xmrig | c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
Size

1.3MB
MD5

a57016f893db9665846077362ea5930b
SHA1

3f49d65d5dade2d23d00d6036fb7c466db461823
SHA256

c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70
SHA512

05d1f84641a576461cd55ec7da4af68bbbbcf180704bd90ff4659e758a99e8e756963833be324515e8e527ab3014bb8f2813a42f28fdad4589bd4d9e91f62135
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPIpxG:Lz071uv4BPMkibTIA5LDGTcw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/4836-65-0x00007FF75D180000-0x00007FF75D572000-memory.dmp	xmrig
behavioral2/memory/2364-70-0x00007FF7F35C0000-0x00007FF7F39B2000-memory.dmp	xmrig
behavioral2/memory/2840-74-0x00007FF73D5B0000-0x00007FF73D9A2000-memory.dmp	xmrig
behavioral2/memory/5100-170-0x00007FF6A1AF0000-0x00007FF6A1EE2000-memory.dmp	xmrig
behavioral2/memory/4396-164-0x00007FF61EB00000-0x00007FF61EEF2000-memory.dmp	xmrig
behavioral2/memory/2612-163-0x00007FF7E45F0000-0x00007FF7E49E2000-memory.dmp	xmrig
behavioral2/memory/3952-157-0x00007FF69CCF0000-0x00007FF69D0E2000-memory.dmp	xmrig
behavioral2/memory/3200-151-0x00007FF7C59A0000-0x00007FF7C5D92000-memory.dmp	xmrig
behavioral2/memory/3716-145-0x00007FF70DA90000-0x00007FF70DE82000-memory.dmp	xmrig
behavioral2/memory/408-139-0x00007FF77CA00000-0x00007FF77CDF2000-memory.dmp	xmrig
behavioral2/memory/4576-128-0x00007FF6A8320000-0x00007FF6A8712000-memory.dmp	xmrig
behavioral2/memory/2988-73-0x00007FF7A1760000-0x00007FF7A1B52000-memory.dmp	xmrig
behavioral2/memory/4684-72-0x00007FF750BC0000-0x00007FF750FB2000-memory.dmp	xmrig
behavioral2/memory/2844-71-0x00007FF71C980000-0x00007FF71CD72000-memory.dmp	xmrig
behavioral2/memory/3452-62-0x00007FF742790000-0x00007FF742B82000-memory.dmp	xmrig
behavioral2/memory/3664-55-0x00007FF67E7A0000-0x00007FF67EB92000-memory.dmp	xmrig
behavioral2/memory/1844-47-0x00007FF63F930000-0x00007FF63FD22000-memory.dmp	xmrig
behavioral2/memory/4868-816-0x00007FF7AD7A0000-0x00007FF7ADB92000-memory.dmp	xmrig
behavioral2/memory/2040-822-0x00007FF6DB580000-0x00007FF6DB972000-memory.dmp	xmrig
behavioral2/memory/3160-912-0x00007FF67F6F0000-0x00007FF67FAE2000-memory.dmp	xmrig
behavioral2/memory/5084-1395-0x00007FF77AC30000-0x00007FF77B022000-memory.dmp	xmrig
behavioral2/memory/1116-1398-0x00007FF78ECE0000-0x00007FF78F0D2000-memory.dmp	xmrig
behavioral2/memory/1220-1457-0x00007FF6C8EA0000-0x00007FF6C9292000-memory.dmp	xmrig
behavioral2/memory/4992-1540-0x00007FF684500000-0x00007FF6848F2000-memory.dmp	xmrig
behavioral2/memory/2900-1541-0x00007FF77FF40000-0x00007FF780332000-memory.dmp	xmrig
behavioral2/memory/4576-1612-0x00007FF6A8320000-0x00007FF6A8712000-memory.dmp	xmrig
behavioral2/memory/1844-3105-0x00007FF63F930000-0x00007FF63FD22000-memory.dmp	xmrig
behavioral2/memory/3664-3110-0x00007FF67E7A0000-0x00007FF67EB92000-memory.dmp	xmrig
behavioral2/memory/2364-3132-0x00007FF7F35C0000-0x00007FF7F39B2000-memory.dmp	xmrig
behavioral2/memory/2988-3123-0x00007FF7A1760000-0x00007FF7A1B52000-memory.dmp	xmrig
behavioral2/memory/5084-3178-0x00007FF77AC30000-0x00007FF77B022000-memory.dmp	xmrig
behavioral2/memory/1116-3189-0x00007FF78ECE0000-0x00007FF78F0D2000-memory.dmp	xmrig
behavioral2/memory/1220-3201-0x00007FF6C8EA0000-0x00007FF6C9292000-memory.dmp	xmrig
behavioral2/memory/4992-3197-0x00007FF684500000-0x00007FF6848F2000-memory.dmp	xmrig
behavioral2/memory/2612-3267-0x00007FF7E45F0000-0x00007FF7E49E2000-memory.dmp	xmrig
behavioral2/memory/3200-3278-0x00007FF7C59A0000-0x00007FF7C5D92000-memory.dmp	xmrig
behavioral2/memory/5100-3280-0x00007FF6A1AF0000-0x00007FF6A1EE2000-memory.dmp	xmrig
behavioral2/memory/4396-3273-0x00007FF61EB00000-0x00007FF61EEF2000-memory.dmp	xmrig
behavioral2/memory/3716-3254-0x00007FF70DA90000-0x00007FF70DE82000-memory.dmp	xmrig
behavioral2/memory/4576-3244-0x00007FF6A8320000-0x00007FF6A8712000-memory.dmp	xmrig
behavioral2/memory/2900-3208-0x00007FF77FF40000-0x00007FF780332000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

6 1080 powershell.exe
9 1080 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1080 powershell.exe

flow	pid	process
6	1080	powershell.exe
9	1080	powershell.exe

pid	process
1080	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

xMPZIHk.exelihFQpZ.exeTSSRNly.exeuXRJXuv.exeUHjNCfH.exeheJdLuE.exeIjKwPOY.exeCXJCciG.exeIAvgvmO.exeygYSlyg.exepepEBKI.exeSVsWGmB.exeArVzNGh.exeYMWIIfQ.exeybgGoNe.exeEOWSHdT.exeQFvGJpB.exeLwmVcGF.exeudPIIQe.exedNncXEg.exejTdAmBC.exeAiDvvGy.exeYOiRNdW.exeUSkTOwm.exeKJOjKxn.exexPJAPmi.exekmCNTGi.exeFIUcVeD.exefvkYsZD.exelxJoGxS.exevrBDnvx.exeEGHXGep.exenpRDeul.execAemZRd.exeHiLrOwC.exeJfSuZRk.exeSMaTCnG.exeOULcVwa.exeYPQkpBP.exeMruLLQt.execKczylW.exeSPLneXX.exeQMvtEEX.exeZczCCzA.exeGrIelyo.exekVUjGDZ.exenqNcRGi.exebFTRygd.exehVrtBEB.exetmbDvsS.exeOucsIWw.exegwHmtES.exewysVXJJ.exewGQnnEs.exeEJcgmvG.exeLiTKpJS.exeVmCmGVB.exeqmzGOfF.exeMxeUyjw.exeiqlRiEP.exewzTPOLP.exeQmhDbHr.exeHfNJrlU.exeBnXgbUn.exe

pid	process
4868	xMPZIHk.exe
3160	lihFQpZ.exe
2040	TSSRNly.exe
1844	uXRJXuv.exe
3664	UHjNCfH.exe
3452	heJdLuE.exe
4836	IjKwPOY.exe
4684	CXJCciG.exe
2364	IAvgvmO.exe
2988	ygYSlyg.exe
2840	pepEBKI.exe
2844	SVsWGmB.exe
5084	ArVzNGh.exe
1116	YMWIIfQ.exe
1220	ybgGoNe.exe
4992	EOWSHdT.exe
2900	QFvGJpB.exe
4576	LwmVcGF.exe
408	udPIIQe.exe
3716	dNncXEg.exe
3200	jTdAmBC.exe
2612	AiDvvGy.exe
4396	YOiRNdW.exe
5100	USkTOwm.exe
4244	KJOjKxn.exe
2180	xPJAPmi.exe
4856	kmCNTGi.exe
3968	FIUcVeD.exe
2224	fvkYsZD.exe
3116	lxJoGxS.exe
4904	vrBDnvx.exe
4548	EGHXGep.exe
4032	npRDeul.exe
2108	cAemZRd.exe
4792	HiLrOwC.exe
4984	JfSuZRk.exe
4696	SMaTCnG.exe
4028	OULcVwa.exe
872	YPQkpBP.exe
2228	MruLLQt.exe
4068	cKczylW.exe
3128	SPLneXX.exe
4428	QMvtEEX.exe
4440	ZczCCzA.exe
5028	GrIelyo.exe
4812	kVUjGDZ.exe
2012	nqNcRGi.exe
4564	bFTRygd.exe
4980	hVrtBEB.exe
3056	tmbDvsS.exe
1304	OucsIWw.exe
5020	gwHmtES.exe
5072	wysVXJJ.exe
4824	wGQnnEs.exe
4708	EJcgmvG.exe
1680	LiTKpJS.exe
1360	VmCmGVB.exe
5052	qmzGOfF.exe
5116	MxeUyjw.exe
4604	iqlRiEP.exe
4936	wzTPOLP.exe
2068	QmhDbHr.exe
2112	HfNJrlU.exe
4964	BnXgbUn.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

5 raw.githubusercontent.com
6 raw.githubusercontent.com

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3952-0-0x00007FF69CCF0000-0x00007FF69D0E2000-memory.dmp	upx
C:\Windows\System\xMPZIHk.exe	upx
C:\Windows\System\TSSRNly.exe	upx
behavioral2/memory/4868-18-0x00007FF7AD7A0000-0x00007FF7ADB92000-memory.dmp	upx
C:\Windows\System\IjKwPOY.exe	upx
C:\Windows\System\IAvgvmO.exe	upx
C:\Windows\System\ygYSlyg.exe	upx
behavioral2/memory/4836-65-0x00007FF75D180000-0x00007FF75D572000-memory.dmp	upx
behavioral2/memory/2364-70-0x00007FF7F35C0000-0x00007FF7F39B2000-memory.dmp	upx
behavioral2/memory/2840-74-0x00007FF73D5B0000-0x00007FF73D9A2000-memory.dmp	upx
behavioral2/memory/1116-99-0x00007FF78ECE0000-0x00007FF78F0D2000-memory.dmp	upx
C:\Windows\System\dNncXEg.exe	upx
C:\Windows\System\jTdAmBC.exe	upx
C:\Windows\System\lxJoGxS.exe	upx
C:\Windows\System\npRDeul.exe	upx
C:\Windows\System\vrBDnvx.exe	upx
C:\Windows\System\EGHXGep.exe	upx
C:\Windows\System\fvkYsZD.exe	upx
C:\Windows\System\FIUcVeD.exe	upx
C:\Windows\System\kmCNTGi.exe	upx
C:\Windows\System\xPJAPmi.exe	upx
behavioral2/memory/5100-170-0x00007FF6A1AF0000-0x00007FF6A1EE2000-memory.dmp	upx
C:\Windows\System\KJOjKxn.exe	upx
behavioral2/memory/4396-164-0x00007FF61EB00000-0x00007FF61EEF2000-memory.dmp	upx
behavioral2/memory/2612-163-0x00007FF7E45F0000-0x00007FF7E49E2000-memory.dmp	upx
C:\Windows\System\USkTOwm.exe	upx
behavioral2/memory/3952-157-0x00007FF69CCF0000-0x00007FF69D0E2000-memory.dmp	upx
C:\Windows\System\YOiRNdW.exe	upx
behavioral2/memory/3200-151-0x00007FF7C59A0000-0x00007FF7C5D92000-memory.dmp	upx
C:\Windows\System\AiDvvGy.exe	upx
behavioral2/memory/3716-145-0x00007FF70DA90000-0x00007FF70DE82000-memory.dmp	upx
behavioral2/memory/408-139-0x00007FF77CA00000-0x00007FF77CDF2000-memory.dmp	upx
C:\Windows\System\udPIIQe.exe	upx
behavioral2/memory/4576-128-0x00007FF6A8320000-0x00007FF6A8712000-memory.dmp	upx
C:\Windows\System\LwmVcGF.exe	upx
behavioral2/memory/2900-122-0x00007FF77FF40000-0x00007FF780332000-memory.dmp	upx
C:\Windows\System\QFvGJpB.exe	upx
behavioral2/memory/4992-116-0x00007FF684500000-0x00007FF6848F2000-memory.dmp	upx
C:\Windows\System\EOWSHdT.exe	upx
C:\Windows\System\ybgGoNe.exe	upx
behavioral2/memory/1220-105-0x00007FF6C8EA0000-0x00007FF6C9292000-memory.dmp	upx
C:\Windows\System\YMWIIfQ.exe	upx
C:\Windows\System\ArVzNGh.exe	upx
behavioral2/memory/5084-90-0x00007FF77AC30000-0x00007FF77B022000-memory.dmp	upx
behavioral2/memory/2988-73-0x00007FF7A1760000-0x00007FF7A1B52000-memory.dmp	upx
behavioral2/memory/4684-72-0x00007FF750BC0000-0x00007FF750FB2000-memory.dmp	upx
behavioral2/memory/2844-71-0x00007FF71C980000-0x00007FF71CD72000-memory.dmp	upx
C:\Windows\System\SVsWGmB.exe	upx
C:\Windows\System\pepEBKI.exe	upx
behavioral2/memory/3452-62-0x00007FF742790000-0x00007FF742B82000-memory.dmp	upx
behavioral2/memory/3664-55-0x00007FF67E7A0000-0x00007FF67EB92000-memory.dmp	upx
C:\Windows\System\CXJCciG.exe	upx
C:\Windows\System\UHjNCfH.exe	upx
behavioral2/memory/1844-47-0x00007FF63F930000-0x00007FF63FD22000-memory.dmp	upx
C:\Windows\System\uXRJXuv.exe	upx
C:\Windows\System\lihFQpZ.exe	upx
behavioral2/memory/2040-36-0x00007FF6DB580000-0x00007FF6DB972000-memory.dmp	upx
behavioral2/memory/3160-35-0x00007FF67F6F0000-0x00007FF67FAE2000-memory.dmp	upx
C:\Windows\System\heJdLuE.exe	upx
behavioral2/memory/4868-816-0x00007FF7AD7A0000-0x00007FF7ADB92000-memory.dmp	upx
behavioral2/memory/2040-822-0x00007FF6DB580000-0x00007FF6DB972000-memory.dmp	upx
behavioral2/memory/3160-912-0x00007FF67F6F0000-0x00007FF67FAE2000-memory.dmp	upx
behavioral2/memory/5084-1395-0x00007FF77AC30000-0x00007FF77B022000-memory.dmp	upx
behavioral2/memory/1116-1398-0x00007FF78ECE0000-0x00007FF78F0D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

Processes:

c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe

description	ioc	process
File created	C:\Windows\System\CtttKaI.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\gEwCVHt.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\PxPeYwz.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\AsxZDwr.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\kNRfVoo.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\gkKhUEY.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\pvVtafz.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\gOeWoKs.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\aiFtLYX.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\xhVIfUU.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\SmLxZHb.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\cMBlwoD.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\FzFGiWl.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\MBUtlQO.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\TSSRNly.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\wbpLWbh.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\bZGfsKW.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\SwaLscM.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\UTAaEHw.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\hRAqMvI.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\rtbzxwC.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\eXjbSWZ.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\OucsIWw.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\GExYXIe.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\jfkFhcJ.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\ESLyijT.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\HEVomOG.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\eTgtKPe.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\bFTRygd.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\sNYwnMW.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\vrFbOwC.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\bFrBZbu.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\wmRAdSz.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\jCVxeXp.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\GBqrVCQ.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\KAXyjTf.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\PJntYTu.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\raOJOoL.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\CEWDKlO.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\ZiwtSIJ.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\DSwvUlA.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\ExaqCWr.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\jChoTkv.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\vVMWCld.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\YZeWOVt.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\adxkfMi.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\ypoAajh.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\vZMKSZg.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\oHhHNFl.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\FkyNCDJ.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\tYYdzWu.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\BzPDICr.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\AnWKFwQ.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\wsUWNHD.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\WjNJyZx.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\qQNczdx.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\UNGWSeX.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\xlerwfD.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\AlWgjlN.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\VCXxvMe.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\ieYxiSl.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\vCSawoe.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\khKxyNv.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
File created	C:\Windows\System\fJTmwzH.exe	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wermgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

wermgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1080 powershell.exe
1080 powershell.exe

pid	process
1080	powershell.exe
1080	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeLockMemoryPrivilege	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe

description	pid	process	target process
PID 3952 wrote to memory of 1080	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	powershell.exe
PID 3952 wrote to memory of 1080	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	powershell.exe
PID 3952 wrote to memory of 4868	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	xMPZIHk.exe
PID 3952 wrote to memory of 4868	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	xMPZIHk.exe
PID 3952 wrote to memory of 3160	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	lihFQpZ.exe
PID 3952 wrote to memory of 3160	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	lihFQpZ.exe
PID 3952 wrote to memory of 2040	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	TSSRNly.exe
PID 3952 wrote to memory of 2040	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	TSSRNly.exe
PID 3952 wrote to memory of 1844	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	uXRJXuv.exe
PID 3952 wrote to memory of 1844	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	uXRJXuv.exe
PID 3952 wrote to memory of 3664	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	UHjNCfH.exe
PID 3952 wrote to memory of 3664	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	UHjNCfH.exe
PID 3952 wrote to memory of 3452	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	heJdLuE.exe
PID 3952 wrote to memory of 3452	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	heJdLuE.exe
PID 3952 wrote to memory of 4836	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	IjKwPOY.exe
PID 3952 wrote to memory of 4836	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	IjKwPOY.exe
PID 3952 wrote to memory of 2364	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	IAvgvmO.exe
PID 3952 wrote to memory of 2364	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	IAvgvmO.exe
PID 3952 wrote to memory of 4684	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	CXJCciG.exe
PID 3952 wrote to memory of 4684	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	CXJCciG.exe
PID 3952 wrote to memory of 2988	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	ygYSlyg.exe
PID 3952 wrote to memory of 2988	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	ygYSlyg.exe
PID 3952 wrote to memory of 2840	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	pepEBKI.exe
PID 3952 wrote to memory of 2840	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	pepEBKI.exe
PID 3952 wrote to memory of 2844	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	SVsWGmB.exe
PID 3952 wrote to memory of 2844	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	SVsWGmB.exe
PID 3952 wrote to memory of 5084	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	ArVzNGh.exe
PID 3952 wrote to memory of 5084	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	ArVzNGh.exe
PID 3952 wrote to memory of 1116	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	YMWIIfQ.exe
PID 3952 wrote to memory of 1116	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	YMWIIfQ.exe
PID 3952 wrote to memory of 1220	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	ybgGoNe.exe
PID 3952 wrote to memory of 1220	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	ybgGoNe.exe
PID 3952 wrote to memory of 4992	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	EOWSHdT.exe
PID 3952 wrote to memory of 4992	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	EOWSHdT.exe
PID 3952 wrote to memory of 2900	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	QFvGJpB.exe
PID 3952 wrote to memory of 2900	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	QFvGJpB.exe
PID 3952 wrote to memory of 4576	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	LwmVcGF.exe
PID 3952 wrote to memory of 4576	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	LwmVcGF.exe
PID 3952 wrote to memory of 408	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	udPIIQe.exe
PID 3952 wrote to memory of 408	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	udPIIQe.exe
PID 3952 wrote to memory of 3716	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	dNncXEg.exe
PID 3952 wrote to memory of 3716	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	dNncXEg.exe
PID 3952 wrote to memory of 3200	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	jTdAmBC.exe
PID 3952 wrote to memory of 3200	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	jTdAmBC.exe
PID 3952 wrote to memory of 2612	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	AiDvvGy.exe
PID 3952 wrote to memory of 2612	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	AiDvvGy.exe
PID 3952 wrote to memory of 4396	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	YOiRNdW.exe
PID 3952 wrote to memory of 4396	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	YOiRNdW.exe
PID 3952 wrote to memory of 5100	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	USkTOwm.exe
PID 3952 wrote to memory of 5100	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	USkTOwm.exe
PID 3952 wrote to memory of 4244	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	KJOjKxn.exe
PID 3952 wrote to memory of 4244	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	KJOjKxn.exe
PID 3952 wrote to memory of 2180	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	xPJAPmi.exe
PID 3952 wrote to memory of 2180	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	xPJAPmi.exe
PID 3952 wrote to memory of 4856	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	kmCNTGi.exe
PID 3952 wrote to memory of 4856	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	kmCNTGi.exe
PID 3952 wrote to memory of 3968	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	FIUcVeD.exe
PID 3952 wrote to memory of 3968	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	FIUcVeD.exe
PID 3952 wrote to memory of 2224	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	fvkYsZD.exe
PID 3952 wrote to memory of 2224	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	fvkYsZD.exe
PID 3952 wrote to memory of 3116	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	lxJoGxS.exe
PID 3952 wrote to memory of 3116	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	lxJoGxS.exe
PID 3952 wrote to memory of 4904	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	vrBDnvx.exe
PID 3952 wrote to memory of 4904	3952	c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe	vrBDnvx.exe

C:\Users\Admin\AppData\Local\Temp\c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe
"C:\Users\Admin\AppData\Local\Temp\c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1080
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1080" "2936" "2792" "2940" "0" "0" "2944" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:14208
- C:\Windows\System\xMPZIHk.exe
  C:\Windows\System\xMPZIHk.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\lihFQpZ.exe
  C:\Windows\System\lihFQpZ.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\TSSRNly.exe
  C:\Windows\System\TSSRNly.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\uXRJXuv.exe
  C:\Windows\System\uXRJXuv.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\UHjNCfH.exe
  C:\Windows\System\UHjNCfH.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\heJdLuE.exe
  C:\Windows\System\heJdLuE.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\IjKwPOY.exe
  C:\Windows\System\IjKwPOY.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\IAvgvmO.exe
  C:\Windows\System\IAvgvmO.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\CXJCciG.exe
  C:\Windows\System\CXJCciG.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\ygYSlyg.exe
  C:\Windows\System\ygYSlyg.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\pepEBKI.exe
  C:\Windows\System\pepEBKI.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\SVsWGmB.exe
  C:\Windows\System\SVsWGmB.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\ArVzNGh.exe
  C:\Windows\System\ArVzNGh.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\YMWIIfQ.exe
  C:\Windows\System\YMWIIfQ.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\ybgGoNe.exe
  C:\Windows\System\ybgGoNe.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\EOWSHdT.exe
  C:\Windows\System\EOWSHdT.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\QFvGJpB.exe
  C:\Windows\System\QFvGJpB.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\LwmVcGF.exe
  C:\Windows\System\LwmVcGF.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\udPIIQe.exe
  C:\Windows\System\udPIIQe.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\dNncXEg.exe
  C:\Windows\System\dNncXEg.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\jTdAmBC.exe
  C:\Windows\System\jTdAmBC.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\AiDvvGy.exe
  C:\Windows\System\AiDvvGy.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\YOiRNdW.exe
  C:\Windows\System\YOiRNdW.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\USkTOwm.exe
  C:\Windows\System\USkTOwm.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\KJOjKxn.exe
  C:\Windows\System\KJOjKxn.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\xPJAPmi.exe
  C:\Windows\System\xPJAPmi.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\kmCNTGi.exe
  C:\Windows\System\kmCNTGi.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\FIUcVeD.exe
  C:\Windows\System\FIUcVeD.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\fvkYsZD.exe
  C:\Windows\System\fvkYsZD.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\lxJoGxS.exe
  C:\Windows\System\lxJoGxS.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\vrBDnvx.exe
  C:\Windows\System\vrBDnvx.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\EGHXGep.exe
  C:\Windows\System\EGHXGep.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\npRDeul.exe
  C:\Windows\System\npRDeul.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\cAemZRd.exe
  C:\Windows\System\cAemZRd.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\HiLrOwC.exe
  C:\Windows\System\HiLrOwC.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\JfSuZRk.exe
  C:\Windows\System\JfSuZRk.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\SMaTCnG.exe
  C:\Windows\System\SMaTCnG.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\OULcVwa.exe
  C:\Windows\System\OULcVwa.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\YPQkpBP.exe
  C:\Windows\System\YPQkpBP.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\MruLLQt.exe
  C:\Windows\System\MruLLQt.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\cKczylW.exe
  C:\Windows\System\cKczylW.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\SPLneXX.exe
  C:\Windows\System\SPLneXX.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\QMvtEEX.exe
  C:\Windows\System\QMvtEEX.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\ZczCCzA.exe
  C:\Windows\System\ZczCCzA.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\GrIelyo.exe
  C:\Windows\System\GrIelyo.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\kVUjGDZ.exe
  C:\Windows\System\kVUjGDZ.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\nqNcRGi.exe
  C:\Windows\System\nqNcRGi.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\bFTRygd.exe
  C:\Windows\System\bFTRygd.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\hVrtBEB.exe
  C:\Windows\System\hVrtBEB.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\tmbDvsS.exe
  C:\Windows\System\tmbDvsS.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\OucsIWw.exe
  C:\Windows\System\OucsIWw.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\gwHmtES.exe
  C:\Windows\System\gwHmtES.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\wysVXJJ.exe
  C:\Windows\System\wysVXJJ.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\wGQnnEs.exe
  C:\Windows\System\wGQnnEs.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\EJcgmvG.exe
  C:\Windows\System\EJcgmvG.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\LiTKpJS.exe
  C:\Windows\System\LiTKpJS.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\VmCmGVB.exe
  C:\Windows\System\VmCmGVB.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\qmzGOfF.exe
  C:\Windows\System\qmzGOfF.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\MxeUyjw.exe
  C:\Windows\System\MxeUyjw.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\iqlRiEP.exe
  C:\Windows\System\iqlRiEP.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\wzTPOLP.exe
  C:\Windows\System\wzTPOLP.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\QmhDbHr.exe
  C:\Windows\System\QmhDbHr.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\HfNJrlU.exe
  C:\Windows\System\HfNJrlU.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\BnXgbUn.exe
  C:\Windows\System\BnXgbUn.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\ULyHxKy.exe
  C:\Windows\System\ULyHxKy.exe
  2⤵
  PID:2620
- C:\Windows\System\pIUinmL.exe
  C:\Windows\System\pIUinmL.exe
  2⤵
  PID:560
- C:\Windows\System\OLoHMQa.exe
  C:\Windows\System\OLoHMQa.exe
  2⤵
  PID:3088
- C:\Windows\System\MAxotZV.exe
  C:\Windows\System\MAxotZV.exe
  2⤵
  PID:1040
- C:\Windows\System\GBxwmnv.exe
  C:\Windows\System\GBxwmnv.exe
  2⤵
  PID:3168
- C:\Windows\System\aKnMhbm.exe
  C:\Windows\System\aKnMhbm.exe
  2⤵
  PID:1624
- C:\Windows\System\mljZhcN.exe
  C:\Windows\System\mljZhcN.exe
  2⤵
  PID:2408
- C:\Windows\System\dyoNDaZ.exe
  C:\Windows\System\dyoNDaZ.exe
  2⤵
  PID:2856
- C:\Windows\System\KidoIXX.exe
  C:\Windows\System\KidoIXX.exe
  2⤵
  PID:2144
- C:\Windows\System\hPpoyjn.exe
  C:\Windows\System\hPpoyjn.exe
  2⤵
  PID:1572
- C:\Windows\System\LukUeqz.exe
  C:\Windows\System\LukUeqz.exe
  2⤵
  PID:5124
- C:\Windows\System\bTgeHhl.exe
  C:\Windows\System\bTgeHhl.exe
  2⤵
  PID:5152
- C:\Windows\System\LfgTNTL.exe
  C:\Windows\System\LfgTNTL.exe
  2⤵
  PID:5180
- C:\Windows\System\sXYOYFD.exe
  C:\Windows\System\sXYOYFD.exe
  2⤵
  PID:5204
- C:\Windows\System\BfaGfLQ.exe
  C:\Windows\System\BfaGfLQ.exe
  2⤵
  PID:5236
- C:\Windows\System\CCuzcFH.exe
  C:\Windows\System\CCuzcFH.exe
  2⤵
  PID:5264
- C:\Windows\System\xeoMSjg.exe
  C:\Windows\System\xeoMSjg.exe
  2⤵
  PID:5288
- C:\Windows\System\TgiOZaQ.exe
  C:\Windows\System\TgiOZaQ.exe
  2⤵
  PID:5320
- C:\Windows\System\raUkyAH.exe
  C:\Windows\System\raUkyAH.exe
  2⤵
  PID:5348
- C:\Windows\System\RGzAnUm.exe
  C:\Windows\System\RGzAnUm.exe
  2⤵
  PID:5376
- C:\Windows\System\feotGrl.exe
  C:\Windows\System\feotGrl.exe
  2⤵
  PID:5404
- C:\Windows\System\hwMWERV.exe
  C:\Windows\System\hwMWERV.exe
  2⤵
  PID:5440
- C:\Windows\System\YLsyXLC.exe
  C:\Windows\System\YLsyXLC.exe
  2⤵
  PID:5460
- C:\Windows\System\gTWUMrk.exe
  C:\Windows\System\gTWUMrk.exe
  2⤵
  PID:5488
- C:\Windows\System\PSCWPpG.exe
  C:\Windows\System\PSCWPpG.exe
  2⤵
  PID:5516
- C:\Windows\System\sZBifcW.exe
  C:\Windows\System\sZBifcW.exe
  2⤵
  PID:5544
- C:\Windows\System\fVwOrva.exe
  C:\Windows\System\fVwOrva.exe
  2⤵
  PID:5572
- C:\Windows\System\UtEgrEF.exe
  C:\Windows\System\UtEgrEF.exe
  2⤵
  PID:5600
- C:\Windows\System\lmFjWQJ.exe
  C:\Windows\System\lmFjWQJ.exe
  2⤵
  PID:5636
- C:\Windows\System\KbvSWlo.exe
  C:\Windows\System\KbvSWlo.exe
  2⤵
  PID:5664
- C:\Windows\System\zoapFgs.exe
  C:\Windows\System\zoapFgs.exe
  2⤵
  PID:5688
- C:\Windows\System\ojXrzTQ.exe
  C:\Windows\System\ojXrzTQ.exe
  2⤵
  PID:5712
- C:\Windows\System\mWAdToE.exe
  C:\Windows\System\mWAdToE.exe
  2⤵
  PID:5740
- C:\Windows\System\dwyhBNx.exe
  C:\Windows\System\dwyhBNx.exe
  2⤵
  PID:5772
- C:\Windows\System\fNZyuOo.exe
  C:\Windows\System\fNZyuOo.exe
  2⤵
  PID:5796
- C:\Windows\System\SmuNcyr.exe
  C:\Windows\System\SmuNcyr.exe
  2⤵
  PID:5824
- C:\Windows\System\jCExJJe.exe
  C:\Windows\System\jCExJJe.exe
  2⤵
  PID:5848
- C:\Windows\System\BNtXHDR.exe
  C:\Windows\System\BNtXHDR.exe
  2⤵
  PID:5880
- C:\Windows\System\TMUnhzX.exe
  C:\Windows\System\TMUnhzX.exe
  2⤵
  PID:5908
- C:\Windows\System\CUUcpci.exe
  C:\Windows\System\CUUcpci.exe
  2⤵
  PID:5936
- C:\Windows\System\ZwuoxDZ.exe
  C:\Windows\System\ZwuoxDZ.exe
  2⤵
  PID:5964
- C:\Windows\System\QugEvyW.exe
  C:\Windows\System\QugEvyW.exe
  2⤵
  PID:5992
- C:\Windows\System\kohggGx.exe
  C:\Windows\System\kohggGx.exe
  2⤵
  PID:6020
- C:\Windows\System\wmRAdSz.exe
  C:\Windows\System\wmRAdSz.exe
  2⤵
  PID:6048
- C:\Windows\System\qxFvzec.exe
  C:\Windows\System\qxFvzec.exe
  2⤵
  PID:6076
- C:\Windows\System\VQckddn.exe
  C:\Windows\System\VQckddn.exe
  2⤵
  PID:6104
- C:\Windows\System\mjuzdXp.exe
  C:\Windows\System\mjuzdXp.exe
  2⤵
  PID:6132
- C:\Windows\System\AlWgjlN.exe
  C:\Windows\System\AlWgjlN.exe
  2⤵
  PID:3028
- C:\Windows\System\dPdSOkK.exe
  C:\Windows\System\dPdSOkK.exe
  2⤵
  PID:2280
- C:\Windows\System\ZIYBJHH.exe
  C:\Windows\System\ZIYBJHH.exe
  2⤵
  PID:4404
- C:\Windows\System\nhXEEBj.exe
  C:\Windows\System\nhXEEBj.exe
  2⤵
  PID:1308
- C:\Windows\System\fmoahuQ.exe
  C:\Windows\System\fmoahuQ.exe
  2⤵
  PID:2460
- C:\Windows\System\uVaNLQw.exe
  C:\Windows\System\uVaNLQw.exe
  2⤵
  PID:2404
- C:\Windows\System\ZSFRFxF.exe
  C:\Windows\System\ZSFRFxF.exe
  2⤵
  PID:5144
- C:\Windows\System\MhYXOBR.exe
  C:\Windows\System\MhYXOBR.exe
  2⤵
  PID:5196
- C:\Windows\System\gVyrgPG.exe
  C:\Windows\System\gVyrgPG.exe
  2⤵
  PID:5256
- C:\Windows\System\UHEKxKj.exe
  C:\Windows\System\UHEKxKj.exe
  2⤵
  PID:5308
- C:\Windows\System\UxSnFVE.exe
  C:\Windows\System\UxSnFVE.exe
  2⤵
  PID:5368
- C:\Windows\System\tgoPRVs.exe
  C:\Windows\System\tgoPRVs.exe
  2⤵
  PID:5424
- C:\Windows\System\eXjbSWZ.exe
  C:\Windows\System\eXjbSWZ.exe
  2⤵
  PID:5480
- C:\Windows\System\rLJUGOr.exe
  C:\Windows\System\rLJUGOr.exe
  2⤵
  PID:5536
- C:\Windows\System\bTaTCkM.exe
  C:\Windows\System\bTaTCkM.exe
  2⤵
  PID:5612
- C:\Windows\System\DKhDKkZ.exe
  C:\Windows\System\DKhDKkZ.exe
  2⤵
  PID:5676
- C:\Windows\System\IUXnjDW.exe
  C:\Windows\System\IUXnjDW.exe
  2⤵
  PID:5728
- C:\Windows\System\zpMBbym.exe
  C:\Windows\System\zpMBbym.exe
  2⤵
  PID:5792
- C:\Windows\System\vmdNRGG.exe
  C:\Windows\System\vmdNRGG.exe
  2⤵
  PID:5844
- C:\Windows\System\OknzqOR.exe
  C:\Windows\System\OknzqOR.exe
  2⤵
  PID:5920
- C:\Windows\System\gIpbJxp.exe
  C:\Windows\System\gIpbJxp.exe
  2⤵
  PID:5984
- C:\Windows\System\IASAMmC.exe
  C:\Windows\System\IASAMmC.exe
  2⤵
  PID:6036
- C:\Windows\System\NxtLAkq.exe
  C:\Windows\System\NxtLAkq.exe
  2⤵
  PID:6116
- C:\Windows\System\eSJSLzF.exe
  C:\Windows\System\eSJSLzF.exe
  2⤵
  PID:1484
- C:\Windows\System\ztiYDZL.exe
  C:\Windows\System\ztiYDZL.exe
  2⤵
  PID:1712
- C:\Windows\System\tAZHelN.exe
  C:\Windows\System\tAZHelN.exe
  2⤵
  PID:4296
- C:\Windows\System\uHQbycB.exe
  C:\Windows\System\uHQbycB.exe
  2⤵
  PID:5168
- C:\Windows\System\HjeleCC.exe
  C:\Windows\System\HjeleCC.exe
  2⤵
  PID:5248
- C:\Windows\System\DUIzhsg.exe
  C:\Windows\System\DUIzhsg.exe
  2⤵
  PID:1548
- C:\Windows\System\DUWdFjJ.exe
  C:\Windows\System\DUWdFjJ.exe
  2⤵
  PID:2888
- C:\Windows\System\qRvENvN.exe
  C:\Windows\System\qRvENvN.exe
  2⤵
  PID:5656
- C:\Windows\System\AqLVTuw.exe
  C:\Windows\System\AqLVTuw.exe
  2⤵
  PID:5896
- C:\Windows\System\tKYhLci.exe
  C:\Windows\System\tKYhLci.exe
  2⤵
  PID:6064
- C:\Windows\System\wyiljti.exe
  C:\Windows\System\wyiljti.exe
  2⤵
  PID:4504
- C:\Windows\System\TsMokdj.exe
  C:\Windows\System\TsMokdj.exe
  2⤵
  PID:6156
- C:\Windows\System\MEjZgOp.exe
  C:\Windows\System\MEjZgOp.exe
  2⤵
  PID:6184
- C:\Windows\System\sNYwnMW.exe
  C:\Windows\System\sNYwnMW.exe
  2⤵
  PID:6204
- C:\Windows\System\MGNEFID.exe
  C:\Windows\System\MGNEFID.exe
  2⤵
  PID:6232
- C:\Windows\System\iRhPaQf.exe
  C:\Windows\System\iRhPaQf.exe
  2⤵
  PID:6260
- C:\Windows\System\KqSvBtw.exe
  C:\Windows\System\KqSvBtw.exe
  2⤵
  PID:6288
- C:\Windows\System\igSehVf.exe
  C:\Windows\System\igSehVf.exe
  2⤵
  PID:6316
- C:\Windows\System\MmKwJXY.exe
  C:\Windows\System\MmKwJXY.exe
  2⤵
  PID:6344
- C:\Windows\System\JtPqvop.exe
  C:\Windows\System\JtPqvop.exe
  2⤵
  PID:6368
- C:\Windows\System\WhwQdeW.exe
  C:\Windows\System\WhwQdeW.exe
  2⤵
  PID:6404
- C:\Windows\System\WJhFFaC.exe
  C:\Windows\System\WJhFFaC.exe
  2⤵
  PID:6436
- C:\Windows\System\tdkswTf.exe
  C:\Windows\System\tdkswTf.exe
  2⤵
  PID:6456
- C:\Windows\System\GHSMQyo.exe
  C:\Windows\System\GHSMQyo.exe
  2⤵
  PID:6484
- C:\Windows\System\iNWXZBO.exe
  C:\Windows\System\iNWXZBO.exe
  2⤵
  PID:6512
- C:\Windows\System\xZaQjUX.exe
  C:\Windows\System\xZaQjUX.exe
  2⤵
  PID:6540
- C:\Windows\System\QhzLWWZ.exe
  C:\Windows\System\QhzLWWZ.exe
  2⤵
  PID:6568
- C:\Windows\System\aVwZJhC.exe
  C:\Windows\System\aVwZJhC.exe
  2⤵
  PID:6596
- C:\Windows\System\AtqzFLV.exe
  C:\Windows\System\AtqzFLV.exe
  2⤵
  PID:6624
- C:\Windows\System\WjRnksE.exe
  C:\Windows\System\WjRnksE.exe
  2⤵
  PID:6652
- C:\Windows\System\ApXFfNp.exe
  C:\Windows\System\ApXFfNp.exe
  2⤵
  PID:6676
- C:\Windows\System\tmYuDqe.exe
  C:\Windows\System\tmYuDqe.exe
  2⤵
  PID:6704
- C:\Windows\System\xYoaCHu.exe
  C:\Windows\System\xYoaCHu.exe
  2⤵
  PID:6736
- C:\Windows\System\JWTYquG.exe
  C:\Windows\System\JWTYquG.exe
  2⤵
  PID:6764
- C:\Windows\System\utwoONf.exe
  C:\Windows\System\utwoONf.exe
  2⤵
  PID:6788
- C:\Windows\System\rHmyLol.exe
  C:\Windows\System\rHmyLol.exe
  2⤵
  PID:6816
- C:\Windows\System\ymiAjyE.exe
  C:\Windows\System\ymiAjyE.exe
  2⤵
  PID:6844
- C:\Windows\System\JqQKmpY.exe
  C:\Windows\System\JqQKmpY.exe
  2⤵
  PID:6872
- C:\Windows\System\zFHKgxc.exe
  C:\Windows\System\zFHKgxc.exe
  2⤵
  PID:6904
- C:\Windows\System\NsVEBbM.exe
  C:\Windows\System\NsVEBbM.exe
  2⤵
  PID:6932
- C:\Windows\System\kPDGpge.exe
  C:\Windows\System\kPDGpge.exe
  2⤵
  PID:6960
- C:\Windows\System\ZCXKSds.exe
  C:\Windows\System\ZCXKSds.exe
  2⤵
  PID:6984
- C:\Windows\System\NAfLIhA.exe
  C:\Windows\System\NAfLIhA.exe
  2⤵
  PID:7016
- C:\Windows\System\mfXkuKU.exe
  C:\Windows\System\mfXkuKU.exe
  2⤵
  PID:7040
- C:\Windows\System\lRTmzHT.exe
  C:\Windows\System\lRTmzHT.exe
  2⤵
  PID:7068
- C:\Windows\System\iLoiGoB.exe
  C:\Windows\System\iLoiGoB.exe
  2⤵
  PID:7096
- C:\Windows\System\mpSDFWL.exe
  C:\Windows\System\mpSDFWL.exe
  2⤵
  PID:7124
- C:\Windows\System\EsCaIjX.exe
  C:\Windows\System\EsCaIjX.exe
  2⤵
  PID:7152
- C:\Windows\System\YcEeIXq.exe
  C:\Windows\System\YcEeIXq.exe
  2⤵
  PID:4084
- C:\Windows\System\SdDqbQX.exe
  C:\Windows\System\SdDqbQX.exe
  2⤵
  PID:3592
- C:\Windows\System\jeaGNnz.exe
  C:\Windows\System\jeaGNnz.exe
  2⤵
  PID:5584
- C:\Windows\System\HEXewbs.exe
  C:\Windows\System\HEXewbs.exe
  2⤵
  PID:5760
- C:\Windows\System\LFjAXhM.exe
  C:\Windows\System\LFjAXhM.exe
  2⤵
  PID:1444
- C:\Windows\System\OydpLEZ.exe
  C:\Windows\System\OydpLEZ.exe
  2⤵
  PID:4256
- C:\Windows\System\cxmlVjH.exe
  C:\Windows\System\cxmlVjH.exe
  2⤵
  PID:6224
- C:\Windows\System\hDWXGRn.exe
  C:\Windows\System\hDWXGRn.exe
  2⤵
  PID:6280
- C:\Windows\System\CAJNmbb.exe
  C:\Windows\System\CAJNmbb.exe
  2⤵
  PID:6332
- C:\Windows\System\UiVafFl.exe
  C:\Windows\System\UiVafFl.exe
  2⤵
  PID:4744
- C:\Windows\System\JZfHnjk.exe
  C:\Windows\System\JZfHnjk.exe
  2⤵
  PID:6428
- C:\Windows\System\JVcayVt.exe
  C:\Windows\System\JVcayVt.exe
  2⤵
  PID:6468
- C:\Windows\System\MrJIiiR.exe
  C:\Windows\System\MrJIiiR.exe
  2⤵
  PID:6528
- C:\Windows\System\YnQllxI.exe
  C:\Windows\System\YnQllxI.exe
  2⤵
  PID:6580
- C:\Windows\System\EHFHKAK.exe
  C:\Windows\System\EHFHKAK.exe
  2⤵
  PID:6636
- C:\Windows\System\gPYmIac.exe
  C:\Windows\System\gPYmIac.exe
  2⤵
  PID:6672
- C:\Windows\System\OeXuPnG.exe
  C:\Windows\System\OeXuPnG.exe
  2⤵
  PID:1328
- C:\Windows\System\HZyAdCi.exe
  C:\Windows\System\HZyAdCi.exe
  2⤵
  PID:6752
- C:\Windows\System\rUBZscy.exe
  C:\Windows\System\rUBZscy.exe
  2⤵
  PID:1652
- C:\Windows\System\zAFZSDs.exe
  C:\Windows\System\zAFZSDs.exe
  2⤵
  PID:764
- C:\Windows\System\zUSQlXx.exe
  C:\Windows\System\zUSQlXx.exe
  2⤵
  PID:4124
- C:\Windows\System\KQlrQXc.exe
  C:\Windows\System\KQlrQXc.exe
  2⤵
  PID:6916
- C:\Windows\System\xGdsUBP.exe
  C:\Windows\System\xGdsUBP.exe
  2⤵
  PID:6972
- C:\Windows\System\wlNaPGA.exe
  C:\Windows\System\wlNaPGA.exe
  2⤵
  PID:7028
- C:\Windows\System\STcfUFW.exe
  C:\Windows\System\STcfUFW.exe
  2⤵
  PID:7092
- C:\Windows\System\pjEeiFe.exe
  C:\Windows\System\pjEeiFe.exe
  2⤵
  PID:7148
- C:\Windows\System\jkQGycO.exe
  C:\Windows\System\jkQGycO.exe
  2⤵
  PID:5452
- C:\Windows\System\IdxhPia.exe
  C:\Windows\System\IdxhPia.exe
  2⤵
  PID:2344
- C:\Windows\System\rmZrATK.exe
  C:\Windows\System\rmZrATK.exe
  2⤵
  PID:6248
- C:\Windows\System\SMZTxsj.exe
  C:\Windows\System\SMZTxsj.exe
  2⤵
  PID:6360
- C:\Windows\System\yqppTvG.exe
  C:\Windows\System\yqppTvG.exe
  2⤵
  PID:6452
- C:\Windows\System\tJbRNEK.exe
  C:\Windows\System\tJbRNEK.exe
  2⤵
  PID:6556
- C:\Windows\System\zoAjdUk.exe
  C:\Windows\System\zoAjdUk.exe
  2⤵
  PID:6696
- C:\Windows\System\UKghylu.exe
  C:\Windows\System\UKghylu.exe
  2⤵
  PID:4368
- C:\Windows\System\wtGSfwj.exe
  C:\Windows\System\wtGSfwj.exe
  2⤵
  PID:6860
- C:\Windows\System\PcDANad.exe
  C:\Windows\System\PcDANad.exe
  2⤵
  PID:7000
- C:\Windows\System\LeHXTrW.exe
  C:\Windows\System\LeHXTrW.exe
  2⤵
  PID:7140
- C:\Windows\System\XEptZVt.exe
  C:\Windows\System\XEptZVt.exe
  2⤵
  PID:6180
- C:\Windows\System\SIuTsXd.exe
  C:\Windows\System\SIuTsXd.exe
  2⤵
  PID:6400
- C:\Windows\System\iWMqSMG.exe
  C:\Windows\System\iWMqSMG.exe
  2⤵
  PID:2428
- C:\Windows\System\dzaAVKR.exe
  C:\Windows\System\dzaAVKR.exe
  2⤵
  PID:2216
- C:\Windows\System\rbfjvyu.exe
  C:\Windows\System\rbfjvyu.exe
  2⤵
  PID:7064
- C:\Windows\System\mDeZmdI.exe
  C:\Windows\System\mDeZmdI.exe
  2⤵
  PID:6328
- C:\Windows\System\ROsOTbX.exe
  C:\Windows\System\ROsOTbX.exe
  2⤵
  PID:7196
- C:\Windows\System\ihRNALv.exe
  C:\Windows\System\ihRNALv.exe
  2⤵
  PID:7292
- C:\Windows\System\BLhRRjg.exe
  C:\Windows\System\BLhRRjg.exe
  2⤵
  PID:7356
- C:\Windows\System\aBlWIAx.exe
  C:\Windows\System\aBlWIAx.exe
  2⤵
  PID:7392
- C:\Windows\System\jtSEHiB.exe
  C:\Windows\System\jtSEHiB.exe
  2⤵
  PID:7484
- C:\Windows\System\eDMcZvS.exe
  C:\Windows\System\eDMcZvS.exe
  2⤵
  PID:7500
- C:\Windows\System\JksFfbP.exe
  C:\Windows\System\JksFfbP.exe
  2⤵
  PID:7536
- C:\Windows\System\CoOwnIn.exe
  C:\Windows\System\CoOwnIn.exe
  2⤵
  PID:7568
- C:\Windows\System\zoamOkk.exe
  C:\Windows\System\zoamOkk.exe
  2⤵
  PID:7584
- C:\Windows\System\FXpeuFP.exe
  C:\Windows\System\FXpeuFP.exe
  2⤵
  PID:7600
- C:\Windows\System\SpCIApo.exe
  C:\Windows\System\SpCIApo.exe
  2⤵
  PID:7616
- C:\Windows\System\NVAOIjc.exe
  C:\Windows\System\NVAOIjc.exe
  2⤵
  PID:7636
- C:\Windows\System\woRzhar.exe
  C:\Windows\System\woRzhar.exe
  2⤵
  PID:7652
- C:\Windows\System\ttZULuV.exe
  C:\Windows\System\ttZULuV.exe
  2⤵
  PID:7712
- C:\Windows\System\sfjNAgE.exe
  C:\Windows\System\sfjNAgE.exe
  2⤵
  PID:7732
- C:\Windows\System\zDBMHSt.exe
  C:\Windows\System\zDBMHSt.exe
  2⤵
  PID:7748
- C:\Windows\System\YGFJjyp.exe
  C:\Windows\System\YGFJjyp.exe
  2⤵
  PID:7772
- C:\Windows\System\FOVpJnL.exe
  C:\Windows\System\FOVpJnL.exe
  2⤵
  PID:7820
- C:\Windows\System\MfxlcPA.exe
  C:\Windows\System\MfxlcPA.exe
  2⤵
  PID:7856
- C:\Windows\System\GmByLHh.exe
  C:\Windows\System\GmByLHh.exe
  2⤵
  PID:7908
- C:\Windows\System\rwYLPxY.exe
  C:\Windows\System\rwYLPxY.exe
  2⤵
  PID:7940
- C:\Windows\System\nmUYyLN.exe
  C:\Windows\System\nmUYyLN.exe
  2⤵
  PID:7984
- C:\Windows\System\lBeDNLE.exe
  C:\Windows\System\lBeDNLE.exe
  2⤵
  PID:8028
- C:\Windows\System\Aooanxy.exe
  C:\Windows\System\Aooanxy.exe
  2⤵
  PID:8048
- C:\Windows\System\IdmXOSg.exe
  C:\Windows\System\IdmXOSg.exe
  2⤵
  PID:8072
- C:\Windows\System\SegSUwM.exe
  C:\Windows\System\SegSUwM.exe
  2⤵
  PID:8092
- C:\Windows\System\wzsftzP.exe
  C:\Windows\System\wzsftzP.exe
  2⤵
  PID:8108
- C:\Windows\System\tfIxHvv.exe
  C:\Windows\System\tfIxHvv.exe
  2⤵
  PID:8140
- C:\Windows\System\iZDOvnE.exe
  C:\Windows\System\iZDOvnE.exe
  2⤵
  PID:8156
- C:\Windows\System\gUhCGrE.exe
  C:\Windows\System\gUhCGrE.exe
  2⤵
  PID:8180
- C:\Windows\System\dAZcTdc.exe
  C:\Windows\System\dAZcTdc.exe
  2⤵
  PID:6616
- C:\Windows\System\yBitDRp.exe
  C:\Windows\System\yBitDRp.exe
  2⤵
  PID:3780
- C:\Windows\System\IUlxSXs.exe
  C:\Windows\System\IUlxSXs.exe
  2⤵
  PID:3304
- C:\Windows\System\aeZXmtZ.exe
  C:\Windows\System\aeZXmtZ.exe
  2⤵
  PID:7180
- C:\Windows\System\zoMnvaA.exe
  C:\Windows\System\zoMnvaA.exe
  2⤵
  PID:748
- C:\Windows\System\ZfNvzcO.exe
  C:\Windows\System\ZfNvzcO.exe
  2⤵
  PID:3064
- C:\Windows\System\tXiIFYI.exe
  C:\Windows\System\tXiIFYI.exe
  2⤵
  PID:4552
- C:\Windows\System\hAiicfW.exe
  C:\Windows\System\hAiicfW.exe
  2⤵
  PID:4584
- C:\Windows\System\XVZyDjx.exe
  C:\Windows\System\XVZyDjx.exe
  2⤵
  PID:7308
- C:\Windows\System\FLKqEzB.exe
  C:\Windows\System\FLKqEzB.exe
  2⤵
  PID:7344
- C:\Windows\System\CaJUQov.exe
  C:\Windows\System\CaJUQov.exe
  2⤵
  PID:7380
- C:\Windows\System\gTMZLMY.exe
  C:\Windows\System\gTMZLMY.exe
  2⤵
  PID:7480
- C:\Windows\System\FGpDVYP.exe
  C:\Windows\System\FGpDVYP.exe
  2⤵
  PID:7448
- C:\Windows\System\kYDBqKJ.exe
  C:\Windows\System\kYDBqKJ.exe
  2⤵
  PID:7524
- C:\Windows\System\VsoXjJe.exe
  C:\Windows\System\VsoXjJe.exe
  2⤵
  PID:7708
- C:\Windows\System\jyORqxL.exe
  C:\Windows\System\jyORqxL.exe
  2⤵
  PID:7644
- C:\Windows\System\exbPExj.exe
  C:\Windows\System\exbPExj.exe
  2⤵
  PID:7844
- C:\Windows\System\FVWiZzT.exe
  C:\Windows\System\FVWiZzT.exe
  2⤵
  PID:7756
- C:\Windows\System\DrHPdml.exe
  C:\Windows\System\DrHPdml.exe
  2⤵
  PID:7888
- C:\Windows\System\zpkIQjc.exe
  C:\Windows\System\zpkIQjc.exe
  2⤵
  PID:7904
- C:\Windows\System\MYOicpf.exe
  C:\Windows\System\MYOicpf.exe
  2⤵
  PID:8004
- C:\Windows\System\xfyPdFV.exe
  C:\Windows\System\xfyPdFV.exe
  2⤵
  PID:8036
- C:\Windows\System\nDUWKdg.exe
  C:\Windows\System\nDUWKdg.exe
  2⤵
  PID:8084
- C:\Windows\System\IJTjmDj.exe
  C:\Windows\System\IJTjmDj.exe
  2⤵
  PID:8152
- C:\Windows\System\ktwLNMB.exe
  C:\Windows\System\ktwLNMB.exe
  2⤵
  PID:2024
- C:\Windows\System\rDrjbrE.exe
  C:\Windows\System\rDrjbrE.exe
  2⤵
  PID:4336
- C:\Windows\System\ylRjGjF.exe
  C:\Windows\System\ylRjGjF.exe
  2⤵
  PID:2508
- C:\Windows\System\AMftUzy.exe
  C:\Windows\System\AMftUzy.exe
  2⤵
  PID:2308
- C:\Windows\System\TQmMhom.exe
  C:\Windows\System\TQmMhom.exe
  2⤵
  PID:7312
- C:\Windows\System\klBDUTX.exe
  C:\Windows\System\klBDUTX.exe
  2⤵
  PID:672
- C:\Windows\System\ofDbGDy.exe
  C:\Windows\System\ofDbGDy.exe
  2⤵
  PID:7552
- C:\Windows\System\PdPhuZL.exe
  C:\Windows\System\PdPhuZL.exe
  2⤵
  PID:7692
- C:\Windows\System\DKuHqwR.exe
  C:\Windows\System\DKuHqwR.exe
  2⤵
  PID:7816
- C:\Windows\System\LPRSfBy.exe
  C:\Windows\System\LPRSfBy.exe
  2⤵
  PID:7972
- C:\Windows\System\BgWyJsE.exe
  C:\Windows\System\BgWyJsE.exe
  2⤵
  PID:8132
- C:\Windows\System\tXSUZVZ.exe
  C:\Windows\System\tXSUZVZ.exe
  2⤵
  PID:2960
- C:\Windows\System\Amxzjuh.exe
  C:\Windows\System\Amxzjuh.exe
  2⤵
  PID:7240
- C:\Windows\System\pxpJxFN.exe
  C:\Windows\System\pxpJxFN.exe
  2⤵
  PID:7852
- C:\Windows\System\sTYOdjX.exe
  C:\Windows\System\sTYOdjX.exe
  2⤵
  PID:7780
- C:\Windows\System\WIYBsbt.exe
  C:\Windows\System\WIYBsbt.exe
  2⤵
  PID:7328
- C:\Windows\System\eCsgmaY.exe
  C:\Windows\System\eCsgmaY.exe
  2⤵
  PID:8212
- C:\Windows\System\EiALFMd.exe
  C:\Windows\System\EiALFMd.exe
  2⤵
  PID:8228
- C:\Windows\System\IBdwEjb.exe
  C:\Windows\System\IBdwEjb.exe
  2⤵
  PID:8256
- C:\Windows\System\pSaWLzi.exe
  C:\Windows\System\pSaWLzi.exe
  2⤵
  PID:8272
- C:\Windows\System\erpCbWF.exe
  C:\Windows\System\erpCbWF.exe
  2⤵
  PID:8296
- C:\Windows\System\BlnHQPY.exe
  C:\Windows\System\BlnHQPY.exe
  2⤵
  PID:8324
- C:\Windows\System\HKyGnOT.exe
  C:\Windows\System\HKyGnOT.exe
  2⤵
  PID:8344
- C:\Windows\System\OuaWdsb.exe
  C:\Windows\System\OuaWdsb.exe
  2⤵
  PID:8396
- C:\Windows\System\IpVhOJZ.exe
  C:\Windows\System\IpVhOJZ.exe
  2⤵
  PID:8432
- C:\Windows\System\gZzwkIE.exe
  C:\Windows\System\gZzwkIE.exe
  2⤵
  PID:8452
- C:\Windows\System\XiwQiSS.exe
  C:\Windows\System\XiwQiSS.exe
  2⤵
  PID:8488
- C:\Windows\System\dvauiaf.exe
  C:\Windows\System\dvauiaf.exe
  2⤵
  PID:8508
- C:\Windows\System\ZFqEbHl.exe
  C:\Windows\System\ZFqEbHl.exe
  2⤵
  PID:8532
- C:\Windows\System\svpfcys.exe
  C:\Windows\System\svpfcys.exe
  2⤵
  PID:8548
- C:\Windows\System\NAZUcwv.exe
  C:\Windows\System\NAZUcwv.exe
  2⤵
  PID:8568
- C:\Windows\System\lCgdiaW.exe
  C:\Windows\System\lCgdiaW.exe
  2⤵
  PID:8588
- C:\Windows\System\FOPFaOQ.exe
  C:\Windows\System\FOPFaOQ.exe
  2⤵
  PID:8608
- C:\Windows\System\BBPldUm.exe
  C:\Windows\System\BBPldUm.exe
  2⤵
  PID:8640
- C:\Windows\System\dFPdLRE.exe
  C:\Windows\System\dFPdLRE.exe
  2⤵
  PID:8672
- C:\Windows\System\iXEqFVg.exe
  C:\Windows\System\iXEqFVg.exe
  2⤵
  PID:8696
- C:\Windows\System\iXnhZDr.exe
  C:\Windows\System\iXnhZDr.exe
  2⤵
  PID:8716
- C:\Windows\System\oKEWESv.exe
  C:\Windows\System\oKEWESv.exe
  2⤵
  PID:8736
- C:\Windows\System\SWkduGI.exe
  C:\Windows\System\SWkduGI.exe
  2⤵
  PID:8804
- C:\Windows\System\FCmHsPz.exe
  C:\Windows\System\FCmHsPz.exe
  2⤵
  PID:8820
- C:\Windows\System\HfrbZMT.exe
  C:\Windows\System\HfrbZMT.exe
  2⤵
  PID:8856
- C:\Windows\System\TKOiBvD.exe
  C:\Windows\System\TKOiBvD.exe
  2⤵
  PID:8872
- C:\Windows\System\pMwVtDc.exe
  C:\Windows\System\pMwVtDc.exe
  2⤵
  PID:8896
- C:\Windows\System\uZPAJPM.exe
  C:\Windows\System\uZPAJPM.exe
  2⤵
  PID:8964
- C:\Windows\System\NIstxMH.exe
  C:\Windows\System\NIstxMH.exe
  2⤵
  PID:8984
- C:\Windows\System\fLokvPW.exe
  C:\Windows\System\fLokvPW.exe
  2⤵
  PID:9044
- C:\Windows\System\qWBeHLa.exe
  C:\Windows\System\qWBeHLa.exe
  2⤵
  PID:9064
- C:\Windows\System\rtYuFMo.exe
  C:\Windows\System\rtYuFMo.exe
  2⤵
  PID:9100
- C:\Windows\System\YSGugiM.exe
  C:\Windows\System\YSGugiM.exe
  2⤵
  PID:9136
- C:\Windows\System\hIWzBfa.exe
  C:\Windows\System\hIWzBfa.exe
  2⤵
  PID:9160
- C:\Windows\System\iHbwqoK.exe
  C:\Windows\System\iHbwqoK.exe
  2⤵
  PID:9184
- C:\Windows\System\XdoQkrr.exe
  C:\Windows\System\XdoQkrr.exe
  2⤵
  PID:9200
- C:\Windows\System\iPuyWlb.exe
  C:\Windows\System\iPuyWlb.exe
  2⤵
  PID:7272
- C:\Windows\System\UbjQrpn.exe
  C:\Windows\System\UbjQrpn.exe
  2⤵
  PID:8136
- C:\Windows\System\lOXsTJm.exe
  C:\Windows\System\lOXsTJm.exe
  2⤵
  PID:8264
- C:\Windows\System\DVDvdyB.exe
  C:\Windows\System\DVDvdyB.exe
  2⤵
  PID:8304
- C:\Windows\System\hrcHRLb.exe
  C:\Windows\System\hrcHRLb.exe
  2⤵
  PID:8464
- C:\Windows\System\GQQGuIT.exe
  C:\Windows\System\GQQGuIT.exe
  2⤵
  PID:8476
- C:\Windows\System\vVMWCld.exe
  C:\Windows\System\vVMWCld.exe
  2⤵
  PID:8540
- C:\Windows\System\QlmOLFe.exe
  C:\Windows\System\QlmOLFe.exe
  2⤵
  PID:8600
- C:\Windows\System\dgzprTC.exe
  C:\Windows\System\dgzprTC.exe
  2⤵
  PID:8668
- C:\Windows\System\eNyjKNI.exe
  C:\Windows\System\eNyjKNI.exe
  2⤵
  PID:8732
- C:\Windows\System\FHWDPmI.exe
  C:\Windows\System\FHWDPmI.exe
  2⤵
  PID:8920
- C:\Windows\System\YkhGkfT.exe
  C:\Windows\System\YkhGkfT.exe
  2⤵
  PID:8852
- C:\Windows\System\BoGekxn.exe
  C:\Windows\System\BoGekxn.exe
  2⤵
  PID:9020
- C:\Windows\System\lPTklSY.exe
  C:\Windows\System\lPTklSY.exe
  2⤵
  PID:8976
- C:\Windows\System\CCNUDDx.exe
  C:\Windows\System\CCNUDDx.exe
  2⤵
  PID:9032
- C:\Windows\System\fCSPAeq.exe
  C:\Windows\System\fCSPAeq.exe
  2⤵
  PID:9156
- C:\Windows\System\OADojgJ.exe
  C:\Windows\System\OADojgJ.exe
  2⤵
  PID:9176
- C:\Windows\System\nmaNnVR.exe
  C:\Windows\System\nmaNnVR.exe
  2⤵
  PID:8404
- C:\Windows\System\OcaYPat.exe
  C:\Windows\System\OcaYPat.exe
  2⤵
  PID:8428
- C:\Windows\System\MVTCFYb.exe
  C:\Windows\System\MVTCFYb.exe
  2⤵
  PID:8356
- C:\Windows\System\UpkNoMY.exe
  C:\Windows\System\UpkNoMY.exe
  2⤵
  PID:8832
- C:\Windows\System\SCMbdFF.exe
  C:\Windows\System\SCMbdFF.exe
  2⤵
  PID:8880
- C:\Windows\System\OqqvajC.exe
  C:\Windows\System\OqqvajC.exe
  2⤵
  PID:8892
- C:\Windows\System\JoxiOqz.exe
  C:\Windows\System\JoxiOqz.exe
  2⤵
  PID:9072
- C:\Windows\System\hLtdyyZ.exe
  C:\Windows\System\hLtdyyZ.exe
  2⤵
  PID:8388
- C:\Windows\System\KundgRN.exe
  C:\Windows\System\KundgRN.exe
  2⤵
  PID:8908
- C:\Windows\System\UbHbLBa.exe
  C:\Windows\System\UbHbLBa.exe
  2⤵
  PID:8544
- C:\Windows\System\iktXcJq.exe
  C:\Windows\System\iktXcJq.exe
  2⤵
  PID:8236
- C:\Windows\System\gtuoEoZ.exe
  C:\Windows\System\gtuoEoZ.exe
  2⤵
  PID:9232
- C:\Windows\System\CLXuYMt.exe
  C:\Windows\System\CLXuYMt.exe
  2⤵
  PID:9260
- C:\Windows\System\jkWMiMS.exe
  C:\Windows\System\jkWMiMS.exe
  2⤵
  PID:9276
- C:\Windows\System\GRlnggV.exe
  C:\Windows\System\GRlnggV.exe
  2⤵
  PID:9296
- C:\Windows\System\hjcHnvZ.exe
  C:\Windows\System\hjcHnvZ.exe
  2⤵
  PID:9316
- C:\Windows\System\liozWBg.exe
  C:\Windows\System\liozWBg.exe
  2⤵
  PID:9332
- C:\Windows\System\QjfJGCW.exe
  C:\Windows\System\QjfJGCW.exe
  2⤵
  PID:9404
- C:\Windows\System\RWochfa.exe
  C:\Windows\System\RWochfa.exe
  2⤵
  PID:9420
- C:\Windows\System\Noccihl.exe
  C:\Windows\System\Noccihl.exe
  2⤵
  PID:9452
- C:\Windows\System\BeVkNGt.exe
  C:\Windows\System\BeVkNGt.exe
  2⤵
  PID:9468
- C:\Windows\System\HriJwQk.exe
  C:\Windows\System\HriJwQk.exe
  2⤵
  PID:9496
- C:\Windows\System\TNAdqMD.exe
  C:\Windows\System\TNAdqMD.exe
  2⤵
  PID:9524
- C:\Windows\System\OurukfV.exe
  C:\Windows\System\OurukfV.exe
  2⤵
  PID:9544
- C:\Windows\System\XdICJQz.exe
  C:\Windows\System\XdICJQz.exe
  2⤵
  PID:9564
- C:\Windows\System\TanZKzM.exe
  C:\Windows\System\TanZKzM.exe
  2⤵
  PID:9632
- C:\Windows\System\PBFumLa.exe
  C:\Windows\System\PBFumLa.exe
  2⤵
  PID:9660
- C:\Windows\System\jrGpfni.exe
  C:\Windows\System\jrGpfni.exe
  2⤵
  PID:9688
- C:\Windows\System\JopcNzB.exe
  C:\Windows\System\JopcNzB.exe
  2⤵
  PID:9716
- C:\Windows\System\UjSpLmo.exe
  C:\Windows\System\UjSpLmo.exe
  2⤵
  PID:9736
- C:\Windows\System\PapQchQ.exe
  C:\Windows\System\PapQchQ.exe
  2⤵
  PID:9760
- C:\Windows\System\TelWRkx.exe
  C:\Windows\System\TelWRkx.exe
  2⤵
  PID:9780
- C:\Windows\System\fpbNwDc.exe
  C:\Windows\System\fpbNwDc.exe
  2⤵
  PID:9820
- C:\Windows\System\JVdAFix.exe
  C:\Windows\System\JVdAFix.exe
  2⤵
  PID:9848
- C:\Windows\System\iEzbMVs.exe
  C:\Windows\System\iEzbMVs.exe
  2⤵
  PID:9872
- C:\Windows\System\ybfIChj.exe
  C:\Windows\System\ybfIChj.exe
  2⤵
  PID:9892
- C:\Windows\System\KrBqnJI.exe
  C:\Windows\System\KrBqnJI.exe
  2⤵
  PID:9916
- C:\Windows\System\KthPXVL.exe
  C:\Windows\System\KthPXVL.exe
  2⤵
  PID:9992
- C:\Windows\System\bVjWrjk.exe
  C:\Windows\System\bVjWrjk.exe
  2⤵
  PID:10008
- C:\Windows\System\SaUCxmw.exe
  C:\Windows\System\SaUCxmw.exe
  2⤵
  PID:10032
- C:\Windows\System\CEWDKlO.exe
  C:\Windows\System\CEWDKlO.exe
  2⤵
  PID:10052
- C:\Windows\System\KYnLKXX.exe
  C:\Windows\System\KYnLKXX.exe
  2⤵
  PID:10072
- C:\Windows\System\IoqpYVQ.exe
  C:\Windows\System\IoqpYVQ.exe
  2⤵
  PID:10096
- C:\Windows\System\bMQvkvD.exe
  C:\Windows\System\bMQvkvD.exe
  2⤵
  PID:10120
- C:\Windows\System\hcfEPTV.exe
  C:\Windows\System\hcfEPTV.exe
  2⤵
  PID:10152
- C:\Windows\System\HqWmPXR.exe
  C:\Windows\System\HqWmPXR.exe
  2⤵
  PID:10172
- C:\Windows\System\LJGwINO.exe
  C:\Windows\System\LJGwINO.exe
  2⤵
  PID:10212
- C:\Windows\System\DnrFJye.exe
  C:\Windows\System\DnrFJye.exe
  2⤵
  PID:10232
- C:\Windows\System\lLNEzjR.exe
  C:\Windows\System\lLNEzjR.exe
  2⤵
  PID:9240
- C:\Windows\System\ACWJFxg.exe
  C:\Windows\System\ACWJFxg.exe
  2⤵
  PID:9256
- C:\Windows\System\CKRodDJ.exe
  C:\Windows\System\CKRodDJ.exe
  2⤵
  PID:9356
- C:\Windows\System\MWeEZAf.exe
  C:\Windows\System\MWeEZAf.exe
  2⤵
  PID:9292
- C:\Windows\System\iyTBQEC.exe
  C:\Windows\System\iyTBQEC.exe
  2⤵
  PID:9440
- C:\Windows\System\oELLGak.exe
  C:\Windows\System\oELLGak.exe
  2⤵
  PID:9488
- C:\Windows\System\iRFNYmw.exe
  C:\Windows\System\iRFNYmw.exe
  2⤵
  PID:9520
- C:\Windows\System\EmcjZlm.exe
  C:\Windows\System\EmcjZlm.exe
  2⤵
  PID:9624
- C:\Windows\System\jXDtdRD.exe
  C:\Windows\System\jXDtdRD.exe
  2⤵
  PID:9752
- C:\Windows\System\qLYruEq.exe
  C:\Windows\System\qLYruEq.exe
  2⤵
  PID:9800
- C:\Windows\System\yijFEYm.exe
  C:\Windows\System\yijFEYm.exe
  2⤵
  PID:9864
- C:\Windows\System\DHuqKFH.exe
  C:\Windows\System\DHuqKFH.exe
  2⤵
  PID:9928
- C:\Windows\System\DZQJvxp.exe
  C:\Windows\System\DZQJvxp.exe
  2⤵
  PID:10000
- C:\Windows\System\vkXXHON.exe
  C:\Windows\System\vkXXHON.exe
  2⤵
  PID:10044
- C:\Windows\System\zsSYzHu.exe
  C:\Windows\System\zsSYzHu.exe
  2⤵
  PID:9428
- C:\Windows\System\FafSidL.exe
  C:\Windows\System\FafSidL.exe
  2⤵
  PID:9604
- C:\Windows\System\gXOdNGz.exe
  C:\Windows\System\gXOdNGz.exe
  2⤵
  PID:10040
- C:\Windows\System\DWpFBFB.exe
  C:\Windows\System\DWpFBFB.exe
  2⤵
  PID:10136
- C:\Windows\System\onwKwXJ.exe
  C:\Windows\System\onwKwXJ.exe
  2⤵
  PID:10188
- C:\Windows\System\yZrIwnT.exe
  C:\Windows\System\yZrIwnT.exe
  2⤵
  PID:10092
- C:\Windows\System\FccPgmP.exe
  C:\Windows\System\FccPgmP.exe
  2⤵
  PID:10164
- C:\Windows\System\AFYtFhX.exe
  C:\Windows\System\AFYtFhX.exe
  2⤵
  PID:9484
- C:\Windows\System\LTKRleN.exe
  C:\Windows\System\LTKRleN.exe
  2⤵
  PID:9652
- C:\Windows\System\qaFGyzn.exe
  C:\Windows\System\qaFGyzn.exe
  2⤵
  PID:9932
- C:\Windows\System\QbDfjsJ.exe
  C:\Windows\System\QbDfjsJ.exe
  2⤵
  PID:9556
- C:\Windows\System\QCKFvXo.exe
  C:\Windows\System\QCKFvXo.exe
  2⤵
  PID:1832
- C:\Windows\System\IbtoyCF.exe
  C:\Windows\System\IbtoyCF.exe
  2⤵
  PID:10244
- C:\Windows\System\rNpqWRu.exe
  C:\Windows\System\rNpqWRu.exe
  2⤵
  PID:10280
- C:\Windows\System\nehtFMH.exe
  C:\Windows\System\nehtFMH.exe
  2⤵
  PID:10296
- C:\Windows\System\CrhJegh.exe
  C:\Windows\System\CrhJegh.exe
  2⤵
  PID:10312
- C:\Windows\System\UJaCAPV.exe
  C:\Windows\System\UJaCAPV.exe
  2⤵
  PID:10332
- C:\Windows\System\sOLcspz.exe
  C:\Windows\System\sOLcspz.exe
  2⤵
  PID:10376
- C:\Windows\System\nkHbwbZ.exe
  C:\Windows\System\nkHbwbZ.exe
  2⤵
  PID:10396
- C:\Windows\System\pLgkHfn.exe
  C:\Windows\System\pLgkHfn.exe
  2⤵
  PID:10420
- C:\Windows\System\cYqtqzv.exe
  C:\Windows\System\cYqtqzv.exe
  2⤵
  PID:10440
- C:\Windows\System\vjWUavt.exe
  C:\Windows\System\vjWUavt.exe
  2⤵
  PID:10480
- C:\Windows\System\BFAzzhM.exe
  C:\Windows\System\BFAzzhM.exe
  2⤵
  PID:10500
- C:\Windows\System\VMOWWdN.exe
  C:\Windows\System\VMOWWdN.exe
  2⤵
  PID:10520
- C:\Windows\System\NgFOOwv.exe
  C:\Windows\System\NgFOOwv.exe
  2⤵
  PID:10568
- C:\Windows\System\lxcQRXC.exe
  C:\Windows\System\lxcQRXC.exe
  2⤵
  PID:10584
- C:\Windows\System\bYUrwoj.exe
  C:\Windows\System\bYUrwoj.exe
  2⤵
  PID:10608
- C:\Windows\System\PaJptQr.exe
  C:\Windows\System\PaJptQr.exe
  2⤵
  PID:10624
- C:\Windows\System\rSxfwEX.exe
  C:\Windows\System\rSxfwEX.exe
  2⤵
  PID:10648
- C:\Windows\System\BFjOCqT.exe
  C:\Windows\System\BFjOCqT.exe
  2⤵
  PID:10664
- C:\Windows\System\nyUHSzq.exe
  C:\Windows\System\nyUHSzq.exe
  2⤵
  PID:10696
- C:\Windows\System\UtEeyKA.exe
  C:\Windows\System\UtEeyKA.exe
  2⤵
  PID:10728
- C:\Windows\System\yhRXPQV.exe
  C:\Windows\System\yhRXPQV.exe
  2⤵
  PID:10752
- C:\Windows\System\joseedG.exe
  C:\Windows\System\joseedG.exe
  2⤵
  PID:10772
- C:\Windows\System\kRgVATU.exe
  C:\Windows\System\kRgVATU.exe
  2⤵
  PID:10856
- C:\Windows\System\cneOiiZ.exe
  C:\Windows\System\cneOiiZ.exe
  2⤵
  PID:10900
- C:\Windows\System\BzPDICr.exe
  C:\Windows\System\BzPDICr.exe
  2⤵
  PID:10916
- C:\Windows\System\KjyePBu.exe
  C:\Windows\System\KjyePBu.exe
  2⤵
  PID:10952
- C:\Windows\System\JaYmroH.exe
  C:\Windows\System\JaYmroH.exe
  2⤵
  PID:10992
- C:\Windows\System\NrgWEDy.exe
  C:\Windows\System\NrgWEDy.exe
  2⤵
  PID:11008
- C:\Windows\System\hmBWYGp.exe
  C:\Windows\System\hmBWYGp.exe
  2⤵
  PID:11028
- C:\Windows\System\SDkHiNz.exe
  C:\Windows\System\SDkHiNz.exe
  2⤵
  PID:11044
- C:\Windows\System\uapAkxG.exe
  C:\Windows\System\uapAkxG.exe
  2⤵
  PID:11068
- C:\Windows\System\lMuAiPl.exe
  C:\Windows\System\lMuAiPl.exe
  2⤵
  PID:11084
- C:\Windows\System\sqtQVcW.exe
  C:\Windows\System\sqtQVcW.exe
  2⤵
  PID:11112
- C:\Windows\System\rqBCTjO.exe
  C:\Windows\System\rqBCTjO.exe
  2⤵
  PID:11164
- C:\Windows\System\njHlaoy.exe
  C:\Windows\System\njHlaoy.exe
  2⤵
  PID:11232
- C:\Windows\System\dZIKHsw.exe
  C:\Windows\System\dZIKHsw.exe
  2⤵
  PID:11260
- C:\Windows\System\fteOrpx.exe
  C:\Windows\System\fteOrpx.exe
  2⤵
  PID:9308
- C:\Windows\System\flYbJAH.exe
  C:\Windows\System\flYbJAH.exe
  2⤵
  PID:10292
- C:\Windows\System\XLqaWEU.exe
  C:\Windows\System\XLqaWEU.exe
  2⤵
  PID:10328
- C:\Windows\System\CdpJYOo.exe
  C:\Windows\System\CdpJYOo.exe
  2⤵
  PID:10408
- C:\Windows\System\YpbFbZw.exe
  C:\Windows\System\YpbFbZw.exe
  2⤵
  PID:10488
- C:\Windows\System\ZKHDUgM.exe
  C:\Windows\System\ZKHDUgM.exe
  2⤵
  PID:10468
- C:\Windows\System\RTBEDKu.exe
  C:\Windows\System\RTBEDKu.exe
  2⤵
  PID:10576
- C:\Windows\System\GPUuxWs.exe
  C:\Windows\System\GPUuxWs.exe
  2⤵
  PID:10640
- C:\Windows\System\VyzGthG.exe
  C:\Windows\System\VyzGthG.exe
  2⤵
  PID:10692
- C:\Windows\System\DDpFDwE.exe
  C:\Windows\System\DDpFDwE.exe
  2⤵
  PID:10848
- C:\Windows\System\KmXkwOS.exe
  C:\Windows\System\KmXkwOS.exe
  2⤵
  PID:10892
- C:\Windows\System\OYtDtGy.exe
  C:\Windows\System\OYtDtGy.exe
  2⤵
  PID:11000
- C:\Windows\System\MnasgdC.exe
  C:\Windows\System\MnasgdC.exe
  2⤵
  PID:11040
- C:\Windows\System\GExYXIe.exe
  C:\Windows\System\GExYXIe.exe
  2⤵
  PID:11180
- C:\Windows\System\rflZexd.exe
  C:\Windows\System\rflZexd.exe
  2⤵
  PID:9284
- C:\Windows\System\aCjvFDa.exe
  C:\Windows\System\aCjvFDa.exe
  2⤵
  PID:11252
- C:\Windows\System\UTxyZTn.exe
  C:\Windows\System\UTxyZTn.exe
  2⤵
  PID:10364
- C:\Windows\System\WjsJqqC.exe
  C:\Windows\System\WjsJqqC.exe
  2⤵
  PID:10404
- C:\Windows\System\NuUuqta.exe
  C:\Windows\System\NuUuqta.exe
  2⤵
  PID:10684
- C:\Windows\System\jsUBoaY.exe
  C:\Windows\System\jsUBoaY.exe
  2⤵
  PID:10944
- C:\Windows\System\DwRahnl.exe
  C:\Windows\System\DwRahnl.exe
  2⤵
  PID:11036
- C:\Windows\System\ciYtNEn.exe
  C:\Windows\System\ciYtNEn.exe
  2⤵
  PID:10196
- C:\Windows\System\DwDHQAz.exe
  C:\Windows\System\DwDHQAz.exe
  2⤵
  PID:11228
- C:\Windows\System\kdJFUaJ.exe
  C:\Windows\System\kdJFUaJ.exe
  2⤵
  PID:10472
- C:\Windows\System\FexZYkv.exe
  C:\Windows\System\FexZYkv.exe
  2⤵
  PID:10940
- C:\Windows\System\ZNNqwQf.exe
  C:\Windows\System\ZNNqwQf.exe
  2⤵
  PID:11108
- C:\Windows\System\jxSXgSd.exe
  C:\Windows\System\jxSXgSd.exe
  2⤵
  PID:10616
- C:\Windows\System\TDVWIpb.exe
  C:\Windows\System\TDVWIpb.exe
  2⤵
  PID:11284
- C:\Windows\System\CEiIUtm.exe
  C:\Windows\System\CEiIUtm.exe
  2⤵
  PID:11300
- C:\Windows\System\rCzOHVb.exe
  C:\Windows\System\rCzOHVb.exe
  2⤵
  PID:11316
- C:\Windows\System\EsgPjyn.exe
  C:\Windows\System\EsgPjyn.exe
  2⤵
  PID:11368
- C:\Windows\System\jmKHaXg.exe
  C:\Windows\System\jmKHaXg.exe
  2⤵
  PID:11408
- C:\Windows\System\QxeqTsg.exe
  C:\Windows\System\QxeqTsg.exe
  2⤵
  PID:11440
- C:\Windows\System\BAisacP.exe
  C:\Windows\System\BAisacP.exe
  2⤵
  PID:11456
- C:\Windows\System\pSpClfZ.exe
  C:\Windows\System\pSpClfZ.exe
  2⤵
  PID:11476
- C:\Windows\System\hBhSIAi.exe
  C:\Windows\System\hBhSIAi.exe
  2⤵
  PID:11496
- C:\Windows\System\ypQmoLz.exe
  C:\Windows\System\ypQmoLz.exe
  2⤵
  PID:11512
- C:\Windows\System\ifaVtQi.exe
  C:\Windows\System\ifaVtQi.exe
  2⤵
  PID:11528
- C:\Windows\System\QHiyvNy.exe
  C:\Windows\System\QHiyvNy.exe
  2⤵
  PID:11544
- C:\Windows\System\XaMmPoX.exe
  C:\Windows\System\XaMmPoX.exe
  2⤵
  PID:11560
- C:\Windows\System\NbgMIWn.exe
  C:\Windows\System\NbgMIWn.exe
  2⤵
  PID:11596
- C:\Windows\System\bnGOwZB.exe
  C:\Windows\System\bnGOwZB.exe
  2⤵
  PID:11616
- C:\Windows\System\IXTZOLu.exe
  C:\Windows\System\IXTZOLu.exe
  2⤵
  PID:11680
- C:\Windows\System\qBWpRgw.exe
  C:\Windows\System\qBWpRgw.exe
  2⤵
  PID:11736
- C:\Windows\System\LymkDpv.exe
  C:\Windows\System\LymkDpv.exe
  2⤵
  PID:11752
- C:\Windows\System\JUHJIcg.exe
  C:\Windows\System\JUHJIcg.exe
  2⤵
  PID:11768
- C:\Windows\System\NjKtUwQ.exe
  C:\Windows\System\NjKtUwQ.exe
  2⤵
  PID:11792
- C:\Windows\System\RgHxlYV.exe
  C:\Windows\System\RgHxlYV.exe
  2⤵
  PID:11812
- C:\Windows\System\moDAFhl.exe
  C:\Windows\System\moDAFhl.exe
  2⤵
  PID:11876
- C:\Windows\System\aQzzxys.exe
  C:\Windows\System\aQzzxys.exe
  2⤵
  PID:11896
- C:\Windows\System\mZTLGGV.exe
  C:\Windows\System\mZTLGGV.exe
  2⤵
  PID:11916
- C:\Windows\System\xsvgbCi.exe
  C:\Windows\System\xsvgbCi.exe
  2⤵
  PID:11952
- C:\Windows\System\YmkzBlY.exe
  C:\Windows\System\YmkzBlY.exe
  2⤵
  PID:11976
- C:\Windows\System\UoWGyIK.exe
  C:\Windows\System\UoWGyIK.exe
  2⤵
  PID:12012
- C:\Windows\System\yfECoMP.exe
  C:\Windows\System\yfECoMP.exe
  2⤵
  PID:12056
- C:\Windows\System\dlifRTu.exe
  C:\Windows\System\dlifRTu.exe
  2⤵
  PID:12080
- C:\Windows\System\YzSXlLR.exe
  C:\Windows\System\YzSXlLR.exe
  2⤵
  PID:12100
- C:\Windows\System\trJMAgU.exe
  C:\Windows\System\trJMAgU.exe
  2⤵
  PID:12120
- C:\Windows\System\IYiyZLq.exe
  C:\Windows\System\IYiyZLq.exe
  2⤵
  PID:12136
- C:\Windows\System\ojddEAq.exe
  C:\Windows\System\ojddEAq.exe
  2⤵
  PID:12160
- C:\Windows\System\zHQaGKK.exe
  C:\Windows\System\zHQaGKK.exe
  2⤵
  PID:12176
- C:\Windows\System\MhUSZqd.exe
  C:\Windows\System\MhUSZqd.exe
  2⤵
  PID:12192
- C:\Windows\System\tYYdzWu.exe
  C:\Windows\System\tYYdzWu.exe
  2⤵
  PID:12208
- C:\Windows\System\AlYoepU.exe
  C:\Windows\System\AlYoepU.exe
  2⤵
  PID:12228
- C:\Windows\System\ZiwtSIJ.exe
  C:\Windows\System\ZiwtSIJ.exe
  2⤵
  PID:12252
- C:\Windows\System\WeZmuDC.exe
  C:\Windows\System\WeZmuDC.exe
  2⤵
  PID:12268
- C:\Windows\System\GDYlNXK.exe
  C:\Windows\System\GDYlNXK.exe
  2⤵
  PID:11272
- C:\Windows\System\MWAJEAy.exe
  C:\Windows\System\MWAJEAy.exe
  2⤵
  PID:10804
- C:\Windows\System\inhmGkZ.exe
  C:\Windows\System\inhmGkZ.exe
  2⤵
  PID:10592
- C:\Windows\System\TGazrSc.exe
  C:\Windows\System\TGazrSc.exe
  2⤵
  PID:11296
- C:\Windows\System\oiMXHgM.exe
  C:\Windows\System\oiMXHgM.exe
  2⤵
  PID:11360
- C:\Windows\System\pcLOTVn.exe
  C:\Windows\System\pcLOTVn.exe
  2⤵
  PID:11392
- C:\Windows\System\RIjhqXt.exe
  C:\Windows\System\RIjhqXt.exe
  2⤵
  PID:11464
- C:\Windows\System\FeSmewt.exe
  C:\Windows\System\FeSmewt.exe
  2⤵
  PID:11488
- C:\Windows\System\peNBWHp.exe
  C:\Windows\System\peNBWHp.exe
  2⤵
  PID:11552
- C:\Windows\System\hlzKahE.exe
  C:\Windows\System\hlzKahE.exe
  2⤵
  PID:11540
- C:\Windows\System\NOByuLJ.exe
  C:\Windows\System\NOByuLJ.exe
  2⤵
  PID:11656
- C:\Windows\System\WdRMLGp.exe
  C:\Windows\System\WdRMLGp.exe
  2⤵
  PID:11588
- C:\Windows\System\bGFRDGf.exe
  C:\Windows\System\bGFRDGf.exe
  2⤵
  PID:11636
- C:\Windows\System\xxapjeG.exe
  C:\Windows\System\xxapjeG.exe
  2⤵
  PID:10368
- C:\Windows\System\ufKSuaT.exe
  C:\Windows\System\ufKSuaT.exe
  2⤵
  PID:11844
- C:\Windows\System\DrSTnYk.exe
  C:\Windows\System\DrSTnYk.exe
  2⤵
  PID:11776
- C:\Windows\System\QsopGjY.exe
  C:\Windows\System\QsopGjY.exe
  2⤵
  PID:11864
- C:\Windows\System\qkHdYvJ.exe
  C:\Windows\System\qkHdYvJ.exe
  2⤵
  PID:11888
- C:\Windows\System\NsSiPEb.exe
  C:\Windows\System\NsSiPEb.exe
  2⤵
  PID:11988
- C:\Windows\System\BDAQskT.exe
  C:\Windows\System\BDAQskT.exe
  2⤵
  PID:12036
- C:\Windows\System\ljnXKWB.exe
  C:\Windows\System\ljnXKWB.exe
  2⤵
  PID:12064
- C:\Windows\System\kxPvmda.exe
  C:\Windows\System\kxPvmda.exe
  2⤵
  PID:12092
- C:\Windows\System\dqDHqce.exe
  C:\Windows\System\dqDHqce.exe
  2⤵
  PID:12128
- C:\Windows\System\MKejGqR.exe
  C:\Windows\System\MKejGqR.exe
  2⤵
  PID:12220
- C:\Windows\System\moScpuC.exe
  C:\Windows\System\moScpuC.exe
  2⤵
  PID:12276
- C:\Windows\System\QzMeqkx.exe
  C:\Windows\System\QzMeqkx.exe
  2⤵
  PID:12156
- C:\Windows\System\jEXRIkN.exe
  C:\Windows\System\jEXRIkN.exe
  2⤵
  PID:11404
- C:\Windows\System\JDArjLF.exe
  C:\Windows\System\JDArjLF.exe
  2⤵
  PID:11712
- C:\Windows\System\jpHlWEu.exe
  C:\Windows\System\jpHlWEu.exe
  2⤵
  PID:12300
- C:\Windows\System\tCdMpxk.exe
  C:\Windows\System\tCdMpxk.exe
  2⤵
  PID:12320
- C:\Windows\System\wOnNxJk.exe
  C:\Windows\System\wOnNxJk.exe
  2⤵
  PID:12340
- C:\Windows\System\hsRMuHB.exe
  C:\Windows\System\hsRMuHB.exe
  2⤵
  PID:12356
- C:\Windows\System\NtYuZZi.exe
  C:\Windows\System\NtYuZZi.exe
  2⤵
  PID:12376
- C:\Windows\System\MyGTSec.exe
  C:\Windows\System\MyGTSec.exe
  2⤵
  PID:12392
- C:\Windows\System\HUmybAZ.exe
  C:\Windows\System\HUmybAZ.exe
  2⤵
  PID:12416
- C:\Windows\System\rHwcLUr.exe
  C:\Windows\System\rHwcLUr.exe
  2⤵
  PID:12432
- C:\Windows\System\OMhkQGt.exe
  C:\Windows\System\OMhkQGt.exe
  2⤵
  PID:12464
- C:\Windows\System\nEYXvSp.exe
  C:\Windows\System\nEYXvSp.exe
  2⤵
  PID:12484
- C:\Windows\System\uHZvmYL.exe
  C:\Windows\System\uHZvmYL.exe
  2⤵
  PID:12500
- C:\Windows\System\dcnjgDD.exe
  C:\Windows\System\dcnjgDD.exe
  2⤵
  PID:12520
- C:\Windows\System\qvMIwth.exe
  C:\Windows\System\qvMIwth.exe
  2⤵
  PID:12536
- C:\Windows\System\lHooHOb.exe
  C:\Windows\System\lHooHOb.exe
  2⤵
  PID:12556
- C:\Windows\System\FkvAvsZ.exe
  C:\Windows\System\FkvAvsZ.exe
  2⤵
  PID:12580
- C:\Windows\System\trEemtV.exe
  C:\Windows\System\trEemtV.exe
  2⤵
  PID:12596
- C:\Windows\System\TuRzfpd.exe
  C:\Windows\System\TuRzfpd.exe
  2⤵
  PID:12616
- C:\Windows\System\vLRCCdB.exe
  C:\Windows\System\vLRCCdB.exe
  2⤵
  PID:12632
- C:\Windows\System\CcPzNJW.exe
  C:\Windows\System\CcPzNJW.exe
  2⤵
  PID:12652
- C:\Windows\System\IbDOddp.exe
  C:\Windows\System\IbDOddp.exe
  2⤵
  PID:12668
- C:\Windows\System\drQzQbJ.exe
  C:\Windows\System\drQzQbJ.exe
  2⤵
  PID:12688
- C:\Windows\System\ekEeWbq.exe
  C:\Windows\System\ekEeWbq.exe
  2⤵
  PID:12708
- C:\Windows\System\SblyUIr.exe
  C:\Windows\System\SblyUIr.exe
  2⤵
  PID:12728
- C:\Windows\System\iitsRtt.exe
  C:\Windows\System\iitsRtt.exe
  2⤵
  PID:12744
- C:\Windows\System\HUDKGFe.exe
  C:\Windows\System\HUDKGFe.exe
  2⤵
  PID:12760
- C:\Windows\System\ufVipJq.exe
  C:\Windows\System\ufVipJq.exe
  2⤵
  PID:12776
- C:\Windows\System\ANoCUvJ.exe
  C:\Windows\System\ANoCUvJ.exe
  2⤵
  PID:12792
- C:\Windows\System\bhRgncP.exe
  C:\Windows\System\bhRgncP.exe
  2⤵
  PID:12816
- C:\Windows\System\mvCeFJr.exe
  C:\Windows\System\mvCeFJr.exe
  2⤵
  PID:12836
- C:\Windows\System\hRchHmN.exe
  C:\Windows\System\hRchHmN.exe
  2⤵
  PID:12856
- C:\Windows\System\WibQIaY.exe
  C:\Windows\System\WibQIaY.exe
  2⤵
  PID:12872
- C:\Windows\System\qEtYzrR.exe
  C:\Windows\System\qEtYzrR.exe
  2⤵
  PID:12892
- C:\Windows\System\aItAIUD.exe
  C:\Windows\System\aItAIUD.exe
  2⤵
  PID:12912
- C:\Windows\System\gmSbxHL.exe
  C:\Windows\System\gmSbxHL.exe
  2⤵
  PID:12928
- C:\Windows\System\QvNisKV.exe
  C:\Windows\System\QvNisKV.exe
  2⤵
  PID:12948
- C:\Windows\System\kZeDUrj.exe
  C:\Windows\System\kZeDUrj.exe
  2⤵
  PID:12972
- C:\Windows\System\DdpSeph.exe
  C:\Windows\System\DdpSeph.exe
  2⤵
  PID:12992
- C:\Windows\System\EuvRBmb.exe
  C:\Windows\System\EuvRBmb.exe
  2⤵
  PID:13012
- C:\Windows\System\CwDipvk.exe
  C:\Windows\System\CwDipvk.exe
  2⤵
  PID:13028
- C:\Windows\System\yXAdAHd.exe
  C:\Windows\System\yXAdAHd.exe
  2⤵
  PID:13048
- C:\Windows\System\NoyeUSJ.exe
  C:\Windows\System\NoyeUSJ.exe
  2⤵
  PID:13068
- C:\Windows\System\tEwhhmv.exe
  C:\Windows\System\tEwhhmv.exe
  2⤵
  PID:13084
- C:\Windows\System\PmFKZwP.exe
  C:\Windows\System\PmFKZwP.exe
  2⤵
  PID:13100
- C:\Windows\System\iIozKUI.exe
  C:\Windows\System\iIozKUI.exe
  2⤵
  PID:13128
- C:\Windows\System\WGRzAih.exe
  C:\Windows\System\WGRzAih.exe
  2⤵
  PID:13148
- C:\Windows\System\vQGOIlY.exe
  C:\Windows\System\vQGOIlY.exe
  2⤵
  PID:13168
- C:\Windows\System\KQccUSu.exe
  C:\Windows\System\KQccUSu.exe
  2⤵
  PID:13188
- C:\Windows\System\HOgOCSF.exe
  C:\Windows\System\HOgOCSF.exe
  2⤵
  PID:13208
- C:\Windows\System\FFqtpcD.exe
  C:\Windows\System\FFqtpcD.exe
  2⤵
  PID:13228
- C:\Windows\System\ihXIEJi.exe
  C:\Windows\System\ihXIEJi.exe
  2⤵
  PID:13248
- C:\Windows\System\SwJvXno.exe
  C:\Windows\System\SwJvXno.exe
  2⤵
  PID:13268
- C:\Windows\System\PVLdWLv.exe
  C:\Windows\System\PVLdWLv.exe
  2⤵
  PID:13288
- C:\Windows\System\XgKxFkT.exe
  C:\Windows\System\XgKxFkT.exe
  2⤵
  PID:13304
- C:\Windows\System\YjGAJwD.exe
  C:\Windows\System\YjGAJwD.exe
  2⤵
  PID:11268
- C:\Windows\System\GTPBCBM.exe
  C:\Windows\System\GTPBCBM.exe
  2⤵
  PID:11828
- C:\Windows\System\GlWVSGm.exe
  C:\Windows\System\GlWVSGm.exe
  2⤵
  PID:12048
- C:\Windows\System\pVOGYdl.exe
  C:\Windows\System\pVOGYdl.exe
  2⤵
  PID:12172
- C:\Windows\System\WKUjoXk.exe
  C:\Windows\System\WKUjoXk.exe
  2⤵
  PID:12248
- C:\Windows\System\ZOGDHAY.exe
  C:\Windows\System\ZOGDHAY.exe
  2⤵
  PID:11328
- C:\Windows\System\emifagx.exe
  C:\Windows\System\emifagx.exe
  2⤵
  PID:12312
- C:\Windows\System\EzNrdYy.exe
  C:\Windows\System\EzNrdYy.exe
  2⤵
  PID:12364
- C:\Windows\System\dijKtkd.exe
  C:\Windows\System\dijKtkd.exe
  2⤵
  PID:12424
- C:\Windows\System\DzHwtMf.exe
  C:\Windows\System\DzHwtMf.exe
  2⤵
  PID:11388
- C:\Windows\System\HxmqFfi.exe
  C:\Windows\System\HxmqFfi.exe
  2⤵
  PID:11524
- C:\Windows\System\pEuDmDC.exe
  C:\Windows\System\pEuDmDC.exe
  2⤵
  PID:12452
- C:\Windows\System\YTixqcT.exe
  C:\Windows\System\YTixqcT.exe
  2⤵
  PID:12528
- C:\Windows\System\ugTUiwD.exe
  C:\Windows\System\ugTUiwD.exe
  2⤵
  PID:12568
- C:\Windows\System\dqwESrt.exe
  C:\Windows\System\dqwESrt.exe
  2⤵
  PID:12588
- C:\Windows\System\qdGwczP.exe
  C:\Windows\System\qdGwczP.exe
  2⤵
  PID:12660
- C:\Windows\System\OxgBuFX.exe
  C:\Windows\System\OxgBuFX.exe
  2⤵
  PID:13324
- C:\Windows\System\nuMOcyV.exe
  C:\Windows\System\nuMOcyV.exe
  2⤵
  PID:13340
- C:\Windows\System\wOJnvHD.exe
  C:\Windows\System\wOJnvHD.exe
  2⤵
  PID:13788
- C:\Windows\System\rjWACgc.exe
  C:\Windows\System\rjWACgc.exe
  2⤵
  PID:13812
- C:\Windows\System\jfMFSYU.exe
  C:\Windows\System\jfMFSYU.exe
  2⤵
  PID:13832
- C:\Windows\System\MNSNFnt.exe
  C:\Windows\System\MNSNFnt.exe
  2⤵
  PID:13852
- C:\Windows\System\uPyHUae.exe
  C:\Windows\System\uPyHUae.exe
  2⤵
  PID:13876
- C:\Windows\System\EwPuVgU.exe
  C:\Windows\System\EwPuVgU.exe
  2⤵
  PID:13896
- C:\Windows\System\aEDqOJp.exe
  C:\Windows\System\aEDqOJp.exe
  2⤵
  PID:13920
- C:\Windows\System\VgYoEGG.exe
  C:\Windows\System\VgYoEGG.exe
  2⤵
  PID:13948
- C:\Windows\System\EhugMXK.exe
  C:\Windows\System\EhugMXK.exe
  2⤵
  PID:13964
- C:\Windows\System\VoMJWHv.exe
  C:\Windows\System\VoMJWHv.exe
  2⤵
  PID:13984
- C:\Windows\System\nmekHam.exe
  C:\Windows\System\nmekHam.exe
  2⤵
  PID:14008
- C:\Windows\System\EfilHnO.exe
  C:\Windows\System\EfilHnO.exe
  2⤵
  PID:14028
- C:\Windows\System\KDcRQcN.exe
  C:\Windows\System\KDcRQcN.exe
  2⤵
  PID:12492
- C:\Windows\System\brejjNQ.exe
  C:\Windows\System\brejjNQ.exe
  2⤵
  PID:13296
- C:\Windows\System\IzGjgJV.exe
  C:\Windows\System\IzGjgJV.exe
  2⤵
  PID:13620
- C:\Windows\System\UmFGzoT.exe
  C:\Windows\System\UmFGzoT.exe
  2⤵
  PID:12088
- C:\Windows\System\xtjLsXE.exe
  C:\Windows\System\xtjLsXE.exe
  2⤵
  PID:11448
- C:\Windows\System\NHUowaS.exe
  C:\Windows\System\NHUowaS.exe
  2⤵
  PID:12508
- C:\Windows\System\fNvlCul.exe
  C:\Windows\System\fNvlCul.exe
  2⤵
  PID:13284
- C:\Windows\System\vnQFxBr.exe
  C:\Windows\System\vnQFxBr.exe
  2⤵
  PID:14024
- C:\Windows\System\StlkaFq.exe
  C:\Windows\System\StlkaFq.exe
  2⤵
  PID:11344
- C:\Windows\System\OAAMktN.exe
  C:\Windows\System\OAAMktN.exe
  2⤵
  PID:13444
- C:\Windows\System\HIySrAV.exe
  C:\Windows\System\HIySrAV.exe
  2⤵
  PID:13376
- C:\Windows\System\timbgVq.exe
  C:\Windows\System\timbgVq.exe
  2⤵
  PID:13576
- C:\Windows\System\vgiNdTR.exe
  C:\Windows\System\vgiNdTR.exe
  2⤵
  PID:13700
- C:\Windows\System\raOJOoL.exe
  C:\Windows\System\raOJOoL.exe
  2⤵
  PID:13840
- C:\Windows\System\SdKGQYs.exe
  C:\Windows\System\SdKGQYs.exe
  2⤵
  PID:2140
- C:\Windows\System\vdAyTui.exe
  C:\Windows\System\vdAyTui.exe
  2⤵
  PID:14304
- C:\Windows\System\oMYQFcm.exe
  C:\Windows\System\oMYQFcm.exe
  2⤵
  PID:14332
- C:\Windows\System\mOxibWh.exe
  C:\Windows\System\mOxibWh.exe
  2⤵
  PID:12960
- C:\Windows\System\oPYFvOE.exe
  C:\Windows\System\oPYFvOE.exe
  2⤵
  PID:13452
- C:\Windows\System\jEbABrZ.exe
  C:\Windows\System\jEbABrZ.exe
  2⤵
  PID:13412
- C:\Windows\System\LNqIsqi.exe
  C:\Windows\System\LNqIsqi.exe
  2⤵
  PID:13572
- C:\Windows\System\gljdfAG.exe
  C:\Windows\System\gljdfAG.exe
  2⤵
  PID:14056
- C:\Windows\System\poSPXWB.exe
  C:\Windows\System\poSPXWB.exe
  2⤵
  PID:12740
- C:\Windows\System\bfOsjNr.exe
  C:\Windows\System\bfOsjNr.exe
  2⤵
  PID:13404
- C:\Windows\System\ClDDAXe.exe
  C:\Windows\System\ClDDAXe.exe
  2⤵
  PID:12788
- C:\Windows\System\CpsrmXu.exe
  C:\Windows\System\CpsrmXu.exe
  2⤵
  PID:14276
- C:\Windows\System\xZSDdfq.exe
  C:\Windows\System\xZSDdfq.exe
  2⤵
  PID:12372
- C:\Windows\System\YJcViVV.exe
  C:\Windows\System\YJcViVV.exe
  2⤵
  PID:14260
- C:\Windows\System\XziNmRL.exe
  C:\Windows\System\XziNmRL.exe
  2⤵
  PID:13468
- C:\Windows\System\zsGSmrI.exe
  C:\Windows\System\zsGSmrI.exe
  2⤵
  PID:13664
- C:\Windows\System\vEosAiK.exe
  C:\Windows\System\vEosAiK.exe
  2⤵
  PID:12384
- C:\Windows\System\DcDUWWz.exe
  C:\Windows\System\DcDUWWz.exe
  2⤵
  PID:13520
- C:\Windows\System\NvHBXLi.exe
  C:\Windows\System\NvHBXLi.exe
  2⤵
  PID:13320
- C:\Windows\System\LEQktoi.exe
  C:\Windows\System\LEQktoi.exe
  2⤵
  PID:13044
- C:\Windows\System\KjBjTTa.exe
  C:\Windows\System\KjBjTTa.exe
  2⤵
  PID:13568
- C:\Windows\System\xDOleVG.exe
  C:\Windows\System\xDOleVG.exe
  2⤵
  PID:1368
- C:\Windows\System\XUcnIsu.exe
  C:\Windows\System\XUcnIsu.exe
  2⤵
  PID:13632
- C:\Windows\System\NkXPZsj.exe
  C:\Windows\System\NkXPZsj.exe
  2⤵
  PID:13824
- C:\Windows\System\ehBFIua.exe
  C:\Windows\System\ehBFIua.exe
  2⤵
  PID:13560
- C:\Windows\System\UjtDeeU.exe
  C:\Windows\System\UjtDeeU.exe
  2⤵
  PID:13640
- C:\Windows\System\uPaaQwm.exe
  C:\Windows\System\uPaaQwm.exe
  2⤵
  PID:456
- C:\Windows\System\YpjaUbJ.exe
  C:\Windows\System\YpjaUbJ.exe
  2⤵
  PID:12940
- C:\Windows\System\daOWeXr.exe
  C:\Windows\System\daOWeXr.exe
  2⤵
  PID:13512
- C:\Windows\System\lBkejim.exe
  C:\Windows\System\lBkejim.exe
  2⤵
  PID:12800
- C:\Windows\System\odctazE.exe
  C:\Windows\System\odctazE.exe
  2⤵
  PID:14020
- C:\Windows\System\xtaBkdG.exe
  C:\Windows\System\xtaBkdG.exe
  2⤵
  PID:14188
- C:\Windows\System\GlhWlUI.exe
  C:\Windows\System\GlhWlUI.exe
  2⤵
  PID:14268
- C:\Windows\System\PeNvLZS.exe
  C:\Windows\System\PeNvLZS.exe
  2⤵
  PID:13668
- C:\Windows\System\XWryyVV.exe
  C:\Windows\System\XWryyVV.exe
  2⤵
  PID:14324
- C:\Windows\System\hBzoJlv.exe
  C:\Windows\System\hBzoJlv.exe
  2⤵
  PID:13660
- C:\Windows\System\ESepwDz.exe
  C:\Windows\System\ESepwDz.exe
  2⤵
  PID:13844
- C:\Windows\System\MWqGcgw.exe
  C:\Windows\System\MWqGcgw.exe
  2⤵
  PID:13592
- C:\Windows\System\CejlxpX.exe
  C:\Windows\System\CejlxpX.exe
  2⤵
  PID:4044
- C:\Windows\System\zdUdIdG.exe
  C:\Windows\System\zdUdIdG.exe
  2⤵
  PID:11884
- C:\Windows\System\fhQgwQf.exe
  C:\Windows\System\fhQgwQf.exe
  2⤵
  PID:13144
- C:\Windows\System\IqNtHzC.exe
  C:\Windows\System\IqNtHzC.exe
  2⤵
  PID:184
- C:\Windows\System\CCngWmm.exe
  C:\Windows\System\CCngWmm.exe
  2⤵
  PID:2484
- C:\Windows\System\lIWAjVd.exe
  C:\Windows\System\lIWAjVd.exe
  2⤵
  PID:3316
- C:\Windows\System\GGioqnH.exe
  C:\Windows\System\GGioqnH.exe
  2⤵
  PID:4804
- C:\Windows\System\YypRPFz.exe
  C:\Windows\System\YypRPFz.exe
  2⤵
  PID:14308
- C:\Windows\System\BJWazWl.exe
  C:\Windows\System\BJWazWl.exe
  2⤵
  PID:12988
- C:\Windows\System\TVstwWP.exe
  C:\Windows\System\TVstwWP.exe
  2⤵
  PID:3972
- C:\Windows\System\PTjTrgw.exe
  C:\Windows\System\PTjTrgw.exe
  2⤵
  PID:13020
- C:\Windows\System\csJwJZL.exe
  C:\Windows\System\csJwJZL.exe
  2⤵
  PID:12328
- C:\Windows\System\ebyJNCo.exe
  C:\Windows\System\ebyJNCo.exe
  2⤵
  PID:14156
- C:\Windows\System\upkigsV.exe
  C:\Windows\System\upkigsV.exe
  2⤵
  PID:13164
- C:\Windows\System\dUcGEKq.exe
  C:\Windows\System\dUcGEKq.exe
  2⤵
  PID:5096
- C:\Windows\System\FtJzCiM.exe
  C:\Windows\System\FtJzCiM.exe
  2⤵
  PID:1348
- C:\Windows\System\VNMZTNA.exe
  C:\Windows\System\VNMZTNA.exe
  2⤵
  PID:2704
- C:\Windows\System\tEUAiOw.exe
  C:\Windows\System\tEUAiOw.exe
  2⤵
  PID:3988
- C:\Windows\System\ILMnIaF.exe
  C:\Windows\System\ILMnIaF.exe
  2⤵
  PID:12756
- C:\Windows\System\EJaYSZr.exe
  C:\Windows\System\EJaYSZr.exe
  2⤵
  PID:12864
- C:\Windows\System\IGeKApB.exe
  C:\Windows\System\IGeKApB.exe
  2⤵
  PID:12112
- C:\Windows\System\MhMjdpm.exe
  C:\Windows\System\MhMjdpm.exe
  2⤵
  PID:12148
- C:\Windows\System\zcMpUTr.exe
  C:\Windows\System\zcMpUTr.exe
  2⤵
  PID:13628
- C:\Windows\System\oYPfpDd.exe
  C:\Windows\System\oYPfpDd.exe
  2⤵
  PID:12552
- C:\Windows\System\VsiAIYD.exe
  C:\Windows\System\VsiAIYD.exe
  2⤵
  PID:13556
- C:\Windows\System\rlAIxso.exe
  C:\Windows\System\rlAIxso.exe
  2⤵
  PID:13772
- C:\Windows\System\LxmoFHf.exe
  C:\Windows\System\LxmoFHf.exe
  2⤵
  PID:3280
- C:\Windows\System\eJfCdNn.exe
  C:\Windows\System\eJfCdNn.exe
  2⤵
  PID:13368
- C:\Windows\System\AhGaIyE.exe
  C:\Windows\System\AhGaIyE.exe
  2⤵
  PID:13096
- C:\Windows\System\goAoQHU.exe
  C:\Windows\System\goAoQHU.exe
  2⤵
  PID:14232
- C:\Windows\System\KqzPudY.exe
  C:\Windows\System\KqzPudY.exe
  2⤵
  PID:14004
- C:\Windows\System\ROnQSlH.exe
  C:\Windows\System\ROnQSlH.exe
  2⤵
  PID:13060
- C:\Windows\System\gWigYQe.exe
  C:\Windows\System\gWigYQe.exe
  2⤵
  PID:12400
- C:\Windows\System\PJXeLzs.exe
  C:\Windows\System\PJXeLzs.exe
  2⤵
  PID:4452
- C:\Windows\System\GRSDUHx.exe
  C:\Windows\System\GRSDUHx.exe
  2⤵
  PID:13332
- C:\Windows\System\lnYNMni.exe
  C:\Windows\System\lnYNMni.exe
  2⤵
  PID:12640
- C:\Windows\System\mqujZDO.exe
  C:\Windows\System\mqujZDO.exe
  2⤵
  PID:4596
- C:\Windows\System\gYaKCMs.exe
  C:\Windows\System\gYaKCMs.exe
  2⤵
  PID:11744
- C:\Windows\System\AoIINCL.exe
  C:\Windows\System\AoIINCL.exe
  2⤵
  PID:11676
- C:\Windows\System\yEluXXn.exe
  C:\Windows\System\yEluXXn.exe
  2⤵
  PID:3220
- C:\Windows\System\tasKPft.exe
  C:\Windows\System\tasKPft.exe
  2⤵
  PID:2664
- C:\Windows\System\CLNFfJw.exe
  C:\Windows\System\CLNFfJw.exe
  2⤵
  PID:12624
- C:\Windows\System\yMIZOGu.exe
  C:\Windows\System\yMIZOGu.exe
  2⤵
  PID:13916
- C:\Windows\System\VKkJfBs.exe
  C:\Windows\System\VKkJfBs.exe
  2⤵
  PID:14292
- C:\Windows\System\BWFdnec.exe
  C:\Windows\System\BWFdnec.exe
  2⤵
  PID:12784
- C:\Windows\System\NiYjHwz.exe
  C:\Windows\System\NiYjHwz.exe
  2⤵
  PID:13000
- C:\Windows\System\RGrFjFG.exe
  C:\Windows\System\RGrFjFG.exe
  2⤵
  PID:12200
- C:\Windows\System\zUNQWrD.exe
  C:\Windows\System\zUNQWrD.exe
  2⤵
  PID:13180
- C:\Windows\System\RVEfXfo.exe
  C:\Windows\System\RVEfXfo.exe
  2⤵
  PID:14284
- C:\Windows\System\omYSXEz.exe
  C:\Windows\System\omYSXEz.exe
  2⤵
  PID:13348
- C:\Windows\System\AYKtXky.exe
  C:\Windows\System\AYKtXky.exe
  2⤵
  PID:13408
- C:\Windows\System\TNiGgoa.exe
  C:\Windows\System\TNiGgoa.exe
  2⤵
  PID:13972
- C:\Windows\System\LrADiuN.exe
  C:\Windows\System\LrADiuN.exe
  2⤵
  PID:520
- C:\Windows\System\HcXpAEY.exe
  C:\Windows\System\HcXpAEY.exe
  2⤵
  PID:1996
- C:\Windows\System\FRXCZXr.exe
  C:\Windows\System\FRXCZXr.exe
  2⤵
  PID:3516
- C:\Windows\System\MKzUgpt.exe
  C:\Windows\System\MKzUgpt.exe
  2⤵
  PID:4212
- C:\Windows\System\kHlcaQV.exe
  C:\Windows\System\kHlcaQV.exe
  2⤵
  PID:3052
- C:\Windows\System\RntiKvF.exe
  C:\Windows\System\RntiKvF.exe
  2⤵
  PID:13488
- C:\Windows\System\UVDFtAe.exe
  C:\Windows\System\UVDFtAe.exe
  2⤵
  PID:13504
- C:\Windows\System\cDsmIbZ.exe
  C:\Windows\System\cDsmIbZ.exe
  2⤵
  PID:13472
- C:\Windows\System\BcoMATB.exe
  C:\Windows\System\BcoMATB.exe
  2⤵
  PID:12440
- C:\Windows\System\TTVOiny.exe
  C:\Windows\System\TTVOiny.exe
  2⤵
  PID:12516
- C:\Windows\System\mehmXtZ.exe
  C:\Windows\System\mehmXtZ.exe
  2⤵
  PID:3612
- C:\Windows\System\JtKyAhx.exe
  C:\Windows\System\JtKyAhx.exe
  2⤵
  PID:6880
- C:\Windows\System\oxcsehH.exe
  C:\Windows\System\oxcsehH.exe
  2⤵
  PID:2964
- C:\Windows\System\cCspfLo.exe
  C:\Windows\System\cCspfLo.exe
  2⤵
  PID:7080
- C:\Windows\System\oxKluoI.exe
  C:\Windows\System\oxKluoI.exe
  2⤵
  PID:13932
- C:\Windows\System\bOaPaNz.exe
  C:\Windows\System\bOaPaNz.exe
  2⤵
  PID:13940
- C:\Windows\System\VBsMmLh.exe
  C:\Windows\System\VBsMmLh.exe
  2⤵
  PID:14072
- C:\Windows\System\NbJwRxy.exe
  C:\Windows\System\NbJwRxy.exe
  2⤵
  PID:1704
- C:\Windows\System\mlguRCH.exe
  C:\Windows\System\mlguRCH.exe
  2⤵
  PID:6220
- C:\Windows\System\krPiohT.exe
  C:\Windows\System\krPiohT.exe
  2⤵
  PID:13492
- C:\Windows\System\XaoXlyt.exe
  C:\Windows\System\XaoXlyt.exe
  2⤵
  PID:2232
- C:\Windows\System\ffpJLLR.exe
  C:\Windows\System\ffpJLLR.exe
  2⤵
  PID:3248
- C:\Windows\System\tZmSylN.exe
  C:\Windows\System\tZmSylN.exe
  2⤵
  PID:4136
- C:\Windows\System\zqlwqVx.exe
  C:\Windows\System\zqlwqVx.exe
  2⤵
  PID:212
- C:\Windows\System\SedaUCb.exe
  C:\Windows\System\SedaUCb.exe
  2⤵
  PID:4116
- C:\Windows\System\GGRNocT.exe
  C:\Windows\System\GGRNocT.exe
  2⤵
  PID:13980
- C:\Windows\System\jpoVDAb.exe
  C:\Windows\System\jpoVDAb.exe
  2⤵
  PID:3892
- C:\Windows\System\JRUazip.exe
  C:\Windows\System\JRUazip.exe
  2⤵
  PID:3076
- C:\Windows\System\xEnImXg.exe
  C:\Windows\System\xEnImXg.exe
  2⤵
  PID:6172
- C:\Windows\System\bVymQzx.exe
  C:\Windows\System\bVymQzx.exe
  2⤵
  PID:6884
- C:\Windows\System\awoKaaQ.exe
  C:\Windows\System\awoKaaQ.exe
  2⤵
  PID:3720
- C:\Windows\System\wBkkQNA.exe
  C:\Windows\System\wBkkQNA.exe
  2⤵
  PID:6980
- C:\Windows\System\YWEbDvw.exe
  C:\Windows\System\YWEbDvw.exe
  2⤵
  PID:1560
- C:\Windows\System\PnTwpsW.exe
  C:\Windows\System\PnTwpsW.exe
  2⤵
  PID:6176
- C:\Windows\System\ILtBWMk.exe
  C:\Windows\System\ILtBWMk.exe
  2⤵
  PID:6396
- C:\Windows\System\sQGeTLb.exe
  C:\Windows\System\sQGeTLb.exe
  2⤵
  PID:6808
- C:\Windows\System\XdWQOlj.exe
  C:\Windows\System\XdWQOlj.exe
  2⤵
  PID:5224
- C:\Windows\System\jBGRuLD.exe
  C:\Windows\System\jBGRuLD.exe
  2⤵
  PID:7172
- C:\Windows\System\oHzTrzd.exe
  C:\Windows\System\oHzTrzd.exe
  2⤵
  PID:2268
- C:\Windows\System\twCVxHv.exe
  C:\Windows\System\twCVxHv.exe
  2⤵
  PID:3256
- C:\Windows\System\URyVVDZ.exe
  C:\Windows\System\URyVVDZ.exe
  2⤵
  PID:13672
- C:\Windows\System\IHaZSBS.exe
  C:\Windows\System\IHaZSBS.exe
  2⤵
  PID:4444
- C:\Windows\System\LinwecD.exe
  C:\Windows\System\LinwecD.exe
  2⤵
  PID:14300
- C:\Windows\System\QYfZgrx.exe
  C:\Windows\System\QYfZgrx.exe
  2⤵
  PID:2688
- C:\Windows\System\AHRclOA.exe
  C:\Windows\System\AHRclOA.exe
  2⤵
  PID:1972
- C:\Windows\System\YGbBsnc.exe
  C:\Windows\System\YGbBsnc.exe
  2⤵
  PID:12612
- C:\Windows\System\ozyofpS.exe
  C:\Windows\System\ozyofpS.exe
  2⤵
  PID:5092
- C:\Windows\System\jqVLwCi.exe
  C:\Windows\System\jqVLwCi.exe
  2⤵
  PID:768
- C:\Windows\System\ukdRPhG.exe
  C:\Windows\System\ukdRPhG.exe
  2⤵
  PID:2728
- C:\Windows\System\GSjROLX.exe
  C:\Windows\System\GSjROLX.exe
  2⤵
  PID:1344
- C:\Windows\System\eScbvUv.exe
  C:\Windows\System\eScbvUv.exe
  2⤵
  PID:2772
- C:\Windows\System\tQHJPGH.exe
  C:\Windows\System\tQHJPGH.exe
  2⤵
  PID:4840
- C:\Windows\System\cpnmPGK.exe
  C:\Windows\System\cpnmPGK.exe
  2⤵
  PID:2056
- C:\Windows\System\BxVayrf.exe
  C:\Windows\System\BxVayrf.exe
  2⤵
  PID:3428
- C:\Windows\System\MkBcmny.exe
  C:\Windows\System\MkBcmny.exe
  2⤵
  PID:1876
- C:\Windows\System\GInNPmc.exe
  C:\Windows\System\GInNPmc.exe
  2⤵
  PID:1556
- C:\Windows\System\wwmrAHC.exe
  C:\Windows\System\wwmrAHC.exe
  2⤵
  PID:2348
- C:\Windows\System\VPgxFDT.exe
  C:\Windows\System\VPgxFDT.exe
  2⤵
  PID:4300
- C:\Windows\System\ytqWSUU.exe
  C:\Windows\System\ytqWSUU.exe
  2⤵
  PID:4360
- C:\Windows\System\KTnxIas.exe
  C:\Windows\System\KTnxIas.exe
  2⤵
  PID:7116
- C:\Windows\System\ZYKjNjJ.exe
  C:\Windows\System\ZYKjNjJ.exe
  2⤵
  PID:5628
- C:\Windows\System\TpKDVya.exe
  C:\Windows\System\TpKDVya.exe
  2⤵
  PID:13480
- C:\Windows\System\wQiFYWA.exe
  C:\Windows\System\wQiFYWA.exe
  2⤵
  PID:1148
- C:\Windows\System\prjLNgU.exe
  C:\Windows\System\prjLNgU.exe
  2⤵
  PID:13848
- C:\Windows\System\iWmpdKu.exe
  C:\Windows\System\iWmpdKu.exe
  2⤵
  PID:7108
- C:\Windows\System\qAakVPK.exe
  C:\Windows\System\qAakVPK.exe
  2⤵
  PID:3768
- C:\Windows\System\DcCNeOq.exe
  C:\Windows\System\DcCNeOq.exe
  2⤵
  PID:4588
- C:\Windows\System\EdVYsIA.exe
  C:\Windows\System\EdVYsIA.exe
  2⤵
  PID:920
- C:\Windows\System\sRsFmUx.exe
  C:\Windows\System\sRsFmUx.exe
  2⤵
  PID:3684
- C:\Windows\System\JIOeLXA.exe
  C:\Windows\System\JIOeLXA.exe
  2⤵
  PID:4768
- C:\Windows\System\iefmXMc.exe
  C:\Windows\System\iefmXMc.exe
  2⤵
  PID:4000
- C:\Windows\System\JqJtdzy.exe
  C:\Windows\System\JqJtdzy.exe
  2⤵
  PID:4540
- C:\Windows\System\Bmrvpgl.exe
  C:\Windows\System\Bmrvpgl.exe
  2⤵
  PID:4224
- C:\Windows\System\bZGfsKW.exe
  C:\Windows\System\bZGfsKW.exe
  2⤵
  PID:2760
- C:\Windows\System\WyvNOXJ.exe
  C:\Windows\System\WyvNOXJ.exe
  2⤵
  PID:1092
- C:\Windows\System\ehZvaoU.exe
  C:\Windows\System\ehZvaoU.exe
  2⤵
  PID:1956
- C:\Windows\System\wtYtIpw.exe
  C:\Windows\System\wtYtIpw.exe
  2⤵
  PID:1668
- C:\Windows\System\KjYiEoT.exe
  C:\Windows\System\KjYiEoT.exe
  2⤵
  PID:644
- C:\Windows\System\BtMjDek.exe
  C:\Windows\System\BtMjDek.exe
  2⤵
  PID:3392
- C:\Windows\System\qfEPXwq.exe
  C:\Windows\System\qfEPXwq.exe
  2⤵
  PID:820
- C:\Windows\System\zezaNLa.exe
  C:\Windows\System\zezaNLa.exe
  2⤵
  PID:4636
- C:\Windows\System\QGRAyGl.exe
  C:\Windows\System\QGRAyGl.exe
  2⤵
  PID:2156
- C:\Windows\System\HyUnONc.exe
  C:\Windows\System\HyUnONc.exe
  2⤵
  PID:6216
- C:\Windows\System\yUeVqSX.exe
  C:\Windows\System\yUeVqSX.exe
  2⤵
  PID:3776
- C:\Windows\System\kWLSkiN.exe
  C:\Windows\System\kWLSkiN.exe
  2⤵
  PID:6500
- C:\Windows\System\LWDrbeZ.exe
  C:\Windows\System\LWDrbeZ.exe
  2⤵
  PID:228
- C:\Windows\System\njhWAsB.exe
  C:\Windows\System\njhWAsB.exe
  2⤵
  PID:3240
- C:\Windows\System\OxBqtKk.exe
  C:\Windows\System\OxBqtKk.exe
  2⤵
  PID:7808
- C:\Windows\System\jdpxLgW.exe
  C:\Windows\System\jdpxLgW.exe
  2⤵
  PID:7832
- C:\Windows\System\tjchEHy.exe
  C:\Windows\System\tjchEHy.exe
  2⤵
  PID:7920
- C:\Windows\System\fXPEqSH.exe
  C:\Windows\System\fXPEqSH.exe
  2⤵
  PID:7056
- C:\Windows\System\pkSjcsM.exe
  C:\Windows\System\pkSjcsM.exe
  2⤵
  PID:1808
- C:\Windows\System\kNXSqOH.exe
  C:\Windows\System\kNXSqOH.exe
  2⤵
  PID:7008
- C:\Windows\System\ECkJSii.exe
  C:\Windows\System\ECkJSii.exe
  2⤵
  PID:1512
- C:\Windows\System\sjEhaUd.exe
  C:\Windows\System\sjEhaUd.exe
  2⤵
  PID:2264
- C:\Windows\System\qPmsghM.exe
  C:\Windows\System\qPmsghM.exe
  2⤵
  PID:5232
- C:\Windows\System\SMpKIIg.exe
  C:\Windows\System\SMpKIIg.exe
  2⤵
  PID:7060
- C:\Windows\System\rKXgZAB.exe
  C:\Windows\System\rKXgZAB.exe
  2⤵
  PID:7980
- C:\Windows\System\dKNjjBJ.exe
  C:\Windows\System\dKNjjBJ.exe
  2⤵
  PID:7996
- C:\Windows\System\mxqzSQC.exe
  C:\Windows\System\mxqzSQC.exe
  2⤵
  PID:4780
- C:\Windows\System\YYKUAOd.exe
  C:\Windows\System\YYKUAOd.exe
  2⤵
  PID:2008
- C:\Windows\System\WPkyEYK.exe
  C:\Windows\System\WPkyEYK.exe
  2⤵
  PID:5272
- C:\Windows\System\gHNnBpm.exe
  C:\Windows\System\gHNnBpm.exe
  2⤵
  PID:1796
- C:\Windows\System\rnDJBcx.exe
  C:\Windows\System\rnDJBcx.exe
  2⤵
  PID:4560
- C:\Windows\System\GQdZXZP.exe
  C:\Windows\System\GQdZXZP.exe
  2⤵
  PID:2804
- C:\Windows\System\efuIRTs.exe
  C:\Windows\System\efuIRTs.exe
  2⤵
  PID:1248
- C:\Windows\System\huUmyCQ.exe
  C:\Windows\System\huUmyCQ.exe
  2⤵
  PID:4436
- C:\Windows\System\ulKWZPJ.exe
  C:\Windows\System\ulKWZPJ.exe
  2⤵
  PID:5372
- C:\Windows\System\xaFxjAF.exe
  C:\Windows\System\xaFxjAF.exe
  2⤵
  PID:3668
- C:\Windows\System\kbDlEcH.exe
  C:\Windows\System\kbDlEcH.exe
  2⤵
  PID:5400
- C:\Windows\System\HFwHNYb.exe
  C:\Windows\System\HFwHNYb.exe
  2⤵
  PID:2212
- C:\Windows\System\DMdekKe.exe
  C:\Windows\System\DMdekKe.exe
  2⤵
  PID:2652
- C:\Windows\System\lObDDzV.exe
  C:\Windows\System\lObDDzV.exe
  2⤵
  PID:7864
- C:\Windows\System\yBqdQcJ.exe
  C:\Windows\System\yBqdQcJ.exe
  2⤵
  PID:5448
- C:\Windows\System\YghQoQk.exe
  C:\Windows\System\YghQoQk.exe
  2⤵
  PID:6612
- C:\Windows\System\KcLnICD.exe
  C:\Windows\System\KcLnICD.exe
  2⤵
  PID:5508
- C:\Windows\System\rXJtdbI.exe
  C:\Windows\System\rXJtdbI.exe
  2⤵
  PID:7024
- C:\Windows\System\gVsdnnw.exe
  C:\Windows\System\gVsdnnw.exe
  2⤵
  PID:2168
- C:\Windows\System\rDtxFnc.exe
  C:\Windows\System\rDtxFnc.exe
  2⤵
  PID:5552
- C:\Windows\System\ajnAUsn.exe
  C:\Windows\System\ajnAUsn.exe
  2⤵
  PID:4356
- C:\Windows\System\AIrzOzL.exe
  C:\Windows\System\AIrzOzL.exe
  2⤵
  PID:8008
- C:\Windows\System\CObWRxz.exe
  C:\Windows\System\CObWRxz.exe
  2⤵
  PID:3444
- C:\Windows\System\YTwGwpg.exe
  C:\Windows\System\YTwGwpg.exe
  2⤵
  PID:2744
- C:\Windows\System\ILmNnPv.exe
  C:\Windows\System\ILmNnPv.exe
  2⤵
  PID:3236
- C:\Windows\System\YstRVLD.exe
  C:\Windows\System\YstRVLD.exe
  2⤵
  PID:5632
- C:\Windows\System\PoZnEID.exe
  C:\Windows\System\PoZnEID.exe
  2⤵
  PID:4080
- C:\Windows\System\jCVxeXp.exe
  C:\Windows\System\jCVxeXp.exe
  2⤵
  PID:7304
- C:\Windows\System\ZCmSPGe.exe
  C:\Windows\System\ZCmSPGe.exe
  2⤵
  PID:7280
- C:\Windows\System\uKeIxCV.exe
  C:\Windows\System\uKeIxCV.exe
  2⤵
  PID:7420
- C:\Windows\System\URkYAWo.exe
  C:\Windows\System\URkYAWo.exe
  2⤵
  PID:13516
- C:\Windows\System\BMnqxBZ.exe
  C:\Windows\System\BMnqxBZ.exe
  2⤵
  PID:5260
- C:\Windows\System\mWCrNSN.exe
  C:\Windows\System\mWCrNSN.exe
  2⤵
  PID:2912
- C:\Windows\System\yMGRFOF.exe
  C:\Windows\System\yMGRFOF.exe
  2⤵
  PID:4208
- C:\Windows\System\PFooxAf.exe
  C:\Windows\System\PFooxAf.exe
  2⤵
  PID:7576
- C:\Windows\System\pIbHxhl.exe
  C:\Windows\System\pIbHxhl.exe
  2⤵
  PID:7760
- C:\Windows\System\aLGXmwY.exe
  C:\Windows\System\aLGXmwY.exe
  2⤵
  PID:7828
- C:\Windows\System\fJTmwzH.exe
  C:\Windows\System\fJTmwzH.exe
  2⤵
  PID:4688
- C:\Windows\System\FtucsNu.exe
  C:\Windows\System\FtucsNu.exe
  2⤵
  PID:6892
- C:\Windows\System\LJbtqRX.exe
  C:\Windows\System\LJbtqRX.exe
  2⤵
  PID:2924
- C:\Windows\System\CDjINaI.exe
  C:\Windows\System\CDjINaI.exe
  2⤵
  PID:4884
- C:\Windows\System\Dscoqfy.exe
  C:\Windows\System\Dscoqfy.exe
  2⤵
  PID:692
- C:\Windows\System\nKBFniR.exe
  C:\Windows\System\nKBFniR.exe
  2⤵
  PID:7520
- C:\Windows\System\TjiJKSb.exe
  C:\Windows\System\TjiJKSb.exe
  2⤵
  PID:5344
- C:\Windows\System\DxOcOKE.exe
  C:\Windows\System\DxOcOKE.exe
  2⤵
  PID:5720
- C:\Windows\System\nivPIUI.exe
  C:\Windows\System\nivPIUI.exe
  2⤵
  PID:7924
- C:\Windows\System\GPbUrRW.exe
  C:\Windows\System\GPbUrRW.exe
  2⤵
  PID:5412
- C:\Windows\System\SJHfyno.exe
  C:\Windows\System\SJHfyno.exe
  2⤵
  PID:5748
- C:\Windows\System\zQrpQra.exe
  C:\Windows\System\zQrpQra.exe
  2⤵
  PID:5768
- C:\Windows\System\koSojId.exe
  C:\Windows\System\koSojId.exe
  2⤵
  PID:5016
- C:\Windows\System\ROpXoSD.exe
  C:\Windows\System\ROpXoSD.exe
  2⤵
  PID:6828
- C:\Windows\System\LDHYKXr.exe
  C:\Windows\System\LDHYKXr.exe
  2⤵
  PID:7236
- C:\Windows\System\lakPyLg.exe
  C:\Windows\System\lakPyLg.exe
  2⤵
  PID:5856
- C:\Windows\System\iFmPSQJ.exe
  C:\Windows\System\iFmPSQJ.exe
  2⤵
  PID:7560
- C:\Windows\System\CiHkORQ.exe
  C:\Windows\System\CiHkORQ.exe
  2⤵
  PID:13644
- C:\Windows\System\xgNdtGU.exe
  C:\Windows\System\xgNdtGU.exe
  2⤵
  PID:5212
- C:\Windows\System\tCoAODn.exe
  C:\Windows\System\tCoAODn.exe
  2⤵
  PID:5944
- C:\Windows\System\qpuwKhO.exe
  C:\Windows\System\qpuwKhO.exe
  2⤵
  PID:7412
- C:\Windows\System\taVhfGu.exe
  C:\Windows\System\taVhfGu.exe
  2⤵
  PID:6896
- C:\Windows\System\XKgHgub.exe
  C:\Windows\System\XKgHgub.exe
  2⤵
  PID:8056
- C:\Windows\System\XLDKZlk.exe
  C:\Windows\System\XLDKZlk.exe
  2⤵
  PID:4448
- C:\Windows\System\ZSvQofY.exe
  C:\Windows\System\ZSvQofY.exe
  2⤵
  PID:7744
- C:\Windows\System\jYnNGmT.exe
  C:\Windows\System\jYnNGmT.exe
  2⤵
  PID:6028
- C:\Windows\System\EakQBRr.exe
  C:\Windows\System\EakQBRr.exe
  2⤵
  PID:7836
- C:\Windows\System\IyAIQWs.exe
  C:\Windows\System\IyAIQWs.exe
  2⤵
  PID:7872
- C:\Windows\System\EgGHuqQ.exe
  C:\Windows\System\EgGHuqQ.exe
  2⤵
  PID:5708
- C:\Windows\System\TzBdqMx.exe
  C:\Windows\System\TzBdqMx.exe
  2⤵
  PID:5596
- C:\Windows\System\owYYCRm.exe
  C:\Windows\System\owYYCRm.exe
  2⤵
  PID:4832
- C:\Windows\System\eTDDiwv.exe
  C:\Windows\System\eTDDiwv.exe
  2⤵
  PID:7964
- C:\Windows\System\BihCUBb.exe
  C:\Windows\System\BihCUBb.exe
  2⤵
  PID:8188
- C:\Windows\System\gfrkmfq.exe
  C:\Windows\System\gfrkmfq.exe
  2⤵
  PID:3688
- C:\Windows\System\xjMTOIK.exe
  C:\Windows\System\xjMTOIK.exe
  2⤵
  PID:5784
- C:\Windows\System\YpHEARp.exe
  C:\Windows\System\YpHEARp.exe
  2⤵
  PID:5820
- C:\Windows\System\vEIqaGH.exe
  C:\Windows\System\vEIqaGH.exe
  2⤵
  PID:7184
- C:\Windows\System\KfJPNcf.exe
  C:\Windows\System\KfJPNcf.exe
  2⤵
  PID:7284
- C:\Windows\System\yWvHdmv.exe
  C:\Windows\System\yWvHdmv.exe
  2⤵
  PID:5876
- C:\Windows\System\abdbFaX.exe
  C:\Windows\System\abdbFaX.exe
  2⤵
  PID:3928
- C:\Windows\System\fnNIZeH.exe
  C:\Windows\System\fnNIZeH.exe
  2⤵
  PID:3176
- C:\Windows\System\KDDFoCe.exe
  C:\Windows\System\KDDFoCe.exe
  2⤵
  PID:7624
- C:\Windows\System\dwaHGdO.exe
  C:\Windows\System\dwaHGdO.exe
  2⤵
  PID:4220
- C:\Windows\System\XEMDngj.exe
  C:\Windows\System\XEMDngj.exe
  2⤵
  PID:8100
- C:\Windows\System\nuufnrU.exe
  C:\Windows\System\nuufnrU.exe
  2⤵
  PID:8620
- C:\Windows\System\ZbSGoCr.exe
  C:\Windows\System\ZbSGoCr.exe
  2⤵
  PID:8648
- C:\Windows\System\RZufyJV.exe
  C:\Windows\System\RZufyJV.exe
  2⤵
  PID:5244
- C:\Windows\System\QHyeuRn.exe
  C:\Windows\System\QHyeuRn.exe
  2⤵
  PID:4816
- C:\Windows\System\jTUJyQn.exe
  C:\Windows\System\jTUJyQn.exe
  2⤵
  PID:7332
- C:\Windows\System\ghPQLYS.exe
  C:\Windows\System\ghPQLYS.exe
  2⤵
  PID:6000
- C:\Windows\System\FXdZryi.exe
  C:\Windows\System\FXdZryi.exe
  2⤵
  PID:5972
- C:\Windows\System\LTaqhZW.exe
  C:\Windows\System\LTaqhZW.exe
  2⤵
  PID:8800
- C:\Windows\System\dmuNEdb.exe
  C:\Windows\System\dmuNEdb.exe
  2⤵
  PID:6084
- C:\Windows\System\xIUXjue.exe
  C:\Windows\System\xIUXjue.exe
  2⤵
  PID:5148
- C:\Windows\System\flelNBM.exe
  C:\Windows\System\flelNBM.exe
  2⤵
  PID:6112
- C:\Windows\System\WvtYCry.exe
  C:\Windows\System\WvtYCry.exe
  2⤵
  PID:5524
- C:\Windows\System\DtDnQfE.exe
  C:\Windows\System\DtDnQfE.exe
  2⤵
  PID:5220
- C:\Windows\System\qFbeQve.exe
  C:\Windows\System\qFbeQve.exe
  2⤵
  PID:8924
- C:\Windows\System\ddkSpTu.exe
  C:\Windows\System\ddkSpTu.exe
  2⤵
  PID:8904
- C:\Windows\System\gLQifho.exe
  C:\Windows\System\gLQifho.exe
  2⤵
  PID:8972
- C:\Windows\System\iJXAFQn.exe
  C:\Windows\System\iJXAFQn.exe
  2⤵
  PID:9028
- C:\Windows\System\rUUVXQf.exe
  C:\Windows\System\rUUVXQf.exe
  2⤵
  PID:9040
- C:\Windows\System\nGoYQMJ.exe
  C:\Windows\System\nGoYQMJ.exe
  2⤵
  PID:9132
- C:\Windows\System\gyxniQH.exe
  C:\Windows\System\gyxniQH.exe
  2⤵
  PID:5684
- C:\Windows\System\ybglmHt.exe
  C:\Windows\System\ybglmHt.exe
  2⤵
  PID:8104
- C:\Windows\System\XxvimRd.exe
  C:\Windows\System\XxvimRd.exe
  2⤵
  PID:8020
- C:\Windows\System\mRHYeqi.exe
  C:\Windows\System\mRHYeqi.exe
  2⤵
  PID:5332
- C:\Windows\System\GhSyXns.exe
  C:\Windows\System\GhSyXns.exe
  2⤵
  PID:7368
- C:\Windows\System\pwHKlNo.exe
  C:\Windows\System\pwHKlNo.exe
  2⤵
  PID:8656
- C:\Windows\System\KWSbyIg.exe
  C:\Windows\System\KWSbyIg.exe
  2⤵
  PID:8252
- C:\Windows\System\SwaLscM.exe
  C:\Windows\System\SwaLscM.exe
  2⤵
  PID:8336
- C:\Windows\System\XZaRJXo.exe
  C:\Windows\System\XZaRJXo.exe
  2⤵
  PID:2352
- C:\Windows\System\smJqVme.exe
  C:\Windows\System\smJqVme.exe
  2⤵
  PID:5580
- C:\Windows\System\kDDAOfP.exe
  C:\Windows\System\kDDAOfP.exe
  2⤵
  PID:3424
- C:\Windows\System\wJlRyZk.exe
  C:\Windows\System\wJlRyZk.exe
  2⤵
  PID:5724
- C:\Windows\System\EYhPYFH.exe
  C:\Windows\System\EYhPYFH.exe
  2⤵
  PID:6056
- C:\Windows\System\qhdtLGr.exe
  C:\Windows\System\qhdtLGr.exe
  2⤵
  PID:5904
- C:\Windows\System\Bfeidpe.exe
  C:\Windows\System\Bfeidpe.exe
  2⤵
  PID:5296
- C:\Windows\System\kbXTGsk.exe
  C:\Windows\System\kbXTGsk.exe
  2⤵
  PID:8768
- C:\Windows\System\mmnfUFk.exe
  C:\Windows\System\mmnfUFk.exe
  2⤵
  PID:8916
- C:\Windows\System\yogvHuK.exe
  C:\Windows\System\yogvHuK.exe
  2⤵
  PID:8692
- C:\Windows\System\vxUllNN.exe
  C:\Windows\System\vxUllNN.exe
  2⤵
  PID:5276
- C:\Windows\System\YLZBUzi.exe
  C:\Windows\System\YLZBUzi.exe
  2⤵
  PID:7188
- C:\Windows\System\dETxnwp.exe
  C:\Windows\System\dETxnwp.exe
  2⤵
  PID:8912
- C:\Windows\System\HZziJIO.exe
  C:\Windows\System\HZziJIO.exe
  2⤵
  PID:7592
- C:\Windows\System\IfNkwmf.exe
  C:\Windows\System\IfNkwmf.exe
  2⤵
  PID:8868
- C:\Windows\System\rkNNlJN.exe
  C:\Windows\System\rkNNlJN.exe
  2⤵
  PID:9076
- C:\Windows\System\OEQsiNO.exe
  C:\Windows\System\OEQsiNO.exe
  2⤵
  PID:4808
- C:\Windows\System\MTyjajK.exe
  C:\Windows\System\MTyjajK.exe
  2⤵
  PID:7492
- C:\Windows\System\zXhDemw.exe
  C:\Windows\System\zXhDemw.exe
  2⤵
  PID:1648
- C:\Windows\System\hIqvvWy.exe
  C:\Windows\System\hIqvvWy.exe
  2⤵
  PID:5960
- C:\Windows\System\iWrNXOJ.exe
  C:\Windows\System\iWrNXOJ.exe
  2⤵
  PID:8596
- C:\Windows\System\hVApISU.exe
  C:\Windows\System\hVApISU.exe
  2⤵
  PID:5392
- C:\Windows\System\isZjEAR.exe
  C:\Windows\System\isZjEAR.exe
  2⤵
  PID:5012
- C:\Windows\System\lDoSgWO.exe
  C:\Windows\System\lDoSgWO.exe
  2⤵
  PID:64
- C:\Windows\System\odSZnwP.exe
  C:\Windows\System\odSZnwP.exe
  2⤵
  PID:5472
- C:\Windows\System\vYmQfea.exe
  C:\Windows\System\vYmQfea.exe
  2⤵
  PID:9024
- C:\Windows\System\LDFcRkj.exe
  C:\Windows\System\LDFcRkj.exe
  2⤵
  PID:8200
- C:\Windows\System\ISPvWVK.exe
  C:\Windows\System\ISPvWVK.exe
  2⤵
  PID:5436
- C:\Windows\System\TBwfpUQ.exe
  C:\Windows\System\TBwfpUQ.exe
  2⤵
  PID:5624
- C:\Windows\System\crnNYzq.exe
  C:\Windows\System\crnNYzq.exe
  2⤵
  PID:9340
- C:\Windows\System\nQbYCEU.exe
  C:\Windows\System\nQbYCEU.exe
  2⤵
  PID:5752
- C:\Windows\System\EXDkfYG.exe
  C:\Windows\System\EXDkfYG.exe
  2⤵
  PID:9036
- C:\Windows\System\mAHnmGO.exe
  C:\Windows\System\mAHnmGO.exe
  2⤵
  PID:5164
- C:\Windows\System\GVtvBXA.exe
  C:\Windows\System\GVtvBXA.exe
  2⤵
  PID:9436
- C:\Windows\System\WqxCyzK.exe
  C:\Windows\System\WqxCyzK.exe
  2⤵
  PID:9540
- C:\Windows\System\UxSZcVG.exe
  C:\Windows\System\UxSZcVG.exe
  2⤵
  PID:9616
- C:\Windows\System\sjSacvG.exe
  C:\Windows\System\sjSacvG.exe
  2⤵
  PID:9644
- C:\Windows\System\mXTYpvk.exe
  C:\Windows\System\mXTYpvk.exe
  2⤵
  PID:6948
- C:\Windows\System\JLXepdP.exe
  C:\Windows\System\JLXepdP.exe
  2⤵
  PID:7668
- C:\Windows\System\MupOphi.exe
  C:\Windows\System\MupOphi.exe
  2⤵
  PID:5616
- C:\Windows\System\IebjsOU.exe
  C:\Windows\System\IebjsOU.exe
  2⤵
  PID:7496
- C:\Windows\System\vGzuhba.exe
  C:\Windows\System\vGzuhba.exe
  2⤵
  PID:5136
- C:\Windows\System\tXgvEkV.exe
  C:\Windows\System\tXgvEkV.exe
  2⤵
  PID:8948
- C:\Windows\System\bApanGt.exe
  C:\Windows\System\bApanGt.exe
  2⤵
  PID:8560
- C:\Windows\System\dvsgskn.exe
  C:\Windows\System\dvsgskn.exe
  2⤵
  PID:5956
- C:\Windows\System\AmnboQb.exe
  C:\Windows\System\AmnboQb.exe
  2⤵
  PID:9712
- C:\Windows\System\BjlVSct.exe
  C:\Windows\System\BjlVSct.exe
  2⤵
  PID:9768
- C:\Windows\System\rbgJXNr.exe
  C:\Windows\System\rbgJXNr.exe
  2⤵
  PID:9812
- C:\Windows\System\nhTFBpG.exe
  C:\Windows\System\nhTFBpG.exe
  2⤵
  PID:5916
- C:\Windows\System\UgleJqe.exe
  C:\Windows\System\UgleJqe.exe
  2⤵
  PID:6140
- C:\Windows\System\UljQPuy.exe
  C:\Windows\System\UljQPuy.exe
  2⤵
  PID:9016
- C:\Windows\System\ozoshdL.exe
  C:\Windows\System\ozoshdL.exe
  2⤵
  PID:9168
- C:\Windows\System\OPUqMxP.exe
  C:\Windows\System\OPUqMxP.exe
  2⤵
  PID:6228
- C:\Windows\System\EUTJReF.exe
  C:\Windows\System\EUTJReF.exe
  2⤵
  PID:6868
- C:\Windows\System\hIEgRAo.exe
  C:\Windows\System\hIEgRAo.exe
  2⤵
  PID:9940
- C:\Windows\System\yIzaKUR.exe
  C:\Windows\System\yIzaKUR.exe
  2⤵
  PID:9944
- C:\Windows\System\NToNLcf.exe
  C:\Windows\System\NToNLcf.exe
  2⤵
  PID:8164
- C:\Windows\System\QtmhOdC.exe
  C:\Windows\System\QtmhOdC.exe
  2⤵
  PID:6240
- C:\Windows\System\ukeFGrv.exe
  C:\Windows\System\ukeFGrv.exe
  2⤵
  PID:7136
- C:\Windows\System\bWGhiUe.exe
  C:\Windows\System\bWGhiUe.exe
  2⤵
  PID:8204
- C:\Windows\System\Wnydchu.exe
  C:\Windows\System\Wnydchu.exe
  2⤵
  PID:9512
- C:\Windows\System\VWkuMyw.exe
  C:\Windows\System\VWkuMyw.exe
  2⤵
  PID:6376
- C:\Windows\System\EMtcpiv.exe
  C:\Windows\System\EMtcpiv.exe
  2⤵
  PID:7876
- C:\Windows\System\ZNHerHN.exe
  C:\Windows\System\ZNHerHN.exe
  2⤵
  PID:6380
- C:\Windows\System\onmYQFR.exe
  C:\Windows\System\onmYQFR.exe
  2⤵
  PID:6416
- C:\Windows\System\NVTIRlv.exe
  C:\Windows\System\NVTIRlv.exe
  2⤵
  PID:10104
- C:\Windows\System\iHHBzCO.exe
  C:\Windows\System\iHHBzCO.exe
  2⤵
  PID:4460
- C:\Windows\System\sHLXNDm.exe
  C:\Windows\System\sHLXNDm.exe
  2⤵
  PID:9444
- C:\Windows\System\JXTBqRj.exe
  C:\Windows\System\JXTBqRj.exe
  2⤵
  PID:8628
- C:\Windows\System\JzHRXYW.exe
  C:\Windows\System\JzHRXYW.exe
  2⤵
  PID:9172
- C:\Windows\System\kxLzrMC.exe
  C:\Windows\System\kxLzrMC.exe
  2⤵
  PID:6464
- C:\Windows\System\UTAaEHw.exe
  C:\Windows\System\UTAaEHw.exe
  2⤵
  PID:5780
- C:\Windows\System\qzcpaqG.exe
  C:\Windows\System\qzcpaqG.exe
  2⤵
  PID:6508
- C:\Windows\System\VXvPPyL.exe
  C:\Windows\System\VXvPPyL.exe
  2⤵
  PID:5420
- C:\Windows\System\RvyqDSy.exe
  C:\Windows\System\RvyqDSy.exe
  2⤵
  PID:6520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m2mmvjbe.pfw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AiDvvGy.exe

Filesize
1.3MB

MD5
1faa1dc3684caa8274c5bcb11b6608b2

SHA1
898d78160ef568b5c85d776322cd839078e8d989

SHA256
ebc2e1455a05bcbf4c626473738a444b29d4aa120f0dbb21affb424a03cadfc0

SHA512
3d6915df4c83aa943c938dde463965e2e31e95034db43fc45d4018cec6f1058abf8c90fd61a15cdb387ece9debe2cdb1ef477ee0df6cc02f81927c53eadfa4e8

Download Submit
C:\Windows\System\ArVzNGh.exe

Filesize
1.3MB

MD5
823ce8ff565cdfcd5c205ce9ff89fa69

SHA1
6a952ae3480b33f70af837bce845b038f5a37db5

SHA256
d6440502e184c14c12f4ec9fdff055eb5c0c1483130c2bb909348acc055c46ac

SHA512
0c76a3be41f3f374de866deedc0fca727ef88db4d1a24f95c4e97067a13f6d3ee32273685c8f82cb30018c64ee7ba6f97fc9b01d5c6c4b531a1abeb6d28e791b

Download Submit
C:\Windows\System\CXJCciG.exe

Filesize
1.3MB

MD5
35def0c383b6d6119f04fe226d0e994e

SHA1
b8b03f991faee95c603b86402e79ba2ae4cbc662

SHA256
c33a1ed0172cca9883d9b2c160ca8c1d631854d39c34526a9ede5d68db474798

SHA512
d1d4d97cd95bfbf648835f541e65883d31faf6bf93edf9db44060c20467902f6fbc0e70839c48565126fd754868d9520e50ee40cb22e8320dd660b99d0b351ff

Download Submit
C:\Windows\System\EGHXGep.exe

Filesize
1.3MB

MD5
0ee52bcc5436d22504a9e66ef7b9bc9d

SHA1
5725a5718bb66598febc65a10be7446ab9a3f58a

SHA256
2ff9ce80c3dd695f9eb6b12f0cb46e4bb3b557451a0e6b53bb63115e8aa18c3a

SHA512
d728b50774cbfc49070223697bdf9002c0605988f6120e56c2a736fb1eb1ccc6105c6d3def324d41d4a3d6cb7f8ef9739fde5a10e88990161c5a6b219aa1e6a7

Download Submit
C:\Windows\System\EOWSHdT.exe

Filesize
1.3MB

MD5
d993768db83493635ddfe9251280e347

SHA1
ff42bb2499bab9005cb99b87a064b0de95eba8fd

SHA256
12866aea141653089cf22954c7e31ad87aa051b5e0777a7797b09b9b7a5f27cf

SHA512
cf88959dc12d357e21f2a0351c2dcab73b3f85c6c6e205ade8fa1fb7a5d5c173fbe4cc0f3bee8c7331d6550e905b1df6203c681f3c20d48f396baaf572bc8fa6

Download Submit
C:\Windows\System\FIUcVeD.exe

Filesize
1.3MB

MD5
c244156628f6ba19ed237825cb5eee6c

SHA1
9d0a934c9c0e196e7a77de1a305e524ddfc214fe

SHA256
23df3044e028cb71a8561d1f7104868728c83a6ca9b6446d62d25918563001e2

SHA512
a18216f34caeae80faeee69ac11b37862fdd33b664cef1070b72f8d8b75d2d2f1524b8b269e50575dec75e478e69c8fd0a8d6347e3d124ec2f238e028c879e12

Download Submit
C:\Windows\System\IAvgvmO.exe

Filesize
1.3MB

MD5
1ffdcbf9159e2a7f4e891c7e683e5349

SHA1
c52ceef3d500fb51661a805d2a1d14bfaf245b06

SHA256
b07651855d0b8b2d4baffcb1834d8e3036c911d9bac4830cd5f8950e0fe36ca6

SHA512
8da0470d3f3fe7c241b4c91d4e781dc2b619c0013c72caf4e8ea6e30218d7e2601041d4ce88d8b6a76a48cafc1a85b57e808305ff9cfa159bfdbc4b2d789cd6f

Download Submit
C:\Windows\System\IjIhNPg.exe

Filesize
8B

MD5
2d0c2c2eeafda1eefbc846623106a651

SHA1
ebe1d12cc7355840b98bff551fa1e9b6ea05149b

SHA256
315fe12e8506c9a5679018a241c22762f38597a85e3d6906984d2cd8e0eb0749

SHA512
4747f2fca75d2722dc6b7850f1cf2e05f5ebac7e64d54a9f03247ac705b6e7fd5e4086e67fbc0da577c026e6cfc06192b9232b3f0c023c488535fb6f948376dc

Download Submit
C:\Windows\System\IjKwPOY.exe

Filesize
1.3MB

MD5
056dd7665d839a09ef5a6cc51032cefc

SHA1
17cb0d7412b52129733239d62ec94e8b00b24765

SHA256
5e822bbf695f0270e01052839edf5f919f1abf7d2198b7665ea3f333bc907747

SHA512
572851a4510ee1bec18199949b3133a636ba3682fd1085afc92f0e17fc731681aea6a9d0c6f6759b6904f54559a37848194f2f3efc37d04a96e09fc6e6dfcf8f

Download Submit
C:\Windows\System\KJOjKxn.exe

Filesize
1.3MB

MD5
3c503731d483cb2cb2233eb117e25e44

SHA1
551844d85555141c1ed5abe0d2a9e049ff7880b2

SHA256
adf877cacc2e7835f49d88aa51a11fcf8ad83bdefd35ad24373676c0e6652162

SHA512
f6356d4ea98730cf294c4430da49b43cad23bb70ae0cf0451a197470543efc4b2944208ccdfec84025b1d30a53fb5ba5badf3888b20b1b843e29396a0d029216

Download Submit
C:\Windows\System\LwmVcGF.exe

Filesize
1.3MB

MD5
dfc260f329fca0e93891def573b2f4a7

SHA1
788cfb5ee6879fafdf7b816149fec5abae147758

SHA256
f2082337a35989c58d64134dc60432c3f7576e7f86137fc3861408b5a530e46e

SHA512
4564a072d7f1592370f9a5f5b5cc1ac37c7582208479a17446cd44cb4bdcfb94b722d3b1a79a5dd7158826cd49f5500f6f6776df2704e002c1796bd40540cdf8

Download Submit
C:\Windows\System\QFvGJpB.exe

Filesize
1.3MB

MD5
5f2486fa333549dbd3729432cc0d74e8

SHA1
167f0b489538ad4ee86df72c334d936eec9b7c99

SHA256
161f17f88d469f9c12fadea8c868ac621e9bcf49f03d1aa4b2e8ca396122c452

SHA512
b269721cacacb10a0972a9ee1f76bda0950b86c1e337a2e859c4f2ed46a85155f3a4047127fcacad25b155960dc228d3af2223cebbc4c3337f7defb4279b9a17

Download Submit
C:\Windows\System\SVsWGmB.exe

Filesize
1.3MB

MD5
28a1e028133a25ba40e771ccb1c29255

SHA1
6f4b6c31d8600f3453022e0a41b3c674ba11b71f

SHA256
43a721876570ba45d851ae40182d2cbabccc1be32ac84d4e054dbc9545d9ca6a

SHA512
822b8afb9a1380befd66ed5347ca890d4955288e90035dfee0746bea55ba38528d6488ecdfae53ce7cceefbdad94590f131968d1e6c772635571b442af815631

Download Submit
C:\Windows\System\TSSRNly.exe

Filesize
1.3MB

MD5
971fc9301f30d4617522ac6c2f54e00c

SHA1
768473bbe502591e725cda10314d23d5fd95cf79

SHA256
905f5886f30e33de364598bf755f89f90c6ce327b76ef4f04f4711fd1ee13e17

SHA512
0050df25bae8fd998d536878470dc744f45fac142da21d1b30ccf09e6a72bef6ea5919561fa43d3ec1cbf3015692a537fb9d05dffd735fd804f876cad0f5d679

Download Submit
C:\Windows\System\UHjNCfH.exe

Filesize
1.3MB

MD5
9becb2ec347850524cda33b8c428c6b0

SHA1
6ceae9cfc657455d4175dc2be1a5a129b64b2a67

SHA256
db818218b2f4250ec25ee38e8a80a3eb93a9077be8b31715b92be72499ffd322

SHA512
b479f7949ebc6e94d70a7e3801ad8dbc5c88e9d7f8adcfe3a653e887aad6163df5b7e6471501301042c3c71bbe4f467b134136ea64ef3a6b516fdbc8a611f3b5

Download Submit
C:\Windows\System\USkTOwm.exe

Filesize
1.3MB

MD5
95b016f7968ebe41626a6234dab229a6

SHA1
fbcff3abadd078cb8a33d053853d5e7885ac9f6d

SHA256
aa7c16ea6e8484006e6432c74493a00a19ead70d52fef4c52ba4002be7f89819

SHA512
f5a1ac72c06b0452d758f55e207cb21de072f2fff0894c47d6287096ff466033d0b69b7a5f3c30500d323bdf8e46cba9684857564173c5558a1a63d3192ca195

Download Submit
C:\Windows\System\YMWIIfQ.exe

Filesize
1.3MB

MD5
784f77a834c70ba6de65e8d82dd98e77

SHA1
8875f749fcf958741377fdc27db01298da45dc3d

SHA256
b1cae63f9a92142ab10d52baefa4503aed57002f3e640cbb14bd5c723fe1fd39

SHA512
7620589dd84a7e4da6fa5402bdcbf90e0a5b879bff36802b89d12a622d75c48c982a060a9d7849bd21e79495ef89b9188b954423bb24b8ef05141fdff290e24f

Download Submit
C:\Windows\System\YOiRNdW.exe

Filesize
1.3MB

MD5
1ccc912f2879c75c10af13d80573aa58

SHA1
4ee931de0a0b762a20fff6aec4487b29f67861aa

SHA256
15a8915bef75e75762c0393707447a296b3541ac984fecddf5066d137887a2d4

SHA512
0332a63b5b58af4392f0946a6db8156d39bd56e83fc884b590fb8a53e3cb604c27dca053ec684c5868b1810515adf64ad06eeea33bf1f971f06979a5db53f4b3

Download Submit
C:\Windows\System\dNncXEg.exe

Filesize
1.3MB

MD5
400be9507dd15a981ef5448a7e442dfb

SHA1
4cc533d22c956297194d9b1745e2935f516f8b56

SHA256
15b0b807490085688e28cab7eefa739c4a0492961b43313e94a794cbc4f44bd6

SHA512
7b1cc45a897f3412b8562b8932148a3025186b4d150b4288478b1845c151b8ff9ee3df56132c0c995c8a2070770d8dee48ea3e482f1efe086a1b9757e99946ee

Download Submit
C:\Windows\System\fvkYsZD.exe

Filesize
1.3MB

MD5
d9bf74d5785a11c14f658b8f9a4f7fda

SHA1
5146a42d84602f5088eac688f56857e834ec5c96

SHA256
bf86004e0383d8db4052237bb9fec10d91dbfaf5c617bf7244812c8adb1809ac

SHA512
6a8b3092ee2004e3583910d0426acc681b00da1e52bb94b5b7ad0d035b9505e5bd273ccb64212c5abd105579e3599fa2ceaae402aab944c126dec6fa68388dbc

Download Submit
C:\Windows\System\heJdLuE.exe

Filesize
1.3MB

MD5
1bc1f6a4934c83f18573db42cf22bbe4

SHA1
7b504ca622866e2263e01eba5ad6a48d0edc5710

SHA256
6789f9c954501ab21a67e91ff9bdc494393c1e5b26a4658321ea34f6fdfc0729

SHA512
940dce27998d68f493e727c2d658bf25b2361db0dec104a02b126fb52f62dbcb7b493df096851393e5a143e80d8da6c426428322dfbcdde682a0b28573df5d34

Download Submit
C:\Windows\System\jTdAmBC.exe

Filesize
1.3MB

MD5
80f2bc1830ec1eec29d4f3d47446fd29

SHA1
e1d408427e37344228b0f56515c1fd1cab30de34

SHA256
368516b79339d1a7209d22e6fb210cb9860610e2bf5bbe87f31e9704b878386a

SHA512
a3ea4310bbbcf967bf0da59cd8261d3c2f680766ef92ffba5a0c6ae3f2253f29d499cfa5d91d24d7e9d4288aa01e4ab197256af3c71ddd99542f3567f63b0895

Download Submit
C:\Windows\System\kmCNTGi.exe

Filesize
1.3MB

MD5
91de5e4c2db08c446bbae2492829767a

SHA1
3faf241b0f016bb392b9739db3f14d29f5b45f9e

SHA256
1625f55c638f1a7c0b9c98af0ab4ccc42feab56c16d5a8f20fa9d400b383a2bf

SHA512
dc747d1cfbe65aa8f182fc255798776719c20ca9884d4d5b5380cdff7f76c0edb06bc6064ad04b414aa3e834b93a7e2972a0ab778041bb7677400475f7c45a2f

Download Submit
C:\Windows\System\lihFQpZ.exe

Filesize
1.3MB

MD5
09ffc9ad207875228b52dde81de6fed3

SHA1
7a32c28bcd073f32f7019d80b998d9725e323a78

SHA256
66002b31134f08f1d6532d1241f437a0bdbc6f8f7ef28b364d9b06dc8a5bc43d

SHA512
eb230b8dbf9af0e1e4ca3fab5b82ab706f20146f124af2232ed2a1c1431ed2bf5a77d9dc9103fca62774db7a98688ce65e5d4bdcc711d37a78a34328a2675840

Download Submit
C:\Windows\System\lxJoGxS.exe

Filesize
1.3MB

MD5
57fe8494c108e9764f0f4d98b065e7b1

SHA1
d5770bc5fb8cecd46851b19020e6e5c8f88b7a1b

SHA256
b5bdbafe131d039ac66cb385c621734b08bb271c4104208484a306d6e4497b4c

SHA512
44575ed85e2dc7fe114ad5d9d471b0126b3a16279786a310ecd6b2114f6cf8bed8f9882ffa383232eb56b862c8005497b99e0786fefd3aaa6d9f65abc274d78f

Download Submit
C:\Windows\System\npRDeul.exe

Filesize
1.3MB

MD5
c3bffe65030d83ae9b65d35c6d39832c

SHA1
0de4661dd38921ce927e0761d5dc49df32b83125

SHA256
0e20d699faf6ba391bb92071206da9904abd47a4cf84bcf443ed6539d7587007

SHA512
6aff30e3329a621cb2f2a015898e28a22b182ce5d716584a512d6ed08fc91b255cef5b21669e41e910084c737ee8c4820058edd11d312b60d7667bf395f74f8a

Download Submit
C:\Windows\System\pepEBKI.exe

Filesize
1.3MB

MD5
164beb43da0df73c38d64d16d0914477

SHA1
f604af62b13c6629a00c334dfe0159c58dddb5b4

SHA256
f3d6873885ae34b9f58427a49bc5587e70d7c1e336dc53bae14c9c9b069e54d4

SHA512
f470b385c9c29dedd993f42924e46040f94388892a8e0f93458d1515c104af2b056c724d923bfa89c083f76719b03383c0f900edcdc65ead7dd111854b5a82f9

Download Submit
C:\Windows\System\uXRJXuv.exe

Filesize
1.3MB

MD5
320724418a093b7fbbcac3559d94e55c

SHA1
adcd8686cf62d9af774529e5bd216d006c24e39b

SHA256
4db6d467c79c63a3a0cd14b77d97b072912d54acfb71b717d8311c236a081a3a

SHA512
20a820f0ae136fe94b896b60495d1d74254730d34361ae9bc7344c3f528221159ffdfd76e6d648e22f9260fea61621a69c5b92a9500c6f27ac1bc186270c6153

Download Submit
C:\Windows\System\udPIIQe.exe

Filesize
1.3MB

MD5
f24c11dd390c202cccc6630c21c7c3c4

SHA1
fd461daa2893a497a61ac29321385ba5e5c2dd74

SHA256
97f066eae132f7809c3c950d301f855e07b06e8e97bddcd77495e580073dccab

SHA512
f3a5853c62e119165050abb5d4b3c80a5f3106eebbd77dcb0b8870f0ae2be67dbacb389b231dbffe23ff1f2f8a4df809d681209bd36fc63f8e5427d08584e1ed

Download Submit
C:\Windows\System\vrBDnvx.exe

Filesize
1.3MB

MD5
08308e3308b0698fb7901d0c01f5516b

SHA1
4fd76ad992f5f2039481af27eccee339be9338a2

SHA256
791ceb3c222ac68b39e9cbadeec345dec438094173e14ae8835047c1fbd23565

SHA512
bb99c23a210e86aabeb8e2e77b98d8b956226a5d5adef338e89e23a05a6b8c918953aa82aec9c8f37cb81716ab3d6a8e6c0da7d53ebefb7c34ba81670ea2554b

Download Submit
C:\Windows\System\xMPZIHk.exe

Filesize
1.3MB

MD5
7dd73f0c3cf919e737591b7949925ebb

SHA1
d34f73dd5d164758d132345f13b32fc34441dc27

SHA256
bd026101b86fb9c81fc1e77d6f6d04d6c1650353d00bfd06e920c03e950866be

SHA512
f36b44f88a4516b07bddc3b6372218bd129cc20197524f7ab69fa9109b2287364e118962c38d92a2f23c7c60229019846511b0ef160df736f4898a5a8935fc04

Download Submit
C:\Windows\System\xPJAPmi.exe

Filesize
1.3MB

MD5
f0df1960e81e1516dc9bfa76aa4a59b0

SHA1
3ffc742c51eed6e65daded8da07b60055e1a6bb5

SHA256
02a14b86cbb5467799cb1f0b61397951d574f2117177d53b543e7f9960661a8a

SHA512
0b2f0ccd0e66d554a53e2e580d3d2f2f209739c755ab87dafc71a2caf127c825b7ef8a72e8deaab1fd997e552c5bdd41cf160f950acd68f97706a89461fee80e

Download Submit
C:\Windows\System\ybgGoNe.exe

Filesize
1.3MB

MD5
21a1e56b902e28e819ff4baa57b5abba

SHA1
7ae98772f46e7c875590f3dbf5e735e760082daa

SHA256
5a00193cb99e418e791903167b12b09205b8ae1d1ef7aa587edd6e0dec5c889b

SHA512
5397b1467c0593240e4b272da6cabaed476ec15f9b3ac17bb2f6bdc72db95f9f0008cc189ad94731385d2e84ca22791fbc2b538d6c84b529bb7f695de873d7d5

Download Submit
C:\Windows\System\ygYSlyg.exe

Filesize
1.3MB

MD5
9dd66c1cef7f307151aadffbd0399444

SHA1
1dc81714838d1e20e4ce7e037e5f4cef1eb81173

SHA256
c7c6e6c4db934d228cdea62f832ff97dd6aff64da7b0a0c421c79d2895b87b4d

SHA512
abd84418e2e6892d87e9144426171ab556dfcaa19e60ce346e6acca459bf7ec4956eb3b1072063971fee1b2cbd3665d563e31b5023c27006986279c8c17284ab

Download Submit
memory/408-139-0x00007FF77CA00000-0x00007FF77CDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-84-0x000001FE65E00000-0x000001FE65E22000-memory.dmp

Filesize
136KB

Download
memory/1080-286-0x000001FE7EBF0000-0x000001FE7F396000-memory.dmp

Filesize
7.6MB

Download
memory/1116-1398-0x00007FF78ECE0000-0x00007FF78F0D2000-memory.dmp

Filesize
3.9MB

Download
memory/1116-3189-0x00007FF78ECE0000-0x00007FF78F0D2000-memory.dmp

Filesize
3.9MB

Download
memory/1116-99-0x00007FF78ECE0000-0x00007FF78F0D2000-memory.dmp

Filesize
3.9MB

Download
memory/1220-1457-0x00007FF6C8EA0000-0x00007FF6C9292000-memory.dmp

Filesize
3.9MB

Download
memory/1220-3201-0x00007FF6C8EA0000-0x00007FF6C9292000-memory.dmp

Filesize
3.9MB

Download
memory/1220-105-0x00007FF6C8EA0000-0x00007FF6C9292000-memory.dmp

Filesize
3.9MB

Download
memory/1844-47-0x00007FF63F930000-0x00007FF63FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1844-3105-0x00007FF63F930000-0x00007FF63FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2040-822-0x00007FF6DB580000-0x00007FF6DB972000-memory.dmp

Filesize
3.9MB

Download
memory/2040-36-0x00007FF6DB580000-0x00007FF6DB972000-memory.dmp

Filesize
3.9MB

Download
memory/2364-70-0x00007FF7F35C0000-0x00007FF7F39B2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-3132-0x00007FF7F35C0000-0x00007FF7F39B2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-3267-0x00007FF7E45F0000-0x00007FF7E49E2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-163-0x00007FF7E45F0000-0x00007FF7E49E2000-memory.dmp

Filesize
3.9MB

Download
memory/2840-74-0x00007FF73D5B0000-0x00007FF73D9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-71-0x00007FF71C980000-0x00007FF71CD72000-memory.dmp

Filesize
3.9MB

Download
memory/2900-122-0x00007FF77FF40000-0x00007FF780332000-memory.dmp

Filesize
3.9MB

Download
memory/2900-3208-0x00007FF77FF40000-0x00007FF780332000-memory.dmp

Filesize
3.9MB

Download
memory/2900-1541-0x00007FF77FF40000-0x00007FF780332000-memory.dmp

Filesize
3.9MB

Download
memory/2988-73-0x00007FF7A1760000-0x00007FF7A1B52000-memory.dmp

Filesize
3.9MB

Download
memory/2988-3123-0x00007FF7A1760000-0x00007FF7A1B52000-memory.dmp

Filesize
3.9MB

Download
memory/3160-35-0x00007FF67F6F0000-0x00007FF67FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/3160-912-0x00007FF67F6F0000-0x00007FF67FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/3200-151-0x00007FF7C59A0000-0x00007FF7C5D92000-memory.dmp

Filesize
3.9MB

Download
memory/3200-3278-0x00007FF7C59A0000-0x00007FF7C5D92000-memory.dmp

Filesize
3.9MB

Download
memory/3452-62-0x00007FF742790000-0x00007FF742B82000-memory.dmp

Filesize
3.9MB

Download
memory/3664-55-0x00007FF67E7A0000-0x00007FF67EB92000-memory.dmp

Filesize
3.9MB

Download
memory/3664-3110-0x00007FF67E7A0000-0x00007FF67EB92000-memory.dmp

Filesize
3.9MB

Download
memory/3716-145-0x00007FF70DA90000-0x00007FF70DE82000-memory.dmp

Filesize
3.9MB

Download
memory/3716-3254-0x00007FF70DA90000-0x00007FF70DE82000-memory.dmp

Filesize
3.9MB

Download
memory/3952-157-0x00007FF69CCF0000-0x00007FF69D0E2000-memory.dmp

Filesize
3.9MB

Download
memory/3952-0-0x00007FF69CCF0000-0x00007FF69D0E2000-memory.dmp

Filesize
3.9MB

Download
memory/3952-1-0x00000273355C0000-0x00000273355D0000-memory.dmp

Filesize
64KB

Download
memory/4396-164-0x00007FF61EB00000-0x00007FF61EEF2000-memory.dmp

Filesize
3.9MB

Download
memory/4396-3273-0x00007FF61EB00000-0x00007FF61EEF2000-memory.dmp

Filesize
3.9MB

Download
memory/4576-1612-0x00007FF6A8320000-0x00007FF6A8712000-memory.dmp

Filesize
3.9MB

Download
memory/4576-128-0x00007FF6A8320000-0x00007FF6A8712000-memory.dmp

Filesize
3.9MB

Download
memory/4576-3244-0x00007FF6A8320000-0x00007FF6A8712000-memory.dmp

Filesize
3.9MB

Download
memory/4684-72-0x00007FF750BC0000-0x00007FF750FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-65-0x00007FF75D180000-0x00007FF75D572000-memory.dmp

Filesize
3.9MB

Download
memory/4868-18-0x00007FF7AD7A0000-0x00007FF7ADB92000-memory.dmp

Filesize
3.9MB

Download
memory/4868-816-0x00007FF7AD7A0000-0x00007FF7ADB92000-memory.dmp

Filesize
3.9MB

Download
memory/4992-1540-0x00007FF684500000-0x00007FF6848F2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-116-0x00007FF684500000-0x00007FF6848F2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-3197-0x00007FF684500000-0x00007FF6848F2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-3178-0x00007FF77AC30000-0x00007FF77B022000-memory.dmp

Filesize
3.9MB

Download
memory/5084-90-0x00007FF77AC30000-0x00007FF77B022000-memory.dmp

Filesize
3.9MB

Download
memory/5084-1395-0x00007FF77AC30000-0x00007FF77B022000-memory.dmp

Filesize
3.9MB

Download
memory/5100-3280-0x00007FF6A1AF0000-0x00007FF6A1EE2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-170-0x00007FF6A1AF0000-0x00007FF6A1EE2000-memory.dmp

Filesize
3.9MB

Download