xmrig | 70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251

Analysis

max time kernel
36s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
Size

3.2MB
MD5

51d4924521c91ed1e8944d4fea958dbb
SHA1

953d6621494029aa7347565355cd6b1bbacde15e
SHA256

70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251
SHA512

d21b1dfaf7154b42d4dcc1c3b25efa4ad83971afce0b3602c1254e3cc3406bebb7aab93525a7ebfd2d268d646e1fc838654a11430d79085bb00cc9d9c2e822a8
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWo:7bBeSFkE

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4952-0-0x00007FF7700F0000-0x00007FF7704E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023452-6.dat	xmrig
behavioral2/files/0x0007000000023453-11.dat	xmrig
behavioral2/files/0x0007000000023454-13.dat	xmrig
behavioral2/files/0x0008000000023456-33.dat	xmrig
behavioral2/files/0x000800000002344e-35.dat	xmrig
behavioral2/files/0x0007000000023457-41.dat	xmrig
behavioral2/files/0x0007000000023458-47.dat	xmrig
behavioral2/files/0x0008000000023455-52.dat	xmrig
behavioral2/memory/4356-61-0x00007FF6B5100000-0x00007FF6B54F6000-memory.dmp	xmrig
behavioral2/files/0x000700000002345a-65.dat	xmrig
behavioral2/memory/1436-70-0x00007FF736890000-0x00007FF736C86000-memory.dmp	xmrig
behavioral2/files/0x000700000002345b-71.dat	xmrig
behavioral2/memory/3892-74-0x00007FF715F20000-0x00007FF716316000-memory.dmp	xmrig
behavioral2/memory/4144-75-0x00007FF74EBE0000-0x00007FF74EFD6000-memory.dmp	xmrig
behavioral2/memory/3540-64-0x00007FF6DC770000-0x00007FF6DCB66000-memory.dmp	xmrig
behavioral2/files/0x0007000000023459-58.dat	xmrig
behavioral2/files/0x0007000000023461-103.dat	xmrig
behavioral2/files/0x0007000000023464-118.dat	xmrig
behavioral2/memory/5112-608-0x00007FF6B0020000-0x00007FF6B0416000-memory.dmp	xmrig
behavioral2/memory/1028-611-0x00007FF763710000-0x00007FF763B06000-memory.dmp	xmrig
behavioral2/memory/2856-618-0x00007FF645DB0000-0x00007FF6461A6000-memory.dmp	xmrig
behavioral2/memory/3548-621-0x00007FF7BB440000-0x00007FF7BB836000-memory.dmp	xmrig
behavioral2/memory/1280-627-0x00007FF6C1BC0000-0x00007FF6C1FB6000-memory.dmp	xmrig
behavioral2/memory/4768-636-0x00007FF6F17D0000-0x00007FF6F1BC6000-memory.dmp	xmrig
behavioral2/memory/2276-646-0x00007FF6003E0000-0x00007FF6007D6000-memory.dmp	xmrig
behavioral2/memory/4800-654-0x00007FF76DA70000-0x00007FF76DE66000-memory.dmp	xmrig
behavioral2/memory/2436-660-0x00007FF7BD2D0000-0x00007FF7BD6C6000-memory.dmp	xmrig
behavioral2/memory/400-642-0x00007FF7EE6C0000-0x00007FF7EEAB6000-memory.dmp	xmrig
behavioral2/memory/2432-671-0x00007FF7C16D0000-0x00007FF7C1AC6000-memory.dmp	xmrig
behavioral2/memory/4064-677-0x00007FF7A53F0000-0x00007FF7A57E6000-memory.dmp	xmrig
behavioral2/memory/3908-692-0x00007FF737EA0000-0x00007FF738296000-memory.dmp	xmrig
behavioral2/memory/1664-698-0x00007FF6C8720000-0x00007FF6C8B16000-memory.dmp	xmrig
behavioral2/memory/4456-701-0x00007FF679E20000-0x00007FF67A216000-memory.dmp	xmrig
behavioral2/memory/1676-707-0x00007FF7A1540000-0x00007FF7A1936000-memory.dmp	xmrig
behavioral2/memory/1852-708-0x00007FF7D1D60000-0x00007FF7D2156000-memory.dmp	xmrig
behavioral2/memory/3308-706-0x00007FF6567A0000-0x00007FF656B96000-memory.dmp	xmrig
behavioral2/memory/4528-705-0x00007FF7399B0000-0x00007FF739DA6000-memory.dmp	xmrig
behavioral2/memory/4528-716-0x00007FF7399B0000-0x00007FF739DA6000-memory.dmp	xmrig
behavioral2/memory/4356-718-0x00007FF6B5100000-0x00007FF6B54F6000-memory.dmp	xmrig
behavioral2/memory/3540-722-0x00007FF6DC770000-0x00007FF6DCB66000-memory.dmp	xmrig
behavioral2/memory/4144-730-0x00007FF74EBE0000-0x00007FF74EFD6000-memory.dmp	xmrig
behavioral2/memory/5112-735-0x00007FF6B0020000-0x00007FF6B0416000-memory.dmp	xmrig
behavioral2/memory/1028-739-0x00007FF763710000-0x00007FF763B06000-memory.dmp	xmrig
behavioral2/memory/3892-726-0x00007FF715F20000-0x00007FF716316000-memory.dmp	xmrig
behavioral2/memory/1436-725-0x00007FF736890000-0x00007FF736C86000-memory.dmp	xmrig
behavioral2/memory/2856-743-0x00007FF645DB0000-0x00007FF6461A6000-memory.dmp	xmrig
behavioral2/memory/1676-745-0x00007FF7A1540000-0x00007FF7A1936000-memory.dmp	xmrig
behavioral2/memory/3308-744-0x00007FF6567A0000-0x00007FF656B96000-memory.dmp	xmrig
behavioral2/files/0x0007000000023470-180.dat	xmrig
behavioral2/files/0x000700000002346f-173.dat	xmrig
behavioral2/memory/3548-790-0x00007FF7BB440000-0x00007FF7BB836000-memory.dmp	xmrig
behavioral2/memory/2432-789-0x00007FF7C16D0000-0x00007FF7C1AC6000-memory.dmp	xmrig
behavioral2/memory/4064-788-0x00007FF7A53F0000-0x00007FF7A57E6000-memory.dmp	xmrig
behavioral2/memory/2436-787-0x00007FF7BD2D0000-0x00007FF7BD6C6000-memory.dmp	xmrig
behavioral2/memory/400-784-0x00007FF7EE6C0000-0x00007FF7EEAB6000-memory.dmp	xmrig
behavioral2/memory/4768-783-0x00007FF6F17D0000-0x00007FF6F1BC6000-memory.dmp	xmrig
behavioral2/memory/2276-782-0x00007FF6003E0000-0x00007FF6007D6000-memory.dmp	xmrig
behavioral2/memory/1280-777-0x00007FF6C1BC0000-0x00007FF6C1FB6000-memory.dmp	xmrig
behavioral2/memory/4456-781-0x00007FF679E20000-0x00007FF67A216000-memory.dmp	xmrig
behavioral2/memory/1664-780-0x00007FF6C8720000-0x00007FF6C8B16000-memory.dmp	xmrig
behavioral2/memory/1852-776-0x00007FF7D1D60000-0x00007FF7D2156000-memory.dmp	xmrig
behavioral2/memory/3908-779-0x00007FF737EA0000-0x00007FF738296000-memory.dmp	xmrig
behavioral2/memory/4800-778-0x00007FF76DA70000-0x00007FF76DE66000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	1944	powershell.exe
11	1944	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1944	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4528	ndJqGCE.exe
4356	eClVtak.exe
3540	TwBtEWT.exe
1436	IWdQKHV.exe
3892	KvtJQra.exe
4144	XSXyifu.exe
5112	mlhDgNb.exe
1028	diuIIzB.exe
2856	HUbUqrS.exe
3308	jvqlFwd.exe
1676	jxewZek.exe
1852	xWRClRP.exe
3548	xbLONsF.exe
1280	pSrZACO.exe
4768	GovhRtM.exe
400	LVFTTPN.exe
2276	HpEZQpG.exe
4800	szqQKuQ.exe
2436	MPKgaOr.exe
2432	hNCkvUG.exe
4064	acywOxc.exe
3908	nZHCBsu.exe
1664	NPOgzcU.exe
4456	KGMvCVm.exe
3592	GtRqRNS.exe
2520	SwhXjuj.exe
2788	ToHRqXB.exe
868	BWyVRKv.exe
3824	SlKwVmH.exe
2812	WvCYScM.exe
2944	jgMEBFk.exe
680	rJGAiKm.exe
3700	ptJteXe.exe
3432	FamGMnv.exe
2568	dbYeznR.exe
4300	XkdArvc.exe
3036	uUlvsIn.exe
692	JPVaDvm.exe
116	hcZUFRv.exe
3640	kBabliQ.exe
4904	nOTbJpO.exe
3528	RCMDqZB.exe
5060	JrNRhYQ.exe
724	MfTdhks.exe
1056	gxDCTwQ.exe
2168	LgvFNoR.exe
2960	ZQdwDez.exe
1080	uVNDTcO.exe
1344	wSjvEvy.exe
1476	eYxxljn.exe
1016	PIkGuVN.exe
3412	ReDIdGv.exe
748	LJNOjZS.exe
1472	gCxApWb.exe
652	NcTYNik.exe
2636	dCwugJM.exe
1864	aEEvdXL.exe
3328	wipDUqr.exe
3084	pCPAzYN.exe
5032	jLQCFwi.exe
1260	MoWIjHV.exe
3596	rsEfdYq.exe
1840	GFFarDM.exe
4024	rZkrLHV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4952-0-0x00007FF7700F0000-0x00007FF7704E6000-memory.dmp	upx
behavioral2/files/0x0007000000023452-6.dat	upx
behavioral2/files/0x0007000000023453-11.dat	upx
behavioral2/files/0x0007000000023454-13.dat	upx
behavioral2/files/0x0008000000023456-33.dat	upx
behavioral2/files/0x000800000002344e-35.dat	upx
behavioral2/files/0x0007000000023457-41.dat	upx
behavioral2/files/0x0007000000023458-47.dat	upx
behavioral2/files/0x0008000000023455-52.dat	upx
behavioral2/memory/4356-61-0x00007FF6B5100000-0x00007FF6B54F6000-memory.dmp	upx
behavioral2/files/0x000700000002345a-65.dat	upx
behavioral2/memory/1436-70-0x00007FF736890000-0x00007FF736C86000-memory.dmp	upx
behavioral2/files/0x000700000002345b-71.dat	upx
behavioral2/memory/3892-74-0x00007FF715F20000-0x00007FF716316000-memory.dmp	upx
behavioral2/memory/4144-75-0x00007FF74EBE0000-0x00007FF74EFD6000-memory.dmp	upx
behavioral2/memory/3540-64-0x00007FF6DC770000-0x00007FF6DCB66000-memory.dmp	upx
behavioral2/files/0x0007000000023459-58.dat	upx
behavioral2/files/0x0007000000023461-103.dat	upx
behavioral2/files/0x0007000000023464-118.dat	upx
behavioral2/memory/5112-608-0x00007FF6B0020000-0x00007FF6B0416000-memory.dmp	upx
behavioral2/memory/1028-611-0x00007FF763710000-0x00007FF763B06000-memory.dmp	upx
behavioral2/memory/2856-618-0x00007FF645DB0000-0x00007FF6461A6000-memory.dmp	upx
behavioral2/memory/3548-621-0x00007FF7BB440000-0x00007FF7BB836000-memory.dmp	upx
behavioral2/memory/1280-627-0x00007FF6C1BC0000-0x00007FF6C1FB6000-memory.dmp	upx
behavioral2/memory/4768-636-0x00007FF6F17D0000-0x00007FF6F1BC6000-memory.dmp	upx
behavioral2/memory/2276-646-0x00007FF6003E0000-0x00007FF6007D6000-memory.dmp	upx
behavioral2/memory/4800-654-0x00007FF76DA70000-0x00007FF76DE66000-memory.dmp	upx
behavioral2/memory/2436-660-0x00007FF7BD2D0000-0x00007FF7BD6C6000-memory.dmp	upx
behavioral2/memory/400-642-0x00007FF7EE6C0000-0x00007FF7EEAB6000-memory.dmp	upx
behavioral2/memory/2432-671-0x00007FF7C16D0000-0x00007FF7C1AC6000-memory.dmp	upx
behavioral2/memory/4064-677-0x00007FF7A53F0000-0x00007FF7A57E6000-memory.dmp	upx
behavioral2/memory/3908-692-0x00007FF737EA0000-0x00007FF738296000-memory.dmp	upx
behavioral2/memory/1664-698-0x00007FF6C8720000-0x00007FF6C8B16000-memory.dmp	upx
behavioral2/memory/4456-701-0x00007FF679E20000-0x00007FF67A216000-memory.dmp	upx
behavioral2/memory/1676-707-0x00007FF7A1540000-0x00007FF7A1936000-memory.dmp	upx
behavioral2/memory/1852-708-0x00007FF7D1D60000-0x00007FF7D2156000-memory.dmp	upx
behavioral2/memory/3308-706-0x00007FF6567A0000-0x00007FF656B96000-memory.dmp	upx
behavioral2/memory/4528-705-0x00007FF7399B0000-0x00007FF739DA6000-memory.dmp	upx
behavioral2/memory/4528-716-0x00007FF7399B0000-0x00007FF739DA6000-memory.dmp	upx
behavioral2/memory/4356-718-0x00007FF6B5100000-0x00007FF6B54F6000-memory.dmp	upx
behavioral2/memory/3540-722-0x00007FF6DC770000-0x00007FF6DCB66000-memory.dmp	upx
behavioral2/memory/4144-730-0x00007FF74EBE0000-0x00007FF74EFD6000-memory.dmp	upx
behavioral2/memory/5112-735-0x00007FF6B0020000-0x00007FF6B0416000-memory.dmp	upx
behavioral2/memory/1028-739-0x00007FF763710000-0x00007FF763B06000-memory.dmp	upx
behavioral2/memory/3892-726-0x00007FF715F20000-0x00007FF716316000-memory.dmp	upx
behavioral2/memory/1436-725-0x00007FF736890000-0x00007FF736C86000-memory.dmp	upx
behavioral2/memory/2856-743-0x00007FF645DB0000-0x00007FF6461A6000-memory.dmp	upx
behavioral2/memory/1676-745-0x00007FF7A1540000-0x00007FF7A1936000-memory.dmp	upx
behavioral2/memory/3308-744-0x00007FF6567A0000-0x00007FF656B96000-memory.dmp	upx
behavioral2/files/0x0007000000023470-180.dat	upx
behavioral2/files/0x000700000002346f-173.dat	upx
behavioral2/memory/3548-790-0x00007FF7BB440000-0x00007FF7BB836000-memory.dmp	upx
behavioral2/memory/2432-789-0x00007FF7C16D0000-0x00007FF7C1AC6000-memory.dmp	upx
behavioral2/memory/4064-788-0x00007FF7A53F0000-0x00007FF7A57E6000-memory.dmp	upx
behavioral2/memory/2436-787-0x00007FF7BD2D0000-0x00007FF7BD6C6000-memory.dmp	upx
behavioral2/memory/400-784-0x00007FF7EE6C0000-0x00007FF7EEAB6000-memory.dmp	upx
behavioral2/memory/4768-783-0x00007FF6F17D0000-0x00007FF6F1BC6000-memory.dmp	upx
behavioral2/memory/2276-782-0x00007FF6003E0000-0x00007FF6007D6000-memory.dmp	upx
behavioral2/memory/1280-777-0x00007FF6C1BC0000-0x00007FF6C1FB6000-memory.dmp	upx
behavioral2/memory/4456-781-0x00007FF679E20000-0x00007FF67A216000-memory.dmp	upx
behavioral2/memory/1664-780-0x00007FF6C8720000-0x00007FF6C8B16000-memory.dmp	upx
behavioral2/memory/1852-776-0x00007FF7D1D60000-0x00007FF7D2156000-memory.dmp	upx
behavioral2/memory/3908-779-0x00007FF737EA0000-0x00007FF738296000-memory.dmp	upx
behavioral2/memory/4800-778-0x00007FF76DA70000-0x00007FF76DE66000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zlRhbdG.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\GovhRtM.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\jgMEBFk.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\sQtWmWW.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\MqbNvyD.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\XIwsTbJ.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\IpFgTEh.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\jvqlFwd.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\aEEvdXL.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\mXXSBHW.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\LTKBAsD.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\XSXyifu.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\szqQKuQ.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\cjxBixi.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\LgvFNoR.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\rZkrLHV.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\sfmOvDq.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\rfTotuS.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\IWdQKHV.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\HCvIAvb.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\uWcamhL.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\rJGAiKm.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\MmBSmCL.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\RCMDqZB.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\sWOehUS.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\gCxApWb.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\GOBJzDv.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\KMtqiQn.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\OTYfWwc.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\XKoSqWe.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\BIXRRNF.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\oJBPDef.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\ndJqGCE.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\SwhXjuj.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\WJnOBnt.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\jYtkFKb.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\GlJGbPB.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\pdOucRS.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\vcgUCDn.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\ToHRqXB.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\FamGMnv.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\uVNDTcO.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\NoFYtpP.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\IhYYjyr.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\zWzmbIc.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\WlJJiRu.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\mcKYZfr.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\zcnCwRJ.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\FzitsWq.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\chNCgZX.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\mlhDgNb.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\eClVtak.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\VRtCgtL.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\vsfTEqJ.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\MoWIjHV.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\ULerldP.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\ArPCArA.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\FYYoaiA.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\ZQdwDez.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\PIkGuVN.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\xbLONsF.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\gxDCTwQ.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\VbHLUtz.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
File created	C:\Windows\System\mlviIPj.exe	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1944	powershell.exe
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeLockMemoryPrivilege	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1944	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	85
PID 4952 wrote to memory of 1944	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	85
PID 4952 wrote to memory of 4528	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	86
PID 4952 wrote to memory of 4528	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	86
PID 4952 wrote to memory of 4356	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	87
PID 4952 wrote to memory of 4356	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	87
PID 4952 wrote to memory of 3540	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	88
PID 4952 wrote to memory of 3540	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	88
PID 4952 wrote to memory of 1436	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	89
PID 4952 wrote to memory of 1436	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	89
PID 4952 wrote to memory of 3892	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	90
PID 4952 wrote to memory of 3892	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	90
PID 4952 wrote to memory of 4144	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	91
PID 4952 wrote to memory of 4144	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	91
PID 4952 wrote to memory of 5112	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	92
PID 4952 wrote to memory of 5112	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	92
PID 4952 wrote to memory of 1028	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	93
PID 4952 wrote to memory of 1028	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	93
PID 4952 wrote to memory of 2856	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	94
PID 4952 wrote to memory of 2856	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	94
PID 4952 wrote to memory of 3308	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	95
PID 4952 wrote to memory of 3308	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	95
PID 4952 wrote to memory of 1676	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	96
PID 4952 wrote to memory of 1676	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	96
PID 4952 wrote to memory of 1852	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	97
PID 4952 wrote to memory of 1852	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	97
PID 4952 wrote to memory of 3548	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	98
PID 4952 wrote to memory of 3548	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	98
PID 4952 wrote to memory of 1280	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	99
PID 4952 wrote to memory of 1280	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	99
PID 4952 wrote to memory of 4768	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	100
PID 4952 wrote to memory of 4768	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	100
PID 4952 wrote to memory of 400	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	101
PID 4952 wrote to memory of 400	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	101
PID 4952 wrote to memory of 2276	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	102
PID 4952 wrote to memory of 2276	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	102
PID 4952 wrote to memory of 4800	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	103
PID 4952 wrote to memory of 4800	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	103
PID 4952 wrote to memory of 2436	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	104
PID 4952 wrote to memory of 2436	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	104
PID 4952 wrote to memory of 2432	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	105
PID 4952 wrote to memory of 2432	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	105
PID 4952 wrote to memory of 4064	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	106
PID 4952 wrote to memory of 4064	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	106
PID 4952 wrote to memory of 3908	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	107
PID 4952 wrote to memory of 3908	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	107
PID 4952 wrote to memory of 1664	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	108
PID 4952 wrote to memory of 1664	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	108
PID 4952 wrote to memory of 4456	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	109
PID 4952 wrote to memory of 4456	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	109
PID 4952 wrote to memory of 3592	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	110
PID 4952 wrote to memory of 3592	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	110
PID 4952 wrote to memory of 2520	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	111
PID 4952 wrote to memory of 2520	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	111
PID 4952 wrote to memory of 2788	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	112
PID 4952 wrote to memory of 2788	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	112
PID 4952 wrote to memory of 868	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	113
PID 4952 wrote to memory of 868	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	113
PID 4952 wrote to memory of 3824	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	114
PID 4952 wrote to memory of 3824	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	114
PID 4952 wrote to memory of 2812	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	115
PID 4952 wrote to memory of 2812	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	115
PID 4952 wrote to memory of 2944	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	116
PID 4952 wrote to memory of 2944	4952	70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe	116

C:\Users\Admin\AppData\Local\Temp\70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe
"C:\Users\Admin\AppData\Local\Temp\70eca5ac868ee58dc21caeb7eb4b508afa44d2d9dcbfc223e8c461e489234251.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System\ndJqGCE.exe
  C:\Windows\System\ndJqGCE.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\eClVtak.exe
  C:\Windows\System\eClVtak.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\TwBtEWT.exe
  C:\Windows\System\TwBtEWT.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\IWdQKHV.exe
  C:\Windows\System\IWdQKHV.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\KvtJQra.exe
  C:\Windows\System\KvtJQra.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\XSXyifu.exe
  C:\Windows\System\XSXyifu.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\mlhDgNb.exe
  C:\Windows\System\mlhDgNb.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\diuIIzB.exe
  C:\Windows\System\diuIIzB.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\HUbUqrS.exe
  C:\Windows\System\HUbUqrS.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\jvqlFwd.exe
  C:\Windows\System\jvqlFwd.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\jxewZek.exe
  C:\Windows\System\jxewZek.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\xWRClRP.exe
  C:\Windows\System\xWRClRP.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\xbLONsF.exe
  C:\Windows\System\xbLONsF.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\pSrZACO.exe
  C:\Windows\System\pSrZACO.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\GovhRtM.exe
  C:\Windows\System\GovhRtM.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\LVFTTPN.exe
  C:\Windows\System\LVFTTPN.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\HpEZQpG.exe
  C:\Windows\System\HpEZQpG.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\szqQKuQ.exe
  C:\Windows\System\szqQKuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\MPKgaOr.exe
  C:\Windows\System\MPKgaOr.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\hNCkvUG.exe
  C:\Windows\System\hNCkvUG.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\acywOxc.exe
  C:\Windows\System\acywOxc.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\nZHCBsu.exe
  C:\Windows\System\nZHCBsu.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\NPOgzcU.exe
  C:\Windows\System\NPOgzcU.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\KGMvCVm.exe
  C:\Windows\System\KGMvCVm.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\GtRqRNS.exe
  C:\Windows\System\GtRqRNS.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\SwhXjuj.exe
  C:\Windows\System\SwhXjuj.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ToHRqXB.exe
  C:\Windows\System\ToHRqXB.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\BWyVRKv.exe
  C:\Windows\System\BWyVRKv.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\SlKwVmH.exe
  C:\Windows\System\SlKwVmH.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\WvCYScM.exe
  C:\Windows\System\WvCYScM.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\jgMEBFk.exe
  C:\Windows\System\jgMEBFk.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\rJGAiKm.exe
  C:\Windows\System\rJGAiKm.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\ptJteXe.exe
  C:\Windows\System\ptJteXe.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\FamGMnv.exe
  C:\Windows\System\FamGMnv.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\dbYeznR.exe
  C:\Windows\System\dbYeznR.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\XkdArvc.exe
  C:\Windows\System\XkdArvc.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\uUlvsIn.exe
  C:\Windows\System\uUlvsIn.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\JPVaDvm.exe
  C:\Windows\System\JPVaDvm.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\hcZUFRv.exe
  C:\Windows\System\hcZUFRv.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\kBabliQ.exe
  C:\Windows\System\kBabliQ.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\nOTbJpO.exe
  C:\Windows\System\nOTbJpO.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\RCMDqZB.exe
  C:\Windows\System\RCMDqZB.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\JrNRhYQ.exe
  C:\Windows\System\JrNRhYQ.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\MfTdhks.exe
  C:\Windows\System\MfTdhks.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\gxDCTwQ.exe
  C:\Windows\System\gxDCTwQ.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\LgvFNoR.exe
  C:\Windows\System\LgvFNoR.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\ZQdwDez.exe
  C:\Windows\System\ZQdwDez.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\uVNDTcO.exe
  C:\Windows\System\uVNDTcO.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\wSjvEvy.exe
  C:\Windows\System\wSjvEvy.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\eYxxljn.exe
  C:\Windows\System\eYxxljn.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\PIkGuVN.exe
  C:\Windows\System\PIkGuVN.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\ReDIdGv.exe
  C:\Windows\System\ReDIdGv.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\LJNOjZS.exe
  C:\Windows\System\LJNOjZS.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\gCxApWb.exe
  C:\Windows\System\gCxApWb.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\NcTYNik.exe
  C:\Windows\System\NcTYNik.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\dCwugJM.exe
  C:\Windows\System\dCwugJM.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\aEEvdXL.exe
  C:\Windows\System\aEEvdXL.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\wipDUqr.exe
  C:\Windows\System\wipDUqr.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\pCPAzYN.exe
  C:\Windows\System\pCPAzYN.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\jLQCFwi.exe
  C:\Windows\System\jLQCFwi.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\MoWIjHV.exe
  C:\Windows\System\MoWIjHV.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\rsEfdYq.exe
  C:\Windows\System\rsEfdYq.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\GFFarDM.exe
  C:\Windows\System\GFFarDM.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\rZkrLHV.exe
  C:\Windows\System\rZkrLHV.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\ytEzzKM.exe
  C:\Windows\System\ytEzzKM.exe
  2⤵
  PID:4296
- C:\Windows\System\RWWQslX.exe
  C:\Windows\System\RWWQslX.exe
  2⤵
  PID:5084
- C:\Windows\System\IhYYjyr.exe
  C:\Windows\System\IhYYjyr.exe
  2⤵
  PID:2724
- C:\Windows\System\XiVPJRB.exe
  C:\Windows\System\XiVPJRB.exe
  2⤵
  PID:3492
- C:\Windows\System\NuwIItb.exe
  C:\Windows\System\NuwIItb.exe
  2⤵
  PID:5148
- C:\Windows\System\PjTUPbO.exe
  C:\Windows\System\PjTUPbO.exe
  2⤵
  PID:5176
- C:\Windows\System\mXXSBHW.exe
  C:\Windows\System\mXXSBHW.exe
  2⤵
  PID:5192
- C:\Windows\System\pBHZhBI.exe
  C:\Windows\System\pBHZhBI.exe
  2⤵
  PID:5208
- C:\Windows\System\pWSeSwK.exe
  C:\Windows\System\pWSeSwK.exe
  2⤵
  PID:5228
- C:\Windows\System\pdOucRS.exe
  C:\Windows\System\pdOucRS.exe
  2⤵
  PID:5264
- C:\Windows\System\twqqpSC.exe
  C:\Windows\System\twqqpSC.exe
  2⤵
  PID:5308
- C:\Windows\System\hrwidYk.exe
  C:\Windows\System\hrwidYk.exe
  2⤵
  PID:5332
- C:\Windows\System\ULerldP.exe
  C:\Windows\System\ULerldP.exe
  2⤵
  PID:5364
- C:\Windows\System\eATAHrM.exe
  C:\Windows\System\eATAHrM.exe
  2⤵
  PID:5400
- C:\Windows\System\uKcMfkP.exe
  C:\Windows\System\uKcMfkP.exe
  2⤵
  PID:5420
- C:\Windows\System\OPxpokB.exe
  C:\Windows\System\OPxpokB.exe
  2⤵
  PID:5444
- C:\Windows\System\imzZGpo.exe
  C:\Windows\System\imzZGpo.exe
  2⤵
  PID:5480
- C:\Windows\System\MmpEbrY.exe
  C:\Windows\System\MmpEbrY.exe
  2⤵
  PID:5508
- C:\Windows\System\ZOUsoGq.exe
  C:\Windows\System\ZOUsoGq.exe
  2⤵
  PID:5528
- C:\Windows\System\DgtRKEV.exe
  C:\Windows\System\DgtRKEV.exe
  2⤵
  PID:5552
- C:\Windows\System\dygJWIF.exe
  C:\Windows\System\dygJWIF.exe
  2⤵
  PID:5580
- C:\Windows\System\QqQAndi.exe
  C:\Windows\System\QqQAndi.exe
  2⤵
  PID:5600
- C:\Windows\System\vvpsWjl.exe
  C:\Windows\System\vvpsWjl.exe
  2⤵
  PID:5640
- C:\Windows\System\sQtWmWW.exe
  C:\Windows\System\sQtWmWW.exe
  2⤵
  PID:5664
- C:\Windows\System\GOBJzDv.exe
  C:\Windows\System\GOBJzDv.exe
  2⤵
  PID:5696
- C:\Windows\System\KWLckmp.exe
  C:\Windows\System\KWLckmp.exe
  2⤵
  PID:5716
- C:\Windows\System\gncyZXG.exe
  C:\Windows\System\gncyZXG.exe
  2⤵
  PID:5736
- C:\Windows\System\iFFmfaa.exe
  C:\Windows\System\iFFmfaa.exe
  2⤵
  PID:5760
- C:\Windows\System\Oodnnya.exe
  C:\Windows\System\Oodnnya.exe
  2⤵
  PID:5788
- C:\Windows\System\GvIEoKD.exe
  C:\Windows\System\GvIEoKD.exe
  2⤵
  PID:5832
- C:\Windows\System\BDtDFrg.exe
  C:\Windows\System\BDtDFrg.exe
  2⤵
  PID:5852
- C:\Windows\System\aaxyUQS.exe
  C:\Windows\System\aaxyUQS.exe
  2⤵
  PID:5876
- C:\Windows\System\HJmzgkS.exe
  C:\Windows\System\HJmzgkS.exe
  2⤵
  PID:5904
- C:\Windows\System\VsrehFL.exe
  C:\Windows\System\VsrehFL.exe
  2⤵
  PID:5944
- C:\Windows\System\PGnwEuJ.exe
  C:\Windows\System\PGnwEuJ.exe
  2⤵
  PID:5972
- C:\Windows\System\ykgcMeb.exe
  C:\Windows\System\ykgcMeb.exe
  2⤵
  PID:6004
- C:\Windows\System\sfmOvDq.exe
  C:\Windows\System\sfmOvDq.exe
  2⤵
  PID:6040
- C:\Windows\System\wUoKNyt.exe
  C:\Windows\System\wUoKNyt.exe
  2⤵
  PID:6068
- C:\Windows\System\mlviIPj.exe
  C:\Windows\System\mlviIPj.exe
  2⤵
  PID:6092
- C:\Windows\System\xqKyBTH.exe
  C:\Windows\System\xqKyBTH.exe
  2⤵
  PID:6112
- C:\Windows\System\zfWcgCW.exe
  C:\Windows\System\zfWcgCW.exe
  2⤵
  PID:3188
- C:\Windows\System\WPaAAiE.exe
  C:\Windows\System\WPaAAiE.exe
  2⤵
  PID:412
- C:\Windows\System\GFZPldE.exe
  C:\Windows\System\GFZPldE.exe
  2⤵
  PID:4388
- C:\Windows\System\FzitsWq.exe
  C:\Windows\System\FzitsWq.exe
  2⤵
  PID:2536
- C:\Windows\System\kPIBcMD.exe
  C:\Windows\System\kPIBcMD.exe
  2⤵
  PID:2676
- C:\Windows\System\ndPPPdY.exe
  C:\Windows\System\ndPPPdY.exe
  2⤵
  PID:2388
- C:\Windows\System\eascmmG.exe
  C:\Windows\System\eascmmG.exe
  2⤵
  PID:5204
- C:\Windows\System\MOJhMBl.exe
  C:\Windows\System\MOJhMBl.exe
  2⤵
  PID:5284
- C:\Windows\System\vcgUCDn.exe
  C:\Windows\System\vcgUCDn.exe
  2⤵
  PID:5380
- C:\Windows\System\TSqTIDc.exe
  C:\Windows\System\TSqTIDc.exe
  2⤵
  PID:5464
- C:\Windows\System\lpBYCrI.exe
  C:\Windows\System\lpBYCrI.exe
  2⤵
  PID:2148
- C:\Windows\System\WJnOBnt.exe
  C:\Windows\System\WJnOBnt.exe
  2⤵
  PID:5540
- C:\Windows\System\BTlfjhB.exe
  C:\Windows\System\BTlfjhB.exe
  2⤵
  PID:5660
- C:\Windows\System\FRQsUgn.exe
  C:\Windows\System\FRQsUgn.exe
  2⤵
  PID:5732
- C:\Windows\System\duunfFe.exe
  C:\Windows\System\duunfFe.exe
  2⤵
  PID:5776
- C:\Windows\System\fKBfdQM.exe
  C:\Windows\System\fKBfdQM.exe
  2⤵
  PID:5804
- C:\Windows\System\cjxBixi.exe
  C:\Windows\System\cjxBixi.exe
  2⤵
  PID:5864
- C:\Windows\System\jYtkFKb.exe
  C:\Windows\System\jYtkFKb.exe
  2⤵
  PID:5928
- C:\Windows\System\cRGdGEE.exe
  C:\Windows\System\cRGdGEE.exe
  2⤵
  PID:5960
- C:\Windows\System\apzaDMW.exe
  C:\Windows\System\apzaDMW.exe
  2⤵
  PID:6036
- C:\Windows\System\WlJJiRu.exe
  C:\Windows\System\WlJJiRu.exe
  2⤵
  PID:6076
- C:\Windows\System\MmBSmCL.exe
  C:\Windows\System\MmBSmCL.exe
  2⤵
  PID:4512
- C:\Windows\System\sRkyfWI.exe
  C:\Windows\System\sRkyfWI.exe
  2⤵
  PID:2620
- C:\Windows\System\VRtCgtL.exe
  C:\Windows\System\VRtCgtL.exe
  2⤵
  PID:5184
- C:\Windows\System\kSPexoj.exe
  C:\Windows\System\kSPexoj.exe
  2⤵
  PID:5296
- C:\Windows\System\xxzyaKu.exe
  C:\Windows\System\xxzyaKu.exe
  2⤵
  PID:5436
- C:\Windows\System\PaxkNjr.exe
  C:\Windows\System\PaxkNjr.exe
  2⤵
  PID:5568
- C:\Windows\System\NyKoWeE.exe
  C:\Windows\System\NyKoWeE.exe
  2⤵
  PID:5724
- C:\Windows\System\GVCQDIc.exe
  C:\Windows\System\GVCQDIc.exe
  2⤵
  PID:4920
- C:\Windows\System\qMIdSno.exe
  C:\Windows\System\qMIdSno.exe
  2⤵
  PID:5888
- C:\Windows\System\RiCwrhL.exe
  C:\Windows\System\RiCwrhL.exe
  2⤵
  PID:6104
- C:\Windows\System\PPSrrEk.exe
  C:\Windows\System\PPSrrEk.exe
  2⤵
  PID:2104
- C:\Windows\System\zWzmbIc.exe
  C:\Windows\System\zWzmbIc.exe
  2⤵
  PID:3032
- C:\Windows\System\BpePGaz.exe
  C:\Windows\System\BpePGaz.exe
  2⤵
  PID:5612
- C:\Windows\System\dxoMNLZ.exe
  C:\Windows\System\dxoMNLZ.exe
  2⤵
  PID:5796
- C:\Windows\System\MqbNvyD.exe
  C:\Windows\System\MqbNvyD.exe
  2⤵
  PID:6052
- C:\Windows\System\kCnkILz.exe
  C:\Windows\System\kCnkILz.exe
  2⤵
  PID:6156
- C:\Windows\System\ArPCArA.exe
  C:\Windows\System\ArPCArA.exe
  2⤵
  PID:6180
- C:\Windows\System\zlRhbdG.exe
  C:\Windows\System\zlRhbdG.exe
  2⤵
  PID:6224
- C:\Windows\System\rRSbJRd.exe
  C:\Windows\System\rRSbJRd.exe
  2⤵
  PID:6260
- C:\Windows\System\mcKYZfr.exe
  C:\Windows\System\mcKYZfr.exe
  2⤵
  PID:6280
- C:\Windows\System\NVSdfCd.exe
  C:\Windows\System\NVSdfCd.exe
  2⤵
  PID:6300
- C:\Windows\System\XIwsTbJ.exe
  C:\Windows\System\XIwsTbJ.exe
  2⤵
  PID:6324
- C:\Windows\System\gfjAmnH.exe
  C:\Windows\System\gfjAmnH.exe
  2⤵
  PID:6340
- C:\Windows\System\KMtqiQn.exe
  C:\Windows\System\KMtqiQn.exe
  2⤵
  PID:6364
- C:\Windows\System\IpFgTEh.exe
  C:\Windows\System\IpFgTEh.exe
  2⤵
  PID:6388
- C:\Windows\System\YcYeSyr.exe
  C:\Windows\System\YcYeSyr.exe
  2⤵
  PID:6416
- C:\Windows\System\nqBNpzT.exe
  C:\Windows\System\nqBNpzT.exe
  2⤵
  PID:6456
- C:\Windows\System\pzKSTgD.exe
  C:\Windows\System\pzKSTgD.exe
  2⤵
  PID:6484
- C:\Windows\System\QcAcRfZ.exe
  C:\Windows\System\QcAcRfZ.exe
  2⤵
  PID:6504
- C:\Windows\System\uyATQLj.exe
  C:\Windows\System\uyATQLj.exe
  2⤵
  PID:6560
- C:\Windows\System\fpdVXFf.exe
  C:\Windows\System\fpdVXFf.exe
  2⤵
  PID:6588
- C:\Windows\System\wHnqsvz.exe
  C:\Windows\System\wHnqsvz.exe
  2⤵
  PID:6628
- C:\Windows\System\GlJGbPB.exe
  C:\Windows\System\GlJGbPB.exe
  2⤵
  PID:6644
- C:\Windows\System\qvuXicL.exe
  C:\Windows\System\qvuXicL.exe
  2⤵
  PID:6664
- C:\Windows\System\IufVxDT.exe
  C:\Windows\System\IufVxDT.exe
  2⤵
  PID:6696
- C:\Windows\System\OTYfWwc.exe
  C:\Windows\System\OTYfWwc.exe
  2⤵
  PID:6716
- C:\Windows\System\mYWrhUD.exe
  C:\Windows\System\mYWrhUD.exe
  2⤵
  PID:6752
- C:\Windows\System\zcnCwRJ.exe
  C:\Windows\System\zcnCwRJ.exe
  2⤵
  PID:6776
- C:\Windows\System\coDHRJF.exe
  C:\Windows\System\coDHRJF.exe
  2⤵
  PID:6808
- C:\Windows\System\XKoSqWe.exe
  C:\Windows\System\XKoSqWe.exe
  2⤵
  PID:6836
- C:\Windows\System\HCvIAvb.exe
  C:\Windows\System\HCvIAvb.exe
  2⤵
  PID:6860
- C:\Windows\System\vKWLddG.exe
  C:\Windows\System\vKWLddG.exe
  2⤵
  PID:6884
- C:\Windows\System\chNCgZX.exe
  C:\Windows\System\chNCgZX.exe
  2⤵
  PID:6908
- C:\Windows\System\HFXwkZS.exe
  C:\Windows\System\HFXwkZS.exe
  2⤵
  PID:6932
- C:\Windows\System\AbTVeED.exe
  C:\Windows\System\AbTVeED.exe
  2⤵
  PID:6968
- C:\Windows\System\UORtZWa.exe
  C:\Windows\System\UORtZWa.exe
  2⤵
  PID:6996
- C:\Windows\System\aQdShEj.exe
  C:\Windows\System\aQdShEj.exe
  2⤵
  PID:7044
- C:\Windows\System\NoFYtpP.exe
  C:\Windows\System\NoFYtpP.exe
  2⤵
  PID:7112
- C:\Windows\System\eKkEftu.exe
  C:\Windows\System\eKkEftu.exe
  2⤵
  PID:7144
- C:\Windows\System\uWcamhL.exe
  C:\Windows\System\uWcamhL.exe
  2⤵
  PID:7160
- C:\Windows\System\bTAuAwn.exe
  C:\Windows\System\bTAuAwn.exe
  2⤵
  PID:3508
- C:\Windows\System\qveUvza.exe
  C:\Windows\System\qveUvza.exe
  2⤵
  PID:6196
- C:\Windows\System\BSHZOBt.exe
  C:\Windows\System\BSHZOBt.exe
  2⤵
  PID:6348
- C:\Windows\System\sVtKnfg.exe
  C:\Windows\System\sVtKnfg.exe
  2⤵
  PID:6440
- C:\Windows\System\TlRGmzS.exe
  C:\Windows\System\TlRGmzS.exe
  2⤵
  PID:6536
- C:\Windows\System\RxPvXee.exe
  C:\Windows\System\RxPvXee.exe
  2⤵
  PID:6596
- C:\Windows\System\BIXRRNF.exe
  C:\Windows\System\BIXRRNF.exe
  2⤵
  PID:6692
- C:\Windows\System\oaWUbDS.exe
  C:\Windows\System\oaWUbDS.exe
  2⤵
  PID:6804
- C:\Windows\System\vNVNGEh.exe
  C:\Windows\System\vNVNGEh.exe
  2⤵
  PID:3860
- C:\Windows\System\pnGBItX.exe
  C:\Windows\System\pnGBItX.exe
  2⤵
  PID:3888
- C:\Windows\System\ANvcynx.exe
  C:\Windows\System\ANvcynx.exe
  2⤵
  PID:2180
- C:\Windows\System\VbHLUtz.exe
  C:\Windows\System\VbHLUtz.exe
  2⤵
  PID:2040
- C:\Windows\System\FYYoaiA.exe
  C:\Windows\System\FYYoaiA.exe
  2⤵
  PID:4848
- C:\Windows\System\sWOehUS.exe
  C:\Windows\System\sWOehUS.exe
  2⤵
  PID:4036
- C:\Windows\System\KSwfMfu.exe
  C:\Windows\System\KSwfMfu.exe
  2⤵
  PID:4600
- C:\Windows\System\JukPdxq.exe
  C:\Windows\System\JukPdxq.exe
  2⤵
  PID:4572
- C:\Windows\System\hpPAuJy.exe
  C:\Windows\System\hpPAuJy.exe
  2⤵
  PID:7152
- C:\Windows\System\vsfTEqJ.exe
  C:\Windows\System\vsfTEqJ.exe
  2⤵
  PID:2220
- C:\Windows\System\LTKBAsD.exe
  C:\Windows\System\LTKBAsD.exe
  2⤵
  PID:4844
- C:\Windows\System\PJZZswo.exe
  C:\Windows\System\PJZZswo.exe
  2⤵
  PID:6164
- C:\Windows\System\rfTotuS.exe
  C:\Windows\System\rfTotuS.exe
  2⤵
  PID:4276
- C:\Windows\System\oAiUGMO.exe
  C:\Windows\System\oAiUGMO.exe
  2⤵
  PID:2028
- C:\Windows\System\ZDdUeqh.exe
  C:\Windows\System\ZDdUeqh.exe
  2⤵
  PID:6524
- C:\Windows\System\oJBPDef.exe
  C:\Windows\System\oJBPDef.exe
  2⤵
  PID:3464
- C:\Windows\System\iwckwRc.exe
  C:\Windows\System\iwckwRc.exe
  2⤵
  PID:6892
- C:\Windows\System\YifNerB.exe
  C:\Windows\System\YifNerB.exe
  2⤵
  PID:6984
- C:\Windows\System\KtIZLNF.exe
  C:\Windows\System\KtIZLNF.exe
  2⤵
  PID:864
- C:\Windows\System\eqQTwaZ.exe
  C:\Windows\System\eqQTwaZ.exe
  2⤵
  PID:3956
- C:\Windows\System\fZuhTjR.exe
  C:\Windows\System\fZuhTjR.exe
  2⤵
  PID:6636
- C:\Windows\System\iwLVzvj.exe
  C:\Windows\System\iwLVzvj.exe
  2⤵
  PID:1920
- C:\Windows\System\FXFKXfj.exe
  C:\Windows\System\FXFKXfj.exe
  2⤵
  PID:1504
- C:\Windows\System\LdPAsmL.exe
  C:\Windows\System\LdPAsmL.exe
  2⤵
  PID:640
- C:\Windows\System\ltPgBIz.exe
  C:\Windows\System\ltPgBIz.exe
  2⤵
  PID:1744
- C:\Windows\System\hsGgagG.exe
  C:\Windows\System\hsGgagG.exe
  2⤵
  PID:1460
- C:\Windows\System\MLdVTGL.exe
  C:\Windows\System\MLdVTGL.exe
  2⤵
  PID:2032
- C:\Windows\System\rmbUFxR.exe
  C:\Windows\System\rmbUFxR.exe
  2⤵
  PID:4836
- C:\Windows\System\xQLpoQj.exe
  C:\Windows\System\xQLpoQj.exe
  2⤵
  PID:812
- C:\Windows\System\RZZbGdl.exe
  C:\Windows\System\RZZbGdl.exe
  2⤵
  PID:5012
- C:\Windows\System\INqPtDT.exe
  C:\Windows\System\INqPtDT.exe
  2⤵
  PID:224
- C:\Windows\System\JKMGsUd.exe
  C:\Windows\System\JKMGsUd.exe
  2⤵
  PID:4088
- C:\Windows\System\QDcNEek.exe
  C:\Windows\System\QDcNEek.exe
  2⤵
  PID:2564
- C:\Windows\System\JCUtZwN.exe
  C:\Windows\System\JCUtZwN.exe
  2⤵
  PID:5004
- C:\Windows\System\YUkUqVk.exe
  C:\Windows\System\YUkUqVk.exe
  2⤵
  PID:1896
- C:\Windows\System\enmkmVF.exe
  C:\Windows\System\enmkmVF.exe
  2⤵
  PID:6832
- C:\Windows\System\wzeadLr.exe
  C:\Windows\System\wzeadLr.exe
  2⤵
  PID:4936
- C:\Windows\System\HlTFBUg.exe
  C:\Windows\System\HlTFBUg.exe
  2⤵
  PID:3472
- C:\Windows\System\RnQqQwO.exe
  C:\Windows\System\RnQqQwO.exe
  2⤵
  PID:3192
- C:\Windows\System\zNcKcBp.exe
  C:\Windows\System\zNcKcBp.exe
  2⤵
  PID:3976
- C:\Windows\System\WFfgmzA.exe
  C:\Windows\System\WFfgmzA.exe
  2⤵
  PID:264
- C:\Windows\System\bOeBzLl.exe
  C:\Windows\System\bOeBzLl.exe
  2⤵
  PID:6904
- C:\Windows\System\cIZjJAf.exe
  C:\Windows\System\cIZjJAf.exe
  2⤵
  PID:2412
- C:\Windows\System\MJXoQxS.exe
  C:\Windows\System\MJXoQxS.exe
  2⤵
  PID:5156
- C:\Windows\System\KSaIoOy.exe
  C:\Windows\System\KSaIoOy.exe
  2⤵
  PID:5288
- C:\Windows\System\knuidHK.exe
  C:\Windows\System\knuidHK.exe
  2⤵
  PID:396
- C:\Windows\System\OBXIJbL.exe
  C:\Windows\System\OBXIJbL.exe
  2⤵
  PID:372
- C:\Windows\System\YYFJIdf.exe
  C:\Windows\System\YYFJIdf.exe
  2⤵
  PID:1232
- C:\Windows\System\QkWNvkk.exe
  C:\Windows\System\QkWNvkk.exe
  2⤵
  PID:760
- C:\Windows\System\iUQpOgw.exe
  C:\Windows\System\iUQpOgw.exe
  2⤵
  PID:7012
- C:\Windows\System\xvqyfbz.exe
  C:\Windows\System\xvqyfbz.exe
  2⤵
  PID:4576
- C:\Windows\System\AfnckVw.exe
  C:\Windows\System\AfnckVw.exe
  2⤵
  PID:5748
- C:\Windows\System\yqxSbAS.exe
  C:\Windows\System\yqxSbAS.exe
  2⤵
  PID:5800
- C:\Windows\System\AAcvCLD.exe
  C:\Windows\System\AAcvCLD.exe
  2⤵
  PID:5940
- C:\Windows\System\BxCjAcm.exe
  C:\Windows\System\BxCjAcm.exe
  2⤵
  PID:5964
- C:\Windows\System\yfsyxLz.exe
  C:\Windows\System\yfsyxLz.exe
  2⤵
  PID:4948
- C:\Windows\System\wTiAUnn.exe
  C:\Windows\System\wTiAUnn.exe
  2⤵
  PID:6580
- C:\Windows\System\BDMpoWL.exe
  C:\Windows\System\BDMpoWL.exe
  2⤵
  PID:5128
- C:\Windows\System\VFeMffb.exe
  C:\Windows\System\VFeMffb.exe
  2⤵
  PID:1180
- C:\Windows\System\oPzBODs.exe
  C:\Windows\System\oPzBODs.exe
  2⤵
  PID:5240
- C:\Windows\System\MWmIorp.exe
  C:\Windows\System\MWmIorp.exe
  2⤵
  PID:2212
- C:\Windows\System\aBQUTEO.exe
  C:\Windows\System\aBQUTEO.exe
  2⤵
  PID:5684
- C:\Windows\System\FlDBDRu.exe
  C:\Windows\System\FlDBDRu.exe
  2⤵
  PID:976
- C:\Windows\System\KXDXMcI.exe
  C:\Windows\System\KXDXMcI.exe
  2⤵
  PID:1044
- C:\Windows\System\NQiaXRf.exe
  C:\Windows\System\NQiaXRf.exe
  2⤵
  PID:5916
- C:\Windows\System\rdcvtpD.exe
  C:\Windows\System\rdcvtpD.exe
  2⤵
  PID:5572
- C:\Windows\System\fpoAWWP.exe
  C:\Windows\System\fpoAWWP.exe
  2⤵
  PID:7180
- C:\Windows\System\UfnMiPP.exe
  C:\Windows\System\UfnMiPP.exe
  2⤵
  PID:7428
- C:\Windows\System\cYVkKAB.exe
  C:\Windows\System\cYVkKAB.exe
  2⤵
  PID:7480
- C:\Windows\System\hNODoEg.exe
  C:\Windows\System\hNODoEg.exe
  2⤵
  PID:7568
- C:\Windows\System\jbSaYbk.exe
  C:\Windows\System\jbSaYbk.exe
  2⤵
  PID:7704
- C:\Windows\System\uIAPYPr.exe
  C:\Windows\System\uIAPYPr.exe
  2⤵
  PID:7768
- C:\Windows\System\bHpHfSa.exe
  C:\Windows\System\bHpHfSa.exe
  2⤵
  PID:7860
- C:\Windows\System\EAcSarh.exe
  C:\Windows\System\EAcSarh.exe
  2⤵
  PID:7932
- C:\Windows\System\eUnTebo.exe
  C:\Windows\System\eUnTebo.exe
  2⤵
  PID:7996
- C:\Windows\System\hIgVhbh.exe
  C:\Windows\System\hIgVhbh.exe
  2⤵
  PID:8092
- C:\Windows\System\NiFeZpW.exe
  C:\Windows\System\NiFeZpW.exe
  2⤵
  PID:8184
- C:\Windows\System\wJpcUeZ.exe
  C:\Windows\System\wJpcUeZ.exe
  2⤵
  PID:6404
- C:\Windows\System\nDfSgAc.exe
  C:\Windows\System\nDfSgAc.exe
  2⤵
  PID:6012
- C:\Windows\System\nuMxUet.exe
  C:\Windows\System\nuMxUet.exe
  2⤵
  PID:3828
- C:\Windows\System\AMVigOB.exe
  C:\Windows\System\AMVigOB.exe
  2⤵
  PID:5956
- C:\Windows\System\xIMVHVs.exe
  C:\Windows\System\xIMVHVs.exe
  2⤵
  PID:7356
- C:\Windows\System\ZUtGhsv.exe
  C:\Windows\System\ZUtGhsv.exe
  2⤵
  PID:7176
- C:\Windows\System\VZQpjBR.exe
  C:\Windows\System\VZQpjBR.exe
  2⤵
  PID:3168
- C:\Windows\System\xROQMIe.exe
  C:\Windows\System\xROQMIe.exe
  2⤵
  PID:6232
- C:\Windows\System\uqVTSUX.exe
  C:\Windows\System\uqVTSUX.exe
  2⤵
  PID:6520
- C:\Windows\System\yYHPnVd.exe
  C:\Windows\System\yYHPnVd.exe
  2⤵
  PID:6612
- C:\Windows\System\rmJRbJe.exe
  C:\Windows\System\rmJRbJe.exe
  2⤵
  PID:6788
- C:\Windows\System\dkuSxsY.exe
  C:\Windows\System\dkuSxsY.exe
  2⤵
  PID:5384
- C:\Windows\System\TUvjBtT.exe
  C:\Windows\System\TUvjBtT.exe
  2⤵
  PID:5376
- C:\Windows\System\VQoayLd.exe
  C:\Windows\System\VQoayLd.exe
  2⤵
  PID:2196
- C:\Windows\System\MOsUnpK.exe
  C:\Windows\System\MOsUnpK.exe
  2⤵
  PID:7440
- C:\Windows\System\lKncfVJ.exe
  C:\Windows\System\lKncfVJ.exe
  2⤵
  PID:7460
- C:\Windows\System\xFoUxsg.exe
  C:\Windows\System\xFoUxsg.exe
  2⤵
  PID:7476
- C:\Windows\System\fiUootH.exe
  C:\Windows\System\fiUootH.exe
  2⤵
  PID:7492
- C:\Windows\System\VtZAQpd.exe
  C:\Windows\System\VtZAQpd.exe
  2⤵
  PID:7548
- C:\Windows\System\zfhdvuG.exe
  C:\Windows\System\zfhdvuG.exe
  2⤵
  PID:7644
- C:\Windows\System\XeXucjO.exe
  C:\Windows\System\XeXucjO.exe
  2⤵
  PID:7680
- C:\Windows\System\NcrgaMZ.exe
  C:\Windows\System\NcrgaMZ.exe
  2⤵
  PID:7224
- C:\Windows\System\HUPqIPD.exe
  C:\Windows\System\HUPqIPD.exe
  2⤵
  PID:7696
- C:\Windows\System\MyEatwN.exe
  C:\Windows\System\MyEatwN.exe
  2⤵
  PID:7720
- C:\Windows\System\oieYWnO.exe
  C:\Windows\System\oieYWnO.exe
  2⤵
  PID:6140
- C:\Windows\System\rOnUjnJ.exe
  C:\Windows\System\rOnUjnJ.exe
  2⤵
  PID:3996
- C:\Windows\System\gXjXJIN.exe
  C:\Windows\System\gXjXJIN.exe
  2⤵
  PID:7760
- C:\Windows\System\LHeXnUC.exe
  C:\Windows\System\LHeXnUC.exe
  2⤵
  PID:1000
- C:\Windows\System\VKgRtBZ.exe
  C:\Windows\System\VKgRtBZ.exe
  2⤵
  PID:7844
- C:\Windows\System\FXOIouc.exe
  C:\Windows\System\FXOIouc.exe
  2⤵
  PID:7900
- C:\Windows\System\LRNGgPw.exe
  C:\Windows\System\LRNGgPw.exe
  2⤵
  PID:7888
- C:\Windows\System\oSefNjx.exe
  C:\Windows\System\oSefNjx.exe
  2⤵
  PID:1228
- C:\Windows\System\fkeOfFL.exe
  C:\Windows\System\fkeOfFL.exe
  2⤵
  PID:8008
- C:\Windows\System\hFXSAvG.exe
  C:\Windows\System\hFXSAvG.exe
  2⤵
  PID:5044
- C:\Windows\System\cMNqwFz.exe
  C:\Windows\System\cMNqwFz.exe
  2⤵
  PID:8072
- C:\Windows\System\WiuRlYB.exe
  C:\Windows\System\WiuRlYB.exe
  2⤵
  PID:8100
- C:\Windows\System\xtxFVml.exe
  C:\Windows\System\xtxFVml.exe
  2⤵
  PID:8136
- C:\Windows\System\GZskMkk.exe
  C:\Windows\System\GZskMkk.exe
  2⤵
  PID:2728
- C:\Windows\System\KyXuflm.exe
  C:\Windows\System\KyXuflm.exe
  2⤵
  PID:5704
- C:\Windows\System\PsWwPwc.exe
  C:\Windows\System\PsWwPwc.exe
  2⤵
  PID:5356
- C:\Windows\System\EiOvTaI.exe
  C:\Windows\System\EiOvTaI.exe
  2⤵
  PID:2376
- C:\Windows\System\wNAzseB.exe
  C:\Windows\System\wNAzseB.exe
  2⤵
  PID:6032
- C:\Windows\System\JAwhscK.exe
  C:\Windows\System\JAwhscK.exe
  2⤵
  PID:5816
- C:\Windows\System\LqHqMkD.exe
  C:\Windows\System\LqHqMkD.exe
  2⤵
  PID:5652
- C:\Windows\System\AovdcAw.exe
  C:\Windows\System\AovdcAw.exe
  2⤵
  PID:5608
- C:\Windows\System\HojbZfZ.exe
  C:\Windows\System\HojbZfZ.exe
  2⤵
  PID:7368
- C:\Windows\System\ihsTCNp.exe
  C:\Windows\System\ihsTCNp.exe
  2⤵
  PID:7376
- C:\Windows\System\RYBhBZf.exe
  C:\Windows\System\RYBhBZf.exe
  2⤵
  PID:4328
- C:\Windows\System\dxwaibL.exe
  C:\Windows\System\dxwaibL.exe
  2⤵
  PID:4308
- C:\Windows\System\QWnvLBB.exe
  C:\Windows\System\QWnvLBB.exe
  2⤵
  PID:1936
- C:\Windows\System\twoEGtW.exe
  C:\Windows\System\twoEGtW.exe
  2⤵
  PID:7780
- C:\Windows\System\ARjczrB.exe
  C:\Windows\System\ARjczrB.exe
  2⤵
  PID:6252
- C:\Windows\System\jHHznbd.exe
  C:\Windows\System\jHHznbd.exe
  2⤵
  PID:6436
- C:\Windows\System\vVkhuZK.exe
  C:\Windows\System\vVkhuZK.exe
  2⤵
  PID:2904
- C:\Windows\System\EQJycSQ.exe
  C:\Windows\System\EQJycSQ.exe
  2⤵
  PID:6688
- C:\Windows\System\yBfvVYd.exe
  C:\Windows\System\yBfvVYd.exe
  2⤵
  PID:6900
- C:\Windows\System\ikwZima.exe
  C:\Windows\System\ikwZima.exe
  2⤵
  PID:6100
- C:\Windows\System\bduQxad.exe
  C:\Windows\System\bduQxad.exe
  2⤵
  PID:7416
- C:\Windows\System\ubtZhoW.exe
  C:\Windows\System\ubtZhoW.exe
  2⤵
  PID:7524
- C:\Windows\System\KpxCjHS.exe
  C:\Windows\System\KpxCjHS.exe
  2⤵
  PID:7504
- C:\Windows\System\qgxrIKQ.exe
  C:\Windows\System\qgxrIKQ.exe
  2⤵
  PID:7652
- C:\Windows\System\TsMOjnV.exe
  C:\Windows\System\TsMOjnV.exe
  2⤵
  PID:6736
- C:\Windows\System\llCBbgb.exe
  C:\Windows\System\llCBbgb.exe
  2⤵
  PID:1400
- C:\Windows\System\yKPuyzk.exe
  C:\Windows\System\yKPuyzk.exe
  2⤵
  PID:7784
- C:\Windows\System\tRqgeMR.exe
  C:\Windows\System\tRqgeMR.exe
  2⤵
  PID:6208
- C:\Windows\System\GQCNwRH.exe
  C:\Windows\System\GQCNwRH.exe
  2⤵
  PID:7880
- C:\Windows\System\BcYJbdm.exe
  C:\Windows\System\BcYJbdm.exe
  2⤵
  PID:7972
- C:\Windows\System\qUsvppr.exe
  C:\Windows\System\qUsvppr.exe
  2⤵
  PID:8024
- C:\Windows\System\FvuwBne.exe
  C:\Windows\System\FvuwBne.exe
  2⤵
  PID:8112
- C:\Windows\System\NackeRC.exe
  C:\Windows\System\NackeRC.exe
  2⤵
  PID:6748
- C:\Windows\System\mkOomSa.exe
  C:\Windows\System\mkOomSa.exe
  2⤵
  PID:5220
- C:\Windows\System\DbDxmfp.exe
  C:\Windows\System\DbDxmfp.exe
  2⤵
  PID:5688
- C:\Windows\System\DqCoMdh.exe
  C:\Windows\System\DqCoMdh.exe
  2⤵
  PID:5488
- C:\Windows\System\aGdvhPV.exe
  C:\Windows\System\aGdvhPV.exe
  2⤵
  PID:7212
- C:\Windows\System\CNdcsMg.exe
  C:\Windows\System\CNdcsMg.exe
  2⤵
  PID:6784
- C:\Windows\System\HTIYZBD.exe
  C:\Windows\System\HTIYZBD.exe
  2⤵
  PID:6552
- C:\Windows\System\Cikklce.exe
  C:\Windows\System\Cikklce.exe
  2⤵
  PID:7400
- C:\Windows\System\ndtHSOw.exe
  C:\Windows\System\ndtHSOw.exe
  2⤵
  PID:7452
- C:\Windows\System\DJYdsFj.exe
  C:\Windows\System\DJYdsFj.exe
  2⤵
  PID:6952
- C:\Windows\System\utQCwZr.exe
  C:\Windows\System\utQCwZr.exe
  2⤵
  PID:2360
- C:\Windows\System\fMVRwQg.exe
  C:\Windows\System\fMVRwQg.exe
  2⤵
  PID:3368
- C:\Windows\System\ugjDZuq.exe
  C:\Windows\System\ugjDZuq.exe
  2⤵
  PID:7096
- C:\Windows\System\VJbIGoo.exe
  C:\Windows\System\VJbIGoo.exe
  2⤵
  PID:1412
- C:\Windows\System\DKNsdvd.exe
  C:\Windows\System\DKNsdvd.exe
  2⤵
  PID:7468
- C:\Windows\System\WgqZZdS.exe
  C:\Windows\System\WgqZZdS.exe
  2⤵
  PID:2060
- C:\Windows\System\YnfxSoa.exe
  C:\Windows\System\YnfxSoa.exe
  2⤵
  PID:1444
- C:\Windows\System\qrngeXi.exe
  C:\Windows\System\qrngeXi.exe
  2⤵
  PID:5996
- C:\Windows\System\cmuniAq.exe
  C:\Windows\System\cmuniAq.exe
  2⤵
  PID:6276
- C:\Windows\System\XnwgOjw.exe
  C:\Windows\System\XnwgOjw.exe
  2⤵
  PID:2888
- C:\Windows\System\WbLljiv.exe
  C:\Windows\System\WbLljiv.exe
  2⤵
  PID:6500
- C:\Windows\System\YLClTTf.exe
  C:\Windows\System\YLClTTf.exe
  2⤵
  PID:6656
- C:\Windows\System\FhbCzjZ.exe
  C:\Windows\System\FhbCzjZ.exe
  2⤵
  PID:6764
- C:\Windows\System\uPgjxrz.exe
  C:\Windows\System\uPgjxrz.exe
  2⤵
  PID:8048
- C:\Windows\System\ydVlLAO.exe
  C:\Windows\System\ydVlLAO.exe
  2⤵
  PID:5536
- C:\Windows\System\bAqlXOO.exe
  C:\Windows\System\bAqlXOO.exe
  2⤵
  PID:7332
- C:\Windows\System\JyDMArj.exe
  C:\Windows\System\JyDMArj.exe
  2⤵
  PID:7560
- C:\Windows\System\ngFOlsl.exe
  C:\Windows\System\ngFOlsl.exe
  2⤵
  PID:2836
- C:\Windows\System\bbMyIuX.exe
  C:\Windows\System\bbMyIuX.exe
  2⤵
  PID:6356
- C:\Windows\System\gkGJOwJ.exe
  C:\Windows\System\gkGJOwJ.exe
  2⤵
  PID:7132
- C:\Windows\System\ZTQRLpj.exe
  C:\Windows\System\ZTQRLpj.exe
  2⤵
  PID:5256
- C:\Windows\System\LGobLjM.exe
  C:\Windows\System\LGobLjM.exe
  2⤵
  PID:3332
- C:\Windows\System\VDhlNNl.exe
  C:\Windows\System\VDhlNNl.exe
  2⤵
  PID:8200
- C:\Windows\System\xUrRpmJ.exe
  C:\Windows\System\xUrRpmJ.exe
  2⤵
  PID:8240
- C:\Windows\System\mVPwNDx.exe
  C:\Windows\System\mVPwNDx.exe
  2⤵
  PID:8284
- C:\Windows\System\qceSzWW.exe
  C:\Windows\System\qceSzWW.exe
  2⤵
  PID:8308
- C:\Windows\System\yNTmYom.exe
  C:\Windows\System\yNTmYom.exe
  2⤵
  PID:8336
- C:\Windows\System\gAuxCtU.exe
  C:\Windows\System\gAuxCtU.exe
  2⤵
  PID:8364
- C:\Windows\System\QoqQrpg.exe
  C:\Windows\System\QoqQrpg.exe
  2⤵
  PID:8404
- C:\Windows\System\OiCPVBa.exe
  C:\Windows\System\OiCPVBa.exe
  2⤵
  PID:8428
- C:\Windows\System\muAuVsw.exe
  C:\Windows\System\muAuVsw.exe
  2⤵
  PID:8476
- C:\Windows\System\OKvtBIL.exe
  C:\Windows\System\OKvtBIL.exe
  2⤵
  PID:8512
- C:\Windows\System\hgErzrI.exe
  C:\Windows\System\hgErzrI.exe
  2⤵
  PID:8532
- C:\Windows\System\SjSDRTZ.exe
  C:\Windows\System\SjSDRTZ.exe
  2⤵
  PID:8572
- C:\Windows\System\TFpPNDU.exe
  C:\Windows\System\TFpPNDU.exe
  2⤵
  PID:8604
- C:\Windows\System\CjJAPgG.exe
  C:\Windows\System\CjJAPgG.exe
  2⤵
  PID:8640
- C:\Windows\System\BOyuTXA.exe
  C:\Windows\System\BOyuTXA.exe
  2⤵
  PID:8664
- C:\Windows\System\rHXFaZK.exe
  C:\Windows\System\rHXFaZK.exe
  2⤵
  PID:8700
- C:\Windows\System\ofKVJqV.exe
  C:\Windows\System\ofKVJqV.exe
  2⤵
  PID:8728
- C:\Windows\System\RjaPeHZ.exe
  C:\Windows\System\RjaPeHZ.exe
  2⤵
  PID:8760
- C:\Windows\System\LThTYkH.exe
  C:\Windows\System\LThTYkH.exe
  2⤵
  PID:8796
- C:\Windows\System\qyNaUMd.exe
  C:\Windows\System\qyNaUMd.exe
  2⤵
  PID:8832
- C:\Windows\System\voqLpkk.exe
  C:\Windows\System\voqLpkk.exe
  2⤵
  PID:8864
- C:\Windows\System\qzfFssM.exe
  C:\Windows\System\qzfFssM.exe
  2⤵
  PID:8900
- C:\Windows\System\PmIpjOz.exe
  C:\Windows\System\PmIpjOz.exe
  2⤵
  PID:8928
- C:\Windows\System\rmyaZhS.exe
  C:\Windows\System\rmyaZhS.exe
  2⤵
  PID:8972
- C:\Windows\System\mcyVMYs.exe
  C:\Windows\System\mcyVMYs.exe
  2⤵
  PID:9012
- C:\Windows\System\SWGCMty.exe
  C:\Windows\System\SWGCMty.exe
  2⤵
  PID:9040
- C:\Windows\System\TGCIqtu.exe
  C:\Windows\System\TGCIqtu.exe
  2⤵
  PID:9068
- C:\Windows\System\kBKFkch.exe
  C:\Windows\System\kBKFkch.exe
  2⤵
  PID:9088
- C:\Windows\System\TKVKxBD.exe
  C:\Windows\System\TKVKxBD.exe
  2⤵
  PID:9128
- C:\Windows\System\zwxTQgS.exe
  C:\Windows\System\zwxTQgS.exe
  2⤵
  PID:9148
- C:\Windows\System\riultxB.exe
  C:\Windows\System\riultxB.exe
  2⤵
  PID:9184
- C:\Windows\System\WfZphzL.exe
  C:\Windows\System\WfZphzL.exe
  2⤵
  PID:9212
- C:\Windows\System\jXSZSfN.exe
  C:\Windows\System\jXSZSfN.exe
  2⤵
  PID:6316
- C:\Windows\System\sCuSgnQ.exe
  C:\Windows\System\sCuSgnQ.exe
  2⤵
  PID:8296
- C:\Windows\System\pCNsHdj.exe
  C:\Windows\System\pCNsHdj.exe
  2⤵
  PID:8352
- C:\Windows\System\WCmmegf.exe
  C:\Windows\System\WCmmegf.exe
  2⤵
  PID:8416
- C:\Windows\System\aWYhpIE.exe
  C:\Windows\System\aWYhpIE.exe
  2⤵
  PID:4860
- C:\Windows\System\NcsWOaR.exe
  C:\Windows\System\NcsWOaR.exe
  2⤵
  PID:8492
- C:\Windows\System\qtBCkLW.exe
  C:\Windows\System\qtBCkLW.exe
  2⤵
  PID:8544
- C:\Windows\System\LNeKLTI.exe
  C:\Windows\System\LNeKLTI.exe
  2⤵
  PID:964
- C:\Windows\System\UQAEIJz.exe
  C:\Windows\System\UQAEIJz.exe
  2⤵
  PID:8648
- C:\Windows\System\oUvVBTd.exe
  C:\Windows\System\oUvVBTd.exe
  2⤵
  PID:8720
- C:\Windows\System\RpFxzJb.exe
  C:\Windows\System\RpFxzJb.exe
  2⤵
  PID:8804
- C:\Windows\System\uiJeHsU.exe
  C:\Windows\System\uiJeHsU.exe
  2⤵
  PID:8620
- C:\Windows\System\lMnsbGT.exe
  C:\Windows\System\lMnsbGT.exe
  2⤵
  PID:8956
- C:\Windows\System\FLlvBId.exe
  C:\Windows\System\FLlvBId.exe
  2⤵
  PID:8992
- C:\Windows\System\gpTAHJg.exe
  C:\Windows\System\gpTAHJg.exe
  2⤵
  PID:9108
- C:\Windows\System\wixbXrs.exe
  C:\Windows\System\wixbXrs.exe
  2⤵
  PID:9168
- C:\Windows\System\ERfadtY.exe
  C:\Windows\System\ERfadtY.exe
  2⤵
  PID:8292
- C:\Windows\System\eqttLwy.exe
  C:\Windows\System\eqttLwy.exe
  2⤵
  PID:6568
- C:\Windows\System\MXkHpTJ.exe
  C:\Windows\System\MXkHpTJ.exe
  2⤵
  PID:8612
- C:\Windows\System\vaADZQj.exe
  C:\Windows\System\vaADZQj.exe
  2⤵
  PID:8740
- C:\Windows\System\ARfXtDU.exe
  C:\Windows\System\ARfXtDU.exe
  2⤵
  PID:8920
- C:\Windows\System\AkaaSQR.exe
  C:\Windows\System\AkaaSQR.exe
  2⤵
  PID:9136
- C:\Windows\System\txrFTys.exe
  C:\Windows\System\txrFTys.exe
  2⤵
  PID:6640
- C:\Windows\System\bFAAOvY.exe
  C:\Windows\System\bFAAOvY.exe
  2⤵
  PID:8676
- C:\Windows\System\GyTOCwZ.exe
  C:\Windows\System\GyTOCwZ.exe
  2⤵
  PID:9048
- C:\Windows\System\lHVfmJp.exe
  C:\Windows\System\lHVfmJp.exe
  2⤵
  PID:8672
- C:\Windows\System\lrZDYCw.exe
  C:\Windows\System\lrZDYCw.exe
  2⤵
  PID:9236
- C:\Windows\System\FXmnyIs.exe
  C:\Windows\System\FXmnyIs.exe
  2⤵
  PID:9308
- C:\Windows\System\wFuNuPT.exe
  C:\Windows\System\wFuNuPT.exe
  2⤵
  PID:9336
- C:\Windows\System\UKLOBlm.exe
  C:\Windows\System\UKLOBlm.exe
  2⤵
  PID:9372
- C:\Windows\System\enihtkd.exe
  C:\Windows\System\enihtkd.exe
  2⤵
  PID:9396
- C:\Windows\System\pxerJfi.exe
  C:\Windows\System\pxerJfi.exe
  2⤵
  PID:9420
- C:\Windows\System\OwcHZIv.exe
  C:\Windows\System\OwcHZIv.exe
  2⤵
  PID:9468
- C:\Windows\System\CWlcTRR.exe
  C:\Windows\System\CWlcTRR.exe
  2⤵
  PID:9496
- C:\Windows\System\KaxOwpk.exe
  C:\Windows\System\KaxOwpk.exe
  2⤵
  PID:9524
- C:\Windows\System\GCBSqMU.exe
  C:\Windows\System\GCBSqMU.exe
  2⤵
  PID:9540
- C:\Windows\System\IvanvAH.exe
  C:\Windows\System\IvanvAH.exe
  2⤵
  PID:9580
- C:\Windows\System\bIcTlIA.exe
  C:\Windows\System\bIcTlIA.exe
  2⤵
  PID:9608
- C:\Windows\System\mFITyol.exe
  C:\Windows\System\mFITyol.exe
  2⤵
  PID:9632
- C:\Windows\System\TmnDAyE.exe
  C:\Windows\System\TmnDAyE.exe
  2⤵
  PID:9664
- C:\Windows\System\TLuhemk.exe
  C:\Windows\System\TLuhemk.exe
  2⤵
  PID:9688
- C:\Windows\System\gmZYIcB.exe
  C:\Windows\System\gmZYIcB.exe
  2⤵
  PID:9720
- C:\Windows\System\UsbkmDX.exe
  C:\Windows\System\UsbkmDX.exe
  2⤵
  PID:9748
- C:\Windows\System\YNTwbAE.exe
  C:\Windows\System\YNTwbAE.exe
  2⤵
  PID:9780
- C:\Windows\System\pNWFQdk.exe
  C:\Windows\System\pNWFQdk.exe
  2⤵
  PID:9812
- C:\Windows\System\orIFZfQ.exe
  C:\Windows\System\orIFZfQ.exe
  2⤵
  PID:9832
- C:\Windows\System\IqYUjwM.exe
  C:\Windows\System\IqYUjwM.exe
  2⤵
  PID:9860
- C:\Windows\System\zQXenSq.exe
  C:\Windows\System\zQXenSq.exe
  2⤵
  PID:9900
- C:\Windows\System\MILiNgd.exe
  C:\Windows\System\MILiNgd.exe
  2⤵
  PID:9932
- C:\Windows\System\hBhRTcj.exe
  C:\Windows\System\hBhRTcj.exe
  2⤵
  PID:9964
- C:\Windows\System\FHgOefg.exe
  C:\Windows\System\FHgOefg.exe
  2⤵
  PID:9996
- C:\Windows\System\vTpcSIE.exe
  C:\Windows\System\vTpcSIE.exe
  2⤵
  PID:10024
- C:\Windows\System\LMSVRlu.exe
  C:\Windows\System\LMSVRlu.exe
  2⤵
  PID:10048
- C:\Windows\System\OlNfNXJ.exe
  C:\Windows\System\OlNfNXJ.exe
  2⤵
  PID:10072
- C:\Windows\System\uuxJPSs.exe
  C:\Windows\System\uuxJPSs.exe
  2⤵
  PID:10112
- C:\Windows\System\zAFkjLW.exe
  C:\Windows\System\zAFkjLW.exe
  2⤵
  PID:10140
- C:\Windows\System\yfcoEiO.exe
  C:\Windows\System\yfcoEiO.exe
  2⤵
  PID:10156
- C:\Windows\System\xCEmZDB.exe
  C:\Windows\System\xCEmZDB.exe
  2⤵
  PID:10188
- C:\Windows\System\sUKgfpi.exe
  C:\Windows\System\sUKgfpi.exe
  2⤵
  PID:10224
- C:\Windows\System\RzFZlUJ.exe
  C:\Windows\System\RzFZlUJ.exe
  2⤵
  PID:8916
- C:\Windows\System\tlByHAj.exe
  C:\Windows\System\tlByHAj.exe
  2⤵
  PID:9304
- C:\Windows\System\UwPXGNw.exe
  C:\Windows\System\UwPXGNw.exe
  2⤵
  PID:9380
- C:\Windows\System\JgTPgmo.exe
  C:\Windows\System\JgTPgmo.exe
  2⤵
  PID:9428
- C:\Windows\System\JEgMnHu.exe
  C:\Windows\System\JEgMnHu.exe
  2⤵
  PID:9480
- C:\Windows\System\HIbXKGB.exe
  C:\Windows\System\HIbXKGB.exe
  2⤵
  PID:9532
- C:\Windows\System\IjVlGOe.exe
  C:\Windows\System\IjVlGOe.exe
  2⤵
  PID:9596
- C:\Windows\System\SlrFdHr.exe
  C:\Windows\System\SlrFdHr.exe
  2⤵
  PID:3788
- C:\Windows\System\PYEXAgl.exe
  C:\Windows\System\PYEXAgl.exe
  2⤵
  PID:9696
- C:\Windows\System\eCspKMK.exe
  C:\Windows\System\eCspKMK.exe
  2⤵
  PID:9760
- C:\Windows\System\UlZZWLg.exe
  C:\Windows\System\UlZZWLg.exe
  2⤵
  PID:7196
- C:\Windows\System\HlwdefZ.exe
  C:\Windows\System\HlwdefZ.exe
  2⤵
  PID:9840
- C:\Windows\System\hJgrHNl.exe
  C:\Windows\System\hJgrHNl.exe
  2⤵
  PID:9884
- C:\Windows\System\pCilDxD.exe
  C:\Windows\System\pCilDxD.exe
  2⤵
  PID:9992
- C:\Windows\System\eCEWqVf.exe
  C:\Windows\System\eCEWqVf.exe
  2⤵
  PID:10084
- C:\Windows\System\pyDXcfB.exe
  C:\Windows\System\pyDXcfB.exe
  2⤵
  PID:10148
- C:\Windows\System\Pcjwpud.exe
  C:\Windows\System\Pcjwpud.exe
  2⤵
  PID:6940
- C:\Windows\System\vsHDAdD.exe
  C:\Windows\System\vsHDAdD.exe
  2⤵
  PID:3616
- C:\Windows\System\UBvvGGF.exe
  C:\Windows\System\UBvvGGF.exe
  2⤵
  PID:9408
- C:\Windows\System\wiVUscs.exe
  C:\Windows\System\wiVUscs.exe
  2⤵
  PID:4728
- C:\Windows\System\iVGmzHp.exe
  C:\Windows\System\iVGmzHp.exe
  2⤵
  PID:9520
- C:\Windows\System\DytvoHe.exe
  C:\Windows\System\DytvoHe.exe
  2⤵
  PID:9588
- C:\Windows\System\VcmPouK.exe
  C:\Windows\System\VcmPouK.exe
  2⤵
  PID:6708
- C:\Windows\System\npAkJib.exe
  C:\Windows\System\npAkJib.exe
  2⤵
  PID:5432
- C:\Windows\System\xtHTpvb.exe
  C:\Windows\System\xtHTpvb.exe
  2⤵
  PID:3692
- C:\Windows\System\JcYkRYn.exe
  C:\Windows\System\JcYkRYn.exe
  2⤵
  PID:2380
- C:\Windows\System\sSjdcJN.exe
  C:\Windows\System\sSjdcJN.exe
  2⤵
  PID:4852
- C:\Windows\System\mlGIjbo.exe
  C:\Windows\System\mlGIjbo.exe
  2⤵
  PID:9944
- C:\Windows\System\vgVGZfQ.exe
  C:\Windows\System\vgVGZfQ.exe
  2⤵
  PID:10108
- C:\Windows\System\jqYncdU.exe
  C:\Windows\System\jqYncdU.exe
  2⤵
  PID:8456
- C:\Windows\System\NgTmoed.exe
  C:\Windows\System\NgTmoed.exe
  2⤵
  PID:4624
- C:\Windows\System\Oubsigf.exe
  C:\Windows\System\Oubsigf.exe
  2⤵
  PID:9552
- C:\Windows\System\AZCXwNP.exe
  C:\Windows\System\AZCXwNP.exe
  2⤵
  PID:4136
- C:\Windows\System\JtMSdYa.exe
  C:\Windows\System\JtMSdYa.exe
  2⤵
  PID:3964
- C:\Windows\System\rBphPKd.exe
  C:\Windows\System\rBphPKd.exe
  2⤵
  PID:9740
- C:\Windows\System\FGRtebc.exe
  C:\Windows\System\FGRtebc.exe
  2⤵
  PID:9948
- C:\Windows\System\jwOdCLf.exe
  C:\Windows\System\jwOdCLf.exe
  2⤵
  PID:10204
- C:\Windows\System\NIOtNLh.exe
  C:\Windows\System\NIOtNLh.exe
  2⤵
  PID:5048
- C:\Windows\System\JyJLZQW.exe
  C:\Windows\System\JyJLZQW.exe
  2⤵
  PID:3556
- C:\Windows\System\dwfaFLe.exe
  C:\Windows\System\dwfaFLe.exe
  2⤵
  PID:2348
- C:\Windows\System\UOrGyib.exe
  C:\Windows\System\UOrGyib.exe
  2⤵
  PID:6684
- C:\Windows\System\BXCjjUh.exe
  C:\Windows\System\BXCjjUh.exe
  2⤵
  PID:7872
- C:\Windows\System\ylyQVnW.exe
  C:\Windows\System\ylyQVnW.exe
  2⤵
  PID:8060
- C:\Windows\System\KNgRdcD.exe
  C:\Windows\System\KNgRdcD.exe
  2⤵
  PID:5224
- C:\Windows\System\hWDtQxs.exe
  C:\Windows\System\hWDtQxs.exe
  2⤵
  PID:2740
- C:\Windows\System\eDYgutg.exe
  C:\Windows\System\eDYgutg.exe
  2⤵
  PID:4288
- C:\Windows\System\PGtjWKk.exe
  C:\Windows\System\PGtjWKk.exe
  2⤵
  PID:5108
- C:\Windows\System\DqEDPXZ.exe
  C:\Windows\System\DqEDPXZ.exe
  2⤵
  PID:6924
- C:\Windows\System\sKzGBfj.exe
  C:\Windows\System\sKzGBfj.exe
  2⤵
  PID:8180
- C:\Windows\System\HGxFlBc.exe
  C:\Windows\System\HGxFlBc.exe
  2⤵
  PID:6336
- C:\Windows\System\lBHBwge.exe
  C:\Windows\System\lBHBwge.exe
  2⤵
  PID:2748
- C:\Windows\System\IdJOWhc.exe
  C:\Windows\System\IdJOWhc.exe
  2⤵
  PID:3200
- C:\Windows\System\TWPYyKc.exe
  C:\Windows\System\TWPYyKc.exe
  2⤵
  PID:1184
- C:\Windows\System\hlGHMLy.exe
  C:\Windows\System\hlGHMLy.exe
  2⤵
  PID:6816
- C:\Windows\System\SCMfHPu.exe
  C:\Windows\System\SCMfHPu.exe
  2⤵
  PID:5828
- C:\Windows\System\KULPtpH.exe
  C:\Windows\System\KULPtpH.exe
  2⤵
  PID:4868
- C:\Windows\System\OrfNTNc.exe
  C:\Windows\System\OrfNTNc.exe
  2⤵
  PID:10256
- C:\Windows\System\GKcccJK.exe
  C:\Windows\System\GKcccJK.exe
  2⤵
  PID:10280
- C:\Windows\System\tfsHHyU.exe
  C:\Windows\System\tfsHHyU.exe
  2⤵
  PID:10324
- C:\Windows\System\KFRorvK.exe
  C:\Windows\System\KFRorvK.exe
  2⤵
  PID:10340
- C:\Windows\System\rYUfvJZ.exe
  C:\Windows\System\rYUfvJZ.exe
  2⤵
  PID:10368
- C:\Windows\System\ocArQtO.exe
  C:\Windows\System\ocArQtO.exe
  2⤵
  PID:10408
- C:\Windows\System\JBJPtjx.exe
  C:\Windows\System\JBJPtjx.exe
  2⤵
  PID:10436
- C:\Windows\System\cffOdtg.exe
  C:\Windows\System\cffOdtg.exe
  2⤵
  PID:10464
- C:\Windows\System\Hhuqmif.exe
  C:\Windows\System\Hhuqmif.exe
  2⤵
  PID:10496
- C:\Windows\System\WtecMzZ.exe
  C:\Windows\System\WtecMzZ.exe
  2⤵
  PID:10524
- C:\Windows\System\BVddCqZ.exe
  C:\Windows\System\BVddCqZ.exe
  2⤵
  PID:10552
- C:\Windows\System\YdKVzgL.exe
  C:\Windows\System\YdKVzgL.exe
  2⤵
  PID:10580
- C:\Windows\System\heAFSuU.exe
  C:\Windows\System\heAFSuU.exe
  2⤵
  PID:10596
- C:\Windows\System\InCFGvq.exe
  C:\Windows\System\InCFGvq.exe
  2⤵
  PID:10632
- C:\Windows\System\ZXLkoOQ.exe
  C:\Windows\System\ZXLkoOQ.exe
  2⤵
  PID:10660
- C:\Windows\System\rWmJUUv.exe
  C:\Windows\System\rWmJUUv.exe
  2⤵
  PID:10688
- C:\Windows\System\xmhdJVQ.exe
  C:\Windows\System\xmhdJVQ.exe
  2⤵
  PID:10708
- C:\Windows\System\RgZgxfW.exe
  C:\Windows\System\RgZgxfW.exe
  2⤵
  PID:10748
- C:\Windows\System\SjlPHfC.exe
  C:\Windows\System\SjlPHfC.exe
  2⤵
  PID:10776
- C:\Windows\System\GpdnhTd.exe
  C:\Windows\System\GpdnhTd.exe
  2⤵
  PID:10796
- C:\Windows\System\iuEGsWd.exe
  C:\Windows\System\iuEGsWd.exe
  2⤵
  PID:10836
- C:\Windows\System\xozGlrk.exe
  C:\Windows\System\xozGlrk.exe
  2⤵
  PID:10856
- C:\Windows\System\irUuSRO.exe
  C:\Windows\System\irUuSRO.exe
  2⤵
  PID:10892
- C:\Windows\System\YslLWwK.exe
  C:\Windows\System\YslLWwK.exe
  2⤵
  PID:10920
- C:\Windows\System\KYgFDRW.exe
  C:\Windows\System\KYgFDRW.exe
  2⤵
  PID:10936
- C:\Windows\System\VSYAFPu.exe
  C:\Windows\System\VSYAFPu.exe
  2⤵
  PID:10972
- C:\Windows\System\LRKGQLv.exe
  C:\Windows\System\LRKGQLv.exe
  2⤵
  PID:11004
- C:\Windows\System\ZvUcVwZ.exe
  C:\Windows\System\ZvUcVwZ.exe
  2⤵
  PID:11032
- C:\Windows\System\bejABfZ.exe
  C:\Windows\System\bejABfZ.exe
  2⤵
  PID:11060
- C:\Windows\System\mWSwLnd.exe
  C:\Windows\System\mWSwLnd.exe
  2⤵
  PID:11092
- C:\Windows\System\URGNAJP.exe
  C:\Windows\System\URGNAJP.exe
  2⤵
  PID:11108
- C:\Windows\System\VojYfYA.exe
  C:\Windows\System\VojYfYA.exe
  2⤵
  PID:11148
- C:\Windows\System\VKlvQmf.exe
  C:\Windows\System\VKlvQmf.exe
  2⤵
  PID:11172
- C:\Windows\System\WvefqMY.exe
  C:\Windows\System\WvefqMY.exe
  2⤵
  PID:11204
- C:\Windows\System\PpoHyVj.exe
  C:\Windows\System\PpoHyVj.exe
  2⤵
  PID:11240
- C:\Windows\System\VzrwOAc.exe
  C:\Windows\System\VzrwOAc.exe
  2⤵
  PID:10248
- C:\Windows\System\LdCjluu.exe
  C:\Windows\System\LdCjluu.exe
  2⤵
  PID:10288
- C:\Windows\System\WCkIyDM.exe
  C:\Windows\System\WCkIyDM.exe
  2⤵
  PID:3476
- C:\Windows\System\iJkFjdh.exe
  C:\Windows\System\iJkFjdh.exe
  2⤵
  PID:3636
- C:\Windows\System\udazhtl.exe
  C:\Windows\System\udazhtl.exe
  2⤵
  PID:7628
- C:\Windows\System\BiVAUfO.exe
  C:\Windows\System\BiVAUfO.exe
  2⤵
  PID:10420
- C:\Windows\System\qyLoGYj.exe
  C:\Windows\System\qyLoGYj.exe
  2⤵
  PID:1104
- C:\Windows\System\ixLCdaw.exe
  C:\Windows\System\ixLCdaw.exe
  2⤵
  PID:5588
- C:\Windows\System\looNfoQ.exe
  C:\Windows\System\looNfoQ.exe
  2⤵
  PID:3744
- C:\Windows\System\wtmBcJq.exe
  C:\Windows\System\wtmBcJq.exe
  2⤵
  PID:10592
- C:\Windows\System\xzafVII.exe
  C:\Windows\System\xzafVII.exe
  2⤵
  PID:10672
- C:\Windows\System\xKYqCwD.exe
  C:\Windows\System\xKYqCwD.exe
  2⤵
  PID:7836
- C:\Windows\System\XgGNTTa.exe
  C:\Windows\System\XgGNTTa.exe
  2⤵
  PID:7204
- C:\Windows\System\zhPFNqO.exe
  C:\Windows\System\zhPFNqO.exe
  2⤵
  PID:10784
- C:\Windows\System\yTDgIev.exe
  C:\Windows\System\yTDgIev.exe
  2⤵
  PID:10844
- C:\Windows\System\UverEFs.exe
  C:\Windows\System\UverEFs.exe
  2⤵
  PID:2496
- C:\Windows\System\zpfDPpd.exe
  C:\Windows\System\zpfDPpd.exe
  2⤵
  PID:10876
- C:\Windows\System\SoBZWAr.exe
  C:\Windows\System\SoBZWAr.exe
  2⤵
  PID:10932
- C:\Windows\System\SyEnidV.exe
  C:\Windows\System\SyEnidV.exe
  2⤵
  PID:10980
- C:\Windows\System\rkFBQor.exe
  C:\Windows\System\rkFBQor.exe
  2⤵
  PID:4532
- C:\Windows\System\iRMsSKJ.exe
  C:\Windows\System\iRMsSKJ.exe
  2⤵
  PID:1768
- C:\Windows\System\tqlHnCD.exe
  C:\Windows\System\tqlHnCD.exe
  2⤵
  PID:9620
- C:\Windows\System\hAIHYRS.exe
  C:\Windows\System\hAIHYRS.exe
  2⤵
  PID:1144
- C:\Windows\System\eraHNFi.exe
  C:\Windows\System\eraHNFi.exe
  2⤵
  PID:2460
- C:\Windows\System\iDgEhEV.exe
  C:\Windows\System\iDgEhEV.exe
  2⤵
  PID:11076
- C:\Windows\System\OhoxiFd.exe
  C:\Windows\System\OhoxiFd.exe
  2⤵
  PID:11120
- C:\Windows\System\HhlwWfD.exe
  C:\Windows\System\HhlwWfD.exe
  2⤵
  PID:6132
- C:\Windows\System\xrIFDDF.exe
  C:\Windows\System\xrIFDDF.exe
  2⤵
  PID:2444
- C:\Windows\System\CdQVGeK.exe
  C:\Windows\System\CdQVGeK.exe
  2⤵
  PID:11248
- C:\Windows\System\aKcfYDR.exe
  C:\Windows\System\aKcfYDR.exe
  2⤵
  PID:10272
- C:\Windows\System\BQeeQpx.exe
  C:\Windows\System\BQeeQpx.exe
  2⤵
  PID:10312
- C:\Windows\System\gXXpiDq.exe
  C:\Windows\System\gXXpiDq.exe
  2⤵
  PID:7512
- C:\Windows\System\LPYveOF.exe
  C:\Windows\System\LPYveOF.exe
  2⤵
  PID:4316
- C:\Windows\System\HRvVkdy.exe
  C:\Windows\System\HRvVkdy.exe
  2⤵
  PID:10504
- C:\Windows\System\QhPKQSm.exe
  C:\Windows\System\QhPKQSm.exe
  2⤵
  PID:10296
- C:\Windows\System\roRgpLi.exe
  C:\Windows\System\roRgpLi.exe
  2⤵
  PID:7276
- C:\Windows\System\XLcLGYV.exe
  C:\Windows\System\XLcLGYV.exe
  2⤵
  PID:6320
- C:\Windows\System\HWaeiFd.exe
  C:\Windows\System\HWaeiFd.exe
  2⤵
  PID:6880
- C:\Windows\System\vXvAioa.exe
  C:\Windows\System\vXvAioa.exe
  2⤵
  PID:7216
- C:\Windows\System\aMMNgVx.exe
  C:\Windows\System\aMMNgVx.exe
  2⤵
  PID:7968
- C:\Windows\System\htsASXP.exe
  C:\Windows\System\htsASXP.exe
  2⤵
  PID:4236
- C:\Windows\System\sxAQrww.exe
  C:\Windows\System\sxAQrww.exe
  2⤵
  PID:8124
- C:\Windows\System\raAzJAo.exe
  C:\Windows\System\raAzJAo.exe
  2⤵
  PID:7812
- C:\Windows\System\EzcvBjU.exe
  C:\Windows\System\EzcvBjU.exe
  2⤵
  PID:544
- C:\Windows\System\LsliBUM.exe
  C:\Windows\System\LsliBUM.exe
  2⤵
  PID:9572
- C:\Windows\System\RbgrqoM.exe
  C:\Windows\System\RbgrqoM.exe
  2⤵
  PID:7824
- C:\Windows\System\EfKIldx.exe
  C:\Windows\System\EfKIldx.exe
  2⤵
  PID:11048
- C:\Windows\System\wWjXmTb.exe
  C:\Windows\System\wWjXmTb.exe
  2⤵
  PID:6744
- C:\Windows\System\CIKyPta.exe
  C:\Windows\System\CIKyPta.exe
  2⤵
  PID:10872
- C:\Windows\System\vMLcPyn.exe
  C:\Windows\System\vMLcPyn.exe
  2⤵
  PID:3336
- C:\Windows\System\RdqXWuV.exe
  C:\Windows\System\RdqXWuV.exe
  2⤵
  PID:5744
- C:\Windows\System\vjnvueC.exe
  C:\Windows\System\vjnvueC.exe
  2⤵
  PID:7884
- C:\Windows\System\HQFVlRe.exe
  C:\Windows\System\HQFVlRe.exe
  2⤵
  PID:6220
- C:\Windows\System\yIEfoVc.exe
  C:\Windows\System\yIEfoVc.exe
  2⤵
  PID:7404
- C:\Windows\System\vBxTpEn.exe
  C:\Windows\System\vBxTpEn.exe
  2⤵
  PID:7244
- C:\Windows\System\tWWHEXJ.exe
  C:\Windows\System\tWWHEXJ.exe
  2⤵
  PID:6448
- C:\Windows\System\XSTlyaG.exe
  C:\Windows\System\XSTlyaG.exe
  2⤵
  PID:7540
- C:\Windows\System\UTQvsOb.exe
  C:\Windows\System\UTQvsOb.exe
  2⤵
  PID:10704
- C:\Windows\System\wJGFBcY.exe
  C:\Windows\System\wJGFBcY.exe
  2⤵
  PID:6576
- C:\Windows\System\CBYDgms.exe
  C:\Windows\System\CBYDgms.exe
  2⤵
  PID:1188
- C:\Windows\System\gocmmEc.exe
  C:\Windows\System\gocmmEc.exe
  2⤵
  PID:7488
- C:\Windows\System\yrpvDPA.exe
  C:\Windows\System\yrpvDPA.exe
  2⤵
  PID:4448
- C:\Windows\System\DFIHNfV.exe
  C:\Windows\System\DFIHNfV.exe
  2⤵
  PID:2244
- C:\Windows\System\pdVOvEJ.exe
  C:\Windows\System\pdVOvEJ.exe
  2⤵
  PID:5200
- C:\Windows\System\dFTvtTl.exe
  C:\Windows\System\dFTvtTl.exe
  2⤵
  PID:11160
- C:\Windows\System\rGQKMnb.exe
  C:\Windows\System\rGQKMnb.exe
  2⤵
  PID:6992
- C:\Windows\System\SkKKXGM.exe
  C:\Windows\System\SkKKXGM.exe
  2⤵
  PID:10356
- C:\Windows\System\xRLcEMq.exe
  C:\Windows\System\xRLcEMq.exe
  2⤵
  PID:7528
- C:\Windows\System\JilFKhp.exe
  C:\Windows\System\JilFKhp.exe
  2⤵
  PID:904
- C:\Windows\System\QjyBtPG.exe
  C:\Windows\System\QjyBtPG.exe
  2⤵
  PID:6148
- C:\Windows\System\jYKpZDb.exe
  C:\Windows\System\jYKpZDb.exe
  2⤵
  PID:2968
- C:\Windows\System\UCOGyOE.exe
  C:\Windows\System\UCOGyOE.exe
  2⤵
  PID:5372
- C:\Windows\System\fmJdgBg.exe
  C:\Windows\System\fmJdgBg.exe
  2⤵
  PID:2416
- C:\Windows\System\tnnnjTc.exe
  C:\Windows\System\tnnnjTc.exe
  2⤵
  PID:3488
- C:\Windows\System\PVZBwus.exe
  C:\Windows\System\PVZBwus.exe
  2⤵
  PID:1880
- C:\Windows\System\fxiFDKI.exe
  C:\Windows\System\fxiFDKI.exe
  2⤵
  PID:3504
- C:\Windows\System\OsitHCt.exe
  C:\Windows\System\OsitHCt.exe
  2⤵
  PID:8596
- C:\Windows\System\DIGFbru.exe
  C:\Windows\System\DIGFbru.exe
  2⤵
  PID:2116
- C:\Windows\System\TkkHnwv.exe
  C:\Windows\System\TkkHnwv.exe
  2⤵
  PID:2152
- C:\Windows\System\BnGUnFY.exe
  C:\Windows\System\BnGUnFY.exe
  2⤵
  PID:6244
- C:\Windows\System\WAtitzk.exe
  C:\Windows\System\WAtitzk.exe
  2⤵
  PID:7956
- C:\Windows\System\enXvGxA.exe
  C:\Windows\System\enXvGxA.exe
  2⤵
  PID:8084
- C:\Windows\System\gIbGRKn.exe
  C:\Windows\System\gIbGRKn.exe
  2⤵
  PID:8156
- C:\Windows\System\eOHsicf.exe
  C:\Windows\System\eOHsicf.exe
  2⤵
  PID:7744
- C:\Windows\System\ddCnzEZ.exe
  C:\Windows\System\ddCnzEZ.exe
  2⤵
  PID:8892
- C:\Windows\System\xtSdwLT.exe
  C:\Windows\System\xtSdwLT.exe
  2⤵
  PID:8924
- C:\Windows\System\bLAocga.exe
  C:\Windows\System\bLAocga.exe
  2⤵
  PID:9004
- C:\Windows\System\CqnjwRU.exe
  C:\Windows\System\CqnjwRU.exe
  2⤵
  PID:5896
- C:\Windows\System\tgtKYgP.exe
  C:\Windows\System\tgtKYgP.exe
  2⤵
  PID:4240
- C:\Windows\System\tdiMpYw.exe
  C:\Windows\System\tdiMpYw.exe
  2⤵
  PID:5564
- C:\Windows\System\jABdkIt.exe
  C:\Windows\System\jABdkIt.exe
  2⤵
  PID:4320
- C:\Windows\System\ZrwATPB.exe
  C:\Windows\System\ZrwATPB.exe
  2⤵
  PID:8828
- C:\Windows\System\CgILEWq.exe
  C:\Windows\System\CgILEWq.exe
  2⤵
  PID:8320
- C:\Windows\System\kdfFUuK.exe
  C:\Windows\System\kdfFUuK.exe
  2⤵
  PID:2080
- C:\Windows\System\IgIyVnT.exe
  C:\Windows\System\IgIyVnT.exe
  2⤵
  PID:6856
- C:\Windows\System\zonRsoH.exe
  C:\Windows\System\zonRsoH.exe
  2⤵
  PID:8820
- C:\Windows\System\ztVLppk.exe
  C:\Windows\System\ztVLppk.exe
  2⤵
  PID:8272
- C:\Windows\System\DPbBHRf.exe
  C:\Windows\System\DPbBHRf.exe
  2⤵
  PID:8692
- C:\Windows\System\xBgGjDn.exe
  C:\Windows\System\xBgGjDn.exe
  2⤵
  PID:6528
- C:\Windows\System\nhoFlxv.exe
  C:\Windows\System\nhoFlxv.exe
  2⤵
  PID:8484
- C:\Windows\System\jthVESF.exe
  C:\Windows\System\jthVESF.exe
  2⤵
  PID:9176
- C:\Windows\System\YepLDNH.exe
  C:\Windows\System\YepLDNH.exe
  2⤵
  PID:8388
- C:\Windows\System\rRVOFtp.exe
  C:\Windows\System\rRVOFtp.exe
  2⤵
  PID:6556
- C:\Windows\System\msvgnkH.exe
  C:\Windows\System\msvgnkH.exe
  2⤵
  PID:11308
- C:\Windows\System\EMAqsjg.exe
  C:\Windows\System\EMAqsjg.exe
  2⤵
  PID:11336
- C:\Windows\System\yOFeNhf.exe
  C:\Windows\System\yOFeNhf.exe
  2⤵
  PID:11364
- C:\Windows\System\sfEFwKK.exe
  C:\Windows\System\sfEFwKK.exe
  2⤵
  PID:11392
- C:\Windows\System\xtPPGJY.exe
  C:\Windows\System\xtPPGJY.exe
  2⤵
  PID:11420
- C:\Windows\System\ncRmonN.exe
  C:\Windows\System\ncRmonN.exe
  2⤵
  PID:11460
- C:\Windows\System\SPTBuLc.exe
  C:\Windows\System\SPTBuLc.exe
  2⤵
  PID:11480
- C:\Windows\System\HbPmfzO.exe
  C:\Windows\System\HbPmfzO.exe
  2⤵
  PID:11520
- C:\Windows\System\liJxDpW.exe
  C:\Windows\System\liJxDpW.exe
  2⤵
  PID:11536
- C:\Windows\System\bbVgYrE.exe
  C:\Windows\System\bbVgYrE.exe
  2⤵
  PID:11576
- C:\Windows\System\bEwzDpk.exe
  C:\Windows\System\bEwzDpk.exe
  2⤵
  PID:11604
- C:\Windows\System\QYQtXGv.exe
  C:\Windows\System\QYQtXGv.exe
  2⤵
  PID:11636
- C:\Windows\System\SCEsVIK.exe
  C:\Windows\System\SCEsVIK.exe
  2⤵
  PID:11700
- C:\Windows\System\pQYxbpR.exe
  C:\Windows\System\pQYxbpR.exe
  2⤵
  PID:11728
- C:\Windows\System\IDaJlnz.exe
  C:\Windows\System\IDaJlnz.exe
  2⤵
  PID:11760
- C:\Windows\System\QITFqRb.exe
  C:\Windows\System\QITFqRb.exe
  2⤵
  PID:11788
- C:\Windows\System\QYbqKzg.exe
  C:\Windows\System\QYbqKzg.exe
  2⤵
  PID:11816
- C:\Windows\System\IxIFycP.exe
  C:\Windows\System\IxIFycP.exe
  2⤵
  PID:11848
- C:\Windows\System\ECblBMs.exe
  C:\Windows\System\ECblBMs.exe
  2⤵
  PID:11864
- C:\Windows\System\zEoqHNd.exe
  C:\Windows\System\zEoqHNd.exe
  2⤵
  PID:11904
- C:\Windows\System\JkdKMHj.exe
  C:\Windows\System\JkdKMHj.exe
  2⤵
  PID:11932
- C:\Windows\System\GaNasAS.exe
  C:\Windows\System\GaNasAS.exe
  2⤵
  PID:11960
- C:\Windows\System\FzkPFsC.exe
  C:\Windows\System\FzkPFsC.exe
  2⤵
  PID:11980
- C:\Windows\System\UXjOVdA.exe
  C:\Windows\System\UXjOVdA.exe
  2⤵
  PID:12008
- C:\Windows\System\MDkfxOB.exe
  C:\Windows\System\MDkfxOB.exe
  2⤵
  PID:12044
- C:\Windows\System\kGiLgPT.exe
  C:\Windows\System\kGiLgPT.exe
  2⤵
  PID:12072
- C:\Windows\System\itCyfMi.exe
  C:\Windows\System\itCyfMi.exe
  2⤵
  PID:12100
- C:\Windows\System\waqHEqR.exe
  C:\Windows\System\waqHEqR.exe
  2⤵
  PID:12120
- C:\Windows\System\JcNjygA.exe
  C:\Windows\System\JcNjygA.exe
  2⤵
  PID:12160
- C:\Windows\System\sINMZxR.exe
  C:\Windows\System\sINMZxR.exe
  2⤵
  PID:12184
- C:\Windows\System\QWmxpPr.exe
  C:\Windows\System\QWmxpPr.exe
  2⤵
  PID:12216
- C:\Windows\System\XXrcmqe.exe
  C:\Windows\System\XXrcmqe.exe
  2⤵
  PID:12236
- C:\Windows\System\mBaLUMY.exe
  C:\Windows\System\mBaLUMY.exe
  2⤵
  PID:12260
- C:\Windows\System\LOJWogh.exe
  C:\Windows\System\LOJWogh.exe
  2⤵
  PID:9076
- C:\Windows\System\pucfBrg.exe
  C:\Windows\System\pucfBrg.exe
  2⤵
  PID:3392
- C:\Windows\System\myXXTtg.exe
  C:\Windows\System\myXXTtg.exe
  2⤵
  PID:7796
- C:\Windows\System\uzyIINT.exe
  C:\Windows\System\uzyIINT.exe
  2⤵
  PID:11280
- C:\Windows\System\cWykpJT.exe
  C:\Windows\System\cWykpJT.exe
  2⤵
  PID:11292
- C:\Windows\System\qubmxxP.exe
  C:\Windows\System\qubmxxP.exe
  2⤵
  PID:11332
- C:\Windows\System\XfKJcdW.exe
  C:\Windows\System\XfKJcdW.exe
  2⤵
  PID:8712
- C:\Windows\System\DMqTVRy.exe
  C:\Windows\System\DMqTVRy.exe
  2⤵
  PID:8856
- C:\Windows\System\eVlhWaQ.exe
  C:\Windows\System\eVlhWaQ.exe
  2⤵
  PID:11448
- C:\Windows\System\GTyobyA.exe
  C:\Windows\System\GTyobyA.exe
  2⤵
  PID:11492
- C:\Windows\System\TykywdB.exe
  C:\Windows\System\TykywdB.exe
  2⤵
  PID:11528
- C:\Windows\System\KijfnEY.exe
  C:\Windows\System\KijfnEY.exe
  2⤵
  PID:11588
- C:\Windows\System\bCUMhKu.exe
  C:\Windows\System\bCUMhKu.exe
  2⤵
  PID:11708
- C:\Windows\System\JcuvdBg.exe
  C:\Windows\System\JcuvdBg.exe
  2⤵
  PID:11768
- C:\Windows\System\sUQXiiS.exe
  C:\Windows\System\sUQXiiS.exe
  2⤵
  PID:11796
- C:\Windows\System\iTnVlpp.exe
  C:\Windows\System\iTnVlpp.exe
  2⤵
  PID:9516
- C:\Windows\System\aRGdSFd.exe
  C:\Windows\System\aRGdSFd.exe
  2⤵
  PID:9548
- C:\Windows\System\LKRBoBu.exe
  C:\Windows\System\LKRBoBu.exe
  2⤵
  PID:9576
- C:\Windows\System\FWdmSTj.exe
  C:\Windows\System\FWdmSTj.exe
  2⤵
  PID:11928
- C:\Windows\System\zCySvRJ.exe
  C:\Windows\System\zCySvRJ.exe
  2⤵
  PID:11968
- C:\Windows\System\akWKoaO.exe
  C:\Windows\System\akWKoaO.exe
  2⤵
  PID:12016
- C:\Windows\System\cOWTwyI.exe
  C:\Windows\System\cOWTwyI.exe
  2⤵
  PID:12040
- C:\Windows\System\CdDcZNP.exe
  C:\Windows\System\CdDcZNP.exe
  2⤵
  PID:9808
- C:\Windows\System\xOMwTcO.exe
  C:\Windows\System\xOMwTcO.exe
  2⤵
  PID:9872
- C:\Windows\System\wNpjbic.exe
  C:\Windows\System\wNpjbic.exe
  2⤵
  PID:7848
- C:\Windows\System\OXMPsLl.exe
  C:\Windows\System\OXMPsLl.exe
  2⤵
  PID:9956
- C:\Windows\System\cVgFGuM.exe
  C:\Windows\System\cVgFGuM.exe
  2⤵
  PID:12200
- C:\Windows\System\MhxGkAZ.exe
  C:\Windows\System\MhxGkAZ.exe
  2⤵
  PID:12224
- C:\Windows\System\qjIafPU.exe
  C:\Windows\System\qjIafPU.exe
  2⤵
  PID:10044
- C:\Windows\System\wVeUemq.exe
  C:\Windows\System\wVeUemq.exe
  2⤵
  PID:12284
- C:\Windows\System\vxvKWlT.exe
  C:\Windows\System\vxvKWlT.exe
  2⤵
  PID:10128
- C:\Windows\System\mtfwUCc.exe
  C:\Windows\System\mtfwUCc.exe
  2⤵
  PID:10180
- C:\Windows\System\RCvYadB.exe
  C:\Windows\System\RCvYadB.exe
  2⤵
  PID:8256
- C:\Windows\System\lgPZadd.exe
  C:\Windows\System\lgPZadd.exe
  2⤵
  PID:11388
- C:\Windows\System\iMDMPaw.exe
  C:\Windows\System\iMDMPaw.exe
  2⤵
  PID:9064
- C:\Windows\System\bbdKSpE.exe
  C:\Windows\System\bbdKSpE.exe
  2⤵
  PID:11468
- C:\Windows\System\jkOzJVw.exe
  C:\Windows\System\jkOzJVw.exe
  2⤵
  PID:11564
- C:\Windows\System\lXrfCLt.exe
  C:\Windows\System\lXrfCLt.exe
  2⤵
  PID:11724
- C:\Windows\System\hYinjnm.exe
  C:\Windows\System\hYinjnm.exe
  2⤵
  PID:11740
- C:\Windows\System\arYBxbM.exe
  C:\Windows\System\arYBxbM.exe
  2⤵
  PID:9592
- C:\Windows\System\zgCvuPC.exe
  C:\Windows\System\zgCvuPC.exe
  2⤵
  PID:9656
- C:\Windows\System\vUFhlcL.exe
  C:\Windows\System\vUFhlcL.exe
  2⤵
  PID:8032
- C:\Windows\System\MLJywvd.exe
  C:\Windows\System\MLJywvd.exe
  2⤵
  PID:9788
- C:\Windows\System\ngIWsXD.exe
  C:\Windows\System\ngIWsXD.exe
  2⤵
  PID:12000
- C:\Windows\System\reZzhrS.exe
  C:\Windows\System\reZzhrS.exe
  2⤵
  PID:7036
- C:\Windows\System\UUvriNu.exe
  C:\Windows\System\UUvriNu.exe
  2⤵
  PID:12112
- C:\Windows\System\dtahMty.exe
  C:\Windows\System\dtahMty.exe
  2⤵
  PID:9920
- C:\Windows\System\ZLsLpmP.exe
  C:\Windows\System\ZLsLpmP.exe
  2⤵
  PID:12208
- C:\Windows\System\RTbqCwm.exe
  C:\Windows\System\RTbqCwm.exe
  2⤵
  PID:10200
- C:\Windows\System\VydBnNz.exe
  C:\Windows\System\VydBnNz.exe
  2⤵
  PID:10080
- C:\Windows\System\LJELVMl.exe
  C:\Windows\System\LJELVMl.exe
  2⤵
  PID:11296
- C:\Windows\System\GzccLyJ.exe
  C:\Windows\System\GzccLyJ.exe
  2⤵
  PID:7072
- C:\Windows\System\LQbxbDi.exe
  C:\Windows\System\LQbxbDi.exe
  2⤵
  PID:6088
- C:\Windows\System\OqxHLvs.exe
  C:\Windows\System\OqxHLvs.exe
  2⤵
  PID:7024
- C:\Windows\System\kaKQvGa.exe
  C:\Windows\System\kaKQvGa.exe
  2⤵
  PID:11504
- C:\Windows\System\uVnTJcz.exe
  C:\Windows\System\uVnTJcz.exe
  2⤵
  PID:11644
- C:\Windows\System\TmzDyUZ.exe
  C:\Windows\System\TmzDyUZ.exe
  2⤵
  PID:1408
- C:\Windows\System\JJVmBtE.exe
  C:\Windows\System\JJVmBtE.exe
  2⤵
  PID:11876
- C:\Windows\System\kyGxdPP.exe
  C:\Windows\System\kyGxdPP.exe
  2⤵
  PID:9772
- C:\Windows\System\cOBGrqq.exe
  C:\Windows\System\cOBGrqq.exe
  2⤵
  PID:12056
- C:\Windows\System\PbRulfu.exe
  C:\Windows\System\PbRulfu.exe
  2⤵
  PID:9848
- C:\Windows\System\iRxOMtR.exe
  C:\Windows\System\iRxOMtR.exe
  2⤵
  PID:8660
- C:\Windows\System\bPnuQrH.exe
  C:\Windows\System\bPnuQrH.exe
  2⤵
  PID:10012
- C:\Windows\System\ocuXoyK.exe
  C:\Windows\System\ocuXoyK.exe
  2⤵
  PID:10236
- C:\Windows\System\YqPOUID.exe
  C:\Windows\System\YqPOUID.exe
  2⤵
  PID:7056
- C:\Windows\System\peqiYPn.exe
  C:\Windows\System\peqiYPn.exe
  2⤵
  PID:7964
- C:\Windows\System\LmYalZl.exe
  C:\Windows\System\LmYalZl.exe
  2⤵
  PID:8344
- C:\Windows\System\gwtUsJG.exe
  C:\Windows\System\gwtUsJG.exe
  2⤵
  PID:9084
- C:\Windows\System\lhrxoLr.exe
  C:\Windows\System\lhrxoLr.exe
  2⤵
  PID:7352
- C:\Windows\System\FazePAo.exe
  C:\Windows\System\FazePAo.exe
  2⤵
  PID:8400
- C:\Windows\System\PyFRfVz.exe
  C:\Windows\System\PyFRfVz.exe
  2⤵
  PID:4672
- C:\Windows\System\MFHIoZf.exe
  C:\Windows\System\MFHIoZf.exe
  2⤵
  PID:6432
- C:\Windows\System\tusvfiR.exe
  C:\Windows\System\tusvfiR.exe
  2⤵
  PID:2408
- C:\Windows\System\GAROCWn.exe
  C:\Windows\System\GAROCWn.exe
  2⤵
  PID:948
- C:\Windows\System\MCUNvwY.exe
  C:\Windows\System\MCUNvwY.exe
  2⤵
  PID:4540
- C:\Windows\System\bWmLION.exe
  C:\Windows\System\bWmLION.exe
  2⤵
  PID:11272
- C:\Windows\System\lgnrsGr.exe
  C:\Windows\System\lgnrsGr.exe
  2⤵
  PID:11304
- C:\Windows\System\MdIVZIe.exe
  C:\Windows\System\MdIVZIe.exe
  2⤵
  PID:5104
- C:\Windows\System\kldfZEo.exe
  C:\Windows\System\kldfZEo.exe
  2⤵
  PID:6376
- C:\Windows\System\aZltnTl.exe
  C:\Windows\System\aZltnTl.exe
  2⤵
  PID:1772
- C:\Windows\System\VgBDbgP.exe
  C:\Windows\System\VgBDbgP.exe
  2⤵
  PID:8460
- C:\Windows\System\xtoMKez.exe
  C:\Windows\System\xtoMKez.exe
  2⤵
  PID:12156
- C:\Windows\System\BfvonSL.exe
  C:\Windows\System\BfvonSL.exe
  2⤵
  PID:1732
- C:\Windows\System\SbnoWly.exe
  C:\Windows\System\SbnoWly.exe
  2⤵
  PID:5352
- C:\Windows\System\WNInOwM.exe
  C:\Windows\System\WNInOwM.exe
  2⤵
  PID:10488
- C:\Windows\System\dHmiQfK.exe
  C:\Windows\System\dHmiQfK.exe
  2⤵
  PID:6380
- C:\Windows\System\QDzUGma.exe
  C:\Windows\System\QDzUGma.exe
  2⤵
  PID:10572
- C:\Windows\System\TFlpDHg.exe
  C:\Windows\System\TFlpDHg.exe
  2⤵
  PID:10612
- C:\Windows\System\yBgXZfd.exe
  C:\Windows\System\yBgXZfd.exe
  2⤵
  PID:9672
- C:\Windows\System\cHSHKlT.exe
  C:\Windows\System\cHSHKlT.exe
  2⤵
  PID:9728
- C:\Windows\System\QzDJhCO.exe
  C:\Windows\System\QzDJhCO.exe
  2⤵
  PID:8780
- C:\Windows\System\rxhzvcr.exe
  C:\Windows\System\rxhzvcr.exe
  2⤵
  PID:9232
- C:\Windows\System\tzWJgDp.exe
  C:\Windows\System\tzWJgDp.exe
  2⤵
  PID:8260
- C:\Windows\System\UriBewe.exe
  C:\Windows\System\UriBewe.exe
  2⤵
  PID:10740
- C:\Windows\System\iqSYBcH.exe
  C:\Windows\System\iqSYBcH.exe
  2⤵
  PID:4864
- C:\Windows\System\FLMvfrz.exe
  C:\Windows\System\FLMvfrz.exe
  2⤵
  PID:10916
- C:\Windows\System\brtXoTv.exe
  C:\Windows\System\brtXoTv.exe
  2⤵
  PID:10828
- C:\Windows\System\rKpfTxy.exe
  C:\Windows\System\rKpfTxy.exe
  2⤵
  PID:10996
- C:\Windows\System\yEJqZHA.exe
  C:\Windows\System\yEJqZHA.exe
  2⤵
  PID:1340
- C:\Windows\System\rQpBipi.exe
  C:\Windows\System\rQpBipi.exe
  2⤵
  PID:8624
- C:\Windows\System\qBjznqV.exe
  C:\Windows\System\qBjznqV.exe
  2⤵
  PID:5280
- C:\Windows\System\WVzlKJL.exe
  C:\Windows\System\WVzlKJL.exe
  2⤵
  PID:10092
- C:\Windows\System\nmNWIjx.exe
  C:\Windows\System\nmNWIjx.exe
  2⤵
  PID:5132
- C:\Windows\System\XuDnFHI.exe
  C:\Windows\System\XuDnFHI.exe
  2⤵
  PID:9384
- C:\Windows\System\gAiqusN.exe
  C:\Windows\System\gAiqusN.exe
  2⤵
  PID:12316
- C:\Windows\System\jmicZxR.exe
  C:\Windows\System\jmicZxR.exe
  2⤵
  PID:12344
- C:\Windows\System\OhwkFZY.exe
  C:\Windows\System\OhwkFZY.exe
  2⤵
  PID:12376
- C:\Windows\System\hZmfvoR.exe
  C:\Windows\System\hZmfvoR.exe
  2⤵
  PID:12404
- C:\Windows\System\ApKPaZN.exe
  C:\Windows\System\ApKPaZN.exe
  2⤵
  PID:12428
- C:\Windows\System\xhaByNO.exe
  C:\Windows\System\xhaByNO.exe
  2⤵
  PID:12460
- C:\Windows\System\ubhqMrP.exe
  C:\Windows\System\ubhqMrP.exe
  2⤵
  PID:12488
- C:\Windows\System\DDuyaow.exe
  C:\Windows\System\DDuyaow.exe
  2⤵
  PID:12528
- C:\Windows\System\VwymWxl.exe
  C:\Windows\System\VwymWxl.exe
  2⤵
  PID:12560
- C:\Windows\System\xvdfbNh.exe
  C:\Windows\System\xvdfbNh.exe
  2⤵
  PID:12588
- C:\Windows\System\mycpmIn.exe
  C:\Windows\System\mycpmIn.exe
  2⤵
  PID:12616
- C:\Windows\System\MkmLemB.exe
  C:\Windows\System\MkmLemB.exe
  2⤵
  PID:12632
- C:\Windows\System\ZYhdvda.exe
  C:\Windows\System\ZYhdvda.exe
  2⤵
  PID:12664
- C:\Windows\System\UMpLEHb.exe
  C:\Windows\System\UMpLEHb.exe
  2⤵
  PID:12696
- C:\Windows\System\jPuTDDa.exe
  C:\Windows\System\jPuTDDa.exe
  2⤵
  PID:12716
- C:\Windows\System\XpaNCAc.exe
  C:\Windows\System\XpaNCAc.exe
  2⤵
  PID:12752
- C:\Windows\System\tuvbsCw.exe
  C:\Windows\System\tuvbsCw.exe
  2⤵
  PID:12772
- C:\Windows\System\oxRPAQB.exe
  C:\Windows\System\oxRPAQB.exe
  2⤵
  PID:12804
- C:\Windows\System\FuEShmB.exe
  C:\Windows\System\FuEShmB.exe
  2⤵
  PID:12832
- C:\Windows\System\nfcxHEk.exe
  C:\Windows\System\nfcxHEk.exe
  2⤵
  PID:12868
- C:\Windows\System\yvbyrBf.exe
  C:\Windows\System\yvbyrBf.exe
  2⤵
  PID:12900
- C:\Windows\System\mzKzncL.exe
  C:\Windows\System\mzKzncL.exe
  2⤵
  PID:12916
- C:\Windows\System\OBtBrIf.exe
  C:\Windows\System\OBtBrIf.exe
  2⤵
  PID:12944
- C:\Windows\System\BwrMByD.exe
  C:\Windows\System\BwrMByD.exe
  2⤵
  PID:12980
- C:\Windows\System\XpwfDRx.exe
  C:\Windows\System\XpwfDRx.exe
  2⤵
  PID:13008
- C:\Windows\System\ZcdDIid.exe
  C:\Windows\System\ZcdDIid.exe
  2⤵
  PID:13028
- C:\Windows\System\WCnEvHf.exe
  C:\Windows\System\WCnEvHf.exe
  2⤵
  PID:13056
- C:\Windows\System\KRXnwWl.exe
  C:\Windows\System\KRXnwWl.exe
  2⤵
  PID:13084
- C:\Windows\System\qZhnhoK.exe
  C:\Windows\System\qZhnhoK.exe
  2⤵
  PID:13120
- C:\Windows\System\viaihgu.exe
  C:\Windows\System\viaihgu.exe
  2⤵
  PID:13152
- C:\Windows\System\rnYqzcL.exe
  C:\Windows\System\rnYqzcL.exe
  2⤵
  PID:13184
- C:\Windows\System\sQRvRTf.exe
  C:\Windows\System\sQRvRTf.exe
  2⤵
  PID:13204
- C:\Windows\System\haKeYka.exe
  C:\Windows\System\haKeYka.exe
  2⤵
  PID:13236
- C:\Windows\System\GipLeBY.exe
  C:\Windows\System\GipLeBY.exe
  2⤵
  PID:13272
- C:\Windows\System\DaDJptX.exe
  C:\Windows\System\DaDJptX.exe
  2⤵
  PID:13300
- C:\Windows\System\iRcmtZP.exe
  C:\Windows\System\iRcmtZP.exe
  2⤵
  PID:12304
- C:\Windows\System\SAScuZu.exe
  C:\Windows\System\SAScuZu.exe
  2⤵
  PID:8888
- C:\Windows\System\UaFHRws.exe
  C:\Windows\System\UaFHRws.exe
  2⤵
  PID:2036
- C:\Windows\System\toWamcw.exe
  C:\Windows\System\toWamcw.exe
  2⤵
  PID:12456
- C:\Windows\System\FfbfTQr.exe
  C:\Windows\System\FfbfTQr.exe
  2⤵
  PID:9732
- C:\Windows\System\BPiyVPr.exe
  C:\Windows\System\BPiyVPr.exe
  2⤵
  PID:9876
- C:\Windows\System\LMsNMlK.exe
  C:\Windows\System\LMsNMlK.exe
  2⤵
  PID:12612
- C:\Windows\System\OfjNETO.exe
  C:\Windows\System\OfjNETO.exe
  2⤵
  PID:12656
- C:\Windows\System\XFGrpJw.exe
  C:\Windows\System\XFGrpJw.exe
  2⤵
  PID:12708
- C:\Windows\System\BYfOZms.exe
  C:\Windows\System\BYfOZms.exe
  2⤵
  PID:10620
- C:\Windows\System\ESycTmF.exe
  C:\Windows\System\ESycTmF.exe
  2⤵
  PID:12828
- C:\Windows\System\RCTHoyk.exe
  C:\Windows\System\RCTHoyk.exe
  2⤵
  PID:4680
- C:\Windows\System\MBbjZxg.exe
  C:\Windows\System\MBbjZxg.exe
  2⤵
  PID:12936
- C:\Windows\System\TQFbqqa.exe
  C:\Windows\System\TQFbqqa.exe
  2⤵
  PID:10732
- C:\Windows\System\bYoxmeH.exe
  C:\Windows\System\bYoxmeH.exe
  2⤵
  PID:12996
- C:\Windows\System\yEcRfbA.exe
  C:\Windows\System\yEcRfbA.exe
  2⤵
  PID:13052
- C:\Windows\System\sYXkFZe.exe
  C:\Windows\System\sYXkFZe.exe
  2⤵
  PID:13096
- C:\Windows\System\DnSufWw.exe
  C:\Windows\System\DnSufWw.exe
  2⤵
  PID:13164
- C:\Windows\System\HkQahzb.exe
  C:\Windows\System\HkQahzb.exe
  2⤵
  PID:8164
- C:\Windows\System\KMWsumi.exe
  C:\Windows\System\KMWsumi.exe
  2⤵
  PID:12292
- C:\Windows\System\teRornh.exe
  C:\Windows\System\teRornh.exe
  2⤵
  PID:11228
- C:\Windows\System\GUtutLt.exe
  C:\Windows\System\GUtutLt.exe
  2⤵
  PID:1688
- C:\Windows\System\wykKrzF.exe
  C:\Windows\System\wykKrzF.exe
  2⤵
  PID:12504
- C:\Windows\System\nDZMPBL.exe
  C:\Windows\System\nDZMPBL.exe
  2⤵
  PID:12596
- C:\Windows\System\BTwxurk.exe
  C:\Windows\System\BTwxurk.exe
  2⤵
  PID:12684
- C:\Windows\System\JQBZaPa.exe
  C:\Windows\System\JQBZaPa.exe
  2⤵
  PID:12764
- C:\Windows\System\gHlAVMh.exe
  C:\Windows\System\gHlAVMh.exe
  2⤵
  PID:10548
- C:\Windows\System\YRYDrOK.exe
  C:\Windows\System\YRYDrOK.exe
  2⤵
  PID:7604
- C:\Windows\System\zlYzDTT.exe
  C:\Windows\System\zlYzDTT.exe
  2⤵
  PID:4364
- C:\Windows\System\XAdRzCo.exe
  C:\Windows\System\XAdRzCo.exe
  2⤵
  PID:1088
- C:\Windows\System\GhJWySS.exe
  C:\Windows\System\GhJWySS.exe
  2⤵
  PID:3952
- C:\Windows\System\hLWehAA.exe
  C:\Windows\System\hLWehAA.exe
  2⤵
  PID:13232
- C:\Windows\System\aOHsJVP.exe
  C:\Windows\System\aOHsJVP.exe
  2⤵
  PID:12360
- C:\Windows\System\iZIeAGY.exe
  C:\Windows\System\iZIeAGY.exe
  2⤵
  PID:1924
- C:\Windows\System\wuwvSZD.exe
  C:\Windows\System\wuwvSZD.exe
  2⤵
  PID:6028
- C:\Windows\System\mjdumtH.exe
  C:\Windows\System\mjdumtH.exe
  2⤵
  PID:10244
- C:\Windows\System\IVIwRYL.exe
  C:\Windows\System\IVIwRYL.exe
  2⤵
  PID:7192
- C:\Windows\System\eQHrpHV.exe
  C:\Windows\System\eQHrpHV.exe
  2⤵
  PID:11212
- C:\Windows\System\ExlwtcG.exe
  C:\Windows\System\ExlwtcG.exe
  2⤵
  PID:11040
- C:\Windows\System\hGWOiNd.exe
  C:\Windows\System\hGWOiNd.exe
  2⤵
  PID:10380
- C:\Windows\System\kFHBlmJ.exe
  C:\Windows\System\kFHBlmJ.exe
  2⤵
  PID:540
- C:\Windows\System\yBMbFaI.exe
  C:\Windows\System\yBMbFaI.exe
  2⤵
  PID:13284
- C:\Windows\System\HFcQdsq.exe
  C:\Windows\System\HFcQdsq.exe
  2⤵
  PID:12416
- C:\Windows\System\TMbcYGx.exe
  C:\Windows\System\TMbcYGx.exe
  2⤵
  PID:216
- C:\Windows\System\hyrNJII.exe
  C:\Windows\System\hyrNJII.exe
  2⤵
  PID:12796
- C:\Windows\System\UEabZen.exe
  C:\Windows\System\UEabZen.exe
  2⤵
  PID:11192
- C:\Windows\System\aPWmZys.exe
  C:\Windows\System\aPWmZys.exe
  2⤵
  PID:10700
- C:\Windows\System\UdEMJlA.exe
  C:\Windows\System\UdEMJlA.exe
  2⤵
  PID:10656
- C:\Windows\System\dfCBYYI.exe
  C:\Windows\System\dfCBYYI.exe
  2⤵
  PID:7248
- C:\Windows\System\IIwYzCy.exe
  C:\Windows\System\IIwYzCy.exe
  2⤵
  PID:11220
- C:\Windows\System\vgZNuEi.exe
  C:\Windows\System\vgZNuEi.exe
  2⤵
  PID:10516
- C:\Windows\System\FvjOpTG.exe
  C:\Windows\System\FvjOpTG.exe
  2⤵
  PID:6584
- C:\Windows\System\eyZYgOK.exe
  C:\Windows\System\eyZYgOK.exe
  2⤵
  PID:7584
- C:\Windows\System\AHbcCgY.exe
  C:\Windows\System\AHbcCgY.exe
  2⤵
  PID:4784
- C:\Windows\System\ACMVyIZ.exe
  C:\Windows\System\ACMVyIZ.exe
  2⤵
  PID:5544
- C:\Windows\System\OcEvpxR.exe
  C:\Windows\System\OcEvpxR.exe
  2⤵
  PID:7516
- C:\Windows\System\PUzPYsZ.exe
  C:\Windows\System\PUzPYsZ.exe
  2⤵
  PID:8488
- C:\Windows\System\vODwnIw.exe
  C:\Windows\System\vODwnIw.exe
  2⤵
  PID:7536
- C:\Windows\System\mJHHapl.exe
  C:\Windows\System\mJHHapl.exe
  2⤵
  PID:7136
- C:\Windows\System\GhsCRjZ.exe
  C:\Windows\System\GhsCRjZ.exe
  2⤵
  PID:11020
- C:\Windows\System\EwLoroB.exe
  C:\Windows\System\EwLoroB.exe
  2⤵
  PID:1304
- C:\Windows\System\KFClEfj.exe
  C:\Windows\System\KFClEfj.exe
  2⤵
  PID:11184
- C:\Windows\System\lVuiAPs.exe
  C:\Windows\System\lVuiAPs.exe
  2⤵
  PID:11024
- C:\Windows\System\HwQBvXD.exe
  C:\Windows\System\HwQBvXD.exe
  2⤵
  PID:4792
- C:\Windows\System\nboBxhN.exe
  C:\Windows\System\nboBxhN.exe
  2⤵
  PID:8852
- C:\Windows\System\bcCwJwL.exe
  C:\Windows\System\bcCwJwL.exe
  2⤵
  PID:11136
- C:\Windows\System\JFsJttz.exe
  C:\Windows\System\JFsJttz.exe
  2⤵
  PID:11188
- C:\Windows\System\xUNvhff.exe
  C:\Windows\System\xUNvhff.exe
  2⤵
  PID:11476
- C:\Windows\System\MbuvcRc.exe
  C:\Windows\System\MbuvcRc.exe
  2⤵
  PID:10392
- C:\Windows\System\zJTdafr.exe
  C:\Windows\System\zJTdafr.exe
  2⤵
  PID:10300
- C:\Windows\System\URQkVMk.exe
  C:\Windows\System\URQkVMk.exe
  2⤵
  PID:1332
- C:\Windows\System\RDLPVQn.exe
  C:\Windows\System\RDLPVQn.exe
  2⤵
  PID:10416
- C:\Windows\System\CdUafCH.exe
  C:\Windows\System\CdUafCH.exe
  2⤵
  PID:9228
- C:\Windows\System\vXukGnX.exe
  C:\Windows\System\vXukGnX.exe
  2⤵
  PID:10520
- C:\Windows\System\dVYrGJB.exe
  C:\Windows\System\dVYrGJB.exe
  2⤵
  PID:9096
- C:\Windows\System\fSgfoBg.exe
  C:\Windows\System\fSgfoBg.exe
  2⤵
  PID:7396
- C:\Windows\System\FjlEJSj.exe
  C:\Windows\System\FjlEJSj.exe
  2⤵
  PID:1536
- C:\Windows\System\oCBvsmg.exe
  C:\Windows\System\oCBvsmg.exe
  2⤵
  PID:7348
- C:\Windows\System\VTnRoOZ.exe
  C:\Windows\System\VTnRoOZ.exe
  2⤵
  PID:8744
- C:\Windows\System\OlcZthc.exe
  C:\Windows\System\OlcZthc.exe
  2⤵
  PID:8936
- C:\Windows\System\ShsKHYu.exe
  C:\Windows\System\ShsKHYu.exe
  2⤵
  PID:5516
- C:\Windows\System\JtCBTdH.exe
  C:\Windows\System\JtCBTdH.exe
  2⤵
  PID:8984
- C:\Windows\System\HxNnkIU.exe
  C:\Windows\System\HxNnkIU.exe
  2⤵
  PID:13328
- C:\Windows\System\kjnTwHc.exe
  C:\Windows\System\kjnTwHc.exe
  2⤵
  PID:13348
- C:\Windows\System\zqbrkOu.exe
  C:\Windows\System\zqbrkOu.exe
  2⤵
  PID:13388
- C:\Windows\System\wLQVCEF.exe
  C:\Windows\System\wLQVCEF.exe
  2⤵
  PID:13416
- C:\Windows\System\djcUAZC.exe
  C:\Windows\System\djcUAZC.exe
  2⤵
  PID:13436
- C:\Windows\System\PZgvpAI.exe
  C:\Windows\System\PZgvpAI.exe
  2⤵
  PID:13464
- C:\Windows\System\ouVdFVG.exe
  C:\Windows\System\ouVdFVG.exe
  2⤵
  PID:13496
- C:\Windows\System\cvLdwWE.exe
  C:\Windows\System\cvLdwWE.exe
  2⤵
  PID:13532
- C:\Windows\System\wftOcgE.exe
  C:\Windows\System\wftOcgE.exe
  2⤵
  PID:13548
- C:\Windows\System\JuYKYEG.exe
  C:\Windows\System\JuYKYEG.exe
  2⤵
  PID:13588
- C:\Windows\System\HuQWSWx.exe
  C:\Windows\System\HuQWSWx.exe
  2⤵
  PID:13604
- C:\Windows\System\fHDQPZE.exe
  C:\Windows\System\fHDQPZE.exe
  2⤵
  PID:13640
- C:\Windows\System\pgIKlSZ.exe
  C:\Windows\System\pgIKlSZ.exe
  2⤵
  PID:13672
- C:\Windows\System\DLvIQBw.exe
  C:\Windows\System\DLvIQBw.exe
  2⤵
  PID:13700
- C:\Windows\System\jhrybga.exe
  C:\Windows\System\jhrybga.exe
  2⤵
  PID:13732
- C:\Windows\System\GuueQPx.exe
  C:\Windows\System\GuueQPx.exe
  2⤵
  PID:13760
- C:\Windows\System\kxJJqzk.exe
  C:\Windows\System\kxJJqzk.exe
  2⤵
  PID:13788
- C:\Windows\System\tXNImml.exe
  C:\Windows\System\tXNImml.exe
  2⤵
  PID:13816
- C:\Windows\System\ZLjXVli.exe
  C:\Windows\System\ZLjXVli.exe
  2⤵
  PID:13832
- C:\Windows\System\lkGcsSJ.exe
  C:\Windows\System\lkGcsSJ.exe
  2⤵
  PID:13864
- C:\Windows\System\DkmmICl.exe
  C:\Windows\System\DkmmICl.exe
  2⤵
  PID:13900
- C:\Windows\System\nJSwjAo.exe
  C:\Windows\System\nJSwjAo.exe
  2⤵
  PID:13924
- C:\Windows\System\uFCsfIp.exe
  C:\Windows\System\uFCsfIp.exe
  2⤵
  PID:13952
- C:\Windows\System\iDMwBXE.exe
  C:\Windows\System\iDMwBXE.exe
  2⤵
  PID:13984
- C:\Windows\System\xSBAqWm.exe
  C:\Windows\System\xSBAqWm.exe
  2⤵
  PID:14008
- C:\Windows\System\lzEQHlq.exe
  C:\Windows\System\lzEQHlq.exe
  2⤵
  PID:14044
- C:\Windows\System\OIPbCeq.exe
  C:\Windows\System\OIPbCeq.exe
  2⤵
  PID:14072
- C:\Windows\System\xFDzOKX.exe
  C:\Windows\System\xFDzOKX.exe
  2⤵
  PID:14100
- C:\Windows\System\kzLDPUu.exe
  C:\Windows\System\kzLDPUu.exe
  2⤵
  PID:14116
- C:\Windows\System\sTTGZKj.exe
  C:\Windows\System\sTTGZKj.exe
  2⤵
  PID:14156
- C:\Windows\System\cXCAoRI.exe
  C:\Windows\System\cXCAoRI.exe
  2⤵
  PID:14180
- C:\Windows\System\yWvIcuj.exe
  C:\Windows\System\yWvIcuj.exe
  2⤵
  PID:14212
- C:\Windows\System\KcECpBt.exe
  C:\Windows\System\KcECpBt.exe
  2⤵
  PID:14228
- C:\Windows\System\wfBqfmX.exe
  C:\Windows\System\wfBqfmX.exe
  2⤵
  PID:14268
- C:\Windows\System\TdfCIZw.exe
  C:\Windows\System\TdfCIZw.exe
  2⤵
  PID:14292
- C:\Windows\System\GAGdBbP.exe
  C:\Windows\System\GAGdBbP.exe
  2⤵
  PID:11372
- C:\Windows\System\vSgOqlE.exe
  C:\Windows\System\vSgOqlE.exe
  2⤵
  PID:11428
- C:\Windows\System\YSESGpM.exe
  C:\Windows\System\YSESGpM.exe
  2⤵
  PID:11444
- C:\Windows\System\BnOnvze.exe
  C:\Windows\System\BnOnvze.exe
  2⤵
  PID:13452
- C:\Windows\System\oAyQnrc.exe
  C:\Windows\System\oAyQnrc.exe
  2⤵
  PID:11544
- C:\Windows\System\fMrXekc.exe
  C:\Windows\System\fMrXekc.exe
  2⤵
  PID:13512
- C:\Windows\System\hItQcYr.exe
  C:\Windows\System\hItQcYr.exe
  2⤵
  PID:11632
- C:\Windows\System\wyusXRy.exe
  C:\Windows\System\wyusXRy.exe
  2⤵
  PID:11028
- C:\Windows\System\tYMpQOG.exe
  C:\Windows\System\tYMpQOG.exe
  2⤵
  PID:11716
- C:\Windows\System\LyXnQRD.exe
  C:\Windows\System\LyXnQRD.exe
  2⤵
  PID:11748
- C:\Windows\System\tKgJZyw.exe
  C:\Windows\System\tKgJZyw.exe
  2⤵
  PID:13684
- C:\Windows\System\ekrFlet.exe
  C:\Windows\System\ekrFlet.exe
  2⤵
  PID:11840
- C:\Windows\System\Mirhdmo.exe
  C:\Windows\System\Mirhdmo.exe
  2⤵
  PID:6136
- C:\Windows\System\AoGghPS.exe
  C:\Windows\System\AoGghPS.exe
  2⤵
  PID:11892
- C:\Windows\System\clLWdOR.exe
  C:\Windows\System\clLWdOR.exe
  2⤵
  PID:13852
- C:\Windows\System\GIlGfcs.exe
  C:\Windows\System\GIlGfcs.exe
  2⤵
  PID:13884
- C:\Windows\System\TCxoyVT.exe
  C:\Windows\System\TCxoyVT.exe
  2⤵
  PID:13912
- C:\Windows\System\FjpyjWV.exe
  C:\Windows\System\FjpyjWV.exe
  2⤵
  PID:12060
- C:\Windows\System\NFhFtTA.exe
  C:\Windows\System\NFhFtTA.exe
  2⤵
  PID:13992
- C:\Windows\System\bIcoFBi.exe
  C:\Windows\System\bIcoFBi.exe
  2⤵
  PID:14020
- C:\Windows\System\OwmMBqp.exe
  C:\Windows\System\OwmMBqp.exe
  2⤵
  PID:14096
- C:\Windows\System\DTcxtmx.exe
  C:\Windows\System\DTcxtmx.exe
  2⤵
  PID:12176
- C:\Windows\System\rbmCGXb.exe
  C:\Windows\System\rbmCGXb.exe
  2⤵
  PID:14164
- C:\Windows\System\iVhLaKx.exe
  C:\Windows\System\iVhLaKx.exe
  2⤵
  PID:14196
- C:\Windows\System\MTbPQLW.exe
  C:\Windows\System\MTbPQLW.exe
  2⤵
  PID:14240
- C:\Windows\System\efikPxq.exe
  C:\Windows\System\efikPxq.exe
  2⤵
  PID:8436
- C:\Windows\System\nFSViQr.exe
  C:\Windows\System\nFSViQr.exe
  2⤵
  PID:14328
- C:\Windows\System\SiAbpXC.exe
  C:\Windows\System\SiAbpXC.exe
  2⤵
  PID:8140
- C:\Windows\System\KIHCRCg.exe
  C:\Windows\System\KIHCRCg.exe
  2⤵
  PID:11508
- C:\Windows\System\MFdlyNJ.exe
  C:\Windows\System\MFdlyNJ.exe
  2⤵
  PID:11556
- C:\Windows\System\PnkrswJ.exe
  C:\Windows\System\PnkrswJ.exe
  2⤵
  PID:11648
- C:\Windows\System\ivtwkBt.exe
  C:\Windows\System\ivtwkBt.exe
  2⤵
  PID:13560
- C:\Windows\System\zyhkHuo.exe
  C:\Windows\System\zyhkHuo.exe
  2⤵
  PID:9492
- C:\Windows\System\yxQYmiL.exe
  C:\Windows\System\yxQYmiL.exe
  2⤵
  PID:11832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_djln0qmx.ryk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BWyVRKv.exe

Filesize
3.2MB

MD5
e4739f1c96ba99a6069792c791b01326

SHA1
27b4c793b89810ee0db808d409e38b9895dc2e50

SHA256
d674822d25782cb61d8f294e06925a1fcd6b69bb7bb58512adf766ca16ccadac

SHA512
733716fef341cacf064a7bb812c2539953660e78489cb7492f34d0ff0769b4e57dab97d1275793c1a67a85c130d1b39baaf1ad88e152e0e3ddcd9f2871e9443b

Download Submit
C:\Windows\System\GovhRtM.exe

Filesize
3.2MB

MD5
55749611de66eee76c4c5d39ffb76bcd

SHA1
e6e8f6d33099678b61a8ecea930e93e4ce5261c9

SHA256
2bef6052fd0e81ec98eaf497c35c395283e547d4d50484f1a05816da155f6da1

SHA512
33aa8309d0be7a9b8958dc38b7c96772553167065378cb8cd0974db9ce17df3c973270508825fdf4fcfec6945a4e30493663e34223c55e4b5cfc76abcd66dd86

Download Submit
C:\Windows\System\GtRqRNS.exe

Filesize
3.2MB

MD5
e5d2df041f3e8287461398682f22f2eb

SHA1
450152d9062e27eace67af71371e4c9501249473

SHA256
321f39db5b2fd4e90f26ffc288a348a6ffb244bfd3120f0a83bd09ccc3a9f881

SHA512
e22dcc531dcdade6009119e5359b77bd45c79cb172259fdd9a3ebb00ef8fa68c431673f36116520361622f81356b01e2193c035bfe663bbbb92550a14171bc3e

Download Submit
C:\Windows\System\HUbUqrS.exe

Filesize
3.2MB

MD5
101efb94382e3c30f56bd100e033f2dc

SHA1
f47cc7f8f171f15f4e6b1bf4ef1d0e72a3099a7f

SHA256
9dd2f7aa7839d265cc3c85107c8fdde79c349b06e9672e0c046255aa1d7d4a2f

SHA512
1eaff837e9301c76b4954f5640aef20751959ebb854187ef988d60875c2861c494dd8ec8652a0a535c0feb14a7d17c77debc47ca5394ac19a1e3527a459b356e

Download Submit
C:\Windows\System\HpEZQpG.exe

Filesize
3.2MB

MD5
002d657d05656581a25e1022b6235773

SHA1
cbd9c426f204ed337821e225f1996885a71cd215

SHA256
da386d98662634458867db6f2833beb7a4c3f96579d1b7bd31f4258711c80485

SHA512
3637ba89c0b28f68d5905d1d969fc686711168db47e8f134f7ad62edc9cc261a6d10a47a54d8acd7dd6fe98cc2cef6f8629c8003db5c15efb63e013d40deb0bd

Download Submit
C:\Windows\System\IWdQKHV.exe

Filesize
3.2MB

MD5
701c24207b6127ff083eb3e9cf1d5086

SHA1
bd28826e3a216085eb12bf76ef01579652dcc072

SHA256
fc874578dc7f092a32529a0b567e3764bbf87d9b09c5c3a709ee5c4bb1872567

SHA512
97a274412a75fafbecb5282d9da093d3edd2613df222f55d38d7fa18abcb497fbe4354664187b7ebfa88c671e3326a60c6e4b58c8be6e1a44aa6db7f1de9eae2

Download Submit
C:\Windows\System\KGMvCVm.exe

Filesize
3.2MB

MD5
78c8f11588915ef14268a17ff524d115

SHA1
e74a7cfd286d7486c5c3de233b01acd44ba93015

SHA256
2b6a9316fdb97ece9002a2d355e9d2a42285236d9f16481ee241d26503570fcd

SHA512
548466efb63578c7d42f79a6e607e184c3ae5fcff305fdb266480b3a774d738969fe8117ebcf828ae226a9072039326fbe2f5ef6768fe379f442a68795db12d9

Download Submit
C:\Windows\System\KvtJQra.exe

Filesize
3.2MB

MD5
272a51c7f2d1765cc3bd20cd315e2980

SHA1
63e4d0fd685257ca8f5d811d0fd45ae86b99acff

SHA256
508a9438452d3e58a34a754a434ea976fc9212cb3212db728cf6a975b0e01ac6

SHA512
5d0554247d515f54e45b6dd71aee4a7465b98fcb0edb75ee6ee4c06911050597b9ccc2175d89db1b67eb1b9fab22cb6854e3ff5c4e0d478648b072e8179f66b6

Download Submit
C:\Windows\System\LVFTTPN.exe

Filesize
3.2MB

MD5
ad7d2936860ec842cdbae70491e27039

SHA1
74b432ad2e348d843ea538aeb8a2a40cbe530600

SHA256
4245b21f3a40908112d9426ef2e7eb1e3c4de9e0c0367917c53a80f2f941f4fb

SHA512
2ca1916bde252f4336a48ebb87970dd067ad96e1d0016c0db0d02eb9aac1d4f0f22edaa1a7f92f11b34072fcab204bc089b2599a791ca41a1e2850c058799303

Download Submit
C:\Windows\System\MPKgaOr.exe

Filesize
3.2MB

MD5
91d774e2657e8482ccfd8cca7634989d

SHA1
26ac4d8a1a09a19263d4384a23f51abe22837169

SHA256
fc669194e4f4b753b992ee8c1427667814808af2fc781a81c09cc34c6688bb95

SHA512
f5899b377f8c25e0053e8b55b43fe70bbda395d1087e9e7aa7ec76cacc56743fd86b6fb9a12f3c5acc108c2a24dda95f040b843df9945ad09f730c2c1e684922

Download Submit
C:\Windows\System\NPOgzcU.exe

Filesize
3.2MB

MD5
f344c44d03e163d5c2a8ff7d59fd5058

SHA1
c7bcfef6c817321f53c0d953d4334ec648542b12

SHA256
bcecb153e272feeb26a21212a23644f2f777ebcc0045c19e1e4fe7e3f0c849c4

SHA512
8d436226847e57be44cfdb91af9d768a91a1af3e6653da05c378957d8b92e9a65f6ad551d50d4ea4be3a8d61d391a804074ad40e7840bbbcc7d6cf4492954d37

Download Submit
C:\Windows\System\SlKwVmH.exe

Filesize
3.2MB

MD5
6da439ff6a2d27ad35c104e6add7b168

SHA1
80a392fd8e4e113e82e4a683a8223a81bc8cad30

SHA256
3494c3fc4883512f4fd67a5bb48012fd3a761eac791d09cf8995f807611c6b8a

SHA512
380594469523dc951040a8317b355d49aa9b1f6aef0fef5fde4733a72e83cf31df03c42f2bf68402b2b24e3722127b3b18b484716b2cf610a1d212c8515ce457

Download Submit
C:\Windows\System\SwhXjuj.exe

Filesize
3.2MB

MD5
30460000d7aad1372deac15781075a0d

SHA1
639d1329e5db5a98622ed50ab333ce2414cacab9

SHA256
ac9d3402a49573bf6332149ad5a08259eaacd4bc6f5835afb4d4172c9cadb202

SHA512
090e6be5f9c024bee958dca749f3aedf5b102404c7a534878d71ca21223e94808f663bbdfb8cfe3f77e59e83dd9f99e343d7dfa67cea1d0cee3f83e7b27441c2

Download Submit
C:\Windows\System\ToHRqXB.exe

Filesize
3.2MB

MD5
e45f1c3d27b13420f650ddde11468030

SHA1
a982ca4cae1b77a3cdf52c6db81b4916ba9b9330

SHA256
5e681f53258711e7786fdc925373a26e59180a5ae57683251be1f9d75b5a28ec

SHA512
2bd497512ac615edbb94f6190393b259d32c635f4998ad43c32e14781e47e57559a2dbeee68f04b903533d82928d481bf1d49456f9f5b456b5e0d79797713cc8

Download Submit
C:\Windows\System\TwBtEWT.exe

Filesize
3.2MB

MD5
c58d73002ac7c48d39ea978e1a1be018

SHA1
2ee74a4e56d15aa571eb8fd891c0fb82ecc906a6

SHA256
e30796591754606bfed0863dc5bd5afe1821d76edf7d5ff3be690fc5755d3755

SHA512
e3bcb511d0362c420878f94a062186f1a9eb8a1e4077a13017250ae3446b1ab54507e62c3654de396620449cab27738066d9d399f235a7a5ecad91057142143c

Download Submit
C:\Windows\System\WvCYScM.exe

Filesize
3.2MB

MD5
9ba67101b53f8d207fefdc535a55bccf

SHA1
f12625469e522f136a3e7682eb1a9ab1927bf5ea

SHA256
75295515be48e92235ca51822036920e20b6c3bedf22cd539d5a6d449d1a1bf1

SHA512
e0a8d576671c22e08d911cf7e8443bf8cab76961c6e6001d7ecc4cdc1f63ce40fc5629d80684db787e22307d543d3b61c5ae0685b85746c03a92a2c286f6937d

Download Submit
C:\Windows\System\XSXyifu.exe

Filesize
3.2MB

MD5
8ddda109c933b4c1a7f4f864df17d050

SHA1
688771ea3379d3f3413b5f2b127b9fc380dfeca8

SHA256
4f966bdcdff9f4de5dc41be398568c21824f2d3bbbf950a3b537b419b4a5f636

SHA512
b8b015418ff174f49b837c2ea13a1794ca6b3d8e044d6f04025f72289bc599ee040b26431ff03807eca5c4198efbfd159ca8613453fe06fbab798c2637e984bc

Download Submit
C:\Windows\System\acywOxc.exe

Filesize
3.2MB

MD5
561e0e1d0abf6272b9dea677b83b0f7e

SHA1
81655675ca5774801547b003a5ee79cc503a9331

SHA256
a61e23a85b67a2104abbdb5fac6a342bb6ad7206f6c1c9291f06305bb2e3a9f9

SHA512
e902d30da9b9cfb40c8d1d56c983b4afa85c9388f85a0cb9e068e2a5b4c2961ae51df1264733191f8879d3a864becd275ddfd3f3529f868e00fd9ba167b68088

Download Submit
C:\Windows\System\diuIIzB.exe

Filesize
3.2MB

MD5
dcd6374e75373157d07fbe976a99b390

SHA1
9f0e87cab67470cac30ec0b3056ec760be3c3c3d

SHA256
691cb47f80619cb5cded0eedb3deb7d6e906e19cb06ee84e3feb291bb2eb7f31

SHA512
e93eb9470f51652ca146d17b25df188e90f0edd3689544a352f6b76539179f5700c729de4085fbae6fa8049c996d343cba97f01a537caad406f45dcc7dc31722

Download Submit
C:\Windows\System\eClVtak.exe

Filesize
3.2MB

MD5
80355ff36c71c74fe7f1aeb6b2834040

SHA1
94076c1e0247675c8ebf889d07de42107adbb4f7

SHA256
932937348674f11542b1d96470d79b813d3c849c5a6e8b348632f7fa2aa85dc3

SHA512
f127cd773e6c612b10053b00ddc521e34f8cf49596e28cea083d40e7c847af8247b9d239fac6582ac55bdc24afadaf18d698ec5c958004ce74f840daadca41d4

Download Submit
C:\Windows\System\hNCkvUG.exe

Filesize
3.2MB

MD5
3a5661fa73c345c85c9db12bb7077e1e

SHA1
b821672db2084f22c5dc72de9bdbd7a6251962fb

SHA256
8fdf1ff81de8683ab3c78543eb7de8ddf53b249cb40278e743cf09d1c9c3853f

SHA512
0214aaf05570d0bcdc8832f3a6ac989ed6c1e7a60410f7eda7c4babed9bb5f6e107b0e7d57484b6f935b76a94c49e798be3ee7941bf17cadd90f28e9b1406591

Download Submit
C:\Windows\System\jgMEBFk.exe

Filesize
3.2MB

MD5
5c8ee957cd5c621dd98662041ee71606

SHA1
1c2ad90746e1de96002a0e9408fa7eaff9744187

SHA256
e03561f2cba6d3cb25a7873985247fefe84bf0b0d2a3cbbd4faad23201614f3d

SHA512
68cf0c9e8516fd6716ba267b1a8dbfcfc0c975f52876ea506f72323ea9269fe40a5a8a4dc77aba552621773cef96f7d39cbe23437a512d4efa0a27370e2f931a

Download Submit
C:\Windows\System\jvqlFwd.exe

Filesize
3.2MB

MD5
2c1d8819cb3ebde1805e323e70ec543d

SHA1
6a5de898b37bc0911150bd3cfeb758a71a60f208

SHA256
59299ee8dabeccc2945f7e8166c3f28a220deb6f2820dc343636a8b8b985a693

SHA512
22207d1d1ab0338176bd3d7b49c7ee9f2de0a31a0211e64a24ab847caf42f657a542fe2769da65769149651c56c92b717fa51a78e84f6541444713c28eb31d7e

Download Submit
C:\Windows\System\jxewZek.exe

Filesize
3.2MB

MD5
e20f3478e0f00077d8c1b9124408cfbd

SHA1
f60a77dedcbec5409adb7be7013434375c7ccf04

SHA256
630aa18ea844535498238ca08ee6405025588d82fa77f3105bf6709cb5ac6cfb

SHA512
d89249787d02512c18bc6433db796e4ab39e4ed4c3de49e9acd82be5fbd06e2a2e2995199a0bf3595694fdc9d64b78b4ddb2d97144073920233e138b16f709b4

Download Submit
C:\Windows\System\mlhDgNb.exe

Filesize
3.2MB

MD5
19d2bd5c9e8f52512dbac28acb443488

SHA1
b12481c37ddacfaab2c300f800e8c9a9ef715cc5

SHA256
661d0823913236c9aba5a9cd78808633982c6f4241b32e69347c6424fe5926ff

SHA512
f14965d0cd0e3487b8acabf17334bb5b77493844dccd7c85fba2a3226fdb2e455350e3c4412878507e1c808e92835408d4078bc8f4a001547cbc75ab0fbc5c1a

Download Submit
C:\Windows\System\nZHCBsu.exe

Filesize
3.2MB

MD5
965e84be22d85201e9e07bb9285ed8a0

SHA1
353a642e1d159c5d9968b46e34c75eefe266d856

SHA256
3592d5488586565c3d7a5c5bb857ffe744e37ebccc70c7b8b57851ceae5a3a7f

SHA512
90fd7a5caa8b87d2dff1b40b3b752439fcee61e59acf687e0b6d5c9097f1c43a2e86b726c0f401cf9b1788e6c20a1dcffdb53e8003affe74f6ba2aa59ec385a3

Download Submit
C:\Windows\System\ndJqGCE.exe

Filesize
3.2MB

MD5
4c2ce2bcf963feb0635d300c8495bd71

SHA1
cbd3b63bfbe712c7b56368ee574edc4eaad614d4

SHA256
2701a79f2989b4167c652d8cab198a39c44778d16abd2414e29873104312ed56

SHA512
143658158b18c0818074e6833d9e83fb4650761cfb123720fa3e754a9debd659488285397c70ee638631ec32c111dc18d0b0db1ff8c1af90b9593c16229cfde2

Download Submit
C:\Windows\System\pSrZACO.exe

Filesize
3.2MB

MD5
7cb165e974e1f4f1be0c55f4f4104bc7

SHA1
6498b1f953a44c8cebe352ff36e9f6d5810e14e4

SHA256
a85c00ebe6c8cf3ae087c1108e9194cbcedf4143cf5873d3cb3cea2482fbf22b

SHA512
3b62613809829064cd349f0649bfbcc69e3264da023a9fbbf098c687182ef5915d73283708753189fbbf7285929eab4ed28b3922f540f866e3982cfc793b5d42

Download Submit
C:\Windows\System\rJGAiKm.exe

Filesize
3.2MB

MD5
fc364915d58de4426fce425993fbc1fe

SHA1
ee1ec0b32d678aace9e202cffae4271e495b5d77

SHA256
0df55eaadd94754de090fce7a4abdca8734881cf0895afa2d3158ccbba418180

SHA512
f46dde77e71738247d988dbb6ecd502906074717c1587e377a4980777170cbd65be67e109600b8e4f82139352f45e81eb6c852a5bd8d6688034d22e5ea9dd2ef

Download Submit
C:\Windows\System\szqQKuQ.exe

Filesize
3.2MB

MD5
ec8949cbebc765178f5370dc9a25168d

SHA1
af920a928a0331caf05bf6834c29f4394a02306e

SHA256
f881d7ebb69bbea9614a3e8a895c2fe5f8b4eab4d470569fbb4002d7d5bd1e8b

SHA512
e7c00bc9910633dd67ba5c9ae84ac8b1359358e180784ba6aee9449a74db2ce1b489e510d153b7dd03a2bead0829099084bfe75d8ef1609f405b00541160fc23

Download Submit
C:\Windows\System\xWRClRP.exe

Filesize
3.2MB

MD5
7998a8207fef12c3b50a903d3463c86c

SHA1
b27ec04c6deff8f69c24aa8d6b590ea1b64a32a0

SHA256
93fed1175267bb7c28e501bb63ae2b577719c7a36fde9504dc932dc809683aca

SHA512
5d93c24f6075e9e07d204ce46239e5301c5720fd273882952911aa77c78167f3a53e01cc2d126edad9e56e4e39075b277fafb0035194711b06ae2f0e45e5607b

Download Submit
C:\Windows\System\xbLONsF.exe

Filesize
3.2MB

MD5
733a83997e20a557dc4ad621bd397ea5

SHA1
9ad16a8ab21b32ba5ea648723e7f24472f2f4995

SHA256
a49a03e2c905bc2d36b4389bae50affddde0d54ca3bbd40f42d6626598360b9d

SHA512
cf88d78ac071f49e449e681b562706888f820422db4ebc6ba99415c06dda713348d19d93fef7436c96536c34960931e7f631e64f29a0fbf739c088f565823d7c

Download Submit
memory/400-642-0x00007FF7EE6C0000-0x00007FF7EEAB6000-memory.dmp

Filesize
4.0MB

Download
memory/400-784-0x00007FF7EE6C0000-0x00007FF7EEAB6000-memory.dmp

Filesize
4.0MB

Download
memory/1028-611-0x00007FF763710000-0x00007FF763B06000-memory.dmp

Filesize
4.0MB

Download
memory/1028-739-0x00007FF763710000-0x00007FF763B06000-memory.dmp

Filesize
4.0MB

Download
memory/1280-777-0x00007FF6C1BC0000-0x00007FF6C1FB6000-memory.dmp

Filesize
4.0MB

Download
memory/1280-627-0x00007FF6C1BC0000-0x00007FF6C1FB6000-memory.dmp

Filesize
4.0MB

Download
memory/1436-725-0x00007FF736890000-0x00007FF736C86000-memory.dmp

Filesize
4.0MB

Download
memory/1436-70-0x00007FF736890000-0x00007FF736C86000-memory.dmp

Filesize
4.0MB

Download
memory/1664-698-0x00007FF6C8720000-0x00007FF6C8B16000-memory.dmp

Filesize
4.0MB

Download
memory/1664-780-0x00007FF6C8720000-0x00007FF6C8B16000-memory.dmp

Filesize
4.0MB

Download
memory/1676-745-0x00007FF7A1540000-0x00007FF7A1936000-memory.dmp

Filesize
4.0MB

Download
memory/1676-707-0x00007FF7A1540000-0x00007FF7A1936000-memory.dmp

Filesize
4.0MB

Download
memory/1852-708-0x00007FF7D1D60000-0x00007FF7D2156000-memory.dmp

Filesize
4.0MB

Download
memory/1852-776-0x00007FF7D1D60000-0x00007FF7D2156000-memory.dmp

Filesize
4.0MB

Download
memory/1944-1992-0x00007FF920E60000-0x00007FF921921000-memory.dmp

Filesize
10.8MB

Download
memory/1944-3-0x00007FF920E63000-0x00007FF920E65000-memory.dmp

Filesize
8KB

Download
memory/1944-704-0x00007FF920E60000-0x00007FF921921000-memory.dmp

Filesize
10.8MB

Download
memory/1944-239-0x00000246766A0000-0x0000024676E46000-memory.dmp

Filesize
7.6MB

Download
memory/1944-57-0x00007FF920E60000-0x00007FF921921000-memory.dmp

Filesize
10.8MB

Download
memory/1944-1986-0x00007FF920E63000-0x00007FF920E65000-memory.dmp

Filesize
8KB

Download
memory/1944-2183-0x00007FF920E60000-0x00007FF921921000-memory.dmp

Filesize
10.8MB

Download
memory/1944-26-0x0000024674DB0000-0x0000024674DD2000-memory.dmp

Filesize
136KB

Download
memory/2276-646-0x00007FF6003E0000-0x00007FF6007D6000-memory.dmp

Filesize
4.0MB

Download
memory/2276-782-0x00007FF6003E0000-0x00007FF6007D6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-671-0x00007FF7C16D0000-0x00007FF7C1AC6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-789-0x00007FF7C16D0000-0x00007FF7C1AC6000-memory.dmp

Filesize
4.0MB

Download
memory/2436-660-0x00007FF7BD2D0000-0x00007FF7BD6C6000-memory.dmp

Filesize
4.0MB

Download
memory/2436-787-0x00007FF7BD2D0000-0x00007FF7BD6C6000-memory.dmp

Filesize
4.0MB

Download
memory/2856-618-0x00007FF645DB0000-0x00007FF6461A6000-memory.dmp

Filesize
4.0MB

Download
memory/2856-743-0x00007FF645DB0000-0x00007FF6461A6000-memory.dmp

Filesize
4.0MB

Download
memory/3308-706-0x00007FF6567A0000-0x00007FF656B96000-memory.dmp

Filesize
4.0MB

Download
memory/3308-744-0x00007FF6567A0000-0x00007FF656B96000-memory.dmp

Filesize
4.0MB

Download
memory/3540-64-0x00007FF6DC770000-0x00007FF6DCB66000-memory.dmp

Filesize
4.0MB

Download
memory/3540-722-0x00007FF6DC770000-0x00007FF6DCB66000-memory.dmp

Filesize
4.0MB

Download
memory/3548-621-0x00007FF7BB440000-0x00007FF7BB836000-memory.dmp

Filesize
4.0MB

Download
memory/3548-790-0x00007FF7BB440000-0x00007FF7BB836000-memory.dmp

Filesize
4.0MB

Download
memory/3892-726-0x00007FF715F20000-0x00007FF716316000-memory.dmp

Filesize
4.0MB

Download
memory/3892-74-0x00007FF715F20000-0x00007FF716316000-memory.dmp

Filesize
4.0MB

Download
memory/3908-779-0x00007FF737EA0000-0x00007FF738296000-memory.dmp

Filesize
4.0MB

Download
memory/3908-692-0x00007FF737EA0000-0x00007FF738296000-memory.dmp

Filesize
4.0MB

Download
memory/4064-788-0x00007FF7A53F0000-0x00007FF7A57E6000-memory.dmp

Filesize
4.0MB

Download
memory/4064-677-0x00007FF7A53F0000-0x00007FF7A57E6000-memory.dmp

Filesize
4.0MB

Download
memory/4144-75-0x00007FF74EBE0000-0x00007FF74EFD6000-memory.dmp

Filesize
4.0MB

Download
memory/4144-730-0x00007FF74EBE0000-0x00007FF74EFD6000-memory.dmp

Filesize
4.0MB

Download
memory/4356-61-0x00007FF6B5100000-0x00007FF6B54F6000-memory.dmp

Filesize
4.0MB

Download
memory/4356-718-0x00007FF6B5100000-0x00007FF6B54F6000-memory.dmp

Filesize
4.0MB

Download
memory/4456-781-0x00007FF679E20000-0x00007FF67A216000-memory.dmp

Filesize
4.0MB

Download
memory/4456-701-0x00007FF679E20000-0x00007FF67A216000-memory.dmp

Filesize
4.0MB

Download
memory/4528-716-0x00007FF7399B0000-0x00007FF739DA6000-memory.dmp

Filesize
4.0MB

Download
memory/4528-705-0x00007FF7399B0000-0x00007FF739DA6000-memory.dmp

Filesize
4.0MB

Download
memory/4768-636-0x00007FF6F17D0000-0x00007FF6F1BC6000-memory.dmp

Filesize
4.0MB

Download
memory/4768-783-0x00007FF6F17D0000-0x00007FF6F1BC6000-memory.dmp

Filesize
4.0MB

Download
memory/4800-778-0x00007FF76DA70000-0x00007FF76DE66000-memory.dmp

Filesize
4.0MB

Download
memory/4800-654-0x00007FF76DA70000-0x00007FF76DE66000-memory.dmp

Filesize
4.0MB

Download
memory/4952-0-0x00007FF7700F0000-0x00007FF7704E6000-memory.dmp

Filesize
4.0MB

Download
memory/4952-1787-0x00007FF7700F0000-0x00007FF7704E6000-memory.dmp

Filesize
4.0MB

Download
memory/4952-1-0x00000278F34B0000-0x00000278F34C0000-memory.dmp

Filesize
64KB

Download
memory/5112-608-0x00007FF6B0020000-0x00007FF6B0416000-memory.dmp

Filesize
4.0MB

Download
memory/5112-735-0x00007FF6B0020000-0x00007FF6B0416000-memory.dmp

Filesize
4.0MB

Download