xmrig | 2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
Size

2.4MB
MD5

5d4c5ef069e129e214f79f4d40a7ce20
SHA1

65e10ccf4cb96eef6ff34287917d1ef6072b6f32
SHA256

2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69
SHA512

3dbdbc35e931ce099546dcce012426e317ea4c51a751523b615d8615d4833a993b0cc6d5595afebe8176713515bcf21a752793de427305ad51256eccecd3e0a4
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w1fZGWM:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral1/memory/1724-1-0x000000013F3A0000-0x000000013F796000-memory.dmp	xmrig
behavioral1/files/0x000b00000001444f-5.dat	xmrig
behavioral1/files/0x0031000000014665-11.dat	xmrig
behavioral1/memory/2740-24-0x000000013F200000-0x000000013F5F6000-memory.dmp	xmrig
behavioral1/files/0x001400000000549e-31.dat	xmrig
behavioral1/files/0x0007000000014b12-26.dat	xmrig
behavioral1/files/0x0008000000014e5a-40.dat	xmrig
behavioral1/files/0x0006000000015cad-61.dat	xmrig
behavioral1/memory/1228-66-0x000000013FEF0000-0x00000001402E6000-memory.dmp	xmrig
behavioral1/memory/2524-69-0x000000013F7E0000-0x000000013FBD6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cdb-94.dat	xmrig
behavioral1/files/0x0006000000015d6e-119.dat	xmrig
behavioral1/files/0x0006000000016277-144.dat	xmrig
behavioral1/files/0x00060000000167ef-164.dat	xmrig
behavioral1/files/0x0006000000016c17-174.dat	xmrig
behavioral1/files/0x0006000000016c2e-184.dat	xmrig
behavioral1/memory/1724-1268-0x000000013F3A0000-0x000000013F796000-memory.dmp	xmrig
behavioral1/files/0x0006000000016c7a-189.dat	xmrig
behavioral1/files/0x0006000000016c26-179.dat	xmrig
behavioral1/files/0x0006000000016a45-169.dat	xmrig
behavioral1/files/0x0006000000016597-159.dat	xmrig
behavioral1/files/0x0006000000016411-149.dat	xmrig
behavioral1/files/0x0006000000016525-154.dat	xmrig
behavioral1/files/0x00060000000160f8-139.dat	xmrig
behavioral1/files/0x0006000000015f9e-129.dat	xmrig
behavioral1/files/0x0006000000016056-134.dat	xmrig
behavioral1/files/0x0006000000015f1b-124.dat	xmrig
behavioral1/files/0x0006000000015d5d-114.dat	xmrig
behavioral1/files/0x0006000000015d06-109.dat	xmrig
behavioral1/files/0x0006000000015cf7-104.dat	xmrig
behavioral1/files/0x0006000000015cec-99.dat	xmrig
behavioral1/memory/2832-91-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cca-88.dat	xmrig
behavioral1/memory/2828-84-0x000000013F930000-0x000000013FD26000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cb9-76.dat	xmrig
behavioral1/memory/1968-72-0x000000013F660000-0x000000013FA56000-memory.dmp	xmrig
behavioral1/memory/2700-83-0x000000013F710000-0x000000013FB06000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cc1-80.dat	xmrig
behavioral1/memory/2464-64-0x000000013F080000-0x000000013F476000-memory.dmp	xmrig
behavioral1/memory/2552-57-0x000000013FB40000-0x000000013FF36000-memory.dmp	xmrig
behavioral1/files/0x0007000000015ca5-54.dat	xmrig
behavioral1/memory/2728-52-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/memory/2896-29-0x000000013F0B0000-0x000000013F4A6000-memory.dmp	xmrig
behavioral1/files/0x0009000000015136-47.dat	xmrig
behavioral1/memory/2592-23-0x000000013F690000-0x000000013FA86000-memory.dmp	xmrig
behavioral1/files/0x00070000000149ea-10.dat	xmrig
behavioral1/memory/2592-4372-0x000000013F690000-0x000000013FA86000-memory.dmp	xmrig
behavioral1/memory/2896-4373-0x000000013F0B0000-0x000000013F4A6000-memory.dmp	xmrig
behavioral1/memory/2740-4374-0x000000013F200000-0x000000013F5F6000-memory.dmp	xmrig
behavioral1/memory/2524-4375-0x000000013F7E0000-0x000000013FBD6000-memory.dmp	xmrig
behavioral1/memory/2464-4376-0x000000013F080000-0x000000013F476000-memory.dmp	xmrig
behavioral1/memory/2728-4377-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/memory/2552-4378-0x000000013FB40000-0x000000013FF36000-memory.dmp	xmrig
behavioral1/memory/1968-4380-0x000000013F660000-0x000000013FA56000-memory.dmp	xmrig
behavioral1/memory/2700-4379-0x000000013F710000-0x000000013FB06000-memory.dmp	xmrig
behavioral1/memory/2828-4381-0x000000013F930000-0x000000013FD26000-memory.dmp	xmrig
behavioral1/memory/1228-4382-0x000000013FEF0000-0x00000001402E6000-memory.dmp	xmrig
behavioral1/memory/2832-4383-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2872	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2592	QDuwWIW.exe
2740	uEnNlso.exe
2896	KvFQZRS.exe
2728	BsqktFa.exe
2552	zlwYyrG.exe
2524	EOczAej.exe
2464	HYvXmJz.exe
1968	ckUHLXf.exe
1228	XxiKrXm.exe
2700	KJtxnVL.exe
2828	FNRMZBc.exe
2832	MBFESnI.exe
1884	dQvrLUs.exe
320	QUuPiZd.exe
1248	DjCQHeM.exe
2412	tnKbZcy.exe
1460	EKRgCRB.exe
1336	sHjJuOa.exe
1212	zMUJBKp.exe
2988	hYhyoNh.exe
2276	xEhvhgO.exe
2836	kXKtTVo.exe
2252	kgeDNFz.exe
540	xrMatUN.exe
788	WWokRZq.exe
656	jiuFjIR.exe
1792	PzMnsXA.exe
1796	dhBybzs.exe
1864	ZDpaqPy.exe
2996	VwdgvCP.exe
2420	IkvRass.exe
2356	PDSoBMo.exe
352	CrDmkBF.exe
1320	RNmkntj.exe
1496	BHSIIVB.exe
1312	PYTAtlw.exe
972	RcWxFpA.exe
1648	iyxWVfB.exe
332	mACLzIu.exe
960	hAlsrWi.exe
856	cLUCJcE.exe
2900	pnEZNLT.exe
2092	hGwVwhL.exe
2100	RkpxfZU.exe
568	jdRRtGv.exe
1196	VIgOwYO.exe
2124	KgIXHCB.exe
2876	MCqPNil.exe
1748	nIGOFep.exe
2044	wkXAnZs.exe
1944	UhjCQij.exe
1544	pyfTalJ.exe
2144	HoYZPma.exe
2732	keMYWuL.exe
2456	cqVKsdg.exe
2752	KTREoMS.exe
2652	yxRXSHc.exe
3020	crgemty.exe
2712	tVoMtJv.exe
2676	Fxsoedr.exe
2820	HcxwXMw.exe
1528	sxLJaMq.exe
1508	DOFArwS.exe
292	iYPCAlV.exe

Loads dropped DLL 64 IoCs

pid	Process
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-1-0x000000013F3A0000-0x000000013F796000-memory.dmp	upx
behavioral1/files/0x000b00000001444f-5.dat	upx
behavioral1/files/0x0031000000014665-11.dat	upx
behavioral1/memory/2740-24-0x000000013F200000-0x000000013F5F6000-memory.dmp	upx
behavioral1/files/0x001400000000549e-31.dat	upx
behavioral1/files/0x0007000000014b12-26.dat	upx
behavioral1/files/0x0008000000014e5a-40.dat	upx
behavioral1/files/0x0006000000015cad-61.dat	upx
behavioral1/memory/1228-66-0x000000013FEF0000-0x00000001402E6000-memory.dmp	upx
behavioral1/memory/2524-69-0x000000013F7E0000-0x000000013FBD6000-memory.dmp	upx
behavioral1/files/0x0006000000015cdb-94.dat	upx
behavioral1/files/0x0006000000015d6e-119.dat	upx
behavioral1/files/0x0006000000016277-144.dat	upx
behavioral1/files/0x00060000000167ef-164.dat	upx
behavioral1/files/0x0006000000016c17-174.dat	upx
behavioral1/files/0x0006000000016c2e-184.dat	upx
behavioral1/memory/1724-1268-0x000000013F3A0000-0x000000013F796000-memory.dmp	upx
behavioral1/files/0x0006000000016c7a-189.dat	upx
behavioral1/files/0x0006000000016c26-179.dat	upx
behavioral1/files/0x0006000000016a45-169.dat	upx
behavioral1/files/0x0006000000016597-159.dat	upx
behavioral1/files/0x0006000000016411-149.dat	upx
behavioral1/files/0x0006000000016525-154.dat	upx
behavioral1/files/0x00060000000160f8-139.dat	upx
behavioral1/files/0x0006000000015f9e-129.dat	upx
behavioral1/files/0x0006000000016056-134.dat	upx
behavioral1/files/0x0006000000015f1b-124.dat	upx
behavioral1/files/0x0006000000015d5d-114.dat	upx
behavioral1/files/0x0006000000015d06-109.dat	upx
behavioral1/files/0x0006000000015cf7-104.dat	upx
behavioral1/files/0x0006000000015cec-99.dat	upx
behavioral1/memory/2832-91-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-88.dat	upx
behavioral1/memory/2828-84-0x000000013F930000-0x000000013FD26000-memory.dmp	upx
behavioral1/files/0x0006000000015cb9-76.dat	upx
behavioral1/memory/1968-72-0x000000013F660000-0x000000013FA56000-memory.dmp	upx
behavioral1/memory/2700-83-0x000000013F710000-0x000000013FB06000-memory.dmp	upx
behavioral1/files/0x0006000000015cc1-80.dat	upx
behavioral1/memory/2464-64-0x000000013F080000-0x000000013F476000-memory.dmp	upx
behavioral1/memory/2552-57-0x000000013FB40000-0x000000013FF36000-memory.dmp	upx
behavioral1/files/0x0007000000015ca5-54.dat	upx
behavioral1/memory/2728-52-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/memory/2896-29-0x000000013F0B0000-0x000000013F4A6000-memory.dmp	upx
behavioral1/files/0x0009000000015136-47.dat	upx
behavioral1/memory/2592-23-0x000000013F690000-0x000000013FA86000-memory.dmp	upx
behavioral1/files/0x00070000000149ea-10.dat	upx
behavioral1/memory/2592-4372-0x000000013F690000-0x000000013FA86000-memory.dmp	upx
behavioral1/memory/2896-4373-0x000000013F0B0000-0x000000013F4A6000-memory.dmp	upx
behavioral1/memory/2740-4374-0x000000013F200000-0x000000013F5F6000-memory.dmp	upx
behavioral1/memory/2524-4375-0x000000013F7E0000-0x000000013FBD6000-memory.dmp	upx
behavioral1/memory/2464-4376-0x000000013F080000-0x000000013F476000-memory.dmp	upx
behavioral1/memory/2728-4377-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/memory/2552-4378-0x000000013FB40000-0x000000013FF36000-memory.dmp	upx
behavioral1/memory/1968-4380-0x000000013F660000-0x000000013FA56000-memory.dmp	upx
behavioral1/memory/2700-4379-0x000000013F710000-0x000000013FB06000-memory.dmp	upx
behavioral1/memory/2828-4381-0x000000013F930000-0x000000013FD26000-memory.dmp	upx
behavioral1/memory/1228-4382-0x000000013FEF0000-0x00000001402E6000-memory.dmp	upx
behavioral1/memory/2832-4383-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ddkTaGK.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\AtBajJW.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\KDRNRwa.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\XHFIszT.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\yOjylUC.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\stQEslP.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\ZegtDjV.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\XxIJpid.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\PtaSNja.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\txmsSdE.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\zvyLXZv.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\UAKXhwp.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\lrKijeO.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\SeRMxvM.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\owgpVFw.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\CAjHGlU.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\ASXDvEf.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\fMLsdRi.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\jDZzsUn.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\dtvhAZl.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\SRxRtnK.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\tqYpTHS.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\jBnviPU.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\VWKaQVu.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\bqiGxOf.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\DRsbuSQ.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\KfNgAdx.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\XomqEMz.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\WndcHVU.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\hksPnih.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\YKQbztc.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\BJjvFBl.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\EFpoxHL.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\DKkzCWi.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\yXheHBv.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\mPWIjRi.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\RUgvOME.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\WfaKqXq.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\Wshehcc.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\PxdfWhL.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\fJZEmcl.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\kfAHHWh.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\TKfdcpx.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\KDSsrKx.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\TufaaIB.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\fTzBoYj.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\ujhDOZm.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\OEDCDjv.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\suTYfds.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\GizGhGB.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\cYfWdjo.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\KNMggVj.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\bIGsqSf.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\ByXbTXt.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\QTsQNqT.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\MzWDgXb.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\BoAQytq.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\RKsBFmU.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\dxdkrWY.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\dBuPHyx.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\ABnOwzY.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\FpkEEmu.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\lCTaTgU.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
File created	C:\Windows\System\BsvVADs.exe	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	powershell.exe
2872	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
Token: SeLockMemoryPrivilege	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
Token: SeDebugPrivilege	2872	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2872	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	29
PID 1724 wrote to memory of 2872	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	29
PID 1724 wrote to memory of 2872	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	29
PID 1724 wrote to memory of 2592	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	30
PID 1724 wrote to memory of 2592	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	30
PID 1724 wrote to memory of 2592	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	30
PID 1724 wrote to memory of 2740	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	31
PID 1724 wrote to memory of 2740	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	31
PID 1724 wrote to memory of 2740	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	31
PID 1724 wrote to memory of 2896	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	32
PID 1724 wrote to memory of 2896	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	32
PID 1724 wrote to memory of 2896	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	32
PID 1724 wrote to memory of 2728	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	33
PID 1724 wrote to memory of 2728	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	33
PID 1724 wrote to memory of 2728	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	33
PID 1724 wrote to memory of 2552	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	34
PID 1724 wrote to memory of 2552	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	34
PID 1724 wrote to memory of 2552	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	34
PID 1724 wrote to memory of 2464	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	35
PID 1724 wrote to memory of 2464	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	35
PID 1724 wrote to memory of 2464	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	35
PID 1724 wrote to memory of 2524	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	36
PID 1724 wrote to memory of 2524	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	36
PID 1724 wrote to memory of 2524	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	36
PID 1724 wrote to memory of 1968	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	37
PID 1724 wrote to memory of 1968	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	37
PID 1724 wrote to memory of 1968	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	37
PID 1724 wrote to memory of 1228	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	38
PID 1724 wrote to memory of 1228	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	38
PID 1724 wrote to memory of 1228	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	38
PID 1724 wrote to memory of 2700	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	39
PID 1724 wrote to memory of 2700	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	39
PID 1724 wrote to memory of 2700	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	39
PID 1724 wrote to memory of 2828	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	40
PID 1724 wrote to memory of 2828	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	40
PID 1724 wrote to memory of 2828	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	40
PID 1724 wrote to memory of 2832	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	41
PID 1724 wrote to memory of 2832	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	41
PID 1724 wrote to memory of 2832	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	41
PID 1724 wrote to memory of 1884	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	42
PID 1724 wrote to memory of 1884	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	42
PID 1724 wrote to memory of 1884	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	42
PID 1724 wrote to memory of 320	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	43
PID 1724 wrote to memory of 320	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	43
PID 1724 wrote to memory of 320	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	43
PID 1724 wrote to memory of 1248	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	44
PID 1724 wrote to memory of 1248	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	44
PID 1724 wrote to memory of 1248	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	44
PID 1724 wrote to memory of 2412	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	45
PID 1724 wrote to memory of 2412	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	45
PID 1724 wrote to memory of 2412	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	45
PID 1724 wrote to memory of 1460	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	46
PID 1724 wrote to memory of 1460	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	46
PID 1724 wrote to memory of 1460	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	46
PID 1724 wrote to memory of 1336	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	47
PID 1724 wrote to memory of 1336	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	47
PID 1724 wrote to memory of 1336	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	47
PID 1724 wrote to memory of 1212	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	48
PID 1724 wrote to memory of 1212	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	48
PID 1724 wrote to memory of 1212	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	48
PID 1724 wrote to memory of 2988	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	49
PID 1724 wrote to memory of 2988	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	49
PID 1724 wrote to memory of 2988	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	49
PID 1724 wrote to memory of 2276	1724	2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe	50

C:\Users\Admin\AppData\Local\Temp\2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe
"C:\Users\Admin\AppData\Local\Temp\2651f91e851491fba29c477f6b2ce1e5b3102ed4f98d25be8a6a8d04a69c9f69.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\System\QDuwWIW.exe
  C:\Windows\System\QDuwWIW.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\uEnNlso.exe
  C:\Windows\System\uEnNlso.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\KvFQZRS.exe
  C:\Windows\System\KvFQZRS.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\BsqktFa.exe
  C:\Windows\System\BsqktFa.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\zlwYyrG.exe
  C:\Windows\System\zlwYyrG.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\HYvXmJz.exe
  C:\Windows\System\HYvXmJz.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\EOczAej.exe
  C:\Windows\System\EOczAej.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ckUHLXf.exe
  C:\Windows\System\ckUHLXf.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\XxiKrXm.exe
  C:\Windows\System\XxiKrXm.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\KJtxnVL.exe
  C:\Windows\System\KJtxnVL.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\FNRMZBc.exe
  C:\Windows\System\FNRMZBc.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\MBFESnI.exe
  C:\Windows\System\MBFESnI.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\dQvrLUs.exe
  C:\Windows\System\dQvrLUs.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\QUuPiZd.exe
  C:\Windows\System\QUuPiZd.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\DjCQHeM.exe
  C:\Windows\System\DjCQHeM.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\tnKbZcy.exe
  C:\Windows\System\tnKbZcy.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\EKRgCRB.exe
  C:\Windows\System\EKRgCRB.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\sHjJuOa.exe
  C:\Windows\System\sHjJuOa.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\zMUJBKp.exe
  C:\Windows\System\zMUJBKp.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\hYhyoNh.exe
  C:\Windows\System\hYhyoNh.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\xEhvhgO.exe
  C:\Windows\System\xEhvhgO.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\kXKtTVo.exe
  C:\Windows\System\kXKtTVo.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\kgeDNFz.exe
  C:\Windows\System\kgeDNFz.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\xrMatUN.exe
  C:\Windows\System\xrMatUN.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\WWokRZq.exe
  C:\Windows\System\WWokRZq.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\jiuFjIR.exe
  C:\Windows\System\jiuFjIR.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\PzMnsXA.exe
  C:\Windows\System\PzMnsXA.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\dhBybzs.exe
  C:\Windows\System\dhBybzs.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\ZDpaqPy.exe
  C:\Windows\System\ZDpaqPy.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\VwdgvCP.exe
  C:\Windows\System\VwdgvCP.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\IkvRass.exe
  C:\Windows\System\IkvRass.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\PDSoBMo.exe
  C:\Windows\System\PDSoBMo.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\CrDmkBF.exe
  C:\Windows\System\CrDmkBF.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\RNmkntj.exe
  C:\Windows\System\RNmkntj.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\BHSIIVB.exe
  C:\Windows\System\BHSIIVB.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\PYTAtlw.exe
  C:\Windows\System\PYTAtlw.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\RcWxFpA.exe
  C:\Windows\System\RcWxFpA.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\iyxWVfB.exe
  C:\Windows\System\iyxWVfB.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\mACLzIu.exe
  C:\Windows\System\mACLzIu.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\hAlsrWi.exe
  C:\Windows\System\hAlsrWi.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\cLUCJcE.exe
  C:\Windows\System\cLUCJcE.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\pnEZNLT.exe
  C:\Windows\System\pnEZNLT.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\hGwVwhL.exe
  C:\Windows\System\hGwVwhL.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\RkpxfZU.exe
  C:\Windows\System\RkpxfZU.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\jdRRtGv.exe
  C:\Windows\System\jdRRtGv.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\VIgOwYO.exe
  C:\Windows\System\VIgOwYO.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\KgIXHCB.exe
  C:\Windows\System\KgIXHCB.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\MCqPNil.exe
  C:\Windows\System\MCqPNil.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\nIGOFep.exe
  C:\Windows\System\nIGOFep.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\wkXAnZs.exe
  C:\Windows\System\wkXAnZs.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\UhjCQij.exe
  C:\Windows\System\UhjCQij.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\pyfTalJ.exe
  C:\Windows\System\pyfTalJ.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\HoYZPma.exe
  C:\Windows\System\HoYZPma.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\keMYWuL.exe
  C:\Windows\System\keMYWuL.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\cqVKsdg.exe
  C:\Windows\System\cqVKsdg.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\KTREoMS.exe
  C:\Windows\System\KTREoMS.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\yxRXSHc.exe
  C:\Windows\System\yxRXSHc.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\crgemty.exe
  C:\Windows\System\crgemty.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\tVoMtJv.exe
  C:\Windows\System\tVoMtJv.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\Fxsoedr.exe
  C:\Windows\System\Fxsoedr.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\HcxwXMw.exe
  C:\Windows\System\HcxwXMw.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\sxLJaMq.exe
  C:\Windows\System\sxLJaMq.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\DOFArwS.exe
  C:\Windows\System\DOFArwS.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\iYPCAlV.exe
  C:\Windows\System\iYPCAlV.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\QjpZUfD.exe
  C:\Windows\System\QjpZUfD.exe
  2⤵
  PID:1376
- C:\Windows\System\RfVosLB.exe
  C:\Windows\System\RfVosLB.exe
  2⤵
  PID:2984
- C:\Windows\System\uDXZCaW.exe
  C:\Windows\System\uDXZCaW.exe
  2⤵
  PID:2028
- C:\Windows\System\jUxZquN.exe
  C:\Windows\System\jUxZquN.exe
  2⤵
  PID:2312
- C:\Windows\System\kCGdzcD.exe
  C:\Windows\System\kCGdzcD.exe
  2⤵
  PID:268
- C:\Windows\System\oMvzRxS.exe
  C:\Windows\System\oMvzRxS.exe
  2⤵
  PID:1432
- C:\Windows\System\vVFHGxI.exe
  C:\Windows\System\vVFHGxI.exe
  2⤵
  PID:2912
- C:\Windows\System\SrDtAzJ.exe
  C:\Windows\System\SrDtAzJ.exe
  2⤵
  PID:3008
- C:\Windows\System\wxwfNnn.exe
  C:\Windows\System\wxwfNnn.exe
  2⤵
  PID:1744
- C:\Windows\System\SeIbDze.exe
  C:\Windows\System\SeIbDze.exe
  2⤵
  PID:848
- C:\Windows\System\hXKKiQC.exe
  C:\Windows\System\hXKKiQC.exe
  2⤵
  PID:1500
- C:\Windows\System\fCOmwam.exe
  C:\Windows\System\fCOmwam.exe
  2⤵
  PID:1596
- C:\Windows\System\LXHEyBN.exe
  C:\Windows\System\LXHEyBN.exe
  2⤵
  PID:1000
- C:\Windows\System\peJeRNM.exe
  C:\Windows\System\peJeRNM.exe
  2⤵
  PID:1732
- C:\Windows\System\NWgpDIb.exe
  C:\Windows\System\NWgpDIb.exe
  2⤵
  PID:2136
- C:\Windows\System\mfmlnmi.exe
  C:\Windows\System\mfmlnmi.exe
  2⤵
  PID:708
- C:\Windows\System\fDaLmRf.exe
  C:\Windows\System\fDaLmRf.exe
  2⤵
  PID:1488
- C:\Windows\System\WQFeaHX.exe
  C:\Windows\System\WQFeaHX.exe
  2⤵
  PID:2324
- C:\Windows\System\XDYWNXq.exe
  C:\Windows\System\XDYWNXq.exe
  2⤵
  PID:2240
- C:\Windows\System\dTwTiQr.exe
  C:\Windows\System\dTwTiQr.exe
  2⤵
  PID:924
- C:\Windows\System\AxDOiql.exe
  C:\Windows\System\AxDOiql.exe
  2⤵
  PID:1736
- C:\Windows\System\oTpnAyw.exe
  C:\Windows\System\oTpnAyw.exe
  2⤵
  PID:1540
- C:\Windows\System\AQqiqqa.exe
  C:\Windows\System\AQqiqqa.exe
  2⤵
  PID:1656
- C:\Windows\System\NnPLmtS.exe
  C:\Windows\System\NnPLmtS.exe
  2⤵
  PID:2884
- C:\Windows\System\kzNDnLp.exe
  C:\Windows\System\kzNDnLp.exe
  2⤵
  PID:2780
- C:\Windows\System\KIKXcVw.exe
  C:\Windows\System\KIKXcVw.exe
  2⤵
  PID:2516
- C:\Windows\System\GjfUnYN.exe
  C:\Windows\System\GjfUnYN.exe
  2⤵
  PID:2796
- C:\Windows\System\QrSnMkU.exe
  C:\Windows\System\QrSnMkU.exe
  2⤵
  PID:1564
- C:\Windows\System\QnWaSCe.exe
  C:\Windows\System\QnWaSCe.exe
  2⤵
  PID:2332
- C:\Windows\System\zQGulYj.exe
  C:\Windows\System\zQGulYj.exe
  2⤵
  PID:1972
- C:\Windows\System\GozAxXw.exe
  C:\Windows\System\GozAxXw.exe
  2⤵
  PID:2840
- C:\Windows\System\tXSojjr.exe
  C:\Windows\System\tXSojjr.exe
  2⤵
  PID:692
- C:\Windows\System\fTURgkJ.exe
  C:\Windows\System\fTURgkJ.exe
  2⤵
  PID:1588
- C:\Windows\System\vBsdeKh.exe
  C:\Windows\System\vBsdeKh.exe
  2⤵
  PID:2908
- C:\Windows\System\XTHbNUG.exe
  C:\Windows\System\XTHbNUG.exe
  2⤵
  PID:3080
- C:\Windows\System\CksvNSi.exe
  C:\Windows\System\CksvNSi.exe
  2⤵
  PID:3100
- C:\Windows\System\IjsvLCH.exe
  C:\Windows\System\IjsvLCH.exe
  2⤵
  PID:3120
- C:\Windows\System\Ahjkufz.exe
  C:\Windows\System\Ahjkufz.exe
  2⤵
  PID:3144
- C:\Windows\System\BEjCFFs.exe
  C:\Windows\System\BEjCFFs.exe
  2⤵
  PID:3164
- C:\Windows\System\OUaFHOw.exe
  C:\Windows\System\OUaFHOw.exe
  2⤵
  PID:3184
- C:\Windows\System\kYemHiG.exe
  C:\Windows\System\kYemHiG.exe
  2⤵
  PID:3204
- C:\Windows\System\qKzgahE.exe
  C:\Windows\System\qKzgahE.exe
  2⤵
  PID:3224
- C:\Windows\System\VTjQXbu.exe
  C:\Windows\System\VTjQXbu.exe
  2⤵
  PID:3244
- C:\Windows\System\zanzaaX.exe
  C:\Windows\System\zanzaaX.exe
  2⤵
  PID:3264
- C:\Windows\System\vEEdYYZ.exe
  C:\Windows\System\vEEdYYZ.exe
  2⤵
  PID:3284
- C:\Windows\System\VvjoUjW.exe
  C:\Windows\System\VvjoUjW.exe
  2⤵
  PID:3304
- C:\Windows\System\SnrLeAD.exe
  C:\Windows\System\SnrLeAD.exe
  2⤵
  PID:3324
- C:\Windows\System\FJzZRDz.exe
  C:\Windows\System\FJzZRDz.exe
  2⤵
  PID:3344
- C:\Windows\System\EIpzLyS.exe
  C:\Windows\System\EIpzLyS.exe
  2⤵
  PID:3364
- C:\Windows\System\ERhYrXl.exe
  C:\Windows\System\ERhYrXl.exe
  2⤵
  PID:3384
- C:\Windows\System\WMfegsp.exe
  C:\Windows\System\WMfegsp.exe
  2⤵
  PID:3400
- C:\Windows\System\OtoZqty.exe
  C:\Windows\System\OtoZqty.exe
  2⤵
  PID:3420
- C:\Windows\System\DTGttvk.exe
  C:\Windows\System\DTGttvk.exe
  2⤵
  PID:3444
- C:\Windows\System\CydgOIK.exe
  C:\Windows\System\CydgOIK.exe
  2⤵
  PID:3464
- C:\Windows\System\jPdEhQQ.exe
  C:\Windows\System\jPdEhQQ.exe
  2⤵
  PID:3484
- C:\Windows\System\xPfTJuz.exe
  C:\Windows\System\xPfTJuz.exe
  2⤵
  PID:3504
- C:\Windows\System\goavsHI.exe
  C:\Windows\System\goavsHI.exe
  2⤵
  PID:3524
- C:\Windows\System\tcRFFqD.exe
  C:\Windows\System\tcRFFqD.exe
  2⤵
  PID:3544
- C:\Windows\System\VXwbCxX.exe
  C:\Windows\System\VXwbCxX.exe
  2⤵
  PID:3564
- C:\Windows\System\cldMAwA.exe
  C:\Windows\System\cldMAwA.exe
  2⤵
  PID:3588
- C:\Windows\System\xAdfCcE.exe
  C:\Windows\System\xAdfCcE.exe
  2⤵
  PID:3608
- C:\Windows\System\Bxhjlwf.exe
  C:\Windows\System\Bxhjlwf.exe
  2⤵
  PID:3628
- C:\Windows\System\PimlcXF.exe
  C:\Windows\System\PimlcXF.exe
  2⤵
  PID:3648
- C:\Windows\System\wqDOIMK.exe
  C:\Windows\System\wqDOIMK.exe
  2⤵
  PID:3668
- C:\Windows\System\qKtBuii.exe
  C:\Windows\System\qKtBuii.exe
  2⤵
  PID:3688
- C:\Windows\System\KTKkjpz.exe
  C:\Windows\System\KTKkjpz.exe
  2⤵
  PID:3708
- C:\Windows\System\mzzPfyz.exe
  C:\Windows\System\mzzPfyz.exe
  2⤵
  PID:3728
- C:\Windows\System\gzYldmy.exe
  C:\Windows\System\gzYldmy.exe
  2⤵
  PID:3748
- C:\Windows\System\zvmwqjx.exe
  C:\Windows\System\zvmwqjx.exe
  2⤵
  PID:3768
- C:\Windows\System\weIKhNM.exe
  C:\Windows\System\weIKhNM.exe
  2⤵
  PID:3788
- C:\Windows\System\UuSaQMP.exe
  C:\Windows\System\UuSaQMP.exe
  2⤵
  PID:3808
- C:\Windows\System\ReXBsgn.exe
  C:\Windows\System\ReXBsgn.exe
  2⤵
  PID:3828
- C:\Windows\System\YfuvszW.exe
  C:\Windows\System\YfuvszW.exe
  2⤵
  PID:3844
- C:\Windows\System\HLYgJNt.exe
  C:\Windows\System\HLYgJNt.exe
  2⤵
  PID:3868
- C:\Windows\System\OyeWjJH.exe
  C:\Windows\System\OyeWjJH.exe
  2⤵
  PID:3888
- C:\Windows\System\dZnQkFr.exe
  C:\Windows\System\dZnQkFr.exe
  2⤵
  PID:3908
- C:\Windows\System\xWNAFtG.exe
  C:\Windows\System\xWNAFtG.exe
  2⤵
  PID:3928
- C:\Windows\System\dCnFFqQ.exe
  C:\Windows\System\dCnFFqQ.exe
  2⤵
  PID:3948
- C:\Windows\System\fVSKITc.exe
  C:\Windows\System\fVSKITc.exe
  2⤵
  PID:3964
- C:\Windows\System\HPgAYbP.exe
  C:\Windows\System\HPgAYbP.exe
  2⤵
  PID:3988
- C:\Windows\System\CjvKDBX.exe
  C:\Windows\System\CjvKDBX.exe
  2⤵
  PID:4004
- C:\Windows\System\dFCxJyH.exe
  C:\Windows\System\dFCxJyH.exe
  2⤵
  PID:4028
- C:\Windows\System\gyDJJDc.exe
  C:\Windows\System\gyDJJDc.exe
  2⤵
  PID:4044
- C:\Windows\System\jAbrBIS.exe
  C:\Windows\System\jAbrBIS.exe
  2⤵
  PID:4064
- C:\Windows\System\IHiidKh.exe
  C:\Windows\System\IHiidKh.exe
  2⤵
  PID:4084
- C:\Windows\System\wijQnQu.exe
  C:\Windows\System\wijQnQu.exe
  2⤵
  PID:704
- C:\Windows\System\iPecbLH.exe
  C:\Windows\System\iPecbLH.exe
  2⤵
  PID:2744
- C:\Windows\System\PQsVnUP.exe
  C:\Windows\System\PQsVnUP.exe
  2⤵
  PID:1760
- C:\Windows\System\FfyqBay.exe
  C:\Windows\System\FfyqBay.exe
  2⤵
  PID:1028
- C:\Windows\System\nfUnoin.exe
  C:\Windows\System\nfUnoin.exe
  2⤵
  PID:3052
- C:\Windows\System\nNgQakP.exe
  C:\Windows\System\nNgQakP.exe
  2⤵
  PID:2148
- C:\Windows\System\fQinrSy.exe
  C:\Windows\System\fQinrSy.exe
  2⤵
  PID:1696
- C:\Windows\System\tvZYBQO.exe
  C:\Windows\System\tvZYBQO.exe
  2⤵
  PID:1456
- C:\Windows\System\Nywjxkt.exe
  C:\Windows\System\Nywjxkt.exe
  2⤵
  PID:1956
- C:\Windows\System\HPfndHq.exe
  C:\Windows\System\HPfndHq.exe
  2⤵
  PID:900
- C:\Windows\System\UorUYMK.exe
  C:\Windows\System\UorUYMK.exe
  2⤵
  PID:2568
- C:\Windows\System\TZqDtzX.exe
  C:\Windows\System\TZqDtzX.exe
  2⤵
  PID:284
- C:\Windows\System\eBHkgdD.exe
  C:\Windows\System\eBHkgdD.exe
  2⤵
  PID:2960
- C:\Windows\System\DPWdthq.exe
  C:\Windows\System\DPWdthq.exe
  2⤵
  PID:2040
- C:\Windows\System\wqppvni.exe
  C:\Windows\System\wqppvni.exe
  2⤵
  PID:2940
- C:\Windows\System\fvBGQtH.exe
  C:\Windows\System\fvBGQtH.exe
  2⤵
  PID:3092
- C:\Windows\System\SPWGVoY.exe
  C:\Windows\System\SPWGVoY.exe
  2⤵
  PID:2548
- C:\Windows\System\yeACwup.exe
  C:\Windows\System\yeACwup.exe
  2⤵
  PID:3112
- C:\Windows\System\YnCIXNP.exe
  C:\Windows\System\YnCIXNP.exe
  2⤵
  PID:3180
- C:\Windows\System\Qvcaflv.exe
  C:\Windows\System\Qvcaflv.exe
  2⤵
  PID:3192
- C:\Windows\System\ExRiCOt.exe
  C:\Windows\System\ExRiCOt.exe
  2⤵
  PID:3232
- C:\Windows\System\PgLRtDx.exe
  C:\Windows\System\PgLRtDx.exe
  2⤵
  PID:3260
- C:\Windows\System\ZbYwCgp.exe
  C:\Windows\System\ZbYwCgp.exe
  2⤵
  PID:3272
- C:\Windows\System\kQywJRG.exe
  C:\Windows\System\kQywJRG.exe
  2⤵
  PID:3332
- C:\Windows\System\JFBjdyT.exe
  C:\Windows\System\JFBjdyT.exe
  2⤵
  PID:3336
- C:\Windows\System\ZILleLj.exe
  C:\Windows\System\ZILleLj.exe
  2⤵
  PID:3380
- C:\Windows\System\sPGVcAy.exe
  C:\Windows\System\sPGVcAy.exe
  2⤵
  PID:3432
- C:\Windows\System\UnIMWzl.exe
  C:\Windows\System\UnIMWzl.exe
  2⤵
  PID:3456
- C:\Windows\System\FCNJqoy.exe
  C:\Windows\System\FCNJqoy.exe
  2⤵
  PID:3472
- C:\Windows\System\GvgMwlf.exe
  C:\Windows\System\GvgMwlf.exe
  2⤵
  PID:3532
- C:\Windows\System\eVNnwVo.exe
  C:\Windows\System\eVNnwVo.exe
  2⤵
  PID:3552
- C:\Windows\System\MTyKKbl.exe
  C:\Windows\System\MTyKKbl.exe
  2⤵
  PID:3576
- C:\Windows\System\vwVbTOA.exe
  C:\Windows\System\vwVbTOA.exe
  2⤵
  PID:3596
- C:\Windows\System\dHxOQfG.exe
  C:\Windows\System\dHxOQfG.exe
  2⤵
  PID:3656
- C:\Windows\System\RJsAFTw.exe
  C:\Windows\System\RJsAFTw.exe
  2⤵
  PID:3704
- C:\Windows\System\wFreXoi.exe
  C:\Windows\System\wFreXoi.exe
  2⤵
  PID:3680
- C:\Windows\System\KiEurFs.exe
  C:\Windows\System\KiEurFs.exe
  2⤵
  PID:3724
- C:\Windows\System\GHWriAm.exe
  C:\Windows\System\GHWriAm.exe
  2⤵
  PID:3784
- C:\Windows\System\KgVgklg.exe
  C:\Windows\System\KgVgklg.exe
  2⤵
  PID:3760
- C:\Windows\System\gtnQJeI.exe
  C:\Windows\System\gtnQJeI.exe
  2⤵
  PID:3856
- C:\Windows\System\WlOwJyq.exe
  C:\Windows\System\WlOwJyq.exe
  2⤵
  PID:3840
- C:\Windows\System\mUEGqHi.exe
  C:\Windows\System\mUEGqHi.exe
  2⤵
  PID:3944
- C:\Windows\System\EZybbsb.exe
  C:\Windows\System\EZybbsb.exe
  2⤵
  PID:3972
- C:\Windows\System\AwwWCJk.exe
  C:\Windows\System\AwwWCJk.exe
  2⤵
  PID:3980
- C:\Windows\System\ULUWAGt.exe
  C:\Windows\System\ULUWAGt.exe
  2⤵
  PID:4024
- C:\Windows\System\YcZQzss.exe
  C:\Windows\System\YcZQzss.exe
  2⤵
  PID:3996
- C:\Windows\System\kwrdBUp.exe
  C:\Windows\System\kwrdBUp.exe
  2⤵
  PID:3004
- C:\Windows\System\TtIplOu.exe
  C:\Windows\System\TtIplOu.exe
  2⤵
  PID:4072
- C:\Windows\System\yfdeHvc.exe
  C:\Windows\System\yfdeHvc.exe
  2⤵
  PID:2920
- C:\Windows\System\dVLRUjJ.exe
  C:\Windows\System\dVLRUjJ.exe
  2⤵
  PID:2172
- C:\Windows\System\pLqCrtW.exe
  C:\Windows\System\pLqCrtW.exe
  2⤵
  PID:1952
- C:\Windows\System\rsELpks.exe
  C:\Windows\System\rsELpks.exe
  2⤵
  PID:3060
- C:\Windows\System\qsuGfVM.exe
  C:\Windows\System\qsuGfVM.exe
  2⤵
  PID:1676
- C:\Windows\System\gWDsPRh.exe
  C:\Windows\System\gWDsPRh.exe
  2⤵
  PID:1216
- C:\Windows\System\rPFFAyx.exe
  C:\Windows\System\rPFFAyx.exe
  2⤵
  PID:1936
- C:\Windows\System\AyadWXM.exe
  C:\Windows\System\AyadWXM.exe
  2⤵
  PID:3132
- C:\Windows\System\ZtxPzMr.exe
  C:\Windows\System\ZtxPzMr.exe
  2⤵
  PID:1852
- C:\Windows\System\XywPfCA.exe
  C:\Windows\System\XywPfCA.exe
  2⤵
  PID:3176
- C:\Windows\System\mkMZVSY.exe
  C:\Windows\System\mkMZVSY.exe
  2⤵
  PID:3152
- C:\Windows\System\LpdYBid.exe
  C:\Windows\System\LpdYBid.exe
  2⤵
  PID:3156
- C:\Windows\System\liNZYJY.exe
  C:\Windows\System\liNZYJY.exe
  2⤵
  PID:3292
- C:\Windows\System\yCXeExm.exe
  C:\Windows\System\yCXeExm.exe
  2⤵
  PID:3316
- C:\Windows\System\pEyzOxk.exe
  C:\Windows\System\pEyzOxk.exe
  2⤵
  PID:3360
- C:\Windows\System\dJfMoBJ.exe
  C:\Windows\System\dJfMoBJ.exe
  2⤵
  PID:3460
- C:\Windows\System\nIqajuq.exe
  C:\Windows\System\nIqajuq.exe
  2⤵
  PID:3540
- C:\Windows\System\cIGumBG.exe
  C:\Windows\System\cIGumBG.exe
  2⤵
  PID:3480
- C:\Windows\System\hhfdruI.exe
  C:\Windows\System\hhfdruI.exe
  2⤵
  PID:3572
- C:\Windows\System\RmrhNFJ.exe
  C:\Windows\System\RmrhNFJ.exe
  2⤵
  PID:3636
- C:\Windows\System\dPQAssy.exe
  C:\Windows\System\dPQAssy.exe
  2⤵
  PID:3740
- C:\Windows\System\EKjZTOw.exe
  C:\Windows\System\EKjZTOw.exe
  2⤵
  PID:3824
- C:\Windows\System\hEWXnUW.exe
  C:\Windows\System\hEWXnUW.exe
  2⤵
  PID:3776
- C:\Windows\System\PhiDrcL.exe
  C:\Windows\System\PhiDrcL.exe
  2⤵
  PID:3896
- C:\Windows\System\NalcxjV.exe
  C:\Windows\System\NalcxjV.exe
  2⤵
  PID:4012
- C:\Windows\System\Hxfpxvm.exe
  C:\Windows\System\Hxfpxvm.exe
  2⤵
  PID:3940
- C:\Windows\System\EFrbREZ.exe
  C:\Windows\System\EFrbREZ.exe
  2⤵
  PID:4092
- C:\Windows\System\XSfVnXU.exe
  C:\Windows\System\XSfVnXU.exe
  2⤵
  PID:916
- C:\Windows\System\uxFtdnd.exe
  C:\Windows\System\uxFtdnd.exe
  2⤵
  PID:4052
- C:\Windows\System\HhHsddD.exe
  C:\Windows\System\HhHsddD.exe
  2⤵
  PID:2976
- C:\Windows\System\WjyOlhA.exe
  C:\Windows\System\WjyOlhA.exe
  2⤵
  PID:380
- C:\Windows\System\cbIgYqn.exe
  C:\Windows\System\cbIgYqn.exe
  2⤵
  PID:2720
- C:\Windows\System\eXBrVqv.exe
  C:\Windows\System\eXBrVqv.exe
  2⤵
  PID:824
- C:\Windows\System\mXpAYEj.exe
  C:\Windows\System\mXpAYEj.exe
  2⤵
  PID:3212
- C:\Windows\System\nYIcdHx.exe
  C:\Windows\System\nYIcdHx.exe
  2⤵
  PID:3296
- C:\Windows\System\jhCOoYp.exe
  C:\Windows\System\jhCOoYp.exe
  2⤵
  PID:3136
- C:\Windows\System\TBxEpae.exe
  C:\Windows\System\TBxEpae.exe
  2⤵
  PID:3436
- C:\Windows\System\OOWzvWZ.exe
  C:\Windows\System\OOWzvWZ.exe
  2⤵
  PID:3312
- C:\Windows\System\iyeFjux.exe
  C:\Windows\System\iyeFjux.exe
  2⤵
  PID:3620
- C:\Windows\System\agVwaBI.exe
  C:\Windows\System\agVwaBI.exe
  2⤵
  PID:3520
- C:\Windows\System\cZIJzSf.exe
  C:\Windows\System\cZIJzSf.exe
  2⤵
  PID:3676
- C:\Windows\System\TkDonWW.exe
  C:\Windows\System\TkDonWW.exe
  2⤵
  PID:3684
- C:\Windows\System\bnvHnel.exe
  C:\Windows\System\bnvHnel.exe
  2⤵
  PID:3976
- C:\Windows\System\XZUcDYe.exe
  C:\Windows\System\XZUcDYe.exe
  2⤵
  PID:2396
- C:\Windows\System\oYLxwwb.exe
  C:\Windows\System\oYLxwwb.exe
  2⤵
  PID:3936
- C:\Windows\System\ioUHCEM.exe
  C:\Windows\System\ioUHCEM.exe
  2⤵
  PID:2956
- C:\Windows\System\ddvNnSR.exe
  C:\Windows\System\ddvNnSR.exe
  2⤵
  PID:1284
- C:\Windows\System\ywBxKZT.exe
  C:\Windows\System\ywBxKZT.exe
  2⤵
  PID:4108
- C:\Windows\System\PpiHxNf.exe
  C:\Windows\System\PpiHxNf.exe
  2⤵
  PID:4128
- C:\Windows\System\KaacTYe.exe
  C:\Windows\System\KaacTYe.exe
  2⤵
  PID:4148
- C:\Windows\System\LyajMSG.exe
  C:\Windows\System\LyajMSG.exe
  2⤵
  PID:4168
- C:\Windows\System\QtoBHBK.exe
  C:\Windows\System\QtoBHBK.exe
  2⤵
  PID:4188
- C:\Windows\System\wEFcknF.exe
  C:\Windows\System\wEFcknF.exe
  2⤵
  PID:4208
- C:\Windows\System\oXehpaS.exe
  C:\Windows\System\oXehpaS.exe
  2⤵
  PID:4224
- C:\Windows\System\AVWUQdF.exe
  C:\Windows\System\AVWUQdF.exe
  2⤵
  PID:4244
- C:\Windows\System\VCjWzYt.exe
  C:\Windows\System\VCjWzYt.exe
  2⤵
  PID:4264
- C:\Windows\System\GDgESgf.exe
  C:\Windows\System\GDgESgf.exe
  2⤵
  PID:4284
- C:\Windows\System\MpeGeLF.exe
  C:\Windows\System\MpeGeLF.exe
  2⤵
  PID:4308
- C:\Windows\System\NZrqVQo.exe
  C:\Windows\System\NZrqVQo.exe
  2⤵
  PID:4328
- C:\Windows\System\MMDeGCz.exe
  C:\Windows\System\MMDeGCz.exe
  2⤵
  PID:4344
- C:\Windows\System\mshGdVb.exe
  C:\Windows\System\mshGdVb.exe
  2⤵
  PID:4368
- C:\Windows\System\jNJhWut.exe
  C:\Windows\System\jNJhWut.exe
  2⤵
  PID:4388
- C:\Windows\System\fQPkGKC.exe
  C:\Windows\System\fQPkGKC.exe
  2⤵
  PID:4408
- C:\Windows\System\BkgXHao.exe
  C:\Windows\System\BkgXHao.exe
  2⤵
  PID:4424
- C:\Windows\System\MGtVtpV.exe
  C:\Windows\System\MGtVtpV.exe
  2⤵
  PID:4448
- C:\Windows\System\tQIMBsk.exe
  C:\Windows\System\tQIMBsk.exe
  2⤵
  PID:4468
- C:\Windows\System\HADdNwk.exe
  C:\Windows\System\HADdNwk.exe
  2⤵
  PID:4488
- C:\Windows\System\KvGHuCr.exe
  C:\Windows\System\KvGHuCr.exe
  2⤵
  PID:4508
- C:\Windows\System\ifjRksj.exe
  C:\Windows\System\ifjRksj.exe
  2⤵
  PID:4528
- C:\Windows\System\cWHfZPm.exe
  C:\Windows\System\cWHfZPm.exe
  2⤵
  PID:4544
- C:\Windows\System\vcGhGDG.exe
  C:\Windows\System\vcGhGDG.exe
  2⤵
  PID:4568
- C:\Windows\System\BzwEvQJ.exe
  C:\Windows\System\BzwEvQJ.exe
  2⤵
  PID:4584
- C:\Windows\System\UTgodGA.exe
  C:\Windows\System\UTgodGA.exe
  2⤵
  PID:4604
- C:\Windows\System\rdmbyBx.exe
  C:\Windows\System\rdmbyBx.exe
  2⤵
  PID:4628
- C:\Windows\System\aWHkhEh.exe
  C:\Windows\System\aWHkhEh.exe
  2⤵
  PID:4648
- C:\Windows\System\caumEwt.exe
  C:\Windows\System\caumEwt.exe
  2⤵
  PID:4668
- C:\Windows\System\CgGrNFF.exe
  C:\Windows\System\CgGrNFF.exe
  2⤵
  PID:4688
- C:\Windows\System\uLeYaCf.exe
  C:\Windows\System\uLeYaCf.exe
  2⤵
  PID:4708
- C:\Windows\System\iXOCXyQ.exe
  C:\Windows\System\iXOCXyQ.exe
  2⤵
  PID:4728
- C:\Windows\System\QkPglvA.exe
  C:\Windows\System\QkPglvA.exe
  2⤵
  PID:4744
- C:\Windows\System\gQhKXdF.exe
  C:\Windows\System\gQhKXdF.exe
  2⤵
  PID:4764
- C:\Windows\System\hEDburn.exe
  C:\Windows\System\hEDburn.exe
  2⤵
  PID:4784
- C:\Windows\System\tfYeGzd.exe
  C:\Windows\System\tfYeGzd.exe
  2⤵
  PID:4804
- C:\Windows\System\MHVYKNm.exe
  C:\Windows\System\MHVYKNm.exe
  2⤵
  PID:4820
- C:\Windows\System\coWzzep.exe
  C:\Windows\System\coWzzep.exe
  2⤵
  PID:4844
- C:\Windows\System\PxxTjbm.exe
  C:\Windows\System\PxxTjbm.exe
  2⤵
  PID:4860
- C:\Windows\System\SanrXvs.exe
  C:\Windows\System\SanrXvs.exe
  2⤵
  PID:4880
- C:\Windows\System\mulEMCb.exe
  C:\Windows\System\mulEMCb.exe
  2⤵
  PID:4896
- C:\Windows\System\cCrBPcM.exe
  C:\Windows\System\cCrBPcM.exe
  2⤵
  PID:4916
- C:\Windows\System\DFnEjEs.exe
  C:\Windows\System\DFnEjEs.exe
  2⤵
  PID:4936
- C:\Windows\System\dLRPgPI.exe
  C:\Windows\System\dLRPgPI.exe
  2⤵
  PID:4956
- C:\Windows\System\FGRTDkD.exe
  C:\Windows\System\FGRTDkD.exe
  2⤵
  PID:4976
- C:\Windows\System\gbYghoL.exe
  C:\Windows\System\gbYghoL.exe
  2⤵
  PID:5000
- C:\Windows\System\NuqMLDo.exe
  C:\Windows\System\NuqMLDo.exe
  2⤵
  PID:5028
- C:\Windows\System\PGcPJrs.exe
  C:\Windows\System\PGcPJrs.exe
  2⤵
  PID:5048
- C:\Windows\System\uwiLEqL.exe
  C:\Windows\System\uwiLEqL.exe
  2⤵
  PID:5068
- C:\Windows\System\qOrIOYI.exe
  C:\Windows\System\qOrIOYI.exe
  2⤵
  PID:5088
- C:\Windows\System\ObLrhro.exe
  C:\Windows\System\ObLrhro.exe
  2⤵
  PID:5108
- C:\Windows\System\LpIGrbP.exe
  C:\Windows\System\LpIGrbP.exe
  2⤵
  PID:2404
- C:\Windows\System\MmwSXQy.exe
  C:\Windows\System\MmwSXQy.exe
  2⤵
  PID:1004
- C:\Windows\System\rNWlMkj.exe
  C:\Windows\System\rNWlMkj.exe
  2⤵
  PID:1904
- C:\Windows\System\Klzfzst.exe
  C:\Windows\System\Klzfzst.exe
  2⤵
  PID:3584
- C:\Windows\System\uUnVVOi.exe
  C:\Windows\System\uUnVVOi.exe
  2⤵
  PID:3160
- C:\Windows\System\ZhfxqTR.exe
  C:\Windows\System\ZhfxqTR.exe
  2⤵
  PID:3600
- C:\Windows\System\bYeySfx.exe
  C:\Windows\System\bYeySfx.exe
  2⤵
  PID:3756
- C:\Windows\System\EHLataC.exe
  C:\Windows\System\EHLataC.exe
  2⤵
  PID:3960
- C:\Windows\System\gDfjcMx.exe
  C:\Windows\System\gDfjcMx.exe
  2⤵
  PID:3696
- C:\Windows\System\lxkbwyx.exe
  C:\Windows\System\lxkbwyx.exe
  2⤵
  PID:1804
- C:\Windows\System\IeDthCI.exe
  C:\Windows\System\IeDthCI.exe
  2⤵
  PID:2508
- C:\Windows\System\ElyMTHC.exe
  C:\Windows\System\ElyMTHC.exe
  2⤵
  PID:4136
- C:\Windows\System\gbQyrQo.exe
  C:\Windows\System\gbQyrQo.exe
  2⤵
  PID:4160
- C:\Windows\System\xFqllGl.exe
  C:\Windows\System\xFqllGl.exe
  2⤵
  PID:4204
- C:\Windows\System\aYTtlsE.exe
  C:\Windows\System\aYTtlsE.exe
  2⤵
  PID:4236
- C:\Windows\System\nfqhUow.exe
  C:\Windows\System\nfqhUow.exe
  2⤵
  PID:4272
- C:\Windows\System\phWTfMH.exe
  C:\Windows\System\phWTfMH.exe
  2⤵
  PID:4296
- C:\Windows\System\nzVjxDA.exe
  C:\Windows\System\nzVjxDA.exe
  2⤵
  PID:4320
- C:\Windows\System\MXhzAQu.exe
  C:\Windows\System\MXhzAQu.exe
  2⤵
  PID:4360
- C:\Windows\System\MIYALeN.exe
  C:\Windows\System\MIYALeN.exe
  2⤵
  PID:4340
- C:\Windows\System\IQavpzk.exe
  C:\Windows\System\IQavpzk.exe
  2⤵
  PID:4380
- C:\Windows\System\OMZSkES.exe
  C:\Windows\System\OMZSkES.exe
  2⤵
  PID:4384
- C:\Windows\System\NfipAXr.exe
  C:\Windows\System\NfipAXr.exe
  2⤵
  PID:4464
- C:\Windows\System\xMxyKcG.exe
  C:\Windows\System\xMxyKcG.exe
  2⤵
  PID:4504
- C:\Windows\System\CBiXWaB.exe
  C:\Windows\System\CBiXWaB.exe
  2⤵
  PID:4560
- C:\Windows\System\MLzNwzJ.exe
  C:\Windows\System\MLzNwzJ.exe
  2⤵
  PID:4596
- C:\Windows\System\yGkrNDN.exe
  C:\Windows\System\yGkrNDN.exe
  2⤵
  PID:4644
- C:\Windows\System\cbfVkCa.exe
  C:\Windows\System\cbfVkCa.exe
  2⤵
  PID:4612
- C:\Windows\System\tTWbJhe.exe
  C:\Windows\System\tTWbJhe.exe
  2⤵
  PID:4620
- C:\Windows\System\HkiDAKm.exe
  C:\Windows\System\HkiDAKm.exe
  2⤵
  PID:4660
- C:\Windows\System\BpGHxLF.exe
  C:\Windows\System\BpGHxLF.exe
  2⤵
  PID:4756
- C:\Windows\System\UNCGmhW.exe
  C:\Windows\System\UNCGmhW.exe
  2⤵
  PID:4740
- C:\Windows\System\KRWSDCj.exe
  C:\Windows\System\KRWSDCj.exe
  2⤵
  PID:4772
- C:\Windows\System\bJEyRYZ.exe
  C:\Windows\System\bJEyRYZ.exe
  2⤵
  PID:4872
- C:\Windows\System\TCaSUhz.exe
  C:\Windows\System\TCaSUhz.exe
  2⤵
  PID:4912
- C:\Windows\System\EHBQroI.exe
  C:\Windows\System\EHBQroI.exe
  2⤵
  PID:4948
- C:\Windows\System\SDMeUsV.exe
  C:\Windows\System\SDMeUsV.exe
  2⤵
  PID:4996
- C:\Windows\System\voxQSnP.exe
  C:\Windows\System\voxQSnP.exe
  2⤵
  PID:4992
- C:\Windows\System\lHHupNP.exe
  C:\Windows\System\lHHupNP.exe
  2⤵
  PID:4928
- C:\Windows\System\CzMLDut.exe
  C:\Windows\System\CzMLDut.exe
  2⤵
  PID:4964
- C:\Windows\System\nhrooFr.exe
  C:\Windows\System\nhrooFr.exe
  2⤵
  PID:5056
- C:\Windows\System\baoboGD.exe
  C:\Windows\System\baoboGD.exe
  2⤵
  PID:5084
- C:\Windows\System\grKDmtb.exe
  C:\Windows\System\grKDmtb.exe
  2⤵
  PID:2080
- C:\Windows\System\eUbAjWd.exe
  C:\Windows\System\eUbAjWd.exe
  2⤵
  PID:3616
- C:\Windows\System\mURNiAS.exe
  C:\Windows\System\mURNiAS.exe
  2⤵
  PID:836
- C:\Windows\System\UktVqzI.exe
  C:\Windows\System\UktVqzI.exe
  2⤵
  PID:3496
- C:\Windows\System\pjALxZh.exe
  C:\Windows\System\pjALxZh.exe
  2⤵
  PID:3716
- C:\Windows\System\VTrBfDe.exe
  C:\Windows\System\VTrBfDe.exe
  2⤵
  PID:3804
- C:\Windows\System\yGMOESP.exe
  C:\Windows\System\yGMOESP.exe
  2⤵
  PID:4040
- C:\Windows\System\TuWuwRZ.exe
  C:\Windows\System\TuWuwRZ.exe
  2⤵
  PID:4156
- C:\Windows\System\cBSUEiJ.exe
  C:\Windows\System\cBSUEiJ.exe
  2⤵
  PID:4120
- C:\Windows\System\vsEsbHA.exe
  C:\Windows\System\vsEsbHA.exe
  2⤵
  PID:4280
- C:\Windows\System\ibMyxXx.exe
  C:\Windows\System\ibMyxXx.exe
  2⤵
  PID:4364
- C:\Windows\System\uluPxww.exe
  C:\Windows\System\uluPxww.exe
  2⤵
  PID:4324
- C:\Windows\System\HsoRyFo.exe
  C:\Windows\System\HsoRyFo.exe
  2⤵
  PID:4404
- C:\Windows\System\FXjRyJA.exe
  C:\Windows\System\FXjRyJA.exe
  2⤵
  PID:4480
- C:\Windows\System\EORIrQL.exe
  C:\Windows\System\EORIrQL.exe
  2⤵
  PID:4556
- C:\Windows\System\yMGsLJX.exe
  C:\Windows\System\yMGsLJX.exe
  2⤵
  PID:4536
- C:\Windows\System\mdachDV.exe
  C:\Windows\System\mdachDV.exe
  2⤵
  PID:4576
- C:\Windows\System\IRYDRgp.exe
  C:\Windows\System\IRYDRgp.exe
  2⤵
  PID:4684
- C:\Windows\System\PoFUKiX.exe
  C:\Windows\System\PoFUKiX.exe
  2⤵
  PID:4828
- C:\Windows\System\RKlkmZO.exe
  C:\Windows\System\RKlkmZO.exe
  2⤵
  PID:4792
- C:\Windows\System\kzKUNPX.exe
  C:\Windows\System\kzKUNPX.exe
  2⤵
  PID:4800
- C:\Windows\System\RBQRMSi.exe
  C:\Windows\System\RBQRMSi.exe
  2⤵
  PID:2844
- C:\Windows\System\wrmuwqW.exe
  C:\Windows\System\wrmuwqW.exe
  2⤵
  PID:4852
- C:\Windows\System\mBHVShx.exe
  C:\Windows\System\mBHVShx.exe
  2⤵
  PID:5012
- C:\Windows\System\tTmnlgF.exe
  C:\Windows\System\tTmnlgF.exe
  2⤵
  PID:5044
- C:\Windows\System\bYKlesw.exe
  C:\Windows\System\bYKlesw.exe
  2⤵
  PID:4968
- C:\Windows\System\dRZakOS.exe
  C:\Windows\System\dRZakOS.exe
  2⤵
  PID:5076
- C:\Windows\System\GLTsWYr.exe
  C:\Windows\System\GLTsWYr.exe
  2⤵
  PID:3428
- C:\Windows\System\kSxHiEp.exe
  C:\Windows\System\kSxHiEp.exe
  2⤵
  PID:2648
- C:\Windows\System\IBwUlvd.exe
  C:\Windows\System\IBwUlvd.exe
  2⤵
  PID:852
- C:\Windows\System\tzkIwAc.exe
  C:\Windows\System\tzkIwAc.exe
  2⤵
  PID:4232
- C:\Windows\System\igvKLwK.exe
  C:\Windows\System\igvKLwK.exe
  2⤵
  PID:4200
- C:\Windows\System\xdaQxfl.exe
  C:\Windows\System\xdaQxfl.exe
  2⤵
  PID:4180
- C:\Windows\System\TieLkLY.exe
  C:\Windows\System\TieLkLY.exe
  2⤵
  PID:4440
- C:\Windows\System\dbuvwSh.exe
  C:\Windows\System\dbuvwSh.exe
  2⤵
  PID:400
- C:\Windows\System\ZHJncNT.exe
  C:\Windows\System\ZHJncNT.exe
  2⤵
  PID:2716
- C:\Windows\System\RjAshEE.exe
  C:\Windows\System\RjAshEE.exe
  2⤵
  PID:4460
- C:\Windows\System\qneKZWY.exe
  C:\Windows\System\qneKZWY.exe
  2⤵
  PID:4700
- C:\Windows\System\gMhFUJp.exe
  C:\Windows\System\gMhFUJp.exe
  2⤵
  PID:4680
- C:\Windows\System\oknlbqw.exe
  C:\Windows\System\oknlbqw.exe
  2⤵
  PID:4984
- C:\Windows\System\FiytHXY.exe
  C:\Windows\System\FiytHXY.exe
  2⤵
  PID:1892
- C:\Windows\System\kVZqwFp.exe
  C:\Windows\System\kVZqwFp.exe
  2⤵
  PID:5008
- C:\Windows\System\QeTGcNm.exe
  C:\Windows\System\QeTGcNm.exe
  2⤵
  PID:2724
- C:\Windows\System\BzBMQGe.exe
  C:\Windows\System\BzBMQGe.exe
  2⤵
  PID:3556
- C:\Windows\System\rKfRjmU.exe
  C:\Windows\System\rKfRjmU.exe
  2⤵
  PID:1304
- C:\Windows\System\ZKDGUCe.exe
  C:\Windows\System\ZKDGUCe.exe
  2⤵
  PID:5140
- C:\Windows\System\ZCPCCni.exe
  C:\Windows\System\ZCPCCni.exe
  2⤵
  PID:5160
- C:\Windows\System\TtnAngh.exe
  C:\Windows\System\TtnAngh.exe
  2⤵
  PID:5180
- C:\Windows\System\kcNeUHj.exe
  C:\Windows\System\kcNeUHj.exe
  2⤵
  PID:5200
- C:\Windows\System\luEeyAb.exe
  C:\Windows\System\luEeyAb.exe
  2⤵
  PID:5220
- C:\Windows\System\DYCaoAj.exe
  C:\Windows\System\DYCaoAj.exe
  2⤵
  PID:5240
- C:\Windows\System\LcCUQgI.exe
  C:\Windows\System\LcCUQgI.exe
  2⤵
  PID:5260
- C:\Windows\System\ONLiCWr.exe
  C:\Windows\System\ONLiCWr.exe
  2⤵
  PID:5280
- C:\Windows\System\LNfglem.exe
  C:\Windows\System\LNfglem.exe
  2⤵
  PID:5300
- C:\Windows\System\JXjwLaV.exe
  C:\Windows\System\JXjwLaV.exe
  2⤵
  PID:5324
- C:\Windows\System\IyPxpfB.exe
  C:\Windows\System\IyPxpfB.exe
  2⤵
  PID:5344
- C:\Windows\System\BFLBPlK.exe
  C:\Windows\System\BFLBPlK.exe
  2⤵
  PID:5364
- C:\Windows\System\KkxrMrm.exe
  C:\Windows\System\KkxrMrm.exe
  2⤵
  PID:5384
- C:\Windows\System\dtGhwqq.exe
  C:\Windows\System\dtGhwqq.exe
  2⤵
  PID:5404
- C:\Windows\System\quISdiB.exe
  C:\Windows\System\quISdiB.exe
  2⤵
  PID:5424
- C:\Windows\System\OSynJwc.exe
  C:\Windows\System\OSynJwc.exe
  2⤵
  PID:5444
- C:\Windows\System\kcWjVef.exe
  C:\Windows\System\kcWjVef.exe
  2⤵
  PID:5464
- C:\Windows\System\JIOumAQ.exe
  C:\Windows\System\JIOumAQ.exe
  2⤵
  PID:5484
- C:\Windows\System\mYSgNUn.exe
  C:\Windows\System\mYSgNUn.exe
  2⤵
  PID:5504
- C:\Windows\System\EOPYerQ.exe
  C:\Windows\System\EOPYerQ.exe
  2⤵
  PID:5524
- C:\Windows\System\UaGNvkY.exe
  C:\Windows\System\UaGNvkY.exe
  2⤵
  PID:5544
- C:\Windows\System\ZkRoFyG.exe
  C:\Windows\System\ZkRoFyG.exe
  2⤵
  PID:5564
- C:\Windows\System\cslICiQ.exe
  C:\Windows\System\cslICiQ.exe
  2⤵
  PID:5580
- C:\Windows\System\NMzrQBo.exe
  C:\Windows\System\NMzrQBo.exe
  2⤵
  PID:5604
- C:\Windows\System\wckBWqH.exe
  C:\Windows\System\wckBWqH.exe
  2⤵
  PID:5620
- C:\Windows\System\YhxGdMh.exe
  C:\Windows\System\YhxGdMh.exe
  2⤵
  PID:5644
- C:\Windows\System\MlAQDKe.exe
  C:\Windows\System\MlAQDKe.exe
  2⤵
  PID:5660
- C:\Windows\System\FeRyJQo.exe
  C:\Windows\System\FeRyJQo.exe
  2⤵
  PID:5684
- C:\Windows\System\AzCCqFK.exe
  C:\Windows\System\AzCCqFK.exe
  2⤵
  PID:5700
- C:\Windows\System\aqppUjX.exe
  C:\Windows\System\aqppUjX.exe
  2⤵
  PID:5724
- C:\Windows\System\vkGnUvV.exe
  C:\Windows\System\vkGnUvV.exe
  2⤵
  PID:5744
- C:\Windows\System\ZAaleOv.exe
  C:\Windows\System\ZAaleOv.exe
  2⤵
  PID:5764
- C:\Windows\System\HhwTiLe.exe
  C:\Windows\System\HhwTiLe.exe
  2⤵
  PID:5780
- C:\Windows\System\nZLDZRz.exe
  C:\Windows\System\nZLDZRz.exe
  2⤵
  PID:5804
- C:\Windows\System\ThMZVHK.exe
  C:\Windows\System\ThMZVHK.exe
  2⤵
  PID:5824
- C:\Windows\System\qXmtbYz.exe
  C:\Windows\System\qXmtbYz.exe
  2⤵
  PID:5844
- C:\Windows\System\HYvymIy.exe
  C:\Windows\System\HYvymIy.exe
  2⤵
  PID:5864
- C:\Windows\System\VNTpwCP.exe
  C:\Windows\System\VNTpwCP.exe
  2⤵
  PID:5884
- C:\Windows\System\ZgGqAjP.exe
  C:\Windows\System\ZgGqAjP.exe
  2⤵
  PID:5900
- C:\Windows\System\OXecQuM.exe
  C:\Windows\System\OXecQuM.exe
  2⤵
  PID:5920
- C:\Windows\System\XSSmfaL.exe
  C:\Windows\System\XSSmfaL.exe
  2⤵
  PID:5936
- C:\Windows\System\iaCXAwE.exe
  C:\Windows\System\iaCXAwE.exe
  2⤵
  PID:5952
- C:\Windows\System\WrRjGem.exe
  C:\Windows\System\WrRjGem.exe
  2⤵
  PID:5972
- C:\Windows\System\LJwqaMC.exe
  C:\Windows\System\LJwqaMC.exe
  2⤵
  PID:6004
- C:\Windows\System\tQjIFjs.exe
  C:\Windows\System\tQjIFjs.exe
  2⤵
  PID:6020
- C:\Windows\System\DEzZcuY.exe
  C:\Windows\System\DEzZcuY.exe
  2⤵
  PID:6048
- C:\Windows\System\vBlFUMF.exe
  C:\Windows\System\vBlFUMF.exe
  2⤵
  PID:6064
- C:\Windows\System\AasEjVn.exe
  C:\Windows\System\AasEjVn.exe
  2⤵
  PID:6084
- C:\Windows\System\QpgdFQa.exe
  C:\Windows\System\QpgdFQa.exe
  2⤵
  PID:6104
- C:\Windows\System\QBImMLf.exe
  C:\Windows\System\QBImMLf.exe
  2⤵
  PID:6124
- C:\Windows\System\eezpfza.exe
  C:\Windows\System\eezpfza.exe
  2⤵
  PID:3744
- C:\Windows\System\aNiEVOn.exe
  C:\Windows\System\aNiEVOn.exe
  2⤵
  PID:4036
- C:\Windows\System\XUUjATn.exe
  C:\Windows\System\XUUjATn.exe
  2⤵
  PID:4352
- C:\Windows\System\anvrydo.exe
  C:\Windows\System\anvrydo.exe
  2⤵
  PID:4400
- C:\Windows\System\GuZXRAF.exe
  C:\Windows\System\GuZXRAF.exe
  2⤵
  PID:1604
- C:\Windows\System\yPFKTlW.exe
  C:\Windows\System\yPFKTlW.exe
  2⤵
  PID:4416
- C:\Windows\System\hevjAQD.exe
  C:\Windows\System\hevjAQD.exe
  2⤵
  PID:4704
- C:\Windows\System\ZnxxpIK.exe
  C:\Windows\System\ZnxxpIK.exe
  2⤵
  PID:2488
- C:\Windows\System\hkdjXRn.exe
  C:\Windows\System\hkdjXRn.exe
  2⤵
  PID:1468
- C:\Windows\System\WCOouVx.exe
  C:\Windows\System\WCOouVx.exe
  2⤵
  PID:2656
- C:\Windows\System\qDHwYel.exe
  C:\Windows\System\qDHwYel.exe
  2⤵
  PID:1752
- C:\Windows\System\LLQZXfN.exe
  C:\Windows\System\LLQZXfN.exe
  2⤵
  PID:1908
- C:\Windows\System\YnQTXXz.exe
  C:\Windows\System\YnQTXXz.exe
  2⤵
  PID:5128
- C:\Windows\System\IIxdomE.exe
  C:\Windows\System\IIxdomE.exe
  2⤵
  PID:5156
- C:\Windows\System\ovdRGVD.exe
  C:\Windows\System\ovdRGVD.exe
  2⤵
  PID:5188
- C:\Windows\System\JbOqeeo.exe
  C:\Windows\System\JbOqeeo.exe
  2⤵
  PID:5216
- C:\Windows\System\tBfTnSj.exe
  C:\Windows\System\tBfTnSj.exe
  2⤵
  PID:5232
- C:\Windows\System\Kbsqame.exe
  C:\Windows\System\Kbsqame.exe
  2⤵
  PID:5268
- C:\Windows\System\HNewWhQ.exe
  C:\Windows\System\HNewWhQ.exe
  2⤵
  PID:5288
- C:\Windows\System\bwdQVUn.exe
  C:\Windows\System\bwdQVUn.exe
  2⤵
  PID:3000
- C:\Windows\System\zIBUrBm.exe
  C:\Windows\System\zIBUrBm.exe
  2⤵
  PID:1048
- C:\Windows\System\BtFEIyg.exe
  C:\Windows\System\BtFEIyg.exe
  2⤵
  PID:2112
- C:\Windows\System\sjpBeAM.exe
  C:\Windows\System\sjpBeAM.exe
  2⤵
  PID:5296
- C:\Windows\System\iqWITtk.exe
  C:\Windows\System\iqWITtk.exe
  2⤵
  PID:5352
- C:\Windows\System\fNisijT.exe
  C:\Windows\System\fNisijT.exe
  2⤵
  PID:5340
- C:\Windows\System\MxWyqAW.exe
  C:\Windows\System\MxWyqAW.exe
  2⤵
  PID:5400
- C:\Windows\System\dPvnAuo.exe
  C:\Windows\System\dPvnAuo.exe
  2⤵
  PID:5432
- C:\Windows\System\WOcFpJF.exe
  C:\Windows\System\WOcFpJF.exe
  2⤵
  PID:5480
- C:\Windows\System\ycpdDTb.exe
  C:\Windows\System\ycpdDTb.exe
  2⤵
  PID:5496
- C:\Windows\System\yPxjPwP.exe
  C:\Windows\System\yPxjPwP.exe
  2⤵
  PID:5560
- C:\Windows\System\lHdmkwT.exe
  C:\Windows\System\lHdmkwT.exe
  2⤵
  PID:5588
- C:\Windows\System\NnqZTiG.exe
  C:\Windows\System\NnqZTiG.exe
  2⤵
  PID:5628
- C:\Windows\System\MlAtDka.exe
  C:\Windows\System\MlAtDka.exe
  2⤵
  PID:5612
- C:\Windows\System\kGvzlgd.exe
  C:\Windows\System\kGvzlgd.exe
  2⤵
  PID:5680
- C:\Windows\System\GJLcCRm.exe
  C:\Windows\System\GJLcCRm.exe
  2⤵
  PID:5720
- C:\Windows\System\UfdWOlg.exe
  C:\Windows\System\UfdWOlg.exe
  2⤵
  PID:5752
- C:\Windows\System\ipLchrt.exe
  C:\Windows\System\ipLchrt.exe
  2⤵
  PID:5736
- C:\Windows\System\QcCrJKB.exe
  C:\Windows\System\QcCrJKB.exe
  2⤵
  PID:5800
- C:\Windows\System\GMUylTX.exe
  C:\Windows\System\GMUylTX.exe
  2⤵
  PID:5832
- C:\Windows\System\LlVJtFC.exe
  C:\Windows\System\LlVJtFC.exe
  2⤵
  PID:5872
- C:\Windows\System\NOdFDQO.exe
  C:\Windows\System\NOdFDQO.exe
  2⤵
  PID:5916
- C:\Windows\System\IttGxGg.exe
  C:\Windows\System\IttGxGg.exe
  2⤵
  PID:1888
- C:\Windows\System\uYVZcyU.exe
  C:\Windows\System\uYVZcyU.exe
  2⤵
  PID:1524
- C:\Windows\System\YdOzhgo.exe
  C:\Windows\System\YdOzhgo.exe
  2⤵
  PID:5896
- C:\Windows\System\JfHBjSa.exe
  C:\Windows\System\JfHBjSa.exe
  2⤵
  PID:5820
- C:\Windows\System\BTQEvRj.exe
  C:\Windows\System\BTQEvRj.exe
  2⤵
  PID:5948
- C:\Windows\System\QZsgUmv.exe
  C:\Windows\System\QZsgUmv.exe
  2⤵
  PID:5988
- C:\Windows\System\swrMebO.exe
  C:\Windows\System\swrMebO.exe
  2⤵
  PID:5964
- C:\Windows\System\WciWvqX.exe
  C:\Windows\System\WciWvqX.exe
  2⤵
  PID:2800
- C:\Windows\System\nWAxVJy.exe
  C:\Windows\System\nWAxVJy.exe
  2⤵
  PID:412
- C:\Windows\System\oLFAaPw.exe
  C:\Windows\System\oLFAaPw.exe
  2⤵
  PID:2268
- C:\Windows\System\IwZxjuS.exe
  C:\Windows\System\IwZxjuS.exe
  2⤵
  PID:6012
- C:\Windows\System\enGqBPz.exe
  C:\Windows\System\enGqBPz.exe
  2⤵
  PID:6116
- C:\Windows\System\rmtgYaj.exe
  C:\Windows\System\rmtgYaj.exe
  2⤵
  PID:4184
- C:\Windows\System\YGQgQKy.exe
  C:\Windows\System\YGQgQKy.exe
  2⤵
  PID:6092
- C:\Windows\System\ipYtXYb.exe
  C:\Windows\System\ipYtXYb.exe
  2⤵
  PID:6136
- C:\Windows\System\BgsakQN.exe
  C:\Windows\System\BgsakQN.exe
  2⤵
  PID:4432
- C:\Windows\System\Dnkzuew.exe
  C:\Windows\System\Dnkzuew.exe
  2⤵
  PID:4552
- C:\Windows\System\oQSBmUE.exe
  C:\Windows\System\oQSBmUE.exe
  2⤵
  PID:1436
- C:\Windows\System\YedhqHF.exe
  C:\Windows\System\YedhqHF.exe
  2⤵
  PID:5192
- C:\Windows\System\acRPlSz.exe
  C:\Windows\System\acRPlSz.exe
  2⤵
  PID:5252
- C:\Windows\System\kFrcBkr.exe
  C:\Windows\System\kFrcBkr.exe
  2⤵
  PID:5228
- C:\Windows\System\zjZCvux.exe
  C:\Windows\System\zjZCvux.exe
  2⤵
  PID:1640
- C:\Windows\System\sbJbzcT.exe
  C:\Windows\System\sbJbzcT.exe
  2⤵
  PID:4664
- C:\Windows\System\qSfMgLn.exe
  C:\Windows\System\qSfMgLn.exe
  2⤵
  PID:1296
- C:\Windows\System\ipJZPUk.exe
  C:\Windows\System\ipJZPUk.exe
  2⤵
  PID:1420
- C:\Windows\System\pTMJyxV.exe
  C:\Windows\System\pTMJyxV.exe
  2⤵
  PID:1992
- C:\Windows\System\qRhLuoN.exe
  C:\Windows\System\qRhLuoN.exe
  2⤵
  PID:5436
- C:\Windows\System\ltRgWwD.exe
  C:\Windows\System\ltRgWwD.exe
  2⤵
  PID:5332
- C:\Windows\System\bvTbayZ.exe
  C:\Windows\System\bvTbayZ.exe
  2⤵
  PID:5412
- C:\Windows\System\PDUjszD.exe
  C:\Windows\System\PDUjszD.exe
  2⤵
  PID:5312
- C:\Windows\System\ngoadeA.exe
  C:\Windows\System\ngoadeA.exe
  2⤵
  PID:5556
- C:\Windows\System\lGaQclP.exe
  C:\Windows\System\lGaQclP.exe
  2⤵
  PID:5640
- C:\Windows\System\tTPAcWD.exe
  C:\Windows\System\tTPAcWD.exe
  2⤵
  PID:5572
- C:\Windows\System\cOoNgCN.exe
  C:\Windows\System\cOoNgCN.exe
  2⤵
  PID:5540
- C:\Windows\System\ZTBjQPH.exe
  C:\Windows\System\ZTBjQPH.exe
  2⤵
  PID:5760
- C:\Windows\System\NrIjFbU.exe
  C:\Windows\System\NrIjFbU.exe
  2⤵
  PID:2540
- C:\Windows\System\YlrgOWW.exe
  C:\Windows\System\YlrgOWW.exe
  2⤵
  PID:5840
- C:\Windows\System\KSQMCMC.exe
  C:\Windows\System\KSQMCMC.exe
  2⤵
  PID:328
- C:\Windows\System\SJHzsEF.exe
  C:\Windows\System\SJHzsEF.exe
  2⤵
  PID:5852
- C:\Windows\System\rgHqFlT.exe
  C:\Windows\System\rgHqFlT.exe
  2⤵
  PID:1192
- C:\Windows\System\tOhckoY.exe
  C:\Windows\System\tOhckoY.exe
  2⤵
  PID:1868
- C:\Windows\System\HtLRSBF.exe
  C:\Windows\System\HtLRSBF.exe
  2⤵
  PID:6112
- C:\Windows\System\bvhKKtx.exe
  C:\Windows\System\bvhKKtx.exe
  2⤵
  PID:6072
- C:\Windows\System\RCZUNQs.exe
  C:\Windows\System\RCZUNQs.exe
  2⤵
  PID:5984
- C:\Windows\System\AzmNvuO.exe
  C:\Windows\System\AzmNvuO.exe
  2⤵
  PID:384
- C:\Windows\System\ZcPyDPE.exe
  C:\Windows\System\ZcPyDPE.exe
  2⤵
  PID:4516
- C:\Windows\System\sFfuRKX.exe
  C:\Windows\System\sFfuRKX.exe
  2⤵
  PID:6100
- C:\Windows\System\CjQyYLn.exe
  C:\Windows\System\CjQyYLn.exe
  2⤵
  PID:4656
- C:\Windows\System\sSvAHNq.exe
  C:\Windows\System\sSvAHNq.exe
  2⤵
  PID:5136
- C:\Windows\System\ctvYkyK.exe
  C:\Windows\System\ctvYkyK.exe
  2⤵
  PID:2296
- C:\Windows\System\LBSQfQz.exe
  C:\Windows\System\LBSQfQz.exe
  2⤵
  PID:4888
- C:\Windows\System\DMQyQSp.exe
  C:\Windows\System\DMQyQSp.exe
  2⤵
  PID:5276
- C:\Windows\System\ZroTGFI.exe
  C:\Windows\System\ZroTGFI.exe
  2⤵
  PID:5336
- C:\Windows\System\pRLlouh.exe
  C:\Windows\System\pRLlouh.exe
  2⤵
  PID:2612
- C:\Windows\System\lvVyvfL.exe
  C:\Windows\System\lvVyvfL.exe
  2⤵
  PID:5960
- C:\Windows\System\VkCqvMn.exe
  C:\Windows\System\VkCqvMn.exe
  2⤵
  PID:5416
- C:\Windows\System\mvoPnXj.exe
  C:\Windows\System\mvoPnXj.exe
  2⤵
  PID:5500
- C:\Windows\System\uAOhIos.exe
  C:\Windows\System\uAOhIos.exe
  2⤵
  PID:2668
- C:\Windows\System\NQBQMps.exe
  C:\Windows\System\NQBQMps.exe
  2⤵
  PID:5796
- C:\Windows\System\JyvOXjJ.exe
  C:\Windows\System\JyvOXjJ.exe
  2⤵
  PID:3780
- C:\Windows\System\nXKSeEQ.exe
  C:\Windows\System\nXKSeEQ.exe
  2⤵
  PID:6096
- C:\Windows\System\bbVKZso.exe
  C:\Windows\System\bbVKZso.exe
  2⤵
  PID:5696
- C:\Windows\System\YmDVVos.exe
  C:\Windows\System\YmDVVos.exe
  2⤵
  PID:2664
- C:\Windows\System\gBTmdys.exe
  C:\Windows\System\gBTmdys.exe
  2⤵
  PID:6132
- C:\Windows\System\jMsPJGI.exe
  C:\Windows\System\jMsPJGI.exe
  2⤵
  PID:1364
- C:\Windows\System\FBfCNVq.exe
  C:\Windows\System\FBfCNVq.exe
  2⤵
  PID:2476
- C:\Windows\System\CtvFiCT.exe
  C:\Windows\System\CtvFiCT.exe
  2⤵
  PID:2280
- C:\Windows\System\lAnNFXv.exe
  C:\Windows\System\lAnNFXv.exe
  2⤵
  PID:5396
- C:\Windows\System\BdmjBHm.exe
  C:\Windows\System\BdmjBHm.exe
  2⤵
  PID:1592
- C:\Windows\System\EPxlWVG.exe
  C:\Windows\System\EPxlWVG.exe
  2⤵
  PID:5692
- C:\Windows\System\JZdLakG.exe
  C:\Windows\System\JZdLakG.exe
  2⤵
  PID:5512
- C:\Windows\System\ZHQmvBa.exe
  C:\Windows\System\ZHQmvBa.exe
  2⤵
  PID:5516
- C:\Windows\System\tuhhSAw.exe
  C:\Windows\System\tuhhSAw.exe
  2⤵
  PID:3036
- C:\Windows\System\GjpbFQx.exe
  C:\Windows\System\GjpbFQx.exe
  2⤵
  PID:6076
- C:\Windows\System\pKHBnnP.exe
  C:\Windows\System\pKHBnnP.exe
  2⤵
  PID:4636
- C:\Windows\System\EzPLBFj.exe
  C:\Windows\System\EzPLBFj.exe
  2⤵
  PID:5772
- C:\Windows\System\PbAHiPs.exe
  C:\Windows\System\PbAHiPs.exe
  2⤵
  PID:1072
- C:\Windows\System\cAmRiXb.exe
  C:\Windows\System\cAmRiXb.exe
  2⤵
  PID:4876
- C:\Windows\System\CEkWFHC.exe
  C:\Windows\System\CEkWFHC.exe
  2⤵
  PID:2584
- C:\Windows\System\LzLADmS.exe
  C:\Windows\System\LzLADmS.exe
  2⤵
  PID:5472
- C:\Windows\System\wiuOdGu.exe
  C:\Windows\System\wiuOdGu.exe
  2⤵
  PID:5668
- C:\Windows\System\ZdnQjMd.exe
  C:\Windows\System\ZdnQjMd.exe
  2⤵
  PID:5992
- C:\Windows\System\kWHkIpb.exe
  C:\Windows\System\kWHkIpb.exe
  2⤵
  PID:4476
- C:\Windows\System\xvDLaLp.exe
  C:\Windows\System\xvDLaLp.exe
  2⤵
  PID:5176
- C:\Windows\System\fuqoNbO.exe
  C:\Windows\System\fuqoNbO.exe
  2⤵
  PID:5792
- C:\Windows\System\gJljNAu.exe
  C:\Windows\System\gJljNAu.exe
  2⤵
  PID:6056
- C:\Windows\System\ttlkRwX.exe
  C:\Windows\System\ttlkRwX.exe
  2⤵
  PID:2248
- C:\Windows\System\QhTqyrj.exe
  C:\Windows\System\QhTqyrj.exe
  2⤵
  PID:5816
- C:\Windows\System\SeqxxRK.exe
  C:\Windows\System\SeqxxRK.exe
  2⤵
  PID:2572
- C:\Windows\System\TKmAUKz.exe
  C:\Windows\System\TKmAUKz.exe
  2⤵
  PID:6160
- C:\Windows\System\ltLvGAx.exe
  C:\Windows\System\ltLvGAx.exe
  2⤵
  PID:6176
- C:\Windows\System\QJuXZou.exe
  C:\Windows\System\QJuXZou.exe
  2⤵
  PID:6196
- C:\Windows\System\HFwANgv.exe
  C:\Windows\System\HFwANgv.exe
  2⤵
  PID:6212
- C:\Windows\System\ortLFmq.exe
  C:\Windows\System\ortLFmq.exe
  2⤵
  PID:6236
- C:\Windows\System\CcxRknC.exe
  C:\Windows\System\CcxRknC.exe
  2⤵
  PID:6252
- C:\Windows\System\NfUpuGu.exe
  C:\Windows\System\NfUpuGu.exe
  2⤵
  PID:6268
- C:\Windows\System\NgHDotl.exe
  C:\Windows\System\NgHDotl.exe
  2⤵
  PID:6284
- C:\Windows\System\QtjTSdi.exe
  C:\Windows\System\QtjTSdi.exe
  2⤵
  PID:6300
- C:\Windows\System\mZjpKyX.exe
  C:\Windows\System\mZjpKyX.exe
  2⤵
  PID:6316
- C:\Windows\System\vfzGmiJ.exe
  C:\Windows\System\vfzGmiJ.exe
  2⤵
  PID:6332
- C:\Windows\System\sIabgoq.exe
  C:\Windows\System\sIabgoq.exe
  2⤵
  PID:6352
- C:\Windows\System\QQSqvvw.exe
  C:\Windows\System\QQSqvvw.exe
  2⤵
  PID:6372
- C:\Windows\System\hgOfSdf.exe
  C:\Windows\System\hgOfSdf.exe
  2⤵
  PID:6392
- C:\Windows\System\XNfYvlt.exe
  C:\Windows\System\XNfYvlt.exe
  2⤵
  PID:6456
- C:\Windows\System\yuEEUsv.exe
  C:\Windows\System\yuEEUsv.exe
  2⤵
  PID:6476
- C:\Windows\System\LqCLdrD.exe
  C:\Windows\System\LqCLdrD.exe
  2⤵
  PID:6492
- C:\Windows\System\yIFERGZ.exe
  C:\Windows\System\yIFERGZ.exe
  2⤵
  PID:6508
- C:\Windows\System\AswXbqv.exe
  C:\Windows\System\AswXbqv.exe
  2⤵
  PID:6524
- C:\Windows\System\twkCvne.exe
  C:\Windows\System\twkCvne.exe
  2⤵
  PID:6540
- C:\Windows\System\UnJfdna.exe
  C:\Windows\System\UnJfdna.exe
  2⤵
  PID:6556
- C:\Windows\System\sdbtPHO.exe
  C:\Windows\System\sdbtPHO.exe
  2⤵
  PID:6572
- C:\Windows\System\kfDsnDZ.exe
  C:\Windows\System\kfDsnDZ.exe
  2⤵
  PID:6588
- C:\Windows\System\FXmfoxB.exe
  C:\Windows\System\FXmfoxB.exe
  2⤵
  PID:6604
- C:\Windows\System\yBmQaCo.exe
  C:\Windows\System\yBmQaCo.exe
  2⤵
  PID:6620
- C:\Windows\System\rakfOEC.exe
  C:\Windows\System\rakfOEC.exe
  2⤵
  PID:6636
- C:\Windows\System\lXRtcwr.exe
  C:\Windows\System\lXRtcwr.exe
  2⤵
  PID:6652
- C:\Windows\System\cOvrOuI.exe
  C:\Windows\System\cOvrOuI.exe
  2⤵
  PID:6668
- C:\Windows\System\YCePNxd.exe
  C:\Windows\System\YCePNxd.exe
  2⤵
  PID:6684
- C:\Windows\System\LIqVvWJ.exe
  C:\Windows\System\LIqVvWJ.exe
  2⤵
  PID:6700
- C:\Windows\System\BbMZQcl.exe
  C:\Windows\System\BbMZQcl.exe
  2⤵
  PID:6720
- C:\Windows\System\xQsZMxY.exe
  C:\Windows\System\xQsZMxY.exe
  2⤵
  PID:6780
- C:\Windows\System\PPoTCav.exe
  C:\Windows\System\PPoTCav.exe
  2⤵
  PID:6800
- C:\Windows\System\WkJtPZT.exe
  C:\Windows\System\WkJtPZT.exe
  2⤵
  PID:6816
- C:\Windows\System\polGUmp.exe
  C:\Windows\System\polGUmp.exe
  2⤵
  PID:6848
- C:\Windows\System\YsZdwaF.exe
  C:\Windows\System\YsZdwaF.exe
  2⤵
  PID:6864
- C:\Windows\System\YcGxTBM.exe
  C:\Windows\System\YcGxTBM.exe
  2⤵
  PID:6884
- C:\Windows\System\lzTeXiC.exe
  C:\Windows\System\lzTeXiC.exe
  2⤵
  PID:6900
- C:\Windows\System\PfVLrVL.exe
  C:\Windows\System\PfVLrVL.exe
  2⤵
  PID:6916
- C:\Windows\System\cLdWPUs.exe
  C:\Windows\System\cLdWPUs.exe
  2⤵
  PID:6940
- C:\Windows\System\tmPFlrI.exe
  C:\Windows\System\tmPFlrI.exe
  2⤵
  PID:6960
- C:\Windows\System\ilMvIsY.exe
  C:\Windows\System\ilMvIsY.exe
  2⤵
  PID:6980
- C:\Windows\System\NFdeePk.exe
  C:\Windows\System\NFdeePk.exe
  2⤵
  PID:7000
- C:\Windows\System\sNJyYrv.exe
  C:\Windows\System\sNJyYrv.exe
  2⤵
  PID:7016
- C:\Windows\System\LhBpCZO.exe
  C:\Windows\System\LhBpCZO.exe
  2⤵
  PID:7048
- C:\Windows\System\cGqPxsJ.exe
  C:\Windows\System\cGqPxsJ.exe
  2⤵
  PID:7072
- C:\Windows\System\LvvKMEw.exe
  C:\Windows\System\LvvKMEw.exe
  2⤵
  PID:7092
- C:\Windows\System\kubICRj.exe
  C:\Windows\System\kubICRj.exe
  2⤵
  PID:7108
- C:\Windows\System\aoLckbf.exe
  C:\Windows\System\aoLckbf.exe
  2⤵
  PID:7124
- C:\Windows\System\JuZMIRW.exe
  C:\Windows\System\JuZMIRW.exe
  2⤵
  PID:7140
- C:\Windows\System\EXXCArk.exe
  C:\Windows\System\EXXCArk.exe
  2⤵
  PID:7156
- C:\Windows\System\eXAGZgk.exe
  C:\Windows\System\eXAGZgk.exe
  2⤵
  PID:2228
- C:\Windows\System\HRkFFdv.exe
  C:\Windows\System\HRkFFdv.exe
  2⤵
  PID:5996
- C:\Windows\System\oZHoKBV.exe
  C:\Windows\System\oZHoKBV.exe
  2⤵
  PID:5392
- C:\Windows\System\lZWFqyp.exe
  C:\Windows\System\lZWFqyp.exe
  2⤵
  PID:6224
- C:\Windows\System\uGzfnZE.exe
  C:\Windows\System\uGzfnZE.exe
  2⤵
  PID:6328
- C:\Windows\System\GbXoXzZ.exe
  C:\Windows\System\GbXoXzZ.exe
  2⤵
  PID:5908
- C:\Windows\System\kBCqYvs.exe
  C:\Windows\System\kBCqYvs.exe
  2⤵
  PID:6428
- C:\Windows\System\ejPlOWL.exe
  C:\Windows\System\ejPlOWL.exe
  2⤵
  PID:6344
- C:\Windows\System\cuOMljq.exe
  C:\Windows\System\cuOMljq.exe
  2⤵
  PID:6416
- C:\Windows\System\BJOPpjJ.exe
  C:\Windows\System\BJOPpjJ.exe
  2⤵
  PID:6368
- C:\Windows\System\zEbkqye.exe
  C:\Windows\System\zEbkqye.exe
  2⤵
  PID:6484
- C:\Windows\System\ymsotkB.exe
  C:\Windows\System\ymsotkB.exe
  2⤵
  PID:6464
- C:\Windows\System\PQwWtEH.exe
  C:\Windows\System\PQwWtEH.exe
  2⤵
  PID:6612
- C:\Windows\System\OSreVhG.exe
  C:\Windows\System\OSreVhG.exe
  2⤵
  PID:6676
- C:\Windows\System\zYVyQde.exe
  C:\Windows\System\zYVyQde.exe
  2⤵
  PID:6520
- C:\Windows\System\xFFcUCk.exe
  C:\Windows\System\xFFcUCk.exe
  2⤵
  PID:6828
- C:\Windows\System\GxqpKuj.exe
  C:\Windows\System\GxqpKuj.exe
  2⤵
  PID:6840
- C:\Windows\System\MemmPyP.exe
  C:\Windows\System\MemmPyP.exe
  2⤵
  PID:6844
- C:\Windows\System\OmkNiqg.exe
  C:\Windows\System\OmkNiqg.exe
  2⤵
  PID:6532
- C:\Windows\System\PmehtjL.exe
  C:\Windows\System\PmehtjL.exe
  2⤵
  PID:6596
- C:\Windows\System\zGBncbj.exe
  C:\Windows\System\zGBncbj.exe
  2⤵
  PID:6664
- C:\Windows\System\tVwaUrC.exe
  C:\Windows\System\tVwaUrC.exe
  2⤵
  PID:6752
- C:\Windows\System\HZYHVjl.exe
  C:\Windows\System\HZYHVjl.exe
  2⤵
  PID:6772
- C:\Windows\System\usYKDbf.exe
  C:\Windows\System\usYKDbf.exe
  2⤵
  PID:6932
- C:\Windows\System\qmspYds.exe
  C:\Windows\System\qmspYds.exe
  2⤵
  PID:6896
- C:\Windows\System\NpZkxvo.exe
  C:\Windows\System\NpZkxvo.exe
  2⤵
  PID:6952
- C:\Windows\System\UHEwfAt.exe
  C:\Windows\System\UHEwfAt.exe
  2⤵
  PID:7036
- C:\Windows\System\iJPdupG.exe
  C:\Windows\System\iJPdupG.exe
  2⤵
  PID:6928
- C:\Windows\System\fnNxXnK.exe
  C:\Windows\System\fnNxXnK.exe
  2⤵
  PID:7008
- C:\Windows\System\ZjXGuQQ.exe
  C:\Windows\System\ZjXGuQQ.exe
  2⤵
  PID:7060
- C:\Windows\System\volhpQD.exe
  C:\Windows\System\volhpQD.exe
  2⤵
  PID:6192
- C:\Windows\System\kiFbkvF.exe
  C:\Windows\System\kiFbkvF.exe
  2⤵
  PID:6400
- C:\Windows\System\OfdrMJJ.exe
  C:\Windows\System\OfdrMJJ.exe
  2⤵
  PID:6276
- C:\Windows\System\LJTDpPW.exe
  C:\Windows\System\LJTDpPW.exe
  2⤵
  PID:6152
- C:\Windows\System\cqgmERh.exe
  C:\Windows\System\cqgmERh.exe
  2⤵
  PID:6292
- C:\Windows\System\dPeNgdq.exe
  C:\Windows\System\dPeNgdq.exe
  2⤵
  PID:6280
- C:\Windows\System\gNgAbrB.exe
  C:\Windows\System\gNgAbrB.exe
  2⤵
  PID:6228
- C:\Windows\System\ElGRXsL.exe
  C:\Windows\System\ElGRXsL.exe
  2⤵
  PID:6384
- C:\Windows\System\KzPpWhk.exe
  C:\Windows\System\KzPpWhk.exe
  2⤵
  PID:6580
- C:\Windows\System\ogReDRR.exe
  C:\Windows\System\ogReDRR.exe
  2⤵
  PID:6500
- C:\Windows\System\NranTAp.exe
  C:\Windows\System\NranTAp.exe
  2⤵
  PID:6628
- C:\Windows\System\vZBJwoL.exe
  C:\Windows\System\vZBJwoL.exe
  2⤵
  PID:6876
- C:\Windows\System\RmpxFQr.exe
  C:\Windows\System\RmpxFQr.exe
  2⤵
  PID:6444
- C:\Windows\System\AbupZpm.exe
  C:\Windows\System\AbupZpm.exe
  2⤵
  PID:6824
- C:\Windows\System\ZuaxUdG.exe
  C:\Windows\System\ZuaxUdG.exe
  2⤵
  PID:6732
- C:\Windows\System\JUDbbiN.exe
  C:\Windows\System\JUDbbiN.exe
  2⤵
  PID:6892
- C:\Windows\System\lCNqDWH.exe
  C:\Windows\System\lCNqDWH.exe
  2⤵
  PID:6812
- C:\Windows\System\bXtcBvi.exe
  C:\Windows\System\bXtcBvi.exe
  2⤵
  PID:7132
- C:\Windows\System\tYlowNw.exe
  C:\Windows\System\tYlowNw.exe
  2⤵
  PID:7080
- C:\Windows\System\nUXZqnW.exe
  C:\Windows\System\nUXZqnW.exe
  2⤵
  PID:7028
- C:\Windows\System\wZhiFao.exe
  C:\Windows\System\wZhiFao.exe
  2⤵
  PID:6188
- C:\Windows\System\ZwffLtV.exe
  C:\Windows\System\ZwffLtV.exe
  2⤵
  PID:6172
- C:\Windows\System\afYzAtw.exe
  C:\Windows\System\afYzAtw.exe
  2⤵
  PID:6404
- C:\Windows\System\jERSUYX.exe
  C:\Windows\System\jERSUYX.exe
  2⤵
  PID:6452
- C:\Windows\System\iHukcHT.exe
  C:\Windows\System\iHukcHT.exe
  2⤵
  PID:6760
- C:\Windows\System\zSspOBV.exe
  C:\Windows\System\zSspOBV.exe
  2⤵
  PID:6584
- C:\Windows\System\SMnANjW.exe
  C:\Windows\System\SMnANjW.exe
  2⤵
  PID:6552
- C:\Windows\System\NhSRmSB.exe
  C:\Windows\System\NhSRmSB.exe
  2⤵
  PID:6872
- C:\Windows\System\gQhZrbB.exe
  C:\Windows\System\gQhZrbB.exe
  2⤵
  PID:6860
- C:\Windows\System\ojJqmZH.exe
  C:\Windows\System\ojJqmZH.exe
  2⤵
  PID:6768
- C:\Windows\System\QbXERKm.exe
  C:\Windows\System\QbXERKm.exe
  2⤵
  PID:7120
- C:\Windows\System\mOLqJGw.exe
  C:\Windows\System\mOLqJGw.exe
  2⤵
  PID:6912
- C:\Windows\System\JZXTvvX.exe
  C:\Windows\System\JZXTvvX.exe
  2⤵
  PID:6968
- C:\Windows\System\sABnmzI.exe
  C:\Windows\System\sABnmzI.exe
  2⤵
  PID:6568
- C:\Windows\System\UCbxZKK.exe
  C:\Windows\System\UCbxZKK.exe
  2⤵
  PID:6712
- C:\Windows\System\RIStNTo.exe
  C:\Windows\System\RIStNTo.exe
  2⤵
  PID:7184
- C:\Windows\System\rGHoPlM.exe
  C:\Windows\System\rGHoPlM.exe
  2⤵
  PID:7212
- C:\Windows\System\uZBmrJH.exe
  C:\Windows\System\uZBmrJH.exe
  2⤵
  PID:7232
- C:\Windows\System\FKlxEHO.exe
  C:\Windows\System\FKlxEHO.exe
  2⤵
  PID:7248
- C:\Windows\System\dFcyWUd.exe
  C:\Windows\System\dFcyWUd.exe
  2⤵
  PID:7264
- C:\Windows\System\KLkcNme.exe
  C:\Windows\System\KLkcNme.exe
  2⤵
  PID:7280
- C:\Windows\System\YgWIgQG.exe
  C:\Windows\System\YgWIgQG.exe
  2⤵
  PID:7300
- C:\Windows\System\JtBrnHp.exe
  C:\Windows\System\JtBrnHp.exe
  2⤵
  PID:7336
- C:\Windows\System\tjHneHn.exe
  C:\Windows\System\tjHneHn.exe
  2⤵
  PID:7352
- C:\Windows\System\uQDpOUO.exe
  C:\Windows\System\uQDpOUO.exe
  2⤵
  PID:7376
- C:\Windows\System\nyYJtxZ.exe
  C:\Windows\System\nyYJtxZ.exe
  2⤵
  PID:7396
- C:\Windows\System\FSxIdCp.exe
  C:\Windows\System\FSxIdCp.exe
  2⤵
  PID:7416
- C:\Windows\System\HrtsuTx.exe
  C:\Windows\System\HrtsuTx.exe
  2⤵
  PID:7436
- C:\Windows\System\cSLBuae.exe
  C:\Windows\System\cSLBuae.exe
  2⤵
  PID:7456
- C:\Windows\System\TKKqiCj.exe
  C:\Windows\System\TKKqiCj.exe
  2⤵
  PID:7480
- C:\Windows\System\gpjCZpJ.exe
  C:\Windows\System\gpjCZpJ.exe
  2⤵
  PID:7504
- C:\Windows\System\HnfFfGu.exe
  C:\Windows\System\HnfFfGu.exe
  2⤵
  PID:7524
- C:\Windows\System\vAVXHAm.exe
  C:\Windows\System\vAVXHAm.exe
  2⤵
  PID:7540
- C:\Windows\System\gwUxlte.exe
  C:\Windows\System\gwUxlte.exe
  2⤵
  PID:7576
- C:\Windows\System\ZsxcHXJ.exe
  C:\Windows\System\ZsxcHXJ.exe
  2⤵
  PID:7620
- C:\Windows\System\blPPhve.exe
  C:\Windows\System\blPPhve.exe
  2⤵
  PID:7636
- C:\Windows\System\ypdslId.exe
  C:\Windows\System\ypdslId.exe
  2⤵
  PID:7652
- C:\Windows\System\PurvCmA.exe
  C:\Windows\System\PurvCmA.exe
  2⤵
  PID:7672
- C:\Windows\System\kGuPtYU.exe
  C:\Windows\System\kGuPtYU.exe
  2⤵
  PID:7692
- C:\Windows\System\YUcukQu.exe
  C:\Windows\System\YUcukQu.exe
  2⤵
  PID:7712
- C:\Windows\System\RXYGuST.exe
  C:\Windows\System\RXYGuST.exe
  2⤵
  PID:7728
- C:\Windows\System\FMQnDVo.exe
  C:\Windows\System\FMQnDVo.exe
  2⤵
  PID:7748
- C:\Windows\System\aYFQyxY.exe
  C:\Windows\System\aYFQyxY.exe
  2⤵
  PID:7764
- C:\Windows\System\cFObHUi.exe
  C:\Windows\System\cFObHUi.exe
  2⤵
  PID:7788
- C:\Windows\System\IOtWWmn.exe
  C:\Windows\System\IOtWWmn.exe
  2⤵
  PID:7808
- C:\Windows\System\tFQULqc.exe
  C:\Windows\System\tFQULqc.exe
  2⤵
  PID:7824
- C:\Windows\System\itbHeTe.exe
  C:\Windows\System\itbHeTe.exe
  2⤵
  PID:7840
- C:\Windows\System\ROlLdvB.exe
  C:\Windows\System\ROlLdvB.exe
  2⤵
  PID:7884
- C:\Windows\System\BbEtkLI.exe
  C:\Windows\System\BbEtkLI.exe
  2⤵
  PID:7904
- C:\Windows\System\ecSaNPc.exe
  C:\Windows\System\ecSaNPc.exe
  2⤵
  PID:7920
- C:\Windows\System\MELjaNW.exe
  C:\Windows\System\MELjaNW.exe
  2⤵
  PID:7936
- C:\Windows\System\zZZzkQR.exe
  C:\Windows\System\zZZzkQR.exe
  2⤵
  PID:7952
- C:\Windows\System\wmVzUWL.exe
  C:\Windows\System\wmVzUWL.exe
  2⤵
  PID:7980
- C:\Windows\System\dRmIGQA.exe
  C:\Windows\System\dRmIGQA.exe
  2⤵
  PID:8000
- C:\Windows\System\djyqyvl.exe
  C:\Windows\System\djyqyvl.exe
  2⤵
  PID:8020
- C:\Windows\System\sXQDrsc.exe
  C:\Windows\System\sXQDrsc.exe
  2⤵
  PID:8036
- C:\Windows\System\FwyXnpd.exe
  C:\Windows\System\FwyXnpd.exe
  2⤵
  PID:8052
- C:\Windows\System\PXZckzd.exe
  C:\Windows\System\PXZckzd.exe
  2⤵
  PID:8068
- C:\Windows\System\uAuHkxE.exe
  C:\Windows\System\uAuHkxE.exe
  2⤵
  PID:8088
- C:\Windows\System\oddZqOo.exe
  C:\Windows\System\oddZqOo.exe
  2⤵
  PID:8108
- C:\Windows\System\ArljtkW.exe
  C:\Windows\System\ArljtkW.exe
  2⤵
  PID:8128
- C:\Windows\System\lyYvEbz.exe
  C:\Windows\System\lyYvEbz.exe
  2⤵
  PID:8152
- C:\Windows\System\oDtilAJ.exe
  C:\Windows\System\oDtilAJ.exe
  2⤵
  PID:8172
- C:\Windows\System\imBTuiS.exe
  C:\Windows\System\imBTuiS.exe
  2⤵
  PID:8188
- C:\Windows\System\XXJrSKv.exe
  C:\Windows\System\XXJrSKv.exe
  2⤵
  PID:6380
- C:\Windows\System\yUZjcJt.exe
  C:\Windows\System\yUZjcJt.exe
  2⤵
  PID:6948
- C:\Windows\System\BgptNhE.exe
  C:\Windows\System\BgptNhE.exe
  2⤵
  PID:7192
- C:\Windows\System\JbRsbbF.exe
  C:\Windows\System\JbRsbbF.exe
  2⤵
  PID:7240
- C:\Windows\System\JbTlZes.exe
  C:\Windows\System\JbTlZes.exe
  2⤵
  PID:7044
- C:\Windows\System\aoyxpKH.exe
  C:\Windows\System\aoyxpKH.exe
  2⤵
  PID:7176
- C:\Windows\System\seaGaoE.exe
  C:\Windows\System\seaGaoE.exe
  2⤵
  PID:7332
- C:\Windows\System\ebbAwvq.exe
  C:\Windows\System\ebbAwvq.exe
  2⤵
  PID:6748
- C:\Windows\System\BiFstYJ.exe
  C:\Windows\System\BiFstYJ.exe
  2⤵
  PID:7364
- C:\Windows\System\cJjFxGN.exe
  C:\Windows\System\cJjFxGN.exe
  2⤵
  PID:7296
- C:\Windows\System\BVqWrgR.exe
  C:\Windows\System\BVqWrgR.exe
  2⤵
  PID:6208
- C:\Windows\System\nopKaKG.exe
  C:\Windows\System\nopKaKG.exe
  2⤵
  PID:7488
- C:\Windows\System\fnJOixS.exe
  C:\Windows\System\fnJOixS.exe
  2⤵
  PID:7256
- C:\Windows\System\CCZGLtx.exe
  C:\Windows\System\CCZGLtx.exe
  2⤵
  PID:7464
- C:\Windows\System\WfLzaxl.exe
  C:\Windows\System\WfLzaxl.exe
  2⤵
  PID:7392
- C:\Windows\System\Tjclauo.exe
  C:\Windows\System\Tjclauo.exe
  2⤵
  PID:7584
- C:\Windows\System\HbqJPvk.exe
  C:\Windows\System\HbqJPvk.exe
  2⤵
  PID:7556
- C:\Windows\System\xIkfdeq.exe
  C:\Windows\System\xIkfdeq.exe
  2⤵
  PID:7616
- C:\Windows\System\VrCwNcc.exe
  C:\Windows\System\VrCwNcc.exe
  2⤵
  PID:7668
- C:\Windows\System\BgkRoMy.exe
  C:\Windows\System\BgkRoMy.exe
  2⤵
  PID:7684
- C:\Windows\System\AHHivGr.exe
  C:\Windows\System\AHHivGr.exe
  2⤵
  PID:7772
- C:\Windows\System\PBqBONs.exe
  C:\Windows\System\PBqBONs.exe
  2⤵
  PID:7760
- C:\Windows\System\FSJuSse.exe
  C:\Windows\System\FSJuSse.exe
  2⤵
  PID:7832
- C:\Windows\System\sYkOswC.exe
  C:\Windows\System\sYkOswC.exe
  2⤵
  PID:7736
- C:\Windows\System\WZOQhTG.exe
  C:\Windows\System\WZOQhTG.exe
  2⤵
  PID:7776
- C:\Windows\System\LVQSvDT.exe
  C:\Windows\System\LVQSvDT.exe
  2⤵
  PID:7900
- C:\Windows\System\NFRAgmH.exe
  C:\Windows\System\NFRAgmH.exe
  2⤵
  PID:7964
- C:\Windows\System\xoWxdHk.exe
  C:\Windows\System\xoWxdHk.exe
  2⤵
  PID:7976
- C:\Windows\System\JiOEKoj.exe
  C:\Windows\System\JiOEKoj.exe
  2⤵
  PID:8044
- C:\Windows\System\Ocyqzyq.exe
  C:\Windows\System\Ocyqzyq.exe
  2⤵
  PID:8164
- C:\Windows\System\BrlWEla.exe
  C:\Windows\System\BrlWEla.exe
  2⤵
  PID:6908
- C:\Windows\System\VWYIrHT.exe
  C:\Windows\System\VWYIrHT.exe
  2⤵
  PID:6264
- C:\Windows\System\tHJTgMx.exe
  C:\Windows\System\tHJTgMx.exe
  2⤵
  PID:7944
- C:\Windows\System\JdvBTgv.exe
  C:\Windows\System\JdvBTgv.exe
  2⤵
  PID:8184
- C:\Windows\System\EzLzVWv.exe
  C:\Windows\System\EzLzVWv.exe
  2⤵
  PID:7276
- C:\Windows\System\aSoyNBv.exe
  C:\Windows\System\aSoyNBv.exe
  2⤵
  PID:8032
- C:\Windows\System\cDnkOCb.exe
  C:\Windows\System\cDnkOCb.exe
  2⤵
  PID:8100
- C:\Windows\System\UVYfNxa.exe
  C:\Windows\System\UVYfNxa.exe
  2⤵
  PID:7316
- C:\Windows\System\hNRVbzq.exe
  C:\Windows\System\hNRVbzq.exe
  2⤵
  PID:7200
- C:\Windows\System\nancRGG.exe
  C:\Windows\System\nancRGG.exe
  2⤵
  PID:6976
- C:\Windows\System\qYheJSl.exe
  C:\Windows\System\qYheJSl.exe
  2⤵
  PID:7224
- C:\Windows\System\bNYYhzp.exe
  C:\Windows\System\bNYYhzp.exe
  2⤵
  PID:6680
- C:\Windows\System\myPVUtr.exe
  C:\Windows\System\myPVUtr.exe
  2⤵
  PID:7064
- C:\Windows\System\EzzSoGA.exe
  C:\Windows\System\EzzSoGA.exe
  2⤵
  PID:7448
- C:\Windows\System\ZbKCwBF.exe
  C:\Windows\System\ZbKCwBF.exe
  2⤵
  PID:7512
- C:\Windows\System\vBJjakH.exe
  C:\Windows\System\vBJjakH.exe
  2⤵
  PID:7288
- C:\Windows\System\NpVbqqJ.exe
  C:\Windows\System\NpVbqqJ.exe
  2⤵
  PID:7516
- C:\Windows\System\ymfDTdp.exe
  C:\Windows\System\ymfDTdp.exe
  2⤵
  PID:7688
- C:\Windows\System\oFCxLvr.exe
  C:\Windows\System\oFCxLvr.exe
  2⤵
  PID:7628
- C:\Windows\System\NdtXoZp.exe
  C:\Windows\System\NdtXoZp.exe
  2⤵
  PID:7704
- C:\Windows\System\gftkYIe.exe
  C:\Windows\System\gftkYIe.exe
  2⤵
  PID:7852
- C:\Windows\System\vfRwIwQ.exe
  C:\Windows\System\vfRwIwQ.exe
  2⤵
  PID:8076
- C:\Windows\System\afAhekl.exe
  C:\Windows\System\afAhekl.exe
  2⤵
  PID:7912
- C:\Windows\System\fOeHLCi.exe
  C:\Windows\System\fOeHLCi.exe
  2⤵
  PID:8120
- C:\Windows\System\NKJUNiL.exe
  C:\Windows\System\NKJUNiL.exe
  2⤵
  PID:7308
- C:\Windows\System\xrfYkda.exe
  C:\Windows\System\xrfYkda.exe
  2⤵
  PID:7320
- C:\Windows\System\GvqjYov.exe
  C:\Windows\System\GvqjYov.exe
  2⤵
  PID:6308
- C:\Windows\System\IVrrIuK.exe
  C:\Windows\System\IVrrIuK.exe
  2⤵
  PID:7468
- C:\Windows\System\MvsmyaW.exe
  C:\Windows\System\MvsmyaW.exe
  2⤵
  PID:7700
- C:\Windows\System\tiFslYP.exe
  C:\Windows\System\tiFslYP.exe
  2⤵
  PID:7892
- C:\Windows\System\yHZvraD.exe
  C:\Windows\System\yHZvraD.exe
  2⤵
  PID:8136
- C:\Windows\System\dSxfjWb.exe
  C:\Windows\System\dSxfjWb.exe
  2⤵
  PID:6324
- C:\Windows\System\LIQUmMI.exe
  C:\Windows\System\LIQUmMI.exe
  2⤵
  PID:6716
- C:\Windows\System\ojSmXWU.exe
  C:\Windows\System\ojSmXWU.exe
  2⤵
  PID:7724
- C:\Windows\System\waHxyDx.exe
  C:\Windows\System\waHxyDx.exe
  2⤵
  PID:6148
- C:\Windows\System\iyIXqaX.exe
  C:\Windows\System\iyIXqaX.exe
  2⤵
  PID:7972
- C:\Windows\System\huopZPk.exe
  C:\Windows\System\huopZPk.exe
  2⤵
  PID:8124
- C:\Windows\System\pjErQNw.exe
  C:\Windows\System\pjErQNw.exe
  2⤵
  PID:7312
- C:\Windows\System\TvBCCaD.exe
  C:\Windows\System\TvBCCaD.exe
  2⤵
  PID:8028
- C:\Windows\System\KfDPrCo.exe
  C:\Windows\System\KfDPrCo.exe
  2⤵
  PID:7172
- C:\Windows\System\omYoJFj.exe
  C:\Windows\System\omYoJFj.exe
  2⤵
  PID:7664
- C:\Windows\System\TAkADld.exe
  C:\Windows\System\TAkADld.exe
  2⤵
  PID:7568
- C:\Windows\System\PlQZpAC.exe
  C:\Windows\System\PlQZpAC.exe
  2⤵
  PID:7344
- C:\Windows\System\UZermLc.exe
  C:\Windows\System\UZermLc.exe
  2⤵
  PID:7816
- C:\Windows\System\cPnZAKw.exe
  C:\Windows\System\cPnZAKw.exe
  2⤵
  PID:7932
- C:\Windows\System\SvdQhaQ.exe
  C:\Windows\System\SvdQhaQ.exe
  2⤵
  PID:6468
- C:\Windows\System\JXggHlb.exe
  C:\Windows\System\JXggHlb.exe
  2⤵
  PID:6644
- C:\Windows\System\pszCwzK.exe
  C:\Windows\System\pszCwzK.exe
  2⤵
  PID:6340
- C:\Windows\System\GbbhMkL.exe
  C:\Windows\System\GbbhMkL.exe
  2⤵
  PID:7720
- C:\Windows\System\nvCMUiJ.exe
  C:\Windows\System\nvCMUiJ.exe
  2⤵
  PID:7432
- C:\Windows\System\MiTglBv.exe
  C:\Windows\System\MiTglBv.exe
  2⤵
  PID:8084
- C:\Windows\System\QqUElGU.exe
  C:\Windows\System\QqUElGU.exe
  2⤵
  PID:7896
- C:\Windows\System\exgGobH.exe
  C:\Windows\System\exgGobH.exe
  2⤵
  PID:7820
- C:\Windows\System\GUieizr.exe
  C:\Windows\System\GUieizr.exe
  2⤵
  PID:7660
- C:\Windows\System\VypQaKy.exe
  C:\Windows\System\VypQaKy.exe
  2⤵
  PID:1516
- C:\Windows\System\HndncAP.exe
  C:\Windows\System\HndncAP.exe
  2⤵
  PID:8208
- C:\Windows\System\lqQBeZx.exe
  C:\Windows\System\lqQBeZx.exe
  2⤵
  PID:8224
- C:\Windows\System\qMtVfEo.exe
  C:\Windows\System\qMtVfEo.exe
  2⤵
  PID:8244
- C:\Windows\System\ACOknWW.exe
  C:\Windows\System\ACOknWW.exe
  2⤵
  PID:8260
- C:\Windows\System\COlrJyL.exe
  C:\Windows\System\COlrJyL.exe
  2⤵
  PID:8276
- C:\Windows\System\GoCuOVJ.exe
  C:\Windows\System\GoCuOVJ.exe
  2⤵
  PID:8300
- C:\Windows\System\wShjvLf.exe
  C:\Windows\System\wShjvLf.exe
  2⤵
  PID:8316
- C:\Windows\System\YFEKLvH.exe
  C:\Windows\System\YFEKLvH.exe
  2⤵
  PID:8340
- C:\Windows\System\GWQDPHo.exe
  C:\Windows\System\GWQDPHo.exe
  2⤵
  PID:8356
- C:\Windows\System\evbxwRY.exe
  C:\Windows\System\evbxwRY.exe
  2⤵
  PID:8372
- C:\Windows\System\GFumFBe.exe
  C:\Windows\System\GFumFBe.exe
  2⤵
  PID:8392
- C:\Windows\System\AWKwHbL.exe
  C:\Windows\System\AWKwHbL.exe
  2⤵
  PID:8432
- C:\Windows\System\lpdcdPi.exe
  C:\Windows\System\lpdcdPi.exe
  2⤵
  PID:8448
- C:\Windows\System\tDHUPEu.exe
  C:\Windows\System\tDHUPEu.exe
  2⤵
  PID:8468
- C:\Windows\System\uMLbEPw.exe
  C:\Windows\System\uMLbEPw.exe
  2⤵
  PID:8484
- C:\Windows\System\WXthVkw.exe
  C:\Windows\System\WXthVkw.exe
  2⤵
  PID:8500
- C:\Windows\System\GAXcjiz.exe
  C:\Windows\System\GAXcjiz.exe
  2⤵
  PID:8520
- C:\Windows\System\VzobHnn.exe
  C:\Windows\System\VzobHnn.exe
  2⤵
  PID:8544
- C:\Windows\System\JuuRycc.exe
  C:\Windows\System\JuuRycc.exe
  2⤵
  PID:8560
- C:\Windows\System\dhNUolD.exe
  C:\Windows\System\dhNUolD.exe
  2⤵
  PID:8576
- C:\Windows\System\UdlEgsT.exe
  C:\Windows\System\UdlEgsT.exe
  2⤵
  PID:8592
- C:\Windows\System\ntyLlkb.exe
  C:\Windows\System\ntyLlkb.exe
  2⤵
  PID:8640
- C:\Windows\System\RiLDXXu.exe
  C:\Windows\System\RiLDXXu.exe
  2⤵
  PID:8656
- C:\Windows\System\Yrmrzdd.exe
  C:\Windows\System\Yrmrzdd.exe
  2⤵
  PID:8676
- C:\Windows\System\GaswUVi.exe
  C:\Windows\System\GaswUVi.exe
  2⤵
  PID:8692
- C:\Windows\System\PpjDLmW.exe
  C:\Windows\System\PpjDLmW.exe
  2⤵
  PID:8708
- C:\Windows\System\yApOynk.exe
  C:\Windows\System\yApOynk.exe
  2⤵
  PID:8728
- C:\Windows\System\jIiqptz.exe
  C:\Windows\System\jIiqptz.exe
  2⤵
  PID:8752
- C:\Windows\System\soYHgNT.exe
  C:\Windows\System\soYHgNT.exe
  2⤵
  PID:8768
- C:\Windows\System\GjZuNDC.exe
  C:\Windows\System\GjZuNDC.exe
  2⤵
  PID:8784
- C:\Windows\System\tcAGPGf.exe
  C:\Windows\System\tcAGPGf.exe
  2⤵
  PID:8800
- C:\Windows\System\icLuKTR.exe
  C:\Windows\System\icLuKTR.exe
  2⤵
  PID:8816
- C:\Windows\System\tBHFgDV.exe
  C:\Windows\System\tBHFgDV.exe
  2⤵
  PID:8832
- C:\Windows\System\kvZvVer.exe
  C:\Windows\System\kvZvVer.exe
  2⤵
  PID:8856
- C:\Windows\System\lyehamb.exe
  C:\Windows\System\lyehamb.exe
  2⤵
  PID:8884
- C:\Windows\System\EenUYOx.exe
  C:\Windows\System\EenUYOx.exe
  2⤵
  PID:8900
- C:\Windows\System\VteihtW.exe
  C:\Windows\System\VteihtW.exe
  2⤵
  PID:8940
- C:\Windows\System\brReYPU.exe
  C:\Windows\System\brReYPU.exe
  2⤵
  PID:8956
- C:\Windows\System\OsrtLom.exe
  C:\Windows\System\OsrtLom.exe
  2⤵
  PID:8972
- C:\Windows\System\zRmTHli.exe
  C:\Windows\System\zRmTHli.exe
  2⤵
  PID:8996
- C:\Windows\System\FbTZdbM.exe
  C:\Windows\System\FbTZdbM.exe
  2⤵
  PID:9016
- C:\Windows\System\xMsSpRm.exe
  C:\Windows\System\xMsSpRm.exe
  2⤵
  PID:9036
- C:\Windows\System\pfjQBSY.exe
  C:\Windows\System\pfjQBSY.exe
  2⤵
  PID:9060
- C:\Windows\System\eicBpMv.exe
  C:\Windows\System\eicBpMv.exe
  2⤵
  PID:9084
- C:\Windows\System\tiqGBHg.exe
  C:\Windows\System\tiqGBHg.exe
  2⤵
  PID:9100
- C:\Windows\System\eYFbcRV.exe
  C:\Windows\System\eYFbcRV.exe
  2⤵
  PID:9120
- C:\Windows\System\qbYNFWP.exe
  C:\Windows\System\qbYNFWP.exe
  2⤵
  PID:9136
- C:\Windows\System\xdDqhvZ.exe
  C:\Windows\System\xdDqhvZ.exe
  2⤵
  PID:9156
- C:\Windows\System\jXNzAcW.exe
  C:\Windows\System\jXNzAcW.exe
  2⤵
  PID:9172
- C:\Windows\System\EpHVBnx.exe
  C:\Windows\System\EpHVBnx.exe
  2⤵
  PID:9192
- C:\Windows\System\mQNPfDa.exe
  C:\Windows\System\mQNPfDa.exe
  2⤵
  PID:9208
- C:\Windows\System\fcBgtii.exe
  C:\Windows\System\fcBgtii.exe
  2⤵
  PID:8148
- C:\Windows\System\iZVKPay.exe
  C:\Windows\System\iZVKPay.exe
  2⤵
  PID:8232
- C:\Windows\System\LGFyFGj.exe
  C:\Windows\System\LGFyFGj.exe
  2⤵
  PID:8272
- C:\Windows\System\KqIrsIy.exe
  C:\Windows\System\KqIrsIy.exe
  2⤵
  PID:8256
- C:\Windows\System\WGOCBFj.exe
  C:\Windows\System\WGOCBFj.exe
  2⤵
  PID:8296
- C:\Windows\System\VeALbSX.exe
  C:\Windows\System\VeALbSX.exe
  2⤵
  PID:8336
- C:\Windows\System\qqrGXwr.exe
  C:\Windows\System\qqrGXwr.exe
  2⤵
  PID:7388
- C:\Windows\System\rfhToil.exe
  C:\Windows\System\rfhToil.exe
  2⤵
  PID:8460
- C:\Windows\System\eEeQDhL.exe
  C:\Windows\System\eEeQDhL.exe
  2⤵
  PID:8384
- C:\Windows\System\uSvExYs.exe
  C:\Windows\System\uSvExYs.exe
  2⤵
  PID:8536
- C:\Windows\System\UHJxzUJ.exe
  C:\Windows\System\UHJxzUJ.exe
  2⤵
  PID:8600
- C:\Windows\System\ksqdyEL.exe
  C:\Windows\System\ksqdyEL.exe
  2⤵
  PID:8444
- C:\Windows\System\twEJWXf.exe
  C:\Windows\System\twEJWXf.exe
  2⤵
  PID:8588
- C:\Windows\System\dWmHgmZ.exe
  C:\Windows\System\dWmHgmZ.exe
  2⤵
  PID:8628
- C:\Windows\System\LpQTbjS.exe
  C:\Windows\System\LpQTbjS.exe
  2⤵
  PID:8704
- C:\Windows\System\UmycrCA.exe
  C:\Windows\System\UmycrCA.exe
  2⤵
  PID:8744
- C:\Windows\System\nHVKNjT.exe
  C:\Windows\System\nHVKNjT.exe
  2⤵
  PID:8780
- C:\Windows\System\gOOjZuB.exe
  C:\Windows\System\gOOjZuB.exe
  2⤵
  PID:8848
- C:\Windows\System\gQBSgHU.exe
  C:\Windows\System\gQBSgHU.exe
  2⤵
  PID:8716
- C:\Windows\System\ANyqhIK.exe
  C:\Windows\System\ANyqhIK.exe
  2⤵
  PID:8868
- C:\Windows\System\DXPAxuN.exe
  C:\Windows\System\DXPAxuN.exe
  2⤵
  PID:8896
- C:\Windows\System\PtkefcX.exe
  C:\Windows\System\PtkefcX.exe
  2⤵
  PID:8924
- C:\Windows\System\xyJJyeh.exe
  C:\Windows\System\xyJJyeh.exe
  2⤵
  PID:8936
- C:\Windows\System\HiXkPcD.exe
  C:\Windows\System\HiXkPcD.exe
  2⤵
  PID:8980
- C:\Windows\System\xexTKNq.exe
  C:\Windows\System\xexTKNq.exe
  2⤵
  PID:9008
- C:\Windows\System\cvHXVeY.exe
  C:\Windows\System\cvHXVeY.exe
  2⤵
  PID:9032
- C:\Windows\System\vvqibtk.exe
  C:\Windows\System\vvqibtk.exe
  2⤵
  PID:9056
- C:\Windows\System\sCxtCOB.exe
  C:\Windows\System\sCxtCOB.exe
  2⤵
  PID:9108
- C:\Windows\System\vPihUbq.exe
  C:\Windows\System\vPihUbq.exe
  2⤵
  PID:9144
- C:\Windows\System\SPkGMpN.exe
  C:\Windows\System\SPkGMpN.exe
  2⤵
  PID:7740
- C:\Windows\System\MfasrrZ.exe
  C:\Windows\System\MfasrrZ.exe
  2⤵
  PID:9168
- C:\Windows\System\epGxVPg.exe
  C:\Windows\System\epGxVPg.exe
  2⤵
  PID:6436
- C:\Windows\System\ZbTLVjl.exe
  C:\Windows\System\ZbTLVjl.exe
  2⤵
  PID:8204
- C:\Windows\System\PMuMwvI.exe
  C:\Windows\System\PMuMwvI.exe
  2⤵
  PID:8288
- C:\Windows\System\VoYjJlu.exe
  C:\Windows\System\VoYjJlu.exe
  2⤵
  PID:8400
- C:\Windows\System\oOkNFyA.exe
  C:\Windows\System\oOkNFyA.exe
  2⤵
  PID:8352
- C:\Windows\System\eprOIls.exe
  C:\Windows\System\eprOIls.exe
  2⤵
  PID:8420
- C:\Windows\System\XXajxAt.exe
  C:\Windows\System\XXajxAt.exe
  2⤵
  PID:8424
- C:\Windows\System\omxyMyB.exe
  C:\Windows\System\omxyMyB.exe
  2⤵
  PID:8572
- C:\Windows\System\qIYdeNt.exe
  C:\Windows\System\qIYdeNt.exe
  2⤵
  PID:8608
- C:\Windows\System\ozgyTDe.exe
  C:\Windows\System\ozgyTDe.exe
  2⤵
  PID:8736
- C:\Windows\System\FVUnAlo.exe
  C:\Windows\System\FVUnAlo.exe
  2⤵
  PID:8840
- C:\Windows\System\JAraNgz.exe
  C:\Windows\System\JAraNgz.exe
  2⤵
  PID:8792
- C:\Windows\System\cXhJFSV.exe
  C:\Windows\System\cXhJFSV.exe
  2⤵
  PID:8876
- C:\Windows\System\OXxzbWz.exe
  C:\Windows\System\OXxzbWz.exe
  2⤵
  PID:8952
- C:\Windows\System\hAXArOg.exe
  C:\Windows\System\hAXArOg.exe
  2⤵
  PID:9048
- C:\Windows\System\mnNVfeh.exe
  C:\Windows\System\mnNVfeh.exe
  2⤵
  PID:9080
- C:\Windows\System\cwBqdwa.exe
  C:\Windows\System\cwBqdwa.exe
  2⤵
  PID:9096
- C:\Windows\System\PeHrnGD.exe
  C:\Windows\System\PeHrnGD.exe
  2⤵
  PID:9184
- C:\Windows\System\YoxsMBv.exe
  C:\Windows\System\YoxsMBv.exe
  2⤵
  PID:8200
- C:\Windows\System\nkvExWr.exe
  C:\Windows\System\nkvExWr.exe
  2⤵
  PID:8268
- C:\Windows\System\djTjsLd.exe
  C:\Windows\System\djTjsLd.exe
  2⤵
  PID:8380
- C:\Windows\System\nySXfZD.exe
  C:\Windows\System\nySXfZD.exe
  2⤵
  PID:8428
- C:\Windows\System\nMMBaPe.exe
  C:\Windows\System\nMMBaPe.exe
  2⤵
  PID:8496
- C:\Windows\System\eahLVWN.exe
  C:\Windows\System\eahLVWN.exe
  2⤵
  PID:8552
- C:\Windows\System\dFRewrX.exe
  C:\Windows\System\dFRewrX.exe
  2⤵
  PID:8648
- C:\Windows\System\lOubXjC.exe
  C:\Windows\System\lOubXjC.exe
  2⤵
  PID:8864
- C:\Windows\System\MGxptJu.exe
  C:\Windows\System\MGxptJu.exe
  2⤵
  PID:8912
- C:\Windows\System\QqNmhQh.exe
  C:\Windows\System\QqNmhQh.exe
  2⤵
  PID:9068
- C:\Windows\System\UbSXlpW.exe
  C:\Windows\System\UbSXlpW.exe
  2⤵
  PID:9128
- C:\Windows\System\txomJsE.exe
  C:\Windows\System\txomJsE.exe
  2⤵
  PID:8348
- C:\Windows\System\JPdAlts.exe
  C:\Windows\System\JPdAlts.exe
  2⤵
  PID:8508
- C:\Windows\System\yniCeOQ.exe
  C:\Windows\System\yniCeOQ.exe
  2⤵
  PID:8492
- C:\Windows\System\pyrNYKa.exe
  C:\Windows\System\pyrNYKa.exe
  2⤵
  PID:8672
- C:\Windows\System\HosccbW.exe
  C:\Windows\System\HosccbW.exe
  2⤵
  PID:8724
- C:\Windows\System\wrHkCFS.exe
  C:\Windows\System\wrHkCFS.exe
  2⤵
  PID:2556
- C:\Windows\System\UCaJZRT.exe
  C:\Windows\System\UCaJZRT.exe
  2⤵
  PID:2632
- C:\Windows\System\bGoECdQ.exe
  C:\Windows\System\bGoECdQ.exe
  2⤵
  PID:8824
- C:\Windows\System\mgpjcOt.exe
  C:\Windows\System\mgpjcOt.exe
  2⤵
  PID:9028
- C:\Windows\System\maSSSxU.exe
  C:\Windows\System\maSSSxU.exe
  2⤵
  PID:9132
- C:\Windows\System\tTLTDIF.exe
  C:\Windows\System\tTLTDIF.exe
  2⤵
  PID:8416
- C:\Windows\System\mhzWEHP.exe
  C:\Windows\System\mhzWEHP.exe
  2⤵
  PID:8668
- C:\Windows\System\tMTrcvW.exe
  C:\Windows\System\tMTrcvW.exe
  2⤵
  PID:8620
- C:\Windows\System\wdvXGaV.exe
  C:\Windows\System\wdvXGaV.exe
  2⤵
  PID:2768
- C:\Windows\System\MCApIBk.exe
  C:\Windows\System\MCApIBk.exe
  2⤵
  PID:9232
- C:\Windows\System\zJcpSkw.exe
  C:\Windows\System\zJcpSkw.exe
  2⤵
  PID:9248
- C:\Windows\System\kwXSogG.exe
  C:\Windows\System\kwXSogG.exe
  2⤵
  PID:9264
- C:\Windows\System\zZNlrHs.exe
  C:\Windows\System\zZNlrHs.exe
  2⤵
  PID:9284
- C:\Windows\System\oWcMdqJ.exe
  C:\Windows\System\oWcMdqJ.exe
  2⤵
  PID:9304
- C:\Windows\System\QUkmtUa.exe
  C:\Windows\System\QUkmtUa.exe
  2⤵
  PID:9320
- C:\Windows\System\OuFSpLD.exe
  C:\Windows\System\OuFSpLD.exe
  2⤵
  PID:9336
- C:\Windows\System\SVPTmaC.exe
  C:\Windows\System\SVPTmaC.exe
  2⤵
  PID:9352
- C:\Windows\System\TpbHwAa.exe
  C:\Windows\System\TpbHwAa.exe
  2⤵
  PID:9376
- C:\Windows\System\BQBwyhx.exe
  C:\Windows\System\BQBwyhx.exe
  2⤵
  PID:9412
- C:\Windows\System\FfxpVKx.exe
  C:\Windows\System\FfxpVKx.exe
  2⤵
  PID:9448
- C:\Windows\System\FolzJrb.exe
  C:\Windows\System\FolzJrb.exe
  2⤵
  PID:9464
- C:\Windows\System\IkfYkIL.exe
  C:\Windows\System\IkfYkIL.exe
  2⤵
  PID:9480
- C:\Windows\System\WFRFzbf.exe
  C:\Windows\System\WFRFzbf.exe
  2⤵
  PID:9504
- C:\Windows\System\jjjUcRc.exe
  C:\Windows\System\jjjUcRc.exe
  2⤵
  PID:9520
- C:\Windows\System\ObaaRTP.exe
  C:\Windows\System\ObaaRTP.exe
  2⤵
  PID:9544
- C:\Windows\System\CEeGzTr.exe
  C:\Windows\System\CEeGzTr.exe
  2⤵
  PID:9564
- C:\Windows\System\CdcBgFC.exe
  C:\Windows\System\CdcBgFC.exe
  2⤵
  PID:9584
- C:\Windows\System\TQkgFjT.exe
  C:\Windows\System\TQkgFjT.exe
  2⤵
  PID:9608
- C:\Windows\System\zsIWoHL.exe
  C:\Windows\System\zsIWoHL.exe
  2⤵
  PID:9624
- C:\Windows\System\iyNgVcW.exe
  C:\Windows\System\iyNgVcW.exe
  2⤵
  PID:9648
- C:\Windows\System\jLxWlGT.exe
  C:\Windows\System\jLxWlGT.exe
  2⤵
  PID:9664
- C:\Windows\System\yZXUpzc.exe
  C:\Windows\System\yZXUpzc.exe
  2⤵
  PID:9692
- C:\Windows\System\PJOcFOb.exe
  C:\Windows\System\PJOcFOb.exe
  2⤵
  PID:9708
- C:\Windows\System\oAcgkhx.exe
  C:\Windows\System\oAcgkhx.exe
  2⤵
  PID:9724
- C:\Windows\System\TOIEbQa.exe
  C:\Windows\System\TOIEbQa.exe
  2⤵
  PID:9748
- C:\Windows\System\IKcCpaN.exe
  C:\Windows\System\IKcCpaN.exe
  2⤵
  PID:9764
- C:\Windows\System\BspLCyM.exe
  C:\Windows\System\BspLCyM.exe
  2⤵
  PID:9784
- C:\Windows\System\svvJPXa.exe
  C:\Windows\System\svvJPXa.exe
  2⤵
  PID:9800
- C:\Windows\System\wkzPfIA.exe
  C:\Windows\System\wkzPfIA.exe
  2⤵
  PID:9832
- C:\Windows\System\yjgznTi.exe
  C:\Windows\System\yjgznTi.exe
  2⤵
  PID:9848
- C:\Windows\System\GeYGOlj.exe
  C:\Windows\System\GeYGOlj.exe
  2⤵
  PID:9868
- C:\Windows\System\JxXvMzb.exe
  C:\Windows\System\JxXvMzb.exe
  2⤵
  PID:9888
- C:\Windows\System\rKQiqps.exe
  C:\Windows\System\rKQiqps.exe
  2⤵
  PID:9908
- C:\Windows\System\wswcVuj.exe
  C:\Windows\System\wswcVuj.exe
  2⤵
  PID:9924
- C:\Windows\System\ubJgSsj.exe
  C:\Windows\System\ubJgSsj.exe
  2⤵
  PID:9944
- C:\Windows\System\LedOmjh.exe
  C:\Windows\System\LedOmjh.exe
  2⤵
  PID:9964
- C:\Windows\System\mdNCRbf.exe
  C:\Windows\System\mdNCRbf.exe
  2⤵
  PID:9988
- C:\Windows\System\YuozVNC.exe
  C:\Windows\System\YuozVNC.exe
  2⤵
  PID:10008
- C:\Windows\System\TKUhbRG.exe
  C:\Windows\System\TKUhbRG.exe
  2⤵
  PID:10028
- C:\Windows\System\lVQEVEV.exe
  C:\Windows\System\lVQEVEV.exe
  2⤵
  PID:10048
- C:\Windows\System\YHxbNJR.exe
  C:\Windows\System\YHxbNJR.exe
  2⤵
  PID:10068
- C:\Windows\System\bCvCNFm.exe
  C:\Windows\System\bCvCNFm.exe
  2⤵
  PID:10088
- C:\Windows\System\murjqVX.exe
  C:\Windows\System\murjqVX.exe
  2⤵
  PID:10108
- C:\Windows\System\iHJjroL.exe
  C:\Windows\System\iHJjroL.exe
  2⤵
  PID:10132
- C:\Windows\System\MeHzpsr.exe
  C:\Windows\System\MeHzpsr.exe
  2⤵
  PID:10148
- C:\Windows\System\NPTKQol.exe
  C:\Windows\System\NPTKQol.exe
  2⤵
  PID:10164
- C:\Windows\System\JEvPmsP.exe
  C:\Windows\System\JEvPmsP.exe
  2⤵
  PID:10184
- C:\Windows\System\bWSvPea.exe
  C:\Windows\System\bWSvPea.exe
  2⤵
  PID:10200
- C:\Windows\System\nlPgvHZ.exe
  C:\Windows\System\nlPgvHZ.exe
  2⤵
  PID:10232
- C:\Windows\System\cQytnWK.exe
  C:\Windows\System\cQytnWK.exe
  2⤵
  PID:9228
- C:\Windows\System\AjkzNpi.exe
  C:\Windows\System\AjkzNpi.exe
  2⤵
  PID:9224
- C:\Windows\System\YjNrcFO.exe
  C:\Windows\System\YjNrcFO.exe
  2⤵
  PID:8688
- C:\Windows\System\XfkfCOL.exe
  C:\Windows\System\XfkfCOL.exe
  2⤵
  PID:2972
- C:\Windows\System\xxdGKnH.exe
  C:\Windows\System\xxdGKnH.exe
  2⤵
  PID:9280
- C:\Windows\System\EruNJQY.exe
  C:\Windows\System\EruNJQY.exe
  2⤵
  PID:9300
- C:\Windows\System\uaBJHuS.exe
  C:\Windows\System\uaBJHuS.exe
  2⤵
  PID:9312
- C:\Windows\System\xjHWLMX.exe
  C:\Windows\System\xjHWLMX.exe
  2⤵
  PID:9368
- C:\Windows\System\REkVEvw.exe
  C:\Windows\System\REkVEvw.exe
  2⤵
  PID:9344
- C:\Windows\System\ESDvoul.exe
  C:\Windows\System\ESDvoul.exe
  2⤵
  PID:9388
- C:\Windows\System\LSIYBlG.exe
  C:\Windows\System\LSIYBlG.exe
  2⤵
  PID:9432
- C:\Windows\System\cdSAyhD.exe
  C:\Windows\System\cdSAyhD.exe
  2⤵
  PID:9460
- C:\Windows\System\OYayYxe.exe
  C:\Windows\System\OYayYxe.exe
  2⤵
  PID:9528
- C:\Windows\System\sPmDxpy.exe
  C:\Windows\System\sPmDxpy.exe
  2⤵
  PID:9500
- C:\Windows\System\pNdAdMW.exe
  C:\Windows\System\pNdAdMW.exe
  2⤵
  PID:9540
- C:\Windows\System\gCAHoGp.exe
  C:\Windows\System\gCAHoGp.exe
  2⤵
  PID:9604
- C:\Windows\System\uryyWGj.exe
  C:\Windows\System\uryyWGj.exe
  2⤵
  PID:9676
- C:\Windows\System\zpmtxGf.exe
  C:\Windows\System\zpmtxGf.exe
  2⤵
  PID:9620
- C:\Windows\System\liYalKi.exe
  C:\Windows\System\liYalKi.exe
  2⤵
  PID:9656
- C:\Windows\System\AXhEvby.exe
  C:\Windows\System\AXhEvby.exe
  2⤵
  PID:9736
- C:\Windows\System\fAEHtpU.exe
  C:\Windows\System\fAEHtpU.exe
  2⤵
  PID:9760
- C:\Windows\System\OOMfUqE.exe
  C:\Windows\System\OOMfUqE.exe
  2⤵
  PID:9772
- C:\Windows\System\DGuZEvE.exe
  C:\Windows\System\DGuZEvE.exe
  2⤵
  PID:9812
- C:\Windows\System\bECfREs.exe
  C:\Windows\System\bECfREs.exe
  2⤵
  PID:9860
- C:\Windows\System\CqUqVOU.exe
  C:\Windows\System\CqUqVOU.exe
  2⤵
  PID:9904
- C:\Windows\System\pxutfBS.exe
  C:\Windows\System\pxutfBS.exe
  2⤵
  PID:9940
- C:\Windows\System\hkGSsiU.exe
  C:\Windows\System\hkGSsiU.exe
  2⤵
  PID:9936
- C:\Windows\System\RULrkmY.exe
  C:\Windows\System\RULrkmY.exe
  2⤵
  PID:9980
- C:\Windows\System\ZQryRET.exe
  C:\Windows\System\ZQryRET.exe
  2⤵
  PID:10036
- C:\Windows\System\LuVErUp.exe
  C:\Windows\System\LuVErUp.exe
  2⤵
  PID:10020
- C:\Windows\System\yyBcdhq.exe
  C:\Windows\System\yyBcdhq.exe
  2⤵
  PID:10056
- C:\Windows\System\etOmYCz.exe
  C:\Windows\System\etOmYCz.exe
  2⤵
  PID:10080
- C:\Windows\System\axXkTPi.exe
  C:\Windows\System\axXkTPi.exe
  2⤵
  PID:10124
- C:\Windows\System\dtlYLEJ.exe
  C:\Windows\System\dtlYLEJ.exe
  2⤵
  PID:10160
- C:\Windows\System\cDEpnxZ.exe
  C:\Windows\System\cDEpnxZ.exe
  2⤵
  PID:10196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DjCQHeM.exe

Filesize
2.4MB

MD5
7a93a53ec262cc99d4e07372aeb5c049

SHA1
5574e315488795dbc6b161ce10bdad6681481246

SHA256
14b2f4c1e53633081e7d333ccca0ec3799d31831675ebf12cdfe4dcfd00d6031

SHA512
cf6b1792a3081efac958110d5cdcde214a1720109a3153ddd7a84df0ab1a0782c1605572bef3fadf3be8a36d6945344c7b94f74c8bf7c4e0fe89a333c7716826

Download Submit
C:\Windows\system\EKRgCRB.exe

Filesize
2.4MB

MD5
0662a1916163b226a26b5ade7d03e944

SHA1
6c36f82e9544a72339bdae6e1a69dbab66d284eb

SHA256
6c1eb2d3d286452389fb1d0176eac6f71071e2061645116fb1c17032e113f662

SHA512
465139090a58f2fce84be519f0e3e83c5df30bcd7c626ffacd20dab0f50d75b77df3fec20248ffae715c51c01fd75989d035203454457faca11c6dc5519e8b0d

Download Submit
C:\Windows\system\EOczAej.exe

Filesize
2.4MB

MD5
d5558f21ad5a8cedf66cbbeef8604f16

SHA1
899ae402b8f98f8783a779c36bc718babf4a63c6

SHA256
3ecaa420de79d118d3a8bc8125986b656dcc0005a91ad092ef24413707631010

SHA512
079b6873cd707c14c7cb94638f9cafdcf74af11929bb8532addaa2f6b1cde6767bdd0c0cb7b1b7017e52c70c3f8ebd64d1e1284ea8ba945cc5c809ddd81f9216

Download Submit
C:\Windows\system\FNRMZBc.exe

Filesize
2.4MB

MD5
ee81ef5c6051deb524e5dd41960e44c5

SHA1
24b6cc633d1c7e289ba31165f1246b843ffda114

SHA256
e46787e2c58d29821cf642f2efc47cb9936cfbe02c64796782cd5ebb42e686ff

SHA512
9fbc851b011c11eb891a8824f63cbda7be1529ea88033c30b13c6e195c240da5acd8e1ec7843f7e7ef8f0d01ad4fec7b86f07ca289cbb272511c43d8f7178ac3

Download Submit
C:\Windows\system\IkvRass.exe

Filesize
2.4MB

MD5
cf8e2d26e40612184b67d834a155724a

SHA1
e0585b29fd9523d9cccd017fced8b7dcd320e49a

SHA256
36a30d6133b9c7619c7ce258ac9f43c560f125f6cf17c0283a81f424598954ef

SHA512
25c95d15e98ad8fcb7a01b53467efe3ac8f12a5a59d7c83f9c01046c462b3c9e03dbc989466618acbf5b510addfd1234b9243979b8c075d2e179a64b0df5158d

Download Submit
C:\Windows\system\KJtxnVL.exe

Filesize
2.4MB

MD5
931cac730207762248e7886a49090963

SHA1
38a5bf2ff468604299f979ac7caeb153a2d4bf62

SHA256
6412e5f9a9e715590f9ff29fd45419b435956bf5750a213a1487e820a076fe60

SHA512
17661e725efcf52eb670245d82d4ef2130ba2e921a1d0e5d70f5b8149eb0d423cefc6ec16268c3278ebb7e1c1157a6da2affc39ad37b3b6acc72718a55018cc7

Download Submit
C:\Windows\system\KvFQZRS.exe

Filesize
2.4MB

MD5
7f15888c70d1c01be3b9020205d61bc6

SHA1
b709ed8a99bf560a726051d837a2fa66e3787527

SHA256
e07f3031650af494cda6edd5c0ca8588b7820a76c597354aba6e0d79b44618ac

SHA512
5cf7cdacc8f2b6c4a68d950e54366937c96d4220f689ae2125855e7489e153daddaaa9b3c2a094794b9b867d665d869a8601af0121b363e42078bcff31afbfab

Download Submit
C:\Windows\system\MBFESnI.exe

Filesize
2.4MB

MD5
e22ec2aefc1f1e82387113425495ec95

SHA1
ac371ac77c8b61b0349e66b586ceada7392d769d

SHA256
8f37e82aefe8ebeeb06978965fa72d595d8756cf8ea92abab734d9f3305aa03d

SHA512
a6367c744b76fd03fa60064a50e5a8b608b9e5084f66dcb9a4ce41bc8b4a23fec852fde806d013b1ec1233c563ef53bafd8ccc134027e334d5c9c7f9948ab729

Download Submit
C:\Windows\system\PDSoBMo.exe

Filesize
2.4MB

MD5
2bae87178b1f4d1fba629d910f4e7cd9

SHA1
e092eaec0cc80eedfc5dd93ae161be803bd61714

SHA256
3b02c22064efef9a995157b4b52f6ea18972a35d86df60a7efeb69c950086f0f

SHA512
dc3065e6663b5a49af66943fee6c90463cf49aae0ee3324920f73caf9ea82370c6c890c085f45164629d4dba5bcad9991c50804e6d4e05f6395ed773de6bedc4

Download Submit
C:\Windows\system\PzMnsXA.exe

Filesize
2.4MB

MD5
d3ab6233f38d138c0b55a64481d19590

SHA1
310bd178ee9adda9152cab52f6d467e81a297656

SHA256
65dfa28f99ed81d6140711403021393d1d0a9231672d7924fb8f8c4d19cfa819

SHA512
03f6b3c7fe3434b62f3a9d1ff335f0e342a76f0d755b0d99ce01e2df9461a4f5085d8a4b5650376254d1bfbe992a5f71c82fecaf582238cca4951d36e5e54e5b

Download Submit
C:\Windows\system\QDuwWIW.exe

Filesize
2.4MB

MD5
55a37e10ef4c61fc74de03eb7662a8a1

SHA1
a3b08a16a06fc6b9ff635d8dd13fe07ea1e8e8ee

SHA256
4b50a8b0038fbbcac5aac9dd607515e4fdb0e48cfa6a71bfce91c11b2e34e31c

SHA512
28a8b6cb60e795f514759b928720da4dfb07075cc09d081edd2f7522607bd0d0a5f4807cb6e1957338034b752817ac82007522c5dd1098e2637e35269b56070a

Download Submit
C:\Windows\system\QUuPiZd.exe

Filesize
2.4MB

MD5
9087379dcfb32a58ec2811d3e9b7e06a

SHA1
eaede900c7c9f9da3634e8f34e8bc241df36e4ee

SHA256
ecae6d00700b49921575a66c1aa7f82904e7bda68b39299b097659d43029b725

SHA512
68a76becf038ce8019d19bf5967d8022f706238cb2b7f1b5f4224c9c77670cd8760ab188036a6ec32ca290874fa573f435e8631359904e9387cda09aa3d57ff4

Download Submit
C:\Windows\system\VwdgvCP.exe

Filesize
2.4MB

MD5
a438e24949bf441641dad8b399c43995

SHA1
13ebcdb8332afa6bd0185b5b3e4da7756a6a3bd5

SHA256
2939a6a8abab8366c7be86bf57f6c004873381b843afb0bdf7b8c272ffa3dcf7

SHA512
da6c4eccf5f038ffec4a8c6cb5ae842e72320698f44f6ba3cbf76b6e14fd37cde73002fb6edbd9c83c0b7567490aa223f1145a5277b62dadfd54e00e6c1bff63

Download Submit
C:\Windows\system\WWokRZq.exe

Filesize
2.4MB

MD5
963282ea5ef8e1100a68d8a6b6557593

SHA1
497f9ecb13a2abb2cf1427e20e2c13ef9045b3ec

SHA256
420bad69761a9917c552bd3e1a0c4b250e67c19041a48770b5daaf499649664e

SHA512
d860e9a0fb057f60ef774da04992bd148179cc50f50d29a76026b9cc5b6549fbab1bc21c10cfe971ace04072af6df172834a2c10e4738b48c934359877a44c95

Download Submit
C:\Windows\system\XxiKrXm.exe

Filesize
2.4MB

MD5
d8e86bd1e59423bfd189e6130eff3c78

SHA1
9ec4d25c0f1b037dbbf47abc73e04946300b36e2

SHA256
5cf9e02704f2724c57c11bcc48dffba8422d79cb5ee409907b7a74bfe9b81cd9

SHA512
200d6513ee66b986aafe0474ab3262107b2ed004dfa6843f89f53ea1205e1b888cdecb873cb4a4c8261a0561376426e2484ba93a8bdc40cd9c99c651b1229ed9

Download Submit
C:\Windows\system\ZDpaqPy.exe

Filesize
2.4MB

MD5
3ff57aadb7dead0268713deb9f2b1ca6

SHA1
6ea2ad4979e2a7f429076d039ab4378226c7ca88

SHA256
0895dd20bb3890201d739d3f2a6f2889f41df1830b74d8acd914150507e1c697

SHA512
e2928da99bbae3e58322420cdf72f579abb2dd5f3c5918ed30a2c6f5baff7efe5991c475d6232acdb91f52127d22008ea3d51a11842d705474212ab2885aeb20

Download Submit
C:\Windows\system\ckUHLXf.exe

Filesize
2.4MB

MD5
e1a792526b6367e44125f72387bd93e4

SHA1
64e9d6228f0b50a06ebcc8c13af527e8317ba30d

SHA256
85ae1b9372fe5ed56c20b0301e5dcdcde4baee8890b50c3f687eee86ee2f3abf

SHA512
cfc79fcf688c7f4db4bda0f5996fbd2cb7b595ba8ea067658b4f17e8b564fc5e585e2809899b5269df1a728c3cf6a4bef044bd001675ac981f937cb3ef40a1a1

Download Submit
C:\Windows\system\dQvrLUs.exe

Filesize
2.4MB

MD5
f85ff23efb3b0308f99a29a684f92240

SHA1
ff13d89bf004e32c71d2bc5fe91819aaa851119b

SHA256
ef8cbf968169e8be0a5e06e758d963247bc119cd022e961bdf979b490cdfc20d

SHA512
c9b79476aff947f4b86853b4a05c1733cb1dc4c201bc6808bed49ca416e02ad00016e2ad584e8269b0f9e4019e47a33e1478aa450c2c14895c90526e45305a94

Download Submit
C:\Windows\system\dhBybzs.exe

Filesize
2.4MB

MD5
97171ae06b35ddf2cda59bbad795954c

SHA1
46c902555102a866027c3fb13b1b4f3be59f5c99

SHA256
0b276820c0ea5dbebb79ff4460062206362de5ca0bfa18c20448a2c61e46d646

SHA512
6e0c6a531ba0c63b61fef4aaaa2e4f2b56d06d0a540b85da1723d29900ae9876c4424cf21cb72b798c1cdce9ed161b78dbca3b2a8afdf602bc191be1831a7101

Download Submit
C:\Windows\system\hYhyoNh.exe

Filesize
2.4MB

MD5
66d76a068ee434cd45c38f9384eef5bd

SHA1
f2f63b96488d65f16997a3f89cf3522e3d420c45

SHA256
be0b03f86ab57659c62f4ab474a890a7e428913249e5cc5091d9fa156119d12a

SHA512
aec785b439520338902138e66fc146e5128a8b44129d6904cf2f2f7396db80ab2f677b7dcafd67b72c9a2d73c6aa949a6ba8d2ae71879a6d52fddd08074039f9

Download Submit
C:\Windows\system\jiuFjIR.exe

Filesize
2.4MB

MD5
207c1f8e436bc34dc70f8439b83f1486

SHA1
7b3f51ad66e5060b215b1cc8ce2f4ac56f2ba25f

SHA256
5d5d3ef10b6d349189f21a72aa1f9cc0d9de5f7d5fb94367365c10d386575e9a

SHA512
f628329f3521c0453b613fa44cd47a74653bb9989362c980874eb334834928b31a612b410eda316b580b419f53afe1016f51f3ee9417e4f918dea54a6891c3b2

Download Submit
C:\Windows\system\kXKtTVo.exe

Filesize
2.4MB

MD5
81f6940cc4eeb4637d0b3879b921f156

SHA1
6e49afd5b2d27b22616e748190643c6794fcb17f

SHA256
41919bad275414e7818e575797a1e5d67fd8367442db46e38b60ba64808ac738

SHA512
46a6d1470aa32a69c40c49696be889f3f76917fee90cf533ae94784459f4cb6f1ed4e754dc1460384b205070a72e6410f6a95ca1593f87401d8d37d448202dcf

Download Submit
C:\Windows\system\kgeDNFz.exe

Filesize
2.4MB

MD5
e4d2ba8f11fd38e5f9cd1070ed4c74ef

SHA1
06c31b0ed1e3997b63f5b432d8b91bb2c9175e5b

SHA256
2456da8506395fe6613ca512365628e11f5cf90c3ace01058186df8d37929c4e

SHA512
e59b240271c92ffaf956077c0da0a70b513eb8904782d27606e3188357fcdd219647832b3bcea433d81830c17218d4be34dfcddb74ed0150c75e1e6efeb5e07f

Download Submit
C:\Windows\system\sHjJuOa.exe

Filesize
2.4MB

MD5
f503005a24593d4665815f39e0b3e066

SHA1
adae45602e1adc1dd1854df8aeb940451687b6fa

SHA256
f55ec2b16dabbb0677c7ee630265046831c524d1d1a0957d3501de293dc81d6c

SHA512
532b73a7e3f8205a265eff145c12fb26dd481fdc35329233678ef438f1eaf988ab6f682c5ea4562d97c783e043da8f94e903ad7159f1a21def756ed5181ce03a

Download Submit
C:\Windows\system\tnKbZcy.exe

Filesize
2.4MB

MD5
754405e7397ac229aa198d1231ee435c

SHA1
1542257784e6640b327a0243a5744ad448e85b25

SHA256
6c3b188161f852dc359374e64c4751b14ff9a71f0f6785f5db65fcbf13fc3027

SHA512
2e9f6ede173b418aba980a2ad9ebef7ac9ebcf378c9374df7074e26931ae16765a1cf94ce431ec0df45de0a0261ad4e797cf170b01b71e650e1672f4ba6777aa

Download Submit
C:\Windows\system\uEnNlso.exe

Filesize
2.4MB

MD5
63ee2e13ce6b639139b4a4298d24d3fe

SHA1
49754beb4456226770667e3052c0f68cb613f0a2

SHA256
1edd2f953c3dd2820887a0695ca957a40a8bc366a2f32344996680e7823086d0

SHA512
c4345e4b8b0737a1f8f399346f5b08e676d070dc935ef4afc1b94db039aadea2123518401c93dbd3d8235b1550d6f8fd1956c7676ef20bb3b8bea48b45fc6568

Download Submit
C:\Windows\system\xEhvhgO.exe

Filesize
2.4MB

MD5
ba8e84d792519ccc951d772c5a7e9808

SHA1
0a449909e6dddf1524e319423d0c78bdae2d0619

SHA256
d05e5af7b0ed890ce4066b6269902272a70b254331dc7b15eb5915d6023c50ec

SHA512
7b307f01b93741e45c033bb03275f7b9fdfde2a014e321c7ad95f76f4ee6faf948a9ce53d4ef671cd9ac7e3559373218ff3dfba5011a51f7bf9618195462c9bb

Download Submit
C:\Windows\system\xrMatUN.exe

Filesize
2.4MB

MD5
d272aa420b24470a70e1fb0da5c293e9

SHA1
d9716e90f716194f6d8ca8bf6f567c797aa32e34

SHA256
65dae6b70debfa0071b6c582787769f321fbcf6c4da1a35174b73dabe237873c

SHA512
e2f1cf25160a3de1f83ef9c37683336afade48ee4de9cea121a4db029863783f71a7edb9fa568cd0608dd2a4dad8dea3efc87a27962d15040f7b05d795089546

Download Submit
C:\Windows\system\zMUJBKp.exe

Filesize
2.4MB

MD5
1a4f0b0a67417c9cdc570422fe31d15a

SHA1
e7cfe99401b5c54c69126a41dc17f9638073cde0

SHA256
feae163e0cd74d634248b9aa26e64fd390c7717d63d66f2bc41b24f72a6338c2

SHA512
7eb3ad71ca34f8483fe9775793ced6937d53e6e1f840705b6ef05540e2fcc527d0a7a97ee297a3052f26ba387f4bae12178947d55c4f4ed8891c226c2af05a84

Download Submit
\Windows\system\BsqktFa.exe

Filesize
2.4MB

MD5
3234ce5a9c64a39185bf4c842ff0fab0

SHA1
8da0e43850be393ed26a9f61abad514195d47f04

SHA256
69a85ad45d3e041522e1718a036dafd99aa16ea05b9279d984b42f6c98bf7707

SHA512
fef280a9ac6893a92573ce2c688300a70553b2514abdce330a72d63a37679f974ce448433cfb08ade74b537c70fe6f2b8375a0123a8e6ab4b5493a2bbd3e4751

Download Submit
\Windows\system\HYvXmJz.exe

Filesize
2.4MB

MD5
b6affc93e093197a87fb9b31b5f3ac97

SHA1
ccf0b2d60d6216a8ea429d07ec58e65716e8cea4

SHA256
d351fd5683fbefd2ee0a2d3515769152b53caf32da8b171a0628f150de2f00df

SHA512
2ae27af2bdbd0c8a500f534bcf9f53779dd6b8c4ba3e9079794706838113abab73178c6e32985a2d05b388b5d6931752bfb3834cc83bc2b3bb21f4deaab6d1d4

Download Submit
\Windows\system\zlwYyrG.exe

Filesize
2.4MB

MD5
55fd6e969536b0190d28bf34eab71892

SHA1
fe7765b951fe014ff25ae2886a58e2023fcb541f

SHA256
109ce6640bbe906b07f5f6ad47342db702c599705acb377c0768d142ae9dfe1e

SHA512
81fb1faa8f78486b075d9ff1893497d6cfcb73efc5fca026a9f64c43c7d8cb4533dfdc4b73d7132cff208cec80975086854f30c9428eb05aec601b4272a3be8b

Download Submit
memory/1228-66-0x000000013FEF0000-0x00000001402E6000-memory.dmp

Filesize
4.0MB

Download
memory/1228-4382-0x000000013FEF0000-0x00000001402E6000-memory.dmp

Filesize
4.0MB

Download
memory/1724-74-0x0000000003330000-0x0000000003726000-memory.dmp

Filesize
4.0MB

Download
memory/1724-65-0x0000000003330000-0x0000000003726000-memory.dmp

Filesize
4.0MB

Download
memory/1724-1-0x000000013F3A0000-0x000000013F796000-memory.dmp

Filesize
4.0MB

Download
memory/1724-1268-0x000000013F3A0000-0x000000013F796000-memory.dmp

Filesize
4.0MB

Download
memory/1724-85-0x000000013F930000-0x000000013FD26000-memory.dmp

Filesize
4.0MB

Download
memory/1724-17-0x0000000003120000-0x0000000003516000-memory.dmp

Filesize
4.0MB

Download
memory/1724-73-0x000000013FEF0000-0x00000001402E6000-memory.dmp

Filesize
4.0MB

Download
memory/1724-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1724-2504-0x0000000003330000-0x0000000003726000-memory.dmp

Filesize
4.0MB

Download
memory/1724-25-0x0000000003120000-0x0000000003516000-memory.dmp

Filesize
4.0MB

Download
memory/1724-35-0x0000000003120000-0x0000000003516000-memory.dmp

Filesize
4.0MB

Download
memory/1724-68-0x0000000003330000-0x0000000003726000-memory.dmp

Filesize
4.0MB

Download
memory/1724-2662-0x0000000003330000-0x0000000003726000-memory.dmp

Filesize
4.0MB

Download
memory/1724-2204-0x000000013FB40000-0x000000013FF36000-memory.dmp

Filesize
4.0MB

Download
memory/1724-44-0x000000013FB40000-0x000000013FF36000-memory.dmp

Filesize
4.0MB

Download
memory/1724-58-0x000000013F7E0000-0x000000013FBD6000-memory.dmp

Filesize
4.0MB

Download
memory/1724-2811-0x0000000003330000-0x0000000003726000-memory.dmp

Filesize
4.0MB

Download
memory/1724-38-0x0000000003120000-0x0000000003516000-memory.dmp

Filesize
4.0MB

Download
memory/1724-3616-0x0000000003330000-0x0000000003726000-memory.dmp

Filesize
4.0MB

Download
memory/1968-72-0x000000013F660000-0x000000013FA56000-memory.dmp

Filesize
4.0MB

Download
memory/1968-4380-0x000000013F660000-0x000000013FA56000-memory.dmp

Filesize
4.0MB

Download
memory/2464-64-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2464-4376-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2524-4375-0x000000013F7E0000-0x000000013FBD6000-memory.dmp

Filesize
4.0MB

Download
memory/2524-69-0x000000013F7E0000-0x000000013FBD6000-memory.dmp

Filesize
4.0MB

Download
memory/2552-57-0x000000013FB40000-0x000000013FF36000-memory.dmp

Filesize
4.0MB

Download
memory/2552-4378-0x000000013FB40000-0x000000013FF36000-memory.dmp

Filesize
4.0MB

Download
memory/2592-4372-0x000000013F690000-0x000000013FA86000-memory.dmp

Filesize
4.0MB

Download
memory/2592-23-0x000000013F690000-0x000000013FA86000-memory.dmp

Filesize
4.0MB

Download
memory/2700-4379-0x000000013F710000-0x000000013FB06000-memory.dmp

Filesize
4.0MB

Download
memory/2700-83-0x000000013F710000-0x000000013FB06000-memory.dmp

Filesize
4.0MB

Download
memory/2728-52-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2728-4377-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2740-24-0x000000013F200000-0x000000013F5F6000-memory.dmp

Filesize
4.0MB

Download
memory/2740-4374-0x000000013F200000-0x000000013F5F6000-memory.dmp

Filesize
4.0MB

Download
memory/2828-84-0x000000013F930000-0x000000013FD26000-memory.dmp

Filesize
4.0MB

Download
memory/2828-4381-0x000000013F930000-0x000000013FD26000-memory.dmp

Filesize
4.0MB

Download
memory/2832-91-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download
memory/2832-4383-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download
memory/2872-1370-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2872-67-0x000007FEF5DCE000-0x000007FEF5DCF000-memory.dmp

Filesize
4KB

Download
memory/2872-2354-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/2872-39-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Filesize
512KB

Download
memory/2872-2657-0x000007FEF5DCE000-0x000007FEF5DCF000-memory.dmp

Filesize
4KB

Download
memory/2896-4373-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

Filesize
4.0MB

Download
memory/2896-29-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

Filesize
4.0MB

Download