xmrig | 1b0a95d01ed4d0c2a22f394c0a1f1c3b09e7cf41017524d696b6f218803c2fad

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fe59b6fcc62c9896513bed1660bd4b0N.exe
Size

2.6MB
MD5

1fe59b6fcc62c9896513bed1660bd4b0
SHA1

df47655e837fe13fe4037ce9c710e1a684a2e40c
SHA256

1b0a95d01ed4d0c2a22f394c0a1f1c3b09e7cf41017524d696b6f218803c2fad
SHA512

c58bdd6c6d8e0f5babe78cfbabd59e6c0547b8002f1db234e3fd0c59bd3aab971a18718cc24f6fc71fcb17c1b39234297a986fca85d4c7212bc293ea3648f568
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZnr:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rp

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4568-0-0x00007FF7A9C10000-0x00007FF7AA006000-memory.dmp	xmrig
behavioral2/files/0x0008000000023600-4.dat	xmrig
behavioral2/files/0x0007000000023604-10.dat	xmrig
behavioral2/memory/4244-11-0x00007FF7E5E40000-0x00007FF7E6236000-memory.dmp	xmrig
behavioral2/files/0x0007000000023605-16.dat	xmrig
behavioral2/memory/3716-17-0x00007FF6D5990000-0x00007FF6D5D86000-memory.dmp	xmrig
behavioral2/memory/3288-14-0x00007FF713F80000-0x00007FF714376000-memory.dmp	xmrig
behavioral2/files/0x0007000000023606-24.dat	xmrig
behavioral2/files/0x0007000000023608-44.dat	xmrig
behavioral2/files/0x000700000002360b-47.dat	xmrig
behavioral2/files/0x0008000000023609-60.dat	xmrig
behavioral2/files/0x000700000002360c-63.dat	xmrig
behavioral2/files/0x000700000002360d-68.dat	xmrig
behavioral2/files/0x000700000002360e-75.dat	xmrig
behavioral2/files/0x0007000000023610-84.dat	xmrig
behavioral2/files/0x0007000000023615-110.dat	xmrig
behavioral2/files/0x0007000000023616-116.dat	xmrig
behavioral2/files/0x000700000002361b-139.dat	xmrig
behavioral2/memory/1452-148-0x00007FF6B9060000-0x00007FF6B9456000-memory.dmp	xmrig
behavioral2/files/0x0007000000023620-165.dat	xmrig
behavioral2/memory/2028-180-0x00007FF7207B0000-0x00007FF720BA6000-memory.dmp	xmrig
behavioral2/memory/1104-183-0x00007FF6561B0000-0x00007FF6565A6000-memory.dmp	xmrig
behavioral2/memory/4648-186-0x00007FF7F0CF0000-0x00007FF7F10E6000-memory.dmp	xmrig
behavioral2/memory/2008-188-0x00007FF7F71D0000-0x00007FF7F75C6000-memory.dmp	xmrig
behavioral2/memory/2856-191-0x00007FF6D0A20000-0x00007FF6D0E16000-memory.dmp	xmrig
behavioral2/memory/2584-194-0x00007FF6E3BF0000-0x00007FF6E3FE6000-memory.dmp	xmrig
behavioral2/memory/1872-193-0x00007FF7FEEB0000-0x00007FF7FF2A6000-memory.dmp	xmrig
behavioral2/memory/656-192-0x00007FF7F14D0000-0x00007FF7F18C6000-memory.dmp	xmrig
behavioral2/memory/3044-190-0x00007FF7D4910000-0x00007FF7D4D06000-memory.dmp	xmrig
behavioral2/memory/4484-187-0x00007FF77DFE0000-0x00007FF77E3D6000-memory.dmp	xmrig
behavioral2/memory/3740-185-0x00007FF7BFEC0000-0x00007FF7C02B6000-memory.dmp	xmrig
behavioral2/memory/3612-184-0x00007FF77B190000-0x00007FF77B586000-memory.dmp	xmrig
behavioral2/memory/4808-182-0x00007FF6AFB10000-0x00007FF6AFF06000-memory.dmp	xmrig
behavioral2/memory/3604-181-0x00007FF627DA0000-0x00007FF628196000-memory.dmp	xmrig
behavioral2/files/0x0007000000023621-178.dat	xmrig
behavioral2/files/0x000700000002361f-174.dat	xmrig
behavioral2/files/0x000700000002361e-172.dat	xmrig
behavioral2/files/0x000700000002361d-170.dat	xmrig
behavioral2/files/0x000700000002361c-168.dat	xmrig
behavioral2/memory/1060-167-0x00007FF69D120000-0x00007FF69D516000-memory.dmp	xmrig
behavioral2/files/0x000700000002361a-144.dat	xmrig
behavioral2/files/0x0007000000023619-142.dat	xmrig
behavioral2/files/0x0007000000023618-140.dat	xmrig
behavioral2/memory/4796-138-0x00007FF7F8A10000-0x00007FF7F8E06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023617-133.dat	xmrig
behavioral2/memory/1828-122-0x00007FF657C70000-0x00007FF658066000-memory.dmp	xmrig
behavioral2/memory/3528-115-0x00007FF7B26C0000-0x00007FF7B2AB6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023612-111.dat	xmrig
behavioral2/files/0x0007000000023614-108.dat	xmrig
behavioral2/files/0x0007000000023613-106.dat	xmrig
behavioral2/files/0x0007000000023611-104.dat	xmrig
behavioral2/memory/2356-101-0x00007FF705DD0000-0x00007FF7061C6000-memory.dmp	xmrig
behavioral2/memory/760-98-0x00007FF6570A0000-0x00007FF657496000-memory.dmp	xmrig
behavioral2/files/0x000700000002360f-80.dat	xmrig
behavioral2/files/0x0007000000023622-222.dat	xmrig
behavioral2/files/0x000800000002360a-55.dat	xmrig
behavioral2/files/0x0007000000023607-36.dat	xmrig
behavioral2/memory/4244-704-0x00007FF7E5E40000-0x00007FF7E6236000-memory.dmp	xmrig
behavioral2/memory/3288-710-0x00007FF713F80000-0x00007FF714376000-memory.dmp	xmrig
behavioral2/memory/3716-717-0x00007FF6D5990000-0x00007FF6D5D86000-memory.dmp	xmrig
behavioral2/memory/760-729-0x00007FF6570A0000-0x00007FF657496000-memory.dmp	xmrig
behavioral2/memory/2356-745-0x00007FF705DD0000-0x00007FF7061C6000-memory.dmp	xmrig
behavioral2/memory/3528-753-0x00007FF7B26C0000-0x00007FF7B2AB6000-memory.dmp	xmrig
behavioral2/memory/1828-756-0x00007FF657C70000-0x00007FF658066000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	4816	powershell.exe
5	4816	powershell.exe
7	4816	powershell.exe
8	4816	powershell.exe
10	4816	powershell.exe
11	4816	powershell.exe
13	4816	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4816	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4244	PndbTqc.exe
3288	wvspnSW.exe
3716	INgvRrQ.exe
760	uJhNDHP.exe
2356	yEOtNHH.exe
3528	kEHtCpV.exe
1828	XwQFkna.exe
4796	hfPtmdx.exe
1452	mZnryWq.exe
1060	NCIHduK.exe
2028	YytHwkQ.exe
3604	arvilhM.exe
4808	mntpkek.exe
1104	hOfibAs.exe
3044	HtkNDOZ.exe
3612	TbxiuMc.exe
2856	WzYFKuT.exe
3740	DSDAeOK.exe
656	RLnCVoR.exe
4648	jDOMxxI.exe
1872	KwxJuhz.exe
2584	JFhusap.exe
4484	GSiNwVY.exe
2008	xwTYgcF.exe
3680	BRoUfpZ.exe
4912	PeGumxH.exe
496	kFCAtsp.exe
4292	MvncWVx.exe
1604	WbzOiGs.exe
2380	oZjtHzA.exe
5040	YpsZgMz.exe
3816	caWuucP.exe
2820	ZhnpsxB.exe
2428	yPDuLMS.exe
5080	puBfTft.exe
5068	hIIzylV.exe
2120	hrcOjlD.exe
2084	jPgTknw.exe
3080	hvvrZYS.exe
4616	mwzGyGi.exe
2996	ARyTpDw.exe
2824	SpvjTzs.exe
1360	arevsMU.exe
5116	rvYUFEI.exe
2968	ZXiorMy.exe
2672	rANHHdU.exe
3300	HgaoMKU.exe
864	ZWaPSfV.exe
2492	zNMPhDi.exe
1216	NODnmgz.exe
4104	OEajlhg.exe
1508	MCMPost.exe
4052	kBbhYZD.exe
1892	mwwLRXh.exe
3648	mUspIYN.exe
3952	sBkSdtP.exe
532	ncGLnqm.exe
3456	pAdMkep.exe
3152	bPEaAYc.exe
5160	diUtvAs.exe
5192	vctCYAW.exe
5244	YgjsCSF.exe
5264	SzkbosS.exe
5304	FjBXYKw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4568-0-0x00007FF7A9C10000-0x00007FF7AA006000-memory.dmp	upx
behavioral2/files/0x0008000000023600-4.dat	upx
behavioral2/files/0x0007000000023604-10.dat	upx
behavioral2/memory/4244-11-0x00007FF7E5E40000-0x00007FF7E6236000-memory.dmp	upx
behavioral2/files/0x0007000000023605-16.dat	upx
behavioral2/memory/3716-17-0x00007FF6D5990000-0x00007FF6D5D86000-memory.dmp	upx
behavioral2/memory/3288-14-0x00007FF713F80000-0x00007FF714376000-memory.dmp	upx
behavioral2/files/0x0007000000023606-24.dat	upx
behavioral2/files/0x0007000000023608-44.dat	upx
behavioral2/files/0x000700000002360b-47.dat	upx
behavioral2/files/0x0008000000023609-60.dat	upx
behavioral2/files/0x000700000002360c-63.dat	upx
behavioral2/files/0x000700000002360d-68.dat	upx
behavioral2/files/0x000700000002360e-75.dat	upx
behavioral2/files/0x0007000000023610-84.dat	upx
behavioral2/files/0x0007000000023615-110.dat	upx
behavioral2/files/0x0007000000023616-116.dat	upx
behavioral2/files/0x000700000002361b-139.dat	upx
behavioral2/memory/1452-148-0x00007FF6B9060000-0x00007FF6B9456000-memory.dmp	upx
behavioral2/files/0x0007000000023620-165.dat	upx
behavioral2/memory/2028-180-0x00007FF7207B0000-0x00007FF720BA6000-memory.dmp	upx
behavioral2/memory/1104-183-0x00007FF6561B0000-0x00007FF6565A6000-memory.dmp	upx
behavioral2/memory/4648-186-0x00007FF7F0CF0000-0x00007FF7F10E6000-memory.dmp	upx
behavioral2/memory/2008-188-0x00007FF7F71D0000-0x00007FF7F75C6000-memory.dmp	upx
behavioral2/memory/2856-191-0x00007FF6D0A20000-0x00007FF6D0E16000-memory.dmp	upx
behavioral2/memory/2584-194-0x00007FF6E3BF0000-0x00007FF6E3FE6000-memory.dmp	upx
behavioral2/memory/1872-193-0x00007FF7FEEB0000-0x00007FF7FF2A6000-memory.dmp	upx
behavioral2/memory/656-192-0x00007FF7F14D0000-0x00007FF7F18C6000-memory.dmp	upx
behavioral2/memory/3044-190-0x00007FF7D4910000-0x00007FF7D4D06000-memory.dmp	upx
behavioral2/memory/4484-187-0x00007FF77DFE0000-0x00007FF77E3D6000-memory.dmp	upx
behavioral2/memory/3740-185-0x00007FF7BFEC0000-0x00007FF7C02B6000-memory.dmp	upx
behavioral2/memory/3612-184-0x00007FF77B190000-0x00007FF77B586000-memory.dmp	upx
behavioral2/memory/4808-182-0x00007FF6AFB10000-0x00007FF6AFF06000-memory.dmp	upx
behavioral2/memory/3604-181-0x00007FF627DA0000-0x00007FF628196000-memory.dmp	upx
behavioral2/files/0x0007000000023621-178.dat	upx
behavioral2/files/0x000700000002361f-174.dat	upx
behavioral2/files/0x000700000002361e-172.dat	upx
behavioral2/files/0x000700000002361d-170.dat	upx
behavioral2/files/0x000700000002361c-168.dat	upx
behavioral2/memory/1060-167-0x00007FF69D120000-0x00007FF69D516000-memory.dmp	upx
behavioral2/files/0x000700000002361a-144.dat	upx
behavioral2/files/0x0007000000023619-142.dat	upx
behavioral2/files/0x0007000000023618-140.dat	upx
behavioral2/memory/4796-138-0x00007FF7F8A10000-0x00007FF7F8E06000-memory.dmp	upx
behavioral2/files/0x0007000000023617-133.dat	upx
behavioral2/memory/1828-122-0x00007FF657C70000-0x00007FF658066000-memory.dmp	upx
behavioral2/memory/3528-115-0x00007FF7B26C0000-0x00007FF7B2AB6000-memory.dmp	upx
behavioral2/files/0x0007000000023612-111.dat	upx
behavioral2/files/0x0007000000023614-108.dat	upx
behavioral2/files/0x0007000000023613-106.dat	upx
behavioral2/files/0x0007000000023611-104.dat	upx
behavioral2/memory/2356-101-0x00007FF705DD0000-0x00007FF7061C6000-memory.dmp	upx
behavioral2/memory/760-98-0x00007FF6570A0000-0x00007FF657496000-memory.dmp	upx
behavioral2/files/0x000700000002360f-80.dat	upx
behavioral2/files/0x0007000000023622-222.dat	upx
behavioral2/files/0x000800000002360a-55.dat	upx
behavioral2/files/0x0007000000023607-36.dat	upx
behavioral2/memory/4244-704-0x00007FF7E5E40000-0x00007FF7E6236000-memory.dmp	upx
behavioral2/memory/3288-710-0x00007FF713F80000-0x00007FF714376000-memory.dmp	upx
behavioral2/memory/3716-717-0x00007FF6D5990000-0x00007FF6D5D86000-memory.dmp	upx
behavioral2/memory/760-729-0x00007FF6570A0000-0x00007FF657496000-memory.dmp	upx
behavioral2/memory/2356-745-0x00007FF705DD0000-0x00007FF7061C6000-memory.dmp	upx
behavioral2/memory/3528-753-0x00007FF7B26C0000-0x00007FF7B2AB6000-memory.dmp	upx
behavioral2/memory/1828-756-0x00007FF657C70000-0x00007FF658066000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oLcaQjA.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\PxUECss.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\asIqMGO.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\FNEUOsU.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\JhGHbQe.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\oDqPkVK.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\enwaylq.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\FiEvmFD.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\xREvczl.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\epFusMD.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\LrDKmcn.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\DcjtjpD.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\IPemEZB.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\koeOqsD.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\TdWVocj.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\HepZGJw.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\KBqTkhG.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\wIuRgTd.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\hFMMXeZ.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\EVpqaMX.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\jpsRnhI.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\KnYbezD.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\bsABbRK.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\grzHrKa.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\ROKWHkT.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\NooYvLb.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\PPBupuT.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\LYphrEt.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\SeZdVcB.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\vtYNLzu.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\APcMOEL.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\JOqUwzc.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\TnmBnpb.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\WvqoAWT.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\vRoLKFd.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\FjPIFml.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\FGbfmgm.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\XreOpAL.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\cxmWzII.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\WPlppWs.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\jafUZTL.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\wSmzAGj.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\sywkmai.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\iQmVvue.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\ubqxRxO.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\bPHrMHR.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\RMBXyin.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\TqWWylM.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\AimNzRV.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\wlcIMDN.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\HdseowQ.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\iHXPkzy.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\VlimzKn.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\UUTVjHl.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\Mskiqlu.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\QipjzLt.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\qJShITj.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\kyYkjeZ.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\Xuwgcli.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\HKwGEPV.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\FOqLAuN.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\ftpejCe.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\glGclFn.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe
File created	C:\Windows\System\niyhNXf.exe	1fe59b6fcc62c9896513bed1660bd4b0N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4816	powershell.exe
4816	powershell.exe
4816	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe
Token: SeLockMemoryPrivilege	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe
Token: SeDebugPrivilege	4816	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4816	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	92
PID 4568 wrote to memory of 4816	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	92
PID 4568 wrote to memory of 4244	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	93
PID 4568 wrote to memory of 4244	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	93
PID 4568 wrote to memory of 3288	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	94
PID 4568 wrote to memory of 3288	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	94
PID 4568 wrote to memory of 3716	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	95
PID 4568 wrote to memory of 3716	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	95
PID 4568 wrote to memory of 760	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	96
PID 4568 wrote to memory of 760	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	96
PID 4568 wrote to memory of 2356	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	97
PID 4568 wrote to memory of 2356	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	97
PID 4568 wrote to memory of 3528	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	98
PID 4568 wrote to memory of 3528	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	98
PID 4568 wrote to memory of 1828	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	99
PID 4568 wrote to memory of 1828	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	99
PID 4568 wrote to memory of 4796	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	101
PID 4568 wrote to memory of 4796	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	101
PID 4568 wrote to memory of 1452	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	102
PID 4568 wrote to memory of 1452	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	102
PID 4568 wrote to memory of 1060	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	103
PID 4568 wrote to memory of 1060	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	103
PID 4568 wrote to memory of 2028	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	104
PID 4568 wrote to memory of 2028	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	104
PID 4568 wrote to memory of 3604	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	105
PID 4568 wrote to memory of 3604	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	105
PID 4568 wrote to memory of 4808	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	106
PID 4568 wrote to memory of 4808	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	106
PID 4568 wrote to memory of 1104	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	107
PID 4568 wrote to memory of 1104	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	107
PID 4568 wrote to memory of 3044	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	108
PID 4568 wrote to memory of 3044	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	108
PID 4568 wrote to memory of 2856	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	109
PID 4568 wrote to memory of 2856	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	109
PID 4568 wrote to memory of 3612	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	110
PID 4568 wrote to memory of 3612	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	110
PID 4568 wrote to memory of 3740	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	111
PID 4568 wrote to memory of 3740	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	111
PID 4568 wrote to memory of 656	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	112
PID 4568 wrote to memory of 656	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	112
PID 4568 wrote to memory of 4648	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	113
PID 4568 wrote to memory of 4648	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	113
PID 4568 wrote to memory of 1872	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	114
PID 4568 wrote to memory of 1872	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	114
PID 4568 wrote to memory of 2584	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	115
PID 4568 wrote to memory of 2584	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	115
PID 4568 wrote to memory of 4484	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	116
PID 4568 wrote to memory of 4484	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	116
PID 4568 wrote to memory of 2008	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	117
PID 4568 wrote to memory of 2008	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	117
PID 4568 wrote to memory of 3680	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	118
PID 4568 wrote to memory of 3680	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	118
PID 4568 wrote to memory of 4912	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	119
PID 4568 wrote to memory of 4912	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	119
PID 4568 wrote to memory of 496	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	120
PID 4568 wrote to memory of 496	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	120
PID 4568 wrote to memory of 4292	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	121
PID 4568 wrote to memory of 4292	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	121
PID 4568 wrote to memory of 1604	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	122
PID 4568 wrote to memory of 1604	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	122
PID 4568 wrote to memory of 2380	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	123
PID 4568 wrote to memory of 2380	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	123
PID 4568 wrote to memory of 5040	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	124
PID 4568 wrote to memory of 5040	4568	1fe59b6fcc62c9896513bed1660bd4b0N.exe	124

C:\Users\Admin\AppData\Local\Temp\1fe59b6fcc62c9896513bed1660bd4b0N.exe
"C:\Users\Admin\AppData\Local\Temp\1fe59b6fcc62c9896513bed1660bd4b0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\System\PndbTqc.exe
  C:\Windows\System\PndbTqc.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\wvspnSW.exe
  C:\Windows\System\wvspnSW.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\INgvRrQ.exe
  C:\Windows\System\INgvRrQ.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\uJhNDHP.exe
  C:\Windows\System\uJhNDHP.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\yEOtNHH.exe
  C:\Windows\System\yEOtNHH.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\kEHtCpV.exe
  C:\Windows\System\kEHtCpV.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\XwQFkna.exe
  C:\Windows\System\XwQFkna.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\hfPtmdx.exe
  C:\Windows\System\hfPtmdx.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\mZnryWq.exe
  C:\Windows\System\mZnryWq.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\NCIHduK.exe
  C:\Windows\System\NCIHduK.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\YytHwkQ.exe
  C:\Windows\System\YytHwkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\arvilhM.exe
  C:\Windows\System\arvilhM.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\mntpkek.exe
  C:\Windows\System\mntpkek.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\hOfibAs.exe
  C:\Windows\System\hOfibAs.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\HtkNDOZ.exe
  C:\Windows\System\HtkNDOZ.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\WzYFKuT.exe
  C:\Windows\System\WzYFKuT.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\TbxiuMc.exe
  C:\Windows\System\TbxiuMc.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\DSDAeOK.exe
  C:\Windows\System\DSDAeOK.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\RLnCVoR.exe
  C:\Windows\System\RLnCVoR.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\jDOMxxI.exe
  C:\Windows\System\jDOMxxI.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\KwxJuhz.exe
  C:\Windows\System\KwxJuhz.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\JFhusap.exe
  C:\Windows\System\JFhusap.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\GSiNwVY.exe
  C:\Windows\System\GSiNwVY.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\xwTYgcF.exe
  C:\Windows\System\xwTYgcF.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\BRoUfpZ.exe
  C:\Windows\System\BRoUfpZ.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\PeGumxH.exe
  C:\Windows\System\PeGumxH.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\kFCAtsp.exe
  C:\Windows\System\kFCAtsp.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\MvncWVx.exe
  C:\Windows\System\MvncWVx.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\WbzOiGs.exe
  C:\Windows\System\WbzOiGs.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\oZjtHzA.exe
  C:\Windows\System\oZjtHzA.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\YpsZgMz.exe
  C:\Windows\System\YpsZgMz.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\caWuucP.exe
  C:\Windows\System\caWuucP.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\ZhnpsxB.exe
  C:\Windows\System\ZhnpsxB.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\yPDuLMS.exe
  C:\Windows\System\yPDuLMS.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\puBfTft.exe
  C:\Windows\System\puBfTft.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\hIIzylV.exe
  C:\Windows\System\hIIzylV.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\hrcOjlD.exe
  C:\Windows\System\hrcOjlD.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\jPgTknw.exe
  C:\Windows\System\jPgTknw.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\hvvrZYS.exe
  C:\Windows\System\hvvrZYS.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\mwzGyGi.exe
  C:\Windows\System\mwzGyGi.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\ARyTpDw.exe
  C:\Windows\System\ARyTpDw.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\SpvjTzs.exe
  C:\Windows\System\SpvjTzs.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\arevsMU.exe
  C:\Windows\System\arevsMU.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\rvYUFEI.exe
  C:\Windows\System\rvYUFEI.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\ZXiorMy.exe
  C:\Windows\System\ZXiorMy.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\rANHHdU.exe
  C:\Windows\System\rANHHdU.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\HgaoMKU.exe
  C:\Windows\System\HgaoMKU.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\ZWaPSfV.exe
  C:\Windows\System\ZWaPSfV.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\zNMPhDi.exe
  C:\Windows\System\zNMPhDi.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\NODnmgz.exe
  C:\Windows\System\NODnmgz.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\OEajlhg.exe
  C:\Windows\System\OEajlhg.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\MCMPost.exe
  C:\Windows\System\MCMPost.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\kBbhYZD.exe
  C:\Windows\System\kBbhYZD.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\mwwLRXh.exe
  C:\Windows\System\mwwLRXh.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\mUspIYN.exe
  C:\Windows\System\mUspIYN.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\sBkSdtP.exe
  C:\Windows\System\sBkSdtP.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\ncGLnqm.exe
  C:\Windows\System\ncGLnqm.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\pAdMkep.exe
  C:\Windows\System\pAdMkep.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\bPEaAYc.exe
  C:\Windows\System\bPEaAYc.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\diUtvAs.exe
  C:\Windows\System\diUtvAs.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\vctCYAW.exe
  C:\Windows\System\vctCYAW.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\YgjsCSF.exe
  C:\Windows\System\YgjsCSF.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\SzkbosS.exe
  C:\Windows\System\SzkbosS.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\FjBXYKw.exe
  C:\Windows\System\FjBXYKw.exe
  2⤵
  - Executes dropped EXE
  PID:5304
- C:\Windows\System\cPVWHdl.exe
  C:\Windows\System\cPVWHdl.exe
  2⤵
  PID:5332
- C:\Windows\System\npJfYTo.exe
  C:\Windows\System\npJfYTo.exe
  2⤵
  PID:5376
- C:\Windows\System\kbMtiME.exe
  C:\Windows\System\kbMtiME.exe
  2⤵
  PID:5432
- C:\Windows\System\LrAQXvD.exe
  C:\Windows\System\LrAQXvD.exe
  2⤵
  PID:5476
- C:\Windows\System\COYWhYA.exe
  C:\Windows\System\COYWhYA.exe
  2⤵
  PID:5524
- C:\Windows\System\yRygtuP.exe
  C:\Windows\System\yRygtuP.exe
  2⤵
  PID:5568
- C:\Windows\System\nCGkHMU.exe
  C:\Windows\System\nCGkHMU.exe
  2⤵
  PID:5600
- C:\Windows\System\jwUwSyv.exe
  C:\Windows\System\jwUwSyv.exe
  2⤵
  PID:5632
- C:\Windows\System\XxejPBt.exe
  C:\Windows\System\XxejPBt.exe
  2⤵
  PID:5660
- C:\Windows\System\CcycEuJ.exe
  C:\Windows\System\CcycEuJ.exe
  2⤵
  PID:5684
- C:\Windows\System\OIqOEbh.exe
  C:\Windows\System\OIqOEbh.exe
  2⤵
  PID:5740
- C:\Windows\System\LSsobWB.exe
  C:\Windows\System\LSsobWB.exe
  2⤵
  PID:5764
- C:\Windows\System\SdHqurt.exe
  C:\Windows\System\SdHqurt.exe
  2⤵
  PID:5800
- C:\Windows\System\fqcYXLP.exe
  C:\Windows\System\fqcYXLP.exe
  2⤵
  PID:5820
- C:\Windows\System\yoHnilH.exe
  C:\Windows\System\yoHnilH.exe
  2⤵
  PID:5852
- C:\Windows\System\jbQqDNc.exe
  C:\Windows\System\jbQqDNc.exe
  2⤵
  PID:5888
- C:\Windows\System\VZKVtNF.exe
  C:\Windows\System\VZKVtNF.exe
  2⤵
  PID:5904
- C:\Windows\System\TdIflET.exe
  C:\Windows\System\TdIflET.exe
  2⤵
  PID:5932
- C:\Windows\System\fDdfnCW.exe
  C:\Windows\System\fDdfnCW.exe
  2⤵
  PID:5960
- C:\Windows\System\nfYavlG.exe
  C:\Windows\System\nfYavlG.exe
  2⤵
  PID:6004
- C:\Windows\System\lbtSXHi.exe
  C:\Windows\System\lbtSXHi.exe
  2⤵
  PID:6032
- C:\Windows\System\sYypSIS.exe
  C:\Windows\System\sYypSIS.exe
  2⤵
  PID:6060
- C:\Windows\System\MSzOUgy.exe
  C:\Windows\System\MSzOUgy.exe
  2⤵
  PID:6076
- C:\Windows\System\WvrrvDm.exe
  C:\Windows\System\WvrrvDm.exe
  2⤵
  PID:6104
- C:\Windows\System\sWwBpOt.exe
  C:\Windows\System\sWwBpOt.exe
  2⤵
  PID:2000
- C:\Windows\System\FGpllkW.exe
  C:\Windows\System\FGpllkW.exe
  2⤵
  PID:1932
- C:\Windows\System\GeoJUCB.exe
  C:\Windows\System\GeoJUCB.exe
  2⤵
  PID:5216
- C:\Windows\System\TrjXMQP.exe
  C:\Windows\System\TrjXMQP.exe
  2⤵
  PID:5284
- C:\Windows\System\JXEASpU.exe
  C:\Windows\System\JXEASpU.exe
  2⤵
  PID:5364
- C:\Windows\System\QqjRbgr.exe
  C:\Windows\System\QqjRbgr.exe
  2⤵
  PID:5396
- C:\Windows\System\wZUEbsA.exe
  C:\Windows\System\wZUEbsA.exe
  2⤵
  PID:5540
- C:\Windows\System\MCZfPIZ.exe
  C:\Windows\System\MCZfPIZ.exe
  2⤵
  PID:5616
- C:\Windows\System\SlEKxSI.exe
  C:\Windows\System\SlEKxSI.exe
  2⤵
  PID:5680
- C:\Windows\System\LmOYeiX.exe
  C:\Windows\System\LmOYeiX.exe
  2⤵
  PID:5784
- C:\Windows\System\mMXAzak.exe
  C:\Windows\System\mMXAzak.exe
  2⤵
  PID:5828
- C:\Windows\System\udQJLaD.exe
  C:\Windows\System\udQJLaD.exe
  2⤵
  PID:5896
- C:\Windows\System\sYGlwaC.exe
  C:\Windows\System\sYGlwaC.exe
  2⤵
  PID:5976
- C:\Windows\System\SwwMopI.exe
  C:\Windows\System\SwwMopI.exe
  2⤵
  PID:6068
- C:\Windows\System\nvYDHsL.exe
  C:\Windows\System\nvYDHsL.exe
  2⤵
  PID:5128
- C:\Windows\System\AuuHtIH.exe
  C:\Windows\System\AuuHtIH.exe
  2⤵
  PID:5232
- C:\Windows\System\DKvnhpa.exe
  C:\Windows\System\DKvnhpa.exe
  2⤵
  PID:5352
- C:\Windows\System\idhuCTE.exe
  C:\Windows\System\idhuCTE.exe
  2⤵
  PID:4444
- C:\Windows\System\rpnLcSC.exe
  C:\Windows\System\rpnLcSC.exe
  2⤵
  PID:5644
- C:\Windows\System\yTYveHc.exe
  C:\Windows\System\yTYveHc.exe
  2⤵
  PID:5812
- C:\Windows\System\aiGYerh.exe
  C:\Windows\System\aiGYerh.exe
  2⤵
  PID:1324
- C:\Windows\System\XBxKajO.exe
  C:\Windows\System\XBxKajO.exe
  2⤵
  PID:5924
- C:\Windows\System\Kzqoctm.exe
  C:\Windows\System\Kzqoctm.exe
  2⤵
  PID:6124
- C:\Windows\System\BZmmqOC.exe
  C:\Windows\System\BZmmqOC.exe
  2⤵
  PID:5408
- C:\Windows\System\NymRidd.exe
  C:\Windows\System\NymRidd.exe
  2⤵
  PID:4624
- C:\Windows\System\NfGFbQC.exe
  C:\Windows\System\NfGFbQC.exe
  2⤵
  PID:4120
- C:\Windows\System\NRRflFz.exe
  C:\Windows\System\NRRflFz.exe
  2⤵
  PID:5508
- C:\Windows\System\gGvDPYY.exe
  C:\Windows\System\gGvDPYY.exe
  2⤵
  PID:5328
- C:\Windows\System\eKvztOb.exe
  C:\Windows\System\eKvztOb.exe
  2⤵
  PID:6148
- C:\Windows\System\VitYkec.exe
  C:\Windows\System\VitYkec.exe
  2⤵
  PID:6180
- C:\Windows\System\zRMmzOv.exe
  C:\Windows\System\zRMmzOv.exe
  2⤵
  PID:6204
- C:\Windows\System\fUuYehi.exe
  C:\Windows\System\fUuYehi.exe
  2⤵
  PID:6240
- C:\Windows\System\EnBBQGN.exe
  C:\Windows\System\EnBBQGN.exe
  2⤵
  PID:6256
- C:\Windows\System\KvwRyBE.exe
  C:\Windows\System\KvwRyBE.exe
  2⤵
  PID:6276
- C:\Windows\System\QyFgLlV.exe
  C:\Windows\System\QyFgLlV.exe
  2⤵
  PID:6316
- C:\Windows\System\qsORUCF.exe
  C:\Windows\System\qsORUCF.exe
  2⤵
  PID:6332
- C:\Windows\System\swUHOgE.exe
  C:\Windows\System\swUHOgE.exe
  2⤵
  PID:6376
- C:\Windows\System\LvRgOmU.exe
  C:\Windows\System\LvRgOmU.exe
  2⤵
  PID:6416
- C:\Windows\System\yvVPcFg.exe
  C:\Windows\System\yvVPcFg.exe
  2⤵
  PID:6444
- C:\Windows\System\DSHxOOL.exe
  C:\Windows\System\DSHxOOL.exe
  2⤵
  PID:6468
- C:\Windows\System\ZDKuZrJ.exe
  C:\Windows\System\ZDKuZrJ.exe
  2⤵
  PID:6492
- C:\Windows\System\pBxcAbE.exe
  C:\Windows\System\pBxcAbE.exe
  2⤵
  PID:6512
- C:\Windows\System\TqsegRq.exe
  C:\Windows\System\TqsegRq.exe
  2⤵
  PID:6544
- C:\Windows\System\ZYRpmda.exe
  C:\Windows\System\ZYRpmda.exe
  2⤵
  PID:6596
- C:\Windows\System\cmFuGcD.exe
  C:\Windows\System\cmFuGcD.exe
  2⤵
  PID:6612
- C:\Windows\System\xODnqEL.exe
  C:\Windows\System\xODnqEL.exe
  2⤵
  PID:6632
- C:\Windows\System\TQSktXQ.exe
  C:\Windows\System\TQSktXQ.exe
  2⤵
  PID:6664
- C:\Windows\System\ymYxHen.exe
  C:\Windows\System\ymYxHen.exe
  2⤵
  PID:6708
- C:\Windows\System\YQpbOOv.exe
  C:\Windows\System\YQpbOOv.exe
  2⤵
  PID:6728
- C:\Windows\System\mPMUnOq.exe
  C:\Windows\System\mPMUnOq.exe
  2⤵
  PID:6748
- C:\Windows\System\FQezUBz.exe
  C:\Windows\System\FQezUBz.exe
  2⤵
  PID:6776
- C:\Windows\System\dXPbPIF.exe
  C:\Windows\System\dXPbPIF.exe
  2⤵
  PID:6820
- C:\Windows\System\khIdYYT.exe
  C:\Windows\System\khIdYYT.exe
  2⤵
  PID:6852
- C:\Windows\System\phGcJYM.exe
  C:\Windows\System\phGcJYM.exe
  2⤵
  PID:6880
- C:\Windows\System\YvLynVr.exe
  C:\Windows\System\YvLynVr.exe
  2⤵
  PID:6908
- C:\Windows\System\eoXiYNW.exe
  C:\Windows\System\eoXiYNW.exe
  2⤵
  PID:6924
- C:\Windows\System\bJYJGEx.exe
  C:\Windows\System\bJYJGEx.exe
  2⤵
  PID:6940
- C:\Windows\System\ceABfqd.exe
  C:\Windows\System\ceABfqd.exe
  2⤵
  PID:6960
- C:\Windows\System\PKuGleo.exe
  C:\Windows\System\PKuGleo.exe
  2⤵
  PID:7044
- C:\Windows\System\LbMRIhX.exe
  C:\Windows\System\LbMRIhX.exe
  2⤵
  PID:7104
- C:\Windows\System\WPxBxkm.exe
  C:\Windows\System\WPxBxkm.exe
  2⤵
  PID:7156
- C:\Windows\System\kFoxTjL.exe
  C:\Windows\System\kFoxTjL.exe
  2⤵
  PID:6212
- C:\Windows\System\eeFTaVw.exe
  C:\Windows\System\eeFTaVw.exe
  2⤵
  PID:824
- C:\Windows\System\JzXNxVP.exe
  C:\Windows\System\JzXNxVP.exe
  2⤵
  PID:2268
- C:\Windows\System\PDmCJGz.exe
  C:\Windows\System\PDmCJGz.exe
  2⤵
  PID:6360
- C:\Windows\System\lUMvfCm.exe
  C:\Windows\System\lUMvfCm.exe
  2⤵
  PID:2544
- C:\Windows\System\GoakTfr.exe
  C:\Windows\System\GoakTfr.exe
  2⤵
  PID:6476
- C:\Windows\System\aqbvAhc.exe
  C:\Windows\System\aqbvAhc.exe
  2⤵
  PID:6532
- C:\Windows\System\vkNoero.exe
  C:\Windows\System\vkNoero.exe
  2⤵
  PID:892
- C:\Windows\System\MLrdRYC.exe
  C:\Windows\System\MLrdRYC.exe
  2⤵
  PID:6644
- C:\Windows\System\rNSaLVg.exe
  C:\Windows\System\rNSaLVg.exe
  2⤵
  PID:4884
- C:\Windows\System\RgLupwo.exe
  C:\Windows\System\RgLupwo.exe
  2⤵
  PID:6700
- C:\Windows\System\vgJUHIG.exe
  C:\Windows\System\vgJUHIG.exe
  2⤵
  PID:1196
- C:\Windows\System\avjEEci.exe
  C:\Windows\System\avjEEci.exe
  2⤵
  PID:6804
- C:\Windows\System\WkDQLpR.exe
  C:\Windows\System\WkDQLpR.exe
  2⤵
  PID:6848
- C:\Windows\System\kWNAXUv.exe
  C:\Windows\System\kWNAXUv.exe
  2⤵
  PID:6932
- C:\Windows\System\JjCKBOh.exe
  C:\Windows\System\JjCKBOh.exe
  2⤵
  PID:3188
- C:\Windows\System\NISemMG.exe
  C:\Windows\System\NISemMG.exe
  2⤵
  PID:7028
- C:\Windows\System\qbLjkdD.exe
  C:\Windows\System\qbLjkdD.exe
  2⤵
  PID:2484
- C:\Windows\System\hFMMXeZ.exe
  C:\Windows\System\hFMMXeZ.exe
  2⤵
  PID:4472
- C:\Windows\System\qfIsHMf.exe
  C:\Windows\System\qfIsHMf.exe
  2⤵
  PID:7076
- C:\Windows\System\BDjLeml.exe
  C:\Windows\System\BDjLeml.exe
  2⤵
  PID:3996
- C:\Windows\System\NIPmIgM.exe
  C:\Windows\System\NIPmIgM.exe
  2⤵
  PID:3640
- C:\Windows\System\yiJOxJI.exe
  C:\Windows\System\yiJOxJI.exe
  2⤵
  PID:6792
- C:\Windows\System\VfETGOK.exe
  C:\Windows\System\VfETGOK.exe
  2⤵
  PID:7036
- C:\Windows\System\TSJNPqL.exe
  C:\Windows\System\TSJNPqL.exe
  2⤵
  PID:7112
- C:\Windows\System\dByNiSo.exe
  C:\Windows\System\dByNiSo.exe
  2⤵
  PID:2324
- C:\Windows\System\OdNvzRQ.exe
  C:\Windows\System\OdNvzRQ.exe
  2⤵
  PID:6156
- C:\Windows\System\fTlPoNP.exe
  C:\Windows\System\fTlPoNP.exe
  2⤵
  PID:6220
- C:\Windows\System\gJHCTLf.exe
  C:\Windows\System\gJHCTLf.exe
  2⤵
  PID:6392
- C:\Windows\System\KhQWgrU.exe
  C:\Windows\System\KhQWgrU.exe
  2⤵
  PID:6500
- C:\Windows\System\VuXHYCu.exe
  C:\Windows\System\VuXHYCu.exe
  2⤵
  PID:6604
- C:\Windows\System\hhbcDIf.exe
  C:\Windows\System\hhbcDIf.exe
  2⤵
  PID:1528
- C:\Windows\System\dHQWGvn.exe
  C:\Windows\System\dHQWGvn.exe
  2⤵
  PID:6228
- C:\Windows\System\bTwHMeA.exe
  C:\Windows\System\bTwHMeA.exe
  2⤵
  PID:4600
- C:\Windows\System\PdnVmRa.exe
  C:\Windows\System\PdnVmRa.exe
  2⤵
  PID:6272
- C:\Windows\System\ROKWHkT.exe
  C:\Windows\System\ROKWHkT.exe
  2⤵
  PID:4636
- C:\Windows\System\VMeowsA.exe
  C:\Windows\System\VMeowsA.exe
  2⤵
  PID:6592
- C:\Windows\System\rMSsCqv.exe
  C:\Windows\System\rMSsCqv.exe
  2⤵
  PID:7084
- C:\Windows\System\npuNAZq.exe
  C:\Windows\System\npuNAZq.exe
  2⤵
  PID:4872
- C:\Windows\System\zSrGsBr.exe
  C:\Windows\System\zSrGsBr.exe
  2⤵
  PID:5696
- C:\Windows\System\lyYRTIF.exe
  C:\Windows\System\lyYRTIF.exe
  2⤵
  PID:5736
- C:\Windows\System\lvDgRbW.exe
  C:\Windows\System\lvDgRbW.exe
  2⤵
  PID:2640
- C:\Windows\System\cWFuESe.exe
  C:\Windows\System\cWFuESe.exe
  2⤵
  PID:6324
- C:\Windows\System\iOcWoWx.exe
  C:\Windows\System\iOcWoWx.exe
  2⤵
  PID:6608
- C:\Windows\System\xycwhml.exe
  C:\Windows\System\xycwhml.exe
  2⤵
  PID:6756
- C:\Windows\System\XuCyaiN.exe
  C:\Windows\System\XuCyaiN.exe
  2⤵
  PID:3468
- C:\Windows\System\WJSCrUs.exe
  C:\Windows\System\WJSCrUs.exe
  2⤵
  PID:7136
- C:\Windows\System\kntJnEX.exe
  C:\Windows\System\kntJnEX.exe
  2⤵
  PID:5388
- C:\Windows\System\srRbNoT.exe
  C:\Windows\System\srRbNoT.exe
  2⤵
  PID:7144
- C:\Windows\System\kpjUYDI.exe
  C:\Windows\System\kpjUYDI.exe
  2⤵
  PID:6772
- C:\Windows\System\suoYztH.exe
  C:\Windows\System\suoYztH.exe
  2⤵
  PID:1200
- C:\Windows\System\ZilVMss.exe
  C:\Windows\System\ZilVMss.exe
  2⤵
  PID:6364
- C:\Windows\System\PYpHfBn.exe
  C:\Windows\System\PYpHfBn.exe
  2⤵
  PID:4544
- C:\Windows\System\fiSckrK.exe
  C:\Windows\System\fiSckrK.exe
  2⤵
  PID:7180
- C:\Windows\System\qVKKEsc.exe
  C:\Windows\System\qVKKEsc.exe
  2⤵
  PID:7200
- C:\Windows\System\RukPGhC.exe
  C:\Windows\System\RukPGhC.exe
  2⤵
  PID:7228
- C:\Windows\System\HYmowaB.exe
  C:\Windows\System\HYmowaB.exe
  2⤵
  PID:7268
- C:\Windows\System\XakFKii.exe
  C:\Windows\System\XakFKii.exe
  2⤵
  PID:7284
- C:\Windows\System\CPqMtrJ.exe
  C:\Windows\System\CPqMtrJ.exe
  2⤵
  PID:7316
- C:\Windows\System\BmkNSwd.exe
  C:\Windows\System\BmkNSwd.exe
  2⤵
  PID:7340
- C:\Windows\System\MBrReHI.exe
  C:\Windows\System\MBrReHI.exe
  2⤵
  PID:7368
- C:\Windows\System\ZOuInrv.exe
  C:\Windows\System\ZOuInrv.exe
  2⤵
  PID:7404
- C:\Windows\System\UbtMyUf.exe
  C:\Windows\System\UbtMyUf.exe
  2⤵
  PID:7432
- C:\Windows\System\VhEYDpr.exe
  C:\Windows\System\VhEYDpr.exe
  2⤵
  PID:7464
- C:\Windows\System\UjbFCUX.exe
  C:\Windows\System\UjbFCUX.exe
  2⤵
  PID:7492
- C:\Windows\System\FNEUOsU.exe
  C:\Windows\System\FNEUOsU.exe
  2⤵
  PID:7516
- C:\Windows\System\PMaVQaa.exe
  C:\Windows\System\PMaVQaa.exe
  2⤵
  PID:7540
- C:\Windows\System\KjpZOfR.exe
  C:\Windows\System\KjpZOfR.exe
  2⤵
  PID:7572
- C:\Windows\System\PDmXpdn.exe
  C:\Windows\System\PDmXpdn.exe
  2⤵
  PID:7604
- C:\Windows\System\kwyJKTR.exe
  C:\Windows\System\kwyJKTR.exe
  2⤵
  PID:7632
- C:\Windows\System\xqJTjXY.exe
  C:\Windows\System\xqJTjXY.exe
  2⤵
  PID:7656
- C:\Windows\System\bXRrGBC.exe
  C:\Windows\System\bXRrGBC.exe
  2⤵
  PID:7692
- C:\Windows\System\sMEaWQP.exe
  C:\Windows\System\sMEaWQP.exe
  2⤵
  PID:7716
- C:\Windows\System\nlIOlJz.exe
  C:\Windows\System\nlIOlJz.exe
  2⤵
  PID:7736
- C:\Windows\System\AYocvEN.exe
  C:\Windows\System\AYocvEN.exe
  2⤵
  PID:7776
- C:\Windows\System\gEkvwEX.exe
  C:\Windows\System\gEkvwEX.exe
  2⤵
  PID:7796
- C:\Windows\System\DlUHvVp.exe
  C:\Windows\System\DlUHvVp.exe
  2⤵
  PID:7832
- C:\Windows\System\QljrPgy.exe
  C:\Windows\System\QljrPgy.exe
  2⤵
  PID:7860
- C:\Windows\System\dXnHVMz.exe
  C:\Windows\System\dXnHVMz.exe
  2⤵
  PID:7880
- C:\Windows\System\lXeKxKS.exe
  C:\Windows\System\lXeKxKS.exe
  2⤵
  PID:7920
- C:\Windows\System\ExwgqdM.exe
  C:\Windows\System\ExwgqdM.exe
  2⤵
  PID:7944
- C:\Windows\System\YOGXqYf.exe
  C:\Windows\System\YOGXqYf.exe
  2⤵
  PID:7976
- C:\Windows\System\UqtjiXw.exe
  C:\Windows\System\UqtjiXw.exe
  2⤵
  PID:8004
- C:\Windows\System\hHYlwKs.exe
  C:\Windows\System\hHYlwKs.exe
  2⤵
  PID:8028
- C:\Windows\System\pnHPhpI.exe
  C:\Windows\System\pnHPhpI.exe
  2⤵
  PID:8056
- C:\Windows\System\CoGssJc.exe
  C:\Windows\System\CoGssJc.exe
  2⤵
  PID:8076
- C:\Windows\System\ZmTRuoT.exe
  C:\Windows\System\ZmTRuoT.exe
  2⤵
  PID:8116
- C:\Windows\System\btGYGAA.exe
  C:\Windows\System\btGYGAA.exe
  2⤵
  PID:8144
- C:\Windows\System\wnHuJfj.exe
  C:\Windows\System\wnHuJfj.exe
  2⤵
  PID:8176
- C:\Windows\System\vsUyWlx.exe
  C:\Windows\System\vsUyWlx.exe
  2⤵
  PID:7192
- C:\Windows\System\uTjaMkA.exe
  C:\Windows\System\uTjaMkA.exe
  2⤵
  PID:7252
- C:\Windows\System\hzNhMuv.exe
  C:\Windows\System\hzNhMuv.exe
  2⤵
  PID:7296
- C:\Windows\System\YQUlkbg.exe
  C:\Windows\System\YQUlkbg.exe
  2⤵
  PID:7360
- C:\Windows\System\BCVYBBF.exe
  C:\Windows\System\BCVYBBF.exe
  2⤵
  PID:7424
- C:\Windows\System\pyBxABc.exe
  C:\Windows\System\pyBxABc.exe
  2⤵
  PID:7508
- C:\Windows\System\jShMZYd.exe
  C:\Windows\System\jShMZYd.exe
  2⤵
  PID:7552
- C:\Windows\System\ZdIVWhU.exe
  C:\Windows\System\ZdIVWhU.exe
  2⤵
  PID:7644
- C:\Windows\System\AYmRTPE.exe
  C:\Windows\System\AYmRTPE.exe
  2⤵
  PID:7704
- C:\Windows\System\FHEJfQL.exe
  C:\Windows\System\FHEJfQL.exe
  2⤵
  PID:7772
- C:\Windows\System\XMzlcwN.exe
  C:\Windows\System\XMzlcwN.exe
  2⤵
  PID:7828
- C:\Windows\System\SOvmPGq.exe
  C:\Windows\System\SOvmPGq.exe
  2⤵
  PID:7868
- C:\Windows\System\YmazJHC.exe
  C:\Windows\System\YmazJHC.exe
  2⤵
  PID:7960
- C:\Windows\System\NjGKNDN.exe
  C:\Windows\System\NjGKNDN.exe
  2⤵
  PID:8036
- C:\Windows\System\zCIAyxM.exe
  C:\Windows\System\zCIAyxM.exe
  2⤵
  PID:8068
- C:\Windows\System\bFEaioq.exe
  C:\Windows\System\bFEaioq.exe
  2⤵
  PID:8168
- C:\Windows\System\FOeqsfr.exe
  C:\Windows\System\FOeqsfr.exe
  2⤵
  PID:3272
- C:\Windows\System\ygutief.exe
  C:\Windows\System\ygutief.exe
  2⤵
  PID:6572
- C:\Windows\System\jVTnSeP.exe
  C:\Windows\System\jVTnSeP.exe
  2⤵
  PID:3820
- C:\Windows\System\XNfCeBP.exe
  C:\Windows\System\XNfCeBP.exe
  2⤵
  PID:7472
- C:\Windows\System\mpPMwqt.exe
  C:\Windows\System\mpPMwqt.exe
  2⤵
  PID:7612
- C:\Windows\System\EdlTKwZ.exe
  C:\Windows\System\EdlTKwZ.exe
  2⤵
  PID:2300
- C:\Windows\System\fqMmAYw.exe
  C:\Windows\System\fqMmAYw.exe
  2⤵
  PID:7816
- C:\Windows\System\HvscWtK.exe
  C:\Windows\System\HvscWtK.exe
  2⤵
  PID:8124
- C:\Windows\System\wOQBWJn.exe
  C:\Windows\System\wOQBWJn.exe
  2⤵
  PID:2328
- C:\Windows\System\sQmfINB.exe
  C:\Windows\System\sQmfINB.exe
  2⤵
  PID:8184
- C:\Windows\System\HRPevIY.exe
  C:\Windows\System\HRPevIY.exe
  2⤵
  PID:7896
- C:\Windows\System\LrdUuMa.exe
  C:\Windows\System\LrdUuMa.exe
  2⤵
  PID:3332
- C:\Windows\System\DRwGIgi.exe
  C:\Windows\System\DRwGIgi.exe
  2⤵
  PID:3828
- C:\Windows\System\DGOmESP.exe
  C:\Windows\System\DGOmESP.exe
  2⤵
  PID:7640
- C:\Windows\System\ntnospr.exe
  C:\Windows\System\ntnospr.exe
  2⤵
  PID:7888
- C:\Windows\System\ZqeASqx.exe
  C:\Windows\System\ZqeASqx.exe
  2⤵
  PID:2872
- C:\Windows\System\KIGhTiB.exe
  C:\Windows\System\KIGhTiB.exe
  2⤵
  PID:8212
- C:\Windows\System\lEbFCKB.exe
  C:\Windows\System\lEbFCKB.exe
  2⤵
  PID:8232
- C:\Windows\System\zWMqren.exe
  C:\Windows\System\zWMqren.exe
  2⤵
  PID:8268
- C:\Windows\System\tutoxlY.exe
  C:\Windows\System\tutoxlY.exe
  2⤵
  PID:8304
- C:\Windows\System\GIFZJLL.exe
  C:\Windows\System\GIFZJLL.exe
  2⤵
  PID:8328
- C:\Windows\System\FGbfmgm.exe
  C:\Windows\System\FGbfmgm.exe
  2⤵
  PID:8352
- C:\Windows\System\ytqVpKq.exe
  C:\Windows\System\ytqVpKq.exe
  2⤵
  PID:8384
- C:\Windows\System\YYriWPu.exe
  C:\Windows\System\YYriWPu.exe
  2⤵
  PID:8416
- C:\Windows\System\TsgWYUM.exe
  C:\Windows\System\TsgWYUM.exe
  2⤵
  PID:8444
- C:\Windows\System\SbFEbTm.exe
  C:\Windows\System\SbFEbTm.exe
  2⤵
  PID:8468
- C:\Windows\System\aQknDtK.exe
  C:\Windows\System\aQknDtK.exe
  2⤵
  PID:8484
- C:\Windows\System\XweSYKt.exe
  C:\Windows\System\XweSYKt.exe
  2⤵
  PID:8520
- C:\Windows\System\wWpWmIV.exe
  C:\Windows\System\wWpWmIV.exe
  2⤵
  PID:8564
- C:\Windows\System\NooYvLb.exe
  C:\Windows\System\NooYvLb.exe
  2⤵
  PID:8584
- C:\Windows\System\ZrYYGPV.exe
  C:\Windows\System\ZrYYGPV.exe
  2⤵
  PID:8612
- C:\Windows\System\lUHcYTo.exe
  C:\Windows\System\lUHcYTo.exe
  2⤵
  PID:8640
- C:\Windows\System\LIomCRd.exe
  C:\Windows\System\LIomCRd.exe
  2⤵
  PID:8668
- C:\Windows\System\mFldRjC.exe
  C:\Windows\System\mFldRjC.exe
  2⤵
  PID:8696
- C:\Windows\System\FHcuPtD.exe
  C:\Windows\System\FHcuPtD.exe
  2⤵
  PID:8724
- C:\Windows\System\OBcdiey.exe
  C:\Windows\System\OBcdiey.exe
  2⤵
  PID:8768
- C:\Windows\System\PdGdnuA.exe
  C:\Windows\System\PdGdnuA.exe
  2⤵
  PID:8788
- C:\Windows\System\jrWvhNm.exe
  C:\Windows\System\jrWvhNm.exe
  2⤵
  PID:8816
- C:\Windows\System\alUsGSL.exe
  C:\Windows\System\alUsGSL.exe
  2⤵
  PID:8840
- C:\Windows\System\nREDhfQ.exe
  C:\Windows\System\nREDhfQ.exe
  2⤵
  PID:8868
- C:\Windows\System\LJGNXZF.exe
  C:\Windows\System\LJGNXZF.exe
  2⤵
  PID:8900
- C:\Windows\System\tkdQltp.exe
  C:\Windows\System\tkdQltp.exe
  2⤵
  PID:8932
- C:\Windows\System\NHIDSBI.exe
  C:\Windows\System\NHIDSBI.exe
  2⤵
  PID:8960
- C:\Windows\System\MALeBAj.exe
  C:\Windows\System\MALeBAj.exe
  2⤵
  PID:8984
- C:\Windows\System\JyUgxzB.exe
  C:\Windows\System\JyUgxzB.exe
  2⤵
  PID:9020
- C:\Windows\System\JIyhBcp.exe
  C:\Windows\System\JIyhBcp.exe
  2⤵
  PID:9040
- C:\Windows\System\WpDInaT.exe
  C:\Windows\System\WpDInaT.exe
  2⤵
  PID:9072
- C:\Windows\System\wbWLOSG.exe
  C:\Windows\System\wbWLOSG.exe
  2⤵
  PID:9100
- C:\Windows\System\SaPgoJd.exe
  C:\Windows\System\SaPgoJd.exe
  2⤵
  PID:9128
- C:\Windows\System\gCkMFuw.exe
  C:\Windows\System\gCkMFuw.exe
  2⤵
  PID:9152
- C:\Windows\System\TnmBnpb.exe
  C:\Windows\System\TnmBnpb.exe
  2⤵
  PID:9176
- C:\Windows\System\DGYQJxv.exe
  C:\Windows\System\DGYQJxv.exe
  2⤵
  PID:7324
- C:\Windows\System\PoukdHA.exe
  C:\Windows\System\PoukdHA.exe
  2⤵
  PID:8200
- C:\Windows\System\iBfHxqY.exe
  C:\Windows\System\iBfHxqY.exe
  2⤵
  PID:8260
- C:\Windows\System\PYaiLVM.exe
  C:\Windows\System\PYaiLVM.exe
  2⤵
  PID:3100
- C:\Windows\System\SZAIUAU.exe
  C:\Windows\System\SZAIUAU.exe
  2⤵
  PID:2156
- C:\Windows\System\kIUAEKk.exe
  C:\Windows\System\kIUAEKk.exe
  2⤵
  PID:8404
- C:\Windows\System\evEXUPW.exe
  C:\Windows\System\evEXUPW.exe
  2⤵
  PID:8436
- C:\Windows\System\sKNcnNK.exe
  C:\Windows\System\sKNcnNK.exe
  2⤵
  PID:8504
- C:\Windows\System\CxTuBbd.exe
  C:\Windows\System\CxTuBbd.exe
  2⤵
  PID:8580
- C:\Windows\System\cbhpRza.exe
  C:\Windows\System\cbhpRza.exe
  2⤵
  PID:8604
- C:\Windows\System\SPXHRqM.exe
  C:\Windows\System\SPXHRqM.exe
  2⤵
  PID:8684
- C:\Windows\System\HrRBhht.exe
  C:\Windows\System\HrRBhht.exe
  2⤵
  PID:8764
- C:\Windows\System\KvFsgdr.exe
  C:\Windows\System\KvFsgdr.exe
  2⤵
  PID:8824
- C:\Windows\System\xRuYiQb.exe
  C:\Windows\System\xRuYiQb.exe
  2⤵
  PID:8888
- C:\Windows\System\LYGXQVd.exe
  C:\Windows\System\LYGXQVd.exe
  2⤵
  PID:8948
- C:\Windows\System\wIAQHFF.exe
  C:\Windows\System\wIAQHFF.exe
  2⤵
  PID:9004
- C:\Windows\System\sOEnrAa.exe
  C:\Windows\System\sOEnrAa.exe
  2⤵
  PID:9080
- C:\Windows\System\HNAhaSC.exe
  C:\Windows\System\HNAhaSC.exe
  2⤵
  PID:9160
- C:\Windows\System\uJBxnzZ.exe
  C:\Windows\System\uJBxnzZ.exe
  2⤵
  PID:9212
- C:\Windows\System\XreOpAL.exe
  C:\Windows\System\XreOpAL.exe
  2⤵
  PID:8348
- C:\Windows\System\TPIlShp.exe
  C:\Windows\System\TPIlShp.exe
  2⤵
  PID:8452
- C:\Windows\System\VKPnVId.exe
  C:\Windows\System\VKPnVId.exe
  2⤵
  PID:8596
- C:\Windows\System\ifYXVvo.exe
  C:\Windows\System\ifYXVvo.exe
  2⤵
  PID:8720
- C:\Windows\System\oPqlRKU.exe
  C:\Windows\System\oPqlRKU.exe
  2⤵
  PID:8780
- C:\Windows\System\FLQgWua.exe
  C:\Windows\System\FLQgWua.exe
  2⤵
  PID:8944
- C:\Windows\System\cOGINlA.exe
  C:\Windows\System\cOGINlA.exe
  2⤵
  PID:5184
- C:\Windows\System\JeMnSdU.exe
  C:\Windows\System\JeMnSdU.exe
  2⤵
  PID:9088
- C:\Windows\System\cOpIScV.exe
  C:\Windows\System\cOpIScV.exe
  2⤵
  PID:2592
- C:\Windows\System\sETBOrD.exe
  C:\Windows\System\sETBOrD.exe
  2⤵
  PID:5276
- C:\Windows\System\dxmZmjf.exe
  C:\Windows\System\dxmZmjf.exe
  2⤵
  PID:2248
- C:\Windows\System\KWkoXwG.exe
  C:\Windows\System\KWkoXwG.exe
  2⤵
  PID:8548
- C:\Windows\System\lpCMzut.exe
  C:\Windows\System\lpCMzut.exe
  2⤵
  PID:8880
- C:\Windows\System\BYPVgtK.exe
  C:\Windows\System\BYPVgtK.exe
  2⤵
  PID:5204
- C:\Windows\System\InoILrQ.exe
  C:\Windows\System\InoILrQ.exe
  2⤵
  PID:432
- C:\Windows\System\qpKQxus.exe
  C:\Windows\System\qpKQxus.exe
  2⤵
  PID:2988
- C:\Windows\System\lWvAjyp.exe
  C:\Windows\System\lWvAjyp.exe
  2⤵
  PID:9140
- C:\Windows\System\NpwLRUc.exe
  C:\Windows\System\NpwLRUc.exe
  2⤵
  PID:1992
- C:\Windows\System\GGtZkyH.exe
  C:\Windows\System\GGtZkyH.exe
  2⤵
  PID:5692
- C:\Windows\System\QsCVyAT.exe
  C:\Windows\System\QsCVyAT.exe
  2⤵
  PID:9028
- C:\Windows\System\dkhrBJe.exe
  C:\Windows\System\dkhrBJe.exe
  2⤵
  PID:8752
- C:\Windows\System\qSCgfcc.exe
  C:\Windows\System\qSCgfcc.exe
  2⤵
  PID:9236
- C:\Windows\System\XZcJxYx.exe
  C:\Windows\System\XZcJxYx.exe
  2⤵
  PID:9260
- C:\Windows\System\NPcWapJ.exe
  C:\Windows\System\NPcWapJ.exe
  2⤵
  PID:9280
- C:\Windows\System\xNKAmBt.exe
  C:\Windows\System\xNKAmBt.exe
  2⤵
  PID:9320
- C:\Windows\System\VMjGpWn.exe
  C:\Windows\System\VMjGpWn.exe
  2⤵
  PID:9348
- C:\Windows\System\jCUSpsP.exe
  C:\Windows\System\jCUSpsP.exe
  2⤵
  PID:9376
- C:\Windows\System\RbsYPmo.exe
  C:\Windows\System\RbsYPmo.exe
  2⤵
  PID:9404
- C:\Windows\System\TNAqUIC.exe
  C:\Windows\System\TNAqUIC.exe
  2⤵
  PID:9420
- C:\Windows\System\cvrVVzn.exe
  C:\Windows\System\cvrVVzn.exe
  2⤵
  PID:9452
- C:\Windows\System\pRpZvXg.exe
  C:\Windows\System\pRpZvXg.exe
  2⤵
  PID:9480
- C:\Windows\System\VvnnfVA.exe
  C:\Windows\System\VvnnfVA.exe
  2⤵
  PID:9524
- C:\Windows\System\qVeuLxm.exe
  C:\Windows\System\qVeuLxm.exe
  2⤵
  PID:9552
- C:\Windows\System\uoYbRTc.exe
  C:\Windows\System\uoYbRTc.exe
  2⤵
  PID:9576
- C:\Windows\System\KnYbezD.exe
  C:\Windows\System\KnYbezD.exe
  2⤵
  PID:9608
- C:\Windows\System\kFIwEhy.exe
  C:\Windows\System\kFIwEhy.exe
  2⤵
  PID:9636
- C:\Windows\System\cHhefFz.exe
  C:\Windows\System\cHhefFz.exe
  2⤵
  PID:9652
- C:\Windows\System\RzybheY.exe
  C:\Windows\System\RzybheY.exe
  2⤵
  PID:9680
- C:\Windows\System\iWpOBAH.exe
  C:\Windows\System\iWpOBAH.exe
  2⤵
  PID:9720
- C:\Windows\System\UrWamCi.exe
  C:\Windows\System\UrWamCi.exe
  2⤵
  PID:9740
- C:\Windows\System\YXPLTbb.exe
  C:\Windows\System\YXPLTbb.exe
  2⤵
  PID:9772
- C:\Windows\System\pPGYRap.exe
  C:\Windows\System\pPGYRap.exe
  2⤵
  PID:9800
- C:\Windows\System\JXbzArB.exe
  C:\Windows\System\JXbzArB.exe
  2⤵
  PID:9828
- C:\Windows\System\oDgJGoO.exe
  C:\Windows\System\oDgJGoO.exe
  2⤵
  PID:9848
- C:\Windows\System\FOwhTiK.exe
  C:\Windows\System\FOwhTiK.exe
  2⤵
  PID:9888
- C:\Windows\System\ocTwicD.exe
  C:\Windows\System\ocTwicD.exe
  2⤵
  PID:9916
- C:\Windows\System\qgazVtQ.exe
  C:\Windows\System\qgazVtQ.exe
  2⤵
  PID:9948
- C:\Windows\System\DfDltYg.exe
  C:\Windows\System\DfDltYg.exe
  2⤵
  PID:9972
- C:\Windows\System\igzbVFk.exe
  C:\Windows\System\igzbVFk.exe
  2⤵
  PID:9992
- C:\Windows\System\KGekYis.exe
  C:\Windows\System\KGekYis.exe
  2⤵
  PID:10012
- C:\Windows\System\BBAPfvO.exe
  C:\Windows\System\BBAPfvO.exe
  2⤵
  PID:10060
- C:\Windows\System\UFTIRmK.exe
  C:\Windows\System\UFTIRmK.exe
  2⤵
  PID:10088
- C:\Windows\System\aExoosJ.exe
  C:\Windows\System\aExoosJ.exe
  2⤵
  PID:10104
- C:\Windows\System\HfPNgUU.exe
  C:\Windows\System\HfPNgUU.exe
  2⤵
  PID:10140
- C:\Windows\System\tpLtwOf.exe
  C:\Windows\System\tpLtwOf.exe
  2⤵
  PID:10160
- C:\Windows\System\YEqFeSC.exe
  C:\Windows\System\YEqFeSC.exe
  2⤵
  PID:10188
- C:\Windows\System\omBhHYH.exe
  C:\Windows\System\omBhHYH.exe
  2⤵
  PID:10224
- C:\Windows\System\skgPXEu.exe
  C:\Windows\System\skgPXEu.exe
  2⤵
  PID:9244
- C:\Windows\System\hLTXSjq.exe
  C:\Windows\System\hLTXSjq.exe
  2⤵
  PID:9276
- C:\Windows\System\NGZHqws.exe
  C:\Windows\System\NGZHqws.exe
  2⤵
  PID:9344
- C:\Windows\System\lmBmVoa.exe
  C:\Windows\System\lmBmVoa.exe
  2⤵
  PID:9388
- C:\Windows\System\yINKMLu.exe
  C:\Windows\System\yINKMLu.exe
  2⤵
  PID:9440
- C:\Windows\System\KycwZdI.exe
  C:\Windows\System\KycwZdI.exe
  2⤵
  PID:9508
- C:\Windows\System\sUlcSPp.exe
  C:\Windows\System\sUlcSPp.exe
  2⤵
  PID:6048
- C:\Windows\System\CtUAWzC.exe
  C:\Windows\System\CtUAWzC.exe
  2⤵
  PID:6092
- C:\Windows\System\euVbrpS.exe
  C:\Windows\System\euVbrpS.exe
  2⤵
  PID:6112
- C:\Windows\System\FSEZDFK.exe
  C:\Windows\System\FSEZDFK.exe
  2⤵
  PID:9716
- C:\Windows\System\yQELSuI.exe
  C:\Windows\System\yQELSuI.exe
  2⤵
  PID:9748
- C:\Windows\System\eoerEFC.exe
  C:\Windows\System\eoerEFC.exe
  2⤵
  PID:5280
- C:\Windows\System\tUvHyoX.exe
  C:\Windows\System\tUvHyoX.exe
  2⤵
  PID:9836
- C:\Windows\System\YZLUuSi.exe
  C:\Windows\System\YZLUuSi.exe
  2⤵
  PID:9896
- C:\Windows\System\LSnwnqp.exe
  C:\Windows\System\LSnwnqp.exe
  2⤵
  PID:5448
- C:\Windows\System\vUTqRzL.exe
  C:\Windows\System\vUTqRzL.exe
  2⤵
  PID:5580
- C:\Windows\System\iaOTonZ.exe
  C:\Windows\System\iaOTonZ.exe
  2⤵
  PID:10020
- C:\Windows\System\gbqiXNj.exe
  C:\Windows\System\gbqiXNj.exe
  2⤵
  PID:10084
- C:\Windows\System\yGAeEGc.exe
  C:\Windows\System\yGAeEGc.exe
  2⤵
  PID:10128
- C:\Windows\System\HxJOxTd.exe
  C:\Windows\System\HxJOxTd.exe
  2⤵
  PID:5972
- C:\Windows\System\vPnBzyk.exe
  C:\Windows\System\vPnBzyk.exe
  2⤵
  PID:6028
- C:\Windows\System\RMBXyin.exe
  C:\Windows\System\RMBXyin.exe
  2⤵
  PID:5404
- C:\Windows\System\fjmhSpx.exe
  C:\Windows\System\fjmhSpx.exe
  2⤵
  PID:9372
- C:\Windows\System\GwniNiS.exe
  C:\Windows\System\GwniNiS.exe
  2⤵
  PID:9432
- C:\Windows\System\lpbKnil.exe
  C:\Windows\System\lpbKnil.exe
  2⤵
  PID:9924
- C:\Windows\System\dkAAiCV.exe
  C:\Windows\System\dkAAiCV.exe
  2⤵
  PID:3928
- C:\Windows\System\YaOGdlR.exe
  C:\Windows\System\YaOGdlR.exe
  2⤵
  PID:9672
- C:\Windows\System\tnMfZHa.exe
  C:\Windows\System\tnMfZHa.exe
  2⤵
  PID:4836
- C:\Windows\System\eztwGNh.exe
  C:\Windows\System\eztwGNh.exe
  2⤵
  PID:1284
- C:\Windows\System\LSluRDf.exe
  C:\Windows\System\LSluRDf.exe
  2⤵
  PID:1368
- C:\Windows\System\QFRgyVn.exe
  C:\Windows\System\QFRgyVn.exe
  2⤵
  PID:9988
- C:\Windows\System\TZkbPmK.exe
  C:\Windows\System\TZkbPmK.exe
  2⤵
  PID:10124
- C:\Windows\System\WkAhrMK.exe
  C:\Windows\System\WkAhrMK.exe
  2⤵
  PID:5880
- C:\Windows\System\HUeLeoT.exe
  C:\Windows\System\HUeLeoT.exe
  2⤵
  PID:10200
- C:\Windows\System\jwfSRNQ.exe
  C:\Windows\System\jwfSRNQ.exe
  2⤵
  PID:6224
- C:\Windows\System\IPemEZB.exe
  C:\Windows\System\IPemEZB.exe
  2⤵
  PID:9504
- C:\Windows\System\PuRgUna.exe
  C:\Windows\System\PuRgUna.exe
  2⤵
  PID:9620
- C:\Windows\System\JQWfEMZ.exe
  C:\Windows\System\JQWfEMZ.exe
  2⤵
  PID:9816
- C:\Windows\System\naAYjRh.exe
  C:\Windows\System\naAYjRh.exe
  2⤵
  PID:5608
- C:\Windows\System\Muztpkq.exe
  C:\Windows\System\Muztpkq.exe
  2⤵
  PID:6352
- C:\Windows\System\SMWbQsL.exe
  C:\Windows\System\SMWbQsL.exe
  2⤵
  PID:5920
- C:\Windows\System\EVihKnT.exe
  C:\Windows\System\EVihKnT.exe
  2⤵
  PID:60
- C:\Windows\System\hOyHbiY.exe
  C:\Windows\System\hOyHbiY.exe
  2⤵
  PID:6056
- C:\Windows\System\UCPdCnx.exe
  C:\Windows\System\UCPdCnx.exe
  2⤵
  PID:2600
- C:\Windows\System\cvsXUsd.exe
  C:\Windows\System\cvsXUsd.exe
  2⤵
  PID:10236
- C:\Windows\System\FPOoSkm.exe
  C:\Windows\System\FPOoSkm.exe
  2⤵
  PID:3160
- C:\Windows\System\IhTbJaW.exe
  C:\Windows\System\IhTbJaW.exe
  2⤵
  PID:924
- C:\Windows\System\EKiwkgR.exe
  C:\Windows\System\EKiwkgR.exe
  2⤵
  PID:9400
- C:\Windows\System\xuPqLEC.exe
  C:\Windows\System\xuPqLEC.exe
  2⤵
  PID:3616
- C:\Windows\System\UQMGjWL.exe
  C:\Windows\System\UQMGjWL.exe
  2⤵
  PID:10260
- C:\Windows\System\rSjIUZl.exe
  C:\Windows\System\rSjIUZl.exe
  2⤵
  PID:10276
- C:\Windows\System\UxvBSUd.exe
  C:\Windows\System\UxvBSUd.exe
  2⤵
  PID:10304
- C:\Windows\System\HlZIvCE.exe
  C:\Windows\System\HlZIvCE.exe
  2⤵
  PID:10336
- C:\Windows\System\oiFQKqZ.exe
  C:\Windows\System\oiFQKqZ.exe
  2⤵
  PID:10372
- C:\Windows\System\kRcRLRn.exe
  C:\Windows\System\kRcRLRn.exe
  2⤵
  PID:10396
- C:\Windows\System\SKHCrhh.exe
  C:\Windows\System\SKHCrhh.exe
  2⤵
  PID:10428
- C:\Windows\System\qWVoShf.exe
  C:\Windows\System\qWVoShf.exe
  2⤵
  PID:10448
- C:\Windows\System\ucNWNlA.exe
  C:\Windows\System\ucNWNlA.exe
  2⤵
  PID:10472
- C:\Windows\System\pMBPiMa.exe
  C:\Windows\System\pMBPiMa.exe
  2⤵
  PID:10500
- C:\Windows\System\LJesTxM.exe
  C:\Windows\System\LJesTxM.exe
  2⤵
  PID:10532
- C:\Windows\System\PquizVB.exe
  C:\Windows\System\PquizVB.exe
  2⤵
  PID:10560
- C:\Windows\System\VlMcoKq.exe
  C:\Windows\System\VlMcoKq.exe
  2⤵
  PID:10588
- C:\Windows\System\CHZHucj.exe
  C:\Windows\System\CHZHucj.exe
  2⤵
  PID:10632
- C:\Windows\System\PDrraXL.exe
  C:\Windows\System\PDrraXL.exe
  2⤵
  PID:10648
- C:\Windows\System\rirapQo.exe
  C:\Windows\System\rirapQo.exe
  2⤵
  PID:10680
- C:\Windows\System\pNtbwcs.exe
  C:\Windows\System\pNtbwcs.exe
  2⤵
  PID:10704
- C:\Windows\System\GJPWBKY.exe
  C:\Windows\System\GJPWBKY.exe
  2⤵
  PID:10744
- C:\Windows\System\HwwFhKK.exe
  C:\Windows\System\HwwFhKK.exe
  2⤵
  PID:10760
- C:\Windows\System\HAtNVxD.exe
  C:\Windows\System\HAtNVxD.exe
  2⤵
  PID:10796
- C:\Windows\System\nWDujkb.exe
  C:\Windows\System\nWDujkb.exe
  2⤵
  PID:10816
- C:\Windows\System\yjzDnMI.exe
  C:\Windows\System\yjzDnMI.exe
  2⤵
  PID:10844
- C:\Windows\System\HZcdTJi.exe
  C:\Windows\System\HZcdTJi.exe
  2⤵
  PID:10872
- C:\Windows\System\dBvmHIn.exe
  C:\Windows\System\dBvmHIn.exe
  2⤵
  PID:10904
- C:\Windows\System\GKNUzov.exe
  C:\Windows\System\GKNUzov.exe
  2⤵
  PID:10928
- C:\Windows\System\RzkhnYV.exe
  C:\Windows\System\RzkhnYV.exe
  2⤵
  PID:10956
- C:\Windows\System\oVfjuyw.exe
  C:\Windows\System\oVfjuyw.exe
  2⤵
  PID:10984
- C:\Windows\System\TwcMRWO.exe
  C:\Windows\System\TwcMRWO.exe
  2⤵
  PID:11016
- C:\Windows\System\blvuWym.exe
  C:\Windows\System\blvuWym.exe
  2⤵
  PID:11040
- C:\Windows\System\dKvhtFF.exe
  C:\Windows\System\dKvhtFF.exe
  2⤵
  PID:11068
- C:\Windows\System\ncvaHqH.exe
  C:\Windows\System\ncvaHqH.exe
  2⤵
  PID:11092
- C:\Windows\System\VPCZYjn.exe
  C:\Windows\System\VPCZYjn.exe
  2⤵
  PID:11112
- C:\Windows\System\zIkMnln.exe
  C:\Windows\System\zIkMnln.exe
  2⤵
  PID:11152
- C:\Windows\System\HMDbdHs.exe
  C:\Windows\System\HMDbdHs.exe
  2⤵
  PID:11180
- C:\Windows\System\GPMxwad.exe
  C:\Windows\System\GPMxwad.exe
  2⤵
  PID:11204
- C:\Windows\System\blTcWuI.exe
  C:\Windows\System\blTcWuI.exe
  2⤵
  PID:11232
- C:\Windows\System\TDmfEhK.exe
  C:\Windows\System\TDmfEhK.exe
  2⤵
  PID:1696
- C:\Windows\System\oJHSMSm.exe
  C:\Windows\System\oJHSMSm.exe
  2⤵
  PID:10272
- C:\Windows\System\ZpqPnWf.exe
  C:\Windows\System\ZpqPnWf.exe
  2⤵
  PID:10344
- C:\Windows\System\GhecKiJ.exe
  C:\Windows\System\GhecKiJ.exe
  2⤵
  PID:10380
- C:\Windows\System\AuDsnLG.exe
  C:\Windows\System\AuDsnLG.exe
  2⤵
  PID:10412
- C:\Windows\System\NWKEkVR.exe
  C:\Windows\System\NWKEkVR.exe
  2⤵
  PID:3736
- C:\Windows\System\xaXwrmo.exe
  C:\Windows\System\xaXwrmo.exe
  2⤵
  PID:10544
- C:\Windows\System\ZsMzwNq.exe
  C:\Windows\System\ZsMzwNq.exe
  2⤵
  PID:10608
- C:\Windows\System\ipanxKC.exe
  C:\Windows\System\ipanxKC.exe
  2⤵
  PID:1732
- C:\Windows\System\ITLnxpT.exe
  C:\Windows\System\ITLnxpT.exe
  2⤵
  PID:10700
- C:\Windows\System\wbIgfnM.exe
  C:\Windows\System\wbIgfnM.exe
  2⤵
  PID:10756
- C:\Windows\System\XPuFAXQ.exe
  C:\Windows\System\XPuFAXQ.exe
  2⤵
  PID:10780
- C:\Windows\System\rSRZFlb.exe
  C:\Windows\System\rSRZFlb.exe
  2⤵
  PID:10864
- C:\Windows\System\nCgKcbF.exe
  C:\Windows\System\nCgKcbF.exe
  2⤵
  PID:10896
- C:\Windows\System\uhWfRvC.exe
  C:\Windows\System\uhWfRvC.exe
  2⤵
  PID:10944
- C:\Windows\System\tWbxPjO.exe
  C:\Windows\System\tWbxPjO.exe
  2⤵
  PID:11024
- C:\Windows\System\fQCZApz.exe
  C:\Windows\System\fQCZApz.exe
  2⤵
  PID:11048
- C:\Windows\System\ZJbWCoh.exe
  C:\Windows\System\ZJbWCoh.exe
  2⤵
  PID:11140
- C:\Windows\System\cJnICmf.exe
  C:\Windows\System\cJnICmf.exe
  2⤵
  PID:11192
- C:\Windows\System\tzNcJfV.exe
  C:\Windows\System\tzNcJfV.exe
  2⤵
  PID:11240
- C:\Windows\System\jiWEFtX.exe
  C:\Windows\System\jiWEFtX.exe
  2⤵
  PID:4184
- C:\Windows\System\tKThiSM.exe
  C:\Windows\System\tKThiSM.exe
  2⤵
  PID:4068
- C:\Windows\System\EJLpbHC.exe
  C:\Windows\System\EJLpbHC.exe
  2⤵
  PID:10480
- C:\Windows\System\ZyBSQCo.exe
  C:\Windows\System\ZyBSQCo.exe
  2⤵
  PID:10572
- C:\Windows\System\eyNrPEu.exe
  C:\Windows\System\eyNrPEu.exe
  2⤵
  PID:10660
- C:\Windows\System\ATyZmDB.exe
  C:\Windows\System\ATyZmDB.exe
  2⤵
  PID:10776
- C:\Windows\System\ynocMRz.exe
  C:\Windows\System\ynocMRz.exe
  2⤵
  PID:4088
- C:\Windows\System\WpptGMn.exe
  C:\Windows\System\WpptGMn.exe
  2⤵
  PID:11004
- C:\Windows\System\DlKaHnA.exe
  C:\Windows\System\DlKaHnA.exe
  2⤵
  PID:7056
- C:\Windows\System\DWCCNbd.exe
  C:\Windows\System\DWCCNbd.exe
  2⤵
  PID:10244
- C:\Windows\System\aAAmXnS.exe
  C:\Windows\System\aAAmXnS.exe
  2⤵
  PID:10408
- C:\Windows\System\IzeqUsu.exe
  C:\Windows\System\IzeqUsu.exe
  2⤵
  PID:4008
- C:\Windows\System\nCbUiDr.exe
  C:\Windows\System\nCbUiDr.exe
  2⤵
  PID:10884
- C:\Windows\System\CbVlbKp.exe
  C:\Windows\System\CbVlbKp.exe
  2⤵
  PID:11076
- C:\Windows\System\cFpsaws.exe
  C:\Windows\System\cFpsaws.exe
  2⤵
  PID:5368
- C:\Windows\System\LOpxOVg.exe
  C:\Windows\System\LOpxOVg.exe
  2⤵
  PID:10832
- C:\Windows\System\PQHPAVw.exe
  C:\Windows\System\PQHPAVw.exe
  2⤵
  PID:11260
- C:\Windows\System\QRKtXmo.exe
  C:\Windows\System\QRKtXmo.exe
  2⤵
  PID:10528
- C:\Windows\System\xuDdVXC.exe
  C:\Windows\System\xuDdVXC.exe
  2⤵
  PID:11284
- C:\Windows\System\EOvaSmT.exe
  C:\Windows\System\EOvaSmT.exe
  2⤵
  PID:11312
- C:\Windows\System\KKgGgRZ.exe
  C:\Windows\System\KKgGgRZ.exe
  2⤵
  PID:11340
- C:\Windows\System\gjivIoX.exe
  C:\Windows\System\gjivIoX.exe
  2⤵
  PID:11368
- C:\Windows\System\ZtZHcmQ.exe
  C:\Windows\System\ZtZHcmQ.exe
  2⤵
  PID:11396
- C:\Windows\System\KnfOxaK.exe
  C:\Windows\System\KnfOxaK.exe
  2⤵
  PID:11424
- C:\Windows\System\dHdLwfl.exe
  C:\Windows\System\dHdLwfl.exe
  2⤵
  PID:11452
- C:\Windows\System\ZewQDEa.exe
  C:\Windows\System\ZewQDEa.exe
  2⤵
  PID:11488
- C:\Windows\System\IOcpAFt.exe
  C:\Windows\System\IOcpAFt.exe
  2⤵
  PID:11508
- C:\Windows\System\FpENOmC.exe
  C:\Windows\System\FpENOmC.exe
  2⤵
  PID:11528
- C:\Windows\System\yGVXyfr.exe
  C:\Windows\System\yGVXyfr.exe
  2⤵
  PID:11544
- C:\Windows\System\ECHEjwR.exe
  C:\Windows\System\ECHEjwR.exe
  2⤵
  PID:11560
- C:\Windows\System\izMpxIk.exe
  C:\Windows\System\izMpxIk.exe
  2⤵
  PID:11596
- C:\Windows\System\tIPJVYq.exe
  C:\Windows\System\tIPJVYq.exe
  2⤵
  PID:11628
- C:\Windows\System\DuDDtNu.exe
  C:\Windows\System\DuDDtNu.exe
  2⤵
  PID:11668
- C:\Windows\System\pfzawyj.exe
  C:\Windows\System\pfzawyj.exe
  2⤵
  PID:11720
- C:\Windows\System\JCJnKVQ.exe
  C:\Windows\System\JCJnKVQ.exe
  2⤵
  PID:11740
- C:\Windows\System\HNtoFfN.exe
  C:\Windows\System\HNtoFfN.exe
  2⤵
  PID:11768
- C:\Windows\System\rbWXXSP.exe
  C:\Windows\System\rbWXXSP.exe
  2⤵
  PID:11804
- C:\Windows\System\HWMcdRw.exe
  C:\Windows\System\HWMcdRw.exe
  2⤵
  PID:11824
- C:\Windows\System\aqbmStI.exe
  C:\Windows\System\aqbmStI.exe
  2⤵
  PID:11852
- C:\Windows\System\gUGpjqz.exe
  C:\Windows\System\gUGpjqz.exe
  2⤵
  PID:11880
- C:\Windows\System\SgyecPe.exe
  C:\Windows\System\SgyecPe.exe
  2⤵
  PID:11908
- C:\Windows\System\CPlqnkE.exe
  C:\Windows\System\CPlqnkE.exe
  2⤵
  PID:11936
- C:\Windows\System\VWBxqnc.exe
  C:\Windows\System\VWBxqnc.exe
  2⤵
  PID:11960
- C:\Windows\System\BwlexFt.exe
  C:\Windows\System\BwlexFt.exe
  2⤵
  PID:11992
- C:\Windows\System\EDGevYz.exe
  C:\Windows\System\EDGevYz.exe
  2⤵
  PID:12016
- C:\Windows\System\dDqcNFt.exe
  C:\Windows\System\dDqcNFt.exe
  2⤵
  PID:12048
- C:\Windows\System\rjYSWVi.exe
  C:\Windows\System\rjYSWVi.exe
  2⤵
  PID:12072
- C:\Windows\System\SBHcPLR.exe
  C:\Windows\System\SBHcPLR.exe
  2⤵
  PID:12100
- C:\Windows\System\fzIZVhu.exe
  C:\Windows\System\fzIZVhu.exe
  2⤵
  PID:12132
- C:\Windows\System\JcdqzIh.exe
  C:\Windows\System\JcdqzIh.exe
  2⤵
  PID:12152
- C:\Windows\System\xtHZUjO.exe
  C:\Windows\System\xtHZUjO.exe
  2⤵
  PID:12188
- C:\Windows\System\JYZQgeV.exe
  C:\Windows\System\JYZQgeV.exe
  2⤵
  PID:12216
- C:\Windows\System\LBCStBa.exe
  C:\Windows\System\LBCStBa.exe
  2⤵
  PID:12244
- C:\Windows\System\koeOqsD.exe
  C:\Windows\System\koeOqsD.exe
  2⤵
  PID:12272
- C:\Windows\System\OCXYcTP.exe
  C:\Windows\System\OCXYcTP.exe
  2⤵
  PID:11268
- C:\Windows\System\MiFlvQp.exe
  C:\Windows\System\MiFlvQp.exe
  2⤵
  PID:11352
- C:\Windows\System\bYpMWge.exe
  C:\Windows\System\bYpMWge.exe
  2⤵
  PID:11436
- C:\Windows\System\xFlBqhj.exe
  C:\Windows\System\xFlBqhj.exe
  2⤵
  PID:5588
- C:\Windows\System\HniNVDX.exe
  C:\Windows\System\HniNVDX.exe
  2⤵
  PID:11536
- C:\Windows\System\IpvBOfH.exe
  C:\Windows\System\IpvBOfH.exe
  2⤵
  PID:11520
- C:\Windows\System\cVKxxmO.exe
  C:\Windows\System\cVKxxmO.exe
  2⤵
  PID:11616
- C:\Windows\System\gTfQuQU.exe
  C:\Windows\System\gTfQuQU.exe
  2⤵
  PID:11676
- C:\Windows\System\SFmNLFd.exe
  C:\Windows\System\SFmNLFd.exe
  2⤵
  PID:11756
- C:\Windows\System\VRJyEQK.exe
  C:\Windows\System\VRJyEQK.exe
  2⤵
  PID:11836
- C:\Windows\System\HgLwuMq.exe
  C:\Windows\System\HgLwuMq.exe
  2⤵
  PID:11892
- C:\Windows\System\iDsxphh.exe
  C:\Windows\System\iDsxphh.exe
  2⤵
  PID:11944
- C:\Windows\System\IEIJGQu.exe
  C:\Windows\System\IEIJGQu.exe
  2⤵
  PID:12008
- C:\Windows\System\wllLVrM.exe
  C:\Windows\System\wllLVrM.exe
  2⤵
  PID:12060
- C:\Windows\System\JPYOkQD.exe
  C:\Windows\System\JPYOkQD.exe
  2⤵
  PID:12084
- C:\Windows\System\oshwWuo.exe
  C:\Windows\System\oshwWuo.exe
  2⤵
  PID:12172
- C:\Windows\System\ONpPNxD.exe
  C:\Windows\System\ONpPNxD.exe
  2⤵
  PID:12236
- C:\Windows\System\fshgzpv.exe
  C:\Windows\System\fshgzpv.exe
  2⤵
  PID:12280
- C:\Windows\System\jxBTmWd.exe
  C:\Windows\System\jxBTmWd.exe
  2⤵
  PID:11380
- C:\Windows\System\Rkfnbvm.exe
  C:\Windows\System\Rkfnbvm.exe
  2⤵
  PID:11552
- C:\Windows\System\duNEKZS.exe
  C:\Windows\System\duNEKZS.exe
  2⤵
  PID:11656
- C:\Windows\System\fPqnalW.exe
  C:\Windows\System\fPqnalW.exe
  2⤵
  PID:11736
- C:\Windows\System\tzFnDvW.exe
  C:\Windows\System\tzFnDvW.exe
  2⤵
  PID:11920
- C:\Windows\System\nVcNxSS.exe
  C:\Windows\System\nVcNxSS.exe
  2⤵
  PID:12024
- C:\Windows\System\VSfhkTb.exe
  C:\Windows\System\VSfhkTb.exe
  2⤵
  PID:5864
- C:\Windows\System\gpDzVnx.exe
  C:\Windows\System\gpDzVnx.exe
  2⤵
  PID:12268
- C:\Windows\System\EDGEGrQ.exe
  C:\Windows\System\EDGEGrQ.exe
  2⤵
  PID:11408
- C:\Windows\System\JjyqQYj.exe
  C:\Windows\System\JjyqQYj.exe
  2⤵
  PID:11868
- C:\Windows\System\LeSzQLP.exe
  C:\Windows\System\LeSzQLP.exe
  2⤵
  PID:12200
- C:\Windows\System\gosZVmD.exe
  C:\Windows\System\gosZVmD.exe
  2⤵
  PID:11612
- C:\Windows\System\axQuIbm.exe
  C:\Windows\System\axQuIbm.exe
  2⤵
  PID:5140
- C:\Windows\System\SuoCEqS.exe
  C:\Windows\System\SuoCEqS.exe
  2⤵
  PID:11364
- C:\Windows\System\UFWCHMW.exe
  C:\Windows\System\UFWCHMW.exe
  2⤵
  PID:12292
- C:\Windows\System\lzNyXKq.exe
  C:\Windows\System\lzNyXKq.exe
  2⤵
  PID:12320
- C:\Windows\System\CsBkybR.exe
  C:\Windows\System\CsBkybR.exe
  2⤵
  PID:12348
- C:\Windows\System\mUkAGWw.exe
  C:\Windows\System\mUkAGWw.exe
  2⤵
  PID:12376
- C:\Windows\System\mXIhoiv.exe
  C:\Windows\System\mXIhoiv.exe
  2⤵
  PID:12404
- C:\Windows\System\yQWNMoJ.exe
  C:\Windows\System\yQWNMoJ.exe
  2⤵
  PID:12432
- C:\Windows\System\YNquZRZ.exe
  C:\Windows\System\YNquZRZ.exe
  2⤵
  PID:12460
- C:\Windows\System\DlHUUFy.exe
  C:\Windows\System\DlHUUFy.exe
  2⤵
  PID:12496
- C:\Windows\System\vaSvOFT.exe
  C:\Windows\System\vaSvOFT.exe
  2⤵
  PID:12516
- C:\Windows\System\tefhhJB.exe
  C:\Windows\System\tefhhJB.exe
  2⤵
  PID:12544
- C:\Windows\System\plnvhPQ.exe
  C:\Windows\System\plnvhPQ.exe
  2⤵
  PID:12572
- C:\Windows\System\gxdZZXC.exe
  C:\Windows\System\gxdZZXC.exe
  2⤵
  PID:12600
- C:\Windows\System\nLIcMNM.exe
  C:\Windows\System\nLIcMNM.exe
  2⤵
  PID:12628
- C:\Windows\System\ZfsmekN.exe
  C:\Windows\System\ZfsmekN.exe
  2⤵
  PID:12668
- C:\Windows\System\BawjwaR.exe
  C:\Windows\System\BawjwaR.exe
  2⤵
  PID:12708
- C:\Windows\System\BlyfQPe.exe
  C:\Windows\System\BlyfQPe.exe
  2⤵
  PID:12752
- C:\Windows\System\oNakJHi.exe
  C:\Windows\System\oNakJHi.exe
  2⤵
  PID:12796
- C:\Windows\System\btEUXqa.exe
  C:\Windows\System\btEUXqa.exe
  2⤵
  PID:12824
- C:\Windows\System\ywCpAzl.exe
  C:\Windows\System\ywCpAzl.exe
  2⤵
  PID:12852
- C:\Windows\System\kIyMhxi.exe
  C:\Windows\System\kIyMhxi.exe
  2⤵
  PID:12880
- C:\Windows\System\bsABbRK.exe
  C:\Windows\System\bsABbRK.exe
  2⤵
  PID:12916
- C:\Windows\System\KwbmJEm.exe
  C:\Windows\System\KwbmJEm.exe
  2⤵
  PID:12944
- C:\Windows\System\TdQseuN.exe
  C:\Windows\System\TdQseuN.exe
  2⤵
  PID:12972
- C:\Windows\System\jYVfEpE.exe
  C:\Windows\System\jYVfEpE.exe
  2⤵
  PID:13004
- C:\Windows\System\GPeMQMa.exe
  C:\Windows\System\GPeMQMa.exe
  2⤵
  PID:13036
- C:\Windows\System\XoFATmT.exe
  C:\Windows\System\XoFATmT.exe
  2⤵
  PID:13060
- C:\Windows\System\eIqyaad.exe
  C:\Windows\System\eIqyaad.exe
  2⤵
  PID:13088
- C:\Windows\System\Djuqakb.exe
  C:\Windows\System\Djuqakb.exe
  2⤵
  PID:13104
- C:\Windows\System\xDZnCWa.exe
  C:\Windows\System\xDZnCWa.exe
  2⤵
  PID:13152
- C:\Windows\System\QdVRjal.exe
  C:\Windows\System\QdVRjal.exe
  2⤵
  PID:13172
- C:\Windows\System\RLdjhwf.exe
  C:\Windows\System\RLdjhwf.exe
  2⤵
  PID:13200
- C:\Windows\System\ZFbrdwq.exe
  C:\Windows\System\ZFbrdwq.exe
  2⤵
  PID:13216
- C:\Windows\System\niaXxjv.exe
  C:\Windows\System\niaXxjv.exe
  2⤵
  PID:13244
- C:\Windows\System\NABSATR.exe
  C:\Windows\System\NABSATR.exe
  2⤵
  PID:13260
- C:\Windows\System\MtCHBhA.exe
  C:\Windows\System\MtCHBhA.exe
  2⤵
  PID:13284
- C:\Windows\System\pSleNjK.exe
  C:\Windows\System\pSleNjK.exe
  2⤵
  PID:13300
- C:\Windows\System\RoXjWhj.exe
  C:\Windows\System\RoXjWhj.exe
  2⤵
  PID:12332
- C:\Windows\System\edvQqyp.exe
  C:\Windows\System\edvQqyp.exe
  2⤵
  PID:12400
- C:\Windows\System\eJgLOGa.exe
  C:\Windows\System\eJgLOGa.exe
  2⤵
  PID:12456
- C:\Windows\System\eyvzxOn.exe
  C:\Windows\System\eyvzxOn.exe
  2⤵
  PID:12540
- C:\Windows\System\OfMUVyd.exe
  C:\Windows\System\OfMUVyd.exe
  2⤵
  PID:12596
- C:\Windows\System\pfGglLO.exe
  C:\Windows\System\pfGglLO.exe
  2⤵
  PID:12692
- C:\Windows\System\GYZZGJg.exe
  C:\Windows\System\GYZZGJg.exe
  2⤵
  PID:12788
- C:\Windows\System\CdPLVYX.exe
  C:\Windows\System\CdPLVYX.exe
  2⤵
  PID:12848
- C:\Windows\System\EqRPbDS.exe
  C:\Windows\System\EqRPbDS.exe
  2⤵
  PID:12928
- C:\Windows\System\mDkDhQR.exe
  C:\Windows\System\mDkDhQR.exe
  2⤵
  PID:13020
- C:\Windows\System\nZGblnO.exe
  C:\Windows\System\nZGblnO.exe
  2⤵
  PID:13132
- C:\Windows\System\UROTIDO.exe
  C:\Windows\System\UROTIDO.exe
  2⤵
  PID:13184
- C:\Windows\System\AJuIqhP.exe
  C:\Windows\System\AJuIqhP.exe
  2⤵
  PID:13208
- C:\Windows\System\EmVkjwO.exe
  C:\Windows\System\EmVkjwO.exe
  2⤵
  PID:13292
- C:\Windows\System\KJOsGuZ.exe
  C:\Windows\System\KJOsGuZ.exe
  2⤵
  PID:13280
- C:\Windows\System\yIUmMwc.exe
  C:\Windows\System\yIUmMwc.exe
  2⤵
  PID:12428
- C:\Windows\System\sgsjXYm.exe
  C:\Windows\System\sgsjXYm.exe
  2⤵
  PID:12676
- C:\Windows\System\FAdCfmS.exe
  C:\Windows\System\FAdCfmS.exe
  2⤵
  PID:12812
- C:\Windows\System\ZSNoMfD.exe
  C:\Windows\System\ZSNoMfD.exe
  2⤵
  PID:12956
- C:\Windows\System\QuRalDm.exe
  C:\Windows\System\QuRalDm.exe
  2⤵
  PID:12968
- C:\Windows\System\gFEEXGY.exe
  C:\Windows\System\gFEEXGY.exe
  2⤵
  PID:6248
- C:\Windows\System\wcNxBzZ.exe
  C:\Windows\System\wcNxBzZ.exe
  2⤵
  PID:13252
- C:\Windows\System\JSiRSOr.exe
  C:\Windows\System\JSiRSOr.exe
  2⤵
  PID:12504
- C:\Windows\System\YDBdSVz.exe
  C:\Windows\System\YDBdSVz.exe
  2⤵
  PID:3856
- C:\Windows\System\pPSZyoj.exe
  C:\Windows\System\pPSZyoj.exe
  2⤵
  PID:6168
- C:\Windows\System\ekwjsVn.exe
  C:\Windows\System\ekwjsVn.exe
  2⤵
  PID:13164
- C:\Windows\System\AeGBEOT.exe
  C:\Windows\System\AeGBEOT.exe
  2⤵
  PID:6052
- C:\Windows\System\QVjPeZF.exe
  C:\Windows\System\QVjPeZF.exe
  2⤵
  PID:12624
- C:\Windows\System\qevAquZ.exe
  C:\Windows\System\qevAquZ.exe
  2⤵
  PID:12904
- C:\Windows\System\cMMELni.exe
  C:\Windows\System\cMMELni.exe
  2⤵
  PID:6044
- C:\Windows\System\GFDZKkd.exe
  C:\Windows\System\GFDZKkd.exe
  2⤵
  PID:12864
- C:\Windows\System\NQcPArL.exe
  C:\Windows\System\NQcPArL.exe
  2⤵
  PID:13228
- C:\Windows\System\cwihbMt.exe
  C:\Windows\System\cwihbMt.exe
  2⤵
  PID:13336
- C:\Windows\System\xVbXppe.exe
  C:\Windows\System\xVbXppe.exe
  2⤵
  PID:13360
- C:\Windows\System\HBekPnw.exe
  C:\Windows\System\HBekPnw.exe
  2⤵
  PID:13384
- C:\Windows\System\FXARgXS.exe
  C:\Windows\System\FXARgXS.exe
  2⤵
  PID:13408
- C:\Windows\System\SrgcULj.exe
  C:\Windows\System\SrgcULj.exe
  2⤵
  PID:13436
- C:\Windows\System\BgVhDgP.exe
  C:\Windows\System\BgVhDgP.exe
  2⤵
  PID:13460
- C:\Windows\System\ijHswKS.exe
  C:\Windows\System\ijHswKS.exe
  2⤵
  PID:13488
- C:\Windows\System\AQGrPQq.exe
  C:\Windows\System\AQGrPQq.exe
  2⤵
  PID:13520
- C:\Windows\System\SbUhZDz.exe
  C:\Windows\System\SbUhZDz.exe
  2⤵
  PID:13548
- C:\Windows\System\KYDzKtT.exe
  C:\Windows\System\KYDzKtT.exe
  2⤵
  PID:13580
- C:\Windows\System\mvdKZRs.exe
  C:\Windows\System\mvdKZRs.exe
  2⤵
  PID:13616
- C:\Windows\System\zstCJiT.exe
  C:\Windows\System\zstCJiT.exe
  2⤵
  PID:13644
- C:\Windows\System\Xuwgcli.exe
  C:\Windows\System\Xuwgcli.exe
  2⤵
  PID:13676
- C:\Windows\System\WZfUecF.exe
  C:\Windows\System\WZfUecF.exe
  2⤵
  PID:13720
- C:\Windows\System\dUHxisi.exe
  C:\Windows\System\dUHxisi.exe
  2⤵
  PID:13736
- C:\Windows\System\wqaxCZB.exe
  C:\Windows\System\wqaxCZB.exe
  2⤵
  PID:13768
- C:\Windows\System\OmfidRn.exe
  C:\Windows\System\OmfidRn.exe
  2⤵
  PID:13792
- C:\Windows\System\EisYkrt.exe
  C:\Windows\System\EisYkrt.exe
  2⤵
  PID:13820
- C:\Windows\System\oMilJYU.exe
  C:\Windows\System\oMilJYU.exe
  2⤵
  PID:13848
- C:\Windows\System\AxSKinm.exe
  C:\Windows\System\AxSKinm.exe
  2⤵
  PID:13876
- C:\Windows\System\cwTJjyD.exe
  C:\Windows\System\cwTJjyD.exe
  2⤵
  PID:13904
- C:\Windows\System\ofUswXZ.exe
  C:\Windows\System\ofUswXZ.exe
  2⤵
  PID:13932
- C:\Windows\System\dUBwVok.exe
  C:\Windows\System\dUBwVok.exe
  2⤵
  PID:13964
- C:\Windows\System\MULRmjV.exe
  C:\Windows\System\MULRmjV.exe
  2⤵
  PID:13988
- C:\Windows\System\xhHarWu.exe
  C:\Windows\System\xhHarWu.exe
  2⤵
  PID:14028
- C:\Windows\System\RHhTWlO.exe
  C:\Windows\System\RHhTWlO.exe
  2⤵
  PID:14056
- C:\Windows\System\GerfVuK.exe
  C:\Windows\System\GerfVuK.exe
  2⤵
  PID:14076
- C:\Windows\System\NqNHPqQ.exe
  C:\Windows\System\NqNHPqQ.exe
  2⤵
  PID:14112
- C:\Windows\System\lIAYKfd.exe
  C:\Windows\System\lIAYKfd.exe
  2⤵
  PID:14136
- C:\Windows\System\KySnjrM.exe
  C:\Windows\System\KySnjrM.exe
  2⤵
  PID:14164
- C:\Windows\System\Zysymcd.exe
  C:\Windows\System\Zysymcd.exe
  2⤵
  PID:14196
- C:\Windows\System\rpwTgYC.exe
  C:\Windows\System\rpwTgYC.exe
  2⤵
  PID:14224
- C:\Windows\System\XEauSsR.exe
  C:\Windows\System\XEauSsR.exe
  2⤵
  PID:14252
- C:\Windows\System\aqGVhgE.exe
  C:\Windows\System\aqGVhgE.exe
  2⤵
  PID:14280
- C:\Windows\System\zKisyWn.exe
  C:\Windows\System\zKisyWn.exe
  2⤵
  PID:14320
- C:\Windows\System\xgZvxBo.exe
  C:\Windows\System\xgZvxBo.exe
  2⤵
  PID:3304
- C:\Windows\System\gPSfjIJ.exe
  C:\Windows\System\gPSfjIJ.exe
  2⤵
  PID:6504
- C:\Windows\System\NFEuszi.exe
  C:\Windows\System\NFEuszi.exe
  2⤵
  PID:13404
- C:\Windows\System\lJQSHXK.exe
  C:\Windows\System\lJQSHXK.exe
  2⤵
  PID:4696
- C:\Windows\System\QeuhQbC.exe
  C:\Windows\System\QeuhQbC.exe
  2⤵
  PID:6720
- C:\Windows\System\oAMgaMU.exe
  C:\Windows\System\oAMgaMU.exe
  2⤵
  PID:13508
- C:\Windows\System\NuyVFIj.exe
  C:\Windows\System\NuyVFIj.exe
  2⤵
  PID:13572
- C:\Windows\System\OFjTyut.exe
  C:\Windows\System\OFjTyut.exe
  2⤵
  PID:13664
- C:\Windows\System\ldIrnJS.exe
  C:\Windows\System\ldIrnJS.exe
  2⤵
  PID:13692
- C:\Windows\System\kPlsHRF.exe
  C:\Windows\System\kPlsHRF.exe
  2⤵
  PID:6312
- C:\Windows\System\BQnZlBY.exe
  C:\Windows\System\BQnZlBY.exe
  2⤵
  PID:13808
- C:\Windows\System\CdXeloM.exe
  C:\Windows\System\CdXeloM.exe
  2⤵
  PID:6952
- C:\Windows\System\hdAkCUg.exe
  C:\Windows\System\hdAkCUg.exe
  2⤵
  PID:13916
- C:\Windows\System\zGMWngx.exe
  C:\Windows\System\zGMWngx.exe
  2⤵
  PID:7000
- C:\Windows\System\AXwUtLM.exe
  C:\Windows\System\AXwUtLM.exe
  2⤵
  PID:13972
- C:\Windows\System\Hulstzk.exe
  C:\Windows\System\Hulstzk.exe
  2⤵
  PID:6412
- C:\Windows\System\qPyQrKe.exe
  C:\Windows\System\qPyQrKe.exe
  2⤵
  PID:2252
- C:\Windows\System\IxtqlIl.exe
  C:\Windows\System\IxtqlIl.exe
  2⤵
  PID:14120
- C:\Windows\System\JDRIEVZ.exe
  C:\Windows\System\JDRIEVZ.exe
  2⤵
  PID:14148
- C:\Windows\System\noIrUnZ.exe
  C:\Windows\System\noIrUnZ.exe
  2⤵
  PID:14216
- C:\Windows\System\GdQrreV.exe
  C:\Windows\System\GdQrreV.exe
  2⤵
  PID:7096
- C:\Windows\System\oGsMaLX.exe
  C:\Windows\System\oGsMaLX.exe
  2⤵
  PID:14300
- C:\Windows\System\qaMXQdU.exe
  C:\Windows\System\qaMXQdU.exe
  2⤵
  PID:6488
- C:\Windows\System\AwYCcMW.exe
  C:\Windows\System\AwYCcMW.exe
  2⤵
  PID:3472
- C:\Windows\System\bEbouRa.exe
  C:\Windows\System\bEbouRa.exe
  2⤵
  PID:3120
- C:\Windows\System\aBuVNvJ.exe
  C:\Windows\System\aBuVNvJ.exe
  2⤵
  PID:13376
- C:\Windows\System\vHYhdGR.exe
  C:\Windows\System\vHYhdGR.exe
  2⤵
  PID:6200
- C:\Windows\System\zOuXZkw.exe
  C:\Windows\System\zOuXZkw.exe
  2⤵
  PID:6528
- C:\Windows\System\nSnJPEM.exe
  C:\Windows\System\nSnJPEM.exe
  2⤵
  PID:13480
- C:\Windows\System\asBmkEx.exe
  C:\Windows\System\asBmkEx.exe
  2⤵
  PID:3976
- C:\Windows\System\CcrDzFM.exe
  C:\Windows\System\CcrDzFM.exe
  2⤵
  PID:6140
- C:\Windows\System\VXtIShz.exe
  C:\Windows\System\VXtIShz.exe
  2⤵
  PID:13812
- C:\Windows\System\MUfTaDF.exe
  C:\Windows\System\MUfTaDF.exe
  2⤵
  PID:7016
- C:\Windows\System\PCpAGok.exe
  C:\Windows\System\PCpAGok.exe
  2⤵
  PID:6628
- C:\Windows\System\hGkjPFk.exe
  C:\Windows\System\hGkjPFk.exe
  2⤵
  PID:6404
- C:\Windows\System\QSOHfLY.exe
  C:\Windows\System\QSOHfLY.exe
  2⤵
  PID:6692
- C:\Windows\System\Hjcdkie.exe
  C:\Windows\System\Hjcdkie.exe
  2⤵
  PID:6816
- C:\Windows\System\lKYjPSu.exe
  C:\Windows\System\lKYjPSu.exe
  2⤵
  PID:2568
- C:\Windows\System\rPEGuAn.exe
  C:\Windows\System\rPEGuAn.exe
  2⤵
  PID:6936
- C:\Windows\System\MKzFbha.exe
  C:\Windows\System\MKzFbha.exe
  2⤵
  PID:1816
- C:\Windows\System\JejEtFi.exe
  C:\Windows\System\JejEtFi.exe
  2⤵
  PID:13892
- C:\Windows\System\ckFlSHX.exe
  C:\Windows\System\ckFlSHX.exe
  2⤵
  PID:7172
- C:\Windows\System\uxyWzrc.exe
  C:\Windows\System\uxyWzrc.exe
  2⤵
  PID:7564
- C:\Windows\System\VxODKfr.exe
  C:\Windows\System\VxODKfr.exe
  2⤵
  PID:13084
- C:\Windows\System\qKhrAjc.exe
  C:\Windows\System\qKhrAjc.exe
  2⤵
  PID:7584
- C:\Windows\System\OiHBDop.exe
  C:\Windows\System\OiHBDop.exe
  2⤵
  PID:12992
- C:\Windows\System\DNwlIvP.exe
  C:\Windows\System\DNwlIvP.exe
  2⤵
  PID:7600
- C:\Windows\System\jczfSzZ.exe
  C:\Windows\System\jczfSzZ.exe
  2⤵
  PID:7624
- C:\Windows\System\glAXfnn.exe
  C:\Windows\System\glAXfnn.exe
  2⤵
  PID:7684
- C:\Windows\System\bwpEDfW.exe
  C:\Windows\System\bwpEDfW.exe
  2⤵
  PID:6520
- C:\Windows\System\EeIceFs.exe
  C:\Windows\System\EeIceFs.exe
  2⤵
  PID:7288
- C:\Windows\System\IlVoKcX.exe
  C:\Windows\System\IlVoKcX.exe
  2⤵
  PID:6796
- C:\Windows\System\khzdbPU.exe
  C:\Windows\System\khzdbPU.exe
  2⤵
  PID:7892
- C:\Windows\System\gnpuXqx.exe
  C:\Windows\System\gnpuXqx.exe
  2⤵
  PID:5092
- C:\Windows\System\UMuqxxN.exe
  C:\Windows\System\UMuqxxN.exe
  2⤵
  PID:7964
- C:\Windows\System\LuiSqhh.exe
  C:\Windows\System\LuiSqhh.exe
  2⤵
  PID:8264
- C:\Windows\System\GwXtrZO.exe
  C:\Windows\System\GwXtrZO.exe
  2⤵
  PID:12892
- C:\Windows\System\hjueWml.exe
  C:\Windows\System\hjueWml.exe
  2⤵
  PID:6832
- C:\Windows\System\WlXaofd.exe
  C:\Windows\System\WlXaofd.exe
  2⤵
  PID:8084
- C:\Windows\System\XRIEzRi.exe
  C:\Windows\System\XRIEzRi.exe
  2⤵
  PID:7008
- C:\Windows\System\WPlppWs.exe
  C:\Windows\System\WPlppWs.exe
  2⤵
  PID:7332
- C:\Windows\System\JhbjEIe.exe
  C:\Windows\System\JhbjEIe.exe
  2⤵
  PID:7512
- C:\Windows\System\FSOLvdu.exe
  C:\Windows\System\FSOLvdu.exe
  2⤵
  PID:7100
- C:\Windows\System\BAsKtaR.exe
  C:\Windows\System\BAsKtaR.exe
  2⤵
  PID:8996
- C:\Windows\System\hxZEQKc.exe
  C:\Windows\System\hxZEQKc.exe
  2⤵
  PID:9008
- C:\Windows\System\AqBdGlu.exe
  C:\Windows\System\AqBdGlu.exe
  2⤵
  PID:9036
- C:\Windows\System\eOfWeRU.exe
  C:\Windows\System\eOfWeRU.exe
  2⤵
  PID:1852
- C:\Windows\System\VcnLXkQ.exe
  C:\Windows\System\VcnLXkQ.exe
  2⤵
  PID:7932
- C:\Windows\System\rmMgtre.exe
  C:\Windows\System\rmMgtre.exe
  2⤵
  PID:7208
- C:\Windows\System\sVsMoSS.exe
  C:\Windows\System\sVsMoSS.exe
  2⤵
  PID:7256
- C:\Windows\System\bTNSOqy.exe
  C:\Windows\System\bTNSOqy.exe
  2⤵
  PID:6428
- C:\Windows\System\SeHojsg.exe
  C:\Windows\System\SeHojsg.exe
  2⤵
  PID:7744
- C:\Windows\System\eNaintX.exe
  C:\Windows\System\eNaintX.exe
  2⤵
  PID:6976
- C:\Windows\System\vnMbdVl.exe
  C:\Windows\System\vnMbdVl.exe
  2⤵
  PID:7768
- C:\Windows\System\EpnhKyh.exe
  C:\Windows\System\EpnhKyh.exe
  2⤵
  PID:1172
- C:\Windows\System\alIebsq.exe
  C:\Windows\System\alIebsq.exe
  2⤵
  PID:1480
- C:\Windows\System\laLNETE.exe
  C:\Windows\System\laLNETE.exe
  2⤵
  PID:2284
- C:\Windows\System\LXswoZD.exe
  C:\Windows\System\LXswoZD.exe
  2⤵
  PID:7220
- C:\Windows\System\JweykSn.exe
  C:\Windows\System\JweykSn.exe
  2⤵
  PID:7940
- C:\Windows\System\NWoGkGu.exe
  C:\Windows\System\NWoGkGu.exe
  2⤵
  PID:6284
- C:\Windows\System\igQCYHn.exe
  C:\Windows\System\igQCYHn.exe
  2⤵
  PID:8020
- C:\Windows\System\zDBlURR.exe
  C:\Windows\System\zDBlURR.exe
  2⤵
  PID:8660
- C:\Windows\System\CTnpgSG.exe
  C:\Windows\System\CTnpgSG.exe
  2⤵
  PID:8108
- C:\Windows\System\KzNngkc.exe
  C:\Windows\System\KzNngkc.exe
  2⤵
  PID:8804
- C:\Windows\System\rYQYxYc.exe
  C:\Windows\System\rYQYxYc.exe
  2⤵
  PID:1768
- C:\Windows\System\qxJwSlW.exe
  C:\Windows\System\qxJwSlW.exe
  2⤵
  PID:7164
- C:\Windows\System\KHzEyVj.exe
  C:\Windows\System\KHzEyVj.exe
  2⤵
  PID:8992
- C:\Windows\System\amvkTFI.exe
  C:\Windows\System\amvkTFI.exe
  2⤵
  PID:9136
- C:\Windows\System\ALIWaGl.exe
  C:\Windows\System\ALIWaGl.exe
  2⤵
  PID:7352
- C:\Windows\System\ujHbRva.exe
  C:\Windows\System\ujHbRva.exe
  2⤵
  PID:8784
- C:\Windows\System\rYCwvjA.exe
  C:\Windows\System\rYCwvjA.exe
  2⤵
  PID:4712
- C:\Windows\System\dUwiJmu.exe
  C:\Windows\System\dUwiJmu.exe
  2⤵
  PID:8848
- C:\Windows\System\UUUcsxW.exe
  C:\Windows\System\UUUcsxW.exe
  2⤵
  PID:5440
- C:\Windows\System\dKqLRZI.exe
  C:\Windows\System\dKqLRZI.exe
  2⤵
  PID:7528
- C:\Windows\System\EBfHYFb.exe
  C:\Windows\System\EBfHYFb.exe
  2⤵
  PID:9124
- C:\Windows\System\QBTXsIC.exe
  C:\Windows\System\QBTXsIC.exe
  2⤵
  PID:7412
- C:\Windows\System\hpXXPUg.exe
  C:\Windows\System\hpXXPUg.exe
  2⤵
  PID:2596
- C:\Windows\System\nIOeNpL.exe
  C:\Windows\System\nIOeNpL.exe
  2⤵
  PID:7452
- C:\Windows\System\kBkEQSA.exe
  C:\Windows\System\kBkEQSA.exe
  2⤵
  PID:8552
- C:\Windows\System\HwDTCNA.exe
  C:\Windows\System\HwDTCNA.exe
  2⤵
  PID:7348
- C:\Windows\System\BMnXHVo.exe
  C:\Windows\System\BMnXHVo.exe
  2⤵
  PID:8100
- C:\Windows\System\rVmdGJq.exe
  C:\Windows\System\rVmdGJq.exe
  2⤵
  PID:8744
- C:\Windows\System\HMIyFRR.exe
  C:\Windows\System\HMIyFRR.exe
  2⤵
  PID:5620
- C:\Windows\System\wLUYmWt.exe
  C:\Windows\System\wLUYmWt.exe
  2⤵
  PID:14048
- C:\Windows\System\rVqFivu.exe
  C:\Windows\System\rVqFivu.exe
  2⤵
  PID:8656
- C:\Windows\System\AMwsHnw.exe
  C:\Windows\System\AMwsHnw.exe
  2⤵
  PID:6660
- C:\Windows\System\RtSmwJa.exe
  C:\Windows\System\RtSmwJa.exe
  2⤵
  PID:5416
- C:\Windows\System\WySELZK.exe
  C:\Windows\System\WySELZK.exe
  2⤵
  PID:7388
- C:\Windows\System\xbySQps.exe
  C:\Windows\System\xbySQps.exe
  2⤵
  PID:8884
- C:\Windows\System\GvzHGCT.exe
  C:\Windows\System\GvzHGCT.exe
  2⤵
  PID:5492
- C:\Windows\System\KdyZEpS.exe
  C:\Windows\System\KdyZEpS.exe
  2⤵
  PID:8796
- C:\Windows\System\NJCMJnW.exe
  C:\Windows\System\NJCMJnW.exe
  2⤵
  PID:8976
- C:\Windows\System\iPWmgyZ.exe
  C:\Windows\System\iPWmgyZ.exe
  2⤵
  PID:9396
- C:\Windows\System\Gdvenvd.exe
  C:\Windows\System\Gdvenvd.exe
  2⤵
  PID:9448
- C:\Windows\System\DcjtjpD.exe
  C:\Windows\System\DcjtjpD.exe
  2⤵
  PID:6996
- C:\Windows\System\QNjNoQY.exe
  C:\Windows\System\QNjNoQY.exe
  2⤵
  PID:9512
- C:\Windows\System\zqRBlnC.exe
  C:\Windows\System\zqRBlnC.exe
  2⤵
  PID:6340
- C:\Windows\System\KUQvshk.exe
  C:\Windows\System\KUQvshk.exe
  2⤵
  PID:7536
- C:\Windows\System\qmZYmpx.exe
  C:\Windows\System\qmZYmpx.exe
  2⤵
  PID:8636
- C:\Windows\System\NBLkWuA.exe
  C:\Windows\System\NBLkWuA.exe
  2⤵
  PID:8224
- C:\Windows\System\UUxQbqQ.exe
  C:\Windows\System\UUxQbqQ.exe
  2⤵
  PID:8572
- C:\Windows\System\uYmxfhf.exe
  C:\Windows\System\uYmxfhf.exe
  2⤵
  PID:14144
- C:\Windows\System\cEaFybq.exe
  C:\Windows\System\cEaFybq.exe
  2⤵
  PID:9752
- C:\Windows\System\CltJWRF.exe
  C:\Windows\System\CltJWRF.exe
  2⤵
  PID:6308
- C:\Windows\System\lnDpMNE.exe
  C:\Windows\System\lnDpMNE.exe
  2⤵
  PID:6232
- C:\Windows\System\caYmUfg.exe
  C:\Windows\System\caYmUfg.exe
  2⤵
  PID:9256
- C:\Windows\System\rolYBps.exe
  C:\Windows\System\rolYBps.exe
  2⤵
  PID:9340
- C:\Windows\System\fnZZdop.exe
  C:\Windows\System\fnZZdop.exe
  2⤵
  PID:2080
- C:\Windows\System\gYLpIac.exe
  C:\Windows\System\gYLpIac.exe
  2⤵
  PID:9464
- C:\Windows\System\mSVvPPO.exe
  C:\Windows\System\mSVvPPO.exe
  2⤵
  PID:1648
- C:\Windows\System\pgqjHXL.exe
  C:\Windows\System\pgqjHXL.exe
  2⤵
  PID:5456
- C:\Windows\System\vpjiKAM.exe
  C:\Windows\System\vpjiKAM.exe
  2⤵
  PID:7384
- C:\Windows\System\yyVYyvf.exe
  C:\Windows\System\yyVYyvf.exe
  2⤵
  PID:8920
- C:\Windows\System\rddUqeM.exe
  C:\Windows\System\rddUqeM.exe
  2⤵
  PID:6872
- C:\Windows\System\xlZxGcr.exe
  C:\Windows\System\xlZxGcr.exe
  2⤵
  PID:8252
- C:\Windows\System\MfaeDWp.exe
  C:\Windows\System\MfaeDWp.exe
  2⤵
  PID:5876
- C:\Windows\System\sXUVduD.exe
  C:\Windows\System\sXUVduD.exe
  2⤵
  PID:9856
- C:\Windows\System\UgldfdQ.exe
  C:\Windows\System\UgldfdQ.exe
  2⤵
  PID:8812
- C:\Windows\System\EBzQADl.exe
  C:\Windows\System\EBzQADl.exe
  2⤵
  PID:9308
- C:\Windows\System\CFUlEWj.exe
  C:\Windows\System\CFUlEWj.exe
  2⤵
  PID:9500
- C:\Windows\System\nzCPkeD.exe
  C:\Windows\System\nzCPkeD.exe
  2⤵
  PID:10032
- C:\Windows\System\NVSZeWI.exe
  C:\Windows\System\NVSZeWI.exe
  2⤵
  PID:9540
- C:\Windows\System\AYPNFiC.exe
  C:\Windows\System\AYPNFiC.exe
  2⤵
  PID:8476
- C:\Windows\System\ETCxcMX.exe
  C:\Windows\System\ETCxcMX.exe
  2⤵
  PID:9668
- C:\Windows\System\EJgwFup.exe
  C:\Windows\System\EJgwFup.exe
  2⤵
  PID:8492
- C:\Windows\System\nRnAjXy.exe
  C:\Windows\System\nRnAjXy.exe
  2⤵
  PID:9884
- C:\Windows\System\oVmzhyc.exe
  C:\Windows\System\oVmzhyc.exe
  2⤵
  PID:8088
- C:\Windows\System\mKtwbVz.exe
  C:\Windows\System\mKtwbVz.exe
  2⤵
  PID:8160
- C:\Windows\System\TLoXvMD.exe
  C:\Windows\System\TLoXvMD.exe
  2⤵
  PID:5788
- C:\Windows\System\fjhAook.exe
  C:\Windows\System\fjhAook.exe
  2⤵
  PID:9252
- C:\Windows\System\MlIVQAD.exe
  C:\Windows\System\MlIVQAD.exe
  2⤵
  PID:9356
- C:\Windows\System\sioXBUR.exe
  C:\Windows\System\sioXBUR.exe
  2⤵
  PID:5836
- C:\Windows\System\MgjIjPL.exe
  C:\Windows\System\MgjIjPL.exe
  2⤵
  PID:7420
- C:\Windows\System\hSMwFTp.exe
  C:\Windows\System\hSMwFTp.exe
  2⤵
  PID:5704
- C:\Windows\System\ELounjf.exe
  C:\Windows\System\ELounjf.exe
  2⤵
  PID:5252
- C:\Windows\System\VtYpwgv.exe
  C:\Windows\System\VtYpwgv.exe
  2⤵
  PID:9648
- C:\Windows\System\xttJLCc.exe
  C:\Windows\System\xttJLCc.exe
  2⤵
  PID:3732
- C:\Windows\System\NVUwaaz.exe
  C:\Windows\System\NVUwaaz.exe
  2⤵
  PID:8052
- C:\Windows\System\Wgtxqfk.exe
  C:\Windows\System\Wgtxqfk.exe
  2⤵
  PID:5300
- C:\Windows\System\svglXWw.exe
  C:\Windows\System\svglXWw.exe
  2⤵
  PID:7812
- C:\Windows\System\meoRbyK.exe
  C:\Windows\System\meoRbyK.exe
  2⤵
  PID:1184
- C:\Windows\System\ngwiziG.exe
  C:\Windows\System\ngwiziG.exe
  2⤵
  PID:1116
- C:\Windows\System\SKdRAqm.exe
  C:\Windows\System\SKdRAqm.exe
  2⤵
  PID:10196
- C:\Windows\System\TdUwEhY.exe
  C:\Windows\System\TdUwEhY.exe
  2⤵
  PID:10216
- C:\Windows\System\tjHzLKg.exe
  C:\Windows\System\tjHzLKg.exe
  2⤵
  PID:8396
- C:\Windows\System\IpayBkB.exe
  C:\Windows\System\IpayBkB.exe
  2⤵
  PID:9548
- C:\Windows\System\uyEjMlI.exe
  C:\Windows\System\uyEjMlI.exe
  2⤵
  PID:2136
- C:\Windows\System\fIwXElY.exe
  C:\Windows\System\fIwXElY.exe
  2⤵
  PID:3980
- C:\Windows\System\HJWqGtH.exe
  C:\Windows\System\HJWqGtH.exe
  2⤵
  PID:6436
- C:\Windows\System\NJfTgtw.exe
  C:\Windows\System\NJfTgtw.exe
  2⤵
  PID:8464
- C:\Windows\System\XzAsnNs.exe
  C:\Windows\System\XzAsnNs.exe
  2⤵
  PID:1248
- C:\Windows\System\GUVeRZS.exe
  C:\Windows\System\GUVeRZS.exe
  2⤵
  PID:10332
- C:\Windows\System\YadPjnn.exe
  C:\Windows\System\YadPjnn.exe
  2⤵
  PID:7532
- C:\Windows\System\lkEPhAJ.exe
  C:\Windows\System\lkEPhAJ.exe
  2⤵
  PID:9688
- C:\Windows\System\RFecnAl.exe
  C:\Windows\System\RFecnAl.exe
  2⤵
  PID:8608
- C:\Windows\System\GYbYljS.exe
  C:\Windows\System\GYbYljS.exe
  2⤵
  PID:4604
- C:\Windows\System\itzPmWn.exe
  C:\Windows\System\itzPmWn.exe
  2⤵
  PID:9824
- C:\Windows\System\YoqKjAF.exe
  C:\Windows\System\YoqKjAF.exe
  2⤵
  PID:9472
- C:\Windows\System\DdPurvy.exe
  C:\Windows\System\DdPurvy.exe
  2⤵
  PID:10540
- C:\Windows\System\qleYhsb.exe
  C:\Windows\System\qleYhsb.exe
  2⤵
  PID:10100
- C:\Windows\System\Rkhwfeb.exe
  C:\Windows\System\Rkhwfeb.exe
  2⤵
  PID:10292
- C:\Windows\System\xRqktAz.exe
  C:\Windows\System\xRqktAz.exe
  2⤵
  PID:4300
- C:\Windows\System\CrxNfHr.exe
  C:\Windows\System\CrxNfHr.exe
  2⤵
  PID:10388
- C:\Windows\System\BehwrGn.exe
  C:\Windows\System\BehwrGn.exe
  2⤵
  PID:10736
- C:\Windows\System\kLPpESX.exe
  C:\Windows\System\kLPpESX.exe
  2⤵
  PID:4852
- C:\Windows\System\egYKGGa.exe
  C:\Windows\System\egYKGGa.exe
  2⤵
  PID:10024
- C:\Windows\System\VdlLblu.exe
  C:\Windows\System\VdlLblu.exe
  2⤵
  PID:10620
- C:\Windows\System\hoOdBui.exe
  C:\Windows\System\hoOdBui.exe
  2⤵
  PID:9052
- C:\Windows\System\xacGKgZ.exe
  C:\Windows\System\xacGKgZ.exe
  2⤵
  PID:10284
- C:\Windows\System\yrzujCS.exe
  C:\Windows\System\yrzujCS.exe
  2⤵
  PID:7500
- C:\Windows\System\iQmVvue.exe
  C:\Windows\System\iQmVvue.exe
  2⤵
  PID:8540
- C:\Windows\System\iavCXnN.exe
  C:\Windows\System\iavCXnN.exe
  2⤵
  PID:9336
- C:\Windows\System\ghkPTac.exe
  C:\Windows\System\ghkPTac.exe
  2⤵
  PID:2316
- C:\Windows\System\SxPxLna.exe
  C:\Windows\System\SxPxLna.exe
  2⤵
  PID:8756
- C:\Windows\System\ImAlugr.exe
  C:\Windows\System\ImAlugr.exe
  2⤵
  PID:10972
- C:\Windows\System\KmIYRjF.exe
  C:\Windows\System\KmIYRjF.exe
  2⤵
  PID:1456
- C:\Windows\System\SbpHexW.exe
  C:\Windows\System\SbpHexW.exe
  2⤵
  PID:3112
- C:\Windows\System\ZqaVPFV.exe
  C:\Windows\System\ZqaVPFV.exe
  2⤵
  PID:11120
- C:\Windows\System\VdBnCxB.exe
  C:\Windows\System\VdBnCxB.exe
  2⤵
  PID:7380
- C:\Windows\System\eEIqZvE.exe
  C:\Windows\System\eEIqZvE.exe
  2⤵
  PID:10812
- C:\Windows\System\kapMcFu.exe
  C:\Windows\System\kapMcFu.exe
  2⤵
  PID:10420
- C:\Windows\System\cplnJBI.exe
  C:\Windows\System\cplnJBI.exe
  2⤵
  PID:8164
- C:\Windows\System\QprdtBm.exe
  C:\Windows\System\QprdtBm.exe
  2⤵
  PID:10548
- C:\Windows\System\aqTbSHQ.exe
  C:\Windows\System\aqTbSHQ.exe
  2⤵
  PID:1672
- C:\Windows\System\ZbQtsGk.exe
  C:\Windows\System\ZbQtsGk.exe
  2⤵
  PID:10612
- C:\Windows\System\QojxzOT.exe
  C:\Windows\System\QojxzOT.exe
  2⤵
  PID:11160
- C:\Windows\System\ijmEAYD.exe
  C:\Windows\System\ijmEAYD.exe
  2⤵
  PID:10640
- C:\Windows\System\NNkBtYn.exe
  C:\Windows\System\NNkBtYn.exe
  2⤵
  PID:11256
- C:\Windows\System\VmTUCpm.exe
  C:\Windows\System\VmTUCpm.exe
  2⤵
  PID:3508
- C:\Windows\System\rMydyoO.exe
  C:\Windows\System\rMydyoO.exe
  2⤵
  PID:11028
- C:\Windows\System\bcraVcD.exe
  C:\Windows\System\bcraVcD.exe
  2⤵
  PID:11248
- C:\Windows\System\HKwGEPV.exe
  C:\Windows\System\HKwGEPV.exe
  2⤵
  PID:9048
- C:\Windows\System\ZSOyWVM.exe
  C:\Windows\System\ZSOyWVM.exe
  2⤵
  PID:10696
- C:\Windows\System\pBVKcwA.exe
  C:\Windows\System\pBVKcwA.exe
  2⤵
  PID:11444
- C:\Windows\System\NylhoYM.exe
  C:\Windows\System\NylhoYM.exe
  2⤵
  PID:11468
- C:\Windows\System\vIbLONF.exe
  C:\Windows\System\vIbLONF.exe
  2⤵
  PID:10268
- C:\Windows\System\MFByCrH.exe
  C:\Windows\System\MFByCrH.exe
  2⤵
  PID:10496
- C:\Windows\System\ZNEgHvw.exe
  C:\Windows\System\ZNEgHvw.exe
  2⤵
  PID:11680
- C:\Windows\System\UZulVyw.exe
  C:\Windows\System\UZulVyw.exe
  2⤵
  PID:10948
- C:\Windows\System\mXwWPbZ.exe
  C:\Windows\System\mXwWPbZ.exe
  2⤵
  PID:8708
- C:\Windows\System\lwlwgAG.exe
  C:\Windows\System\lwlwgAG.exe
  2⤵
  PID:11888
- C:\Windows\System\JNpjRDu.exe
  C:\Windows\System\JNpjRDu.exe
  2⤵
  PID:10924
- C:\Windows\System\ZWZgzck.exe
  C:\Windows\System\ZWZgzck.exe
  2⤵
  PID:10920
- C:\Windows\System\SWuCdWm.exe
  C:\Windows\System\SWuCdWm.exe
  2⤵
  PID:12040
- C:\Windows\System\DueWUtt.exe
  C:\Windows\System\DueWUtt.exe
  2⤵
  PID:12068
- C:\Windows\System\qAeJfpF.exe
  C:\Windows\System\qAeJfpF.exe
  2⤵
  PID:9868
- C:\Windows\System\xcfWTbA.exe
  C:\Windows\System\xcfWTbA.exe
  2⤵
  PID:8228
- C:\Windows\System\MiBnlFn.exe
  C:\Windows\System\MiBnlFn.exe
  2⤵
  PID:11384
- C:\Windows\System\pupMivA.exe
  C:\Windows\System\pupMivA.exe
  2⤵
  PID:11624
- C:\Windows\System\XWMjsIe.exe
  C:\Windows\System\XWMjsIe.exe
  2⤵
  PID:11712
- C:\Windows\System\kXUdWdC.exe
  C:\Windows\System\kXUdWdC.exe
  2⤵
  PID:11360
- C:\Windows\System\FLCnyTq.exe
  C:\Windows\System\FLCnyTq.exe
  2⤵
  PID:11776
- C:\Windows\System\CcMSbYy.exe
  C:\Windows\System\CcMSbYy.exe
  2⤵
  PID:11844
- C:\Windows\System\YitgDwI.exe
  C:\Windows\System\YitgDwI.exe
  2⤵
  PID:4780
- C:\Windows\System\AnWMXgr.exe
  C:\Windows\System\AnWMXgr.exe
  2⤵
  PID:12212
- C:\Windows\System\zquQTGj.exe
  C:\Windows\System\zquQTGj.exe
  2⤵
  PID:12224
- C:\Windows\System\rYAJrJr.exe
  C:\Windows\System\rYAJrJr.exe
  2⤵
  PID:11404
- C:\Windows\System\JsQhjSD.exe
  C:\Windows\System\JsQhjSD.exe
  2⤵
  PID:2904
- C:\Windows\System\NjxidvG.exe
  C:\Windows\System\NjxidvG.exe
  2⤵
  PID:11104
- C:\Windows\System\iuEGpHj.exe
  C:\Windows\System\iuEGpHj.exe
  2⤵
  PID:12080
- C:\Windows\System\FhOPFlg.exe
  C:\Windows\System\FhOPFlg.exe
  2⤵
  PID:11796
- C:\Windows\System\JXdWIYr.exe
  C:\Windows\System\JXdWIYr.exe
  2⤵
  PID:11448
- C:\Windows\System\XmliDtN.exe
  C:\Windows\System\XmliDtN.exe
  2⤵
  PID:11388
- C:\Windows\System\SsHmjgX.exe
  C:\Windows\System\SsHmjgX.exe
  2⤵
  PID:12252
- C:\Windows\System\votCGoC.exe
  C:\Windows\System\votCGoC.exe
  2⤵
  PID:12356
- C:\Windows\System\jafUZTL.exe
  C:\Windows\System\jafUZTL.exe
  2⤵
  PID:10772
- C:\Windows\System\grisuAA.exe
  C:\Windows\System\grisuAA.exe
  2⤵
  PID:5816
- C:\Windows\System\RWfkYpl.exe
  C:\Windows\System\RWfkYpl.exe
  2⤵
  PID:11556
- C:\Windows\System\oWPOYrb.exe
  C:\Windows\System\oWPOYrb.exe
  2⤵
  PID:11504
- C:\Windows\System\QDHCMuK.exe
  C:\Windows\System\QDHCMuK.exe
  2⤵
  PID:12012
- C:\Windows\System\ghGBNvK.exe
  C:\Windows\System\ghGBNvK.exe
  2⤵
  PID:12088
- C:\Windows\System\PKbPPwZ.exe
  C:\Windows\System\PKbPPwZ.exe
  2⤵
  PID:10980
- C:\Windows\System\RGGWipG.exe
  C:\Windows\System\RGGWipG.exe
  2⤵
  PID:12840
- C:\Windows\System\EdJqNYL.exe
  C:\Windows\System\EdJqNYL.exe
  2⤵
  PID:11764
- C:\Windows\System\cQzQdWn.exe
  C:\Windows\System\cQzQdWn.exe
  2⤵
  PID:12988
- C:\Windows\System\JkFyyER.exe
  C:\Windows\System\JkFyyER.exe
  2⤵
  PID:13012
- C:\Windows\System\adcHKaZ.exe
  C:\Windows\System\adcHKaZ.exe
  2⤵
  PID:9228
- C:\Windows\System\LrVPQsH.exe
  C:\Windows\System\LrVPQsH.exe
  2⤵
  PID:12264
- C:\Windows\System\UWhhOyM.exe
  C:\Windows\System\UWhhOyM.exe
  2⤵
  PID:13144
- C:\Windows\System\lTdCIFX.exe
  C:\Windows\System\lTdCIFX.exe
  2⤵
  PID:13180
- C:\Windows\System\CBayIBO.exe
  C:\Windows\System\CBayIBO.exe
  2⤵
  PID:5320
- C:\Windows\System\vHJTDSW.exe
  C:\Windows\System\vHJTDSW.exe
  2⤵
  PID:12924
- C:\Windows\System\edZroVQ.exe
  C:\Windows\System\edZroVQ.exe
  2⤵
  PID:5884
- C:\Windows\System\XnQPvdz.exe
  C:\Windows\System\XnQPvdz.exe
  2⤵
  PID:11928
- C:\Windows\System\KfBSBUQ.exe
  C:\Windows\System\KfBSBUQ.exe
  2⤵
  PID:13048
- C:\Windows\System\xLnryKT.exe
  C:\Windows\System\xLnryKT.exe
  2⤵
  PID:13056
- C:\Windows\System\yxzqFbv.exe
  C:\Windows\System\yxzqFbv.exe
  2⤵
  PID:13124
- C:\Windows\System\TXepQUT.exe
  C:\Windows\System\TXepQUT.exe
  2⤵
  PID:13236
- C:\Windows\System\nmJgnDK.exe
  C:\Windows\System\nmJgnDK.exe
  2⤵
  PID:13256
- C:\Windows\System\jfZTmhN.exe
  C:\Windows\System\jfZTmhN.exe
  2⤵
  PID:6020
- C:\Windows\System\dRHdlpm.exe
  C:\Windows\System\dRHdlpm.exe
  2⤵
  PID:12860
- C:\Windows\System\bwIBApT.exe
  C:\Windows\System\bwIBApT.exe
  2⤵
  PID:12392
- C:\Windows\System\oHrezym.exe
  C:\Windows\System\oHrezym.exe
  2⤵
  PID:13080
- C:\Windows\System\JhczAFr.exe
  C:\Windows\System\JhczAFr.exe
  2⤵
  PID:5296
- C:\Windows\System\ivSolNP.exe
  C:\Windows\System\ivSolNP.exe
  2⤵
  PID:3236
- C:\Windows\System\Qrmegyj.exe
  C:\Windows\System\Qrmegyj.exe
  2⤵
  PID:12656
- C:\Windows\System\CTUenyw.exe
  C:\Windows\System\CTUenyw.exe
  2⤵
  PID:13356
- C:\Windows\System\paBhoXy.exe
  C:\Windows\System\paBhoXy.exe
  2⤵
  PID:5668
- C:\Windows\System\sJJDcBE.exe
  C:\Windows\System\sJJDcBE.exe
  2⤵
  PID:13564
- C:\Windows\System\eOsNpZa.exe
  C:\Windows\System\eOsNpZa.exe
  2⤵
  PID:5512
- C:\Windows\System\PgYlmcr.exe
  C:\Windows\System\PgYlmcr.exe
  2⤵
  PID:13656
- C:\Windows\System\kEfnVmK.exe
  C:\Windows\System\kEfnVmK.exe
  2⤵
  PID:13232
- C:\Windows\System\QvIgqSk.exe
  C:\Windows\System\QvIgqSk.exe
  2⤵
  PID:13764
- C:\Windows\System\qizymTu.exe
  C:\Windows\System\qizymTu.exe
  2⤵
  PID:13828
- C:\Windows\System\zIcTYmJ.exe
  C:\Windows\System\zIcTYmJ.exe
  2⤵
  PID:13960
- C:\Windows\System\lMXaPht.exe
  C:\Windows\System\lMXaPht.exe
  2⤵
  PID:13684
- C:\Windows\System\eJsxGxb.exe
  C:\Windows\System\eJsxGxb.exe
  2⤵
  PID:13016
- C:\Windows\System\MDgVsEc.exe
  C:\Windows\System\MDgVsEc.exe
  2⤵
  PID:13744
- C:\Windows\System\CKfszZG.exe
  C:\Windows\System\CKfszZG.exe
  2⤵
  PID:13816
- C:\Windows\System\qviSThE.exe
  C:\Windows\System\qviSThE.exe
  2⤵
  PID:14248
- C:\Windows\System\XfRDxGK.exe
  C:\Windows\System\XfRDxGK.exe
  2⤵
  PID:12664
- C:\Windows\System\cwThtVY.exe
  C:\Windows\System\cwThtVY.exe
  2⤵
  PID:13912
- C:\Windows\System\SjkxZMx.exe
  C:\Windows\System\SjkxZMx.exe
  2⤵
  PID:872
- C:\Windows\System\nmlwJbP.exe
  C:\Windows\System\nmlwJbP.exe
  2⤵
  PID:13348
- C:\Windows\System\WqUFtCU.exe
  C:\Windows\System\WqUFtCU.exe
  2⤵
  PID:12740
- C:\Windows\System\UyvrAXa.exe
  C:\Windows\System\UyvrAXa.exe
  2⤵
  PID:13640
- C:\Windows\System\bGMfyCx.exe
  C:\Windows\System\bGMfyCx.exe
  2⤵
  PID:13696
- C:\Windows\System\XQkBBkn.exe
  C:\Windows\System\XQkBBkn.exe
  2⤵
  PID:13332
- C:\Windows\System\yZMzppt.exe
  C:\Windows\System\yZMzppt.exe
  2⤵
  PID:12932
- C:\Windows\System\BXuEaHL.exe
  C:\Windows\System\BXuEaHL.exe
  2⤵
  PID:13756
- C:\Windows\System\OCeZPrt.exe
  C:\Windows\System\OCeZPrt.exe
  2⤵
  PID:14188
- C:\Windows\System\CEcWukc.exe
  C:\Windows\System\CEcWukc.exe
  2⤵
  PID:13888
- C:\Windows\System\wksdcIx.exe
  C:\Windows\System\wksdcIx.exe
  2⤵
  PID:13976
- C:\Windows\System\Sfdhgan.exe
  C:\Windows\System\Sfdhgan.exe
  2⤵
  PID:14212
- C:\Windows\System\RtNyRFB.exe
  C:\Windows\System\RtNyRFB.exe
  2⤵
  PID:13416
- C:\Windows\System\eATNviz.exe
  C:\Windows\System\eATNviz.exe
  2⤵
  PID:13540
- C:\Windows\System\DchXPzC.exe
  C:\Windows\System\DchXPzC.exe
  2⤵
  PID:5488
- C:\Windows\System\wrTouUj.exe
  C:\Windows\System\wrTouUj.exe
  2⤵
  PID:6556
- C:\Windows\System\VahNyyK.exe
  C:\Windows\System\VahNyyK.exe
  2⤵
  PID:6564
- C:\Windows\System\yoJfTja.exe
  C:\Windows\System\yoJfTja.exe
  2⤵
  PID:10444
- C:\Windows\System\zxaEzVb.exe
  C:\Windows\System\zxaEzVb.exe
  2⤵
  PID:9676
- C:\Windows\System\MPevrVp.exe
  C:\Windows\System\MPevrVp.exe
  2⤵
  PID:13836
- C:\Windows\System\FvZZAGT.exe
  C:\Windows\System\FvZZAGT.exe
  2⤵
  PID:13368
- C:\Windows\System\PDRxhjv.exe
  C:\Windows\System\PDRxhjv.exe
  2⤵
  PID:6972
- C:\Windows\System\PtXbbXy.exe
  C:\Windows\System\PtXbbXy.exe
  2⤵
  PID:14044
- C:\Windows\System\tLQyIKo.exe
  C:\Windows\System\tLQyIKo.exe
  2⤵
  PID:14276
- C:\Windows\System\YSQmHYJ.exe
  C:\Windows\System\YSQmHYJ.exe
  2⤵
  PID:14020
- C:\Windows\System\sagHpFC.exe
  C:\Windows\System\sagHpFC.exe
  2⤵
  PID:13920
- C:\Windows\System\ICDKBVC.exe
  C:\Windows\System\ICDKBVC.exe
  2⤵
  PID:14184
- C:\Windows\System\APiSgpR.exe
  C:\Windows\System\APiSgpR.exe
  2⤵
  PID:4080
- C:\Windows\System\EWxvjFR.exe
  C:\Windows\System\EWxvjFR.exe
  2⤵
  PID:3772
- C:\Windows\System\eyaZccP.exe
  C:\Windows\System\eyaZccP.exe
  2⤵
  PID:14012
- C:\Windows\System\tViVSpK.exe
  C:\Windows\System\tViVSpK.exe
  2⤵
  PID:2972
- C:\Windows\System\ONwUEqB.exe
  C:\Windows\System\ONwUEqB.exe
  2⤵
  PID:11244
- C:\Windows\System\btqPVcZ.exe
  C:\Windows\System\btqPVcZ.exe
  2⤵
  PID:14084
- C:\Windows\System\NtVvByc.exe
  C:\Windows\System\NtVvByc.exe
  2⤵
  PID:10784
- C:\Windows\System\adFKlbi.exe
  C:\Windows\System\adFKlbi.exe
  2⤵
  PID:11252
- C:\Windows\System\lzJMnnm.exe
  C:\Windows\System\lzJMnnm.exe
  2⤵
  PID:6424
- C:\Windows\System\LhyuWMK.exe
  C:\Windows\System\LhyuWMK.exe
  2⤵
  PID:14360
- C:\Windows\System\YuNfWrs.exe
  C:\Windows\System\YuNfWrs.exe
  2⤵
  PID:14388
- C:\Windows\System\OavhJXr.exe
  C:\Windows\System\OavhJXr.exe
  2⤵
  PID:14416
- C:\Windows\System\FLDtadU.exe
  C:\Windows\System\FLDtadU.exe
  2⤵
  PID:14444
- C:\Windows\System\yYXYRSb.exe
  C:\Windows\System\yYXYRSb.exe
  2⤵
  PID:14472
- C:\Windows\System\rRdEgzX.exe
  C:\Windows\System\rRdEgzX.exe
  2⤵
  PID:14504
- C:\Windows\System\vtWYYKx.exe
  C:\Windows\System\vtWYYKx.exe
  2⤵
  PID:14536
- C:\Windows\System\EiIeZmF.exe
  C:\Windows\System\EiIeZmF.exe
  2⤵
  PID:14556
- C:\Windows\System\DbovsFs.exe
  C:\Windows\System\DbovsFs.exe
  2⤵
  PID:14584
- C:\Windows\System\VjrmWBW.exe
  C:\Windows\System\VjrmWBW.exe
  2⤵
  PID:14612
- C:\Windows\System\AhFDunV.exe
  C:\Windows\System\AhFDunV.exe
  2⤵
  PID:14640
- C:\Windows\System\SMzZXJE.exe
  C:\Windows\System\SMzZXJE.exe
  2⤵
  PID:14668
- C:\Windows\System\lJCElYN.exe
  C:\Windows\System\lJCElYN.exe
  2⤵
  PID:14696
- C:\Windows\System\AatInHY.exe
  C:\Windows\System\AatInHY.exe
  2⤵
  PID:14724
- C:\Windows\System\wECOuxk.exe
  C:\Windows\System\wECOuxk.exe
  2⤵
  PID:14752
- C:\Windows\System\pkoQxeI.exe
  C:\Windows\System\pkoQxeI.exe
  2⤵
  PID:14792
- C:\Windows\System\pKBtSCu.exe
  C:\Windows\System\pKBtSCu.exe
  2⤵
  PID:14808
- C:\Windows\System\oMQomYX.exe
  C:\Windows\System\oMQomYX.exe
  2⤵
  PID:14840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3896,i,3409420486566309625,12100452682816721435,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4lwfmdke.53r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BRoUfpZ.exe

Filesize
2.7MB

MD5
5bb6f8513d461b9c2bf0e28aef3bc2e8

SHA1
c7f40de9cf7d57ef869d6e9dd9580d4520d2e896

SHA256
51ea381c46bf63ac045d8ccbbb03ab90e7dc36165e5992df03afeb49b8e74fcd

SHA512
1a67bc02dfac599eed754eea4f6a849f8cce2921a6e1cb8aca517378ab8702d4ddb51512e8d20a025298205ad797c8bdfdaa19011e492b4457a4224c633ad533

Download Submit
C:\Windows\System\DSDAeOK.exe

Filesize
2.7MB

MD5
2917fb52a3e6ddba3f1b3368c1172c73

SHA1
49fc8c9c03a9da30047414f0e142f9a1a06c4c66

SHA256
e77fe2909fcedc9147b62406d4aa5422cf52f972fa4e3af778eb8f4e2756cfc6

SHA512
970722caff52be8d45d8112178fb04cd529f5390b162d47460db50e21b4c279d34c6d2ca8efa76918662131998291c6ee05df29834dda5d39ed599c7d40c790c

Download Submit
C:\Windows\System\GSiNwVY.exe

Filesize
2.7MB

MD5
b181bbed2181959010faab23a92b5941

SHA1
c67caacbb2d254188c00f04ae673576297b8d7ad

SHA256
b1adb3ff4bb4b055f1abcab2587666b3a600f787e25ad5d122a3d91d31af7616

SHA512
cb93a5eaa5208ed9f6a189a59806e5da0dbacf07002d60128ec915246bf962b10ccac3db76ff24828ebbcbf27b347dc4e63edfd23300203e75b1906abd34b635

Download Submit
C:\Windows\System\HtkNDOZ.exe

Filesize
2.7MB

MD5
c2aeaf24963b9b982e77d97240dcff50

SHA1
cfee7101b97fbb1b9109425ff34b0dec427fed3b

SHA256
ebce0df059bb2dce6568d51643d7e59c17b7304e7bbe9b009648cb9893377ebd

SHA512
9a7e16cb2580db8f5a334028b6a9cb16bb5f946e02843635cefd83585aa8c5c3ed6748ac6f03d7b4852ca793d07d3edfb8b4364c95fd613cf2a7baa69992f3c4

Download Submit
C:\Windows\System\INgvRrQ.exe

Filesize
2.6MB

MD5
21fabaa63d9f99d62cf03867b23aec66

SHA1
e11e6a312000ba16dd4c309fffb503c9feab082d

SHA256
3b44c21422546f29c4281c296513f9fb6181b5197c8899376c5e3825b320ec07

SHA512
d428b39c5b3c939df20c938f9fa696f60a69c388477f285ed99672849f3a3136ace909964a9292e2e8b91bedbdb22457f932ebec6e16bed73378d2a9f6683776

Download Submit
C:\Windows\System\JFhusap.exe

Filesize
2.7MB

MD5
4b861af967f5a4d9bd6e54e4e78305b4

SHA1
966ed43b85aadff7772ee7ac846898c41add2345

SHA256
7f6073c91de7f69bc5e40180c3bea6d3dc1252689cba1f6c2c11fedb79f8c51d

SHA512
5e82d9992beb8e3a441eb5373ca2e7f80bb39e3733053c9b35bd67318f39b0fcae1160766ba98ca859d7373a0138304e35a2484df37e36fc701822f73de3e118

Download Submit
C:\Windows\System\KwxJuhz.exe

Filesize
2.7MB

MD5
5030fa8322fec1e34804a231c7027d42

SHA1
36b26bb186d752789b8e84228e4d406ae7f9e018

SHA256
216d21c203b12d35787944be38c30f21ebd0a3d00aa5a9bbf52637a102c87230

SHA512
a0192fa559ecb09a7dad9f7e2fea65808bfa98248b0da0b18a4e7598530b2121a22bcbe9a85c50c3d66145f829f53e1429cb8db7f71b633a2f78471ada00a3e7

Download Submit
C:\Windows\System\MvncWVx.exe

Filesize
2.7MB

MD5
c7c17b26960c85436c2de66c95f186ea

SHA1
15f6282ddc923edf3db5297148c897162e549fe9

SHA256
ef16d7c1c15f4496b713ea59724098c35c044ac6d839d948df48c5e02b6cb576

SHA512
ce54ddace257aa7f20b7a32ead07667275031246ad357de0895ded3061aa52a8c51dc1fb9e84a07fac189c1101027d769dff745590f832e2d707c2e4801fc9f3

Download Submit
C:\Windows\System\NCIHduK.exe

Filesize
2.7MB

MD5
795c2921ebdfd53613329c3105cf200d

SHA1
6aec7e989f2822a7610924d7fc308275f3edb23a

SHA256
c01e284034e6e51b7cd47cbf95de3e7afb7e66b871a44f54093db31263f7da85

SHA512
71e53e2ab92473e83bfebfec8db69c32f0576cd129cbd830bc1eba454891f951678ea137202d1f1ea5426ccd51fd2e1125fde9ae70ef9bf9fdf95d302c7151f5

Download Submit
C:\Windows\System\PeGumxH.exe

Filesize
2.7MB

MD5
bf3c787d8befb7258a132115b2e15185

SHA1
032fcb179fb64aeb4bc9df2eb3c8f125ab747173

SHA256
e2ccf1df9e71c1116d8ec36004ebe871a366a3560be54bfad04fae676e6c8656

SHA512
cbdb8e34ba66d151d94cfe393dd29efb1a01f341f9b9ebf2bc3ab006eec22e9995e743bb1989da9b47bb3f21e2a2323b4133b4119650a20d139219eff7575699

Download Submit
C:\Windows\System\PndbTqc.exe

Filesize
2.6MB

MD5
535d74614c5fd41bebe6bfbd96a66b6d

SHA1
1e9ba7e4187d169e2d6ba0304a1d74d427cadc8c

SHA256
ea45db7fff826158b442d02ada7b7ad5395395db1d9df2dca12ab1c1c6995922

SHA512
cdce5af2094e2739d7cb203237143bd1274ce05a7032be6633d4245ef26ba57acc7c274e58abb48651a8f0206ee98c1a7a9754e7ad7edf0b24ae42080641218e

Download Submit
C:\Windows\System\RLnCVoR.exe

Filesize
2.7MB

MD5
5fb20544de7903c40517fa4e0f522b0e

SHA1
926e4489c01e23c48abd5edd0bb178a40066cbc7

SHA256
abc45f8b803091217c7b83fd4bc1d3b26d1f1279770d1c60a8c11140942c336e

SHA512
719a7f8d8b27114b49f485ee5c3f34ae8887d389858aea638da857f36e30c773650bcb787b76f5daa5d59e1a14d494f1e7ad9c8c57df41e1e2275d82760d9c46

Download Submit
C:\Windows\System\TbxiuMc.exe

Filesize
2.7MB

MD5
1fbfe9a0a7804d5d8b50325c3c37173a

SHA1
92aa2dd5efd62ab872334c8d1eb89784e3a3b62e

SHA256
47f9c7585d3aae76eff8ecddee98ff7305877b73e74446351222c540ddfa3ccf

SHA512
f24c3eccd41f042df5482c06f0e40f7c7fc75e35af1247bd806c442567d7e5f662e0e4d16bea0faf0cc02f355c2d03c6b047a68b835ee61e0452a96c481b9a64

Download Submit
C:\Windows\System\WbzOiGs.exe

Filesize
2.7MB

MD5
f8ae43bb763c8d906f767bcfd5d81517

SHA1
6cb06efc6a250aef4594938719b67d8d580fb186

SHA256
6302fef99e12ade9255d845322b5869080b0daec341d50d2ea69c96e00620e23

SHA512
ae3b640d703de9b5d6e9729dcb6b823532c9d0fa507f57041dc88779aade8125684f8cca6835979d74f6d60a618f2f4e0193d4931995da6899cd31159921ce73

Download Submit
C:\Windows\System\WzYFKuT.exe

Filesize
2.7MB

MD5
04d2baa25af5e13d0d35b5885fcbc9a4

SHA1
356a7cbf6ca75d09ed8cfc05536c8bbd74844def

SHA256
e8dca40391747b874642c3fb6928ad5b07ef84b5c65b2fd84cd842b2f8270fae

SHA512
8051baefa39afd40c72ddbf0b121f3327c50d7e27e665fc6226e486d3339079d94219715f8f060bbbf6ea322fc5ccada9da0f2a0b8b8d24c7e7dc388c40b0803

Download Submit
C:\Windows\System\XwQFkna.exe

Filesize
2.6MB

MD5
82f23cb2da289d633888bb38add55460

SHA1
9de3a8707467d9fd4c3e1ac034389d4df2224ad6

SHA256
b86a8457cc0dbe7cb36b4417b1c45814599d63bfa3cc6f6bd7aa49863f58dc81

SHA512
92e8adaf4d5f05dfb2d74ab7676db0fc55cfc681a04c4f567cbb9fc15249f9bff1e4abf621f0b852a61cc5c13c2b21da77547764977b95bfe15c3ea1cbb342b2

Download Submit
C:\Windows\System\YpsZgMz.exe

Filesize
2.7MB

MD5
2db1e046301566732e00a4463d1f4735

SHA1
82ef15e462757115b3c0cdc54c0003e44ef8187b

SHA256
cbb7ae5780bc552e87d84c2f8abcbc732bd8e930d251971cc03f3a8620174b7f

SHA512
12c892501083763afbe5484a6c7f3da9ecc9aa738cdce1dc832a09c7bad4a492c6ea7c4c58db400e77583c5c4c92c21606d7353c4f35ce5af81c518e69af5dbd

Download Submit
C:\Windows\System\YytHwkQ.exe

Filesize
2.7MB

MD5
4480906e9ff9faa4e4c9f0ca1fd01068

SHA1
c9fa13c7eec11fe6316b997e52fdd3012e2314b6

SHA256
9abb14f637bd88030934b7bee3bd25153b882cc78bea0da0004f94cf110ed65d

SHA512
4c44bc4401494bce6603a0c0468ad6aba95538edea5e10ba1bd16c55ae459e557b49f400a49914369a6194a6ea84ce26bb27cff3795478df1127b3c826a6ef2c

Download Submit
C:\Windows\System\arvilhM.exe

Filesize
2.7MB

MD5
c3e7315079700109546037ae33cdc5ae

SHA1
41e1e33536fb462b4572a5d85aabd1d2b401457a

SHA256
b13332485967d94eb15a3aea43f9c8c3993e9cfd8326a916a2125e9b8464e559

SHA512
06069552fc91023b4893070957120aeec71e9272e6a257fe7f3f52949e7e712cc10f55dc7b5d1c98da2f6f9d7e08a8ae194a18395fc8c3cd8180c6d2db816302

Download Submit
C:\Windows\System\cBPRdGC.exe

Filesize
8B

MD5
1181c19b6f9434329a40dd0a535daee0

SHA1
26029ec68dca8a8a29e1d6ce6c487811fa0de291

SHA256
05b9a08193b4ea145f31142a43bd5b86480af7a75389332110dd903c69bc0353

SHA512
91fe78427503c5a87c606c290ff2d7fd74e13234c84499e07e9c2b9b351d779897358ea7d530fc9170467c79cab04ab2fafcafc7b5a7194e0d4ae8a2d60d56a3

Download Submit
C:\Windows\System\caWuucP.exe

Filesize
2.7MB

MD5
28938ca9e6f42a503199169498bf6184

SHA1
f9bdd0912e9d8e96d4a73e8821e0ec09c221148d

SHA256
4caa9dd069fd2a83650ec0188fe889d72945fe8a8720519bfb15e54a50b57fac

SHA512
1b9e83b9f0334219e09fd163804c8f00cb95ced0829c98139777fd4fcdb0673c81e551bf46c2d0ee15c1a5e88883fc5c8d8ae09841df312f67a1418b94d4f10e

Download Submit
C:\Windows\System\hOfibAs.exe

Filesize
2.7MB

MD5
c3c08e038c4a749d1028339593219f87

SHA1
b7df5388ee9d51d2d12aad4daeccb29e4fc108a8

SHA256
7986109999bf501d9fa337ba050faa8f2e0327bc684414423f423b32c0840511

SHA512
1ce8cd96b05289fb6f9bbed67162797c18ad515a21b627087595479b185945527bc9622115767412480b390c74aa5986f7f1295716571a906cbcea2677a1ca80

Download Submit
C:\Windows\System\hfPtmdx.exe

Filesize
2.6MB

MD5
0e4e3fb51bda6e83a5b85182cc16f58b

SHA1
899852461a09693e9c0b92d1acad270f692e2dfb

SHA256
af3bfd273989cc6a130df60484a61698ec8ef7b290ce58d72c99919506472216

SHA512
7efbed9be8fd35e86b6af5ab87a3d9dbd852a5687feddcc3fc6c4f76d08fc948492e9307e27273bf4e3fba4e3e5a4539e9b390de066df91b3dd22e2fec15cfb7

Download Submit
C:\Windows\System\jDOMxxI.exe

Filesize
2.7MB

MD5
5cc5df3f04cd5e24293ab695addd0fbd

SHA1
7aeea746f21865878cb40d83ef765b34cfac8393

SHA256
2c524ea7ab877fbc3b2e9bf2f2fa45b29e48b6247fb98cfd25f0a07413872368

SHA512
3e0531bec298d7c3bbb6042a14a335a0107d0e99e4dc32c6cd65582bddaec5546d4b79b7518bbfd90181ddd962af8c688e01b556b6e996df5d1351fa0fb272ba

Download Submit
C:\Windows\System\kEHtCpV.exe

Filesize
2.6MB

MD5
8542e2a9c9c2b06db4438ffd92ea9324

SHA1
430d466c757465ddf08dd8e59f8abae86afd8c8a

SHA256
8f47a95ee6cd1e7eaea5f2047ebc24bc704f43159e625973d86f302b41f94cff

SHA512
19b2a3bcb7c2baf922dcf6a9fa463acd2298dd9e915ae10e4eb91216f2a4f52c1313cac1614686c7bdf728f342e70cbd837f599bc8f4f1db9470bca9ba9cd934

Download Submit
C:\Windows\System\kFCAtsp.exe

Filesize
2.7MB

MD5
7ffd246a3fec0b21c7104e8ddc90904f

SHA1
2abed7ae48b49c8f0089a4a6fe810c0cf60c8f16

SHA256
370e2c2704597c0b36ad369f918e8533398f17388d2b8619986e225e49109352

SHA512
ceb1004f8028966fa39308588c875acb0f44f441914d9d7e152b4e758155f76564fccfce2ec6b21f226ddf3c7eeb72a090b3fd8cbacd2a4c1a26b81892bb7cde

Download Submit
C:\Windows\System\mZnryWq.exe

Filesize
2.6MB

MD5
89109ea11ab2be0230bb50a0bc1d558e

SHA1
e6e1fa55197955304a997606a5f0d385657996d7

SHA256
bbda10552ff9a6241ef10bf50e7cd3e285cab0213c479d60e752d006f0fca9ba

SHA512
64af439d419fc1562e4d471810f96c893fd4a5338851c6f3a6b9a4c7887db04776200e11505dea7f53a3dc3c0e42d7f2dfa98c8b3acc75c5bb91bbfb26dc98ca

Download Submit
C:\Windows\System\mntpkek.exe

Filesize
2.7MB

MD5
bf15a7f09c66849ece0d1407dab77e4d

SHA1
e948fba9d2152c4803a5a773dc1c7dc8087d63dd

SHA256
a87ac668026edf08d47508da92a5922cbe10baf0618d658fd9e8d6ee8305489e

SHA512
d833f7ded94e14268ee739f15e0edc5bb85e14b22f8a0c7ebf6ff03276eaec4f63fde9f83b971342e1f66c1552ed7c306838f37142caff7565a4f6d6a964c3b8

Download Submit
C:\Windows\System\oZjtHzA.exe

Filesize
2.7MB

MD5
18b0ffb00e1e5fff6d1ebbc27eb0dc0f

SHA1
1a3ce6be7e713778172889f3983e7c6c6c5d5302

SHA256
a000a2329055cc9eb4af8f7d158d570e74791e0d28b0218c7ffabb12f9536497

SHA512
dcb607a0a39c96e65083eb2c352ef36c5a1bb6ee58ef8f7b097fff1c1504e5d97a5ba8a599faddf1a84bd655314294fa4dfce130fc9df98a25e0dff4bcefdbdc

Download Submit
C:\Windows\System\uJhNDHP.exe

Filesize
2.6MB

MD5
e3eed5f2a3943ae038120fd99a782f04

SHA1
775977070d8bc19e34271d0affd952b8fbb3b195

SHA256
d940cbea210c4acd2ebdb33abae4d1756f56b5296eed4d1e1849b4ad37cdb9df

SHA512
35005cd4d7775d5273dcd9975a8ba5933e594c0b91d7e84e51c8c7c353ecfec7ac4c7e3e56a959de552bacd5077d7c3d443f42a13c839a491043e6c2c7c96291

Download Submit
C:\Windows\System\wvspnSW.exe

Filesize
2.6MB

MD5
9d6d1662f5b0da0fb8032aaa9569679b

SHA1
c4fe2bb977bb0a1e3fbf808be87eb244278dd45e

SHA256
11243e0472fc7cffa097b652a2955810aa28f6d604e93530c514ce05470817bf

SHA512
9ecac203c4b031ced23114c800d2fc067abb60e9cd7bd97462f442632b5bc9b949774afcd22065a04d9681d24adb638678ba684e0ee297b53e19b0dd88a42f2a

Download Submit
C:\Windows\System\xwTYgcF.exe

Filesize
2.7MB

MD5
8ffee7a7518f8f0bf068c2247cdda506

SHA1
8eb1e2e9c991c90275ea0dc977e8c67083a3aec9

SHA256
00c2f9eb4d0177120823f8396efd1ee4e32da154149bb58f5830fb0c59935443

SHA512
f649d50e70d5d278c82ab8e0eb7e7dbafc64bf8fac428193539be1481a6d54cf12ea202d9c995ebd0a7ba3f4cdc8c067806c912c39ece05e0a3f812a172fc4a6

Download Submit
C:\Windows\System\yEOtNHH.exe

Filesize
2.6MB

MD5
5a081a1d4092f15f9e136d426cdaabe5

SHA1
8c8927a25c2816141b8e636530f5a44af4334500

SHA256
a1329c46ec477fde59faddf21878d3e418801363b9f4266c6facebc24927b9f1

SHA512
f43850354d785f5f27bb2adc50f6c9b99888eac9ff2e629957278f973ade16b0a7d17fbe0f3cd87d0731de315c5038c2378a35408a441b65cb80574ea6f75d74

Download Submit
memory/656-192-0x00007FF7F14D0000-0x00007FF7F18C6000-memory.dmp

Filesize
4.0MB

Download
memory/656-806-0x00007FF7F14D0000-0x00007FF7F18C6000-memory.dmp

Filesize
4.0MB

Download
memory/760-729-0x00007FF6570A0000-0x00007FF657496000-memory.dmp

Filesize
4.0MB

Download
memory/760-98-0x00007FF6570A0000-0x00007FF657496000-memory.dmp

Filesize
4.0MB

Download
memory/1060-167-0x00007FF69D120000-0x00007FF69D516000-memory.dmp

Filesize
4.0MB

Download
memory/1060-769-0x00007FF69D120000-0x00007FF69D516000-memory.dmp

Filesize
4.0MB

Download
memory/1104-183-0x00007FF6561B0000-0x00007FF6565A6000-memory.dmp

Filesize
4.0MB

Download
memory/1104-798-0x00007FF6561B0000-0x00007FF6565A6000-memory.dmp

Filesize
4.0MB

Download
memory/1452-148-0x00007FF6B9060000-0x00007FF6B9456000-memory.dmp

Filesize
4.0MB

Download
memory/1452-762-0x00007FF6B9060000-0x00007FF6B9456000-memory.dmp

Filesize
4.0MB

Download
memory/1828-756-0x00007FF657C70000-0x00007FF658066000-memory.dmp

Filesize
4.0MB

Download
memory/1828-122-0x00007FF657C70000-0x00007FF658066000-memory.dmp

Filesize
4.0MB

Download
memory/1872-809-0x00007FF7FEEB0000-0x00007FF7FF2A6000-memory.dmp

Filesize
4.0MB

Download
memory/1872-193-0x00007FF7FEEB0000-0x00007FF7FF2A6000-memory.dmp

Filesize
4.0MB

Download
memory/2008-814-0x00007FF7F71D0000-0x00007FF7F75C6000-memory.dmp

Filesize
4.0MB

Download
memory/2008-188-0x00007FF7F71D0000-0x00007FF7F75C6000-memory.dmp

Filesize
4.0MB

Download
memory/2028-773-0x00007FF7207B0000-0x00007FF720BA6000-memory.dmp

Filesize
4.0MB

Download
memory/2028-180-0x00007FF7207B0000-0x00007FF720BA6000-memory.dmp

Filesize
4.0MB

Download
memory/2356-745-0x00007FF705DD0000-0x00007FF7061C6000-memory.dmp

Filesize
4.0MB

Download
memory/2356-101-0x00007FF705DD0000-0x00007FF7061C6000-memory.dmp

Filesize
4.0MB

Download
memory/2584-194-0x00007FF6E3BF0000-0x00007FF6E3FE6000-memory.dmp

Filesize
4.0MB

Download
memory/2584-807-0x00007FF6E3BF0000-0x00007FF6E3FE6000-memory.dmp

Filesize
4.0MB

Download
memory/2856-812-0x00007FF6D0A20000-0x00007FF6D0E16000-memory.dmp

Filesize
4.0MB

Download
memory/2856-191-0x00007FF6D0A20000-0x00007FF6D0E16000-memory.dmp

Filesize
4.0MB

Download
memory/3044-805-0x00007FF7D4910000-0x00007FF7D4D06000-memory.dmp

Filesize
4.0MB

Download
memory/3044-190-0x00007FF7D4910000-0x00007FF7D4D06000-memory.dmp

Filesize
4.0MB

Download
memory/3288-14-0x00007FF713F80000-0x00007FF714376000-memory.dmp

Filesize
4.0MB

Download
memory/3288-710-0x00007FF713F80000-0x00007FF714376000-memory.dmp

Filesize
4.0MB

Download
memory/3528-115-0x00007FF7B26C0000-0x00007FF7B2AB6000-memory.dmp

Filesize
4.0MB

Download
memory/3528-753-0x00007FF7B26C0000-0x00007FF7B2AB6000-memory.dmp

Filesize
4.0MB

Download
memory/3604-777-0x00007FF627DA0000-0x00007FF628196000-memory.dmp

Filesize
4.0MB

Download
memory/3604-181-0x00007FF627DA0000-0x00007FF628196000-memory.dmp

Filesize
4.0MB

Download
memory/3612-804-0x00007FF77B190000-0x00007FF77B586000-memory.dmp

Filesize
4.0MB

Download
memory/3612-184-0x00007FF77B190000-0x00007FF77B586000-memory.dmp

Filesize
4.0MB

Download
memory/3716-17-0x00007FF6D5990000-0x00007FF6D5D86000-memory.dmp

Filesize
4.0MB

Download
memory/3716-717-0x00007FF6D5990000-0x00007FF6D5D86000-memory.dmp

Filesize
4.0MB

Download
memory/3740-802-0x00007FF7BFEC0000-0x00007FF7C02B6000-memory.dmp

Filesize
4.0MB

Download
memory/3740-185-0x00007FF7BFEC0000-0x00007FF7C02B6000-memory.dmp

Filesize
4.0MB

Download
memory/4244-704-0x00007FF7E5E40000-0x00007FF7E6236000-memory.dmp

Filesize
4.0MB

Download
memory/4244-11-0x00007FF7E5E40000-0x00007FF7E6236000-memory.dmp

Filesize
4.0MB

Download
memory/4484-187-0x00007FF77DFE0000-0x00007FF77E3D6000-memory.dmp

Filesize
4.0MB

Download
memory/4484-803-0x00007FF77DFE0000-0x00007FF77E3D6000-memory.dmp

Filesize
4.0MB

Download
memory/4568-0-0x00007FF7A9C10000-0x00007FF7AA006000-memory.dmp

Filesize
4.0MB

Download
memory/4568-1210-0x00007FF7A9C10000-0x00007FF7AA006000-memory.dmp

Filesize
4.0MB

Download
memory/4568-1-0x0000022B70870000-0x0000022B70880000-memory.dmp

Filesize
64KB

Download
memory/4648-186-0x00007FF7F0CF0000-0x00007FF7F10E6000-memory.dmp

Filesize
4.0MB

Download
memory/4648-808-0x00007FF7F0CF0000-0x00007FF7F10E6000-memory.dmp

Filesize
4.0MB

Download
memory/4796-761-0x00007FF7F8A10000-0x00007FF7F8E06000-memory.dmp

Filesize
4.0MB

Download
memory/4796-138-0x00007FF7F8A10000-0x00007FF7F8E06000-memory.dmp

Filesize
4.0MB

Download
memory/4808-790-0x00007FF6AFB10000-0x00007FF6AFF06000-memory.dmp

Filesize
4.0MB

Download
memory/4808-182-0x00007FF6AFB10000-0x00007FF6AFF06000-memory.dmp

Filesize
4.0MB

Download
memory/4816-87-0x00007FFE9ACB0000-0x00007FFE9B771000-memory.dmp

Filesize
10.8MB

Download
memory/4816-189-0x00007FFE9ACB0000-0x00007FFE9B771000-memory.dmp

Filesize
10.8MB

Download
memory/4816-195-0x000002A571340000-0x000002A571AE6000-memory.dmp

Filesize
7.6MB

Download
memory/4816-21-0x00007FFE9ACB3000-0x00007FFE9ACB5000-memory.dmp

Filesize
8KB

Download
memory/4816-1690-0x00007FFE9ACB0000-0x00007FFE9B771000-memory.dmp

Filesize
10.8MB

Download
memory/4816-1909-0x00007FFE9ACB3000-0x00007FFE9ACB5000-memory.dmp

Filesize
8KB

Download
memory/4816-28-0x000002A56E600000-0x000002A56E622000-memory.dmp

Filesize
136KB

Download