xmrig | 025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
Size

1.1MB
MD5

08275f5b4266a89dc9bd3587cddee170
SHA1

bbb4c691ff0dfa4e3afb914297125f6f49cdce3a
SHA256

025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0
SHA512

8b7938fc08930c2041515d9c418b34dea619e51d78e24e1e6e0325a40ef5d0169f33aac21b144c90052e0b7056952106961d8805af40d523d08803c4f61e6678
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYGiYFYS+P6:Lz071uv4BPMkibTIA5G1YA

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/2348-762-0x00007FF60E0F0000-0x00007FF60E4E2000-memory.dmp	xmrig
behavioral2/memory/1004-769-0x00007FF6D05A0000-0x00007FF6D0992000-memory.dmp	xmrig
behavioral2/memory/2020-773-0x00007FF6DDA40000-0x00007FF6DDE32000-memory.dmp	xmrig
behavioral2/memory/3312-779-0x00007FF605030000-0x00007FF605422000-memory.dmp	xmrig
behavioral2/memory/1340-778-0x00007FF7E17C0000-0x00007FF7E1BB2000-memory.dmp	xmrig
behavioral2/memory/1460-776-0x00007FF6C5720000-0x00007FF6C5B12000-memory.dmp	xmrig
behavioral2/memory/2116-775-0x00007FF74C2C0000-0x00007FF74C6B2000-memory.dmp	xmrig
behavioral2/memory/2840-774-0x00007FF734AE0000-0x00007FF734ED2000-memory.dmp	xmrig
behavioral2/memory/5116-772-0x00007FF78A730000-0x00007FF78AB22000-memory.dmp	xmrig
behavioral2/memory/2132-771-0x00007FF778C40000-0x00007FF779032000-memory.dmp	xmrig
behavioral2/memory/1528-770-0x00007FF784A20000-0x00007FF784E12000-memory.dmp	xmrig
behavioral2/memory/2548-768-0x00007FF6FF820000-0x00007FF6FFC12000-memory.dmp	xmrig
behavioral2/memory/588-767-0x00007FF745FD0000-0x00007FF7463C2000-memory.dmp	xmrig
behavioral2/memory/3800-766-0x00007FF7CD8A0000-0x00007FF7CDC92000-memory.dmp	xmrig
behavioral2/memory/4140-765-0x00007FF6C3A00000-0x00007FF6C3DF2000-memory.dmp	xmrig
behavioral2/memory/3904-764-0x00007FF7AA640000-0x00007FF7AAA32000-memory.dmp	xmrig
behavioral2/memory/5084-763-0x00007FF6E8D40000-0x00007FF6E9132000-memory.dmp	xmrig
behavioral2/memory/3732-688-0x00007FF6DB4B0000-0x00007FF6DB8A2000-memory.dmp	xmrig
behavioral2/memory/2904-491-0x00007FF7E5DB0000-0x00007FF7E61A2000-memory.dmp	xmrig
behavioral2/memory/4208-440-0x00007FF636350000-0x00007FF636742000-memory.dmp	xmrig
behavioral2/memory/1656-326-0x00007FF7587C0000-0x00007FF758BB2000-memory.dmp	xmrig
behavioral2/memory/3376-232-0x00007FF64C9F0000-0x00007FF64CDE2000-memory.dmp	xmrig
behavioral2/memory/780-143-0x00007FF72FAB0000-0x00007FF72FEA2000-memory.dmp	xmrig
behavioral2/memory/780-6289-0x00007FF72FAB0000-0x00007FF72FEA2000-memory.dmp	xmrig
behavioral2/memory/3376-6347-0x00007FF64C9F0000-0x00007FF64CDE2000-memory.dmp	xmrig
behavioral2/memory/3904-6532-0x00007FF7AA640000-0x00007FF7AAA32000-memory.dmp	xmrig
behavioral2/memory/1460-6537-0x00007FF6C5720000-0x00007FF6C5B12000-memory.dmp	xmrig
behavioral2/memory/2548-6592-0x00007FF6FF820000-0x00007FF6FFC12000-memory.dmp	xmrig
behavioral2/memory/3312-6516-0x00007FF605030000-0x00007FF605422000-memory.dmp	xmrig
behavioral2/memory/2132-6509-0x00007FF778C40000-0x00007FF779032000-memory.dmp	xmrig
behavioral2/memory/588-6478-0x00007FF745FD0000-0x00007FF7463C2000-memory.dmp	xmrig
behavioral2/memory/1656-6453-0x00007FF7587C0000-0x00007FF758BB2000-memory.dmp	xmrig
behavioral2/memory/1340-6311-0x00007FF7E17C0000-0x00007FF7E1BB2000-memory.dmp	xmrig
behavioral2/memory/4172-6295-0x00007FF64C820000-0x00007FF64CC12000-memory.dmp	xmrig
behavioral2/memory/2840-6644-0x00007FF734AE0000-0x00007FF734ED2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1608	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4172	quczOEh.exe
780	oWKebkR.exe
1340	mDDoJQi.exe
3376	sKKqBCT.exe
1656	yQBIAVt.exe
4208	mitLMZQ.exe
2904	BDbmjFv.exe
3732	pakcPnH.exe
2348	HXPrdUO.exe
5084	aYIXhRs.exe
3904	gMMBXsY.exe
4140	TYYoSkK.exe
3800	GwGtzfT.exe
588	ifdyHPt.exe
2548	TONBPkL.exe
1004	paIqRjr.exe
1528	kLtAFXN.exe
2132	pwJatFa.exe
3312	rZCBGoI.exe
5116	waazjXU.exe
2020	EBvbdGV.exe
2840	PhKhfhQ.exe
2116	qSEaqHX.exe
1460	PFndtbi.exe
3940	jeQWxuy.exe
3116	bJCBLKc.exe
2568	QSlaIsL.exe
1164	JjhAbdJ.exe
4512	tUIwWxH.exe
4024	TSuwpAa.exe
2224	JtRTgkj.exe
388	DnVmUTc.exe
2264	BEhXHsv.exe
2660	iXqhulL.exe
1228	vFDbfFK.exe
2968	qicCEEW.exe
4888	pCVVbND.exe
4960	UlLmBaP.exe
3408	DnsPkAW.exe
5080	hlzWTqC.exe
4176	pSypsCo.exe
5016	mVuGisL.exe
424	ICNpAVw.exe
4720	mJjqDez.exe
4616	KVMrHug.exe
3112	ZVYpfKy.exe
2324	EiagZWs.exe
1884	LmrTdOk.exe
4796	Weewjzq.exe
2176	HlYtwrD.exe
1844	TeUlKhI.exe
3592	jslmgKd.exe
1216	jQSLEhZ.exe
3612	yqzNSqZ.exe
4504	tCihRyS.exe
5056	AApSJTe.exe
528	ayUltxA.exe
1408	oFPdUkH.exe
1348	bsEArHw.exe
4860	XaEqUep.exe
2888	PSxROFg.exe
3912	WgdXlKL.exe
2008	SCpajKJ.exe
4820	IMrCnDA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3552-0-0x00007FF723CC0000-0x00007FF7240B2000-memory.dmp	upx
behavioral2/files/0x00090000000233ed-9.dat	upx
behavioral2/memory/4172-13-0x00007FF64C820000-0x00007FF64CC12000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-59.dat	upx
behavioral2/files/0x0007000000023403-151.dat	upx
behavioral2/memory/2348-762-0x00007FF60E0F0000-0x00007FF60E4E2000-memory.dmp	upx
behavioral2/memory/1004-769-0x00007FF6D05A0000-0x00007FF6D0992000-memory.dmp	upx
behavioral2/memory/2020-773-0x00007FF6DDA40000-0x00007FF6DDE32000-memory.dmp	upx
behavioral2/memory/3312-779-0x00007FF605030000-0x00007FF605422000-memory.dmp	upx
behavioral2/memory/1340-778-0x00007FF7E17C0000-0x00007FF7E1BB2000-memory.dmp	upx
behavioral2/memory/1460-776-0x00007FF6C5720000-0x00007FF6C5B12000-memory.dmp	upx
behavioral2/memory/2116-775-0x00007FF74C2C0000-0x00007FF74C6B2000-memory.dmp	upx
behavioral2/memory/2840-774-0x00007FF734AE0000-0x00007FF734ED2000-memory.dmp	upx
behavioral2/memory/5116-772-0x00007FF78A730000-0x00007FF78AB22000-memory.dmp	upx
behavioral2/memory/2132-771-0x00007FF778C40000-0x00007FF779032000-memory.dmp	upx
behavioral2/memory/1528-770-0x00007FF784A20000-0x00007FF784E12000-memory.dmp	upx
behavioral2/memory/2548-768-0x00007FF6FF820000-0x00007FF6FFC12000-memory.dmp	upx
behavioral2/memory/588-767-0x00007FF745FD0000-0x00007FF7463C2000-memory.dmp	upx
behavioral2/memory/3800-766-0x00007FF7CD8A0000-0x00007FF7CDC92000-memory.dmp	upx
behavioral2/memory/4140-765-0x00007FF6C3A00000-0x00007FF6C3DF2000-memory.dmp	upx
behavioral2/memory/3904-764-0x00007FF7AA640000-0x00007FF7AAA32000-memory.dmp	upx
behavioral2/memory/5084-763-0x00007FF6E8D40000-0x00007FF6E9132000-memory.dmp	upx
behavioral2/memory/3732-688-0x00007FF6DB4B0000-0x00007FF6DB8A2000-memory.dmp	upx
behavioral2/memory/2904-491-0x00007FF7E5DB0000-0x00007FF7E61A2000-memory.dmp	upx
behavioral2/memory/4208-440-0x00007FF636350000-0x00007FF636742000-memory.dmp	upx
behavioral2/memory/1656-326-0x00007FF7587C0000-0x00007FF758BB2000-memory.dmp	upx
behavioral2/files/0x000700000002341a-223.dat	upx
behavioral2/files/0x000700000002340d-213.dat	upx
behavioral2/files/0x0007000000023418-210.dat	upx
behavioral2/files/0x0007000000023416-206.dat	upx
behavioral2/files/0x0007000000023415-203.dat	upx
behavioral2/files/0x000700000002340b-202.dat	upx
behavioral2/files/0x0007000000023413-199.dat	upx
behavioral2/files/0x0007000000023412-198.dat	upx
behavioral2/files/0x00070000000233ff-188.dat	upx
behavioral2/files/0x00070000000233fe-186.dat	upx
behavioral2/files/0x00070000000233fd-184.dat	upx
behavioral2/files/0x0007000000023410-171.dat	upx
behavioral2/files/0x00070000000233fa-170.dat	upx
behavioral2/files/0x00070000000233f9-166.dat	upx
behavioral2/files/0x00070000000233f5-157.dat	upx
behavioral2/files/0x000700000002340f-150.dat	upx
behavioral2/files/0x000700000002340e-149.dat	upx
behavioral2/memory/3376-232-0x00007FF64C9F0000-0x00007FF64CDE2000-memory.dmp	upx
behavioral2/memory/780-143-0x00007FF72FAB0000-0x00007FF72FEA2000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-142.dat	upx
behavioral2/files/0x0007000000023419-220.dat	upx
behavioral2/files/0x000700000002340c-133.dat	upx
behavioral2/files/0x000700000002340a-125.dat	upx
behavioral2/files/0x0007000000023411-196.dat	upx
behavioral2/files/0x0007000000023409-117.dat	upx
behavioral2/files/0x00070000000233fc-115.dat	upx
behavioral2/files/0x0007000000023408-113.dat	upx
behavioral2/files/0x0007000000023407-112.dat	upx
behavioral2/files/0x0007000000023405-109.dat	upx
behavioral2/files/0x0007000000023404-108.dat	upx
behavioral2/files/0x00070000000233f8-107.dat	upx
behavioral2/files/0x0007000000023401-138.dat	upx
behavioral2/files/0x0007000000023400-130.dat	upx
behavioral2/files/0x00070000000233f6-82.dat	upx
behavioral2/files/0x00070000000233fb-79.dat	upx
behavioral2/files/0x0007000000023406-111.dat	upx
behavioral2/files/0x0007000000023402-101.dat	upx
behavioral2/files/0x00070000000233f3-89.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cHcAsQX.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\bPQKxkm.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\lxeZaex.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\NEQYhQr.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\CndIQcW.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\sarRrGh.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\qoTZnan.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\gvGubJl.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\uzsVPsP.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\jKltUOb.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\oiaFBeG.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\ckLbRHe.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\aThbkmT.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\hmwFxdK.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\kzGlIbn.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\zmIOyFv.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\OBYnzCM.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\joGXmSQ.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\LbVDrmI.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\aHRgBHW.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\VfrDVIG.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\pvOQBcY.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\EkqwRot.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\ElMkfZG.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\QyCSAwf.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\pFZMXVW.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\XSNNFAE.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\eJnMnqU.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\FTeyUQj.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\aDccYsq.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\fNzwQHj.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\rEJCMTw.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\ALYdhlu.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\SrZTjhV.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\xPSKWIC.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\SzYubOF.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\KLBykde.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\FbGYyKa.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\UmkoKgc.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\xsBfGTY.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\dltldic.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\jZqDpim.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\PWpdyQf.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\rhPCJnO.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\FmomLwr.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\fYvsOvM.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\iSrEkuu.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\IdFlUWa.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\djmeHvm.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\uAciHyl.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\ZcFiZvo.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\ftAhVjb.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\caaqCIc.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\mzYcWDx.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\GpEfApz.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\vGfIJEt.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\kQEnsqx.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\lSerqnX.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\XUqUVTc.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\bMeuFPx.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\ROnwhNJ.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\fyDhdBv.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\PMWBjyt.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\HHkxjkq.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1608	powershell.exe
1608	powershell.exe
1608	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
Token: SeLockMemoryPrivilege	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeCreateGlobalPrivilege	6004	dwm.exe
Token: SeChangeNotifyPrivilege	6004	dwm.exe
Token: 33	6004	dwm.exe
Token: SeIncBasePriorityPrivilege	6004	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 1608	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	81
PID 3552 wrote to memory of 1608	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	81
PID 3552 wrote to memory of 4172	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	82
PID 3552 wrote to memory of 4172	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	82
PID 3552 wrote to memory of 780	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	83
PID 3552 wrote to memory of 780	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	83
PID 3552 wrote to memory of 1340	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	84
PID 3552 wrote to memory of 1340	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	84
PID 3552 wrote to memory of 3376	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	85
PID 3552 wrote to memory of 3376	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	85
PID 3552 wrote to memory of 1656	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	86
PID 3552 wrote to memory of 1656	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	86
PID 3552 wrote to memory of 4208	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	87
PID 3552 wrote to memory of 4208	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	87
PID 3552 wrote to memory of 2904	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	88
PID 3552 wrote to memory of 2904	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	88
PID 3552 wrote to memory of 3732	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	89
PID 3552 wrote to memory of 3732	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	89
PID 3552 wrote to memory of 2348	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	90
PID 3552 wrote to memory of 2348	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	90
PID 3552 wrote to memory of 5084	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	91
PID 3552 wrote to memory of 5084	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	91
PID 3552 wrote to memory of 3904	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	92
PID 3552 wrote to memory of 3904	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	92
PID 3552 wrote to memory of 4140	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	93
PID 3552 wrote to memory of 4140	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	93
PID 3552 wrote to memory of 3800	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	94
PID 3552 wrote to memory of 3800	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	94
PID 3552 wrote to memory of 588	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	95
PID 3552 wrote to memory of 588	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	95
PID 3552 wrote to memory of 2548	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	96
PID 3552 wrote to memory of 2548	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	96
PID 3552 wrote to memory of 1004	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	97
PID 3552 wrote to memory of 1004	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	97
PID 3552 wrote to memory of 1528	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	98
PID 3552 wrote to memory of 1528	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	98
PID 3552 wrote to memory of 2132	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	99
PID 3552 wrote to memory of 2132	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	99
PID 3552 wrote to memory of 3312	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	100
PID 3552 wrote to memory of 3312	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	100
PID 3552 wrote to memory of 5116	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	101
PID 3552 wrote to memory of 5116	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	101
PID 3552 wrote to memory of 2020	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	102
PID 3552 wrote to memory of 2020	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	102
PID 3552 wrote to memory of 2840	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	103
PID 3552 wrote to memory of 2840	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	103
PID 3552 wrote to memory of 2116	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	104
PID 3552 wrote to memory of 2116	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	104
PID 3552 wrote to memory of 1460	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	105
PID 3552 wrote to memory of 1460	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	105
PID 3552 wrote to memory of 3940	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	106
PID 3552 wrote to memory of 3940	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	106
PID 3552 wrote to memory of 3116	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	107
PID 3552 wrote to memory of 3116	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	107
PID 3552 wrote to memory of 2568	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	108
PID 3552 wrote to memory of 2568	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	108
PID 3552 wrote to memory of 1164	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	109
PID 3552 wrote to memory of 1164	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	109
PID 3552 wrote to memory of 4888	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	110
PID 3552 wrote to memory of 4888	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	110
PID 3552 wrote to memory of 4512	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	111
PID 3552 wrote to memory of 4512	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	111
PID 3552 wrote to memory of 4024	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	112
PID 3552 wrote to memory of 4024	3552	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	112

C:\Users\Admin\AppData\Local\Temp\025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
"C:\Users\Admin\AppData\Local\Temp\025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\System\quczOEh.exe
  C:\Windows\System\quczOEh.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\oWKebkR.exe
  C:\Windows\System\oWKebkR.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\mDDoJQi.exe
  C:\Windows\System\mDDoJQi.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\sKKqBCT.exe
  C:\Windows\System\sKKqBCT.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\yQBIAVt.exe
  C:\Windows\System\yQBIAVt.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\mitLMZQ.exe
  C:\Windows\System\mitLMZQ.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\BDbmjFv.exe
  C:\Windows\System\BDbmjFv.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\pakcPnH.exe
  C:\Windows\System\pakcPnH.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\HXPrdUO.exe
  C:\Windows\System\HXPrdUO.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\aYIXhRs.exe
  C:\Windows\System\aYIXhRs.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\gMMBXsY.exe
  C:\Windows\System\gMMBXsY.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\TYYoSkK.exe
  C:\Windows\System\TYYoSkK.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\GwGtzfT.exe
  C:\Windows\System\GwGtzfT.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\ifdyHPt.exe
  C:\Windows\System\ifdyHPt.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\TONBPkL.exe
  C:\Windows\System\TONBPkL.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\paIqRjr.exe
  C:\Windows\System\paIqRjr.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\kLtAFXN.exe
  C:\Windows\System\kLtAFXN.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\pwJatFa.exe
  C:\Windows\System\pwJatFa.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\rZCBGoI.exe
  C:\Windows\System\rZCBGoI.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\waazjXU.exe
  C:\Windows\System\waazjXU.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\EBvbdGV.exe
  C:\Windows\System\EBvbdGV.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\PhKhfhQ.exe
  C:\Windows\System\PhKhfhQ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\qSEaqHX.exe
  C:\Windows\System\qSEaqHX.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\PFndtbi.exe
  C:\Windows\System\PFndtbi.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\jeQWxuy.exe
  C:\Windows\System\jeQWxuy.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\bJCBLKc.exe
  C:\Windows\System\bJCBLKc.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\QSlaIsL.exe
  C:\Windows\System\QSlaIsL.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\JjhAbdJ.exe
  C:\Windows\System\JjhAbdJ.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\pCVVbND.exe
  C:\Windows\System\pCVVbND.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\tUIwWxH.exe
  C:\Windows\System\tUIwWxH.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\TSuwpAa.exe
  C:\Windows\System\TSuwpAa.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\JtRTgkj.exe
  C:\Windows\System\JtRTgkj.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\DnVmUTc.exe
  C:\Windows\System\DnVmUTc.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\BEhXHsv.exe
  C:\Windows\System\BEhXHsv.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\iXqhulL.exe
  C:\Windows\System\iXqhulL.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\vFDbfFK.exe
  C:\Windows\System\vFDbfFK.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\qicCEEW.exe
  C:\Windows\System\qicCEEW.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\XaEqUep.exe
  C:\Windows\System\XaEqUep.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\UlLmBaP.exe
  C:\Windows\System\UlLmBaP.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\DnsPkAW.exe
  C:\Windows\System\DnsPkAW.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\SCpajKJ.exe
  C:\Windows\System\SCpajKJ.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\hlzWTqC.exe
  C:\Windows\System\hlzWTqC.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\pSypsCo.exe
  C:\Windows\System\pSypsCo.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\mVuGisL.exe
  C:\Windows\System\mVuGisL.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\ICNpAVw.exe
  C:\Windows\System\ICNpAVw.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\mJjqDez.exe
  C:\Windows\System\mJjqDez.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\KVMrHug.exe
  C:\Windows\System\KVMrHug.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\ZVYpfKy.exe
  C:\Windows\System\ZVYpfKy.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\EiagZWs.exe
  C:\Windows\System\EiagZWs.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\LmrTdOk.exe
  C:\Windows\System\LmrTdOk.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\Weewjzq.exe
  C:\Windows\System\Weewjzq.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\HlYtwrD.exe
  C:\Windows\System\HlYtwrD.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\TeUlKhI.exe
  C:\Windows\System\TeUlKhI.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\jslmgKd.exe
  C:\Windows\System\jslmgKd.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\jQSLEhZ.exe
  C:\Windows\System\jQSLEhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\yqzNSqZ.exe
  C:\Windows\System\yqzNSqZ.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\tCihRyS.exe
  C:\Windows\System\tCihRyS.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\AApSJTe.exe
  C:\Windows\System\AApSJTe.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\ayUltxA.exe
  C:\Windows\System\ayUltxA.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\oFPdUkH.exe
  C:\Windows\System\oFPdUkH.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\bsEArHw.exe
  C:\Windows\System\bsEArHw.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\PSxROFg.exe
  C:\Windows\System\PSxROFg.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\WgdXlKL.exe
  C:\Windows\System\WgdXlKL.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\IMrCnDA.exe
  C:\Windows\System\IMrCnDA.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\bdGAqYZ.exe
  C:\Windows\System\bdGAqYZ.exe
  2⤵
  PID:3772
- C:\Windows\System\JfBVwHS.exe
  C:\Windows\System\JfBVwHS.exe
  2⤵
  PID:2360
- C:\Windows\System\CAqQzdV.exe
  C:\Windows\System\CAqQzdV.exe
  2⤵
  PID:3852
- C:\Windows\System\yXZettt.exe
  C:\Windows\System\yXZettt.exe
  2⤵
  PID:1416
- C:\Windows\System\lMPFjJb.exe
  C:\Windows\System\lMPFjJb.exe
  2⤵
  PID:4992
- C:\Windows\System\IZEdrQA.exe
  C:\Windows\System\IZEdrQA.exe
  2⤵
  PID:2688
- C:\Windows\System\CKuTCDf.exe
  C:\Windows\System\CKuTCDf.exe
  2⤵
  PID:1596
- C:\Windows\System\SLLyEbg.exe
  C:\Windows\System\SLLyEbg.exe
  2⤵
  PID:2844
- C:\Windows\System\owoFluu.exe
  C:\Windows\System\owoFluu.exe
  2⤵
  PID:1336
- C:\Windows\System\ukjnikl.exe
  C:\Windows\System\ukjnikl.exe
  2⤵
  PID:4336
- C:\Windows\System\VrwdUxk.exe
  C:\Windows\System\VrwdUxk.exe
  2⤵
  PID:3836
- C:\Windows\System\rbTFrVZ.exe
  C:\Windows\System\rbTFrVZ.exe
  2⤵
  PID:4912
- C:\Windows\System\FOseAqW.exe
  C:\Windows\System\FOseAqW.exe
  2⤵
  PID:4872
- C:\Windows\System\bXuRYok.exe
  C:\Windows\System\bXuRYok.exe
  2⤵
  PID:4844
- C:\Windows\System\GElCwTQ.exe
  C:\Windows\System\GElCwTQ.exe
  2⤵
  PID:4864
- C:\Windows\System\BfOHLhM.exe
  C:\Windows\System\BfOHLhM.exe
  2⤵
  PID:2172
- C:\Windows\System\ZOgBOUL.exe
  C:\Windows\System\ZOgBOUL.exe
  2⤵
  PID:2140
- C:\Windows\System\mzNYqkt.exe
  C:\Windows\System\mzNYqkt.exe
  2⤵
  PID:4988
- C:\Windows\System\GOEZDHY.exe
  C:\Windows\System\GOEZDHY.exe
  2⤵
  PID:3392
- C:\Windows\System\MtkJCGF.exe
  C:\Windows\System\MtkJCGF.exe
  2⤵
  PID:4184
- C:\Windows\System\KyrZQpB.exe
  C:\Windows\System\KyrZQpB.exe
  2⤵
  PID:4948
- C:\Windows\System\dwaDOeS.exe
  C:\Windows\System\dwaDOeS.exe
  2⤵
  PID:4712
- C:\Windows\System\kdpoHNZ.exe
  C:\Windows\System\kdpoHNZ.exe
  2⤵
  PID:2600
- C:\Windows\System\QcsmUsi.exe
  C:\Windows\System\QcsmUsi.exe
  2⤵
  PID:4316
- C:\Windows\System\NzPCyHV.exe
  C:\Windows\System\NzPCyHV.exe
  2⤵
  PID:2780
- C:\Windows\System\AEXQmmZ.exe
  C:\Windows\System\AEXQmmZ.exe
  2⤵
  PID:1652
- C:\Windows\System\yxMeEyb.exe
  C:\Windows\System\yxMeEyb.exe
  2⤵
  PID:2400
- C:\Windows\System\KKXGZdD.exe
  C:\Windows\System\KKXGZdD.exe
  2⤵
  PID:3044
- C:\Windows\System\chaMpUs.exe
  C:\Windows\System\chaMpUs.exe
  2⤵
  PID:1832
- C:\Windows\System\PZYkFVQ.exe
  C:\Windows\System\PZYkFVQ.exe
  2⤵
  PID:5136
- C:\Windows\System\PcIJWJt.exe
  C:\Windows\System\PcIJWJt.exe
  2⤵
  PID:5160
- C:\Windows\System\cjExSph.exe
  C:\Windows\System\cjExSph.exe
  2⤵
  PID:5176
- C:\Windows\System\SbHQEdq.exe
  C:\Windows\System\SbHQEdq.exe
  2⤵
  PID:5220
- C:\Windows\System\BzikoaL.exe
  C:\Windows\System\BzikoaL.exe
  2⤵
  PID:5240
- C:\Windows\System\dTPUZxk.exe
  C:\Windows\System\dTPUZxk.exe
  2⤵
  PID:5264
- C:\Windows\System\kPadDdp.exe
  C:\Windows\System\kPadDdp.exe
  2⤵
  PID:5280
- C:\Windows\System\DuCwZVN.exe
  C:\Windows\System\DuCwZVN.exe
  2⤵
  PID:5304
- C:\Windows\System\XvYiaLM.exe
  C:\Windows\System\XvYiaLM.exe
  2⤵
  PID:5320
- C:\Windows\System\ZjYCeov.exe
  C:\Windows\System\ZjYCeov.exe
  2⤵
  PID:5336
- C:\Windows\System\vSdZCrm.exe
  C:\Windows\System\vSdZCrm.exe
  2⤵
  PID:5352
- C:\Windows\System\jVEgcYx.exe
  C:\Windows\System\jVEgcYx.exe
  2⤵
  PID:5376
- C:\Windows\System\XwxKbKb.exe
  C:\Windows\System\XwxKbKb.exe
  2⤵
  PID:5392
- C:\Windows\System\vRGCsbF.exe
  C:\Windows\System\vRGCsbF.exe
  2⤵
  PID:5408
- C:\Windows\System\zqIjoVm.exe
  C:\Windows\System\zqIjoVm.exe
  2⤵
  PID:5424
- C:\Windows\System\pSdAdXx.exe
  C:\Windows\System\pSdAdXx.exe
  2⤵
  PID:5440
- C:\Windows\System\ssDESPy.exe
  C:\Windows\System\ssDESPy.exe
  2⤵
  PID:5464
- C:\Windows\System\MQYNHvj.exe
  C:\Windows\System\MQYNHvj.exe
  2⤵
  PID:5480
- C:\Windows\System\SyqrEwk.exe
  C:\Windows\System\SyqrEwk.exe
  2⤵
  PID:5500
- C:\Windows\System\XqpClig.exe
  C:\Windows\System\XqpClig.exe
  2⤵
  PID:5516
- C:\Windows\System\jrGvWky.exe
  C:\Windows\System\jrGvWky.exe
  2⤵
  PID:5536
- C:\Windows\System\rVqbdZg.exe
  C:\Windows\System\rVqbdZg.exe
  2⤵
  PID:5552
- C:\Windows\System\WlepeLe.exe
  C:\Windows\System\WlepeLe.exe
  2⤵
  PID:5576
- C:\Windows\System\PMTkXSU.exe
  C:\Windows\System\PMTkXSU.exe
  2⤵
  PID:5596
- C:\Windows\System\DcuBLVJ.exe
  C:\Windows\System\DcuBLVJ.exe
  2⤵
  PID:5612
- C:\Windows\System\hOSEGqP.exe
  C:\Windows\System\hOSEGqP.exe
  2⤵
  PID:5628
- C:\Windows\System\urmAlCY.exe
  C:\Windows\System\urmAlCY.exe
  2⤵
  PID:5648
- C:\Windows\System\ISUAvYI.exe
  C:\Windows\System\ISUAvYI.exe
  2⤵
  PID:5668
- C:\Windows\System\fLKCLQX.exe
  C:\Windows\System\fLKCLQX.exe
  2⤵
  PID:5684
- C:\Windows\System\uxuhvws.exe
  C:\Windows\System\uxuhvws.exe
  2⤵
  PID:5724
- C:\Windows\System\ZaMDYIo.exe
  C:\Windows\System\ZaMDYIo.exe
  2⤵
  PID:5744
- C:\Windows\System\yazSRqH.exe
  C:\Windows\System\yazSRqH.exe
  2⤵
  PID:5764
- C:\Windows\System\ZBzNWFl.exe
  C:\Windows\System\ZBzNWFl.exe
  2⤵
  PID:5780
- C:\Windows\System\AHjNqds.exe
  C:\Windows\System\AHjNqds.exe
  2⤵
  PID:5800
- C:\Windows\System\wmqlwpD.exe
  C:\Windows\System\wmqlwpD.exe
  2⤵
  PID:5816
- C:\Windows\System\crtHtzQ.exe
  C:\Windows\System\crtHtzQ.exe
  2⤵
  PID:5840
- C:\Windows\System\kcIBkwl.exe
  C:\Windows\System\kcIBkwl.exe
  2⤵
  PID:5860
- C:\Windows\System\oSMZysh.exe
  C:\Windows\System\oSMZysh.exe
  2⤵
  PID:5876
- C:\Windows\System\xWZCQzW.exe
  C:\Windows\System\xWZCQzW.exe
  2⤵
  PID:5892
- C:\Windows\System\ngRjSrn.exe
  C:\Windows\System\ngRjSrn.exe
  2⤵
  PID:5920
- C:\Windows\System\aTZCtjg.exe
  C:\Windows\System\aTZCtjg.exe
  2⤵
  PID:5940
- C:\Windows\System\vKqzcxK.exe
  C:\Windows\System\vKqzcxK.exe
  2⤵
  PID:5960
- C:\Windows\System\CAeOWhj.exe
  C:\Windows\System\CAeOWhj.exe
  2⤵
  PID:6024
- C:\Windows\System\SOCWTNx.exe
  C:\Windows\System\SOCWTNx.exe
  2⤵
  PID:6044
- C:\Windows\System\cvBoRJc.exe
  C:\Windows\System\cvBoRJc.exe
  2⤵
  PID:6064
- C:\Windows\System\QzIXWQa.exe
  C:\Windows\System\QzIXWQa.exe
  2⤵
  PID:6084
- C:\Windows\System\cHoSbyb.exe
  C:\Windows\System\cHoSbyb.exe
  2⤵
  PID:6100
- C:\Windows\System\eTDUBfm.exe
  C:\Windows\System\eTDUBfm.exe
  2⤵
  PID:6124
- C:\Windows\System\VZdncBC.exe
  C:\Windows\System\VZdncBC.exe
  2⤵
  PID:6140
- C:\Windows\System\iBmuHaJ.exe
  C:\Windows\System\iBmuHaJ.exe
  2⤵
  PID:1628
- C:\Windows\System\fILBGFa.exe
  C:\Windows\System\fILBGFa.exe
  2⤵
  PID:1036
- C:\Windows\System\aKYwuSA.exe
  C:\Windows\System\aKYwuSA.exe
  2⤵
  PID:4824
- C:\Windows\System\aCCmwaG.exe
  C:\Windows\System\aCCmwaG.exe
  2⤵
  PID:3748
- C:\Windows\System\nAzPNFg.exe
  C:\Windows\System\nAzPNFg.exe
  2⤵
  PID:3492
- C:\Windows\System\VCXWvkq.exe
  C:\Windows\System\VCXWvkq.exe
  2⤵
  PID:3704
- C:\Windows\System\bjyhjTm.exe
  C:\Windows\System\bjyhjTm.exe
  2⤵
  PID:1096
- C:\Windows\System\LNMIALw.exe
  C:\Windows\System\LNMIALw.exe
  2⤵
  PID:1856
- C:\Windows\System\KmQxnGr.exe
  C:\Windows\System\KmQxnGr.exe
  2⤵
  PID:4500
- C:\Windows\System\MboMTXX.exe
  C:\Windows\System\MboMTXX.exe
  2⤵
  PID:2812
- C:\Windows\System\oOEMKYz.exe
  C:\Windows\System\oOEMKYz.exe
  2⤵
  PID:5232
- C:\Windows\System\JKcsvpC.exe
  C:\Windows\System\JKcsvpC.exe
  2⤵
  PID:6292
- C:\Windows\System\unTLIrg.exe
  C:\Windows\System\unTLIrg.exe
  2⤵
  PID:6324
- C:\Windows\System\hqmXDVY.exe
  C:\Windows\System\hqmXDVY.exe
  2⤵
  PID:6344
- C:\Windows\System\VFqAPxW.exe
  C:\Windows\System\VFqAPxW.exe
  2⤵
  PID:6360
- C:\Windows\System\CrebOlC.exe
  C:\Windows\System\CrebOlC.exe
  2⤵
  PID:6380
- C:\Windows\System\bcbsCGM.exe
  C:\Windows\System\bcbsCGM.exe
  2⤵
  PID:6400
- C:\Windows\System\ytvRRgd.exe
  C:\Windows\System\ytvRRgd.exe
  2⤵
  PID:6420
- C:\Windows\System\xRTqWnT.exe
  C:\Windows\System\xRTqWnT.exe
  2⤵
  PID:6440
- C:\Windows\System\kmSjNis.exe
  C:\Windows\System\kmSjNis.exe
  2⤵
  PID:6460
- C:\Windows\System\HWTcsfM.exe
  C:\Windows\System\HWTcsfM.exe
  2⤵
  PID:6476
- C:\Windows\System\hbHmxCk.exe
  C:\Windows\System\hbHmxCk.exe
  2⤵
  PID:6496
- C:\Windows\System\ZWIzrEJ.exe
  C:\Windows\System\ZWIzrEJ.exe
  2⤵
  PID:6520
- C:\Windows\System\rBNVjYF.exe
  C:\Windows\System\rBNVjYF.exe
  2⤵
  PID:6548
- C:\Windows\System\TTzCFzy.exe
  C:\Windows\System\TTzCFzy.exe
  2⤵
  PID:6564
- C:\Windows\System\KxRnYcg.exe
  C:\Windows\System\KxRnYcg.exe
  2⤵
  PID:6584
- C:\Windows\System\dfZVnfg.exe
  C:\Windows\System\dfZVnfg.exe
  2⤵
  PID:6604
- C:\Windows\System\fYPcrIq.exe
  C:\Windows\System\fYPcrIq.exe
  2⤵
  PID:6624
- C:\Windows\System\jtJMALs.exe
  C:\Windows\System\jtJMALs.exe
  2⤵
  PID:6640
- C:\Windows\System\opAHtuk.exe
  C:\Windows\System\opAHtuk.exe
  2⤵
  PID:6664
- C:\Windows\System\iBBwSuw.exe
  C:\Windows\System\iBBwSuw.exe
  2⤵
  PID:6680
- C:\Windows\System\GOdmuck.exe
  C:\Windows\System\GOdmuck.exe
  2⤵
  PID:6696
- C:\Windows\System\uunvVgq.exe
  C:\Windows\System\uunvVgq.exe
  2⤵
  PID:6724
- C:\Windows\System\xwjWRhb.exe
  C:\Windows\System\xwjWRhb.exe
  2⤵
  PID:6744
- C:\Windows\System\vnirUNL.exe
  C:\Windows\System\vnirUNL.exe
  2⤵
  PID:6840
- C:\Windows\System\zQIQVhl.exe
  C:\Windows\System\zQIQVhl.exe
  2⤵
  PID:6868
- C:\Windows\System\gVyPUOE.exe
  C:\Windows\System\gVyPUOE.exe
  2⤵
  PID:6884
- C:\Windows\System\FrGITQl.exe
  C:\Windows\System\FrGITQl.exe
  2⤵
  PID:6900
- C:\Windows\System\RViIZxK.exe
  C:\Windows\System\RViIZxK.exe
  2⤵
  PID:6920
- C:\Windows\System\cutEQAR.exe
  C:\Windows\System\cutEQAR.exe
  2⤵
  PID:6936
- C:\Windows\System\kCPpPQB.exe
  C:\Windows\System\kCPpPQB.exe
  2⤵
  PID:6960
- C:\Windows\System\WUQBYrA.exe
  C:\Windows\System\WUQBYrA.exe
  2⤵
  PID:6976
- C:\Windows\System\bsMugJW.exe
  C:\Windows\System\bsMugJW.exe
  2⤵
  PID:6996
- C:\Windows\System\FarriQe.exe
  C:\Windows\System\FarriQe.exe
  2⤵
  PID:7012
- C:\Windows\System\UcdOdaq.exe
  C:\Windows\System\UcdOdaq.exe
  2⤵
  PID:7028
- C:\Windows\System\YWeMWcq.exe
  C:\Windows\System\YWeMWcq.exe
  2⤵
  PID:7052
- C:\Windows\System\fHFpTCp.exe
  C:\Windows\System\fHFpTCp.exe
  2⤵
  PID:7068
- C:\Windows\System\NLwLpVa.exe
  C:\Windows\System\NLwLpVa.exe
  2⤵
  PID:7100
- C:\Windows\System\qYDSdUs.exe
  C:\Windows\System\qYDSdUs.exe
  2⤵
  PID:7116
- C:\Windows\System\bpgFZdT.exe
  C:\Windows\System\bpgFZdT.exe
  2⤵
  PID:7136
- C:\Windows\System\GCxeaHP.exe
  C:\Windows\System\GCxeaHP.exe
  2⤵
  PID:7156
- C:\Windows\System\KBiaabN.exe
  C:\Windows\System\KBiaabN.exe
  2⤵
  PID:2428
- C:\Windows\System\tLCLSiX.exe
  C:\Windows\System\tLCLSiX.exe
  2⤵
  PID:2924
- C:\Windows\System\gTikaWL.exe
  C:\Windows\System\gTikaWL.exe
  2⤵
  PID:5932
- C:\Windows\System\HdbDCUk.exe
  C:\Windows\System\HdbDCUk.exe
  2⤵
  PID:64
- C:\Windows\System\QzHjJyD.exe
  C:\Windows\System\QzHjJyD.exe
  2⤵
  PID:1920
- C:\Windows\System\pJbHVkJ.exe
  C:\Windows\System\pJbHVkJ.exe
  2⤵
  PID:3348
- C:\Windows\System\cNMXQls.exe
  C:\Windows\System\cNMXQls.exe
  2⤵
  PID:2236
- C:\Windows\System\lryLMXQ.exe
  C:\Windows\System\lryLMXQ.exe
  2⤵
  PID:4332
- C:\Windows\System\VPDmHYA.exe
  C:\Windows\System\VPDmHYA.exe
  2⤵
  PID:3256
- C:\Windows\System\djjhNhi.exe
  C:\Windows\System\djjhNhi.exe
  2⤵
  PID:5344
- C:\Windows\System\ilzmtPl.exe
  C:\Windows\System\ilzmtPl.exe
  2⤵
  PID:5432
- C:\Windows\System\pNByDqo.exe
  C:\Windows\System\pNByDqo.exe
  2⤵
  PID:5528
- C:\Windows\System\bqSEKys.exe
  C:\Windows\System\bqSEKys.exe
  2⤵
  PID:5636
- C:\Windows\System\bnyRlRi.exe
  C:\Windows\System\bnyRlRi.exe
  2⤵
  PID:5732
- C:\Windows\System\siJoxOe.exe
  C:\Windows\System\siJoxOe.exe
  2⤵
  PID:5828
- C:\Windows\System\odGDYoV.exe
  C:\Windows\System\odGDYoV.exe
  2⤵
  PID:5948
- C:\Windows\System\ZNKWjtw.exe
  C:\Windows\System\ZNKWjtw.exe
  2⤵
  PID:4996
- C:\Windows\System\qpVVIxH.exe
  C:\Windows\System\qpVVIxH.exe
  2⤵
  PID:5316
- C:\Windows\System\jYcuwrb.exe
  C:\Windows\System\jYcuwrb.exe
  2⤵
  PID:1504
- C:\Windows\System\vIEuUHZ.exe
  C:\Windows\System\vIEuUHZ.exe
  2⤵
  PID:4312
- C:\Windows\System\BgUQpFV.exe
  C:\Windows\System\BgUQpFV.exe
  2⤵
  PID:5008
- C:\Windows\System\xucxFcJ.exe
  C:\Windows\System\xucxFcJ.exe
  2⤵
  PID:1028
- C:\Windows\System\fWhTaDK.exe
  C:\Windows\System\fWhTaDK.exe
  2⤵
  PID:368
- C:\Windows\System\wIfRUyB.exe
  C:\Windows\System\wIfRUyB.exe
  2⤵
  PID:3416
- C:\Windows\System\PFVqYpu.exe
  C:\Windows\System\PFVqYpu.exe
  2⤵
  PID:3900
- C:\Windows\System\CaFdYJv.exe
  C:\Windows\System\CaFdYJv.exe
  2⤵
  PID:5736
- C:\Windows\System\whvoayd.exe
  C:\Windows\System\whvoayd.exe
  2⤵
  PID:5168
- C:\Windows\System\ysqBWon.exe
  C:\Windows\System\ysqBWon.exe
  2⤵
  PID:6120
- C:\Windows\System\uYZVuVH.exe
  C:\Windows\System\uYZVuVH.exe
  2⤵
  PID:5228
- C:\Windows\System\sivXAgS.exe
  C:\Windows\System\sivXAgS.exe
  2⤵
  PID:5292
- C:\Windows\System\LItOAti.exe
  C:\Windows\System\LItOAti.exe
  2⤵
  PID:2560
- C:\Windows\System\lpYmvRQ.exe
  C:\Windows\System\lpYmvRQ.exe
  2⤵
  PID:7176
- C:\Windows\System\dZGLfUL.exe
  C:\Windows\System\dZGLfUL.exe
  2⤵
  PID:7192
- C:\Windows\System\bCvYMAU.exe
  C:\Windows\System\bCvYMAU.exe
  2⤵
  PID:7212
- C:\Windows\System\neiSSPr.exe
  C:\Windows\System\neiSSPr.exe
  2⤵
  PID:7228
- C:\Windows\System\LzabdFk.exe
  C:\Windows\System\LzabdFk.exe
  2⤵
  PID:7244
- C:\Windows\System\UWxXKaC.exe
  C:\Windows\System\UWxXKaC.exe
  2⤵
  PID:7268
- C:\Windows\System\xRHlDNs.exe
  C:\Windows\System\xRHlDNs.exe
  2⤵
  PID:7284
- C:\Windows\System\vYFTGAz.exe
  C:\Windows\System\vYFTGAz.exe
  2⤵
  PID:7308
- C:\Windows\System\MTYptOe.exe
  C:\Windows\System\MTYptOe.exe
  2⤵
  PID:7328
- C:\Windows\System\VokTxRv.exe
  C:\Windows\System\VokTxRv.exe
  2⤵
  PID:7344
- C:\Windows\System\apgDVRw.exe
  C:\Windows\System\apgDVRw.exe
  2⤵
  PID:7364
- C:\Windows\System\aKJuUgi.exe
  C:\Windows\System\aKJuUgi.exe
  2⤵
  PID:7388
- C:\Windows\System\VFpqwMt.exe
  C:\Windows\System\VFpqwMt.exe
  2⤵
  PID:7404
- C:\Windows\System\pxpLqhK.exe
  C:\Windows\System\pxpLqhK.exe
  2⤵
  PID:7428
- C:\Windows\System\FZXLaRR.exe
  C:\Windows\System\FZXLaRR.exe
  2⤵
  PID:7448
- C:\Windows\System\HpQSCkk.exe
  C:\Windows\System\HpQSCkk.exe
  2⤵
  PID:7468
- C:\Windows\System\DPtExJi.exe
  C:\Windows\System\DPtExJi.exe
  2⤵
  PID:7484
- C:\Windows\System\NGGPMPT.exe
  C:\Windows\System\NGGPMPT.exe
  2⤵
  PID:7500
- C:\Windows\System\noKknZt.exe
  C:\Windows\System\noKknZt.exe
  2⤵
  PID:7516
- C:\Windows\System\dDUKWJM.exe
  C:\Windows\System\dDUKWJM.exe
  2⤵
  PID:7536
- C:\Windows\System\muwRwKK.exe
  C:\Windows\System\muwRwKK.exe
  2⤵
  PID:7556
- C:\Windows\System\xXlKcIk.exe
  C:\Windows\System\xXlKcIk.exe
  2⤵
  PID:7572
- C:\Windows\System\nxqkXmz.exe
  C:\Windows\System\nxqkXmz.exe
  2⤵
  PID:7588
- C:\Windows\System\cROjInK.exe
  C:\Windows\System\cROjInK.exe
  2⤵
  PID:7608
- C:\Windows\System\DldPbDr.exe
  C:\Windows\System\DldPbDr.exe
  2⤵
  PID:7628
- C:\Windows\System\hVnpluC.exe
  C:\Windows\System\hVnpluC.exe
  2⤵
  PID:7648
- C:\Windows\System\wGnZkFC.exe
  C:\Windows\System\wGnZkFC.exe
  2⤵
  PID:7668
- C:\Windows\System\bMSkHNm.exe
  C:\Windows\System\bMSkHNm.exe
  2⤵
  PID:7684
- C:\Windows\System\WNSQDgk.exe
  C:\Windows\System\WNSQDgk.exe
  2⤵
  PID:7708
- C:\Windows\System\hjmMapD.exe
  C:\Windows\System\hjmMapD.exe
  2⤵
  PID:7724
- C:\Windows\System\BnAPrcB.exe
  C:\Windows\System\BnAPrcB.exe
  2⤵
  PID:7744
- C:\Windows\System\lzOWqoK.exe
  C:\Windows\System\lzOWqoK.exe
  2⤵
  PID:7760
- C:\Windows\System\MTnpHPy.exe
  C:\Windows\System\MTnpHPy.exe
  2⤵
  PID:7784
- C:\Windows\System\PWDhYIe.exe
  C:\Windows\System\PWDhYIe.exe
  2⤵
  PID:7800
- C:\Windows\System\tNAjKlT.exe
  C:\Windows\System\tNAjKlT.exe
  2⤵
  PID:7820
- C:\Windows\System\AfdamFQ.exe
  C:\Windows\System\AfdamFQ.exe
  2⤵
  PID:7844
- C:\Windows\System\RZUrPaz.exe
  C:\Windows\System\RZUrPaz.exe
  2⤵
  PID:7860
- C:\Windows\System\vEPKneP.exe
  C:\Windows\System\vEPKneP.exe
  2⤵
  PID:7884
- C:\Windows\System\LGnxgrH.exe
  C:\Windows\System\LGnxgrH.exe
  2⤵
  PID:7900
- C:\Windows\System\pueNfce.exe
  C:\Windows\System\pueNfce.exe
  2⤵
  PID:7916
- C:\Windows\System\QagnrWL.exe
  C:\Windows\System\QagnrWL.exe
  2⤵
  PID:7984
- C:\Windows\System\hrAtjNt.exe
  C:\Windows\System\hrAtjNt.exe
  2⤵
  PID:8004
- C:\Windows\System\enmdIwb.exe
  C:\Windows\System\enmdIwb.exe
  2⤵
  PID:8020
- C:\Windows\System\oNjRiwP.exe
  C:\Windows\System\oNjRiwP.exe
  2⤵
  PID:8044
- C:\Windows\System\cCuOqPQ.exe
  C:\Windows\System\cCuOqPQ.exe
  2⤵
  PID:8064
- C:\Windows\System\WsdFfDK.exe
  C:\Windows\System\WsdFfDK.exe
  2⤵
  PID:8088
- C:\Windows\System\kkSnZZm.exe
  C:\Windows\System\kkSnZZm.exe
  2⤵
  PID:8108
- C:\Windows\System\fjGhBGM.exe
  C:\Windows\System\fjGhBGM.exe
  2⤵
  PID:8140
- C:\Windows\System\DimddWu.exe
  C:\Windows\System\DimddWu.exe
  2⤵
  PID:8160
- C:\Windows\System\uFBzObc.exe
  C:\Windows\System\uFBzObc.exe
  2⤵
  PID:8176
- C:\Windows\System\lHSpUzf.exe
  C:\Windows\System\lHSpUzf.exe
  2⤵
  PID:6492
- C:\Windows\System\dNjCCKs.exe
  C:\Windows\System\dNjCCKs.exe
  2⤵
  PID:5452
- C:\Windows\System\hGinhVt.exe
  C:\Windows\System\hGinhVt.exe
  2⤵
  PID:6576
- C:\Windows\System\dWVMAyK.exe
  C:\Windows\System\dWVMAyK.exe
  2⤵
  PID:6732
- C:\Windows\System\VfOYexe.exe
  C:\Windows\System\VfOYexe.exe
  2⤵
  PID:6080
- C:\Windows\System\QpUwCSv.exe
  C:\Windows\System\QpUwCSv.exe
  2⤵
  PID:3188
- C:\Windows\System\hbbqFEC.exe
  C:\Windows\System\hbbqFEC.exe
  2⤵
  PID:4472
- C:\Windows\System\NoZElsD.exe
  C:\Windows\System\NoZElsD.exe
  2⤵
  PID:3636
- C:\Windows\System\slLQFOU.exe
  C:\Windows\System\slLQFOU.exe
  2⤵
  PID:6316
- C:\Windows\System\rKOkBGm.exe
  C:\Windows\System\rKOkBGm.exe
  2⤵
  PID:2108
- C:\Windows\System\ZMVLyml.exe
  C:\Windows\System\ZMVLyml.exe
  2⤵
  PID:1928
- C:\Windows\System\KXSKoxg.exe
  C:\Windows\System\KXSKoxg.exe
  2⤵
  PID:7064
- C:\Windows\System\aOlVFdc.exe
  C:\Windows\System\aOlVFdc.exe
  2⤵
  PID:6196
- C:\Windows\System\WCTvspp.exe
  C:\Windows\System\WCTvspp.exe
  2⤵
  PID:6260
- C:\Windows\System\igjCGGx.exe
  C:\Windows\System\igjCGGx.exe
  2⤵
  PID:6332
- C:\Windows\System\dlOcVoP.exe
  C:\Windows\System\dlOcVoP.exe
  2⤵
  PID:6388
- C:\Windows\System\ClGWdTz.exe
  C:\Windows\System\ClGWdTz.exe
  2⤵
  PID:6416
- C:\Windows\System\ByWdpcl.exe
  C:\Windows\System\ByWdpcl.exe
  2⤵
  PID:6472
- C:\Windows\System\LTroAJE.exe
  C:\Windows\System\LTroAJE.exe
  2⤵
  PID:6536
- C:\Windows\System\GdJYcPP.exe
  C:\Windows\System\GdJYcPP.exe
  2⤵
  PID:6592
- C:\Windows\System\oRSvsQz.exe
  C:\Windows\System\oRSvsQz.exe
  2⤵
  PID:6620
- C:\Windows\System\DjFfOlM.exe
  C:\Windows\System\DjFfOlM.exe
  2⤵
  PID:6652
- C:\Windows\System\MFkcloF.exe
  C:\Windows\System\MFkcloF.exe
  2⤵
  PID:6688
- C:\Windows\System\aISPyvK.exe
  C:\Windows\System\aISPyvK.exe
  2⤵
  PID:6752
- C:\Windows\System\gdvgqxS.exe
  C:\Windows\System\gdvgqxS.exe
  2⤵
  PID:6892
- C:\Windows\System\BaQBWhM.exe
  C:\Windows\System\BaQBWhM.exe
  2⤵
  PID:6972
- C:\Windows\System\WFQobMg.exe
  C:\Windows\System\WFQobMg.exe
  2⤵
  PID:7132
- C:\Windows\System\AGSGEvQ.exe
  C:\Windows\System\AGSGEvQ.exe
  2⤵
  PID:3196
- C:\Windows\System\VLojOHn.exe
  C:\Windows\System\VLojOHn.exe
  2⤵
  PID:6056
- C:\Windows\System\YPFPIty.exe
  C:\Windows\System\YPFPIty.exe
  2⤵
  PID:4788
- C:\Windows\System\UdlzKFJ.exe
  C:\Windows\System\UdlzKFJ.exe
  2⤵
  PID:7352
- C:\Windows\System\qTDmTkJ.exe
  C:\Windows\System\qTDmTkJ.exe
  2⤵
  PID:7812
- C:\Windows\System\UkxWPnQ.exe
  C:\Windows\System\UkxWPnQ.exe
  2⤵
  PID:2864
- C:\Windows\System\aBwHcya.exe
  C:\Windows\System\aBwHcya.exe
  2⤵
  PID:3576
- C:\Windows\System\qQCUXFn.exe
  C:\Windows\System\qQCUXFn.exe
  2⤵
  PID:7220
- C:\Windows\System\SNcHPTb.exe
  C:\Windows\System\SNcHPTb.exe
  2⤵
  PID:7260
- C:\Windows\System\DZrjZnY.exe
  C:\Windows\System\DZrjZnY.exe
  2⤵
  PID:7304
- C:\Windows\System\xmXWVRO.exe
  C:\Windows\System\xmXWVRO.exe
  2⤵
  PID:7340
- C:\Windows\System\gzkbCYp.exe
  C:\Windows\System\gzkbCYp.exe
  2⤵
  PID:7376
- C:\Windows\System\wMbQxKc.exe
  C:\Windows\System\wMbQxKc.exe
  2⤵
  PID:7420
- C:\Windows\System\HdoxIDr.exe
  C:\Windows\System\HdoxIDr.exe
  2⤵
  PID:7460
- C:\Windows\System\TMXnTVj.exe
  C:\Windows\System\TMXnTVj.exe
  2⤵
  PID:7492
- C:\Windows\System\dOzFrRB.exe
  C:\Windows\System\dOzFrRB.exe
  2⤵
  PID:4076
- C:\Windows\System\pNNJquI.exe
  C:\Windows\System\pNNJquI.exe
  2⤵
  PID:5992
- C:\Windows\System\dMjejTR.exe
  C:\Windows\System\dMjejTR.exe
  2⤵
  PID:7564
- C:\Windows\System\BicJlES.exe
  C:\Windows\System\BicJlES.exe
  2⤵
  PID:7600
- C:\Windows\System\LLnmlvc.exe
  C:\Windows\System\LLnmlvc.exe
  2⤵
  PID:7636
- C:\Windows\System\rgRMnUO.exe
  C:\Windows\System\rgRMnUO.exe
  2⤵
  PID:7680
- C:\Windows\System\jDRbXPA.exe
  C:\Windows\System\jDRbXPA.exe
  2⤵
  PID:7696
- C:\Windows\System\FsGrhkQ.exe
  C:\Windows\System\FsGrhkQ.exe
  2⤵
  PID:7756
- C:\Windows\System\LSNtcDE.exe
  C:\Windows\System\LSNtcDE.exe
  2⤵
  PID:7792
- C:\Windows\System\bAAdtht.exe
  C:\Windows\System\bAAdtht.exe
  2⤵
  PID:7836
- C:\Windows\System\CmceGly.exe
  C:\Windows\System\CmceGly.exe
  2⤵
  PID:7880
- C:\Windows\System\UkzVjkC.exe
  C:\Windows\System\UkzVjkC.exe
  2⤵
  PID:7912
- C:\Windows\System\ozXyJBx.exe
  C:\Windows\System\ozXyJBx.exe
  2⤵
  PID:8012
- C:\Windows\System\AXlCPdd.exe
  C:\Windows\System\AXlCPdd.exe
  2⤵
  PID:8036
- C:\Windows\System\UrMykFV.exe
  C:\Windows\System\UrMykFV.exe
  2⤵
  PID:8076
- C:\Windows\System\zspLxSc.exe
  C:\Windows\System\zspLxSc.exe
  2⤵
  PID:8136
- C:\Windows\System\wIfIlWd.exe
  C:\Windows\System\wIfIlWd.exe
  2⤵
  PID:8172
- C:\Windows\System\KgpUeAs.exe
  C:\Windows\System\KgpUeAs.exe
  2⤵
  PID:5420
- C:\Windows\System\WWFIEwO.exe
  C:\Windows\System\WWFIEwO.exe
  2⤵
  PID:2492
- C:\Windows\System\xlyfBcz.exe
  C:\Windows\System\xlyfBcz.exe
  2⤵
  PID:8208
- C:\Windows\System\yBnWsoe.exe
  C:\Windows\System\yBnWsoe.exe
  2⤵
  PID:8236
- C:\Windows\System\qYEUCfi.exe
  C:\Windows\System\qYEUCfi.exe
  2⤵
  PID:8268
- C:\Windows\System\RMEuUst.exe
  C:\Windows\System\RMEuUst.exe
  2⤵
  PID:8288
- C:\Windows\System\wALdkVk.exe
  C:\Windows\System\wALdkVk.exe
  2⤵
  PID:8312
- C:\Windows\System\KvMuKhf.exe
  C:\Windows\System\KvMuKhf.exe
  2⤵
  PID:8340
- C:\Windows\System\NFIuKQb.exe
  C:\Windows\System\NFIuKQb.exe
  2⤵
  PID:8360
- C:\Windows\System\tjNaRvX.exe
  C:\Windows\System\tjNaRvX.exe
  2⤵
  PID:8384
- C:\Windows\System\VBwlXwJ.exe
  C:\Windows\System\VBwlXwJ.exe
  2⤵
  PID:8408
- C:\Windows\System\JhEhllj.exe
  C:\Windows\System\JhEhllj.exe
  2⤵
  PID:8432
- C:\Windows\System\JctYztK.exe
  C:\Windows\System\JctYztK.exe
  2⤵
  PID:8452
- C:\Windows\System\McMkjxG.exe
  C:\Windows\System\McMkjxG.exe
  2⤵
  PID:8480
- C:\Windows\System\XdiSaWu.exe
  C:\Windows\System\XdiSaWu.exe
  2⤵
  PID:8500
- C:\Windows\System\GcImCCM.exe
  C:\Windows\System\GcImCCM.exe
  2⤵
  PID:8520
- C:\Windows\System\XsASViI.exe
  C:\Windows\System\XsASViI.exe
  2⤵
  PID:8548
- C:\Windows\System\wYtSdjO.exe
  C:\Windows\System\wYtSdjO.exe
  2⤵
  PID:8572
- C:\Windows\System\HxxuVuq.exe
  C:\Windows\System\HxxuVuq.exe
  2⤵
  PID:8600
- C:\Windows\System\LVIhAhp.exe
  C:\Windows\System\LVIhAhp.exe
  2⤵
  PID:8632
- C:\Windows\System\wgtWcbt.exe
  C:\Windows\System\wgtWcbt.exe
  2⤵
  PID:8660
- C:\Windows\System\khtlefP.exe
  C:\Windows\System\khtlefP.exe
  2⤵
  PID:8684
- C:\Windows\System\EBDUQFD.exe
  C:\Windows\System\EBDUQFD.exe
  2⤵
  PID:8708
- C:\Windows\System\tAkCcrd.exe
  C:\Windows\System\tAkCcrd.exe
  2⤵
  PID:8736
- C:\Windows\System\YeQhNxI.exe
  C:\Windows\System\YeQhNxI.exe
  2⤵
  PID:8768
- C:\Windows\System\fzhcDDU.exe
  C:\Windows\System\fzhcDDU.exe
  2⤵
  PID:8792
- C:\Windows\System\mbANGxD.exe
  C:\Windows\System\mbANGxD.exe
  2⤵
  PID:8808
- C:\Windows\System\MxWHZTH.exe
  C:\Windows\System\MxWHZTH.exe
  2⤵
  PID:8836
- C:\Windows\System\aduYVrK.exe
  C:\Windows\System\aduYVrK.exe
  2⤵
  PID:8856
- C:\Windows\System\EhRBIEt.exe
  C:\Windows\System\EhRBIEt.exe
  2⤵
  PID:8880
- C:\Windows\System\gEpGDiV.exe
  C:\Windows\System\gEpGDiV.exe
  2⤵
  PID:8904
- C:\Windows\System\qsbUnbg.exe
  C:\Windows\System\qsbUnbg.exe
  2⤵
  PID:8928
- C:\Windows\System\QeVVZkt.exe
  C:\Windows\System\QeVVZkt.exe
  2⤵
  PID:8952
- C:\Windows\System\NLkKMoM.exe
  C:\Windows\System\NLkKMoM.exe
  2⤵
  PID:8976
- C:\Windows\System\rputHwS.exe
  C:\Windows\System\rputHwS.exe
  2⤵
  PID:9004
- C:\Windows\System\xSLaIRv.exe
  C:\Windows\System\xSLaIRv.exe
  2⤵
  PID:9028
- C:\Windows\System\ZocWfHO.exe
  C:\Windows\System\ZocWfHO.exe
  2⤵
  PID:9048
- C:\Windows\System\UAFlHqZ.exe
  C:\Windows\System\UAFlHqZ.exe
  2⤵
  PID:9080
- C:\Windows\System\LVxnhfE.exe
  C:\Windows\System\LVxnhfE.exe
  2⤵
  PID:9112
- C:\Windows\System\UNYveyO.exe
  C:\Windows\System\UNYveyO.exe
  2⤵
  PID:9144
- C:\Windows\System\piTPAXl.exe
  C:\Windows\System\piTPAXl.exe
  2⤵
  PID:9172
- C:\Windows\System\EMhlqxh.exe
  C:\Windows\System\EMhlqxh.exe
  2⤵
  PID:9192
- C:\Windows\System\cIJSixL.exe
  C:\Windows\System\cIJSixL.exe
  2⤵
  PID:10032
- C:\Windows\System\BsgmHum.exe
  C:\Windows\System\BsgmHum.exe
  2⤵
  PID:10052
- C:\Windows\System\FPnNVkk.exe
  C:\Windows\System\FPnNVkk.exe
  2⤵
  PID:10072
- C:\Windows\System\hYuxoHm.exe
  C:\Windows\System\hYuxoHm.exe
  2⤵
  PID:10088
- C:\Windows\System\QaiCJVD.exe
  C:\Windows\System\QaiCJVD.exe
  2⤵
  PID:10116
- C:\Windows\System\dEUrTgL.exe
  C:\Windows\System\dEUrTgL.exe
  2⤵
  PID:10132
- C:\Windows\System\SZbFsKk.exe
  C:\Windows\System\SZbFsKk.exe
  2⤵
  PID:10148
- C:\Windows\System\xjwVybM.exe
  C:\Windows\System\xjwVybM.exe
  2⤵
  PID:10172
- C:\Windows\System\AUJkgfz.exe
  C:\Windows\System\AUJkgfz.exe
  2⤵
  PID:10192
- C:\Windows\System\qNwGfLT.exe
  C:\Windows\System\qNwGfLT.exe
  2⤵
  PID:10232
- C:\Windows\System\xlydaBf.exe
  C:\Windows\System\xlydaBf.exe
  2⤵
  PID:2084
- C:\Windows\System\MsSttfv.exe
  C:\Windows\System\MsSttfv.exe
  2⤵
  PID:3344
- C:\Windows\System\yQpXWHU.exe
  C:\Windows\System\yQpXWHU.exe
  2⤵
  PID:6372
- C:\Windows\System\rWewOlS.exe
  C:\Windows\System\rWewOlS.exe
  2⤵
  PID:6556
- C:\Windows\System\QeMrpBY.exe
  C:\Windows\System\QeMrpBY.exe
  2⤵
  PID:6988
- C:\Windows\System\SvyHfAD.exe
  C:\Windows\System\SvyHfAD.exe
  2⤵
  PID:7464
- C:\Windows\System\uVIBzTQ.exe
  C:\Windows\System\uVIBzTQ.exe
  2⤵
  PID:7280
- C:\Windows\System\QKQQtAq.exe
  C:\Windows\System\QKQQtAq.exe
  2⤵
  PID:7480
- C:\Windows\System\pMyEoyZ.exe
  C:\Windows\System\pMyEoyZ.exe
  2⤵
  PID:7580
- C:\Windows\System\yzyskxm.exe
  C:\Windows\System\yzyskxm.exe
  2⤵
  PID:7736
- C:\Windows\System\bRoIPLR.exe
  C:\Windows\System\bRoIPLR.exe
  2⤵
  PID:2972
- C:\Windows\System\cOECFfU.exe
  C:\Windows\System\cOECFfU.exe
  2⤵
  PID:8644
- C:\Windows\System\CTCaIud.exe
  C:\Windows\System\CTCaIud.exe
  2⤵
  PID:8716
- C:\Windows\System\lzBcuEF.exe
  C:\Windows\System\lzBcuEF.exe
  2⤵
  PID:8844
- C:\Windows\System\iCblCJk.exe
  C:\Windows\System\iCblCJk.exe
  2⤵
  PID:8936
- C:\Windows\System\CqGSGWO.exe
  C:\Windows\System\CqGSGWO.exe
  2⤵
  PID:9100
- C:\Windows\System\BQbXfVl.exe
  C:\Windows\System\BQbXfVl.exe
  2⤵
  PID:9284
- C:\Windows\System\hCksgmk.exe
  C:\Windows\System\hCksgmk.exe
  2⤵
  PID:9504
- C:\Windows\System\TaxnQlo.exe
  C:\Windows\System\TaxnQlo.exe
  2⤵
  PID:10252
- C:\Windows\System\qNCTorT.exe
  C:\Windows\System\qNCTorT.exe
  2⤵
  PID:10272
- C:\Windows\System\RzRgXiP.exe
  C:\Windows\System\RzRgXiP.exe
  2⤵
  PID:10292
- C:\Windows\System\qpyUIJs.exe
  C:\Windows\System\qpyUIJs.exe
  2⤵
  PID:10312
- C:\Windows\System\jAiklnF.exe
  C:\Windows\System\jAiklnF.exe
  2⤵
  PID:10328
- C:\Windows\System\HNLsTnc.exe
  C:\Windows\System\HNLsTnc.exe
  2⤵
  PID:10348
- C:\Windows\System\orlpGkC.exe
  C:\Windows\System\orlpGkC.exe
  2⤵
  PID:10368
- C:\Windows\System\jXxtyJF.exe
  C:\Windows\System\jXxtyJF.exe
  2⤵
  PID:10384
- C:\Windows\System\IzQUBru.exe
  C:\Windows\System\IzQUBru.exe
  2⤵
  PID:10404
- C:\Windows\System\yoXTDbZ.exe
  C:\Windows\System\yoXTDbZ.exe
  2⤵
  PID:10420
- C:\Windows\System\ATAxZmo.exe
  C:\Windows\System\ATAxZmo.exe
  2⤵
  PID:10440
- C:\Windows\System\SlXybQj.exe
  C:\Windows\System\SlXybQj.exe
  2⤵
  PID:10460
- C:\Windows\System\PUmKOOB.exe
  C:\Windows\System\PUmKOOB.exe
  2⤵
  PID:10476
- C:\Windows\System\RjmWNrF.exe
  C:\Windows\System\RjmWNrF.exe
  2⤵
  PID:10496
- C:\Windows\System\VYnlInF.exe
  C:\Windows\System\VYnlInF.exe
  2⤵
  PID:10512
- C:\Windows\System\INoCUuN.exe
  C:\Windows\System\INoCUuN.exe
  2⤵
  PID:10532
- C:\Windows\System\jOnpADZ.exe
  C:\Windows\System\jOnpADZ.exe
  2⤵
  PID:10556
- C:\Windows\System\HVQWwuU.exe
  C:\Windows\System\HVQWwuU.exe
  2⤵
  PID:10576
- C:\Windows\System\zlAUEnc.exe
  C:\Windows\System\zlAUEnc.exe
  2⤵
  PID:10612
- C:\Windows\System\rcHUpiS.exe
  C:\Windows\System\rcHUpiS.exe
  2⤵
  PID:10632
- C:\Windows\System\LergiKP.exe
  C:\Windows\System\LergiKP.exe
  2⤵
  PID:10656
- C:\Windows\System\tHyIuSM.exe
  C:\Windows\System\tHyIuSM.exe
  2⤵
  PID:10744
- C:\Windows\System\MRbyMOI.exe
  C:\Windows\System\MRbyMOI.exe
  2⤵
  PID:10760
- C:\Windows\System\zNbYDcD.exe
  C:\Windows\System\zNbYDcD.exe
  2⤵
  PID:10776
- C:\Windows\System\gLzHWwu.exe
  C:\Windows\System\gLzHWwu.exe
  2⤵
  PID:10792
- C:\Windows\System\VEyRHTp.exe
  C:\Windows\System\VEyRHTp.exe
  2⤵
  PID:10808
- C:\Windows\System\MINnsie.exe
  C:\Windows\System\MINnsie.exe
  2⤵
  PID:10828
- C:\Windows\System\SQFPxWJ.exe
  C:\Windows\System\SQFPxWJ.exe
  2⤵
  PID:10844
- C:\Windows\System\VSyQihk.exe
  C:\Windows\System\VSyQihk.exe
  2⤵
  PID:10860
- C:\Windows\System\XIHLeOJ.exe
  C:\Windows\System\XIHLeOJ.exe
  2⤵
  PID:10876
- C:\Windows\System\PyhwUMw.exe
  C:\Windows\System\PyhwUMw.exe
  2⤵
  PID:10900
- C:\Windows\System\nInSoDj.exe
  C:\Windows\System\nInSoDj.exe
  2⤵
  PID:10920
- C:\Windows\System\JjfHFxG.exe
  C:\Windows\System\JjfHFxG.exe
  2⤵
  PID:10936
- C:\Windows\System\dDxEzhv.exe
  C:\Windows\System\dDxEzhv.exe
  2⤵
  PID:10952
- C:\Windows\System\AYtKozk.exe
  C:\Windows\System\AYtKozk.exe
  2⤵
  PID:11020
- C:\Windows\System\dRBOCnh.exe
  C:\Windows\System\dRBOCnh.exe
  2⤵
  PID:11036
- C:\Windows\System\aZtnQAJ.exe
  C:\Windows\System\aZtnQAJ.exe
  2⤵
  PID:11064
- C:\Windows\System\fDCgqAa.exe
  C:\Windows\System\fDCgqAa.exe
  2⤵
  PID:11084
- C:\Windows\System\lbyeKIB.exe
  C:\Windows\System\lbyeKIB.exe
  2⤵
  PID:11104
- C:\Windows\System\mYfHxlL.exe
  C:\Windows\System\mYfHxlL.exe
  2⤵
  PID:11128
- C:\Windows\System\FCrbaOv.exe
  C:\Windows\System\FCrbaOv.exe
  2⤵
  PID:11148
- C:\Windows\System\ZyVaxgD.exe
  C:\Windows\System\ZyVaxgD.exe
  2⤵
  PID:11168
- C:\Windows\System\IHCnlHA.exe
  C:\Windows\System\IHCnlHA.exe
  2⤵
  PID:11188
- C:\Windows\System\GxmKPbn.exe
  C:\Windows\System\GxmKPbn.exe
  2⤵
  PID:11208
- C:\Windows\System\FTeJDUm.exe
  C:\Windows\System\FTeJDUm.exe
  2⤵
  PID:11232
- C:\Windows\System\zVrqTLw.exe
  C:\Windows\System\zVrqTLw.exe
  2⤵
  PID:11252
- C:\Windows\System\JTOTmVF.exe
  C:\Windows\System\JTOTmVF.exe
  2⤵
  PID:9456
- C:\Windows\System\QaPITpU.exe
  C:\Windows\System\QaPITpU.exe
  2⤵
  PID:10592
- C:\Windows\System\UexOirn.exe
  C:\Windows\System\UexOirn.exe
  2⤵
  PID:9604
- C:\Windows\System\hTyUlma.exe
  C:\Windows\System\hTyUlma.exe
  2⤵
  PID:4984
- C:\Windows\System\BvcAHxq.exe
  C:\Windows\System\BvcAHxq.exe
  2⤵
  PID:6176
- C:\Windows\System\HyzTqjR.exe
  C:\Windows\System\HyzTqjR.exe
  2⤵
  PID:6412
- C:\Windows\System\TjVrUkX.exe
  C:\Windows\System\TjVrUkX.exe
  2⤵
  PID:4744
- C:\Windows\System\JkWNcno.exe
  C:\Windows\System\JkWNcno.exe
  2⤵
  PID:6968
- C:\Windows\System\scWuZew.exe
  C:\Windows\System\scWuZew.exe
  2⤵
  PID:7292
- C:\Windows\System\aPcnliQ.exe
  C:\Windows\System\aPcnliQ.exe
  2⤵
  PID:384
- C:\Windows\System\TQRgkVu.exe
  C:\Windows\System\TQRgkVu.exe
  2⤵
  PID:5184
- C:\Windows\System\yEAhhaY.exe
  C:\Windows\System\yEAhhaY.exe
  2⤵
  PID:544
- C:\Windows\System\nkiklHy.exe
  C:\Windows\System\nkiklHy.exe
  2⤵
  PID:7172
- C:\Windows\System\QmPcasw.exe
  C:\Windows\System\QmPcasw.exe
  2⤵
  PID:7276
- C:\Windows\System\VAPtknT.exe
  C:\Windows\System\VAPtknT.exe
  2⤵
  PID:7412
- C:\Windows\System\iyuRrcC.exe
  C:\Windows\System\iyuRrcC.exe
  2⤵
  PID:7584
- C:\Windows\System\efmwUtO.exe
  C:\Windows\System\efmwUtO.exe
  2⤵
  PID:7740
- C:\Windows\System\LkBnyDh.exe
  C:\Windows\System\LkBnyDh.exe
  2⤵
  PID:7996
- C:\Windows\System\DtsHTUH.exe
  C:\Windows\System\DtsHTUH.exe
  2⤵
  PID:5404
- C:\Windows\System\cbDYDsI.exe
  C:\Windows\System\cbDYDsI.exe
  2⤵
  PID:8244
- C:\Windows\System\HPvRODn.exe
  C:\Windows\System\HPvRODn.exe
  2⤵
  PID:8296
- C:\Windows\System\oJBkITk.exe
  C:\Windows\System\oJBkITk.exe
  2⤵
  PID:8376
- C:\Windows\System\EIVEnQv.exe
  C:\Windows\System\EIVEnQv.exe
  2⤵
  PID:8424
- C:\Windows\System\tXgOcxA.exe
  C:\Windows\System\tXgOcxA.exe
  2⤵
  PID:8492
- C:\Windows\System\dugXWSo.exe
  C:\Windows\System\dugXWSo.exe
  2⤵
  PID:8568
- C:\Windows\System\RKWsNIH.exe
  C:\Windows\System\RKWsNIH.exe
  2⤵
  PID:8620
- C:\Windows\System\xKzhAjd.exe
  C:\Windows\System\xKzhAjd.exe
  2⤵
  PID:8680
- C:\Windows\System\hwdpMHQ.exe
  C:\Windows\System\hwdpMHQ.exe
  2⤵
  PID:8744
- C:\Windows\System\CsKwPHs.exe
  C:\Windows\System\CsKwPHs.exe
  2⤵
  PID:8804
- C:\Windows\System\ybCZUGo.exe
  C:\Windows\System\ybCZUGo.exe
  2⤵
  PID:8876
- C:\Windows\System\CHSIEIQ.exe
  C:\Windows\System\CHSIEIQ.exe
  2⤵
  PID:8940
- C:\Windows\System\EgaLUJI.exe
  C:\Windows\System\EgaLUJI.exe
  2⤵
  PID:8992
- C:\Windows\System\hnCqwyf.exe
  C:\Windows\System\hnCqwyf.exe
  2⤵
  PID:9068
- C:\Windows\System\HJjfWvU.exe
  C:\Windows\System\HJjfWvU.exe
  2⤵
  PID:9132
- C:\Windows\System\MkkasUq.exe
  C:\Windows\System\MkkasUq.exe
  2⤵
  PID:9184
- C:\Windows\System\PFAmRgN.exe
  C:\Windows\System\PFAmRgN.exe
  2⤵
  PID:9240
- C:\Windows\System\OvyjWcY.exe
  C:\Windows\System\OvyjWcY.exe
  2⤵
  PID:9324
- C:\Windows\System\gSejJxf.exe
  C:\Windows\System\gSejJxf.exe
  2⤵
  PID:9372
- C:\Windows\System\LStIYmd.exe
  C:\Windows\System\LStIYmd.exe
  2⤵
  PID:9412
- C:\Windows\System\WkXpDRZ.exe
  C:\Windows\System\WkXpDRZ.exe
  2⤵
  PID:9452
- C:\Windows\System\BtPVPDX.exe
  C:\Windows\System\BtPVPDX.exe
  2⤵
  PID:9544
- C:\Windows\System\wxBrqHh.exe
  C:\Windows\System\wxBrqHh.exe
  2⤵
  PID:11272
- C:\Windows\System\xRDjMyO.exe
  C:\Windows\System\xRDjMyO.exe
  2⤵
  PID:11296
- C:\Windows\System\vBIjLNE.exe
  C:\Windows\System\vBIjLNE.exe
  2⤵
  PID:11312
- C:\Windows\System\Cvvlqvz.exe
  C:\Windows\System\Cvvlqvz.exe
  2⤵
  PID:11328
- C:\Windows\System\rgncggO.exe
  C:\Windows\System\rgncggO.exe
  2⤵
  PID:11344
- C:\Windows\System\BUhFzZP.exe
  C:\Windows\System\BUhFzZP.exe
  2⤵
  PID:11364
- C:\Windows\System\eYEEGKC.exe
  C:\Windows\System\eYEEGKC.exe
  2⤵
  PID:11388
- C:\Windows\System\okdftEo.exe
  C:\Windows\System\okdftEo.exe
  2⤵
  PID:11408
- C:\Windows\System\BUZzKLr.exe
  C:\Windows\System\BUZzKLr.exe
  2⤵
  PID:11428
- C:\Windows\System\zbotnen.exe
  C:\Windows\System\zbotnen.exe
  2⤵
  PID:11444
- C:\Windows\System\EJeSYzx.exe
  C:\Windows\System\EJeSYzx.exe
  2⤵
  PID:11464
- C:\Windows\System\ThgsubB.exe
  C:\Windows\System\ThgsubB.exe
  2⤵
  PID:11484
- C:\Windows\System\zwWWMRR.exe
  C:\Windows\System\zwWWMRR.exe
  2⤵
  PID:11504
- C:\Windows\System\jrqmOUa.exe
  C:\Windows\System\jrqmOUa.exe
  2⤵
  PID:11520
- C:\Windows\System\OgOKsji.exe
  C:\Windows\System\OgOKsji.exe
  2⤵
  PID:11536
- C:\Windows\System\QyZFEyH.exe
  C:\Windows\System\QyZFEyH.exe
  2⤵
  PID:11552
- C:\Windows\System\tPHeSJZ.exe
  C:\Windows\System\tPHeSJZ.exe
  2⤵
  PID:11568
- C:\Windows\System\ixJUSvO.exe
  C:\Windows\System\ixJUSvO.exe
  2⤵
  PID:11584
- C:\Windows\System\rgZSOzF.exe
  C:\Windows\System\rgZSOzF.exe
  2⤵
  PID:11600
- C:\Windows\System\yTSlFrr.exe
  C:\Windows\System\yTSlFrr.exe
  2⤵
  PID:11616
- C:\Windows\System\gcinMLK.exe
  C:\Windows\System\gcinMLK.exe
  2⤵
  PID:11632
- C:\Windows\System\SmXTAjb.exe
  C:\Windows\System\SmXTAjb.exe
  2⤵
  PID:11648
- C:\Windows\System\EbMgyAh.exe
  C:\Windows\System\EbMgyAh.exe
  2⤵
  PID:11664
- C:\Windows\System\cRiiyzh.exe
  C:\Windows\System\cRiiyzh.exe
  2⤵
  PID:11680
- C:\Windows\System\itPMWBi.exe
  C:\Windows\System\itPMWBi.exe
  2⤵
  PID:11696
- C:\Windows\System\LKHwBCS.exe
  C:\Windows\System\LKHwBCS.exe
  2⤵
  PID:11744
- C:\Windows\System\iIqdohE.exe
  C:\Windows\System\iIqdohE.exe
  2⤵
  PID:11768
- C:\Windows\System\qNnwEtv.exe
  C:\Windows\System\qNnwEtv.exe
  2⤵
  PID:11792
- C:\Windows\System\IoRqPGe.exe
  C:\Windows\System\IoRqPGe.exe
  2⤵
  PID:11812
- C:\Windows\System\ewRpFHP.exe
  C:\Windows\System\ewRpFHP.exe
  2⤵
  PID:11840
- C:\Windows\System\bvGxeud.exe
  C:\Windows\System\bvGxeud.exe
  2⤵
  PID:11856
- C:\Windows\System\jFeqLYI.exe
  C:\Windows\System\jFeqLYI.exe
  2⤵
  PID:11876
- C:\Windows\System\ZXmYHyM.exe
  C:\Windows\System\ZXmYHyM.exe
  2⤵
  PID:11920
- C:\Windows\System\cgsbPWa.exe
  C:\Windows\System\cgsbPWa.exe
  2⤵
  PID:11936
- C:\Windows\System\TiMGGEG.exe
  C:\Windows\System\TiMGGEG.exe
  2⤵
  PID:11956
- C:\Windows\System\VfXNEpa.exe
  C:\Windows\System\VfXNEpa.exe
  2⤵
  PID:11972
- C:\Windows\System\MXGuJUz.exe
  C:\Windows\System\MXGuJUz.exe
  2⤵
  PID:11996
- C:\Windows\System\neyqinn.exe
  C:\Windows\System\neyqinn.exe
  2⤵
  PID:12012
- C:\Windows\System\zfEwKXV.exe
  C:\Windows\System\zfEwKXV.exe
  2⤵
  PID:12032
- C:\Windows\System\qLchdMp.exe
  C:\Windows\System\qLchdMp.exe
  2⤵
  PID:12060
- C:\Windows\System\sutTchI.exe
  C:\Windows\System\sutTchI.exe
  2⤵
  PID:12180
- C:\Windows\System\cuSfobe.exe
  C:\Windows\System\cuSfobe.exe
  2⤵
  PID:12196
- C:\Windows\System\dpnWaan.exe
  C:\Windows\System\dpnWaan.exe
  2⤵
  PID:12224
- C:\Windows\System\loXNIla.exe
  C:\Windows\System\loXNIla.exe
  2⤵
  PID:12240
- C:\Windows\System\aXVkACo.exe
  C:\Windows\System\aXVkACo.exe
  2⤵
  PID:12264
- C:\Windows\System\wLbhZfO.exe
  C:\Windows\System\wLbhZfO.exe
  2⤵
  PID:12284
- C:\Windows\System\UbznrII.exe
  C:\Windows\System\UbznrII.exe
  2⤵
  PID:10872
- C:\Windows\System\FGfKeNP.exe
  C:\Windows\System\FGfKeNP.exe
  2⤵
  PID:10928
- C:\Windows\System\pSGzRqm.exe
  C:\Windows\System\pSGzRqm.exe
  2⤵
  PID:4328
- C:\Windows\System\rXcWVQd.exe
  C:\Windows\System\rXcWVQd.exe
  2⤵
  PID:10044
- C:\Windows\System\XsHXfNB.exe
  C:\Windows\System\XsHXfNB.exe
  2⤵
  PID:10100
- C:\Windows\System\hwppEIv.exe
  C:\Windows\System\hwppEIv.exe
  2⤵
  PID:10160
- C:\Windows\System\aQXErwd.exe
  C:\Windows\System\aQXErwd.exe
  2⤵
  PID:10228
- C:\Windows\System\MefOaQq.exe
  C:\Windows\System\MefOaQq.exe
  2⤵
  PID:4588
- C:\Windows\System\PXnguwr.exe
  C:\Windows\System\PXnguwr.exe
  2⤵
  PID:6208
- C:\Windows\System\crUftvu.exe
  C:\Windows\System\crUftvu.exe
  2⤵
  PID:6636
- C:\Windows\System\YpllRPZ.exe
  C:\Windows\System\YpllRPZ.exe
  2⤵
  PID:3692
- C:\Windows\System\NdqCeln.exe
  C:\Windows\System\NdqCeln.exe
  2⤵
  PID:4696
- C:\Windows\System\tuMwWUX.exe
  C:\Windows\System\tuMwWUX.exe
  2⤵
  PID:8668
- C:\Windows\System\WOlcOvb.exe
  C:\Windows\System\WOlcOvb.exe
  2⤵
  PID:8912
- C:\Windows\System\RnvGIAE.exe
  C:\Windows\System\RnvGIAE.exe
  2⤵
  PID:9160
- C:\Windows\System\OOEmdQh.exe
  C:\Windows\System\OOEmdQh.exe
  2⤵
  PID:9536
- C:\Windows\System\IiqRCgK.exe
  C:\Windows\System\IiqRCgK.exe
  2⤵
  PID:10288
- C:\Windows\System\tSDFfhs.exe
  C:\Windows\System\tSDFfhs.exe
  2⤵
  PID:10320
- C:\Windows\System\sWOoufm.exe
  C:\Windows\System\sWOoufm.exe
  2⤵
  PID:10360
- C:\Windows\System\OFISFLC.exe
  C:\Windows\System\OFISFLC.exe
  2⤵
  PID:10392
- C:\Windows\System\LBGOZKJ.exe
  C:\Windows\System\LBGOZKJ.exe
  2⤵
  PID:10432
- C:\Windows\System\UxLdmJX.exe
  C:\Windows\System\UxLdmJX.exe
  2⤵
  PID:10472
- C:\Windows\System\xfHNjOv.exe
  C:\Windows\System\xfHNjOv.exe
  2⤵
  PID:10504
- C:\Windows\System\ZqBObuo.exe
  C:\Windows\System\ZqBObuo.exe
  2⤵
  PID:10548
- C:\Windows\System\RrfUVLH.exe
  C:\Windows\System\RrfUVLH.exe
  2⤵
  PID:5216
- C:\Windows\System\fCFCcBx.exe
  C:\Windows\System\fCFCcBx.exe
  2⤵
  PID:8612
- C:\Windows\System\BYXSMFo.exe
  C:\Windows\System\BYXSMFo.exe
  2⤵
  PID:9152
- C:\Windows\System\CyafnEM.exe
  C:\Windows\System\CyafnEM.exe
  2⤵
  PID:9396
- C:\Windows\System\rnnFdGB.exe
  C:\Windows\System\rnnFdGB.exe
  2⤵
  PID:12304
- C:\Windows\System\joVWPHj.exe
  C:\Windows\System\joVWPHj.exe
  2⤵
  PID:12320
- C:\Windows\System\FxlNsEV.exe
  C:\Windows\System\FxlNsEV.exe
  2⤵
  PID:12336
- C:\Windows\System\yFCxBbM.exe
  C:\Windows\System\yFCxBbM.exe
  2⤵
  PID:12352
- C:\Windows\System\xjnGBFq.exe
  C:\Windows\System\xjnGBFq.exe
  2⤵
  PID:12368
- C:\Windows\System\daUMOSI.exe
  C:\Windows\System\daUMOSI.exe
  2⤵
  PID:12384
- C:\Windows\System\KqDaMjd.exe
  C:\Windows\System\KqDaMjd.exe
  2⤵
  PID:12400
- C:\Windows\System\VlZnsIp.exe
  C:\Windows\System\VlZnsIp.exe
  2⤵
  PID:12424
- C:\Windows\System\MvUcNUk.exe
  C:\Windows\System\MvUcNUk.exe
  2⤵
  PID:12444
- C:\Windows\System\BmsbfYa.exe
  C:\Windows\System\BmsbfYa.exe
  2⤵
  PID:12472
- C:\Windows\System\eOUPKvE.exe
  C:\Windows\System\eOUPKvE.exe
  2⤵
  PID:12492
- C:\Windows\System\wJfNkEm.exe
  C:\Windows\System\wJfNkEm.exe
  2⤵
  PID:12508
- C:\Windows\System\FLGqnEy.exe
  C:\Windows\System\FLGqnEy.exe
  2⤵
  PID:12532
- C:\Windows\System\WrOGwrX.exe
  C:\Windows\System\WrOGwrX.exe
  2⤵
  PID:12548
- C:\Windows\System\fTHJRDu.exe
  C:\Windows\System\fTHJRDu.exe
  2⤵
  PID:12572
- C:\Windows\System\qwaKySB.exe
  C:\Windows\System\qwaKySB.exe
  2⤵
  PID:12588
- C:\Windows\System\GFhjwqr.exe
  C:\Windows\System\GFhjwqr.exe
  2⤵
  PID:12612
- C:\Windows\System\JiPLwpM.exe
  C:\Windows\System\JiPLwpM.exe
  2⤵
  PID:12632
- C:\Windows\System\pTwgUGi.exe
  C:\Windows\System\pTwgUGi.exe
  2⤵
  PID:12652
- C:\Windows\System\USlREcm.exe
  C:\Windows\System\USlREcm.exe
  2⤵
  PID:12676
- C:\Windows\System\AZAegOk.exe
  C:\Windows\System\AZAegOk.exe
  2⤵
  PID:10980
- C:\Windows\System\hRBXQSE.exe
  C:\Windows\System\hRBXQSE.exe
  2⤵
  PID:1636
- C:\Windows\System\yOLgVgD.exe
  C:\Windows\System\yOLgVgD.exe
  2⤵
  PID:11044
- C:\Windows\System\LBcIPXA.exe
  C:\Windows\System\LBcIPXA.exe
  2⤵
  PID:11100
- C:\Windows\System\zQiXrDX.exe
  C:\Windows\System\zQiXrDX.exe
  2⤵
  PID:11164
- C:\Windows\System\tETdfaH.exe
  C:\Windows\System\tETdfaH.exe
  2⤵
  PID:11204
- C:\Windows\System\mKjRNci.exe
  C:\Windows\System\mKjRNci.exe
  2⤵
  PID:11244
- C:\Windows\System\OmfjXel.exe
  C:\Windows\System\OmfjXel.exe
  2⤵
  PID:9512
- C:\Windows\System\lLAWvUb.exe
  C:\Windows\System\lLAWvUb.exe
  2⤵
  PID:9572
- C:\Windows\System\MEHmAbu.exe
  C:\Windows\System\MEHmAbu.exe
  2⤵
  PID:9612
- C:\Windows\System\NMEhArJ.exe
  C:\Windows\System\NMEhArJ.exe
  2⤵
  PID:6912
- C:\Windows\System\gBAWKMP.exe
  C:\Windows\System\gBAWKMP.exe
  2⤵
  PID:7336
- C:\Windows\System\xkWJoQn.exe
  C:\Windows\System\xkWJoQn.exe
  2⤵
  PID:8560
- C:\Windows\System\PwPTdaN.exe
  C:\Windows\System\PwPTdaN.exe
  2⤵
  PID:9120
- C:\Windows\System\MAuqOEy.exe
  C:\Windows\System\MAuqOEy.exe
  2⤵
  PID:9404
- C:\Windows\System\AjaPASS.exe
  C:\Windows\System\AjaPASS.exe
  2⤵
  PID:11320
- C:\Windows\System\MZbgNJj.exe
  C:\Windows\System\MZbgNJj.exe
  2⤵
  PID:12768
- C:\Windows\System\QbOBxVV.exe
  C:\Windows\System\QbOBxVV.exe
  2⤵
  PID:11400
- C:\Windows\System\JyofzyK.exe
  C:\Windows\System\JyofzyK.exe
  2⤵
  PID:11512
- C:\Windows\System\tlPRiXq.exe
  C:\Windows\System\tlPRiXq.exe
  2⤵
  PID:5088
- C:\Windows\System\zKAJJTz.exe
  C:\Windows\System\zKAJJTz.exe
  2⤵
  PID:12872
- C:\Windows\System\RywzICL.exe
  C:\Windows\System\RywzICL.exe
  2⤵
  PID:4780
- C:\Windows\System\XbQdmyo.exe
  C:\Windows\System\XbQdmyo.exe
  2⤵
  PID:11728
- C:\Windows\System\xojPEyC.exe
  C:\Windows\System\xojPEyC.exe
  2⤵
  PID:12960
- C:\Windows\System\XKyOCAQ.exe
  C:\Windows\System\XKyOCAQ.exe
  2⤵
  PID:13016
- C:\Windows\System\cGGYJgu.exe
  C:\Windows\System\cGGYJgu.exe
  2⤵
  PID:2152
- C:\Windows\System\FevnOWY.exe
  C:\Windows\System\FevnOWY.exe
  2⤵
  PID:3336
- C:\Windows\System\mXXWgVq.exe
  C:\Windows\System\mXXWgVq.exe
  2⤵
  PID:12780
- C:\Windows\System\TtNbNms.exe
  C:\Windows\System\TtNbNms.exe
  2⤵
  PID:12732
- C:\Windows\System\FyDQgnY.exe
  C:\Windows\System\FyDQgnY.exe
  2⤵
  PID:12704
- C:\Windows\System\HydTXBT.exe
  C:\Windows\System\HydTXBT.exe
  2⤵
  PID:12648
- C:\Windows\System\bLwJAYf.exe
  C:\Windows\System\bLwJAYf.exe
  2⤵
  PID:12608
- C:\Windows\System\mCWiYXa.exe
  C:\Windows\System\mCWiYXa.exe
  2⤵
  PID:12544
- C:\Windows\System\bvpkxzT.exe
  C:\Windows\System\bvpkxzT.exe
  2⤵
  PID:12488
- C:\Windows\System\UAhojcF.exe
  C:\Windows\System\UAhojcF.exe
  2⤵
  PID:12452
- C:\Windows\System\wbLomRt.exe
  C:\Windows\System\wbLomRt.exe
  2⤵
  PID:12412
- C:\Windows\System\dFXUKjW.exe
  C:\Windows\System\dFXUKjW.exe
  2⤵
  PID:12376
- C:\Windows\System\jpmumGt.exe
  C:\Windows\System\jpmumGt.exe
  2⤵
  PID:12332
- C:\Windows\System\pOSIKYj.exe
  C:\Windows\System\pOSIKYj.exe
  2⤵
  PID:12296
- C:\Windows\System\FsQhjrH.exe
  C:\Windows\System\FsQhjrH.exe
  2⤵
  PID:8420
- C:\Windows\System\ijYzXxT.exe
  C:\Windows\System\ijYzXxT.exe
  2⤵
  PID:1948
- C:\Windows\System\mFsSFhf.exe
  C:\Windows\System\mFsSFhf.exe
  2⤵
  PID:10080
- C:\Windows\System\WsLQukH.exe
  C:\Windows\System\WsLQukH.exe
  2⤵
  PID:12256
- C:\Windows\System\YZhyRqz.exe
  C:\Windows\System\YZhyRqz.exe
  2⤵
  PID:12044
- C:\Windows\System\YedbtWh.exe
  C:\Windows\System\YedbtWh.exe
  2⤵
  PID:11868
- C:\Windows\System\itGcJaV.exe
  C:\Windows\System\itGcJaV.exe
  2⤵
  PID:11740
- C:\Windows\System\aaOkvco.exe
  C:\Windows\System\aaOkvco.exe
  2⤵
  PID:13064
- C:\Windows\System\dsXdlvg.exe
  C:\Windows\System\dsXdlvg.exe
  2⤵
  PID:11304
- C:\Windows\System\NFVbCAd.exe
  C:\Windows\System\NFVbCAd.exe
  2⤵
  PID:13212
- C:\Windows\System\fZgBjEm.exe
  C:\Windows\System\fZgBjEm.exe
  2⤵
  PID:13256
- C:\Windows\System\EoxSKdU.exe
  C:\Windows\System\EoxSKdU.exe
  2⤵
  PID:9444
- C:\Windows\System\CkxlnTW.exe
  C:\Windows\System\CkxlnTW.exe
  2⤵
  PID:552
- C:\Windows\System\eEMxEbD.exe
  C:\Windows\System\eEMxEbD.exe
  2⤵
  PID:6648
- C:\Windows\System\nDweipg.exe
  C:\Windows\System\nDweipg.exe
  2⤵
  PID:232
- C:\Windows\System\mVZjIEw.exe
  C:\Windows\System\mVZjIEw.exe
  2⤵
  PID:12164
- C:\Windows\System\uEWOUAW.exe
  C:\Windows\System\uEWOUAW.exe
  2⤵
  PID:12868
- C:\Windows\System\dWTlIwI.exe
  C:\Windows\System\dWTlIwI.exe
  2⤵
  PID:12720
- C:\Windows\System\EqinWSF.exe
  C:\Windows\System\EqinWSF.exe
  2⤵
  PID:12348
- C:\Windows\System\hvXtbOd.exe
  C:\Windows\System\hvXtbOd.exe
  2⤵
  PID:12972
- C:\Windows\System\mSjdrSu.exe
  C:\Windows\System\mSjdrSu.exe
  2⤵
  PID:13112
- C:\Windows\System\sOetmwg.exe
  C:\Windows\System\sOetmwg.exe
  2⤵
  PID:13160
- C:\Windows\System\hZiLUiK.exe
  C:\Windows\System\hZiLUiK.exe
  2⤵
  PID:432
- C:\Windows\System\WBYUqJQ.exe
  C:\Windows\System\WBYUqJQ.exe
  2⤵
  PID:12312
- C:\Windows\System\UYrFUYG.exe
  C:\Windows\System\UYrFUYG.exe
  2⤵
  PID:9816
- C:\Windows\System\pPjDAUP.exe
  C:\Windows\System\pPjDAUP.exe
  2⤵
  PID:3684
- C:\Windows\System\AbHbRxs.exe
  C:\Windows\System\AbHbRxs.exe
  2⤵
  PID:11144
- C:\Windows\System\kSrUhyc.exe
  C:\Windows\System\kSrUhyc.exe
  2⤵
  PID:6952
- C:\Windows\System\nxvRQSn.exe
  C:\Windows\System\nxvRQSn.exe
  2⤵
  PID:11592
- C:\Windows\System\hvXrwch.exe
  C:\Windows\System\hvXrwch.exe
  2⤵
  PID:12944
- C:\Windows\System\VWFhuyf.exe
  C:\Windows\System\VWFhuyf.exe
  2⤵
  PID:5996
- C:\Windows\System\riPtyCe.exe
  C:\Windows\System\riPtyCe.exe
  2⤵
  PID:9492
- C:\Windows\System\GHFiIEF.exe
  C:\Windows\System\GHFiIEF.exe
  2⤵
  PID:12560
- C:\Windows\System\pmKJESG.exe
  C:\Windows\System\pmKJESG.exe
  2⤵
  PID:6708
- C:\Windows\System\NoPiUnW.exe
  C:\Windows\System\NoPiUnW.exe
  2⤵
  PID:6704
- C:\Windows\System\EhhcsTk.exe
  C:\Windows\System\EhhcsTk.exe
  2⤵
  PID:10896
- C:\Windows\System\MCpPRaU.exe
  C:\Windows\System\MCpPRaU.exe
  2⤵
  PID:13384
- C:\Windows\System\ZgColgr.exe
  C:\Windows\System\ZgColgr.exe
  2⤵
  PID:13496
- C:\Windows\System\zankiYA.exe
  C:\Windows\System\zankiYA.exe
  2⤵
  PID:13512
- C:\Windows\System\duYrUeR.exe
  C:\Windows\System\duYrUeR.exe
  2⤵
  PID:13544
- C:\Windows\System\qvCqcPv.exe
  C:\Windows\System\qvCqcPv.exe
  2⤵
  PID:13732
- C:\Windows\System\ZeYzfyD.exe
  C:\Windows\System\ZeYzfyD.exe
  2⤵
  PID:13784
- C:\Windows\System\UrcAxFN.exe
  C:\Windows\System\UrcAxFN.exe
  2⤵
  PID:13912
- C:\Windows\System\fivWXVk.exe
  C:\Windows\System\fivWXVk.exe
  2⤵
  PID:13980
- C:\Windows\System\vrKVGRp.exe
  C:\Windows\System\vrKVGRp.exe
  2⤵
  PID:14100
- C:\Windows\System\Cqxgaqm.exe
  C:\Windows\System\Cqxgaqm.exe
  2⤵
  PID:14300
- C:\Windows\System\tOijfYY.exe
  C:\Windows\System\tOijfYY.exe
  2⤵
  PID:2448
- C:\Windows\System\SAQZZua.exe
  C:\Windows\System\SAQZZua.exe
  2⤵
  PID:6108
- C:\Windows\System\QNazmjV.exe
  C:\Windows\System\QNazmjV.exe
  2⤵
  PID:12956
- C:\Windows\System\qARmXhq.exe
  C:\Windows\System\qARmXhq.exe
  2⤵
  PID:11820
- C:\Windows\System\DAISpbm.exe
  C:\Windows\System\DAISpbm.exe
  2⤵
  PID:4120
- C:\Windows\System\QPCnwAj.exe
  C:\Windows\System\QPCnwAj.exe
  2⤵
  PID:12392
- C:\Windows\System\mlHiZlm.exe
  C:\Windows\System\mlHiZlm.exe
  2⤵
  PID:13456
- C:\Windows\System\ThqdtkO.exe
  C:\Windows\System\ThqdtkO.exe
  2⤵
  PID:13428
- C:\Windows\System\MMlvKWo.exe
  C:\Windows\System\MMlvKWo.exe
  2⤵
  PID:2564
- C:\Windows\System\pvUahOE.exe
  C:\Windows\System\pvUahOE.exe
  2⤵
  PID:4704
- C:\Windows\System\nIPFQSr.exe
  C:\Windows\System\nIPFQSr.exe
  2⤵
  PID:10684
- C:\Windows\System\HgklGGM.exe
  C:\Windows\System\HgklGGM.exe
  2⤵
  PID:13672
- C:\Windows\System\tikFZHB.exe
  C:\Windows\System\tikFZHB.exe
  2⤵
  PID:13468
- C:\Windows\System\OMGnuiu.exe
  C:\Windows\System\OMGnuiu.exe
  2⤵
  PID:13528
- C:\Windows\System\xfaCkYc.exe
  C:\Windows\System\xfaCkYc.exe
  2⤵
  PID:13552
- C:\Windows\System\RkOSzBx.exe
  C:\Windows\System\RkOSzBx.exe
  2⤵
  PID:13664
- C:\Windows\System\WXlQirj.exe
  C:\Windows\System\WXlQirj.exe
  2⤵
  PID:13944
- C:\Windows\System\ibgtNoD.exe
  C:\Windows\System\ibgtNoD.exe
  2⤵
  PID:13996
- C:\Windows\System\ncGyERz.exe
  C:\Windows\System\ncGyERz.exe
  2⤵
  PID:13924
- C:\Windows\System\tgjqrLM.exe
  C:\Windows\System\tgjqrLM.exe
  2⤵
  PID:14216
- C:\Windows\System\NAeyjJa.exe
  C:\Windows\System\NAeyjJa.exe
  2⤵
  PID:10804
- C:\Windows\System\NPRuzNT.exe
  C:\Windows\System\NPRuzNT.exe
  2⤵
  PID:12628
- C:\Windows\System\AkUhgOI.exe
  C:\Windows\System\AkUhgOI.exe
  2⤵
  PID:12528
- C:\Windows\System\OIgUGTd.exe
  C:\Windows\System\OIgUGTd.exe
  2⤵
  PID:13316
- C:\Windows\System\vbkqyhM.exe
  C:\Windows\System\vbkqyhM.exe
  2⤵
  PID:13580
- C:\Windows\System\QLXepCw.exe
  C:\Windows\System\QLXepCw.exe
  2⤵
  PID:1464
- C:\Windows\System\CwvQSPM.exe
  C:\Windows\System\CwvQSPM.exe
  2⤵
  PID:13344
- C:\Windows\System\FtVINOb.exe
  C:\Windows\System\FtVINOb.exe
  2⤵
  PID:4264
- C:\Windows\System\MzvVReS.exe
  C:\Windows\System\MzvVReS.exe
  2⤵
  PID:13800
- C:\Windows\System\OoyzQLY.exe
  C:\Windows\System\OoyzQLY.exe
  2⤵
  PID:13592
- C:\Windows\System\UTAPhtj.exe
  C:\Windows\System\UTAPhtj.exe
  2⤵
  PID:13232
- C:\Windows\System\MYGwhZd.exe
  C:\Windows\System\MYGwhZd.exe
  2⤵
  PID:14096
- C:\Windows\System\GiClbgt.exe
  C:\Windows\System\GiClbgt.exe
  2⤵
  PID:12416
- C:\Windows\System\swgUCMr.exe
  C:\Windows\System\swgUCMr.exe
  2⤵
  PID:14320
- C:\Windows\System\jbPNaiN.exe
  C:\Windows\System\jbPNaiN.exe
  2⤵
  PID:1808
- C:\Windows\System\azrxSVP.exe
  C:\Windows\System\azrxSVP.exe
  2⤵
  PID:13952
- C:\Windows\System\aUCcAme.exe
  C:\Windows\System\aUCcAme.exe
  2⤵
  PID:13920
- C:\Windows\System\aoPUSzh.exe
  C:\Windows\System\aoPUSzh.exe
  2⤵
  PID:14180
- C:\Windows\System\srAnUcd.exe
  C:\Windows\System\srAnUcd.exe
  2⤵
  PID:13668
- C:\Windows\System\tFAganD.exe
  C:\Windows\System\tFAganD.exe
  2⤵
  PID:9552
- C:\Windows\System\uhTwCYF.exe
  C:\Windows\System\uhTwCYF.exe
  2⤵
  PID:13520
- C:\Windows\System\uYbgYxq.exe
  C:\Windows\System\uYbgYxq.exe
  2⤵
  PID:13356
- C:\Windows\System\YmxbeCr.exe
  C:\Windows\System\YmxbeCr.exe
  2⤵
  PID:3428
- C:\Windows\System\JjjKwTM.exe
  C:\Windows\System\JjjKwTM.exe
  2⤵
  PID:3536
- C:\Windows\System\ijfYufF.exe
  C:\Windows\System\ijfYufF.exe
  2⤵
  PID:14284
- C:\Windows\System\vrdolNR.exe
  C:\Windows\System\vrdolNR.exe
  2⤵
  PID:14052
- C:\Windows\System\BGEGxMR.exe
  C:\Windows\System\BGEGxMR.exe
  2⤵
  PID:13728
- C:\Windows\System\oAzLRdy.exe
  C:\Windows\System\oAzLRdy.exe
  2⤵
  PID:13832
- C:\Windows\System\UmdiYNP.exe
  C:\Windows\System\UmdiYNP.exe
  2⤵
  PID:13464
- C:\Windows\System\zRwOrBp.exe
  C:\Windows\System\zRwOrBp.exe
  2⤵
  PID:13684
- C:\Windows\System\vGCtprg.exe
  C:\Windows\System\vGCtprg.exe
  2⤵
  PID:13492
- C:\Windows\System\faGHMCE.exe
  C:\Windows\System\faGHMCE.exe
  2⤵
  PID:1456
- C:\Windows\System\WioAOjp.exe
  C:\Windows\System\WioAOjp.exe
  2⤵
  PID:3928
- C:\Windows\System\mgUKqlD.exe
  C:\Windows\System\mgUKqlD.exe
  2⤵
  PID:1720
- C:\Windows\System\BluSQoK.exe
  C:\Windows\System\BluSQoK.exe
  2⤵
  PID:14188
- C:\Windows\System\iGRDeVt.exe
  C:\Windows\System\iGRDeVt.exe
  2⤵
  PID:13824
- C:\Windows\System\CPysTJJ.exe
  C:\Windows\System\CPysTJJ.exe
  2⤵
  PID:560
- C:\Windows\System\UVLhPJy.exe
  C:\Windows\System\UVLhPJy.exe
  2⤵
  PID:580
- C:\Windows\System\NDdTlsC.exe
  C:\Windows\System\NDdTlsC.exe
  2⤵
  PID:1604
- C:\Windows\System\jfeXQkK.exe
  C:\Windows\System\jfeXQkK.exe
  2⤵
  PID:13716
- C:\Windows\System\AGTorCk.exe
  C:\Windows\System\AGTorCk.exe
  2⤵
  PID:6008
- C:\Windows\System\LQSTLRF.exe
  C:\Windows\System\LQSTLRF.exe
  2⤵
  PID:14260
- C:\Windows\System\CytKBzn.exe
  C:\Windows\System\CytKBzn.exe
  2⤵
  PID:3268
- C:\Windows\System\KUWcTch.exe
  C:\Windows\System\KUWcTch.exe
  2⤵
  PID:12848
- C:\Windows\System\rnaDefY.exe
  C:\Windows\System\rnaDefY.exe
  2⤵
  PID:11080
- C:\Windows\System\xImuLdi.exe
  C:\Windows\System\xImuLdi.exe
  2⤵
  PID:7112
- C:\Windows\System\pTjTtSL.exe
  C:\Windows\System\pTjTtSL.exe
  2⤵
  PID:6580
- C:\Windows\System\UavppWn.exe
  C:\Windows\System\UavppWn.exe
  2⤵
  PID:13444
- C:\Windows\System\ecdJAHv.exe
  C:\Windows\System\ecdJAHv.exe
  2⤵
  PID:9480
- C:\Windows\System\MOXPqZV.exe
  C:\Windows\System\MOXPqZV.exe
  2⤵
  PID:6012
- C:\Windows\System\uugaJVa.exe
  C:\Windows\System\uugaJVa.exe
  2⤵
  PID:3892
- C:\Windows\System\NMjMdcR.exe
  C:\Windows\System\NMjMdcR.exe
  2⤵
  PID:14332
- C:\Windows\System\awmSTXW.exe
  C:\Windows\System\awmSTXW.exe
  2⤵
  PID:7036
- C:\Windows\System\VILgvSQ.exe
  C:\Windows\System\VILgvSQ.exe
  2⤵
  PID:1232
- C:\Windows\System\zdVXtZX.exe
  C:\Windows\System\zdVXtZX.exe
  2⤵
  PID:14324
- C:\Windows\System\EkTzASG.exe
  C:\Windows\System\EkTzASG.exe
  2⤵
  PID:9340
- C:\Windows\System\BHejSqH.exe
  C:\Windows\System\BHejSqH.exe
  2⤵
  PID:5460
- C:\Windows\System\uySAlTp.exe
  C:\Windows\System\uySAlTp.exe
  2⤵
  PID:2432
- C:\Windows\System\VqEYPfX.exe
  C:\Windows\System\VqEYPfX.exe
  2⤵
  PID:13616
- C:\Windows\System\YaGSuVK.exe
  C:\Windows\System\YaGSuVK.exe
  2⤵
  PID:3464
- C:\Windows\System\nGaRSDH.exe
  C:\Windows\System\nGaRSDH.exe
  2⤵
  PID:5704
- C:\Windows\System\AUPsIDK.exe
  C:\Windows\System\AUPsIDK.exe
  2⤵
  PID:7544
- C:\Windows\System\dIvkBYb.exe
  C:\Windows\System\dIvkBYb.exe
  2⤵
  PID:4708
- C:\Windows\System\vOpHcmb.exe
  C:\Windows\System\vOpHcmb.exe
  2⤵
  PID:4456
- C:\Windows\System\wyPACGw.exe
  C:\Windows\System\wyPACGw.exe
  2⤵
  PID:7620
- C:\Windows\System\xegqcYV.exe
  C:\Windows\System\xegqcYV.exe
  2⤵
  PID:2304
- C:\Windows\System\kZSmEOx.exe
  C:\Windows\System\kZSmEOx.exe
  2⤵
  PID:4768
- C:\Windows\System\knORvje.exe
  C:\Windows\System\knORvje.exe
  2⤵
  PID:10772
- C:\Windows\System\qLuoAUw.exe
  C:\Windows\System\qLuoAUw.exe
  2⤵
  PID:13540
- C:\Windows\System\VooicJg.exe
  C:\Windows\System\VooicJg.exe
  2⤵
  PID:2724
- C:\Windows\System\HoAOCpV.exe
  C:\Windows\System\HoAOCpV.exe
  2⤵
  PID:5212
- C:\Windows\System\vpxYsCW.exe
  C:\Windows\System\vpxYsCW.exe
  2⤵
  PID:6000
- C:\Windows\System\eHYtgAn.exe
  C:\Windows\System\eHYtgAn.exe
  2⤵
  PID:1696
- C:\Windows\System\AtgNXMy.exe
  C:\Windows\System\AtgNXMy.exe
  2⤵
  PID:13504
- C:\Windows\System\AjAOewM.exe
  C:\Windows\System\AjAOewM.exe
  2⤵
  PID:13696
- C:\Windows\System\DKGwDXA.exe
  C:\Windows\System\DKGwDXA.exe
  2⤵
  PID:14264
- C:\Windows\System\lHNXSes.exe
  C:\Windows\System\lHNXSes.exe
  2⤵
  PID:14160
- C:\Windows\System\hzlgCrq.exe
  C:\Windows\System\hzlgCrq.exe
  2⤵
  PID:3372
- C:\Windows\System\fwUVmTD.exe
  C:\Windows\System\fwUVmTD.exe
  2⤵
  PID:13460
- C:\Windows\System\EOwKKBM.exe
  C:\Windows\System\EOwKKBM.exe
  2⤵
  PID:5196
- C:\Windows\System\XwYCkoj.exe
  C:\Windows\System\XwYCkoj.exe
  2⤵
  PID:6244
- C:\Windows\System\CDKIrgg.exe
  C:\Windows\System\CDKIrgg.exe
  2⤵
  PID:5796
- C:\Windows\System\vQuJiSo.exe
  C:\Windows\System\vQuJiSo.exe
  2⤵
  PID:13848
- C:\Windows\System\WeutrzF.exe
  C:\Windows\System\WeutrzF.exe
  2⤵
  PID:12396
- C:\Windows\System\NiQcnjB.exe
  C:\Windows\System\NiQcnjB.exe
  2⤵
  PID:6540
- C:\Windows\System\cDePcnZ.exe
  C:\Windows\System\cDePcnZ.exe
  2⤵
  PID:688
- C:\Windows\System\Cvtltgi.exe
  C:\Windows\System\Cvtltgi.exe
  2⤵
  PID:13756
- C:\Windows\System\WOoYhqr.exe
  C:\Windows\System\WOoYhqr.exe
  2⤵
  PID:6740
- C:\Windows\System\vWeglGG.exe
  C:\Windows\System\vWeglGG.exe
  2⤵
  PID:5204
- C:\Windows\System\OZyuEhO.exe
  C:\Windows\System\OZyuEhO.exe
  2⤵
  PID:7360
- C:\Windows\System\ysAFzho.exe
  C:\Windows\System\ysAFzho.exe
  2⤵
  PID:5368
- C:\Windows\System\FOgdVwg.exe
  C:\Windows\System\FOgdVwg.exe
  2⤵
  PID:7096
- C:\Windows\System\emqERde.exe
  C:\Windows\System\emqERde.exe
  2⤵
  PID:2004
- C:\Windows\System\Dbhdeds.exe
  C:\Windows\System\Dbhdeds.exe
  2⤵
  PID:6200
- C:\Windows\System\KHrItpO.exe
  C:\Windows\System\KHrItpO.exe
  2⤵
  PID:14204
- C:\Windows\System\lhhVAwC.exe
  C:\Windows\System\lhhVAwC.exe
  2⤵
  PID:5700
- C:\Windows\System\qNPmUnL.exe
  C:\Windows\System\qNPmUnL.exe
  2⤵
  PID:220
- C:\Windows\System\RAncsGM.exe
  C:\Windows\System\RAncsGM.exe
  2⤵
  PID:5708
- C:\Windows\System\uZolrnk.exe
  C:\Windows\System\uZolrnk.exe
  2⤵
  PID:14444
- C:\Windows\System\YIdNxnA.exe
  C:\Windows\System\YIdNxnA.exe
  2⤵
  PID:14476
- C:\Windows\System\nyqyTiI.exe
  C:\Windows\System\nyqyTiI.exe
  2⤵
  PID:14496
- C:\Windows\System\YBBKIru.exe
  C:\Windows\System\YBBKIru.exe
  2⤵
  PID:14716
- C:\Windows\System\ICkWsnQ.exe
  C:\Windows\System\ICkWsnQ.exe
  2⤵
  PID:14756
- C:\Windows\System\iCmjQKx.exe
  C:\Windows\System\iCmjQKx.exe
  2⤵
  PID:14780
- C:\Windows\System\UwsmTAU.exe
  C:\Windows\System\UwsmTAU.exe
  2⤵
  PID:14964
- C:\Windows\System\zjilkFC.exe
  C:\Windows\System\zjilkFC.exe
  2⤵
  PID:14996
- C:\Windows\System\CyzDnCW.exe
  C:\Windows\System\CyzDnCW.exe
  2⤵
  PID:15072
- C:\Windows\System\IHDmTxI.exe
  C:\Windows\System\IHDmTxI.exe
  2⤵
  PID:15096
- C:\Windows\System\GnItoCT.exe
  C:\Windows\System\GnItoCT.exe
  2⤵
  PID:15120
- C:\Windows\System\gOFsfBf.exe
  C:\Windows\System\gOFsfBf.exe
  2⤵
  PID:15140
- C:\Windows\System\cGCTpVq.exe
  C:\Windows\System\cGCTpVq.exe
  2⤵
  PID:15160
- C:\Windows\System\kxyROKK.exe
  C:\Windows\System\kxyROKK.exe
  2⤵
  PID:15196
- C:\Windows\System\wawErWd.exe
  C:\Windows\System\wawErWd.exe
  2⤵
  PID:15216
- C:\Windows\System\iRfENUy.exe
  C:\Windows\System\iRfENUy.exe
  2⤵
  PID:15232
- C:\Windows\System\cJtmDSN.exe
  C:\Windows\System\cJtmDSN.exe
  2⤵
  PID:15256
- C:\Windows\System\OQSzxcQ.exe
  C:\Windows\System\OQSzxcQ.exe
  2⤵
  PID:15284
- C:\Windows\System\dHHkFzI.exe
  C:\Windows\System\dHHkFzI.exe
  2⤵
  PID:12860
- C:\Windows\System\ldqmjZv.exe
  C:\Windows\System\ldqmjZv.exe
  2⤵
  PID:6816
- C:\Windows\System\eXycSLX.exe
  C:\Windows\System\eXycSLX.exe
  2⤵
  PID:6164
- C:\Windows\System\KsBqIEe.exe
  C:\Windows\System\KsBqIEe.exe
  2⤵
  PID:14424
- C:\Windows\System\SjYihkF.exe
  C:\Windows\System\SjYihkF.exe
  2⤵
  PID:14436
- C:\Windows\System\inrGDzZ.exe
  C:\Windows\System\inrGDzZ.exe
  2⤵
  PID:5720
- C:\Windows\System\KhgXgKI.exe
  C:\Windows\System\KhgXgKI.exe
  2⤵
  PID:14288
- C:\Windows\System\zBMPLQd.exe
  C:\Windows\System\zBMPLQd.exe
  2⤵
  PID:14408
- C:\Windows\System\YhXNaRg.exe
  C:\Windows\System\YhXNaRg.exe
  2⤵
  PID:7956
- C:\Windows\System\ivXRdPU.exe
  C:\Windows\System\ivXRdPU.exe
  2⤵
  PID:14620
- C:\Windows\System\ERaWyLS.exe
  C:\Windows\System\ERaWyLS.exe
  2⤵
  PID:6516
- C:\Windows\System\mLkLMZO.exe
  C:\Windows\System\mLkLMZO.exe
  2⤵
  PID:14364
- C:\Windows\System\OOAShsN.exe
  C:\Windows\System\OOAShsN.exe
  2⤵
  PID:14660
- C:\Windows\System\RDifaRE.exe
  C:\Windows\System\RDifaRE.exe
  2⤵
  PID:14508
- C:\Windows\System\lPPODGr.exe
  C:\Windows\System\lPPODGr.exe
  2⤵
  PID:14548
- C:\Windows\System\UtqzZpD.exe
  C:\Windows\System\UtqzZpD.exe
  2⤵
  PID:14684
- C:\Windows\System\rWKENJe.exe
  C:\Windows\System\rWKENJe.exe
  2⤵
  PID:7664
- C:\Windows\System\wdYfbDS.exe
  C:\Windows\System\wdYfbDS.exe
  2⤵
  PID:2396
- C:\Windows\System\CXUeGth.exe
  C:\Windows\System\CXUeGth.exe
  2⤵
  PID:14592
- C:\Windows\System\Dolffxt.exe
  C:\Windows\System\Dolffxt.exe
  2⤵
  PID:7040
- C:\Windows\System\RbduxBH.exe
  C:\Windows\System\RbduxBH.exe
  2⤵
  PID:14768
- C:\Windows\System\WKBWnKU.exe
  C:\Windows\System\WKBWnKU.exe
  2⤵
  PID:14792
- C:\Windows\System\yAUbjsP.exe
  C:\Windows\System\yAUbjsP.exe
  2⤵
  PID:14644
- C:\Windows\System\ABVEPkF.exe
  C:\Windows\System\ABVEPkF.exe
  2⤵
  PID:15008
- C:\Windows\System\yWKotbP.exe
  C:\Windows\System\yWKotbP.exe
  2⤵
  PID:15252
- C:\Windows\System\atlVsyp.exe
  C:\Windows\System\atlVsyp.exe
  2⤵
  PID:15332
- C:\Windows\System\jCUWcOZ.exe
  C:\Windows\System\jCUWcOZ.exe
  2⤵
  PID:14948
- C:\Windows\System\tJmusbK.exe
  C:\Windows\System\tJmusbK.exe
  2⤵
  PID:15016
- C:\Windows\System\AtgXHKW.exe
  C:\Windows\System\AtgXHKW.exe
  2⤵
  PID:6932
- C:\Windows\System\pdVetcR.exe
  C:\Windows\System\pdVetcR.exe
  2⤵
  PID:14556
- C:\Windows\System\NZZSiZh.exe
  C:\Windows\System\NZZSiZh.exe
  2⤵
  PID:6756
- C:\Windows\System\spUbuQS.exe
  C:\Windows\System\spUbuQS.exe
  2⤵
  PID:14400
- C:\Windows\System\RlRzgBT.exe
  C:\Windows\System\RlRzgBT.exe
  2⤵
  PID:5624
- C:\Windows\System\acHsCQx.exe
  C:\Windows\System\acHsCQx.exe
  2⤵
  PID:14976
- C:\Windows\System\FhamMex.exe
  C:\Windows\System\FhamMex.exe
  2⤵
  PID:15064
- C:\Windows\System\acionWw.exe
  C:\Windows\System\acionWw.exe
  2⤵
  PID:14952
- C:\Windows\System\dcfpmtT.exe
  C:\Windows\System\dcfpmtT.exe
  2⤵
  PID:6772
- C:\Windows\System\vdJLFhq.exe
  C:\Windows\System\vdJLFhq.exe
  2⤵
  PID:15212
- C:\Windows\System\tazUuEh.exe
  C:\Windows\System\tazUuEh.exe
  2⤵
  PID:14692
- C:\Windows\System\pxxmbVR.exe
  C:\Windows\System\pxxmbVR.exe
  2⤵
  PID:6368
- C:\Windows\System\gdpjIws.exe
  C:\Windows\System\gdpjIws.exe
  2⤵
  PID:5792
- C:\Windows\System\yklvITd.exe
  C:\Windows\System\yklvITd.exe
  2⤵
  PID:14676
- C:\Windows\System\ezVADnN.exe
  C:\Windows\System\ezVADnN.exe
  2⤵
  PID:7840
- C:\Windows\System\VyBrsjJ.exe
  C:\Windows\System\VyBrsjJ.exe
  2⤵
  PID:7972
- C:\Windows\System\aqdmbEy.exe
  C:\Windows\System\aqdmbEy.exe
  2⤵
  PID:14752
- C:\Windows\System\xgGZdXf.exe
  C:\Windows\System\xgGZdXf.exe
  2⤵
  PID:14540
- C:\Windows\System\zKTnqmP.exe
  C:\Windows\System\zKTnqmP.exe
  2⤵
  PID:14340
- C:\Windows\System\qVTAacy.exe
  C:\Windows\System\qVTAacy.exe
  2⤵
  PID:5256
- C:\Windows\System\vCBshPW.exe
  C:\Windows\System\vCBshPW.exe
  2⤵
  PID:7088
- C:\Windows\System\jOcxZsZ.exe
  C:\Windows\System\jOcxZsZ.exe
  2⤵
  PID:14956
- C:\Windows\System\cMvfPLK.exe
  C:\Windows\System\cMvfPLK.exe
  2⤵
  PID:15240
- C:\Windows\System\ZuXzEzt.exe
  C:\Windows\System\ZuXzEzt.exe
  2⤵
  PID:15176
- C:\Windows\System\TLpaSPq.exe
  C:\Windows\System\TLpaSPq.exe
  2⤵
  PID:15036
- C:\Windows\System\wULrPAL.exe
  C:\Windows\System\wULrPAL.exe
  2⤵
  PID:14612
- C:\Windows\System\zFintpm.exe
  C:\Windows\System\zFintpm.exe
  2⤵
  PID:14616
- C:\Windows\System\vnexDOX.exe
  C:\Windows\System\vnexDOX.exe
  2⤵
  PID:14608
- C:\Windows\System\YajSlor.exe
  C:\Windows\System\YajSlor.exe
  2⤵
  PID:6396
- C:\Windows\System\cUDrSaX.exe
  C:\Windows\System\cUDrSaX.exe
  2⤵
  PID:8260
- C:\Windows\System\XzCKhmL.exe
  C:\Windows\System\XzCKhmL.exe
  2⤵
  PID:14568
- C:\Windows\System\syAUIHQ.exe
  C:\Windows\System\syAUIHQ.exe
  2⤵
  PID:8188
- C:\Windows\System\UEEysbg.exe
  C:\Windows\System\UEEysbg.exe
  2⤵
  PID:6864
- C:\Windows\System\sARMnUv.exe
  C:\Windows\System\sARMnUv.exe
  2⤵
  PID:14820
- C:\Windows\System\aTPfPdz.exe
  C:\Windows\System\aTPfPdz.exe
  2⤵
  PID:5664
- C:\Windows\System\nFJmrqr.exe
  C:\Windows\System\nFJmrqr.exe
  2⤵
  PID:14536
- C:\Windows\System\drddpoI.exe
  C:\Windows\System\drddpoI.exe
  2⤵
  PID:14572
- C:\Windows\System\eeHgHJT.exe
  C:\Windows\System\eeHgHJT.exe
  2⤵
  PID:3924
- C:\Windows\System\tHNTsAU.exe
  C:\Windows\System\tHNTsAU.exe
  2⤵
  PID:15304
- C:\Windows\System\DTflHDs.exe
  C:\Windows\System\DTflHDs.exe
  2⤵
  PID:8252
- C:\Windows\System\CUxkJqB.exe
  C:\Windows\System\CUxkJqB.exe
  2⤵
  PID:14840
- C:\Windows\System\pHBVlAd.exe
  C:\Windows\System\pHBVlAd.exe
  2⤵
  PID:9632
- C:\Windows\System\YnLZOON.exe
  C:\Windows\System\YnLZOON.exe
  2⤵
  PID:8656
- C:\Windows\System\FJtpdHO.exe
  C:\Windows\System\FJtpdHO.exe
  2⤵
  PID:8648
- C:\Windows\System\cTnAPar.exe
  C:\Windows\System\cTnAPar.exe
  2⤵
  PID:14140
- C:\Windows\System\gsCQwqa.exe
  C:\Windows\System\gsCQwqa.exe
  2⤵
  PID:9868
- C:\Windows\System\rxjtiVz.exe
  C:\Windows\System\rxjtiVz.exe
  2⤵
  PID:8820
- C:\Windows\System\CeFTXGa.exe
  C:\Windows\System\CeFTXGa.exe
  2⤵
  PID:6152
- C:\Windows\System\vYKsjxc.exe
  C:\Windows\System\vYKsjxc.exe
  2⤵
  PID:7436
- C:\Windows\System\DLGvKIB.exe
  C:\Windows\System\DLGvKIB.exe
  2⤵
  PID:8540
- C:\Windows\System\VhRdzgb.exe
  C:\Windows\System\VhRdzgb.exe
  2⤵
  PID:8084
- C:\Windows\System\fghghQZ.exe
  C:\Windows\System\fghghQZ.exe
  2⤵
  PID:9760
- C:\Windows\System\bcNIsbF.exe
  C:\Windows\System\bcNIsbF.exe
  2⤵
  PID:9136
- C:\Windows\System\gVnkNEP.exe
  C:\Windows\System\gVnkNEP.exe
  2⤵
  PID:4384
- C:\Windows\System\RKoKINZ.exe
  C:\Windows\System\RKoKINZ.exe
  2⤵
  PID:14640
- C:\Windows\System\UkdGyaw.exe
  C:\Windows\System\UkdGyaw.exe
  2⤵
  PID:9976
- C:\Windows\System\UWtXedi.exe
  C:\Windows\System\UWtXedi.exe
  2⤵
  PID:5388
- C:\Windows\System\StbyVtP.exe
  C:\Windows\System\StbyVtP.exe
  2⤵
  PID:9636
- C:\Windows\System\wpwphTA.exe
  C:\Windows\System\wpwphTA.exe
  2⤵
  PID:9872
- C:\Windows\System\QHKqbYn.exe
  C:\Windows\System\QHKqbYn.exe
  2⤵
  PID:10000
- C:\Windows\System\XrsLNXN.exe
  C:\Windows\System\XrsLNXN.exe
  2⤵
  PID:10024
- C:\Windows\System\RdJSUvb.exe
  C:\Windows\System\RdJSUvb.exe
  2⤵
  PID:14468
- C:\Windows\System\FDwCWnX.exe
  C:\Windows\System\FDwCWnX.exe
  2⤵
  PID:10048
- C:\Windows\System\jLQxtTn.exe
  C:\Windows\System\jLQxtTn.exe
  2⤵
  PID:8336
- C:\Windows\System\FFmgkGf.exe
  C:\Windows\System\FFmgkGf.exe
  2⤵
  PID:9272
- C:\Windows\System\KpTYXdU.exe
  C:\Windows\System\KpTYXdU.exe
  2⤵
  PID:7896
- C:\Windows\System\sgdcHRa.exe
  C:\Windows\System\sgdcHRa.exe
  2⤵
  PID:8104
- C:\Windows\System\osWLxOm.exe
  C:\Windows\System\osWLxOm.exe
  2⤵
  PID:5532
- C:\Windows\System\zczvvWT.exe
  C:\Windows\System\zczvvWT.exe
  2⤵
  PID:9264
- C:\Windows\System\msCUSQy.exe
  C:\Windows\System\msCUSQy.exe
  2⤵
  PID:8348
- C:\Windows\System\vBFDakY.exe
  C:\Windows\System\vBFDakY.exe
  2⤵
  PID:9432
- C:\Windows\System\SbhqoBx.exe
  C:\Windows\System\SbhqoBx.exe
  2⤵
  PID:15172
- C:\Windows\System\QfINkfP.exe
  C:\Windows\System\QfINkfP.exe
  2⤵
  PID:9788
- C:\Windows\System\NtNuyWg.exe
  C:\Windows\System\NtNuyWg.exe
  2⤵
  PID:14824
- C:\Windows\System\cKZbGLB.exe
  C:\Windows\System\cKZbGLB.exe
  2⤵
  PID:9392
- C:\Windows\System\GotnUKa.exe
  C:\Windows\System\GotnUKa.exe
  2⤵
  PID:8704
- C:\Windows\System\OtTHjfc.exe
  C:\Windows\System\OtTHjfc.exe
  2⤵
  PID:15020
- C:\Windows\System\LdcFfpe.exe
  C:\Windows\System\LdcFfpe.exe
  2⤵
  PID:9584
- C:\Windows\System\FfKgxlj.exe
  C:\Windows\System\FfKgxlj.exe
  2⤵
  PID:3756
- C:\Windows\System\SzpIBrV.exe
  C:\Windows\System\SzpIBrV.exe
  2⤵
  PID:8592
- C:\Windows\System\nZRbhQs.exe
  C:\Windows\System\nZRbhQs.exe
  2⤵
  PID:6832
- C:\Windows\System\ZHLmIyN.exe
  C:\Windows\System\ZHLmIyN.exe
  2⤵
  PID:8728
- C:\Windows\System\yhdFglI.exe
  C:\Windows\System\yhdFglI.exe
  2⤵
  PID:8760
- C:\Windows\System\rzOgPiv.exe
  C:\Windows\System\rzOgPiv.exe
  2⤵
  PID:9960
- C:\Windows\System\RijksMj.exe
  C:\Windows\System\RijksMj.exe
  2⤵
  PID:12008
- C:\Windows\System\IGqkVvC.exe
  C:\Windows\System\IGqkVvC.exe
  2⤵
  PID:9460
- C:\Windows\System\WTpTzty.exe
  C:\Windows\System\WTpTzty.exe
  2⤵
  PID:9556
- C:\Windows\System\QZWpynZ.exe
  C:\Windows\System\QZWpynZ.exe
  2⤵
  PID:8528
- C:\Windows\System\UmAjWsH.exe
  C:\Windows\System\UmAjWsH.exe
  2⤵
  PID:6836
- C:\Windows\System\JrFLPcQ.exe
  C:\Windows\System\JrFLPcQ.exe
  2⤵
  PID:9680
- C:\Windows\System\vnuCsRH.exe
  C:\Windows\System\vnuCsRH.exe
  2⤵
  PID:9464
- C:\Windows\System\dZXCZMo.exe
  C:\Windows\System\dZXCZMo.exe
  2⤵
  PID:9532
- C:\Windows\System\ulwrJKK.exe
  C:\Windows\System\ulwrJKK.exe
  2⤵
  PID:4460
- C:\Windows\System\FfTnspr.exe
  C:\Windows\System\FfTnspr.exe
  2⤵
  PID:9964
- C:\Windows\System\mVeIlAC.exe
  C:\Windows\System\mVeIlAC.exe
  2⤵
  PID:9668
- C:\Windows\System\XQitKVN.exe
  C:\Windows\System\XQitKVN.exe
  2⤵
  PID:13476
- C:\Windows\System\SujNqLw.exe
  C:\Windows\System\SujNqLw.exe
  2⤵
  PID:7828
- C:\Windows\System\KNPHMoc.exe
  C:\Windows\System\KNPHMoc.exe
  2⤵
  PID:9720
- C:\Windows\System\LecKtCw.exe
  C:\Windows\System\LecKtCw.exe
  2⤵
  PID:6848
- C:\Windows\System\ZfkoMUf.exe
  C:\Windows\System\ZfkoMUf.exe
  2⤵
  PID:668
- C:\Windows\System\bVpBDzy.exe
  C:\Windows\System\bVpBDzy.exe
  2⤵
  PID:9168
- C:\Windows\System\qYyuBoy.exe
  C:\Windows\System\qYyuBoy.exe
  2⤵
  PID:15040
- C:\Windows\System\LoVTBbs.exe
  C:\Windows\System\LoVTBbs.exe
  2⤵
  PID:10104
- C:\Windows\System\mZRSvbx.exe
  C:\Windows\System\mZRSvbx.exe
  2⤵
  PID:8320
- C:\Windows\System\BoAEygQ.exe
  C:\Windows\System\BoAEygQ.exe
  2⤵
  PID:7528
- C:\Windows\System\YgibeSg.exe
  C:\Windows\System\YgibeSg.exe
  2⤵
  PID:9652
- C:\Windows\System\WKBKiIm.exe
  C:\Windows\System\WKBKiIm.exe
  2⤵
  PID:9328
- C:\Windows\System\bUzHoPo.exe
  C:\Windows\System\bUzHoPo.exe
  2⤵
  PID:9776
- C:\Windows\System\LLEIgMK.exe
  C:\Windows\System\LLEIgMK.exe
  2⤵
  PID:10704
- C:\Windows\System\TVTiqmr.exe
  C:\Windows\System\TVTiqmr.exe
  2⤵
  PID:10888
- C:\Windows\System\bsFQUHZ.exe
  C:\Windows\System\bsFQUHZ.exe
  2⤵
  PID:8416
- C:\Windows\System\iNlCmMF.exe
  C:\Windows\System\iNlCmMF.exe
  2⤵
  PID:9696
- C:\Windows\System\PMclHJg.exe
  C:\Windows\System\PMclHJg.exe
  2⤵
  PID:9800
- C:\Windows\System\kwdGTDm.exe
  C:\Windows\System\kwdGTDm.exe
  2⤵
  PID:9792
- C:\Windows\System\rxcdUgF.exe
  C:\Windows\System\rxcdUgF.exe
  2⤵
  PID:9260
- C:\Windows\System\gollRXd.exe
  C:\Windows\System\gollRXd.exe
  2⤵
  PID:7424
- C:\Windows\System\ITaKSKA.exe
  C:\Windows\System\ITaKSKA.exe
  2⤵
  PID:11008
- C:\Windows\System\lvvKPdh.exe
  C:\Windows\System\lvvKPdh.exe
  2⤵
  PID:5588
- C:\Windows\System\ijOTNhv.exe
  C:\Windows\System\ijOTNhv.exe
  2⤵
  PID:7416
- C:\Windows\System\mvQAqCr.exe
  C:\Windows\System\mvQAqCr.exe
  2⤵
  PID:12088
- C:\Windows\System\OtInOJm.exe
  C:\Windows\System\OtInOJm.exe
  2⤵
  PID:6032
- C:\Windows\System\RLJVCzT.exe
  C:\Windows\System\RLJVCzT.exe
  2⤵
  PID:9256
- C:\Windows\System\McPjYbO.exe
  C:\Windows\System\McPjYbO.exe
  2⤵
  PID:14712
- C:\Windows\System\rfriwQA.exe
  C:\Windows\System\rfriwQA.exe
  2⤵
  PID:12172
- C:\Windows\System\vxXSzGz.exe
  C:\Windows\System\vxXSzGz.exe
  2⤵
  PID:10840
- C:\Windows\System\yvEhYqj.exe
  C:\Windows\System\yvEhYqj.exe
  2⤵
  PID:8784
- C:\Windows\System\ZNjIUZO.exe
  C:\Windows\System\ZNjIUZO.exe
  2⤵
  PID:8652
- C:\Windows\System\NzopMsH.exe
  C:\Windows\System\NzopMsH.exe
  2⤵
  PID:8132
- C:\Windows\System\hwaIBzQ.exe
  C:\Windows\System\hwaIBzQ.exe
  2⤵
  PID:10976
- C:\Windows\System\PYzuEhX.exe
  C:\Windows\System\PYzuEhX.exe
  2⤵
  PID:4748
- C:\Windows\System\vTaXPXM.exe
  C:\Windows\System\vTaXPXM.exe
  2⤵
  PID:8888
- C:\Windows\System\iJYoXEd.exe
  C:\Windows\System\iJYoXEd.exe
  2⤵
  PID:1564
- C:\Windows\System\eCjsHui.exe
  C:\Windows\System\eCjsHui.exe
  2⤵
  PID:9304
- C:\Windows\System\RjGkrRb.exe
  C:\Windows\System\RjGkrRb.exe
  2⤵
  PID:15128
- C:\Windows\System\fbmxWwi.exe
  C:\Windows\System\fbmxWwi.exe
  2⤵
  PID:14404
- C:\Windows\System\GqIQmqH.exe
  C:\Windows\System\GqIQmqH.exe
  2⤵
  PID:14488
- C:\Windows\System\PuuJzpW.exe
  C:\Windows\System\PuuJzpW.exe
  2⤵
  PID:4436
- C:\Windows\System\KbyQQhb.exe
  C:\Windows\System\KbyQQhb.exe
  2⤵
  PID:9628
- C:\Windows\System\VPKeyEx.exe
  C:\Windows\System\VPKeyEx.exe
  2⤵
  PID:10012
- C:\Windows\System\OzwDiIS.exe
  C:\Windows\System\OzwDiIS.exe
  2⤵
  PID:5128
- C:\Windows\System\oHGuERC.exe
  C:\Windows\System\oHGuERC.exe
  2⤵
  PID:8052
- C:\Windows\System\LpnfDJX.exe
  C:\Windows\System\LpnfDJX.exe
  2⤵
  PID:9944
- C:\Windows\System\SBWTRDh.exe
  C:\Windows\System\SBWTRDh.exe
  2⤵
  PID:4012
- C:\Windows\System\qsPWQEX.exe
  C:\Windows\System\qsPWQEX.exe
  2⤵
  PID:11072
- C:\Windows\System\CWgFRad.exe
  C:\Windows\System\CWgFRad.exe
  2⤵
  PID:4620
- C:\Windows\System\GaAIVUk.exe
  C:\Windows\System\GaAIVUk.exe
  2⤵
  PID:9924
- C:\Windows\System\FVbGAyT.exe
  C:\Windows\System\FVbGAyT.exe
  2⤵
  PID:12916
- C:\Windows\System\oTgYldL.exe
  C:\Windows\System\oTgYldL.exe
  2⤵
  PID:10096
- C:\Windows\System\MioeRkn.exe
  C:\Windows\System\MioeRkn.exe
  2⤵
  PID:9576
- C:\Windows\System\fxTpbGS.exe
  C:\Windows\System\fxTpbGS.exe
  2⤵
  PID:12056
- C:\Windows\System\SBHFQfR.exe
  C:\Windows\System\SBHFQfR.exe
  2⤵
  PID:11352
- C:\Windows\System\MZBMJXl.exe
  C:\Windows\System\MZBMJXl.exe
  2⤵
  PID:10552
- C:\Windows\System\LnuSXwL.exe
  C:\Windows\System\LnuSXwL.exe
  2⤵
  PID:12812
- C:\Windows\System\BWGmmrZ.exe
  C:\Windows\System\BWGmmrZ.exe
  2⤵
  PID:7380
- C:\Windows\System\rgmejcU.exe
  C:\Windows\System\rgmejcU.exe
  2⤵
  PID:9876
- C:\Windows\System\XeBXhmc.exe
  C:\Windows\System\XeBXhmc.exe
  2⤵
  PID:10224
- C:\Windows\System\hBFVLAn.exe
  C:\Windows\System\hBFVLAn.exe
  2⤵
  PID:15380
- C:\Windows\System\xBYNCMj.exe
  C:\Windows\System\xBYNCMj.exe
  2⤵
  PID:15412
- C:\Windows\System\imHVBzV.exe
  C:\Windows\System\imHVBzV.exe
  2⤵
  PID:15436
- C:\Windows\System\VNEEwYo.exe
  C:\Windows\System\VNEEwYo.exe
  2⤵
  PID:15468
- C:\Windows\System\xTYvuLv.exe
  C:\Windows\System\xTYvuLv.exe
  2⤵
  PID:15496
- C:\Windows\System\fGibOfu.exe
  C:\Windows\System\fGibOfu.exe
  2⤵
  PID:15524
- C:\Windows\System\AlOPjoC.exe
  C:\Windows\System\AlOPjoC.exe
  2⤵
  PID:15548
- C:\Windows\System\zrhhneh.exe
  C:\Windows\System\zrhhneh.exe
  2⤵
  PID:15568
- C:\Windows\System\srUemcN.exe
  C:\Windows\System\srUemcN.exe
  2⤵
  PID:15596
- C:\Windows\System\zxOUlYa.exe
  C:\Windows\System\zxOUlYa.exe
  2⤵
  PID:15620
- C:\Windows\System\sjerkZT.exe
  C:\Windows\System\sjerkZT.exe
  2⤵
  PID:15648
- C:\Windows\System\gEfQLRY.exe
  C:\Windows\System\gEfQLRY.exe
  2⤵
  PID:15684
- C:\Windows\System\UmYcVqj.exe
  C:\Windows\System\UmYcVqj.exe
  2⤵
  PID:15708
- C:\Windows\System\OmeSTTY.exe
  C:\Windows\System\OmeSTTY.exe
  2⤵
  PID:15732
- C:\Windows\System\vJTsqEd.exe
  C:\Windows\System\vJTsqEd.exe
  2⤵
  PID:15760
- C:\Windows\System\ZxKtljV.exe
  C:\Windows\System\ZxKtljV.exe
  2⤵
  PID:15784
- C:\Windows\System\IoxWNtH.exe
  C:\Windows\System\IoxWNtH.exe
  2⤵
  PID:15812
- C:\Windows\System\nxtUwDs.exe
  C:\Windows\System\nxtUwDs.exe
  2⤵
  PID:15832
- C:\Windows\System\cdpGBNf.exe
  C:\Windows\System\cdpGBNf.exe
  2⤵
  PID:16072
- C:\Windows\System\ZQtbGki.exe
  C:\Windows\System\ZQtbGki.exe
  2⤵
  PID:16100
- C:\Windows\System\cKFJWsX.exe
  C:\Windows\System\cKFJWsX.exe
  2⤵
  PID:16152
- C:\Windows\System\PBvuHIA.exe
  C:\Windows\System\PBvuHIA.exe
  2⤵
  PID:16204
- C:\Windows\System\fJKDTLh.exe
  C:\Windows\System\fJKDTLh.exe
  2⤵
  PID:16236
- C:\Windows\System\SPewkSM.exe
  C:\Windows\System\SPewkSM.exe
  2⤵
  PID:16268
- C:\Windows\System\dSzJxKg.exe
  C:\Windows\System\dSzJxKg.exe
  2⤵
  PID:16300
- C:\Windows\System\CPtUwqa.exe
  C:\Windows\System\CPtUwqa.exe
  2⤵
  PID:16336
- C:\Windows\System\kRJCFWF.exe
  C:\Windows\System\kRJCFWF.exe
  2⤵
  PID:16372
- C:\Windows\System\ojDDnoH.exe
  C:\Windows\System\ojDDnoH.exe
  2⤵
  PID:8056
- C:\Windows\System\cmRVxQq.exe
  C:\Windows\System\cmRVxQq.exe
  2⤵
  PID:9276
- C:\Windows\System\WKiyHjR.exe
  C:\Windows\System\WKiyHjR.exe
  2⤵
  PID:10284

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 688 -p 544 -ip 544
1⤵
PID:11144

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 688 -p 7696 -ip 7696
1⤵
PID:4120

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4kdmthpu.wl2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BDbmjFv.exe

Filesize
1.1MB

MD5
8f703e8cb0e943ed28dac765b38eba30

SHA1
4fbeb5dd57314844424de6208865db650fb6d9ea

SHA256
1a5ba7bde2c36c754a9d0d98f70411ddcb5091a6f8d55d9cbc55c87f897a5dfb

SHA512
3a3adc4772df1cfea83512b20735f76a0b5376d47d84556b0d58f2521eff3397d3fe0422256c973c26a801ad6c2d09fe8236deb6064c453e4ff14e4035735df1

Download Submit
C:\Windows\System\BEhXHsv.exe

Filesize
1.1MB

MD5
828aca20c40035c722f738828afa65bf

SHA1
eff2b207f5b820fc6375d91164eaec175b5a5772

SHA256
cb577e485175be2e3cbd180833427ed5628eb41d2c45a8d90609f5120115d8d5

SHA512
fa131641d83deb4207613739152601b9fcb4577da409186e574c236ec1b558066cb7da2d9930ca5ddf60e507bdb0af3b769c0dd3c107afa4257a6b38de8644e5

Download Submit
C:\Windows\System\DnVmUTc.exe

Filesize
1.1MB

MD5
65f1d2594ec3bc599fb40858d3ce50a1

SHA1
4cfd6fdb7f8b6ff2cc92bd48431fe6bef292136e

SHA256
16edbc0be51b34904400489df85045448ee7fb514b21b22190d3763a7a1dae42

SHA512
8ca6bf484359da916c4f46a5fdc96471143c40f37b9d48c54ac8f54770bb9c0c650c8fad7ad9932893233b91ca3c774aae11ac61d89de7d1a1de9277e5be2b4a

Download Submit
C:\Windows\System\DnsPkAW.exe

Filesize
1.1MB

MD5
16fe7c34af9089a98a191d482dd9b725

SHA1
89fb516158e532473e80d0de950ef22f782e6c89

SHA256
8a1e0d95d65acd8a0ec9da01fcd02f733b8283910c40b1291363bf54afc11c97

SHA512
985969e8266a009a79830115b41081ee72bfda156d0355ab0abd4f95efdd76ed9a1b848c9f29946fe48c2627ace1b806b87f13bbc5c7c91059b764a1dffb735d

Download Submit
C:\Windows\System\EBvbdGV.exe

Filesize
1.1MB

MD5
80564fdd3f2f5661d211635db4959be2

SHA1
158b98a8a97b902a114d1e28860db281db3c32cc

SHA256
dafa4cc9a54f8e3598c35d878097e09eb28135cca189579c4d4a8bc227246b6f

SHA512
42fabb74028792af3808fe607c234d87b7db6641678f41f69130cdbada4ce2ee042f43e8c44ab3453be17897bbe45a1a78166573a82c6d63b3e40854c540eb89

Download Submit
C:\Windows\System\GwGtzfT.exe

Filesize
1.1MB

MD5
eca2e285e49335fb0500af669baeda9e

SHA1
3b9b9c258a3cf82816b16446a0e26a84c62d92c5

SHA256
16d5d3420a3baed30fde8f33192fff188dccd56805af362914532ea796aeda38

SHA512
72ff4c4bbe33dcee44894268229600c23397ec9716ce65d1f9fd9c0ac1a44a24e386dab5bc00f25485d652716389cc2546788fa8a3f941a2fae66d0c23e2b72f

Download Submit
C:\Windows\System\HXPrdUO.exe

Filesize
1.1MB

MD5
a4a15e07235a59cd46105fd8220e63b8

SHA1
e2ff69f9605cce0bed71b944316605a8cf9b9640

SHA256
2ff75df48dc86b5c9764674c45166b9d8687754376865d18a96153235386fc2f

SHA512
62c2b816c10484f9670a74960bdd39ad7f8a375e2cc4e47c3a88462ee0151ed40f40d6827a2781d50f806c09dbb7787043ac0bc4b18049cf5562f1e590562d7b

Download Submit
C:\Windows\System\JjhAbdJ.exe

Filesize
1.1MB

MD5
52bc7f38420cb9af1db27f2d4097597b

SHA1
1e541d926596ae6b4b9acc0d1f2877dff33a93a8

SHA256
7ec8ea75a34f95d05b9c5b4ee4a5677ac48bb1aabd345c96e18529d20a1e7b71

SHA512
958658f527432154db719f868b1cf2170457136f4c77269a7a0d7a2ba9ad693b4b5f4bd2a904c96693a7dfa13dea85149cd359631d49359d8e3fe420016e41f1

Download Submit
C:\Windows\System\JtRTgkj.exe

Filesize
1.1MB

MD5
b079f84115b3d8b58345bdc1f1a271ad

SHA1
d85ef5ef484987be7b130e5467ea42c5f8e4c55a

SHA256
1fb17bcf923a0cdd1557964289336b9018bcf44a9e0e084cce669afb4755fada

SHA512
f16ed345174842863e0f48f23018546a6cd125df79f060aab8155c0809c2ffb7c7b62ae73fa576983a9b959caa1538a685c11ed6ff4db7db9401c54130b8db4e

Download Submit
C:\Windows\System\PFndtbi.exe

Filesize
1.1MB

MD5
50c3b6b2d8c73cbc1d63037e76ffab4b

SHA1
8d57711bbd5c8be60990030f78a0e8ca42cdd64a

SHA256
a04cd6542c41faaa16b52d25402742f14afe7606b0fce319f10ca97f12f12003

SHA512
7bd0a010508068015a6030e39d538d81d24695a5ac18e542bf5db0fd06b2eac08897892173b68677b21cafe6218bb819625c3c4fda654da88b123206e5ced1b2

Download Submit
C:\Windows\System\PhKhfhQ.exe

Filesize
1.1MB

MD5
681e7c8cef6fc984a676372cddf56d4e

SHA1
711e6662f16fde2603b64172cee6a48b5e106ac9

SHA256
02083141c0e9b09200bf8e10eba39bc6bca979667ba35e88d8de073283dbafeb

SHA512
16241ed2b3f546c8cf667d3b108cd862983b3bd30d8177950fb899939009871477d570281890aeb559063b6668dc60127dd9a2991d53683cd7657b9979f0ecf6

Download Submit
C:\Windows\System\QSlaIsL.exe

Filesize
1.1MB

MD5
5576eab0c96241d42c0dc9df68639f4b

SHA1
d7bbcb969bc142b7a92ae3826322f2b5fb9e19cb

SHA256
fb740dacb18e67495592e762e804ea7127bc19a61e53cad229d44c66cbcea1b7

SHA512
01d773b9de7393c7f66f9cfbbc58ff5b0be39bde1be8d6524266187ac6ec81b7c67ad530b59068b5bd6e1d7eaa22766a403d9d41fa3a27ac2312ce4950b13002

Download Submit
C:\Windows\System\TONBPkL.exe

Filesize
1.1MB

MD5
7e8496986d995a918210245884b980f3

SHA1
8dc0d02eea6d3b6ae4971dc4d51de543546a78c7

SHA256
f6e798e072fe2d1b46ad3e334cc9c1932b655d05c5e1323286bcb6083160dd67

SHA512
c5e90d5c857c271dd7c6b63631a0e1264ce0046af1b8d374e670c7eea86a0ab33e2dd211b20dacf9fc25f977cdc702e62a403e54ffa249be287f97f506e75bd2

Download Submit
C:\Windows\System\TSuwpAa.exe

Filesize
1.1MB

MD5
d5655fb4fe869eb914f967ea1d45c1b1

SHA1
4f33ef3f8a9a5bc5de6fea723c5b23840338eb68

SHA256
9277e8132cd9460766a388b73ad8b104199a96668e0544ad97a1c2b29287cc0e

SHA512
7f0e1531e3e4da1fcff4bd94498687642e0e897c947ffcf2ed22e42f0bd3a5a9bfab05d47225e7ad093fd8593b170bbde77ec87cdd99111b512df41621e40507

Download Submit
C:\Windows\System\TYYoSkK.exe

Filesize
1.1MB

MD5
3f232bd7e4bf09e0200dcfc8f0a16422

SHA1
8bf4794894fbd53b5366e09c914efac0cc70497f

SHA256
13d7898ec48a7e5500a49dd111d2933472609aa2ca8203a546336467929b45c4

SHA512
6f6ba3ef74183861dacb36a0bdfc1d42582c175bf3aae05247e16ef9f0e680776784bc5ca048111ad1a49de7bff98a3e9b1327f69ada1b4e22af1d0b7aa6f100

Download Submit
C:\Windows\System\UlLmBaP.exe

Filesize
1.1MB

MD5
17ced7e1d6a327f44c3306044b705805

SHA1
a49263e69001013d243266f475d746807836c69b

SHA256
c7f8a1ad89bc972ec278d72b96eb80e4bfced2e3a6c822e36cb838fd94273fb1

SHA512
800c93fe1ab9a8cdcab23523fe7bc7131c1754e5f0ed5a5b9af106c78a35b35cf72b3bcea6e3e4edfb400b853a95e57e337dbe7b8937754229fe45f9b07fca76

Download Submit
C:\Windows\System\aYIXhRs.exe

Filesize
1.1MB

MD5
3d1628a39a6820fadd51fb80c46033ec

SHA1
3f40ec54b7bdd8d973175938f375b4cbdfc7b7e2

SHA256
ff540dd0e5173f75dfc46cc64c631d535b88e60383d022d4b79af28d396e9cd3

SHA512
439b6f7801881a73e1364a3298176e79618742cb7335be627dea227c14cc4d951a7c9272a2764f2d5907f33b29a9c1c854af7c01ac6669bda4622349dce23f3b

Download Submit
C:\Windows\System\bJCBLKc.exe

Filesize
1.1MB

MD5
55810754a6aba5bf90a0a4d92ab22cb5

SHA1
b10d833daaadd8fb610374770843668fa4ed84ff

SHA256
219dd1441abec31b6835584da3211de90473d994ab1845923b1e9f8bdc47130c

SHA512
55b99910758874e5761b56168657d149a9acdc56bf84580804862489f9ae92f0e2aa875461dc058fe85284b1c244bed1bc81505d3849777c08a9ad4929f181be

Download Submit
C:\Windows\System\deNUXQj.exe

Filesize
8B

MD5
1760839b55220a7273e7d4b611c74c68

SHA1
103d0fb94267a08347d76b7f783580d0e8e0b885

SHA256
a315866ff3a2e83d464225dee35eee1c9c3c5c8cf80f428c1a2be919ef8e5308

SHA512
9aa273824c918fff1a8f949f96ecc4186c5d9dc2c78485b69fef096e69f14e16fa261d1ef4a0562a7adc2a0ac88d7b17e54cee7522a0b1b90a0eaf65b0fe5524

Download Submit
C:\Windows\System\gMMBXsY.exe

Filesize
1.1MB

MD5
80a6c5a798ee18dd358a34496e428dd0

SHA1
90d08bd1f729dac196dc6d29571b0a16c7578a2f

SHA256
4ddb24e39c907df87d0dae8d4036001cc48afd4d8405fd5a85d0c7c6419cb75d

SHA512
25503a470b3314f13b646a54f84a288aa687a339dc14256d84379f924368d9f6f2a9c44abddbce24ce8d6c0402dcdec157dba7aac6043c4c1e2ddd91cad93a7c

Download Submit
C:\Windows\System\hlzWTqC.exe

Filesize
1.1MB

MD5
ebe95c8fea490a0cbeb7696406c77e1f

SHA1
620caec5eee2767c51329e10d01d3f58f067ee6c

SHA256
4c83dfa4dee2062fee13b4e3bdd6aa07f843ca073d20237e06ff5169c9633e6b

SHA512
6c5cb022ccc684a8eb1b209b53a880e6daf7b4a931b7affa1192d317b2e1c2d95a90f5e00a521f916f10d64687f312c72a8be6027a2015eb07ac9f4701dabc22

Download Submit
C:\Windows\System\iXqhulL.exe

Filesize
1.1MB

MD5
24fefb3ebceb3540c1b9aa54bc028806

SHA1
6d3bb9781b4a34c6b80e391336af300446339580

SHA256
a608189fc126c28042ba69ae5ec906c7921234da4993e0f79c3f76eb2947712e

SHA512
9c83025c44c9067e04990c3a4a87a6f1b9714953934ac721241bb9b2e5d5e0cd11f444ab6fbdf9169d0051aaa85a0765cfce4ae9eea7ff878f4b7a1bbce08098

Download Submit
C:\Windows\System\ifdyHPt.exe

Filesize
1.1MB

MD5
fa19bd2b6f3feb0f68b18a682d077e08

SHA1
399e8dc05ff60cd3769130480c9718e52cd5a8f8

SHA256
f467381d54353003b1330aff10843e7d60661797b88b69f970c8510ee7b030f5

SHA512
8d1b3b18ea179a3ce9243430201c046dd6564d3f345abef42ead708859e4ff2fc16a2ab3ef4400fe9a881e53c7bb0eb7fc4c97701c5b965c9673c886c08e9ca8

Download Submit
C:\Windows\System\jeQWxuy.exe

Filesize
1.1MB

MD5
f3ea0f601d9cb2d637ad1dfd4f57afd0

SHA1
045ddb3c3628f055205fc72324dbf6f746f862b1

SHA256
f2a50a921620c57c91f83c57e2f8722e926756e071e46092968a15cd004939ed

SHA512
1a42bb7813df74b1d71951cb977bf8ee7268308c62f69edf73f6763d406aa3575ff944530a290c3c10576ae528371b5b0ec1f52e204e0ae9833e222ea4ea577d

Download Submit
C:\Windows\System\kLtAFXN.exe

Filesize
1.1MB

MD5
00c8697b20b5e8e422e79f7bbebf8529

SHA1
016d9747be18174d7dee949ffa946dc15f8fd319

SHA256
468019ce82c0178d43cecc8ae8e58f54d85aebc56fab4c1f8d19dce4a4fe7aa7

SHA512
29ffd85b62ee948340a204196c128667a80ffbd765826bf7c21a99aebb043e49496470ff6e5c7ae20a41f78066616ec2e9c0c940488dfcb4813657995c72f5ca

Download Submit
C:\Windows\System\mDDoJQi.exe

Filesize
1.1MB

MD5
9a2d41f012bf30c3f2c4130c227ff1d5

SHA1
7416d6965c7e4f9dec02e13e0c8a3aaea6903cde

SHA256
3ed62b5860378268fd972dbe4c968abfc07370f899bfdbf265fcaa0d97220b22

SHA512
55182b48cb836575503c7fba3d74a4e78978b554bcf83cabecdb54286bd9adb1608860442ea5bf359e5b39b236995731fcae40ce9ec7a2ee72bb508a8252eb15

Download Submit
C:\Windows\System\mVuGisL.exe

Filesize
1.1MB

MD5
31308479d86de67102fc519896da36d5

SHA1
f96a8225f305fcb14667de377f10e5dd9859fb6e

SHA256
2a024d5063f3905ae2342711ca39a5f734cac0d836226e8d35886f16bc2f8593

SHA512
148e9c6ec27adee96019a73d858dd72882dbf4f9fd9aecd58bdc1cd288c151f7d2ce3a3528dab307ee8fdbc67734498bca00c32a4267fe63b11dd339e52ef17c

Download Submit
C:\Windows\System\mitLMZQ.exe

Filesize
1.1MB

MD5
2ff051f98b316fc51956f86f827c7928

SHA1
017f9ae3d92a721cb18e0539c81e96231c9b5a48

SHA256
5ec96b5d9306aaec41d0e78f60ddddd53bcc61eb38cb4b7f05dc1ee6c2a32e0e

SHA512
0aaf0645501d827f010cca7424e47eac9d96ea112f152cb4ed80ef12e164fe42952be579bd3f78699b6f65fd74a58d335bbc39987b7a56a750a2272d4aae5d6d

Download Submit
C:\Windows\System\oWKebkR.exe

Filesize
1.1MB

MD5
099a27e205a1e995b5fa5643eb380b8c

SHA1
94793531337929bb9b2d304b35a5f57d2fd4cc61

SHA256
15c2584b492d2d34389f49cbaa1d897bf2a9b8e769953b23f547c08a3d1a2e6b

SHA512
140eecd16292451a85eb8906c6f9394ed77392446b80b3f453dec6abc0b0ff518c8009ad093f584ad7834761ad731a60a737d80cc1b115b7e55049e3d766d527

Download Submit
C:\Windows\System\pCVVbND.exe

Filesize
1.1MB

MD5
000cc3af3e2c8bb3392a3231f166b6b1

SHA1
db1dde8f607fa7bf66b6ddb5a4f2802095b7c289

SHA256
809e5c8de06ed7e94a41f7ce8afe01646841d9e0c0d16fd933489008b30245e6

SHA512
d91b6359aaff37b4a4667e94eff62be0f8eb164abe296a96e09967d79e70de4a2f22c4a7de6290bcab97ed90707f821e4f8b222580b53f6ff649c38c96c59a58

Download Submit
C:\Windows\System\pSypsCo.exe

Filesize
1.1MB

MD5
f29fa326808912dc31d0b21673d05070

SHA1
0ea33dc39d2c7137e0d0788f996bec0c273f81e5

SHA256
171055e399ade9b6a21f87ae2426a8135f27fb9f8a076539dba6054a6b7d4c41

SHA512
abc4b52a2849efc7ce8746aa46902d4772fb9d539fabca3acafc4bfcee79ffcfb1dcf48bf9dca459d1fa8bbf77478733fe566df307c9baf0302fd6b8f99223c6

Download Submit
C:\Windows\System\paIqRjr.exe

Filesize
1.1MB

MD5
47adce788280a46667e961d40d4effe1

SHA1
ded2765cb43c96324b97ef5d2103046b19fc9722

SHA256
311c883a5fde6e3f66d06d0787c47f7734d4e4f565619fa4bb304dd683544963

SHA512
edbce933daacf4411ca89f2749adcbdfff93f0acfca7f457a3f74efce4acf66f5e5f7cd2cc26c3071fbc359c89036872ca9b9c67140894f85ba9078b2dca9731

Download Submit
C:\Windows\System\pakcPnH.exe

Filesize
1.1MB

MD5
c1a7c3724343490c7a4ec7d5e58ccaa2

SHA1
f27cae99a2e42f2b02a754de710f4f3a2b589ff8

SHA256
2a76ce41138bca9988c8f74367f062928caf4d7fb12da14166a9ae12f1a32157

SHA512
a42d61577dcfe5773c0cbb97990638297c6c3995235de0d361b2eaf0c6ea29c7422738c9250cd979995ac225b321c585205a3388c45e221fa48e8a97bbb42af1

Download Submit
C:\Windows\System\pwJatFa.exe

Filesize
1.1MB

MD5
b82297f908e0eca3d214c73829f6c637

SHA1
71fbcae11a129c493ccc3d5f608ebb9948d31302

SHA256
f85b40d90697c1a4bbc356e8884b2a1ef336e5314e47c87c3c99dbfd7e49720f

SHA512
c0d798926c983bd00e036f6f4c8adeee07dde43fbd0f0ae201ca65c09ceca6b8d1327c451921ac81488504d41596de16642fb2bbf3930ef60b10da6f41e3d5ff

Download Submit
C:\Windows\System\qSEaqHX.exe

Filesize
1.1MB

MD5
fc8994a8370ebfd9704dbe4ebfb76b69

SHA1
2748d12d8c2170a3ea95d481830bdd1989f8f67a

SHA256
9f5248e5f0dc6a3f46817ec80c5027f27dcdbb56bca631d2ef885782c674b5dc

SHA512
80d72dc02b808240fee817710ce293afb0c6dc5dcb326dc9228ce9e0f64d23be1614d3f7675084b7ec51ab0ea1f493356a54bf56ce884bf489ba1ff8fd29612f

Download Submit
C:\Windows\System\qicCEEW.exe

Filesize
1.1MB

MD5
9315e6bf2eb3b1fb6d2ca1d0273099c2

SHA1
8e87110a229a8bcbe8ae23c352ff11c09ec39ee7

SHA256
3510bc9535e10a951dc75ca66f6e3dad4b15c24bd0f576a19efb4885ca58c004

SHA512
981d0d7f1196170a3819fd03f3a01257f5b0822aa79c24be332135b994fe36c8a0d2bd3b04527f7fd898a34630238d280dfbcb96b5047eb0aee1fec70eb72e84

Download Submit
C:\Windows\System\quczOEh.exe

Filesize
1.1MB

MD5
dbd5c1c6317ad45fbca263a6269e1f41

SHA1
5a27265f1babb53b35cc29b1609833ab167ef717

SHA256
c84d93485460ebb59da9cde3a963e06a5f6228ee846fab56b852ea4f47059e95

SHA512
405fa960cdc89ad02bf6f374b4d47a308d882851e0d308093df39fefc4f3ba8bc8a180e2fbd2949bae401797591bb02d4f2bd7a5fa3179fd434dbb4ea2c06103

Download Submit
C:\Windows\System\rZCBGoI.exe

Filesize
1.1MB

MD5
724c76fe868228f8fef19f4fa6621980

SHA1
7f0b6ce367fe7b4ad3a5297cc8edddc7e6fa1cfb

SHA256
8b50f640f2d2663785f8395b68f4c2f46a3f2d2e936ce2ee283a46775cfbf56e

SHA512
bd6d29aee8a3aa06376947880c8240781df500b49758ba70222dfcbd6167af6aa524c2e22edcbefbde7981c5c3bdeef496ae588ab960a4a4392bb9fe9ea2be53

Download Submit
C:\Windows\System\sKKqBCT.exe

Filesize
1.1MB

MD5
20eb2b8f859889d6be58fc8b7a4e5bd0

SHA1
d67d2e96bdac85c46bd2820930be0043ea4257e9

SHA256
20aba6ecc2e696a48c10599ede93d9c5fa5e57f35e9277ba886932a7b973af2a

SHA512
ff75de6c9104443767c859df63f559e76560d6e89931d452effa7334db5b28218043955238682f7818182060f756d33502db8c340ec1cabd8f7af46600652af1

Download Submit
C:\Windows\System\tUIwWxH.exe

Filesize
1.1MB

MD5
ed54472e8aa951b810bf5c93ae414717

SHA1
2f192949dfd2c7e6be2c516f501ec599670ffe69

SHA256
e5944d3290d3a64a7a50a78b8edfd77140a783603cfd82f26a74878bdbdbd60d

SHA512
ffbc91fe97ed25db875cc4175de7df697c68124436ed289e61262fe3557c806bd9d370d81ea2cfbb850c15186b11f24f5ff12bddaaea1eaaa4f2cd4f629b30b9

Download Submit
C:\Windows\System\vFDbfFK.exe

Filesize
1.1MB

MD5
90aee3eb45a64ef4d1041e4ce811ba49

SHA1
c52319fe1448aaafe68af210f640d82cbdf7cf91

SHA256
9c900cfc9a0226e190313083fe47de8d60eaf2097a0e05f2397f869ba8b6fa2e

SHA512
e215d3f0ad18f9d5801e8aa86d0657b9b0082aee0f2a63aaf8fe65c4760a0da98e24a11fca4c5b8e6833b6322b51e4576754d0a69b33525e27693b8ba6109de3

Download Submit
C:\Windows\System\waazjXU.exe

Filesize
1.1MB

MD5
ed18974fe17cb99c45f4e81f57acf7e7

SHA1
f254ff4a34d99bf5d5ee178dc20786c34e44f970

SHA256
c62965606c8b4d9789c78bd8b12ebfd1bb62267e28b53161452c76c0e4ef509f

SHA512
05b49a6d72482eb8d2825ee0359501c68059c3c75b8e24b05aca2d7caae5cf6445db964c12ce90a41e67571ef41ecccc61c082d94cb31158396c7f25067f9e38

Download Submit
C:\Windows\System\yQBIAVt.exe

Filesize
1.1MB

MD5
4cad3a106e39bf7662739fd6b95527cc

SHA1
23154f0d3ad0392a9af6356d54486aa0550d99a4

SHA256
af3a9c48f59c5531e8f171e6ef72fd68b4fcf86ff230b793fdbc7198a007ba09

SHA512
2346f5d73b0ab45154e7d09e63c30b77ae5a42e420d574a89f48018874cac504c0b7b03200dda175164f3e88b1fd73362ed35c5344289fa4eb25f1a8b3baf908

Download Submit
memory/588-6478-0x00007FF745FD0000-0x00007FF7463C2000-memory.dmp

Filesize
3.9MB

Download
memory/588-767-0x00007FF745FD0000-0x00007FF7463C2000-memory.dmp

Filesize
3.9MB

Download
memory/780-143-0x00007FF72FAB0000-0x00007FF72FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/780-6289-0x00007FF72FAB0000-0x00007FF72FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1004-769-0x00007FF6D05A0000-0x00007FF6D0992000-memory.dmp

Filesize
3.9MB

Download
memory/1340-778-0x00007FF7E17C0000-0x00007FF7E1BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1340-6311-0x00007FF7E17C0000-0x00007FF7E1BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-6537-0x00007FF6C5720000-0x00007FF6C5B12000-memory.dmp

Filesize
3.9MB

Download
memory/1460-776-0x00007FF6C5720000-0x00007FF6C5B12000-memory.dmp

Filesize
3.9MB

Download
memory/1528-770-0x00007FF784A20000-0x00007FF784E12000-memory.dmp

Filesize
3.9MB

Download
memory/1608-92-0x00007FFBF81B0000-0x00007FFBF8C71000-memory.dmp

Filesize
10.8MB

Download
memory/1608-396-0x0000021BE5FB0000-0x0000021BE5FD2000-memory.dmp

Filesize
136KB

Download
memory/1608-6-0x00007FFBF81B3000-0x00007FFBF81B5000-memory.dmp

Filesize
8KB

Download
memory/1608-777-0x00007FFBF81B0000-0x00007FFBF8C71000-memory.dmp

Filesize
10.8MB

Download
memory/1656-6453-0x00007FF7587C0000-0x00007FF758BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1656-326-0x00007FF7587C0000-0x00007FF758BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-773-0x00007FF6DDA40000-0x00007FF6DDE32000-memory.dmp

Filesize
3.9MB

Download
memory/2116-775-0x00007FF74C2C0000-0x00007FF74C6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-771-0x00007FF778C40000-0x00007FF779032000-memory.dmp

Filesize
3.9MB

Download
memory/2132-6509-0x00007FF778C40000-0x00007FF779032000-memory.dmp

Filesize
3.9MB

Download
memory/2348-762-0x00007FF60E0F0000-0x00007FF60E4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-768-0x00007FF6FF820000-0x00007FF6FFC12000-memory.dmp

Filesize
3.9MB

Download
memory/2548-6592-0x00007FF6FF820000-0x00007FF6FFC12000-memory.dmp

Filesize
3.9MB

Download
memory/2840-6644-0x00007FF734AE0000-0x00007FF734ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2840-774-0x00007FF734AE0000-0x00007FF734ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-491-0x00007FF7E5DB0000-0x00007FF7E61A2000-memory.dmp

Filesize
3.9MB

Download
memory/3312-6516-0x00007FF605030000-0x00007FF605422000-memory.dmp

Filesize
3.9MB

Download
memory/3312-779-0x00007FF605030000-0x00007FF605422000-memory.dmp

Filesize
3.9MB

Download
memory/3376-6347-0x00007FF64C9F0000-0x00007FF64CDE2000-memory.dmp

Filesize
3.9MB

Download
memory/3376-232-0x00007FF64C9F0000-0x00007FF64CDE2000-memory.dmp

Filesize
3.9MB

Download
memory/3552-0-0x00007FF723CC0000-0x00007FF7240B2000-memory.dmp

Filesize
3.9MB

Download
memory/3552-1-0x0000021840170000-0x0000021840180000-memory.dmp

Filesize
64KB

Download
memory/3732-688-0x00007FF6DB4B0000-0x00007FF6DB8A2000-memory.dmp

Filesize
3.9MB

Download
memory/3800-766-0x00007FF7CD8A0000-0x00007FF7CDC92000-memory.dmp

Filesize
3.9MB

Download
memory/3904-764-0x00007FF7AA640000-0x00007FF7AAA32000-memory.dmp

Filesize
3.9MB

Download
memory/3904-6532-0x00007FF7AA640000-0x00007FF7AAA32000-memory.dmp

Filesize
3.9MB

Download
memory/4140-765-0x00007FF6C3A00000-0x00007FF6C3DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4172-13-0x00007FF64C820000-0x00007FF64CC12000-memory.dmp

Filesize
3.9MB

Download
memory/4172-6295-0x00007FF64C820000-0x00007FF64CC12000-memory.dmp

Filesize
3.9MB

Download
memory/4208-440-0x00007FF636350000-0x00007FF636742000-memory.dmp

Filesize
3.9MB

Download
memory/5084-763-0x00007FF6E8D40000-0x00007FF6E9132000-memory.dmp

Filesize
3.9MB

Download
memory/5116-772-0x00007FF78A730000-0x00007FF78AB22000-memory.dmp

Filesize
3.9MB

Download