xmrig | 568f975169b671e932afc33e7cac001007dd62730feed617ba84308693d67411

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

215f0dfecd789d8d2f83420bffe027a0.exe
Size

1.9MB
MD5

215f0dfecd789d8d2f83420bffe027a0
SHA1

2795d198a39df023bbf06829b4f7ba1e579d8548
SHA256

568f975169b671e932afc33e7cac001007dd62730feed617ba84308693d67411
SHA512

5d7bf462f988a51251b1c59b9a850cccfd6a05ed74e7eb67d1a480ad0ffe5a1496dc9823accd71e7cb676e4a4a11341dd558fd424ac3d5f575d51aec24c1ee9b
SSDEEP

49152:Lz071uv4BPMkyW10/w16BvZX71Fq8++fAYUHK5:NABm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/2880-296-0x00007FF7805C0000-0x00007FF7809B2000-memory.dmp	xmrig
behavioral2/memory/3944-300-0x00007FF615E00000-0x00007FF6161F2000-memory.dmp	xmrig
behavioral2/memory/2552-438-0x00007FF7847E0000-0x00007FF784BD2000-memory.dmp	xmrig
behavioral2/memory/776-526-0x00007FF6C0F30000-0x00007FF6C1322000-memory.dmp	xmrig
behavioral2/memory/532-575-0x00007FF77E5C0000-0x00007FF77E9B2000-memory.dmp	xmrig
behavioral2/memory/912-630-0x00007FF6E1DC0000-0x00007FF6E21B2000-memory.dmp	xmrig
behavioral2/memory/2644-703-0x00007FF6C5280000-0x00007FF6C5672000-memory.dmp	xmrig
behavioral2/memory/632-574-0x00007FF611620000-0x00007FF611A12000-memory.dmp	xmrig
behavioral2/memory/3088-387-0x00007FF793020000-0x00007FF793412000-memory.dmp	xmrig
behavioral2/memory/3644-304-0x00007FF7DE950000-0x00007FF7DED42000-memory.dmp	xmrig
behavioral2/memory/216-303-0x00007FF686D30000-0x00007FF687122000-memory.dmp	xmrig
behavioral2/memory/3472-302-0x00007FF646530000-0x00007FF646922000-memory.dmp	xmrig
behavioral2/memory/312-301-0x00007FF6DE610000-0x00007FF6DEA02000-memory.dmp	xmrig
behavioral2/memory/3184-299-0x00007FF68B7B0000-0x00007FF68BBA2000-memory.dmp	xmrig
behavioral2/memory/2132-298-0x00007FF6F2B70000-0x00007FF6F2F62000-memory.dmp	xmrig
behavioral2/memory/1552-297-0x00007FF645A80000-0x00007FF645E72000-memory.dmp	xmrig
behavioral2/memory/452-295-0x00007FF6BA640000-0x00007FF6BAA32000-memory.dmp	xmrig
behavioral2/memory/4400-294-0x00007FF624150000-0x00007FF624542000-memory.dmp	xmrig
behavioral2/memory/812-293-0x00007FF7AFF70000-0x00007FF7B0362000-memory.dmp	xmrig
behavioral2/memory/1920-292-0x00007FF7B2C40000-0x00007FF7B3032000-memory.dmp	xmrig
behavioral2/memory/2908-48-0x00007FF673AA0000-0x00007FF673E92000-memory.dmp	xmrig
behavioral2/memory/632-2671-0x00007FF611620000-0x00007FF611A12000-memory.dmp	xmrig
behavioral2/memory/4884-2670-0x00007FF656870000-0x00007FF656C62000-memory.dmp	xmrig
behavioral2/memory/3184-2702-0x00007FF68B7B0000-0x00007FF68BBA2000-memory.dmp	xmrig
behavioral2/memory/1552-2716-0x00007FF645A80000-0x00007FF645E72000-memory.dmp	xmrig
behavioral2/memory/776-2699-0x00007FF6C0F30000-0x00007FF6C1322000-memory.dmp	xmrig
behavioral2/memory/1920-2696-0x00007FF7B2C40000-0x00007FF7B3032000-memory.dmp	xmrig
behavioral2/memory/812-2747-0x00007FF7AFF70000-0x00007FF7B0362000-memory.dmp	xmrig
behavioral2/memory/216-2814-0x00007FF686D30000-0x00007FF687122000-memory.dmp	xmrig
behavioral2/memory/3088-2776-0x00007FF793020000-0x00007FF793412000-memory.dmp	xmrig
behavioral2/memory/3644-2771-0x00007FF7DE950000-0x00007FF7DED42000-memory.dmp	xmrig
behavioral2/memory/2132-2786-0x00007FF6F2B70000-0x00007FF6F2F62000-memory.dmp	xmrig
behavioral2/memory/912-2766-0x00007FF6E1DC0000-0x00007FF6E21B2000-memory.dmp	xmrig
behavioral2/memory/452-2762-0x00007FF6BA640000-0x00007FF6BAA32000-memory.dmp	xmrig
behavioral2/memory/2644-2761-0x00007FF6C5280000-0x00007FF6C5672000-memory.dmp	xmrig
behavioral2/memory/2552-2757-0x00007FF7847E0000-0x00007FF784BD2000-memory.dmp	xmrig
behavioral2/memory/312-2774-0x00007FF6DE610000-0x00007FF6DEA02000-memory.dmp	xmrig
behavioral2/memory/3944-2753-0x00007FF615E00000-0x00007FF6161F2000-memory.dmp	xmrig
behavioral2/memory/2880-2768-0x00007FF7805C0000-0x00007FF7809B2000-memory.dmp	xmrig
behavioral2/memory/3472-2743-0x00007FF646530000-0x00007FF646922000-memory.dmp	xmrig
behavioral2/memory/4400-2735-0x00007FF624150000-0x00007FF624542000-memory.dmp	xmrig
behavioral2/memory/532-2677-0x00007FF77E5C0000-0x00007FF77E9B2000-memory.dmp	xmrig
behavioral2/memory/3960-5852-0x00007FF6BB7D0000-0x00007FF6BBBC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2868	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2932	QEjGdlR.exe
4884	cakYCSU.exe
776	oePdvYU.exe
2908	mczveoA.exe
3856	JLEDMJA.exe
632	zpdJXnv.exe
532	iUghxIe.exe
1920	wCVxPlz.exe
812	WCmVqWd.exe
912	fJVRFrK.exe
4400	wfgLKsB.exe
452	yYmQJnR.exe
1552	stesiGe.exe
2880	MKgmUgC.exe
2132	bktoqDb.exe
3184	BXgEVFb.exe
3944	rsmKcMS.exe
2644	CcapLba.exe
312	xAAlUmy.exe
3472	ytMWltQ.exe
216	iapncog.exe
3644	HyzQaeI.exe
3088	HcXuxiL.exe
2552	ysIAHyO.exe
3012	AUmlLHR.exe
4684	mGvxHQD.exe
4656	mbrdDPp.exe
1676	WGejfBf.exe
3652	qpeCYYe.exe
1224	qwsTUAn.exe
1708	xSIYhfA.exe
3512	HwrUpAO.exe
2056	EfaGjbz.exe
2064	FwJikVv.exe
4756	qkRvOSG.exe
2136	KFBGnCJ.exe
4836	yZDanNz.exe
116	TsBBALN.exe
3552	zgeaFqB.exe
1912	vOUJITO.exe
4880	XLiazxn.exe
2988	FmxNbVT.exe
4432	ObBUKaY.exe
1592	tOnpePJ.exe
1716	AldERXE.exe
2728	PMDlPvF.exe
1480	VHLgydW.exe
2628	WdPFMLw.exe
1556	pbYZZEN.exe
1404	LLNZfBH.exe
1452	IPgGXDh.exe
2276	pBPLfpr.exe
1644	keNtKbG.exe
3048	QDyGAcG.exe
3444	GfJrJGu.exe
2584	aXKPgtv.exe
4344	JIAwywk.exe
4328	VVfuKjW.exe
5052	dGCigKy.exe
1792	hmmtayn.exe
3548	reMdqDP.exe
2920	nqXYDnn.exe
3792	OnOmiIl.exe
2864	YoPJNXa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3960-0-0x00007FF6BB7D0000-0x00007FF6BBBC2000-memory.dmp	upx
behavioral2/files/0x000800000002343f-8.dat	upx
behavioral2/files/0x0007000000023443-29.dat	upx
behavioral2/files/0x0007000000023449-61.dat	upx
behavioral2/files/0x000800000002343d-126.dat	upx
behavioral2/files/0x000700000002345c-155.dat	upx
behavioral2/memory/2880-296-0x00007FF7805C0000-0x00007FF7809B2000-memory.dmp	upx
behavioral2/memory/3944-300-0x00007FF615E00000-0x00007FF6161F2000-memory.dmp	upx
behavioral2/memory/2552-438-0x00007FF7847E0000-0x00007FF784BD2000-memory.dmp	upx
behavioral2/memory/776-526-0x00007FF6C0F30000-0x00007FF6C1322000-memory.dmp	upx
behavioral2/memory/532-575-0x00007FF77E5C0000-0x00007FF77E9B2000-memory.dmp	upx
behavioral2/memory/912-630-0x00007FF6E1DC0000-0x00007FF6E21B2000-memory.dmp	upx
behavioral2/memory/2644-703-0x00007FF6C5280000-0x00007FF6C5672000-memory.dmp	upx
behavioral2/memory/632-574-0x00007FF611620000-0x00007FF611A12000-memory.dmp	upx
behavioral2/memory/3088-387-0x00007FF793020000-0x00007FF793412000-memory.dmp	upx
behavioral2/memory/3644-304-0x00007FF7DE950000-0x00007FF7DED42000-memory.dmp	upx
behavioral2/memory/216-303-0x00007FF686D30000-0x00007FF687122000-memory.dmp	upx
behavioral2/memory/3472-302-0x00007FF646530000-0x00007FF646922000-memory.dmp	upx
behavioral2/memory/312-301-0x00007FF6DE610000-0x00007FF6DEA02000-memory.dmp	upx
behavioral2/memory/3184-299-0x00007FF68B7B0000-0x00007FF68BBA2000-memory.dmp	upx
behavioral2/memory/2132-298-0x00007FF6F2B70000-0x00007FF6F2F62000-memory.dmp	upx
behavioral2/memory/1552-297-0x00007FF645A80000-0x00007FF645E72000-memory.dmp	upx
behavioral2/memory/452-295-0x00007FF6BA640000-0x00007FF6BAA32000-memory.dmp	upx
behavioral2/memory/4400-294-0x00007FF624150000-0x00007FF624542000-memory.dmp	upx
behavioral2/memory/812-293-0x00007FF7AFF70000-0x00007FF7B0362000-memory.dmp	upx
behavioral2/memory/1920-292-0x00007FF7B2C40000-0x00007FF7B3032000-memory.dmp	upx
behavioral2/files/0x0007000000023464-185.dat	upx
behavioral2/files/0x0007000000023463-184.dat	upx
behavioral2/files/0x0007000000023462-183.dat	upx
behavioral2/files/0x0007000000023460-178.dat	upx
behavioral2/files/0x000700000002345f-174.dat	upx
behavioral2/files/0x0007000000023454-170.dat	upx
behavioral2/files/0x0007000000023450-168.dat	upx
behavioral2/files/0x000700000002345e-165.dat	upx
behavioral2/files/0x000700000002345d-159.dat	upx
behavioral2/files/0x000700000002344d-151.dat	upx
behavioral2/files/0x0007000000023455-150.dat	upx
behavioral2/files/0x000700000002345b-149.dat	upx
behavioral2/files/0x000700000002345a-144.dat	upx
behavioral2/files/0x0007000000023461-181.dat	upx
behavioral2/files/0x0007000000023459-140.dat	upx
behavioral2/files/0x0007000000023452-139.dat	upx
behavioral2/files/0x0007000000023453-169.dat	upx
behavioral2/files/0x000700000002344f-132.dat	upx
behavioral2/files/0x0007000000023451-163.dat	upx
behavioral2/files/0x0007000000023457-128.dat	upx
behavioral2/files/0x0007000000023458-137.dat	upx
behavioral2/files/0x000700000002344b-108.dat	upx
behavioral2/files/0x0007000000023456-127.dat	upx
behavioral2/files/0x000700000002344c-117.dat	upx
behavioral2/files/0x0007000000023444-93.dat	upx
behavioral2/files/0x000700000002344a-83.dat	upx
behavioral2/files/0x000700000002344e-75.dat	upx
behavioral2/files/0x0007000000023448-74.dat	upx
behavioral2/files/0x0007000000023442-71.dat	upx
behavioral2/memory/3856-68-0x00007FF6827D0000-0x00007FF682BC2000-memory.dmp	upx
behavioral2/files/0x0007000000023447-80.dat	upx
behavioral2/files/0x0007000000023446-76.dat	upx
behavioral2/files/0x0007000000023445-55.dat	upx
behavioral2/memory/2908-48-0x00007FF673AA0000-0x00007FF673E92000-memory.dmp	upx
behavioral2/files/0x0007000000023440-50.dat	upx
behavioral2/memory/2932-25-0x00007FF6B2460000-0x00007FF6B2852000-memory.dmp	upx
behavioral2/files/0x0007000000023441-23.dat	upx
behavioral2/memory/4884-33-0x00007FF656870000-0x00007FF656C62000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kFgfojQ.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\aRtRrMk.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\ZZuoUTi.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\pWvFvSg.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\ZmZuLpL.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\csIjsRy.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\ODtaLCB.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\llGvIsL.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\KbmBuzQ.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\AniQmvU.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\mWqMYKx.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\hLsVDIs.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\Bolffgx.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\DSriNNG.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\VNsmSMn.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\UIgMnLh.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\UBOkAda.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\QuWdYRG.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\gfBYpsj.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\MhfcvNx.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\iCoOTnH.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\PKKIeBk.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\BVUslwW.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\wpItEFm.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\czyheMC.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\VBjdlTn.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\VEQLorS.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\VoDVmpe.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\IiwBoiV.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\HNwNRfz.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\exRogeW.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\kyQJbCK.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\KHzFLVK.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\mFMTIcT.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\ZmVhisL.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\kjtFhCt.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\IaTAPDm.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\cjhxuTK.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\NgRYPdF.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\CleuvuF.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\ZPkhKqq.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\WynyibH.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\vwobVNP.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\QFjMDuq.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\gVtTWPL.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\wHerVDL.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\qPxDzaq.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\JzYIZbI.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\HNNUeBD.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\wCUOERc.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\XupRqLv.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\IojRiij.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\RpnastM.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\FufyhpI.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\AhxsJoD.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\GpqQipM.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\iQLdnBB.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\XgqPBuw.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\KhpqYra.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\jrUqNgq.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\RUbTlyp.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\EAiuPIB.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\YEjMnri.exe	215f0dfecd789d8d2f83420bffe027a0.exe
File created	C:\Windows\System\MkBlRCs.exe	215f0dfecd789d8d2f83420bffe027a0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2868	powershell.exe
2868	powershell.exe
2868	powershell.exe
2868	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3960	215f0dfecd789d8d2f83420bffe027a0.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeLockMemoryPrivilege	3960	215f0dfecd789d8d2f83420bffe027a0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 2868	3960	215f0dfecd789d8d2f83420bffe027a0.exe	83
PID 3960 wrote to memory of 2868	3960	215f0dfecd789d8d2f83420bffe027a0.exe	83
PID 3960 wrote to memory of 2932	3960	215f0dfecd789d8d2f83420bffe027a0.exe	84
PID 3960 wrote to memory of 2932	3960	215f0dfecd789d8d2f83420bffe027a0.exe	84
PID 3960 wrote to memory of 4884	3960	215f0dfecd789d8d2f83420bffe027a0.exe	85
PID 3960 wrote to memory of 4884	3960	215f0dfecd789d8d2f83420bffe027a0.exe	85
PID 3960 wrote to memory of 776	3960	215f0dfecd789d8d2f83420bffe027a0.exe	86
PID 3960 wrote to memory of 776	3960	215f0dfecd789d8d2f83420bffe027a0.exe	86
PID 3960 wrote to memory of 2908	3960	215f0dfecd789d8d2f83420bffe027a0.exe	87
PID 3960 wrote to memory of 2908	3960	215f0dfecd789d8d2f83420bffe027a0.exe	87
PID 3960 wrote to memory of 3856	3960	215f0dfecd789d8d2f83420bffe027a0.exe	88
PID 3960 wrote to memory of 3856	3960	215f0dfecd789d8d2f83420bffe027a0.exe	88
PID 3960 wrote to memory of 632	3960	215f0dfecd789d8d2f83420bffe027a0.exe	89
PID 3960 wrote to memory of 632	3960	215f0dfecd789d8d2f83420bffe027a0.exe	89
PID 3960 wrote to memory of 912	3960	215f0dfecd789d8d2f83420bffe027a0.exe	90
PID 3960 wrote to memory of 912	3960	215f0dfecd789d8d2f83420bffe027a0.exe	90
PID 3960 wrote to memory of 532	3960	215f0dfecd789d8d2f83420bffe027a0.exe	91
PID 3960 wrote to memory of 532	3960	215f0dfecd789d8d2f83420bffe027a0.exe	91
PID 3960 wrote to memory of 1920	3960	215f0dfecd789d8d2f83420bffe027a0.exe	92
PID 3960 wrote to memory of 1920	3960	215f0dfecd789d8d2f83420bffe027a0.exe	92
PID 3960 wrote to memory of 812	3960	215f0dfecd789d8d2f83420bffe027a0.exe	93
PID 3960 wrote to memory of 812	3960	215f0dfecd789d8d2f83420bffe027a0.exe	93
PID 3960 wrote to memory of 4400	3960	215f0dfecd789d8d2f83420bffe027a0.exe	94
PID 3960 wrote to memory of 4400	3960	215f0dfecd789d8d2f83420bffe027a0.exe	94
PID 3960 wrote to memory of 452	3960	215f0dfecd789d8d2f83420bffe027a0.exe	95
PID 3960 wrote to memory of 452	3960	215f0dfecd789d8d2f83420bffe027a0.exe	95
PID 3960 wrote to memory of 1552	3960	215f0dfecd789d8d2f83420bffe027a0.exe	96
PID 3960 wrote to memory of 1552	3960	215f0dfecd789d8d2f83420bffe027a0.exe	96
PID 3960 wrote to memory of 2880	3960	215f0dfecd789d8d2f83420bffe027a0.exe	97
PID 3960 wrote to memory of 2880	3960	215f0dfecd789d8d2f83420bffe027a0.exe	97
PID 3960 wrote to memory of 2132	3960	215f0dfecd789d8d2f83420bffe027a0.exe	98
PID 3960 wrote to memory of 2132	3960	215f0dfecd789d8d2f83420bffe027a0.exe	98
PID 3960 wrote to memory of 2644	3960	215f0dfecd789d8d2f83420bffe027a0.exe	99
PID 3960 wrote to memory of 2644	3960	215f0dfecd789d8d2f83420bffe027a0.exe	99
PID 3960 wrote to memory of 3184	3960	215f0dfecd789d8d2f83420bffe027a0.exe	100
PID 3960 wrote to memory of 3184	3960	215f0dfecd789d8d2f83420bffe027a0.exe	100
PID 3960 wrote to memory of 3944	3960	215f0dfecd789d8d2f83420bffe027a0.exe	101
PID 3960 wrote to memory of 3944	3960	215f0dfecd789d8d2f83420bffe027a0.exe	101
PID 3960 wrote to memory of 216	3960	215f0dfecd789d8d2f83420bffe027a0.exe	102
PID 3960 wrote to memory of 216	3960	215f0dfecd789d8d2f83420bffe027a0.exe	102
PID 3960 wrote to memory of 312	3960	215f0dfecd789d8d2f83420bffe027a0.exe	103
PID 3960 wrote to memory of 312	3960	215f0dfecd789d8d2f83420bffe027a0.exe	103
PID 3960 wrote to memory of 3472	3960	215f0dfecd789d8d2f83420bffe027a0.exe	104
PID 3960 wrote to memory of 3472	3960	215f0dfecd789d8d2f83420bffe027a0.exe	104
PID 3960 wrote to memory of 3644	3960	215f0dfecd789d8d2f83420bffe027a0.exe	105
PID 3960 wrote to memory of 3644	3960	215f0dfecd789d8d2f83420bffe027a0.exe	105
PID 3960 wrote to memory of 3088	3960	215f0dfecd789d8d2f83420bffe027a0.exe	106
PID 3960 wrote to memory of 3088	3960	215f0dfecd789d8d2f83420bffe027a0.exe	106
PID 3960 wrote to memory of 2552	3960	215f0dfecd789d8d2f83420bffe027a0.exe	107
PID 3960 wrote to memory of 2552	3960	215f0dfecd789d8d2f83420bffe027a0.exe	107
PID 3960 wrote to memory of 3012	3960	215f0dfecd789d8d2f83420bffe027a0.exe	108
PID 3960 wrote to memory of 3012	3960	215f0dfecd789d8d2f83420bffe027a0.exe	108
PID 3960 wrote to memory of 4684	3960	215f0dfecd789d8d2f83420bffe027a0.exe	109
PID 3960 wrote to memory of 4684	3960	215f0dfecd789d8d2f83420bffe027a0.exe	109
PID 3960 wrote to memory of 4656	3960	215f0dfecd789d8d2f83420bffe027a0.exe	110
PID 3960 wrote to memory of 4656	3960	215f0dfecd789d8d2f83420bffe027a0.exe	110
PID 3960 wrote to memory of 1676	3960	215f0dfecd789d8d2f83420bffe027a0.exe	111
PID 3960 wrote to memory of 1676	3960	215f0dfecd789d8d2f83420bffe027a0.exe	111
PID 3960 wrote to memory of 3652	3960	215f0dfecd789d8d2f83420bffe027a0.exe	112
PID 3960 wrote to memory of 3652	3960	215f0dfecd789d8d2f83420bffe027a0.exe	112
PID 3960 wrote to memory of 1224	3960	215f0dfecd789d8d2f83420bffe027a0.exe	113
PID 3960 wrote to memory of 1224	3960	215f0dfecd789d8d2f83420bffe027a0.exe	113
PID 3960 wrote to memory of 1708	3960	215f0dfecd789d8d2f83420bffe027a0.exe	114
PID 3960 wrote to memory of 1708	3960	215f0dfecd789d8d2f83420bffe027a0.exe	114

C:\Users\Admin\AppData\Local\Temp\215f0dfecd789d8d2f83420bffe027a0.exe
"C:\Users\Admin\AppData\Local\Temp\215f0dfecd789d8d2f83420bffe027a0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\System\QEjGdlR.exe
  C:\Windows\System\QEjGdlR.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\cakYCSU.exe
  C:\Windows\System\cakYCSU.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\oePdvYU.exe
  C:\Windows\System\oePdvYU.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\mczveoA.exe
  C:\Windows\System\mczveoA.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\JLEDMJA.exe
  C:\Windows\System\JLEDMJA.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\zpdJXnv.exe
  C:\Windows\System\zpdJXnv.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\fJVRFrK.exe
  C:\Windows\System\fJVRFrK.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\iUghxIe.exe
  C:\Windows\System\iUghxIe.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\wCVxPlz.exe
  C:\Windows\System\wCVxPlz.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\WCmVqWd.exe
  C:\Windows\System\WCmVqWd.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\wfgLKsB.exe
  C:\Windows\System\wfgLKsB.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\yYmQJnR.exe
  C:\Windows\System\yYmQJnR.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\stesiGe.exe
  C:\Windows\System\stesiGe.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\MKgmUgC.exe
  C:\Windows\System\MKgmUgC.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\bktoqDb.exe
  C:\Windows\System\bktoqDb.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\CcapLba.exe
  C:\Windows\System\CcapLba.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\BXgEVFb.exe
  C:\Windows\System\BXgEVFb.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\rsmKcMS.exe
  C:\Windows\System\rsmKcMS.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\iapncog.exe
  C:\Windows\System\iapncog.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\xAAlUmy.exe
  C:\Windows\System\xAAlUmy.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\ytMWltQ.exe
  C:\Windows\System\ytMWltQ.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\HyzQaeI.exe
  C:\Windows\System\HyzQaeI.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\HcXuxiL.exe
  C:\Windows\System\HcXuxiL.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\ysIAHyO.exe
  C:\Windows\System\ysIAHyO.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\AUmlLHR.exe
  C:\Windows\System\AUmlLHR.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\mGvxHQD.exe
  C:\Windows\System\mGvxHQD.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\mbrdDPp.exe
  C:\Windows\System\mbrdDPp.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\WGejfBf.exe
  C:\Windows\System\WGejfBf.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\qpeCYYe.exe
  C:\Windows\System\qpeCYYe.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\qwsTUAn.exe
  C:\Windows\System\qwsTUAn.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\xSIYhfA.exe
  C:\Windows\System\xSIYhfA.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\HwrUpAO.exe
  C:\Windows\System\HwrUpAO.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\EfaGjbz.exe
  C:\Windows\System\EfaGjbz.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\FwJikVv.exe
  C:\Windows\System\FwJikVv.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\qkRvOSG.exe
  C:\Windows\System\qkRvOSG.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\KFBGnCJ.exe
  C:\Windows\System\KFBGnCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\yZDanNz.exe
  C:\Windows\System\yZDanNz.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\TsBBALN.exe
  C:\Windows\System\TsBBALN.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\zgeaFqB.exe
  C:\Windows\System\zgeaFqB.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\vOUJITO.exe
  C:\Windows\System\vOUJITO.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\XLiazxn.exe
  C:\Windows\System\XLiazxn.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\FmxNbVT.exe
  C:\Windows\System\FmxNbVT.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\ObBUKaY.exe
  C:\Windows\System\ObBUKaY.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\tOnpePJ.exe
  C:\Windows\System\tOnpePJ.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\AldERXE.exe
  C:\Windows\System\AldERXE.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\PMDlPvF.exe
  C:\Windows\System\PMDlPvF.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\VHLgydW.exe
  C:\Windows\System\VHLgydW.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\WdPFMLw.exe
  C:\Windows\System\WdPFMLw.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\pbYZZEN.exe
  C:\Windows\System\pbYZZEN.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\OnOmiIl.exe
  C:\Windows\System\OnOmiIl.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\LLNZfBH.exe
  C:\Windows\System\LLNZfBH.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\IPgGXDh.exe
  C:\Windows\System\IPgGXDh.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\pBPLfpr.exe
  C:\Windows\System\pBPLfpr.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\keNtKbG.exe
  C:\Windows\System\keNtKbG.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\QDyGAcG.exe
  C:\Windows\System\QDyGAcG.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\GfJrJGu.exe
  C:\Windows\System\GfJrJGu.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\aXKPgtv.exe
  C:\Windows\System\aXKPgtv.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\JIAwywk.exe
  C:\Windows\System\JIAwywk.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\VVfuKjW.exe
  C:\Windows\System\VVfuKjW.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\dGCigKy.exe
  C:\Windows\System\dGCigKy.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\hmmtayn.exe
  C:\Windows\System\hmmtayn.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\reMdqDP.exe
  C:\Windows\System\reMdqDP.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\nqXYDnn.exe
  C:\Windows\System\nqXYDnn.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\YoPJNXa.exe
  C:\Windows\System\YoPJNXa.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\yKYsTVu.exe
  C:\Windows\System\yKYsTVu.exe
  2⤵
  PID:4892
- C:\Windows\System\YlLymvK.exe
  C:\Windows\System\YlLymvK.exe
  2⤵
  PID:1772
- C:\Windows\System\ViBfVhx.exe
  C:\Windows\System\ViBfVhx.exe
  2⤵
  PID:2328
- C:\Windows\System\ScyDYMs.exe
  C:\Windows\System\ScyDYMs.exe
  2⤵
  PID:2292
- C:\Windows\System\sSmEZMJ.exe
  C:\Windows\System\sSmEZMJ.exe
  2⤵
  PID:1200
- C:\Windows\System\rqhgHCo.exe
  C:\Windows\System\rqhgHCo.exe
  2⤵
  PID:2952
- C:\Windows\System\VoGxibA.exe
  C:\Windows\System\VoGxibA.exe
  2⤵
  PID:4972
- C:\Windows\System\EaJxUTQ.exe
  C:\Windows\System\EaJxUTQ.exe
  2⤵
  PID:4428
- C:\Windows\System\eoPKyGy.exe
  C:\Windows\System\eoPKyGy.exe
  2⤵
  PID:4876
- C:\Windows\System\TuGktMn.exe
  C:\Windows\System\TuGktMn.exe
  2⤵
  PID:4076
- C:\Windows\System\tCrnBIq.exe
  C:\Windows\System\tCrnBIq.exe
  2⤵
  PID:2528
- C:\Windows\System\WSHooha.exe
  C:\Windows\System\WSHooha.exe
  2⤵
  PID:1992
- C:\Windows\System\eQrGAzm.exe
  C:\Windows\System\eQrGAzm.exe
  2⤵
  PID:2624
- C:\Windows\System\XiyTtXX.exe
  C:\Windows\System\XiyTtXX.exe
  2⤵
  PID:4828
- C:\Windows\System\PKKIeBk.exe
  C:\Windows\System\PKKIeBk.exe
  2⤵
  PID:2944
- C:\Windows\System\zzJJmPK.exe
  C:\Windows\System\zzJJmPK.exe
  2⤵
  PID:1280
- C:\Windows\System\DwNGRdD.exe
  C:\Windows\System\DwNGRdD.exe
  2⤵
  PID:1436
- C:\Windows\System\Fvzkipe.exe
  C:\Windows\System\Fvzkipe.exe
  2⤵
  PID:4800
- C:\Windows\System\LFVnVkd.exe
  C:\Windows\System\LFVnVkd.exe
  2⤵
  PID:3948
- C:\Windows\System\sSeXOkn.exe
  C:\Windows\System\sSeXOkn.exe
  2⤵
  PID:5132
- C:\Windows\System\buUKClC.exe
  C:\Windows\System\buUKClC.exe
  2⤵
  PID:5268
- C:\Windows\System\PHYHSSz.exe
  C:\Windows\System\PHYHSSz.exe
  2⤵
  PID:5284
- C:\Windows\System\eluKdXs.exe
  C:\Windows\System\eluKdXs.exe
  2⤵
  PID:5308
- C:\Windows\System\fuMwTCy.exe
  C:\Windows\System\fuMwTCy.exe
  2⤵
  PID:5324
- C:\Windows\System\yPRGKpP.exe
  C:\Windows\System\yPRGKpP.exe
  2⤵
  PID:5340
- C:\Windows\System\GgaMAnY.exe
  C:\Windows\System\GgaMAnY.exe
  2⤵
  PID:5360
- C:\Windows\System\GnWiZFA.exe
  C:\Windows\System\GnWiZFA.exe
  2⤵
  PID:5376
- C:\Windows\System\fVXsZtj.exe
  C:\Windows\System\fVXsZtj.exe
  2⤵
  PID:5392
- C:\Windows\System\vxugzCP.exe
  C:\Windows\System\vxugzCP.exe
  2⤵
  PID:5408
- C:\Windows\System\myTAYMA.exe
  C:\Windows\System\myTAYMA.exe
  2⤵
  PID:5432
- C:\Windows\System\NUVjXCz.exe
  C:\Windows\System\NUVjXCz.exe
  2⤵
  PID:5456
- C:\Windows\System\BaQTAoa.exe
  C:\Windows\System\BaQTAoa.exe
  2⤵
  PID:5488
- C:\Windows\System\XjVogac.exe
  C:\Windows\System\XjVogac.exe
  2⤵
  PID:5508
- C:\Windows\System\UefRsdB.exe
  C:\Windows\System\UefRsdB.exe
  2⤵
  PID:5528
- C:\Windows\System\usrOQXf.exe
  C:\Windows\System\usrOQXf.exe
  2⤵
  PID:5552
- C:\Windows\System\pHrjgZB.exe
  C:\Windows\System\pHrjgZB.exe
  2⤵
  PID:5572
- C:\Windows\System\mcKXqzX.exe
  C:\Windows\System\mcKXqzX.exe
  2⤵
  PID:5592
- C:\Windows\System\SPYRcdi.exe
  C:\Windows\System\SPYRcdi.exe
  2⤵
  PID:5616
- C:\Windows\System\Vrgtzyo.exe
  C:\Windows\System\Vrgtzyo.exe
  2⤵
  PID:5640
- C:\Windows\System\lDQqfyY.exe
  C:\Windows\System\lDQqfyY.exe
  2⤵
  PID:5664
- C:\Windows\System\cJEFsOr.exe
  C:\Windows\System\cJEFsOr.exe
  2⤵
  PID:5688
- C:\Windows\System\LHubEgs.exe
  C:\Windows\System\LHubEgs.exe
  2⤵
  PID:5704
- C:\Windows\System\YfygIYb.exe
  C:\Windows\System\YfygIYb.exe
  2⤵
  PID:5724
- C:\Windows\System\hgUoWqL.exe
  C:\Windows\System\hgUoWqL.exe
  2⤵
  PID:5744
- C:\Windows\System\hjKjvYZ.exe
  C:\Windows\System\hjKjvYZ.exe
  2⤵
  PID:5764
- C:\Windows\System\WlxABXo.exe
  C:\Windows\System\WlxABXo.exe
  2⤵
  PID:5788
- C:\Windows\System\DHOlFPO.exe
  C:\Windows\System\DHOlFPO.exe
  2⤵
  PID:5820
- C:\Windows\System\vxDpJYq.exe
  C:\Windows\System\vxDpJYq.exe
  2⤵
  PID:5868
- C:\Windows\System\BvjqNTd.exe
  C:\Windows\System\BvjqNTd.exe
  2⤵
  PID:5892
- C:\Windows\System\LpXibRN.exe
  C:\Windows\System\LpXibRN.exe
  2⤵
  PID:5940
- C:\Windows\System\nQcWQBk.exe
  C:\Windows\System\nQcWQBk.exe
  2⤵
  PID:5972
- C:\Windows\System\dvwctYB.exe
  C:\Windows\System\dvwctYB.exe
  2⤵
  PID:5992
- C:\Windows\System\rocuqmf.exe
  C:\Windows\System\rocuqmf.exe
  2⤵
  PID:6008
- C:\Windows\System\yJlchux.exe
  C:\Windows\System\yJlchux.exe
  2⤵
  PID:6032
- C:\Windows\System\gXFFJyh.exe
  C:\Windows\System\gXFFJyh.exe
  2⤵
  PID:6056
- C:\Windows\System\yxIgSyy.exe
  C:\Windows\System\yxIgSyy.exe
  2⤵
  PID:6072
- C:\Windows\System\cGWmcYL.exe
  C:\Windows\System\cGWmcYL.exe
  2⤵
  PID:6096
- C:\Windows\System\KqdjxVE.exe
  C:\Windows\System\KqdjxVE.exe
  2⤵
  PID:6116
- C:\Windows\System\zyAiJbT.exe
  C:\Windows\System\zyAiJbT.exe
  2⤵
  PID:6136
- C:\Windows\System\idlhPHA.exe
  C:\Windows\System\idlhPHA.exe
  2⤵
  PID:1496
- C:\Windows\System\RlWENgm.exe
  C:\Windows\System\RlWENgm.exe
  2⤵
  PID:3920
- C:\Windows\System\jXwkTtG.exe
  C:\Windows\System\jXwkTtG.exe
  2⤵
  PID:5084
- C:\Windows\System\eSCMZFu.exe
  C:\Windows\System\eSCMZFu.exe
  2⤵
  PID:3936
- C:\Windows\System\bnVnisd.exe
  C:\Windows\System\bnVnisd.exe
  2⤵
  PID:4408
- C:\Windows\System\gjJDPuP.exe
  C:\Windows\System\gjJDPuP.exe
  2⤵
  PID:972
- C:\Windows\System\RisDLzl.exe
  C:\Windows\System\RisDLzl.exe
  2⤵
  PID:3840
- C:\Windows\System\MEbceSP.exe
  C:\Windows\System\MEbceSP.exe
  2⤵
  PID:4980
- C:\Windows\System\TQOUMiX.exe
  C:\Windows\System\TQOUMiX.exe
  2⤵
  PID:1712
- C:\Windows\System\YpDwmsQ.exe
  C:\Windows\System\YpDwmsQ.exe
  2⤵
  PID:4020
- C:\Windows\System\LWbMCzF.exe
  C:\Windows\System\LWbMCzF.exe
  2⤵
  PID:5652
- C:\Windows\System\fMUJZYl.exe
  C:\Windows\System\fMUJZYl.exe
  2⤵
  PID:5740
- C:\Windows\System\BeIoMSf.exe
  C:\Windows\System\BeIoMSf.exe
  2⤵
  PID:1356
- C:\Windows\System\XaanIoH.exe
  C:\Windows\System\XaanIoH.exe
  2⤵
  PID:5524
- C:\Windows\System\hAFiURz.exe
  C:\Windows\System\hAFiURz.exe
  2⤵
  PID:5624
- C:\Windows\System\wuqahHg.exe
  C:\Windows\System\wuqahHg.exe
  2⤵
  PID:5812
- C:\Windows\System\SwgFwdd.exe
  C:\Windows\System\SwgFwdd.exe
  2⤵
  PID:5264
- C:\Windows\System\CeUHFAM.exe
  C:\Windows\System\CeUHFAM.exe
  2⤵
  PID:4768
- C:\Windows\System\ibpkwsY.exe
  C:\Windows\System\ibpkwsY.exe
  2⤵
  PID:5276
- C:\Windows\System\LgcRoFM.exe
  C:\Windows\System\LgcRoFM.exe
  2⤵
  PID:6172
- C:\Windows\System\SjMwdfr.exe
  C:\Windows\System\SjMwdfr.exe
  2⤵
  PID:6192
- C:\Windows\System\gdmkkfm.exe
  C:\Windows\System\gdmkkfm.exe
  2⤵
  PID:6216
- C:\Windows\System\VIXMHWq.exe
  C:\Windows\System\VIXMHWq.exe
  2⤵
  PID:6236
- C:\Windows\System\zRgdqQe.exe
  C:\Windows\System\zRgdqQe.exe
  2⤵
  PID:6256
- C:\Windows\System\mkcNHUP.exe
  C:\Windows\System\mkcNHUP.exe
  2⤵
  PID:6276
- C:\Windows\System\lyPJTYN.exe
  C:\Windows\System\lyPJTYN.exe
  2⤵
  PID:6300
- C:\Windows\System\zcyyHjC.exe
  C:\Windows\System\zcyyHjC.exe
  2⤵
  PID:6320
- C:\Windows\System\NBpncNN.exe
  C:\Windows\System\NBpncNN.exe
  2⤵
  PID:6344
- C:\Windows\System\uXGuAyy.exe
  C:\Windows\System\uXGuAyy.exe
  2⤵
  PID:6364
- C:\Windows\System\pudPbFY.exe
  C:\Windows\System\pudPbFY.exe
  2⤵
  PID:6392
- C:\Windows\System\EbhHVqK.exe
  C:\Windows\System\EbhHVqK.exe
  2⤵
  PID:6412
- C:\Windows\System\JxYKyqY.exe
  C:\Windows\System\JxYKyqY.exe
  2⤵
  PID:6440
- C:\Windows\System\wkeJpar.exe
  C:\Windows\System\wkeJpar.exe
  2⤵
  PID:6456
- C:\Windows\System\GaSdygS.exe
  C:\Windows\System\GaSdygS.exe
  2⤵
  PID:6476
- C:\Windows\System\ivTuizM.exe
  C:\Windows\System\ivTuizM.exe
  2⤵
  PID:6516
- C:\Windows\System\pinnMfy.exe
  C:\Windows\System\pinnMfy.exe
  2⤵
  PID:6536
- C:\Windows\System\aKMAMzb.exe
  C:\Windows\System\aKMAMzb.exe
  2⤵
  PID:6556
- C:\Windows\System\nWMPQaU.exe
  C:\Windows\System\nWMPQaU.exe
  2⤵
  PID:6580
- C:\Windows\System\YCQUdld.exe
  C:\Windows\System\YCQUdld.exe
  2⤵
  PID:6820
- C:\Windows\System\TFJMBAa.exe
  C:\Windows\System\TFJMBAa.exe
  2⤵
  PID:6844
- C:\Windows\System\QgBUXdX.exe
  C:\Windows\System\QgBUXdX.exe
  2⤵
  PID:6868
- C:\Windows\System\IBdqNcM.exe
  C:\Windows\System\IBdqNcM.exe
  2⤵
  PID:6896
- C:\Windows\System\QVxeKhZ.exe
  C:\Windows\System\QVxeKhZ.exe
  2⤵
  PID:6916
- C:\Windows\System\LHOzLob.exe
  C:\Windows\System\LHOzLob.exe
  2⤵
  PID:6948
- C:\Windows\System\cqECXMU.exe
  C:\Windows\System\cqECXMU.exe
  2⤵
  PID:6968
- C:\Windows\System\SzMMWqO.exe
  C:\Windows\System\SzMMWqO.exe
  2⤵
  PID:6992
- C:\Windows\System\CxeQRvT.exe
  C:\Windows\System\CxeQRvT.exe
  2⤵
  PID:7020
- C:\Windows\System\dMyKBxo.exe
  C:\Windows\System\dMyKBxo.exe
  2⤵
  PID:7036
- C:\Windows\System\lSeHnDs.exe
  C:\Windows\System\lSeHnDs.exe
  2⤵
  PID:7064
- C:\Windows\System\ZjrZcBH.exe
  C:\Windows\System\ZjrZcBH.exe
  2⤵
  PID:7084
- C:\Windows\System\NtkYlBa.exe
  C:\Windows\System\NtkYlBa.exe
  2⤵
  PID:7108
- C:\Windows\System\xvmSyVa.exe
  C:\Windows\System\xvmSyVa.exe
  2⤵
  PID:7128
- C:\Windows\System\AKfTLmC.exe
  C:\Windows\System\AKfTLmC.exe
  2⤵
  PID:7152
- C:\Windows\System\BxrVzcI.exe
  C:\Windows\System\BxrVzcI.exe
  2⤵
  PID:5292
- C:\Windows\System\HJLkJJe.exe
  C:\Windows\System\HJLkJJe.exe
  2⤵
  PID:5320
- C:\Windows\System\OsLqhcS.exe
  C:\Windows\System\OsLqhcS.exe
  2⤵
  PID:5384
- C:\Windows\System\BKZvEek.exe
  C:\Windows\System\BKZvEek.exe
  2⤵
  PID:5428
- C:\Windows\System\OQcUFfg.exe
  C:\Windows\System\OQcUFfg.exe
  2⤵
  PID:5844
- C:\Windows\System\hvRcBSQ.exe
  C:\Windows\System\hvRcBSQ.exe
  2⤵
  PID:3392
- C:\Windows\System\vTZANdj.exe
  C:\Windows\System\vTZANdj.exe
  2⤵
  PID:6352
- C:\Windows\System\cQmTCpr.exe
  C:\Windows\System\cQmTCpr.exe
  2⤵
  PID:5932
- C:\Windows\System\rEjJCUa.exe
  C:\Windows\System\rEjJCUa.exe
  2⤵
  PID:6652
- C:\Windows\System\SKNYcSw.exe
  C:\Windows\System\SKNYcSw.exe
  2⤵
  PID:6672
- C:\Windows\System\Ohghdee.exe
  C:\Windows\System\Ohghdee.exe
  2⤵
  PID:6696
- C:\Windows\System\rzMIQtd.exe
  C:\Windows\System\rzMIQtd.exe
  2⤵
  PID:6724
- C:\Windows\System\WtJqUCx.exe
  C:\Windows\System\WtJqUCx.exe
  2⤵
  PID:6752
- C:\Windows\System\jsgUusk.exe
  C:\Windows\System\jsgUusk.exe
  2⤵
  PID:6772
- C:\Windows\System\UyDQNYo.exe
  C:\Windows\System\UyDQNYo.exe
  2⤵
  PID:5956
- C:\Windows\System\pPjTMlJ.exe
  C:\Windows\System\pPjTMlJ.exe
  2⤵
  PID:6020
- C:\Windows\System\WjbaWta.exe
  C:\Windows\System\WjbaWta.exe
  2⤵
  PID:6064
- C:\Windows\System\JAdrbXi.exe
  C:\Windows\System\JAdrbXi.exe
  2⤵
  PID:4888
- C:\Windows\System\JosHgiW.exe
  C:\Windows\System\JosHgiW.exe
  2⤵
  PID:4300
- C:\Windows\System\jIwmuBR.exe
  C:\Windows\System\jIwmuBR.exe
  2⤵
  PID:3448
- C:\Windows\System\jzviTbY.exe
  C:\Windows\System\jzviTbY.exe
  2⤵
  PID:644
- C:\Windows\System\QzqdXGM.exe
  C:\Windows\System\QzqdXGM.exe
  2⤵
  PID:6156
- C:\Windows\System\qTnHKLd.exe
  C:\Windows\System\qTnHKLd.exe
  2⤵
  PID:6264
- C:\Windows\System\DsPVcsb.exe
  C:\Windows\System\DsPVcsb.exe
  2⤵
  PID:6328
- C:\Windows\System\tsuYbko.exe
  C:\Windows\System\tsuYbko.exe
  2⤵
  PID:6408
- C:\Windows\System\GHSyrGQ.exe
  C:\Windows\System\GHSyrGQ.exe
  2⤵
  PID:4072
- C:\Windows\System\alYclyH.exe
  C:\Windows\System\alYclyH.exe
  2⤵
  PID:5128
- C:\Windows\System\aGvjHHM.exe
  C:\Windows\System\aGvjHHM.exe
  2⤵
  PID:5784
- C:\Windows\System\hNnuvFX.exe
  C:\Windows\System\hNnuvFX.exe
  2⤵
  PID:184
- C:\Windows\System\xrYHtvX.exe
  C:\Windows\System\xrYHtvX.exe
  2⤵
  PID:5260
- C:\Windows\System\fmnvAjv.exe
  C:\Windows\System\fmnvAjv.exe
  2⤵
  PID:5140
- C:\Windows\System\PtxlZKl.exe
  C:\Windows\System\PtxlZKl.exe
  2⤵
  PID:6376
- C:\Windows\System\WmBORih.exe
  C:\Windows\System\WmBORih.exe
  2⤵
  PID:7188
- C:\Windows\System\UzeYNzs.exe
  C:\Windows\System\UzeYNzs.exe
  2⤵
  PID:7212
- C:\Windows\System\cMpDLPV.exe
  C:\Windows\System\cMpDLPV.exe
  2⤵
  PID:7236
- C:\Windows\System\BtcENSy.exe
  C:\Windows\System\BtcENSy.exe
  2⤵
  PID:7268
- C:\Windows\System\yngKVbd.exe
  C:\Windows\System\yngKVbd.exe
  2⤵
  PID:7296
- C:\Windows\System\swtCeGV.exe
  C:\Windows\System\swtCeGV.exe
  2⤵
  PID:7316
- C:\Windows\System\VthUZdF.exe
  C:\Windows\System\VthUZdF.exe
  2⤵
  PID:7336
- C:\Windows\System\nBkPJRw.exe
  C:\Windows\System\nBkPJRw.exe
  2⤵
  PID:7352
- C:\Windows\System\zETRiad.exe
  C:\Windows\System\zETRiad.exe
  2⤵
  PID:7368
- C:\Windows\System\MTqoOZV.exe
  C:\Windows\System\MTqoOZV.exe
  2⤵
  PID:7388
- C:\Windows\System\SVmAAny.exe
  C:\Windows\System\SVmAAny.exe
  2⤵
  PID:7404
- C:\Windows\System\FvezndB.exe
  C:\Windows\System\FvezndB.exe
  2⤵
  PID:7432
- C:\Windows\System\POAgBii.exe
  C:\Windows\System\POAgBii.exe
  2⤵
  PID:7456
- C:\Windows\System\iUgszLw.exe
  C:\Windows\System\iUgszLw.exe
  2⤵
  PID:7484
- C:\Windows\System\JciIjRs.exe
  C:\Windows\System\JciIjRs.exe
  2⤵
  PID:7504
- C:\Windows\System\BzfEbWJ.exe
  C:\Windows\System\BzfEbWJ.exe
  2⤵
  PID:7520
- C:\Windows\System\PoNvlcP.exe
  C:\Windows\System\PoNvlcP.exe
  2⤵
  PID:7540
- C:\Windows\System\rTEhOAG.exe
  C:\Windows\System\rTEhOAG.exe
  2⤵
  PID:7604
- C:\Windows\System\jXNZsEu.exe
  C:\Windows\System\jXNZsEu.exe
  2⤵
  PID:7632
- C:\Windows\System\auZOoHN.exe
  C:\Windows\System\auZOoHN.exe
  2⤵
  PID:7660
- C:\Windows\System\AnSEsAn.exe
  C:\Windows\System\AnSEsAn.exe
  2⤵
  PID:7680
- C:\Windows\System\TjijaDE.exe
  C:\Windows\System\TjijaDE.exe
  2⤵
  PID:7704
- C:\Windows\System\eVSPKwg.exe
  C:\Windows\System\eVSPKwg.exe
  2⤵
  PID:7732
- C:\Windows\System\OzixfGp.exe
  C:\Windows\System\OzixfGp.exe
  2⤵
  PID:7752
- C:\Windows\System\cElADOA.exe
  C:\Windows\System\cElADOA.exe
  2⤵
  PID:7776
- C:\Windows\System\kVhQCqa.exe
  C:\Windows\System\kVhQCqa.exe
  2⤵
  PID:7804
- C:\Windows\System\XneTPKF.exe
  C:\Windows\System\XneTPKF.exe
  2⤵
  PID:7836
- C:\Windows\System\VnGDjVN.exe
  C:\Windows\System\VnGDjVN.exe
  2⤵
  PID:7860
- C:\Windows\System\GVOqaRy.exe
  C:\Windows\System\GVOqaRy.exe
  2⤵
  PID:7888
- C:\Windows\System\FINEXJX.exe
  C:\Windows\System\FINEXJX.exe
  2⤵
  PID:7904
- C:\Windows\System\HDYkmGM.exe
  C:\Windows\System\HDYkmGM.exe
  2⤵
  PID:7928
- C:\Windows\System\alWwQza.exe
  C:\Windows\System\alWwQza.exe
  2⤵
  PID:7952
- C:\Windows\System\xUszDeJ.exe
  C:\Windows\System\xUszDeJ.exe
  2⤵
  PID:7972
- C:\Windows\System\oeWkDKM.exe
  C:\Windows\System\oeWkDKM.exe
  2⤵
  PID:7992
- C:\Windows\System\SJQcWQt.exe
  C:\Windows\System\SJQcWQt.exe
  2⤵
  PID:8020
- C:\Windows\System\WynyibH.exe
  C:\Windows\System\WynyibH.exe
  2⤵
  PID:8040
- C:\Windows\System\UyjUpQz.exe
  C:\Windows\System\UyjUpQz.exe
  2⤵
  PID:8068
- C:\Windows\System\LdrgXcZ.exe
  C:\Windows\System\LdrgXcZ.exe
  2⤵
  PID:8084
- C:\Windows\System\irOHniF.exe
  C:\Windows\System\irOHniF.exe
  2⤵
  PID:8108
- C:\Windows\System\sRDFfcZ.exe
  C:\Windows\System\sRDFfcZ.exe
  2⤵
  PID:8136
- C:\Windows\System\OqZxCXY.exe
  C:\Windows\System\OqZxCXY.exe
  2⤵
  PID:8160
- C:\Windows\System\frkgHrO.exe
  C:\Windows\System\frkgHrO.exe
  2⤵
  PID:8180
- C:\Windows\System\IJrqxVq.exe
  C:\Windows\System\IJrqxVq.exe
  2⤵
  PID:6668
- C:\Windows\System\IaBhUxx.exe
  C:\Windows\System\IaBhUxx.exe
  2⤵
  PID:6764
- C:\Windows\System\PDbOTjm.exe
  C:\Windows\System\PDbOTjm.exe
  2⤵
  PID:6084
- C:\Windows\System\fJKxAdY.exe
  C:\Windows\System\fJKxAdY.exe
  2⤵
  PID:6452
- C:\Windows\System\qlxlClW.exe
  C:\Windows\System\qlxlClW.exe
  2⤵
  PID:4064
- C:\Windows\System\JeorNKq.exe
  C:\Windows\System\JeorNKq.exe
  2⤵
  PID:5416
- C:\Windows\System\AoDurmd.exe
  C:\Windows\System\AoDurmd.exe
  2⤵
  PID:3544
- C:\Windows\System\XcFlcSb.exe
  C:\Windows\System\XcFlcSb.exe
  2⤵
  PID:6564
- C:\Windows\System\geQBTqm.exe
  C:\Windows\System\geQBTqm.exe
  2⤵
  PID:6620
- C:\Windows\System\kPClDJm.exe
  C:\Windows\System\kPClDJm.exe
  2⤵
  PID:6852
- C:\Windows\System\NmCPwVR.exe
  C:\Windows\System\NmCPwVR.exe
  2⤵
  PID:6904
- C:\Windows\System\UeCneHm.exe
  C:\Windows\System\UeCneHm.exe
  2⤵
  PID:7048
- C:\Windows\System\AKbEyfE.exe
  C:\Windows\System\AKbEyfE.exe
  2⤵
  PID:7004
- C:\Windows\System\IHZdEGd.exe
  C:\Windows\System\IHZdEGd.exe
  2⤵
  PID:6936
- C:\Windows\System\LpYrtVo.exe
  C:\Windows\System\LpYrtVo.exe
  2⤵
  PID:7116
- C:\Windows\System\pknRWje.exe
  C:\Windows\System\pknRWje.exe
  2⤵
  PID:7120
- C:\Windows\System\dNwMtlP.exe
  C:\Windows\System\dNwMtlP.exe
  2⤵
  PID:6316
- C:\Windows\System\yDbtYiS.exe
  C:\Windows\System\yDbtYiS.exe
  2⤵
  PID:7208
- C:\Windows\System\KtORZZy.exe
  C:\Windows\System\KtORZZy.exe
  2⤵
  PID:6432
- C:\Windows\System\IOJpMzW.exe
  C:\Windows\System\IOJpMzW.exe
  2⤵
  PID:5024
- C:\Windows\System\QAzxrLN.exe
  C:\Windows\System\QAzxrLN.exe
  2⤵
  PID:6648
- C:\Windows\System\zdOZskF.exe
  C:\Windows\System\zdOZskF.exe
  2⤵
  PID:4772
- C:\Windows\System\xORFIPi.exe
  C:\Windows\System\xORFIPi.exe
  2⤵
  PID:7876
- C:\Windows\System\EfFNrvH.exe
  C:\Windows\System\EfFNrvH.exe
  2⤵
  PID:7960
- C:\Windows\System\srumIic.exe
  C:\Windows\System\srumIic.exe
  2⤵
  PID:8100
- C:\Windows\System\AWskehQ.exe
  C:\Windows\System\AWskehQ.exe
  2⤵
  PID:6976
- C:\Windows\System\YBROKRq.exe
  C:\Windows\System\YBROKRq.exe
  2⤵
  PID:6104
- C:\Windows\System\ULCzYTC.exe
  C:\Windows\System\ULCzYTC.exe
  2⤵
  PID:7200
- C:\Windows\System\ItbeUDU.exe
  C:\Windows\System\ItbeUDU.exe
  2⤵
  PID:7440
- C:\Windows\System\jYUWSwK.exe
  C:\Windows\System\jYUWSwK.exe
  2⤵
  PID:7512
- C:\Windows\System\CSafPVE.exe
  C:\Windows\System\CSafPVE.exe
  2⤵
  PID:8200
- C:\Windows\System\zKfHfki.exe
  C:\Windows\System\zKfHfki.exe
  2⤵
  PID:8228
- C:\Windows\System\tiShiAE.exe
  C:\Windows\System\tiShiAE.exe
  2⤵
  PID:8252
- C:\Windows\System\WpvtLuv.exe
  C:\Windows\System\WpvtLuv.exe
  2⤵
  PID:8284
- C:\Windows\System\ynuaovf.exe
  C:\Windows\System\ynuaovf.exe
  2⤵
  PID:8320
- C:\Windows\System\Scujphq.exe
  C:\Windows\System\Scujphq.exe
  2⤵
  PID:8348
- C:\Windows\System\qFDlAJJ.exe
  C:\Windows\System\qFDlAJJ.exe
  2⤵
  PID:8368
- C:\Windows\System\ZCpLzBV.exe
  C:\Windows\System\ZCpLzBV.exe
  2⤵
  PID:8392
- C:\Windows\System\XuPPFLR.exe
  C:\Windows\System\XuPPFLR.exe
  2⤵
  PID:8416
- C:\Windows\System\wVvouHs.exe
  C:\Windows\System\wVvouHs.exe
  2⤵
  PID:8444
- C:\Windows\System\RgFVykn.exe
  C:\Windows\System\RgFVykn.exe
  2⤵
  PID:8468
- C:\Windows\System\lSCFXPe.exe
  C:\Windows\System\lSCFXPe.exe
  2⤵
  PID:8508
- C:\Windows\System\KXnMYZW.exe
  C:\Windows\System\KXnMYZW.exe
  2⤵
  PID:8532
- C:\Windows\System\VxBRkOK.exe
  C:\Windows\System\VxBRkOK.exe
  2⤵
  PID:8552
- C:\Windows\System\QgLLyZh.exe
  C:\Windows\System\QgLLyZh.exe
  2⤵
  PID:8576
- C:\Windows\System\eRfizAL.exe
  C:\Windows\System\eRfizAL.exe
  2⤵
  PID:8596
- C:\Windows\System\mBXpxBO.exe
  C:\Windows\System\mBXpxBO.exe
  2⤵
  PID:8672
- C:\Windows\System\kTkKnAG.exe
  C:\Windows\System\kTkKnAG.exe
  2⤵
  PID:8692
- C:\Windows\System\owkKFzg.exe
  C:\Windows\System\owkKFzg.exe
  2⤵
  PID:8712
- C:\Windows\System\BtWQtho.exe
  C:\Windows\System\BtWQtho.exe
  2⤵
  PID:8732
- C:\Windows\System\KZYKdZj.exe
  C:\Windows\System\KZYKdZj.exe
  2⤵
  PID:8748
- C:\Windows\System\EwaKTyf.exe
  C:\Windows\System\EwaKTyf.exe
  2⤵
  PID:8764
- C:\Windows\System\xSDafMO.exe
  C:\Windows\System\xSDafMO.exe
  2⤵
  PID:8780
- C:\Windows\System\uZALSDw.exe
  C:\Windows\System\uZALSDw.exe
  2⤵
  PID:8828
- C:\Windows\System\tyjHhui.exe
  C:\Windows\System\tyjHhui.exe
  2⤵
  PID:8848
- C:\Windows\System\TtgLEOI.exe
  C:\Windows\System\TtgLEOI.exe
  2⤵
  PID:8880
- C:\Windows\System\VvYpQuV.exe
  C:\Windows\System\VvYpQuV.exe
  2⤵
  PID:8912
- C:\Windows\System\bAuGCtQ.exe
  C:\Windows\System\bAuGCtQ.exe
  2⤵
  PID:8940
- C:\Windows\System\UJGPIEr.exe
  C:\Windows\System\UJGPIEr.exe
  2⤵
  PID:8972
- C:\Windows\System\uvKpcve.exe
  C:\Windows\System\uvKpcve.exe
  2⤵
  PID:8992
- C:\Windows\System\CrgfHxJ.exe
  C:\Windows\System\CrgfHxJ.exe
  2⤵
  PID:9016
- C:\Windows\System\XvLuIzk.exe
  C:\Windows\System\XvLuIzk.exe
  2⤵
  PID:9036
- C:\Windows\System\JoAikeh.exe
  C:\Windows\System\JoAikeh.exe
  2⤵
  PID:9052
- C:\Windows\System\XamzeHB.exe
  C:\Windows\System\XamzeHB.exe
  2⤵
  PID:9068
- C:\Windows\System\RYVfdwv.exe
  C:\Windows\System\RYVfdwv.exe
  2⤵
  PID:9088
- C:\Windows\System\hwetxiQ.exe
  C:\Windows\System\hwetxiQ.exe
  2⤵
  PID:9104
- C:\Windows\System\pvwFagP.exe
  C:\Windows\System\pvwFagP.exe
  2⤵
  PID:9124
- C:\Windows\System\ohwuszU.exe
  C:\Windows\System\ohwuszU.exe
  2⤵
  PID:9140
- C:\Windows\System\gUorSce.exe
  C:\Windows\System\gUorSce.exe
  2⤵
  PID:9156
- C:\Windows\System\zBYFnHs.exe
  C:\Windows\System\zBYFnHs.exe
  2⤵
  PID:9172
- C:\Windows\System\CkHDVMX.exe
  C:\Windows\System\CkHDVMX.exe
  2⤵
  PID:9192
- C:\Windows\System\DSriNNG.exe
  C:\Windows\System\DSriNNG.exe
  2⤵
  PID:7560
- C:\Windows\System\FNEiVOQ.exe
  C:\Windows\System\FNEiVOQ.exe
  2⤵
  PID:7612
- C:\Windows\System\tZtwVwL.exe
  C:\Windows\System\tZtwVwL.exe
  2⤵
  PID:7700
- C:\Windows\System\oTlbajr.exe
  C:\Windows\System\oTlbajr.exe
  2⤵
  PID:7812
- C:\Windows\System\VWfdjMg.exe
  C:\Windows\System\VWfdjMg.exe
  2⤵
  PID:8000
- C:\Windows\System\fkBbXmq.exe
  C:\Windows\System\fkBbXmq.exe
  2⤵
  PID:8080
- C:\Windows\System\ngWXnAX.exe
  C:\Windows\System\ngWXnAX.exe
  2⤵
  PID:8156
- C:\Windows\System\hlueJRT.exe
  C:\Windows\System\hlueJRT.exe
  2⤵
  PID:6112
- C:\Windows\System\GGvGtLZ.exe
  C:\Windows\System\GGvGtLZ.exe
  2⤵
  PID:6836
- C:\Windows\System\zuEjdDt.exe
  C:\Windows\System\zuEjdDt.exe
  2⤵
  PID:7144
- C:\Windows\System\uQrsTTX.exe
  C:\Windows\System\uQrsTTX.exe
  2⤵
  PID:6180
- C:\Windows\System\EzQlglD.exe
  C:\Windows\System\EzQlglD.exe
  2⤵
  PID:4952
- C:\Windows\System\IxLZpRH.exe
  C:\Windows\System\IxLZpRH.exe
  2⤵
  PID:8344
- C:\Windows\System\UBkLPwz.exe
  C:\Windows\System\UBkLPwz.exe
  2⤵
  PID:9240
- C:\Windows\System\EOBkYrp.exe
  C:\Windows\System\EOBkYrp.exe
  2⤵
  PID:9260
- C:\Windows\System\rSGdmmf.exe
  C:\Windows\System\rSGdmmf.exe
  2⤵
  PID:9280
- C:\Windows\System\CNDOAvv.exe
  C:\Windows\System\CNDOAvv.exe
  2⤵
  PID:9304
- C:\Windows\System\NJuJRhZ.exe
  C:\Windows\System\NJuJRhZ.exe
  2⤵
  PID:9336
- C:\Windows\System\fbiQNOV.exe
  C:\Windows\System\fbiQNOV.exe
  2⤵
  PID:9356
- C:\Windows\System\ZVFArLR.exe
  C:\Windows\System\ZVFArLR.exe
  2⤵
  PID:9388
- C:\Windows\System\tvvswhq.exe
  C:\Windows\System\tvvswhq.exe
  2⤵
  PID:9408
- C:\Windows\System\UwGAhne.exe
  C:\Windows\System\UwGAhne.exe
  2⤵
  PID:9424
- C:\Windows\System\UqYRryG.exe
  C:\Windows\System\UqYRryG.exe
  2⤵
  PID:9448
- C:\Windows\System\ZUtGmef.exe
  C:\Windows\System\ZUtGmef.exe
  2⤵
  PID:9488
- C:\Windows\System\rSfNcqz.exe
  C:\Windows\System\rSfNcqz.exe
  2⤵
  PID:9508
- C:\Windows\System\qtmoIsU.exe
  C:\Windows\System\qtmoIsU.exe
  2⤵
  PID:9524
- C:\Windows\System\PDtoVkQ.exe
  C:\Windows\System\PDtoVkQ.exe
  2⤵
  PID:9540
- C:\Windows\System\bZuWLgx.exe
  C:\Windows\System\bZuWLgx.exe
  2⤵
  PID:9556
- C:\Windows\System\nstSmEj.exe
  C:\Windows\System\nstSmEj.exe
  2⤵
  PID:9572
- C:\Windows\System\mGsvjmp.exe
  C:\Windows\System\mGsvjmp.exe
  2⤵
  PID:9604
- C:\Windows\System\MHzoaPC.exe
  C:\Windows\System\MHzoaPC.exe
  2⤵
  PID:9624
- C:\Windows\System\UYXgPQG.exe
  C:\Windows\System\UYXgPQG.exe
  2⤵
  PID:9644
- C:\Windows\System\HOSSjyA.exe
  C:\Windows\System\HOSSjyA.exe
  2⤵
  PID:9660
- C:\Windows\System\CVMbEgp.exe
  C:\Windows\System\CVMbEgp.exe
  2⤵
  PID:9676
- C:\Windows\System\cHcoBom.exe
  C:\Windows\System\cHcoBom.exe
  2⤵
  PID:9696
- C:\Windows\System\Clbjbhb.exe
  C:\Windows\System\Clbjbhb.exe
  2⤵
  PID:9724
- C:\Windows\System\AisjUPD.exe
  C:\Windows\System\AisjUPD.exe
  2⤵
  PID:9772
- C:\Windows\System\TaFrdQV.exe
  C:\Windows\System\TaFrdQV.exe
  2⤵
  PID:9788
- C:\Windows\System\AMwCTCO.exe
  C:\Windows\System\AMwCTCO.exe
  2⤵
  PID:9824
- C:\Windows\System\ouKuOly.exe
  C:\Windows\System\ouKuOly.exe
  2⤵
  PID:9844
- C:\Windows\System\empKAeY.exe
  C:\Windows\System\empKAeY.exe
  2⤵
  PID:9860
- C:\Windows\System\TmphjTQ.exe
  C:\Windows\System\TmphjTQ.exe
  2⤵
  PID:9876
- C:\Windows\System\NljFFvH.exe
  C:\Windows\System\NljFFvH.exe
  2⤵
  PID:9892
- C:\Windows\System\AiykfZQ.exe
  C:\Windows\System\AiykfZQ.exe
  2⤵
  PID:9916
- C:\Windows\System\HHJPBZm.exe
  C:\Windows\System\HHJPBZm.exe
  2⤵
  PID:9952
- C:\Windows\System\MxHZbQT.exe
  C:\Windows\System\MxHZbQT.exe
  2⤵
  PID:9984
- C:\Windows\System\ljdVYnX.exe
  C:\Windows\System\ljdVYnX.exe
  2⤵
  PID:10016
- C:\Windows\System\ZPKLyLH.exe
  C:\Windows\System\ZPKLyLH.exe
  2⤵
  PID:10032
- C:\Windows\System\ZWlxiWY.exe
  C:\Windows\System\ZWlxiWY.exe
  2⤵
  PID:10052
- C:\Windows\System\pQcRtlL.exe
  C:\Windows\System\pQcRtlL.exe
  2⤵
  PID:10076
- C:\Windows\System\kXLegYl.exe
  C:\Windows\System\kXLegYl.exe
  2⤵
  PID:10100
- C:\Windows\System\RCElMgM.exe
  C:\Windows\System\RCElMgM.exe
  2⤵
  PID:10124
- C:\Windows\System\ZMujHZy.exe
  C:\Windows\System\ZMujHZy.exe
  2⤵
  PID:10144
- C:\Windows\System\eCHUdNN.exe
  C:\Windows\System\eCHUdNN.exe
  2⤵
  PID:10160
- C:\Windows\System\rfnaRiI.exe
  C:\Windows\System\rfnaRiI.exe
  2⤵
  PID:10192
- C:\Windows\System\ABZTZcd.exe
  C:\Windows\System\ABZTZcd.exe
  2⤵
  PID:10220
- C:\Windows\System\gnwdJjx.exe
  C:\Windows\System\gnwdJjx.exe
  2⤵
  PID:10236
- C:\Windows\System\jvihhad.exe
  C:\Windows\System\jvihhad.exe
  2⤵
  PID:436
- C:\Windows\System\uFJLMJq.exe
  C:\Windows\System\uFJLMJq.exe
  2⤵
  PID:6720
- C:\Windows\System\xRwHGFa.exe
  C:\Windows\System\xRwHGFa.exe
  2⤵
  PID:4104
- C:\Windows\System\sRQMpbT.exe
  C:\Windows\System\sRQMpbT.exe
  2⤵
  PID:8920
- C:\Windows\System\LLoRQoS.exe
  C:\Windows\System\LLoRQoS.exe
  2⤵
  PID:4040
- C:\Windows\System\rPHlFXX.exe
  C:\Windows\System\rPHlFXX.exe
  2⤵
  PID:7196
- C:\Windows\System\QntIGck.exe
  C:\Windows\System\QntIGck.exe
  2⤵
  PID:8240
- C:\Windows\System\NtRFOvW.exe
  C:\Windows\System\NtRFOvW.exe
  2⤵
  PID:8408
- C:\Windows\System\wRKSjNG.exe
  C:\Windows\System\wRKSjNG.exe
  2⤵
  PID:8452
- C:\Windows\System\eweXmUq.exe
  C:\Windows\System\eweXmUq.exe
  2⤵
  PID:8540
- C:\Windows\System\tRKVHNi.exe
  C:\Windows\System\tRKVHNi.exe
  2⤵
  PID:2576
- C:\Windows\System\OhpImcJ.exe
  C:\Windows\System\OhpImcJ.exe
  2⤵
  PID:7696
- C:\Windows\System\aWrOXxE.exe
  C:\Windows\System\aWrOXxE.exe
  2⤵
  PID:8172
- C:\Windows\System\YmeUMZL.exe
  C:\Windows\System\YmeUMZL.exe
  2⤵
  PID:8928
- C:\Windows\System\DWmpeVB.exe
  C:\Windows\System\DWmpeVB.exe
  2⤵
  PID:6816
- C:\Windows\System\RjyCkCx.exe
  C:\Windows\System\RjyCkCx.exe
  2⤵
  PID:9032
- C:\Windows\System\jxrotxL.exe
  C:\Windows\System\jxrotxL.exe
  2⤵
  PID:9612
- C:\Windows\System\agxnwJL.exe
  C:\Windows\System\agxnwJL.exe
  2⤵
  PID:9096
- C:\Windows\System\lPlxmpl.exe
  C:\Windows\System\lPlxmpl.exe
  2⤵
  PID:7516
- C:\Windows\System\rEKZAJM.exe
  C:\Windows\System\rEKZAJM.exe
  2⤵
  PID:8308
- C:\Windows\System\ZGGbuyv.exe
  C:\Windows\System\ZGGbuyv.exe
  2⤵
  PID:7948
- C:\Windows\System\wpItEFm.exe
  C:\Windows\System\wpItEFm.exe
  2⤵
  PID:8036
- C:\Windows\System\NmYZZWK.exe
  C:\Windows\System\NmYZZWK.exe
  2⤵
  PID:6760
- C:\Windows\System\PlDxOyU.exe
  C:\Windows\System\PlDxOyU.exe
  2⤵
  PID:5404
- C:\Windows\System\ZAaWXvj.exe
  C:\Windows\System\ZAaWXvj.exe
  2⤵
  PID:7012
- C:\Windows\System\GPNxmwR.exe
  C:\Windows\System\GPNxmwR.exe
  2⤵
  PID:5836
- C:\Windows\System\gzVtlFg.exe
  C:\Windows\System\gzVtlFg.exe
  2⤵
  PID:6204
- C:\Windows\System\mWyqitS.exe
  C:\Windows\System\mWyqitS.exe
  2⤵
  PID:8636
- C:\Windows\System\AzFzAQP.exe
  C:\Windows\System\AzFzAQP.exe
  2⤵
  PID:10248
- C:\Windows\System\cwTJgBf.exe
  C:\Windows\System\cwTJgBf.exe
  2⤵
  PID:10272
- C:\Windows\System\gVqKMQR.exe
  C:\Windows\System\gVqKMQR.exe
  2⤵
  PID:10292
- C:\Windows\System\qjyyNnV.exe
  C:\Windows\System\qjyyNnV.exe
  2⤵
  PID:10328
- C:\Windows\System\uqxqTEM.exe
  C:\Windows\System\uqxqTEM.exe
  2⤵
  PID:10348
- C:\Windows\System\JEhUmwM.exe
  C:\Windows\System\JEhUmwM.exe
  2⤵
  PID:10368
- C:\Windows\System\LiCBiIx.exe
  C:\Windows\System\LiCBiIx.exe
  2⤵
  PID:10384
- C:\Windows\System\vAOTNxE.exe
  C:\Windows\System\vAOTNxE.exe
  2⤵
  PID:10412
- C:\Windows\System\XjvFMqs.exe
  C:\Windows\System\XjvFMqs.exe
  2⤵
  PID:10440
- C:\Windows\System\VJDIexb.exe
  C:\Windows\System\VJDIexb.exe
  2⤵
  PID:10476
- C:\Windows\System\ANvCvTX.exe
  C:\Windows\System\ANvCvTX.exe
  2⤵
  PID:10500
- C:\Windows\System\cYHnIlg.exe
  C:\Windows\System\cYHnIlg.exe
  2⤵
  PID:10528
- C:\Windows\System\cFmDLTo.exe
  C:\Windows\System\cFmDLTo.exe
  2⤵
  PID:10544
- C:\Windows\System\rPTcQXl.exe
  C:\Windows\System\rPTcQXl.exe
  2⤵
  PID:10564
- C:\Windows\System\BQatnQI.exe
  C:\Windows\System\BQatnQI.exe
  2⤵
  PID:10584
- C:\Windows\System\rbJWWVM.exe
  C:\Windows\System\rbJWWVM.exe
  2⤵
  PID:10612
- C:\Windows\System\KsQhhJb.exe
  C:\Windows\System\KsQhhJb.exe
  2⤵
  PID:10636
- C:\Windows\System\weUITLK.exe
  C:\Windows\System\weUITLK.exe
  2⤵
  PID:10660
- C:\Windows\System\GOWgFem.exe
  C:\Windows\System\GOWgFem.exe
  2⤵
  PID:10696
- C:\Windows\System\aLCuxUz.exe
  C:\Windows\System\aLCuxUz.exe
  2⤵
  PID:10720
- C:\Windows\System\fGWtFrd.exe
  C:\Windows\System\fGWtFrd.exe
  2⤵
  PID:10748
- C:\Windows\System\lyCzfes.exe
  C:\Windows\System\lyCzfes.exe
  2⤵
  PID:10772
- C:\Windows\System\AISExQH.exe
  C:\Windows\System\AISExQH.exe
  2⤵
  PID:10796
- C:\Windows\System\Lxwuaxh.exe
  C:\Windows\System\Lxwuaxh.exe
  2⤵
  PID:10836
- C:\Windows\System\TPoUYun.exe
  C:\Windows\System\TPoUYun.exe
  2⤵
  PID:10856
- C:\Windows\System\xDWttjf.exe
  C:\Windows\System\xDWttjf.exe
  2⤵
  PID:10876
- C:\Windows\System\mNvMsmO.exe
  C:\Windows\System\mNvMsmO.exe
  2⤵
  PID:10904
- C:\Windows\System\VxtOoNC.exe
  C:\Windows\System\VxtOoNC.exe
  2⤵
  PID:10924
- C:\Windows\System\cqfzabJ.exe
  C:\Windows\System\cqfzabJ.exe
  2⤵
  PID:10948
- C:\Windows\System\dJkkkmR.exe
  C:\Windows\System\dJkkkmR.exe
  2⤵
  PID:10972
- C:\Windows\System\txchHvu.exe
  C:\Windows\System\txchHvu.exe
  2⤵
  PID:8952
- C:\Windows\System\UJjpgbB.exe
  C:\Windows\System\UJjpgbB.exe
  2⤵
  PID:9152
- C:\Windows\System\mIwOdPj.exe
  C:\Windows\System\mIwOdPj.exe
  2⤵
  PID:9164
- C:\Windows\System\WFVgqca.exe
  C:\Windows\System\WFVgqca.exe
  2⤵
  PID:9208
- C:\Windows\System\namZTLJ.exe
  C:\Windows\System\namZTLJ.exe
  2⤵
  PID:7676
- C:\Windows\System\MJsJkGC.exe
  C:\Windows\System\MJsJkGC.exe
  2⤵
  PID:8028
- C:\Windows\System\jFyTZfV.exe
  C:\Windows\System\jFyTZfV.exe
  2⤵
  PID:7672
- C:\Windows\System\nrtFemY.exe
  C:\Windows\System\nrtFemY.exe
  2⤵
  PID:7060
- C:\Windows\System\MccfJxG.exe
  C:\Windows\System\MccfJxG.exe
  2⤵
  PID:9372
- C:\Windows\System\pJVvptN.exe
  C:\Windows\System\pJVvptN.exe
  2⤵
  PID:9444
- C:\Windows\System\iqxIhyF.exe
  C:\Windows\System\iqxIhyF.exe
  2⤵
  PID:9396
- C:\Windows\System\lmVIXub.exe
  C:\Windows\System\lmVIXub.exe
  2⤵
  PID:8280
- C:\Windows\System\LigqNCA.exe
  C:\Windows\System\LigqNCA.exe
  2⤵
  PID:10012
- C:\Windows\System\lKnMLuH.exe
  C:\Windows\System\lKnMLuH.exe
  2⤵
  PID:10060
- C:\Windows\System\lIIUewC.exe
  C:\Windows\System\lIIUewC.exe
  2⤵
  PID:10116
- C:\Windows\System\rFMIUVZ.exe
  C:\Windows\System\rFMIUVZ.exe
  2⤵
  PID:8860
- C:\Windows\System\lVCGxSW.exe
  C:\Windows\System\lVCGxSW.exe
  2⤵
  PID:9552
- C:\Windows\System\HwxPgNI.exe
  C:\Windows\System\HwxPgNI.exe
  2⤵
  PID:4156
- C:\Windows\System\dMDxEbQ.exe
  C:\Windows\System\dMDxEbQ.exe
  2⤵
  PID:2008
- C:\Windows\System\nWJUwmn.exe
  C:\Windows\System\nWJUwmn.exe
  2⤵
  PID:6340
- C:\Windows\System\pKjJrsq.exe
  C:\Windows\System\pKjJrsq.exe
  2⤵
  PID:3108
- C:\Windows\System\SYhBTeW.exe
  C:\Windows\System\SYhBTeW.exe
  2⤵
  PID:9768
- C:\Windows\System\NaRYZnn.exe
  C:\Windows\System\NaRYZnn.exe
  2⤵
  PID:9836
- C:\Windows\System\ThxLrNu.exe
  C:\Windows\System\ThxLrNu.exe
  2⤵
  PID:8272
- C:\Windows\System\IdVDpkI.exe
  C:\Windows\System\IdVDpkI.exe
  2⤵
  PID:8564
- C:\Windows\System\bWLOeGg.exe
  C:\Windows\System\bWLOeGg.exe
  2⤵
  PID:9924
- C:\Windows\System\eWSHePz.exe
  C:\Windows\System\eWSHePz.exe
  2⤵
  PID:8588
- C:\Windows\System\tuKVQSx.exe
  C:\Windows\System\tuKVQSx.exe
  2⤵
  PID:10260
- C:\Windows\System\YBzCzwF.exe
  C:\Windows\System\YBzCzwF.exe
  2⤵
  PID:9964
- C:\Windows\System\iKzXlpu.exe
  C:\Windows\System\iKzXlpu.exe
  2⤵
  PID:10448
- C:\Windows\System\bJYBMdK.exe
  C:\Windows\System\bJYBMdK.exe
  2⤵
  PID:10152
- C:\Windows\System\RPJetkQ.exe
  C:\Windows\System\RPJetkQ.exe
  2⤵
  PID:11272
- C:\Windows\System\FOnVXKB.exe
  C:\Windows\System\FOnVXKB.exe
  2⤵
  PID:11300
- C:\Windows\System\zENwlXU.exe
  C:\Windows\System\zENwlXU.exe
  2⤵
  PID:11324
- C:\Windows\System\gSqvZfn.exe
  C:\Windows\System\gSqvZfn.exe
  2⤵
  PID:11348
- C:\Windows\System\NhBpBLx.exe
  C:\Windows\System\NhBpBLx.exe
  2⤵
  PID:11392
- C:\Windows\System\cuwOvIS.exe
  C:\Windows\System\cuwOvIS.exe
  2⤵
  PID:11412
- C:\Windows\System\SGwFzph.exe
  C:\Windows\System\SGwFzph.exe
  2⤵
  PID:11440
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11440 -s 240
    3⤵
    PID:1076
- C:\Windows\System\DgrHFcy.exe
  C:\Windows\System\DgrHFcy.exe
  2⤵
  PID:11460
- C:\Windows\System\yZRMFVb.exe
  C:\Windows\System\yZRMFVb.exe
  2⤵
  PID:11496
- C:\Windows\System\MjpXGkt.exe
  C:\Windows\System\MjpXGkt.exe
  2⤵
  PID:11524
- C:\Windows\System\oHDEeok.exe
  C:\Windows\System\oHDEeok.exe
  2⤵
  PID:11548
- C:\Windows\System\gLnoDir.exe
  C:\Windows\System\gLnoDir.exe
  2⤵
  PID:11572
- C:\Windows\System\ZlvjGPW.exe
  C:\Windows\System\ZlvjGPW.exe
  2⤵
  PID:11620
- C:\Windows\System\ZmoYZfu.exe
  C:\Windows\System\ZmoYZfu.exe
  2⤵
  PID:11640
- C:\Windows\System\QngbiLl.exe
  C:\Windows\System\QngbiLl.exe
  2⤵
  PID:11664
- C:\Windows\System\ASfPxtA.exe
  C:\Windows\System\ASfPxtA.exe
  2⤵
  PID:11688
- C:\Windows\System\LzDNGrb.exe
  C:\Windows\System\LzDNGrb.exe
  2⤵
  PID:11720
- C:\Windows\System\dBQpPAP.exe
  C:\Windows\System\dBQpPAP.exe
  2⤵
  PID:11740
- C:\Windows\System\iTveThj.exe
  C:\Windows\System\iTveThj.exe
  2⤵
  PID:11764
- C:\Windows\System\hNALIPZ.exe
  C:\Windows\System\hNALIPZ.exe
  2⤵
  PID:11788
- C:\Windows\System\mIypPIX.exe
  C:\Windows\System\mIypPIX.exe
  2⤵
  PID:11808
- C:\Windows\System\IJgWyyR.exe
  C:\Windows\System\IJgWyyR.exe
  2⤵
  PID:11824
- C:\Windows\System\xWeIvtr.exe
  C:\Windows\System\xWeIvtr.exe
  2⤵
  PID:11840
- C:\Windows\System\iYqVEyP.exe
  C:\Windows\System\iYqVEyP.exe
  2⤵
  PID:11856
- C:\Windows\System\ilqprnJ.exe
  C:\Windows\System\ilqprnJ.exe
  2⤵
  PID:11880
- C:\Windows\System\CUmwUXu.exe
  C:\Windows\System\CUmwUXu.exe
  2⤵
  PID:11896
- C:\Windows\System\HLNBEzy.exe
  C:\Windows\System\HLNBEzy.exe
  2⤵
  PID:11924
- C:\Windows\System\xVihIZO.exe
  C:\Windows\System\xVihIZO.exe
  2⤵
  PID:11944
- C:\Windows\System\QNZMfTk.exe
  C:\Windows\System\QNZMfTk.exe
  2⤵
  PID:11960
- C:\Windows\System\GmNpFzo.exe
  C:\Windows\System\GmNpFzo.exe
  2⤵
  PID:11984
- C:\Windows\System\HJZVPgh.exe
  C:\Windows\System\HJZVPgh.exe
  2⤵
  PID:12016
- C:\Windows\System\pRVMgUR.exe
  C:\Windows\System\pRVMgUR.exe
  2⤵
  PID:12100
- C:\Windows\System\LKDNSMI.exe
  C:\Windows\System\LKDNSMI.exe
  2⤵
  PID:12132
- C:\Windows\System\vdIYned.exe
  C:\Windows\System\vdIYned.exe
  2⤵
  PID:12156
- C:\Windows\System\vBxgfED.exe
  C:\Windows\System\vBxgfED.exe
  2⤵
  PID:12180
- C:\Windows\System\ynZwvnV.exe
  C:\Windows\System\ynZwvnV.exe
  2⤵
  PID:12200
- C:\Windows\System\XcnxfZM.exe
  C:\Windows\System\XcnxfZM.exe
  2⤵
  PID:12228
- C:\Windows\System\CjJAsvj.exe
  C:\Windows\System\CjJAsvj.exe
  2⤵
  PID:12248
- C:\Windows\System\GlsbwWc.exe
  C:\Windows\System\GlsbwWc.exe
  2⤵
  PID:12264
- C:\Windows\System\uYOryRt.exe
  C:\Windows\System\uYOryRt.exe
  2⤵
  PID:12280
- C:\Windows\System\lbmnKMo.exe
  C:\Windows\System\lbmnKMo.exe
  2⤵
  PID:1516
- C:\Windows\System\gMyWtRr.exe
  C:\Windows\System\gMyWtRr.exe
  2⤵
  PID:10200
- C:\Windows\System\uUXCHFv.exe
  C:\Windows\System\uUXCHFv.exe
  2⤵
  PID:4052
- C:\Windows\System\doAznaT.exe
  C:\Windows\System\doAznaT.exe
  2⤵
  PID:7180
- C:\Windows\System\FvKuBuF.exe
  C:\Windows\System\FvKuBuF.exe
  2⤵
  PID:6232
- C:\Windows\System\tRIEuZn.exe
  C:\Windows\System\tRIEuZn.exe
  2⤵
  PID:8248
- C:\Windows\System\PYTgYXt.exe
  C:\Windows\System\PYTgYXt.exe
  2⤵
  PID:8520
- C:\Windows\System\NUEooLz.exe
  C:\Windows\System\NUEooLz.exe
  2⤵
  PID:8924
- C:\Windows\System\trTdlxP.exe
  C:\Windows\System\trTdlxP.exe
  2⤵
  PID:1888
- C:\Windows\System\ezyabTk.exe
  C:\Windows\System\ezyabTk.exe
  2⤵
  PID:4536
- C:\Windows\System\EypbDQz.exe
  C:\Windows\System\EypbDQz.exe
  2⤵
  PID:9592
- C:\Windows\System\YhbpUSg.exe
  C:\Windows\System\YhbpUSg.exe
  2⤵
  PID:9168
- C:\Windows\System\oojTYrh.exe
  C:\Windows\System\oojTYrh.exe
  2⤵
  PID:9944
- C:\Windows\System\XdxWtUC.exe
  C:\Windows\System\XdxWtUC.exe
  2⤵
  PID:5064
- C:\Windows\System\KgqOjpR.exe
  C:\Windows\System\KgqOjpR.exe
  2⤵
  PID:8896
- C:\Windows\System\NAnTGED.exe
  C:\Windows\System\NAnTGED.exe
  2⤵
  PID:9800
- C:\Windows\System\bktYAPt.exe
  C:\Windows\System\bktYAPt.exe
  2⤵
  PID:8340
- C:\Windows\System\hEcjvaV.exe
  C:\Windows\System\hEcjvaV.exe
  2⤵
  PID:11280
- C:\Windows\System\vwobVNP.exe
  C:\Windows\System\vwobVNP.exe
  2⤵
  PID:696
- C:\Windows\System\uODrJsh.exe
  C:\Windows\System\uODrJsh.exe
  2⤵
  PID:10552
- C:\Windows\System\hgffgct.exe
  C:\Windows\System\hgffgct.exe
  2⤵
  PID:12292
- C:\Windows\System\WDrsSff.exe
  C:\Windows\System\WDrsSff.exe
  2⤵
  PID:12316
- C:\Windows\System\vBuLjEN.exe
  C:\Windows\System\vBuLjEN.exe
  2⤵
  PID:12344
- C:\Windows\System\zzVoKOG.exe
  C:\Windows\System\zzVoKOG.exe
  2⤵
  PID:12364
- C:\Windows\System\FymkGuz.exe
  C:\Windows\System\FymkGuz.exe
  2⤵
  PID:12388
- C:\Windows\System\UXYzpLm.exe
  C:\Windows\System\UXYzpLm.exe
  2⤵
  PID:12404
- C:\Windows\System\kLCEYyK.exe
  C:\Windows\System\kLCEYyK.exe
  2⤵
  PID:12428
- C:\Windows\System\Eosvoja.exe
  C:\Windows\System\Eosvoja.exe
  2⤵
  PID:12452
- C:\Windows\System\lHWPeso.exe
  C:\Windows\System\lHWPeso.exe
  2⤵
  PID:12480
- C:\Windows\System\LikXlJu.exe
  C:\Windows\System\LikXlJu.exe
  2⤵
  PID:12504
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12504 -s 28
    3⤵
    PID:13276
- C:\Windows\System\NTNDgJu.exe
  C:\Windows\System\NTNDgJu.exe
  2⤵
  PID:12524
- C:\Windows\System\jEUqrzd.exe
  C:\Windows\System\jEUqrzd.exe
  2⤵
  PID:12552
- C:\Windows\System\sGrZBkB.exe
  C:\Windows\System\sGrZBkB.exe
  2⤵
  PID:12576
- C:\Windows\System\sLjnWMr.exe
  C:\Windows\System\sLjnWMr.exe
  2⤵
  PID:12600
- C:\Windows\System\ZGKFpgj.exe
  C:\Windows\System\ZGKFpgj.exe
  2⤵
  PID:12616
- C:\Windows\System\ZTAkYpo.exe
  C:\Windows\System\ZTAkYpo.exe
  2⤵
  PID:12640
- C:\Windows\System\OPOIWoK.exe
  C:\Windows\System\OPOIWoK.exe
  2⤵
  PID:12656
- C:\Windows\System\NXzHphh.exe
  C:\Windows\System\NXzHphh.exe
  2⤵
  PID:12672
- C:\Windows\System\NVQlPMA.exe
  C:\Windows\System\NVQlPMA.exe
  2⤵
  PID:12688
- C:\Windows\System\zNbMMMS.exe
  C:\Windows\System\zNbMMMS.exe
  2⤵
  PID:12704
- C:\Windows\System\CetmWVI.exe
  C:\Windows\System\CetmWVI.exe
  2⤵
  PID:12724
- C:\Windows\System\kjZIqGn.exe
  C:\Windows\System\kjZIqGn.exe
  2⤵
  PID:12748
- C:\Windows\System\RnyKqzl.exe
  C:\Windows\System\RnyKqzl.exe
  2⤵
  PID:12768
- C:\Windows\System\oDptdnj.exe
  C:\Windows\System\oDptdnj.exe
  2⤵
  PID:12792
- C:\Windows\System\iZYhfoy.exe
  C:\Windows\System\iZYhfoy.exe
  2⤵
  PID:12808
- C:\Windows\System\CdCdyjS.exe
  C:\Windows\System\CdCdyjS.exe
  2⤵
  PID:12828
- C:\Windows\System\pmNVouU.exe
  C:\Windows\System\pmNVouU.exe
  2⤵
  PID:12848
- C:\Windows\System\HTFHeFj.exe
  C:\Windows\System\HTFHeFj.exe
  2⤵
  PID:12868
- C:\Windows\System\LNacJeR.exe
  C:\Windows\System\LNacJeR.exe
  2⤵
  PID:12888
- C:\Windows\System\WStWKyr.exe
  C:\Windows\System\WStWKyr.exe
  2⤵
  PID:12916
- C:\Windows\System\XpnshbH.exe
  C:\Windows\System\XpnshbH.exe
  2⤵
  PID:12940
- C:\Windows\System\sfZiSah.exe
  C:\Windows\System\sfZiSah.exe
  2⤵
  PID:12956
- C:\Windows\System\JDoyuSb.exe
  C:\Windows\System\JDoyuSb.exe
  2⤵
  PID:12984
- C:\Windows\System\HSzTjdm.exe
  C:\Windows\System\HSzTjdm.exe
  2⤵
  PID:13016
- C:\Windows\System\uGnfhqB.exe
  C:\Windows\System\uGnfhqB.exe
  2⤵
  PID:13036
- C:\Windows\System\YCyEaSR.exe
  C:\Windows\System\YCyEaSR.exe
  2⤵
  PID:13060
- C:\Windows\System\MwPUWRm.exe
  C:\Windows\System\MwPUWRm.exe
  2⤵
  PID:13084
- C:\Windows\System\MvDxfFp.exe
  C:\Windows\System\MvDxfFp.exe
  2⤵
  PID:13116
- C:\Windows\System\KhEbEqU.exe
  C:\Windows\System\KhEbEqU.exe
  2⤵
  PID:13140
- C:\Windows\System\iJcOgsW.exe
  C:\Windows\System\iJcOgsW.exe
  2⤵
  PID:13176
- C:\Windows\System\FVLElPc.exe
  C:\Windows\System\FVLElPc.exe
  2⤵
  PID:13196
- C:\Windows\System\OntvPKB.exe
  C:\Windows\System\OntvPKB.exe
  2⤵
  PID:13216
- C:\Windows\System\GzHtjcL.exe
  C:\Windows\System\GzHtjcL.exe
  2⤵
  PID:13240
- C:\Windows\System\aMsNqGL.exe
  C:\Windows\System\aMsNqGL.exe
  2⤵
  PID:13264
- C:\Windows\System\PwkGokY.exe
  C:\Windows\System\PwkGokY.exe
  2⤵
  PID:13284
- C:\Windows\System\HPMQkdV.exe
  C:\Windows\System\HPMQkdV.exe
  2⤵
  PID:13308
- C:\Windows\System\ETImcFl.exe
  C:\Windows\System\ETImcFl.exe
  2⤵
  PID:12952
- C:\Windows\System\gLZXfcq.exe
  C:\Windows\System\gLZXfcq.exe
  2⤵
  PID:9248
- C:\Windows\System\SkucrOm.exe
  C:\Windows\System\SkucrOm.exe
  2⤵
  PID:9400
- C:\Windows\System\IhlGzEu.exe
  C:\Windows\System\IhlGzEu.exe
  2⤵
  PID:10000
- C:\Windows\System\RWygSAl.exe
  C:\Windows\System\RWygSAl.exe
  2⤵
  PID:9500
- C:\Windows\System\DFnJOEd.exe
  C:\Windows\System\DFnJOEd.exe
  2⤵
  PID:13248
- C:\Windows\System\uwBJwga.exe
  C:\Windows\System\uwBJwga.exe
  2⤵
  PID:1204
- C:\Windows\System\ONTYIXP.exe
  C:\Windows\System\ONTYIXP.exe
  2⤵
  PID:1648
- C:\Windows\System\fycKVCn.exe
  C:\Windows\System\fycKVCn.exe
  2⤵
  PID:11952
- C:\Windows\System\POdlcYV.exe
  C:\Windows\System\POdlcYV.exe
  2⤵
  PID:11124
- C:\Windows\System\IpDCGPi.exe
  C:\Windows\System\IpDCGPi.exe
  2⤵
  PID:10300
- C:\Windows\System\wfsIOno.exe
  C:\Windows\System\wfsIOno.exe
  2⤵
  PID:10920
- C:\Windows\System\RiUpbyC.exe
  C:\Windows\System\RiUpbyC.exe
  2⤵
  PID:10600
- C:\Windows\System\rRPzJSc.exe
  C:\Windows\System\rRPzJSc.exe
  2⤵
  PID:12324
- C:\Windows\System\jZSSTDb.exe
  C:\Windows\System\jZSSTDb.exe
  2⤵
  PID:12560
- C:\Windows\System\tjeWNTS.exe
  C:\Windows\System\tjeWNTS.exe
  2⤵
  PID:12516
- C:\Windows\System\VaekWLW.exe
  C:\Windows\System\VaekWLW.exe
  2⤵
  PID:12416
- C:\Windows\System\EwmMvFm.exe
  C:\Windows\System\EwmMvFm.exe
  2⤵
  PID:12628
- C:\Windows\System\auntkIy.exe
  C:\Windows\System\auntkIy.exe
  2⤵
  PID:12740
- C:\Windows\System\McsJXiL.exe
  C:\Windows\System\McsJXiL.exe
  2⤵
  PID:11040
- C:\Windows\System\Dwrilxw.exe
  C:\Windows\System\Dwrilxw.exe
  2⤵
  PID:9380
- C:\Windows\System\xHcKpwk.exe
  C:\Windows\System\xHcKpwk.exe
  2⤵
  PID:13300
- C:\Windows\System\CTCSVRM.exe
  C:\Windows\System\CTCSVRM.exe
  2⤵
  PID:3724
- C:\Windows\System\zjiiNJq.exe
  C:\Windows\System\zjiiNJq.exe
  2⤵
  PID:11288
- C:\Windows\System\RYugyre.exe
  C:\Windows\System\RYugyre.exe
  2⤵
  PID:12308
- C:\Windows\System\iRcBZxR.exe
  C:\Windows\System\iRcBZxR.exe
  2⤵
  PID:3432
- C:\Windows\System\UUuVAQS.exe
  C:\Windows\System\UUuVAQS.exe
  2⤵
  PID:11904
- C:\Windows\System\SBwynnM.exe
  C:\Windows\System\SBwynnM.exe
  2⤵
  PID:9900
- C:\Windows\System\wwkktGE.exe
  C:\Windows\System\wwkktGE.exe
  2⤵
  PID:10156
- C:\Windows\System\NSqWCYG.exe
  C:\Windows\System\NSqWCYG.exe
  2⤵
  PID:12332
- C:\Windows\System\khPNKPR.exe
  C:\Windows\System\khPNKPR.exe
  2⤵
  PID:2572
- C:\Windows\System\dYlOIol.exe
  C:\Windows\System\dYlOIol.exe
  2⤵
  PID:10108
- C:\Windows\System\YNlNxNw.exe
  C:\Windows\System\YNlNxNw.exe
  2⤵
  PID:12168
- C:\Windows\System\iStVdyH.exe
  C:\Windows\System\iStVdyH.exe
  2⤵
  PID:10852
- C:\Windows\System\ptKROdF.exe
  C:\Windows\System\ptKROdF.exe
  2⤵
  PID:10284
- C:\Windows\System\QLlzrrn.exe
  C:\Windows\System\QLlzrrn.exe
  2⤵
  PID:12536
- C:\Windows\System\uuIzvlI.exe
  C:\Windows\System\uuIzvlI.exe
  2⤵
  PID:10848
- C:\Windows\System\hYVZZGS.exe
  C:\Windows\System\hYVZZGS.exe
  2⤵
  PID:8688
- C:\Windows\System\Kjvgkvo.exe
  C:\Windows\System\Kjvgkvo.exe
  2⤵
  PID:12924
- C:\Windows\System\yodulxo.exe
  C:\Windows\System\yodulxo.exe
  2⤵
  PID:12712
- C:\Windows\System\nsFHHtK.exe
  C:\Windows\System\nsFHHtK.exe
  2⤵
  PID:12008
- C:\Windows\System\SidtjyZ.exe
  C:\Windows\System\SidtjyZ.exe
  2⤵
  PID:11936
- C:\Windows\System\QRcJhGC.exe
  C:\Windows\System\QRcJhGC.exe
  2⤵
  PID:1076
- C:\Windows\System\DZmynno.exe
  C:\Windows\System\DZmynno.exe
  2⤵
  PID:10456
- C:\Windows\System\fsCqAam.exe
  C:\Windows\System\fsCqAam.exe
  2⤵
  PID:5048
- C:\Windows\System\SJtFmYj.exe
  C:\Windows\System\SJtFmYj.exe
  2⤵
  PID:380
- C:\Windows\System\cGtmfxs.exe
  C:\Windows\System\cGtmfxs.exe
  2⤵
  PID:13276
- C:\Windows\System\uVVZJpB.exe
  C:\Windows\System\uVVZJpB.exe
  2⤵
  PID:3900
- C:\Windows\System\DZHbxrp.exe
  C:\Windows\System\DZHbxrp.exe
  2⤵
  PID:12476
- C:\Windows\System\noHXuww.exe
  C:\Windows\System\noHXuww.exe
  2⤵
  PID:12716
- C:\Windows\System\cfwJMKl.exe
  C:\Windows\System\cfwJMKl.exe
  2⤵
  PID:13072
- C:\Windows\System\gpsnKWs.exe
  C:\Windows\System\gpsnKWs.exe
  2⤵
  PID:3456
- C:\Windows\System\zmgHrRs.exe
  C:\Windows\System\zmgHrRs.exe
  2⤵
  PID:11456
- C:\Windows\System\XvNTEZT.exe
  C:\Windows\System\XvNTEZT.exe
  2⤵
  PID:13236
- C:\Windows\System\eSiQOlc.exe
  C:\Windows\System\eSiQOlc.exe
  2⤵
  PID:11588
- C:\Windows\System\wQNBBEG.exe
  C:\Windows\System\wQNBBEG.exe
  2⤵
  PID:4568
- C:\Windows\System\YPpwjoL.exe
  C:\Windows\System\YPpwjoL.exe
  2⤵
  PID:8708
- C:\Windows\System\RNRrBvY.exe
  C:\Windows\System\RNRrBvY.exe
  2⤵
  PID:10960
- C:\Windows\System\RIgAOTx.exe
  C:\Windows\System\RIgAOTx.exe
  2⤵
  PID:4924
- C:\Windows\System\DZALVyH.exe
  C:\Windows\System\DZALVyH.exe
  2⤵
  PID:5588
- C:\Windows\System\kzMHimn.exe
  C:\Windows\System\kzMHimn.exe
  2⤵
  PID:13104
- C:\Windows\System\faQCCQu.exe
  C:\Windows\System\faQCCQu.exe
  2⤵
  PID:11976
- C:\Windows\System\UYqUMaS.exe
  C:\Windows\System\UYqUMaS.exe
  2⤵
  PID:5208
- C:\Windows\System\mDClbec.exe
  C:\Windows\System\mDClbec.exe
  2⤵
  PID:5232
- C:\Windows\System\VxEzWKz.exe
  C:\Windows\System\VxEzWKz.exe
  2⤵
  PID:3600
- C:\Windows\System\tlEFQTc.exe
  C:\Windows\System\tlEFQTc.exe
  2⤵
  PID:5112
- C:\Windows\System\ibKyYXX.exe
  C:\Windows\System\ibKyYXX.exe
  2⤵
  PID:11684
- C:\Windows\System\mborCrk.exe
  C:\Windows\System\mborCrk.exe
  2⤵
  PID:11356
- C:\Windows\System\TvfFzHs.exe
  C:\Windows\System\TvfFzHs.exe
  2⤵
  PID:5220
- C:\Windows\System\YBSgiUd.exe
  C:\Windows\System\YBSgiUd.exe
  2⤵
  PID:11424
- C:\Windows\System\sITojVe.exe
  C:\Windows\System\sITojVe.exe
  2⤵
  PID:4348
- C:\Windows\System\kTUWrYc.exe
  C:\Windows\System\kTUWrYc.exe
  2⤵
  PID:13172
- C:\Windows\System\atzJfXt.exe
  C:\Windows\System\atzJfXt.exe
  2⤵
  PID:5212
- C:\Windows\System\nvpgXYV.exe
  C:\Windows\System\nvpgXYV.exe
  2⤵
  PID:2860
- C:\Windows\System\kbfBzey.exe
  C:\Windows\System\kbfBzey.exe
  2⤵
  PID:1220
- C:\Windows\System\YmfHUSz.exe
  C:\Windows\System\YmfHUSz.exe
  2⤵
  PID:2892
- C:\Windows\System\VLqeRCr.exe
  C:\Windows\System\VLqeRCr.exe
  2⤵
  PID:4144
- C:\Windows\System\AUdehAE.exe
  C:\Windows\System\AUdehAE.exe
  2⤵
  PID:4696
- C:\Windows\System\RxTfOSb.exe
  C:\Windows\System\RxTfOSb.exe
  2⤵
  PID:13132
- C:\Windows\System\wHBVyaM.exe
  C:\Windows\System\wHBVyaM.exe
  2⤵
  PID:1932
- C:\Windows\System\tlrkwIj.exe
  C:\Windows\System\tlrkwIj.exe
  2⤵
  PID:1448
- C:\Windows\System\mLLhUcL.exe
  C:\Windows\System\mLLhUcL.exe
  2⤵
  PID:3932
- C:\Windows\System\kqGDRyo.exe
  C:\Windows\System\kqGDRyo.exe
  2⤵
  PID:3592
- C:\Windows\System\SWTVhJb.exe
  C:\Windows\System\SWTVhJb.exe
  2⤵
  PID:1468
- C:\Windows\System\GEQfWnJ.exe
  C:\Windows\System\GEQfWnJ.exe
  2⤵
  PID:13324
- C:\Windows\System\fhfLXlk.exe
  C:\Windows\System\fhfLXlk.exe
  2⤵
  PID:13344
- C:\Windows\System\nvAbPxp.exe
  C:\Windows\System\nvAbPxp.exe
  2⤵
  PID:13372
- C:\Windows\System\fYBdOwT.exe
  C:\Windows\System\fYBdOwT.exe
  2⤵
  PID:13476
- C:\Windows\System\akjsowl.exe
  C:\Windows\System\akjsowl.exe
  2⤵
  PID:13496
- C:\Windows\System\WyUvfBH.exe
  C:\Windows\System\WyUvfBH.exe
  2⤵
  PID:13540
- C:\Windows\System\GMpYaAQ.exe
  C:\Windows\System\GMpYaAQ.exe
  2⤵
  PID:13624
- C:\Windows\System\BreDQXC.exe
  C:\Windows\System\BreDQXC.exe
  2⤵
  PID:13652
- C:\Windows\System\wDSsSrJ.exe
  C:\Windows\System\wDSsSrJ.exe
  2⤵
  PID:13672
- C:\Windows\System\erdLPhK.exe
  C:\Windows\System\erdLPhK.exe
  2⤵
  PID:13696
- C:\Windows\System\ZZeFjUd.exe
  C:\Windows\System\ZZeFjUd.exe
  2⤵
  PID:13732
- C:\Windows\System\wYBcabQ.exe
  C:\Windows\System\wYBcabQ.exe
  2⤵
  PID:13752
- C:\Windows\System\UnMcImg.exe
  C:\Windows\System\UnMcImg.exe
  2⤵
  PID:13772
- C:\Windows\System\efZzBjL.exe
  C:\Windows\System\efZzBjL.exe
  2⤵
  PID:13788
- C:\Windows\System\pXlyuXV.exe
  C:\Windows\System\pXlyuXV.exe
  2⤵
  PID:13812
- C:\Windows\System\aAaAzsq.exe
  C:\Windows\System\aAaAzsq.exe
  2⤵
  PID:13832
- C:\Windows\System\gCqsIPT.exe
  C:\Windows\System\gCqsIPT.exe
  2⤵
  PID:13852
- C:\Windows\System\ksPCzIr.exe
  C:\Windows\System\ksPCzIr.exe
  2⤵
  PID:13872
- C:\Windows\System\saoKSzi.exe
  C:\Windows\System\saoKSzi.exe
  2⤵
  PID:13896
- C:\Windows\System\mwfyADf.exe
  C:\Windows\System\mwfyADf.exe
  2⤵
  PID:13916
- C:\Windows\System\rYRnjUp.exe
  C:\Windows\System\rYRnjUp.exe
  2⤵
  PID:13932
- C:\Windows\System\afDgZZC.exe
  C:\Windows\System\afDgZZC.exe
  2⤵
  PID:13956
- C:\Windows\System\zBumjgX.exe
  C:\Windows\System\zBumjgX.exe
  2⤵
  PID:13976
- C:\Windows\System\HQKLilU.exe
  C:\Windows\System\HQKLilU.exe
  2⤵
  PID:14004
- C:\Windows\System\EzMZUjg.exe
  C:\Windows\System\EzMZUjg.exe
  2⤵
  PID:14024
- C:\Windows\System\vETgJZh.exe
  C:\Windows\System\vETgJZh.exe
  2⤵
  PID:14068
- C:\Windows\System\JpmMilW.exe
  C:\Windows\System\JpmMilW.exe
  2⤵
  PID:14156
- C:\Windows\System\mrgXjuZ.exe
  C:\Windows\System\mrgXjuZ.exe
  2⤵
  PID:14180
- C:\Windows\System\qYHpnwb.exe
  C:\Windows\System\qYHpnwb.exe
  2⤵
  PID:14220
- C:\Windows\System\uRptSmp.exe
  C:\Windows\System\uRptSmp.exe
  2⤵
  PID:14260
- C:\Windows\System\xHTdKJD.exe
  C:\Windows\System\xHTdKJD.exe
  2⤵
  PID:14296
- C:\Windows\System\LtrCBcB.exe
  C:\Windows\System\LtrCBcB.exe
  2⤵
  PID:14316
- C:\Windows\System\kqifUwa.exe
  C:\Windows\System\kqifUwa.exe
  2⤵
  PID:7648
- C:\Windows\System\vzLHhls.exe
  C:\Windows\System\vzLHhls.exe
  2⤵
  PID:4996
- C:\Windows\System\ipFIanU.exe
  C:\Windows\System\ipFIanU.exe
  2⤵
  PID:13316
- C:\Windows\System\mDmUGtQ.exe
  C:\Windows\System\mDmUGtQ.exe
  2⤵
  PID:13340
- C:\Windows\System\MDowZIQ.exe
  C:\Windows\System\MDowZIQ.exe
  2⤵
  PID:13484
- C:\Windows\System\HbYLNOE.exe
  C:\Windows\System\HbYLNOE.exe
  2⤵
  PID:13588
- C:\Windows\System\uvrnPXT.exe
  C:\Windows\System\uvrnPXT.exe
  2⤵
  PID:13536
- C:\Windows\System\aenHcGY.exe
  C:\Windows\System\aenHcGY.exe
  2⤵
  PID:2968
- C:\Windows\System\IzvRxjI.exe
  C:\Windows\System\IzvRxjI.exe
  2⤵
  PID:13744
- C:\Windows\System\HMtBByk.exe
  C:\Windows\System\HMtBByk.exe
  2⤵
  PID:5116
- C:\Windows\System\viTFYoj.exe
  C:\Windows\System\viTFYoj.exe
  2⤵
  PID:13800
- C:\Windows\System\XZqhTwI.exe
  C:\Windows\System\XZqhTwI.exe
  2⤵
  PID:2384
- C:\Windows\System\IVWHDsL.exe
  C:\Windows\System\IVWHDsL.exe
  2⤵
  PID:13884
- C:\Windows\System\MrHmrjH.exe
  C:\Windows\System\MrHmrjH.exe
  2⤵
  PID:13968
- C:\Windows\System\YexWUXy.exe
  C:\Windows\System\YexWUXy.exe
  2⤵
  PID:14016
- C:\Windows\System\XLbFueg.exe
  C:\Windows\System\XLbFueg.exe
  2⤵
  PID:2788
- C:\Windows\System\kzJVMhn.exe
  C:\Windows\System\kzJVMhn.exe
  2⤵
  PID:14136
- C:\Windows\System\LxUuiGT.exe
  C:\Windows\System\LxUuiGT.exe
  2⤵
  PID:14108
- C:\Windows\System\wypINjS.exe
  C:\Windows\System\wypINjS.exe
  2⤵
  PID:1848
- C:\Windows\System\SUCuqUF.exe
  C:\Windows\System\SUCuqUF.exe
  2⤵
  PID:4496
- C:\Windows\System\itVAiRO.exe
  C:\Windows\System\itVAiRO.exe
  2⤵
  PID:14188
- C:\Windows\System\lvjbvhc.exe
  C:\Windows\System\lvjbvhc.exe
  2⤵
  PID:14280
- C:\Windows\System\yEWpgDt.exe
  C:\Windows\System\yEWpgDt.exe
  2⤵
  PID:2712
- C:\Windows\System\rLpIsTz.exe
  C:\Windows\System\rLpIsTz.exe
  2⤵
  PID:13568
- C:\Windows\System\ByHgKoV.exe
  C:\Windows\System\ByHgKoV.exe
  2⤵
  PID:1112
- C:\Windows\System\PksNosl.exe
  C:\Windows\System\PksNosl.exe
  2⤵
  PID:5192
- C:\Windows\System\zckQLMB.exe
  C:\Windows\System\zckQLMB.exe
  2⤵
  PID:2288
- C:\Windows\System\cDkGxff.exe
  C:\Windows\System\cDkGxff.exe
  2⤵
  PID:5180
- C:\Windows\System\VLOchTC.exe
  C:\Windows\System\VLOchTC.exe
  2⤵
  PID:3820
- C:\Windows\System\GmsprkO.exe
  C:\Windows\System\GmsprkO.exe
  2⤵
  PID:13748
- C:\Windows\System\fgmBxcR.exe
  C:\Windows\System\fgmBxcR.exe
  2⤵
  PID:13948
- C:\Windows\System\mmDyeNT.exe
  C:\Windows\System\mmDyeNT.exe
  2⤵
  PID:1120
- C:\Windows\System\csIjsRy.exe
  C:\Windows\System\csIjsRy.exe
  2⤵
  PID:14228
- C:\Windows\System\qqUdbkg.exe
  C:\Windows\System\qqUdbkg.exe
  2⤵
  PID:224
- C:\Windows\System\fBRgDmM.exe
  C:\Windows\System\fBRgDmM.exe
  2⤵
  PID:5468
- C:\Windows\System\sTgPghA.exe
  C:\Windows\System\sTgPghA.exe
  2⤵
  PID:6052
- C:\Windows\System\VCHkUDc.exe
  C:\Windows\System\VCHkUDc.exe
  2⤵
  PID:2940
- C:\Windows\System\KbmBuzQ.exe
  C:\Windows\System\KbmBuzQ.exe
  2⤵
  PID:5908
- C:\Windows\System\ccPDdnS.exe
  C:\Windows\System\ccPDdnS.exe
  2⤵
  PID:14308
- C:\Windows\System\RYUxUdR.exe
  C:\Windows\System\RYUxUdR.exe
  2⤵
  PID:2352
- C:\Windows\System\kIZBgQH.exe
  C:\Windows\System\kIZBgQH.exe
  2⤵
  PID:14216
- C:\Windows\System\Dzmwuya.exe
  C:\Windows\System\Dzmwuya.exe
  2⤵
  PID:5516
- C:\Windows\System\JjFawHI.exe
  C:\Windows\System\JjFawHI.exe
  2⤵
  PID:11632
- C:\Windows\System\LndiObN.exe
  C:\Windows\System\LndiObN.exe
  2⤵
  PID:13508
- C:\Windows\System\IUpVHaD.exe
  C:\Windows\System\IUpVHaD.exe
  2⤵
  PID:13720
- C:\Windows\System\DwxnFsS.exe
  C:\Windows\System\DwxnFsS.exe
  2⤵
  PID:772
- C:\Windows\System\ZdIaFjt.exe
  C:\Windows\System\ZdIaFjt.exe
  2⤵
  PID:5184
- C:\Windows\System\tVVcLST.exe
  C:\Windows\System\tVVcLST.exe
  2⤵
  PID:13796
- C:\Windows\System\EVeLOkI.exe
  C:\Windows\System\EVeLOkI.exe
  2⤵
  PID:6124
- C:\Windows\System\IHnWIyr.exe
  C:\Windows\System\IHnWIyr.exe
  2⤵
  PID:13840
- C:\Windows\System\rJJAfpF.exe
  C:\Windows\System\rJJAfpF.exe
  2⤵
  PID:5204
- C:\Windows\System\CiZeiIW.exe
  C:\Windows\System\CiZeiIW.exe
  2⤵
  PID:5160
- C:\Windows\System\hBGVjoe.exe
  C:\Windows\System\hBGVjoe.exe
  2⤵
  PID:9884
- C:\Windows\System\WCxEzVk.exe
  C:\Windows\System\WCxEzVk.exe
  2⤵
  PID:5968
- C:\Windows\System\zNgBMFu.exe
  C:\Windows\System\zNgBMFu.exe
  2⤵
  PID:14240
- C:\Windows\System\zuffcxs.exe
  C:\Windows\System\zuffcxs.exe
  2⤵
  PID:14084
- C:\Windows\System\FmfsUBM.exe
  C:\Windows\System\FmfsUBM.exe
  2⤵
  PID:14276
- C:\Windows\System\sRTajTT.exe
  C:\Windows\System\sRTajTT.exe
  2⤵
  PID:6796
- C:\Windows\System\XYxjjaG.exe
  C:\Windows\System\XYxjjaG.exe
  2⤵
  PID:6840
- C:\Windows\System\IHgzFnP.exe
  C:\Windows\System\IHgzFnP.exe
  2⤵
  PID:6224
- C:\Windows\System\wQICGGo.exe
  C:\Windows\System\wQICGGo.exe
  2⤵
  PID:6332
- C:\Windows\System\GQnNTpF.exe
  C:\Windows\System\GQnNTpF.exe
  2⤵
  PID:6388
- C:\Windows\System\BXCagMx.exe
  C:\Windows\System\BXCagMx.exe
  2⤵
  PID:2740
- C:\Windows\System\McKNLlM.exe
  C:\Windows\System\McKNLlM.exe
  2⤵
  PID:13716
- C:\Windows\System\zHHUACe.exe
  C:\Windows\System\zHHUACe.exe
  2⤵
  PID:5928
- C:\Windows\System\gjFCsYI.exe
  C:\Windows\System\gjFCsYI.exe
  2⤵
  PID:13424
- C:\Windows\System\nEorSxb.exe
  C:\Windows\System\nEorSxb.exe
  2⤵
  PID:5452
- C:\Windows\System\kUSkkyT.exe
  C:\Windows\System\kUSkkyT.exe
  2⤵
  PID:5464
- C:\Windows\System\WlVFFzx.exe
  C:\Windows\System\WlVFFzx.exe
  2⤵
  PID:2024
- C:\Windows\System\zoaCLth.exe
  C:\Windows\System\zoaCLth.exe
  2⤵
  PID:5448
- C:\Windows\System\SNIEtst.exe
  C:\Windows\System\SNIEtst.exe
  2⤵
  PID:1956
- C:\Windows\System\osInmSb.exe
  C:\Windows\System\osInmSb.exe
  2⤵
  PID:5700
- C:\Windows\System\lRXhzFs.exe
  C:\Windows\System\lRXhzFs.exe
  2⤵
  PID:880
- C:\Windows\System\gJvISOp.exe
  C:\Windows\System\gJvISOp.exe
  2⤵
  PID:4224
- C:\Windows\System\uxhZVcK.exe
  C:\Windows\System\uxhZVcK.exe
  2⤵
  PID:5500
- C:\Windows\System\EeUcwxA.exe
  C:\Windows\System\EeUcwxA.exe
  2⤵
  PID:6604
- C:\Windows\System\rDPhlSm.exe
  C:\Windows\System\rDPhlSm.exe
  2⤵
  PID:6596
- C:\Windows\System\rOgnwoy.exe
  C:\Windows\System\rOgnwoy.exe
  2⤵
  PID:13512
- C:\Windows\System\LVjgNYj.exe
  C:\Windows\System\LVjgNYj.exe
  2⤵
  PID:4548
- C:\Windows\System\idLMDQI.exe
  C:\Windows\System\idLMDQI.exe
  2⤵
  PID:4068
- C:\Windows\System\EeViODu.exe
  C:\Windows\System\EeViODu.exe
  2⤵
  PID:13452
- C:\Windows\System\PJMkhMF.exe
  C:\Windows\System\PJMkhMF.exe
  2⤵
  PID:7292
- C:\Windows\System\KtQaqOv.exe
  C:\Windows\System\KtQaqOv.exe
  2⤵
  PID:4264
- C:\Windows\System\ZaRgFhb.exe
  C:\Windows\System\ZaRgFhb.exe
  2⤵
  PID:4984
- C:\Windows\System\LdtRdhG.exe
  C:\Windows\System\LdtRdhG.exe
  2⤵
  PID:13924
- C:\Windows\System\TZJHvjW.exe
  C:\Windows\System\TZJHvjW.exe
  2⤵
  PID:7624
- C:\Windows\System\cThNZjp.exe
  C:\Windows\System\cThNZjp.exe
  2⤵
  PID:2592
- C:\Windows\System\aFOvqir.exe
  C:\Windows\System\aFOvqir.exe
  2⤵
  PID:4592
- C:\Windows\System\SyrQyuC.exe
  C:\Windows\System\SyrQyuC.exe
  2⤵
  PID:7092
- C:\Windows\System\rVzEhCk.exe
  C:\Windows\System\rVzEhCk.exe
  2⤵
  PID:5476
- C:\Windows\System\bJsYyip.exe
  C:\Windows\System\bJsYyip.exe
  2⤵
  PID:8052
- C:\Windows\System\jXvQOJp.exe
  C:\Windows\System\jXvQOJp.exe
  2⤵
  PID:5020
- C:\Windows\System\sChJlzi.exe
  C:\Windows\System\sChJlzi.exe
  2⤵
  PID:6228
- C:\Windows\System\CjseQBz.exe
  C:\Windows\System\CjseQBz.exe
  2⤵
  PID:6288
- C:\Windows\System\nxFRvfA.exe
  C:\Windows\System\nxFRvfA.exe
  2⤵
  PID:6828
- C:\Windows\System\MXgJqMi.exe
  C:\Windows\System\MXgJqMi.exe
  2⤵
  PID:6940
- C:\Windows\System\ATCYnbN.exe
  C:\Windows\System\ATCYnbN.exe
  2⤵
  PID:7136
- C:\Windows\System\WADNyKU.exe
  C:\Windows\System\WADNyKU.exe
  2⤵
  PID:6944
- C:\Windows\System\OSFMcDs.exe
  C:\Windows\System\OSFMcDs.exe
  2⤵
  PID:7096
- C:\Windows\System\gSCOOCB.exe
  C:\Windows\System\gSCOOCB.exe
  2⤵
  PID:916
- C:\Windows\System\YJJJSas.exe
  C:\Windows\System\YJJJSas.exe
  2⤵
  PID:3348
- C:\Windows\System\dfZJfqe.exe
  C:\Windows\System\dfZJfqe.exe
  2⤵
  PID:6736
- C:\Windows\System\QVqtDvm.exe
  C:\Windows\System\QVqtDvm.exe
  2⤵
  PID:7148
- C:\Windows\System\jcUQrbo.exe
  C:\Windows\System\jcUQrbo.exe
  2⤵
  PID:3324
- C:\Windows\System\HSbVRiT.exe
  C:\Windows\System\HSbVRiT.exe
  2⤵
  PID:6804
- C:\Windows\System\kxUcNnb.exe
  C:\Windows\System\kxUcNnb.exe
  2⤵
  PID:1892
- C:\Windows\System\KdpeMuU.exe
  C:\Windows\System\KdpeMuU.exe
  2⤵
  PID:7468
- C:\Windows\System\bQFSfni.exe
  C:\Windows\System\bQFSfni.exe
  2⤵
  PID:7848
- C:\Windows\System\darRfgJ.exe
  C:\Windows\System\darRfgJ.exe
  2⤵
  PID:5144
- C:\Windows\System\lkllItl.exe
  C:\Windows\System\lkllItl.exe
  2⤵
  PID:6780
- C:\Windows\System\AlwnfOK.exe
  C:\Windows\System\AlwnfOK.exe
  2⤵
  PID:14364
- C:\Windows\System\KnGbhEt.exe
  C:\Windows\System\KnGbhEt.exe
  2⤵
  PID:14392
- C:\Windows\System\yywiWJW.exe
  C:\Windows\System\yywiWJW.exe
  2⤵
  PID:14408
- C:\Windows\System\eXVqPuK.exe
  C:\Windows\System\eXVqPuK.exe
  2⤵
  PID:14428
- C:\Windows\System\Bglwbry.exe
  C:\Windows\System\Bglwbry.exe
  2⤵
  PID:14448
- C:\Windows\System\YLuvUNb.exe
  C:\Windows\System\YLuvUNb.exe
  2⤵
  PID:14464
- C:\Windows\System\SmUyOzk.exe
  C:\Windows\System\SmUyOzk.exe
  2⤵
  PID:14488
- C:\Windows\System\ZYJqCel.exe
  C:\Windows\System\ZYJqCel.exe
  2⤵
  PID:14516
- C:\Windows\System\bgjdvOr.exe
  C:\Windows\System\bgjdvOr.exe
  2⤵
  PID:14544
- C:\Windows\System\eycPjKP.exe
  C:\Windows\System\eycPjKP.exe
  2⤵
  PID:14564
- C:\Windows\System\lppZVfz.exe
  C:\Windows\System\lppZVfz.exe
  2⤵
  PID:14584
- C:\Windows\System\EnUprEb.exe
  C:\Windows\System\EnUprEb.exe
  2⤵
  PID:14604
- C:\Windows\System\GMtPDYI.exe
  C:\Windows\System\GMtPDYI.exe
  2⤵
  PID:14632
- C:\Windows\System\PvjHgZg.exe
  C:\Windows\System\PvjHgZg.exe
  2⤵
  PID:14664
- C:\Windows\System\LeODydo.exe
  C:\Windows\System\LeODydo.exe
  2⤵
  PID:14684
- C:\Windows\System\GQjshMP.exe
  C:\Windows\System\GQjshMP.exe
  2⤵
  PID:14700
- C:\Windows\System\LiETPcJ.exe
  C:\Windows\System\LiETPcJ.exe
  2⤵
  PID:14848
- C:\Windows\System\OCRZULK.exe
  C:\Windows\System\OCRZULK.exe
  2⤵
  PID:14872
- C:\Windows\System\dASrRYs.exe
  C:\Windows\System\dASrRYs.exe
  2⤵
  PID:14892
- C:\Windows\System\wXITbPm.exe
  C:\Windows\System\wXITbPm.exe
  2⤵
  PID:15104
- C:\Windows\System\YBOzbac.exe
  C:\Windows\System\YBOzbac.exe
  2⤵
  PID:15140
- C:\Windows\System\tmtbwcU.exe
  C:\Windows\System\tmtbwcU.exe
  2⤵
  PID:15168
- C:\Windows\System\uLzwxTH.exe
  C:\Windows\System\uLzwxTH.exe
  2⤵
  PID:15320
- C:\Windows\System\LgVEdyj.exe
  C:\Windows\System\LgVEdyj.exe
  2⤵
  PID:15340
- C:\Windows\System\cerMIkk.exe
  C:\Windows\System\cerMIkk.exe
  2⤵
  PID:7204
- C:\Windows\System\cMhjpps.exe
  C:\Windows\System\cMhjpps.exe
  2⤵
  PID:6024
- C:\Windows\System\qdiATUM.exe
  C:\Windows\System\qdiATUM.exe
  2⤵
  PID:7828
- C:\Windows\System\hdnmmQe.exe
  C:\Windows\System\hdnmmQe.exe
  2⤵
  PID:7580
- C:\Windows\System\gZWcycj.exe
  C:\Windows\System\gZWcycj.exe
  2⤵
  PID:1012
- C:\Windows\System\MQWzyxL.exe
  C:\Windows\System\MQWzyxL.exe
  2⤵
  PID:7792
- C:\Windows\System\wsuqrvO.exe
  C:\Windows\System\wsuqrvO.exe
  2⤵
  PID:5852
- C:\Windows\System\GoOhYRg.exe
  C:\Windows\System\GoOhYRg.exe
  2⤵
  PID:14496
- C:\Windows\System\RGrsHit.exe
  C:\Windows\System\RGrsHit.exe
  2⤵
  PID:13604
- C:\Windows\System\RwPWZky.exe
  C:\Windows\System\RwPWZky.exe
  2⤵
  PID:5648
- C:\Windows\System\ChLhenR.exe
  C:\Windows\System\ChLhenR.exe
  2⤵
  PID:7288
- C:\Windows\System\XBEuTpz.exe
  C:\Windows\System\XBEuTpz.exe
  2⤵
  PID:13868
- C:\Windows\System\RlBPHUq.exe
  C:\Windows\System\RlBPHUq.exe
  2⤵
  PID:6732
- C:\Windows\System\pXcfBqW.exe
  C:\Windows\System\pXcfBqW.exe
  2⤵
  PID:6292
- C:\Windows\System\ziSlsVJ.exe
  C:\Windows\System\ziSlsVJ.exe
  2⤵
  PID:6660
- C:\Windows\System\NGgbJCv.exe
  C:\Windows\System\NGgbJCv.exe
  2⤵
  PID:14348
- C:\Windows\System\yhOjmIV.exe
  C:\Windows\System\yhOjmIV.exe
  2⤵
  PID:5684
- C:\Windows\System\ZbErLfw.exe
  C:\Windows\System\ZbErLfw.exe
  2⤵
  PID:7176
- C:\Windows\System\EcfCykw.exe
  C:\Windows\System\EcfCykw.exe
  2⤵
  PID:14600
- C:\Windows\System\jtFqOFg.exe
  C:\Windows\System\jtFqOFg.exe
  2⤵
  PID:13648
- C:\Windows\System\RZUOKNb.exe
  C:\Windows\System\RZUOKNb.exe
  2⤵
  PID:14652
- C:\Windows\System\qpqoNuD.exe
  C:\Windows\System\qpqoNuD.exe
  2⤵
  PID:6616
- C:\Windows\System\fGzzzRc.exe
  C:\Windows\System\fGzzzRc.exe
  2⤵
  PID:14616
- C:\Windows\System\GdhmFuf.exe
  C:\Windows\System\GdhmFuf.exe
  2⤵
  PID:2300
- C:\Windows\System\cqymbNl.exe
  C:\Windows\System\cqymbNl.exe
  2⤵
  PID:14720
- C:\Windows\System\ApijbXB.exe
  C:\Windows\System\ApijbXB.exe
  2⤵
  PID:14744
- C:\Windows\System\NmJYBTg.exe
  C:\Windows\System\NmJYBTg.exe
  2⤵
  PID:14372
- C:\Windows\System\PfXLUiF.exe
  C:\Windows\System\PfXLUiF.exe
  2⤵
  PID:14400
- C:\Windows\System\JlcUfHL.exe
  C:\Windows\System\JlcUfHL.exe
  2⤵
  PID:14460
- C:\Windows\System\DcjnkJB.exe
  C:\Windows\System\DcjnkJB.exe
  2⤵
  PID:14572
- C:\Windows\System\fPOPKIW.exe
  C:\Windows\System\fPOPKIW.exe
  2⤵
  PID:14828
- C:\Windows\System\DUTqAMo.exe
  C:\Windows\System\DUTqAMo.exe
  2⤵
  PID:1544
- C:\Windows\System\huTbVvs.exe
  C:\Windows\System\huTbVvs.exe
  2⤵
  PID:8336
- C:\Windows\System\HCeRbpr.exe
  C:\Windows\System\HCeRbpr.exe
  2⤵
  PID:15100
- C:\Windows\System\VJdlMll.exe
  C:\Windows\System\VJdlMll.exe
  2⤵
  PID:14952
- C:\Windows\System\RSdJhXm.exe
  C:\Windows\System\RSdJhXm.exe
  2⤵
  PID:15160
- C:\Windows\System\uyaLcWJ.exe
  C:\Windows\System\uyaLcWJ.exe
  2⤵
  PID:14992
- C:\Windows\System\jLkhZil.exe
  C:\Windows\System\jLkhZil.exe
  2⤵
  PID:8516
- C:\Windows\System\AQDDOlw.exe
  C:\Windows\System\AQDDOlw.exe
  2⤵
  PID:15044
- C:\Windows\System\JVjIWux.exe
  C:\Windows\System\JVjIWux.exe
  2⤵
  PID:15244
- C:\Windows\System\PrEfSuF.exe
  C:\Windows\System\PrEfSuF.exe
  2⤵
  PID:15292
- C:\Windows\System\cSCknVO.exe
  C:\Windows\System\cSCknVO.exe
  2⤵
  PID:15184
- C:\Windows\System\ALKcPYe.exe
  C:\Windows\System\ALKcPYe.exe
  2⤵
  PID:6588
- C:\Windows\System\bTXOkPw.exe
  C:\Windows\System\bTXOkPw.exe
  2⤵
  PID:8648
- C:\Windows\System\hKsaWQL.exe
  C:\Windows\System\hKsaWQL.exe
  2⤵
  PID:8616
- C:\Windows\System\ofSsrnW.exe
  C:\Windows\System\ofSsrnW.exe
  2⤵
  PID:15316
- C:\Windows\System\RzrVZtH.exe
  C:\Windows\System\RzrVZtH.exe
  2⤵
  PID:4204
- C:\Windows\System\OWnGgii.exe
  C:\Windows\System\OWnGgii.exe
  2⤵
  PID:8664
- C:\Windows\System\gayxnjW.exe
  C:\Windows\System\gayxnjW.exe
  2⤵
  PID:13572
- C:\Windows\System\NbHjhHh.exe
  C:\Windows\System\NbHjhHh.exe
  2⤵
  PID:7720
- C:\Windows\System\dfaBHts.exe
  C:\Windows\System\dfaBHts.exe
  2⤵
  PID:6740
- C:\Windows\System\LstjZFw.exe
  C:\Windows\System\LstjZFw.exe
  2⤵
  PID:7308
- C:\Windows\System\aQoZqQe.exe
  C:\Windows\System\aQoZqQe.exe
  2⤵
  PID:5760
- C:\Windows\System\BSngAMT.exe
  C:\Windows\System\BSngAMT.exe
  2⤵
  PID:6188
- C:\Windows\System\aoBuoCE.exe
  C:\Windows\System\aoBuoCE.exe
  2⤵
  PID:7324
- C:\Windows\System\yhBFTgN.exe
  C:\Windows\System\yhBFTgN.exe
  2⤵
  PID:784
- C:\Windows\System\oQxIPEM.exe
  C:\Windows\System\oQxIPEM.exe
  2⤵
  PID:14380
- C:\Windows\System\QYXitkJ.exe
  C:\Windows\System\QYXitkJ.exe
  2⤵
  PID:8900
- C:\Windows\System\hEqeDrY.exe
  C:\Windows\System\hEqeDrY.exe
  2⤵
  PID:14508
- C:\Windows\System\HpeLAoZ.exe
  C:\Windows\System\HpeLAoZ.exe
  2⤵
  PID:6356
- C:\Windows\System\ziKsIOF.exe
  C:\Windows\System\ziKsIOF.exe
  2⤵
  PID:1288
- C:\Windows\System\inzJJMw.exe
  C:\Windows\System\inzJJMw.exe
  2⤵
  PID:14696
- C:\Windows\System\vxreBPZ.exe
  C:\Windows\System\vxreBPZ.exe
  2⤵
  PID:8316
- C:\Windows\System\nJmMeVV.exe
  C:\Windows\System\nJmMeVV.exe
  2⤵
  PID:9404
- C:\Windows\System\CPisNlC.exe
  C:\Windows\System\CPisNlC.exe
  2⤵
  PID:7916
- C:\Windows\System\ltbaemt.exe
  C:\Windows\System\ltbaemt.exe
  2⤵
  PID:6640
- C:\Windows\System\ubquAYV.exe
  C:\Windows\System\ubquAYV.exe
  2⤵
  PID:8428
- C:\Windows\System\ZscHHsp.exe
  C:\Windows\System\ZscHHsp.exe
  2⤵
  PID:15036
- C:\Windows\System\aXtryiM.exe
  C:\Windows\System\aXtryiM.exe
  2⤵
  PID:8292
- C:\Windows\System\bFBnNjX.exe
  C:\Windows\System\bFBnNjX.exe
  2⤵
  PID:15356
- C:\Windows\System\PkLMjSC.exe
  C:\Windows\System\PkLMjSC.exe
  2⤵
  PID:15116
- C:\Windows\System\aHxioAJ.exe
  C:\Windows\System\aHxioAJ.exe
  2⤵
  PID:8868
- C:\Windows\System\XFokHMm.exe
  C:\Windows\System\XFokHMm.exe
  2⤵
  PID:9980
- C:\Windows\System\njZOzGn.exe
  C:\Windows\System\njZOzGn.exe
  2⤵
  PID:7332
- C:\Windows\System\cPizoAW.exe
  C:\Windows\System\cPizoAW.exe
  2⤵
  PID:8640
- C:\Windows\System\pAQgKqs.exe
  C:\Windows\System\pAQgKqs.exe
  2⤵
  PID:8440
- C:\Windows\System\lHpNYcR.exe
  C:\Windows\System\lHpNYcR.exe
  2⤵
  PID:15352
- C:\Windows\System\vCKVSEI.exe
  C:\Windows\System\vCKVSEI.exe
  2⤵
  PID:15288
- C:\Windows\System\kQIvOIM.exe
  C:\Windows\System\kQIvOIM.exe
  2⤵
  PID:9436
- C:\Windows\System\AtGBzTk.exe
  C:\Windows\System\AtGBzTk.exe
  2⤵
  PID:15368
- C:\Windows\System\QuPARuf.exe
  C:\Windows\System\QuPARuf.exe
  2⤵
  PID:15384
- C:\Windows\System\RqBsOLI.exe
  C:\Windows\System\RqBsOLI.exe
  2⤵
  PID:15408
- C:\Windows\System\pOfdrqb.exe
  C:\Windows\System\pOfdrqb.exe
  2⤵
  PID:15428
- C:\Windows\System\mjCwpQj.exe
  C:\Windows\System\mjCwpQj.exe
  2⤵
  PID:15444
- C:\Windows\System\waiHcCh.exe
  C:\Windows\System\waiHcCh.exe
  2⤵
  PID:15460
- C:\Windows\System\yxrJlxC.exe
  C:\Windows\System\yxrJlxC.exe
  2⤵
  PID:15524
- C:\Windows\System\kVAMksx.exe
  C:\Windows\System\kVAMksx.exe
  2⤵
  PID:15544
- C:\Windows\System\xqlGlrx.exe
  C:\Windows\System\xqlGlrx.exe
  2⤵
  PID:15644
- C:\Windows\System\fOFNMhL.exe
  C:\Windows\System\fOFNMhL.exe
  2⤵
  PID:15720
- C:\Windows\System\ZoNKumt.exe
  C:\Windows\System\ZoNKumt.exe
  2⤵
  PID:15736
- C:\Windows\System\QsUtvgP.exe
  C:\Windows\System\QsUtvgP.exe
  2⤵
  PID:15756
- C:\Windows\System\UciQhkE.exe
  C:\Windows\System\UciQhkE.exe
  2⤵
  PID:15892
- C:\Windows\System\ulmRJWK.exe
  C:\Windows\System\ulmRJWK.exe
  2⤵
  PID:16108
- C:\Windows\System\WozJZdJ.exe
  C:\Windows\System\WozJZdJ.exe
  2⤵
  PID:16124
- C:\Windows\System\zOqcHBu.exe
  C:\Windows\System\zOqcHBu.exe
  2⤵
  PID:16144
- C:\Windows\System\DvHQLar.exe
  C:\Windows\System\DvHQLar.exe
  2⤵
  PID:16160
- C:\Windows\System\gwYjcXw.exe
  C:\Windows\System\gwYjcXw.exe
  2⤵
  PID:16184
- C:\Windows\System\RfiXzLJ.exe
  C:\Windows\System\RfiXzLJ.exe
  2⤵
  PID:16204
- C:\Windows\System\YfQAmNu.exe
  C:\Windows\System\YfQAmNu.exe
  2⤵
  PID:16228
- C:\Windows\System\IVZqJYP.exe
  C:\Windows\System\IVZqJYP.exe
  2⤵
  PID:16308
- C:\Windows\System\wwcOogQ.exe
  C:\Windows\System\wwcOogQ.exe
  2⤵
  PID:16340
- C:\Windows\System\dQBjjNP.exe
  C:\Windows\System\dQBjjNP.exe
  2⤵
  PID:8908
- C:\Windows\System\tHGDGmf.exe
  C:\Windows\System\tHGDGmf.exe
  2⤵
  PID:9996
- C:\Windows\System\efGpStv.exe
  C:\Windows\System\efGpStv.exe
  2⤵
  PID:9804
- C:\Windows\System\GNWjgGg.exe
  C:\Windows\System\GNWjgGg.exe
  2⤵
  PID:7880
- C:\Windows\System\fBWmaEZ.exe
  C:\Windows\System\fBWmaEZ.exe
  2⤵
  PID:14340
- C:\Windows\System\NdxwIdh.exe
  C:\Windows\System\NdxwIdh.exe
  2⤵
  PID:7920
- C:\Windows\System\PPAuGWR.exe
  C:\Windows\System\PPAuGWR.exe
  2⤵
  PID:7076
- C:\Windows\System\fNJpYVa.exe
  C:\Windows\System\fNJpYVa.exe
  2⤵
  PID:8224
- C:\Windows\System\iVUwYnv.exe
  C:\Windows\System\iVUwYnv.exe
  2⤵
  PID:8808
- C:\Windows\System\lONtmMM.exe
  C:\Windows\System\lONtmMM.exe
  2⤵
  PID:12624
- C:\Windows\System\FowoBuD.exe
  C:\Windows\System\FowoBuD.exe
  2⤵
  PID:10460
- C:\Windows\System\azIqUBt.exe
  C:\Windows\System\azIqUBt.exe
  2⤵
  PID:7872
- C:\Windows\System\zInrvsH.exe
  C:\Windows\System\zInrvsH.exe
  2⤵
  PID:15684
- C:\Windows\System\deEfHhU.exe
  C:\Windows\System\deEfHhU.exe
  2⤵
  PID:15696
- C:\Windows\System\MCdguzC.exe
  C:\Windows\System\MCdguzC.exe
  2⤵
  PID:15716
- C:\Windows\System\BkHOOGi.exe
  C:\Windows\System\BkHOOGi.exe
  2⤵
  PID:10688
- C:\Windows\System\DXPlBuj.exe
  C:\Windows\System\DXPlBuj.exe
  2⤵
  PID:10180
- C:\Windows\System\zHPoKNH.exe
  C:\Windows\System\zHPoKNH.exe
  2⤵
  PID:15492
- C:\Windows\System\hsSnKnN.exe
  C:\Windows\System\hsSnKnN.exe
  2⤵
  PID:15652
- C:\Windows\System\flhVHAH.exe
  C:\Windows\System\flhVHAH.exe
  2⤵
  PID:15672
- C:\Windows\System\GFyTFMW.exe
  C:\Windows\System\GFyTFMW.exe
  2⤵
  PID:10320
- C:\Windows\System\cdHiUcl.exe
  C:\Windows\System\cdHiUcl.exe
  2⤵
  PID:11084
- C:\Windows\System\djespEm.exe
  C:\Windows\System\djespEm.exe
  2⤵
  PID:10828
- C:\Windows\System\YaPuPvc.exe
  C:\Windows\System\YaPuPvc.exe
  2⤵
  PID:10680
- C:\Windows\System\YYHugyC.exe
  C:\Windows\System\YYHugyC.exe
  2⤵
  PID:10112
- C:\Windows\System\cHxqzGS.exe
  C:\Windows\System\cHxqzGS.exe
  2⤵
  PID:11096
- C:\Windows\System\adzlYoF.exe
  C:\Windows\System\adzlYoF.exe
  2⤵
  PID:8800
- C:\Windows\System\kOtrUgU.exe
  C:\Windows\System\kOtrUgU.exe
  2⤵
  PID:16100
- C:\Windows\System\dXjpvaz.exe
  C:\Windows\System\dXjpvaz.exe
  2⤵
  PID:16372
- C:\Windows\System\ObCxidx.exe
  C:\Windows\System\ObCxidx.exe
  2⤵
  PID:9904
- C:\Windows\System\KqxlyCV.exe
  C:\Windows\System\KqxlyCV.exe
  2⤵
  PID:11060
- C:\Windows\System\GyvdZJu.exe
  C:\Windows\System\GyvdZJu.exe
  2⤵
  PID:8004
- C:\Windows\System\iBcHzWe.exe
  C:\Windows\System\iBcHzWe.exe
  2⤵
  PID:10652
- C:\Windows\System\AhWZiqJ.exe
  C:\Windows\System\AhWZiqJ.exe
  2⤵
  PID:10324
- C:\Windows\System\xGFrCBy.exe
  C:\Windows\System\xGFrCBy.exe
  2⤵
  PID:10820
- C:\Windows\System\OLUghec.exe
  C:\Windows\System\OLUghec.exe
  2⤵
  PID:8720
- C:\Windows\System\RdleHnA.exe
  C:\Windows\System\RdleHnA.exe
  2⤵
  PID:14032
- C:\Windows\System\sHvTDyc.exe
  C:\Windows\System\sHvTDyc.exe
  2⤵
  PID:9816
- C:\Windows\System\xqppHay.exe
  C:\Windows\System\xqppHay.exe
  2⤵
  PID:10040
- C:\Windows\System\rqjCfbQ.exe
  C:\Windows\System\rqjCfbQ.exe
  2⤵
  PID:9584
- C:\Windows\System\bOgiekf.exe
  C:\Windows\System\bOgiekf.exe
  2⤵
  PID:15456
- C:\Windows\System\KLBJBKz.exe
  C:\Windows\System\KLBJBKz.exe
  2⤵
  PID:7784
- C:\Windows\System\LjZWyqM.exe
  C:\Windows\System\LjZWyqM.exe
  2⤵
  PID:10028
- C:\Windows\System\ksrFVkU.exe
  C:\Windows\System\ksrFVkU.exe
  2⤵
  PID:8776
- C:\Windows\System\WmZJcoO.exe
  C:\Windows\System\WmZJcoO.exe
  2⤵
  PID:7000
- C:\Windows\System\mTmsYQO.exe
  C:\Windows\System\mTmsYQO.exe
  2⤵
  PID:9120
- C:\Windows\System\maZfLuV.exe
  C:\Windows\System\maZfLuV.exe
  2⤵
  PID:10132
- C:\Windows\System\FMcjssr.exe
  C:\Windows\System\FMcjssr.exe
  2⤵
  PID:10608
- C:\Windows\System\MfbJsvi.exe
  C:\Windows\System\MfbJsvi.exe
  2⤵
  PID:10396
- C:\Windows\System\VoYhMwp.exe
  C:\Windows\System\VoYhMwp.exe
  2⤵
  PID:15784
- C:\Windows\System\qNySTPd.exe
  C:\Windows\System\qNySTPd.exe
  2⤵
  PID:11584
- C:\Windows\System\yoTQEge.exe
  C:\Windows\System\yoTQEge.exe
  2⤵
  PID:12012
- C:\Windows\System\FufyhpI.exe
  C:\Windows\System\FufyhpI.exe
  2⤵
  PID:15452
- C:\Windows\System\PMgeCYW.exe
  C:\Windows\System\PMgeCYW.exe
  2⤵
  PID:9872
- C:\Windows\System\dFItthX.exe
  C:\Windows\System\dFItthX.exe
  2⤵
  PID:15860
- C:\Windows\System\zgSTbBV.exe
  C:\Windows\System\zgSTbBV.exe
  2⤵
  PID:15072
- C:\Windows\System\fJQRvZo.exe
  C:\Windows\System\fJQRvZo.exe
  2⤵
  PID:16012
- C:\Windows\System\uZgKnVc.exe
  C:\Windows\System\uZgKnVc.exe
  2⤵
  PID:12164
- C:\Windows\System\bHUssct.exe
  C:\Windows\System\bHUssct.exe
  2⤵
  PID:10784
- C:\Windows\System\TMSuutl.exe
  C:\Windows\System\TMSuutl.exe
  2⤵
  PID:16244
- C:\Windows\System\WlJOhYe.exe
  C:\Windows\System\WlJOhYe.exe
  2⤵
  PID:13000
- C:\Windows\System\QqRpCwZ.exe
  C:\Windows\System\QqRpCwZ.exe
  2⤵
  PID:15420
- C:\Windows\System\JVgPmOu.exe
  C:\Windows\System\JVgPmOu.exe
  2⤵
  PID:11020
- C:\Windows\System\gxOJXyB.exe
  C:\Windows\System\gxOJXyB.exe
  2⤵
  PID:15792
- C:\Windows\System\njTiVap.exe
  C:\Windows\System\njTiVap.exe
  2⤵
  PID:15836
- C:\Windows\System\LQfBYia.exe
  C:\Windows\System\LQfBYia.exe
  2⤵
  PID:15560
- C:\Windows\System\LbdCrce.exe
  C:\Windows\System\LbdCrce.exe
  2⤵
  PID:15920
- C:\Windows\System\PPNIzbq.exe
  C:\Windows\System\PPNIzbq.exe
  2⤵
  PID:15816
- C:\Windows\System\UHecxEk.exe
  C:\Windows\System\UHecxEk.exe
  2⤵
  PID:15852
- C:\Windows\System\VTjsKbC.exe
  C:\Windows\System\VTjsKbC.exe
  2⤵
  PID:2360
- C:\Windows\System\myUwOvb.exe
  C:\Windows\System\myUwOvb.exe
  2⤵
  PID:12072
- C:\Windows\System\YRMyyov.exe
  C:\Windows\System\YRMyyov.exe
  2⤵
  PID:9368
- C:\Windows\System\kQWloEx.exe
  C:\Windows\System\kQWloEx.exe
  2⤵
  PID:10488
- C:\Windows\System\MllpkgX.exe
  C:\Windows\System\MllpkgX.exe
  2⤵
  PID:11372
- C:\Windows\System\mOcyPRH.exe
  C:\Windows\System\mOcyPRH.exe
  2⤵
  PID:8604
- C:\Windows\System\NTiGxdh.exe
  C:\Windows\System\NTiGxdh.exe
  2⤵
  PID:9048
- C:\Windows\System\dQlElzw.exe
  C:\Windows\System\dQlElzw.exe
  2⤵
  PID:16240
- C:\Windows\System\EcGLPPx.exe
  C:\Windows\System\EcGLPPx.exe
  2⤵
  PID:9808
- C:\Windows\System\TUQSIrx.exe
  C:\Windows\System\TUQSIrx.exe
  2⤵
  PID:10596
- C:\Windows\System\SkaXUgB.exe
  C:\Windows\System\SkaXUgB.exe
  2⤵
  PID:12192
- C:\Windows\System\iRFBCGo.exe
  C:\Windows\System\iRFBCGo.exe
  2⤵
  PID:8740
- C:\Windows\System\UWUmayf.exe
  C:\Windows\System\UWUmayf.exe
  2⤵
  PID:15832
- C:\Windows\System\TTvrbGY.exe
  C:\Windows\System\TTvrbGY.exe
  2⤵
  PID:11604
- C:\Windows\System\ndxKxoe.exe
  C:\Windows\System\ndxKxoe.exe
  2⤵
  PID:11468
- C:\Windows\System\UHSKaqh.exe
  C:\Windows\System\UHSKaqh.exe
  2⤵
  PID:8856
- C:\Windows\System\BYzgOEM.exe
  C:\Windows\System\BYzgOEM.exe
  2⤵
  PID:10344
- C:\Windows\System\ECJIehH.exe
  C:\Windows\System\ECJIehH.exe
  2⤵
  PID:8064
- C:\Windows\System\SVIPnuG.exe
  C:\Windows\System\SVIPnuG.exe
  2⤵
  PID:15844
- C:\Windows\System\BJbJlNQ.exe
  C:\Windows\System\BJbJlNQ.exe
  2⤵
  PID:13024
- C:\Windows\System\WDXVcRT.exe
  C:\Windows\System\WDXVcRT.exe
  2⤵
  PID:5216
- C:\Windows\System\QQyCnDV.exe
  C:\Windows\System\QQyCnDV.exe
  2⤵
  PID:12972
- C:\Windows\System\BfbQXFF.exe
  C:\Windows\System\BfbQXFF.exe
  2⤵
  PID:16328
- C:\Windows\System\QeaZfMP.exe
  C:\Windows\System\QeaZfMP.exe
  2⤵
  PID:9324
- C:\Windows\System\wNAXHtA.exe
  C:\Windows\System\wNAXHtA.exe
  2⤵
  PID:16052
- C:\Windows\System\oipBUVR.exe
  C:\Windows\System\oipBUVR.exe
  2⤵
  PID:12500

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 600 -p 12956 -ip 12956
1⤵
PID:12924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_40bddzy0.wjy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AUmlLHR.exe

Filesize
1.9MB

MD5
6792b97f98736f31b6ccb599c9afb9cb

SHA1
219482a6c03ac171c905505994124b66faa2839a

SHA256
7d840477b737eeec32592170aea74b5512341738ac0975d19aeeeb3e0351c30c

SHA512
7459b95ea6dcb1863c2f9a2fcbb3c32df76b86f94280786a9dcbb0d404ba163f43ada74099601f8a284d324c71c750e30599f6d42d2a939e3d321efc8ad8ae96

Download Submit
C:\Windows\System\BXgEVFb.exe

Filesize
1.9MB

MD5
9b1ccbe7c0d7a48eaef85f0626828a7d

SHA1
0051aa327a84a4e32e4cae237263cf4dff6f1244

SHA256
39cb5763bfca3e0fa776fad6635323bdea89c6391100c009b06cc1aa65216147

SHA512
66badfde6c5e99bb859babf369153ea76c935d157bc12aaeb18057bcfb9b0085836cd6e513aa3a165b45c254a31eaa61dcdf3eef3a80299a91f31a10834a48ad

Download Submit
C:\Windows\System\CcapLba.exe

Filesize
1.9MB

MD5
d4b6531457928b556cedf841a19009ad

SHA1
144e89bb7dff30f9b2b883cb911a7cebbe44fa2f

SHA256
b9c01460fbbb638a48227ee2b48972db76b1916f15290762b6d66b023d4db541

SHA512
c2fdb0de7d8f2dc436fbd6621e626747f4ba54e17d7b62daef4fea7d12015374a96f1f1b813331a455cb377c84c168d20a368c7704cd957967bfd2c132de170c

Download Submit
C:\Windows\System\EfaGjbz.exe

Filesize
1.9MB

MD5
20e2b9c2b334d0d36094c412b19588f7

SHA1
926602ca8f2e2fb4712c77782bf5f11c7c2c8fc0

SHA256
7f53638103e10b77d0fe3d888c23ffb47a80712436b95a8a15b50b73265178d4

SHA512
2466e60ccecbd31c211fe1442e85091de50929dfce6eb1b4bb73f8edef4df73e851dea366249f10f0d89fc5f64ac094714b38cc193444f0d7c5e473359d0bb56

Download Submit
C:\Windows\System\FwJikVv.exe

Filesize
1.9MB

MD5
11e93f4309ab36a01818bc09688d7a23

SHA1
4a3edba04bc6cde4b42f36b7abd5efbe5b6455dd

SHA256
3cecca2b5b6db92d3af9f6d8952739e3e774e993cc7174bf347edb33510525ff

SHA512
f06840188f201adf29c6e975805ba8062142375044517d3304ff0a00701358282e263f81e04633bcff09c26952fe806d74d1ba7b16fbeee07cf8b37e3a817c1b

Download Submit
C:\Windows\System\HcXuxiL.exe

Filesize
1.9MB

MD5
438adf604ce6c63dcd9b462a31220def

SHA1
6009b07aa46be3adfed3836a2c7edde928811be2

SHA256
b60ad2a172f1ba7d0c1509a19a242e4f269fff74b0a0551179b97596bee8f2b5

SHA512
ae4bcf4c1f7953689a6c5f586f002adf41edcffc40f809ca4d4570521267abc66d60e8b11a2b806ef47643fea0650bcc90f4fd898ceeaf5c252a160df56b865b

Download Submit
C:\Windows\System\HwrUpAO.exe

Filesize
1.9MB

MD5
46e45ac5c22fdd5a08bc830c83315094

SHA1
162537f6d99aa70d23784c33578210c4f47c80b1

SHA256
f62d1fbeb57e7dd1da1556ebac7c45602add26f384951d51b827586b2b729888

SHA512
877d4d57b12329ccc7517febc194bc6f18ae69a41e1c39fcb1f17f176a79ca6229a32eac06f960d3c96ce8537725883bc108abc21257a00f126ad2da4eb1c099

Download Submit
C:\Windows\System\HyzQaeI.exe

Filesize
1.9MB

MD5
f11dec7100c0b9789001edd00f342854

SHA1
5b3b088115f33c9e39322d98319bfa6f2cd0bc59

SHA256
b3bc47a5cee4c0298340c1adf4f4ffcc6e42dfce8cf9381bf28a68f80525bf3c

SHA512
4a4c67e8af013f682507a5209b001b3ad3dd64d9f6c3e038658c3a4ce30f4b7e5d695f6e839e78dd2f41af070c509daa2260599d35289f5468a54db11c1c9657

Download Submit
C:\Windows\System\JLEDMJA.exe

Filesize
1.9MB

MD5
e13e5c5a370eaa3298dfe9192c4569f2

SHA1
3356a450722fbf42938bdb6ff4c5102f3ec47458

SHA256
8cb8d6a4af53b47108bb52fb7924a8e3b0639a89179b703921e9a55a497f3c39

SHA512
1d47356c7464723058af18e7c2eccb0673760819295322339cc790bcc035ec8286daa88eeccf11b57f7947bb055ff5a93de1e115d32f5ee5d6ba6a98ea3af3c6

Download Submit
C:\Windows\System\KFBGnCJ.exe

Filesize
1.9MB

MD5
a675f77efd10d5fc2f34d92a6b0be7de

SHA1
39581b3eafd07c9219d9b1e28ee783d5db97a31f

SHA256
4c0a94373922a4e666cb4b1ca10c3dcccb1cc8e117500cd24f0a8f9cc2455aad

SHA512
ab2a81792c4c9b93816669cf46fa1457b8c14977c0489b7ee2f0136256e73e09747965d93e72251b44761300c44ffba10ec93121785af45de4bc9d2e0e72b349

Download Submit
C:\Windows\System\MKgmUgC.exe

Filesize
1.9MB

MD5
df2a63037a289efff7b7ad25458ae28e

SHA1
c879d0c89dc6756cb2135b020b0e3adb5c6ba806

SHA256
06d51535955889901c21328ed0e58dd01e68bc4679fca5cdc90f16487d97379f

SHA512
d6ed852721516f5245c60b05e257c89050bee571336b5eb9c58e7e8b11a509b2b717cf5c3aeda5c4d9fa6921a7aee058db1b452574aaae233051043f1c317759

Download Submit
C:\Windows\System\QEjGdlR.exe

Filesize
1.9MB

MD5
219bb59c24f2b21c69b1a1e28d944690

SHA1
54bb10f394d1999ca7b289bd38d07cb4f75597ae

SHA256
58ef2913ffa2086ee583a010570391502bb922c3a5f48a292444ba84ccc5e2a5

SHA512
2803f44d53ac95c72c891990b54f445e356500797c195ec8bbbbe21b9b2ae7e61542d2e28940cef9a885c10bb1a835b83822b9c84b65d480c33ba78032745bba

Download Submit
C:\Windows\System\TsBBALN.exe

Filesize
1.9MB

MD5
d7eadaaf78e8811dee62aaa9dba1d7b6

SHA1
8a4d08ba4667ce33112c238a7903adf1e2c3078b

SHA256
4802af957feea4897d0d5c36f3fe62dbe4b338f1bead2998e7376c5c566739e2

SHA512
59e5b1938b38fe0ca35a871c7fe915c417b4ca226807d57b101be6ce36acb68c842d84b8335bea218b1e47171f3acc8405e622c219c30a117fd5ab451e1ed239

Download Submit
C:\Windows\System\WCmVqWd.exe

Filesize
1.9MB

MD5
f1c4cbc825e2f9ec59d0249780766d7d

SHA1
4491be44256f07d5e6ea550a2eac33d33c8376c6

SHA256
0ed5354e89c50d4f5cf4ecae54b761abe8577fd337baa9a88723c997013186af

SHA512
8f012a26dd5ed1cbbe95351c873f322659e892630da2ac7295b43b21d779a30870afba9ac32d38b5b8d75cf1264945d590700f92f4a216429259fb2c5b244fb5

Download Submit
C:\Windows\System\WGejfBf.exe

Filesize
1.9MB

MD5
25ae1dbd32cfc69600d0bbc15edac7b3

SHA1
49005e774421876cb21c39d6692ad7376a2c1f50

SHA256
b28802050297b742003b5e4534fe7e39f0032a5593b08e31cf83719d0a8fa61d

SHA512
1df384580a1e5b40e7281d359e21c7feed0ad6c0389d92324556698194cc45951109b6bcf18ed18d3dfd53d275a58d4da4a27d2540c3851bd5312bc497fc08ef

Download Submit
C:\Windows\System\bktoqDb.exe

Filesize
1.9MB

MD5
2c05137d805cb63af0e29a2762d19b2e

SHA1
f28bfd0d158d8087817b926fdfdb02fb9ce06605

SHA256
0e8a68ab54cdb1f2eeea7774fce0252cb7737e219e02ac86d58903ef8e1343a3

SHA512
48a9c836023cb1f6eaf6f8319b477396e7e4ae9c36c068631df476b111ccee58b6d389cfb90dd3d5f370a9b7de4b39f6d9cf4974b24dd13e9889c316cdde655a

Download Submit
C:\Windows\System\cakYCSU.exe

Filesize
1.9MB

MD5
380bd8da775fe0185e2eb778abb22a40

SHA1
cb7c66bc661dd018e43ca8d851666f5eab7cfe1d

SHA256
a3b85c8b34e0f11434e0ebcd3bb13d7f105be04c80e33e6ec1ce5941bcd8359f

SHA512
87c22a9be224f397eecf80239facaeaa6c43a8fb0c95b1c41b92cd34cd6b499d93f31b174e768449c643f78c4bc201d1c5fb2ec262cd53e2873b6bda2bd11a7d

Download Submit
C:\Windows\System\fJVRFrK.exe

Filesize
1.9MB

MD5
107af4292dd5a1626a554639ac30de97

SHA1
9a0435cdcdec7831020bf874615c3f8ae63d9a57

SHA256
98656b831de6f4165bb5745a183a07df3f53daed67661abe75298f52e32041f7

SHA512
fdc68f24c9c7235bac52b75a65b628b149d1cf76f24168891b641e71ca06e01939b3b5aafcba3f1fe1d66f4d979800ae9ec3bafc0c6f750825173d38b5940b0a

Download Submit
C:\Windows\System\iUghxIe.exe

Filesize
1.9MB

MD5
7d71a2e49aa4f17c7fd748a2c81d4989

SHA1
0ca30f7e6d16f03df8dfb9e2961035255bd49ac8

SHA256
3e205012c2a05fc38d42d1e321f463cbaa544708e3ac4d41593882059b91566a

SHA512
7aba9c8dc2ef2de120a7c6c77cd7abc9124a003b6b71e07a20fddea6571428b30e6bdfe400e8060dc0d40aa6da36313088a2bd023bc7b26b3e4e608a1d204355

Download Submit
C:\Windows\System\iapncog.exe

Filesize
1.9MB

MD5
1fad9ebb46dcc4c8e3e55c94b04bf4f8

SHA1
73e7281d1df3ae40c886719d5282eb5b53ba16bf

SHA256
ce3fb08f6274f9e536608b473efc7e08e879097847ac35bb620b2c07ea6c4553

SHA512
7f37fa717b72e21b1fbcdf94f5133f700c52735da18ece01ca1b79a7f9adf845776c6f678ecfca66ce04564cc41503adf70958817dfed5b95fc56f0ca98085b1

Download Submit
C:\Windows\System\mGvxHQD.exe

Filesize
1.9MB

MD5
eb762ebb45b4df941820b6a5e8e53123

SHA1
dbac951f108f86fd1d09425f602ed09270bf2cc1

SHA256
359a667b46bf20ba0a2d3549a4b37b38c477f427799256bacb9ac38b96c24190

SHA512
2b3a6321c0ce983878ce83376743fcc880aa79d3d1dbf4445ab4dc4861eec066ad4995c7b830f6d7b845bc01c78bebaf138879ee87604e90e0f31041516d7af4

Download Submit
C:\Windows\System\mbrdDPp.exe

Filesize
1.9MB

MD5
66e4c0848232d39421a2f6b204a0928a

SHA1
5f1f93486d4f236477f652fd6de681358d7d0aef

SHA256
5e9943f097b8f36673cbf2be34be931275f79db30a5d0db3a4c27e4d2340d995

SHA512
0d5369c639d9eb7575c9f739d28ed44b48ff3310bf4005e9e59050ffb6c462b0c05f9e7e9ae8817b8d9b874c798c171f7da1f71fc42d26a310d9f400470c1c82

Download Submit
C:\Windows\System\mczveoA.exe

Filesize
1.9MB

MD5
81c7633034bcef32d428da4e3f692076

SHA1
2bd4b4310e95478ad702f753129a71f3b45cb9db

SHA256
d5c3c5a8b850173bfe3417acd1c1d8be9dd6cfc0e595d7ac9693bfc48c72a775

SHA512
cdecd65bb12e7c0f1f2ff86995c5ad70655043c40601320a8766bff933a578e54773ac12bdfe7d66d0ee97b24ec136698f4ac4d50f205beb23fb74380ab540e7

Download Submit
C:\Windows\System\oePdvYU.exe

Filesize
1.9MB

MD5
a910f42df78e217f76ee03337ca35169

SHA1
991dd76447c46d88eab2c3b46c532d2b0a5342cf

SHA256
68a550d89d369b1262b096fdaa9f5d26336e9917802b4083f8468db375bd8d5e

SHA512
c578cffc2b41234638c53bad9732c65b1db5da433aa1a4c338ea640a450485dce643c4574d335c59c1ad82df884071d4ab8b836c532f18ed0c17e904505943b5

Download Submit
C:\Windows\System\qkRvOSG.exe

Filesize
1.9MB

MD5
01fd3abfa4f2e9158e5f6595517822b8

SHA1
f6080a172424a370359517d0ffac5a37292e6bf6

SHA256
6f8e06b5db1a8128f2ba951829221fcbb946d96a4040ce787bf4fce8d0682ad8

SHA512
9aa09a6de3d266fb541174e0b9cd812300cb568bfe14451b171b71044810c685dd7821eb5d25918b59131463ebb1b62ec2a9d7b6c8547d2aef12f9862b6a33f9

Download Submit
C:\Windows\System\qpeCYYe.exe

Filesize
1.9MB

MD5
4eddd7743f5119bc2c8cc9c03525c84e

SHA1
43882fde0a92a593f87293a478270cc38b6f1b7f

SHA256
937b2ac91fa35d22bf6ce3dbd7a46b2f6953835da28ee3ffed53f5b89aef8fea

SHA512
57f125c1d4645b2b54c876329dd743a7736740e064ce04d7370e24aa7a1b8887fbef29562e91f8679ea19f19eca6b62add358ec884dfbfc19ef7c2eeb05c9836

Download Submit
C:\Windows\System\qwsTUAn.exe

Filesize
1.9MB

MD5
aa9dee9c20cca1ef3b2bb4bab9b3ddc1

SHA1
7e0f202129100e9f287a931df08118b71b883790

SHA256
6073f05ae3ce92c5988962942206d6c7f373a7931c1bf02c60bbaf5c6de1dc74

SHA512
04c6d1138c12a27348501848ccb6b7b21edd9ccbd430795b5cda86c8fbb0a0778c6502ac15f26ce528f70a53b68ce976a7be11c82271d0fae707f876ae04f839

Download Submit
C:\Windows\System\rsmKcMS.exe

Filesize
1.9MB

MD5
5082aab3d31dd6c66c631d64954c1a52

SHA1
e5ef349cce3de65eb259c183e2827f3e4ceb1bbe

SHA256
0bb354e2b4905ff613e8ca89b0cea29f27efbdf2599a77fac29720f324125585

SHA512
ac17f55ac5ea85a9ebbb4d95fb930824e8a977aedf48daa1e1084c4f30ff70c5c6b60b46b8ffc43fc3039fced22069723920379df1a7d9ee65c7c5cc00ad680d

Download Submit
C:\Windows\System\stesiGe.exe

Filesize
1.9MB

MD5
05ed89f0e7927d5d6f6499e1d785f489

SHA1
4be8861b02c8796aca19da2cf1958ea3693f3128

SHA256
739663841f6756d4484dabc093c4f87a480c181f70c4d8afe713babcf9a7f66e

SHA512
8c2ea64c0018c17fea4dddbfaad528a2c390a1084dcdba46adede9b3b95e7fb5b67cb37b2192e1f0cd204d2ecfa2c829e38c5ee95ef53c3545c80085fea76569

Download Submit
C:\Windows\System\vOUJITO.exe

Filesize
1.9MB

MD5
8e633755f6cf01671bbc870113cd2547

SHA1
403cf881946f33b1305d51d9b6d5f500b8e8e1ed

SHA256
f346597203396889816b682116346d33c5f78b878a0ccbf807567544e761155d

SHA512
f5c0ed3a3a9208c07ed04b06ecf64d4ce3fb2f8bcf1004a8b769b93651f5548b3dd720b9b146d0569843fe7a14387bfac23c579ea6ca68d053ec7bdf512687c1

Download Submit
C:\Windows\System\wCVxPlz.exe

Filesize
1.9MB

MD5
92a635eb8910515900ad92fda1191030

SHA1
0bf17818de018b1e601a5e922f6a18654f665447

SHA256
1a31defc8df89d1914c3cdce5608674ea8f147abd80e56aede178908aa082125

SHA512
97b591e364c1701a44be18ebd60c69b8b5cbb65f2b56d9ad019c5026f6a2e9b1a1e6fb82298346dec79fcc53fe90957f92fce779d2d4ce55fd691663864b8fa3

Download Submit
C:\Windows\System\wfgLKsB.exe

Filesize
1.9MB

MD5
258b6c8ed0370077b313011e4dbc09b7

SHA1
4f993e161ed1f54cf5a15bd2dda4e269062cd3ed

SHA256
76f9cc2449f27557324e834caf455a3724abd1277ac319d306d9540399b3e009

SHA512
88d34b1b79ec38141f253d51ed474ff9bd53979ec42ce2a6b3a2dc593873cdc2a9618d3849bcb95029a79bcc86487e2ee73afda2c2f04052e7aebac331f13e07

Download Submit
C:\Windows\System\xAAlUmy.exe

Filesize
1.9MB

MD5
5c137ecba6777cef4256e70383e34439

SHA1
749548fafac148bc642fa02f653ffd89aa4df279

SHA256
d9f3fad784b3e189f2dbab61f9f856e34e7ab3e82c69ffa5853610093d271ff1

SHA512
a33cd6aaa3aba62443e99de3c1082e23e006a68d6397cd6bee995ac2ab6db66b7d22da15a7782e1bb922d81413f622300176e2c03f6868a586e76fa44dbe0a4c

Download Submit
C:\Windows\System\xSIYhfA.exe

Filesize
1.9MB

MD5
3c2a526eee6d1cff2c5d56727554cc3d

SHA1
c9f26bc8fd2a6fd2d60b8c6dd24b1bb23e863ca9

SHA256
b3b67d732d8463d9737e4335ff2fb7cd84259f395b53ded2ed3f77fbf41f5ca6

SHA512
43913154de5787777e6d9888f6681442a5b39678fecd8d0b9874f59296681515d379180d041849e047330e6d2e538d7f978db0249a862f7561ce648c1ef6e9f1

Download Submit
C:\Windows\System\yYmQJnR.exe

Filesize
1.9MB

MD5
3a3062786708eee315bc3ae2368915dc

SHA1
93252db9b11c788ef5845c6829d9e65393a41260

SHA256
e4a0765ff81bf250120a7f6e294918b512efb93e4d1f15db16d70a0a5414ebc7

SHA512
cbe27e4f18ce3c7ad3bdaedfc07fcaf1857977be3de5a1d9a4aa8c7d99b4cccb98c395a1881ed616aead61b6888beda0eecc2b148a6cbaa412365fafea2c8eba

Download Submit
C:\Windows\System\yZDanNz.exe

Filesize
1.9MB

MD5
ad9e8717914ec6128c887caff3a6e441

SHA1
5a90cbced772396d75bd5d23f8921ae250571fb5

SHA256
70feea34cc349283d89b993e93c4e6329e3c425de01fccfeb997d57ea99f19cb

SHA512
ba3032015e22334bbcca1bd647067a948d9b4c11042e307934f54298c1801fcfdeeb4f202aa5f3f86c7133e5c0470b8a7d2eebf592b481b7bdf358ab4accb618

Download Submit
C:\Windows\System\ysIAHyO.exe

Filesize
1.9MB

MD5
0d2de7a93a323fd73caab4f00f31bcda

SHA1
a4681300dc7719c370de640deaa116b505d307be

SHA256
284b42f18503fb9505b0fe074161646fd9124f79130456426ab6cd774ebce19c

SHA512
55ab7d274cb66471644427d31f6d6a1241663ef6e6f335709fd04001710df515ab6b49088ae06f30cb5fcbd27dd4eb9b80b94677af8113b7959926c7cd3a8bb2

Download Submit
C:\Windows\System\ytMWltQ.exe

Filesize
1.9MB

MD5
9c56cc3c1c24680610eba0b1e36c5ea0

SHA1
530484596c3dc022730116789788fe91fc04dd26

SHA256
d2c29a996fb149f978b54d7c9780d6205749b28cb438d1a529f25ba3200d98d1

SHA512
9343e72b7864d1842f2a8987669fcffe530f65b5e4486640fca6a8046a144c339da3b24944e60f1aa9ff0152436b7672b3c3eecc4f9950d17855c027a59b18d9

Download Submit
C:\Windows\System\zgeaFqB.exe

Filesize
1.9MB

MD5
45f1e5ca7c407ed1987379ae52910760

SHA1
630e9453e4b4e8b3cbcd86de529c4b924b3db7f5

SHA256
1474d47f8e8382216c0500c35a2b313ac963018b612d5fc805291263708bda2e

SHA512
fbc25ddb34d79017a3c6752e72740aa8550e14384a6363d79f5e0b557f84bd11c0e537fc9765df320c4caf1be9817c2be6e78293af87903f991799adc02b24ee

Download Submit
C:\Windows\System\zpdJXnv.exe

Filesize
1.9MB

MD5
87d457681b39c180138372e0c8bd5044

SHA1
156b3447b762391612f0831b3fcf339c50b46bf4

SHA256
9d8802d158aa07ecd11af49af7732a8d709ba341eeeb7983664c12f66036ce28

SHA512
efb40bc437d94a1b942e61d287dad6a7cd4cec0b09c460a6e564aaee5ac03d9af759fb102cf27c12399f62d1bd6738492b24b9bf0a1463127d6e1884af2f2ccb

Download Submit
memory/216-2814-0x00007FF686D30000-0x00007FF687122000-memory.dmp

Filesize
3.9MB

Download
memory/216-303-0x00007FF686D30000-0x00007FF687122000-memory.dmp

Filesize
3.9MB

Download
memory/312-301-0x00007FF6DE610000-0x00007FF6DEA02000-memory.dmp

Filesize
3.9MB

Download
memory/312-2774-0x00007FF6DE610000-0x00007FF6DEA02000-memory.dmp

Filesize
3.9MB

Download
memory/452-295-0x00007FF6BA640000-0x00007FF6BAA32000-memory.dmp

Filesize
3.9MB

Download
memory/452-2762-0x00007FF6BA640000-0x00007FF6BAA32000-memory.dmp

Filesize
3.9MB

Download
memory/532-2677-0x00007FF77E5C0000-0x00007FF77E9B2000-memory.dmp

Filesize
3.9MB

Download
memory/532-575-0x00007FF77E5C0000-0x00007FF77E9B2000-memory.dmp

Filesize
3.9MB

Download
memory/632-2671-0x00007FF611620000-0x00007FF611A12000-memory.dmp

Filesize
3.9MB

Download
memory/632-574-0x00007FF611620000-0x00007FF611A12000-memory.dmp

Filesize
3.9MB

Download
memory/776-526-0x00007FF6C0F30000-0x00007FF6C1322000-memory.dmp

Filesize
3.9MB

Download
memory/776-2699-0x00007FF6C0F30000-0x00007FF6C1322000-memory.dmp

Filesize
3.9MB

Download
memory/812-293-0x00007FF7AFF70000-0x00007FF7B0362000-memory.dmp

Filesize
3.9MB

Download
memory/812-2747-0x00007FF7AFF70000-0x00007FF7B0362000-memory.dmp

Filesize
3.9MB

Download
memory/912-630-0x00007FF6E1DC0000-0x00007FF6E21B2000-memory.dmp

Filesize
3.9MB

Download
memory/912-2766-0x00007FF6E1DC0000-0x00007FF6E21B2000-memory.dmp

Filesize
3.9MB

Download
memory/1552-297-0x00007FF645A80000-0x00007FF645E72000-memory.dmp

Filesize
3.9MB

Download
memory/1552-2716-0x00007FF645A80000-0x00007FF645E72000-memory.dmp

Filesize
3.9MB

Download
memory/1920-2696-0x00007FF7B2C40000-0x00007FF7B3032000-memory.dmp

Filesize
3.9MB

Download
memory/1920-292-0x00007FF7B2C40000-0x00007FF7B3032000-memory.dmp

Filesize
3.9MB

Download
memory/2132-298-0x00007FF6F2B70000-0x00007FF6F2F62000-memory.dmp

Filesize
3.9MB

Download
memory/2132-2786-0x00007FF6F2B70000-0x00007FF6F2F62000-memory.dmp

Filesize
3.9MB

Download
memory/2552-2757-0x00007FF7847E0000-0x00007FF784BD2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-438-0x00007FF7847E0000-0x00007FF784BD2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-2761-0x00007FF6C5280000-0x00007FF6C5672000-memory.dmp

Filesize
3.9MB

Download
memory/2644-703-0x00007FF6C5280000-0x00007FF6C5672000-memory.dmp

Filesize
3.9MB

Download
memory/2868-89-0x00007FF8CD023000-0x00007FF8CD025000-memory.dmp

Filesize
8KB

Download
memory/2868-290-0x00007FF8CD020000-0x00007FF8CDAE1000-memory.dmp

Filesize
10.8MB

Download
memory/2868-160-0x00007FF8CD020000-0x00007FF8CDAE1000-memory.dmp

Filesize
10.8MB

Download
memory/2868-224-0x000001E049350000-0x000001E049372000-memory.dmp

Filesize
136KB

Download
memory/2880-2768-0x00007FF7805C0000-0x00007FF7809B2000-memory.dmp

Filesize
3.9MB

Download
memory/2880-296-0x00007FF7805C0000-0x00007FF7809B2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-48-0x00007FF673AA0000-0x00007FF673E92000-memory.dmp

Filesize
3.9MB

Download
memory/2932-25-0x00007FF6B2460000-0x00007FF6B2852000-memory.dmp

Filesize
3.9MB

Download
memory/3088-387-0x00007FF793020000-0x00007FF793412000-memory.dmp

Filesize
3.9MB

Download
memory/3088-2776-0x00007FF793020000-0x00007FF793412000-memory.dmp

Filesize
3.9MB

Download
memory/3184-299-0x00007FF68B7B0000-0x00007FF68BBA2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-2702-0x00007FF68B7B0000-0x00007FF68BBA2000-memory.dmp

Filesize
3.9MB

Download
memory/3472-302-0x00007FF646530000-0x00007FF646922000-memory.dmp

Filesize
3.9MB

Download
memory/3472-2743-0x00007FF646530000-0x00007FF646922000-memory.dmp

Filesize
3.9MB

Download
memory/3644-2771-0x00007FF7DE950000-0x00007FF7DED42000-memory.dmp

Filesize
3.9MB

Download
memory/3644-304-0x00007FF7DE950000-0x00007FF7DED42000-memory.dmp

Filesize
3.9MB

Download
memory/3856-68-0x00007FF6827D0000-0x00007FF682BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3944-300-0x00007FF615E00000-0x00007FF6161F2000-memory.dmp

Filesize
3.9MB

Download
memory/3944-2753-0x00007FF615E00000-0x00007FF6161F2000-memory.dmp

Filesize
3.9MB

Download
memory/3960-1-0x000001BD1D960000-0x000001BD1D970000-memory.dmp

Filesize
64KB

Download
memory/3960-0-0x00007FF6BB7D0000-0x00007FF6BBBC2000-memory.dmp

Filesize
3.9MB

Download
memory/3960-5852-0x00007FF6BB7D0000-0x00007FF6BBBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4400-294-0x00007FF624150000-0x00007FF624542000-memory.dmp

Filesize
3.9MB

Download
memory/4400-2735-0x00007FF624150000-0x00007FF624542000-memory.dmp

Filesize
3.9MB

Download
memory/4884-2670-0x00007FF656870000-0x00007FF656C62000-memory.dmp

Filesize
3.9MB

Download
memory/4884-33-0x00007FF656870000-0x00007FF656C62000-memory.dmp

Filesize
3.9MB

Download