xmrig | d5f41bd93daddd58fc19985d34b18b3d123ae7935dfd7ab70d9e9a84461c7a57

Analysis

max time kernel
120s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

406625bdfef5749f15f9ac11a9ed2eb0N.exe
Size

1.6MB
MD5

406625bdfef5749f15f9ac11a9ed2eb0
SHA1

51badb9d56abcdf584c824bd554bac41a9c1e6f3
SHA256

d5f41bd93daddd58fc19985d34b18b3d123ae7935dfd7ab70d9e9a84461c7a57
SHA512

6d9812ef8212bf47564f2ee59a01452706ff358499aa636f9a4ddccb8f30b6f64ab5dd3ec2c358a7286bf15b229f2e184088a39704ffe1f0db13464ffb49f2c7
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtT:Lz071uv4BPMkibTIA5I4TNrpDGKK

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/4400-99-0x00007FF6538C0000-0x00007FF653CB2000-memory.dmp	xmrig
behavioral2/memory/1232-114-0x00007FF699B50000-0x00007FF699F42000-memory.dmp	xmrig
behavioral2/memory/3572-119-0x00007FF7EAFC0000-0x00007FF7EB3B2000-memory.dmp	xmrig
behavioral2/memory/4852-122-0x00007FF6234E0000-0x00007FF6238D2000-memory.dmp	xmrig
behavioral2/memory/2848-123-0x00007FF7A46F0000-0x00007FF7A4AE2000-memory.dmp	xmrig
behavioral2/memory/1848-121-0x00007FF756F00000-0x00007FF7572F2000-memory.dmp	xmrig
behavioral2/memory/220-120-0x00007FF7BF630000-0x00007FF7BFA22000-memory.dmp	xmrig
behavioral2/memory/4800-377-0x00007FF7DA1D0000-0x00007FF7DA5C2000-memory.dmp	xmrig
behavioral2/memory/2500-378-0x00007FF628150000-0x00007FF628542000-memory.dmp	xmrig
behavioral2/memory/4836-385-0x00007FF724AB0000-0x00007FF724EA2000-memory.dmp	xmrig
behavioral2/memory/3536-387-0x00007FF7686B0000-0x00007FF768AA2000-memory.dmp	xmrig
behavioral2/memory/2012-384-0x00007FF66D560000-0x00007FF66D952000-memory.dmp	xmrig
behavioral2/memory/1540-381-0x00007FF6C3BB0000-0x00007FF6C3FA2000-memory.dmp	xmrig
behavioral2/memory/440-118-0x00007FF60ACE0000-0x00007FF60B0D2000-memory.dmp	xmrig
behavioral2/memory/456-117-0x00007FF62C0F0000-0x00007FF62C4E2000-memory.dmp	xmrig
behavioral2/memory/2988-113-0x00007FF775BF0000-0x00007FF775FE2000-memory.dmp	xmrig
behavioral2/memory/4384-106-0x00007FF7CD7D0000-0x00007FF7CDBC2000-memory.dmp	xmrig
behavioral2/memory/2664-95-0x00007FF633840000-0x00007FF633C32000-memory.dmp	xmrig
behavioral2/memory/3544-86-0x00007FF665C80000-0x00007FF666072000-memory.dmp	xmrig
behavioral2/memory/3440-76-0x00007FF7FE0A0000-0x00007FF7FE492000-memory.dmp	xmrig
behavioral2/memory/2952-72-0x00007FF6518E0000-0x00007FF651CD2000-memory.dmp	xmrig
behavioral2/memory/2636-29-0x00007FF7A5BA0000-0x00007FF7A5F92000-memory.dmp	xmrig
behavioral2/memory/4644-28-0x00007FF6F68F0000-0x00007FF6F6CE2000-memory.dmp	xmrig
behavioral2/memory/2672-3670-0x00007FF63A0B0000-0x00007FF63A4A2000-memory.dmp	xmrig
behavioral2/memory/2952-3675-0x00007FF6518E0000-0x00007FF651CD2000-memory.dmp	xmrig
behavioral2/memory/2636-3678-0x00007FF7A5BA0000-0x00007FF7A5F92000-memory.dmp	xmrig
behavioral2/memory/456-3685-0x00007FF62C0F0000-0x00007FF62C4E2000-memory.dmp	xmrig
behavioral2/memory/4644-3681-0x00007FF6F68F0000-0x00007FF6F6CE2000-memory.dmp	xmrig
behavioral2/memory/3440-3690-0x00007FF7FE0A0000-0x00007FF7FE492000-memory.dmp	xmrig
behavioral2/memory/440-3712-0x00007FF60ACE0000-0x00007FF60B0D2000-memory.dmp	xmrig
behavioral2/memory/4852-3732-0x00007FF6234E0000-0x00007FF6238D2000-memory.dmp	xmrig
behavioral2/memory/1848-3733-0x00007FF756F00000-0x00007FF7572F2000-memory.dmp	xmrig
behavioral2/memory/220-3723-0x00007FF7BF630000-0x00007FF7BFA22000-memory.dmp	xmrig
behavioral2/memory/3572-3719-0x00007FF7EAFC0000-0x00007FF7EB3B2000-memory.dmp	xmrig
behavioral2/memory/1232-3722-0x00007FF699B50000-0x00007FF699F42000-memory.dmp	xmrig
behavioral2/memory/4400-3707-0x00007FF6538C0000-0x00007FF653CB2000-memory.dmp	xmrig
behavioral2/memory/3544-3701-0x00007FF665C80000-0x00007FF666072000-memory.dmp	xmrig
behavioral2/memory/4384-3697-0x00007FF7CD7D0000-0x00007FF7CDBC2000-memory.dmp	xmrig
behavioral2/memory/2988-3696-0x00007FF775BF0000-0x00007FF775FE2000-memory.dmp	xmrig
behavioral2/memory/2664-3703-0x00007FF633840000-0x00007FF633C32000-memory.dmp	xmrig
behavioral2/memory/2848-3737-0x00007FF7A46F0000-0x00007FF7A4AE2000-memory.dmp	xmrig
behavioral2/memory/4800-3741-0x00007FF7DA1D0000-0x00007FF7DA5C2000-memory.dmp	xmrig
behavioral2/memory/2500-3746-0x00007FF628150000-0x00007FF628542000-memory.dmp	xmrig
behavioral2/memory/1540-3750-0x00007FF6C3BB0000-0x00007FF6C3FA2000-memory.dmp	xmrig
behavioral2/memory/2012-3753-0x00007FF66D560000-0x00007FF66D952000-memory.dmp	xmrig
behavioral2/memory/4836-3755-0x00007FF724AB0000-0x00007FF724EA2000-memory.dmp	xmrig
behavioral2/memory/3536-3758-0x00007FF7686B0000-0x00007FF768AA2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4328	powershell.exe
5	4328	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4328	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2672	sNOyabu.exe
2952	bBeVoGa.exe
4644	jnNZKoo.exe
2636	HLfQvSA.exe
456	buCCGZz.exe
3440	rGYJFKg.exe
3544	tFROPYm.exe
2664	iFdXjHb.exe
4400	CBGyvmu.exe
440	EMHbIpV.exe
4384	iVrVdLz.exe
2988	ZOlmdWM.exe
3572	aWZiKOp.exe
220	qFcmRow.exe
1232	JSoBifp.exe
1848	gWAiyaO.exe
4852	KqYQLgp.exe
2848	ukfYAsx.exe
4800	WJVEsKC.exe
2500	hQsOgbA.exe
1540	yFaxEHD.exe
2012	xmaGcSF.exe
4836	CjqGjpl.exe
3536	yxbohUp.exe
4872	OFXIMgl.exe
2156	rYMsXVA.exe
4416	DbaNfgK.exe
2624	EvtmMia.exe
1940	Tvoprrv.exe
2180	KbqGibu.exe
3444	uLwngvl.exe
940	mirFLuS.exe
812	piWywRs.exe
2820	lTtnQVd.exe
3176	MjdRGpE.exe
4972	usYZwrC.exe
4516	sgQCAEh.exe
2932	EpnItCh.exe
4396	agLSggN.exe
4920	Hdqwtai.exe
868	MNPkrti.exe
3852	zXwPZYB.exe
3476	HubQxkF.exe
3836	nFYEmjZ.exe
1532	ddJxNLB.exe
3044	XoXcJmk.exe
372	dJINmNk.exe
1164	aXNADDB.exe
2920	aJFUupo.exe
1368	BtnxyVH.exe
4284	UdvHAHe.exe
4480	IdPoyzn.exe
3432	fbFxXLF.exe
1672	RXigAlH.exe
3540	nfZIpRe.exe
1576	rvtnMNg.exe
412	BMbnLdc.exe
764	FikHUoP.exe
2056	qPFTGNX.exe
1216	EVkArGN.exe
4840	zQlPzKz.exe
2408	qiaDQWf.exe
1704	yRerFkZ.exe
4264	catuZvA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4668-0-0x00007FF67FAD0000-0x00007FF67FEC2000-memory.dmp	upx
behavioral2/files/0x00090000000233f0-5.dat	upx
behavioral2/files/0x0008000000023453-11.dat	upx
behavioral2/files/0x0007000000023455-30.dat	upx
behavioral2/files/0x0007000000023456-39.dat	upx
behavioral2/files/0x0007000000023459-50.dat	upx
behavioral2/files/0x000700000002345c-71.dat	upx
behavioral2/files/0x000700000002345d-77.dat	upx
behavioral2/memory/4400-99-0x00007FF6538C0000-0x00007FF653CB2000-memory.dmp	upx
behavioral2/files/0x0007000000023461-105.dat	upx
behavioral2/files/0x000800000002345e-110.dat	upx
behavioral2/memory/1232-114-0x00007FF699B50000-0x00007FF699F42000-memory.dmp	upx
behavioral2/memory/3572-119-0x00007FF7EAFC0000-0x00007FF7EB3B2000-memory.dmp	upx
behavioral2/memory/4852-122-0x00007FF6234E0000-0x00007FF6238D2000-memory.dmp	upx
behavioral2/memory/2848-123-0x00007FF7A46F0000-0x00007FF7A4AE2000-memory.dmp	upx
behavioral2/memory/1848-121-0x00007FF756F00000-0x00007FF7572F2000-memory.dmp	upx
behavioral2/memory/220-120-0x00007FF7BF630000-0x00007FF7BFA22000-memory.dmp	upx
behavioral2/files/0x0007000000023464-140.dat	upx
behavioral2/files/0x000700000002346b-175.dat	upx
behavioral2/memory/4800-377-0x00007FF7DA1D0000-0x00007FF7DA5C2000-memory.dmp	upx
behavioral2/memory/2500-378-0x00007FF628150000-0x00007FF628542000-memory.dmp	upx
behavioral2/memory/4836-385-0x00007FF724AB0000-0x00007FF724EA2000-memory.dmp	upx
behavioral2/memory/3536-387-0x00007FF7686B0000-0x00007FF768AA2000-memory.dmp	upx
behavioral2/memory/2012-384-0x00007FF66D560000-0x00007FF66D952000-memory.dmp	upx
behavioral2/memory/1540-381-0x00007FF6C3BB0000-0x00007FF6C3FA2000-memory.dmp	upx
behavioral2/files/0x000700000002346f-194.dat	upx
behavioral2/files/0x000700000002346e-190.dat	upx
behavioral2/files/0x000700000002346d-185.dat	upx
behavioral2/files/0x000700000002346c-180.dat	upx
behavioral2/files/0x000700000002346a-170.dat	upx
behavioral2/files/0x0007000000023469-164.dat	upx
behavioral2/files/0x0007000000023468-160.dat	upx
behavioral2/files/0x0007000000023467-155.dat	upx
behavioral2/files/0x0007000000023466-150.dat	upx
behavioral2/files/0x0007000000023465-145.dat	upx
behavioral2/files/0x0007000000023463-134.dat	upx
behavioral2/files/0x0007000000023462-130.dat	upx
behavioral2/memory/440-118-0x00007FF60ACE0000-0x00007FF60B0D2000-memory.dmp	upx
behavioral2/memory/456-117-0x00007FF62C0F0000-0x00007FF62C4E2000-memory.dmp	upx
behavioral2/memory/2988-113-0x00007FF775BF0000-0x00007FF775FE2000-memory.dmp	upx
behavioral2/files/0x0008000000023451-111.dat	upx
behavioral2/memory/4384-106-0x00007FF7CD7D0000-0x00007FF7CDBC2000-memory.dmp	upx
behavioral2/files/0x000800000002345f-103.dat	upx
behavioral2/files/0x0007000000023460-101.dat	upx
behavioral2/memory/2664-95-0x00007FF633840000-0x00007FF633C32000-memory.dmp	upx
behavioral2/files/0x000700000002345a-88.dat	upx
behavioral2/memory/3544-86-0x00007FF665C80000-0x00007FF666072000-memory.dmp	upx
behavioral2/files/0x000700000002345b-80.dat	upx
behavioral2/memory/3440-76-0x00007FF7FE0A0000-0x00007FF7FE492000-memory.dmp	upx
behavioral2/memory/2952-72-0x00007FF6518E0000-0x00007FF651CD2000-memory.dmp	upx
behavioral2/files/0x0007000000023458-58.dat	upx
behavioral2/files/0x0007000000023457-54.dat	upx
behavioral2/memory/2636-29-0x00007FF7A5BA0000-0x00007FF7A5F92000-memory.dmp	upx
behavioral2/memory/4644-28-0x00007FF6F68F0000-0x00007FF6F6CE2000-memory.dmp	upx
behavioral2/files/0x0007000000023454-23.dat	upx
behavioral2/files/0x0008000000023450-17.dat	upx
behavioral2/memory/2672-7-0x00007FF63A0B0000-0x00007FF63A4A2000-memory.dmp	upx
behavioral2/memory/2672-3670-0x00007FF63A0B0000-0x00007FF63A4A2000-memory.dmp	upx
behavioral2/memory/2952-3675-0x00007FF6518E0000-0x00007FF651CD2000-memory.dmp	upx
behavioral2/memory/2636-3678-0x00007FF7A5BA0000-0x00007FF7A5F92000-memory.dmp	upx
behavioral2/memory/456-3685-0x00007FF62C0F0000-0x00007FF62C4E2000-memory.dmp	upx
behavioral2/memory/4644-3681-0x00007FF6F68F0000-0x00007FF6F6CE2000-memory.dmp	upx
behavioral2/memory/3440-3690-0x00007FF7FE0A0000-0x00007FF7FE492000-memory.dmp	upx
behavioral2/memory/440-3712-0x00007FF60ACE0000-0x00007FF60B0D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vgYcKrG.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\zLkjOFR.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\qenEtiY.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\hZpbhst.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\fUDyMoh.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\ITCiMyC.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\keEPndR.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\NCYXNvM.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\lEaNZjf.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\OsoMDlL.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\oBJEXGS.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\eVFsURe.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\SvldzFV.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\dgDiFZF.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\BZTssep.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\kvqBVwX.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\PxsFdGb.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\IYquVVm.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\bMFBxCr.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\Omrlsna.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\UMuvgtF.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\YciRbhR.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\csBzJhB.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\WOfPaBB.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\haFdsEq.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\ahhhItC.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\wGTBgLk.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\LUCDxph.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\wRIvbZK.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\JKCiGEw.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\aEczefB.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\vHRIxco.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\ONJrtvR.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\AQDKqeR.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\rbXiaIU.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\UxiRMAb.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\xZDkTrv.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\YarqUgg.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\qKwzgiK.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\incTJYL.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\VFiCYuj.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\zYOPvLq.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\JsuAcis.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\BToFyga.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\vZmxdCw.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\PpWoQKn.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\TRQEkdu.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\CLbrmUG.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\TEaOrFi.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\ojpVawo.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\kndxQvJ.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\bPDOWTk.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\dmgBTrz.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\VnaaKqJ.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\ErelBLA.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\tcvPHYL.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\NvyewKH.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\fprnlRa.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\XhZLPsg.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\JkrtNJX.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\zxiRLLs.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\mHnArFv.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\mmtdykT.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe
File created	C:\Windows\System\QBVUjpm.exe	406625bdfef5749f15f9ac11a9ed2eb0N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe
Token: SeLockMemoryPrivilege	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe
Token: SeDebugPrivilege	4328	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4328	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	82
PID 4668 wrote to memory of 4328	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	82
PID 4668 wrote to memory of 2672	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	83
PID 4668 wrote to memory of 2672	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	83
PID 4668 wrote to memory of 2952	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	84
PID 4668 wrote to memory of 2952	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	84
PID 4668 wrote to memory of 4644	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	85
PID 4668 wrote to memory of 4644	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	85
PID 4668 wrote to memory of 2636	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	86
PID 4668 wrote to memory of 2636	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	86
PID 4668 wrote to memory of 456	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	87
PID 4668 wrote to memory of 456	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	87
PID 4668 wrote to memory of 3440	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	88
PID 4668 wrote to memory of 3440	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	88
PID 4668 wrote to memory of 3544	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	89
PID 4668 wrote to memory of 3544	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	89
PID 4668 wrote to memory of 2664	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	90
PID 4668 wrote to memory of 2664	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	90
PID 4668 wrote to memory of 4400	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	91
PID 4668 wrote to memory of 4400	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	91
PID 4668 wrote to memory of 440	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	92
PID 4668 wrote to memory of 440	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	92
PID 4668 wrote to memory of 4384	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	93
PID 4668 wrote to memory of 4384	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	93
PID 4668 wrote to memory of 2988	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	94
PID 4668 wrote to memory of 2988	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	94
PID 4668 wrote to memory of 3572	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	95
PID 4668 wrote to memory of 3572	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	95
PID 4668 wrote to memory of 220	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	96
PID 4668 wrote to memory of 220	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	96
PID 4668 wrote to memory of 1232	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	97
PID 4668 wrote to memory of 1232	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	97
PID 4668 wrote to memory of 1848	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	98
PID 4668 wrote to memory of 1848	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	98
PID 4668 wrote to memory of 4852	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	99
PID 4668 wrote to memory of 4852	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	99
PID 4668 wrote to memory of 2848	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	100
PID 4668 wrote to memory of 2848	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	100
PID 4668 wrote to memory of 4800	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	101
PID 4668 wrote to memory of 4800	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	101
PID 4668 wrote to memory of 2500	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	102
PID 4668 wrote to memory of 2500	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	102
PID 4668 wrote to memory of 1540	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	103
PID 4668 wrote to memory of 1540	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	103
PID 4668 wrote to memory of 2012	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	104
PID 4668 wrote to memory of 2012	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	104
PID 4668 wrote to memory of 4836	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	105
PID 4668 wrote to memory of 4836	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	105
PID 4668 wrote to memory of 3536	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	106
PID 4668 wrote to memory of 3536	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	106
PID 4668 wrote to memory of 4872	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	107
PID 4668 wrote to memory of 4872	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	107
PID 4668 wrote to memory of 2156	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	108
PID 4668 wrote to memory of 2156	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	108
PID 4668 wrote to memory of 4416	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	109
PID 4668 wrote to memory of 4416	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	109
PID 4668 wrote to memory of 2624	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	110
PID 4668 wrote to memory of 2624	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	110
PID 4668 wrote to memory of 1940	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	111
PID 4668 wrote to memory of 1940	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	111
PID 4668 wrote to memory of 2180	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	112
PID 4668 wrote to memory of 2180	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	112
PID 4668 wrote to memory of 3444	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	113
PID 4668 wrote to memory of 3444	4668	406625bdfef5749f15f9ac11a9ed2eb0N.exe	113

C:\Users\Admin\AppData\Local\Temp\406625bdfef5749f15f9ac11a9ed2eb0N.exe
"C:\Users\Admin\AppData\Local\Temp\406625bdfef5749f15f9ac11a9ed2eb0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4328
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4328" "2968" "2892" "2972" "0" "0" "2976" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13064
- C:\Windows\System\sNOyabu.exe
  C:\Windows\System\sNOyabu.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\bBeVoGa.exe
  C:\Windows\System\bBeVoGa.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\jnNZKoo.exe
  C:\Windows\System\jnNZKoo.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\HLfQvSA.exe
  C:\Windows\System\HLfQvSA.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\buCCGZz.exe
  C:\Windows\System\buCCGZz.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\rGYJFKg.exe
  C:\Windows\System\rGYJFKg.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\tFROPYm.exe
  C:\Windows\System\tFROPYm.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\iFdXjHb.exe
  C:\Windows\System\iFdXjHb.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\CBGyvmu.exe
  C:\Windows\System\CBGyvmu.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\EMHbIpV.exe
  C:\Windows\System\EMHbIpV.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\iVrVdLz.exe
  C:\Windows\System\iVrVdLz.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\ZOlmdWM.exe
  C:\Windows\System\ZOlmdWM.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\aWZiKOp.exe
  C:\Windows\System\aWZiKOp.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\qFcmRow.exe
  C:\Windows\System\qFcmRow.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\JSoBifp.exe
  C:\Windows\System\JSoBifp.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\gWAiyaO.exe
  C:\Windows\System\gWAiyaO.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\KqYQLgp.exe
  C:\Windows\System\KqYQLgp.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\ukfYAsx.exe
  C:\Windows\System\ukfYAsx.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\WJVEsKC.exe
  C:\Windows\System\WJVEsKC.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\hQsOgbA.exe
  C:\Windows\System\hQsOgbA.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\yFaxEHD.exe
  C:\Windows\System\yFaxEHD.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\xmaGcSF.exe
  C:\Windows\System\xmaGcSF.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\CjqGjpl.exe
  C:\Windows\System\CjqGjpl.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\yxbohUp.exe
  C:\Windows\System\yxbohUp.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\OFXIMgl.exe
  C:\Windows\System\OFXIMgl.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\rYMsXVA.exe
  C:\Windows\System\rYMsXVA.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\DbaNfgK.exe
  C:\Windows\System\DbaNfgK.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\EvtmMia.exe
  C:\Windows\System\EvtmMia.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\Tvoprrv.exe
  C:\Windows\System\Tvoprrv.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\KbqGibu.exe
  C:\Windows\System\KbqGibu.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\uLwngvl.exe
  C:\Windows\System\uLwngvl.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\mirFLuS.exe
  C:\Windows\System\mirFLuS.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\piWywRs.exe
  C:\Windows\System\piWywRs.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\lTtnQVd.exe
  C:\Windows\System\lTtnQVd.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\MjdRGpE.exe
  C:\Windows\System\MjdRGpE.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\usYZwrC.exe
  C:\Windows\System\usYZwrC.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\sgQCAEh.exe
  C:\Windows\System\sgQCAEh.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\EpnItCh.exe
  C:\Windows\System\EpnItCh.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\agLSggN.exe
  C:\Windows\System\agLSggN.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\Hdqwtai.exe
  C:\Windows\System\Hdqwtai.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\MNPkrti.exe
  C:\Windows\System\MNPkrti.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\zXwPZYB.exe
  C:\Windows\System\zXwPZYB.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\HubQxkF.exe
  C:\Windows\System\HubQxkF.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\nFYEmjZ.exe
  C:\Windows\System\nFYEmjZ.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\ddJxNLB.exe
  C:\Windows\System\ddJxNLB.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\XoXcJmk.exe
  C:\Windows\System\XoXcJmk.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\dJINmNk.exe
  C:\Windows\System\dJINmNk.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\aXNADDB.exe
  C:\Windows\System\aXNADDB.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\aJFUupo.exe
  C:\Windows\System\aJFUupo.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\BtnxyVH.exe
  C:\Windows\System\BtnxyVH.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\UdvHAHe.exe
  C:\Windows\System\UdvHAHe.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\IdPoyzn.exe
  C:\Windows\System\IdPoyzn.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\fbFxXLF.exe
  C:\Windows\System\fbFxXLF.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\RXigAlH.exe
  C:\Windows\System\RXigAlH.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\nfZIpRe.exe
  C:\Windows\System\nfZIpRe.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\rvtnMNg.exe
  C:\Windows\System\rvtnMNg.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\BMbnLdc.exe
  C:\Windows\System\BMbnLdc.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\FikHUoP.exe
  C:\Windows\System\FikHUoP.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\qPFTGNX.exe
  C:\Windows\System\qPFTGNX.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\EVkArGN.exe
  C:\Windows\System\EVkArGN.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\zQlPzKz.exe
  C:\Windows\System\zQlPzKz.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\qiaDQWf.exe
  C:\Windows\System\qiaDQWf.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\yRerFkZ.exe
  C:\Windows\System\yRerFkZ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\catuZvA.exe
  C:\Windows\System\catuZvA.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\mBiWclk.exe
  C:\Windows\System\mBiWclk.exe
  2⤵
  PID:928
- C:\Windows\System\SLSvylI.exe
  C:\Windows\System\SLSvylI.exe
  2⤵
  PID:4440
- C:\Windows\System\WaUisEc.exe
  C:\Windows\System\WaUisEc.exe
  2⤵
  PID:2940
- C:\Windows\System\NDpsbSu.exe
  C:\Windows\System\NDpsbSu.exe
  2⤵
  PID:1980
- C:\Windows\System\CbcGyJw.exe
  C:\Windows\System\CbcGyJw.exe
  2⤵
  PID:2972
- C:\Windows\System\oceDoot.exe
  C:\Windows\System\oceDoot.exe
  2⤵
  PID:4608
- C:\Windows\System\yDXhHxh.exe
  C:\Windows\System\yDXhHxh.exe
  2⤵
  PID:1060
- C:\Windows\System\IYsFRRk.exe
  C:\Windows\System\IYsFRRk.exe
  2⤵
  PID:556
- C:\Windows\System\ekEYxLZ.exe
  C:\Windows\System\ekEYxLZ.exe
  2⤵
  PID:1852
- C:\Windows\System\ppBhjLL.exe
  C:\Windows\System\ppBhjLL.exe
  2⤵
  PID:2528
- C:\Windows\System\JYLvzvH.exe
  C:\Windows\System\JYLvzvH.exe
  2⤵
  PID:5004
- C:\Windows\System\BwBRoFr.exe
  C:\Windows\System\BwBRoFr.exe
  2⤵
  PID:3764
- C:\Windows\System\PFjSkth.exe
  C:\Windows\System\PFjSkth.exe
  2⤵
  PID:5108
- C:\Windows\System\FdiEpfy.exe
  C:\Windows\System\FdiEpfy.exe
  2⤵
  PID:4860
- C:\Windows\System\mEbAqgs.exe
  C:\Windows\System\mEbAqgs.exe
  2⤵
  PID:3384
- C:\Windows\System\TfVoNKR.exe
  C:\Windows\System\TfVoNKR.exe
  2⤵
  PID:2296
- C:\Windows\System\kRkuVJy.exe
  C:\Windows\System\kRkuVJy.exe
  2⤵
  PID:3700
- C:\Windows\System\gRPQHPU.exe
  C:\Windows\System\gRPQHPU.exe
  2⤵
  PID:4496
- C:\Windows\System\GBmlqUV.exe
  C:\Windows\System\GBmlqUV.exe
  2⤵
  PID:1748
- C:\Windows\System\xckdlDf.exe
  C:\Windows\System\xckdlDf.exe
  2⤵
  PID:4812
- C:\Windows\System\kETXsyw.exe
  C:\Windows\System\kETXsyw.exe
  2⤵
  PID:2376
- C:\Windows\System\zqkNBDy.exe
  C:\Windows\System\zqkNBDy.exe
  2⤵
  PID:2360
- C:\Windows\System\BwWUeRF.exe
  C:\Windows\System\BwWUeRF.exe
  2⤵
  PID:1732
- C:\Windows\System\TbdsUBI.exe
  C:\Windows\System\TbdsUBI.exe
  2⤵
  PID:3508
- C:\Windows\System\LHKpSkA.exe
  C:\Windows\System\LHKpSkA.exe
  2⤵
  PID:4332
- C:\Windows\System\osWRUYR.exe
  C:\Windows\System\osWRUYR.exe
  2⤵
  PID:4596
- C:\Windows\System\xqKqXht.exe
  C:\Windows\System\xqKqXht.exe
  2⤵
  PID:2228
- C:\Windows\System\JZnYOZU.exe
  C:\Windows\System\JZnYOZU.exe
  2⤵
  PID:1588
- C:\Windows\System\fhCMHll.exe
  C:\Windows\System\fhCMHll.exe
  2⤵
  PID:3276
- C:\Windows\System\FtefjOJ.exe
  C:\Windows\System\FtefjOJ.exe
  2⤵
  PID:3916
- C:\Windows\System\wvwPEzf.exe
  C:\Windows\System\wvwPEzf.exe
  2⤵
  PID:464
- C:\Windows\System\nsDsONe.exe
  C:\Windows\System\nsDsONe.exe
  2⤵
  PID:3108
- C:\Windows\System\iuFPHXi.exe
  C:\Windows\System\iuFPHXi.exe
  2⤵
  PID:1156
- C:\Windows\System\IVBzMxA.exe
  C:\Windows\System\IVBzMxA.exe
  2⤵
  PID:3356
- C:\Windows\System\XGVQqax.exe
  C:\Windows\System\XGVQqax.exe
  2⤵
  PID:5264
- C:\Windows\System\IuBjnKU.exe
  C:\Windows\System\IuBjnKU.exe
  2⤵
  PID:5316
- C:\Windows\System\iTRrDrS.exe
  C:\Windows\System\iTRrDrS.exe
  2⤵
  PID:5336
- C:\Windows\System\UVQDIEw.exe
  C:\Windows\System\UVQDIEw.exe
  2⤵
  PID:5356
- C:\Windows\System\RzrkiyX.exe
  C:\Windows\System\RzrkiyX.exe
  2⤵
  PID:5376
- C:\Windows\System\lvhFTtF.exe
  C:\Windows\System\lvhFTtF.exe
  2⤵
  PID:5412
- C:\Windows\System\ZgaJrnQ.exe
  C:\Windows\System\ZgaJrnQ.exe
  2⤵
  PID:5464
- C:\Windows\System\zSEtyVz.exe
  C:\Windows\System\zSEtyVz.exe
  2⤵
  PID:5484
- C:\Windows\System\AqhquXg.exe
  C:\Windows\System\AqhquXg.exe
  2⤵
  PID:5516
- C:\Windows\System\McxyqoG.exe
  C:\Windows\System\McxyqoG.exe
  2⤵
  PID:5544
- C:\Windows\System\qwnwcSK.exe
  C:\Windows\System\qwnwcSK.exe
  2⤵
  PID:5572
- C:\Windows\System\PUfWQTo.exe
  C:\Windows\System\PUfWQTo.exe
  2⤵
  PID:5588
- C:\Windows\System\BezxPqQ.exe
  C:\Windows\System\BezxPqQ.exe
  2⤵
  PID:5628
- C:\Windows\System\XqkuNmr.exe
  C:\Windows\System\XqkuNmr.exe
  2⤵
  PID:5648
- C:\Windows\System\cfxIYyF.exe
  C:\Windows\System\cfxIYyF.exe
  2⤵
  PID:5672
- C:\Windows\System\GqXnzdE.exe
  C:\Windows\System\GqXnzdE.exe
  2⤵
  PID:5692
- C:\Windows\System\lBQKedb.exe
  C:\Windows\System\lBQKedb.exe
  2⤵
  PID:5720
- C:\Windows\System\srrtPfC.exe
  C:\Windows\System\srrtPfC.exe
  2⤵
  PID:5752
- C:\Windows\System\TIQPCQm.exe
  C:\Windows\System\TIQPCQm.exe
  2⤵
  PID:5792
- C:\Windows\System\CCsRaNp.exe
  C:\Windows\System\CCsRaNp.exe
  2⤵
  PID:5816
- C:\Windows\System\PJjxDHQ.exe
  C:\Windows\System\PJjxDHQ.exe
  2⤵
  PID:5860
- C:\Windows\System\EtDqsgY.exe
  C:\Windows\System\EtDqsgY.exe
  2⤵
  PID:5880
- C:\Windows\System\sCwfvop.exe
  C:\Windows\System\sCwfvop.exe
  2⤵
  PID:5912
- C:\Windows\System\hAZAMJc.exe
  C:\Windows\System\hAZAMJc.exe
  2⤵
  PID:5940
- C:\Windows\System\XzzkSIV.exe
  C:\Windows\System\XzzkSIV.exe
  2⤵
  PID:5964
- C:\Windows\System\mYiJYrH.exe
  C:\Windows\System\mYiJYrH.exe
  2⤵
  PID:5984
- C:\Windows\System\HajoMFi.exe
  C:\Windows\System\HajoMFi.exe
  2⤵
  PID:6000
- C:\Windows\System\LdwTjPY.exe
  C:\Windows\System\LdwTjPY.exe
  2⤵
  PID:6040
- C:\Windows\System\XERoNHX.exe
  C:\Windows\System\XERoNHX.exe
  2⤵
  PID:6068
- C:\Windows\System\jzrpboL.exe
  C:\Windows\System\jzrpboL.exe
  2⤵
  PID:6084
- C:\Windows\System\uHIVjXr.exe
  C:\Windows\System\uHIVjXr.exe
  2⤵
  PID:6116
- C:\Windows\System\AxXpaqw.exe
  C:\Windows\System\AxXpaqw.exe
  2⤵
  PID:760
- C:\Windows\System\WgUwYSK.exe
  C:\Windows\System\WgUwYSK.exe
  2⤵
  PID:1984
- C:\Windows\System\VniSqcx.exe
  C:\Windows\System\VniSqcx.exe
  2⤵
  PID:4804
- C:\Windows\System\aYLTfqk.exe
  C:\Windows\System\aYLTfqk.exe
  2⤵
  PID:4192
- C:\Windows\System\ncyretQ.exe
  C:\Windows\System\ncyretQ.exe
  2⤵
  PID:3728
- C:\Windows\System\CPdfCNi.exe
  C:\Windows\System\CPdfCNi.exe
  2⤵
  PID:2328
- C:\Windows\System\yrzUIZs.exe
  C:\Windows\System\yrzUIZs.exe
  2⤵
  PID:5244
- C:\Windows\System\oEZJDvB.exe
  C:\Windows\System\oEZJDvB.exe
  2⤵
  PID:5308
- C:\Windows\System\zxbvjGE.exe
  C:\Windows\System\zxbvjGE.exe
  2⤵
  PID:5368
- C:\Windows\System\HuxOMJl.exe
  C:\Windows\System\HuxOMJl.exe
  2⤵
  PID:5564
- C:\Windows\System\ONnvCgy.exe
  C:\Windows\System\ONnvCgy.exe
  2⤵
  PID:5532
- C:\Windows\System\UcCHtGM.exe
  C:\Windows\System\UcCHtGM.exe
  2⤵
  PID:5584
- C:\Windows\System\ZtglyOx.exe
  C:\Windows\System\ZtglyOx.exe
  2⤵
  PID:5668
- C:\Windows\System\WsMZXMs.exe
  C:\Windows\System\WsMZXMs.exe
  2⤵
  PID:5772
- C:\Windows\System\KTTqjcf.exe
  C:\Windows\System\KTTqjcf.exe
  2⤵
  PID:1468
- C:\Windows\System\lRXXXyw.exe
  C:\Windows\System\lRXXXyw.exe
  2⤵
  PID:5852
- C:\Windows\System\FyDpJfy.exe
  C:\Windows\System\FyDpJfy.exe
  2⤵
  PID:5980
- C:\Windows\System\jJPPqvz.exe
  C:\Windows\System\jJPPqvz.exe
  2⤵
  PID:6052
- C:\Windows\System\IBsIRLD.exe
  C:\Windows\System\IBsIRLD.exe
  2⤵
  PID:6076
- C:\Windows\System\NqgFGWJ.exe
  C:\Windows\System\NqgFGWJ.exe
  2⤵
  PID:4700
- C:\Windows\System\XhZLPsg.exe
  C:\Windows\System\XhZLPsg.exe
  2⤵
  PID:4692
- C:\Windows\System\aIdkyte.exe
  C:\Windows\System\aIdkyte.exe
  2⤵
  PID:2608
- C:\Windows\System\AsAVMUF.exe
  C:\Windows\System\AsAVMUF.exe
  2⤵
  PID:3636
- C:\Windows\System\bqEdYEU.exe
  C:\Windows\System\bqEdYEU.exe
  2⤵
  PID:5204
- C:\Windows\System\mdduoXK.exe
  C:\Windows\System\mdduoXK.exe
  2⤵
  PID:5352
- C:\Windows\System\kUcMOLW.exe
  C:\Windows\System\kUcMOLW.exe
  2⤵
  PID:5524
- C:\Windows\System\MhXsMUY.exe
  C:\Windows\System\MhXsMUY.exe
  2⤵
  PID:4760
- C:\Windows\System\jDwfJVi.exe
  C:\Windows\System\jDwfJVi.exe
  2⤵
  PID:5732
- C:\Windows\System\PpVbQhg.exe
  C:\Windows\System\PpVbQhg.exe
  2⤵
  PID:2212
- C:\Windows\System\hJKikim.exe
  C:\Windows\System\hJKikim.exe
  2⤵
  PID:6016
- C:\Windows\System\kyEfsBx.exe
  C:\Windows\System\kyEfsBx.exe
  2⤵
  PID:6124
- C:\Windows\System\iSXUqRS.exe
  C:\Windows\System\iSXUqRS.exe
  2⤵
  PID:2692
- C:\Windows\System\aDTIZSy.exe
  C:\Windows\System\aDTIZSy.exe
  2⤵
  PID:5580
- C:\Windows\System\fxucDVp.exe
  C:\Windows\System\fxucDVp.exe
  2⤵
  PID:6060
- C:\Windows\System\PiKjHJU.exe
  C:\Windows\System\PiKjHJU.exe
  2⤵
  PID:5840
- C:\Windows\System\zJacIjp.exe
  C:\Windows\System\zJacIjp.exe
  2⤵
  PID:5972
- C:\Windows\System\OsoMDlL.exe
  C:\Windows\System\OsoMDlL.exe
  2⤵
  PID:5136
- C:\Windows\System\hTORnoq.exe
  C:\Windows\System\hTORnoq.exe
  2⤵
  PID:6184
- C:\Windows\System\nGWendC.exe
  C:\Windows\System\nGWendC.exe
  2⤵
  PID:6204
- C:\Windows\System\sJoNHlG.exe
  C:\Windows\System\sJoNHlG.exe
  2⤵
  PID:6224
- C:\Windows\System\yEdUWfo.exe
  C:\Windows\System\yEdUWfo.exe
  2⤵
  PID:6272
- C:\Windows\System\svpZtIr.exe
  C:\Windows\System\svpZtIr.exe
  2⤵
  PID:6288
- C:\Windows\System\rJRTnZQ.exe
  C:\Windows\System\rJRTnZQ.exe
  2⤵
  PID:6332
- C:\Windows\System\fXfcKbT.exe
  C:\Windows\System\fXfcKbT.exe
  2⤵
  PID:6348
- C:\Windows\System\chqenYu.exe
  C:\Windows\System\chqenYu.exe
  2⤵
  PID:6376
- C:\Windows\System\gFUswaY.exe
  C:\Windows\System\gFUswaY.exe
  2⤵
  PID:6396
- C:\Windows\System\wkWMRWN.exe
  C:\Windows\System\wkWMRWN.exe
  2⤵
  PID:6420
- C:\Windows\System\wOXCmOf.exe
  C:\Windows\System\wOXCmOf.exe
  2⤵
  PID:6480
- C:\Windows\System\oDnKyqM.exe
  C:\Windows\System\oDnKyqM.exe
  2⤵
  PID:6516
- C:\Windows\System\ehTyTRn.exe
  C:\Windows\System\ehTyTRn.exe
  2⤵
  PID:6540
- C:\Windows\System\iXLVHPv.exe
  C:\Windows\System\iXLVHPv.exe
  2⤵
  PID:6560
- C:\Windows\System\CMUZzLW.exe
  C:\Windows\System\CMUZzLW.exe
  2⤵
  PID:6588
- C:\Windows\System\JXYoUOX.exe
  C:\Windows\System\JXYoUOX.exe
  2⤵
  PID:6604
- C:\Windows\System\NBsJABz.exe
  C:\Windows\System\NBsJABz.exe
  2⤵
  PID:6628
- C:\Windows\System\OmzRmoA.exe
  C:\Windows\System\OmzRmoA.exe
  2⤵
  PID:6684
- C:\Windows\System\wvYmvRk.exe
  C:\Windows\System\wvYmvRk.exe
  2⤵
  PID:6700
- C:\Windows\System\JWaJnXr.exe
  C:\Windows\System\JWaJnXr.exe
  2⤵
  PID:6720
- C:\Windows\System\MzArUJm.exe
  C:\Windows\System\MzArUJm.exe
  2⤵
  PID:6740
- C:\Windows\System\SIoZQgp.exe
  C:\Windows\System\SIoZQgp.exe
  2⤵
  PID:6760
- C:\Windows\System\XEVaUBd.exe
  C:\Windows\System\XEVaUBd.exe
  2⤵
  PID:6780
- C:\Windows\System\WaFqiAK.exe
  C:\Windows\System\WaFqiAK.exe
  2⤵
  PID:6832
- C:\Windows\System\CtLhtuj.exe
  C:\Windows\System\CtLhtuj.exe
  2⤵
  PID:6860
- C:\Windows\System\yLeJwXC.exe
  C:\Windows\System\yLeJwXC.exe
  2⤵
  PID:6876
- C:\Windows\System\sjGLehP.exe
  C:\Windows\System\sjGLehP.exe
  2⤵
  PID:6904
- C:\Windows\System\TvlMYpQ.exe
  C:\Windows\System\TvlMYpQ.exe
  2⤵
  PID:6920
- C:\Windows\System\WLWqKyw.exe
  C:\Windows\System\WLWqKyw.exe
  2⤵
  PID:6936
- C:\Windows\System\kGeECDB.exe
  C:\Windows\System\kGeECDB.exe
  2⤵
  PID:6964
- C:\Windows\System\lAbdLlr.exe
  C:\Windows\System\lAbdLlr.exe
  2⤵
  PID:6980
- C:\Windows\System\xFGqFfM.exe
  C:\Windows\System\xFGqFfM.exe
  2⤵
  PID:7000
- C:\Windows\System\XwWXKMc.exe
  C:\Windows\System\XwWXKMc.exe
  2⤵
  PID:7020
- C:\Windows\System\hpobRqD.exe
  C:\Windows\System\hpobRqD.exe
  2⤵
  PID:7036
- C:\Windows\System\YFQwJTH.exe
  C:\Windows\System\YFQwJTH.exe
  2⤵
  PID:7064
- C:\Windows\System\dtTWyPl.exe
  C:\Windows\System\dtTWyPl.exe
  2⤵
  PID:7120
- C:\Windows\System\mcnlSon.exe
  C:\Windows\System\mcnlSon.exe
  2⤵
  PID:7156
- C:\Windows\System\CidjYeT.exe
  C:\Windows\System\CidjYeT.exe
  2⤵
  PID:5280
- C:\Windows\System\NbWtEQH.exe
  C:\Windows\System\NbWtEQH.exe
  2⤵
  PID:6256
- C:\Windows\System\rftoHVe.exe
  C:\Windows\System\rftoHVe.exe
  2⤵
  PID:6264
- C:\Windows\System\ExptAUR.exe
  C:\Windows\System\ExptAUR.exe
  2⤵
  PID:6368
- C:\Windows\System\lXbAaMp.exe
  C:\Windows\System\lXbAaMp.exe
  2⤵
  PID:6392
- C:\Windows\System\sTaLZnP.exe
  C:\Windows\System\sTaLZnP.exe
  2⤵
  PID:6472
- C:\Windows\System\jjkudxY.exe
  C:\Windows\System\jjkudxY.exe
  2⤵
  PID:6596
- C:\Windows\System\wYOhfQt.exe
  C:\Windows\System\wYOhfQt.exe
  2⤵
  PID:6660
- C:\Windows\System\RgrFGPo.exe
  C:\Windows\System\RgrFGPo.exe
  2⤵
  PID:5332
- C:\Windows\System\aMXfyDF.exe
  C:\Windows\System\aMXfyDF.exe
  2⤵
  PID:376
- C:\Windows\System\YYSIpQT.exe
  C:\Windows\System\YYSIpQT.exe
  2⤵
  PID:6884
- C:\Windows\System\loYLJMw.exe
  C:\Windows\System\loYLJMw.exe
  2⤵
  PID:6844
- C:\Windows\System\OWsqnZa.exe
  C:\Windows\System\OWsqnZa.exe
  2⤵
  PID:6928
- C:\Windows\System\hXOvbsa.exe
  C:\Windows\System\hXOvbsa.exe
  2⤵
  PID:6944
- C:\Windows\System\wskYhlJ.exe
  C:\Windows\System\wskYhlJ.exe
  2⤵
  PID:7164
- C:\Windows\System\vGbvPbH.exe
  C:\Windows\System\vGbvPbH.exe
  2⤵
  PID:6196
- C:\Windows\System\hiiXTKl.exe
  C:\Windows\System\hiiXTKl.exe
  2⤵
  PID:6384
- C:\Windows\System\fhjjNGu.exe
  C:\Windows\System\fhjjNGu.exe
  2⤵
  PID:6508
- C:\Windows\System\HrwRFLE.exe
  C:\Windows\System\HrwRFLE.exe
  2⤵
  PID:6872
- C:\Windows\System\TRQEkdu.exe
  C:\Windows\System\TRQEkdu.exe
  2⤵
  PID:1208
- C:\Windows\System\ZAKboPv.exe
  C:\Windows\System\ZAKboPv.exe
  2⤵
  PID:7008
- C:\Windows\System\rhMnxSu.exe
  C:\Windows\System\rhMnxSu.exe
  2⤵
  PID:6912
- C:\Windows\System\ZZStIGX.exe
  C:\Windows\System\ZZStIGX.exe
  2⤵
  PID:5312
- C:\Windows\System\jbEVKVQ.exe
  C:\Windows\System\jbEVKVQ.exe
  2⤵
  PID:6772
- C:\Windows\System\Yndhnvc.exe
  C:\Windows\System\Yndhnvc.exe
  2⤵
  PID:6192
- C:\Windows\System\ovxeyFo.exe
  C:\Windows\System\ovxeyFo.exe
  2⤵
  PID:6468
- C:\Windows\System\LYjZJuz.exe
  C:\Windows\System\LYjZJuz.exe
  2⤵
  PID:7212
- C:\Windows\System\gRYhpxC.exe
  C:\Windows\System\gRYhpxC.exe
  2⤵
  PID:7228
- C:\Windows\System\yEfPWgn.exe
  C:\Windows\System\yEfPWgn.exe
  2⤵
  PID:7256
- C:\Windows\System\JsxofPa.exe
  C:\Windows\System\JsxofPa.exe
  2⤵
  PID:7276
- C:\Windows\System\muPrIXs.exe
  C:\Windows\System\muPrIXs.exe
  2⤵
  PID:7292
- C:\Windows\System\BCGxSeg.exe
  C:\Windows\System\BCGxSeg.exe
  2⤵
  PID:7320
- C:\Windows\System\QwMbzVH.exe
  C:\Windows\System\QwMbzVH.exe
  2⤵
  PID:7340
- C:\Windows\System\NlMoqGT.exe
  C:\Windows\System\NlMoqGT.exe
  2⤵
  PID:7380
- C:\Windows\System\ToMlqcp.exe
  C:\Windows\System\ToMlqcp.exe
  2⤵
  PID:7428
- C:\Windows\System\BZQZlFu.exe
  C:\Windows\System\BZQZlFu.exe
  2⤵
  PID:7448
- C:\Windows\System\yKwvQsS.exe
  C:\Windows\System\yKwvQsS.exe
  2⤵
  PID:7472
- C:\Windows\System\qnZjojf.exe
  C:\Windows\System\qnZjojf.exe
  2⤵
  PID:7496
- C:\Windows\System\iXVFrtn.exe
  C:\Windows\System\iXVFrtn.exe
  2⤵
  PID:7532
- C:\Windows\System\DcqXeTS.exe
  C:\Windows\System\DcqXeTS.exe
  2⤵
  PID:7560
- C:\Windows\System\KNBzoGN.exe
  C:\Windows\System\KNBzoGN.exe
  2⤵
  PID:7584
- C:\Windows\System\WYpkrvK.exe
  C:\Windows\System\WYpkrvK.exe
  2⤵
  PID:7604
- C:\Windows\System\etcOmCP.exe
  C:\Windows\System\etcOmCP.exe
  2⤵
  PID:7632
- C:\Windows\System\qOcLCuI.exe
  C:\Windows\System\qOcLCuI.exe
  2⤵
  PID:7648
- C:\Windows\System\XXzBBVS.exe
  C:\Windows\System\XXzBBVS.exe
  2⤵
  PID:7676
- C:\Windows\System\bAnXzLw.exe
  C:\Windows\System\bAnXzLw.exe
  2⤵
  PID:7724
- C:\Windows\System\wgskLkm.exe
  C:\Windows\System\wgskLkm.exe
  2⤵
  PID:7744
- C:\Windows\System\pzxJkEy.exe
  C:\Windows\System\pzxJkEy.exe
  2⤵
  PID:7792
- C:\Windows\System\pOdHBIJ.exe
  C:\Windows\System\pOdHBIJ.exe
  2⤵
  PID:7808
- C:\Windows\System\EamEJgH.exe
  C:\Windows\System\EamEJgH.exe
  2⤵
  PID:7840
- C:\Windows\System\PsxMRwd.exe
  C:\Windows\System\PsxMRwd.exe
  2⤵
  PID:7860
- C:\Windows\System\bXQnxdw.exe
  C:\Windows\System\bXQnxdw.exe
  2⤵
  PID:7880
- C:\Windows\System\FzLpLQX.exe
  C:\Windows\System\FzLpLQX.exe
  2⤵
  PID:7924
- C:\Windows\System\xkKQBGD.exe
  C:\Windows\System\xkKQBGD.exe
  2⤵
  PID:7960
- C:\Windows\System\RFkkxhz.exe
  C:\Windows\System\RFkkxhz.exe
  2⤵
  PID:7984
- C:\Windows\System\rVIEbLh.exe
  C:\Windows\System\rVIEbLh.exe
  2⤵
  PID:8008
- C:\Windows\System\EONUmFZ.exe
  C:\Windows\System\EONUmFZ.exe
  2⤵
  PID:8028
- C:\Windows\System\VDlrZiJ.exe
  C:\Windows\System\VDlrZiJ.exe
  2⤵
  PID:8048
- C:\Windows\System\gsEwMzl.exe
  C:\Windows\System\gsEwMzl.exe
  2⤵
  PID:8116
- C:\Windows\System\rLxqpXC.exe
  C:\Windows\System\rLxqpXC.exe
  2⤵
  PID:8136
- C:\Windows\System\bvKzBmJ.exe
  C:\Windows\System\bvKzBmJ.exe
  2⤵
  PID:8168
- C:\Windows\System\HYfmkqd.exe
  C:\Windows\System\HYfmkqd.exe
  2⤵
  PID:6852
- C:\Windows\System\fRfGLOY.exe
  C:\Windows\System\fRfGLOY.exe
  2⤵
  PID:1228
- C:\Windows\System\Vuyxuxg.exe
  C:\Windows\System\Vuyxuxg.exe
  2⤵
  PID:5248
- C:\Windows\System\kmqmDIt.exe
  C:\Windows\System\kmqmDIt.exe
  2⤵
  PID:5304
- C:\Windows\System\KyvcNvg.exe
  C:\Windows\System\KyvcNvg.exe
  2⤵
  PID:7264
- C:\Windows\System\wjUeInr.exe
  C:\Windows\System\wjUeInr.exe
  2⤵
  PID:7308
- C:\Windows\System\MMJHRrr.exe
  C:\Windows\System\MMJHRrr.exe
  2⤵
  PID:7288
- C:\Windows\System\dzsQvxB.exe
  C:\Windows\System\dzsQvxB.exe
  2⤵
  PID:7388
- C:\Windows\System\pbnlLLL.exe
  C:\Windows\System\pbnlLLL.exe
  2⤵
  PID:7440
- C:\Windows\System\EXLILtt.exe
  C:\Windows\System\EXLILtt.exe
  2⤵
  PID:7600
- C:\Windows\System\KrCQHTi.exe
  C:\Windows\System\KrCQHTi.exe
  2⤵
  PID:8128
- C:\Windows\System\oBJEXGS.exe
  C:\Windows\System\oBJEXGS.exe
  2⤵
  PID:6752
- C:\Windows\System\IOmnxKM.exe
  C:\Windows\System\IOmnxKM.exe
  2⤵
  PID:5252
- C:\Windows\System\IyRTTwj.exe
  C:\Windows\System\IyRTTwj.exe
  2⤵
  PID:7368
- C:\Windows\System\XyZJJzL.exe
  C:\Windows\System\XyZJJzL.exe
  2⤵
  PID:7404
- C:\Windows\System\vORBIMa.exe
  C:\Windows\System\vORBIMa.exe
  2⤵
  PID:7244
- C:\Windows\System\puaPJXw.exe
  C:\Windows\System\puaPJXw.exe
  2⤵
  PID:7596
- C:\Windows\System\mABzlYX.exe
  C:\Windows\System\mABzlYX.exe
  2⤵
  PID:7816
- C:\Windows\System\aviSCEr.exe
  C:\Windows\System\aviSCEr.exe
  2⤵
  PID:7776
- C:\Windows\System\VFZNpgj.exe
  C:\Windows\System\VFZNpgj.exe
  2⤵
  PID:7856
- C:\Windows\System\EqIQcVa.exe
  C:\Windows\System\EqIQcVa.exe
  2⤵
  PID:7848
- C:\Windows\System\ViJiOhe.exe
  C:\Windows\System\ViJiOhe.exe
  2⤵
  PID:7936
- C:\Windows\System\vCVMMjY.exe
  C:\Windows\System\vCVMMjY.exe
  2⤵
  PID:8040
- C:\Windows\System\eGxzGWY.exe
  C:\Windows\System\eGxzGWY.exe
  2⤵
  PID:5288
- C:\Windows\System\ClMxoXz.exe
  C:\Windows\System\ClMxoXz.exe
  2⤵
  PID:8176
- C:\Windows\System\YGxzqDk.exe
  C:\Windows\System\YGxzqDk.exe
  2⤵
  PID:7712
- C:\Windows\System\IoPqsTH.exe
  C:\Windows\System\IoPqsTH.exe
  2⤵
  PID:7656
- C:\Windows\System\UCgTXpV.exe
  C:\Windows\System\UCgTXpV.exe
  2⤵
  PID:7756
- C:\Windows\System\icJkTAi.exe
  C:\Windows\System\icJkTAi.exe
  2⤵
  PID:8004
- C:\Windows\System\daRHwzJ.exe
  C:\Windows\System\daRHwzJ.exe
  2⤵
  PID:7872
- C:\Windows\System\ZNiLzyY.exe
  C:\Windows\System\ZNiLzyY.exe
  2⤵
  PID:7772
- C:\Windows\System\taFWWEb.exe
  C:\Windows\System\taFWWEb.exe
  2⤵
  PID:8200
- C:\Windows\System\tcCKgEP.exe
  C:\Windows\System\tcCKgEP.exe
  2⤵
  PID:8224
- C:\Windows\System\SbTLwYL.exe
  C:\Windows\System\SbTLwYL.exe
  2⤵
  PID:8240
- C:\Windows\System\OOoZqCJ.exe
  C:\Windows\System\OOoZqCJ.exe
  2⤵
  PID:8292
- C:\Windows\System\rUupwMo.exe
  C:\Windows\System\rUupwMo.exe
  2⤵
  PID:8312
- C:\Windows\System\SQitMjy.exe
  C:\Windows\System\SQitMjy.exe
  2⤵
  PID:8360
- C:\Windows\System\ZtaimYt.exe
  C:\Windows\System\ZtaimYt.exe
  2⤵
  PID:8380
- C:\Windows\System\IysYyVF.exe
  C:\Windows\System\IysYyVF.exe
  2⤵
  PID:8408
- C:\Windows\System\nTDPIsy.exe
  C:\Windows\System\nTDPIsy.exe
  2⤵
  PID:8476
- C:\Windows\System\eauiOvU.exe
  C:\Windows\System\eauiOvU.exe
  2⤵
  PID:8520
- C:\Windows\System\fzBtSph.exe
  C:\Windows\System\fzBtSph.exe
  2⤵
  PID:8548
- C:\Windows\System\kWGAPrI.exe
  C:\Windows\System\kWGAPrI.exe
  2⤵
  PID:8564
- C:\Windows\System\AIeMJVH.exe
  C:\Windows\System\AIeMJVH.exe
  2⤵
  PID:8580
- C:\Windows\System\NPLowBp.exe
  C:\Windows\System\NPLowBp.exe
  2⤵
  PID:8596
- C:\Windows\System\tdLCARw.exe
  C:\Windows\System\tdLCARw.exe
  2⤵
  PID:8616
- C:\Windows\System\AFXkQLG.exe
  C:\Windows\System\AFXkQLG.exe
  2⤵
  PID:8632
- C:\Windows\System\lMlRwFX.exe
  C:\Windows\System\lMlRwFX.exe
  2⤵
  PID:8648
- C:\Windows\System\IsFzUMC.exe
  C:\Windows\System\IsFzUMC.exe
  2⤵
  PID:8664
- C:\Windows\System\FZcDWdA.exe
  C:\Windows\System\FZcDWdA.exe
  2⤵
  PID:8680
- C:\Windows\System\irLVmkB.exe
  C:\Windows\System\irLVmkB.exe
  2⤵
  PID:8696
- C:\Windows\System\ayGoNrl.exe
  C:\Windows\System\ayGoNrl.exe
  2⤵
  PID:8712
- C:\Windows\System\cbzvJgv.exe
  C:\Windows\System\cbzvJgv.exe
  2⤵
  PID:8728
- C:\Windows\System\iYkowox.exe
  C:\Windows\System\iYkowox.exe
  2⤵
  PID:8744
- C:\Windows\System\TDlRdHu.exe
  C:\Windows\System\TDlRdHu.exe
  2⤵
  PID:8760
- C:\Windows\System\gikqwus.exe
  C:\Windows\System\gikqwus.exe
  2⤵
  PID:8776
- C:\Windows\System\bLGPVfm.exe
  C:\Windows\System\bLGPVfm.exe
  2⤵
  PID:8792
- C:\Windows\System\sulInXt.exe
  C:\Windows\System\sulInXt.exe
  2⤵
  PID:8808
- C:\Windows\System\XGcAhCx.exe
  C:\Windows\System\XGcAhCx.exe
  2⤵
  PID:8940
- C:\Windows\System\ToDqabw.exe
  C:\Windows\System\ToDqabw.exe
  2⤵
  PID:9036
- C:\Windows\System\NDDWFUH.exe
  C:\Windows\System\NDDWFUH.exe
  2⤵
  PID:9052
- C:\Windows\System\mpOAfAr.exe
  C:\Windows\System\mpOAfAr.exe
  2⤵
  PID:9080
- C:\Windows\System\hHkUpee.exe
  C:\Windows\System\hHkUpee.exe
  2⤵
  PID:9100
- C:\Windows\System\SAlESCT.exe
  C:\Windows\System\SAlESCT.exe
  2⤵
  PID:9128
- C:\Windows\System\XlJDStw.exe
  C:\Windows\System\XlJDStw.exe
  2⤵
  PID:9144
- C:\Windows\System\JIleGaz.exe
  C:\Windows\System\JIleGaz.exe
  2⤵
  PID:8196
- C:\Windows\System\EfzSlQN.exe
  C:\Windows\System\EfzSlQN.exe
  2⤵
  PID:8216
- C:\Windows\System\Ujqwmmk.exe
  C:\Windows\System\Ujqwmmk.exe
  2⤵
  PID:8404
- C:\Windows\System\UMuvgtF.exe
  C:\Windows\System\UMuvgtF.exe
  2⤵
  PID:8560
- C:\Windows\System\vRHPGoJ.exe
  C:\Windows\System\vRHPGoJ.exe
  2⤵
  PID:8852
- C:\Windows\System\ascUSSK.exe
  C:\Windows\System\ascUSSK.exe
  2⤵
  PID:8432
- C:\Windows\System\YGyUfHs.exe
  C:\Windows\System\YGyUfHs.exe
  2⤵
  PID:8784
- C:\Windows\System\sUsihuB.exe
  C:\Windows\System\sUsihuB.exe
  2⤵
  PID:8948
- C:\Windows\System\OvHOTad.exe
  C:\Windows\System\OvHOTad.exe
  2⤵
  PID:8836
- C:\Windows\System\byjrNPJ.exe
  C:\Windows\System\byjrNPJ.exe
  2⤵
  PID:8872
- C:\Windows\System\dzWGggB.exe
  C:\Windows\System\dzWGggB.exe
  2⤵
  PID:8640
- C:\Windows\System\ePTzxXf.exe
  C:\Windows\System\ePTzxXf.exe
  2⤵
  PID:9000
- C:\Windows\System\HFzlNHJ.exe
  C:\Windows\System\HFzlNHJ.exe
  2⤵
  PID:9020
- C:\Windows\System\amGVFir.exe
  C:\Windows\System\amGVFir.exe
  2⤵
  PID:9164
- C:\Windows\System\BrPfTER.exe
  C:\Windows\System\BrPfTER.exe
  2⤵
  PID:9096
- C:\Windows\System\PSyzceQ.exe
  C:\Windows\System\PSyzceQ.exe
  2⤵
  PID:9112
- C:\Windows\System\YzbuiId.exe
  C:\Windows\System\YzbuiId.exe
  2⤵
  PID:8232
- C:\Windows\System\JRnGjwi.exe
  C:\Windows\System\JRnGjwi.exe
  2⤵
  PID:9184
- C:\Windows\System\nmPVgVm.exe
  C:\Windows\System\nmPVgVm.exe
  2⤵
  PID:8468
- C:\Windows\System\grOtsWQ.exe
  C:\Windows\System\grOtsWQ.exe
  2⤵
  PID:8488
- C:\Windows\System\VzeRYbd.exe
  C:\Windows\System\VzeRYbd.exe
  2⤵
  PID:8804
- C:\Windows\System\ORwnoZz.exe
  C:\Windows\System\ORwnoZz.exe
  2⤵
  PID:8856
- C:\Windows\System\gnxMmPo.exe
  C:\Windows\System\gnxMmPo.exe
  2⤵
  PID:8752
- C:\Windows\System\wfMpzoS.exe
  C:\Windows\System\wfMpzoS.exe
  2⤵
  PID:8980
- C:\Windows\System\vbmaFRf.exe
  C:\Windows\System\vbmaFRf.exe
  2⤵
  PID:9192
- C:\Windows\System\wyDjTfk.exe
  C:\Windows\System\wyDjTfk.exe
  2⤵
  PID:8820
- C:\Windows\System\JnieXDU.exe
  C:\Windows\System\JnieXDU.exe
  2⤵
  PID:8840
- C:\Windows\System\weGvvSD.exe
  C:\Windows\System\weGvvSD.exe
  2⤵
  PID:8484
- C:\Windows\System\WJLdbXP.exe
  C:\Windows\System\WJLdbXP.exe
  2⤵
  PID:9224
- C:\Windows\System\IySshXS.exe
  C:\Windows\System\IySshXS.exe
  2⤵
  PID:9244
- C:\Windows\System\jbVxtdx.exe
  C:\Windows\System\jbVxtdx.exe
  2⤵
  PID:9264
- C:\Windows\System\nVtGAVt.exe
  C:\Windows\System\nVtGAVt.exe
  2⤵
  PID:9284
- C:\Windows\System\jMfnqDN.exe
  C:\Windows\System\jMfnqDN.exe
  2⤵
  PID:9312
- C:\Windows\System\TprmQAk.exe
  C:\Windows\System\TprmQAk.exe
  2⤵
  PID:9344
- C:\Windows\System\sGoCsMF.exe
  C:\Windows\System\sGoCsMF.exe
  2⤵
  PID:9368
- C:\Windows\System\gmFWYZA.exe
  C:\Windows\System\gmFWYZA.exe
  2⤵
  PID:9388
- C:\Windows\System\hzaidga.exe
  C:\Windows\System\hzaidga.exe
  2⤵
  PID:9448
- C:\Windows\System\hRbLjrc.exe
  C:\Windows\System\hRbLjrc.exe
  2⤵
  PID:9468
- C:\Windows\System\sELPnCt.exe
  C:\Windows\System\sELPnCt.exe
  2⤵
  PID:9488
- C:\Windows\System\oyDEAqy.exe
  C:\Windows\System\oyDEAqy.exe
  2⤵
  PID:9572
- C:\Windows\System\hLtSLzr.exe
  C:\Windows\System\hLtSLzr.exe
  2⤵
  PID:9592
- C:\Windows\System\aJUCaYu.exe
  C:\Windows\System\aJUCaYu.exe
  2⤵
  PID:9616
- C:\Windows\System\sxTLqsb.exe
  C:\Windows\System\sxTLqsb.exe
  2⤵
  PID:9636
- C:\Windows\System\BCjQwAC.exe
  C:\Windows\System\BCjQwAC.exe
  2⤵
  PID:9660
- C:\Windows\System\inNxKQW.exe
  C:\Windows\System\inNxKQW.exe
  2⤵
  PID:9680
- C:\Windows\System\ZSuIyYg.exe
  C:\Windows\System\ZSuIyYg.exe
  2⤵
  PID:9700
- C:\Windows\System\jQMPMqA.exe
  C:\Windows\System\jQMPMqA.exe
  2⤵
  PID:9732
- C:\Windows\System\gVqeMFU.exe
  C:\Windows\System\gVqeMFU.exe
  2⤵
  PID:9768
- C:\Windows\System\ZGwGmdp.exe
  C:\Windows\System\ZGwGmdp.exe
  2⤵
  PID:9796
- C:\Windows\System\TuHZCKU.exe
  C:\Windows\System\TuHZCKU.exe
  2⤵
  PID:9844
- C:\Windows\System\Avpcayv.exe
  C:\Windows\System\Avpcayv.exe
  2⤵
  PID:9864
- C:\Windows\System\VbRDqFT.exe
  C:\Windows\System\VbRDqFT.exe
  2⤵
  PID:9888
- C:\Windows\System\PmCiQvC.exe
  C:\Windows\System\PmCiQvC.exe
  2⤵
  PID:9908
- C:\Windows\System\MRMVRpN.exe
  C:\Windows\System\MRMVRpN.exe
  2⤵
  PID:9928
- C:\Windows\System\wFjvYSw.exe
  C:\Windows\System\wFjvYSw.exe
  2⤵
  PID:9948
- C:\Windows\System\wYVcIjp.exe
  C:\Windows\System\wYVcIjp.exe
  2⤵
  PID:9980
- C:\Windows\System\zyupwme.exe
  C:\Windows\System\zyupwme.exe
  2⤵
  PID:10032
- C:\Windows\System\HbtYiuk.exe
  C:\Windows\System\HbtYiuk.exe
  2⤵
  PID:10048
- C:\Windows\System\EbNruIb.exe
  C:\Windows\System\EbNruIb.exe
  2⤵
  PID:10092
- C:\Windows\System\gibVfYL.exe
  C:\Windows\System\gibVfYL.exe
  2⤵
  PID:10128
- C:\Windows\System\CLbrmUG.exe
  C:\Windows\System\CLbrmUG.exe
  2⤵
  PID:10164
- C:\Windows\System\NhbERJr.exe
  C:\Windows\System\NhbERJr.exe
  2⤵
  PID:10188
- C:\Windows\System\RFBtKpX.exe
  C:\Windows\System\RFBtKpX.exe
  2⤵
  PID:10208
- C:\Windows\System\ugmqVEV.exe
  C:\Windows\System\ugmqVEV.exe
  2⤵
  PID:10224
- C:\Windows\System\PPUfzUV.exe
  C:\Windows\System\PPUfzUV.exe
  2⤵
  PID:8440
- C:\Windows\System\rAtHGFo.exe
  C:\Windows\System\rAtHGFo.exe
  2⤵
  PID:9252
- C:\Windows\System\SqRMATc.exe
  C:\Windows\System\SqRMATc.exe
  2⤵
  PID:8444
- C:\Windows\System\GZxXFUc.exe
  C:\Windows\System\GZxXFUc.exe
  2⤵
  PID:9292
- C:\Windows\System\nYZvXyV.exe
  C:\Windows\System\nYZvXyV.exe
  2⤵
  PID:9408
- C:\Windows\System\mSrYkVD.exe
  C:\Windows\System\mSrYkVD.exe
  2⤵
  PID:9428
- C:\Windows\System\gFUwVQX.exe
  C:\Windows\System\gFUwVQX.exe
  2⤵
  PID:9544
- C:\Windows\System\lbLhrGj.exe
  C:\Windows\System\lbLhrGj.exe
  2⤵
  PID:9624
- C:\Windows\System\gDTZlpg.exe
  C:\Windows\System\gDTZlpg.exe
  2⤵
  PID:9668
- C:\Windows\System\kQRXiNk.exe
  C:\Windows\System\kQRXiNk.exe
  2⤵
  PID:9696
- C:\Windows\System\craDtHW.exe
  C:\Windows\System\craDtHW.exe
  2⤵
  PID:9820
- C:\Windows\System\YsNzElc.exe
  C:\Windows\System\YsNzElc.exe
  2⤵
  PID:9860
- C:\Windows\System\LlRpnOL.exe
  C:\Windows\System\LlRpnOL.exe
  2⤵
  PID:9920
- C:\Windows\System\YoSsRph.exe
  C:\Windows\System\YoSsRph.exe
  2⤵
  PID:10012
- C:\Windows\System\TnSzJeY.exe
  C:\Windows\System\TnSzJeY.exe
  2⤵
  PID:10124
- C:\Windows\System\TYhZqgx.exe
  C:\Windows\System\TYhZqgx.exe
  2⤵
  PID:10148
- C:\Windows\System\GuPyGfN.exe
  C:\Windows\System\GuPyGfN.exe
  2⤵
  PID:10236
- C:\Windows\System\gONGSwM.exe
  C:\Windows\System\gONGSwM.exe
  2⤵
  PID:9276
- C:\Windows\System\SIQsrmX.exe
  C:\Windows\System\SIQsrmX.exe
  2⤵
  PID:9364
- C:\Windows\System\xEBzThV.exe
  C:\Windows\System\xEBzThV.exe
  2⤵
  PID:3552
- C:\Windows\System\UKyPJIx.exe
  C:\Windows\System\UKyPJIx.exe
  2⤵
  PID:9788
- C:\Windows\System\qCbQMjW.exe
  C:\Windows\System\qCbQMjW.exe
  2⤵
  PID:10216
- C:\Windows\System\lsGGkCb.exe
  C:\Windows\System\lsGGkCb.exe
  2⤵
  PID:9416
- C:\Windows\System\IKiErcS.exe
  C:\Windows\System\IKiErcS.exe
  2⤵
  PID:8260
- C:\Windows\System\GPBlTKS.exe
  C:\Windows\System\GPBlTKS.exe
  2⤵
  PID:9560
- C:\Windows\System\VLhFJoN.exe
  C:\Windows\System\VLhFJoN.exe
  2⤵
  PID:9856
- C:\Windows\System\xZzlXck.exe
  C:\Windows\System\xZzlXck.exe
  2⤵
  PID:10100
- C:\Windows\System\SutnwoT.exe
  C:\Windows\System\SutnwoT.exe
  2⤵
  PID:10244
- C:\Windows\System\xebxPDD.exe
  C:\Windows\System\xebxPDD.exe
  2⤵
  PID:10264
- C:\Windows\System\Fdeznji.exe
  C:\Windows\System\Fdeznji.exe
  2⤵
  PID:10296
- C:\Windows\System\iQFYaYT.exe
  C:\Windows\System\iQFYaYT.exe
  2⤵
  PID:10340
- C:\Windows\System\mlsYdho.exe
  C:\Windows\System\mlsYdho.exe
  2⤵
  PID:10364
- C:\Windows\System\TBkQCgf.exe
  C:\Windows\System\TBkQCgf.exe
  2⤵
  PID:10384
- C:\Windows\System\tAokTPX.exe
  C:\Windows\System\tAokTPX.exe
  2⤵
  PID:10408
- C:\Windows\System\DaZtBjA.exe
  C:\Windows\System\DaZtBjA.exe
  2⤵
  PID:10428
- C:\Windows\System\JzVYatp.exe
  C:\Windows\System\JzVYatp.exe
  2⤵
  PID:10496
- C:\Windows\System\eDidQLk.exe
  C:\Windows\System\eDidQLk.exe
  2⤵
  PID:10536
- C:\Windows\System\AKQAwKl.exe
  C:\Windows\System\AKQAwKl.exe
  2⤵
  PID:10552
- C:\Windows\System\qRNowBf.exe
  C:\Windows\System\qRNowBf.exe
  2⤵
  PID:10572
- C:\Windows\System\YciRbhR.exe
  C:\Windows\System\YciRbhR.exe
  2⤵
  PID:10608
- C:\Windows\System\jGSgODv.exe
  C:\Windows\System\jGSgODv.exe
  2⤵
  PID:10628
- C:\Windows\System\nzrwEye.exe
  C:\Windows\System\nzrwEye.exe
  2⤵
  PID:10644
- C:\Windows\System\qgTSbis.exe
  C:\Windows\System\qgTSbis.exe
  2⤵
  PID:10668
- C:\Windows\System\BpbFKGP.exe
  C:\Windows\System\BpbFKGP.exe
  2⤵
  PID:10688
- C:\Windows\System\RTfDcHB.exe
  C:\Windows\System\RTfDcHB.exe
  2⤵
  PID:10748
- C:\Windows\System\jsXmwwg.exe
  C:\Windows\System\jsXmwwg.exe
  2⤵
  PID:10768
- C:\Windows\System\FAzMGQg.exe
  C:\Windows\System\FAzMGQg.exe
  2⤵
  PID:10792
- C:\Windows\System\dwvfZdb.exe
  C:\Windows\System\dwvfZdb.exe
  2⤵
  PID:10808
- C:\Windows\System\tPqHNKp.exe
  C:\Windows\System\tPqHNKp.exe
  2⤵
  PID:10828
- C:\Windows\System\oAjuAWm.exe
  C:\Windows\System\oAjuAWm.exe
  2⤵
  PID:10876
- C:\Windows\System\pKbazdK.exe
  C:\Windows\System\pKbazdK.exe
  2⤵
  PID:10908
- C:\Windows\System\JEIzSou.exe
  C:\Windows\System\JEIzSou.exe
  2⤵
  PID:10936
- C:\Windows\System\LtkUHul.exe
  C:\Windows\System\LtkUHul.exe
  2⤵
  PID:10964
- C:\Windows\System\UAnIdSC.exe
  C:\Windows\System\UAnIdSC.exe
  2⤵
  PID:11000
- C:\Windows\System\MXzttzn.exe
  C:\Windows\System\MXzttzn.exe
  2⤵
  PID:11024
- C:\Windows\System\Danhbjx.exe
  C:\Windows\System\Danhbjx.exe
  2⤵
  PID:11044
- C:\Windows\System\mXhHvfz.exe
  C:\Windows\System\mXhHvfz.exe
  2⤵
  PID:11068
- C:\Windows\System\MwzMNMP.exe
  C:\Windows\System\MwzMNMP.exe
  2⤵
  PID:11088
- C:\Windows\System\GstvKpT.exe
  C:\Windows\System\GstvKpT.exe
  2⤵
  PID:11124
- C:\Windows\System\osEpceT.exe
  C:\Windows\System\osEpceT.exe
  2⤵
  PID:11160
- C:\Windows\System\jrrEtom.exe
  C:\Windows\System\jrrEtom.exe
  2⤵
  PID:11180
- C:\Windows\System\gNczFPx.exe
  C:\Windows\System\gNczFPx.exe
  2⤵
  PID:11204
- C:\Windows\System\UyePclf.exe
  C:\Windows\System\UyePclf.exe
  2⤵
  PID:11224
- C:\Windows\System\bQqUIyX.exe
  C:\Windows\System\bQqUIyX.exe
  2⤵
  PID:11240
- C:\Windows\System\xOsQXDy.exe
  C:\Windows\System\xOsQXDy.exe
  2⤵
  PID:9260
- C:\Windows\System\TJoVlXu.exe
  C:\Windows\System\TJoVlXu.exe
  2⤵
  PID:9384
- C:\Windows\System\nGHPjEh.exe
  C:\Windows\System\nGHPjEh.exe
  2⤵
  PID:10260
- C:\Windows\System\vfirQID.exe
  C:\Windows\System\vfirQID.exe
  2⤵
  PID:10348
- C:\Windows\System\WtjFJfe.exe
  C:\Windows\System\WtjFJfe.exe
  2⤵
  PID:10420
- C:\Windows\System\oWoyJPA.exe
  C:\Windows\System\oWoyJPA.exe
  2⤵
  PID:10488
- C:\Windows\System\PrhWBSt.exe
  C:\Windows\System\PrhWBSt.exe
  2⤵
  PID:10520
- C:\Windows\System\cQaHyJD.exe
  C:\Windows\System\cQaHyJD.exe
  2⤵
  PID:10564
- C:\Windows\System\GSFZNlC.exe
  C:\Windows\System\GSFZNlC.exe
  2⤵
  PID:10640
- C:\Windows\System\OdUkoYr.exe
  C:\Windows\System\OdUkoYr.exe
  2⤵
  PID:10676
- C:\Windows\System\aEpzShH.exe
  C:\Windows\System\aEpzShH.exe
  2⤵
  PID:10840
- C:\Windows\System\mVwdNVo.exe
  C:\Windows\System\mVwdNVo.exe
  2⤵
  PID:4476
- C:\Windows\System\FHSkJRL.exe
  C:\Windows\System\FHSkJRL.exe
  2⤵
  PID:11040
- C:\Windows\System\ovNBxfv.exe
  C:\Windows\System\ovNBxfv.exe
  2⤵
  PID:11008
- C:\Windows\System\NTTTYVh.exe
  C:\Windows\System\NTTTYVh.exe
  2⤵
  PID:11104
- C:\Windows\System\BMrZpDH.exe
  C:\Windows\System\BMrZpDH.exe
  2⤵
  PID:10288
- C:\Windows\System\hUfjknt.exe
  C:\Windows\System\hUfjknt.exe
  2⤵
  PID:11256
- C:\Windows\System\rqcfkHR.exe
  C:\Windows\System\rqcfkHR.exe
  2⤵
  PID:11220
- C:\Windows\System\IgQRKHs.exe
  C:\Windows\System\IgQRKHs.exe
  2⤵
  PID:10728
- C:\Windows\System\WMlqoYa.exe
  C:\Windows\System\WMlqoYa.exe
  2⤵
  PID:10764
- C:\Windows\System\caREHtq.exe
  C:\Windows\System\caREHtq.exe
  2⤵
  PID:10856
- C:\Windows\System\RcmMlUH.exe
  C:\Windows\System\RcmMlUH.exe
  2⤵
  PID:11056
- C:\Windows\System\TgwQFWC.exe
  C:\Windows\System\TgwQFWC.exe
  2⤵
  PID:11172
- C:\Windows\System\RXAOisb.exe
  C:\Windows\System\RXAOisb.exe
  2⤵
  PID:10472
- C:\Windows\System\JkEBTDY.exe
  C:\Windows\System\JkEBTDY.exe
  2⤵
  PID:10864
- C:\Windows\System\pEPcxLJ.exe
  C:\Windows\System\pEPcxLJ.exe
  2⤵
  PID:10256
- C:\Windows\System\jxfmbFV.exe
  C:\Windows\System\jxfmbFV.exe
  2⤵
  PID:10304
- C:\Windows\System\wnIQHJm.exe
  C:\Windows\System\wnIQHJm.exe
  2⤵
  PID:11076
- C:\Windows\System\GZLQCmo.exe
  C:\Windows\System\GZLQCmo.exe
  2⤵
  PID:11280
- C:\Windows\System\dOhGlru.exe
  C:\Windows\System\dOhGlru.exe
  2⤵
  PID:11312
- C:\Windows\System\BYToEpN.exe
  C:\Windows\System\BYToEpN.exe
  2⤵
  PID:11328
- C:\Windows\System\URhpyBw.exe
  C:\Windows\System\URhpyBw.exe
  2⤵
  PID:11344
- C:\Windows\System\vxXGhuT.exe
  C:\Windows\System\vxXGhuT.exe
  2⤵
  PID:11376
- C:\Windows\System\eytStcV.exe
  C:\Windows\System\eytStcV.exe
  2⤵
  PID:11428
- C:\Windows\System\FrYgOtL.exe
  C:\Windows\System\FrYgOtL.exe
  2⤵
  PID:11448
- C:\Windows\System\DcijvuK.exe
  C:\Windows\System\DcijvuK.exe
  2⤵
  PID:11484
- C:\Windows\System\ulgOkhv.exe
  C:\Windows\System\ulgOkhv.exe
  2⤵
  PID:11504
- C:\Windows\System\hBNwKgc.exe
  C:\Windows\System\hBNwKgc.exe
  2⤵
  PID:11536
- C:\Windows\System\kNENLKw.exe
  C:\Windows\System\kNENLKw.exe
  2⤵
  PID:11556
- C:\Windows\System\arEcNYZ.exe
  C:\Windows\System\arEcNYZ.exe
  2⤵
  PID:11572
- C:\Windows\System\ayVKjUn.exe
  C:\Windows\System\ayVKjUn.exe
  2⤵
  PID:11616
- C:\Windows\System\FcenXrO.exe
  C:\Windows\System\FcenXrO.exe
  2⤵
  PID:11644
- C:\Windows\System\TMuWgID.exe
  C:\Windows\System\TMuWgID.exe
  2⤵
  PID:11660
- C:\Windows\System\VnxaRAL.exe
  C:\Windows\System\VnxaRAL.exe
  2⤵
  PID:11704
- C:\Windows\System\HIfEiGl.exe
  C:\Windows\System\HIfEiGl.exe
  2⤵
  PID:11728
- C:\Windows\System\kQEbywR.exe
  C:\Windows\System\kQEbywR.exe
  2⤵
  PID:11752
- C:\Windows\System\fPFzqEj.exe
  C:\Windows\System\fPFzqEj.exe
  2⤵
  PID:11808
- C:\Windows\System\QAaTGFk.exe
  C:\Windows\System\QAaTGFk.exe
  2⤵
  PID:11840
- C:\Windows\System\BLZfOpp.exe
  C:\Windows\System\BLZfOpp.exe
  2⤵
  PID:11860
- C:\Windows\System\SPVXZTG.exe
  C:\Windows\System\SPVXZTG.exe
  2⤵
  PID:11876
- C:\Windows\System\wzNvQsW.exe
  C:\Windows\System\wzNvQsW.exe
  2⤵
  PID:11896
- C:\Windows\System\WIZUEZZ.exe
  C:\Windows\System\WIZUEZZ.exe
  2⤵
  PID:11920
- C:\Windows\System\MOEcbhk.exe
  C:\Windows\System\MOEcbhk.exe
  2⤵
  PID:11940
- C:\Windows\System\GdkZSrz.exe
  C:\Windows\System\GdkZSrz.exe
  2⤵
  PID:11988
- C:\Windows\System\vCEAMXl.exe
  C:\Windows\System\vCEAMXl.exe
  2⤵
  PID:12008
- C:\Windows\System\oacUrzG.exe
  C:\Windows\System\oacUrzG.exe
  2⤵
  PID:12028
- C:\Windows\System\FylJYWO.exe
  C:\Windows\System\FylJYWO.exe
  2⤵
  PID:12060
- C:\Windows\System\pZqpmMI.exe
  C:\Windows\System\pZqpmMI.exe
  2⤵
  PID:12080
- C:\Windows\System\fPJxams.exe
  C:\Windows\System\fPJxams.exe
  2⤵
  PID:12100
- C:\Windows\System\wqiOylW.exe
  C:\Windows\System\wqiOylW.exe
  2⤵
  PID:12176
- C:\Windows\System\noiERvs.exe
  C:\Windows\System\noiERvs.exe
  2⤵
  PID:12196
- C:\Windows\System\sKMkCRN.exe
  C:\Windows\System\sKMkCRN.exe
  2⤵
  PID:12224
- C:\Windows\System\nLYJoeB.exe
  C:\Windows\System\nLYJoeB.exe
  2⤵
  PID:12240
- C:\Windows\System\iSyQiAR.exe
  C:\Windows\System\iSyQiAR.exe
  2⤵
  PID:12268
- C:\Windows\System\gUdKUhe.exe
  C:\Windows\System\gUdKUhe.exe
  2⤵
  PID:10820
- C:\Windows\System\aVcENOU.exe
  C:\Windows\System\aVcENOU.exe
  2⤵
  PID:11304
- C:\Windows\System\RlMsGkD.exe
  C:\Windows\System\RlMsGkD.exe
  2⤵
  PID:11424
- C:\Windows\System\xPIIuKZ.exe
  C:\Windows\System\xPIIuKZ.exe
  2⤵
  PID:11476
- C:\Windows\System\LPrtirE.exe
  C:\Windows\System\LPrtirE.exe
  2⤵
  PID:11524
- C:\Windows\System\MXMfChP.exe
  C:\Windows\System\MXMfChP.exe
  2⤵
  PID:11592
- C:\Windows\System\rBmPHhy.exe
  C:\Windows\System\rBmPHhy.exe
  2⤵
  PID:11600
- C:\Windows\System\WKAMoPA.exe
  C:\Windows\System\WKAMoPA.exe
  2⤵
  PID:11736
- C:\Windows\System\xRsJQDT.exe
  C:\Windows\System\xRsJQDT.exe
  2⤵
  PID:11744
- C:\Windows\System\UDxRMFc.exe
  C:\Windows\System\UDxRMFc.exe
  2⤵
  PID:11784
- C:\Windows\System\xzMhzCy.exe
  C:\Windows\System\xzMhzCy.exe
  2⤵
  PID:11912
- C:\Windows\System\wFBOMLc.exe
  C:\Windows\System\wFBOMLc.exe
  2⤵
  PID:11932
- C:\Windows\System\GDimnPH.exe
  C:\Windows\System\GDimnPH.exe
  2⤵
  PID:12088
- C:\Windows\System\tsflGIr.exe
  C:\Windows\System\tsflGIr.exe
  2⤵
  PID:12144
- C:\Windows\System\fyoMBWB.exe
  C:\Windows\System\fyoMBWB.exe
  2⤵
  PID:12168
- C:\Windows\System\CBUQckC.exe
  C:\Windows\System\CBUQckC.exe
  2⤵
  PID:336
- C:\Windows\System\DOoIQcE.exe
  C:\Windows\System\DOoIQcE.exe
  2⤵
  PID:12216
- C:\Windows\System\nWtZDzZ.exe
  C:\Windows\System\nWtZDzZ.exe
  2⤵
  PID:12256
- C:\Windows\System\sZLeVjT.exe
  C:\Windows\System\sZLeVjT.exe
  2⤵
  PID:11372
- C:\Windows\System\PYKtXSK.exe
  C:\Windows\System\PYKtXSK.exe
  2⤵
  PID:11500
- C:\Windows\System\vAPHghA.exe
  C:\Windows\System\vAPHghA.exe
  2⤵
  PID:11960
- C:\Windows\System\GbvvtRl.exe
  C:\Windows\System\GbvvtRl.exe
  2⤵
  PID:12120
- C:\Windows\System\dwADzEM.exe
  C:\Windows\System\dwADzEM.exe
  2⤵
  PID:11292
- C:\Windows\System\ducWOsx.exe
  C:\Windows\System\ducWOsx.exe
  2⤵
  PID:12072
- C:\Windows\System\IjYWBnt.exe
  C:\Windows\System\IjYWBnt.exe
  2⤵
  PID:11676
- C:\Windows\System\WcvgPIY.exe
  C:\Windows\System\WcvgPIY.exe
  2⤵
  PID:11552
- C:\Windows\System\PqaSDhX.exe
  C:\Windows\System\PqaSDhX.exe
  2⤵
  PID:12076
- C:\Windows\System\qbElZzN.exe
  C:\Windows\System\qbElZzN.exe
  2⤵
  PID:12136
- C:\Windows\System\lZFltqu.exe
  C:\Windows\System\lZFltqu.exe
  2⤵
  PID:12312
- C:\Windows\System\uQWSrLQ.exe
  C:\Windows\System\uQWSrLQ.exe
  2⤵
  PID:12336
- C:\Windows\System\cVqdNUV.exe
  C:\Windows\System\cVqdNUV.exe
  2⤵
  PID:12368
- C:\Windows\System\YgixyVm.exe
  C:\Windows\System\YgixyVm.exe
  2⤵
  PID:12408
- C:\Windows\System\oBHcdWz.exe
  C:\Windows\System\oBHcdWz.exe
  2⤵
  PID:12428
- C:\Windows\System\jEMlpOO.exe
  C:\Windows\System\jEMlpOO.exe
  2⤵
  PID:12460
- C:\Windows\System\IyDYjnY.exe
  C:\Windows\System\IyDYjnY.exe
  2⤵
  PID:12480
- C:\Windows\System\xBciRZJ.exe
  C:\Windows\System\xBciRZJ.exe
  2⤵
  PID:12504
- C:\Windows\System\ZsmSgAf.exe
  C:\Windows\System\ZsmSgAf.exe
  2⤵
  PID:12532
- C:\Windows\System\tdVGXWT.exe
  C:\Windows\System\tdVGXWT.exe
  2⤵
  PID:12600
- C:\Windows\System\epTcIwx.exe
  C:\Windows\System\epTcIwx.exe
  2⤵
  PID:12620
- C:\Windows\System\DYWmYyy.exe
  C:\Windows\System\DYWmYyy.exe
  2⤵
  PID:12640
- C:\Windows\System\YUQAvHe.exe
  C:\Windows\System\YUQAvHe.exe
  2⤵
  PID:12668
- C:\Windows\System\npTnscw.exe
  C:\Windows\System\npTnscw.exe
  2⤵
  PID:12696
- C:\Windows\System\VegqqRO.exe
  C:\Windows\System\VegqqRO.exe
  2⤵
  PID:12728
- C:\Windows\System\SpspzVy.exe
  C:\Windows\System\SpspzVy.exe
  2⤵
  PID:12776
- C:\Windows\System\bKPndwS.exe
  C:\Windows\System\bKPndwS.exe
  2⤵
  PID:12816
- C:\Windows\System\XWzawff.exe
  C:\Windows\System\XWzawff.exe
  2⤵
  PID:12836
- C:\Windows\System\ZGTaZih.exe
  C:\Windows\System\ZGTaZih.exe
  2⤵
  PID:12860
- C:\Windows\System\OqRJvFh.exe
  C:\Windows\System\OqRJvFh.exe
  2⤵
  PID:12876
- C:\Windows\System\SnZxplD.exe
  C:\Windows\System\SnZxplD.exe
  2⤵
  PID:12908
- C:\Windows\System\zUoJnWC.exe
  C:\Windows\System\zUoJnWC.exe
  2⤵
  PID:12936
- C:\Windows\System\vnazivu.exe
  C:\Windows\System\vnazivu.exe
  2⤵
  PID:12996
- C:\Windows\System\zzkVrit.exe
  C:\Windows\System\zzkVrit.exe
  2⤵
  PID:13028
- C:\Windows\System\nrypaYK.exe
  C:\Windows\System\nrypaYK.exe
  2⤵
  PID:13016
- C:\Windows\System\ZIRUdeo.exe
  C:\Windows\System\ZIRUdeo.exe
  2⤵
  PID:12476
- C:\Windows\System\yezSHJz.exe
  C:\Windows\System\yezSHJz.exe
  2⤵
  PID:12528
- C:\Windows\System\emEWWFe.exe
  C:\Windows\System\emEWWFe.exe
  2⤵
  PID:12564
- C:\Windows\System\bmxAkfE.exe
  C:\Windows\System\bmxAkfE.exe
  2⤵
  PID:12704
- C:\Windows\System\EOtasmu.exe
  C:\Windows\System\EOtasmu.exe
  2⤵
  PID:11832
- C:\Windows\System\AZIKAcF.exe
  C:\Windows\System\AZIKAcF.exe
  2⤵
  PID:11976
- C:\Windows\System\iYvMwzS.exe
  C:\Windows\System\iYvMwzS.exe
  2⤵
  PID:12348
- C:\Windows\System\SxnoeqN.exe
  C:\Windows\System\SxnoeqN.exe
  2⤵
  PID:11408
- C:\Windows\System\hudLVFB.exe
  C:\Windows\System\hudLVFB.exe
  2⤵
  PID:12392
- C:\Windows\System\IOjdKbv.exe
  C:\Windows\System\IOjdKbv.exe
  2⤵
  PID:12388
- C:\Windows\System\wVPSNyg.exe
  C:\Windows\System\wVPSNyg.exe
  2⤵
  PID:12496
- C:\Windows\System\imkPdxL.exe
  C:\Windows\System\imkPdxL.exe
  2⤵
  PID:12488
- C:\Windows\System\qcOcETI.exe
  C:\Windows\System\qcOcETI.exe
  2⤵
  PID:12612
- C:\Windows\System\sPabhWQ.exe
  C:\Windows\System\sPabhWQ.exe
  2⤵
  PID:12660
- C:\Windows\System\QUJqLom.exe
  C:\Windows\System\QUJqLom.exe
  2⤵
  PID:12724
- C:\Windows\System\BJJEOYK.exe
  C:\Windows\System\BJJEOYK.exe
  2⤵
  PID:12676
- C:\Windows\System\uJSQTYk.exe
  C:\Windows\System\uJSQTYk.exe
  2⤵
  PID:12756
- C:\Windows\System\FNnGpGH.exe
  C:\Windows\System\FNnGpGH.exe
  2⤵
  PID:12800
- C:\Windows\System\VZqoWnX.exe
  C:\Windows\System\VZqoWnX.exe
  2⤵
  PID:3068
- C:\Windows\System\FsBXflE.exe
  C:\Windows\System\FsBXflE.exe
  2⤵
  PID:12856
- C:\Windows\System\ONsCiJT.exe
  C:\Windows\System\ONsCiJT.exe
  2⤵
  PID:12888
- C:\Windows\System\oyZOjIN.exe
  C:\Windows\System\oyZOjIN.exe
  2⤵
  PID:12868
- C:\Windows\System\LvrNJNH.exe
  C:\Windows\System\LvrNJNH.exe
  2⤵
  PID:12976
- C:\Windows\System\pPKeIGD.exe
  C:\Windows\System\pPKeIGD.exe
  2⤵
  PID:944
- C:\Windows\System\ewoZOfW.exe
  C:\Windows\System\ewoZOfW.exe
  2⤵
  PID:13044
- C:\Windows\System\elSKUwl.exe
  C:\Windows\System\elSKUwl.exe
  2⤵
  PID:13076
- C:\Windows\System\WjpsqkQ.exe
  C:\Windows\System\WjpsqkQ.exe
  2⤵
  PID:13088
- C:\Windows\System\RgpVuAC.exe
  C:\Windows\System\RgpVuAC.exe
  2⤵
  PID:13108
- C:\Windows\System\HdaYtvO.exe
  C:\Windows\System\HdaYtvO.exe
  2⤵
  PID:13132
- C:\Windows\System\FaNUVNq.exe
  C:\Windows\System\FaNUVNq.exe
  2⤵
  PID:2348
- C:\Windows\System\SEvhIri.exe
  C:\Windows\System\SEvhIri.exe
  2⤵
  PID:13236
- C:\Windows\System\pSgwuQV.exe
  C:\Windows\System\pSgwuQV.exe
  2⤵
  PID:13252
- C:\Windows\System\ICiaIsL.exe
  C:\Windows\System\ICiaIsL.exe
  2⤵
  PID:13268
- C:\Windows\System\zkMpXCH.exe
  C:\Windows\System\zkMpXCH.exe
  2⤵
  PID:13288
- C:\Windows\System\eaTGnpw.exe
  C:\Windows\System\eaTGnpw.exe
  2⤵
  PID:13292
- C:\Windows\System\mPyQYir.exe
  C:\Windows\System\mPyQYir.exe
  2⤵
  PID:13308
- C:\Windows\System\iFXPAGP.exe
  C:\Windows\System\iFXPAGP.exe
  2⤵
  PID:11544
- C:\Windows\System\kALMeRT.exe
  C:\Windows\System\kALMeRT.exe
  2⤵
  PID:864
- C:\Windows\System\oBJFhmJ.exe
  C:\Windows\System\oBJFhmJ.exe
  2⤵
  PID:3216
- C:\Windows\System\vGWlJMI.exe
  C:\Windows\System\vGWlJMI.exe
  2⤵
  PID:12952
- C:\Windows\System\rKeQhet.exe
  C:\Windows\System\rKeQhet.exe
  2⤵
  PID:2600
- C:\Windows\System\YEUOZJX.exe
  C:\Windows\System\YEUOZJX.exe
  2⤵
  PID:12592
- C:\Windows\System\CfRXXof.exe
  C:\Windows\System\CfRXXof.exe
  2⤵
  PID:12720
- C:\Windows\System\SfQhnNl.exe
  C:\Windows\System\SfQhnNl.exe
  2⤵
  PID:12768
- C:\Windows\System\rMqgYcm.exe
  C:\Windows\System\rMqgYcm.exe
  2⤵
  PID:12844
- C:\Windows\System\IAnlzEe.exe
  C:\Windows\System\IAnlzEe.exe
  2⤵
  PID:12872
- C:\Windows\System\vpAjWUt.exe
  C:\Windows\System\vpAjWUt.exe
  2⤵
  PID:12988
- C:\Windows\System\rphGfod.exe
  C:\Windows\System\rphGfod.exe
  2⤵
  PID:13020
- C:\Windows\System\Wllyhia.exe
  C:\Windows\System\Wllyhia.exe
  2⤵
  PID:13068
- C:\Windows\System\rPQYamZ.exe
  C:\Windows\System\rPQYamZ.exe
  2⤵
  PID:13116
- C:\Windows\System\ukxbxdH.exe
  C:\Windows\System\ukxbxdH.exe
  2⤵
  PID:13172
- C:\Windows\System\NQFRhSw.exe
  C:\Windows\System\NQFRhSw.exe
  2⤵
  PID:13228
- C:\Windows\System\CQdyqxT.exe
  C:\Windows\System\CQdyqxT.exe
  2⤵
  PID:13244
- C:\Windows\System\ODdonXW.exe
  C:\Windows\System\ODdonXW.exe
  2⤵
  PID:13052
- C:\Windows\System\kvyOanb.exe
  C:\Windows\System\kvyOanb.exe
  2⤵
  PID:13276
- C:\Windows\System\EZITGMu.exe
  C:\Windows\System\EZITGMu.exe
  2⤵
  PID:5164
- C:\Windows\System\ZbSmkzR.exe
  C:\Windows\System\ZbSmkzR.exe
  2⤵
  PID:5924
- C:\Windows\System\kKbAOCo.exe
  C:\Windows\System\kKbAOCo.exe
  2⤵
  PID:13200
- C:\Windows\System\JniutrO.exe
  C:\Windows\System\JniutrO.exe
  2⤵
  PID:4448
- C:\Windows\System\miUrGhq.exe
  C:\Windows\System\miUrGhq.exe
  2⤵
  PID:13304
- C:\Windows\System\dADDFjO.exe
  C:\Windows\System\dADDFjO.exe
  2⤵
  PID:12208
- C:\Windows\System\lZkdqWG.exe
  C:\Windows\System\lZkdqWG.exe
  2⤵
  PID:2456
- C:\Windows\System\ksPdyTa.exe
  C:\Windows\System\ksPdyTa.exe
  2⤵
  PID:768
- C:\Windows\System\yEOGyzW.exe
  C:\Windows\System\yEOGyzW.exe
  2⤵
  PID:5160
- C:\Windows\System\YcHEnJK.exe
  C:\Windows\System\YcHEnJK.exe
  2⤵
  PID:5144
- C:\Windows\System\WkIfWtD.exe
  C:\Windows\System\WkIfWtD.exe
  2⤵
  PID:3232
- C:\Windows\System\kpQnVfi.exe
  C:\Windows\System\kpQnVfi.exe
  2⤵
  PID:5276
- C:\Windows\System\vrQdjMY.exe
  C:\Windows\System\vrQdjMY.exe
  2⤵
  PID:12632
- C:\Windows\System\XUlkywQ.exe
  C:\Windows\System\XUlkywQ.exe
  2⤵
  PID:400
- C:\Windows\System\sThsSuK.exe
  C:\Windows\System\sThsSuK.exe
  2⤵
  PID:5196
- C:\Windows\System\RbyRzSP.exe
  C:\Windows\System\RbyRzSP.exe
  2⤵
  PID:5364
- C:\Windows\System\iHIwNRS.exe
  C:\Windows\System\iHIwNRS.exe
  2⤵
  PID:5452
- C:\Windows\System\GeezwbU.exe
  C:\Windows\System\GeezwbU.exe
  2⤵
  PID:5476
- C:\Windows\System\SxkdMvM.exe
  C:\Windows\System\SxkdMvM.exe
  2⤵
  PID:5616
- C:\Windows\System\GTXOJZB.exe
  C:\Windows\System\GTXOJZB.exe
  2⤵
  PID:5568
- C:\Windows\System\uCDqzgB.exe
  C:\Windows\System\uCDqzgB.exe
  2⤵
  PID:13024
- C:\Windows\System\YZvLoSC.exe
  C:\Windows\System\YZvLoSC.exe
  2⤵
  PID:12980
- C:\Windows\System\cciEMKK.exe
  C:\Windows\System\cciEMKK.exe
  2⤵
  PID:6056
- C:\Windows\System\EiERrlc.exe
  C:\Windows\System\EiERrlc.exe
  2⤵
  PID:6080
- C:\Windows\System\Nkcdlgf.exe
  C:\Windows\System\Nkcdlgf.exe
  2⤵
  PID:5856
- C:\Windows\System\aawNBHS.exe
  C:\Windows\System\aawNBHS.exe
  2⤵
  PID:3188
- C:\Windows\System\BTyUuNi.exe
  C:\Windows\System\BTyUuNi.exe
  2⤵
  PID:10120
- C:\Windows\System\GQruQmB.exe
  C:\Windows\System\GQruQmB.exe
  2⤵
  PID:7184
- C:\Windows\System\WjmdnKg.exe
  C:\Windows\System\WjmdnKg.exe
  2⤵
  PID:2620
- C:\Windows\System\qltYsxl.exe
  C:\Windows\System\qltYsxl.exe
  2⤵
  PID:13284
- C:\Windows\System\PvvxlOq.exe
  C:\Windows\System\PvvxlOq.exe
  2⤵
  PID:13300
- C:\Windows\System\BGNolFK.exe
  C:\Windows\System\BGNolFK.exe
  2⤵
  PID:5156
- C:\Windows\System\YhxldsF.exe
  C:\Windows\System\YhxldsF.exe
  2⤵
  PID:6236
- C:\Windows\System\VkcEgSP.exe
  C:\Windows\System\VkcEgSP.exe
  2⤵
  PID:5044
- C:\Windows\System\JOsLVuW.exe
  C:\Windows\System\JOsLVuW.exe
  2⤵
  PID:4864
- C:\Windows\System\qHIUdIf.exe
  C:\Windows\System\qHIUdIf.exe
  2⤵
  PID:5200
- C:\Windows\System\RjBQeKr.exe
  C:\Windows\System\RjBQeKr.exe
  2⤵
  PID:6436
- C:\Windows\System\feBILcB.exe
  C:\Windows\System\feBILcB.exe
  2⤵
  PID:12968
- C:\Windows\System\nVBPMlD.exe
  C:\Windows\System\nVBPMlD.exe
  2⤵
  PID:5344
- C:\Windows\System\mVXmuZT.exe
  C:\Windows\System\mVXmuZT.exe
  2⤵
  PID:6092
- C:\Windows\System\CpXSDge.exe
  C:\Windows\System\CpXSDge.exe
  2⤵
  PID:1404
- C:\Windows\System\NJBVtul.exe
  C:\Windows\System\NJBVtul.exe
  2⤵
  PID:6900
- C:\Windows\System\rDfoOUQ.exe
  C:\Windows\System\rDfoOUQ.exe
  2⤵
  PID:4624
- C:\Windows\System\DbagZSS.exe
  C:\Windows\System\DbagZSS.exe
  2⤵
  PID:1740
- C:\Windows\System\dxBNAbr.exe
  C:\Windows\System\dxBNAbr.exe
  2⤵
  PID:5436
- C:\Windows\System\qFVgQnw.exe
  C:\Windows\System\qFVgQnw.exe
  2⤵
  PID:6512
- C:\Windows\System\lzwBhUd.exe
  C:\Windows\System\lzwBhUd.exe
  2⤵
  PID:1884
- C:\Windows\System\CefcGsD.exe
  C:\Windows\System\CefcGsD.exe
  2⤵
  PID:5068
- C:\Windows\System\hPrrsar.exe
  C:\Windows\System\hPrrsar.exe
  2⤵
  PID:13224
- C:\Windows\System\AhMNYwS.exe
  C:\Windows\System\AhMNYwS.exe
  2⤵
  PID:12356
- C:\Windows\System\OxBubRR.exe
  C:\Windows\System\OxBubRR.exe
  2⤵
  PID:3164
- C:\Windows\System\OTILxZt.exe
  C:\Windows\System\OTILxZt.exe
  2⤵
  PID:1592
- C:\Windows\System\ZCiwMQw.exe
  C:\Windows\System\ZCiwMQw.exe
  2⤵
  PID:1820
- C:\Windows\System\MTCcifu.exe
  C:\Windows\System\MTCcifu.exe
  2⤵
  PID:5428
- C:\Windows\System\zcQFYBY.exe
  C:\Windows\System\zcQFYBY.exe
  2⤵
  PID:636
- C:\Windows\System\yHPrRbr.exe
  C:\Windows\System\yHPrRbr.exe
  2⤵
  PID:6440
- C:\Windows\System\gQMvbcB.exe
  C:\Windows\System\gQMvbcB.exe
  2⤵
  PID:6716
- C:\Windows\System\KYLADRB.exe
  C:\Windows\System\KYLADRB.exe
  2⤵
  PID:6696
- C:\Windows\System\otsSlrq.exe
  C:\Windows\System\otsSlrq.exe
  2⤵
  PID:6324
- C:\Windows\System\vTXDkFn.exe
  C:\Windows\System\vTXDkFn.exe
  2⤵
  PID:7196
- C:\Windows\System\EIoHgRC.exe
  C:\Windows\System\EIoHgRC.exe
  2⤵
  PID:7356
- C:\Windows\System\BudkLMp.exe
  C:\Windows\System\BudkLMp.exe
  2⤵
  PID:7392
- C:\Windows\System\TyJckDT.exe
  C:\Windows\System\TyJckDT.exe
  2⤵
  PID:7412
- C:\Windows\System\fDCknpV.exe
  C:\Windows\System\fDCknpV.exe
  2⤵
  PID:7460
- C:\Windows\System\TzPlJnp.exe
  C:\Windows\System\TzPlJnp.exe
  2⤵
  PID:7700
- C:\Windows\System\BTQQovA.exe
  C:\Windows\System\BTQQovA.exe
  2⤵
  PID:7628
- C:\Windows\System\WSYyfBK.exe
  C:\Windows\System\WSYyfBK.exe
  2⤵
  PID:7732
- C:\Windows\System\YNEGECY.exe
  C:\Windows\System\YNEGECY.exe
  2⤵
  PID:13152
- C:\Windows\System\BTIUuPc.exe
  C:\Windows\System\BTIUuPc.exe
  2⤵
  PID:1968
- C:\Windows\System\dNLdBtj.exe
  C:\Windows\System\dNLdBtj.exe
  2⤵
  PID:6800
- C:\Windows\System\YbonCvN.exe
  C:\Windows\System\YbonCvN.exe
  2⤵
  PID:8144
- C:\Windows\System\fkvTAhH.exe
  C:\Windows\System\fkvTAhH.exe
  2⤵
  PID:3788
- C:\Windows\System\JlHJilf.exe
  C:\Windows\System\JlHJilf.exe
  2⤵
  PID:5132
- C:\Windows\System\HFBwwyA.exe
  C:\Windows\System\HFBwwyA.exe
  2⤵
  PID:4504
- C:\Windows\System\HQkxzQq.exe
  C:\Windows\System\HQkxzQq.exe
  2⤵
  PID:5148
- C:\Windows\System\apkbkMl.exe
  C:\Windows\System\apkbkMl.exe
  2⤵
  PID:7540
- C:\Windows\System\mqVlirj.exe
  C:\Windows\System\mqVlirj.exe
  2⤵
  PID:7576
- C:\Windows\System\WTFldDd.exe
  C:\Windows\System\WTFldDd.exe
  2⤵
  PID:8088
- C:\Windows\System\EssZfEL.exe
  C:\Windows\System\EssZfEL.exe
  2⤵
  PID:7644
- C:\Windows\System\IducSeM.exe
  C:\Windows\System\IducSeM.exe
  2⤵
  PID:7672
- C:\Windows\System\UHTgZXP.exe
  C:\Windows\System\UHTgZXP.exe
  2⤵
  PID:7736
- C:\Windows\System\gZSswrY.exe
  C:\Windows\System\gZSswrY.exe
  2⤵
  PID:7512
- C:\Windows\System\DVsnSWK.exe
  C:\Windows\System\DVsnSWK.exe
  2⤵
  PID:7948
- C:\Windows\System\BNJCqAn.exe
  C:\Windows\System\BNJCqAn.exe
  2⤵
  PID:8024
- C:\Windows\System\HMVWQfh.exe
  C:\Windows\System\HMVWQfh.exe
  2⤵
  PID:8108
- C:\Windows\System\ivMuoCH.exe
  C:\Windows\System\ivMuoCH.exe
  2⤵
  PID:7208
- C:\Windows\System\rYPRPow.exe
  C:\Windows\System\rYPRPow.exe
  2⤵
  PID:8252
- C:\Windows\System\FCzPfcj.exe
  C:\Windows\System\FCzPfcj.exe
  2⤵
  PID:8320
- C:\Windows\System\AJCXkTv.exe
  C:\Windows\System\AJCXkTv.exe
  2⤵
  PID:8420
- C:\Windows\System\BMRgblS.exe
  C:\Windows\System\BMRgblS.exe
  2⤵
  PID:1068
- C:\Windows\System\ceExfAC.exe
  C:\Windows\System\ceExfAC.exe
  2⤵
  PID:3900
- C:\Windows\System\mbBZpXW.exe
  C:\Windows\System\mbBZpXW.exe
  2⤵
  PID:7348
- C:\Windows\System\qjPHrzx.exe
  C:\Windows\System\qjPHrzx.exe
  2⤵
  PID:6532
- C:\Windows\System\uWzCwTD.exe
  C:\Windows\System\uWzCwTD.exe
  2⤵
  PID:6568
- C:\Windows\System\KTjKlgC.exe
  C:\Windows\System\KTjKlgC.exe
  2⤵
  PID:7140
- C:\Windows\System\tXvFcwb.exe
  C:\Windows\System\tXvFcwb.exe
  2⤵
  PID:6328
- C:\Windows\System\jegSVMJ.exe
  C:\Windows\System\jegSVMJ.exe
  2⤵
  PID:6308
- C:\Windows\System\ahsKrbR.exe
  C:\Windows\System\ahsKrbR.exe
  2⤵
  PID:3424
- C:\Windows\System\aUtvLVM.exe
  C:\Windows\System\aUtvLVM.exe
  2⤵
  PID:4632
- C:\Windows\System\TTtpiCO.exe
  C:\Windows\System\TTtpiCO.exe
  2⤵
  PID:224
- C:\Windows\System\XzEmyUy.exe
  C:\Windows\System\XzEmyUy.exe
  2⤵
  PID:1484
- C:\Windows\System\DHVlkXU.exe
  C:\Windows\System\DHVlkXU.exe
  2⤵
  PID:4844
- C:\Windows\System\qIVvMCk.exe
  C:\Windows\System\qIVvMCk.exe
  2⤵
  PID:2612
- C:\Windows\System\QELxNPy.exe
  C:\Windows\System\QELxNPy.exe
  2⤵
  PID:208
- C:\Windows\System\zMHxCeK.exe
  C:\Windows\System\zMHxCeK.exe
  2⤵
  PID:5700
- C:\Windows\System\oRmpvLY.exe
  C:\Windows\System\oRmpvLY.exe
  2⤵
  PID:13148
- C:\Windows\System\FEACuoK.exe
  C:\Windows\System\FEACuoK.exe
  2⤵
  PID:8960
- C:\Windows\System\dPWiZgv.exe
  C:\Windows\System\dPWiZgv.exe
  2⤵
  PID:8976
- C:\Windows\System\CovtlAE.exe
  C:\Windows\System\CovtlAE.exe
  2⤵
  PID:8916
- C:\Windows\System\TeHOGBR.exe
  C:\Windows\System\TeHOGBR.exe
  2⤵
  PID:8928
- C:\Windows\System\zlJmltl.exe
  C:\Windows\System\zlJmltl.exe
  2⤵
  PID:9016
- C:\Windows\System\FwEKTZS.exe
  C:\Windows\System\FwEKTZS.exe
  2⤵
  PID:4420
- C:\Windows\System\fQmJpNG.exe
  C:\Windows\System\fQmJpNG.exe
  2⤵
  PID:3200
- C:\Windows\System\zWCGySg.exe
  C:\Windows\System\zWCGySg.exe
  2⤵
  PID:1512
- C:\Windows\System\aoIuOcw.exe
  C:\Windows\System\aoIuOcw.exe
  2⤵
  PID:2480
- C:\Windows\System\LOZLFrS.exe
  C:\Windows\System\LOZLFrS.exe
  2⤵
  PID:4268
- C:\Windows\System\RPwBJHE.exe
  C:\Windows\System\RPwBJHE.exe
  2⤵
  PID:3996
- C:\Windows\System\VpoNWXk.exe
  C:\Windows\System\VpoNWXk.exe
  2⤵
  PID:3240
- C:\Windows\System\ngSVMvY.exe
  C:\Windows\System\ngSVMvY.exe
  2⤵
  PID:4752
- C:\Windows\System\fiVVVhD.exe
  C:\Windows\System\fiVVVhD.exe
  2⤵
  PID:8452
- C:\Windows\System\dbYmkuQ.exe
  C:\Windows\System\dbYmkuQ.exe
  2⤵
  PID:5216
- C:\Windows\System\DdDIZwB.exe
  C:\Windows\System\DdDIZwB.exe
  2⤵
  PID:4672
- C:\Windows\System\sCQyool.exe
  C:\Windows\System\sCQyool.exe
  2⤵
  PID:3888
- C:\Windows\System\cOiUtfe.exe
  C:\Windows\System\cOiUtfe.exe
  2⤵
  PID:5688
- C:\Windows\System\wEmECUm.exe
  C:\Windows\System\wEmECUm.exe
  2⤵
  PID:7056
- C:\Windows\System\rMmXulj.exe
  C:\Windows\System\rMmXulj.exe
  2⤵
  PID:8660
- C:\Windows\System\JEfJvxa.exe
  C:\Windows\System\JEfJvxa.exe
  2⤵
  PID:2788
- C:\Windows\System\sRkAAWF.exe
  C:\Windows\System\sRkAAWF.exe
  2⤵
  PID:5424
- C:\Windows\System\OErctIr.exe
  C:\Windows\System\OErctIr.exe
  2⤵
  PID:4708
- C:\Windows\System\wptttTt.exe
  C:\Windows\System\wptttTt.exe
  2⤵
  PID:2332
- C:\Windows\System\uHhPwGl.exe
  C:\Windows\System\uHhPwGl.exe
  2⤵
  PID:6388
- C:\Windows\System\XinLgjS.exe
  C:\Windows\System\XinLgjS.exe
  2⤵
  PID:4816
- C:\Windows\System\GbqeypA.exe
  C:\Windows\System\GbqeypA.exe
  2⤵
  PID:6988
- C:\Windows\System\NewQOVo.exe
  C:\Windows\System\NewQOVo.exe
  2⤵
  PID:7240
- C:\Windows\System\KyVRjJo.exe
  C:\Windows\System\KyVRjJo.exe
  2⤵
  PID:1892
- C:\Windows\System\tZifPOS.exe
  C:\Windows\System\tZifPOS.exe
  2⤵
  PID:8208
- C:\Windows\System\cGagctj.exe
  C:\Windows\System\cGagctj.exe
  2⤵
  PID:8456
- C:\Windows\System\BZmSpkc.exe
  C:\Windows\System\BZmSpkc.exe
  2⤵
  PID:7520
- C:\Windows\System\CKnaZGH.exe
  C:\Windows\System\CKnaZGH.exe
  2⤵
  PID:7788
- C:\Windows\System\YtsEIHM.exe
  C:\Windows\System\YtsEIHM.exe
  2⤵
  PID:7940
- C:\Windows\System\tCAFcaD.exe
  C:\Windows\System\tCAFcaD.exe
  2⤵
  PID:968
- C:\Windows\System\cJjrfAZ.exe
  C:\Windows\System\cJjrfAZ.exe
  2⤵
  PID:5088
- C:\Windows\System\PwkfLgM.exe
  C:\Windows\System\PwkfLgM.exe
  2⤵
  PID:1416
- C:\Windows\System\VEIFyRq.exe
  C:\Windows\System\VEIFyRq.exe
  2⤵
  PID:5404
- C:\Windows\System\SEWpvEf.exe
  C:\Windows\System\SEWpvEf.exe
  2⤵
  PID:6408
- C:\Windows\System\wzZnxmJ.exe
  C:\Windows\System\wzZnxmJ.exe
  2⤵
  PID:2380
- C:\Windows\System\KKfPddq.exe
  C:\Windows\System\KKfPddq.exe
  2⤵
  PID:872
- C:\Windows\System\QKAedNH.exe
  C:\Windows\System\QKAedNH.exe
  2⤵
  PID:7220
- C:\Windows\System\DMnMlta.exe
  C:\Windows\System\DMnMlta.exe
  2⤵
  PID:11420
- C:\Windows\System\jRmZhbT.exe
  C:\Windows\System\jRmZhbT.exe
  2⤵
  PID:7616
- C:\Windows\System\vPKYEPC.exe
  C:\Windows\System\vPKYEPC.exe
  2⤵
  PID:876
- C:\Windows\System\VMpDHHb.exe
  C:\Windows\System\VMpDHHb.exe
  2⤵
  PID:7832
- C:\Windows\System\bKQhgvF.exe
  C:\Windows\System\bKQhgvF.exe
  2⤵
  PID:8044
- C:\Windows\System\NcxSyET.exe
  C:\Windows\System\NcxSyET.exe
  2⤵
  PID:7908
- C:\Windows\System\cjklwrT.exe
  C:\Windows\System\cjklwrT.exe
  2⤵
  PID:4068
- C:\Windows\System\vStonNK.exe
  C:\Windows\System\vStonNK.exe
  2⤵
  PID:4100
- C:\Windows\System\zkuHMsX.exe
  C:\Windows\System\zkuHMsX.exe
  2⤵
  PID:9936
- C:\Windows\System\DWXhSCE.exe
  C:\Windows\System\DWXhSCE.exe
  2⤵
  PID:1172
- C:\Windows\System\uvvenpZ.exe
  C:\Windows\System\uvvenpZ.exe
  2⤵
  PID:7456
- C:\Windows\System\slrJTLB.exe
  C:\Windows\System\slrJTLB.exe
  2⤵
  PID:4004
- C:\Windows\System\GANDuyx.exe
  C:\Windows\System\GANDuyx.exe
  2⤵
  PID:10080
- C:\Windows\System\CsHmWZs.exe
  C:\Windows\System\CsHmWZs.exe
  2⤵
  PID:4896
- C:\Windows\System\qMpRYur.exe
  C:\Windows\System\qMpRYur.exe
  2⤵
  PID:8300
- C:\Windows\System\PiOWpRz.exe
  C:\Windows\System\PiOWpRz.exe
  2⤵
  PID:4808
- C:\Windows\System\LFyOqCu.exe
  C:\Windows\System\LFyOqCu.exe
  2⤵
  PID:10184
- C:\Windows\System\HEDTDTK.exe
  C:\Windows\System\HEDTDTK.exe
  2⤵
  PID:4728
- C:\Windows\System\JSLYnZs.exe
  C:\Windows\System\JSLYnZs.exe
  2⤵
  PID:9352
- C:\Windows\System\ZoxiDUF.exe
  C:\Windows\System\ZoxiDUF.exe
  2⤵
  PID:1008
- C:\Windows\System\ofstThh.exe
  C:\Windows\System\ofstThh.exe
  2⤵
  PID:6164
- C:\Windows\System\VQrhAAs.exe
  C:\Windows\System\VQrhAAs.exe
  2⤵
  PID:3448
- C:\Windows\System\pbFatpd.exe
  C:\Windows\System\pbFatpd.exe
  2⤵
  PID:212
- C:\Windows\System\jCGFvrT.exe
  C:\Windows\System\jCGFvrT.exe
  2⤵
  PID:3148
- C:\Windows\System\NtkgRpK.exe
  C:\Windows\System\NtkgRpK.exe
  2⤵
  PID:4320
- C:\Windows\System\DRvkTBJ.exe
  C:\Windows\System\DRvkTBJ.exe
  2⤵
  PID:3192
- C:\Windows\System\sPoUAUd.exe
  C:\Windows\System\sPoUAUd.exe
  2⤵
  PID:1192
- C:\Windows\System\XEYvdqP.exe
  C:\Windows\System\XEYvdqP.exe
  2⤵
  PID:3640
- C:\Windows\System\FMuosqT.exe
  C:\Windows\System\FMuosqT.exe
  2⤵
  PID:640
- C:\Windows\System\ckrVNPP.exe
  C:\Windows\System\ckrVNPP.exe
  2⤵
  PID:6692
- C:\Windows\System\QMLkACl.exe
  C:\Windows\System\QMLkACl.exe
  2⤵
  PID:4372
- C:\Windows\System\sGWDfXO.exe
  C:\Windows\System\sGWDfXO.exe
  2⤵
  PID:9976
- C:\Windows\System\IahFfpl.exe
  C:\Windows\System\IahFfpl.exe
  2⤵
  PID:8972
- C:\Windows\System\imGnxRC.exe
  C:\Windows\System\imGnxRC.exe
  2⤵
  PID:8988
- C:\Windows\System\Lnxqywg.exe
  C:\Windows\System\Lnxqywg.exe
  2⤵
  PID:1256
- C:\Windows\System\KyrTtwQ.exe
  C:\Windows\System\KyrTtwQ.exe
  2⤵
  PID:9008
- C:\Windows\System\ehapMqi.exe
  C:\Windows\System\ehapMqi.exe
  2⤵
  PID:1488
- C:\Windows\System\rQXnsiW.exe
  C:\Windows\System\rQXnsiW.exe
  2⤵
  PID:10320
- C:\Windows\System\hQitQsM.exe
  C:\Windows\System\hQitQsM.exe
  2⤵
  PID:1824
- C:\Windows\System\ZkiZdek.exe
  C:\Windows\System\ZkiZdek.exe
  2⤵
  PID:5140
- C:\Windows\System\PjrjZvu.exe
  C:\Windows\System\PjrjZvu.exe
  2⤵
  PID:10560
- C:\Windows\System\emEuHLb.exe
  C:\Windows\System\emEuHLb.exe
  2⤵
  PID:7060
- C:\Windows\System\eOPGgsp.exe
  C:\Windows\System\eOPGgsp.exe
  2⤵
  PID:3256
- C:\Windows\System\EErUyXZ.exe
  C:\Windows\System\EErUyXZ.exe
  2⤵
  PID:10716
- C:\Windows\System\NJwDYWI.exe
  C:\Windows\System\NJwDYWI.exe
  2⤵
  PID:4716
- C:\Windows\System\RxWoqSS.exe
  C:\Windows\System\RxWoqSS.exe
  2⤵
  PID:3116
- C:\Windows\System\FmcfOQw.exe
  C:\Windows\System\FmcfOQw.exe
  2⤵
  PID:10972
- C:\Windows\System\RHfdeNf.exe
  C:\Windows\System\RHfdeNf.exe
  2⤵
  PID:6816
- C:\Windows\System\uwwULPk.exe
  C:\Windows\System\uwwULPk.exe
  2⤵
  PID:2816
- C:\Windows\System\dqeQLiX.exe
  C:\Windows\System\dqeQLiX.exe
  2⤵
  PID:7300
- C:\Windows\System\JYMwXwN.exe
  C:\Windows\System\JYMwXwN.exe
  2⤵
  PID:3860
- C:\Windows\System\QcQaKze.exe
  C:\Windows\System\QcQaKze.exe
  2⤵
  PID:10592
- C:\Windows\System\kKBIEzy.exe
  C:\Windows\System\kKBIEzy.exe
  2⤵
  PID:5272
- C:\Windows\System\mOmqjds.exe
  C:\Windows\System\mOmqjds.exe
  2⤵
  PID:5828
- C:\Windows\System\rJZiOIx.exe
  C:\Windows\System\rJZiOIx.exe
  2⤵
  PID:7524
- C:\Windows\System\WYNCPkh.exe
  C:\Windows\System\WYNCPkh.exe
  2⤵
  PID:10380
- C:\Windows\System\lIXDftv.exe
  C:\Windows\System\lIXDftv.exe
  2⤵
  PID:7944
- C:\Windows\System\jrVSGLs.exe
  C:\Windows\System\jrVSGLs.exe
  2⤵
  PID:9600
- C:\Windows\System\fImlwqX.exe
  C:\Windows\System\fImlwqX.exe
  2⤵
  PID:5444
- C:\Windows\System\oYWVFUV.exe
  C:\Windows\System\oYWVFUV.exe
  2⤵
  PID:5392
- C:\Windows\System\gcWTMyu.exe
  C:\Windows\System\gcWTMyu.exe
  2⤵
  PID:5420
- C:\Windows\System\aOfuGtX.exe
  C:\Windows\System\aOfuGtX.exe
  2⤵
  PID:5504
- C:\Windows\System\TuZDbzg.exe
  C:\Windows\System\TuZDbzg.exe
  2⤵
  PID:2900
- C:\Windows\System\SIQDaYv.exe
  C:\Windows\System\SIQDaYv.exe
  2⤵
  PID:7480
- C:\Windows\System\hpflfET.exe
  C:\Windows\System\hpflfET.exe
  2⤵
  PID:5556
- C:\Windows\System\IixNxii.exe
  C:\Windows\System\IixNxii.exe
  2⤵
  PID:9840
- C:\Windows\System\rGGTDNP.exe
  C:\Windows\System\rGGTDNP.exe
  2⤵
  PID:5604
- C:\Windows\System\bYGtDZw.exe
  C:\Windows\System\bYGtDZw.exe
  2⤵
  PID:5660
- C:\Windows\System\XqwMriv.exe
  C:\Windows\System\XqwMriv.exe
  2⤵
  PID:3388
- C:\Windows\System\oVMOEKl.exe
  C:\Windows\System\oVMOEKl.exe
  2⤵
  PID:5776
- C:\Windows\System\buNPyBJ.exe
  C:\Windows\System\buNPyBJ.exe
  2⤵
  PID:5748
- C:\Windows\System\kYdDzJq.exe
  C:\Windows\System\kYdDzJq.exe
  2⤵
  PID:8336
- C:\Windows\System\zkRRhNm.exe
  C:\Windows\System\zkRRhNm.exe
  2⤵
  PID:10116
- C:\Windows\System\PWHpCjQ.exe
  C:\Windows\System\PWHpCjQ.exe
  2⤵
  PID:11584
- C:\Windows\System\ZbtYnLv.exe
  C:\Windows\System\ZbtYnLv.exe
  2⤵
  PID:5836
- C:\Windows\System\ctrMvao.exe
  C:\Windows\System\ctrMvao.exe
  2⤵
  PID:4604
- C:\Windows\System\tRWEeJM.exe
  C:\Windows\System\tRWEeJM.exe
  2⤵
  PID:1080
- C:\Windows\System\kcKdAmY.exe
  C:\Windows\System\kcKdAmY.exe
  2⤵
  PID:6556
- C:\Windows\System\zqgiucw.exe
  C:\Windows\System\zqgiucw.exe
  2⤵
  PID:6220
- C:\Windows\System\kRJozaw.exe
  C:\Windows\System\kRJozaw.exe
  2⤵
  PID:6020
- C:\Windows\System\xZDkTrv.exe
  C:\Windows\System\xZDkTrv.exe
  2⤵
  PID:7092
- C:\Windows\System\ogJlItr.exe
  C:\Windows\System\ogJlItr.exe
  2⤵
  PID:2200
- C:\Windows\System\kEuJTKD.exe
  C:\Windows\System\kEuJTKD.exe
  2⤵
  PID:540
- C:\Windows\System\jeXmOJS.exe
  C:\Windows\System\jeXmOJS.exe
  2⤵
  PID:2760
- C:\Windows\System\uhSqrxc.exe
  C:\Windows\System\uhSqrxc.exe
  2⤵
  PID:2236
- C:\Windows\System\kTLDCxh.exe
  C:\Windows\System\kTLDCxh.exe
  2⤵
  PID:5060
- C:\Windows\System\nXVJUVR.exe
  C:\Windows\System\nXVJUVR.exe
  2⤵
  PID:2680
- C:\Windows\System\ZhkZvNG.exe
  C:\Windows\System\ZhkZvNG.exe
  2⤵
  PID:2800
- C:\Windows\System\vMZFeFq.exe
  C:\Windows\System\vMZFeFq.exe
  2⤵
  PID:9924
- C:\Windows\System\YtIDVXf.exe
  C:\Windows\System\YtIDVXf.exe
  2⤵
  PID:7416
- C:\Windows\System\alsTMhQ.exe
  C:\Windows\System\alsTMhQ.exe
  2⤵
  PID:676
- C:\Windows\System\DVnGXLk.exe
  C:\Windows\System\DVnGXLk.exe
  2⤵
  PID:11364
- C:\Windows\System\HgrAtxI.exe
  C:\Windows\System\HgrAtxI.exe
  2⤵
  PID:2464
- C:\Windows\System\bgPmEog.exe
  C:\Windows\System\bgPmEog.exe
  2⤵
  PID:11800
- C:\Windows\System\UnVkXwf.exe
  C:\Windows\System\UnVkXwf.exe
  2⤵
  PID:4828
- C:\Windows\System\cERoXgq.exe
  C:\Windows\System\cERoXgq.exe
  2⤵
  PID:7144
- C:\Windows\System\FKlXEIE.exe
  C:\Windows\System\FKlXEIE.exe
  2⤵
  PID:12024
- C:\Windows\System\gkSBFkr.exe
  C:\Windows\System\gkSBFkr.exe
  2⤵
  PID:4952
- C:\Windows\System\fduPvqO.exe
  C:\Windows\System\fduPvqO.exe
  2⤵
  PID:10616
- C:\Windows\System\fFjLkat.exe
  C:\Windows\System\fFjLkat.exe
  2⤵
  PID:12308
- C:\Windows\System\QbMQSDD.exe
  C:\Windows\System\QbMQSDD.exe
  2⤵
  PID:11396
- C:\Windows\System\YcZtWXZ.exe
  C:\Windows\System\YcZtWXZ.exe
  2⤵
  PID:1308
- C:\Windows\System\ZrcHHUx.exe
  C:\Windows\System\ZrcHHUx.exe
  2⤵
  PID:5788
- C:\Windows\System\WerPKDp.exe
  C:\Windows\System\WerPKDp.exe
  2⤵
  PID:5848
- C:\Windows\System\ETThTFY.exe
  C:\Windows\System\ETThTFY.exe
  2⤵
  PID:4996
- C:\Windows\System\QMzuKHX.exe
  C:\Windows\System\QMzuKHX.exe
  2⤵
  PID:3884
- C:\Windows\System\kzLcLpj.exe
  C:\Windows\System\kzLcLpj.exe
  2⤵
  PID:5440
- C:\Windows\System\FxMODYb.exe
  C:\Windows\System\FxMODYb.exe
  2⤵
  PID:836
- C:\Windows\System\IiyHJuk.exe
  C:\Windows\System\IiyHJuk.exe
  2⤵
  PID:12344
- C:\Windows\System\PayDWdd.exe
  C:\Windows\System\PayDWdd.exe
  2⤵
  PID:6304
- C:\Windows\System\WHblcpF.exe
  C:\Windows\System\WHblcpF.exe
  2⤵
  PID:6156
- C:\Windows\System\MYYXnZQ.exe
  C:\Windows\System\MYYXnZQ.exe
  2⤵
  PID:5496
- C:\Windows\System\DGRcLHu.exe
  C:\Windows\System\DGRcLHu.exe
  2⤵
  PID:7580
- C:\Windows\System\eyxFFhW.exe
  C:\Windows\System\eyxFFhW.exe
  2⤵
  PID:12680
- C:\Windows\System\EhTLAyJ.exe
  C:\Windows\System\EhTLAyJ.exe
  2⤵
  PID:12736
- C:\Windows\System\mtiTtAX.exe
  C:\Windows\System\mtiTtAX.exe
  2⤵
  PID:1620
- C:\Windows\System\fSmRPfw.exe
  C:\Windows\System\fSmRPfw.exe
  2⤵
  PID:12788
- C:\Windows\System\oxFCVRS.exe
  C:\Windows\System\oxFCVRS.exe
  2⤵
  PID:9612
- C:\Windows\System\COjsIqX.exe
  C:\Windows\System\COjsIqX.exe
  2⤵
  PID:4528
- C:\Windows\System\wjIcwOm.exe
  C:\Windows\System\wjIcwOm.exe
  2⤵
  PID:5284
- C:\Windows\System\rIdnqnB.exe
  C:\Windows\System\rIdnqnB.exe
  2⤵
  PID:12916
- C:\Windows\System\OMkVsoy.exe
  C:\Windows\System\OMkVsoy.exe
  2⤵
  PID:7996
- C:\Windows\System\uzsssdy.exe
  C:\Windows\System\uzsssdy.exe
  2⤵
  PID:10948
- C:\Windows\System\hGfkRnV.exe
  C:\Windows\System\hGfkRnV.exe
  2⤵
  PID:2224
- C:\Windows\System\WAMRWtM.exe
  C:\Windows\System\WAMRWtM.exe
  2⤵
  PID:11144
- C:\Windows\System\nXhrTEa.exe
  C:\Windows\System\nXhrTEa.exe
  2⤵
  PID:7684
- C:\Windows\System\CzvoyJC.exe
  C:\Windows\System\CzvoyJC.exe
  2⤵
  PID:6364
- C:\Windows\System\tIGQVga.exe
  C:\Windows\System\tIGQVga.exe
  2⤵
  PID:8036
- C:\Windows\System\AMvZgBW.exe
  C:\Windows\System\AMvZgBW.exe
  2⤵
  PID:6576
- C:\Windows\System\efNiTSd.exe
  C:\Windows\System\efNiTSd.exe
  2⤵
  PID:6644
- C:\Windows\System\rxSPQrs.exe
  C:\Windows\System\rxSPQrs.exe
  2⤵
  PID:6664
- C:\Windows\System\vZqGKOH.exe
  C:\Windows\System\vZqGKOH.exe
  2⤵
  PID:9756
- C:\Windows\System\aChAQef.exe
  C:\Windows\System\aChAQef.exe
  2⤵
  PID:7836
- C:\Windows\System\Blatvvk.exe
  C:\Windows\System\Blatvvk.exe
  2⤵
  PID:11276
- C:\Windows\System\HzMoYfI.exe
  C:\Windows\System\HzMoYfI.exe
  2⤵
  PID:8164
- C:\Windows\System\mmHUGTQ.exe
  C:\Windows\System\mmHUGTQ.exe
  2⤵
  PID:6572
- C:\Windows\System\xxzypdK.exe
  C:\Windows\System\xxzypdK.exe
  2⤵
  PID:11612
- C:\Windows\System\UJNKEeD.exe
  C:\Windows\System\UJNKEeD.exe
  2⤵
  PID:5844
- C:\Windows\System\JeAidHY.exe
  C:\Windows\System\JeAidHY.exe
  2⤵
  PID:8248
- C:\Windows\System\vTpxLsV.exe
  C:\Windows\System\vTpxLsV.exe
  2⤵
  PID:7052
- C:\Windows\System\tRJacSa.exe
  C:\Windows\System\tRJacSa.exe
  2⤵
  PID:7048
- C:\Windows\System\baDOnHF.exe
  C:\Windows\System\baDOnHF.exe
  2⤵
  PID:11776
- C:\Windows\System\vFiNoth.exe
  C:\Windows\System\vFiNoth.exe
  2⤵
  PID:9484
- C:\Windows\System\pYgPvZX.exe
  C:\Windows\System\pYgPvZX.exe
  2⤵
  PID:11948
- C:\Windows\System\uXMWnIZ.exe
  C:\Windows\System\uXMWnIZ.exe
  2⤵
  PID:12036
- C:\Windows\System\QgFkkNw.exe
  C:\Windows\System\QgFkkNw.exe
  2⤵
  PID:6132
- C:\Windows\System\TZzzKEV.exe
  C:\Windows\System\TZzzKEV.exe
  2⤵
  PID:3120
- C:\Windows\System\sGYBdmD.exe
  C:\Windows\System\sGYBdmD.exe
  2⤵
  PID:6812
- C:\Windows\System\PDRboop.exe
  C:\Windows\System\PDRboop.exe
  2⤵
  PID:6808
- C:\Windows\System\pBqjTBz.exe
  C:\Windows\System\pBqjTBz.exe
  2⤵
  PID:5744
- C:\Windows\System\DZozAtv.exe
  C:\Windows\System\DZozAtv.exe
  2⤵
  PID:6776
- C:\Windows\System\PwjGhsp.exe
  C:\Windows\System\PwjGhsp.exe
  2⤵
  PID:8952
- C:\Windows\System\CsItnNK.exe
  C:\Windows\System\CsItnNK.exe
  2⤵
  PID:2732
- C:\Windows\System\oUCTGuh.exe
  C:\Windows\System\oUCTGuh.exe
  2⤵
  PID:11324
- C:\Windows\System\MehirLX.exe
  C:\Windows\System\MehirLX.exe
  2⤵
  PID:7132
- C:\Windows\System\ysSocna.exe
  C:\Windows\System\ysSocna.exe
  2⤵
  PID:7112
- C:\Windows\System\CHBpVlT.exe
  C:\Windows\System\CHBpVlT.exe
  2⤵
  PID:4272
- C:\Windows\System\hteKPFG.exe
  C:\Windows\System\hteKPFG.exe
  2⤵
  PID:6296
- C:\Windows\System\SquTiyp.exe
  C:\Windows\System\SquTiyp.exe
  2⤵
  PID:6536
- C:\Windows\System\BfBCJXk.exe
  C:\Windows\System\BfBCJXk.exe
  2⤵
  PID:3820
- C:\Windows\System\MYMAuJj.exe
  C:\Windows\System\MYMAuJj.exe
  2⤵
  PID:5396
- C:\Windows\System\JVTocij.exe
  C:\Windows\System\JVTocij.exe
  2⤵
  PID:5400
- C:\Windows\System\XQHBZVU.exe
  C:\Windows\System\XQHBZVU.exe
  2⤵
  PID:6708
- C:\Windows\System\CNHRkfU.exe
  C:\Windows\System\CNHRkfU.exe
  2⤵
  PID:6656
- C:\Windows\System\ZBjgymn.exe
  C:\Windows\System\ZBjgymn.exe
  2⤵
  PID:7328
- C:\Windows\System\MyrhNpA.exe
  C:\Windows\System\MyrhNpA.exe
  2⤵
  PID:5460
- C:\Windows\System\XJcrrEy.exe
  C:\Windows\System\XJcrrEy.exe
  2⤵
  PID:12596
- C:\Windows\System\TIpVWpZ.exe
  C:\Windows\System\TIpVWpZ.exe
  2⤵
  PID:11232
- C:\Windows\System\XRvWiHb.exe
  C:\Windows\System\XRvWiHb.exe
  2⤵
  PID:7820
- C:\Windows\System\vNTzXJV.exe
  C:\Windows\System\vNTzXJV.exe
  2⤵
  PID:12804
- C:\Windows\System\mwoWNUI.exe
  C:\Windows\System\mwoWNUI.exe
  2⤵
  PID:5348
- C:\Windows\System\lLgetAq.exe
  C:\Windows\System\lLgetAq.exe
  2⤵
  PID:12892
- C:\Windows\System\PqGnMIo.exe
  C:\Windows\System\PqGnMIo.exe
  2⤵
  PID:12948
- C:\Windows\System\gphoDjN.exe
  C:\Windows\System\gphoDjN.exe
  2⤵
  PID:4220
- C:\Windows\System\YBBGCaX.exe
  C:\Windows\System\YBBGCaX.exe
  2⤵
  PID:7968
- C:\Windows\System\TtOeear.exe
  C:\Windows\System\TtOeear.exe
  2⤵
  PID:668
- C:\Windows\System\iuVuIQx.exe
  C:\Windows\System\iuVuIQx.exe
  2⤵
  PID:5624
- C:\Windows\System\yeJaRGU.exe
  C:\Windows\System\yeJaRGU.exe
  2⤵
  PID:6636
- C:\Windows\System\LLEUkhF.exe
  C:\Windows\System\LLEUkhF.exe
  2⤵
  PID:4944
- C:\Windows\System\hcOEcpN.exe
  C:\Windows\System\hcOEcpN.exe
  2⤵
  PID:13080
- C:\Windows\System\XOrezAV.exe
  C:\Windows\System\XOrezAV.exe
  2⤵
  PID:9852
- C:\Windows\System\shgACxl.exe
  C:\Windows\System\shgACxl.exe
  2⤵
  PID:11416
- C:\Windows\System\XJvZVov.exe
  C:\Windows\System\XJvZVov.exe
  2⤵
  PID:2776
- C:\Windows\System\jejrUKa.exe
  C:\Windows\System\jejrUKa.exe
  2⤵
  PID:4976
- C:\Windows\System\EVSiNVc.exe
  C:\Windows\System\EVSiNVc.exe
  2⤵
  PID:1696
- C:\Windows\System\ENttoyk.exe
  C:\Windows\System\ENttoyk.exe
  2⤵
  PID:6584
- C:\Windows\System\CqwUKCv.exe
  C:\Windows\System\CqwUKCv.exe
  2⤵
  PID:7044
- C:\Windows\System\kaXFRNC.exe
  C:\Windows\System\kaXFRNC.exe
  2⤵
  PID:3776
- C:\Windows\System\dbmLuCF.exe
  C:\Windows\System\dbmLuCF.exe
  2⤵
  PID:13072
- C:\Windows\System\tNymgrK.exe
  C:\Windows\System\tNymgrK.exe
  2⤵
  PID:7128
- C:\Windows\System\ndIZRbN.exe
  C:\Windows\System\ndIZRbN.exe
  2⤵
  PID:1100
- C:\Windows\System\MNQeeuQ.exe
  C:\Windows\System\MNQeeuQ.exe
  2⤵
  PID:7372
- C:\Windows\System\CNeXCry.exe
  C:\Windows\System\CNeXCry.exe
  2⤵
  PID:4676
- C:\Windows\System\PgrfusG.exe
  C:\Windows\System\PgrfusG.exe
  2⤵
  PID:9760
- C:\Windows\System\nTgrEUL.exe
  C:\Windows\System\nTgrEUL.exe
  2⤵
  PID:6216
- C:\Windows\System\yIJyeQi.exe
  C:\Windows\System\yIJyeQi.exe
  2⤵
  PID:1372
- C:\Windows\System\SJTpDbv.exe
  C:\Windows\System\SJTpDbv.exe
  2⤵
  PID:2240
- C:\Windows\System\QFbqyoc.exe
  C:\Windows\System\QFbqyoc.exe
  2⤵
  PID:6580
- C:\Windows\System\aVqsNUg.exe
  C:\Windows\System\aVqsNUg.exe
  2⤵
  PID:4072
- C:\Windows\System\XYahPWu.exe
  C:\Windows\System\XYahPWu.exe
  2⤵
  PID:8540
- C:\Windows\System\dHXOeBX.exe
  C:\Windows\System\dHXOeBX.exe
  2⤵
  PID:8460
- C:\Windows\System\pwITAHZ.exe
  C:\Windows\System\pwITAHZ.exe
  2⤵
  PID:7400
- C:\Windows\System\dpYZukl.exe
  C:\Windows\System\dpYZukl.exe
  2⤵
  PID:6028
- C:\Windows\System\MuTROni.exe
  C:\Windows\System\MuTROni.exe
  2⤵
  PID:5908
- C:\Windows\System\QNphkMH.exe
  C:\Windows\System\QNphkMH.exe
  2⤵
  PID:2024
- C:\Windows\System\liHWSDI.exe
  C:\Windows\System\liHWSDI.exe
  2⤵
  PID:12652
- C:\Windows\System\xiUAWJo.exe
  C:\Windows\System\xiUAWJo.exe
  2⤵
  PID:468
- C:\Windows\System\KOpKEhW.exe
  C:\Windows\System\KOpKEhW.exe
  2⤵
  PID:7716
- C:\Windows\System\YarqUgg.exe
  C:\Windows\System\YarqUgg.exe
  2⤵
  PID:8124
- C:\Windows\System\hcpfpvX.exe
  C:\Windows\System\hcpfpvX.exe
  2⤵
  PID:9196
- C:\Windows\System\SakifQC.exe
  C:\Windows\System\SakifQC.exe
  2⤵
  PID:10760
- C:\Windows\System\XnYHUKq.exe
  C:\Windows\System\XnYHUKq.exe
  2⤵
  PID:6312
- C:\Windows\System\RUNgAIu.exe
  C:\Windows\System\RUNgAIu.exe
  2⤵
  PID:6360
- C:\Windows\System\BEIiFpP.exe
  C:\Windows\System\BEIiFpP.exe
  2⤵
  PID:8376
- C:\Windows\System\SNCfgkF.exe
  C:\Windows\System\SNCfgkF.exe
  2⤵
  PID:6680
- C:\Windows\System\CbzPxxe.exe
  C:\Windows\System\CbzPxxe.exe
  2⤵
  PID:8472
- C:\Windows\System\MijQUNs.exe
  C:\Windows\System\MijQUNs.exe
  2⤵
  PID:4436
- C:\Windows\System\BLxnZLq.exe
  C:\Windows\System\BLxnZLq.exe
  2⤵
  PID:8096
- C:\Windows\System\yvMaITg.exe
  C:\Windows\System\yvMaITg.exe
  2⤵
  PID:6792
- C:\Windows\System\aNMpify.exe
  C:\Windows\System\aNMpify.exe
  2⤵
  PID:8888
- C:\Windows\System\YOkOqbm.exe
  C:\Windows\System\YOkOqbm.exe
  2⤵
  PID:8592
- C:\Windows\System\QhINOVo.exe
  C:\Windows\System\QhINOVo.exe
  2⤵
  PID:11384
- C:\Windows\System\acjxxwJ.exe
  C:\Windows\System\acjxxwJ.exe
  2⤵
  PID:8604
- C:\Windows\System\aZigRgi.exe
  C:\Windows\System\aZigRgi.exe
  2⤵
  PID:8800
- C:\Windows\System\VnHzYbY.exe
  C:\Windows\System\VnHzYbY.exe
  2⤵
  PID:8100
- C:\Windows\System\nJRMhQe.exe
  C:\Windows\System\nJRMhQe.exe
  2⤵
  PID:8288
- C:\Windows\System\fyGktSF.exe
  C:\Windows\System\fyGktSF.exe
  2⤵
  PID:6828
- C:\Windows\System\vuKuBUA.exe
  C:\Windows\System\vuKuBUA.exe
  2⤵
  PID:7200
- C:\Windows\System\neoNICX.exe
  C:\Windows\System\neoNICX.exe
  2⤵
  PID:388
- C:\Windows\System\CWcAEWB.exe
  C:\Windows\System\CWcAEWB.exe
  2⤵
  PID:6128
- C:\Windows\System\eHEuzDh.exe
  C:\Windows\System\eHEuzDh.exe
  2⤵
  PID:6448
- C:\Windows\System\VqplkNQ.exe
  C:\Windows\System\VqplkNQ.exe
  2⤵
  PID:4352
- C:\Windows\System\AwdhhBr.exe
  C:\Windows\System\AwdhhBr.exe
  2⤵
  PID:11816
- C:\Windows\System\SJMUXEP.exe
  C:\Windows\System\SJMUXEP.exe
  2⤵
  PID:6732
- C:\Windows\System\AlfxIQI.exe
  C:\Windows\System\AlfxIQI.exe
  2⤵
  PID:11792
- C:\Windows\System\PHjWjYy.exe
  C:\Windows\System\PHjWjYy.exe
  2⤵
  PID:8848
- C:\Windows\System\biOkdXq.exe
  C:\Windows\System\biOkdXq.exe
  2⤵
  PID:2344
- C:\Windows\System\fJbDQFO.exe
  C:\Windows\System\fJbDQFO.exe
  2⤵
  PID:12040
- C:\Windows\System\VFiCYuj.exe
  C:\Windows\System\VFiCYuj.exe
  2⤵
  PID:9324
- C:\Windows\System\KlVKjhp.exe
  C:\Windows\System\KlVKjhp.exe
  2⤵
  PID:9356
- C:\Windows\System\IkcsBME.exe
  C:\Windows\System\IkcsBME.exe
  2⤵
  PID:10180
- C:\Windows\System\fiivPoh.exe
  C:\Windows\System\fiivPoh.exe
  2⤵
  PID:9656
- C:\Windows\System\CXGFyFE.exe
  C:\Windows\System\CXGFyFE.exe
  2⤵
  PID:6488
- C:\Windows\System\jzSaTZR.exe
  C:\Windows\System\jzSaTZR.exe
  2⤵
  PID:8532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rb2mvzt1.ubt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CBGyvmu.exe

Filesize
1.6MB

MD5
6f5186e38e257bc9bbb19fee1b51dfae

SHA1
07cb4c53ef0372641c633a6ca56e5c7483a31657

SHA256
1ed20b1f6977d43fa49ebdfb9e88e7b7b8bb234bb790b0a3eb735a90460aa295

SHA512
01237fc106ca83342d9f34b5f37648cf5abd90095e310d96ff09e24f517c2922f8f3b122637578738212e7cb0ac9fc834df81aaa5f385514cb5d6a4b3d208b43

Download Submit
C:\Windows\System\CjqGjpl.exe

Filesize
1.6MB

MD5
f37b49c679a093225e6a370b1875f0cb

SHA1
385fe5789ba7dbf7aa42c59416ffd8059df55164

SHA256
8bcd4f3402af785ee3b4f7c67cced198088e28c154458dd36f27584ea557d6cf

SHA512
7732ac803775b7bce84138bcb6ae4831287ff29e8d7c253538e1a67d05a7f7924bf58d243083520924b947eab028771c99e03bb9cdd32659ac1001d01e174aa6

Download Submit
C:\Windows\System\DbaNfgK.exe

Filesize
1.6MB

MD5
dab2ca89dc6e7f4a605e399b90d9dfe9

SHA1
5a84595aed0119d951a1a7717449d1381c6bc261

SHA256
f9457496cf8c3ad2db4226d060ac3dda6e41f8020bf3e0470d265b23653047f5

SHA512
234389913cd278aa4ab1447967950d2717890050f7e92b3a40d49772b16921490cc7185fbc95b73ab8084b4412585838e31af6542df1d2a764f116067cb0c979

Download Submit
C:\Windows\System\EMHbIpV.exe

Filesize
1.6MB

MD5
491e80efb2a62f0a92ad51f0a02effbb

SHA1
8f35bd1535ac45bb7fcaa5a694ff5ce725ac6fb8

SHA256
04ba8e4fdc2d05d0012e90417e83f95245c05cdb63fbe279f6b2aefe46f098d5

SHA512
e8edf63ba3e032c6e55a2e070a687ec3e00151149343befec535dc26ad349f9be9b1b8226ad9f3bbb1a75bf8e4e9d234b7f7e43a21aeccf6f19a281239c9c3ae

Download Submit
C:\Windows\System\EvtmMia.exe

Filesize
1.6MB

MD5
8d0411668782aa9530ed02efb101fa18

SHA1
4ad29f56f70fd35b2f0b553626f8b23aabfc6ad1

SHA256
137a0cfa6789cb30926f5a2decad4fda307625cab54fa14bc157e6cf1d586b68

SHA512
b29b35a04d5317c32f49d24aa6d50829230ff97a43dfdcaf79e6a076a7a7ba88ade4a367726b0eea97fc1645255c7c9e2b550da2086e30bd41592dbf92930254

Download Submit
C:\Windows\System\HLfQvSA.exe

Filesize
1.6MB

MD5
fe5949bf01ba637b22127eec2f8fa34d

SHA1
4ac038bbfa23b02d405769c597ef1a5110e3bc18

SHA256
4c587361db041e62fd81c34ca09d672890313349aa5947a97eb613939f46d9a6

SHA512
bdd1ed58e9ebbe4903ffb5bfb06703ee3b98fa9364a8613344ce9add3656b4eca8dd99183b51a2e0a013cafea64eb68a4ea0e1d9072828d4cb8d62250b7e7dc0

Download Submit
C:\Windows\System\JSoBifp.exe

Filesize
1.6MB

MD5
1d346db4da8339da855cebe9b66eab26

SHA1
510b748f906193c37969e5ea5a93a75689e24bd0

SHA256
0ff3a77f0907aacaca0f691bea04bb13170fa4b1fc809916f9a2a9ab8b911011

SHA512
383ff9c4b008ca6292335a71495103f9d796e9475dbe0701b54c062647d3865454e25ef5857d959620b77e34734e516fb24bcc4adb20c4b84d6dec9d303f65b7

Download Submit
C:\Windows\System\KbqGibu.exe

Filesize
1.6MB

MD5
e836ffb6f259fd6adcdcefed85f82929

SHA1
47e77fe60099cfe3b91bc8479f1850b69ce5e35d

SHA256
de1a140e5c2d558ccec1aa7a4dc661124df5063bf9df6928a3e19ef049e3acc8

SHA512
8bb369009db45155fb99b403b3aa1150187e4f6e556b7db1bd4a6d85db578acc67691d3d76dcc8955483551c85e43f902c7aeb890c2b70aa3ffe042f563ce181

Download Submit
C:\Windows\System\KqYQLgp.exe

Filesize
1.6MB

MD5
bbee3779ea5244c6bfdd539b9a3252fc

SHA1
f3af22d199ed64da5f1ffbd131e7a5dad534b668

SHA256
f9ffb116b5682cb8a42d68cd2f385abc5ac55dea44f2192e7d2c692f040af8dd

SHA512
3d0571ba297eabbb770e6b2750f0da5dca24f6766fdffcaebaaefd140d653cae6d2b30efa89b73087c3b3c2ca1857c720e3f4757885bf7cb880748353ab9fcd4

Download Submit
C:\Windows\System\OFXIMgl.exe

Filesize
1.6MB

MD5
f11097b0263a3da8d1893cd8a77b7764

SHA1
ce9af3f8cdf4aa4117871d35d77b34ba62a86a1a

SHA256
41fa1bcdf7b2bd185af17e70da2b377bfaebd8d2263ecb8f1e7212e00e61e0e9

SHA512
8df94bf977834235e5021faf8956a2b88e32c31b19eb4f518f34b688ba61f6f227e01647caedc4792b2f9dc5c06e01ea01b98909c22ed0d1dec9f2360a013cd4

Download Submit
C:\Windows\System\Tvoprrv.exe

Filesize
1.6MB

MD5
3290070048da388053af473795b91767

SHA1
861fb08e99afca46da63bbc269e937756c54f4c3

SHA256
d969d5b2d00b8f848b252d3efacf5a8fb37f64a899fcda5400e4266895d5a9e2

SHA512
0312336a8944bd3e0d87a029beb18cfa687c65d086c299d3e5d3b3f1baa332bca2212047c85674678fb26d73821e05f7c9cc5605680b2b37065acca45f215fb9

Download Submit
C:\Windows\System\WJVEsKC.exe

Filesize
1.6MB

MD5
9226f0575e7e74935a8ea2e4822aaade

SHA1
bda4b0ad95d6f5d7cef74b61144e011316ed1c7c

SHA256
d70162b20d070a1add1871225b996fa93c8b9e927a5128bfc7dacd6753e13799

SHA512
9c468f17847f3e129ab1a77873bd6ca072e7b797498a46475310d9a430c23152e88ba38192b2c5cd68ec9e57c06c6773c7c8c98d43da99753541b7eb080b3716

Download Submit
C:\Windows\System\ZOlmdWM.exe

Filesize
1.6MB

MD5
3984917964a7560e88dcdf3739638431

SHA1
1c620b631a12c8a54c3140e2a920b11ff48ab780

SHA256
44837c59c3ab44c8cb8cc7e376a4147b628abf67b05ee3c44def091025acef98

SHA512
6250141a8e7a674ff2304b7c52cd790e33d21972a8d694ff48f13f99f0e4384e773f3c8ac51f6535807935a1ceff14222c223aa247073954766b6c3874bd4504

Download Submit
C:\Windows\System\aWZiKOp.exe

Filesize
1.6MB

MD5
81f9f8ecc2f7f8f68301f2b02eca32ca

SHA1
fe83e53eb801c47f0376d8105766f45ebeafdc94

SHA256
e8bcaa4f4a07c4cacdc9324fdb2486712f2d6b14eca826d1ed39af43363c3108

SHA512
6f5d80b44bfa5cb395307aa8cf833d315a97936e3c39ec731a8b683712e5b0ef8ea322764861c707b55778c5d393d5b77d44222535253d8bca354ed147c27a02

Download Submit
C:\Windows\System\bBeVoGa.exe

Filesize
1.6MB

MD5
4f35b48d1bbd1b00b1db6b7f573e1a31

SHA1
255775f9a5dc6f4af754f12d4121fa6ebfc3054b

SHA256
3ea76696015919b1d7c76adadfe65e27d7cd8b67e4f6a245a346c698e07a57d4

SHA512
cfc086e2040476f3da33bb7441c9f7574a5ce74469e2d0ed14cadfc697743e1a2c8ea200561f27ba5a30798885b1f97ae864572b81c8455fcee6f5f311c88c71

Download Submit
C:\Windows\System\bbjwKzv.exe

Filesize
8B

MD5
3fa896e6e03a6c36944841b51d39e0d4

SHA1
4aefb55d27e72ef2d47403b0c8ce06d172004a35

SHA256
400669c3a4cce9fc0e15e111795da46968d6aa425fadb66d6e8c94b8a55f448d

SHA512
612aa9da451a214208d9de281e4424e86a677aa7a795a809d046b92d6bba85793ab2e58fb70475807546f0c1e5ee525dd22de24b67b42735f5d59a71d847dc4f

Download Submit
C:\Windows\System\buCCGZz.exe

Filesize
1.6MB

MD5
ea7b68456cb449fa2568c4a9db91b018

SHA1
609137f04a722efcc82f8460266756c1718ef074

SHA256
cd585928eb06d5b5e71d0b79c0ba6a18565812e337baa195839d4e354449faa3

SHA512
25b6174115c617a3e9df078248152a343ded92565f6f4e97ba154e2f4cda3f1ce68fb65b8bef5e6dc13f0aff06cc52015c54dede05915f1ef9eb743e57703eeb

Download Submit
C:\Windows\System\gWAiyaO.exe

Filesize
1.6MB

MD5
0b251750d8dbd07a061cf871296aeb5e

SHA1
146209119914e7c25e75c7bb72f3428b01f9e92d

SHA256
7842a3cbba5dd166c23b358df23e2c7f43a87089ccd8d447404f0078a247dbd9

SHA512
cc9a813d7d10a227a03d5d34a598e03723cbc1f63805cc527d78d666bee8a2d6bee8e638dbde1bbda5cfd06e633ff2841e83e212390fc28afb230d6bc9de9d11

Download Submit
C:\Windows\System\hQsOgbA.exe

Filesize
1.6MB

MD5
ced30cc6dbed88c25a5eff462c24ff5f

SHA1
e6643f2131038dfb1911d6448e2c8ae9600cd4de

SHA256
1de8cf3a3c9666e7f35a1341c3005332c4e42471f4c6727f4472a277c76fb778

SHA512
a6a180e3286413b9448a406bc0450047097b099410bde12c201c35ff8f0a3b6adae025365c1a38656c83dc0ca8c2bce4b06399c89e51f9aebca6b00b50c7f100

Download Submit
C:\Windows\System\iFdXjHb.exe

Filesize
1.6MB

MD5
6c4064d2eabb78ae7dbab3f679128ba3

SHA1
3ea766fd092a03099c09cea5126ac18588d0cadb

SHA256
40b61e3da549e70d4dd6f3b1034e1b28764985b9cde4decd5caa05548653070d

SHA512
fbde8f48db1fa2a8cf56292ea32574814f56720b14777182390953de0461dfeac249967ea54bc4cad2968c64616c22cf17cd35f53f448d62e60c1a7f235e1701

Download Submit
C:\Windows\System\iVrVdLz.exe

Filesize
1.6MB

MD5
b23bddf160eca5da9774077093a35982

SHA1
dc0a8b79ebc97cc9814caf8436c3b2ad5ffec7b6

SHA256
b14819713b02a08dd076008ce06157f878697d0c984d79297b3d221e72ba112f

SHA512
c32b39b174e23fd0392090dc359797cd38c3cb315158657066c754f01228a3c82e98777f909392b1af248d6468276869ed7067ea8cd9b676ac2bfb78308dbc29

Download Submit
C:\Windows\System\jnNZKoo.exe

Filesize
1.6MB

MD5
ed8116564ea1863ee4111c2169ab279e

SHA1
9dd73c4cc4b5fdab711e77dcdea237c6218a6aca

SHA256
b5bfb5f4beabdf09bd52f60e91f072dc51fcc4d0681071398210157067f38c6d

SHA512
dca9f078f7b8a42032778fe83b2092a1defbe52018c919043f20f1962c607ec592a5d835ce1ca9de7a903743a1cffe9242f27bb7e9d5ca96f3a8de70e7069dcd

Download Submit
C:\Windows\System\mirFLuS.exe

Filesize
1.6MB

MD5
440f63181808e4e6a9e39e37a9209dec

SHA1
d1e44998bf68df7f0e00ec1b2d39620dfab1811d

SHA256
b7c404b69ae4884dcde88aefe7968574c6c3d0b3c45c100eeec8f73be97e532b

SHA512
fdea6218c88fe98444d7f156e24d04fe544a7f3e2e5f98b7dcdda7bfb9a077efbc773f6c2cdf20808a72f10b82b7b3d01e75eee89dfdf6199b87fee12af829b7

Download Submit
C:\Windows\System\qFcmRow.exe

Filesize
1.6MB

MD5
551f105b616ebf6ca37244a673ec8742

SHA1
c5a42ce7e9adced753be2760eb62bbf269813459

SHA256
ed6d0a65d6fae831e73ede4a48196ad08c854f3c25ba75cd15e5cc6d697dab18

SHA512
0548a67f9e28c7d675abe4db605ecf14b5a1ea23caabc544f05224ea92fdc0ffa609f23b18be6a50e98f2d2f587bd28147c5d4f0cefcc71112cda3a7612945cc

Download Submit
C:\Windows\System\rGYJFKg.exe

Filesize
1.6MB

MD5
032420038c0d51bb79458dba162eaca7

SHA1
ebb06e2bd642d0de5536f754e21f55779acbd288

SHA256
9716db92a4fdd72c64cd20525167fb6555d2d2a2732fbf241a761e2fc33e4875

SHA512
5f42e2f9b07640d40e5924eab1b907e3f1e4492c022bfc6ff1d6be80e513542c0809623dfbc515b5bfbb9c282e18756c839181ed66efb24bc16da7f445425c23

Download Submit
C:\Windows\System\rYMsXVA.exe

Filesize
1.6MB

MD5
e8af728739331d9ae90432b1a0a33418

SHA1
3ec604f246b2bb09c58d174321f36d21f9904cae

SHA256
714c3afed376862d6771bde58e12797553ca554fb8ff4326be930708fefb96a5

SHA512
5cf8db9e2b9a443458741c30164b1f1820f56c9efd11db4d5ea211a0e1abc024b4e0d730189baea9bcecac355adfb7b43db795ee0284c46ed789deaaf73d2ddc

Download Submit
C:\Windows\System\sNOyabu.exe

Filesize
1.6MB

MD5
746fb0f5200ef81d271fa5f89ce09c55

SHA1
36cd297fc24938506618b26d5396db7f0f60bb19

SHA256
60473966ca62e9cc920ceefa225ec6de4ed46e689bef213b32c1811cd1489f54

SHA512
17ae54e17889f84844a735b3dde9eb0817b66547bf5de4c82aa8ac9af92798c3d7122cd4f03a6735c8ff2afe3886826f9a172e9741db74480cff65efc4f1614c

Download Submit
C:\Windows\System\tFROPYm.exe

Filesize
1.6MB

MD5
89594f44fb1279989630108c5b790782

SHA1
1a1193ad853447ca0b9fcc0633f2511d5593082d

SHA256
0db02b24ec50805bd1a5acc5291af3fbbe70b90dda7dba7db34fbac6e3748d67

SHA512
d95701d0b2a3ebbca38a82283359680e0b33fe57267ab64b0848e5ac9f8e4ed691be6e73dae4e608fcecb5919d5e0a6de209301b8b393a88fee04f7d7e38804c

Download Submit
C:\Windows\System\uLwngvl.exe

Filesize
1.6MB

MD5
9cc6748b4063484600a436e35df6ca0d

SHA1
2994d8067ddf8a3310f8c2c1d699edd0e7d1a1ea

SHA256
aa40d7827f90672c144902c87e1ef3dea8498526b36b70dc9324d1aba7d26e5f

SHA512
915720161b9535cb3e9d8edf55d6fecceeeaa344f0e2070e5c5c710ac35ad4f06872f7e10a84752f0d71714394ef5e27d31e3b151199a6fe1487e74a2fff7a96

Download Submit
C:\Windows\System\ukfYAsx.exe

Filesize
1.6MB

MD5
b6d867b88a8e868e15ad7b1102590aa8

SHA1
fe09080e6a97dbb851e85c40ff61c536184e2850

SHA256
11796bf7d26ffe9c3852b7b78993b1d09df4262e8f0e53f9b3fcee0eaad79fcb

SHA512
900517c8d10d38be6496f82365675948d44033627236c1f8f91437c4f3b128213ad78c89afec3236feec6123771da3f43873fbd6836e89e95975751e263c6876

Download Submit
C:\Windows\System\xmaGcSF.exe

Filesize
1.6MB

MD5
5b3d4e2fa79a1e8eeb1e05db24deea17

SHA1
bd993d14030a8899d46e1ce241b484253e215ebf

SHA256
e88c8572e2fa76448ba380c809b15c11e409eb2265890acf4e6464a0200f394a

SHA512
320e1c99f5eef919cedf729cf669b6759e728e161f740e8ec1ef54e7c32cbaccf177ddeaaa30a1e9040f557a7cf3cbd15e4de1a0754890f5e5496b00902183df

Download Submit
C:\Windows\System\yFaxEHD.exe

Filesize
1.6MB

MD5
e5d9561b6eee373b657a9f5a7654b6bb

SHA1
27c557c0bb91a7e08e7d99d64c31bf959e5b6b06

SHA256
ac27d307dd3e21ef4756474ea62c8709e19fe3a3351630e6cad8620efa0fa275

SHA512
45fe402e6ad951dd1e9814be3c5ae52b164a871f9aa47ff56fc1e47eafcb2bc59929cd95705635df17e254050258692b5d6f0b2740314a24ed7315845e56aa3d

Download Submit
C:\Windows\System\yxbohUp.exe

Filesize
1.6MB

MD5
68948cb66e33147cc81a9251746e9fbd

SHA1
175410bd0db374ef97b9581b6fb25b1c09353c6a

SHA256
38af21605c80e2f49f18854329e065218116ed8534b918c145a06e00c8a7aa99

SHA512
856454ed02f5d868560d21862c6ce3def77c2184b235f61c465862a223d30e9418a844a2857f48f6306b77129db54eed79bfe89a1f0f3711f231490bac5816aa

Download Submit
memory/220-120-0x00007FF7BF630000-0x00007FF7BFA22000-memory.dmp

Filesize
3.9MB

Download
memory/220-3723-0x00007FF7BF630000-0x00007FF7BFA22000-memory.dmp

Filesize
3.9MB

Download
memory/440-118-0x00007FF60ACE0000-0x00007FF60B0D2000-memory.dmp

Filesize
3.9MB

Download
memory/440-3712-0x00007FF60ACE0000-0x00007FF60B0D2000-memory.dmp

Filesize
3.9MB

Download
memory/456-117-0x00007FF62C0F0000-0x00007FF62C4E2000-memory.dmp

Filesize
3.9MB

Download
memory/456-3685-0x00007FF62C0F0000-0x00007FF62C4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-114-0x00007FF699B50000-0x00007FF699F42000-memory.dmp

Filesize
3.9MB

Download
memory/1232-3722-0x00007FF699B50000-0x00007FF699F42000-memory.dmp

Filesize
3.9MB

Download
memory/1540-3750-0x00007FF6C3BB0000-0x00007FF6C3FA2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-381-0x00007FF6C3BB0000-0x00007FF6C3FA2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-121-0x00007FF756F00000-0x00007FF7572F2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-3733-0x00007FF756F00000-0x00007FF7572F2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-384-0x00007FF66D560000-0x00007FF66D952000-memory.dmp

Filesize
3.9MB

Download
memory/2012-3753-0x00007FF66D560000-0x00007FF66D952000-memory.dmp

Filesize
3.9MB

Download
memory/2500-3746-0x00007FF628150000-0x00007FF628542000-memory.dmp

Filesize
3.9MB

Download
memory/2500-378-0x00007FF628150000-0x00007FF628542000-memory.dmp

Filesize
3.9MB

Download
memory/2636-3678-0x00007FF7A5BA0000-0x00007FF7A5F92000-memory.dmp

Filesize
3.9MB

Download
memory/2636-29-0x00007FF7A5BA0000-0x00007FF7A5F92000-memory.dmp

Filesize
3.9MB

Download
memory/2664-3703-0x00007FF633840000-0x00007FF633C32000-memory.dmp

Filesize
3.9MB

Download
memory/2664-95-0x00007FF633840000-0x00007FF633C32000-memory.dmp

Filesize
3.9MB

Download
memory/2672-3670-0x00007FF63A0B0000-0x00007FF63A4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-7-0x00007FF63A0B0000-0x00007FF63A4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-3737-0x00007FF7A46F0000-0x00007FF7A4AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-123-0x00007FF7A46F0000-0x00007FF7A4AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-3675-0x00007FF6518E0000-0x00007FF651CD2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-72-0x00007FF6518E0000-0x00007FF651CD2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-3696-0x00007FF775BF0000-0x00007FF775FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-113-0x00007FF775BF0000-0x00007FF775FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3440-76-0x00007FF7FE0A0000-0x00007FF7FE492000-memory.dmp

Filesize
3.9MB

Download
memory/3440-3690-0x00007FF7FE0A0000-0x00007FF7FE492000-memory.dmp

Filesize
3.9MB

Download
memory/3536-3758-0x00007FF7686B0000-0x00007FF768AA2000-memory.dmp

Filesize
3.9MB

Download
memory/3536-387-0x00007FF7686B0000-0x00007FF768AA2000-memory.dmp

Filesize
3.9MB

Download
memory/3544-3701-0x00007FF665C80000-0x00007FF666072000-memory.dmp

Filesize
3.9MB

Download
memory/3544-86-0x00007FF665C80000-0x00007FF666072000-memory.dmp

Filesize
3.9MB

Download
memory/3572-119-0x00007FF7EAFC0000-0x00007FF7EB3B2000-memory.dmp

Filesize
3.9MB

Download
memory/3572-3719-0x00007FF7EAFC0000-0x00007FF7EB3B2000-memory.dmp

Filesize
3.9MB

Download
memory/4328-2923-0x00007FF83D603000-0x00007FF83D605000-memory.dmp

Filesize
8KB

Download
memory/4328-3589-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-8-0x00007FF83D603000-0x00007FF83D605000-memory.dmp

Filesize
8KB

Download
memory/4328-24-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-400-0x0000027BF4100000-0x0000027BF48A6000-memory.dmp

Filesize
7.6MB

Download
memory/4328-45-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-69-0x0000027BF35A0000-0x0000027BF35C2000-memory.dmp

Filesize
136KB

Download
memory/4384-3697-0x00007FF7CD7D0000-0x00007FF7CDBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4384-106-0x00007FF7CD7D0000-0x00007FF7CDBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4400-99-0x00007FF6538C0000-0x00007FF653CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4400-3707-0x00007FF6538C0000-0x00007FF653CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4644-28-0x00007FF6F68F0000-0x00007FF6F6CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4644-3681-0x00007FF6F68F0000-0x00007FF6F6CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4668-0-0x00007FF67FAD0000-0x00007FF67FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/4668-1-0x000002AE562C0000-0x000002AE562D0000-memory.dmp

Filesize
64KB

Download
memory/4800-377-0x00007FF7DA1D0000-0x00007FF7DA5C2000-memory.dmp

Filesize
3.9MB

Download
memory/4800-3741-0x00007FF7DA1D0000-0x00007FF7DA5C2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-385-0x00007FF724AB0000-0x00007FF724EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-3755-0x00007FF724AB0000-0x00007FF724EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-122-0x00007FF6234E0000-0x00007FF6238D2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-3732-0x00007FF6234E0000-0x00007FF6238D2000-memory.dmp

Filesize
3.9MB

Download