xmrig | 05021dc1b621144bdbe39711a0bd9bcc42d3aca24ec1ee02c8b1badb362ca603

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09271a338ed85a96c6431fc9cb821720N.exe
Size

1.8MB
MD5

09271a338ed85a96c6431fc9cb821720
SHA1

e2c3e9a7629c751cebe809791442ac5cf56b29d5
SHA256

05021dc1b621144bdbe39711a0bd9bcc42d3aca24ec1ee02c8b1badb362ca603
SHA512

c31028b18012be79cbc830904eb0a79509aa89e1b1d1707cf15cfd9f95e3fe4feb772118d3e403f2df902d5f6fd940c81045a93d83d3dc509aa70babfefa39da
SSDEEP

49152:Lz071uv4BPMkHC0IlnASEx/z+cl8WNG/Wnqnc:NABt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/4640-251-0x00007FF7BFC00000-0x00007FF7BFFF2000-memory.dmp	xmrig
behavioral2/memory/3040-276-0x00007FF6154D0000-0x00007FF6158C2000-memory.dmp	xmrig
behavioral2/memory/4416-281-0x00007FF74A7C0000-0x00007FF74ABB2000-memory.dmp	xmrig
behavioral2/memory/3968-287-0x00007FF6536B0000-0x00007FF653AA2000-memory.dmp	xmrig
behavioral2/memory/1572-292-0x00007FF74E710000-0x00007FF74EB02000-memory.dmp	xmrig
behavioral2/memory/1228-290-0x00007FF787F30000-0x00007FF788322000-memory.dmp	xmrig
behavioral2/memory/4336-289-0x00007FF618150000-0x00007FF618542000-memory.dmp	xmrig
behavioral2/memory/1316-288-0x00007FF74A9E0000-0x00007FF74ADD2000-memory.dmp	xmrig
behavioral2/memory/212-286-0x00007FF6F7E10000-0x00007FF6F8202000-memory.dmp	xmrig
behavioral2/memory/4280-285-0x00007FF6EFD80000-0x00007FF6F0172000-memory.dmp	xmrig
behavioral2/memory/1532-284-0x00007FF6EE570000-0x00007FF6EE962000-memory.dmp	xmrig
behavioral2/memory/4920-283-0x00007FF63F2B0000-0x00007FF63F6A2000-memory.dmp	xmrig
behavioral2/memory/208-282-0x00007FF684510000-0x00007FF684902000-memory.dmp	xmrig
behavioral2/memory/4884-280-0x00007FF7BBE20000-0x00007FF7BC212000-memory.dmp	xmrig
behavioral2/memory/448-279-0x00007FF7CD7F0000-0x00007FF7CDBE2000-memory.dmp	xmrig
behavioral2/memory/3532-278-0x00007FF6C45B0000-0x00007FF6C49A2000-memory.dmp	xmrig
behavioral2/memory/468-277-0x00007FF7862D0000-0x00007FF7866C2000-memory.dmp	xmrig
behavioral2/memory/372-275-0x00007FF70CD50000-0x00007FF70D142000-memory.dmp	xmrig
behavioral2/memory/4944-274-0x00007FF64DE00000-0x00007FF64E1F2000-memory.dmp	xmrig
behavioral2/memory/2300-273-0x00007FF63D860000-0x00007FF63DC52000-memory.dmp	xmrig
behavioral2/memory/3468-272-0x00007FF73BD50000-0x00007FF73C142000-memory.dmp	xmrig
behavioral2/memory/4812-271-0x00007FF793940000-0x00007FF793D32000-memory.dmp	xmrig
behavioral2/memory/1568-178-0x00007FF6BD510000-0x00007FF6BD902000-memory.dmp	xmrig
behavioral2/memory/1568-2349-0x00007FF6BD510000-0x00007FF6BD902000-memory.dmp	xmrig
behavioral2/memory/4944-2365-0x00007FF64DE00000-0x00007FF64E1F2000-memory.dmp	xmrig
behavioral2/memory/4640-2342-0x00007FF7BFC00000-0x00007FF7BFFF2000-memory.dmp	xmrig
behavioral2/memory/1572-2341-0x00007FF74E710000-0x00007FF74EB02000-memory.dmp	xmrig
behavioral2/memory/372-2320-0x00007FF70CD50000-0x00007FF70D142000-memory.dmp	xmrig
behavioral2/memory/4884-2585-0x00007FF7BBE20000-0x00007FF7BC212000-memory.dmp	xmrig
behavioral2/memory/1532-2596-0x00007FF6EE570000-0x00007FF6EE962000-memory.dmp	xmrig
behavioral2/memory/3968-2574-0x00007FF6536B0000-0x00007FF653AA2000-memory.dmp	xmrig
behavioral2/memory/1228-2567-0x00007FF787F30000-0x00007FF788322000-memory.dmp	xmrig
behavioral2/memory/208-2509-0x00007FF684510000-0x00007FF684902000-memory.dmp	xmrig
behavioral2/memory/448-2479-0x00007FF7CD7F0000-0x00007FF7CDBE2000-memory.dmp	xmrig
behavioral2/memory/3532-2426-0x00007FF6C45B0000-0x00007FF6C49A2000-memory.dmp	xmrig
behavioral2/memory/2300-2424-0x00007FF63D860000-0x00007FF63DC52000-memory.dmp	xmrig
behavioral2/memory/4280-2415-0x00007FF6EFD80000-0x00007FF6F0172000-memory.dmp	xmrig
behavioral2/memory/4336-2434-0x00007FF618150000-0x00007FF618542000-memory.dmp	xmrig
behavioral2/memory/468-2371-0x00007FF7862D0000-0x00007FF7866C2000-memory.dmp	xmrig
behavioral2/memory/3468-2322-0x00007FF73BD50000-0x00007FF73C142000-memory.dmp	xmrig
behavioral2/memory/1804-2313-0x00007FF664F90000-0x00007FF665382000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	3892	powershell.exe
5	3892	powershell.exe
7	3892	powershell.exe
8	3892	powershell.exe
10	3892	powershell.exe
11	3892	powershell.exe
13	3892	powershell.exe
19	3892	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3892	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1804	BPVrjRO.exe
1568	RcSdcGd.exe
4640	KqKgBDL.exe
4812	AikoOnN.exe
1572	ZQXByNk.exe
3468	rXoHyxE.exe
2300	CbMVBad.exe
4944	jhDqNPd.exe
372	vCjzuFO.exe
3040	SLLcelu.exe
468	CbspAFy.exe
3532	xAeGhxv.exe
448	uCmJKRj.exe
4884	BaHmFOE.exe
4416	oJZBOpo.exe
208	zVtdQeg.exe
4920	BixhhjG.exe
1532	Fivtsiw.exe
4280	uksJMgg.exe
212	YTvCPjT.exe
3968	UFAiRcJ.exe
1316	toZimYZ.exe
4336	nQivbrV.exe
1228	UuWwGzN.exe
3832	utHVHnE.exe
396	yKCnYXU.exe
948	ySIJggO.exe
4204	PSplTGJ.exe
2244	KZlhlsi.exe
3420	WrYrhpq.exe
4668	ntlgAGK.exe
4504	jkHTZPx.exe
608	CWOKQPV.exe
2032	IwURCxP.exe
1524	GscNxej.exe
2740	YdsdZfK.exe
4108	pSbiLAt.exe
1324	tyrENmi.exe
2096	qeDceEJ.exe
2448	uKKLuCw.exe
4960	vgpzQys.exe
2404	oHadnvG.exe
1504	wJsbjgS.exe
4860	ECEVeGo.exe
3608	MfhEODA.exe
4184	WIefdOD.exe
4364	SveHSKP.exe
1168	vWqRHxH.exe
2192	ugFWGxB.exe
4956	pQgCioq.exe
4820	VBclGcf.exe
1640	PJeieqb.exe
3648	cyIcxUI.exe
4724	bajPkXr.exe
1944	SVFuxQX.exe
3960	qDmxxPv.exe
3644	wTKnZag.exe
3708	sKdeSxX.exe
2692	JYlwsgL.exe
4764	ZJDgsCu.exe
3888	RdvNIWe.exe
4984	rjuGIsv.exe
4912	LoEUoFT.exe
4312	KEdLxwi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/776-0-0x00007FF6FDC70000-0x00007FF6FE062000-memory.dmp	upx
behavioral2/files/0x0006000000023287-6.dat	upx
behavioral2/files/0x000a0000000234f9-31.dat	upx
behavioral2/files/0x0007000000023513-109.dat	upx
behavioral2/files/0x0007000000023521-192.dat	upx
behavioral2/memory/4640-251-0x00007FF7BFC00000-0x00007FF7BFFF2000-memory.dmp	upx
behavioral2/memory/3040-276-0x00007FF6154D0000-0x00007FF6158C2000-memory.dmp	upx
behavioral2/memory/4416-281-0x00007FF74A7C0000-0x00007FF74ABB2000-memory.dmp	upx
behavioral2/memory/3968-287-0x00007FF6536B0000-0x00007FF653AA2000-memory.dmp	upx
behavioral2/memory/1572-292-0x00007FF74E710000-0x00007FF74EB02000-memory.dmp	upx
behavioral2/memory/1228-290-0x00007FF787F30000-0x00007FF788322000-memory.dmp	upx
behavioral2/memory/4336-289-0x00007FF618150000-0x00007FF618542000-memory.dmp	upx
behavioral2/memory/1316-288-0x00007FF74A9E0000-0x00007FF74ADD2000-memory.dmp	upx
behavioral2/memory/212-286-0x00007FF6F7E10000-0x00007FF6F8202000-memory.dmp	upx
behavioral2/memory/4280-285-0x00007FF6EFD80000-0x00007FF6F0172000-memory.dmp	upx
behavioral2/memory/1532-284-0x00007FF6EE570000-0x00007FF6EE962000-memory.dmp	upx
behavioral2/memory/4920-283-0x00007FF63F2B0000-0x00007FF63F6A2000-memory.dmp	upx
behavioral2/memory/208-282-0x00007FF684510000-0x00007FF684902000-memory.dmp	upx
behavioral2/memory/4884-280-0x00007FF7BBE20000-0x00007FF7BC212000-memory.dmp	upx
behavioral2/memory/448-279-0x00007FF7CD7F0000-0x00007FF7CDBE2000-memory.dmp	upx
behavioral2/memory/3532-278-0x00007FF6C45B0000-0x00007FF6C49A2000-memory.dmp	upx
behavioral2/memory/468-277-0x00007FF7862D0000-0x00007FF7866C2000-memory.dmp	upx
behavioral2/memory/372-275-0x00007FF70CD50000-0x00007FF70D142000-memory.dmp	upx
behavioral2/memory/4944-274-0x00007FF64DE00000-0x00007FF64E1F2000-memory.dmp	upx
behavioral2/memory/2300-273-0x00007FF63D860000-0x00007FF63DC52000-memory.dmp	upx
behavioral2/memory/3468-272-0x00007FF73BD50000-0x00007FF73C142000-memory.dmp	upx
behavioral2/memory/4812-271-0x00007FF793940000-0x00007FF793D32000-memory.dmp	upx
behavioral2/files/0x0007000000023520-187.dat	upx
behavioral2/files/0x0007000000023518-182.dat	upx
behavioral2/memory/1568-178-0x00007FF6BD510000-0x00007FF6BD902000-memory.dmp	upx
behavioral2/files/0x000700000002351e-177.dat	upx
behavioral2/files/0x0007000000023512-171.dat	upx
behavioral2/files/0x0007000000023515-167.dat	upx
behavioral2/files/0x000700000002351d-166.dat	upx
behavioral2/files/0x000700000002351c-163.dat	upx
behavioral2/files/0x000700000002351a-157.dat	upx
behavioral2/files/0x000700000002350d-152.dat	upx
behavioral2/files/0x0007000000023519-148.dat	upx
behavioral2/files/0x000700000002350c-142.dat	upx
behavioral2/files/0x0007000000023506-140.dat	upx
behavioral2/files/0x000700000002351f-181.dat	upx
behavioral2/files/0x0007000000023517-136.dat	upx
behavioral2/files/0x0007000000023516-135.dat	upx
behavioral2/files/0x00090000000234f3-134.dat	upx
behavioral2/files/0x0007000000023510-127.dat	upx
behavioral2/files/0x0007000000023509-126.dat	upx
behavioral2/files/0x000700000002351b-162.dat	upx
behavioral2/files/0x0007000000023514-160.dat	upx
behavioral2/files/0x0007000000023507-120.dat	upx
behavioral2/files/0x000700000002350b-113.dat	upx
behavioral2/files/0x0007000000023508-111.dat	upx
behavioral2/files/0x0007000000023511-102.dat	upx
behavioral2/files/0x000700000002350a-96.dat	upx
behavioral2/files/0x000700000002350f-92.dat	upx
behavioral2/files/0x0007000000023503-89.dat	upx
behavioral2/files/0x0007000000023502-83.dat	upx
behavioral2/files/0x000700000002350e-88.dat	upx
behavioral2/files/0x00070000000234fe-63.dat	upx
behavioral2/files/0x0007000000023505-55.dat	upx
behavioral2/files/0x0007000000023504-76.dat	upx
behavioral2/files/0x0007000000023501-44.dat	upx
behavioral2/files/0x0007000000023500-52.dat	upx
behavioral2/memory/1804-27-0x00007FF664F90000-0x00007FF665382000-memory.dmp	upx
behavioral2/files/0x00070000000234ff-23.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DvmumsF.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\KLCnutO.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\CcFhYVS.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\OfuBVid.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\dwnjPfZ.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\YtOuTdw.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\UvoPtkX.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\IZYQquf.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\oBdrVNI.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\loZIwRd.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\jJOQWXY.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\iSykubz.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\TkGnFVv.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\pWQpQvP.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\FqjGJyU.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\LMENZIy.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\JwFETXw.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\Galrlcl.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\MwTnPXz.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\DLyTVKJ.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\MYiyLip.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\wrKKBeW.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\VlHYNHt.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\CgkLHGy.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\ixsWKXp.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\TJKuiDF.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\jwuUphu.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\UKniEJt.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\NBpqDfX.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\xUhBVcS.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\KmnnZgF.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\FdkczzV.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\RYxsJHP.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\ywkWSjw.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\FKrtrAb.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\foFlpol.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\DlSicir.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\FkmDWOF.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\TkSOIYg.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\MWyzlbV.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\wmFqEFz.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\MfinwhX.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\iIjDURY.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\PYQZjJH.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\QqRItfv.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\jARsubD.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\GnlSKvB.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\hifrUrb.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\JzlltzV.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\wwZfxLd.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\NlfuAzd.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\itMxqFj.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\XpYeMpI.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\nvezosY.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\Jjmmppw.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\VMxYUJe.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\KJLDTGY.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\erHBAFS.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\sNOGPxM.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\JOwNdqg.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\ejyLzbI.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\XlDEMEU.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\jneKCEw.exe	09271a338ed85a96c6431fc9cb821720N.exe
File created	C:\Windows\System\oUSJJsW.exe	09271a338ed85a96c6431fc9cb821720N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	776	09271a338ed85a96c6431fc9cb821720N.exe
Token: SeLockMemoryPrivilege	776	09271a338ed85a96c6431fc9cb821720N.exe
Token: SeDebugPrivilege	3892	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 3892	776	09271a338ed85a96c6431fc9cb821720N.exe	83
PID 776 wrote to memory of 3892	776	09271a338ed85a96c6431fc9cb821720N.exe	83
PID 776 wrote to memory of 1804	776	09271a338ed85a96c6431fc9cb821720N.exe	84
PID 776 wrote to memory of 1804	776	09271a338ed85a96c6431fc9cb821720N.exe	84
PID 776 wrote to memory of 1568	776	09271a338ed85a96c6431fc9cb821720N.exe	85
PID 776 wrote to memory of 1568	776	09271a338ed85a96c6431fc9cb821720N.exe	85
PID 776 wrote to memory of 4640	776	09271a338ed85a96c6431fc9cb821720N.exe	86
PID 776 wrote to memory of 4640	776	09271a338ed85a96c6431fc9cb821720N.exe	86
PID 776 wrote to memory of 4812	776	09271a338ed85a96c6431fc9cb821720N.exe	87
PID 776 wrote to memory of 4812	776	09271a338ed85a96c6431fc9cb821720N.exe	87
PID 776 wrote to memory of 1572	776	09271a338ed85a96c6431fc9cb821720N.exe	88
PID 776 wrote to memory of 1572	776	09271a338ed85a96c6431fc9cb821720N.exe	88
PID 776 wrote to memory of 3468	776	09271a338ed85a96c6431fc9cb821720N.exe	89
PID 776 wrote to memory of 3468	776	09271a338ed85a96c6431fc9cb821720N.exe	89
PID 776 wrote to memory of 2300	776	09271a338ed85a96c6431fc9cb821720N.exe	90
PID 776 wrote to memory of 2300	776	09271a338ed85a96c6431fc9cb821720N.exe	90
PID 776 wrote to memory of 468	776	09271a338ed85a96c6431fc9cb821720N.exe	91
PID 776 wrote to memory of 468	776	09271a338ed85a96c6431fc9cb821720N.exe	91
PID 776 wrote to memory of 4944	776	09271a338ed85a96c6431fc9cb821720N.exe	92
PID 776 wrote to memory of 4944	776	09271a338ed85a96c6431fc9cb821720N.exe	92
PID 776 wrote to memory of 372	776	09271a338ed85a96c6431fc9cb821720N.exe	93
PID 776 wrote to memory of 372	776	09271a338ed85a96c6431fc9cb821720N.exe	93
PID 776 wrote to memory of 448	776	09271a338ed85a96c6431fc9cb821720N.exe	94
PID 776 wrote to memory of 448	776	09271a338ed85a96c6431fc9cb821720N.exe	94
PID 776 wrote to memory of 3040	776	09271a338ed85a96c6431fc9cb821720N.exe	95
PID 776 wrote to memory of 3040	776	09271a338ed85a96c6431fc9cb821720N.exe	95
PID 776 wrote to memory of 3532	776	09271a338ed85a96c6431fc9cb821720N.exe	96
PID 776 wrote to memory of 3532	776	09271a338ed85a96c6431fc9cb821720N.exe	96
PID 776 wrote to memory of 4884	776	09271a338ed85a96c6431fc9cb821720N.exe	97
PID 776 wrote to memory of 4884	776	09271a338ed85a96c6431fc9cb821720N.exe	97
PID 776 wrote to memory of 4416	776	09271a338ed85a96c6431fc9cb821720N.exe	98
PID 776 wrote to memory of 4416	776	09271a338ed85a96c6431fc9cb821720N.exe	98
PID 776 wrote to memory of 1316	776	09271a338ed85a96c6431fc9cb821720N.exe	99
PID 776 wrote to memory of 1316	776	09271a338ed85a96c6431fc9cb821720N.exe	99
PID 776 wrote to memory of 1228	776	09271a338ed85a96c6431fc9cb821720N.exe	100
PID 776 wrote to memory of 1228	776	09271a338ed85a96c6431fc9cb821720N.exe	100
PID 776 wrote to memory of 208	776	09271a338ed85a96c6431fc9cb821720N.exe	101
PID 776 wrote to memory of 208	776	09271a338ed85a96c6431fc9cb821720N.exe	101
PID 776 wrote to memory of 4920	776	09271a338ed85a96c6431fc9cb821720N.exe	102
PID 776 wrote to memory of 4920	776	09271a338ed85a96c6431fc9cb821720N.exe	102
PID 776 wrote to memory of 1532	776	09271a338ed85a96c6431fc9cb821720N.exe	103
PID 776 wrote to memory of 1532	776	09271a338ed85a96c6431fc9cb821720N.exe	103
PID 776 wrote to memory of 4280	776	09271a338ed85a96c6431fc9cb821720N.exe	104
PID 776 wrote to memory of 4280	776	09271a338ed85a96c6431fc9cb821720N.exe	104
PID 776 wrote to memory of 212	776	09271a338ed85a96c6431fc9cb821720N.exe	105
PID 776 wrote to memory of 212	776	09271a338ed85a96c6431fc9cb821720N.exe	105
PID 776 wrote to memory of 3968	776	09271a338ed85a96c6431fc9cb821720N.exe	106
PID 776 wrote to memory of 3968	776	09271a338ed85a96c6431fc9cb821720N.exe	106
PID 776 wrote to memory of 4336	776	09271a338ed85a96c6431fc9cb821720N.exe	107
PID 776 wrote to memory of 4336	776	09271a338ed85a96c6431fc9cb821720N.exe	107
PID 776 wrote to memory of 4504	776	09271a338ed85a96c6431fc9cb821720N.exe	108
PID 776 wrote to memory of 4504	776	09271a338ed85a96c6431fc9cb821720N.exe	108
PID 776 wrote to memory of 3832	776	09271a338ed85a96c6431fc9cb821720N.exe	109
PID 776 wrote to memory of 3832	776	09271a338ed85a96c6431fc9cb821720N.exe	109
PID 776 wrote to memory of 396	776	09271a338ed85a96c6431fc9cb821720N.exe	110
PID 776 wrote to memory of 396	776	09271a338ed85a96c6431fc9cb821720N.exe	110
PID 776 wrote to memory of 948	776	09271a338ed85a96c6431fc9cb821720N.exe	111
PID 776 wrote to memory of 948	776	09271a338ed85a96c6431fc9cb821720N.exe	111
PID 776 wrote to memory of 4204	776	09271a338ed85a96c6431fc9cb821720N.exe	112
PID 776 wrote to memory of 4204	776	09271a338ed85a96c6431fc9cb821720N.exe	112
PID 776 wrote to memory of 2244	776	09271a338ed85a96c6431fc9cb821720N.exe	113
PID 776 wrote to memory of 2244	776	09271a338ed85a96c6431fc9cb821720N.exe	113
PID 776 wrote to memory of 3420	776	09271a338ed85a96c6431fc9cb821720N.exe	114
PID 776 wrote to memory of 3420	776	09271a338ed85a96c6431fc9cb821720N.exe	114

C:\Users\Admin\AppData\Local\Temp\09271a338ed85a96c6431fc9cb821720N.exe
"C:\Users\Admin\AppData\Local\Temp\09271a338ed85a96c6431fc9cb821720N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\System\BPVrjRO.exe
  C:\Windows\System\BPVrjRO.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\RcSdcGd.exe
  C:\Windows\System\RcSdcGd.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\KqKgBDL.exe
  C:\Windows\System\KqKgBDL.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\AikoOnN.exe
  C:\Windows\System\AikoOnN.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\ZQXByNk.exe
  C:\Windows\System\ZQXByNk.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\rXoHyxE.exe
  C:\Windows\System\rXoHyxE.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\CbMVBad.exe
  C:\Windows\System\CbMVBad.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\CbspAFy.exe
  C:\Windows\System\CbspAFy.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\jhDqNPd.exe
  C:\Windows\System\jhDqNPd.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\vCjzuFO.exe
  C:\Windows\System\vCjzuFO.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\uCmJKRj.exe
  C:\Windows\System\uCmJKRj.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\SLLcelu.exe
  C:\Windows\System\SLLcelu.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\xAeGhxv.exe
  C:\Windows\System\xAeGhxv.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\BaHmFOE.exe
  C:\Windows\System\BaHmFOE.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\oJZBOpo.exe
  C:\Windows\System\oJZBOpo.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\toZimYZ.exe
  C:\Windows\System\toZimYZ.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\UuWwGzN.exe
  C:\Windows\System\UuWwGzN.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\zVtdQeg.exe
  C:\Windows\System\zVtdQeg.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\BixhhjG.exe
  C:\Windows\System\BixhhjG.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\Fivtsiw.exe
  C:\Windows\System\Fivtsiw.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\uksJMgg.exe
  C:\Windows\System\uksJMgg.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\YTvCPjT.exe
  C:\Windows\System\YTvCPjT.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\UFAiRcJ.exe
  C:\Windows\System\UFAiRcJ.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\nQivbrV.exe
  C:\Windows\System\nQivbrV.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\jkHTZPx.exe
  C:\Windows\System\jkHTZPx.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\utHVHnE.exe
  C:\Windows\System\utHVHnE.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\yKCnYXU.exe
  C:\Windows\System\yKCnYXU.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\ySIJggO.exe
  C:\Windows\System\ySIJggO.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\PSplTGJ.exe
  C:\Windows\System\PSplTGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\KZlhlsi.exe
  C:\Windows\System\KZlhlsi.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\WrYrhpq.exe
  C:\Windows\System\WrYrhpq.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\ntlgAGK.exe
  C:\Windows\System\ntlgAGK.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\CWOKQPV.exe
  C:\Windows\System\CWOKQPV.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\IwURCxP.exe
  C:\Windows\System\IwURCxP.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\GscNxej.exe
  C:\Windows\System\GscNxej.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\YdsdZfK.exe
  C:\Windows\System\YdsdZfK.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\pSbiLAt.exe
  C:\Windows\System\pSbiLAt.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\tyrENmi.exe
  C:\Windows\System\tyrENmi.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\qeDceEJ.exe
  C:\Windows\System\qeDceEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\uKKLuCw.exe
  C:\Windows\System\uKKLuCw.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\vgpzQys.exe
  C:\Windows\System\vgpzQys.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\oHadnvG.exe
  C:\Windows\System\oHadnvG.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\wJsbjgS.exe
  C:\Windows\System\wJsbjgS.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\ECEVeGo.exe
  C:\Windows\System\ECEVeGo.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\MfhEODA.exe
  C:\Windows\System\MfhEODA.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\WIefdOD.exe
  C:\Windows\System\WIefdOD.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\SveHSKP.exe
  C:\Windows\System\SveHSKP.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\vWqRHxH.exe
  C:\Windows\System\vWqRHxH.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\ugFWGxB.exe
  C:\Windows\System\ugFWGxB.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\pQgCioq.exe
  C:\Windows\System\pQgCioq.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\VBclGcf.exe
  C:\Windows\System\VBclGcf.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\PJeieqb.exe
  C:\Windows\System\PJeieqb.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\cyIcxUI.exe
  C:\Windows\System\cyIcxUI.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\bajPkXr.exe
  C:\Windows\System\bajPkXr.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\SVFuxQX.exe
  C:\Windows\System\SVFuxQX.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\qDmxxPv.exe
  C:\Windows\System\qDmxxPv.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\wTKnZag.exe
  C:\Windows\System\wTKnZag.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\sKdeSxX.exe
  C:\Windows\System\sKdeSxX.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\cJErAxy.exe
  C:\Windows\System\cJErAxy.exe
  2⤵
  PID:3432
- C:\Windows\System\sZxxxQM.exe
  C:\Windows\System\sZxxxQM.exe
  2⤵
  PID:3308
- C:\Windows\System\JYlwsgL.exe
  C:\Windows\System\JYlwsgL.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ZJDgsCu.exe
  C:\Windows\System\ZJDgsCu.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\RdvNIWe.exe
  C:\Windows\System\RdvNIWe.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\rjuGIsv.exe
  C:\Windows\System\rjuGIsv.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\LoEUoFT.exe
  C:\Windows\System\LoEUoFT.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\KEdLxwi.exe
  C:\Windows\System\KEdLxwi.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\BSAKGKZ.exe
  C:\Windows\System\BSAKGKZ.exe
  2⤵
  PID:4832
- C:\Windows\System\QfcWhfa.exe
  C:\Windows\System\QfcWhfa.exe
  2⤵
  PID:4888
- C:\Windows\System\qfsBwbh.exe
  C:\Windows\System\qfsBwbh.exe
  2⤵
  PID:1052
- C:\Windows\System\zWOFKzM.exe
  C:\Windows\System\zWOFKzM.exe
  2⤵
  PID:3396
- C:\Windows\System\GHEUgpb.exe
  C:\Windows\System\GHEUgpb.exe
  2⤵
  PID:1448
- C:\Windows\System\GwqRrKN.exe
  C:\Windows\System\GwqRrKN.exe
  2⤵
  PID:1184
- C:\Windows\System\lsJYrSD.exe
  C:\Windows\System\lsJYrSD.exe
  2⤵
  PID:2724
- C:\Windows\System\hlowBPk.exe
  C:\Windows\System\hlowBPk.exe
  2⤵
  PID:3156
- C:\Windows\System\vPpwZmR.exe
  C:\Windows\System\vPpwZmR.exe
  2⤵
  PID:4780
- C:\Windows\System\mJFECKA.exe
  C:\Windows\System\mJFECKA.exe
  2⤵
  PID:3148
- C:\Windows\System\yqjGYmH.exe
  C:\Windows\System\yqjGYmH.exe
  2⤵
  PID:5116
- C:\Windows\System\EDCwZzp.exe
  C:\Windows\System\EDCwZzp.exe
  2⤵
  PID:1628
- C:\Windows\System\hDFXEZj.exe
  C:\Windows\System\hDFXEZj.exe
  2⤵
  PID:1656
- C:\Windows\System\FAuJOIT.exe
  C:\Windows\System\FAuJOIT.exe
  2⤵
  PID:720
- C:\Windows\System\bUPqiMS.exe
  C:\Windows\System\bUPqiMS.exe
  2⤵
  PID:2588
- C:\Windows\System\DKQQoWY.exe
  C:\Windows\System\DKQQoWY.exe
  2⤵
  PID:2064
- C:\Windows\System\myMiyTk.exe
  C:\Windows\System\myMiyTk.exe
  2⤵
  PID:404
- C:\Windows\System\oeXNlNG.exe
  C:\Windows\System\oeXNlNG.exe
  2⤵
  PID:4052
- C:\Windows\System\iPoErub.exe
  C:\Windows\System\iPoErub.exe
  2⤵
  PID:4816
- C:\Windows\System\srSdGPs.exe
  C:\Windows\System\srSdGPs.exe
  2⤵
  PID:4352
- C:\Windows\System\KXCagmk.exe
  C:\Windows\System\KXCagmk.exe
  2⤵
  PID:1748
- C:\Windows\System\PCQXsBe.exe
  C:\Windows\System\PCQXsBe.exe
  2⤵
  PID:2904
- C:\Windows\System\nWHGfNc.exe
  C:\Windows\System\nWHGfNc.exe
  2⤵
  PID:2944
- C:\Windows\System\ETNslXG.exe
  C:\Windows\System\ETNslXG.exe
  2⤵
  PID:2744
- C:\Windows\System\DFxryeB.exe
  C:\Windows\System\DFxryeB.exe
  2⤵
  PID:2848
- C:\Windows\System\kCYahbp.exe
  C:\Windows\System\kCYahbp.exe
  2⤵
  PID:5124
- C:\Windows\System\oyeRkZU.exe
  C:\Windows\System\oyeRkZU.exe
  2⤵
  PID:5152
- C:\Windows\System\TknBuQU.exe
  C:\Windows\System\TknBuQU.exe
  2⤵
  PID:5172
- C:\Windows\System\EqCeynE.exe
  C:\Windows\System\EqCeynE.exe
  2⤵
  PID:5196
- C:\Windows\System\tphOsbY.exe
  C:\Windows\System\tphOsbY.exe
  2⤵
  PID:5220
- C:\Windows\System\sCKxyIH.exe
  C:\Windows\System\sCKxyIH.exe
  2⤵
  PID:5256
- C:\Windows\System\mkWeCkT.exe
  C:\Windows\System\mkWeCkT.exe
  2⤵
  PID:5272
- C:\Windows\System\DNWfEbw.exe
  C:\Windows\System\DNWfEbw.exe
  2⤵
  PID:5288
- C:\Windows\System\Eaxphrs.exe
  C:\Windows\System\Eaxphrs.exe
  2⤵
  PID:5324
- C:\Windows\System\BLrGRpO.exe
  C:\Windows\System\BLrGRpO.exe
  2⤵
  PID:5340
- C:\Windows\System\lBmFydI.exe
  C:\Windows\System\lBmFydI.exe
  2⤵
  PID:5364
- C:\Windows\System\okVHnyn.exe
  C:\Windows\System\okVHnyn.exe
  2⤵
  PID:5392
- C:\Windows\System\HMOajQa.exe
  C:\Windows\System\HMOajQa.exe
  2⤵
  PID:5420
- C:\Windows\System\cGlxyke.exe
  C:\Windows\System\cGlxyke.exe
  2⤵
  PID:5444
- C:\Windows\System\VZTEPhB.exe
  C:\Windows\System\VZTEPhB.exe
  2⤵
  PID:5468
- C:\Windows\System\YYaLKcx.exe
  C:\Windows\System\YYaLKcx.exe
  2⤵
  PID:5492
- C:\Windows\System\WCFFlJe.exe
  C:\Windows\System\WCFFlJe.exe
  2⤵
  PID:5508
- C:\Windows\System\XKYHEef.exe
  C:\Windows\System\XKYHEef.exe
  2⤵
  PID:5528
- C:\Windows\System\TTwqEdE.exe
  C:\Windows\System\TTwqEdE.exe
  2⤵
  PID:5568
- C:\Windows\System\TJyItbn.exe
  C:\Windows\System\TJyItbn.exe
  2⤵
  PID:5592
- C:\Windows\System\FkHhiUd.exe
  C:\Windows\System\FkHhiUd.exe
  2⤵
  PID:5608
- C:\Windows\System\VNKGDbj.exe
  C:\Windows\System\VNKGDbj.exe
  2⤵
  PID:5648
- C:\Windows\System\KqJEAyI.exe
  C:\Windows\System\KqJEAyI.exe
  2⤵
  PID:5692
- C:\Windows\System\bNxlNpI.exe
  C:\Windows\System\bNxlNpI.exe
  2⤵
  PID:5708
- C:\Windows\System\bxyAYuj.exe
  C:\Windows\System\bxyAYuj.exe
  2⤵
  PID:5740
- C:\Windows\System\PYQZjJH.exe
  C:\Windows\System\PYQZjJH.exe
  2⤵
  PID:5768
- C:\Windows\System\DagYgsd.exe
  C:\Windows\System\DagYgsd.exe
  2⤵
  PID:5804
- C:\Windows\System\eppTDVu.exe
  C:\Windows\System\eppTDVu.exe
  2⤵
  PID:5836
- C:\Windows\System\PZdlgDe.exe
  C:\Windows\System\PZdlgDe.exe
  2⤵
  PID:5852
- C:\Windows\System\WDwbnba.exe
  C:\Windows\System\WDwbnba.exe
  2⤵
  PID:5868
- C:\Windows\System\mXTytaJ.exe
  C:\Windows\System\mXTytaJ.exe
  2⤵
  PID:5896
- C:\Windows\System\RmDlaVM.exe
  C:\Windows\System\RmDlaVM.exe
  2⤵
  PID:5912
- C:\Windows\System\sjAjFyO.exe
  C:\Windows\System\sjAjFyO.exe
  2⤵
  PID:5940
- C:\Windows\System\jZgnvlU.exe
  C:\Windows\System\jZgnvlU.exe
  2⤵
  PID:5968
- C:\Windows\System\QCXcYAw.exe
  C:\Windows\System\QCXcYAw.exe
  2⤵
  PID:5988
- C:\Windows\System\MjhCrxB.exe
  C:\Windows\System\MjhCrxB.exe
  2⤵
  PID:6012
- C:\Windows\System\Eahxple.exe
  C:\Windows\System\Eahxple.exe
  2⤵
  PID:6028
- C:\Windows\System\lEsWTXu.exe
  C:\Windows\System\lEsWTXu.exe
  2⤵
  PID:6068
- C:\Windows\System\QJkUrqF.exe
  C:\Windows\System\QJkUrqF.exe
  2⤵
  PID:6088
- C:\Windows\System\nIwXXxo.exe
  C:\Windows\System\nIwXXxo.exe
  2⤵
  PID:6128
- C:\Windows\System\sIicjcd.exe
  C:\Windows\System\sIicjcd.exe
  2⤵
  PID:1852
- C:\Windows\System\iDwnWPL.exe
  C:\Windows\System\iDwnWPL.exe
  2⤵
  PID:3032
- C:\Windows\System\zEmEsnQ.exe
  C:\Windows\System\zEmEsnQ.exe
  2⤵
  PID:116
- C:\Windows\System\xLBQcmF.exe
  C:\Windows\System\xLBQcmF.exe
  2⤵
  PID:5228
- C:\Windows\System\QujoCFF.exe
  C:\Windows\System\QujoCFF.exe
  2⤵
  PID:5488
- C:\Windows\System\Xkjawjl.exe
  C:\Windows\System\Xkjawjl.exe
  2⤵
  PID:5312
- C:\Windows\System\xGhsesz.exe
  C:\Windows\System\xGhsesz.exe
  2⤵
  PID:5864
- C:\Windows\System\CVKxcWJ.exe
  C:\Windows\System\CVKxcWJ.exe
  2⤵
  PID:5796
- C:\Windows\System\SCAEVMh.exe
  C:\Windows\System\SCAEVMh.exe
  2⤵
  PID:4156
- C:\Windows\System\OnHbQPV.exe
  C:\Windows\System\OnHbQPV.exe
  2⤵
  PID:5316
- C:\Windows\System\jsrrndW.exe
  C:\Windows\System\jsrrndW.exe
  2⤵
  PID:2180
- C:\Windows\System\TkSOIYg.exe
  C:\Windows\System\TkSOIYg.exe
  2⤵
  PID:2352
- C:\Windows\System\aFyuFXd.exe
  C:\Windows\System\aFyuFXd.exe
  2⤵
  PID:5204
- C:\Windows\System\yNEgJTx.exe
  C:\Windows\System\yNEgJTx.exe
  2⤵
  PID:5460
- C:\Windows\System\llXhLxY.exe
  C:\Windows\System\llXhLxY.exe
  2⤵
  PID:5952
- C:\Windows\System\JKfKner.exe
  C:\Windows\System\JKfKner.exe
  2⤵
  PID:1056
- C:\Windows\System\baDVsWM.exe
  C:\Windows\System\baDVsWM.exe
  2⤵
  PID:6124
- C:\Windows\System\cPDyaXy.exe
  C:\Windows\System\cPDyaXy.exe
  2⤵
  PID:5904
- C:\Windows\System\NarkfYz.exe
  C:\Windows\System\NarkfYz.exe
  2⤵
  PID:4048
- C:\Windows\System\HdVLxZT.exe
  C:\Windows\System\HdVLxZT.exe
  2⤵
  PID:5664
- C:\Windows\System\xtZTRuc.exe
  C:\Windows\System\xtZTRuc.exe
  2⤵
  PID:5752
- C:\Windows\System\gLcaUsy.exe
  C:\Windows\System\gLcaUsy.exe
  2⤵
  PID:5540
- C:\Windows\System\lCuuFoA.exe
  C:\Windows\System\lCuuFoA.exe
  2⤵
  PID:5884
- C:\Windows\System\CxQPouo.exe
  C:\Windows\System\CxQPouo.exe
  2⤵
  PID:5536
- C:\Windows\System\GNRTwvr.exe
  C:\Windows\System\GNRTwvr.exe
  2⤵
  PID:4752
- C:\Windows\System\fbKXZUs.exe
  C:\Windows\System\fbKXZUs.exe
  2⤵
  PID:5668
- C:\Windows\System\MrudEMd.exe
  C:\Windows\System\MrudEMd.exe
  2⤵
  PID:6180
- C:\Windows\System\jYQxCnG.exe
  C:\Windows\System\jYQxCnG.exe
  2⤵
  PID:6248
- C:\Windows\System\FywrtOo.exe
  C:\Windows\System\FywrtOo.exe
  2⤵
  PID:6280
- C:\Windows\System\SSnquSU.exe
  C:\Windows\System\SSnquSU.exe
  2⤵
  PID:6344
- C:\Windows\System\hraitcI.exe
  C:\Windows\System\hraitcI.exe
  2⤵
  PID:6388
- C:\Windows\System\OHgjgUZ.exe
  C:\Windows\System\OHgjgUZ.exe
  2⤵
  PID:6416
- C:\Windows\System\YrnCHBK.exe
  C:\Windows\System\YrnCHBK.exe
  2⤵
  PID:6436
- C:\Windows\System\kyfmXWB.exe
  C:\Windows\System\kyfmXWB.exe
  2⤵
  PID:6480
- C:\Windows\System\IMGndOq.exe
  C:\Windows\System\IMGndOq.exe
  2⤵
  PID:6528
- C:\Windows\System\CugYbtB.exe
  C:\Windows\System\CugYbtB.exe
  2⤵
  PID:6556
- C:\Windows\System\mvIUkaM.exe
  C:\Windows\System\mvIUkaM.exe
  2⤵
  PID:6580
- C:\Windows\System\ojjchQL.exe
  C:\Windows\System\ojjchQL.exe
  2⤵
  PID:6608
- C:\Windows\System\ZdvxPKE.exe
  C:\Windows\System\ZdvxPKE.exe
  2⤵
  PID:6632
- C:\Windows\System\RlMeekl.exe
  C:\Windows\System\RlMeekl.exe
  2⤵
  PID:6672
- C:\Windows\System\sZryOWW.exe
  C:\Windows\System\sZryOWW.exe
  2⤵
  PID:6708
- C:\Windows\System\XDygxBP.exe
  C:\Windows\System\XDygxBP.exe
  2⤵
  PID:6740
- C:\Windows\System\YSfBKzo.exe
  C:\Windows\System\YSfBKzo.exe
  2⤵
  PID:6772
- C:\Windows\System\ZNsxnGa.exe
  C:\Windows\System\ZNsxnGa.exe
  2⤵
  PID:6800
- C:\Windows\System\mYCEqTs.exe
  C:\Windows\System\mYCEqTs.exe
  2⤵
  PID:6820
- C:\Windows\System\pWcCTfg.exe
  C:\Windows\System\pWcCTfg.exe
  2⤵
  PID:6844
- C:\Windows\System\tCKJBkc.exe
  C:\Windows\System\tCKJBkc.exe
  2⤵
  PID:6872
- C:\Windows\System\wqhggKa.exe
  C:\Windows\System\wqhggKa.exe
  2⤵
  PID:6912
- C:\Windows\System\OgDbYwa.exe
  C:\Windows\System\OgDbYwa.exe
  2⤵
  PID:6944
- C:\Windows\System\cHWgmjH.exe
  C:\Windows\System\cHWgmjH.exe
  2⤵
  PID:6968
- C:\Windows\System\QVNFPia.exe
  C:\Windows\System\QVNFPia.exe
  2⤵
  PID:6988
- C:\Windows\System\iVHkffE.exe
  C:\Windows\System\iVHkffE.exe
  2⤵
  PID:7004
- C:\Windows\System\SivEQLb.exe
  C:\Windows\System\SivEQLb.exe
  2⤵
  PID:7024
- C:\Windows\System\NOTbXpY.exe
  C:\Windows\System\NOTbXpY.exe
  2⤵
  PID:7048
- C:\Windows\System\NxwhYGg.exe
  C:\Windows\System\NxwhYGg.exe
  2⤵
  PID:7084
- C:\Windows\System\nmJRwEX.exe
  C:\Windows\System\nmJRwEX.exe
  2⤵
  PID:7108
- C:\Windows\System\AUsIPWz.exe
  C:\Windows\System\AUsIPWz.exe
  2⤵
  PID:7128
- C:\Windows\System\HbNZuGm.exe
  C:\Windows\System\HbNZuGm.exe
  2⤵
  PID:7156
- C:\Windows\System\PmhIqAc.exe
  C:\Windows\System\PmhIqAc.exe
  2⤵
  PID:6096
- C:\Windows\System\TpMvvZg.exe
  C:\Windows\System\TpMvvZg.exe
  2⤵
  PID:6204
- C:\Windows\System\rukPxEu.exe
  C:\Windows\System\rukPxEu.exe
  2⤵
  PID:6236
- C:\Windows\System\zUlcwOx.exe
  C:\Windows\System\zUlcwOx.exe
  2⤵
  PID:6396
- C:\Windows\System\dRuIAns.exe
  C:\Windows\System\dRuIAns.exe
  2⤵
  PID:6428
- C:\Windows\System\vDsjFww.exe
  C:\Windows\System\vDsjFww.exe
  2⤵
  PID:6464
- C:\Windows\System\gRseqrw.exe
  C:\Windows\System\gRseqrw.exe
  2⤵
  PID:6504
- C:\Windows\System\HwfEYwL.exe
  C:\Windows\System\HwfEYwL.exe
  2⤵
  PID:6552
- C:\Windows\System\yfGMktK.exe
  C:\Windows\System\yfGMktK.exe
  2⤵
  PID:6592
- C:\Windows\System\JfLdbom.exe
  C:\Windows\System\JfLdbom.exe
  2⤵
  PID:6696
- C:\Windows\System\dKnehdn.exe
  C:\Windows\System\dKnehdn.exe
  2⤵
  PID:6716
- C:\Windows\System\afXumKJ.exe
  C:\Windows\System\afXumKJ.exe
  2⤵
  PID:6760
- C:\Windows\System\wZlPWRY.exe
  C:\Windows\System\wZlPWRY.exe
  2⤵
  PID:6808
- C:\Windows\System\jdLmAGV.exe
  C:\Windows\System\jdLmAGV.exe
  2⤵
  PID:6880
- C:\Windows\System\WHspxUF.exe
  C:\Windows\System\WHspxUF.exe
  2⤵
  PID:6940
- C:\Windows\System\HgHcLAX.exe
  C:\Windows\System\HgHcLAX.exe
  2⤵
  PID:7000
- C:\Windows\System\qhpPoVt.exe
  C:\Windows\System\qhpPoVt.exe
  2⤵
  PID:7044
- C:\Windows\System\ppFpGvh.exe
  C:\Windows\System\ppFpGvh.exe
  2⤵
  PID:6176
- C:\Windows\System\ikKahxB.exe
  C:\Windows\System\ikKahxB.exe
  2⤵
  PID:7100
- C:\Windows\System\FJHOFcA.exe
  C:\Windows\System\FJHOFcA.exe
  2⤵
  PID:7140
- C:\Windows\System\ahlBmpq.exe
  C:\Windows\System\ahlBmpq.exe
  2⤵
  PID:7164
- C:\Windows\System\DlEcwhX.exe
  C:\Windows\System\DlEcwhX.exe
  2⤵
  PID:6268
- C:\Windows\System\nhJypsh.exe
  C:\Windows\System\nhJypsh.exe
  2⤵
  PID:6520
- C:\Windows\System\UpVGJla.exe
  C:\Windows\System\UpVGJla.exe
  2⤵
  PID:6452
- C:\Windows\System\VqlArHF.exe
  C:\Windows\System\VqlArHF.exe
  2⤵
  PID:6748
- C:\Windows\System\NWWlEqJ.exe
  C:\Windows\System\NWWlEqJ.exe
  2⤵
  PID:6364
- C:\Windows\System\tPMFfgk.exe
  C:\Windows\System\tPMFfgk.exe
  2⤵
  PID:6568
- C:\Windows\System\IoSWghX.exe
  C:\Windows\System\IoSWghX.exe
  2⤵
  PID:7184
- C:\Windows\System\sbfeAQc.exe
  C:\Windows\System\sbfeAQc.exe
  2⤵
  PID:7200
- C:\Windows\System\zoNxLMs.exe
  C:\Windows\System\zoNxLMs.exe
  2⤵
  PID:7216
- C:\Windows\System\wAsCRxE.exe
  C:\Windows\System\wAsCRxE.exe
  2⤵
  PID:7232
- C:\Windows\System\YqxMybp.exe
  C:\Windows\System\YqxMybp.exe
  2⤵
  PID:7248
- C:\Windows\System\lJPiNnh.exe
  C:\Windows\System\lJPiNnh.exe
  2⤵
  PID:7264
- C:\Windows\System\yZsoEUG.exe
  C:\Windows\System\yZsoEUG.exe
  2⤵
  PID:7304
- C:\Windows\System\jtGzSWN.exe
  C:\Windows\System\jtGzSWN.exe
  2⤵
  PID:7328
- C:\Windows\System\wNhaETo.exe
  C:\Windows\System\wNhaETo.exe
  2⤵
  PID:7344
- C:\Windows\System\LfalEne.exe
  C:\Windows\System\LfalEne.exe
  2⤵
  PID:7360
- C:\Windows\System\ybSWzNA.exe
  C:\Windows\System\ybSWzNA.exe
  2⤵
  PID:7380
- C:\Windows\System\pXpSkxm.exe
  C:\Windows\System\pXpSkxm.exe
  2⤵
  PID:7412
- C:\Windows\System\MiqYBWh.exe
  C:\Windows\System\MiqYBWh.exe
  2⤵
  PID:7432
- C:\Windows\System\IerBKou.exe
  C:\Windows\System\IerBKou.exe
  2⤵
  PID:7460
- C:\Windows\System\fLFJRHB.exe
  C:\Windows\System\fLFJRHB.exe
  2⤵
  PID:7480
- C:\Windows\System\kbGFyzo.exe
  C:\Windows\System\kbGFyzo.exe
  2⤵
  PID:7504
- C:\Windows\System\xrNvnRv.exe
  C:\Windows\System\xrNvnRv.exe
  2⤵
  PID:7520
- C:\Windows\System\GuqljLK.exe
  C:\Windows\System\GuqljLK.exe
  2⤵
  PID:7536
- C:\Windows\System\RUIgBIW.exe
  C:\Windows\System\RUIgBIW.exe
  2⤵
  PID:7556
- C:\Windows\System\qkFfuti.exe
  C:\Windows\System\qkFfuti.exe
  2⤵
  PID:7580
- C:\Windows\System\iOnfqXd.exe
  C:\Windows\System\iOnfqXd.exe
  2⤵
  PID:7596
- C:\Windows\System\FoklpBa.exe
  C:\Windows\System\FoklpBa.exe
  2⤵
  PID:7616
- C:\Windows\System\PuTTOHh.exe
  C:\Windows\System\PuTTOHh.exe
  2⤵
  PID:7632
- C:\Windows\System\hhxdaCc.exe
  C:\Windows\System\hhxdaCc.exe
  2⤵
  PID:7648
- C:\Windows\System\sfHfIAs.exe
  C:\Windows\System\sfHfIAs.exe
  2⤵
  PID:7664
- C:\Windows\System\TTxcDtk.exe
  C:\Windows\System\TTxcDtk.exe
  2⤵
  PID:7680
- C:\Windows\System\COUiciI.exe
  C:\Windows\System\COUiciI.exe
  2⤵
  PID:7696
- C:\Windows\System\tvFSqPY.exe
  C:\Windows\System\tvFSqPY.exe
  2⤵
  PID:7716
- C:\Windows\System\HUYGyYg.exe
  C:\Windows\System\HUYGyYg.exe
  2⤵
  PID:7736
- C:\Windows\System\hoHYXmu.exe
  C:\Windows\System\hoHYXmu.exe
  2⤵
  PID:7756
- C:\Windows\System\xkiWhmB.exe
  C:\Windows\System\xkiWhmB.exe
  2⤵
  PID:7772
- C:\Windows\System\noZxXCC.exe
  C:\Windows\System\noZxXCC.exe
  2⤵
  PID:7792
- C:\Windows\System\jEIwxhc.exe
  C:\Windows\System\jEIwxhc.exe
  2⤵
  PID:7808
- C:\Windows\System\nFUSDhU.exe
  C:\Windows\System\nFUSDhU.exe
  2⤵
  PID:7824
- C:\Windows\System\PPadnPT.exe
  C:\Windows\System\PPadnPT.exe
  2⤵
  PID:7864
- C:\Windows\System\NBZLrfg.exe
  C:\Windows\System\NBZLrfg.exe
  2⤵
  PID:7956
- C:\Windows\System\BnmtZqe.exe
  C:\Windows\System\BnmtZqe.exe
  2⤵
  PID:8188
- C:\Windows\System\SrApexk.exe
  C:\Windows\System\SrApexk.exe
  2⤵
  PID:6996
- C:\Windows\System\GOUxKQi.exe
  C:\Windows\System\GOUxKQi.exe
  2⤵
  PID:6444
- C:\Windows\System\gIxMSMA.exe
  C:\Windows\System\gIxMSMA.exe
  2⤵
  PID:6296
- C:\Windows\System\VDMbbDv.exe
  C:\Windows\System\VDMbbDv.exe
  2⤵
  PID:6832
- C:\Windows\System\wBsmqkh.exe
  C:\Windows\System\wBsmqkh.exe
  2⤵
  PID:7256
- C:\Windows\System\BzyJerZ.exe
  C:\Windows\System\BzyJerZ.exe
  2⤵
  PID:7472
- C:\Windows\System\dZjisLm.exe
  C:\Windows\System\dZjisLm.exe
  2⤵
  PID:6400
- C:\Windows\System\XoOjmAn.exe
  C:\Windows\System\XoOjmAn.exe
  2⤵
  PID:6728
- C:\Windows\System\KZgFOAo.exe
  C:\Windows\System\KZgFOAo.exe
  2⤵
  PID:7284
- C:\Windows\System\xGOWwUi.exe
  C:\Windows\System\xGOWwUi.exe
  2⤵
  PID:7488
- C:\Windows\System\obeCZkl.exe
  C:\Windows\System\obeCZkl.exe
  2⤵
  PID:8008
- C:\Windows\System\chsyHmg.exe
  C:\Windows\System\chsyHmg.exe
  2⤵
  PID:6292
- C:\Windows\System\EhXoyeF.exe
  C:\Windows\System\EhXoyeF.exe
  2⤵
  PID:8012
- C:\Windows\System\SzHdDGD.exe
  C:\Windows\System\SzHdDGD.exe
  2⤵
  PID:6784
- C:\Windows\System\ysOnoFU.exe
  C:\Windows\System\ysOnoFU.exe
  2⤵
  PID:7588
- C:\Windows\System\LwFHywP.exe
  C:\Windows\System\LwFHywP.exe
  2⤵
  PID:8160
- C:\Windows\System\VtMDKTk.exe
  C:\Windows\System\VtMDKTk.exe
  2⤵
  PID:6620
- C:\Windows\System\XhoVWNJ.exe
  C:\Windows\System\XhoVWNJ.exe
  2⤵
  PID:7016
- C:\Windows\System\TcQZkMS.exe
  C:\Windows\System\TcQZkMS.exe
  2⤵
  PID:7148
- C:\Windows\System\xWfZIWB.exe
  C:\Windows\System\xWfZIWB.exe
  2⤵
  PID:7316
- C:\Windows\System\EEGQmfl.exe
  C:\Windows\System\EEGQmfl.exe
  2⤵
  PID:7944
- C:\Windows\System\idQmSDl.exe
  C:\Windows\System\idQmSDl.exe
  2⤵
  PID:6928
- C:\Windows\System\CsrDAYc.exe
  C:\Windows\System\CsrDAYc.exe
  2⤵
  PID:8056
- C:\Windows\System\mleVgio.exe
  C:\Windows\System\mleVgio.exe
  2⤵
  PID:7672
- C:\Windows\System\SMsFEcz.exe
  C:\Windows\System\SMsFEcz.exe
  2⤵
  PID:8024
- C:\Windows\System\vnjQKcC.exe
  C:\Windows\System\vnjQKcC.exe
  2⤵
  PID:7976
- C:\Windows\System\nCnhwxl.exe
  C:\Windows\System\nCnhwxl.exe
  2⤵
  PID:7280
- C:\Windows\System\FkpXxcT.exe
  C:\Windows\System\FkpXxcT.exe
  2⤵
  PID:7208
- C:\Windows\System\JaWBDPt.exe
  C:\Windows\System\JaWBDPt.exe
  2⤵
  PID:8220
- C:\Windows\System\fICZBTt.exe
  C:\Windows\System\fICZBTt.exe
  2⤵
  PID:8244
- C:\Windows\System\GDvQgBM.exe
  C:\Windows\System\GDvQgBM.exe
  2⤵
  PID:8272
- C:\Windows\System\nbTMcBT.exe
  C:\Windows\System\nbTMcBT.exe
  2⤵
  PID:8296
- C:\Windows\System\ebMLtns.exe
  C:\Windows\System\ebMLtns.exe
  2⤵
  PID:8316
- C:\Windows\System\FHZUjbi.exe
  C:\Windows\System\FHZUjbi.exe
  2⤵
  PID:8336
- C:\Windows\System\bqTpKFj.exe
  C:\Windows\System\bqTpKFj.exe
  2⤵
  PID:8356
- C:\Windows\System\PpUQAIQ.exe
  C:\Windows\System\PpUQAIQ.exe
  2⤵
  PID:8376
- C:\Windows\System\ngouEep.exe
  C:\Windows\System\ngouEep.exe
  2⤵
  PID:8404
- C:\Windows\System\RMiUixY.exe
  C:\Windows\System\RMiUixY.exe
  2⤵
  PID:8420
- C:\Windows\System\VTxkDmm.exe
  C:\Windows\System\VTxkDmm.exe
  2⤵
  PID:8436
- C:\Windows\System\bJLNHiW.exe
  C:\Windows\System\bJLNHiW.exe
  2⤵
  PID:8452
- C:\Windows\System\cwZsdYB.exe
  C:\Windows\System\cwZsdYB.exe
  2⤵
  PID:8472
- C:\Windows\System\hIqmJut.exe
  C:\Windows\System\hIqmJut.exe
  2⤵
  PID:8496
- C:\Windows\System\cCbUfcB.exe
  C:\Windows\System\cCbUfcB.exe
  2⤵
  PID:8520
- C:\Windows\System\pAEUvdK.exe
  C:\Windows\System\pAEUvdK.exe
  2⤵
  PID:8548
- C:\Windows\System\qxtnHDQ.exe
  C:\Windows\System\qxtnHDQ.exe
  2⤵
  PID:8568
- C:\Windows\System\DIToxEM.exe
  C:\Windows\System\DIToxEM.exe
  2⤵
  PID:8588
- C:\Windows\System\JnhhEdN.exe
  C:\Windows\System\JnhhEdN.exe
  2⤵
  PID:8608
- C:\Windows\System\nanWYdX.exe
  C:\Windows\System\nanWYdX.exe
  2⤵
  PID:8640
- C:\Windows\System\CCuyDOJ.exe
  C:\Windows\System\CCuyDOJ.exe
  2⤵
  PID:8668
- C:\Windows\System\xuzBflG.exe
  C:\Windows\System\xuzBflG.exe
  2⤵
  PID:8688
- C:\Windows\System\RJfBBsW.exe
  C:\Windows\System\RJfBBsW.exe
  2⤵
  PID:8712
- C:\Windows\System\EvAhMPr.exe
  C:\Windows\System\EvAhMPr.exe
  2⤵
  PID:8732
- C:\Windows\System\qqAOshq.exe
  C:\Windows\System\qqAOshq.exe
  2⤵
  PID:8752
- C:\Windows\System\LKanfnw.exe
  C:\Windows\System\LKanfnw.exe
  2⤵
  PID:8776
- C:\Windows\System\NWQWvYl.exe
  C:\Windows\System\NWQWvYl.exe
  2⤵
  PID:8812
- C:\Windows\System\RzsKBpa.exe
  C:\Windows\System\RzsKBpa.exe
  2⤵
  PID:8832
- C:\Windows\System\yzPbybl.exe
  C:\Windows\System\yzPbybl.exe
  2⤵
  PID:8856
- C:\Windows\System\tnKtOsy.exe
  C:\Windows\System\tnKtOsy.exe
  2⤵
  PID:8880
- C:\Windows\System\WAdFTQh.exe
  C:\Windows\System\WAdFTQh.exe
  2⤵
  PID:8908
- C:\Windows\System\yzWhGXI.exe
  C:\Windows\System\yzWhGXI.exe
  2⤵
  PID:8936
- C:\Windows\System\rmfSXla.exe
  C:\Windows\System\rmfSXla.exe
  2⤵
  PID:8956
- C:\Windows\System\uquDCNY.exe
  C:\Windows\System\uquDCNY.exe
  2⤵
  PID:8980
- C:\Windows\System\FZfWFhr.exe
  C:\Windows\System\FZfWFhr.exe
  2⤵
  PID:9000
- C:\Windows\System\pFCUhqn.exe
  C:\Windows\System\pFCUhqn.exe
  2⤵
  PID:9016
- C:\Windows\System\hjELAwf.exe
  C:\Windows\System\hjELAwf.exe
  2⤵
  PID:9040
- C:\Windows\System\VbNHHfw.exe
  C:\Windows\System\VbNHHfw.exe
  2⤵
  PID:9060
- C:\Windows\System\MwqAbbX.exe
  C:\Windows\System\MwqAbbX.exe
  2⤵
  PID:9080
- C:\Windows\System\oCEnQak.exe
  C:\Windows\System\oCEnQak.exe
  2⤵
  PID:9104
- C:\Windows\System\BgYSHIT.exe
  C:\Windows\System\BgYSHIT.exe
  2⤵
  PID:9128
- C:\Windows\System\VpwyYxv.exe
  C:\Windows\System\VpwyYxv.exe
  2⤵
  PID:9148
- C:\Windows\System\JkkyMVI.exe
  C:\Windows\System\JkkyMVI.exe
  2⤵
  PID:9168
- C:\Windows\System\dNLBooZ.exe
  C:\Windows\System\dNLBooZ.exe
  2⤵
  PID:9192
- C:\Windows\System\OCrqWhl.exe
  C:\Windows\System\OCrqWhl.exe
  2⤵
  PID:9212
- C:\Windows\System\hZOILmy.exe
  C:\Windows\System\hZOILmy.exe
  2⤵
  PID:6976
- C:\Windows\System\cCIMcqZ.exe
  C:\Windows\System\cCIMcqZ.exe
  2⤵
  PID:7272
- C:\Windows\System\vDWWusP.exe
  C:\Windows\System\vDWWusP.exe
  2⤵
  PID:7408
- C:\Windows\System\rbFzuaA.exe
  C:\Windows\System\rbFzuaA.exe
  2⤵
  PID:8208
- C:\Windows\System\LaGWPFF.exe
  C:\Windows\System\LaGWPFF.exe
  2⤵
  PID:7844
- C:\Windows\System\KkAxtUT.exe
  C:\Windows\System\KkAxtUT.exe
  2⤵
  PID:7176
- C:\Windows\System\FNDUawc.exe
  C:\Windows\System\FNDUawc.exe
  2⤵
  PID:8620
- C:\Windows\System\EtwIral.exe
  C:\Windows\System\EtwIral.exe
  2⤵
  PID:8444
- C:\Windows\System\phtGpUA.exe
  C:\Windows\System\phtGpUA.exe
  2⤵
  PID:8800
- C:\Windows\System\LCZOcZY.exe
  C:\Windows\System\LCZOcZY.exe
  2⤵
  PID:8628
- C:\Windows\System\kmPxZyi.exe
  C:\Windows\System\kmPxZyi.exe
  2⤵
  PID:8308
- C:\Windows\System\hDuxKex.exe
  C:\Windows\System\hDuxKex.exe
  2⤵
  PID:8352
- C:\Windows\System\wmYtrtr.exe
  C:\Windows\System\wmYtrtr.exe
  2⤵
  PID:8864
- C:\Windows\System\GGHxeVv.exe
  C:\Windows\System\GGHxeVv.exe
  2⤵
  PID:8704
- C:\Windows\System\yWOvYOX.exe
  C:\Windows\System\yWOvYOX.exe
  2⤵
  PID:8744
- C:\Windows\System\vDUaEmc.exe
  C:\Windows\System\vDUaEmc.exe
  2⤵
  PID:7640
- C:\Windows\System\tMOnZUe.exe
  C:\Windows\System\tMOnZUe.exe
  2⤵
  PID:9052
- C:\Windows\System\QuxFqpi.exe
  C:\Windows\System\QuxFqpi.exe
  2⤵
  PID:9360
- C:\Windows\System\CYVNAsb.exe
  C:\Windows\System\CYVNAsb.exe
  2⤵
  PID:9380
- C:\Windows\System\EWtyrmb.exe
  C:\Windows\System\EWtyrmb.exe
  2⤵
  PID:9428
- C:\Windows\System\BFeZQBG.exe
  C:\Windows\System\BFeZQBG.exe
  2⤵
  PID:9464
- C:\Windows\System\FJsMiDj.exe
  C:\Windows\System\FJsMiDj.exe
  2⤵
  PID:9492
- C:\Windows\System\sZxSdDS.exe
  C:\Windows\System\sZxSdDS.exe
  2⤵
  PID:9512
- C:\Windows\System\bBqROJX.exe
  C:\Windows\System\bBqROJX.exe
  2⤵
  PID:9556
- C:\Windows\System\onSJlQc.exe
  C:\Windows\System\onSJlQc.exe
  2⤵
  PID:9584
- C:\Windows\System\BsvCfMC.exe
  C:\Windows\System\BsvCfMC.exe
  2⤵
  PID:9616
- C:\Windows\System\ZXkeLAq.exe
  C:\Windows\System\ZXkeLAq.exe
  2⤵
  PID:9656
- C:\Windows\System\BoySsIa.exe
  C:\Windows\System\BoySsIa.exe
  2⤵
  PID:9676
- C:\Windows\System\brBImdE.exe
  C:\Windows\System\brBImdE.exe
  2⤵
  PID:9700
- C:\Windows\System\ayemgVw.exe
  C:\Windows\System\ayemgVw.exe
  2⤵
  PID:9716
- C:\Windows\System\sYBcFVg.exe
  C:\Windows\System\sYBcFVg.exe
  2⤵
  PID:9736
- C:\Windows\System\kFlfeGg.exe
  C:\Windows\System\kFlfeGg.exe
  2⤵
  PID:9776
- C:\Windows\System\vYhIHWE.exe
  C:\Windows\System\vYhIHWE.exe
  2⤵
  PID:9804
- C:\Windows\System\GSOGRQH.exe
  C:\Windows\System\GSOGRQH.exe
  2⤵
  PID:9824
- C:\Windows\System\KYRJJxg.exe
  C:\Windows\System\KYRJJxg.exe
  2⤵
  PID:9844
- C:\Windows\System\XyKYUTv.exe
  C:\Windows\System\XyKYUTv.exe
  2⤵
  PID:9876
- C:\Windows\System\nSiLlDb.exe
  C:\Windows\System\nSiLlDb.exe
  2⤵
  PID:9896
- C:\Windows\System\vlGXgXu.exe
  C:\Windows\System\vlGXgXu.exe
  2⤵
  PID:9928
- C:\Windows\System\ioOnhLO.exe
  C:\Windows\System\ioOnhLO.exe
  2⤵
  PID:9952
- C:\Windows\System\ocALTwW.exe
  C:\Windows\System\ocALTwW.exe
  2⤵
  PID:9976
- C:\Windows\System\sGYYrBa.exe
  C:\Windows\System\sGYYrBa.exe
  2⤵
  PID:10004
- C:\Windows\System\UtMrldA.exe
  C:\Windows\System\UtMrldA.exe
  2⤵
  PID:10024
- C:\Windows\System\HWVzWEO.exe
  C:\Windows\System\HWVzWEO.exe
  2⤵
  PID:10044
- C:\Windows\System\UXVOaaE.exe
  C:\Windows\System\UXVOaaE.exe
  2⤵
  PID:10064
- C:\Windows\System\RJjxLKG.exe
  C:\Windows\System\RJjxLKG.exe
  2⤵
  PID:10088
- C:\Windows\System\NxpihWO.exe
  C:\Windows\System\NxpihWO.exe
  2⤵
  PID:10112
- C:\Windows\System\wDkxYli.exe
  C:\Windows\System\wDkxYli.exe
  2⤵
  PID:10132
- C:\Windows\System\fxHCTfz.exe
  C:\Windows\System\fxHCTfz.exe
  2⤵
  PID:10156
- C:\Windows\System\duDMQPq.exe
  C:\Windows\System\duDMQPq.exe
  2⤵
  PID:10180
- C:\Windows\System\cJdMSfZ.exe
  C:\Windows\System\cJdMSfZ.exe
  2⤵
  PID:10208
- C:\Windows\System\FFwXAOL.exe
  C:\Windows\System\FFwXAOL.exe
  2⤵
  PID:8228
- C:\Windows\System\eFRdGAs.exe
  C:\Windows\System\eFRdGAs.exe
  2⤵
  PID:8992
- C:\Windows\System\nWlTtHX.exe
  C:\Windows\System\nWlTtHX.exe
  2⤵
  PID:9124
- C:\Windows\System\ZpuSOyC.exe
  C:\Windows\System\ZpuSOyC.exe
  2⤵
  PID:8696
- C:\Windows\System\ogxWsmU.exe
  C:\Windows\System\ogxWsmU.exe
  2⤵
  PID:9200
- C:\Windows\System\kiJeNdp.exe
  C:\Windows\System\kiJeNdp.exe
  2⤵
  PID:6888
- C:\Windows\System\UwIOWJQ.exe
  C:\Windows\System\UwIOWJQ.exe
  2⤵
  PID:8304
- C:\Windows\System\tVSWkxa.exe
  C:\Windows\System\tVSWkxa.exe
  2⤵
  PID:8616
- C:\Windows\System\zZYwUKM.exe
  C:\Windows\System\zZYwUKM.exe
  2⤵
  PID:9332
- C:\Windows\System\wQDpNxa.exe
  C:\Windows\System\wQDpNxa.exe
  2⤵
  PID:9344
- C:\Windows\System\TFtmRaT.exe
  C:\Windows\System\TFtmRaT.exe
  2⤵
  PID:9224
- C:\Windows\System\OAVSWxI.exe
  C:\Windows\System\OAVSWxI.exe
  2⤵
  PID:9268
- C:\Windows\System\hjAWXfv.exe
  C:\Windows\System\hjAWXfv.exe
  2⤵
  PID:1272
- C:\Windows\System\abjYRYZ.exe
  C:\Windows\System\abjYRYZ.exe
  2⤵
  PID:9576
- C:\Windows\System\JDYfMpg.exe
  C:\Windows\System\JDYfMpg.exe
  2⤵
  PID:9624
- C:\Windows\System\TneOctt.exe
  C:\Windows\System\TneOctt.exe
  2⤵
  PID:9484
- C:\Windows\System\qtNXzQB.exe
  C:\Windows\System\qtNXzQB.exe
  2⤵
  PID:9836
- C:\Windows\System\frmuLyo.exe
  C:\Windows\System\frmuLyo.exe
  2⤵
  PID:9672
- C:\Windows\System\WKUabUZ.exe
  C:\Windows\System\WKUabUZ.exe
  2⤵
  PID:9708
- C:\Windows\System\jAcAIhA.exe
  C:\Windows\System\jAcAIhA.exe
  2⤵
  PID:9744
- C:\Windows\System\xHIZOPu.exe
  C:\Windows\System\xHIZOPu.exe
  2⤵
  PID:9972
- C:\Windows\System\kEquqLO.exe
  C:\Windows\System\kEquqLO.exe
  2⤵
  PID:10056
- C:\Windows\System\ApWHxVS.exe
  C:\Windows\System\ApWHxVS.exe
  2⤵
  PID:9908
- C:\Windows\System\dCSWcLT.exe
  C:\Windows\System\dCSWcLT.exe
  2⤵
  PID:10220
- C:\Windows\System\UFNGQgy.exe
  C:\Windows\System\UFNGQgy.exe
  2⤵
  PID:9996
- C:\Windows\System\ndpZVMr.exe
  C:\Windows\System\ndpZVMr.exe
  2⤵
  PID:10036
- C:\Windows\System\XKnjlzL.exe
  C:\Windows\System\XKnjlzL.exe
  2⤵
  PID:10072
- C:\Windows\System\GVAshlp.exe
  C:\Windows\System\GVAshlp.exe
  2⤵
  PID:10168
- C:\Windows\System\pxyLzKb.exe
  C:\Windows\System\pxyLzKb.exe
  2⤵
  PID:10192
- C:\Windows\System\tRxceSI.exe
  C:\Windows\System\tRxceSI.exe
  2⤵
  PID:10224
- C:\Windows\System\PMlenCJ.exe
  C:\Windows\System\PMlenCJ.exe
  2⤵
  PID:10332
- C:\Windows\System\CUbDUtx.exe
  C:\Windows\System\CUbDUtx.exe
  2⤵
  PID:10364
- C:\Windows\System\TQXzKON.exe
  C:\Windows\System\TQXzKON.exe
  2⤵
  PID:10384
- C:\Windows\System\JAXaqle.exe
  C:\Windows\System\JAXaqle.exe
  2⤵
  PID:10404
- C:\Windows\System\sFBeXXC.exe
  C:\Windows\System\sFBeXXC.exe
  2⤵
  PID:10432
- C:\Windows\System\zvWMtSh.exe
  C:\Windows\System\zvWMtSh.exe
  2⤵
  PID:10468
- C:\Windows\System\ABtvzUe.exe
  C:\Windows\System\ABtvzUe.exe
  2⤵
  PID:10488
- C:\Windows\System\oyGYBgU.exe
  C:\Windows\System\oyGYBgU.exe
  2⤵
  PID:10516
- C:\Windows\System\oQNPdmy.exe
  C:\Windows\System\oQNPdmy.exe
  2⤵
  PID:10536
- C:\Windows\System\iVuVIuz.exe
  C:\Windows\System\iVuVIuz.exe
  2⤵
  PID:10560
- C:\Windows\System\wKxQPhQ.exe
  C:\Windows\System\wKxQPhQ.exe
  2⤵
  PID:10580
- C:\Windows\System\GoDojWf.exe
  C:\Windows\System\GoDojWf.exe
  2⤵
  PID:10792
- C:\Windows\System\GYIjlhy.exe
  C:\Windows\System\GYIjlhy.exe
  2⤵
  PID:10808
- C:\Windows\System\HZxBjmO.exe
  C:\Windows\System\HZxBjmO.exe
  2⤵
  PID:10836
- C:\Windows\System\vChKUYL.exe
  C:\Windows\System\vChKUYL.exe
  2⤵
  PID:10860
- C:\Windows\System\citvtpt.exe
  C:\Windows\System\citvtpt.exe
  2⤵
  PID:10884
- C:\Windows\System\JZJfzoa.exe
  C:\Windows\System\JZJfzoa.exe
  2⤵
  PID:10908
- C:\Windows\System\irpzjkD.exe
  C:\Windows\System\irpzjkD.exe
  2⤵
  PID:10928
- C:\Windows\System\nLWKtUl.exe
  C:\Windows\System\nLWKtUl.exe
  2⤵
  PID:10956
- C:\Windows\System\XwTMkDf.exe
  C:\Windows\System\XwTMkDf.exe
  2⤵
  PID:10980
- C:\Windows\System\yarhpxE.exe
  C:\Windows\System\yarhpxE.exe
  2⤵
  PID:11000
- C:\Windows\System\mfoXWiX.exe
  C:\Windows\System\mfoXWiX.exe
  2⤵
  PID:11020
- C:\Windows\System\DLEqrAH.exe
  C:\Windows\System\DLEqrAH.exe
  2⤵
  PID:11048
- C:\Windows\System\ZhUFpMC.exe
  C:\Windows\System\ZhUFpMC.exe
  2⤵
  PID:11072
- C:\Windows\System\mNLIsnO.exe
  C:\Windows\System\mNLIsnO.exe
  2⤵
  PID:11096
- C:\Windows\System\BYIkJXo.exe
  C:\Windows\System\BYIkJXo.exe
  2⤵
  PID:11120
- C:\Windows\System\bOwWKKr.exe
  C:\Windows\System\bOwWKKr.exe
  2⤵
  PID:11152
- C:\Windows\System\rFiiMdg.exe
  C:\Windows\System\rFiiMdg.exe
  2⤵
  PID:11172
- C:\Windows\System\iRHLmOM.exe
  C:\Windows\System\iRHLmOM.exe
  2⤵
  PID:11192
- C:\Windows\System\prynemy.exe
  C:\Windows\System\prynemy.exe
  2⤵
  PID:11228
- C:\Windows\System\tRrbkFq.exe
  C:\Windows\System\tRrbkFq.exe
  2⤵
  PID:11256
- C:\Windows\System\MDRuGvh.exe
  C:\Windows\System\MDRuGvh.exe
  2⤵
  PID:9724
- C:\Windows\System\RcdARXw.exe
  C:\Windows\System\RcdARXw.exe
  2⤵
  PID:8604
- C:\Windows\System\zMfleFr.exe
  C:\Windows\System\zMfleFr.exe
  2⤵
  PID:8516
- C:\Windows\System\sacepeZ.exe
  C:\Windows\System\sacepeZ.exe
  2⤵
  PID:7816
- C:\Windows\System\SCSWGyU.exe
  C:\Windows\System\SCSWGyU.exe
  2⤵
  PID:8580
- C:\Windows\System\WUMmElj.exe
  C:\Windows\System\WUMmElj.exe
  2⤵
  PID:10140
- C:\Windows\System\iZfaMnI.exe
  C:\Windows\System\iZfaMnI.exe
  2⤵
  PID:10016
- C:\Windows\System\EdHKwZn.exe
  C:\Windows\System\EdHKwZn.exe
  2⤵
  PID:10104
- C:\Windows\System\gtPJHnO.exe
  C:\Windows\System\gtPJHnO.exe
  2⤵
  PID:9488
- C:\Windows\System\vMruzET.exe
  C:\Windows\System\vMruzET.exe
  2⤵
  PID:9452
- C:\Windows\System\JIhTFrP.exe
  C:\Windows\System\JIhTFrP.exe
  2⤵
  PID:9760
- C:\Windows\System\JvGBdEH.exe
  C:\Windows\System\JvGBdEH.exe
  2⤵
  PID:10060
- C:\Windows\System\lNSrTEe.exe
  C:\Windows\System\lNSrTEe.exe
  2⤵
  PID:8324
- C:\Windows\System\bPJgbAT.exe
  C:\Windows\System\bPJgbAT.exe
  2⤵
  PID:10400
- C:\Windows\System\TvEjOXX.exe
  C:\Windows\System\TvEjOXX.exe
  2⤵
  PID:10348
- C:\Windows\System\TsfVpSb.exe
  C:\Windows\System\TsfVpSb.exe
  2⤵
  PID:10476
- C:\Windows\System\OocKVIl.exe
  C:\Windows\System\OocKVIl.exe
  2⤵
  PID:10504
- C:\Windows\System\VdSijei.exe
  C:\Windows\System\VdSijei.exe
  2⤵
  PID:10648
- C:\Windows\System\sVyxALv.exe
  C:\Windows\System\sVyxALv.exe
  2⤵
  PID:10556
- C:\Windows\System\VntRuVK.exe
  C:\Windows\System\VntRuVK.exe
  2⤵
  PID:10628
- C:\Windows\System\eIbzced.exe
  C:\Windows\System\eIbzced.exe
  2⤵
  PID:10640
- C:\Windows\System\vhlhDvq.exe
  C:\Windows\System\vhlhDvq.exe
  2⤵
  PID:10372
- C:\Windows\System\QgYTRnt.exe
  C:\Windows\System\QgYTRnt.exe
  2⤵
  PID:10660
- C:\Windows\System\vrEclKx.exe
  C:\Windows\System\vrEclKx.exe
  2⤵
  PID:10872
- C:\Windows\System\nbkwzeq.exe
  C:\Windows\System\nbkwzeq.exe
  2⤵
  PID:10924
- C:\Windows\System\mYlBkEn.exe
  C:\Windows\System\mYlBkEn.exe
  2⤵
  PID:10800
- C:\Windows\System\hbukEUr.exe
  C:\Windows\System\hbukEUr.exe
  2⤵
  PID:10820
- C:\Windows\System\wwZfxLd.exe
  C:\Windows\System\wwZfxLd.exe
  2⤵
  PID:11080
- C:\Windows\System\MYzotet.exe
  C:\Windows\System\MYzotet.exe
  2⤵
  PID:10852
- C:\Windows\System\xfFInck.exe
  C:\Windows\System\xfFInck.exe
  2⤵
  PID:10944
- C:\Windows\System\OGCPPxz.exe
  C:\Windows\System\OGCPPxz.exe
  2⤵
  PID:11012
- C:\Windows\System\OOsCqac.exe
  C:\Windows\System\OOsCqac.exe
  2⤵
  PID:9520
- C:\Windows\System\iHYOSXj.exe
  C:\Windows\System\iHYOSXj.exe
  2⤵
  PID:9228
- C:\Windows\System\lYefWmj.exe
  C:\Windows\System\lYefWmj.exe
  2⤵
  PID:11284
- C:\Windows\System\bUTbilZ.exe
  C:\Windows\System\bUTbilZ.exe
  2⤵
  PID:11300
- C:\Windows\System\UfFWpmL.exe
  C:\Windows\System\UfFWpmL.exe
  2⤵
  PID:11316
- C:\Windows\System\oMcFKDS.exe
  C:\Windows\System\oMcFKDS.exe
  2⤵
  PID:11340
- C:\Windows\System\mhvDWUS.exe
  C:\Windows\System\mhvDWUS.exe
  2⤵
  PID:11360
- C:\Windows\System\WgpUrXK.exe
  C:\Windows\System\WgpUrXK.exe
  2⤵
  PID:11392
- C:\Windows\System\NfJnlFz.exe
  C:\Windows\System\NfJnlFz.exe
  2⤵
  PID:11416
- C:\Windows\System\GjjzPlB.exe
  C:\Windows\System\GjjzPlB.exe
  2⤵
  PID:11440
- C:\Windows\System\jsqpIir.exe
  C:\Windows\System\jsqpIir.exe
  2⤵
  PID:11456
- C:\Windows\System\hGxPmYs.exe
  C:\Windows\System\hGxPmYs.exe
  2⤵
  PID:11484
- C:\Windows\System\bQTkaLR.exe
  C:\Windows\System\bQTkaLR.exe
  2⤵
  PID:11500
- C:\Windows\System\ULfCTUm.exe
  C:\Windows\System\ULfCTUm.exe
  2⤵
  PID:11520
- C:\Windows\System\LmxtRwx.exe
  C:\Windows\System\LmxtRwx.exe
  2⤵
  PID:11544
- C:\Windows\System\QwcRYIj.exe
  C:\Windows\System\QwcRYIj.exe
  2⤵
  PID:11568
- C:\Windows\System\UhoXWnH.exe
  C:\Windows\System\UhoXWnH.exe
  2⤵
  PID:11584
- C:\Windows\System\NzLQrqy.exe
  C:\Windows\System\NzLQrqy.exe
  2⤵
  PID:11612
- C:\Windows\System\PwSetoX.exe
  C:\Windows\System\PwSetoX.exe
  2⤵
  PID:11640
- C:\Windows\System\sqceJwX.exe
  C:\Windows\System\sqceJwX.exe
  2⤵
  PID:11660
- C:\Windows\System\QjdYvQu.exe
  C:\Windows\System\QjdYvQu.exe
  2⤵
  PID:11692
- C:\Windows\System\ZEWGtOF.exe
  C:\Windows\System\ZEWGtOF.exe
  2⤵
  PID:11720
- C:\Windows\System\inYJRUt.exe
  C:\Windows\System\inYJRUt.exe
  2⤵
  PID:11740
- C:\Windows\System\YwHmqXo.exe
  C:\Windows\System\YwHmqXo.exe
  2⤵
  PID:11764
- C:\Windows\System\mwKNZNt.exe
  C:\Windows\System\mwKNZNt.exe
  2⤵
  PID:11800
- C:\Windows\System\fOpvpNh.exe
  C:\Windows\System\fOpvpNh.exe
  2⤵
  PID:11816
- C:\Windows\System\ocWQseR.exe
  C:\Windows\System\ocWQseR.exe
  2⤵
  PID:11832
- C:\Windows\System\gUXoOzo.exe
  C:\Windows\System\gUXoOzo.exe
  2⤵
  PID:11848
- C:\Windows\System\XFLVUac.exe
  C:\Windows\System\XFLVUac.exe
  2⤵
  PID:11864
- C:\Windows\System\NdOruJd.exe
  C:\Windows\System\NdOruJd.exe
  2⤵
  PID:11880
- C:\Windows\System\dvDHKdT.exe
  C:\Windows\System\dvDHKdT.exe
  2⤵
  PID:11896
- C:\Windows\System\NYpVIzY.exe
  C:\Windows\System\NYpVIzY.exe
  2⤵
  PID:11912
- C:\Windows\System\lNBPvNs.exe
  C:\Windows\System\lNBPvNs.exe
  2⤵
  PID:11932
- C:\Windows\System\pEErbCV.exe
  C:\Windows\System\pEErbCV.exe
  2⤵
  PID:11956
- C:\Windows\System\yRExMBa.exe
  C:\Windows\System\yRExMBa.exe
  2⤵
  PID:11976
- C:\Windows\System\xwFRKGh.exe
  C:\Windows\System\xwFRKGh.exe
  2⤵
  PID:11996
- C:\Windows\System\LrlJnFD.exe
  C:\Windows\System\LrlJnFD.exe
  2⤵
  PID:12040
- C:\Windows\System\kILeesF.exe
  C:\Windows\System\kILeesF.exe
  2⤵
  PID:12064
- C:\Windows\System\CcVsjyP.exe
  C:\Windows\System\CcVsjyP.exe
  2⤵
  PID:12088
- C:\Windows\System\LgEDBLk.exe
  C:\Windows\System\LgEDBLk.exe
  2⤵
  PID:12112
- C:\Windows\System\vnEBwQP.exe
  C:\Windows\System\vnEBwQP.exe
  2⤵
  PID:12132
- C:\Windows\System\bkiAwri.exe
  C:\Windows\System\bkiAwri.exe
  2⤵
  PID:12152
- C:\Windows\System\nccfPEq.exe
  C:\Windows\System\nccfPEq.exe
  2⤵
  PID:12172
- C:\Windows\System\CAPmypp.exe
  C:\Windows\System\CAPmypp.exe
  2⤵
  PID:12204
- C:\Windows\System\gNpahbZ.exe
  C:\Windows\System\gNpahbZ.exe
  2⤵
  PID:12224
- C:\Windows\System\NVUchMj.exe
  C:\Windows\System\NVUchMj.exe
  2⤵
  PID:12244
- C:\Windows\System\WyYBNRd.exe
  C:\Windows\System\WyYBNRd.exe
  2⤵
  PID:12264
- C:\Windows\System\gZwdkuu.exe
  C:\Windows\System\gZwdkuu.exe
  2⤵
  PID:9300
- C:\Windows\System\PaGvUIA.exe
  C:\Windows\System\PaGvUIA.exe
  2⤵
  PID:6652
- C:\Windows\System\bBOhEdX.exe
  C:\Windows\System\bBOhEdX.exe
  2⤵
  PID:10680
- C:\Windows\System\RLOJAxi.exe
  C:\Windows\System\RLOJAxi.exe
  2⤵
  PID:9884
- C:\Windows\System\INGsQEG.exe
  C:\Windows\System\INGsQEG.exe
  2⤵
  PID:11280
- C:\Windows\System\ggDHzku.exe
  C:\Windows\System\ggDHzku.exe
  2⤵
  PID:10328
- C:\Windows\System\juGKYBf.exe
  C:\Windows\System\juGKYBf.exe
  2⤵
  PID:8204
- C:\Windows\System\flFjjxw.exe
  C:\Windows\System\flFjjxw.exe
  2⤵
  PID:10568
- C:\Windows\System\gnyQAnY.exe
  C:\Windows\System\gnyQAnY.exe
  2⤵
  PID:11448
- C:\Windows\System\rRrZZtp.exe
  C:\Windows\System\rRrZZtp.exe
  2⤵
  PID:10816
- C:\Windows\System\fKIXOiV.exe
  C:\Windows\System\fKIXOiV.exe
  2⤵
  PID:9276
- C:\Windows\System\pDlsVAv.exe
  C:\Windows\System\pDlsVAv.exe
  2⤵
  PID:9816
- C:\Windows\System\rGMdFxk.exe
  C:\Windows\System\rGMdFxk.exe
  2⤵
  PID:11716
- C:\Windows\System\AzRRAcT.exe
  C:\Windows\System\AzRRAcT.exe
  2⤵
  PID:11380
- C:\Windows\System\PFlphbt.exe
  C:\Windows\System\PFlphbt.exe
  2⤵
  PID:11424
- C:\Windows\System\NdaslBG.exe
  C:\Windows\System\NdaslBG.exe
  2⤵
  PID:10664
- C:\Windows\System\eAKXKEv.exe
  C:\Windows\System\eAKXKEv.exe
  2⤵
  PID:10732
- C:\Windows\System\YIWoGGS.exe
  C:\Windows\System\YIWoGGS.exe
  2⤵
  PID:11532
- C:\Windows\System\rUHlEaN.exe
  C:\Windows\System\rUHlEaN.exe
  2⤵
  PID:12076
- C:\Windows\System\DAIHwjF.exe
  C:\Windows\System\DAIHwjF.exe
  2⤵
  PID:12296
- C:\Windows\System\itmuYpb.exe
  C:\Windows\System\itmuYpb.exe
  2⤵
  PID:12320
- C:\Windows\System\ZSRSDjQ.exe
  C:\Windows\System\ZSRSDjQ.exe
  2⤵
  PID:12336
- C:\Windows\System\qRQSGlc.exe
  C:\Windows\System\qRQSGlc.exe
  2⤵
  PID:12356
- C:\Windows\System\CMAGdyL.exe
  C:\Windows\System\CMAGdyL.exe
  2⤵
  PID:12380
- C:\Windows\System\dpdizVX.exe
  C:\Windows\System\dpdizVX.exe
  2⤵
  PID:12400
- C:\Windows\System\tWwhjey.exe
  C:\Windows\System\tWwhjey.exe
  2⤵
  PID:12428
- C:\Windows\System\UshfuEh.exe
  C:\Windows\System\UshfuEh.exe
  2⤵
  PID:12448
- C:\Windows\System\vYjkYXn.exe
  C:\Windows\System\vYjkYXn.exe
  2⤵
  PID:12472
- C:\Windows\System\FCKQXqX.exe
  C:\Windows\System\FCKQXqX.exe
  2⤵
  PID:12492
- C:\Windows\System\iKDIzHd.exe
  C:\Windows\System\iKDIzHd.exe
  2⤵
  PID:12512
- C:\Windows\System\sLLpApO.exe
  C:\Windows\System\sLLpApO.exe
  2⤵
  PID:12536
- C:\Windows\System\DqCRlze.exe
  C:\Windows\System\DqCRlze.exe
  2⤵
  PID:12556
- C:\Windows\System\hyIpzcn.exe
  C:\Windows\System\hyIpzcn.exe
  2⤵
  PID:12580
- C:\Windows\System\zauuVZN.exe
  C:\Windows\System\zauuVZN.exe
  2⤵
  PID:12604
- C:\Windows\System\JnuxzFC.exe
  C:\Windows\System\JnuxzFC.exe
  2⤵
  PID:12624
- C:\Windows\System\akUyBNj.exe
  C:\Windows\System\akUyBNj.exe
  2⤵
  PID:12644
- C:\Windows\System\gHlUbzE.exe
  C:\Windows\System\gHlUbzE.exe
  2⤵
  PID:12672
- C:\Windows\System\BNVrXRJ.exe
  C:\Windows\System\BNVrXRJ.exe
  2⤵
  PID:12700
- C:\Windows\System\VOlDiFI.exe
  C:\Windows\System\VOlDiFI.exe
  2⤵
  PID:12716
- C:\Windows\System\JKQTVuo.exe
  C:\Windows\System\JKQTVuo.exe
  2⤵
  PID:12740
- C:\Windows\System\LpYbsmD.exe
  C:\Windows\System\LpYbsmD.exe
  2⤵
  PID:12764
- C:\Windows\System\vjKtDKL.exe
  C:\Windows\System\vjKtDKL.exe
  2⤵
  PID:12780
- C:\Windows\System\EaPGnwY.exe
  C:\Windows\System\EaPGnwY.exe
  2⤵
  PID:12804
- C:\Windows\System\jbXFuTf.exe
  C:\Windows\System\jbXFuTf.exe
  2⤵
  PID:12828
- C:\Windows\System\OGFbGES.exe
  C:\Windows\System\OGFbGES.exe
  2⤵
  PID:12852
- C:\Windows\System\vfQZJYn.exe
  C:\Windows\System\vfQZJYn.exe
  2⤵
  PID:12868
- C:\Windows\System\MjSGEzM.exe
  C:\Windows\System\MjSGEzM.exe
  2⤵
  PID:13196
- C:\Windows\System\NEPQSLq.exe
  C:\Windows\System\NEPQSLq.exe
  2⤵
  PID:13216
- C:\Windows\System\TtdCbEC.exe
  C:\Windows\System\TtdCbEC.exe
  2⤵
  PID:12328
- C:\Windows\System\hfrgRZf.exe
  C:\Windows\System\hfrgRZf.exe
  2⤵
  PID:12140
- C:\Windows\System\VlSNeXM.exe
  C:\Windows\System\VlSNeXM.exe
  2⤵
  PID:12120
- C:\Windows\System\FtwxDdy.exe
  C:\Windows\System\FtwxDdy.exe
  2⤵
  PID:12184
- C:\Windows\System\XjLRlwN.exe
  C:\Windows\System\XjLRlwN.exe
  2⤵
  PID:4796
- C:\Windows\System\xZduXJw.exe
  C:\Windows\System\xZduXJw.exe
  2⤵
  PID:13160
- C:\Windows\System\jqVhsED.exe
  C:\Windows\System\jqVhsED.exe
  2⤵
  PID:12692
- C:\Windows\System\lHCHufk.exe
  C:\Windows\System\lHCHufk.exe
  2⤵
  PID:12924
- C:\Windows\System\jNEsQCj.exe
  C:\Windows\System\jNEsQCj.exe
  2⤵
  PID:13248
- C:\Windows\System\hQhbvmF.exe
  C:\Windows\System\hQhbvmF.exe
  2⤵
  PID:13268
- C:\Windows\System\ADmtewx.exe
  C:\Windows\System\ADmtewx.exe
  2⤵
  PID:11188
- C:\Windows\System\zOnewDY.exe
  C:\Windows\System\zOnewDY.exe
  2⤵
  PID:12212
- C:\Windows\System\dRBfqTi.exe
  C:\Windows\System\dRBfqTi.exe
  2⤵
  PID:12660
- C:\Windows\System\satRHmm.exe
  C:\Windows\System\satRHmm.exe
  2⤵
  PID:12392
- C:\Windows\System\niRjLBj.exe
  C:\Windows\System\niRjLBj.exe
  2⤵
  PID:3740
- C:\Windows\System\iHhCpdJ.exe
  C:\Windows\System\iHhCpdJ.exe
  2⤵
  PID:12792
- C:\Windows\System\TkNWcsQ.exe
  C:\Windows\System\TkNWcsQ.exe
  2⤵
  PID:13240
- C:\Windows\System\AGlWImQ.exe
  C:\Windows\System\AGlWImQ.exe
  2⤵
  PID:1576
- C:\Windows\System\KDEgVFn.exe
  C:\Windows\System\KDEgVFn.exe
  2⤵
  PID:12896
- C:\Windows\System\CzjNBhu.exe
  C:\Windows\System\CzjNBhu.exe
  2⤵
  PID:13184
- C:\Windows\System\ropdwjy.exe
  C:\Windows\System\ropdwjy.exe
  2⤵
  PID:13124
- C:\Windows\System\BFnqfEe.exe
  C:\Windows\System\BFnqfEe.exe
  2⤵
  PID:13088
- C:\Windows\System\VDakohO.exe
  C:\Windows\System\VDakohO.exe
  2⤵
  PID:11044
- C:\Windows\System\KRpioBV.exe
  C:\Windows\System\KRpioBV.exe
  2⤵
  PID:11684
- C:\Windows\System\DpKJlww.exe
  C:\Windows\System\DpKJlww.exe
  2⤵
  PID:13244
- C:\Windows\System\mZMxVQf.exe
  C:\Windows\System\mZMxVQf.exe
  2⤵
  PID:13284
- C:\Windows\System\vTjFHDZ.exe
  C:\Windows\System\vTjFHDZ.exe
  2⤵
  PID:11856
- C:\Windows\System\ypuKwAj.exe
  C:\Windows\System\ypuKwAj.exe
  2⤵
  PID:11480
- C:\Windows\System\pgsVOdu.exe
  C:\Windows\System\pgsVOdu.exe
  2⤵
  PID:10344
- C:\Windows\System\TzvLcXf.exe
  C:\Windows\System\TzvLcXf.exe
  2⤵
  PID:11888
- C:\Windows\System\RcvBuao.exe
  C:\Windows\System\RcvBuao.exe
  2⤵
  PID:12732
- C:\Windows\System\XVZJcoo.exe
  C:\Windows\System\XVZJcoo.exe
  2⤵
  PID:11596
- C:\Windows\System\zxkggce.exe
  C:\Windows\System\zxkggce.exe
  2⤵
  PID:2044
- C:\Windows\System\jYSmTcr.exe
  C:\Windows\System\jYSmTcr.exe
  2⤵
  PID:4492
- C:\Windows\System\VLNjlbm.exe
  C:\Windows\System\VLNjlbm.exe
  2⤵
  PID:12968
- C:\Windows\System\lnpClFM.exe
  C:\Windows\System\lnpClFM.exe
  2⤵
  PID:12440
- C:\Windows\System\feiHUdg.exe
  C:\Windows\System\feiHUdg.exe
  2⤵
  PID:12280
- C:\Windows\System\iMfEBSt.exe
  C:\Windows\System\iMfEBSt.exe
  2⤵
  PID:12460
- C:\Windows\System\fblIRCF.exe
  C:\Windows\System\fblIRCF.exe
  2⤵
  PID:3684
- C:\Windows\System\WYfaVdY.exe
  C:\Windows\System\WYfaVdY.exe
  2⤵
  PID:13224
- C:\Windows\System\AcUecCA.exe
  C:\Windows\System\AcUecCA.exe
  2⤵
  PID:2992
- C:\Windows\System\eypkiiQ.exe
  C:\Windows\System\eypkiiQ.exe
  2⤵
  PID:11828
- C:\Windows\System\CKoDtaO.exe
  C:\Windows\System\CKoDtaO.exe
  2⤵
  PID:13040
- C:\Windows\System\GyBdlLB.exe
  C:\Windows\System\GyBdlLB.exe
  2⤵
  PID:5092
- C:\Windows\System\eRVpKQP.exe
  C:\Windows\System\eRVpKQP.exe
  2⤵
  PID:2152
- C:\Windows\System\UndkoDl.exe
  C:\Windows\System\UndkoDl.exe
  2⤵
  PID:9628
- C:\Windows\System\HwQbQQd.exe
  C:\Windows\System\HwQbQQd.exe
  2⤵
  PID:13292
- C:\Windows\System\vbfLlQe.exe
  C:\Windows\System\vbfLlQe.exe
  2⤵
  PID:12636
- C:\Windows\System\bsoHPqV.exe
  C:\Windows\System\bsoHPqV.exe
  2⤵
  PID:4688
- C:\Windows\System\SLStjbM.exe
  C:\Windows\System\SLStjbM.exe
  2⤵
  PID:12984
- C:\Windows\System\jvQtBrz.exe
  C:\Windows\System\jvQtBrz.exe
  2⤵
  PID:13000
- C:\Windows\System\RdRGjKc.exe
  C:\Windows\System\RdRGjKc.exe
  2⤵
  PID:868
- C:\Windows\System\BkFLLoZ.exe
  C:\Windows\System\BkFLLoZ.exe
  2⤵
  PID:12008
- C:\Windows\System\DoFapui.exe
  C:\Windows\System\DoFapui.exe
  2⤵
  PID:3540
- C:\Windows\System\zYZrTHI.exe
  C:\Windows\System\zYZrTHI.exe
  2⤵
  PID:11876
- C:\Windows\System\MbllPjk.exe
  C:\Windows\System\MbllPjk.exe
  2⤵
  PID:10124
- C:\Windows\System\WCuSPsc.exe
  C:\Windows\System\WCuSPsc.exe
  2⤵
  PID:1660
- C:\Windows\System\reqNzIA.exe
  C:\Windows\System\reqNzIA.exe
  2⤵
  PID:11464
- C:\Windows\System\GYLWLUP.exe
  C:\Windows\System\GYLWLUP.exe
  2⤵
  PID:440
- C:\Windows\System\oSNqtko.exe
  C:\Windows\System\oSNqtko.exe
  2⤵
  PID:12920
- C:\Windows\System\iXlIgRP.exe
  C:\Windows\System\iXlIgRP.exe
  2⤵
  PID:3616
- C:\Windows\System\VSmmeSS.exe
  C:\Windows\System\VSmmeSS.exe
  2⤵
  PID:2060
- C:\Windows\System\LUYYiTw.exe
  C:\Windows\System\LUYYiTw.exe
  2⤵
  PID:10592
- C:\Windows\System\nxQraAF.exe
  C:\Windows\System\nxQraAF.exe
  2⤵
  PID:12316
- C:\Windows\System\UfIAmIs.exe
  C:\Windows\System\UfIAmIs.exe
  2⤵
  PID:2920
- C:\Windows\System\KjWdXzr.exe
  C:\Windows\System\KjWdXzr.exe
  2⤵
  PID:11400
- C:\Windows\System\NzolsPh.exe
  C:\Windows\System\NzolsPh.exe
  2⤵
  PID:12708
- C:\Windows\System\LpXSMIj.exe
  C:\Windows\System\LpXSMIj.exe
  2⤵
  PID:11032
- C:\Windows\System\gaeFsGg.exe
  C:\Windows\System\gaeFsGg.exe
  2⤵
  PID:7692
- C:\Windows\System\tAsQXny.exe
  C:\Windows\System\tAsQXny.exe
  2⤵
  PID:896
- C:\Windows\System\HZJSWEG.exe
  C:\Windows\System\HZJSWEG.exe
  2⤵
  PID:3460
- C:\Windows\System\pJhcvut.exe
  C:\Windows\System\pJhcvut.exe
  2⤵
  PID:912
- C:\Windows\System\bHGsKOS.exe
  C:\Windows\System\bHGsKOS.exe
  2⤵
  PID:4904
- C:\Windows\System\bEqMrhE.exe
  C:\Windows\System\bEqMrhE.exe
  2⤵
  PID:3136
- C:\Windows\System\ksDLHKe.exe
  C:\Windows\System\ksDLHKe.exe
  2⤵
  PID:3108
- C:\Windows\System\LoERLNi.exe
  C:\Windows\System\LoERLNi.exe
  2⤵
  PID:4276
- C:\Windows\System\XIKQxmG.exe
  C:\Windows\System\XIKQxmG.exe
  2⤵
  PID:4732
- C:\Windows\System\PhhdpMC.exe
  C:\Windows\System\PhhdpMC.exe
  2⤵
  PID:2576
- C:\Windows\System\HQTMaOD.exe
  C:\Windows\System\HQTMaOD.exe
  2⤵
  PID:644
- C:\Windows\System\UImqKrc.exe
  C:\Windows\System\UImqKrc.exe
  2⤵
  PID:4036
- C:\Windows\System\FuMbuGM.exe
  C:\Windows\System\FuMbuGM.exe
  2⤵
  PID:12240
- C:\Windows\System\ZqwTEAp.exe
  C:\Windows\System\ZqwTEAp.exe
  2⤵
  PID:2484
- C:\Windows\System\lxcEUfX.exe
  C:\Windows\System\lxcEUfX.exe
  2⤵
  PID:9536
- C:\Windows\System\RCSqGAQ.exe
  C:\Windows\System\RCSqGAQ.exe
  2⤵
  PID:12940
- C:\Windows\System\YUKlFrr.exe
  C:\Windows\System\YUKlFrr.exe
  2⤵
  PID:10236
- C:\Windows\System\azruPtl.exe
  C:\Windows\System\azruPtl.exe
  2⤵
  PID:4840
- C:\Windows\System\ZtEThBI.exe
  C:\Windows\System\ZtEThBI.exe
  2⤵
  PID:3056
- C:\Windows\System\yLcxiVA.exe
  C:\Windows\System\yLcxiVA.exe
  2⤵
  PID:11408
- C:\Windows\System\cTHNWGn.exe
  C:\Windows\System\cTHNWGn.exe
  2⤵
  PID:3172
- C:\Windows\System\sTkQTwn.exe
  C:\Windows\System\sTkQTwn.exe
  2⤵
  PID:2784
- C:\Windows\System\tLpfQfr.exe
  C:\Windows\System\tLpfQfr.exe
  2⤵
  PID:3632
- C:\Windows\System\PkuJSOH.exe
  C:\Windows\System\PkuJSOH.exe
  2⤵
  PID:12756
- C:\Windows\System\ZLNrjxC.exe
  C:\Windows\System\ZLNrjxC.exe
  2⤵
  PID:12996
- C:\Windows\System\NWtWplH.exe
  C:\Windows\System\NWtWplH.exe
  2⤵
  PID:1932
- C:\Windows\System\HuwilBR.exe
  C:\Windows\System\HuwilBR.exe
  2⤵
  PID:13316
- C:\Windows\System\HapvfgN.exe
  C:\Windows\System\HapvfgN.exe
  2⤵
  PID:13332
- C:\Windows\System\CgADEvm.exe
  C:\Windows\System\CgADEvm.exe
  2⤵
  PID:13360
- C:\Windows\System\CliwrAy.exe
  C:\Windows\System\CliwrAy.exe
  2⤵
  PID:13388
- C:\Windows\System\uDbZxep.exe
  C:\Windows\System\uDbZxep.exe
  2⤵
  PID:13408
- C:\Windows\System\KCWZkvU.exe
  C:\Windows\System\KCWZkvU.exe
  2⤵
  PID:13436
- C:\Windows\System\svImmXk.exe
  C:\Windows\System\svImmXk.exe
  2⤵
  PID:13452
- C:\Windows\System\ovOQikw.exe
  C:\Windows\System\ovOQikw.exe
  2⤵
  PID:13724
- C:\Windows\System\gjTVoFK.exe
  C:\Windows\System\gjTVoFK.exe
  2⤵
  PID:13848
- C:\Windows\System\LfnskgG.exe
  C:\Windows\System\LfnskgG.exe
  2⤵
  PID:13872
- C:\Windows\System\LNSnjeL.exe
  C:\Windows\System\LNSnjeL.exe
  2⤵
  PID:13892
- C:\Windows\System\mcMYaXG.exe
  C:\Windows\System\mcMYaXG.exe
  2⤵
  PID:13908
- C:\Windows\System\OEyNeOq.exe
  C:\Windows\System\OEyNeOq.exe
  2⤵
  PID:13180
- C:\Windows\System\GcsnvRJ.exe
  C:\Windows\System\GcsnvRJ.exe
  2⤵
  PID:13400
- C:\Windows\System\MXJhukR.exe
  C:\Windows\System\MXJhukR.exe
  2⤵
  PID:13580
- C:\Windows\System\emwOyIG.exe
  C:\Windows\System\emwOyIG.exe
  2⤵
  PID:4784
- C:\Windows\System\ZjBxsEg.exe
  C:\Windows\System\ZjBxsEg.exe
  2⤵
  PID:5516
- C:\Windows\System\yvwyfJg.exe
  C:\Windows\System\yvwyfJg.exe
  2⤵
  PID:13808
- C:\Windows\System\PATwqwU.exe
  C:\Windows\System\PATwqwU.exe
  2⤵
  PID:5400
- C:\Windows\System\MdeyQmA.exe
  C:\Windows\System\MdeyQmA.exe
  2⤵
  PID:13740
- C:\Windows\System\mcoPewz.exe
  C:\Windows\System\mcoPewz.exe
  2⤵
  PID:13840
- C:\Windows\System\ZCnjzYp.exe
  C:\Windows\System\ZCnjzYp.exe
  2⤵
  PID:13688
- C:\Windows\System\CtRzZdE.exe
  C:\Windows\System\CtRzZdE.exe
  2⤵
  PID:13660
- C:\Windows\System\XtIIhyR.exe
  C:\Windows\System\XtIIhyR.exe
  2⤵
  PID:13816
- C:\Windows\System\XZHylAE.exe
  C:\Windows\System\XZHylAE.exe
  2⤵
  PID:1188
- C:\Windows\System\fagItto.exe
  C:\Windows\System\fagItto.exe
  2⤵
  PID:13900
- C:\Windows\System\dqqgANH.exe
  C:\Windows\System\dqqgANH.exe
  2⤵
  PID:13904
- C:\Windows\System\qfJPFeL.exe
  C:\Windows\System\qfJPFeL.exe
  2⤵
  PID:13964
- C:\Windows\System\AjYGrdp.exe
  C:\Windows\System\AjYGrdp.exe
  2⤵
  PID:14004
- C:\Windows\System\FLeNuSi.exe
  C:\Windows\System\FLeNuSi.exe
  2⤵
  PID:14016
- C:\Windows\System\AOvOqbR.exe
  C:\Windows\System\AOvOqbR.exe
  2⤵
  PID:5784
- C:\Windows\System\eCzyTCv.exe
  C:\Windows\System\eCzyTCv.exe
  2⤵
  PID:14156
- C:\Windows\System\ZnAgYqU.exe
  C:\Windows\System\ZnAgYqU.exe
  2⤵
  PID:14176
- C:\Windows\System\FGsichj.exe
  C:\Windows\System\FGsichj.exe
  2⤵
  PID:14196
- C:\Windows\System\ikGFyNF.exe
  C:\Windows\System\ikGFyNF.exe
  2⤵
  PID:14216
- C:\Windows\System\mSebOVq.exe
  C:\Windows\System\mSebOVq.exe
  2⤵
  PID:14236
- C:\Windows\System\OAleODi.exe
  C:\Windows\System\OAleODi.exe
  2⤵
  PID:14248
- C:\Windows\System\JPqXNnh.exe
  C:\Windows\System\JPqXNnh.exe
  2⤵
  PID:14256
- C:\Windows\System\PRasEfR.exe
  C:\Windows\System\PRasEfR.exe
  2⤵
  PID:14268
- C:\Windows\System\dMCiLPe.exe
  C:\Windows\System\dMCiLPe.exe
  2⤵
  PID:6220
- C:\Windows\System\iLIOvTz.exe
  C:\Windows\System\iLIOvTz.exe
  2⤵
  PID:14296
- C:\Windows\System\wYkHIRJ.exe
  C:\Windows\System\wYkHIRJ.exe
  2⤵
  PID:14316
- C:\Windows\System\CnUMelh.exe
  C:\Windows\System\CnUMelh.exe
  2⤵
  PID:13608
- C:\Windows\System\yQHbLnv.exe
  C:\Windows\System\yQHbLnv.exe
  2⤵
  PID:13668
- C:\Windows\System\voMNgav.exe
  C:\Windows\System\voMNgav.exe
  2⤵
  PID:13736
- C:\Windows\System\ADleocj.exe
  C:\Windows\System\ADleocj.exe
  2⤵
  PID:3936
- C:\Windows\System\xhsoaQo.exe
  C:\Windows\System\xhsoaQo.exe
  2⤵
  PID:5372
- C:\Windows\System\kEfkKzj.exe
  C:\Windows\System\kEfkKzj.exe
  2⤵
  PID:3452
- C:\Windows\System\PrZVwCp.exe
  C:\Windows\System\PrZVwCp.exe
  2⤵
  PID:14040
- C:\Windows\System\xbYQuIi.exe
  C:\Windows\System\xbYQuIi.exe
  2⤵
  PID:14052
- C:\Windows\System\FroXxOy.exe
  C:\Windows\System\FroXxOy.exe
  2⤵
  PID:14060
- C:\Windows\System\goiGqMJ.exe
  C:\Windows\System\goiGqMJ.exe
  2⤵
  PID:14080
- C:\Windows\System\FIVCLjz.exe
  C:\Windows\System\FIVCLjz.exe
  2⤵
  PID:14100
- C:\Windows\System\BwjPoFz.exe
  C:\Windows\System\BwjPoFz.exe
  2⤵
  PID:5680
- C:\Windows\System\twRluzL.exe
  C:\Windows\System\twRluzL.exe
  2⤵
  PID:5548
- C:\Windows\System\cjcuqmX.exe
  C:\Windows\System\cjcuqmX.exe
  2⤵
  PID:14136
- C:\Windows\System\vWtcXTm.exe
  C:\Windows\System\vWtcXTm.exe
  2⤵
  PID:2260
- C:\Windows\System\SuIJmMF.exe
  C:\Windows\System\SuIJmMF.exe
  2⤵
  PID:5412
- C:\Windows\System\qYOvUaa.exe
  C:\Windows\System\qYOvUaa.exe
  2⤵
  PID:5564
- C:\Windows\System\tnXkRoM.exe
  C:\Windows\System\tnXkRoM.exe
  2⤵
  PID:14288
- C:\Windows\System\TuLdTuR.exe
  C:\Windows\System\TuLdTuR.exe
  2⤵
  PID:13988
- C:\Windows\System\yvWtyVY.exe
  C:\Windows\System\yvWtyVY.exe
  2⤵
  PID:14252
- C:\Windows\System\vXhsHwH.exe
  C:\Windows\System\vXhsHwH.exe
  2⤵
  PID:14304
- C:\Windows\System\MQSzZYD.exe
  C:\Windows\System\MQSzZYD.exe
  2⤵
  PID:14224
- C:\Windows\System\TQyNhqN.exe
  C:\Windows\System\TQyNhqN.exe
  2⤵
  PID:6152
- C:\Windows\System\Rixywce.exe
  C:\Windows\System\Rixywce.exe
  2⤵
  PID:14096
- C:\Windows\System\Oudrlvm.exe
  C:\Windows\System\Oudrlvm.exe
  2⤵
  PID:14328
- C:\Windows\System\YHzNPHr.exe
  C:\Windows\System\YHzNPHr.exe
  2⤵
  PID:3848
- C:\Windows\System\QDdjBhP.exe
  C:\Windows\System\QDdjBhP.exe
  2⤵
  PID:6924
- C:\Windows\System\FUrXCBX.exe
  C:\Windows\System\FUrXCBX.exe
  2⤵
  PID:1920
- C:\Windows\System\LPXiUoH.exe
  C:\Windows\System\LPXiUoH.exe
  2⤵
  PID:6700
- C:\Windows\System\TVNkOeH.exe
  C:\Windows\System\TVNkOeH.exe
  2⤵
  PID:5560
- C:\Windows\System\gesaabX.exe
  C:\Windows\System\gesaabX.exe
  2⤵
  PID:5248
- C:\Windows\System\IThzfHs.exe
  C:\Windows\System\IThzfHs.exe
  2⤵
  PID:13272
- C:\Windows\System\zBXGGnf.exe
  C:\Windows\System\zBXGGnf.exe
  2⤵
  PID:5924
- C:\Windows\System\NOGaEar.exe
  C:\Windows\System\NOGaEar.exe
  2⤵
  PID:13328
- C:\Windows\System\momeIDk.exe
  C:\Windows\System\momeIDk.exe
  2⤵
  PID:4728
- C:\Windows\System\UFkAodt.exe
  C:\Windows\System\UFkAodt.exe
  2⤵
  PID:13592
- C:\Windows\System\eGOLGMl.exe
  C:\Windows\System\eGOLGMl.exe
  2⤵
  PID:5304
- C:\Windows\System\jPUinqm.exe
  C:\Windows\System\jPUinqm.exe
  2⤵
  PID:13464
- C:\Windows\System\tXHNKKr.exe
  C:\Windows\System\tXHNKKr.exe
  2⤵
  PID:13444
- C:\Windows\System\MyIFPMu.exe
  C:\Windows\System\MyIFPMu.exe
  2⤵
  PID:14068
- C:\Windows\System\CfEQHCI.exe
  C:\Windows\System\CfEQHCI.exe
  2⤵
  PID:5264
- C:\Windows\System\GyeEXAf.exe
  C:\Windows\System\GyeEXAf.exe
  2⤵
  PID:5032
- C:\Windows\System\rJXtxAo.exe
  C:\Windows\System\rJXtxAo.exe
  2⤵
  PID:5688
- C:\Windows\System\rIqprDC.exe
  C:\Windows\System\rIqprDC.exe
  2⤵
  PID:5388
- C:\Windows\System\rNGvIsk.exe
  C:\Windows\System\rNGvIsk.exe
  2⤵
  PID:4516
- C:\Windows\System\ObTNkpD.exe
  C:\Windows\System\ObTNkpD.exe
  2⤵
  PID:4384
- C:\Windows\System\UGlIMRa.exe
  C:\Windows\System\UGlIMRa.exe
  2⤵
  PID:14092
- C:\Windows\System\wHsQaVg.exe
  C:\Windows\System\wHsQaVg.exe
  2⤵
  PID:13832
- C:\Windows\System\aHYPKAN.exe
  C:\Windows\System\aHYPKAN.exe
  2⤵
  PID:13720
- C:\Windows\System\gHScTOs.exe
  C:\Windows\System\gHScTOs.exe
  2⤵
  PID:13628
- C:\Windows\System\tMPUGfh.exe
  C:\Windows\System\tMPUGfh.exe
  2⤵
  PID:4076
- C:\Windows\System\CtpgVrw.exe
  C:\Windows\System\CtpgVrw.exe
  2⤵
  PID:14036
- C:\Windows\System\rFCYNYu.exe
  C:\Windows\System\rFCYNYu.exe
  2⤵
  PID:3464
- C:\Windows\System\zjdfewu.exe
  C:\Windows\System\zjdfewu.exe
  2⤵
  PID:5728
- C:\Windows\System\rcbkjRw.exe
  C:\Windows\System\rcbkjRw.exe
  2⤵
  PID:5144
- C:\Windows\System\kEjtEyq.exe
  C:\Windows\System\kEjtEyq.exe
  2⤵
  PID:11860
- C:\Windows\System\BbUIOCB.exe
  C:\Windows\System\BbUIOCB.exe
  2⤵
  PID:14000
- C:\Windows\System\HknDeYD.exe
  C:\Windows\System\HknDeYD.exe
  2⤵
  PID:5580
- C:\Windows\System\Zwzynva.exe
  C:\Windows\System\Zwzynva.exe
  2⤵
  PID:3168
- C:\Windows\System\MDCGEJA.exe
  C:\Windows\System\MDCGEJA.exe
  2⤵
  PID:12908
- C:\Windows\System\iISDIlL.exe
  C:\Windows\System\iISDIlL.exe
  2⤵
  PID:5180
- C:\Windows\System\jVYgGls.exe
  C:\Windows\System\jVYgGls.exe
  2⤵
  PID:14208
- C:\Windows\System\uUJwkxJ.exe
  C:\Windows\System\uUJwkxJ.exe
  2⤵
  PID:14172
- C:\Windows\System\WKhtCMU.exe
  C:\Windows\System\WKhtCMU.exe
  2⤵
  PID:1544
- C:\Windows\System\ZuysFqO.exe
  C:\Windows\System\ZuysFqO.exe
  2⤵
  PID:5816
- C:\Windows\System\zrRPXeX.exe
  C:\Windows\System\zrRPXeX.exe
  2⤵
  PID:2756
- C:\Windows\System\INXAwyS.exe
  C:\Windows\System\INXAwyS.exe
  2⤵
  PID:13992
- C:\Windows\System\KVQxKsi.exe
  C:\Windows\System\KVQxKsi.exe
  2⤵
  PID:6084
- C:\Windows\System\eYyrDGt.exe
  C:\Windows\System\eYyrDGt.exe
  2⤵
  PID:5240
- C:\Windows\System\zGGObQB.exe
  C:\Windows\System\zGGObQB.exe
  2⤵
  PID:5876
- C:\Windows\System\LsOnNMM.exe
  C:\Windows\System\LsOnNMM.exe
  2⤵
  PID:6172
- C:\Windows\System\dnDEDYG.exe
  C:\Windows\System\dnDEDYG.exe
  2⤵
  PID:14076
- C:\Windows\System\YDmAyop.exe
  C:\Windows\System\YDmAyop.exe
  2⤵
  PID:3672
- C:\Windows\System\zpRbNHV.exe
  C:\Windows\System\zpRbNHV.exe
  2⤵
  PID:6040
- C:\Windows\System\pgEXeJR.exe
  C:\Windows\System\pgEXeJR.exe
  2⤵
  PID:5284
- C:\Windows\System\GDoeXZM.exe
  C:\Windows\System\GDoeXZM.exe
  2⤵
  PID:13656
- C:\Windows\System\KgtwDNW.exe
  C:\Windows\System\KgtwDNW.exe
  2⤵
  PID:6516
- C:\Windows\System\rHjSyvt.exe
  C:\Windows\System\rHjSyvt.exe
  2⤵
  PID:5624
- C:\Windows\System\fEUMDou.exe
  C:\Windows\System\fEUMDou.exe
  2⤵
  PID:6324
- C:\Windows\System\PnRrcsr.exe
  C:\Windows\System\PnRrcsr.exe
  2⤵
  PID:5656
- C:\Windows\System\nhKHgNC.exe
  C:\Windows\System\nhKHgNC.exe
  2⤵
  PID:3580
- C:\Windows\System\HejIJDf.exe
  C:\Windows\System\HejIJDf.exe
  2⤵
  PID:4388
- C:\Windows\System\cdPWVXt.exe
  C:\Windows\System\cdPWVXt.exe
  2⤵
  PID:5208
- C:\Windows\System\mjiVGer.exe
  C:\Windows\System\mjiVGer.exe
  2⤵
  PID:3356
- C:\Windows\System\yxXGjAD.exe
  C:\Windows\System\yxXGjAD.exe
  2⤵
  PID:6840
- C:\Windows\System\HQlZnWo.exe
  C:\Windows\System\HQlZnWo.exe
  2⤵
  PID:6868
- C:\Windows\System\PdElURx.exe
  C:\Windows\System\PdElURx.exe
  2⤵
  PID:5636
- C:\Windows\System\RdvjgZh.exe
  C:\Windows\System\RdvjgZh.exe
  2⤵
  PID:13952
- C:\Windows\System\RFvgCcK.exe
  C:\Windows\System\RFvgCcK.exe
  2⤵
  PID:6964
- C:\Windows\System\QtHEYSU.exe
  C:\Windows\System\QtHEYSU.exe
  2⤵
  PID:6192
- C:\Windows\System\pCQuaFS.exe
  C:\Windows\System\pCQuaFS.exe
  2⤵
  PID:5168
- C:\Windows\System\wUQnTty.exe
  C:\Windows\System\wUQnTty.exe
  2⤵
  PID:6276
- C:\Windows\System\mRLsxae.exe
  C:\Windows\System\mRLsxae.exe
  2⤵
  PID:5704
- C:\Windows\System\YmnWYNe.exe
  C:\Windows\System\YmnWYNe.exe
  2⤵
  PID:4316
- C:\Windows\System\bOzJMgF.exe
  C:\Windows\System\bOzJMgF.exe
  2⤵
  PID:5964
- C:\Windows\System\gtxQkNo.exe
  C:\Windows\System\gtxQkNo.exe
  2⤵
  PID:6476
- C:\Windows\System\SnWKAbo.exe
  C:\Windows\System\SnWKAbo.exe
  2⤵
  PID:6724
- C:\Windows\System\pmIiVoZ.exe
  C:\Windows\System\pmIiVoZ.exe
  2⤵
  PID:7400
- C:\Windows\System\OjhTITt.exe
  C:\Windows\System\OjhTITt.exe
  2⤵
  PID:5860
- C:\Windows\System\cjVgzeF.exe
  C:\Windows\System\cjVgzeF.exe
  2⤵
  PID:14376
- C:\Windows\System\cVZNfFO.exe
  C:\Windows\System\cVZNfFO.exe
  2⤵
  PID:14396
- C:\Windows\System\nZJSnjA.exe
  C:\Windows\System\nZJSnjA.exe
  2⤵
  PID:14416
- C:\Windows\System\dOXULfF.exe
  C:\Windows\System\dOXULfF.exe
  2⤵
  PID:14432
- C:\Windows\System\mIMiVDm.exe
  C:\Windows\System\mIMiVDm.exe
  2⤵
  PID:14476
- C:\Windows\System\IlgLttz.exe
  C:\Windows\System\IlgLttz.exe
  2⤵
  PID:14500
- C:\Windows\System\WxGoCWG.exe
  C:\Windows\System\WxGoCWG.exe
  2⤵
  PID:14520
- C:\Windows\System\ofthfSG.exe
  C:\Windows\System\ofthfSG.exe
  2⤵
  PID:14540
- C:\Windows\System\FHqHMRH.exe
  C:\Windows\System\FHqHMRH.exe
  2⤵
  PID:14628
- C:\Windows\System\pPnVnBY.exe
  C:\Windows\System\pPnVnBY.exe
  2⤵
  PID:14680
- C:\Windows\System\TgkELkV.exe
  C:\Windows\System\TgkELkV.exe
  2⤵
  PID:14872
- C:\Windows\System\tnuXvqQ.exe
  C:\Windows\System\tnuXvqQ.exe
  2⤵
  PID:14900
- C:\Windows\System\CsznNAX.exe
  C:\Windows\System\CsznNAX.exe
  2⤵
  PID:14916
- C:\Windows\System\ivwSRiQ.exe
  C:\Windows\System\ivwSRiQ.exe
  2⤵
  PID:14940
- C:\Windows\System\oIiJQZE.exe
  C:\Windows\System\oIiJQZE.exe
  2⤵
  PID:14964
- C:\Windows\System\OShUXUH.exe
  C:\Windows\System\OShUXUH.exe
  2⤵
  PID:14980
- C:\Windows\System\PFNeDSK.exe
  C:\Windows\System\PFNeDSK.exe
  2⤵
  PID:15004
- C:\Windows\System\zTtrRib.exe
  C:\Windows\System\zTtrRib.exe
  2⤵
  PID:15040
- C:\Windows\System\uhZTdrZ.exe
  C:\Windows\System\uhZTdrZ.exe
  2⤵
  PID:15064
- C:\Windows\System\RgiRpyi.exe
  C:\Windows\System\RgiRpyi.exe
  2⤵
  PID:15240
- C:\Windows\System\WlrQCYM.exe
  C:\Windows\System\WlrQCYM.exe
  2⤵
  PID:15348
- C:\Windows\System\PBKgxyF.exe
  C:\Windows\System\PBKgxyF.exe
  2⤵
  PID:6628
- C:\Windows\System\zlqmENB.exe
  C:\Windows\System\zlqmENB.exe
  2⤵
  PID:6456
- C:\Windows\System\znhwMCU.exe
  C:\Windows\System\znhwMCU.exe
  2⤵
  PID:2940
- C:\Windows\System\nNQJIjj.exe
  C:\Windows\System\nNQJIjj.exe
  2⤵
  PID:7448
- C:\Windows\System\btvQHMO.exe
  C:\Windows\System\btvQHMO.exe
  2⤵
  PID:13752
- C:\Windows\System\EKpdYLf.exe
  C:\Windows\System\EKpdYLf.exe
  2⤵
  PID:14372
- C:\Windows\System\eTAcvvO.exe
  C:\Windows\System\eTAcvvO.exe
  2⤵
  PID:6460
- C:\Windows\System\cVbtzzL.exe
  C:\Windows\System\cVbtzzL.exe
  2⤵
  PID:7076
- C:\Windows\System\niSbtZh.exe
  C:\Windows\System\niSbtZh.exe
  2⤵
  PID:7880
- C:\Windows\System\mzeroDF.exe
  C:\Windows\System\mzeroDF.exe
  2⤵
  PID:14444
- C:\Windows\System\uWHrHhc.exe
  C:\Windows\System\uWHrHhc.exe
  2⤵
  PID:14468
- C:\Windows\System\EgXpwvI.exe
  C:\Windows\System\EgXpwvI.exe
  2⤵
  PID:14552
- C:\Windows\System\aKEvZCa.exe
  C:\Windows\System\aKEvZCa.exe
  2⤵
  PID:14348
- C:\Windows\System\cbilAYp.exe
  C:\Windows\System\cbilAYp.exe
  2⤵
  PID:14464
- C:\Windows\System\lyokjsr.exe
  C:\Windows\System\lyokjsr.exe
  2⤵
  PID:14488
- C:\Windows\System\jDdkomm.exe
  C:\Windows\System\jDdkomm.exe
  2⤵
  PID:14548
- C:\Windows\System\hNtgbNs.exe
  C:\Windows\System\hNtgbNs.exe
  2⤵
  PID:7576
- C:\Windows\System\CivDPow.exe
  C:\Windows\System\CivDPow.exe
  2⤵
  PID:14644
- C:\Windows\System\FleRwRW.exe
  C:\Windows\System\FleRwRW.exe
  2⤵
  PID:14700
- C:\Windows\System\HoTFuKU.exe
  C:\Windows\System\HoTFuKU.exe
  2⤵
  PID:8112
- C:\Windows\System\BhbWswC.exe
  C:\Windows\System\BhbWswC.exe
  2⤵
  PID:7260
- C:\Windows\System\UmQPEeX.exe
  C:\Windows\System\UmQPEeX.exe
  2⤵
  PID:2956
- C:\Windows\System\DJwJuyL.exe
  C:\Windows\System\DJwJuyL.exe
  2⤵
  PID:6048
- C:\Windows\System\iDrznWg.exe
  C:\Windows\System\iDrznWg.exe
  2⤵
  PID:8148
- C:\Windows\System\FTSoQLc.exe
  C:\Windows\System\FTSoQLc.exe
  2⤵
  PID:8064
- C:\Windows\System\ZcKzQAK.exe
  C:\Windows\System\ZcKzQAK.exe
  2⤵
  PID:15292
- C:\Windows\System\UPEELwx.exe
  C:\Windows\System\UPEELwx.exe
  2⤵
  PID:15184
- C:\Windows\System\jzcUghw.exe
  C:\Windows\System\jzcUghw.exe
  2⤵
  PID:7836
- C:\Windows\System\GeWXNzs.exe
  C:\Windows\System\GeWXNzs.exe
  2⤵
  PID:15216
- C:\Windows\System\gdTlVOW.exe
  C:\Windows\System\gdTlVOW.exe
  2⤵
  PID:15252
- C:\Windows\System\lTBBkDq.exe
  C:\Windows\System\lTBBkDq.exe
  2⤵
  PID:8104
- C:\Windows\System\knJdFvY.exe
  C:\Windows\System\knJdFvY.exe
  2⤵
  PID:15332
- C:\Windows\System\IEAgyZO.exe
  C:\Windows\System\IEAgyZO.exe
  2⤵
  PID:7452
- C:\Windows\System\XpfUbNN.exe
  C:\Windows\System\XpfUbNN.exe
  2⤵
  PID:14048
- C:\Windows\System\ovqpEhn.exe
  C:\Windows\System\ovqpEhn.exe
  2⤵
  PID:8068
- C:\Windows\System\aAMDkCK.exe
  C:\Windows\System\aAMDkCK.exe
  2⤵
  PID:7300
- C:\Windows\System\qwnnZZY.exe
  C:\Windows\System\qwnnZZY.exe
  2⤵
  PID:7516
- C:\Windows\System\azNcMOM.exe
  C:\Windows\System\azNcMOM.exe
  2⤵
  PID:14472
- C:\Windows\System\kIKNsNE.exe
  C:\Windows\System\kIKNsNE.exe
  2⤵
  PID:7064
- C:\Windows\System\sBARMYW.exe
  C:\Windows\System\sBARMYW.exe
  2⤵
  PID:6208
- C:\Windows\System\SLILIWD.exe
  C:\Windows\System\SLILIWD.exe
  2⤵
  PID:7368
- C:\Windows\System\EfPjIhS.exe
  C:\Windows\System\EfPjIhS.exe
  2⤵
  PID:14368
- C:\Windows\System\pzGXDKO.exe
  C:\Windows\System\pzGXDKO.exe
  2⤵
  PID:14772
- C:\Windows\System\ZkSUiZT.exe
  C:\Windows\System\ZkSUiZT.exe
  2⤵
  PID:14656
- C:\Windows\System\OrWwwqA.exe
  C:\Windows\System\OrWwwqA.exe
  2⤵
  PID:8076
- C:\Windows\System\fpZaZtg.exe
  C:\Windows\System\fpZaZtg.exe
  2⤵
  PID:13176
- C:\Windows\System\HlaIDrA.exe
  C:\Windows\System\HlaIDrA.exe
  2⤵
  PID:7916
- C:\Windows\System\TUrpXAb.exe
  C:\Windows\System\TUrpXAb.exe
  2⤵
  PID:7612
- C:\Windows\System\oWmwJje.exe
  C:\Windows\System\oWmwJje.exe
  2⤵
  PID:6960
- C:\Windows\System\xictnDh.exe
  C:\Windows\System\xictnDh.exe
  2⤵
  PID:15036
- C:\Windows\System\PsBpKgC.exe
  C:\Windows\System\PsBpKgC.exe
  2⤵
  PID:15060
- C:\Windows\System\hzOSqMh.exe
  C:\Windows\System\hzOSqMh.exe
  2⤵
  PID:14972
- C:\Windows\System\upLiWgP.exe
  C:\Windows\System\upLiWgP.exe
  2⤵
  PID:7404
- C:\Windows\System\eaQBkmq.exe
  C:\Windows\System\eaQBkmq.exe
  2⤵
  PID:15052
- C:\Windows\System\uvHfbvg.exe
  C:\Windows\System\uvHfbvg.exe
  2⤵
  PID:8156
- C:\Windows\System\jjplOJX.exe
  C:\Windows\System\jjplOJX.exe
  2⤵
  PID:7352
- C:\Windows\System\iUBOoFz.exe
  C:\Windows\System\iUBOoFz.exe
  2⤵
  PID:7144
- C:\Windows\System\xzrslzV.exe
  C:\Windows\System\xzrslzV.exe
  2⤵
  PID:7212
- C:\Windows\System\hiyzGan.exe
  C:\Windows\System\hiyzGan.exe
  2⤵
  PID:15176
- C:\Windows\System\SukqeIr.exe
  C:\Windows\System\SukqeIr.exe
  2⤵
  PID:14012
- C:\Windows\System\gJjUuGY.exe
  C:\Windows\System\gJjUuGY.exe
  2⤵
  PID:15208
- C:\Windows\System\iwftpKl.exe
  C:\Windows\System\iwftpKl.exe
  2⤵
  PID:8460
- C:\Windows\System\LcaDvth.exe
  C:\Windows\System\LcaDvth.exe
  2⤵
  PID:8784
- C:\Windows\System\YFhAMsv.exe
  C:\Windows\System\YFhAMsv.exe
  2⤵
  PID:8544
- C:\Windows\System\Qakclev.exe
  C:\Windows\System\Qakclev.exe
  2⤵
  PID:8944
- C:\Windows\System\iIHhVhA.exe
  C:\Windows\System\iIHhVhA.exe
  2⤵
  PID:14460
- C:\Windows\System\KPnKImh.exe
  C:\Windows\System\KPnKImh.exe
  2⤵
  PID:8484
- C:\Windows\System\yYzxggK.exe
  C:\Windows\System\yYzxggK.exe
  2⤵
  PID:8976
- C:\Windows\System\IuyHCwI.exe
  C:\Windows\System\IuyHCwI.exe
  2⤵
  PID:14404
- C:\Windows\System\qqNaHAg.exe
  C:\Windows\System\qqNaHAg.exe
  2⤵
  PID:6164
- C:\Windows\System\BaXCHJj.exe
  C:\Windows\System\BaXCHJj.exe
  2⤵
  PID:8084
- C:\Windows\System\zGAtuHg.exe
  C:\Windows\System\zGAtuHg.exe
  2⤵
  PID:7152
- C:\Windows\System\wGlpvLI.exe
  C:\Windows\System\wGlpvLI.exe
  2⤵
  PID:7340
- C:\Windows\System\quqdwMX.exe
  C:\Windows\System\quqdwMX.exe
  2⤵
  PID:8124
- C:\Windows\System\TLILrIR.exe
  C:\Windows\System\TLILrIR.exe
  2⤵
  PID:7644
- C:\Windows\System\BPnDnJo.exe
  C:\Windows\System\BPnDnJo.exe
  2⤵
  PID:7568
- C:\Windows\System\dqrKqwF.exe
  C:\Windows\System\dqrKqwF.exe
  2⤵
  PID:8216
- C:\Windows\System\VMVAKJR.exe
  C:\Windows\System\VMVAKJR.exe
  2⤵
  PID:6688
- C:\Windows\System\YSNsDKv.exe
  C:\Windows\System\YSNsDKv.exe
  2⤵
  PID:8648
- C:\Windows\System\OujfJii.exe
  C:\Windows\System\OujfJii.exe
  2⤵
  PID:8652
- C:\Windows\System\dLwaFLZ.exe
  C:\Windows\System\dLwaFLZ.exe
  2⤵
  PID:8096
- C:\Windows\System\ymjUoGR.exe
  C:\Windows\System\ymjUoGR.exe
  2⤵
  PID:7656
- C:\Windows\System\qfgCmYo.exe
  C:\Windows\System\qfgCmYo.exe
  2⤵
  PID:9100
- C:\Windows\System\dqHcUqx.exe
  C:\Windows\System\dqHcUqx.exe
  2⤵
  PID:8432
- C:\Windows\System\guDsyTn.exe
  C:\Windows\System\guDsyTn.exe
  2⤵
  PID:7196
- C:\Windows\System\IgDXpXf.exe
  C:\Windows\System\IgDXpXf.exe
  2⤵
  PID:14612
- C:\Windows\System\FPTzGWq.exe
  C:\Windows\System\FPTzGWq.exe
  2⤵
  PID:6304
- C:\Windows\System\zIhPRdD.exe
  C:\Windows\System\zIhPRdD.exe
  2⤵
  PID:9412
- C:\Windows\System\utcIMqh.exe
  C:\Windows\System\utcIMqh.exe
  2⤵
  PID:7852
- C:\Windows\System\NyrwOpw.exe
  C:\Windows\System\NyrwOpw.exe
  2⤵
  PID:14776
- C:\Windows\System\jcfoZcE.exe
  C:\Windows\System\jcfoZcE.exe
  2⤵
  PID:10176
- C:\Windows\System\sVleheA.exe
  C:\Windows\System\sVleheA.exe
  2⤵
  PID:9436
- C:\Windows\System\QQWVRAX.exe
  C:\Windows\System\QQWVRAX.exe
  2⤵
  PID:9916
- C:\Windows\System\pmTEiWm.exe
  C:\Windows\System\pmTEiWm.exe
  2⤵
  PID:7892
- C:\Windows\System\aokhtex.exe
  C:\Windows\System\aokhtex.exe
  2⤵
  PID:9408
- C:\Windows\System\IMyYEfh.exe
  C:\Windows\System\IMyYEfh.exe
  2⤵
  PID:844
- C:\Windows\System\RZJxcyK.exe
  C:\Windows\System\RZJxcyK.exe
  2⤵
  PID:10108
- C:\Windows\System\WrsSwSG.exe
  C:\Windows\System\WrsSwSG.exe
  2⤵
  PID:9208
- C:\Windows\System\wCbdDzy.exe
  C:\Windows\System\wCbdDzy.exe
  2⤵
  PID:14636
- C:\Windows\System\SUzOlPl.exe
  C:\Windows\System\SUzOlPl.exe
  2⤵
  PID:14388
- C:\Windows\System\DLcDLNw.exe
  C:\Windows\System\DLcDLNw.exe
  2⤵
  PID:8708
- C:\Windows\System\CgkLHGy.exe
  C:\Windows\System\CgkLHGy.exe
  2⤵
  PID:8968
- C:\Windows\System\UYwhxzG.exe
  C:\Windows\System\UYwhxzG.exe
  2⤵
  PID:7456
- C:\Windows\System\dfmMslU.exe
  C:\Windows\System\dfmMslU.exe
  2⤵
  PID:8332
- C:\Windows\System\sINvXlW.exe
  C:\Windows\System\sINvXlW.exe
  2⤵
  PID:14800
- C:\Windows\System\nbNhqpw.exe
  C:\Windows\System\nbNhqpw.exe
  2⤵
  PID:14364
- C:\Windows\System\WubNRgA.exe
  C:\Windows\System\WubNRgA.exe
  2⤵
  PID:8896
- C:\Windows\System\zbIDJdP.exe
  C:\Windows\System\zbIDJdP.exe
  2⤵
  PID:8240
- C:\Windows\System\jPnRYrE.exe
  C:\Windows\System\jPnRYrE.exe
  2⤵
  PID:8536
- C:\Windows\System\RjLDXMw.exe
  C:\Windows\System\RjLDXMw.exe
  2⤵
  PID:2028
- C:\Windows\System\NXDuNEp.exe
  C:\Windows\System\NXDuNEp.exe
  2⤵
  PID:9260
- C:\Windows\System\IUrfdIP.exe
  C:\Windows\System\IUrfdIP.exe
  2⤵
  PID:9564
- C:\Windows\System\ntxgzdB.exe
  C:\Windows\System\ntxgzdB.exe
  2⤵
  PID:6796
- C:\Windows\System\DyvKwZe.exe
  C:\Windows\System\DyvKwZe.exe
  2⤵
  PID:7312
- C:\Windows\System\XPyDYxV.exe
  C:\Windows\System\XPyDYxV.exe
  2⤵
  PID:6572
- C:\Windows\System\esTMmVo.exe
  C:\Windows\System\esTMmVo.exe
  2⤵
  PID:10164
- C:\Windows\System\UiHPDkZ.exe
  C:\Windows\System\UiHPDkZ.exe
  2⤵
  PID:9608
- C:\Windows\System\bhMxpVm.exe
  C:\Windows\System\bhMxpVm.exe
  2⤵
  PID:7988
- C:\Windows\System\uGeKybB.exe
  C:\Windows\System\uGeKybB.exe
  2⤵
  PID:6372
- C:\Windows\System\DFCZUZp.exe
  C:\Windows\System\DFCZUZp.exe
  2⤵
  PID:9352
- C:\Windows\System\FUvviYr.exe
  C:\Windows\System\FUvviYr.exe
  2⤵
  PID:8684
- C:\Windows\System\ykYtLiV.exe
  C:\Windows\System\ykYtLiV.exe
  2⤵
  PID:9960
- C:\Windows\System\STNgxee.exe
  C:\Windows\System\STNgxee.exe
  2⤵
  PID:9904
- C:\Windows\System\nddGFgo.exe
  C:\Windows\System\nddGFgo.exe
  2⤵
  PID:10412
- C:\Windows\System\OSZMShO.exe
  C:\Windows\System\OSZMShO.exe
  2⤵
  PID:10268
- C:\Windows\System\wAlGhVH.exe
  C:\Windows\System\wAlGhVH.exe
  2⤵
  PID:8172
- C:\Windows\System\KLNdDsz.exe
  C:\Windows\System\KLNdDsz.exe
  2⤵
  PID:10652
- C:\Windows\System\dNjNmml.exe
  C:\Windows\System\dNjNmml.exe
  2⤵
  PID:9424
- C:\Windows\System\yzmUfCL.exe
  C:\Windows\System\yzmUfCL.exe
  2⤵
  PID:10284
- C:\Windows\System\bICjrcn.exe
  C:\Windows\System\bICjrcn.exe
  2⤵
  PID:10608
- C:\Windows\System\QTOOuHW.exe
  C:\Windows\System\QTOOuHW.exe
  2⤵
  PID:8132
- C:\Windows\System\QvNXrpD.exe
  C:\Windows\System\QvNXrpD.exe
  2⤵
  PID:10696
- C:\Windows\System\hHBFetV.exe
  C:\Windows\System\hHBFetV.exe
  2⤵
  PID:14816
- C:\Windows\System\bQQYYlt.exe
  C:\Windows\System\bQQYYlt.exe
  2⤵
  PID:9688
- C:\Windows\System\wdrWQIX.exe
  C:\Windows\System\wdrWQIX.exe
  2⤵
  PID:9460
- C:\Windows\System\JbXnvGT.exe
  C:\Windows\System\JbXnvGT.exe
  2⤵
  PID:15376
- C:\Windows\System\eeMFbLq.exe
  C:\Windows\System\eeMFbLq.exe
  2⤵
  PID:15400
- C:\Windows\System\YDqfKvS.exe
  C:\Windows\System\YDqfKvS.exe
  2⤵
  PID:15420
- C:\Windows\System\TzBJmTx.exe
  C:\Windows\System\TzBJmTx.exe
  2⤵
  PID:15452
- C:\Windows\System\ytmaBUq.exe
  C:\Windows\System\ytmaBUq.exe
  2⤵
  PID:15512
- C:\Windows\System\KqFgkHk.exe
  C:\Windows\System\KqFgkHk.exe
  2⤵
  PID:15532
- C:\Windows\System\wpuNeJT.exe
  C:\Windows\System\wpuNeJT.exe
  2⤵
  PID:15552
- C:\Windows\System\OGebHRC.exe
  C:\Windows\System\OGebHRC.exe
  2⤵
  PID:15576
- C:\Windows\System\XQGeEYm.exe
  C:\Windows\System\XQGeEYm.exe
  2⤵
  PID:15604
- C:\Windows\System\TcKcJZL.exe
  C:\Windows\System\TcKcJZL.exe
  2⤵
  PID:15632
- C:\Windows\System\NslTrbI.exe
  C:\Windows\System\NslTrbI.exe
  2⤵
  PID:15672
- C:\Windows\System\QfOgDOh.exe
  C:\Windows\System\QfOgDOh.exe
  2⤵
  PID:15696
- C:\Windows\System\LbmgFGQ.exe
  C:\Windows\System\LbmgFGQ.exe
  2⤵
  PID:15732
- C:\Windows\System\PeUuewR.exe
  C:\Windows\System\PeUuewR.exe
  2⤵
  PID:15760
- C:\Windows\System\fgJPeCk.exe
  C:\Windows\System\fgJPeCk.exe
  2⤵
  PID:15892
- C:\Windows\System\WciJXnf.exe
  C:\Windows\System\WciJXnf.exe
  2⤵
  PID:15916
- C:\Windows\System\CIarJXP.exe
  C:\Windows\System\CIarJXP.exe
  2⤵
  PID:15932
- C:\Windows\System\qLIzvGW.exe
  C:\Windows\System\qLIzvGW.exe
  2⤵
  PID:15948
- C:\Windows\System\vYUJzdu.exe
  C:\Windows\System\vYUJzdu.exe
  2⤵
  PID:15964
- C:\Windows\System\CxQkKSX.exe
  C:\Windows\System\CxQkKSX.exe
  2⤵
  PID:15980
- C:\Windows\System\VIlAZtZ.exe
  C:\Windows\System\VIlAZtZ.exe
  2⤵
  PID:15996
- C:\Windows\System\jugGeaM.exe
  C:\Windows\System\jugGeaM.exe
  2⤵
  PID:16012
- C:\Windows\System\dRotoeQ.exe
  C:\Windows\System\dRotoeQ.exe
  2⤵
  PID:16028
- C:\Windows\System\AdJTBSs.exe
  C:\Windows\System\AdJTBSs.exe
  2⤵
  PID:16044
- C:\Windows\System\YtncmfD.exe
  C:\Windows\System\YtncmfD.exe
  2⤵
  PID:16076
- C:\Windows\System\QEbPpUX.exe
  C:\Windows\System\QEbPpUX.exe
  2⤵
  PID:16132
- C:\Windows\System\hKqplaq.exe
  C:\Windows\System\hKqplaq.exe
  2⤵
  PID:16148
- C:\Windows\System\iwrCDFi.exe
  C:\Windows\System\iwrCDFi.exe
  2⤵
  PID:16164
- C:\Windows\System\mjvAIlg.exe
  C:\Windows\System\mjvAIlg.exe
  2⤵
  PID:16180
- C:\Windows\System\zhrXGtG.exe
  C:\Windows\System\zhrXGtG.exe
  2⤵
  PID:16212
- C:\Windows\System\awkDErB.exe
  C:\Windows\System\awkDErB.exe
  2⤵
  PID:16236
- C:\Windows\System\jrXLdPQ.exe
  C:\Windows\System\jrXLdPQ.exe
  2⤵
  PID:16260
- C:\Windows\System\OXbwZrw.exe
  C:\Windows\System\OXbwZrw.exe
  2⤵
  PID:16280
- C:\Windows\System\HVNyEyY.exe
  C:\Windows\System\HVNyEyY.exe
  2⤵
  PID:16308
- C:\Windows\System\phmPGBM.exe
  C:\Windows\System\phmPGBM.exe
  2⤵
  PID:11040
- C:\Windows\System\ycKWWTz.exe
  C:\Windows\System\ycKWWTz.exe
  2⤵
  PID:11108
- C:\Windows\System\CwIkUUA.exe
  C:\Windows\System\CwIkUUA.exe
  2⤵
  PID:9856
- C:\Windows\System\qugaEEu.exe
  C:\Windows\System\qugaEEu.exe
  2⤵
  PID:9272
- C:\Windows\System\IiaszCz.exe
  C:\Windows\System\IiaszCz.exe
  2⤵
  PID:10508
- C:\Windows\System\PAXlduT.exe
  C:\Windows\System\PAXlduT.exe
  2⤵
  PID:9444
- C:\Windows\System\HemJkOW.exe
  C:\Windows\System\HemJkOW.exe
  2⤵
  PID:10248
- C:\Windows\System\aNEkwTO.exe
  C:\Windows\System\aNEkwTO.exe
  2⤵
  PID:15540
- C:\Windows\System\WjoAXkz.exe
  C:\Windows\System\WjoAXkz.exe
  2⤵
  PID:15592
- C:\Windows\System\WEIycnG.exe
  C:\Windows\System\WEIycnG.exe
  2⤵
  PID:15136
- C:\Windows\System\Rgmlfux.exe
  C:\Windows\System\Rgmlfux.exe
  2⤵
  PID:15148
- C:\Windows\System\cDZwKtA.exe
  C:\Windows\System\cDZwKtA.exe
  2⤵
  PID:15692
- C:\Windows\System\MoLrPyb.exe
  C:\Windows\System\MoLrPyb.exe
  2⤵
  PID:9220
- C:\Windows\System\NkPwUpT.exe
  C:\Windows\System\NkPwUpT.exe
  2⤵
  PID:15724
- C:\Windows\System\ViRcNtQ.exe
  C:\Windows\System\ViRcNtQ.exe
  2⤵
  PID:11592
- C:\Windows\System\aKpyZml.exe
  C:\Windows\System\aKpyZml.exe
  2⤵
  PID:8664
- C:\Windows\System\FOpDuXw.exe
  C:\Windows\System\FOpDuXw.exe
  2⤵
  PID:9416
- C:\Windows\System\wcxmdsv.exe
  C:\Windows\System\wcxmdsv.exe
  2⤵
  PID:13172
- C:\Windows\System\GPyudBM.exe
  C:\Windows\System\GPyudBM.exe
  2⤵
  PID:9240
- C:\Windows\System\zAxJJKL.exe
  C:\Windows\System\zAxJJKL.exe
  2⤵
  PID:10324
- C:\Windows\System\lbSnkdb.exe
  C:\Windows\System\lbSnkdb.exe
  2⤵
  PID:11700
- C:\Windows\System\kPmguWD.exe
  C:\Windows\System\kPmguWD.exe
  2⤵
  PID:10380
- C:\Windows\System\tdzLCeH.exe
  C:\Windows\System\tdzLCeH.exe
  2⤵
  PID:15868
- C:\Windows\System\FzijSOY.exe
  C:\Windows\System\FzijSOY.exe
  2⤵
  PID:11604
- C:\Windows\System\CczRsPF.exe
  C:\Windows\System\CczRsPF.exe
  2⤵
  PID:16068
- C:\Windows\System\oqqvtEC.exe
  C:\Windows\System\oqqvtEC.exe
  2⤵
  PID:15588
- C:\Windows\System\mOCAWja.exe
  C:\Windows\System\mOCAWja.exe
  2⤵
  PID:15628
- C:\Windows\System\LwsgzRv.exe
  C:\Windows\System\LwsgzRv.exe
  2⤵
  PID:15648
- C:\Windows\System\qhbJYGl.exe
  C:\Windows\System\qhbJYGl.exe
  2⤵
  PID:11428
- C:\Windows\System\SdMtTNd.exe
  C:\Windows\System\SdMtTNd.exe
  2⤵
  PID:16288
- C:\Windows\System\yiLQawK.exe
  C:\Windows\System\yiLQawK.exe
  2⤵
  PID:8268
- C:\Windows\System\IPjaakh.exe
  C:\Windows\System\IPjaakh.exe
  2⤵
  PID:15752
- C:\Windows\System\LEypIft.exe
  C:\Windows\System\LEypIft.exe
  2⤵
  PID:10620
- C:\Windows\System\XiidTzN.exe
  C:\Windows\System\XiidTzN.exe
  2⤵
  PID:15836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_emfgolu3.omm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AikoOnN.exe

Filesize
1.8MB

MD5
c856c2affe095a89751afe30cce37a0c

SHA1
02966ebec82573f2dda8bb38180bfc33f9cc564c

SHA256
c6332773599c4590020c09001aad34b6dd707cbf654d28efe9a488962754c622

SHA512
88266a95933dc0d133e991eb8fa025c335f5a2893eb04650d0e1263c661376b7b8b24fde87ad0b40605876b3780faa2ffe285c65bb65315e462a4863df7b367f

Download Submit
C:\Windows\System\BPVrjRO.exe

Filesize
1.8MB

MD5
b08486af8a54283195f56685bbf5a059

SHA1
cdf5b29054a5ac47cd62af7cd0e8dad133bc7f2b

SHA256
65bbfeab86eac19151f5520ccbbc56e6a792bbd7b8ac02528a6b832d34b1f224

SHA512
386ad055fb9106c4eafb3456f3af3d9fc113b5d75f9c7f905b9e2c48be89536ba08aec3cc5c637488bf8252096a0221afa18832d91573620e227e1574aac2556

Download Submit
C:\Windows\System\BaHmFOE.exe

Filesize
1.8MB

MD5
2b8144b986445a19952a8f56a0c4586d

SHA1
4a64a9a5f699088af18578ddb7d192ad7f69fe0f

SHA256
630ec13c752a1fb82602d19d698666783d9a95ce321e537fcfa552e8e521102d

SHA512
cd817010267ded712773ab7afa4fa872d5ea6d0a66eeefd985f40a7581633b522fa243746382bd08b4e01f0f95736fa37a48400aa365d308e69f0161780b48a1

Download Submit
C:\Windows\System\BixhhjG.exe

Filesize
1.8MB

MD5
94c6543eac70e1a92743106ab2ed36d3

SHA1
b9db5aa5330d93d469cf3c60484b8c944cac97bc

SHA256
5d75004c6cb9c58bbfed644f9b90fdde2d25288fb5b20bc4c1cf932aa1e202e6

SHA512
769bb0d4d041bb0d4d788b28d9b1a4f6d2c4031328ef65cf4d3e50d513db1fef38501efaf5a455891df53307074cad129fb281d843599f6413054cccfb653661

Download Submit
C:\Windows\System\CWOKQPV.exe

Filesize
1.8MB

MD5
d82292aa9d92c5a70529303c06cfbe7e

SHA1
7427b0db39354399efb4aa24e1ddeab88779998d

SHA256
754eb0686db1c55b8b8558efc36f6407970f5f099881208a77098d8849b976f0

SHA512
2fc8ef8af86b98633739c61f1aad7542a4236f323545a29f8fa9f4802fc6084e9a94cc3fc45d2b284014c112f562e7f1db4d121e5872208ef35cf59c4a7be7c9

Download Submit
C:\Windows\System\CbMVBad.exe

Filesize
1.8MB

MD5
d77bef28b95562a8dc216012fe5289fe

SHA1
b3063afaa5ef21f3bcf603fd21998df668055b9a

SHA256
ca281644f744a7a210177e6d6de7df29dd025e3f8c09ddc95fb768c01f1c7874

SHA512
8a516b0db7cfb6cb61e72b8a4498074d30eb883efc44e2eaad7d6148b939557a1392811b357982ce755346763d0eb17a5ff022158913d0a559e7ba6e3eae26c2

Download Submit
C:\Windows\System\CbspAFy.exe

Filesize
1.8MB

MD5
e283bb0a4feec2799601aab49b655ff5

SHA1
29b3a7f735c72c3d3b0c8077c77609f7d7edaf2e

SHA256
ad433004ad7eece76153ee969119730e24f702cd0341f069f7427322c0aab7d7

SHA512
289ed5806dd5883ae239b7f9df43063b2ab9a637ef53036f702b2c0a77418d2b0834819cfa9b12ea2c73b2b09537b8ed6fc741517e51987f5d6d059018af1858

Download Submit
C:\Windows\System\Fivtsiw.exe

Filesize
1.8MB

MD5
6dac8f89bb1b49c492155fb190687600

SHA1
0222f5d62805b99b626ed04a76ca8e3ad199e5e7

SHA256
896e22934b950887476f01cbee80aab5d39485d7abbfa6300f3fdda50899df9f

SHA512
9befaa09f3f521fece19de0473d2e08aa46f58cf42b1148d8c03280d5bbae22a8d8bfbe7dbd451a3162dbde49e3bd1bb3e18fd430096ee58f032ce1acf8a7a1f

Download Submit
C:\Windows\System\GscNxej.exe

Filesize
1.8MB

MD5
22a4d1b9163ad5d84c49134e965ca857

SHA1
ec1add4b0c720d4072128f53a6a82d0869184ec2

SHA256
2585edfce6608744e4a80667452a9eeb6d2e747eb476ad6b5f80fdad171c77c8

SHA512
71d8955eaea33cf58d695d2ef8343bc8d66893498913d999abbae628baa0d4814193f5de684902faa1f703c048f3430575a8ff2d0e564acd09adb98175ba4697

Download Submit
C:\Windows\System\IwURCxP.exe

Filesize
1.8MB

MD5
070a6114bc222451fe62a1312a1c0182

SHA1
21d103f31c0abefa519c25343729051343d00e64

SHA256
923cb08b6bd6a24469cdc5c1b595778eec4abe34b7e3983d73479361470c1c3e

SHA512
e0a59b994cbcb883b274e7a4f39d5c4246af4b6fd2c0c66f258b43161f8a8782833abc6156a3f9aaa8466111aebb34a348dffdb1258ec22f21e6d5971fe1bd12

Download Submit
C:\Windows\System\KZlhlsi.exe

Filesize
1.8MB

MD5
a6f78866d966ca80ec527f231108a3bc

SHA1
9d43efef9f23b2042da434344f7a1a2080350409

SHA256
f438f0747d5d45830f94793bd2686636dd93f460702d8fe634ff58bd3ed574a2

SHA512
2b375e8fa6ca65b498723237b89c967e810fcb0a9ad65bd0014af514566dd587eb3b4e3c6200b1ef1b2fd8086fcca7ccaa0f4e11951d423fccb16caaef31eb56

Download Submit
C:\Windows\System\KqKgBDL.exe

Filesize
1.8MB

MD5
54453301964db9a78cf93936b1279197

SHA1
cc9b23da5002dc21a9a70422a037a9ec15d15df6

SHA256
67fa203dddc1b274492925f4310ca9e5ddd012e55e62ff4143c1551365644ee7

SHA512
8e72f1f995d7a2f8088081baf510d3f5231988cb9b14efcf0820876e3df608a4333b660784128aafcce272f9cf32794149309567b6a1c4c2c93434d7f30d2094

Download Submit
C:\Windows\System\NOfPSSw.exe

Filesize
8B

MD5
bbb5190eff45a62c43cde634094759c0

SHA1
45cda8be7c649ba00340a832715a0757e8ce9b9b

SHA256
4b7c7c791bd2893e065fd5e4934dccf3152aeac2fce4808132b05acefb80891a

SHA512
213d190bfff285fb6040740f8a61d201e24cba89077f90495986109a6840ce2f9df148c3ae6f113d24bbce88876d227a01aea3f25c0103630fa1669df46f16db

Download Submit
C:\Windows\System\PSplTGJ.exe

Filesize
1.8MB

MD5
85b42d870ce9579b2fd33ccf12da6f21

SHA1
ce0348d9aa0a33f166c2901d0592722cc6f9eda7

SHA256
c1adb6953ded97ffb5195d4366b34f26e885d3296ffc428ae39d7cc90abc25a8

SHA512
c024f6be03ad72395c1d9ebf311aed558b26f2127230b8f9d20b638b050af95349d727dfec3b999e559a18bb15f40b01f17d4b871a5a4865c7a30c075026f25c

Download Submit
C:\Windows\System\RcSdcGd.exe

Filesize
1.8MB

MD5
efdfd405853e4f60765b0db94d17a744

SHA1
8a9c24b890121e19368a2ccc561781f8831c6b94

SHA256
f869e88daadbe207cccf5818fddce7998f240583f77486156d1c672b396be09d

SHA512
f5ce70ee7ca4ea75b7cf6d5ad3498fd2e0f1310eaca96bd0075bedc77b7e0cfa2b0c4ee6c0791e94b213bdd8cfc1986a3742ba6da1ca7198b248b21337317ff2

Download Submit
C:\Windows\System\SLLcelu.exe

Filesize
1.8MB

MD5
bb5b4433f0095b4f29c32459155b4d16

SHA1
5b5097e50718df69f2f2db19fe8f65488b313088

SHA256
a8f6faf39b80b4b35f48db4f047c516ad4d37b0d055da3b81ee9e14c1a02815e

SHA512
97b19e26db07ac327ae99ecf9a08a084ec1f8b2a307f1fec5e8edfe3ee2239f16c2dc3a01ec0e1289a49064020c37891f0a1e5e2b7b8765cae102cf5377f060a

Download Submit
C:\Windows\System\UFAiRcJ.exe

Filesize
1.8MB

MD5
e398b3fdb62e7128ec1a2be408bda273

SHA1
41872e91abb01c132e1031fae1d0a70d57d0f942

SHA256
c489acda4a377728b5dc0200dc8c3ebee29b4f6c6e5f1980841e87a561b1f69c

SHA512
46abb9f7bde427f7984134a4ea3812b137862edc2f12fe2a441c9845482dd05754ddabdc7364bff98b1dcc551b33c64822775b63a04692d7d53640ee4a7bb5e2

Download Submit
C:\Windows\System\UuWwGzN.exe

Filesize
1.8MB

MD5
3b21a71ab9efd7a1b272f1361bfc0dd5

SHA1
3223c1a26904137d61215c2b0028339004de186a

SHA256
e2334ed836b5c5d979ade7a3f7f786055a55de9c8649d9d1eeaddb0a467d4c85

SHA512
7ff02b381c3a5865fa53862e267e704486826c9fa1fcce4363d7a9319da680aea8ddb40a2a25ee6308e9c30fdb7113b2b7ffc1dfc45bb3dd52516cd92648b37b

Download Submit
C:\Windows\System\WrYrhpq.exe

Filesize
1.8MB

MD5
88d595717e9ba9aba57db5fa89a4eecd

SHA1
49d3b21da0881ba83f7da8f2dda2315bbf98fcc4

SHA256
11e75b68675146299548543d1ba2e35a06ec84d26ccfdb94b8bafa13d36acb2f

SHA512
36b6bf51a75554ab0e7c5178d43bb62130d6bd8e0dbc83f1fa0b183d6e68989372ef939c8b33d36a07366eb1f300beee9260fdeb51ab73843519d8f4bf7d4246

Download Submit
C:\Windows\System\YTvCPjT.exe

Filesize
1.8MB

MD5
94507c966cdb98d207c33cf16452bbdc

SHA1
d9a6fdbe93dbab1000f1bac14dcf5120041f57fd

SHA256
785e4233ee19df42aa8ad1667bcf97c508c3e0cb87ff145f20a99fab94ca0208

SHA512
8855bacd0f41c9c51e5617d6739b5abda9ca98e2fb29a6fb7b9968cb0ac9c7081f2d59982e3c041cbf4f459c5f4afbcb433e53379cd2e1d959a40db2d1127c65

Download Submit
C:\Windows\System\YdsdZfK.exe

Filesize
1.8MB

MD5
23c6073ed99f32f568468552731165d9

SHA1
621d496a47093dc4cbca5f21af260f695cb8f21a

SHA256
4a4e67b4584cfca5b976916372423ff0dc683544a73c74e751cf74a9fb5b18c9

SHA512
031ffc96605ad1287ab6315bcff727d4e1d2069d4cf506fbd55cede29867e2f653923e8c5874a8eb7eefcee923497181edf506e84ea5b1eb886fe0f9d31566a2

Download Submit
C:\Windows\System\ZQXByNk.exe

Filesize
1.8MB

MD5
61306eae0d157b73305c1d00822fedb9

SHA1
0275a58d1f7be22cb0f2bef64f767a52921bad35

SHA256
41d1578c4aab6d3612ace87a04d5d70a60a1e9d8894ab7684e3313676bf0c461

SHA512
e41ac9f62fa8243ccc932680473c3d265405fb644e2b702ca87c76795ddb544e89519ff12a00dc52b082254f79e4fcb15182d371011b29d77b7c13c4d92ff7ab

Download Submit
C:\Windows\System\jhDqNPd.exe

Filesize
1.8MB

MD5
1efc802655373258b367f8c871cd16ea

SHA1
ffd1c5ae89ff51fbb6a32e1880badd3df2caacc0

SHA256
914868b78c92cecba2644197ac5af5104f80994378bb176f9d7732e69a5ab50f

SHA512
8b41440204019cf16d26f32b0aebb3da95352450ecb27d2f950ef5f65350aa9bbf01856249f30235146e79668aae0ced91af4b2b5fb944546c9db83002bdf989

Download Submit
C:\Windows\System\jkHTZPx.exe

Filesize
1.8MB

MD5
0dd9d34e720d75599bae9910c8ea5a01

SHA1
cd53552e7ae8af240ba53d3ced13388541092a3e

SHA256
1d90fb8538ab1bda4571f4f9dd676a077ff413e97cd3bd8b0b204fa4b0c4cd6a

SHA512
eeb36710780cdb3af58e0cb21de1c3ee175c454b8c7dad56d4d0954d7896eb9289299e47cc16a8b9fdb31d70c4108c1a678683855cd575cfcee4b744a53fc87d

Download Submit
C:\Windows\System\nQivbrV.exe

Filesize
1.8MB

MD5
bc53977c586c2c678d81f75f4b0b4078

SHA1
a8c944f69db52d9f64cbf36e76a9d3c466c00f8b

SHA256
b9fd239154444eca00d9a107e84135e8b2790d5e1f93c5762d4775297aceeee0

SHA512
81daafdb49d35af994cd193e66b3816464cbe429b9d24a8be99ae8b208efdce210a40fc40404b0f84883804fa432a117bd6a029746bf56154219aef6863d0963

Download Submit
C:\Windows\System\ntlgAGK.exe

Filesize
1.8MB

MD5
4a8cfb6825482ead41ca508981b49ae6

SHA1
b4805f7b7e25d171afe40e62232791857f6ab17a

SHA256
f471f3213321ef13f0fbd30cb764b106150f40757a08bd5179965343753aa040

SHA512
b131f36e05de62a2cf27391c3bb8a842026392c6493905e1d9371bf1c818b5c16dcbcd306354542bf033b1d31a627c8489bc9a96b05f4cfc0c9e666701be786d

Download Submit
C:\Windows\System\oJZBOpo.exe

Filesize
1.8MB

MD5
9f8761609be2cdeb56dec42f9796c871

SHA1
624b940902a369d462dcdfe1885e3eef4716c822

SHA256
306a14e92a5163ee084c92c8f855bced9271f422dac2197c3effc880c88c0b07

SHA512
06f82e4b3faf605a257850d3b372b58ea8e06dcb53e5d3ca2e5b5d30e5f61af67d2cf4371522b36efeb9490a162dcda7aaabc04d43f7bea29aba1cc903a27384

Download Submit
C:\Windows\System\pSbiLAt.exe

Filesize
1.8MB

MD5
5ba0c9cbb10c91d5b18d97e766475ba9

SHA1
dd143c3850ced23f63f1ce2e9aaa2f995915fa40

SHA256
fdc4326c7aebf1da10484c0a95af31e498fc030f3b304ae9aa5bcaf7b05fb519

SHA512
77c7f1509911a47bf85ade585986fc21f821d372527f1a36a4134c927953e437a9310875394ee57d36b7bee6d2ef5af42837de0ad7d2a81be0c118280520d7f2

Download Submit
C:\Windows\System\qeDceEJ.exe

Filesize
1.8MB

MD5
edf9244af16749fc1cc1eea860ad5f79

SHA1
32a27224a3d7ddceaa2faa3eabd34e9bd5f9c8bc

SHA256
d5e9843b34c799c96ed7bc9deb2a218fd5045c773cb5568b77b42a5ab6c7bec5

SHA512
48b4b175207fd3df2337575155e604df90f265a7990e5b899d222b655dbc06962a06ae1c63322098bbbfae010cdb6c8188e4a545d8b53cab285d84dc247bcff9

Download Submit
C:\Windows\System\rXoHyxE.exe

Filesize
1.8MB

MD5
a40b23ec5568d408289ac1a4bfa34613

SHA1
a2e9de31747c38a3bfacd1a85f610b13f00a496a

SHA256
5d06a5c574844651f10ad43287270e05c8cff0ae8ac7005a9a5945e92398268c

SHA512
68809b882de898f6e2e44aa07e70cc6a07f672690ee107ce2c18329af6353ac4c3e5c4d4aacce79bd18a596607a77077eaa89edaac17eae720566d07cc38804c

Download Submit
C:\Windows\System\toZimYZ.exe

Filesize
1.8MB

MD5
0318343a6a7d8d758ebb951c23d96b46

SHA1
f069d94f28358d2dca5f8679b38a9f6ea104478b

SHA256
2d34e5481ae5ece131a246bbd2732c82fe8d347a2f6d0e81fe90c89229af07dc

SHA512
57556789c58e0adcb28e72dac486b29821983ccb75029fe15c706ed45c4f0c3e5e4eb4be48a2bd4bb70ec39ee721314b70598ed2e3ba35e037fb186e2357d6ed

Download Submit
C:\Windows\System\tyrENmi.exe

Filesize
1.8MB

MD5
827e90fc1d856d9ddaa531056262384c

SHA1
8c61658fcdcd7ff0ece5e117d124f37aa0d9ec09

SHA256
ebf60da66a97c9d996b3dc68ffc2af17c54ddf2d352b1f0780f3d24c0708f7c4

SHA512
e707f08c33c6dd037f1ded1bdfc211135de25b9b9edb91b59a404c0a886d69de5bdcec46a95497769f95d0e725e0193f3c2780835ea985a4f2d29a06334f39d9

Download Submit
C:\Windows\System\uCmJKRj.exe

Filesize
1.8MB

MD5
eec3ed0de2a155eccca4768621ed7ca6

SHA1
8fd650d5161d75cd48cc045804a8f642a48ac700

SHA256
a4260e61741f5920584adc6d8af154874452e8170dc47ac90e312a92bf928de0

SHA512
6d617dd718c08a9c12f89544b3ebf0d19db86a46a8024aad1f45e041a516a56faeba9f487f81b262bed4cef7f1658153cf74c9ab023ac275bbdffb00ee5fc160

Download Submit
C:\Windows\System\uksJMgg.exe

Filesize
1.8MB

MD5
50d685aa2963acf49edf2862a3a609c0

SHA1
0d65f6804a82d3933c23ba521b7c206817f53716

SHA256
8f3e564de589c4b2638c3c6eeb12da3385c88af093ae8f5e77fa9d405f488047

SHA512
301be3cc20abfc05dc2d79b8f155f833e7695c55dadca39777f09927863f3da8808a6664304aacc27910305ad0a0dc2eeae2b3696de91ffb30010ae42fccaad4

Download Submit
C:\Windows\System\utHVHnE.exe

Filesize
1.8MB

MD5
2fe9d7a05b5e52e07fee7b9192d43391

SHA1
8f82329158808396640c45fb94d8b950676c0558

SHA256
f71a4d4483086a3df36e8317f17bc894f6ebad861debfc994fd6fc88813cbf8e

SHA512
0bf460dad64da6b44efbbdcb000bd090002136918a26fdbebc571872811adce58aa9aff41183a6442356145a1db632eadd10e9085912aa12a28a80948fe12dc6

Download Submit
C:\Windows\System\vCjzuFO.exe

Filesize
1.8MB

MD5
413aa895155e3f8634c2f7383a7a929c

SHA1
fd6306c28f144e3a4b59a9c0ef5397c5bd253301

SHA256
4125ee59faeb164d9580d3e78854bc056e62c0d3de65d4239c84913ccee03443

SHA512
597b39a57c4d6a5a300ea303d0dbccfb34f1bb9558ed8ea69faebcf0764b6b45056604c07e5232cb1c1c9e23b5b6ab613e9369538b6fc137ad4d23e0ac9a0f97

Download Submit
C:\Windows\System\xAeGhxv.exe

Filesize
1.8MB

MD5
244e8e3804e505125334fa86b0270130

SHA1
b6ed11e51af207b10e02d174f2b4b88e854d0649

SHA256
316281a1d8effa70e33014523ff39b0ecd063bf9d0889234229ee81f84b5f9e4

SHA512
5b9b5125943ddc00825046dcb4adb71906a5f33e9f7e26c987a1e4590c85e979af3ccfba5d97c507805caa1d6b0827af78d6b5d1420d04dd2c05f9af932f0bb3

Download Submit
C:\Windows\System\yKCnYXU.exe

Filesize
1.8MB

MD5
5685a82074a0ebea4f997bea02729213

SHA1
a334b4dc03a8fe5550f177a3a50c7c56f4b10200

SHA256
fadb6bbaebb119f1c45fec8a6ea97f01577c773c8d683f4b4269a8fbb87201c0

SHA512
99452ff1226bd49325a2d5993bc1544e89e7946ed9bf25b3c24b11323470494b66f06e2a76305f7be933dbe0a2fd7797adfd4006e40f47c01168f5ed2841a72d

Download Submit
C:\Windows\System\ySIJggO.exe

Filesize
1.8MB

MD5
b600acb1f1ef192143891248cfec6847

SHA1
c8f0841e49935da631cf3c5e2b55b5dbbda6e776

SHA256
9ad447eb08a71f8ce3c2d72dedf5a0f2b37181342dda852bd5ce0f2ec91632f0

SHA512
6fcd5cbd7d6dfcc6748134e0f26e9aa6ae84ea423972a8796ed5e18f252444c404a12b640dcbaa7caf099ae3a2e1268d59dec159cd815de3d17f7f6d0663a6d0

Download Submit
C:\Windows\System\zVtdQeg.exe

Filesize
1.8MB

MD5
c03217502f87d1df61f74ea9665d62ad

SHA1
ce0bb0578d2fd98b6debf5de2fb25336e14404ca

SHA256
b9fd30148c7a2a1eb8ed045774b0324a280afc619a79e14056b7b5adf9019b46

SHA512
e87508f6e8066ec5a2b3ed009c33bf7de202f30d9878ba20e9cca18a9009f0df4dae4f08b62baf5f0dddbd25e5c391ba61588d621a9218d67771946dccb83950

Download Submit
memory/208-2509-0x00007FF684510000-0x00007FF684902000-memory.dmp

Filesize
3.9MB

Download
memory/208-282-0x00007FF684510000-0x00007FF684902000-memory.dmp

Filesize
3.9MB

Download
memory/212-286-0x00007FF6F7E10000-0x00007FF6F8202000-memory.dmp

Filesize
3.9MB

Download
memory/372-275-0x00007FF70CD50000-0x00007FF70D142000-memory.dmp

Filesize
3.9MB

Download
memory/372-2320-0x00007FF70CD50000-0x00007FF70D142000-memory.dmp

Filesize
3.9MB

Download
memory/448-2479-0x00007FF7CD7F0000-0x00007FF7CDBE2000-memory.dmp

Filesize
3.9MB

Download
memory/448-279-0x00007FF7CD7F0000-0x00007FF7CDBE2000-memory.dmp

Filesize
3.9MB

Download
memory/468-2371-0x00007FF7862D0000-0x00007FF7866C2000-memory.dmp

Filesize
3.9MB

Download
memory/468-277-0x00007FF7862D0000-0x00007FF7866C2000-memory.dmp

Filesize
3.9MB

Download
memory/776-1-0x000001A742940000-0x000001A742950000-memory.dmp

Filesize
64KB

Download
memory/776-0-0x00007FF6FDC70000-0x00007FF6FE062000-memory.dmp

Filesize
3.9MB

Download
memory/1228-2567-0x00007FF787F30000-0x00007FF788322000-memory.dmp

Filesize
3.9MB

Download
memory/1228-290-0x00007FF787F30000-0x00007FF788322000-memory.dmp

Filesize
3.9MB

Download
memory/1316-288-0x00007FF74A9E0000-0x00007FF74ADD2000-memory.dmp

Filesize
3.9MB

Download
memory/1532-284-0x00007FF6EE570000-0x00007FF6EE962000-memory.dmp

Filesize
3.9MB

Download
memory/1532-2596-0x00007FF6EE570000-0x00007FF6EE962000-memory.dmp

Filesize
3.9MB

Download
memory/1568-178-0x00007FF6BD510000-0x00007FF6BD902000-memory.dmp

Filesize
3.9MB

Download
memory/1568-2349-0x00007FF6BD510000-0x00007FF6BD902000-memory.dmp

Filesize
3.9MB

Download
memory/1572-292-0x00007FF74E710000-0x00007FF74EB02000-memory.dmp

Filesize
3.9MB

Download
memory/1572-2341-0x00007FF74E710000-0x00007FF74EB02000-memory.dmp

Filesize
3.9MB

Download
memory/1804-27-0x00007FF664F90000-0x00007FF665382000-memory.dmp

Filesize
3.9MB

Download
memory/1804-2313-0x00007FF664F90000-0x00007FF665382000-memory.dmp

Filesize
3.9MB

Download
memory/2300-273-0x00007FF63D860000-0x00007FF63DC52000-memory.dmp

Filesize
3.9MB

Download
memory/2300-2424-0x00007FF63D860000-0x00007FF63DC52000-memory.dmp

Filesize
3.9MB

Download
memory/3040-276-0x00007FF6154D0000-0x00007FF6158C2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-2322-0x00007FF73BD50000-0x00007FF73C142000-memory.dmp

Filesize
3.9MB

Download
memory/3468-272-0x00007FF73BD50000-0x00007FF73C142000-memory.dmp

Filesize
3.9MB

Download
memory/3532-278-0x00007FF6C45B0000-0x00007FF6C49A2000-memory.dmp

Filesize
3.9MB

Download
memory/3532-2426-0x00007FF6C45B0000-0x00007FF6C49A2000-memory.dmp

Filesize
3.9MB

Download
memory/3892-5-0x00007FFF5D333000-0x00007FFF5D335000-memory.dmp

Filesize
8KB

Download
memory/3892-6381-0x00007FFF5D333000-0x00007FFF5D335000-memory.dmp

Filesize
8KB

Download
memory/3892-137-0x00007FFF5D330000-0x00007FFF5DDF1000-memory.dmp

Filesize
10.8MB

Download
memory/3892-239-0x000001506AC50000-0x000001506AC72000-memory.dmp

Filesize
136KB

Download
memory/3892-291-0x00007FFF5D330000-0x00007FFF5DDF1000-memory.dmp

Filesize
10.8MB

Download
memory/3892-293-0x000001506B780000-0x000001506BF26000-memory.dmp

Filesize
7.6MB

Download
memory/3968-2574-0x00007FF6536B0000-0x00007FF653AA2000-memory.dmp

Filesize
3.9MB

Download
memory/3968-287-0x00007FF6536B0000-0x00007FF653AA2000-memory.dmp

Filesize
3.9MB

Download
memory/4280-285-0x00007FF6EFD80000-0x00007FF6F0172000-memory.dmp

Filesize
3.9MB

Download
memory/4280-2415-0x00007FF6EFD80000-0x00007FF6F0172000-memory.dmp

Filesize
3.9MB

Download
memory/4336-289-0x00007FF618150000-0x00007FF618542000-memory.dmp

Filesize
3.9MB

Download
memory/4336-2434-0x00007FF618150000-0x00007FF618542000-memory.dmp

Filesize
3.9MB

Download
memory/4416-281-0x00007FF74A7C0000-0x00007FF74ABB2000-memory.dmp

Filesize
3.9MB

Download
memory/4640-2342-0x00007FF7BFC00000-0x00007FF7BFFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4640-251-0x00007FF7BFC00000-0x00007FF7BFFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-271-0x00007FF793940000-0x00007FF793D32000-memory.dmp

Filesize
3.9MB

Download
memory/4884-2585-0x00007FF7BBE20000-0x00007FF7BC212000-memory.dmp

Filesize
3.9MB

Download
memory/4884-280-0x00007FF7BBE20000-0x00007FF7BC212000-memory.dmp

Filesize
3.9MB

Download
memory/4920-283-0x00007FF63F2B0000-0x00007FF63F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/4944-274-0x00007FF64DE00000-0x00007FF64E1F2000-memory.dmp

Filesize
3.9MB

Download
memory/4944-2365-0x00007FF64DE00000-0x00007FF64E1F2000-memory.dmp

Filesize
3.9MB

Download