xmrig | 82b9e1a4cad8076d92f50c4c9f69d96efc788140b21f918a8c6a4fe8ffa20404

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d205facb50bc83f1a2eaf22e0a60d570N.exe
Size

1.9MB
MD5

d205facb50bc83f1a2eaf22e0a60d570
SHA1

9a84958de8d42f253edb3a3f0f5e076cb81848a0
SHA256

82b9e1a4cad8076d92f50c4c9f69d96efc788140b21f918a8c6a4fe8ffa20404
SHA512

8afea55cc75528cef6e589a97ef839d2685a4faba636eec090b754c1d3ee4cb5c3278ea64be021012f4eadee25424b83410776ac4eaca8874ce632f9e52126b2
SSDEEP

49152:Lz071uv4BPMkyW10/w16BvZX71Fq868VI:NABf

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4552-98-0x00007FF60CDF0000-0x00007FF60D1E2000-memory.dmp	xmrig
behavioral2/memory/5012-111-0x00007FF75C990000-0x00007FF75CD82000-memory.dmp	xmrig
behavioral2/memory/4088-118-0x00007FF758710000-0x00007FF758B02000-memory.dmp	xmrig
behavioral2/memory/3500-126-0x00007FF642E80000-0x00007FF643272000-memory.dmp	xmrig
behavioral2/memory/4504-451-0x00007FF6DC4C0000-0x00007FF6DC8B2000-memory.dmp	xmrig
behavioral2/memory/3744-449-0x00007FF6EA2E0000-0x00007FF6EA6D2000-memory.dmp	xmrig
behavioral2/memory/2744-448-0x00007FF7C3DB0000-0x00007FF7C41A2000-memory.dmp	xmrig
behavioral2/memory/316-473-0x00007FF743230000-0x00007FF743622000-memory.dmp	xmrig
behavioral2/memory/4284-1168-0x00007FF6597B0000-0x00007FF659BA2000-memory.dmp	xmrig
behavioral2/memory/5076-1030-0x00007FF64F640000-0x00007FF64FA32000-memory.dmp	xmrig
behavioral2/memory/4988-885-0x00007FF727B90000-0x00007FF727F82000-memory.dmp	xmrig
behavioral2/memory/1808-485-0x00007FF678EA0000-0x00007FF679292000-memory.dmp	xmrig
behavioral2/memory/3820-483-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp	xmrig
behavioral2/memory/1008-481-0x00007FF6BF010000-0x00007FF6BF402000-memory.dmp	xmrig
behavioral2/memory/800-129-0x00007FF60D0C0000-0x00007FF60D4B2000-memory.dmp	xmrig
behavioral2/memory/4588-128-0x00007FF746DB0000-0x00007FF7471A2000-memory.dmp	xmrig
behavioral2/memory/3584-127-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp	xmrig
behavioral2/memory/212-123-0x00007FF692410000-0x00007FF692802000-memory.dmp	xmrig
behavioral2/memory/3312-120-0x00007FF6D4A40000-0x00007FF6D4E32000-memory.dmp	xmrig
behavioral2/memory/872-112-0x00007FF7F3EB0000-0x00007FF7F42A2000-memory.dmp	xmrig
behavioral2/memory/2944-93-0x00007FF7FADB0000-0x00007FF7FB1A2000-memory.dmp	xmrig
behavioral2/memory/856-86-0x00007FF738760000-0x00007FF738B52000-memory.dmp	xmrig
behavioral2/memory/3768-85-0x00007FF6B5D10000-0x00007FF6B6102000-memory.dmp	xmrig
behavioral2/memory/552-1411-0x00007FF7F1550000-0x00007FF7F1942000-memory.dmp	xmrig
behavioral2/memory/3276-1516-0x00007FF71DFF0000-0x00007FF71E3E2000-memory.dmp	xmrig
behavioral2/memory/3820-4387-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp	xmrig
behavioral2/memory/1808-4393-0x00007FF678EA0000-0x00007FF679292000-memory.dmp	xmrig
behavioral2/memory/3768-4410-0x00007FF6B5D10000-0x00007FF6B6102000-memory.dmp	xmrig
behavioral2/memory/856-4415-0x00007FF738760000-0x00007FF738B52000-memory.dmp	xmrig
behavioral2/memory/3312-4445-0x00007FF6D4A40000-0x00007FF6D4E32000-memory.dmp	xmrig
behavioral2/memory/5012-4465-0x00007FF75C990000-0x00007FF75CD82000-memory.dmp	xmrig
behavioral2/memory/3500-4501-0x00007FF642E80000-0x00007FF643272000-memory.dmp	xmrig
behavioral2/memory/3584-4505-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp	xmrig
behavioral2/memory/4552-4431-0x00007FF60CDF0000-0x00007FF60D1E2000-memory.dmp	xmrig
behavioral2/memory/2944-4421-0x00007FF7FADB0000-0x00007FF7FB1A2000-memory.dmp	xmrig
behavioral2/memory/3276-4579-0x00007FF71DFF0000-0x00007FF71E3E2000-memory.dmp	xmrig
behavioral2/memory/800-4571-0x00007FF60D0C0000-0x00007FF60D4B2000-memory.dmp	xmrig
behavioral2/memory/4284-4568-0x00007FF6597B0000-0x00007FF659BA2000-memory.dmp	xmrig
behavioral2/memory/4588-4569-0x00007FF746DB0000-0x00007FF7471A2000-memory.dmp	xmrig
behavioral2/memory/5076-4564-0x00007FF64F640000-0x00007FF64FA32000-memory.dmp	xmrig
behavioral2/memory/552-4562-0x00007FF7F1550000-0x00007FF7F1942000-memory.dmp	xmrig
behavioral2/memory/4988-4963-0x00007FF727B90000-0x00007FF727F82000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	1440	powershell.exe
10	1440	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1440	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
316	GJWImoI.exe
3744	CEBJlkm.exe
4504	CNnToHg.exe
1008	ixHfsul.exe
872	ZWCIlEK.exe
3820	ukSvDRN.exe
1808	OGECjmy.exe
3768	mDIyPKK.exe
4088	EJrkpqn.exe
856	QxReJkh.exe
2944	oVARtOM.exe
4552	dxXFGFp.exe
3312	mKfOzRa.exe
5012	tcgjXdZ.exe
212	FseZUFp.exe
3500	pFufwOG.exe
3584	xNyaUVn.exe
4588	zMHUrng.exe
800	HFixNYD.exe
4988	KCRngzU.exe
5076	mmISkCH.exe
4284	beaZoMG.exe
552	tPzuOgc.exe
3276	SUgvZDg.exe
4964	eVuYJcB.exe
3096	PxCWMEB.exe
2804	pAVDksi.exe
1784	ceSACYG.exe
1324	dlQBVRS.exe
1572	xSqwVXb.exe
1828	hgMkmat.exe
3800	ZMYALxg.exe
4444	XHFbcUr.exe
3460	eIWuHwA.exe
3020	QNJBoWr.exe
1912	WIHCVVu.exe
1780	JWRArJb.exe
3524	JeQtEWH.exe
3632	bBopLdR.exe
4352	rIcdhbQ.exe
4360	hBZDUpf.exe
1176	YXDBUks.exe
3612	VvfyvlA.exe
920	nlOEqJz.exe
684	xujjWjw.exe
3600	lTXUOQd.exe
3124	jiPyHMz.exe
4548	mEkFJcy.exe
4380	xpApLJx.exe
376	MacEUPc.exe
2984	XlJwdgy.exe
4784	qYhXvDZ.exe
1000	zsrxiKN.exe
4048	xOnbloL.exe
2504	ucYduqc.exe
3888	YIDxfAG.exe
3284	SBDtMhA.exe
740	whoDaIv.exe
1392	KWwOxGO.exe
844	hCcxmaz.exe
1592	PvXtMTD.exe
4856	FjapPqN.exe
2488	VknZlwK.exe
2228	cqupsfh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2744-0-0x00007FF7C3DB0000-0x00007FF7C41A2000-memory.dmp	upx
behavioral2/memory/316-9-0x00007FF743230000-0x00007FF743622000-memory.dmp	upx
behavioral2/files/0x0008000000023464-7.dat	upx
behavioral2/files/0x0007000000023466-6.dat	upx
behavioral2/files/0x0007000000023467-21.dat	upx
behavioral2/files/0x000700000002346a-36.dat	upx
behavioral2/memory/1008-38-0x00007FF6BF010000-0x00007FF6BF402000-memory.dmp	upx
behavioral2/files/0x0007000000023469-35.dat	upx
behavioral2/files/0x0007000000023468-34.dat	upx
behavioral2/files/0x0007000000023465-32.dat	upx
behavioral2/memory/4504-24-0x00007FF6DC4C0000-0x00007FF6DC8B2000-memory.dmp	upx
behavioral2/files/0x000700000002346b-37.dat	upx
behavioral2/memory/3744-18-0x00007FF6EA2E0000-0x00007FF6EA6D2000-memory.dmp	upx
behavioral2/files/0x000700000002346c-68.dat	upx
behavioral2/files/0x000700000002346d-74.dat	upx
behavioral2/memory/4552-98-0x00007FF60CDF0000-0x00007FF60D1E2000-memory.dmp	upx
behavioral2/memory/5012-111-0x00007FF75C990000-0x00007FF75CD82000-memory.dmp	upx
behavioral2/memory/4088-118-0x00007FF758710000-0x00007FF758B02000-memory.dmp	upx
behavioral2/files/0x0007000000023475-121.dat	upx
behavioral2/memory/3500-126-0x00007FF642E80000-0x00007FF643272000-memory.dmp	upx
behavioral2/files/0x0007000000023478-132.dat	upx
behavioral2/files/0x0008000000023476-135.dat	upx
behavioral2/files/0x0008000000023477-140.dat	upx
behavioral2/memory/4284-149-0x00007FF6597B0000-0x00007FF659BA2000-memory.dmp	upx
behavioral2/files/0x0007000000023479-151.dat	upx
behavioral2/memory/552-150-0x00007FF7F1550000-0x00007FF7F1942000-memory.dmp	upx
behavioral2/memory/3276-158-0x00007FF71DFF0000-0x00007FF71E3E2000-memory.dmp	upx
behavioral2/files/0x000700000002347d-169.dat	upx
behavioral2/files/0x000700000002347e-182.dat	upx
behavioral2/files/0x0007000000023482-194.dat	upx
behavioral2/memory/4504-451-0x00007FF6DC4C0000-0x00007FF6DC8B2000-memory.dmp	upx
behavioral2/memory/3744-449-0x00007FF6EA2E0000-0x00007FF6EA6D2000-memory.dmp	upx
behavioral2/memory/2744-448-0x00007FF7C3DB0000-0x00007FF7C41A2000-memory.dmp	upx
behavioral2/memory/316-473-0x00007FF743230000-0x00007FF743622000-memory.dmp	upx
behavioral2/memory/4284-1168-0x00007FF6597B0000-0x00007FF659BA2000-memory.dmp	upx
behavioral2/memory/5076-1030-0x00007FF64F640000-0x00007FF64FA32000-memory.dmp	upx
behavioral2/memory/4988-885-0x00007FF727B90000-0x00007FF727F82000-memory.dmp	upx
behavioral2/memory/1808-485-0x00007FF678EA0000-0x00007FF679292000-memory.dmp	upx
behavioral2/memory/3820-483-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp	upx
behavioral2/memory/1008-481-0x00007FF6BF010000-0x00007FF6BF402000-memory.dmp	upx
behavioral2/files/0x0007000000023483-199.dat	upx
behavioral2/files/0x0007000000023481-197.dat	upx
behavioral2/files/0x0007000000023480-192.dat	upx
behavioral2/files/0x000700000002347f-187.dat	upx
behavioral2/files/0x000700000002347c-172.dat	upx
behavioral2/files/0x000700000002347b-167.dat	upx
behavioral2/files/0x000700000002347a-159.dat	upx
behavioral2/memory/5076-143-0x00007FF64F640000-0x00007FF64FA32000-memory.dmp	upx
behavioral2/memory/4988-138-0x00007FF727B90000-0x00007FF727F82000-memory.dmp	upx
behavioral2/memory/800-129-0x00007FF60D0C0000-0x00007FF60D4B2000-memory.dmp	upx
behavioral2/memory/4588-128-0x00007FF746DB0000-0x00007FF7471A2000-memory.dmp	upx
behavioral2/memory/3584-127-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp	upx
behavioral2/files/0x0008000000023462-124.dat	upx
behavioral2/memory/212-123-0x00007FF692410000-0x00007FF692802000-memory.dmp	upx
behavioral2/memory/3312-120-0x00007FF6D4A40000-0x00007FF6D4E32000-memory.dmp	upx
behavioral2/files/0x0007000000023474-114.dat	upx
behavioral2/memory/872-112-0x00007FF7F3EB0000-0x00007FF7F42A2000-memory.dmp	upx
behavioral2/files/0x0007000000023473-95.dat	upx
behavioral2/memory/2944-93-0x00007FF7FADB0000-0x00007FF7FB1A2000-memory.dmp	upx
behavioral2/files/0x0007000000023471-89.dat	upx
behavioral2/files/0x0007000000023470-87.dat	upx
behavioral2/memory/856-86-0x00007FF738760000-0x00007FF738B52000-memory.dmp	upx
behavioral2/memory/3768-85-0x00007FF6B5D10000-0x00007FF6B6102000-memory.dmp	upx
behavioral2/files/0x000700000002346f-82.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ANCppxb.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\aCRROAG.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\ksrFMgx.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\INfCNtF.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\gZQPgES.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\YWWFUpx.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\PcgUcDU.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\uHkehKa.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\CykAOUh.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\FGuuXIE.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\PrMtUcR.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\zTUxkPL.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\hUxpNsG.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\dtsQLyN.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\Fszyjca.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\ODcLndq.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\TpfRRFN.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\GVLwFbH.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\wbYslNv.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\yyjpTpZ.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\MuKIsyz.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\VYGcJGd.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\nBdcDOU.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\qvzgcJw.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\QXAMGfj.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\xmSEamU.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\rQHYPtW.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\dokJqYJ.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\KTMwuBD.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\utKTPVF.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\ShOasck.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\BHSNnLB.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\dUXDQMn.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\PIWtDBl.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\XFaXjMa.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\VqYymbh.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\nsDImFo.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\UEVdTDH.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\uzunlMR.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\CKGKUQQ.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\ibSAuug.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\ljycGDZ.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\MAwhDzm.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\WihFQCP.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\pmiGIsI.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\jbQvYGd.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\cHNpKuj.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\TmFLMsX.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\hLNmLPc.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\qMVmNzS.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\ircIcVL.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\JCbXWdp.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\yufWgGR.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\jPGldpB.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\MoVTUlE.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\PwPOazs.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\hPhtmMG.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\jCSrOCh.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\LhdPrRf.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\yQDdGRn.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\oYynSGq.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\CNXoGtF.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\zIWEQhs.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe
File created	C:\Windows\System\Qyfdvhg.exe	d205facb50bc83f1a2eaf22e0a60d570N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe
Token: SeLockMemoryPrivilege	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe
Token: SeDebugPrivilege	1440	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 1440	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	84
PID 2744 wrote to memory of 1440	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	84
PID 2744 wrote to memory of 316	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	85
PID 2744 wrote to memory of 316	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	85
PID 2744 wrote to memory of 3744	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	86
PID 2744 wrote to memory of 3744	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	86
PID 2744 wrote to memory of 4504	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	87
PID 2744 wrote to memory of 4504	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	87
PID 2744 wrote to memory of 1008	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	88
PID 2744 wrote to memory of 1008	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	88
PID 2744 wrote to memory of 872	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	89
PID 2744 wrote to memory of 872	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	89
PID 2744 wrote to memory of 3820	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	90
PID 2744 wrote to memory of 3820	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	90
PID 2744 wrote to memory of 1808	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	91
PID 2744 wrote to memory of 1808	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	91
PID 2744 wrote to memory of 3768	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	92
PID 2744 wrote to memory of 3768	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	92
PID 2744 wrote to memory of 4088	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	93
PID 2744 wrote to memory of 4088	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	93
PID 2744 wrote to memory of 856	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	94
PID 2744 wrote to memory of 856	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	94
PID 2744 wrote to memory of 2944	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	95
PID 2744 wrote to memory of 2944	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	95
PID 2744 wrote to memory of 4552	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	96
PID 2744 wrote to memory of 4552	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	96
PID 2744 wrote to memory of 3312	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	97
PID 2744 wrote to memory of 3312	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	97
PID 2744 wrote to memory of 5012	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	98
PID 2744 wrote to memory of 5012	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	98
PID 2744 wrote to memory of 212	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	99
PID 2744 wrote to memory of 212	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	99
PID 2744 wrote to memory of 3500	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	100
PID 2744 wrote to memory of 3500	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	100
PID 2744 wrote to memory of 3584	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	101
PID 2744 wrote to memory of 3584	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	101
PID 2744 wrote to memory of 4588	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	102
PID 2744 wrote to memory of 4588	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	102
PID 2744 wrote to memory of 800	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	103
PID 2744 wrote to memory of 800	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	103
PID 2744 wrote to memory of 4988	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	104
PID 2744 wrote to memory of 4988	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	104
PID 2744 wrote to memory of 5076	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	105
PID 2744 wrote to memory of 5076	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	105
PID 2744 wrote to memory of 4284	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	106
PID 2744 wrote to memory of 4284	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	106
PID 2744 wrote to memory of 552	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	107
PID 2744 wrote to memory of 552	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	107
PID 2744 wrote to memory of 3276	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	108
PID 2744 wrote to memory of 3276	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	108
PID 2744 wrote to memory of 4964	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	109
PID 2744 wrote to memory of 4964	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	109
PID 2744 wrote to memory of 3096	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	110
PID 2744 wrote to memory of 3096	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	110
PID 2744 wrote to memory of 2804	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	111
PID 2744 wrote to memory of 2804	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	111
PID 2744 wrote to memory of 1784	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	112
PID 2744 wrote to memory of 1784	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	112
PID 2744 wrote to memory of 1324	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	113
PID 2744 wrote to memory of 1324	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	113
PID 2744 wrote to memory of 1572	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	114
PID 2744 wrote to memory of 1572	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	114
PID 2744 wrote to memory of 1828	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	115
PID 2744 wrote to memory of 1828	2744	d205facb50bc83f1a2eaf22e0a60d570N.exe	115

C:\Users\Admin\AppData\Local\Temp\d205facb50bc83f1a2eaf22e0a60d570N.exe
"C:\Users\Admin\AppData\Local\Temp\d205facb50bc83f1a2eaf22e0a60d570N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1440" "2928" "2892" "2932" "0" "0" "2936" "0" "0" "0" "0" "0"
    3⤵
    PID:13364
- C:\Windows\System\GJWImoI.exe
  C:\Windows\System\GJWImoI.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\CEBJlkm.exe
  C:\Windows\System\CEBJlkm.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\CNnToHg.exe
  C:\Windows\System\CNnToHg.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\ixHfsul.exe
  C:\Windows\System\ixHfsul.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\ZWCIlEK.exe
  C:\Windows\System\ZWCIlEK.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\ukSvDRN.exe
  C:\Windows\System\ukSvDRN.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\OGECjmy.exe
  C:\Windows\System\OGECjmy.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\mDIyPKK.exe
  C:\Windows\System\mDIyPKK.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\EJrkpqn.exe
  C:\Windows\System\EJrkpqn.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\QxReJkh.exe
  C:\Windows\System\QxReJkh.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\oVARtOM.exe
  C:\Windows\System\oVARtOM.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\dxXFGFp.exe
  C:\Windows\System\dxXFGFp.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\mKfOzRa.exe
  C:\Windows\System\mKfOzRa.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\tcgjXdZ.exe
  C:\Windows\System\tcgjXdZ.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\FseZUFp.exe
  C:\Windows\System\FseZUFp.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\pFufwOG.exe
  C:\Windows\System\pFufwOG.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\xNyaUVn.exe
  C:\Windows\System\xNyaUVn.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\zMHUrng.exe
  C:\Windows\System\zMHUrng.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\HFixNYD.exe
  C:\Windows\System\HFixNYD.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\KCRngzU.exe
  C:\Windows\System\KCRngzU.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\mmISkCH.exe
  C:\Windows\System\mmISkCH.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\beaZoMG.exe
  C:\Windows\System\beaZoMG.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\tPzuOgc.exe
  C:\Windows\System\tPzuOgc.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\SUgvZDg.exe
  C:\Windows\System\SUgvZDg.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\eVuYJcB.exe
  C:\Windows\System\eVuYJcB.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\PxCWMEB.exe
  C:\Windows\System\PxCWMEB.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\pAVDksi.exe
  C:\Windows\System\pAVDksi.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\ceSACYG.exe
  C:\Windows\System\ceSACYG.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\dlQBVRS.exe
  C:\Windows\System\dlQBVRS.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\xSqwVXb.exe
  C:\Windows\System\xSqwVXb.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\hgMkmat.exe
  C:\Windows\System\hgMkmat.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\ZMYALxg.exe
  C:\Windows\System\ZMYALxg.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\XHFbcUr.exe
  C:\Windows\System\XHFbcUr.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\eIWuHwA.exe
  C:\Windows\System\eIWuHwA.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\QNJBoWr.exe
  C:\Windows\System\QNJBoWr.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\WIHCVVu.exe
  C:\Windows\System\WIHCVVu.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\JWRArJb.exe
  C:\Windows\System\JWRArJb.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\JeQtEWH.exe
  C:\Windows\System\JeQtEWH.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\bBopLdR.exe
  C:\Windows\System\bBopLdR.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\rIcdhbQ.exe
  C:\Windows\System\rIcdhbQ.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\hBZDUpf.exe
  C:\Windows\System\hBZDUpf.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\YXDBUks.exe
  C:\Windows\System\YXDBUks.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\VvfyvlA.exe
  C:\Windows\System\VvfyvlA.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\nlOEqJz.exe
  C:\Windows\System\nlOEqJz.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\xujjWjw.exe
  C:\Windows\System\xujjWjw.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\lTXUOQd.exe
  C:\Windows\System\lTXUOQd.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\jiPyHMz.exe
  C:\Windows\System\jiPyHMz.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\mEkFJcy.exe
  C:\Windows\System\mEkFJcy.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\xpApLJx.exe
  C:\Windows\System\xpApLJx.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\MacEUPc.exe
  C:\Windows\System\MacEUPc.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\XlJwdgy.exe
  C:\Windows\System\XlJwdgy.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\qYhXvDZ.exe
  C:\Windows\System\qYhXvDZ.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\zsrxiKN.exe
  C:\Windows\System\zsrxiKN.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\xOnbloL.exe
  C:\Windows\System\xOnbloL.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\ucYduqc.exe
  C:\Windows\System\ucYduqc.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\YIDxfAG.exe
  C:\Windows\System\YIDxfAG.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\SBDtMhA.exe
  C:\Windows\System\SBDtMhA.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\whoDaIv.exe
  C:\Windows\System\whoDaIv.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\KWwOxGO.exe
  C:\Windows\System\KWwOxGO.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\hCcxmaz.exe
  C:\Windows\System\hCcxmaz.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\PvXtMTD.exe
  C:\Windows\System\PvXtMTD.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\FjapPqN.exe
  C:\Windows\System\FjapPqN.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\VknZlwK.exe
  C:\Windows\System\VknZlwK.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\cqupsfh.exe
  C:\Windows\System\cqupsfh.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\WWfXLUp.exe
  C:\Windows\System\WWfXLUp.exe
  2⤵
  PID:2384
- C:\Windows\System\QvWXsph.exe
  C:\Windows\System\QvWXsph.exe
  2⤵
  PID:1972
- C:\Windows\System\tZXkTmy.exe
  C:\Windows\System\tZXkTmy.exe
  2⤵
  PID:3544
- C:\Windows\System\cEOlLjS.exe
  C:\Windows\System\cEOlLjS.exe
  2⤵
  PID:3520
- C:\Windows\System\hfqDGtW.exe
  C:\Windows\System\hfqDGtW.exe
  2⤵
  PID:4528
- C:\Windows\System\GYREnWk.exe
  C:\Windows\System\GYREnWk.exe
  2⤵
  PID:3324
- C:\Windows\System\zjdEMGx.exe
  C:\Windows\System\zjdEMGx.exe
  2⤵
  PID:2988
- C:\Windows\System\FyZNUIw.exe
  C:\Windows\System\FyZNUIw.exe
  2⤵
  PID:2856
- C:\Windows\System\cOektET.exe
  C:\Windows\System\cOektET.exe
  2⤵
  PID:4816
- C:\Windows\System\wqOAJon.exe
  C:\Windows\System\wqOAJon.exe
  2⤵
  PID:4728
- C:\Windows\System\CuMWGga.exe
  C:\Windows\System\CuMWGga.exe
  2⤵
  PID:5132
- C:\Windows\System\tBinBIK.exe
  C:\Windows\System\tBinBIK.exe
  2⤵
  PID:5160
- C:\Windows\System\pQZERvu.exe
  C:\Windows\System\pQZERvu.exe
  2⤵
  PID:5188
- C:\Windows\System\DQifwTa.exe
  C:\Windows\System\DQifwTa.exe
  2⤵
  PID:5220
- C:\Windows\System\tLwqNMm.exe
  C:\Windows\System\tLwqNMm.exe
  2⤵
  PID:5240
- C:\Windows\System\SDKUBdD.exe
  C:\Windows\System\SDKUBdD.exe
  2⤵
  PID:5268
- C:\Windows\System\MDCzAqg.exe
  C:\Windows\System\MDCzAqg.exe
  2⤵
  PID:5296
- C:\Windows\System\wetCCav.exe
  C:\Windows\System\wetCCav.exe
  2⤵
  PID:5320
- C:\Windows\System\zvQYSIf.exe
  C:\Windows\System\zvQYSIf.exe
  2⤵
  PID:5348
- C:\Windows\System\lRGJYLD.exe
  C:\Windows\System\lRGJYLD.exe
  2⤵
  PID:5376
- C:\Windows\System\XiKcAgD.exe
  C:\Windows\System\XiKcAgD.exe
  2⤵
  PID:5404
- C:\Windows\System\BUFfKpx.exe
  C:\Windows\System\BUFfKpx.exe
  2⤵
  PID:5436
- C:\Windows\System\mqYGkBE.exe
  C:\Windows\System\mqYGkBE.exe
  2⤵
  PID:5464
- C:\Windows\System\AvhHCoj.exe
  C:\Windows\System\AvhHCoj.exe
  2⤵
  PID:5488
- C:\Windows\System\NEhyIDZ.exe
  C:\Windows\System\NEhyIDZ.exe
  2⤵
  PID:5516
- C:\Windows\System\aafNwws.exe
  C:\Windows\System\aafNwws.exe
  2⤵
  PID:5544
- C:\Windows\System\ztWBhmJ.exe
  C:\Windows\System\ztWBhmJ.exe
  2⤵
  PID:5576
- C:\Windows\System\HYGtNcY.exe
  C:\Windows\System\HYGtNcY.exe
  2⤵
  PID:5604
- C:\Windows\System\GmXaeqy.exe
  C:\Windows\System\GmXaeqy.exe
  2⤵
  PID:5632
- C:\Windows\System\udnfZOI.exe
  C:\Windows\System\udnfZOI.exe
  2⤵
  PID:5664
- C:\Windows\System\uZAyOKK.exe
  C:\Windows\System\uZAyOKK.exe
  2⤵
  PID:5692
- C:\Windows\System\HtCIzFw.exe
  C:\Windows\System\HtCIzFw.exe
  2⤵
  PID:5724
- C:\Windows\System\xFfkgnt.exe
  C:\Windows\System\xFfkgnt.exe
  2⤵
  PID:5756
- C:\Windows\System\bJCbHkt.exe
  C:\Windows\System\bJCbHkt.exe
  2⤵
  PID:5780
- C:\Windows\System\nPntzgL.exe
  C:\Windows\System\nPntzgL.exe
  2⤵
  PID:5812
- C:\Windows\System\zdLejFl.exe
  C:\Windows\System\zdLejFl.exe
  2⤵
  PID:5840
- C:\Windows\System\yDkYPuQ.exe
  C:\Windows\System\yDkYPuQ.exe
  2⤵
  PID:5872
- C:\Windows\System\TfBDDJM.exe
  C:\Windows\System\TfBDDJM.exe
  2⤵
  PID:5900
- C:\Windows\System\wcMeqAg.exe
  C:\Windows\System\wcMeqAg.exe
  2⤵
  PID:5928
- C:\Windows\System\adbjHdx.exe
  C:\Windows\System\adbjHdx.exe
  2⤵
  PID:5952
- C:\Windows\System\ZxriEzq.exe
  C:\Windows\System\ZxriEzq.exe
  2⤵
  PID:5980
- C:\Windows\System\tIkTaWy.exe
  C:\Windows\System\tIkTaWy.exe
  2⤵
  PID:6008
- C:\Windows\System\BIjLCfG.exe
  C:\Windows\System\BIjLCfG.exe
  2⤵
  PID:6036
- C:\Windows\System\wkgGeIg.exe
  C:\Windows\System\wkgGeIg.exe
  2⤵
  PID:6064
- C:\Windows\System\WpjbxdP.exe
  C:\Windows\System\WpjbxdP.exe
  2⤵
  PID:6092
- C:\Windows\System\MLLQkpW.exe
  C:\Windows\System\MLLQkpW.exe
  2⤵
  PID:6120
- C:\Windows\System\pSVQsSF.exe
  C:\Windows\System\pSVQsSF.exe
  2⤵
  PID:5072
- C:\Windows\System\gmnPtYw.exe
  C:\Windows\System\gmnPtYw.exe
  2⤵
  PID:4060
- C:\Windows\System\xEUjOIQ.exe
  C:\Windows\System\xEUjOIQ.exe
  2⤵
  PID:548
- C:\Windows\System\jfPNXuq.exe
  C:\Windows\System\jfPNXuq.exe
  2⤵
  PID:1664
- C:\Windows\System\ahsqGHx.exe
  C:\Windows\System\ahsqGHx.exe
  2⤵
  PID:4688
- C:\Windows\System\TQruKsi.exe
  C:\Windows\System\TQruKsi.exe
  2⤵
  PID:5176
- C:\Windows\System\uoFIIly.exe
  C:\Windows\System\uoFIIly.exe
  2⤵
  PID:5364
- C:\Windows\System\JxbnLWY.exe
  C:\Windows\System\JxbnLWY.exe
  2⤵
  PID:5504
- C:\Windows\System\PuMVUnI.exe
  C:\Windows\System\PuMVUnI.exe
  2⤵
  PID:5540
- C:\Windows\System\JpeUAwf.exe
  C:\Windows\System\JpeUAwf.exe
  2⤵
  PID:5568
- C:\Windows\System\hkdDAAE.exe
  C:\Windows\System\hkdDAAE.exe
  2⤵
  PID:5624
- C:\Windows\System\lOpasNb.exe
  C:\Windows\System\lOpasNb.exe
  2⤵
  PID:5712
- C:\Windows\System\SAxwkoa.exe
  C:\Windows\System\SAxwkoa.exe
  2⤵
  PID:5020
- C:\Windows\System\gLiSiih.exe
  C:\Windows\System\gLiSiih.exe
  2⤵
  PID:3852
- C:\Windows\System\IHLBVbu.exe
  C:\Windows\System\IHLBVbu.exe
  2⤵
  PID:5828
- C:\Windows\System\DhqEYwm.exe
  C:\Windows\System\DhqEYwm.exe
  2⤵
  PID:5856
- C:\Windows\System\IaQkpmM.exe
  C:\Windows\System\IaQkpmM.exe
  2⤵
  PID:5884
- C:\Windows\System\vDQKiUi.exe
  C:\Windows\System\vDQKiUi.exe
  2⤵
  PID:5916
- C:\Windows\System\egtRDFh.exe
  C:\Windows\System\egtRDFh.exe
  2⤵
  PID:628
- C:\Windows\System\AGQWEQR.exe
  C:\Windows\System\AGQWEQR.exe
  2⤵
  PID:6000
- C:\Windows\System\GoiCakx.exe
  C:\Windows\System\GoiCakx.exe
  2⤵
  PID:6028
- C:\Windows\System\synfthz.exe
  C:\Windows\System\synfthz.exe
  2⤵
  PID:6084
- C:\Windows\System\DRAnQkM.exe
  C:\Windows\System\DRAnQkM.exe
  2⤵
  PID:6116
- C:\Windows\System\iHfYhbT.exe
  C:\Windows\System\iHfYhbT.exe
  2⤵
  PID:3980
- C:\Windows\System\ZhEJllZ.exe
  C:\Windows\System\ZhEJllZ.exe
  2⤵
  PID:1644
- C:\Windows\System\GFmjrNU.exe
  C:\Windows\System\GFmjrNU.exe
  2⤵
  PID:4200
- C:\Windows\System\ItTWPuG.exe
  C:\Windows\System\ItTWPuG.exe
  2⤵
  PID:4836
- C:\Windows\System\uuyTWua.exe
  C:\Windows\System\uuyTWua.exe
  2⤵
  PID:5288
- C:\Windows\System\EngnAPV.exe
  C:\Windows\System\EngnAPV.exe
  2⤵
  PID:2288
- C:\Windows\System\umTEfWL.exe
  C:\Windows\System\umTEfWL.exe
  2⤵
  PID:1388
- C:\Windows\System\qNDWPkQ.exe
  C:\Windows\System\qNDWPkQ.exe
  2⤵
  PID:1492
- C:\Windows\System\SrkOTcK.exe
  C:\Windows\System\SrkOTcK.exe
  2⤵
  PID:3700
- C:\Windows\System\UYPhKwK.exe
  C:\Windows\System\UYPhKwK.exe
  2⤵
  PID:3576
- C:\Windows\System\VRxKXGR.exe
  C:\Windows\System\VRxKXGR.exe
  2⤵
  PID:5660
- C:\Windows\System\OfPbLbk.exe
  C:\Windows\System\OfPbLbk.exe
  2⤵
  PID:4904
- C:\Windows\System\XpmWtUX.exe
  C:\Windows\System\XpmWtUX.exe
  2⤵
  PID:4428
- C:\Windows\System\hcZJmqc.exe
  C:\Windows\System\hcZJmqc.exe
  2⤵
  PID:2768
- C:\Windows\System\MOcKTfh.exe
  C:\Windows\System\MOcKTfh.exe
  2⤵
  PID:4804
- C:\Windows\System\PiQgoFc.exe
  C:\Windows\System\PiQgoFc.exe
  2⤵
  PID:2936
- C:\Windows\System\MgBRbhU.exe
  C:\Windows\System\MgBRbhU.exe
  2⤵
  PID:5684
- C:\Windows\System\XzjajJk.exe
  C:\Windows\System\XzjajJk.exe
  2⤵
  PID:5536
- C:\Windows\System\AuyIgXv.exe
  C:\Windows\System\AuyIgXv.exe
  2⤵
  PID:5792
- C:\Windows\System\JuawVfh.exe
  C:\Windows\System\JuawVfh.exe
  2⤵
  PID:4452
- C:\Windows\System\MkkWFOU.exe
  C:\Windows\System\MkkWFOU.exe
  2⤵
  PID:6088
- C:\Windows\System\kfzkXdy.exe
  C:\Windows\System\kfzkXdy.exe
  2⤵
  PID:5316
- C:\Windows\System\vcDZuUl.exe
  C:\Windows\System\vcDZuUl.exe
  2⤵
  PID:5656
- C:\Windows\System\lEMNUQI.exe
  C:\Windows\System\lEMNUQI.exe
  2⤵
  PID:5600
- C:\Windows\System\JJSxIpO.exe
  C:\Windows\System\JJSxIpO.exe
  2⤵
  PID:5216
- C:\Windows\System\gfrThxt.exe
  C:\Windows\System\gfrThxt.exe
  2⤵
  PID:1292
- C:\Windows\System\QeMGrsy.exe
  C:\Windows\System\QeMGrsy.exe
  2⤵
  PID:1356
- C:\Windows\System\YBqUIOz.exe
  C:\Windows\System\YBqUIOz.exe
  2⤵
  PID:6184
- C:\Windows\System\qllAbKI.exe
  C:\Windows\System\qllAbKI.exe
  2⤵
  PID:6204
- C:\Windows\System\MNoOcMR.exe
  C:\Windows\System\MNoOcMR.exe
  2⤵
  PID:6228
- C:\Windows\System\VIJItIL.exe
  C:\Windows\System\VIJItIL.exe
  2⤵
  PID:6248
- C:\Windows\System\OszRjOn.exe
  C:\Windows\System\OszRjOn.exe
  2⤵
  PID:6268
- C:\Windows\System\qXHxFYw.exe
  C:\Windows\System\qXHxFYw.exe
  2⤵
  PID:6296
- C:\Windows\System\TmFLMsX.exe
  C:\Windows\System\TmFLMsX.exe
  2⤵
  PID:6336
- C:\Windows\System\OCSvKsE.exe
  C:\Windows\System\OCSvKsE.exe
  2⤵
  PID:6384
- C:\Windows\System\unOcMGp.exe
  C:\Windows\System\unOcMGp.exe
  2⤵
  PID:6400
- C:\Windows\System\FwoTtxq.exe
  C:\Windows\System\FwoTtxq.exe
  2⤵
  PID:6444
- C:\Windows\System\nRLVakW.exe
  C:\Windows\System\nRLVakW.exe
  2⤵
  PID:6476
- C:\Windows\System\VwTHtPg.exe
  C:\Windows\System\VwTHtPg.exe
  2⤵
  PID:6500
- C:\Windows\System\TlPcAor.exe
  C:\Windows\System\TlPcAor.exe
  2⤵
  PID:6516
- C:\Windows\System\nkBXRLa.exe
  C:\Windows\System\nkBXRLa.exe
  2⤵
  PID:6544
- C:\Windows\System\HJBdHPn.exe
  C:\Windows\System\HJBdHPn.exe
  2⤵
  PID:6572
- C:\Windows\System\AYOuhKb.exe
  C:\Windows\System\AYOuhKb.exe
  2⤵
  PID:6596
- C:\Windows\System\qprRwry.exe
  C:\Windows\System\qprRwry.exe
  2⤵
  PID:6644
- C:\Windows\System\uomzzqZ.exe
  C:\Windows\System\uomzzqZ.exe
  2⤵
  PID:6664
- C:\Windows\System\MxbNnEd.exe
  C:\Windows\System\MxbNnEd.exe
  2⤵
  PID:6684
- C:\Windows\System\cKGFImu.exe
  C:\Windows\System\cKGFImu.exe
  2⤵
  PID:6736
- C:\Windows\System\vlKsnbY.exe
  C:\Windows\System\vlKsnbY.exe
  2⤵
  PID:6760
- C:\Windows\System\JSIqbBV.exe
  C:\Windows\System\JSIqbBV.exe
  2⤵
  PID:6788
- C:\Windows\System\ECiYZUs.exe
  C:\Windows\System\ECiYZUs.exe
  2⤵
  PID:6808
- C:\Windows\System\JqRMhje.exe
  C:\Windows\System\JqRMhje.exe
  2⤵
  PID:6864
- C:\Windows\System\BJRIfAE.exe
  C:\Windows\System\BJRIfAE.exe
  2⤵
  PID:6888
- C:\Windows\System\kAGfjfY.exe
  C:\Windows\System\kAGfjfY.exe
  2⤵
  PID:6912
- C:\Windows\System\YWBYQMT.exe
  C:\Windows\System\YWBYQMT.exe
  2⤵
  PID:6932
- C:\Windows\System\IbyKgWm.exe
  C:\Windows\System\IbyKgWm.exe
  2⤵
  PID:6976
- C:\Windows\System\rmPqHVH.exe
  C:\Windows\System\rmPqHVH.exe
  2⤵
  PID:7000
- C:\Windows\System\eBQyVnU.exe
  C:\Windows\System\eBQyVnU.exe
  2⤵
  PID:7024
- C:\Windows\System\tiQTHYK.exe
  C:\Windows\System\tiQTHYK.exe
  2⤵
  PID:7052
- C:\Windows\System\WQSwhMk.exe
  C:\Windows\System\WQSwhMk.exe
  2⤵
  PID:7068
- C:\Windows\System\PdZPKSp.exe
  C:\Windows\System\PdZPKSp.exe
  2⤵
  PID:7088
- C:\Windows\System\fYJyJBW.exe
  C:\Windows\System\fYJyJBW.exe
  2⤵
  PID:7160
- C:\Windows\System\SglBXfN.exe
  C:\Windows\System\SglBXfN.exe
  2⤵
  PID:756
- C:\Windows\System\MOhriDb.exe
  C:\Windows\System\MOhriDb.exe
  2⤵
  PID:1768
- C:\Windows\System\QiPBvlI.exe
  C:\Windows\System\QiPBvlI.exe
  2⤵
  PID:6216
- C:\Windows\System\zUunmgB.exe
  C:\Windows\System\zUunmgB.exe
  2⤵
  PID:2652
- C:\Windows\System\cmMJopL.exe
  C:\Windows\System\cmMJopL.exe
  2⤵
  PID:6256
- C:\Windows\System\yICtizZ.exe
  C:\Windows\System\yICtizZ.exe
  2⤵
  PID:6356
- C:\Windows\System\Jntsbls.exe
  C:\Windows\System\Jntsbls.exe
  2⤵
  PID:6372
- C:\Windows\System\DjlvbSu.exe
  C:\Windows\System\DjlvbSu.exe
  2⤵
  PID:3168
- C:\Windows\System\HUfiWdG.exe
  C:\Windows\System\HUfiWdG.exe
  2⤵
  PID:6460
- C:\Windows\System\jWdpvVU.exe
  C:\Windows\System\jWdpvVU.exe
  2⤵
  PID:6492
- C:\Windows\System\dHNSfer.exe
  C:\Windows\System\dHNSfer.exe
  2⤵
  PID:6564
- C:\Windows\System\STBtJeG.exe
  C:\Windows\System\STBtJeG.exe
  2⤵
  PID:6616
- C:\Windows\System\RIPIIUh.exe
  C:\Windows\System\RIPIIUh.exe
  2⤵
  PID:6636
- C:\Windows\System\jbfWyBt.exe
  C:\Windows\System\jbfWyBt.exe
  2⤵
  PID:6708
- C:\Windows\System\WyCuccI.exe
  C:\Windows\System\WyCuccI.exe
  2⤵
  PID:6752
- C:\Windows\System\MsTSFgJ.exe
  C:\Windows\System\MsTSFgJ.exe
  2⤵
  PID:6776
- C:\Windows\System\SiaGEVH.exe
  C:\Windows\System\SiaGEVH.exe
  2⤵
  PID:7008
- C:\Windows\System\AhsiMKo.exe
  C:\Windows\System\AhsiMKo.exe
  2⤵
  PID:7012
- C:\Windows\System\WnZVwDo.exe
  C:\Windows\System\WnZVwDo.exe
  2⤵
  PID:7084
- C:\Windows\System\rzfGiKS.exe
  C:\Windows\System\rzfGiKS.exe
  2⤵
  PID:6552
- C:\Windows\System\QnENKyQ.exe
  C:\Windows\System\QnENKyQ.exe
  2⤵
  PID:6632
- C:\Windows\System\LNarawV.exe
  C:\Windows\System\LNarawV.exe
  2⤵
  PID:6200
- C:\Windows\System\NWVRyOh.exe
  C:\Windows\System\NWVRyOh.exe
  2⤵
  PID:6396
- C:\Windows\System\dxlXGuO.exe
  C:\Windows\System\dxlXGuO.exe
  2⤵
  PID:6056
- C:\Windows\System\nFfkNqM.exe
  C:\Windows\System\nFfkNqM.exe
  2⤵
  PID:6828
- C:\Windows\System\nrVwCUn.exe
  C:\Windows\System\nrVwCUn.exe
  2⤵
  PID:7136
- C:\Windows\System\AeOtnxP.exe
  C:\Windows\System\AeOtnxP.exe
  2⤵
  PID:5284
- C:\Windows\System\DQjyeff.exe
  C:\Windows\System\DQjyeff.exe
  2⤵
  PID:6924
- C:\Windows\System\bADADlB.exe
  C:\Windows\System\bADADlB.exe
  2⤵
  PID:6612
- C:\Windows\System\swOtUkF.exe
  C:\Windows\System\swOtUkF.exe
  2⤵
  PID:7192
- C:\Windows\System\ALammlJ.exe
  C:\Windows\System\ALammlJ.exe
  2⤵
  PID:7216
- C:\Windows\System\BaEzxuA.exe
  C:\Windows\System\BaEzxuA.exe
  2⤵
  PID:7236
- C:\Windows\System\fyZQQbU.exe
  C:\Windows\System\fyZQQbU.exe
  2⤵
  PID:7268
- C:\Windows\System\DAwCtMx.exe
  C:\Windows\System\DAwCtMx.exe
  2⤵
  PID:7316
- C:\Windows\System\YyZPMIr.exe
  C:\Windows\System\YyZPMIr.exe
  2⤵
  PID:7340
- C:\Windows\System\BhTFxXt.exe
  C:\Windows\System\BhTFxXt.exe
  2⤵
  PID:7384
- C:\Windows\System\JeAakIu.exe
  C:\Windows\System\JeAakIu.exe
  2⤵
  PID:7420
- C:\Windows\System\iXQYFmk.exe
  C:\Windows\System\iXQYFmk.exe
  2⤵
  PID:7444
- C:\Windows\System\HUPCVQw.exe
  C:\Windows\System\HUPCVQw.exe
  2⤵
  PID:7460
- C:\Windows\System\zVHgIaT.exe
  C:\Windows\System\zVHgIaT.exe
  2⤵
  PID:7508
- C:\Windows\System\gGKlXXk.exe
  C:\Windows\System\gGKlXXk.exe
  2⤵
  PID:7532
- C:\Windows\System\iLRbSGV.exe
  C:\Windows\System\iLRbSGV.exe
  2⤵
  PID:7556
- C:\Windows\System\GkeXIKt.exe
  C:\Windows\System\GkeXIKt.exe
  2⤵
  PID:7588
- C:\Windows\System\vDMNExW.exe
  C:\Windows\System\vDMNExW.exe
  2⤵
  PID:7608
- C:\Windows\System\upihZxE.exe
  C:\Windows\System\upihZxE.exe
  2⤵
  PID:7632
- C:\Windows\System\QOgCWjI.exe
  C:\Windows\System\QOgCWjI.exe
  2⤵
  PID:7672
- C:\Windows\System\Alzdgaj.exe
  C:\Windows\System\Alzdgaj.exe
  2⤵
  PID:7692
- C:\Windows\System\OxFWvtK.exe
  C:\Windows\System\OxFWvtK.exe
  2⤵
  PID:7712
- C:\Windows\System\oRyFxvP.exe
  C:\Windows\System\oRyFxvP.exe
  2⤵
  PID:7740
- C:\Windows\System\ffOiEMe.exe
  C:\Windows\System\ffOiEMe.exe
  2⤵
  PID:7760
- C:\Windows\System\DNTRyCE.exe
  C:\Windows\System\DNTRyCE.exe
  2⤵
  PID:7784
- C:\Windows\System\fSPkmlx.exe
  C:\Windows\System\fSPkmlx.exe
  2⤵
  PID:7812
- C:\Windows\System\CdtzRFg.exe
  C:\Windows\System\CdtzRFg.exe
  2⤵
  PID:7840
- C:\Windows\System\nbLtMbb.exe
  C:\Windows\System\nbLtMbb.exe
  2⤵
  PID:7860
- C:\Windows\System\hUuBJHj.exe
  C:\Windows\System\hUuBJHj.exe
  2⤵
  PID:7928
- C:\Windows\System\ypaVeMz.exe
  C:\Windows\System\ypaVeMz.exe
  2⤵
  PID:7948
- C:\Windows\System\FhNgVDe.exe
  C:\Windows\System\FhNgVDe.exe
  2⤵
  PID:8012
- C:\Windows\System\NcAUeer.exe
  C:\Windows\System\NcAUeer.exe
  2⤵
  PID:8028
- C:\Windows\System\cGKFSJN.exe
  C:\Windows\System\cGKFSJN.exe
  2⤵
  PID:8044
- C:\Windows\System\NTgXEOt.exe
  C:\Windows\System\NTgXEOt.exe
  2⤵
  PID:8064
- C:\Windows\System\CzZZQhz.exe
  C:\Windows\System\CzZZQhz.exe
  2⤵
  PID:8084
- C:\Windows\System\eRHIkSY.exe
  C:\Windows\System\eRHIkSY.exe
  2⤵
  PID:8104
- C:\Windows\System\dMebXDI.exe
  C:\Windows\System\dMebXDI.exe
  2⤵
  PID:8148
- C:\Windows\System\UDWIWNF.exe
  C:\Windows\System\UDWIWNF.exe
  2⤵
  PID:8180
- C:\Windows\System\JwIKwkj.exe
  C:\Windows\System\JwIKwkj.exe
  2⤵
  PID:6780
- C:\Windows\System\cfdCdZz.exe
  C:\Windows\System\cfdCdZz.exe
  2⤵
  PID:7256
- C:\Windows\System\YLRHuwJ.exe
  C:\Windows\System\YLRHuwJ.exe
  2⤵
  PID:7360
- C:\Windows\System\sHqRNpz.exe
  C:\Windows\System\sHqRNpz.exe
  2⤵
  PID:7452
- C:\Windows\System\rtyglFK.exe
  C:\Windows\System\rtyglFK.exe
  2⤵
  PID:7504
- C:\Windows\System\tHmYBEo.exe
  C:\Windows\System\tHmYBEo.exe
  2⤵
  PID:6528
- C:\Windows\System\rWRxaMr.exe
  C:\Windows\System\rWRxaMr.exe
  2⤵
  PID:7648
- C:\Windows\System\HLZpERs.exe
  C:\Windows\System\HLZpERs.exe
  2⤵
  PID:7720
- C:\Windows\System\eRmyRFB.exe
  C:\Windows\System\eRmyRFB.exe
  2⤵
  PID:7708
- C:\Windows\System\xoxMqtg.exe
  C:\Windows\System\xoxMqtg.exe
  2⤵
  PID:7748
- C:\Windows\System\sJyvPTr.exe
  C:\Windows\System\sJyvPTr.exe
  2⤵
  PID:7852
- C:\Windows\System\eibyRky.exe
  C:\Windows\System\eibyRky.exe
  2⤵
  PID:5776
- C:\Windows\System\aZWZeDk.exe
  C:\Windows\System\aZWZeDk.exe
  2⤵
  PID:7940
- C:\Windows\System\TqyDxvS.exe
  C:\Windows\System\TqyDxvS.exe
  2⤵
  PID:7896
- C:\Windows\System\GOrAkZr.exe
  C:\Windows\System\GOrAkZr.exe
  2⤵
  PID:8024
- C:\Windows\System\UnYgpON.exe
  C:\Windows\System\UnYgpON.exe
  2⤵
  PID:8004
- C:\Windows\System\tIfpavE.exe
  C:\Windows\System\tIfpavE.exe
  2⤵
  PID:8160
- C:\Windows\System\VHNpgCN.exe
  C:\Windows\System\VHNpgCN.exe
  2⤵
  PID:7296
- C:\Windows\System\vnKSCAg.exe
  C:\Windows\System\vnKSCAg.exe
  2⤵
  PID:7488
- C:\Windows\System\qHLlZkw.exe
  C:\Windows\System\qHLlZkw.exe
  2⤵
  PID:7604
- C:\Windows\System\nwiefHT.exe
  C:\Windows\System\nwiefHT.exe
  2⤵
  PID:7804
- C:\Windows\System\ssSCwfA.exe
  C:\Windows\System\ssSCwfA.exe
  2⤵
  PID:7908
- C:\Windows\System\SEBBVeA.exe
  C:\Windows\System\SEBBVeA.exe
  2⤵
  PID:7980
- C:\Windows\System\snxOcYC.exe
  C:\Windows\System\snxOcYC.exe
  2⤵
  PID:8132
- C:\Windows\System\lYLJgqs.exe
  C:\Windows\System\lYLJgqs.exe
  2⤵
  PID:7332
- C:\Windows\System\kzKWwsw.exe
  C:\Windows\System\kzKWwsw.exe
  2⤵
  PID:7684
- C:\Windows\System\MXnOyZw.exe
  C:\Windows\System\MXnOyZw.exe
  2⤵
  PID:7892
- C:\Windows\System\HVBjWWg.exe
  C:\Windows\System\HVBjWWg.exe
  2⤵
  PID:8080
- C:\Windows\System\iTdDLxc.exe
  C:\Windows\System\iTdDLxc.exe
  2⤵
  PID:8052
- C:\Windows\System\OVzBlDi.exe
  C:\Windows\System\OVzBlDi.exe
  2⤵
  PID:6676
- C:\Windows\System\sTkIyYy.exe
  C:\Windows\System\sTkIyYy.exe
  2⤵
  PID:8220
- C:\Windows\System\RrSPqlq.exe
  C:\Windows\System\RrSPqlq.exe
  2⤵
  PID:8240
- C:\Windows\System\BQVfGbN.exe
  C:\Windows\System\BQVfGbN.exe
  2⤵
  PID:8260
- C:\Windows\System\GHhDLIj.exe
  C:\Windows\System\GHhDLIj.exe
  2⤵
  PID:8288
- C:\Windows\System\RDjqlst.exe
  C:\Windows\System\RDjqlst.exe
  2⤵
  PID:8316
- C:\Windows\System\RZkRkGR.exe
  C:\Windows\System\RZkRkGR.exe
  2⤵
  PID:8344
- C:\Windows\System\NUBZnMc.exe
  C:\Windows\System\NUBZnMc.exe
  2⤵
  PID:8364
- C:\Windows\System\EgKStyu.exe
  C:\Windows\System\EgKStyu.exe
  2⤵
  PID:8388
- C:\Windows\System\lGCfCbO.exe
  C:\Windows\System\lGCfCbO.exe
  2⤵
  PID:8444
- C:\Windows\System\EiOWwqC.exe
  C:\Windows\System\EiOWwqC.exe
  2⤵
  PID:8476
- C:\Windows\System\wvchMQf.exe
  C:\Windows\System\wvchMQf.exe
  2⤵
  PID:8508
- C:\Windows\System\YsfyuxV.exe
  C:\Windows\System\YsfyuxV.exe
  2⤵
  PID:8528
- C:\Windows\System\vkRaspJ.exe
  C:\Windows\System\vkRaspJ.exe
  2⤵
  PID:8564
- C:\Windows\System\sRhiSTq.exe
  C:\Windows\System\sRhiSTq.exe
  2⤵
  PID:8592
- C:\Windows\System\FrBEmjV.exe
  C:\Windows\System\FrBEmjV.exe
  2⤵
  PID:8620
- C:\Windows\System\NFjvkha.exe
  C:\Windows\System\NFjvkha.exe
  2⤵
  PID:8640
- C:\Windows\System\GKkxPVg.exe
  C:\Windows\System\GKkxPVg.exe
  2⤵
  PID:8656
- C:\Windows\System\uakXIuI.exe
  C:\Windows\System\uakXIuI.exe
  2⤵
  PID:8676
- C:\Windows\System\zxlfzkS.exe
  C:\Windows\System\zxlfzkS.exe
  2⤵
  PID:8704
- C:\Windows\System\CdxDXqC.exe
  C:\Windows\System\CdxDXqC.exe
  2⤵
  PID:8728
- C:\Windows\System\GSIAxgd.exe
  C:\Windows\System\GSIAxgd.exe
  2⤵
  PID:8752
- C:\Windows\System\NzkFPQJ.exe
  C:\Windows\System\NzkFPQJ.exe
  2⤵
  PID:8820
- C:\Windows\System\RtmYIqr.exe
  C:\Windows\System\RtmYIqr.exe
  2⤵
  PID:8844
- C:\Windows\System\wVZXzFB.exe
  C:\Windows\System\wVZXzFB.exe
  2⤵
  PID:8872
- C:\Windows\System\WBtoJXW.exe
  C:\Windows\System\WBtoJXW.exe
  2⤵
  PID:8892
- C:\Windows\System\eXGsvDn.exe
  C:\Windows\System\eXGsvDn.exe
  2⤵
  PID:8912
- C:\Windows\System\ErpGuvf.exe
  C:\Windows\System\ErpGuvf.exe
  2⤵
  PID:8940
- C:\Windows\System\yPruBrA.exe
  C:\Windows\System\yPruBrA.exe
  2⤵
  PID:8968
- C:\Windows\System\UihhuLB.exe
  C:\Windows\System\UihhuLB.exe
  2⤵
  PID:8988
- C:\Windows\System\hvRrVtV.exe
  C:\Windows\System\hvRrVtV.exe
  2⤵
  PID:9024
- C:\Windows\System\rnPiYbc.exe
  C:\Windows\System\rnPiYbc.exe
  2⤵
  PID:9064
- C:\Windows\System\yPEwAyO.exe
  C:\Windows\System\yPEwAyO.exe
  2⤵
  PID:9080
- C:\Windows\System\kWBTzEn.exe
  C:\Windows\System\kWBTzEn.exe
  2⤵
  PID:9108
- C:\Windows\System\cGeeASi.exe
  C:\Windows\System\cGeeASi.exe
  2⤵
  PID:9140
- C:\Windows\System\roGfBcX.exe
  C:\Windows\System\roGfBcX.exe
  2⤵
  PID:9188
- C:\Windows\System\pDLtbvu.exe
  C:\Windows\System\pDLtbvu.exe
  2⤵
  PID:9212
- C:\Windows\System\qFafqJw.exe
  C:\Windows\System\qFafqJw.exe
  2⤵
  PID:8228
- C:\Windows\System\PIYKgal.exe
  C:\Windows\System\PIYKgal.exe
  2⤵
  PID:8304
- C:\Windows\System\jitqppo.exe
  C:\Windows\System\jitqppo.exe
  2⤵
  PID:8380
- C:\Windows\System\meeARnF.exe
  C:\Windows\System\meeARnF.exe
  2⤵
  PID:8432
- C:\Windows\System\NcKKIvo.exe
  C:\Windows\System\NcKKIvo.exe
  2⤵
  PID:8500
- C:\Windows\System\pwcHflg.exe
  C:\Windows\System\pwcHflg.exe
  2⤵
  PID:8552
- C:\Windows\System\TXBnQfV.exe
  C:\Windows\System\TXBnQfV.exe
  2⤵
  PID:8612
- C:\Windows\System\UEXjHwL.exe
  C:\Windows\System\UEXjHwL.exe
  2⤵
  PID:8696
- C:\Windows\System\AzfxrxS.exe
  C:\Windows\System\AzfxrxS.exe
  2⤵
  PID:8748
- C:\Windows\System\LmWjFqG.exe
  C:\Windows\System\LmWjFqG.exe
  2⤵
  PID:8832
- C:\Windows\System\DFFWWjL.exe
  C:\Windows\System\DFFWWjL.exe
  2⤵
  PID:8884
- C:\Windows\System\GofRhqS.exe
  C:\Windows\System\GofRhqS.exe
  2⤵
  PID:8960
- C:\Windows\System\WhKhiCa.exe
  C:\Windows\System\WhKhiCa.exe
  2⤵
  PID:9000
- C:\Windows\System\PGYrWSW.exe
  C:\Windows\System\PGYrWSW.exe
  2⤵
  PID:9044
- C:\Windows\System\POXRhby.exe
  C:\Windows\System\POXRhby.exe
  2⤵
  PID:9104
- C:\Windows\System\GKYIDub.exe
  C:\Windows\System\GKYIDub.exe
  2⤵
  PID:9176
- C:\Windows\System\rcKRQDD.exe
  C:\Windows\System\rcKRQDD.exe
  2⤵
  PID:8296
- C:\Windows\System\PmtMFVC.exe
  C:\Windows\System\PmtMFVC.exe
  2⤵
  PID:8428
- C:\Windows\System\CombTga.exe
  C:\Windows\System\CombTga.exe
  2⤵
  PID:8556
- C:\Windows\System\cImbsld.exe
  C:\Windows\System\cImbsld.exe
  2⤵
  PID:8628
- C:\Windows\System\PtLsSaz.exe
  C:\Windows\System\PtLsSaz.exe
  2⤵
  PID:8776
- C:\Windows\System\uthtCsz.exe
  C:\Windows\System\uthtCsz.exe
  2⤵
  PID:9016
- C:\Windows\System\GKCbUvu.exe
  C:\Windows\System\GKCbUvu.exe
  2⤵
  PID:9132
- C:\Windows\System\OlUQNts.exe
  C:\Windows\System\OlUQNts.exe
  2⤵
  PID:8376
- C:\Windows\System\AFsptSv.exe
  C:\Windows\System\AFsptSv.exe
  2⤵
  PID:8724
- C:\Windows\System\vRtqBRw.exe
  C:\Windows\System\vRtqBRw.exe
  2⤵
  PID:9220
- C:\Windows\System\mQcWuZu.exe
  C:\Windows\System\mQcWuZu.exe
  2⤵
  PID:9240
- C:\Windows\System\iHcWEIw.exe
  C:\Windows\System\iHcWEIw.exe
  2⤵
  PID:9292
- C:\Windows\System\ZJwaVrH.exe
  C:\Windows\System\ZJwaVrH.exe
  2⤵
  PID:9308
- C:\Windows\System\lQlIIKW.exe
  C:\Windows\System\lQlIIKW.exe
  2⤵
  PID:9332
- C:\Windows\System\SvhbsGs.exe
  C:\Windows\System\SvhbsGs.exe
  2⤵
  PID:9348
- C:\Windows\System\uYrXokk.exe
  C:\Windows\System\uYrXokk.exe
  2⤵
  PID:9368
- C:\Windows\System\BBQGPvJ.exe
  C:\Windows\System\BBQGPvJ.exe
  2⤵
  PID:9388
- C:\Windows\System\FfTzpeg.exe
  C:\Windows\System\FfTzpeg.exe
  2⤵
  PID:9416
- C:\Windows\System\hwHeQFu.exe
  C:\Windows\System\hwHeQFu.exe
  2⤵
  PID:9432
- C:\Windows\System\hGnRmkV.exe
  C:\Windows\System\hGnRmkV.exe
  2⤵
  PID:9476
- C:\Windows\System\jfWSBmz.exe
  C:\Windows\System\jfWSBmz.exe
  2⤵
  PID:9512
- C:\Windows\System\wLdZVrz.exe
  C:\Windows\System\wLdZVrz.exe
  2⤵
  PID:9568
- C:\Windows\System\SIzjmrF.exe
  C:\Windows\System\SIzjmrF.exe
  2⤵
  PID:9596
- C:\Windows\System\vXwUZZo.exe
  C:\Windows\System\vXwUZZo.exe
  2⤵
  PID:9616
- C:\Windows\System\vYczVHi.exe
  C:\Windows\System\vYczVHi.exe
  2⤵
  PID:9656
- C:\Windows\System\RZfmmxx.exe
  C:\Windows\System\RZfmmxx.exe
  2⤵
  PID:9672
- C:\Windows\System\hgavCFC.exe
  C:\Windows\System\hgavCFC.exe
  2⤵
  PID:9700
- C:\Windows\System\SYcCGmW.exe
  C:\Windows\System\SYcCGmW.exe
  2⤵
  PID:9740
- C:\Windows\System\leXQZcp.exe
  C:\Windows\System\leXQZcp.exe
  2⤵
  PID:9772
- C:\Windows\System\AzOERll.exe
  C:\Windows\System\AzOERll.exe
  2⤵
  PID:9796
- C:\Windows\System\kVTRTbn.exe
  C:\Windows\System\kVTRTbn.exe
  2⤵
  PID:9828
- C:\Windows\System\CGwfBkd.exe
  C:\Windows\System\CGwfBkd.exe
  2⤵
  PID:9856
- C:\Windows\System\bmcjtcQ.exe
  C:\Windows\System\bmcjtcQ.exe
  2⤵
  PID:9872
- C:\Windows\System\PnySrnc.exe
  C:\Windows\System\PnySrnc.exe
  2⤵
  PID:9892
- C:\Windows\System\MIdEpbS.exe
  C:\Windows\System\MIdEpbS.exe
  2⤵
  PID:9916
- C:\Windows\System\vWqKbWR.exe
  C:\Windows\System\vWqKbWR.exe
  2⤵
  PID:9944
- C:\Windows\System\QsejAHx.exe
  C:\Windows\System\QsejAHx.exe
  2⤵
  PID:9996
- C:\Windows\System\iJWRvBt.exe
  C:\Windows\System\iJWRvBt.exe
  2⤵
  PID:10020
- C:\Windows\System\alUtEGy.exe
  C:\Windows\System\alUtEGy.exe
  2⤵
  PID:10060
- C:\Windows\System\UFwPknU.exe
  C:\Windows\System\UFwPknU.exe
  2⤵
  PID:10084
- C:\Windows\System\bmoiWUb.exe
  C:\Windows\System\bmoiWUb.exe
  2⤵
  PID:10112
- C:\Windows\System\ZFnCFgd.exe
  C:\Windows\System\ZFnCFgd.exe
  2⤵
  PID:10140
- C:\Windows\System\ZWDyqdI.exe
  C:\Windows\System\ZWDyqdI.exe
  2⤵
  PID:10168
- C:\Windows\System\sQFmEQV.exe
  C:\Windows\System\sQFmEQV.exe
  2⤵
  PID:10184
- C:\Windows\System\nhCdxZO.exe
  C:\Windows\System\nhCdxZO.exe
  2⤵
  PID:10208
- C:\Windows\System\TaWOTmx.exe
  C:\Windows\System\TaWOTmx.exe
  2⤵
  PID:8908
- C:\Windows\System\DsIeMqI.exe
  C:\Windows\System\DsIeMqI.exe
  2⤵
  PID:8256
- C:\Windows\System\nOqXXVJ.exe
  C:\Windows\System\nOqXXVJ.exe
  2⤵
  PID:9276
- C:\Windows\System\TnQbGQB.exe
  C:\Windows\System\TnQbGQB.exe
  2⤵
  PID:9304
- C:\Windows\System\lzAGsob.exe
  C:\Windows\System\lzAGsob.exe
  2⤵
  PID:9360
- C:\Windows\System\npObQWi.exe
  C:\Windows\System\npObQWi.exe
  2⤵
  PID:9452
- C:\Windows\System\fSFqiMv.exe
  C:\Windows\System\fSFqiMv.exe
  2⤵
  PID:9400
- C:\Windows\System\YQhlJym.exe
  C:\Windows\System\YQhlJym.exe
  2⤵
  PID:9508
- C:\Windows\System\WJjKCgF.exe
  C:\Windows\System\WJjKCgF.exe
  2⤵
  PID:9576
- C:\Windows\System\LAzZAjT.exe
  C:\Windows\System\LAzZAjT.exe
  2⤵
  PID:9668
- C:\Windows\System\PeCRTLv.exe
  C:\Windows\System\PeCRTLv.exe
  2⤵
  PID:9844
- C:\Windows\System\IZAMEia.exe
  C:\Windows\System\IZAMEia.exe
  2⤵
  PID:9880
- C:\Windows\System\hpjLOEF.exe
  C:\Windows\System\hpjLOEF.exe
  2⤵
  PID:9956
- C:\Windows\System\mirmZvh.exe
  C:\Windows\System\mirmZvh.exe
  2⤵
  PID:9120
- C:\Windows\System\ofNnaEG.exe
  C:\Windows\System\ofNnaEG.exe
  2⤵
  PID:10052
- C:\Windows\System\nuOywrZ.exe
  C:\Windows\System\nuOywrZ.exe
  2⤵
  PID:10132
- C:\Windows\System\tloiEkd.exe
  C:\Windows\System\tloiEkd.exe
  2⤵
  PID:10180
- C:\Windows\System\csXyYaa.exe
  C:\Windows\System\csXyYaa.exe
  2⤵
  PID:10232
- C:\Windows\System\gkRNceQ.exe
  C:\Windows\System\gkRNceQ.exe
  2⤵
  PID:9280
- C:\Windows\System\CZuhSbP.exe
  C:\Windows\System\CZuhSbP.exe
  2⤵
  PID:9384
- C:\Windows\System\LvgKNCP.exe
  C:\Windows\System\LvgKNCP.exe
  2⤵
  PID:9428
- C:\Windows\System\VBzLJqZ.exe
  C:\Windows\System\VBzLJqZ.exe
  2⤵
  PID:9644
- C:\Windows\System\XPptkgU.exe
  C:\Windows\System\XPptkgU.exe
  2⤵
  PID:9964
- C:\Windows\System\NrXKuKt.exe
  C:\Windows\System\NrXKuKt.exe
  2⤵
  PID:10056
- C:\Windows\System\mrFyWaS.exe
  C:\Windows\System\mrFyWaS.exe
  2⤵
  PID:10204
- C:\Windows\System\RBlbwLJ.exe
  C:\Windows\System\RBlbwLJ.exe
  2⤵
  PID:9468
- C:\Windows\System\EGDhlVc.exe
  C:\Windows\System\EGDhlVc.exe
  2⤵
  PID:9884
- C:\Windows\System\CvsQmZc.exe
  C:\Windows\System\CvsQmZc.exe
  2⤵
  PID:10160
- C:\Windows\System\oOjJGMk.exe
  C:\Windows\System\oOjJGMk.exe
  2⤵
  PID:10264
- C:\Windows\System\SPNLnNl.exe
  C:\Windows\System\SPNLnNl.exe
  2⤵
  PID:10300
- C:\Windows\System\RYMcevk.exe
  C:\Windows\System\RYMcevk.exe
  2⤵
  PID:10324
- C:\Windows\System\yBGyPSk.exe
  C:\Windows\System\yBGyPSk.exe
  2⤵
  PID:10352
- C:\Windows\System\buiLHkD.exe
  C:\Windows\System\buiLHkD.exe
  2⤵
  PID:10392
- C:\Windows\System\NRdYyXA.exe
  C:\Windows\System\NRdYyXA.exe
  2⤵
  PID:10420
- C:\Windows\System\WbXfcwd.exe
  C:\Windows\System\WbXfcwd.exe
  2⤵
  PID:10436
- C:\Windows\System\vTpbKHH.exe
  C:\Windows\System\vTpbKHH.exe
  2⤵
  PID:10464
- C:\Windows\System\aMDhRlE.exe
  C:\Windows\System\aMDhRlE.exe
  2⤵
  PID:10496
- C:\Windows\System\CyHXwxT.exe
  C:\Windows\System\CyHXwxT.exe
  2⤵
  PID:10520
- C:\Windows\System\UnkdPEq.exe
  C:\Windows\System\UnkdPEq.exe
  2⤵
  PID:10540
- C:\Windows\System\XqMRTdF.exe
  C:\Windows\System\XqMRTdF.exe
  2⤵
  PID:10568
- C:\Windows\System\mEoVqvx.exe
  C:\Windows\System\mEoVqvx.exe
  2⤵
  PID:10604
- C:\Windows\System\vCFOYMT.exe
  C:\Windows\System\vCFOYMT.exe
  2⤵
  PID:10656
- C:\Windows\System\TkKKukv.exe
  C:\Windows\System\TkKKukv.exe
  2⤵
  PID:10688
- C:\Windows\System\GguIKnt.exe
  C:\Windows\System\GguIKnt.exe
  2⤵
  PID:10708
- C:\Windows\System\vPXChjQ.exe
  C:\Windows\System\vPXChjQ.exe
  2⤵
  PID:10748
- C:\Windows\System\ejQEEDq.exe
  C:\Windows\System\ejQEEDq.exe
  2⤵
  PID:10768
- C:\Windows\System\EWClFkT.exe
  C:\Windows\System\EWClFkT.exe
  2⤵
  PID:10804
- C:\Windows\System\JUcCWHq.exe
  C:\Windows\System\JUcCWHq.exe
  2⤵
  PID:10824
- C:\Windows\System\ZkjiDbK.exe
  C:\Windows\System\ZkjiDbK.exe
  2⤵
  PID:10848
- C:\Windows\System\gRIBCUm.exe
  C:\Windows\System\gRIBCUm.exe
  2⤵
  PID:10868
- C:\Windows\System\mIieSKU.exe
  C:\Windows\System\mIieSKU.exe
  2⤵
  PID:10900
- C:\Windows\System\PvAQyyt.exe
  C:\Windows\System\PvAQyyt.exe
  2⤵
  PID:10924
- C:\Windows\System\XZWSSbz.exe
  C:\Windows\System\XZWSSbz.exe
  2⤵
  PID:10944
- C:\Windows\System\ggBQAwU.exe
  C:\Windows\System\ggBQAwU.exe
  2⤵
  PID:10980
- C:\Windows\System\ZnLHrpy.exe
  C:\Windows\System\ZnLHrpy.exe
  2⤵
  PID:11008
- C:\Windows\System\rVMkdLT.exe
  C:\Windows\System\rVMkdLT.exe
  2⤵
  PID:11028
- C:\Windows\System\nbyaxYt.exe
  C:\Windows\System\nbyaxYt.exe
  2⤵
  PID:11048
- C:\Windows\System\vQLZfPi.exe
  C:\Windows\System\vQLZfPi.exe
  2⤵
  PID:11072
- C:\Windows\System\DRyLBvs.exe
  C:\Windows\System\DRyLBvs.exe
  2⤵
  PID:11136
- C:\Windows\System\ZOCnWKO.exe
  C:\Windows\System\ZOCnWKO.exe
  2⤵
  PID:11164
- C:\Windows\System\uyUIgjl.exe
  C:\Windows\System\uyUIgjl.exe
  2⤵
  PID:11184
- C:\Windows\System\Iqphbfg.exe
  C:\Windows\System\Iqphbfg.exe
  2⤵
  PID:11204
- C:\Windows\System\MuBZKYO.exe
  C:\Windows\System\MuBZKYO.exe
  2⤵
  PID:11224
- C:\Windows\System\qaEfGrR.exe
  C:\Windows\System\qaEfGrR.exe
  2⤵
  PID:11244
- C:\Windows\System\dRaXSUF.exe
  C:\Windows\System\dRaXSUF.exe
  2⤵
  PID:10252
- C:\Windows\System\SRxOPxn.exe
  C:\Windows\System\SRxOPxn.exe
  2⤵
  PID:8424
- C:\Windows\System\KyHLWzA.exe
  C:\Windows\System\KyHLWzA.exe
  2⤵
  PID:10364
- C:\Windows\System\DhlVHej.exe
  C:\Windows\System\DhlVHej.exe
  2⤵
  PID:10432
- C:\Windows\System\BttlcxU.exe
  C:\Windows\System\BttlcxU.exe
  2⤵
  PID:10460
- C:\Windows\System\EqhjRmD.exe
  C:\Windows\System\EqhjRmD.exe
  2⤵
  PID:10580
- C:\Windows\System\FpcFInj.exe
  C:\Windows\System\FpcFInj.exe
  2⤵
  PID:10700
- C:\Windows\System\DumTclD.exe
  C:\Windows\System\DumTclD.exe
  2⤵
  PID:10764
- C:\Windows\System\NWlXBlV.exe
  C:\Windows\System\NWlXBlV.exe
  2⤵
  PID:10812
- C:\Windows\System\FiYAtiu.exe
  C:\Windows\System\FiYAtiu.exe
  2⤵
  PID:10840
- C:\Windows\System\XWnOWPm.exe
  C:\Windows\System\XWnOWPm.exe
  2⤵
  PID:10888
- C:\Windows\System\uPIYyNv.exe
  C:\Windows\System\uPIYyNv.exe
  2⤵
  PID:11108
- C:\Windows\System\riuWrKA.exe
  C:\Windows\System\riuWrKA.exe
  2⤵
  PID:11152
- C:\Windows\System\ZmmFnMj.exe
  C:\Windows\System\ZmmFnMj.exe
  2⤵
  PID:11180
- C:\Windows\System\cOWITXB.exe
  C:\Windows\System\cOWITXB.exe
  2⤵
  PID:10004
- C:\Windows\System\FZDdbVf.exe
  C:\Windows\System\FZDdbVf.exe
  2⤵
  PID:10516
- C:\Windows\System\BgsUvxF.exe
  C:\Windows\System\BgsUvxF.exe
  2⤵
  PID:10428
- C:\Windows\System\wvyIIqH.exe
  C:\Windows\System\wvyIIqH.exe
  2⤵
  PID:10476
- C:\Windows\System\DfnCjno.exe
  C:\Windows\System\DfnCjno.exe
  2⤵
  PID:10844
- C:\Windows\System\TGiqReI.exe
  C:\Windows\System\TGiqReI.exe
  2⤵
  PID:10920
- C:\Windows\System\VKBfLsI.exe
  C:\Windows\System\VKBfLsI.exe
  2⤵
  PID:11144
- C:\Windows\System\WlWOKLP.exe
  C:\Windows\System\WlWOKLP.exe
  2⤵
  PID:10628
- C:\Windows\System\YzUYAWE.exe
  C:\Windows\System\YzUYAWE.exe
  2⤵
  PID:10996
- C:\Windows\System\IHAnlaT.exe
  C:\Windows\System\IHAnlaT.exe
  2⤵
  PID:11272
- C:\Windows\System\JJMYJmO.exe
  C:\Windows\System\JJMYJmO.exe
  2⤵
  PID:11312
- C:\Windows\System\XTYfplS.exe
  C:\Windows\System\XTYfplS.exe
  2⤵
  PID:11344
- C:\Windows\System\nBdcDOU.exe
  C:\Windows\System\nBdcDOU.exe
  2⤵
  PID:11368
- C:\Windows\System\zxcczDm.exe
  C:\Windows\System\zxcczDm.exe
  2⤵
  PID:11384
- C:\Windows\System\NlmPKkE.exe
  C:\Windows\System\NlmPKkE.exe
  2⤵
  PID:11408
- C:\Windows\System\vtDwPtf.exe
  C:\Windows\System\vtDwPtf.exe
  2⤵
  PID:11428
- C:\Windows\System\jSAvGVK.exe
  C:\Windows\System\jSAvGVK.exe
  2⤵
  PID:11452
- C:\Windows\System\coVFnuY.exe
  C:\Windows\System\coVFnuY.exe
  2⤵
  PID:11484
- C:\Windows\System\UvoendW.exe
  C:\Windows\System\UvoendW.exe
  2⤵
  PID:11508
- C:\Windows\System\XzpnNqa.exe
  C:\Windows\System\XzpnNqa.exe
  2⤵
  PID:11544
- C:\Windows\System\bphdGhC.exe
  C:\Windows\System\bphdGhC.exe
  2⤵
  PID:11596
- C:\Windows\System\wRqxZpq.exe
  C:\Windows\System\wRqxZpq.exe
  2⤵
  PID:11636
- C:\Windows\System\gWCGQNa.exe
  C:\Windows\System\gWCGQNa.exe
  2⤵
  PID:11664
- C:\Windows\System\TKJPvFI.exe
  C:\Windows\System\TKJPvFI.exe
  2⤵
  PID:11712
- C:\Windows\System\ahdSUOp.exe
  C:\Windows\System\ahdSUOp.exe
  2⤵
  PID:11736
- C:\Windows\System\yTgjDkh.exe
  C:\Windows\System\yTgjDkh.exe
  2⤵
  PID:11756
- C:\Windows\System\DViiMhx.exe
  C:\Windows\System\DViiMhx.exe
  2⤵
  PID:11776
- C:\Windows\System\PYWpjUv.exe
  C:\Windows\System\PYWpjUv.exe
  2⤵
  PID:11800
- C:\Windows\System\bMlWCkO.exe
  C:\Windows\System\bMlWCkO.exe
  2⤵
  PID:11840
- C:\Windows\System\gokHQBZ.exe
  C:\Windows\System\gokHQBZ.exe
  2⤵
  PID:11904
- C:\Windows\System\JTNUTiv.exe
  C:\Windows\System\JTNUTiv.exe
  2⤵
  PID:11928
- C:\Windows\System\PEUNlxu.exe
  C:\Windows\System\PEUNlxu.exe
  2⤵
  PID:11976
- C:\Windows\System\WFvCxly.exe
  C:\Windows\System\WFvCxly.exe
  2⤵
  PID:11996
- C:\Windows\System\ZYjTdvW.exe
  C:\Windows\System\ZYjTdvW.exe
  2⤵
  PID:12016
- C:\Windows\System\QqtSqCi.exe
  C:\Windows\System\QqtSqCi.exe
  2⤵
  PID:12060
- C:\Windows\System\XNVRvAG.exe
  C:\Windows\System\XNVRvAG.exe
  2⤵
  PID:12096
- C:\Windows\System\vddIpUe.exe
  C:\Windows\System\vddIpUe.exe
  2⤵
  PID:12112
- C:\Windows\System\aQIdsuE.exe
  C:\Windows\System\aQIdsuE.exe
  2⤵
  PID:12132
- C:\Windows\System\qVUAfeq.exe
  C:\Windows\System\qVUAfeq.exe
  2⤵
  PID:12184
- C:\Windows\System\ZDznjiS.exe
  C:\Windows\System\ZDznjiS.exe
  2⤵
  PID:12204
- C:\Windows\System\iFsIARp.exe
  C:\Windows\System\iFsIARp.exe
  2⤵
  PID:12228
- C:\Windows\System\xtwxtQF.exe
  C:\Windows\System\xtwxtQF.exe
  2⤵
  PID:12248
- C:\Windows\System\sBRlrVK.exe
  C:\Windows\System\sBRlrVK.exe
  2⤵
  PID:12280
- C:\Windows\System\SLdyuSn.exe
  C:\Windows\System\SLdyuSn.exe
  2⤵
  PID:11284
- C:\Windows\System\qWKPQQY.exe
  C:\Windows\System\qWKPQQY.exe
  2⤵
  PID:11404
- C:\Windows\System\ZacDcvH.exe
  C:\Windows\System\ZacDcvH.exe
  2⤵
  PID:11424
- C:\Windows\System\QsKlZmp.exe
  C:\Windows\System\QsKlZmp.exe
  2⤵
  PID:11568
- C:\Windows\System\XYwUSmE.exe
  C:\Windows\System\XYwUSmE.exe
  2⤵
  PID:11656
- C:\Windows\System\jcltfSp.exe
  C:\Windows\System\jcltfSp.exe
  2⤵
  PID:11704
- C:\Windows\System\PGIYmkL.exe
  C:\Windows\System\PGIYmkL.exe
  2⤵
  PID:11788
- C:\Windows\System\xENsqQb.exe
  C:\Windows\System\xENsqQb.exe
  2⤵
  PID:11836
- C:\Windows\System\XJfXiXc.exe
  C:\Windows\System\XJfXiXc.exe
  2⤵
  PID:11920
- C:\Windows\System\ZgBvgNC.exe
  C:\Windows\System\ZgBvgNC.exe
  2⤵
  PID:11992
- C:\Windows\System\hTxoVxf.exe
  C:\Windows\System\hTxoVxf.exe
  2⤵
  PID:12076
- C:\Windows\System\hUUMqbQ.exe
  C:\Windows\System\hUUMqbQ.exe
  2⤵
  PID:12124
- C:\Windows\System\uCFblDU.exe
  C:\Windows\System\uCFblDU.exe
  2⤵
  PID:12192
- C:\Windows\System\uRLJaNQ.exe
  C:\Windows\System\uRLJaNQ.exe
  2⤵
  PID:12220
- C:\Windows\System\IaUZeMk.exe
  C:\Windows\System\IaUZeMk.exe
  2⤵
  PID:11420
- C:\Windows\System\brXtFkx.exe
  C:\Windows\System\brXtFkx.exe
  2⤵
  PID:11724
- C:\Windows\System\eXWlDmf.exe
  C:\Windows\System\eXWlDmf.exe
  2⤵
  PID:11856
- C:\Windows\System\flRWTuA.exe
  C:\Windows\System\flRWTuA.exe
  2⤵
  PID:12008
- C:\Windows\System\vlbpVuj.exe
  C:\Windows\System\vlbpVuj.exe
  2⤵
  PID:12092
- C:\Windows\System\mdjYGFC.exe
  C:\Windows\System\mdjYGFC.exe
  2⤵
  PID:12036
- C:\Windows\System\cojLboR.exe
  C:\Windows\System\cojLboR.exe
  2⤵
  PID:7380
- C:\Windows\System\TpfRRFN.exe
  C:\Windows\System\TpfRRFN.exe
  2⤵
  PID:11960
- C:\Windows\System\IGqgWup.exe
  C:\Windows\System\IGqgWup.exe
  2⤵
  PID:11880
- C:\Windows\System\bsfWSjn.exe
  C:\Windows\System\bsfWSjn.exe
  2⤵
  PID:12316
- C:\Windows\System\CtxwVhG.exe
  C:\Windows\System\CtxwVhG.exe
  2⤵
  PID:12364
- C:\Windows\System\aRDeGDJ.exe
  C:\Windows\System\aRDeGDJ.exe
  2⤵
  PID:12388
- C:\Windows\System\XzSsZDz.exe
  C:\Windows\System\XzSsZDz.exe
  2⤵
  PID:12412
- C:\Windows\System\bjXoDFV.exe
  C:\Windows\System\bjXoDFV.exe
  2⤵
  PID:12456
- C:\Windows\System\WLfhSRN.exe
  C:\Windows\System\WLfhSRN.exe
  2⤵
  PID:12484
- C:\Windows\System\kCGgluu.exe
  C:\Windows\System\kCGgluu.exe
  2⤵
  PID:12524
- C:\Windows\System\nWWnjPl.exe
  C:\Windows\System\nWWnjPl.exe
  2⤵
  PID:12540
- C:\Windows\System\jvvjOhk.exe
  C:\Windows\System\jvvjOhk.exe
  2⤵
  PID:12592
- C:\Windows\System\smOBSVp.exe
  C:\Windows\System\smOBSVp.exe
  2⤵
  PID:12612
- C:\Windows\System\bKAroWA.exe
  C:\Windows\System\bKAroWA.exe
  2⤵
  PID:12632
- C:\Windows\System\KAsWZSN.exe
  C:\Windows\System\KAsWZSN.exe
  2⤵
  PID:12676
- C:\Windows\System\zrDctLL.exe
  C:\Windows\System\zrDctLL.exe
  2⤵
  PID:12708
- C:\Windows\System\lEoYmRk.exe
  C:\Windows\System\lEoYmRk.exe
  2⤵
  PID:12728
- C:\Windows\System\EkMsWUi.exe
  C:\Windows\System\EkMsWUi.exe
  2⤵
  PID:12756
- C:\Windows\System\DQJIOpU.exe
  C:\Windows\System\DQJIOpU.exe
  2⤵
  PID:12776
- C:\Windows\System\DxFSrEH.exe
  C:\Windows\System\DxFSrEH.exe
  2⤵
  PID:12800
- C:\Windows\System\QGkStHe.exe
  C:\Windows\System\QGkStHe.exe
  2⤵
  PID:12824
- C:\Windows\System\sEMWXlm.exe
  C:\Windows\System\sEMWXlm.exe
  2⤵
  PID:12864
- C:\Windows\System\LXKdJmC.exe
  C:\Windows\System\LXKdJmC.exe
  2⤵
  PID:12888
- C:\Windows\System\GLZKhkF.exe
  C:\Windows\System\GLZKhkF.exe
  2⤵
  PID:12940
- C:\Windows\System\tBUqwml.exe
  C:\Windows\System\tBUqwml.exe
  2⤵
  PID:12960
- C:\Windows\System\bGiUfHp.exe
  C:\Windows\System\bGiUfHp.exe
  2⤵
  PID:12984
- C:\Windows\System\HqpEnoy.exe
  C:\Windows\System\HqpEnoy.exe
  2⤵
  PID:13008
- C:\Windows\System\yqkwmNe.exe
  C:\Windows\System\yqkwmNe.exe
  2⤵
  PID:13024
- C:\Windows\System\BhHSndF.exe
  C:\Windows\System\BhHSndF.exe
  2⤵
  PID:13048
- C:\Windows\System\jVLmRXI.exe
  C:\Windows\System\jVLmRXI.exe
  2⤵
  PID:13092
- C:\Windows\System\sVmfnRr.exe
  C:\Windows\System\sVmfnRr.exe
  2⤵
  PID:13128
- C:\Windows\System\UVYOrgt.exe
  C:\Windows\System\UVYOrgt.exe
  2⤵
  PID:13152
- C:\Windows\System\VzGYYcx.exe
  C:\Windows\System\VzGYYcx.exe
  2⤵
  PID:13180
- C:\Windows\System\qMjIZMP.exe
  C:\Windows\System\qMjIZMP.exe
  2⤵
  PID:13208
- C:\Windows\System\yKfcCmS.exe
  C:\Windows\System\yKfcCmS.exe
  2⤵
  PID:13304
- C:\Windows\System\CLCDBMr.exe
  C:\Windows\System\CLCDBMr.exe
  2⤵
  PID:12180
- C:\Windows\System\UmKvwxU.exe
  C:\Windows\System\UmKvwxU.exe
  2⤵
  PID:11864
- C:\Windows\System\owqSazs.exe
  C:\Windows\System\owqSazs.exe
  2⤵
  PID:12308
- C:\Windows\System\nFLUiIU.exe
  C:\Windows\System\nFLUiIU.exe
  2⤵
  PID:12476
- C:\Windows\System\bPHuPCh.exe
  C:\Windows\System\bPHuPCh.exe
  2⤵
  PID:12532
- C:\Windows\System\aozZMQI.exe
  C:\Windows\System\aozZMQI.exe
  2⤵
  PID:12588
- C:\Windows\System\pHoHFoO.exe
  C:\Windows\System\pHoHFoO.exe
  2⤵
  PID:12608
- C:\Windows\System\tfipoUu.exe
  C:\Windows\System\tfipoUu.exe
  2⤵
  PID:12700
- C:\Windows\System\TQnEuBV.exe
  C:\Windows\System\TQnEuBV.exe
  2⤵
  PID:12768
- C:\Windows\System\EBXUGjf.exe
  C:\Windows\System\EBXUGjf.exe
  2⤵
  PID:12816
- C:\Windows\System\ySMhbRj.exe
  C:\Windows\System\ySMhbRj.exe
  2⤵
  PID:436
- C:\Windows\System\bSZzGtV.exe
  C:\Windows\System\bSZzGtV.exe
  2⤵
  PID:12880
- C:\Windows\System\qNKmJms.exe
  C:\Windows\System\qNKmJms.exe
  2⤵
  PID:1352
- C:\Windows\System\LBRRQcz.exe
  C:\Windows\System\LBRRQcz.exe
  2⤵
  PID:13032
- C:\Windows\System\hewquXx.exe
  C:\Windows\System\hewquXx.exe
  2⤵
  PID:13040
- C:\Windows\System\IwRgQio.exe
  C:\Windows\System\IwRgQio.exe
  2⤵
  PID:13144
- C:\Windows\System\TswjmOS.exe
  C:\Windows\System\TswjmOS.exe
  2⤵
  PID:13268
- C:\Windows\System\raDBabW.exe
  C:\Windows\System\raDBabW.exe
  2⤵
  PID:13296
- C:\Windows\System\YktqsEU.exe
  C:\Windows\System\YktqsEU.exe
  2⤵
  PID:11288
- C:\Windows\System\qFFwrTY.exe
  C:\Windows\System\qFFwrTY.exe
  2⤵
  PID:12336
- C:\Windows\System\pmtCShI.exe
  C:\Windows\System\pmtCShI.exe
  2⤵
  PID:12560
- C:\Windows\System\IXjtMDc.exe
  C:\Windows\System\IXjtMDc.exe
  2⤵
  PID:12688
- C:\Windows\System\WBFiogU.exe
  C:\Windows\System\WBFiogU.exe
  2⤵
  PID:12792
- C:\Windows\System\wIYOmTg.exe
  C:\Windows\System\wIYOmTg.exe
  2⤵
  PID:4372
- C:\Windows\System\QRMAWBs.exe
  C:\Windows\System\QRMAWBs.exe
  2⤵
  PID:12928
- C:\Windows\System\RhbuAZa.exe
  C:\Windows\System\RhbuAZa.exe
  2⤵
  PID:13136
- C:\Windows\System\IFNtfWm.exe
  C:\Windows\System\IFNtfWm.exe
  2⤵
  PID:12772
- C:\Windows\System\eTLwEls.exe
  C:\Windows\System\eTLwEls.exe
  2⤵
  PID:12852
- C:\Windows\System\JqhaEDI.exe
  C:\Windows\System\JqhaEDI.exe
  2⤵
  PID:12600
- C:\Windows\System\woxEhoW.exe
  C:\Windows\System\woxEhoW.exe
  2⤵
  PID:12788
- C:\Windows\System\wAvXIRC.exe
  C:\Windows\System\wAvXIRC.exe
  2⤵
  PID:12664
- C:\Windows\System\rVHOecr.exe
  C:\Windows\System\rVHOecr.exe
  2⤵
  PID:13328
- C:\Windows\System\JDJptQr.exe
  C:\Windows\System\JDJptQr.exe
  2⤵
  PID:13392
- C:\Windows\System\acowSdf.exe
  C:\Windows\System\acowSdf.exe
  2⤵
  PID:13408
- C:\Windows\System\atxwTkl.exe
  C:\Windows\System\atxwTkl.exe
  2⤵
  PID:13424
- C:\Windows\System\dIVsWrM.exe
  C:\Windows\System\dIVsWrM.exe
  2⤵
  PID:13440
- C:\Windows\System\KirHjHB.exe
  C:\Windows\System\KirHjHB.exe
  2⤵
  PID:13456
- C:\Windows\System\sXCaoGa.exe
  C:\Windows\System\sXCaoGa.exe
  2⤵
  PID:13472
- C:\Windows\System\PSEdPwR.exe
  C:\Windows\System\PSEdPwR.exe
  2⤵
  PID:13492
- C:\Windows\System\vTrfDDS.exe
  C:\Windows\System\vTrfDDS.exe
  2⤵
  PID:13512
- C:\Windows\System\HaBXPlg.exe
  C:\Windows\System\HaBXPlg.exe
  2⤵
  PID:13532
- C:\Windows\System\PJUAUvN.exe
  C:\Windows\System\PJUAUvN.exe
  2⤵
  PID:13548
- C:\Windows\System\fJQhMLr.exe
  C:\Windows\System\fJQhMLr.exe
  2⤵
  PID:13568
- C:\Windows\System\wyXJfsj.exe
  C:\Windows\System\wyXJfsj.exe
  2⤵
  PID:13628
- C:\Windows\System\qiiUyXG.exe
  C:\Windows\System\qiiUyXG.exe
  2⤵
  PID:13668
- C:\Windows\System\zGVDbuJ.exe
  C:\Windows\System\zGVDbuJ.exe
  2⤵
  PID:13720
- C:\Windows\System\bWPWPiD.exe
  C:\Windows\System\bWPWPiD.exe
  2⤵
  PID:13776
- C:\Windows\System\iDsBIhX.exe
  C:\Windows\System\iDsBIhX.exe
  2⤵
  PID:13808
- C:\Windows\System\ROZgMBB.exe
  C:\Windows\System\ROZgMBB.exe
  2⤵
  PID:13840
- C:\Windows\System\TAWbOaz.exe
  C:\Windows\System\TAWbOaz.exe
  2⤵
  PID:13860
- C:\Windows\System\fPdgznU.exe
  C:\Windows\System\fPdgznU.exe
  2⤵
  PID:12048
- C:\Windows\System\SkzEEfm.exe
  C:\Windows\System\SkzEEfm.exe
  2⤵
  PID:13352
- C:\Windows\System\UpuRMWr.exe
  C:\Windows\System\UpuRMWr.exe
  2⤵
  PID:13620
- C:\Windows\System\BuCcvKZ.exe
  C:\Windows\System\BuCcvKZ.exe
  2⤵
  PID:13656
- C:\Windows\System\qlTnToX.exe
  C:\Windows\System\qlTnToX.exe
  2⤵
  PID:13692
- C:\Windows\System\NyTsnLc.exe
  C:\Windows\System\NyTsnLc.exe
  2⤵
  PID:13748
- C:\Windows\System\wWXaIze.exe
  C:\Windows\System\wWXaIze.exe
  2⤵
  PID:13708
- C:\Windows\System\JxUWDCb.exe
  C:\Windows\System\JxUWDCb.exe
  2⤵
  PID:13800
- C:\Windows\System\fWoKjBM.exe
  C:\Windows\System\fWoKjBM.exe
  2⤵
  PID:4340
- C:\Windows\System\hNIlRDN.exe
  C:\Windows\System\hNIlRDN.exe
  2⤵
  PID:13856
- C:\Windows\System\kcNoddR.exe
  C:\Windows\System\kcNoddR.exe
  2⤵
  PID:13896
- C:\Windows\System\KEDGrnW.exe
  C:\Windows\System\KEDGrnW.exe
  2⤵
  PID:13880
- C:\Windows\System\EgpMgJs.exe
  C:\Windows\System\EgpMgJs.exe
  2⤵
  PID:13940
- C:\Windows\System\BdzOMGy.exe
  C:\Windows\System\BdzOMGy.exe
  2⤵
  PID:13956
- C:\Windows\System\MnLkoub.exe
  C:\Windows\System\MnLkoub.exe
  2⤵
  PID:13972
- C:\Windows\System\gatiTHU.exe
  C:\Windows\System\gatiTHU.exe
  2⤵
  PID:13988
- C:\Windows\System\mwoCzvt.exe
  C:\Windows\System\mwoCzvt.exe
  2⤵
  PID:2496
- C:\Windows\System\utNCoSt.exe
  C:\Windows\System\utNCoSt.exe
  2⤵
  PID:14028
- C:\Windows\System\UFPnfIp.exe
  C:\Windows\System\UFPnfIp.exe
  2⤵
  PID:14044
- C:\Windows\System\JOjBLsw.exe
  C:\Windows\System\JOjBLsw.exe
  2⤵
  PID:14060
- C:\Windows\System\ekvYzxo.exe
  C:\Windows\System\ekvYzxo.exe
  2⤵
  PID:14076
- C:\Windows\System\xTPUJAS.exe
  C:\Windows\System\xTPUJAS.exe
  2⤵
  PID:3692
- C:\Windows\System\MNwxANQ.exe
  C:\Windows\System\MNwxANQ.exe
  2⤵
  PID:14092
- C:\Windows\System\FlPxusk.exe
  C:\Windows\System\FlPxusk.exe
  2⤵
  PID:14104
- C:\Windows\System\HAVovJf.exe
  C:\Windows\System\HAVovJf.exe
  2⤵
  PID:14120
- C:\Windows\System\PfLhSla.exe
  C:\Windows\System\PfLhSla.exe
  2⤵
  PID:5428
- C:\Windows\System\KUBvIVl.exe
  C:\Windows\System\KUBvIVl.exe
  2⤵
  PID:14148
- C:\Windows\System\sVFvxFP.exe
  C:\Windows\System\sVFvxFP.exe
  2⤵
  PID:14180
- C:\Windows\System\TjLnzub.exe
  C:\Windows\System\TjLnzub.exe
  2⤵
  PID:14196
- C:\Windows\System\ieKpwJw.exe
  C:\Windows\System\ieKpwJw.exe
  2⤵
  PID:14220
- C:\Windows\System\ETEXYCT.exe
  C:\Windows\System\ETEXYCT.exe
  2⤵
  PID:10348
- C:\Windows\System\SVgYMhQ.exe
  C:\Windows\System\SVgYMhQ.exe
  2⤵
  PID:10280
- C:\Windows\System\vIrsHZV.exe
  C:\Windows\System\vIrsHZV.exe
  2⤵
  PID:10292
- C:\Windows\System\thReWhp.exe
  C:\Windows\System\thReWhp.exe
  2⤵
  PID:10248
- C:\Windows\System\jsUkoQG.exe
  C:\Windows\System\jsUkoQG.exe
  2⤵
  PID:10272
- C:\Windows\System\leepnRW.exe
  C:\Windows\System\leepnRW.exe
  2⤵
  PID:14244
- C:\Windows\System\WvyOnit.exe
  C:\Windows\System\WvyOnit.exe
  2⤵
  PID:14300
- C:\Windows\System\hMhEcQn.exe
  C:\Windows\System\hMhEcQn.exe
  2⤵
  PID:14296
- C:\Windows\System\BycRhGM.exe
  C:\Windows\System\BycRhGM.exe
  2⤵
  PID:6848
- C:\Windows\System\kTcGNUf.exe
  C:\Windows\System\kTcGNUf.exe
  2⤵
  PID:228
- C:\Windows\System\wnUqgYF.exe
  C:\Windows\System\wnUqgYF.exe
  2⤵
  PID:5252
- C:\Windows\System\lMgXxmK.exe
  C:\Windows\System\lMgXxmK.exe
  2⤵
  PID:14308
- C:\Windows\System\JfCClKd.exe
  C:\Windows\System\JfCClKd.exe
  2⤵
  PID:14316
- C:\Windows\System\vTYQrEv.exe
  C:\Windows\System\vTYQrEv.exe
  2⤵
  PID:4436
- C:\Windows\System\wjdkXAI.exe
  C:\Windows\System\wjdkXAI.exe
  2⤵
  PID:13524
- C:\Windows\System\LHeGVfg.exe
  C:\Windows\System\LHeGVfg.exe
  2⤵
  PID:13452
- C:\Windows\System\wjjEVFm.exe
  C:\Windows\System\wjjEVFm.exe
  2⤵
  PID:5256
- C:\Windows\System\kJbLMuI.exe
  C:\Windows\System\kJbLMuI.exe
  2⤵
  PID:1696
- C:\Windows\System\Jfulatx.exe
  C:\Windows\System\Jfulatx.exe
  2⤵
  PID:13948
- C:\Windows\System\WFbsbdo.exe
  C:\Windows\System\WFbsbdo.exe
  2⤵
  PID:14096
- C:\Windows\System\OKKBzGk.exe
  C:\Windows\System\OKKBzGk.exe
  2⤵
  PID:852
- C:\Windows\System\WJkQczo.exe
  C:\Windows\System\WJkQczo.exe
  2⤵
  PID:14116
- C:\Windows\System\XDGCvtd.exe
  C:\Windows\System\XDGCvtd.exe
  2⤵
  PID:14136
- C:\Windows\System\fjtUBAl.exe
  C:\Windows\System\fjtUBAl.exe
  2⤵
  PID:5236
- C:\Windows\System\EdsGOjV.exe
  C:\Windows\System\EdsGOjV.exe
  2⤵
  PID:3244
- C:\Windows\System\OoPGrvr.exe
  C:\Windows\System\OoPGrvr.exe
  2⤵
  PID:4756
- C:\Windows\System\NSsvsQD.exe
  C:\Windows\System\NSsvsQD.exe
  2⤵
  PID:14264
- C:\Windows\System\ZUbBngE.exe
  C:\Windows\System\ZUbBngE.exe
  2⤵
  PID:4852
- C:\Windows\System\imqHoHW.exe
  C:\Windows\System\imqHoHW.exe
  2⤵
  PID:5016
- C:\Windows\System\lQuyRTY.exe
  C:\Windows\System\lQuyRTY.exe
  2⤵
  PID:13320
- C:\Windows\System\WVDqsbl.exe
  C:\Windows\System\WVDqsbl.exe
  2⤵
  PID:4684
- C:\Windows\System\JknqCWA.exe
  C:\Windows\System\JknqCWA.exe
  2⤵
  PID:2204
- C:\Windows\System\SVePgGV.exe
  C:\Windows\System\SVePgGV.exe
  2⤵
  PID:13920
- C:\Windows\System\oXkVmqO.exe
  C:\Windows\System\oXkVmqO.exe
  2⤵
  PID:7244
- C:\Windows\System\vVmxRxE.exe
  C:\Windows\System\vVmxRxE.exe
  2⤵
  PID:13520
- C:\Windows\System\hTJgIRP.exe
  C:\Windows\System\hTJgIRP.exe
  2⤵
  PID:13448
- C:\Windows\System\qyjNkXn.exe
  C:\Windows\System\qyjNkXn.exe
  2⤵
  PID:13468
- C:\Windows\System\YGIVEcR.exe
  C:\Windows\System\YGIVEcR.exe
  2⤵
  PID:7348
- C:\Windows\System\YcmPMZL.exe
  C:\Windows\System\YcmPMZL.exe
  2⤵
  PID:2392
- C:\Windows\System\QgobgWQ.exe
  C:\Windows\System\QgobgWQ.exe
  2⤵
  PID:2264
- C:\Windows\System\NCMNAfm.exe
  C:\Windows\System\NCMNAfm.exe
  2⤵
  PID:7404
- C:\Windows\System\hoGWHBI.exe
  C:\Windows\System\hoGWHBI.exe
  2⤵
  PID:5592
- C:\Windows\System\oKaDmYc.exe
  C:\Windows\System\oKaDmYc.exe
  2⤵
  PID:3240
- C:\Windows\System\utGsOnd.exe
  C:\Windows\System\utGsOnd.exe
  2⤵
  PID:13680
- C:\Windows\System\EmpUYrr.exe
  C:\Windows\System\EmpUYrr.exe
  2⤵
  PID:7480
- C:\Windows\System\SuKXyLv.exe
  C:\Windows\System\SuKXyLv.exe
  2⤵
  PID:4572
- C:\Windows\System\sIwpFLA.exe
  C:\Windows\System\sIwpFLA.exe
  2⤵
  PID:5400
- C:\Windows\System\mjUgoOB.exe
  C:\Windows\System\mjUgoOB.exe
  2⤵
  PID:12896
- C:\Windows\System\LVbAqUY.exe
  C:\Windows\System\LVbAqUY.exe
  2⤵
  PID:7232
- C:\Windows\System\gvwBwUm.exe
  C:\Windows\System\gvwBwUm.exe
  2⤵
  PID:7308
- C:\Windows\System\mJzwxnH.exe
  C:\Windows\System\mJzwxnH.exe
  2⤵
  PID:5280
- C:\Windows\System\DrtlpNw.exe
  C:\Windows\System\DrtlpNw.exe
  2⤵
  PID:7688
- C:\Windows\System\mqYPmrp.exe
  C:\Windows\System\mqYPmrp.exe
  2⤵
  PID:7260
- C:\Windows\System\qVaThhq.exe
  C:\Windows\System\qVaThhq.exe
  2⤵
  PID:7660
- C:\Windows\System\ebBJFSO.exe
  C:\Windows\System\ebBJFSO.exe
  2⤵
  PID:4612
- C:\Windows\System\OKCkxPx.exe
  C:\Windows\System\OKCkxPx.exe
  2⤵
  PID:6140
- C:\Windows\System\EDLxbMZ.exe
  C:\Windows\System\EDLxbMZ.exe
  2⤵
  PID:6160
- C:\Windows\System\FrGANoc.exe
  C:\Windows\System\FrGANoc.exe
  2⤵
  PID:7656
- C:\Windows\System\rWrrFQz.exe
  C:\Windows\System\rWrrFQz.exe
  2⤵
  PID:7768
- C:\Windows\System\wBScrbT.exe
  C:\Windows\System\wBScrbT.exe
  2⤵
  PID:7880
- C:\Windows\System\eJoOaCG.exe
  C:\Windows\System\eJoOaCG.exe
  2⤵
  PID:7936
- C:\Windows\System\dgwSPCz.exe
  C:\Windows\System\dgwSPCz.exe
  2⤵
  PID:8056
- C:\Windows\System\BBmddla.exe
  C:\Windows\System\BBmddla.exe
  2⤵
  PID:8120
- C:\Windows\System\tStSvCD.exe
  C:\Windows\System\tStSvCD.exe
  2⤵
  PID:7228
- C:\Windows\System\LQZCWqS.exe
  C:\Windows\System\LQZCWqS.exe
  2⤵
  PID:7292
- C:\Windows\System\hcFSYzc.exe
  C:\Windows\System\hcFSYzc.exe
  2⤵
  PID:7756
- C:\Windows\System\QjoOMsl.exe
  C:\Windows\System\QjoOMsl.exe
  2⤵
  PID:8008
- C:\Windows\System\ZoisxtO.exe
  C:\Windows\System\ZoisxtO.exe
  2⤵
  PID:8156
- C:\Windows\System\mqRtMbi.exe
  C:\Windows\System\mqRtMbi.exe
  2⤵
  PID:7808
- C:\Windows\System\oXZFdzQ.exe
  C:\Windows\System\oXZFdzQ.exe
  2⤵
  PID:8312
- C:\Windows\System\nYBqjxy.exe
  C:\Windows\System\nYBqjxy.exe
  2⤵
  PID:8412
- C:\Windows\System\uzPlinH.exe
  C:\Windows\System\uzPlinH.exe
  2⤵
  PID:8456
- C:\Windows\System\kxbSobs.exe
  C:\Windows\System\kxbSobs.exe
  2⤵
  PID:14140
- C:\Windows\System\kmWvyIJ.exe
  C:\Windows\System\kmWvyIJ.exe
  2⤵
  PID:14040
- C:\Windows\System\hLTJhgc.exe
  C:\Windows\System\hLTJhgc.exe
  2⤵
  PID:3268
- C:\Windows\System\hmEYOaq.exe
  C:\Windows\System\hmEYOaq.exe
  2⤵
  PID:13984
- C:\Windows\System\yNTljgB.exe
  C:\Windows\System\yNTljgB.exe
  2⤵
  PID:6436
- C:\Windows\System\PUglxud.exe
  C:\Windows\System\PUglxud.exe
  2⤵
  PID:6628
- C:\Windows\System\AAmLDhp.exe
  C:\Windows\System\AAmLDhp.exe
  2⤵
  PID:8664
- C:\Windows\System\qpDqhIg.exe
  C:\Windows\System\qpDqhIg.exe
  2⤵
  PID:5056
- C:\Windows\System\jkKwwTn.exe
  C:\Windows\System\jkKwwTn.exe
  2⤵
  PID:2164
- C:\Windows\System\LAcYuMq.exe
  C:\Windows\System\LAcYuMq.exe
  2⤵
  PID:1740
- C:\Windows\System\sFGWdnf.exe
  C:\Windows\System\sFGWdnf.exe
  2⤵
  PID:3024
- C:\Windows\System\IMXLEUO.exe
  C:\Windows\System\IMXLEUO.exe
  2⤵
  PID:8768
- C:\Windows\System\REfUOVj.exe
  C:\Windows\System\REfUOVj.exe
  2⤵
  PID:388
- C:\Windows\System\LdEjsLY.exe
  C:\Windows\System\LdEjsLY.exe
  2⤵
  PID:8808
- C:\Windows\System\qeMeTkL.exe
  C:\Windows\System\qeMeTkL.exe
  2⤵
  PID:8828
- C:\Windows\System\EVFOjwQ.exe
  C:\Windows\System\EVFOjwQ.exe
  2⤵
  PID:4328
- C:\Windows\System\GkVhaEI.exe
  C:\Windows\System\GkVhaEI.exe
  2⤵
  PID:8924
- C:\Windows\System\OOhgtnp.exe
  C:\Windows\System\OOhgtnp.exe
  2⤵
  PID:9008
- C:\Windows\System\rUKEjel.exe
  C:\Windows\System\rUKEjel.exe
  2⤵
  PID:9036
- C:\Windows\System\itYgWAm.exe
  C:\Windows\System\itYgWAm.exe
  2⤵
  PID:9096
- C:\Windows\System\UWYQbEs.exe
  C:\Windows\System\UWYQbEs.exe
  2⤵
  PID:9208
- C:\Windows\System\EANYAiR.exe
  C:\Windows\System\EANYAiR.exe
  2⤵
  PID:8252
- C:\Windows\System\sTgruol.exe
  C:\Windows\System\sTgruol.exe
  2⤵
  PID:8496
- C:\Windows\System\QLBlsJd.exe
  C:\Windows\System\QLBlsJd.exe
  2⤵
  PID:8600
- C:\Windows\System\iufmSvz.exe
  C:\Windows\System\iufmSvz.exe
  2⤵
  PID:2596
- C:\Windows\System\UqTKKPw.exe
  C:\Windows\System\UqTKKPw.exe
  2⤵
  PID:8360
- C:\Windows\System\cFRIzJN.exe
  C:\Windows\System\cFRIzJN.exe
  2⤵
  PID:8860
- C:\Windows\System\UAYqIRG.exe
  C:\Windows\System\UAYqIRG.exe
  2⤵
  PID:4928
- C:\Windows\System\vJTeOWu.exe
  C:\Windows\System\vJTeOWu.exe
  2⤵
  PID:6744
- C:\Windows\System\AspjIdq.exe
  C:\Windows\System\AspjIdq.exe
  2⤵
  PID:9060
- C:\Windows\System\vbXiLSa.exe
  C:\Windows\System\vbXiLSa.exe
  2⤵
  PID:8280
- C:\Windows\System\jGiaSrA.exe
  C:\Windows\System\jGiaSrA.exe
  2⤵
  PID:1860
- C:\Windows\System\hPnkrHM.exe
  C:\Windows\System\hPnkrHM.exe
  2⤵
  PID:9284
- C:\Windows\System\DnGPZAB.exe
  C:\Windows\System\DnGPZAB.exe
  2⤵
  PID:4900
- C:\Windows\System\twuqMcc.exe
  C:\Windows\System\twuqMcc.exe
  2⤵
  PID:2036
- C:\Windows\System\hwbHHcN.exe
  C:\Windows\System\hwbHHcN.exe
  2⤵
  PID:808
- C:\Windows\System\QWkXkXH.exe
  C:\Windows\System\QWkXkXH.exe
  2⤵
  PID:13384
- C:\Windows\System\pCrLyVL.exe
  C:\Windows\System\pCrLyVL.exe
  2⤵
  PID:6984
- C:\Windows\System\CMYjoBk.exe
  C:\Windows\System\CMYjoBk.exe
  2⤵
  PID:624
- C:\Windows\System\sDnaUMg.exe
  C:\Windows\System\sDnaUMg.exe
  2⤵
  PID:3644
- C:\Windows\System\wJBwjib.exe
  C:\Windows\System\wJBwjib.exe
  2⤵
  PID:1284
- C:\Windows\System\YIRdgVK.exe
  C:\Windows\System\YIRdgVK.exe
  2⤵
  PID:3588
- C:\Windows\System\fGpFfmP.exe
  C:\Windows\System\fGpFfmP.exe
  2⤵
  PID:4632
- C:\Windows\System\mhpfXxc.exe
  C:\Windows\System\mhpfXxc.exe
  2⤵
  PID:4892
- C:\Windows\System\QjtpJcY.exe
  C:\Windows\System\QjtpJcY.exe
  2⤵
  PID:13380
- C:\Windows\System\awXdKxA.exe
  C:\Windows\System\awXdKxA.exe
  2⤵
  PID:7288
- C:\Windows\System\uGzKrda.exe
  C:\Windows\System\uGzKrda.exe
  2⤵
  PID:5028
- C:\Windows\System\THQJiSy.exe
  C:\Windows\System\THQJiSy.exe
  2⤵
  PID:7300
- C:\Windows\System\xJSvTXT.exe
  C:\Windows\System\xJSvTXT.exe
  2⤵
  PID:1776
- C:\Windows\System\MoVTUlE.exe
  C:\Windows\System\MoVTUlE.exe
  2⤵
  PID:404
- C:\Windows\System\YRrNAlw.exe
  C:\Windows\System\YRrNAlw.exe
  2⤵
  PID:9712
- C:\Windows\System\LkjOIzL.exe
  C:\Windows\System\LkjOIzL.exe
  2⤵
  PID:9756
- C:\Windows\System\BzOleqN.exe
  C:\Windows\System\BzOleqN.exe
  2⤵
  PID:4216
- C:\Windows\System\mnziJEa.exe
  C:\Windows\System\mnziJEa.exe
  2⤵
  PID:9812
- C:\Windows\System\KeJGruo.exe
  C:\Windows\System\KeJGruo.exe
  2⤵
  PID:9840
- C:\Windows\System\nRQJNRb.exe
  C:\Windows\System\nRQJNRb.exe
  2⤵
  PID:2920
- C:\Windows\System\okztXXp.exe
  C:\Windows\System\okztXXp.exe
  2⤵
  PID:3008
- C:\Windows\System\OEjByua.exe
  C:\Windows\System\OEjByua.exe
  2⤵
  PID:9960
- C:\Windows\System\PXwPaUf.exe
  C:\Windows\System\PXwPaUf.exe
  2⤵
  PID:3736
- C:\Windows\System\oKQUqSU.exe
  C:\Windows\System\oKQUqSU.exe
  2⤵
  PID:4844
- C:\Windows\System\OMjGhzc.exe
  C:\Windows\System\OMjGhzc.exe
  2⤵
  PID:13832
- C:\Windows\System\YxcIWFN.exe
  C:\Windows\System\YxcIWFN.exe
  2⤵
  PID:5232
- C:\Windows\System\LoyHMgC.exe
  C:\Windows\System\LoyHMgC.exe
  2⤵
  PID:1700
- C:\Windows\System\reIyuiv.exe
  C:\Windows\System\reIyuiv.exe
  2⤵
  PID:9520
- C:\Windows\System\nTEKYcB.exe
  C:\Windows\System\nTEKYcB.exe
  2⤵
  PID:7528
- C:\Windows\System\FMrALAY.exe
  C:\Windows\System\FMrALAY.exe
  2⤵
  PID:14252
- C:\Windows\System\JBlRESg.exe
  C:\Windows\System\JBlRESg.exe
  2⤵
  PID:5532
- C:\Windows\System\GLTeeWf.exe
  C:\Windows\System\GLTeeWf.exe
  2⤵
  PID:4516
- C:\Windows\System\XilXVyl.exe
  C:\Windows\System\XilXVyl.exe
  2⤵
  PID:7428
- C:\Windows\System\YmmUswb.exe
  C:\Windows\System\YmmUswb.exe
  2⤵
  PID:5140
- C:\Windows\System\JQTJHHU.exe
  C:\Windows\System\JQTJHHU.exe
  2⤵
  PID:6972
- C:\Windows\System\zkQUODS.exe
  C:\Windows\System\zkQUODS.exe
  2⤵
  PID:10176
- C:\Windows\System\SnNIbFn.exe
  C:\Windows\System\SnNIbFn.exe
  2⤵
  PID:8216
- C:\Windows\System\oilHwjr.exe
  C:\Windows\System\oilHwjr.exe
  2⤵
  PID:7732
- C:\Windows\System\TpFirGd.exe
  C:\Windows\System\TpFirGd.exe
  2⤵
  PID:6164
- C:\Windows\System\gLdlGRV.exe
  C:\Windows\System\gLdlGRV.exe
  2⤵
  PID:5196
- C:\Windows\System\qlRXsmg.exe
  C:\Windows\System\qlRXsmg.exe
  2⤵
  PID:7796
- C:\Windows\System\rxTWrUC.exe
  C:\Windows\System\rxTWrUC.exe
  2⤵
  PID:7800
- C:\Windows\System\UmRKmCg.exe
  C:\Windows\System\UmRKmCg.exe
  2⤵
  PID:5228
- C:\Windows\System\mEDphaJ.exe
  C:\Windows\System\mEDphaJ.exe
  2⤵
  PID:7828
- C:\Windows\System\nLHjTJG.exe
  C:\Windows\System\nLHjTJG.exe
  2⤵
  PID:8468
- C:\Windows\System\rSRHktc.exe
  C:\Windows\System\rSRHktc.exe
  2⤵
  PID:7968
- C:\Windows\System\IQxDksV.exe
  C:\Windows\System\IQxDksV.exe
  2⤵
  PID:9300
- C:\Windows\System\fzhJyMK.exe
  C:\Windows\System\fzhJyMK.exe
  2⤵
  PID:5412
- C:\Windows\System\gVJRIej.exe
  C:\Windows\System\gVJRIej.exe
  2⤵
  PID:8124
- C:\Windows\System\GlEXxEx.exe
  C:\Windows\System\GlEXxEx.exe
  2⤵
  PID:8136
- C:\Windows\System\rDcgIZG.exe
  C:\Windows\System\rDcgIZG.exe
  2⤵
  PID:10336
- C:\Windows\System\ZRdcRhT.exe
  C:\Windows\System\ZRdcRhT.exe
  2⤵
  PID:7664
- C:\Windows\System\FFVsSgn.exe
  C:\Windows\System\FFVsSgn.exe
  2⤵
  PID:5472
- C:\Windows\System\eoUjFoy.exe
  C:\Windows\System\eoUjFoy.exe
  2⤵
  PID:5500
- C:\Windows\System\MnZkzFo.exe
  C:\Windows\System\MnZkzFo.exe
  2⤵
  PID:5528
- C:\Windows\System\aeRSOoA.exe
  C:\Windows\System\aeRSOoA.exe
  2⤵
  PID:8324
- C:\Windows\System\DjHELnq.exe
  C:\Windows\System\DjHELnq.exe
  2⤵
  PID:10724
- C:\Windows\System\XbCnFsq.exe
  C:\Windows\System\XbCnFsq.exe
  2⤵
  PID:10484
- C:\Windows\System\vhYaWHy.exe
  C:\Windows\System\vhYaWHy.exe
  2⤵
  PID:14132
- C:\Windows\System\NCXFBxg.exe
  C:\Windows\System\NCXFBxg.exe
  2⤵
  PID:10956
- C:\Windows\System\wJXsjuA.exe
  C:\Windows\System\wJXsjuA.exe
  2⤵
  PID:5648
- C:\Windows\System\XkEdyZq.exe
  C:\Windows\System\XkEdyZq.exe
  2⤵
  PID:14156
- C:\Windows\System\dHbyMIH.exe
  C:\Windows\System\dHbyMIH.exe
  2⤵
  PID:6324
- C:\Windows\System\MIWMaUr.exe
  C:\Windows\System\MIWMaUr.exe
  2⤵
  PID:3260
- C:\Windows\System\OJFHPPT.exe
  C:\Windows\System\OJFHPPT.exe
  2⤵
  PID:8560
- C:\Windows\System\voScLGz.exe
  C:\Windows\System\voScLGz.exe
  2⤵
  PID:2056
- C:\Windows\System\iIrBzgV.exe
  C:\Windows\System\iIrBzgV.exe
  2⤵
  PID:1228
- C:\Windows\System\LqBMVwE.exe
  C:\Windows\System\LqBMVwE.exe
  2⤵
  PID:1056
- C:\Windows\System\xWwHNfF.exe
  C:\Windows\System\xWwHNfF.exe
  2⤵
  PID:3696
- C:\Windows\System\hPVWYvv.exe
  C:\Windows\System\hPVWYvv.exe
  2⤵
  PID:7620
- C:\Windows\System\fRYMQAi.exe
  C:\Windows\System\fRYMQAi.exe
  2⤵
  PID:6844
- C:\Windows\System\lFxDyUe.exe
  C:\Windows\System\lFxDyUe.exe
  2⤵
  PID:2372
- C:\Windows\System\HAAQnVM.exe
  C:\Windows\System\HAAQnVM.exe
  2⤵
  PID:8840
- C:\Windows\System\iQYURot.exe
  C:\Windows\System\iQYURot.exe
  2⤵
  PID:5868
- C:\Windows\System\IDMckBD.exe
  C:\Windows\System\IDMckBD.exe
  2⤵
  PID:5924
- C:\Windows\System\JQpSSvf.exe
  C:\Windows\System\JQpSSvf.exe
  2⤵
  PID:8900
- C:\Windows\System\ZEWTkWI.exe
  C:\Windows\System\ZEWTkWI.exe
  2⤵
  PID:10616
- C:\Windows\System\oEDpOTW.exe
  C:\Windows\System\oEDpOTW.exe
  2⤵
  PID:10680
- C:\Windows\System\mNAVygc.exe
  C:\Windows\System\mNAVygc.exe
  2⤵
  PID:9012
- C:\Windows\System\etpdQmg.exe
  C:\Windows\System\etpdQmg.exe
  2⤵
  PID:9056
- C:\Windows\System\mjaAKuU.exe
  C:\Windows\System\mjaAKuU.exe
  2⤵
  PID:6020
- C:\Windows\System\WPuFEmf.exe
  C:\Windows\System\WPuFEmf.exe
  2⤵
  PID:9172
- C:\Windows\System\QStPlsw.exe
  C:\Windows\System\QStPlsw.exe
  2⤵
  PID:8272
- C:\Windows\System\bqmIKin.exe
  C:\Windows\System\bqmIKin.exe
  2⤵
  PID:8356
- C:\Windows\System\NdBGZXH.exe
  C:\Windows\System\NdBGZXH.exe
  2⤵
  PID:6128
- C:\Windows\System\lQfQcas.exe
  C:\Windows\System\lQfQcas.exe
  2⤵
  PID:3236
- C:\Windows\System\BXYfNLM.exe
  C:\Windows\System\BXYfNLM.exe
  2⤵
  PID:1484
- C:\Windows\System\qYShxuR.exe
  C:\Windows\System\qYShxuR.exe
  2⤵
  PID:9184
- C:\Windows\System\wSjgOse.exe
  C:\Windows\System\wSjgOse.exe
  2⤵
  PID:5204
- C:\Windows\System\zBktByc.exe
  C:\Windows\System\zBktByc.exe
  2⤵
  PID:10332
- C:\Windows\System\UEJBBIy.exe
  C:\Windows\System\UEJBBIy.exe
  2⤵
  PID:13388
- C:\Windows\System\BEQjyHQ.exe
  C:\Windows\System\BEQjyHQ.exe
  2⤵
  PID:9528
- C:\Windows\System\aZiXpBt.exe
  C:\Windows\System\aZiXpBt.exe
  2⤵
  PID:4884
- C:\Windows\System\oxHaNlY.exe
  C:\Windows\System\oxHaNlY.exe
  2⤵
  PID:8632
- C:\Windows\System\pdtCVom.exe
  C:\Windows\System\pdtCVom.exe
  2⤵
  PID:11092
- C:\Windows\System\beFejWX.exe
  C:\Windows\System\beFejWX.exe
  2⤵
  PID:11440
- C:\Windows\System\RORMnhB.exe
  C:\Windows\System\RORMnhB.exe
  2⤵
  PID:4388
- C:\Windows\System\seJpsNT.exe
  C:\Windows\System\seJpsNT.exe
  2⤵
  PID:9444
- C:\Windows\System\wTEfNvc.exe
  C:\Windows\System\wTEfNvc.exe
  2⤵
  PID:2440
- C:\Windows\System\BLruOzQ.exe
  C:\Windows\System\BLruOzQ.exe
  2⤵
  PID:3452
- C:\Windows\System\xKsVQJX.exe
  C:\Windows\System\xKsVQJX.exe
  2⤵
  PID:13348
- C:\Windows\System\bbQudQc.exe
  C:\Windows\System\bbQudQc.exe
  2⤵
  PID:4164
- C:\Windows\System\xascGDF.exe
  C:\Windows\System\xascGDF.exe
  2⤵
  PID:13360
- C:\Windows\System\KboGONj.exe
  C:\Windows\System\KboGONj.exe
  2⤵
  PID:4872
- C:\Windows\System\sFZNZJP.exe
  C:\Windows\System\sFZNZJP.exe
  2⤵
  PID:1052
- C:\Windows\System\DezHapO.exe
  C:\Windows\System\DezHapO.exe
  2⤵
  PID:5652
- C:\Windows\System\mxtVVUV.exe
  C:\Windows\System\mxtVVUV.exe
  2⤵
  PID:1716
- C:\Windows\System\RSzInRK.exe
  C:\Windows\System\RSzInRK.exe
  2⤵
  PID:9784
- C:\Windows\System\rGBQaWm.exe
  C:\Windows\System\rGBQaWm.exe
  2⤵
  PID:908
- C:\Windows\System\eChaujs.exe
  C:\Windows\System\eChaujs.exe
  2⤵
  PID:11720
- C:\Windows\System\FApMmRc.exe
  C:\Windows\System\FApMmRc.exe
  2⤵
  PID:4196
- C:\Windows\System\PiXocOh.exe
  C:\Windows\System\PiXocOh.exe
  2⤵
  PID:4620
- C:\Windows\System\KfwviWf.exe
  C:\Windows\System\KfwviWf.exe
  2⤵
  PID:1532
- C:\Windows\System\AHbEbmf.exe
  C:\Windows\System\AHbEbmf.exe
  2⤵
  PID:7580
- C:\Windows\System\MXOSCUI.exe
  C:\Windows\System\MXOSCUI.exe
  2⤵
  PID:11560
- C:\Windows\System\QCdbizS.exe
  C:\Windows\System\QCdbizS.exe
  2⤵
  PID:13900
- C:\Windows\System\Tgfwzne.exe
  C:\Windows\System\Tgfwzne.exe
  2⤵
  PID:10068
- C:\Windows\System\yIswpvk.exe
  C:\Windows\System\yIswpvk.exe
  2⤵
  PID:5008
- C:\Windows\System\AupPFDm.exe
  C:\Windows\System\AupPFDm.exe
  2⤵
  PID:1448
- C:\Windows\System\LBNkiKQ.exe
  C:\Windows\System\LBNkiKQ.exe
  2⤵
  PID:12360
- C:\Windows\System\HcVebUL.exe
  C:\Windows\System\HcVebUL.exe
  2⤵
  PID:12376
- C:\Windows\System\SzYadbl.exe
  C:\Windows\System\SzYadbl.exe
  2⤵
  PID:4600
- C:\Windows\System\RliBhme.exe
  C:\Windows\System\RliBhme.exe
  2⤵
  PID:5396
- C:\Windows\System\QmKQOch.exe
  C:\Windows\System\QmKQOch.exe
  2⤵
  PID:8144
- C:\Windows\System\PcjDVMT.exe
  C:\Windows\System\PcjDVMT.exe
  2⤵
  PID:4568
- C:\Windows\System\MgRXnqE.exe
  C:\Windows\System\MgRXnqE.exe
  2⤵
  PID:12504
- C:\Windows\System\Rzdhmal.exe
  C:\Windows\System\Rzdhmal.exe
  2⤵
  PID:12576
- C:\Windows\System\jVhnKPA.exe
  C:\Windows\System\jVhnKPA.exe
  2⤵
  PID:3164
- C:\Windows\System\VmdGDtQ.exe
  C:\Windows\System\VmdGDtQ.exe
  2⤵
  PID:772
- C:\Windows\System\BuYwaPZ.exe
  C:\Windows\System\BuYwaPZ.exe
  2⤵
  PID:2028
- C:\Windows\System\AydLuUz.exe
  C:\Windows\System\AydLuUz.exe
  2⤵
  PID:5208
- C:\Windows\System\oAKSRVV.exe
  C:\Windows\System\oAKSRVV.exe
  2⤵
  PID:12696
- C:\Windows\System\eAcHVrZ.exe
  C:\Windows\System\eAcHVrZ.exe
  2⤵
  PID:12796
- C:\Windows\System\hebnrOJ.exe
  C:\Windows\System\hebnrOJ.exe
  2⤵
  PID:13836
- C:\Windows\System\PIIZmCE.exe
  C:\Windows\System\PIIZmCE.exe
  2⤵
  PID:5276
- C:\Windows\System\UxeYDqT.exe
  C:\Windows\System\UxeYDqT.exe
  2⤵
  PID:7836
- C:\Windows\System\doBPEwZ.exe
  C:\Windows\System\doBPEwZ.exe
  2⤵
  PID:5152
- C:\Windows\System\CdPeyfZ.exe
  C:\Windows\System\CdPeyfZ.exe
  2⤵
  PID:13056
- C:\Windows\System\vsDZtDJ.exe
  C:\Windows\System\vsDZtDJ.exe
  2⤵
  PID:4912
- C:\Windows\System\WnFnFIN.exe
  C:\Windows\System\WnFnFIN.exe
  2⤵
  PID:10276
- C:\Windows\System\MRbRzoM.exe
  C:\Windows\System\MRbRzoM.exe
  2⤵
  PID:5460
- C:\Windows\System\mjLsANI.exe
  C:\Windows\System\mjLsANI.exe
  2⤵
  PID:1192
- C:\Windows\System\CSafhGm.exe
  C:\Windows\System\CSafhGm.exe
  2⤵
  PID:1460
- C:\Windows\System\AePbAQN.exe
  C:\Windows\System\AePbAQN.exe
  2⤵
  PID:5552
- C:\Windows\System\tXAwpkI.exe
  C:\Windows\System\tXAwpkI.exe
  2⤵
  PID:10964
- C:\Windows\System\eXHJOHa.exe
  C:\Windows\System\eXHJOHa.exe
  2⤵
  PID:10664
- C:\Windows\System\oOdQTfQ.exe
  C:\Windows\System\oOdQTfQ.exe
  2⤵
  PID:10672
- C:\Windows\System\YravDME.exe
  C:\Windows\System\YravDME.exe
  2⤵
  PID:10728
- C:\Windows\System\FbcZpOz.exe
  C:\Windows\System\FbcZpOz.exe
  2⤵
  PID:14084
- C:\Windows\System\uOiLdfj.exe
  C:\Windows\System\uOiLdfj.exe
  2⤵
  PID:3368
- C:\Windows\System\TlAcJpP.exe
  C:\Windows\System\TlAcJpP.exe
  2⤵
  PID:2556
- C:\Windows\System\nwpIRal.exe
  C:\Windows\System\nwpIRal.exe
  2⤵
  PID:14036
- C:\Windows\System\AifJfjZ.exe
  C:\Windows\System\AifJfjZ.exe
  2⤵
  PID:6316
- C:\Windows\System\FucdxqO.exe
  C:\Windows\System\FucdxqO.exe
  2⤵
  PID:5448
- C:\Windows\System\vaXySOH.exe
  C:\Windows\System\vaXySOH.exe
  2⤵
  PID:3512
- C:\Windows\System\xdGQORV.exe
  C:\Windows\System\xdGQORV.exe
  2⤵
  PID:6408
- C:\Windows\System\ZFlfLRr.exe
  C:\Windows\System\ZFlfLRr.exe
  2⤵
  PID:8536
- C:\Windows\System\kZdoRDU.exe
  C:\Windows\System\kZdoRDU.exe
  2⤵
  PID:12836
- C:\Windows\System\JtVincj.exe
  C:\Windows\System\JtVincj.exe
  2⤵
  PID:6584
- C:\Windows\System\zitgKtp.exe
  C:\Windows\System\zitgKtp.exe
  2⤵
  PID:2476
- C:\Windows\System\FNhtklK.exe
  C:\Windows\System\FNhtklK.exe
  2⤵
  PID:5732
- C:\Windows\System\EfcEtAS.exe
  C:\Windows\System\EfcEtAS.exe
  2⤵
  PID:6716
- C:\Windows\System\kVHaELg.exe
  C:\Windows\System\kVHaELg.exe
  2⤵
  PID:6692
- C:\Windows\System\NMWhqwr.exe
  C:\Windows\System\NMWhqwr.exe
  2⤵
  PID:6840
- C:\Windows\System\bCQxztx.exe
  C:\Windows\System\bCQxztx.exe
  2⤵
  PID:6856
- C:\Windows\System\nvOyehu.exe
  C:\Windows\System\nvOyehu.exe
  2⤵
  PID:13084
- C:\Windows\System\roMpLoM.exe
  C:\Windows\System\roMpLoM.exe
  2⤵
  PID:5880
- C:\Windows\System\FATtMln.exe
  C:\Windows\System\FATtMln.exe
  2⤵
  PID:10584
- C:\Windows\System\sdgQjUu.exe
  C:\Windows\System\sdgQjUu.exe
  2⤵
  PID:10504
- C:\Windows\System\uMLqElN.exe
  C:\Windows\System\uMLqElN.exe
  2⤵
  PID:10560
- C:\Windows\System\DQPlvoX.exe
  C:\Windows\System\DQPlvoX.exe
  2⤵
  PID:6240
- C:\Windows\System\uvrbRtl.exe
  C:\Windows\System\uvrbRtl.exe
  2⤵
  PID:6348
- C:\Windows\System\mnkcqVd.exe
  C:\Windows\System\mnkcqVd.exe
  2⤵
  PID:9160
- C:\Windows\System\fVfVMGR.exe
  C:\Windows\System\fVfVMGR.exe
  2⤵
  PID:13732
- C:\Windows\System\KuJbKFy.exe
  C:\Windows\System\KuJbKFy.exe
  2⤵
  PID:13928
- C:\Windows\System\AGRQAQj.exe
  C:\Windows\System\AGRQAQj.exe
  2⤵
  PID:8740
- C:\Windows\System\GcOcjWj.exe
  C:\Windows\System\GcOcjWj.exe
  2⤵
  PID:4616
- C:\Windows\System\OToIjGg.exe
  C:\Windows\System\OToIjGg.exe
  2⤵
  PID:3320
- C:\Windows\System\TGWXrTm.exe
  C:\Windows\System\TGWXrTm.exe
  2⤵
  PID:11212
- C:\Windows\System\YeGjHJh.exe
  C:\Windows\System\YeGjHJh.exe
  2⤵
  PID:8948
- C:\Windows\System\CpOvKmz.exe
  C:\Windows\System\CpOvKmz.exe
  2⤵
  PID:5200
- C:\Windows\System\YZmRQvz.exe
  C:\Windows\System\YZmRQvz.exe
  2⤵
  PID:7048
- C:\Windows\System\IrOIEVP.exe
  C:\Windows\System\IrOIEVP.exe
  2⤵
  PID:4280
- C:\Windows\System\ZODlPfD.exe
  C:\Windows\System\ZODlPfD.exe
  2⤵
  PID:10860
- C:\Windows\System\WgZLcHY.exe
  C:\Windows\System\WgZLcHY.exe
  2⤵
  PID:6540
- C:\Windows\System\QknaCQL.exe
  C:\Windows\System\QknaCQL.exe
  2⤵
  PID:13416
- C:\Windows\System\FuzpUTr.exe
  C:\Windows\System\FuzpUTr.exe
  2⤵
  PID:6264
- C:\Windows\System\gtIfoIb.exe
  C:\Windows\System\gtIfoIb.exe
  2⤵
  PID:6392
- C:\Windows\System\FoALgeJ.exe
  C:\Windows\System\FoALgeJ.exe
  2⤵
  PID:2624
- C:\Windows\System\jIcJgRX.exe
  C:\Windows\System\jIcJgRX.exe
  2⤵
  PID:11492
- C:\Windows\System\pgLdlwd.exe
  C:\Windows\System\pgLdlwd.exe
  2⤵
  PID:4824
- C:\Windows\System\NDxBMeT.exe
  C:\Windows\System\NDxBMeT.exe
  2⤵
  PID:7040
- C:\Windows\System\SHsqqjp.exe
  C:\Windows\System\SHsqqjp.exe
  2⤵
  PID:1764
- C:\Windows\System\LGIWOWJ.exe
  C:\Windows\System\LGIWOWJ.exe
  2⤵
  PID:5392
- C:\Windows\System\LoRicNq.exe
  C:\Windows\System\LoRicNq.exe
  2⤵
  PID:4780
- C:\Windows\System\KdOdYOm.exe
  C:\Windows\System\KdOdYOm.exe
  2⤵
  PID:4576
- C:\Windows\System\GnQOajo.exe
  C:\Windows\System\GnQOajo.exe
  2⤵
  PID:4180
- C:\Windows\System\BcQduaL.exe
  C:\Windows\System\BcQduaL.exe
  2⤵
  PID:1640
- C:\Windows\System\LRYMWKQ.exe
  C:\Windows\System\LRYMWKQ.exe
  2⤵
  PID:13924
- C:\Windows\System\SXXYpLj.exe
  C:\Windows\System\SXXYpLj.exe
  2⤵
  PID:5940
- C:\Windows\System\jfyJVIq.exe
  C:\Windows\System\jfyJVIq.exe
  2⤵
  PID:11888
- C:\Windows\System\hslmscn.exe
  C:\Windows\System\hslmscn.exe
  2⤵
  PID:4020
- C:\Windows\System\FgpPFRD.exe
  C:\Windows\System\FgpPFRD.exe
  2⤵
  PID:4544
- C:\Windows\System\UyIcxPQ.exe
  C:\Windows\System\UyIcxPQ.exe
  2⤵
  PID:10124
- C:\Windows\System\AGgVEVe.exe
  C:\Windows\System\AGgVEVe.exe
  2⤵
  PID:4996
- C:\Windows\System\FiOLhBm.exe
  C:\Windows\System\FiOLhBm.exe
  2⤵
  PID:10196
- C:\Windows\System\DwpTdon.exe
  C:\Windows\System\DwpTdon.exe
  2⤵
  PID:13372
- C:\Windows\System\mNKXTxY.exe
  C:\Windows\System\mNKXTxY.exe
  2⤵
  PID:5116
- C:\Windows\System\dKKvsLw.exe
  C:\Windows\System\dKKvsLw.exe
  2⤵
  PID:8112
- C:\Windows\System\hhrcYXw.exe
  C:\Windows\System\hhrcYXw.exe
  2⤵
  PID:12328
- C:\Windows\System\OQXCUIk.exe
  C:\Windows\System\OQXCUIk.exe
  2⤵
  PID:12400
- C:\Windows\System\bzdSDjF.exe
  C:\Windows\System\bzdSDjF.exe
  2⤵
  PID:3648
- C:\Windows\System\RmXOrUW.exe
  C:\Windows\System\RmXOrUW.exe
  2⤵
  PID:12472
- C:\Windows\System\IAsmJJW.exe
  C:\Windows\System\IAsmJJW.exe
  2⤵
  PID:10120
- C:\Windows\System\QMSEzaN.exe
  C:\Windows\System\QMSEzaN.exe
  2⤵
  PID:5168
- C:\Windows\System\QllWzJD.exe
  C:\Windows\System\QllWzJD.exe
  2⤵
  PID:12644
- C:\Windows\System\piJjvmI.exe
  C:\Windows\System\piJjvmI.exe
  2⤵
  PID:5596
- C:\Windows\System\XXJOrFf.exe
  C:\Windows\System\XXJOrFf.exe
  2⤵
  PID:6212
- C:\Windows\System\QEcMytg.exe
  C:\Windows\System\QEcMytg.exe
  2⤵
  PID:5836
- C:\Windows\System\iSrJpEf.exe
  C:\Windows\System\iSrJpEf.exe
  2⤵
  PID:12948
- C:\Windows\System\LSAAPkM.exe
  C:\Windows\System\LSAAPkM.exe
  2⤵
  PID:7988
- C:\Windows\System\SxGuOvd.exe
  C:\Windows\System\SxGuOvd.exe
  2⤵
  PID:7960
- C:\Windows\System\kjtMzrP.exe
  C:\Windows\System\kjtMzrP.exe
  2⤵
  PID:8332
- C:\Windows\System\bWZVLXW.exe
  C:\Windows\System\bWZVLXW.exe
  2⤵
  PID:8072
- C:\Windows\System\rsvjQvs.exe
  C:\Windows\System\rsvjQvs.exe
  2⤵
  PID:8164
- C:\Windows\System\PiEdgTQ.exe
  C:\Windows\System\PiEdgTQ.exe
  2⤵
  PID:8760
- C:\Windows\System\nLBEyZR.exe
  C:\Windows\System\nLBEyZR.exe
  2⤵
  PID:10620
- C:\Windows\System\CxOzpPf.exe
  C:\Windows\System\CxOzpPf.exe
  2⤵
  PID:12720
- C:\Windows\System\BAVHXcN.exe
  C:\Windows\System\BAVHXcN.exe
  2⤵
  PID:11056
- C:\Windows\System\cvCNvQB.exe
  C:\Windows\System\cvCNvQB.exe
  2⤵
  PID:12408
- C:\Windows\System\kHMfmMi.exe
  C:\Windows\System\kHMfmMi.exe
  2⤵
  PID:12404
- C:\Windows\System\HOzKDDG.exe
  C:\Windows\System\HOzKDDG.exe
  2⤵
  PID:12548
- C:\Windows\System\KXCnwll.exe
  C:\Windows\System\KXCnwll.exe
  2⤵
  PID:8484
- C:\Windows\System\KPZbfYK.exe
  C:\Windows\System\KPZbfYK.exe
  2⤵
  PID:12652
- C:\Windows\System\NVppWVB.exe
  C:\Windows\System\NVppWVB.exe
  2⤵
  PID:14268
- C:\Windows\System\ZzAmKys.exe
  C:\Windows\System\ZzAmKys.exe
  2⤵
  PID:12084
- C:\Windows\System\xVDlfEv.exe
  C:\Windows\System\xVDlfEv.exe
  2⤵
  PID:6320
- C:\Windows\System\xXLUFbx.exe
  C:\Windows\System\xXLUFbx.exe
  2⤵
  PID:14100
- C:\Windows\System\yJKEnse.exe
  C:\Windows\System\yJKEnse.exe
  2⤵
  PID:11160
- C:\Windows\System\TvlsBUY.exe
  C:\Windows\System\TvlsBUY.exe
  2⤵
  PID:6468
- C:\Windows\System\zMHinvU.exe
  C:\Windows\System\zMHinvU.exe
  2⤵
  PID:8544
- C:\Windows\System\HXdpBKg.exe
  C:\Windows\System\HXdpBKg.exe
  2⤵
  PID:5768
- C:\Windows\System\gwKBooF.exe
  C:\Windows\System\gwKBooF.exe
  2⤵
  PID:6704
- C:\Windows\System\NmHinZd.exe
  C:\Windows\System\NmHinZd.exe
  2⤵
  PID:11252
- C:\Windows\System\TvqnXoP.exe
  C:\Windows\System\TvqnXoP.exe
  2⤵
  PID:6784
- C:\Windows\System\vEDTuvv.exe
  C:\Windows\System\vEDTuvv.exe
  2⤵
  PID:5896
- C:\Windows\System\MILmVOK.exe
  C:\Windows\System\MILmVOK.exe
  2⤵
  PID:9072
- C:\Windows\System\KzVDKXs.exe
  C:\Windows\System\KzVDKXs.exe
  2⤵
  PID:6940
- C:\Windows\System\mAYlIzR.exe
  C:\Windows\System\mAYlIzR.exe
  2⤵
  PID:8880
- C:\Windows\System\CTChgtz.exe
  C:\Windows\System\CTChgtz.exe
  2⤵
  PID:5960
- C:\Windows\System\TNvhGod.exe
  C:\Windows\System\TNvhGod.exe
  2⤵
  PID:9488
- C:\Windows\System\eTUuRSN.exe
  C:\Windows\System\eTUuRSN.exe
  2⤵
  PID:9492
- C:\Windows\System\XxeKxyZ.exe
  C:\Windows\System\XxeKxyZ.exe
  2⤵
  PID:9500
- C:\Windows\System\HPijIdS.exe
  C:\Windows\System\HPijIdS.exe
  2⤵
  PID:9204
- C:\Windows\System\cqSwCVM.exe
  C:\Windows\System\cqSwCVM.exe
  2⤵
  PID:2724
- C:\Windows\System\yftFAHh.exe
  C:\Windows\System\yftFAHh.exe
  2⤵
  PID:10344
- C:\Windows\System\YrNdUfn.exe
  C:\Windows\System\YrNdUfn.exe
  2⤵
  PID:9164
- C:\Windows\System\UzgKMQs.exe
  C:\Windows\System\UzgKMQs.exe
  2⤵
  PID:13952
- C:\Windows\System\olMQFbV.exe
  C:\Windows\System\olMQFbV.exe
  2⤵
  PID:3032
- C:\Windows\System\XJMHUto.exe
  C:\Windows\System\XJMHUto.exe
  2⤵
  PID:9940
- C:\Windows\System\xTJXBFS.exe
  C:\Windows\System\xTJXBFS.exe
  2⤵
  PID:6872
- C:\Windows\System\MFgqobe.exe
  C:\Windows\System\MFgqobe.exe
  2⤵
  PID:10048
- C:\Windows\System\WyMVLev.exe
  C:\Windows\System\WyMVLev.exe
  2⤵
  PID:13364
- C:\Windows\System\cOajuHp.exe
  C:\Windows\System\cOajuHp.exe
  2⤵
  PID:11200
- C:\Windows\System\gJAIiqM.exe
  C:\Windows\System\gJAIiqM.exe
  2⤵
  PID:10164
- C:\Windows\System\kApwAxc.exe
  C:\Windows\System\kApwAxc.exe
  2⤵
  PID:7152
- C:\Windows\System\LPuZxpi.exe
  C:\Windows\System\LPuZxpi.exe
  2⤵
  PID:10224
- C:\Windows\System\foVJYjz.exe
  C:\Windows\System\foVJYjz.exe
  2⤵
  PID:9440
- C:\Windows\System\LBtPDyj.exe
  C:\Windows\System\LBtPDyj.exe
  2⤵
  PID:9364
- C:\Windows\System\ifAWfSW.exe
  C:\Windows\System\ifAWfSW.exe
  2⤵
  PID:6860
- C:\Windows\System\DwsSAVS.exe
  C:\Windows\System\DwsSAVS.exe
  2⤵
  PID:9588
- C:\Windows\System\QkFBrpm.exe
  C:\Windows\System\QkFBrpm.exe
  2⤵
  PID:9792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q12auvwl.bfn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CEBJlkm.exe

Filesize
1.9MB

MD5
45c537a229166f93206731f9aeb5efa9

SHA1
275d46a7b480098a5cd14f119bf31511e53ce37c

SHA256
7526e37fb2f3b52eb2c73889663c657db5f913f5807d1c2b46ceff1d15069c29

SHA512
595c8ffa4cea651f48bed6c263ba315471951a51e657ad72ab433b435b89717b7ddb6fb972432f3488d60ae6852d9ba838083894f94570e81ed9fb512df14cda

Download Submit
C:\Windows\System\CNnToHg.exe

Filesize
1.9MB

MD5
3ca43cb61b36b26bce79c880e65fbba1

SHA1
8db129876d7ff60493ca1be4bf150e91b2f33657

SHA256
ceee43b50ada5fd445cdc882aca8061b19dfb06aca44b06c6ff15a205bc1e5eb

SHA512
5c4bb3c6fffb8a9d68879ad062c34340a5e19eeaf3655a8ccdc10104807d28884c37e74b808d225a17aa389e238edddc6773f819a8ec779475644965fb323335

Download Submit
C:\Windows\System\EJrkpqn.exe

Filesize
1.9MB

MD5
36e479c78f62756c6c4a597cfd14828e

SHA1
21fdca6c228638eb713d1c5b514b034c699fb6b7

SHA256
e39c4fee38f9f83561ae196bc301e0af004895943b46514d0c3af6d10fa02cb3

SHA512
ef29d5e113989ad9cf23859cfc8bf1407c1cfafab972be7de1215500d12031b695744521e51d7542bb4460f133f252f0956acf2e3eadfd469a7b3d4e95502ec3

Download Submit
C:\Windows\System\FseZUFp.exe

Filesize
1.9MB

MD5
cfb10aeb43f7984667ae04025c56fa64

SHA1
e10399d408aed750bdcdd4bf686147b35aad6a0b

SHA256
d5522569d170c8265b2a0a154d81afdf4ad15a1834e68b92b36d93e579ce3db6

SHA512
1ff8e900597095e648e5fb6f004f41423cf122b369744cd5618b185716fb2a4244dc0910161aaa5d65e5c92af065fdfa7477e060f3dcf6f3c0edfc6371b60920

Download Submit
C:\Windows\System\GJWImoI.exe

Filesize
1.9MB

MD5
24dbbd1477616dc84f5c3c222bf39c2a

SHA1
00f5dd83a72b79082d02f51fcc9dbbc0283e9ca9

SHA256
d0e000a076ef93519521050d2106e9672652308941901cc9ab08d0484bc232f3

SHA512
b390f376eeede85749e7d5435f6906cfcbd63f662a5834877c0f171d32a8d9d711f41e6ff51295af109e21230dcb9b6535d76e6bab9e3e79fb30b7ca6170b9e6

Download Submit
C:\Windows\System\HFixNYD.exe

Filesize
1.9MB

MD5
d065e59caaebc7a24532ab8c5315c028

SHA1
c2d12990e2c9d45c026d08d686970e2e59786286

SHA256
12d179c339d3d10f550b86934442e793912470f8cf84bfec274f267be4236a9f

SHA512
28265daa9868fef4534e4978809dfe9dbe9cda30099e04fdf51aed99f3405b3908d3894dac3cb27c8b7dce32463fa4ebcc5df92ac480ed04bfdb3b23a787ca69

Download Submit
C:\Windows\System\KCRngzU.exe

Filesize
1.9MB

MD5
9f39f24c53b19483e9c934443e8112b8

SHA1
4484857610c785b5026c330fe9f995e05eb44ebc

SHA256
cd458ea1f56158408155634c53656d0e67f97913c417e7d78f1070a1d1a7b2d0

SHA512
19adb38fcc147c0164721bbaa21e8cf5b7634cd66d5379ccba64b7bbcda2d2e67dccb17bfbe38267df1ed061156cb671ecc3b2f3f380e8f672870feb2ecd1fcc

Download Submit
C:\Windows\System\OGECjmy.exe

Filesize
1.9MB

MD5
7c7cb133e3fa41ad3b39afebb266df42

SHA1
bb484ca9464d457d9ad678a2ef0a8953c85f1ae5

SHA256
c5ce3833e5a0fd3edc9665ff553d22dcf443f5dd7cf4f146e341a840f13d05da

SHA512
a8899d765f4f078139f5075c4e68b5bc63a3d140e5e15438189dbf81b003ceaf901a9f371aa4b2f5560001db101c87df1a29768ee54579292712518af897eb71

Download Submit
C:\Windows\System\PxCWMEB.exe

Filesize
1.9MB

MD5
43e510aeaa3ad2fe641dcefe9fd7eb9c

SHA1
4a905bbe7140022eadffa6512200be80ed1c8689

SHA256
8e1feac4cdb2e2ce2262269c7f08588194e0c6c9058a221c4570a602b35600c8

SHA512
0931711fa1085b59250538fd9a88cdb8438556093727496250dc2fe7689750c9ebe13ed4aeb5dbf12a800adc4dc0c41e0a270d144b26dcd91ba0d89df748921d

Download Submit
C:\Windows\System\QxReJkh.exe

Filesize
1.9MB

MD5
abf6281022d9d8d5f8fdf74206ce22b1

SHA1
02291757a0b4f2f2b146413f20f512b1dd953b57

SHA256
cb3537359646900b1955627acc7053aef3769f7bef23b7758e63fd435163a256

SHA512
16202c73a566a6dd81575a942f80e1d3155a22dd17a4701a06aeb56d055498cbee7d63b457b0a0194f3d3690e9fceae6407cfc2c704766e435d54dfe2e2d7d35

Download Submit
C:\Windows\System\SUgvZDg.exe

Filesize
1.9MB

MD5
aab8c1c5377fb6d05e90610ccda36281

SHA1
08af52eeeaabc9bf41517b843e1a3509eef6aef9

SHA256
6f9e00383abd3bce8f58775088938c0787c109a7c489c1007df2ace64ca4fe89

SHA512
c3d75f8384d3cb2fda2fa5a278c57763ccde33c8683d4c2814c861a73b080723e11ca6de1a626313560ea4ea216ba73e787f33b3d83c62743315759a2979d07e

Download Submit
C:\Windows\System\XHFbcUr.exe

Filesize
1.9MB

MD5
f214fa942a0abb7424f91dd52af4a437

SHA1
98ecc653e831b4e1d0377f7a8050e20bbffe2c30

SHA256
ac0304e28944206a6835b84ce8b1dfa07875ade79997156563b2c364f5ed8165

SHA512
1a5ce71f9babe60a861f58aaa7a63716d6dec03d4603a9be8eac93ed4a1a1561bd64454812a7be96e66bcfa15caf4cd24035dc817003b2c177d61fbf81aa2139

Download Submit
C:\Windows\System\ZMYALxg.exe

Filesize
1.9MB

MD5
238417726646de52bae45e0e10fd2368

SHA1
5bdec1591f6f88ff29f2a9455a3b77776113a4d4

SHA256
f2eae4fd77c0067093e8fa694a78917a60e7438242516bceb5312f9e62e048ef

SHA512
15ad3591e80a94a379a6a873c821469fd54bd2a71a66c7059212fe06414bb05d5f3aa61f79039feb76472b7cbf753dd3e79466448872fa8c768fedde32c2d8b5

Download Submit
C:\Windows\System\ZWCIlEK.exe

Filesize
1.9MB

MD5
0b848621fcbe2746572232dad27acc1c

SHA1
36d557913a1acf87b6b56cf235b3f2590e90504c

SHA256
ba77b19fddc611c57282963e22a3b23814bb1136441e03a58ebe5853d7a1a23c

SHA512
c8e8f4659b38162611a37bb9f4d26632cb9f6975a61b202551dd5d7f0167d81086ceb79e5aa8c1d83afbfa1627fa59aa54edb976609c065dda0ab3b2e5710e81

Download Submit
C:\Windows\System\beaZoMG.exe

Filesize
1.9MB

MD5
feda670e7b072235f2019e1e03cef2bf

SHA1
340579b06941d4d6505bac9bd9f6556104081445

SHA256
3a24d268a3932e246bdd1edc3b49234ef4231838b8821d9fd06be58cfc79743c

SHA512
e0b58bb7962861877e77200ca72879a0022c2ba861d697cb7a02b016c338a1683817120216a36d12111e44da4ed30e782bf0d82561192846b13c14d8ceef1ae4

Download Submit
C:\Windows\System\ceSACYG.exe

Filesize
1.9MB

MD5
d6bf002f4134e610e53b26729c2fc2a7

SHA1
b69121053e58eaba6a7b7473bf90a68f79ef1e4a

SHA256
ae4a9557d42c5406a825f8bb2324e2a9ac308589c037cee8a3582573696713ba

SHA512
f641949a1f44dd32030ba7f1b6486d806cc5b51a2f574005a89813ee309ad0c15c1c020faef3293cf0a99fae3a0f055366db579c3c417c158f1ac4a774e990f2

Download Submit
C:\Windows\System\dlQBVRS.exe

Filesize
1.9MB

MD5
8f2b432a4824f585de62787cb44265a6

SHA1
ece246606c5bd12c8a07eeaf8e478a601df8afdf

SHA256
79ceb24fbbccb06fc445ae0c0ba7fd8c641cb8fc0fcaa1f73cb21e7ec8f78320

SHA512
889cf540b7656144adcf74ab733d0cdab15744fe2d2baa770ffa538199fba8cefb5e20ab60e44b8ba2473a5b07945c121fe3239bf49f971b0fb3563f338349f7

Download Submit
C:\Windows\System\dxXFGFp.exe

Filesize
1.9MB

MD5
0fc57ce8e3293aa5542cd8c08d5d4e2f

SHA1
aa4b29cdeb7ada85c5dc7083fdd39871259212ed

SHA256
82d428dba66f0994c09560b3aba7a9b57b12efd61b98b285981def3cacad5d5c

SHA512
506d645891a169bf53f16da45fcff12883d78b769b5054cf62ac04804414257c12c002b156896ef4256f83f4c5597e21807effcc51a841f137f507799533b741

Download Submit
C:\Windows\System\eVuYJcB.exe

Filesize
1.9MB

MD5
004898fb2a61bf0ccef0ca312a277154

SHA1
1e25911a618a2632cecad17971fc8d6a08e259ff

SHA256
09bbab7fcfe9c26f6c9937ab460cb76540d012d6078454c5cd5f795b7faf27dc

SHA512
6e83f08d2a190414fa6136b5c6a6b79c0429ceecc3177ccc483ab54d756380724ab3130b93f433cb1cc317df060970601a6df873772a2df3148b7cbddb2dc963

Download Submit
C:\Windows\System\hgMkmat.exe

Filesize
1.9MB

MD5
3134bbe7153c5aafc844c6a2136cb563

SHA1
15363927b70844c1d33137961b947536b82439a4

SHA256
74670c912156c1b9aeb13202da2ca701a8a47a18a784e47f4a60b68148ffd46f

SHA512
5835030793192c8cc054e808e0ef1ab7a5364693daa50b675cfbd9f57aba6bfce9f18afbf3817ea2fa9ab3e57f6bc4e0cd1ab3195280dbe011d90ad6f0716887

Download Submit
C:\Windows\System\ixHfsul.exe

Filesize
1.9MB

MD5
fc838e0581185e3b0ce73d15a18b45eb

SHA1
e7e4ad393c5663562700d02bd95be4ff5aadb210

SHA256
03ac4d4f0fa65a820a357a0e653bf89ab6a122ce13e0b5a9e7953a7e86be9a9a

SHA512
d40460f2e728e9651b9f1c7312328b90cbf824dbeac2787e49c56863d7cddae66ddd1f4ee0e267d248f7e32735942c0946f180a563b7ab7ad3a591813df81c1a

Download Submit
C:\Windows\System\mDIyPKK.exe

Filesize
1.9MB

MD5
35464303f8c1f114621a22df5a7f48e0

SHA1
ce4fe138e2760966d634decb354d863958413b9c

SHA256
6712914793cddd17d5548d08b106d0553d6931ba968b26e88b9da13623d6c6ab

SHA512
8a401951ae6a1776abbda235cb791a1a790572f42ff4141dbe3d69b84bf7dade05b3d43583213527388fc0a64ec5d2c9c31ccd9340a9594882e5db7e0d70a77e

Download Submit
C:\Windows\System\mKfOzRa.exe

Filesize
1.9MB

MD5
171a02624f6e4082fa6628508567c02c

SHA1
fd4fd7eefc6b0bbc5ae5a0d1e86b450c5c00e756

SHA256
dbe494cc37c8efbd92e808009f50cdc1849a9a9e171a8edae6eaa24513818d5f

SHA512
f583734edc9a71286f2dbbd88f66bbf29c0cb7a068a17587b0b3a710276bfd9137c49e676c0c0d5518ee9f32965d59c84e60ec4e09dbaf3d0bec026f154b11b4

Download Submit
C:\Windows\System\mmISkCH.exe

Filesize
1.9MB

MD5
cdf3f187631a88f1645a4e20fb1eacfc

SHA1
a885d99bd34503d39f999844206ed7cfdf7e9b86

SHA256
ee5396311a30e815f8e47b6c206b7bdd05b7a3b8ef41c13230ba933b2f1bcb25

SHA512
a4765433fa1345b694d82f379ec1f91e38359cae70198c83381ed43b29b744704e1a917669af31b22fa92093dc2dd2558c751fd46c808daf907aca10ee5e0fc0

Download Submit
C:\Windows\System\oVARtOM.exe

Filesize
1.9MB

MD5
c53f2b3df360941ffcec9638802cb078

SHA1
789febe23baaf9c96a168e8a7bc502a8ce6ad94c

SHA256
c83ba23d89a920f71090c67943392119a512144d93e118d97458a57e8a09b999

SHA512
de10005b6c93ba27043111652f53896bb3ab38f25170de6d78cb6ee583ae2d912e89386eb10bf594aacad51a97a9a765719f646bb04df6fdb6e16e3854621e63

Download Submit
C:\Windows\System\pAVDksi.exe

Filesize
1.9MB

MD5
4cc529c42c0c8c9324e4bab43a1bfa79

SHA1
3d5b8e0cdd563adeba9bff2713a8f7f6da0daadd

SHA256
0bde42edd8edf183e6a217305f19f733eea78c0f4cd0a36fff74f0bfc30bf850

SHA512
eb9d38063a1626e2ad7285341898eb78968b24b7606f6311d0110d8852249146afb7ece70f8054f8c6d30f59bda3835d29cc4619d6701cbf9dfdf5748d6ee507

Download Submit
C:\Windows\System\pFufwOG.exe

Filesize
1.9MB

MD5
25481fe93a84892b5ceaaa5ac892552a

SHA1
5004e5a254566437198193b718223b58bc8c7085

SHA256
f44af40f992d4b743ce72b2d5bee759f1880c53222f355a62637d17a23cf628a

SHA512
1b21c41ed7efc64b852edfb054893d3157758868c9f78fc9e314181f2bbda61498db84a4c35ea4c85a79b1d462b69a1dfd7e790843542cf8172ffd7f67ae20bf

Download Submit
C:\Windows\System\tPzuOgc.exe

Filesize
1.9MB

MD5
09055e143544275e8ecb94e2633ec809

SHA1
9be0a4f3eaac154442cc4edc270932154e0f66ba

SHA256
336c169498abbf990f26168ed833e589569a94f32317b1e713f3fad4e9145688

SHA512
56fece0c8e6f188a7bff29bd85e8556ebff6a51970a611ad569521bd07a904f834eecf599b266e75f49b3472240f0cfd7d27ee50b0763218db502a7da88a1305

Download Submit
C:\Windows\System\tcgjXdZ.exe

Filesize
1.9MB

MD5
d298bd91ae5db4140ba9bebf297ddad5

SHA1
2cdf62697cc7e92d72638a6468b4c5cf17506889

SHA256
7403d8a7fe1bd35e13f1b586851f80348c9ce22c463cfd454e1b1486316da122

SHA512
2373af625218b0b12f1f443739fafab57fea22b905a7e811f023974ae909902c300c47d868849203c2b5b0bab73822b8165bcabc0ef2a9797f02d656095cddbb

Download Submit
C:\Windows\System\ukSvDRN.exe

Filesize
1.9MB

MD5
c5128e7f38f875893c606715ce6c24c6

SHA1
d7fb7458856fc9c98a12faee36a0a38362b23160

SHA256
743955e414b4125acf87277e6f2efda03150be01922ea241eee5193883a49566

SHA512
20be5f5f454734993917c4cb1d84b101b83caf1a4cd60785355666581fdc359c365c02e5b960e17b80c62d5cd9e9f491d33f8f65680bd76305483f51b89b04bc

Download Submit
C:\Windows\System\xNyaUVn.exe

Filesize
1.9MB

MD5
be153e157d5dc3cd1869e53ddc3b5f5c

SHA1
767ef4c1a6ae547f4e6b8c0146a58222bfa26361

SHA256
badaa07a94c9dd5e2758c68f63eb5805cd92bb37e023c0dc799e31397c16ec39

SHA512
321ae8a407309f63cda5b6cb4227f9e90f8d79d8112b4ce66063701b835e6f8e391d9edb7671f8e9b7538f3b7f56c091053ba341e78585ae87ead9f2f82cfba1

Download Submit
C:\Windows\System\xSqwVXb.exe

Filesize
1.9MB

MD5
07c71b9838fee3e8d63b3433ae624271

SHA1
db45218ca5ae2b64f1c65813f3b717cbe4234085

SHA256
bb9d6a046abf975e367998fd19862798ebf72ebd6b33de60e26b18b4ea5d6b73

SHA512
8dac0ecdd70c850d8d3b880c3cfd28aad85502aadf4e231ed49b4f3e1952a2aeef4a2e92045d78208ead3dc2defd41fd882a14d72170f20f72cb6c0baaff6733

Download Submit
C:\Windows\System\zMHUrng.exe

Filesize
1.9MB

MD5
e0f35d0102b84118938bf8c55f93d055

SHA1
49432eba4541c77ae0d2e1c91040082f464e4867

SHA256
991030c8d8e74e5fe5563b9f26d05dbf4e02d81a7833f26ce60f63e1d035cdcb

SHA512
1063a5fca83aa4989bc0a16f5ce6b98afcf4d95c62f5cd3dcf13c6bc3aca16cbfc1cc204c9f311444d309b1d5e9546f9ae4854fbaffd4611cd981c80031a6a9a

Download Submit
memory/212-123-0x00007FF692410000-0x00007FF692802000-memory.dmp

Filesize
3.9MB

Download
memory/316-473-0x00007FF743230000-0x00007FF743622000-memory.dmp

Filesize
3.9MB

Download
memory/316-9-0x00007FF743230000-0x00007FF743622000-memory.dmp

Filesize
3.9MB

Download
memory/552-150-0x00007FF7F1550000-0x00007FF7F1942000-memory.dmp

Filesize
3.9MB

Download
memory/552-4562-0x00007FF7F1550000-0x00007FF7F1942000-memory.dmp

Filesize
3.9MB

Download
memory/552-1411-0x00007FF7F1550000-0x00007FF7F1942000-memory.dmp

Filesize
3.9MB

Download
memory/800-129-0x00007FF60D0C0000-0x00007FF60D4B2000-memory.dmp

Filesize
3.9MB

Download
memory/800-4571-0x00007FF60D0C0000-0x00007FF60D4B2000-memory.dmp

Filesize
3.9MB

Download
memory/856-4415-0x00007FF738760000-0x00007FF738B52000-memory.dmp

Filesize
3.9MB

Download
memory/856-86-0x00007FF738760000-0x00007FF738B52000-memory.dmp

Filesize
3.9MB

Download
memory/872-112-0x00007FF7F3EB0000-0x00007FF7F42A2000-memory.dmp

Filesize
3.9MB

Download
memory/1008-38-0x00007FF6BF010000-0x00007FF6BF402000-memory.dmp

Filesize
3.9MB

Download
memory/1008-481-0x00007FF6BF010000-0x00007FF6BF402000-memory.dmp

Filesize
3.9MB

Download
memory/1440-110-0x000001CF65E70000-0x000001CF65E92000-memory.dmp

Filesize
136KB

Download
memory/1440-568-0x00007FFDF2643000-0x00007FFDF2645000-memory.dmp

Filesize
8KB

Download
memory/1440-475-0x000001CF7E540000-0x000001CF7E550000-memory.dmp

Filesize
64KB

Download
memory/1440-27-0x000001CF7E540000-0x000001CF7E550000-memory.dmp

Filesize
64KB

Download
memory/1440-28-0x000001CF7E540000-0x000001CF7E550000-memory.dmp

Filesize
64KB

Download
memory/1440-29-0x00007FFDF2643000-0x00007FFDF2645000-memory.dmp

Filesize
8KB

Download
memory/1440-375-0x000001CF7ED00000-0x000001CF7F4A6000-memory.dmp

Filesize
7.6MB

Download
memory/1808-73-0x00007FF678EA0000-0x00007FF679292000-memory.dmp

Filesize
3.9MB

Download
memory/1808-4393-0x00007FF678EA0000-0x00007FF679292000-memory.dmp

Filesize
3.9MB

Download
memory/1808-485-0x00007FF678EA0000-0x00007FF679292000-memory.dmp

Filesize
3.9MB

Download
memory/2744-0-0x00007FF7C3DB0000-0x00007FF7C41A2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-1-0x000001BE84850000-0x000001BE84860000-memory.dmp

Filesize
64KB

Download
memory/2744-448-0x00007FF7C3DB0000-0x00007FF7C41A2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-93-0x00007FF7FADB0000-0x00007FF7FB1A2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-4421-0x00007FF7FADB0000-0x00007FF7FB1A2000-memory.dmp

Filesize
3.9MB

Download
memory/3276-4579-0x00007FF71DFF0000-0x00007FF71E3E2000-memory.dmp

Filesize
3.9MB

Download
memory/3276-158-0x00007FF71DFF0000-0x00007FF71E3E2000-memory.dmp

Filesize
3.9MB

Download
memory/3276-1516-0x00007FF71DFF0000-0x00007FF71E3E2000-memory.dmp

Filesize
3.9MB

Download
memory/3312-120-0x00007FF6D4A40000-0x00007FF6D4E32000-memory.dmp

Filesize
3.9MB

Download
memory/3312-4445-0x00007FF6D4A40000-0x00007FF6D4E32000-memory.dmp

Filesize
3.9MB

Download
memory/3500-4501-0x00007FF642E80000-0x00007FF643272000-memory.dmp

Filesize
3.9MB

Download
memory/3500-126-0x00007FF642E80000-0x00007FF643272000-memory.dmp

Filesize
3.9MB

Download
memory/3584-4505-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp

Filesize
3.9MB

Download
memory/3584-127-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp

Filesize
3.9MB

Download
memory/3744-449-0x00007FF6EA2E0000-0x00007FF6EA6D2000-memory.dmp

Filesize
3.9MB

Download
memory/3744-18-0x00007FF6EA2E0000-0x00007FF6EA6D2000-memory.dmp

Filesize
3.9MB

Download
memory/3768-4410-0x00007FF6B5D10000-0x00007FF6B6102000-memory.dmp

Filesize
3.9MB

Download
memory/3768-85-0x00007FF6B5D10000-0x00007FF6B6102000-memory.dmp

Filesize
3.9MB

Download
memory/3820-483-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp

Filesize
3.9MB

Download
memory/3820-61-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp

Filesize
3.9MB

Download
memory/3820-4387-0x00007FF6CCEA0000-0x00007FF6CD292000-memory.dmp

Filesize
3.9MB

Download
memory/4088-118-0x00007FF758710000-0x00007FF758B02000-memory.dmp

Filesize
3.9MB

Download
memory/4284-4568-0x00007FF6597B0000-0x00007FF659BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4284-149-0x00007FF6597B0000-0x00007FF659BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4284-1168-0x00007FF6597B0000-0x00007FF659BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4504-451-0x00007FF6DC4C0000-0x00007FF6DC8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4504-24-0x00007FF6DC4C0000-0x00007FF6DC8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4552-4431-0x00007FF60CDF0000-0x00007FF60D1E2000-memory.dmp

Filesize
3.9MB

Download
memory/4552-98-0x00007FF60CDF0000-0x00007FF60D1E2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-4569-0x00007FF746DB0000-0x00007FF7471A2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-128-0x00007FF746DB0000-0x00007FF7471A2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-885-0x00007FF727B90000-0x00007FF727F82000-memory.dmp

Filesize
3.9MB

Download
memory/4988-138-0x00007FF727B90000-0x00007FF727F82000-memory.dmp

Filesize
3.9MB

Download
memory/4988-4963-0x00007FF727B90000-0x00007FF727F82000-memory.dmp

Filesize
3.9MB

Download
memory/5012-111-0x00007FF75C990000-0x00007FF75CD82000-memory.dmp

Filesize
3.9MB

Download
memory/5012-4465-0x00007FF75C990000-0x00007FF75CD82000-memory.dmp

Filesize
3.9MB

Download
memory/5076-1030-0x00007FF64F640000-0x00007FF64FA32000-memory.dmp

Filesize
3.9MB

Download
memory/5076-4564-0x00007FF64F640000-0x00007FF64FA32000-memory.dmp

Filesize
3.9MB

Download
memory/5076-143-0x00007FF64F640000-0x00007FF64FA32000-memory.dmp

Filesize
3.9MB

Download