xmrig | b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
Size

1.8MB
MD5

a8d0e8581a75d64959925ef179dd7150
SHA1

732df9e913f25d58ddfced22024a007d9cf64c2c
SHA256

b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585
SHA512

59bf3e7003cbc0f81416a89f7104f6313fcab4951c2e14aec81106f4c65569b4b13cee12db26e8013d4030419908ceb424e07c6435d1edc533c90bd4695cad6f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VFi:NAB3

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/4368-358-0x00007FF6A5450000-0x00007FF6A5842000-memory.dmp	xmrig
behavioral2/memory/2636-421-0x00007FF712110000-0x00007FF712502000-memory.dmp	xmrig
behavioral2/memory/3312-455-0x00007FF6E2380000-0x00007FF6E2772000-memory.dmp	xmrig
behavioral2/memory/2120-459-0x00007FF614600000-0x00007FF6149F2000-memory.dmp	xmrig
behavioral2/memory/976-488-0x00007FF71D9C0000-0x00007FF71DDB2000-memory.dmp	xmrig
behavioral2/memory/2552-491-0x00007FF727F30000-0x00007FF728322000-memory.dmp	xmrig
behavioral2/memory/3972-2432-0x00007FF7F80F0000-0x00007FF7F84E2000-memory.dmp	xmrig
behavioral2/memory/2208-2437-0x00007FF63C8E0000-0x00007FF63CCD2000-memory.dmp	xmrig
behavioral2/memory/3504-2403-0x00007FF757A70000-0x00007FF757E62000-memory.dmp	xmrig
behavioral2/memory/2304-2010-0x00007FF65F8A0000-0x00007FF65FC92000-memory.dmp	xmrig
behavioral2/memory/4088-2009-0x00007FF7AAF70000-0x00007FF7AB362000-memory.dmp	xmrig
behavioral2/memory/3544-2629-0x00007FF6197C0000-0x00007FF619BB2000-memory.dmp	xmrig
behavioral2/memory/4772-490-0x00007FF63C8F0000-0x00007FF63CCE2000-memory.dmp	xmrig
behavioral2/memory/2148-489-0x00007FF6FBE60000-0x00007FF6FC252000-memory.dmp	xmrig
behavioral2/memory/4972-486-0x00007FF62EC30000-0x00007FF62F022000-memory.dmp	xmrig
behavioral2/memory/4980-451-0x00007FF672F20000-0x00007FF673312000-memory.dmp	xmrig
behavioral2/memory/4576-373-0x00007FF750250000-0x00007FF750642000-memory.dmp	xmrig
behavioral2/memory/3824-334-0x00007FF7F6010000-0x00007FF7F6402000-memory.dmp	xmrig
behavioral2/memory/3540-280-0x00007FF7ABAF0000-0x00007FF7ABEE2000-memory.dmp	xmrig
behavioral2/memory/2236-255-0x00007FF742140000-0x00007FF742532000-memory.dmp	xmrig
behavioral2/memory/2928-215-0x00007FF75A0C0000-0x00007FF75A4B2000-memory.dmp	xmrig
behavioral2/memory/3416-163-0x00007FF6956B0000-0x00007FF695AA2000-memory.dmp	xmrig
behavioral2/memory/3504-6209-0x00007FF757A70000-0x00007FF757E62000-memory.dmp	xmrig
behavioral2/memory/3972-6243-0x00007FF7F80F0000-0x00007FF7F84E2000-memory.dmp	xmrig
behavioral2/memory/2928-6283-0x00007FF75A0C0000-0x00007FF75A4B2000-memory.dmp	xmrig
behavioral2/memory/2236-6311-0x00007FF742140000-0x00007FF742532000-memory.dmp	xmrig
behavioral2/memory/3824-6320-0x00007FF7F6010000-0x00007FF7F6402000-memory.dmp	xmrig
behavioral2/memory/2636-6339-0x00007FF712110000-0x00007FF712502000-memory.dmp	xmrig
behavioral2/memory/4980-6342-0x00007FF672F20000-0x00007FF673312000-memory.dmp	xmrig
behavioral2/memory/2120-6345-0x00007FF614600000-0x00007FF6149F2000-memory.dmp	xmrig
behavioral2/memory/3544-6352-0x00007FF6197C0000-0x00007FF619BB2000-memory.dmp	xmrig
behavioral2/memory/3312-6360-0x00007FF6E2380000-0x00007FF6E2772000-memory.dmp	xmrig
behavioral2/memory/3540-6338-0x00007FF7ABAF0000-0x00007FF7ABEE2000-memory.dmp	xmrig
behavioral2/memory/2208-6315-0x00007FF63C8E0000-0x00007FF63CCD2000-memory.dmp	xmrig
behavioral2/memory/4972-6389-0x00007FF62EC30000-0x00007FF62F022000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1548	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2304	pWFCLIw.exe
1264	nJvOxIY.exe
4492	dUiWBfG.exe
3504	fOPTQIM.exe
976	fEUXmbR.exe
3972	JWCsGzj.exe
4008	MpArpEB.exe
2208	UTsziSS.exe
2148	kwMvNUS.exe
3544	xnbXNfp.exe
3416	WMdCtTy.exe
4772	RGomNTt.exe
2928	yyKUQkI.exe
2236	MhnkyTn.exe
3540	CKEUjsh.exe
3824	RxbMQPj.exe
4368	FeZyBWw.exe
2552	pPLzNZl.exe
4576	XNMDiPI.exe
2636	XMKcMCi.exe
4980	lslbBiY.exe
3312	WTppeOR.exe
2120	tiRxPty.exe
4972	QfRgyZK.exe
228	iASZVLu.exe
2660	otabXNP.exe
3316	tbOIhoB.exe
1816	YGkXoiW.exe
1188	EWvVyxZ.exe
712	ONoFjcN.exe
5104	yDvCGEC.exe
3240	eGfYhdL.exe
1544	aDhcapQ.exe
3204	Jvfqped.exe
2504	XGWigek.exe
944	gkopqqt.exe
1128	kZIJrrx.exe
2184	wZFzOtN.exe
1896	yMzejMi.exe
4892	sWomNKB.exe
3612	EoSizkc.exe
3360	OXVcaiY.exe
2724	ifdINYL.exe
4692	XkzDVjt.exe
2024	ARMpYeB.exe
4620	hKOuQSu.exe
2432	JTezyDq.exe
2196	YmwQcRy.exe
5072	vsDNtoh.exe
5004	MuPMvAX.exe
3568	XQDEEAf.exe
1192	RAukqdq.exe
4572	ZkHESUa.exe
2492	dpTipFM.exe
2212	mSCSQut.exe
688	XxgnwsU.exe
4040	cEdPuao.exe
4836	IxgGrfd.exe
3848	TnCWAsi.exe
4848	YhFbLRy.exe
4072	NCTnFok.exe
2252	dBsaXrh.exe
4324	YXXWTOD.exe
3004	LAmxerr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4088-0-0x00007FF7AAF70000-0x00007FF7AB362000-memory.dmp	upx
behavioral2/files/0x000a000000023b37-19.dat	upx
behavioral2/files/0x000a000000023b3c-35.dat	upx
behavioral2/files/0x000a000000023b3f-52.dat	upx
behavioral2/files/0x000a000000023b40-53.dat	upx
behavioral2/files/0x000a000000023b4a-111.dat	upx
behavioral2/files/0x000a000000023b53-142.dat	upx
behavioral2/memory/4368-358-0x00007FF6A5450000-0x00007FF6A5842000-memory.dmp	upx
behavioral2/memory/2636-421-0x00007FF712110000-0x00007FF712502000-memory.dmp	upx
behavioral2/memory/3312-455-0x00007FF6E2380000-0x00007FF6E2772000-memory.dmp	upx
behavioral2/memory/2120-459-0x00007FF614600000-0x00007FF6149F2000-memory.dmp	upx
behavioral2/memory/976-488-0x00007FF71D9C0000-0x00007FF71DDB2000-memory.dmp	upx
behavioral2/memory/2552-491-0x00007FF727F30000-0x00007FF728322000-memory.dmp	upx
behavioral2/memory/3972-2432-0x00007FF7F80F0000-0x00007FF7F84E2000-memory.dmp	upx
behavioral2/memory/2208-2437-0x00007FF63C8E0000-0x00007FF63CCD2000-memory.dmp	upx
behavioral2/memory/3504-2403-0x00007FF757A70000-0x00007FF757E62000-memory.dmp	upx
behavioral2/memory/2304-2010-0x00007FF65F8A0000-0x00007FF65FC92000-memory.dmp	upx
behavioral2/memory/4088-2009-0x00007FF7AAF70000-0x00007FF7AB362000-memory.dmp	upx
behavioral2/memory/3544-2629-0x00007FF6197C0000-0x00007FF619BB2000-memory.dmp	upx
behavioral2/memory/4772-490-0x00007FF63C8F0000-0x00007FF63CCE2000-memory.dmp	upx
behavioral2/memory/2148-489-0x00007FF6FBE60000-0x00007FF6FC252000-memory.dmp	upx
behavioral2/memory/4972-486-0x00007FF62EC30000-0x00007FF62F022000-memory.dmp	upx
behavioral2/memory/4980-451-0x00007FF672F20000-0x00007FF673312000-memory.dmp	upx
behavioral2/memory/4576-373-0x00007FF750250000-0x00007FF750642000-memory.dmp	upx
behavioral2/memory/3824-334-0x00007FF7F6010000-0x00007FF7F6402000-memory.dmp	upx
behavioral2/memory/3540-280-0x00007FF7ABAF0000-0x00007FF7ABEE2000-memory.dmp	upx
behavioral2/memory/2236-255-0x00007FF742140000-0x00007FF742532000-memory.dmp	upx
behavioral2/memory/2928-215-0x00007FF75A0C0000-0x00007FF75A4B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b4b-192.dat	upx
behavioral2/files/0x000a000000023b5d-191.dat	upx
behavioral2/files/0x000a000000023b5c-190.dat	upx
behavioral2/files/0x000a000000023b44-184.dat	upx
behavioral2/files/0x000a000000023b5b-183.dat	upx
behavioral2/files/0x000a000000023b5a-173.dat	upx
behavioral2/files/0x000a000000023b4f-165.dat	upx
behavioral2/files/0x000a000000023b48-164.dat	upx
behavioral2/memory/3416-163-0x00007FF6956B0000-0x00007FF695AA2000-memory.dmp	upx
behavioral2/files/0x000a000000023b57-160.dat	upx
behavioral2/files/0x000a000000023b56-159.dat	upx
behavioral2/files/0x000a000000023b55-158.dat	upx
behavioral2/files/0x000a000000023b54-151.dat	upx
behavioral2/files/0x000a000000023b43-150.dat	upx
behavioral2/files/0x000a000000023b52-145.dat	upx
behavioral2/files/0x000a000000023b51-138.dat	upx
behavioral2/files/0x000a000000023b59-172.dat	upx
behavioral2/files/0x000a000000023b49-136.dat	upx
behavioral2/files/0x000a000000023b58-162.dat	upx
behavioral2/memory/3544-134-0x00007FF6197C0000-0x00007FF619BB2000-memory.dmp	upx
behavioral2/files/0x000a000000023b4e-131.dat	upx
behavioral2/files/0x000a000000023b4d-130.dat	upx
behavioral2/files/0x000a000000023b4c-129.dat	upx
behavioral2/files/0x000a000000023b46-122.dat	upx
behavioral2/files/0x000a000000023b45-119.dat	upx
behavioral2/files/0x000a000000023b50-137.dat	upx
behavioral2/memory/2208-99-0x00007FF63C8E0000-0x00007FF63CCD2000-memory.dmp	upx
behavioral2/files/0x000a000000023b47-93.dat	upx
behavioral2/files/0x000a000000023b3d-76.dat	upx
behavioral2/files/0x000a000000023b3b-69.dat	upx
behavioral2/memory/4008-67-0x00007FF78D5D0000-0x00007FF78D9C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b41-63.dat	upx
behavioral2/memory/3972-58-0x00007FF7F80F0000-0x00007FF7F84E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b3a-55.dat	upx
behavioral2/files/0x000a000000023b42-75.dat	upx
behavioral2/files/0x000a000000023b3e-46.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ovcbFTg.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\AqQHElz.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\IyScwCT.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\QQMXOYw.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\kgGIdPl.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\sOtHSQi.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\oMJOLZM.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\DBwtDpI.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\RYETiiO.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\cgDufQP.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\HHLqDve.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\iuYgbLO.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\dMayJPJ.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\unrJjJE.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\GKVeqry.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\lLuAAFL.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\DIZXoSa.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\KCVIeFN.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\gLRWJtX.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\HBWCqfV.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\BuvMaff.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\IVmeWPs.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\mRpUuir.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\geJhklD.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\zvNhAdn.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\JWlEJXQ.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\oiUSXDz.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\tOxWeme.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\uRWzBiE.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\ndtqiAH.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\RMxHHTJ.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\skXbMRS.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\KworUbT.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\SEMOZFo.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\sCmWyhO.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\IhhmOBK.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\JNaAvnN.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\EmOsoRA.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\zUtAVmw.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\jAOjlBz.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\ZYKPZiN.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\pkTqaaJ.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\DJOVxBS.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\KLhqQKd.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\oiKEtBx.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\gTKXOym.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\BQREBVi.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\dtJFRKV.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\xReXfGF.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\HJCEPBm.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\DyLWfRi.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\srCubsJ.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\eDaNtPw.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\FngWBeW.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\bUyjpkM.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\ubDVPos.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\KajcqCn.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\vQlaXXA.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\jTopyYt.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\dJIQqKS.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\VakwGap.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\QHZbXKA.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\fJOMsmf.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
File created	C:\Windows\System\IAsVscG.exe	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe

Modifies data under HKEY_USERS 27 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t\|0"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	Process not Found

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1548	powershell.exe
1548	powershell.exe
1548	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
Token: SeLockMemoryPrivilege	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
Token: SeDebugPrivilege	1548	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2708	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1548	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	82
PID 4088 wrote to memory of 1548	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	82
PID 4088 wrote to memory of 2304	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	83
PID 4088 wrote to memory of 2304	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	83
PID 4088 wrote to memory of 1264	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	84
PID 4088 wrote to memory of 1264	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	84
PID 4088 wrote to memory of 4492	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	85
PID 4088 wrote to memory of 4492	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	85
PID 4088 wrote to memory of 3504	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	86
PID 4088 wrote to memory of 3504	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	86
PID 4088 wrote to memory of 976	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	87
PID 4088 wrote to memory of 976	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	87
PID 4088 wrote to memory of 3972	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	88
PID 4088 wrote to memory of 3972	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	88
PID 4088 wrote to memory of 4008	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	89
PID 4088 wrote to memory of 4008	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	89
PID 4088 wrote to memory of 2208	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	90
PID 4088 wrote to memory of 2208	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	90
PID 4088 wrote to memory of 2148	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	91
PID 4088 wrote to memory of 2148	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	91
PID 4088 wrote to memory of 3544	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	92
PID 4088 wrote to memory of 3544	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	92
PID 4088 wrote to memory of 3416	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	93
PID 4088 wrote to memory of 3416	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	93
PID 4088 wrote to memory of 4772	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	94
PID 4088 wrote to memory of 4772	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	94
PID 4088 wrote to memory of 2928	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	95
PID 4088 wrote to memory of 2928	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	95
PID 4088 wrote to memory of 2236	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	96
PID 4088 wrote to memory of 2236	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	96
PID 4088 wrote to memory of 3540	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	97
PID 4088 wrote to memory of 3540	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	97
PID 4088 wrote to memory of 3824	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	98
PID 4088 wrote to memory of 3824	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	98
PID 4088 wrote to memory of 4368	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	99
PID 4088 wrote to memory of 4368	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	99
PID 4088 wrote to memory of 2552	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	100
PID 4088 wrote to memory of 2552	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	100
PID 4088 wrote to memory of 4576	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	101
PID 4088 wrote to memory of 4576	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	101
PID 4088 wrote to memory of 2660	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	102
PID 4088 wrote to memory of 2660	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	102
PID 4088 wrote to memory of 2636	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	103
PID 4088 wrote to memory of 2636	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	103
PID 4088 wrote to memory of 4980	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	104
PID 4088 wrote to memory of 4980	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	104
PID 4088 wrote to memory of 3312	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	105
PID 4088 wrote to memory of 3312	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	105
PID 4088 wrote to memory of 2120	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	106
PID 4088 wrote to memory of 2120	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	106
PID 4088 wrote to memory of 4972	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	107
PID 4088 wrote to memory of 4972	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	107
PID 4088 wrote to memory of 228	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	108
PID 4088 wrote to memory of 228	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	108
PID 4088 wrote to memory of 3316	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	109
PID 4088 wrote to memory of 3316	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	109
PID 4088 wrote to memory of 1816	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	110
PID 4088 wrote to memory of 1816	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	110
PID 4088 wrote to memory of 1188	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	111
PID 4088 wrote to memory of 1188	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	111
PID 4088 wrote to memory of 712	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	112
PID 4088 wrote to memory of 712	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	112
PID 4088 wrote to memory of 5104	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	113
PID 4088 wrote to memory of 5104	4088	b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe	113

C:\Users\Admin\AppData\Local\Temp\b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe
"C:\Users\Admin\AppData\Local\Temp\b4ed2168fe19f8c4d1cfb643830abc382a07e27fefd14a22455728ada11c1585N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\System\pWFCLIw.exe
  C:\Windows\System\pWFCLIw.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\nJvOxIY.exe
  C:\Windows\System\nJvOxIY.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\dUiWBfG.exe
  C:\Windows\System\dUiWBfG.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\fOPTQIM.exe
  C:\Windows\System\fOPTQIM.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\fEUXmbR.exe
  C:\Windows\System\fEUXmbR.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\JWCsGzj.exe
  C:\Windows\System\JWCsGzj.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\MpArpEB.exe
  C:\Windows\System\MpArpEB.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\UTsziSS.exe
  C:\Windows\System\UTsziSS.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\kwMvNUS.exe
  C:\Windows\System\kwMvNUS.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\xnbXNfp.exe
  C:\Windows\System\xnbXNfp.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\WMdCtTy.exe
  C:\Windows\System\WMdCtTy.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\RGomNTt.exe
  C:\Windows\System\RGomNTt.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\yyKUQkI.exe
  C:\Windows\System\yyKUQkI.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\MhnkyTn.exe
  C:\Windows\System\MhnkyTn.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\CKEUjsh.exe
  C:\Windows\System\CKEUjsh.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\RxbMQPj.exe
  C:\Windows\System\RxbMQPj.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\FeZyBWw.exe
  C:\Windows\System\FeZyBWw.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\pPLzNZl.exe
  C:\Windows\System\pPLzNZl.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\XNMDiPI.exe
  C:\Windows\System\XNMDiPI.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\otabXNP.exe
  C:\Windows\System\otabXNP.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\XMKcMCi.exe
  C:\Windows\System\XMKcMCi.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\lslbBiY.exe
  C:\Windows\System\lslbBiY.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\WTppeOR.exe
  C:\Windows\System\WTppeOR.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\tiRxPty.exe
  C:\Windows\System\tiRxPty.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\QfRgyZK.exe
  C:\Windows\System\QfRgyZK.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\iASZVLu.exe
  C:\Windows\System\iASZVLu.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\tbOIhoB.exe
  C:\Windows\System\tbOIhoB.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\YGkXoiW.exe
  C:\Windows\System\YGkXoiW.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\EWvVyxZ.exe
  C:\Windows\System\EWvVyxZ.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\ONoFjcN.exe
  C:\Windows\System\ONoFjcN.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\yDvCGEC.exe
  C:\Windows\System\yDvCGEC.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\eGfYhdL.exe
  C:\Windows\System\eGfYhdL.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\aDhcapQ.exe
  C:\Windows\System\aDhcapQ.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\Jvfqped.exe
  C:\Windows\System\Jvfqped.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\XGWigek.exe
  C:\Windows\System\XGWigek.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\gkopqqt.exe
  C:\Windows\System\gkopqqt.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\kZIJrrx.exe
  C:\Windows\System\kZIJrrx.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\wZFzOtN.exe
  C:\Windows\System\wZFzOtN.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\yMzejMi.exe
  C:\Windows\System\yMzejMi.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\sWomNKB.exe
  C:\Windows\System\sWomNKB.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\EoSizkc.exe
  C:\Windows\System\EoSizkc.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\OXVcaiY.exe
  C:\Windows\System\OXVcaiY.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\ifdINYL.exe
  C:\Windows\System\ifdINYL.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\XkzDVjt.exe
  C:\Windows\System\XkzDVjt.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\ARMpYeB.exe
  C:\Windows\System\ARMpYeB.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\hKOuQSu.exe
  C:\Windows\System\hKOuQSu.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\JTezyDq.exe
  C:\Windows\System\JTezyDq.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\YmwQcRy.exe
  C:\Windows\System\YmwQcRy.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\vsDNtoh.exe
  C:\Windows\System\vsDNtoh.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\MuPMvAX.exe
  C:\Windows\System\MuPMvAX.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\XQDEEAf.exe
  C:\Windows\System\XQDEEAf.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\RAukqdq.exe
  C:\Windows\System\RAukqdq.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\ZkHESUa.exe
  C:\Windows\System\ZkHESUa.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\kIasGST.exe
  C:\Windows\System\kIasGST.exe
  2⤵
  PID:4756
- C:\Windows\System\dpTipFM.exe
  C:\Windows\System\dpTipFM.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\mSCSQut.exe
  C:\Windows\System\mSCSQut.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\KFTaPab.exe
  C:\Windows\System\KFTaPab.exe
  2⤵
  PID:3932
- C:\Windows\System\XxgnwsU.exe
  C:\Windows\System\XxgnwsU.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\cEdPuao.exe
  C:\Windows\System\cEdPuao.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\IxgGrfd.exe
  C:\Windows\System\IxgGrfd.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\TnCWAsi.exe
  C:\Windows\System\TnCWAsi.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\YhFbLRy.exe
  C:\Windows\System\YhFbLRy.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\NCTnFok.exe
  C:\Windows\System\NCTnFok.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\dBsaXrh.exe
  C:\Windows\System\dBsaXrh.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\YXXWTOD.exe
  C:\Windows\System\YXXWTOD.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\LAmxerr.exe
  C:\Windows\System\LAmxerr.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\vuejUQP.exe
  C:\Windows\System\vuejUQP.exe
  2⤵
  PID:3676
- C:\Windows\System\oUCImnN.exe
  C:\Windows\System\oUCImnN.exe
  2⤵
  PID:3448
- C:\Windows\System\XkLxPSq.exe
  C:\Windows\System\XkLxPSq.exe
  2⤵
  PID:632
- C:\Windows\System\MggjkHV.exe
  C:\Windows\System\MggjkHV.exe
  2⤵
  PID:640
- C:\Windows\System\gBuDKdR.exe
  C:\Windows\System\gBuDKdR.exe
  2⤵
  PID:736
- C:\Windows\System\KFKKaUA.exe
  C:\Windows\System\KFKKaUA.exe
  2⤵
  PID:960
- C:\Windows\System\GptzBbH.exe
  C:\Windows\System\GptzBbH.exe
  2⤵
  PID:4352
- C:\Windows\System\cTnYzmK.exe
  C:\Windows\System\cTnYzmK.exe
  2⤵
  PID:1764
- C:\Windows\System\MBnPhbA.exe
  C:\Windows\System\MBnPhbA.exe
  2⤵
  PID:1468
- C:\Windows\System\wvmFmNr.exe
  C:\Windows\System\wvmFmNr.exe
  2⤵
  PID:4568
- C:\Windows\System\hcmEJwE.exe
  C:\Windows\System\hcmEJwE.exe
  2⤵
  PID:4500
- C:\Windows\System\MXmSeIq.exe
  C:\Windows\System\MXmSeIq.exe
  2⤵
  PID:2744
- C:\Windows\System\vFTmuvM.exe
  C:\Windows\System\vFTmuvM.exe
  2⤵
  PID:2648
- C:\Windows\System\TPsSHhr.exe
  C:\Windows\System\TPsSHhr.exe
  2⤵
  PID:2956
- C:\Windows\System\SnxxCMH.exe
  C:\Windows\System\SnxxCMH.exe
  2⤵
  PID:1832
- C:\Windows\System\dKVAREM.exe
  C:\Windows\System\dKVAREM.exe
  2⤵
  PID:3864
- C:\Windows\System\QpvBBzq.exe
  C:\Windows\System\QpvBBzq.exe
  2⤵
  PID:1292
- C:\Windows\System\hRVpvKK.exe
  C:\Windows\System\hRVpvKK.exe
  2⤵
  PID:4520
- C:\Windows\System\mvwPmgw.exe
  C:\Windows\System\mvwPmgw.exe
  2⤵
  PID:3020
- C:\Windows\System\ppdBDiD.exe
  C:\Windows\System\ppdBDiD.exe
  2⤵
  PID:3472
- C:\Windows\System\RoKZcLe.exe
  C:\Windows\System\RoKZcLe.exe
  2⤵
  PID:2460
- C:\Windows\System\aYPsera.exe
  C:\Windows\System\aYPsera.exe
  2⤵
  PID:3748
- C:\Windows\System\gxUUHdv.exe
  C:\Windows\System\gxUUHdv.exe
  2⤵
  PID:5124
- C:\Windows\System\OtwiHcn.exe
  C:\Windows\System\OtwiHcn.exe
  2⤵
  PID:5156
- C:\Windows\System\wcdVxIS.exe
  C:\Windows\System\wcdVxIS.exe
  2⤵
  PID:5176
- C:\Windows\System\GXQwuhh.exe
  C:\Windows\System\GXQwuhh.exe
  2⤵
  PID:5200
- C:\Windows\System\rofohJc.exe
  C:\Windows\System\rofohJc.exe
  2⤵
  PID:5220
- C:\Windows\System\dnzjRxp.exe
  C:\Windows\System\dnzjRxp.exe
  2⤵
  PID:5284
- C:\Windows\System\UOcWgDp.exe
  C:\Windows\System\UOcWgDp.exe
  2⤵
  PID:5332
- C:\Windows\System\TDXMVfF.exe
  C:\Windows\System\TDXMVfF.exe
  2⤵
  PID:5424
- C:\Windows\System\qtdzwNN.exe
  C:\Windows\System\qtdzwNN.exe
  2⤵
  PID:5444
- C:\Windows\System\bEMJNXA.exe
  C:\Windows\System\bEMJNXA.exe
  2⤵
  PID:5464
- C:\Windows\System\vqiuOaQ.exe
  C:\Windows\System\vqiuOaQ.exe
  2⤵
  PID:5500
- C:\Windows\System\iHlcWkw.exe
  C:\Windows\System\iHlcWkw.exe
  2⤵
  PID:5552
- C:\Windows\System\tVktpvH.exe
  C:\Windows\System\tVktpvH.exe
  2⤵
  PID:5568
- C:\Windows\System\IgcpxYZ.exe
  C:\Windows\System\IgcpxYZ.exe
  2⤵
  PID:5648
- C:\Windows\System\OgVnvoe.exe
  C:\Windows\System\OgVnvoe.exe
  2⤵
  PID:5668
- C:\Windows\System\EGEnIzO.exe
  C:\Windows\System\EGEnIzO.exe
  2⤵
  PID:5696
- C:\Windows\System\FZWTnmZ.exe
  C:\Windows\System\FZWTnmZ.exe
  2⤵
  PID:5712
- C:\Windows\System\OaSvdPC.exe
  C:\Windows\System\OaSvdPC.exe
  2⤵
  PID:5732
- C:\Windows\System\QkvzRIa.exe
  C:\Windows\System\QkvzRIa.exe
  2⤵
  PID:5748
- C:\Windows\System\hvozSlH.exe
  C:\Windows\System\hvozSlH.exe
  2⤵
  PID:5764
- C:\Windows\System\tJTdDZA.exe
  C:\Windows\System\tJTdDZA.exe
  2⤵
  PID:5784
- C:\Windows\System\AaZBUqq.exe
  C:\Windows\System\AaZBUqq.exe
  2⤵
  PID:5800
- C:\Windows\System\DvfYuUA.exe
  C:\Windows\System\DvfYuUA.exe
  2⤵
  PID:5828
- C:\Windows\System\zQxwEdQ.exe
  C:\Windows\System\zQxwEdQ.exe
  2⤵
  PID:5844
- C:\Windows\System\cFRUTkm.exe
  C:\Windows\System\cFRUTkm.exe
  2⤵
  PID:5868
- C:\Windows\System\Gjtxuuh.exe
  C:\Windows\System\Gjtxuuh.exe
  2⤵
  PID:5884
- C:\Windows\System\qzNuijl.exe
  C:\Windows\System\qzNuijl.exe
  2⤵
  PID:5912
- C:\Windows\System\ruSJEBn.exe
  C:\Windows\System\ruSJEBn.exe
  2⤵
  PID:5928
- C:\Windows\System\gnqaqnp.exe
  C:\Windows\System\gnqaqnp.exe
  2⤵
  PID:5948
- C:\Windows\System\FyvVpco.exe
  C:\Windows\System\FyvVpco.exe
  2⤵
  PID:5972
- C:\Windows\System\zlzGHyZ.exe
  C:\Windows\System\zlzGHyZ.exe
  2⤵
  PID:6004
- C:\Windows\System\xxrJhXB.exe
  C:\Windows\System\xxrJhXB.exe
  2⤵
  PID:6028
- C:\Windows\System\uOOzcCG.exe
  C:\Windows\System\uOOzcCG.exe
  2⤵
  PID:6068
- C:\Windows\System\DSaKTOm.exe
  C:\Windows\System\DSaKTOm.exe
  2⤵
  PID:6088
- C:\Windows\System\HNZGqQr.exe
  C:\Windows\System\HNZGqQr.exe
  2⤵
  PID:6104
- C:\Windows\System\tNvtNeJ.exe
  C:\Windows\System\tNvtNeJ.exe
  2⤵
  PID:3076
- C:\Windows\System\QuQuGAJ.exe
  C:\Windows\System\QuQuGAJ.exe
  2⤵
  PID:3760
- C:\Windows\System\RagjsKz.exe
  C:\Windows\System\RagjsKz.exe
  2⤵
  PID:1444
- C:\Windows\System\oVBjGVy.exe
  C:\Windows\System\oVBjGVy.exe
  2⤵
  PID:1740
- C:\Windows\System\DyhwsdV.exe
  C:\Windows\System\DyhwsdV.exe
  2⤵
  PID:4472
- C:\Windows\System\RaUhALD.exe
  C:\Windows\System\RaUhALD.exe
  2⤵
  PID:3392
- C:\Windows\System\CCJjZHC.exe
  C:\Windows\System\CCJjZHC.exe
  2⤵
  PID:5092
- C:\Windows\System\ihUgGHw.exe
  C:\Windows\System\ihUgGHw.exe
  2⤵
  PID:3624
- C:\Windows\System\bVAPQva.exe
  C:\Windows\System\bVAPQva.exe
  2⤵
  PID:5340
- C:\Windows\System\ogLiPax.exe
  C:\Windows\System\ogLiPax.exe
  2⤵
  PID:5148
- C:\Windows\System\wrJFKXZ.exe
  C:\Windows\System\wrJFKXZ.exe
  2⤵
  PID:5184
- C:\Windows\System\nkXlnVN.exe
  C:\Windows\System\nkXlnVN.exe
  2⤵
  PID:5236
- C:\Windows\System\bfdvcjJ.exe
  C:\Windows\System\bfdvcjJ.exe
  2⤵
  PID:5312
- C:\Windows\System\aMNSJdk.exe
  C:\Windows\System\aMNSJdk.exe
  2⤵
  PID:5376
- C:\Windows\System\PelBTjG.exe
  C:\Windows\System\PelBTjG.exe
  2⤵
  PID:5432
- C:\Windows\System\ihmwGMZ.exe
  C:\Windows\System\ihmwGMZ.exe
  2⤵
  PID:5460
- C:\Windows\System\VhuFgSy.exe
  C:\Windows\System\VhuFgSy.exe
  2⤵
  PID:5728
- C:\Windows\System\MpvhAiD.exe
  C:\Windows\System\MpvhAiD.exe
  2⤵
  PID:5760
- C:\Windows\System\ShNnbLi.exe
  C:\Windows\System\ShNnbLi.exe
  2⤵
  PID:5796
- C:\Windows\System\uaBiMlB.exe
  C:\Windows\System\uaBiMlB.exe
  2⤵
  PID:5836
- C:\Windows\System\WpPkPdj.exe
  C:\Windows\System\WpPkPdj.exe
  2⤵
  PID:5864
- C:\Windows\System\hEEumJT.exe
  C:\Windows\System\hEEumJT.exe
  2⤵
  PID:5896
- C:\Windows\System\IhhmOBK.exe
  C:\Windows\System\IhhmOBK.exe
  2⤵
  PID:4012
- C:\Windows\System\UZszTkv.exe
  C:\Windows\System\UZszTkv.exe
  2⤵
  PID:3080
- C:\Windows\System\rbGgXEm.exe
  C:\Windows\System\rbGgXEm.exe
  2⤵
  PID:4084
- C:\Windows\System\qSMjLvJ.exe
  C:\Windows\System\qSMjLvJ.exe
  2⤵
  PID:6084
- C:\Windows\System\UAgZdyu.exe
  C:\Windows\System\UAgZdyu.exe
  2⤵
  PID:6044
- C:\Windows\System\avqvOYc.exe
  C:\Windows\System\avqvOYc.exe
  2⤵
  PID:5944
- C:\Windows\System\DZOkyTm.exe
  C:\Windows\System\DZOkyTm.exe
  2⤵
  PID:4176
- C:\Windows\System\zkvrkEG.exe
  C:\Windows\System\zkvrkEG.exe
  2⤵
  PID:2308
- C:\Windows\System\PprjzSm.exe
  C:\Windows\System\PprjzSm.exe
  2⤵
  PID:5272
- C:\Windows\System\bGCCGzf.exe
  C:\Windows\System\bGCCGzf.exe
  2⤵
  PID:5168
- C:\Windows\System\tyTBUnh.exe
  C:\Windows\System\tyTBUnh.exe
  2⤵
  PID:5292
- C:\Windows\System\GJfETMe.exe
  C:\Windows\System\GJfETMe.exe
  2⤵
  PID:5456
- C:\Windows\System\iqYTiCr.exe
  C:\Windows\System\iqYTiCr.exe
  2⤵
  PID:6176
- C:\Windows\System\JqspztW.exe
  C:\Windows\System\JqspztW.exe
  2⤵
  PID:6200
- C:\Windows\System\RHtZPqL.exe
  C:\Windows\System\RHtZPqL.exe
  2⤵
  PID:6220
- C:\Windows\System\NsAxiwk.exe
  C:\Windows\System\NsAxiwk.exe
  2⤵
  PID:6236
- C:\Windows\System\JoqMvqT.exe
  C:\Windows\System\JoqMvqT.exe
  2⤵
  PID:6368
- C:\Windows\System\sOOImLU.exe
  C:\Windows\System\sOOImLU.exe
  2⤵
  PID:6388
- C:\Windows\System\yxQrKFE.exe
  C:\Windows\System\yxQrKFE.exe
  2⤵
  PID:6424
- C:\Windows\System\mJlxFYY.exe
  C:\Windows\System\mJlxFYY.exe
  2⤵
  PID:6472
- C:\Windows\System\GsrCFKT.exe
  C:\Windows\System\GsrCFKT.exe
  2⤵
  PID:6496
- C:\Windows\System\PFGTMAz.exe
  C:\Windows\System\PFGTMAz.exe
  2⤵
  PID:6520
- C:\Windows\System\XpOLtpb.exe
  C:\Windows\System\XpOLtpb.exe
  2⤵
  PID:6540
- C:\Windows\System\IGdHHwU.exe
  C:\Windows\System\IGdHHwU.exe
  2⤵
  PID:6560
- C:\Windows\System\NZYKnxs.exe
  C:\Windows\System\NZYKnxs.exe
  2⤵
  PID:6576
- C:\Windows\System\GgzaAap.exe
  C:\Windows\System\GgzaAap.exe
  2⤵
  PID:6600
- C:\Windows\System\hlIhnmH.exe
  C:\Windows\System\hlIhnmH.exe
  2⤵
  PID:6624
- C:\Windows\System\DYKKRKb.exe
  C:\Windows\System\DYKKRKb.exe
  2⤵
  PID:6652
- C:\Windows\System\iMHMNNP.exe
  C:\Windows\System\iMHMNNP.exe
  2⤵
  PID:6668
- C:\Windows\System\XZyEzMj.exe
  C:\Windows\System\XZyEzMj.exe
  2⤵
  PID:6684
- C:\Windows\System\NxEURJh.exe
  C:\Windows\System\NxEURJh.exe
  2⤵
  PID:6700
- C:\Windows\System\AgpYmLB.exe
  C:\Windows\System\AgpYmLB.exe
  2⤵
  PID:6720
- C:\Windows\System\kvHHnZe.exe
  C:\Windows\System\kvHHnZe.exe
  2⤵
  PID:6748
- C:\Windows\System\AtLAvDO.exe
  C:\Windows\System\AtLAvDO.exe
  2⤵
  PID:6768
- C:\Windows\System\WcyUWIN.exe
  C:\Windows\System\WcyUWIN.exe
  2⤵
  PID:6784
- C:\Windows\System\gOCIwcI.exe
  C:\Windows\System\gOCIwcI.exe
  2⤵
  PID:6824
- C:\Windows\System\FKYdJui.exe
  C:\Windows\System\FKYdJui.exe
  2⤵
  PID:6848
- C:\Windows\System\HHPmhnX.exe
  C:\Windows\System\HHPmhnX.exe
  2⤵
  PID:6872
- C:\Windows\System\YkFVVmd.exe
  C:\Windows\System\YkFVVmd.exe
  2⤵
  PID:7116
- C:\Windows\System\PgAfiVZ.exe
  C:\Windows\System\PgAfiVZ.exe
  2⤵
  PID:7144
- C:\Windows\System\wCplbFE.exe
  C:\Windows\System\wCplbFE.exe
  2⤵
  PID:7160
- C:\Windows\System\WKGhgna.exe
  C:\Windows\System\WKGhgna.exe
  2⤵
  PID:5228
- C:\Windows\System\DHOPwoy.exe
  C:\Windows\System\DHOPwoy.exe
  2⤵
  PID:1976
- C:\Windows\System\xdgyTZy.exe
  C:\Windows\System\xdgyTZy.exe
  2⤵
  PID:5132
- C:\Windows\System\NQZRWPp.exe
  C:\Windows\System\NQZRWPp.exe
  2⤵
  PID:5856
- C:\Windows\System\GmXCjZR.exe
  C:\Windows\System\GmXCjZR.exe
  2⤵
  PID:868
- C:\Windows\System\ZqznLCA.exe
  C:\Windows\System\ZqznLCA.exe
  2⤵
  PID:6012
- C:\Windows\System\JWcaMIQ.exe
  C:\Windows\System\JWcaMIQ.exe
  2⤵
  PID:5956
- C:\Windows\System\edGfqoB.exe
  C:\Windows\System\edGfqoB.exe
  2⤵
  PID:2716
- C:\Windows\System\dPbuNHn.exe
  C:\Windows\System\dPbuNHn.exe
  2⤵
  PID:6020
- C:\Windows\System\sXNljOt.exe
  C:\Windows\System\sXNljOt.exe
  2⤵
  PID:5708
- C:\Windows\System\dQxFYkY.exe
  C:\Windows\System\dQxFYkY.exe
  2⤵
  PID:6160
- C:\Windows\System\fkeGMDp.exe
  C:\Windows\System\fkeGMDp.exe
  2⤵
  PID:6216
- C:\Windows\System\kAgSMgL.exe
  C:\Windows\System\kAgSMgL.exe
  2⤵
  PID:6248
- C:\Windows\System\YQJItYl.exe
  C:\Windows\System\YQJItYl.exe
  2⤵
  PID:6336
- C:\Windows\System\QsATJXD.exe
  C:\Windows\System\QsATJXD.exe
  2⤵
  PID:6384
- C:\Windows\System\jhXTxKB.exe
  C:\Windows\System\jhXTxKB.exe
  2⤵
  PID:3324
- C:\Windows\System\MxGxuDh.exe
  C:\Windows\System\MxGxuDh.exe
  2⤵
  PID:3220
- C:\Windows\System\slFdZvq.exe
  C:\Windows\System\slFdZvq.exe
  2⤵
  PID:6440
- C:\Windows\System\gSomZpR.exe
  C:\Windows\System\gSomZpR.exe
  2⤵
  PID:6808
- C:\Windows\System\TSDzjPA.exe
  C:\Windows\System\TSDzjPA.exe
  2⤵
  PID:6844
- C:\Windows\System\TBOSDMy.exe
  C:\Windows\System\TBOSDMy.exe
  2⤵
  PID:6880
- C:\Windows\System\ReGnOui.exe
  C:\Windows\System\ReGnOui.exe
  2⤵
  PID:7048
- C:\Windows\System\usiqaSk.exe
  C:\Windows\System\usiqaSk.exe
  2⤵
  PID:7184
- C:\Windows\System\QHmRmzm.exe
  C:\Windows\System\QHmRmzm.exe
  2⤵
  PID:7204
- C:\Windows\System\ZtdaXPQ.exe
  C:\Windows\System\ZtdaXPQ.exe
  2⤵
  PID:7228
- C:\Windows\System\gabvXtb.exe
  C:\Windows\System\gabvXtb.exe
  2⤵
  PID:7248
- C:\Windows\System\eVcAuZV.exe
  C:\Windows\System\eVcAuZV.exe
  2⤵
  PID:7268
- C:\Windows\System\cIWVHSb.exe
  C:\Windows\System\cIWVHSb.exe
  2⤵
  PID:7292
- C:\Windows\System\qbqYcVz.exe
  C:\Windows\System\qbqYcVz.exe
  2⤵
  PID:7312
- C:\Windows\System\FSbwFcR.exe
  C:\Windows\System\FSbwFcR.exe
  2⤵
  PID:7332
- C:\Windows\System\jldUZrm.exe
  C:\Windows\System\jldUZrm.exe
  2⤵
  PID:7360
- C:\Windows\System\LFzBsCm.exe
  C:\Windows\System\LFzBsCm.exe
  2⤵
  PID:7380
- C:\Windows\System\mPnHhrT.exe
  C:\Windows\System\mPnHhrT.exe
  2⤵
  PID:7396
- C:\Windows\System\TiGIzFv.exe
  C:\Windows\System\TiGIzFv.exe
  2⤵
  PID:7420
- C:\Windows\System\dmuEysy.exe
  C:\Windows\System\dmuEysy.exe
  2⤵
  PID:7444
- C:\Windows\System\MDlaoOp.exe
  C:\Windows\System\MDlaoOp.exe
  2⤵
  PID:7472
- C:\Windows\System\MkWTaoc.exe
  C:\Windows\System\MkWTaoc.exe
  2⤵
  PID:7488
- C:\Windows\System\TngaDLj.exe
  C:\Windows\System\TngaDLj.exe
  2⤵
  PID:7508
- C:\Windows\System\FNqiRnP.exe
  C:\Windows\System\FNqiRnP.exe
  2⤵
  PID:7572
- C:\Windows\System\ikhELuM.exe
  C:\Windows\System\ikhELuM.exe
  2⤵
  PID:7588
- C:\Windows\System\NGcmNDb.exe
  C:\Windows\System\NGcmNDb.exe
  2⤵
  PID:7604
- C:\Windows\System\ogXEaGJ.exe
  C:\Windows\System\ogXEaGJ.exe
  2⤵
  PID:7636
- C:\Windows\System\vRTZkLA.exe
  C:\Windows\System\vRTZkLA.exe
  2⤵
  PID:7664
- C:\Windows\System\FmtCFTO.exe
  C:\Windows\System\FmtCFTO.exe
  2⤵
  PID:7680
- C:\Windows\System\fgmaxzp.exe
  C:\Windows\System\fgmaxzp.exe
  2⤵
  PID:7712
- C:\Windows\System\DwZxcVn.exe
  C:\Windows\System\DwZxcVn.exe
  2⤵
  PID:7860
- C:\Windows\System\JVECPOP.exe
  C:\Windows\System\JVECPOP.exe
  2⤵
  PID:7884
- C:\Windows\System\VsbmysZ.exe
  C:\Windows\System\VsbmysZ.exe
  2⤵
  PID:7908
- C:\Windows\System\wowqtqe.exe
  C:\Windows\System\wowqtqe.exe
  2⤵
  PID:7928
- C:\Windows\System\jDzZJDY.exe
  C:\Windows\System\jDzZJDY.exe
  2⤵
  PID:7944
- C:\Windows\System\UjCouUd.exe
  C:\Windows\System\UjCouUd.exe
  2⤵
  PID:7964
- C:\Windows\System\dHZoSsp.exe
  C:\Windows\System\dHZoSsp.exe
  2⤵
  PID:7988
- C:\Windows\System\qEtfIcz.exe
  C:\Windows\System\qEtfIcz.exe
  2⤵
  PID:8008
- C:\Windows\System\ECNqRga.exe
  C:\Windows\System\ECNqRga.exe
  2⤵
  PID:8032
- C:\Windows\System\OYJEECV.exe
  C:\Windows\System\OYJEECV.exe
  2⤵
  PID:8060
- C:\Windows\System\tvXKFSz.exe
  C:\Windows\System\tvXKFSz.exe
  2⤵
  PID:8076
- C:\Windows\System\LGzHmcS.exe
  C:\Windows\System\LGzHmcS.exe
  2⤵
  PID:8092
- C:\Windows\System\gRYulmp.exe
  C:\Windows\System\gRYulmp.exe
  2⤵
  PID:8112
- C:\Windows\System\QIDroCy.exe
  C:\Windows\System\QIDroCy.exe
  2⤵
  PID:8132
- C:\Windows\System\GXQMJHd.exe
  C:\Windows\System\GXQMJHd.exe
  2⤵
  PID:7076
- C:\Windows\System\yiuoDHP.exe
  C:\Windows\System\yiuoDHP.exe
  2⤵
  PID:7108
- C:\Windows\System\kTIBHaP.exe
  C:\Windows\System\kTIBHaP.exe
  2⤵
  PID:7132
- C:\Windows\System\vAFlzba.exe
  C:\Windows\System\vAFlzba.exe
  2⤵
  PID:1536
- C:\Windows\System\AmWtWas.exe
  C:\Windows\System\AmWtWas.exe
  2⤵
  PID:4632
- C:\Windows\System\RTMtBgH.exe
  C:\Windows\System\RTMtBgH.exe
  2⤵
  PID:4716
- C:\Windows\System\caDjKGg.exe
  C:\Windows\System\caDjKGg.exe
  2⤵
  PID:5988
- C:\Windows\System\mANWRQP.exe
  C:\Windows\System\mANWRQP.exe
  2⤵
  PID:1016
- C:\Windows\System\jUZBkzc.exe
  C:\Windows\System\jUZBkzc.exe
  2⤵
  PID:6156
- C:\Windows\System\aFzbTFW.exe
  C:\Windows\System\aFzbTFW.exe
  2⤵
  PID:6324
- C:\Windows\System\aaGKILX.exe
  C:\Windows\System\aaGKILX.exe
  2⤵
  PID:6348
- C:\Windows\System\aXUatZS.exe
  C:\Windows\System\aXUatZS.exe
  2⤵
  PID:7328
- C:\Windows\System\mDQvCEK.exe
  C:\Windows\System\mDQvCEK.exe
  2⤵
  PID:7372
- C:\Windows\System\sorgStm.exe
  C:\Windows\System\sorgStm.exe
  2⤵
  PID:6620
- C:\Windows\System\UbuxJUB.exe
  C:\Windows\System\UbuxJUB.exe
  2⤵
  PID:6708
- C:\Windows\System\KAXEoQx.exe
  C:\Windows\System\KAXEoQx.exe
  2⤵
  PID:6796
- C:\Windows\System\EjVJaGm.exe
  C:\Windows\System\EjVJaGm.exe
  2⤵
  PID:2384
- C:\Windows\System\vlPmZMa.exe
  C:\Windows\System\vlPmZMa.exe
  2⤵
  PID:3396
- C:\Windows\System\GBeWvnU.exe
  C:\Windows\System\GBeWvnU.exe
  2⤵
  PID:3528
- C:\Windows\System\oayfVJv.exe
  C:\Windows\System\oayfVJv.exe
  2⤵
  PID:7284
- C:\Windows\System\PTHBliI.exe
  C:\Windows\System\PTHBliI.exe
  2⤵
  PID:7368
- C:\Windows\System\aloTgfY.exe
  C:\Windows\System\aloTgfY.exe
  2⤵
  PID:7416
- C:\Windows\System\yvMTXon.exe
  C:\Windows\System\yvMTXon.exe
  2⤵
  PID:7452
- C:\Windows\System\fqvIQea.exe
  C:\Windows\System\fqvIQea.exe
  2⤵
  PID:4948
- C:\Windows\System\tIsBMWq.exe
  C:\Windows\System\tIsBMWq.exe
  2⤵
  PID:2820
- C:\Windows\System\blqXKuF.exe
  C:\Windows\System\blqXKuF.exe
  2⤵
  PID:7600
- C:\Windows\System\DvfbDtc.exe
  C:\Windows\System\DvfbDtc.exe
  2⤵
  PID:7648
- C:\Windows\System\xRzRPLD.exe
  C:\Windows\System\xRzRPLD.exe
  2⤵
  PID:7724
- C:\Windows\System\cBQIwvm.exe
  C:\Windows\System\cBQIwvm.exe
  2⤵
  PID:1160
- C:\Windows\System\GMrVJzf.exe
  C:\Windows\System\GMrVJzf.exe
  2⤵
  PID:7792
- C:\Windows\System\zrYcDpt.exe
  C:\Windows\System\zrYcDpt.exe
  2⤵
  PID:7760
- C:\Windows\System\SLWpzEF.exe
  C:\Windows\System\SLWpzEF.exe
  2⤵
  PID:8180
- C:\Windows\System\PiEyhVh.exe
  C:\Windows\System\PiEyhVh.exe
  2⤵
  PID:7848
- C:\Windows\System\Pxwrqhr.exe
  C:\Windows\System\Pxwrqhr.exe
  2⤵
  PID:7936
- C:\Windows\System\OfIdCTX.exe
  C:\Windows\System\OfIdCTX.exe
  2⤵
  PID:7996
- C:\Windows\System\iQuXHNs.exe
  C:\Windows\System\iQuXHNs.exe
  2⤵
  PID:8044
- C:\Windows\System\kkQbkwE.exe
  C:\Windows\System\kkQbkwE.exe
  2⤵
  PID:2772
- C:\Windows\System\xDuqfxq.exe
  C:\Windows\System\xDuqfxq.exe
  2⤵
  PID:7040
- C:\Windows\System\zVvZGHt.exe
  C:\Windows\System\zVvZGHt.exe
  2⤵
  PID:7412
- C:\Windows\System\AidpsVn.exe
  C:\Windows\System\AidpsVn.exe
  2⤵
  PID:8216
- C:\Windows\System\lqhQWqF.exe
  C:\Windows\System\lqhQWqF.exe
  2⤵
  PID:8240
- C:\Windows\System\hYYQsif.exe
  C:\Windows\System\hYYQsif.exe
  2⤵
  PID:8260
- C:\Windows\System\EDIISyv.exe
  C:\Windows\System\EDIISyv.exe
  2⤵
  PID:8280
- C:\Windows\System\QILZzmY.exe
  C:\Windows\System\QILZzmY.exe
  2⤵
  PID:8308
- C:\Windows\System\skFEqlp.exe
  C:\Windows\System\skFEqlp.exe
  2⤵
  PID:8332
- C:\Windows\System\eFCwZTK.exe
  C:\Windows\System\eFCwZTK.exe
  2⤵
  PID:8364
- C:\Windows\System\MspgLWM.exe
  C:\Windows\System\MspgLWM.exe
  2⤵
  PID:8392
- C:\Windows\System\QYurJHD.exe
  C:\Windows\System\QYurJHD.exe
  2⤵
  PID:8432
- C:\Windows\System\jiaBNIW.exe
  C:\Windows\System\jiaBNIW.exe
  2⤵
  PID:8460
- C:\Windows\System\NEhPmaM.exe
  C:\Windows\System\NEhPmaM.exe
  2⤵
  PID:8480
- C:\Windows\System\ieFLdWS.exe
  C:\Windows\System\ieFLdWS.exe
  2⤵
  PID:8500
- C:\Windows\System\IiqDrns.exe
  C:\Windows\System\IiqDrns.exe
  2⤵
  PID:8524
- C:\Windows\System\wrTrflF.exe
  C:\Windows\System\wrTrflF.exe
  2⤵
  PID:8544
- C:\Windows\System\eIWiIrj.exe
  C:\Windows\System\eIWiIrj.exe
  2⤵
  PID:8568
- C:\Windows\System\LUppabV.exe
  C:\Windows\System\LUppabV.exe
  2⤵
  PID:8588
- C:\Windows\System\dBQuIsu.exe
  C:\Windows\System\dBQuIsu.exe
  2⤵
  PID:8608
- C:\Windows\System\TYtErDk.exe
  C:\Windows\System\TYtErDk.exe
  2⤵
  PID:8636
- C:\Windows\System\WNDAJwM.exe
  C:\Windows\System\WNDAJwM.exe
  2⤵
  PID:8652
- C:\Windows\System\LDGvLsZ.exe
  C:\Windows\System\LDGvLsZ.exe
  2⤵
  PID:8696
- C:\Windows\System\DakmTxq.exe
  C:\Windows\System\DakmTxq.exe
  2⤵
  PID:8724
- C:\Windows\System\fPzySZi.exe
  C:\Windows\System\fPzySZi.exe
  2⤵
  PID:8752
- C:\Windows\System\uTUzLfV.exe
  C:\Windows\System\uTUzLfV.exe
  2⤵
  PID:8768
- C:\Windows\System\ECaCjRS.exe
  C:\Windows\System\ECaCjRS.exe
  2⤵
  PID:8784
- C:\Windows\System\Eydqeeb.exe
  C:\Windows\System\Eydqeeb.exe
  2⤵
  PID:8800
- C:\Windows\System\CCaNVwh.exe
  C:\Windows\System\CCaNVwh.exe
  2⤵
  PID:8824
- C:\Windows\System\yncxNPH.exe
  C:\Windows\System\yncxNPH.exe
  2⤵
  PID:8840
- C:\Windows\System\QqsXSsZ.exe
  C:\Windows\System\QqsXSsZ.exe
  2⤵
  PID:8864
- C:\Windows\System\MNOWUGI.exe
  C:\Windows\System\MNOWUGI.exe
  2⤵
  PID:8884
- C:\Windows\System\pJbmjFM.exe
  C:\Windows\System\pJbmjFM.exe
  2⤵
  PID:8904
- C:\Windows\System\VHkyInc.exe
  C:\Windows\System\VHkyInc.exe
  2⤵
  PID:8920
- C:\Windows\System\PbMypfT.exe
  C:\Windows\System\PbMypfT.exe
  2⤵
  PID:8936
- C:\Windows\System\smuIqEC.exe
  C:\Windows\System\smuIqEC.exe
  2⤵
  PID:8952
- C:\Windows\System\fBsUybM.exe
  C:\Windows\System\fBsUybM.exe
  2⤵
  PID:8968
- C:\Windows\System\EFLnAJz.exe
  C:\Windows\System\EFLnAJz.exe
  2⤵
  PID:8988
- C:\Windows\System\AOreXXI.exe
  C:\Windows\System\AOreXXI.exe
  2⤵
  PID:9012
- C:\Windows\System\yDbVdOl.exe
  C:\Windows\System\yDbVdOl.exe
  2⤵
  PID:9028
- C:\Windows\System\WILsDlO.exe
  C:\Windows\System\WILsDlO.exe
  2⤵
  PID:9064
- C:\Windows\System\vRszGVL.exe
  C:\Windows\System\vRszGVL.exe
  2⤵
  PID:9108
- C:\Windows\System\xcRAXKy.exe
  C:\Windows\System\xcRAXKy.exe
  2⤵
  PID:9156
- C:\Windows\System\bCPbipy.exe
  C:\Windows\System\bCPbipy.exe
  2⤵
  PID:9192
- C:\Windows\System\fLgzUxt.exe
  C:\Windows\System\fLgzUxt.exe
  2⤵
  PID:3500
- C:\Windows\System\wpKUmLN.exe
  C:\Windows\System\wpKUmLN.exe
  2⤵
  PID:4364
- C:\Windows\System\UhsMfTn.exe
  C:\Windows\System\UhsMfTn.exe
  2⤵
  PID:7128
- C:\Windows\System\SmPmuyE.exe
  C:\Windows\System\SmPmuyE.exe
  2⤵
  PID:5980
- C:\Windows\System\KeQwgcd.exe
  C:\Windows\System\KeQwgcd.exe
  2⤵
  PID:8084
- C:\Windows\System\oQKKZVj.exe
  C:\Windows\System\oQKKZVj.exe
  2⤵
  PID:4372
- C:\Windows\System\RSZnoga.exe
  C:\Windows\System\RSZnoga.exe
  2⤵
  PID:7088
- C:\Windows\System\mWvKtlb.exe
  C:\Windows\System\mWvKtlb.exe
  2⤵
  PID:7840
- C:\Windows\System\eIIalAN.exe
  C:\Windows\System\eIIalAN.exe
  2⤵
  PID:8232
- C:\Windows\System\ICSItHt.exe
  C:\Windows\System\ICSItHt.exe
  2⤵
  PID:8276
- C:\Windows\System\uAJThiJ.exe
  C:\Windows\System\uAJThiJ.exe
  2⤵
  PID:7356
- C:\Windows\System\ekUCQHS.exe
  C:\Windows\System\ekUCQHS.exe
  2⤵
  PID:2720
- C:\Windows\System\IacwUQW.exe
  C:\Windows\System\IacwUQW.exe
  2⤵
  PID:6780
- C:\Windows\System\cHjFphq.exe
  C:\Windows\System\cHjFphq.exe
  2⤵
  PID:7212
- C:\Windows\System\kSnQcRw.exe
  C:\Windows\System\kSnQcRw.exe
  2⤵
  PID:7304
- C:\Windows\System\vdBGfRT.exe
  C:\Windows\System\vdBGfRT.exe
  2⤵
  PID:8040
- C:\Windows\System\zKkrzoU.exe
  C:\Windows\System\zKkrzoU.exe
  2⤵
  PID:7480
- C:\Windows\System\XZFxoNw.exe
  C:\Windows\System\XZFxoNw.exe
  2⤵
  PID:7564
- C:\Windows\System\AnHTxIh.exe
  C:\Windows\System\AnHTxIh.exe
  2⤵
  PID:7672
- C:\Windows\System\DEWWkMC.exe
  C:\Windows\System\DEWWkMC.exe
  2⤵
  PID:5100
- C:\Windows\System\RviiaLd.exe
  C:\Windows\System\RviiaLd.exe
  2⤵
  PID:8004
- C:\Windows\System\sEOxLZQ.exe
  C:\Windows\System\sEOxLZQ.exe
  2⤵
  PID:7800
- C:\Windows\System\JwjyIsB.exe
  C:\Windows\System\JwjyIsB.exe
  2⤵
  PID:7952
- C:\Windows\System\wrVucYq.exe
  C:\Windows\System\wrVucYq.exe
  2⤵
  PID:8028
- C:\Windows\System\lKYZYFq.exe
  C:\Windows\System\lKYZYFq.exe
  2⤵
  PID:6868
- C:\Windows\System\MFRbHXr.exe
  C:\Windows\System\MFRbHXr.exe
  2⤵
  PID:8916
- C:\Windows\System\OTFiWqu.exe
  C:\Windows\System\OTFiWqu.exe
  2⤵
  PID:8248
- C:\Windows\System\BknXycd.exe
  C:\Windows\System\BknXycd.exe
  2⤵
  PID:9000
- C:\Windows\System\SrPtmBd.exe
  C:\Windows\System\SrPtmBd.exe
  2⤵
  PID:9228
- C:\Windows\System\HcqYYKn.exe
  C:\Windows\System\HcqYYKn.exe
  2⤵
  PID:9244
- C:\Windows\System\feKqDmn.exe
  C:\Windows\System\feKqDmn.exe
  2⤵
  PID:9260
- C:\Windows\System\xLWpzdO.exe
  C:\Windows\System\xLWpzdO.exe
  2⤵
  PID:9276
- C:\Windows\System\gHeimlj.exe
  C:\Windows\System\gHeimlj.exe
  2⤵
  PID:9292
- C:\Windows\System\lOjjkZB.exe
  C:\Windows\System\lOjjkZB.exe
  2⤵
  PID:9308
- C:\Windows\System\iBVOheY.exe
  C:\Windows\System\iBVOheY.exe
  2⤵
  PID:9324
- C:\Windows\System\WBvTYYx.exe
  C:\Windows\System\WBvTYYx.exe
  2⤵
  PID:9340
- C:\Windows\System\otVgLoU.exe
  C:\Windows\System\otVgLoU.exe
  2⤵
  PID:9356
- C:\Windows\System\VrdHFWb.exe
  C:\Windows\System\VrdHFWb.exe
  2⤵
  PID:9372
- C:\Windows\System\CeOvIkQ.exe
  C:\Windows\System\CeOvIkQ.exe
  2⤵
  PID:9388
- C:\Windows\System\HfqNgKC.exe
  C:\Windows\System\HfqNgKC.exe
  2⤵
  PID:9404
- C:\Windows\System\qbRWoCM.exe
  C:\Windows\System\qbRWoCM.exe
  2⤵
  PID:9420
- C:\Windows\System\dkvEubL.exe
  C:\Windows\System\dkvEubL.exe
  2⤵
  PID:9436
- C:\Windows\System\yQQujJs.exe
  C:\Windows\System\yQQujJs.exe
  2⤵
  PID:9468
- C:\Windows\System\BeumWjA.exe
  C:\Windows\System\BeumWjA.exe
  2⤵
  PID:9524
- C:\Windows\System\OmtqBxF.exe
  C:\Windows\System\OmtqBxF.exe
  2⤵
  PID:9548
- C:\Windows\System\aYmwLof.exe
  C:\Windows\System\aYmwLof.exe
  2⤵
  PID:9564
- C:\Windows\System\qqzRtWM.exe
  C:\Windows\System\qqzRtWM.exe
  2⤵
  PID:9600
- C:\Windows\System\hMZqWbn.exe
  C:\Windows\System\hMZqWbn.exe
  2⤵
  PID:9616
- C:\Windows\System\LWsUmlL.exe
  C:\Windows\System\LWsUmlL.exe
  2⤵
  PID:9640
- C:\Windows\System\deZEvmh.exe
  C:\Windows\System\deZEvmh.exe
  2⤵
  PID:9660
- C:\Windows\System\jcRdwsa.exe
  C:\Windows\System\jcRdwsa.exe
  2⤵
  PID:9684
- C:\Windows\System\gAuWizi.exe
  C:\Windows\System\gAuWizi.exe
  2⤵
  PID:9708
- C:\Windows\System\KoyUmNf.exe
  C:\Windows\System\KoyUmNf.exe
  2⤵
  PID:9724
- C:\Windows\System\obAfQfj.exe
  C:\Windows\System\obAfQfj.exe
  2⤵
  PID:9748
- C:\Windows\System\wtAwYxn.exe
  C:\Windows\System\wtAwYxn.exe
  2⤵
  PID:9776
- C:\Windows\System\NglBpuJ.exe
  C:\Windows\System\NglBpuJ.exe
  2⤵
  PID:9796
- C:\Windows\System\NUzyoqq.exe
  C:\Windows\System\NUzyoqq.exe
  2⤵
  PID:9820
- C:\Windows\System\ATlNpom.exe
  C:\Windows\System\ATlNpom.exe
  2⤵
  PID:9836
- C:\Windows\System\CZRDNot.exe
  C:\Windows\System\CZRDNot.exe
  2⤵
  PID:9852
- C:\Windows\System\oDEWyaZ.exe
  C:\Windows\System\oDEWyaZ.exe
  2⤵
  PID:9868
- C:\Windows\System\aFLBzsi.exe
  C:\Windows\System\aFLBzsi.exe
  2⤵
  PID:9892
- C:\Windows\System\eeDicGo.exe
  C:\Windows\System\eeDicGo.exe
  2⤵
  PID:9916
- C:\Windows\System\tzMuecU.exe
  C:\Windows\System\tzMuecU.exe
  2⤵
  PID:9936
- C:\Windows\System\ZJwDmoi.exe
  C:\Windows\System\ZJwDmoi.exe
  2⤵
  PID:9960
- C:\Windows\System\ohFzaUJ.exe
  C:\Windows\System\ohFzaUJ.exe
  2⤵
  PID:9980
- C:\Windows\System\ryAiDFe.exe
  C:\Windows\System\ryAiDFe.exe
  2⤵
  PID:10000
- C:\Windows\System\RtMzOxV.exe
  C:\Windows\System\RtMzOxV.exe
  2⤵
  PID:10028
- C:\Windows\System\HrALyvO.exe
  C:\Windows\System\HrALyvO.exe
  2⤵
  PID:10052
- C:\Windows\System\iwCIVMG.exe
  C:\Windows\System\iwCIVMG.exe
  2⤵
  PID:10068
- C:\Windows\System\jTCNLZQ.exe
  C:\Windows\System\jTCNLZQ.exe
  2⤵
  PID:10092
- C:\Windows\System\SXmWOUx.exe
  C:\Windows\System\SXmWOUx.exe
  2⤵
  PID:10116
- C:\Windows\System\WmQFdti.exe
  C:\Windows\System\WmQFdti.exe
  2⤵
  PID:10136
- C:\Windows\System\UhAFCzG.exe
  C:\Windows\System\UhAFCzG.exe
  2⤵
  PID:10156
- C:\Windows\System\UiQjcQi.exe
  C:\Windows\System\UiQjcQi.exe
  2⤵
  PID:10176
- C:\Windows\System\RMwwulZ.exe
  C:\Windows\System\RMwwulZ.exe
  2⤵
  PID:10192
- C:\Windows\System\KAPasjT.exe
  C:\Windows\System\KAPasjT.exe
  2⤵
  PID:10208
- C:\Windows\System\EDosqjE.exe
  C:\Windows\System\EDosqjE.exe
  2⤵
  PID:10224
- C:\Windows\System\tWfOHJn.exe
  C:\Windows\System\tWfOHJn.exe
  2⤵
  PID:8596
- C:\Windows\System\XqpekZs.exe
  C:\Windows\System\XqpekZs.exe
  2⤵
  PID:8624
- C:\Windows\System\TDtJoPV.exe
  C:\Windows\System\TDtJoPV.exe
  2⤵
  PID:9144
- C:\Windows\System\ujXuhuk.exe
  C:\Windows\System\ujXuhuk.exe
  2⤵
  PID:3956
- C:\Windows\System\VWCKSsy.exe
  C:\Windows\System\VWCKSsy.exe
  2⤵
  PID:1628
- C:\Windows\System\azHxmSB.exe
  C:\Windows\System\azHxmSB.exe
  2⤵
  PID:8380
- C:\Windows\System\hGdXqpp.exe
  C:\Windows\System\hGdXqpp.exe
  2⤵
  PID:8712
- C:\Windows\System\BaNWHgJ.exe
  C:\Windows\System\BaNWHgJ.exe
  2⤵
  PID:8420
- C:\Windows\System\YrzQAax.exe
  C:\Windows\System\YrzQAax.exe
  2⤵
  PID:8124
- C:\Windows\System\JmLEPRa.exe
  C:\Windows\System\JmLEPRa.exe
  2⤵
  PID:8348
- C:\Windows\System\ASGBWRA.exe
  C:\Windows\System\ASGBWRA.exe
  2⤵
  PID:2812
- C:\Windows\System\CUKEOJw.exe
  C:\Windows\System\CUKEOJw.exe
  2⤵
  PID:7404
- C:\Windows\System\lAOtjEw.exe
  C:\Windows\System\lAOtjEw.exe
  2⤵
  PID:8980
- C:\Windows\System\xWXhpcc.exe
  C:\Windows\System\xWXhpcc.exe
  2⤵
  PID:8964
- C:\Windows\System\sNazRyc.exe
  C:\Windows\System\sNazRyc.exe
  2⤵
  PID:8324
- C:\Windows\System\hyqbVaQ.exe
  C:\Windows\System\hyqbVaQ.exe
  2⤵
  PID:8560
- C:\Windows\System\JLLfJeH.exe
  C:\Windows\System\JLLfJeH.exe
  2⤵
  PID:9056
- C:\Windows\System\baCvwpY.exe
  C:\Windows\System\baCvwpY.exe
  2⤵
  PID:9084
- C:\Windows\System\WRonYVf.exe
  C:\Windows\System\WRonYVf.exe
  2⤵
  PID:8644
- C:\Windows\System\SOdCutS.exe
  C:\Windows\System\SOdCutS.exe
  2⤵
  PID:9520
- C:\Windows\System\cqkhNjq.exe
  C:\Windows\System\cqkhNjq.exe
  2⤵
  PID:8676
- C:\Windows\System\SeUJGKl.exe
  C:\Windows\System\SeUJGKl.exe
  2⤵
  PID:2096
- C:\Windows\System\ptKGhtw.exe
  C:\Windows\System\ptKGhtw.exe
  2⤵
  PID:7060
- C:\Windows\System\ouTqFMy.exe
  C:\Windows\System\ouTqFMy.exe
  2⤵
  PID:9668
- C:\Windows\System\HixBViq.exe
  C:\Windows\System\HixBViq.exe
  2⤵
  PID:5816
- C:\Windows\System\HqqruzQ.exe
  C:\Windows\System\HqqruzQ.exe
  2⤵
  PID:10264
- C:\Windows\System\gMaMWhZ.exe
  C:\Windows\System\gMaMWhZ.exe
  2⤵
  PID:10284
- C:\Windows\System\gvAnxod.exe
  C:\Windows\System\gvAnxod.exe
  2⤵
  PID:10304
- C:\Windows\System\OwcKLiG.exe
  C:\Windows\System\OwcKLiG.exe
  2⤵
  PID:10328
- C:\Windows\System\pUkplEu.exe
  C:\Windows\System\pUkplEu.exe
  2⤵
  PID:10352
- C:\Windows\System\dXrFIhf.exe
  C:\Windows\System\dXrFIhf.exe
  2⤵
  PID:10372
- C:\Windows\System\kBMzPvn.exe
  C:\Windows\System\kBMzPvn.exe
  2⤵
  PID:10392
- C:\Windows\System\NJhRUTs.exe
  C:\Windows\System\NJhRUTs.exe
  2⤵
  PID:10408
- C:\Windows\System\KDLLosO.exe
  C:\Windows\System\KDLLosO.exe
  2⤵
  PID:10428
- C:\Windows\System\BFSnNrq.exe
  C:\Windows\System\BFSnNrq.exe
  2⤵
  PID:10452
- C:\Windows\System\HgBLKxJ.exe
  C:\Windows\System\HgBLKxJ.exe
  2⤵
  PID:10476
- C:\Windows\System\SOVOZSs.exe
  C:\Windows\System\SOVOZSs.exe
  2⤵
  PID:10492
- C:\Windows\System\vCsbFhW.exe
  C:\Windows\System\vCsbFhW.exe
  2⤵
  PID:10512
- C:\Windows\System\WdIAXhC.exe
  C:\Windows\System\WdIAXhC.exe
  2⤵
  PID:10532
- C:\Windows\System\XiquHXV.exe
  C:\Windows\System\XiquHXV.exe
  2⤵
  PID:10556
- C:\Windows\System\gnqZXtW.exe
  C:\Windows\System\gnqZXtW.exe
  2⤵
  PID:10580
- C:\Windows\System\XhzMDJd.exe
  C:\Windows\System\XhzMDJd.exe
  2⤵
  PID:10600
- C:\Windows\System\rFpsuhH.exe
  C:\Windows\System\rFpsuhH.exe
  2⤵
  PID:10620
- C:\Windows\System\WhtDSNs.exe
  C:\Windows\System\WhtDSNs.exe
  2⤵
  PID:10648
- C:\Windows\System\DbrCHbB.exe
  C:\Windows\System\DbrCHbB.exe
  2⤵
  PID:10664
- C:\Windows\System\RIDstOs.exe
  C:\Windows\System\RIDstOs.exe
  2⤵
  PID:10684
- C:\Windows\System\UmNyPCn.exe
  C:\Windows\System\UmNyPCn.exe
  2⤵
  PID:10708
- C:\Windows\System\aakbYcg.exe
  C:\Windows\System\aakbYcg.exe
  2⤵
  PID:10724
- C:\Windows\System\KmejMZs.exe
  C:\Windows\System\KmejMZs.exe
  2⤵
  PID:10744
- C:\Windows\System\arCSByT.exe
  C:\Windows\System\arCSByT.exe
  2⤵
  PID:10768
- C:\Windows\System\mzukIsV.exe
  C:\Windows\System\mzukIsV.exe
  2⤵
  PID:10784
- C:\Windows\System\gxeWJWG.exe
  C:\Windows\System\gxeWJWG.exe
  2⤵
  PID:10800
- C:\Windows\System\MkJJZnN.exe
  C:\Windows\System\MkJJZnN.exe
  2⤵
  PID:10816
- C:\Windows\System\XVZPKNl.exe
  C:\Windows\System\XVZPKNl.exe
  2⤵
  PID:10832
- C:\Windows\System\pOfzTzu.exe
  C:\Windows\System\pOfzTzu.exe
  2⤵
  PID:10852
- C:\Windows\System\qtpgHdi.exe
  C:\Windows\System\qtpgHdi.exe
  2⤵
  PID:10872
- C:\Windows\System\qyXOXSl.exe
  C:\Windows\System\qyXOXSl.exe
  2⤵
  PID:10900
- C:\Windows\System\aWCMEUS.exe
  C:\Windows\System\aWCMEUS.exe
  2⤵
  PID:10916
- C:\Windows\System\KWfxejt.exe
  C:\Windows\System\KWfxejt.exe
  2⤵
  PID:10940
- C:\Windows\System\FUGfjdg.exe
  C:\Windows\System\FUGfjdg.exe
  2⤵
  PID:10960
- C:\Windows\System\qHStDtM.exe
  C:\Windows\System\qHStDtM.exe
  2⤵
  PID:10984
- C:\Windows\System\xwcRaxB.exe
  C:\Windows\System\xwcRaxB.exe
  2⤵
  PID:11000
- C:\Windows\System\TmuwJrc.exe
  C:\Windows\System\TmuwJrc.exe
  2⤵
  PID:11020
- C:\Windows\System\wQNRTcl.exe
  C:\Windows\System\wQNRTcl.exe
  2⤵
  PID:11040
- C:\Windows\System\WQdzUOU.exe
  C:\Windows\System\WQdzUOU.exe
  2⤵
  PID:11064
- C:\Windows\System\IEzDhga.exe
  C:\Windows\System\IEzDhga.exe
  2⤵
  PID:11084
- C:\Windows\System\DMiwIjC.exe
  C:\Windows\System\DMiwIjC.exe
  2⤵
  PID:11104
- C:\Windows\System\HSGPoNZ.exe
  C:\Windows\System\HSGPoNZ.exe
  2⤵
  PID:11128
- C:\Windows\System\MhOJRDG.exe
  C:\Windows\System\MhOJRDG.exe
  2⤵
  PID:11152
- C:\Windows\System\IfEXVuB.exe
  C:\Windows\System\IfEXVuB.exe
  2⤵
  PID:11168
- C:\Windows\System\GpbaTfm.exe
  C:\Windows\System\GpbaTfm.exe
  2⤵
  PID:11188
- C:\Windows\System\SRtbtLJ.exe
  C:\Windows\System\SRtbtLJ.exe
  2⤵
  PID:11208
- C:\Windows\System\cHRcAsm.exe
  C:\Windows\System\cHRcAsm.exe
  2⤵
  PID:11224
- C:\Windows\System\zYeOmZQ.exe
  C:\Windows\System\zYeOmZQ.exe
  2⤵
  PID:11244
- C:\Windows\System\LeRnWPp.exe
  C:\Windows\System\LeRnWPp.exe
  2⤵
  PID:9720
- C:\Windows\System\xTjyYrf.exe
  C:\Windows\System\xTjyYrf.exe
  2⤵
  PID:8808
- C:\Windows\System\tcFNORm.exe
  C:\Windows\System\tcFNORm.exe
  2⤵
  PID:9736
- C:\Windows\System\rJyxdrt.exe
  C:\Windows\System\rJyxdrt.exe
  2⤵
  PID:8128
- C:\Windows\System\hFlnoYo.exe
  C:\Windows\System\hFlnoYo.exe
  2⤵
  PID:8872
- C:\Windows\System\vBBhipK.exe
  C:\Windows\System\vBBhipK.exe
  2⤵
  PID:8900
- C:\Windows\System\KpBokbb.exe
  C:\Windows\System\KpBokbb.exe
  2⤵
  PID:8928
- C:\Windows\System\OfmnNpe.exe
  C:\Windows\System\OfmnNpe.exe
  2⤵
  PID:4276
- C:\Windows\System\obmCLWc.exe
  C:\Windows\System\obmCLWc.exe
  2⤵
  PID:9996
- C:\Windows\System\OGMsaRB.exe
  C:\Windows\System\OGMsaRB.exe
  2⤵
  PID:8764
- C:\Windows\System\MIJiHVF.exe
  C:\Windows\System\MIJiHVF.exe
  2⤵
  PID:8208
- C:\Windows\System\qozxWRV.exe
  C:\Windows\System\qozxWRV.exe
  2⤵
  PID:10076
- C:\Windows\System\XzWblpM.exe
  C:\Windows\System\XzWblpM.exe
  2⤵
  PID:10124
- C:\Windows\System\oEzdcDY.exe
  C:\Windows\System\oEzdcDY.exe
  2⤵
  PID:9052
- C:\Windows\System\uUznSwY.exe
  C:\Windows\System\uUznSwY.exe
  2⤵
  PID:9100
- C:\Windows\System\NfaeoPe.exe
  C:\Windows\System\NfaeoPe.exe
  2⤵
  PID:9124
- C:\Windows\System\OqTYDlv.exe
  C:\Windows\System\OqTYDlv.exe
  2⤵
  PID:9348
- C:\Windows\System\sNqSSFj.exe
  C:\Windows\System\sNqSSFj.exe
  2⤵
  PID:9396
- C:\Windows\System\lavzEpT.exe
  C:\Windows\System\lavzEpT.exe
  2⤵
  PID:8344
- C:\Windows\System\IrMlBZT.exe
  C:\Windows\System\IrMlBZT.exe
  2⤵
  PID:8812
- C:\Windows\System\cdfDrST.exe
  C:\Windows\System\cdfDrST.exe
  2⤵
  PID:9272
- C:\Windows\System\CjgkeqA.exe
  C:\Windows\System\CjgkeqA.exe
  2⤵
  PID:9448
- C:\Windows\System\tdiWvPw.exe
  C:\Windows\System\tdiWvPw.exe
  2⤵
  PID:4736
- C:\Windows\System\EqifXNr.exe
  C:\Windows\System\EqifXNr.exe
  2⤵
  PID:10248
- C:\Windows\System\SKnEhXh.exe
  C:\Windows\System\SKnEhXh.exe
  2⤵
  PID:11284
- C:\Windows\System\pomQXxp.exe
  C:\Windows\System\pomQXxp.exe
  2⤵
  PID:11312
- C:\Windows\System\RrYjYhQ.exe
  C:\Windows\System\RrYjYhQ.exe
  2⤵
  PID:11332
- C:\Windows\System\TvruLEh.exe
  C:\Windows\System\TvruLEh.exe
  2⤵
  PID:11352
- C:\Windows\System\qXSZdaU.exe
  C:\Windows\System\qXSZdaU.exe
  2⤵
  PID:11368
- C:\Windows\System\EFDlPCG.exe
  C:\Windows\System\EFDlPCG.exe
  2⤵
  PID:11392
- C:\Windows\System\kiUXokc.exe
  C:\Windows\System\kiUXokc.exe
  2⤵
  PID:11412
- C:\Windows\System\APyXKaz.exe
  C:\Windows\System\APyXKaz.exe
  2⤵
  PID:11432
- C:\Windows\System\VjGfFLA.exe
  C:\Windows\System\VjGfFLA.exe
  2⤵
  PID:11456
- C:\Windows\System\ofpmsYw.exe
  C:\Windows\System\ofpmsYw.exe
  2⤵
  PID:11480
- C:\Windows\System\HcYaYCC.exe
  C:\Windows\System\HcYaYCC.exe
  2⤵
  PID:11500
- C:\Windows\System\vnzOebT.exe
  C:\Windows\System\vnzOebT.exe
  2⤵
  PID:11524
- C:\Windows\System\eyBtQpt.exe
  C:\Windows\System\eyBtQpt.exe
  2⤵
  PID:11552
- C:\Windows\System\vOypkyK.exe
  C:\Windows\System\vOypkyK.exe
  2⤵
  PID:11576
- C:\Windows\System\RGrjytP.exe
  C:\Windows\System\RGrjytP.exe
  2⤵
  PID:11592
- C:\Windows\System\KCLRcbo.exe
  C:\Windows\System\KCLRcbo.exe
  2⤵
  PID:11620
- C:\Windows\System\MhBiUeL.exe
  C:\Windows\System\MhBiUeL.exe
  2⤵
  PID:11636
- C:\Windows\System\ROugXgY.exe
  C:\Windows\System\ROugXgY.exe
  2⤵
  PID:11656
- C:\Windows\System\AYBkSdE.exe
  C:\Windows\System\AYBkSdE.exe
  2⤵
  PID:11676
- C:\Windows\System\SUyrtqt.exe
  C:\Windows\System\SUyrtqt.exe
  2⤵
  PID:11692
- C:\Windows\System\eXyiAnW.exe
  C:\Windows\System\eXyiAnW.exe
  2⤵
  PID:11708
- C:\Windows\System\qyFNswE.exe
  C:\Windows\System\qyFNswE.exe
  2⤵
  PID:11724
- C:\Windows\System\kUpmmBl.exe
  C:\Windows\System\kUpmmBl.exe
  2⤵
  PID:11744
- C:\Windows\System\AGhxyHg.exe
  C:\Windows\System\AGhxyHg.exe
  2⤵
  PID:11768
- C:\Windows\System\NxqJufj.exe
  C:\Windows\System\NxqJufj.exe
  2⤵
  PID:11792
- C:\Windows\System\UlIMRaz.exe
  C:\Windows\System\UlIMRaz.exe
  2⤵
  PID:11816
- C:\Windows\System\OpSpyin.exe
  C:\Windows\System\OpSpyin.exe
  2⤵
  PID:11832
- C:\Windows\System\oLNAzOT.exe
  C:\Windows\System\oLNAzOT.exe
  2⤵
  PID:11856
- C:\Windows\System\TRriXmb.exe
  C:\Windows\System\TRriXmb.exe
  2⤵
  PID:11876
- C:\Windows\System\NUIXhum.exe
  C:\Windows\System\NUIXhum.exe
  2⤵
  PID:11892
- C:\Windows\System\sqsZqNs.exe
  C:\Windows\System\sqsZqNs.exe
  2⤵
  PID:11916
- C:\Windows\System\vIrmKbt.exe
  C:\Windows\System\vIrmKbt.exe
  2⤵
  PID:11940
- C:\Windows\System\IopHZQG.exe
  C:\Windows\System\IopHZQG.exe
  2⤵
  PID:11960
- C:\Windows\System\OHoAXqz.exe
  C:\Windows\System\OHoAXqz.exe
  2⤵
  PID:11984
- C:\Windows\System\uNUXTSy.exe
  C:\Windows\System\uNUXTSy.exe
  2⤵
  PID:12008
- C:\Windows\System\miarWIH.exe
  C:\Windows\System\miarWIH.exe
  2⤵
  PID:12024
- C:\Windows\System\yGdUdPI.exe
  C:\Windows\System\yGdUdPI.exe
  2⤵
  PID:12040
- C:\Windows\System\Azjohjg.exe
  C:\Windows\System\Azjohjg.exe
  2⤵
  PID:12060
- C:\Windows\System\kSINqRR.exe
  C:\Windows\System\kSINqRR.exe
  2⤵
  PID:12080
- C:\Windows\System\bNLaRKX.exe
  C:\Windows\System\bNLaRKX.exe
  2⤵
  PID:12104
- C:\Windows\System\PcNbwHC.exe
  C:\Windows\System\PcNbwHC.exe
  2⤵
  PID:12124
- C:\Windows\System\bsUmCyP.exe
  C:\Windows\System\bsUmCyP.exe
  2⤵
  PID:12144
- C:\Windows\System\yysEBhe.exe
  C:\Windows\System\yysEBhe.exe
  2⤵
  PID:12168
- C:\Windows\System\pPDxoUZ.exe
  C:\Windows\System\pPDxoUZ.exe
  2⤵
  PID:12184
- C:\Windows\System\kSWoLtB.exe
  C:\Windows\System\kSWoLtB.exe
  2⤵
  PID:12204
- C:\Windows\System\VTaAgOE.exe
  C:\Windows\System\VTaAgOE.exe
  2⤵
  PID:12232
- C:\Windows\System\ovMpxjm.exe
  C:\Windows\System\ovMpxjm.exe
  2⤵
  PID:12248
- C:\Windows\System\LagZlEh.exe
  C:\Windows\System\LagZlEh.exe
  2⤵
  PID:12272
- C:\Windows\System\NROqNZf.exe
  C:\Windows\System\NROqNZf.exe
  2⤵
  PID:6332
- C:\Windows\System\hgptfFi.exe
  C:\Windows\System\hgptfFi.exe
  2⤵
  PID:9844
- C:\Windows\System\HmBmcPZ.exe
  C:\Windows\System\HmBmcPZ.exe
  2⤵
  PID:7260
- C:\Windows\System\KdzVolt.exe
  C:\Windows\System\KdzVolt.exe
  2⤵
  PID:10460
- C:\Windows\System\uaEjCZR.exe
  C:\Windows\System\uaEjCZR.exe
  2⤵
  PID:10508
- C:\Windows\System\UBEUaWM.exe
  C:\Windows\System\UBEUaWM.exe
  2⤵
  PID:10596
- C:\Windows\System\BmJGOsO.exe
  C:\Windows\System\BmJGOsO.exe
  2⤵
  PID:10636
- C:\Windows\System\OCcwGGo.exe
  C:\Windows\System\OCcwGGo.exe
  2⤵
  PID:7920
- C:\Windows\System\QDtpKIQ.exe
  C:\Windows\System\QDtpKIQ.exe
  2⤵
  PID:10792
- C:\Windows\System\OsjsUDb.exe
  C:\Windows\System\OsjsUDb.exe
  2⤵
  PID:10888
- C:\Windows\System\OZJrSfo.exe
  C:\Windows\System\OZJrSfo.exe
  2⤵
  PID:8296
- C:\Windows\System\wvapzwX.exe
  C:\Windows\System\wvapzwX.exe
  2⤵
  PID:10992
- C:\Windows\System\daPUTHQ.exe
  C:\Windows\System\daPUTHQ.exe
  2⤵
  PID:11048
- C:\Windows\System\xmFCbjE.exe
  C:\Windows\System\xmFCbjE.exe
  2⤵
  PID:9256
- C:\Windows\System\AVbRlks.exe
  C:\Windows\System\AVbRlks.exe
  2⤵
  PID:9304
- C:\Windows\System\dGYeaSM.exe
  C:\Windows\System\dGYeaSM.exe
  2⤵
  PID:9368
- C:\Windows\System\qXGiUWm.exe
  C:\Windows\System\qXGiUWm.exe
  2⤵
  PID:9416
- C:\Windows\System\dmNnXtW.exe
  C:\Windows\System\dmNnXtW.exe
  2⤵
  PID:9716
- C:\Windows\System\uPrCLrl.exe
  C:\Windows\System\uPrCLrl.exe
  2⤵
  PID:8648
- C:\Windows\System\swEmTwX.exe
  C:\Windows\System\swEmTwX.exe
  2⤵
  PID:7620
- C:\Windows\System\kvbpTHC.exe
  C:\Windows\System\kvbpTHC.exe
  2⤵
  PID:2712
- C:\Windows\System\FStwILG.exe
  C:\Windows\System\FStwILG.exe
  2⤵
  PID:9532
- C:\Windows\System\DJImzhJ.exe
  C:\Windows\System\DJImzhJ.exe
  2⤵
  PID:12308
- C:\Windows\System\QijAxez.exe
  C:\Windows\System\QijAxez.exe
  2⤵
  PID:12328
- C:\Windows\System\bTgbOVo.exe
  C:\Windows\System\bTgbOVo.exe
  2⤵
  PID:12352
- C:\Windows\System\BzNHPKk.exe
  C:\Windows\System\BzNHPKk.exe
  2⤵
  PID:12368
- C:\Windows\System\yDIgZwc.exe
  C:\Windows\System\yDIgZwc.exe
  2⤵
  PID:12392
- C:\Windows\System\BdEhGYd.exe
  C:\Windows\System\BdEhGYd.exe
  2⤵
  PID:12412
- C:\Windows\System\igUexER.exe
  C:\Windows\System\igUexER.exe
  2⤵
  PID:12428
- C:\Windows\System\XemYqBf.exe
  C:\Windows\System\XemYqBf.exe
  2⤵
  PID:12448
- C:\Windows\System\pikVOfi.exe
  C:\Windows\System\pikVOfi.exe
  2⤵
  PID:12476
- C:\Windows\System\IavKGLZ.exe
  C:\Windows\System\IavKGLZ.exe
  2⤵
  PID:12496
- C:\Windows\System\tTtMWiA.exe
  C:\Windows\System\tTtMWiA.exe
  2⤵
  PID:12512
- C:\Windows\System\dZZgOpX.exe
  C:\Windows\System\dZZgOpX.exe
  2⤵
  PID:12536
- C:\Windows\System\JugUoug.exe
  C:\Windows\System\JugUoug.exe
  2⤵
  PID:12560
- C:\Windows\System\gXlAOtM.exe
  C:\Windows\System\gXlAOtM.exe
  2⤵
  PID:12584
- C:\Windows\System\AxYvdPs.exe
  C:\Windows\System\AxYvdPs.exe
  2⤵
  PID:12604
- C:\Windows\System\zbLaLtm.exe
  C:\Windows\System\zbLaLtm.exe
  2⤵
  PID:12624
- C:\Windows\System\vmILmWU.exe
  C:\Windows\System\vmILmWU.exe
  2⤵
  PID:12640
- C:\Windows\System\scnAQui.exe
  C:\Windows\System\scnAQui.exe
  2⤵
  PID:12664
- C:\Windows\System\lnHKbAI.exe
  C:\Windows\System\lnHKbAI.exe
  2⤵
  PID:12684
- C:\Windows\System\hnRPKXL.exe
  C:\Windows\System\hnRPKXL.exe
  2⤵
  PID:12700
- C:\Windows\System\AiCQmqv.exe
  C:\Windows\System\AiCQmqv.exe
  2⤵
  PID:12716
- C:\Windows\System\ouXqKWh.exe
  C:\Windows\System\ouXqKWh.exe
  2⤵
  PID:12732
- C:\Windows\System\ZnYxMhX.exe
  C:\Windows\System\ZnYxMhX.exe
  2⤵
  PID:12748
- C:\Windows\System\DDHAGgK.exe
  C:\Windows\System\DDHAGgK.exe
  2⤵
  PID:13064
- C:\Windows\System\LRLCYkE.exe
  C:\Windows\System\LRLCYkE.exe
  2⤵
  PID:13192
- C:\Windows\System\pAUEaRT.exe
  C:\Windows\System\pAUEaRT.exe
  2⤵
  PID:9572
- C:\Windows\System\XTWoBif.exe
  C:\Windows\System\XTWoBif.exe
  2⤵
  PID:9756
- C:\Windows\System\uHgYOYH.exe
  C:\Windows\System\uHgYOYH.exe
  2⤵
  PID:9132
- C:\Windows\System\SMCJpSO.exe
  C:\Windows\System\SMCJpSO.exe
  2⤵
  PID:9252
- C:\Windows\System\kXPuHpn.exe
  C:\Windows\System\kXPuHpn.exe
  2⤵
  PID:5852
- C:\Windows\System\fGCHJYx.exe
  C:\Windows\System\fGCHJYx.exe
  2⤵
  PID:8912
- C:\Windows\System\RjXOYqK.exe
  C:\Windows\System\RjXOYqK.exe
  2⤵
  PID:9464
- C:\Windows\System\AxTggCe.exe
  C:\Windows\System\AxTggCe.exe
  2⤵
  PID:8552
- C:\Windows\System\WweChLX.exe
  C:\Windows\System\WweChLX.exe
  2⤵
  PID:12324
- C:\Windows\System\iNFFeKG.exe
  C:\Windows\System\iNFFeKG.exe
  2⤵
  PID:12360
- C:\Windows\System\oKirMSN.exe
  C:\Windows\System\oKirMSN.exe
  2⤵
  PID:4996
- C:\Windows\System\VGTfWVY.exe
  C:\Windows\System\VGTfWVY.exe
  2⤵
  PID:4700
- C:\Windows\System\VYXWYdv.exe
  C:\Windows\System\VYXWYdv.exe
  2⤵
  PID:8716
- C:\Windows\System\hlQvdGe.exe
  C:\Windows\System\hlQvdGe.exe
  2⤵
  PID:8732
- C:\Windows\System\xPGWoRP.exe
  C:\Windows\System\xPGWoRP.exe
  2⤵
  PID:12620
- C:\Windows\System\YQQGvHw.exe
  C:\Windows\System\YQQGvHw.exe
  2⤵
  PID:12660
- C:\Windows\System\MPEWgfS.exe
  C:\Windows\System\MPEWgfS.exe
  2⤵
  PID:12112
- C:\Windows\System\hUsIIvC.exe
  C:\Windows\System\hUsIIvC.exe
  2⤵
  PID:12728
- C:\Windows\System\xMzutck.exe
  C:\Windows\System\xMzutck.exe
  2⤵
  PID:12968
- C:\Windows\System\NWHoBca.exe
  C:\Windows\System\NWHoBca.exe
  2⤵
  PID:12996
- C:\Windows\System\hwiuOdE.exe
  C:\Windows\System\hwiuOdE.exe
  2⤵
  PID:12880
- C:\Windows\System\irAmiap.exe
  C:\Windows\System\irAmiap.exe
  2⤵
  PID:12832
- C:\Windows\System\feQvOcY.exe
  C:\Windows\System\feQvOcY.exe
  2⤵
  PID:12804
- C:\Windows\System\VokvqxL.exe
  C:\Windows\System\VokvqxL.exe
  2⤵
  PID:12788
- C:\Windows\System\Erjzkyw.exe
  C:\Windows\System\Erjzkyw.exe
  2⤵
  PID:12764
- C:\Windows\System\JlPbLtl.exe
  C:\Windows\System\JlPbLtl.exe
  2⤵
  PID:12648
- C:\Windows\System\lCdifJz.exe
  C:\Windows\System\lCdifJz.exe
  2⤵
  PID:12576
- C:\Windows\System\hrcTPKL.exe
  C:\Windows\System\hrcTPKL.exe
  2⤵
  PID:12504
- C:\Windows\System\yMWhTyA.exe
  C:\Windows\System\yMWhTyA.exe
  2⤵
  PID:12464
- C:\Windows\System\EOmWNVH.exe
  C:\Windows\System\EOmWNVH.exe
  2⤵
  PID:12376
- C:\Windows\System\ynqYuOD.exe
  C:\Windows\System\ynqYuOD.exe
  2⤵
  PID:12300
- C:\Windows\System\GYkDzjB.exe
  C:\Windows\System\GYkDzjB.exe
  2⤵
  PID:8272
- C:\Windows\System\soyAvql.exe
  C:\Windows\System\soyAvql.exe
  2⤵
  PID:9432
- C:\Windows\System\zMDBEOC.exe
  C:\Windows\System\zMDBEOC.exe
  2⤵
  PID:9332
- C:\Windows\System\belNEQo.exe
  C:\Windows\System\belNEQo.exe
  2⤵
  PID:10884
- C:\Windows\System\UWyqnaY.exe
  C:\Windows\System\UWyqnaY.exe
  2⤵
  PID:10632
- C:\Windows\System\SoivqLY.exe
  C:\Windows\System\SoivqLY.exe
  2⤵
  PID:8256
- C:\Windows\System\atVOeHr.exe
  C:\Windows\System\atVOeHr.exe
  2⤵
  PID:9932
- C:\Windows\System\gxQCVGf.exe
  C:\Windows\System\gxQCVGf.exe
  2⤵
  PID:12280
- C:\Windows\System\ZstoTPN.exe
  C:\Windows\System\ZstoTPN.exe
  2⤵
  PID:12152
- C:\Windows\System\IUIaTcO.exe
  C:\Windows\System\IUIaTcO.exe
  2⤵
  PID:11972
- C:\Windows\System\hsLeyaz.exe
  C:\Windows\System\hsLeyaz.exe
  2⤵
  PID:11936
- C:\Windows\System\CZwvHfN.exe
  C:\Windows\System\CZwvHfN.exe
  2⤵
  PID:11900
- C:\Windows\System\uxRejeZ.exe
  C:\Windows\System\uxRejeZ.exe
  2⤵
  PID:11784
- C:\Windows\System\UlFeDhi.exe
  C:\Windows\System\UlFeDhi.exe
  2⤵
  PID:11684
- C:\Windows\System\YRRrRSk.exe
  C:\Windows\System\YRRrRSk.exe
  2⤵
  PID:11628
- C:\Windows\System\GeKmjHY.exe
  C:\Windows\System\GeKmjHY.exe
  2⤵
  PID:11584
- C:\Windows\System\lgirMXe.exe
  C:\Windows\System\lgirMXe.exe
  2⤵
  PID:11472
- C:\Windows\System\kORWcbA.exe
  C:\Windows\System\kORWcbA.exe
  2⤵
  PID:11448
- C:\Windows\System\BMsGjvh.exe
  C:\Windows\System\BMsGjvh.exe
  2⤵
  PID:11304
- C:\Windows\System\bevcWnV.exe
  C:\Windows\System\bevcWnV.exe
  2⤵
  PID:9184
- C:\Windows\System\vaQZvZK.exe
  C:\Windows\System\vaQZvZK.exe
  2⤵
  PID:7172
- C:\Windows\System\zrWPVjk.exe
  C:\Windows\System\zrWPVjk.exe
  2⤵
  PID:8580
- C:\Windows\System\CqKunUB.exe
  C:\Windows\System\CqKunUB.exe
  2⤵
  PID:9020
- C:\Windows\System\JDfsGGa.exe
  C:\Windows\System\JDfsGGa.exe
  2⤵
  PID:8492
- C:\Windows\System\RIyilSh.exe
  C:\Windows\System\RIyilSh.exe
  2⤵
  PID:8848
- C:\Windows\System\wPvwoKm.exe
  C:\Windows\System\wPvwoKm.exe
  2⤵
  PID:11236
- C:\Windows\System\IhGAApa.exe
  C:\Windows\System\IhGAApa.exe
  2⤵
  PID:11176
- C:\Windows\System\McdVKNT.exe
  C:\Windows\System\McdVKNT.exe
  2⤵
  PID:11112
- C:\Windows\System\kRYaeRl.exe
  C:\Windows\System\kRYaeRl.exe
  2⤵
  PID:11072
- C:\Windows\System\CRiPGBD.exe
  C:\Windows\System\CRiPGBD.exe
  2⤵
  PID:10972
- C:\Windows\System\gaXSOjv.exe
  C:\Windows\System\gaXSOjv.exe
  2⤵
  PID:10100
- C:\Windows\System\tvcWXrl.exe
  C:\Windows\System\tvcWXrl.exe
  2⤵
  PID:13088
- C:\Windows\System\yZhovMx.exe
  C:\Windows\System\yZhovMx.exe
  2⤵
  PID:13204
- C:\Windows\System\oMWmbit.exe
  C:\Windows\System\oMWmbit.exe
  2⤵
  PID:13212
- C:\Windows\System\CWogymI.exe
  C:\Windows\System\CWogymI.exe
  2⤵
  PID:3108
- C:\Windows\System\bvgBvpb.exe
  C:\Windows\System\bvgBvpb.exe
  2⤵
  PID:13296
- C:\Windows\System\iAZjtcK.exe
  C:\Windows\System\iAZjtcK.exe
  2⤵
  PID:9988
- C:\Windows\System\lQJseat.exe
  C:\Windows\System\lQJseat.exe
  2⤵
  PID:8468
- C:\Windows\System\fVwwoVO.exe
  C:\Windows\System\fVwwoVO.exe
  2⤵
  PID:11320
- C:\Windows\System\QXebfuw.exe
  C:\Windows\System\QXebfuw.exe
  2⤵
  PID:12020
- C:\Windows\System\DjjpMGd.exe
  C:\Windows\System\DjjpMGd.exe
  2⤵
  PID:13040
- C:\Windows\System\nldEawo.exe
  C:\Windows\System\nldEawo.exe
  2⤵
  PID:9544
- C:\Windows\System\xCptkwZ.exe
  C:\Windows\System\xCptkwZ.exe
  2⤵
  PID:13116
- C:\Windows\System\YNcTlRA.exe
  C:\Windows\System\YNcTlRA.exe
  2⤵
  PID:9860
- C:\Windows\System\igdTfJx.exe
  C:\Windows\System\igdTfJx.exe
  2⤵
  PID:13124
- C:\Windows\System\JbYnDnm.exe
  C:\Windows\System\JbYnDnm.exe
  2⤵
  PID:13156
- C:\Windows\System\hAfkIfP.exe
  C:\Windows\System\hAfkIfP.exe
  2⤵
  PID:11496
- C:\Windows\System\jVJxGzI.exe
  C:\Windows\System\jVJxGzI.exe
  2⤵
  PID:12052
- C:\Windows\System\CFnvCCb.exe
  C:\Windows\System\CFnvCCb.exe
  2⤵
  PID:13184
- C:\Windows\System\hPGyRvX.exe
  C:\Windows\System\hPGyRvX.exe
  2⤵
  PID:13260
- C:\Windows\System\nxSpoRS.exe
  C:\Windows\System\nxSpoRS.exe
  2⤵
  PID:13240
- C:\Windows\System\pFodiZk.exe
  C:\Windows\System\pFodiZk.exe
  2⤵
  PID:13272
- C:\Windows\System\IEdzjjw.exe
  C:\Windows\System\IEdzjjw.exe
  2⤵
  PID:13288
- C:\Windows\System\jmIXoZf.exe
  C:\Windows\System\jmIXoZf.exe
  2⤵
  PID:9656
- C:\Windows\System\YcbMYcU.exe
  C:\Windows\System\YcbMYcU.exe
  2⤵
  PID:9832
- C:\Windows\System\KmpHaOm.exe
  C:\Windows\System\KmpHaOm.exe
  2⤵
  PID:11376
- C:\Windows\System\AEWQemV.exe
  C:\Windows\System\AEWQemV.exe
  2⤵
  PID:10404
- C:\Windows\System\mejhmAS.exe
  C:\Windows\System\mejhmAS.exe
  2⤵
  PID:12380
- C:\Windows\System\uSXNHBl.exe
  C:\Windows\System\uSXNHBl.exe
  2⤵
  PID:9072
- C:\Windows\System\AWxxDsI.exe
  C:\Windows\System\AWxxDsI.exe
  2⤵
  PID:10808
- C:\Windows\System\EgoATTL.exe
  C:\Windows\System\EgoATTL.exe
  2⤵
  PID:1464
- C:\Windows\System\hspBNcW.exe
  C:\Windows\System\hspBNcW.exe
  2⤵
  PID:10528
- C:\Windows\System\bdQQcsS.exe
  C:\Windows\System\bdQQcsS.exe
  2⤵
  PID:12100
- C:\Windows\System\jlLhPNj.exe
  C:\Windows\System\jlLhPNj.exe
  2⤵
  PID:10760
- C:\Windows\System\zqsTdCq.exe
  C:\Windows\System\zqsTdCq.exe
  2⤵
  PID:10440
- C:\Windows\System\rfxhrLE.exe
  C:\Windows\System\rfxhrLE.exe
  2⤵
  PID:9972
- C:\Windows\System\giPeDvQ.exe
  C:\Windows\System\giPeDvQ.exe
  2⤵
  PID:11564
- C:\Windows\System\sKSubHu.exe
  C:\Windows\System\sKSubHu.exe
  2⤵
  PID:12912
- C:\Windows\System\AWDxvto.exe
  C:\Windows\System\AWDxvto.exe
  2⤵
  PID:10084
- C:\Windows\System\cXvfcLS.exe
  C:\Windows\System\cXvfcLS.exe
  2⤵
  PID:12200
- C:\Windows\System\gmTakoq.exe
  C:\Windows\System\gmTakoq.exe
  2⤵
  PID:12264
- C:\Windows\System\BbfTTSO.exe
  C:\Windows\System\BbfTTSO.exe
  2⤵
  PID:11400
- C:\Windows\System\hgYLZXI.exe
  C:\Windows\System\hgYLZXI.exe
  2⤵
  PID:8540
- C:\Windows\System\VRKRJLr.exe
  C:\Windows\System\VRKRJLr.exe
  2⤵
  PID:10044
- C:\Windows\System\OKSUOXf.exe
  C:\Windows\System\OKSUOXf.exe
  2⤵
  PID:8792
- C:\Windows\System\OkKAQQe.exe
  C:\Windows\System\OkKAQQe.exe
  2⤵
  PID:9484
- C:\Windows\System\qesNXtc.exe
  C:\Windows\System\qesNXtc.exe
  2⤵
  PID:3404
- C:\Windows\System\HsrDyUI.exe
  C:\Windows\System\HsrDyUI.exe
  2⤵
  PID:8704
- C:\Windows\System\MpvNZhk.exe
  C:\Windows\System\MpvNZhk.exe
  2⤵
  PID:12692
- C:\Windows\System\wVfOiSc.exe
  C:\Windows\System\wVfOiSc.exe
  2⤵
  PID:9672
- C:\Windows\System\moakXuc.exe
  C:\Windows\System\moakXuc.exe
  2⤵
  PID:4168
- C:\Windows\System\HtHWwLP.exe
  C:\Windows\System\HtHWwLP.exe
  2⤵
  PID:11196
- C:\Windows\System\WtkzXGX.exe
  C:\Windows\System\WtkzXGX.exe
  2⤵
  PID:11360
- C:\Windows\System\sUWlVGm.exe
  C:\Windows\System\sUWlVGm.exe
  2⤵
  PID:10908
- C:\Windows\System\ChfKWuM.exe
  C:\Windows\System\ChfKWuM.exe
  2⤵
  PID:10576
- C:\Windows\System\eNcdZFc.exe
  C:\Windows\System\eNcdZFc.exe
  2⤵
  PID:6052
- C:\Windows\System\iBWzMJq.exe
  C:\Windows\System\iBWzMJq.exe
  2⤵
  PID:12928
- C:\Windows\System\yChvgNN.exe
  C:\Windows\System\yChvgNN.exe
  2⤵
  PID:13012
- C:\Windows\System\llYFCFL.exe
  C:\Windows\System\llYFCFL.exe
  2⤵
  PID:12548
- C:\Windows\System\qCVWvBM.exe
  C:\Windows\System\qCVWvBM.exe
  2⤵
  PID:9364
- C:\Windows\System\qbaUZgy.exe
  C:\Windows\System\qbaUZgy.exe
  2⤵
  PID:11948
- C:\Windows\System\pIxYHVj.exe
  C:\Windows\System\pIxYHVj.exe
  2⤵
  PID:11764
- C:\Windows\System\yAcJMtR.exe
  C:\Windows\System\yAcJMtR.exe
  2⤵
  PID:13252
- C:\Windows\System\XMuDUnb.exe
  C:\Windows\System\XMuDUnb.exe
  2⤵
  PID:9624
- C:\Windows\System\nJbJOsG.exe
  C:\Windows\System\nJbJOsG.exe
  2⤵
  PID:11388
- C:\Windows\System\OBkACEs.exe
  C:\Windows\System\OBkACEs.exe
  2⤵
  PID:13144
- C:\Windows\System\RPacFbB.exe
  C:\Windows\System\RPacFbB.exe
  2⤵
  PID:13168
- C:\Windows\System\BttKSKi.exe
  C:\Windows\System\BttKSKi.exe
  2⤵
  PID:11364
- C:\Windows\System\hIBwRUs.exe
  C:\Windows\System\hIBwRUs.exe
  2⤵
  PID:13336
- C:\Windows\System\NhkgonZ.exe
  C:\Windows\System\NhkgonZ.exe
  2⤵
  PID:13360
- C:\Windows\System\mYZTqRp.exe
  C:\Windows\System\mYZTqRp.exe
  2⤵
  PID:13384
- C:\Windows\System\YBpbONr.exe
  C:\Windows\System\YBpbONr.exe
  2⤵
  PID:13412
- C:\Windows\System\bEfvBiS.exe
  C:\Windows\System\bEfvBiS.exe
  2⤵
  PID:13436
- C:\Windows\System\bRdSIVV.exe
  C:\Windows\System\bRdSIVV.exe
  2⤵
  PID:13456
- C:\Windows\System\gAZCTNI.exe
  C:\Windows\System\gAZCTNI.exe
  2⤵
  PID:13484
- C:\Windows\System\kDRslVd.exe
  C:\Windows\System\kDRslVd.exe
  2⤵
  PID:13508
- C:\Windows\System\Cqbxxrl.exe
  C:\Windows\System\Cqbxxrl.exe
  2⤵
  PID:13536
- C:\Windows\System\GwwULSk.exe
  C:\Windows\System\GwwULSk.exe
  2⤵
  PID:13556
- C:\Windows\System\ssIpCcu.exe
  C:\Windows\System\ssIpCcu.exe
  2⤵
  PID:13576
- C:\Windows\System\zFTciWm.exe
  C:\Windows\System\zFTciWm.exe
  2⤵
  PID:13600
- C:\Windows\System\ZgEqRsT.exe
  C:\Windows\System\ZgEqRsT.exe
  2⤵
  PID:13620
- C:\Windows\System\BlJpWYk.exe
  C:\Windows\System\BlJpWYk.exe
  2⤵
  PID:13644
- C:\Windows\System\xBXkMvH.exe
  C:\Windows\System\xBXkMvH.exe
  2⤵
  PID:13668
- C:\Windows\System\WwMJwnc.exe
  C:\Windows\System\WwMJwnc.exe
  2⤵
  PID:13696
- C:\Windows\System\mFqzYtq.exe
  C:\Windows\System\mFqzYtq.exe
  2⤵
  PID:13724
- C:\Windows\System\OpfMnre.exe
  C:\Windows\System\OpfMnre.exe
  2⤵
  PID:13748
- C:\Windows\System\GInBceC.exe
  C:\Windows\System\GInBceC.exe
  2⤵
  PID:13768
- C:\Windows\System\vGKDdan.exe
  C:\Windows\System\vGKDdan.exe
  2⤵
  PID:13796
- C:\Windows\System\qBrfDhG.exe
  C:\Windows\System\qBrfDhG.exe
  2⤵
  PID:13812
- C:\Windows\System\RsnIGsb.exe
  C:\Windows\System\RsnIGsb.exe
  2⤵
  PID:13840
- C:\Windows\System\ozjFVAE.exe
  C:\Windows\System\ozjFVAE.exe
  2⤵
  PID:13864
- C:\Windows\System\YVccWgr.exe
  C:\Windows\System\YVccWgr.exe
  2⤵
  PID:13888
- C:\Windows\System\ktfbCTu.exe
  C:\Windows\System\ktfbCTu.exe
  2⤵
  PID:13916
- C:\Windows\System\IpiRIQO.exe
  C:\Windows\System\IpiRIQO.exe
  2⤵
  PID:13940
- C:\Windows\System\cuwGYDs.exe
  C:\Windows\System\cuwGYDs.exe
  2⤵
  PID:13968
- C:\Windows\System\dfeqXWk.exe
  C:\Windows\System\dfeqXWk.exe
  2⤵
  PID:13984
- C:\Windows\System\WxeFgGx.exe
  C:\Windows\System\WxeFgGx.exe
  2⤵
  PID:14004
- C:\Windows\System\nIpnnoy.exe
  C:\Windows\System\nIpnnoy.exe
  2⤵
  PID:14028
- C:\Windows\System\lAYiAqH.exe
  C:\Windows\System\lAYiAqH.exe
  2⤵
  PID:9212
- C:\Windows\System\ZeTDQeJ.exe
  C:\Windows\System\ZeTDQeJ.exe
  2⤵
  PID:10952
- C:\Windows\System\mfMFBAL.exe
  C:\Windows\System\mfMFBAL.exe
  2⤵
  PID:12036
- C:\Windows\System\ifAiMrm.exe
  C:\Windows\System\ifAiMrm.exe
  2⤵
  PID:12768
- C:\Windows\System\qLfKwyt.exe
  C:\Windows\System\qLfKwyt.exe
  2⤵
  PID:11824
- C:\Windows\System\lLKrZGK.exe
  C:\Windows\System\lLKrZGK.exe
  2⤵
  PID:13876
- C:\Windows\System\HyKVjyf.exe
  C:\Windows\System\HyKVjyf.exe
  2⤵
  PID:13704
- C:\Windows\System\tpRyUId.exe
  C:\Windows\System\tpRyUId.exe
  2⤵
  PID:8880
- C:\Windows\System\uHbsakK.exe
  C:\Windows\System\uHbsakK.exe
  2⤵
  PID:2124
- C:\Windows\System\tqZApjn.exe
  C:\Windows\System\tqZApjn.exe
  2⤵
  PID:12956
- C:\Windows\System\pwJnPBZ.exe
  C:\Windows\System\pwJnPBZ.exe
  2⤵
  PID:13444
- C:\Windows\System\aVJGNJm.exe
  C:\Windows\System\aVJGNJm.exe
  2⤵
  PID:13120
- C:\Windows\System\tKJNpQT.exe
  C:\Windows\System\tKJNpQT.exe
  2⤵
  PID:14144
- C:\Windows\System\SxwydBT.exe
  C:\Windows\System\SxwydBT.exe
  2⤵
  PID:10980
- C:\Windows\System\mqsYSxs.exe
  C:\Windows\System\mqsYSxs.exe
  2⤵
  PID:13328
- C:\Windows\System\AFUTtFq.exe
  C:\Windows\System\AFUTtFq.exe
  2⤵
  PID:5012
- C:\Windows\System\wgOBPdK.exe
  C:\Windows\System\wgOBPdK.exe
  2⤵
  PID:884
- C:\Windows\System\LBLFAXy.exe
  C:\Windows\System\LBLFAXy.exe
  2⤵
  PID:4800
- C:\Windows\System\nRqwUCV.exe
  C:\Windows\System\nRqwUCV.exe
  2⤵
  PID:6676
- C:\Windows\System\wtkLcCw.exe
  C:\Windows\System\wtkLcCw.exe
  2⤵
  PID:14064
- C:\Windows\System\IOlKVay.exe
  C:\Windows\System\IOlKVay.exe
  2⤵
  PID:14276
- C:\Windows\System\akuciIx.exe
  C:\Windows\System\akuciIx.exe
  2⤵
  PID:3704
- C:\Windows\System\bLiXNTG.exe
  C:\Windows\System\bLiXNTG.exe
  2⤵
  PID:4464
- C:\Windows\System\XljrXEO.exe
  C:\Windows\System\XljrXEO.exe
  2⤵
  PID:14020
- C:\Windows\System\QcUbBtJ.exe
  C:\Windows\System\QcUbBtJ.exe
  2⤵
  PID:8340
- C:\Windows\System\SbxRZsx.exe
  C:\Windows\System\SbxRZsx.exe
  2⤵
  PID:11600
- C:\Windows\System\UhvssAU.exe
  C:\Windows\System\UhvssAU.exe
  2⤵
  PID:4100
- C:\Windows\System\jHNKgeF.exe
  C:\Windows\System\jHNKgeF.exe
  2⤵
  PID:5488
- C:\Windows\System\eNrrZPj.exe
  C:\Windows\System\eNrrZPj.exe
  2⤵
  PID:14048
- C:\Windows\System\zaplTDO.exe
  C:\Windows\System\zaplTDO.exe
  2⤵
  PID:13836
- C:\Windows\System\juMqWkS.exe
  C:\Windows\System\juMqWkS.exe
  2⤵
  PID:14312
- C:\Windows\System\WfmAWse.exe
  C:\Windows\System\WfmAWse.exe
  2⤵
  PID:14156
- C:\Windows\System\VRiRJow.exe
  C:\Windows\System\VRiRJow.exe
  2⤵
  PID:5232
- C:\Windows\System\YuXlsZq.exe
  C:\Windows\System\YuXlsZq.exe
  2⤵
  PID:13960
- C:\Windows\System\KHNmhHI.exe
  C:\Windows\System\KHNmhHI.exe
  2⤵
  PID:13332
- C:\Windows\System\xOxFwSi.exe
  C:\Windows\System\xOxFwSi.exe
  2⤵
  PID:1640
- C:\Windows\System\BYdTVNV.exe
  C:\Windows\System\BYdTVNV.exe
  2⤵
  PID:5076
- C:\Windows\System\afnKnOm.exe
  C:\Windows\System\afnKnOm.exe
  2⤵
  PID:9284
- C:\Windows\System\wpKafxk.exe
  C:\Windows\System\wpKafxk.exe
  2⤵
  PID:14200
- C:\Windows\System\YynTlxm.exe
  C:\Windows\System\YynTlxm.exe
  2⤵
  PID:10840
- C:\Windows\System\uBARRIf.exe
  C:\Windows\System\uBARRIf.exe
  2⤵
  PID:14300
- C:\Windows\System\nuSqGdk.exe
  C:\Windows\System\nuSqGdk.exe
  2⤵
  PID:448
- C:\Windows\System\YXVfUYY.exe
  C:\Windows\System\YXVfUYY.exe
  2⤵
  PID:13516
- C:\Windows\System\OybKUDA.exe
  C:\Windows\System\OybKUDA.exe
  2⤵
  PID:13788
- C:\Windows\System\SwWRbeD.exe
  C:\Windows\System\SwWRbeD.exe
  2⤵
  PID:10680
- C:\Windows\System\HfJzjyf.exe
  C:\Windows\System\HfJzjyf.exe
  2⤵
  PID:14180
- C:\Windows\System\JZtAuMk.exe
  C:\Windows\System\JZtAuMk.exe
  2⤵
  PID:780
- C:\Windows\System\CnFaMMQ.exe
  C:\Windows\System\CnFaMMQ.exe
  2⤵
  PID:14796
- C:\Windows\System\OzXLriR.exe
  C:\Windows\System\OzXLriR.exe
  2⤵
  PID:14860
- C:\Windows\System\drNIRag.exe
  C:\Windows\System\drNIRag.exe
  2⤵
  PID:14936
- C:\Windows\System\mOgXSau.exe
  C:\Windows\System\mOgXSau.exe
  2⤵
  PID:14956
- C:\Windows\System\pBnWxBE.exe
  C:\Windows\System\pBnWxBE.exe
  2⤵
  PID:14976
- C:\Windows\System\xYFqJlc.exe
  C:\Windows\System\xYFqJlc.exe
  2⤵
  PID:15064
- C:\Windows\System\gAamDOL.exe
  C:\Windows\System\gAamDOL.exe
  2⤵
  PID:15080
- C:\Windows\System\XkoOzhW.exe
  C:\Windows\System\XkoOzhW.exe
  2⤵
  PID:15096
- C:\Windows\System\fjwkgad.exe
  C:\Windows\System\fjwkgad.exe
  2⤵
  PID:15112
- C:\Windows\System\ZiujKci.exe
  C:\Windows\System\ZiujKci.exe
  2⤵
  PID:15128
- C:\Windows\System\TfbpWGR.exe
  C:\Windows\System\TfbpWGR.exe
  2⤵
  PID:15144
- C:\Windows\System\MTgPwWl.exe
  C:\Windows\System\MTgPwWl.exe
  2⤵
  PID:15164
- C:\Windows\System\BwMwybi.exe
  C:\Windows\System\BwMwybi.exe
  2⤵
  PID:15180
- C:\Windows\System\OjLtkFf.exe
  C:\Windows\System\OjLtkFf.exe
  2⤵
  PID:15204
- C:\Windows\System\eifrNMp.exe
  C:\Windows\System\eifrNMp.exe
  2⤵
  PID:15224
- C:\Windows\System\SxvjMdr.exe
  C:\Windows\System\SxvjMdr.exe
  2⤵
  PID:15252
- C:\Windows\System\SEJMNJX.exe
  C:\Windows\System\SEJMNJX.exe
  2⤵
  PID:15272
- C:\Windows\System\YQdSkTI.exe
  C:\Windows\System\YQdSkTI.exe
  2⤵
  PID:13368
- C:\Windows\System\mTRZTPU.exe
  C:\Windows\System\mTRZTPU.exe
  2⤵
  PID:14380
- C:\Windows\System\RaRsjxG.exe
  C:\Windows\System\RaRsjxG.exe
  2⤵
  PID:14188
- C:\Windows\System\agfWeYM.exe
  C:\Windows\System\agfWeYM.exe
  2⤵
  PID:3996
- C:\Windows\System\jYpAoGP.exe
  C:\Windows\System\jYpAoGP.exe
  2⤵
  PID:1528
- C:\Windows\System\DziQSag.exe
  C:\Windows\System\DziQSag.exe
  2⤵
  PID:13376
- C:\Windows\System\HXrufmA.exe
  C:\Windows\System\HXrufmA.exe
  2⤵
  PID:6952
- C:\Windows\System\idwYvDI.exe
  C:\Windows\System\idwYvDI.exe
  2⤵
  PID:14552
- C:\Windows\System\KFpCxNF.exe
  C:\Windows\System\KFpCxNF.exe
  2⤵
  PID:14540
- C:\Windows\System\LRgayTg.exe
  C:\Windows\System\LRgayTg.exe
  2⤵
  PID:2352
- C:\Windows\System\jtvNPcT.exe
  C:\Windows\System\jtvNPcT.exe
  2⤵
  PID:14776
- C:\Windows\System\nDRUOZT.exe
  C:\Windows\System\nDRUOZT.exe
  2⤵
  PID:14920
- C:\Windows\System\fGBarzR.exe
  C:\Windows\System\fGBarzR.exe
  2⤵
  PID:15028
- C:\Windows\System\UQFYvSi.exe
  C:\Windows\System\UQFYvSi.exe
  2⤵
  PID:15124
- C:\Windows\System\ntxGOPW.exe
  C:\Windows\System\ntxGOPW.exe
  2⤵
  PID:15348
- C:\Windows\System\jBxBOqb.exe
  C:\Windows\System\jBxBOqb.exe
  2⤵
  PID:1968
- C:\Windows\System\ZGyhtGQ.exe
  C:\Windows\System\ZGyhtGQ.exe
  2⤵
  PID:14408
- C:\Windows\System\CxnBUzn.exe
  C:\Windows\System\CxnBUzn.exe
  2⤵
  PID:14364
- C:\Windows\System\JvbSvpc.exe
  C:\Windows\System\JvbSvpc.exe
  2⤵
  PID:2484
- C:\Windows\System\oIrHHJb.exe
  C:\Windows\System\oIrHHJb.exe
  2⤵
  PID:14492
- C:\Windows\System\OFJrBVo.exe
  C:\Windows\System\OFJrBVo.exe
  2⤵
  PID:14600
- C:\Windows\System\CsPXduk.exe
  C:\Windows\System\CsPXduk.exe
  2⤵
  PID:3600
- C:\Windows\System\CcCzqFR.exe
  C:\Windows\System\CcCzqFR.exe
  2⤵
  PID:14812
- C:\Windows\System\kXcYvMY.exe
  C:\Windows\System\kXcYvMY.exe
  2⤵
  PID:14820
- C:\Windows\System\UpYqwZh.exe
  C:\Windows\System\UpYqwZh.exe
  2⤵
  PID:14620
- C:\Windows\System\sjdsuWF.exe
  C:\Windows\System\sjdsuWF.exe
  2⤵
  PID:14780
- C:\Windows\System\AfavcOa.exe
  C:\Windows\System\AfavcOa.exe
  2⤵
  PID:456
- C:\Windows\System\mKZCRQY.exe
  C:\Windows\System\mKZCRQY.exe
  2⤵
  PID:3592
- C:\Windows\System\YbBCRHY.exe
  C:\Windows\System\YbBCRHY.exe
  2⤵
  PID:14988
- C:\Windows\System\TrXshya.exe
  C:\Windows\System\TrXshya.exe
  2⤵
  PID:14680
- C:\Windows\System\jVvezsn.exe
  C:\Windows\System\jVvezsn.exe
  2⤵
  PID:15056
- C:\Windows\System\nWkmjrf.exe
  C:\Windows\System\nWkmjrf.exe
  2⤵
  PID:15288
- C:\Windows\System\SByPRBg.exe
  C:\Windows\System\SByPRBg.exe
  2⤵
  PID:15004
- C:\Windows\System\FvAZBpy.exe
  C:\Windows\System\FvAZBpy.exe
  2⤵
  PID:15260
- C:\Windows\System\qSkkNaL.exe
  C:\Windows\System\qSkkNaL.exe
  2⤵
  PID:3508
- C:\Windows\System\NfrrBOq.exe
  C:\Windows\System\NfrrBOq.exe
  2⤵
  PID:10704
- C:\Windows\System\wRMEdJS.exe
  C:\Windows\System\wRMEdJS.exe
  2⤵
  PID:6060
- C:\Windows\System\EaUyhQR.exe
  C:\Windows\System\EaUyhQR.exe
  2⤵
  PID:13504
- C:\Windows\System\jUHsnUY.exe
  C:\Windows\System\jUHsnUY.exe
  2⤵
  PID:3512
- C:\Windows\System\CBJmhDE.exe
  C:\Windows\System\CBJmhDE.exe
  2⤵
  PID:5656
- C:\Windows\System\UVdJzvb.exe
  C:\Windows\System\UVdJzvb.exe
  2⤵
  PID:2848
- C:\Windows\System\rLguMnX.exe
  C:\Windows\System\rLguMnX.exe
  2⤵
  PID:5300
- C:\Windows\System\Egonoem.exe
  C:\Windows\System\Egonoem.exe
  2⤵
  PID:12656
- C:\Windows\System\npcqhMl.exe
  C:\Windows\System\npcqhMl.exe
  2⤵
  PID:3064
- C:\Windows\System\sYQXDYO.exe
  C:\Windows\System\sYQXDYO.exe
  2⤵
  PID:3964
- C:\Windows\System\URIjIZj.exe
  C:\Windows\System\URIjIZj.exe
  2⤵
  PID:5524
- C:\Windows\System\QgWMMtK.exe
  C:\Windows\System\QgWMMtK.exe
  2⤵
  PID:5516
- C:\Windows\System\ddiHGdx.exe
  C:\Windows\System\ddiHGdx.exe
  2⤵
  PID:2140
- C:\Windows\System\TfBkYfj.exe
  C:\Windows\System\TfBkYfj.exe
  2⤵
  PID:11668
- C:\Windows\System\qVmGbvg.exe
  C:\Windows\System\qVmGbvg.exe
  2⤵
  PID:4312
- C:\Windows\System\RUtAMiy.exe
  C:\Windows\System\RUtAMiy.exe
  2⤵
  PID:5532
- C:\Windows\System\yijWGJx.exe
  C:\Windows\System\yijWGJx.exe
  2⤵
  PID:5548
- C:\Windows\System\dofmhQP.exe
  C:\Windows\System\dofmhQP.exe
  2⤵
  PID:14640
- C:\Windows\System\VTZfFEN.exe
  C:\Windows\System\VTZfFEN.exe
  2⤵
  PID:14672
- C:\Windows\System\mjDTzBX.exe
  C:\Windows\System\mjDTzBX.exe
  2⤵
  PID:14720
- C:\Windows\System\qyKmRUR.exe
  C:\Windows\System\qyKmRUR.exe
  2⤵
  PID:14880
- C:\Windows\System\yYexAjt.exe
  C:\Windows\System\yYexAjt.exe
  2⤵
  PID:6260
- C:\Windows\System\NNePOdo.exe
  C:\Windows\System\NNePOdo.exe
  2⤵
  PID:4936
- C:\Windows\System\OrfNMOp.exe
  C:\Windows\System\OrfNMOp.exe
  2⤵
  PID:14488
- C:\Windows\System\ZhLSAUt.exe
  C:\Windows\System\ZhLSAUt.exe
  2⤵
  PID:6396
- C:\Windows\System\XBsuJPD.exe
  C:\Windows\System\XBsuJPD.exe
  2⤵
  PID:4708
- C:\Windows\System\MwbpDpm.exe
  C:\Windows\System\MwbpDpm.exe
  2⤵
  PID:1828
- C:\Windows\System\sDGzHSX.exe
  C:\Windows\System\sDGzHSX.exe
  2⤵
  PID:15196
- C:\Windows\System\OZNQZlH.exe
  C:\Windows\System\OZNQZlH.exe
  2⤵
  PID:6316
- C:\Windows\System\zxXTKKh.exe
  C:\Windows\System\zxXTKKh.exe
  2⤵
  PID:4212
- C:\Windows\System\COKFWGk.exe
  C:\Windows\System\COKFWGk.exe
  2⤵
  PID:5396
- C:\Windows\System\xIeTlDr.exe
  C:\Windows\System\xIeTlDr.exe
  2⤵
  PID:840
- C:\Windows\System\YPHhbwE.exe
  C:\Windows\System\YPHhbwE.exe
  2⤵
  PID:7300
- C:\Windows\System\gVSUgBd.exe
  C:\Windows\System\gVSUgBd.exe
  2⤵
  PID:5144
- C:\Windows\System\lMGIqdn.exe
  C:\Windows\System\lMGIqdn.exe
  2⤵
  PID:6972
- C:\Windows\System\UmnhggI.exe
  C:\Windows\System\UmnhggI.exe
  2⤵
  PID:7012
- C:\Windows\System\CzAqDSe.exe
  C:\Windows\System\CzAqDSe.exe
  2⤵
  PID:11408
- C:\Windows\System\KfjLiDg.exe
  C:\Windows\System\KfjLiDg.exe
  2⤵
  PID:6640
- C:\Windows\System\JTMAJgR.exe
  C:\Windows\System\JTMAJgR.exe
  2⤵
  PID:5256
- C:\Windows\System\yIzBjwz.exe
  C:\Windows\System\yIzBjwz.exe
  2⤵
  PID:12016
- C:\Windows\System\ulGxKDv.exe
  C:\Windows\System\ulGxKDv.exe
  2⤵
  PID:12244
- C:\Windows\System\zGttBqQ.exe
  C:\Windows\System\zGttBqQ.exe
  2⤵
  PID:4960
- C:\Windows\System\gEOyjnN.exe
  C:\Windows\System\gEOyjnN.exe
  2⤵
  PID:14348
- C:\Windows\System\sgkVFnm.exe
  C:\Windows\System\sgkVFnm.exe
  2⤵
  PID:6352
- C:\Windows\System\yZbOURm.exe
  C:\Windows\System\yZbOURm.exe
  2⤵
  PID:14484
- C:\Windows\System\lGfgIjC.exe
  C:\Windows\System\lGfgIjC.exe
  2⤵
  PID:7504
- C:\Windows\System\UsukkQF.exe
  C:\Windows\System\UsukkQF.exe
  2⤵
  PID:6760
- C:\Windows\System\joxVGuP.exe
  C:\Windows\System\joxVGuP.exe
  2⤵
  PID:6800
- C:\Windows\System\kdpMAGm.exe
  C:\Windows\System\kdpMAGm.exe
  2⤵
  PID:7616
- C:\Windows\System\slynanH.exe
  C:\Windows\System\slynanH.exe
  2⤵
  PID:14632
- C:\Windows\System\DmvbtVH.exe
  C:\Windows\System\DmvbtVH.exe
  2⤵
  PID:4268
- C:\Windows\System\oIUVqcU.exe
  C:\Windows\System\oIUVqcU.exe
  2⤵
  PID:1624
- C:\Windows\System\pYKyYZQ.exe
  C:\Windows\System\pYKyYZQ.exe
  2⤵
  PID:14732
- C:\Windows\System\pWfFyBF.exe
  C:\Windows\System\pWfFyBF.exe
  2⤵
  PID:5016
- C:\Windows\System\ZqYBzJk.exe
  C:\Windows\System\ZqYBzJk.exe
  2⤵
  PID:4448
- C:\Windows\System\zycDEln.exe
  C:\Windows\System\zycDEln.exe
  2⤵
  PID:7820
- C:\Windows\System\zThugCN.exe
  C:\Windows\System\zThugCN.exe
  2⤵
  PID:4404
- C:\Windows\System\blxeGkW.exe
  C:\Windows\System\blxeGkW.exe
  2⤵
  PID:14872
- C:\Windows\System\bgjJjxZ.exe
  C:\Windows\System\bgjJjxZ.exe
  2⤵
  PID:5820
- C:\Windows\System\zNbYpDD.exe
  C:\Windows\System\zNbYpDD.exe
  2⤵
  PID:7956
- C:\Windows\System\ObMegli.exe
  C:\Windows\System\ObMegli.exe
  2⤵
  PID:6864
- C:\Windows\System\CWPAhja.exe
  C:\Windows\System\CWPAhja.exe
  2⤵
  PID:6420
- C:\Windows\System\IuYGqSW.exe
  C:\Windows\System\IuYGqSW.exe
  2⤵
  PID:10144
- C:\Windows\System\BBTZzON.exe
  C:\Windows\System\BBTZzON.exe
  2⤵
  PID:2960
- C:\Windows\System\tpQgWNA.exe
  C:\Windows\System\tpQgWNA.exe
  2⤵
  PID:8428
- C:\Windows\System\VzfHqbI.exe
  C:\Windows\System\VzfHqbI.exe
  2⤵
  PID:924
- C:\Windows\System\jTvJEIY.exe
  C:\Windows\System\jTvJEIY.exe
  2⤵
  PID:5260
- C:\Windows\System\VobCBaB.exe
  C:\Windows\System\VobCBaB.exe
  2⤵
  PID:6252
- C:\Windows\System\NiCnsVQ.exe
  C:\Windows\System\NiCnsVQ.exe
  2⤵
  PID:6884
- C:\Windows\System\TDPDYoq.exe
  C:\Windows\System\TDPDYoq.exe
  2⤵
  PID:476
- C:\Windows\System\pzWkIFW.exe
  C:\Windows\System\pzWkIFW.exe
  2⤵
  PID:9060
- C:\Windows\System\ceZZurX.exe
  C:\Windows\System\ceZZurX.exe
  2⤵
  PID:15172
- C:\Windows\System\uurWCJp.exe
  C:\Windows\System\uurWCJp.exe
  2⤵
  PID:13392
- C:\Windows\System\BAjXWrL.exe
  C:\Windows\System\BAjXWrL.exe
  2⤵
  PID:8852
- C:\Windows\System\oAJDLgV.exe
  C:\Windows\System\oAJDLgV.exe
  2⤵
  PID:8856
- C:\Windows\System\IDqRqTw.exe
  C:\Windows\System\IDqRqTw.exe
  2⤵
  PID:9584
- C:\Windows\System\LBWXalg.exe
  C:\Windows\System\LBWXalg.exe
  2⤵
  PID:9596
- C:\Windows\System\PXGXIiO.exe
  C:\Windows\System\PXGXIiO.exe
  2⤵
  PID:972
- C:\Windows\System\iycFmPL.exe
  C:\Windows\System\iycFmPL.exe
  2⤵
  PID:2336
- C:\Windows\System\UpZbwOi.exe
  C:\Windows\System\UpZbwOi.exe
  2⤵
  PID:8720
- C:\Windows\System\gGgVpNc.exe
  C:\Windows\System\gGgVpNc.exe
  2⤵
  PID:7136
- C:\Windows\System\qqmBmdp.exe
  C:\Windows\System\qqmBmdp.exe
  2⤵
  PID:6508
- C:\Windows\System\nNFYwkF.exe
  C:\Windows\System\nNFYwkF.exe
  2⤵
  PID:5328
- C:\Windows\System\PWYUYDV.exe
  C:\Windows\System\PWYUYDV.exe
  2⤵
  PID:9540
- C:\Windows\System\wYoANOy.exe
  C:\Windows\System\wYoANOy.exe
  2⤵
  PID:5308
- C:\Windows\System\NqGXqOL.exe
  C:\Windows\System\NqGXqOL.exe
  2⤵
  PID:10700
- C:\Windows\System\UFBxqVh.exe
  C:\Windows\System\UFBxqVh.exe
  2⤵
  PID:12544
- C:\Windows\System\uuAAnWu.exe
  C:\Windows\System\uuAAnWu.exe
  2⤵
  PID:6948
- C:\Windows\System\eEuZRST.exe
  C:\Windows\System\eEuZRST.exe
  2⤵
  PID:14436
- C:\Windows\System\krsTodq.exe
  C:\Windows\System\krsTodq.exe
  2⤵
  PID:14392
- C:\Windows\System\PfdtaaA.exe
  C:\Windows\System\PfdtaaA.exe
  2⤵
  PID:7556
- C:\Windows\System\PjKFMXp.exe
  C:\Windows\System\PjKFMXp.exe
  2⤵
  PID:11976
- C:\Windows\System\AcDSqaY.exe
  C:\Windows\System\AcDSqaY.exe
  2⤵
  PID:3936
- C:\Windows\System\spjTHoH.exe
  C:\Windows\System\spjTHoH.exe
  2⤵
  PID:5564
- C:\Windows\System\NNpeoTg.exe
  C:\Windows\System\NNpeoTg.exe
  2⤵
  PID:12048
- C:\Windows\System\zIeTMaf.exe
  C:\Windows\System\zIeTMaf.exe
  2⤵
  PID:11092
- C:\Windows\System\emZHOSU.exe
  C:\Windows\System\emZHOSU.exe
  2⤵
  PID:7652
- C:\Windows\System\tJXBCPS.exe
  C:\Windows\System\tJXBCPS.exe
  2⤵
  PID:5280
- C:\Windows\System\ZNFlXGv.exe
  C:\Windows\System\ZNFlXGv.exe
  2⤵
  PID:14916
- C:\Windows\System\mCCzvRR.exe
  C:\Windows\System\mCCzvRR.exe
  2⤵
  PID:12840
- C:\Windows\System\qkNopOW.exe
  C:\Windows\System\qkNopOW.exe
  2⤵
  PID:10468
- C:\Windows\System\fCuGyNp.exe
  C:\Windows\System\fCuGyNp.exe
  2⤵
  PID:12892
- C:\Windows\System\ucLwUFi.exe
  C:\Windows\System\ucLwUFi.exe
  2⤵
  PID:6256
- C:\Windows\System\TtMUHmM.exe
  C:\Windows\System\TtMUHmM.exe
  2⤵
  PID:8024
- C:\Windows\System\sdvRhgb.exe
  C:\Windows\System\sdvRhgb.exe
  2⤵
  PID:10616
- C:\Windows\System\RDApean.exe
  C:\Windows\System\RDApean.exe
  2⤵
  PID:8304
- C:\Windows\System\MhpNDxa.exe
  C:\Windows\System\MhpNDxa.exe
  2⤵
  PID:6436
- C:\Windows\System\nAdPyzS.exe
  C:\Windows\System\nAdPyzS.exe
  2⤵
  PID:5812
- C:\Windows\System\rfxIVEo.exe
  C:\Windows\System\rfxIVEo.exe
  2⤵
  PID:8668
- C:\Windows\System\pxvqRHV.exe
  C:\Windows\System\pxvqRHV.exe
  2⤵
  PID:15336
- C:\Windows\System\FXzKYIL.exe
  C:\Windows\System\FXzKYIL.exe
  2⤵
  PID:9172
- C:\Windows\System\CnDXKaC.exe
  C:\Windows\System\CnDXKaC.exe
  2⤵
  PID:9784
- C:\Windows\System\whPoaIu.exe
  C:\Windows\System\whPoaIu.exe
  2⤵
  PID:8196
- C:\Windows\System\TBfMvLs.exe
  C:\Windows\System\TBfMvLs.exe
  2⤵
  PID:6940
- C:\Windows\System\ykuZDBE.exe
  C:\Windows\System\ykuZDBE.exe
  2⤵
  PID:5780
- C:\Windows\System\FuottWu.exe
  C:\Windows\System\FuottWu.exe
  2⤵
  PID:8536
- C:\Windows\System\liMpSES.exe
  C:\Windows\System\liMpSES.exe
  2⤵
  PID:12580
- C:\Windows\System\LJrUvaA.exe
  C:\Windows\System\LJrUvaA.exe
  2⤵
  PID:9816
- C:\Windows\System\OfcdqHi.exe
  C:\Windows\System\OfcdqHi.exe
  2⤵
  PID:7104
- C:\Windows\System\NBBHpai.exe
  C:\Windows\System\NBBHpai.exe
  2⤵
  PID:10720
- C:\Windows\System\ZKPFagG.exe
  C:\Windows\System\ZKPFagG.exe
  2⤵
  PID:6552
- C:\Windows\System\dPUbHrV.exe
  C:\Windows\System\dPUbHrV.exe
  2⤵
  PID:9804
- C:\Windows\System\ptWcCFW.exe
  C:\Windows\System\ptWcCFW.exe
  2⤵
  PID:7524
- C:\Windows\System\UeEQNmu.exe
  C:\Windows\System\UeEQNmu.exe
  2⤵
  PID:2228
- C:\Windows\System\DUkCqkW.exe
  C:\Windows\System\DUkCqkW.exe
  2⤵
  PID:11272
- C:\Windows\System\YyeDsuU.exe
  C:\Windows\System\YyeDsuU.exe
  2⤵
  PID:12004
- C:\Windows\System\UMhLWHK.exe
  C:\Windows\System\UMhLWHK.exe
  2⤵
  PID:6696
- C:\Windows\System\fvUAXkh.exe
  C:\Windows\System\fvUAXkh.exe
  2⤵
  PID:13140
- C:\Windows\System\dwzAgmr.exe
  C:\Windows\System\dwzAgmr.exe
  2⤵
  PID:10544
- C:\Windows\System\yqeGYIr.exe
  C:\Windows\System\yqeGYIr.exe
  2⤵
  PID:11780
- C:\Windows\System\oNVmHCw.exe
  C:\Windows\System\oNVmHCw.exe
  2⤵
  PID:13492
- C:\Windows\System\sLpYCzm.exe
  C:\Windows\System\sLpYCzm.exe
  2⤵
  PID:13500
- C:\Windows\System\CuPxUZh.exe
  C:\Windows\System\CuPxUZh.exe
  2⤵
  PID:10672
- C:\Windows\System\CoujAYp.exe
  C:\Windows\System\CoujAYp.exe
  2⤵
  PID:11736
- C:\Windows\System\RFGdqQs.exe
  C:\Windows\System\RFGdqQs.exe
  2⤵
  PID:12180
- C:\Windows\System\nXldZpt.exe
  C:\Windows\System\nXldZpt.exe
  2⤵
  PID:10948
- C:\Windows\System\hxvmKKh.exe
  C:\Windows\System\hxvmKKh.exe
  2⤵
  PID:3732
- C:\Windows\System\EORkJki.exe
  C:\Windows\System\EORkJki.exe
  2⤵
  PID:13092
- C:\Windows\System\rjOIztE.exe
  C:\Windows\System\rjOIztE.exe
  2⤵
  PID:13284
- C:\Windows\System\lARFXwl.exe
  C:\Windows\System\lARFXwl.exe
  2⤵
  PID:11428
- C:\Windows\System\nWijvHt.exe
  C:\Windows\System\nWijvHt.exe
  2⤵
  PID:13324
- C:\Windows\System\jaRdXtB.exe
  C:\Windows\System\jaRdXtB.exe
  2⤵
  PID:13372
- C:\Windows\System\LwgKPDa.exe
  C:\Windows\System\LwgKPDa.exe
  2⤵
  PID:14256
- C:\Windows\System\bWVQQJQ.exe
  C:\Windows\System\bWVQQJQ.exe
  2⤵
  PID:14264
- C:\Windows\System\zfGLOBi.exe
  C:\Windows\System\zfGLOBi.exe
  2⤵
  PID:14268
- C:\Windows\System\FFZZEpY.exe
  C:\Windows\System\FFZZEpY.exe
  2⤵
  PID:9120
- C:\Windows\System\YsoSwVb.exe
  C:\Windows\System\YsoSwVb.exe
  2⤵
  PID:8144
- C:\Windows\System\mzTlFqi.exe
  C:\Windows\System\mzTlFqi.exe
  2⤵
  PID:7852
- C:\Windows\System\JZKIxCh.exe
  C:\Windows\System\JZKIxCh.exe
  2⤵
  PID:6692
- C:\Windows\System\VOHLGhk.exe
  C:\Windows\System\VOHLGhk.exe
  2⤵
  PID:14304
- C:\Windows\System\EnXDhKN.exe
  C:\Windows\System\EnXDhKN.exe
  2⤵
  PID:13880
- C:\Windows\System\RgxVyUS.exe
  C:\Windows\System\RgxVyUS.exe
  2⤵
  PID:11444
- C:\Windows\System\gWGYwwI.exe
  C:\Windows\System\gWGYwwI.exe
  2⤵
  PID:11080
- C:\Windows\System\HFTpoaj.exe
  C:\Windows\System\HFTpoaj.exe
  2⤵
  PID:14096
- C:\Windows\System\hSWihmT.exe
  C:\Windows\System\hSWihmT.exe
  2⤵
  PID:1452
- C:\Windows\System\CeQvbxK.exe
  C:\Windows\System\CeQvbxK.exe
  2⤵
  PID:10064
- C:\Windows\System\YDhpgQn.exe
  C:\Windows\System\YDhpgQn.exe
  2⤵
  PID:11968
- C:\Windows\System\moMWUrJ.exe
  C:\Windows\System\moMWUrJ.exe
  2⤵
  PID:3616
- C:\Windows\System\ZhROWcU.exe
  C:\Windows\System\ZhROWcU.exe
  2⤵
  PID:3892
- C:\Windows\System\gdCEPfy.exe
  C:\Windows\System\gdCEPfy.exe
  2⤵
  PID:11652
- C:\Windows\System\NnwdIUg.exe
  C:\Windows\System\NnwdIUg.exe
  2⤵
  PID:9924
- C:\Windows\System\cNsrNPs.exe
  C:\Windows\System\cNsrNPs.exe
  2⤵
  PID:5020
- C:\Windows\System\niTSJyM.exe
  C:\Windows\System\niTSJyM.exe
  2⤵
  PID:5908
- C:\Windows\System\msnltbd.exe
  C:\Windows\System\msnltbd.exe
  2⤵
  PID:13564
- C:\Windows\System\dMeunDI.exe
  C:\Windows\System\dMeunDI.exe
  2⤵
  PID:13076
- C:\Windows\System\pwLwNMS.exe
  C:\Windows\System\pwLwNMS.exe
  2⤵
  PID:10420
- C:\Windows\System\YbPfNWm.exe
  C:\Windows\System\YbPfNWm.exe
  2⤵
  PID:1688
- C:\Windows\System\EzLQRFf.exe
  C:\Windows\System\EzLQRFf.exe
  2⤵
  PID:12940
- C:\Windows\System\EnmAigr.exe
  C:\Windows\System\EnmAigr.exe
  2⤵
  PID:14060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xwnsz52p.wr4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CKEUjsh.exe

Filesize
1.8MB

MD5
7d95aee57a939a6cc1f8df6234865b77

SHA1
7c662fc585c0b27cb5e64e7b2a61bec1655fa8e8

SHA256
b4521251275f44fecec1ee7c18bf29e5a28c16bf0d4fb0f41bf04f885b4f97a8

SHA512
72cafd2e02cff78437c68bf6bf65624d6a92527c06bd82a317e08abf7714bc4e23f192cff1fb036761b38571774e1347a71e0754c734720e87b0d79361ddccd1

Download Submit
C:\Windows\System\EWvVyxZ.exe

Filesize
1.8MB

MD5
c6f6ca99bbe84568f0bf4476f1f89d80

SHA1
29568c8920fe65217098140497f3c923c251e6b2

SHA256
24f494f948daa4e5d7a6f6aa80e4746def905f889f33ccf493fa5aafccb33153

SHA512
fd3775eca3cae3b170d6bda82a8cd7a3570bc05fa6075fae1cf76e5fcc875fcd0e93458d288764d3ca0ea753a5a6595572e84501bdcf079602670b13737ccebe

Download Submit
C:\Windows\System\FeZyBWw.exe

Filesize
1.8MB

MD5
03144129fcb327c2a281d1148c6f9a53

SHA1
d288c235013346626fa8cd37bc193160ea385f2d

SHA256
9e0f75df10ce79dcc675f4ba9bbe80e0f9e11140a59a7027c3c46f928fb48207

SHA512
5f47f73a5b9d9bdd84be49fdee9162fd80036f0f9cf9d2b0f7fde09ae932114d910ca58af3159ed1919c1ec727cb07d71a906ec32fe172b4a6f706efc4ba2387

Download Submit
C:\Windows\System\JWCsGzj.exe

Filesize
1.8MB

MD5
92b3a7eaa92e9f0560d47c8f255de2b7

SHA1
7e9639c089ee5b3fc1c8a6f9286e02e1d0c77fe0

SHA256
d17a01d3172e1561cf8b9425f80f89b1e0ef455fe1c6ab9e3b90b4f46891f684

SHA512
f7b8ecdb858d611c1360859fa6068ba83adc3339bc2aadb2f19bad449840633b76faed540c9fdcf0c84b9be378ea2b88b3071e0991562f771cebdbc0413f2b9d

Download Submit
C:\Windows\System\Jvfqped.exe

Filesize
1.8MB

MD5
5e0f21f5b2a4ff33e6454fd296d0ddb7

SHA1
2fcbc7a7701f7e5e99790dd6be8bba8d4b251964

SHA256
9541a0d1c5529fb6d648b7d14d485e2adc7c883df4ae6f028195f6599713dba1

SHA512
7882ff19229ad8e9a4c408a6cbafcfca2c1b8631eaa6fc341dca0a7950d584f54e401e917b870a3cc5cf6f305032f102f1ff1121b59e3c8dee0b320683b1842c

Download Submit
C:\Windows\System\LtLEuNM.exe

Filesize
8B

MD5
9cb4bf9fd9671df0839f651b7291ada1

SHA1
65a07e22b4bb88cf278eb1826c308150ded29593

SHA256
7188099eb9c8547d41ed9f4696ce901a0066852814ae83835a5ed6cbffc1cf40

SHA512
6f35a15b3248c656029fbcfa880774f447f590d87875077936e1e0e583b3b4b43f507832937ba7994137923090cc3abaa893880b066cf5189f7fd87f77593929

Download Submit
C:\Windows\System\MhnkyTn.exe

Filesize
1.8MB

MD5
83b66e0ff0bedf79ecb601af23e8f91b

SHA1
f40cf10364972ab9f5d0bb5bc1e789cda07e8abd

SHA256
e8e2ad25127c4c6d53d2bd9a874fcda124eb62c5a2da681887a5feaec1ab1caa

SHA512
fa48ba6dd5232a1cd6af26b1aaf3d514d9677d535a0141cee1a99a8778cf65ce674963ca9cc813d643d55dc1d935a9e58b0d520bee78222b88adad546b4a420f

Download Submit
C:\Windows\System\MpArpEB.exe

Filesize
1.8MB

MD5
b5ffac13384a6e9c5846d65062d00c19

SHA1
d599bb05f257305a793d4c3cb3fab75a39853414

SHA256
13cc39716f8032742f158d984ee4eb0dba905eb5391207cef0969c7f93d59b1a

SHA512
db1d6e4d665bca7eea7a40b4d682d1c6c62637fa97ea42b12c770608480bb20202d63c8ea57fe3adae8dd8667f3282ca0506a81c0f6624edad2f96eee53bec32

Download Submit
C:\Windows\System\ONoFjcN.exe

Filesize
1.8MB

MD5
fb5d78bb9f013c0965a2744867eb0fb8

SHA1
41fc3151a87478607eae94c7cf224ca3ea30d700

SHA256
a0d7bbc855b6887a20ad376d1062a6a599839e844de4ad70c4403c6724929b57

SHA512
9112d3aa005b5bf22da3028460a08631a518e6f949415e0cbaa2a595fd47959228e5fc183c363a6ab1b6fc2aa14cdfd18f7a972d5726469222d35ab5752943c5

Download Submit
C:\Windows\System\QfRgyZK.exe

Filesize
1.8MB

MD5
5cff62bc182945e5997511443d3b884d

SHA1
d66e6f4fce198122eed00528e4772b6780628e97

SHA256
6f577b7dacc73dccd500399b21f3135facbded1bb591b9a3091eba94fefdd692

SHA512
d4b7e9cfe12f2eb7b793fc55703c1340535f332c26d8c0e5f8979645aabe10107265d8833a281adff26f2719ad9529df3f9f3f169a2483a5d9747b831b16878b

Download Submit
C:\Windows\System\RGomNTt.exe

Filesize
1.8MB

MD5
5fda773e6300c78149861f3df0764fce

SHA1
0c97449263f05a08c41cb40785cc09e37f714789

SHA256
0b5cc032d9ad9e4673bc3db83bda4d7e5c4a197bc77c335422937fbee5ecdfe4

SHA512
bab4fc11feb983b75c4b193950e9da19c818cb657012e1c9c5b866ea8f253419be6cc0d1d27c1d9e608d04bdd78606f4d342e4dc133355f651eea79029cd761e

Download Submit
C:\Windows\System\RxbMQPj.exe

Filesize
1.8MB

MD5
81cf7fece376414bf712e64188566d74

SHA1
a2d8e4ff6847db58b2a5be67a15c7493d1f85823

SHA256
848eac712c450c35051769ec922f5ac6fc388f35eeca1b77b2137f3307930ba8

SHA512
f5aa8e6408e6900a35f520c77b67d6a311f9660610a7c7e8257e40c24eaba8191d57661bd2d838925b5f1e0e859545c7037539ce5132e3b1595c0db317f9102c

Download Submit
C:\Windows\System\UTsziSS.exe

Filesize
1.8MB

MD5
a401f6f5973313676ba1309b18bcc433

SHA1
fb86b85b55e2bd1add7340027687b7a1cac6f29c

SHA256
873fe785b02f05dd09aa1e787e1cf92abb6289bdf046282e836a103b5135e844

SHA512
fa94298848ee67139e23547d37534e9125887ff04642ce1b3ac40a43df7daa8c90083a9732dc7789bed68f465f2c8faca637a40b431cb58ee31f7309582884d5

Download Submit
C:\Windows\System\WMdCtTy.exe

Filesize
1.8MB

MD5
5da9205358fb3ac4e3f59437c11da630

SHA1
31f39c2a2ff2195c0ddd6ae6a8ac34a2635fde2e

SHA256
e6f3cb24a9297afbb5f411cbdba35c0a3400774ab3b2c8285da5a1e041e6dc84

SHA512
34c649ec5fc97bd361687923f6295fb9defce1c8833fa0c3f52ec078eab1fb66d5b241353a7a91c9f855e5c4a7fde25f48bb7dd05929c318ab582cf7e6a278bc

Download Submit
C:\Windows\System\WTppeOR.exe

Filesize
1.8MB

MD5
c87fdac4f5ea16fed773c839f4774dcc

SHA1
22dcb6ce90717e4521acfdc1f3e66c368f35cd3c

SHA256
4f73e087ee87e9d1d045f6e36c15974e0432410e8a192b7c4e59070b33c9fa0d

SHA512
8cba3af1d7ca74127a375980a7a84b8506716fdfc2b47f34f857593fcfeb1229194c01bc4c3abed3ffbc839383c447e5b73cd4eccb2e8de83ea985d2def59bde

Download Submit
C:\Windows\System\XGWigek.exe

Filesize
1.8MB

MD5
06c74eebbb7284a06f689ea691fd5f08

SHA1
24e3c1a096932cbb0e88c39bd5eec3d9ccda0fbf

SHA256
34a789083e3ab47c11685878484488be9ac42ae7774111d4f7f460c5b6e2d481

SHA512
3038d98e6434f7023bd8282090c5be3b5620c5222621b7bc963931cf70f7114dbaf1d666f1231642b5ccacb170bba74f9fbef4e4d75596230c0ddce5d7de53cf

Download Submit
C:\Windows\System\XMKcMCi.exe

Filesize
1.8MB

MD5
8509bb095534034e9c2e007f7994bef5

SHA1
6e463cd98b7bcdf972c47721b3b0f820191f67c9

SHA256
c79b75f380bfdb5c3ba5ca036971f6474e1ba980dadae2067104a6ee5da72d24

SHA512
b6c29693b9e3b9183292ceb48a8dbffbd0c5d69134c6b75ae23d67302d0422d37fdb64819e8e9c26a0a9a8228f06375d443a879b3c1991710bacceae40e3a179

Download Submit
C:\Windows\System\XNMDiPI.exe

Filesize
1.8MB

MD5
ff963a3eefb9f36579d44bfcda1c1fa4

SHA1
a3284cdf3e5ad0890cf7b4826c3ea5bea2f5a711

SHA256
7ab4c30201fd4208d95e12b27652b41c7d148df3738295de7f6aac6fadb014b8

SHA512
77263b8ae88c462c40ac85b01629e2552263cddfd43e31397df05bfa10f98d43db7c2d6abc3f6e8a6842285b99aa168d49118b84d099a62078ea27ba8024e2b7

Download Submit
C:\Windows\System\YGkXoiW.exe

Filesize
1.8MB

MD5
bef44f594d4365169e6cb5dc2285e53d

SHA1
831ffc48de286539474dc2eaf972f73e0ac1a06b

SHA256
1c195c46c7c012b27229fd7e8c655e741a3800674672e595e2c53703000b1e26

SHA512
8a8292559f829b6d53980a26f2b22ad7a9f05a89fc28bbbc57f729e9a8c0babcdd7c9f8ada9c15fe380c7e2c825e3b6525cb18463ba4207bdfbfba2e9314ddd4

Download Submit
C:\Windows\System\aDhcapQ.exe

Filesize
1.8MB

MD5
9836a8e9e7736dd1de72cf90c5ab7198

SHA1
ccb2243d31ca467c81965e162bed4cb86b34378b

SHA256
dfaf7c09f3d54a2427e92944018cdce2c6eb37a1470e7e417158a0036966e7ad

SHA512
db910053f16d86a89b07af58b2e6fc0de72328cf9fd4cd8fa61be28f759c2b85b26d6beeda43799ef6f365cae4f47f7a13197011dc61c050408585d1b9113e51

Download Submit
C:\Windows\System\dUiWBfG.exe

Filesize
1.8MB

MD5
dca075a76b53035c77bbfff224782ae1

SHA1
24b05fffcd49f6764266cd800a43e04a0c318cfb

SHA256
480161e2b73c368f5e38e5551404a9152e2ccf68189750e162388c2833dc1b07

SHA512
0f7c25c744809ffe29545cc863028d15b829973467bea9faadb8718a5d90ae266d095c7144159a7ed7a5d0611f7c9f35a6c1054f43d59b004f371d365c8602a8

Download Submit
C:\Windows\System\eGfYhdL.exe

Filesize
1.8MB

MD5
91eca5af6820479dfe3e50aed68d2260

SHA1
ec7a97253723276fa64858598f2fc8c3e8f195c7

SHA256
2b9cbb311ec0c1279989f64c349c6dd1af6693f5a8d8692ce599f9391cde7e91

SHA512
09e05cb0df293520a9e45c3d0cbc75af181c144a5efd6734aa7c73c4d986a24c0656245396edf3093bce24aca34fd5e7ad8ca228fc2c0fabaa5767a387e5686e

Download Submit
C:\Windows\System\fEUXmbR.exe

Filesize
1.8MB

MD5
91eac59228604b27f4aaa7466acb9e6d

SHA1
3eed46b416fad010d390cda3dcc9cd620adf51b4

SHA256
0d83e3c0e701f8d9ea05d8357645125f9587cf3fbc58f6810af6cc2a8e77b2cf

SHA512
314e83d57f7bcdba130811dad2c048e804ee7ef59fb75a51f638671f1ca72d83381402c311809280e964d47257d5c74caa79fb45a8a8b84063508712c6d8558c

Download Submit
C:\Windows\System\fOPTQIM.exe

Filesize
1.8MB

MD5
441ef7b2fd8510b98be5975faa2848c6

SHA1
24b91a29ac0fd6e6c4d97ddee7e0089ecbbd8006

SHA256
555dd85ce7016d96dd811c926c7405b4479945767b2c14a5ccf6871ba1e76bf8

SHA512
356744c68bc4589452f32f3204d721418529dabaf70ae1e47f267f86fa7fed5657cb6ac177217de31a361ac215cce2e44f5486394ab3618670af0d1d4b06a428

Download Submit
C:\Windows\System\gkopqqt.exe

Filesize
1.8MB

MD5
c3d34c03cf677a4ec4e9da459b1765d9

SHA1
6e7629a27ab5d996fa71f69368ef567a6fc1adf3

SHA256
e2d5a7e218c69eb0262376bfc52b263dcef2858b53133521bf3ab17fb304d26c

SHA512
78af251dd2b09f746da8c3ee878ee1a24b6340d599e0deaf9ccabf7bcc23f3633553d1f263b95efd62a4f037a4db197ab7fbf7f75f4cfbb93f258407739048ab

Download Submit
C:\Windows\System\iASZVLu.exe

Filesize
1.8MB

MD5
e7657dea674960451c2088ffd772af50

SHA1
f089a9c125c24dac5de9a55581654cbcce1ac647

SHA256
6615a06f2d3814160c4aebf15ebb0cf9a753838ec9c3040b4be629224f4505d5

SHA512
f6dbb0e496d2eacd5a162c6a89b6a3eb5e8ce00ea3b36b2525fc5085806e26a4cbbfe8b7ffb10d2d2f0b70194de972090ddc39862798dd806708d22e4f8d2864

Download Submit
C:\Windows\System\kTbiOWy.exe

Filesize
18B

MD5
774019997db8b24d065a213771d36d50

SHA1
be10246550d1e149d5100f5404893ab8c63e246f

SHA256
75a4bb958151bbdc10482e708182affba64c835016d239ed4fda1ad85aa5efa5

SHA512
6720ec3ad2de7feaa3ca65a0a8daba7fda966ddc56eade159c846e8bd81c3f9a88b4860b202a8db148eb863f0bae1e0f4f6c6a69b1dc2eeb8a67052edf2fb542

Download Submit
C:\Windows\System\kZIJrrx.exe

Filesize
1.8MB

MD5
2a366ced1e395403289e2aa7e0f53877

SHA1
6d8cd12480981e1b4508dbe3556679b91abd7b14

SHA256
a0cfe100e9d820c068efaf8d9bef9c4c716cc224b6d0e3c28452e58a8362bd70

SHA512
a8902823f39693b8f15275462c75f1b14157c7dbccccddedf8020a3121968e43a2389f245d6e77857a0df271c2a16880210069ac0cb0ded328fb2d5ee642aa9d

Download Submit
C:\Windows\System\kwMvNUS.exe

Filesize
1.8MB

MD5
67b5e9f544b745c998e587d24ec83628

SHA1
5d850b5f3ea056d74ed5574ec2f45c88ba6c1192

SHA256
0a8b8ba923e45c4b9d88df3fed800062c5ac27909b0ec1378d1a25d7e3c4dde8

SHA512
7d5d5760f01a588e10750c510714e2b6e46c3eec22021bd07b7df77217682ee8e82b8fd907555cea0873fec43332c99801c1ac2ae80d519b3ab0673324c87e48

Download Submit
C:\Windows\System\lslbBiY.exe

Filesize
1.8MB

MD5
c6aa9a9f81950cf2faf3012f0e2b3139

SHA1
5b26edacecd23e6895a190acfb1843c8ddf50fca

SHA256
1f0535dffb3a9633b6695b496bda435c2272f2c278dbfb61c7030e774bf3b739

SHA512
8e4ebcb307491ef64df687f15f926909ac0d5cb0e314cf2f2cd563267cfbd7f5b1456c4b55fef159281b6c27ff1c6132e7d70ebc6d665f85f8d7f91ad487e1f0

Download Submit
C:\Windows\System\nJvOxIY.exe

Filesize
1.8MB

MD5
ed7393c4fcbd5506e547a4288c72598a

SHA1
be31325c0934b7d5d68658a6c0ee12111203ee78

SHA256
4d917351dd8caf311fa49773a899c59a7912a9bb34603169effd35a647964cd2

SHA512
f01e21d6ed1dbe91a3b21f75beac9df9a93dd2f493eff88742c7ca56535cea776066ae0c10b4e1796f04ac750887268ee2cfd3d37e8d244bbea9859305be7cd1

Download Submit
C:\Windows\System\otabXNP.exe

Filesize
1.8MB

MD5
353ff70ba4d93733b1105cf0b1cb9ab2

SHA1
a4e7039ff90b89a649509c1519811481734dee7f

SHA256
0a9a61e6e061996a271d15de8eeb0216de53b9c5ea16b2cb416b2f3c380968aa

SHA512
f56bccc9e4c3b21e3b57143ba8fa3e1494c3db789ed8badadc22ede8ebd883c3b1d04412ebdd2213b38a4bce5dfd4f8a0f8f577a38b034c39e3a99d3e091894c

Download Submit
C:\Windows\System\pPLzNZl.exe

Filesize
1.8MB

MD5
5a4309155436ba17cc417d4d1ee56157

SHA1
619fa6a37556962aeb5b22e63315b9794ec99e54

SHA256
e2e520f9a9c6e936cede45ab5e0a4318f91a638ba0f30ed5403bd52d70227837

SHA512
e971dd4a970691ee440658b56c44c4979c05496dfda922fd69ff82eaf1f8430c032e70d366733a9870494d049b061dea77d703e6ba9dd8f308875f85e2bffcc9

Download Submit
C:\Windows\System\pWFCLIw.exe

Filesize
1.8MB

MD5
8e0e19b243f5efc67b065a7a998c0bc4

SHA1
87e94b05d7936e96490c49a2a3f5a99734d88a15

SHA256
3872decc884d34ccce5fae5a47154029de8a5f8f3a51c5f0a41e350fab5f492d

SHA512
4ef3820bc1d64420f575ae45309e3a6147707c53448c66884e2f11b7e0232d047c8ccbc2986b1db424d14ab6c62299529e1af3b6506af10b881320f9599afc69

Download Submit
C:\Windows\System\sWomNKB.exe

Filesize
1.8MB

MD5
66cfc39b8163b87b5f1562b6afd0fb3d

SHA1
d6057a1e09f2fd17ed817f5d9b714175cb642c84

SHA256
19328598d749940bd68844e628546a5f5beab222aaea93a67ac28d154661203c

SHA512
7a2a9520164d35de359e0d5a6824658843f8919baeb3bc7071f930206c66dc1ecf18666c0f8f3cff8e008b96b78a2b695647c2e31695296f4c4ca60bffdfc908

Download Submit
C:\Windows\System\tbOIhoB.exe

Filesize
1.8MB

MD5
05cd1cf89f41fc52fd8c57b413a67145

SHA1
755fc3b99904a5dacc4dbb0fab51784cba8200fc

SHA256
a872c527c0a67c754b868dc5ad4a104086e1435b83b82ef23b6d6fe0f63cc2d0

SHA512
bf7d12b5ed494a335199346f5e1b5d0774d89dd5f87d428f5f2584a37313ea03b8a61e5ffee9e39846bbbbb8fdfb2a53b905eb88c77a1d9dbf5de8ce6854d938

Download Submit
C:\Windows\System\tiRxPty.exe

Filesize
1.8MB

MD5
0ee1638e0a95e102a0c5d64dabc7966b

SHA1
f460b4e01caa7b6720f46def014a120b5796ffed

SHA256
8643e7d4b14da983de9c22da099d7e603ccdfbccbebe1f3449c388d38562a269

SHA512
6e83f0d5bcf519aa88414557d5b595e3282acc654e28f37c3ff212b90d7f03153ec5aa49412169a99365ddbc879b1a8dd405db4ba995b85395c984311ed123c8

Download Submit
C:\Windows\System\wZFzOtN.exe

Filesize
1.8MB

MD5
b0bce6a38f395d2ca88c95a9a3ec0411

SHA1
910886ff77dec0eeed9124e09ad5373b79681476

SHA256
7c9d38b864fa0c89d337cc8041de5435ea6576f3cf212b04e96dcedf4f586fa0

SHA512
d3412657cb348e1ca94fd4e747d0b9c701876e7e8c6638dc4b97d717e6e9b6284f4714a55d367058f51e79b677b0ed041d77286fde669fd68f12f963c083fc82

Download Submit
C:\Windows\System\xnbXNfp.exe

Filesize
1.8MB

MD5
fd0dc803bea8eb7e4e40be903b439a0a

SHA1
598a2ad12d291209ca392abd505fda6a28cbad1f

SHA256
f5a47545ef42be8437a58034a1261bb5e8224d644f93b1dfa970db825e1400e8

SHA512
ae8f50b0c5fa0ddbf0fd49f0df30d27340a46fe59c36e06c455db8b1a0e36868ffdff5e7c697018b5308c32fb70d2f455395e98bed8861427d418bfac993e151

Download Submit
C:\Windows\System\yDvCGEC.exe

Filesize
1.8MB

MD5
aab7e0f4b8c8b1ced408a0c6757c51d7

SHA1
f26cf9de5cdd8e7c75a732ea1a0ce909db3c01d7

SHA256
265e766310796770e7d3b348fe0cc0a356f699c5d31c16bb2f77817a0aad160f

SHA512
eb7b1b7c62a007cccb3714746f6f150bf5301068cc4f1bd88e82066b31454596a6abcb21426c5f0176c20ab1b469541427b49002f434c37d63d71840e25d4459

Download Submit
C:\Windows\System\yMzejMi.exe

Filesize
1.8MB

MD5
b5c88e8dacf3595ba809b1e4540a7689

SHA1
e6bea1d3d40e93cdcf52a6bcf9c0b667ade32aae

SHA256
b82c50708afea078936693d643cfd77af9d7f80a1190bb195092153c3f757bc1

SHA512
0a714760e866650a7b834f9002b3e0de889e0d21d120daf7fffb837ffc38bcb014ee523eab0bc3cd74563e356dff19d25182aa804fcf2bd6ea12f3bf334a7878

Download Submit
C:\Windows\System\yyKUQkI.exe

Filesize
1.8MB

MD5
65052ff4f8a699d9b8fe3c912aa1eaa8

SHA1
883db0cda1bfa9fa548d4aa265a69e55249931cf

SHA256
dd0c66b124661621c73cfce809d30ff05cbc4aeb8cb1128d6ed386eaeed73fd5

SHA512
b0f9bccdc848a96ae96845d72f20ed1a284ace7383b435e314a45b3ccc2a77f8a685bd36516cca47f9aa8a2d09c2e12a75652396b71ebfb8d0cc9a4f3fdd7bb4

Download Submit
memory/976-488-0x00007FF71D9C0000-0x00007FF71DDB2000-memory.dmp

Filesize
3.9MB

Download
memory/1264-23-0x00007FF70A240000-0x00007FF70A632000-memory.dmp

Filesize
3.9MB

Download
memory/1548-24-0x000001FCFB610000-0x000001FCFB620000-memory.dmp

Filesize
64KB

Download
memory/1548-277-0x000001FCFB490000-0x000001FCFB4B2000-memory.dmp

Filesize
136KB

Download
memory/1548-487-0x00007FFE4CDD3000-0x00007FFE4CDD5000-memory.dmp

Filesize
8KB

Download
memory/2120-459-0x00007FF614600000-0x00007FF6149F2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-6345-0x00007FF614600000-0x00007FF6149F2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-489-0x00007FF6FBE60000-0x00007FF6FC252000-memory.dmp

Filesize
3.9MB

Download
memory/2208-2437-0x00007FF63C8E0000-0x00007FF63CCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-6315-0x00007FF63C8E0000-0x00007FF63CCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-99-0x00007FF63C8E0000-0x00007FF63CCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-255-0x00007FF742140000-0x00007FF742532000-memory.dmp

Filesize
3.9MB

Download
memory/2236-6311-0x00007FF742140000-0x00007FF742532000-memory.dmp

Filesize
3.9MB

Download
memory/2304-13-0x00007FF65F8A0000-0x00007FF65FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2304-2010-0x00007FF65F8A0000-0x00007FF65FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2552-491-0x00007FF727F30000-0x00007FF728322000-memory.dmp

Filesize
3.9MB

Download
memory/2636-421-0x00007FF712110000-0x00007FF712502000-memory.dmp

Filesize
3.9MB

Download
memory/2636-6339-0x00007FF712110000-0x00007FF712502000-memory.dmp

Filesize
3.9MB

Download
memory/2928-6283-0x00007FF75A0C0000-0x00007FF75A4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2928-215-0x00007FF75A0C0000-0x00007FF75A4B2000-memory.dmp

Filesize
3.9MB

Download
memory/3312-6360-0x00007FF6E2380000-0x00007FF6E2772000-memory.dmp

Filesize
3.9MB

Download
memory/3312-455-0x00007FF6E2380000-0x00007FF6E2772000-memory.dmp

Filesize
3.9MB

Download
memory/3416-163-0x00007FF6956B0000-0x00007FF695AA2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-38-0x00007FF757A70000-0x00007FF757E62000-memory.dmp

Filesize
3.9MB

Download
memory/3504-6209-0x00007FF757A70000-0x00007FF757E62000-memory.dmp

Filesize
3.9MB

Download
memory/3504-2403-0x00007FF757A70000-0x00007FF757E62000-memory.dmp

Filesize
3.9MB

Download
memory/3540-6338-0x00007FF7ABAF0000-0x00007FF7ABEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-280-0x00007FF7ABAF0000-0x00007FF7ABEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3544-134-0x00007FF6197C0000-0x00007FF619BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3544-6352-0x00007FF6197C0000-0x00007FF619BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3544-2629-0x00007FF6197C0000-0x00007FF619BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3824-334-0x00007FF7F6010000-0x00007FF7F6402000-memory.dmp

Filesize
3.9MB

Download
memory/3824-6320-0x00007FF7F6010000-0x00007FF7F6402000-memory.dmp

Filesize
3.9MB

Download
memory/3972-58-0x00007FF7F80F0000-0x00007FF7F84E2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-2432-0x00007FF7F80F0000-0x00007FF7F84E2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-6243-0x00007FF7F80F0000-0x00007FF7F84E2000-memory.dmp

Filesize
3.9MB

Download
memory/4008-67-0x00007FF78D5D0000-0x00007FF78D9C2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-0-0x00007FF7AAF70000-0x00007FF7AB362000-memory.dmp

Filesize
3.9MB

Download
memory/4088-2009-0x00007FF7AAF70000-0x00007FF7AB362000-memory.dmp

Filesize
3.9MB

Download
memory/4088-1-0x0000025D58EF0000-0x0000025D58F00000-memory.dmp

Filesize
64KB

Download
memory/4368-358-0x00007FF6A5450000-0x00007FF6A5842000-memory.dmp

Filesize
3.9MB

Download
memory/4492-28-0x00007FF7F7600000-0x00007FF7F79F2000-memory.dmp

Filesize
3.9MB

Download
memory/4576-373-0x00007FF750250000-0x00007FF750642000-memory.dmp

Filesize
3.9MB

Download
memory/4772-490-0x00007FF63C8F0000-0x00007FF63CCE2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-486-0x00007FF62EC30000-0x00007FF62F022000-memory.dmp

Filesize
3.9MB

Download
memory/4972-6389-0x00007FF62EC30000-0x00007FF62F022000-memory.dmp

Filesize
3.9MB

Download
memory/4980-6342-0x00007FF672F20000-0x00007FF673312000-memory.dmp

Filesize
3.9MB

Download
memory/4980-451-0x00007FF672F20000-0x00007FF673312000-memory.dmp

Filesize
3.9MB

Download