xmrig | 946e3588a2a11d6ec63caef9779c56f9891bcc672a3c29ac0d9c844df5c4e9c6

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4fcd911bfb553bf3495c3ef39671dc0N.exe
Size

1.9MB
MD5

b4fcd911bfb553bf3495c3ef39671dc0
SHA1

a9c93a4aaf1f2b2b38013591d796e89b8717ae4b
SHA256

946e3588a2a11d6ec63caef9779c56f9891bcc672a3c29ac0d9c844df5c4e9c6
SHA512

eb19bf5fba41571b4c68913611fb42e4318ef17295ac916ae1f92cd8a3d96ed154b2429f9cb0579130c8a6dffbdc148f7d2685673a33d1d18fbf1f5a4fdeec4f
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjFkTVnfuDPFFWqreoYtgWqabE1y14dMPV:Lz071uv4BPMkHC0IEFTo/abRcN91M+8

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/3468-287-0x00007FF600870000-0x00007FF600C62000-memory.dmp	xmrig
behavioral2/memory/2132-320-0x00007FF7743A0000-0x00007FF774792000-memory.dmp	xmrig
behavioral2/memory/4928-341-0x00007FF716BB0000-0x00007FF716FA2000-memory.dmp	xmrig
behavioral2/memory/5000-346-0x00007FF75AEE0000-0x00007FF75B2D2000-memory.dmp	xmrig
behavioral2/memory/644-351-0x00007FF606020000-0x00007FF606412000-memory.dmp	xmrig
behavioral2/memory/2868-470-0x00007FF6AE000000-0x00007FF6AE3F2000-memory.dmp	xmrig
behavioral2/memory/940-511-0x00007FF61A060000-0x00007FF61A452000-memory.dmp	xmrig
behavioral2/memory/3908-421-0x00007FF624BF0000-0x00007FF624FE2000-memory.dmp	xmrig
behavioral2/memory/3848-353-0x00007FF6949B0000-0x00007FF694DA2000-memory.dmp	xmrig
behavioral2/memory/4244-352-0x00007FF7A2B80000-0x00007FF7A2F72000-memory.dmp	xmrig
behavioral2/memory/3636-350-0x00007FF7752A0000-0x00007FF775692000-memory.dmp	xmrig
behavioral2/memory/4616-349-0x00007FF72D0B0000-0x00007FF72D4A2000-memory.dmp	xmrig
behavioral2/memory/4988-348-0x00007FF7A2F20000-0x00007FF7A3312000-memory.dmp	xmrig
behavioral2/memory/3152-347-0x00007FF62B410000-0x00007FF62B802000-memory.dmp	xmrig
behavioral2/memory/4448-345-0x00007FF6D2D30000-0x00007FF6D3122000-memory.dmp	xmrig
behavioral2/memory/1288-344-0x00007FF729680000-0x00007FF729A72000-memory.dmp	xmrig
behavioral2/memory/376-343-0x00007FF70B810000-0x00007FF70BC02000-memory.dmp	xmrig
behavioral2/memory/2944-342-0x00007FF758AC0000-0x00007FF758EB2000-memory.dmp	xmrig
behavioral2/memory/3428-226-0x00007FF785400000-0x00007FF7857F2000-memory.dmp	xmrig
behavioral2/memory/2124-220-0x00007FF730710000-0x00007FF730B02000-memory.dmp	xmrig
behavioral2/memory/656-75-0x00007FF6925C0000-0x00007FF6929B2000-memory.dmp	xmrig
behavioral2/memory/3908-3324-0x00007FF624BF0000-0x00007FF624FE2000-memory.dmp	xmrig
behavioral2/memory/3428-3335-0x00007FF785400000-0x00007FF7857F2000-memory.dmp	xmrig
behavioral2/memory/2868-3338-0x00007FF6AE000000-0x00007FF6AE3F2000-memory.dmp	xmrig
behavioral2/memory/1916-3360-0x00007FF7C2B90000-0x00007FF7C2F82000-memory.dmp	xmrig
behavioral2/memory/5044-3368-0x00007FF764A00000-0x00007FF764DF2000-memory.dmp	xmrig
behavioral2/memory/1288-3364-0x00007FF729680000-0x00007FF729A72000-memory.dmp	xmrig
behavioral2/memory/3468-3356-0x00007FF600870000-0x00007FF600C62000-memory.dmp	xmrig
behavioral2/memory/2132-3350-0x00007FF7743A0000-0x00007FF774792000-memory.dmp	xmrig
behavioral2/memory/2124-3348-0x00007FF730710000-0x00007FF730B02000-memory.dmp	xmrig
behavioral2/memory/2944-3384-0x00007FF758AC0000-0x00007FF758EB2000-memory.dmp	xmrig
behavioral2/memory/3636-3421-0x00007FF7752A0000-0x00007FF775692000-memory.dmp	xmrig
behavioral2/memory/4244-3432-0x00007FF7A2B80000-0x00007FF7A2F72000-memory.dmp	xmrig
behavioral2/memory/644-3426-0x00007FF606020000-0x00007FF606412000-memory.dmp	xmrig
behavioral2/memory/940-3410-0x00007FF61A060000-0x00007FF61A452000-memory.dmp	xmrig
behavioral2/memory/4616-3402-0x00007FF72D0B0000-0x00007FF72D4A2000-memory.dmp	xmrig
behavioral2/memory/5000-3398-0x00007FF75AEE0000-0x00007FF75B2D2000-memory.dmp	xmrig
behavioral2/memory/4988-3394-0x00007FF7A2F20000-0x00007FF7A3312000-memory.dmp	xmrig
behavioral2/memory/4928-3381-0x00007FF716BB0000-0x00007FF716FA2000-memory.dmp	xmrig
behavioral2/memory/376-3378-0x00007FF70B810000-0x00007FF70BC02000-memory.dmp	xmrig
behavioral2/memory/3152-3377-0x00007FF62B410000-0x00007FF62B802000-memory.dmp	xmrig
behavioral2/memory/4448-3373-0x00007FF6D2D30000-0x00007FF6D3122000-memory.dmp	xmrig
behavioral2/memory/656-3328-0x00007FF6925C0000-0x00007FF6929B2000-memory.dmp	xmrig
behavioral2/memory/3804-4720-0x00007FF608320000-0x00007FF608712000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	2672	powershell.exe
11	2672	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2672	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2720	IuIoKYv.exe
3848	ERNEsij.exe
1916	QZvRdvS.exe
5044	WeXYQTu.exe
3908	kVTZCtg.exe
656	TDFEtAh.exe
2124	TUdykcf.exe
3428	pReirDe.exe
2868	EtFibqF.exe
3468	cJHxUgk.exe
2132	khwJAEn.exe
4928	RwxhuOu.exe
2944	iFMLKfJ.exe
376	athjyVL.exe
940	obUNQFm.exe
1288	ohOYcgR.exe
4448	LDMTvIo.exe
5000	vqRZEkd.exe
3152	tajPlfc.exe
4988	HRVqEIu.exe
4616	fatRjZi.exe
3636	eKWOCiU.exe
644	KTUKOxS.exe
4244	yHBXvYO.exe
4352	PXMVHLT.exe
4168	ueILAoF.exe
2304	PseSOxd.exe
2860	GefaAtE.exe
3984	rLhbbbB.exe
3540	ZbkNEmh.exe
1940	WvRLLPv.exe
2912	jscjumC.exe
4612	gcpNTni.exe
1356	xBXtFEx.exe
2820	ZtUbJWB.exe
3092	yAOeZQW.exe
2864	TPfVJdK.exe
1368	yaWmUHg.exe
1384	RHjSkAk.exe
3400	gjVqiPC.exe
4572	ntmsyTe.exe
4436	svvMPDW.exe
2832	qLwktCS.exe
1856	wXTlVpp.exe
1996	RqpLRbn.exe
4432	sfXDpnw.exe
3528	XyWckSj.exe
4996	JxZoxhH.exe
3680	oibtaUv.exe
3708	bLHpofH.exe
2500	GIyuKIT.exe
1140	yxtJdgH.exe
3656	cgVJeoE.exe
3888	CCnleav.exe
1152	tuvKohg.exe
2076	vZFSxJu.exe
2468	eUQsSCj.exe
4348	jCPtxMl.exe
4912	mkgEipa.exe
4924	cPozkmt.exe
5004	slfKlAm.exe
3616	tFgACAr.exe
1884	SXMulpJ.exe
4628	SbjMChr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3804-0-0x00007FF608320000-0x00007FF608712000-memory.dmp	upx
behavioral2/files/0x00070000000234ae-7.dat	upx
behavioral2/files/0x00070000000234b4-53.dat	upx
behavioral2/files/0x00070000000234b5-77.dat	upx
behavioral2/files/0x00070000000234c0-95.dat	upx
behavioral2/files/0x00070000000234ba-143.dat	upx
behavioral2/files/0x00070000000234c5-158.dat	upx
behavioral2/files/0x00070000000234c3-177.dat	upx
behavioral2/memory/3468-287-0x00007FF600870000-0x00007FF600C62000-memory.dmp	upx
behavioral2/memory/2132-320-0x00007FF7743A0000-0x00007FF774792000-memory.dmp	upx
behavioral2/memory/4928-341-0x00007FF716BB0000-0x00007FF716FA2000-memory.dmp	upx
behavioral2/memory/5000-346-0x00007FF75AEE0000-0x00007FF75B2D2000-memory.dmp	upx
behavioral2/memory/644-351-0x00007FF606020000-0x00007FF606412000-memory.dmp	upx
behavioral2/memory/2868-470-0x00007FF6AE000000-0x00007FF6AE3F2000-memory.dmp	upx
behavioral2/memory/940-511-0x00007FF61A060000-0x00007FF61A452000-memory.dmp	upx
behavioral2/memory/3908-421-0x00007FF624BF0000-0x00007FF624FE2000-memory.dmp	upx
behavioral2/memory/3848-353-0x00007FF6949B0000-0x00007FF694DA2000-memory.dmp	upx
behavioral2/memory/4244-352-0x00007FF7A2B80000-0x00007FF7A2F72000-memory.dmp	upx
behavioral2/memory/3636-350-0x00007FF7752A0000-0x00007FF775692000-memory.dmp	upx
behavioral2/memory/4616-349-0x00007FF72D0B0000-0x00007FF72D4A2000-memory.dmp	upx
behavioral2/memory/4988-348-0x00007FF7A2F20000-0x00007FF7A3312000-memory.dmp	upx
behavioral2/memory/3152-347-0x00007FF62B410000-0x00007FF62B802000-memory.dmp	upx
behavioral2/memory/4448-345-0x00007FF6D2D30000-0x00007FF6D3122000-memory.dmp	upx
behavioral2/memory/1288-344-0x00007FF729680000-0x00007FF729A72000-memory.dmp	upx
behavioral2/memory/376-343-0x00007FF70B810000-0x00007FF70BC02000-memory.dmp	upx
behavioral2/memory/2944-342-0x00007FF758AC0000-0x00007FF758EB2000-memory.dmp	upx
behavioral2/memory/3428-226-0x00007FF785400000-0x00007FF7857F2000-memory.dmp	upx
behavioral2/memory/2124-220-0x00007FF730710000-0x00007FF730B02000-memory.dmp	upx
behavioral2/files/0x00070000000234c8-187.dat	upx
behavioral2/files/0x00070000000234c6-184.dat	upx
behavioral2/files/0x00080000000234aa-172.dat	upx
behavioral2/files/0x00070000000234c2-162.dat	upx
behavioral2/files/0x00070000000234c1-160.dat	upx
behavioral2/files/0x00070000000234cd-155.dat	upx
behavioral2/files/0x00070000000234cb-153.dat	upx
behavioral2/files/0x00070000000234ca-152.dat	upx
behavioral2/files/0x00070000000234c9-151.dat	upx
behavioral2/files/0x00070000000234c7-149.dat	upx
behavioral2/files/0x00070000000234c4-145.dat	upx
behavioral2/files/0x00070000000234bf-133.dat	upx
behavioral2/files/0x00070000000234be-127.dat	upx
behavioral2/files/0x00070000000234b9-123.dat	upx
behavioral2/files/0x00070000000234b7-119.dat	upx
behavioral2/files/0x00070000000234b8-116.dat	upx
behavioral2/files/0x00070000000234bd-110.dat	upx
behavioral2/files/0x00070000000234cc-154.dat	upx
behavioral2/files/0x00070000000234bc-87.dat	upx
behavioral2/files/0x00070000000234bb-86.dat	upx
behavioral2/memory/656-75-0x00007FF6925C0000-0x00007FF6929B2000-memory.dmp	upx
behavioral2/files/0x00070000000234b6-65.dat	upx
behavioral2/files/0x00070000000234b2-64.dat	upx
behavioral2/files/0x00070000000234af-61.dat	upx
behavioral2/memory/5044-49-0x00007FF764A00000-0x00007FF764DF2000-memory.dmp	upx
behavioral2/files/0x00070000000234b3-43.dat	upx
behavioral2/files/0x00070000000234b1-38.dat	upx
behavioral2/files/0x00070000000234b0-30.dat	upx
behavioral2/files/0x00080000000234ac-15.dat	upx
behavioral2/memory/1916-26-0x00007FF7C2B90000-0x00007FF7C2F82000-memory.dmp	upx
behavioral2/memory/2720-13-0x00007FF70ED30000-0x00007FF70F122000-memory.dmp	upx
behavioral2/files/0x00070000000234ad-12.dat	upx
behavioral2/memory/3908-3324-0x00007FF624BF0000-0x00007FF624FE2000-memory.dmp	upx
behavioral2/memory/3428-3335-0x00007FF785400000-0x00007FF7857F2000-memory.dmp	upx
behavioral2/memory/2868-3338-0x00007FF6AE000000-0x00007FF6AE3F2000-memory.dmp	upx
behavioral2/memory/1916-3360-0x00007FF7C2B90000-0x00007FF7C2F82000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HgpTbyk.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\EqercoM.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\qLwktCS.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\sAbWOOp.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\hDAAVNr.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\MbJqIgi.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\YSelHZs.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\SMxmgPx.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\ExrtBVE.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\QHFLRGn.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\CZkvTqd.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\XzNWzCL.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\nOqNtPt.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\wrlmAFG.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\vfYjAfZ.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\DYPjOUR.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\ZopdVFJ.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\xyKyXDY.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\jrxAwnz.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\scrijVS.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\fvyrWuv.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\SWLoehZ.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\rWCmuxL.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\LDxGFFj.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\rjnxLtY.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\JRTPPJk.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\EXKdzcn.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\zZaIcRn.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\UbZUKhb.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\QjjQzkL.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\Wxqxpgt.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\uyWGqeM.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\KgjXdyp.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\OvLFnNl.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\DfyeJRe.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\SxFxLhr.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\SSskzAn.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\SChpwQu.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\SwEdECQ.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\AHnpuKx.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\gjnEuVH.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\mZyeZPW.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\NZYhGrV.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\JfXIBWS.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\FoNIvxs.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\eiCoDuT.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\AycPCdh.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\OizNIzC.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\KQSMvRk.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\XkFchOC.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\ZYbRdGG.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\lcPxZUt.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\nmnOOhu.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\odDNgAt.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\ShKPueo.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\BAzmQeI.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\qqNSIkM.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\JjWTfvx.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\rGpBjtX.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\Hsfdiyc.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\kkAcrll.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\ehnwBxJ.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\fZGnORZ.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe
File created	C:\Windows\System\nLBYKwL.exe	b4fcd911bfb553bf3495c3ef39671dc0N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeLockMemoryPrivilege	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe
Token: SeLockMemoryPrivilege	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 2672	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	85
PID 3804 wrote to memory of 2672	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	85
PID 3804 wrote to memory of 2720	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	86
PID 3804 wrote to memory of 2720	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	86
PID 3804 wrote to memory of 3848	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	87
PID 3804 wrote to memory of 3848	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	87
PID 3804 wrote to memory of 1916	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	88
PID 3804 wrote to memory of 1916	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	88
PID 3804 wrote to memory of 5044	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	89
PID 3804 wrote to memory of 5044	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	89
PID 3804 wrote to memory of 3908	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	90
PID 3804 wrote to memory of 3908	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	90
PID 3804 wrote to memory of 656	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	91
PID 3804 wrote to memory of 656	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	91
PID 3804 wrote to memory of 2124	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	92
PID 3804 wrote to memory of 2124	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	92
PID 3804 wrote to memory of 3428	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	93
PID 3804 wrote to memory of 3428	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	93
PID 3804 wrote to memory of 2868	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	94
PID 3804 wrote to memory of 2868	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	94
PID 3804 wrote to memory of 3468	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	95
PID 3804 wrote to memory of 3468	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	95
PID 3804 wrote to memory of 2132	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	96
PID 3804 wrote to memory of 2132	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	96
PID 3804 wrote to memory of 4928	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	97
PID 3804 wrote to memory of 4928	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	97
PID 3804 wrote to memory of 2944	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	98
PID 3804 wrote to memory of 2944	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	98
PID 3804 wrote to memory of 376	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	99
PID 3804 wrote to memory of 376	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	99
PID 3804 wrote to memory of 940	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	100
PID 3804 wrote to memory of 940	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	100
PID 3804 wrote to memory of 1288	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	101
PID 3804 wrote to memory of 1288	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	101
PID 3804 wrote to memory of 4448	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	102
PID 3804 wrote to memory of 4448	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	102
PID 3804 wrote to memory of 5000	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	103
PID 3804 wrote to memory of 5000	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	103
PID 3804 wrote to memory of 3152	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	104
PID 3804 wrote to memory of 3152	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	104
PID 3804 wrote to memory of 4988	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	105
PID 3804 wrote to memory of 4988	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	105
PID 3804 wrote to memory of 4616	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	106
PID 3804 wrote to memory of 4616	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	106
PID 3804 wrote to memory of 3636	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	107
PID 3804 wrote to memory of 3636	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	107
PID 3804 wrote to memory of 644	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	108
PID 3804 wrote to memory of 644	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	108
PID 3804 wrote to memory of 4244	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	109
PID 3804 wrote to memory of 4244	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	109
PID 3804 wrote to memory of 4352	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	110
PID 3804 wrote to memory of 4352	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	110
PID 3804 wrote to memory of 4168	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	111
PID 3804 wrote to memory of 4168	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	111
PID 3804 wrote to memory of 2304	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	112
PID 3804 wrote to memory of 2304	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	112
PID 3804 wrote to memory of 2860	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	113
PID 3804 wrote to memory of 2860	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	113
PID 3804 wrote to memory of 3984	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	114
PID 3804 wrote to memory of 3984	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	114
PID 3804 wrote to memory of 3540	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	115
PID 3804 wrote to memory of 3540	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	115
PID 3804 wrote to memory of 1940	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	116
PID 3804 wrote to memory of 1940	3804	b4fcd911bfb553bf3495c3ef39671dc0N.exe	116

C:\Users\Admin\AppData\Local\Temp\b4fcd911bfb553bf3495c3ef39671dc0N.exe
"C:\Users\Admin\AppData\Local\Temp\b4fcd911bfb553bf3495c3ef39671dc0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\System\IuIoKYv.exe
  C:\Windows\System\IuIoKYv.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ERNEsij.exe
  C:\Windows\System\ERNEsij.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\QZvRdvS.exe
  C:\Windows\System\QZvRdvS.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\WeXYQTu.exe
  C:\Windows\System\WeXYQTu.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\kVTZCtg.exe
  C:\Windows\System\kVTZCtg.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\TDFEtAh.exe
  C:\Windows\System\TDFEtAh.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\TUdykcf.exe
  C:\Windows\System\TUdykcf.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\pReirDe.exe
  C:\Windows\System\pReirDe.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\EtFibqF.exe
  C:\Windows\System\EtFibqF.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\cJHxUgk.exe
  C:\Windows\System\cJHxUgk.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\khwJAEn.exe
  C:\Windows\System\khwJAEn.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\RwxhuOu.exe
  C:\Windows\System\RwxhuOu.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\iFMLKfJ.exe
  C:\Windows\System\iFMLKfJ.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\athjyVL.exe
  C:\Windows\System\athjyVL.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\obUNQFm.exe
  C:\Windows\System\obUNQFm.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\ohOYcgR.exe
  C:\Windows\System\ohOYcgR.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\LDMTvIo.exe
  C:\Windows\System\LDMTvIo.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\vqRZEkd.exe
  C:\Windows\System\vqRZEkd.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\tajPlfc.exe
  C:\Windows\System\tajPlfc.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\HRVqEIu.exe
  C:\Windows\System\HRVqEIu.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\fatRjZi.exe
  C:\Windows\System\fatRjZi.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\eKWOCiU.exe
  C:\Windows\System\eKWOCiU.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\KTUKOxS.exe
  C:\Windows\System\KTUKOxS.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\yHBXvYO.exe
  C:\Windows\System\yHBXvYO.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\PXMVHLT.exe
  C:\Windows\System\PXMVHLT.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\ueILAoF.exe
  C:\Windows\System\ueILAoF.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\PseSOxd.exe
  C:\Windows\System\PseSOxd.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\GefaAtE.exe
  C:\Windows\System\GefaAtE.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\rLhbbbB.exe
  C:\Windows\System\rLhbbbB.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\ZbkNEmh.exe
  C:\Windows\System\ZbkNEmh.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\WvRLLPv.exe
  C:\Windows\System\WvRLLPv.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\jscjumC.exe
  C:\Windows\System\jscjumC.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\gcpNTni.exe
  C:\Windows\System\gcpNTni.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\xBXtFEx.exe
  C:\Windows\System\xBXtFEx.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\ZtUbJWB.exe
  C:\Windows\System\ZtUbJWB.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\yAOeZQW.exe
  C:\Windows\System\yAOeZQW.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\TPfVJdK.exe
  C:\Windows\System\TPfVJdK.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\yaWmUHg.exe
  C:\Windows\System\yaWmUHg.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\RHjSkAk.exe
  C:\Windows\System\RHjSkAk.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\gjVqiPC.exe
  C:\Windows\System\gjVqiPC.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\ntmsyTe.exe
  C:\Windows\System\ntmsyTe.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\svvMPDW.exe
  C:\Windows\System\svvMPDW.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\qLwktCS.exe
  C:\Windows\System\qLwktCS.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\wXTlVpp.exe
  C:\Windows\System\wXTlVpp.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\RqpLRbn.exe
  C:\Windows\System\RqpLRbn.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\sfXDpnw.exe
  C:\Windows\System\sfXDpnw.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\XyWckSj.exe
  C:\Windows\System\XyWckSj.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\JxZoxhH.exe
  C:\Windows\System\JxZoxhH.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\oibtaUv.exe
  C:\Windows\System\oibtaUv.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\bLHpofH.exe
  C:\Windows\System\bLHpofH.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\GIyuKIT.exe
  C:\Windows\System\GIyuKIT.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\yxtJdgH.exe
  C:\Windows\System\yxtJdgH.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\cgVJeoE.exe
  C:\Windows\System\cgVJeoE.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\CCnleav.exe
  C:\Windows\System\CCnleav.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\tuvKohg.exe
  C:\Windows\System\tuvKohg.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\vZFSxJu.exe
  C:\Windows\System\vZFSxJu.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\eUQsSCj.exe
  C:\Windows\System\eUQsSCj.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\jCPtxMl.exe
  C:\Windows\System\jCPtxMl.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\mkgEipa.exe
  C:\Windows\System\mkgEipa.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\cPozkmt.exe
  C:\Windows\System\cPozkmt.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\slfKlAm.exe
  C:\Windows\System\slfKlAm.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\tFgACAr.exe
  C:\Windows\System\tFgACAr.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\SXMulpJ.exe
  C:\Windows\System\SXMulpJ.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\SbjMChr.exe
  C:\Windows\System\SbjMChr.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\PNqNVZD.exe
  C:\Windows\System\PNqNVZD.exe
  2⤵
  PID:640
- C:\Windows\System\oBrQaPM.exe
  C:\Windows\System\oBrQaPM.exe
  2⤵
  PID:3000
- C:\Windows\System\zlvJxQE.exe
  C:\Windows\System\zlvJxQE.exe
  2⤵
  PID:3492
- C:\Windows\System\BtQBhNP.exe
  C:\Windows\System\BtQBhNP.exe
  2⤵
  PID:2352
- C:\Windows\System\XhrGHrw.exe
  C:\Windows\System\XhrGHrw.exe
  2⤵
  PID:2160
- C:\Windows\System\YsxGbAd.exe
  C:\Windows\System\YsxGbAd.exe
  2⤵
  PID:1656
- C:\Windows\System\wzfMYTx.exe
  C:\Windows\System\wzfMYTx.exe
  2⤵
  PID:4320
- C:\Windows\System\CirfmFJ.exe
  C:\Windows\System\CirfmFJ.exe
  2⤵
  PID:2496
- C:\Windows\System\aBaGjpO.exe
  C:\Windows\System\aBaGjpO.exe
  2⤵
  PID:2128
- C:\Windows\System\iyajPiy.exe
  C:\Windows\System\iyajPiy.exe
  2⤵
  PID:2080
- C:\Windows\System\EMkoiwU.exe
  C:\Windows\System\EMkoiwU.exe
  2⤵
  PID:3420
- C:\Windows\System\wUDykuY.exe
  C:\Windows\System\wUDykuY.exe
  2⤵
  PID:1580
- C:\Windows\System\ZOwlJas.exe
  C:\Windows\System\ZOwlJas.exe
  2⤵
  PID:2204
- C:\Windows\System\GGJPABc.exe
  C:\Windows\System\GGJPABc.exe
  2⤵
  PID:3884
- C:\Windows\System\DihLnHP.exe
  C:\Windows\System\DihLnHP.exe
  2⤵
  PID:2144
- C:\Windows\System\YyCEnze.exe
  C:\Windows\System\YyCEnze.exe
  2⤵
  PID:1724
- C:\Windows\System\KanwcaD.exe
  C:\Windows\System\KanwcaD.exe
  2⤵
  PID:2884
- C:\Windows\System\ChVhWhc.exe
  C:\Windows\System\ChVhWhc.exe
  2⤵
  PID:2968
- C:\Windows\System\VdklsPF.exe
  C:\Windows\System\VdklsPF.exe
  2⤵
  PID:2596
- C:\Windows\System\dlHYtNw.exe
  C:\Windows\System\dlHYtNw.exe
  2⤵
  PID:4740
- C:\Windows\System\UqoZFDD.exe
  C:\Windows\System\UqoZFDD.exe
  2⤵
  PID:2404
- C:\Windows\System\fvyrWuv.exe
  C:\Windows\System\fvyrWuv.exe
  2⤵
  PID:5128
- C:\Windows\System\EMrgNCt.exe
  C:\Windows\System\EMrgNCt.exe
  2⤵
  PID:5144
- C:\Windows\System\CsKPnyn.exe
  C:\Windows\System\CsKPnyn.exe
  2⤵
  PID:5172
- C:\Windows\System\ngCRuXs.exe
  C:\Windows\System\ngCRuXs.exe
  2⤵
  PID:5204
- C:\Windows\System\sMzZiYp.exe
  C:\Windows\System\sMzZiYp.exe
  2⤵
  PID:5232
- C:\Windows\System\XMyVavs.exe
  C:\Windows\System\XMyVavs.exe
  2⤵
  PID:5252
- C:\Windows\System\SwuTaLt.exe
  C:\Windows\System\SwuTaLt.exe
  2⤵
  PID:5276
- C:\Windows\System\NZYhGrV.exe
  C:\Windows\System\NZYhGrV.exe
  2⤵
  PID:5292
- C:\Windows\System\ypSARjR.exe
  C:\Windows\System\ypSARjR.exe
  2⤵
  PID:5316
- C:\Windows\System\RaTEwmI.exe
  C:\Windows\System\RaTEwmI.exe
  2⤵
  PID:5344
- C:\Windows\System\FRmeRwE.exe
  C:\Windows\System\FRmeRwE.exe
  2⤵
  PID:5520
- C:\Windows\System\JprcRfm.exe
  C:\Windows\System\JprcRfm.exe
  2⤵
  PID:5536
- C:\Windows\System\lwgLWZL.exe
  C:\Windows\System\lwgLWZL.exe
  2⤵
  PID:5552
- C:\Windows\System\XIztiHL.exe
  C:\Windows\System\XIztiHL.exe
  2⤵
  PID:5568
- C:\Windows\System\sYhXuFn.exe
  C:\Windows\System\sYhXuFn.exe
  2⤵
  PID:5588
- C:\Windows\System\sQdhRYl.exe
  C:\Windows\System\sQdhRYl.exe
  2⤵
  PID:5604
- C:\Windows\System\eFsMZpc.exe
  C:\Windows\System\eFsMZpc.exe
  2⤵
  PID:5620
- C:\Windows\System\aaFGhYc.exe
  C:\Windows\System\aaFGhYc.exe
  2⤵
  PID:5636
- C:\Windows\System\MSOAEgu.exe
  C:\Windows\System\MSOAEgu.exe
  2⤵
  PID:5652
- C:\Windows\System\dpfnDqF.exe
  C:\Windows\System\dpfnDqF.exe
  2⤵
  PID:5668
- C:\Windows\System\nwvNxbG.exe
  C:\Windows\System\nwvNxbG.exe
  2⤵
  PID:5684
- C:\Windows\System\rHRRaky.exe
  C:\Windows\System\rHRRaky.exe
  2⤵
  PID:5700
- C:\Windows\System\LLRskmA.exe
  C:\Windows\System\LLRskmA.exe
  2⤵
  PID:5716
- C:\Windows\System\zexOABW.exe
  C:\Windows\System\zexOABW.exe
  2⤵
  PID:5732
- C:\Windows\System\IcYVsfm.exe
  C:\Windows\System\IcYVsfm.exe
  2⤵
  PID:5752
- C:\Windows\System\QieGyHQ.exe
  C:\Windows\System\QieGyHQ.exe
  2⤵
  PID:5768
- C:\Windows\System\Knnsyhe.exe
  C:\Windows\System\Knnsyhe.exe
  2⤵
  PID:5788
- C:\Windows\System\UDljSVO.exe
  C:\Windows\System\UDljSVO.exe
  2⤵
  PID:5812
- C:\Windows\System\phTTfRj.exe
  C:\Windows\System\phTTfRj.exe
  2⤵
  PID:5828
- C:\Windows\System\BexJFQU.exe
  C:\Windows\System\BexJFQU.exe
  2⤵
  PID:5852
- C:\Windows\System\NfjTJDI.exe
  C:\Windows\System\NfjTJDI.exe
  2⤵
  PID:5868
- C:\Windows\System\qElQJbf.exe
  C:\Windows\System\qElQJbf.exe
  2⤵
  PID:5892
- C:\Windows\System\iRaWVdu.exe
  C:\Windows\System\iRaWVdu.exe
  2⤵
  PID:5916
- C:\Windows\System\fevGIHQ.exe
  C:\Windows\System\fevGIHQ.exe
  2⤵
  PID:5932
- C:\Windows\System\TZRLNzY.exe
  C:\Windows\System\TZRLNzY.exe
  2⤵
  PID:5952
- C:\Windows\System\VxOvbOK.exe
  C:\Windows\System\VxOvbOK.exe
  2⤵
  PID:6132
- C:\Windows\System\dpvuhCA.exe
  C:\Windows\System\dpvuhCA.exe
  2⤵
  PID:3564
- C:\Windows\System\CtOCwdY.exe
  C:\Windows\System\CtOCwdY.exe
  2⤵
  PID:2176
- C:\Windows\System\cUAqipo.exe
  C:\Windows\System\cUAqipo.exe
  2⤵
  PID:4780
- C:\Windows\System\xWxZRbL.exe
  C:\Windows\System\xWxZRbL.exe
  2⤵
  PID:1448
- C:\Windows\System\CfWytud.exe
  C:\Windows\System\CfWytud.exe
  2⤵
  PID:3532
- C:\Windows\System\bPprliF.exe
  C:\Windows\System\bPprliF.exe
  2⤵
  PID:4808
- C:\Windows\System\hYeKrtj.exe
  C:\Windows\System\hYeKrtj.exe
  2⤵
  PID:2180
- C:\Windows\System\JIWwasa.exe
  C:\Windows\System\JIWwasa.exe
  2⤵
  PID:2688
- C:\Windows\System\LOHIfDj.exe
  C:\Windows\System\LOHIfDj.exe
  2⤵
  PID:4632
- C:\Windows\System\hHFvCBf.exe
  C:\Windows\System\hHFvCBf.exe
  2⤵
  PID:4916
- C:\Windows\System\FDZPgpE.exe
  C:\Windows\System\FDZPgpE.exe
  2⤵
  PID:1652
- C:\Windows\System\lWfCtIK.exe
  C:\Windows\System\lWfCtIK.exe
  2⤵
  PID:3740
- C:\Windows\System\CdCpnyI.exe
  C:\Windows\System\CdCpnyI.exe
  2⤵
  PID:5016
- C:\Windows\System\ebCOCkr.exe
  C:\Windows\System\ebCOCkr.exe
  2⤵
  PID:4400
- C:\Windows\System\aocRxal.exe
  C:\Windows\System\aocRxal.exe
  2⤵
  PID:5140
- C:\Windows\System\odQLFNb.exe
  C:\Windows\System\odQLFNb.exe
  2⤵
  PID:5216
- C:\Windows\System\ubAqLAp.exe
  C:\Windows\System\ubAqLAp.exe
  2⤵
  PID:5324
- C:\Windows\System\OQjskXv.exe
  C:\Windows\System\OQjskXv.exe
  2⤵
  PID:1492
- C:\Windows\System\rwVXghN.exe
  C:\Windows\System\rwVXghN.exe
  2⤵
  PID:5336
- C:\Windows\System\CZLiHtd.exe
  C:\Windows\System\CZLiHtd.exe
  2⤵
  PID:6032
- C:\Windows\System\WKTyYSL.exe
  C:\Windows\System\WKTyYSL.exe
  2⤵
  PID:6156
- C:\Windows\System\NoEukbs.exe
  C:\Windows\System\NoEukbs.exe
  2⤵
  PID:6172
- C:\Windows\System\rcaPdoY.exe
  C:\Windows\System\rcaPdoY.exe
  2⤵
  PID:6188
- C:\Windows\System\kUcCoVQ.exe
  C:\Windows\System\kUcCoVQ.exe
  2⤵
  PID:6204
- C:\Windows\System\ETVAxeE.exe
  C:\Windows\System\ETVAxeE.exe
  2⤵
  PID:6220
- C:\Windows\System\bhbhsHb.exe
  C:\Windows\System\bhbhsHb.exe
  2⤵
  PID:6236
- C:\Windows\System\bFTnBnF.exe
  C:\Windows\System\bFTnBnF.exe
  2⤵
  PID:6252
- C:\Windows\System\rPBLPYM.exe
  C:\Windows\System\rPBLPYM.exe
  2⤵
  PID:6268
- C:\Windows\System\lcPxZUt.exe
  C:\Windows\System\lcPxZUt.exe
  2⤵
  PID:6284
- C:\Windows\System\mUHCyQW.exe
  C:\Windows\System\mUHCyQW.exe
  2⤵
  PID:6300
- C:\Windows\System\gqKWeAo.exe
  C:\Windows\System\gqKWeAo.exe
  2⤵
  PID:6324
- C:\Windows\System\CIpisQY.exe
  C:\Windows\System\CIpisQY.exe
  2⤵
  PID:6344
- C:\Windows\System\LHFNoLW.exe
  C:\Windows\System\LHFNoLW.exe
  2⤵
  PID:6368
- C:\Windows\System\kSRCTYB.exe
  C:\Windows\System\kSRCTYB.exe
  2⤵
  PID:6392
- C:\Windows\System\KJSUlXq.exe
  C:\Windows\System\KJSUlXq.exe
  2⤵
  PID:6416
- C:\Windows\System\MgmtmaP.exe
  C:\Windows\System\MgmtmaP.exe
  2⤵
  PID:6432
- C:\Windows\System\QzxgtqN.exe
  C:\Windows\System\QzxgtqN.exe
  2⤵
  PID:6464
- C:\Windows\System\cPaZcGz.exe
  C:\Windows\System\cPaZcGz.exe
  2⤵
  PID:6484
- C:\Windows\System\JrDIEOW.exe
  C:\Windows\System\JrDIEOW.exe
  2⤵
  PID:6504
- C:\Windows\System\tSViNxt.exe
  C:\Windows\System\tSViNxt.exe
  2⤵
  PID:6528
- C:\Windows\System\jvQTYxi.exe
  C:\Windows\System\jvQTYxi.exe
  2⤵
  PID:6552
- C:\Windows\System\QplJSXj.exe
  C:\Windows\System\QplJSXj.exe
  2⤵
  PID:6572
- C:\Windows\System\awwkUwy.exe
  C:\Windows\System\awwkUwy.exe
  2⤵
  PID:6592
- C:\Windows\System\GfGEFjt.exe
  C:\Windows\System\GfGEFjt.exe
  2⤵
  PID:6616
- C:\Windows\System\tfUXUxf.exe
  C:\Windows\System\tfUXUxf.exe
  2⤵
  PID:6640
- C:\Windows\System\HlcTzST.exe
  C:\Windows\System\HlcTzST.exe
  2⤵
  PID:6656
- C:\Windows\System\XbKgbxT.exe
  C:\Windows\System\XbKgbxT.exe
  2⤵
  PID:6680
- C:\Windows\System\HltGGPP.exe
  C:\Windows\System\HltGGPP.exe
  2⤵
  PID:6704
- C:\Windows\System\wLzAfqk.exe
  C:\Windows\System\wLzAfqk.exe
  2⤵
  PID:6724
- C:\Windows\System\yUqJSFz.exe
  C:\Windows\System\yUqJSFz.exe
  2⤵
  PID:6748
- C:\Windows\System\KHUvtBy.exe
  C:\Windows\System\KHUvtBy.exe
  2⤵
  PID:6772
- C:\Windows\System\fwkcfsb.exe
  C:\Windows\System\fwkcfsb.exe
  2⤵
  PID:6796
- C:\Windows\System\RFHvSWH.exe
  C:\Windows\System\RFHvSWH.exe
  2⤵
  PID:6812
- C:\Windows\System\cuztmNg.exe
  C:\Windows\System\cuztmNg.exe
  2⤵
  PID:6836
- C:\Windows\System\VqYWupn.exe
  C:\Windows\System\VqYWupn.exe
  2⤵
  PID:6852
- C:\Windows\System\FncJhnT.exe
  C:\Windows\System\FncJhnT.exe
  2⤵
  PID:6876
- C:\Windows\System\KCarlWr.exe
  C:\Windows\System\KCarlWr.exe
  2⤵
  PID:6908
- C:\Windows\System\iZEPZjH.exe
  C:\Windows\System\iZEPZjH.exe
  2⤵
  PID:6924
- C:\Windows\System\dZtWcQN.exe
  C:\Windows\System\dZtWcQN.exe
  2⤵
  PID:6944
- C:\Windows\System\qOAWFlH.exe
  C:\Windows\System\qOAWFlH.exe
  2⤵
  PID:6964
- C:\Windows\System\xEqIDtE.exe
  C:\Windows\System\xEqIDtE.exe
  2⤵
  PID:6984
- C:\Windows\System\xaTeTKL.exe
  C:\Windows\System\xaTeTKL.exe
  2⤵
  PID:7008
- C:\Windows\System\orUrMte.exe
  C:\Windows\System\orUrMte.exe
  2⤵
  PID:1460
- C:\Windows\System\FNCCllT.exe
  C:\Windows\System\FNCCllT.exe
  2⤵
  PID:5964
- C:\Windows\System\BFDShLz.exe
  C:\Windows\System\BFDShLz.exe
  2⤵
  PID:5396
- C:\Windows\System\xfvuawI.exe
  C:\Windows\System\xfvuawI.exe
  2⤵
  PID:5564
- C:\Windows\System\YNMeyFy.exe
  C:\Windows\System\YNMeyFy.exe
  2⤵
  PID:5612
- C:\Windows\System\MMzqJTd.exe
  C:\Windows\System\MMzqJTd.exe
  2⤵
  PID:5660
- C:\Windows\System\rEScFpm.exe
  C:\Windows\System\rEScFpm.exe
  2⤵
  PID:5692
- C:\Windows\System\kXORMpo.exe
  C:\Windows\System\kXORMpo.exe
  2⤵
  PID:5744
- C:\Windows\System\mPBvfpA.exe
  C:\Windows\System\mPBvfpA.exe
  2⤵
  PID:5784
- C:\Windows\System\oTofRhh.exe
  C:\Windows\System\oTofRhh.exe
  2⤵
  PID:5820
- C:\Windows\System\IkLdRvu.exe
  C:\Windows\System\IkLdRvu.exe
  2⤵
  PID:5848
- C:\Windows\System\wXrVflH.exe
  C:\Windows\System\wXrVflH.exe
  2⤵
  PID:5884
- C:\Windows\System\tMLZBKr.exe
  C:\Windows\System\tMLZBKr.exe
  2⤵
  PID:2680
- C:\Windows\System\JxWMrYU.exe
  C:\Windows\System\JxWMrYU.exe
  2⤵
  PID:2384
- C:\Windows\System\odUMiYf.exe
  C:\Windows\System\odUMiYf.exe
  2⤵
  PID:5300
- C:\Windows\System\jKhVOzc.exe
  C:\Windows\System\jKhVOzc.exe
  2⤵
  PID:6148
- C:\Windows\System\QYQXofb.exe
  C:\Windows\System\QYQXofb.exe
  2⤵
  PID:6184
- C:\Windows\System\fYfAeWq.exe
  C:\Windows\System\fYfAeWq.exe
  2⤵
  PID:6228
- C:\Windows\System\IXtJIdt.exe
  C:\Windows\System\IXtJIdt.exe
  2⤵
  PID:6276
- C:\Windows\System\eiCoDuT.exe
  C:\Windows\System\eiCoDuT.exe
  2⤵
  PID:6312
- C:\Windows\System\PUZFKQR.exe
  C:\Windows\System\PUZFKQR.exe
  2⤵
  PID:6380
- C:\Windows\System\NeWpOLm.exe
  C:\Windows\System\NeWpOLm.exe
  2⤵
  PID:6428
- C:\Windows\System\fXiDmtm.exe
  C:\Windows\System\fXiDmtm.exe
  2⤵
  PID:6480
- C:\Windows\System\ElwpbFc.exe
  C:\Windows\System\ElwpbFc.exe
  2⤵
  PID:6520
- C:\Windows\System\DdtdAWb.exe
  C:\Windows\System\DdtdAWb.exe
  2⤵
  PID:6568
- C:\Windows\System\TvNMKOm.exe
  C:\Windows\System\TvNMKOm.exe
  2⤵
  PID:6608
- C:\Windows\System\juIWEHt.exe
  C:\Windows\System\juIWEHt.exe
  2⤵
  PID:6652
- C:\Windows\System\EzqIkWu.exe
  C:\Windows\System\EzqIkWu.exe
  2⤵
  PID:6696
- C:\Windows\System\JFQSvzl.exe
  C:\Windows\System\JFQSvzl.exe
  2⤵
  PID:6740
- C:\Windows\System\EJmEJgD.exe
  C:\Windows\System\EJmEJgD.exe
  2⤵
  PID:6788
- C:\Windows\System\PEunhoe.exe
  C:\Windows\System\PEunhoe.exe
  2⤵
  PID:6828
- C:\Windows\System\BAQVGkq.exe
  C:\Windows\System\BAQVGkq.exe
  2⤵
  PID:6868
- C:\Windows\System\VaYzqqv.exe
  C:\Windows\System\VaYzqqv.exe
  2⤵
  PID:6916
- C:\Windows\System\qMZTAnz.exe
  C:\Windows\System\qMZTAnz.exe
  2⤵
  PID:6956
- C:\Windows\System\sYdYiyE.exe
  C:\Windows\System\sYdYiyE.exe
  2⤵
  PID:7440
- C:\Windows\System\glDCTtM.exe
  C:\Windows\System\glDCTtM.exe
  2⤵
  PID:7456
- C:\Windows\System\yiLiqoO.exe
  C:\Windows\System\yiLiqoO.exe
  2⤵
  PID:7532
- C:\Windows\System\ehnwBxJ.exe
  C:\Windows\System\ehnwBxJ.exe
  2⤵
  PID:7552
- C:\Windows\System\pYJteKf.exe
  C:\Windows\System\pYJteKf.exe
  2⤵
  PID:7584
- C:\Windows\System\zhWAhge.exe
  C:\Windows\System\zhWAhge.exe
  2⤵
  PID:7600
- C:\Windows\System\fyEEGHC.exe
  C:\Windows\System\fyEEGHC.exe
  2⤵
  PID:7620
- C:\Windows\System\GuBWTVS.exe
  C:\Windows\System\GuBWTVS.exe
  2⤵
  PID:7644
- C:\Windows\System\DBEOutq.exe
  C:\Windows\System\DBEOutq.exe
  2⤵
  PID:7664
- C:\Windows\System\DzHTPTL.exe
  C:\Windows\System\DzHTPTL.exe
  2⤵
  PID:7684
- C:\Windows\System\UnGfYUh.exe
  C:\Windows\System\UnGfYUh.exe
  2⤵
  PID:7816
- C:\Windows\System\DfyeJRe.exe
  C:\Windows\System\DfyeJRe.exe
  2⤵
  PID:7840
- C:\Windows\System\ByILdHB.exe
  C:\Windows\System\ByILdHB.exe
  2⤵
  PID:7872
- C:\Windows\System\QwtUUGh.exe
  C:\Windows\System\QwtUUGh.exe
  2⤵
  PID:7888
- C:\Windows\System\AWWbqWR.exe
  C:\Windows\System\AWWbqWR.exe
  2⤵
  PID:7908
- C:\Windows\System\OzNqkiA.exe
  C:\Windows\System\OzNqkiA.exe
  2⤵
  PID:7932
- C:\Windows\System\LDxGFFj.exe
  C:\Windows\System\LDxGFFj.exe
  2⤵
  PID:7952
- C:\Windows\System\DvycjCC.exe
  C:\Windows\System\DvycjCC.exe
  2⤵
  PID:7976
- C:\Windows\System\hnNIfGY.exe
  C:\Windows\System\hnNIfGY.exe
  2⤵
  PID:7996
- C:\Windows\System\lDyNVqt.exe
  C:\Windows\System\lDyNVqt.exe
  2⤵
  PID:8020
- C:\Windows\System\txGSFZo.exe
  C:\Windows\System\txGSFZo.exe
  2⤵
  PID:8036
- C:\Windows\System\hRelgKH.exe
  C:\Windows\System\hRelgKH.exe
  2⤵
  PID:8060
- C:\Windows\System\LfMrjIZ.exe
  C:\Windows\System\LfMrjIZ.exe
  2⤵
  PID:8092
- C:\Windows\System\OjITyjQ.exe
  C:\Windows\System\OjITyjQ.exe
  2⤵
  PID:8116
- C:\Windows\System\AzZGcrM.exe
  C:\Windows\System\AzZGcrM.exe
  2⤵
  PID:8132
- C:\Windows\System\JKiDdCP.exe
  C:\Windows\System\JKiDdCP.exe
  2⤵
  PID:8156
- C:\Windows\System\pqISVTw.exe
  C:\Windows\System\pqISVTw.exe
  2⤵
  PID:8188
- C:\Windows\System\tVeWBUs.exe
  C:\Windows\System\tVeWBUs.exe
  2⤵
  PID:7044
- C:\Windows\System\hyHKzzR.exe
  C:\Windows\System\hyHKzzR.exe
  2⤵
  PID:5780
- C:\Windows\System\gdNcjvV.exe
  C:\Windows\System\gdNcjvV.exe
  2⤵
  PID:5900
- C:\Windows\System\DCSqYaJ.exe
  C:\Windows\System\DCSqYaJ.exe
  2⤵
  PID:6164
- C:\Windows\System\glbiGZk.exe
  C:\Windows\System\glbiGZk.exe
  2⤵
  PID:6460
- C:\Windows\System\QCdgGoQ.exe
  C:\Windows\System\QCdgGoQ.exe
  2⤵
  PID:6768
- C:\Windows\System\CgyexSw.exe
  C:\Windows\System\CgyexSw.exe
  2⤵
  PID:6920
- C:\Windows\System\YWyeFzk.exe
  C:\Windows\System\YWyeFzk.exe
  2⤵
  PID:4412
- C:\Windows\System\cMoLEaA.exe
  C:\Windows\System\cMoLEaA.exe
  2⤵
  PID:7264
- C:\Windows\System\NlHPgyW.exe
  C:\Windows\System\NlHPgyW.exe
  2⤵
  PID:3236
- C:\Windows\System\tKNYAOW.exe
  C:\Windows\System\tKNYAOW.exe
  2⤵
  PID:6264
- C:\Windows\System\ZwvmgAj.exe
  C:\Windows\System\ZwvmgAj.exe
  2⤵
  PID:6472
- C:\Windows\System\vpODbAS.exe
  C:\Windows\System\vpODbAS.exe
  2⤵
  PID:6564
- C:\Windows\System\XseWXjD.exe
  C:\Windows\System\XseWXjD.exe
  2⤵
  PID:6820
- C:\Windows\System\akgIsBI.exe
  C:\Windows\System\akgIsBI.exe
  2⤵
  PID:6960
- C:\Windows\System\FmPztFB.exe
  C:\Windows\System\FmPztFB.exe
  2⤵
  PID:5676
- C:\Windows\System\iWApRBY.exe
  C:\Windows\System\iWApRBY.exe
  2⤵
  PID:7172
- C:\Windows\System\VNAriJh.exe
  C:\Windows\System\VNAriJh.exe
  2⤵
  PID:7240
- C:\Windows\System\YwaUErD.exe
  C:\Windows\System\YwaUErD.exe
  2⤵
  PID:6068
- C:\Windows\System\ABzTvLZ.exe
  C:\Windows\System\ABzTvLZ.exe
  2⤵
  PID:6636
- C:\Windows\System\xbPeEyR.exe
  C:\Windows\System\xbPeEyR.exe
  2⤵
  PID:4184
- C:\Windows\System\cQVCMmO.exe
  C:\Windows\System\cQVCMmO.exe
  2⤵
  PID:8204
- C:\Windows\System\wqjqywo.exe
  C:\Windows\System\wqjqywo.exe
  2⤵
  PID:8224
- C:\Windows\System\msmjeuQ.exe
  C:\Windows\System\msmjeuQ.exe
  2⤵
  PID:8244
- C:\Windows\System\XsDHNJp.exe
  C:\Windows\System\XsDHNJp.exe
  2⤵
  PID:8264
- C:\Windows\System\bWGoGuA.exe
  C:\Windows\System\bWGoGuA.exe
  2⤵
  PID:8284
- C:\Windows\System\AKxVAAr.exe
  C:\Windows\System\AKxVAAr.exe
  2⤵
  PID:8308
- C:\Windows\System\NnGJLvo.exe
  C:\Windows\System\NnGJLvo.exe
  2⤵
  PID:8332
- C:\Windows\System\mNUjqtO.exe
  C:\Windows\System\mNUjqtO.exe
  2⤵
  PID:8356
- C:\Windows\System\JCxuvIH.exe
  C:\Windows\System\JCxuvIH.exe
  2⤵
  PID:8384
- C:\Windows\System\mmTeclS.exe
  C:\Windows\System\mmTeclS.exe
  2⤵
  PID:8404
- C:\Windows\System\DsaOjwc.exe
  C:\Windows\System\DsaOjwc.exe
  2⤵
  PID:8612
- C:\Windows\System\guVTfgz.exe
  C:\Windows\System\guVTfgz.exe
  2⤵
  PID:8636
- C:\Windows\System\xEpyoJz.exe
  C:\Windows\System\xEpyoJz.exe
  2⤵
  PID:8668
- C:\Windows\System\PvKNXWq.exe
  C:\Windows\System\PvKNXWq.exe
  2⤵
  PID:8688
- C:\Windows\System\LAWTzjf.exe
  C:\Windows\System\LAWTzjf.exe
  2⤵
  PID:8708
- C:\Windows\System\VEHyhUC.exe
  C:\Windows\System\VEHyhUC.exe
  2⤵
  PID:8728
- C:\Windows\System\MndiMdU.exe
  C:\Windows\System\MndiMdU.exe
  2⤵
  PID:8756
- C:\Windows\System\CqURMdr.exe
  C:\Windows\System\CqURMdr.exe
  2⤵
  PID:8776
- C:\Windows\System\SmJBCXg.exe
  C:\Windows\System\SmJBCXg.exe
  2⤵
  PID:8796
- C:\Windows\System\ukQedst.exe
  C:\Windows\System\ukQedst.exe
  2⤵
  PID:8820
- C:\Windows\System\HgvuqYx.exe
  C:\Windows\System\HgvuqYx.exe
  2⤵
  PID:8836
- C:\Windows\System\WarbFvE.exe
  C:\Windows\System\WarbFvE.exe
  2⤵
  PID:8860
- C:\Windows\System\vIvvRsv.exe
  C:\Windows\System\vIvvRsv.exe
  2⤵
  PID:8884
- C:\Windows\System\DiyycGD.exe
  C:\Windows\System\DiyycGD.exe
  2⤵
  PID:8908
- C:\Windows\System\VQykUcw.exe
  C:\Windows\System\VQykUcw.exe
  2⤵
  PID:8924
- C:\Windows\System\PEfwozx.exe
  C:\Windows\System\PEfwozx.exe
  2⤵
  PID:9024
- C:\Windows\System\GDwabqz.exe
  C:\Windows\System\GDwabqz.exe
  2⤵
  PID:9040
- C:\Windows\System\KUamZXx.exe
  C:\Windows\System\KUamZXx.exe
  2⤵
  PID:9056
- C:\Windows\System\dUiHgvi.exe
  C:\Windows\System\dUiHgvi.exe
  2⤵
  PID:9072
- C:\Windows\System\yqSecDi.exe
  C:\Windows\System\yqSecDi.exe
  2⤵
  PID:9088
- C:\Windows\System\bKVMxKU.exe
  C:\Windows\System\bKVMxKU.exe
  2⤵
  PID:9104
- C:\Windows\System\xGeeDOk.exe
  C:\Windows\System\xGeeDOk.exe
  2⤵
  PID:9120
- C:\Windows\System\MVnSEoy.exe
  C:\Windows\System\MVnSEoy.exe
  2⤵
  PID:9144
- C:\Windows\System\izhVruh.exe
  C:\Windows\System\izhVruh.exe
  2⤵
  PID:9160
- C:\Windows\System\FiOctcN.exe
  C:\Windows\System\FiOctcN.exe
  2⤵
  PID:9176
- C:\Windows\System\CMfIAUc.exe
  C:\Windows\System\CMfIAUc.exe
  2⤵
  PID:9200
- C:\Windows\System\mInFaPz.exe
  C:\Windows\System\mInFaPz.exe
  2⤵
  PID:7420
- C:\Windows\System\jUlhUIG.exe
  C:\Windows\System\jUlhUIG.exe
  2⤵
  PID:7512
- C:\Windows\System\bKXncbM.exe
  C:\Windows\System\bKXncbM.exe
  2⤵
  PID:7576
- C:\Windows\System\nTVWNRz.exe
  C:\Windows\System\nTVWNRz.exe
  2⤵
  PID:7628
- C:\Windows\System\FXCjLjv.exe
  C:\Windows\System\FXCjLjv.exe
  2⤵
  PID:7676
- C:\Windows\System\WMMmdNw.exe
  C:\Windows\System\WMMmdNw.exe
  2⤵
  PID:4720
- C:\Windows\System\ZjpGAvX.exe
  C:\Windows\System\ZjpGAvX.exe
  2⤵
  PID:7796
- C:\Windows\System\FKrRtqz.exe
  C:\Windows\System\FKrRtqz.exe
  2⤵
  PID:7836
- C:\Windows\System\dktSNHR.exe
  C:\Windows\System\dktSNHR.exe
  2⤵
  PID:7896
- C:\Windows\System\qlwGyZq.exe
  C:\Windows\System\qlwGyZq.exe
  2⤵
  PID:7940
- C:\Windows\System\tGMfBLy.exe
  C:\Windows\System\tGMfBLy.exe
  2⤵
  PID:7988
- C:\Windows\System\wcZWZio.exe
  C:\Windows\System\wcZWZio.exe
  2⤵
  PID:8028
- C:\Windows\System\pKKZGVO.exe
  C:\Windows\System\pKKZGVO.exe
  2⤵
  PID:8068
- C:\Windows\System\lhBcccK.exe
  C:\Windows\System\lhBcccK.exe
  2⤵
  PID:8108
- C:\Windows\System\JWhvdHY.exe
  C:\Windows\System\JWhvdHY.exe
  2⤵
  PID:8164
- C:\Windows\System\PyTBIpd.exe
  C:\Windows\System\PyTBIpd.exe
  2⤵
  PID:5912
- C:\Windows\System\TqBSRtp.exe
  C:\Windows\System\TqBSRtp.exe
  2⤵
  PID:5864
- C:\Windows\System\OdtTfkn.exe
  C:\Windows\System\OdtTfkn.exe
  2⤵
  PID:6356
- C:\Windows\System\WuoxZvi.exe
  C:\Windows\System\WuoxZvi.exe
  2⤵
  PID:6884
- C:\Windows\System\SyVvOwP.exe
  C:\Windows\System\SyVvOwP.exe
  2⤵
  PID:2800
- C:\Windows\System\xSANROJ.exe
  C:\Windows\System\xSANROJ.exe
  2⤵
  PID:8220
- C:\Windows\System\GfEnJAa.exe
  C:\Windows\System\GfEnJAa.exe
  2⤵
  PID:6360
- C:\Windows\System\RKYjmSj.exe
  C:\Windows\System\RKYjmSj.exe
  2⤵
  PID:6860
- C:\Windows\System\mphYbJV.exe
  C:\Windows\System\mphYbJV.exe
  2⤵
  PID:5724
- C:\Windows\System\XloQgDJ.exe
  C:\Windows\System\XloQgDJ.exe
  2⤵
  PID:7272
- C:\Windows\System\GiBEEti.exe
  C:\Windows\System\GiBEEti.exe
  2⤵
  PID:8880
- C:\Windows\System\OsSOKHF.exe
  C:\Windows\System\OsSOKHF.exe
  2⤵
  PID:8276
- C:\Windows\System\UJBFFzK.exe
  C:\Windows\System\UJBFFzK.exe
  2⤵
  PID:8304
- C:\Windows\System\eTYSwOo.exe
  C:\Windows\System\eTYSwOo.exe
  2⤵
  PID:8352
- C:\Windows\System\VLcyEiS.exe
  C:\Windows\System\VLcyEiS.exe
  2⤵
  PID:1312
- C:\Windows\System\NDgHIxq.exe
  C:\Windows\System\NDgHIxq.exe
  2⤵
  PID:8448
- C:\Windows\System\SoIvMvI.exe
  C:\Windows\System\SoIvMvI.exe
  2⤵
  PID:8852
- C:\Windows\System\IKIGpcl.exe
  C:\Windows\System\IKIGpcl.exe
  2⤵
  PID:8892
- C:\Windows\System\PfzxHxR.exe
  C:\Windows\System\PfzxHxR.exe
  2⤵
  PID:8916
- C:\Windows\System\iCLMKbN.exe
  C:\Windows\System\iCLMKbN.exe
  2⤵
  PID:7924
- C:\Windows\System\NKXiERh.exe
  C:\Windows\System\NKXiERh.exe
  2⤵
  PID:8016
- C:\Windows\System\BZOhSwi.exe
  C:\Windows\System\BZOhSwi.exe
  2⤵
  PID:9244
- C:\Windows\System\ykIaAjo.exe
  C:\Windows\System\ykIaAjo.exe
  2⤵
  PID:9268
- C:\Windows\System\BLBqxzW.exe
  C:\Windows\System\BLBqxzW.exe
  2⤵
  PID:9292
- C:\Windows\System\VwsNBAc.exe
  C:\Windows\System\VwsNBAc.exe
  2⤵
  PID:9316
- C:\Windows\System\yEyexDq.exe
  C:\Windows\System\yEyexDq.exe
  2⤵
  PID:9336
- C:\Windows\System\JGWRfFp.exe
  C:\Windows\System\JGWRfFp.exe
  2⤵
  PID:9352
- C:\Windows\System\YMTZHYE.exe
  C:\Windows\System\YMTZHYE.exe
  2⤵
  PID:9368
- C:\Windows\System\hfNYKuD.exe
  C:\Windows\System\hfNYKuD.exe
  2⤵
  PID:9384
- C:\Windows\System\yjoWXnQ.exe
  C:\Windows\System\yjoWXnQ.exe
  2⤵
  PID:9408
- C:\Windows\System\OdxCVRX.exe
  C:\Windows\System\OdxCVRX.exe
  2⤵
  PID:9432
- C:\Windows\System\jaZQMYj.exe
  C:\Windows\System\jaZQMYj.exe
  2⤵
  PID:9456
- C:\Windows\System\gkbONju.exe
  C:\Windows\System\gkbONju.exe
  2⤵
  PID:9476
- C:\Windows\System\FdtIcMe.exe
  C:\Windows\System\FdtIcMe.exe
  2⤵
  PID:9536
- C:\Windows\System\tDtOnlc.exe
  C:\Windows\System\tDtOnlc.exe
  2⤵
  PID:9556
- C:\Windows\System\hDiUscg.exe
  C:\Windows\System\hDiUscg.exe
  2⤵
  PID:9572
- C:\Windows\System\wWciqJr.exe
  C:\Windows\System\wWciqJr.exe
  2⤵
  PID:9592
- C:\Windows\System\CYoFeDG.exe
  C:\Windows\System\CYoFeDG.exe
  2⤵
  PID:9616
- C:\Windows\System\GNXIlyY.exe
  C:\Windows\System\GNXIlyY.exe
  2⤵
  PID:9820
- C:\Windows\System\sNPVUtN.exe
  C:\Windows\System\sNPVUtN.exe
  2⤵
  PID:9836
- C:\Windows\System\LUUINhM.exe
  C:\Windows\System\LUUINhM.exe
  2⤵
  PID:9852
- C:\Windows\System\dNhnqYi.exe
  C:\Windows\System\dNhnqYi.exe
  2⤵
  PID:9928
- C:\Windows\System\vMZMhpj.exe
  C:\Windows\System\vMZMhpj.exe
  2⤵
  PID:9944
- C:\Windows\System\gIKchSw.exe
  C:\Windows\System\gIKchSw.exe
  2⤵
  PID:9964
- C:\Windows\System\nccbBov.exe
  C:\Windows\System\nccbBov.exe
  2⤵
  PID:9980
- C:\Windows\System\XFIBySv.exe
  C:\Windows\System\XFIBySv.exe
  2⤵
  PID:9996
- C:\Windows\System\cVTFkqC.exe
  C:\Windows\System\cVTFkqC.exe
  2⤵
  PID:10012
- C:\Windows\System\QRtyAsx.exe
  C:\Windows\System\QRtyAsx.exe
  2⤵
  PID:10036
- C:\Windows\System\oPDWLRF.exe
  C:\Windows\System\oPDWLRF.exe
  2⤵
  PID:10064
- C:\Windows\System\LHRpuiR.exe
  C:\Windows\System\LHRpuiR.exe
  2⤵
  PID:10092
- C:\Windows\System\sfOOWfc.exe
  C:\Windows\System\sfOOWfc.exe
  2⤵
  PID:10132
- C:\Windows\System\MbWxFlk.exe
  C:\Windows\System\MbWxFlk.exe
  2⤵
  PID:10156
- C:\Windows\System\YizyicK.exe
  C:\Windows\System\YizyicK.exe
  2⤵
  PID:10188
- C:\Windows\System\UUmPDvD.exe
  C:\Windows\System\UUmPDvD.exe
  2⤵
  PID:1736
- C:\Windows\System\CMUjZfK.exe
  C:\Windows\System\CMUjZfK.exe
  2⤵
  PID:8580
- C:\Windows\System\OUqaplB.exe
  C:\Windows\System\OUqaplB.exe
  2⤵
  PID:8628
- C:\Windows\System\cZoyCva.exe
  C:\Windows\System\cZoyCva.exe
  2⤵
  PID:8680
- C:\Windows\System\RpUGNlM.exe
  C:\Windows\System\RpUGNlM.exe
  2⤵
  PID:8720
- C:\Windows\System\tjEcHVO.exe
  C:\Windows\System\tjEcHVO.exe
  2⤵
  PID:8772
- C:\Windows\System\hlgeVIr.exe
  C:\Windows\System\hlgeVIr.exe
  2⤵
  PID:8808
- C:\Windows\System\sEcUylD.exe
  C:\Windows\System\sEcUylD.exe
  2⤵
  PID:7616
- C:\Windows\System\IHXJKxe.exe
  C:\Windows\System\IHXJKxe.exe
  2⤵
  PID:8468
- C:\Windows\System\CVXcnGN.exe
  C:\Windows\System\CVXcnGN.exe
  2⤵
  PID:7596
- C:\Windows\System\dedhsYw.exe
  C:\Windows\System\dedhsYw.exe
  2⤵
  PID:8932
- C:\Windows\System\lNWbgbO.exe
  C:\Windows\System\lNWbgbO.exe
  2⤵
  PID:9328
- C:\Windows\System\EaUysFr.exe
  C:\Windows\System\EaUysFr.exe
  2⤵
  PID:9380
- C:\Windows\System\sUFzEkw.exe
  C:\Windows\System\sUFzEkw.exe
  2⤵
  PID:9424
- C:\Windows\System\xuMpGBK.exe
  C:\Windows\System\xuMpGBK.exe
  2⤵
  PID:4876
- C:\Windows\System\ZQacwRS.exe
  C:\Windows\System\ZQacwRS.exe
  2⤵
  PID:9052
- C:\Windows\System\gOifEFQ.exe
  C:\Windows\System\gOifEFQ.exe
  2⤵
  PID:3588
- C:\Windows\System\knbcePW.exe
  C:\Windows\System\knbcePW.exe
  2⤵
  PID:9132
- C:\Windows\System\evSSKIE.exe
  C:\Windows\System\evSSKIE.exe
  2⤵
  PID:9168
- C:\Windows\System\xdlGeYi.exe
  C:\Windows\System\xdlGeYi.exe
  2⤵
  PID:7344
- C:\Windows\System\Vsitxfh.exe
  C:\Windows\System\Vsitxfh.exe
  2⤵
  PID:7752
- C:\Windows\System\XIsNOEE.exe
  C:\Windows\System\XIsNOEE.exe
  2⤵
  PID:9468
- C:\Windows\System\iRfbRey.exe
  C:\Windows\System\iRfbRey.exe
  2⤵
  PID:8200
- C:\Windows\System\fHTcPlz.exe
  C:\Windows\System\fHTcPlz.exe
  2⤵
  PID:8212
- C:\Windows\System\HDOEJeE.exe
  C:\Windows\System\HDOEJeE.exe
  2⤵
  PID:8292
- C:\Windows\System\bOQNfwt.exe
  C:\Windows\System\bOQNfwt.exe
  2⤵
  PID:7256
- C:\Windows\System\tmQawKY.exe
  C:\Windows\System\tmQawKY.exe
  2⤵
  PID:9228
- C:\Windows\System\IOoKfYp.exe
  C:\Windows\System\IOoKfYp.exe
  2⤵
  PID:9264
- C:\Windows\System\BtOsxAd.exe
  C:\Windows\System\BtOsxAd.exe
  2⤵
  PID:9312
- C:\Windows\System\aIumRPy.exe
  C:\Windows\System\aIumRPy.exe
  2⤵
  PID:10256
- C:\Windows\System\lzrhZwA.exe
  C:\Windows\System\lzrhZwA.exe
  2⤵
  PID:10276
- C:\Windows\System\QoQOcnb.exe
  C:\Windows\System\QoQOcnb.exe
  2⤵
  PID:10296
- C:\Windows\System\rkSSxsO.exe
  C:\Windows\System\rkSSxsO.exe
  2⤵
  PID:10316
- C:\Windows\System\VjENIdK.exe
  C:\Windows\System\VjENIdK.exe
  2⤵
  PID:10340
- C:\Windows\System\PpxvtYc.exe
  C:\Windows\System\PpxvtYc.exe
  2⤵
  PID:10364
- C:\Windows\System\RnuqXgK.exe
  C:\Windows\System\RnuqXgK.exe
  2⤵
  PID:10380
- C:\Windows\System\xnMywox.exe
  C:\Windows\System\xnMywox.exe
  2⤵
  PID:10396
- C:\Windows\System\ARmmFin.exe
  C:\Windows\System\ARmmFin.exe
  2⤵
  PID:10412
- C:\Windows\System\jtrqbES.exe
  C:\Windows\System\jtrqbES.exe
  2⤵
  PID:10428
- C:\Windows\System\VylIwqM.exe
  C:\Windows\System\VylIwqM.exe
  2⤵
  PID:10452
- C:\Windows\System\yhHlpFy.exe
  C:\Windows\System\yhHlpFy.exe
  2⤵
  PID:10472
- C:\Windows\System\EFMGaJd.exe
  C:\Windows\System\EFMGaJd.exe
  2⤵
  PID:10496
- C:\Windows\System\PyRAzqg.exe
  C:\Windows\System\PyRAzqg.exe
  2⤵
  PID:10512
- C:\Windows\System\weCVhlc.exe
  C:\Windows\System\weCVhlc.exe
  2⤵
  PID:10576
- C:\Windows\System\yRdSkNh.exe
  C:\Windows\System\yRdSkNh.exe
  2⤵
  PID:10592
- C:\Windows\System\lrBCCsE.exe
  C:\Windows\System\lrBCCsE.exe
  2⤵
  PID:10612
- C:\Windows\System\BbYULIn.exe
  C:\Windows\System\BbYULIn.exe
  2⤵
  PID:10644
- C:\Windows\System\ltLwfhL.exe
  C:\Windows\System\ltLwfhL.exe
  2⤵
  PID:10668
- C:\Windows\System\MOBEheW.exe
  C:\Windows\System\MOBEheW.exe
  2⤵
  PID:10692
- C:\Windows\System\nUhbvxo.exe
  C:\Windows\System\nUhbvxo.exe
  2⤵
  PID:10712
- C:\Windows\System\KUbqOaZ.exe
  C:\Windows\System\KUbqOaZ.exe
  2⤵
  PID:10732
- C:\Windows\System\iNWOdqk.exe
  C:\Windows\System\iNWOdqk.exe
  2⤵
  PID:10748
- C:\Windows\System\ZKZVBmi.exe
  C:\Windows\System\ZKZVBmi.exe
  2⤵
  PID:10776
- C:\Windows\System\lCRfYSn.exe
  C:\Windows\System\lCRfYSn.exe
  2⤵
  PID:10800
- C:\Windows\System\wwbPUFW.exe
  C:\Windows\System\wwbPUFW.exe
  2⤵
  PID:10824
- C:\Windows\System\GSrtsHa.exe
  C:\Windows\System\GSrtsHa.exe
  2⤵
  PID:10848
- C:\Windows\System\FmsPAwl.exe
  C:\Windows\System\FmsPAwl.exe
  2⤵
  PID:10868
- C:\Windows\System\PtZPtJk.exe
  C:\Windows\System\PtZPtJk.exe
  2⤵
  PID:10888
- C:\Windows\System\kIxApKr.exe
  C:\Windows\System\kIxApKr.exe
  2⤵
  PID:10904
- C:\Windows\System\RTKevmO.exe
  C:\Windows\System\RTKevmO.exe
  2⤵
  PID:10924
- C:\Windows\System\rqoqjur.exe
  C:\Windows\System\rqoqjur.exe
  2⤵
  PID:10944
- C:\Windows\System\JRTPPJk.exe
  C:\Windows\System\JRTPPJk.exe
  2⤵
  PID:10964
- C:\Windows\System\QNbSOfC.exe
  C:\Windows\System\QNbSOfC.exe
  2⤵
  PID:10988
- C:\Windows\System\NKnvNVU.exe
  C:\Windows\System\NKnvNVU.exe
  2⤵
  PID:11016
- C:\Windows\System\pCqOqSQ.exe
  C:\Windows\System\pCqOqSQ.exe
  2⤵
  PID:11032
- C:\Windows\System\vGgXZhF.exe
  C:\Windows\System\vGgXZhF.exe
  2⤵
  PID:11052
- C:\Windows\System\iYJIBMm.exe
  C:\Windows\System\iYJIBMm.exe
  2⤵
  PID:11072
- C:\Windows\System\ImfWWRD.exe
  C:\Windows\System\ImfWWRD.exe
  2⤵
  PID:11088
- C:\Windows\System\NiMGzgy.exe
  C:\Windows\System\NiMGzgy.exe
  2⤵
  PID:11104
- C:\Windows\System\XGtTiXa.exe
  C:\Windows\System\XGtTiXa.exe
  2⤵
  PID:11124
- C:\Windows\System\zNMtVMK.exe
  C:\Windows\System\zNMtVMK.exe
  2⤵
  PID:11144
- C:\Windows\System\QWQpCid.exe
  C:\Windows\System\QWQpCid.exe
  2⤵
  PID:11164
- C:\Windows\System\lNzHfYy.exe
  C:\Windows\System\lNzHfYy.exe
  2⤵
  PID:11184
- C:\Windows\System\BSsnSYp.exe
  C:\Windows\System\BSsnSYp.exe
  2⤵
  PID:11208
- C:\Windows\System\WBuPtPG.exe
  C:\Windows\System\WBuPtPG.exe
  2⤵
  PID:11232
- C:\Windows\System\QNJrlRt.exe
  C:\Windows\System\QNJrlRt.exe
  2⤵
  PID:11252
- C:\Windows\System\yycHJHR.exe
  C:\Windows\System\yycHJHR.exe
  2⤵
  PID:10044
- C:\Windows\System\dSDQvuD.exe
  C:\Windows\System\dSDQvuD.exe
  2⤵
  PID:10072
- C:\Windows\System\ODkJPLQ.exe
  C:\Windows\System\ODkJPLQ.exe
  2⤵
  PID:10100
- C:\Windows\System\wVTaskJ.exe
  C:\Windows\System\wVTaskJ.exe
  2⤵
  PID:9532
- C:\Windows\System\NnCzinw.exe
  C:\Windows\System\NnCzinw.exe
  2⤵
  PID:9568
- C:\Windows\System\odhgTqi.exe
  C:\Windows\System\odhgTqi.exe
  2⤵
  PID:9612
- C:\Windows\System\CPVrsQM.exe
  C:\Windows\System\CPVrsQM.exe
  2⤵
  PID:8012
- C:\Windows\System\ZncPILx.exe
  C:\Windows\System\ZncPILx.exe
  2⤵
  PID:9440
- C:\Windows\System\MXACLpk.exe
  C:\Windows\System\MXACLpk.exe
  2⤵
  PID:9664
- C:\Windows\System\ltIWvhK.exe
  C:\Windows\System\ltIWvhK.exe
  2⤵
  PID:9112
- C:\Windows\System\dPTDtiE.exe
  C:\Windows\System\dPTDtiE.exe
  2⤵
  PID:7692
- C:\Windows\System\qxyUIxb.exe
  C:\Windows\System\qxyUIxb.exe
  2⤵
  PID:7276
- C:\Windows\System\ZRYtJak.exe
  C:\Windows\System\ZRYtJak.exe
  2⤵
  PID:4728
- C:\Windows\System\YGibGKh.exe
  C:\Windows\System\YGibGKh.exe
  2⤵
  PID:9300
- C:\Windows\System\ZUwjjAc.exe
  C:\Windows\System\ZUwjjAc.exe
  2⤵
  PID:1376
- C:\Windows\System\ItDACNz.exe
  C:\Windows\System\ItDACNz.exe
  2⤵
  PID:10376
- C:\Windows\System\qXqzMNk.exe
  C:\Windows\System\qXqzMNk.exe
  2⤵
  PID:10424
- C:\Windows\System\eUqkYve.exe
  C:\Windows\System\eUqkYve.exe
  2⤵
  PID:10488
- C:\Windows\System\aWeeoXg.exe
  C:\Windows\System\aWeeoXg.exe
  2⤵
  PID:10508
- C:\Windows\System\DYaXqTZ.exe
  C:\Windows\System\DYaXqTZ.exe
  2⤵
  PID:9748
- C:\Windows\System\rCVWtDU.exe
  C:\Windows\System\rCVWtDU.exe
  2⤵
  PID:4112
- C:\Windows\System\WPryUCG.exe
  C:\Windows\System\WPryUCG.exe
  2⤵
  PID:10656
- C:\Windows\System\eTSRoiI.exe
  C:\Windows\System\eTSRoiI.exe
  2⤵
  PID:1808
- C:\Windows\System\SsbpmnS.exe
  C:\Windows\System\SsbpmnS.exe
  2⤵
  PID:9016
- C:\Windows\System\XSfqdFv.exe
  C:\Windows\System\XSfqdFv.exe
  2⤵
  PID:10792
- C:\Windows\System\zvcwRks.exe
  C:\Windows\System\zvcwRks.exe
  2⤵
  PID:10812
- C:\Windows\System\UwjuMQi.exe
  C:\Windows\System\UwjuMQi.exe
  2⤵
  PID:8152
- C:\Windows\System\BlecwQr.exe
  C:\Windows\System\BlecwQr.exe
  2⤵
  PID:9252
- C:\Windows\System\gQUXIDx.exe
  C:\Windows\System\gQUXIDx.exe
  2⤵
  PID:9304
- C:\Windows\System\MbrUnIL.exe
  C:\Windows\System\MbrUnIL.exe
  2⤵
  PID:10960
- C:\Windows\System\ExrtBVE.exe
  C:\Windows\System\ExrtBVE.exe
  2⤵
  PID:10308
- C:\Windows\System\PubCaDv.exe
  C:\Windows\System\PubCaDv.exe
  2⤵
  PID:10388
- C:\Windows\System\gASxusw.exe
  C:\Windows\System\gASxusw.exe
  2⤵
  PID:10116
- C:\Windows\System\kjJnIcM.exe
  C:\Windows\System\kjJnIcM.exe
  2⤵
  PID:11140
- C:\Windows\System\IBxXGww.exe
  C:\Windows\System\IBxXGww.exe
  2⤵
  PID:11280
- C:\Windows\System\aTrWqjl.exe
  C:\Windows\System\aTrWqjl.exe
  2⤵
  PID:11316
- C:\Windows\System\xexhDAD.exe
  C:\Windows\System\xexhDAD.exe
  2⤵
  PID:11332
- C:\Windows\System\ndfAInF.exe
  C:\Windows\System\ndfAInF.exe
  2⤵
  PID:11348
- C:\Windows\System\lSNPDto.exe
  C:\Windows\System\lSNPDto.exe
  2⤵
  PID:11368
- C:\Windows\System\YzXGSTK.exe
  C:\Windows\System\YzXGSTK.exe
  2⤵
  PID:11392
- C:\Windows\System\tHeODHd.exe
  C:\Windows\System\tHeODHd.exe
  2⤵
  PID:11408
- C:\Windows\System\PfGbmsB.exe
  C:\Windows\System\PfGbmsB.exe
  2⤵
  PID:11424
- C:\Windows\System\VdPQfsw.exe
  C:\Windows\System\VdPQfsw.exe
  2⤵
  PID:11444
- C:\Windows\System\RojHKEH.exe
  C:\Windows\System\RojHKEH.exe
  2⤵
  PID:11464
- C:\Windows\System\ktTfftw.exe
  C:\Windows\System\ktTfftw.exe
  2⤵
  PID:11488
- C:\Windows\System\ByVsitW.exe
  C:\Windows\System\ByVsitW.exe
  2⤵
  PID:11504
- C:\Windows\System\kSufRld.exe
  C:\Windows\System\kSufRld.exe
  2⤵
  PID:11528
- C:\Windows\System\wFBFOHY.exe
  C:\Windows\System\wFBFOHY.exe
  2⤵
  PID:11548
- C:\Windows\System\kFgPrlw.exe
  C:\Windows\System\kFgPrlw.exe
  2⤵
  PID:11568
- C:\Windows\System\TbSBFPM.exe
  C:\Windows\System\TbSBFPM.exe
  2⤵
  PID:11592
- C:\Windows\System\KcgRbRg.exe
  C:\Windows\System\KcgRbRg.exe
  2⤵
  PID:11616
- C:\Windows\System\WEDwfTR.exe
  C:\Windows\System\WEDwfTR.exe
  2⤵
  PID:11636
- C:\Windows\System\kHBvdZi.exe
  C:\Windows\System\kHBvdZi.exe
  2⤵
  PID:11656
- C:\Windows\System\XRWyJid.exe
  C:\Windows\System\XRWyJid.exe
  2⤵
  PID:11676
- C:\Windows\System\zAxeiBS.exe
  C:\Windows\System\zAxeiBS.exe
  2⤵
  PID:11704
- C:\Windows\System\jbutruZ.exe
  C:\Windows\System\jbutruZ.exe
  2⤵
  PID:11728
- C:\Windows\System\tTuvPEg.exe
  C:\Windows\System\tTuvPEg.exe
  2⤵
  PID:11756
- C:\Windows\System\qgXbLKE.exe
  C:\Windows\System\qgXbLKE.exe
  2⤵
  PID:11780
- C:\Windows\System\DGrmGka.exe
  C:\Windows\System\DGrmGka.exe
  2⤵
  PID:11804
- C:\Windows\System\kVyoLkW.exe
  C:\Windows\System\kVyoLkW.exe
  2⤵
  PID:11820
- C:\Windows\System\EtCQgsD.exe
  C:\Windows\System\EtCQgsD.exe
  2⤵
  PID:11840
- C:\Windows\System\GlwhllK.exe
  C:\Windows\System\GlwhllK.exe
  2⤵
  PID:11864
- C:\Windows\System\HBYuwQA.exe
  C:\Windows\System\HBYuwQA.exe
  2⤵
  PID:11884
- C:\Windows\System\BweiRew.exe
  C:\Windows\System\BweiRew.exe
  2⤵
  PID:11904
- C:\Windows\System\klaxEPB.exe
  C:\Windows\System\klaxEPB.exe
  2⤵
  PID:11928
- C:\Windows\System\jPipEdy.exe
  C:\Windows\System\jPipEdy.exe
  2⤵
  PID:11952
- C:\Windows\System\aSWzZEL.exe
  C:\Windows\System\aSWzZEL.exe
  2⤵
  PID:11980
- C:\Windows\System\vVSoBtD.exe
  C:\Windows\System\vVSoBtD.exe
  2⤵
  PID:12000
- C:\Windows\System\xtGSMht.exe
  C:\Windows\System\xtGSMht.exe
  2⤵
  PID:12020
- C:\Windows\System\bRLSJcw.exe
  C:\Windows\System\bRLSJcw.exe
  2⤵
  PID:12044
- C:\Windows\System\vLxsohz.exe
  C:\Windows\System\vLxsohz.exe
  2⤵
  PID:12072
- C:\Windows\System\naDOXum.exe
  C:\Windows\System\naDOXum.exe
  2⤵
  PID:12092
- C:\Windows\System\iekpYgb.exe
  C:\Windows\System\iekpYgb.exe
  2⤵
  PID:12120
- C:\Windows\System\LWeEdsq.exe
  C:\Windows\System\LWeEdsq.exe
  2⤵
  PID:12140
- C:\Windows\System\JDvCAQv.exe
  C:\Windows\System\JDvCAQv.exe
  2⤵
  PID:12164
- C:\Windows\System\lmHdnza.exe
  C:\Windows\System\lmHdnza.exe
  2⤵
  PID:12188
- C:\Windows\System\WJBVSVG.exe
  C:\Windows\System\WJBVSVG.exe
  2⤵
  PID:12212
- C:\Windows\System\LlNgNrL.exe
  C:\Windows\System\LlNgNrL.exe
  2⤵
  PID:12232
- C:\Windows\System\paaoTkU.exe
  C:\Windows\System\paaoTkU.exe
  2⤵
  PID:12256
- C:\Windows\System\RGhlxxa.exe
  C:\Windows\System\RGhlxxa.exe
  2⤵
  PID:12280
- C:\Windows\System\Hquqpse.exe
  C:\Windows\System\Hquqpse.exe
  2⤵
  PID:10204
- C:\Windows\System\pMsyutm.exe
  C:\Windows\System\pMsyutm.exe
  2⤵
  PID:8596
- C:\Windows\System\ZTBMoLp.exe
  C:\Windows\System\ZTBMoLp.exe
  2⤵
  PID:8868
- C:\Windows\System\WFdszIC.exe
  C:\Windows\System\WFdszIC.exe
  2⤵
  PID:8348
- C:\Windows\System\tdYxEqm.exe
  C:\Windows\System\tdYxEqm.exe
  2⤵
  PID:8744
- C:\Windows\System\MVpqVEL.exe
  C:\Windows\System\MVpqVEL.exe
  2⤵
  PID:8664
- C:\Windows\System\pRBvQqs.exe
  C:\Windows\System\pRBvQqs.exe
  2⤵
  PID:9564
- C:\Windows\System\urPbdty.exe
  C:\Windows\System\urPbdty.exe
  2⤵
  PID:10836
- C:\Windows\System\FwTMVFA.exe
  C:\Windows\System\FwTMVFA.exe
  2⤵
  PID:10860
- C:\Windows\System\ClTGflU.exe
  C:\Windows\System\ClTGflU.exe
  2⤵
  PID:10284
- C:\Windows\System\bkFwscq.exe
  C:\Windows\System\bkFwscq.exe
  2⤵
  PID:8828
- C:\Windows\System\dXcZKru.exe
  C:\Windows\System\dXcZKru.exe
  2⤵
  PID:2400
- C:\Windows\System\gREvjAd.exe
  C:\Windows\System\gREvjAd.exe
  2⤵
  PID:10896
- C:\Windows\System\WTJRUrj.exe
  C:\Windows\System\WTJRUrj.exe
  2⤵
  PID:10252
- C:\Windows\System\FUmOFfH.exe
  C:\Windows\System\FUmOFfH.exe
  2⤵
  PID:11000
- C:\Windows\System\TPoamoY.exe
  C:\Windows\System\TPoamoY.exe
  2⤵
  PID:10772
- C:\Windows\System\yMoZHJb.exe
  C:\Windows\System\yMoZHJb.exe
  2⤵
  PID:9208
- C:\Windows\System\IPnlxKG.exe
  C:\Windows\System\IPnlxKG.exe
  2⤵
  PID:11100
- C:\Windows\System\UJxZyMh.exe
  C:\Windows\System\UJxZyMh.exe
  2⤵
  PID:10464
- C:\Windows\System\kmMQzjm.exe
  C:\Windows\System\kmMQzjm.exe
  2⤵
  PID:12292
- C:\Windows\System\DUYWyKZ.exe
  C:\Windows\System\DUYWyKZ.exe
  2⤵
  PID:12316
- C:\Windows\System\UgonBdD.exe
  C:\Windows\System\UgonBdD.exe
  2⤵
  PID:12336
- C:\Windows\System\AnYwSxv.exe
  C:\Windows\System\AnYwSxv.exe
  2⤵
  PID:12352
- C:\Windows\System\HTvQLIp.exe
  C:\Windows\System\HTvQLIp.exe
  2⤵
  PID:12376
- C:\Windows\System\qjFVHEm.exe
  C:\Windows\System\qjFVHEm.exe
  2⤵
  PID:12392
- C:\Windows\System\hgcvFHT.exe
  C:\Windows\System\hgcvFHT.exe
  2⤵
  PID:12412
- C:\Windows\System\dYTUrno.exe
  C:\Windows\System\dYTUrno.exe
  2⤵
  PID:12440
- C:\Windows\System\wpYquLU.exe
  C:\Windows\System\wpYquLU.exe
  2⤵
  PID:12472
- C:\Windows\System\yFBqWGV.exe
  C:\Windows\System\yFBqWGV.exe
  2⤵
  PID:12492
- C:\Windows\System\NVVYIvS.exe
  C:\Windows\System\NVVYIvS.exe
  2⤵
  PID:12516
- C:\Windows\System\UMIyCiz.exe
  C:\Windows\System\UMIyCiz.exe
  2⤵
  PID:12540
- C:\Windows\System\ZVCflTA.exe
  C:\Windows\System\ZVCflTA.exe
  2⤵
  PID:12564
- C:\Windows\System\OnFRNoM.exe
  C:\Windows\System\OnFRNoM.exe
  2⤵
  PID:12588
- C:\Windows\System\RdGICQT.exe
  C:\Windows\System\RdGICQT.exe
  2⤵
  PID:12608
- C:\Windows\System\adgHJSY.exe
  C:\Windows\System\adgHJSY.exe
  2⤵
  PID:12628
- C:\Windows\System\kuZdmXK.exe
  C:\Windows\System\kuZdmXK.exe
  2⤵
  PID:12652
- C:\Windows\System\xFDbtsh.exe
  C:\Windows\System\xFDbtsh.exe
  2⤵
  PID:12680
- C:\Windows\System\oTFhnlD.exe
  C:\Windows\System\oTFhnlD.exe
  2⤵
  PID:13144
- C:\Windows\System\pvXtldZ.exe
  C:\Windows\System\pvXtldZ.exe
  2⤵
  PID:13172
- C:\Windows\System\VHICBkz.exe
  C:\Windows\System\VHICBkz.exe
  2⤵
  PID:448
- C:\Windows\System\yDzvMjg.exe
  C:\Windows\System\yDzvMjg.exe
  2⤵
  PID:10604
- C:\Windows\System\gqRkrGX.exe
  C:\Windows\System\gqRkrGX.exe
  2⤵
  PID:10676
- C:\Windows\System\wepkTIi.exe
  C:\Windows\System\wepkTIi.exe
  2⤵
  PID:11672
- C:\Windows\System\JxTeYhY.exe
  C:\Windows\System\JxTeYhY.exe
  2⤵
  PID:11740
- C:\Windows\System\qcoWAUJ.exe
  C:\Windows\System\qcoWAUJ.exe
  2⤵
  PID:12600
- C:\Windows\System\aBCyiLj.exe
  C:\Windows\System\aBCyiLj.exe
  2⤵
  PID:9848
- C:\Windows\System\cItNRlo.exe
  C:\Windows\System\cItNRlo.exe
  2⤵
  PID:10808
- C:\Windows\System\wIVLsvM.exe
  C:\Windows\System\wIVLsvM.exe
  2⤵
  PID:2312
- C:\Windows\System\EZmvNWL.exe
  C:\Windows\System\EZmvNWL.exe
  2⤵
  PID:11276
- C:\Windows\System\ekZMWIX.exe
  C:\Windows\System\ekZMWIX.exe
  2⤵
  PID:12360
- C:\Windows\System\MfUMaUp.exe
  C:\Windows\System\MfUMaUp.exe
  2⤵
  PID:11324
- C:\Windows\System\eXGapit.exe
  C:\Windows\System\eXGapit.exe
  2⤵
  PID:2200
- C:\Windows\System\DtCklVS.exe
  C:\Windows\System\DtCklVS.exe
  2⤵
  PID:11832
- C:\Windows\System\tjxPGAA.exe
  C:\Windows\System\tjxPGAA.exe
  2⤵
  PID:11772
- C:\Windows\System\CuweEIV.exe
  C:\Windows\System\CuweEIV.exe
  2⤵
  PID:11172
- C:\Windows\System\ZunUWrz.exe
  C:\Windows\System\ZunUWrz.exe
  2⤵
  PID:12248
- C:\Windows\System\lSJNjfR.exe
  C:\Windows\System\lSJNjfR.exe
  2⤵
  PID:12132
- C:\Windows\System\dGNSidq.exe
  C:\Windows\System\dGNSidq.exe
  2⤵
  PID:8056
- C:\Windows\System\EFBbVag.exe
  C:\Windows\System\EFBbVag.exe
  2⤵
  PID:8704
- C:\Windows\System\mEoAAGp.exe
  C:\Windows\System\mEoAAGp.exe
  2⤵
  PID:12408
- C:\Windows\System\ZhGbCYP.exe
  C:\Windows\System\ZhGbCYP.exe
  2⤵
  PID:12856
- C:\Windows\System\gIdJpCz.exe
  C:\Windows\System\gIdJpCz.exe
  2⤵
  PID:12920
- C:\Windows\System\CwYqXxq.exe
  C:\Windows\System\CwYqXxq.exe
  2⤵
  PID:12936
- C:\Windows\System\qUIczzr.exe
  C:\Windows\System\qUIczzr.exe
  2⤵
  PID:12960
- C:\Windows\System\lYAPuju.exe
  C:\Windows\System\lYAPuju.exe
  2⤵
  PID:12448
- C:\Windows\System\krfOmzA.exe
  C:\Windows\System\krfOmzA.exe
  2⤵
  PID:12576
- C:\Windows\System\qUcqyph.exe
  C:\Windows\System\qUcqyph.exe
  2⤵
  PID:12712
- C:\Windows\System\JsWwYyf.exe
  C:\Windows\System\JsWwYyf.exe
  2⤵
  PID:12816
- C:\Windows\System\sRvfbya.exe
  C:\Windows\System\sRvfbya.exe
  2⤵
  PID:12844
- C:\Windows\System\YeHrSKW.exe
  C:\Windows\System\YeHrSKW.exe
  2⤵
  PID:12948
- C:\Windows\System\OGqfdIm.exe
  C:\Windows\System\OGqfdIm.exe
  2⤵
  PID:12272
- C:\Windows\System\JvYgBkt.exe
  C:\Windows\System\JvYgBkt.exe
  2⤵
  PID:12732
- C:\Windows\System\FLUKgIu.exe
  C:\Windows\System\FLUKgIu.exe
  2⤵
  PID:4624
- C:\Windows\System\tOzZOiW.exe
  C:\Windows\System\tOzZOiW.exe
  2⤵
  PID:13260
- C:\Windows\System\oqfoqNP.exe
  C:\Windows\System\oqfoqNP.exe
  2⤵
  PID:10708
- C:\Windows\System\LucahpZ.exe
  C:\Windows\System\LucahpZ.exe
  2⤵
  PID:11400
- C:\Windows\System\szrkJoT.exe
  C:\Windows\System\szrkJoT.exe
  2⤵
  PID:11476
- C:\Windows\System\ZXQRHSc.exe
  C:\Windows\System\ZXQRHSc.exe
  2⤵
  PID:9196
- C:\Windows\System\uhHBZop.exe
  C:\Windows\System\uhHBZop.exe
  2⤵
  PID:4404
- C:\Windows\System\RpwMnlb.exe
  C:\Windows\System\RpwMnlb.exe
  2⤵
  PID:11404
- C:\Windows\System\VjKkclw.exe
  C:\Windows\System\VjKkclw.exe
  2⤵
  PID:11364
- C:\Windows\System\lvkwxum.exe
  C:\Windows\System\lvkwxum.exe
  2⤵
  PID:8564
- C:\Windows\System\KJQBCLO.exe
  C:\Windows\System\KJQBCLO.exe
  2⤵
  PID:12640
- C:\Windows\System\FdWLZoN.exe
  C:\Windows\System\FdWLZoN.exe
  2⤵
  PID:13284
- C:\Windows\System\NADnIub.exe
  C:\Windows\System\NADnIub.exe
  2⤵
  PID:13220
- C:\Windows\System\FqALXpP.exe
  C:\Windows\System\FqALXpP.exe
  2⤵
  PID:13180
- C:\Windows\System\UheJXKK.exe
  C:\Windows\System\UheJXKK.exe
  2⤵
  PID:9988
- C:\Windows\System\LVKktdz.exe
  C:\Windows\System\LVKktdz.exe
  2⤵
  PID:13304
- C:\Windows\System\qKeNItt.exe
  C:\Windows\System\qKeNItt.exe
  2⤵
  PID:2656
- C:\Windows\System\qHXMzkP.exe
  C:\Windows\System\qHXMzkP.exe
  2⤵
  PID:10020
- C:\Windows\System\QYiBScU.exe
  C:\Windows\System\QYiBScU.exe
  2⤵
  PID:1944
- C:\Windows\System\rGCPQNd.exe
  C:\Windows\System\rGCPQNd.exe
  2⤵
  PID:10916
- C:\Windows\System\wKzqIQN.exe
  C:\Windows\System\wKzqIQN.exe
  2⤵
  PID:11856
- C:\Windows\System\MERTogv.exe
  C:\Windows\System\MERTogv.exe
  2⤵
  PID:12580
- C:\Windows\System\dZXuHPW.exe
  C:\Windows\System\dZXuHPW.exe
  2⤵
  PID:12620
- C:\Windows\System\GpkAWaP.exe
  C:\Windows\System\GpkAWaP.exe
  2⤵
  PID:4324
- C:\Windows\System\QgDSgPl.exe
  C:\Windows\System\QgDSgPl.exe
  2⤵
  PID:12800
- C:\Windows\System\HKJHWye.exe
  C:\Windows\System\HKJHWye.exe
  2⤵
  PID:12860
- C:\Windows\System\MyDqQTh.exe
  C:\Windows\System\MyDqQTh.exe
  2⤵
  PID:11356
- C:\Windows\System\vOmSuyA.exe
  C:\Windows\System\vOmSuyA.exe
  2⤵
  PID:11496
- C:\Windows\System\utkecBH.exe
  C:\Windows\System\utkecBH.exe
  2⤵
  PID:9524
- C:\Windows\System\sdxRLJx.exe
  C:\Windows\System\sdxRLJx.exe
  2⤵
  PID:9628
- C:\Windows\System\GRwuuns.exe
  C:\Windows\System\GRwuuns.exe
  2⤵
  PID:2316
- C:\Windows\System\sooovwr.exe
  C:\Windows\System\sooovwr.exe
  2⤵
  PID:12208
- C:\Windows\System\CZpuStO.exe
  C:\Windows\System\CZpuStO.exe
  2⤵
  PID:12820
- C:\Windows\System\yYUaTGq.exe
  C:\Windows\System\yYUaTGq.exe
  2⤵
  PID:3716
- C:\Windows\System\txzpaAZ.exe
  C:\Windows\System\txzpaAZ.exe
  2⤵
  PID:4888
- C:\Windows\System\nZdFEVe.exe
  C:\Windows\System\nZdFEVe.exe
  2⤵
  PID:9152
- C:\Windows\System\EUjhjnY.exe
  C:\Windows\System\EUjhjnY.exe
  2⤵
  PID:12556
- C:\Windows\System\nXLXCRm.exe
  C:\Windows\System\nXLXCRm.exe
  2⤵
  PID:8548
- C:\Windows\System\nMRIwVA.exe
  C:\Windows\System\nMRIwVA.exe
  2⤵
  PID:12428
- C:\Windows\System\NSvcUqi.exe
  C:\Windows\System\NSvcUqi.exe
  2⤵
  PID:5484
- C:\Windows\System\OjjJTsu.exe
  C:\Windows\System\OjjJTsu.exe
  2⤵
  PID:5472
- C:\Windows\System\OOPAajR.exe
  C:\Windows\System\OOPAajR.exe
  2⤵
  PID:13268
- C:\Windows\System\iBTywQz.exe
  C:\Windows\System\iBTywQz.exe
  2⤵
  PID:11308
- C:\Windows\System\qpkZrkl.exe
  C:\Windows\System\qpkZrkl.exe
  2⤵
  PID:5376
- C:\Windows\System\xvOnCft.exe
  C:\Windows\System\xvOnCft.exe
  2⤵
  PID:5224
- C:\Windows\System\LqBWMZC.exe
  C:\Windows\System\LqBWMZC.exe
  2⤵
  PID:11560
- C:\Windows\System\XNHBoST.exe
  C:\Windows\System\XNHBoST.exe
  2⤵
  PID:11880
- C:\Windows\System\lGbHlvC.exe
  C:\Windows\System\lGbHlvC.exe
  2⤵
  PID:12840
- C:\Windows\System\XPtyuoJ.exe
  C:\Windows\System\XPtyuoJ.exe
  2⤵
  PID:11500
- C:\Windows\System\nFKMaDj.exe
  C:\Windows\System\nFKMaDj.exe
  2⤵
  PID:10980
- C:\Windows\System\fwspkps.exe
  C:\Windows\System\fwspkps.exe
  2⤵
  PID:12404
- C:\Windows\System\ebOZSyy.exe
  C:\Windows\System\ebOZSyy.exe
  2⤵
  PID:12848
- C:\Windows\System\uCKuBeu.exe
  C:\Windows\System\uCKuBeu.exe
  2⤵
  PID:11416
- C:\Windows\System\oqdGTAb.exe
  C:\Windows\System\oqdGTAb.exe
  2⤵
  PID:4444
- C:\Windows\System\eeNafgp.exe
  C:\Windows\System\eeNafgp.exe
  2⤵
  PID:11876
- C:\Windows\System\KqGiCzr.exe
  C:\Windows\System\KqGiCzr.exe
  2⤵
  PID:10704
- C:\Windows\System\UrRILMn.exe
  C:\Windows\System\UrRILMn.exe
  2⤵
  PID:8752
- C:\Windows\System\NJElOgE.exe
  C:\Windows\System\NJElOgE.exe
  2⤵
  PID:10584
- C:\Windows\System\QRidNsy.exe
  C:\Windows\System\QRidNsy.exe
  2⤵
  PID:4048
- C:\Windows\System\DBuOYut.exe
  C:\Windows\System\DBuOYut.exe
  2⤵
  PID:11960
- C:\Windows\System\DdQVmrY.exe
  C:\Windows\System\DdQVmrY.exe
  2⤵
  PID:3028
- C:\Windows\System\RHZxmZR.exe
  C:\Windows\System\RHZxmZR.exe
  2⤵
  PID:8620
- C:\Windows\System\odgObWF.exe
  C:\Windows\System\odgObWF.exe
  2⤵
  PID:12768
- C:\Windows\System\Villioc.exe
  C:\Windows\System\Villioc.exe
  2⤵
  PID:4956
- C:\Windows\System\hTzqcsm.exe
  C:\Windows\System\hTzqcsm.exe
  2⤵
  PID:5508
- C:\Windows\System\yOWZdJm.exe
  C:\Windows\System\yOWZdJm.exe
  2⤵
  PID:10148
- C:\Windows\System\BcHwrGb.exe
  C:\Windows\System\BcHwrGb.exe
  2⤵
  PID:12148
- C:\Windows\System\zDljjdc.exe
  C:\Windows\System\zDljjdc.exe
  2⤵
  PID:13184
- C:\Windows\System\ZPOCync.exe
  C:\Windows\System\ZPOCync.exe
  2⤵
  PID:10420
- C:\Windows\System\KGHblLr.exe
  C:\Windows\System\KGHblLr.exe
  2⤵
  PID:4228
- C:\Windows\System\OUwzwDZ.exe
  C:\Windows\System\OUwzwDZ.exe
  2⤵
  PID:5116
- C:\Windows\System\lSAQDfw.exe
  C:\Windows\System\lSAQDfw.exe
  2⤵
  PID:5764
- C:\Windows\System\EqercoM.exe
  C:\Windows\System\EqercoM.exe
  2⤵
  PID:2768
- C:\Windows\System\ZVrwnGf.exe
  C:\Windows\System\ZVrwnGf.exe
  2⤵
  PID:9100
- C:\Windows\System\UPkAZrt.exe
  C:\Windows\System\UPkAZrt.exe
  2⤵
  PID:800
- C:\Windows\System\lKEHFsZ.exe
  C:\Windows\System\lKEHFsZ.exe
  2⤵
  PID:1860
- C:\Windows\System\IzAtEqC.exe
  C:\Windows\System\IzAtEqC.exe
  2⤵
  PID:10976
- C:\Windows\System\UGVwYNs.exe
  C:\Windows\System\UGVwYNs.exe
  2⤵
  PID:1604
- C:\Windows\System\qBEdPgz.exe
  C:\Windows\System\qBEdPgz.exe
  2⤵
  PID:2512
- C:\Windows\System\QLuBVHv.exe
  C:\Windows\System\QLuBVHv.exe
  2⤵
  PID:8240
- C:\Windows\System\QHFLRGn.exe
  C:\Windows\System\QHFLRGn.exe
  2⤵
  PID:11240
- C:\Windows\System\EsFYvbK.exe
  C:\Windows\System\EsFYvbK.exe
  2⤵
  PID:12300
- C:\Windows\System\xWlUdbe.exe
  C:\Windows\System\xWlUdbe.exe
  2⤵
  PID:212
- C:\Windows\System\GZJckyq.exe
  C:\Windows\System\GZJckyq.exe
  2⤵
  PID:3464
- C:\Windows\System\gXcNmku.exe
  C:\Windows\System\gXcNmku.exe
  2⤵
  PID:3144
- C:\Windows\System\svcukFT.exe
  C:\Windows\System\svcukFT.exe
  2⤵
  PID:7048
- C:\Windows\System\znRMpxC.exe
  C:\Windows\System\znRMpxC.exe
  2⤵
  PID:12088
- C:\Windows\System\LLCDdrA.exe
  C:\Windows\System\LLCDdrA.exe
  2⤵
  PID:3672
- C:\Windows\System\YtmgMLd.exe
  C:\Windows\System\YtmgMLd.exe
  2⤵
  PID:3632
- C:\Windows\System\JZrcxjg.exe
  C:\Windows\System\JZrcxjg.exe
  2⤵
  PID:10504
- C:\Windows\System\JgWjndJ.exe
  C:\Windows\System\JgWjndJ.exe
  2⤵
  PID:1680
- C:\Windows\System\OEKmNfO.exe
  C:\Windows\System\OEKmNfO.exe
  2⤵
  PID:3060
- C:\Windows\System\bZWTffd.exe
  C:\Windows\System\bZWTffd.exe
  2⤵
  PID:11896
- C:\Windows\System\pZUtAZi.exe
  C:\Windows\System\pZUtAZi.exe
  2⤵
  PID:11600
- C:\Windows\System\eZYMqbU.exe
  C:\Windows\System\eZYMqbU.exe
  2⤵
  PID:3036
- C:\Windows\System\vLwzfsK.exe
  C:\Windows\System\vLwzfsK.exe
  2⤵
  PID:1972
- C:\Windows\System\suSkABy.exe
  C:\Windows\System\suSkABy.exe
  2⤵
  PID:8216
- C:\Windows\System\nDHsuHz.exe
  C:\Windows\System\nDHsuHz.exe
  2⤵
  PID:10264
- C:\Windows\System\OWvYjzU.exe
  C:\Windows\System\OWvYjzU.exe
  2⤵
  PID:13328
- C:\Windows\System\DjYBHYH.exe
  C:\Windows\System\DjYBHYH.exe
  2⤵
  PID:13344
- C:\Windows\System\PAPiDfh.exe
  C:\Windows\System\PAPiDfh.exe
  2⤵
  PID:13360
- C:\Windows\System\LXCLRVJ.exe
  C:\Windows\System\LXCLRVJ.exe
  2⤵
  PID:13380
- C:\Windows\System\XvgKFgW.exe
  C:\Windows\System\XvgKFgW.exe
  2⤵
  PID:13396
- C:\Windows\System\puWVasq.exe
  C:\Windows\System\puWVasq.exe
  2⤵
  PID:13416
- C:\Windows\System\TPdIWxT.exe
  C:\Windows\System\TPdIWxT.exe
  2⤵
  PID:13432
- C:\Windows\System\EWXcCrX.exe
  C:\Windows\System\EWXcCrX.exe
  2⤵
  PID:13448
- C:\Windows\System\zGHvMKO.exe
  C:\Windows\System\zGHvMKO.exe
  2⤵
  PID:13464
- C:\Windows\System\OaPeFSM.exe
  C:\Windows\System\OaPeFSM.exe
  2⤵
  PID:13480
- C:\Windows\System\sARIvJc.exe
  C:\Windows\System\sARIvJc.exe
  2⤵
  PID:13496
- C:\Windows\System\mjzYIND.exe
  C:\Windows\System\mjzYIND.exe
  2⤵
  PID:13512
- C:\Windows\System\JgMesPM.exe
  C:\Windows\System\JgMesPM.exe
  2⤵
  PID:13532
- C:\Windows\System\XDrkvDZ.exe
  C:\Windows\System\XDrkvDZ.exe
  2⤵
  PID:13548
- C:\Windows\System\WYQzkte.exe
  C:\Windows\System\WYQzkte.exe
  2⤵
  PID:13564
- C:\Windows\System\mWEzuMC.exe
  C:\Windows\System\mWEzuMC.exe
  2⤵
  PID:13580
- C:\Windows\System\aoBpZcV.exe
  C:\Windows\System\aoBpZcV.exe
  2⤵
  PID:13596
- C:\Windows\System\ArbtWrC.exe
  C:\Windows\System\ArbtWrC.exe
  2⤵
  PID:13612
- C:\Windows\System\AWWUNdT.exe
  C:\Windows\System\AWWUNdT.exe
  2⤵
  PID:13628
- C:\Windows\System\ORAfqME.exe
  C:\Windows\System\ORAfqME.exe
  2⤵
  PID:13644
- C:\Windows\System\OMMXQPR.exe
  C:\Windows\System\OMMXQPR.exe
  2⤵
  PID:13660
- C:\Windows\System\BkNjnpC.exe
  C:\Windows\System\BkNjnpC.exe
  2⤵
  PID:13676
- C:\Windows\System\ihcrQuS.exe
  C:\Windows\System\ihcrQuS.exe
  2⤵
  PID:13692
- C:\Windows\System\kyKhJXn.exe
  C:\Windows\System\kyKhJXn.exe
  2⤵
  PID:13708
- C:\Windows\System\GTOLnLp.exe
  C:\Windows\System\GTOLnLp.exe
  2⤵
  PID:13724
- C:\Windows\System\immkorw.exe
  C:\Windows\System\immkorw.exe
  2⤵
  PID:13740
- C:\Windows\System\GORdpmM.exe
  C:\Windows\System\GORdpmM.exe
  2⤵
  PID:13756
- C:\Windows\System\hVpNCIg.exe
  C:\Windows\System\hVpNCIg.exe
  2⤵
  PID:13772
- C:\Windows\System\sPELJgO.exe
  C:\Windows\System\sPELJgO.exe
  2⤵
  PID:13788
- C:\Windows\System\ACmWPcA.exe
  C:\Windows\System\ACmWPcA.exe
  2⤵
  PID:13812
- C:\Windows\System\bPcKvOZ.exe
  C:\Windows\System\bPcKvOZ.exe
  2⤵
  PID:13828
- C:\Windows\System\VNMpHMw.exe
  C:\Windows\System\VNMpHMw.exe
  2⤵
  PID:13844
- C:\Windows\System\XHuVjCX.exe
  C:\Windows\System\XHuVjCX.exe
  2⤵
  PID:13860
- C:\Windows\System\OnoKOOk.exe
  C:\Windows\System\OnoKOOk.exe
  2⤵
  PID:13876
- C:\Windows\System\iqoaGev.exe
  C:\Windows\System\iqoaGev.exe
  2⤵
  PID:13892
- C:\Windows\System\sAbWOOp.exe
  C:\Windows\System\sAbWOOp.exe
  2⤵
  PID:13908
- C:\Windows\System\DQSINCO.exe
  C:\Windows\System\DQSINCO.exe
  2⤵
  PID:13924
- C:\Windows\System\kFOrlff.exe
  C:\Windows\System\kFOrlff.exe
  2⤵
  PID:13944
- C:\Windows\System\zcoqJQT.exe
  C:\Windows\System\zcoqJQT.exe
  2⤵
  PID:13960
- C:\Windows\System\ogYnKLA.exe
  C:\Windows\System\ogYnKLA.exe
  2⤵
  PID:13976
- C:\Windows\System\JUsHRBM.exe
  C:\Windows\System\JUsHRBM.exe
  2⤵
  PID:13992
- C:\Windows\System\ZWLQmfg.exe
  C:\Windows\System\ZWLQmfg.exe
  2⤵
  PID:14008
- C:\Windows\System\afnoxUp.exe
  C:\Windows\System\afnoxUp.exe
  2⤵
  PID:14028
- C:\Windows\System\ewpIucE.exe
  C:\Windows\System\ewpIucE.exe
  2⤵
  PID:14048
- C:\Windows\System\wcVaYpH.exe
  C:\Windows\System\wcVaYpH.exe
  2⤵
  PID:14064
- C:\Windows\System\XNRMUhF.exe
  C:\Windows\System\XNRMUhF.exe
  2⤵
  PID:14080
- C:\Windows\System\SFdAVaC.exe
  C:\Windows\System\SFdAVaC.exe
  2⤵
  PID:14096
- C:\Windows\System\vlArrWM.exe
  C:\Windows\System\vlArrWM.exe
  2⤵
  PID:14116
- C:\Windows\System\YTFlDAg.exe
  C:\Windows\System\YTFlDAg.exe
  2⤵
  PID:14132
- C:\Windows\System\CQpiVKL.exe
  C:\Windows\System\CQpiVKL.exe
  2⤵
  PID:14148
- C:\Windows\System\IEXApPe.exe
  C:\Windows\System\IEXApPe.exe
  2⤵
  PID:14164
- C:\Windows\System\oyqQIsc.exe
  C:\Windows\System\oyqQIsc.exe
  2⤵
  PID:14180
- C:\Windows\System\DQIYBot.exe
  C:\Windows\System\DQIYBot.exe
  2⤵
  PID:14196
- C:\Windows\System\AEBbuAh.exe
  C:\Windows\System\AEBbuAh.exe
  2⤵
  PID:14212
- C:\Windows\System\NmwJHBx.exe
  C:\Windows\System\NmwJHBx.exe
  2⤵
  PID:14228
- C:\Windows\System\imojzpv.exe
  C:\Windows\System\imojzpv.exe
  2⤵
  PID:14244
- C:\Windows\System\TeZpcLV.exe
  C:\Windows\System\TeZpcLV.exe
  2⤵
  PID:14264
- C:\Windows\System\AXKVqwn.exe
  C:\Windows\System\AXKVqwn.exe
  2⤵
  PID:13372
- C:\Windows\System\NToRIIR.exe
  C:\Windows\System\NToRIIR.exe
  2⤵
  PID:13412
- C:\Windows\System\AUZbkmw.exe
  C:\Windows\System\AUZbkmw.exe
  2⤵
  PID:13440
- C:\Windows\System\FyEEVZR.exe
  C:\Windows\System\FyEEVZR.exe
  2⤵
  PID:13472
- C:\Windows\System\WwWtUli.exe
  C:\Windows\System\WwWtUli.exe
  2⤵
  PID:13504
- C:\Windows\System\reSoUlg.exe
  C:\Windows\System\reSoUlg.exe
  2⤵
  PID:13604
- C:\Windows\System\iztDLAL.exe
  C:\Windows\System\iztDLAL.exe
  2⤵
  PID:13636
- C:\Windows\System\cgpFLhI.exe
  C:\Windows\System\cgpFLhI.exe
  2⤵
  PID:13672
- C:\Windows\System\JIqYJGI.exe
  C:\Windows\System\JIqYJGI.exe
  2⤵
  PID:13704
- C:\Windows\System\mBVLTEF.exe
  C:\Windows\System\mBVLTEF.exe
  2⤵
  PID:13736
- C:\Windows\System\BIfluQv.exe
  C:\Windows\System\BIfluQv.exe
  2⤵
  PID:13764
- C:\Windows\System\xERnvyD.exe
  C:\Windows\System\xERnvyD.exe
  2⤵
  PID:13800
- C:\Windows\System\vMoHPVI.exe
  C:\Windows\System\vMoHPVI.exe
  2⤵
  PID:13840
- C:\Windows\System\DwmaRzn.exe
  C:\Windows\System\DwmaRzn.exe
  2⤵
  PID:13872
- C:\Windows\System\yOgXldv.exe
  C:\Windows\System\yOgXldv.exe
  2⤵
  PID:13904
- C:\Windows\System\MSIiVnB.exe
  C:\Windows\System\MSIiVnB.exe
  2⤵
  PID:13932
- C:\Windows\System\ZVrnZLB.exe
  C:\Windows\System\ZVrnZLB.exe
  2⤵
  PID:13968
- C:\Windows\System\iCQzWMU.exe
  C:\Windows\System\iCQzWMU.exe
  2⤵
  PID:14000
- C:\Windows\System\XKHjFuk.exe
  C:\Windows\System\XKHjFuk.exe
  2⤵
  PID:14044
- C:\Windows\System\AglbOKr.exe
  C:\Windows\System\AglbOKr.exe
  2⤵
  PID:14072
- C:\Windows\System\neYdgjf.exe
  C:\Windows\System\neYdgjf.exe
  2⤵
  PID:14108
- C:\Windows\System\mprmmKx.exe
  C:\Windows\System\mprmmKx.exe
  2⤵
  PID:14140
- C:\Windows\System\LacmAyH.exe
  C:\Windows\System\LacmAyH.exe
  2⤵
  PID:14172
- C:\Windows\System\IKRQkSe.exe
  C:\Windows\System\IKRQkSe.exe
  2⤵
  PID:14204
- C:\Windows\System\eaBNZRo.exe
  C:\Windows\System\eaBNZRo.exe
  2⤵
  PID:14236
- C:\Windows\System\syCLZAw.exe
  C:\Windows\System\syCLZAw.exe
  2⤵
  PID:14288
- C:\Windows\System\kYSFffl.exe
  C:\Windows\System\kYSFffl.exe
  2⤵
  PID:14252
- C:\Windows\System\qIJRNOA.exe
  C:\Windows\System\qIJRNOA.exe
  2⤵
  PID:13424
- C:\Windows\System\aNQFKxg.exe
  C:\Windows\System\aNQFKxg.exe
  2⤵
  PID:14320
- C:\Windows\System\doANvFj.exe
  C:\Windows\System\doANvFj.exe
  2⤵
  PID:13336
- C:\Windows\System\vcxLrww.exe
  C:\Windows\System\vcxLrww.exe
  2⤵
  PID:13428
- C:\Windows\System\SCAPGfm.exe
  C:\Windows\System\SCAPGfm.exe
  2⤵
  PID:14312
- C:\Windows\System\WeFieOL.exe
  C:\Windows\System\WeFieOL.exe
  2⤵
  PID:14324
- C:\Windows\System\nITqHmq.exe
  C:\Windows\System\nITqHmq.exe
  2⤵
  PID:13320
- C:\Windows\System\CVUovom.exe
  C:\Windows\System\CVUovom.exe
  2⤵
  PID:13624
- C:\Windows\System\LCRPxXr.exe
  C:\Windows\System\LCRPxXr.exe
  2⤵
  PID:13492
- C:\Windows\System\aIUsICL.exe
  C:\Windows\System\aIUsICL.exe
  2⤵
  PID:13524
- C:\Windows\System\qqHZJTO.exe
  C:\Windows\System\qqHZJTO.exe
  2⤵
  PID:13652
- C:\Windows\System\CrwYdYY.exe
  C:\Windows\System\CrwYdYY.exe
  2⤵
  PID:13768
- C:\Windows\System\sRRdTlt.exe
  C:\Windows\System\sRRdTlt.exe
  2⤵
  PID:13836
- C:\Windows\System\YfvASbh.exe
  C:\Windows\System\YfvASbh.exe
  2⤵
  PID:13900
- C:\Windows\System\bimeFae.exe
  C:\Windows\System\bimeFae.exe
  2⤵
  PID:13956
- C:\Windows\System\qjzKkQS.exe
  C:\Windows\System\qjzKkQS.exe
  2⤵
  PID:14020
- C:\Windows\System\sYKEwzd.exe
  C:\Windows\System\sYKEwzd.exe
  2⤵
  PID:14092
- C:\Windows\System\AGUKlnM.exe
  C:\Windows\System\AGUKlnM.exe
  2⤵
  PID:14160
- C:\Windows\System\QqZOyge.exe
  C:\Windows\System\QqZOyge.exe
  2⤵
  PID:14224
- C:\Windows\System\CliszPJ.exe
  C:\Windows\System\CliszPJ.exe
  2⤵
  PID:14304
- C:\Windows\System\ZOVByZM.exe
  C:\Windows\System\ZOVByZM.exe
  2⤵
  PID:14272
- C:\Windows\System\jufMDzl.exe
  C:\Windows\System\jufMDzl.exe
  2⤵
  PID:13356
- C:\Windows\System\QwZrNPK.exe
  C:\Windows\System\QwZrNPK.exe
  2⤵
  PID:13528
- C:\Windows\System\JvLFSln.exe
  C:\Windows\System\JvLFSln.exe
  2⤵
  PID:13656
- C:\Windows\System\PqjlYHe.exe
  C:\Windows\System\PqjlYHe.exe
  2⤵
  PID:13688
- C:\Windows\System\vvPglbo.exe
  C:\Windows\System\vvPglbo.exe
  2⤵
  PID:13796
- C:\Windows\System\XjoEuIh.exe
  C:\Windows\System\XjoEuIh.exe
  2⤵
  PID:13984
- C:\Windows\System\klazfHL.exe
  C:\Windows\System\klazfHL.exe
  2⤵
  PID:14156
- C:\Windows\System\KZSqWzi.exe
  C:\Windows\System\KZSqWzi.exe
  2⤵
  PID:14276
- C:\Windows\System\UYyINeU.exe
  C:\Windows\System\UYyINeU.exe
  2⤵
  PID:13352
- C:\Windows\System\SwEdECQ.exe
  C:\Windows\System\SwEdECQ.exe
  2⤵
  PID:13152
- C:\Windows\System\ydMRCnk.exe
  C:\Windows\System\ydMRCnk.exe
  2⤵
  PID:13732
- C:\Windows\System\BqDLBpV.exe
  C:\Windows\System\BqDLBpV.exe
  2⤵
  PID:14056
- C:\Windows\System\eCesPCZ.exe
  C:\Windows\System\eCesPCZ.exe
  2⤵
  PID:14220
- C:\Windows\System\GpCuVbD.exe
  C:\Windows\System\GpCuVbD.exe
  2⤵
  PID:13544
- C:\Windows\System\BayEIEb.exe
  C:\Windows\System\BayEIEb.exe
  2⤵
  PID:13920
- C:\Windows\System\pKPQaNO.exe
  C:\Windows\System\pKPQaNO.exe
  2⤵
  PID:13588
- C:\Windows\System\paDadlS.exe
  C:\Windows\System\paDadlS.exe
  2⤵
  PID:14348
- C:\Windows\System\FNPgGJG.exe
  C:\Windows\System\FNPgGJG.exe
  2⤵
  PID:14376
- C:\Windows\System\wMwDSPQ.exe
  C:\Windows\System\wMwDSPQ.exe
  2⤵
  PID:14396
- C:\Windows\System\YdCZseg.exe
  C:\Windows\System\YdCZseg.exe
  2⤵
  PID:14416
- C:\Windows\System\yOtQYze.exe
  C:\Windows\System\yOtQYze.exe
  2⤵
  PID:14436
- C:\Windows\System\dZMZPiH.exe
  C:\Windows\System\dZMZPiH.exe
  2⤵
  PID:15128
- C:\Windows\System\rIMXajA.exe
  C:\Windows\System\rIMXajA.exe
  2⤵
  PID:15148
- C:\Windows\System\JAPuICo.exe
  C:\Windows\System\JAPuICo.exe
  2⤵
  PID:15164
- C:\Windows\System\zYbJfiM.exe
  C:\Windows\System\zYbJfiM.exe
  2⤵
  PID:15216
- C:\Windows\System\LNKInjm.exe
  C:\Windows\System\LNKInjm.exe
  2⤵
  PID:15240
- C:\Windows\System\WohAPRn.exe
  C:\Windows\System\WohAPRn.exe
  2⤵
  PID:15264
- C:\Windows\System\JyjkmMP.exe
  C:\Windows\System\JyjkmMP.exe
  2⤵
  PID:15284
- C:\Windows\System\AEJGrEZ.exe
  C:\Windows\System\AEJGrEZ.exe
  2⤵
  PID:15308
- C:\Windows\System\PqpKmYZ.exe
  C:\Windows\System\PqpKmYZ.exe
  2⤵
  PID:15324
- C:\Windows\System\RCLEujx.exe
  C:\Windows\System\RCLEujx.exe
  2⤵
  PID:5072
- C:\Windows\System\FwLIhAT.exe
  C:\Windows\System\FwLIhAT.exe
  2⤵
  PID:14340
- C:\Windows\System\njvgPek.exe
  C:\Windows\System\njvgPek.exe
  2⤵
  PID:14372
- C:\Windows\System\fsEjZUI.exe
  C:\Windows\System\fsEjZUI.exe
  2⤵
  PID:14408
- C:\Windows\System\tvZyJZa.exe
  C:\Windows\System\tvZyJZa.exe
  2⤵
  PID:14444
- C:\Windows\System\aaYksUl.exe
  C:\Windows\System\aaYksUl.exe
  2⤵
  PID:14464
- C:\Windows\System\KheSFkD.exe
  C:\Windows\System\KheSFkD.exe
  2⤵
  PID:14492
- C:\Windows\System\egULGyZ.exe
  C:\Windows\System\egULGyZ.exe
  2⤵
  PID:14508
- C:\Windows\System\TbSLzLF.exe
  C:\Windows\System\TbSLzLF.exe
  2⤵
  PID:14544
- C:\Windows\System\FVSxOZy.exe
  C:\Windows\System\FVSxOZy.exe
  2⤵
  PID:13952
- C:\Windows\System\uGrqeZt.exe
  C:\Windows\System\uGrqeZt.exe
  2⤵
  PID:14568
- C:\Windows\System\lmnGCKX.exe
  C:\Windows\System\lmnGCKX.exe
  2⤵
  PID:14584
- C:\Windows\System\olxPDwY.exe
  C:\Windows\System\olxPDwY.exe
  2⤵
  PID:14592
- C:\Windows\System\yowrcWF.exe
  C:\Windows\System\yowrcWF.exe
  2⤵
  PID:14620
- C:\Windows\System\IqxGGrg.exe
  C:\Windows\System\IqxGGrg.exe
  2⤵
  PID:14192
- C:\Windows\System\nJIoxEY.exe
  C:\Windows\System\nJIoxEY.exe
  2⤵
  PID:14668
- C:\Windows\System\QnJTsFm.exe
  C:\Windows\System\QnJTsFm.exe
  2⤵
  PID:14688
- C:\Windows\System\DkhbXCF.exe
  C:\Windows\System\DkhbXCF.exe
  2⤵
  PID:14704
- C:\Windows\System\bhRXlYY.exe
  C:\Windows\System\bhRXlYY.exe
  2⤵
  PID:14724
- C:\Windows\System\ELloOen.exe
  C:\Windows\System\ELloOen.exe
  2⤵
  PID:14732
- C:\Windows\System\VLehoWx.exe
  C:\Windows\System\VLehoWx.exe
  2⤵
  PID:2504
- C:\Windows\System\TMTDXPA.exe
  C:\Windows\System\TMTDXPA.exe
  2⤵
  PID:14752
- C:\Windows\System\CYXnZMl.exe
  C:\Windows\System\CYXnZMl.exe
  2⤵
  PID:14772
- C:\Windows\System\pFHNIST.exe
  C:\Windows\System\pFHNIST.exe
  2⤵
  PID:14808
- C:\Windows\System\lMmBcnT.exe
  C:\Windows\System\lMmBcnT.exe
  2⤵
  PID:14824
- C:\Windows\System\NjabPPK.exe
  C:\Windows\System\NjabPPK.exe
  2⤵
  PID:14840
- C:\Windows\System\gJXOPlR.exe
  C:\Windows\System\gJXOPlR.exe
  2⤵
  PID:14864
- C:\Windows\System\KGHzrNX.exe
  C:\Windows\System\KGHzrNX.exe
  2⤵
  PID:14880
- C:\Windows\System\jOWUbcZ.exe
  C:\Windows\System\jOWUbcZ.exe
  2⤵
  PID:14956
- C:\Windows\System\HLRlQkG.exe
  C:\Windows\System\HLRlQkG.exe
  2⤵
  PID:14988
- C:\Windows\System\zVYJOEP.exe
  C:\Windows\System\zVYJOEP.exe
  2⤵
  PID:15024
- C:\Windows\System\NbNFBYk.exe
  C:\Windows\System\NbNFBYk.exe
  2⤵
  PID:15060
- C:\Windows\System\EjUPjkh.exe
  C:\Windows\System\EjUPjkh.exe
  2⤵
  PID:15080
- C:\Windows\System\MeZtvHr.exe
  C:\Windows\System\MeZtvHr.exe
  2⤵
  PID:15088
- C:\Windows\System\DOfrAkO.exe
  C:\Windows\System\DOfrAkO.exe
  2⤵
  PID:2072
- C:\Windows\System\jyCduyj.exe
  C:\Windows\System\jyCduyj.exe
  2⤵
  PID:15120
- C:\Windows\System\ngoNEAP.exe
  C:\Windows\System\ngoNEAP.exe
  2⤵
  PID:15140
- C:\Windows\System\ISihDsB.exe
  C:\Windows\System\ISihDsB.exe
  2⤵
  PID:15172
- C:\Windows\System\nOqNtPt.exe
  C:\Windows\System\nOqNtPt.exe
  2⤵
  PID:15196
- C:\Windows\System\wTrKuKw.exe
  C:\Windows\System\wTrKuKw.exe
  2⤵
  PID:184
- C:\Windows\System\GzuDElD.exe
  C:\Windows\System\GzuDElD.exe
  2⤵
  PID:1732
- C:\Windows\System\tkxNDgJ.exe
  C:\Windows\System\tkxNDgJ.exe
  2⤵
  PID:768
- C:\Windows\System\zWVbRtP.exe
  C:\Windows\System\zWVbRtP.exe
  2⤵
  PID:15272
- C:\Windows\System\hBxzVxg.exe
  C:\Windows\System\hBxzVxg.exe
  2⤵
  PID:15316
- C:\Windows\System\sjucFSL.exe
  C:\Windows\System\sjucFSL.exe
  2⤵
  PID:15340
- C:\Windows\System\LEiBpdt.exe
  C:\Windows\System\LEiBpdt.exe
  2⤵
  PID:4476
- C:\Windows\System\OJWWcvu.exe
  C:\Windows\System\OJWWcvu.exe
  2⤵
  PID:14364
- C:\Windows\System\ZGBLZqp.exe
  C:\Windows\System\ZGBLZqp.exe
  2⤵
  PID:14392
- C:\Windows\System\RUaItDH.exe
  C:\Windows\System\RUaItDH.exe
  2⤵
  PID:2760
- C:\Windows\System\jXXVRkq.exe
  C:\Windows\System\jXXVRkq.exe
  2⤵
  PID:14456
- C:\Windows\System\KilMFuZ.exe
  C:\Windows\System\KilMFuZ.exe
  2⤵
  PID:14480
- C:\Windows\System\dHEQQps.exe
  C:\Windows\System\dHEQQps.exe
  2⤵
  PID:5052
- C:\Windows\System\ItnFhZZ.exe
  C:\Windows\System\ItnFhZZ.exe
  2⤵
  PID:4460
- C:\Windows\System\JDDYphi.exe
  C:\Windows\System\JDDYphi.exe
  2⤵
  PID:14560
- C:\Windows\System\UKXaMys.exe
  C:\Windows\System\UKXaMys.exe
  2⤵
  PID:368
- C:\Windows\System\wLkPced.exe
  C:\Windows\System\wLkPced.exe
  2⤵
  PID:14632
- C:\Windows\System\tHLavGf.exe
  C:\Windows\System\tHLavGf.exe
  2⤵
  PID:14652
- C:\Windows\System\VZVlbzu.exe
  C:\Windows\System\VZVlbzu.exe
  2⤵
  PID:14596
- C:\Windows\System\lkBeISU.exe
  C:\Windows\System\lkBeISU.exe
  2⤵
  PID:4860
- C:\Windows\System\ToQNZBB.exe
  C:\Windows\System\ToQNZBB.exe
  2⤵
  PID:14600
- C:\Windows\System\LmYEnNf.exe
  C:\Windows\System\LmYEnNf.exe
  2⤵
  PID:4308
- C:\Windows\System\hiCHOUW.exe
  C:\Windows\System\hiCHOUW.exe
  2⤵
  PID:3484
- C:\Windows\System\vpqMVrA.exe
  C:\Windows\System\vpqMVrA.exe
  2⤵
  PID:14728
- C:\Windows\System\JosZBIw.exe
  C:\Windows\System\JosZBIw.exe
  2⤵
  PID:4812
- C:\Windows\System\fZGnORZ.exe
  C:\Windows\System\fZGnORZ.exe
  2⤵
  PID:14792
- C:\Windows\System\XmOKUQY.exe
  C:\Windows\System\XmOKUQY.exe
  2⤵
  PID:3216
- C:\Windows\System\ITnhSgI.exe
  C:\Windows\System\ITnhSgI.exe
  2⤵
  PID:1684
- C:\Windows\System\rRDfxfw.exe
  C:\Windows\System\rRDfxfw.exe
  2⤵
  PID:4588
- C:\Windows\System\kYQkyLU.exe
  C:\Windows\System\kYQkyLU.exe
  2⤵
  PID:8696
- C:\Windows\System\ajNSkzU.exe
  C:\Windows\System\ajNSkzU.exe
  2⤵
  PID:8900
- C:\Windows\System\JYBzvAZ.exe
  C:\Windows\System\JYBzvAZ.exe
  2⤵
  PID:4540
- C:\Windows\System\NQLbijL.exe
  C:\Windows\System\NQLbijL.exe
  2⤵
  PID:1616
- C:\Windows\System\tgqmpOe.exe
  C:\Windows\System\tgqmpOe.exe
  2⤵
  PID:4712
- C:\Windows\System\YHzjSYe.exe
  C:\Windows\System\YHzjSYe.exe
  2⤵
  PID:4604
- C:\Windows\System\aqOOESi.exe
  C:\Windows\System\aqOOESi.exe
  2⤵
  PID:2740
- C:\Windows\System\Deirovs.exe
  C:\Windows\System\Deirovs.exe
  2⤵
  PID:4864
- C:\Windows\System\QYyKObA.exe
  C:\Windows\System\QYyKObA.exe
  2⤵
  PID:15084
- C:\Windows\System\dyYVHVI.exe
  C:\Windows\System\dyYVHVI.exe
  2⤵
  PID:15104
- C:\Windows\System\rNFrYIc.exe
  C:\Windows\System\rNFrYIc.exe
  2⤵
  PID:15180
- C:\Windows\System\HEjheWX.exe
  C:\Windows\System\HEjheWX.exe
  2⤵
  PID:15200
- C:\Windows\System\XXvhPVn.exe
  C:\Windows\System\XXvhPVn.exe
  2⤵
  PID:14968
- C:\Windows\System\diqvdjK.exe
  C:\Windows\System\diqvdjK.exe
  2⤵
  PID:14976
- C:\Windows\System\hJQuQXD.exe
  C:\Windows\System\hJQuQXD.exe
  2⤵
  PID:15016
- C:\Windows\System\RGMMPwt.exe
  C:\Windows\System\RGMMPwt.exe
  2⤵
  PID:15040
- C:\Windows\System\QUYTEgv.exe
  C:\Windows\System\QUYTEgv.exe
  2⤵
  PID:1456
- C:\Windows\System\NLWvDIO.exe
  C:\Windows\System\NLWvDIO.exe
  2⤵
  PID:15156
- C:\Windows\System\ZoEJZQX.exe
  C:\Windows\System\ZoEJZQX.exe
  2⤵
  PID:5020
- C:\Windows\System\vwUFbak.exe
  C:\Windows\System\vwUFbak.exe
  2⤵
  PID:3120
- C:\Windows\System\UctEPdb.exe
  C:\Windows\System\UctEPdb.exe
  2⤵
  PID:5364
- C:\Windows\System\vBYDAeB.exe
  C:\Windows\System\vBYDAeB.exe
  2⤵
  PID:5168
- C:\Windows\System\dIErDBX.exe
  C:\Windows\System\dIErDBX.exe
  2⤵
  PID:1576
- C:\Windows\System\bCXJCrP.exe
  C:\Windows\System\bCXJCrP.exe
  2⤵
  PID:5100
- C:\Windows\System\JufVRzH.exe
  C:\Windows\System\JufVRzH.exe
  2⤵
  PID:2756
- C:\Windows\System\jlVVrIe.exe
  C:\Windows\System\jlVVrIe.exe
  2⤵
  PID:14516
- C:\Windows\System\JnJKMRD.exe
  C:\Windows\System\JnJKMRD.exe
  2⤵
  PID:2380
- C:\Windows\System\FWCjodr.exe
  C:\Windows\System\FWCjodr.exe
  2⤵
  PID:14504
- C:\Windows\System\WTbiPDF.exe
  C:\Windows\System\WTbiPDF.exe
  2⤵
  PID:5432
- C:\Windows\System\HoiBNwC.exe
  C:\Windows\System\HoiBNwC.exe
  2⤵
  PID:14616
- C:\Windows\System\EMUSwiB.exe
  C:\Windows\System\EMUSwiB.exe
  2⤵
  PID:15208
- C:\Windows\System\QtcvUVe.exe
  C:\Windows\System\QtcvUVe.exe
  2⤵
  PID:14680
- C:\Windows\System\NmjmNwd.exe
  C:\Windows\System\NmjmNwd.exe
  2⤵
  PID:1928
- C:\Windows\System\WTveztQ.exe
  C:\Windows\System\WTveztQ.exe
  2⤵
  PID:14664
- C:\Windows\System\AkHXlyO.exe
  C:\Windows\System\AkHXlyO.exe
  2⤵
  PID:5392
- C:\Windows\System\QOkDwaM.exe
  C:\Windows\System\QOkDwaM.exe
  2⤵
  PID:4040
- C:\Windows\System\FjQAFUn.exe
  C:\Windows\System\FjQAFUn.exe
  2⤵
  PID:14476
- C:\Windows\System\jTCsnhO.exe
  C:\Windows\System\jTCsnhO.exe
  2⤵
  PID:14488
- C:\Windows\System\CanbmLM.exe
  C:\Windows\System\CanbmLM.exe
  2⤵
  PID:4372
- C:\Windows\System\XmUoLoq.exe
  C:\Windows\System\XmUoLoq.exe
  2⤵
  PID:2244
- C:\Windows\System\dRUMpEl.exe
  C:\Windows\System\dRUMpEl.exe
  2⤵
  PID:15044
- C:\Windows\System\CBnUBPJ.exe
  C:\Windows\System\CBnUBPJ.exe
  2⤵
  PID:14996
- C:\Windows\System\lNGWyyD.exe
  C:\Windows\System\lNGWyyD.exe
  2⤵
  PID:14524
- C:\Windows\System\PdDPkNk.exe
  C:\Windows\System\PdDPkNk.exe
  2⤵
  PID:4496
- C:\Windows\System\bKcPBdh.exe
  C:\Windows\System\bKcPBdh.exe
  2⤵
  PID:15204
- C:\Windows\System\ClKyeCe.exe
  C:\Windows\System\ClKyeCe.exe
  2⤵
  PID:1276
- C:\Windows\System\xEmUFQy.exe
  C:\Windows\System\xEmUFQy.exe
  2⤵
  PID:14696
- C:\Windows\System\opWCPEe.exe
  C:\Windows\System\opWCPEe.exe
  2⤵
  PID:6096
- C:\Windows\System\mmobwQA.exe
  C:\Windows\System\mmobwQA.exe
  2⤵
  PID:6088
- C:\Windows\System\RaUrRjg.exe
  C:\Windows\System\RaUrRjg.exe
  2⤵
  PID:6080
- C:\Windows\System\dVKunPt.exe
  C:\Windows\System\dVKunPt.exe
  2⤵
  PID:14356
- C:\Windows\System\fkKTYhh.exe
  C:\Windows\System\fkKTYhh.exe
  2⤵
  PID:15356
- C:\Windows\System\OCtLgQu.exe
  C:\Windows\System\OCtLgQu.exe
  2⤵
  PID:14484
- C:\Windows\System\KYbBZkH.exe
  C:\Windows\System\KYbBZkH.exe
  2⤵
  PID:2788
- C:\Windows\System\MbJqIgi.exe
  C:\Windows\System\MbJqIgi.exe
  2⤵
  PID:3004
- C:\Windows\System\jlwqNZu.exe
  C:\Windows\System\jlwqNZu.exe
  2⤵
  PID:6028
- C:\Windows\System\NcKdXzf.exe
  C:\Windows\System\NcKdXzf.exe
  2⤵
  PID:5264
- C:\Windows\System\tgmnmoI.exe
  C:\Windows\System\tgmnmoI.exe
  2⤵
  PID:6036
- C:\Windows\System\pgMRwOo.exe
  C:\Windows\System\pgMRwOo.exe
  2⤵
  PID:5356
- C:\Windows\System\LvQqofM.exe
  C:\Windows\System\LvQqofM.exe
  2⤵
  PID:14796
- C:\Windows\System\paqHvzO.exe
  C:\Windows\System\paqHvzO.exe
  2⤵
  PID:14640
- C:\Windows\System\nLxDRNC.exe
  C:\Windows\System\nLxDRNC.exe
  2⤵
  PID:14788
- C:\Windows\System\anhFLVF.exe
  C:\Windows\System\anhFLVF.exe
  2⤵
  PID:5412
- C:\Windows\System\pAbrWCC.exe
  C:\Windows\System\pAbrWCC.exe
  2⤵
  PID:4248
- C:\Windows\System\UmOAibi.exe
  C:\Windows\System\UmOAibi.exe
  2⤵
  PID:3676
- C:\Windows\System\SxFxLhr.exe
  C:\Windows\System\SxFxLhr.exe
  2⤵
  PID:15008
- C:\Windows\System\spovugM.exe
  C:\Windows\System\spovugM.exe
  2⤵
  PID:14424
- C:\Windows\System\ihZROvJ.exe
  C:\Windows\System\ihZROvJ.exe
  2⤵
  PID:14852
- C:\Windows\System\FIxJBYN.exe
  C:\Windows\System\FIxJBYN.exe
  2⤵
  PID:1468
- C:\Windows\System\acsiznE.exe
  C:\Windows\System\acsiznE.exe
  2⤵
  PID:744
- C:\Windows\System\szLRNic.exe
  C:\Windows\System\szLRNic.exe
  2⤵
  PID:15000
- C:\Windows\System\ghiUzQH.exe
  C:\Windows\System\ghiUzQH.exe
  2⤵
  PID:6364
- C:\Windows\System\adlCTkM.exe
  C:\Windows\System\adlCTkM.exe
  2⤵
  PID:1664
- C:\Windows\System\dqzxonO.exe
  C:\Windows\System\dqzxonO.exe
  2⤵
  PID:15228
- C:\Windows\System\SCFDeCS.exe
  C:\Windows\System\SCFDeCS.exe
  2⤵
  PID:14540
- C:\Windows\System\jAswRvp.exe
  C:\Windows\System\jAswRvp.exe
  2⤵
  PID:15124
- C:\Windows\System\xSOIElm.exe
  C:\Windows\System\xSOIElm.exe
  2⤵
  PID:5328
- C:\Windows\System\BYvyQBt.exe
  C:\Windows\System\BYvyQBt.exe
  2⤵
  PID:2436
- C:\Windows\System\oOyLZgZ.exe
  C:\Windows\System\oOyLZgZ.exe
  2⤵
  PID:6044
- C:\Windows\System\BkYUQfi.exe
  C:\Windows\System\BkYUQfi.exe
  2⤵
  PID:5372
- C:\Windows\System\gtcvrAK.exe
  C:\Windows\System\gtcvrAK.exe
  2⤵
  PID:6000
- C:\Windows\System\bJeFjzc.exe
  C:\Windows\System\bJeFjzc.exe
  2⤵
  PID:3156
- C:\Windows\System\siFzHCv.exe
  C:\Windows\System\siFzHCv.exe
  2⤵
  PID:4524
- C:\Windows\System\bPXSMEC.exe
  C:\Windows\System\bPXSMEC.exe
  2⤵
  PID:14844
- C:\Windows\System\SnBzTPs.exe
  C:\Windows\System\SnBzTPs.exe
  2⤵
  PID:5028
- C:\Windows\System\veuHeOb.exe
  C:\Windows\System\veuHeOb.exe
  2⤵
  PID:6008
- C:\Windows\System\HokljRN.exe
  C:\Windows\System\HokljRN.exe
  2⤵
  PID:14972
- C:\Windows\System\LNcqWNO.exe
  C:\Windows\System\LNcqWNO.exe
  2⤵
  PID:6052
- C:\Windows\System\MuFDmRN.exe
  C:\Windows\System\MuFDmRN.exe
  2⤵
  PID:6060
- C:\Windows\System\QhzWAnb.exe
  C:\Windows\System\QhzWAnb.exe
  2⤵
  PID:540
- C:\Windows\System\TIynIXg.exe
  C:\Windows\System\TIynIXg.exe
  2⤵
  PID:14780
- C:\Windows\System\SRqXnaL.exe
  C:\Windows\System\SRqXnaL.exe
  2⤵
  PID:14472
- C:\Windows\System\TqiFVzo.exe
  C:\Windows\System\TqiFVzo.exe
  2⤵
  PID:2848
- C:\Windows\System\pnoQIpI.exe
  C:\Windows\System\pnoQIpI.exe
  2⤵
  PID:14608
- C:\Windows\System\qHziPWg.exe
  C:\Windows\System\qHziPWg.exe
  2⤵
  PID:6332
- C:\Windows\System\ArVtklD.exe
  C:\Windows\System\ArVtklD.exe
  2⤵
  PID:3792
- C:\Windows\System\bcntBFK.exe
  C:\Windows\System\bcntBFK.exe
  2⤵
  PID:5160
- C:\Windows\System\BJtYJkL.exe
  C:\Windows\System\BJtYJkL.exe
  2⤵
  PID:724
- C:\Windows\System\UhARbPs.exe
  C:\Windows\System\UhARbPs.exe
  2⤵
  PID:14520
- C:\Windows\System\FpCpplI.exe
  C:\Windows\System\FpCpplI.exe
  2⤵
  PID:6864
- C:\Windows\System\nrqFwzl.exe
  C:\Windows\System\nrqFwzl.exe
  2⤵
  PID:15056
- C:\Windows\System\cyQShvW.exe
  C:\Windows\System\cyQShvW.exe
  2⤵
  PID:5908
- C:\Windows\System\zIjwTYV.exe
  C:\Windows\System\zIjwTYV.exe
  2⤵
  PID:7164
- C:\Windows\System\QjjQzkL.exe
  C:\Windows\System\QjjQzkL.exe
  2⤵
  PID:6412
- C:\Windows\System\DnQBAsP.exe
  C:\Windows\System\DnQBAsP.exe
  2⤵
  PID:6384
- C:\Windows\System\GjKoIJK.exe
  C:\Windows\System\GjKoIJK.exe
  2⤵
  PID:7156
- C:\Windows\System\PjPSlHm.exe
  C:\Windows\System\PjPSlHm.exe
  2⤵
  PID:7064
- C:\Windows\System\vFDVzzv.exe
  C:\Windows\System\vFDVzzv.exe
  2⤵
  PID:3688
- C:\Windows\System\BSHpqUd.exe
  C:\Windows\System\BSHpqUd.exe
  2⤵
  PID:6516
- C:\Windows\System\YyRPrAg.exe
  C:\Windows\System\YyRPrAg.exe
  2⤵
  PID:7084
- C:\Windows\System\wrlmAFG.exe
  C:\Windows\System\wrlmAFG.exe
  2⤵
  PID:7096
- C:\Windows\System\ZSPjCvK.exe
  C:\Windows\System\ZSPjCvK.exe
  2⤵
  PID:7108
- C:\Windows\System\sPkCPJb.exe
  C:\Windows\System\sPkCPJb.exe
  2⤵
  PID:2236
- C:\Windows\System\rdTQEQy.exe
  C:\Windows\System\rdTQEQy.exe
  2⤵
  PID:6320
- C:\Windows\System\RnxurEQ.exe
  C:\Windows\System\RnxurEQ.exe
  2⤵
  PID:5456
- C:\Windows\System\nZGtnrN.exe
  C:\Windows\System\nZGtnrN.exe
  2⤵
  PID:2444
- C:\Windows\System\akqDiOu.exe
  C:\Windows\System\akqDiOu.exe
  2⤵
  PID:14872
- C:\Windows\System\SmeskKF.exe
  C:\Windows\System\SmeskKF.exe
  2⤵
  PID:6112
- C:\Windows\System\dQYInkY.exe
  C:\Windows\System\dQYInkY.exe
  2⤵
  PID:13324

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 652 -p 8828 -ip 8828
1⤵
PID:10916

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 604 -p 10252 -ip 10252
1⤵
PID:11496

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 764 -p 10376 -ip 10376
1⤵
PID:12820

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 632 -p 11864 -ip 11864
1⤵
PID:4888

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 764 -p 12628 -ip 12628
1⤵
PID:9152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hdotqsmf.jsj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ERNEsij.exe

Filesize
1.9MB

MD5
5c6bbe483476d56d3f96f22bcd0dcba4

SHA1
52e73d32293f619a86e23707d6b43d242c8f2de2

SHA256
dab2fa746888606e8a5b5eb5a127e436a2e5062b522f2ea174851ef905712b45

SHA512
3e6f953746dd38e81fc73fbc1f3e6e952f7e8eb487f141b10fc0a21d033de10676a2d66ab5aaa2c66909b69a866c3808d730ce094e70b4b17a4c87bcac6f4018

Download Submit
C:\Windows\System\EtFibqF.exe

Filesize
1.9MB

MD5
1188d9ad99303653f9b6b902c04f2c4f

SHA1
363934d699a10372d413f1b3f0359ffb46f5f57b

SHA256
63ff92f818de45e941e4284abdba04a3f7c3d70fff30f83d0fa3ffee787354a5

SHA512
1256937c787eb4ac2b29640cb7652b53a5b5b3a5ad74d716974c59a63e7d8cacb0de46a35f579e81ab3bc8a87d6a6a8462284d32d6a960e1e07b6151e7cefdcb

Download Submit
C:\Windows\System\GefaAtE.exe

Filesize
1.9MB

MD5
7c2d157da4c3f848ff707422e1a84101

SHA1
b70bb7345f9d33820dcee08005d9b5c5f7f18749

SHA256
465bd7622877379d88368763ce4c856f2e5cc914c175d8a1be96e183b6c44a76

SHA512
7f010c6f35d6783f2754beb14cae19f8244e2a164fba2637a324091e1ab9069a3d9db0ddb21665f96b9d47c35f8768a9bef84fcc433b0739ccb2bc632663f2dd

Download Submit
C:\Windows\System\HRVqEIu.exe

Filesize
1.9MB

MD5
f716e014cfb0582e5d625e3b7e8742cd

SHA1
08d6549e4fbcb9e051c7d77701f0c88997271fab

SHA256
25377a3746a00e5e58fec3d73f46589e0a985e454ef6358e076929fa155f12c3

SHA512
da003aea81e8948e4a713c60b2ad979092514239adbd47b50fe8f962df54c05d7d3e745113448367c22e6dafbe68545a3db697ef2777b8d0e199b2e15723e0f7

Download Submit
C:\Windows\System\IuIoKYv.exe

Filesize
1.9MB

MD5
95f4bc50eb6cc6b305718d4b384ff2ff

SHA1
b8f9e343625a2f5c3d4aa4cb92c689b4a60a0a09

SHA256
298b25c3844596de4328ed05cbb1cc82030f5a8756848a78f7c457a4a49d49a7

SHA512
b4b4e3d11a8a6ddeffba7afe4475a4fffbbac8c5f6b53184566387d716fedac8193428f50fbb18ffd5ab4e49b3eec399205f1dcb0ce916314e4d624661736c2f

Download Submit
C:\Windows\System\KTUKOxS.exe

Filesize
1.9MB

MD5
83d6e8423b2b46ca01494f42f4606cb4

SHA1
4e714b4515a606583a5b997c05dc4e1b463ad3e9

SHA256
2c567396021f166822d4281d381dcd28bd1779c69789d58e44cc7af3c9e0a1f0

SHA512
2215cc45a39a2107779b8819048a92aaa9c5cda3fbdc84135a4044eef3ec91b35740381149b284482abcaba0695129edc18bd3ee2e2fb1537ff9652f9dfe4545

Download Submit
C:\Windows\System\LDMTvIo.exe

Filesize
1.9MB

MD5
295addd2296302c432225be37bd0b8e0

SHA1
46fcb8030a51ba7961ecfbb5213fe5518ec58cd8

SHA256
75b016f1c56017f1117b119e3a4dadb666bae65db8596e5fa4bb305eba090ead

SHA512
d7459b1464a9d44f0bf4f3da565bf7ecaee50260ca96c8da47a7f7baebe229ed1cfb469ba25822d8333d408c3b43ba0c5f9f10a8e13b2cc0a349954d4bb6beb7

Download Submit
C:\Windows\System\PXMVHLT.exe

Filesize
1.9MB

MD5
b3207f9634ddc639327c4eaf8db7c57d

SHA1
4d03580c3971888b2ebf56ad730d96c944f94a2a

SHA256
4492767f68b5e8c72ed21a19e7c955fc769dccab62ef0651f6c16fd21b6021ed

SHA512
463d9a2a89a9c7363ff38e07c6405f315751d00c8d74b68a472465127cb20b3cdbd18c8b968c725274637d5cc7557f9a54ad4a522d2a7725a9b3115c75949eed

Download Submit
C:\Windows\System\PseSOxd.exe

Filesize
1.9MB

MD5
98610aded6f043b6a58f459d80f8c887

SHA1
a49d73cc0e7d8128fa4b9c6ba14eb733ce7e800f

SHA256
63d0e8a356f66eb9767d4ba714f433b3ccf41d733f8f86cdaf6b431adbef10a1

SHA512
f501839459ef1ee97408332bf3a7a02337dd35a2d17a62fb4c18390b928e5bfd4eff6b6f092078a632657d9fb832887bd2c3a77b4436d605b41003dc9e165b05

Download Submit
C:\Windows\System\QZvRdvS.exe

Filesize
1.9MB

MD5
214837bb53850e2387801d58ce58c5ce

SHA1
d7b3b5e7b48d0ed8c4abf1dc77999632297089f2

SHA256
66878ca9bafcfbb915684ac79fe29d31e1cc4c83126134cbf6899d0038c7e562

SHA512
daeb58dc31b5c9ffe4f1684e90af8f05fe7f56f086238610ad552922e37a61aa66b3824173ee4e627cff1fecbb053cfb9ba312816e723b4fb06d0b91ea30678e

Download Submit
C:\Windows\System\RwxhuOu.exe

Filesize
1.9MB

MD5
a2d5e900dde3335f2cc6f5e4d4ca32b4

SHA1
d07ffce65a1cc45eb903d1cf9a5e96740ed02482

SHA256
344b2fd4729b831df4fb3cd1f1ba370ea2112988e5eb7748751d9f2e974a68a7

SHA512
1f15aed0a3b8afbf5bcbdd2c845b4ba6f68d0115e54ec4e2220a68546b41b4a3c1c99493de2131cdaea2a11df7d5d0d4c923a56d48aa64a4e47d519419281e53

Download Submit
C:\Windows\System\TDFEtAh.exe

Filesize
1.9MB

MD5
7edb450a49f54c438c4c302f1fa82ee1

SHA1
f625688f0b9539a62c7f8482fe023472c4e2d931

SHA256
cc2eda0cb30b896bc3f1b14610942b58068a3263951610a32c0c273cb744a914

SHA512
306553128f0eb5f99ab73d82f96cb54786afaedcff5a8a37cb5ba16485c0e224a3ce3e84ed61db62bce95238bde892c902e5c352fcbcd44fd8e22ca6dd37c404

Download Submit
C:\Windows\System\TUdykcf.exe

Filesize
1.9MB

MD5
62a97369da973bdd80943413e907c564

SHA1
6e7ce629eb739094f2c5f100ffe75800603a0864

SHA256
ecb0918c09b19290214465e12ac5e8e711c5b4692a3f4236a3721eaea8841160

SHA512
953421495bad50856dd0987c296b17184307eccc266a1df160c80c5d44a1c349f8dcfc0605e9fd5042b4cdc7af4279b68d0f50671de3fbe855880bf4231cded2

Download Submit
C:\Windows\System\WeXYQTu.exe

Filesize
1.9MB

MD5
b6512cb5c1d125680d10250b2ec7abfa

SHA1
9b0bd9d333a1859f08d7d43261601df59b65d689

SHA256
5c114bc12478bf8f14f197b5627ed0b81422a092e05ddd0f46ddb446414f651e

SHA512
e3a7323e32d3f8e7a9fa2a64dbd767a0540357ccc4172dbefcbc68e0384251631273343838bdf0d8290a26c2891b84d8486677912d836e34c20b99c6f260809a

Download Submit
C:\Windows\System\WvRLLPv.exe

Filesize
1.9MB

MD5
8b3b1e6e65c58ca74849575c0c1b204d

SHA1
40433c16261b66ca5186bd65119dad19648281d0

SHA256
c91f92901231e061a31002094fe021c988fca37f59571d37ddb76a893a8f65b6

SHA512
762faf1ab90a5569ecad84b679eb6276b29794f33fab349646846d3263728a9283d11576ab800eecfbeae9679d4af3262ec81ced8f0f9a806eed9089620e60c5

Download Submit
C:\Windows\System\ZbkNEmh.exe

Filesize
1.9MB

MD5
341de071e01d6ead827f7d7d69eb74b2

SHA1
7a2e7cc04783146ff9c2c613f1bfee9c21414514

SHA256
dd93d7a16b449aeca900ad3faf5a80c9853dae2fcc0cad50f77c3e546a39ab1d

SHA512
2258ee4d136792305b6df90cc9bf1278bb1d4ff9af9d0b0bb26f2597125f9ded3d38a8f8081aa0d1b87d2a393ae77e04bca1fa6a5d29a3592052777c32eb9f9f

Download Submit
C:\Windows\System\ZtUbJWB.exe

Filesize
1.9MB

MD5
6d93d3fd37e1f733e9f78bef2c411832

SHA1
947a0568b186d27f6894eba20ea7fa1ef126b278

SHA256
7a812448ea8714087f1c0d7b00c597482a08bd3304bd649b26ce0ad120205bc9

SHA512
32bc6257a8d14447ded82fa03b58cbbe6dd69cd04d8486fa5d9b7d547f8fbb09d08ccdf7a481551d327c56df7061882e0b51fd414205dcfc3aeca9215cc760c7

Download Submit
C:\Windows\System\athjyVL.exe

Filesize
1.9MB

MD5
4ea4d67277866cf4da04b9e97f1e0a2e

SHA1
4070e643b46a79b973a433f604b181d594e40545

SHA256
3c57ba078ddfe801dcec9484a773f24c1c206ac512e3b0f9913dd6f650ff52c1

SHA512
fc77a82118e7f6632cabaf3bd0ae1413fa1d5b3000b97bf5b5cb3c1717933a8c9eeca0bbd38ff7c06e99ec92eb7b048b56929f989b4fdbf5b2ae847058ebdbaa

Download Submit
C:\Windows\System\cJHxUgk.exe

Filesize
1.9MB

MD5
44e925b6112f8b1699f1c6ee79e722f1

SHA1
19c0753aaeb717ac235da272bdee92a0ff2f45a7

SHA256
b79ada46b8e7df802b089a0852d1f5af43d1bdae17e4366c67613ce6ee803057

SHA512
08b6e8f5766ea246099c4c347b2e5aacb8f0432a29842482b214a03cf287523f4f2a312b7e622cc5be785a0bd84a212b9f7d17abb2c8d9c31dd825a7897237f7

Download Submit
C:\Windows\System\eKWOCiU.exe

Filesize
1.9MB

MD5
3e7e01bc745c848632944b324c3962b8

SHA1
8ed0cae816996fdb60d8b01dc6dac67b906e6684

SHA256
1987ee2dad2029bac88c9beabbef91325be8ac30cede2b44489f1ee061982436

SHA512
fa0ba7665b0bde1e59e086d25d6562f079337de2a03759efd383deae6a1b19ec2631c1b4f5c11b83e3394fbc86a9724457d283dbe86ca8dd794a7bace5a3d443

Download Submit
C:\Windows\System\fatRjZi.exe

Filesize
1.9MB

MD5
e69aa6796cf79a08150d33808d597387

SHA1
da175ca99a39b4f4c95b8aad81ef1914c18b11db

SHA256
8a74cd7a0ee9023f3e244dc646d189d8b91151d9d46164cfc3c4d9e879c1b9eb

SHA512
ef4caaa961ac777c77e0487aa366bfa7ea987f28add7c7288527e92c26c9d056cffdee2d501783f281a176ddf387738db54c2300bb6655f8c45cf2639b495e66

Download Submit
C:\Windows\System\gcpNTni.exe

Filesize
1.9MB

MD5
88cf20e0eed320ca84faaec2dcdbf305

SHA1
c9d3c5bd62071ab56b2e090413483f9aab3766cf

SHA256
7233967e09f3e0ea6571bf002a1896ee1595559d4ee6cd9a35376f1bdec8177d

SHA512
f19a816542ff23634e0c7ab537be2d657a17029e473102e8b7b266360d8df6456e7681d02366e0b51f4e003284fba2a7839f9c63ff721b5b513e7d4798b49c0f

Download Submit
C:\Windows\System\iFMLKfJ.exe

Filesize
1.9MB

MD5
733f0227c83c41af93dff3237123b81c

SHA1
b4f9288013d0e914c8beda49f550972eff304c56

SHA256
1206cd1acd9ee52474d7a6c7c13f7cfcd0897ee0c6cbc989fdba9e62272d4570

SHA512
f35a112d3ad988f2068b4853715c4639fc3bb0fbbd21083e1c12b66b05649f1f41db416b5e9198195210b8340099631863d463aab084f48c070ad395ee2fd1d5

Download Submit
C:\Windows\System\jscjumC.exe

Filesize
1.9MB

MD5
b82dba6ef24b2f2ca3b9520f7f629927

SHA1
ee311a3cef8bf84e96fbfa7da305b55326d305d1

SHA256
a49627a010ef63887c0c8656f204171bd305a86aa27ff88d4fb1fd0661257074

SHA512
d088f6c1d2cfd3799d157f91fd101bfbdb79010cec7efb3ff82909a4730fafb5f4a90cbfe3b8704e0e7b6660d02cdea833199ac7bc7830b5664be65beb1f43b7

Download Submit
C:\Windows\System\kVTZCtg.exe

Filesize
1.9MB

MD5
5c00120f3a29d2218410e95f66769dea

SHA1
c90f7a47a52aa00e36703339ba5ba8104a90ac2c

SHA256
f8229f7c043b8043c99145b53901699fa00dae0814335e780fe1022fa338c0be

SHA512
3a3b889df1ac89434fe36769444c7ae9b7dfbe281de18fc3fc2cbf672cb66f814aae32cd79171f9b58df182a8c55a00be40db5e0552593c634fd968b0da23bc5

Download Submit
C:\Windows\System\khwJAEn.exe

Filesize
1.9MB

MD5
34f5fd057719d6a5e913f4194550968c

SHA1
f5833322ba1eac8b658a84aef2f0cfbd313de976

SHA256
7b377bc775d943fb188c816f75113bfc37b881506e72238a34afd9b5264a05ba

SHA512
843643415ebf7204a79b385f47209cdc3f0fe57bab8377f75e9452dc26f0e3b85440e0ea957c06316b81ac59b35c8d0ed070d0abf4c2ec5831b4500f56ee06b0

Download Submit
C:\Windows\System\obUNQFm.exe

Filesize
1.9MB

MD5
a7b8e793153131d37042134c6a5039b2

SHA1
fd6edde1bcb7729fccf1dbe515102e57f1833cd3

SHA256
4964ac1a1573605f2c0e5db315e2ef048dbd428348b5f13e285c302e399c6190

SHA512
1e4b9bf1f99ab8cad7639520de1787a2445bfb3375bb327b809536046e2b621c9d76cd7214490bfc89526f416546c973bb6e7688937fb1140c602ef12d353493

Download Submit
C:\Windows\System\ohOYcgR.exe

Filesize
1.9MB

MD5
c9310b62fac7f105c54c3d312cbccc25

SHA1
388001d15eb500afa67171d964a343d28eea2b37

SHA256
4b1e1e6fdd7cfe90a08c8fd65df422d9fa7aeabb037e7127d9cf701fedba9de1

SHA512
a628f05d09f7b750fde258ae3444632c34e8d904bb895e850c6f43978bb87cd4f5414e33e1bb2310f8819b472b03918904a2921b359ea6ba48f4e55245cf63c7

Download Submit
C:\Windows\System\pReirDe.exe

Filesize
1.9MB

MD5
9d67e12bfa43a118ff20e9ce749223fb

SHA1
8d99acb9a9d55fed3fe935249f72adc939b4f98e

SHA256
6c24c09f6eb228cee12ad6b1740fc195d57772cdf20e7fdc10993d461c244fff

SHA512
e47e85eef46c21065999c983ad7ae8958bc5047cdd58be9dfdaa15efce460601796dd532ab33baa838c9bf0fa4327cfab82fe0cc11be531cb71c47405deaef97

Download Submit
C:\Windows\System\rLhbbbB.exe

Filesize
1.9MB

MD5
93243893dee550483c73882f7cd9ea07

SHA1
e6402eab305a06a56cd910e8cc3b336ea521201c

SHA256
5b1d3fa1f739c5a80e71ed70a3f6a5bf5e3289f572b132fec96f6564c8e01fc6

SHA512
5a1e91f70dfc7780885b00e36bf06b3e761c72b1d2f60004e2398d8f9d41241657be5c4c3f8e1ad67d1166041a5b7b6e721e1b25c8a91c89254f0f9a1aaa4c88

Download Submit
C:\Windows\System\tajPlfc.exe

Filesize
1.9MB

MD5
484d1fff535069a9b5fe92e77a30f48f

SHA1
a91909a05b6ba7806bc0e0e2e2c0df9a1eb78072

SHA256
e7cf926a93178f3f6586bb0d357dd9402b3e9cae93837d3424c3bd8c388f272e

SHA512
1f378aeb1184599bf1c02566ebafa5ea715f3afd1645c56b05ba5c5c9d7cd3fbd587690d8b79abf10a7249476ae61132789e78d2cfd4f8506ef06bd865f461c6

Download Submit
C:\Windows\System\ueILAoF.exe

Filesize
1.9MB

MD5
2705fc691a6921228a5e0cf8b4c1119f

SHA1
02fd6ae597ec45d946edf1d5f082e962c54a9a87

SHA256
6816b6432366841ecc001732e8a9363de4cbc7c4a4833088d1c734745233b5e1

SHA512
59336c95c29de6f049139bbcc661591115b485598eff4f2bd6805bbea48ff5f81abfa967de9494369e62f05ec0cd7fd4c5de0330f85733be94778af5e0a2d400

Download Submit
C:\Windows\System\vqRZEkd.exe

Filesize
1.9MB

MD5
8282d190eb2264fccf92a37546b0e962

SHA1
462a739c9d7fb0548ba28e49b7dcaad586f49841

SHA256
f8c576d5c292cf7743b6d7f37c90243794e7292a26dd9065f242b014ca0a02fe

SHA512
110f383d9dbcc7c888618595b329de072a4a1bcc4f63a6cb36d0962744584bb3343c84ad83fc54d46ddf1bb184cffc71e4d907fea7679908fff35efd6f80b4f9

Download Submit
C:\Windows\System\xBXtFEx.exe

Filesize
1.9MB

MD5
9b34104c3be68a84a2fbe86c43bdf1f6

SHA1
ac4d3572ed4b14ebccddc1e3fa20a7c45856db8f

SHA256
7b8e1ae1774eebd6463d3fbca26ba502463b467f29a790c532364f8a274f3bc7

SHA512
0c3517f80e86871e9a9d27710c5ed19531cd62948c0c0c664c031b6f9ae48995b8b44aeacba6bd614502ff950b6336eac1b9a73d2ada1fd26bcf5134a80f2a20

Download Submit
C:\Windows\System\yHBXvYO.exe

Filesize
1.9MB

MD5
668979d539c3df79cfb8772b4844f90b

SHA1
4c79c06a54a15c1c7373c3aebb8fb92ad259d2ba

SHA256
d3cc561fa5491e4384a1b43836e7fdb664b3c6c0f7ccbaed976fc76df58c7d2f

SHA512
9a4732d4f70eaa3eefc5a9075b81f25fbb99659c4817d93f22bc6a6de1f53773f828136754274c57b3c08c390d14ce81475dc46e06cce1d06321e487898111e4

Download Submit
memory/376-3378-0x00007FF70B810000-0x00007FF70BC02000-memory.dmp

Filesize
3.9MB

Download
memory/376-343-0x00007FF70B810000-0x00007FF70BC02000-memory.dmp

Filesize
3.9MB

Download
memory/644-3426-0x00007FF606020000-0x00007FF606412000-memory.dmp

Filesize
3.9MB

Download
memory/644-351-0x00007FF606020000-0x00007FF606412000-memory.dmp

Filesize
3.9MB

Download
memory/656-75-0x00007FF6925C0000-0x00007FF6929B2000-memory.dmp

Filesize
3.9MB

Download
memory/656-3328-0x00007FF6925C0000-0x00007FF6929B2000-memory.dmp

Filesize
3.9MB

Download
memory/940-511-0x00007FF61A060000-0x00007FF61A452000-memory.dmp

Filesize
3.9MB

Download
memory/940-3410-0x00007FF61A060000-0x00007FF61A452000-memory.dmp

Filesize
3.9MB

Download
memory/1288-344-0x00007FF729680000-0x00007FF729A72000-memory.dmp

Filesize
3.9MB

Download
memory/1288-3364-0x00007FF729680000-0x00007FF729A72000-memory.dmp

Filesize
3.9MB

Download
memory/1916-3360-0x00007FF7C2B90000-0x00007FF7C2F82000-memory.dmp

Filesize
3.9MB

Download
memory/1916-26-0x00007FF7C2B90000-0x00007FF7C2F82000-memory.dmp

Filesize
3.9MB

Download
memory/2124-220-0x00007FF730710000-0x00007FF730B02000-memory.dmp

Filesize
3.9MB

Download
memory/2124-3348-0x00007FF730710000-0x00007FF730B02000-memory.dmp

Filesize
3.9MB

Download
memory/2132-3350-0x00007FF7743A0000-0x00007FF774792000-memory.dmp

Filesize
3.9MB

Download
memory/2132-320-0x00007FF7743A0000-0x00007FF774792000-memory.dmp

Filesize
3.9MB

Download
memory/2672-50-0x00007FF896C13000-0x00007FF896C15000-memory.dmp

Filesize
8KB

Download
memory/2672-215-0x00007FF896C10000-0x00007FF8976D1000-memory.dmp

Filesize
10.8MB

Download
memory/2672-147-0x00007FF896C10000-0x00007FF8976D1000-memory.dmp

Filesize
10.8MB

Download
memory/2672-217-0x0000019DF4CF0000-0x0000019DF4D12000-memory.dmp

Filesize
136KB

Download
memory/2720-13-0x00007FF70ED30000-0x00007FF70F122000-memory.dmp

Filesize
3.9MB

Download
memory/2868-470-0x00007FF6AE000000-0x00007FF6AE3F2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-3338-0x00007FF6AE000000-0x00007FF6AE3F2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-3384-0x00007FF758AC0000-0x00007FF758EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-342-0x00007FF758AC0000-0x00007FF758EB2000-memory.dmp

Filesize
3.9MB

Download
memory/3152-347-0x00007FF62B410000-0x00007FF62B802000-memory.dmp

Filesize
3.9MB

Download
memory/3152-3377-0x00007FF62B410000-0x00007FF62B802000-memory.dmp

Filesize
3.9MB

Download
memory/3428-3335-0x00007FF785400000-0x00007FF7857F2000-memory.dmp

Filesize
3.9MB

Download
memory/3428-226-0x00007FF785400000-0x00007FF7857F2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-3356-0x00007FF600870000-0x00007FF600C62000-memory.dmp

Filesize
3.9MB

Download
memory/3468-287-0x00007FF600870000-0x00007FF600C62000-memory.dmp

Filesize
3.9MB

Download
memory/3636-3421-0x00007FF7752A0000-0x00007FF775692000-memory.dmp

Filesize
3.9MB

Download
memory/3636-350-0x00007FF7752A0000-0x00007FF775692000-memory.dmp

Filesize
3.9MB

Download
memory/3804-4720-0x00007FF608320000-0x00007FF608712000-memory.dmp

Filesize
3.9MB

Download
memory/3804-1-0x0000027C90800000-0x0000027C90810000-memory.dmp

Filesize
64KB

Download
memory/3804-0-0x00007FF608320000-0x00007FF608712000-memory.dmp

Filesize
3.9MB

Download
memory/3848-353-0x00007FF6949B0000-0x00007FF694DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3908-3324-0x00007FF624BF0000-0x00007FF624FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3908-421-0x00007FF624BF0000-0x00007FF624FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4244-3432-0x00007FF7A2B80000-0x00007FF7A2F72000-memory.dmp

Filesize
3.9MB

Download
memory/4244-352-0x00007FF7A2B80000-0x00007FF7A2F72000-memory.dmp

Filesize
3.9MB

Download
memory/4448-345-0x00007FF6D2D30000-0x00007FF6D3122000-memory.dmp

Filesize
3.9MB

Download
memory/4448-3373-0x00007FF6D2D30000-0x00007FF6D3122000-memory.dmp

Filesize
3.9MB

Download
memory/4616-3402-0x00007FF72D0B0000-0x00007FF72D4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-349-0x00007FF72D0B0000-0x00007FF72D4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4928-3381-0x00007FF716BB0000-0x00007FF716FA2000-memory.dmp

Filesize
3.9MB

Download
memory/4928-341-0x00007FF716BB0000-0x00007FF716FA2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-3394-0x00007FF7A2F20000-0x00007FF7A3312000-memory.dmp

Filesize
3.9MB

Download
memory/4988-348-0x00007FF7A2F20000-0x00007FF7A3312000-memory.dmp

Filesize
3.9MB

Download
memory/5000-3398-0x00007FF75AEE0000-0x00007FF75B2D2000-memory.dmp

Filesize
3.9MB

Download
memory/5000-346-0x00007FF75AEE0000-0x00007FF75B2D2000-memory.dmp

Filesize
3.9MB

Download
memory/5044-49-0x00007FF764A00000-0x00007FF764DF2000-memory.dmp

Filesize
3.9MB

Download
memory/5044-3368-0x00007FF764A00000-0x00007FF764DF2000-memory.dmp

Filesize
3.9MB

Download