a5f89

SHA256
1927946011a518f0820ebaa5aa6964c739eefd9094a101f0eca7f8fdf5e19d3d

SHA512
a9083acb76b33a2dc46e2017b0d74f7df026a6342784f63e47837805d96ba797ae3fb4cdcca096a97d365e511bded53cbf72af9f75b28a2f26e1a95d7ad53c8c

Download Submit
memory/1040-257-0x00007FF7DE390000-0x00007FF7DE782000-memory.dmp

Filesize
3.9MB

Download
memory/1136-252-0x00007FF7B3E10000-0x00007FF7B4202000-memory.dmp

Filesize
3.9MB

Download
memory/1144-254-0x00007FF6BD860000-0x00007FF6BDC52000-memory.dmp

Filesize
3.9MB

Download
memory/1236-253-0x00007FF606E40000-0x00007FF607232000-memory.dmp

Filesize
3.9MB

Download
memory/1632-511-0x00007FF729A90000-0x00007FF729E82000-memory.dmp

Filesize
3.9MB

Download
memory/1632-5311-0x00007FF729A90000-0x00007FF729E82000-memory.dmp

Filesize
3.9MB

Download
memory/1828-718-0x00007FF644F30000-0x00007FF645322000-memory.dmp

Filesize
3.9MB

Download
memory/2228-247-0x00007FF76AEC0000-0x00007FF76B2B2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-463-0x00007FF6C8AF0000-0x00007FF6C8EE2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-5286-0x00007FF6C8AF0000-0x00007FF6C8EE2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-5081-0x00007FF622210000-0x00007FF622602000-memory.dmp

Filesize
3.9MB

Download
memory/2796-248-0x00007FF622210000-0x00007FF622602000-memory.dmp

Filesize
3.9MB

Download
memory/3112-796-0x00007FF697290000-0x00007FF697682000-memory.dmp

Filesize
3.9MB

Download
memory/3124-395-0x00007FF79F160000-0x00007FF79F552000-memory.dmp

Filesize
3.9MB

Download
memory/3124-5270-0x00007FF79F160000-0x00007FF79F552000-memory.dmp

Filesize
3.9MB

Download
memory/3160-394-0x00007FF6E56D0000-0x00007FF6E5AC2000-memory.dmp

Filesize
3.9MB

Download
memory/3336-1-0x000001F72C210000-0x000001F72C220000-memory.dmp

Filesize
64KB

Download
memory/3336-0-0x00007FF6E6200000-0x00007FF6E65F2000-memory.dmp

Filesize
3.9MB

Download
memory/3728-255-0x00007FF6332B0000-0x00007FF6336A2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-5303-0x00007FF70BC10000-0x00007FF70C002000-memory.dmp

Filesize
3.9MB

Download
memory/3876-579-0x00007FF70BC10000-0x00007FF70C002000-memory.dmp

Filesize
3.9MB

Download
memory/4188-198-0x00007FF676110000-0x00007FF676502000-memory.dmp

Filesize
3.9MB

Download
memory/4248-251-0x00007FF696740000-0x00007FF696B32000-memory.dmp

Filesize
3.9MB

Download
memory/4420-256-0x00007FF736F00000-0x00007FF7372F2000-memory.dmp

Filesize
3.9MB

Download
memory/4472-127-0x00007FF7CAE20000-0x00007FF7CB212000-memory.dmp

Filesize
3.9MB

Download
memory/4560-642-0x00007FF645000000-0x00007FF6453F2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-258-0x00007FF72A3B0000-0x00007FF72A7A2000-memory.dmp

Filesize
3.9MB

Download
memory/4600-249-0x00007FF7B2690000-0x00007FF7B2A82000-memory.dmp

Filesize
3.9MB

Download
memory/4636-185-0x00007FF7CCA60000-0x00007FF7CCE52000-memory.dmp

Filesize
3.9MB

Download
memory/4840-10-0x00007FF66AC10000-0x00007FF66B002000-memory.dmp

Filesize
3.9MB

Download
memory/4840-2558-0x00007FF66AC10000-0x00007FF66B002000-memory.dmp

Filesize
3.9MB

Download
memory/4852-637-0x000001DD9C330000-0x000001DD9C352000-memory.dmp

Filesize
136KB

Download
memory/4852-19-0x00007FFAE2A13000-0x00007FFAE2A15000-memory.dmp

Filesize
8KB

Download
memory/4852-69-0x00007FFAE2A10000-0x00007FFAE34D1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-2321-0x00007FFAE2A10000-0x00007FFAE34D1000-memory.dmp

Filesize
10.8MB

Download
memory/4904-250-0x00007FF782C20000-0x00007FF783012000-memory.dmp

Filesize
3.9MB

Download