xmrig | 72f152bba5fb835d18728377d51888f956ce78f217ef507ba015e7ccb7907b4e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 05:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

48ec921b40608962fd2f64fa6b8eb330.exe
Size

1.8MB
MD5

48ec921b40608962fd2f64fa6b8eb330
SHA1

90ba50181fdf2b9bef486da553bcbebd98b02223
SHA256

72f152bba5fb835d18728377d51888f956ce78f217ef507ba015e7ccb7907b4e
SHA512

4fd6058457c65c4ce4a9482d1e99f44c982fdb9fe6826bc3ff9075e0698146092bd9d70de8a5f4765972775794fdc3e4353b0de82a18c8b8658ce63560f0586a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDilK3uPpHbcMfOoIS:Lz071uv4BPMkFfdg6NsOkc2v

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/5112-137-0x00007FF652E50000-0x00007FF653242000-memory.dmp	xmrig
behavioral2/memory/5036-194-0x00007FF7BF0A0000-0x00007FF7BF492000-memory.dmp	xmrig
behavioral2/memory/3908-196-0x00007FF605840000-0x00007FF605C32000-memory.dmp	xmrig
behavioral2/memory/2332-209-0x00007FF7604C0000-0x00007FF7608B2000-memory.dmp	xmrig
behavioral2/memory/4196-214-0x00007FF720FE0000-0x00007FF7213D2000-memory.dmp	xmrig
behavioral2/memory/916-213-0x00007FF710D20000-0x00007FF711112000-memory.dmp	xmrig
behavioral2/memory/548-212-0x00007FF6058E0000-0x00007FF605CD2000-memory.dmp	xmrig
behavioral2/memory/2288-211-0x00007FF7B4340000-0x00007FF7B4732000-memory.dmp	xmrig
behavioral2/memory/4112-208-0x00007FF6189D0000-0x00007FF618DC2000-memory.dmp	xmrig
behavioral2/memory/3380-207-0x00007FF7F2730000-0x00007FF7F2B22000-memory.dmp	xmrig
behavioral2/memory/4920-206-0x00007FF6D6DE0000-0x00007FF6D71D2000-memory.dmp	xmrig
behavioral2/memory/4872-205-0x00007FF68E950000-0x00007FF68ED42000-memory.dmp	xmrig
behavioral2/memory/4448-204-0x00007FF6BB8D0000-0x00007FF6BBCC2000-memory.dmp	xmrig
behavioral2/memory/3076-195-0x00007FF628C20000-0x00007FF629012000-memory.dmp	xmrig
behavioral2/memory/3436-181-0x00007FF75B3F0000-0x00007FF75B7E2000-memory.dmp	xmrig
behavioral2/memory/1976-145-0x00007FF6BBF90000-0x00007FF6BC382000-memory.dmp	xmrig
behavioral2/memory/5048-140-0x00007FF61AEF0000-0x00007FF61B2E2000-memory.dmp	xmrig
behavioral2/memory/3624-139-0x00007FF7CD400000-0x00007FF7CD7F2000-memory.dmp	xmrig
behavioral2/memory/4968-138-0x00007FF785BB0000-0x00007FF785FA2000-memory.dmp	xmrig
behavioral2/memory/4592-43-0x00007FF6EC1A0000-0x00007FF6EC592000-memory.dmp	xmrig
behavioral2/memory/1452-3752-0x00007FF791820000-0x00007FF791C12000-memory.dmp	xmrig
behavioral2/memory/1292-3766-0x00007FF78EA80000-0x00007FF78EE72000-memory.dmp	xmrig
behavioral2/memory/3624-3796-0x00007FF7CD400000-0x00007FF7CD7F2000-memory.dmp	xmrig
behavioral2/memory/1976-3850-0x00007FF6BBF90000-0x00007FF6BC382000-memory.dmp	xmrig
behavioral2/memory/2332-3891-0x00007FF7604C0000-0x00007FF7608B2000-memory.dmp	xmrig
behavioral2/memory/4112-3890-0x00007FF6189D0000-0x00007FF618DC2000-memory.dmp	xmrig
behavioral2/memory/5036-3885-0x00007FF7BF0A0000-0x00007FF7BF492000-memory.dmp	xmrig
behavioral2/memory/3380-3887-0x00007FF7F2730000-0x00007FF7F2B22000-memory.dmp	xmrig
behavioral2/memory/4448-3880-0x00007FF6BB8D0000-0x00007FF6BBCC2000-memory.dmp	xmrig
behavioral2/memory/3908-3873-0x00007FF605840000-0x00007FF605C32000-memory.dmp	xmrig
behavioral2/memory/4872-3857-0x00007FF68E950000-0x00007FF68ED42000-memory.dmp	xmrig
behavioral2/memory/4920-3840-0x00007FF6D6DE0000-0x00007FF6D71D2000-memory.dmp	xmrig
behavioral2/memory/5048-3846-0x00007FF61AEF0000-0x00007FF61B2E2000-memory.dmp	xmrig
behavioral2/memory/3076-3830-0x00007FF628C20000-0x00007FF629012000-memory.dmp	xmrig
behavioral2/memory/4196-3827-0x00007FF720FE0000-0x00007FF7213D2000-memory.dmp	xmrig
behavioral2/memory/4968-3837-0x00007FF785BB0000-0x00007FF785FA2000-memory.dmp	xmrig
behavioral2/memory/916-3826-0x00007FF710D20000-0x00007FF711112000-memory.dmp	xmrig
behavioral2/memory/3436-3816-0x00007FF75B3F0000-0x00007FF75B7E2000-memory.dmp	xmrig
behavioral2/memory/5112-3784-0x00007FF652E50000-0x00007FF653242000-memory.dmp	xmrig

Blocklisted process makes network request 26 IoCs

flow	pid	Process
3	4588	powershell.exe
5	4588	powershell.exe
7	4588	powershell.exe
8	4588	powershell.exe
10	4588	powershell.exe
11	4588	powershell.exe
13	4588	powershell.exe
18	4588	powershell.exe
20	4588	powershell.exe
21	4588	powershell.exe
22	4588	powershell.exe
23	4588	powershell.exe
24	4588	powershell.exe
25	4588	powershell.exe
26	4588	powershell.exe
27	4588	powershell.exe
28	4588	powershell.exe
29	4588	powershell.exe
30	4588	powershell.exe
31	4588	powershell.exe
32	4588	powershell.exe
33	4588	powershell.exe
34	4588	powershell.exe
35	4588	powershell.exe
36	4588	powershell.exe
37	4588	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4588	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5028	LsMbdeB.exe
780	VDhUCtL.exe
4592	yCTbQMv.exe
1452	tjDqDZZ.exe
1292	ATQGTpw.exe
2288	IKQCkBh.exe
548	taTYXvV.exe
5112	OCGkJrg.exe
4968	GBDwCFb.exe
3624	VuuDBFV.exe
916	wjlAhaA.exe
5048	KtcTmEK.exe
4196	AJJCHat.exe
1976	QUVUBKA.exe
3436	wtCftpH.exe
5036	yDrYhDM.exe
3076	KtWILbN.exe
3908	gLCbddd.exe
4448	rTneiAB.exe
4872	VdisNYW.exe
4920	NGEOyKA.exe
3380	NCkGFjx.exe
4112	ZhZOaQN.exe
2332	BEoqgoF.exe
4092	qZMngCO.exe
4432	JGTxbDe.exe
4220	KBXFWuz.exe
2680	tCjQmBQ.exe
2352	koYSPOF.exe
4120	yOAPnbC.exe
468	PaEjJIS.exe
996	GheLHUU.exe
3760	sUCNGnl.exe
3468	teoGihv.exe
2372	ZUoxBEL.exe
1380	CYPHJYB.exe
2632	DyeUwbZ.exe
4512	trzeGWd.exe
2936	CAlnvhM.exe
2972	xmriGPS.exe
2224	ScMkorS.exe
4868	MzFcvsV.exe
3308	QDLlYSS.exe
4036	RjcaijO.exe
1808	gfjSlSF.exe
1020	GbxCDkx.exe
4380	KUaCUeD.exe
4508	CBodpRU.exe
2100	UlUffdI.exe
2228	VghnhQB.exe
3904	jujLkCX.exe
4280	LQvRCCi.exe
2392	oyJTzbX.exe
3008	YXfLTid.exe
4232	uXSaArK.exe
4000	IaFHsDb.exe
3620	PeOVuwp.exe
4100	hXCFXzs.exe
1728	aXSOdKJ.exe
4156	QpOGDRj.exe
2788	TbskUzQ.exe
5076	cJyuzsp.exe
3768	mwEmliS.exe
1676	XgUsGYO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2684-0-0x00007FF712980000-0x00007FF712D72000-memory.dmp	upx
behavioral2/files/0x00070000000234e3-7.dat	upx
behavioral2/memory/5028-14-0x00007FF6A8620000-0x00007FF6A8A12000-memory.dmp	upx
behavioral2/files/0x00080000000234e2-22.dat	upx
behavioral2/files/0x00070000000234e5-46.dat	upx
behavioral2/files/0x00070000000234ef-91.dat	upx
behavioral2/files/0x00070000000234ee-117.dat	upx
behavioral2/memory/5112-137-0x00007FF652E50000-0x00007FF653242000-memory.dmp	upx
behavioral2/files/0x00070000000234f0-143.dat	upx
behavioral2/files/0x00070000000234f8-152.dat	upx
behavioral2/memory/5036-194-0x00007FF7BF0A0000-0x00007FF7BF492000-memory.dmp	upx
behavioral2/memory/3908-196-0x00007FF605840000-0x00007FF605C32000-memory.dmp	upx
behavioral2/memory/2332-209-0x00007FF7604C0000-0x00007FF7608B2000-memory.dmp	upx
behavioral2/memory/4196-214-0x00007FF720FE0000-0x00007FF7213D2000-memory.dmp	upx
behavioral2/memory/916-213-0x00007FF710D20000-0x00007FF711112000-memory.dmp	upx
behavioral2/memory/548-212-0x00007FF6058E0000-0x00007FF605CD2000-memory.dmp	upx
behavioral2/memory/2288-211-0x00007FF7B4340000-0x00007FF7B4732000-memory.dmp	upx
behavioral2/memory/4112-208-0x00007FF6189D0000-0x00007FF618DC2000-memory.dmp	upx
behavioral2/memory/3380-207-0x00007FF7F2730000-0x00007FF7F2B22000-memory.dmp	upx
behavioral2/memory/4920-206-0x00007FF6D6DE0000-0x00007FF6D71D2000-memory.dmp	upx
behavioral2/memory/4872-205-0x00007FF68E950000-0x00007FF68ED42000-memory.dmp	upx
behavioral2/memory/4448-204-0x00007FF6BB8D0000-0x00007FF6BBCC2000-memory.dmp	upx
behavioral2/memory/3076-195-0x00007FF628C20000-0x00007FF629012000-memory.dmp	upx
behavioral2/files/0x0007000000023503-193.dat	upx
behavioral2/files/0x00070000000234fd-191.dat	upx
behavioral2/files/0x0007000000023500-190.dat	upx
behavioral2/files/0x00070000000234ff-189.dat	upx
behavioral2/files/0x00070000000234fe-188.dat	upx
behavioral2/memory/3436-181-0x00007FF75B3F0000-0x00007FF75B7E2000-memory.dmp	upx
behavioral2/files/0x00070000000234fc-164.dat	upx
behavioral2/files/0x00070000000234fb-160.dat	upx
behavioral2/files/0x00070000000234fa-157.dat	upx
behavioral2/files/0x00070000000234f9-154.dat	upx
behavioral2/files/0x00070000000234f7-150.dat	upx
behavioral2/files/0x00080000000234e0-148.dat	upx
behavioral2/files/0x00070000000234f6-146.dat	upx
behavioral2/memory/1976-145-0x00007FF6BBF90000-0x00007FF6BC382000-memory.dmp	upx
behavioral2/files/0x00070000000234f3-141.dat	upx
behavioral2/memory/5048-140-0x00007FF61AEF0000-0x00007FF61B2E2000-memory.dmp	upx
behavioral2/memory/3624-139-0x00007FF7CD400000-0x00007FF7CD7F2000-memory.dmp	upx
behavioral2/memory/4968-138-0x00007FF785BB0000-0x00007FF785FA2000-memory.dmp	upx
behavioral2/files/0x00070000000234f2-129.dat	upx
behavioral2/files/0x00070000000234f4-126.dat	upx
behavioral2/files/0x00070000000234ed-113.dat	upx
behavioral2/files/0x00070000000234f5-110.dat	upx
behavioral2/files/0x00070000000234f1-95.dat	upx
behavioral2/files/0x00070000000234ec-86.dat	upx
behavioral2/files/0x00070000000234eb-76.dat	upx
behavioral2/files/0x00070000000234ea-72.dat	upx
behavioral2/files/0x00070000000234e8-63.dat	upx
behavioral2/files/0x00070000000234e7-58.dat	upx
behavioral2/memory/1292-53-0x00007FF78EA80000-0x00007FF78EE72000-memory.dmp	upx
behavioral2/memory/1452-52-0x00007FF791820000-0x00007FF791C12000-memory.dmp	upx
behavioral2/files/0x00070000000234e9-71.dat	upx
behavioral2/files/0x00070000000234e6-67.dat	upx
behavioral2/memory/4592-43-0x00007FF6EC1A0000-0x00007FF6EC592000-memory.dmp	upx
behavioral2/memory/780-32-0x00007FF710210000-0x00007FF710602000-memory.dmp	upx
behavioral2/files/0x00070000000234e4-28.dat	upx
behavioral2/files/0x0009000000022fdd-10.dat	upx
behavioral2/memory/1452-3752-0x00007FF791820000-0x00007FF791C12000-memory.dmp	upx
behavioral2/memory/1292-3766-0x00007FF78EA80000-0x00007FF78EE72000-memory.dmp	upx
behavioral2/memory/3624-3796-0x00007FF7CD400000-0x00007FF7CD7F2000-memory.dmp	upx
behavioral2/memory/1976-3850-0x00007FF6BBF90000-0x00007FF6BC382000-memory.dmp	upx
behavioral2/memory/2332-3891-0x00007FF7604C0000-0x00007FF7608B2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\svGeKxK.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\qYFgQla.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\szcqkpT.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\VzqtXxh.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\yrJJjim.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\aYBWYGf.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\nRoUyHE.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\VnwyFbi.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\iXJyxPa.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\DpSAokT.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\jHLbYQd.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\ArxYZFk.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\DsqizOX.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\lDouHpj.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\wYspwDp.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\OxQYsdj.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\eoNffqz.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\HWJBHFf.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\rLCiyaf.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\sLORxeH.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\zorhZfe.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\TolGRes.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\FYYYOvR.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\JuYTsGb.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\WCsRTBC.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\koqTJbb.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\fCFyTzj.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\SSrjYtI.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\vkLUHZr.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\KOYuNOS.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\bQzCRNt.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\rNYAyVa.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\dKQLpyG.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\MOAgCGW.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\HmQViNJ.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\NSyRTOo.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\SRvBmZR.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\XeXTsEn.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\mRNWJJk.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\qeCbuns.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\yTeIgOb.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\KxPeVCR.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\YFbykQd.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\oFAHKch.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\FMmJnfI.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\LjgSJzH.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\IycqGMr.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\bWmCiCW.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\VpyNDVC.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\GVnbpDi.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\CdOwvDT.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\AyqxxSj.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\nPnhKIi.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\wgjfIQt.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\CsxOrmO.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\CwPREQf.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\xdFIOsx.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\YFUxEjZ.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\HsoHPyx.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\rrjJNvd.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\FdPOUZv.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\VsQcbIN.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\NsaaxGp.exe	48ec921b40608962fd2f64fa6b8eb330.exe
File created	C:\Windows\System\iswfPbV.exe	48ec921b40608962fd2f64fa6b8eb330.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4588	powershell.exe
4588	powershell.exe
4588	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2684	48ec921b40608962fd2f64fa6b8eb330.exe
Token: SeLockMemoryPrivilege	2684	48ec921b40608962fd2f64fa6b8eb330.exe
Token: SeDebugPrivilege	4588	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 4588	2684	48ec921b40608962fd2f64fa6b8eb330.exe	84
PID 2684 wrote to memory of 4588	2684	48ec921b40608962fd2f64fa6b8eb330.exe	84
PID 2684 wrote to memory of 5028	2684	48ec921b40608962fd2f64fa6b8eb330.exe	85
PID 2684 wrote to memory of 5028	2684	48ec921b40608962fd2f64fa6b8eb330.exe	85
PID 2684 wrote to memory of 1292	2684	48ec921b40608962fd2f64fa6b8eb330.exe	86
PID 2684 wrote to memory of 1292	2684	48ec921b40608962fd2f64fa6b8eb330.exe	86
PID 2684 wrote to memory of 780	2684	48ec921b40608962fd2f64fa6b8eb330.exe	87
PID 2684 wrote to memory of 780	2684	48ec921b40608962fd2f64fa6b8eb330.exe	87
PID 2684 wrote to memory of 4592	2684	48ec921b40608962fd2f64fa6b8eb330.exe	88
PID 2684 wrote to memory of 4592	2684	48ec921b40608962fd2f64fa6b8eb330.exe	88
PID 2684 wrote to memory of 1452	2684	48ec921b40608962fd2f64fa6b8eb330.exe	89
PID 2684 wrote to memory of 1452	2684	48ec921b40608962fd2f64fa6b8eb330.exe	89
PID 2684 wrote to memory of 2288	2684	48ec921b40608962fd2f64fa6b8eb330.exe	90
PID 2684 wrote to memory of 2288	2684	48ec921b40608962fd2f64fa6b8eb330.exe	90
PID 2684 wrote to memory of 548	2684	48ec921b40608962fd2f64fa6b8eb330.exe	91
PID 2684 wrote to memory of 548	2684	48ec921b40608962fd2f64fa6b8eb330.exe	91
PID 2684 wrote to memory of 5112	2684	48ec921b40608962fd2f64fa6b8eb330.exe	92
PID 2684 wrote to memory of 5112	2684	48ec921b40608962fd2f64fa6b8eb330.exe	92
PID 2684 wrote to memory of 4968	2684	48ec921b40608962fd2f64fa6b8eb330.exe	93
PID 2684 wrote to memory of 4968	2684	48ec921b40608962fd2f64fa6b8eb330.exe	93
PID 2684 wrote to memory of 3624	2684	48ec921b40608962fd2f64fa6b8eb330.exe	94
PID 2684 wrote to memory of 3624	2684	48ec921b40608962fd2f64fa6b8eb330.exe	94
PID 2684 wrote to memory of 4196	2684	48ec921b40608962fd2f64fa6b8eb330.exe	95
PID 2684 wrote to memory of 4196	2684	48ec921b40608962fd2f64fa6b8eb330.exe	95
PID 2684 wrote to memory of 916	2684	48ec921b40608962fd2f64fa6b8eb330.exe	96
PID 2684 wrote to memory of 916	2684	48ec921b40608962fd2f64fa6b8eb330.exe	96
PID 2684 wrote to memory of 5048	2684	48ec921b40608962fd2f64fa6b8eb330.exe	97
PID 2684 wrote to memory of 5048	2684	48ec921b40608962fd2f64fa6b8eb330.exe	97
PID 2684 wrote to memory of 1976	2684	48ec921b40608962fd2f64fa6b8eb330.exe	98
PID 2684 wrote to memory of 1976	2684	48ec921b40608962fd2f64fa6b8eb330.exe	98
PID 2684 wrote to memory of 3436	2684	48ec921b40608962fd2f64fa6b8eb330.exe	99
PID 2684 wrote to memory of 3436	2684	48ec921b40608962fd2f64fa6b8eb330.exe	99
PID 2684 wrote to memory of 5036	2684	48ec921b40608962fd2f64fa6b8eb330.exe	100
PID 2684 wrote to memory of 5036	2684	48ec921b40608962fd2f64fa6b8eb330.exe	100
PID 2684 wrote to memory of 3076	2684	48ec921b40608962fd2f64fa6b8eb330.exe	101
PID 2684 wrote to memory of 3076	2684	48ec921b40608962fd2f64fa6b8eb330.exe	101
PID 2684 wrote to memory of 3908	2684	48ec921b40608962fd2f64fa6b8eb330.exe	102
PID 2684 wrote to memory of 3908	2684	48ec921b40608962fd2f64fa6b8eb330.exe	102
PID 2684 wrote to memory of 4448	2684	48ec921b40608962fd2f64fa6b8eb330.exe	103
PID 2684 wrote to memory of 4448	2684	48ec921b40608962fd2f64fa6b8eb330.exe	103
PID 2684 wrote to memory of 4872	2684	48ec921b40608962fd2f64fa6b8eb330.exe	104
PID 2684 wrote to memory of 4872	2684	48ec921b40608962fd2f64fa6b8eb330.exe	104
PID 2684 wrote to memory of 4920	2684	48ec921b40608962fd2f64fa6b8eb330.exe	105
PID 2684 wrote to memory of 4920	2684	48ec921b40608962fd2f64fa6b8eb330.exe	105
PID 2684 wrote to memory of 3380	2684	48ec921b40608962fd2f64fa6b8eb330.exe	106
PID 2684 wrote to memory of 3380	2684	48ec921b40608962fd2f64fa6b8eb330.exe	106
PID 2684 wrote to memory of 4112	2684	48ec921b40608962fd2f64fa6b8eb330.exe	107
PID 2684 wrote to memory of 4112	2684	48ec921b40608962fd2f64fa6b8eb330.exe	107
PID 2684 wrote to memory of 2332	2684	48ec921b40608962fd2f64fa6b8eb330.exe	108
PID 2684 wrote to memory of 2332	2684	48ec921b40608962fd2f64fa6b8eb330.exe	108
PID 2684 wrote to memory of 4092	2684	48ec921b40608962fd2f64fa6b8eb330.exe	109
PID 2684 wrote to memory of 4092	2684	48ec921b40608962fd2f64fa6b8eb330.exe	109
PID 2684 wrote to memory of 4432	2684	48ec921b40608962fd2f64fa6b8eb330.exe	110
PID 2684 wrote to memory of 4432	2684	48ec921b40608962fd2f64fa6b8eb330.exe	110
PID 2684 wrote to memory of 4220	2684	48ec921b40608962fd2f64fa6b8eb330.exe	111
PID 2684 wrote to memory of 4220	2684	48ec921b40608962fd2f64fa6b8eb330.exe	111
PID 2684 wrote to memory of 2680	2684	48ec921b40608962fd2f64fa6b8eb330.exe	112
PID 2684 wrote to memory of 2680	2684	48ec921b40608962fd2f64fa6b8eb330.exe	112
PID 2684 wrote to memory of 2352	2684	48ec921b40608962fd2f64fa6b8eb330.exe	113
PID 2684 wrote to memory of 2352	2684	48ec921b40608962fd2f64fa6b8eb330.exe	113
PID 2684 wrote to memory of 4120	2684	48ec921b40608962fd2f64fa6b8eb330.exe	114
PID 2684 wrote to memory of 4120	2684	48ec921b40608962fd2f64fa6b8eb330.exe	114
PID 2684 wrote to memory of 468	2684	48ec921b40608962fd2f64fa6b8eb330.exe	115
PID 2684 wrote to memory of 468	2684	48ec921b40608962fd2f64fa6b8eb330.exe	115

C:\Users\Admin\AppData\Local\Temp\48ec921b40608962fd2f64fa6b8eb330.exe
"C:\Users\Admin\AppData\Local\Temp\48ec921b40608962fd2f64fa6b8eb330.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- C:\Windows\System\LsMbdeB.exe
  C:\Windows\System\LsMbdeB.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\ATQGTpw.exe
  C:\Windows\System\ATQGTpw.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\VDhUCtL.exe
  C:\Windows\System\VDhUCtL.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\yCTbQMv.exe
  C:\Windows\System\yCTbQMv.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\tjDqDZZ.exe
  C:\Windows\System\tjDqDZZ.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\IKQCkBh.exe
  C:\Windows\System\IKQCkBh.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\taTYXvV.exe
  C:\Windows\System\taTYXvV.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\OCGkJrg.exe
  C:\Windows\System\OCGkJrg.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\GBDwCFb.exe
  C:\Windows\System\GBDwCFb.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\VuuDBFV.exe
  C:\Windows\System\VuuDBFV.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\AJJCHat.exe
  C:\Windows\System\AJJCHat.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\wjlAhaA.exe
  C:\Windows\System\wjlAhaA.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\KtcTmEK.exe
  C:\Windows\System\KtcTmEK.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\QUVUBKA.exe
  C:\Windows\System\QUVUBKA.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\wtCftpH.exe
  C:\Windows\System\wtCftpH.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\yDrYhDM.exe
  C:\Windows\System\yDrYhDM.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\KtWILbN.exe
  C:\Windows\System\KtWILbN.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\gLCbddd.exe
  C:\Windows\System\gLCbddd.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\rTneiAB.exe
  C:\Windows\System\rTneiAB.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\VdisNYW.exe
  C:\Windows\System\VdisNYW.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\NGEOyKA.exe
  C:\Windows\System\NGEOyKA.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\NCkGFjx.exe
  C:\Windows\System\NCkGFjx.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\ZhZOaQN.exe
  C:\Windows\System\ZhZOaQN.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\BEoqgoF.exe
  C:\Windows\System\BEoqgoF.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\qZMngCO.exe
  C:\Windows\System\qZMngCO.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\JGTxbDe.exe
  C:\Windows\System\JGTxbDe.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\KBXFWuz.exe
  C:\Windows\System\KBXFWuz.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\tCjQmBQ.exe
  C:\Windows\System\tCjQmBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\koYSPOF.exe
  C:\Windows\System\koYSPOF.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\yOAPnbC.exe
  C:\Windows\System\yOAPnbC.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\PaEjJIS.exe
  C:\Windows\System\PaEjJIS.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\GheLHUU.exe
  C:\Windows\System\GheLHUU.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\sUCNGnl.exe
  C:\Windows\System\sUCNGnl.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\teoGihv.exe
  C:\Windows\System\teoGihv.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\ZUoxBEL.exe
  C:\Windows\System\ZUoxBEL.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\CYPHJYB.exe
  C:\Windows\System\CYPHJYB.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\DyeUwbZ.exe
  C:\Windows\System\DyeUwbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\trzeGWd.exe
  C:\Windows\System\trzeGWd.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\CAlnvhM.exe
  C:\Windows\System\CAlnvhM.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\xmriGPS.exe
  C:\Windows\System\xmriGPS.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\ScMkorS.exe
  C:\Windows\System\ScMkorS.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\MzFcvsV.exe
  C:\Windows\System\MzFcvsV.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\QDLlYSS.exe
  C:\Windows\System\QDLlYSS.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\RjcaijO.exe
  C:\Windows\System\RjcaijO.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\gfjSlSF.exe
  C:\Windows\System\gfjSlSF.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\GbxCDkx.exe
  C:\Windows\System\GbxCDkx.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\KUaCUeD.exe
  C:\Windows\System\KUaCUeD.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\CBodpRU.exe
  C:\Windows\System\CBodpRU.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\UlUffdI.exe
  C:\Windows\System\UlUffdI.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\VghnhQB.exe
  C:\Windows\System\VghnhQB.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\jujLkCX.exe
  C:\Windows\System\jujLkCX.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\LQvRCCi.exe
  C:\Windows\System\LQvRCCi.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\oyJTzbX.exe
  C:\Windows\System\oyJTzbX.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\YXfLTid.exe
  C:\Windows\System\YXfLTid.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\uXSaArK.exe
  C:\Windows\System\uXSaArK.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\IaFHsDb.exe
  C:\Windows\System\IaFHsDb.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\PeOVuwp.exe
  C:\Windows\System\PeOVuwp.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\hXCFXzs.exe
  C:\Windows\System\hXCFXzs.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\aXSOdKJ.exe
  C:\Windows\System\aXSOdKJ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\QpOGDRj.exe
  C:\Windows\System\QpOGDRj.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\TbskUzQ.exe
  C:\Windows\System\TbskUzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\cJyuzsp.exe
  C:\Windows\System\cJyuzsp.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\mwEmliS.exe
  C:\Windows\System\mwEmliS.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\XgUsGYO.exe
  C:\Windows\System\XgUsGYO.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\AdJlmvC.exe
  C:\Windows\System\AdJlmvC.exe
  2⤵
  PID:1992
- C:\Windows\System\LtkKpwY.exe
  C:\Windows\System\LtkKpwY.exe
  2⤵
  PID:856
- C:\Windows\System\RJdRJMR.exe
  C:\Windows\System\RJdRJMR.exe
  2⤵
  PID:896
- C:\Windows\System\ycYhCsO.exe
  C:\Windows\System\ycYhCsO.exe
  2⤵
  PID:3808
- C:\Windows\System\JcmNtPT.exe
  C:\Windows\System\JcmNtPT.exe
  2⤵
  PID:1652
- C:\Windows\System\qILAMgu.exe
  C:\Windows\System\qILAMgu.exe
  2⤵
  PID:1644
- C:\Windows\System\dlbDtZD.exe
  C:\Windows\System\dlbDtZD.exe
  2⤵
  PID:2104
- C:\Windows\System\edCKzDw.exe
  C:\Windows\System\edCKzDw.exe
  2⤵
  PID:4372
- C:\Windows\System\nUXvcOn.exe
  C:\Windows\System\nUXvcOn.exe
  2⤵
  PID:1612
- C:\Windows\System\pkaHmOl.exe
  C:\Windows\System\pkaHmOl.exe
  2⤵
  PID:3320
- C:\Windows\System\CfuKneJ.exe
  C:\Windows\System\CfuKneJ.exe
  2⤵
  PID:5596
- C:\Windows\System\QXXVahI.exe
  C:\Windows\System\QXXVahI.exe
  2⤵
  PID:5636
- C:\Windows\System\rQHVImR.exe
  C:\Windows\System\rQHVImR.exe
  2⤵
  PID:5668
- C:\Windows\System\coTiWYs.exe
  C:\Windows\System\coTiWYs.exe
  2⤵
  PID:5692
- C:\Windows\System\mlpZSwX.exe
  C:\Windows\System\mlpZSwX.exe
  2⤵
  PID:5740
- C:\Windows\System\ToHcTDP.exe
  C:\Windows\System\ToHcTDP.exe
  2⤵
  PID:5764
- C:\Windows\System\QwRISoE.exe
  C:\Windows\System\QwRISoE.exe
  2⤵
  PID:5780
- C:\Windows\System\JmEkgLs.exe
  C:\Windows\System\JmEkgLs.exe
  2⤵
  PID:5824
- C:\Windows\System\yjjuNwk.exe
  C:\Windows\System\yjjuNwk.exe
  2⤵
  PID:5844
- C:\Windows\System\vCPVNqV.exe
  C:\Windows\System\vCPVNqV.exe
  2⤵
  PID:5860
- C:\Windows\System\BntElbB.exe
  C:\Windows\System\BntElbB.exe
  2⤵
  PID:5876
- C:\Windows\System\wqmPeKk.exe
  C:\Windows\System\wqmPeKk.exe
  2⤵
  PID:5900
- C:\Windows\System\fHtonry.exe
  C:\Windows\System\fHtonry.exe
  2⤵
  PID:5916
- C:\Windows\System\OgrxwjM.exe
  C:\Windows\System\OgrxwjM.exe
  2⤵
  PID:5936
- C:\Windows\System\MfIVEIW.exe
  C:\Windows\System\MfIVEIW.exe
  2⤵
  PID:5956
- C:\Windows\System\gSKbeka.exe
  C:\Windows\System\gSKbeka.exe
  2⤵
  PID:5980
- C:\Windows\System\HUEQlpW.exe
  C:\Windows\System\HUEQlpW.exe
  2⤵
  PID:6004
- C:\Windows\System\nxwJcCQ.exe
  C:\Windows\System\nxwJcCQ.exe
  2⤵
  PID:6028
- C:\Windows\System\PwKwjLm.exe
  C:\Windows\System\PwKwjLm.exe
  2⤵
  PID:6060
- C:\Windows\System\oNgcdLZ.exe
  C:\Windows\System\oNgcdLZ.exe
  2⤵
  PID:6076
- C:\Windows\System\VwUTwII.exe
  C:\Windows\System\VwUTwII.exe
  2⤵
  PID:6100
- C:\Windows\System\PtrbRSx.exe
  C:\Windows\System\PtrbRSx.exe
  2⤵
  PID:6120
- C:\Windows\System\EylxHGI.exe
  C:\Windows\System\EylxHGI.exe
  2⤵
  PID:6140
- C:\Windows\System\ZriKcZL.exe
  C:\Windows\System\ZriKcZL.exe
  2⤵
  PID:3156
- C:\Windows\System\UFnpGnh.exe
  C:\Windows\System\UFnpGnh.exe
  2⤵
  PID:5024
- C:\Windows\System\totPzzb.exe
  C:\Windows\System\totPzzb.exe
  2⤵
  PID:1560
- C:\Windows\System\VIGklkh.exe
  C:\Windows\System\VIGklkh.exe
  2⤵
  PID:404
- C:\Windows\System\WfAqOJY.exe
  C:\Windows\System\WfAqOJY.exe
  2⤵
  PID:2428
- C:\Windows\System\fvaiPPH.exe
  C:\Windows\System\fvaiPPH.exe
  2⤵
  PID:2660
- C:\Windows\System\NZOIagO.exe
  C:\Windows\System\NZOIagO.exe
  2⤵
  PID:2284
- C:\Windows\System\AbxHNpD.exe
  C:\Windows\System\AbxHNpD.exe
  2⤵
  PID:740
- C:\Windows\System\fGdeTKX.exe
  C:\Windows\System\fGdeTKX.exe
  2⤵
  PID:4060
- C:\Windows\System\guhLjDo.exe
  C:\Windows\System\guhLjDo.exe
  2⤵
  PID:372
- C:\Windows\System\CrKdonD.exe
  C:\Windows\System\CrKdonD.exe
  2⤵
  PID:3252
- C:\Windows\System\CRdLoxT.exe
  C:\Windows\System\CRdLoxT.exe
  2⤵
  PID:1640
- C:\Windows\System\PPTEqsF.exe
  C:\Windows\System\PPTEqsF.exe
  2⤵
  PID:5008
- C:\Windows\System\HGOiKge.exe
  C:\Windows\System\HGOiKge.exe
  2⤵
  PID:5144
- C:\Windows\System\ujZjujd.exe
  C:\Windows\System\ujZjujd.exe
  2⤵
  PID:5308
- C:\Windows\System\VixpuVu.exe
  C:\Windows\System\VixpuVu.exe
  2⤵
  PID:3676
- C:\Windows\System\mBSHVin.exe
  C:\Windows\System\mBSHVin.exe
  2⤵
  PID:2672
- C:\Windows\System\WeCmcSF.exe
  C:\Windows\System\WeCmcSF.exe
  2⤵
  PID:1804
- C:\Windows\System\sIJhXzM.exe
  C:\Windows\System\sIJhXzM.exe
  2⤵
  PID:4584
- C:\Windows\System\uwiHJql.exe
  C:\Windows\System\uwiHJql.exe
  2⤵
  PID:2344
- C:\Windows\System\pRGWEhu.exe
  C:\Windows\System\pRGWEhu.exe
  2⤵
  PID:4800
- C:\Windows\System\lKhgDfs.exe
  C:\Windows\System\lKhgDfs.exe
  2⤵
  PID:4056
- C:\Windows\System\RdeaZaq.exe
  C:\Windows\System\RdeaZaq.exe
  2⤵
  PID:3816
- C:\Windows\System\rQVoOPC.exe
  C:\Windows\System\rQVoOPC.exe
  2⤵
  PID:4924
- C:\Windows\System\GDewquW.exe
  C:\Windows\System\GDewquW.exe
  2⤵
  PID:4772
- C:\Windows\System\drQOLoi.exe
  C:\Windows\System\drQOLoi.exe
  2⤵
  PID:2480
- C:\Windows\System\fznzvzz.exe
  C:\Windows\System\fznzvzz.exe
  2⤵
  PID:4136
- C:\Windows\System\yTkWJgJ.exe
  C:\Windows\System\yTkWJgJ.exe
  2⤵
  PID:1596
- C:\Windows\System\CULXMAJ.exe
  C:\Windows\System\CULXMAJ.exe
  2⤵
  PID:5544
- C:\Windows\System\bdKhAWH.exe
  C:\Windows\System\bdKhAWH.exe
  2⤵
  PID:4088
- C:\Windows\System\aNWFEsd.exe
  C:\Windows\System\aNWFEsd.exe
  2⤵
  PID:1636
- C:\Windows\System\spqEAJM.exe
  C:\Windows\System\spqEAJM.exe
  2⤵
  PID:3096
- C:\Windows\System\LlyNlEz.exe
  C:\Windows\System\LlyNlEz.exe
  2⤵
  PID:5612
- C:\Windows\System\pZiZPfX.exe
  C:\Windows\System\pZiZPfX.exe
  2⤵
  PID:2924
- C:\Windows\System\DloDchi.exe
  C:\Windows\System\DloDchi.exe
  2⤵
  PID:1076
- C:\Windows\System\RnPLVeI.exe
  C:\Windows\System\RnPLVeI.exe
  2⤵
  PID:4860
- C:\Windows\System\euuWZJL.exe
  C:\Windows\System\euuWZJL.exe
  2⤵
  PID:5644
- C:\Windows\System\cBEWcwX.exe
  C:\Windows\System\cBEWcwX.exe
  2⤵
  PID:5676
- C:\Windows\System\XiAgoEj.exe
  C:\Windows\System\XiAgoEj.exe
  2⤵
  PID:5700
- C:\Windows\System\OUsaYsS.exe
  C:\Windows\System\OUsaYsS.exe
  2⤵
  PID:5760
- C:\Windows\System\eYPqNWU.exe
  C:\Windows\System\eYPqNWU.exe
  2⤵
  PID:5736
- C:\Windows\System\lvRuGig.exe
  C:\Windows\System\lvRuGig.exe
  2⤵
  PID:5800
- C:\Windows\System\CDMASTa.exe
  C:\Windows\System\CDMASTa.exe
  2⤵
  PID:5924
- C:\Windows\System\mStuFFA.exe
  C:\Windows\System\mStuFFA.exe
  2⤵
  PID:5964
- C:\Windows\System\XAVxTUs.exe
  C:\Windows\System\XAVxTUs.exe
  2⤵
  PID:6048
- C:\Windows\System\eRCzwCI.exe
  C:\Windows\System\eRCzwCI.exe
  2⤵
  PID:6132
- C:\Windows\System\VacDPGO.exe
  C:\Windows\System\VacDPGO.exe
  2⤵
  PID:6016
- C:\Windows\System\YWrtxHI.exe
  C:\Windows\System\YWrtxHI.exe
  2⤵
  PID:6020
- C:\Windows\System\CiYANpW.exe
  C:\Windows\System\CiYANpW.exe
  2⤵
  PID:5908
- C:\Windows\System\ZqVhXcu.exe
  C:\Windows\System\ZqVhXcu.exe
  2⤵
  PID:4948
- C:\Windows\System\UgjMeCq.exe
  C:\Windows\System\UgjMeCq.exe
  2⤵
  PID:6096
- C:\Windows\System\JxzuOsk.exe
  C:\Windows\System\JxzuOsk.exe
  2⤵
  PID:1568
- C:\Windows\System\FeKUQIk.exe
  C:\Windows\System\FeKUQIk.exe
  2⤵
  PID:1444
- C:\Windows\System\USwXYYt.exe
  C:\Windows\System\USwXYYt.exe
  2⤵
  PID:332
- C:\Windows\System\EdTLPXa.exe
  C:\Windows\System\EdTLPXa.exe
  2⤵
  PID:2412
- C:\Windows\System\kirEilH.exe
  C:\Windows\System\kirEilH.exe
  2⤵
  PID:2768
- C:\Windows\System\brzwBFK.exe
  C:\Windows\System\brzwBFK.exe
  2⤵
  PID:4468
- C:\Windows\System\ACeaXdF.exe
  C:\Windows\System\ACeaXdF.exe
  2⤵
  PID:5164
- C:\Windows\System\fYMDLdh.exe
  C:\Windows\System\fYMDLdh.exe
  2⤵
  PID:3948
- C:\Windows\System\XmiJVdc.exe
  C:\Windows\System\XmiJVdc.exe
  2⤵
  PID:1096
- C:\Windows\System\wMxWptt.exe
  C:\Windows\System\wMxWptt.exe
  2⤵
  PID:5372
- C:\Windows\System\uSkgYDw.exe
  C:\Windows\System\uSkgYDw.exe
  2⤵
  PID:5656
- C:\Windows\System\NgSmqvC.exe
  C:\Windows\System\NgSmqvC.exe
  2⤵
  PID:6164
- C:\Windows\System\UNkbeMN.exe
  C:\Windows\System\UNkbeMN.exe
  2⤵
  PID:6184
- C:\Windows\System\JmfIWQi.exe
  C:\Windows\System\JmfIWQi.exe
  2⤵
  PID:6204
- C:\Windows\System\RNfZBCq.exe
  C:\Windows\System\RNfZBCq.exe
  2⤵
  PID:6228
- C:\Windows\System\igwsFgq.exe
  C:\Windows\System\igwsFgq.exe
  2⤵
  PID:6252
- C:\Windows\System\cREQZVV.exe
  C:\Windows\System\cREQZVV.exe
  2⤵
  PID:6268
- C:\Windows\System\mTRsbJw.exe
  C:\Windows\System\mTRsbJw.exe
  2⤵
  PID:6292
- C:\Windows\System\AvKzoAT.exe
  C:\Windows\System\AvKzoAT.exe
  2⤵
  PID:6308
- C:\Windows\System\GRuhQxx.exe
  C:\Windows\System\GRuhQxx.exe
  2⤵
  PID:6332
- C:\Windows\System\wPFwPJm.exe
  C:\Windows\System\wPFwPJm.exe
  2⤵
  PID:6352
- C:\Windows\System\vbnnqhU.exe
  C:\Windows\System\vbnnqhU.exe
  2⤵
  PID:6372
- C:\Windows\System\xThclRR.exe
  C:\Windows\System\xThclRR.exe
  2⤵
  PID:6400
- C:\Windows\System\mnnsYpG.exe
  C:\Windows\System\mnnsYpG.exe
  2⤵
  PID:6432
- C:\Windows\System\paNgujO.exe
  C:\Windows\System\paNgujO.exe
  2⤵
  PID:6452
- C:\Windows\System\jToLFZK.exe
  C:\Windows\System\jToLFZK.exe
  2⤵
  PID:6476
- C:\Windows\System\yAuQRRS.exe
  C:\Windows\System\yAuQRRS.exe
  2⤵
  PID:6496
- C:\Windows\System\VHbQtUi.exe
  C:\Windows\System\VHbQtUi.exe
  2⤵
  PID:6520
- C:\Windows\System\RWVVtHS.exe
  C:\Windows\System\RWVVtHS.exe
  2⤵
  PID:6540
- C:\Windows\System\HtJnYpp.exe
  C:\Windows\System\HtJnYpp.exe
  2⤵
  PID:6560
- C:\Windows\System\OYrpzyE.exe
  C:\Windows\System\OYrpzyE.exe
  2⤵
  PID:6580
- C:\Windows\System\EszHQOo.exe
  C:\Windows\System\EszHQOo.exe
  2⤵
  PID:6604
- C:\Windows\System\lYiuphy.exe
  C:\Windows\System\lYiuphy.exe
  2⤵
  PID:6620
- C:\Windows\System\GfNBSRZ.exe
  C:\Windows\System\GfNBSRZ.exe
  2⤵
  PID:6644
- C:\Windows\System\DsEQCKk.exe
  C:\Windows\System\DsEQCKk.exe
  2⤵
  PID:6664
- C:\Windows\System\ISKEtyc.exe
  C:\Windows\System\ISKEtyc.exe
  2⤵
  PID:6684
- C:\Windows\System\ZPQfFRt.exe
  C:\Windows\System\ZPQfFRt.exe
  2⤵
  PID:6700
- C:\Windows\System\cKcjTcr.exe
  C:\Windows\System\cKcjTcr.exe
  2⤵
  PID:6728
- C:\Windows\System\AZvaEZL.exe
  C:\Windows\System\AZvaEZL.exe
  2⤵
  PID:6744
- C:\Windows\System\kvrSFPO.exe
  C:\Windows\System\kvrSFPO.exe
  2⤵
  PID:6768
- C:\Windows\System\FsvTgaW.exe
  C:\Windows\System\FsvTgaW.exe
  2⤵
  PID:6796
- C:\Windows\System\wYfqRDy.exe
  C:\Windows\System\wYfqRDy.exe
  2⤵
  PID:6828
- C:\Windows\System\TRbIovO.exe
  C:\Windows\System\TRbIovO.exe
  2⤵
  PID:6848
- C:\Windows\System\admBEfA.exe
  C:\Windows\System\admBEfA.exe
  2⤵
  PID:6872
- C:\Windows\System\jCmsriY.exe
  C:\Windows\System\jCmsriY.exe
  2⤵
  PID:6888
- C:\Windows\System\XjFEXLS.exe
  C:\Windows\System\XjFEXLS.exe
  2⤵
  PID:6912
- C:\Windows\System\tQtdXKA.exe
  C:\Windows\System\tQtdXKA.exe
  2⤵
  PID:6928
- C:\Windows\System\YXAHeBU.exe
  C:\Windows\System\YXAHeBU.exe
  2⤵
  PID:6960
- C:\Windows\System\SZtsIpK.exe
  C:\Windows\System\SZtsIpK.exe
  2⤵
  PID:6976
- C:\Windows\System\JxUPCwj.exe
  C:\Windows\System\JxUPCwj.exe
  2⤵
  PID:6996
- C:\Windows\System\msXTEuk.exe
  C:\Windows\System\msXTEuk.exe
  2⤵
  PID:7016
- C:\Windows\System\QpsBDFO.exe
  C:\Windows\System\QpsBDFO.exe
  2⤵
  PID:7040
- C:\Windows\System\vzwbnVh.exe
  C:\Windows\System\vzwbnVh.exe
  2⤵
  PID:7064
- C:\Windows\System\QWyloDb.exe
  C:\Windows\System\QWyloDb.exe
  2⤵
  PID:7088
- C:\Windows\System\RpVlYCP.exe
  C:\Windows\System\RpVlYCP.exe
  2⤵
  PID:7108
- C:\Windows\System\YPaUYme.exe
  C:\Windows\System\YPaUYme.exe
  2⤵
  PID:7136
- C:\Windows\System\AyrVkci.exe
  C:\Windows\System\AyrVkci.exe
  2⤵
  PID:7156
- C:\Windows\System\AkGBdeP.exe
  C:\Windows\System\AkGBdeP.exe
  2⤵
  PID:1172
- C:\Windows\System\VqArTSf.exe
  C:\Windows\System\VqArTSf.exe
  2⤵
  PID:3052
- C:\Windows\System\PbkBNeJ.exe
  C:\Windows\System\PbkBNeJ.exe
  2⤵
  PID:5292
- C:\Windows\System\DdtwkxH.exe
  C:\Windows\System\DdtwkxH.exe
  2⤵
  PID:5992
- C:\Windows\System\zFJnSYI.exe
  C:\Windows\System\zFJnSYI.exe
  2⤵
  PID:2140
- C:\Windows\System\JvojrtI.exe
  C:\Windows\System\JvojrtI.exe
  2⤵
  PID:6072
- C:\Windows\System\nKzMoAl.exe
  C:\Windows\System\nKzMoAl.exe
  2⤵
  PID:5420
- C:\Windows\System\XuDTipL.exe
  C:\Windows\System\XuDTipL.exe
  2⤵
  PID:440
- C:\Windows\System\wvjGbAO.exe
  C:\Windows\System\wvjGbAO.exe
  2⤵
  PID:3752
- C:\Windows\System\rILjtAF.exe
  C:\Windows\System\rILjtAF.exe
  2⤵
  PID:5628
- C:\Windows\System\XldFIbs.exe
  C:\Windows\System\XldFIbs.exe
  2⤵
  PID:6156
- C:\Windows\System\YsNIkHr.exe
  C:\Windows\System\YsNIkHr.exe
  2⤵
  PID:1840
- C:\Windows\System\jnBgWBt.exe
  C:\Windows\System\jnBgWBt.exe
  2⤵
  PID:6176
- C:\Windows\System\JlSyPxM.exe
  C:\Windows\System\JlSyPxM.exe
  2⤵
  PID:6212
- C:\Windows\System\GXoPDyk.exe
  C:\Windows\System\GXoPDyk.exe
  2⤵
  PID:6260
- C:\Windows\System\TvPOmDR.exe
  C:\Windows\System\TvPOmDR.exe
  2⤵
  PID:6304
- C:\Windows\System\jHNitpD.exe
  C:\Windows\System\jHNitpD.exe
  2⤵
  PID:5788
- C:\Windows\System\VAfuAXx.exe
  C:\Windows\System\VAfuAXx.exe
  2⤵
  PID:6416
- C:\Windows\System\DELApxT.exe
  C:\Windows\System\DELApxT.exe
  2⤵
  PID:2408
- C:\Windows\System\RICBkss.exe
  C:\Windows\System\RICBkss.exe
  2⤵
  PID:5552
- C:\Windows\System\ODoSKcB.exe
  C:\Windows\System\ODoSKcB.exe
  2⤵
  PID:6588
- C:\Windows\System\iOZoTVT.exe
  C:\Windows\System\iOZoTVT.exe
  2⤵
  PID:6616
- C:\Windows\System\aYBWYGf.exe
  C:\Windows\System\aYBWYGf.exe
  2⤵
  PID:6680
- C:\Windows\System\DPfWLCY.exe
  C:\Windows\System\DPfWLCY.exe
  2⤵
  PID:3524
- C:\Windows\System\gYtCJLn.exe
  C:\Windows\System\gYtCJLn.exe
  2⤵
  PID:5136
- C:\Windows\System\riJUyzx.exe
  C:\Windows\System\riJUyzx.exe
  2⤵
  PID:7180
- C:\Windows\System\MrpCJuo.exe
  C:\Windows\System\MrpCJuo.exe
  2⤵
  PID:7208
- C:\Windows\System\raEdNOT.exe
  C:\Windows\System\raEdNOT.exe
  2⤵
  PID:7228
- C:\Windows\System\vqPfvwl.exe
  C:\Windows\System\vqPfvwl.exe
  2⤵
  PID:7260
- C:\Windows\System\TuGRynp.exe
  C:\Windows\System\TuGRynp.exe
  2⤵
  PID:7284
- C:\Windows\System\snYVbJe.exe
  C:\Windows\System\snYVbJe.exe
  2⤵
  PID:7300
- C:\Windows\System\ktXniGk.exe
  C:\Windows\System\ktXniGk.exe
  2⤵
  PID:7328
- C:\Windows\System\ZLZIxUu.exe
  C:\Windows\System\ZLZIxUu.exe
  2⤵
  PID:7344
- C:\Windows\System\wChqwgw.exe
  C:\Windows\System\wChqwgw.exe
  2⤵
  PID:7364
- C:\Windows\System\CQrzHmu.exe
  C:\Windows\System\CQrzHmu.exe
  2⤵
  PID:7388
- C:\Windows\System\orZKdgb.exe
  C:\Windows\System\orZKdgb.exe
  2⤵
  PID:7412
- C:\Windows\System\djhVuvP.exe
  C:\Windows\System\djhVuvP.exe
  2⤵
  PID:7440
- C:\Windows\System\GAVntXl.exe
  C:\Windows\System\GAVntXl.exe
  2⤵
  PID:7464
- C:\Windows\System\LvFdaIZ.exe
  C:\Windows\System\LvFdaIZ.exe
  2⤵
  PID:7484
- C:\Windows\System\dKKJUcv.exe
  C:\Windows\System\dKKJUcv.exe
  2⤵
  PID:7504
- C:\Windows\System\BubmhEW.exe
  C:\Windows\System\BubmhEW.exe
  2⤵
  PID:7524
- C:\Windows\System\QTXZSqR.exe
  C:\Windows\System\QTXZSqR.exe
  2⤵
  PID:7548
- C:\Windows\System\GMGxDux.exe
  C:\Windows\System\GMGxDux.exe
  2⤵
  PID:7568
- C:\Windows\System\RGzkugV.exe
  C:\Windows\System\RGzkugV.exe
  2⤵
  PID:7588
- C:\Windows\System\ebrdYDA.exe
  C:\Windows\System\ebrdYDA.exe
  2⤵
  PID:7624
- C:\Windows\System\kmkIrfQ.exe
  C:\Windows\System\kmkIrfQ.exe
  2⤵
  PID:7648
- C:\Windows\System\guTyyNZ.exe
  C:\Windows\System\guTyyNZ.exe
  2⤵
  PID:7668
- C:\Windows\System\SnzHeUb.exe
  C:\Windows\System\SnzHeUb.exe
  2⤵
  PID:7688
- C:\Windows\System\InDmboc.exe
  C:\Windows\System\InDmboc.exe
  2⤵
  PID:7712
- C:\Windows\System\ehtxoeG.exe
  C:\Windows\System\ehtxoeG.exe
  2⤵
  PID:7732
- C:\Windows\System\HCrRKjj.exe
  C:\Windows\System\HCrRKjj.exe
  2⤵
  PID:7752
- C:\Windows\System\IrKNihW.exe
  C:\Windows\System\IrKNihW.exe
  2⤵
  PID:7780
- C:\Windows\System\EjlZtjp.exe
  C:\Windows\System\EjlZtjp.exe
  2⤵
  PID:7796
- C:\Windows\System\rcCHaVV.exe
  C:\Windows\System\rcCHaVV.exe
  2⤵
  PID:7820
- C:\Windows\System\XxcQlHk.exe
  C:\Windows\System\XxcQlHk.exe
  2⤵
  PID:7844
- C:\Windows\System\YcpoiUv.exe
  C:\Windows\System\YcpoiUv.exe
  2⤵
  PID:7872
- C:\Windows\System\fjawwic.exe
  C:\Windows\System\fjawwic.exe
  2⤵
  PID:7896
- C:\Windows\System\WwHZsSi.exe
  C:\Windows\System\WwHZsSi.exe
  2⤵
  PID:7916
- C:\Windows\System\Cvtwyed.exe
  C:\Windows\System\Cvtwyed.exe
  2⤵
  PID:7936
- C:\Windows\System\UXnVEUf.exe
  C:\Windows\System\UXnVEUf.exe
  2⤵
  PID:7956
- C:\Windows\System\jWHqhwi.exe
  C:\Windows\System\jWHqhwi.exe
  2⤵
  PID:7980
- C:\Windows\System\dVMvASB.exe
  C:\Windows\System\dVMvASB.exe
  2⤵
  PID:8000
- C:\Windows\System\PjehCPH.exe
  C:\Windows\System\PjehCPH.exe
  2⤵
  PID:8024
- C:\Windows\System\MsAMirL.exe
  C:\Windows\System\MsAMirL.exe
  2⤵
  PID:8044
- C:\Windows\System\TYvqLXD.exe
  C:\Windows\System\TYvqLXD.exe
  2⤵
  PID:8064
- C:\Windows\System\uCZQjYM.exe
  C:\Windows\System\uCZQjYM.exe
  2⤵
  PID:8088
- C:\Windows\System\SuoKzGH.exe
  C:\Windows\System\SuoKzGH.exe
  2⤵
  PID:8108
- C:\Windows\System\hcDvpkr.exe
  C:\Windows\System\hcDvpkr.exe
  2⤵
  PID:8124
- C:\Windows\System\xCYttbq.exe
  C:\Windows\System\xCYttbq.exe
  2⤵
  PID:8152
- C:\Windows\System\ZPBEBhS.exe
  C:\Windows\System\ZPBEBhS.exe
  2⤵
  PID:8172
- C:\Windows\System\VQyJjtB.exe
  C:\Windows\System\VQyJjtB.exe
  2⤵
  PID:6840
- C:\Windows\System\AJInwii.exe
  C:\Windows\System\AJInwii.exe
  2⤵
  PID:7036
- C:\Windows\System\jjLSCmd.exe
  C:\Windows\System\jjLSCmd.exe
  2⤵
  PID:7148
- C:\Windows\System\ZfNgkxY.exe
  C:\Windows\System\ZfNgkxY.exe
  2⤵
  PID:5276
- C:\Windows\System\ejVFcDR.exe
  C:\Windows\System\ejVFcDR.exe
  2⤵
  PID:5988
- C:\Windows\System\dTARnUM.exe
  C:\Windows\System\dTARnUM.exe
  2⤵
  PID:6444
- C:\Windows\System\MRtgxKb.exe
  C:\Windows\System\MRtgxKb.exe
  2⤵
  PID:6468
- C:\Windows\System\IzUqiRz.exe
  C:\Windows\System\IzUqiRz.exe
  2⤵
  PID:5088
- C:\Windows\System\vqoTbsN.exe
  C:\Windows\System\vqoTbsN.exe
  2⤵
  PID:6152
- C:\Windows\System\HFCOFBd.exe
  C:\Windows\System\HFCOFBd.exe
  2⤵
  PID:6388
- C:\Windows\System\cCVSRLO.exe
  C:\Windows\System\cCVSRLO.exe
  2⤵
  PID:1996
- C:\Windows\System\XLfhcZc.exe
  C:\Windows\System\XLfhcZc.exe
  2⤵
  PID:6784
- C:\Windows\System\eGFdDPj.exe
  C:\Windows\System\eGFdDPj.exe
  2⤵
  PID:5108
- C:\Windows\System\ebnlQiB.exe
  C:\Windows\System\ebnlQiB.exe
  2⤵
  PID:4240
- C:\Windows\System\vTcXgcr.exe
  C:\Windows\System\vTcXgcr.exe
  2⤵
  PID:7220
- C:\Windows\System\HOhWPoQ.exe
  C:\Windows\System\HOhWPoQ.exe
  2⤵
  PID:6868
- C:\Windows\System\wkvuXvy.exe
  C:\Windows\System\wkvuXvy.exe
  2⤵
  PID:7012
- C:\Windows\System\rwQUoAb.exe
  C:\Windows\System\rwQUoAb.exe
  2⤵
  PID:7404
- C:\Windows\System\BcVynoP.exe
  C:\Windows\System\BcVynoP.exe
  2⤵
  PID:8200
- C:\Windows\System\oKlntAc.exe
  C:\Windows\System\oKlntAc.exe
  2⤵
  PID:8220
- C:\Windows\System\WkJhhTe.exe
  C:\Windows\System\WkJhhTe.exe
  2⤵
  PID:8244
- C:\Windows\System\dSsYsmR.exe
  C:\Windows\System\dSsYsmR.exe
  2⤵
  PID:8272
- C:\Windows\System\fvpmUra.exe
  C:\Windows\System\fvpmUra.exe
  2⤵
  PID:8288
- C:\Windows\System\ibNIKNG.exe
  C:\Windows\System\ibNIKNG.exe
  2⤵
  PID:8304
- C:\Windows\System\RvNuowA.exe
  C:\Windows\System\RvNuowA.exe
  2⤵
  PID:8328
- C:\Windows\System\AuOJmtV.exe
  C:\Windows\System\AuOJmtV.exe
  2⤵
  PID:8352
- C:\Windows\System\mzKSmub.exe
  C:\Windows\System\mzKSmub.exe
  2⤵
  PID:8372
- C:\Windows\System\RhcaMpL.exe
  C:\Windows\System\RhcaMpL.exe
  2⤵
  PID:8388
- C:\Windows\System\rIouwQz.exe
  C:\Windows\System\rIouwQz.exe
  2⤵
  PID:8416
- C:\Windows\System\RcUoeuG.exe
  C:\Windows\System\RcUoeuG.exe
  2⤵
  PID:8436
- C:\Windows\System\wXnDGeQ.exe
  C:\Windows\System\wXnDGeQ.exe
  2⤵
  PID:8460
- C:\Windows\System\PiNkNfz.exe
  C:\Windows\System\PiNkNfz.exe
  2⤵
  PID:8480
- C:\Windows\System\sEutBPk.exe
  C:\Windows\System\sEutBPk.exe
  2⤵
  PID:8500
- C:\Windows\System\VOUWufM.exe
  C:\Windows\System\VOUWufM.exe
  2⤵
  PID:8520
- C:\Windows\System\KcBcZVg.exe
  C:\Windows\System\KcBcZVg.exe
  2⤵
  PID:8544
- C:\Windows\System\bWdDnxE.exe
  C:\Windows\System\bWdDnxE.exe
  2⤵
  PID:8564
- C:\Windows\System\CxhxkWP.exe
  C:\Windows\System\CxhxkWP.exe
  2⤵
  PID:8584
- C:\Windows\System\wQRCTen.exe
  C:\Windows\System\wQRCTen.exe
  2⤵
  PID:8604
- C:\Windows\System\ZSQKKyA.exe
  C:\Windows\System\ZSQKKyA.exe
  2⤵
  PID:8624
- C:\Windows\System\ZBOxuZg.exe
  C:\Windows\System\ZBOxuZg.exe
  2⤵
  PID:8648
- C:\Windows\System\HVWfNhL.exe
  C:\Windows\System\HVWfNhL.exe
  2⤵
  PID:8664
- C:\Windows\System\rtFWPev.exe
  C:\Windows\System\rtFWPev.exe
  2⤵
  PID:8688
- C:\Windows\System\HWafifZ.exe
  C:\Windows\System\HWafifZ.exe
  2⤵
  PID:8708
- C:\Windows\System\nCRndso.exe
  C:\Windows\System\nCRndso.exe
  2⤵
  PID:8728
- C:\Windows\System\IGWQgjV.exe
  C:\Windows\System\IGWQgjV.exe
  2⤵
  PID:8904
- C:\Windows\System\IIVLmCt.exe
  C:\Windows\System\IIVLmCt.exe
  2⤵
  PID:8944
- C:\Windows\System\WOUtZCH.exe
  C:\Windows\System\WOUtZCH.exe
  2⤵
  PID:8964
- C:\Windows\System\UPYlkNp.exe
  C:\Windows\System\UPYlkNp.exe
  2⤵
  PID:8984
- C:\Windows\System\pvrVZLZ.exe
  C:\Windows\System\pvrVZLZ.exe
  2⤵
  PID:9008
- C:\Windows\System\earjWsb.exe
  C:\Windows\System\earjWsb.exe
  2⤵
  PID:9032
- C:\Windows\System\DOAKnRb.exe
  C:\Windows\System\DOAKnRb.exe
  2⤵
  PID:9052
- C:\Windows\System\VgOJtkL.exe
  C:\Windows\System\VgOJtkL.exe
  2⤵
  PID:9076
- C:\Windows\System\lOUrCPL.exe
  C:\Windows\System\lOUrCPL.exe
  2⤵
  PID:9096
- C:\Windows\System\jPGYRBK.exe
  C:\Windows\System\jPGYRBK.exe
  2⤵
  PID:9116
- C:\Windows\System\mpRjsFN.exe
  C:\Windows\System\mpRjsFN.exe
  2⤵
  PID:9140
- C:\Windows\System\OTTsbqX.exe
  C:\Windows\System\OTTsbqX.exe
  2⤵
  PID:9160
- C:\Windows\System\qrzUwja.exe
  C:\Windows\System\qrzUwja.exe
  2⤵
  PID:9180
- C:\Windows\System\skmquCp.exe
  C:\Windows\System\skmquCp.exe
  2⤵
  PID:9204
- C:\Windows\System\WBTseRp.exe
  C:\Windows\System\WBTseRp.exe
  2⤵
  PID:6340
- C:\Windows\System\qvSmPUu.exe
  C:\Windows\System\qvSmPUu.exe
  2⤵
  PID:5728
- C:\Windows\System\xTLXudx.exe
  C:\Windows\System\xTLXudx.exe
  2⤵
  PID:7496
- C:\Windows\System\KTNPymQ.exe
  C:\Windows\System\KTNPymQ.exe
  2⤵
  PID:1900
- C:\Windows\System\cZlXSBv.exe
  C:\Windows\System\cZlXSBv.exe
  2⤵
  PID:6552
- C:\Windows\System\uckhLpj.exe
  C:\Windows\System\uckhLpj.exe
  2⤵
  PID:6192
- C:\Windows\System\ZeFbeHv.exe
  C:\Windows\System\ZeFbeHv.exe
  2⤵
  PID:7776
- C:\Windows\System\jqjmmnp.exe
  C:\Windows\System\jqjmmnp.exe
  2⤵
  PID:6408
- C:\Windows\System\AMKqyuP.exe
  C:\Windows\System\AMKqyuP.exe
  2⤵
  PID:6752
- C:\Windows\System\SSzXHtv.exe
  C:\Windows\System\SSzXHtv.exe
  2⤵
  PID:6808
- C:\Windows\System\inaVqTq.exe
  C:\Windows\System\inaVqTq.exe
  2⤵
  PID:7188
- C:\Windows\System\mOyriWC.exe
  C:\Windows\System\mOyriWC.exe
  2⤵
  PID:6884
- C:\Windows\System\hhbGfzq.exe
  C:\Windows\System\hhbGfzq.exe
  2⤵
  PID:6924
- C:\Windows\System\HLDNDVN.exe
  C:\Windows\System\HLDNDVN.exe
  2⤵
  PID:6972
- C:\Windows\System\nWHBkSX.exe
  C:\Windows\System\nWHBkSX.exe
  2⤵
  PID:7744
- C:\Windows\System\hCPgMLC.exe
  C:\Windows\System\hCPgMLC.exe
  2⤵
  PID:8052
- C:\Windows\System\YqEHiTD.exe
  C:\Windows\System\YqEHiTD.exe
  2⤵
  PID:5732
- C:\Windows\System\cGxyKGt.exe
  C:\Windows\System\cGxyKGt.exe
  2⤵
  PID:5892
- C:\Windows\System\arINowf.exe
  C:\Windows\System\arINowf.exe
  2⤵
  PID:6284
- C:\Windows\System\JGsSgyb.exe
  C:\Windows\System\JGsSgyb.exe
  2⤵
  PID:7340
- C:\Windows\System\NIZjiPF.exe
  C:\Windows\System\NIZjiPF.exe
  2⤵
  PID:6792
- C:\Windows\System\uYKPOwM.exe
  C:\Windows\System\uYKPOwM.exe
  2⤵
  PID:7400
- C:\Windows\System\FgESDmS.exe
  C:\Windows\System\FgESDmS.exe
  2⤵
  PID:8216
- C:\Windows\System\kCGxohl.exe
  C:\Windows\System\kCGxohl.exe
  2⤵
  PID:9220
- C:\Windows\System\ZlkXyaA.exe
  C:\Windows\System\ZlkXyaA.exe
  2⤵
  PID:9248
- C:\Windows\System\BGHrEDB.exe
  C:\Windows\System\BGHrEDB.exe
  2⤵
  PID:9268
- C:\Windows\System\ZOnTvsk.exe
  C:\Windows\System\ZOnTvsk.exe
  2⤵
  PID:9288
- C:\Windows\System\VCbzLVd.exe
  C:\Windows\System\VCbzLVd.exe
  2⤵
  PID:9312
- C:\Windows\System\ZLcQmum.exe
  C:\Windows\System\ZLcQmum.exe
  2⤵
  PID:9332
- C:\Windows\System\dOafYvm.exe
  C:\Windows\System\dOafYvm.exe
  2⤵
  PID:9360
- C:\Windows\System\tENtNwg.exe
  C:\Windows\System\tENtNwg.exe
  2⤵
  PID:9380
- C:\Windows\System\ARDzfAy.exe
  C:\Windows\System\ARDzfAy.exe
  2⤵
  PID:9404
- C:\Windows\System\KEuUfqV.exe
  C:\Windows\System\KEuUfqV.exe
  2⤵
  PID:9428
- C:\Windows\System\UcHyccg.exe
  C:\Windows\System\UcHyccg.exe
  2⤵
  PID:9448
- C:\Windows\System\VfvUrme.exe
  C:\Windows\System\VfvUrme.exe
  2⤵
  PID:9468
- C:\Windows\System\MBoPTju.exe
  C:\Windows\System\MBoPTju.exe
  2⤵
  PID:9492
- C:\Windows\System\bRCQFpt.exe
  C:\Windows\System\bRCQFpt.exe
  2⤵
  PID:9516
- C:\Windows\System\ELnfbXw.exe
  C:\Windows\System\ELnfbXw.exe
  2⤵
  PID:9536
- C:\Windows\System\EcnJQRN.exe
  C:\Windows\System\EcnJQRN.exe
  2⤵
  PID:9556
- C:\Windows\System\iswfPbV.exe
  C:\Windows\System\iswfPbV.exe
  2⤵
  PID:9580
- C:\Windows\System\rjzLBlI.exe
  C:\Windows\System\rjzLBlI.exe
  2⤵
  PID:9604
- C:\Windows\System\FdDmYVx.exe
  C:\Windows\System\FdDmYVx.exe
  2⤵
  PID:9624
- C:\Windows\System\Ktlcwmc.exe
  C:\Windows\System\Ktlcwmc.exe
  2⤵
  PID:9648
- C:\Windows\System\yjPFopa.exe
  C:\Windows\System\yjPFopa.exe
  2⤵
  PID:9664
- C:\Windows\System\YrmeYFQ.exe
  C:\Windows\System\YrmeYFQ.exe
  2⤵
  PID:9688
- C:\Windows\System\SGKmmIY.exe
  C:\Windows\System\SGKmmIY.exe
  2⤵
  PID:9708
- C:\Windows\System\IdSBoHK.exe
  C:\Windows\System\IdSBoHK.exe
  2⤵
  PID:9724
- C:\Windows\System\chscTUk.exe
  C:\Windows\System\chscTUk.exe
  2⤵
  PID:9740
- C:\Windows\System\ARmNiwz.exe
  C:\Windows\System\ARmNiwz.exe
  2⤵
  PID:9772
- C:\Windows\System\nqWqGoQ.exe
  C:\Windows\System\nqWqGoQ.exe
  2⤵
  PID:9796
- C:\Windows\System\uzjiHbC.exe
  C:\Windows\System\uzjiHbC.exe
  2⤵
  PID:9812
- C:\Windows\System\ylsaGty.exe
  C:\Windows\System\ylsaGty.exe
  2⤵
  PID:9832
- C:\Windows\System\gecRHWJ.exe
  C:\Windows\System\gecRHWJ.exe
  2⤵
  PID:9864
- C:\Windows\System\jEAZUAV.exe
  C:\Windows\System\jEAZUAV.exe
  2⤵
  PID:9884
- C:\Windows\System\VpKYuxo.exe
  C:\Windows\System\VpKYuxo.exe
  2⤵
  PID:9908
- C:\Windows\System\tJKuFHY.exe
  C:\Windows\System\tJKuFHY.exe
  2⤵
  PID:9932
- C:\Windows\System\uVZVCLf.exe
  C:\Windows\System\uVZVCLf.exe
  2⤵
  PID:9948
- C:\Windows\System\bktxKkl.exe
  C:\Windows\System\bktxKkl.exe
  2⤵
  PID:9972
- C:\Windows\System\wMJFCst.exe
  C:\Windows\System\wMJFCst.exe
  2⤵
  PID:9996
- C:\Windows\System\MPttnhr.exe
  C:\Windows\System\MPttnhr.exe
  2⤵
  PID:10020
- C:\Windows\System\lpBDiyH.exe
  C:\Windows\System\lpBDiyH.exe
  2⤵
  PID:10048
- C:\Windows\System\PgFtwyN.exe
  C:\Windows\System\PgFtwyN.exe
  2⤵
  PID:10068
- C:\Windows\System\TADTgMi.exe
  C:\Windows\System\TADTgMi.exe
  2⤵
  PID:10088
- C:\Windows\System\ZeWbBFu.exe
  C:\Windows\System\ZeWbBFu.exe
  2⤵
  PID:10112
- C:\Windows\System\HNPrOWM.exe
  C:\Windows\System\HNPrOWM.exe
  2⤵
  PID:10132
- C:\Windows\System\cvWuESu.exe
  C:\Windows\System\cvWuESu.exe
  2⤵
  PID:10152
- C:\Windows\System\amiTJhi.exe
  C:\Windows\System\amiTJhi.exe
  2⤵
  PID:10176
- C:\Windows\System\ByZVzGE.exe
  C:\Windows\System\ByZVzGE.exe
  2⤵
  PID:10192
- C:\Windows\System\EmjXiwv.exe
  C:\Windows\System\EmjXiwv.exe
  2⤵
  PID:10216
- C:\Windows\System\cDcIjuk.exe
  C:\Windows\System\cDcIjuk.exe
  2⤵
  PID:3700
- C:\Windows\System\sUcnFsm.exe
  C:\Windows\System\sUcnFsm.exe
  2⤵
  PID:6136
- C:\Windows\System\WGQEBNP.exe
  C:\Windows\System\WGQEBNP.exe
  2⤵
  PID:7616
- C:\Windows\System\zFmsqEV.exe
  C:\Windows\System\zFmsqEV.exe
  2⤵
  PID:8684
- C:\Windows\System\ZZpLuSh.exe
  C:\Windows\System\ZZpLuSh.exe
  2⤵
  PID:8744
- C:\Windows\System\yVpEXPH.exe
  C:\Windows\System\yVpEXPH.exe
  2⤵
  PID:6244
- C:\Windows\System\FdYnCTi.exe
  C:\Windows\System\FdYnCTi.exe
  2⤵
  PID:7996
- C:\Windows\System\nTSwUtk.exe
  C:\Windows\System\nTSwUtk.exe
  2⤵
  PID:7952
- C:\Windows\System\WdEXnRm.exe
  C:\Windows\System\WdEXnRm.exe
  2⤵
  PID:8828
- C:\Windows\System\etuvhlz.exe
  C:\Windows\System\etuvhlz.exe
  2⤵
  PID:8104
- C:\Windows\System\aFtqQZx.exe
  C:\Windows\System\aFtqQZx.exe
  2⤵
  PID:5632
- C:\Windows\System\jxHywVK.exe
  C:\Windows\System\jxHywVK.exe
  2⤵
  PID:8880
- C:\Windows\System\josTYNn.exe
  C:\Windows\System\josTYNn.exe
  2⤵
  PID:8936
- C:\Windows\System\mWetXOK.exe
  C:\Windows\System\mWetXOK.exe
  2⤵
  PID:8976
- C:\Windows\System\bhFAJQC.exe
  C:\Windows\System\bhFAJQC.exe
  2⤵
  PID:9024
- C:\Windows\System\QggbdHT.exe
  C:\Windows\System\QggbdHT.exe
  2⤵
  PID:9132
- C:\Windows\System\YconYbk.exe
  C:\Windows\System\YconYbk.exe
  2⤵
  PID:10244
- C:\Windows\System\BIIsgAg.exe
  C:\Windows\System\BIIsgAg.exe
  2⤵
  PID:10268
- C:\Windows\System\FveViur.exe
  C:\Windows\System\FveViur.exe
  2⤵
  PID:10288
- C:\Windows\System\fdLxKbI.exe
  C:\Windows\System\fdLxKbI.exe
  2⤵
  PID:10308
- C:\Windows\System\vuWUAsw.exe
  C:\Windows\System\vuWUAsw.exe
  2⤵
  PID:10332
- C:\Windows\System\dzaFgpW.exe
  C:\Windows\System\dzaFgpW.exe
  2⤵
  PID:10368
- C:\Windows\System\kupMrlL.exe
  C:\Windows\System\kupMrlL.exe
  2⤵
  PID:10384
- C:\Windows\System\bUJucZa.exe
  C:\Windows\System\bUJucZa.exe
  2⤵
  PID:10404
- C:\Windows\System\sAklded.exe
  C:\Windows\System\sAklded.exe
  2⤵
  PID:10428
- C:\Windows\System\rIlJSLl.exe
  C:\Windows\System\rIlJSLl.exe
  2⤵
  PID:10452
- C:\Windows\System\lbekcQv.exe
  C:\Windows\System\lbekcQv.exe
  2⤵
  PID:10468
- C:\Windows\System\kUGMRTR.exe
  C:\Windows\System\kUGMRTR.exe
  2⤵
  PID:10488
- C:\Windows\System\qmVQhhv.exe
  C:\Windows\System\qmVQhhv.exe
  2⤵
  PID:10508
- C:\Windows\System\PTwSNwC.exe
  C:\Windows\System\PTwSNwC.exe
  2⤵
  PID:10532
- C:\Windows\System\DbWTRWI.exe
  C:\Windows\System\DbWTRWI.exe
  2⤵
  PID:10548
- C:\Windows\System\zxUsPAC.exe
  C:\Windows\System\zxUsPAC.exe
  2⤵
  PID:10572
- C:\Windows\System\yBmLpoB.exe
  C:\Windows\System\yBmLpoB.exe
  2⤵
  PID:10596
- C:\Windows\System\GAIHAMT.exe
  C:\Windows\System\GAIHAMT.exe
  2⤵
  PID:10620
- C:\Windows\System\nwiHWus.exe
  C:\Windows\System\nwiHWus.exe
  2⤵
  PID:10644
- C:\Windows\System\GOYkiGa.exe
  C:\Windows\System\GOYkiGa.exe
  2⤵
  PID:10664
- C:\Windows\System\aEYSqwL.exe
  C:\Windows\System\aEYSqwL.exe
  2⤵
  PID:10680
- C:\Windows\System\HCTXrbk.exe
  C:\Windows\System\HCTXrbk.exe
  2⤵
  PID:10696
- C:\Windows\System\nOcBabz.exe
  C:\Windows\System\nOcBabz.exe
  2⤵
  PID:10712
- C:\Windows\System\gujFcxA.exe
  C:\Windows\System\gujFcxA.exe
  2⤵
  PID:10728
- C:\Windows\System\cFoOaeL.exe
  C:\Windows\System\cFoOaeL.exe
  2⤵
  PID:10744
- C:\Windows\System\wYwcQTn.exe
  C:\Windows\System\wYwcQTn.exe
  2⤵
  PID:10760
- C:\Windows\System\fatChGv.exe
  C:\Windows\System\fatChGv.exe
  2⤵
  PID:10780
- C:\Windows\System\cdQsCsy.exe
  C:\Windows\System\cdQsCsy.exe
  2⤵
  PID:10808
- C:\Windows\System\aPyqJxp.exe
  C:\Windows\System\aPyqJxp.exe
  2⤵
  PID:10824
- C:\Windows\System\BnJTKbv.exe
  C:\Windows\System\BnJTKbv.exe
  2⤵
  PID:10852
- C:\Windows\System\LKDDbvU.exe
  C:\Windows\System\LKDDbvU.exe
  2⤵
  PID:10868
- C:\Windows\System\TZNkMaP.exe
  C:\Windows\System\TZNkMaP.exe
  2⤵
  PID:10892
- C:\Windows\System\GnilbQF.exe
  C:\Windows\System\GnilbQF.exe
  2⤵
  PID:10912
- C:\Windows\System\BQshLWN.exe
  C:\Windows\System\BQshLWN.exe
  2⤵
  PID:10932
- C:\Windows\System\lrXvTXM.exe
  C:\Windows\System\lrXvTXM.exe
  2⤵
  PID:10956
- C:\Windows\System\kfWmOLh.exe
  C:\Windows\System\kfWmOLh.exe
  2⤵
  PID:10976
- C:\Windows\System\TsLHAjA.exe
  C:\Windows\System\TsLHAjA.exe
  2⤵
  PID:11000
- C:\Windows\System\UMnCIeO.exe
  C:\Windows\System\UMnCIeO.exe
  2⤵
  PID:11020
- C:\Windows\System\AzLuByd.exe
  C:\Windows\System\AzLuByd.exe
  2⤵
  PID:11040
- C:\Windows\System\eUXWXjQ.exe
  C:\Windows\System\eUXWXjQ.exe
  2⤵
  PID:11060
- C:\Windows\System\JSMgAau.exe
  C:\Windows\System\JSMgAau.exe
  2⤵
  PID:11084
- C:\Windows\System\yhawMQV.exe
  C:\Windows\System\yhawMQV.exe
  2⤵
  PID:11108
- C:\Windows\System\STLEngi.exe
  C:\Windows\System\STLEngi.exe
  2⤵
  PID:11132
- C:\Windows\System\miXLqlJ.exe
  C:\Windows\System\miXLqlJ.exe
  2⤵
  PID:11164
- C:\Windows\System\eAOyRGw.exe
  C:\Windows\System\eAOyRGw.exe
  2⤵
  PID:11184
- C:\Windows\System\OYQRalk.exe
  C:\Windows\System\OYQRalk.exe
  2⤵
  PID:11204
- C:\Windows\System\DKekVkV.exe
  C:\Windows\System\DKekVkV.exe
  2⤵
  PID:11228
- C:\Windows\System\IlvfBnU.exe
  C:\Windows\System\IlvfBnU.exe
  2⤵
  PID:11252
- C:\Windows\System\uxOvVeR.exe
  C:\Windows\System\uxOvVeR.exe
  2⤵
  PID:7080
- C:\Windows\System\WvLHBLX.exe
  C:\Windows\System\WvLHBLX.exe
  2⤵
  PID:5004
- C:\Windows\System\SnSKEOB.exe
  C:\Windows\System\SnSKEOB.exe
  2⤵
  PID:7376
- C:\Windows\System\uSlrTRa.exe
  C:\Windows\System\uSlrTRa.exe
  2⤵
  PID:7200
- C:\Windows\System\fQOjmGg.exe
  C:\Windows\System\fQOjmGg.exe
  2⤵
  PID:6412
- C:\Windows\System\XyiGfkf.exe
  C:\Windows\System\XyiGfkf.exe
  2⤵
  PID:4932
- C:\Windows\System\rsBYimA.exe
  C:\Windows\System\rsBYimA.exe
  2⤵
  PID:6920
- C:\Windows\System\lTDBPyR.exe
  C:\Windows\System\lTDBPyR.exe
  2⤵
  PID:6968
- C:\Windows\System\iRSpyOT.exe
  C:\Windows\System\iRSpyOT.exe
  2⤵
  PID:7908
- C:\Windows\System\vldXLup.exe
  C:\Windows\System\vldXLup.exe
  2⤵
  PID:7216
- C:\Windows\System\lShzQYt.exe
  C:\Windows\System\lShzQYt.exe
  2⤵
  PID:9324
- C:\Windows\System\gFGKWBD.exe
  C:\Windows\System\gFGKWBD.exe
  2⤵
  PID:7560
- C:\Windows\System\FrWeOuD.exe
  C:\Windows\System\FrWeOuD.exe
  2⤵
  PID:9348
- C:\Windows\System\fzNTdtR.exe
  C:\Windows\System\fzNTdtR.exe
  2⤵
  PID:9356
- C:\Windows\System\flOzyts.exe
  C:\Windows\System\flOzyts.exe
  2⤵
  PID:9420
- C:\Windows\System\vBspIbY.exe
  C:\Windows\System\vBspIbY.exe
  2⤵
  PID:9500
- C:\Windows\System\kidHAXH.exe
  C:\Windows\System\kidHAXH.exe
  2⤵
  PID:8656
- C:\Windows\System\YYJLOrI.exe
  C:\Windows\System\YYJLOrI.exe
  2⤵
  PID:8724
- C:\Windows\System\TCUMzAp.exe
  C:\Windows\System\TCUMzAp.exe
  2⤵
  PID:7856
- C:\Windows\System\YqWMyOA.exe
  C:\Windows\System\YqWMyOA.exe
  2⤵
  PID:9760
- C:\Windows\System\RKYaMAh.exe
  C:\Windows\System\RKYaMAh.exe
  2⤵
  PID:11280
- C:\Windows\System\JCDWfiz.exe
  C:\Windows\System\JCDWfiz.exe
  2⤵
  PID:11300
- C:\Windows\System\pqnOgTq.exe
  C:\Windows\System\pqnOgTq.exe
  2⤵
  PID:11320
- C:\Windows\System\lgbaAxS.exe
  C:\Windows\System\lgbaAxS.exe
  2⤵
  PID:11344
- C:\Windows\System\lXQyEMg.exe
  C:\Windows\System\lXQyEMg.exe
  2⤵
  PID:11368
- C:\Windows\System\UtkugcI.exe
  C:\Windows\System\UtkugcI.exe
  2⤵
  PID:11392
- C:\Windows\System\LmunzTj.exe
  C:\Windows\System\LmunzTj.exe
  2⤵
  PID:11424
- C:\Windows\System\lpVVwvD.exe
  C:\Windows\System\lpVVwvD.exe
  2⤵
  PID:11444
- C:\Windows\System\bpXnbtr.exe
  C:\Windows\System\bpXnbtr.exe
  2⤵
  PID:11464
- C:\Windows\System\mpeqlCx.exe
  C:\Windows\System\mpeqlCx.exe
  2⤵
  PID:11480
- C:\Windows\System\gYhAkbY.exe
  C:\Windows\System\gYhAkbY.exe
  2⤵
  PID:11500
- C:\Windows\System\fbqvzra.exe
  C:\Windows\System\fbqvzra.exe
  2⤵
  PID:11516
- C:\Windows\System\xqWdNZZ.exe
  C:\Windows\System\xqWdNZZ.exe
  2⤵
  PID:11532
- C:\Windows\System\zEEuRKb.exe
  C:\Windows\System\zEEuRKb.exe
  2⤵
  PID:11548
- C:\Windows\System\BTtqTGA.exe
  C:\Windows\System\BTtqTGA.exe
  2⤵
  PID:11564
- C:\Windows\System\LYURTRV.exe
  C:\Windows\System\LYURTRV.exe
  2⤵
  PID:11584
- C:\Windows\System\FHFLkpn.exe
  C:\Windows\System\FHFLkpn.exe
  2⤵
  PID:11612
- C:\Windows\System\gBKEQnU.exe
  C:\Windows\System\gBKEQnU.exe
  2⤵
  PID:11632
- C:\Windows\System\uVZytvW.exe
  C:\Windows\System\uVZytvW.exe
  2⤵
  PID:11652
- C:\Windows\System\lvMTrwE.exe
  C:\Windows\System\lvMTrwE.exe
  2⤵
  PID:11672
- C:\Windows\System\mqLAMdu.exe
  C:\Windows\System\mqLAMdu.exe
  2⤵
  PID:11692
- C:\Windows\System\Pwfpgmd.exe
  C:\Windows\System\Pwfpgmd.exe
  2⤵
  PID:11708
- C:\Windows\System\lakKZpn.exe
  C:\Windows\System\lakKZpn.exe
  2⤵
  PID:11724
- C:\Windows\System\flnkWhb.exe
  C:\Windows\System\flnkWhb.exe
  2⤵
  PID:11740
- C:\Windows\System\bUOXUpr.exe
  C:\Windows\System\bUOXUpr.exe
  2⤵
  PID:11764
- C:\Windows\System\QhBrvPw.exe
  C:\Windows\System\QhBrvPw.exe
  2⤵
  PID:11784
- C:\Windows\System\rsNYVyE.exe
  C:\Windows\System\rsNYVyE.exe
  2⤵
  PID:11816
- C:\Windows\System\busiQqU.exe
  C:\Windows\System\busiQqU.exe
  2⤵
  PID:11836
- C:\Windows\System\SgpkBMw.exe
  C:\Windows\System\SgpkBMw.exe
  2⤵
  PID:11856
- C:\Windows\System\OuWWUIj.exe
  C:\Windows\System\OuWWUIj.exe
  2⤵
  PID:11880
- C:\Windows\System\JHWovuP.exe
  C:\Windows\System\JHWovuP.exe
  2⤵
  PID:11900
- C:\Windows\System\gCHMaRt.exe
  C:\Windows\System\gCHMaRt.exe
  2⤵
  PID:11920
- C:\Windows\System\aoBtDzZ.exe
  C:\Windows\System\aoBtDzZ.exe
  2⤵
  PID:11940
- C:\Windows\System\oOantvj.exe
  C:\Windows\System\oOantvj.exe
  2⤵
  PID:11964
- C:\Windows\System\DrxdIJl.exe
  C:\Windows\System\DrxdIJl.exe
  2⤵
  PID:11992
- C:\Windows\System\KFeAWVS.exe
  C:\Windows\System\KFeAWVS.exe
  2⤵
  PID:12012
- C:\Windows\System\IXsLTfn.exe
  C:\Windows\System\IXsLTfn.exe
  2⤵
  PID:12036
- C:\Windows\System\xpaZAyQ.exe
  C:\Windows\System\xpaZAyQ.exe
  2⤵
  PID:12056
- C:\Windows\System\UpWjzEH.exe
  C:\Windows\System\UpWjzEH.exe
  2⤵
  PID:12076
- C:\Windows\System\NSyRTOo.exe
  C:\Windows\System\NSyRTOo.exe
  2⤵
  PID:12092
- C:\Windows\System\OBOUXtr.exe
  C:\Windows\System\OBOUXtr.exe
  2⤵
  PID:12108
- C:\Windows\System\QPnzaSA.exe
  C:\Windows\System\QPnzaSA.exe
  2⤵
  PID:12132
- C:\Windows\System\DpSAokT.exe
  C:\Windows\System\DpSAokT.exe
  2⤵
  PID:12152
- C:\Windows\System\FqlZziI.exe
  C:\Windows\System\FqlZziI.exe
  2⤵
  PID:12176
- C:\Windows\System\hQKhXvN.exe
  C:\Windows\System\hQKhXvN.exe
  2⤵
  PID:12196
- C:\Windows\System\qRtJCwK.exe
  C:\Windows\System\qRtJCwK.exe
  2⤵
  PID:12216
- C:\Windows\System\SfOigcG.exe
  C:\Windows\System\SfOigcG.exe
  2⤵
  PID:12240
- C:\Windows\System\eXvHJPE.exe
  C:\Windows\System\eXvHJPE.exe
  2⤵
  PID:12264
- C:\Windows\System\nTjVvsk.exe
  C:\Windows\System\nTjVvsk.exe
  2⤵
  PID:9896
- C:\Windows\System\tMwXpcH.exe
  C:\Windows\System\tMwXpcH.exe
  2⤵
  PID:10012
- C:\Windows\System\rrulXPE.exe
  C:\Windows\System\rrulXPE.exe
  2⤵
  PID:10084
- C:\Windows\System\UNmolLf.exe
  C:\Windows\System\UNmolLf.exe
  2⤵
  PID:10212
- C:\Windows\System\PfWZvWk.exe
  C:\Windows\System\PfWZvWk.exe
  2⤵
  PID:7540
- C:\Windows\System\vFDIOuA.exe
  C:\Windows\System\vFDIOuA.exe
  2⤵
  PID:8620
- C:\Windows\System\URCXuqg.exe
  C:\Windows\System\URCXuqg.exe
  2⤵
  PID:8940
- C:\Windows\System\klcLxIV.exe
  C:\Windows\System\klcLxIV.exe
  2⤵
  PID:7852
- C:\Windows\System\pejmtVh.exe
  C:\Windows\System\pejmtVh.exe
  2⤵
  PID:8992
- C:\Windows\System\oeFFlDc.exe
  C:\Windows\System\oeFFlDc.exe
  2⤵
  PID:4276
- C:\Windows\System\WcuLIji.exe
  C:\Windows\System\WcuLIji.exe
  2⤵
  PID:3428
- C:\Windows\System\nJWeNcR.exe
  C:\Windows\System\nJWeNcR.exe
  2⤵
  PID:9148
- C:\Windows\System\sGrtfry.exe
  C:\Windows\System\sGrtfry.exe
  2⤵
  PID:10264
- C:\Windows\System\YRhGUYV.exe
  C:\Windows\System\YRhGUYV.exe
  2⤵
  PID:7104
- C:\Windows\System\CrkHzuq.exe
  C:\Windows\System\CrkHzuq.exe
  2⤵
  PID:7580
- C:\Windows\System\jrhMDfT.exe
  C:\Windows\System\jrhMDfT.exe
  2⤵
  PID:10364
- C:\Windows\System\ZyCllpj.exe
  C:\Windows\System\ZyCllpj.exe
  2⤵
  PID:6344
- C:\Windows\System\WTtuxgg.exe
  C:\Windows\System\WTtuxgg.exe
  2⤵
  PID:8040
- C:\Windows\System\xqVBZcf.exe
  C:\Windows\System\xqVBZcf.exe
  2⤵
  PID:10440
- C:\Windows\System\pSDKKkJ.exe
  C:\Windows\System\pSDKKkJ.exe
  2⤵
  PID:10540
- C:\Windows\System\uNlKaLj.exe
  C:\Windows\System\uNlKaLj.exe
  2⤵
  PID:10592
- C:\Windows\System\IqbdbXt.exe
  C:\Windows\System\IqbdbXt.exe
  2⤵
  PID:10652
- C:\Windows\System\NIkehiX.exe
  C:\Windows\System\NIkehiX.exe
  2⤵
  PID:7924
- C:\Windows\System\xGJfzVf.exe
  C:\Windows\System\xGJfzVf.exe
  2⤵
  PID:10704
- C:\Windows\System\SYEHxeR.exe
  C:\Windows\System\SYEHxeR.exe
  2⤵
  PID:6196
- C:\Windows\System\SSSikkT.exe
  C:\Windows\System\SSSikkT.exe
  2⤵
  PID:6492
- C:\Windows\System\UpzLnWt.exe
  C:\Windows\System\UpzLnWt.exe
  2⤵
  PID:6224
- C:\Windows\System\UHDxpam.exe
  C:\Windows\System\UHDxpam.exe
  2⤵
  PID:8364
- C:\Windows\System\scdyjyB.exe
  C:\Windows\System\scdyjyB.exe
  2⤵
  PID:10840
- C:\Windows\System\jZomyel.exe
  C:\Windows\System\jZomyel.exe
  2⤵
  PID:10900
- C:\Windows\System\czSgPqD.exe
  C:\Windows\System\czSgPqD.exe
  2⤵
  PID:8432
- C:\Windows\System\DEVbFvS.exe
  C:\Windows\System\DEVbFvS.exe
  2⤵
  PID:9300
- C:\Windows\System\uOiGHQM.exe
  C:\Windows\System\uOiGHQM.exe
  2⤵
  PID:8472
- C:\Windows\System\OfHlbIk.exe
  C:\Windows\System\OfHlbIk.exe
  2⤵
  PID:12300
- C:\Windows\System\YJuZlRm.exe
  C:\Windows\System\YJuZlRm.exe
  2⤵
  PID:12324
- C:\Windows\System\iGIkIIP.exe
  C:\Windows\System\iGIkIIP.exe
  2⤵
  PID:12348
- C:\Windows\System\JxsaIHd.exe
  C:\Windows\System\JxsaIHd.exe
  2⤵
  PID:12364
- C:\Windows\System\EopmpiV.exe
  C:\Windows\System\EopmpiV.exe
  2⤵
  PID:12384
- C:\Windows\System\hwsqVbt.exe
  C:\Windows\System\hwsqVbt.exe
  2⤵
  PID:12408
- C:\Windows\System\wRZlUBe.exe
  C:\Windows\System\wRZlUBe.exe
  2⤵
  PID:12424
- C:\Windows\System\zJBarbE.exe
  C:\Windows\System\zJBarbE.exe
  2⤵
  PID:12444
- C:\Windows\System\UVOCfAt.exe
  C:\Windows\System\UVOCfAt.exe
  2⤵
  PID:12460
- C:\Windows\System\JRnTvUS.exe
  C:\Windows\System\JRnTvUS.exe
  2⤵
  PID:12480
- C:\Windows\System\ndNHfrU.exe
  C:\Windows\System\ndNHfrU.exe
  2⤵
  PID:12500
- C:\Windows\System\yPWGxAX.exe
  C:\Windows\System\yPWGxAX.exe
  2⤵
  PID:12524
- C:\Windows\System\ihMUboT.exe
  C:\Windows\System\ihMUboT.exe
  2⤵
  PID:12540
- C:\Windows\System\HtDOMNy.exe
  C:\Windows\System\HtDOMNy.exe
  2⤵
  PID:9828
- C:\Windows\System\TwzxuWE.exe
  C:\Windows\System\TwzxuWE.exe
  2⤵
  PID:11272
- C:\Windows\System\WSgaQlQ.exe
  C:\Windows\System\WSgaQlQ.exe
  2⤵
  PID:11316
- C:\Windows\System\xLvcgvr.exe
  C:\Windows\System\xLvcgvr.exe
  2⤵
  PID:11356
- C:\Windows\System\hMpOsmN.exe
  C:\Windows\System\hMpOsmN.exe
  2⤵
  PID:9228
- C:\Windows\System\IbexBdo.exe
  C:\Windows\System\IbexBdo.exe
  2⤵
  PID:10420
- C:\Windows\System\ZHJvdVy.exe
  C:\Windows\System\ZHJvdVy.exe
  2⤵
  PID:10640
- C:\Windows\System\jEAldxe.exe
  C:\Windows\System\jEAldxe.exe
  2⤵
  PID:8264
- C:\Windows\System\ORjJgKv.exe
  C:\Windows\System\ORjJgKv.exe
  2⤵
  PID:9264
- C:\Windows\System\ViwwasR.exe
  C:\Windows\System\ViwwasR.exe
  2⤵
  PID:12908
- C:\Windows\System\JgUKoWO.exe
  C:\Windows\System\JgUKoWO.exe
  2⤵
  PID:12916
- C:\Windows\System\UIlWTUc.exe
  C:\Windows\System\UIlWTUc.exe
  2⤵
  PID:13104
- C:\Windows\System\KKXtcVo.exe
  C:\Windows\System\KKXtcVo.exe
  2⤵
  PID:13256
- C:\Windows\System\GuMrkcH.exe
  C:\Windows\System\GuMrkcH.exe
  2⤵
  PID:12980
- C:\Windows\System\grdsYZe.exe
  C:\Windows\System\grdsYZe.exe
  2⤵
  PID:9804
- C:\Windows\System\SKuWzeb.exe
  C:\Windows\System\SKuWzeb.exe
  2⤵
  PID:13132
- C:\Windows\System\ePAEGYh.exe
  C:\Windows\System\ePAEGYh.exe
  2⤵
  PID:13192
- C:\Windows\System\moKQGbi.exe
  C:\Windows\System\moKQGbi.exe
  2⤵
  PID:13280
- C:\Windows\System\qgNMcrt.exe
  C:\Windows\System\qgNMcrt.exe
  2⤵
  PID:9916
- C:\Windows\System\wIsMlSp.exe
  C:\Windows\System\wIsMlSp.exe
  2⤵
  PID:11364
- C:\Windows\System\YFnHwAZ.exe
  C:\Windows\System\YFnHwAZ.exe
  2⤵
  PID:11688
- C:\Windows\System\eERMDCN.exe
  C:\Windows\System\eERMDCN.exe
  2⤵
  PID:11780
- C:\Windows\System\fRuRAGn.exe
  C:\Windows\System\fRuRAGn.exe
  2⤵
  PID:11812
- C:\Windows\System\PAFLbcR.exe
  C:\Windows\System\PAFLbcR.exe
  2⤵
  PID:10304
- C:\Windows\System\pIJYmUw.exe
  C:\Windows\System\pIJYmUw.exe
  2⤵
  PID:9824
- C:\Windows\System\gZKITLr.exe
  C:\Windows\System\gZKITLr.exe
  2⤵
  PID:12420
- C:\Windows\System\CLfHYGq.exe
  C:\Windows\System\CLfHYGq.exe
  2⤵
  PID:12004
- C:\Windows\System\vIScrNc.exe
  C:\Windows\System\vIScrNc.exe
  2⤵
  PID:10208
- C:\Windows\System\KfVwCig.exe
  C:\Windows\System\KfVwCig.exe
  2⤵
  PID:10832
- C:\Windows\System\YKDfiXh.exe
  C:\Windows\System\YKDfiXh.exe
  2⤵
  PID:12696
- C:\Windows\System\iACrGsA.exe
  C:\Windows\System\iACrGsA.exe
  2⤵
  PID:9640
- C:\Windows\System\lAlMVlC.exe
  C:\Windows\System\lAlMVlC.exe
  2⤵
  PID:8060
- C:\Windows\System\dkySdhW.exe
  C:\Windows\System\dkySdhW.exe
  2⤵
  PID:11844
- C:\Windows\System\jYfftVZ.exe
  C:\Windows\System\jYfftVZ.exe
  2⤵
  PID:4216
- C:\Windows\System\buCMEpq.exe
  C:\Windows\System\buCMEpq.exe
  2⤵
  PID:10476
- C:\Windows\System\GyWvNdV.exe
  C:\Windows\System\GyWvNdV.exe
  2⤵
  PID:11948
- C:\Windows\System\QSyoFto.exe
  C:\Windows\System\QSyoFto.exe
  2⤵
  PID:13100
- C:\Windows\System\sRrVMgO.exe
  C:\Windows\System\sRrVMgO.exe
  2⤵
  PID:10164
- C:\Windows\System\bTsiuoF.exe
  C:\Windows\System\bTsiuoF.exe
  2⤵
  PID:8540
- C:\Windows\System\QltbvOz.exe
  C:\Windows\System\QltbvOz.exe
  2⤵
  PID:12144
- C:\Windows\System\nSnJQsZ.exe
  C:\Windows\System\nSnJQsZ.exe
  2⤵
  PID:6464
- C:\Windows\System\dgfzhEl.exe
  C:\Windows\System\dgfzhEl.exe
  2⤵
  PID:10504
- C:\Windows\System\pxqrIzb.exe
  C:\Windows\System\pxqrIzb.exe
  2⤵
  PID:12552
- C:\Windows\System\QSvxWoT.exe
  C:\Windows\System\QSvxWoT.exe
  2⤵
  PID:12812
- C:\Windows\System\nbZAeLD.exe
  C:\Windows\System\nbZAeLD.exe
  2⤵
  PID:12960
- C:\Windows\System\XjPwwhM.exe
  C:\Windows\System\XjPwwhM.exe
  2⤵
  PID:12672
- C:\Windows\System\nIHNnZI.exe
  C:\Windows\System\nIHNnZI.exe
  2⤵
  PID:11052
- C:\Windows\System\wjKAFEg.exe
  C:\Windows\System\wjKAFEg.exe
  2⤵
  PID:12360
- C:\Windows\System\MPUOVCD.exe
  C:\Windows\System\MPUOVCD.exe
  2⤵
  PID:6600
- C:\Windows\System\yXrFfkj.exe
  C:\Windows\System\yXrFfkj.exe
  2⤵
  PID:11124
- C:\Windows\System\rWPsNsz.exe
  C:\Windows\System\rWPsNsz.exe
  2⤵
  PID:9780
- C:\Windows\System\ueLOPso.exe
  C:\Windows\System\ueLOPso.exe
  2⤵
  PID:11512
- C:\Windows\System\HJUBRvO.exe
  C:\Windows\System\HJUBRvO.exe
  2⤵
  PID:7356
- C:\Windows\System\tdVtYMY.exe
  C:\Windows\System\tdVtYMY.exe
  2⤵
  PID:13276
- C:\Windows\System\RqKPbVN.exe
  C:\Windows\System\RqKPbVN.exe
  2⤵
  PID:5608
- C:\Windows\System\OpsopmT.exe
  C:\Windows\System\OpsopmT.exe
  2⤵
  PID:9592
- C:\Windows\System\hVmMQvy.exe
  C:\Windows\System\hVmMQvy.exe
  2⤵
  PID:12084
- C:\Windows\System\YbrgHTH.exe
  C:\Windows\System\YbrgHTH.exe
  2⤵
  PID:11296
- C:\Windows\System\zVkxXTc.exe
  C:\Windows\System\zVkxXTc.exe
  2⤵
  PID:12476
- C:\Windows\System\kzZZZTy.exe
  C:\Windows\System\kzZZZTy.exe
  2⤵
  PID:3944
- C:\Windows\System\OgQWgJX.exe
  C:\Windows\System\OgQWgJX.exe
  2⤵
  PID:10612
- C:\Windows\System\uwwnfWV.exe
  C:\Windows\System\uwwnfWV.exe
  2⤵
  PID:11080
- C:\Windows\System\FBbCVvh.exe
  C:\Windows\System\FBbCVvh.exe
  2⤵
  PID:12292
- C:\Windows\System\MWKRoWe.exe
  C:\Windows\System\MWKRoWe.exe
  2⤵
  PID:10344
- C:\Windows\System\gWFdcwR.exe
  C:\Windows\System\gWFdcwR.exe
  2⤵
  PID:5536
- C:\Windows\System\mymbwfK.exe
  C:\Windows\System\mymbwfK.exe
  2⤵
  PID:11680
- C:\Windows\System\WZzqOeM.exe
  C:\Windows\System\WZzqOeM.exe
  2⤵
  PID:13036
- C:\Windows\System\FqbBVmy.exe
  C:\Windows\System\FqbBVmy.exe
  2⤵
  PID:12192
- C:\Windows\System\wBFFiNw.exe
  C:\Windows\System\wBFFiNw.exe
  2⤵
  PID:12236
- C:\Windows\System\DsKCiTP.exe
  C:\Windows\System\DsKCiTP.exe
  2⤵
  PID:848
- C:\Windows\System\YczMJjY.exe
  C:\Windows\System\YczMJjY.exe
  2⤵
  PID:4764
- C:\Windows\System\tmgOlhH.exe
  C:\Windows\System\tmgOlhH.exe
  2⤵
  PID:808
- C:\Windows\System\unbNhoz.exe
  C:\Windows\System\unbNhoz.exe
  2⤵
  PID:11628
- C:\Windows\System\qBLVTKc.exe
  C:\Windows\System\qBLVTKc.exe
  2⤵
  PID:3188
- C:\Windows\System\UjrSjUh.exe
  C:\Windows\System\UjrSjUh.exe
  2⤵
  PID:12128
- C:\Windows\System\hGhKCLp.exe
  C:\Windows\System\hGhKCLp.exe
  2⤵
  PID:9788
- C:\Windows\System\yhYecNR.exe
  C:\Windows\System\yhYecNR.exe
  2⤵
  PID:2964
- C:\Windows\System\vwaFmkX.exe
  C:\Windows\System\vwaFmkX.exe
  2⤵
  PID:4436
- C:\Windows\System\PmnShNC.exe
  C:\Windows\System\PmnShNC.exe
  2⤵
  PID:3520
- C:\Windows\System\tlDCaXt.exe
  C:\Windows\System\tlDCaXt.exe
  2⤵
  PID:1584
- C:\Windows\System\AlwGbHj.exe
  C:\Windows\System\AlwGbHj.exe
  2⤵
  PID:2432
- C:\Windows\System\lTObzcu.exe
  C:\Windows\System\lTObzcu.exe
  2⤵
  PID:632
- C:\Windows\System\lmxxqxM.exe
  C:\Windows\System\lmxxqxM.exe
  2⤵
  PID:4904
- C:\Windows\System\OcwftSn.exe
  C:\Windows\System\OcwftSn.exe
  2⤵
  PID:9980
- C:\Windows\System\YbhPEkM.exe
  C:\Windows\System\YbhPEkM.exe
  2⤵
  PID:2952
- C:\Windows\System\VygChOe.exe
  C:\Windows\System\VygChOe.exe
  2⤵
  PID:1436
- C:\Windows\System\RmsvxGO.exe
  C:\Windows\System\RmsvxGO.exe
  2⤵
  PID:4608
- C:\Windows\System\OrJkLDp.exe
  C:\Windows\System\OrJkLDp.exe
  2⤵
  PID:628
- C:\Windows\System\iiDvuXo.exe
  C:\Windows\System\iiDvuXo.exe
  2⤵
  PID:2260
- C:\Windows\System\epQvIWo.exe
  C:\Windows\System\epQvIWo.exe
  2⤵
  PID:11580
- C:\Windows\System\DHPdVsV.exe
  C:\Windows\System\DHPdVsV.exe
  2⤵
  PID:3088
- C:\Windows\System\qlmarIc.exe
  C:\Windows\System\qlmarIc.exe
  2⤵
  PID:3048
- C:\Windows\System\olrcINs.exe
  C:\Windows\System\olrcINs.exe
  2⤵
  PID:2256
- C:\Windows\System\QwQdfKN.exe
  C:\Windows\System\QwQdfKN.exe
  2⤵
  PID:5932
- C:\Windows\System\nOVfSRR.exe
  C:\Windows\System\nOVfSRR.exe
  2⤵
  PID:6040
- C:\Windows\System\GtgFibl.exe
  C:\Windows\System\GtgFibl.exe
  2⤵
  PID:3132
- C:\Windows\System\fNAaOGY.exe
  C:\Windows\System\fNAaOGY.exe
  2⤵
  PID:2876
- C:\Windows\System\guMNXHV.exe
  C:\Windows\System\guMNXHV.exe
  2⤵
  PID:4452
- C:\Windows\System\vhZdAHJ.exe
  C:\Windows\System\vhZdAHJ.exe
  2⤵
  PID:6956
- C:\Windows\System\hrLXbCQ.exe
  C:\Windows\System\hrLXbCQ.exe
  2⤵
  PID:6248
- C:\Windows\System\leJVNui.exe
  C:\Windows\System\leJVNui.exe
  2⤵
  PID:6360
- C:\Windows\System\uUcyGkG.exe
  C:\Windows\System\uUcyGkG.exe
  2⤵
  PID:5368
- C:\Windows\System\SSGPpjY.exe
  C:\Windows\System\SSGPpjY.exe
  2⤵
  PID:6236
- C:\Windows\System\wvNwRve.exe
  C:\Windows\System\wvNwRve.exe
  2⤵
  PID:7272
- C:\Windows\System\iCUDPOS.exe
  C:\Windows\System\iCUDPOS.exe
  2⤵
  PID:4124
- C:\Windows\System\bWoRFuX.exe
  C:\Windows\System\bWoRFuX.exe
  2⤵
  PID:1832
- C:\Windows\System\YSwSAjL.exe
  C:\Windows\System\YSwSAjL.exe
  2⤵
  PID:7192
- C:\Windows\System\bxCeYSX.exe
  C:\Windows\System\bxCeYSX.exe
  2⤵
  PID:9720
- C:\Windows\System\qHcSteZ.exe
  C:\Windows\System\qHcSteZ.exe
  2⤵
  PID:4444
- C:\Windows\System\dQjiqov.exe
  C:\Windows\System\dQjiqov.exe
  2⤵
  PID:4648
- C:\Windows\System\eJYgPUy.exe
  C:\Windows\System\eJYgPUy.exe
  2⤵
  PID:4756
- C:\Windows\System\rXRKdGy.exe
  C:\Windows\System\rXRKdGy.exe
  2⤵
  PID:1624
- C:\Windows\System\xMayHsb.exe
  C:\Windows\System\xMayHsb.exe
  2⤵
  PID:5304
- C:\Windows\System\GRjwlxG.exe
  C:\Windows\System\GRjwlxG.exe
  2⤵
  PID:5056
- C:\Windows\System\MwxLOul.exe
  C:\Windows\System\MwxLOul.exe
  2⤵
  PID:2764
- C:\Windows\System\VxZhuFw.exe
  C:\Windows\System\VxZhuFw.exe
  2⤵
  PID:5364
- C:\Windows\System\xIFUzbU.exe
  C:\Windows\System\xIFUzbU.exe
  2⤵
  PID:2960
- C:\Windows\System\kasBVOB.exe
  C:\Windows\System\kasBVOB.exe
  2⤵
  PID:5340
- C:\Windows\System\sXdgahq.exe
  C:\Windows\System\sXdgahq.exe
  2⤵
  PID:5228
- C:\Windows\System\IIOmbkO.exe
  C:\Windows\System\IIOmbkO.exe
  2⤵
  PID:5288
- C:\Windows\System\PtJgARD.exe
  C:\Windows\System\PtJgARD.exe
  2⤵
  PID:5944
- C:\Windows\System\Ajrukor.exe
  C:\Windows\System\Ajrukor.exe
  2⤵
  PID:13304
- C:\Windows\System\fXXTmHM.exe
  C:\Windows\System\fXXTmHM.exe
  2⤵
  PID:2880
- C:\Windows\System\xwWCyns.exe
  C:\Windows\System\xwWCyns.exe
  2⤵
  PID:5272
- C:\Windows\System\EqEsugz.exe
  C:\Windows\System\EqEsugz.exe
  2⤵
  PID:5212
- C:\Windows\System\eaDTlSa.exe
  C:\Windows\System\eaDTlSa.exe
  2⤵
  PID:12928
- C:\Windows\System\ZyIgtIp.exe
  C:\Windows\System\ZyIgtIp.exe
  2⤵
  PID:3432
- C:\Windows\System\XFJoJLI.exe
  C:\Windows\System\XFJoJLI.exe
  2⤵
  PID:1468
- C:\Windows\System\OlKUoIK.exe
  C:\Windows\System\OlKUoIK.exe
  2⤵
  PID:9476
- C:\Windows\System\RvhmXKb.exe
  C:\Windows\System\RvhmXKb.exe
  2⤵
  PID:6788
- C:\Windows\System\ngxVJpQ.exe
  C:\Windows\System\ngxVJpQ.exe
  2⤵
  PID:6216
- C:\Windows\System\rEBQrRQ.exe
  C:\Windows\System\rEBQrRQ.exe
  2⤵
  PID:10096
- C:\Windows\System\LFcgZOp.exe
  C:\Windows\System\LFcgZOp.exe
  2⤵
  PID:6448
- C:\Windows\System\XgTYIIv.exe
  C:\Windows\System\XgTYIIv.exe
  2⤵
  PID:6708
- C:\Windows\System\MWERmAe.exe
  C:\Windows\System\MWERmAe.exe
  2⤵
  PID:6716
- C:\Windows\System\ZANeTKA.exe
  C:\Windows\System\ZANeTKA.exe
  2⤵
  PID:2460
- C:\Windows\System\LLQBieV.exe
  C:\Windows\System\LLQBieV.exe
  2⤵
  PID:3312
- C:\Windows\System\IUOgEae.exe
  C:\Windows\System\IUOgEae.exe
  2⤵
  PID:5352
- C:\Windows\System\aqnykWy.exe
  C:\Windows\System\aqnykWy.exe
  2⤵
  PID:5156
- C:\Windows\System\aDlZPQX.exe
  C:\Windows\System\aDlZPQX.exe
  2⤵
  PID:5344
- C:\Windows\System\vIGGdMX.exe
  C:\Windows\System\vIGGdMX.exe
  2⤵
  PID:5200
- C:\Windows\System\VuRrmKG.exe
  C:\Windows\System\VuRrmKG.exe
  2⤵
  PID:5348
- C:\Windows\System\OZuEkWE.exe
  C:\Windows\System\OZuEkWE.exe
  2⤵
  PID:4368
- C:\Windows\System\zQgqjtQ.exe
  C:\Windows\System\zQgqjtQ.exe
  2⤵
  PID:6736
- C:\Windows\System\WXbmWmQ.exe
  C:\Windows\System\WXbmWmQ.exe
  2⤵
  PID:5196
- C:\Windows\System\brVuxDA.exe
  C:\Windows\System\brVuxDA.exe
  2⤵
  PID:12616
- C:\Windows\System\hvrTGyL.exe
  C:\Windows\System\hvrTGyL.exe
  2⤵
  PID:6904
- C:\Windows\System\UJEiamp.exe
  C:\Windows\System\UJEiamp.exe
  2⤵
  PID:3128
- C:\Windows\System\yzLZYky.exe
  C:\Windows\System\yzLZYky.exe
  2⤵
  PID:6516
- C:\Windows\System\CjqoEHL.exe
  C:\Windows\System\CjqoEHL.exe
  2⤵
  PID:5360
- C:\Windows\System\ZryzHlN.exe
  C:\Windows\System\ZryzHlN.exe
  2⤵
  PID:8456
- C:\Windows\System\ZjQbIEH.exe
  C:\Windows\System\ZjQbIEH.exe
  2⤵
  PID:5820
- C:\Windows\System\ZhpWRhq.exe
  C:\Windows\System\ZhpWRhq.exe
  2⤵
  PID:3012
- C:\Windows\System\GfzOSiB.exe
  C:\Windows\System\GfzOSiB.exe
  2⤵
  PID:784
- C:\Windows\System\bWfKwMO.exe
  C:\Windows\System\bWfKwMO.exe
  2⤵
  PID:5184
- C:\Windows\System\vNXZDsh.exe
  C:\Windows\System\vNXZDsh.exe
  2⤵
  PID:5216
- C:\Windows\System\ejSCJxs.exe
  C:\Windows\System\ejSCJxs.exe
  2⤵
  PID:2656
- C:\Windows\System\oAnaZSW.exe
  C:\Windows\System\oAnaZSW.exe
  2⤵
  PID:6052
- C:\Windows\System\xfKfeiT.exe
  C:\Windows\System\xfKfeiT.exe
  2⤵
  PID:3304
- C:\Windows\System\tXprjcJ.exe
  C:\Windows\System\tXprjcJ.exe
  2⤵
  PID:2268
- C:\Windows\System\iLZRSXs.exe
  C:\Windows\System\iLZRSXs.exe
  2⤵
  PID:3552
- C:\Windows\System\CpNuNxg.exe
  C:\Windows\System\CpNuNxg.exe
  2⤵
  PID:5684
- C:\Windows\System\nuHPKVP.exe
  C:\Windows\System\nuHPKVP.exe
  2⤵
  PID:388
- C:\Windows\System\bQzCRNt.exe
  C:\Windows\System\bQzCRNt.exe
  2⤵
  PID:5128
- C:\Windows\System\QTOePBs.exe
  C:\Windows\System\QTOePBs.exe
  2⤵
  PID:4460
- C:\Windows\System\qXpfJVh.exe
  C:\Windows\System\qXpfJVh.exe
  2⤵
  PID:6756
- C:\Windows\System\quawFpf.exe
  C:\Windows\System\quawFpf.exe
  2⤵
  PID:13380
- C:\Windows\System\rJerhVy.exe
  C:\Windows\System\rJerhVy.exe
  2⤵
  PID:13396
- C:\Windows\System\xjDtnOe.exe
  C:\Windows\System\xjDtnOe.exe
  2⤵
  PID:13412
- C:\Windows\System\MMceIhC.exe
  C:\Windows\System\MMceIhC.exe
  2⤵
  PID:13440
- C:\Windows\System\CllRyRZ.exe
  C:\Windows\System\CllRyRZ.exe
  2⤵
  PID:13476
- C:\Windows\System\syiknIs.exe
  C:\Windows\System\syiknIs.exe
  2⤵
  PID:13588
- C:\Windows\System\KBSCgBP.exe
  C:\Windows\System\KBSCgBP.exe
  2⤵
  PID:13660
- C:\Windows\System\yeFVXKV.exe
  C:\Windows\System\yeFVXKV.exe
  2⤵
  PID:13712
- C:\Windows\System\YHHaHXQ.exe
  C:\Windows\System\YHHaHXQ.exe
  2⤵
  PID:13816
- C:\Windows\System\fuUvfaZ.exe
  C:\Windows\System\fuUvfaZ.exe
  2⤵
  PID:13836
- C:\Windows\System\iVQaAGq.exe
  C:\Windows\System\iVQaAGq.exe
  2⤵
  PID:13892
- C:\Windows\System\DUGEUyj.exe
  C:\Windows\System\DUGEUyj.exe
  2⤵
  PID:14096
- C:\Windows\System\AxehSNX.exe
  C:\Windows\System\AxehSNX.exe
  2⤵
  PID:14132
- C:\Windows\System\PqUguVr.exe
  C:\Windows\System\PqUguVr.exe
  2⤵
  PID:14148
- C:\Windows\System\QqbTqHL.exe
  C:\Windows\System\QqbTqHL.exe
  2⤵
  PID:14164
- C:\Windows\System\AGfuVFj.exe
  C:\Windows\System\AGfuVFj.exe
  2⤵
  PID:14192
- C:\Windows\System\tcUviWg.exe
  C:\Windows\System\tcUviWg.exe
  2⤵
  PID:14212
- C:\Windows\System\BRAAsSg.exe
  C:\Windows\System\BRAAsSg.exe
  2⤵
  PID:14232
- C:\Windows\System\mACbWdx.exe
  C:\Windows\System\mACbWdx.exe
  2⤵
  PID:14252
- C:\Windows\System\NefMZdj.exe
  C:\Windows\System\NefMZdj.exe
  2⤵
  PID:14280
- C:\Windows\System\Kbwytzi.exe
  C:\Windows\System\Kbwytzi.exe
  2⤵
  PID:14304
- C:\Windows\System\MxAOOyD.exe
  C:\Windows\System\MxAOOyD.exe
  2⤵
  PID:14324
- C:\Windows\System\uNJjSHn.exe
  C:\Windows\System\uNJjSHn.exe
  2⤵
  PID:1276
- C:\Windows\System\JbxTGMA.exe
  C:\Windows\System\JbxTGMA.exe
  2⤵
  PID:13320
- C:\Windows\System\DDplWLc.exe
  C:\Windows\System\DDplWLc.exe
  2⤵
  PID:13316
- C:\Windows\System\aetejDD.exe
  C:\Windows\System\aetejDD.exe
  2⤵
  PID:13360
- C:\Windows\System\UWoTHnY.exe
  C:\Windows\System\UWoTHnY.exe
  2⤵
  PID:13448
- C:\Windows\System\DOLTRBy.exe
  C:\Windows\System\DOLTRBy.exe
  2⤵
  PID:13472
- C:\Windows\System\PzervLj.exe
  C:\Windows\System\PzervLj.exe
  2⤵
  PID:13656
- C:\Windows\System\eZidaNe.exe
  C:\Windows\System\eZidaNe.exe
  2⤵
  PID:13720
- C:\Windows\System\TlrPRhM.exe
  C:\Windows\System\TlrPRhM.exe
  2⤵
  PID:13852
- C:\Windows\System\RVPjKiE.exe
  C:\Windows\System\RVPjKiE.exe
  2⤵
  PID:13704
- C:\Windows\System\vsGxYpQ.exe
  C:\Windows\System\vsGxYpQ.exe
  2⤵
  PID:13792
- C:\Windows\System\ugosPjK.exe
  C:\Windows\System\ugosPjK.exe
  2⤵
  PID:13880
- C:\Windows\System\AnwOyiW.exe
  C:\Windows\System\AnwOyiW.exe
  2⤵
  PID:14012
- C:\Windows\System\XKKctdU.exe
  C:\Windows\System\XKKctdU.exe
  2⤵
  PID:13932
- C:\Windows\System\CLERkVz.exe
  C:\Windows\System\CLERkVz.exe
  2⤵
  PID:7596
- C:\Windows\System\FxQkfEK.exe
  C:\Windows\System\FxQkfEK.exe
  2⤵
  PID:14076
- C:\Windows\System\EDkIWLb.exe
  C:\Windows\System\EDkIWLb.exe
  2⤵
  PID:7384
- C:\Windows\System\NgSjZRW.exe
  C:\Windows\System\NgSjZRW.exe
  2⤵
  PID:14128
- C:\Windows\System\HHfQABq.exe
  C:\Windows\System\HHfQABq.exe
  2⤵
  PID:14156
- C:\Windows\System\iTuusZp.exe
  C:\Windows\System\iTuusZp.exe
  2⤵
  PID:14140
- C:\Windows\System\NPQVugp.exe
  C:\Windows\System\NPQVugp.exe
  2⤵
  PID:14276
- C:\Windows\System\aBAkbcG.exe
  C:\Windows\System\aBAkbcG.exe
  2⤵
  PID:3592
- C:\Windows\System\fvmTeOp.exe
  C:\Windows\System\fvmTeOp.exe
  2⤵
  PID:5620
- C:\Windows\System\ySjKGAX.exe
  C:\Windows\System\ySjKGAX.exe
  2⤵
  PID:14268
- C:\Windows\System\EdZpSRI.exe
  C:\Windows\System\EdZpSRI.exe
  2⤵
  PID:6640
- C:\Windows\System\eiajWWb.exe
  C:\Windows\System\eiajWWb.exe
  2⤵
  PID:13432
- C:\Windows\System\qyrMgob.exe
  C:\Windows\System\qyrMgob.exe
  2⤵
  PID:13404
- C:\Windows\System\csmOftG.exe
  C:\Windows\System\csmOftG.exe
  2⤵
  PID:13544
- C:\Windows\System\zlEcKFE.exe
  C:\Windows\System\zlEcKFE.exe
  2⤵
  PID:13428
- C:\Windows\System\aZFViPJ.exe
  C:\Windows\System\aZFViPJ.exe
  2⤵
  PID:8228
- C:\Windows\System\GCqDBJS.exe
  C:\Windows\System\GCqDBJS.exe
  2⤵
  PID:13392
- C:\Windows\System\JCCRMhB.exe
  C:\Windows\System\JCCRMhB.exe
  2⤵
  PID:13468
- C:\Windows\System\MtjbLCx.exe
  C:\Windows\System\MtjbLCx.exe
  2⤵
  PID:13732
- C:\Windows\System\pfAldmK.exe
  C:\Windows\System\pfAldmK.exe
  2⤵
  PID:7880
- C:\Windows\System\EkgwgEn.exe
  C:\Windows\System\EkgwgEn.exe
  2⤵
  PID:8780
- C:\Windows\System\CVxijeu.exe
  C:\Windows\System\CVxijeu.exe
  2⤵
  PID:13692
- C:\Windows\System\ovQHnwF.exe
  C:\Windows\System\ovQHnwF.exe
  2⤵
  PID:7988
- C:\Windows\System\sNSHhEr.exe
  C:\Windows\System\sNSHhEr.exe
  2⤵
  PID:13904
- C:\Windows\System\sAVpAGY.exe
  C:\Windows\System\sAVpAGY.exe
  2⤵
  PID:13752
- C:\Windows\System\FyVtvrl.exe
  C:\Windows\System\FyVtvrl.exe
  2⤵
  PID:8824
- C:\Windows\System\QCxTuAy.exe
  C:\Windows\System\QCxTuAy.exe
  2⤵
  PID:7072
- C:\Windows\System\oxufPif.exe
  C:\Windows\System\oxufPif.exe
  2⤵
  PID:9344
- C:\Windows\System\WMZKChm.exe
  C:\Windows\System\WMZKChm.exe
  2⤵
  PID:6116
- C:\Windows\System\VNtnHbv.exe
  C:\Windows\System\VNtnHbv.exe
  2⤵
  PID:9244
- C:\Windows\System\rIDtRcO.exe
  C:\Windows\System\rIDtRcO.exe
  2⤵
  PID:9060
- C:\Windows\System\gZabVOQ.exe
  C:\Windows\System\gZabVOQ.exe
  2⤵
  PID:6428
- C:\Windows\System\jixqJAe.exe
  C:\Windows\System\jixqJAe.exe
  2⤵
  PID:9256
- C:\Windows\System\CDkiclE.exe
  C:\Windows\System\CDkiclE.exe
  2⤵
  PID:13992
- C:\Windows\System\aGBSzRr.exe
  C:\Windows\System\aGBSzRr.exe
  2⤵
  PID:14004
- C:\Windows\System\NYePpEm.exe
  C:\Windows\System\NYePpEm.exe
  2⤵
  PID:14072
- C:\Windows\System\HWTQuMV.exe
  C:\Windows\System\HWTQuMV.exe
  2⤵
  PID:9904
- C:\Windows\System\yRsMEze.exe
  C:\Windows\System\yRsMEze.exe
  2⤵
  PID:9992
- C:\Windows\System\eDhYCpH.exe
  C:\Windows\System\eDhYCpH.exe
  2⤵
  PID:8740
- C:\Windows\System\IpCYhMV.exe
  C:\Windows\System\IpCYhMV.exe
  2⤵
  PID:8800
- C:\Windows\System\GbaqTTX.exe
  C:\Windows\System\GbaqTTX.exe
  2⤵
  PID:10016
- C:\Windows\System\bYRHILz.exe
  C:\Windows\System\bYRHILz.exe
  2⤵
  PID:14296
- C:\Windows\System\XTIrPYs.exe
  C:\Windows\System\XTIrPYs.exe
  2⤵
  PID:7704
- C:\Windows\System\EeGLTBO.exe
  C:\Windows\System\EeGLTBO.exe
  2⤵
  PID:14188
- C:\Windows\System\gFhVRhT.exe
  C:\Windows\System\gFhVRhT.exe
  2⤵
  PID:5488
- C:\Windows\System\iqjMMeT.exe
  C:\Windows\System\iqjMMeT.exe
  2⤵
  PID:8860
- C:\Windows\System\jXzkYkY.exe
  C:\Windows\System\jXzkYkY.exe
  2⤵
  PID:14300
- C:\Windows\System\XRXuEFK.exe
  C:\Windows\System\XRXuEFK.exe
  2⤵
  PID:7532
- C:\Windows\System\SuKtOKc.exe
  C:\Windows\System\SuKtOKc.exe
  2⤵
  PID:13336
- C:\Windows\System\RMjgZZG.exe
  C:\Windows\System\RMjgZZG.exe
  2⤵
  PID:8184
- C:\Windows\System\SbdoMaJ.exe
  C:\Windows\System\SbdoMaJ.exe
  2⤵
  PID:8928
- C:\Windows\System\JTYIXNB.exe
  C:\Windows\System\JTYIXNB.exe
  2⤵
  PID:13616
- C:\Windows\System\FfvONvN.exe
  C:\Windows\System\FfvONvN.exe
  2⤵
  PID:13696
- C:\Windows\System\XJxhfVM.exe
  C:\Windows\System\XJxhfVM.exe
  2⤵
  PID:6696
- C:\Windows\System\cwziSuN.exe
  C:\Windows\System\cwziSuN.exe
  2⤵
  PID:10252
- C:\Windows\System\HeHtahE.exe
  C:\Windows\System\HeHtahE.exe
  2⤵
  PID:13620
- C:\Windows\System\ToFwDrd.exe
  C:\Windows\System\ToFwDrd.exe
  2⤵
  PID:10328
- C:\Windows\System\FngpdAu.exe
  C:\Windows\System\FngpdAu.exe
  2⤵
  PID:13908
- C:\Windows\System\aAJXrwC.exe
  C:\Windows\System\aAJXrwC.exe
  2⤵
  PID:13900
- C:\Windows\System\CKqwNCl.exe
  C:\Windows\System\CKqwNCl.exe
  2⤵
  PID:8100
- C:\Windows\System\EgpNUge.exe
  C:\Windows\System\EgpNUge.exe
  2⤵
  PID:9040
- C:\Windows\System\wsgBHtc.exe
  C:\Windows\System\wsgBHtc.exe
  2⤵
  PID:8612
- C:\Windows\System\nSCGTki.exe
  C:\Windows\System\nSCGTki.exe
  2⤵
  PID:8996
- C:\Windows\System\AsbJEoj.exe
  C:\Windows\System\AsbJEoj.exe
  2⤵
  PID:8788
- C:\Windows\System\NhvUDWm.exe
  C:\Windows\System\NhvUDWm.exe
  2⤵
  PID:704
- C:\Windows\System\fwABPEq.exe
  C:\Windows\System\fwABPEq.exe
  2⤵
  PID:10340
- C:\Windows\System\ILykraP.exe
  C:\Windows\System\ILykraP.exe
  2⤵
  PID:8756
- C:\Windows\System\KuGUepz.exe
  C:\Windows\System\KuGUepz.exe
  2⤵
  PID:13500
- C:\Windows\System\HykMvCZ.exe
  C:\Windows\System\HykMvCZ.exe
  2⤵
  PID:7720
- C:\Windows\System\eTCZWcY.exe
  C:\Windows\System\eTCZWcY.exe
  2⤵
  PID:1424
- C:\Windows\System\DhqKrNF.exe
  C:\Windows\System\DhqKrNF.exe
  2⤵
  PID:7760
- C:\Windows\System\vUmGfIV.exe
  C:\Windows\System\vUmGfIV.exe
  2⤵
  PID:7472
- C:\Windows\System\npmsATp.exe
  C:\Windows\System\npmsATp.exe
  2⤵
  PID:9104
- C:\Windows\System\iZpZQKD.exe
  C:\Windows\System\iZpZQKD.exe
  2⤵
  PID:7640
- C:\Windows\System\LlYqpVx.exe
  C:\Windows\System\LlYqpVx.exe
  2⤵
  PID:9820
- C:\Windows\System\XoeObly.exe
  C:\Windows\System\XoeObly.exe
  2⤵
  PID:14332
- C:\Windows\System\LwFZIVl.exe
  C:\Windows\System\LwFZIVl.exe
  2⤵
  PID:11960
- C:\Windows\System\uyEasyW.exe
  C:\Windows\System\uyEasyW.exe
  2⤵
  PID:9200
- C:\Windows\System\IcppbtX.exe
  C:\Windows\System\IcppbtX.exe
  2⤵
  PID:6024
- C:\Windows\System\HqVRHEw.exe
  C:\Windows\System\HqVRHEw.exe
  2⤵
  PID:8384
- C:\Windows\System\RJBWnko.exe
  C:\Windows\System\RJBWnko.exe
  2⤵
  PID:11160
- C:\Windows\System\jXgBWLx.exe
  C:\Windows\System\jXgBWLx.exe
  2⤵
  PID:9568
- C:\Windows\System\rjwazww.exe
  C:\Windows\System\rjwazww.exe
  2⤵
  PID:10844
- C:\Windows\System\EPEsaHR.exe
  C:\Windows\System\EPEsaHR.exe
  2⤵
  PID:12620
- C:\Windows\System\uohiWYd.exe
  C:\Windows\System\uohiWYd.exe
  2⤵
  PID:8256
- C:\Windows\System\vzEzNHH.exe
  C:\Windows\System\vzEzNHH.exe
  2⤵
  PID:11596
- C:\Windows\System\pNHKcso.exe
  C:\Windows\System\pNHKcso.exe
  2⤵
  PID:13928
- C:\Windows\System\AywKRMY.exe
  C:\Windows\System\AywKRMY.exe
  2⤵
  PID:8468
- C:\Windows\System\LjESeuy.exe
  C:\Windows\System\LjESeuy.exe
  2⤵
  PID:7708
- C:\Windows\System\zOJMRIp.exe
  C:\Windows\System\zOJMRIp.exe
  2⤵
  PID:8404
- C:\Windows\System\NFdBEgU.exe
  C:\Windows\System\NFdBEgU.exe
  2⤵
  PID:8072
- C:\Windows\System\XYgzBMu.exe
  C:\Windows\System\XYgzBMu.exe
  2⤵
  PID:9792
- C:\Windows\System\QkJIsbD.exe
  C:\Windows\System\QkJIsbD.exe
  2⤵
  PID:11156
- C:\Windows\System\ZoDQlsB.exe
  C:\Windows\System\ZoDQlsB.exe
  2⤵
  PID:11352
- C:\Windows\System\cgTitNd.exe
  C:\Windows\System\cgTitNd.exe
  2⤵
  PID:11240
- C:\Windows\System\uhHqICJ.exe
  C:\Windows\System\uhHqICJ.exe
  2⤵
  PID:6940
- C:\Windows\System\hMxvCHv.exe
  C:\Windows\System\hMxvCHv.exe
  2⤵
  PID:9212
- C:\Windows\System\ZCNmgVz.exe
  C:\Windows\System\ZCNmgVz.exe
  2⤵
  PID:12692
- C:\Windows\System\wtgzXES.exe
  C:\Windows\System\wtgzXES.exe
  2⤵
  PID:6856
- C:\Windows\System\WMuoTyY.exe
  C:\Windows\System\WMuoTyY.exe
  2⤵
  PID:12676
- C:\Windows\System\ruARMfC.exe
  C:\Windows\System\ruARMfC.exe
  2⤵
  PID:11620
- C:\Windows\System\EKAcnVr.exe
  C:\Windows\System\EKAcnVr.exe
  2⤵
  PID:10636
- C:\Windows\System\jEVgsKm.exe
  C:\Windows\System\jEVgsKm.exe
  2⤵
  PID:11660
- C:\Windows\System\xnrsEGq.exe
  C:\Windows\System\xnrsEGq.exe
  2⤵
  PID:12636
- C:\Windows\System\hNifFRc.exe
  C:\Windows\System\hNifFRc.exe
  2⤵
  PID:8916
- C:\Windows\System\GaOWJdR.exe
  C:\Windows\System\GaOWJdR.exe
  2⤵
  PID:11120
- C:\Windows\System\sYLqNWc.exe
  C:\Windows\System\sYLqNWc.exe
  2⤵
  PID:6568
- C:\Windows\System\vGQulTa.exe
  C:\Windows\System\vGQulTa.exe
  2⤵
  PID:7964
- C:\Windows\System\naROjoa.exe
  C:\Windows\System\naROjoa.exe
  2⤵
  PID:9296
- C:\Windows\System\VqqOcRm.exe
  C:\Windows\System\VqqOcRm.exe
  2⤵
  PID:9188
- C:\Windows\System\NcmuzQV.exe
  C:\Windows\System\NcmuzQV.exe
  2⤵
  PID:14272
- C:\Windows\System\bdweIYy.exe
  C:\Windows\System\bdweIYy.exe
  2⤵
  PID:11292
- C:\Windows\System\cJPeTuW.exe
  C:\Windows\System\cJPeTuW.exe
  2⤵
  PID:10124
- C:\Windows\System\CyPfffZ.exe
  C:\Windows\System\CyPfffZ.exe
  2⤵
  PID:12704
- C:\Windows\System\qauDTWJ.exe
  C:\Windows\System\qauDTWJ.exe
  2⤵
  PID:14344
- C:\Windows\System\YJMAtDs.exe
  C:\Windows\System\YJMAtDs.exe
  2⤵
  PID:14364
- C:\Windows\System\aFtsIch.exe
  C:\Windows\System\aFtsIch.exe
  2⤵
  PID:14396
- C:\Windows\System\VRacwcu.exe
  C:\Windows\System\VRacwcu.exe
  2⤵
  PID:14420
- C:\Windows\System\yASiBrI.exe
  C:\Windows\System\yASiBrI.exe
  2⤵
  PID:14436
- C:\Windows\System\DpEAbei.exe
  C:\Windows\System\DpEAbei.exe
  2⤵
  PID:14464
- C:\Windows\System\DAZsJtS.exe
  C:\Windows\System\DAZsJtS.exe
  2⤵
  PID:14488
- C:\Windows\System\SSCATGo.exe
  C:\Windows\System\SSCATGo.exe
  2⤵
  PID:14512
- C:\Windows\System\VbuuCTE.exe
  C:\Windows\System\VbuuCTE.exe
  2⤵
  PID:14536
- C:\Windows\System\KGSNljW.exe
  C:\Windows\System\KGSNljW.exe
  2⤵
  PID:14556
- C:\Windows\System\XUgwZog.exe
  C:\Windows\System\XUgwZog.exe
  2⤵
  PID:14584
- C:\Windows\System\CDtHpVI.exe
  C:\Windows\System\CDtHpVI.exe
  2⤵
  PID:14604
- C:\Windows\System\RmrhXtR.exe
  C:\Windows\System\RmrhXtR.exe
  2⤵
  PID:14652
- C:\Windows\System\fdSiLBp.exe
  C:\Windows\System\fdSiLBp.exe
  2⤵
  PID:14716
- C:\Windows\System\eGbyqBp.exe
  C:\Windows\System\eGbyqBp.exe
  2⤵
  PID:14836
- C:\Windows\System\jGuJWoA.exe
  C:\Windows\System\jGuJWoA.exe
  2⤵
  PID:14884
- C:\Windows\System\aXHBtdO.exe
  C:\Windows\System\aXHBtdO.exe
  2⤵
  PID:14964
- C:\Windows\System\XAivOuL.exe
  C:\Windows\System\XAivOuL.exe
  2⤵
  PID:15088
- C:\Windows\System\PJRCTIO.exe
  C:\Windows\System\PJRCTIO.exe
  2⤵
  PID:15120
- C:\Windows\System\JKajjwI.exe
  C:\Windows\System\JKajjwI.exe
  2⤵
  PID:15168
- C:\Windows\System\gXRteIP.exe
  C:\Windows\System\gXRteIP.exe
  2⤵
  PID:15216
- C:\Windows\System\gLfrEYw.exe
  C:\Windows\System\gLfrEYw.exe
  2⤵
  PID:15232
- C:\Windows\System\aBjaKuh.exe
  C:\Windows\System\aBjaKuh.exe
  2⤵
  PID:15248
- C:\Windows\System\DSYXYIP.exe
  C:\Windows\System\DSYXYIP.exe
  2⤵
  PID:15264
- C:\Windows\System\VZpfrps.exe
  C:\Windows\System\VZpfrps.exe
  2⤵
  PID:15280
- C:\Windows\System\ItTSmNQ.exe
  C:\Windows\System\ItTSmNQ.exe
  2⤵
  PID:15296
- C:\Windows\System\YgjMlXO.exe
  C:\Windows\System\YgjMlXO.exe
  2⤵
  PID:15316
- C:\Windows\System\UHtQNcC.exe
  C:\Windows\System\UHtQNcC.exe
  2⤵
  PID:15336
- C:\Windows\System\ikdkpLl.exe
  C:\Windows\System\ikdkpLl.exe
  2⤵
  PID:11972
- C:\Windows\System\RAXiZCv.exe
  C:\Windows\System\RAXiZCv.exe
  2⤵
  PID:10120
- C:\Windows\System\kdHVZaN.exe
  C:\Windows\System\kdHVZaN.exe
  2⤵
  PID:11460
- C:\Windows\System\NXOKBUU.exe
  C:\Windows\System\NXOKBUU.exe
  2⤵
  PID:12140
- C:\Windows\System\sfvxzGv.exe
  C:\Windows\System\sfvxzGv.exe
  2⤵
  PID:10436
- C:\Windows\System\pmZgvmU.exe
  C:\Windows\System\pmZgvmU.exe
  2⤵
  PID:14600
- C:\Windows\System\aKHWChz.exe
  C:\Windows\System\aKHWChz.exe
  2⤵
  PID:14628
- C:\Windows\System\rOhsyuG.exe
  C:\Windows\System\rOhsyuG.exe
  2⤵
  PID:12788
- C:\Windows\System\GQbYffI.exe
  C:\Windows\System\GQbYffI.exe
  2⤵
  PID:14772
- C:\Windows\System\yJuMrzd.exe
  C:\Windows\System\yJuMrzd.exe
  2⤵
  PID:14948
- C:\Windows\System\zVZhtuK.exe
  C:\Windows\System\zVZhtuK.exe
  2⤵
  PID:12648
- C:\Windows\System\EvFpAQh.exe
  C:\Windows\System\EvFpAQh.exe
  2⤵
  PID:15016
- C:\Windows\System\iUFKKjn.exe
  C:\Windows\System\iUFKKjn.exe
  2⤵
  PID:15032
- C:\Windows\System\YFuXLPF.exe
  C:\Windows\System\YFuXLPF.exe
  2⤵
  PID:13028
- C:\Windows\System\eqjBiOt.exe
  C:\Windows\System\eqjBiOt.exe
  2⤵
  PID:13300
- C:\Windows\System\mgDwJAK.exe
  C:\Windows\System\mgDwJAK.exe
  2⤵
  PID:15148
- C:\Windows\System\invCVDp.exe
  C:\Windows\System\invCVDp.exe
  2⤵
  PID:13068
- C:\Windows\System\KRnjHWF.exe
  C:\Windows\System\KRnjHWF.exe
  2⤵
  PID:15208
- C:\Windows\System\AvLdYWS.exe
  C:\Windows\System\AvLdYWS.exe
  2⤵
  PID:11212
- C:\Windows\System\gnWrAbd.exe
  C:\Windows\System\gnWrAbd.exe
  2⤵
  PID:15068
- C:\Windows\System\onFfsOd.exe
  C:\Windows\System\onFfsOd.exe
  2⤵
  PID:11332
- C:\Windows\System\SRvBmZR.exe
  C:\Windows\System\SRvBmZR.exe
  2⤵
  PID:12892
- C:\Windows\System\JBdUVgI.exe
  C:\Windows\System\JBdUVgI.exe
  2⤵
  PID:15180
- C:\Windows\System\yYLoYNV.exe
  C:\Windows\System\yYLoYNV.exe
  2⤵
  PID:15192
- C:\Windows\System\BXztumx.exe
  C:\Windows\System\BXztumx.exe
  2⤵
  PID:15036
- C:\Windows\System\SymmIBB.exe
  C:\Windows\System\SymmIBB.exe
  2⤵
  PID:12984
- C:\Windows\System\njwKESK.exe
  C:\Windows\System\njwKESK.exe
  2⤵
  PID:10888
- C:\Windows\System\sTXZThd.exe
  C:\Windows\System\sTXZThd.exe
  2⤵
  PID:13204
- C:\Windows\System\mGcMYgx.exe
  C:\Windows\System\mGcMYgx.exe
  2⤵
  PID:9876
- C:\Windows\System\aEewDnl.exe
  C:\Windows\System\aEewDnl.exe
  2⤵
  PID:11180
- C:\Windows\System\HUVKwHP.exe
  C:\Windows\System\HUVKwHP.exe
  2⤵
  PID:12768
- C:\Windows\System\omwPXjW.exe
  C:\Windows\System\omwPXjW.exe
  2⤵
  PID:11096
- C:\Windows\System\XaViWIv.exe
  C:\Windows\System\XaViWIv.exe
  2⤵
  PID:14444
- C:\Windows\System\GsNizvs.exe
  C:\Windows\System\GsNizvs.exe
  2⤵
  PID:15184
- C:\Windows\System\qvTkcRf.exe
  C:\Windows\System\qvTkcRf.exe
  2⤵
  PID:15224
- C:\Windows\System\zKFPUZt.exe
  C:\Windows\System\zKFPUZt.exe
  2⤵
  PID:15288
- C:\Windows\System\yplQtFz.exe
  C:\Windows\System\yplQtFz.exe
  2⤵
  PID:7928
- C:\Windows\System\EFJQXVd.exe
  C:\Windows\System\EFJQXVd.exe
  2⤵
  PID:8912
- C:\Windows\System\fRAXHid.exe
  C:\Windows\System\fRAXHid.exe
  2⤵
  PID:13140
- C:\Windows\System\ttoKZTz.exe
  C:\Windows\System\ttoKZTz.exe
  2⤵
  PID:9488
- C:\Windows\System\xkOZIhu.exe
  C:\Windows\System\xkOZIhu.exe
  2⤵
  PID:15324
- C:\Windows\System\DlzEuAR.exe
  C:\Windows\System\DlzEuAR.exe
  2⤵
  PID:15348
- C:\Windows\System\vCIaUfB.exe
  C:\Windows\System\vCIaUfB.exe
  2⤵
  PID:8148
- C:\Windows\System\AYrgveO.exe
  C:\Windows\System\AYrgveO.exe
  2⤵
  PID:12824
- C:\Windows\System\SVKluhl.exe
  C:\Windows\System\SVKluhl.exe
  2⤵
  PID:10396
- C:\Windows\System\SWPwLbS.exe
  C:\Windows\System\SWPwLbS.exe
  2⤵
  PID:14688
- C:\Windows\System\NQLRLAd.exe
  C:\Windows\System\NQLRLAd.exe
  2⤵
  PID:8784
- C:\Windows\System\FmRVndI.exe
  C:\Windows\System\FmRVndI.exe
  2⤵
  PID:14520
- C:\Windows\System\xgCDNgP.exe
  C:\Windows\System\xgCDNgP.exe
  2⤵
  PID:9680
- C:\Windows\System\eyLbSpx.exe
  C:\Windows\System\eyLbSpx.exe
  2⤵
  PID:14552
- C:\Windows\System\saLzCDK.exe
  C:\Windows\System\saLzCDK.exe
  2⤵
  PID:9700
- C:\Windows\System\OixohJb.exe
  C:\Windows\System\OixohJb.exe
  2⤵
  PID:14904
- C:\Windows\System\dJxSywr.exe
  C:\Windows\System\dJxSywr.exe
  2⤵
  PID:11340
- C:\Windows\System\MelnXjU.exe
  C:\Windows\System\MelnXjU.exe
  2⤵
  PID:12172
- C:\Windows\System\tZWgYPW.exe
  C:\Windows\System\tZWgYPW.exe
  2⤵
  PID:14016
- C:\Windows\System\nVejoqz.exe
  C:\Windows\System\nVejoqz.exe
  2⤵
  PID:12828
- C:\Windows\System\zqsCVpc.exe
  C:\Windows\System\zqsCVpc.exe
  2⤵
  PID:14616
- C:\Windows\System\MXOiXsP.exe
  C:\Windows\System\MXOiXsP.exe
  2⤵
  PID:13120
- C:\Windows\System\zuaZlaZ.exe
  C:\Windows\System\zuaZlaZ.exe
  2⤵
  PID:12660
- C:\Windows\System\NBtpGQy.exe
  C:\Windows\System\NBtpGQy.exe
  2⤵
  PID:10184
- C:\Windows\System\VCBomlH.exe
  C:\Windows\System\VCBomlH.exe
  2⤵
  PID:10144
- C:\Windows\System\WsoATPL.exe
  C:\Windows\System\WsoATPL.exe
  2⤵
  PID:7480
- C:\Windows\System\MxtipHy.exe
  C:\Windows\System\MxtipHy.exe
  2⤵
  PID:12600
- C:\Windows\System\UTPlDPC.exe
  C:\Windows\System\UTPlDPC.exe
  2⤵
  PID:12312
- C:\Windows\System\qLbPxiE.exe
  C:\Windows\System\qLbPxiE.exe
  2⤵
  PID:10100
- C:\Windows\System\ZSMMgjY.exe
  C:\Windows\System\ZSMMgjY.exe
  2⤵
  PID:10008
- C:\Windows\System\vPKIepv.exe
  C:\Windows\System\vPKIepv.exe
  2⤵
  PID:12556
- C:\Windows\System\JDTuIim.exe
  C:\Windows\System\JDTuIim.exe
  2⤵
  PID:11540
- C:\Windows\System\KHUKwRO.exe
  C:\Windows\System\KHUKwRO.exe
  2⤵
  PID:4284
- C:\Windows\System\OJONLTL.exe
  C:\Windows\System\OJONLTL.exe
  2⤵
  PID:11720
- C:\Windows\System\nPZPoxN.exe
  C:\Windows\System\nPZPoxN.exe
  2⤵
  PID:10920
- C:\Windows\System\wpZxJyI.exe
  C:\Windows\System\wpZxJyI.exe
  2⤵
  PID:11644
- C:\Windows\System\pWMBXHu.exe
  C:\Windows\System\pWMBXHu.exe
  2⤵
  PID:15080
- C:\Windows\System\tdTsjzz.exe
  C:\Windows\System\tdTsjzz.exe
  2⤵
  PID:12320
- C:\Windows\System\YtGdcho.exe
  C:\Windows\System\YtGdcho.exe
  2⤵
  PID:10584
- C:\Windows\System\lJZTBaG.exe
  C:\Windows\System\lJZTBaG.exe
  2⤵
  PID:14880
- C:\Windows\System\XgCJsFH.exe
  C:\Windows\System\XgCJsFH.exe
  2⤵
  PID:12596
- C:\Windows\System\aeyQvQK.exe
  C:\Windows\System\aeyQvQK.exe
  2⤵
  PID:14980
- C:\Windows\System\NMejNMk.exe
  C:\Windows\System\NMejNMk.exe
  2⤵
  PID:10876
- C:\Windows\System\hvEuBvR.exe
  C:\Windows\System\hvEuBvR.exe
  2⤵
  PID:11452
- C:\Windows\System\zHmaVeK.exe
  C:\Windows\System\zHmaVeK.exe
  2⤵
  PID:12592
- C:\Windows\System\cyrhtoJ.exe
  C:\Windows\System\cyrhtoJ.exe
  2⤵
  PID:10724
- C:\Windows\System\rBrcbrb.exe
  C:\Windows\System\rBrcbrb.exe
  2⤵
  PID:15244
- C:\Windows\System\knFYrTr.exe
  C:\Windows\System\knFYrTr.exe
  2⤵
  PID:15024
- C:\Windows\System\GrfxBJY.exe
  C:\Windows\System\GrfxBJY.exe
  2⤵
  PID:14544
- C:\Windows\System\XCGIWPG.exe
  C:\Windows\System\XCGIWPG.exe
  2⤵
  PID:13136
- C:\Windows\System\bmSqJTs.exe
  C:\Windows\System\bmSqJTs.exe
  2⤵
  PID:12680
- C:\Windows\System\TBwxrDd.exe
  C:\Windows\System\TBwxrDd.exe
  2⤵
  PID:13196
- C:\Windows\System\gptHGuY.exe
  C:\Windows\System\gptHGuY.exe
  2⤵
  PID:9644
- C:\Windows\System\uMrMbtS.exe
  C:\Windows\System\uMrMbtS.exe
  2⤵
  PID:10820
- C:\Windows\System\OPZOOPR.exe
  C:\Windows\System\OPZOOPR.exe
  2⤵
  PID:13000
- C:\Windows\System\RUsWlrI.exe
  C:\Windows\System\RUsWlrI.exe
  2⤵
  PID:12876
- C:\Windows\System\HZnOXMa.exe
  C:\Windows\System\HZnOXMa.exe
  2⤵
  PID:10300
- C:\Windows\System\iAhoBBt.exe
  C:\Windows\System\iAhoBBt.exe
  2⤵
  PID:11076
- C:\Windows\System\sYASCly.exe
  C:\Windows\System\sYASCly.exe
  2⤵
  PID:10660
- C:\Windows\System\zwFsOPK.exe
  C:\Windows\System\zwFsOPK.exe
  2⤵
  PID:12712
- C:\Windows\System\rKULudI.exe
  C:\Windows\System\rKULudI.exe
  2⤵
  PID:7700
- C:\Windows\System\XHRCNWh.exe
  C:\Windows\System\XHRCNWh.exe
  2⤵
  PID:9736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bvimkihr.vmg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AJJCHat.exe

Filesize
1.8MB

MD5
28b2e392a51370a5e04c0acba68752b4

SHA1
191d76b153fb358b06086b3c078618c5089643c1

SHA256
7579ec36097358d88a2429ecdf437039c3d97f862685e0ddb1889c7d23598952

SHA512
45831b1fd21feb4081f5a927fb77121c16531b99bfac6c9fe8ed7977cc8be364b8ac0e51c8e3eb3cacbf2a298a6bc7226a07720cc457a46c1b4ffc1ce0c9c132

Download Submit
C:\Windows\System\ATQGTpw.exe

Filesize
1.8MB

MD5
1d30f972862763c64cd8c3fdce8a720b

SHA1
01e67fceb5068c128a5fd7fa225fb163f76df248

SHA256
4975f4772e1b913ea617edee400ad60b25f8561f34892b8b5b74eeccab4a8c7f

SHA512
47ef7eae78faacea0e9061ecadd0871b0ec72b0d5bf3e223b9ee9e6190df7cf19b41984eec37832a83eb137c34d7d2f683626f2ec225bfa26d839646b35d2c1d

Download Submit
C:\Windows\System\BEoqgoF.exe

Filesize
1.8MB

MD5
362637c57fc50aa17063a8e45b0164b8

SHA1
bd180168f83be29b3653ca13ff54d8bcc761a607

SHA256
21ca9941650dd14ddf5d8e42e6b7ca2d75541500917955bfbc771658063f86d5

SHA512
8690ba2aff113aab2d3bc5e141ac847ca814aab91e7479524fc16c2e93ffd7ef7b1c5ad351fb07b08c864394d3e82e2d8073d739e90eff0b7f55f008ecfc2d23

Download Submit
C:\Windows\System\BHravAp.exe

Filesize
8B

MD5
fbef424b1922acb531e69f596a8b8921

SHA1
584ada3a02d95facb3db59252be930cc2019a07e

SHA256
9ba99dfe86f586665444906d4d6c065235a1faa079a57e34597feec2870450c4

SHA512
b7c856eeb52f1f5b978a86cc276964a598136109586a3999d60402c0885755b7f0a6e5ca90b5856e8f2e8d74fc885b0d7e257ea62c297369572d765724b94880

Download Submit
C:\Windows\System\GBDwCFb.exe

Filesize
1.8MB

MD5
693f83e778fe0cd7b0094617217872dd

SHA1
27891d0e89e341231a01546906aad07273732230

SHA256
cf600fd60ab4d478a9c8d1df62191dce0c62629a89f028466b6b93c747aeba59

SHA512
1c9961d697bf5e3bc29d3fe2976702f2a3a87746233ecd3e5dd7ec4a940690c6cac6f9c62cbcae6f517e37830d622f2c78a289bb654d6fd314283cf05530186d

Download Submit
C:\Windows\System\GKFQqUM.exe

Filesize
18B

MD5
eaae1f3b7beb3274801231b6a1757b3b

SHA1
c9ba05a4f2d6890ec14b998fd149757ff51e1d25

SHA256
2c49c25b512bec1585049dae8f4ce08598bec7fa52045234579c255a76f2b533

SHA512
174887d02daaf33b8bac83b6a72a1570e5f9f1824cb795cc9b96aedf583e8e085c48f62ebacc87997a726027c015b261b2877b3b01d68ecd33fc3336b93511d3

Download Submit
C:\Windows\System\GheLHUU.exe

Filesize
1.8MB

MD5
b2f3ea34f3b82ac9cb5bf0e2a2addb2d

SHA1
4c85ffc8fa2775e162395a93d8c9128c98faf786

SHA256
bebede806d9946a686d8aec32138fdeee2bbb5cf7a1889c2304afa25803198c6

SHA512
4cdc5749a8da519db22bdff36d4a989cbab642aae452f070d6cfc0361b82d1d55ee6f25e6ff6d66d04f782f2d8196977b11b0ee44f258557055c85beaca3aa8a

Download Submit
C:\Windows\System\IKQCkBh.exe

Filesize
1.8MB

MD5
febb2adc5640e251be4edb1a9a0c5b76

SHA1
725cb9821878772ac690fed690ffb5a51e41b059

SHA256
081ba34a33ddea096f710a3eba7c1d6cb5f7cf598a07951c6d7cf2be84511f1e

SHA512
4532e436c44a7afd4218c0e2ef52f7db88ae8a97304a8aaf519b7b7b322ee81df33211f7a20b84f98854d97fd6a410d339ae2bc7d55f1e71ee381a310414f8ed

Download Submit
C:\Windows\System\JGTxbDe.exe

Filesize
1.8MB

MD5
f862264cc67fc778c7c2fc4bef7089c0

SHA1
913601f9531b9746befa7067e9cbcfc3d96c9784

SHA256
4553a0c27db50fa8b394b4ed5c70810a75d69edeab92ac303dc3bf583ee4a511

SHA512
be4d3231452cf06f4eca56219b14f97972898eac4bbb493fb6ba37ea122b77c6154e20bee4f415524b7a7fb062a21095a735077e353d60d4eda13bcfafe7e240

Download Submit
C:\Windows\System\KBXFWuz.exe

Filesize
1.8MB

MD5
4f03c7e81c496bd3affc79aeee7f1ac4

SHA1
706da79eea89dac44ead1a12741ec672318a0aa7

SHA256
54aa453eeebc29a5d033c39cf5424607e57ca5022c0c7f7498f16385d5f72055

SHA512
d1864858239725a1505fa429fc3c8086444899c21d05fecc629fa6d5cc44fbb252951d58be32cc1cddecf7e53a77f65ee39d6429e4566d450a03b14e47c7e964

Download Submit
C:\Windows\System\KtWILbN.exe

Filesize
1.8MB

MD5
a3af5d8624e5310f401e917d8b171c5e

SHA1
39c624e7b54270e57cd8c53b246fb6d10fa02b56

SHA256
e00d69bdf57ec106f79d4d6463ce2bfa8a09c7da53da8c324a252eb5bf3bb675

SHA512
d6614891b98f1279c4139ae2cfd525bc0448da5c28d2c3b5623eb9300ade13e2109afa4c54dc3a6bc58cb3ba3e1d0bef420f4a9c3a1c1946f3efad65fae8dab2

Download Submit
C:\Windows\System\KtcTmEK.exe

Filesize
1.8MB

MD5
23564c31709c40be362def71f3ad60e0

SHA1
1e43d89960fd0d3640078ba05b4b5f65cf2f2338

SHA256
0c597ddb27555f9c910287d4e79c8d877269690e22ac1041ef86f71a05941b55

SHA512
210ddbe1cb7bd1df1166457b2695922ce8444991553d2381b5a8f58e7c3850e5d73cf29da55c910d74f5f67b15c2f54c6a85b38e6e61be54f87dd8b7e2d36db8

Download Submit
C:\Windows\System\LsMbdeB.exe

Filesize
1.8MB

MD5
7094a5c00158e2a00f44d2b0f8a0badf

SHA1
c2b4b3550ec5b146432115f578f95a421c76d718

SHA256
f72b66c8d21371deaaf27ab4cc71e99c383bcb031cb6bcc4ed8fdd3471af09f0

SHA512
e9d1f6bfc56cfad8589b39c8054f3c62a7473bddc53da2e5af62f31c1d1badf34a0327dc2229e52c3a553ae1176cb041c3e4fdc2c38a458e3e233096355667fc

Download Submit
C:\Windows\System\NCkGFjx.exe

Filesize
1.8MB

MD5
ab4caf1d572924de4f8f27b19330b7db

SHA1
8a04bf393f29db6422024fba19b1166d22f4171d

SHA256
ec1c1a53cf334d411586846c1ce80e70a32e6f1feaa8e9d10dc2862bacd3c07e

SHA512
d823d44c9a12be5efbc2c815abd50032f46b065d89e4c5add0d3b41d7314115e4b6b638697c461a4d03b11b37946818dbfd1c03a67f279d0a144b52585f3f5d8

Download Submit
C:\Windows\System\NGEOyKA.exe

Filesize
1.8MB

MD5
d7070e7eff20910b7ff3c1e3fc7ad3f0

SHA1
44485e1532d783417edf143e41342c697a060f55

SHA256
71fa03483eff1507b442db3baba570b517f41ace54849c794d8b82f4b89583df

SHA512
a300a010319a116d5e99fe52e741f6ca94be81a8553aebb219448c7320be416564aa73f073d63a0ca576f73ff58ee5d6f7cd30a334fc0889ac95dced16771a02

Download Submit
C:\Windows\System\OCGkJrg.exe

Filesize
1.8MB

MD5
ce865004dba29b1f1cf738fe3de51ad2

SHA1
26bdcea4160282c2683719553cea0f7df762ccc9

SHA256
44489689beb7dab5a558f45f7cf1cc40dd9c3c1999f492763dd28d0c39cabdf3

SHA512
a01195477f66b4c3347e871d206d7a359d33dce46ae2f863f4805e5b0279ce39abbfff29ce327dfc425097608b3534a5b0c537abf444d4e7dbaaff03883e7f98

Download Submit
C:\Windows\System\PaEjJIS.exe

Filesize
1.8MB

MD5
ad4378153aae3b8d9da054bbe6c106e3

SHA1
d1f3dcfa3db81a3151ef05c6e1e04f3e55d5ba39

SHA256
98ad7aaa78def6e1d664fe972d54033f49bab29ee247bdf1ad1eb296b5505be0

SHA512
a7c876561a2d08edffd3c9ee2cf78c0f228e364b3487f66629d06fffe29dba8b51d38c2ab2467f47a36170bc926f81110b99ef73d8a8236816dfff6d6ff8d213

Download Submit
C:\Windows\System\QUVUBKA.exe

Filesize
1.8MB

MD5
496760ed851ee0cdbd0652a1172ef75e

SHA1
4b08e5895b76f5455f91569b491a8d8e1a54c903

SHA256
b2478583783bbb0d75417625fe115507c3696d0d0593acdbe1a57275e1991d1a

SHA512
449cb243d82eeb60a296417ec5ae71905f2e1f3f9c29e499fed027143ed18e6603c7376132a04c6a135be087a0ab7fa53e22d10437294d9e4495fe931f99ace3

Download Submit
C:\Windows\System\VDhUCtL.exe

Filesize
1.8MB

MD5
a9a4acc6aecae7f004bd22bcebae17b0

SHA1
005c064cb3b97b6ef5c7328c1bbcb892398d9f33

SHA256
4533e3a3a473e43418b9850f9f8c157e2eca60ccbc5f090c1a848fc684225df9

SHA512
4b03b0f46b991905e59477807d7d46b121a77c9611b7823a30dc572fa08abe58bb59cbd90957ad66885a55f9d3028f4d92c8585fdab4c1805781b1f221fc9d06

Download Submit
C:\Windows\System\VdisNYW.exe

Filesize
1.8MB

MD5
ddb6019b4a51456c8575f1b6da048e63

SHA1
047a8fc79e58a80b91fc53d7d80daa91f46f1112

SHA256
be4f2c903ed5b9e65d41f895f278eb6fd5e6e5178c282f6b42a72d09d99885c3

SHA512
c6e47e919994b2d4b942c9e2cd6be13f502e79d32242b7a042012699a571ece3620d8c0414422c39b5217c0fd854bf8e58910afc97ef1f1d751ecb8b12e329ba

Download Submit
C:\Windows\System\VuuDBFV.exe

Filesize
1.8MB

MD5
d2acef47b56d05bb7501d10c35e8d79a

SHA1
f7a977e229997ed19555d3418bb063a83a504d39

SHA256
3b30ce791e0e390d5b16e9da09afa4c39927d5a2cf2d66f59ac6320151925ef8

SHA512
d3fb0bcb31588606c015438332d2db13a3380b2369f9cbf1818269dd23e6efe282698cd2e683cdb1e9c6743d43ad68f6ae32cc22c9ae01356b309efad466ce50

Download Submit
C:\Windows\System\ZhZOaQN.exe

Filesize
1.8MB

MD5
6f416fba50e2b94f342fb868bb2654f0

SHA1
47593c1a65763b596d2a9ac5da9af18954da3656

SHA256
8ade1a7daeb4faa6c8b0a83cdb1335a5aafa569c7efd353d977c9cac445e5ba2

SHA512
62ca09d87fbfb56b79cc68872b6d8355b54ceb6cb7240e5314e7e6f4ecc2153590b63ac7cbc0c209f835da993c5a8ece02f6e62038c019d5ca8443b4cbf2e6d4

Download Submit
C:\Windows\System\gLCbddd.exe

Filesize
1.8MB

MD5
e2ab9cd1ad38d6076a7b030ab05495b1

SHA1
913d9369477a1dd6b71483c10df1e5039aac116c

SHA256
14d6939226a88656cd282a4a70771a64a8625eac9c8ffeb5cef547d6be393064

SHA512
881c63c6d40abe29d5df4d15ea6237f24e8db56f2018a7eb02f256f80244e7fcbeee1e6cbf363f6d2cbe36b4b1e7128be800adf1b2a89b2a65fb002cccb02097

Download Submit
C:\Windows\System\koYSPOF.exe

Filesize
1.8MB

MD5
b72ebeae5e2330a48c3dad57ad3c4d9c

SHA1
2a795b0f4c7930a1fe38ea664225fba32d0e541e

SHA256
b5385931674a503deb62d17816153ac0962f24d3386495bde031f004b3e8f690

SHA512
8c3d7cccc47208eef5a1818f5d25b1dbdb40439154f0ba48a714c7072b44b772b2721a1596d4afa00f7e87a2f740f5aeff17f1c1fbbcf71278d5feec395c5f7d

Download Submit
C:\Windows\System\qZMngCO.exe

Filesize
1.8MB

MD5
8f0992248c2092f966579989d477ef58

SHA1
236dede3fcf1dcf7253bb5b67eb0e1d12814c11f

SHA256
431b6fedb28b66fb490a38397d59bc3eaf778f2b3a24b1ed60ce495aca7220d7

SHA512
a467e10a8ec2444e4878f22a90c234cf9677c11f3e85f4ba730c3eede8a8398b56b18aacc35f448bb2d6ab70b6a0bc8ebec142c1737bc8fe663758ee3e203ac7

Download Submit
C:\Windows\System\rTneiAB.exe

Filesize
1.8MB

MD5
f7414b5faa85097f64d897485ee0f0c1

SHA1
3f0bfdc77790ffa8255da7eeeeafa449af5f78ef

SHA256
8bd733cf8711936d75a11a38fcfc27b6ed14527e611c9bb7fa7793d80f4c0bb7

SHA512
be7451f4037a6a58d42301e5979551044f63fa204c6a548296b81b0e0ba037d810496bd5f01febe137729633f3ad60f3e0d65894b2aa2158e4a2fff88b020629

Download Submit
C:\Windows\System\sUCNGnl.exe

Filesize
1.8MB

MD5
244c2c949019bd1552bfdd7b915a5136

SHA1
179ea56d71593c1eef891572f6b279664513664c

SHA256
da1b7941171000e50063c3c53d16c8e5e65fef91c7e5a7413e87ed7fc801e24b

SHA512
a4f1e0b69083f6fc88c1308cf0fab7efbc43e8facec47359694bbc93001f1eb9db3b7bb68060090a7b123d165d8462fc1ad5dde813e56da365e1a6784c7bed36

Download Submit
C:\Windows\System\tCjQmBQ.exe

Filesize
1.8MB

MD5
ced1039ba7edbaa5d020b43e29246917

SHA1
3ea66985f860345bc3269ee499851a06892709d4

SHA256
58d53ee426602214a2210582f418930a865289c1d428812ce7bd9d8c9136e7c3

SHA512
e430759d368cb3f930f2834f4284d6d289a1585adfd12154e30bd0575bbc7ec3ba0c893f293670d688df35dc0b424fffe59ad75b5da40717d136ca3b04706ead

Download Submit
C:\Windows\System\taTYXvV.exe

Filesize
1.8MB

MD5
d1aa1dd144db5890f482233a28087412

SHA1
e5f707619fbec379f69a81427efc1619b1e9aff6

SHA256
952af6e34f3542d3c98397819c47ee17c1e127e2f720469ba2c18e1f90377f5a

SHA512
54f936a5c2e937b8f2bb6d9a8d42436b181d55696c492a8fb3a9bbf66b3b5c6d6061d4029fff943da4e3f2cc82891141c9bbe52413458d49effef64929e9a17d

Download Submit
C:\Windows\System\teoGihv.exe

Filesize
1.8MB

MD5
05d04d0115dac4211115ec692a19d342

SHA1
25d9473688232def6e35c597374e1d2abf2486ae

SHA256
ab45806765bdeeffb5876239e141bbeabef53c519aae24df8544b518ece4eba5

SHA512
707dac36c920350b9ecf4c0e005b1a19957d88ddd35bde4ecf7be9dfc0e64ab82081433ffcdba2010469fad5dc4061a8dc7dad540c86caf4ea98c4bb1db13f8b

Download Submit
C:\Windows\System\tjDqDZZ.exe

Filesize
1.8MB

MD5
6e9ebe155b87d93cee8b5c5131cbcbf0

SHA1
86f7853b1209020ad2e2efb87dc7aa288d228fa6

SHA256
65e55d377290f2bb1079b2cb3ae4a0445be160f291b093b9da219793b543915e

SHA512
d79fda5aa4aa1f1530bfaa99daa29c9362a160728176dfa8b3351ebd3fea273f65bab2b643dede04a4e52c629fc430704f0855a62a77101226272492538837c6

Download Submit
C:\Windows\System\wjlAhaA.exe

Filesize
1.8MB

MD5
6617657d90ba0917166de38f85972bd4

SHA1
7142e866ab307e5aeb960ba6145823f33c7cf13b

SHA256
5f5762c59bff139f2fe552f08c1e6fe77aa90fb1f17cc37a861fb0e3d20756db

SHA512
20ddcd2b563f355958aa0814210c836abdbae52e7b0f971048cf3cbcb4bb5f7d8f5138211594ce3aaa9c118b0ad721e66d62ac1a2c6cda2878e817cd9909eaae

Download Submit
C:\Windows\System\wtCftpH.exe

Filesize
1.8MB

MD5
0d8247f89c9c958cd9d268b60ce982a3

SHA1
09083bffd4f130c345450808953ddbf5fcb55743

SHA256
7cd0c311cac02ac7af4f8b41f34c5645e5488b0cf8a440a0b35da00d736b3d7b

SHA512
9de20df3b1205629500e85641b3e6ac9a63f4b3c93c2fc8f972faf04532101d1c16344013aa4e1c68a8e327977aa0b209b006d42b12524680de21d3ef6ce5255

Download Submit
C:\Windows\System\yCTbQMv.exe

Filesize
1.8MB

MD5
a1a92801d8ed8c5b4a877ecadc649127

SHA1
b1ad38395a16558c54513a8fb8f187ba92855d83

SHA256
b827ede0ef2a0723a6ee7c27a8d1ba61d5f97b2307a0983489c1d6e3409d19f5

SHA512
12bc42f51bb98ba5a34d8a982deb5610018bc7945ee9cc39dbf9dd57e9816c779501dd434d0881cd8e26fbf724076d03c7eddfe17026092c838ac747474709e4

Download Submit
C:\Windows\System\yDrYhDM.exe

Filesize
1.8MB

MD5
663ce6ed89d736865c1ec7adcb28f7fc

SHA1
f4246d2b415c44177297309b7942419f7a7db557

SHA256
8afaf2ed7d3dbb43d45b9b44460cc3e2e6cae1929c92db220ee1a317bdb476bd

SHA512
cc3e4343407bae3023ee94a2fa405a7cca92417597cbd6e02c3fcaf5160e26c2246b4a41c41cafcc5dc393df4230a763f137520ed18ecab30aa4ae446fd3b79f

Download Submit
C:\Windows\System\yOAPnbC.exe

Filesize
1.8MB

MD5
b6f66ba7cb7bb099db82f83e9c6a7920

SHA1
0bca5972442d3275b7ab07c61882a297708d757f

SHA256
aa54d32d1997a27e005408e949c7835391aa2f5ac30b79c601082258242f29da

SHA512
d0a4f499a896ac561be4870561f171320d4f7a44fe83a85f414c11d343bdd9634e32d3d60588cebffdcd8cce68e975fef0d6fc672ad71f95b65c4dba702c3229

Download Submit
memory/548-212-0x00007FF6058E0000-0x00007FF605CD2000-memory.dmp

Filesize
3.9MB

Download
memory/780-32-0x00007FF710210000-0x00007FF710602000-memory.dmp

Filesize
3.9MB

Download
memory/916-213-0x00007FF710D20000-0x00007FF711112000-memory.dmp

Filesize
3.9MB

Download
memory/916-3826-0x00007FF710D20000-0x00007FF711112000-memory.dmp

Filesize
3.9MB

Download
memory/1292-3766-0x00007FF78EA80000-0x00007FF78EE72000-memory.dmp

Filesize
3.9MB

Download
memory/1292-53-0x00007FF78EA80000-0x00007FF78EE72000-memory.dmp

Filesize
3.9MB

Download
memory/1452-3752-0x00007FF791820000-0x00007FF791C12000-memory.dmp

Filesize
3.9MB

Download
memory/1452-52-0x00007FF791820000-0x00007FF791C12000-memory.dmp

Filesize
3.9MB

Download
memory/1976-145-0x00007FF6BBF90000-0x00007FF6BC382000-memory.dmp

Filesize
3.9MB

Download
memory/1976-3850-0x00007FF6BBF90000-0x00007FF6BC382000-memory.dmp

Filesize
3.9MB

Download
memory/2288-211-0x00007FF7B4340000-0x00007FF7B4732000-memory.dmp

Filesize
3.9MB

Download
memory/2332-209-0x00007FF7604C0000-0x00007FF7608B2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-3891-0x00007FF7604C0000-0x00007FF7608B2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-1-0x00000238DD7C0000-0x00000238DD7D0000-memory.dmp

Filesize
64KB

Download
memory/2684-0-0x00007FF712980000-0x00007FF712D72000-memory.dmp

Filesize
3.9MB

Download
memory/3076-3830-0x00007FF628C20000-0x00007FF629012000-memory.dmp

Filesize
3.9MB

Download
memory/3076-195-0x00007FF628C20000-0x00007FF629012000-memory.dmp

Filesize
3.9MB

Download
memory/3380-3887-0x00007FF7F2730000-0x00007FF7F2B22000-memory.dmp

Filesize
3.9MB

Download
memory/3380-207-0x00007FF7F2730000-0x00007FF7F2B22000-memory.dmp

Filesize
3.9MB

Download
memory/3436-181-0x00007FF75B3F0000-0x00007FF75B7E2000-memory.dmp

Filesize
3.9MB

Download
memory/3436-3816-0x00007FF75B3F0000-0x00007FF75B7E2000-memory.dmp

Filesize
3.9MB

Download
memory/3624-139-0x00007FF7CD400000-0x00007FF7CD7F2000-memory.dmp

Filesize
3.9MB

Download
memory/3624-3796-0x00007FF7CD400000-0x00007FF7CD7F2000-memory.dmp

Filesize
3.9MB

Download
memory/3908-3873-0x00007FF605840000-0x00007FF605C32000-memory.dmp

Filesize
3.9MB

Download
memory/3908-196-0x00007FF605840000-0x00007FF605C32000-memory.dmp

Filesize
3.9MB

Download
memory/4112-3890-0x00007FF6189D0000-0x00007FF618DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4112-208-0x00007FF6189D0000-0x00007FF618DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4196-3827-0x00007FF720FE0000-0x00007FF7213D2000-memory.dmp

Filesize
3.9MB

Download
memory/4196-214-0x00007FF720FE0000-0x00007FF7213D2000-memory.dmp

Filesize
3.9MB

Download
memory/4448-204-0x00007FF6BB8D0000-0x00007FF6BBCC2000-memory.dmp

Filesize
3.9MB

Download
memory/4448-3880-0x00007FF6BB8D0000-0x00007FF6BBCC2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-182-0x000001E26BAC0000-0x000001E26BAE2000-memory.dmp

Filesize
136KB

Download
memory/4588-325-0x000001E26E880000-0x000001E26F026000-memory.dmp

Filesize
7.6MB

Download
memory/4588-7000-0x00007FFA45DA3000-0x00007FFA45DA5000-memory.dmp

Filesize
8KB

Download
memory/4588-210-0x00007FFA45DA0000-0x00007FFA46861000-memory.dmp

Filesize
10.8MB

Download
memory/4588-54-0x00007FFA45DA3000-0x00007FFA45DA5000-memory.dmp

Filesize
8KB

Download
memory/4588-123-0x00007FFA45DA0000-0x00007FFA46861000-memory.dmp

Filesize
10.8MB

Download
memory/4592-43-0x00007FF6EC1A0000-0x00007FF6EC592000-memory.dmp

Filesize
3.9MB

Download
memory/4872-205-0x00007FF68E950000-0x00007FF68ED42000-memory.dmp

Filesize
3.9MB

Download
memory/4872-3857-0x00007FF68E950000-0x00007FF68ED42000-memory.dmp

Filesize
3.9MB

Download
memory/4920-3840-0x00007FF6D6DE0000-0x00007FF6D71D2000-memory.dmp

Filesize
3.9MB

Download
memory/4920-206-0x00007FF6D6DE0000-0x00007FF6D71D2000-memory.dmp

Filesize
3.9MB

Download
memory/4968-138-0x00007FF785BB0000-0x00007FF785FA2000-memory.dmp

Filesize
3.9MB

Download
memory/4968-3837-0x00007FF785BB0000-0x00007FF785FA2000-memory.dmp

Filesize
3.9MB

Download
memory/5028-14-0x00007FF6A8620000-0x00007FF6A8A12000-memory.dmp

Filesize
3.9MB

Download
memory/5036-3885-0x00007FF7BF0A0000-0x00007FF7BF492000-memory.dmp

Filesize
3.9MB

Download
memory/5036-194-0x00007FF7BF0A0000-0x00007FF7BF492000-memory.dmp

Filesize
3.9MB

Download
memory/5048-3846-0x00007FF61AEF0000-0x00007FF61B2E2000-memory.dmp

Filesize
3.9MB

Download
memory/5048-140-0x00007FF61AEF0000-0x00007FF61B2E2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-3784-0x00007FF652E50000-0x00007FF653242000-memory.dmp

Filesize
3.9MB

Download
memory/5112-137-0x00007FF652E50000-0x00007FF653242000-memory.dmp

Filesize
3.9MB

Download