xmrig | 2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
Size

1.9MB
MD5

141f24f61df57578ee91b53b44737a93
SHA1

3be2316b1f3765ff92c164e109635d825c02a40b
SHA256

2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42
SHA512

421c4be917909ad696d53e9a7d833a4aa78a7d71c3d8d2db88788e88475c92afa56f7d9bb7c57030b07afcb2e80b311ecb607aae5b4960c7f22abffe025a8e32
SSDEEP

49152:T1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrSax91MkibTIDiH3gPeMr:T1ONtyBeSFkXV1etEKLlWUTOfeiRA2R4

Score

10^/10

xmrig execution miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects executables containing URLs to raw contents of a Github gist 64 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1424-0-0x00007FF69D800000-0x00007FF69DBED000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\QOUzpGE.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1828-40-0x00007FF762840000-0x00007FF762C2D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\rtkEzWa.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2612-21-0x00007FF72C2B0000-0x00007FF72C69D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1812-30-0x00007FF7471E0000-0x00007FF7475CD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\KuILDJr.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\SiONgLg.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\XYCJnoC.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1880-11-0x00007FF788FC0000-0x00007FF7893AD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\BSFNSAH.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/376-200-0x00007FF62F1F0000-0x00007FF62F5DD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/856-196-0x00007FF6EA590000-0x00007FF6EA97D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1528-251-0x00007FF666D80000-0x00007FF66716D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1208-263-0x00007FF698640000-0x00007FF698A2D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4300-247-0x00007FF7C0DD0000-0x00007FF7C11BD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1564-241-0x00007FF69B440000-0x00007FF69B82D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4988-223-0x00007FF7C0980000-0x00007FF7C0D6D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\rkksuro.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\jtdkKoT.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\SEanAsH.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3964-210-0x00007FF7C0D70000-0x00007FF7C115D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\zQIFoiz.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\SrLthws.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\EVdcIgQ.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\nvYkNXe.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2252-193-0x00007FF739580000-0x00007FF73996D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\TdUSAoI.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\sLzakVl.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\IaJTDOc.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4060-187-0x00007FF7C0750000-0x00007FF7C0B3D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4816-179-0x00007FF7DB1D0000-0x00007FF7DB5BD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\xgiydIn.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2760-173-0x00007FF706170000-0x00007FF70655D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\BzmsEpm.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\XVmritU.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\PBVEwUe.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\waqoLlc.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4064-162-0x00007FF7C3060000-0x00007FF7C344D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\xEpGAem.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/404-152-0x00007FF669C90000-0x00007FF66A07D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\iGpQyxm.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\cCMbESY.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4068-207-0x00007FF6E72A0000-0x00007FF6E768D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\yIJcOQo.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\RDOrmEb.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3064-170-0x00007FF60AD90000-0x00007FF60B17D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\fkKAfNA.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3972-133-0x00007FF7CF8A0000-0x00007FF7CFC8D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\pIsFYrN.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\GENGxtI.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1028-122-0x00007FF7E0D00000-0x00007FF7E10ED000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\sTDfTSf.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4316-117-0x00007FF78CA60000-0x00007FF78CE4D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/5084-112-0x00007FF686540000-0x00007FF68692D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\IgseoQQ.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4180-127-0x00007FF68D9A0000-0x00007FF68DD8D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\jBbyipX.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2128-90-0x00007FF7C6A40000-0x00007FF7C6E2D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/832-88-0x00007FF785C80000-0x00007FF78606D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\BQZtsPs.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\RCEnhju.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2816-106-0x00007FF7D3620000-0x00007FF7D3A0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
C:\Windows\System\xjmjqxC.exe	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

XMRig Miner payload 64 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1424-0-0x00007FF69D800000-0x00007FF69DBED000-memory.dmp	xmrig
C:\Windows\System\QOUzpGE.exe	xmrig
behavioral2/memory/1828-40-0x00007FF762840000-0x00007FF762C2D000-memory.dmp	xmrig
C:\Windows\System\rtkEzWa.exe	xmrig
behavioral2/memory/2612-21-0x00007FF72C2B0000-0x00007FF72C69D000-memory.dmp	xmrig
behavioral2/memory/1812-30-0x00007FF7471E0000-0x00007FF7475CD000-memory.dmp	xmrig
C:\Windows\System\KuILDJr.exe	xmrig
C:\Windows\System\SiONgLg.exe	xmrig
C:\Windows\System\XYCJnoC.exe	xmrig
behavioral2/memory/1880-11-0x00007FF788FC0000-0x00007FF7893AD000-memory.dmp	xmrig
C:\Windows\System\BSFNSAH.exe	xmrig
behavioral2/memory/376-200-0x00007FF62F1F0000-0x00007FF62F5DD000-memory.dmp	xmrig
behavioral2/memory/856-196-0x00007FF6EA590000-0x00007FF6EA97D000-memory.dmp	xmrig
behavioral2/memory/1528-251-0x00007FF666D80000-0x00007FF66716D000-memory.dmp	xmrig
behavioral2/memory/1208-263-0x00007FF698640000-0x00007FF698A2D000-memory.dmp	xmrig
behavioral2/memory/4300-247-0x00007FF7C0DD0000-0x00007FF7C11BD000-memory.dmp	xmrig
behavioral2/memory/1564-241-0x00007FF69B440000-0x00007FF69B82D000-memory.dmp	xmrig
behavioral2/memory/4988-223-0x00007FF7C0980000-0x00007FF7C0D6D000-memory.dmp	xmrig
C:\Windows\System\rkksuro.exe	xmrig
C:\Windows\System\jtdkKoT.exe	xmrig
C:\Windows\System\SEanAsH.exe	xmrig
behavioral2/memory/3964-210-0x00007FF7C0D70000-0x00007FF7C115D000-memory.dmp	xmrig
C:\Windows\System\zQIFoiz.exe	xmrig
C:\Windows\System\SrLthws.exe	xmrig
C:\Windows\System\EVdcIgQ.exe	xmrig
C:\Windows\System\nvYkNXe.exe	xmrig
behavioral2/memory/2252-193-0x00007FF739580000-0x00007FF73996D000-memory.dmp	xmrig
C:\Windows\System\TdUSAoI.exe	xmrig
C:\Windows\System\sLzakVl.exe	xmrig
C:\Windows\System\IaJTDOc.exe	xmrig
behavioral2/memory/4060-187-0x00007FF7C0750000-0x00007FF7C0B3D000-memory.dmp	xmrig
behavioral2/memory/4816-179-0x00007FF7DB1D0000-0x00007FF7DB5BD000-memory.dmp	xmrig
C:\Windows\System\xgiydIn.exe	xmrig
behavioral2/memory/2760-173-0x00007FF706170000-0x00007FF70655D000-memory.dmp	xmrig
C:\Windows\System\BzmsEpm.exe	xmrig
C:\Windows\System\XVmritU.exe	xmrig
C:\Windows\System\PBVEwUe.exe	xmrig
C:\Windows\System\waqoLlc.exe	xmrig
behavioral2/memory/4064-162-0x00007FF7C3060000-0x00007FF7C344D000-memory.dmp	xmrig
C:\Windows\System\xEpGAem.exe	xmrig
behavioral2/memory/404-152-0x00007FF669C90000-0x00007FF66A07D000-memory.dmp	xmrig
C:\Windows\System\iGpQyxm.exe	xmrig
C:\Windows\System\cCMbESY.exe	xmrig
behavioral2/memory/4068-207-0x00007FF6E72A0000-0x00007FF6E768D000-memory.dmp	xmrig
C:\Windows\System\yIJcOQo.exe	xmrig
C:\Windows\System\RDOrmEb.exe	xmrig
behavioral2/memory/3064-170-0x00007FF60AD90000-0x00007FF60B17D000-memory.dmp	xmrig
C:\Windows\System\fkKAfNA.exe	xmrig
behavioral2/memory/3972-133-0x00007FF7CF8A0000-0x00007FF7CFC8D000-memory.dmp	xmrig
C:\Windows\System\pIsFYrN.exe	xmrig
C:\Windows\System\GENGxtI.exe	xmrig
behavioral2/memory/1028-122-0x00007FF7E0D00000-0x00007FF7E10ED000-memory.dmp	xmrig
C:\Windows\System\sTDfTSf.exe	xmrig
behavioral2/memory/4316-117-0x00007FF78CA60000-0x00007FF78CE4D000-memory.dmp	xmrig
behavioral2/memory/5084-112-0x00007FF686540000-0x00007FF68692D000-memory.dmp	xmrig
C:\Windows\System\IgseoQQ.exe	xmrig
behavioral2/memory/4180-127-0x00007FF68D9A0000-0x00007FF68DD8D000-memory.dmp	xmrig
C:\Windows\System\jBbyipX.exe	xmrig
behavioral2/memory/2128-90-0x00007FF7C6A40000-0x00007FF7C6E2D000-memory.dmp	xmrig
behavioral2/memory/832-88-0x00007FF785C80000-0x00007FF78606D000-memory.dmp	xmrig
C:\Windows\System\BQZtsPs.exe	xmrig
C:\Windows\System\RCEnhju.exe	xmrig
behavioral2/memory/2816-106-0x00007FF7D3620000-0x00007FF7D3A0D000-memory.dmp	xmrig
C:\Windows\System\xjmjqxC.exe	xmrig

Blocklisted process makes network request 31 IoCs

Processes:

powershell.exe

flow	pid	process
5	4184	powershell.exe
9	4184	powershell.exe
16	4184	powershell.exe
17	4184	powershell.exe
20	4184	powershell.exe
22	4184	powershell.exe
23	4184	powershell.exe
24	4184	powershell.exe
25	4184	powershell.exe
28	4184	powershell.exe
30	4184	powershell.exe
31	4184	powershell.exe
32	4184	powershell.exe
33	4184	powershell.exe
34	4184	powershell.exe
35	4184	powershell.exe
36	4184	powershell.exe
37	4184	powershell.exe
38	4184	powershell.exe
39	4184	powershell.exe
40	4184	powershell.exe
42	4184	powershell.exe
43	4184	powershell.exe
44	4184	powershell.exe
45	4184	powershell.exe
46	4184	powershell.exe
47	4184	powershell.exe
48	4184	powershell.exe
49	4184	powershell.exe
50	4184	powershell.exe
51	4184	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4184 powershell.exe

pid	process
4184	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

QOUzpGE.exertkEzWa.exeXYCJnoC.exeKuILDJr.exeSiONgLg.exeIgseoQQ.exeRCEnhju.execqSTJwl.exeFLDpSlW.exexjmjqxC.exeBSFNSAH.exesTDfTSf.exejBbyipX.exeTdUSAoI.exeSrLthws.exeBQZtsPs.exeiGpQyxm.exepIsFYrN.exePBVEwUe.exenvYkNXe.exeEVdcIgQ.exerkksuro.exexEpGAem.exefkKAfNA.exeXVmritU.exexgiydIn.exeyIJcOQo.exezQIFoiz.execCMbESY.exeGENGxtI.exewaqoLlc.exeBzmsEpm.exeRDOrmEb.exeIaJTDOc.exesLzakVl.exeSEanAsH.exejtdkKoT.exeaPDbaBk.exegsBIVTv.exeAGeABpo.exevuGVlNv.exeWEsUpel.exeOQFohLx.exeRAZDJvF.exeyJKeYgC.exeQDnSlzS.exejVMmMCQ.exexEnKmuk.exeXrimrEX.exetxvityl.exenxJixLm.exeJpxyvNQ.exevsBsNIZ.exePTsZXpe.exewdLkfKQ.exemwLGvvh.exefWkvnLg.exeUmxTtLF.exeMzijVCJ.exeoNmWrJB.exexdmffbJ.exedEEeLwJ.exeRwiyaOa.exengQGTOm.exe

pid	process
1880	QOUzpGE.exe
1828	rtkEzWa.exe
2612	XYCJnoC.exe
1812	KuILDJr.exe
4692	SiONgLg.exe
5084	IgseoQQ.exe
2128	RCEnhju.exe
1692	cqSTJwl.exe
4000	FLDpSlW.exe
2816	xjmjqxC.exe
4316	BSFNSAH.exe
1028	sTDfTSf.exe
4180	jBbyipX.exe
2252	TdUSAoI.exe
4068	SrLthws.exe
832	BQZtsPs.exe
404	iGpQyxm.exe
3972	pIsFYrN.exe
3064	PBVEwUe.exe
856	nvYkNXe.exe
376	EVdcIgQ.exe
1384	rkksuro.exe
4064	xEpGAem.exe
4988	fkKAfNA.exe
2760	XVmritU.exe
4816	xgiydIn.exe
4060	yIJcOQo.exe
3964	zQIFoiz.exe
1208	cCMbESY.exe
1048	GENGxtI.exe
1532	waqoLlc.exe
1496	BzmsEpm.exe
1564	RDOrmEb.exe
1528	IaJTDOc.exe
2284	sLzakVl.exe
3348	SEanAsH.exe
4116	jtdkKoT.exe
4944	aPDbaBk.exe
3792	gsBIVTv.exe
3356	AGeABpo.exe
388	vuGVlNv.exe
4984	WEsUpel.exe
4300	OQFohLx.exe
3804	RAZDJvF.exe
2908	yJKeYgC.exe
1924	QDnSlzS.exe
2140	jVMmMCQ.exe
4436	xEnKmuk.exe
4276	XrimrEX.exe
4432	txvityl.exe
2472	nxJixLm.exe
3112	JpxyvNQ.exe
3544	vsBsNIZ.exe
3172	PTsZXpe.exe
3264	wdLkfKQ.exe
4080	mwLGvvh.exe
512	fWkvnLg.exe
4324	UmxTtLF.exe
4092	MzijVCJ.exe
3256	oNmWrJB.exe
2744	xdmffbJ.exe
880	dEEeLwJ.exe
1936	RwiyaOa.exe
2000	ngQGTOm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 raw.githubusercontent.com
5 raw.githubusercontent.com

flow	ioc
3	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe

description	ioc	process
File created	C:\Windows\System\RbFsgMT.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\jnDSMaK.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\GVUbizI.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\xrqDlrr.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\CPSowiE.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\vaYvXKd.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\dsrUnYI.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\qVJwkhJ.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\SKgVNJt.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\RZMGBFM.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\IywMJCu.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\dsXmSCM.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\dAUKsQu.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\skPfEKj.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\gDyVlBd.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\BbUSCCH.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\sGHYXej.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\ZWOrszi.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\tByHTDT.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\PCQPidw.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\blYvGRL.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\StUlyQl.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\niOIyul.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\cpTvVUu.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\TYUuEkL.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\rGpAGyl.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\fVFhGBM.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\EfSzcDo.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\lXQOlPr.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\TDKrsRU.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\JTFGcVm.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\LJAqtQt.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\HlRzdJN.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\rAXkfNQ.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\LCnGiXb.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\cFNaKJO.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\DqtatXw.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\DOxnahB.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\OCbNyUo.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\zDfMQKb.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\kGvDZqe.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\xlKrrJu.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\rUXdlfb.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\jOuXstc.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\WpKiLai.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\iihOswm.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\gOmdgaC.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\JltkRvT.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\SUWKUUB.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\mSDSdJa.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\jrEdjyg.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\OFccGhu.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\iZLJnOa.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\jsIsaOV.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\EoKbiyF.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\hlJDAAT.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\lYbcKmi.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\KPiweES.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\RCHoOFZ.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\UuxkczA.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\uAVMvib.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\vGxxkkb.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\aScyomp.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
File created	C:\Windows\System\ZedPRIA.exe	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe

pid process

4184 powershell.exe
4184 powershell.exe
4184 powershell.exe
4184 powershell.exe

pid	process
4184	powershell.exe
4184	powershell.exe
4184	powershell.exe
4184	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeLockMemoryPrivilege	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe

description	pid	process	target process
PID 1424 wrote to memory of 4184	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	powershell.exe
PID 1424 wrote to memory of 4184	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	powershell.exe
PID 1424 wrote to memory of 1880	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	QOUzpGE.exe
PID 1424 wrote to memory of 1880	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	QOUzpGE.exe
PID 1424 wrote to memory of 1828	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	rtkEzWa.exe
PID 1424 wrote to memory of 1828	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	rtkEzWa.exe
PID 1424 wrote to memory of 2612	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	XYCJnoC.exe
PID 1424 wrote to memory of 2612	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	XYCJnoC.exe
PID 1424 wrote to memory of 1812	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	KuILDJr.exe
PID 1424 wrote to memory of 1812	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	KuILDJr.exe
PID 1424 wrote to memory of 4692	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	SiONgLg.exe
PID 1424 wrote to memory of 4692	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	SiONgLg.exe
PID 1424 wrote to memory of 1692	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	cqSTJwl.exe
PID 1424 wrote to memory of 1692	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	cqSTJwl.exe
PID 1424 wrote to memory of 4000	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	FLDpSlW.exe
PID 1424 wrote to memory of 4000	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	FLDpSlW.exe
PID 1424 wrote to memory of 5084	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	IgseoQQ.exe
PID 1424 wrote to memory of 5084	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	IgseoQQ.exe
PID 1424 wrote to memory of 2128	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	RCEnhju.exe
PID 1424 wrote to memory of 2128	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	RCEnhju.exe
PID 1424 wrote to memory of 2816	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	xjmjqxC.exe
PID 1424 wrote to memory of 2816	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	xjmjqxC.exe
PID 1424 wrote to memory of 4316	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	BSFNSAH.exe
PID 1424 wrote to memory of 4316	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	BSFNSAH.exe
PID 1424 wrote to memory of 1028	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	sTDfTSf.exe
PID 1424 wrote to memory of 1028	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	sTDfTSf.exe
PID 1424 wrote to memory of 4180	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	jBbyipX.exe
PID 1424 wrote to memory of 4180	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	jBbyipX.exe
PID 1424 wrote to memory of 2252	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	TdUSAoI.exe
PID 1424 wrote to memory of 2252	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	TdUSAoI.exe
PID 1424 wrote to memory of 4068	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	SrLthws.exe
PID 1424 wrote to memory of 4068	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	SrLthws.exe
PID 1424 wrote to memory of 376	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	EVdcIgQ.exe
PID 1424 wrote to memory of 376	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	EVdcIgQ.exe
PID 1424 wrote to memory of 832	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	BQZtsPs.exe
PID 1424 wrote to memory of 832	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	BQZtsPs.exe
PID 1424 wrote to memory of 404	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	iGpQyxm.exe
PID 1424 wrote to memory of 404	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	iGpQyxm.exe
PID 1424 wrote to memory of 3972	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	pIsFYrN.exe
PID 1424 wrote to memory of 3972	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	pIsFYrN.exe
PID 1424 wrote to memory of 4064	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	xEpGAem.exe
PID 1424 wrote to memory of 4064	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	xEpGAem.exe
PID 1424 wrote to memory of 3064	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	PBVEwUe.exe
PID 1424 wrote to memory of 3064	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	PBVEwUe.exe
PID 1424 wrote to memory of 856	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	nvYkNXe.exe
PID 1424 wrote to memory of 856	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	nvYkNXe.exe
PID 1424 wrote to memory of 1208	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	cCMbESY.exe
PID 1424 wrote to memory of 1208	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	cCMbESY.exe
PID 1424 wrote to memory of 1384	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	rkksuro.exe
PID 1424 wrote to memory of 1384	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	rkksuro.exe
PID 1424 wrote to memory of 4988	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	fkKAfNA.exe
PID 1424 wrote to memory of 4988	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	fkKAfNA.exe
PID 1424 wrote to memory of 2760	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	XVmritU.exe
PID 1424 wrote to memory of 2760	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	XVmritU.exe
PID 1424 wrote to memory of 4816	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	xgiydIn.exe
PID 1424 wrote to memory of 4816	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	xgiydIn.exe
PID 1424 wrote to memory of 4060	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	yIJcOQo.exe
PID 1424 wrote to memory of 4060	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	yIJcOQo.exe
PID 1424 wrote to memory of 3964	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	zQIFoiz.exe
PID 1424 wrote to memory of 3964	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	zQIFoiz.exe
PID 1424 wrote to memory of 1048	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	GENGxtI.exe
PID 1424 wrote to memory of 1048	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	GENGxtI.exe
PID 1424 wrote to memory of 1532	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	waqoLlc.exe
PID 1424 wrote to memory of 1532	1424	2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe	waqoLlc.exe

C:\Users\Admin\AppData\Local\Temp\2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe
"C:\Users\Admin\AppData\Local\Temp\2e9f3813bb4ad5a29067000e2d0935ea1f284f60ccbe74cb858f8bd2b242ab42.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4184
- C:\Windows\System\QOUzpGE.exe
  C:\Windows\System\QOUzpGE.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\rtkEzWa.exe
  C:\Windows\System\rtkEzWa.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\XYCJnoC.exe
  C:\Windows\System\XYCJnoC.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\KuILDJr.exe
  C:\Windows\System\KuILDJr.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\SiONgLg.exe
  C:\Windows\System\SiONgLg.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\cqSTJwl.exe
  C:\Windows\System\cqSTJwl.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\FLDpSlW.exe
  C:\Windows\System\FLDpSlW.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\IgseoQQ.exe
  C:\Windows\System\IgseoQQ.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\RCEnhju.exe
  C:\Windows\System\RCEnhju.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\xjmjqxC.exe
  C:\Windows\System\xjmjqxC.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\BSFNSAH.exe
  C:\Windows\System\BSFNSAH.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\sTDfTSf.exe
  C:\Windows\System\sTDfTSf.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\jBbyipX.exe
  C:\Windows\System\jBbyipX.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\TdUSAoI.exe
  C:\Windows\System\TdUSAoI.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\SrLthws.exe
  C:\Windows\System\SrLthws.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\EVdcIgQ.exe
  C:\Windows\System\EVdcIgQ.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\BQZtsPs.exe
  C:\Windows\System\BQZtsPs.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\iGpQyxm.exe
  C:\Windows\System\iGpQyxm.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\pIsFYrN.exe
  C:\Windows\System\pIsFYrN.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\xEpGAem.exe
  C:\Windows\System\xEpGAem.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\PBVEwUe.exe
  C:\Windows\System\PBVEwUe.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\nvYkNXe.exe
  C:\Windows\System\nvYkNXe.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\cCMbESY.exe
  C:\Windows\System\cCMbESY.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\rkksuro.exe
  C:\Windows\System\rkksuro.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\fkKAfNA.exe
  C:\Windows\System\fkKAfNA.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\XVmritU.exe
  C:\Windows\System\XVmritU.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\xgiydIn.exe
  C:\Windows\System\xgiydIn.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\yIJcOQo.exe
  C:\Windows\System\yIJcOQo.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\zQIFoiz.exe
  C:\Windows\System\zQIFoiz.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\GENGxtI.exe
  C:\Windows\System\GENGxtI.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\waqoLlc.exe
  C:\Windows\System\waqoLlc.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\BzmsEpm.exe
  C:\Windows\System\BzmsEpm.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\RDOrmEb.exe
  C:\Windows\System\RDOrmEb.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\IaJTDOc.exe
  C:\Windows\System\IaJTDOc.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\sLzakVl.exe
  C:\Windows\System\sLzakVl.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\yJKeYgC.exe
  C:\Windows\System\yJKeYgC.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\SEanAsH.exe
  C:\Windows\System\SEanAsH.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\XrimrEX.exe
  C:\Windows\System\XrimrEX.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\jtdkKoT.exe
  C:\Windows\System\jtdkKoT.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\aPDbaBk.exe
  C:\Windows\System\aPDbaBk.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\gsBIVTv.exe
  C:\Windows\System\gsBIVTv.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\AGeABpo.exe
  C:\Windows\System\AGeABpo.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\vuGVlNv.exe
  C:\Windows\System\vuGVlNv.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\WEsUpel.exe
  C:\Windows\System\WEsUpel.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\OQFohLx.exe
  C:\Windows\System\OQFohLx.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\xdmffbJ.exe
  C:\Windows\System\xdmffbJ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\RAZDJvF.exe
  C:\Windows\System\RAZDJvF.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\QDnSlzS.exe
  C:\Windows\System\QDnSlzS.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\jVMmMCQ.exe
  C:\Windows\System\jVMmMCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\xEnKmuk.exe
  C:\Windows\System\xEnKmuk.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\txvityl.exe
  C:\Windows\System\txvityl.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\nxJixLm.exe
  C:\Windows\System\nxJixLm.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\JpxyvNQ.exe
  C:\Windows\System\JpxyvNQ.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\vsBsNIZ.exe
  C:\Windows\System\vsBsNIZ.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\PTsZXpe.exe
  C:\Windows\System\PTsZXpe.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\wdLkfKQ.exe
  C:\Windows\System\wdLkfKQ.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\mwLGvvh.exe
  C:\Windows\System\mwLGvvh.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\fWkvnLg.exe
  C:\Windows\System\fWkvnLg.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\UmxTtLF.exe
  C:\Windows\System\UmxTtLF.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\MzijVCJ.exe
  C:\Windows\System\MzijVCJ.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\oNmWrJB.exe
  C:\Windows\System\oNmWrJB.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\dEEeLwJ.exe
  C:\Windows\System\dEEeLwJ.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\RwiyaOa.exe
  C:\Windows\System\RwiyaOa.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\ngQGTOm.exe
  C:\Windows\System\ngQGTOm.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\UKIhZdd.exe
  C:\Windows\System\UKIhZdd.exe
  2⤵
  PID:4668
- C:\Windows\System\iLMYbiq.exe
  C:\Windows\System\iLMYbiq.exe
  2⤵
  PID:5132
- C:\Windows\System\vVWixqg.exe
  C:\Windows\System\vVWixqg.exe
  2⤵
  PID:5156
- C:\Windows\System\IXjjrCn.exe
  C:\Windows\System\IXjjrCn.exe
  2⤵
  PID:5292
- C:\Windows\System\GzrHDNN.exe
  C:\Windows\System\GzrHDNN.exe
  2⤵
  PID:5320
- C:\Windows\System\ZfRUuXw.exe
  C:\Windows\System\ZfRUuXw.exe
  2⤵
  PID:5356
- C:\Windows\System\PYxUfCJ.exe
  C:\Windows\System\PYxUfCJ.exe
  2⤵
  PID:5384
- C:\Windows\System\IMlhahW.exe
  C:\Windows\System\IMlhahW.exe
  2⤵
  PID:5416
- C:\Windows\System\ATGwrfg.exe
  C:\Windows\System\ATGwrfg.exe
  2⤵
  PID:5640
- C:\Windows\System\qmkglCn.exe
  C:\Windows\System\qmkglCn.exe
  2⤵
  PID:5688
- C:\Windows\System\eBXguEp.exe
  C:\Windows\System\eBXguEp.exe
  2⤵
  PID:5712
- C:\Windows\System\GmAqvNX.exe
  C:\Windows\System\GmAqvNX.exe
  2⤵
  PID:5744
- C:\Windows\System\nnwBtZM.exe
  C:\Windows\System\nnwBtZM.exe
  2⤵
  PID:5764
- C:\Windows\System\ipEYBio.exe
  C:\Windows\System\ipEYBio.exe
  2⤵
  PID:5784
- C:\Windows\System\xaFsIQH.exe
  C:\Windows\System\xaFsIQH.exe
  2⤵
  PID:5804
- C:\Windows\System\PlkniKZ.exe
  C:\Windows\System\PlkniKZ.exe
  2⤵
  PID:5824
- C:\Windows\System\lAdTzSc.exe
  C:\Windows\System\lAdTzSc.exe
  2⤵
  PID:1836
- C:\Windows\System\ooFUMBM.exe
  C:\Windows\System\ooFUMBM.exe
  2⤵
  PID:1072
- C:\Windows\System\KclwgIj.exe
  C:\Windows\System\KclwgIj.exe
  2⤵
  PID:2124
- C:\Windows\System\evKfBNf.exe
  C:\Windows\System\evKfBNf.exe
  2⤵
  PID:1712
- C:\Windows\System\NOscqOI.exe
  C:\Windows\System\NOscqOI.exe
  2⤵
  PID:2116
- C:\Windows\System\QbTwheU.exe
  C:\Windows\System\QbTwheU.exe
  2⤵
  PID:4916
- C:\Windows\System\LTQqoEn.exe
  C:\Windows\System\LTQqoEn.exe
  2⤵
  PID:4356
- C:\Windows\System\GYzDAxA.exe
  C:\Windows\System\GYzDAxA.exe
  2⤵
  PID:4664
- C:\Windows\System\XmVKgeW.exe
  C:\Windows\System\XmVKgeW.exe
  2⤵
  PID:5128
- C:\Windows\System\TZjsjQX.exe
  C:\Windows\System\TZjsjQX.exe
  2⤵
  PID:5224
- C:\Windows\System\BpbumXs.exe
  C:\Windows\System\BpbumXs.exe
  2⤵
  PID:5248
- C:\Windows\System\dhfUOpw.exe
  C:\Windows\System\dhfUOpw.exe
  2⤵
  PID:5280
- C:\Windows\System\VbsQdbR.exe
  C:\Windows\System\VbsQdbR.exe
  2⤵
  PID:5312
- C:\Windows\System\mhWUCuz.exe
  C:\Windows\System\mhWUCuz.exe
  2⤵
  PID:5376
- C:\Windows\System\cFVCaNR.exe
  C:\Windows\System\cFVCaNR.exe
  2⤵
  PID:5404
- C:\Windows\System\azHGaGK.exe
  C:\Windows\System\azHGaGK.exe
  2⤵
  PID:5432
- C:\Windows\System\CJJOtlg.exe
  C:\Windows\System\CJJOtlg.exe
  2⤵
  PID:5496
- C:\Windows\System\nPhsIex.exe
  C:\Windows\System\nPhsIex.exe
  2⤵
  PID:5548
- C:\Windows\System\MrLVmyM.exe
  C:\Windows\System\MrLVmyM.exe
  2⤵
  PID:5592
- C:\Windows\System\KZvefsq.exe
  C:\Windows\System\KZvefsq.exe
  2⤵
  PID:5620
- C:\Windows\System\XtFUkJX.exe
  C:\Windows\System\XtFUkJX.exe
  2⤵
  PID:5664
- C:\Windows\System\CxfHXme.exe
  C:\Windows\System\CxfHXme.exe
  2⤵
  PID:5696
- C:\Windows\System\BloRQao.exe
  C:\Windows\System\BloRQao.exe
  2⤵
  PID:5776
- C:\Windows\System\uOjQMem.exe
  C:\Windows\System\uOjQMem.exe
  2⤵
  PID:1192
- C:\Windows\System\kVDfrzn.exe
  C:\Windows\System\kVDfrzn.exe
  2⤵
  PID:5876
- C:\Windows\System\ySpvOYv.exe
  C:\Windows\System\ySpvOYv.exe
  2⤵
  PID:5932
- C:\Windows\System\xbEMSjM.exe
  C:\Windows\System\xbEMSjM.exe
  2⤵
  PID:5968
- C:\Windows\System\oXWiqXb.exe
  C:\Windows\System\oXWiqXb.exe
  2⤵
  PID:6048
- C:\Windows\System\hytgRnC.exe
  C:\Windows\System\hytgRnC.exe
  2⤵
  PID:6072
- C:\Windows\System\whOQxeC.exe
  C:\Windows\System\whOQxeC.exe
  2⤵
  PID:6112
- C:\Windows\System\LRSWrBE.exe
  C:\Windows\System\LRSWrBE.exe
  2⤵
  PID:2916
- C:\Windows\System\QwQtYCl.exe
  C:\Windows\System\QwQtYCl.exe
  2⤵
  PID:3268
- C:\Windows\System\YDHAhcY.exe
  C:\Windows\System\YDHAhcY.exe
  2⤵
  PID:2332
- C:\Windows\System\OOuCzea.exe
  C:\Windows\System\OOuCzea.exe
  2⤵
  PID:1392
- C:\Windows\System\dgICJXj.exe
  C:\Windows\System\dgICJXj.exe
  2⤵
  PID:1640
- C:\Windows\System\uCZLBBH.exe
  C:\Windows\System\uCZLBBH.exe
  2⤵
  PID:4848
- C:\Windows\System\oPWWfJJ.exe
  C:\Windows\System\oPWWfJJ.exe
  2⤵
  PID:548
- C:\Windows\System\lyLkwyK.exe
  C:\Windows\System\lyLkwyK.exe
  2⤵
  PID:3820
- C:\Windows\System\jksWkzj.exe
  C:\Windows\System\jksWkzj.exe
  2⤵
  PID:5092
- C:\Windows\System\CMaAGjw.exe
  C:\Windows\System\CMaAGjw.exe
  2⤵
  PID:4140
- C:\Windows\System\SSaqJkU.exe
  C:\Windows\System\SSaqJkU.exe
  2⤵
  PID:3108
- C:\Windows\System\QvfvGYy.exe
  C:\Windows\System\QvfvGYy.exe
  2⤵
  PID:3868
- C:\Windows\System\xojukXA.exe
  C:\Windows\System\xojukXA.exe
  2⤵
  PID:720
- C:\Windows\System\XbUJKIL.exe
  C:\Windows\System\XbUJKIL.exe
  2⤵
  PID:5108
- C:\Windows\System\CfWewmP.exe
  C:\Windows\System\CfWewmP.exe
  2⤵
  PID:1872
- C:\Windows\System\elSfdRS.exe
  C:\Windows\System\elSfdRS.exe
  2⤵
  PID:5112
- C:\Windows\System\KJXUTcv.exe
  C:\Windows\System\KJXUTcv.exe
  2⤵
  PID:2308
- C:\Windows\System\tojnTFZ.exe
  C:\Windows\System\tojnTFZ.exe
  2⤵
  PID:2312
- C:\Windows\System\fSJdTBN.exe
  C:\Windows\System\fSJdTBN.exe
  2⤵
  PID:452
- C:\Windows\System\UjoiQNc.exe
  C:\Windows\System\UjoiQNc.exe
  2⤵
  PID:5268
- C:\Windows\System\KMGyfjk.exe
  C:\Windows\System\KMGyfjk.exe
  2⤵
  PID:5288
- C:\Windows\System\jozLFNG.exe
  C:\Windows\System\jozLFNG.exe
  2⤵
  PID:5204
- C:\Windows\System\BCMrhbs.exe
  C:\Windows\System\BCMrhbs.exe
  2⤵
  PID:5480
- C:\Windows\System\NOdNBne.exe
  C:\Windows\System\NOdNBne.exe
  2⤵
  PID:5176
- C:\Windows\System\VEJnGAs.exe
  C:\Windows\System\VEJnGAs.exe
  2⤵
  PID:5648
- C:\Windows\System\fdljUxF.exe
  C:\Windows\System\fdljUxF.exe
  2⤵
  PID:5424
- C:\Windows\System\fnVRyMt.exe
  C:\Windows\System\fnVRyMt.exe
  2⤵
  PID:5892
- C:\Windows\System\ZjNWEjx.exe
  C:\Windows\System\ZjNWEjx.exe
  2⤵
  PID:5540
- C:\Windows\System\dbTJBtp.exe
  C:\Windows\System\dbTJBtp.exe
  2⤵
  PID:6060
- C:\Windows\System\UaymKeL.exe
  C:\Windows\System\UaymKeL.exe
  2⤵
  PID:6100
- C:\Windows\System\lLsftBl.exe
  C:\Windows\System\lLsftBl.exe
  2⤵
  PID:3148
- C:\Windows\System\mNxfIbC.exe
  C:\Windows\System\mNxfIbC.exe
  2⤵
  PID:5964
- C:\Windows\System\xVdAWhk.exe
  C:\Windows\System\xVdAWhk.exe
  2⤵
  PID:5724
- C:\Windows\System\sTPJvGi.exe
  C:\Windows\System\sTPJvGi.exe
  2⤵
  PID:440
- C:\Windows\System\ELGenfL.exe
  C:\Windows\System\ELGenfL.exe
  2⤵
  PID:4844
- C:\Windows\System\AFfihdu.exe
  C:\Windows\System\AFfihdu.exe
  2⤵
  PID:4744
- C:\Windows\System\NlWdZEm.exe
  C:\Windows\System\NlWdZEm.exe
  2⤵
  PID:5036
- C:\Windows\System\viBAoqf.exe
  C:\Windows\System\viBAoqf.exe
  2⤵
  PID:2464
- C:\Windows\System\NwyTFEn.exe
  C:\Windows\System\NwyTFEn.exe
  2⤵
  PID:6156
- C:\Windows\System\MyPsenZ.exe
  C:\Windows\System\MyPsenZ.exe
  2⤵
  PID:6184
- C:\Windows\System\eVNBnLd.exe
  C:\Windows\System\eVNBnLd.exe
  2⤵
  PID:6208
- C:\Windows\System\DSCYLyY.exe
  C:\Windows\System\DSCYLyY.exe
  2⤵
  PID:6240
- C:\Windows\System\zgaYmlb.exe
  C:\Windows\System\zgaYmlb.exe
  2⤵
  PID:6264
- C:\Windows\System\RsQokro.exe
  C:\Windows\System\RsQokro.exe
  2⤵
  PID:6284
- C:\Windows\System\owjBkNC.exe
  C:\Windows\System\owjBkNC.exe
  2⤵
  PID:6308
- C:\Windows\System\UVuAlEs.exe
  C:\Windows\System\UVuAlEs.exe
  2⤵
  PID:6332
- C:\Windows\System\aMzpJDv.exe
  C:\Windows\System\aMzpJDv.exe
  2⤵
  PID:6360
- C:\Windows\System\TWITsLV.exe
  C:\Windows\System\TWITsLV.exe
  2⤵
  PID:6376
- C:\Windows\System\cwVwiWq.exe
  C:\Windows\System\cwVwiWq.exe
  2⤵
  PID:6408
- C:\Windows\System\VAMeXWI.exe
  C:\Windows\System\VAMeXWI.exe
  2⤵
  PID:6440
- C:\Windows\System\IWoGzcI.exe
  C:\Windows\System\IWoGzcI.exe
  2⤵
  PID:6460
- C:\Windows\System\buUTAJD.exe
  C:\Windows\System\buUTAJD.exe
  2⤵
  PID:6484
- C:\Windows\System\RJSawkc.exe
  C:\Windows\System\RJSawkc.exe
  2⤵
  PID:6516
- C:\Windows\System\nXmLJic.exe
  C:\Windows\System\nXmLJic.exe
  2⤵
  PID:6544
- C:\Windows\System\PxTwVxs.exe
  C:\Windows\System\PxTwVxs.exe
  2⤵
  PID:6568
- C:\Windows\System\cryptdo.exe
  C:\Windows\System\cryptdo.exe
  2⤵
  PID:6592
- C:\Windows\System\blozYgk.exe
  C:\Windows\System\blozYgk.exe
  2⤵
  PID:6616
- C:\Windows\System\EKbbiVS.exe
  C:\Windows\System\EKbbiVS.exe
  2⤵
  PID:6632
- C:\Windows\System\PKCHvde.exe
  C:\Windows\System\PKCHvde.exe
  2⤵
  PID:6656
- C:\Windows\System\mEkJzuH.exe
  C:\Windows\System\mEkJzuH.exe
  2⤵
  PID:6680
- C:\Windows\System\lpqpXlO.exe
  C:\Windows\System\lpqpXlO.exe
  2⤵
  PID:6708
- C:\Windows\System\jWAkKxg.exe
  C:\Windows\System\jWAkKxg.exe
  2⤵
  PID:6948
- C:\Windows\System\HBJXtqM.exe
  C:\Windows\System\HBJXtqM.exe
  2⤵
  PID:6972
- C:\Windows\System\jsHxVzi.exe
  C:\Windows\System\jsHxVzi.exe
  2⤵
  PID:6996
- C:\Windows\System\xOsOopt.exe
  C:\Windows\System\xOsOopt.exe
  2⤵
  PID:7028
- C:\Windows\System\DOwSgQI.exe
  C:\Windows\System\DOwSgQI.exe
  2⤵
  PID:7056
- C:\Windows\System\yFDPlHS.exe
  C:\Windows\System\yFDPlHS.exe
  2⤵
  PID:7076
- C:\Windows\System\GJoxVyl.exe
  C:\Windows\System\GJoxVyl.exe
  2⤵
  PID:7104
- C:\Windows\System\LMsNqfz.exe
  C:\Windows\System\LMsNqfz.exe
  2⤵
  PID:7136
- C:\Windows\System\ZHeNDVe.exe
  C:\Windows\System\ZHeNDVe.exe
  2⤵
  PID:7156
- C:\Windows\System\hlKRMpO.exe
  C:\Windows\System\hlKRMpO.exe
  2⤵
  PID:5632
- C:\Windows\System\UYSBYhP.exe
  C:\Windows\System\UYSBYhP.exe
  2⤵
  PID:3676
- C:\Windows\System\ehKTgzn.exe
  C:\Windows\System\ehKTgzn.exe
  2⤵
  PID:5812
- C:\Windows\System\WgcrVwx.exe
  C:\Windows\System\WgcrVwx.exe
  2⤵
  PID:5980
- C:\Windows\System\jjTOMHT.exe
  C:\Windows\System\jjTOMHT.exe
  2⤵
  PID:3840
- C:\Windows\System\LWduBoR.exe
  C:\Windows\System\LWduBoR.exe
  2⤵
  PID:3720
- C:\Windows\System\hgBvAvt.exe
  C:\Windows\System\hgBvAvt.exe
  2⤵
  PID:5456
- C:\Windows\System\SDsbCvA.exe
  C:\Windows\System\SDsbCvA.exe
  2⤵
  PID:4368
- C:\Windows\System\mqppVTK.exe
  C:\Windows\System\mqppVTK.exe
  2⤵
  PID:1256
- C:\Windows\System\CZJwEEK.exe
  C:\Windows\System\CZJwEEK.exe
  2⤵
  PID:6084
- C:\Windows\System\YuafLwz.exe
  C:\Windows\System\YuafLwz.exe
  2⤵
  PID:2196
- C:\Windows\System\diNjfXJ.exe
  C:\Windows\System\diNjfXJ.exe
  2⤵
  PID:6500
- C:\Windows\System\vxLBzXc.exe
  C:\Windows\System\vxLBzXc.exe
  2⤵
  PID:1372
- C:\Windows\System\wAHThYm.exe
  C:\Windows\System\wAHThYm.exe
  2⤵
  PID:6148
- C:\Windows\System\WpVEgwh.exe
  C:\Windows\System\WpVEgwh.exe
  2⤵
  PID:6720
- C:\Windows\System\WFBxFCM.exe
  C:\Windows\System\WFBxFCM.exe
  2⤵
  PID:6508
- C:\Windows\System\mGMKkxr.exe
  C:\Windows\System\mGMKkxr.exe
  2⤵
  PID:6224
- C:\Windows\System\WOSHzRQ.exe
  C:\Windows\System\WOSHzRQ.exe
  2⤵
  PID:5736
- C:\Windows\System\zIKnvLm.exe
  C:\Windows\System\zIKnvLm.exe
  2⤵
  PID:6344
- C:\Windows\System\QoowmEi.exe
  C:\Windows\System\QoowmEi.exe
  2⤵
  PID:6452
- C:\Windows\System\TgtUjrq.exe
  C:\Windows\System\TgtUjrq.exe
  2⤵
  PID:4820
- C:\Windows\System\mBhwnPo.exe
  C:\Windows\System\mBhwnPo.exe
  2⤵
  PID:6608
- C:\Windows\System\OWCGtNm.exe
  C:\Windows\System\OWCGtNm.exe
  2⤵
  PID:6180
- C:\Windows\System\LpVrnBa.exe
  C:\Windows\System\LpVrnBa.exe
  2⤵
  PID:6700
- C:\Windows\System\JNoXoEb.exe
  C:\Windows\System\JNoXoEb.exe
  2⤵
  PID:6556
- C:\Windows\System\NUvuhhg.exe
  C:\Windows\System\NUvuhhg.exe
  2⤵
  PID:6940
- C:\Windows\System\lvacivN.exe
  C:\Windows\System\lvacivN.exe
  2⤵
  PID:7120
- C:\Windows\System\AqEONrE.exe
  C:\Windows\System\AqEONrE.exe
  2⤵
  PID:7176
- C:\Windows\System\ErBJydB.exe
  C:\Windows\System\ErBJydB.exe
  2⤵
  PID:7192
- C:\Windows\System\DzdyjRe.exe
  C:\Windows\System\DzdyjRe.exe
  2⤵
  PID:7212
- C:\Windows\System\iolZCwa.exe
  C:\Windows\System\iolZCwa.exe
  2⤵
  PID:7228
- C:\Windows\System\coxCRBK.exe
  C:\Windows\System\coxCRBK.exe
  2⤵
  PID:7252
- C:\Windows\System\vLspMWK.exe
  C:\Windows\System\vLspMWK.exe
  2⤵
  PID:7280
- C:\Windows\System\xGtymNh.exe
  C:\Windows\System\xGtymNh.exe
  2⤵
  PID:7296
- C:\Windows\System\JFXxjkj.exe
  C:\Windows\System\JFXxjkj.exe
  2⤵
  PID:7328
- C:\Windows\System\LhIMeOu.exe
  C:\Windows\System\LhIMeOu.exe
  2⤵
  PID:7356
- C:\Windows\System\shHyTlL.exe
  C:\Windows\System\shHyTlL.exe
  2⤵
  PID:7376
- C:\Windows\System\KwsqtRV.exe
  C:\Windows\System\KwsqtRV.exe
  2⤵
  PID:7404
- C:\Windows\System\scyyFzZ.exe
  C:\Windows\System\scyyFzZ.exe
  2⤵
  PID:7428
- C:\Windows\System\MxWhlsn.exe
  C:\Windows\System\MxWhlsn.exe
  2⤵
  PID:7444
- C:\Windows\System\RWeNasP.exe
  C:\Windows\System\RWeNasP.exe
  2⤵
  PID:7464
- C:\Windows\System\zyHrhrr.exe
  C:\Windows\System\zyHrhrr.exe
  2⤵
  PID:7492
- C:\Windows\System\IOaYZVp.exe
  C:\Windows\System\IOaYZVp.exe
  2⤵
  PID:7524
- C:\Windows\System\FzbGFPi.exe
  C:\Windows\System\FzbGFPi.exe
  2⤵
  PID:7552
- C:\Windows\System\JjdieJq.exe
  C:\Windows\System\JjdieJq.exe
  2⤵
  PID:7572
- C:\Windows\System\vOPdtgm.exe
  C:\Windows\System\vOPdtgm.exe
  2⤵
  PID:7592
- C:\Windows\System\ZoNVNVq.exe
  C:\Windows\System\ZoNVNVq.exe
  2⤵
  PID:7612
- C:\Windows\System\gqukQpi.exe
  C:\Windows\System\gqukQpi.exe
  2⤵
  PID:7628
- C:\Windows\System\Nuhuisq.exe
  C:\Windows\System\Nuhuisq.exe
  2⤵
  PID:7644
- C:\Windows\System\PctMtGV.exe
  C:\Windows\System\PctMtGV.exe
  2⤵
  PID:7672
- C:\Windows\System\dBWVOpQ.exe
  C:\Windows\System\dBWVOpQ.exe
  2⤵
  PID:7692
- C:\Windows\System\knhJElD.exe
  C:\Windows\System\knhJElD.exe
  2⤵
  PID:7980
- C:\Windows\System\bmzEJVk.exe
  C:\Windows\System\bmzEJVk.exe
  2⤵
  PID:8016
- C:\Windows\System\QfxWAUB.exe
  C:\Windows\System\QfxWAUB.exe
  2⤵
  PID:8052
- C:\Windows\System\vZfUVPZ.exe
  C:\Windows\System\vZfUVPZ.exe
  2⤵
  PID:8088
- C:\Windows\System\tVHnoMp.exe
  C:\Windows\System\tVHnoMp.exe
  2⤵
  PID:8116
- C:\Windows\System\ONMxUmj.exe
  C:\Windows\System\ONMxUmj.exe
  2⤵
  PID:8144
- C:\Windows\System\nfKWjuF.exe
  C:\Windows\System\nfKWjuF.exe
  2⤵
  PID:8160
- C:\Windows\System\jKoaDWl.exe
  C:\Windows\System\jKoaDWl.exe
  2⤵
  PID:8176
- C:\Windows\System\vevOEeV.exe
  C:\Windows\System\vevOEeV.exe
  2⤵
  PID:6512
- C:\Windows\System\MysfnwM.exe
  C:\Windows\System\MysfnwM.exe
  2⤵
  PID:5568
- C:\Windows\System\HGhbTGy.exe
  C:\Windows\System\HGhbTGy.exe
  2⤵
  PID:1636
- C:\Windows\System\kejyzTY.exe
  C:\Windows\System\kejyzTY.exe
  2⤵
  PID:6888
- C:\Windows\System\InBIbLh.exe
  C:\Windows\System\InBIbLh.exe
  2⤵
  PID:6296
- C:\Windows\System\USBeBgo.exe
  C:\Windows\System\USBeBgo.exe
  2⤵
  PID:6644
- C:\Windows\System\DBmqTvH.exe
  C:\Windows\System\DBmqTvH.exe
  2⤵
  PID:6732
- C:\Windows\System\lGomJtW.exe
  C:\Windows\System\lGomJtW.exe
  2⤵
  PID:7012
- C:\Windows\System\lmdEcQz.exe
  C:\Windows\System\lmdEcQz.exe
  2⤵
  PID:7040
- C:\Windows\System\rglLywA.exe
  C:\Windows\System\rglLywA.exe
  2⤵
  PID:7096
- C:\Windows\System\VfPDwgJ.exe
  C:\Windows\System\VfPDwgJ.exe
  2⤵
  PID:7144
- C:\Windows\System\LpGUfjC.exe
  C:\Windows\System\LpGUfjC.exe
  2⤵
  PID:6776
- C:\Windows\System\FWgvLRw.exe
  C:\Windows\System\FWgvLRw.exe
  2⤵
  PID:7248
- C:\Windows\System\Trmuhfy.exe
  C:\Windows\System\Trmuhfy.exe
  2⤵
  PID:7436
- C:\Windows\System\zthOSEV.exe
  C:\Windows\System\zthOSEV.exe
  2⤵
  PID:7476
- C:\Windows\System\zCJrIKO.exe
  C:\Windows\System\zCJrIKO.exe
  2⤵
  PID:7068
- C:\Windows\System\bhiOWFL.exe
  C:\Windows\System\bhiOWFL.exe
  2⤵
  PID:7536
- C:\Windows\System\zYmaGWS.exe
  C:\Windows\System\zYmaGWS.exe
  2⤵
  PID:6812
- C:\Windows\System\qwdeWzm.exe
  C:\Windows\System\qwdeWzm.exe
  2⤵
  PID:7708
- C:\Windows\System\xzjlyBn.exe
  C:\Windows\System\xzjlyBn.exe
  2⤵
  PID:7172
- C:\Windows\System\BdbScAu.exe
  C:\Windows\System\BdbScAu.exe
  2⤵
  PID:4236
- C:\Windows\System\FIbojOA.exe
  C:\Windows\System\FIbojOA.exe
  2⤵
  PID:5124
- C:\Windows\System\vpkWKhV.exe
  C:\Windows\System\vpkWKhV.exe
  2⤵
  PID:6252
- C:\Windows\System\yvMfuJH.exe
  C:\Windows\System\yvMfuJH.exe
  2⤵
  PID:4512
- C:\Windows\System\HouzMUX.exe
  C:\Windows\System\HouzMUX.exe
  2⤵
  PID:7400
- C:\Windows\System\mHWzGrV.exe
  C:\Windows\System\mHWzGrV.exe
  2⤵
  PID:6528
- C:\Windows\System\ZeIsueQ.exe
  C:\Windows\System\ZeIsueQ.exe
  2⤵
  PID:7488
- C:\Windows\System\hOldgUw.exe
  C:\Windows\System\hOldgUw.exe
  2⤵
  PID:2732
- C:\Windows\System\tThduaU.exe
  C:\Windows\System\tThduaU.exe
  2⤵
  PID:7608
- C:\Windows\System\EAuegzv.exe
  C:\Windows\System\EAuegzv.exe
  2⤵
  PID:7664
- C:\Windows\System\hbmWwYd.exe
  C:\Windows\System\hbmWwYd.exe
  2⤵
  PID:7992
- C:\Windows\System\BuzFYHV.exe
  C:\Windows\System\BuzFYHV.exe
  2⤵
  PID:8064
- C:\Windows\System\hbVBrPw.exe
  C:\Windows\System\hbVBrPw.exe
  2⤵
  PID:7752
- C:\Windows\System\MKURPtq.exe
  C:\Windows\System\MKURPtq.exe
  2⤵
  PID:2244
- C:\Windows\System\EGeRFtc.exe
  C:\Windows\System\EGeRFtc.exe
  2⤵
  PID:8200
- C:\Windows\System\VtAgXEI.exe
  C:\Windows\System\VtAgXEI.exe
  2⤵
  PID:8220
- C:\Windows\System\dnStsdk.exe
  C:\Windows\System\dnStsdk.exe
  2⤵
  PID:8260
- C:\Windows\System\UVZOTjz.exe
  C:\Windows\System\UVZOTjz.exe
  2⤵
  PID:8280
- C:\Windows\System\KprfwdJ.exe
  C:\Windows\System\KprfwdJ.exe
  2⤵
  PID:8296
- C:\Windows\System\tqSGifz.exe
  C:\Windows\System\tqSGifz.exe
  2⤵
  PID:8328
- C:\Windows\System\cGJvhCV.exe
  C:\Windows\System\cGJvhCV.exe
  2⤵
  PID:8344
- C:\Windows\System\dlZJGur.exe
  C:\Windows\System\dlZJGur.exe
  2⤵
  PID:8376
- C:\Windows\System\VxOKyiz.exe
  C:\Windows\System\VxOKyiz.exe
  2⤵
  PID:8408
- C:\Windows\System\HqIhrod.exe
  C:\Windows\System\HqIhrod.exe
  2⤵
  PID:8428
- C:\Windows\System\XYnHUCl.exe
  C:\Windows\System\XYnHUCl.exe
  2⤵
  PID:8444
- C:\Windows\System\CWzQnkE.exe
  C:\Windows\System\CWzQnkE.exe
  2⤵
  PID:8460
- C:\Windows\System\Qhkncgw.exe
  C:\Windows\System\Qhkncgw.exe
  2⤵
  PID:8492
- C:\Windows\System\QAMEpuo.exe
  C:\Windows\System\QAMEpuo.exe
  2⤵
  PID:8508
- C:\Windows\System\ZHKwPjW.exe
  C:\Windows\System\ZHKwPjW.exe
  2⤵
  PID:8524
- C:\Windows\System\PIHTLXg.exe
  C:\Windows\System\PIHTLXg.exe
  2⤵
  PID:8552
- C:\Windows\System\cccSCKu.exe
  C:\Windows\System\cccSCKu.exe
  2⤵
  PID:8576
- C:\Windows\System\PFOfvJx.exe
  C:\Windows\System\PFOfvJx.exe
  2⤵
  PID:8592
- C:\Windows\System\tgseWmT.exe
  C:\Windows\System\tgseWmT.exe
  2⤵
  PID:8628
- C:\Windows\System\BwFLkLl.exe
  C:\Windows\System\BwFLkLl.exe
  2⤵
  PID:8648
- C:\Windows\System\yRiDYoC.exe
  C:\Windows\System\yRiDYoC.exe
  2⤵
  PID:8668
- C:\Windows\System\ogsjWXa.exe
  C:\Windows\System\ogsjWXa.exe
  2⤵
  PID:8704
- C:\Windows\System\SrbhCwZ.exe
  C:\Windows\System\SrbhCwZ.exe
  2⤵
  PID:8724
- C:\Windows\System\uhdliWF.exe
  C:\Windows\System\uhdliWF.exe
  2⤵
  PID:8740
- C:\Windows\System\IkaFhuY.exe
  C:\Windows\System\IkaFhuY.exe
  2⤵
  PID:8756
- C:\Windows\System\UmPDnge.exe
  C:\Windows\System\UmPDnge.exe
  2⤵
  PID:8776
- C:\Windows\System\DHEbYKh.exe
  C:\Windows\System\DHEbYKh.exe
  2⤵
  PID:8804
- C:\Windows\System\fTWlgYz.exe
  C:\Windows\System\fTWlgYz.exe
  2⤵
  PID:8824
- C:\Windows\System\vWWBIXn.exe
  C:\Windows\System\vWWBIXn.exe
  2⤵
  PID:8860
- C:\Windows\System\pqYzRVJ.exe
  C:\Windows\System\pqYzRVJ.exe
  2⤵
  PID:8896
- C:\Windows\System\ygyIvEv.exe
  C:\Windows\System\ygyIvEv.exe
  2⤵
  PID:8932
- C:\Windows\System\FravrDl.exe
  C:\Windows\System\FravrDl.exe
  2⤵
  PID:8972
- C:\Windows\System\rQqkJJD.exe
  C:\Windows\System\rQqkJJD.exe
  2⤵
  PID:8996
- C:\Windows\System\GtZmEHC.exe
  C:\Windows\System\GtZmEHC.exe
  2⤵
  PID:9024
- C:\Windows\System\njsbxyb.exe
  C:\Windows\System\njsbxyb.exe
  2⤵
  PID:9044
- C:\Windows\System\mkrSSPw.exe
  C:\Windows\System\mkrSSPw.exe
  2⤵
  PID:9068
- C:\Windows\System\OSnBApu.exe
  C:\Windows\System\OSnBApu.exe
  2⤵
  PID:9084
- C:\Windows\System\ICshFlw.exe
  C:\Windows\System\ICshFlw.exe
  2⤵
  PID:9112
- C:\Windows\System\ZWONDAL.exe
  C:\Windows\System\ZWONDAL.exe
  2⤵
  PID:9136
- C:\Windows\System\YVQtWPp.exe
  C:\Windows\System\YVQtWPp.exe
  2⤵
  PID:9172
- C:\Windows\System\dNjjoLG.exe
  C:\Windows\System\dNjjoLG.exe
  2⤵
  PID:9192
- C:\Windows\System\uUymjyx.exe
  C:\Windows\System\uUymjyx.exe
  2⤵
  PID:6840
- C:\Windows\System\hCKLXDM.exe
  C:\Windows\System\hCKLXDM.exe
  2⤵
  PID:7388
- C:\Windows\System\bSjmCOX.exe
  C:\Windows\System\bSjmCOX.exe
  2⤵
  PID:6916
- C:\Windows\System\XIyhWGb.exe
  C:\Windows\System\XIyhWGb.exe
  2⤵
  PID:6968
- C:\Windows\System\NiiDMxI.exe
  C:\Windows\System\NiiDMxI.exe
  2⤵
  PID:7512
- C:\Windows\System\HHWnaHl.exe
  C:\Windows\System\HHWnaHl.exe
  2⤵
  PID:7888
- C:\Windows\System\nnvfqTg.exe
  C:\Windows\System\nnvfqTg.exe
  2⤵
  PID:7912
- C:\Windows\System\vkOlflT.exe
  C:\Windows\System\vkOlflT.exe
  2⤵
  PID:2208
- C:\Windows\System\aTcEYau.exe
  C:\Windows\System\aTcEYau.exe
  2⤵
  PID:7924
- C:\Windows\System\kBXABrv.exe
  C:\Windows\System\kBXABrv.exe
  2⤵
  PID:7928
- C:\Windows\System\iLNkfDC.exe
  C:\Windows\System\iLNkfDC.exe
  2⤵
  PID:7948
- C:\Windows\System\IwTGbqE.exe
  C:\Windows\System\IwTGbqE.exe
  2⤵
  PID:7420
- C:\Windows\System\ozbtjPy.exe
  C:\Windows\System\ozbtjPy.exe
  2⤵
  PID:7500
- C:\Windows\System\ojbJuXS.exe
  C:\Windows\System\ojbJuXS.exe
  2⤵
  PID:8132
- C:\Windows\System\qjkPgVk.exe
  C:\Windows\System\qjkPgVk.exe
  2⤵
  PID:8172
- C:\Windows\System\mbiTGCt.exe
  C:\Windows\System\mbiTGCt.exe
  2⤵
  PID:8208
- C:\Windows\System\nVqqALX.exe
  C:\Windows\System\nVqqALX.exe
  2⤵
  PID:8244
- C:\Windows\System\XJWrjgS.exe
  C:\Windows\System\XJWrjgS.exe
  2⤵
  PID:8288
- C:\Windows\System\cNkLEKQ.exe
  C:\Windows\System\cNkLEKQ.exe
  2⤵
  PID:6984
- C:\Windows\System\QxqbuJV.exe
  C:\Windows\System\QxqbuJV.exe
  2⤵
  PID:7848
- C:\Windows\System\BjeCJBo.exe
  C:\Windows\System\BjeCJBo.exe
  2⤵
  PID:8452
- C:\Windows\System\BeBzRqM.exe
  C:\Windows\System\BeBzRqM.exe
  2⤵
  PID:7344
- C:\Windows\System\sEFRaiX.exe
  C:\Windows\System\sEFRaiX.exe
  2⤵
  PID:6448
- C:\Windows\System\SHGHzYS.exe
  C:\Windows\System\SHGHzYS.exe
  2⤵
  PID:7968
- C:\Windows\System\znqNYba.exe
  C:\Windows\System\znqNYba.exe
  2⤵
  PID:8012
- C:\Windows\System\GwIZxsW.exe
  C:\Windows\System\GwIZxsW.exe
  2⤵
  PID:8792
- C:\Windows\System\iQQhrMh.exe
  C:\Windows\System\iQQhrMh.exe
  2⤵
  PID:6652
- C:\Windows\System\HTPyUHP.exe
  C:\Windows\System\HTPyUHP.exe
  2⤵
  PID:8888
- C:\Windows\System\wCPHrjv.exe
  C:\Windows\System\wCPHrjv.exe
  2⤵
  PID:8156
- C:\Windows\System\YRNdhGd.exe
  C:\Windows\System\YRNdhGd.exe
  2⤵
  PID:9224
- C:\Windows\System\dyFJbOp.exe
  C:\Windows\System\dyFJbOp.exe
  2⤵
  PID:9260
- C:\Windows\System\dwYuEQL.exe
  C:\Windows\System\dwYuEQL.exe
  2⤵
  PID:9292
- C:\Windows\System\oGCbJdD.exe
  C:\Windows\System\oGCbJdD.exe
  2⤵
  PID:9324
- C:\Windows\System\TvOZUxO.exe
  C:\Windows\System\TvOZUxO.exe
  2⤵
  PID:9360
- C:\Windows\System\NrvVQfq.exe
  C:\Windows\System\NrvVQfq.exe
  2⤵
  PID:9376
- C:\Windows\System\xVxoVKb.exe
  C:\Windows\System\xVxoVKb.exe
  2⤵
  PID:9400
- C:\Windows\System\kOnYQcq.exe
  C:\Windows\System\kOnYQcq.exe
  2⤵
  PID:9416
- C:\Windows\System\mBPwJKT.exe
  C:\Windows\System\mBPwJKT.exe
  2⤵
  PID:9432
- C:\Windows\System\lRaZzDd.exe
  C:\Windows\System\lRaZzDd.exe
  2⤵
  PID:9472
- C:\Windows\System\XURKTIA.exe
  C:\Windows\System\XURKTIA.exe
  2⤵
  PID:9492
- C:\Windows\System\jwfkpmk.exe
  C:\Windows\System\jwfkpmk.exe
  2⤵
  PID:9520
- C:\Windows\System\TSatZkL.exe
  C:\Windows\System\TSatZkL.exe
  2⤵
  PID:7184
- C:\Windows\System\XRRLVit.exe
  C:\Windows\System\XRRLVit.exe
  2⤵
  PID:7460
- C:\Windows\System\RNMygwN.exe
  C:\Windows\System\RNMygwN.exe
  2⤵
  PID:7548
- C:\Windows\System\ODsXJuw.exe
  C:\Windows\System\ODsXJuw.exe
  2⤵
  PID:8128
- C:\Windows\System\qkEcMrR.exe
  C:\Windows\System\qkEcMrR.exe
  2⤵
  PID:8688
- C:\Windows\System\SEgXUkZ.exe
  C:\Windows\System\SEgXUkZ.exe
  2⤵
  PID:7348
- C:\Windows\System\nTGrjTg.exe
  C:\Windows\System\nTGrjTg.exe
  2⤵
  PID:7312
- C:\Windows\System\mZeDJBo.exe
  C:\Windows\System\mZeDJBo.exe
  2⤵
  PID:8796
- C:\Windows\System\mFSQiJv.exe
  C:\Windows\System\mFSQiJv.exe
  2⤵
  PID:9232
- C:\Windows\System\jDkocHA.exe
  C:\Windows\System\jDkocHA.exe
  2⤵
  PID:9368
- C:\Windows\System\WMPQWxt.exe
  C:\Windows\System\WMPQWxt.exe
  2⤵
  PID:9456
- C:\Windows\System\TSihEqv.exe
  C:\Windows\System\TSihEqv.exe
  2⤵
  PID:8440
- C:\Windows\System\HoLFnKT.exe
  C:\Windows\System\HoLFnKT.exe
  2⤵
  PID:8540
- C:\Windows\System\bvtINbd.exe
  C:\Windows\System\bvtINbd.exe
  2⤵
  PID:8588
- C:\Windows\System\poNvsEW.exe
  C:\Windows\System\poNvsEW.exe
  2⤵
  PID:8684
- C:\Windows\System\zeCwxaB.exe
  C:\Windows\System\zeCwxaB.exe
  2⤵
  PID:7792
- C:\Windows\System\uTRbhvQ.exe
  C:\Windows\System\uTRbhvQ.exe
  2⤵
  PID:6924
- C:\Windows\System\FowYIWc.exe
  C:\Windows\System\FowYIWc.exe
  2⤵
  PID:7828
- C:\Windows\System\hyhPHmc.exe
  C:\Windows\System\hyhPHmc.exe
  2⤵
  PID:8868
- C:\Windows\System\MSFAnGp.exe
  C:\Windows\System\MSFAnGp.exe
  2⤵
  PID:8548
- C:\Windows\System\czljKYD.exe
  C:\Windows\System\czljKYD.exe
  2⤵
  PID:8072
- C:\Windows\System\lZgbQrR.exe
  C:\Windows\System\lZgbQrR.exe
  2⤵
  PID:9256
- C:\Windows\System\LtLannU.exe
  C:\Windows\System\LtLannU.exe
  2⤵
  PID:9080
- C:\Windows\System\woYYrdl.exe
  C:\Windows\System\woYYrdl.exe
  2⤵
  PID:9148
- C:\Windows\System\gQdrAEq.exe
  C:\Windows\System\gQdrAEq.exe
  2⤵
  PID:9184
- C:\Windows\System\euDFjuu.exe
  C:\Windows\System\euDFjuu.exe
  2⤵
  PID:9488
- C:\Windows\System\MbkcEZA.exe
  C:\Windows\System\MbkcEZA.exe
  2⤵
  PID:7484
- C:\Windows\System\vlMUKGi.exe
  C:\Windows\System\vlMUKGi.exe
  2⤵
  PID:9572
- C:\Windows\System\FpZXmcM.exe
  C:\Windows\System\FpZXmcM.exe
  2⤵
  PID:9600
- C:\Windows\System\fKQtlap.exe
  C:\Windows\System\fKQtlap.exe
  2⤵
  PID:7920
- C:\Windows\System\RfydcDt.exe
  C:\Windows\System\RfydcDt.exe
  2⤵
  PID:7932
- C:\Windows\System\RcYfqiX.exe
  C:\Windows\System\RcYfqiX.exe
  2⤵
  PID:7412
- C:\Windows\System\wdMDTFm.exe
  C:\Windows\System\wdMDTFm.exe
  2⤵
  PID:9756
- C:\Windows\System\xtyQmAk.exe
  C:\Windows\System\xtyQmAk.exe
  2⤵
  PID:9812
- C:\Windows\System\deQFTRf.exe
  C:\Windows\System\deQFTRf.exe
  2⤵
  PID:10248
- C:\Windows\System\HNDOOwK.exe
  C:\Windows\System\HNDOOwK.exe
  2⤵
  PID:10264
- C:\Windows\System\XyMtERO.exe
  C:\Windows\System\XyMtERO.exe
  2⤵
  PID:10288
- C:\Windows\System\mKfPzwa.exe
  C:\Windows\System\mKfPzwa.exe
  2⤵
  PID:10316
- C:\Windows\System\CDcEBJo.exe
  C:\Windows\System\CDcEBJo.exe
  2⤵
  PID:10348
- C:\Windows\System\GZbmIOT.exe
  C:\Windows\System\GZbmIOT.exe
  2⤵
  PID:10364
- C:\Windows\System\yvgCOMq.exe
  C:\Windows\System\yvgCOMq.exe
  2⤵
  PID:10392
- C:\Windows\System\DoxPsgx.exe
  C:\Windows\System\DoxPsgx.exe
  2⤵
  PID:10412
- C:\Windows\System\YjjoBok.exe
  C:\Windows\System\YjjoBok.exe
  2⤵
  PID:10456
- C:\Windows\System\WlPUHNO.exe
  C:\Windows\System\WlPUHNO.exe
  2⤵
  PID:10472
- C:\Windows\System\vSgnfKC.exe
  C:\Windows\System\vSgnfKC.exe
  2⤵
  PID:10500
- C:\Windows\System\YbrGHJe.exe
  C:\Windows\System\YbrGHJe.exe
  2⤵
  PID:10536
- C:\Windows\System\redDCjB.exe
  C:\Windows\System\redDCjB.exe
  2⤵
  PID:10560
- C:\Windows\System\qXXktCa.exe
  C:\Windows\System\qXXktCa.exe
  2⤵
  PID:10588
- C:\Windows\System\PmvpoPa.exe
  C:\Windows\System\PmvpoPa.exe
  2⤵
  PID:10604
- C:\Windows\System\fwDXeop.exe
  C:\Windows\System\fwDXeop.exe
  2⤵
  PID:10620
- C:\Windows\System\QeMVmyd.exe
  C:\Windows\System\QeMVmyd.exe
  2⤵
  PID:10636
- C:\Windows\System\spIVBtG.exe
  C:\Windows\System\spIVBtG.exe
  2⤵
  PID:10652
- C:\Windows\System\aZgRoWS.exe
  C:\Windows\System\aZgRoWS.exe
  2⤵
  PID:10668
- C:\Windows\System\GaiueDX.exe
  C:\Windows\System\GaiueDX.exe
  2⤵
  PID:10684
- C:\Windows\System\YFSolMY.exe
  C:\Windows\System\YFSolMY.exe
  2⤵
  PID:10708
- C:\Windows\System\bXOEvax.exe
  C:\Windows\System\bXOEvax.exe
  2⤵
  PID:10732
- C:\Windows\System\amtArGu.exe
  C:\Windows\System\amtArGu.exe
  2⤵
  PID:10764
- C:\Windows\System\OCHxFKF.exe
  C:\Windows\System\OCHxFKF.exe
  2⤵
  PID:10788
- C:\Windows\System\hYkdQuG.exe
  C:\Windows\System\hYkdQuG.exe
  2⤵
  PID:10808
- C:\Windows\System\twkyhEr.exe
  C:\Windows\System\twkyhEr.exe
  2⤵
  PID:10824
- C:\Windows\System\NokzPZJ.exe
  C:\Windows\System\NokzPZJ.exe
  2⤵
  PID:10852
- C:\Windows\System\XRGbdgC.exe
  C:\Windows\System\XRGbdgC.exe
  2⤵
  PID:10872
- C:\Windows\System\wdhchaD.exe
  C:\Windows\System\wdhchaD.exe
  2⤵
  PID:10896
- C:\Windows\System\tkKsAix.exe
  C:\Windows\System\tkKsAix.exe
  2⤵
  PID:10924
- C:\Windows\System\sjRsnEr.exe
  C:\Windows\System\sjRsnEr.exe
  2⤵
  PID:10944
- C:\Windows\System\ffMWKwT.exe
  C:\Windows\System\ffMWKwT.exe
  2⤵
  PID:10980
- C:\Windows\System\AOrHziT.exe
  C:\Windows\System\AOrHziT.exe
  2⤵
  PID:11000
- C:\Windows\System\ZSBXNYE.exe
  C:\Windows\System\ZSBXNYE.exe
  2⤵
  PID:11020
- C:\Windows\System\cyQSbpl.exe
  C:\Windows\System\cyQSbpl.exe
  2⤵
  PID:11048
- C:\Windows\System\OfcKlFt.exe
  C:\Windows\System\OfcKlFt.exe
  2⤵
  PID:11076
- C:\Windows\System\fDZwIoJ.exe
  C:\Windows\System\fDZwIoJ.exe
  2⤵
  PID:11116
- C:\Windows\System\XexHyeK.exe
  C:\Windows\System\XexHyeK.exe
  2⤵
  PID:11148
- C:\Windows\System\crsdzRx.exe
  C:\Windows\System\crsdzRx.exe
  2⤵
  PID:11180
- C:\Windows\System\dYMhUhT.exe
  C:\Windows\System\dYMhUhT.exe
  2⤵
  PID:11212
- C:\Windows\System\COArTUm.exe
  C:\Windows\System\COArTUm.exe
  2⤵
  PID:11232
- C:\Windows\System\VRprdwV.exe
  C:\Windows\System\VRprdwV.exe
  2⤵
  PID:11260
- C:\Windows\System\BUwVknv.exe
  C:\Windows\System\BUwVknv.exe
  2⤵
  PID:8456
- C:\Windows\System\SPaFxNk.exe
  C:\Windows\System\SPaFxNk.exe
  2⤵
  PID:3492
- C:\Windows\System\xeEZWbi.exe
  C:\Windows\System\xeEZWbi.exe
  2⤵
  PID:7716
- C:\Windows\System\RFjxeBV.exe
  C:\Windows\System\RFjxeBV.exe
  2⤵
  PID:8820
- C:\Windows\System\pSaLrJM.exe
  C:\Windows\System\pSaLrJM.exe
  2⤵
  PID:9020
- C:\Windows\System\DtNthwe.exe
  C:\Windows\System\DtNthwe.exe
  2⤵
  PID:9988
- C:\Windows\System\YOMHUwB.exe
  C:\Windows\System\YOMHUwB.exe
  2⤵
  PID:8584
- C:\Windows\System\wZbcPsC.exe
  C:\Windows\System\wZbcPsC.exe
  2⤵
  PID:10004
- C:\Windows\System\JaQZuXF.exe
  C:\Windows\System\JaQZuXF.exe
  2⤵
  PID:8880
- C:\Windows\System\SVVidNh.exe
  C:\Windows\System\SVVidNh.exe
  2⤵
  PID:9640
- C:\Windows\System\jjVHnND.exe
  C:\Windows\System\jjVHnND.exe
  2⤵
  PID:9660
- C:\Windows\System\RXXIjra.exe
  C:\Windows\System\RXXIjra.exe
  2⤵
  PID:9288
- C:\Windows\System\AHBIAxg.exe
  C:\Windows\System\AHBIAxg.exe
  2⤵
  PID:9408
- C:\Windows\System\uEyWhJy.exe
  C:\Windows\System\uEyWhJy.exe
  2⤵
  PID:9744
- C:\Windows\System\RyjksyJ.exe
  C:\Windows\System\RyjksyJ.exe
  2⤵
  PID:10200
- C:\Windows\System\FxbZiJS.exe
  C:\Windows\System\FxbZiJS.exe
  2⤵
  PID:8272
- C:\Windows\System\RywJnth.exe
  C:\Windows\System\RywJnth.exe
  2⤵
  PID:6868
- C:\Windows\System\HLrjuOg.exe
  C:\Windows\System\HLrjuOg.exe
  2⤵
  PID:10280
- C:\Windows\System\tnaVNoU.exe
  C:\Windows\System\tnaVNoU.exe
  2⤵
  PID:6580
- C:\Windows\System\iLzfRNs.exe
  C:\Windows\System\iLzfRNs.exe
  2⤵
  PID:9888
- C:\Windows\System\noaPoLV.exe
  C:\Windows\System\noaPoLV.exe
  2⤵
  PID:8624
- C:\Windows\System\KLqxxUl.exe
  C:\Windows\System\KLqxxUl.exe
  2⤵
  PID:8324
- C:\Windows\System\SsKyIKp.exe
  C:\Windows\System\SsKyIKp.exe
  2⤵
  PID:10664
- C:\Windows\System\NMldwKg.exe
  C:\Windows\System\NMldwKg.exe
  2⤵
  PID:9300
- C:\Windows\System\tUPkbPL.exe
  C:\Windows\System\tUPkbPL.exe
  2⤵
  PID:10780
- C:\Windows\System\WgQgdKb.exe
  C:\Windows\System\WgQgdKb.exe
  2⤵
  PID:8504
- C:\Windows\System\rkEIJAD.exe
  C:\Windows\System\rkEIJAD.exe
  2⤵
  PID:11276
- C:\Windows\System\oaLJcQl.exe
  C:\Windows\System\oaLJcQl.exe
  2⤵
  PID:11304
- C:\Windows\System\RwblgVN.exe
  C:\Windows\System\RwblgVN.exe
  2⤵
  PID:11332
- C:\Windows\System\wwpygqc.exe
  C:\Windows\System\wwpygqc.exe
  2⤵
  PID:11352
- C:\Windows\System\ItiCzVu.exe
  C:\Windows\System\ItiCzVu.exe
  2⤵
  PID:11368
- C:\Windows\System\yKcTzCo.exe
  C:\Windows\System\yKcTzCo.exe
  2⤵
  PID:11392
- C:\Windows\System\vkqTRQx.exe
  C:\Windows\System\vkqTRQx.exe
  2⤵
  PID:11408
- C:\Windows\System\wBywbap.exe
  C:\Windows\System\wBywbap.exe
  2⤵
  PID:11440
- C:\Windows\System\mnrKwhy.exe
  C:\Windows\System\mnrKwhy.exe
  2⤵
  PID:11460
- C:\Windows\System\IcDHKpe.exe
  C:\Windows\System\IcDHKpe.exe
  2⤵
  PID:11480
- C:\Windows\System\xzDBqEq.exe
  C:\Windows\System\xzDBqEq.exe
  2⤵
  PID:11496
- C:\Windows\System\SuJHhoR.exe
  C:\Windows\System\SuJHhoR.exe
  2⤵
  PID:11512
- C:\Windows\System\ZgSpqTq.exe
  C:\Windows\System\ZgSpqTq.exe
  2⤵
  PID:11528
- C:\Windows\System\kRDTago.exe
  C:\Windows\System\kRDTago.exe
  2⤵
  PID:11544
- C:\Windows\System\CnOvzlk.exe
  C:\Windows\System\CnOvzlk.exe
  2⤵
  PID:11560
- C:\Windows\System\LdbPctD.exe
  C:\Windows\System\LdbPctD.exe
  2⤵
  PID:11576
- C:\Windows\System\pHaQnZa.exe
  C:\Windows\System\pHaQnZa.exe
  2⤵
  PID:11592
- C:\Windows\System\QmGoxSx.exe
  C:\Windows\System\QmGoxSx.exe
  2⤵
  PID:11608
- C:\Windows\System\eQyYMpp.exe
  C:\Windows\System\eQyYMpp.exe
  2⤵
  PID:11624
- C:\Windows\System\NHaHSdt.exe
  C:\Windows\System\NHaHSdt.exe
  2⤵
  PID:11644
- C:\Windows\System\iuQnBYY.exe
  C:\Windows\System\iuQnBYY.exe
  2⤵
  PID:11680
- C:\Windows\System\dYxnEtT.exe
  C:\Windows\System\dYxnEtT.exe
  2⤵
  PID:11704
- C:\Windows\System\OmYpJwI.exe
  C:\Windows\System\OmYpJwI.exe
  2⤵
  PID:11720
- C:\Windows\System\WNrCcXl.exe
  C:\Windows\System\WNrCcXl.exe
  2⤵
  PID:11740
- C:\Windows\System\wgskCHy.exe
  C:\Windows\System\wgskCHy.exe
  2⤵
  PID:11760
- C:\Windows\System\tCZSupv.exe
  C:\Windows\System\tCZSupv.exe
  2⤵
  PID:11792
- C:\Windows\System\tsqIDud.exe
  C:\Windows\System\tsqIDud.exe
  2⤵
  PID:11808
- C:\Windows\System\BKZDceJ.exe
  C:\Windows\System\BKZDceJ.exe
  2⤵
  PID:11832
- C:\Windows\System\TNzoAtR.exe
  C:\Windows\System\TNzoAtR.exe
  2⤵
  PID:11852
- C:\Windows\System\QsDsTHs.exe
  C:\Windows\System\QsDsTHs.exe
  2⤵
  PID:11872
- C:\Windows\System\dmrGNLD.exe
  C:\Windows\System\dmrGNLD.exe
  2⤵
  PID:11900
- C:\Windows\System\yytpEzn.exe
  C:\Windows\System\yytpEzn.exe
  2⤵
  PID:11916
- C:\Windows\System\qZHTigD.exe
  C:\Windows\System\qZHTigD.exe
  2⤵
  PID:11944
- C:\Windows\System\mhSFpeC.exe
  C:\Windows\System\mhSFpeC.exe
  2⤵
  PID:11972
- C:\Windows\System\jEkCxrC.exe
  C:\Windows\System\jEkCxrC.exe
  2⤵
  PID:12004
- C:\Windows\System\YLjFBbW.exe
  C:\Windows\System\YLjFBbW.exe
  2⤵
  PID:12040
- C:\Windows\System\qPcYahh.exe
  C:\Windows\System\qPcYahh.exe
  2⤵
  PID:12068
- C:\Windows\System\osAKNMO.exe
  C:\Windows\System\osAKNMO.exe
  2⤵
  PID:12100
- C:\Windows\System\erLEsDw.exe
  C:\Windows\System\erLEsDw.exe
  2⤵
  PID:12116
- C:\Windows\System\ArDPgsO.exe
  C:\Windows\System\ArDPgsO.exe
  2⤵
  PID:12132
- C:\Windows\System\jVBtkFn.exe
  C:\Windows\System\jVBtkFn.exe
  2⤵
  PID:12160
- C:\Windows\System\WVmlozG.exe
  C:\Windows\System\WVmlozG.exe
  2⤵
  PID:12200
- C:\Windows\System\FtRAkZL.exe
  C:\Windows\System\FtRAkZL.exe
  2⤵
  PID:12228
- C:\Windows\System\foZtXKl.exe
  C:\Windows\System\foZtXKl.exe
  2⤵
  PID:12248
- C:\Windows\System\XalvHIO.exe
  C:\Windows\System\XalvHIO.exe
  2⤵
  PID:12280
- C:\Windows\System\HMfRddF.exe
  C:\Windows\System\HMfRddF.exe
  2⤵
  PID:8752
- C:\Windows\System\kvqxBSE.exe
  C:\Windows\System\kvqxBSE.exe
  2⤵
  PID:10940
- C:\Windows\System\nkstjEj.exe
  C:\Windows\System\nkstjEj.exe
  2⤵
  PID:10056
- C:\Windows\System\VOjbegX.exe
  C:\Windows\System\VOjbegX.exe
  2⤵
  PID:10136
- C:\Windows\System\LukrfyM.exe
  C:\Windows\System\LukrfyM.exe
  2⤵
  PID:11176
- C:\Windows\System\ABfSeNd.exe
  C:\Windows\System\ABfSeNd.exe
  2⤵
  PID:10232
- C:\Windows\System\UTdNGDO.exe
  C:\Windows\System\UTdNGDO.exe
  2⤵
  PID:11248
- C:\Windows\System\GITIHtE.exe
  C:\Windows\System\GITIHtE.exe
  2⤵
  PID:7712
- C:\Windows\System\MznQgdm.exe
  C:\Windows\System\MznQgdm.exe
  2⤵
  PID:6396
- C:\Windows\System\EEBCHmr.exe
  C:\Windows\System\EEBCHmr.exe
  2⤵
  PID:2132
- C:\Windows\System\ftnLZcn.exe
  C:\Windows\System\ftnLZcn.exe
  2⤵
  PID:9564
- C:\Windows\System\YMgPvFN.exe
  C:\Windows\System\YMgPvFN.exe
  2⤵
  PID:10308
- C:\Windows\System\qcBLnhP.exe
  C:\Windows\System\qcBLnhP.exe
  2⤵
  PID:10356
- C:\Windows\System\TTdPnUf.exe
  C:\Windows\System\TTdPnUf.exe
  2⤵
  PID:10440
- C:\Windows\System\pQtyFbS.exe
  C:\Windows\System\pQtyFbS.exe
  2⤵
  PID:8232
- C:\Windows\System\zSUfEUj.exe
  C:\Windows\System\zSUfEUj.exe
  2⤵
  PID:10244
- C:\Windows\System\YSLIUyp.exe
  C:\Windows\System\YSLIUyp.exe
  2⤵
  PID:10572
- C:\Windows\System\wLGGdRh.exe
  C:\Windows\System\wLGGdRh.exe
  2⤵
  PID:8228
- C:\Windows\System\enOBdQX.exe
  C:\Windows\System\enOBdQX.exe
  2⤵
  PID:10864
- C:\Windows\System\nyguFeU.exe
  C:\Windows\System\nyguFeU.exe
  2⤵
  PID:8616
- C:\Windows\System\AdirEmH.exe
  C:\Windows\System\AdirEmH.exe
  2⤵
  PID:10956
- C:\Windows\System\UtABLos.exe
  C:\Windows\System\UtABLos.exe
  2⤵
  PID:11360
- C:\Windows\System\HeAfhHY.exe
  C:\Windows\System\HeAfhHY.exe
  2⤵
  PID:8876
- C:\Windows\System\ICCFvXP.exe
  C:\Windows\System\ICCFvXP.exe
  2⤵
  PID:11384
- C:\Windows\System\zLiiKMg.exe
  C:\Windows\System\zLiiKMg.exe
  2⤵
  PID:10992
- C:\Windows\System\hvHgwnp.exe
  C:\Windows\System\hvHgwnp.exe
  2⤵
  PID:8928
- C:\Windows\System\ZaSPsgm.exe
  C:\Windows\System\ZaSPsgm.exe
  2⤵
  PID:11068
- C:\Windows\System\fBEwPfv.exe
  C:\Windows\System\fBEwPfv.exe
  2⤵
  PID:11468
- C:\Windows\System\cgmkQTw.exe
  C:\Windows\System\cgmkQTw.exe
  2⤵
  PID:11492
- C:\Windows\System\qstXdXQ.exe
  C:\Windows\System\qstXdXQ.exe
  2⤵
  PID:11524
- C:\Windows\System\POnCdsu.exe
  C:\Windows\System\POnCdsu.exe
  2⤵
  PID:11584
- C:\Windows\System\GdFtIuC.exe
  C:\Windows\System\GdFtIuC.exe
  2⤵
  PID:11604
- C:\Windows\System\jQrGmVZ.exe
  C:\Windows\System\jQrGmVZ.exe
  2⤵
  PID:11112
- C:\Windows\System\IWgVDjg.exe
  C:\Windows\System\IWgVDjg.exe
  2⤵
  PID:12300
- C:\Windows\System\MUyEbeb.exe
  C:\Windows\System\MUyEbeb.exe
  2⤵
  PID:12332
- C:\Windows\System\FjhQRlJ.exe
  C:\Windows\System\FjhQRlJ.exe
  2⤵
  PID:12360
- C:\Windows\System\kbJWzqp.exe
  C:\Windows\System\kbJWzqp.exe
  2⤵
  PID:12392
- C:\Windows\System\ymIMDNf.exe
  C:\Windows\System\ymIMDNf.exe
  2⤵
  PID:12428
- C:\Windows\System\TFPIsnW.exe
  C:\Windows\System\TFPIsnW.exe
  2⤵
  PID:12460
- C:\Windows\System\cQJWMwh.exe
  C:\Windows\System\cQJWMwh.exe
  2⤵
  PID:12476
- C:\Windows\System\yZoKBZe.exe
  C:\Windows\System\yZoKBZe.exe
  2⤵
  PID:12500
- C:\Windows\System\ugHFUmk.exe
  C:\Windows\System\ugHFUmk.exe
  2⤵
  PID:12536
- C:\Windows\System\QspSaor.exe
  C:\Windows\System\QspSaor.exe
  2⤵
  PID:12552
- C:\Windows\System\iQOAswb.exe
  C:\Windows\System\iQOAswb.exe
  2⤵
  PID:12584
- C:\Windows\System\TyDCYYS.exe
  C:\Windows\System\TyDCYYS.exe
  2⤵
  PID:12600
- C:\Windows\System\DZMABxD.exe
  C:\Windows\System\DZMABxD.exe
  2⤵
  PID:12620
- C:\Windows\System\qXmWZQF.exe
  C:\Windows\System\qXmWZQF.exe
  2⤵
  PID:12648
- C:\Windows\System\qllBKia.exe
  C:\Windows\System\qllBKia.exe
  2⤵
  PID:12668
- C:\Windows\System\nGadMvD.exe
  C:\Windows\System\nGadMvD.exe
  2⤵
  PID:12700
- C:\Windows\System\XkpNsFR.exe
  C:\Windows\System\XkpNsFR.exe
  2⤵
  PID:12728
- C:\Windows\System\qYrdRWl.exe
  C:\Windows\System\qYrdRWl.exe
  2⤵
  PID:12748
- C:\Windows\System\SMcZkUm.exe
  C:\Windows\System\SMcZkUm.exe
  2⤵
  PID:12768
- C:\Windows\System\OBbirqT.exe
  C:\Windows\System\OBbirqT.exe
  2⤵
  PID:12792
- C:\Windows\System\SZxJWvb.exe
  C:\Windows\System\SZxJWvb.exe
  2⤵
  PID:12816
- C:\Windows\System\aEOYhgj.exe
  C:\Windows\System\aEOYhgj.exe
  2⤵
  PID:12840
- C:\Windows\System\CEkVeUE.exe
  C:\Windows\System\CEkVeUE.exe
  2⤵
  PID:12868
- C:\Windows\System\LyNyHKm.exe
  C:\Windows\System\LyNyHKm.exe
  2⤵
  PID:12892
- C:\Windows\System\FDCRAwP.exe
  C:\Windows\System\FDCRAwP.exe
  2⤵
  PID:12916
- C:\Windows\System\KSqeAJv.exe
  C:\Windows\System\KSqeAJv.exe
  2⤵
  PID:12948
- C:\Windows\System\ruiwbTF.exe
  C:\Windows\System\ruiwbTF.exe
  2⤵
  PID:12964
- C:\Windows\System\pfZPVRx.exe
  C:\Windows\System\pfZPVRx.exe
  2⤵
  PID:12988
- C:\Windows\System\lDdWOvt.exe
  C:\Windows\System\lDdWOvt.exe
  2⤵
  PID:13016
- C:\Windows\System\NdjHQTd.exe
  C:\Windows\System\NdjHQTd.exe
  2⤵
  PID:13052
- C:\Windows\System\SliEhRh.exe
  C:\Windows\System\SliEhRh.exe
  2⤵
  PID:13080
- C:\Windows\System\bfLnpbg.exe
  C:\Windows\System\bfLnpbg.exe
  2⤵
  PID:13108
- C:\Windows\System\FlXndVE.exe
  C:\Windows\System\FlXndVE.exe
  2⤵
  PID:13128
- C:\Windows\System\Urbdrpo.exe
  C:\Windows\System\Urbdrpo.exe
  2⤵
  PID:13152
- C:\Windows\System\ZfQGmWV.exe
  C:\Windows\System\ZfQGmWV.exe
  2⤵
  PID:13176
- C:\Windows\System\LIYoQzc.exe
  C:\Windows\System\LIYoQzc.exe
  2⤵
  PID:13212
- C:\Windows\System\UfFliCF.exe
  C:\Windows\System\UfFliCF.exe
  2⤵
  PID:13232
- C:\Windows\System\JsuknFk.exe
  C:\Windows\System\JsuknFk.exe
  2⤵
  PID:13252
- C:\Windows\System\LGlpbRP.exe
  C:\Windows\System\LGlpbRP.exe
  2⤵
  PID:13268
- C:\Windows\System\DOQSIPB.exe
  C:\Windows\System\DOQSIPB.exe
  2⤵
  PID:13288
- C:\Windows\System\dTKaTui.exe
  C:\Windows\System\dTKaTui.exe
  2⤵
  PID:11668
- C:\Windows\System\QifnGbJ.exe
  C:\Windows\System\QifnGbJ.exe
  2⤵
  PID:8816
- C:\Windows\System\ZwifxKS.exe
  C:\Windows\System\ZwifxKS.exe
  2⤵
  PID:9244
- C:\Windows\System\nmvRKky.exe
  C:\Windows\System\nmvRKky.exe
  2⤵
  PID:9340
- C:\Windows\System\itdgYyQ.exe
  C:\Windows\System\itdgYyQ.exe
  2⤵
  PID:11912
- C:\Windows\System\jCIwlbA.exe
  C:\Windows\System\jCIwlbA.exe
  2⤵
  PID:9464
- C:\Windows\System\RrUdSfr.exe
  C:\Windows\System\RrUdSfr.exe
  2⤵
  PID:10020
- C:\Windows\System\nLTPZTa.exe
  C:\Windows\System\nLTPZTa.exe
  2⤵
  PID:9688
- C:\Windows\System\CLsageM.exe
  C:\Windows\System\CLsageM.exe
  2⤵
  PID:10508
- C:\Windows\System\GNonHta.exe
  C:\Windows\System\GNonHta.exe
  2⤵
  PID:10532
- C:\Windows\System\lzLAgEC.exe
  C:\Windows\System\lzLAgEC.exe
  2⤵
  PID:10584
- C:\Windows\System\WisTssP.exe
  C:\Windows\System\WisTssP.exe
  2⤵
  PID:8700
- C:\Windows\System\euteJQu.exe
  C:\Windows\System\euteJQu.exe
  2⤵
  PID:10728
- C:\Windows\System\clOPNwF.exe
  C:\Windows\System\clOPNwF.exe
  2⤵
  PID:9272
- C:\Windows\System\oTeQtCA.exe
  C:\Windows\System\oTeQtCA.exe
  2⤵
  PID:7668
- C:\Windows\System\IrKSPpY.exe
  C:\Windows\System\IrKSPpY.exe
  2⤵
  PID:9108
- C:\Windows\System\tQEJuRu.exe
  C:\Windows\System\tQEJuRu.exe
  2⤵
  PID:10260
- C:\Windows\System\xzDCYMT.exe
  C:\Windows\System\xzDCYMT.exe
  2⤵
  PID:10884
- C:\Windows\System\XUsQlMm.exe
  C:\Windows\System\XUsQlMm.exe
  2⤵
  PID:9704
- C:\Windows\System\pEMUJRP.exe
  C:\Windows\System\pEMUJRP.exe
  2⤵
  PID:11328
- C:\Windows\System\gEnJbQm.exe
  C:\Windows\System\gEnJbQm.exe
  2⤵
  PID:3272
- C:\Windows\System\GHLbRnF.exe
  C:\Windows\System\GHLbRnF.exe
  2⤵
  PID:11376
- C:\Windows\System\giNadiJ.exe
  C:\Windows\System\giNadiJ.exe
  2⤵
  PID:13320
- C:\Windows\System\jGQaTsJ.exe
  C:\Windows\System\jGQaTsJ.exe
  2⤵
  PID:13336
- C:\Windows\System\EHINvmA.exe
  C:\Windows\System\EHINvmA.exe
  2⤵
  PID:13352
- C:\Windows\System\tzanIjy.exe
  C:\Windows\System\tzanIjy.exe
  2⤵
  PID:13368
- C:\Windows\System\adAKDxt.exe
  C:\Windows\System\adAKDxt.exe
  2⤵
  PID:13384
- C:\Windows\System\JtfTdSr.exe
  C:\Windows\System\JtfTdSr.exe
  2⤵
  PID:13400
- C:\Windows\System\KfjdkLx.exe
  C:\Windows\System\KfjdkLx.exe
  2⤵
  PID:13416
- C:\Windows\System\ONMsZZt.exe
  C:\Windows\System\ONMsZZt.exe
  2⤵
  PID:13444
- C:\Windows\System\NaPtSlR.exe
  C:\Windows\System\NaPtSlR.exe
  2⤵
  PID:13460
- C:\Windows\System\fhsBcxp.exe
  C:\Windows\System\fhsBcxp.exe
  2⤵
  PID:13488
- C:\Windows\System\AlREWEO.exe
  C:\Windows\System\AlREWEO.exe
  2⤵
  PID:13516
- C:\Windows\System\nPtumqx.exe
  C:\Windows\System\nPtumqx.exe
  2⤵
  PID:13532
- C:\Windows\System\hfDWlYl.exe
  C:\Windows\System\hfDWlYl.exe
  2⤵
  PID:13548
- C:\Windows\System\AnEynvP.exe
  C:\Windows\System\AnEynvP.exe
  2⤵
  PID:13568
- C:\Windows\System\ZdmqRaD.exe
  C:\Windows\System\ZdmqRaD.exe
  2⤵
  PID:13588
- C:\Windows\System\AGKUjFG.exe
  C:\Windows\System\AGKUjFG.exe
  2⤵
  PID:13620
- C:\Windows\System\qMPrzge.exe
  C:\Windows\System\qMPrzge.exe
  2⤵
  PID:13644
- C:\Windows\System\aTSPHZR.exe
  C:\Windows\System\aTSPHZR.exe
  2⤵
  PID:13660
- C:\Windows\System\wMSfKuZ.exe
  C:\Windows\System\wMSfKuZ.exe
  2⤵
  PID:13684
- C:\Windows\System\ihipMYF.exe
  C:\Windows\System\ihipMYF.exe
  2⤵
  PID:13728
- C:\Windows\System\VVkyegn.exe
  C:\Windows\System\VVkyegn.exe
  2⤵
  PID:13748
- C:\Windows\System\hKDRZFp.exe
  C:\Windows\System\hKDRZFp.exe
  2⤵
  PID:13772
- C:\Windows\System\tlUYwAS.exe
  C:\Windows\System\tlUYwAS.exe
  2⤵
  PID:13800
- C:\Windows\System\eOINaVI.exe
  C:\Windows\System\eOINaVI.exe
  2⤵
  PID:13816
- C:\Windows\System\XNRqhRe.exe
  C:\Windows\System\XNRqhRe.exe
  2⤵
  PID:13848
- C:\Windows\System\RYveOpt.exe
  C:\Windows\System\RYveOpt.exe
  2⤵
  PID:13876
- C:\Windows\System\LJEYREL.exe
  C:\Windows\System\LJEYREL.exe
  2⤵
  PID:13892
- C:\Windows\System\FZFpjYn.exe
  C:\Windows\System\FZFpjYn.exe
  2⤵
  PID:13928
- C:\Windows\System\ekiGWwh.exe
  C:\Windows\System\ekiGWwh.exe
  2⤵
  PID:13964
- C:\Windows\System\ebLovLc.exe
  C:\Windows\System\ebLovLc.exe
  2⤵
  PID:13984
- C:\Windows\System\wpigHuH.exe
  C:\Windows\System\wpigHuH.exe
  2⤵
  PID:14012
- C:\Windows\System\VfVECQa.exe
  C:\Windows\System\VfVECQa.exe
  2⤵
  PID:14032
- C:\Windows\System\aIJlAMs.exe
  C:\Windows\System\aIJlAMs.exe
  2⤵
  PID:14060
- C:\Windows\System\vJYNfCa.exe
  C:\Windows\System\vJYNfCa.exe
  2⤵
  PID:14076
- C:\Windows\System\cwjJFnN.exe
  C:\Windows\System\cwjJFnN.exe
  2⤵
  PID:14108
- C:\Windows\System\piIOmkp.exe
  C:\Windows\System\piIOmkp.exe
  2⤵
  PID:14132
- C:\Windows\System\HqIDGbA.exe
  C:\Windows\System\HqIDGbA.exe
  2⤵
  PID:14152
- C:\Windows\System\OfUAgNc.exe
  C:\Windows\System\OfUAgNc.exe
  2⤵
  PID:14172
- C:\Windows\System\EsMsNxA.exe
  C:\Windows\System\EsMsNxA.exe
  2⤵
  PID:14212
- C:\Windows\System\HviRRPT.exe
  C:\Windows\System\HviRRPT.exe
  2⤵
  PID:14240
- C:\Windows\System\ocXTlbJ.exe
  C:\Windows\System\ocXTlbJ.exe
  2⤵
  PID:14256
- C:\Windows\System\uILyuzn.exe
  C:\Windows\System\uILyuzn.exe
  2⤵
  PID:14276
- C:\Windows\System\TpGcgOu.exe
  C:\Windows\System\TpGcgOu.exe
  2⤵
  PID:14300
- C:\Windows\System\ITNvxsS.exe
  C:\Windows\System\ITNvxsS.exe
  2⤵
  PID:14332
- C:\Windows\System\glWPeWZ.exe
  C:\Windows\System\glWPeWZ.exe
  2⤵
  PID:8916
- C:\Windows\System\GyYtAyj.exe
  C:\Windows\System\GyYtAyj.exe
  2⤵
  PID:11132
- C:\Windows\System\Kfrhsmw.exe
  C:\Windows\System\Kfrhsmw.exe
  2⤵
  PID:11452
- C:\Windows\System\CZeyhWj.exe
  C:\Windows\System\CZeyhWj.exe
  2⤵
  PID:11540
- C:\Windows\System\OYZAulC.exe
  C:\Windows\System\OYZAulC.exe
  2⤵
  PID:12412
- C:\Windows\System\atUHhyB.exe
  C:\Windows\System\atUHhyB.exe
  2⤵
  PID:11736
- C:\Windows\System\ORcxfTR.exe
  C:\Windows\System\ORcxfTR.exe
  2⤵
  PID:7244
- C:\Windows\System\eaAqTfM.exe
  C:\Windows\System\eaAqTfM.exe
  2⤵
  PID:9332
- C:\Windows\System\UkhgUVF.exe
  C:\Windows\System\UkhgUVF.exe
  2⤵
  PID:11860
- C:\Windows\System\GdaJVBn.exe
  C:\Windows\System\GdaJVBn.exe
  2⤵
  PID:9220
- C:\Windows\System\iSIztPL.exe
  C:\Windows\System\iSIztPL.exe
  2⤵
  PID:11884
- C:\Windows\System\HqDKuZU.exe
  C:\Windows\System\HqDKuZU.exe
  2⤵
  PID:11936
- C:\Windows\System\VDkQFYL.exe
  C:\Windows\System\VDkQFYL.exe
  2⤵
  PID:9512
- C:\Windows\System\kjKzKmn.exe
  C:\Windows\System\kjKzKmn.exe
  2⤵
  PID:12056
- C:\Windows\System\fzjIZTo.exe
  C:\Windows\System\fzjIZTo.exe
  2⤵
  PID:12804
- C:\Windows\System\WIZpNGD.exe
  C:\Windows\System\WIZpNGD.exe
  2⤵
  PID:12096
- C:\Windows\System\cyUXIaG.exe
  C:\Windows\System\cyUXIaG.exe
  2⤵
  PID:12124
- C:\Windows\System\GTmCPPf.exe
  C:\Windows\System\GTmCPPf.exe
  2⤵
  PID:11656
- C:\Windows\System\iYbLvin.exe
  C:\Windows\System\iYbLvin.exe
  2⤵
  PID:12680
- C:\Windows\System\TCaMRCF.exe
  C:\Windows\System\TCaMRCF.exe
  2⤵
  PID:14308
- C:\Windows\System\JrCYzMr.exe
  C:\Windows\System\JrCYzMr.exe
  2⤵
  PID:2924
- C:\Windows\System\ksqeyxF.exe
  C:\Windows\System\ksqeyxF.exe
  2⤵
  PID:12932
- C:\Windows\System\uFkzHIO.exe
  C:\Windows\System\uFkzHIO.exe
  2⤵
  PID:10952
- C:\Windows\System\vKoCYrE.exe
  C:\Windows\System\vKoCYrE.exe
  2⤵
  PID:12260
- C:\Windows\System\hECOBUa.exe
  C:\Windows\System\hECOBUa.exe
  2⤵
  PID:11104
- C:\Windows\System\NBYWshm.exe
  C:\Windows\System\NBYWshm.exe
  2⤵
  PID:11268
- C:\Windows\System\SZrWgDO.exe
  C:\Windows\System\SZrWgDO.exe
  2⤵
  PID:13428
- C:\Windows\System\IuYWvvA.exe
  C:\Windows\System\IuYWvvA.exe
  2⤵
  PID:13484
- C:\Windows\System\qEyZybN.exe
  C:\Windows\System\qEyZybN.exe
  2⤵
  PID:13544
- C:\Windows\System\LBJVyUW.exe
  C:\Windows\System\LBJVyUW.exe
  2⤵
  PID:12312
- C:\Windows\System\bTfOVGo.exe
  C:\Windows\System\bTfOVGo.exe
  2⤵
  PID:12292
- C:\Windows\System\VqdeZeG.exe
  C:\Windows\System\VqdeZeG.exe
  2⤵
  PID:12348
- C:\Windows\System\nufqzYg.exe
  C:\Windows\System\nufqzYg.exe
  2⤵
  PID:12404
- C:\Windows\System\iVgwaVE.exe
  C:\Windows\System\iVgwaVE.exe
  2⤵
  PID:7564
- C:\Windows\System\fRSLflD.exe
  C:\Windows\System\fRSLflD.exe
  2⤵
  PID:12468
- C:\Windows\System\VfKJVWk.exe
  C:\Windows\System\VfKJVWk.exe
  2⤵
  PID:12512
- C:\Windows\System\KWbKbdd.exe
  C:\Windows\System\KWbKbdd.exe
  2⤵
  PID:13856
- C:\Windows\System\ZkMpcte.exe
  C:\Windows\System\ZkMpcte.exe
  2⤵
  PID:12592
- C:\Windows\System\zxLrtLa.exe
  C:\Windows\System\zxLrtLa.exe
  2⤵
  PID:12616
- C:\Windows\System\vXXOBfR.exe
  C:\Windows\System\vXXOBfR.exe
  2⤵
  PID:12660
- C:\Windows\System\mQIpEXY.exe
  C:\Windows\System\mQIpEXY.exe
  2⤵
  PID:12724
- C:\Windows\System\OVNTQwZ.exe
  C:\Windows\System\OVNTQwZ.exe
  2⤵
  PID:14096
- C:\Windows\System\slfvJXc.exe
  C:\Windows\System\slfvJXc.exe
  2⤵
  PID:12784
- C:\Windows\System\ZiNdqJT.exe
  C:\Windows\System\ZiNdqJT.exe
  2⤵
  PID:14272
- C:\Windows\System\beEQLzL.exe
  C:\Windows\System\beEQLzL.exe
  2⤵
  PID:12424
- C:\Windows\System\cObHgSk.exe
  C:\Windows\System\cObHgSk.exe
  2⤵
  PID:12580
- C:\Windows\System\CxFjFDb.exe
  C:\Windows\System\CxFjFDb.exe
  2⤵
  PID:13124
- C:\Windows\System\DkClLQz.exe
  C:\Windows\System\DkClLQz.exe
  2⤵
  PID:13184
- C:\Windows\System\aJhGAlR.exe
  C:\Windows\System\aJhGAlR.exe
  2⤵
  PID:11992
- C:\Windows\System\NwgopkJ.exe
  C:\Windows\System\NwgopkJ.exe
  2⤵
  PID:12928
- C:\Windows\System\cPVvSPY.exe
  C:\Windows\System\cPVvSPY.exe
  2⤵
  PID:12980
- C:\Windows\System\nvyzwhA.exe
  C:\Windows\System\nvyzwhA.exe
  2⤵
  PID:13120
- C:\Windows\System\mfRzWZK.exe
  C:\Windows\System\mfRzWZK.exe
  2⤵
  PID:13408
- C:\Windows\System\sHvLsXX.exe
  C:\Windows\System\sHvLsXX.exe
  2⤵
  PID:14068
- C:\Windows\System\CmmYNdz.exe
  C:\Windows\System\CmmYNdz.exe
  2⤵
  PID:13168
- C:\Windows\System\HkKrTsE.exe
  C:\Windows\System\HkKrTsE.exe
  2⤵
  PID:3756
- C:\Windows\System\MqgziUb.exe
  C:\Windows\System\MqgziUb.exe
  2⤵
  PID:10312
- C:\Windows\System\evmLsaS.exe
  C:\Windows\System\evmLsaS.exe
  2⤵
  PID:10748
- C:\Windows\System\kRtsxhe.exe
  C:\Windows\System\kRtsxhe.exe
  2⤵
  PID:15404
- C:\Windows\System\wLqcXpr.exe
  C:\Windows\System\wLqcXpr.exe
  2⤵
  PID:15428
- C:\Windows\System\ShPFWOu.exe
  C:\Windows\System\ShPFWOu.exe
  2⤵
  PID:15496
- C:\Windows\System\MJWazQw.exe
  C:\Windows\System\MJWazQw.exe
  2⤵
  PID:15520
- C:\Windows\System\YQAdRVv.exe
  C:\Windows\System\YQAdRVv.exe
  2⤵
  PID:15544
- C:\Windows\System\RsdoWbX.exe
  C:\Windows\System\RsdoWbX.exe
  2⤵
  PID:15588
- C:\Windows\System\BHmMwig.exe
  C:\Windows\System\BHmMwig.exe
  2⤵
  PID:15628
- C:\Windows\System\AIfYnEd.exe
  C:\Windows\System\AIfYnEd.exe
  2⤵
  PID:15668
- C:\Windows\System\ulJbtrQ.exe
  C:\Windows\System\ulJbtrQ.exe
  2⤵
  PID:15688
- C:\Windows\System\cnqGMFg.exe
  C:\Windows\System\cnqGMFg.exe
  2⤵
  PID:15712
- C:\Windows\System\YsnfkUd.exe
  C:\Windows\System\YsnfkUd.exe
  2⤵
  PID:15736
- C:\Windows\System\BdywnfY.exe
  C:\Windows\System\BdywnfY.exe
  2⤵
  PID:15760
- C:\Windows\System\EpommoO.exe
  C:\Windows\System\EpommoO.exe
  2⤵
  PID:15776
- C:\Windows\System\PPpuGrt.exe
  C:\Windows\System\PPpuGrt.exe
  2⤵
  PID:15812
- C:\Windows\System\SYuOsGh.exe
  C:\Windows\System\SYuOsGh.exe
  2⤵
  PID:15832
- C:\Windows\System\gxSjlWF.exe
  C:\Windows\System\gxSjlWF.exe
  2⤵
  PID:15856
- C:\Windows\System\BuERmfz.exe
  C:\Windows\System\BuERmfz.exe
  2⤵
  PID:15876
- C:\Windows\System\gpEzPlr.exe
  C:\Windows\System\gpEzPlr.exe
  2⤵
  PID:15892
- C:\Windows\System\hkvAXTi.exe
  C:\Windows\System\hkvAXTi.exe
  2⤵
  PID:15928
- C:\Windows\System\pqcILaU.exe
  C:\Windows\System\pqcILaU.exe
  2⤵
  PID:15944
- C:\Windows\System\PpmtPvE.exe
  C:\Windows\System\PpmtPvE.exe
  2⤵
  PID:16032
- C:\Windows\System\KekYeAW.exe
  C:\Windows\System\KekYeAW.exe
  2⤵
  PID:16052
- C:\Windows\System\qdUQlMt.exe
  C:\Windows\System\qdUQlMt.exe
  2⤵
  PID:16072
- C:\Windows\System\UxELdIZ.exe
  C:\Windows\System\UxELdIZ.exe
  2⤵
  PID:16092
- C:\Windows\System\YRiyLcj.exe
  C:\Windows\System\YRiyLcj.exe
  2⤵
  PID:16116
- C:\Windows\System\RtLFpsf.exe
  C:\Windows\System\RtLFpsf.exe
  2⤵
  PID:16140
- C:\Windows\System\FXTmTfU.exe
  C:\Windows\System\FXTmTfU.exe
  2⤵
  PID:16160
- C:\Windows\System\gYXAtEO.exe
  C:\Windows\System\gYXAtEO.exe
  2⤵
  PID:16176
- C:\Windows\System\XQbJFMB.exe
  C:\Windows\System\XQbJFMB.exe
  2⤵
  PID:16196
- C:\Windows\System\Xyogpvj.exe
  C:\Windows\System\Xyogpvj.exe
  2⤵
  PID:16220
- C:\Windows\System\ZULmElq.exe
  C:\Windows\System\ZULmElq.exe
  2⤵
  PID:16244
- C:\Windows\System\wdwFPKL.exe
  C:\Windows\System\wdwFPKL.exe
  2⤵
  PID:16268
- C:\Windows\System\UBEKPKH.exe
  C:\Windows\System\UBEKPKH.exe
  2⤵
  PID:16376
- C:\Windows\System\EHnOhXc.exe
  C:\Windows\System\EHnOhXc.exe
  2⤵
  PID:14796
- C:\Windows\System\XwetJIZ.exe
  C:\Windows\System\XwetJIZ.exe
  2⤵
  PID:14832
- C:\Windows\System\eolKNgO.exe
  C:\Windows\System\eolKNgO.exe
  2⤵
  PID:14856
- C:\Windows\System\QjBNiiB.exe
  C:\Windows\System\QjBNiiB.exe
  2⤵
  PID:13920
- C:\Windows\System\oPyuCmQ.exe
  C:\Windows\System\oPyuCmQ.exe
  2⤵
  PID:14892
- C:\Windows\System\ExSdpTi.exe
  C:\Windows\System\ExSdpTi.exe
  2⤵
  PID:14948
- C:\Windows\System\uQXLZkL.exe
  C:\Windows\System\uQXLZkL.exe
  2⤵
  PID:2800
- C:\Windows\System\WejOubh.exe
  C:\Windows\System\WejOubh.exe
  2⤵
  PID:16408
- C:\Windows\System\GRoBipE.exe
  C:\Windows\System\GRoBipE.exe
  2⤵
  PID:16424
- C:\Windows\System\zoZqvew.exe
  C:\Windows\System\zoZqvew.exe
  2⤵
  PID:16448
- C:\Windows\System\hxQBKrJ.exe
  C:\Windows\System\hxQBKrJ.exe
  2⤵
  PID:16464
- C:\Windows\System\KjFLrIC.exe
  C:\Windows\System\KjFLrIC.exe
  2⤵
  PID:16580
- C:\Windows\System\uwSfrdK.exe
  C:\Windows\System\uwSfrdK.exe
  2⤵
  PID:16596
- C:\Windows\System\NbZqzyU.exe
  C:\Windows\System\NbZqzyU.exe
  2⤵
  PID:16620
- C:\Windows\System\nJWogmO.exe
  C:\Windows\System\nJWogmO.exe
  2⤵
  PID:16644
- C:\Windows\System\CawrQFy.exe
  C:\Windows\System\CawrQFy.exe
  2⤵
  PID:16668
- C:\Windows\System\zXclUxo.exe
  C:\Windows\System\zXclUxo.exe
  2⤵
  PID:16704
- C:\Windows\System\MlgOnkT.exe
  C:\Windows\System\MlgOnkT.exe
  2⤵
  PID:16728
- C:\Windows\System\rFtjqcG.exe
  C:\Windows\System\rFtjqcG.exe
  2⤵
  PID:16748
- C:\Windows\System\rIRTDxg.exe
  C:\Windows\System\rIRTDxg.exe
  2⤵
  PID:16772
- C:\Windows\System\MojJmoV.exe
  C:\Windows\System\MojJmoV.exe
  2⤵
  PID:17016
- C:\Windows\System\jGZxgev.exe
  C:\Windows\System\jGZxgev.exe
  2⤵
  PID:17032
- C:\Windows\System\tIKevCQ.exe
  C:\Windows\System\tIKevCQ.exe
  2⤵
  PID:17048
- C:\Windows\System\IWyslzi.exe
  C:\Windows\System\IWyslzi.exe
  2⤵
  PID:17064
- C:\Windows\System\ZdTBMUl.exe
  C:\Windows\System\ZdTBMUl.exe
  2⤵
  PID:13264
- C:\Windows\System\tTyFxZy.exe
  C:\Windows\System\tTyFxZy.exe
  2⤵
  PID:16280
- C:\Windows\System\nDzyCrt.exe
  C:\Windows\System\nDzyCrt.exe
  2⤵
  PID:16016
- C:\Windows\System\lhdBsmp.exe
  C:\Windows\System\lhdBsmp.exe
  2⤵
  PID:15864
- C:\Windows\System\uImlVnP.exe
  C:\Windows\System\uImlVnP.exe
  2⤵
  PID:15752
- C:\Windows\System\sZlySmb.exe
  C:\Windows\System\sZlySmb.exe
  2⤵
  PID:12548
- C:\Windows\System\GraxqhP.exe
  C:\Windows\System\GraxqhP.exe
  2⤵
  PID:14200
- C:\Windows\System\cJGYNIl.exe
  C:\Windows\System\cJGYNIl.exe
  2⤵
  PID:14388
- C:\Windows\System\bLkZASp.exe
  C:\Windows\System\bLkZASp.exe
  2⤵
  PID:12900
- C:\Windows\System\zkptrdP.exe
  C:\Windows\System\zkptrdP.exe
  2⤵
  PID:16932
- C:\Windows\System\qupcUCP.exe
  C:\Windows\System\qupcUCP.exe
  2⤵
  PID:4216
- C:\Windows\System\SNeVrDP.exe
  C:\Windows\System\SNeVrDP.exe
  2⤵
  PID:12196
- C:\Windows\System\mTkkzze.exe
  C:\Windows\System\mTkkzze.exe
  2⤵
  PID:13700
- C:\Windows\System\ToSIeKm.exe
  C:\Windows\System\ToSIeKm.exe
  2⤵
  PID:16992
- C:\Windows\System\UQsQzAp.exe
  C:\Windows\System\UQsQzAp.exe
  2⤵
  PID:17028
- C:\Windows\System\Gzbqvna.exe
  C:\Windows\System\Gzbqvna.exe
  2⤵
  PID:4764
- C:\Windows\System\YmqUZAm.exe
  C:\Windows\System\YmqUZAm.exe
  2⤵
  PID:15664
- C:\Windows\System\Lcgrfwm.exe
  C:\Windows\System\Lcgrfwm.exe
  2⤵
  PID:17144
- C:\Windows\System\PEEyHZI.exe
  C:\Windows\System\PEEyHZI.exe
  2⤵
  PID:15824
- C:\Windows\System\uVaxHlZ.exe
  C:\Windows\System\uVaxHlZ.exe
  2⤵
  PID:17176
- C:\Windows\System\jsTtyKx.exe
  C:\Windows\System\jsTtyKx.exe
  2⤵
  PID:16172
- C:\Windows\System\nfKlDry.exe
  C:\Windows\System\nfKlDry.exe
  2⤵
  PID:14716
- C:\Windows\System\GQaFYSI.exe
  C:\Windows\System\GQaFYSI.exe
  2⤵
  PID:14976
- C:\Windows\System\wXzBFBa.exe
  C:\Windows\System\wXzBFBa.exe
  2⤵
  PID:14928
- C:\Windows\System\mPSQnLl.exe
  C:\Windows\System\mPSQnLl.exe
  2⤵
  PID:16724
- C:\Windows\System\SuTdWAR.exe
  C:\Windows\System\SuTdWAR.exe
  2⤵
  PID:17076
- C:\Windows\System\IAxzklr.exe
  C:\Windows\System\IAxzklr.exe
  2⤵
  PID:16588
- C:\Windows\System\AJzZpQV.exe
  C:\Windows\System\AJzZpQV.exe
  2⤵
  PID:16316
- C:\Windows\System\FDayqPU.exe
  C:\Windows\System\FDayqPU.exe
  2⤵
  PID:16348
- C:\Windows\System\tnjgOgE.exe
  C:\Windows\System\tnjgOgE.exe
  2⤵
  PID:14692
- C:\Windows\System\ZSmPaRU.exe
  C:\Windows\System\ZSmPaRU.exe
  2⤵
  PID:13720
- C:\Windows\System\fEqhEiV.exe
  C:\Windows\System\fEqhEiV.exe
  2⤵
  PID:13440
- C:\Windows\System\ZGXSxpU.exe
  C:\Windows\System\ZGXSxpU.exe
  2⤵
  PID:17124
- C:\Windows\System\sdYpLao.exe
  C:\Windows\System\sdYpLao.exe
  2⤵
  PID:12456
- C:\Windows\System\MwasbPT.exe
  C:\Windows\System\MwasbPT.exe
  2⤵
  PID:11432
- C:\Windows\System\gbKDSbS.exe
  C:\Windows\System\gbKDSbS.exe
  2⤵
  PID:1960
- C:\Windows\System\DAsFEck.exe
  C:\Windows\System\DAsFEck.exe
  2⤵
  PID:15136
- C:\Windows\System\pZBTlZZ.exe
  C:\Windows\System\pZBTlZZ.exe
  2⤵
  PID:14072
- C:\Windows\System\IRUBcWH.exe
  C:\Windows\System\IRUBcWH.exe
  2⤵
  PID:12516
- C:\Windows\System\MmTmWdg.exe
  C:\Windows\System\MmTmWdg.exe
  2⤵
  PID:13300
- C:\Windows\System\eZZahXJ.exe
  C:\Windows\System\eZZahXJ.exe
  2⤵
  PID:16292
- C:\Windows\System\uRyLPqE.exe
  C:\Windows\System\uRyLPqE.exe
  2⤵
  PID:16592
- C:\Windows\System\vDjoMQr.exe
  C:\Windows\System\vDjoMQr.exe
  2⤵
  PID:4076
- C:\Windows\System\mffNRdv.exe
  C:\Windows\System\mffNRdv.exe
  2⤵
  PID:16256
- C:\Windows\System\uyzPeqN.exe
  C:\Windows\System\uyzPeqN.exe
  2⤵
  PID:14888
- C:\Windows\System\JwelLrG.exe
  C:\Windows\System\JwelLrG.exe
  2⤵
  PID:14660
- C:\Windows\System\RyQFOLk.exe
  C:\Windows\System\RyQFOLk.exe
  2⤵
  PID:14344
- C:\Windows\System\BiOIhPD.exe
  C:\Windows\System\BiOIhPD.exe
  2⤵
  PID:4336
- C:\Windows\System\agHkqaZ.exe
  C:\Windows\System\agHkqaZ.exe
  2⤵
  PID:16608
- C:\Windows\System\FMMbOnm.exe
  C:\Windows\System\FMMbOnm.exe
  2⤵
  PID:17324
- C:\Windows\System\tdAZJrK.exe
  C:\Windows\System\tdAZJrK.exe
  2⤵
  PID:16396
- C:\Windows\System\QePYxYZ.exe
  C:\Windows\System\QePYxYZ.exe
  2⤵
  PID:11908
- C:\Windows\System\onSuCqA.exe
  C:\Windows\System\onSuCqA.exe
  2⤵
  PID:15988
- C:\Windows\System\jutNASa.exe
  C:\Windows\System\jutNASa.exe
  2⤵
  PID:14116
- C:\Windows\System\pXXtilY.exe
  C:\Windows\System\pXXtilY.exe
  2⤵
  PID:15964
- C:\Windows\System\tdwJmLB.exe
  C:\Windows\System\tdwJmLB.exe
  2⤵
  PID:17328
- C:\Windows\System\TQtdiPy.exe
  C:\Windows\System\TQtdiPy.exe
  2⤵
  PID:12524
- C:\Windows\System\YgBjZOA.exe
  C:\Windows\System\YgBjZOA.exe
  2⤵
  PID:16912
- C:\Windows\System\eCDTeGI.exe
  C:\Windows\System\eCDTeGI.exe
  2⤵
  PID:15704
- C:\Windows\System\bJGgZJs.exe
  C:\Windows\System\bJGgZJs.exe
  2⤵
  PID:17024
- C:\Windows\System\pqOjxzq.exe
  C:\Windows\System\pqOjxzq.exe
  2⤵
  PID:14348
- C:\Windows\System\wVcylWv.exe
  C:\Windows\System\wVcylWv.exe
  2⤵
  PID:15960
- C:\Windows\System\XRttZbj.exe
  C:\Windows\System\XRttZbj.exe
  2⤵
  PID:3352
- C:\Windows\System\CxkUWzg.exe
  C:\Windows\System\CxkUWzg.exe
  2⤵
  PID:17004
- C:\Windows\System\cjWVkGf.exe
  C:\Windows\System\cjWVkGf.exe
  2⤵
  PID:15440
- C:\Windows\System\MoskbEn.exe
  C:\Windows\System\MoskbEn.exe
  2⤵
  PID:15608
- C:\Windows\System\vGipBst.exe
  C:\Windows\System\vGipBst.exe
  2⤵
  PID:3968
- C:\Windows\System\RAVIIAK.exe
  C:\Windows\System\RAVIIAK.exe
  2⤵
  PID:16504
- C:\Windows\System\xjeJCWq.exe
  C:\Windows\System\xjeJCWq.exe
  2⤵
  PID:16364
- C:\Windows\System\lHbuevr.exe
  C:\Windows\System\lHbuevr.exe
  2⤵
  PID:3588
- C:\Windows\System\OswDqni.exe
  C:\Windows\System\OswDqni.exe
  2⤵
  PID:16372
- C:\Windows\System\MbHkGUs.exe
  C:\Windows\System\MbHkGUs.exe
  2⤵
  PID:16480
- C:\Windows\System\USseoVK.exe
  C:\Windows\System\USseoVK.exe
  2⤵
  PID:13048
- C:\Windows\System\pWrTiGL.exe
  C:\Windows\System\pWrTiGL.exe
  2⤵
  PID:3328
- C:\Windows\System\HumnHVy.exe
  C:\Windows\System\HumnHVy.exe
  2⤵
  PID:1340
- C:\Windows\System\TPnDesF.exe
  C:\Windows\System\TPnDesF.exe
  2⤵
  PID:14940
- C:\Windows\System\QzKcyEj.exe
  C:\Windows\System\QzKcyEj.exe
  2⤵
  PID:16288
- C:\Windows\System\efqalJG.exe
  C:\Windows\System\efqalJG.exe
  2⤵
  PID:14568
- C:\Windows\System\tGUtHLD.exe
  C:\Windows\System\tGUtHLD.exe
  2⤵
  PID:16988
- C:\Windows\System\QeiTTnM.exe
  C:\Windows\System\QeiTTnM.exe
  2⤵
  PID:16044
- C:\Windows\System\LkQHMbp.exe
  C:\Windows\System\LkQHMbp.exe
  2⤵
  PID:4520
- C:\Windows\System\eaOMVdL.exe
  C:\Windows\System\eaOMVdL.exe
  2⤵
  PID:15508
- C:\Windows\System\lIsdRWr.exe
  C:\Windows\System\lIsdRWr.exe
  2⤵
  PID:17116
- C:\Windows\System\hTiYTdu.exe
  C:\Windows\System\hTiYTdu.exe
  2⤵
  PID:4628
- C:\Windows\System\OmpVzip.exe
  C:\Windows\System\OmpVzip.exe
  2⤵
  PID:752
- C:\Windows\System\KtoyYmS.exe
  C:\Windows\System\KtoyYmS.exe
  2⤵
  PID:11040
- C:\Windows\System\hRhkYko.exe
  C:\Windows\System\hRhkYko.exe
  2⤵
  PID:16324
- C:\Windows\System\WvKGsCl.exe
  C:\Windows\System\WvKGsCl.exe
  2⤵
  PID:9792
- C:\Windows\System\fIlvPDp.exe
  C:\Windows\System\fIlvPDp.exe
  2⤵
  PID:16520
- C:\Windows\System\IVxriJm.exe
  C:\Windows\System\IVxriJm.exe
  2⤵
  PID:13012
- C:\Windows\System\lTCnhkC.exe
  C:\Windows\System\lTCnhkC.exe
  2⤵
  PID:16400
- C:\Windows\System\HpoUTIe.exe
  C:\Windows\System\HpoUTIe.exe
  2⤵
  PID:16916
- C:\Windows\System\pxKiHAA.exe
  C:\Windows\System\pxKiHAA.exe
  2⤵
  PID:11168
- C:\Windows\System\knlVbke.exe
  C:\Windows\System\knlVbke.exe
  2⤵
  PID:3904
- C:\Windows\System\asAbGOR.exe
  C:\Windows\System\asAbGOR.exe
  2⤵
  PID:9964
- C:\Windows\System\txGcKSp.exe
  C:\Windows\System\txGcKSp.exe
  2⤵
  PID:17272
- C:\Windows\System\VjfvyxB.exe
  C:\Windows\System\VjfvyxB.exe
  2⤵
  PID:15572
- C:\Windows\System\cSLCHyC.exe
  C:\Windows\System\cSLCHyC.exe
  2⤵
  PID:60
- C:\Windows\System\CUhVREA.exe
  C:\Windows\System\CUhVREA.exe
  2⤵
  PID:1868
- C:\Windows\System\QqUiBRd.exe
  C:\Windows\System\QqUiBRd.exe
  2⤵
  PID:14476
- C:\Windows\System\KeQkyyD.exe
  C:\Windows\System\KeQkyyD.exe
  2⤵
  PID:5468
- C:\Windows\System\mKHJyRb.exe
  C:\Windows\System\mKHJyRb.exe
  2⤵
  PID:5512
- C:\Windows\System\EsZeQpO.exe
  C:\Windows\System\EsZeQpO.exe
  2⤵
  PID:10408
- C:\Windows\System\hWsjKPE.exe
  C:\Windows\System\hWsjKPE.exe
  2⤵
  PID:3380
- C:\Windows\System\NaxxYgw.exe
  C:\Windows\System\NaxxYgw.exe
  2⤵
  PID:5260
- C:\Windows\System\tHTVEXb.exe
  C:\Windows\System\tHTVEXb.exe
  2⤵
  PID:2824
- C:\Windows\System\BAcQCVL.exe
  C:\Windows\System\BAcQCVL.exe
  2⤵
  PID:17228
- C:\Windows\System\rSbZlzH.exe
  C:\Windows\System\rSbZlzH.exe
  2⤵
  PID:14316
- C:\Windows\System\pyxRqtV.exe
  C:\Windows\System\pyxRqtV.exe
  2⤵
  PID:15176
- C:\Windows\System\QWHobyn.exe
  C:\Windows\System\QWHobyn.exe
  2⤵
  PID:5276
- C:\Windows\System\wRfDbXU.exe
  C:\Windows\System\wRfDbXU.exe
  2⤵
  PID:16812
- C:\Windows\System\wXLhcJy.exe
  C:\Windows\System\wXLhcJy.exe
  2⤵
  PID:3604
- C:\Windows\System\SKaPjAC.exe
  C:\Windows\System\SKaPjAC.exe
  2⤵
  PID:5800
- C:\Windows\System\jyhjJhS.exe
  C:\Windows\System\jyhjJhS.exe
  2⤵
  PID:16352
- C:\Windows\System\JvaDDej.exe
  C:\Windows\System\JvaDDej.exe
  2⤵
  PID:16240
- C:\Windows\System\ADsgGME.exe
  C:\Windows\System\ADsgGME.exe
  2⤵
  PID:5196
- C:\Windows\System\YOnPGPV.exe
  C:\Windows\System\YOnPGPV.exe
  2⤵
  PID:16768
- C:\Windows\System\PncCIVH.exe
  C:\Windows\System\PncCIVH.exe
  2⤵
  PID:13888
- C:\Windows\System\cOOTTCg.exe
  C:\Windows\System\cOOTTCg.exe
  2⤵
  PID:868
- C:\Windows\System\gvuXuGa.exe
  C:\Windows\System\gvuXuGa.exe
  2⤵
  PID:12444
- C:\Windows\System\dIpnVYr.exe
  C:\Windows\System\dIpnVYr.exe
  2⤵
  PID:10132
- C:\Windows\System\gBecbZQ.exe
  C:\Windows\System\gBecbZQ.exe
  2⤵
  PID:4372
- C:\Windows\System\ayZDNtn.exe
  C:\Windows\System\ayZDNtn.exe
  2⤵
  PID:3208
- C:\Windows\System\LtfcmJC.exe
  C:\Windows\System\LtfcmJC.exe
  2⤵
  PID:5556
- C:\Windows\System\WntNZYm.exe
  C:\Windows\System\WntNZYm.exe
  2⤵
  PID:3872
- C:\Windows\System\DbAfeVj.exe
  C:\Windows\System\DbAfeVj.exe
  2⤵
  PID:3320
- C:\Windows\System\CbzScYD.exe
  C:\Windows\System\CbzScYD.exe
  2⤵
  PID:1288
- C:\Windows\System\tEifbfc.exe
  C:\Windows\System\tEifbfc.exe
  2⤵
  PID:1552
- C:\Windows\System\QRRSEZO.exe
  C:\Windows\System\QRRSEZO.exe
  2⤵
  PID:5256
- C:\Windows\System\fqmBtWf.exe
  C:\Windows\System\fqmBtWf.exe
  2⤵
  PID:14768
- C:\Windows\System\hIEmREN.exe
  C:\Windows\System\hIEmREN.exe
  2⤵
  PID:12092
- C:\Windows\System\EdsQNay.exe
  C:\Windows\System\EdsQNay.exe
  2⤵
  PID:5760
- C:\Windows\System\efhTUsy.exe
  C:\Windows\System\efhTUsy.exe
  2⤵
  PID:5908
- C:\Windows\System\FwzbGql.exe
  C:\Windows\System\FwzbGql.exe
  2⤵
  PID:3360
- C:\Windows\System\WUpPKse.exe
  C:\Windows\System\WUpPKse.exe
  2⤵
  PID:5576
- C:\Windows\System\bvaxjvm.exe
  C:\Windows\System\bvaxjvm.exe
  2⤵
  PID:5920
- C:\Windows\System\eZPBdNA.exe
  C:\Windows\System\eZPBdNA.exe
  2⤵
  PID:15912
- C:\Windows\System\TiFFPZd.exe
  C:\Windows\System\TiFFPZd.exe
  2⤵
  PID:5896
- C:\Windows\System\FxXZkbY.exe
  C:\Windows\System\FxXZkbY.exe
  2⤵
  PID:6020
- C:\Windows\System\dQxcvZt.exe
  C:\Windows\System\dQxcvZt.exe
  2⤵
  PID:6036
- C:\Windows\System\lCseitX.exe
  C:\Windows\System\lCseitX.exe
  2⤵
  PID:16720
- C:\Windows\System\sLWkiHL.exe
  C:\Windows\System\sLWkiHL.exe
  2⤵
  PID:6044
- C:\Windows\System\VGghIxB.exe
  C:\Windows\System\VGghIxB.exe
  2⤵
  PID:16740
- C:\Windows\System\LuvOsMl.exe
  C:\Windows\System\LuvOsMl.exe
  2⤵
  PID:16788
- C:\Windows\System\qngDGNI.exe
  C:\Windows\System\qngDGNI.exe
  2⤵
  PID:14248
- C:\Windows\System\dofQLYT.exe
  C:\Windows\System\dofQLYT.exe
  2⤵
  PID:5956
- C:\Windows\System\QRCBNRi.exe
  C:\Windows\System\QRCBNRi.exe
  2⤵
  PID:15708
- C:\Windows\System\BwnrdWQ.exe
  C:\Windows\System\BwnrdWQ.exe
  2⤵
  PID:5328
- C:\Windows\System\BVKWwTy.exe
  C:\Windows\System\BVKWwTy.exe
  2⤵
  PID:14428
- C:\Windows\System\mFeqpzi.exe
  C:\Windows\System\mFeqpzi.exe
  2⤵
  PID:14356
- C:\Windows\System\FnTzUhx.exe
  C:\Windows\System\FnTzUhx.exe
  2⤵
  PID:15684
- C:\Windows\System\vMGvcJR.exe
  C:\Windows\System\vMGvcJR.exe
  2⤵
  PID:9956
- C:\Windows\System\FhAxRYy.exe
  C:\Windows\System\FhAxRYy.exe
  2⤵
  PID:6004
- C:\Windows\System\HQABLvd.exe
  C:\Windows\System\HQABLvd.exe
  2⤵
  PID:3512
- C:\Windows\System\qnnkdgr.exe
  C:\Windows\System\qnnkdgr.exe
  2⤵
  PID:3916
- C:\Windows\System\bkKRqYg.exe
  C:\Windows\System\bkKRqYg.exe
  2⤵
  PID:6168
- C:\Windows\System\QECMIZj.exe
  C:\Windows\System\QECMIZj.exe
  2⤵
  PID:3248
- C:\Windows\System\PSOTUby.exe
  C:\Windows\System\PSOTUby.exe
  2⤵
  PID:4740
- C:\Windows\System\jPVtwxF.exe
  C:\Windows\System\jPVtwxF.exe
  2⤵
  PID:5844
- C:\Windows\System\WPmxATc.exe
  C:\Windows\System\WPmxATc.exe
  2⤵
  PID:6612
- C:\Windows\System\ZaVbZPG.exe
  C:\Windows\System\ZaVbZPG.exe
  2⤵
  PID:6216
- C:\Windows\System\VifyHGM.exe
  C:\Windows\System\VifyHGM.exe
  2⤵
  PID:6292
- C:\Windows\System\YIzvmfk.exe
  C:\Windows\System\YIzvmfk.exe
  2⤵
  PID:6772
- C:\Windows\System\wSLALRn.exe
  C:\Windows\System\wSLALRn.exe
  2⤵
  PID:6504
- C:\Windows\System\axStFRV.exe
  C:\Windows\System\axStFRV.exe
  2⤵
  PID:6844
- C:\Windows\System\zGJwIAn.exe
  C:\Windows\System\zGJwIAn.exe
  2⤵
  PID:6716
- C:\Windows\System\cBlGGWA.exe
  C:\Windows\System\cBlGGWA.exe
  2⤵
  PID:5544
- C:\Windows\System\vMjoTST.exe
  C:\Windows\System\vMjoTST.exe
  2⤵
  PID:6804
- C:\Windows\System\wQUzFRo.exe
  C:\Windows\System\wQUzFRo.exe
  2⤵
  PID:5668
- C:\Windows\System\KzAtiQB.exe
  C:\Windows\System\KzAtiQB.exe
  2⤵
  PID:4528
- C:\Windows\System\YEfEvjs.exe
  C:\Windows\System\YEfEvjs.exe
  2⤵
  PID:6980
- C:\Windows\System\apFqEMr.exe
  C:\Windows\System\apFqEMr.exe
  2⤵
  PID:17200
- C:\Windows\System\WIjeEWZ.exe
  C:\Windows\System\WIjeEWZ.exe
  2⤵
  PID:6892
- C:\Windows\System\Xewqngk.exe
  C:\Windows\System\Xewqngk.exe
  2⤵
  PID:6780
- C:\Windows\System\CeEJjlT.exe
  C:\Windows\System\CeEJjlT.exe
  2⤵
  PID:5848
- C:\Windows\System\nAWAACW.exe
  C:\Windows\System\nAWAACW.exe
  2⤵
  PID:7276
- C:\Windows\System\ioVemST.exe
  C:\Windows\System\ioVemST.exe
  2⤵
  PID:7744
- C:\Windows\System\cKnjAjI.exe
  C:\Windows\System\cKnjAjI.exe
  2⤵
  PID:7340
- C:\Windows\System\YzjTPxN.exe
  C:\Windows\System\YzjTPxN.exe
  2⤵
  PID:7600
- C:\Windows\System\QWiHWNz.exe
  C:\Windows\System\QWiHWNz.exe
  2⤵
  PID:7088
- C:\Windows\System\sTuxRjD.exe
  C:\Windows\System\sTuxRjD.exe
  2⤵
  PID:7392
- C:\Windows\System\zelIuXO.exe
  C:\Windows\System\zelIuXO.exe
  2⤵
  PID:7456
- C:\Windows\System\eWWtIXw.exe
  C:\Windows\System\eWWtIXw.exe
  2⤵
  PID:7768
- C:\Windows\System\tWNvXru.exe
  C:\Windows\System\tWNvXru.exe
  2⤵
  PID:7304
- C:\Windows\System\lJlcftg.exe
  C:\Windows\System\lJlcftg.exe
  2⤵
  PID:7884
- C:\Windows\System\DCUjDfY.exe
  C:\Windows\System\DCUjDfY.exe
  2⤵
  PID:7896
- C:\Windows\System\IFkJItq.exe
  C:\Windows\System\IFkJItq.exe
  2⤵
  PID:6468
- C:\Windows\System\rtcfDIa.exe
  C:\Windows\System\rtcfDIa.exe
  2⤵
  PID:7100
- C:\Windows\System\eRKtUZw.exe
  C:\Windows\System\eRKtUZw.exe
  2⤵
  PID:6624
- C:\Windows\System\CpWqlnv.exe
  C:\Windows\System\CpWqlnv.exe
  2⤵
  PID:4896
- C:\Windows\System\czRlLZC.exe
  C:\Windows\System\czRlLZC.exe
  2⤵
  PID:8800
- C:\Windows\System\UvrPOEB.exe
  C:\Windows\System\UvrPOEB.exe
  2⤵
  PID:9064
- C:\Windows\System\OTBlXmx.exe
  C:\Windows\System\OTBlXmx.exe
  2⤵
  PID:9208
- C:\Windows\System\IRuIniv.exe
  C:\Windows\System\IRuIniv.exe
  2⤵
  PID:14820
- C:\Windows\System\qFujixI.exe
  C:\Windows\System\qFujixI.exe
  2⤵
  PID:8112
- C:\Windows\System\IxEZCcU.exe
  C:\Windows\System\IxEZCcU.exe
  2⤵
  PID:3500
- C:\Windows\System\YxWQNwO.exe
  C:\Windows\System\YxWQNwO.exe
  2⤵
  PID:1348
- C:\Windows\System\BtRNuqr.exe
  C:\Windows\System\BtRNuqr.exe
  2⤵
  PID:13472
- C:\Windows\System\BasoeKl.exe
  C:\Windows\System\BasoeKl.exe
  2⤵
  PID:8984
- C:\Windows\System\XinhTDY.exe
  C:\Windows\System\XinhTDY.exe
  2⤵
  PID:4376
- C:\Windows\System\NYQyNCn.exe
  C:\Windows\System\NYQyNCn.exe
  2⤵
  PID:9468
- C:\Windows\System\jQeOIeo.exe
  C:\Windows\System\jQeOIeo.exe
  2⤵
  PID:5368
- C:\Windows\System\XCCHOvr.exe
  C:\Windows\System\XCCHOvr.exe
  2⤵
  PID:7624
- C:\Windows\System\VaoPvbY.exe
  C:\Windows\System\VaoPvbY.exe
  2⤵
  PID:4344
- C:\Windows\System\kcDyNgg.exe
  C:\Windows\System\kcDyNgg.exe
  2⤵
  PID:9760
- C:\Windows\System\DgCmVud.exe
  C:\Windows\System\DgCmVud.exe
  2⤵
  PID:15448
- C:\Windows\System\IHIfUdr.exe
  C:\Windows\System\IHIfUdr.exe
  2⤵
  PID:9848
- C:\Windows\System\munkPDm.exe
  C:\Windows\System\munkPDm.exe
  2⤵
  PID:9904
- C:\Windows\System\LeHhZqL.exe
  C:\Windows\System\LeHhZqL.exe
  2⤵
  PID:9336
- C:\Windows\System\gHyIwZu.exe
  C:\Windows\System\gHyIwZu.exe
  2⤵
  PID:9452
- C:\Windows\System\cMrGiud.exe
  C:\Windows\System\cMrGiud.exe
  2⤵
  PID:4672
- C:\Windows\System\UsJipuE.exe
  C:\Windows\System\UsJipuE.exe
  2⤵
  PID:4172
- C:\Windows\System\pFTEwfk.exe
  C:\Windows\System\pFTEwfk.exe
  2⤵
  PID:9612
- C:\Windows\System\uqMlCNQ.exe
  C:\Windows\System\uqMlCNQ.exe
  2⤵
  PID:9648
- C:\Windows\System\xuGbSXh.exe
  C:\Windows\System\xuGbSXh.exe
  2⤵
  PID:10168
- C:\Windows\System\irVUTih.exe
  C:\Windows\System\irVUTih.exe
  2⤵
  PID:5180
- C:\Windows\System\GNfkHcq.exe
  C:\Windows\System\GNfkHcq.exe
  2⤵
  PID:9804
- C:\Windows\System\fWREozM.exe
  C:\Windows\System\fWREozM.exe
  2⤵
  PID:8424
- C:\Windows\System\UuyoEoe.exe
  C:\Windows\System\UuyoEoe.exe
  2⤵
  PID:9936
- C:\Windows\System\ANReNtM.exe
  C:\Windows\System\ANReNtM.exe
  2⤵
  PID:10000
- C:\Windows\System\IrKoVsp.exe
  C:\Windows\System\IrKoVsp.exe
  2⤵
  PID:8340
- C:\Windows\System\IqQwRAq.exe
  C:\Windows\System\IqQwRAq.exe
  2⤵
  PID:9396
- C:\Windows\System\oyOfGSl.exe
  C:\Windows\System\oyOfGSl.exe
  2⤵
  PID:9212
- C:\Windows\System\PwAQpAK.exe
  C:\Windows\System\PwAQpAK.exe
  2⤵
  PID:6820
- C:\Windows\System\suZrJip.exe
  C:\Windows\System\suZrJip.exe
  2⤵
  PID:10544
- C:\Windows\System\JCmuZHY.exe
  C:\Windows\System\JCmuZHY.exe
  2⤵
  PID:5836
- C:\Windows\System\qbcexKL.exe
  C:\Windows\System\qbcexKL.exe
  2⤵
  PID:10848
- C:\Windows\System\zJgZwvD.exe
  C:\Windows\System\zJgZwvD.exe
  2⤵
  PID:10988
- C:\Windows\System\Vpjlxoe.exe
  C:\Windows\System\Vpjlxoe.exe
  2⤵
  PID:2404
- C:\Windows\System\CXsKsFD.exe
  C:\Windows\System\CXsKsFD.exe
  2⤵
  PID:6928
- C:\Windows\System\zzrIXRG.exe
  C:\Windows\System\zzrIXRG.exe
  2⤵
  PID:6220
- C:\Windows\System\TAlYUcQ.exe
  C:\Windows\System\TAlYUcQ.exe
  2⤵
  PID:7036
- C:\Windows\System\uWrsYPk.exe
  C:\Windows\System\uWrsYPk.exe
  2⤵
  PID:7112
- C:\Windows\System\nMmoaVu.exe
  C:\Windows\System\nMmoaVu.exe
  2⤵
  PID:3660
- C:\Windows\System\hZwiaft.exe
  C:\Windows\System\hZwiaft.exe
  2⤵
  PID:7208
- C:\Windows\System\bPAPayi.exe
  C:\Windows\System\bPAPayi.exe
  2⤵
  PID:7788
- C:\Windows\System\FjZskHh.exe
  C:\Windows\System\FjZskHh.exe
  2⤵
  PID:6232
- C:\Windows\System\fogTAFz.exe
  C:\Windows\System\fogTAFz.exe
  2⤵
  PID:11084
- C:\Windows\System\itltCUj.exe
  C:\Windows\System\itltCUj.exe
  2⤵
  PID:11108
- C:\Windows\System\ESfmWNY.exe
  C:\Windows\System\ESfmWNY.exe
  2⤵
  PID:4504
- C:\Windows\System\klbPKBG.exe
  C:\Windows\System\klbPKBG.exe
  2⤵
  PID:924
- C:\Windows\System\XhEYOKD.exe
  C:\Windows\System\XhEYOKD.exe
  2⤵
  PID:11828
- C:\Windows\System\FUrWBIc.exe
  C:\Windows\System\FUrWBIc.exe
  2⤵
  PID:7860
- C:\Windows\System\RiVLOGp.exe
  C:\Windows\System\RiVLOGp.exe
  2⤵
  PID:9532
- C:\Windows\System\SNtuQrB.exe
  C:\Windows\System\SNtuQrB.exe
  2⤵
  PID:6768
- C:\Windows\System\iZssHdu.exe
  C:\Windows\System\iZssHdu.exe
  2⤵
  PID:10756
- C:\Windows\System\yhoKPLX.exe
  C:\Windows\System\yhoKPLX.exe
  2⤵
  PID:7900
- C:\Windows\System\UqqRTjK.exe
  C:\Windows\System\UqqRTjK.exe
  2⤵
  PID:5504
- C:\Windows\System\ZstLRyK.exe
  C:\Windows\System\ZstLRyK.exe
  2⤵
  PID:6352
- C:\Windows\System\EfxpvDh.exe
  C:\Windows\System\EfxpvDh.exe
  2⤵
  PID:7516
- C:\Windows\System\WggwLqf.exe
  C:\Windows\System\WggwLqf.exe
  2⤵
  PID:11924
- C:\Windows\System\VnfXTPa.exe
  C:\Windows\System\VnfXTPa.exe
  2⤵
  PID:11980
- C:\Windows\System\SBYuydt.exe
  C:\Windows\System\SBYuydt.exe
  2⤵
  PID:12864
- C:\Windows\System\bbLwszH.exe
  C:\Windows\System\bbLwszH.exe
  2⤵
  PID:7732
- C:\Windows\System\WQzzAln.exe
  C:\Windows\System\WQzzAln.exe
  2⤵
  PID:2180
- C:\Windows\System\LXNBCvw.exe
  C:\Windows\System\LXNBCvw.exe
  2⤵
  PID:3236
- C:\Windows\System\qMwDtbR.exe
  C:\Windows\System\qMwDtbR.exe
  2⤵
  PID:11928
- C:\Windows\System\ECXBaEO.exe
  C:\Windows\System\ECXBaEO.exe
  2⤵
  PID:10744
- C:\Windows\System\AdrFDvY.exe
  C:\Windows\System\AdrFDvY.exe
  2⤵
  PID:8884
- C:\Windows\System\GLjlKim.exe
  C:\Windows\System\GLjlKim.exe
  2⤵
  PID:15076
- C:\Windows\System\igzIQut.exe
  C:\Windows\System\igzIQut.exe
  2⤵
  PID:8784
- C:\Windows\System\qWKvave.exe
  C:\Windows\System\qWKvave.exe
  2⤵
  PID:13636
- C:\Windows\System\gVJysLn.exe
  C:\Windows\System\gVJysLn.exe
  2⤵
  PID:13788
- C:\Windows\System\zXMmhXc.exe
  C:\Windows\System\zXMmhXc.exe
  2⤵
  PID:8844
- C:\Windows\System\iWsewIJ.exe
  C:\Windows\System\iWsewIJ.exe
  2⤵
  PID:12676
- C:\Windows\System\yHMEvmm.exe
  C:\Windows\System\yHMEvmm.exe
  2⤵
  PID:12780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k0cl3ldr.vio.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BQZtsPs.exe

Filesize
1.9MB

MD5
4d1be3997d879b9cb12cd4d685680dd6

SHA1
1a9bbee889aca79d3bfd112d8988c0df6fee17a3

SHA256
df425689ef3b465e45e4fcf1cb819ad8b0bcc0387221de896b9c04d40f5c0697

SHA512
b0b3ff92cc9e7c988284a440369c262ec27dad4a7b2febc090f64ecc6a1e02f23dc5e720423d3ad513bdee8a6d6ddf8f9b4f12eb7cad71a6d258921c58d7ea3b

Download Submit
C:\Windows\System\BSFNSAH.exe

Filesize
1.9MB

MD5
09f1a942b92d1da74c4e385bc21f4f7d

SHA1
952801f276f68d5606096bb141a666d4611bef3f

SHA256
661290465510f48adeaa47d651be235ffc9d0bee76fc1e4bd8789a5e0e89717a

SHA512
9a441c0f1b882816f4fd6cccf197d1a2b65f9358b6d006260fc8de3eb56c36a3c66548d5acc9133d4509ee4aea9467c4a00f730c3d1ad5db4db6c9cacabe6a5f

Download Submit
C:\Windows\System\BzmsEpm.exe

Filesize
1.9MB

MD5
a154c461fa6e02d01a6cd8d5a2b099b9

SHA1
c6ac95ff48dcc9e2ac886d3d6b4d53523ada65ca

SHA256
d620bb874fc5148d07c1f7e2099dc0ce3698007726d20c7806f18586b439e3be

SHA512
8f452a3e1f6ad9baae87aa6e3a86bab5c64837663e9541557b1057b342d477add5cc96bbd4b7ab4aa9c3d643f7cc90108c6952f63edb189d56f7e55a14fcfce5

Download Submit
C:\Windows\System\EVdcIgQ.exe

Filesize
1.9MB

MD5
869d886c48b7703d9eddb629e0288e62

SHA1
9a8e1e571f95980d3ca1dac14426171f73c022a6

SHA256
012d9c766ef50ecf337e65384ac4243fd3f817e917ad3e5f76469e3c431d7418

SHA512
b44758cd45e8d42d37b778f7f97b649ebda931ce20874bd2d22835f94e953accd1ed90950cfb8032469487efea7f24b6fc27c5750a07f8295946aaec537f533e

Download Submit
C:\Windows\System\FLDpSlW.exe

Filesize
1.9MB

MD5
86e7bb91701d36c61d62b0f748b6165e

SHA1
2847ccf0d8917f54426bcb092fbf5fb95715e497

SHA256
21133fcb87474dd58e3d9bc2d7f56d83a6056fe1f50aa9dafaa3fc339cc71902

SHA512
caf5ae5415649cb350b50860f6d4140a8b6f903b7a3ad1949b7b59b25fd3c7e1bb1d37ef27adefe3c4d009c6803f0572d5768497a133bedd71217014665cd10f

Download Submit
C:\Windows\System\GENGxtI.exe

Filesize
1.9MB

MD5
7038ffcef43fc8ef75ee798578e9f66f

SHA1
33c12045d04b00c512e6a68e1ce091e6a19299cd

SHA256
158920e566254553850bfc8ef05fe14c40f2df148e243dc197bd43da4f4e5cc3

SHA512
fe9b958abd0616d815145024c0fa5ba83794298eafdc7a75b742fc47b274949f313671148e976ebf8549f3539800687027a9306811829f3daccc323090d37dac

Download Submit
C:\Windows\System\IaJTDOc.exe

Filesize
1.9MB

MD5
455eeee80ddd5e463083dcf2a55580cb

SHA1
655e53ae2fc1d0cee7fb9e2c8538cb4eaed4fc70

SHA256
dd25ab1e1bf1d543db981957d4da2c1ad184624704b9577c5bbfe76838492722

SHA512
b880fedc04c0f7b0c6a8ab947e3e72ece2f1b37bb99ee161ce07b0f23d6b5eb8c5deeaaaa6d5c9b3be1cbd67281e1b15eaaed6ac5c8339c446833c88115b11ff

Download Submit
C:\Windows\System\IgseoQQ.exe

Filesize
1.9MB

MD5
c5d4b890f186895ac0dd1e825fbffae1

SHA1
8d4c54ac725a7ca77203f082a964cc3c67afb6c5

SHA256
1aaf5ac2ffed47a20cb4e900637792757fb059afa9769bc3a360031f1f20dba0

SHA512
c316415b77d064330cb69ce9bbaee4524483989db2d1d05c26be97c81d7ca44c507fbbed761f11c0a08c0ae7e629ca4d304d7e0caae2c667ede1bbb4b80aad18

Download Submit
C:\Windows\System\KuILDJr.exe

Filesize
1.9MB

MD5
a1895a2963088543ce7a2f910848a5c1

SHA1
395582540cba3079fa01b1971efc27c4f275eb7f

SHA256
325bcd7a441ad25966a686acc20c42e98d323450245bc63966faed589ed7ca39

SHA512
46deac017178077fc3b22b49c23a74bd89511d5cfb2e8f6e616438940c7dd8750d821495e3754d028b1e2033910bbe32b3a65b36c61c00c735f6e2c32ddf947b

Download Submit
C:\Windows\System\PBVEwUe.exe

Filesize
1.9MB

MD5
fdff31877524a85f73dbfa22ca2a5166

SHA1
4f8adf3241a7207228bddb88708e063d85eac62a

SHA256
25daae2312c2cd082f03a4ec9229c6148b69edb2121542d323b00b9c95c188fc

SHA512
44edf3d8064748260c225c0b4a70fd22e1f1c1db3a93be544c32d30e41a8a5c12b2dd99ef15f9dadace942c8ed375dcf0120c3bd9637cce620f09a59780ff00d

Download Submit
C:\Windows\System\QOUzpGE.exe

Filesize
1.9MB

MD5
50cbb0c0592e130385cea4fc8ea65ce1

SHA1
41aa7ad024cea9d046a8d7f4ea06a293bfbff168

SHA256
7c082d0832ae3294b2c19c946727cb7e9d3f761fa4108ceb8410be3eaf94385c

SHA512
36b9ab8415a9ded670db0d314758b235d6ddee8be52b9083f9f2490d0031e1b2e3bdd4488bd4704dda3a530ae4ba9a5ee2307cb82494e1555426e222dbf116b2

Download Submit
C:\Windows\System\RCEnhju.exe

Filesize
1.9MB

MD5
8ed6652ee45a8dc42398b2a7de949bb3

SHA1
8b5d613cc8655ec50143ad0d81dc40efa2f537c3

SHA256
72efab53df6d64783ab0e9e2c89885240884cc531cd42497faa0b713c37ea5af

SHA512
6a7fe1269e63119bca5604912ce5c7fa25975c444f681fadb323e5a987525b0d8524dd389a1a8aea689243cad9354c2fc64437ae6ad5b6fb24628dfd3003a6af

Download Submit
C:\Windows\System\RDOrmEb.exe

Filesize
1.9MB

MD5
ab3ab5c6c4eb8c6ac1b7c8185e0ae1f1

SHA1
69dc09299cf219062786c6d1347c206ed12744d5

SHA256
c3b4746b7e0a83f6accde4863800940dce1a6e7bb61d96a1a89a20cec9f13890

SHA512
05e4e6fe63d9c4a2f0f363b8dc300ee68b1e0aabc0c414257c4f9c08e3148527a2741cdda4a8151368bd13d6719e44bb258fd1e90747742ab3c602c64af8dec6

Download Submit
C:\Windows\System\SEanAsH.exe

Filesize
1.9MB

MD5
ef5d549e7f1b5a0d571b958749e44324

SHA1
2ce9dd12096559bfb4551f64b8fad3e3ef69cd7f

SHA256
1d8447a0005ed1c9d6067648e650750a000703c5d80ec20d1eff70ff3c6e118d

SHA512
7a870e2af52679ac72dabc2450064a06dc3febcf6db10449648ace34a9ed3ad8f6c0e83d3391586dc62adb666927a80c430acc0a9bdfc4754ceb164805ef3caf

Download Submit
C:\Windows\System\SiONgLg.exe

Filesize
1.9MB

MD5
cdfda99c944b0612a65f543549f87186

SHA1
0bb93150dd70f4d33e46d3739b06ff7d593966da

SHA256
5feb8e29572ab04a2774f38e2a4d62dedf7b92aac8a9e521ac03aa0bdf34d9db

SHA512
f28ecb3abf15eee94eae5b5467a9a7d3623ded1e2ab0c1815b2cacf24d323b3549f10cfd2bf1b9a9ffa2a8f1d1b006e10cedee04b8745b90d8ec53b1514ce2db

Download Submit
C:\Windows\System\SrLthws.exe

Filesize
1.9MB

MD5
16f59ad8855f743a2b0d1e671f429c67

SHA1
17566a7af57f575ae62112faf6327d6cd6cf5340

SHA256
f94cc74a5ba68517cf3de0cb792062c81c87d0eb7a6a48f0dcc29811bad21788

SHA512
9cad1960b13345d090ce0272490c5bc5b80451e866a98edfe5d2c13fdfbc6a73171363738b15ccaf05d8684cac96571e2eefc6b2c7cbe00532cecbfb1b009104

Download Submit
C:\Windows\System\TdUSAoI.exe

Filesize
1.9MB

MD5
b774c83ec70bfefed2821614dbdcb484

SHA1
a4a52af8848e449f0750d005b24ec3987094ec1f

SHA256
05c3074a24100b6163a96cf825dad21a6a68de6e72cfcfa831c6db9b5bbe2c2c

SHA512
c75a25a4fc97ffa16ad0e8f71b5be904c3c9e137912a78af3731dc5ba24ae5296dfe240df063a17b6b520b47e68521ab9ef8c68abafb379d72415141d13a1c3e

Download Submit
C:\Windows\System\XVmritU.exe

Filesize
1.9MB

MD5
6b99bfc64b6d6b900c6f84b4a9c59913

SHA1
f47e78028675c714afbd5a017952c3eef1d1e455

SHA256
62ac843e1b66b5f3e330a57c829238e367d53ee7a8a771b623cc0357cd9f4f99

SHA512
8979772baec712a22dd62b68ac534d060bf1f12b99da91062604740f4227d4003b5f2526a31509d29147766d525c12a6df4383706b88bc20faf6c772375105e1

Download Submit
C:\Windows\System\XYCJnoC.exe

Filesize
1.9MB

MD5
635e427b212549e853843e3948e4daf2

SHA1
8b26b4ed40117f46d843593004ec7deaa9909395

SHA256
5383097511067334df192f3cfaf352108a40816fbfe3df442e0ab25127bde35a

SHA512
0225c2d2961427c73663fd5d6dfb77bc366ff34ee5337d8deec393e4ec91274e36feab5009c8e9b676a193668da10c23eb02257569d89599310f91eaf269455d

Download Submit
C:\Windows\System\cCMbESY.exe

Filesize
1.9MB

MD5
9a714f8a40f6e5b7f4c5c5ba37a2f637

SHA1
610daae4e8eb6a3ccac2c9cb248901d261e8aa64

SHA256
a36c5443b9c8e75d27401fb2485e7db1b0a524f8ab947866f67973d1a777f2d0

SHA512
86d12d1f8619896fc4fe7f3b7602c7d3f3b695fed9a93f49e65876e061aaeb9056347fff00c10248e906a46912a52e19b1d8896f0d34b21e82373c9ac97fdc6f

Download Submit
C:\Windows\System\cqSTJwl.exe

Filesize
1.9MB

MD5
b3816272d6ca49be68fbff39c32d63d0

SHA1
13b5cd0b39197393c3937405ad9ad783ffcf3134

SHA256
1ba52b836a83777891e181fe32ef7ad9ff38eac82ff15323238cd2c4885f788d

SHA512
6dd802abc90db6c582e15f85a9d0359826601c09c6e40ee653c7c9c07e2c264c103aeb48a81bb9850f4c482a9a639d58a6a25b4b147384761f0044293ed8a931

Download Submit
C:\Windows\System\fkKAfNA.exe

Filesize
1.9MB

MD5
ac35c2723c88e9eff3dbb9306a7336bd

SHA1
d76c2644dfdc84c0f4bd1ceb904eebbfda15b67f

SHA256
66903c95b5a7328f4aadd42c679e8635ee3ce63d7c480b2d7d263497237ca5a2

SHA512
de82cf8eef5a5fd91a33e1a938c2c15f748785c695d5ab5f2049090c6f1688a2a8a86a8989642e3e4563796c976713e86752787a100d5bff9a70137f59b5243e

Download Submit
C:\Windows\System\iGpQyxm.exe

Filesize
1.9MB

MD5
331a96153e4c84c7dc3529b79e314807

SHA1
a944f27eb4777e62f3febc6b70c5aaee0378d467

SHA256
b6af6f0a677e611800cbdee416e3f79cb7d28b0a6b0314a252f55cdcd5fd2c31

SHA512
77458bb0ff7d9c28c303deafd18cf65e5c306dcf65f355697491cb63136a09dfb21d0e594220f9b2de5bf7fcbcb0112e827e279c883d873ffba28d62caeabccc

Download Submit
C:\Windows\System\jBbyipX.exe

Filesize
1.9MB

MD5
5f20b6202ca894e99e187a71ede7e5c5

SHA1
1d8bf5deb72084b301b29f38db8cd53079def527

SHA256
b47200951028ac5d341cd07960f0ff24eb5406d466e894ca0686c16ff1a0c678

SHA512
c2fd9759e78f890d7c83d41cd3db60c095686a63cfbffa254ab75660181dd448733a0548287840ca535f9cf4707ff2403d7ed34c1b20d7a0f2e698daafc8ba93

Download Submit
C:\Windows\System\jDOlRoj.exe

Filesize
18B

MD5
4c7f6b540e09fd952f2facb22ae75d13

SHA1
1451ca976a9256474cc7ba9ed69d05ce0af39bd9

SHA256
fca731168af380695d9e60400fef60a609cc00caf91e54e2cdb17a46c087406f

SHA512
067e6b485d286329615bdbdc8c4a056bcb8cdf0b69092cd95ff4797a55bc8ffff615accca2383e98fbf56a299d2d5f4b5bbc0675ba4f88908f9e0c16890a2a09

Download Submit
C:\Windows\System\jtdkKoT.exe

Filesize
1.9MB

MD5
e0497636af35f57e90df8bc03855c4dc

SHA1
4462bef73041873173d0fa9b5b1b71da9c08ea0d

SHA256
66d1b3caed7b0eda820e9efb58f1a4d046fd47af96de92a039eb9be8bd95cda2

SHA512
3560972c49a173ac2e02d5895feb5bdbaa38302d16f023924c476013aea637bbb024333a2ef578d01e7b434599b333fabac38d36c263ff78d9abda27c4c90126

Download Submit
C:\Windows\System\nvYkNXe.exe

Filesize
1.9MB

MD5
f491ece460615d65b38a316674a554d7

SHA1
19c2312f9be3d541310ac1c830de958d829897fa

SHA256
fa9e7c5c53bc17c1f7ee357b6aa2d7fd1ce473a170a82b97493ce6c54e06ea5a

SHA512
fb40d1de93af6bb103f1f9db40ed5d291ba88ffd54a075eef726be863536952337cf13e56bf07d8c28bb92d4aace3a9fe6f6e3f258c006f58c202291565f26cf

Download Submit
C:\Windows\System\pIsFYrN.exe

Filesize
1.9MB

MD5
b11ead44b4957fda92d11ba3109b7b1c

SHA1
d793a8f501a1ce3569f41da620a8ee6f56635833

SHA256
2705f36563c9d70077af153487c2ba37d2d82ea90e08c9f8e6f266ca5a95d226

SHA512
a8a2e1fc8257ae8aa3b7bd4e126cceb9cafc9d994f977cc869a5eb9ef8b613104abbbd6dd74578227d7894dfd229e4e492201ae1dceb6c9ad0043bd6a5ba7744

Download Submit
C:\Windows\System\rkksuro.exe

Filesize
1.9MB

MD5
04a441bf16892a94742d50d25bbc681a

SHA1
4da3566432228483d956fc2f146e7c7954796413

SHA256
b4d3b6899ac0fa403bc0471cd5e00e3e63f2d925eea5ac31315cb41d25b31037

SHA512
c4fb0f665d067b8682d780256c20d73862b08ddfb99e4e536fcdef22de9188da3e31b48791d44bfd1917da089634a569efba5985af44afcc6a8cfcea3c56752e

Download Submit
C:\Windows\System\rtkEzWa.exe

Filesize
1.9MB

MD5
f1d6048912bbb40ea8b52a86c5b6ee42

SHA1
ff458f4d1a6841574e57e733695f07f49d979c2e

SHA256
df73f3cf7af199265f7fdae9f4b12d1be82039ccd2c6d5db7e84321dc6467198

SHA512
3decbaf03cda7cc8ac3476a40f1c23abd5e60a79af2b544e2832fd694b8f9f73593f5b564ffe5d69cdd9aa59f60d63599b87600bb17c049428d3fcf10757817e

Download Submit
C:\Windows\System\sLzakVl.exe

Filesize
1.9MB

MD5
e86d80513d5f818a8fe1f0ccb09d46ac

SHA1
2e74a12b09d58a62408c92523132a6032d526532

SHA256
e4f9b879f6ba24f92f40ff98c659db12da5b2c3400116a8542a8863d87aa4afd

SHA512
3b48e0174ae4c2ca51e86d9fa8d40f63cfb82265678ac29ec63d02ef674cd613da0f7b136b0d1934292649b0217d2d58e415f54e3844512dc34173080bae046a

Download Submit
C:\Windows\System\sTDfTSf.exe

Filesize
1.9MB

MD5
a5a755e8428af4abab1e22d79ea3758e

SHA1
926447bd10921c405ac6c0cf12da8e1d03710e11

SHA256
e0baaec05cba342827062390711d536e4ee69717b1bc621875890e3cb934be0b

SHA512
b9a1b0ee28db30051d4a0490464f273d4f46b5ae63410592f34000e60935aa95f3320aa54c8063f43a2999b8b21ef2d046dfe4580fb11fb1a03c262994821ff3

Download Submit
C:\Windows\System\uiqXPYY.exe

Filesize
8B

MD5
407153002ceb60514585c08d0881d39e

SHA1
5adc970603a957069f0b4f66650c9904cb35cd23

SHA256
c54e32119464679a2f98a349d930f00f6deb793a562e84e2a0208e05004e35b4

SHA512
d5c67d7f32f813ff67ed9edd167ca00a1d3f8f9bf86ba5473c3cc9e1ba6e6705f0794946a0a79d39d6dad16864b6bae99d66c2c2fd5e7b8f5648ac86f768968a

Download Submit
C:\Windows\System\waqoLlc.exe

Filesize
1.9MB

MD5
6ecac31159d8374c79fe7c8f26de5324

SHA1
53770409726b5c5a554f55a464e6acb1c375f90b

SHA256
a9682eb8aa4e2046991da4e6173b85cf943d468329495435d5fd36712220bc84

SHA512
a461f3a4b882622c9d57261bdf559752b633a3e0e7747b9cf83c5c84ebe11d601abe12a767ffce841b07f30639acd9044af32ba339cf35ea7623333a441ab177

Download Submit
C:\Windows\System\xEpGAem.exe

Filesize
1.9MB

MD5
9d49827c928f1d45c050bb2bcdc9a43c

SHA1
18b98644bb0f6cb4cf139989690a49cb371e81ba

SHA256
fb454cedf4f5b814d727de4369f27a56b817d5cfd26ee5d5f7bdc744231acd07

SHA512
9f805e692e12e248189ea0fdd48d0c28f5f7b1eafc71bdcc5c004d9baf92dfd00ec2368dff0deb73608241fc8f71298e185e667b077fadfd77a640bf48a69dd5

Download Submit
C:\Windows\System\xgiydIn.exe

Filesize
1.9MB

MD5
f3878a4518b33e8c91a083a3a5c26bfc

SHA1
4a20c1065e0a5704898b038af5f00e541321a807

SHA256
8e60e20d2bfbdcc6d5a2cb81bfe526d2a10c0feeb93ab9a36c7d497d3bb95f43

SHA512
f288d959905cc4f04a5b40664e7a76d0f3f0266fe7ba0a28c93ceecace2389e4c23e89da7b08f8126a4e972bbd483ccafad1517575fada49b54f06ea9730a9c3

Download Submit
C:\Windows\System\xjmjqxC.exe

Filesize
1.9MB

MD5
8ee38b1b9c47ae827447518d245095ba

SHA1
8c853937545d44d533086074b28e010a0c3804a7

SHA256
8187418cf3b6c7cbbc9bea00300318239623f4319650975473400846b00f4efb

SHA512
f60ff15e7f1502d62d3a7ce5c146725d0502f8cae59fbf96875857c3ba8e2a4d5e094279622f718d02f8119c72a2b97c83f2252dbe598d41129bac0f4540c8eb

Download Submit
C:\Windows\System\yIJcOQo.exe

Filesize
1.9MB

MD5
66befd475c4e5f4efc7922d47ec09f4e

SHA1
fb99959a255666eceee166ec3844343459459203

SHA256
527988961400854052239d4ba236cb63b74654a6686846265e466f899dbb046f

SHA512
35368486b46b6c12abf0dd4f7f4165dfcb9178c31559489287bc928007a8103dae298cbd7d6d9ff9c92089eca802ed02a380fe2d1a7568564f0676d04ff30abf

Download Submit
C:\Windows\System\zQIFoiz.exe

Filesize
1.9MB

MD5
2e843d204ecdce3f3b2d096a4fb47ea5

SHA1
0d5e246e041032af54715504d32472a0244d91bd

SHA256
56134470e8d220a6e74a731c6c815f849ea11a2776e14f935d6b3e3023fbdfcb

SHA512
50853ae78b378561df59a2b8259143beaa9d576dee0f41a7917a276f267b1d85eba205f4f0fc7b81391aec641d8fd6c5a32e4ad0f5610002ec4ff6e791e0d156

Download Submit
memory/376-200-0x00007FF62F1F0000-0x00007FF62F5DD000-memory.dmp

Filesize
3.9MB

Download
memory/404-152-0x00007FF669C90000-0x00007FF66A07D000-memory.dmp

Filesize
3.9MB

Download
memory/832-88-0x00007FF785C80000-0x00007FF78606D000-memory.dmp

Filesize
3.9MB

Download
memory/856-196-0x00007FF6EA590000-0x00007FF6EA97D000-memory.dmp

Filesize
3.9MB

Download
memory/1028-122-0x00007FF7E0D00000-0x00007FF7E10ED000-memory.dmp

Filesize
3.9MB

Download
memory/1208-263-0x00007FF698640000-0x00007FF698A2D000-memory.dmp

Filesize
3.9MB

Download
memory/1424-1-0x0000021F59B40000-0x0000021F59B50000-memory.dmp

Filesize
64KB

Download
memory/1424-0-0x00007FF69D800000-0x00007FF69DBED000-memory.dmp

Filesize
3.9MB

Download
memory/1528-251-0x00007FF666D80000-0x00007FF66716D000-memory.dmp

Filesize
3.9MB

Download
memory/1564-241-0x00007FF69B440000-0x00007FF69B82D000-memory.dmp

Filesize
3.9MB

Download
memory/1692-49-0x00007FF6AA720000-0x00007FF6AAB0D000-memory.dmp

Filesize
3.9MB

Download
memory/1812-30-0x00007FF7471E0000-0x00007FF7475CD000-memory.dmp

Filesize
3.9MB

Download
memory/1828-40-0x00007FF762840000-0x00007FF762C2D000-memory.dmp

Filesize
3.9MB

Download
memory/1880-11-0x00007FF788FC0000-0x00007FF7893AD000-memory.dmp

Filesize
3.9MB

Download
memory/2128-90-0x00007FF7C6A40000-0x00007FF7C6E2D000-memory.dmp

Filesize
3.9MB

Download
memory/2252-193-0x00007FF739580000-0x00007FF73996D000-memory.dmp

Filesize
3.9MB

Download
memory/2612-21-0x00007FF72C2B0000-0x00007FF72C69D000-memory.dmp

Filesize
3.9MB

Download
memory/2760-173-0x00007FF706170000-0x00007FF70655D000-memory.dmp

Filesize
3.9MB

Download
memory/2816-106-0x00007FF7D3620000-0x00007FF7D3A0D000-memory.dmp

Filesize
3.9MB

Download
memory/3064-170-0x00007FF60AD90000-0x00007FF60B17D000-memory.dmp

Filesize
3.9MB

Download
memory/3964-210-0x00007FF7C0D70000-0x00007FF7C115D000-memory.dmp

Filesize
3.9MB

Download
memory/3972-133-0x00007FF7CF8A0000-0x00007FF7CFC8D000-memory.dmp

Filesize
3.9MB

Download
memory/4000-76-0x00007FF615E50000-0x00007FF61623D000-memory.dmp

Filesize
3.9MB

Download
memory/4060-187-0x00007FF7C0750000-0x00007FF7C0B3D000-memory.dmp

Filesize
3.9MB

Download
memory/4064-162-0x00007FF7C3060000-0x00007FF7C344D000-memory.dmp

Filesize
3.9MB

Download
memory/4068-207-0x00007FF6E72A0000-0x00007FF6E768D000-memory.dmp

Filesize
3.9MB

Download
memory/4180-127-0x00007FF68D9A0000-0x00007FF68DD8D000-memory.dmp

Filesize
3.9MB

Download
memory/4184-238-0x000001A635030000-0x000001A635052000-memory.dmp

Filesize
136KB

Download
memory/4184-18-0x00007FF84FA83000-0x00007FF84FA85000-memory.dmp

Filesize
8KB

Download
memory/4184-73-0x00007FF84FA80000-0x00007FF850541000-memory.dmp

Filesize
10.8MB

Download
memory/4184-395-0x000001A635CD0000-0x000001A636476000-memory.dmp

Filesize
7.6MB

Download
memory/4184-7594-0x00007FF84FA83000-0x00007FF84FA85000-memory.dmp

Filesize
8KB

Download
memory/4184-7989-0x00007FF84FA80000-0x00007FF850541000-memory.dmp

Filesize
10.8MB

Download
memory/4300-247-0x00007FF7C0DD0000-0x00007FF7C11BD000-memory.dmp

Filesize
3.9MB

Download
memory/4316-117-0x00007FF78CA60000-0x00007FF78CE4D000-memory.dmp

Filesize
3.9MB

Download
memory/4692-60-0x00007FF6EE380000-0x00007FF6EE76D000-memory.dmp

Filesize
3.9MB

Download
memory/4816-179-0x00007FF7DB1D0000-0x00007FF7DB5BD000-memory.dmp

Filesize
3.9MB

Download
memory/4988-223-0x00007FF7C0980000-0x00007FF7C0D6D000-memory.dmp

Filesize
3.9MB

Download
memory/5084-112-0x00007FF686540000-0x00007FF68692D000-memory.dmp

Filesize
3.9MB

Download