xmrig | fd1af21218f85aef39c482b00bb29d47a4e832ab0af49ab75dfde4d83bf8220d

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

898eb64e7b7f04dfb0a2b4dc06d71360N.exe
Size

1.4MB
MD5

898eb64e7b7f04dfb0a2b4dc06d71360
SHA1

ac072287cc4ede72b7b27c378642b30f45bfa1b9
SHA256

fd1af21218f85aef39c482b00bb29d47a4e832ab0af49ab75dfde4d83bf8220d
SHA512

10567a37e9afbfbf4ebd6dd4babcae3642fa4ecc1cd3c970bd1f3c813a8da1ad162c7a15f61f0e642047840ea97ca913ea72755282705b61ddd90f80e4aa293a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZ204oVTUG7FAtOeqTZ:Lz071uv4BPMkibTIA5JnJ10+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/memory/3980-54-0x00007FF7E29C0000-0x00007FF7E2DB2000-memory.dmp	xmrig
behavioral2/memory/4916-67-0x00007FF776360000-0x00007FF776752000-memory.dmp	xmrig
behavioral2/memory/4348-78-0x00007FF75C140000-0x00007FF75C532000-memory.dmp	xmrig
behavioral2/memory/208-83-0x00007FF630FF0000-0x00007FF6313E2000-memory.dmp	xmrig
behavioral2/memory/436-151-0x00007FF745DF0000-0x00007FF7461E2000-memory.dmp	xmrig
behavioral2/memory/5020-182-0x00007FF62E060000-0x00007FF62E452000-memory.dmp	xmrig
behavioral2/memory/2136-176-0x00007FF6436D0000-0x00007FF643AC2000-memory.dmp	xmrig
behavioral2/memory/3048-170-0x00007FF75D4B0000-0x00007FF75D8A2000-memory.dmp	xmrig
behavioral2/memory/4224-163-0x00007FF72AF10000-0x00007FF72B302000-memory.dmp	xmrig
behavioral2/memory/2660-150-0x00007FF60BCD0000-0x00007FF60C0C2000-memory.dmp	xmrig
behavioral2/memory/1680-149-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp	xmrig
behavioral2/memory/2376-143-0x00007FF637540000-0x00007FF637932000-memory.dmp	xmrig
behavioral2/memory/4976-108-0x00007FF6F0410000-0x00007FF6F0802000-memory.dmp	xmrig
behavioral2/memory/3784-80-0x00007FF700480000-0x00007FF700872000-memory.dmp	xmrig
behavioral2/memory/2652-77-0x00007FF617630000-0x00007FF617A22000-memory.dmp	xmrig
behavioral2/memory/4780-74-0x00007FF620120000-0x00007FF620512000-memory.dmp	xmrig
behavioral2/memory/1000-60-0x00007FF6C6B80000-0x00007FF6C6F72000-memory.dmp	xmrig
behavioral2/memory/1336-43-0x00007FF762680000-0x00007FF762A72000-memory.dmp	xmrig
behavioral2/memory/1532-877-0x00007FF746C70000-0x00007FF747062000-memory.dmp	xmrig
behavioral2/memory/3620-999-0x00007FF685940000-0x00007FF685D32000-memory.dmp	xmrig
behavioral2/memory/2280-997-0x00007FF712C00000-0x00007FF712FF2000-memory.dmp	xmrig
behavioral2/memory/4680-1250-0x00007FF635690000-0x00007FF635A82000-memory.dmp	xmrig
behavioral2/memory/972-1370-0x00007FF71FE20000-0x00007FF720212000-memory.dmp	xmrig
behavioral2/memory/1964-1508-0x00007FF641590000-0x00007FF641982000-memory.dmp	xmrig
behavioral2/memory/3980-2743-0x00007FF7E29C0000-0x00007FF7E2DB2000-memory.dmp	xmrig
behavioral2/memory/3784-2762-0x00007FF700480000-0x00007FF700872000-memory.dmp	xmrig
behavioral2/memory/4916-2774-0x00007FF776360000-0x00007FF776752000-memory.dmp	xmrig
behavioral2/memory/4348-2770-0x00007FF75C140000-0x00007FF75C532000-memory.dmp	xmrig
behavioral2/memory/2280-2799-0x00007FF712C00000-0x00007FF712FF2000-memory.dmp	xmrig
behavioral2/memory/3620-2829-0x00007FF685940000-0x00007FF685D32000-memory.dmp	xmrig
behavioral2/memory/4680-2836-0x00007FF635690000-0x00007FF635A82000-memory.dmp	xmrig
behavioral2/memory/1680-2804-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp	xmrig
behavioral2/memory/1532-2803-0x00007FF746C70000-0x00007FF747062000-memory.dmp	xmrig
behavioral2/memory/2660-2870-0x00007FF60BCD0000-0x00007FF60C0C2000-memory.dmp	xmrig
behavioral2/memory/3048-2890-0x00007FF75D4B0000-0x00007FF75D8A2000-memory.dmp	xmrig
behavioral2/memory/1512-4126-0x00007FF758A10000-0x00007FF758E02000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	4832	powershell.exe
10	4832	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4832	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4780	YujrDZq.exe
1336	eEhaTKq.exe
3980	ZbRyGgb.exe
1000	DtAUjVD.exe
2652	DSnupqp.exe
4348	AOFqSoF.exe
3784	EEHtYXf.exe
4916	JIovcuR.exe
208	RmhGLQZ.exe
1512	jqWUQvK.exe
1680	mLlfSTE.exe
5020	OVlyhoh.exe
1532	EOAjxbu.exe
2280	ZiPVtNl.exe
3620	mIYVnce.exe
4680	lUsXXeT.exe
972	HRHvTDI.exe
1964	wiURsiB.exe
2376	zjkAKTj.exe
2660	jlsYuSx.exe
436	tpzlpHW.exe
4224	gvEjkjP.exe
3048	pnXmZgv.exe
2136	YOlUXgx.exe
2668	OTRTIHq.exe
1292	ZdzVSBN.exe
3820	cwbjYVq.exe
4284	RRzFkhv.exe
4688	FKiwBST.exe
4604	tfjWCbS.exe
4932	xRRCgmT.exe
936	wisbJSp.exe
4092	voCJxcR.exe
4492	bUFXBFf.exe
4296	NrNsoUp.exe
2592	HFcOZzS.exe
2788	YyUoDae.exe
3824	gjpArdz.exe
792	TBBPVUr.exe
2936	zFhraUf.exe
2396	AkRUbNN.exe
3136	hQWagsB.exe
1088	zTrmCuh.exe
232	yjVClFv.exe
3612	UXcZedc.exe
3444	CTHGZRR.exe
5024	OjNdIdA.exe
1416	yOwZMxx.exe
1744	rIcaSCs.exe
4520	KPcMfah.exe
4456	oyNNeEu.exe
540	wkDwuaH.exe
2188	ZFmRqns.exe
3412	NubyzmJ.exe
3696	EmadJCD.exe
2224	LszvOuG.exe
2868	LCQExkg.exe
3000	pTIdUVH.exe
1364	iMCWGqP.exe
3952	KzlgRiK.exe
3276	aIjcjhM.exe
2196	OGDAvwe.exe
4536	qvZbOkC.exe
4516	jsCHooM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4976-0-0x00007FF6F0410000-0x00007FF6F0802000-memory.dmp	upx
behavioral2/files/0x00080000000234ed-6.dat	upx
behavioral2/files/0x00070000000234f2-8.dat	upx
behavioral2/files/0x00070000000234f1-9.dat	upx
behavioral2/files/0x00070000000234f4-27.dat	upx
behavioral2/files/0x00080000000234f7-51.dat	upx
behavioral2/files/0x00070000000234f5-53.dat	upx
behavioral2/memory/3980-54-0x00007FF7E29C0000-0x00007FF7E2DB2000-memory.dmp	upx
behavioral2/memory/4916-67-0x00007FF776360000-0x00007FF776752000-memory.dmp	upx
behavioral2/files/0x00080000000234f6-70.dat	upx
behavioral2/files/0x00070000000234fa-75.dat	upx
behavioral2/memory/4348-78-0x00007FF75C140000-0x00007FF75C532000-memory.dmp	upx
behavioral2/memory/208-83-0x00007FF630FF0000-0x00007FF6313E2000-memory.dmp	upx
behavioral2/files/0x00080000000234ee-87.dat	upx
behavioral2/files/0x00070000000234fc-95.dat	upx
behavioral2/files/0x00070000000234fd-101.dat	upx
behavioral2/files/0x00070000000234ff-111.dat	upx
behavioral2/files/0x0007000000023502-129.dat	upx
behavioral2/memory/436-151-0x00007FF745DF0000-0x00007FF7461E2000-memory.dmp	upx
behavioral2/files/0x0007000000023507-159.dat	upx
behavioral2/files/0x000700000002350c-190.dat	upx
behavioral2/files/0x000700000002350f-205.dat	upx
behavioral2/files/0x000700000002350d-203.dat	upx
behavioral2/files/0x000700000002350e-200.dat	upx
behavioral2/files/0x000700000002350b-193.dat	upx
behavioral2/files/0x000700000002350a-188.dat	upx
behavioral2/files/0x0007000000023509-183.dat	upx
behavioral2/memory/5020-182-0x00007FF62E060000-0x00007FF62E452000-memory.dmp	upx
behavioral2/files/0x0007000000023508-177.dat	upx
behavioral2/memory/2136-176-0x00007FF6436D0000-0x00007FF643AC2000-memory.dmp	upx
behavioral2/memory/3048-170-0x00007FF75D4B0000-0x00007FF75D8A2000-memory.dmp	upx
behavioral2/memory/1512-169-0x00007FF758A10000-0x00007FF758E02000-memory.dmp	upx
behavioral2/files/0x0007000000023506-164.dat	upx
behavioral2/memory/4224-163-0x00007FF72AF10000-0x00007FF72B302000-memory.dmp	upx
behavioral2/files/0x0007000000023505-157.dat	upx
behavioral2/files/0x0007000000023504-152.dat	upx
behavioral2/memory/2660-150-0x00007FF60BCD0000-0x00007FF60C0C2000-memory.dmp	upx
behavioral2/memory/1680-149-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp	upx
behavioral2/files/0x0007000000023503-144.dat	upx
behavioral2/memory/2376-143-0x00007FF637540000-0x00007FF637932000-memory.dmp	upx
behavioral2/files/0x0007000000023501-132.dat	upx
behavioral2/files/0x0007000000023500-127.dat	upx
behavioral2/memory/1964-126-0x00007FF641590000-0x00007FF641982000-memory.dmp	upx
behavioral2/memory/972-120-0x00007FF71FE20000-0x00007FF720212000-memory.dmp	upx
behavioral2/files/0x00070000000234fe-115.dat	upx
behavioral2/memory/4680-114-0x00007FF635690000-0x00007FF635A82000-memory.dmp	upx
behavioral2/memory/4976-108-0x00007FF6F0410000-0x00007FF6F0802000-memory.dmp	upx
behavioral2/memory/3620-107-0x00007FF685940000-0x00007FF685D32000-memory.dmp	upx
behavioral2/memory/2280-96-0x00007FF712C00000-0x00007FF712FF2000-memory.dmp	upx
behavioral2/memory/1532-90-0x00007FF746C70000-0x00007FF747062000-memory.dmp	upx
behavioral2/files/0x00070000000234fb-88.dat	upx
behavioral2/memory/5020-86-0x00007FF62E060000-0x00007FF62E452000-memory.dmp	upx
behavioral2/memory/3784-80-0x00007FF700480000-0x00007FF700872000-memory.dmp	upx
behavioral2/memory/2652-77-0x00007FF617630000-0x00007FF617A22000-memory.dmp	upx
behavioral2/memory/4780-74-0x00007FF620120000-0x00007FF620512000-memory.dmp	upx
behavioral2/files/0x00070000000234f9-73.dat	upx
behavioral2/memory/1680-69-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp	upx
behavioral2/memory/1512-68-0x00007FF758A10000-0x00007FF758E02000-memory.dmp	upx
behavioral2/memory/1000-60-0x00007FF6C6B80000-0x00007FF6C6F72000-memory.dmp	upx
behavioral2/files/0x00070000000234f8-56.dat	upx
behavioral2/memory/1336-43-0x00007FF762680000-0x00007FF762A72000-memory.dmp	upx
behavioral2/files/0x00070000000234f3-20.dat	upx
behavioral2/memory/1532-877-0x00007FF746C70000-0x00007FF747062000-memory.dmp	upx
behavioral2/memory/3620-999-0x00007FF685940000-0x00007FF685D32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wpQQEKp.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\qQTerMG.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\RYoxuyf.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\EdMXbMM.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\mkiDanp.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\hBabsTr.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\tGSEBmb.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\BrBWcRo.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\BDxozmE.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\wVDoGdK.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\RdfrmNY.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\ieuQKdG.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\TjDENQv.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\ChCdkQY.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\NUyZXyx.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\NMDcPKp.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\KAvNgFJ.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\xfkImEL.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\fATPyCw.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\saXWNyD.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\RGwJlue.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\bYadCjX.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\EsudgNC.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\lVxmVMX.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\QcPYtcG.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\XWfnQVd.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\gLTCEsP.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\PAicJaE.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\JUSemzQ.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\dvHkcno.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\qnGvBfw.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\hJcjcmQ.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\EnbPFHg.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\oQOpFcy.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\PoxYIgf.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\UwDoyKL.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\SNGrxFu.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\PvSpAOX.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\dIugZYD.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\sbbOOGB.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\gjgMokn.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\UXXzKKB.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\QbHfTaR.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\YaGQeLx.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\qAghFDL.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\ctJhrpG.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\VmUdMLu.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\aDcNoty.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\pgHFDZz.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\SLsbqBt.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\YnzkFZc.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\mPguWNO.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\JerVwLf.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\QPNGUbf.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\TfUoxAd.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\uOVFMrh.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\ZnFuLdx.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\BEhOcUf.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\xxnWxng.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\VDtXFpS.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\MyYHGiG.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\kMzTEdo.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\zsCpAbx.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
File created	C:\Windows\System\XBXyWyi.exe	898eb64e7b7f04dfb0a2b4dc06d71360N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4832	powershell.exe
4832	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeLockMemoryPrivilege	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4832	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	85
PID 4976 wrote to memory of 4832	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	85
PID 4976 wrote to memory of 4780	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	86
PID 4976 wrote to memory of 4780	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	86
PID 4976 wrote to memory of 1336	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	87
PID 4976 wrote to memory of 1336	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	87
PID 4976 wrote to memory of 3980	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	88
PID 4976 wrote to memory of 3980	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	88
PID 4976 wrote to memory of 1000	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	89
PID 4976 wrote to memory of 1000	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	89
PID 4976 wrote to memory of 2652	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	90
PID 4976 wrote to memory of 2652	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	90
PID 4976 wrote to memory of 4348	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	91
PID 4976 wrote to memory of 4348	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	91
PID 4976 wrote to memory of 3784	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	92
PID 4976 wrote to memory of 3784	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	92
PID 4976 wrote to memory of 4916	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	93
PID 4976 wrote to memory of 4916	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	93
PID 4976 wrote to memory of 208	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	94
PID 4976 wrote to memory of 208	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	94
PID 4976 wrote to memory of 1512	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	95
PID 4976 wrote to memory of 1512	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	95
PID 4976 wrote to memory of 1680	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	96
PID 4976 wrote to memory of 1680	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	96
PID 4976 wrote to memory of 5020	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	97
PID 4976 wrote to memory of 5020	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	97
PID 4976 wrote to memory of 1532	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	98
PID 4976 wrote to memory of 1532	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	98
PID 4976 wrote to memory of 2280	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	99
PID 4976 wrote to memory of 2280	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	99
PID 4976 wrote to memory of 3620	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	100
PID 4976 wrote to memory of 3620	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	100
PID 4976 wrote to memory of 4680	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	101
PID 4976 wrote to memory of 4680	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	101
PID 4976 wrote to memory of 972	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	102
PID 4976 wrote to memory of 972	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	102
PID 4976 wrote to memory of 1964	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	103
PID 4976 wrote to memory of 1964	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	103
PID 4976 wrote to memory of 2376	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	104
PID 4976 wrote to memory of 2376	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	104
PID 4976 wrote to memory of 2660	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	105
PID 4976 wrote to memory of 2660	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	105
PID 4976 wrote to memory of 436	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	106
PID 4976 wrote to memory of 436	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	106
PID 4976 wrote to memory of 4224	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	107
PID 4976 wrote to memory of 4224	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	107
PID 4976 wrote to memory of 3048	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	108
PID 4976 wrote to memory of 3048	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	108
PID 4976 wrote to memory of 2136	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	109
PID 4976 wrote to memory of 2136	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	109
PID 4976 wrote to memory of 2668	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	110
PID 4976 wrote to memory of 2668	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	110
PID 4976 wrote to memory of 1292	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	111
PID 4976 wrote to memory of 1292	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	111
PID 4976 wrote to memory of 3820	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	112
PID 4976 wrote to memory of 3820	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	112
PID 4976 wrote to memory of 4284	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	113
PID 4976 wrote to memory of 4284	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	113
PID 4976 wrote to memory of 4688	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	114
PID 4976 wrote to memory of 4688	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	114
PID 4976 wrote to memory of 4604	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	115
PID 4976 wrote to memory of 4604	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	115
PID 4976 wrote to memory of 4932	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	116
PID 4976 wrote to memory of 4932	4976	898eb64e7b7f04dfb0a2b4dc06d71360N.exe	116

C:\Users\Admin\AppData\Local\Temp\898eb64e7b7f04dfb0a2b4dc06d71360N.exe
"C:\Users\Admin\AppData\Local\Temp\898eb64e7b7f04dfb0a2b4dc06d71360N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4832" "2952" "2884" "2956" "0" "0" "2960" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4748
- C:\Windows\System\YujrDZq.exe
  C:\Windows\System\YujrDZq.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\eEhaTKq.exe
  C:\Windows\System\eEhaTKq.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\ZbRyGgb.exe
  C:\Windows\System\ZbRyGgb.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\DtAUjVD.exe
  C:\Windows\System\DtAUjVD.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\DSnupqp.exe
  C:\Windows\System\DSnupqp.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\AOFqSoF.exe
  C:\Windows\System\AOFqSoF.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\EEHtYXf.exe
  C:\Windows\System\EEHtYXf.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\JIovcuR.exe
  C:\Windows\System\JIovcuR.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\RmhGLQZ.exe
  C:\Windows\System\RmhGLQZ.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\jqWUQvK.exe
  C:\Windows\System\jqWUQvK.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\mLlfSTE.exe
  C:\Windows\System\mLlfSTE.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\OVlyhoh.exe
  C:\Windows\System\OVlyhoh.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\EOAjxbu.exe
  C:\Windows\System\EOAjxbu.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\ZiPVtNl.exe
  C:\Windows\System\ZiPVtNl.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\mIYVnce.exe
  C:\Windows\System\mIYVnce.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\lUsXXeT.exe
  C:\Windows\System\lUsXXeT.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\HRHvTDI.exe
  C:\Windows\System\HRHvTDI.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\wiURsiB.exe
  C:\Windows\System\wiURsiB.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\zjkAKTj.exe
  C:\Windows\System\zjkAKTj.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\jlsYuSx.exe
  C:\Windows\System\jlsYuSx.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\tpzlpHW.exe
  C:\Windows\System\tpzlpHW.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\gvEjkjP.exe
  C:\Windows\System\gvEjkjP.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\pnXmZgv.exe
  C:\Windows\System\pnXmZgv.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\YOlUXgx.exe
  C:\Windows\System\YOlUXgx.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\OTRTIHq.exe
  C:\Windows\System\OTRTIHq.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ZdzVSBN.exe
  C:\Windows\System\ZdzVSBN.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\cwbjYVq.exe
  C:\Windows\System\cwbjYVq.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\RRzFkhv.exe
  C:\Windows\System\RRzFkhv.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\FKiwBST.exe
  C:\Windows\System\FKiwBST.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\tfjWCbS.exe
  C:\Windows\System\tfjWCbS.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\xRRCgmT.exe
  C:\Windows\System\xRRCgmT.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\wisbJSp.exe
  C:\Windows\System\wisbJSp.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\voCJxcR.exe
  C:\Windows\System\voCJxcR.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\bUFXBFf.exe
  C:\Windows\System\bUFXBFf.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\NrNsoUp.exe
  C:\Windows\System\NrNsoUp.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\HFcOZzS.exe
  C:\Windows\System\HFcOZzS.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\YyUoDae.exe
  C:\Windows\System\YyUoDae.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\gjpArdz.exe
  C:\Windows\System\gjpArdz.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\TBBPVUr.exe
  C:\Windows\System\TBBPVUr.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\zFhraUf.exe
  C:\Windows\System\zFhraUf.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\AkRUbNN.exe
  C:\Windows\System\AkRUbNN.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\hQWagsB.exe
  C:\Windows\System\hQWagsB.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\zTrmCuh.exe
  C:\Windows\System\zTrmCuh.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\yjVClFv.exe
  C:\Windows\System\yjVClFv.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\UXcZedc.exe
  C:\Windows\System\UXcZedc.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\CTHGZRR.exe
  C:\Windows\System\CTHGZRR.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\OjNdIdA.exe
  C:\Windows\System\OjNdIdA.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\yOwZMxx.exe
  C:\Windows\System\yOwZMxx.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\rIcaSCs.exe
  C:\Windows\System\rIcaSCs.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\KPcMfah.exe
  C:\Windows\System\KPcMfah.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\oyNNeEu.exe
  C:\Windows\System\oyNNeEu.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\wkDwuaH.exe
  C:\Windows\System\wkDwuaH.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ZFmRqns.exe
  C:\Windows\System\ZFmRqns.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\NubyzmJ.exe
  C:\Windows\System\NubyzmJ.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\EmadJCD.exe
  C:\Windows\System\EmadJCD.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\LszvOuG.exe
  C:\Windows\System\LszvOuG.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\LCQExkg.exe
  C:\Windows\System\LCQExkg.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\pTIdUVH.exe
  C:\Windows\System\pTIdUVH.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\iMCWGqP.exe
  C:\Windows\System\iMCWGqP.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\KzlgRiK.exe
  C:\Windows\System\KzlgRiK.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\aIjcjhM.exe
  C:\Windows\System\aIjcjhM.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\OGDAvwe.exe
  C:\Windows\System\OGDAvwe.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\qvZbOkC.exe
  C:\Windows\System\qvZbOkC.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\jsCHooM.exe
  C:\Windows\System\jsCHooM.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\ZiaXJWH.exe
  C:\Windows\System\ZiaXJWH.exe
  2⤵
  PID:4440
- C:\Windows\System\fHTFGev.exe
  C:\Windows\System\fHTFGev.exe
  2⤵
  PID:2020
- C:\Windows\System\fDHLmVu.exe
  C:\Windows\System\fDHLmVu.exe
  2⤵
  PID:3892
- C:\Windows\System\hCaCCYY.exe
  C:\Windows\System\hCaCCYY.exe
  2⤵
  PID:1804
- C:\Windows\System\UjvXQUa.exe
  C:\Windows\System\UjvXQUa.exe
  2⤵
  PID:2700
- C:\Windows\System\zFXKzWb.exe
  C:\Windows\System\zFXKzWb.exe
  2⤵
  PID:4660
- C:\Windows\System\TOAnnjk.exe
  C:\Windows\System\TOAnnjk.exe
  2⤵
  PID:4824
- C:\Windows\System\OUqzxGZ.exe
  C:\Windows\System\OUqzxGZ.exe
  2⤵
  PID:2388
- C:\Windows\System\bgwyrzk.exe
  C:\Windows\System\bgwyrzk.exe
  2⤵
  PID:4908
- C:\Windows\System\MedQpAT.exe
  C:\Windows\System\MedQpAT.exe
  2⤵
  PID:220
- C:\Windows\System\uNmxNNp.exe
  C:\Windows\System\uNmxNNp.exe
  2⤵
  PID:5148
- C:\Windows\System\yRhsWIW.exe
  C:\Windows\System\yRhsWIW.exe
  2⤵
  PID:5164
- C:\Windows\System\KXDwKVQ.exe
  C:\Windows\System\KXDwKVQ.exe
  2⤵
  PID:5192
- C:\Windows\System\jSVjWRh.exe
  C:\Windows\System\jSVjWRh.exe
  2⤵
  PID:5220
- C:\Windows\System\MOyxVvr.exe
  C:\Windows\System\MOyxVvr.exe
  2⤵
  PID:5248
- C:\Windows\System\HfbKFxE.exe
  C:\Windows\System\HfbKFxE.exe
  2⤵
  PID:5276
- C:\Windows\System\gjVTGLB.exe
  C:\Windows\System\gjVTGLB.exe
  2⤵
  PID:5304
- C:\Windows\System\cdULopS.exe
  C:\Windows\System\cdULopS.exe
  2⤵
  PID:5332
- C:\Windows\System\WquuQNN.exe
  C:\Windows\System\WquuQNN.exe
  2⤵
  PID:5360
- C:\Windows\System\uquBPjU.exe
  C:\Windows\System\uquBPjU.exe
  2⤵
  PID:5392
- C:\Windows\System\JOFTAGp.exe
  C:\Windows\System\JOFTAGp.exe
  2⤵
  PID:5416
- C:\Windows\System\ibGWeeI.exe
  C:\Windows\System\ibGWeeI.exe
  2⤵
  PID:5448
- C:\Windows\System\BfTFVEx.exe
  C:\Windows\System\BfTFVEx.exe
  2⤵
  PID:5476
- C:\Windows\System\JKGHJjF.exe
  C:\Windows\System\JKGHJjF.exe
  2⤵
  PID:5500
- C:\Windows\System\sAvUBDG.exe
  C:\Windows\System\sAvUBDG.exe
  2⤵
  PID:5532
- C:\Windows\System\bDbtsWX.exe
  C:\Windows\System\bDbtsWX.exe
  2⤵
  PID:5560
- C:\Windows\System\UvowMCs.exe
  C:\Windows\System\UvowMCs.exe
  2⤵
  PID:5588
- C:\Windows\System\mjyMGLE.exe
  C:\Windows\System\mjyMGLE.exe
  2⤵
  PID:5612
- C:\Windows\System\jbwDGDA.exe
  C:\Windows\System\jbwDGDA.exe
  2⤵
  PID:5644
- C:\Windows\System\AVsZtQC.exe
  C:\Windows\System\AVsZtQC.exe
  2⤵
  PID:5672
- C:\Windows\System\qiWKKqf.exe
  C:\Windows\System\qiWKKqf.exe
  2⤵
  PID:5704
- C:\Windows\System\wZdXCTU.exe
  C:\Windows\System\wZdXCTU.exe
  2⤵
  PID:5728
- C:\Windows\System\CRozJHP.exe
  C:\Windows\System\CRozJHP.exe
  2⤵
  PID:5760
- C:\Windows\System\dJvlfVZ.exe
  C:\Windows\System\dJvlfVZ.exe
  2⤵
  PID:5796
- C:\Windows\System\MimYjcq.exe
  C:\Windows\System\MimYjcq.exe
  2⤵
  PID:5816
- C:\Windows\System\iMteCIk.exe
  C:\Windows\System\iMteCIk.exe
  2⤵
  PID:5844
- C:\Windows\System\hviHcmu.exe
  C:\Windows\System\hviHcmu.exe
  2⤵
  PID:5872
- C:\Windows\System\UbjKTKx.exe
  C:\Windows\System\UbjKTKx.exe
  2⤵
  PID:5896
- C:\Windows\System\JnPFkYT.exe
  C:\Windows\System\JnPFkYT.exe
  2⤵
  PID:5928
- C:\Windows\System\SICalsV.exe
  C:\Windows\System\SICalsV.exe
  2⤵
  PID:5956
- C:\Windows\System\JWVfusP.exe
  C:\Windows\System\JWVfusP.exe
  2⤵
  PID:5980
- C:\Windows\System\Sdwoevm.exe
  C:\Windows\System\Sdwoevm.exe
  2⤵
  PID:6008
- C:\Windows\System\DJyYppy.exe
  C:\Windows\System\DJyYppy.exe
  2⤵
  PID:6032
- C:\Windows\System\BqBrGlK.exe
  C:\Windows\System\BqBrGlK.exe
  2⤵
  PID:6068
- C:\Windows\System\kPXgZai.exe
  C:\Windows\System\kPXgZai.exe
  2⤵
  PID:6096
- C:\Windows\System\wbuFfJb.exe
  C:\Windows\System\wbuFfJb.exe
  2⤵
  PID:6128
- C:\Windows\System\VcTPkqS.exe
  C:\Windows\System\VcTPkqS.exe
  2⤵
  PID:4364
- C:\Windows\System\XqFFeFi.exe
  C:\Windows\System\XqFFeFi.exe
  2⤵
  PID:2752
- C:\Windows\System\JstgmOp.exe
  C:\Windows\System\JstgmOp.exe
  2⤵
  PID:544
- C:\Windows\System\AgRFKIL.exe
  C:\Windows\System\AgRFKIL.exe
  2⤵
  PID:3940
- C:\Windows\System\dfIKzSQ.exe
  C:\Windows\System\dfIKzSQ.exe
  2⤵
  PID:3188
- C:\Windows\System\NzhaMyF.exe
  C:\Windows\System\NzhaMyF.exe
  2⤵
  PID:5140
- C:\Windows\System\FufseQm.exe
  C:\Windows\System\FufseQm.exe
  2⤵
  PID:5208
- C:\Windows\System\UzIwWjb.exe
  C:\Windows\System\UzIwWjb.exe
  2⤵
  PID:5268
- C:\Windows\System\uGYhxDG.exe
  C:\Windows\System\uGYhxDG.exe
  2⤵
  PID:5348
- C:\Windows\System\mnHpTZX.exe
  C:\Windows\System\mnHpTZX.exe
  2⤵
  PID:5412
- C:\Windows\System\YyLtiQu.exe
  C:\Windows\System\YyLtiQu.exe
  2⤵
  PID:5488
- C:\Windows\System\ntXtbAh.exe
  C:\Windows\System\ntXtbAh.exe
  2⤵
  PID:5548
- C:\Windows\System\ebiUKlR.exe
  C:\Windows\System\ebiUKlR.exe
  2⤵
  PID:5580
- C:\Windows\System\pRJTbQm.exe
  C:\Windows\System\pRJTbQm.exe
  2⤵
  PID:5656
- C:\Windows\System\ykdmbhm.exe
  C:\Windows\System\ykdmbhm.exe
  2⤵
  PID:5720
- C:\Windows\System\LICMJSM.exe
  C:\Windows\System\LICMJSM.exe
  2⤵
  PID:5780
- C:\Windows\System\ohVFtyn.exe
  C:\Windows\System\ohVFtyn.exe
  2⤵
  PID:1432
- C:\Windows\System\HwOIGiD.exe
  C:\Windows\System\HwOIGiD.exe
  2⤵
  PID:5912
- C:\Windows\System\UNnzwDp.exe
  C:\Windows\System\UNnzwDp.exe
  2⤵
  PID:5948
- C:\Windows\System\nrJrAhX.exe
  C:\Windows\System\nrJrAhX.exe
  2⤵
  PID:6000
- C:\Windows\System\URwqDJA.exe
  C:\Windows\System\URwqDJA.exe
  2⤵
  PID:6060
- C:\Windows\System\piiZUgC.exe
  C:\Windows\System\piiZUgC.exe
  2⤵
  PID:2044
- C:\Windows\System\NNPWulF.exe
  C:\Windows\System\NNPWulF.exe
  2⤵
  PID:1052
- C:\Windows\System\HOYOtmi.exe
  C:\Windows\System\HOYOtmi.exe
  2⤵
  PID:4840
- C:\Windows\System\dnfeqni.exe
  C:\Windows\System\dnfeqni.exe
  2⤵
  PID:3880
- C:\Windows\System\PFbNYmp.exe
  C:\Windows\System\PFbNYmp.exe
  2⤵
  PID:5184
- C:\Windows\System\zSBVOGx.exe
  C:\Windows\System\zSBVOGx.exe
  2⤵
  PID:5328
- C:\Windows\System\QwauHJE.exe
  C:\Windows\System\QwauHJE.exe
  2⤵
  PID:5464
- C:\Windows\System\lQsIEqh.exe
  C:\Windows\System\lQsIEqh.exe
  2⤵
  PID:2644
- C:\Windows\System\EDrBPxI.exe
  C:\Windows\System\EDrBPxI.exe
  2⤵
  PID:5696
- C:\Windows\System\QpiaEdw.exe
  C:\Windows\System\QpiaEdw.exe
  2⤵
  PID:3192
- C:\Windows\System\ENtOHxR.exe
  C:\Windows\System\ENtOHxR.exe
  2⤵
  PID:3916
- C:\Windows\System\vUkSvjN.exe
  C:\Windows\System\vUkSvjN.exe
  2⤵
  PID:6028
- C:\Windows\System\wwHTAHb.exe
  C:\Windows\System\wwHTAHb.exe
  2⤵
  PID:3636
- C:\Windows\System\CDRHIlu.exe
  C:\Windows\System\CDRHIlu.exe
  2⤵
  PID:4280
- C:\Windows\System\kFZHCTK.exe
  C:\Windows\System\kFZHCTK.exe
  2⤵
  PID:5080
- C:\Windows\System\NClVcWs.exe
  C:\Windows\System\NClVcWs.exe
  2⤵
  PID:784
- C:\Windows\System\PafpPSH.exe
  C:\Windows\System\PafpPSH.exe
  2⤵
  PID:5632
- C:\Windows\System\NfIEgVH.exe
  C:\Windows\System\NfIEgVH.exe
  2⤵
  PID:3388
- C:\Windows\System\WeJHrNG.exe
  C:\Windows\System\WeJHrNG.exe
  2⤵
  PID:5884
- C:\Windows\System\PvSpAOX.exe
  C:\Windows\System\PvSpAOX.exe
  2⤵
  PID:5996
- C:\Windows\System\iDrgsJM.exe
  C:\Windows\System\iDrgsJM.exe
  2⤵
  PID:3016
- C:\Windows\System\wAwZQPq.exe
  C:\Windows\System\wAwZQPq.exe
  2⤵
  PID:740
- C:\Windows\System\hmLLAis.exe
  C:\Windows\System\hmLLAis.exe
  2⤵
  PID:4816
- C:\Windows\System\MIuvBTh.exe
  C:\Windows\System\MIuvBTh.exe
  2⤵
  PID:3228
- C:\Windows\System\cpvKspu.exe
  C:\Windows\System\cpvKspu.exe
  2⤵
  PID:6172
- C:\Windows\System\pqqsJiQ.exe
  C:\Windows\System\pqqsJiQ.exe
  2⤵
  PID:6200
- C:\Windows\System\ofwZbOX.exe
  C:\Windows\System\ofwZbOX.exe
  2⤵
  PID:6232
- C:\Windows\System\dByjLmU.exe
  C:\Windows\System\dByjLmU.exe
  2⤵
  PID:6260
- C:\Windows\System\ApHKQKD.exe
  C:\Windows\System\ApHKQKD.exe
  2⤵
  PID:6284
- C:\Windows\System\aWpJtjR.exe
  C:\Windows\System\aWpJtjR.exe
  2⤵
  PID:6312
- C:\Windows\System\bTtawnz.exe
  C:\Windows\System\bTtawnz.exe
  2⤵
  PID:6340
- C:\Windows\System\PWxGTct.exe
  C:\Windows\System\PWxGTct.exe
  2⤵
  PID:6372
- C:\Windows\System\WqlCOra.exe
  C:\Windows\System\WqlCOra.exe
  2⤵
  PID:6400
- C:\Windows\System\aKpfipN.exe
  C:\Windows\System\aKpfipN.exe
  2⤵
  PID:6424
- C:\Windows\System\tSTMmcF.exe
  C:\Windows\System\tSTMmcF.exe
  2⤵
  PID:6456
- C:\Windows\System\xfkImEL.exe
  C:\Windows\System\xfkImEL.exe
  2⤵
  PID:6480
- C:\Windows\System\FgsjTjt.exe
  C:\Windows\System\FgsjTjt.exe
  2⤵
  PID:6512
- C:\Windows\System\gfcHZcO.exe
  C:\Windows\System\gfcHZcO.exe
  2⤵
  PID:6540
- C:\Windows\System\SHDvxtR.exe
  C:\Windows\System\SHDvxtR.exe
  2⤵
  PID:6564
- C:\Windows\System\uhKhOPC.exe
  C:\Windows\System\uhKhOPC.exe
  2⤵
  PID:6596
- C:\Windows\System\hkxVejP.exe
  C:\Windows\System\hkxVejP.exe
  2⤵
  PID:6620
- C:\Windows\System\MsLyrqs.exe
  C:\Windows\System\MsLyrqs.exe
  2⤵
  PID:6652
- C:\Windows\System\XdngsaS.exe
  C:\Windows\System\XdngsaS.exe
  2⤵
  PID:6680
- C:\Windows\System\yfwWTJk.exe
  C:\Windows\System\yfwWTJk.exe
  2⤵
  PID:6704
- C:\Windows\System\gzTnOxo.exe
  C:\Windows\System\gzTnOxo.exe
  2⤵
  PID:6736
- C:\Windows\System\ImprCGX.exe
  C:\Windows\System\ImprCGX.exe
  2⤵
  PID:6764
- C:\Windows\System\tXOIHKw.exe
  C:\Windows\System\tXOIHKw.exe
  2⤵
  PID:6792
- C:\Windows\System\iGrsuGt.exe
  C:\Windows\System\iGrsuGt.exe
  2⤵
  PID:6820
- C:\Windows\System\TldtLDt.exe
  C:\Windows\System\TldtLDt.exe
  2⤵
  PID:6848
- C:\Windows\System\YgQuDtX.exe
  C:\Windows\System\YgQuDtX.exe
  2⤵
  PID:6876
- C:\Windows\System\lYDStFq.exe
  C:\Windows\System\lYDStFq.exe
  2⤵
  PID:6904
- C:\Windows\System\TyMFUhy.exe
  C:\Windows\System\TyMFUhy.exe
  2⤵
  PID:6928
- C:\Windows\System\QXQFdmI.exe
  C:\Windows\System\QXQFdmI.exe
  2⤵
  PID:6968
- C:\Windows\System\PyyShBA.exe
  C:\Windows\System\PyyShBA.exe
  2⤵
  PID:6988
- C:\Windows\System\gVlIklR.exe
  C:\Windows\System\gVlIklR.exe
  2⤵
  PID:7012
- C:\Windows\System\yAOhgjh.exe
  C:\Windows\System\yAOhgjh.exe
  2⤵
  PID:7040
- C:\Windows\System\mWEignm.exe
  C:\Windows\System\mWEignm.exe
  2⤵
  PID:7072
- C:\Windows\System\BZkGhsP.exe
  C:\Windows\System\BZkGhsP.exe
  2⤵
  PID:7100
- C:\Windows\System\bGvwGIP.exe
  C:\Windows\System\bGvwGIP.exe
  2⤵
  PID:7128
- C:\Windows\System\wmpEElE.exe
  C:\Windows\System\wmpEElE.exe
  2⤵
  PID:7152
- C:\Windows\System\HcqMhbw.exe
  C:\Windows\System\HcqMhbw.exe
  2⤵
  PID:3024
- C:\Windows\System\hDEbKCo.exe
  C:\Windows\System\hDEbKCo.exe
  2⤵
  PID:4208
- C:\Windows\System\uwMmDLV.exe
  C:\Windows\System\uwMmDLV.exe
  2⤵
  PID:6196
- C:\Windows\System\wzzfWUl.exe
  C:\Windows\System\wzzfWUl.exe
  2⤵
  PID:6272
- C:\Windows\System\mupvqxk.exe
  C:\Windows\System\mupvqxk.exe
  2⤵
  PID:6440
- C:\Windows\System\hIYswle.exe
  C:\Windows\System\hIYswle.exe
  2⤵
  PID:6608
- C:\Windows\System\uLweKqq.exe
  C:\Windows\System\uLweKqq.exe
  2⤵
  PID:6640
- C:\Windows\System\fLlIBQh.exe
  C:\Windows\System\fLlIBQh.exe
  2⤵
  PID:6692
- C:\Windows\System\QAGlcgn.exe
  C:\Windows\System\QAGlcgn.exe
  2⤵
  PID:3964
- C:\Windows\System\UyVdMjO.exe
  C:\Windows\System\UyVdMjO.exe
  2⤵
  PID:6752
- C:\Windows\System\oTTLvov.exe
  C:\Windows\System\oTTLvov.exe
  2⤵
  PID:6784
- C:\Windows\System\kEOmqBo.exe
  C:\Windows\System\kEOmqBo.exe
  2⤵
  PID:6832
- C:\Windows\System\DVrvowG.exe
  C:\Windows\System\DVrvowG.exe
  2⤵
  PID:6860
- C:\Windows\System\qJWvhZj.exe
  C:\Windows\System\qJWvhZj.exe
  2⤵
  PID:6888
- C:\Windows\System\hbkJYfq.exe
  C:\Windows\System\hbkJYfq.exe
  2⤵
  PID:6920
- C:\Windows\System\oZIywws.exe
  C:\Windows\System\oZIywws.exe
  2⤵
  PID:6952
- C:\Windows\System\YmLCRMJ.exe
  C:\Windows\System\YmLCRMJ.exe
  2⤵
  PID:4720
- C:\Windows\System\vLsrKUf.exe
  C:\Windows\System\vLsrKUf.exe
  2⤵
  PID:1152
- C:\Windows\System\jWnZWgU.exe
  C:\Windows\System\jWnZWgU.exe
  2⤵
  PID:7084
- C:\Windows\System\UbFzVKH.exe
  C:\Windows\System\UbFzVKH.exe
  2⤵
  PID:4436
- C:\Windows\System\WCLFTtv.exe
  C:\Windows\System\WCLFTtv.exe
  2⤵
  PID:6416
- C:\Windows\System\khLeeDT.exe
  C:\Windows\System\khLeeDT.exe
  2⤵
  PID:2432
- C:\Windows\System\cpIzoaZ.exe
  C:\Windows\System\cpIzoaZ.exe
  2⤵
  PID:7028
- C:\Windows\System\OuUhgIR.exe
  C:\Windows\System\OuUhgIR.exe
  2⤵
  PID:6472
- C:\Windows\System\mSwrNea.exe
  C:\Windows\System\mSwrNea.exe
  2⤵
  PID:6532
- C:\Windows\System\GIEywBo.exe
  C:\Windows\System\GIEywBo.exe
  2⤵
  PID:6916
- C:\Windows\System\KehzOZU.exe
  C:\Windows\System\KehzOZU.exe
  2⤵
  PID:6780
- C:\Windows\System\wpQQEKp.exe
  C:\Windows\System\wpQQEKp.exe
  2⤵
  PID:6700
- C:\Windows\System\jxopBhV.exe
  C:\Windows\System\jxopBhV.exe
  2⤵
  PID:6584
- C:\Windows\System\XKBvStj.exe
  C:\Windows\System\XKBvStj.exe
  2⤵
  PID:2960
- C:\Windows\System\ncPtMUY.exe
  C:\Windows\System\ncPtMUY.exe
  2⤵
  PID:1968
- C:\Windows\System\GcNrAEm.exe
  C:\Windows\System\GcNrAEm.exe
  2⤵
  PID:2024
- C:\Windows\System\nOyWoFn.exe
  C:\Windows\System\nOyWoFn.exe
  2⤵
  PID:7148
- C:\Windows\System\XScIlww.exe
  C:\Windows\System\XScIlww.exe
  2⤵
  PID:6728
- C:\Windows\System\kLQANBG.exe
  C:\Windows\System\kLQANBG.exe
  2⤵
  PID:7192
- C:\Windows\System\pQDOdvY.exe
  C:\Windows\System\pQDOdvY.exe
  2⤵
  PID:7208
- C:\Windows\System\UXXzKKB.exe
  C:\Windows\System\UXXzKKB.exe
  2⤵
  PID:7232
- C:\Windows\System\GBolBqu.exe
  C:\Windows\System\GBolBqu.exe
  2⤵
  PID:7248
- C:\Windows\System\kAWfJox.exe
  C:\Windows\System\kAWfJox.exe
  2⤵
  PID:7272
- C:\Windows\System\rfbHVqj.exe
  C:\Windows\System\rfbHVqj.exe
  2⤵
  PID:7292
- C:\Windows\System\ntvHOFB.exe
  C:\Windows\System\ntvHOFB.exe
  2⤵
  PID:7308
- C:\Windows\System\wIJDrJB.exe
  C:\Windows\System\wIJDrJB.exe
  2⤵
  PID:7328
- C:\Windows\System\CnKpumQ.exe
  C:\Windows\System\CnKpumQ.exe
  2⤵
  PID:7344
- C:\Windows\System\EqbgktQ.exe
  C:\Windows\System\EqbgktQ.exe
  2⤵
  PID:7364
- C:\Windows\System\nxPTTyb.exe
  C:\Windows\System\nxPTTyb.exe
  2⤵
  PID:7384
- C:\Windows\System\TizSaOQ.exe
  C:\Windows\System\TizSaOQ.exe
  2⤵
  PID:7400
- C:\Windows\System\fLIvoAd.exe
  C:\Windows\System\fLIvoAd.exe
  2⤵
  PID:7424
- C:\Windows\System\kFfomBr.exe
  C:\Windows\System\kFfomBr.exe
  2⤵
  PID:7444
- C:\Windows\System\Mpubofi.exe
  C:\Windows\System\Mpubofi.exe
  2⤵
  PID:7468
- C:\Windows\System\pPPJCnJ.exe
  C:\Windows\System\pPPJCnJ.exe
  2⤵
  PID:7540
- C:\Windows\System\nzINlLs.exe
  C:\Windows\System\nzINlLs.exe
  2⤵
  PID:7556
- C:\Windows\System\qtvFueV.exe
  C:\Windows\System\qtvFueV.exe
  2⤵
  PID:7584
- C:\Windows\System\SlYvYIx.exe
  C:\Windows\System\SlYvYIx.exe
  2⤵
  PID:7608
- C:\Windows\System\gzlealD.exe
  C:\Windows\System\gzlealD.exe
  2⤵
  PID:7628
- C:\Windows\System\vAFEIxB.exe
  C:\Windows\System\vAFEIxB.exe
  2⤵
  PID:7648
- C:\Windows\System\doLYHcr.exe
  C:\Windows\System\doLYHcr.exe
  2⤵
  PID:7668
- C:\Windows\System\PgOncXH.exe
  C:\Windows\System\PgOncXH.exe
  2⤵
  PID:7692
- C:\Windows\System\vFTrxwk.exe
  C:\Windows\System\vFTrxwk.exe
  2⤵
  PID:7784
- C:\Windows\System\JZhRyOI.exe
  C:\Windows\System\JZhRyOI.exe
  2⤵
  PID:7804
- C:\Windows\System\aiivcsk.exe
  C:\Windows\System\aiivcsk.exe
  2⤵
  PID:7824
- C:\Windows\System\kuaQifb.exe
  C:\Windows\System\kuaQifb.exe
  2⤵
  PID:7884
- C:\Windows\System\lEPMMuT.exe
  C:\Windows\System\lEPMMuT.exe
  2⤵
  PID:7900
- C:\Windows\System\kiHUMHW.exe
  C:\Windows\System\kiHUMHW.exe
  2⤵
  PID:7952
- C:\Windows\System\yabWDhO.exe
  C:\Windows\System\yabWDhO.exe
  2⤵
  PID:8064
- C:\Windows\System\iiqJeQc.exe
  C:\Windows\System\iiqJeQc.exe
  2⤵
  PID:8084
- C:\Windows\System\cxGnnqb.exe
  C:\Windows\System\cxGnnqb.exe
  2⤵
  PID:8108
- C:\Windows\System\hOrMkla.exe
  C:\Windows\System\hOrMkla.exe
  2⤵
  PID:8124
- C:\Windows\System\privPHd.exe
  C:\Windows\System\privPHd.exe
  2⤵
  PID:8148
- C:\Windows\System\FdLGgLs.exe
  C:\Windows\System\FdLGgLs.exe
  2⤵
  PID:8164
- C:\Windows\System\VNubNoD.exe
  C:\Windows\System\VNubNoD.exe
  2⤵
  PID:8188
- C:\Windows\System\COjSSAS.exe
  C:\Windows\System\COjSSAS.exe
  2⤵
  PID:4032
- C:\Windows\System\sruPHfT.exe
  C:\Windows\System\sruPHfT.exe
  2⤵
  PID:6528
- C:\Windows\System\QHxEyqr.exe
  C:\Windows\System\QHxEyqr.exe
  2⤵
  PID:7244
- C:\Windows\System\jecJqMD.exe
  C:\Windows\System\jecJqMD.exe
  2⤵
  PID:7320
- C:\Windows\System\AfoRdzg.exe
  C:\Windows\System\AfoRdzg.exe
  2⤵
  PID:7340
- C:\Windows\System\aZNepRi.exe
  C:\Windows\System\aZNepRi.exe
  2⤵
  PID:7256
- C:\Windows\System\gybpUbx.exe
  C:\Windows\System\gybpUbx.exe
  2⤵
  PID:7436
- C:\Windows\System\bSCuGUM.exe
  C:\Windows\System\bSCuGUM.exe
  2⤵
  PID:7504
- C:\Windows\System\FJyYsJP.exe
  C:\Windows\System\FJyYsJP.exe
  2⤵
  PID:7756
- C:\Windows\System\bJqXAXn.exe
  C:\Windows\System\bJqXAXn.exe
  2⤵
  PID:7524
- C:\Windows\System\oZsXrNC.exe
  C:\Windows\System\oZsXrNC.exe
  2⤵
  PID:7704
- C:\Windows\System\UipInMS.exe
  C:\Windows\System\UipInMS.exe
  2⤵
  PID:7620
- C:\Windows\System\LcilnRo.exe
  C:\Windows\System\LcilnRo.exe
  2⤵
  PID:7936
- C:\Windows\System\uNhnoVs.exe
  C:\Windows\System\uNhnoVs.exe
  2⤵
  PID:7944
- C:\Windows\System\jsNSHpb.exe
  C:\Windows\System\jsNSHpb.exe
  2⤵
  PID:8012
- C:\Windows\System\vtDvOpO.exe
  C:\Windows\System\vtDvOpO.exe
  2⤵
  PID:8144
- C:\Windows\System\XCBvgwx.exe
  C:\Windows\System\XCBvgwx.exe
  2⤵
  PID:8080
- C:\Windows\System\LMcsngI.exe
  C:\Windows\System\LMcsngI.exe
  2⤵
  PID:7260
- C:\Windows\System\mqKQzWe.exe
  C:\Windows\System\mqKQzWe.exe
  2⤵
  PID:7300
- C:\Windows\System\FDjTLwl.exe
  C:\Windows\System\FDjTLwl.exe
  2⤵
  PID:7764
- C:\Windows\System\SXqZtcO.exe
  C:\Windows\System\SXqZtcO.exe
  2⤵
  PID:7796
- C:\Windows\System\cvwslhL.exe
  C:\Windows\System\cvwslhL.exe
  2⤵
  PID:7600
- C:\Windows\System\FIDcSOQ.exe
  C:\Windows\System\FIDcSOQ.exe
  2⤵
  PID:7868
- C:\Windows\System\EfFtEDA.exe
  C:\Windows\System\EfFtEDA.exe
  2⤵
  PID:7980
- C:\Windows\System\GMEtVUy.exe
  C:\Windows\System\GMEtVUy.exe
  2⤵
  PID:7324
- C:\Windows\System\cCSQVSF.exe
  C:\Windows\System\cCSQVSF.exe
  2⤵
  PID:7864
- C:\Windows\System\HQxlqTv.exe
  C:\Windows\System\HQxlqTv.exe
  2⤵
  PID:7892
- C:\Windows\System\udiSEDs.exe
  C:\Windows\System\udiSEDs.exe
  2⤵
  PID:4736
- C:\Windows\System\JIUNVOV.exe
  C:\Windows\System\JIUNVOV.exe
  2⤵
  PID:8204
- C:\Windows\System\vyLUUBI.exe
  C:\Windows\System\vyLUUBI.exe
  2⤵
  PID:8252
- C:\Windows\System\ADgHmnw.exe
  C:\Windows\System\ADgHmnw.exe
  2⤵
  PID:8284
- C:\Windows\System\eeAZmvB.exe
  C:\Windows\System\eeAZmvB.exe
  2⤵
  PID:8308
- C:\Windows\System\JVkZvIN.exe
  C:\Windows\System\JVkZvIN.exe
  2⤵
  PID:8336
- C:\Windows\System\autSqFZ.exe
  C:\Windows\System\autSqFZ.exe
  2⤵
  PID:8360
- C:\Windows\System\RbGYPOT.exe
  C:\Windows\System\RbGYPOT.exe
  2⤵
  PID:8380
- C:\Windows\System\ZXpndoZ.exe
  C:\Windows\System\ZXpndoZ.exe
  2⤵
  PID:8396
- C:\Windows\System\mPeIQec.exe
  C:\Windows\System\mPeIQec.exe
  2⤵
  PID:8432
- C:\Windows\System\nXEcEZh.exe
  C:\Windows\System\nXEcEZh.exe
  2⤵
  PID:8468
- C:\Windows\System\rSndaix.exe
  C:\Windows\System\rSndaix.exe
  2⤵
  PID:8508
- C:\Windows\System\OdYICAr.exe
  C:\Windows\System\OdYICAr.exe
  2⤵
  PID:8532
- C:\Windows\System\FcaKYrd.exe
  C:\Windows\System\FcaKYrd.exe
  2⤵
  PID:8556
- C:\Windows\System\bvZLgef.exe
  C:\Windows\System\bvZLgef.exe
  2⤵
  PID:8572
- C:\Windows\System\ctJhrpG.exe
  C:\Windows\System\ctJhrpG.exe
  2⤵
  PID:8596
- C:\Windows\System\IIPjdSf.exe
  C:\Windows\System\IIPjdSf.exe
  2⤵
  PID:8612
- C:\Windows\System\XkfkBye.exe
  C:\Windows\System\XkfkBye.exe
  2⤵
  PID:8628
- C:\Windows\System\CKsMkEH.exe
  C:\Windows\System\CKsMkEH.exe
  2⤵
  PID:8648
- C:\Windows\System\HByKqrh.exe
  C:\Windows\System\HByKqrh.exe
  2⤵
  PID:8676
- C:\Windows\System\yvLEfLt.exe
  C:\Windows\System\yvLEfLt.exe
  2⤵
  PID:8704
- C:\Windows\System\UzZryFE.exe
  C:\Windows\System\UzZryFE.exe
  2⤵
  PID:8740
- C:\Windows\System\AWkkeAB.exe
  C:\Windows\System\AWkkeAB.exe
  2⤵
  PID:8812
- C:\Windows\System\wnpTBnk.exe
  C:\Windows\System\wnpTBnk.exe
  2⤵
  PID:8844
- C:\Windows\System\pkvMYfY.exe
  C:\Windows\System\pkvMYfY.exe
  2⤵
  PID:8876
- C:\Windows\System\qbRpCOa.exe
  C:\Windows\System\qbRpCOa.exe
  2⤵
  PID:8892
- C:\Windows\System\JNMHeNN.exe
  C:\Windows\System\JNMHeNN.exe
  2⤵
  PID:8920
- C:\Windows\System\EVWXqQs.exe
  C:\Windows\System\EVWXqQs.exe
  2⤵
  PID:8952
- C:\Windows\System\gfXptzR.exe
  C:\Windows\System\gfXptzR.exe
  2⤵
  PID:8976
- C:\Windows\System\yOVchcy.exe
  C:\Windows\System\yOVchcy.exe
  2⤵
  PID:8996
- C:\Windows\System\turNifZ.exe
  C:\Windows\System\turNifZ.exe
  2⤵
  PID:9012
- C:\Windows\System\lYAVRbH.exe
  C:\Windows\System\lYAVRbH.exe
  2⤵
  PID:9032
- C:\Windows\System\gFggRjz.exe
  C:\Windows\System\gFggRjz.exe
  2⤵
  PID:9052
- C:\Windows\System\kNzPKCe.exe
  C:\Windows\System\kNzPKCe.exe
  2⤵
  PID:9092
- C:\Windows\System\dIugZYD.exe
  C:\Windows\System\dIugZYD.exe
  2⤵
  PID:9136
- C:\Windows\System\KKrYqCH.exe
  C:\Windows\System\KKrYqCH.exe
  2⤵
  PID:9152
- C:\Windows\System\RqAsvbF.exe
  C:\Windows\System\RqAsvbF.exe
  2⤵
  PID:9180
- C:\Windows\System\rBIfOnz.exe
  C:\Windows\System\rBIfOnz.exe
  2⤵
  PID:9196
- C:\Windows\System\qJlOEqv.exe
  C:\Windows\System\qJlOEqv.exe
  2⤵
  PID:8196
- C:\Windows\System\PEwApnL.exe
  C:\Windows\System\PEwApnL.exe
  2⤵
  PID:8232
- C:\Windows\System\zdaCQnB.exe
  C:\Windows\System\zdaCQnB.exe
  2⤵
  PID:8300
- C:\Windows\System\UwfiYpc.exe
  C:\Windows\System\UwfiYpc.exe
  2⤵
  PID:8348
- C:\Windows\System\xAcgazO.exe
  C:\Windows\System\xAcgazO.exe
  2⤵
  PID:8424
- C:\Windows\System\zaQfXwd.exe
  C:\Windows\System\zaQfXwd.exe
  2⤵
  PID:8496
- C:\Windows\System\YzgnCeQ.exe
  C:\Windows\System\YzgnCeQ.exe
  2⤵
  PID:8504
- C:\Windows\System\OVSvYNq.exe
  C:\Windows\System\OVSvYNq.exe
  2⤵
  PID:8552
- C:\Windows\System\AUoMlCT.exe
  C:\Windows\System\AUoMlCT.exe
  2⤵
  PID:1328
- C:\Windows\System\ANBafEh.exe
  C:\Windows\System\ANBafEh.exe
  2⤵
  PID:8684
- C:\Windows\System\YgtMgVV.exe
  C:\Windows\System\YgtMgVV.exe
  2⤵
  PID:8752
- C:\Windows\System\FcpzZoD.exe
  C:\Windows\System\FcpzZoD.exe
  2⤵
  PID:8804
- C:\Windows\System\UQyAlPP.exe
  C:\Windows\System\UQyAlPP.exe
  2⤵
  PID:8836
- C:\Windows\System\RBmjyDo.exe
  C:\Windows\System\RBmjyDo.exe
  2⤵
  PID:8968
- C:\Windows\System\ORbCTJk.exe
  C:\Windows\System\ORbCTJk.exe
  2⤵
  PID:9044
- C:\Windows\System\YHRwVwh.exe
  C:\Windows\System\YHRwVwh.exe
  2⤵
  PID:9108
- C:\Windows\System\hFbUlNc.exe
  C:\Windows\System\hFbUlNc.exe
  2⤵
  PID:9148
- C:\Windows\System\VfFnHKN.exe
  C:\Windows\System\VfFnHKN.exe
  2⤵
  PID:7760
- C:\Windows\System\yJAQOkY.exe
  C:\Windows\System\yJAQOkY.exe
  2⤵
  PID:8448
- C:\Windows\System\vFBhpJP.exe
  C:\Windows\System\vFBhpJP.exe
  2⤵
  PID:8604
- C:\Windows\System\ePjxHzT.exe
  C:\Windows\System\ePjxHzT.exe
  2⤵
  PID:8588
- C:\Windows\System\YvoneMo.exe
  C:\Windows\System\YvoneMo.exe
  2⤵
  PID:8712
- C:\Windows\System\RtBAsMX.exe
  C:\Windows\System\RtBAsMX.exe
  2⤵
  PID:8768
- C:\Windows\System\QsMdWlA.exe
  C:\Windows\System\QsMdWlA.exe
  2⤵
  PID:8964
- C:\Windows\System\ITWFVuI.exe
  C:\Windows\System\ITWFVuI.exe
  2⤵
  PID:7008
- C:\Windows\System\hnEdywN.exe
  C:\Windows\System\hnEdywN.exe
  2⤵
  PID:8500
- C:\Windows\System\LivcPiA.exe
  C:\Windows\System\LivcPiA.exe
  2⤵
  PID:8872
- C:\Windows\System\GZwwSzl.exe
  C:\Windows\System\GZwwSzl.exe
  2⤵
  PID:8280
- C:\Windows\System\VSXNGSX.exe
  C:\Windows\System\VSXNGSX.exe
  2⤵
  PID:9104
- C:\Windows\System\GWMURNE.exe
  C:\Windows\System\GWMURNE.exe
  2⤵
  PID:9224
- C:\Windows\System\ewdIBnr.exe
  C:\Windows\System\ewdIBnr.exe
  2⤵
  PID:9264
- C:\Windows\System\oaVQBpO.exe
  C:\Windows\System\oaVQBpO.exe
  2⤵
  PID:9300
- C:\Windows\System\zMmxsWf.exe
  C:\Windows\System\zMmxsWf.exe
  2⤵
  PID:9320
- C:\Windows\System\ySGYdXT.exe
  C:\Windows\System\ySGYdXT.exe
  2⤵
  PID:9348
- C:\Windows\System\NWwIjrN.exe
  C:\Windows\System\NWwIjrN.exe
  2⤵
  PID:9372
- C:\Windows\System\pFGSwmE.exe
  C:\Windows\System\pFGSwmE.exe
  2⤵
  PID:9412
- C:\Windows\System\ceenSdQ.exe
  C:\Windows\System\ceenSdQ.exe
  2⤵
  PID:9432
- C:\Windows\System\kRyfKHK.exe
  C:\Windows\System\kRyfKHK.exe
  2⤵
  PID:9456
- C:\Windows\System\NhNERKU.exe
  C:\Windows\System\NhNERKU.exe
  2⤵
  PID:9476
- C:\Windows\System\pAwZQfF.exe
  C:\Windows\System\pAwZQfF.exe
  2⤵
  PID:9504
- C:\Windows\System\FHORGUn.exe
  C:\Windows\System\FHORGUn.exe
  2⤵
  PID:9520
- C:\Windows\System\gBZlsqN.exe
  C:\Windows\System\gBZlsqN.exe
  2⤵
  PID:9552
- C:\Windows\System\kQfOQOD.exe
  C:\Windows\System\kQfOQOD.exe
  2⤵
  PID:9608
- C:\Windows\System\oOnNTBW.exe
  C:\Windows\System\oOnNTBW.exe
  2⤵
  PID:9624
- C:\Windows\System\GwNdYeg.exe
  C:\Windows\System\GwNdYeg.exe
  2⤵
  PID:9644
- C:\Windows\System\usORbrf.exe
  C:\Windows\System\usORbrf.exe
  2⤵
  PID:9664
- C:\Windows\System\BUOcJVe.exe
  C:\Windows\System\BUOcJVe.exe
  2⤵
  PID:9696
- C:\Windows\System\RlgJkHV.exe
  C:\Windows\System\RlgJkHV.exe
  2⤵
  PID:9712
- C:\Windows\System\yLwUIuH.exe
  C:\Windows\System\yLwUIuH.exe
  2⤵
  PID:9780
- C:\Windows\System\KKcVoWV.exe
  C:\Windows\System\KKcVoWV.exe
  2⤵
  PID:9796
- C:\Windows\System\hRJOakI.exe
  C:\Windows\System\hRJOakI.exe
  2⤵
  PID:9824
- C:\Windows\System\GGiSTZy.exe
  C:\Windows\System\GGiSTZy.exe
  2⤵
  PID:9844
- C:\Windows\System\cNWuNwp.exe
  C:\Windows\System\cNWuNwp.exe
  2⤵
  PID:9864
- C:\Windows\System\iPluXvG.exe
  C:\Windows\System\iPluXvG.exe
  2⤵
  PID:9896
- C:\Windows\System\igIzMoG.exe
  C:\Windows\System\igIzMoG.exe
  2⤵
  PID:9928
- C:\Windows\System\XFSRhBz.exe
  C:\Windows\System\XFSRhBz.exe
  2⤵
  PID:9948
- C:\Windows\System\JwSYsJZ.exe
  C:\Windows\System\JwSYsJZ.exe
  2⤵
  PID:9984
- C:\Windows\System\oYyXlqs.exe
  C:\Windows\System\oYyXlqs.exe
  2⤵
  PID:10004
- C:\Windows\System\xpkgFFT.exe
  C:\Windows\System\xpkgFFT.exe
  2⤵
  PID:10048
- C:\Windows\System\SZjFyJs.exe
  C:\Windows\System\SZjFyJs.exe
  2⤵
  PID:10112
- C:\Windows\System\gqmrpVX.exe
  C:\Windows\System\gqmrpVX.exe
  2⤵
  PID:10140
- C:\Windows\System\MbuPHKw.exe
  C:\Windows\System\MbuPHKw.exe
  2⤵
  PID:10156
- C:\Windows\System\scDceJn.exe
  C:\Windows\System\scDceJn.exe
  2⤵
  PID:10176
- C:\Windows\System\aDnHCPo.exe
  C:\Windows\System\aDnHCPo.exe
  2⤵
  PID:10200
- C:\Windows\System\RDfNhjj.exe
  C:\Windows\System\RDfNhjj.exe
  2⤵
  PID:10220
- C:\Windows\System\elFvfyN.exe
  C:\Windows\System\elFvfyN.exe
  2⤵
  PID:8292
- C:\Windows\System\JUSemzQ.exe
  C:\Windows\System\JUSemzQ.exe
  2⤵
  PID:9284
- C:\Windows\System\jSFRpNP.exe
  C:\Windows\System\jSFRpNP.exe
  2⤵
  PID:9392
- C:\Windows\System\SPFcQQg.exe
  C:\Windows\System\SPFcQQg.exe
  2⤵
  PID:9468
- C:\Windows\System\XZdhydB.exe
  C:\Windows\System\XZdhydB.exe
  2⤵
  PID:9440
- C:\Windows\System\FWBGPIb.exe
  C:\Windows\System\FWBGPIb.exe
  2⤵
  PID:9516
- C:\Windows\System\AtgLYKM.exe
  C:\Windows\System\AtgLYKM.exe
  2⤵
  PID:9596
- C:\Windows\System\eSIcNfs.exe
  C:\Windows\System\eSIcNfs.exe
  2⤵
  PID:9660
- C:\Windows\System\oKnHBPX.exe
  C:\Windows\System\oKnHBPX.exe
  2⤵
  PID:9708
- C:\Windows\System\NaMphXc.exe
  C:\Windows\System\NaMphXc.exe
  2⤵
  PID:9820
- C:\Windows\System\wtZLSLZ.exe
  C:\Windows\System\wtZLSLZ.exe
  2⤵
  PID:9860
- C:\Windows\System\hRUVwRq.exe
  C:\Windows\System\hRUVwRq.exe
  2⤵
  PID:9892
- C:\Windows\System\MmxApBx.exe
  C:\Windows\System\MmxApBx.exe
  2⤵
  PID:9992
- C:\Windows\System\gjAASEs.exe
  C:\Windows\System\gjAASEs.exe
  2⤵
  PID:9632
- C:\Windows\System\vWLUQAh.exe
  C:\Windows\System\vWLUQAh.exe
  2⤵
  PID:10152
- C:\Windows\System\hqpVnzk.exe
  C:\Windows\System\hqpVnzk.exe
  2⤵
  PID:9244
- C:\Windows\System\tZtklxz.exe
  C:\Windows\System\tZtklxz.exe
  2⤵
  PID:8732
- C:\Windows\System\RFHBoBK.exe
  C:\Windows\System\RFHBoBK.exe
  2⤵
  PID:9368
- C:\Windows\System\ztQEIia.exe
  C:\Windows\System\ztQEIia.exe
  2⤵
  PID:9544
- C:\Windows\System\tMYFTUf.exe
  C:\Windows\System\tMYFTUf.exe
  2⤵
  PID:9636
- C:\Windows\System\YdEiDfE.exe
  C:\Windows\System\YdEiDfE.exe
  2⤵
  PID:9692
- C:\Windows\System\NoOqmsu.exe
  C:\Windows\System\NoOqmsu.exe
  2⤵
  PID:9888
- C:\Windows\System\DWuWLYr.exe
  C:\Windows\System\DWuWLYr.exe
  2⤵
  PID:9364
- C:\Windows\System\lqFeBPD.exe
  C:\Windows\System\lqFeBPD.exe
  2⤵
  PID:10216
- C:\Windows\System\scMMLFh.exe
  C:\Windows\System\scMMLFh.exe
  2⤵
  PID:9856
- C:\Windows\System\mkiDanp.exe
  C:\Windows\System\mkiDanp.exe
  2⤵
  PID:10184
- C:\Windows\System\GQxhlyN.exe
  C:\Windows\System\GQxhlyN.exe
  2⤵
  PID:10128
- C:\Windows\System\OmrUcmZ.exe
  C:\Windows\System\OmrUcmZ.exe
  2⤵
  PID:10260
- C:\Windows\System\htuhsYp.exe
  C:\Windows\System\htuhsYp.exe
  2⤵
  PID:10280
- C:\Windows\System\NvONmXs.exe
  C:\Windows\System\NvONmXs.exe
  2⤵
  PID:10300
- C:\Windows\System\gpLKXog.exe
  C:\Windows\System\gpLKXog.exe
  2⤵
  PID:10332
- C:\Windows\System\hdBgtjN.exe
  C:\Windows\System\hdBgtjN.exe
  2⤵
  PID:10372
- C:\Windows\System\PifWBeb.exe
  C:\Windows\System\PifWBeb.exe
  2⤵
  PID:10392
- C:\Windows\System\qjqgtvC.exe
  C:\Windows\System\qjqgtvC.exe
  2⤵
  PID:10412
- C:\Windows\System\EsMeiQi.exe
  C:\Windows\System\EsMeiQi.exe
  2⤵
  PID:10448
- C:\Windows\System\eeAIBkC.exe
  C:\Windows\System\eeAIBkC.exe
  2⤵
  PID:10484
- C:\Windows\System\fUslFqF.exe
  C:\Windows\System\fUslFqF.exe
  2⤵
  PID:10536
- C:\Windows\System\oDkKRjc.exe
  C:\Windows\System\oDkKRjc.exe
  2⤵
  PID:10560
- C:\Windows\System\DHkYDFH.exe
  C:\Windows\System\DHkYDFH.exe
  2⤵
  PID:10576
- C:\Windows\System\rHVgovA.exe
  C:\Windows\System\rHVgovA.exe
  2⤵
  PID:10592
- C:\Windows\System\nnFjSmK.exe
  C:\Windows\System\nnFjSmK.exe
  2⤵
  PID:10612
- C:\Windows\System\eLtYvTu.exe
  C:\Windows\System\eLtYvTu.exe
  2⤵
  PID:10632
- C:\Windows\System\MFLtSwB.exe
  C:\Windows\System\MFLtSwB.exe
  2⤵
  PID:10668
- C:\Windows\System\VPfIdTE.exe
  C:\Windows\System\VPfIdTE.exe
  2⤵
  PID:10684
- C:\Windows\System\rvxrQdk.exe
  C:\Windows\System\rvxrQdk.exe
  2⤵
  PID:10708
- C:\Windows\System\HDKqlKp.exe
  C:\Windows\System\HDKqlKp.exe
  2⤵
  PID:10744
- C:\Windows\System\BaOYuem.exe
  C:\Windows\System\BaOYuem.exe
  2⤵
  PID:10760
- C:\Windows\System\ZvvFaAR.exe
  C:\Windows\System\ZvvFaAR.exe
  2⤵
  PID:10780
- C:\Windows\System\XPnJMJH.exe
  C:\Windows\System\XPnJMJH.exe
  2⤵
  PID:10812
- C:\Windows\System\iKOrNpe.exe
  C:\Windows\System\iKOrNpe.exe
  2⤵
  PID:10828
- C:\Windows\System\SOnSSgR.exe
  C:\Windows\System\SOnSSgR.exe
  2⤵
  PID:10880
- C:\Windows\System\WaQyBbo.exe
  C:\Windows\System\WaQyBbo.exe
  2⤵
  PID:10920
- C:\Windows\System\WNyFrqt.exe
  C:\Windows\System\WNyFrqt.exe
  2⤵
  PID:10944
- C:\Windows\System\FFNEoYC.exe
  C:\Windows\System\FFNEoYC.exe
  2⤵
  PID:10988
- C:\Windows\System\ILCVGQY.exe
  C:\Windows\System\ILCVGQY.exe
  2⤵
  PID:11040
- C:\Windows\System\QSQLZkV.exe
  C:\Windows\System\QSQLZkV.exe
  2⤵
  PID:11060
- C:\Windows\System\utISnck.exe
  C:\Windows\System\utISnck.exe
  2⤵
  PID:11084
- C:\Windows\System\VTqFmEU.exe
  C:\Windows\System\VTqFmEU.exe
  2⤵
  PID:11104
- C:\Windows\System\AzgFzAt.exe
  C:\Windows\System\AzgFzAt.exe
  2⤵
  PID:11124
- C:\Windows\System\PlrFXpG.exe
  C:\Windows\System\PlrFXpG.exe
  2⤵
  PID:11144
- C:\Windows\System\QvDaTIZ.exe
  C:\Windows\System\QvDaTIZ.exe
  2⤵
  PID:11176
- C:\Windows\System\TwHqItT.exe
  C:\Windows\System\TwHqItT.exe
  2⤵
  PID:11228
- C:\Windows\System\Hcxwese.exe
  C:\Windows\System\Hcxwese.exe
  2⤵
  PID:11252
- C:\Windows\System\zjzsWRc.exe
  C:\Windows\System\zjzsWRc.exe
  2⤵
  PID:10248
- C:\Windows\System\FIxIJxB.exe
  C:\Windows\System\FIxIJxB.exe
  2⤵
  PID:10276
- C:\Windows\System\RFwWHEb.exe
  C:\Windows\System\RFwWHEb.exe
  2⤵
  PID:10420
- C:\Windows\System\WNBavBt.exe
  C:\Windows\System\WNBavBt.exe
  2⤵
  PID:10456
- C:\Windows\System\ogZKUce.exe
  C:\Windows\System\ogZKUce.exe
  2⤵
  PID:10508
- C:\Windows\System\JDgrRYS.exe
  C:\Windows\System\JDgrRYS.exe
  2⤵
  PID:10624
- C:\Windows\System\ZKkzWwI.exe
  C:\Windows\System\ZKkzWwI.exe
  2⤵
  PID:10660
- C:\Windows\System\dTSCjQQ.exe
  C:\Windows\System\dTSCjQQ.exe
  2⤵
  PID:10680
- C:\Windows\System\qvKhAVN.exe
  C:\Windows\System\qvKhAVN.exe
  2⤵
  PID:9424
- C:\Windows\System\PMyyogw.exe
  C:\Windows\System\PMyyogw.exe
  2⤵
  PID:10772
- C:\Windows\System\gKZhZvB.exe
  C:\Windows\System\gKZhZvB.exe
  2⤵
  PID:10808
- C:\Windows\System\ZatiYke.exe
  C:\Windows\System\ZatiYke.exe
  2⤵
  PID:10852
- C:\Windows\System\yGKPIRj.exe
  C:\Windows\System\yGKPIRj.exe
  2⤵
  PID:10968
- C:\Windows\System\ZmsAERY.exe
  C:\Windows\System\ZmsAERY.exe
  2⤵
  PID:11072
- C:\Windows\System\WiWnTjj.exe
  C:\Windows\System\WiWnTjj.exe
  2⤵
  PID:11112
- C:\Windows\System\vRodoRq.exe
  C:\Windows\System\vRodoRq.exe
  2⤵
  PID:11092
- C:\Windows\System\PNBFtCN.exe
  C:\Windows\System\PNBFtCN.exe
  2⤵
  PID:11220
- C:\Windows\System\XQVUMyH.exe
  C:\Windows\System\XQVUMyH.exe
  2⤵
  PID:10268
- C:\Windows\System\BmSbfQi.exe
  C:\Windows\System\BmSbfQi.exe
  2⤵
  PID:10296
- C:\Windows\System\SmPQfOl.exe
  C:\Windows\System\SmPQfOl.exe
  2⤵
  PID:10408
- C:\Windows\System\vqoaQoZ.exe
  C:\Windows\System\vqoaQoZ.exe
  2⤵
  PID:10732
- C:\Windows\System\eWnVWPt.exe
  C:\Windows\System\eWnVWPt.exe
  2⤵
  PID:10704
- C:\Windows\System\VsgWNnD.exe
  C:\Windows\System\VsgWNnD.exe
  2⤵
  PID:11068
- C:\Windows\System\onbybTu.exe
  C:\Windows\System\onbybTu.exe
  2⤵
  PID:10384
- C:\Windows\System\cSKbpJU.exe
  C:\Windows\System\cSKbpJU.exe
  2⤵
  PID:10620
- C:\Windows\System\uBJpKQx.exe
  C:\Windows\System\uBJpKQx.exe
  2⤵
  PID:10912
- C:\Windows\System\WggiwQK.exe
  C:\Windows\System\WggiwQK.exe
  2⤵
  PID:10648
- C:\Windows\System\KcyIBQP.exe
  C:\Windows\System\KcyIBQP.exe
  2⤵
  PID:11292
- C:\Windows\System\XAtYhVm.exe
  C:\Windows\System\XAtYhVm.exe
  2⤵
  PID:11316
- C:\Windows\System\RqTWacr.exe
  C:\Windows\System\RqTWacr.exe
  2⤵
  PID:11332
- C:\Windows\System\nfAIAZQ.exe
  C:\Windows\System\nfAIAZQ.exe
  2⤵
  PID:11348
- C:\Windows\System\tkFtwoT.exe
  C:\Windows\System\tkFtwoT.exe
  2⤵
  PID:11368
- C:\Windows\System\RdfrmNY.exe
  C:\Windows\System\RdfrmNY.exe
  2⤵
  PID:11392
- C:\Windows\System\cMwafZA.exe
  C:\Windows\System\cMwafZA.exe
  2⤵
  PID:11412
- C:\Windows\System\AQWhuVM.exe
  C:\Windows\System\AQWhuVM.exe
  2⤵
  PID:11440
- C:\Windows\System\jXJcBez.exe
  C:\Windows\System\jXJcBez.exe
  2⤵
  PID:11464
- C:\Windows\System\jLncCCj.exe
  C:\Windows\System\jLncCCj.exe
  2⤵
  PID:11480
- C:\Windows\System\IphTINc.exe
  C:\Windows\System\IphTINc.exe
  2⤵
  PID:11516
- C:\Windows\System\BdWeinK.exe
  C:\Windows\System\BdWeinK.exe
  2⤵
  PID:11548
- C:\Windows\System\eheUyjM.exe
  C:\Windows\System\eheUyjM.exe
  2⤵
  PID:11604
- C:\Windows\System\EqfPhfp.exe
  C:\Windows\System\EqfPhfp.exe
  2⤵
  PID:11636
- C:\Windows\System\ieuQKdG.exe
  C:\Windows\System\ieuQKdG.exe
  2⤵
  PID:11664
- C:\Windows\System\uBpDZRT.exe
  C:\Windows\System\uBpDZRT.exe
  2⤵
  PID:11700
- C:\Windows\System\YpznHxj.exe
  C:\Windows\System\YpznHxj.exe
  2⤵
  PID:11728
- C:\Windows\System\kvtNAze.exe
  C:\Windows\System\kvtNAze.exe
  2⤵
  PID:11748
- C:\Windows\System\JcqDMfD.exe
  C:\Windows\System\JcqDMfD.exe
  2⤵
  PID:11788
- C:\Windows\System\dGKeqmP.exe
  C:\Windows\System\dGKeqmP.exe
  2⤵
  PID:11808
- C:\Windows\System\iPqTfCX.exe
  C:\Windows\System\iPqTfCX.exe
  2⤵
  PID:11832
- C:\Windows\System\hOlJUAN.exe
  C:\Windows\System\hOlJUAN.exe
  2⤵
  PID:11856
- C:\Windows\System\DFwQrWV.exe
  C:\Windows\System\DFwQrWV.exe
  2⤵
  PID:11892
- C:\Windows\System\pVuYeMQ.exe
  C:\Windows\System\pVuYeMQ.exe
  2⤵
  PID:11924
- C:\Windows\System\pbJLPVa.exe
  C:\Windows\System\pbJLPVa.exe
  2⤵
  PID:11944
- C:\Windows\System\wxMlQsJ.exe
  C:\Windows\System\wxMlQsJ.exe
  2⤵
  PID:11972
- C:\Windows\System\nxypCvw.exe
  C:\Windows\System\nxypCvw.exe
  2⤵
  PID:11992
- C:\Windows\System\fATPyCw.exe
  C:\Windows\System\fATPyCw.exe
  2⤵
  PID:12012
- C:\Windows\System\EAoSuIa.exe
  C:\Windows\System\EAoSuIa.exe
  2⤵
  PID:12040
- C:\Windows\System\gyBmHlt.exe
  C:\Windows\System\gyBmHlt.exe
  2⤵
  PID:12100
- C:\Windows\System\QzHMSJf.exe
  C:\Windows\System\QzHMSJf.exe
  2⤵
  PID:12136
- C:\Windows\System\GhveKou.exe
  C:\Windows\System\GhveKou.exe
  2⤵
  PID:12164
- C:\Windows\System\qNajays.exe
  C:\Windows\System\qNajays.exe
  2⤵
  PID:12184
- C:\Windows\System\qSENuUI.exe
  C:\Windows\System\qSENuUI.exe
  2⤵
  PID:12200
- C:\Windows\System\VmUdMLu.exe
  C:\Windows\System\VmUdMLu.exe
  2⤵
  PID:12224
- C:\Windows\System\WBbuuBe.exe
  C:\Windows\System\WBbuuBe.exe
  2⤵
  PID:12256
- C:\Windows\System\GkidZWB.exe
  C:\Windows\System\GkidZWB.exe
  2⤵
  PID:11248
- C:\Windows\System\GfqAvci.exe
  C:\Windows\System\GfqAvci.exe
  2⤵
  PID:11328
- C:\Windows\System\EAfzuoU.exe
  C:\Windows\System\EAfzuoU.exe
  2⤵
  PID:11360
- C:\Windows\System\uROfIif.exe
  C:\Windows\System\uROfIif.exe
  2⤵
  PID:11376
- C:\Windows\System\EWJpjFV.exe
  C:\Windows\System\EWJpjFV.exe
  2⤵
  PID:11460
- C:\Windows\System\kFTCyYi.exe
  C:\Windows\System\kFTCyYi.exe
  2⤵
  PID:11572
- C:\Windows\System\UUmlAgU.exe
  C:\Windows\System\UUmlAgU.exe
  2⤵
  PID:11576
- C:\Windows\System\tYXbGsg.exe
  C:\Windows\System\tYXbGsg.exe
  2⤵
  PID:11652
- C:\Windows\System\WZqmFDo.exe
  C:\Windows\System\WZqmFDo.exe
  2⤵
  PID:11712
- C:\Windows\System\vofjELW.exe
  C:\Windows\System\vofjELW.exe
  2⤵
  PID:11744
- C:\Windows\System\pUNgJhP.exe
  C:\Windows\System\pUNgJhP.exe
  2⤵
  PID:11800
- C:\Windows\System\YylCxPa.exe
  C:\Windows\System\YylCxPa.exe
  2⤵
  PID:11848
- C:\Windows\System\vlOzLdd.exe
  C:\Windows\System\vlOzLdd.exe
  2⤵
  PID:11952
- C:\Windows\System\HpknxtC.exe
  C:\Windows\System\HpknxtC.exe
  2⤵
  PID:12076
- C:\Windows\System\kBAqSKa.exe
  C:\Windows\System\kBAqSKa.exe
  2⤵
  PID:12124
- C:\Windows\System\XWYkZYI.exe
  C:\Windows\System\XWYkZYI.exe
  2⤵
  PID:12176
- C:\Windows\System\ZHrWzEU.exe
  C:\Windows\System\ZHrWzEU.exe
  2⤵
  PID:12216
- C:\Windows\System\akbVWqH.exe
  C:\Windows\System\akbVWqH.exe
  2⤵
  PID:11276
- C:\Windows\System\CUtBRDG.exe
  C:\Windows\System\CUtBRDG.exe
  2⤵
  PID:11344
- C:\Windows\System\fRPAQvi.exe
  C:\Windows\System\fRPAQvi.exe
  2⤵
  PID:11448
- C:\Windows\System\WPELFtJ.exe
  C:\Windows\System\WPELFtJ.exe
  2⤵
  PID:11740
- C:\Windows\System\BxKWrDt.exe
  C:\Windows\System\BxKWrDt.exe
  2⤵
  PID:11916
- C:\Windows\System\GmcEacj.exe
  C:\Windows\System\GmcEacj.exe
  2⤵
  PID:11984
- C:\Windows\System\ZWysFVe.exe
  C:\Windows\System\ZWysFVe.exe
  2⤵
  PID:12128
- C:\Windows\System\CUzPWPv.exe
  C:\Windows\System\CUzPWPv.exe
  2⤵
  PID:11432
- C:\Windows\System\xASEUEF.exe
  C:\Windows\System\xASEUEF.exe
  2⤵
  PID:11612
- C:\Windows\System\TILoSff.exe
  C:\Windows\System\TILoSff.exe
  2⤵
  PID:12320
- C:\Windows\System\snxJKbE.exe
  C:\Windows\System\snxJKbE.exe
  2⤵
  PID:12352
- C:\Windows\System\pRklDyQ.exe
  C:\Windows\System\pRklDyQ.exe
  2⤵
  PID:12388
- C:\Windows\System\ILObbQB.exe
  C:\Windows\System\ILObbQB.exe
  2⤵
  PID:12408
- C:\Windows\System\DfmDoxN.exe
  C:\Windows\System\DfmDoxN.exe
  2⤵
  PID:12424
- C:\Windows\System\KVbwHKi.exe
  C:\Windows\System\KVbwHKi.exe
  2⤵
  PID:12448
- C:\Windows\System\MilUNga.exe
  C:\Windows\System\MilUNga.exe
  2⤵
  PID:12468
- C:\Windows\System\HpnDitI.exe
  C:\Windows\System\HpnDitI.exe
  2⤵
  PID:12512
- C:\Windows\System\EueIqix.exe
  C:\Windows\System\EueIqix.exe
  2⤵
  PID:12540
- C:\Windows\System\gYoVCsG.exe
  C:\Windows\System\gYoVCsG.exe
  2⤵
  PID:12564
- C:\Windows\System\dcMoSGa.exe
  C:\Windows\System\dcMoSGa.exe
  2⤵
  PID:12592
- C:\Windows\System\Iyblxru.exe
  C:\Windows\System\Iyblxru.exe
  2⤵
  PID:12608
- C:\Windows\System\Sesqqmg.exe
  C:\Windows\System\Sesqqmg.exe
  2⤵
  PID:12640
- C:\Windows\System\fdWRNiU.exe
  C:\Windows\System\fdWRNiU.exe
  2⤵
  PID:12660
- C:\Windows\System\XToUZvL.exe
  C:\Windows\System\XToUZvL.exe
  2⤵
  PID:12684
- C:\Windows\System\OUrnqFc.exe
  C:\Windows\System\OUrnqFc.exe
  2⤵
  PID:12720
- C:\Windows\System\NawDscw.exe
  C:\Windows\System\NawDscw.exe
  2⤵
  PID:12740
- C:\Windows\System\bOUefMI.exe
  C:\Windows\System\bOUefMI.exe
  2⤵
  PID:12764
- C:\Windows\System\bCNCJFU.exe
  C:\Windows\System\bCNCJFU.exe
  2⤵
  PID:12784
- C:\Windows\System\CoMUATT.exe
  C:\Windows\System\CoMUATT.exe
  2⤵
  PID:12804
- C:\Windows\System\EAKKgCi.exe
  C:\Windows\System\EAKKgCi.exe
  2⤵
  PID:12824
- C:\Windows\System\WTCddao.exe
  C:\Windows\System\WTCddao.exe
  2⤵
  PID:12848
- C:\Windows\System\sWlaMju.exe
  C:\Windows\System\sWlaMju.exe
  2⤵
  PID:12880
- C:\Windows\System\LsBNxZV.exe
  C:\Windows\System\LsBNxZV.exe
  2⤵
  PID:12924
- C:\Windows\System\LfBguml.exe
  C:\Windows\System\LfBguml.exe
  2⤵
  PID:12984
- C:\Windows\System\eIcaIYW.exe
  C:\Windows\System\eIcaIYW.exe
  2⤵
  PID:13000
- C:\Windows\System\cawvVpq.exe
  C:\Windows\System\cawvVpq.exe
  2⤵
  PID:13024
- C:\Windows\System\mQoebJZ.exe
  C:\Windows\System\mQoebJZ.exe
  2⤵
  PID:13048
- C:\Windows\System\dFpUBJw.exe
  C:\Windows\System\dFpUBJw.exe
  2⤵
  PID:13068
- C:\Windows\System\QYGkCYd.exe
  C:\Windows\System\QYGkCYd.exe
  2⤵
  PID:13096
- C:\Windows\System\Fkpmxto.exe
  C:\Windows\System\Fkpmxto.exe
  2⤵
  PID:13112
- C:\Windows\System\ZGUpIPO.exe
  C:\Windows\System\ZGUpIPO.exe
  2⤵
  PID:13164
- C:\Windows\System\lfzYIZQ.exe
  C:\Windows\System\lfzYIZQ.exe
  2⤵
  PID:13180
- C:\Windows\System\kiTDClI.exe
  C:\Windows\System\kiTDClI.exe
  2⤵
  PID:13208
- C:\Windows\System\rFtoTrC.exe
  C:\Windows\System\rFtoTrC.exe
  2⤵
  PID:13260
- C:\Windows\System\QbHfTaR.exe
  C:\Windows\System\QbHfTaR.exe
  2⤵
  PID:13280
- C:\Windows\System\MNyEEqV.exe
  C:\Windows\System\MNyEEqV.exe
  2⤵
  PID:13304
- C:\Windows\System\IzgsfIb.exe
  C:\Windows\System\IzgsfIb.exe
  2⤵
  PID:12060
- C:\Windows\System\uoSecuY.exe
  C:\Windows\System\uoSecuY.exe
  2⤵
  PID:11456
- C:\Windows\System\OyUTToc.exe
  C:\Windows\System\OyUTToc.exe
  2⤵
  PID:12304
- C:\Windows\System\KZJgIlC.exe
  C:\Windows\System\KZJgIlC.exe
  2⤵
  PID:3616
- C:\Windows\System\ddqkYto.exe
  C:\Windows\System\ddqkYto.exe
  2⤵
  PID:12376
- C:\Windows\System\CzOOJrE.exe
  C:\Windows\System\CzOOJrE.exe
  2⤵
  PID:12500
- C:\Windows\System\BoBdtKk.exe
  C:\Windows\System\BoBdtKk.exe
  2⤵
  PID:12580
- C:\Windows\System\dgmEGtm.exe
  C:\Windows\System\dgmEGtm.exe
  2⤵
  PID:12672
- C:\Windows\System\oOecMei.exe
  C:\Windows\System\oOecMei.exe
  2⤵
  PID:12796
- C:\Windows\System\mqUlQDJ.exe
  C:\Windows\System\mqUlQDJ.exe
  2⤵
  PID:12832
- C:\Windows\System\ObPQKIZ.exe
  C:\Windows\System\ObPQKIZ.exe
  2⤵
  PID:12904
- C:\Windows\System\AMZschZ.exe
  C:\Windows\System\AMZschZ.exe
  2⤵
  PID:12960
- C:\Windows\System\GkQzJBz.exe
  C:\Windows\System\GkQzJBz.exe
  2⤵
  PID:12972
- C:\Windows\System\kNjtgJb.exe
  C:\Windows\System\kNjtgJb.exe
  2⤵
  PID:13056
- C:\Windows\System\zUwxocg.exe
  C:\Windows\System\zUwxocg.exe
  2⤵
  PID:12992
- C:\Windows\System\tDYvAwO.exe
  C:\Windows\System\tDYvAwO.exe
  2⤵
  PID:13032
- C:\Windows\System\YnzkFZc.exe
  C:\Windows\System\YnzkFZc.exe
  2⤵
  PID:13224
- C:\Windows\System\YACrtHv.exe
  C:\Windows\System\YACrtHv.exe
  2⤵
  PID:13196
- C:\Windows\System\DidqbgZ.exe
  C:\Windows\System\DidqbgZ.exe
  2⤵
  PID:12292
- C:\Windows\System\gWGtnLD.exe
  C:\Windows\System\gWGtnLD.exe
  2⤵
  PID:12404
- C:\Windows\System\aDySewj.exe
  C:\Windows\System\aDySewj.exe
  2⤵
  PID:12536
- C:\Windows\System\xaxvIbl.exe
  C:\Windows\System\xaxvIbl.exe
  2⤵
  PID:12752
- C:\Windows\System\fFMckyN.exe
  C:\Windows\System\fFMckyN.exe
  2⤵
  PID:12956
- C:\Windows\System\YRsMBql.exe
  C:\Windows\System\YRsMBql.exe
  2⤵
  PID:13132
- C:\Windows\System\wAREoTs.exe
  C:\Windows\System\wAREoTs.exe
  2⤵
  PID:4944
- C:\Windows\System\aIlkeFz.exe
  C:\Windows\System\aIlkeFz.exe
  2⤵
  PID:12348
- C:\Windows\System\OSsYEDE.exe
  C:\Windows\System\OSsYEDE.exe
  2⤵
  PID:916
- C:\Windows\System\KSfOqja.exe
  C:\Windows\System\KSfOqja.exe
  2⤵
  PID:2824
- C:\Windows\System\lqDqUAy.exe
  C:\Windows\System\lqDqUAy.exe
  2⤵
  PID:10104
- C:\Windows\System\Adhawur.exe
  C:\Windows\System\Adhawur.exe
  2⤵
  PID:2784
- C:\Windows\System\zDqZPMI.exe
  C:\Windows\System\zDqZPMI.exe
  2⤵
  PID:3068
- C:\Windows\System\HJhYcie.exe
  C:\Windows\System\HJhYcie.exe
  2⤵
  PID:732
- C:\Windows\System\rpCyBDZ.exe
  C:\Windows\System\rpCyBDZ.exe
  2⤵
  PID:1676
- C:\Windows\System\kDGUpeo.exe
  C:\Windows\System\kDGUpeo.exe
  2⤵
  PID:372
- C:\Windows\System\EqqxZru.exe
  C:\Windows\System\EqqxZru.exe
  2⤵
  PID:2056
- C:\Windows\System\uLXDjjE.exe
  C:\Windows\System\uLXDjjE.exe
  2⤵
  PID:4556
- C:\Windows\System\MxkPgsq.exe
  C:\Windows\System\MxkPgsq.exe
  2⤵
  PID:3968
- C:\Windows\System\vznydJh.exe
  C:\Windows\System\vznydJh.exe
  2⤵
  PID:4768
- C:\Windows\System\hKYwOPO.exe
  C:\Windows\System\hKYwOPO.exe
  2⤵
  PID:4828
- C:\Windows\System\GznBfYN.exe
  C:\Windows\System\GznBfYN.exe
  2⤵
  PID:1728
- C:\Windows\System\cPSrcGz.exe
  C:\Windows\System\cPSrcGz.exe
  2⤵
  PID:13064
- C:\Windows\System\DgjxYUn.exe
  C:\Windows\System\DgjxYUn.exe
  2⤵
  PID:2688
- C:\Windows\System\ApEaGCC.exe
  C:\Windows\System\ApEaGCC.exe
  2⤵
  PID:4328
- C:\Windows\System\AWkrhNg.exe
  C:\Windows\System\AWkrhNg.exe
  2⤵
  PID:5688
- C:\Windows\System\EMHwRcl.exe
  C:\Windows\System\EMHwRcl.exe
  2⤵
  PID:5136
- C:\Windows\System\sWSDcoy.exe
  C:\Windows\System\sWSDcoy.exe
  2⤵
  PID:4752
- C:\Windows\System\zpVhjMP.exe
  C:\Windows\System\zpVhjMP.exe
  2⤵
  PID:4548
- C:\Windows\System\lErjecZ.exe
  C:\Windows\System\lErjecZ.exe
  2⤵
  PID:5084
- C:\Windows\System\bkFVIEt.exe
  C:\Windows\System\bkFVIEt.exe
  2⤵
  PID:1596
- C:\Windows\System\qLFrSGU.exe
  C:\Windows\System\qLFrSGU.exe
  2⤵
  PID:1376
- C:\Windows\System\mMPdgtr.exe
  C:\Windows\System\mMPdgtr.exe
  2⤵
  PID:3876
- C:\Windows\System\RObuBsC.exe
  C:\Windows\System\RObuBsC.exe
  2⤵
  PID:4112
- C:\Windows\System\naqOous.exe
  C:\Windows\System\naqOous.exe
  2⤵
  PID:3392
- C:\Windows\System\iWbrYJf.exe
  C:\Windows\System\iWbrYJf.exe
  2⤵
  PID:4748
- C:\Windows\System\qJZSaIR.exe
  C:\Windows\System\qJZSaIR.exe
  2⤵
  PID:5088
- C:\Windows\System\ndPfRGU.exe
  C:\Windows\System\ndPfRGU.exe
  2⤵
  PID:368
- C:\Windows\System\dblzNMX.exe
  C:\Windows\System\dblzNMX.exe
  2⤵
  PID:13324
- C:\Windows\System\EqEHlcb.exe
  C:\Windows\System\EqEHlcb.exe
  2⤵
  PID:13340
- C:\Windows\System\LQsjaEF.exe
  C:\Windows\System\LQsjaEF.exe
  2⤵
  PID:13356
- C:\Windows\System\erQxIHx.exe
  C:\Windows\System\erQxIHx.exe
  2⤵
  PID:13372
- C:\Windows\System\eSEPgcQ.exe
  C:\Windows\System\eSEPgcQ.exe
  2⤵
  PID:13388
- C:\Windows\System\jfNmSrI.exe
  C:\Windows\System\jfNmSrI.exe
  2⤵
  PID:13404
- C:\Windows\System\qlqSgFl.exe
  C:\Windows\System\qlqSgFl.exe
  2⤵
  PID:13420
- C:\Windows\System\KynLasI.exe
  C:\Windows\System\KynLasI.exe
  2⤵
  PID:13436
- C:\Windows\System\YVuFQEe.exe
  C:\Windows\System\YVuFQEe.exe
  2⤵
  PID:13456
- C:\Windows\System\jnmAhAm.exe
  C:\Windows\System\jnmAhAm.exe
  2⤵
  PID:13476
- C:\Windows\System\RIZwIDi.exe
  C:\Windows\System\RIZwIDi.exe
  2⤵
  PID:13492
- C:\Windows\System\gtfpIzg.exe
  C:\Windows\System\gtfpIzg.exe
  2⤵
  PID:13508
- C:\Windows\System\ivccfjX.exe
  C:\Windows\System\ivccfjX.exe
  2⤵
  PID:13524
- C:\Windows\System\xRZZStg.exe
  C:\Windows\System\xRZZStg.exe
  2⤵
  PID:13540
- C:\Windows\System\vqvfuKO.exe
  C:\Windows\System\vqvfuKO.exe
  2⤵
  PID:13560
- C:\Windows\System\fVfFGdB.exe
  C:\Windows\System\fVfFGdB.exe
  2⤵
  PID:13576
- C:\Windows\System\ZhtFrtE.exe
  C:\Windows\System\ZhtFrtE.exe
  2⤵
  PID:13592
- C:\Windows\System\CfZTtrG.exe
  C:\Windows\System\CfZTtrG.exe
  2⤵
  PID:13608
- C:\Windows\System\jllWLSI.exe
  C:\Windows\System\jllWLSI.exe
  2⤵
  PID:13624
- C:\Windows\System\xDJHGxa.exe
  C:\Windows\System\xDJHGxa.exe
  2⤵
  PID:13640
- C:\Windows\System\UDJwUCb.exe
  C:\Windows\System\UDJwUCb.exe
  2⤵
  PID:13656
- C:\Windows\System\UokjAoK.exe
  C:\Windows\System\UokjAoK.exe
  2⤵
  PID:13672
- C:\Windows\System\LMolaTN.exe
  C:\Windows\System\LMolaTN.exe
  2⤵
  PID:13688
- C:\Windows\System\LhVFIxj.exe
  C:\Windows\System\LhVFIxj.exe
  2⤵
  PID:13704
- C:\Windows\System\UzmhZPJ.exe
  C:\Windows\System\UzmhZPJ.exe
  2⤵
  PID:13720
- C:\Windows\System\DiJaEWX.exe
  C:\Windows\System\DiJaEWX.exe
  2⤵
  PID:13736
- C:\Windows\System\dgowyyC.exe
  C:\Windows\System\dgowyyC.exe
  2⤵
  PID:13752
- C:\Windows\System\OTNRtLM.exe
  C:\Windows\System\OTNRtLM.exe
  2⤵
  PID:13768
- C:\Windows\System\gHzLGoX.exe
  C:\Windows\System\gHzLGoX.exe
  2⤵
  PID:13784
- C:\Windows\System\HWZJlyL.exe
  C:\Windows\System\HWZJlyL.exe
  2⤵
  PID:13800
- C:\Windows\System\WoPDQYW.exe
  C:\Windows\System\WoPDQYW.exe
  2⤵
  PID:13816
- C:\Windows\System\lmFtNVw.exe
  C:\Windows\System\lmFtNVw.exe
  2⤵
  PID:13832
- C:\Windows\System\UnFIegY.exe
  C:\Windows\System\UnFIegY.exe
  2⤵
  PID:13848
- C:\Windows\System\JuKqiwE.exe
  C:\Windows\System\JuKqiwE.exe
  2⤵
  PID:13864
- C:\Windows\System\NAKEDAz.exe
  C:\Windows\System\NAKEDAz.exe
  2⤵
  PID:13880
- C:\Windows\System\OtDPkyQ.exe
  C:\Windows\System\OtDPkyQ.exe
  2⤵
  PID:13896
- C:\Windows\System\MPqDqTT.exe
  C:\Windows\System\MPqDqTT.exe
  2⤵
  PID:13912
- C:\Windows\System\pXZuEkf.exe
  C:\Windows\System\pXZuEkf.exe
  2⤵
  PID:13928
- C:\Windows\System\eASpUWL.exe
  C:\Windows\System\eASpUWL.exe
  2⤵
  PID:13944
- C:\Windows\System\NuhraUv.exe
  C:\Windows\System\NuhraUv.exe
  2⤵
  PID:13960
- C:\Windows\System\ChuwwvI.exe
  C:\Windows\System\ChuwwvI.exe
  2⤵
  PID:13976
- C:\Windows\System\OBfuVPY.exe
  C:\Windows\System\OBfuVPY.exe
  2⤵
  PID:13992
- C:\Windows\System\vkMaJvJ.exe
  C:\Windows\System\vkMaJvJ.exe
  2⤵
  PID:14008
- C:\Windows\System\CoCTuzl.exe
  C:\Windows\System\CoCTuzl.exe
  2⤵
  PID:14024
- C:\Windows\System\EHIaLLz.exe
  C:\Windows\System\EHIaLLz.exe
  2⤵
  PID:14040
- C:\Windows\System\ITbOEYX.exe
  C:\Windows\System\ITbOEYX.exe
  2⤵
  PID:14056
- C:\Windows\System\WpaLfNh.exe
  C:\Windows\System\WpaLfNh.exe
  2⤵
  PID:14072
- C:\Windows\System\owmBthJ.exe
  C:\Windows\System\owmBthJ.exe
  2⤵
  PID:14088
- C:\Windows\System\RSavZNI.exe
  C:\Windows\System\RSavZNI.exe
  2⤵
  PID:14104
- C:\Windows\System\PtggNEy.exe
  C:\Windows\System\PtggNEy.exe
  2⤵
  PID:14120
- C:\Windows\System\tbOSIHf.exe
  C:\Windows\System\tbOSIHf.exe
  2⤵
  PID:14136
- C:\Windows\System\nRkBDTY.exe
  C:\Windows\System\nRkBDTY.exe
  2⤵
  PID:14152
- C:\Windows\System\PxisXtX.exe
  C:\Windows\System\PxisXtX.exe
  2⤵
  PID:14168
- C:\Windows\System\KDWfycq.exe
  C:\Windows\System\KDWfycq.exe
  2⤵
  PID:14184
- C:\Windows\System\ITXQsRM.exe
  C:\Windows\System\ITXQsRM.exe
  2⤵
  PID:14200
- C:\Windows\System\jbFysCa.exe
  C:\Windows\System\jbFysCa.exe
  2⤵
  PID:14216
- C:\Windows\System\QwoRzmr.exe
  C:\Windows\System\QwoRzmr.exe
  2⤵
  PID:14232
- C:\Windows\System\KJuQMFo.exe
  C:\Windows\System\KJuQMFo.exe
  2⤵
  PID:14248
- C:\Windows\System\zZegDlX.exe
  C:\Windows\System\zZegDlX.exe
  2⤵
  PID:14264
- C:\Windows\System\lrJlMbo.exe
  C:\Windows\System\lrJlMbo.exe
  2⤵
  PID:14280
- C:\Windows\System\TNNGjNg.exe
  C:\Windows\System\TNNGjNg.exe
  2⤵
  PID:14296
- C:\Windows\System\XncnEzl.exe
  C:\Windows\System\XncnEzl.exe
  2⤵
  PID:14312
- C:\Windows\System\MkXLsQV.exe
  C:\Windows\System\MkXLsQV.exe
  2⤵
  PID:14332
- C:\Windows\System\ATjqfSS.exe
  C:\Windows\System\ATjqfSS.exe
  2⤵
  PID:13336
- C:\Windows\System\HMqUZXW.exe
  C:\Windows\System\HMqUZXW.exe
  2⤵
  PID:13368
- C:\Windows\System\ioDpqkE.exe
  C:\Windows\System\ioDpqkE.exe
  2⤵
  PID:13400
- C:\Windows\System\yVbwwoo.exe
  C:\Windows\System\yVbwwoo.exe
  2⤵
  PID:13432
- C:\Windows\System\YaGQeLx.exe
  C:\Windows\System\YaGQeLx.exe
  2⤵
  PID:13468
- C:\Windows\System\kAVNpcg.exe
  C:\Windows\System\kAVNpcg.exe
  2⤵
  PID:13500
- C:\Windows\System\rOWrWUJ.exe
  C:\Windows\System\rOWrWUJ.exe
  2⤵
  PID:13532
- C:\Windows\System\NUhwYIs.exe
  C:\Windows\System\NUhwYIs.exe
  2⤵
  PID:13568
- C:\Windows\System\ZNyECcj.exe
  C:\Windows\System\ZNyECcj.exe
  2⤵
  PID:13600
- C:\Windows\System\bGxZpax.exe
  C:\Windows\System\bGxZpax.exe
  2⤵
  PID:13632
- C:\Windows\System\mOKoXwq.exe
  C:\Windows\System\mOKoXwq.exe
  2⤵
  PID:13664
- C:\Windows\System\eebtHOK.exe
  C:\Windows\System\eebtHOK.exe
  2⤵
  PID:13716
- C:\Windows\System\NZaItbz.exe
  C:\Windows\System\NZaItbz.exe
  2⤵
  PID:13748
- C:\Windows\System\TSbtIME.exe
  C:\Windows\System\TSbtIME.exe
  2⤵
  PID:13780
- C:\Windows\System\utEVGKd.exe
  C:\Windows\System\utEVGKd.exe
  2⤵
  PID:13812
- C:\Windows\System\EqQYoqN.exe
  C:\Windows\System\EqQYoqN.exe
  2⤵
  PID:13844
- C:\Windows\System\QVYJUGL.exe
  C:\Windows\System\QVYJUGL.exe
  2⤵
  PID:13876
- C:\Windows\System\vvRIvPm.exe
  C:\Windows\System\vvRIvPm.exe
  2⤵
  PID:13908
- C:\Windows\System\BIMSrLD.exe
  C:\Windows\System\BIMSrLD.exe
  2⤵
  PID:13940
- C:\Windows\System\YboPKpg.exe
  C:\Windows\System\YboPKpg.exe
  2⤵
  PID:13972
- C:\Windows\System\gHThlkK.exe
  C:\Windows\System\gHThlkK.exe
  2⤵
  PID:14000
- C:\Windows\System\uwFkWcP.exe
  C:\Windows\System\uwFkWcP.exe
  2⤵
  PID:14032
- C:\Windows\System\tvhXdzG.exe
  C:\Windows\System\tvhXdzG.exe
  2⤵
  PID:14064
- C:\Windows\System\ahmMXAd.exe
  C:\Windows\System\ahmMXAd.exe
  2⤵
  PID:14096
- C:\Windows\System\GVCSYyU.exe
  C:\Windows\System\GVCSYyU.exe
  2⤵
  PID:14128
- C:\Windows\System\JzjRQLC.exe
  C:\Windows\System\JzjRQLC.exe
  2⤵
  PID:14160
- C:\Windows\System\bdRkLwU.exe
  C:\Windows\System\bdRkLwU.exe
  2⤵
  PID:14192
- C:\Windows\System\YELlHSE.exe
  C:\Windows\System\YELlHSE.exe
  2⤵
  PID:14224
- C:\Windows\System\zPHCvKS.exe
  C:\Windows\System\zPHCvKS.exe
  2⤵
  PID:14244
- C:\Windows\System\BIRYHlQ.exe
  C:\Windows\System\BIRYHlQ.exe
  2⤵
  PID:14276
- C:\Windows\System\ITftqeU.exe
  C:\Windows\System\ITftqeU.exe
  2⤵
  PID:14308
- C:\Windows\System\YQRSUXa.exe
  C:\Windows\System\YQRSUXa.exe
  2⤵
  PID:13332
- C:\Windows\System\hQWkSCE.exe
  C:\Windows\System\hQWkSCE.exe
  2⤵
  PID:13396
- C:\Windows\System\oPaoRLk.exe
  C:\Windows\System\oPaoRLk.exe
  2⤵
  PID:13448
- C:\Windows\System\uAbcCIQ.exe
  C:\Windows\System\uAbcCIQ.exe
  2⤵
  PID:13520
- C:\Windows\System\ENHTBVJ.exe
  C:\Windows\System\ENHTBVJ.exe
  2⤵
  PID:13588
- C:\Windows\System\AFzDyEv.exe
  C:\Windows\System\AFzDyEv.exe
  2⤵
  PID:13652
- C:\Windows\System\dYoKSYK.exe
  C:\Windows\System\dYoKSYK.exe
  2⤵
  PID:13700
- C:\Windows\System\YdWBfUS.exe
  C:\Windows\System\YdWBfUS.exe
  2⤵
  PID:13764
- C:\Windows\System\gdzXYeV.exe
  C:\Windows\System\gdzXYeV.exe
  2⤵
  PID:13828
- C:\Windows\System\ZuKiMKK.exe
  C:\Windows\System\ZuKiMKK.exe
  2⤵
  PID:13892
- C:\Windows\System\oHzQmTe.exe
  C:\Windows\System\oHzQmTe.exe
  2⤵
  PID:13936
- C:\Windows\System\WqGUxds.exe
  C:\Windows\System\WqGUxds.exe
  2⤵
  PID:3996
- C:\Windows\System\mUiamxj.exe
  C:\Windows\System\mUiamxj.exe
  2⤵
  PID:14052
- C:\Windows\System\JmOdunC.exe
  C:\Windows\System\JmOdunC.exe
  2⤵
  PID:14116
- C:\Windows\System\yYniNHh.exe
  C:\Windows\System\yYniNHh.exe
  2⤵
  PID:14180
- C:\Windows\System\sTMwtKv.exe
  C:\Windows\System\sTMwtKv.exe
  2⤵
  PID:6772
- C:\Windows\System\MDeWfJN.exe
  C:\Windows\System\MDeWfJN.exe
  2⤵
  PID:14292
- C:\Windows\System\spQpLnF.exe
  C:\Windows\System\spQpLnF.exe
  2⤵
  PID:13444
- C:\Windows\System\UqGdFPr.exe
  C:\Windows\System\UqGdFPr.exe
  2⤵
  PID:13584
- C:\Windows\System\Qepfuhh.exe
  C:\Windows\System\Qepfuhh.exe
  2⤵
  PID:13744
- C:\Windows\System\Jdoojsu.exe
  C:\Windows\System\Jdoojsu.exe
  2⤵
  PID:6160
- C:\Windows\System\dKIgrkk.exe
  C:\Windows\System\dKIgrkk.exe
  2⤵
  PID:13904
- C:\Windows\System\YFPMNfy.exe
  C:\Windows\System\YFPMNfy.exe
  2⤵
  PID:14020
- C:\Windows\System\kNfeZKE.exe
  C:\Windows\System\kNfeZKE.exe
  2⤵
  PID:14148
- C:\Windows\System\qnPnRmO.exe
  C:\Windows\System\qnPnRmO.exe
  2⤵
  PID:5092
- C:\Windows\System\TlJtOZg.exe
  C:\Windows\System\TlJtOZg.exe
  2⤵
  PID:5096
- C:\Windows\System\hBrCIMo.exe
  C:\Windows\System\hBrCIMo.exe
  2⤵
  PID:14272
- C:\Windows\System\TCiQNNS.exe
  C:\Windows\System\TCiQNNS.exe
  2⤵
  PID:13556
- C:\Windows\System\reaEHhr.exe
  C:\Windows\System\reaEHhr.exe
  2⤵
  PID:13796
- C:\Windows\System\saXWNyD.exe
  C:\Windows\System\saXWNyD.exe
  2⤵
  PID:13988
- C:\Windows\System\poGGRNp.exe
  C:\Windows\System\poGGRNp.exe
  2⤵
  PID:2916
- C:\Windows\System\wBVoeZl.exe
  C:\Windows\System\wBVoeZl.exe
  2⤵
  PID:14260
- C:\Windows\System\fRIEuiV.exe
  C:\Windows\System\fRIEuiV.exe
  2⤵
  PID:13872
- C:\Windows\System\moCVkkE.exe
  C:\Windows\System\moCVkkE.exe
  2⤵
  PID:532
- C:\Windows\System\JrXvaWr.exe
  C:\Windows\System\JrXvaWr.exe
  2⤵
  PID:14112
- C:\Windows\System\qalXioC.exe
  C:\Windows\System\qalXioC.exe
  2⤵
  PID:5056
- C:\Windows\System\mGjkDmi.exe
  C:\Windows\System\mGjkDmi.exe
  2⤵
  PID:4820
- C:\Windows\System\ySdhdxb.exe
  C:\Windows\System\ySdhdxb.exe
  2⤵
  PID:5116
- C:\Windows\System\rBLkeaU.exe
  C:\Windows\System\rBLkeaU.exe
  2⤵
  PID:13516
- C:\Windows\System\vuwCTLR.exe
  C:\Windows\System\vuwCTLR.exe
  2⤵
  PID:440
- C:\Windows\System\SBPiHRE.exe
  C:\Windows\System\SBPiHRE.exe
  2⤵
  PID:14348
- C:\Windows\System\GCfdayZ.exe
  C:\Windows\System\GCfdayZ.exe
  2⤵
  PID:14364
- C:\Windows\System\YYhWfTK.exe
  C:\Windows\System\YYhWfTK.exe
  2⤵
  PID:14380
- C:\Windows\System\GdhRoYv.exe
  C:\Windows\System\GdhRoYv.exe
  2⤵
  PID:14396
- C:\Windows\System\FAmpoxZ.exe
  C:\Windows\System\FAmpoxZ.exe
  2⤵
  PID:14456
- C:\Windows\System\KLvgHDE.exe
  C:\Windows\System\KLvgHDE.exe
  2⤵
  PID:14484
- C:\Windows\System\OFkISim.exe
  C:\Windows\System\OFkISim.exe
  2⤵
  PID:14516
- C:\Windows\System\gXFVgrv.exe
  C:\Windows\System\gXFVgrv.exe
  2⤵
  PID:14560
- C:\Windows\System\vGGNfMr.exe
  C:\Windows\System\vGGNfMr.exe
  2⤵
  PID:14616
- C:\Windows\System\fNvpRCB.exe
  C:\Windows\System\fNvpRCB.exe
  2⤵
  PID:14632
- C:\Windows\System\rwZWzhZ.exe
  C:\Windows\System\rwZWzhZ.exe
  2⤵
  PID:14680
- C:\Windows\System\uIwOlOS.exe
  C:\Windows\System\uIwOlOS.exe
  2⤵
  PID:14696
- C:\Windows\System\YYPKtAF.exe
  C:\Windows\System\YYPKtAF.exe
  2⤵
  PID:14712
- C:\Windows\System\fOUSXbu.exe
  C:\Windows\System\fOUSXbu.exe
  2⤵
  PID:14728
- C:\Windows\System\NVaUgUU.exe
  C:\Windows\System\NVaUgUU.exe
  2⤵
  PID:14748
- C:\Windows\System\YIBKsoK.exe
  C:\Windows\System\YIBKsoK.exe
  2⤵
  PID:14768
- C:\Windows\System\fYPMePJ.exe
  C:\Windows\System\fYPMePJ.exe
  2⤵
  PID:14788
- C:\Windows\System\CIMSaoc.exe
  C:\Windows\System\CIMSaoc.exe
  2⤵
  PID:14804
- C:\Windows\System\SjieBYg.exe
  C:\Windows\System\SjieBYg.exe
  2⤵
  PID:14824
- C:\Windows\System\kmhYIhq.exe
  C:\Windows\System\kmhYIhq.exe
  2⤵
  PID:14844
- C:\Windows\System\RfvSKhz.exe
  C:\Windows\System\RfvSKhz.exe
  2⤵
  PID:14868
- C:\Windows\System\WqNNrjw.exe
  C:\Windows\System\WqNNrjw.exe
  2⤵
  PID:14884
- C:\Windows\System\cyWjkPR.exe
  C:\Windows\System\cyWjkPR.exe
  2⤵
  PID:14916
- C:\Windows\System\XCzwXXa.exe
  C:\Windows\System\XCzwXXa.exe
  2⤵
  PID:15028
- C:\Windows\System\oWaRzSy.exe
  C:\Windows\System\oWaRzSy.exe
  2⤵
  PID:15044
- C:\Windows\System\IEOQuHA.exe
  C:\Windows\System\IEOQuHA.exe
  2⤵
  PID:15060
- C:\Windows\System\gejpgke.exe
  C:\Windows\System\gejpgke.exe
  2⤵
  PID:15076
- C:\Windows\System\nxogoSr.exe
  C:\Windows\System\nxogoSr.exe
  2⤵
  PID:15092
- C:\Windows\System\iTpvJwT.exe
  C:\Windows\System\iTpvJwT.exe
  2⤵
  PID:15108
- C:\Windows\System\zCORiJd.exe
  C:\Windows\System\zCORiJd.exe
  2⤵
  PID:15132
- C:\Windows\System\IVYZfwj.exe
  C:\Windows\System\IVYZfwj.exe
  2⤵
  PID:15152
- C:\Windows\System\XHgtynD.exe
  C:\Windows\System\XHgtynD.exe
  2⤵
  PID:15168
- C:\Windows\System\wthrOBi.exe
  C:\Windows\System\wthrOBi.exe
  2⤵
  PID:15192
- C:\Windows\System\LwrXfuP.exe
  C:\Windows\System\LwrXfuP.exe
  2⤵
  PID:15208
- C:\Windows\System\IZsQjKN.exe
  C:\Windows\System\IZsQjKN.exe
  2⤵
  PID:15224
- C:\Windows\System\xbDWSsF.exe
  C:\Windows\System\xbDWSsF.exe
  2⤵
  PID:15240
- C:\Windows\System\GTVRCwC.exe
  C:\Windows\System\GTVRCwC.exe
  2⤵
  PID:15284
- C:\Windows\System\hTGpRaA.exe
  C:\Windows\System\hTGpRaA.exe
  2⤵
  PID:15332
- C:\Windows\System\PblZZiT.exe
  C:\Windows\System\PblZZiT.exe
  2⤵
  PID:15352
- C:\Windows\System\clnEmDk.exe
  C:\Windows\System\clnEmDk.exe
  2⤵
  PID:14440
- C:\Windows\System\plvFtGk.exe
  C:\Windows\System\plvFtGk.exe
  2⤵
  PID:14512
- C:\Windows\System\qdQBPJM.exe
  C:\Windows\System\qdQBPJM.exe
  2⤵
  PID:14544
- C:\Windows\System\hBabsTr.exe
  C:\Windows\System\hBabsTr.exe
  2⤵
  PID:14576
- C:\Windows\System\qKPlnqM.exe
  C:\Windows\System\qKPlnqM.exe
  2⤵
  PID:4044
- C:\Windows\System\pZcghqd.exe
  C:\Windows\System\pZcghqd.exe
  2⤵
  PID:14596
- C:\Windows\System\uDZCqhK.exe
  C:\Windows\System\uDZCqhK.exe
  2⤵
  PID:14628
- C:\Windows\System\mzpBYfk.exe
  C:\Windows\System\mzpBYfk.exe
  2⤵
  PID:2004
- C:\Windows\System\rwXgXKI.exe
  C:\Windows\System\rwXgXKI.exe
  2⤵
  PID:14668
- C:\Windows\System\jnXkhGq.exe
  C:\Windows\System\jnXkhGq.exe
  2⤵
  PID:14692
- C:\Windows\System\EKUTeSy.exe
  C:\Windows\System\EKUTeSy.exe
  2⤵
  PID:14720
- C:\Windows\System\qMmYrPV.exe
  C:\Windows\System\qMmYrPV.exe
  2⤵
  PID:14744
- C:\Windows\System\PRIeVQS.exe
  C:\Windows\System\PRIeVQS.exe
  2⤵
  PID:14780
- C:\Windows\System\uuNdTxH.exe
  C:\Windows\System\uuNdTxH.exe
  2⤵
  PID:14796
- C:\Windows\System\efBliEm.exe
  C:\Windows\System\efBliEm.exe
  2⤵
  PID:14840
- C:\Windows\System\zSOLsnK.exe
  C:\Windows\System\zSOLsnK.exe
  2⤵
  PID:2684
- C:\Windows\System\szQNJSe.exe
  C:\Windows\System\szQNJSe.exe
  2⤵
  PID:2268
- C:\Windows\System\qQTerMG.exe
  C:\Windows\System\qQTerMG.exe
  2⤵
  PID:7220
- C:\Windows\System\QEmtOTB.exe
  C:\Windows\System\QEmtOTB.exe
  2⤵
  PID:14896
- C:\Windows\System\ZjauPPo.exe
  C:\Windows\System\ZjauPPo.exe
  2⤵
  PID:14912
- C:\Windows\System\bWtIAkW.exe
  C:\Windows\System\bWtIAkW.exe
  2⤵
  PID:14924
- C:\Windows\System\MZGhsuL.exe
  C:\Windows\System\MZGhsuL.exe
  2⤵
  PID:14948
- C:\Windows\System\ZqtyrDd.exe
  C:\Windows\System\ZqtyrDd.exe
  2⤵
  PID:3628
- C:\Windows\System\tLnujsm.exe
  C:\Windows\System\tLnujsm.exe
  2⤵
  PID:14956
- C:\Windows\System\YyJoHgo.exe
  C:\Windows\System\YyJoHgo.exe
  2⤵
  PID:15040
- C:\Windows\System\sseRklE.exe
  C:\Windows\System\sseRklE.exe
  2⤵
  PID:15008
- C:\Windows\System\slXJVEP.exe
  C:\Windows\System\slXJVEP.exe
  2⤵
  PID:15100
- C:\Windows\System\nqyXleJ.exe
  C:\Windows\System\nqyXleJ.exe
  2⤵
  PID:15068
- C:\Windows\System\eKjAOFZ.exe
  C:\Windows\System\eKjAOFZ.exe
  2⤵
  PID:1812
- C:\Windows\System\DJWdrBb.exe
  C:\Windows\System\DJWdrBb.exe
  2⤵
  PID:15124
- C:\Windows\System\PivoIRp.exe
  C:\Windows\System\PivoIRp.exe
  2⤵
  PID:4776
- C:\Windows\System\qLuZHbz.exe
  C:\Windows\System\qLuZHbz.exe
  2⤵
  PID:14984
- C:\Windows\System\prxZNBg.exe
  C:\Windows\System\prxZNBg.exe
  2⤵
  PID:7964
- C:\Windows\System\AssFgHC.exe
  C:\Windows\System\AssFgHC.exe
  2⤵
  PID:7988
- C:\Windows\System\PmavRQM.exe
  C:\Windows\System\PmavRQM.exe
  2⤵
  PID:8060
- C:\Windows\System\IQgEtav.exe
  C:\Windows\System\IQgEtav.exe
  2⤵
  PID:6668
- C:\Windows\System\TzUiSZV.exe
  C:\Windows\System\TzUiSZV.exe
  2⤵
  PID:4144
- C:\Windows\System\ySpwBkE.exe
  C:\Windows\System\ySpwBkE.exe
  2⤵
  PID:3200
- C:\Windows\System\vRBBugu.exe
  C:\Windows\System\vRBBugu.exe
  2⤵
  PID:7688
- C:\Windows\System\oBrCwky.exe
  C:\Windows\System\oBrCwky.exe
  2⤵
  PID:7712
- C:\Windows\System\jclbmtA.exe
  C:\Windows\System\jclbmtA.exe
  2⤵
  PID:7772
- C:\Windows\System\qeGmwkA.exe
  C:\Windows\System\qeGmwkA.exe
  2⤵
  PID:7736
- C:\Windows\System\QpPueBi.exe
  C:\Windows\System\QpPueBi.exe
  2⤵
  PID:7876
- C:\Windows\System\pHNTlEl.exe
  C:\Windows\System\pHNTlEl.exe
  2⤵
  PID:7596
- C:\Windows\System\rzpOgXt.exe
  C:\Windows\System\rzpOgXt.exe
  2⤵
  PID:8156
- C:\Windows\System\sfSWdtC.exe
  C:\Windows\System\sfSWdtC.exe
  2⤵
  PID:8132
- C:\Windows\System\mMtQVuT.exe
  C:\Windows\System\mMtQVuT.exe
  2⤵
  PID:15140
- C:\Windows\System\sLPhHpM.exe
  C:\Windows\System\sLPhHpM.exe
  2⤵
  PID:2940
- C:\Windows\System\VnRrwbo.exe
  C:\Windows\System\VnRrwbo.exe
  2⤵
  PID:15248
- C:\Windows\System\UAXlInf.exe
  C:\Windows\System\UAXlInf.exe
  2⤵
  PID:15280
- C:\Windows\System\GimwpQK.exe
  C:\Windows\System\GimwpQK.exe
  2⤵
  PID:1456
- C:\Windows\System\WTUaBhh.exe
  C:\Windows\System\WTUaBhh.exe
  2⤵
  PID:7412
- C:\Windows\System\WrNZeVl.exe
  C:\Windows\System\WrNZeVl.exe
  2⤵
  PID:15220
- C:\Windows\System\yeWMlXT.exe
  C:\Windows\System\yeWMlXT.exe
  2⤵
  PID:14388
- C:\Windows\System\nnSOwuc.exe
  C:\Windows\System\nnSOwuc.exe
  2⤵
  PID:4124
- C:\Windows\System\aDcNoty.exe
  C:\Windows\System\aDcNoty.exe
  2⤵
  PID:14420
- C:\Windows\System\rwgkFQv.exe
  C:\Windows\System\rwgkFQv.exe
  2⤵
  PID:15296
- C:\Windows\System\MUaloIY.exe
  C:\Windows\System\MUaloIY.exe
  2⤵
  PID:15308
- C:\Windows\System\bmjeMVH.exe
  C:\Windows\System\bmjeMVH.exe
  2⤵
  PID:14452
- C:\Windows\System\QZClmlc.exe
  C:\Windows\System\QZClmlc.exe
  2⤵
  PID:14640
- C:\Windows\System\CjtEKiW.exe
  C:\Windows\System\CjtEKiW.exe
  2⤵
  PID:14372
- C:\Windows\System\WajoEQT.exe
  C:\Windows\System\WajoEQT.exe
  2⤵
  PID:14412
- C:\Windows\System\iJdisEm.exe
  C:\Windows\System\iJdisEm.exe
  2⤵
  PID:14408
- C:\Windows\System\SiWEqky.exe
  C:\Windows\System\SiWEqky.exe
  2⤵
  PID:1912
- C:\Windows\System\BHiCmlR.exe
  C:\Windows\System\BHiCmlR.exe
  2⤵
  PID:1320
- C:\Windows\System\BNbHcyM.exe
  C:\Windows\System\BNbHcyM.exe
  2⤵
  PID:8404
- C:\Windows\System\pbdsOvC.exe
  C:\Windows\System\pbdsOvC.exe
  2⤵
  PID:14604
- C:\Windows\System\FDsmMnB.exe
  C:\Windows\System\FDsmMnB.exe
  2⤵
  PID:14592
- C:\Windows\System\dmmrvvQ.exe
  C:\Windows\System\dmmrvvQ.exe
  2⤵
  PID:2400
- C:\Windows\System\mtlntVi.exe
  C:\Windows\System\mtlntVi.exe
  2⤵
  PID:5076
- C:\Windows\System\wkIztLt.exe
  C:\Windows\System\wkIztLt.exe
  2⤵
  PID:2996
- C:\Windows\System\fynbfuT.exe
  C:\Windows\System\fynbfuT.exe
  2⤵
  PID:3528
- C:\Windows\System\pbwvjeU.exe
  C:\Windows\System\pbwvjeU.exe
  2⤵
  PID:14644
- C:\Windows\System\wIjqtnN.exe
  C:\Windows\System\wIjqtnN.exe
  2⤵
  PID:14656
- C:\Windows\System\vVsxBVe.exe
  C:\Windows\System\vVsxBVe.exe
  2⤵
  PID:1896
- C:\Windows\System\fREPrhx.exe
  C:\Windows\System\fREPrhx.exe
  2⤵
  PID:6960
- C:\Windows\System\TCXpbNI.exe
  C:\Windows\System\TCXpbNI.exe
  2⤵
  PID:14760
- C:\Windows\System\zkEMhWV.exe
  C:\Windows\System\zkEMhWV.exe
  2⤵
  PID:14812
- C:\Windows\System\TKpbhoU.exe
  C:\Windows\System\TKpbhoU.exe
  2⤵
  PID:3848
- C:\Windows\System\NEYrVIK.exe
  C:\Windows\System\NEYrVIK.exe
  2⤵
  PID:14880
- C:\Windows\System\LtSyzSx.exe
  C:\Windows\System\LtSyzSx.exe
  2⤵
  PID:4332
- C:\Windows\System\pImixAC.exe
  C:\Windows\System\pImixAC.exe
  2⤵
  PID:612
- C:\Windows\System\HTadtur.exe
  C:\Windows\System\HTadtur.exe
  2⤵
  PID:14832
- C:\Windows\System\uscCIka.exe
  C:\Windows\System\uscCIka.exe
  2⤵
  PID:14940
- C:\Windows\System\Bajswci.exe
  C:\Windows\System\Bajswci.exe
  2⤵
  PID:3340
- C:\Windows\System\OfypwuY.exe
  C:\Windows\System\OfypwuY.exe
  2⤵
  PID:3644
- C:\Windows\System\sApPotc.exe
  C:\Windows\System\sApPotc.exe
  2⤵
  PID:2260
- C:\Windows\System\bfxQoSF.exe
  C:\Windows\System\bfxQoSF.exe
  2⤵
  PID:548
- C:\Windows\System\qwOMbxR.exe
  C:\Windows\System\qwOMbxR.exe
  2⤵
  PID:15036
- C:\Windows\System\dJZuMuZ.exe
  C:\Windows\System\dJZuMuZ.exe
  2⤵
  PID:15020
- C:\Windows\System\TjDENQv.exe
  C:\Windows\System\TjDENQv.exe
  2⤵
  PID:8808
- C:\Windows\System\zpPihkV.exe
  C:\Windows\System\zpPihkV.exe
  2⤵
  PID:2392
- C:\Windows\System\pGNQckZ.exe
  C:\Windows\System\pGNQckZ.exe
  2⤵
  PID:15128
- C:\Windows\System\xryanNe.exe
  C:\Windows\System\xryanNe.exe
  2⤵
  PID:8852
- C:\Windows\System\LrJaRCZ.exe
  C:\Windows\System\LrJaRCZ.exe
  2⤵
  PID:15164
- C:\Windows\System\YBLoxXf.exe
  C:\Windows\System\YBLoxXf.exe
  2⤵
  PID:8024
- C:\Windows\System\cnyZyUP.exe
  C:\Windows\System\cnyZyUP.exe
  2⤵
  PID:7992
- C:\Windows\System\gtDNPKz.exe
  C:\Windows\System\gtDNPKz.exe
  2⤵
  PID:8044
- C:\Windows\System\PBasupP.exe
  C:\Windows\System\PBasupP.exe
  2⤵
  PID:2472
- C:\Windows\System\orbnxWU.exe
  C:\Windows\System\orbnxWU.exe
  2⤵
  PID:7484
- C:\Windows\System\LpQLxVf.exe
  C:\Windows\System\LpQLxVf.exe
  2⤵
  PID:7356
- C:\Windows\System\GJrWojc.exe
  C:\Windows\System\GJrWojc.exe
  2⤵
  PID:7644
- C:\Windows\System\JfLXlsw.exe
  C:\Windows\System\JfLXlsw.exe
  2⤵
  PID:7896
- C:\Windows\System\kdgtkpQ.exe
  C:\Windows\System\kdgtkpQ.exe
  2⤵
  PID:7800
- C:\Windows\System\fSQyJKS.exe
  C:\Windows\System\fSQyJKS.exe
  2⤵
  PID:7512
- C:\Windows\System\puZHitg.exe
  C:\Windows\System\puZHitg.exe
  2⤵
  PID:8376
- C:\Windows\System\GDMxMJQ.exe
  C:\Windows\System\GDMxMJQ.exe
  2⤵
  PID:8480
- C:\Windows\System\aauofYS.exe
  C:\Windows\System\aauofYS.exe
  2⤵
  PID:8592
- C:\Windows\System\QdnKDKq.exe
  C:\Windows\System\QdnKDKq.exe
  2⤵
  PID:8244
- C:\Windows\System\avRDqNx.exe
  C:\Windows\System\avRDqNx.exe
  2⤵
  PID:8268
- C:\Windows\System\WFWhCKO.exe
  C:\Windows\System\WFWhCKO.exe
  2⤵
  PID:4372
- C:\Windows\System\QHRtYmZ.exe
  C:\Windows\System\QHRtYmZ.exe
  2⤵
  PID:7920
- C:\Windows\System\hjnFrdv.exe
  C:\Windows\System\hjnFrdv.exe
  2⤵
  PID:15268
- C:\Windows\System\jYEaeoq.exe
  C:\Windows\System\jYEaeoq.exe
  2⤵
  PID:3252
- C:\Windows\System\xbeuuVI.exe
  C:\Windows\System\xbeuuVI.exe
  2⤵
  PID:7336
- C:\Windows\System\mgyLyTK.exe
  C:\Windows\System\mgyLyTK.exe
  2⤵
  PID:7872
- C:\Windows\System\nJUttkO.exe
  C:\Windows\System\nJUttkO.exe
  2⤵
  PID:9048
- C:\Windows\System\XwfMkUj.exe
  C:\Windows\System\XwfMkUj.exe
  2⤵
  PID:8272
- C:\Windows\System\CaMUptS.exe
  C:\Windows\System\CaMUptS.exe
  2⤵
  PID:14528
- C:\Windows\System\rrFMtht.exe
  C:\Windows\System\rrFMtht.exe
  2⤵
  PID:8172
- C:\Windows\System\MljMCzS.exe
  C:\Windows\System\MljMCzS.exe
  2⤵
  PID:8316
- C:\Windows\System\zopRLXn.exe
  C:\Windows\System\zopRLXn.exe
  2⤵
  PID:4424
- C:\Windows\System\hQQdHOd.exe
  C:\Windows\System\hQQdHOd.exe
  2⤵
  PID:3592
- C:\Windows\System\VaKqEis.exe
  C:\Windows\System\VaKqEis.exe
  2⤵
  PID:2248
- C:\Windows\System\yfJVoCe.exe
  C:\Windows\System\yfJVoCe.exe
  2⤵
  PID:1996
- C:\Windows\System\VdfjmaX.exe
  C:\Windows\System\VdfjmaX.exe
  2⤵
  PID:4524
- C:\Windows\System\DtvkAdq.exe
  C:\Windows\System\DtvkAdq.exe
  2⤵
  PID:9168
- C:\Windows\System\mbWuHrL.exe
  C:\Windows\System\mbWuHrL.exe
  2⤵
  PID:2640
- C:\Windows\System\sEnYVXo.exe
  C:\Windows\System\sEnYVXo.exe
  2⤵
  PID:8620
- C:\Windows\System\ZvlEsjI.exe
  C:\Windows\System\ZvlEsjI.exe
  2⤵
  PID:3976
- C:\Windows\System\uPdgVTF.exe
  C:\Windows\System\uPdgVTF.exe
  2⤵
  PID:14764
- C:\Windows\System\zeIGDAY.exe
  C:\Windows\System\zeIGDAY.exe
  2⤵
  PID:2236
- C:\Windows\System\nCuzMvG.exe
  C:\Windows\System\nCuzMvG.exe
  2⤵
  PID:60
- C:\Windows\System\WjsZfdM.exe
  C:\Windows\System\WjsZfdM.exe
  2⤵
  PID:2848
- C:\Windows\System\eKcSiUO.exe
  C:\Windows\System\eKcSiUO.exe
  2⤵
  PID:14776
- C:\Windows\System\fKyYQoo.exe
  C:\Windows\System\fKyYQoo.exe
  2⤵
  PID:9236
- C:\Windows\System\URoDmAV.exe
  C:\Windows\System\URoDmAV.exe
  2⤵
  PID:14876
- C:\Windows\System\VuHqHIR.exe
  C:\Windows\System\VuHqHIR.exe
  2⤵
  PID:14740
- C:\Windows\System\svHwLmy.exe
  C:\Windows\System\svHwLmy.exe
  2⤵
  PID:3888
- C:\Windows\System\uegOMUK.exe
  C:\Windows\System\uegOMUK.exe
  2⤵
  PID:4340
- C:\Windows\System\UAWtjCI.exe
  C:\Windows\System\UAWtjCI.exe
  2⤵
  PID:1324
- C:\Windows\System\JmeTvlQ.exe
  C:\Windows\System\JmeTvlQ.exe
  2⤵
  PID:8636
- C:\Windows\System\tiWjdnM.exe
  C:\Windows\System\tiWjdnM.exe
  2⤵
  PID:14928
- C:\Windows\System\zvCWQkZ.exe
  C:\Windows\System\zvCWQkZ.exe
  2⤵
  PID:1056
- C:\Windows\System\bPbmgWK.exe
  C:\Windows\System\bPbmgWK.exe
  2⤵
  PID:3596
- C:\Windows\System\gpJxgmR.exe
  C:\Windows\System\gpJxgmR.exe
  2⤵
  PID:14972
- C:\Windows\System\vpRozRl.exe
  C:\Windows\System\vpRozRl.exe
  2⤵
  PID:15072
- C:\Windows\System\lVoHwTx.exe
  C:\Windows\System\lVoHwTx.exe
  2⤵
  PID:8796
- C:\Windows\System\nDqDOaI.exe
  C:\Windows\System\nDqDOaI.exe
  2⤵
  PID:4000
- C:\Windows\System\CkNUvMy.exe
  C:\Windows\System\CkNUvMy.exe
  2⤵
  PID:14360
- C:\Windows\System\PTBJOKi.exe
  C:\Windows\System\PTBJOKi.exe
  2⤵
  PID:15188
- C:\Windows\System\AYwEiAn.exe
  C:\Windows\System\AYwEiAn.exe
  2⤵
  PID:4708
- C:\Windows\System\BMCdMky.exe
  C:\Windows\System\BMCdMky.exe
  2⤵
  PID:8000
- C:\Windows\System\VwwFmNO.exe
  C:\Windows\System\VwwFmNO.exe
  2⤵
  PID:4428
- C:\Windows\System\sgOosqX.exe
  C:\Windows\System\sgOosqX.exe
  2⤵
  PID:7396
- C:\Windows\System\RkGlScd.exe
  C:\Windows\System\RkGlScd.exe
  2⤵
  PID:3484
- C:\Windows\System\NPSuvyR.exe
  C:\Windows\System\NPSuvyR.exe
  2⤵
  PID:396
- C:\Windows\System\sQFLzOK.exe
  C:\Windows\System\sQFLzOK.exe
  2⤵
  PID:8048
- C:\Windows\System\SJfLrxn.exe
  C:\Windows\System\SJfLrxn.exe
  2⤵
  PID:4288
- C:\Windows\System\ekEpASF.exe
  C:\Windows\System\ekEpASF.exe
  2⤵
  PID:8368
- C:\Windows\System\EyuebpK.exe
  C:\Windows\System\EyuebpK.exe
  2⤵
  PID:4412
- C:\Windows\System\YfTTfNC.exe
  C:\Windows\System\YfTTfNC.exe
  2⤵
  PID:15264
- C:\Windows\System\BjtqyDm.exe
  C:\Windows\System\BjtqyDm.exe
  2⤵
  PID:8260
- C:\Windows\System\VsxLkgF.exe
  C:\Windows\System\VsxLkgF.exe
  2⤵
  PID:15276
- C:\Windows\System\opkqdES.exe
  C:\Windows\System\opkqdES.exe
  2⤵
  PID:8120
- C:\Windows\System\tHUBvwY.exe
  C:\Windows\System\tHUBvwY.exe
  2⤵
  PID:3148
- C:\Windows\System\zltTzTU.exe
  C:\Windows\System\zltTzTU.exe
  2⤵
  PID:1756
- C:\Windows\System\ohRTWAB.exe
  C:\Windows\System\ohRTWAB.exe
  2⤵
  PID:10032
- C:\Windows\System\BPVlEQp.exe
  C:\Windows\System\BPVlEQp.exe
  2⤵
  PID:2832
- C:\Windows\System\ACmfWdy.exe
  C:\Windows\System\ACmfWdy.exe
  2⤵
  PID:15300
- C:\Windows\System\RVlLSSS.exe
  C:\Windows\System\RVlLSSS.exe
  2⤵
  PID:4904
- C:\Windows\System\iBydtav.exe
  C:\Windows\System\iBydtav.exe
  2⤵
  PID:8828
- C:\Windows\System\cflIDIK.exe
  C:\Windows\System\cflIDIK.exe
  2⤵
  PID:5216
- C:\Windows\System\hmagVuc.exe
  C:\Windows\System\hmagVuc.exe
  2⤵
  PID:9176
- C:\Windows\System\dgzRNMD.exe
  C:\Windows\System\dgzRNMD.exe
  2⤵
  PID:8484
- C:\Windows\System\vYvbFBF.exe
  C:\Windows\System\vYvbFBF.exe
  2⤵
  PID:2616
- C:\Windows\System\uqfPOMo.exe
  C:\Windows\System\uqfPOMo.exe
  2⤵
  PID:1028
- C:\Windows\System\lWaCeEM.exe
  C:\Windows\System\lWaCeEM.exe
  2⤵
  PID:4324
- C:\Windows\System\iiMUGbW.exe
  C:\Windows\System\iiMUGbW.exe
  2⤵
  PID:15204
- C:\Windows\System\vEAbaav.exe
  C:\Windows\System\vEAbaav.exe
  2⤵
  PID:14444
- C:\Windows\System\vcfbamJ.exe
  C:\Windows\System\vcfbamJ.exe
  2⤵
  PID:14608
- C:\Windows\System\mwcrcyj.exe
  C:\Windows\System\mwcrcyj.exe
  2⤵
  PID:3004
- C:\Windows\System\FWfbQwH.exe
  C:\Windows\System\FWfbQwH.exe
  2⤵
  PID:1696
- C:\Windows\System\ApuVQJm.exe
  C:\Windows\System\ApuVQJm.exe
  2⤵
  PID:14556
- C:\Windows\System\GNElKKB.exe
  C:\Windows\System\GNElKKB.exe
  2⤵
  PID:1044
- C:\Windows\System\BJInfep.exe
  C:\Windows\System\BJInfep.exe
  2⤵
  PID:2088
- C:\Windows\System\gQkYekv.exe
  C:\Windows\System\gQkYekv.exe
  2⤵
  PID:4404
- C:\Windows\System\oyokSoQ.exe
  C:\Windows\System\oyokSoQ.exe
  2⤵
  PID:5300
- C:\Windows\System\RlJIwiR.exe
  C:\Windows\System\RlJIwiR.exe
  2⤵
  PID:8692
- C:\Windows\System\CkNGIhz.exe
  C:\Windows\System\CkNGIhz.exe
  2⤵
  PID:5344
- C:\Windows\System\UKNYGop.exe
  C:\Windows\System\UKNYGop.exe
  2⤵
  PID:5424
- C:\Windows\System\ZcQytCj.exe
  C:\Windows\System\ZcQytCj.exe
  2⤵
  PID:5456
- C:\Windows\System\hluqMrH.exe
  C:\Windows\System\hluqMrH.exe
  2⤵
  PID:9944
- C:\Windows\System\MyWPpXK.exe
  C:\Windows\System\MyWPpXK.exe
  2⤵
  PID:5484
- C:\Windows\System\tbovbPZ.exe
  C:\Windows\System\tbovbPZ.exe
  2⤵
  PID:10120
- C:\Windows\System\nfHePrf.exe
  C:\Windows\System\nfHePrf.exe
  2⤵
  PID:15052
- C:\Windows\System\pUWZLhP.exe
  C:\Windows\System\pUWZLhP.exe
  2⤵
  PID:10236
- C:\Windows\System\bVGUGPf.exe
  C:\Windows\System\bVGUGPf.exe
  2⤵
  PID:5556
- C:\Windows\System\rZlzEJu.exe
  C:\Windows\System\rZlzEJu.exe
  2⤵
  PID:4448
- C:\Windows\System\rzNnbVI.exe
  C:\Windows\System\rzNnbVI.exe
  2⤵
  PID:5512
- C:\Windows\System\BuXyxiS.exe
  C:\Windows\System\BuXyxiS.exe
  2⤵
  PID:1660
- C:\Windows\System\GePlxEV.exe
  C:\Windows\System\GePlxEV.exe
  2⤵
  PID:5596
- C:\Windows\System\CwJChjm.exe
  C:\Windows\System\CwJChjm.exe
  2⤵
  PID:8304
- C:\Windows\System\GWXyAJY.exe
  C:\Windows\System\GWXyAJY.exe
  2⤵
  PID:7216
- C:\Windows\System\kTKwcJM.exe
  C:\Windows\System\kTKwcJM.exe
  2⤵
  PID:1636
- C:\Windows\System\NSOCZAc.exe
  C:\Windows\System\NSOCZAc.exe
  2⤵
  PID:14540
- C:\Windows\System\tncSrBT.exe
  C:\Windows\System\tncSrBT.exe
  2⤵
  PID:5700
- C:\Windows\System\djgLEfm.exe
  C:\Windows\System\djgLEfm.exe
  2⤵
  PID:10148
- C:\Windows\System\ynDGAsi.exe
  C:\Windows\System\ynDGAsi.exe
  2⤵
  PID:8228
- C:\Windows\System\yjVlNka.exe
  C:\Windows\System\yjVlNka.exe
  2⤵
  PID:5756
- C:\Windows\System\OPSwuKP.exe
  C:\Windows\System\OPSwuKP.exe
  2⤵
  PID:14532
- C:\Windows\System\dRCYVyM.exe
  C:\Windows\System\dRCYVyM.exe
  2⤵
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vyebmapm.mjh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AOFqSoF.exe

Filesize
1.4MB

MD5
38d5f98c2183a588cf5ec27f3ef37903

SHA1
b145dd3ef5f73a7c25e21706172da13a03ee6268

SHA256
82c4c0ba12bf5ce124f5862a4758a43f220fdcc52c3f5dac5210fe35fe93bf77

SHA512
fc042b21223c3be0c6f26eff21c663cbcac7af2e8af26ebc06f007872d3d38a4628c2658ea59f172e6b676bf8bad55f5a7b448391e618f0db713c66f6db4c35a

Download Submit
C:\Windows\System\DSnupqp.exe

Filesize
1.4MB

MD5
d6f40695793801cb8228f9beb04969d1

SHA1
faca76e965bb49a6adb0662e67a26e50dd640863

SHA256
1b5e9eebfa5d689aef4e2939e13978ceff4a56ce465dd3445e0277d8e15982c6

SHA512
e3616ad5648eedfe2788d5d56e54185f1d8bfef6d812c46df3d6c8bf688646002169af1476bc0a142faa12aa73989fadb6d9c10f36a281593c54418e54365b51

Download Submit
C:\Windows\System\DtAUjVD.exe

Filesize
1.4MB

MD5
f4719411ab944b2b5a8caa0e96a51728

SHA1
c83d01f9d2a360c33a956581213ef09d309900c9

SHA256
4fcf84f69a807959dc0856afb34e4a920125a9cb4c2c5729fb1f1a3582ebb11d

SHA512
22ff8e2ea44f0ca10368971fea2701281672b7e981e67b062441a0428aaba1760f348ae286c08e16fd09b77f86bf3b19eeaca7eabe751eca89e28e99075c8cbf

Download Submit
C:\Windows\System\EEHtYXf.exe

Filesize
1.4MB

MD5
a624acdd7c2cd7f2c354e3f7cbcf2fdc

SHA1
4c935fecfdc4ed46ab3e841a6797c0d5bc7a42c8

SHA256
a6c5e604fbeab796dc97537dcfe4682c996735dfda8102f01f9313352d0fd454

SHA512
9e880ea9955e5f39a4b7a2e6fb85a3f45765ceaac9d79cb9878cac7e222cd73107199ac71003366ac85014841b403dadd95bcc3063b97f2dc06ac86ba97dbad2

Download Submit
C:\Windows\System\EOAjxbu.exe

Filesize
1.4MB

MD5
1f7544c06cc50c6d038e0d96a410693c

SHA1
27c6810eca7f368dd9d21d36d09bc6f0711c09c2

SHA256
184a4ae71c65256de19485efbcba61b3101f2622144612f1031ecc3bbbc1cd97

SHA512
135aad5a771331afeedbaa5d95a29e2cb74433da809b392d554f7cd31eb0760a8093ffb9923ad6c940ab2b305314898b56a344dfabebcdbee0ae9cb49cdd2d8c

Download Submit
C:\Windows\System\FKiwBST.exe

Filesize
1.5MB

MD5
18a5873c218e4df29e0f44797f9fa4f2

SHA1
18c07832c24dbab532c99de500efa07d58da7caf

SHA256
a020e49740740715d265d1518bdab5e33c03c497614244f387c56ddaac77d91d

SHA512
30c96d002fa60f8a35465edc65412c1d3136d3f1cde6db4d63cc12441ab55fc3dbc5ba676626b7067904e543b04a47b37f925271c5928b21159230f65d64905d

Download Submit
C:\Windows\System\HRHvTDI.exe

Filesize
1.5MB

MD5
ef48e05d6f4c38fcee4c5ff961530f0d

SHA1
5494cb5f598db83f2f16cbde31049886ec75e579

SHA256
c69edc63443327f6b3b832cc14e89977673ce1a3607affce4e1348558e36dbec

SHA512
01e981bba4e79cc00cd36960a80eb406766fb0628b177bafb9bc1251858792873445b155ea27b288ba38fee342f08f108ef78abe4e251022b69c4a02d03163d2

Download Submit
C:\Windows\System\JIovcuR.exe

Filesize
1.4MB

MD5
eea1df711f03cce8bf30fc4536774385

SHA1
b5ccd0110c14b6e15b52a4f9831c36483a5314f1

SHA256
8e3354523cca33be70d0b40617438ecd86da97251a3d78a4565180ae15c4de02

SHA512
edc23536154a7ca36aecdd4630773df7e150484a2e30dff5f09457e70a557e8c14336ca21483d0574ae4203001da30fc14f1695ff6e5204becf3ec63f2f76d89

Download Submit
C:\Windows\System\NpxRKxJ.exe

Filesize
8B

MD5
70d32c5686563edbb854aed29ea9d85c

SHA1
bd541445a50c65f1a6670fe5c95bea5d00e91b07

SHA256
7838364f90f7a979e688eff5ec314b7556d64c92bdfbd76fb1ec9602cec23e30

SHA512
23991ce500626bded4e2dc15b31393a89cfbbdda0d797292f12ec97001984de33a442b02e485bb8bd2704c63b7c242ef2cf2fc4fd62f7f428d253fd4da79e7f5

Download Submit
C:\Windows\System\OTRTIHq.exe

Filesize
1.5MB

MD5
be2e96d00c39ec9854dc276697e27207

SHA1
d62bef9cc046cb2f3089e25f753e6c0618879ca7

SHA256
398c8b2a37b595411f9ea92cf3a917b6a68e79442dd0233a590be2e1767b0436

SHA512
79fa09b40762c0448047dc7468acc145255b39c6ef7fc33ad35a0a4ce1395cafe96470b21e40b40541781f996276fb6fe73861c541c6741e5248586bad16f0ef

Download Submit
C:\Windows\System\OVlyhoh.exe

Filesize
1.4MB

MD5
a1b78e0f55218409548e2a839a2fc2a7

SHA1
ba741b4f8f9695a3beaee274496f7279a72081e4

SHA256
4332ebabc9ab537c659950e9136d6f77c07fee9c1599419ebeac9017ac43bc85

SHA512
a77edcaa516c1d1e7de49a40994cdab4419eb3ed9f0b90ca884b1e9c92ae72ac8508b17101cea5b9f31caebadee27416e9eb6c7276de4d7afce4af46ea3d0e1a

Download Submit
C:\Windows\System\RRzFkhv.exe

Filesize
1.5MB

MD5
cbf49fdef07bc2f379ba75c9414768d5

SHA1
5b2102da7626ffeacaf48bbaf90b5e55e2382a1b

SHA256
2fc6f43f9fdb68c1d41e56cad05259d18b967c72212a99696cff3784ee687ed7

SHA512
91233e8ea63474bc6d499b9199e85f8c0cf06d1afcb0450082faf1ea9d3b322d45f94c050ba61a13f3512e9e0bc697cbb94fb184aa90c3ad2a3a2dd14cc5dd9c

Download Submit
C:\Windows\System\RmhGLQZ.exe

Filesize
1.4MB

MD5
13a58a436848b1c6ab8c731ac14b69b2

SHA1
1c90d5a49c8115ddb8177797a4a48edfba686eec

SHA256
ff91d50f150949b50cdc6e6f95058766f687872d201220f6ab663e7e70aa941f

SHA512
b125baab23da224c94743033fdfc06a00431fc071c26b10f198139b7068b67f9ff80bd5d3621f1b156b7478ed3deac00b546ceaf29bf27365f10136fbd0cd84c

Download Submit
C:\Windows\System\YOlUXgx.exe

Filesize
1.5MB

MD5
78d3ba5f1de2c9c1bfe7c9babccae554

SHA1
6724458834adf84e5a98dc8beed744eb26a53602

SHA256
63546fbeb34dd6f676a7cda79b91087b9980b6b0fe1ad46eb02731bccfdd2718

SHA512
b4f339fd6ba48ae8aae740b7573eae8c9513020497d455e1f0e2e052d4a6d326321530ae2d5576538fb7591b1edf45b0bc5b7d007ba538f2eb27ec7a75a74cb8

Download Submit
C:\Windows\System\YujrDZq.exe

Filesize
1.4MB

MD5
d6f2c9283b5a2a71b6d20c0b853d5e80

SHA1
f77d893d27e63e37ef3dfa7f7cc781e2e9ec6b68

SHA256
08038434f1a04a73e1c50139e13e308ad4c4f2bc116d84a212544432fc1e5cd7

SHA512
d8f97815f88682446081610c3738ed95ce9e759f407c8e94549e3733caf4f9f85ebd9580b06f7bedc326f648e0c2307476e1d858f1cbfeb3860a7e08386811bd

Download Submit
C:\Windows\System\ZbRyGgb.exe

Filesize
1.4MB

MD5
3f17e2b2ec311020740d278a594c4ee9

SHA1
aa3961105019813a4b8c565f9d26118f9e104ba4

SHA256
0d332971aeb5b7ac326b22409d3b39548930c31102dfc33dbfe2a1b56075414a

SHA512
495b6d400ca2a2c3e405177085db9f4de39ae20ee1a5dfd1a5ec8cca75617b8268c65c1bde33dde9976dc6672a2513643b23ff40b025ab82f43441348c8c6be7

Download Submit
C:\Windows\System\ZdzVSBN.exe

Filesize
1.5MB

MD5
c1fc3443ece184faaf05a637f981e413

SHA1
027b4487a540fac96f042846da087ea1e88fff24

SHA256
b0b291b7614c056db00988289399d482ed52392e0ad2d6ba7646de4eb0d2b3d1

SHA512
ca5f6da57aea7c5571ed51f0bce4e64588b620df6e5bb4dce0ee565cde22359aa83ef25b5459dd76cd734377d14f556619a65d1c67217fb8a85aed3f446981f9

Download Submit
C:\Windows\System\ZiPVtNl.exe

Filesize
1.4MB

MD5
bb6e62b3d00f15d8b16f23136854f7ca

SHA1
61c5ab37b0c443e18511a1f93a12e5c518b12aef

SHA256
4a16f86828af77424bed5fed9d783dbdd70f5d682c7bc771a83af4e6a5c0b113

SHA512
6654cd6cff0e0b820a84f42d4d45640b8df9c66ba93329cbd44fc3b9589e2a2e9ec8e2cde6e53cb3eb2016eee3917286874d77a1b9b1cca6352d200ec7242661

Download Submit
C:\Windows\System\cwbjYVq.exe

Filesize
1.5MB

MD5
a50f3d7dbc9402d7991197137c90992d

SHA1
0a44698778532ed62f63d9f5162855299ca62502

SHA256
9b05c6bf31ae15bb98f4dc8e429b12f45dbbb0cc3fd6589885f7fb7ff81d781e

SHA512
b6a9e8d53e6febde24911754186e4f15d2e9acb728ddf2728c4591998dd8c837f250a5c413bef93ba5111b308baa684f84522c34a8ced379218a6dd44a74c501

Download Submit
C:\Windows\System\eEhaTKq.exe

Filesize
1.4MB

MD5
4a200a4ad7102230b66d9cdb34644f54

SHA1
68a91506c3127e2b6065ad2ed8c076d0c0c0a99a

SHA256
10ff7350465af54eb83020d1978b981761c5d4ab6cf2cb09087105ad4e7cdc9d

SHA512
0782a05d1e2e6078ce252aac3e1ae8fbd2f64e756e486bcc1029ec0e9cba286cc9e6d42687937112729e82252c28098cd99d816567e9aa12d2b76b0bb426b612

Download Submit
C:\Windows\System\gvEjkjP.exe

Filesize
1.5MB

MD5
b70e75c5a1c9a2f811e5bdf0c4f2a5d4

SHA1
9c80a191ae7bc35a98dd3cd46b927de1ea54ff21

SHA256
9eaae9ae58cb6f5532690c34167072342a53b21aefe3850c2f15db59678beef6

SHA512
b77adb438334c02506206e8497d92938e81f07d34359d5fcb81d09c5340071ca973561f291452fbfce8f23eb7592c52209262c2f235131dc95203299c97d8f8c

Download Submit
C:\Windows\System\jlsYuSx.exe

Filesize
1.5MB

MD5
102af8668d9c048da8bb4dff98c4a397

SHA1
37d860868ec8c27f7c4bb167072fbfb9305ec849

SHA256
7706a698353dfc481127517f41c693579af223c1f46976eea8d81566e65c447b

SHA512
ee88ba393b28e269868153bbc76c39e09787dc3bdeb46b24759e5d95f93e99ecbd515483f00f3a920e45975b64477ede9932b5c2e969a6e92d352b3928a1eeb9

Download Submit
C:\Windows\System\jqWUQvK.exe

Filesize
1.4MB

MD5
b527b2681229ff09df67f41436d966a0

SHA1
385f45b7bc340149dfb0ee25b20c79e6cd91317c

SHA256
12294a224f9e7e7cfa7d9eae9b370becd4dea22f9dc951dceb8e8847fd427f1e

SHA512
1bdab031b6c5b972ad0983f47e5fe52dbc86ef6c1b434fde83cd013e78ef90b72adb5c6bd5ff7c8abd0ec98719ad39de4e53e3afa9f9afbf8680ed8eccfa74c6

Download Submit
C:\Windows\System\lUsXXeT.exe

Filesize
1.5MB

MD5
ce424be26305d97fad3c9d5f1a82ee55

SHA1
195cb31245c873b09ae21f37333b889c2dc2bf7a

SHA256
165e9b833f93043f262120e0b32ceee71988b02a7cf7e2c2df8e6fcfdc659a3a

SHA512
6c86e0ae2b24751c5a48c13c59618cf53a91cc0a6ed6edc8061e53b7a5332cfcb900407920447c3dc56e5a6efb37902273d6a16a53238bcbcebb88e689cb8fab

Download Submit
C:\Windows\System\mIYVnce.exe

Filesize
1.4MB

MD5
8953bd74a71a91ea31e675ceffee04ff

SHA1
d481b3f26841678cd82e646da64b6d1d1a4f12ef

SHA256
949748ceb39d0bbc7fd0040ea2144600338fa5c50052800510605a06928fc0d8

SHA512
6cc7363ba2398fd36da1e005a3c62dab151f3de8a088c998a9470a9b0e181e292009cc7ec41ca721770b8aa59d9bb9cafb92047947813c114d4ffc051252ee59

Download Submit
C:\Windows\System\mLlfSTE.exe

Filesize
1.4MB

MD5
79af1725a39c78cace56fb05b1ea0fda

SHA1
5d9fa48fd9480f48b9ded151d55b4a0a03aba3d1

SHA256
7fe968a79b1c93bc5c2c938f8b8278d8486de3477b4fe6ae74d584199718c358

SHA512
690805eafb329054fe239fb78a89fc2a0038cdf1bd3e48185e6a38a65c8fd20226663be113aaf81c7845092d9e0d3627e6d19e599f886dbbc96788aae6033f65

Download Submit
C:\Windows\System\pnXmZgv.exe

Filesize
1.5MB

MD5
860ec83a6bae91ff639945409ff95505

SHA1
31b964ba1cf75503edf2935504f97f6f428d9840

SHA256
009748ff7b746d4a094a53e5ea5741e9b5cee9ec94be5a38b5056d896444a314

SHA512
3032d56f63608450192d692d3f1ea560c01915007d5ca8459777c2c7a3e23da5d2e3e0838efcfe6a9c762e05f5fbefbb297f52d4ac004851a582e3eb63fd59d6

Download Submit
C:\Windows\System\tfjWCbS.exe

Filesize
1.5MB

MD5
660e36386f3d165273d5372eb0ae3429

SHA1
b4fee9b0c20e4565bcd0d0208f8365744f89a699

SHA256
aa70d253eb9683d9b7bee73c08dab3a783756d44f941988cfda138fcd02be8ce

SHA512
8941df6987f6abbca4db8a75e6a5bde7abe8e5499a54c2aefb8f90d98e0c589cfa2ce93f2eb16d1ac95a0da59aabe6871ce5e6ed53fc55524db7d1dccbb36efd

Download Submit
C:\Windows\System\tpzlpHW.exe

Filesize
1.5MB

MD5
47a84baf5e69fe77f03ce3f9d50c5c90

SHA1
be565e120576ce4d2e9c0eb1f5d1c8974fb147f7

SHA256
da7f9cb7b6013733ecd8634085f351954f8e8911475fcb4fc24a19daadce58ec

SHA512
5e1442ebe26fa0e7be67d2be7a201821e0f56c0c03dd5c03126de22dfc6de0319b66bf1e362305d34de30ec255415b7e6f3b0db49f7386b6fb5966026834c739

Download Submit
C:\Windows\System\voCJxcR.exe

Filesize
1.5MB

MD5
c1a37747b53a6b63eb3cdc7fcffde543

SHA1
afe5d5e14b06b5ec7861e83112a8829da808883d

SHA256
23e1d58e310e36771bc5e3bc25b962b2ba6bad217187e98bf772140ce37a158d

SHA512
bc9be3caa7f4f31b3c68b67b4138a06609ff1b2d0a06c1f5d4b834dcad939c0c94cbc6fa8ee9d9d9f3289b422d37f3e1db92063bb6d4536aa690ef5da76da64b

Download Submit
C:\Windows\System\wiURsiB.exe

Filesize
1.5MB

MD5
622e98a76ebdc2623e09332802f746e2

SHA1
3c2d8ecf1d7b775db9fef5b5e04f7c478abdee21

SHA256
cfe7dab4c38f31f950a281abbf8f639b2244dc77740a861cb0e0972bb7e523a9

SHA512
06207a0d6e581b15405843d12369de8cc35ad5093ba78982d41f30e6d20b1c428be15eb5ccdf3551ffa94e3b7644783efb317f35d0fd15f3e1895e0a312eb8aa

Download Submit
C:\Windows\System\wisbJSp.exe

Filesize
1.5MB

MD5
2fb25fb7d91e9ad48d44d4e02857980d

SHA1
2e5ee832670546901f53823c184d79b6910fe8c8

SHA256
6dfe46a6c6a5c8b72cac6a7fd6a065ecc2c0afbf3c24f528658cdb8155723ead

SHA512
ba75637ef3cbb715ece5724a9af7d8f8fb66f2a7e643a0da4ce4071a5adce1dffda8fdd0926a926d5095d0e9e39f76a0c2c03fa93763beccfc9640e8f881893e

Download Submit
C:\Windows\System\xRRCgmT.exe

Filesize
1.5MB

MD5
ebba9cacfdaa8f55d0c481e6c8a564b5

SHA1
276de173f0769a0ae9146a0a0e7c600002528ee2

SHA256
515be3c899b9ebbc044760e6d7d9ede98b1e698c0d1bdd93efab7967ab8ec6b5

SHA512
84d72969cb1d868e8020a4e654f26bb6633c2817ded92d71028ba94ec40b9dc86181ec69e4ae7e9946a04212d1e7a1b479aca789e942af70964b13c12129ab15

Download Submit
C:\Windows\System\zjkAKTj.exe

Filesize
1.5MB

MD5
1a8d470247bcd0d270a3b350e300ae8f

SHA1
087a48c7c17961ae489363df847caf88f9e76804

SHA256
8200b5bdbbab06c37e6205049a8f30bb1061f9df0d509e691e400e6f4f917d93

SHA512
b407c7fafeae9a117fc1d9ad2e6f20f9c953e85c18c4f37710196ad4dc879d08dd4798780059dd914512a282726655066ca658810f2d51d5919b20bb03ed2d2f

Download Submit
memory/208-83-0x00007FF630FF0000-0x00007FF6313E2000-memory.dmp

Filesize
3.9MB

Download
memory/436-151-0x00007FF745DF0000-0x00007FF7461E2000-memory.dmp

Filesize
3.9MB

Download
memory/972-120-0x00007FF71FE20000-0x00007FF720212000-memory.dmp

Filesize
3.9MB

Download
memory/972-1370-0x00007FF71FE20000-0x00007FF720212000-memory.dmp

Filesize
3.9MB

Download
memory/1000-60-0x00007FF6C6B80000-0x00007FF6C6F72000-memory.dmp

Filesize
3.9MB

Download
memory/1336-43-0x00007FF762680000-0x00007FF762A72000-memory.dmp

Filesize
3.9MB

Download
memory/1512-169-0x00007FF758A10000-0x00007FF758E02000-memory.dmp

Filesize
3.9MB

Download
memory/1512-68-0x00007FF758A10000-0x00007FF758E02000-memory.dmp

Filesize
3.9MB

Download
memory/1512-4126-0x00007FF758A10000-0x00007FF758E02000-memory.dmp

Filesize
3.9MB

Download
memory/1532-877-0x00007FF746C70000-0x00007FF747062000-memory.dmp

Filesize
3.9MB

Download
memory/1532-2803-0x00007FF746C70000-0x00007FF747062000-memory.dmp

Filesize
3.9MB

Download
memory/1532-90-0x00007FF746C70000-0x00007FF747062000-memory.dmp

Filesize
3.9MB

Download
memory/1680-69-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp

Filesize
3.9MB

Download
memory/1680-149-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp

Filesize
3.9MB

Download
memory/1680-2804-0x00007FF7EAC80000-0x00007FF7EB072000-memory.dmp

Filesize
3.9MB

Download
memory/1964-126-0x00007FF641590000-0x00007FF641982000-memory.dmp

Filesize
3.9MB

Download
memory/1964-1508-0x00007FF641590000-0x00007FF641982000-memory.dmp

Filesize
3.9MB

Download
memory/2136-176-0x00007FF6436D0000-0x00007FF643AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2280-2799-0x00007FF712C00000-0x00007FF712FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2280-997-0x00007FF712C00000-0x00007FF712FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2280-96-0x00007FF712C00000-0x00007FF712FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-143-0x00007FF637540000-0x00007FF637932000-memory.dmp

Filesize
3.9MB

Download
memory/2652-77-0x00007FF617630000-0x00007FF617A22000-memory.dmp

Filesize
3.9MB

Download
memory/2660-2870-0x00007FF60BCD0000-0x00007FF60C0C2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-150-0x00007FF60BCD0000-0x00007FF60C0C2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-170-0x00007FF75D4B0000-0x00007FF75D8A2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-2890-0x00007FF75D4B0000-0x00007FF75D8A2000-memory.dmp

Filesize
3.9MB

Download
memory/3620-107-0x00007FF685940000-0x00007FF685D32000-memory.dmp

Filesize
3.9MB

Download
memory/3620-999-0x00007FF685940000-0x00007FF685D32000-memory.dmp

Filesize
3.9MB

Download
memory/3620-2829-0x00007FF685940000-0x00007FF685D32000-memory.dmp

Filesize
3.9MB

Download
memory/3784-2762-0x00007FF700480000-0x00007FF700872000-memory.dmp

Filesize
3.9MB

Download
memory/3784-80-0x00007FF700480000-0x00007FF700872000-memory.dmp

Filesize
3.9MB

Download
memory/3980-2743-0x00007FF7E29C0000-0x00007FF7E2DB2000-memory.dmp

Filesize
3.9MB

Download
memory/3980-54-0x00007FF7E29C0000-0x00007FF7E2DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4224-163-0x00007FF72AF10000-0x00007FF72B302000-memory.dmp

Filesize
3.9MB

Download
memory/4348-78-0x00007FF75C140000-0x00007FF75C532000-memory.dmp

Filesize
3.9MB

Download
memory/4348-2770-0x00007FF75C140000-0x00007FF75C532000-memory.dmp

Filesize
3.9MB

Download
memory/4680-114-0x00007FF635690000-0x00007FF635A82000-memory.dmp

Filesize
3.9MB

Download
memory/4680-1250-0x00007FF635690000-0x00007FF635A82000-memory.dmp

Filesize
3.9MB

Download
memory/4680-2836-0x00007FF635690000-0x00007FF635A82000-memory.dmp

Filesize
3.9MB

Download
memory/4780-74-0x00007FF620120000-0x00007FF620512000-memory.dmp

Filesize
3.9MB

Download
memory/4832-36-0x0000028D38E00000-0x0000028D38E22000-memory.dmp

Filesize
136KB

Download
memory/4832-5-0x00007FF9E6273000-0x00007FF9E6275000-memory.dmp

Filesize
8KB

Download
memory/4832-23-0x00007FF9E6270000-0x00007FF9E6D31000-memory.dmp

Filesize
10.8MB

Download
memory/4832-41-0x00007FF9E6270000-0x00007FF9E6D31000-memory.dmp

Filesize
10.8MB

Download
memory/4832-424-0x0000028D520C0000-0x0000028D52866000-memory.dmp

Filesize
7.6MB

Download
memory/4832-137-0x00007FF9E6270000-0x00007FF9E6D31000-memory.dmp

Filesize
10.8MB

Download
memory/4832-162-0x00007FF9E6270000-0x00007FF9E6D31000-memory.dmp

Filesize
10.8MB

Download
memory/4916-67-0x00007FF776360000-0x00007FF776752000-memory.dmp

Filesize
3.9MB

Download
memory/4916-2774-0x00007FF776360000-0x00007FF776752000-memory.dmp

Filesize
3.9MB

Download
memory/4976-1-0x000001E5BA820000-0x000001E5BA830000-memory.dmp

Filesize
64KB

Download
memory/4976-0-0x00007FF6F0410000-0x00007FF6F0802000-memory.dmp

Filesize
3.9MB

Download
memory/4976-108-0x00007FF6F0410000-0x00007FF6F0802000-memory.dmp

Filesize
3.9MB

Download
memory/5020-86-0x00007FF62E060000-0x00007FF62E452000-memory.dmp

Filesize
3.9MB

Download
memory/5020-182-0x00007FF62E060000-0x00007FF62E452000-memory.dmp

Filesize
3.9MB

Download