xmrig | f376949c9e90e5e308dae400ba2620f412949894f8fbbcc8d5824e1887964ac6

Analysis

max time kernel
120s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

258252cd52185b22f25b9b059a8d8ae0N.exe
Size

2.3MB
MD5

258252cd52185b22f25b9b059a8d8ae0
SHA1

fb69ae70692c1909977f79f0c548349d1df464e2
SHA256

f376949c9e90e5e308dae400ba2620f412949894f8fbbcc8d5824e1887964ac6
SHA512

607a6da29b4188a6a6ed58a6c3e314def6fae874029927314553fdacace60dd9b07541798d30ecb7b52af71fbb5bed0505323cafa8a2f9b9789d083db5a959b4
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTlew:NABl

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/1740-105-0x00007FF6A70A0000-0x00007FF6A7492000-memory.dmp	xmrig
behavioral2/memory/4268-192-0x00007FF66CF10000-0x00007FF66D302000-memory.dmp	xmrig
behavioral2/memory/4180-226-0x00007FF7FCFD0000-0x00007FF7FD3C2000-memory.dmp	xmrig
behavioral2/memory/1952-298-0x00007FF784FC0000-0x00007FF7853B2000-memory.dmp	xmrig
behavioral2/memory/3732-316-0x00007FF6ED3F0000-0x00007FF6ED7E2000-memory.dmp	xmrig
behavioral2/memory/1212-297-0x00007FF7A4A40000-0x00007FF7A4E32000-memory.dmp	xmrig
behavioral2/memory/4612-286-0x00007FF7F4DA0000-0x00007FF7F5192000-memory.dmp	xmrig
behavioral2/memory/3824-264-0x00007FF732F10000-0x00007FF733302000-memory.dmp	xmrig
behavioral2/memory/1180-263-0x00007FF648080000-0x00007FF648472000-memory.dmp	xmrig
behavioral2/memory/2888-252-0x00007FF7F7600000-0x00007FF7F79F2000-memory.dmp	xmrig
behavioral2/memory/1156-251-0x00007FF752FD0000-0x00007FF7533C2000-memory.dmp	xmrig
behavioral2/memory/1648-241-0x00007FF6867D0000-0x00007FF686BC2000-memory.dmp	xmrig
behavioral2/memory/2984-225-0x00007FF63C580000-0x00007FF63C972000-memory.dmp	xmrig
behavioral2/memory/1984-207-0x00007FF7A2680000-0x00007FF7A2A72000-memory.dmp	xmrig
behavioral2/memory/3028-186-0x00007FF77E0A0000-0x00007FF77E492000-memory.dmp	xmrig
behavioral2/memory/3896-176-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp	xmrig
behavioral2/memory/4944-168-0x00007FF7B4180000-0x00007FF7B4572000-memory.dmp	xmrig
behavioral2/memory/2760-167-0x00007FF6B7A90000-0x00007FF6B7E82000-memory.dmp	xmrig
behavioral2/memory/2188-151-0x00007FF6F9FC0000-0x00007FF6FA3B2000-memory.dmp	xmrig
behavioral2/memory/4284-80-0x00007FF691EA0000-0x00007FF692292000-memory.dmp	xmrig
behavioral2/memory/1908-58-0x00007FF6E2880000-0x00007FF6E2C72000-memory.dmp	xmrig
behavioral2/memory/1040-31-0x00007FF605BF0000-0x00007FF605FE2000-memory.dmp	xmrig
behavioral2/memory/1908-4624-0x00007FF6E2880000-0x00007FF6E2C72000-memory.dmp	xmrig
behavioral2/memory/1332-4635-0x00007FF78FE40000-0x00007FF790232000-memory.dmp	xmrig
behavioral2/memory/4284-4640-0x00007FF691EA0000-0x00007FF692292000-memory.dmp	xmrig
behavioral2/memory/2188-4643-0x00007FF6F9FC0000-0x00007FF6FA3B2000-memory.dmp	xmrig
behavioral2/memory/4612-4647-0x00007FF7F4DA0000-0x00007FF7F5192000-memory.dmp	xmrig
behavioral2/memory/1740-4653-0x00007FF6A70A0000-0x00007FF6A7492000-memory.dmp	xmrig
behavioral2/memory/4944-4657-0x00007FF7B4180000-0x00007FF7B4572000-memory.dmp	xmrig
behavioral2/memory/2760-4650-0x00007FF6B7A90000-0x00007FF6B7E82000-memory.dmp	xmrig
behavioral2/memory/3896-4667-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp	xmrig
behavioral2/memory/3028-4663-0x00007FF77E0A0000-0x00007FF77E492000-memory.dmp	xmrig
behavioral2/memory/1212-4673-0x00007FF7A4A40000-0x00007FF7A4E32000-memory.dmp	xmrig
behavioral2/memory/4180-4683-0x00007FF7FCFD0000-0x00007FF7FD3C2000-memory.dmp	xmrig
behavioral2/memory/2888-4691-0x00007FF7F7600000-0x00007FF7F79F2000-memory.dmp	xmrig
behavioral2/memory/1648-4689-0x00007FF6867D0000-0x00007FF686BC2000-memory.dmp	xmrig
behavioral2/memory/1156-4685-0x00007FF752FD0000-0x00007FF7533C2000-memory.dmp	xmrig
behavioral2/memory/4268-4680-0x00007FF66CF10000-0x00007FF66D302000-memory.dmp	xmrig
behavioral2/memory/2984-4677-0x00007FF63C580000-0x00007FF63C972000-memory.dmp	xmrig
behavioral2/memory/1180-4717-0x00007FF648080000-0x00007FF648472000-memory.dmp	xmrig
behavioral2/memory/3824-4715-0x00007FF732F10000-0x00007FF733302000-memory.dmp	xmrig
behavioral2/memory/3732-4720-0x00007FF6ED3F0000-0x00007FF6ED7E2000-memory.dmp	xmrig
behavioral2/memory/1984-4714-0x00007FF7A2680000-0x00007FF7A2A72000-memory.dmp	xmrig
behavioral2/memory/1952-4703-0x00007FF784FC0000-0x00007FF7853B2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4720	powershell.exe
5	4720	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4720	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2280	BQzfubL.exe
1908	lISmOAk.exe
4284	NfUgUZx.exe
1332	UrrHcdt.exe
1040	eisniJo.exe
4612	OnjsFrz.exe
1740	XMWNwQe.exe
2188	Ijmcuwj.exe
2760	BjfyCGr.exe
4944	VzQlgUP.exe
3896	yzrzacQ.exe
3028	wIEKpQc.exe
4268	qvRWLVI.exe
1212	OmhgADk.exe
1984	QMdOpOK.exe
1952	NoAVAJI.exe
2984	kRtmvgo.exe
4180	AMwoPGk.exe
1648	BCDqYEF.exe
1156	qunPznw.exe
2888	xOkZWEz.exe
3732	cnuVRRr.exe
1180	jOLcNzd.exe
3824	LLzvNLC.exe
1584	kdYYYFU.exe
1608	UUGvOue.exe
4224	dTdlaxa.exe
3276	SjyMbGE.exe
2844	zLWRZwP.exe
3560	FXVORaz.exe
3212	rtUngMJ.exe
4148	rSJJdCP.exe
5028	WFGYeGV.exe
1476	CtsRqhu.exe
1868	LuvAsgv.exe
3920	amgIhwi.exe
3584	cpZXhJf.exe
4396	AwpsNmK.exe
3676	MuvRwhk.exe
2452	VPXaXRV.exe
3244	hQpmmUI.exe
4512	LTmvCIo.exe
4444	GgMzTyn.exe
2776	wmfFJUS.exe
4480	fmkfyQS.exe
4976	LBQxWUg.exe
1860	PUgotho.exe
2520	pUztiJb.exe
220	FBivMLn.exe
1992	yqzfTot.exe
1996	yeypabR.exe
4288	YBPQNXB.exe
4588	KMhVTDG.exe
1472	QRSwHQX.exe
2148	nNkxZQO.exe
1096	nBRKxVv.exe
4680	oMPLDVR.exe
4372	CZSrSYH.exe
2028	BpbMdia.exe
4000	zApeByo.exe
2388	aYPwBVs.exe
224	oaVUwWj.exe
728	VEDsdiq.exe
3816	CubTSvF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4408-0-0x00007FF7595B0000-0x00007FF7599A2000-memory.dmp	upx
behavioral2/files/0x00090000000233b8-8.dat	upx
behavioral2/files/0x00090000000233bc-7.dat	upx
behavioral2/files/0x000b0000000233b2-5.dat	upx
behavioral2/memory/1332-25-0x00007FF78FE40000-0x00007FF790232000-memory.dmp	upx
behavioral2/files/0x00080000000233be-34.dat	upx
behavioral2/files/0x00080000000233c2-41.dat	upx
behavioral2/files/0x00070000000234bb-107.dat	upx
behavioral2/memory/1740-105-0x00007FF6A70A0000-0x00007FF6A7492000-memory.dmp	upx
behavioral2/files/0x00070000000234c4-143.dat	upx
behavioral2/files/0x00070000000234c9-172.dat	upx
behavioral2/memory/4268-192-0x00007FF66CF10000-0x00007FF66D302000-memory.dmp	upx
behavioral2/memory/4180-226-0x00007FF7FCFD0000-0x00007FF7FD3C2000-memory.dmp	upx
behavioral2/memory/1952-298-0x00007FF784FC0000-0x00007FF7853B2000-memory.dmp	upx
behavioral2/memory/3732-316-0x00007FF6ED3F0000-0x00007FF6ED7E2000-memory.dmp	upx
behavioral2/memory/1212-297-0x00007FF7A4A40000-0x00007FF7A4E32000-memory.dmp	upx
behavioral2/memory/4612-286-0x00007FF7F4DA0000-0x00007FF7F5192000-memory.dmp	upx
behavioral2/memory/3824-264-0x00007FF732F10000-0x00007FF733302000-memory.dmp	upx
behavioral2/memory/1180-263-0x00007FF648080000-0x00007FF648472000-memory.dmp	upx
behavioral2/memory/2888-252-0x00007FF7F7600000-0x00007FF7F79F2000-memory.dmp	upx
behavioral2/memory/1156-251-0x00007FF752FD0000-0x00007FF7533C2000-memory.dmp	upx
behavioral2/memory/1648-241-0x00007FF6867D0000-0x00007FF686BC2000-memory.dmp	upx
behavioral2/memory/2984-225-0x00007FF63C580000-0x00007FF63C972000-memory.dmp	upx
behavioral2/memory/1984-207-0x00007FF7A2680000-0x00007FF7A2A72000-memory.dmp	upx
behavioral2/memory/3028-186-0x00007FF77E0A0000-0x00007FF77E492000-memory.dmp	upx
behavioral2/memory/3896-176-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp	upx
behavioral2/files/0x00070000000234c8-171.dat	upx
behavioral2/memory/4944-168-0x00007FF7B4180000-0x00007FF7B4572000-memory.dmp	upx
behavioral2/memory/2760-167-0x00007FF6B7A90000-0x00007FF6B7E82000-memory.dmp	upx
behavioral2/files/0x00070000000234c6-165.dat	upx
behavioral2/files/0x00070000000234c0-163.dat	upx
behavioral2/files/0x00070000000234cd-160.dat	upx
behavioral2/files/0x00070000000234cc-159.dat	upx
behavioral2/files/0x00070000000234c2-157.dat	upx
behavioral2/files/0x00070000000234ca-156.dat	upx
behavioral2/files/0x00070000000234ba-155.dat	upx
behavioral2/files/0x00070000000234c1-170.dat	upx
behavioral2/files/0x00070000000234c7-152.dat	upx
behavioral2/memory/2188-151-0x00007FF6F9FC0000-0x00007FF6FA3B2000-memory.dmp	upx
behavioral2/files/0x00080000000234b8-148.dat	upx
behavioral2/files/0x00070000000234c5-147.dat	upx
behavioral2/files/0x00070000000234c3-139.dat	upx
behavioral2/files/0x00070000000234bf-137.dat	upx
behavioral2/files/0x00070000000234cb-158.dat	upx
behavioral2/files/0x00070000000234bd-131.dat	upx
behavioral2/files/0x00080000000233d0-120.dat	upx
behavioral2/files/0x00080000000233d9-109.dat	upx
behavioral2/files/0x00070000000234be-101.dat	upx
behavioral2/files/0x00070000000234b9-95.dat	upx
behavioral2/files/0x00070000000234bc-92.dat	upx
behavioral2/files/0x00080000000233d8-96.dat	upx
behavioral2/files/0x00080000000233d3-81.dat	upx
behavioral2/memory/4284-80-0x00007FF691EA0000-0x00007FF692292000-memory.dmp	upx
behavioral2/files/0x00090000000233d2-74.dat	upx
behavioral2/files/0x00080000000233d1-66.dat	upx
behavioral2/memory/1908-58-0x00007FF6E2880000-0x00007FF6E2C72000-memory.dmp	upx
behavioral2/files/0x00080000000233ca-55.dat	upx
behavioral2/files/0x00080000000233cd-57.dat	upx
behavioral2/memory/1040-31-0x00007FF605BF0000-0x00007FF605FE2000-memory.dmp	upx
behavioral2/files/0x00080000000233bf-23.dat	upx
behavioral2/memory/2280-22-0x00007FF699B40000-0x00007FF699F32000-memory.dmp	upx
behavioral2/memory/1908-4624-0x00007FF6E2880000-0x00007FF6E2C72000-memory.dmp	upx
behavioral2/memory/1332-4635-0x00007FF78FE40000-0x00007FF790232000-memory.dmp	upx
behavioral2/memory/4284-4640-0x00007FF691EA0000-0x00007FF692292000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mskOwnb.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\GsSAkAR.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\otQbnAZ.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\HiddiUx.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\LjymrnX.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\kPAtviv.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\NqdpUaW.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\ZvaiKEu.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\CECNZam.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\JvMXWWA.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\juvMLfH.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\dAgBgUv.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\CbSlwHR.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\SjyMbGE.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\yhKUcIE.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\HDRdisp.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\aoINMlM.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\wEafpMd.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\xOCedGr.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\hjPDLjf.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\FJXsGNK.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\UkJRQJc.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\BJrRrtY.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\gaIYnYu.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\MgWaHQi.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\BbmlplT.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\gBBHIWd.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\xqdbyey.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\mLHNKoc.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\RrfsNle.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\DsJvYCs.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\blXnTfC.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\DjtgFKL.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\YPvcFTA.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\aljXWyQ.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\ZhZiJqs.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\brnzwrp.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\GCAyTYr.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\QnBnSKX.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\utGxYtj.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\krVKkRn.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\fReNKlT.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\FlYBqio.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\dSyIggD.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\XVmVSiU.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\guilcRo.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\SuzitWP.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\BtUjigU.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\heLPzrl.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\vGcpSgu.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\BQYuLAH.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\cLRTbNQ.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\dKISShe.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\EILgSvB.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\xRTtNBw.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\yxwjvKT.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\vTVHRdd.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\fKYbHDL.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\UldrxhM.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\FacfJOi.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\TuUziou.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\LFgxzRU.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\kmrZmgM.exe	258252cd52185b22f25b9b059a8d8ae0N.exe
File created	C:\Windows\System\ZmBZVrX.exe	258252cd52185b22f25b9b059a8d8ae0N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4720	powershell.exe
4720	powershell.exe
4720	powershell.exe
4720	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4408	258252cd52185b22f25b9b059a8d8ae0N.exe
Token: SeLockMemoryPrivilege	4408	258252cd52185b22f25b9b059a8d8ae0N.exe
Token: SeDebugPrivilege	4720	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4720	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	87
PID 4408 wrote to memory of 4720	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	87
PID 4408 wrote to memory of 2280	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	88
PID 4408 wrote to memory of 2280	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	88
PID 4408 wrote to memory of 1908	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	89
PID 4408 wrote to memory of 1908	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	89
PID 4408 wrote to memory of 4284	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	90
PID 4408 wrote to memory of 4284	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	90
PID 4408 wrote to memory of 1332	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	91
PID 4408 wrote to memory of 1332	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	91
PID 4408 wrote to memory of 1040	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	92
PID 4408 wrote to memory of 1040	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	92
PID 4408 wrote to memory of 1740	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	93
PID 4408 wrote to memory of 1740	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	93
PID 4408 wrote to memory of 4612	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	94
PID 4408 wrote to memory of 4612	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	94
PID 4408 wrote to memory of 2188	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	95
PID 4408 wrote to memory of 2188	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	95
PID 4408 wrote to memory of 4268	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	96
PID 4408 wrote to memory of 4268	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	96
PID 4408 wrote to memory of 2760	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	97
PID 4408 wrote to memory of 2760	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	97
PID 4408 wrote to memory of 4944	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	98
PID 4408 wrote to memory of 4944	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	98
PID 4408 wrote to memory of 3896	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	99
PID 4408 wrote to memory of 3896	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	99
PID 4408 wrote to memory of 3028	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	100
PID 4408 wrote to memory of 3028	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	100
PID 4408 wrote to memory of 1212	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	101
PID 4408 wrote to memory of 1212	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	101
PID 4408 wrote to memory of 1984	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	102
PID 4408 wrote to memory of 1984	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	102
PID 4408 wrote to memory of 4180	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	103
PID 4408 wrote to memory of 4180	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	103
PID 4408 wrote to memory of 1952	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	104
PID 4408 wrote to memory of 1952	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	104
PID 4408 wrote to memory of 3732	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	105
PID 4408 wrote to memory of 3732	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	105
PID 4408 wrote to memory of 2984	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	106
PID 4408 wrote to memory of 2984	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	106
PID 4408 wrote to memory of 1648	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	107
PID 4408 wrote to memory of 1648	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	107
PID 4408 wrote to memory of 1156	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	108
PID 4408 wrote to memory of 1156	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	108
PID 4408 wrote to memory of 2888	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	109
PID 4408 wrote to memory of 2888	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	109
PID 4408 wrote to memory of 1180	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	110
PID 4408 wrote to memory of 1180	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	110
PID 4408 wrote to memory of 3824	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	111
PID 4408 wrote to memory of 3824	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	111
PID 4408 wrote to memory of 1584	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	112
PID 4408 wrote to memory of 1584	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	112
PID 4408 wrote to memory of 1608	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	113
PID 4408 wrote to memory of 1608	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	113
PID 4408 wrote to memory of 4224	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	114
PID 4408 wrote to memory of 4224	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	114
PID 4408 wrote to memory of 3276	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	115
PID 4408 wrote to memory of 3276	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	115
PID 4408 wrote to memory of 2844	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	116
PID 4408 wrote to memory of 2844	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	116
PID 4408 wrote to memory of 3560	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	117
PID 4408 wrote to memory of 3560	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	117
PID 4408 wrote to memory of 3212	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	118
PID 4408 wrote to memory of 3212	4408	258252cd52185b22f25b9b059a8d8ae0N.exe	118

C:\Users\Admin\AppData\Local\Temp\258252cd52185b22f25b9b059a8d8ae0N.exe
"C:\Users\Admin\AppData\Local\Temp\258252cd52185b22f25b9b059a8d8ae0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4720" "2956" "2888" "2960" "0" "0" "2964" "0" "0" "0" "0" "0"
    3⤵
    PID:11596
- C:\Windows\System\BQzfubL.exe
  C:\Windows\System\BQzfubL.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\lISmOAk.exe
  C:\Windows\System\lISmOAk.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\NfUgUZx.exe
  C:\Windows\System\NfUgUZx.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\UrrHcdt.exe
  C:\Windows\System\UrrHcdt.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\eisniJo.exe
  C:\Windows\System\eisniJo.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\XMWNwQe.exe
  C:\Windows\System\XMWNwQe.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\OnjsFrz.exe
  C:\Windows\System\OnjsFrz.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\Ijmcuwj.exe
  C:\Windows\System\Ijmcuwj.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\qvRWLVI.exe
  C:\Windows\System\qvRWLVI.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\BjfyCGr.exe
  C:\Windows\System\BjfyCGr.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\VzQlgUP.exe
  C:\Windows\System\VzQlgUP.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\yzrzacQ.exe
  C:\Windows\System\yzrzacQ.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\wIEKpQc.exe
  C:\Windows\System\wIEKpQc.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\OmhgADk.exe
  C:\Windows\System\OmhgADk.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\QMdOpOK.exe
  C:\Windows\System\QMdOpOK.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\AMwoPGk.exe
  C:\Windows\System\AMwoPGk.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\NoAVAJI.exe
  C:\Windows\System\NoAVAJI.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\cnuVRRr.exe
  C:\Windows\System\cnuVRRr.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\kRtmvgo.exe
  C:\Windows\System\kRtmvgo.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\BCDqYEF.exe
  C:\Windows\System\BCDqYEF.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\qunPznw.exe
  C:\Windows\System\qunPznw.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\xOkZWEz.exe
  C:\Windows\System\xOkZWEz.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\jOLcNzd.exe
  C:\Windows\System\jOLcNzd.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\LLzvNLC.exe
  C:\Windows\System\LLzvNLC.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\kdYYYFU.exe
  C:\Windows\System\kdYYYFU.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\UUGvOue.exe
  C:\Windows\System\UUGvOue.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\dTdlaxa.exe
  C:\Windows\System\dTdlaxa.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\SjyMbGE.exe
  C:\Windows\System\SjyMbGE.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\zLWRZwP.exe
  C:\Windows\System\zLWRZwP.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\FXVORaz.exe
  C:\Windows\System\FXVORaz.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\rtUngMJ.exe
  C:\Windows\System\rtUngMJ.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\rSJJdCP.exe
  C:\Windows\System\rSJJdCP.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\WFGYeGV.exe
  C:\Windows\System\WFGYeGV.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\cpZXhJf.exe
  C:\Windows\System\cpZXhJf.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\CtsRqhu.exe
  C:\Windows\System\CtsRqhu.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\LuvAsgv.exe
  C:\Windows\System\LuvAsgv.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\amgIhwi.exe
  C:\Windows\System\amgIhwi.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\AwpsNmK.exe
  C:\Windows\System\AwpsNmK.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\MuvRwhk.exe
  C:\Windows\System\MuvRwhk.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\VPXaXRV.exe
  C:\Windows\System\VPXaXRV.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\hQpmmUI.exe
  C:\Windows\System\hQpmmUI.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\LTmvCIo.exe
  C:\Windows\System\LTmvCIo.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\GgMzTyn.exe
  C:\Windows\System\GgMzTyn.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\wmfFJUS.exe
  C:\Windows\System\wmfFJUS.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\fmkfyQS.exe
  C:\Windows\System\fmkfyQS.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\LBQxWUg.exe
  C:\Windows\System\LBQxWUg.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\PUgotho.exe
  C:\Windows\System\PUgotho.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\pUztiJb.exe
  C:\Windows\System\pUztiJb.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\FBivMLn.exe
  C:\Windows\System\FBivMLn.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\yqzfTot.exe
  C:\Windows\System\yqzfTot.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\yeypabR.exe
  C:\Windows\System\yeypabR.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\YBPQNXB.exe
  C:\Windows\System\YBPQNXB.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\KMhVTDG.exe
  C:\Windows\System\KMhVTDG.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\QRSwHQX.exe
  C:\Windows\System\QRSwHQX.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\nNkxZQO.exe
  C:\Windows\System\nNkxZQO.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\nBRKxVv.exe
  C:\Windows\System\nBRKxVv.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\oMPLDVR.exe
  C:\Windows\System\oMPLDVR.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\CZSrSYH.exe
  C:\Windows\System\CZSrSYH.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\BpbMdia.exe
  C:\Windows\System\BpbMdia.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\zApeByo.exe
  C:\Windows\System\zApeByo.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\aYPwBVs.exe
  C:\Windows\System\aYPwBVs.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\oaVUwWj.exe
  C:\Windows\System\oaVUwWj.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\qhmlDis.exe
  C:\Windows\System\qhmlDis.exe
  2⤵
  PID:904
- C:\Windows\System\VEDsdiq.exe
  C:\Windows\System\VEDsdiq.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\CubTSvF.exe
  C:\Windows\System\CubTSvF.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\ycYkjjp.exe
  C:\Windows\System\ycYkjjp.exe
  2⤵
  PID:3980
- C:\Windows\System\HQuVsZm.exe
  C:\Windows\System\HQuVsZm.exe
  2⤵
  PID:2468
- C:\Windows\System\dEJXYyc.exe
  C:\Windows\System\dEJXYyc.exe
  2⤵
  PID:4996
- C:\Windows\System\wPMMLHy.exe
  C:\Windows\System\wPMMLHy.exe
  2⤵
  PID:4328
- C:\Windows\System\bjyMdOc.exe
  C:\Windows\System\bjyMdOc.exe
  2⤵
  PID:2132
- C:\Windows\System\ZLZFNZv.exe
  C:\Windows\System\ZLZFNZv.exe
  2⤵
  PID:780
- C:\Windows\System\wvZeKEw.exe
  C:\Windows\System\wvZeKEw.exe
  2⤵
  PID:3592
- C:\Windows\System\NJJamNk.exe
  C:\Windows\System\NJJamNk.exe
  2⤵
  PID:4272
- C:\Windows\System\muEkDTx.exe
  C:\Windows\System\muEkDTx.exe
  2⤵
  PID:3012
- C:\Windows\System\EqDNQqm.exe
  C:\Windows\System\EqDNQqm.exe
  2⤵
  PID:1252
- C:\Windows\System\bAIYGAH.exe
  C:\Windows\System\bAIYGAH.exe
  2⤵
  PID:5156
- C:\Windows\System\qSbhWrn.exe
  C:\Windows\System\qSbhWrn.exe
  2⤵
  PID:5172
- C:\Windows\System\IwlFMno.exe
  C:\Windows\System\IwlFMno.exe
  2⤵
  PID:5196
- C:\Windows\System\DOkwGBT.exe
  C:\Windows\System\DOkwGBT.exe
  2⤵
  PID:5224
- C:\Windows\System\aEhjSem.exe
  C:\Windows\System\aEhjSem.exe
  2⤵
  PID:5276
- C:\Windows\System\xnDFJEq.exe
  C:\Windows\System\xnDFJEq.exe
  2⤵
  PID:5412
- C:\Windows\System\KZgAENd.exe
  C:\Windows\System\KZgAENd.exe
  2⤵
  PID:5436
- C:\Windows\System\VnxFecT.exe
  C:\Windows\System\VnxFecT.exe
  2⤵
  PID:5464
- C:\Windows\System\MtbGOtK.exe
  C:\Windows\System\MtbGOtK.exe
  2⤵
  PID:5480
- C:\Windows\System\MhunMxB.exe
  C:\Windows\System\MhunMxB.exe
  2⤵
  PID:5596
- C:\Windows\System\ZpbClxU.exe
  C:\Windows\System\ZpbClxU.exe
  2⤵
  PID:5612
- C:\Windows\System\CgkUWhi.exe
  C:\Windows\System\CgkUWhi.exe
  2⤵
  PID:5632
- C:\Windows\System\fROORkU.exe
  C:\Windows\System\fROORkU.exe
  2⤵
  PID:5648
- C:\Windows\System\dJozhNc.exe
  C:\Windows\System\dJozhNc.exe
  2⤵
  PID:5664
- C:\Windows\System\SfXOBam.exe
  C:\Windows\System\SfXOBam.exe
  2⤵
  PID:5680
- C:\Windows\System\Fztgppa.exe
  C:\Windows\System\Fztgppa.exe
  2⤵
  PID:5696
- C:\Windows\System\kpqxAhU.exe
  C:\Windows\System\kpqxAhU.exe
  2⤵
  PID:5712
- C:\Windows\System\ZglNWYC.exe
  C:\Windows\System\ZglNWYC.exe
  2⤵
  PID:5728
- C:\Windows\System\QSduSuL.exe
  C:\Windows\System\QSduSuL.exe
  2⤵
  PID:5744
- C:\Windows\System\fEvYFqh.exe
  C:\Windows\System\fEvYFqh.exe
  2⤵
  PID:5760
- C:\Windows\System\hgNFMyA.exe
  C:\Windows\System\hgNFMyA.exe
  2⤵
  PID:5776
- C:\Windows\System\haukZGE.exe
  C:\Windows\System\haukZGE.exe
  2⤵
  PID:6028
- C:\Windows\System\wABAmgP.exe
  C:\Windows\System\wABAmgP.exe
  2⤵
  PID:6048
- C:\Windows\System\YSMdOKZ.exe
  C:\Windows\System\YSMdOKZ.exe
  2⤵
  PID:6064
- C:\Windows\System\ypiPHls.exe
  C:\Windows\System\ypiPHls.exe
  2⤵
  PID:6080
- C:\Windows\System\ZITmIZA.exe
  C:\Windows\System\ZITmIZA.exe
  2⤵
  PID:6100
- C:\Windows\System\OiiFBIB.exe
  C:\Windows\System\OiiFBIB.exe
  2⤵
  PID:6116
- C:\Windows\System\bbvTcNT.exe
  C:\Windows\System\bbvTcNT.exe
  2⤵
  PID:6136
- C:\Windows\System\EmboLyV.exe
  C:\Windows\System\EmboLyV.exe
  2⤵
  PID:4864
- C:\Windows\System\VXEHGFA.exe
  C:\Windows\System\VXEHGFA.exe
  2⤵
  PID:712
- C:\Windows\System\AMCGBYj.exe
  C:\Windows\System\AMCGBYj.exe
  2⤵
  PID:2636
- C:\Windows\System\xOWuFif.exe
  C:\Windows\System\xOWuFif.exe
  2⤵
  PID:4472
- C:\Windows\System\lLywWFx.exe
  C:\Windows\System\lLywWFx.exe
  2⤵
  PID:4988
- C:\Windows\System\QEBrSXs.exe
  C:\Windows\System\QEBrSXs.exe
  2⤵
  PID:3904
- C:\Windows\System\dPabqSL.exe
  C:\Windows\System\dPabqSL.exe
  2⤵
  PID:1328
- C:\Windows\System\cdkBgkO.exe
  C:\Windows\System\cdkBgkO.exe
  2⤵
  PID:5152
- C:\Windows\System\IOTnXsN.exe
  C:\Windows\System\IOTnXsN.exe
  2⤵
  PID:1932
- C:\Windows\System\jWlujBB.exe
  C:\Windows\System\jWlujBB.exe
  2⤵
  PID:5164
- C:\Windows\System\HwGaKkx.exe
  C:\Windows\System\HwGaKkx.exe
  2⤵
  PID:5232
- C:\Windows\System\FQEsNnK.exe
  C:\Windows\System\FQEsNnK.exe
  2⤵
  PID:5260
- C:\Windows\System\BnbnSYH.exe
  C:\Windows\System\BnbnSYH.exe
  2⤵
  PID:5296
- C:\Windows\System\pgnviEv.exe
  C:\Windows\System\pgnviEv.exe
  2⤵
  PID:5388
- C:\Windows\System\yrFMUVq.exe
  C:\Windows\System\yrFMUVq.exe
  2⤵
  PID:5452
- C:\Windows\System\WDYODMB.exe
  C:\Windows\System\WDYODMB.exe
  2⤵
  PID:5488
- C:\Windows\System\vDJVuDD.exe
  C:\Windows\System\vDJVuDD.exe
  2⤵
  PID:5548
- C:\Windows\System\wcqfFGZ.exe
  C:\Windows\System\wcqfFGZ.exe
  2⤵
  PID:5624
- C:\Windows\System\gFadzej.exe
  C:\Windows\System\gFadzej.exe
  2⤵
  PID:5672
- C:\Windows\System\afWIiSG.exe
  C:\Windows\System\afWIiSG.exe
  2⤵
  PID:5720
- C:\Windows\System\wSwcoLb.exe
  C:\Windows\System\wSwcoLb.exe
  2⤵
  PID:396
- C:\Windows\System\nsDUyxt.exe
  C:\Windows\System\nsDUyxt.exe
  2⤵
  PID:1544
- C:\Windows\System\WBDlSAS.exe
  C:\Windows\System\WBDlSAS.exe
  2⤵
  PID:3220
- C:\Windows\System\HiddiUx.exe
  C:\Windows\System\HiddiUx.exe
  2⤵
  PID:5936
- C:\Windows\System\ncShaFM.exe
  C:\Windows\System\ncShaFM.exe
  2⤵
  PID:5968
- C:\Windows\System\jpHWoHd.exe
  C:\Windows\System\jpHWoHd.exe
  2⤵
  PID:3964
- C:\Windows\System\ljlBNqc.exe
  C:\Windows\System\ljlBNqc.exe
  2⤵
  PID:1628
- C:\Windows\System\XlQWUjD.exe
  C:\Windows\System\XlQWUjD.exe
  2⤵
  PID:2716
- C:\Windows\System\iaFUFma.exe
  C:\Windows\System\iaFUFma.exe
  2⤵
  PID:2560
- C:\Windows\System\cDHkbOk.exe
  C:\Windows\System\cDHkbOk.exe
  2⤵
  PID:2564
- C:\Windows\System\PYjEJIx.exe
  C:\Windows\System\PYjEJIx.exe
  2⤵
  PID:3984
- C:\Windows\System\XhOteqh.exe
  C:\Windows\System\XhOteqh.exe
  2⤵
  PID:3472
- C:\Windows\System\yxLEZdb.exe
  C:\Windows\System\yxLEZdb.exe
  2⤵
  PID:1800
- C:\Windows\System\sZKQXPr.exe
  C:\Windows\System\sZKQXPr.exe
  2⤵
  PID:2440
- C:\Windows\System\rQbmgmI.exe
  C:\Windows\System\rQbmgmI.exe
  2⤵
  PID:4808
- C:\Windows\System\xucOxaK.exe
  C:\Windows\System\xucOxaK.exe
  2⤵
  PID:2700
- C:\Windows\System\EVhsgmh.exe
  C:\Windows\System\EVhsgmh.exe
  2⤵
  PID:2124
- C:\Windows\System\mYxsWfD.exe
  C:\Windows\System\mYxsWfD.exe
  2⤵
  PID:1460
- C:\Windows\System\VDBQhbe.exe
  C:\Windows\System\VDBQhbe.exe
  2⤵
  PID:1488
- C:\Windows\System\WRUhkkO.exe
  C:\Windows\System\WRUhkkO.exe
  2⤵
  PID:680
- C:\Windows\System\qLZbknY.exe
  C:\Windows\System\qLZbknY.exe
  2⤵
  PID:5216
- C:\Windows\System\aKzWXeN.exe
  C:\Windows\System\aKzWXeN.exe
  2⤵
  PID:6044
- C:\Windows\System\lLUWqSn.exe
  C:\Windows\System\lLUWqSn.exe
  2⤵
  PID:3252
- C:\Windows\System\jIAJFRW.exe
  C:\Windows\System\jIAJFRW.exe
  2⤵
  PID:1564
- C:\Windows\System\DZAQeSZ.exe
  C:\Windows\System\DZAQeSZ.exe
  2⤵
  PID:6076
- C:\Windows\System\LjLAZAG.exe
  C:\Windows\System\LjLAZAG.exe
  2⤵
  PID:2764
- C:\Windows\System\MGTBkRZ.exe
  C:\Windows\System\MGTBkRZ.exe
  2⤵
  PID:4940
- C:\Windows\System\iuarQit.exe
  C:\Windows\System\iuarQit.exe
  2⤵
  PID:5304
- C:\Windows\System\hLTpOuy.exe
  C:\Windows\System\hLTpOuy.exe
  2⤵
  PID:2476
- C:\Windows\System\NBxcPfs.exe
  C:\Windows\System\NBxcPfs.exe
  2⤵
  PID:5432
- C:\Windows\System\hprOPGi.exe
  C:\Windows\System\hprOPGi.exe
  2⤵
  PID:5212
- C:\Windows\System\nayKTLj.exe
  C:\Windows\System\nayKTLj.exe
  2⤵
  PID:5256
- C:\Windows\System\ZbExbXa.exe
  C:\Windows\System\ZbExbXa.exe
  2⤵
  PID:5804
- C:\Windows\System\OdepQFu.exe
  C:\Windows\System\OdepQFu.exe
  2⤵
  PID:2580
- C:\Windows\System\SzapReO.exe
  C:\Windows\System\SzapReO.exe
  2⤵
  PID:5688
- C:\Windows\System\SQWzbon.exe
  C:\Windows\System\SQWzbon.exe
  2⤵
  PID:3852
- C:\Windows\System\IdIJGHW.exe
  C:\Windows\System\IdIJGHW.exe
  2⤵
  PID:4728
- C:\Windows\System\HwnmONp.exe
  C:\Windows\System\HwnmONp.exe
  2⤵
  PID:952
- C:\Windows\System\FzfirFX.exe
  C:\Windows\System\FzfirFX.exe
  2⤵
  PID:5620
- C:\Windows\System\iuuytsh.exe
  C:\Windows\System\iuuytsh.exe
  2⤵
  PID:4884
- C:\Windows\System\IGSbXQr.exe
  C:\Windows\System\IGSbXQr.exe
  2⤵
  PID:6056
- C:\Windows\System\mixRiyi.exe
  C:\Windows\System\mixRiyi.exe
  2⤵
  PID:6108
- C:\Windows\System\LhHJflr.exe
  C:\Windows\System\LhHJflr.exe
  2⤵
  PID:5964
- C:\Windows\System\FdzfusN.exe
  C:\Windows\System\FdzfusN.exe
  2⤵
  PID:4204
- C:\Windows\System\RwvWCnG.exe
  C:\Windows\System\RwvWCnG.exe
  2⤵
  PID:2328
- C:\Windows\System\gfHaExe.exe
  C:\Windows\System\gfHaExe.exe
  2⤵
  PID:1440
- C:\Windows\System\bjkmDZy.exe
  C:\Windows\System\bjkmDZy.exe
  2⤵
  PID:4948
- C:\Windows\System\rSHBrlX.exe
  C:\Windows\System\rSHBrlX.exe
  2⤵
  PID:1028
- C:\Windows\System\lpZtwBK.exe
  C:\Windows\System\lpZtwBK.exe
  2⤵
  PID:6072
- C:\Windows\System\HZMaaLa.exe
  C:\Windows\System\HZMaaLa.exe
  2⤵
  PID:6160
- C:\Windows\System\mTgXknM.exe
  C:\Windows\System\mTgXknM.exe
  2⤵
  PID:6180
- C:\Windows\System\ZfVQtey.exe
  C:\Windows\System\ZfVQtey.exe
  2⤵
  PID:6204
- C:\Windows\System\BPWsDTQ.exe
  C:\Windows\System\BPWsDTQ.exe
  2⤵
  PID:6224
- C:\Windows\System\lcxqofe.exe
  C:\Windows\System\lcxqofe.exe
  2⤵
  PID:6244
- C:\Windows\System\JOjkIme.exe
  C:\Windows\System\JOjkIme.exe
  2⤵
  PID:6268
- C:\Windows\System\LFgxzRU.exe
  C:\Windows\System\LFgxzRU.exe
  2⤵
  PID:6292
- C:\Windows\System\hOAAUsg.exe
  C:\Windows\System\hOAAUsg.exe
  2⤵
  PID:6324
- C:\Windows\System\ykceANR.exe
  C:\Windows\System\ykceANR.exe
  2⤵
  PID:6344
- C:\Windows\System\kqKOiBk.exe
  C:\Windows\System\kqKOiBk.exe
  2⤵
  PID:6372
- C:\Windows\System\VWoaaHw.exe
  C:\Windows\System\VWoaaHw.exe
  2⤵
  PID:6396
- C:\Windows\System\UQskqWU.exe
  C:\Windows\System\UQskqWU.exe
  2⤵
  PID:6412
- C:\Windows\System\kNhGXdg.exe
  C:\Windows\System\kNhGXdg.exe
  2⤵
  PID:6456
- C:\Windows\System\sdmqXxH.exe
  C:\Windows\System\sdmqXxH.exe
  2⤵
  PID:6480
- C:\Windows\System\FPrpuqA.exe
  C:\Windows\System\FPrpuqA.exe
  2⤵
  PID:6500
- C:\Windows\System\CBPsLfh.exe
  C:\Windows\System\CBPsLfh.exe
  2⤵
  PID:6532
- C:\Windows\System\uAKhPrn.exe
  C:\Windows\System\uAKhPrn.exe
  2⤵
  PID:6556
- C:\Windows\System\EOudpFQ.exe
  C:\Windows\System\EOudpFQ.exe
  2⤵
  PID:6572
- C:\Windows\System\TZBOMtp.exe
  C:\Windows\System\TZBOMtp.exe
  2⤵
  PID:6596
- C:\Windows\System\MOIPBBy.exe
  C:\Windows\System\MOIPBBy.exe
  2⤵
  PID:6620
- C:\Windows\System\rWsjnBM.exe
  C:\Windows\System\rWsjnBM.exe
  2⤵
  PID:6640
- C:\Windows\System\lRgrmHa.exe
  C:\Windows\System\lRgrmHa.exe
  2⤵
  PID:6664
- C:\Windows\System\hQXbbKC.exe
  C:\Windows\System\hQXbbKC.exe
  2⤵
  PID:6684
- C:\Windows\System\WVpAAda.exe
  C:\Windows\System\WVpAAda.exe
  2⤵
  PID:6708
- C:\Windows\System\aeYRsVv.exe
  C:\Windows\System\aeYRsVv.exe
  2⤵
  PID:6724
- C:\Windows\System\mNZnFwo.exe
  C:\Windows\System\mNZnFwo.exe
  2⤵
  PID:6752
- C:\Windows\System\hoROFrW.exe
  C:\Windows\System\hoROFrW.exe
  2⤵
  PID:6772
- C:\Windows\System\NDraAAC.exe
  C:\Windows\System\NDraAAC.exe
  2⤵
  PID:6796
- C:\Windows\System\PZHUNRo.exe
  C:\Windows\System\PZHUNRo.exe
  2⤵
  PID:6820
- C:\Windows\System\nxlcQRg.exe
  C:\Windows\System\nxlcQRg.exe
  2⤵
  PID:6844
- C:\Windows\System\vUcLBfz.exe
  C:\Windows\System\vUcLBfz.exe
  2⤵
  PID:6868
- C:\Windows\System\gMfuzoh.exe
  C:\Windows\System\gMfuzoh.exe
  2⤵
  PID:6884
- C:\Windows\System\fxtUmDT.exe
  C:\Windows\System\fxtUmDT.exe
  2⤵
  PID:6904
- C:\Windows\System\OPyJIiv.exe
  C:\Windows\System\OPyJIiv.exe
  2⤵
  PID:6928
- C:\Windows\System\JadvXlz.exe
  C:\Windows\System\JadvXlz.exe
  2⤵
  PID:6944
- C:\Windows\System\YBQfWto.exe
  C:\Windows\System\YBQfWto.exe
  2⤵
  PID:6972
- C:\Windows\System\WLfyCYw.exe
  C:\Windows\System\WLfyCYw.exe
  2⤵
  PID:6992
- C:\Windows\System\uUvFzkW.exe
  C:\Windows\System\uUvFzkW.exe
  2⤵
  PID:7012
- C:\Windows\System\DdNCLPj.exe
  C:\Windows\System\DdNCLPj.exe
  2⤵
  PID:7036
- C:\Windows\System\dzRkHan.exe
  C:\Windows\System\dzRkHan.exe
  2⤵
  PID:7056
- C:\Windows\System\ofnJNYY.exe
  C:\Windows\System\ofnJNYY.exe
  2⤵
  PID:7076
- C:\Windows\System\scgnqdw.exe
  C:\Windows\System\scgnqdw.exe
  2⤵
  PID:7104
- C:\Windows\System\cyxcEOu.exe
  C:\Windows\System\cyxcEOu.exe
  2⤵
  PID:7128
- C:\Windows\System\tvrQqSd.exe
  C:\Windows\System\tvrQqSd.exe
  2⤵
  PID:7152
- C:\Windows\System\QnjYSVG.exe
  C:\Windows\System\QnjYSVG.exe
  2⤵
  PID:452
- C:\Windows\System\OySqBoz.exe
  C:\Windows\System\OySqBoz.exe
  2⤵
  PID:1468
- C:\Windows\System\TAHNpeB.exe
  C:\Windows\System\TAHNpeB.exe
  2⤵
  PID:3492
- C:\Windows\System\KjqvoRX.exe
  C:\Windows\System\KjqvoRX.exe
  2⤵
  PID:6336
- C:\Windows\System\vkuSwbK.exe
  C:\Windows\System\vkuSwbK.exe
  2⤵
  PID:5796
- C:\Windows\System\EcvlZxM.exe
  C:\Windows\System\EcvlZxM.exe
  2⤵
  PID:6172
- C:\Windows\System\gVKLPcp.exe
  C:\Windows\System\gVKLPcp.exe
  2⤵
  PID:6236
- C:\Windows\System\VBNdYis.exe
  C:\Windows\System\VBNdYis.exe
  2⤵
  PID:6304
- C:\Windows\System\hvkWUHN.exe
  C:\Windows\System\hvkWUHN.exe
  2⤵
  PID:5752
- C:\Windows\System\FAzjASt.exe
  C:\Windows\System\FAzjASt.exe
  2⤵
  PID:6420
- C:\Windows\System\TVPENcV.exe
  C:\Windows\System\TVPENcV.exe
  2⤵
  PID:6568
- C:\Windows\System\GzqGsvU.exe
  C:\Windows\System\GzqGsvU.exe
  2⤵
  PID:6760
- C:\Windows\System\hTxswku.exe
  C:\Windows\System\hTxswku.exe
  2⤵
  PID:5980
- C:\Windows\System\scBjPZn.exe
  C:\Windows\System\scBjPZn.exe
  2⤵
  PID:6852
- C:\Windows\System\TQkFZKp.exe
  C:\Windows\System\TQkFZKp.exe
  2⤵
  PID:6216
- C:\Windows\System\newYRmb.exe
  C:\Windows\System\newYRmb.exe
  2⤵
  PID:7028
- C:\Windows\System\iczrHcG.exe
  C:\Windows\System\iczrHcG.exe
  2⤵
  PID:7088
- C:\Windows\System\vCKaBaK.exe
  C:\Windows\System\vCKaBaK.exe
  2⤵
  PID:7184
- C:\Windows\System\FCGcpoU.exe
  C:\Windows\System\FCGcpoU.exe
  2⤵
  PID:7212
- C:\Windows\System\ZUdIIYa.exe
  C:\Windows\System\ZUdIIYa.exe
  2⤵
  PID:7232
- C:\Windows\System\DehiSQE.exe
  C:\Windows\System\DehiSQE.exe
  2⤵
  PID:7256
- C:\Windows\System\novVgoc.exe
  C:\Windows\System\novVgoc.exe
  2⤵
  PID:7276
- C:\Windows\System\lCCdfcl.exe
  C:\Windows\System\lCCdfcl.exe
  2⤵
  PID:7304
- C:\Windows\System\ELcuigA.exe
  C:\Windows\System\ELcuigA.exe
  2⤵
  PID:7324
- C:\Windows\System\jrCpeoS.exe
  C:\Windows\System\jrCpeoS.exe
  2⤵
  PID:7344
- C:\Windows\System\EqYTJxg.exe
  C:\Windows\System\EqYTJxg.exe
  2⤵
  PID:7368
- C:\Windows\System\JZXRxPH.exe
  C:\Windows\System\JZXRxPH.exe
  2⤵
  PID:7388
- C:\Windows\System\tSugkLP.exe
  C:\Windows\System\tSugkLP.exe
  2⤵
  PID:7408
- C:\Windows\System\kmrZmgM.exe
  C:\Windows\System\kmrZmgM.exe
  2⤵
  PID:7428
- C:\Windows\System\FeTneMw.exe
  C:\Windows\System\FeTneMw.exe
  2⤵
  PID:7452
- C:\Windows\System\Qfpwzwd.exe
  C:\Windows\System\Qfpwzwd.exe
  2⤵
  PID:7476
- C:\Windows\System\qARgyWS.exe
  C:\Windows\System\qARgyWS.exe
  2⤵
  PID:7500
- C:\Windows\System\nDBjkJt.exe
  C:\Windows\System\nDBjkJt.exe
  2⤵
  PID:7520
- C:\Windows\System\SPvsexg.exe
  C:\Windows\System\SPvsexg.exe
  2⤵
  PID:7540
- C:\Windows\System\ZXjaZri.exe
  C:\Windows\System\ZXjaZri.exe
  2⤵
  PID:7568
- C:\Windows\System\XeUjtuV.exe
  C:\Windows\System\XeUjtuV.exe
  2⤵
  PID:7588
- C:\Windows\System\eLfBQVe.exe
  C:\Windows\System\eLfBQVe.exe
  2⤵
  PID:7608
- C:\Windows\System\qUlWzpd.exe
  C:\Windows\System\qUlWzpd.exe
  2⤵
  PID:7632
- C:\Windows\System\owlSmpn.exe
  C:\Windows\System\owlSmpn.exe
  2⤵
  PID:7660
- C:\Windows\System\OMURJWp.exe
  C:\Windows\System\OMURJWp.exe
  2⤵
  PID:7684
- C:\Windows\System\iIyDgPl.exe
  C:\Windows\System\iIyDgPl.exe
  2⤵
  PID:7700
- C:\Windows\System\namgqta.exe
  C:\Windows\System\namgqta.exe
  2⤵
  PID:7724
- C:\Windows\System\wnSIaCM.exe
  C:\Windows\System\wnSIaCM.exe
  2⤵
  PID:7752
- C:\Windows\System\qxFZwzZ.exe
  C:\Windows\System\qxFZwzZ.exe
  2⤵
  PID:7772
- C:\Windows\System\aMoOzSH.exe
  C:\Windows\System\aMoOzSH.exe
  2⤵
  PID:7792
- C:\Windows\System\tLTUQEy.exe
  C:\Windows\System\tLTUQEy.exe
  2⤵
  PID:7824
- C:\Windows\System\bzwdJON.exe
  C:\Windows\System\bzwdJON.exe
  2⤵
  PID:7848
- C:\Windows\System\aECAHfJ.exe
  C:\Windows\System\aECAHfJ.exe
  2⤵
  PID:7868
- C:\Windows\System\RuxahGM.exe
  C:\Windows\System\RuxahGM.exe
  2⤵
  PID:7888
- C:\Windows\System\guilcRo.exe
  C:\Windows\System\guilcRo.exe
  2⤵
  PID:7912
- C:\Windows\System\yhKUcIE.exe
  C:\Windows\System\yhKUcIE.exe
  2⤵
  PID:7936
- C:\Windows\System\sHFHgNs.exe
  C:\Windows\System\sHFHgNs.exe
  2⤵
  PID:7960
- C:\Windows\System\KsoDyJY.exe
  C:\Windows\System\KsoDyJY.exe
  2⤵
  PID:7980
- C:\Windows\System\rVEsJMO.exe
  C:\Windows\System\rVEsJMO.exe
  2⤵
  PID:8008
- C:\Windows\System\bQfbgez.exe
  C:\Windows\System\bQfbgez.exe
  2⤵
  PID:8036
- C:\Windows\System\HjRTXkE.exe
  C:\Windows\System\HjRTXkE.exe
  2⤵
  PID:8052
- C:\Windows\System\xNYQQYF.exe
  C:\Windows\System\xNYQQYF.exe
  2⤵
  PID:8076
- C:\Windows\System\McVTBsm.exe
  C:\Windows\System\McVTBsm.exe
  2⤵
  PID:8100
- C:\Windows\System\lkZSByQ.exe
  C:\Windows\System\lkZSByQ.exe
  2⤵
  PID:8124
- C:\Windows\System\SajiytM.exe
  C:\Windows\System\SajiytM.exe
  2⤵
  PID:8148
- C:\Windows\System\vHmGExz.exe
  C:\Windows\System\vHmGExz.exe
  2⤵
  PID:8172
- C:\Windows\System\vqVeFwJ.exe
  C:\Windows\System\vqVeFwJ.exe
  2⤵
  PID:8188
- C:\Windows\System\HIoDCef.exe
  C:\Windows\System\HIoDCef.exe
  2⤵
  PID:6636
- C:\Windows\System\erGbBqB.exe
  C:\Windows\System\erGbBqB.exe
  2⤵
  PID:6692
- C:\Windows\System\IGNGQBS.exe
  C:\Windows\System\IGNGQBS.exe
  2⤵
  PID:6816
- C:\Windows\System\Imfmnik.exe
  C:\Windows\System\Imfmnik.exe
  2⤵
  PID:6980
- C:\Windows\System\MpGkrSj.exe
  C:\Windows\System\MpGkrSj.exe
  2⤵
  PID:7004
- C:\Windows\System\bAQyydz.exe
  C:\Windows\System\bAQyydz.exe
  2⤵
  PID:6264
- C:\Windows\System\azhHNuD.exe
  C:\Windows\System\azhHNuD.exe
  2⤵
  PID:7248
- C:\Windows\System\qvMsrLw.exe
  C:\Windows\System\qvMsrLw.exe
  2⤵
  PID:6096
- C:\Windows\System\iDCSZgc.exe
  C:\Windows\System\iDCSZgc.exe
  2⤵
  PID:6192
- C:\Windows\System\AQBlRpr.exe
  C:\Windows\System\AQBlRpr.exe
  2⤵
  PID:7404
- C:\Windows\System\CLSlccY.exe
  C:\Windows\System\CLSlccY.exe
  2⤵
  PID:7488
- C:\Windows\System\qFTtMxq.exe
  C:\Windows\System\qFTtMxq.exe
  2⤵
  PID:6960
- C:\Windows\System\JTjNPAH.exe
  C:\Windows\System\JTjNPAH.exe
  2⤵
  PID:7576
- C:\Windows\System\oWfirVB.exe
  C:\Windows\System\oWfirVB.exe
  2⤵
  PID:7652
- C:\Windows\System\lmxTmoO.exe
  C:\Windows\System\lmxTmoO.exe
  2⤵
  PID:6720
- C:\Windows\System\JtTXMRT.exe
  C:\Windows\System\JtTXMRT.exe
  2⤵
  PID:7720
- C:\Windows\System\UFxmTvM.exe
  C:\Windows\System\UFxmTvM.exe
  2⤵
  PID:6840
- C:\Windows\System\nyxCfqR.exe
  C:\Windows\System\nyxCfqR.exe
  2⤵
  PID:7784
- C:\Windows\System\AufLbza.exe
  C:\Windows\System\AufLbza.exe
  2⤵
  PID:7180
- C:\Windows\System\pYhSjFH.exe
  C:\Windows\System\pYhSjFH.exe
  2⤵
  PID:7204
- C:\Windows\System\ONcTawa.exe
  C:\Windows\System\ONcTawa.exe
  2⤵
  PID:7976
- C:\Windows\System\VgaqWOQ.exe
  C:\Windows\System\VgaqWOQ.exe
  2⤵
  PID:6352
- C:\Windows\System\wtaZhSf.exe
  C:\Windows\System\wtaZhSf.exe
  2⤵
  PID:8068
- C:\Windows\System\nSrhJfb.exe
  C:\Windows\System\nSrhJfb.exe
  2⤵
  PID:8196
- C:\Windows\System\RWjdPcy.exe
  C:\Windows\System\RWjdPcy.exe
  2⤵
  PID:8216
- C:\Windows\System\Qexhlak.exe
  C:\Windows\System\Qexhlak.exe
  2⤵
  PID:8244
- C:\Windows\System\EMryzEE.exe
  C:\Windows\System\EMryzEE.exe
  2⤵
  PID:8268
- C:\Windows\System\GqueyNK.exe
  C:\Windows\System\GqueyNK.exe
  2⤵
  PID:8288
- C:\Windows\System\mwUhjrq.exe
  C:\Windows\System\mwUhjrq.exe
  2⤵
  PID:8308
- C:\Windows\System\EXghGah.exe
  C:\Windows\System\EXghGah.exe
  2⤵
  PID:8328
- C:\Windows\System\PcVcMoH.exe
  C:\Windows\System\PcVcMoH.exe
  2⤵
  PID:8344
- C:\Windows\System\aMIBAnv.exe
  C:\Windows\System\aMIBAnv.exe
  2⤵
  PID:8368
- C:\Windows\System\yxCkqRo.exe
  C:\Windows\System\yxCkqRo.exe
  2⤵
  PID:8388
- C:\Windows\System\mHRzNbo.exe
  C:\Windows\System\mHRzNbo.exe
  2⤵
  PID:8408
- C:\Windows\System\mLShmPF.exe
  C:\Windows\System\mLShmPF.exe
  2⤵
  PID:8432
- C:\Windows\System\ZlkiqjS.exe
  C:\Windows\System\ZlkiqjS.exe
  2⤵
  PID:8452
- C:\Windows\System\nFtbZCk.exe
  C:\Windows\System\nFtbZCk.exe
  2⤵
  PID:8472
- C:\Windows\System\kzcYcMh.exe
  C:\Windows\System\kzcYcMh.exe
  2⤵
  PID:8500
- C:\Windows\System\QmfaoNF.exe
  C:\Windows\System\QmfaoNF.exe
  2⤵
  PID:8520
- C:\Windows\System\kopGVhg.exe
  C:\Windows\System\kopGVhg.exe
  2⤵
  PID:8540
- C:\Windows\System\cRCwbsQ.exe
  C:\Windows\System\cRCwbsQ.exe
  2⤵
  PID:8572
- C:\Windows\System\ZdbrUoI.exe
  C:\Windows\System\ZdbrUoI.exe
  2⤵
  PID:8592
- C:\Windows\System\Buxkfgd.exe
  C:\Windows\System\Buxkfgd.exe
  2⤵
  PID:8616
- C:\Windows\System\XCWGyYy.exe
  C:\Windows\System\XCWGyYy.exe
  2⤵
  PID:8640
- C:\Windows\System\tBbGcPg.exe
  C:\Windows\System\tBbGcPg.exe
  2⤵
  PID:8660
- C:\Windows\System\pHmlukH.exe
  C:\Windows\System\pHmlukH.exe
  2⤵
  PID:8684
- C:\Windows\System\LJnTHYn.exe
  C:\Windows\System\LJnTHYn.exe
  2⤵
  PID:8708
- C:\Windows\System\kjGbILK.exe
  C:\Windows\System\kjGbILK.exe
  2⤵
  PID:8732
- C:\Windows\System\okzjrVo.exe
  C:\Windows\System\okzjrVo.exe
  2⤵
  PID:8760
- C:\Windows\System\JEMfCzt.exe
  C:\Windows\System\JEMfCzt.exe
  2⤵
  PID:8784
- C:\Windows\System\zxYuOen.exe
  C:\Windows\System\zxYuOen.exe
  2⤵
  PID:8804
- C:\Windows\System\jlxjPHh.exe
  C:\Windows\System\jlxjPHh.exe
  2⤵
  PID:8832
- C:\Windows\System\giHBnHh.exe
  C:\Windows\System\giHBnHh.exe
  2⤵
  PID:8848
- C:\Windows\System\EcMByBm.exe
  C:\Windows\System\EcMByBm.exe
  2⤵
  PID:8872
- C:\Windows\System\uvGXhUu.exe
  C:\Windows\System\uvGXhUu.exe
  2⤵
  PID:8896
- C:\Windows\System\zfORfBY.exe
  C:\Windows\System\zfORfBY.exe
  2⤵
  PID:8920
- C:\Windows\System\pWUGPCS.exe
  C:\Windows\System\pWUGPCS.exe
  2⤵
  PID:8944
- C:\Windows\System\YTQrQQc.exe
  C:\Windows\System\YTQrQQc.exe
  2⤵
  PID:8972
- C:\Windows\System\UMmjDMg.exe
  C:\Windows\System\UMmjDMg.exe
  2⤵
  PID:8992
- C:\Windows\System\wPVOCYa.exe
  C:\Windows\System\wPVOCYa.exe
  2⤵
  PID:9020
- C:\Windows\System\ITIiOWF.exe
  C:\Windows\System\ITIiOWF.exe
  2⤵
  PID:9044
- C:\Windows\System\zxhTfjX.exe
  C:\Windows\System\zxhTfjX.exe
  2⤵
  PID:9072
- C:\Windows\System\UXvHgci.exe
  C:\Windows\System\UXvHgci.exe
  2⤵
  PID:9092
- C:\Windows\System\dmbgpZp.exe
  C:\Windows\System\dmbgpZp.exe
  2⤵
  PID:9116
- C:\Windows\System\RakkZEJ.exe
  C:\Windows\System\RakkZEJ.exe
  2⤵
  PID:9136
- C:\Windows\System\NljjRsJ.exe
  C:\Windows\System\NljjRsJ.exe
  2⤵
  PID:9164
- C:\Windows\System\KWYaTdJ.exe
  C:\Windows\System\KWYaTdJ.exe
  2⤵
  PID:9184
- C:\Windows\System\QBbewWy.exe
  C:\Windows\System\QBbewWy.exe
  2⤵
  PID:9208
- C:\Windows\System\mlALcjq.exe
  C:\Windows\System\mlALcjq.exe
  2⤵
  PID:5292
- C:\Windows\System\cygMmpu.exe
  C:\Windows\System\cygMmpu.exe
  2⤵
  PID:7508
- C:\Windows\System\fEmvleR.exe
  C:\Windows\System\fEmvleR.exe
  2⤵
  PID:7600
- C:\Windows\System\TTLsevH.exe
  C:\Windows\System\TTLsevH.exe
  2⤵
  PID:7000
- C:\Windows\System\sCfUASz.exe
  C:\Windows\System\sCfUASz.exe
  2⤵
  PID:412
- C:\Windows\System\tyfhWSf.exe
  C:\Windows\System\tyfhWSf.exe
  2⤵
  PID:7800
- C:\Windows\System\jUJFppt.exe
  C:\Windows\System\jUJFppt.exe
  2⤵
  PID:7548
- C:\Windows\System\YZRHoMF.exe
  C:\Windows\System\YZRHoMF.exe
  2⤵
  PID:7640
- C:\Windows\System\ZhZiJqs.exe
  C:\Windows\System\ZhZiJqs.exe
  2⤵
  PID:7840
- C:\Windows\System\BeAdUxI.exe
  C:\Windows\System\BeAdUxI.exe
  2⤵
  PID:8084
- C:\Windows\System\XhqifQi.exe
  C:\Windows\System\XhqifQi.exe
  2⤵
  PID:7996
- C:\Windows\System\CoiJXng.exe
  C:\Windows\System\CoiJXng.exe
  2⤵
  PID:8224
- C:\Windows\System\NiHAtUJ.exe
  C:\Windows\System\NiHAtUJ.exe
  2⤵
  PID:8280
- C:\Windows\System\cZMRSrz.exe
  C:\Windows\System\cZMRSrz.exe
  2⤵
  PID:8300
- C:\Windows\System\KxEYWkj.exe
  C:\Windows\System\KxEYWkj.exe
  2⤵
  PID:6812
- C:\Windows\System\lBMikZI.exe
  C:\Windows\System\lBMikZI.exe
  2⤵
  PID:7604
- C:\Windows\System\MfkmXas.exe
  C:\Windows\System\MfkmXas.exe
  2⤵
  PID:8516
- C:\Windows\System\hyYVpIF.exe
  C:\Windows\System\hyYVpIF.exe
  2⤵
  PID:8568
- C:\Windows\System\kkstMCD.exe
  C:\Windows\System\kkstMCD.exe
  2⤵
  PID:9220
- C:\Windows\System\fNgPgit.exe
  C:\Windows\System\fNgPgit.exe
  2⤵
  PID:9252
- C:\Windows\System\xgKOZnW.exe
  C:\Windows\System\xgKOZnW.exe
  2⤵
  PID:9276
- C:\Windows\System\RQoXsdR.exe
  C:\Windows\System\RQoXsdR.exe
  2⤵
  PID:9296
- C:\Windows\System\RBFFgDZ.exe
  C:\Windows\System\RBFFgDZ.exe
  2⤵
  PID:9320
- C:\Windows\System\pkIFXaQ.exe
  C:\Windows\System\pkIFXaQ.exe
  2⤵
  PID:9348
- C:\Windows\System\guspMYa.exe
  C:\Windows\System\guspMYa.exe
  2⤵
  PID:9372
- C:\Windows\System\ntqYBjW.exe
  C:\Windows\System\ntqYBjW.exe
  2⤵
  PID:9388
- C:\Windows\System\VEtbldq.exe
  C:\Windows\System\VEtbldq.exe
  2⤵
  PID:9412
- C:\Windows\System\KiDmEsI.exe
  C:\Windows\System\KiDmEsI.exe
  2⤵
  PID:9440
- C:\Windows\System\kXlKGuC.exe
  C:\Windows\System\kXlKGuC.exe
  2⤵
  PID:9460
- C:\Windows\System\cxYCkRW.exe
  C:\Windows\System\cxYCkRW.exe
  2⤵
  PID:9484
- C:\Windows\System\xbXyCsU.exe
  C:\Windows\System\xbXyCsU.exe
  2⤵
  PID:9508
- C:\Windows\System\eSzEhVV.exe
  C:\Windows\System\eSzEhVV.exe
  2⤵
  PID:9536
- C:\Windows\System\CnKUQyU.exe
  C:\Windows\System\CnKUQyU.exe
  2⤵
  PID:9556
- C:\Windows\System\caCvhxK.exe
  C:\Windows\System\caCvhxK.exe
  2⤵
  PID:9576
- C:\Windows\System\cjCHgGB.exe
  C:\Windows\System\cjCHgGB.exe
  2⤵
  PID:9600
- C:\Windows\System\Zgxnanb.exe
  C:\Windows\System\Zgxnanb.exe
  2⤵
  PID:9624
- C:\Windows\System\DGHMVKc.exe
  C:\Windows\System\DGHMVKc.exe
  2⤵
  PID:9644
- C:\Windows\System\ylxufXg.exe
  C:\Windows\System\ylxufXg.exe
  2⤵
  PID:9668
- C:\Windows\System\cmszfUA.exe
  C:\Windows\System\cmszfUA.exe
  2⤵
  PID:9688
- C:\Windows\System\keygWoL.exe
  C:\Windows\System\keygWoL.exe
  2⤵
  PID:9716
- C:\Windows\System\kqqnPVQ.exe
  C:\Windows\System\kqqnPVQ.exe
  2⤵
  PID:9736
- C:\Windows\System\opIfeEr.exe
  C:\Windows\System\opIfeEr.exe
  2⤵
  PID:9760
- C:\Windows\System\FaAYmMk.exe
  C:\Windows\System\FaAYmMk.exe
  2⤵
  PID:9784
- C:\Windows\System\mMVdeVF.exe
  C:\Windows\System\mMVdeVF.exe
  2⤵
  PID:9812
- C:\Windows\System\lKcfWPE.exe
  C:\Windows\System\lKcfWPE.exe
  2⤵
  PID:9836
- C:\Windows\System\BfAFsFm.exe
  C:\Windows\System\BfAFsFm.exe
  2⤵
  PID:9860
- C:\Windows\System\xRTtNBw.exe
  C:\Windows\System\xRTtNBw.exe
  2⤵
  PID:9880
- C:\Windows\System\nYPGyRL.exe
  C:\Windows\System\nYPGyRL.exe
  2⤵
  PID:9912
- C:\Windows\System\jpTKabc.exe
  C:\Windows\System\jpTKabc.exe
  2⤵
  PID:9936
- C:\Windows\System\vGcpSgu.exe
  C:\Windows\System\vGcpSgu.exe
  2⤵
  PID:9956
- C:\Windows\System\dJOnQIA.exe
  C:\Windows\System\dJOnQIA.exe
  2⤵
  PID:9980
- C:\Windows\System\jHVUCtd.exe
  C:\Windows\System\jHVUCtd.exe
  2⤵
  PID:9996
- C:\Windows\System\uKLLMpv.exe
  C:\Windows\System\uKLLMpv.exe
  2⤵
  PID:10020
- C:\Windows\System\nzHzRut.exe
  C:\Windows\System\nzHzRut.exe
  2⤵
  PID:10044
- C:\Windows\System\nQIlTCf.exe
  C:\Windows\System\nQIlTCf.exe
  2⤵
  PID:10072
- C:\Windows\System\axIxPBf.exe
  C:\Windows\System\axIxPBf.exe
  2⤵
  PID:10092
- C:\Windows\System\NFJfvAQ.exe
  C:\Windows\System\NFJfvAQ.exe
  2⤵
  PID:10116
- C:\Windows\System\sKIlxgN.exe
  C:\Windows\System\sKIlxgN.exe
  2⤵
  PID:10136
- C:\Windows\System\iBPgPbS.exe
  C:\Windows\System\iBPgPbS.exe
  2⤵
  PID:10156
- C:\Windows\System\zrGQrKM.exe
  C:\Windows\System\zrGQrKM.exe
  2⤵
  PID:10184
- C:\Windows\System\DhgnGGb.exe
  C:\Windows\System\DhgnGGb.exe
  2⤵
  PID:10208
- C:\Windows\System\aPvGjna.exe
  C:\Windows\System\aPvGjna.exe
  2⤵
  PID:8652
- C:\Windows\System\JzLsnET.exe
  C:\Windows\System\JzLsnET.exe
  2⤵
  PID:7880
- C:\Windows\System\aLdqxLh.exe
  C:\Windows\System\aLdqxLh.exe
  2⤵
  PID:6780
- C:\Windows\System\bkEzMqG.exe
  C:\Windows\System\bkEzMqG.exe
  2⤵
  PID:8776
- C:\Windows\System\AKfkwAT.exe
  C:\Windows\System\AKfkwAT.exe
  2⤵
  PID:7944
- C:\Windows\System\uZaoBgz.exe
  C:\Windows\System\uZaoBgz.exe
  2⤵
  PID:7124
- C:\Windows\System\YLGTrjU.exe
  C:\Windows\System\YLGTrjU.exe
  2⤵
  PID:8000
- C:\Windows\System\yqlDpAg.exe
  C:\Windows\System\yqlDpAg.exe
  2⤵
  PID:8108
- C:\Windows\System\LAFRnXP.exe
  C:\Windows\System\LAFRnXP.exe
  2⤵
  PID:7336
- C:\Windows\System\MDkvwgN.exe
  C:\Windows\System\MDkvwgN.exe
  2⤵
  PID:8160
- C:\Windows\System\sYBtIlk.exe
  C:\Windows\System\sYBtIlk.exe
  2⤵
  PID:9060
- C:\Windows\System\WNKgzQf.exe
  C:\Windows\System\WNKgzQf.exe
  2⤵
  PID:8256
- C:\Windows\System\CrbyfBt.exe
  C:\Windows\System\CrbyfBt.exe
  2⤵
  PID:8336
- C:\Windows\System\ybDhEGn.exe
  C:\Windows\System\ybDhEGn.exe
  2⤵
  PID:6552
- C:\Windows\System\GfqKoVp.exe
  C:\Windows\System\GfqKoVp.exe
  2⤵
  PID:8468
- C:\Windows\System\CNmtmHd.exe
  C:\Windows\System\CNmtmHd.exe
  2⤵
  PID:8096
- C:\Windows\System\PYBrbVq.exe
  C:\Windows\System\PYBrbVq.exe
  2⤵
  PID:8548
- C:\Windows\System\vJKMqZA.exe
  C:\Windows\System\vJKMqZA.exe
  2⤵
  PID:6676
- C:\Windows\System\GZNWlju.exe
  C:\Windows\System\GZNWlju.exe
  2⤵
  PID:8608
- C:\Windows\System\IMoBIIu.exe
  C:\Windows\System\IMoBIIu.exe
  2⤵
  PID:6952
- C:\Windows\System\IsKGKpp.exe
  C:\Windows\System\IsKGKpp.exe
  2⤵
  PID:9248
- C:\Windows\System\pVmtrTw.exe
  C:\Windows\System\pVmtrTw.exe
  2⤵
  PID:10248
- C:\Windows\System\HFNLdgZ.exe
  C:\Windows\System\HFNLdgZ.exe
  2⤵
  PID:10948
- C:\Windows\System\sShOIid.exe
  C:\Windows\System\sShOIid.exe
  2⤵
  PID:11088
- C:\Windows\System\xZeFXlu.exe
  C:\Windows\System\xZeFXlu.exe
  2⤵
  PID:11112
- C:\Windows\System\mkPuIGd.exe
  C:\Windows\System\mkPuIGd.exe
  2⤵
  PID:11132
- C:\Windows\System\lSUYsEj.exe
  C:\Windows\System\lSUYsEj.exe
  2⤵
  PID:11152
- C:\Windows\System\UXjiRWr.exe
  C:\Windows\System\UXjiRWr.exe
  2⤵
  PID:11176
- C:\Windows\System\uwummUd.exe
  C:\Windows\System\uwummUd.exe
  2⤵
  PID:11204
- C:\Windows\System\DAoKufn.exe
  C:\Windows\System\DAoKufn.exe
  2⤵
  PID:11228
- C:\Windows\System\SdOtZco.exe
  C:\Windows\System\SdOtZco.exe
  2⤵
  PID:9468
- C:\Windows\System\JfruXBf.exe
  C:\Windows\System\JfruXBf.exe
  2⤵
  PID:7292
- C:\Windows\System\TXJKPtG.exe
  C:\Windows\System\TXJKPtG.exe
  2⤵
  PID:9128
- C:\Windows\System\vpZtzxZ.exe
  C:\Windows\System\vpZtzxZ.exe
  2⤵
  PID:9992
- C:\Windows\System\sSNXAsc.exe
  C:\Windows\System\sSNXAsc.exe
  2⤵
  PID:10108
- C:\Windows\System\kEOeqrY.exe
  C:\Windows\System\kEOeqrY.exe
  2⤵
  PID:7864
- C:\Windows\System\IisYXRy.exe
  C:\Windows\System\IisYXRy.exe
  2⤵
  PID:8964
- C:\Windows\System\RHrkTce.exe
  C:\Windows\System\RHrkTce.exe
  2⤵
  PID:7716
- C:\Windows\System\FhHLQRX.exe
  C:\Windows\System\FhHLQRX.exe
  2⤵
  PID:7836
- C:\Windows\System\zVFDxou.exe
  C:\Windows\System\zVFDxou.exe
  2⤵
  PID:9228
- C:\Windows\System\NkuUtnN.exe
  C:\Windows\System\NkuUtnN.exe
  2⤵
  PID:7460
- C:\Windows\System\zfDhxrR.exe
  C:\Windows\System\zfDhxrR.exe
  2⤵
  PID:8716
- C:\Windows\System\LUbmhKc.exe
  C:\Windows\System\LUbmhKc.exe
  2⤵
  PID:9528
- C:\Windows\System\wmZZMEF.exe
  C:\Windows\System\wmZZMEF.exe
  2⤵
  PID:8932
- C:\Windows\System\LhXjnMC.exe
  C:\Windows\System\LhXjnMC.exe
  2⤵
  PID:9732
- C:\Windows\System\yJbNtIp.exe
  C:\Windows\System\yJbNtIp.exe
  2⤵
  PID:9100
- C:\Windows\System\sNlYJLT.exe
  C:\Windows\System\sNlYJLT.exe
  2⤵
  PID:9160
- C:\Windows\System\JiZAbEU.exe
  C:\Windows\System\JiZAbEU.exe
  2⤵
  PID:10132
- C:\Windows\System\yVjUBwo.exe
  C:\Windows\System\yVjUBwo.exe
  2⤵
  PID:10192
- C:\Windows\System\GGrZKLE.exe
  C:\Windows\System\GGrZKLE.exe
  2⤵
  PID:10232
- C:\Windows\System\xZHIUpJ.exe
  C:\Windows\System\xZHIUpJ.exe
  2⤵
  PID:6156
- C:\Windows\System\XUKntcX.exe
  C:\Windows\System\XUKntcX.exe
  2⤵
  PID:9288
- C:\Windows\System\uFsgACd.exe
  C:\Windows\System\uFsgACd.exe
  2⤵
  PID:9112
- C:\Windows\System\ALBbGhf.exe
  C:\Windows\System\ALBbGhf.exe
  2⤵
  PID:9872
- C:\Windows\System\jzghQhs.exe
  C:\Windows\System\jzghQhs.exe
  2⤵
  PID:10264
- C:\Windows\System\IMSBSTX.exe
  C:\Windows\System\IMSBSTX.exe
  2⤵
  PID:9380
- C:\Windows\System\LeIkZYz.exe
  C:\Windows\System\LeIkZYz.exe
  2⤵
  PID:10268
- C:\Windows\System\GxjKCUw.exe
  C:\Windows\System\GxjKCUw.exe
  2⤵
  PID:9584
- C:\Windows\System\qLlQnkt.exe
  C:\Windows\System\qLlQnkt.exe
  2⤵
  PID:10668
- C:\Windows\System\oFlXEKr.exe
  C:\Windows\System\oFlXEKr.exe
  2⤵
  PID:10200
- C:\Windows\System\lsomQwq.exe
  C:\Windows\System\lsomQwq.exe
  2⤵
  PID:8444
- C:\Windows\System\VCNdBsb.exe
  C:\Windows\System\VCNdBsb.exe
  2⤵
  PID:10968
- C:\Windows\System\ZxxKzul.exe
  C:\Windows\System\ZxxKzul.exe
  2⤵
  PID:6900
- C:\Windows\System\UWxYFrj.exe
  C:\Windows\System\UWxYFrj.exe
  2⤵
  PID:10084
- C:\Windows\System\kcmWOvQ.exe
  C:\Windows\System\kcmWOvQ.exe
  2⤵
  PID:11272
- C:\Windows\System\fNwkxiA.exe
  C:\Windows\System\fNwkxiA.exe
  2⤵
  PID:11292
- C:\Windows\System\FlSupVl.exe
  C:\Windows\System\FlSupVl.exe
  2⤵
  PID:11312
- C:\Windows\System\RTPyBZO.exe
  C:\Windows\System\RTPyBZO.exe
  2⤵
  PID:11340
- C:\Windows\System\YqEOvSW.exe
  C:\Windows\System\YqEOvSW.exe
  2⤵
  PID:11364
- C:\Windows\System\qlgZkSi.exe
  C:\Windows\System\qlgZkSi.exe
  2⤵
  PID:11384
- C:\Windows\System\xdJAGbA.exe
  C:\Windows\System\xdJAGbA.exe
  2⤵
  PID:11412
- C:\Windows\System\TnrsgdE.exe
  C:\Windows\System\TnrsgdE.exe
  2⤵
  PID:11440
- C:\Windows\System\mgMinmg.exe
  C:\Windows\System\mgMinmg.exe
  2⤵
  PID:11464
- C:\Windows\System\hyIshDk.exe
  C:\Windows\System\hyIshDk.exe
  2⤵
  PID:11488
- C:\Windows\System\KaYnHTo.exe
  C:\Windows\System\KaYnHTo.exe
  2⤵
  PID:11516
- C:\Windows\System\VlWlNsy.exe
  C:\Windows\System\VlWlNsy.exe
  2⤵
  PID:11532
- C:\Windows\System\CSRNLwV.exe
  C:\Windows\System\CSRNLwV.exe
  2⤵
  PID:11568
- C:\Windows\System\bwawQtB.exe
  C:\Windows\System\bwawQtB.exe
  2⤵
  PID:11584
- C:\Windows\System\pfqoKms.exe
  C:\Windows\System\pfqoKms.exe
  2⤵
  PID:11608
- C:\Windows\System\SdhQACc.exe
  C:\Windows\System\SdhQACc.exe
  2⤵
  PID:11628
- C:\Windows\System\PyGWVoS.exe
  C:\Windows\System\PyGWVoS.exe
  2⤵
  PID:11644
- C:\Windows\System\ZegJvRb.exe
  C:\Windows\System\ZegJvRb.exe
  2⤵
  PID:11672
- C:\Windows\System\UldrxhM.exe
  C:\Windows\System\UldrxhM.exe
  2⤵
  PID:11692
- C:\Windows\System\pMtFoAm.exe
  C:\Windows\System\pMtFoAm.exe
  2⤵
  PID:11716
- C:\Windows\System\KgwOpAf.exe
  C:\Windows\System\KgwOpAf.exe
  2⤵
  PID:11736
- C:\Windows\System\vKqttkp.exe
  C:\Windows\System\vKqttkp.exe
  2⤵
  PID:11756
- C:\Windows\System\vGqafZD.exe
  C:\Windows\System\vGqafZD.exe
  2⤵
  PID:11776
- C:\Windows\System\rycIBIW.exe
  C:\Windows\System\rycIBIW.exe
  2⤵
  PID:11800
- C:\Windows\System\SdmclKE.exe
  C:\Windows\System\SdmclKE.exe
  2⤵
  PID:11824
- C:\Windows\System\WkapBXH.exe
  C:\Windows\System\WkapBXH.exe
  2⤵
  PID:11848
- C:\Windows\System\vPnjgDz.exe
  C:\Windows\System\vPnjgDz.exe
  2⤵
  PID:11864
- C:\Windows\System\JrwnNBs.exe
  C:\Windows\System\JrwnNBs.exe
  2⤵
  PID:11884
- C:\Windows\System\cxKhMgf.exe
  C:\Windows\System\cxKhMgf.exe
  2⤵
  PID:11916
- C:\Windows\System\szSRKWI.exe
  C:\Windows\System\szSRKWI.exe
  2⤵
  PID:11932
- C:\Windows\System\xyFGDwP.exe
  C:\Windows\System\xyFGDwP.exe
  2⤵
  PID:11952
- C:\Windows\System\PsfxHLv.exe
  C:\Windows\System\PsfxHLv.exe
  2⤵
  PID:11976
- C:\Windows\System\cLBaZtq.exe
  C:\Windows\System\cLBaZtq.exe
  2⤵
  PID:11992
- C:\Windows\System\dbDrqQw.exe
  C:\Windows\System\dbDrqQw.exe
  2⤵
  PID:12008
- C:\Windows\System\JlphWFT.exe
  C:\Windows\System\JlphWFT.exe
  2⤵
  PID:12024
- C:\Windows\System\iQUTYpU.exe
  C:\Windows\System\iQUTYpU.exe
  2⤵
  PID:12040
- C:\Windows\System\LjHTPdZ.exe
  C:\Windows\System\LjHTPdZ.exe
  2⤵
  PID:12060
- C:\Windows\System\wrPxDzj.exe
  C:\Windows\System\wrPxDzj.exe
  2⤵
  PID:12076
- C:\Windows\System\KAtFvFz.exe
  C:\Windows\System\KAtFvFz.exe
  2⤵
  PID:12092
- C:\Windows\System\adwjGYH.exe
  C:\Windows\System\adwjGYH.exe
  2⤵
  PID:12108
- C:\Windows\System\KihPDFa.exe
  C:\Windows\System\KihPDFa.exe
  2⤵
  PID:12124
- C:\Windows\System\tNHdIZd.exe
  C:\Windows\System\tNHdIZd.exe
  2⤵
  PID:12140
- C:\Windows\System\ESEUkIy.exe
  C:\Windows\System\ESEUkIy.exe
  2⤵
  PID:12168
- C:\Windows\System\SxCGWky.exe
  C:\Windows\System\SxCGWky.exe
  2⤵
  PID:12188
- C:\Windows\System\dKSlubM.exe
  C:\Windows\System\dKSlubM.exe
  2⤵
  PID:12212
- C:\Windows\System\cAuXfGX.exe
  C:\Windows\System\cAuXfGX.exe
  2⤵
  PID:12236
- C:\Windows\System\OQWOunH.exe
  C:\Windows\System\OQWOunH.exe
  2⤵
  PID:12260
- C:\Windows\System\tGSsCoa.exe
  C:\Windows\System\tGSsCoa.exe
  2⤵
  PID:11168
- C:\Windows\System\uKhGyju.exe
  C:\Windows\System\uKhGyju.exe
  2⤵
  PID:11244
- C:\Windows\System\rcwExRO.exe
  C:\Windows\System\rcwExRO.exe
  2⤵
  PID:9040
- C:\Windows\System\EOCqTKc.exe
  C:\Windows\System\EOCqTKc.exe
  2⤵
  PID:9052
- C:\Windows\System\KmPlbHD.exe
  C:\Windows\System\KmPlbHD.exe
  2⤵
  PID:9268
- C:\Windows\System\gthlAbH.exe
  C:\Windows\System\gthlAbH.exe
  2⤵
  PID:9908
- C:\Windows\System\ufyzkQS.exe
  C:\Windows\System\ufyzkQS.exe
  2⤵
  PID:10524
- C:\Windows\System\WJgpzfe.exe
  C:\Windows\System\WJgpzfe.exe
  2⤵
  PID:10916
- C:\Windows\System\AGCmGwy.exe
  C:\Windows\System\AGCmGwy.exe
  2⤵
  PID:9728
- C:\Windows\System\NsIodEu.exe
  C:\Windows\System\NsIodEu.exe
  2⤵
  PID:9420
- C:\Windows\System\EXaMlNr.exe
  C:\Windows\System\EXaMlNr.exe
  2⤵
  PID:8168
- C:\Windows\System\vPJPDIj.exe
  C:\Windows\System\vPJPDIj.exe
  2⤵
  PID:8648
- C:\Windows\System\sBUYsOO.exe
  C:\Windows\System\sBUYsOO.exe
  2⤵
  PID:8800
- C:\Windows\System\NvIRGcB.exe
  C:\Windows\System\NvIRGcB.exe
  2⤵
  PID:10100
- C:\Windows\System\DfmLMSw.exe
  C:\Windows\System\DfmLMSw.exe
  2⤵
  PID:9792
- C:\Windows\System\vwVatdN.exe
  C:\Windows\System\vwVatdN.exe
  2⤵
  PID:11172
- C:\Windows\System\xjHgxzC.exe
  C:\Windows\System\xjHgxzC.exe
  2⤵
  PID:11376
- C:\Windows\System\csfasQO.exe
  C:\Windows\System\csfasQO.exe
  2⤵
  PID:11420
- C:\Windows\System\pwMGRvv.exe
  C:\Windows\System\pwMGRvv.exe
  2⤵
  PID:8184
- C:\Windows\System\mxCnlgd.exe
  C:\Windows\System\mxCnlgd.exe
  2⤵
  PID:8448
- C:\Windows\System\gcxxlCr.exe
  C:\Windows\System\gcxxlCr.exe
  2⤵
  PID:10676
- C:\Windows\System\XHdqQzw.exe
  C:\Windows\System\XHdqQzw.exe
  2⤵
  PID:11528
- C:\Windows\System\cwRjfKq.exe
  C:\Windows\System\cwRjfKq.exe
  2⤵
  PID:10700
- C:\Windows\System\ZpdHLhb.exe
  C:\Windows\System\ZpdHLhb.exe
  2⤵
  PID:10712
- C:\Windows\System\bOTnoBm.exe
  C:\Windows\System\bOTnoBm.exe
  2⤵
  PID:11616
- C:\Windows\System\IkTOLmy.exe
  C:\Windows\System\IkTOLmy.exe
  2⤵
  PID:10820
- C:\Windows\System\YLlnHNl.exe
  C:\Windows\System\YLlnHNl.exe
  2⤵
  PID:7084
- C:\Windows\System\ZbiFWWg.exe
  C:\Windows\System\ZbiFWWg.exe
  2⤵
  PID:11728
- C:\Windows\System\OHYLudF.exe
  C:\Windows\System\OHYLudF.exe
  2⤵
  PID:11796
- C:\Windows\System\qRdHxjo.exe
  C:\Windows\System\qRdHxjo.exe
  2⤵
  PID:8728
- C:\Windows\System\CtTApJn.exe
  C:\Windows\System\CtTApJn.exe
  2⤵
  PID:11044
- C:\Windows\System\hRfRGyW.exe
  C:\Windows\System\hRfRGyW.exe
  2⤵
  PID:10792
- C:\Windows\System\yeZJDjB.exe
  C:\Windows\System\yeZJDjB.exe
  2⤵
  PID:12052
- C:\Windows\System\KjgxuVb.exe
  C:\Windows\System\KjgxuVb.exe
  2⤵
  PID:11160
- C:\Windows\System\tRDhSsJ.exe
  C:\Windows\System\tRDhSsJ.exe
  2⤵
  PID:11332
- C:\Windows\System\lTrXtYA.exe
  C:\Windows\System\lTrXtYA.exe
  2⤵
  PID:12204
- C:\Windows\System\AcuUkhq.exe
  C:\Windows\System\AcuUkhq.exe
  2⤵
  PID:11424
- C:\Windows\System\cVLUxvM.exe
  C:\Windows\System\cVLUxvM.exe
  2⤵
  PID:12308
- C:\Windows\System\fqBFjTL.exe
  C:\Windows\System\fqBFjTL.exe
  2⤵
  PID:12328
- C:\Windows\System\edBeTtF.exe
  C:\Windows\System\edBeTtF.exe
  2⤵
  PID:12352
- C:\Windows\System\urkEghS.exe
  C:\Windows\System\urkEghS.exe
  2⤵
  PID:12376
- C:\Windows\System\NpVabQz.exe
  C:\Windows\System\NpVabQz.exe
  2⤵
  PID:12404
- C:\Windows\System\aBeanHI.exe
  C:\Windows\System\aBeanHI.exe
  2⤵
  PID:12424
- C:\Windows\System\THMCIPg.exe
  C:\Windows\System\THMCIPg.exe
  2⤵
  PID:12440
- C:\Windows\System\MLILdFC.exe
  C:\Windows\System\MLILdFC.exe
  2⤵
  PID:12456
- C:\Windows\System\anuTxbT.exe
  C:\Windows\System\anuTxbT.exe
  2⤵
  PID:12472
- C:\Windows\System\mhCVGKV.exe
  C:\Windows\System\mhCVGKV.exe
  2⤵
  PID:12488
- C:\Windows\System\tAhxbDQ.exe
  C:\Windows\System\tAhxbDQ.exe
  2⤵
  PID:12504
- C:\Windows\System\jOntUdt.exe
  C:\Windows\System\jOntUdt.exe
  2⤵
  PID:12520
- C:\Windows\System\zzwSvnW.exe
  C:\Windows\System\zzwSvnW.exe
  2⤵
  PID:12536
- C:\Windows\System\LjymrnX.exe
  C:\Windows\System\LjymrnX.exe
  2⤵
  PID:12552
- C:\Windows\System\mjwocfs.exe
  C:\Windows\System\mjwocfs.exe
  2⤵
  PID:12568
- C:\Windows\System\HDRdisp.exe
  C:\Windows\System\HDRdisp.exe
  2⤵
  PID:12588
- C:\Windows\System\ahawVIT.exe
  C:\Windows\System\ahawVIT.exe
  2⤵
  PID:12612
- C:\Windows\System\ZiVaprJ.exe
  C:\Windows\System\ZiVaprJ.exe
  2⤵
  PID:12632
- C:\Windows\System\CAnBcBI.exe
  C:\Windows\System\CAnBcBI.exe
  2⤵
  PID:12652
- C:\Windows\System\MObSRcH.exe
  C:\Windows\System\MObSRcH.exe
  2⤵
  PID:12680
- C:\Windows\System\oPCttPE.exe
  C:\Windows\System\oPCttPE.exe
  2⤵
  PID:12704
- C:\Windows\System\PQUOJOX.exe
  C:\Windows\System\PQUOJOX.exe
  2⤵
  PID:12728
- C:\Windows\System\ibbqXkZ.exe
  C:\Windows\System\ibbqXkZ.exe
  2⤵
  PID:12752
- C:\Windows\System\JPlADCE.exe
  C:\Windows\System\JPlADCE.exe
  2⤵
  PID:12780
- C:\Windows\System\LQeybsY.exe
  C:\Windows\System\LQeybsY.exe
  2⤵
  PID:12808
- C:\Windows\System\bizMhYm.exe
  C:\Windows\System\bizMhYm.exe
  2⤵
  PID:12832
- C:\Windows\System\bEzBJuq.exe
  C:\Windows\System\bEzBJuq.exe
  2⤵
  PID:12856
- C:\Windows\System\RTwObsX.exe
  C:\Windows\System\RTwObsX.exe
  2⤵
  PID:12876
- C:\Windows\System\XzZlnwt.exe
  C:\Windows\System\XzZlnwt.exe
  2⤵
  PID:12900
- C:\Windows\System\fTNNlZD.exe
  C:\Windows\System\fTNNlZD.exe
  2⤵
  PID:12924
- C:\Windows\System\aGsBkQb.exe
  C:\Windows\System\aGsBkQb.exe
  2⤵
  PID:12948
- C:\Windows\System\vXAOfiA.exe
  C:\Windows\System\vXAOfiA.exe
  2⤵
  PID:11120
- C:\Windows\System\krBrIpM.exe
  C:\Windows\System\krBrIpM.exe
  2⤵
  PID:11144
- C:\Windows\System\PtDfRiy.exe
  C:\Windows\System\PtDfRiy.exe
  2⤵
  PID:12744
- C:\Windows\System\ZhyFbAp.exe
  C:\Windows\System\ZhyFbAp.exe
  2⤵
  PID:12792
- C:\Windows\System\DWAgadl.exe
  C:\Windows\System\DWAgadl.exe
  2⤵
  PID:9904
- C:\Windows\System\rijACgE.exe
  C:\Windows\System\rijACgE.exe
  2⤵
  PID:12516
- C:\Windows\System\tDRacau.exe
  C:\Windows\System\tDRacau.exe
  2⤵
  PID:12548
- C:\Windows\System\bSjvkcK.exe
  C:\Windows\System\bSjvkcK.exe
  2⤵
  PID:12824
- C:\Windows\System\GhRmEtx.exe
  C:\Windows\System\GhRmEtx.exe
  2⤵
  PID:12628
- C:\Windows\System\iahgxms.exe
  C:\Windows\System\iahgxms.exe
  2⤵
  PID:12696
- C:\Windows\System\NyCRgdb.exe
  C:\Windows\System\NyCRgdb.exe
  2⤵
  PID:8680
- C:\Windows\System\fzrqTLR.exe
  C:\Windows\System\fzrqTLR.exe
  2⤵
  PID:11668
- C:\Windows\System\pfbqUsJ.exe
  C:\Windows\System\pfbqUsJ.exe
  2⤵
  PID:12772
- C:\Windows\System\ICNbbpd.exe
  C:\Windows\System\ICNbbpd.exe
  2⤵
  PID:11320
- C:\Windows\System\QYSewJa.exe
  C:\Windows\System\QYSewJa.exe
  2⤵
  PID:13112
- C:\Windows\System\KJMeKIB.exe
  C:\Windows\System\KJMeKIB.exe
  2⤵
  PID:13220
- C:\Windows\System\TyxGgLt.exe
  C:\Windows\System\TyxGgLt.exe
  2⤵
  PID:13264
- C:\Windows\System\LMldmHR.exe
  C:\Windows\System\LMldmHR.exe
  2⤵
  PID:12944
- C:\Windows\System\RBVLDIK.exe
  C:\Windows\System\RBVLDIK.exe
  2⤵
  PID:13104
- C:\Windows\System\PTifloJ.exe
  C:\Windows\System\PTifloJ.exe
  2⤵
  PID:9592
- C:\Windows\System\tPazdRK.exe
  C:\Windows\System\tPazdRK.exe
  2⤵
  PID:13052
- C:\Windows\System\GHsjDEO.exe
  C:\Windows\System\GHsjDEO.exe
  2⤵
  PID:8828
- C:\Windows\System\kJuYIhi.exe
  C:\Windows\System\kJuYIhi.exe
  2⤵
  PID:13152
- C:\Windows\System\IgixqHM.exe
  C:\Windows\System\IgixqHM.exe
  2⤵
  PID:10828
- C:\Windows\System\GFtdBVd.exe
  C:\Windows\System\GFtdBVd.exe
  2⤵
  PID:11984
- C:\Windows\System\DGGMuIn.exe
  C:\Windows\System\DGGMuIn.exe
  2⤵
  PID:12368
- C:\Windows\System\bhHoKCG.exe
  C:\Windows\System\bhHoKCG.exe
  2⤵
  PID:12484
- C:\Windows\System\vYfNawY.exe
  C:\Windows\System\vYfNawY.exe
  2⤵
  PID:9332
- C:\Windows\System\tPrHTiG.exe
  C:\Windows\System\tPrHTiG.exe
  2⤵
  PID:1200
- C:\Windows\System\Zsxwfsg.exe
  C:\Windows\System\Zsxwfsg.exe
  2⤵
  PID:10176
- C:\Windows\System\vNuIwOt.exe
  C:\Windows\System\vNuIwOt.exe
  2⤵
  PID:12300
- C:\Windows\System\EvffAId.exe
  C:\Windows\System\EvffAId.exe
  2⤵
  PID:8892
- C:\Windows\System\NeOxjSl.exe
  C:\Windows\System\NeOxjSl.exe
  2⤵
  PID:13140
- C:\Windows\System\SPBToFQ.exe
  C:\Windows\System\SPBToFQ.exe
  2⤵
  PID:12248
- C:\Windows\System\gCTXfaG.exe
  C:\Windows\System\gCTXfaG.exe
  2⤵
  PID:8772
- C:\Windows\System\JoUlMsB.exe
  C:\Windows\System\JoUlMsB.exe
  2⤵
  PID:876
- C:\Windows\System\lKPOLvl.exe
  C:\Windows\System\lKPOLvl.exe
  2⤵
  PID:10372
- C:\Windows\System\rFMPvrO.exe
  C:\Windows\System\rFMPvrO.exe
  2⤵
  PID:13308
- C:\Windows\System\sXOyyfa.exe
  C:\Windows\System\sXOyyfa.exe
  2⤵
  PID:10516
- C:\Windows\System\xxIxgMW.exe
  C:\Windows\System\xxIxgMW.exe
  2⤵
  PID:12932
- C:\Windows\System\bZoglZX.exe
  C:\Windows\System\bZoglZX.exe
  2⤵
  PID:11768
- C:\Windows\System\mpeKnaD.exe
  C:\Windows\System\mpeKnaD.exe
  2⤵
  PID:7812
- C:\Windows\System\ezzRxWF.exe
  C:\Windows\System\ezzRxWF.exe
  2⤵
  PID:11652
- C:\Windows\System\LUvuHYq.exe
  C:\Windows\System\LUvuHYq.exe
  2⤵
  PID:11972
- C:\Windows\System\YWUwtam.exe
  C:\Windows\System\YWUwtam.exe
  2⤵
  PID:2740
- C:\Windows\System\CdHTSLD.exe
  C:\Windows\System\CdHTSLD.exe
  2⤵
  PID:12160
- C:\Windows\System\AOdMkxn.exe
  C:\Windows\System\AOdMkxn.exe
  2⤵
  PID:9640
- C:\Windows\System\deuOuwk.exe
  C:\Windows\System\deuOuwk.exe
  2⤵
  PID:12868
- C:\Windows\System\YeukCzx.exe
  C:\Windows\System\YeukCzx.exe
  2⤵
  PID:10508
- C:\Windows\System\fpxgSck.exe
  C:\Windows\System\fpxgSck.exe
  2⤵
  PID:8324
- C:\Windows\System\VTTbOnL.exe
  C:\Windows\System\VTTbOnL.exe
  2⤵
  PID:10944
- C:\Windows\System\tzFlrsq.exe
  C:\Windows\System\tzFlrsq.exe
  2⤵
  PID:12968
- C:\Windows\System\ujYiRdR.exe
  C:\Windows\System\ujYiRdR.exe
  2⤵
  PID:13292
- C:\Windows\System\lWSEvXd.exe
  C:\Windows\System\lWSEvXd.exe
  2⤵
  PID:12016
- C:\Windows\System\dAvyGHk.exe
  C:\Windows\System\dAvyGHk.exe
  2⤵
  PID:12196
- C:\Windows\System\BIOIkkO.exe
  C:\Windows\System\BIOIkkO.exe
  2⤵
  PID:11640
- C:\Windows\System\AlRfbIs.exe
  C:\Windows\System\AlRfbIs.exe
  2⤵
  PID:3076
- C:\Windows\System\wTEnwdA.exe
  C:\Windows\System\wTEnwdA.exe
  2⤵
  PID:11744
- C:\Windows\System\RZytHUH.exe
  C:\Windows\System\RZytHUH.exe
  2⤵
  PID:12296
- C:\Windows\System\nURuoiO.exe
  C:\Windows\System\nURuoiO.exe
  2⤵
  PID:10572
- C:\Windows\System\GflrOro.exe
  C:\Windows\System\GflrOro.exe
  2⤵
  PID:4660
- C:\Windows\System\cHdCtzh.exe
  C:\Windows\System\cHdCtzh.exe
  2⤵
  PID:12360
- C:\Windows\System\GyGUYMO.exe
  C:\Windows\System\GyGUYMO.exe
  2⤵
  PID:4212
- C:\Windows\System\BIDNEqN.exe
  C:\Windows\System\BIDNEqN.exe
  2⤵
  PID:12984
- C:\Windows\System\wlFDyVh.exe
  C:\Windows\System\wlFDyVh.exe
  2⤵
  PID:4556
- C:\Windows\System\UzteWyw.exe
  C:\Windows\System\UzteWyw.exe
  2⤵
  PID:5244
- C:\Windows\System\KqutZeh.exe
  C:\Windows\System\KqutZeh.exe
  2⤵
  PID:5576
- C:\Windows\System\ZAyiJKq.exe
  C:\Windows\System\ZAyiJKq.exe
  2⤵
  PID:5584
- C:\Windows\System\SUZYNTH.exe
  C:\Windows\System\SUZYNTH.exe
  2⤵
  PID:5932
- C:\Windows\System\rrFAhnd.exe
  C:\Windows\System\rrFAhnd.exe
  2⤵
  PID:11524
- C:\Windows\System\WHoxTYG.exe
  C:\Windows\System\WHoxTYG.exe
  2⤵
  PID:13296
- C:\Windows\System\OyXnqdL.exe
  C:\Windows\System\OyXnqdL.exe
  2⤵
  PID:1496
- C:\Windows\System\FDIPAUd.exe
  C:\Windows\System\FDIPAUd.exe
  2⤵
  PID:10876
- C:\Windows\System\WRAIccA.exe
  C:\Windows\System\WRAIccA.exe
  2⤵
  PID:12432
- C:\Windows\System\gifZzfl.exe
  C:\Windows\System\gifZzfl.exe
  2⤵
  PID:5912
- C:\Windows\System\VpSbnHX.exe
  C:\Windows\System\VpSbnHX.exe
  2⤵
  PID:13284
- C:\Windows\System\OEvnChW.exe
  C:\Windows\System\OEvnChW.exe
  2⤵
  PID:13192
- C:\Windows\System\iWJyldz.exe
  C:\Windows\System\iWJyldz.exe
  2⤵
  PID:2024
- C:\Windows\System\WWneiRy.exe
  C:\Windows\System\WWneiRy.exe
  2⤵
  PID:13116
- C:\Windows\System\ZeMpzww.exe
  C:\Windows\System\ZeMpzww.exe
  2⤵
  PID:10088
- C:\Windows\System\cxdlCrA.exe
  C:\Windows\System\cxdlCrA.exe
  2⤵
  PID:3320
- C:\Windows\System\RAKmIHL.exe
  C:\Windows\System\RAKmIHL.exe
  2⤵
  PID:5580
- C:\Windows\System\IYqXWZX.exe
  C:\Windows\System\IYqXWZX.exe
  2⤵
  PID:13328
- C:\Windows\System\EZDtFWQ.exe
  C:\Windows\System\EZDtFWQ.exe
  2⤵
  PID:13360
- C:\Windows\System\XRqdTkj.exe
  C:\Windows\System\XRqdTkj.exe
  2⤵
  PID:13392
- C:\Windows\System\auZsDqp.exe
  C:\Windows\System\auZsDqp.exe
  2⤵
  PID:13408
- C:\Windows\System\UZmDvYf.exe
  C:\Windows\System\UZmDvYf.exe
  2⤵
  PID:13424
- C:\Windows\System\RRkjGvm.exe
  C:\Windows\System\RRkjGvm.exe
  2⤵
  PID:13440
- C:\Windows\System\yEdfzeW.exe
  C:\Windows\System\yEdfzeW.exe
  2⤵
  PID:13456
- C:\Windows\System\MQfKzMQ.exe
  C:\Windows\System\MQfKzMQ.exe
  2⤵
  PID:13472
- C:\Windows\System\GRcCMZO.exe
  C:\Windows\System\GRcCMZO.exe
  2⤵
  PID:13488
- C:\Windows\System\PMuCveT.exe
  C:\Windows\System\PMuCveT.exe
  2⤵
  PID:13504
- C:\Windows\System\DeaMpvN.exe
  C:\Windows\System\DeaMpvN.exe
  2⤵
  PID:13520
- C:\Windows\System\pkReRMY.exe
  C:\Windows\System\pkReRMY.exe
  2⤵
  PID:13536
- C:\Windows\System\WVgbvBT.exe
  C:\Windows\System\WVgbvBT.exe
  2⤵
  PID:13552
- C:\Windows\System\ncuVqqj.exe
  C:\Windows\System\ncuVqqj.exe
  2⤵
  PID:13568
- C:\Windows\System\tPsrEbN.exe
  C:\Windows\System\tPsrEbN.exe
  2⤵
  PID:13588
- C:\Windows\System\qaBKxGL.exe
  C:\Windows\System\qaBKxGL.exe
  2⤵
  PID:13608
- C:\Windows\System\HGtlNTO.exe
  C:\Windows\System\HGtlNTO.exe
  2⤵
  PID:13624
- C:\Windows\System\RIBTudU.exe
  C:\Windows\System\RIBTudU.exe
  2⤵
  PID:13640
- C:\Windows\System\iCKTpJa.exe
  C:\Windows\System\iCKTpJa.exe
  2⤵
  PID:13656
- C:\Windows\System\jhcfUrU.exe
  C:\Windows\System\jhcfUrU.exe
  2⤵
  PID:13676
- C:\Windows\System\dzpsKCx.exe
  C:\Windows\System\dzpsKCx.exe
  2⤵
  PID:13696
- C:\Windows\System\vuiaTSO.exe
  C:\Windows\System\vuiaTSO.exe
  2⤵
  PID:13712
- C:\Windows\System\KWgTywn.exe
  C:\Windows\System\KWgTywn.exe
  2⤵
  PID:13728
- C:\Windows\System\HmTJMdd.exe
  C:\Windows\System\HmTJMdd.exe
  2⤵
  PID:13752
- C:\Windows\System\sSwPOzh.exe
  C:\Windows\System\sSwPOzh.exe
  2⤵
  PID:13772
- C:\Windows\System\qfcIUTW.exe
  C:\Windows\System\qfcIUTW.exe
  2⤵
  PID:13788
- C:\Windows\System\LDDLFQz.exe
  C:\Windows\System\LDDLFQz.exe
  2⤵
  PID:13804
- C:\Windows\System\oxyJRWE.exe
  C:\Windows\System\oxyJRWE.exe
  2⤵
  PID:13820
- C:\Windows\System\pnIRHiD.exe
  C:\Windows\System\pnIRHiD.exe
  2⤵
  PID:13836
- C:\Windows\System\EkNcWQh.exe
  C:\Windows\System\EkNcWQh.exe
  2⤵
  PID:13864
- C:\Windows\System\rsbTOkZ.exe
  C:\Windows\System\rsbTOkZ.exe
  2⤵
  PID:13884
- C:\Windows\System\kvuCzOf.exe
  C:\Windows\System\kvuCzOf.exe
  2⤵
  PID:13904
- C:\Windows\System\OlQJbaT.exe
  C:\Windows\System\OlQJbaT.exe
  2⤵
  PID:13920
- C:\Windows\System\gwxuKaa.exe
  C:\Windows\System\gwxuKaa.exe
  2⤵
  PID:13936
- C:\Windows\System\AHziUoo.exe
  C:\Windows\System\AHziUoo.exe
  2⤵
  PID:13952
- C:\Windows\System\RmHlIFs.exe
  C:\Windows\System\RmHlIFs.exe
  2⤵
  PID:13968
- C:\Windows\System\ymGRVGm.exe
  C:\Windows\System\ymGRVGm.exe
  2⤵
  PID:13984
- C:\Windows\System\XqFLvKV.exe
  C:\Windows\System\XqFLvKV.exe
  2⤵
  PID:14000
- C:\Windows\System\FSbSGKw.exe
  C:\Windows\System\FSbSGKw.exe
  2⤵
  PID:14016
- C:\Windows\System\CEGdrWm.exe
  C:\Windows\System\CEGdrWm.exe
  2⤵
  PID:14032
- C:\Windows\System\pDGxdsj.exe
  C:\Windows\System\pDGxdsj.exe
  2⤵
  PID:14048
- C:\Windows\System\XBlwakZ.exe
  C:\Windows\System\XBlwakZ.exe
  2⤵
  PID:14064
- C:\Windows\System\TwrOpTl.exe
  C:\Windows\System\TwrOpTl.exe
  2⤵
  PID:14080
- C:\Windows\System\bcrvDEk.exe
  C:\Windows\System\bcrvDEk.exe
  2⤵
  PID:14096
- C:\Windows\System\qExEVYI.exe
  C:\Windows\System\qExEVYI.exe
  2⤵
  PID:14112
- C:\Windows\System\PeCLxKp.exe
  C:\Windows\System\PeCLxKp.exe
  2⤵
  PID:14128
- C:\Windows\System\VrkSNTh.exe
  C:\Windows\System\VrkSNTh.exe
  2⤵
  PID:14148
- C:\Windows\System\tBfRngY.exe
  C:\Windows\System\tBfRngY.exe
  2⤵
  PID:14164
- C:\Windows\System\HbCwnQn.exe
  C:\Windows\System\HbCwnQn.exe
  2⤵
  PID:14180
- C:\Windows\System\ezYfAbs.exe
  C:\Windows\System\ezYfAbs.exe
  2⤵
  PID:14196
- C:\Windows\System\gWOZdWo.exe
  C:\Windows\System\gWOZdWo.exe
  2⤵
  PID:14212
- C:\Windows\System\QiwOpyO.exe
  C:\Windows\System\QiwOpyO.exe
  2⤵
  PID:14228
- C:\Windows\System\MOEuwbx.exe
  C:\Windows\System\MOEuwbx.exe
  2⤵
  PID:14244
- C:\Windows\System\zgXEtxB.exe
  C:\Windows\System\zgXEtxB.exe
  2⤵
  PID:14264
- C:\Windows\System\RCAZNpM.exe
  C:\Windows\System\RCAZNpM.exe
  2⤵
  PID:14284
- C:\Windows\System\pQogqwD.exe
  C:\Windows\System\pQogqwD.exe
  2⤵
  PID:14300
- C:\Windows\System\Quwpvex.exe
  C:\Windows\System\Quwpvex.exe
  2⤵
  PID:14320
- C:\Windows\System\rxKtufw.exe
  C:\Windows\System\rxKtufw.exe
  2⤵
  PID:4920
- C:\Windows\System\AXOiakW.exe
  C:\Windows\System\AXOiakW.exe
  2⤵
  PID:13384
- C:\Windows\System\xNciexd.exe
  C:\Windows\System\xNciexd.exe
  2⤵
  PID:13416
- C:\Windows\System\TGcyvTk.exe
  C:\Windows\System\TGcyvTk.exe
  2⤵
  PID:13468
- C:\Windows\System\EgkHiiw.exe
  C:\Windows\System\EgkHiiw.exe
  2⤵
  PID:13496
- C:\Windows\System\WKeHbdU.exe
  C:\Windows\System\WKeHbdU.exe
  2⤵
  PID:13532
- C:\Windows\System\SdpHXTa.exe
  C:\Windows\System\SdpHXTa.exe
  2⤵
  PID:13564
- C:\Windows\System\AoGONEZ.exe
  C:\Windows\System\AoGONEZ.exe
  2⤵
  PID:13604
- C:\Windows\System\tkGEjpl.exe
  C:\Windows\System\tkGEjpl.exe
  2⤵
  PID:13636
- C:\Windows\System\yuMHgSx.exe
  C:\Windows\System\yuMHgSx.exe
  2⤵
  PID:13664
- C:\Windows\System\XjLckng.exe
  C:\Windows\System\XjLckng.exe
  2⤵
  PID:13720
- C:\Windows\System\rKWhAqh.exe
  C:\Windows\System\rKWhAqh.exe
  2⤵
  PID:13748
- C:\Windows\System\jHgHYTX.exe
  C:\Windows\System\jHgHYTX.exe
  2⤵
  PID:13784
- C:\Windows\System\FyoTnEn.exe
  C:\Windows\System\FyoTnEn.exe
  2⤵
  PID:13812
- C:\Windows\System\zFobjgU.exe
  C:\Windows\System\zFobjgU.exe
  2⤵
  PID:13856
- C:\Windows\System\xYEhgAh.exe
  C:\Windows\System\xYEhgAh.exe
  2⤵
  PID:5004
- C:\Windows\System\WOCVPvJ.exe
  C:\Windows\System\WOCVPvJ.exe
  2⤵
  PID:4856
- C:\Windows\System\FDwDBNU.exe
  C:\Windows\System\FDwDBNU.exe
  2⤵
  PID:13872
- C:\Windows\System\uIXfQYf.exe
  C:\Windows\System\uIXfQYf.exe
  2⤵
  PID:13912
- C:\Windows\System\OcejtRp.exe
  C:\Windows\System\OcejtRp.exe
  2⤵
  PID:13944
- C:\Windows\System\xSRtXNG.exe
  C:\Windows\System\xSRtXNG.exe
  2⤵
  PID:13964
- C:\Windows\System\RXJDpjf.exe
  C:\Windows\System\RXJDpjf.exe
  2⤵
  PID:13996
- C:\Windows\System\rfwnPLw.exe
  C:\Windows\System\rfwnPLw.exe
  2⤵
  PID:14028
- C:\Windows\System\ZIXrelf.exe
  C:\Windows\System\ZIXrelf.exe
  2⤵
  PID:14060
- C:\Windows\System\cEjnluw.exe
  C:\Windows\System\cEjnluw.exe
  2⤵
  PID:14088
- C:\Windows\System\LNWbszk.exe
  C:\Windows\System\LNWbszk.exe
  2⤵
  PID:14136
- C:\Windows\System\XZjfFei.exe
  C:\Windows\System\XZjfFei.exe
  2⤵
  PID:14176
- C:\Windows\System\TaaCfSD.exe
  C:\Windows\System\TaaCfSD.exe
  2⤵
  PID:14280
- C:\Windows\System\icVstYR.exe
  C:\Windows\System\icVstYR.exe
  2⤵
  PID:14316
- C:\Windows\System\DhMlptT.exe
  C:\Windows\System\DhMlptT.exe
  2⤵
  PID:13356
- C:\Windows\System\vOZTcFy.exe
  C:\Windows\System\vOZTcFy.exe
  2⤵
  PID:13448
- C:\Windows\System\jMEzeWd.exe
  C:\Windows\System\jMEzeWd.exe
  2⤵
  PID:13512
- C:\Windows\System\fPRfEfM.exe
  C:\Windows\System\fPRfEfM.exe
  2⤵
  PID:13620
- C:\Windows\System\bjzIpyw.exe
  C:\Windows\System\bjzIpyw.exe
  2⤵
  PID:13744
- C:\Windows\System\SrQrEXP.exe
  C:\Windows\System\SrQrEXP.exe
  2⤵
  PID:13800
- C:\Windows\System\DHbyjda.exe
  C:\Windows\System\DHbyjda.exe
  2⤵
  PID:968
- C:\Windows\System\tcRWijn.exe
  C:\Windows\System\tcRWijn.exe
  2⤵
  PID:13432
- C:\Windows\System\LpZrWtI.exe
  C:\Windows\System\LpZrWtI.exe
  2⤵
  PID:14160
- C:\Windows\System\IdvEXSR.exe
  C:\Windows\System\IdvEXSR.exe
  2⤵
  PID:13560
- C:\Windows\System\zdtCIGL.exe
  C:\Windows\System\zdtCIGL.exe
  2⤵
  PID:14220
- C:\Windows\System\SEhUPvN.exe
  C:\Windows\System\SEhUPvN.exe
  2⤵
  PID:2516
- C:\Windows\System\rnEiggE.exe
  C:\Windows\System\rnEiggE.exe
  2⤵
  PID:1956
- C:\Windows\System\qWMcdfq.exe
  C:\Windows\System\qWMcdfq.exe
  2⤵
  PID:14224
- C:\Windows\System\VGEqaxu.exe
  C:\Windows\System\VGEqaxu.exe
  2⤵
  PID:14240
- C:\Windows\System\yZoCQrG.exe
  C:\Windows\System\yZoCQrG.exe
  2⤵
  PID:14312
- C:\Windows\System\LpWQPWc.exe
  C:\Windows\System\LpWQPWc.exe
  2⤵
  PID:13760
- C:\Windows\System\qvUSYac.exe
  C:\Windows\System\qvUSYac.exe
  2⤵
  PID:3452
- C:\Windows\System\pMNOQvg.exe
  C:\Windows\System\pMNOQvg.exe
  2⤵
  PID:13896
- C:\Windows\System\dePXyOz.exe
  C:\Windows\System\dePXyOz.exe
  2⤵
  PID:11592
- C:\Windows\System\UNeGenl.exe
  C:\Windows\System\UNeGenl.exe
  2⤵
  PID:14012
- C:\Windows\System\RwALRhR.exe
  C:\Windows\System\RwALRhR.exe
  2⤵
  PID:14056
- C:\Windows\System\TThDkAH.exe
  C:\Windows\System\TThDkAH.exe
  2⤵
  PID:5084
- C:\Windows\System\TyDLFAc.exe
  C:\Windows\System\TyDLFAc.exe
  2⤵
  PID:14092
- C:\Windows\System\tEuYNxK.exe
  C:\Windows\System\tEuYNxK.exe
  2⤵
  PID:5904
- C:\Windows\System\yblAeBa.exe
  C:\Windows\System\yblAeBa.exe
  2⤵
  PID:14124
- C:\Windows\System\RLZMylJ.exe
  C:\Windows\System\RLZMylJ.exe
  2⤵
  PID:3908
- C:\Windows\System\rttKwiZ.exe
  C:\Windows\System\rttKwiZ.exe
  2⤵
  PID:520
- C:\Windows\System\zJVwsDn.exe
  C:\Windows\System\zJVwsDn.exe
  2⤵
  PID:4804
- C:\Windows\System\jpCHDyu.exe
  C:\Windows\System\jpCHDyu.exe
  2⤵
  PID:14276
- C:\Windows\System\MmQpzok.exe
  C:\Windows\System\MmQpzok.exe
  2⤵
  PID:13344
- C:\Windows\System\gOYkbwP.exe
  C:\Windows\System\gOYkbwP.exe
  2⤵
  PID:14332
- C:\Windows\System\VqifZut.exe
  C:\Windows\System\VqifZut.exe
  2⤵
  PID:13708
- C:\Windows\System\vRLWaPD.exe
  C:\Windows\System\vRLWaPD.exe
  2⤵
  PID:14204
- C:\Windows\System\IdnVVto.exe
  C:\Windows\System\IdnVVto.exe
  2⤵
  PID:1288
- C:\Windows\System\XEKDRRu.exe
  C:\Windows\System\XEKDRRu.exe
  2⤵
  PID:13600
- C:\Windows\System\EdCAAZL.exe
  C:\Windows\System\EdCAAZL.exe
  2⤵
  PID:13876
- C:\Windows\System\UliDZhf.exe
  C:\Windows\System\UliDZhf.exe
  2⤵
  PID:4584
- C:\Windows\System\IsYxIAT.exe
  C:\Windows\System\IsYxIAT.exe
  2⤵
  PID:14108
- C:\Windows\System\WPQyAGa.exe
  C:\Windows\System\WPQyAGa.exe
  2⤵
  PID:13584
- C:\Windows\System\WQxLiyu.exe
  C:\Windows\System\WQxLiyu.exe
  2⤵
  PID:13704
- C:\Windows\System\RLQCCFq.exe
  C:\Windows\System\RLQCCFq.exe
  2⤵
  PID:2792
- C:\Windows\System\FfEQbKf.exe
  C:\Windows\System\FfEQbKf.exe
  2⤵
  PID:1524
- C:\Windows\System\LosDQen.exe
  C:\Windows\System\LosDQen.exe
  2⤵
  PID:3180
- C:\Windows\System\rvPXNxY.exe
  C:\Windows\System\rvPXNxY.exe
  2⤵
  PID:1768
- C:\Windows\System\SXAfaST.exe
  C:\Windows\System\SXAfaST.exe
  2⤵
  PID:4552
- C:\Windows\System\rsnRRBm.exe
  C:\Windows\System\rsnRRBm.exe
  2⤵
  PID:13832
- C:\Windows\System\mojobYM.exe
  C:\Windows\System\mojobYM.exe
  2⤵
  PID:4260
- C:\Windows\System\JlXFjNR.exe
  C:\Windows\System\JlXFjNR.exe
  2⤵
  PID:14272
- C:\Windows\System\KZIAZoG.exe
  C:\Windows\System\KZIAZoG.exe
  2⤵
  PID:3128
- C:\Windows\System\hAHttZN.exe
  C:\Windows\System\hAHttZN.exe
  2⤵
  PID:14296
- C:\Windows\System\owannKz.exe
  C:\Windows\System\owannKz.exe
  2⤵
  PID:13400
- C:\Windows\System\fReNKlT.exe
  C:\Windows\System\fReNKlT.exe
  2⤵
  PID:5988
- C:\Windows\System\aLEKPbN.exe
  C:\Windows\System\aLEKPbN.exe
  2⤵
  PID:4776
- C:\Windows\System\CGkrSgp.exe
  C:\Windows\System\CGkrSgp.exe
  2⤵
  PID:4564
- C:\Windows\System\xHBzpMP.exe
  C:\Windows\System\xHBzpMP.exe
  2⤵
  PID:4176
- C:\Windows\System\YVUqgBB.exe
  C:\Windows\System\YVUqgBB.exe
  2⤵
  PID:14120
- C:\Windows\System\pxSPBBM.exe
  C:\Windows\System\pxSPBBM.exe
  2⤵
  PID:4244
- C:\Windows\System\ldepChu.exe
  C:\Windows\System\ldepChu.exe
  2⤵
  PID:13892
- C:\Windows\System\vYsinDE.exe
  C:\Windows\System\vYsinDE.exe
  2⤵
  PID:936
- C:\Windows\System\wWFoZLb.exe
  C:\Windows\System\wWFoZLb.exe
  2⤵
  PID:3436
- C:\Windows\System\jefszHO.exe
  C:\Windows\System\jefszHO.exe
  2⤵
  PID:3268
- C:\Windows\System\YijMtrO.exe
  C:\Windows\System\YijMtrO.exe
  2⤵
  PID:2588
- C:\Windows\System\hvoRpoJ.exe
  C:\Windows\System\hvoRpoJ.exe
  2⤵
  PID:4560
- C:\Windows\System\RiuHyIH.exe
  C:\Windows\System\RiuHyIH.exe
  2⤵
  PID:5088
- C:\Windows\System\OKoyUKJ.exe
  C:\Windows\System\OKoyUKJ.exe
  2⤵
  PID:14260
- C:\Windows\System\aqwraUb.exe
  C:\Windows\System\aqwraUb.exe
  2⤵
  PID:14144
- C:\Windows\System\ueqlWmw.exe
  C:\Windows\System\ueqlWmw.exe
  2⤵
  PID:880
- C:\Windows\System\gdwOxKu.exe
  C:\Windows\System\gdwOxKu.exe
  2⤵
  PID:5864
- C:\Windows\System\fPsBFIw.exe
  C:\Windows\System\fPsBFIw.exe
  2⤵
  PID:8624
- C:\Windows\System\ChHfBuy.exe
  C:\Windows\System\ChHfBuy.exe
  2⤵
  PID:4928
- C:\Windows\System\LiXRznN.exe
  C:\Windows\System\LiXRznN.exe
  2⤵
  PID:8860
- C:\Windows\System\TwdfPYh.exe
  C:\Windows\System\TwdfPYh.exe
  2⤵
  PID:8980
- C:\Windows\System\yrBTnRW.exe
  C:\Windows\System\yrBTnRW.exe
  2⤵
  PID:9124
- C:\Windows\System\hKZkJVI.exe
  C:\Windows\System\hKZkJVI.exe
  2⤵
  PID:2788
- C:\Windows\System\MnuiCOp.exe
  C:\Windows\System\MnuiCOp.exe
  2⤵
  PID:2964
- C:\Windows\System\IvfpTwq.exe
  C:\Windows\System\IvfpTwq.exe
  2⤵
  PID:4352
- C:\Windows\System\KxgDxFs.exe
  C:\Windows\System\KxgDxFs.exe
  2⤵
  PID:4020
- C:\Windows\System\JEXTSUd.exe
  C:\Windows\System\JEXTSUd.exe
  2⤵
  PID:4876
- C:\Windows\System\OtULxhG.exe
  C:\Windows\System\OtULxhG.exe
  2⤵
  PID:4492
- C:\Windows\System\HzJTVVB.exe
  C:\Windows\System\HzJTVVB.exe
  2⤵
  PID:1400
- C:\Windows\System\WqidKUh.exe
  C:\Windows\System\WqidKUh.exe
  2⤵
  PID:1660
- C:\Windows\System\LieUsML.exe
  C:\Windows\System\LieUsML.exe
  2⤵
  PID:1352
- C:\Windows\System\VtBtGfY.exe
  C:\Windows\System\VtBtGfY.exe
  2⤵
  PID:1220
- C:\Windows\System\ZNIWear.exe
  C:\Windows\System\ZNIWear.exe
  2⤵
  PID:3368
- C:\Windows\System\CuTtJyl.exe
  C:\Windows\System\CuTtJyl.exe
  2⤵
  PID:4800
- C:\Windows\System\inFwubG.exe
  C:\Windows\System\inFwubG.exe
  2⤵
  PID:14252
- C:\Windows\System\gMwFtcL.exe
  C:\Windows\System\gMwFtcL.exe
  2⤵
  PID:8580
- C:\Windows\System\tIFCFie.exe
  C:\Windows\System\tIFCFie.exe
  2⤵
  PID:14156
- C:\Windows\System\IeQIRyw.exe
  C:\Windows\System\IeQIRyw.exe
  2⤵
  PID:4908
- C:\Windows\System\MSekUgY.exe
  C:\Windows\System\MSekUgY.exe
  2⤵
  PID:1184
- C:\Windows\System\KIvAUQa.exe
  C:\Windows\System\KIvAUQa.exe
  2⤵
  PID:2168
- C:\Windows\System\MTGwxHZ.exe
  C:\Windows\System\MTGwxHZ.exe
  2⤵
  PID:4256
- C:\Windows\System\ozAVHce.exe
  C:\Windows\System\ozAVHce.exe
  2⤵
  PID:8824
- C:\Windows\System\RGgrOmR.exe
  C:\Windows\System\RGgrOmR.exe
  2⤵
  PID:3812
- C:\Windows\System\FZBkgKS.exe
  C:\Windows\System\FZBkgKS.exe
  2⤵
  PID:13796
- C:\Windows\System\cxMqrZk.exe
  C:\Windows\System\cxMqrZk.exe
  2⤵
  PID:1424
- C:\Windows\System\qYcqujN.exe
  C:\Windows\System\qYcqujN.exe
  2⤵
  PID:1792
- C:\Windows\System\wZfHadU.exe
  C:\Windows\System\wZfHadU.exe
  2⤵
  PID:2372
- C:\Windows\System\KWiYFup.exe
  C:\Windows\System\KWiYFup.exe
  2⤵
  PID:5328
- C:\Windows\System\ucfPXdv.exe
  C:\Windows\System\ucfPXdv.exe
  2⤵
  PID:5336
- C:\Windows\System\HNbPcvX.exe
  C:\Windows\System\HNbPcvX.exe
  2⤵
  PID:5340
- C:\Windows\System\fKrKrFi.exe
  C:\Windows\System\fKrKrFi.exe
  2⤵
  PID:4360
- C:\Windows\System\snsGnle.exe
  C:\Windows\System\snsGnle.exe
  2⤵
  PID:776
- C:\Windows\System\HPNfzlD.exe
  C:\Windows\System\HPNfzlD.exe
  2⤵
  PID:3648
- C:\Windows\System\rviCunR.exe
  C:\Windows\System\rviCunR.exe
  2⤵
  PID:1492
- C:\Windows\System\PLKiNpG.exe
  C:\Windows\System\PLKiNpG.exe
  2⤵
  PID:2240
- C:\Windows\System\yZWcoxp.exe
  C:\Windows\System\yZWcoxp.exe
  2⤵
  PID:5500
- C:\Windows\System\ThRKvYw.exe
  C:\Windows\System\ThRKvYw.exe
  2⤵
  PID:5504
- C:\Windows\System\OLRaTAv.exe
  C:\Windows\System\OLRaTAv.exe
  2⤵
  PID:5408
- C:\Windows\System\hUugYMq.exe
  C:\Windows\System\hUugYMq.exe
  2⤵
  PID:4004
- C:\Windows\System\bUbWTEs.exe
  C:\Windows\System\bUbWTEs.exe
  2⤵
  PID:3708
- C:\Windows\System\CxTtwOA.exe
  C:\Windows\System\CxTtwOA.exe
  2⤵
  PID:14256
- C:\Windows\System\VtrzUpZ.exe
  C:\Windows\System\VtrzUpZ.exe
  2⤵
  PID:4060
- C:\Windows\System\uohJWwM.exe
  C:\Windows\System\uohJWwM.exe
  2⤵
  PID:8792
- C:\Windows\System\xSvCiQz.exe
  C:\Windows\System\xSvCiQz.exe
  2⤵
  PID:408
- C:\Windows\System\xhDqnSM.exe
  C:\Windows\System\xhDqnSM.exe
  2⤵
  PID:5528
- C:\Windows\System\psSCXwq.exe
  C:\Windows\System\psSCXwq.exe
  2⤵
  PID:1152
- C:\Windows\System\WJCmDPm.exe
  C:\Windows\System\WJCmDPm.exe
  2⤵
  PID:8604
- C:\Windows\System\Yyxbpov.exe
  C:\Windows\System\Yyxbpov.exe
  2⤵
  PID:5312
- C:\Windows\System\DiPtwDp.exe
  C:\Windows\System\DiPtwDp.exe
  2⤵
  PID:3236
- C:\Windows\System\FaDbKIo.exe
  C:\Windows\System\FaDbKIo.exe
  2⤵
  PID:2156
- C:\Windows\System\ztDDJAv.exe
  C:\Windows\System\ztDDJAv.exe
  2⤵
  PID:4860
- C:\Windows\System\sdqbzLH.exe
  C:\Windows\System\sdqbzLH.exe
  2⤵
  PID:2152
- C:\Windows\System\tDZWQWX.exe
  C:\Windows\System\tDZWQWX.exe
  2⤵
  PID:5516
- C:\Windows\System\iKEscPo.exe
  C:\Windows\System\iKEscPo.exe
  2⤵
  PID:4732
- C:\Windows\System\CgCUiQw.exe
  C:\Windows\System\CgCUiQw.exe
  2⤵
  PID:5556
- C:\Windows\System\wJqEWrJ.exe
  C:\Windows\System\wJqEWrJ.exe
  2⤵
  PID:3864
- C:\Windows\System\yGRmGVS.exe
  C:\Windows\System\yGRmGVS.exe
  2⤵
  PID:14340
- C:\Windows\System\HJpkHHx.exe
  C:\Windows\System\HJpkHHx.exe
  2⤵
  PID:14356
- C:\Windows\System\QCozblx.exe
  C:\Windows\System\QCozblx.exe
  2⤵
  PID:14372
- C:\Windows\System\CJmcTFi.exe
  C:\Windows\System\CJmcTFi.exe
  2⤵
  PID:14388
- C:\Windows\System\PAxpyCr.exe
  C:\Windows\System\PAxpyCr.exe
  2⤵
  PID:14416
- C:\Windows\System\AFoWOrO.exe
  C:\Windows\System\AFoWOrO.exe
  2⤵
  PID:14432
- C:\Windows\System\qLBnlQG.exe
  C:\Windows\System\qLBnlQG.exe
  2⤵
  PID:14448
- C:\Windows\System\RcrPJze.exe
  C:\Windows\System\RcrPJze.exe
  2⤵
  PID:14464
- C:\Windows\System\JkQMAxu.exe
  C:\Windows\System\JkQMAxu.exe
  2⤵
  PID:14480
- C:\Windows\System\XuKUDKe.exe
  C:\Windows\System\XuKUDKe.exe
  2⤵
  PID:14496
- C:\Windows\System\hfxLVom.exe
  C:\Windows\System\hfxLVom.exe
  2⤵
  PID:14512
- C:\Windows\System\GusJKBI.exe
  C:\Windows\System\GusJKBI.exe
  2⤵
  PID:14528
- C:\Windows\System\ZGLHwcQ.exe
  C:\Windows\System\ZGLHwcQ.exe
  2⤵
  PID:14544
- C:\Windows\System\uKesSTe.exe
  C:\Windows\System\uKesSTe.exe
  2⤵
  PID:14560
- C:\Windows\System\QdQJrNA.exe
  C:\Windows\System\QdQJrNA.exe
  2⤵
  PID:14576
- C:\Windows\System\tPzRxoW.exe
  C:\Windows\System\tPzRxoW.exe
  2⤵
  PID:14592
- C:\Windows\System\SlnrFoE.exe
  C:\Windows\System\SlnrFoE.exe
  2⤵
  PID:14608
- C:\Windows\System\CvvYvrL.exe
  C:\Windows\System\CvvYvrL.exe
  2⤵
  PID:14624
- C:\Windows\System\MlpOHoL.exe
  C:\Windows\System\MlpOHoL.exe
  2⤵
  PID:14640
- C:\Windows\System\QwvjHCe.exe
  C:\Windows\System\QwvjHCe.exe
  2⤵
  PID:14656
- C:\Windows\System\SQAIkXB.exe
  C:\Windows\System\SQAIkXB.exe
  2⤵
  PID:14676
- C:\Windows\System\LcoJUGN.exe
  C:\Windows\System\LcoJUGN.exe
  2⤵
  PID:14692
- C:\Windows\System\FRqETJv.exe
  C:\Windows\System\FRqETJv.exe
  2⤵
  PID:14708
- C:\Windows\System\XPdDGtU.exe
  C:\Windows\System\XPdDGtU.exe
  2⤵
  PID:14724
- C:\Windows\System\AxuPGZi.exe
  C:\Windows\System\AxuPGZi.exe
  2⤵
  PID:14740
- C:\Windows\System\LxEMmlF.exe
  C:\Windows\System\LxEMmlF.exe
  2⤵
  PID:14756
- C:\Windows\System\kcyqnGi.exe
  C:\Windows\System\kcyqnGi.exe
  2⤵
  PID:14780
- C:\Windows\System\ukoylsi.exe
  C:\Windows\System\ukoylsi.exe
  2⤵
  PID:14808
- C:\Windows\System\LWcGOzo.exe
  C:\Windows\System\LWcGOzo.exe
  2⤵
  PID:14824
- C:\Windows\System\DvBESdK.exe
  C:\Windows\System\DvBESdK.exe
  2⤵
  PID:14860
- C:\Windows\System\rhlPYhO.exe
  C:\Windows\System\rhlPYhO.exe
  2⤵
  PID:14876
- C:\Windows\System\OoqDIvu.exe
  C:\Windows\System\OoqDIvu.exe
  2⤵
  PID:14892
- C:\Windows\System\bPypqcu.exe
  C:\Windows\System\bPypqcu.exe
  2⤵
  PID:14908
- C:\Windows\System\MErHLec.exe
  C:\Windows\System\MErHLec.exe
  2⤵
  PID:14924
- C:\Windows\System\StbdUjk.exe
  C:\Windows\System\StbdUjk.exe
  2⤵
  PID:14940
- C:\Windows\System\XjQrYTG.exe
  C:\Windows\System\XjQrYTG.exe
  2⤵
  PID:14956
- C:\Windows\System\AVsDItw.exe
  C:\Windows\System\AVsDItw.exe
  2⤵
  PID:14972
- C:\Windows\System\mSiwbtU.exe
  C:\Windows\System\mSiwbtU.exe
  2⤵
  PID:14988
- C:\Windows\System\vbpHLiu.exe
  C:\Windows\System\vbpHLiu.exe
  2⤵
  PID:15004
- C:\Windows\System\fBtyqxN.exe
  C:\Windows\System\fBtyqxN.exe
  2⤵
  PID:15020
- C:\Windows\System\FzJKqLu.exe
  C:\Windows\System\FzJKqLu.exe
  2⤵
  PID:15036
- C:\Windows\System\HGPQKsN.exe
  C:\Windows\System\HGPQKsN.exe
  2⤵
  PID:15052
- C:\Windows\System\maghYKc.exe
  C:\Windows\System\maghYKc.exe
  2⤵
  PID:15068
- C:\Windows\System\cHEofYI.exe
  C:\Windows\System\cHEofYI.exe
  2⤵
  PID:15084
- C:\Windows\System\BsrsumR.exe
  C:\Windows\System\BsrsumR.exe
  2⤵
  PID:15100
- C:\Windows\System\awXdpqL.exe
  C:\Windows\System\awXdpqL.exe
  2⤵
  PID:15116
- C:\Windows\System\VOtCfPn.exe
  C:\Windows\System\VOtCfPn.exe
  2⤵
  PID:15132
- C:\Windows\System\gvAhWCD.exe
  C:\Windows\System\gvAhWCD.exe
  2⤵
  PID:15148
- C:\Windows\System\fVYBqkj.exe
  C:\Windows\System\fVYBqkj.exe
  2⤵
  PID:15164
- C:\Windows\System\KWGEjqm.exe
  C:\Windows\System\KWGEjqm.exe
  2⤵
  PID:15180
- C:\Windows\System\zXRCpVq.exe
  C:\Windows\System\zXRCpVq.exe
  2⤵
  PID:15196
- C:\Windows\System\UybEpZD.exe
  C:\Windows\System\UybEpZD.exe
  2⤵
  PID:15212
- C:\Windows\System\hHqllXa.exe
  C:\Windows\System\hHqllXa.exe
  2⤵
  PID:15228
- C:\Windows\System\cgdiazB.exe
  C:\Windows\System\cgdiazB.exe
  2⤵
  PID:15244
- C:\Windows\System\QTODpxf.exe
  C:\Windows\System\QTODpxf.exe
  2⤵
  PID:15260
- C:\Windows\System\AizDcdW.exe
  C:\Windows\System\AizDcdW.exe
  2⤵
  PID:15276
- C:\Windows\System\yYUkbvH.exe
  C:\Windows\System\yYUkbvH.exe
  2⤵
  PID:15292
- C:\Windows\System\rQjNHWN.exe
  C:\Windows\System\rQjNHWN.exe
  2⤵
  PID:15308
- C:\Windows\System\SUaFDKA.exe
  C:\Windows\System\SUaFDKA.exe
  2⤵
  PID:15324
- C:\Windows\System\sXmSADX.exe
  C:\Windows\System\sXmSADX.exe
  2⤵
  PID:15340
- C:\Windows\System\huUjGkE.exe
  C:\Windows\System\huUjGkE.exe
  2⤵
  PID:15356
- C:\Windows\System\SJxJclZ.exe
  C:\Windows\System\SJxJclZ.exe
  2⤵
  PID:14368
- C:\Windows\System\uLpnWJT.exe
  C:\Windows\System\uLpnWJT.exe
  2⤵
  PID:14396
- C:\Windows\System\zCNgNnl.exe
  C:\Windows\System\zCNgNnl.exe
  2⤵
  PID:1980
- C:\Windows\System\POCKjXr.exe
  C:\Windows\System\POCKjXr.exe
  2⤵
  PID:2284
- C:\Windows\System\FCaISoO.exe
  C:\Windows\System\FCaISoO.exe
  2⤵
  PID:1688
- C:\Windows\System\GGcYCjH.exe
  C:\Windows\System\GGcYCjH.exe
  2⤵
  PID:5136
- C:\Windows\System\hDibgkl.exe
  C:\Windows\System\hDibgkl.exe
  2⤵
  PID:5352
- C:\Windows\System\swCirxw.exe
  C:\Windows\System\swCirxw.exe
  2⤵
  PID:14364
- C:\Windows\System\lPpzhsq.exe
  C:\Windows\System\lPpzhsq.exe
  2⤵
  PID:5384
- C:\Windows\System\hPKuBdv.exe
  C:\Windows\System\hPKuBdv.exe
  2⤵
  PID:5424
- C:\Windows\System\oCEpJUT.exe
  C:\Windows\System\oCEpJUT.exe
  2⤵
  PID:1240
- C:\Windows\System\zcMmEoa.exe
  C:\Windows\System\zcMmEoa.exe
  2⤵
  PID:5544
- C:\Windows\System\KHXUIcW.exe
  C:\Windows\System\KHXUIcW.exe
  2⤵
  PID:14352
- C:\Windows\System\CQyCQrr.exe
  C:\Windows\System\CQyCQrr.exe
  2⤵
  PID:14412
- C:\Windows\System\GnWOhoc.exe
  C:\Windows\System\GnWOhoc.exe
  2⤵
  PID:14440
- C:\Windows\System\kfqZFJc.exe
  C:\Windows\System\kfqZFJc.exe
  2⤵
  PID:14476
- C:\Windows\System\vulNSun.exe
  C:\Windows\System\vulNSun.exe
  2⤵
  PID:14508
- C:\Windows\System\pIpvwdT.exe
  C:\Windows\System\pIpvwdT.exe
  2⤵
  PID:14540
- C:\Windows\System\zIyxqwg.exe
  C:\Windows\System\zIyxqwg.exe
  2⤵
  PID:14572
- C:\Windows\System\lTqAfdS.exe
  C:\Windows\System\lTqAfdS.exe
  2⤵
  PID:14604
- C:\Windows\System\hCfUQeq.exe
  C:\Windows\System\hCfUQeq.exe
  2⤵
  PID:14636
- C:\Windows\System\FghUrav.exe
  C:\Windows\System\FghUrav.exe
  2⤵
  PID:14668
- C:\Windows\System\IhZUkcR.exe
  C:\Windows\System\IhZUkcR.exe
  2⤵
  PID:14700
- C:\Windows\System\ZZfxazM.exe
  C:\Windows\System\ZZfxazM.exe
  2⤵
  PID:5876
- C:\Windows\System\wudyJfA.exe
  C:\Windows\System\wudyJfA.exe
  2⤵
  PID:14820
- C:\Windows\System\qOSyNnK.exe
  C:\Windows\System\qOSyNnK.exe
  2⤵
  PID:14872
- C:\Windows\System\HeTlabo.exe
  C:\Windows\System\HeTlabo.exe
  2⤵
  PID:14904
- C:\Windows\System\Yunkalu.exe
  C:\Windows\System\Yunkalu.exe
  2⤵
  PID:14936
- C:\Windows\System\RfzUknC.exe
  C:\Windows\System\RfzUknC.exe
  2⤵
  PID:14968
- C:\Windows\System\oBPAjLC.exe
  C:\Windows\System\oBPAjLC.exe
  2⤵
  PID:15000
- C:\Windows\System\VxsblPP.exe
  C:\Windows\System\VxsblPP.exe
  2⤵
  PID:15032
- C:\Windows\System\oxdJKgw.exe
  C:\Windows\System\oxdJKgw.exe
  2⤵
  PID:15064
- C:\Windows\System\OeTUzod.exe
  C:\Windows\System\OeTUzod.exe
  2⤵
  PID:15096
- C:\Windows\System\shVRvfI.exe
  C:\Windows\System\shVRvfI.exe
  2⤵
  PID:15128
- C:\Windows\System\jrPATmZ.exe
  C:\Windows\System\jrPATmZ.exe
  2⤵
  PID:15172
- C:\Windows\System\KMWxCWX.exe
  C:\Windows\System\KMWxCWX.exe
  2⤵
  PID:14664
- C:\Windows\System\ECpXsZX.exe
  C:\Windows\System\ECpXsZX.exe
  2⤵
  PID:15268
- C:\Windows\System\otsAAOX.exe
  C:\Windows\System\otsAAOX.exe
  2⤵
  PID:15300
- C:\Windows\System\TVRcznD.exe
  C:\Windows\System\TVRcznD.exe
  2⤵
  PID:15332
- C:\Windows\System\cEoqZUD.exe
  C:\Windows\System\cEoqZUD.exe
  2⤵
  PID:5792
- C:\Windows\System\ZSGeFdY.exe
  C:\Windows\System\ZSGeFdY.exe
  2⤵
  PID:216
- C:\Windows\System\IiKzcnQ.exe
  C:\Windows\System\IiKzcnQ.exe
  2⤵
  PID:3900
- C:\Windows\System\hjPDLjf.exe
  C:\Windows\System\hjPDLjf.exe
  2⤵
  PID:2584
- C:\Windows\System\TfSSLLv.exe
  C:\Windows\System\TfSSLLv.exe
  2⤵
  PID:2464
- C:\Windows\System\QNXxPhd.exe
  C:\Windows\System\QNXxPhd.exe
  2⤵
  PID:5512
- C:\Windows\System\stMNtwB.exe
  C:\Windows\System\stMNtwB.exe
  2⤵
  PID:4724
- C:\Windows\System\fyRWvLM.exe
  C:\Windows\System\fyRWvLM.exe
  2⤵
  PID:14408
- C:\Windows\System\SOXVZMb.exe
  C:\Windows\System\SOXVZMb.exe
  2⤵
  PID:14472
- C:\Windows\System\XYattKy.exe
  C:\Windows\System\XYattKy.exe
  2⤵
  PID:14536
- C:\Windows\System\bBrflFd.exe
  C:\Windows\System\bBrflFd.exe
  2⤵
  PID:14600
- C:\Windows\System\weCUSVF.exe
  C:\Windows\System\weCUSVF.exe
  2⤵
  PID:14652
- C:\Windows\System\MZVvHLd.exe
  C:\Windows\System\MZVvHLd.exe
  2⤵
  PID:5880
- C:\Windows\System\ieYEGjQ.exe
  C:\Windows\System\ieYEGjQ.exe
  2⤵
  PID:14720
- C:\Windows\System\YOJHzPD.exe
  C:\Windows\System\YOJHzPD.exe
  2⤵
  PID:14748
- C:\Windows\System\CAuYYVR.exe
  C:\Windows\System\CAuYYVR.exe
  2⤵
  PID:14768
- C:\Windows\System\fSpEPry.exe
  C:\Windows\System\fSpEPry.exe
  2⤵
  PID:14932
- C:\Windows\System\vgBLSvU.exe
  C:\Windows\System\vgBLSvU.exe
  2⤵
  PID:14984
- C:\Windows\System\UiOuqbm.exe
  C:\Windows\System\UiOuqbm.exe
  2⤵
  PID:15060
- C:\Windows\System\XUOYVoc.exe
  C:\Windows\System\XUOYVoc.exe
  2⤵
  PID:5892
- C:\Windows\System\RAzovsR.exe
  C:\Windows\System\RAzovsR.exe
  2⤵
  PID:15112
- C:\Windows\System\sdeaQQr.exe
  C:\Windows\System\sdeaQQr.exe
  2⤵
  PID:14840
- C:\Windows\System\oLiMPRv.exe
  C:\Windows\System\oLiMPRv.exe
  2⤵
  PID:15160
- C:\Windows\System\eTaJFSd.exe
  C:\Windows\System\eTaJFSd.exe
  2⤵
  PID:14996
- C:\Windows\System\zvaKZaj.exe
  C:\Windows\System\zvaKZaj.exe
  2⤵
  PID:15288
- C:\Windows\System\poMjOxK.exe
  C:\Windows\System\poMjOxK.exe
  2⤵
  PID:5800
- C:\Windows\System\zovgnxz.exe
  C:\Windows\System\zovgnxz.exe
  2⤵
  PID:1748
- C:\Windows\System\NLlVWwj.exe
  C:\Windows\System\NLlVWwj.exe
  2⤵
  PID:5520
- C:\Windows\System\sCESXDY.exe
  C:\Windows\System\sCESXDY.exe
  2⤵
  PID:14444
- C:\Windows\System\aZlvNZM.exe
  C:\Windows\System\aZlvNZM.exe
  2⤵
  PID:14632
- C:\Windows\System\UKaRaHQ.exe
  C:\Windows\System\UKaRaHQ.exe
  2⤵
  PID:14852
- C:\Windows\System\CBtzZip.exe
  C:\Windows\System\CBtzZip.exe
  2⤵
  PID:14920
- C:\Windows\System\jmxCcdb.exe
  C:\Windows\System\jmxCcdb.exe
  2⤵
  PID:15048
- C:\Windows\System\TtsVGXC.exe
  C:\Windows\System\TtsVGXC.exe
  2⤵
  PID:768
- C:\Windows\System\VgvnSCl.exe
  C:\Windows\System\VgvnSCl.exe
  2⤵
  PID:14804
- C:\Windows\System\qoioPGv.exe
  C:\Windows\System\qoioPGv.exe
  2⤵
  PID:14776
- C:\Windows\System\ZMiYGcd.exe
  C:\Windows\System\ZMiYGcd.exe
  2⤵
  PID:12804
- C:\Windows\System\vRTXkcL.exe
  C:\Windows\System\vRTXkcL.exe
  2⤵
  PID:10924
- C:\Windows\System\ytgmQNo.exe
  C:\Windows\System\ytgmQNo.exe
  2⤵
  PID:11452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mi3dqrd5.ozg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AMwoPGk.exe

Filesize
2.3MB

MD5
5bb33b929eb100f93197d04bbdee7421

SHA1
f382e30c1dfd7969bd17712a5a041e4c4e418e71

SHA256
0ab73fc00b98cd67a2ba691d3c0c96254f2b603f34b53944259f569dcf8ef631

SHA512
70f160b290bccd25dd16e99664949dd4c49f5e887851a9e2f5bfa9cedadc183c4f57c8adc73decc48ff718bd8c67803cde7b4fd72704e906fb7e1d520a8d6fdc

Download Submit
C:\Windows\System\BCDqYEF.exe

Filesize
2.3MB

MD5
4e159846807b147dbc3187ffe65b39e6

SHA1
4619b7fb2aedd59386d85aae929090b3fb5012db

SHA256
29b907ce108b7b7471e56b30b7cbccc8ff28e9a39dfa9c55566123d280d1afa5

SHA512
d4b2b40bb2ff4a966a57469fa843b5ff5cfdf3ca52cf8c3e26b442fa8df2c776a58338466ca4e17f8027799a8ef97f0b58ca6efb164e46b9aecf092e98d8b638

Download Submit
C:\Windows\System\BQzfubL.exe

Filesize
2.3MB

MD5
f77e54c65544a171e913f797578d7ff1

SHA1
a86cc8edb32a397f9eec717749060b8ac4dd234e

SHA256
7d17b7319e55105dc09ae5afe6993c8b69d569942cfb7e87f6b991fb298155d6

SHA512
3882a01ffe518d47697d1b34c0e6d7bbaf7fbd334b9bc11dc4584e965157a100349c2c4b27489cd7d42fd0ed603c2218a39db8c78d4962574ad0d8e894d71922

Download Submit
C:\Windows\System\BjfyCGr.exe

Filesize
2.3MB

MD5
0b53980a49905c997a4ee0552f4e3344

SHA1
28d4d7801eae5ae0891883fb549365f3dfd3f853

SHA256
7a31814058906f9d4d349894b2ae1f44a3eecc1e976cc0ed232d4908f965c8cd

SHA512
9cf5126c07ab4920cd6333cdb9a31ed26c5695f831a2add32c0577e5bcc08a887f06aabecdad057e6a3a20349c0a2f54570ae99d862333240e2691bd6de76851

Download Submit
C:\Windows\System\CtsRqhu.exe

Filesize
2.3MB

MD5
898cb354a0069ba1f4fd3ebefd52a48b

SHA1
619b3285d9d2aafe5ccd6fce1dc334fba49f39e9

SHA256
5b34e08412571597582c1430ecaf7f48f24c0294d7edee839724f01e757e2772

SHA512
b8925f43a6307f7eab2ecd5d3b13d711460205af540fc104fd97ab6939a607e79082d01116923c26d2c2b5828eca8c6d7e0cb3653e0f3f07bb4f1fb76095f9e3

Download Submit
C:\Windows\System\FXVORaz.exe

Filesize
2.3MB

MD5
5c088cba0b96d2094845c72264d7be9d

SHA1
efe41cc50e76e269c0b594579f55814ba3668302

SHA256
1b78ec111071bef651ddc206c663dc406f7ad21673cd2641bf5624fe3aa984e5

SHA512
44d500a1fa545690ab75248b77e55d974c28bf5e7dcf6b28292f41f40bcdae0de2fd86a4c687fc7317fe688c37ca7be5aa48fb366c620fffe9733f7deea0fe69

Download Submit
C:\Windows\System\Ijmcuwj.exe

Filesize
2.3MB

MD5
78720c573e86f56c73bae13339ecb42d

SHA1
f9d5b22c15ac5bf725fa1c008eac3080dd673df1

SHA256
c3c01038dc34cfef11aaed69a4cec29f10d7a39b07f11e0351cd9f8e5c3410e1

SHA512
8660670db75c97328eef6d2a8af11072bc2707ffe680df02491cc0a1b9b45aacfabe67fe8eec7207cd7ba37896e312eb23d8a52ec391176fba6d93910a6b7e4c

Download Submit
C:\Windows\System\LLzvNLC.exe

Filesize
2.3MB

MD5
60ded6c9476a9713c1832f471ab435c0

SHA1
1442a294a54adc058bc34ec969fb772f3c38434f

SHA256
ef2ea2d7898354696c656790065fb1a5036ea1009ccf9799d6b45ccdcfa928fe

SHA512
7180c787af406e03b87db660c96ac36e6cb4421ebb047ff260de488afb50f5e1e9b146973843d0c46e9141ce6c257da8d0a60acb566d0f6f5af17d54ce639314

Download Submit
C:\Windows\System\LuvAsgv.exe

Filesize
2.3MB

MD5
ad2c35826120c2f39d6ebd9325bdbbda

SHA1
310279070615da4ca712f6aacb4b24dbe0c8fc28

SHA256
7a1dc9275e4d44da5e7e7f53fbe10db7bddad5971129bd5a9cced388d8a55125

SHA512
75fb053ffcfb57151230547d288c3df75d1c951ada85f4bf6374da00c7df9ae08c1dc70caabf6b68f567c5891f804ea91d3a3032a1b2277a8dd40b515aafa7a1

Download Submit
C:\Windows\System\NfUgUZx.exe

Filesize
2.3MB

MD5
e871f65c51b36b66535a1b379edc0aba

SHA1
036b72b0fc1cc0d72831b0fa964759227b6622d3

SHA256
e04b9acf7f15ac915548ba78e1d1944617d669570474b33c0e54770e18b49933

SHA512
bcc30d8b2e490c9d3aa0acc20c8568b3880efd71018e827d2fc2b613c6292eaf2137670e6db650bbebbbb02e5ce5b07bba0f2795a06206aaa53ed556cbe39f8e

Download Submit
C:\Windows\System\NhFGDOM.exe

Filesize
8B

MD5
3fa896e6e03a6c36944841b51d39e0d4

SHA1
4aefb55d27e72ef2d47403b0c8ce06d172004a35

SHA256
400669c3a4cce9fc0e15e111795da46968d6aa425fadb66d6e8c94b8a55f448d

SHA512
612aa9da451a214208d9de281e4424e86a677aa7a795a809d046b92d6bba85793ab2e58fb70475807546f0c1e5ee525dd22de24b67b42735f5d59a71d847dc4f

Download Submit
C:\Windows\System\NoAVAJI.exe

Filesize
2.3MB

MD5
c96569a87d04d570c7934ee1a5b60948

SHA1
d014740a23b3502240251c20e7c4da6f62b2e98e

SHA256
9408f3bf2966683ad2ea1db421e8d62cc960a81d4b71126b55e04b7473829ba0

SHA512
dc230e3b2694fdaa1f282cb0d3fe3a04156bc9a1d8d9ab3b16e906478a736b19ca8b0a3774d0ddd17bd8e1dcb0fa19153eef74d47e005384885cbe2c0dd00cc0

Download Submit
C:\Windows\System\OmhgADk.exe

Filesize
2.3MB

MD5
c5c14e5b4c07b39e10a39da4686edfb9

SHA1
09eb72092865d7cf38d9d3747b5456923144cd54

SHA256
3bea5347871143b4f1dc1b96e94154aa78e3383322adc378962d5e4102f414ce

SHA512
49b803f244fcc003bd20182ea6b089fe95acfc445a605faff97bf74235ee499f574d94b33dfeea8c0403b4e3ab2353ed93285005615cc5e43f2571c50211a51c

Download Submit
C:\Windows\System\OnjsFrz.exe

Filesize
2.3MB

MD5
578f4f3bce89b2c0edf655571217933c

SHA1
3fdc1d2b97c072ba22702d5977c3f98fd14a5e17

SHA256
331434b53e6ce3b7ccf130e3b437c80b78934971dfa04f0b3a430b80547dfcc5

SHA512
8f4f4e6403c5fb63be1622bf95b690cf685d62bc6f6de7be2fc730186b06bc37867c5e5e1b8548eb8588a87d99190f0ac5914e412fb5758b9abb758384864380

Download Submit
C:\Windows\System\QMdOpOK.exe

Filesize
2.3MB

MD5
77d3426893487ae005cea51ef8024d46

SHA1
3dc831b19ff2e255c7c2a337c356f8254a59ab23

SHA256
de01710e54cbe38052e645179bedaf75cf5ee413a2dd84dcde9ba8cba6d3dcf8

SHA512
047ae2f45b3692646a62f81e8333850666660ab790f983cbc706a0a13141b1bdadd29a401df74e8fd1a5970f4784e4be991992792aab036b9f57b85a5e801b18

Download Submit
C:\Windows\System\SjyMbGE.exe

Filesize
2.3MB

MD5
9fca4dcc1addf00622e7b1e846edde7b

SHA1
2103d74cb455e03d9ef0ab927bd6be30f72a5965

SHA256
55f4f9c2b8c3e28d36cf8fbbb9371eedd4fdd2ed64e9704a9e60478d0e706c6d

SHA512
67afed463604eb193dc2b5e91de1b754d51573b6ba42c622673793efa0c672880132c4e577a620613f775e75dba5c8f3e6439fd296e4deced17452b037d3a4c5

Download Submit
C:\Windows\System\UUGvOue.exe

Filesize
2.3MB

MD5
f43bfd8b9b39bc6e6c26861fde135d67

SHA1
4b04cdd526f5a32d989f53f3e363c50fbff2ea04

SHA256
2ebaa5cfc20e9aa36750eace50a0060fa7b9dff2029dd5644c0044e8e3ba8715

SHA512
ccad3fcd09de815a90cce468db02bfbae72b781573d760c098d5054468bc245c5d67644d987764acdada24e9bbbf7fd5fc1edc43191b5638389a19623c1c995e

Download Submit
C:\Windows\System\UrrHcdt.exe

Filesize
2.3MB

MD5
9938cad8fa1ec344dca494479ce5db65

SHA1
dc10c6635d21e4792c858993bc643c5a5018337b

SHA256
d24aaed10f651173562353fdf8a09093fd8736a8ba8b8a9b6c6a2687a1042017

SHA512
f2845333d6c1d078956bcff8165941da62611903d41556a71aa57b9a6bdbf3faae60218ecba81f47005f512c4d117150a141e49746b17f4ea8e589f0bc3692c8

Download Submit
C:\Windows\System\VzQlgUP.exe

Filesize
2.3MB

MD5
2aa96473abeaf7d9f935ca8c00e58c78

SHA1
c026d48cf1d4ecc637240fc3ce4f08c280e4bb67

SHA256
7e59cff4ba21172564d7f6dec6c584ae6c78acb08684db043890b45d8cba0cd5

SHA512
d0507cec5c3c67d8333f901896313cff596273d64b8cb1886d108ba901649feb78644b56deab9ee5971169f4f8414afff56c005f0da16cda7022f055c45b71cf

Download Submit
C:\Windows\System\WFGYeGV.exe

Filesize
2.3MB

MD5
49c65c0e5838c53789bf4605d05d8bbe

SHA1
51377b10a260e0946eec219d0651f32a3e48e1a1

SHA256
e4fa623e43cbb564adbe0d6a59b12ec9a13ce878a49ff34c16b5e16962b57ab7

SHA512
f74b8d1f1ef4361cc044277ded63f9705f2d26f090d30b3b901dd0d342355176bf5fa88d1f34676f38018662add1fa4b5133057c6ab3f907d178ef6ec8251b8f

Download Submit
C:\Windows\System\XMWNwQe.exe

Filesize
2.3MB

MD5
c8ebb53e72856f518705ab61110cd182

SHA1
d9b319aa11513b34a9957fc27769abdf4825b6c6

SHA256
b988dfb36c9ec976bf421d041fbc189374507363c21fb26401bc55040a80f333

SHA512
fe2350792563d8e142b86ddbbc90f50f9416ef5b73400ee6785e1022ef1cf65d86b5bfd55f2f04aaa454a453599216b7eb5c8e6dfadbcfe9d5a1ae9164cb30c8

Download Submit
C:\Windows\System\amgIhwi.exe

Filesize
2.3MB

MD5
f9b5d9ec47ed90c08dbb1e852224ada3

SHA1
80203a9d3f5cc962391e847276b77a7e70b4d0b2

SHA256
391131448f493f4caf2a56bcf0c4aa07f82c4a464cd05fc13000760e2f170e16

SHA512
0fd51d8483fe32546ad1bcbdb3df7507456999a854f8b38dfa2c0351dc47cb1ab48c502fda1edcbd3903fb46aa3518d9748e5061886089987df844f7967bb35d

Download Submit
C:\Windows\System\cnuVRRr.exe

Filesize
2.3MB

MD5
f9fc3cd6f40daff96def43db7aaa9a2d

SHA1
1ec46bd772d3f35115aa321dfd4efb0e496432fc

SHA256
384baa6db690a4bb365c28f8f641b2bbdedd11156fc80c3f60a3e599b7a150a0

SHA512
8c7739e1562428b6d9da6e0d7a52d90309b3ec79e4e91eef5b6794504b6247cbbeeeaa2326de2f3fdee5b06fcd123e6b84e2180d696e712a8a63033d4bfda5b9

Download Submit
C:\Windows\System\dTdlaxa.exe

Filesize
2.3MB

MD5
1600401b1e5e32c0cd5da431095e2220

SHA1
9f000f3173341660079de6ba793bc39370d4bc06

SHA256
49dd73299446efbcb2ccc32fb4b3997ea9bcd86e7c6328367a9e6a150c637659

SHA512
9cc1bf1231f6aba0df28de70c2ca793cd4ec2b85960fcecfdf22b52ef5fc01e31d66adb257c8394aae5bbaf9c50e716391ab6d114379ed5d44464a378a862326

Download Submit
C:\Windows\System\eisniJo.exe

Filesize
2.3MB

MD5
fb402ef83f088cd14e70ab35c40edb51

SHA1
f0d6c3f5f82080d138963a1be0fdc96785cc8322

SHA256
5d03b8d40e8feca185adf2bfb0fb9e0e2295f74e438cd8c0e8ff946bc7328ee1

SHA512
75eb474610d56cd48261ed6d3ad614f9b5dabc256465c9da22d70399b2b58a9f3fd6eb5ff11dcfa8114c45c914d304c8892f907a6d776598f0a8829f28e52270

Download Submit
C:\Windows\System\jOLcNzd.exe

Filesize
2.3MB

MD5
427a8dd9ff4fa9d6e8a74fae536c7915

SHA1
f598d379d905c6b59fef56104fa098f1edf08c99

SHA256
b28ef40465a5f92f1751f6d0be8e76f61d58ee46cb8e783e993d6ecec007cc25

SHA512
349e94ff10cfd235ad6d7bec0b2afd738d4722d20d700990c93464a5a1b12648c7e14041870ba6e40728673fa92e69f62992430025c14c7b1c36463396bebc6a

Download Submit
C:\Windows\System\kRtmvgo.exe

Filesize
2.3MB

MD5
cfe70a1c7c8f2940836b63415e1a267e

SHA1
1af959dc0ed150d2d5f253354a5b42f9cedbe4a3

SHA256
169f60310fb36681c95b0dc966de13971916a9ff19604357c8631b3d484f659c

SHA512
07248038ca4e55fdf0b55004ca6ce52e29548d54d9f2810f8d5c7e09e6529331702a52997ff423f5572d68d49b31ecb33fcd33ef32953642da5ea0e760c4a659

Download Submit
C:\Windows\System\kdYYYFU.exe

Filesize
2.3MB

MD5
8e39056610da00f628fa9fe416234968

SHA1
423784c09df459ec4dd473963d5baef8028c40df

SHA256
a45cdceb6ca50532060e56589089be475d3a1f9879d4fb25643522d813b1ab6d

SHA512
05d356e47f5b5370f5817ee83031e994034a00dc0c664a3efccfc78b56d5aa4741610529a8346f5c2429150087bc6826aa8db750c566bd53dd042e406279d4ee

Download Submit
C:\Windows\System\lISmOAk.exe

Filesize
2.3MB

MD5
ee37f9fb18ecd8c5c84dd9cc0d4a9159

SHA1
8540a0c24c5d6eb2de4abf42ffce59742dbcfe0d

SHA256
6d32cf1af56ae5e4c31f189ff2d73bed05aed24ee7a73f255f6868ea698eed69

SHA512
17c03ce9802f465ebc0269281a292eab3f86eeaf7204d3d9a57f16185d0673d24a9555221f7666eb4598bf16e7b6f76ca03d02d7b5888dcf543cde6993ccb745

Download Submit
C:\Windows\System\qunPznw.exe

Filesize
2.3MB

MD5
7c0b2183907ba43bccab78c8fce73ec2

SHA1
781c08e1b30e5a0e6a96e2702968b9b2c33398fd

SHA256
89d0c9c69ad73dcac04ac1a56cc04a5bc06f6db568c6f7dfd794d044a044d79c

SHA512
d19671046b6880a12d30d59f45d182481080a5a656ea4127fcb41a66a18232015ae38b94216d294f304003002d1aea82666b0a543e95a24d5395d5c25d6aab13

Download Submit
C:\Windows\System\qvRWLVI.exe

Filesize
2.3MB

MD5
082d3e485ccf05225ff108173c3d6236

SHA1
f50fe641250ebc28d7014e8d2d632e75193d9622

SHA256
50c83d1e3f028ff46977c9ae58321469c09a0902506916a40baf6853802afc34

SHA512
a5122543455e479cac5365f087b777639bb225c524d6dbf4771baf6640775ad58d36c33f0e52dea9ccd13fbd9fbb40b4b79f37e85cd0d51168393239fa05ce8a

Download Submit
C:\Windows\System\rSJJdCP.exe

Filesize
2.3MB

MD5
9c9807e49cea2b82de8d7c9805617051

SHA1
600842e83624681cb1c10124e9935cd7aecba3c5

SHA256
e8fe8c0ebe2f197800f277195baad0ddaa64334d55c7d3e30d957a676a4f8487

SHA512
b762d227a0da1f1e0700736a702cac0c3c513bf87ed183c3c4da2028e7eb061d597ac675bf030a7653c2bfb894659bfca6f9fe6b5c318bdfb25aec0e53b22267

Download Submit
C:\Windows\System\rtUngMJ.exe

Filesize
2.3MB

MD5
e76b7298a20a7251f05e07e4a44d7f13

SHA1
bcbcd58118bafabdd1ff51bf8743f475187abb38

SHA256
cfa6e6c5226c8237f3f0cd9e74730744be4e05f13af871abb27acf0ddd36ccf6

SHA512
b7355741a17af0584e9e495146a5bf1f6204b6fdcf6b96990b08b8dfdc286ef94fcbb6506b676e339923c9856ec875628e4e44b4474375be7b682e23bb4188ab

Download Submit
C:\Windows\System\wIEKpQc.exe

Filesize
2.3MB

MD5
36ab3497fc623e12a3e65728a1a1eac8

SHA1
d237e9f762be421ff2db80be1b3d234cbb7b5dcd

SHA256
6765d37efbf5e84bb3ffd7e4aa87a93e968349437528e7fc2031c33f8b004905

SHA512
d9a9fa8e1d945fd66a95492751a5eb6a9c22c410b8e350f0106f0c98719c165ebd876d0be6778f0c1f5b5d176200f71ef0a3dd7057de58bf49e83ff20e4597b2

Download Submit
C:\Windows\System\xOkZWEz.exe

Filesize
2.3MB

MD5
5fa7642c03278236d9c29fe709949598

SHA1
0114780c6655c930bf57db1ceb5d09412916d7f1

SHA256
2fe118c8925d405d85ae4f5d9105d60f0a07ca3e9a9301bc23a0ea2247c97381

SHA512
273a2718085e4ecc76908054bc8fed839167b097db040760d041a6cc95b70463b58f172b2943f71ff7dda6ea9bbc2b6a215e64b5ee9a09a299bb4f6cc872d409

Download Submit
C:\Windows\System\yzrzacQ.exe

Filesize
2.3MB

MD5
44360ba5d6872024668379988c2de6b2

SHA1
7db7ec7751c1184579f2fadbb9311fe0c38883cf

SHA256
6f1e9769c2c15db44f43d36403cf363e405d1dc07577f7dda03209d3d4353c0d

SHA512
f96c6acf46e6f3370f3e48ce685eb66073b69c63ca238259d9b305e24cf95cc4f430ddf7e7464ef27b8c3424301b6559878ee4bfad6238af76789ffa6b8793e9

Download Submit
C:\Windows\System\zLWRZwP.exe

Filesize
2.3MB

MD5
c516110cb08501caee390b646ca8447b

SHA1
64827f6d19ddc0954cbca9d3250f4ccbb0ec247f

SHA256
c2a28d9e60648c4c508ef9958825b848861a4e13822ce6a01b78402fd944ba81

SHA512
36b9e337475fe5ee619effcf921fc40f14e77f39256db071ed98177be3afb1214628443b1b69fbd0e5f4a12fbfd5cb3aed99c9db3de8fba04dc544a735c414f4

Download Submit
memory/1040-31-0x00007FF605BF0000-0x00007FF605FE2000-memory.dmp

Filesize
3.9MB

Download
memory/1156-251-0x00007FF752FD0000-0x00007FF7533C2000-memory.dmp

Filesize
3.9MB

Download
memory/1156-4685-0x00007FF752FD0000-0x00007FF7533C2000-memory.dmp

Filesize
3.9MB

Download
memory/1180-263-0x00007FF648080000-0x00007FF648472000-memory.dmp

Filesize
3.9MB

Download
memory/1180-4717-0x00007FF648080000-0x00007FF648472000-memory.dmp

Filesize
3.9MB

Download
memory/1212-4673-0x00007FF7A4A40000-0x00007FF7A4E32000-memory.dmp

Filesize
3.9MB

Download
memory/1212-297-0x00007FF7A4A40000-0x00007FF7A4E32000-memory.dmp

Filesize
3.9MB

Download
memory/1332-4635-0x00007FF78FE40000-0x00007FF790232000-memory.dmp

Filesize
3.9MB

Download
memory/1332-25-0x00007FF78FE40000-0x00007FF790232000-memory.dmp

Filesize
3.9MB

Download
memory/1648-241-0x00007FF6867D0000-0x00007FF686BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-4689-0x00007FF6867D0000-0x00007FF686BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1740-105-0x00007FF6A70A0000-0x00007FF6A7492000-memory.dmp

Filesize
3.9MB

Download
memory/1740-4653-0x00007FF6A70A0000-0x00007FF6A7492000-memory.dmp

Filesize
3.9MB

Download
memory/1908-4624-0x00007FF6E2880000-0x00007FF6E2C72000-memory.dmp

Filesize
3.9MB

Download
memory/1908-58-0x00007FF6E2880000-0x00007FF6E2C72000-memory.dmp

Filesize
3.9MB

Download
memory/1952-4703-0x00007FF784FC0000-0x00007FF7853B2000-memory.dmp

Filesize
3.9MB

Download
memory/1952-298-0x00007FF784FC0000-0x00007FF7853B2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-207-0x00007FF7A2680000-0x00007FF7A2A72000-memory.dmp

Filesize
3.9MB

Download
memory/1984-4714-0x00007FF7A2680000-0x00007FF7A2A72000-memory.dmp

Filesize
3.9MB

Download
memory/2188-151-0x00007FF6F9FC0000-0x00007FF6FA3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-4643-0x00007FF6F9FC0000-0x00007FF6FA3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2280-22-0x00007FF699B40000-0x00007FF699F32000-memory.dmp

Filesize
3.9MB

Download
memory/2760-4650-0x00007FF6B7A90000-0x00007FF6B7E82000-memory.dmp

Filesize
3.9MB

Download
memory/2760-167-0x00007FF6B7A90000-0x00007FF6B7E82000-memory.dmp

Filesize
3.9MB

Download
memory/2888-252-0x00007FF7F7600000-0x00007FF7F79F2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-4691-0x00007FF7F7600000-0x00007FF7F79F2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-4677-0x00007FF63C580000-0x00007FF63C972000-memory.dmp

Filesize
3.9MB

Download
memory/2984-225-0x00007FF63C580000-0x00007FF63C972000-memory.dmp

Filesize
3.9MB

Download
memory/3028-186-0x00007FF77E0A0000-0x00007FF77E492000-memory.dmp

Filesize
3.9MB

Download
memory/3028-4663-0x00007FF77E0A0000-0x00007FF77E492000-memory.dmp

Filesize
3.9MB

Download
memory/3732-4720-0x00007FF6ED3F0000-0x00007FF6ED7E2000-memory.dmp

Filesize
3.9MB

Download
memory/3732-316-0x00007FF6ED3F0000-0x00007FF6ED7E2000-memory.dmp

Filesize
3.9MB

Download
memory/3824-264-0x00007FF732F10000-0x00007FF733302000-memory.dmp

Filesize
3.9MB

Download
memory/3824-4715-0x00007FF732F10000-0x00007FF733302000-memory.dmp

Filesize
3.9MB

Download
memory/3896-176-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3896-4667-0x00007FF6569B0000-0x00007FF656DA2000-memory.dmp

Filesize
3.9MB

Download
memory/4180-4683-0x00007FF7FCFD0000-0x00007FF7FD3C2000-memory.dmp

Filesize
3.9MB

Download
memory/4180-226-0x00007FF7FCFD0000-0x00007FF7FD3C2000-memory.dmp

Filesize
3.9MB

Download
memory/4268-192-0x00007FF66CF10000-0x00007FF66D302000-memory.dmp

Filesize
3.9MB

Download
memory/4268-4680-0x00007FF66CF10000-0x00007FF66D302000-memory.dmp

Filesize
3.9MB

Download
memory/4284-80-0x00007FF691EA0000-0x00007FF692292000-memory.dmp

Filesize
3.9MB

Download
memory/4284-4640-0x00007FF691EA0000-0x00007FF692292000-memory.dmp

Filesize
3.9MB

Download
memory/4408-0-0x00007FF7595B0000-0x00007FF7599A2000-memory.dmp

Filesize
3.9MB

Download
memory/4408-1-0x000001D1FDDB0000-0x000001D1FDDC0000-memory.dmp

Filesize
64KB

Download
memory/4612-286-0x00007FF7F4DA0000-0x00007FF7F5192000-memory.dmp

Filesize
3.9MB

Download
memory/4612-4647-0x00007FF7F4DA0000-0x00007FF7F5192000-memory.dmp

Filesize
3.9MB

Download
memory/4720-399-0x0000015C74130000-0x0000015C748D6000-memory.dmp

Filesize
7.6MB

Download
memory/4720-325-0x0000015C734D0000-0x0000015C734F2000-memory.dmp

Filesize
136KB

Download
memory/4944-4657-0x00007FF7B4180000-0x00007FF7B4572000-memory.dmp

Filesize
3.9MB

Download
memory/4944-168-0x00007FF7B4180000-0x00007FF7B4572000-memory.dmp

Filesize
3.9MB

Download