xmrig | 347003bfd95d2c78d619a8552effe5126bd956d8bf3d88e9b41899c5ee3f4c63

Analysis

max time kernel
120s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a846dcbbcf3eb2a7d5885884ef79a60N.exe
Size

1.9MB
MD5

1a846dcbbcf3eb2a7d5885884ef79a60
SHA1

7fef8bd8b44aa153f758432a48464f0ebbf9414f
SHA256

347003bfd95d2c78d619a8552effe5126bd956d8bf3d88e9b41899c5ee3f4c63
SHA512

ce96b43d880f8bffe350d6d16e03721b2cafe9b2c00772a2fe4c6fcbf97e79ec7101ae5a3647a5d3548a226b8c5309411edb6c1229077ff940bd98fb7cd4fda4
SSDEEP

49152:Lz071uv4BPMkyW10/w16BvZX71Fq8+iar:NABt

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/memory/2252-374-0x00007FF6C4130000-0x00007FF6C4522000-memory.dmp	xmrig
behavioral2/memory/1904-379-0x00007FF7DEE90000-0x00007FF7DF282000-memory.dmp	xmrig
behavioral2/memory/764-458-0x00007FF626BC0000-0x00007FF626FB2000-memory.dmp	xmrig
behavioral2/memory/5068-527-0x00007FF6B0A50000-0x00007FF6B0E42000-memory.dmp	xmrig
behavioral2/memory/2380-553-0x00007FF75CD10000-0x00007FF75D102000-memory.dmp	xmrig
behavioral2/memory/4640-2149-0x00007FF792C00000-0x00007FF792FF2000-memory.dmp	xmrig
behavioral2/memory/4868-2177-0x00007FF6BEC40000-0x00007FF6BF032000-memory.dmp	xmrig
behavioral2/memory/3636-2176-0x00007FF67B5B0000-0x00007FF67B9A2000-memory.dmp	xmrig
behavioral2/memory/1948-2151-0x00007FF6BFDD0000-0x00007FF6C01C2000-memory.dmp	xmrig
behavioral2/memory/688-561-0x00007FF6F3E30000-0x00007FF6F4222000-memory.dmp	xmrig
behavioral2/memory/2384-560-0x00007FF630EC0000-0x00007FF6312B2000-memory.dmp	xmrig
behavioral2/memory/5044-559-0x00007FF6D23D0000-0x00007FF6D27C2000-memory.dmp	xmrig
behavioral2/memory/1188-558-0x00007FF751C20000-0x00007FF752012000-memory.dmp	xmrig
behavioral2/memory/4484-557-0x00007FF6B0C80000-0x00007FF6B1072000-memory.dmp	xmrig
behavioral2/memory/3288-556-0x00007FF6B3B60000-0x00007FF6B3F52000-memory.dmp	xmrig
behavioral2/memory/3904-555-0x00007FF6E4120000-0x00007FF6E4512000-memory.dmp	xmrig
behavioral2/memory/4940-554-0x00007FF7446C0000-0x00007FF744AB2000-memory.dmp	xmrig
behavioral2/memory/1528-552-0x00007FF6422D0000-0x00007FF6426C2000-memory.dmp	xmrig
behavioral2/memory/4160-551-0x00007FF7FE890000-0x00007FF7FEC82000-memory.dmp	xmrig
behavioral2/memory/3832-550-0x00007FF6D7F10000-0x00007FF6D8302000-memory.dmp	xmrig
behavioral2/memory/2196-549-0x00007FF795B20000-0x00007FF795F12000-memory.dmp	xmrig
behavioral2/memory/1792-457-0x00007FF719BD0000-0x00007FF719FC2000-memory.dmp	xmrig
behavioral2/memory/1328-399-0x00007FF6152B0000-0x00007FF6156A2000-memory.dmp	xmrig
behavioral2/memory/4104-96-0x00007FF60D280000-0x00007FF60D672000-memory.dmp	xmrig
behavioral2/memory/2624-51-0x00007FF66B640000-0x00007FF66BA32000-memory.dmp	xmrig
behavioral2/memory/4104-4946-0x00007FF60D280000-0x00007FF60D672000-memory.dmp	xmrig
behavioral2/memory/1904-4990-0x00007FF7DEE90000-0x00007FF7DF282000-memory.dmp	xmrig
behavioral2/memory/688-4995-0x00007FF6F3E30000-0x00007FF6F4222000-memory.dmp	xmrig
behavioral2/memory/2384-5017-0x00007FF630EC0000-0x00007FF6312B2000-memory.dmp	xmrig
behavioral2/memory/4160-5073-0x00007FF7FE890000-0x00007FF7FEC82000-memory.dmp	xmrig
behavioral2/memory/764-5079-0x00007FF626BC0000-0x00007FF626FB2000-memory.dmp	xmrig
behavioral2/memory/2380-5101-0x00007FF75CD10000-0x00007FF75D102000-memory.dmp	xmrig
behavioral2/memory/4940-5135-0x00007FF7446C0000-0x00007FF744AB2000-memory.dmp	xmrig

Blocklisted process makes network request 3 IoCs

flow	pid	Process
9	3716	powershell.exe
11	3716	powershell.exe
15	3716	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3716	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1948	DTSFmIZ.exe
3288	pnhCcHC.exe
3636	kGLmyIM.exe
4484	DCfnJJy.exe
2624	zxmgkjS.exe
4868	sVVUktH.exe
4104	FECNQCV.exe
2252	WaFEqFq.exe
1904	YrOAyRZ.exe
1328	xeVQbLS.exe
1188	RiQgkCY.exe
5044	iqhCpxa.exe
2384	fdeNkry.exe
1792	HGqMRSx.exe
764	ZcdghOy.exe
5068	pKQORqH.exe
2196	vPpnHcp.exe
3832	krjTSJz.exe
688	EbuwPgC.exe
4160	bsARfSc.exe
1528	dgUfFok.exe
2380	KATmnYJ.exe
4940	klxLOXW.exe
3904	OxvDInr.exe
1060	wyhIhkL.exe
1992	vMyqENZ.exe
4580	WQtHPqy.exe
1524	riAzPUU.exe
3028	kqDynbV.exe
4764	yTleTIn.exe
4144	aGYtmZo.exe
4400	gDdtjbx.exe
4492	zBVQLqG.exe
4364	feIHQKm.exe
3784	aepcEAM.exe
4236	efabhyT.exe
408	BCEAytF.exe
4348	FAvlmFl.exe
4068	ivzdYdU.exe
3464	eMhknzO.exe
4076	DObdrPC.exe
4120	PnWYhcL.exe
4112	mxiZXaO.exe
1632	vLSHlpX.exe
428	IJSEvEf.exe
3712	pCkNASO.exe
548	WhLntrA.exe
3700	ogFGYGV.exe
2296	dvGJnhE.exe
1672	vinAImf.exe
4368	kuGCPgw.exe
1472	VjUAZlc.exe
3600	odcNUDt.exe
2976	geXeasO.exe
1764	Rxxtaxq.exe
3260	JMUmmXf.exe
4152	JmontEJ.exe
1256	mExhVrX.exe
3368	pYmawzU.exe
1716	xGuOPRA.exe
2628	kswnTLZ.exe
3168	EEWvYEE.exe
4308	VxojoIN.exe
1444	oVIXIbD.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4640-0-0x00007FF792C00000-0x00007FF792FF2000-memory.dmp	upx
behavioral2/files/0x00080000000234d5-5.dat	upx
behavioral2/files/0x00070000000234da-7.dat	upx
behavioral2/files/0x00070000000234de-36.dat	upx
behavioral2/files/0x00070000000234e4-52.dat	upx
behavioral2/files/0x00070000000234e5-71.dat	upx
behavioral2/memory/2252-374-0x00007FF6C4130000-0x00007FF6C4522000-memory.dmp	upx
behavioral2/memory/1904-379-0x00007FF7DEE90000-0x00007FF7DF282000-memory.dmp	upx
behavioral2/memory/764-458-0x00007FF626BC0000-0x00007FF626FB2000-memory.dmp	upx
behavioral2/memory/5068-527-0x00007FF6B0A50000-0x00007FF6B0E42000-memory.dmp	upx
behavioral2/memory/2380-553-0x00007FF75CD10000-0x00007FF75D102000-memory.dmp	upx
behavioral2/memory/4640-2149-0x00007FF792C00000-0x00007FF792FF2000-memory.dmp	upx
behavioral2/memory/4868-2177-0x00007FF6BEC40000-0x00007FF6BF032000-memory.dmp	upx
behavioral2/memory/3636-2176-0x00007FF67B5B0000-0x00007FF67B9A2000-memory.dmp	upx
behavioral2/memory/1948-2151-0x00007FF6BFDD0000-0x00007FF6C01C2000-memory.dmp	upx
behavioral2/memory/688-561-0x00007FF6F3E30000-0x00007FF6F4222000-memory.dmp	upx
behavioral2/memory/2384-560-0x00007FF630EC0000-0x00007FF6312B2000-memory.dmp	upx
behavioral2/memory/5044-559-0x00007FF6D23D0000-0x00007FF6D27C2000-memory.dmp	upx
behavioral2/memory/1188-558-0x00007FF751C20000-0x00007FF752012000-memory.dmp	upx
behavioral2/memory/4484-557-0x00007FF6B0C80000-0x00007FF6B1072000-memory.dmp	upx
behavioral2/memory/3288-556-0x00007FF6B3B60000-0x00007FF6B3F52000-memory.dmp	upx
behavioral2/memory/3904-555-0x00007FF6E4120000-0x00007FF6E4512000-memory.dmp	upx
behavioral2/memory/4940-554-0x00007FF7446C0000-0x00007FF744AB2000-memory.dmp	upx
behavioral2/memory/1528-552-0x00007FF6422D0000-0x00007FF6426C2000-memory.dmp	upx
behavioral2/memory/4160-551-0x00007FF7FE890000-0x00007FF7FEC82000-memory.dmp	upx
behavioral2/memory/3832-550-0x00007FF6D7F10000-0x00007FF6D8302000-memory.dmp	upx
behavioral2/memory/2196-549-0x00007FF795B20000-0x00007FF795F12000-memory.dmp	upx
behavioral2/memory/1792-457-0x00007FF719BD0000-0x00007FF719FC2000-memory.dmp	upx
behavioral2/memory/1328-399-0x00007FF6152B0000-0x00007FF6156A2000-memory.dmp	upx
behavioral2/files/0x00070000000234ed-190.dat	upx
behavioral2/files/0x00070000000234eb-178.dat	upx
behavioral2/files/0x00070000000234f6-177.dat	upx
behavioral2/files/0x00070000000234fe-174.dat	upx
behavioral2/files/0x00070000000234f5-172.dat	upx
behavioral2/files/0x00070000000234fd-169.dat	upx
behavioral2/files/0x00070000000234fc-162.dat	upx
behavioral2/files/0x00070000000234e9-160.dat	upx
behavioral2/files/0x00070000000234fb-159.dat	upx
behavioral2/files/0x00070000000234f9-157.dat	upx
behavioral2/files/0x00070000000234f7-155.dat	upx
behavioral2/files/0x00070000000234f4-150.dat	upx
behavioral2/files/0x00070000000234f3-149.dat	upx
behavioral2/files/0x00070000000234f1-145.dat	upx
behavioral2/files/0x00070000000234f0-142.dat	upx
behavioral2/files/0x00070000000234e8-136.dat	upx
behavioral2/files/0x00070000000234ef-132.dat	upx
behavioral2/files/0x00070000000234fa-158.dat	upx
behavioral2/files/0x00070000000234f8-156.dat	upx
behavioral2/files/0x00070000000234e7-127.dat	upx
behavioral2/files/0x00070000000234ee-126.dat	upx
behavioral2/files/0x00070000000234ec-122.dat	upx
behavioral2/files/0x00070000000234ea-113.dat	upx
behavioral2/files/0x00070000000234e0-105.dat	upx
behavioral2/files/0x00070000000234df-102.dat	upx
behavioral2/files/0x00070000000234f2-148.dat	upx
behavioral2/memory/4104-96-0x00007FF60D280000-0x00007FF60D672000-memory.dmp	upx
behavioral2/files/0x00070000000234e3-77.dat	upx
behavioral2/files/0x00070000000234e6-116.dat	upx
behavioral2/files/0x00070000000234dd-60.dat	upx
behavioral2/files/0x00070000000234e1-73.dat	upx
behavioral2/files/0x00070000000234db-54.dat	upx
behavioral2/memory/4868-69-0x00007FF6BEC40000-0x00007FF6BF032000-memory.dmp	upx
behavioral2/files/0x00070000000234e2-49.dat	upx
behavioral2/memory/3636-45-0x00007FF67B5B0000-0x00007FF67B9A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mZDsWVe.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\ZRrzHXJ.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\FdBcxlw.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\iErpdfP.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\vKkUKoL.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\bZwvSEE.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\HiJIExo.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\gKcbEaS.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\qiUzthE.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\JXepxoj.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\cfuqDhz.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\djLREge.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\TJlTqkN.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\mMmpFPO.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\WfCybLd.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\Redzkow.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\PlCweRw.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\SwBHxtf.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\rdZdAEg.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\zkvvjbW.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\hibtGon.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\MnOAmKw.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\pzQHuCF.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\xwCMtgd.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\IxbAdLK.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\rUMldSc.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\IbPuTbc.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\EYAfglZ.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\rZlDinK.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\JyvZsYC.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\fHjvtSu.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\GzfXIst.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\XPdNVWf.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\dALbbUP.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\GvxeivJ.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\AkXryeM.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\uwTIyaC.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\yBWQllb.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\xqkcytJ.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\asiLMrl.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\lUUHTSu.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\CxDbKGP.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\zSysuDe.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\MyPEBSF.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\VkVslGj.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\sZMNhhH.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\cnTwPWU.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\RjFZpqv.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\NbchVFO.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\qsqOGpa.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\GMHMqdV.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\QKyIepe.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\xBVBVpr.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\FMeAiUf.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\UHrayYS.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\drLOJtP.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\NbiwtCT.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\owrXPiD.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\YDQqLBT.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\AGnoVTM.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\dxOXoLq.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\YkYfSKA.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\lvTJlBV.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
File created	C:\Windows\System\LHwxyhE.exe	1a846dcbbcf3eb2a7d5885884ef79a60N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeLockMemoryPrivilege	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe
Token: SeLockMemoryPrivilege	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3716	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	84
PID 4640 wrote to memory of 3716	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	84
PID 4640 wrote to memory of 1948	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	85
PID 4640 wrote to memory of 1948	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	85
PID 4640 wrote to memory of 3288	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	86
PID 4640 wrote to memory of 3288	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	86
PID 4640 wrote to memory of 3636	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	87
PID 4640 wrote to memory of 3636	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	87
PID 4640 wrote to memory of 4484	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	88
PID 4640 wrote to memory of 4484	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	88
PID 4640 wrote to memory of 2624	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	89
PID 4640 wrote to memory of 2624	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	89
PID 4640 wrote to memory of 4868	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	90
PID 4640 wrote to memory of 4868	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	90
PID 4640 wrote to memory of 4104	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	91
PID 4640 wrote to memory of 4104	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	91
PID 4640 wrote to memory of 2252	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	92
PID 4640 wrote to memory of 2252	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	92
PID 4640 wrote to memory of 1904	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	93
PID 4640 wrote to memory of 1904	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	93
PID 4640 wrote to memory of 1328	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	94
PID 4640 wrote to memory of 1328	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	94
PID 4640 wrote to memory of 1188	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	95
PID 4640 wrote to memory of 1188	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	95
PID 4640 wrote to memory of 2384	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	96
PID 4640 wrote to memory of 2384	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	96
PID 4640 wrote to memory of 5044	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	97
PID 4640 wrote to memory of 5044	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	97
PID 4640 wrote to memory of 1792	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	98
PID 4640 wrote to memory of 1792	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	98
PID 4640 wrote to memory of 764	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	99
PID 4640 wrote to memory of 764	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	99
PID 4640 wrote to memory of 5068	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	100
PID 4640 wrote to memory of 5068	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	100
PID 4640 wrote to memory of 2196	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	101
PID 4640 wrote to memory of 2196	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	101
PID 4640 wrote to memory of 3832	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	102
PID 4640 wrote to memory of 3832	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	102
PID 4640 wrote to memory of 688	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	103
PID 4640 wrote to memory of 688	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	103
PID 4640 wrote to memory of 4160	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	104
PID 4640 wrote to memory of 4160	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	104
PID 4640 wrote to memory of 1528	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	105
PID 4640 wrote to memory of 1528	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	105
PID 4640 wrote to memory of 2380	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	106
PID 4640 wrote to memory of 2380	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	106
PID 4640 wrote to memory of 4940	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	107
PID 4640 wrote to memory of 4940	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	107
PID 4640 wrote to memory of 3904	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	108
PID 4640 wrote to memory of 3904	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	108
PID 4640 wrote to memory of 1060	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	109
PID 4640 wrote to memory of 1060	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	109
PID 4640 wrote to memory of 1992	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	110
PID 4640 wrote to memory of 1992	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	110
PID 4640 wrote to memory of 4580	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	111
PID 4640 wrote to memory of 4580	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	111
PID 4640 wrote to memory of 1524	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	112
PID 4640 wrote to memory of 1524	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	112
PID 4640 wrote to memory of 3028	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	113
PID 4640 wrote to memory of 3028	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	113
PID 4640 wrote to memory of 4764	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	114
PID 4640 wrote to memory of 4764	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	114
PID 4640 wrote to memory of 4068	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	115
PID 4640 wrote to memory of 4068	4640	1a846dcbbcf3eb2a7d5885884ef79a60N.exe	115

C:\Users\Admin\AppData\Local\Temp\1a846dcbbcf3eb2a7d5885884ef79a60N.exe
"C:\Users\Admin\AppData\Local\Temp\1a846dcbbcf3eb2a7d5885884ef79a60N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Windows\System\DTSFmIZ.exe
  C:\Windows\System\DTSFmIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\pnhCcHC.exe
  C:\Windows\System\pnhCcHC.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\kGLmyIM.exe
  C:\Windows\System\kGLmyIM.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\DCfnJJy.exe
  C:\Windows\System\DCfnJJy.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\zxmgkjS.exe
  C:\Windows\System\zxmgkjS.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\sVVUktH.exe
  C:\Windows\System\sVVUktH.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\FECNQCV.exe
  C:\Windows\System\FECNQCV.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\WaFEqFq.exe
  C:\Windows\System\WaFEqFq.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\YrOAyRZ.exe
  C:\Windows\System\YrOAyRZ.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\xeVQbLS.exe
  C:\Windows\System\xeVQbLS.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\RiQgkCY.exe
  C:\Windows\System\RiQgkCY.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\fdeNkry.exe
  C:\Windows\System\fdeNkry.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\iqhCpxa.exe
  C:\Windows\System\iqhCpxa.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\HGqMRSx.exe
  C:\Windows\System\HGqMRSx.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ZcdghOy.exe
  C:\Windows\System\ZcdghOy.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\pKQORqH.exe
  C:\Windows\System\pKQORqH.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\vPpnHcp.exe
  C:\Windows\System\vPpnHcp.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\krjTSJz.exe
  C:\Windows\System\krjTSJz.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\EbuwPgC.exe
  C:\Windows\System\EbuwPgC.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\bsARfSc.exe
  C:\Windows\System\bsARfSc.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\dgUfFok.exe
  C:\Windows\System\dgUfFok.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\KATmnYJ.exe
  C:\Windows\System\KATmnYJ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\klxLOXW.exe
  C:\Windows\System\klxLOXW.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\OxvDInr.exe
  C:\Windows\System\OxvDInr.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\wyhIhkL.exe
  C:\Windows\System\wyhIhkL.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\vMyqENZ.exe
  C:\Windows\System\vMyqENZ.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\WQtHPqy.exe
  C:\Windows\System\WQtHPqy.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\riAzPUU.exe
  C:\Windows\System\riAzPUU.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\kqDynbV.exe
  C:\Windows\System\kqDynbV.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\yTleTIn.exe
  C:\Windows\System\yTleTIn.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\ivzdYdU.exe
  C:\Windows\System\ivzdYdU.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\aGYtmZo.exe
  C:\Windows\System\aGYtmZo.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\gDdtjbx.exe
  C:\Windows\System\gDdtjbx.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\zBVQLqG.exe
  C:\Windows\System\zBVQLqG.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\feIHQKm.exe
  C:\Windows\System\feIHQKm.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\aepcEAM.exe
  C:\Windows\System\aepcEAM.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\efabhyT.exe
  C:\Windows\System\efabhyT.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\BCEAytF.exe
  C:\Windows\System\BCEAytF.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\FAvlmFl.exe
  C:\Windows\System\FAvlmFl.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\eMhknzO.exe
  C:\Windows\System\eMhknzO.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\DObdrPC.exe
  C:\Windows\System\DObdrPC.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\PnWYhcL.exe
  C:\Windows\System\PnWYhcL.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\mxiZXaO.exe
  C:\Windows\System\mxiZXaO.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\vLSHlpX.exe
  C:\Windows\System\vLSHlpX.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\IJSEvEf.exe
  C:\Windows\System\IJSEvEf.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\pCkNASO.exe
  C:\Windows\System\pCkNASO.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\WhLntrA.exe
  C:\Windows\System\WhLntrA.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\ogFGYGV.exe
  C:\Windows\System\ogFGYGV.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\dvGJnhE.exe
  C:\Windows\System\dvGJnhE.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\tGtSTzm.exe
  C:\Windows\System\tGtSTzm.exe
  2⤵
  PID:3280
- C:\Windows\System\vinAImf.exe
  C:\Windows\System\vinAImf.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\kuGCPgw.exe
  C:\Windows\System\kuGCPgw.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\VjUAZlc.exe
  C:\Windows\System\VjUAZlc.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\odcNUDt.exe
  C:\Windows\System\odcNUDt.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\geXeasO.exe
  C:\Windows\System\geXeasO.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\Rxxtaxq.exe
  C:\Windows\System\Rxxtaxq.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\JMUmmXf.exe
  C:\Windows\System\JMUmmXf.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\JmontEJ.exe
  C:\Windows\System\JmontEJ.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\mExhVrX.exe
  C:\Windows\System\mExhVrX.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\pYmawzU.exe
  C:\Windows\System\pYmawzU.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\xGuOPRA.exe
  C:\Windows\System\xGuOPRA.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\kswnTLZ.exe
  C:\Windows\System\kswnTLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\EEWvYEE.exe
  C:\Windows\System\EEWvYEE.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\VxojoIN.exe
  C:\Windows\System\VxojoIN.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\oVIXIbD.exe
  C:\Windows\System\oVIXIbD.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\lUaamMk.exe
  C:\Windows\System\lUaamMk.exe
  2⤵
  PID:2848
- C:\Windows\System\Rorxfjp.exe
  C:\Windows\System\Rorxfjp.exe
  2⤵
  PID:220
- C:\Windows\System\tRMrTcK.exe
  C:\Windows\System\tRMrTcK.exe
  2⤵
  PID:3484
- C:\Windows\System\XluXaMk.exe
  C:\Windows\System\XluXaMk.exe
  2⤵
  PID:348
- C:\Windows\System\xtXjiPJ.exe
  C:\Windows\System\xtXjiPJ.exe
  2⤵
  PID:2144
- C:\Windows\System\cdHHqHQ.exe
  C:\Windows\System\cdHHqHQ.exe
  2⤵
  PID:2336
- C:\Windows\System\HVgnqaO.exe
  C:\Windows\System\HVgnqaO.exe
  2⤵
  PID:2560
- C:\Windows\System\jsiJxgh.exe
  C:\Windows\System\jsiJxgh.exe
  2⤵
  PID:1300
- C:\Windows\System\OXgnhCC.exe
  C:\Windows\System\OXgnhCC.exe
  2⤵
  PID:3472
- C:\Windows\System\ZEouZTt.exe
  C:\Windows\System\ZEouZTt.exe
  2⤵
  PID:3176
- C:\Windows\System\RnuftyB.exe
  C:\Windows\System\RnuftyB.exe
  2⤵
  PID:3172
- C:\Windows\System\Ihsvuqi.exe
  C:\Windows\System\Ihsvuqi.exe
  2⤵
  PID:3744
- C:\Windows\System\fFxSLMY.exe
  C:\Windows\System\fFxSLMY.exe
  2⤵
  PID:4812
- C:\Windows\System\QCOvbWN.exe
  C:\Windows\System\QCOvbWN.exe
  2⤵
  PID:3940
- C:\Windows\System\DfwtgPx.exe
  C:\Windows\System\DfwtgPx.exe
  2⤵
  PID:3156
- C:\Windows\System\IIBEhJR.exe
  C:\Windows\System\IIBEhJR.exe
  2⤵
  PID:4544
- C:\Windows\System\YRWFGvM.exe
  C:\Windows\System\YRWFGvM.exe
  2⤵
  PID:3948
- C:\Windows\System\fpWEjdk.exe
  C:\Windows\System\fpWEjdk.exe
  2⤵
  PID:1184
- C:\Windows\System\qpJrEdD.exe
  C:\Windows\System\qpJrEdD.exe
  2⤵
  PID:3672
- C:\Windows\System\xYmTbgy.exe
  C:\Windows\System\xYmTbgy.exe
  2⤵
  PID:1156
- C:\Windows\System\QHzVSUV.exe
  C:\Windows\System\QHzVSUV.exe
  2⤵
  PID:5144
- C:\Windows\System\gaxVeTE.exe
  C:\Windows\System\gaxVeTE.exe
  2⤵
  PID:5160
- C:\Windows\System\QnEoVRG.exe
  C:\Windows\System\QnEoVRG.exe
  2⤵
  PID:5188
- C:\Windows\System\ZYbqOvS.exe
  C:\Windows\System\ZYbqOvS.exe
  2⤵
  PID:5208
- C:\Windows\System\yITcYiR.exe
  C:\Windows\System\yITcYiR.exe
  2⤵
  PID:5228
- C:\Windows\System\TKjQjBG.exe
  C:\Windows\System\TKjQjBG.exe
  2⤵
  PID:5256
- C:\Windows\System\KZqeiHu.exe
  C:\Windows\System\KZqeiHu.exe
  2⤵
  PID:5276
- C:\Windows\System\jSAxFID.exe
  C:\Windows\System\jSAxFID.exe
  2⤵
  PID:5292
- C:\Windows\System\raOWqtm.exe
  C:\Windows\System\raOWqtm.exe
  2⤵
  PID:5316
- C:\Windows\System\OwVgfvR.exe
  C:\Windows\System\OwVgfvR.exe
  2⤵
  PID:5360
- C:\Windows\System\wodKNqr.exe
  C:\Windows\System\wodKNqr.exe
  2⤵
  PID:5376
- C:\Windows\System\rpEsVQt.exe
  C:\Windows\System\rpEsVQt.exe
  2⤵
  PID:5404
- C:\Windows\System\qTkKRmg.exe
  C:\Windows\System\qTkKRmg.exe
  2⤵
  PID:5424
- C:\Windows\System\vKDpFUi.exe
  C:\Windows\System\vKDpFUi.exe
  2⤵
  PID:5440
- C:\Windows\System\maTNyhh.exe
  C:\Windows\System\maTNyhh.exe
  2⤵
  PID:5456
- C:\Windows\System\fieTpot.exe
  C:\Windows\System\fieTpot.exe
  2⤵
  PID:5472
- C:\Windows\System\ZzzyjOK.exe
  C:\Windows\System\ZzzyjOK.exe
  2⤵
  PID:5508
- C:\Windows\System\IDHGdmU.exe
  C:\Windows\System\IDHGdmU.exe
  2⤵
  PID:5532
- C:\Windows\System\LeCegoJ.exe
  C:\Windows\System\LeCegoJ.exe
  2⤵
  PID:5560
- C:\Windows\System\IyGlEvh.exe
  C:\Windows\System\IyGlEvh.exe
  2⤵
  PID:5604
- C:\Windows\System\uotIZEg.exe
  C:\Windows\System\uotIZEg.exe
  2⤵
  PID:5664
- C:\Windows\System\Kjifnvc.exe
  C:\Windows\System\Kjifnvc.exe
  2⤵
  PID:5684
- C:\Windows\System\VkxqQIG.exe
  C:\Windows\System\VkxqQIG.exe
  2⤵
  PID:5704
- C:\Windows\System\RiWblIx.exe
  C:\Windows\System\RiWblIx.exe
  2⤵
  PID:5732
- C:\Windows\System\YXSrfsh.exe
  C:\Windows\System\YXSrfsh.exe
  2⤵
  PID:5752
- C:\Windows\System\gQYsets.exe
  C:\Windows\System\gQYsets.exe
  2⤵
  PID:5772
- C:\Windows\System\DBNmSZr.exe
  C:\Windows\System\DBNmSZr.exe
  2⤵
  PID:5796
- C:\Windows\System\ElDANoR.exe
  C:\Windows\System\ElDANoR.exe
  2⤵
  PID:5820
- C:\Windows\System\NPCLfQF.exe
  C:\Windows\System\NPCLfQF.exe
  2⤵
  PID:5840
- C:\Windows\System\qjBvIyQ.exe
  C:\Windows\System\qjBvIyQ.exe
  2⤵
  PID:5864
- C:\Windows\System\GUjVzRp.exe
  C:\Windows\System\GUjVzRp.exe
  2⤵
  PID:6128
- C:\Windows\System\efBxRSj.exe
  C:\Windows\System\efBxRSj.exe
  2⤵
  PID:1084
- C:\Windows\System\kuMKNpw.exe
  C:\Windows\System\kuMKNpw.exe
  2⤵
  PID:1572
- C:\Windows\System\celLjUv.exe
  C:\Windows\System\celLjUv.exe
  2⤵
  PID:5092
- C:\Windows\System\aJIlsOr.exe
  C:\Windows\System\aJIlsOr.exe
  2⤵
  PID:4376
- C:\Windows\System\XRhAUuR.exe
  C:\Windows\System\XRhAUuR.exe
  2⤵
  PID:2028
- C:\Windows\System\ZiyGLSV.exe
  C:\Windows\System\ZiyGLSV.exe
  2⤵
  PID:1032
- C:\Windows\System\MtkiySU.exe
  C:\Windows\System\MtkiySU.exe
  2⤵
  PID:1452
- C:\Windows\System\QJwtEFW.exe
  C:\Windows\System\QJwtEFW.exe
  2⤵
  PID:4888
- C:\Windows\System\HhwvyZZ.exe
  C:\Windows\System\HhwvyZZ.exe
  2⤵
  PID:1196
- C:\Windows\System\gKEWMcH.exe
  C:\Windows\System\gKEWMcH.exe
  2⤵
  PID:3140
- C:\Windows\System\arpsJEz.exe
  C:\Windows\System\arpsJEz.exe
  2⤵
  PID:2824
- C:\Windows\System\kgtQeOx.exe
  C:\Windows\System\kgtQeOx.exe
  2⤵
  PID:4352
- C:\Windows\System\BwIQtSQ.exe
  C:\Windows\System\BwIQtSQ.exe
  2⤵
  PID:1552
- C:\Windows\System\zUznNgk.exe
  C:\Windows\System\zUznNgk.exe
  2⤵
  PID:860
- C:\Windows\System\FKDNYoQ.exe
  C:\Windows\System\FKDNYoQ.exe
  2⤵
  PID:1988
- C:\Windows\System\jBLWlQp.exe
  C:\Windows\System\jBLWlQp.exe
  2⤵
  PID:2156
- C:\Windows\System\uUinkWW.exe
  C:\Windows\System\uUinkWW.exe
  2⤵
  PID:1684
- C:\Windows\System\fHjOjNQ.exe
  C:\Windows\System\fHjOjNQ.exe
  2⤵
  PID:5168
- C:\Windows\System\DjCDzpj.exe
  C:\Windows\System\DjCDzpj.exe
  2⤵
  PID:5200
- C:\Windows\System\jNGfDuM.exe
  C:\Windows\System\jNGfDuM.exe
  2⤵
  PID:5268
- C:\Windows\System\EbnZTYU.exe
  C:\Windows\System\EbnZTYU.exe
  2⤵
  PID:5312
- C:\Windows\System\WwfHjfI.exe
  C:\Windows\System\WwfHjfI.exe
  2⤵
  PID:5368
- C:\Windows\System\zbXRXCr.exe
  C:\Windows\System\zbXRXCr.exe
  2⤵
  PID:5412
- C:\Windows\System\YTsRtSH.exe
  C:\Windows\System\YTsRtSH.exe
  2⤵
  PID:5432
- C:\Windows\System\hfGMsxD.exe
  C:\Windows\System\hfGMsxD.exe
  2⤵
  PID:1036
- C:\Windows\System\aBxADPP.exe
  C:\Windows\System\aBxADPP.exe
  2⤵
  PID:5540
- C:\Windows\System\hGUJrqf.exe
  C:\Windows\System\hGUJrqf.exe
  2⤵
  PID:5572
- C:\Windows\System\HRYCAzo.exe
  C:\Windows\System\HRYCAzo.exe
  2⤵
  PID:5592
- C:\Windows\System\qLrgiOZ.exe
  C:\Windows\System\qLrgiOZ.exe
  2⤵
  PID:5676
- C:\Windows\System\fvVIOyi.exe
  C:\Windows\System\fvVIOyi.exe
  2⤵
  PID:5716
- C:\Windows\System\OHGdLhP.exe
  C:\Windows\System\OHGdLhP.exe
  2⤵
  PID:5764
- C:\Windows\System\rnHbMMm.exe
  C:\Windows\System\rnHbMMm.exe
  2⤵
  PID:5812
- C:\Windows\System\AcXtRKX.exe
  C:\Windows\System\AcXtRKX.exe
  2⤵
  PID:5856
- C:\Windows\System\KVIgrNV.exe
  C:\Windows\System\KVIgrNV.exe
  2⤵
  PID:5896
- C:\Windows\System\kZGipMN.exe
  C:\Windows\System\kZGipMN.exe
  2⤵
  PID:6160
- C:\Windows\System\xwkTwia.exe
  C:\Windows\System\xwkTwia.exe
  2⤵
  PID:6192
- C:\Windows\System\iTHHxdk.exe
  C:\Windows\System\iTHHxdk.exe
  2⤵
  PID:6220
- C:\Windows\System\noRfcYG.exe
  C:\Windows\System\noRfcYG.exe
  2⤵
  PID:6240
- C:\Windows\System\fDuiHFM.exe
  C:\Windows\System\fDuiHFM.exe
  2⤵
  PID:6260
- C:\Windows\System\yRXdzWv.exe
  C:\Windows\System\yRXdzWv.exe
  2⤵
  PID:6284
- C:\Windows\System\kjIhgUf.exe
  C:\Windows\System\kjIhgUf.exe
  2⤵
  PID:6304
- C:\Windows\System\QvmAMPo.exe
  C:\Windows\System\QvmAMPo.exe
  2⤵
  PID:6328
- C:\Windows\System\GMJKzlh.exe
  C:\Windows\System\GMJKzlh.exe
  2⤵
  PID:6344
- C:\Windows\System\EzhfNhw.exe
  C:\Windows\System\EzhfNhw.exe
  2⤵
  PID:6368
- C:\Windows\System\jupeYFp.exe
  C:\Windows\System\jupeYFp.exe
  2⤵
  PID:6384
- C:\Windows\System\gtrFsgO.exe
  C:\Windows\System\gtrFsgO.exe
  2⤵
  PID:6408
- C:\Windows\System\qGIAzAU.exe
  C:\Windows\System\qGIAzAU.exe
  2⤵
  PID:6432
- C:\Windows\System\LgfhXPq.exe
  C:\Windows\System\LgfhXPq.exe
  2⤵
  PID:6448
- C:\Windows\System\AOSwVvB.exe
  C:\Windows\System\AOSwVvB.exe
  2⤵
  PID:6496
- C:\Windows\System\NpAqKSG.exe
  C:\Windows\System\NpAqKSG.exe
  2⤵
  PID:6552
- C:\Windows\System\AhkaUvu.exe
  C:\Windows\System\AhkaUvu.exe
  2⤵
  PID:6572
- C:\Windows\System\mYSoJKG.exe
  C:\Windows\System\mYSoJKG.exe
  2⤵
  PID:6592
- C:\Windows\System\IkSByjM.exe
  C:\Windows\System\IkSByjM.exe
  2⤵
  PID:6612
- C:\Windows\System\uJjQqqv.exe
  C:\Windows\System\uJjQqqv.exe
  2⤵
  PID:6632
- C:\Windows\System\uyZPvHH.exe
  C:\Windows\System\uyZPvHH.exe
  2⤵
  PID:6648
- C:\Windows\System\MHSPZcM.exe
  C:\Windows\System\MHSPZcM.exe
  2⤵
  PID:6676
- C:\Windows\System\VCPzruu.exe
  C:\Windows\System\VCPzruu.exe
  2⤵
  PID:6692
- C:\Windows\System\keGRwrI.exe
  C:\Windows\System\keGRwrI.exe
  2⤵
  PID:7100
- C:\Windows\System\SBDnWft.exe
  C:\Windows\System\SBDnWft.exe
  2⤵
  PID:7116
- C:\Windows\System\xDpDwdX.exe
  C:\Windows\System\xDpDwdX.exe
  2⤵
  PID:3360
- C:\Windows\System\EllalXj.exe
  C:\Windows\System\EllalXj.exe
  2⤵
  PID:4440
- C:\Windows\System\fPjwLaP.exe
  C:\Windows\System\fPjwLaP.exe
  2⤵
  PID:6180
- C:\Windows\System\vvzSUZu.exe
  C:\Windows\System\vvzSUZu.exe
  2⤵
  PID:5152
- C:\Windows\System\BzmDLvW.exe
  C:\Windows\System\BzmDLvW.exe
  2⤵
  PID:964
- C:\Windows\System\iQKnKxk.exe
  C:\Windows\System\iQKnKxk.exe
  2⤵
  PID:5576
- C:\Windows\System\FcffywW.exe
  C:\Windows\System\FcffywW.exe
  2⤵
  PID:6232
- C:\Windows\System\totwvVF.exe
  C:\Windows\System\totwvVF.exe
  2⤵
  PID:6324
- C:\Windows\System\WVSGPZP.exe
  C:\Windows\System\WVSGPZP.exe
  2⤵
  PID:6404
- C:\Windows\System\QPkEBNb.exe
  C:\Windows\System\QPkEBNb.exe
  2⤵
  PID:6568
- C:\Windows\System\XOXddmI.exe
  C:\Windows\System\XOXddmI.exe
  2⤵
  PID:6688
- C:\Windows\System\JXepxoj.exe
  C:\Windows\System\JXepxoj.exe
  2⤵
  PID:6316
- C:\Windows\System\UBDcLUn.exe
  C:\Windows\System\UBDcLUn.exe
  2⤵
  PID:6400
- C:\Windows\System\bEiShUg.exe
  C:\Windows\System\bEiShUg.exe
  2⤵
  PID:6544
- C:\Windows\System\pmqgAlQ.exe
  C:\Windows\System\pmqgAlQ.exe
  2⤵
  PID:6640
- C:\Windows\System\ZENXdoF.exe
  C:\Windows\System\ZENXdoF.exe
  2⤵
  PID:1984
- C:\Windows\System\KDCHkGP.exe
  C:\Windows\System\KDCHkGP.exe
  2⤵
  PID:4848
- C:\Windows\System\EOKvgtW.exe
  C:\Windows\System\EOKvgtW.exe
  2⤵
  PID:436
- C:\Windows\System\Yospwhe.exe
  C:\Windows\System\Yospwhe.exe
  2⤵
  PID:7172
- C:\Windows\System\bofrNIB.exe
  C:\Windows\System\bofrNIB.exe
  2⤵
  PID:7188
- C:\Windows\System\KYrPJTE.exe
  C:\Windows\System\KYrPJTE.exe
  2⤵
  PID:7204
- C:\Windows\System\sgCUCXj.exe
  C:\Windows\System\sgCUCXj.exe
  2⤵
  PID:7224
- C:\Windows\System\OnVBmQJ.exe
  C:\Windows\System\OnVBmQJ.exe
  2⤵
  PID:7244
- C:\Windows\System\bUaLPmZ.exe
  C:\Windows\System\bUaLPmZ.exe
  2⤵
  PID:7264
- C:\Windows\System\GNgwdQX.exe
  C:\Windows\System\GNgwdQX.exe
  2⤵
  PID:7288
- C:\Windows\System\hpyhzQP.exe
  C:\Windows\System\hpyhzQP.exe
  2⤵
  PID:7308
- C:\Windows\System\spRECew.exe
  C:\Windows\System\spRECew.exe
  2⤵
  PID:7332
- C:\Windows\System\jJWJCrI.exe
  C:\Windows\System\jJWJCrI.exe
  2⤵
  PID:7352
- C:\Windows\System\vdTePOh.exe
  C:\Windows\System\vdTePOh.exe
  2⤵
  PID:7372
- C:\Windows\System\MuMDWvy.exe
  C:\Windows\System\MuMDWvy.exe
  2⤵
  PID:7392
- C:\Windows\System\PTLBSNO.exe
  C:\Windows\System\PTLBSNO.exe
  2⤵
  PID:7416
- C:\Windows\System\tpYiuqV.exe
  C:\Windows\System\tpYiuqV.exe
  2⤵
  PID:7444
- C:\Windows\System\XPHLhMp.exe
  C:\Windows\System\XPHLhMp.exe
  2⤵
  PID:7460
- C:\Windows\System\sYWAyLY.exe
  C:\Windows\System\sYWAyLY.exe
  2⤵
  PID:7484
- C:\Windows\System\BaQEmkG.exe
  C:\Windows\System\BaQEmkG.exe
  2⤵
  PID:7504
- C:\Windows\System\uyyOIDY.exe
  C:\Windows\System\uyyOIDY.exe
  2⤵
  PID:7808
- C:\Windows\System\EgLzfcF.exe
  C:\Windows\System\EgLzfcF.exe
  2⤵
  PID:7824
- C:\Windows\System\lVXbQyh.exe
  C:\Windows\System\lVXbQyh.exe
  2⤵
  PID:7840
- C:\Windows\System\MIQOOVZ.exe
  C:\Windows\System\MIQOOVZ.exe
  2⤵
  PID:7860
- C:\Windows\System\JaxKOwf.exe
  C:\Windows\System\JaxKOwf.exe
  2⤵
  PID:7880
- C:\Windows\System\oiwyvYU.exe
  C:\Windows\System\oiwyvYU.exe
  2⤵
  PID:7900
- C:\Windows\System\RJYTXUO.exe
  C:\Windows\System\RJYTXUO.exe
  2⤵
  PID:7920
- C:\Windows\System\HECPJxJ.exe
  C:\Windows\System\HECPJxJ.exe
  2⤵
  PID:7936
- C:\Windows\System\RlfewTU.exe
  C:\Windows\System\RlfewTU.exe
  2⤵
  PID:7960
- C:\Windows\System\CUVeYRY.exe
  C:\Windows\System\CUVeYRY.exe
  2⤵
  PID:7980
- C:\Windows\System\gEwuYlM.exe
  C:\Windows\System\gEwuYlM.exe
  2⤵
  PID:7996
- C:\Windows\System\xGyuJgZ.exe
  C:\Windows\System\xGyuJgZ.exe
  2⤵
  PID:8016
- C:\Windows\System\vOmnXTR.exe
  C:\Windows\System\vOmnXTR.exe
  2⤵
  PID:8036
- C:\Windows\System\Gfmiuia.exe
  C:\Windows\System\Gfmiuia.exe
  2⤵
  PID:8088
- C:\Windows\System\UBvLLmY.exe
  C:\Windows\System\UBvLLmY.exe
  2⤵
  PID:8124
- C:\Windows\System\gQBygBD.exe
  C:\Windows\System\gQBygBD.exe
  2⤵
  PID:8144
- C:\Windows\System\vjGkJuT.exe
  C:\Windows\System\vjGkJuT.exe
  2⤵
  PID:8160
- C:\Windows\System\wwYVSJr.exe
  C:\Windows\System\wwYVSJr.exe
  2⤵
  PID:8180
- C:\Windows\System\HGCZKxW.exe
  C:\Windows\System\HGCZKxW.exe
  2⤵
  PID:6976
- C:\Windows\System\KGDyJXe.exe
  C:\Windows\System\KGDyJXe.exe
  2⤵
  PID:6996
- C:\Windows\System\odwBJxk.exe
  C:\Windows\System\odwBJxk.exe
  2⤵
  PID:7012
- C:\Windows\System\cNmIrfU.exe
  C:\Windows\System\cNmIrfU.exe
  2⤵
  PID:7028
- C:\Windows\System\CkckwXD.exe
  C:\Windows\System\CkckwXD.exe
  2⤵
  PID:7052
- C:\Windows\System\yCNhnHv.exe
  C:\Windows\System\yCNhnHv.exe
  2⤵
  PID:7076
- C:\Windows\System\gtfXshg.exe
  C:\Windows\System\gtfXshg.exe
  2⤵
  PID:7144
- C:\Windows\System\oQwDBQK.exe
  C:\Windows\System\oQwDBQK.exe
  2⤵
  PID:1180
- C:\Windows\System\znGAmCz.exe
  C:\Windows\System\znGAmCz.exe
  2⤵
  PID:5132
- C:\Windows\System\hYTlJBO.exe
  C:\Windows\System\hYTlJBO.exe
  2⤵
  PID:5804
- C:\Windows\System\FpXykZd.exe
  C:\Windows\System\FpXykZd.exe
  2⤵
  PID:3740
- C:\Windows\System\hWAJrwN.exe
  C:\Windows\System\hWAJrwN.exe
  2⤵
  PID:4140
- C:\Windows\System\dwtrZKg.exe
  C:\Windows\System\dwtrZKg.exe
  2⤵
  PID:5696
- C:\Windows\System\xzXHsvR.exe
  C:\Windows\System\xzXHsvR.exe
  2⤵
  PID:6272
- C:\Windows\System\rjYSxaC.exe
  C:\Windows\System\rjYSxaC.exe
  2⤵
  PID:6608
- C:\Windows\System\wxnYlwP.exe
  C:\Windows\System\wxnYlwP.exe
  2⤵
  PID:6360
- C:\Windows\System\RUSSfbH.exe
  C:\Windows\System\RUSSfbH.exe
  2⤵
  PID:6620
- C:\Windows\System\KxXOtWU.exe
  C:\Windows\System\KxXOtWU.exe
  2⤵
  PID:752
- C:\Windows\System\GYCceha.exe
  C:\Windows\System\GYCceha.exe
  2⤵
  PID:6228
- C:\Windows\System\hRQEGXX.exe
  C:\Windows\System\hRQEGXX.exe
  2⤵
  PID:7216
- C:\Windows\System\DUIwUMl.exe
  C:\Windows\System\DUIwUMl.exe
  2⤵
  PID:7260
- C:\Windows\System\wvkOArr.exe
  C:\Windows\System\wvkOArr.exe
  2⤵
  PID:7296
- C:\Windows\System\hkPNoPP.exe
  C:\Windows\System\hkPNoPP.exe
  2⤵
  PID:7344
- C:\Windows\System\lWQJpnE.exe
  C:\Windows\System\lWQJpnE.exe
  2⤵
  PID:7388
- C:\Windows\System\unwxtRs.exe
  C:\Windows\System\unwxtRs.exe
  2⤵
  PID:7428
- C:\Windows\System\DEetebC.exe
  C:\Windows\System\DEetebC.exe
  2⤵
  PID:7480
- C:\Windows\System\cGjqsAX.exe
  C:\Windows\System\cGjqsAX.exe
  2⤵
  PID:7572
- C:\Windows\System\euGGvcC.exe
  C:\Windows\System\euGGvcC.exe
  2⤵
  PID:4056
- C:\Windows\System\PSBmyUe.exe
  C:\Windows\System\PSBmyUe.exe
  2⤵
  PID:3336
- C:\Windows\System\QdgIwIh.exe
  C:\Windows\System\QdgIwIh.exe
  2⤵
  PID:2592
- C:\Windows\System\HSaSMpv.exe
  C:\Windows\System\HSaSMpv.exe
  2⤵
  PID:1640
- C:\Windows\System\dCFojDf.exe
  C:\Windows\System\dCFojDf.exe
  2⤵
  PID:4968
- C:\Windows\System\kARzdiZ.exe
  C:\Windows\System\kARzdiZ.exe
  2⤵
  PID:4920
- C:\Windows\System\tRQavTb.exe
  C:\Windows\System\tRQavTb.exe
  2⤵
  PID:2916
- C:\Windows\System\LPAVxHP.exe
  C:\Windows\System\LPAVxHP.exe
  2⤵
  PID:4788
- C:\Windows\System\npOjEkZ.exe
  C:\Windows\System\npOjEkZ.exe
  2⤵
  PID:2556
- C:\Windows\System\LYDHSIV.exe
  C:\Windows\System\LYDHSIV.exe
  2⤵
  PID:7852
- C:\Windows\System\tGXGhwp.exe
  C:\Windows\System\tGXGhwp.exe
  2⤵
  PID:7888
- C:\Windows\System\HIMKVVp.exe
  C:\Windows\System\HIMKVVp.exe
  2⤵
  PID:7944
- C:\Windows\System\XtAiFaf.exe
  C:\Windows\System\XtAiFaf.exe
  2⤵
  PID:7972
- C:\Windows\System\KlFrpCC.exe
  C:\Windows\System\KlFrpCC.exe
  2⤵
  PID:8032
- C:\Windows\System\sYrlIHE.exe
  C:\Windows\System\sYrlIHE.exe
  2⤵
  PID:8052
- C:\Windows\System\Xllvfav.exe
  C:\Windows\System\Xllvfav.exe
  2⤵
  PID:4232
- C:\Windows\System\AWaqKIQ.exe
  C:\Windows\System\AWaqKIQ.exe
  2⤵
  PID:8116
- C:\Windows\System\XQqPFdP.exe
  C:\Windows\System\XQqPFdP.exe
  2⤵
  PID:8176
- C:\Windows\System\iQGOrME.exe
  C:\Windows\System\iQGOrME.exe
  2⤵
  PID:7832
- C:\Windows\System\WMFlFTH.exe
  C:\Windows\System\WMFlFTH.exe
  2⤵
  PID:7048
- C:\Windows\System\VqBekUs.exe
  C:\Windows\System\VqBekUs.exe
  2⤵
  PID:936
- C:\Windows\System\pWffXoM.exe
  C:\Windows\System\pWffXoM.exe
  2⤵
  PID:2520
- C:\Windows\System\EiIvVSp.exe
  C:\Windows\System\EiIvVSp.exe
  2⤵
  PID:6988
- C:\Windows\System\jGVCixj.exe
  C:\Windows\System\jGVCixj.exe
  2⤵
  PID:1932
- C:\Windows\System\GYIzils.exe
  C:\Windows\System\GYIzils.exe
  2⤵
  PID:8060
- C:\Windows\System\gFbPkfX.exe
  C:\Windows\System\gFbPkfX.exe
  2⤵
  PID:8080
- C:\Windows\System\xJjprgW.exe
  C:\Windows\System\xJjprgW.exe
  2⤵
  PID:6268
- C:\Windows\System\aKFOVQZ.exe
  C:\Windows\System\aKFOVQZ.exe
  2⤵
  PID:3212
- C:\Windows\System\DsYjaAd.exe
  C:\Windows\System\DsYjaAd.exe
  2⤵
  PID:7500
- C:\Windows\System\jdroQdj.exe
  C:\Windows\System\jdroQdj.exe
  2⤵
  PID:5832
- C:\Windows\System\vTonVJi.exe
  C:\Windows\System\vTonVJi.exe
  2⤵
  PID:7112
- C:\Windows\System\cCdvhyx.exe
  C:\Windows\System\cCdvhyx.exe
  2⤵
  PID:3384
- C:\Windows\System\IOmSclS.exe
  C:\Windows\System\IOmSclS.exe
  2⤵
  PID:4084
- C:\Windows\System\FRTYojC.exe
  C:\Windows\System\FRTYojC.exe
  2⤵
  PID:7280
- C:\Windows\System\XKHggDE.exe
  C:\Windows\System\XKHggDE.exe
  2⤵
  PID:7368
- C:\Windows\System\bvHBLDA.exe
  C:\Windows\System\bvHBLDA.exe
  2⤵
  PID:7804
- C:\Windows\System\SKbfUKj.exe
  C:\Windows\System\SKbfUKj.exe
  2⤵
  PID:1088
- C:\Windows\System\EVRIgVh.exe
  C:\Windows\System\EVRIgVh.exe
  2⤵
  PID:6480
- C:\Windows\System\nmDhGnN.exe
  C:\Windows\System\nmDhGnN.exe
  2⤵
  PID:8196
- C:\Windows\System\lekzcqe.exe
  C:\Windows\System\lekzcqe.exe
  2⤵
  PID:8220
- C:\Windows\System\cvhtaTQ.exe
  C:\Windows\System\cvhtaTQ.exe
  2⤵
  PID:8244
- C:\Windows\System\sPvWQnm.exe
  C:\Windows\System\sPvWQnm.exe
  2⤵
  PID:8264
- C:\Windows\System\EYfkQlt.exe
  C:\Windows\System\EYfkQlt.exe
  2⤵
  PID:8288
- C:\Windows\System\oDGFptj.exe
  C:\Windows\System\oDGFptj.exe
  2⤵
  PID:8308
- C:\Windows\System\IvQPHwE.exe
  C:\Windows\System\IvQPHwE.exe
  2⤵
  PID:8324
- C:\Windows\System\cYuPNxv.exe
  C:\Windows\System\cYuPNxv.exe
  2⤵
  PID:8344
- C:\Windows\System\KjJhgrw.exe
  C:\Windows\System\KjJhgrw.exe
  2⤵
  PID:8368
- C:\Windows\System\ZiOMEvs.exe
  C:\Windows\System\ZiOMEvs.exe
  2⤵
  PID:8392
- C:\Windows\System\wETpbgl.exe
  C:\Windows\System\wETpbgl.exe
  2⤵
  PID:8428
- C:\Windows\System\qoSjGKE.exe
  C:\Windows\System\qoSjGKE.exe
  2⤵
  PID:8444
- C:\Windows\System\MsXjxGO.exe
  C:\Windows\System\MsXjxGO.exe
  2⤵
  PID:8464
- C:\Windows\System\uEdcPBU.exe
  C:\Windows\System\uEdcPBU.exe
  2⤵
  PID:8488
- C:\Windows\System\sEtwFij.exe
  C:\Windows\System\sEtwFij.exe
  2⤵
  PID:8508
- C:\Windows\System\qJGOASI.exe
  C:\Windows\System\qJGOASI.exe
  2⤵
  PID:8536
- C:\Windows\System\jrgtGdF.exe
  C:\Windows\System\jrgtGdF.exe
  2⤵
  PID:8560
- C:\Windows\System\EjVvTOb.exe
  C:\Windows\System\EjVvTOb.exe
  2⤵
  PID:8604
- C:\Windows\System\mhNvqry.exe
  C:\Windows\System\mhNvqry.exe
  2⤵
  PID:8656
- C:\Windows\System\mHqXezi.exe
  C:\Windows\System\mHqXezi.exe
  2⤵
  PID:8700
- C:\Windows\System\gfVEYgQ.exe
  C:\Windows\System\gfVEYgQ.exe
  2⤵
  PID:8720
- C:\Windows\System\buIaXhJ.exe
  C:\Windows\System\buIaXhJ.exe
  2⤵
  PID:8748
- C:\Windows\System\eGupdWo.exe
  C:\Windows\System\eGupdWo.exe
  2⤵
  PID:8768
- C:\Windows\System\MSVCBnO.exe
  C:\Windows\System\MSVCBnO.exe
  2⤵
  PID:8792
- C:\Windows\System\SEPKOMj.exe
  C:\Windows\System\SEPKOMj.exe
  2⤵
  PID:8812
- C:\Windows\System\sbPTJYU.exe
  C:\Windows\System\sbPTJYU.exe
  2⤵
  PID:8840
- C:\Windows\System\FJZfTMH.exe
  C:\Windows\System\FJZfTMH.exe
  2⤵
  PID:8860
- C:\Windows\System\GAWAOAf.exe
  C:\Windows\System\GAWAOAf.exe
  2⤵
  PID:8880
- C:\Windows\System\SJfJNaO.exe
  C:\Windows\System\SJfJNaO.exe
  2⤵
  PID:8908
- C:\Windows\System\DxRmXJn.exe
  C:\Windows\System\DxRmXJn.exe
  2⤵
  PID:8928
- C:\Windows\System\VJFQBXF.exe
  C:\Windows\System\VJFQBXF.exe
  2⤵
  PID:8956
- C:\Windows\System\vrYupWV.exe
  C:\Windows\System\vrYupWV.exe
  2⤵
  PID:8976
- C:\Windows\System\dBWKDVk.exe
  C:\Windows\System\dBWKDVk.exe
  2⤵
  PID:9004
- C:\Windows\System\tEIfGdh.exe
  C:\Windows\System\tEIfGdh.exe
  2⤵
  PID:9024
- C:\Windows\System\HpzaDjH.exe
  C:\Windows\System\HpzaDjH.exe
  2⤵
  PID:9044
- C:\Windows\System\VBRNHYo.exe
  C:\Windows\System\VBRNHYo.exe
  2⤵
  PID:9076
- C:\Windows\System\YPoBtLH.exe
  C:\Windows\System\YPoBtLH.exe
  2⤵
  PID:9100
- C:\Windows\System\dPrMdTF.exe
  C:\Windows\System\dPrMdTF.exe
  2⤵
  PID:9120
- C:\Windows\System\HXHugeo.exe
  C:\Windows\System\HXHugeo.exe
  2⤵
  PID:9140
- C:\Windows\System\mwfEZnR.exe
  C:\Windows\System\mwfEZnR.exe
  2⤵
  PID:9160
- C:\Windows\System\VHJkwiW.exe
  C:\Windows\System\VHJkwiW.exe
  2⤵
  PID:9184
- C:\Windows\System\xbkKzLI.exe
  C:\Windows\System\xbkKzLI.exe
  2⤵
  PID:9208
- C:\Windows\System\RIdWYGo.exe
  C:\Windows\System\RIdWYGo.exe
  2⤵
  PID:8172
- C:\Windows\System\TtAUmSp.exe
  C:\Windows\System\TtAUmSp.exe
  2⤵
  PID:7240
- C:\Windows\System\MnLIJiD.exe
  C:\Windows\System\MnLIJiD.exe
  2⤵
  PID:7908
- C:\Windows\System\czMmrlX.exe
  C:\Windows\System\czMmrlX.exe
  2⤵
  PID:7836
- C:\Windows\System\svwscQW.exe
  C:\Windows\System\svwscQW.exe
  2⤵
  PID:3064
- C:\Windows\System\AHfUHhV.exe
  C:\Windows\System\AHfUHhV.exe
  2⤵
  PID:8112
- C:\Windows\System\YJLLqDI.exe
  C:\Windows\System\YJLLqDI.exe
  2⤵
  PID:7948
- C:\Windows\System\pnbRZNs.exe
  C:\Windows\System\pnbRZNs.exe
  2⤵
  PID:8236
- C:\Windows\System\SCXUvAt.exe
  C:\Windows\System\SCXUvAt.exe
  2⤵
  PID:8296
- C:\Windows\System\HnMxvul.exe
  C:\Windows\System\HnMxvul.exe
  2⤵
  PID:6776
- C:\Windows\System\ehrHJps.exe
  C:\Windows\System\ehrHJps.exe
  2⤵
  PID:3256
- C:\Windows\System\toCvbqP.exe
  C:\Windows\System\toCvbqP.exe
  2⤵
  PID:7876
- C:\Windows\System\lXhLcbF.exe
  C:\Windows\System\lXhLcbF.exe
  2⤵
  PID:3616
- C:\Windows\System\oGCjpXw.exe
  C:\Windows\System\oGCjpXw.exe
  2⤵
  PID:8552
- C:\Windows\System\eyomzzv.exe
  C:\Windows\System\eyomzzv.exe
  2⤵
  PID:9224
- C:\Windows\System\fgpuaIA.exe
  C:\Windows\System\fgpuaIA.exe
  2⤵
  PID:9240
- C:\Windows\System\EBVnqKA.exe
  C:\Windows\System\EBVnqKA.exe
  2⤵
  PID:9256
- C:\Windows\System\rMJIEhp.exe
  C:\Windows\System\rMJIEhp.exe
  2⤵
  PID:9272
- C:\Windows\System\JFFXBEk.exe
  C:\Windows\System\JFFXBEk.exe
  2⤵
  PID:9288
- C:\Windows\System\qMUjLWn.exe
  C:\Windows\System\qMUjLWn.exe
  2⤵
  PID:9304
- C:\Windows\System\EOshloD.exe
  C:\Windows\System\EOshloD.exe
  2⤵
  PID:9324
- C:\Windows\System\sdUpOjR.exe
  C:\Windows\System\sdUpOjR.exe
  2⤵
  PID:9344
- C:\Windows\System\RHhrhMU.exe
  C:\Windows\System\RHhrhMU.exe
  2⤵
  PID:9360
- C:\Windows\System\KjDRDgA.exe
  C:\Windows\System\KjDRDgA.exe
  2⤵
  PID:9376
- C:\Windows\System\LiIXCQO.exe
  C:\Windows\System\LiIXCQO.exe
  2⤵
  PID:9392
- C:\Windows\System\PbkfXPM.exe
  C:\Windows\System\PbkfXPM.exe
  2⤵
  PID:9408
- C:\Windows\System\dNMwbuA.exe
  C:\Windows\System\dNMwbuA.exe
  2⤵
  PID:9424
- C:\Windows\System\nePErvj.exe
  C:\Windows\System\nePErvj.exe
  2⤵
  PID:9440
- C:\Windows\System\tBKOcgJ.exe
  C:\Windows\System\tBKOcgJ.exe
  2⤵
  PID:9456
- C:\Windows\System\Qddmhlk.exe
  C:\Windows\System\Qddmhlk.exe
  2⤵
  PID:9476
- C:\Windows\System\clajFie.exe
  C:\Windows\System\clajFie.exe
  2⤵
  PID:9500
- C:\Windows\System\ZOZpwyz.exe
  C:\Windows\System\ZOZpwyz.exe
  2⤵
  PID:9544
- C:\Windows\System\yWFxbnm.exe
  C:\Windows\System\yWFxbnm.exe
  2⤵
  PID:9560
- C:\Windows\System\oytmXpM.exe
  C:\Windows\System\oytmXpM.exe
  2⤵
  PID:9588
- C:\Windows\System\CpmorMI.exe
  C:\Windows\System\CpmorMI.exe
  2⤵
  PID:9612
- C:\Windows\System\DgyrKCf.exe
  C:\Windows\System\DgyrKCf.exe
  2⤵
  PID:9632
- C:\Windows\System\NSBowUr.exe
  C:\Windows\System\NSBowUr.exe
  2⤵
  PID:9652
- C:\Windows\System\eymXnAu.exe
  C:\Windows\System\eymXnAu.exe
  2⤵
  PID:9672
- C:\Windows\System\BUkfqwO.exe
  C:\Windows\System\BUkfqwO.exe
  2⤵
  PID:9692
- C:\Windows\System\PDqiTrj.exe
  C:\Windows\System\PDqiTrj.exe
  2⤵
  PID:9716
- C:\Windows\System\CtePnYu.exe
  C:\Windows\System\CtePnYu.exe
  2⤵
  PID:9736
- C:\Windows\System\agBdOmr.exe
  C:\Windows\System\agBdOmr.exe
  2⤵
  PID:9752
- C:\Windows\System\CflnByv.exe
  C:\Windows\System\CflnByv.exe
  2⤵
  PID:9772
- C:\Windows\System\gcdksoA.exe
  C:\Windows\System\gcdksoA.exe
  2⤵
  PID:9796
- C:\Windows\System\gMmpoBo.exe
  C:\Windows\System\gMmpoBo.exe
  2⤵
  PID:9824
- C:\Windows\System\pBWrnsp.exe
  C:\Windows\System\pBWrnsp.exe
  2⤵
  PID:9844
- C:\Windows\System\BiNteGn.exe
  C:\Windows\System\BiNteGn.exe
  2⤵
  PID:9864
- C:\Windows\System\YTIAhph.exe
  C:\Windows\System\YTIAhph.exe
  2⤵
  PID:9892
- C:\Windows\System\KVhEXnN.exe
  C:\Windows\System\KVhEXnN.exe
  2⤵
  PID:9908
- C:\Windows\System\mAoKljX.exe
  C:\Windows\System\mAoKljX.exe
  2⤵
  PID:9932
- C:\Windows\System\HeLGmOg.exe
  C:\Windows\System\HeLGmOg.exe
  2⤵
  PID:9952
- C:\Windows\System\hArHGuM.exe
  C:\Windows\System\hArHGuM.exe
  2⤵
  PID:9976
- C:\Windows\System\iyfEdbn.exe
  C:\Windows\System\iyfEdbn.exe
  2⤵
  PID:9996
- C:\Windows\System\QXrnqSO.exe
  C:\Windows\System\QXrnqSO.exe
  2⤵
  PID:10016
- C:\Windows\System\xLEKOAF.exe
  C:\Windows\System\xLEKOAF.exe
  2⤵
  PID:10032
- C:\Windows\System\OHNkCnu.exe
  C:\Windows\System\OHNkCnu.exe
  2⤵
  PID:10056
- C:\Windows\System\JJsbSrQ.exe
  C:\Windows\System\JJsbSrQ.exe
  2⤵
  PID:10076
- C:\Windows\System\AJRajoR.exe
  C:\Windows\System\AJRajoR.exe
  2⤵
  PID:10096
- C:\Windows\System\yRpVZBI.exe
  C:\Windows\System\yRpVZBI.exe
  2⤵
  PID:10124
- C:\Windows\System\ZuUrZGV.exe
  C:\Windows\System\ZuUrZGV.exe
  2⤵
  PID:10144
- C:\Windows\System\kUcUveJ.exe
  C:\Windows\System\kUcUveJ.exe
  2⤵
  PID:10164
- C:\Windows\System\mgMOdXF.exe
  C:\Windows\System\mgMOdXF.exe
  2⤵
  PID:10188
- C:\Windows\System\YHIunMk.exe
  C:\Windows\System\YHIunMk.exe
  2⤵
  PID:10216
- C:\Windows\System\PcZtiXF.exe
  C:\Windows\System\PcZtiXF.exe
  2⤵
  PID:10232
- C:\Windows\System\MOHHDtO.exe
  C:\Windows\System\MOHHDtO.exe
  2⤵
  PID:8064
- C:\Windows\System\bFEZtzf.exe
  C:\Windows\System\bFEZtzf.exe
  2⤵
  PID:8756
- C:\Windows\System\WFYowDc.exe
  C:\Windows\System\WFYowDc.exe
  2⤵
  PID:8856
- C:\Windows\System\IxiTqVR.exe
  C:\Windows\System\IxiTqVR.exe
  2⤵
  PID:7596
- C:\Windows\System\HClknLH.exe
  C:\Windows\System\HClknLH.exe
  2⤵
  PID:8900
- C:\Windows\System\ZovysTg.exe
  C:\Windows\System\ZovysTg.exe
  2⤵
  PID:8984
- C:\Windows\System\snTTJEX.exe
  C:\Windows\System\snTTJEX.exe
  2⤵
  PID:9016
- C:\Windows\System\sfrimGc.exe
  C:\Windows\System\sfrimGc.exe
  2⤵
  PID:8204
- C:\Windows\System\NgaHrFo.exe
  C:\Windows\System\NgaHrFo.exe
  2⤵
  PID:8256
- C:\Windows\System\jDCzMuB.exe
  C:\Windows\System\jDCzMuB.exe
  2⤵
  PID:9112
- C:\Windows\System\uCTXUhc.exe
  C:\Windows\System\uCTXUhc.exe
  2⤵
  PID:540
- C:\Windows\System\cGKKKHY.exe
  C:\Windows\System\cGKKKHY.exe
  2⤵
  PID:8520
- C:\Windows\System\bMYKYuN.exe
  C:\Windows\System\bMYKYuN.exe
  2⤵
  PID:8532
- C:\Windows\System\nfJTSHW.exe
  C:\Windows\System\nfJTSHW.exe
  2⤵
  PID:9252
- C:\Windows\System\pvOhLxb.exe
  C:\Windows\System\pvOhLxb.exe
  2⤵
  PID:8620
- C:\Windows\System\RovNNzv.exe
  C:\Windows\System\RovNNzv.exe
  2⤵
  PID:9296
- C:\Windows\System\DxQmQqr.exe
  C:\Windows\System\DxQmQqr.exe
  2⤵
  PID:8644
- C:\Windows\System\RBsqaCf.exe
  C:\Windows\System\RBsqaCf.exe
  2⤵
  PID:9384
- C:\Windows\System\NIeLLHt.exe
  C:\Windows\System\NIeLLHt.exe
  2⤵
  PID:9404
- C:\Windows\System\LJgfCeb.exe
  C:\Windows\System\LJgfCeb.exe
  2⤵
  PID:8676
- C:\Windows\System\bZetgKv.exe
  C:\Windows\System\bZetgKv.exe
  2⤵
  PID:9468
- C:\Windows\System\zpaONPs.exe
  C:\Windows\System\zpaONPs.exe
  2⤵
  PID:9520
- C:\Windows\System\MWcsjBb.exe
  C:\Windows\System\MWcsjBb.exe
  2⤵
  PID:8760
- C:\Windows\System\JhfNQGF.exe
  C:\Windows\System\JhfNQGF.exe
  2⤵
  PID:10256
- C:\Windows\System\FUTuGHJ.exe
  C:\Windows\System\FUTuGHJ.exe
  2⤵
  PID:10276
- C:\Windows\System\aOvQQzp.exe
  C:\Windows\System\aOvQQzp.exe
  2⤵
  PID:10292
- C:\Windows\System\MHthRxN.exe
  C:\Windows\System\MHthRxN.exe
  2⤵
  PID:10312
- C:\Windows\System\hdxfuHR.exe
  C:\Windows\System\hdxfuHR.exe
  2⤵
  PID:10340
- C:\Windows\System\isNswUS.exe
  C:\Windows\System\isNswUS.exe
  2⤵
  PID:10364
- C:\Windows\System\LXHbakL.exe
  C:\Windows\System\LXHbakL.exe
  2⤵
  PID:10396
- C:\Windows\System\PFUFOFb.exe
  C:\Windows\System\PFUFOFb.exe
  2⤵
  PID:10416
- C:\Windows\System\mfPROwm.exe
  C:\Windows\System\mfPROwm.exe
  2⤵
  PID:10432
- C:\Windows\System\OJfDwMU.exe
  C:\Windows\System\OJfDwMU.exe
  2⤵
  PID:10456
- C:\Windows\System\jrCdqJE.exe
  C:\Windows\System\jrCdqJE.exe
  2⤵
  PID:10484
- C:\Windows\System\DtNvifr.exe
  C:\Windows\System\DtNvifr.exe
  2⤵
  PID:10504
- C:\Windows\System\btmmNJr.exe
  C:\Windows\System\btmmNJr.exe
  2⤵
  PID:10528
- C:\Windows\System\mezGeCj.exe
  C:\Windows\System\mezGeCj.exe
  2⤵
  PID:10552
- C:\Windows\System\gvmGuXx.exe
  C:\Windows\System\gvmGuXx.exe
  2⤵
  PID:10580
- C:\Windows\System\ozQcFru.exe
  C:\Windows\System\ozQcFru.exe
  2⤵
  PID:10600
- C:\Windows\System\CGxLyLL.exe
  C:\Windows\System\CGxLyLL.exe
  2⤵
  PID:10616
- C:\Windows\System\wVHlcwf.exe
  C:\Windows\System\wVHlcwf.exe
  2⤵
  PID:10648
- C:\Windows\System\DLCuRhD.exe
  C:\Windows\System\DLCuRhD.exe
  2⤵
  PID:10664
- C:\Windows\System\nQBveek.exe
  C:\Windows\System\nQBveek.exe
  2⤵
  PID:10692
- C:\Windows\System\caiDFaV.exe
  C:\Windows\System\caiDFaV.exe
  2⤵
  PID:10712
- C:\Windows\System\WQAcpww.exe
  C:\Windows\System\WQAcpww.exe
  2⤵
  PID:10736
- C:\Windows\System\YYfCswO.exe
  C:\Windows\System\YYfCswO.exe
  2⤵
  PID:10756
- C:\Windows\System\kWGrXDs.exe
  C:\Windows\System\kWGrXDs.exe
  2⤵
  PID:10780
- C:\Windows\System\GgbgEVW.exe
  C:\Windows\System\GgbgEVW.exe
  2⤵
  PID:10800
- C:\Windows\System\msrDMPF.exe
  C:\Windows\System\msrDMPF.exe
  2⤵
  PID:10816
- C:\Windows\System\DCYunLz.exe
  C:\Windows\System\DCYunLz.exe
  2⤵
  PID:10836
- C:\Windows\System\TPedwbo.exe
  C:\Windows\System\TPedwbo.exe
  2⤵
  PID:10860
- C:\Windows\System\xeNVDKz.exe
  C:\Windows\System\xeNVDKz.exe
  2⤵
  PID:10884
- C:\Windows\System\kOOCHDU.exe
  C:\Windows\System\kOOCHDU.exe
  2⤵
  PID:10904
- C:\Windows\System\Zrhhffd.exe
  C:\Windows\System\Zrhhffd.exe
  2⤵
  PID:10920
- C:\Windows\System\uksBwTx.exe
  C:\Windows\System\uksBwTx.exe
  2⤵
  PID:10940
- C:\Windows\System\BwYwMBP.exe
  C:\Windows\System\BwYwMBP.exe
  2⤵
  PID:10956
- C:\Windows\System\aBNFDpe.exe
  C:\Windows\System\aBNFDpe.exe
  2⤵
  PID:10980
- C:\Windows\System\MuzqeMD.exe
  C:\Windows\System\MuzqeMD.exe
  2⤵
  PID:10996
- C:\Windows\System\DKuqHlm.exe
  C:\Windows\System\DKuqHlm.exe
  2⤵
  PID:11024
- C:\Windows\System\sVmYCzU.exe
  C:\Windows\System\sVmYCzU.exe
  2⤵
  PID:11052
- C:\Windows\System\OyCtweK.exe
  C:\Windows\System\OyCtweK.exe
  2⤵
  PID:11072
- C:\Windows\System\rHYRCBy.exe
  C:\Windows\System\rHYRCBy.exe
  2⤵
  PID:11092
- C:\Windows\System\CGdjJbN.exe
  C:\Windows\System\CGdjJbN.exe
  2⤵
  PID:11116
- C:\Windows\System\zfHbfQi.exe
  C:\Windows\System\zfHbfQi.exe
  2⤵
  PID:11156
- C:\Windows\System\xNRFiTR.exe
  C:\Windows\System\xNRFiTR.exe
  2⤵
  PID:11172
- C:\Windows\System\QiihIVJ.exe
  C:\Windows\System\QiihIVJ.exe
  2⤵
  PID:11192
- C:\Windows\System\ykpJDxm.exe
  C:\Windows\System\ykpJDxm.exe
  2⤵
  PID:11212
- C:\Windows\System\TwQNiDZ.exe
  C:\Windows\System\TwQNiDZ.exe
  2⤵
  PID:11232
- C:\Windows\System\unINMUN.exe
  C:\Windows\System\unINMUN.exe
  2⤵
  PID:11256
- C:\Windows\System\FVGRtkp.exe
  C:\Windows\System\FVGRtkp.exe
  2⤵
  PID:9620
- C:\Windows\System\BPFpjtR.exe
  C:\Windows\System\BPFpjtR.exe
  2⤵
  PID:9668
- C:\Windows\System\YJQzirw.exe
  C:\Windows\System\YJQzirw.exe
  2⤵
  PID:9768
- C:\Windows\System\HfRLpYA.exe
  C:\Windows\System\HfRLpYA.exe
  2⤵
  PID:9860
- C:\Windows\System\oRizlNy.exe
  C:\Windows\System\oRizlNy.exe
  2⤵
  PID:9900
- C:\Windows\System\ESDcHmB.exe
  C:\Windows\System\ESDcHmB.exe
  2⤵
  PID:9924
- C:\Windows\System\gcPKJym.exe
  C:\Windows\System\gcPKJym.exe
  2⤵
  PID:9992
- C:\Windows\System\avsdXdB.exe
  C:\Windows\System\avsdXdB.exe
  2⤵
  PID:10024
- C:\Windows\System\KlzNdJG.exe
  C:\Windows\System\KlzNdJG.exe
  2⤵
  PID:8280
- C:\Windows\System\ZPlLaqH.exe
  C:\Windows\System\ZPlLaqH.exe
  2⤵
  PID:8336
- C:\Windows\System\JSfqTtK.exe
  C:\Windows\System\JSfqTtK.exe
  2⤵
  PID:8376
- C:\Windows\System\gszRIfA.exe
  C:\Windows\System\gszRIfA.exe
  2⤵
  PID:8400
- C:\Windows\System\chBsXAg.exe
  C:\Windows\System\chBsXAg.exe
  2⤵
  PID:8472
- C:\Windows\System\IzTwBIo.exe
  C:\Windows\System\IzTwBIo.exe
  2⤵
  PID:8592
- C:\Windows\System\PlAMjFZ.exe
  C:\Windows\System\PlAMjFZ.exe
  2⤵
  PID:8628
- C:\Windows\System\vRWxasS.exe
  C:\Windows\System\vRWxasS.exe
  2⤵
  PID:9420
- C:\Windows\System\lSYQwJP.exe
  C:\Windows\System\lSYQwJP.exe
  2⤵
  PID:8692
- C:\Windows\System\jUFIUyl.exe
  C:\Windows\System\jUFIUyl.exe
  2⤵
  PID:9284
- C:\Windows\System\PdQBbsJ.exe
  C:\Windows\System\PdQBbsJ.exe
  2⤵
  PID:9400
- C:\Windows\System\VuGWaNu.exe
  C:\Windows\System\VuGWaNu.exe
  2⤵
  PID:9492
- C:\Windows\System\yHTfAsS.exe
  C:\Windows\System\yHTfAsS.exe
  2⤵
  PID:10264
- C:\Windows\System\GsNDRis.exe
  C:\Windows\System\GsNDRis.exe
  2⤵
  PID:8848
- C:\Windows\System\iEukWNc.exe
  C:\Windows\System\iEukWNc.exe
  2⤵
  PID:10388
- C:\Windows\System\wuqBuIi.exe
  C:\Windows\System\wuqBuIi.exe
  2⤵
  PID:8888
- C:\Windows\System\cIGwzlH.exe
  C:\Windows\System\cIGwzlH.exe
  2⤵
  PID:9712
- C:\Windows\System\yLnWJkM.exe
  C:\Windows\System\yLnWJkM.exe
  2⤵
  PID:9732
- C:\Windows\System\ovylWjt.exe
  C:\Windows\System\ovylWjt.exe
  2⤵
  PID:10516
- C:\Windows\System\pjtlBjd.exe
  C:\Windows\System\pjtlBjd.exe
  2⤵
  PID:11272
- C:\Windows\System\KeAbvMM.exe
  C:\Windows\System\KeAbvMM.exe
  2⤵
  PID:11296
- C:\Windows\System\rqMCVwo.exe
  C:\Windows\System\rqMCVwo.exe
  2⤵
  PID:11316
- C:\Windows\System\WOGjZTa.exe
  C:\Windows\System\WOGjZTa.exe
  2⤵
  PID:11340
- C:\Windows\System\ccmALgK.exe
  C:\Windows\System\ccmALgK.exe
  2⤵
  PID:11368
- C:\Windows\System\JAoCZNm.exe
  C:\Windows\System\JAoCZNm.exe
  2⤵
  PID:11392
- C:\Windows\System\UUncfiS.exe
  C:\Windows\System\UUncfiS.exe
  2⤵
  PID:11416
- C:\Windows\System\uzRrvgL.exe
  C:\Windows\System\uzRrvgL.exe
  2⤵
  PID:11436
- C:\Windows\System\ZRLLaWr.exe
  C:\Windows\System\ZRLLaWr.exe
  2⤵
  PID:11456
- C:\Windows\System\IcRCThI.exe
  C:\Windows\System\IcRCThI.exe
  2⤵
  PID:11480
- C:\Windows\System\ztIEfYG.exe
  C:\Windows\System\ztIEfYG.exe
  2⤵
  PID:11504
- C:\Windows\System\uEibmOo.exe
  C:\Windows\System\uEibmOo.exe
  2⤵
  PID:11520
- C:\Windows\System\dSTlpAn.exe
  C:\Windows\System\dSTlpAn.exe
  2⤵
  PID:11540
- C:\Windows\System\FUzunhl.exe
  C:\Windows\System\FUzunhl.exe
  2⤵
  PID:11564
- C:\Windows\System\pVIJMVH.exe
  C:\Windows\System\pVIJMVH.exe
  2⤵
  PID:11584
- C:\Windows\System\bHPPVeO.exe
  C:\Windows\System\bHPPVeO.exe
  2⤵
  PID:11612
- C:\Windows\System\pIKvuWz.exe
  C:\Windows\System\pIKvuWz.exe
  2⤵
  PID:11636
- C:\Windows\System\JeGVrWi.exe
  C:\Windows\System\JeGVrWi.exe
  2⤵
  PID:11652
- C:\Windows\System\Vcwwabe.exe
  C:\Windows\System\Vcwwabe.exe
  2⤵
  PID:11680
- C:\Windows\System\ghvYQYc.exe
  C:\Windows\System\ghvYQYc.exe
  2⤵
  PID:11700
- C:\Windows\System\JHiUgXx.exe
  C:\Windows\System\JHiUgXx.exe
  2⤵
  PID:11720
- C:\Windows\System\jQLctOm.exe
  C:\Windows\System\jQLctOm.exe
  2⤵
  PID:11744
- C:\Windows\System\smWSoSR.exe
  C:\Windows\System\smWSoSR.exe
  2⤵
  PID:11760
- C:\Windows\System\oXwHpvw.exe
  C:\Windows\System\oXwHpvw.exe
  2⤵
  PID:11776
- C:\Windows\System\iytjwCC.exe
  C:\Windows\System\iytjwCC.exe
  2⤵
  PID:11796
- C:\Windows\System\oemFfNM.exe
  C:\Windows\System\oemFfNM.exe
  2⤵
  PID:11812
- C:\Windows\System\mcahcfl.exe
  C:\Windows\System\mcahcfl.exe
  2⤵
  PID:11828
- C:\Windows\System\uovVoKw.exe
  C:\Windows\System\uovVoKw.exe
  2⤵
  PID:11848
- C:\Windows\System\IjBSQTe.exe
  C:\Windows\System\IjBSQTe.exe
  2⤵
  PID:11872
- C:\Windows\System\IewlwUJ.exe
  C:\Windows\System\IewlwUJ.exe
  2⤵
  PID:11892
- C:\Windows\System\SfPwVmK.exe
  C:\Windows\System\SfPwVmK.exe
  2⤵
  PID:11920
- C:\Windows\System\mgnbzVW.exe
  C:\Windows\System\mgnbzVW.exe
  2⤵
  PID:11936
- C:\Windows\System\yUuECUj.exe
  C:\Windows\System\yUuECUj.exe
  2⤵
  PID:11964
- C:\Windows\System\eaNlRrS.exe
  C:\Windows\System\eaNlRrS.exe
  2⤵
  PID:11988
- C:\Windows\System\BHCHuZi.exe
  C:\Windows\System\BHCHuZi.exe
  2⤵
  PID:12004
- C:\Windows\System\xPSNSoq.exe
  C:\Windows\System\xPSNSoq.exe
  2⤵
  PID:12024
- C:\Windows\System\qCYcvUy.exe
  C:\Windows\System\qCYcvUy.exe
  2⤵
  PID:12040
- C:\Windows\System\nqRFnHP.exe
  C:\Windows\System\nqRFnHP.exe
  2⤵
  PID:12060
- C:\Windows\System\jVcfsCb.exe
  C:\Windows\System\jVcfsCb.exe
  2⤵
  PID:12080
- C:\Windows\System\gELjNcH.exe
  C:\Windows\System\gELjNcH.exe
  2⤵
  PID:12096
- C:\Windows\System\jJbEvNa.exe
  C:\Windows\System\jJbEvNa.exe
  2⤵
  PID:12116
- C:\Windows\System\xZQXgJG.exe
  C:\Windows\System\xZQXgJG.exe
  2⤵
  PID:12144
- C:\Windows\System\VXGxziw.exe
  C:\Windows\System\VXGxziw.exe
  2⤵
  PID:12164
- C:\Windows\System\ESubxPN.exe
  C:\Windows\System\ESubxPN.exe
  2⤵
  PID:12184
- C:\Windows\System\NozyQNQ.exe
  C:\Windows\System\NozyQNQ.exe
  2⤵
  PID:12204
- C:\Windows\System\rylffCL.exe
  C:\Windows\System\rylffCL.exe
  2⤵
  PID:12220
- C:\Windows\System\isWBkYf.exe
  C:\Windows\System\isWBkYf.exe
  2⤵
  PID:12244
- C:\Windows\System\dvsnDYE.exe
  C:\Windows\System\dvsnDYE.exe
  2⤵
  PID:12268
- C:\Windows\System\csdGcrr.exe
  C:\Windows\System\csdGcrr.exe
  2⤵
  PID:10636
- C:\Windows\System\kKHhviV.exe
  C:\Windows\System\kKHhviV.exe
  2⤵
  PID:10684
- C:\Windows\System\aCzWsjp.exe
  C:\Windows\System\aCzWsjp.exe
  2⤵
  PID:10768
- C:\Windows\System\KazNAaV.exe
  C:\Windows\System\KazNAaV.exe
  2⤵
  PID:10812
- C:\Windows\System\TQXMOeN.exe
  C:\Windows\System\TQXMOeN.exe
  2⤵
  PID:10856
- C:\Windows\System\RySUQVp.exe
  C:\Windows\System\RySUQVp.exe
  2⤵
  PID:10180
- C:\Windows\System\bjgrzsv.exe
  C:\Windows\System\bjgrzsv.exe
  2⤵
  PID:10964
- C:\Windows\System\nLLwJaW.exe
  C:\Windows\System\nLLwJaW.exe
  2⤵
  PID:11012
- C:\Windows\System\ghMoTtV.exe
  C:\Windows\System\ghMoTtV.exe
  2⤵
  PID:6484
- C:\Windows\System\OFteXIn.exe
  C:\Windows\System\OFteXIn.exe
  2⤵
  PID:8140
- C:\Windows\System\muVyBVF.exe
  C:\Windows\System\muVyBVF.exe
  2⤵
  PID:11124
- C:\Windows\System\lnDbaet.exe
  C:\Windows\System\lnDbaet.exe
  2⤵
  PID:8440
- C:\Windows\System\uhQZDxe.exe
  C:\Windows\System\uhQZDxe.exe
  2⤵
  PID:9340
- C:\Windows\System\HyDbRwh.exe
  C:\Windows\System\HyDbRwh.exe
  2⤵
  PID:11220
- C:\Windows\System\SDMiOHl.exe
  C:\Windows\System\SDMiOHl.exe
  2⤵
  PID:8216
- C:\Windows\System\CxDbKGP.exe
  C:\Windows\System\CxDbKGP.exe
  2⤵
  PID:12312
- C:\Windows\System\bKuRjAv.exe
  C:\Windows\System\bKuRjAv.exe
  2⤵
  PID:12340
- C:\Windows\System\CbYHnkX.exe
  C:\Windows\System\CbYHnkX.exe
  2⤵
  PID:12360
- C:\Windows\System\lPjfVcr.exe
  C:\Windows\System\lPjfVcr.exe
  2⤵
  PID:12380
- C:\Windows\System\PztNZym.exe
  C:\Windows\System\PztNZym.exe
  2⤵
  PID:12400
- C:\Windows\System\CgjNOuE.exe
  C:\Windows\System\CgjNOuE.exe
  2⤵
  PID:12420
- C:\Windows\System\JWLGVFZ.exe
  C:\Windows\System\JWLGVFZ.exe
  2⤵
  PID:12444
- C:\Windows\System\MDjfHBS.exe
  C:\Windows\System\MDjfHBS.exe
  2⤵
  PID:12460
- C:\Windows\System\jSaDftu.exe
  C:\Windows\System\jSaDftu.exe
  2⤵
  PID:12480
- C:\Windows\System\tCXHQTs.exe
  C:\Windows\System\tCXHQTs.exe
  2⤵
  PID:12504
- C:\Windows\System\lImSrcj.exe
  C:\Windows\System\lImSrcj.exe
  2⤵
  PID:12528
- C:\Windows\System\xdLjmxO.exe
  C:\Windows\System\xdLjmxO.exe
  2⤵
  PID:12552
- C:\Windows\System\AqOvauy.exe
  C:\Windows\System\AqOvauy.exe
  2⤵
  PID:10068
- C:\Windows\System\wcbgyoK.exe
  C:\Windows\System\wcbgyoK.exe
  2⤵
  PID:1092
- C:\Windows\System\wPsZMwL.exe
  C:\Windows\System\wPsZMwL.exe
  2⤵
  PID:12232
- C:\Windows\System\xFIPOvj.exe
  C:\Windows\System\xFIPOvj.exe
  2⤵
  PID:10844
- C:\Windows\System\RdJmhKb.exe
  C:\Windows\System\RdJmhKb.exe
  2⤵
  PID:10988
- C:\Windows\System\SrTtopk.exe
  C:\Windows\System\SrTtopk.exe
  2⤵
  PID:11184
- C:\Windows\System\fMakRvj.exe
  C:\Windows\System\fMakRvj.exe
  2⤵
  PID:12308
- C:\Windows\System\lnKBHuG.exe
  C:\Windows\System\lnKBHuG.exe
  2⤵
  PID:12356
- C:\Windows\System\TBqWjUU.exe
  C:\Windows\System\TBqWjUU.exe
  2⤵
  PID:12436
- C:\Windows\System\IJGtjFJ.exe
  C:\Windows\System\IJGtjFJ.exe
  2⤵
  PID:12500
- C:\Windows\System\eXWTRiW.exe
  C:\Windows\System\eXWTRiW.exe
  2⤵
  PID:12536
- C:\Windows\System\hXJsEBF.exe
  C:\Windows\System\hXJsEBF.exe
  2⤵
  PID:12628
- C:\Windows\System\VUenLbJ.exe
  C:\Windows\System\VUenLbJ.exe
  2⤵
  PID:12848
- C:\Windows\System\MHZAZJC.exe
  C:\Windows\System\MHZAZJC.exe
  2⤵
  PID:13012
- C:\Windows\System\tcBBDLU.exe
  C:\Windows\System\tcBBDLU.exe
  2⤵
  PID:12636
- C:\Windows\System\hWRQXtP.exe
  C:\Windows\System\hWRQXtP.exe
  2⤵
  PID:12596
- C:\Windows\System\SdckVPk.exe
  C:\Windows\System\SdckVPk.exe
  2⤵
  PID:12572
- C:\Windows\System\JLfAQaq.exe
  C:\Windows\System\JLfAQaq.exe
  2⤵
  PID:12496
- C:\Windows\System\hLekLik.exe
  C:\Windows\System\hLekLik.exe
  2⤵
  PID:12392
- C:\Windows\System\kAhpCin.exe
  C:\Windows\System\kAhpCin.exe
  2⤵
  PID:12304
- C:\Windows\System\ZcmvnJT.exe
  C:\Windows\System\ZcmvnJT.exe
  2⤵
  PID:8736
- C:\Windows\System\xbwDLPS.exe
  C:\Windows\System\xbwDLPS.exe
  2⤵
  PID:10832
- C:\Windows\System\KTkrjOH.exe
  C:\Windows\System\KTkrjOH.exe
  2⤵
  PID:12228
- C:\Windows\System\xDwiLax.exe
  C:\Windows\System\xDwiLax.exe
  2⤵
  PID:13056
- C:\Windows\System\jfDyjwi.exe
  C:\Windows\System\jfDyjwi.exe
  2⤵
  PID:13192
- C:\Windows\System\yuXlcqM.exe
  C:\Windows\System\yuXlcqM.exe
  2⤵
  PID:13036
- C:\Windows\System\ivYntBr.exe
  C:\Windows\System\ivYntBr.exe
  2⤵
  PID:13176
- C:\Windows\System\rdhQPtq.exe
  C:\Windows\System\rdhQPtq.exe
  2⤵
  PID:312
- C:\Windows\System\vXOgvAj.exe
  C:\Windows\System\vXOgvAj.exe
  2⤵
  PID:13272
- C:\Windows\System\gXBIqGW.exe
  C:\Windows\System\gXBIqGW.exe
  2⤵
  PID:10088
- C:\Windows\System\ZMckozR.exe
  C:\Windows\System\ZMckozR.exe
  2⤵
  PID:9556
- C:\Windows\System\ZsuMUBp.exe
  C:\Windows\System\ZsuMUBp.exe
  2⤵
  PID:13240
- C:\Windows\System\miOiZQe.exe
  C:\Windows\System\miOiZQe.exe
  2⤵
  PID:9788
- C:\Windows\System\NdqzTJF.exe
  C:\Windows\System\NdqzTJF.exe
  2⤵
  PID:9600
- C:\Windows\System\rJgxSno.exe
  C:\Windows\System\rJgxSno.exe
  2⤵
  PID:12780
- C:\Windows\System\LPMukVh.exe
  C:\Windows\System\LPMukVh.exe
  2⤵
  PID:11132
- C:\Windows\System\wILnYjp.exe
  C:\Windows\System\wILnYjp.exe
  2⤵
  PID:10196
- C:\Windows\System\HPyZmsp.exe
  C:\Windows\System\HPyZmsp.exe
  2⤵
  PID:9576
- C:\Windows\System\UHrayYS.exe
  C:\Windows\System\UHrayYS.exe
  2⤵
  PID:9836
- C:\Windows\System\XFBVEvT.exe
  C:\Windows\System\XFBVEvT.exe
  2⤵
  PID:9660
- C:\Windows\System\xmiRzpm.exe
  C:\Windows\System\xmiRzpm.exe
  2⤵
  PID:9960
- C:\Windows\System\oLEJAHg.exe
  C:\Windows\System\oLEJAHg.exe
  2⤵
  PID:9432
- C:\Windows\System\dMOQoJl.exe
  C:\Windows\System\dMOQoJl.exe
  2⤵
  PID:8652
- C:\Windows\System\mhPVGsl.exe
  C:\Windows\System\mhPVGsl.exe
  2⤵
  PID:8548
- C:\Windows\System\RsLCPky.exe
  C:\Windows\System\RsLCPky.exe
  2⤵
  PID:13256
- C:\Windows\System\xdAqtgZ.exe
  C:\Windows\System\xdAqtgZ.exe
  2⤵
  PID:11804
- C:\Windows\System\hsuuBZI.exe
  C:\Windows\System\hsuuBZI.exe
  2⤵
  PID:11996
- C:\Windows\System\KWPjoAy.exe
  C:\Windows\System\KWPjoAy.exe
  2⤵
  PID:5016
- C:\Windows\System\VoiTLJp.exe
  C:\Windows\System\VoiTLJp.exe
  2⤵
  PID:9220
- C:\Windows\System\RSQrcDB.exe
  C:\Windows\System\RSQrcDB.exe
  2⤵
  PID:11472
- C:\Windows\System\DATUqis.exe
  C:\Windows\System\DATUqis.exe
  2⤵
  PID:3448
- C:\Windows\System\SGuPBHa.exe
  C:\Windows\System\SGuPBHa.exe
  2⤵
  PID:12588
- C:\Windows\System\AOVdkGu.exe
  C:\Windows\System\AOVdkGu.exe
  2⤵
  PID:11068
- C:\Windows\System\YytXTkD.exe
  C:\Windows\System\YytXTkD.exe
  2⤵
  PID:8996
- C:\Windows\System\NUBbncz.exe
  C:\Windows\System\NUBbncz.exe
  2⤵
  PID:10428
- C:\Windows\System\ryzORRm.exe
  C:\Windows\System\ryzORRm.exe
  2⤵
  PID:6800
- C:\Windows\System\gRhhxKV.exe
  C:\Windows\System\gRhhxKV.exe
  2⤵
  PID:13024
- C:\Windows\System\fNfouwG.exe
  C:\Windows\System\fNfouwG.exe
  2⤵
  PID:11956
- C:\Windows\System\ODWPIKv.exe
  C:\Windows\System\ODWPIKv.exe
  2⤵
  PID:12396
- C:\Windows\System\OFqOwCm.exe
  C:\Windows\System\OFqOwCm.exe
  2⤵
  PID:11788
- C:\Windows\System\rCjctIQ.exe
  C:\Windows\System\rCjctIQ.exe
  2⤵
  PID:12428
- C:\Windows\System\FfQpDbo.exe
  C:\Windows\System\FfQpDbo.exe
  2⤵
  PID:10492
- C:\Windows\System\pJIRjGS.exe
  C:\Windows\System\pJIRjGS.exe
  2⤵
  PID:4480
- C:\Windows\System\yAlclEt.exe
  C:\Windows\System\yAlclEt.exe
  2⤵
  PID:10744
- C:\Windows\System\xfpKLzi.exe
  C:\Windows\System\xfpKLzi.exe
  2⤵
  PID:13244
- C:\Windows\System\yncgTHV.exe
  C:\Windows\System\yncgTHV.exe
  2⤵
  PID:12796
- C:\Windows\System\ZjYzGkG.exe
  C:\Windows\System\ZjYzGkG.exe
  2⤵
  PID:10676
- C:\Windows\System\zprwpXi.exe
  C:\Windows\System\zprwpXi.exe
  2⤵
  PID:9988
- C:\Windows\System\xtTqKaF.exe
  C:\Windows\System\xtTqKaF.exe
  2⤵
  PID:12644
- C:\Windows\System\QWTFKsz.exe
  C:\Windows\System\QWTFKsz.exe
  2⤵
  PID:11536
- C:\Windows\System\cVasNDd.exe
  C:\Windows\System\cVasNDd.exe
  2⤵
  PID:10672
- C:\Windows\System\kumHNOs.exe
  C:\Windows\System\kumHNOs.exe
  2⤵
  PID:12276
- C:\Windows\System\LHkhGMr.exe
  C:\Windows\System\LHkhGMr.exe
  2⤵
  PID:12880
- C:\Windows\System\OdFjLlr.exe
  C:\Windows\System\OdFjLlr.exe
  2⤵
  PID:6768
- C:\Windows\System\jHEmbyp.exe
  C:\Windows\System\jHEmbyp.exe
  2⤵
  PID:13268
- C:\Windows\System\wAWmiMk.exe
  C:\Windows\System\wAWmiMk.exe
  2⤵
  PID:13344
- C:\Windows\System\fVOivGn.exe
  C:\Windows\System\fVOivGn.exe
  2⤵
  PID:13364
- C:\Windows\System\Lxmtolc.exe
  C:\Windows\System\Lxmtolc.exe
  2⤵
  PID:13420
- C:\Windows\System\tZJbIoE.exe
  C:\Windows\System\tZJbIoE.exe
  2⤵
  PID:13436
- C:\Windows\System\uCEYcpD.exe
  C:\Windows\System\uCEYcpD.exe
  2⤵
  PID:13452
- C:\Windows\System\qFXroEV.exe
  C:\Windows\System\qFXroEV.exe
  2⤵
  PID:13468
- C:\Windows\System\DVnNagd.exe
  C:\Windows\System\DVnNagd.exe
  2⤵
  PID:13492
- C:\Windows\System\yIHxwmh.exe
  C:\Windows\System\yIHxwmh.exe
  2⤵
  PID:13536
- C:\Windows\System\SoJsiwc.exe
  C:\Windows\System\SoJsiwc.exe
  2⤵
  PID:13556
- C:\Windows\System\cjAsdQQ.exe
  C:\Windows\System\cjAsdQQ.exe
  2⤵
  PID:13744
- C:\Windows\System\wAApchw.exe
  C:\Windows\System\wAApchw.exe
  2⤵
  PID:13824
- C:\Windows\System\gCfqyoM.exe
  C:\Windows\System\gCfqyoM.exe
  2⤵
  PID:13860
- C:\Windows\System\XHOnvgb.exe
  C:\Windows\System\XHOnvgb.exe
  2⤵
  PID:14088
- C:\Windows\System\czuAPbq.exe
  C:\Windows\System\czuAPbq.exe
  2⤵
  PID:14204
- C:\Windows\System\XAWRmIv.exe
  C:\Windows\System\XAWRmIv.exe
  2⤵
  PID:14240
- C:\Windows\System\NGHIbHl.exe
  C:\Windows\System\NGHIbHl.exe
  2⤵
  PID:14256
- C:\Windows\System\eTWqdPb.exe
  C:\Windows\System\eTWqdPb.exe
  2⤵
  PID:14272
- C:\Windows\System\SkDTBCi.exe
  C:\Windows\System\SkDTBCi.exe
  2⤵
  PID:14292
- C:\Windows\System\RZQoaCp.exe
  C:\Windows\System\RZQoaCp.exe
  2⤵
  PID:14308
- C:\Windows\System\txxuQpi.exe
  C:\Windows\System\txxuQpi.exe
  2⤵
  PID:14324
- C:\Windows\System\NPghUJO.exe
  C:\Windows\System\NPghUJO.exe
  2⤵
  PID:10932
- C:\Windows\System\ENlEXTX.exe
  C:\Windows\System\ENlEXTX.exe
  2⤵
  PID:6060
- C:\Windows\System\fJEfMzu.exe
  C:\Windows\System\fJEfMzu.exe
  2⤵
  PID:13172
- C:\Windows\System\yCuSMvp.exe
  C:\Windows\System\yCuSMvp.exe
  2⤵
  PID:13060
- C:\Windows\System\CmTzSgY.exe
  C:\Windows\System\CmTzSgY.exe
  2⤵
  PID:11432
- C:\Windows\System\SIhyKDW.exe
  C:\Windows\System\SIhyKDW.exe
  2⤵
  PID:5448
- C:\Windows\System\ZrzzSfp.exe
  C:\Windows\System\ZrzzSfp.exe
  2⤵
  PID:6784
- C:\Windows\System\oPKNijw.exe
  C:\Windows\System\oPKNijw.exe
  2⤵
  PID:9436
- C:\Windows\System\NsPNpfh.exe
  C:\Windows\System\NsPNpfh.exe
  2⤵
  PID:11840
- C:\Windows\System\fMTtinV.exe
  C:\Windows\System\fMTtinV.exe
  2⤵
  PID:11164
- C:\Windows\System\rqsZeaD.exe
  C:\Windows\System\rqsZeaD.exe
  2⤵
  PID:13464
- C:\Windows\System\wJkRJWM.exe
  C:\Windows\System\wJkRJWM.exe
  2⤵
  PID:8364
- C:\Windows\System\psFiZqB.exe
  C:\Windows\System\psFiZqB.exe
  2⤵
  PID:4768
- C:\Windows\System\gbPeMvH.exe
  C:\Windows\System\gbPeMvH.exe
  2⤵
  PID:10224
- C:\Windows\System\EkgUkHg.exe
  C:\Windows\System\EkgUkHg.exe
  2⤵
  PID:13588
- C:\Windows\System\qSXBjXK.exe
  C:\Windows\System\qSXBjXK.exe
  2⤵
  PID:13324
- C:\Windows\System\hNOsXbJ.exe
  C:\Windows\System\hNOsXbJ.exe
  2⤵
  PID:13380
- C:\Windows\System\ySIFEeB.exe
  C:\Windows\System\ySIFEeB.exe
  2⤵
  PID:12432
- C:\Windows\System\ZvbFYRc.exe
  C:\Windows\System\ZvbFYRc.exe
  2⤵
  PID:13412
- C:\Windows\System\iDUazxo.exe
  C:\Windows\System\iDUazxo.exe
  2⤵
  PID:13584
- C:\Windows\System\DcGKoVf.exe
  C:\Windows\System\DcGKoVf.exe
  2⤵
  PID:13636
- C:\Windows\System\zMFFHSG.exe
  C:\Windows\System\zMFFHSG.exe
  2⤵
  PID:13680
- C:\Windows\System\fUEfVud.exe
  C:\Windows\System\fUEfVud.exe
  2⤵
  PID:14024
- C:\Windows\System\hCHtHGI.exe
  C:\Windows\System\hCHtHGI.exe
  2⤵
  PID:14172
- C:\Windows\System\IZzySyL.exe
  C:\Windows\System\IZzySyL.exe
  2⤵
  PID:11020
- C:\Windows\System\ogITfWm.exe
  C:\Windows\System\ogITfWm.exe
  2⤵
  PID:14300
- C:\Windows\System\WytlDkN.exe
  C:\Windows\System\WytlDkN.exe
  2⤵
  PID:4080
- C:\Windows\System\JkGkUzF.exe
  C:\Windows\System\JkGkUzF.exe
  2⤵
  PID:10048
- C:\Windows\System\drNIrzA.exe
  C:\Windows\System\drNIrzA.exe
  2⤵
  PID:13508
- C:\Windows\System\vbKnXGD.exe
  C:\Windows\System\vbKnXGD.exe
  2⤵
  PID:13480
- C:\Windows\System\bidUQpT.exe
  C:\Windows\System\bidUQpT.exe
  2⤵
  PID:11128
- C:\Windows\System\XzYxkEV.exe
  C:\Windows\System\XzYxkEV.exe
  2⤵
  PID:13904
- C:\Windows\System\whsGiXH.exe
  C:\Windows\System\whsGiXH.exe
  2⤵
  PID:13772
- C:\Windows\System\VtiRiWx.exe
  C:\Windows\System\VtiRiWx.exe
  2⤵
  PID:13804
- C:\Windows\System\uPFmyvx.exe
  C:\Windows\System\uPFmyvx.exe
  2⤵
  PID:13760
- C:\Windows\System\gBCrPvu.exe
  C:\Windows\System\gBCrPvu.exe
  2⤵
  PID:13820
- C:\Windows\System\ErHkBqM.exe
  C:\Windows\System\ErHkBqM.exe
  2⤵
  PID:13880
- C:\Windows\System\ncpEmFN.exe
  C:\Windows\System\ncpEmFN.exe
  2⤵
  PID:14008
- C:\Windows\System\CWHokST.exe
  C:\Windows\System\CWHokST.exe
  2⤵
  PID:11136
- C:\Windows\System\rZffVXd.exe
  C:\Windows\System\rZffVXd.exe
  2⤵
  PID:14136
- C:\Windows\System\UtAiJBI.exe
  C:\Windows\System\UtAiJBI.exe
  2⤵
  PID:13448
- C:\Windows\System\ZJZcaWU.exe
  C:\Windows\System\ZJZcaWU.exe
  2⤵
  PID:9352
- C:\Windows\System\UikYard.exe
  C:\Windows\System\UikYard.exe
  2⤵
  PID:13276
- C:\Windows\System\ebCaGXJ.exe
  C:\Windows\System\ebCaGXJ.exe
  2⤵
  PID:13580
- C:\Windows\System\KunuDbn.exe
  C:\Windows\System\KunuDbn.exe
  2⤵
  PID:10372
- C:\Windows\System\oIYuLKw.exe
  C:\Windows\System\oIYuLKw.exe
  2⤵
  PID:13544
- C:\Windows\System\UdGFHYw.exe
  C:\Windows\System\UdGFHYw.exe
  2⤵
  PID:11336
- C:\Windows\System\HTHTVkv.exe
  C:\Windows\System\HTHTVkv.exe
  2⤵
  PID:13992
- C:\Windows\System\cAMEJRc.exe
  C:\Windows\System\cAMEJRc.exe
  2⤵
  PID:13848
- C:\Windows\System\JcfoOep.exe
  C:\Windows\System\JcfoOep.exe
  2⤵
  PID:400
- C:\Windows\System\yqxUZMY.exe
  C:\Windows\System\yqxUZMY.exe
  2⤵
  PID:7692
- C:\Windows\System\TgrDCJM.exe
  C:\Windows\System\TgrDCJM.exe
  2⤵
  PID:7784
- C:\Windows\System\fxgtKAG.exe
  C:\Windows\System\fxgtKAG.exe
  2⤵
  PID:14076
- C:\Windows\System\prhGivZ.exe
  C:\Windows\System\prhGivZ.exe
  2⤵
  PID:1492
- C:\Windows\System\jbCOSwQ.exe
  C:\Windows\System\jbCOSwQ.exe
  2⤵
  PID:13144
- C:\Windows\System\HnaPzzB.exe
  C:\Windows\System\HnaPzzB.exe
  2⤵
  PID:14200
- C:\Windows\System\PDdkLHa.exe
  C:\Windows\System\PDdkLHa.exe
  2⤵
  PID:13188
- C:\Windows\System\uitgQNT.exe
  C:\Windows\System\uitgQNT.exe
  2⤵
  PID:11592
- C:\Windows\System\zFrlWVH.exe
  C:\Windows\System\zFrlWVH.exe
  2⤵
  PID:14100
- C:\Windows\System\xftzhNW.exe
  C:\Windows\System\xftzhNW.exe
  2⤵
  PID:2312
- C:\Windows\System\sMJQAWI.exe
  C:\Windows\System\sMJQAWI.exe
  2⤵
  PID:14224
- C:\Windows\System\vRtFKwE.exe
  C:\Windows\System\vRtFKwE.exe
  2⤵
  PID:4212
- C:\Windows\System\dPcyJgG.exe
  C:\Windows\System\dPcyJgG.exe
  2⤵
  PID:7660
- C:\Windows\System\Cintdkf.exe
  C:\Windows\System\Cintdkf.exe
  2⤵
  PID:3708
- C:\Windows\System\kfXTftf.exe
  C:\Windows\System\kfXTftf.exe
  2⤵
  PID:7676
- C:\Windows\System\TjGMcVZ.exe
  C:\Windows\System\TjGMcVZ.exe
  2⤵
  PID:7680
- C:\Windows\System\gkuCLNR.exe
  C:\Windows\System\gkuCLNR.exe
  2⤵
  PID:7792
- C:\Windows\System\TjRhMfh.exe
  C:\Windows\System\TjRhMfh.exe
  2⤵
  PID:10808
- C:\Windows\System\qWzlayu.exe
  C:\Windows\System\qWzlayu.exe
  2⤵
  PID:2344
- C:\Windows\System\HPmPofc.exe
  C:\Windows\System\HPmPofc.exe
  2⤵
  PID:14280
- C:\Windows\System\aKlwYfo.exe
  C:\Windows\System\aKlwYfo.exe
  2⤵
  PID:4060
- C:\Windows\System\tSoNoEQ.exe
  C:\Windows\System\tSoNoEQ.exe
  2⤵
  PID:4100
- C:\Windows\System\tSMVDEn.exe
  C:\Windows\System\tSMVDEn.exe
  2⤵
  PID:9744
- C:\Windows\System\ZOWBpQT.exe
  C:\Windows\System\ZOWBpQT.exe
  2⤵
  PID:11200
- C:\Windows\System\uXAiDcp.exe
  C:\Windows\System\uXAiDcp.exe
  2⤵
  PID:13432
- C:\Windows\System\xyWCCDD.exe
  C:\Windows\System\xyWCCDD.exe
  2⤵
  PID:5356
- C:\Windows\System\eQLCsIu.exe
  C:\Windows\System\eQLCsIu.exe
  2⤵
  PID:14248
- C:\Windows\System\HajdaFs.exe
  C:\Windows\System\HajdaFs.exe
  2⤵
  PID:3324
- C:\Windows\System\INXthlc.exe
  C:\Windows\System\INXthlc.exe
  2⤵
  PID:864
- C:\Windows\System\HwDheka.exe
  C:\Windows\System\HwDheka.exe
  2⤵
  PID:3300
- C:\Windows\System\WzCIkUn.exe
  C:\Windows\System\WzCIkUn.exe
  2⤵
  PID:3308
- C:\Windows\System\gGFlugv.exe
  C:\Windows\System\gGFlugv.exe
  2⤵
  PID:14216
- C:\Windows\System\QFReFrW.exe
  C:\Windows\System\QFReFrW.exe
  2⤵
  PID:3340
- C:\Windows\System\mYgpVuc.exe
  C:\Windows\System\mYgpVuc.exe
  2⤵
  PID:608
- C:\Windows\System\kCKgPzI.exe
  C:\Windows\System\kCKgPzI.exe
  2⤵
  PID:5496
- C:\Windows\System\xAfMeMg.exe
  C:\Windows\System\xAfMeMg.exe
  2⤵
  PID:2920
- C:\Windows\System\ealNZyh.exe
  C:\Windows\System\ealNZyh.exe
  2⤵
  PID:1008
- C:\Windows\System\WuLQVoQ.exe
  C:\Windows\System\WuLQVoQ.exe
  2⤵
  PID:2856
- C:\Windows\System\wmqyOMg.exe
  C:\Windows\System\wmqyOMg.exe
  2⤵
  PID:14052
- C:\Windows\System\Qowpogf.exe
  C:\Windows\System\Qowpogf.exe
  2⤵
  PID:14264
- C:\Windows\System\YQIjdNM.exe
  C:\Windows\System\YQIjdNM.exe
  2⤵
  PID:3276
- C:\Windows\System\wQAmILu.exe
  C:\Windows\System\wQAmILu.exe
  2⤵
  PID:14236
- C:\Windows\System\cQjskbY.exe
  C:\Windows\System\cQjskbY.exe
  2⤵
  PID:13372
- C:\Windows\System\fkTgeeo.exe
  C:\Windows\System\fkTgeeo.exe
  2⤵
  PID:5620
- C:\Windows\System\zWbogEd.exe
  C:\Windows\System\zWbogEd.exe
  2⤵
  PID:2316
- C:\Windows\System\yjSsHJM.exe
  C:\Windows\System\yjSsHJM.exe
  2⤵
  PID:3980
- C:\Windows\System\zylPECe.exe
  C:\Windows\System\zylPECe.exe
  2⤵
  PID:14180
- C:\Windows\System\IfHkgJi.exe
  C:\Windows\System\IfHkgJi.exe
  2⤵
  PID:3000
- C:\Windows\System\JrTMWZT.exe
  C:\Windows\System\JrTMWZT.exe
  2⤵
  PID:2564
- C:\Windows\System\iyNxBtm.exe
  C:\Windows\System\iyNxBtm.exe
  2⤵
  PID:1288
- C:\Windows\System\PlQuAOs.exe
  C:\Windows\System\PlQuAOs.exe
  2⤵
  PID:1136
- C:\Windows\System\Yoafqsa.exe
  C:\Windows\System\Yoafqsa.exe
  2⤵
  PID:2132
- C:\Windows\System\UfzjQYX.exe
  C:\Windows\System\UfzjQYX.exe
  2⤵
  PID:5892
- C:\Windows\System\ABTJAaG.exe
  C:\Windows\System\ABTJAaG.exe
  2⤵
  PID:1460
- C:\Windows\System\AIHVUGr.exe
  C:\Windows\System\AIHVUGr.exe
  2⤵
  PID:13928
- C:\Windows\System\NLHOfcT.exe
  C:\Windows\System\NLHOfcT.exe
  2⤵
  PID:5972
- C:\Windows\System\ZhYqhVZ.exe
  C:\Windows\System\ZhYqhVZ.exe
  2⤵
  PID:13684
- C:\Windows\System\bZrXhht.exe
  C:\Windows\System\bZrXhht.exe
  2⤵
  PID:4892
- C:\Windows\System\vVBwoJA.exe
  C:\Windows\System\vVBwoJA.exe
  2⤵
  PID:836
- C:\Windows\System\fXdVYwp.exe
  C:\Windows\System\fXdVYwp.exe
  2⤵
  PID:2840
- C:\Windows\System\stNHyUS.exe
  C:\Windows\System\stNHyUS.exe
  2⤵
  PID:5488
- C:\Windows\System\OyNiCbl.exe
  C:\Windows\System\OyNiCbl.exe
  2⤵
  PID:2392
- C:\Windows\System\TvwZonA.exe
  C:\Windows\System\TvwZonA.exe
  2⤵
  PID:5468
- C:\Windows\System\oJbvyJv.exe
  C:\Windows\System\oJbvyJv.exe
  2⤵
  PID:3580
- C:\Windows\System\zGSPwrX.exe
  C:\Windows\System\zGSPwrX.exe
  2⤵
  PID:3800
- C:\Windows\System\ACPoKVh.exe
  C:\Windows\System\ACPoKVh.exe
  2⤵
  PID:6120
- C:\Windows\System\ZElubrw.exe
  C:\Windows\System\ZElubrw.exe
  2⤵
  PID:6504
- C:\Windows\System\VYcTueZ.exe
  C:\Windows\System\VYcTueZ.exe
  2⤵
  PID:13952
- C:\Windows\System\VAGpzmK.exe
  C:\Windows\System\VAGpzmK.exe
  2⤵
  PID:1384
- C:\Windows\System\jvSyzsm.exe
  C:\Windows\System\jvSyzsm.exe
  2⤵
  PID:14212
- C:\Windows\System\IKmGyOM.exe
  C:\Windows\System\IKmGyOM.exe
  2⤵
  PID:5332
- C:\Windows\System\UyKigrr.exe
  C:\Windows\System\UyKigrr.exe
  2⤵
  PID:13444
- C:\Windows\System\HhBSicS.exe
  C:\Windows\System\HhBSicS.exe
  2⤵
  PID:6732
- C:\Windows\System\umeUENf.exe
  C:\Windows\System\umeUENf.exe
  2⤵
  PID:6712
- C:\Windows\System\TAcLIVA.exe
  C:\Windows\System\TAcLIVA.exe
  2⤵
  PID:6468
- C:\Windows\System\JlTCgYk.exe
  C:\Windows\System\JlTCgYk.exe
  2⤵
  PID:6728
- C:\Windows\System\ruDadon.exe
  C:\Windows\System\ruDadon.exe
  2⤵
  PID:5264
- C:\Windows\System\LyWACnh.exe
  C:\Windows\System\LyWACnh.exe
  2⤵
  PID:14032
- C:\Windows\System\hwuetzR.exe
  C:\Windows\System\hwuetzR.exe
  2⤵
  PID:9416
- C:\Windows\System\lQeOzCA.exe
  C:\Windows\System\lQeOzCA.exe
  2⤵
  PID:5964
- C:\Windows\System\iSdkQwA.exe
  C:\Windows\System\iSdkQwA.exe
  2⤵
  PID:14196
- C:\Windows\System\JfJTLRj.exe
  C:\Windows\System\JfJTLRj.exe
  2⤵
  PID:5136
- C:\Windows\System\wxbrGLj.exe
  C:\Windows\System\wxbrGLj.exe
  2⤵
  PID:6056
- C:\Windows\System\eyLOuuS.exe
  C:\Windows\System\eyLOuuS.exe
  2⤵
  PID:5140
- C:\Windows\System\atQQNbt.exe
  C:\Windows\System\atQQNbt.exe
  2⤵
  PID:6756
- C:\Windows\System\QIiQEmo.exe
  C:\Windows\System\QIiQEmo.exe
  2⤵
  PID:6720
- C:\Windows\System\tEJtzsU.exe
  C:\Windows\System\tEJtzsU.exe
  2⤵
  PID:6016
- C:\Windows\System\hklMwqm.exe
  C:\Windows\System\hklMwqm.exe
  2⤵
  PID:5480
- C:\Windows\System\hPwhCkF.exe
  C:\Windows\System\hPwhCkF.exe
  2⤵
  PID:6200
- C:\Windows\System\lFepqxw.exe
  C:\Windows\System\lFepqxw.exe
  2⤵
  PID:6848
- C:\Windows\System\UMXToFW.exe
  C:\Windows\System\UMXToFW.exe
  2⤵
  PID:5216
- C:\Windows\System\HKWQkpb.exe
  C:\Windows\System\HKWQkpb.exe
  2⤵
  PID:4116
- C:\Windows\System\iiPrUwZ.exe
  C:\Windows\System\iiPrUwZ.exe
  2⤵
  PID:3608
- C:\Windows\System\XSQYwKe.exe
  C:\Windows\System\XSQYwKe.exe
  2⤵
  PID:6872
- C:\Windows\System\QYTCJfp.exe
  C:\Windows\System\QYTCJfp.exe
  2⤵
  PID:5788
- C:\Windows\System\XOikxYG.exe
  C:\Windows\System\XOikxYG.exe
  2⤵
  PID:4572
- C:\Windows\System\SWeAomC.exe
  C:\Windows\System\SWeAomC.exe
  2⤵
  PID:6760
- C:\Windows\System\RCgRLXd.exe
  C:\Windows\System\RCgRLXd.exe
  2⤵
  PID:14356
- C:\Windows\System\sorTrgW.exe
  C:\Windows\System\sorTrgW.exe
  2⤵
  PID:14468
- C:\Windows\System\pMDuSMK.exe
  C:\Windows\System\pMDuSMK.exe
  2⤵
  PID:14492
- C:\Windows\System\MWiKqdb.exe
  C:\Windows\System\MWiKqdb.exe
  2⤵
  PID:14508
- C:\Windows\System\bzPbeHx.exe
  C:\Windows\System\bzPbeHx.exe
  2⤵
  PID:14568
- C:\Windows\System\QJAoSrj.exe
  C:\Windows\System\QJAoSrj.exe
  2⤵
  PID:14672
- C:\Windows\System\MyJXXwb.exe
  C:\Windows\System\MyJXXwb.exe
  2⤵
  PID:14692
- C:\Windows\System\uNDXkKy.exe
  C:\Windows\System\uNDXkKy.exe
  2⤵
  PID:14712
- C:\Windows\System\EytnzJN.exe
  C:\Windows\System\EytnzJN.exe
  2⤵
  PID:14732
- C:\Windows\System\JrxbZBC.exe
  C:\Windows\System\JrxbZBC.exe
  2⤵
  PID:14752
- C:\Windows\System\clxXwrv.exe
  C:\Windows\System\clxXwrv.exe
  2⤵
  PID:14772
- C:\Windows\System\EluzWjA.exe
  C:\Windows\System\EluzWjA.exe
  2⤵
  PID:14788
- C:\Windows\System\nRWqUvr.exe
  C:\Windows\System\nRWqUvr.exe
  2⤵
  PID:14804
- C:\Windows\System\GRJwNkA.exe
  C:\Windows\System\GRJwNkA.exe
  2⤵
  PID:14820
- C:\Windows\System\HKbHTpv.exe
  C:\Windows\System\HKbHTpv.exe
  2⤵
  PID:14836
- C:\Windows\System\mydWwxc.exe
  C:\Windows\System\mydWwxc.exe
  2⤵
  PID:14864
- C:\Windows\System\oTugmOv.exe
  C:\Windows\System\oTugmOv.exe
  2⤵
  PID:14920
- C:\Windows\System\FfMgUAx.exe
  C:\Windows\System\FfMgUAx.exe
  2⤵
  PID:14952
- C:\Windows\System\jqmdRRe.exe
  C:\Windows\System\jqmdRRe.exe
  2⤵
  PID:14980
- C:\Windows\System\PjZqBcf.exe
  C:\Windows\System\PjZqBcf.exe
  2⤵
  PID:15000
- C:\Windows\System\WBTqwqI.exe
  C:\Windows\System\WBTqwqI.exe
  2⤵
  PID:15020
- C:\Windows\System\mSRZsXb.exe
  C:\Windows\System\mSRZsXb.exe
  2⤵
  PID:15060
- C:\Windows\System\CLpAFCz.exe
  C:\Windows\System\CLpAFCz.exe
  2⤵
  PID:15096
- C:\Windows\System\fBFJpuY.exe
  C:\Windows\System\fBFJpuY.exe
  2⤵
  PID:15112
- C:\Windows\System\HxqexvB.exe
  C:\Windows\System\HxqexvB.exe
  2⤵
  PID:15136
- C:\Windows\System\khFgYcE.exe
  C:\Windows\System\khFgYcE.exe
  2⤵
  PID:15160
- C:\Windows\System\HkvLBVC.exe
  C:\Windows\System\HkvLBVC.exe
  2⤵
  PID:15188
- C:\Windows\System\NksIUvx.exe
  C:\Windows\System\NksIUvx.exe
  2⤵
  PID:15216
- C:\Windows\System\iiiCnQH.exe
  C:\Windows\System\iiiCnQH.exe
  2⤵
  PID:15316
- C:\Windows\System\YYyTrry.exe
  C:\Windows\System\YYyTrry.exe
  2⤵
  PID:6876
- C:\Windows\System\sKQSvVB.exe
  C:\Windows\System\sKQSvVB.exe
  2⤵
  PID:4916
- C:\Windows\System\JksnZrY.exe
  C:\Windows\System\JksnZrY.exe
  2⤵
  PID:4836
- C:\Windows\System\YpKtzgO.exe
  C:\Windows\System\YpKtzgO.exe
  2⤵
  PID:6896
- C:\Windows\System\JXGpYix.exe
  C:\Windows\System\JXGpYix.exe
  2⤵
  PID:5724
- C:\Windows\System\ZsojIXK.exe
  C:\Windows\System\ZsojIXK.exe
  2⤵
  PID:5612
- C:\Windows\System\ajdUyHY.exe
  C:\Windows\System\ajdUyHY.exe
  2⤵
  PID:6972
- C:\Windows\System\ymWXiod.exe
  C:\Windows\System\ymWXiod.exe
  2⤵
  PID:14480
- C:\Windows\System\fqtjKBk.exe
  C:\Windows\System\fqtjKBk.exe
  2⤵
  PID:14488
- C:\Windows\System\urxjpZR.exe
  C:\Windows\System\urxjpZR.exe
  2⤵
  PID:14504
- C:\Windows\System\TvLIhJW.exe
  C:\Windows\System\TvLIhJW.exe
  2⤵
  PID:14372
- C:\Windows\System\QdzpbEe.exe
  C:\Windows\System\QdzpbEe.exe
  2⤵
  PID:14680
- C:\Windows\System\DKOjUqk.exe
  C:\Windows\System\DKOjUqk.exe
  2⤵
  PID:6912
- C:\Windows\System\vnjDwmq.exe
  C:\Windows\System\vnjDwmq.exe
  2⤵
  PID:14996
- C:\Windows\System\vRKMiZG.exe
  C:\Windows\System\vRKMiZG.exe
  2⤵
  PID:15124
- C:\Windows\System\SYbBHsr.exe
  C:\Windows\System\SYbBHsr.exe
  2⤵
  PID:15084
- C:\Windows\System\RDLIAmY.exe
  C:\Windows\System\RDLIAmY.exe
  2⤵
  PID:14908
- C:\Windows\System\qKorjwX.exe
  C:\Windows\System\qKorjwX.exe
  2⤵
  PID:15336
- C:\Windows\System\FepeMaz.exe
  C:\Windows\System\FepeMaz.exe
  2⤵
  PID:2192
- C:\Windows\System\aRlDoWd.exe
  C:\Windows\System\aRlDoWd.exe
  2⤵
  PID:6924
- C:\Windows\System\SvYpqcN.exe
  C:\Windows\System\SvYpqcN.exe
  2⤵
  PID:1484
- C:\Windows\System\HiJIExo.exe
  C:\Windows\System\HiJIExo.exe
  2⤵
  PID:6900
- C:\Windows\System\gKIzxJM.exe
  C:\Windows\System\gKIzxJM.exe
  2⤵
  PID:14632
- C:\Windows\System\iDkchjS.exe
  C:\Windows\System\iDkchjS.exe
  2⤵
  PID:14592
- C:\Windows\System\zkyadgp.exe
  C:\Windows\System\zkyadgp.exe
  2⤵
  PID:14612
- C:\Windows\System\RVPUQTP.exe
  C:\Windows\System\RVPUQTP.exe
  2⤵
  PID:15032
- C:\Windows\System\tGbUblH.exe
  C:\Windows\System\tGbUblH.exe
  2⤵
  PID:14936
- C:\Windows\System\pwWeUHe.exe
  C:\Windows\System\pwWeUHe.exe
  2⤵
  PID:15208
- C:\Windows\System\WzGTNyM.exe
  C:\Windows\System\WzGTNyM.exe
  2⤵
  PID:15028
- C:\Windows\System\nolTmRi.exe
  C:\Windows\System\nolTmRi.exe
  2⤵
  PID:4648
- C:\Windows\System\NVlLBcL.exe
  C:\Windows\System\NVlLBcL.exe
  2⤵
  PID:15308
- C:\Windows\System\fTolSgY.exe
  C:\Windows\System\fTolSgY.exe
  2⤵
  PID:15088
- C:\Windows\System\gyEIEuI.exe
  C:\Windows\System\gyEIEuI.exe
  2⤵
  PID:14896
- C:\Windows\System\JuTnzwC.exe
  C:\Windows\System\JuTnzwC.exe
  2⤵
  PID:7436
- C:\Windows\System\UVKdLYK.exe
  C:\Windows\System\UVKdLYK.exe
  2⤵
  PID:5244
- C:\Windows\System\RctPUCL.exe
  C:\Windows\System\RctPUCL.exe
  2⤵
  PID:14644
- C:\Windows\System\CZsTSBJ.exe
  C:\Windows\System\CZsTSBJ.exe
  2⤵
  PID:6844
- C:\Windows\System\ApDQyqB.exe
  C:\Windows\System\ApDQyqB.exe
  2⤵
  PID:14344
- C:\Windows\System\MyPEBSF.exe
  C:\Windows\System\MyPEBSF.exe
  2⤵
  PID:14628
- C:\Windows\System\ywQWJiC.exe
  C:\Windows\System\ywQWJiC.exe
  2⤵
  PID:14460
- C:\Windows\System\MNRLiMd.exe
  C:\Windows\System\MNRLiMd.exe
  2⤵
  PID:14400
- C:\Windows\System\SSmomXw.exe
  C:\Windows\System\SSmomXw.exe
  2⤵
  PID:6236
- C:\Windows\System\ABYrmmF.exe
  C:\Windows\System\ABYrmmF.exe
  2⤵
  PID:15148
- C:\Windows\System\KpEcZty.exe
  C:\Windows\System\KpEcZty.exe
  2⤵
  PID:14524
- C:\Windows\System\rgEywgH.exe
  C:\Windows\System\rgEywgH.exe
  2⤵
  PID:5780
- C:\Windows\System\RuQkcsO.exe
  C:\Windows\System\RuQkcsO.exe
  2⤵
  PID:7584
- C:\Windows\System\PEAhwTk.exe
  C:\Windows\System\PEAhwTk.exe
  2⤵
  PID:7560
- C:\Windows\System\ayfJHqq.exe
  C:\Windows\System\ayfJHqq.exe
  2⤵
  PID:15184
- C:\Windows\System\JxOYCAG.exe
  C:\Windows\System\JxOYCAG.exe
  2⤵
  PID:14620
- C:\Windows\System\kheAieX.exe
  C:\Windows\System\kheAieX.exe
  2⤵
  PID:14748
- C:\Windows\System\rTTKIWG.exe
  C:\Windows\System\rTTKIWG.exe
  2⤵
  PID:14928
- C:\Windows\System\tUQcdVE.exe
  C:\Windows\System\tUQcdVE.exe
  2⤵
  PID:6944
- C:\Windows\System\AQkehqc.exe
  C:\Windows\System\AQkehqc.exe
  2⤵
  PID:6392
- C:\Windows\System\CYrmtur.exe
  C:\Windows\System\CYrmtur.exe
  2⤵
  PID:15072
- C:\Windows\System\sMlEQpq.exe
  C:\Windows\System\sMlEQpq.exe
  2⤵
  PID:5616
- C:\Windows\System\PspXYec.exe
  C:\Windows\System\PspXYec.exe
  2⤵
  PID:14028
- C:\Windows\System\YyTGYQo.exe
  C:\Windows\System\YyTGYQo.exe
  2⤵
  PID:4420
- C:\Windows\System\wlzpYAN.exe
  C:\Windows\System\wlzpYAN.exe
  2⤵
  PID:1252
- C:\Windows\System\fZQUsuj.exe
  C:\Windows\System\fZQUsuj.exe
  2⤵
  PID:6656
- C:\Windows\System\VixaNcz.exe
  C:\Windows\System\VixaNcz.exe
  2⤵
  PID:1496
- C:\Windows\System\xsKPHiC.exe
  C:\Windows\System\xsKPHiC.exe
  2⤵
  PID:4468
- C:\Windows\System\exwCjFO.exe
  C:\Windows\System\exwCjFO.exe
  2⤵
  PID:14552
- C:\Windows\System\folDwov.exe
  C:\Windows\System\folDwov.exe
  2⤵
  PID:5568
- C:\Windows\System\sobsqQr.exe
  C:\Windows\System\sobsqQr.exe
  2⤵
  PID:8420
- C:\Windows\System\GYHVAWZ.exe
  C:\Windows\System\GYHVAWZ.exe
  2⤵
  PID:14584
- C:\Windows\System\wHrRtAU.exe
  C:\Windows\System\wHrRtAU.exe
  2⤵
  PID:5652
- C:\Windows\System\QanWTEQ.exe
  C:\Windows\System\QanWTEQ.exe
  2⤵
  PID:8024
- C:\Windows\System\cpFSvTn.exe
  C:\Windows\System\cpFSvTn.exe
  2⤵
  PID:7404
- C:\Windows\System\LkOHRuW.exe
  C:\Windows\System\LkOHRuW.exe
  2⤵
  PID:7648
- C:\Windows\System\VGDxmKA.exe
  C:\Windows\System\VGDxmKA.exe
  2⤵
  PID:15196
- C:\Windows\System\RHHqjlX.exe
  C:\Windows\System\RHHqjlX.exe
  2⤵
  PID:8272
- C:\Windows\System\KjWEoSk.exe
  C:\Windows\System\KjWEoSk.exe
  2⤵
  PID:7324
- C:\Windows\System\vfCXxpR.exe
  C:\Windows\System\vfCXxpR.exe
  2⤵
  PID:7556
- C:\Windows\System\uXILjZG.exe
  C:\Windows\System\uXILjZG.exe
  2⤵
  PID:14476
- C:\Windows\System\gRcAcfj.exe
  C:\Windows\System\gRcAcfj.exe
  2⤵
  PID:3780
- C:\Windows\System\NthXmGW.exe
  C:\Windows\System\NthXmGW.exe
  2⤵
  PID:7772
- C:\Windows\System\XPjCkYR.exe
  C:\Windows\System\XPjCkYR.exe
  2⤵
  PID:8524
- C:\Windows\System\qxcRUnd.exe
  C:\Windows\System\qxcRUnd.exe
  2⤵
  PID:6152
- C:\Windows\System\Wpilpfc.exe
  C:\Windows\System\Wpilpfc.exe
  2⤵
  PID:7564
- C:\Windows\System\WTXFogn.exe
  C:\Windows\System\WTXFogn.exe
  2⤵
  PID:15016
- C:\Windows\System\lHORNHS.exe
  C:\Windows\System\lHORNHS.exe
  2⤵
  PID:376
- C:\Windows\System\LDWUHll.exe
  C:\Windows\System\LDWUHll.exe
  2⤵
  PID:8208
- C:\Windows\System\YOvNFps.exe
  C:\Windows\System\YOvNFps.exe
  2⤵
  PID:7540
- C:\Windows\System\HejXAEh.exe
  C:\Windows\System\HejXAEh.exe
  2⤵
  PID:8232
- C:\Windows\System\QsuhJBn.exe
  C:\Windows\System\QsuhJBn.exe
  2⤵
  PID:9608
- C:\Windows\System\HTqbhOq.exe
  C:\Windows\System\HTqbhOq.exe
  2⤵
  PID:6440
- C:\Windows\System\FCkeYMN.exe
  C:\Windows\System\FCkeYMN.exe
  2⤵
  PID:3476
- C:\Windows\System\kGOSOzk.exe
  C:\Windows\System\kGOSOzk.exe
  2⤵
  PID:8284
- C:\Windows\System\zYPgtOG.exe
  C:\Windows\System\zYPgtOG.exe
  2⤵
  PID:7036
- C:\Windows\System\wFbRiRm.exe
  C:\Windows\System\wFbRiRm.exe
  2⤵
  PID:14916
- C:\Windows\System\yxRHWdW.exe
  C:\Windows\System\yxRHWdW.exe
  2⤵
  PID:6936
- C:\Windows\System\WfTcDPZ.exe
  C:\Windows\System\WfTcDPZ.exe
  2⤵
  PID:10548
- C:\Windows\System\WUblXpw.exe
  C:\Windows\System\WUblXpw.exe
  2⤵
  PID:10560
- C:\Windows\System\yyZslEO.exe
  C:\Windows\System\yyZslEO.exe
  2⤵
  PID:2460
- C:\Windows\System\vCojpoZ.exe
  C:\Windows\System\vCojpoZ.exe
  2⤵
  PID:10072
- C:\Windows\System\AxjTlCc.exe
  C:\Windows\System\AxjTlCc.exe
  2⤵
  PID:9724
- C:\Windows\System\XUOIXxo.exe
  C:\Windows\System\XUOIXxo.exe
  2⤵
  PID:2968
- C:\Windows\System\BVkCXXG.exe
  C:\Windows\System\BVkCXXG.exe
  2⤵
  PID:9072
- C:\Windows\System\lvPvRlX.exe
  C:\Windows\System\lvPvRlX.exe
  2⤵
  PID:14124
- C:\Windows\System\UmpNKXT.exe
  C:\Windows\System\UmpNKXT.exe
  2⤵
  PID:5836
- C:\Windows\System\IevvyWy.exe
  C:\Windows\System\IevvyWy.exe
  2⤵
  PID:10588
- C:\Windows\System\VIJXZdJ.exe
  C:\Windows\System\VIJXZdJ.exe
  2⤵
  PID:11740
- C:\Windows\System\EOXJSkw.exe
  C:\Windows\System\EOXJSkw.exe
  2⤵
  PID:8836
- C:\Windows\System\iOtVCMo.exe
  C:\Windows\System\iOtVCMo.exe
  2⤵
  PID:11140
- C:\Windows\System\ywbnDMt.exe
  C:\Windows\System\ywbnDMt.exe
  2⤵
  PID:9312
- C:\Windows\System\Lruoeeb.exe
  C:\Windows\System\Lruoeeb.exe
  2⤵
  PID:10472
- C:\Windows\System\RgovAcq.exe
  C:\Windows\System\RgovAcq.exe
  2⤵
  PID:10976
- C:\Windows\System\SfTdsCA.exe
  C:\Windows\System\SfTdsCA.exe
  2⤵
  PID:9092
- C:\Windows\System\OqfzGCd.exe
  C:\Windows\System\OqfzGCd.exe
  2⤵
  PID:10384
- C:\Windows\System\yFbAdTw.exe
  C:\Windows\System\yFbAdTw.exe
  2⤵
  PID:11144
- C:\Windows\System\VBcAPsk.exe
  C:\Windows\System\VBcAPsk.exe
  2⤵
  PID:11664
- C:\Windows\System\mOQhTgy.exe
  C:\Windows\System\mOQhTgy.exe
  2⤵
  PID:15156
- C:\Windows\System\QQfJnWO.exe
  C:\Windows\System\QQfJnWO.exe
  2⤵
  PID:9484
- C:\Windows\System\OWasvNp.exe
  C:\Windows\System\OWasvNp.exe
  2⤵
  PID:8424
- C:\Windows\System\gYEHBQa.exe
  C:\Windows\System\gYEHBQa.exe
  2⤵
  PID:13888
- C:\Windows\System\BhXuOYK.exe
  C:\Windows\System\BhXuOYK.exe
  2⤵
  PID:8416
- C:\Windows\System\PzBOzyj.exe
  C:\Windows\System\PzBOzyj.exe
  2⤵
  PID:11048
- C:\Windows\System\GrPmZfi.exe
  C:\Windows\System\GrPmZfi.exe
  2⤵
  PID:5528
- C:\Windows\System\aSYSlru.exe
  C:\Windows\System\aSYSlru.exe
  2⤵
  PID:14760
- C:\Windows\System\vfPQefO.exe
  C:\Windows\System\vfPQefO.exe
  2⤵
  PID:8732
- C:\Windows\System\cUiEmEY.exe
  C:\Windows\System\cUiEmEY.exe
  2⤵
  PID:12736
- C:\Windows\System\XiKbFCi.exe
  C:\Windows\System\XiKbFCi.exe
  2⤵
  PID:1500
- C:\Windows\System\PZIiOlM.exe
  C:\Windows\System\PZIiOlM.exe
  2⤵
  PID:9604
- C:\Windows\System\grtDcbH.exe
  C:\Windows\System\grtDcbH.exe
  2⤵
  PID:3968
- C:\Windows\System\DeDVQqq.exe
  C:\Windows\System\DeDVQqq.exe
  2⤵
  PID:9052
- C:\Windows\System\hZwOvce.exe
  C:\Windows\System\hZwOvce.exe
  2⤵
  PID:15236
- C:\Windows\System\bEGOWCD.exe
  C:\Windows\System\bEGOWCD.exe
  2⤵
  PID:8480
- C:\Windows\System\CGjmFdg.exe
  C:\Windows\System\CGjmFdg.exe
  2⤵
  PID:4852
- C:\Windows\System\AzyOAoz.exe
  C:\Windows\System\AzyOAoz.exe
  2⤵
  PID:9508
- C:\Windows\System\hftuHpV.exe
  C:\Windows\System\hftuHpV.exe
  2⤵
  PID:10348
- C:\Windows\System\hhBCauS.exe
  C:\Windows\System\hhBCauS.exe
  2⤵
  PID:12772
- C:\Windows\System\JCiLzUC.exe
  C:\Windows\System\JCiLzUC.exe
  2⤵
  PID:9584
- C:\Windows\System\QEoFcQw.exe
  C:\Windows\System\QEoFcQw.exe
  2⤵
  PID:14560
- C:\Windows\System\yIsQPLQ.exe
  C:\Windows\System\yIsQPLQ.exe
  2⤵
  PID:12784
- C:\Windows\System\bucmhra.exe
  C:\Windows\System\bucmhra.exe
  2⤵
  PID:8904
- C:\Windows\System\lQzFPib.exe
  C:\Windows\System\lQzFPib.exe
  2⤵
  PID:10324
- C:\Windows\System\EpgYNJa.exe
  C:\Windows\System\EpgYNJa.exe
  2⤵
  PID:11404
- C:\Windows\System\jdxMCQe.exe
  C:\Windows\System\jdxMCQe.exe
  2⤵
  PID:11676
- C:\Windows\System\rJqYZpk.exe
  C:\Windows\System\rJqYZpk.exe
  2⤵
  PID:2884
- C:\Windows\System\xuBsLVN.exe
  C:\Windows\System\xuBsLVN.exe
  2⤵
  PID:10304
- C:\Windows\System\btBPHWu.exe
  C:\Windows\System\btBPHWu.exe
  2⤵
  PID:14720
- C:\Windows\System\gtfGlsS.exe
  C:\Windows\System\gtfGlsS.exe
  2⤵
  PID:12708
- C:\Windows\System\GDmTXWU.exe
  C:\Windows\System\GDmTXWU.exe
  2⤵
  PID:12776
- C:\Windows\System\LvabwiL.exe
  C:\Windows\System\LvabwiL.exe
  2⤵
  PID:10108
- C:\Windows\System\eduWFLn.exe
  C:\Windows\System\eduWFLn.exe
  2⤵
  PID:13000
- C:\Windows\System\zvyQwdu.exe
  C:\Windows\System\zvyQwdu.exe
  2⤵
  PID:8896
- C:\Windows\System\xGoRqnZ.exe
  C:\Windows\System\xGoRqnZ.exe
  2⤵
  PID:6644
- C:\Windows\System\OyYZrFX.exe
  C:\Windows\System\OyYZrFX.exe
  2⤵
  PID:9464
- C:\Windows\System\BjFxfQH.exe
  C:\Windows\System\BjFxfQH.exe
  2⤵
  PID:9808
- C:\Windows\System\fbbKyOQ.exe
  C:\Windows\System\fbbKyOQ.exe
  2⤵
  PID:11836
- C:\Windows\System\myHsSFI.exe
  C:\Windows\System\myHsSFI.exe
  2⤵
  PID:9928
- C:\Windows\System\bnLNryR.exe
  C:\Windows\System\bnLNryR.exe
  2⤵
  PID:12300
- C:\Windows\System\Xqnzpsw.exe
  C:\Windows\System\Xqnzpsw.exe
  2⤵
  PID:11428
- C:\Windows\System\LkUMFMa.exe
  C:\Windows\System\LkUMFMa.exe
  2⤵
  PID:12972
- C:\Windows\System\ZKPPTGN.exe
  C:\Windows\System\ZKPPTGN.exe
  2⤵
  PID:12936
- C:\Windows\System\xKNEGqR.exe
  C:\Windows\System\xKNEGqR.exe
  2⤵
  PID:13048
- C:\Windows\System\ZIefZXQ.exe
  C:\Windows\System\ZIefZXQ.exe
  2⤵
  PID:11364
- C:\Windows\System\cKCwhpV.exe
  C:\Windows\System\cKCwhpV.exe
  2⤵
  PID:9356
- C:\Windows\System\bTtQief.exe
  C:\Windows\System\bTtQief.exe
  2⤵
  PID:7476
- C:\Windows\System\pvWcklR.exe
  C:\Windows\System\pvWcklR.exe
  2⤵
  PID:3768
- C:\Windows\System\DyXKmGs.exe
  C:\Windows\System\DyXKmGs.exe
  2⤵
  PID:15340
- C:\Windows\System\ADoooIK.exe
  C:\Windows\System\ADoooIK.exe
  2⤵
  PID:15388
- C:\Windows\System\gUmHZeN.exe
  C:\Windows\System\gUmHZeN.exe
  2⤵
  PID:15448
- C:\Windows\System\HzxXeUz.exe
  C:\Windows\System\HzxXeUz.exe
  2⤵
  PID:15468
- C:\Windows\System\LUDTKMy.exe
  C:\Windows\System\LUDTKMy.exe
  2⤵
  PID:15484
- C:\Windows\System\xBVBVpr.exe
  C:\Windows\System\xBVBVpr.exe
  2⤵
  PID:15500
- C:\Windows\System\BfGuUUT.exe
  C:\Windows\System\BfGuUUT.exe
  2⤵
  PID:15516
- C:\Windows\System\TUBXSOS.exe
  C:\Windows\System\TUBXSOS.exe
  2⤵
  PID:15540
- C:\Windows\System\VJhXEYO.exe
  C:\Windows\System\VJhXEYO.exe
  2⤵
  PID:15568
- C:\Windows\System\PBnbaYg.exe
  C:\Windows\System\PBnbaYg.exe
  2⤵
  PID:15612
- C:\Windows\System\RsvVpoT.exe
  C:\Windows\System\RsvVpoT.exe
  2⤵
  PID:15652
- C:\Windows\System\UdObtvs.exe
  C:\Windows\System\UdObtvs.exe
  2⤵
  PID:15864
- C:\Windows\System\vkHyove.exe
  C:\Windows\System\vkHyove.exe
  2⤵
  PID:15884
- C:\Windows\System\QqRcLEG.exe
  C:\Windows\System\QqRcLEG.exe
  2⤵
  PID:15912
- C:\Windows\System\XunbxWK.exe
  C:\Windows\System\XunbxWK.exe
  2⤵
  PID:16112
- C:\Windows\System\sAPqzjW.exe
  C:\Windows\System\sAPqzjW.exe
  2⤵
  PID:16152
- C:\Windows\System\SJJAUsw.exe
  C:\Windows\System\SJJAUsw.exe
  2⤵
  PID:16176
- C:\Windows\System\nfBLuHT.exe
  C:\Windows\System\nfBLuHT.exe
  2⤵
  PID:16216
- C:\Windows\System\quYwgfq.exe
  C:\Windows\System\quYwgfq.exe
  2⤵
  PID:12952
- C:\Windows\System\yWczxce.exe
  C:\Windows\System\yWczxce.exe
  2⤵
  PID:12860

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 11652 -ip 11652
1⤵
PID:6800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k5ditsbt.fu0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BCEAytF.exe

Filesize
1.9MB

MD5
d12ae28e0f767b0eee6a9ea10d2f56a3

SHA1
389bba1faba010d365bb15fc2d452b362ced0e65

SHA256
389a5c830a552c3cd3c75e97719d1fbd24d48dd686e3189b13b01cbbbfc26494

SHA512
ac048b1d3e25992996c3e1c349aca9f62020f87684f21fc19b82b7c348e21a2fd592d8a476de6eefedd2116f85783e6c24324e9c71f23abafce8193923afb0e0

Download Submit
C:\Windows\System\DCfnJJy.exe

Filesize
1.9MB

MD5
a646c326b27dcfc4a4ae7da0d29bca40

SHA1
fc42072a86b2b0a91a1311ed9a84ca9d8b0d2b0f

SHA256
6b72f35c8eaf9cbd340fb5798c826c607116d3c488882301543ea1a22e4655e5

SHA512
3348dffbb79619c048477f42653b4840edd70c9d11a8a1dc0fbbc67af3e87518690d90e3511a43b75605bc42c25448fe11cb65529ca7751db14c19dd6da89be3

Download Submit
C:\Windows\System\DTSFmIZ.exe

Filesize
1.9MB

MD5
34e560ddace827b960e2ebd04e35762a

SHA1
eb1fa5b776c77c17f7c0ec90a4018163a64a6306

SHA256
d95858fce2dde9c69508014fc159ec36292b64c4e52f4bb2cdf3ae915700faea

SHA512
5f1101c2d613da9c5970b9ec11318136e40d4a4654ba1c6c321fbb6e83148b37c105008d851a52f3cea4aa539dd800b574981a169c120b63e41a5bba6be210ad

Download Submit
C:\Windows\System\DjPzRXv.exe

Filesize
8B

MD5
77d7bf33fc4f12bfdb9e86136d3b03c4

SHA1
97d97c8d5ae00436ac2d2202db990baabc4e4d94

SHA256
a079985e5dcd4e5003f1d0cfa79ba591507ffd065b7459f4b6f1fe6835c1aebc

SHA512
31a189517e8f007e33c776dddb91ad4e752c628e5f64dec1a48a29302de6a9ffe3541221f6c58119e49f66669bc0b1de454057d727c5323655bbae427b0917a2

Download Submit
C:\Windows\System\EbuwPgC.exe

Filesize
1.9MB

MD5
5bde3fee8a6dc7bac463c6ddeb780fe6

SHA1
68cc8dd42b644173110c880996bfa0704605b032

SHA256
be79115cb79a0a6571ca3034603108b570855eda7fd91a3b34376f86891bcb39

SHA512
dacc210c031434ebae75fcb08d2870ece0d5c8b5fa74b337b623af5f8bb522a56849710a867b890efbcbe671505bfbec7cf5bb282aeca66d8c321c0c8c71527e

Download Submit
C:\Windows\System\FAvlmFl.exe

Filesize
1.9MB

MD5
60515f683754bcf4b94149d14380448a

SHA1
bbad1cb37b6d0275d0078a09c19e9256e5da53d1

SHA256
3764b1a840e6c0c87ef04ab78587108e6c6265d54f6837fbf2d233fd8272b3e5

SHA512
8735f26fd408ad4aab89856d999e6464e659e7fccafbdb18db09116c3b1102fa3560c1a3ea342747087b7f78c03a21f42b0c47cea1965517e0571af64b863cb6

Download Submit
C:\Windows\System\FECNQCV.exe

Filesize
1.9MB

MD5
0b73160eda8a202c92e529fa74f76819

SHA1
88ff2e6666a570cb728fc3a48aa5bdec86dd010f

SHA256
5f28bb88abe3dda150b9d49e2e3b805e498dc6d9f922c04570da4c9406ea40a1

SHA512
38710f7bc25c41f76d1e10dd002f0c4bc0d1f6b9532574f46ac253158ae247d7078fe3c50d52f31040adf9f3917d6de0d896a0b32ccf8932f156468981be4904

Download Submit
C:\Windows\System\HGqMRSx.exe

Filesize
1.9MB

MD5
222e1c8eb21360c82e82ea9a05af5c06

SHA1
d16e159a62f47f668294dfb6b279386fd92476bc

SHA256
b53063ef1c2149d89b7a0ce4a0a7d52bc73951827d89728977f72352d9dfa539

SHA512
dd76b6ce4e75055fbe40150f8da4aba476bb4cb45eae5a115b003bb4df82abf364d1f1ad9c6a7fcd08f63430e4e3360d71ee92ee96063f68d8fa87d339d039c3

Download Submit
C:\Windows\System\HnGusLz.exe

Filesize
18B

MD5
86b2bd2a1c5b503db6068a06743b627f

SHA1
644b52f79c6a2eb0efae14be490427eef7c9ced4

SHA256
90fcdf666f6075fbf44637df6214158f77410fcd29208c8cede77d16eb2bd111

SHA512
c858b69983ca77bf7fe8b37aa87b9425d1690e149418627a1f76e372e3ec9f8309a7441fa7dcd2b3ca7a63e06025c03ca6346e22eb8339841933907a2b26d3c2

Download Submit
C:\Windows\System\KATmnYJ.exe

Filesize
1.9MB

MD5
bf97c39fd4329a726cc9bbc3827f89dd

SHA1
c633a65f42a70a1dfffbe8bdc51dd74440f0e928

SHA256
7188f2290b7ded91e56776dafbfcb5b5ad2656364404919aed08ac66a360cf12

SHA512
706450e6116ac6a7a73308b4f7a501b1187caa345ef1d4b819acc7788e0cb205dc0c6e9eacdf4cc680a55a95f583324f0539184af60a6a76dbb3b1b2a61b9c73

Download Submit
C:\Windows\System\OxvDInr.exe

Filesize
1.9MB

MD5
b592a0f9d5486ef080ce91dac74cc15d

SHA1
c7a22b0e540165f563453fa61680a36c60114baf

SHA256
36f5bfee9b1bcafd25c962b727d32ea6382317b822dee97d1e4e018805e7f198

SHA512
522b623c075a9eed42d0676c7c02782acfab5c0a1aa0515a7db61598212913a1a7962e032483181da1079dfa8e0b8ddf3e995295edbeac265e4c04178cd8440f

Download Submit
C:\Windows\System\RiQgkCY.exe

Filesize
1.9MB

MD5
9b16cd46af18fba29b2c21cd714384fe

SHA1
8b555de34950009273564b99b3e6cbb062e7dff7

SHA256
d780fb80f444ee5c5a995cbee4bd7fc1974d550dbef7bdb8a3dc1b7e753add6d

SHA512
5127ecf8ad57d29cb901ce14d29a7d6854f9017091430cad53698c2789ee50115563654e262c6a899f739b46c620b5f7b9325dd1709a2340c70cd86628836ac6

Download Submit
C:\Windows\System\WQtHPqy.exe

Filesize
1.9MB

MD5
b0979ad3003ede64adc912727beba79d

SHA1
1ffb4fc802272e0bc89e985903416557e2278091

SHA256
0ad896eeef3ef4fa76b076bed878fab5699bcc9b0f1efd52fa23b9892a4a135b

SHA512
fc28b5c3493c6bc85fb1bf23bc0924a77c76ee5db6ba0be7dda48911fae666b89422a9d15aa0650917ad27833628dcee0701af91ddfd578de8022bcfa7241beb

Download Submit
C:\Windows\System\WaFEqFq.exe

Filesize
1.9MB

MD5
f6d267ecaec3fbc1a0d91e0f6a57fe4a

SHA1
2b36d3cfaaba82161acc29fb64b35af2895f1432

SHA256
758c23de6428895ca3fcae345eafa1ee3ea147f0b92999faf231d6b4369dacbc

SHA512
0587e35d46f6a000fd05d9aafad50447b741e00aae5f3dba8d4a4b75ed0ba5d5bf5b64e6e0b00f7425e060a5befb3f6f7400ac0d7ff8c5868d0ae7e89b4e97d9

Download Submit
C:\Windows\System\YrOAyRZ.exe

Filesize
1.9MB

MD5
9d0c8583f1a225c1af404bd37a0756db

SHA1
0cab8b2c604fd0530c3d765d8704a07f9a7e0adb

SHA256
6673c424105c3b904d274c7c8c7ac6dcd17d8f60d524e2c5f77f5e562f5526d5

SHA512
5f7dcde9c3da89887099c39ecdf14f89e0b0d102276de4fc74ec1a02da36b8ef40e624f7924869f9bd8122023acc89c40b20932f649425c75f63a2ec194f4031

Download Submit
C:\Windows\System\ZcdghOy.exe

Filesize
1.9MB

MD5
542771965eb89a5295b7fdc29d2be256

SHA1
112ddc2ae5388d8c0b97408b26afac0639bd7f87

SHA256
a904f70816ddeeec29643d0a4f6c6790d15a49759d6577a8befe564a2c965e03

SHA512
e3f88d33b2b288e4a59e7b96fbe41ae1ab4f68f06aa90a386092a1bf77a2458e2d13027c1d43ac40f6c0969cae9040246902507ba170d17b0cc5fc4665d9fb8d

Download Submit
C:\Windows\System\aGYtmZo.exe

Filesize
1.9MB

MD5
c0dd3c8e650ea38bbf6fc259ffc730f2

SHA1
e320401adbc72d1dbafe8caba1b8a336d5989544

SHA256
f0d2146c05551cad03889ddce1e2fdc0e690099f8afbc5ddc7816e8ba6d55ffe

SHA512
b6c82988567d03d9b12fddfbb7cb878316f4b405f1678f55add8a5191b98ddf78d2dddb6e71d26e77436b86ab6649383e89ecb9d09449c21ab1051b04e6b1780

Download Submit
C:\Windows\System\aepcEAM.exe

Filesize
1.9MB

MD5
74a606761fd7f542d91edc338cb57366

SHA1
c91d0970b9e3433eea9ffead68ab0659c6daca53

SHA256
02e48f8e5849d72cb91b0e808961e5a5322ef06cf84a2bbf1dc9a3188e18123d

SHA512
81df69d5d6161235b75b8c329e467356704b885b8cc5991ed4160c7a575f80c14dc318d3ad5ea9f75104d52771718221a72cba0adac22bf0be824ddc090fb407

Download Submit
C:\Windows\System\bsARfSc.exe

Filesize
1.9MB

MD5
1c3507c642ce84eb2cfe378fea231f27

SHA1
f82ad9bf239089c64bfc4d178572158d60450602

SHA256
bc5128d317d5e8d66c866b3ddcfb35e831c32156a6d2f011b755edc837826883

SHA512
8fccb751bdae90d608653dc7411ed58481e932d67b0616ae09f4b235160ce2e984a8f4a789ee104397e8295c1acbe82dda32e26bf68cc9ed2cb1d808244cd055

Download Submit
C:\Windows\System\dgUfFok.exe

Filesize
1.9MB

MD5
b60aae4acda8260485f52fec99faf499

SHA1
a358fb1f566776bb3c81c311ce6a0e239af0058b

SHA256
5fdbd2f46672bed206b695fdb0ed16d6d15a38f4bcfe9c4e9059c0dc93f6d1be

SHA512
6544a147d94bb8f2d4f0f6167159e1f2d7b52a48b8506c3ab6371eb6a52ae3d5dcd12d94c88dd11fe4fb3bb9979f7114ac6154755e9afe3a6e521d3b9edce43f

Download Submit
C:\Windows\System\efabhyT.exe

Filesize
1.9MB

MD5
6d03bf00165f70659945c27b22d7fe92

SHA1
dfa287db6fed898e96f557c6cd5abb544f305893

SHA256
40fd5d7215fe3295882ec86cbeafff26962adec422d3dff7b8bbb9275ea9bbc1

SHA512
97b1de7416e82c84fb54b86aae9077a451907185c4c34a2489183cde46c0828752082480aa1dd829ea7ef75bde335e90e7e480d1caf88216bb87b083e15d8f0a

Download Submit
C:\Windows\System\fdeNkry.exe

Filesize
1.9MB

MD5
27911dc62f13a2722147e25796d27de0

SHA1
3c4bc0f9f8ae2bcd0e0512d910db772f451013f4

SHA256
f5a875008e923c9814eba9588cb15d0c3353fac69726d2e9670286f3128675d9

SHA512
13b0002962a5ebc735a700b40baa4d44e31cb04ddbfc12112e9ea5f139620bdc6a00a672a6ef1a6f95eada9071703c9a1a634b594cc100eba555957cf0aaff4d

Download Submit
C:\Windows\System\feIHQKm.exe

Filesize
1.9MB

MD5
b2faf9ecd8cc0ec735fb6f84f5f36ff3

SHA1
135227671a766939c40af6bd8166b49b45baed6d

SHA256
17c3d4d1dd66eeb18f6da14d81459f8785ecb5c1e2d31f5946ccbe531e9ea656

SHA512
4453b4bb3281dca38301b9ece83b1960374262be92c074134e713ca6dd4f86018cfe50dc6dba7f52698cbf3e74cf4a40c23bf2135438a0124333e9eae0282d23

Download Submit
C:\Windows\System\gDdtjbx.exe

Filesize
1.9MB

MD5
8f1243c42a52e23f6c55d88dcf5d264d

SHA1
bace148f5101b7b7f2b59fef35e290aa78c479f3

SHA256
27df3ef4bcd6bd118c8fa36bd14eb30c2f60f9ea524a0eaef8a10e55125f3519

SHA512
1d5e5fa2203b418e501de33115d569ecc9de4b0c6b360e4bc98b5494a75c4e336378d227b715c878f8140338262d13f4c6c1a3ef7bf1c7f921c4da3abdc4d881

Download Submit
C:\Windows\System\iqhCpxa.exe

Filesize
1.9MB

MD5
44906b9d0d1a96445c9f48b107f6ee0e

SHA1
680f83d5dbb7efaaae0f659511a4080613a5056c

SHA256
21bd69fc707cc5186208bf0d38adebbc2c700093b06a6c2099acce62de1f4859

SHA512
d3810b58956a6c2ac29e75d946924ade29782b071ea32eb1a999c7592bc9ebc02ed58862b24fb940a4ea66b4d0c086d592a924a506907cd41af21fd43f18c9c2

Download Submit
C:\Windows\System\ivzdYdU.exe

Filesize
1.9MB

MD5
18530b35172e626521d581bc327ad414

SHA1
7372162c1ce5153ba9ab4edda568b4de8c782715

SHA256
0838533cda0c51ac8a106036fede6f41e7112c50987d07d6f802de24a639476e

SHA512
2f666854055c3b2ef6067e0660063ea4d87e498e727d61b1294430174baf59b347bb6da8db07381d683e0d809a3027025b740e27ba03e8da6426fb1949413817

Download Submit
C:\Windows\System\kGLmyIM.exe

Filesize
1.9MB

MD5
0deef3ce9a56cafd571d741ad3836b19

SHA1
49fe3a205d46e1358422ec58e4cc9a4ebbd13302

SHA256
71e56addf882846a1062a2a6dbf68f27e9e21b183cfc7eb50328ce9836e99ea9

SHA512
e42a80a6976adc6cc2e13bb125a1d4d5d164654a355e4095fa8b7ecb43d60359229ff351382ccb56c902d126b503bd02d9ec1ff58e40091c88b0b7f51729af00

Download Submit
C:\Windows\System\klxLOXW.exe

Filesize
1.9MB

MD5
aa20169eba953ed1085531c4fad649f0

SHA1
056ba398fd0886d99e3cf21e18f5b5790e576367

SHA256
8d4070f7d17a9c0878b205c2e09121a20cb8edcaeb76b68772498af8018b4181

SHA512
008483c2f63f73bfd57f135fb616ef870860e89abfdce59a7e846fa8255f20f0e550d1da26a4284814bf3491f26db72bfbfffc32f7a40f9cd6961d744b11ea94

Download Submit
C:\Windows\System\kqDynbV.exe

Filesize
1.9MB

MD5
c3c977daa02aab05112802093556ac71

SHA1
f155eaa571c90d1673c1f1958b04089448526168

SHA256
28b02fa2cb2d3553f86b27f3d418e9f7547421aed858c806c26caa28b6baca03

SHA512
4a089c8cd3bd24e6730b33e7fc2ea1059727c998a4403c0d33e1983a4fb39e526cdf1d32b7bf4299cc461f8b1fe76ee7f5520c33e77f71f0691a4d7bca6fe1e6

Download Submit
C:\Windows\System\krjTSJz.exe

Filesize
1.9MB

MD5
8628c226f4802197c4baa7c2b1499655

SHA1
144c975d5e359f49a735d315ed7d48fcd27e0568

SHA256
54fd3dc0f826b88d8fd3e2dd76d70558a4859994b974c66fd44792dfa630170a

SHA512
52b84b4bba8118495b7dbb3d6fb251cea0c354e88c72237160c36c82c7799da8410948ae57e4057c8445cb0127cb6c7bf8aca49f724986a5fb0f620fd32f7def

Download Submit
C:\Windows\System\pKQORqH.exe

Filesize
1.9MB

MD5
b5847a29305fa3295aa00931e5bc3b3e

SHA1
2eed6befd6b0cff4d5fcb75897ed09066cc5b4a4

SHA256
f81f0ffe6fa5d14726f1987744489b111b9dfeaa24a6b24eba03c6527b6f2dc7

SHA512
34e99ae82fa1c9df77f2351619c23992151a4a0e6101d19ddce2fc8d66b78df91fb575d1d04fdb64af5d3645333430838cecdebcfaf3db5e4cabc867035da829

Download Submit
C:\Windows\System\pnhCcHC.exe

Filesize
1.9MB

MD5
4580f6ce31745d433e78b6cef5a4270b

SHA1
58ce1181cf282f1a8baa243cad881ee19691fd6e

SHA256
a757c9e549bbdcaffe3f3f6c082d51a113bc59efb16c5dcca4c1a36bf227b577

SHA512
16445e58d4b43dd9615bf1bf99b82de0227346b2c067054cf66f7f10a3e71513cb5980bdc65ba84096e7d687983a14b934d210003ea60ca4f43bf2389029b2e3

Download Submit
C:\Windows\System\riAzPUU.exe

Filesize
1.9MB

MD5
fc54939db1ab91975a5bb5b2dfaec19f

SHA1
e5e37921ccd0c764432e73dad382545cb0768136

SHA256
42564a0d7455b9441891fead593336b333d4a35588f8dc748ef79d8ccb7609e6

SHA512
709aabc4bcb910e79b063e3fb60def6b1976d7c12d29a4bc865b896b8774d1d59c24466d0d057994a411fc07da9b3ec6a2c371259281ec96b26e9ff56e354734

Download Submit
C:\Windows\System\sVVUktH.exe

Filesize
1.9MB

MD5
8b0de0acfb150b2eb42b757bd493b50d

SHA1
405d6a19d0b6c7d09ddbd13fab89b8bcdb32706d

SHA256
ca2d0370fe5374184433ffdcc07a373b317942a7bc4ca52d3aded1ad54891234

SHA512
a3bfb47f6cdb112a95c2cb7143bf2fd1b405366fb64bc680579fc9cc30fd776506ae4bda3d454b3325091e1b396e840c9ab292d841acc8e67f12423ba9dc897f

Download Submit
C:\Windows\System\vMyqENZ.exe

Filesize
1.9MB

MD5
f377491a2a2a51e646ddc63d440c58ad

SHA1
cf8b2c7ed0ddcd573849e13659ff40ff5b3316ae

SHA256
13027b62f6e8f50ac31d4118746f060b0bd71fe6cb0c5b5dadea18fa92f71e53

SHA512
5ff4defc2ecff53ba41188b8c9adb0abf3c76ea58011e21359dc53c8601ee78e3b50cefdf388e88c75f0bdbd489b6a256495afa89ca680235cfae57f66b8d94d

Download Submit
C:\Windows\System\vPpnHcp.exe

Filesize
1.9MB

MD5
037e0f3328816076ff2ad8e60f2a6174

SHA1
9a8110507c95b534606426d102423beb4ef1fe96

SHA256
091760555ef47e7e47b13705c3c30f02b56a78bea6c14ef2713628d556eb6051

SHA512
90c033e5e31e06f8fc0268c24f9646b03f0d950a1ccf02fdde92d5e235910dc30483f8bc87e33388f8b5c7ea59ceb392f734e953b38386b97d15ed7ec3474dde

Download Submit
C:\Windows\System\wyhIhkL.exe

Filesize
1.9MB

MD5
c5f04762ba73d1d934dddf2928a1fc7d

SHA1
f60602ea119f936c3e25e6fd15fac06c3f006164

SHA256
2be34c37afac89f3bb4ef4a26d334c8d4c65a4ff26694ff13973f8b3bf3e0e16

SHA512
c53e6b80c58d2a880a5a486ae112f5d16b66a2b3c4e65035b42b70d4a3449dc5624dcf4b965c06ca00cae70b3e90765288b1159ae4a6109f6a8206e755d686c5

Download Submit
C:\Windows\System\xeVQbLS.exe

Filesize
1.9MB

MD5
359e889d9b47fb013dcf57d6fe6c3bba

SHA1
392cda1340a7736ae5a87beb05e81311a540c278

SHA256
5164fc184dd2aa219b1819046e0f4725fb73948acbbb1cce397412739363ef49

SHA512
b9baa2165892cab286720e933f44fed0f6dc413c29a5af425a88be58b17919cec6bfa89ad352b07a72c1b6fe8511718006c4cda163e7e4ccd91b37b5d2292a0f

Download Submit
C:\Windows\System\yTleTIn.exe

Filesize
1.9MB

MD5
6e29f85269b16cab3f09387ccc912a93

SHA1
456fa55bc275cd301c4a2ed9235def6afadfa981

SHA256
600be5e5811479f02fdaddae0c9a5aa19de32656d5001d555c77fb342d072b4c

SHA512
dde7f92edf53da6998d50a691dbcced8c1f909fae53431dbe37a72f27d5ec8fbb0f014d01d2fd833545228b131fe0a77df8b70535e6a1479f903fc003762c782

Download Submit
C:\Windows\System\zBVQLqG.exe

Filesize
1.9MB

MD5
be03d1cc09343e64ad28cda284415f38

SHA1
b1b27a7ec633ecc58df45a8611ca447b2cc951ce

SHA256
a9a0fb825f4d55de6c72c3a17061b43b78e467650f09cb09b493d8905e0e0408

SHA512
552b133d06c4deafdbbfac8e03e74d64519e3aac64bbd47aa4875a19cf91c9c35032a2bcb5e6c7c26358d4b4a742830f4f7a590de1d693a7c9f0cad0d8ebe013

Download Submit
C:\Windows\System\zxmgkjS.exe

Filesize
1.9MB

MD5
f9a8dd65d071dc2d8385858da8bcb372

SHA1
d3038ac8494ea9114b173e341cb7824a9a467bc6

SHA256
2b9c4b4aa4b54314c3764878e3268c2b1b28c4ea2cdcd2cd2a33cb8aa77abf04

SHA512
f8ab315c4b1ddede6cff785abb15e904208572dc6563d2d3bdf0b8389b815cbdf7c5c2336a1bcb43e65defbfbb21b1fcafaa41d82fa52cd218d07bed3311577d

Download Submit
memory/688-561-0x00007FF6F3E30000-0x00007FF6F4222000-memory.dmp

Filesize
3.9MB

Download
memory/688-4995-0x00007FF6F3E30000-0x00007FF6F4222000-memory.dmp

Filesize
3.9MB

Download
memory/764-458-0x00007FF626BC0000-0x00007FF626FB2000-memory.dmp

Filesize
3.9MB

Download
memory/764-5079-0x00007FF626BC0000-0x00007FF626FB2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-558-0x00007FF751C20000-0x00007FF752012000-memory.dmp

Filesize
3.9MB

Download
memory/1328-399-0x00007FF6152B0000-0x00007FF6156A2000-memory.dmp

Filesize
3.9MB

Download
memory/1528-552-0x00007FF6422D0000-0x00007FF6426C2000-memory.dmp

Filesize
3.9MB

Download
memory/1792-457-0x00007FF719BD0000-0x00007FF719FC2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-379-0x00007FF7DEE90000-0x00007FF7DF282000-memory.dmp

Filesize
3.9MB

Download
memory/1904-4990-0x00007FF7DEE90000-0x00007FF7DF282000-memory.dmp

Filesize
3.9MB

Download
memory/1948-2151-0x00007FF6BFDD0000-0x00007FF6C01C2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-18-0x00007FF6BFDD0000-0x00007FF6C01C2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-549-0x00007FF795B20000-0x00007FF795F12000-memory.dmp

Filesize
3.9MB

Download
memory/2252-374-0x00007FF6C4130000-0x00007FF6C4522000-memory.dmp

Filesize
3.9MB

Download
memory/2380-5101-0x00007FF75CD10000-0x00007FF75D102000-memory.dmp

Filesize
3.9MB

Download
memory/2380-553-0x00007FF75CD10000-0x00007FF75D102000-memory.dmp

Filesize
3.9MB

Download
memory/2384-5017-0x00007FF630EC0000-0x00007FF6312B2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-560-0x00007FF630EC0000-0x00007FF6312B2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-51-0x00007FF66B640000-0x00007FF66BA32000-memory.dmp

Filesize
3.9MB

Download
memory/3288-556-0x00007FF6B3B60000-0x00007FF6B3F52000-memory.dmp

Filesize
3.9MB

Download
memory/3636-2176-0x00007FF67B5B0000-0x00007FF67B9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3636-45-0x00007FF67B5B0000-0x00007FF67B9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3716-309-0x00007FF9FBA00000-0x00007FF9FC4C1000-memory.dmp

Filesize
10.8MB

Download
memory/3716-209-0x00007FF9FBA00000-0x00007FF9FC4C1000-memory.dmp

Filesize
10.8MB

Download
memory/3716-97-0x00007FF9FBA03000-0x00007FF9FBA05000-memory.dmp

Filesize
8KB

Download
memory/3716-2377-0x00007FF9FBA03000-0x00007FF9FBA05000-memory.dmp

Filesize
8KB

Download
memory/3716-344-0x000002995A6E0000-0x000002995A702000-memory.dmp

Filesize
136KB

Download
memory/3832-550-0x00007FF6D7F10000-0x00007FF6D8302000-memory.dmp

Filesize
3.9MB

Download
memory/3904-555-0x00007FF6E4120000-0x00007FF6E4512000-memory.dmp

Filesize
3.9MB

Download
memory/4104-96-0x00007FF60D280000-0x00007FF60D672000-memory.dmp

Filesize
3.9MB

Download
memory/4104-4946-0x00007FF60D280000-0x00007FF60D672000-memory.dmp

Filesize
3.9MB

Download
memory/4160-551-0x00007FF7FE890000-0x00007FF7FEC82000-memory.dmp

Filesize
3.9MB

Download
memory/4160-5073-0x00007FF7FE890000-0x00007FF7FEC82000-memory.dmp

Filesize
3.9MB

Download
memory/4484-557-0x00007FF6B0C80000-0x00007FF6B1072000-memory.dmp

Filesize
3.9MB

Download
memory/4640-0-0x00007FF792C00000-0x00007FF792FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4640-2149-0x00007FF792C00000-0x00007FF792FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4640-1-0x0000029997770000-0x0000029997780000-memory.dmp

Filesize
64KB

Download
memory/4868-2177-0x00007FF6BEC40000-0x00007FF6BF032000-memory.dmp

Filesize
3.9MB

Download
memory/4868-69-0x00007FF6BEC40000-0x00007FF6BF032000-memory.dmp

Filesize
3.9MB

Download
memory/4940-554-0x00007FF7446C0000-0x00007FF744AB2000-memory.dmp

Filesize
3.9MB

Download
memory/4940-5135-0x00007FF7446C0000-0x00007FF744AB2000-memory.dmp

Filesize
3.9MB

Download
memory/5044-559-0x00007FF6D23D0000-0x00007FF6D27C2000-memory.dmp

Filesize
3.9MB

Download
memory/5068-527-0x00007FF6B0A50000-0x00007FF6B0E42000-memory.dmp

Filesize
3.9MB

Download