xmrig | cb1b422aaa665f3e07aeafef788ed6d34016463c0d596168437374087ae10026

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d39c0e1f00ae0b952caedb50c2c2980.exe
Size

2.9MB
MD5

1d39c0e1f00ae0b952caedb50c2c2980
SHA1

03dd9768c4418410c7dd6a5e941d1c93c1426e3d
SHA256

cb1b422aaa665f3e07aeafef788ed6d34016463c0d596168437374087ae10026
SHA512

f0b82864cb9daac6fbbbfc09c5428391f7b454e11e5a3fe727043924888893926c04558c8105013eef28bc872985d04199ec0752f585423e2f1982cc476d6870
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BWgacx:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral1/memory/2240-1-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig
behavioral1/files/0x000a000000012286-6.dat	xmrig
behavioral1/memory/3004-9-0x000000013FB30000-0x000000013FF26000-memory.dmp	xmrig
behavioral1/memory/2752-19-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	xmrig
behavioral1/files/0x0036000000015cc7-14.dat	xmrig
behavioral1/files/0x000d00000000549e-23.dat	xmrig
behavioral1/files/0x0008000000015d24-29.dat	xmrig
behavioral1/files/0x0007000000015d3b-31.dat	xmrig
behavioral1/memory/2240-32-0x000000013F730000-0x000000013FB26000-memory.dmp	xmrig
behavioral1/memory/2740-25-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	xmrig
behavioral1/files/0x0007000000015d53-40.dat	xmrig
behavioral1/files/0x0036000000015cdf-45.dat	xmrig
behavioral1/files/0x0008000000015d7b-48.dat	xmrig
behavioral1/files/0x00060000000165e1-52.dat	xmrig
behavioral1/files/0x0006000000016835-56.dat	xmrig
behavioral1/files/0x0006000000016cc1-76.dat	xmrig
behavioral1/files/0x0006000000016d68-137.dat	xmrig
behavioral1/files/0x0006000000016dc8-162.dat	xmrig
behavioral1/memory/2732-196-0x000000013FE40000-0x0000000140236000-memory.dmp	xmrig
behavioral1/memory/1528-216-0x000000013FB10000-0x000000013FF06000-memory.dmp	xmrig
behavioral1/memory/1588-214-0x000000013F330000-0x000000013F726000-memory.dmp	xmrig
behavioral1/memory/2288-209-0x000000013F160000-0x000000013F556000-memory.dmp	xmrig
behavioral1/memory/2984-207-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/2564-205-0x000000013FED0000-0x00000001402C6000-memory.dmp	xmrig
behavioral1/memory/2504-203-0x000000013F550000-0x000000013F946000-memory.dmp	xmrig
behavioral1/files/0x0006000000016ddc-172.dat	xmrig
behavioral1/memory/2652-194-0x000000013F730000-0x000000013FB26000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d9f-152.dat	xmrig
behavioral1/files/0x0006000000016dd1-167.dat	xmrig
behavioral1/files/0x0006000000016dba-157.dat	xmrig
behavioral1/files/0x0006000000016d8b-147.dat	xmrig
behavioral1/files/0x0006000000016d6f-142.dat	xmrig
behavioral1/files/0x0006000000016d64-132.dat	xmrig
behavioral1/files/0x0006000000016d5f-127.dat	xmrig
behavioral1/files/0x0006000000016d4b-122.dat	xmrig
behavioral1/files/0x0006000000016d43-117.dat	xmrig
behavioral1/files/0x0006000000016d3b-112.dat	xmrig
behavioral1/files/0x0006000000016d2a-88.dat	xmrig
behavioral1/files/0x0006000000016d32-92.dat	xmrig
behavioral1/files/0x0006000000016d17-84.dat	xmrig
behavioral1/files/0x0006000000016ceb-80.dat	xmrig
behavioral1/files/0x0006000000016c78-72.dat	xmrig
behavioral1/files/0x0006000000016c6f-68.dat	xmrig
behavioral1/files/0x0006000000016c52-64.dat	xmrig
behavioral1/files/0x0006000000016a8a-60.dat	xmrig
behavioral1/memory/2240-2300-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig
behavioral1/memory/2752-2511-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	xmrig
behavioral1/memory/2740-2684-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	xmrig
behavioral1/memory/2712-2691-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	xmrig
behavioral1/memory/2504-5845-0x000000013F550000-0x000000013F946000-memory.dmp	xmrig
behavioral1/memory/2984-5846-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/2732-5855-0x000000013FE40000-0x0000000140236000-memory.dmp	xmrig
behavioral1/memory/2712-5854-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	xmrig
behavioral1/memory/2564-5853-0x000000013FED0000-0x00000001402C6000-memory.dmp	xmrig
behavioral1/memory/2752-5851-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	xmrig
behavioral1/memory/1528-5861-0x000000013FB10000-0x000000013FF06000-memory.dmp	xmrig
behavioral1/memory/2288-5862-0x000000013F160000-0x000000013F556000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2076	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3004	oszgXLh.exe
2752	uwENPeA.exe
2740	PyPOaKu.exe
2712	jUiahvu.exe
2652	ALABstD.exe
2732	muYhsYu.exe
2504	AEpQrZp.exe
2564	ZIDjBNC.exe
2984	ZxuLzUe.exe
2288	lpARZND.exe
1588	JEXjCnP.exe
1528	WYBUMLC.exe
1776	TlGMUqC.exe
1840	xsHhxMH.exe
2552	SIVKHLs.exe
1424	nHiyOoP.exe
2704	HqiuMmE.exe
1764	ihVUvlH.exe
2468	OpsyRmq.exe
2420	tHGQbPV.exe
1688	iARXlEf.exe
480	OiEqfVW.exe
268	zvNCsXc.exe
1616	ChKOVIg.exe
2812	LxVeLNa.exe
2824	JSEuhWU.exe
2952	lhjIVbC.exe
680	DXpqfmT.exe
1144	FkkbYSq.exe
2864	HiruOLn.exe
2348	pZXmPOV.exe
1088	pOriuPT.exe
576	wEKWNuf.exe
1504	oFYmoiT.exe
1124	pHfyXph.exe
3060	kWjoYpW.exe
1836	YapUYRu.exe
444	BKxUOsH.exe
2340	XEcVyWc.exe
1212	HFjdxhP.exe
760	ovLHgRb.exe
2832	mwrSTfT.exe
892	OpVdZPs.exe
1480	XMYSAfH.exe
1516	YGrxNoZ.exe
2084	jPqKHOS.exe
2972	sNDJhXG.exe
2828	CTPzIhN.exe
2964	TGseCJf.exe
2352	QGzZALx.exe
2088	sMcmAmk.exe
1936	sfBpdxA.exe
2976	tGDCeqL.exe
2236	PozrRSW.exe
1572	mNFzHnt.exe
1716	EhrLxqh.exe
2736	PqyFBPt.exe
2616	PYewFVV.exe
2956	OYLCBZD.exe
2524	gjLMgTz.exe
2132	uIemVbF.exe
1956	zqhxjxP.exe
1780	emFHqmh.exe
1992	psglSfX.exe

Loads dropped DLL 64 IoCs

pid	Process
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
2240	1d39c0e1f00ae0b952caedb50c2c2980.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-1-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx
behavioral1/files/0x000a000000012286-6.dat	upx
behavioral1/memory/3004-9-0x000000013FB30000-0x000000013FF26000-memory.dmp	upx
behavioral1/memory/2752-19-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	upx
behavioral1/files/0x0036000000015cc7-14.dat	upx
behavioral1/files/0x000d00000000549e-23.dat	upx
behavioral1/files/0x0008000000015d24-29.dat	upx
behavioral1/files/0x0007000000015d3b-31.dat	upx
behavioral1/memory/2240-32-0x000000013F730000-0x000000013FB26000-memory.dmp	upx
behavioral1/memory/2740-25-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	upx
behavioral1/files/0x0007000000015d53-40.dat	upx
behavioral1/files/0x0036000000015cdf-45.dat	upx
behavioral1/files/0x0008000000015d7b-48.dat	upx
behavioral1/files/0x00060000000165e1-52.dat	upx
behavioral1/files/0x0006000000016835-56.dat	upx
behavioral1/files/0x0006000000016cc1-76.dat	upx
behavioral1/files/0x0006000000016d68-137.dat	upx
behavioral1/files/0x0006000000016dc8-162.dat	upx
behavioral1/memory/2732-196-0x000000013FE40000-0x0000000140236000-memory.dmp	upx
behavioral1/memory/1528-216-0x000000013FB10000-0x000000013FF06000-memory.dmp	upx
behavioral1/memory/1588-214-0x000000013F330000-0x000000013F726000-memory.dmp	upx
behavioral1/memory/2288-209-0x000000013F160000-0x000000013F556000-memory.dmp	upx
behavioral1/memory/2984-207-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/2564-205-0x000000013FED0000-0x00000001402C6000-memory.dmp	upx
behavioral1/memory/2504-203-0x000000013F550000-0x000000013F946000-memory.dmp	upx
behavioral1/files/0x0006000000016ddc-172.dat	upx
behavioral1/memory/2652-194-0x000000013F730000-0x000000013FB26000-memory.dmp	upx
behavioral1/files/0x0006000000016d9f-152.dat	upx
behavioral1/files/0x0006000000016dd1-167.dat	upx
behavioral1/files/0x0006000000016dba-157.dat	upx
behavioral1/files/0x0006000000016d8b-147.dat	upx
behavioral1/files/0x0006000000016d6f-142.dat	upx
behavioral1/files/0x0006000000016d64-132.dat	upx
behavioral1/files/0x0006000000016d5f-127.dat	upx
behavioral1/files/0x0006000000016d4b-122.dat	upx
behavioral1/files/0x0006000000016d43-117.dat	upx
behavioral1/files/0x0006000000016d3b-112.dat	upx
behavioral1/files/0x0006000000016d2a-88.dat	upx
behavioral1/files/0x0006000000016d32-92.dat	upx
behavioral1/files/0x0006000000016d17-84.dat	upx
behavioral1/files/0x0006000000016ceb-80.dat	upx
behavioral1/files/0x0006000000016c78-72.dat	upx
behavioral1/files/0x0006000000016c6f-68.dat	upx
behavioral1/files/0x0006000000016c52-64.dat	upx
behavioral1/files/0x0006000000016a8a-60.dat	upx
behavioral1/memory/2240-2300-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx
behavioral1/memory/2752-2511-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	upx
behavioral1/memory/2740-2684-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	upx
behavioral1/memory/2712-2691-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	upx
behavioral1/memory/2504-5845-0x000000013F550000-0x000000013F946000-memory.dmp	upx
behavioral1/memory/2984-5846-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/2732-5855-0x000000013FE40000-0x0000000140236000-memory.dmp	upx
behavioral1/memory/2712-5854-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	upx
behavioral1/memory/2564-5853-0x000000013FED0000-0x00000001402C6000-memory.dmp	upx
behavioral1/memory/2752-5851-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	upx
behavioral1/memory/1528-5861-0x000000013FB10000-0x000000013FF06000-memory.dmp	upx
behavioral1/memory/2288-5862-0x000000013F160000-0x000000013F556000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jqVdkfB.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\WwGzTko.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\InqYsFE.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\UwlICOT.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\gzBhfsI.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\ooIsqih.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\CwuyFLS.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\ITXZVny.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\ymozegZ.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\eildnXP.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\IgQCGJD.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\UlUMEcg.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\gZfSuBt.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\XEQXtUS.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\NQoiwlY.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\dNiorOE.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\noDlndc.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\lVxtvNq.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\PTDEZFZ.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\JhjWzEO.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\nhsECvx.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\ATPjkal.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\GiKAoKo.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\LYWmKAf.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\KlSPGGF.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\THMIgce.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\GPNSXeQ.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\DyxEOIh.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\nzgEnMD.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\rAQTAbG.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\VxJPezZ.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\hnzaoTP.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\Lxwydfq.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\kQKfYxM.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\vCZITGf.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\BnupIJH.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\TEHkgxp.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\SgqVPRz.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\ZZcJjjA.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\sXuuWwM.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\ykNjKeH.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\dEaDNwl.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\owQlhuR.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\HumBqrM.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\vWADVTo.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\AhbNtye.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\XXWRbow.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\aHLJuiz.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\sOMkfkG.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\tdrHxpa.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\cByMDlj.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\ehynOKu.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\mIjJKwu.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\fbwNAcm.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\HGrCfXH.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\iHyqJxX.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\sMxLTUt.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\PZEDZkg.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\RbPQkxE.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\rDRmELA.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\NMAsLpu.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\rsgDwLy.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\sWzCQZJ.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe
File created	C:\Windows\System\PbFmgKK.exe	1d39c0e1f00ae0b952caedb50c2c2980.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2076	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
Token: SeLockMemoryPrivilege	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe
Token: SeDebugPrivilege	2076	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2076	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	29
PID 2240 wrote to memory of 2076	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	29
PID 2240 wrote to memory of 2076	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	29
PID 2240 wrote to memory of 3004	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	30
PID 2240 wrote to memory of 3004	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	30
PID 2240 wrote to memory of 3004	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	30
PID 2240 wrote to memory of 2752	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	31
PID 2240 wrote to memory of 2752	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	31
PID 2240 wrote to memory of 2752	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	31
PID 2240 wrote to memory of 2740	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	32
PID 2240 wrote to memory of 2740	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	32
PID 2240 wrote to memory of 2740	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	32
PID 2240 wrote to memory of 2712	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	33
PID 2240 wrote to memory of 2712	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	33
PID 2240 wrote to memory of 2712	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	33
PID 2240 wrote to memory of 2652	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	34
PID 2240 wrote to memory of 2652	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	34
PID 2240 wrote to memory of 2652	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	34
PID 2240 wrote to memory of 2732	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	35
PID 2240 wrote to memory of 2732	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	35
PID 2240 wrote to memory of 2732	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	35
PID 2240 wrote to memory of 2504	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	36
PID 2240 wrote to memory of 2504	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	36
PID 2240 wrote to memory of 2504	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	36
PID 2240 wrote to memory of 2564	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	37
PID 2240 wrote to memory of 2564	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	37
PID 2240 wrote to memory of 2564	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	37
PID 2240 wrote to memory of 2984	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	38
PID 2240 wrote to memory of 2984	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	38
PID 2240 wrote to memory of 2984	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	38
PID 2240 wrote to memory of 2288	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	39
PID 2240 wrote to memory of 2288	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	39
PID 2240 wrote to memory of 2288	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	39
PID 2240 wrote to memory of 1588	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	40
PID 2240 wrote to memory of 1588	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	40
PID 2240 wrote to memory of 1588	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	40
PID 2240 wrote to memory of 1528	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	41
PID 2240 wrote to memory of 1528	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	41
PID 2240 wrote to memory of 1528	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	41
PID 2240 wrote to memory of 1776	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	42
PID 2240 wrote to memory of 1776	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	42
PID 2240 wrote to memory of 1776	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	42
PID 2240 wrote to memory of 1840	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	43
PID 2240 wrote to memory of 1840	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	43
PID 2240 wrote to memory of 1840	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	43
PID 2240 wrote to memory of 2552	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	44
PID 2240 wrote to memory of 2552	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	44
PID 2240 wrote to memory of 2552	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	44
PID 2240 wrote to memory of 1424	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	45
PID 2240 wrote to memory of 1424	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	45
PID 2240 wrote to memory of 1424	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	45
PID 2240 wrote to memory of 2704	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	46
PID 2240 wrote to memory of 2704	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	46
PID 2240 wrote to memory of 2704	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	46
PID 2240 wrote to memory of 1764	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	47
PID 2240 wrote to memory of 1764	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	47
PID 2240 wrote to memory of 1764	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	47
PID 2240 wrote to memory of 2468	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	48
PID 2240 wrote to memory of 2468	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	48
PID 2240 wrote to memory of 2468	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	48
PID 2240 wrote to memory of 2420	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	49
PID 2240 wrote to memory of 2420	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	49
PID 2240 wrote to memory of 2420	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	49
PID 2240 wrote to memory of 1688	2240	1d39c0e1f00ae0b952caedb50c2c2980.exe	50

C:\Users\Admin\AppData\Local\Temp\1d39c0e1f00ae0b952caedb50c2c2980.exe
"C:\Users\Admin\AppData\Local\Temp\1d39c0e1f00ae0b952caedb50c2c2980.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\System\oszgXLh.exe
  C:\Windows\System\oszgXLh.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\uwENPeA.exe
  C:\Windows\System\uwENPeA.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\PyPOaKu.exe
  C:\Windows\System\PyPOaKu.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\jUiahvu.exe
  C:\Windows\System\jUiahvu.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\ALABstD.exe
  C:\Windows\System\ALABstD.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\muYhsYu.exe
  C:\Windows\System\muYhsYu.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\AEpQrZp.exe
  C:\Windows\System\AEpQrZp.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\ZIDjBNC.exe
  C:\Windows\System\ZIDjBNC.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\ZxuLzUe.exe
  C:\Windows\System\ZxuLzUe.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\lpARZND.exe
  C:\Windows\System\lpARZND.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\JEXjCnP.exe
  C:\Windows\System\JEXjCnP.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\WYBUMLC.exe
  C:\Windows\System\WYBUMLC.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\TlGMUqC.exe
  C:\Windows\System\TlGMUqC.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\xsHhxMH.exe
  C:\Windows\System\xsHhxMH.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\SIVKHLs.exe
  C:\Windows\System\SIVKHLs.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\nHiyOoP.exe
  C:\Windows\System\nHiyOoP.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\HqiuMmE.exe
  C:\Windows\System\HqiuMmE.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ihVUvlH.exe
  C:\Windows\System\ihVUvlH.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\OpsyRmq.exe
  C:\Windows\System\OpsyRmq.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\tHGQbPV.exe
  C:\Windows\System\tHGQbPV.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\iARXlEf.exe
  C:\Windows\System\iARXlEf.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\OiEqfVW.exe
  C:\Windows\System\OiEqfVW.exe
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Windows\System\zvNCsXc.exe
  C:\Windows\System\zvNCsXc.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\ChKOVIg.exe
  C:\Windows\System\ChKOVIg.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\LxVeLNa.exe
  C:\Windows\System\LxVeLNa.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\JSEuhWU.exe
  C:\Windows\System\JSEuhWU.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\lhjIVbC.exe
  C:\Windows\System\lhjIVbC.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\DXpqfmT.exe
  C:\Windows\System\DXpqfmT.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\FkkbYSq.exe
  C:\Windows\System\FkkbYSq.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\HiruOLn.exe
  C:\Windows\System\HiruOLn.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\pZXmPOV.exe
  C:\Windows\System\pZXmPOV.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\pOriuPT.exe
  C:\Windows\System\pOriuPT.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\wEKWNuf.exe
  C:\Windows\System\wEKWNuf.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\YapUYRu.exe
  C:\Windows\System\YapUYRu.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\oFYmoiT.exe
  C:\Windows\System\oFYmoiT.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\BKxUOsH.exe
  C:\Windows\System\BKxUOsH.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\pHfyXph.exe
  C:\Windows\System\pHfyXph.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\XEcVyWc.exe
  C:\Windows\System\XEcVyWc.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\kWjoYpW.exe
  C:\Windows\System\kWjoYpW.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\HFjdxhP.exe
  C:\Windows\System\HFjdxhP.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\ovLHgRb.exe
  C:\Windows\System\ovLHgRb.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\mwrSTfT.exe
  C:\Windows\System\mwrSTfT.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\OpVdZPs.exe
  C:\Windows\System\OpVdZPs.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\XMYSAfH.exe
  C:\Windows\System\XMYSAfH.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\YGrxNoZ.exe
  C:\Windows\System\YGrxNoZ.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\jPqKHOS.exe
  C:\Windows\System\jPqKHOS.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\sNDJhXG.exe
  C:\Windows\System\sNDJhXG.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\CTPzIhN.exe
  C:\Windows\System\CTPzIhN.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\TGseCJf.exe
  C:\Windows\System\TGseCJf.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\QGzZALx.exe
  C:\Windows\System\QGzZALx.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\sMcmAmk.exe
  C:\Windows\System\sMcmAmk.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\sfBpdxA.exe
  C:\Windows\System\sfBpdxA.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\tGDCeqL.exe
  C:\Windows\System\tGDCeqL.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\PozrRSW.exe
  C:\Windows\System\PozrRSW.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\mNFzHnt.exe
  C:\Windows\System\mNFzHnt.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\EhrLxqh.exe
  C:\Windows\System\EhrLxqh.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\PqyFBPt.exe
  C:\Windows\System\PqyFBPt.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\PYewFVV.exe
  C:\Windows\System\PYewFVV.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\OYLCBZD.exe
  C:\Windows\System\OYLCBZD.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\gjLMgTz.exe
  C:\Windows\System\gjLMgTz.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\uIemVbF.exe
  C:\Windows\System\uIemVbF.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\zqhxjxP.exe
  C:\Windows\System\zqhxjxP.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\emFHqmh.exe
  C:\Windows\System\emFHqmh.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\psglSfX.exe
  C:\Windows\System\psglSfX.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\pJIZgid.exe
  C:\Windows\System\pJIZgid.exe
  2⤵
  PID:1960
- C:\Windows\System\eMChqrp.exe
  C:\Windows\System\eMChqrp.exe
  2⤵
  PID:2208
- C:\Windows\System\zHalvxY.exe
  C:\Windows\System\zHalvxY.exe
  2⤵
  PID:1904
- C:\Windows\System\slwawOw.exe
  C:\Windows\System\slwawOw.exe
  2⤵
  PID:1988
- C:\Windows\System\fVGvOLf.exe
  C:\Windows\System\fVGvOLf.exe
  2⤵
  PID:1464
- C:\Windows\System\GQsAtLv.exe
  C:\Windows\System\GQsAtLv.exe
  2⤵
  PID:768
- C:\Windows\System\dLEChIn.exe
  C:\Windows\System\dLEChIn.exe
  2⤵
  PID:2788
- C:\Windows\System\ZXablli.exe
  C:\Windows\System\ZXablli.exe
  2⤵
  PID:2532
- C:\Windows\System\KAhMQPh.exe
  C:\Windows\System\KAhMQPh.exe
  2⤵
  PID:1696
- C:\Windows\System\dZdOlta.exe
  C:\Windows\System\dZdOlta.exe
  2⤵
  PID:2668
- C:\Windows\System\itTjhsV.exe
  C:\Windows\System\itTjhsV.exe
  2⤵
  PID:580
- C:\Windows\System\UStboGk.exe
  C:\Windows\System\UStboGk.exe
  2⤵
  PID:2840
- C:\Windows\System\ricXTyc.exe
  C:\Windows\System\ricXTyc.exe
  2⤵
  PID:404
- C:\Windows\System\DFvgoKL.exe
  C:\Windows\System\DFvgoKL.exe
  2⤵
  PID:2344
- C:\Windows\System\YevtXUP.exe
  C:\Windows\System\YevtXUP.exe
  2⤵
  PID:1760
- C:\Windows\System\LoPayll.exe
  C:\Windows\System\LoPayll.exe
  2⤵
  PID:2276
- C:\Windows\System\CiBHjhJ.exe
  C:\Windows\System\CiBHjhJ.exe
  2⤵
  PID:2656
- C:\Windows\System\ZREKZNG.exe
  C:\Windows\System\ZREKZNG.exe
  2⤵
  PID:2228
- C:\Windows\System\ilLyTal.exe
  C:\Windows\System\ilLyTal.exe
  2⤵
  PID:2044
- C:\Windows\System\OdyWHRW.exe
  C:\Windows\System\OdyWHRW.exe
  2⤵
  PID:1508
- C:\Windows\System\XafctYI.exe
  C:\Windows\System\XafctYI.exe
  2⤵
  PID:1188
- C:\Windows\System\ryZeWoF.exe
  C:\Windows\System\ryZeWoF.exe
  2⤵
  PID:600
- C:\Windows\System\vJGllvg.exe
  C:\Windows\System\vJGllvg.exe
  2⤵
  PID:2456
- C:\Windows\System\gsuCUPX.exe
  C:\Windows\System\gsuCUPX.exe
  2⤵
  PID:1712
- C:\Windows\System\nnucXlb.exe
  C:\Windows\System\nnucXlb.exe
  2⤵
  PID:3036
- C:\Windows\System\MUQDJeF.exe
  C:\Windows\System\MUQDJeF.exe
  2⤵
  PID:1380
- C:\Windows\System\NYunsRa.exe
  C:\Windows\System\NYunsRa.exe
  2⤵
  PID:868
- C:\Windows\System\ssLqjSM.exe
  C:\Windows\System\ssLqjSM.exe
  2⤵
  PID:880
- C:\Windows\System\zaHNVdX.exe
  C:\Windows\System\zaHNVdX.exe
  2⤵
  PID:1676
- C:\Windows\System\MrqOkyK.exe
  C:\Windows\System\MrqOkyK.exe
  2⤵
  PID:2544
- C:\Windows\System\NVOftYF.exe
  C:\Windows\System\NVOftYF.exe
  2⤵
  PID:2248
- C:\Windows\System\OuRArHa.exe
  C:\Windows\System\OuRArHa.exe
  2⤵
  PID:2144
- C:\Windows\System\XMfStsj.exe
  C:\Windows\System\XMfStsj.exe
  2⤵
  PID:2684
- C:\Windows\System\qaQjHWd.exe
  C:\Windows\System\qaQjHWd.exe
  2⤵
  PID:376
- C:\Windows\System\jBddBdP.exe
  C:\Windows\System\jBddBdP.exe
  2⤵
  PID:2944
- C:\Windows\System\HmrPrnl.exe
  C:\Windows\System\HmrPrnl.exe
  2⤵
  PID:2016
- C:\Windows\System\RrUifmW.exe
  C:\Windows\System\RrUifmW.exe
  2⤵
  PID:2412
- C:\Windows\System\lEoDpAz.exe
  C:\Windows\System\lEoDpAz.exe
  2⤵
  PID:1384
- C:\Windows\System\VNMimSv.exe
  C:\Windows\System\VNMimSv.exe
  2⤵
  PID:2404
- C:\Windows\System\qLXtFax.exe
  C:\Windows\System\qLXtFax.exe
  2⤵
  PID:2780
- C:\Windows\System\RrMtahZ.exe
  C:\Windows\System\RrMtahZ.exe
  2⤵
  PID:1916
- C:\Windows\System\bKAwhRC.exe
  C:\Windows\System\bKAwhRC.exe
  2⤵
  PID:1512
- C:\Windows\System\kApajLe.exe
  C:\Windows\System\kApajLe.exe
  2⤵
  PID:588
- C:\Windows\System\BzCSxft.exe
  C:\Windows\System\BzCSxft.exe
  2⤵
  PID:1600
- C:\Windows\System\DfyXElR.exe
  C:\Windows\System\DfyXElR.exe
  2⤵
  PID:3016
- C:\Windows\System\pWVNbyN.exe
  C:\Windows\System\pWVNbyN.exe
  2⤵
  PID:2040
- C:\Windows\System\YdVoIDP.exe
  C:\Windows\System\YdVoIDP.exe
  2⤵
  PID:1908
- C:\Windows\System\zhIQWtf.exe
  C:\Windows\System\zhIQWtf.exe
  2⤵
  PID:636
- C:\Windows\System\cRfOcQG.exe
  C:\Windows\System\cRfOcQG.exe
  2⤵
  PID:1920
- C:\Windows\System\xnXcmPK.exe
  C:\Windows\System\xnXcmPK.exe
  2⤵
  PID:2176
- C:\Windows\System\jEFanel.exe
  C:\Windows\System\jEFanel.exe
  2⤵
  PID:3000
- C:\Windows\System\avainmW.exe
  C:\Windows\System\avainmW.exe
  2⤵
  PID:620
- C:\Windows\System\WTplfNY.exe
  C:\Windows\System\WTplfNY.exe
  2⤵
  PID:2432
- C:\Windows\System\qPBKuda.exe
  C:\Windows\System\qPBKuda.exe
  2⤵
  PID:1704
- C:\Windows\System\OUwrBdM.exe
  C:\Windows\System\OUwrBdM.exe
  2⤵
  PID:1648
- C:\Windows\System\Owxvgnq.exe
  C:\Windows\System\Owxvgnq.exe
  2⤵
  PID:1276
- C:\Windows\System\WkpVWti.exe
  C:\Windows\System\WkpVWti.exe
  2⤵
  PID:2960
- C:\Windows\System\HTFzmgC.exe
  C:\Windows\System\HTFzmgC.exe
  2⤵
  PID:2592
- C:\Windows\System\TsaoGJs.exe
  C:\Windows\System\TsaoGJs.exe
  2⤵
  PID:1584
- C:\Windows\System\RQQxMdX.exe
  C:\Windows\System\RQQxMdX.exe
  2⤵
  PID:1812
- C:\Windows\System\LyLkGLA.exe
  C:\Windows\System\LyLkGLA.exe
  2⤵
  PID:1708
- C:\Windows\System\MkKlOSx.exe
  C:\Windows\System\MkKlOSx.exe
  2⤵
  PID:2416
- C:\Windows\System\YtAuKHn.exe
  C:\Windows\System\YtAuKHn.exe
  2⤵
  PID:1928
- C:\Windows\System\PKlwZhe.exe
  C:\Windows\System\PKlwZhe.exe
  2⤵
  PID:1244
- C:\Windows\System\uQSHGfH.exe
  C:\Windows\System\uQSHGfH.exe
  2⤵
  PID:2156
- C:\Windows\System\YwaoWQW.exe
  C:\Windows\System\YwaoWQW.exe
  2⤵
  PID:656
- C:\Windows\System\IDEoVxD.exe
  C:\Windows\System\IDEoVxD.exe
  2⤵
  PID:272
- C:\Windows\System\Qsmbcjb.exe
  C:\Windows\System\Qsmbcjb.exe
  2⤵
  PID:532
- C:\Windows\System\UjaKkqU.exe
  C:\Windows\System\UjaKkqU.exe
  2⤵
  PID:2848
- C:\Windows\System\gidZzhv.exe
  C:\Windows\System\gidZzhv.exe
  2⤵
  PID:1996
- C:\Windows\System\lnThYKT.exe
  C:\Windows\System\lnThYKT.exe
  2⤵
  PID:2188
- C:\Windows\System\jQXEEjb.exe
  C:\Windows\System\jQXEEjb.exe
  2⤵
  PID:884
- C:\Windows\System\qQcjONb.exe
  C:\Windows\System\qQcjONb.exe
  2⤵
  PID:1260
- C:\Windows\System\nAgOUuJ.exe
  C:\Windows\System\nAgOUuJ.exe
  2⤵
  PID:1800
- C:\Windows\System\RBmXZjz.exe
  C:\Windows\System\RBmXZjz.exe
  2⤵
  PID:2940
- C:\Windows\System\icaUSfR.exe
  C:\Windows\System\icaUSfR.exe
  2⤵
  PID:948
- C:\Windows\System\MXIWOLs.exe
  C:\Windows\System\MXIWOLs.exe
  2⤵
  PID:2716
- C:\Windows\System\RkAMFbB.exe
  C:\Windows\System\RkAMFbB.exe
  2⤵
  PID:1652
- C:\Windows\System\SENbYhR.exe
  C:\Windows\System\SENbYhR.exe
  2⤵
  PID:2336
- C:\Windows\System\EDjJhsP.exe
  C:\Windows\System\EDjJhsP.exe
  2⤵
  PID:2700
- C:\Windows\System\gjYakQt.exe
  C:\Windows\System\gjYakQt.exe
  2⤵
  PID:1564
- C:\Windows\System\xlCJYKl.exe
  C:\Windows\System\xlCJYKl.exe
  2⤵
  PID:1940
- C:\Windows\System\sYBeSfk.exe
  C:\Windows\System\sYBeSfk.exe
  2⤵
  PID:2204
- C:\Windows\System\ikofIqq.exe
  C:\Windows\System\ikofIqq.exe
  2⤵
  PID:1964
- C:\Windows\System\lUUlxia.exe
  C:\Windows\System\lUUlxia.exe
  2⤵
  PID:2424
- C:\Windows\System\wbvnyPK.exe
  C:\Windows\System\wbvnyPK.exe
  2⤵
  PID:304
- C:\Windows\System\uwDawXm.exe
  C:\Windows\System\uwDawXm.exe
  2⤵
  PID:1292
- C:\Windows\System\JvYemwO.exe
  C:\Windows\System\JvYemwO.exe
  2⤵
  PID:2772
- C:\Windows\System\yCDwdgY.exe
  C:\Windows\System\yCDwdgY.exe
  2⤵
  PID:2852
- C:\Windows\System\dZmwdLn.exe
  C:\Windows\System\dZmwdLn.exe
  2⤵
  PID:2728
- C:\Windows\System\Apvrnwc.exe
  C:\Windows\System\Apvrnwc.exe
  2⤵
  PID:2320
- C:\Windows\System\EnOJUNQ.exe
  C:\Windows\System\EnOJUNQ.exe
  2⤵
  PID:2308
- C:\Windows\System\nUaXfKE.exe
  C:\Windows\System\nUaXfKE.exe
  2⤵
  PID:1968
- C:\Windows\System\MFxfVBX.exe
  C:\Windows\System\MFxfVBX.exe
  2⤵
  PID:3032
- C:\Windows\System\xShZVdQ.exe
  C:\Windows\System\xShZVdQ.exe
  2⤵
  PID:1768
- C:\Windows\System\RpplUwa.exe
  C:\Windows\System\RpplUwa.exe
  2⤵
  PID:2428
- C:\Windows\System\RmKseNP.exe
  C:\Windows\System\RmKseNP.exe
  2⤵
  PID:2388
- C:\Windows\System\SpZDSYE.exe
  C:\Windows\System\SpZDSYE.exe
  2⤵
  PID:1556
- C:\Windows\System\fBsEHqw.exe
  C:\Windows\System\fBsEHqw.exe
  2⤵
  PID:2008
- C:\Windows\System\FPZPToG.exe
  C:\Windows\System\FPZPToG.exe
  2⤵
  PID:1888
- C:\Windows\System\fbsrefL.exe
  C:\Windows\System\fbsrefL.exe
  2⤵
  PID:2540
- C:\Windows\System\RStrCNo.exe
  C:\Windows\System\RStrCNo.exe
  2⤵
  PID:2232
- C:\Windows\System\NpZXTiy.exe
  C:\Windows\System\NpZXTiy.exe
  2⤵
  PID:1892
- C:\Windows\System\zkRGEwh.exe
  C:\Windows\System\zkRGEwh.exe
  2⤵
  PID:752
- C:\Windows\System\dTdJhlK.exe
  C:\Windows\System\dTdJhlK.exe
  2⤵
  PID:1596
- C:\Windows\System\RzqjKpp.exe
  C:\Windows\System\RzqjKpp.exe
  2⤵
  PID:1224
- C:\Windows\System\zFrwUYQ.exe
  C:\Windows\System\zFrwUYQ.exe
  2⤵
  PID:1628
- C:\Windows\System\eWpYQul.exe
  C:\Windows\System\eWpYQul.exe
  2⤵
  PID:836
- C:\Windows\System\fHcSuXn.exe
  C:\Windows\System\fHcSuXn.exe
  2⤵
  PID:2948
- C:\Windows\System\GxJTtcz.exe
  C:\Windows\System\GxJTtcz.exe
  2⤵
  PID:3092
- C:\Windows\System\XbcAUjt.exe
  C:\Windows\System\XbcAUjt.exe
  2⤵
  PID:3120
- C:\Windows\System\lpXGreh.exe
  C:\Windows\System\lpXGreh.exe
  2⤵
  PID:3136
- C:\Windows\System\kUysDRz.exe
  C:\Windows\System\kUysDRz.exe
  2⤵
  PID:3164
- C:\Windows\System\AGmWtZb.exe
  C:\Windows\System\AGmWtZb.exe
  2⤵
  PID:3184
- C:\Windows\System\EyDiBIW.exe
  C:\Windows\System\EyDiBIW.exe
  2⤵
  PID:3204
- C:\Windows\System\EsTlLTD.exe
  C:\Windows\System\EsTlLTD.exe
  2⤵
  PID:3220
- C:\Windows\System\qGikBZu.exe
  C:\Windows\System\qGikBZu.exe
  2⤵
  PID:3240
- C:\Windows\System\JiTHtPh.exe
  C:\Windows\System\JiTHtPh.exe
  2⤵
  PID:3260
- C:\Windows\System\ITXZVny.exe
  C:\Windows\System\ITXZVny.exe
  2⤵
  PID:3280
- C:\Windows\System\txJjyIT.exe
  C:\Windows\System\txJjyIT.exe
  2⤵
  PID:3300
- C:\Windows\System\dcdKtGl.exe
  C:\Windows\System\dcdKtGl.exe
  2⤵
  PID:3316
- C:\Windows\System\cmTegkd.exe
  C:\Windows\System\cmTegkd.exe
  2⤵
  PID:3332
- C:\Windows\System\OzjVTbK.exe
  C:\Windows\System\OzjVTbK.exe
  2⤵
  PID:3348
- C:\Windows\System\lnJRyWK.exe
  C:\Windows\System\lnJRyWK.exe
  2⤵
  PID:3372
- C:\Windows\System\mLDqfwA.exe
  C:\Windows\System\mLDqfwA.exe
  2⤵
  PID:3388
- C:\Windows\System\kibUXLt.exe
  C:\Windows\System\kibUXLt.exe
  2⤵
  PID:3404
- C:\Windows\System\yUzTNEP.exe
  C:\Windows\System\yUzTNEP.exe
  2⤵
  PID:3420
- C:\Windows\System\LedYAUK.exe
  C:\Windows\System\LedYAUK.exe
  2⤵
  PID:3440
- C:\Windows\System\SIdAGYP.exe
  C:\Windows\System\SIdAGYP.exe
  2⤵
  PID:3460
- C:\Windows\System\TeRsNnk.exe
  C:\Windows\System\TeRsNnk.exe
  2⤵
  PID:3480
- C:\Windows\System\fHlHeaG.exe
  C:\Windows\System\fHlHeaG.exe
  2⤵
  PID:3496
- C:\Windows\System\wDsPbAC.exe
  C:\Windows\System\wDsPbAC.exe
  2⤵
  PID:3512
- C:\Windows\System\SJpRVKC.exe
  C:\Windows\System\SJpRVKC.exe
  2⤵
  PID:3552
- C:\Windows\System\DvSBaym.exe
  C:\Windows\System\DvSBaym.exe
  2⤵
  PID:3568
- C:\Windows\System\pIGnRop.exe
  C:\Windows\System\pIGnRop.exe
  2⤵
  PID:3584
- C:\Windows\System\DVmVjeB.exe
  C:\Windows\System\DVmVjeB.exe
  2⤵
  PID:3600
- C:\Windows\System\aQYwGVj.exe
  C:\Windows\System\aQYwGVj.exe
  2⤵
  PID:3620
- C:\Windows\System\GOSbXkg.exe
  C:\Windows\System\GOSbXkg.exe
  2⤵
  PID:3648
- C:\Windows\System\qUofoHW.exe
  C:\Windows\System\qUofoHW.exe
  2⤵
  PID:3676
- C:\Windows\System\fQzfqEE.exe
  C:\Windows\System\fQzfqEE.exe
  2⤵
  PID:3700
- C:\Windows\System\LjQMUZD.exe
  C:\Windows\System\LjQMUZD.exe
  2⤵
  PID:3716
- C:\Windows\System\icOGAXH.exe
  C:\Windows\System\icOGAXH.exe
  2⤵
  PID:3740
- C:\Windows\System\AUELTUZ.exe
  C:\Windows\System\AUELTUZ.exe
  2⤵
  PID:3764
- C:\Windows\System\ARGBXze.exe
  C:\Windows\System\ARGBXze.exe
  2⤵
  PID:3784
- C:\Windows\System\GRrIuRP.exe
  C:\Windows\System\GRrIuRP.exe
  2⤵
  PID:3800
- C:\Windows\System\KoOzxId.exe
  C:\Windows\System\KoOzxId.exe
  2⤵
  PID:3816
- C:\Windows\System\HulqYKr.exe
  C:\Windows\System\HulqYKr.exe
  2⤵
  PID:3832
- C:\Windows\System\CYJRyNs.exe
  C:\Windows\System\CYJRyNs.exe
  2⤵
  PID:3848
- C:\Windows\System\FZsOMUt.exe
  C:\Windows\System\FZsOMUt.exe
  2⤵
  PID:3864
- C:\Windows\System\wJWrEBH.exe
  C:\Windows\System\wJWrEBH.exe
  2⤵
  PID:3880
- C:\Windows\System\RtRBwjU.exe
  C:\Windows\System\RtRBwjU.exe
  2⤵
  PID:3896
- C:\Windows\System\LwNSMWq.exe
  C:\Windows\System\LwNSMWq.exe
  2⤵
  PID:3912
- C:\Windows\System\RSZCwnS.exe
  C:\Windows\System\RSZCwnS.exe
  2⤵
  PID:3928
- C:\Windows\System\QVrUQFS.exe
  C:\Windows\System\QVrUQFS.exe
  2⤵
  PID:3944
- C:\Windows\System\HqonSwC.exe
  C:\Windows\System\HqonSwC.exe
  2⤵
  PID:3960
- C:\Windows\System\gONerQi.exe
  C:\Windows\System\gONerQi.exe
  2⤵
  PID:3992
- C:\Windows\System\sgHdIDu.exe
  C:\Windows\System\sgHdIDu.exe
  2⤵
  PID:4012
- C:\Windows\System\QQdDCnL.exe
  C:\Windows\System\QQdDCnL.exe
  2⤵
  PID:4032
- C:\Windows\System\YgqtbKW.exe
  C:\Windows\System\YgqtbKW.exe
  2⤵
  PID:4056
- C:\Windows\System\uPZrVhi.exe
  C:\Windows\System\uPZrVhi.exe
  2⤵
  PID:4072
- C:\Windows\System\rgEspmF.exe
  C:\Windows\System\rgEspmF.exe
  2⤵
  PID:4088
- C:\Windows\System\YjFmlnM.exe
  C:\Windows\System\YjFmlnM.exe
  2⤵
  PID:1792
- C:\Windows\System\tQOnAgu.exe
  C:\Windows\System\tQOnAgu.exe
  2⤵
  PID:3080
- C:\Windows\System\DBICctK.exe
  C:\Windows\System\DBICctK.exe
  2⤵
  PID:1756
- C:\Windows\System\WFHtFOw.exe
  C:\Windows\System\WFHtFOw.exe
  2⤵
  PID:2596
- C:\Windows\System\WEziESE.exe
  C:\Windows\System\WEziESE.exe
  2⤵
  PID:936
- C:\Windows\System\gvTagBs.exe
  C:\Windows\System\gvTagBs.exe
  2⤵
  PID:3152
- C:\Windows\System\VgyDPHV.exe
  C:\Windows\System\VgyDPHV.exe
  2⤵
  PID:3148
- C:\Windows\System\lMYvmDy.exe
  C:\Windows\System\lMYvmDy.exe
  2⤵
  PID:3212
- C:\Windows\System\ZrAKLBV.exe
  C:\Windows\System\ZrAKLBV.exe
  2⤵
  PID:3324
- C:\Windows\System\FaYewjn.exe
  C:\Windows\System\FaYewjn.exe
  2⤵
  PID:3276
- C:\Windows\System\bXdhUcs.exe
  C:\Windows\System\bXdhUcs.exe
  2⤵
  PID:3228
- C:\Windows\System\xigdIqV.exe
  C:\Windows\System\xigdIqV.exe
  2⤵
  PID:3236
- C:\Windows\System\rBNuEGQ.exe
  C:\Windows\System\rBNuEGQ.exe
  2⤵
  PID:3428
- C:\Windows\System\bhvjWGf.exe
  C:\Windows\System\bhvjWGf.exe
  2⤵
  PID:3504
- C:\Windows\System\tdtPfMl.exe
  C:\Windows\System\tdtPfMl.exe
  2⤵
  PID:3596
- C:\Windows\System\sNiRYyO.exe
  C:\Windows\System\sNiRYyO.exe
  2⤵
  PID:3636
- C:\Windows\System\kxoFarN.exe
  C:\Windows\System\kxoFarN.exe
  2⤵
  PID:3456
- C:\Windows\System\eIteLjY.exe
  C:\Windows\System\eIteLjY.exe
  2⤵
  PID:3524
- C:\Windows\System\mTBStuP.exe
  C:\Windows\System\mTBStuP.exe
  2⤵
  PID:3692
- C:\Windows\System\ugBjCnp.exe
  C:\Windows\System\ugBjCnp.exe
  2⤵
  PID:3608
- C:\Windows\System\nXSGasr.exe
  C:\Windows\System\nXSGasr.exe
  2⤵
  PID:3724
- C:\Windows\System\DQDCmDD.exe
  C:\Windows\System\DQDCmDD.exe
  2⤵
  PID:3660
- C:\Windows\System\yiDjDjt.exe
  C:\Windows\System\yiDjDjt.exe
  2⤵
  PID:3772
- C:\Windows\System\koBFtif.exe
  C:\Windows\System\koBFtif.exe
  2⤵
  PID:3872
- C:\Windows\System\nYrEJMM.exe
  C:\Windows\System\nYrEJMM.exe
  2⤵
  PID:3908
- C:\Windows\System\bqObciY.exe
  C:\Windows\System\bqObciY.exe
  2⤵
  PID:3972
- C:\Windows\System\pDbDqqH.exe
  C:\Windows\System\pDbDqqH.exe
  2⤵
  PID:3988
- C:\Windows\System\erNssuM.exe
  C:\Windows\System\erNssuM.exe
  2⤵
  PID:3756
- C:\Windows\System\gimleCg.exe
  C:\Windows\System\gimleCg.exe
  2⤵
  PID:3792
- C:\Windows\System\TRAnJby.exe
  C:\Windows\System\TRAnJby.exe
  2⤵
  PID:3888
- C:\Windows\System\EmEDGYC.exe
  C:\Windows\System\EmEDGYC.exe
  2⤵
  PID:4000
- C:\Windows\System\eFcLsvP.exe
  C:\Windows\System\eFcLsvP.exe
  2⤵
  PID:4044
- C:\Windows\System\vbSHLCq.exe
  C:\Windows\System\vbSHLCq.exe
  2⤵
  PID:2640
- C:\Windows\System\AVoCjoG.exe
  C:\Windows\System\AVoCjoG.exe
  2⤵
  PID:3076
- C:\Windows\System\vkjhSxL.exe
  C:\Windows\System\vkjhSxL.exe
  2⤵
  PID:4048
- C:\Windows\System\iJjxKUU.exe
  C:\Windows\System\iJjxKUU.exe
  2⤵
  PID:292
- C:\Windows\System\RUESXCH.exe
  C:\Windows\System\RUESXCH.exe
  2⤵
  PID:3132
- C:\Windows\System\UKmLEsH.exe
  C:\Windows\System\UKmLEsH.exe
  2⤵
  PID:3116
- C:\Windows\System\odQOuJv.exe
  C:\Windows\System\odQOuJv.exe
  2⤵
  PID:3312
- C:\Windows\System\JiIfgJC.exe
  C:\Windows\System\JiIfgJC.exe
  2⤵
  PID:3272
- C:\Windows\System\GIHEuDU.exe
  C:\Windows\System\GIHEuDU.exe
  2⤵
  PID:3448
- C:\Windows\System\IqkfSsB.exe
  C:\Windows\System\IqkfSsB.exe
  2⤵
  PID:2444
- C:\Windows\System\gOlBDgf.exe
  C:\Windows\System\gOlBDgf.exe
  2⤵
  PID:3476
- C:\Windows\System\kmSzRIY.exe
  C:\Windows\System\kmSzRIY.exe
  2⤵
  PID:3400
- C:\Windows\System\zdQbMmy.exe
  C:\Windows\System\zdQbMmy.exe
  2⤵
  PID:3684
- C:\Windows\System\VpclgDM.exe
  C:\Windows\System\VpclgDM.exe
  2⤵
  PID:3632
- C:\Windows\System\sSjBWcZ.exe
  C:\Windows\System\sSjBWcZ.exe
  2⤵
  PID:3580
- C:\Windows\System\sdQnqhg.exe
  C:\Windows\System\sdQnqhg.exe
  2⤵
  PID:3656
- C:\Windows\System\lnROPrF.exe
  C:\Windows\System\lnROPrF.exe
  2⤵
  PID:3752
- C:\Windows\System\IUoemND.exe
  C:\Windows\System\IUoemND.exe
  2⤵
  PID:3924
- C:\Windows\System\ZZwxSkI.exe
  C:\Windows\System\ZZwxSkI.exe
  2⤵
  PID:3812
- C:\Windows\System\qtnrTsI.exe
  C:\Windows\System\qtnrTsI.exe
  2⤵
  PID:3940
- C:\Windows\System\cxBpEGZ.exe
  C:\Windows\System\cxBpEGZ.exe
  2⤵
  PID:3828
- C:\Windows\System\XqvHCZn.exe
  C:\Windows\System\XqvHCZn.exe
  2⤵
  PID:3088
- C:\Windows\System\SZFiFNO.exe
  C:\Windows\System\SZFiFNO.exe
  2⤵
  PID:3160
- C:\Windows\System\LDUrtwg.exe
  C:\Windows\System\LDUrtwg.exe
  2⤵
  PID:3256
- C:\Windows\System\ABftydO.exe
  C:\Windows\System\ABftydO.exe
  2⤵
  PID:3288
- C:\Windows\System\tmyfgmw.exe
  C:\Windows\System\tmyfgmw.exe
  2⤵
  PID:1604
- C:\Windows\System\kGiRMBT.exe
  C:\Windows\System\kGiRMBT.exe
  2⤵
  PID:3384
- C:\Windows\System\TQaLMql.exe
  C:\Windows\System\TQaLMql.exe
  2⤵
  PID:3644
- C:\Windows\System\QRSJCIe.exe
  C:\Windows\System\QRSJCIe.exe
  2⤵
  PID:3472
- C:\Windows\System\HrmgSlP.exe
  C:\Windows\System\HrmgSlP.exe
  2⤵
  PID:3540
- C:\Windows\System\gYOZhwa.exe
  C:\Windows\System\gYOZhwa.exe
  2⤵
  PID:3576
- C:\Windows\System\xAMCttt.exe
  C:\Windows\System\xAMCttt.exe
  2⤵
  PID:3956
- C:\Windows\System\IIUGgAN.exe
  C:\Windows\System\IIUGgAN.exe
  2⤵
  PID:3616
- C:\Windows\System\cKGLIOQ.exe
  C:\Windows\System\cKGLIOQ.exe
  2⤵
  PID:3712
- C:\Windows\System\JMLDWoZ.exe
  C:\Windows\System\JMLDWoZ.exe
  2⤵
  PID:4028
- C:\Windows\System\nvoOkuL.exe
  C:\Windows\System\nvoOkuL.exe
  2⤵
  PID:4084
- C:\Windows\System\lApqsaP.exe
  C:\Windows\System\lApqsaP.exe
  2⤵
  PID:3200
- C:\Windows\System\gVdXEvZ.exe
  C:\Windows\System\gVdXEvZ.exe
  2⤵
  PID:4104
- C:\Windows\System\aHtYtwl.exe
  C:\Windows\System\aHtYtwl.exe
  2⤵
  PID:4140
- C:\Windows\System\sruzYUs.exe
  C:\Windows\System\sruzYUs.exe
  2⤵
  PID:4156
- C:\Windows\System\CaENwba.exe
  C:\Windows\System\CaENwba.exe
  2⤵
  PID:4172
- C:\Windows\System\kBvEtyf.exe
  C:\Windows\System\kBvEtyf.exe
  2⤵
  PID:4188
- C:\Windows\System\olVHeqJ.exe
  C:\Windows\System\olVHeqJ.exe
  2⤵
  PID:4204
- C:\Windows\System\EJbQFCD.exe
  C:\Windows\System\EJbQFCD.exe
  2⤵
  PID:4224
- C:\Windows\System\wjBAVvT.exe
  C:\Windows\System\wjBAVvT.exe
  2⤵
  PID:4244
- C:\Windows\System\yVnMhJL.exe
  C:\Windows\System\yVnMhJL.exe
  2⤵
  PID:4264
- C:\Windows\System\iwahPjQ.exe
  C:\Windows\System\iwahPjQ.exe
  2⤵
  PID:4288
- C:\Windows\System\vDPPXec.exe
  C:\Windows\System\vDPPXec.exe
  2⤵
  PID:4316
- C:\Windows\System\aGgTwqA.exe
  C:\Windows\System\aGgTwqA.exe
  2⤵
  PID:4352
- C:\Windows\System\alJyEPC.exe
  C:\Windows\System\alJyEPC.exe
  2⤵
  PID:4376
- C:\Windows\System\fmoGQwV.exe
  C:\Windows\System\fmoGQwV.exe
  2⤵
  PID:4392
- C:\Windows\System\payCrJF.exe
  C:\Windows\System\payCrJF.exe
  2⤵
  PID:4408
- C:\Windows\System\pxajdhz.exe
  C:\Windows\System\pxajdhz.exe
  2⤵
  PID:4424
- C:\Windows\System\NGUMRXG.exe
  C:\Windows\System\NGUMRXG.exe
  2⤵
  PID:4440
- C:\Windows\System\ovMTZGM.exe
  C:\Windows\System\ovMTZGM.exe
  2⤵
  PID:4460
- C:\Windows\System\mCqjGRk.exe
  C:\Windows\System\mCqjGRk.exe
  2⤵
  PID:4484
- C:\Windows\System\IYqnxGr.exe
  C:\Windows\System\IYqnxGr.exe
  2⤵
  PID:4504
- C:\Windows\System\lPAKAxj.exe
  C:\Windows\System\lPAKAxj.exe
  2⤵
  PID:4528
- C:\Windows\System\hktLQFk.exe
  C:\Windows\System\hktLQFk.exe
  2⤵
  PID:4548
- C:\Windows\System\XauGpOF.exe
  C:\Windows\System\XauGpOF.exe
  2⤵
  PID:4564
- C:\Windows\System\gLYASBC.exe
  C:\Windows\System\gLYASBC.exe
  2⤵
  PID:4580
- C:\Windows\System\IvVALqc.exe
  C:\Windows\System\IvVALqc.exe
  2⤵
  PID:4596
- C:\Windows\System\fFljMif.exe
  C:\Windows\System\fFljMif.exe
  2⤵
  PID:4612
- C:\Windows\System\pwUALag.exe
  C:\Windows\System\pwUALag.exe
  2⤵
  PID:4628
- C:\Windows\System\iAeXKbd.exe
  C:\Windows\System\iAeXKbd.exe
  2⤵
  PID:4648
- C:\Windows\System\GvpZzjL.exe
  C:\Windows\System\GvpZzjL.exe
  2⤵
  PID:4668
- C:\Windows\System\LmnxsIH.exe
  C:\Windows\System\LmnxsIH.exe
  2⤵
  PID:4692
- C:\Windows\System\ckcIzGS.exe
  C:\Windows\System\ckcIzGS.exe
  2⤵
  PID:4708
- C:\Windows\System\DyTiqtr.exe
  C:\Windows\System\DyTiqtr.exe
  2⤵
  PID:4728
- C:\Windows\System\jNTVUMa.exe
  C:\Windows\System\jNTVUMa.exe
  2⤵
  PID:4744
- C:\Windows\System\HEhXAai.exe
  C:\Windows\System\HEhXAai.exe
  2⤵
  PID:4760
- C:\Windows\System\YiWwDMr.exe
  C:\Windows\System\YiWwDMr.exe
  2⤵
  PID:4780
- C:\Windows\System\RRrtBPB.exe
  C:\Windows\System\RRrtBPB.exe
  2⤵
  PID:4800
- C:\Windows\System\ATPjkal.exe
  C:\Windows\System\ATPjkal.exe
  2⤵
  PID:4820
- C:\Windows\System\sIcMWHv.exe
  C:\Windows\System\sIcMWHv.exe
  2⤵
  PID:4836
- C:\Windows\System\mEaejlp.exe
  C:\Windows\System\mEaejlp.exe
  2⤵
  PID:4868
- C:\Windows\System\TPzptEF.exe
  C:\Windows\System\TPzptEF.exe
  2⤵
  PID:4888
- C:\Windows\System\WXEtKIh.exe
  C:\Windows\System\WXEtKIh.exe
  2⤵
  PID:4904
- C:\Windows\System\TjPtfCS.exe
  C:\Windows\System\TjPtfCS.exe
  2⤵
  PID:4924
- C:\Windows\System\hZZZsNo.exe
  C:\Windows\System\hZZZsNo.exe
  2⤵
  PID:4944
- C:\Windows\System\icSpYXq.exe
  C:\Windows\System\icSpYXq.exe
  2⤵
  PID:4972
- C:\Windows\System\DMhbLms.exe
  C:\Windows\System\DMhbLms.exe
  2⤵
  PID:5008
- C:\Windows\System\QTXsYiI.exe
  C:\Windows\System\QTXsYiI.exe
  2⤵
  PID:5024
- C:\Windows\System\FUAddRM.exe
  C:\Windows\System\FUAddRM.exe
  2⤵
  PID:5040
- C:\Windows\System\kFhBhmb.exe
  C:\Windows\System\kFhBhmb.exe
  2⤵
  PID:5060
- C:\Windows\System\hMeuWyK.exe
  C:\Windows\System\hMeuWyK.exe
  2⤵
  PID:5076
- C:\Windows\System\oscSCRX.exe
  C:\Windows\System\oscSCRX.exe
  2⤵
  PID:5092
- C:\Windows\System\VeLecJM.exe
  C:\Windows\System\VeLecJM.exe
  2⤵
  PID:5108
- C:\Windows\System\pjJChxu.exe
  C:\Windows\System\pjJChxu.exe
  2⤵
  PID:3984
- C:\Windows\System\Mhovisb.exe
  C:\Windows\System\Mhovisb.exe
  2⤵
  PID:4040
- C:\Windows\System\TIKiWyq.exe
  C:\Windows\System\TIKiWyq.exe
  2⤵
  PID:3952
- C:\Windows\System\jfQtpWY.exe
  C:\Windows\System\jfQtpWY.exe
  2⤵
  PID:3100
- C:\Windows\System\LuflXEn.exe
  C:\Windows\System\LuflXEn.exe
  2⤵
  PID:4124
- C:\Windows\System\WEUECsy.exe
  C:\Windows\System\WEUECsy.exe
  2⤵
  PID:4200
- C:\Windows\System\jIDDdYg.exe
  C:\Windows\System\jIDDdYg.exe
  2⤵
  PID:4276
- C:\Windows\System\apkeXzE.exe
  C:\Windows\System\apkeXzE.exe
  2⤵
  PID:3144
- C:\Windows\System\RAhKSNm.exe
  C:\Windows\System\RAhKSNm.exe
  2⤵
  PID:4336
- C:\Windows\System\irlakqb.exe
  C:\Windows\System\irlakqb.exe
  2⤵
  PID:4676
- C:\Windows\System\ixbGjHW.exe
  C:\Windows\System\ixbGjHW.exe
  2⤵
  PID:3980
- C:\Windows\System\ZsbHrsu.exe
  C:\Windows\System\ZsbHrsu.exe
  2⤵
  PID:2360
- C:\Windows\System\BxsJFwM.exe
  C:\Windows\System\BxsJFwM.exe
  2⤵
  PID:4180
- C:\Windows\System\nFkWdww.exe
  C:\Windows\System\nFkWdww.exe
  2⤵
  PID:4304
- C:\Windows\System\DKQhjZm.exe
  C:\Windows\System\DKQhjZm.exe
  2⤵
  PID:4756
- C:\Windows\System\zbeNgVd.exe
  C:\Windows\System\zbeNgVd.exe
  2⤵
  PID:4912
- C:\Windows\System\lAvMIGT.exe
  C:\Windows\System\lAvMIGT.exe
  2⤵
  PID:4876
- C:\Windows\System\ssFqBvb.exe
  C:\Windows\System\ssFqBvb.exe
  2⤵
  PID:4920
- C:\Windows\System\QLyEOex.exe
  C:\Windows\System\QLyEOex.exe
  2⤵
  PID:4968
- C:\Windows\System\JONTqzT.exe
  C:\Windows\System\JONTqzT.exe
  2⤵
  PID:5116
- C:\Windows\System\wiTTIfo.exe
  C:\Windows\System\wiTTIfo.exe
  2⤵
  PID:4120
- C:\Windows\System\QVLLzGe.exe
  C:\Windows\System\QVLLzGe.exe
  2⤵
  PID:4432
- C:\Windows\System\pOpDnwV.exe
  C:\Windows\System\pOpDnwV.exe
  2⤵
  PID:4436
- C:\Windows\System\ieYowmp.exe
  C:\Windows\System\ieYowmp.exe
  2⤵
  PID:4372
- C:\Windows\System\ZXvONfE.exe
  C:\Windows\System\ZXvONfE.exe
  2⤵
  PID:4296
- C:\Windows\System\DpwPBsh.exe
  C:\Windows\System\DpwPBsh.exe
  2⤵
  PID:4240
- C:\Windows\System\gvnwEyV.exe
  C:\Windows\System\gvnwEyV.exe
  2⤵
  PID:4940
- C:\Windows\System\IzjubBt.exe
  C:\Windows\System\IzjubBt.exe
  2⤵
  PID:5104
- C:\Windows\System\aoGuEsq.exe
  C:\Windows\System\aoGuEsq.exe
  2⤵
  PID:4588
- C:\Windows\System\fZphROs.exe
  C:\Windows\System\fZphROs.exe
  2⤵
  PID:4664
- C:\Windows\System\QOUfmzn.exe
  C:\Windows\System\QOUfmzn.exe
  2⤵
  PID:4988
- C:\Windows\System\YRQbyIA.exe
  C:\Windows\System\YRQbyIA.exe
  2⤵
  PID:5032
- C:\Windows\System\rgzmFdk.exe
  C:\Windows\System\rgzmFdk.exe
  2⤵
  PID:4984
- C:\Windows\System\dQFcMCC.exe
  C:\Windows\System\dQFcMCC.exe
  2⤵
  PID:4900
- C:\Windows\System\UeNZTja.exe
  C:\Windows\System\UeNZTja.exe
  2⤵
  PID:4812
- C:\Windows\System\HVdwBOS.exe
  C:\Windows\System\HVdwBOS.exe
  2⤵
  PID:4736
- C:\Windows\System\ftkpkWT.exe
  C:\Windows\System\ftkpkWT.exe
  2⤵
  PID:4132
- C:\Windows\System\pCSoPIE.exe
  C:\Windows\System\pCSoPIE.exe
  2⤵
  PID:4196
- C:\Windows\System\ELRDaUt.exe
  C:\Windows\System\ELRDaUt.exe
  2⤵
  PID:4344
- C:\Windows\System\IjQDcYR.exe
  C:\Windows\System\IjQDcYR.exe
  2⤵
  PID:4080
- C:\Windows\System\CfUjDRl.exe
  C:\Windows\System\CfUjDRl.exe
  2⤵
  PID:4452
- C:\Windows\System\SImhnzk.exe
  C:\Windows\System\SImhnzk.exe
  2⤵
  PID:3468
- C:\Windows\System\RREnHSB.exe
  C:\Windows\System\RREnHSB.exe
  2⤵
  PID:4576
- C:\Windows\System\nvjPPOt.exe
  C:\Windows\System\nvjPPOt.exe
  2⤵
  PID:2028
- C:\Windows\System\IhuHevN.exe
  C:\Windows\System\IhuHevN.exe
  2⤵
  PID:4684
- C:\Windows\System\iCFVGyd.exe
  C:\Windows\System\iCFVGyd.exe
  2⤵
  PID:3364
- C:\Windows\System\DSlMCgZ.exe
  C:\Windows\System\DSlMCgZ.exe
  2⤵
  PID:2460
- C:\Windows\System\TWfDsOg.exe
  C:\Windows\System\TWfDsOg.exe
  2⤵
  PID:4716
- C:\Windows\System\IUpObwv.exe
  C:\Windows\System\IUpObwv.exe
  2⤵
  PID:4796
- C:\Windows\System\dMYTiJx.exe
  C:\Windows\System\dMYTiJx.exe
  2⤵
  PID:4832
- C:\Windows\System\QnfaedH.exe
  C:\Windows\System\QnfaedH.exe
  2⤵
  PID:5048
- C:\Windows\System\CpFqoLK.exe
  C:\Windows\System\CpFqoLK.exe
  2⤵
  PID:3528
- C:\Windows\System\XXfWVai.exe
  C:\Windows\System\XXfWVai.exe
  2⤵
  PID:4476
- C:\Windows\System\uPVLOll.exe
  C:\Windows\System\uPVLOll.exe
  2⤵
  PID:4368
- C:\Windows\System\uLxFpla.exe
  C:\Windows\System\uLxFpla.exe
  2⤵
  PID:4992
- C:\Windows\System\unOVXoS.exe
  C:\Windows\System\unOVXoS.exe
  2⤵
  PID:4400
- C:\Windows\System\gQfgpgs.exe
  C:\Windows\System\gQfgpgs.exe
  2⤵
  PID:1344
- C:\Windows\System\HfZXoDF.exe
  C:\Windows\System\HfZXoDF.exe
  2⤵
  PID:5068
- C:\Windows\System\TeCRkjC.exe
  C:\Windows\System\TeCRkjC.exe
  2⤵
  PID:4852
- C:\Windows\System\iaPeMjY.exe
  C:\Windows\System\iaPeMjY.exe
  2⤵
  PID:4512
- C:\Windows\System\XXxQwJj.exe
  C:\Windows\System\XXxQwJj.exe
  2⤵
  PID:4624
- C:\Windows\System\zoSETzn.exe
  C:\Windows\System\zoSETzn.exe
  2⤵
  PID:4384
- C:\Windows\System\rzJuDjt.exe
  C:\Windows\System\rzJuDjt.exe
  2⤵
  PID:952
- C:\Windows\System\TxzCQpT.exe
  C:\Windows\System\TxzCQpT.exe
  2⤵
  PID:4688
- C:\Windows\System\pBmErTe.exe
  C:\Windows\System\pBmErTe.exe
  2⤵
  PID:4572
- C:\Windows\System\NbkHQYX.exe
  C:\Windows\System\NbkHQYX.exe
  2⤵
  PID:1192
- C:\Windows\System\inQlySI.exe
  C:\Windows\System\inQlySI.exe
  2⤵
  PID:1112
- C:\Windows\System\KNxrsDw.exe
  C:\Windows\System\KNxrsDw.exe
  2⤵
  PID:4848
- C:\Windows\System\exUIiHa.exe
  C:\Windows\System\exUIiHa.exe
  2⤵
  PID:4328
- C:\Windows\System\YtVDZlI.exe
  C:\Windows\System\YtVDZlI.exe
  2⤵
  PID:4740
- C:\Windows\System\VYSVcuG.exe
  C:\Windows\System\VYSVcuG.exe
  2⤵
  PID:4844
- C:\Windows\System\fCJALVy.exe
  C:\Windows\System\fCJALVy.exe
  2⤵
  PID:4932
- C:\Windows\System\srhOzsQ.exe
  C:\Windows\System\srhOzsQ.exe
  2⤵
  PID:4860
- C:\Windows\System\MYLCsnb.exe
  C:\Windows\System\MYLCsnb.exe
  2⤵
  PID:5004
- C:\Windows\System\OHUYENh.exe
  C:\Windows\System\OHUYENh.exe
  2⤵
  PID:4388
- C:\Windows\System\BwulxmR.exe
  C:\Windows\System\BwulxmR.exe
  2⤵
  PID:4280
- C:\Windows\System\gTkhpKA.exe
  C:\Windows\System\gTkhpKA.exe
  2⤵
  PID:4884
- C:\Windows\System\xeQzgYq.exe
  C:\Windows\System\xeQzgYq.exe
  2⤵
  PID:4620
- C:\Windows\System\ynsTZAk.exe
  C:\Windows\System\ynsTZAk.exe
  2⤵
  PID:3564
- C:\Windows\System\FLOJaRo.exe
  C:\Windows\System\FLOJaRo.exe
  2⤵
  PID:4608
- C:\Windows\System\mCkzIKR.exe
  C:\Windows\System\mCkzIKR.exe
  2⤵
  PID:4772
- C:\Windows\System\GeqZgNo.exe
  C:\Windows\System\GeqZgNo.exe
  2⤵
  PID:3048
- C:\Windows\System\kLwHXqc.exe
  C:\Windows\System\kLwHXqc.exe
  2⤵
  PID:4416
- C:\Windows\System\QrWSXFH.exe
  C:\Windows\System\QrWSXFH.exe
  2⤵
  PID:4212
- C:\Windows\System\suZNMaV.exe
  C:\Windows\System\suZNMaV.exe
  2⤵
  PID:4768
- C:\Windows\System\XnMdRiH.exe
  C:\Windows\System\XnMdRiH.exe
  2⤵
  PID:5000
- C:\Windows\System\OgftORO.exe
  C:\Windows\System\OgftORO.exe
  2⤵
  PID:5128
- C:\Windows\System\prWDuYJ.exe
  C:\Windows\System\prWDuYJ.exe
  2⤵
  PID:5144
- C:\Windows\System\jPxpFFQ.exe
  C:\Windows\System\jPxpFFQ.exe
  2⤵
  PID:5164
- C:\Windows\System\fwRsCft.exe
  C:\Windows\System\fwRsCft.exe
  2⤵
  PID:5180
- C:\Windows\System\VJDPmfF.exe
  C:\Windows\System\VJDPmfF.exe
  2⤵
  PID:5196
- C:\Windows\System\uDqVvFG.exe
  C:\Windows\System\uDqVvFG.exe
  2⤵
  PID:5212
- C:\Windows\System\rlXTeTD.exe
  C:\Windows\System\rlXTeTD.exe
  2⤵
  PID:5228
- C:\Windows\System\UVPwwks.exe
  C:\Windows\System\UVPwwks.exe
  2⤵
  PID:5252
- C:\Windows\System\mQKTOxz.exe
  C:\Windows\System\mQKTOxz.exe
  2⤵
  PID:5268
- C:\Windows\System\mxulbxO.exe
  C:\Windows\System\mxulbxO.exe
  2⤵
  PID:5284
- C:\Windows\System\zYUKtKx.exe
  C:\Windows\System\zYUKtKx.exe
  2⤵
  PID:5300
- C:\Windows\System\LXwufdO.exe
  C:\Windows\System\LXwufdO.exe
  2⤵
  PID:5316
- C:\Windows\System\LBUSHxo.exe
  C:\Windows\System\LBUSHxo.exe
  2⤵
  PID:5368
- C:\Windows\System\UCHmMoI.exe
  C:\Windows\System\UCHmMoI.exe
  2⤵
  PID:5388
- C:\Windows\System\JoEBsne.exe
  C:\Windows\System\JoEBsne.exe
  2⤵
  PID:5412
- C:\Windows\System\FeVaQav.exe
  C:\Windows\System\FeVaQav.exe
  2⤵
  PID:5428
- C:\Windows\System\yErbTYv.exe
  C:\Windows\System\yErbTYv.exe
  2⤵
  PID:5448
- C:\Windows\System\jHBJLJc.exe
  C:\Windows\System\jHBJLJc.exe
  2⤵
  PID:5464
- C:\Windows\System\PqRTVEt.exe
  C:\Windows\System\PqRTVEt.exe
  2⤵
  PID:5488
- C:\Windows\System\ATxUrle.exe
  C:\Windows\System\ATxUrle.exe
  2⤵
  PID:5508
- C:\Windows\System\IRNPfgu.exe
  C:\Windows\System\IRNPfgu.exe
  2⤵
  PID:5524
- C:\Windows\System\IQUTjfZ.exe
  C:\Windows\System\IQUTjfZ.exe
  2⤵
  PID:5548
- C:\Windows\System\pKyfINi.exe
  C:\Windows\System\pKyfINi.exe
  2⤵
  PID:5572
- C:\Windows\System\YTvEqgO.exe
  C:\Windows\System\YTvEqgO.exe
  2⤵
  PID:5592
- C:\Windows\System\prXNDnq.exe
  C:\Windows\System\prXNDnq.exe
  2⤵
  PID:5608
- C:\Windows\System\GPOwuMS.exe
  C:\Windows\System\GPOwuMS.exe
  2⤵
  PID:5632
- C:\Windows\System\ujeXkvN.exe
  C:\Windows\System\ujeXkvN.exe
  2⤵
  PID:5656
- C:\Windows\System\sTALjaD.exe
  C:\Windows\System\sTALjaD.exe
  2⤵
  PID:5672
- C:\Windows\System\EUbGgqN.exe
  C:\Windows\System\EUbGgqN.exe
  2⤵
  PID:5688
- C:\Windows\System\XtrdYNM.exe
  C:\Windows\System\XtrdYNM.exe
  2⤵
  PID:5704
- C:\Windows\System\jPrFWGl.exe
  C:\Windows\System\jPrFWGl.exe
  2⤵
  PID:5720
- C:\Windows\System\KbqEcJk.exe
  C:\Windows\System\KbqEcJk.exe
  2⤵
  PID:5736
- C:\Windows\System\ERKVapU.exe
  C:\Windows\System\ERKVapU.exe
  2⤵
  PID:5752
- C:\Windows\System\DSwrgSL.exe
  C:\Windows\System\DSwrgSL.exe
  2⤵
  PID:5768
- C:\Windows\System\sgtfZaL.exe
  C:\Windows\System\sgtfZaL.exe
  2⤵
  PID:5788
- C:\Windows\System\VeIoIGI.exe
  C:\Windows\System\VeIoIGI.exe
  2⤵
  PID:5812
- C:\Windows\System\BXyzFIG.exe
  C:\Windows\System\BXyzFIG.exe
  2⤵
  PID:5832
- C:\Windows\System\wEKERup.exe
  C:\Windows\System\wEKERup.exe
  2⤵
  PID:5848
- C:\Windows\System\CKegQru.exe
  C:\Windows\System\CKegQru.exe
  2⤵
  PID:5864
- C:\Windows\System\UhismaP.exe
  C:\Windows\System\UhismaP.exe
  2⤵
  PID:5880
- C:\Windows\System\XtBifRL.exe
  C:\Windows\System\XtBifRL.exe
  2⤵
  PID:5896
- C:\Windows\System\gegxyIY.exe
  C:\Windows\System\gegxyIY.exe
  2⤵
  PID:5912
- C:\Windows\System\yBpVQqf.exe
  C:\Windows\System\yBpVQqf.exe
  2⤵
  PID:5932
- C:\Windows\System\bMrQBtz.exe
  C:\Windows\System\bMrQBtz.exe
  2⤵
  PID:5948
- C:\Windows\System\xWqeDdl.exe
  C:\Windows\System\xWqeDdl.exe
  2⤵
  PID:5972
- C:\Windows\System\ROAFIVg.exe
  C:\Windows\System\ROAFIVg.exe
  2⤵
  PID:5992
- C:\Windows\System\FkLImOx.exe
  C:\Windows\System\FkLImOx.exe
  2⤵
  PID:6028
- C:\Windows\System\WoYMgig.exe
  C:\Windows\System\WoYMgig.exe
  2⤵
  PID:6044
- C:\Windows\System\UmEDzMA.exe
  C:\Windows\System\UmEDzMA.exe
  2⤵
  PID:6060
- C:\Windows\System\cGahUWD.exe
  C:\Windows\System\cGahUWD.exe
  2⤵
  PID:6076
- C:\Windows\System\ghjqlnn.exe
  C:\Windows\System\ghjqlnn.exe
  2⤵
  PID:6092
- C:\Windows\System\tbfxUVP.exe
  C:\Windows\System\tbfxUVP.exe
  2⤵
  PID:6108
- C:\Windows\System\CZOLoWv.exe
  C:\Windows\System\CZOLoWv.exe
  2⤵
  PID:6124
- C:\Windows\System\vvbCyJB.exe
  C:\Windows\System\vvbCyJB.exe
  2⤵
  PID:5124
- C:\Windows\System\HukshfW.exe
  C:\Windows\System\HukshfW.exe
  2⤵
  PID:5156
- C:\Windows\System\HMkvwLK.exe
  C:\Windows\System\HMkvwLK.exe
  2⤵
  PID:4468
- C:\Windows\System\jQUwSrC.exe
  C:\Windows\System\jQUwSrC.exe
  2⤵
  PID:4216
- C:\Windows\System\sRnQZba.exe
  C:\Windows\System\sRnQZba.exe
  2⤵
  PID:5056
- C:\Windows\System\YaATfLb.exe
  C:\Windows\System\YaATfLb.exe
  2⤵
  PID:972
- C:\Windows\System\qHaDbQt.exe
  C:\Windows\System\qHaDbQt.exe
  2⤵
  PID:5336
- C:\Windows\System\jNqDGxx.exe
  C:\Windows\System\jNqDGxx.exe
  2⤵
  PID:5356
- C:\Windows\System\cHpCrUX.exe
  C:\Windows\System\cHpCrUX.exe
  2⤵
  PID:5364
- C:\Windows\System\wnDNGwk.exe
  C:\Windows\System\wnDNGwk.exe
  2⤵
  PID:5404
- C:\Windows\System\kiisiuP.exe
  C:\Windows\System\kiisiuP.exe
  2⤵
  PID:5240
- C:\Windows\System\MsrjZEo.exe
  C:\Windows\System\MsrjZEo.exe
  2⤵
  PID:5384
- C:\Windows\System\jEdsJBH.exe
  C:\Windows\System\jEdsJBH.exe
  2⤵
  PID:5484
- C:\Windows\System\NKRIZMt.exe
  C:\Windows\System\NKRIZMt.exe
  2⤵
  PID:5248
- C:\Windows\System\rKhkjGB.exe
  C:\Windows\System\rKhkjGB.exe
  2⤵
  PID:5496
- C:\Windows\System\pcolmzb.exe
  C:\Windows\System\pcolmzb.exe
  2⤵
  PID:5560
- C:\Windows\System\NyPdDLT.exe
  C:\Windows\System\NyPdDLT.exe
  2⤵
  PID:5532
- C:\Windows\System\sOgbxJX.exe
  C:\Windows\System\sOgbxJX.exe
  2⤵
  PID:5588
- C:\Windows\System\RvOdndT.exe
  C:\Windows\System\RvOdndT.exe
  2⤵
  PID:5624
- C:\Windows\System\aiHceAs.exe
  C:\Windows\System\aiHceAs.exe
  2⤵
  PID:5680
- C:\Windows\System\vudkamq.exe
  C:\Windows\System\vudkamq.exe
  2⤵
  PID:5824
- C:\Windows\System\FWytEjm.exe
  C:\Windows\System\FWytEjm.exe
  2⤵
  PID:5892
- C:\Windows\System\uKWdykX.exe
  C:\Windows\System\uKWdykX.exe
  2⤵
  PID:5956
- C:\Windows\System\JipQKFw.exe
  C:\Windows\System\JipQKFw.exe
  2⤵
  PID:5668
- C:\Windows\System\ensUsiv.exe
  C:\Windows\System\ensUsiv.exe
  2⤵
  PID:6004
- C:\Windows\System\kdFGlLH.exe
  C:\Windows\System\kdFGlLH.exe
  2⤵
  PID:6020
- C:\Windows\System\NTLuLaN.exe
  C:\Windows\System\NTLuLaN.exe
  2⤵
  PID:6052
- C:\Windows\System\KMAjQdK.exe
  C:\Windows\System\KMAjQdK.exe
  2⤵
  PID:2856
- C:\Windows\System\VpjQXeK.exe
  C:\Windows\System\VpjQXeK.exe
  2⤵
  PID:5844
- C:\Windows\System\WIxTilS.exe
  C:\Windows\System\WIxTilS.exe
  2⤵
  PID:5908
- C:\Windows\System\PeSkOMl.exe
  C:\Windows\System\PeSkOMl.exe
  2⤵
  PID:5988
- C:\Windows\System\GOuySgm.exe
  C:\Windows\System\GOuySgm.exe
  2⤵
  PID:6104
- C:\Windows\System\XFxTXhu.exe
  C:\Windows\System\XFxTXhu.exe
  2⤵
  PID:4256
- C:\Windows\System\WMyJUya.exe
  C:\Windows\System\WMyJUya.exe
  2⤵
  PID:4776
- C:\Windows\System\qmdEjly.exe
  C:\Windows\System\qmdEjly.exe
  2⤵
  PID:2900
- C:\Windows\System\BffjQsm.exe
  C:\Windows\System\BffjQsm.exe
  2⤵
  PID:5188
- C:\Windows\System\QGdcSgc.exe
  C:\Windows\System\QGdcSgc.exe
  2⤵
  PID:5344
- C:\Windows\System\htNdiSH.exe
  C:\Windows\System\htNdiSH.exe
  2⤵
  PID:5380
- C:\Windows\System\puTsAXQ.exe
  C:\Windows\System\puTsAXQ.exe
  2⤵
  PID:5556
- C:\Windows\System\fRMYASO.exe
  C:\Windows\System\fRMYASO.exe
  2⤵
  PID:5504
- C:\Windows\System\ecDIVZr.exe
  C:\Windows\System\ecDIVZr.exe
  2⤵
  PID:5652
- C:\Windows\System\iZkuUmQ.exe
  C:\Windows\System\iZkuUmQ.exe
  2⤵
  PID:5456
- C:\Windows\System\ClkujAN.exe
  C:\Windows\System\ClkujAN.exe
  2⤵
  PID:5292
- C:\Windows\System\DbqJfuG.exe
  C:\Windows\System\DbqJfuG.exe
  2⤵
  PID:5748
- C:\Windows\System\HdXTezu.exe
  C:\Windows\System\HdXTezu.exe
  2⤵
  PID:5604
- C:\Windows\System\qDPOBKu.exe
  C:\Windows\System\qDPOBKu.exe
  2⤵
  PID:5440
- C:\Windows\System\BExppGW.exe
  C:\Windows\System\BExppGW.exe
  2⤵
  PID:5744
- C:\Windows\System\nUXIrHO.exe
  C:\Windows\System\nUXIrHO.exe
  2⤵
  PID:5308
- C:\Windows\System\EUHlDbL.exe
  C:\Windows\System\EUHlDbL.exe
  2⤵
  PID:5924
- C:\Windows\System\xeETaoz.exe
  C:\Windows\System\xeETaoz.exe
  2⤵
  PID:5888
- C:\Windows\System\pTTOTtd.exe
  C:\Windows\System\pTTOTtd.exe
  2⤵
  PID:6016
- C:\Windows\System\hWXrHBG.exe
  C:\Windows\System\hWXrHBG.exe
  2⤵
  PID:5872
- C:\Windows\System\FDJuZOg.exe
  C:\Windows\System\FDJuZOg.exe
  2⤵
  PID:5928
- C:\Windows\System\MNTyRFB.exe
  C:\Windows\System\MNTyRFB.exe
  2⤵
  PID:6068
- C:\Windows\System\DdMYiqQ.exe
  C:\Windows\System\DdMYiqQ.exe
  2⤵
  PID:4556
- C:\Windows\System\XfVynbM.exe
  C:\Windows\System\XfVynbM.exe
  2⤵
  PID:6140
- C:\Windows\System\PGSsbYx.exe
  C:\Windows\System\PGSsbYx.exe
  2⤵
  PID:2808
- C:\Windows\System\HtibYjS.exe
  C:\Windows\System\HtibYjS.exe
  2⤵
  PID:5172
- C:\Windows\System\IMLXCeD.exe
  C:\Windows\System\IMLXCeD.exe
  2⤵
  PID:5500
- C:\Windows\System\AwMFCHb.exe
  C:\Windows\System\AwMFCHb.exe
  2⤵
  PID:5224
- C:\Windows\System\QmsbvtS.exe
  C:\Windows\System\QmsbvtS.exe
  2⤵
  PID:5716
- C:\Windows\System\uTUCdEK.exe
  C:\Windows\System\uTUCdEK.exe
  2⤵
  PID:5820
- C:\Windows\System\XKuNLEs.exe
  C:\Windows\System\XKuNLEs.exe
  2⤵
  PID:6040
- C:\Windows\System\StEoRGo.exe
  C:\Windows\System\StEoRGo.exe
  2⤵
  PID:5728
- C:\Windows\System\faSwQiy.exe
  C:\Windows\System\faSwQiy.exe
  2⤵
  PID:5260
- C:\Windows\System\tepZAXP.exe
  C:\Windows\System\tepZAXP.exe
  2⤵
  PID:5620
- C:\Windows\System\xXNYWKx.exe
  C:\Windows\System\xXNYWKx.exe
  2⤵
  PID:5472
- C:\Windows\System\GcyaTkF.exe
  C:\Windows\System\GcyaTkF.exe
  2⤵
  PID:6136
- C:\Windows\System\hgMwqNb.exe
  C:\Windows\System\hgMwqNb.exe
  2⤵
  PID:5764
- C:\Windows\System\kWnyzRy.exe
  C:\Windows\System\kWnyzRy.exe
  2⤵
  PID:5376
- C:\Windows\System\gvvCigw.exe
  C:\Windows\System\gvvCigw.exe
  2⤵
  PID:5296
- C:\Windows\System\ebpWTmZ.exe
  C:\Windows\System\ebpWTmZ.exe
  2⤵
  PID:5176
- C:\Windows\System\WmKtYBw.exe
  C:\Windows\System\WmKtYBw.exe
  2⤵
  PID:2476
- C:\Windows\System\jFmvFpB.exe
  C:\Windows\System\jFmvFpB.exe
  2⤵
  PID:6100
- C:\Windows\System\aqMicwK.exe
  C:\Windows\System\aqMicwK.exe
  2⤵
  PID:6116
- C:\Windows\System\ozOqQvy.exe
  C:\Windows\System\ozOqQvy.exe
  2⤵
  PID:6024
- C:\Windows\System\ySAPnao.exe
  C:\Windows\System\ySAPnao.exe
  2⤵
  PID:2800
- C:\Windows\System\qhUIBsm.exe
  C:\Windows\System\qhUIBsm.exe
  2⤵
  PID:5780
- C:\Windows\System\qDfNnGe.exe
  C:\Windows\System\qDfNnGe.exe
  2⤵
  PID:6152
- C:\Windows\System\JYNloOT.exe
  C:\Windows\System\JYNloOT.exe
  2⤵
  PID:6168
- C:\Windows\System\KMYFKKN.exe
  C:\Windows\System\KMYFKKN.exe
  2⤵
  PID:6220
- C:\Windows\System\IsWAauG.exe
  C:\Windows\System\IsWAauG.exe
  2⤵
  PID:6240
- C:\Windows\System\WtVkBhl.exe
  C:\Windows\System\WtVkBhl.exe
  2⤵
  PID:6256
- C:\Windows\System\SKToecx.exe
  C:\Windows\System\SKToecx.exe
  2⤵
  PID:6272
- C:\Windows\System\nBgPKmK.exe
  C:\Windows\System\nBgPKmK.exe
  2⤵
  PID:6292
- C:\Windows\System\krIlrlE.exe
  C:\Windows\System\krIlrlE.exe
  2⤵
  PID:6312
- C:\Windows\System\vEjfdcw.exe
  C:\Windows\System\vEjfdcw.exe
  2⤵
  PID:6340
- C:\Windows\System\vXysmxC.exe
  C:\Windows\System\vXysmxC.exe
  2⤵
  PID:6356
- C:\Windows\System\PXXvGai.exe
  C:\Windows\System\PXXvGai.exe
  2⤵
  PID:6372
- C:\Windows\System\myWiESw.exe
  C:\Windows\System\myWiESw.exe
  2⤵
  PID:6388
- C:\Windows\System\MmDIfRx.exe
  C:\Windows\System\MmDIfRx.exe
  2⤵
  PID:6404
- C:\Windows\System\Pbckcft.exe
  C:\Windows\System\Pbckcft.exe
  2⤵
  PID:6424
- C:\Windows\System\jUliclS.exe
  C:\Windows\System\jUliclS.exe
  2⤵
  PID:6440
- C:\Windows\System\rNYrLmf.exe
  C:\Windows\System\rNYrLmf.exe
  2⤵
  PID:6464
- C:\Windows\System\MpmwZPo.exe
  C:\Windows\System\MpmwZPo.exe
  2⤵
  PID:6484
- C:\Windows\System\UBFiaII.exe
  C:\Windows\System\UBFiaII.exe
  2⤵
  PID:6500
- C:\Windows\System\DZwGKsj.exe
  C:\Windows\System\DZwGKsj.exe
  2⤵
  PID:6516
- C:\Windows\System\aOvVhlk.exe
  C:\Windows\System\aOvVhlk.exe
  2⤵
  PID:6536
- C:\Windows\System\kBpLGlQ.exe
  C:\Windows\System\kBpLGlQ.exe
  2⤵
  PID:6552
- C:\Windows\System\mjDgBFA.exe
  C:\Windows\System\mjDgBFA.exe
  2⤵
  PID:6576
- C:\Windows\System\xlohEcw.exe
  C:\Windows\System\xlohEcw.exe
  2⤵
  PID:6596
- C:\Windows\System\SvDCjzT.exe
  C:\Windows\System\SvDCjzT.exe
  2⤵
  PID:6616
- C:\Windows\System\LLIUFGn.exe
  C:\Windows\System\LLIUFGn.exe
  2⤵
  PID:6632
- C:\Windows\System\CExcVqp.exe
  C:\Windows\System\CExcVqp.exe
  2⤵
  PID:6648
- C:\Windows\System\vTGEsKz.exe
  C:\Windows\System\vTGEsKz.exe
  2⤵
  PID:6664
- C:\Windows\System\tnWdgVR.exe
  C:\Windows\System\tnWdgVR.exe
  2⤵
  PID:6716
- C:\Windows\System\hjLvkeJ.exe
  C:\Windows\System\hjLvkeJ.exe
  2⤵
  PID:6732
- C:\Windows\System\wsNZTkc.exe
  C:\Windows\System\wsNZTkc.exe
  2⤵
  PID:6756
- C:\Windows\System\TObtGjk.exe
  C:\Windows\System\TObtGjk.exe
  2⤵
  PID:6772
- C:\Windows\System\lELNRWd.exe
  C:\Windows\System\lELNRWd.exe
  2⤵
  PID:6796
- C:\Windows\System\SxVyMjx.exe
  C:\Windows\System\SxVyMjx.exe
  2⤵
  PID:6812
- C:\Windows\System\dHRfYCM.exe
  C:\Windows\System\dHRfYCM.exe
  2⤵
  PID:6828
- C:\Windows\System\KkWjAkV.exe
  C:\Windows\System\KkWjAkV.exe
  2⤵
  PID:6844
- C:\Windows\System\DnunmtL.exe
  C:\Windows\System\DnunmtL.exe
  2⤵
  PID:6860
- C:\Windows\System\hagGNre.exe
  C:\Windows\System\hagGNre.exe
  2⤵
  PID:6876
- C:\Windows\System\VaMoDJd.exe
  C:\Windows\System\VaMoDJd.exe
  2⤵
  PID:6896
- C:\Windows\System\WaLdXcT.exe
  C:\Windows\System\WaLdXcT.exe
  2⤵
  PID:6916
- C:\Windows\System\QYssSKg.exe
  C:\Windows\System\QYssSKg.exe
  2⤵
  PID:6940
- C:\Windows\System\BEAlbVm.exe
  C:\Windows\System\BEAlbVm.exe
  2⤵
  PID:6976
- C:\Windows\System\JRkErYa.exe
  C:\Windows\System\JRkErYa.exe
  2⤵
  PID:6996
- C:\Windows\System\yZbuOYS.exe
  C:\Windows\System\yZbuOYS.exe
  2⤵
  PID:7012
- C:\Windows\System\FftrgEp.exe
  C:\Windows\System\FftrgEp.exe
  2⤵
  PID:7032
- C:\Windows\System\RdzQdlg.exe
  C:\Windows\System\RdzQdlg.exe
  2⤵
  PID:7048
- C:\Windows\System\jNrvkUP.exe
  C:\Windows\System\jNrvkUP.exe
  2⤵
  PID:7064
- C:\Windows\System\rbHkfos.exe
  C:\Windows\System\rbHkfos.exe
  2⤵
  PID:7080
- C:\Windows\System\WngKGeG.exe
  C:\Windows\System\WngKGeG.exe
  2⤵
  PID:7104
- C:\Windows\System\arvdyRd.exe
  C:\Windows\System\arvdyRd.exe
  2⤵
  PID:7124
- C:\Windows\System\GiKAoKo.exe
  C:\Windows\System\GiKAoKo.exe
  2⤵
  PID:7144
- C:\Windows\System\MHsOpok.exe
  C:\Windows\System\MHsOpok.exe
  2⤵
  PID:5400
- C:\Windows\System\rIaoIbr.exe
  C:\Windows\System\rIaoIbr.exe
  2⤵
  PID:5628
- C:\Windows\System\WMzMibH.exe
  C:\Windows\System\WMzMibH.exe
  2⤵
  PID:5860
- C:\Windows\System\anSLbiF.exe
  C:\Windows\System\anSLbiF.exe
  2⤵
  PID:5460
- C:\Windows\System\TtGHYGm.exe
  C:\Windows\System\TtGHYGm.exe
  2⤵
  PID:6164
- C:\Windows\System\qgAWFoi.exe
  C:\Windows\System\qgAWFoi.exe
  2⤵
  PID:6208
- C:\Windows\System\jWcskFG.exe
  C:\Windows\System\jWcskFG.exe
  2⤵
  PID:6228
- C:\Windows\System\FOYzpbo.exe
  C:\Windows\System\FOYzpbo.exe
  2⤵
  PID:6252
- C:\Windows\System\ponRTaW.exe
  C:\Windows\System\ponRTaW.exe
  2⤵
  PID:6304
- C:\Windows\System\ZwSnaSu.exe
  C:\Windows\System\ZwSnaSu.exe
  2⤵
  PID:6336
- C:\Windows\System\TbjRfGD.exe
  C:\Windows\System\TbjRfGD.exe
  2⤵
  PID:6348
- C:\Windows\System\iSwcOsR.exe
  C:\Windows\System\iSwcOsR.exe
  2⤵
  PID:6416
- C:\Windows\System\figoCaf.exe
  C:\Windows\System\figoCaf.exe
  2⤵
  PID:6460
- C:\Windows\System\EeFXNhg.exe
  C:\Windows\System\EeFXNhg.exe
  2⤵
  PID:6564
- C:\Windows\System\OEtCKsk.exe
  C:\Windows\System\OEtCKsk.exe
  2⤵
  PID:6368
- C:\Windows\System\AxjHbYK.exe
  C:\Windows\System\AxjHbYK.exe
  2⤵
  PID:6644
- C:\Windows\System\gpPxRaL.exe
  C:\Windows\System\gpPxRaL.exe
  2⤵
  PID:6684
- C:\Windows\System\cokAleP.exe
  C:\Windows\System\cokAleP.exe
  2⤵
  PID:6512
- C:\Windows\System\CNplEBF.exe
  C:\Windows\System\CNplEBF.exe
  2⤵
  PID:6704
- C:\Windows\System\tedhalz.exe
  C:\Windows\System\tedhalz.exe
  2⤵
  PID:6400
- C:\Windows\System\IIsnMoo.exe
  C:\Windows\System\IIsnMoo.exe
  2⤵
  PID:6656
- C:\Windows\System\hEYEqxr.exe
  C:\Windows\System\hEYEqxr.exe
  2⤵
  PID:6508
- C:\Windows\System\BJmmLWa.exe
  C:\Windows\System\BJmmLWa.exe
  2⤵
  PID:6744
- C:\Windows\System\NmPvnkM.exe
  C:\Windows\System\NmPvnkM.exe
  2⤵
  PID:6780
- C:\Windows\System\ZNxGlvW.exe
  C:\Windows\System\ZNxGlvW.exe
  2⤵
  PID:6820
- C:\Windows\System\YMEzssT.exe
  C:\Windows\System\YMEzssT.exe
  2⤵
  PID:6884
- C:\Windows\System\fVnopQw.exe
  C:\Windows\System\fVnopQw.exe
  2⤵
  PID:6872
- C:\Windows\System\qtqshyB.exe
  C:\Windows\System\qtqshyB.exe
  2⤵
  PID:6948
- C:\Windows\System\ZEECEbN.exe
  C:\Windows\System\ZEECEbN.exe
  2⤵
  PID:6804
- C:\Windows\System\ClpcLkG.exe
  C:\Windows\System\ClpcLkG.exe
  2⤵
  PID:6968
- C:\Windows\System\CutwcwX.exe
  C:\Windows\System\CutwcwX.exe
  2⤵
  PID:6992
- C:\Windows\System\ZEUZnXN.exe
  C:\Windows\System\ZEUZnXN.exe
  2⤵
  PID:7060
- C:\Windows\System\pIZKcgl.exe
  C:\Windows\System\pIZKcgl.exe
  2⤵
  PID:7140
- C:\Windows\System\mutLQkd.exe
  C:\Windows\System\mutLQkd.exe
  2⤵
  PID:5540
- C:\Windows\System\ZKJDKwh.exe
  C:\Windows\System\ZKJDKwh.exe
  2⤵
  PID:7116
- C:\Windows\System\NpJGJsi.exe
  C:\Windows\System\NpJGJsi.exe
  2⤵
  PID:5332
- C:\Windows\System\mylxzme.exe
  C:\Windows\System\mylxzme.exe
  2⤵
  PID:5960
- C:\Windows\System\IvwIjJz.exe
  C:\Windows\System\IvwIjJz.exe
  2⤵
  PID:6216
- C:\Windows\System\vMkNtWS.exe
  C:\Windows\System\vMkNtWS.exe
  2⤵
  PID:6148
- C:\Windows\System\YYbGUQP.exe
  C:\Windows\System\YYbGUQP.exe
  2⤵
  PID:6232
- C:\Windows\System\hFAoMsT.exe
  C:\Windows\System\hFAoMsT.exe
  2⤵
  PID:6320
- C:\Windows\System\QjAGWbQ.exe
  C:\Windows\System\QjAGWbQ.exe
  2⤵
  PID:6384
- C:\Windows\System\MDWBqIA.exe
  C:\Windows\System\MDWBqIA.exe
  2⤵
  PID:6456
- C:\Windows\System\DZCmHMw.exe
  C:\Windows\System\DZCmHMw.exe
  2⤵
  PID:6364
- C:\Windows\System\iRnxMGF.exe
  C:\Windows\System\iRnxMGF.exe
  2⤵
  PID:6572
- C:\Windows\System\uVeBMcG.exe
  C:\Windows\System\uVeBMcG.exe
  2⤵
  PID:6608
- C:\Windows\System\dlbLohJ.exe
  C:\Windows\System\dlbLohJ.exe
  2⤵
  PID:6592
- C:\Windows\System\yrflCfM.exe
  C:\Windows\System\yrflCfM.exe
  2⤵
  PID:6748
- C:\Windows\System\hHQREbQ.exe
  C:\Windows\System\hHQREbQ.exe
  2⤵
  PID:6476
- C:\Windows\System\BtNibEy.exe
  C:\Windows\System\BtNibEy.exe
  2⤵
  PID:6856
- C:\Windows\System\miishYa.exe
  C:\Windows\System\miishYa.exe
  2⤵
  PID:6924
- C:\Windows\System\KebImjF.exe
  C:\Windows\System\KebImjF.exe
  2⤵
  PID:6956
- C:\Windows\System\GaVHdQE.exe
  C:\Windows\System\GaVHdQE.exe
  2⤵
  PID:7024
- C:\Windows\System\qqneflP.exe
  C:\Windows\System\qqneflP.exe
  2⤵
  PID:6988
- C:\Windows\System\ETmezRw.exe
  C:\Windows\System\ETmezRw.exe
  2⤵
  PID:7008
- C:\Windows\System\qlQHOsD.exe
  C:\Windows\System\qlQHOsD.exe
  2⤵
  PID:5352
- C:\Windows\System\fkGFsWt.exe
  C:\Windows\System\fkGFsWt.exe
  2⤵
  PID:5760
- C:\Windows\System\uCayxYP.exe
  C:\Windows\System\uCayxYP.exe
  2⤵
  PID:7072
- C:\Windows\System\yjzreXl.exe
  C:\Windows\System\yjzreXl.exe
  2⤵
  PID:5420
- C:\Windows\System\SRRmuOQ.exe
  C:\Windows\System\SRRmuOQ.exe
  2⤵
  PID:5396
- C:\Windows\System\DROvBqQ.exe
  C:\Windows\System\DROvBqQ.exe
  2⤵
  PID:6528
- C:\Windows\System\XriPOxq.exe
  C:\Windows\System\XriPOxq.exe
  2⤵
  PID:6680
- C:\Windows\System\LMMxMeP.exe
  C:\Windows\System\LMMxMeP.exe
  2⤵
  PID:6300
- C:\Windows\System\hUZqYgS.exe
  C:\Windows\System\hUZqYgS.exe
  2⤵
  PID:6852
- C:\Windows\System\mUlcNSq.exe
  C:\Windows\System\mUlcNSq.exe
  2⤵
  PID:6788
- C:\Windows\System\RGYSmtp.exe
  C:\Windows\System\RGYSmtp.exe
  2⤵
  PID:6836
- C:\Windows\System\nBFFjIf.exe
  C:\Windows\System\nBFFjIf.exe
  2⤵
  PID:6984
- C:\Windows\System\EZdxjNx.exe
  C:\Windows\System\EZdxjNx.exe
  2⤵
  PID:7044
- C:\Windows\System\EqkUQbU.exe
  C:\Windows\System\EqkUQbU.exe
  2⤵
  PID:7076
- C:\Windows\System\FKsNIRO.exe
  C:\Windows\System\FKsNIRO.exe
  2⤵
  PID:6544
- C:\Windows\System\DBTDzUG.exe
  C:\Windows\System\DBTDzUG.exe
  2⤵
  PID:6960
- C:\Windows\System\AfgzNnl.exe
  C:\Windows\System\AfgzNnl.exe
  2⤵
  PID:6708
- C:\Windows\System\yRCcqBQ.exe
  C:\Windows\System\yRCcqBQ.exe
  2⤵
  PID:5140
- C:\Windows\System\QACVRFJ.exe
  C:\Windows\System\QACVRFJ.exe
  2⤵
  PID:7156
- C:\Windows\System\MOXLYvD.exe
  C:\Windows\System\MOXLYvD.exe
  2⤵
  PID:6196
- C:\Windows\System\dosnEad.exe
  C:\Windows\System\dosnEad.exe
  2⤵
  PID:7040
- C:\Windows\System\IjYHeFB.exe
  C:\Windows\System\IjYHeFB.exe
  2⤵
  PID:6808
- C:\Windows\System\fHpmYDC.exe
  C:\Windows\System\fHpmYDC.exe
  2⤵
  PID:6932
- C:\Windows\System\nXQLtLK.exe
  C:\Windows\System\nXQLtLK.exe
  2⤵
  PID:6640
- C:\Windows\System\fkJUQtQ.exe
  C:\Windows\System\fkJUQtQ.exe
  2⤵
  PID:6180
- C:\Windows\System\ERkdfrj.exe
  C:\Windows\System\ERkdfrj.exe
  2⤵
  PID:6936
- C:\Windows\System\YRUalRX.exe
  C:\Windows\System\YRUalRX.exe
  2⤵
  PID:6628
- C:\Windows\System\CVFcgnU.exe
  C:\Windows\System\CVFcgnU.exe
  2⤵
  PID:6452
- C:\Windows\System\VdSaBPt.exe
  C:\Windows\System\VdSaBPt.exe
  2⤵
  PID:6328
- C:\Windows\System\otJdzyU.exe
  C:\Windows\System\otJdzyU.exe
  2⤵
  PID:6868
- C:\Windows\System\QLeAgKr.exe
  C:\Windows\System\QLeAgKr.exe
  2⤵
  PID:7180
- C:\Windows\System\OyEJlAE.exe
  C:\Windows\System\OyEJlAE.exe
  2⤵
  PID:7196
- C:\Windows\System\eSywXxA.exe
  C:\Windows\System\eSywXxA.exe
  2⤵
  PID:7212
- C:\Windows\System\gzusDVL.exe
  C:\Windows\System\gzusDVL.exe
  2⤵
  PID:7228
- C:\Windows\System\JwOPius.exe
  C:\Windows\System\JwOPius.exe
  2⤵
  PID:7248
- C:\Windows\System\CawedJC.exe
  C:\Windows\System\CawedJC.exe
  2⤵
  PID:7272
- C:\Windows\System\nzfRUOW.exe
  C:\Windows\System\nzfRUOW.exe
  2⤵
  PID:7292
- C:\Windows\System\KBAPFhv.exe
  C:\Windows\System\KBAPFhv.exe
  2⤵
  PID:7308
- C:\Windows\System\GxQMDEc.exe
  C:\Windows\System\GxQMDEc.exe
  2⤵
  PID:7328
- C:\Windows\System\OabkaiI.exe
  C:\Windows\System\OabkaiI.exe
  2⤵
  PID:7348
- C:\Windows\System\SdnuSVE.exe
  C:\Windows\System\SdnuSVE.exe
  2⤵
  PID:7364
- C:\Windows\System\UCJWDyj.exe
  C:\Windows\System\UCJWDyj.exe
  2⤵
  PID:7384
- C:\Windows\System\dLsoZul.exe
  C:\Windows\System\dLsoZul.exe
  2⤵
  PID:7400
- C:\Windows\System\uwFusXB.exe
  C:\Windows\System\uwFusXB.exe
  2⤵
  PID:7436
- C:\Windows\System\KzlQFPQ.exe
  C:\Windows\System\KzlQFPQ.exe
  2⤵
  PID:7460
- C:\Windows\System\HUdDUAv.exe
  C:\Windows\System\HUdDUAv.exe
  2⤵
  PID:7476
- C:\Windows\System\cmnObwn.exe
  C:\Windows\System\cmnObwn.exe
  2⤵
  PID:7492
- C:\Windows\System\UIOaRLO.exe
  C:\Windows\System\UIOaRLO.exe
  2⤵
  PID:7512
- C:\Windows\System\jhxKNaP.exe
  C:\Windows\System\jhxKNaP.exe
  2⤵
  PID:7536
- C:\Windows\System\RVwLvIL.exe
  C:\Windows\System\RVwLvIL.exe
  2⤵
  PID:7552
- C:\Windows\System\GoaZqoK.exe
  C:\Windows\System\GoaZqoK.exe
  2⤵
  PID:7576
- C:\Windows\System\vISWekB.exe
  C:\Windows\System\vISWekB.exe
  2⤵
  PID:7596
- C:\Windows\System\zgNiHkc.exe
  C:\Windows\System\zgNiHkc.exe
  2⤵
  PID:7612
- C:\Windows\System\tUEHQJA.exe
  C:\Windows\System\tUEHQJA.exe
  2⤵
  PID:7644
- C:\Windows\System\MpfgrnK.exe
  C:\Windows\System\MpfgrnK.exe
  2⤵
  PID:7660
- C:\Windows\System\lIcordq.exe
  C:\Windows\System\lIcordq.exe
  2⤵
  PID:7676
- C:\Windows\System\PQuUBob.exe
  C:\Windows\System\PQuUBob.exe
  2⤵
  PID:7696
- C:\Windows\System\qElLtiD.exe
  C:\Windows\System\qElLtiD.exe
  2⤵
  PID:7712
- C:\Windows\System\GUJvGvz.exe
  C:\Windows\System\GUJvGvz.exe
  2⤵
  PID:7732
- C:\Windows\System\hPxlSYI.exe
  C:\Windows\System\hPxlSYI.exe
  2⤵
  PID:7748
- C:\Windows\System\qICFBqS.exe
  C:\Windows\System\qICFBqS.exe
  2⤵
  PID:7764
- C:\Windows\System\WkUySAw.exe
  C:\Windows\System\WkUySAw.exe
  2⤵
  PID:7780
- C:\Windows\System\GrZPDAj.exe
  C:\Windows\System\GrZPDAj.exe
  2⤵
  PID:7796
- C:\Windows\System\dZELLHD.exe
  C:\Windows\System\dZELLHD.exe
  2⤵
  PID:7812
- C:\Windows\System\Pxgpawu.exe
  C:\Windows\System\Pxgpawu.exe
  2⤵
  PID:7836
- C:\Windows\System\dNQAiMs.exe
  C:\Windows\System\dNQAiMs.exe
  2⤵
  PID:7856
- C:\Windows\System\DOLrwPg.exe
  C:\Windows\System\DOLrwPg.exe
  2⤵
  PID:7880
- C:\Windows\System\WqUtYwf.exe
  C:\Windows\System\WqUtYwf.exe
  2⤵
  PID:7900
- C:\Windows\System\EEZRUcx.exe
  C:\Windows\System\EEZRUcx.exe
  2⤵
  PID:7952
- C:\Windows\System\apispsz.exe
  C:\Windows\System\apispsz.exe
  2⤵
  PID:7968
- C:\Windows\System\GqbHWdz.exe
  C:\Windows\System\GqbHWdz.exe
  2⤵
  PID:7984
- C:\Windows\System\ykShSRW.exe
  C:\Windows\System\ykShSRW.exe
  2⤵
  PID:8000
- C:\Windows\System\IPpuCWj.exe
  C:\Windows\System\IPpuCWj.exe
  2⤵
  PID:8016
- C:\Windows\System\jLJKRuY.exe
  C:\Windows\System\jLJKRuY.exe
  2⤵
  PID:8056
- C:\Windows\System\CyvJdTW.exe
  C:\Windows\System\CyvJdTW.exe
  2⤵
  PID:8076
- C:\Windows\System\kQQdOIq.exe
  C:\Windows\System\kQQdOIq.exe
  2⤵
  PID:8092
- C:\Windows\System\HuHbPVi.exe
  C:\Windows\System\HuHbPVi.exe
  2⤵
  PID:8108
- C:\Windows\System\FwAXWuJ.exe
  C:\Windows\System\FwAXWuJ.exe
  2⤵
  PID:8124
- C:\Windows\System\iPLliyT.exe
  C:\Windows\System\iPLliyT.exe
  2⤵
  PID:8144
- C:\Windows\System\yqlCIry.exe
  C:\Windows\System\yqlCIry.exe
  2⤵
  PID:8168
- C:\Windows\System\lUhcqft.exe
  C:\Windows\System\lUhcqft.exe
  2⤵
  PID:8188
- C:\Windows\System\llDcRhM.exe
  C:\Windows\System\llDcRhM.exe
  2⤵
  PID:7244
- C:\Windows\System\ayTmtEK.exe
  C:\Windows\System\ayTmtEK.exe
  2⤵
  PID:7288
- C:\Windows\System\QpnPHTx.exe
  C:\Windows\System\QpnPHTx.exe
  2⤵
  PID:7320
- C:\Windows\System\SlrVldt.exe
  C:\Windows\System\SlrVldt.exe
  2⤵
  PID:7176
- C:\Windows\System\NERhomS.exe
  C:\Windows\System\NERhomS.exe
  2⤵
  PID:7224
- C:\Windows\System\tSISCfm.exe
  C:\Windows\System\tSISCfm.exe
  2⤵
  PID:7336
- C:\Windows\System\vqPUMDN.exe
  C:\Windows\System\vqPUMDN.exe
  2⤵
  PID:7372
- C:\Windows\System\KbkWWtR.exe
  C:\Windows\System\KbkWWtR.exe
  2⤵
  PID:7412
- C:\Windows\System\ORQVhRq.exe
  C:\Windows\System\ORQVhRq.exe
  2⤵
  PID:7448
- C:\Windows\System\LXktija.exe
  C:\Windows\System\LXktija.exe
  2⤵
  PID:7484
- C:\Windows\System\aTqSDla.exe
  C:\Windows\System\aTqSDla.exe
  2⤵
  PID:7532
- C:\Windows\System\HzCnXPU.exe
  C:\Windows\System\HzCnXPU.exe
  2⤵
  PID:7564
- C:\Windows\System\LrymMkb.exe
  C:\Windows\System\LrymMkb.exe
  2⤵
  PID:7592
- C:\Windows\System\MOfYiHf.exe
  C:\Windows\System\MOfYiHf.exe
  2⤵
  PID:7632
- C:\Windows\System\TNZcnco.exe
  C:\Windows\System\TNZcnco.exe
  2⤵
  PID:7656
- C:\Windows\System\jOEbbai.exe
  C:\Windows\System\jOEbbai.exe
  2⤵
  PID:7724
- C:\Windows\System\RZBjlQw.exe
  C:\Windows\System\RZBjlQw.exe
  2⤵
  PID:7708
- C:\Windows\System\eBKdiKk.exe
  C:\Windows\System\eBKdiKk.exe
  2⤵
  PID:7788
- C:\Windows\System\EbFqCum.exe
  C:\Windows\System\EbFqCum.exe
  2⤵
  PID:7824
- C:\Windows\System\lonisgL.exe
  C:\Windows\System\lonisgL.exe
  2⤵
  PID:7844
- C:\Windows\System\HjIzTiX.exe
  C:\Windows\System\HjIzTiX.exe
  2⤵
  PID:7872
- C:\Windows\System\fHjJXBM.exe
  C:\Windows\System\fHjJXBM.exe
  2⤵
  PID:7892
- C:\Windows\System\sSzAIWd.exe
  C:\Windows\System\sSzAIWd.exe
  2⤵
  PID:7920
- C:\Windows\System\HzUFXiS.exe
  C:\Windows\System\HzUFXiS.exe
  2⤵
  PID:7936
- C:\Windows\System\dzwCFwS.exe
  C:\Windows\System\dzwCFwS.exe
  2⤵
  PID:7960
- C:\Windows\System\cVXmTTH.exe
  C:\Windows\System\cVXmTTH.exe
  2⤵
  PID:7996
- C:\Windows\System\GvuDQYn.exe
  C:\Windows\System\GvuDQYn.exe
  2⤵
  PID:8036
- C:\Windows\System\wkcmdYr.exe
  C:\Windows\System\wkcmdYr.exe
  2⤵
  PID:8072
- C:\Windows\System\gbvLzVv.exe
  C:\Windows\System\gbvLzVv.exe
  2⤵
  PID:8104
- C:\Windows\System\KZRwzMB.exe
  C:\Windows\System\KZRwzMB.exe
  2⤵
  PID:8152
- C:\Windows\System\znorctC.exe
  C:\Windows\System\znorctC.exe
  2⤵
  PID:8180
- C:\Windows\System\oPcNHKT.exe
  C:\Windows\System\oPcNHKT.exe
  2⤵
  PID:7280
- C:\Windows\System\ipbfeAd.exe
  C:\Windows\System\ipbfeAd.exe
  2⤵
  PID:7220
- C:\Windows\System\QKanfYT.exe
  C:\Windows\System\QKanfYT.exe
  2⤵
  PID:6280
- C:\Windows\System\lKepEUx.exe
  C:\Windows\System\lKepEUx.exe
  2⤵
  PID:7300
- C:\Windows\System\kqvTWOc.exe
  C:\Windows\System\kqvTWOc.exe
  2⤵
  PID:7380
- C:\Windows\System\kQlwMSi.exe
  C:\Windows\System\kQlwMSi.exe
  2⤵
  PID:7500
- C:\Windows\System\YtvgpHw.exe
  C:\Windows\System\YtvgpHw.exe
  2⤵
  PID:7524
- C:\Windows\System\rWIRSBr.exe
  C:\Windows\System\rWIRSBr.exe
  2⤵
  PID:7604
- C:\Windows\System\AOxlyQp.exe
  C:\Windows\System\AOxlyQp.exe
  2⤵
  PID:7628
- C:\Windows\System\tGpBBDU.exe
  C:\Windows\System\tGpBBDU.exe
  2⤵
  PID:7640
- C:\Windows\System\rdlOONj.exe
  C:\Windows\System\rdlOONj.exe
  2⤵
  PID:7672
- C:\Windows\System\VSUfhbd.exe
  C:\Windows\System\VSUfhbd.exe
  2⤵
  PID:7772
- C:\Windows\System\eeaOMin.exe
  C:\Windows\System\eeaOMin.exe
  2⤵
  PID:7808
- C:\Windows\System\xaYMHqb.exe
  C:\Windows\System\xaYMHqb.exe
  2⤵
  PID:7888
- C:\Windows\System\jgNRrgb.exe
  C:\Windows\System\jgNRrgb.exe
  2⤵
  PID:7912
- C:\Windows\System\UuvgOdi.exe
  C:\Windows\System\UuvgOdi.exe
  2⤵
  PID:7976
- C:\Windows\System\MSKdTqI.exe
  C:\Windows\System\MSKdTqI.exe
  2⤵
  PID:8028
- C:\Windows\System\BCZPooD.exe
  C:\Windows\System\BCZPooD.exe
  2⤵
  PID:8040
- C:\Windows\System\EMQCABg.exe
  C:\Windows\System\EMQCABg.exe
  2⤵
  PID:8120
- C:\Windows\System\OqOQQIN.exe
  C:\Windows\System\OqOQQIN.exe
  2⤵
  PID:8184
- C:\Windows\System\fikftwy.exe
  C:\Windows\System\fikftwy.exe
  2⤵
  PID:7208
- C:\Windows\System\suGXDMw.exe
  C:\Windows\System\suGXDMw.exe
  2⤵
  PID:7396
- C:\Windows\System\igncJKp.exe
  C:\Windows\System\igncJKp.exe
  2⤵
  PID:7268
- C:\Windows\System\DXAavxJ.exe
  C:\Windows\System\DXAavxJ.exe
  2⤵
  PID:1536
- C:\Windows\System\ugmzqGq.exe
  C:\Windows\System\ugmzqGq.exe
  2⤵
  PID:7588
- C:\Windows\System\MCrspDU.exe
  C:\Windows\System\MCrspDU.exe
  2⤵
  PID:7608
- C:\Windows\System\zGyTqrt.exe
  C:\Windows\System\zGyTqrt.exe
  2⤵
  PID:7864
- C:\Windows\System\MPUPSvg.exe
  C:\Windows\System\MPUPSvg.exe
  2⤵
  PID:7944
- C:\Windows\System\kDcxXLw.exe
  C:\Windows\System\kDcxXLw.exe
  2⤵
  PID:8048
- C:\Windows\System\dkDINAM.exe
  C:\Windows\System\dkDINAM.exe
  2⤵
  PID:6768
- C:\Windows\System\wDUxfdo.exe
  C:\Windows\System\wDUxfdo.exe
  2⤵
  PID:7520
- C:\Windows\System\GDmhVkO.exe
  C:\Windows\System\GDmhVkO.exe
  2⤵
  PID:7424
- C:\Windows\System\HPuoVBE.exe
  C:\Windows\System\HPuoVBE.exe
  2⤵
  PID:7572
- C:\Windows\System\xdDgEaP.exe
  C:\Windows\System\xdDgEaP.exe
  2⤵
  PID:8160
- C:\Windows\System\bQZEjum.exe
  C:\Windows\System\bQZEjum.exe
  2⤵
  PID:7820
- C:\Windows\System\UaEpwKe.exe
  C:\Windows\System\UaEpwKe.exe
  2⤵
  PID:7744
- C:\Windows\System\BNJkyZC.exe
  C:\Windows\System\BNJkyZC.exe
  2⤵
  PID:7948
- C:\Windows\System\KXnwoEJ.exe
  C:\Windows\System\KXnwoEJ.exe
  2⤵
  PID:8084
- C:\Windows\System\ExBCJft.exe
  C:\Windows\System\ExBCJft.exe
  2⤵
  PID:7324
- C:\Windows\System\EkMCzwU.exe
  C:\Windows\System\EkMCzwU.exe
  2⤵
  PID:7916
- C:\Windows\System\cQsuWRI.exe
  C:\Windows\System\cQsuWRI.exe
  2⤵
  PID:8012
- C:\Windows\System\hzzFLUr.exe
  C:\Windows\System\hzzFLUr.exe
  2⤵
  PID:7344
- C:\Windows\System\GSMoexP.exe
  C:\Windows\System\GSMoexP.exe
  2⤵
  PID:7428
- C:\Windows\System\xGYhfuW.exe
  C:\Windows\System\xGYhfuW.exe
  2⤵
  PID:8140
- C:\Windows\System\bwIgqQM.exe
  C:\Windows\System\bwIgqQM.exe
  2⤵
  PID:7432
- C:\Windows\System\qNMcXIh.exe
  C:\Windows\System\qNMcXIh.exe
  2⤵
  PID:7692
- C:\Windows\System\awfEcej.exe
  C:\Windows\System\awfEcej.exe
  2⤵
  PID:7928
- C:\Windows\System\vHUzoJr.exe
  C:\Windows\System\vHUzoJr.exe
  2⤵
  PID:8200
- C:\Windows\System\jUgkijL.exe
  C:\Windows\System\jUgkijL.exe
  2⤵
  PID:8220
- C:\Windows\System\sJTyKsm.exe
  C:\Windows\System\sJTyKsm.exe
  2⤵
  PID:8236
- C:\Windows\System\izlBfez.exe
  C:\Windows\System\izlBfez.exe
  2⤵
  PID:8264
- C:\Windows\System\OKvFVOd.exe
  C:\Windows\System\OKvFVOd.exe
  2⤵
  PID:8280
- C:\Windows\System\ZXhyvWp.exe
  C:\Windows\System\ZXhyvWp.exe
  2⤵
  PID:8308
- C:\Windows\System\fuNFXCa.exe
  C:\Windows\System\fuNFXCa.exe
  2⤵
  PID:8324
- C:\Windows\System\zogSems.exe
  C:\Windows\System\zogSems.exe
  2⤵
  PID:8348
- C:\Windows\System\PgepVam.exe
  C:\Windows\System\PgepVam.exe
  2⤵
  PID:8364
- C:\Windows\System\bOAOuyT.exe
  C:\Windows\System\bOAOuyT.exe
  2⤵
  PID:8380
- C:\Windows\System\sYlfycm.exe
  C:\Windows\System\sYlfycm.exe
  2⤵
  PID:8400
- C:\Windows\System\bViLnDI.exe
  C:\Windows\System\bViLnDI.exe
  2⤵
  PID:8416
- C:\Windows\System\WgwmJlo.exe
  C:\Windows\System\WgwmJlo.exe
  2⤵
  PID:8432
- C:\Windows\System\sXSEQWP.exe
  C:\Windows\System\sXSEQWP.exe
  2⤵
  PID:8476
- C:\Windows\System\UndtHNu.exe
  C:\Windows\System\UndtHNu.exe
  2⤵
  PID:8492
- C:\Windows\System\lfNWWRa.exe
  C:\Windows\System\lfNWWRa.exe
  2⤵
  PID:8508
- C:\Windows\System\UCPcvQL.exe
  C:\Windows\System\UCPcvQL.exe
  2⤵
  PID:8524
- C:\Windows\System\CXMFHeY.exe
  C:\Windows\System\CXMFHeY.exe
  2⤵
  PID:8540
- C:\Windows\System\qQwvcST.exe
  C:\Windows\System\qQwvcST.exe
  2⤵
  PID:8580
- C:\Windows\System\tVmmiEz.exe
  C:\Windows\System\tVmmiEz.exe
  2⤵
  PID:8596
- C:\Windows\System\WlAubqf.exe
  C:\Windows\System\WlAubqf.exe
  2⤵
  PID:8616
- C:\Windows\System\sIIgtdJ.exe
  C:\Windows\System\sIIgtdJ.exe
  2⤵
  PID:8640
- C:\Windows\System\uKDiLDv.exe
  C:\Windows\System\uKDiLDv.exe
  2⤵
  PID:8656
- C:\Windows\System\iPdsgky.exe
  C:\Windows\System\iPdsgky.exe
  2⤵
  PID:8680
- C:\Windows\System\jLmmQDF.exe
  C:\Windows\System\jLmmQDF.exe
  2⤵
  PID:8696
- C:\Windows\System\YVBJNrJ.exe
  C:\Windows\System\YVBJNrJ.exe
  2⤵
  PID:8712
- C:\Windows\System\NODscVQ.exe
  C:\Windows\System\NODscVQ.exe
  2⤵
  PID:8732
- C:\Windows\System\QeuTFSZ.exe
  C:\Windows\System\QeuTFSZ.exe
  2⤵
  PID:8756
- C:\Windows\System\YJkkmFF.exe
  C:\Windows\System\YJkkmFF.exe
  2⤵
  PID:8780
- C:\Windows\System\wCWPyTl.exe
  C:\Windows\System\wCWPyTl.exe
  2⤵
  PID:8800
- C:\Windows\System\UFkjvsg.exe
  C:\Windows\System\UFkjvsg.exe
  2⤵
  PID:8816
- C:\Windows\System\tPJXWmA.exe
  C:\Windows\System\tPJXWmA.exe
  2⤵
  PID:8836
- C:\Windows\System\seOdRgP.exe
  C:\Windows\System\seOdRgP.exe
  2⤵
  PID:8860
- C:\Windows\System\QJjfzII.exe
  C:\Windows\System\QJjfzII.exe
  2⤵
  PID:8880
- C:\Windows\System\OGkKRZT.exe
  C:\Windows\System\OGkKRZT.exe
  2⤵
  PID:8900
- C:\Windows\System\AeSfTCe.exe
  C:\Windows\System\AeSfTCe.exe
  2⤵
  PID:8920
- C:\Windows\System\mjYKSMh.exe
  C:\Windows\System\mjYKSMh.exe
  2⤵
  PID:8956
- C:\Windows\System\APKauCV.exe
  C:\Windows\System\APKauCV.exe
  2⤵
  PID:8972
- C:\Windows\System\XXrwabB.exe
  C:\Windows\System\XXrwabB.exe
  2⤵
  PID:8996
- C:\Windows\System\xFRNgBv.exe
  C:\Windows\System\xFRNgBv.exe
  2⤵
  PID:9012
- C:\Windows\System\NdEipZp.exe
  C:\Windows\System\NdEipZp.exe
  2⤵
  PID:9028
- C:\Windows\System\AVDkzWs.exe
  C:\Windows\System\AVDkzWs.exe
  2⤵
  PID:9044
- C:\Windows\System\oscilKI.exe
  C:\Windows\System\oscilKI.exe
  2⤵
  PID:9068
- C:\Windows\System\kcuyZfM.exe
  C:\Windows\System\kcuyZfM.exe
  2⤵
  PID:9088
- C:\Windows\System\scALlVA.exe
  C:\Windows\System\scALlVA.exe
  2⤵
  PID:9112
- C:\Windows\System\jqDXCNi.exe
  C:\Windows\System\jqDXCNi.exe
  2⤵
  PID:9132
- C:\Windows\System\VVkHiat.exe
  C:\Windows\System\VVkHiat.exe
  2⤵
  PID:9152
- C:\Windows\System\UPQFNdf.exe
  C:\Windows\System\UPQFNdf.exe
  2⤵
  PID:9176
- C:\Windows\System\TTFQyec.exe
  C:\Windows\System\TTFQyec.exe
  2⤵
  PID:9192
- C:\Windows\System\IDcxuCR.exe
  C:\Windows\System\IDcxuCR.exe
  2⤵
  PID:9208
- C:\Windows\System\LjqQKUv.exe
  C:\Windows\System\LjqQKUv.exe
  2⤵
  PID:8212
- C:\Windows\System\hYXNnrh.exe
  C:\Windows\System\hYXNnrh.exe
  2⤵
  PID:8252
- C:\Windows\System\MvZZGoW.exe
  C:\Windows\System\MvZZGoW.exe
  2⤵
  PID:8228
- C:\Windows\System\ZsxrXbv.exe
  C:\Windows\System\ZsxrXbv.exe
  2⤵
  PID:8300
- C:\Windows\System\aHNiuUH.exe
  C:\Windows\System\aHNiuUH.exe
  2⤵
  PID:8340
- C:\Windows\System\kfFevBm.exe
  C:\Windows\System\kfFevBm.exe
  2⤵
  PID:8440
- C:\Windows\System\OhQjdWg.exe
  C:\Windows\System\OhQjdWg.exe
  2⤵
  PID:8316
- C:\Windows\System\yVYponB.exe
  C:\Windows\System\yVYponB.exe
  2⤵
  PID:8456
- C:\Windows\System\ahwhctc.exe
  C:\Windows\System\ahwhctc.exe
  2⤵
  PID:8396
- C:\Windows\System\YONIPVf.exe
  C:\Windows\System\YONIPVf.exe
  2⤵
  PID:8532
- C:\Windows\System\QWaTgmR.exe
  C:\Windows\System\QWaTgmR.exe
  2⤵
  PID:8548
- C:\Windows\System\IwpBQBo.exe
  C:\Windows\System\IwpBQBo.exe
  2⤵
  PID:8556
- C:\Windows\System\NdHdPHq.exe
  C:\Windows\System\NdHdPHq.exe
  2⤵
  PID:8588
- C:\Windows\System\hFioZqZ.exe
  C:\Windows\System\hFioZqZ.exe
  2⤵
  PID:8632
- C:\Windows\System\QNOeJvE.exe
  C:\Windows\System\QNOeJvE.exe
  2⤵
  PID:8664
- C:\Windows\System\rEYDiKn.exe
  C:\Windows\System\rEYDiKn.exe
  2⤵
  PID:8704
- C:\Windows\System\kgnFTto.exe
  C:\Windows\System\kgnFTto.exe
  2⤵
  PID:8752
- C:\Windows\System\WeePSVs.exe
  C:\Windows\System\WeePSVs.exe
  2⤵
  PID:8724
- C:\Windows\System\byeWhBy.exe
  C:\Windows\System\byeWhBy.exe
  2⤵
  PID:8832
- C:\Windows\System\HaCjRio.exe
  C:\Windows\System\HaCjRio.exe
  2⤵
  PID:8872
- C:\Windows\System\jauOlNA.exe
  C:\Windows\System\jauOlNA.exe
  2⤵
  PID:8844
- C:\Windows\System\gVvmtBM.exe
  C:\Windows\System\gVvmtBM.exe
  2⤵
  PID:8912
- C:\Windows\System\MynFePx.exe
  C:\Windows\System\MynFePx.exe
  2⤵
  PID:8472
- C:\Windows\System\XaeJmqO.exe
  C:\Windows\System\XaeJmqO.exe
  2⤵
  PID:9020
- C:\Windows\System\kzNzsli.exe
  C:\Windows\System\kzNzsli.exe
  2⤵
  PID:9084
- C:\Windows\System\CVjZkjY.exe
  C:\Windows\System\CVjZkjY.exe
  2⤵
  PID:9024
- C:\Windows\System\ChDvwQv.exe
  C:\Windows\System\ChDvwQv.exe
  2⤵
  PID:9100
- C:\Windows\System\qmnCDlY.exe
  C:\Windows\System\qmnCDlY.exe
  2⤵
  PID:9160
- C:\Windows\System\kQsxRAP.exe
  C:\Windows\System\kQsxRAP.exe
  2⤵
  PID:9172
- C:\Windows\System\avAMijN.exe
  C:\Windows\System\avAMijN.exe
  2⤵
  PID:8116
- C:\Windows\System\XTmxSsZ.exe
  C:\Windows\System\XTmxSsZ.exe
  2⤵
  PID:8248
- C:\Windows\System\LPMwJZp.exe
  C:\Windows\System\LPMwJZp.exe
  2⤵
  PID:8292
- C:\Windows\System\iWUAOol.exe
  C:\Windows\System\iWUAOol.exe
  2⤵
  PID:8336
- C:\Windows\System\SSmAqad.exe
  C:\Windows\System\SSmAqad.exe
  2⤵
  PID:8944
- C:\Windows\System\sVBJAwU.exe
  C:\Windows\System\sVBJAwU.exe
  2⤵
  PID:8424
- C:\Windows\System\BAwBgkv.exe
  C:\Windows\System\BAwBgkv.exe
  2⤵
  PID:8460
- C:\Windows\System\gkFLvje.exe
  C:\Windows\System\gkFLvje.exe
  2⤵
  PID:8560
- C:\Windows\System\CInQpGV.exe
  C:\Windows\System\CInQpGV.exe
  2⤵
  PID:8672
- C:\Windows\System\wQTgaRz.exe
  C:\Windows\System\wQTgaRz.exe
  2⤵
  PID:8568
- C:\Windows\System\XFirKpQ.exe
  C:\Windows\System\XFirKpQ.exe
  2⤵
  PID:8536
- C:\Windows\System\eNfmDIK.exe
  C:\Windows\System\eNfmDIK.exe
  2⤵
  PID:8748
- C:\Windows\System\kRPmQmb.exe
  C:\Windows\System\kRPmQmb.exe
  2⤵
  PID:8776
- C:\Windows\System\qixqlrn.exe
  C:\Windows\System\qixqlrn.exe
  2⤵
  PID:8812
- C:\Windows\System\suIdHKQ.exe
  C:\Windows\System\suIdHKQ.exe
  2⤵
  PID:8908
- C:\Windows\System\HyZhMtX.exe
  C:\Windows\System\HyZhMtX.exe
  2⤵
  PID:8964
- C:\Windows\System\WWympYe.exe
  C:\Windows\System\WWympYe.exe
  2⤵
  PID:9076
- C:\Windows\System\mpvOABX.exe
  C:\Windows\System\mpvOABX.exe
  2⤵
  PID:9064
- C:\Windows\System\gdWzwdH.exe
  C:\Windows\System\gdWzwdH.exe
  2⤵
  PID:9124
- C:\Windows\System\ygOFKCY.exe
  C:\Windows\System\ygOFKCY.exe
  2⤵
  PID:9200
- C:\Windows\System\gShmWuT.exe
  C:\Windows\System\gShmWuT.exe
  2⤵
  PID:8176
- C:\Windows\System\BmvRZuc.exe
  C:\Windows\System\BmvRZuc.exe
  2⤵
  PID:8408
- C:\Windows\System\icWZuUw.exe
  C:\Windows\System\icWZuUw.exe
  2⤵
  PID:8332
- C:\Windows\System\cSNnuqT.exe
  C:\Windows\System\cSNnuqT.exe
  2⤵
  PID:8452
- C:\Windows\System\sxiaLEK.exe
  C:\Windows\System\sxiaLEK.exe
  2⤵
  PID:8612
- C:\Windows\System\lSyXVHa.exe
  C:\Windows\System\lSyXVHa.exe
  2⤵
  PID:8500
- C:\Windows\System\KgtGalZ.exe
  C:\Windows\System\KgtGalZ.exe
  2⤵
  PID:8792
- C:\Windows\System\NdbpEZE.exe
  C:\Windows\System\NdbpEZE.exe
  2⤵
  PID:8824
- C:\Windows\System\kfjkFGQ.exe
  C:\Windows\System\kfjkFGQ.exe
  2⤵
  PID:8856
- C:\Windows\System\Umhywqi.exe
  C:\Windows\System\Umhywqi.exe
  2⤵
  PID:8788
- C:\Windows\System\rNNlwpB.exe
  C:\Windows\System\rNNlwpB.exe
  2⤵
  PID:9056
- C:\Windows\System\UKVMlbC.exe
  C:\Windows\System\UKVMlbC.exe
  2⤵
  PID:9060
- C:\Windows\System\KlOFFWJ.exe
  C:\Windows\System\KlOFFWJ.exe
  2⤵
  PID:8304
- C:\Windows\System\KCiUrJS.exe
  C:\Windows\System\KCiUrJS.exe
  2⤵
  PID:9144
- C:\Windows\System\VQDlgTM.exe
  C:\Windows\System\VQDlgTM.exe
  2⤵
  PID:8516
- C:\Windows\System\DtYhgrs.exe
  C:\Windows\System\DtYhgrs.exe
  2⤵
  PID:8648
- C:\Windows\System\GVGcgPi.exe
  C:\Windows\System\GVGcgPi.exe
  2⤵
  PID:8796
- C:\Windows\System\nKrDNWR.exe
  C:\Windows\System\nKrDNWR.exe
  2⤵
  PID:9128
- C:\Windows\System\TWEqbFt.exe
  C:\Windows\System\TWEqbFt.exe
  2⤵
  PID:8276
- C:\Windows\System\ydIaBrX.exe
  C:\Windows\System\ydIaBrX.exe
  2⤵
  PID:9232
- C:\Windows\System\SEvSwAj.exe
  C:\Windows\System\SEvSwAj.exe
  2⤵
  PID:9248
- C:\Windows\System\uNqdLlR.exe
  C:\Windows\System\uNqdLlR.exe
  2⤵
  PID:9264
- C:\Windows\System\sEFevly.exe
  C:\Windows\System\sEFevly.exe
  2⤵
  PID:9284
- C:\Windows\System\xioChqC.exe
  C:\Windows\System\xioChqC.exe
  2⤵
  PID:9324
- C:\Windows\System\GbDeZtF.exe
  C:\Windows\System\GbDeZtF.exe
  2⤵
  PID:9352
- C:\Windows\System\qvJrDJK.exe
  C:\Windows\System\qvJrDJK.exe
  2⤵
  PID:9372
- C:\Windows\System\WYMCtgh.exe
  C:\Windows\System\WYMCtgh.exe
  2⤵
  PID:9388
- C:\Windows\System\QqGEleV.exe
  C:\Windows\System\QqGEleV.exe
  2⤵
  PID:9404
- C:\Windows\System\OVrgiML.exe
  C:\Windows\System\OVrgiML.exe
  2⤵
  PID:9432
- C:\Windows\System\qWOVNqp.exe
  C:\Windows\System\qWOVNqp.exe
  2⤵
  PID:9456
- C:\Windows\System\DIJYwER.exe
  C:\Windows\System\DIJYwER.exe
  2⤵
  PID:9476
- C:\Windows\System\mHzRkor.exe
  C:\Windows\System\mHzRkor.exe
  2⤵
  PID:9504
- C:\Windows\System\GmbMLaM.exe
  C:\Windows\System\GmbMLaM.exe
  2⤵
  PID:9520
- C:\Windows\System\MPVBfPC.exe
  C:\Windows\System\MPVBfPC.exe
  2⤵
  PID:9536
- C:\Windows\System\SYVgkHf.exe
  C:\Windows\System\SYVgkHf.exe
  2⤵
  PID:9560
- C:\Windows\System\XMkohPI.exe
  C:\Windows\System\XMkohPI.exe
  2⤵
  PID:9576
- C:\Windows\System\yNtjDCy.exe
  C:\Windows\System\yNtjDCy.exe
  2⤵
  PID:9592
- C:\Windows\System\nLbinCE.exe
  C:\Windows\System\nLbinCE.exe
  2⤵
  PID:9608
- C:\Windows\System\afYings.exe
  C:\Windows\System\afYings.exe
  2⤵
  PID:9628
- C:\Windows\System\eugghzv.exe
  C:\Windows\System\eugghzv.exe
  2⤵
  PID:9648
- C:\Windows\System\grHWjta.exe
  C:\Windows\System\grHWjta.exe
  2⤵
  PID:9664
- C:\Windows\System\lvSbRXx.exe
  C:\Windows\System\lvSbRXx.exe
  2⤵
  PID:9700
- C:\Windows\System\FpClRNR.exe
  C:\Windows\System\FpClRNR.exe
  2⤵
  PID:9720
- C:\Windows\System\jPToUGL.exe
  C:\Windows\System\jPToUGL.exe
  2⤵
  PID:9740
- C:\Windows\System\lbuOAPs.exe
  C:\Windows\System\lbuOAPs.exe
  2⤵
  PID:9756
- C:\Windows\System\TTnrFmD.exe
  C:\Windows\System\TTnrFmD.exe
  2⤵
  PID:9780
- C:\Windows\System\nlFNMgM.exe
  C:\Windows\System\nlFNMgM.exe
  2⤵
  PID:9808
- C:\Windows\System\BErMrUw.exe
  C:\Windows\System\BErMrUw.exe
  2⤵
  PID:9828
- C:\Windows\System\PvjQYAF.exe
  C:\Windows\System\PvjQYAF.exe
  2⤵
  PID:9848
- C:\Windows\System\lXMTOFI.exe
  C:\Windows\System\lXMTOFI.exe
  2⤵
  PID:9864
- C:\Windows\System\XAqCqJt.exe
  C:\Windows\System\XAqCqJt.exe
  2⤵
  PID:9888
- C:\Windows\System\ewJqxNQ.exe
  C:\Windows\System\ewJqxNQ.exe
  2⤵
  PID:9904
- C:\Windows\System\TxSojaQ.exe
  C:\Windows\System\TxSojaQ.exe
  2⤵
  PID:9924
- C:\Windows\System\LAzWnRC.exe
  C:\Windows\System\LAzWnRC.exe
  2⤵
  PID:9944
- C:\Windows\System\HfzqgjG.exe
  C:\Windows\System\HfzqgjG.exe
  2⤵
  PID:9968
- C:\Windows\System\GTfFSkA.exe
  C:\Windows\System\GTfFSkA.exe
  2⤵
  PID:9984
- C:\Windows\System\sxZfmNu.exe
  C:\Windows\System\sxZfmNu.exe
  2⤵
  PID:10004
- C:\Windows\System\Ynqnhff.exe
  C:\Windows\System\Ynqnhff.exe
  2⤵
  PID:10024
- C:\Windows\System\ytxqJxj.exe
  C:\Windows\System\ytxqJxj.exe
  2⤵
  PID:10048
- C:\Windows\System\pDjVjhe.exe
  C:\Windows\System\pDjVjhe.exe
  2⤵
  PID:10064
- C:\Windows\System\kTncfEc.exe
  C:\Windows\System\kTncfEc.exe
  2⤵
  PID:10088
- C:\Windows\System\tzjsybd.exe
  C:\Windows\System\tzjsybd.exe
  2⤵
  PID:10104
- C:\Windows\System\gNRCKtR.exe
  C:\Windows\System\gNRCKtR.exe
  2⤵
  PID:10120
- C:\Windows\System\GLWEyqx.exe
  C:\Windows\System\GLWEyqx.exe
  2⤵
  PID:10136
- C:\Windows\System\MaEEwVy.exe
  C:\Windows\System\MaEEwVy.exe
  2⤵
  PID:10164
- C:\Windows\System\MmHrikp.exe
  C:\Windows\System\MmHrikp.exe
  2⤵
  PID:10180
- C:\Windows\System\OPNAKXH.exe
  C:\Windows\System\OPNAKXH.exe
  2⤵
  PID:10204
- C:\Windows\System\eGYIdYZ.exe
  C:\Windows\System\eGYIdYZ.exe
  2⤵
  PID:10220
- C:\Windows\System\GoNHlhu.exe
  C:\Windows\System\GoNHlhu.exe
  2⤵
  PID:8448
- C:\Windows\System\KTofKfD.exe
  C:\Windows\System\KTofKfD.exe
  2⤵
  PID:8980
- C:\Windows\System\jzziiTk.exe
  C:\Windows\System\jzziiTk.exe
  2⤵
  PID:8744
- C:\Windows\System\otdMWFt.exe
  C:\Windows\System\otdMWFt.exe
  2⤵
  PID:9244
- C:\Windows\System\cHEMToM.exe
  C:\Windows\System\cHEMToM.exe
  2⤵
  PID:9260
- C:\Windows\System\zJqaSng.exe
  C:\Windows\System\zJqaSng.exe
  2⤵
  PID:9228
- C:\Windows\System\BmtIyps.exe
  C:\Windows\System\BmtIyps.exe
  2⤵
  PID:9304
- C:\Windows\System\cNLoJSx.exe
  C:\Windows\System\cNLoJSx.exe
  2⤵
  PID:9332
- C:\Windows\System\yCXmWkx.exe
  C:\Windows\System\yCXmWkx.exe
  2⤵
  PID:9380
- C:\Windows\System\XQPLvts.exe
  C:\Windows\System\XQPLvts.exe
  2⤵
  PID:9360
- C:\Windows\System\mSCnczn.exe
  C:\Windows\System\mSCnczn.exe
  2⤵
  PID:9396
- C:\Windows\System\wScFVnO.exe
  C:\Windows\System\wScFVnO.exe
  2⤵
  PID:9468
- C:\Windows\System\mneJqiK.exe
  C:\Windows\System\mneJqiK.exe
  2⤵
  PID:9484
- C:\Windows\System\GaKMjuW.exe
  C:\Windows\System\GaKMjuW.exe
  2⤵
  PID:9516
- C:\Windows\System\SzllvBc.exe
  C:\Windows\System\SzllvBc.exe
  2⤵
  PID:9616
- C:\Windows\System\tnvEpey.exe
  C:\Windows\System\tnvEpey.exe
  2⤵
  PID:9656
- C:\Windows\System\ScsKJcZ.exe
  C:\Windows\System\ScsKJcZ.exe
  2⤵
  PID:9500
- C:\Windows\System\wUnywZv.exe
  C:\Windows\System\wUnywZv.exe
  2⤵
  PID:9604
- C:\Windows\System\FsvpUOh.exe
  C:\Windows\System\FsvpUOh.exe
  2⤵
  PID:9492
- C:\Windows\System\RmjfSNg.exe
  C:\Windows\System\RmjfSNg.exe
  2⤵
  PID:9680
- C:\Windows\System\wNliucW.exe
  C:\Windows\System\wNliucW.exe
  2⤵
  PID:9728
- C:\Windows\System\MyZsAXK.exe
  C:\Windows\System\MyZsAXK.exe
  2⤵
  PID:9772
- C:\Windows\System\fCKYCoq.exe
  C:\Windows\System\fCKYCoq.exe
  2⤵
  PID:9816
- C:\Windows\System\OxGRJLO.exe
  C:\Windows\System\OxGRJLO.exe
  2⤵
  PID:9840
- C:\Windows\System\xUmZquF.exe
  C:\Windows\System\xUmZquF.exe
  2⤵
  PID:9880
- C:\Windows\System\CtdJFjP.exe
  C:\Windows\System\CtdJFjP.exe
  2⤵
  PID:9900
- C:\Windows\System\ileEniK.exe
  C:\Windows\System\ileEniK.exe
  2⤵
  PID:9096
- C:\Windows\System\GwIkwvj.exe
  C:\Windows\System\GwIkwvj.exe
  2⤵
  PID:9956
- C:\Windows\System\ezNKJnj.exe
  C:\Windows\System\ezNKJnj.exe
  2⤵
  PID:9976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AEpQrZp.exe

Filesize
2.9MB

MD5
90ee3086f5c2f377ec391ab2354ab66f

SHA1
42a4392cd6fa34484d46a517d7a7a700b3db69b6

SHA256
530e3ad031245222939d036b7268f274eb403f4c6333720d0157e8888937ce55

SHA512
2f3f59f8624122c1959d86b9742818e563062afa3cca7a86423efa7fdb2c2e1b4c27eb07bb635d50952bd4dee58b1a94c1bb34c6b02134be9fbe51ad73870dc6

Download Submit
C:\Windows\system\ChKOVIg.exe

Filesize
2.9MB

MD5
1aa96a813786367d5c14163a455bc314

SHA1
9f3222b9796d447beff53a276c03a74f36ec2616

SHA256
144885714e06446fa835e0e22cd737e7758174b8f20576ec8156acac155585f2

SHA512
c07c20c172dcb8edaacfa8c76d99c43ef9e29a1ca2320c6caf91c714ceaa8103cdf73013d9fdfba6dd561bfa3fb78b700372aee06fff855ffb8eb423d77a9ffd

Download Submit
C:\Windows\system\DXpqfmT.exe

Filesize
2.9MB

MD5
9f0139aff9b470a32394309e1af85244

SHA1
7ebf1d506036960c2e151773199508806a31e488

SHA256
80495b336213d6f72942ce922e43fd7b991c63a5f7eceb7e035dc040cc40d137

SHA512
52912c6f409b52f40266e148d94c3e635be1f1a0cc9407bd1a69b72a60de5fa6c55e1ddaa0b72fa31fdad62bae1cdedc951f3375da84b06c98847d12e38c767b

Download Submit
C:\Windows\system\FkkbYSq.exe

Filesize
2.9MB

MD5
5bf76a7f4f648f5f1e15308f12261cc3

SHA1
d97ba58e0372074a265cacb66253258dcb427b1a

SHA256
045629a203b91393bcc34236d5e4d548b8bc6b29970dac6af926b91c4f43fb9d

SHA512
11cc451e17422966e3598c41efce529e33ba05cdcc9f73428a2f56499d05d578b85697e4a182c71e4053f58341b3ab1b89f08aac6ee3298862eaae2526c37457

Download Submit
C:\Windows\system\HiruOLn.exe

Filesize
2.9MB

MD5
ab642a3f2563e56966c7ebeba5594089

SHA1
b3a621b87085a8625820ee09abb1c8ecfa939dae

SHA256
0824773fcb241a4c1c583cf1493ee1a134f0fd58f2cf070bf6d0393c6efa37c7

SHA512
aac59de334887d6d71b4b9f929e673c5f032958def95a7d6192f973a6fdb4a8ab2d3a13dba896d3a4f39badd300f82ef73b71f0fe3ee19274aaeee31131d8011

Download Submit
C:\Windows\system\HqiuMmE.exe

Filesize
2.9MB

MD5
f5528138331810ad325a2010cd1d6798

SHA1
2d4ed36c4b9d4d4cd4d2d0ab571a3a37c8bc6b2e

SHA256
c0f2614bbed7895b22ea9a265d79583065eff2d6f96b6de6a83eb75f4b161f95

SHA512
4385207752de9ad829ca3c45fbd4b61e0741bc956fdf03d990ba0eda984910508278ad4cc81bf5b3b430b128cd8ef17905d3ff187a30e6e88098ed968c2a5e22

Download Submit
C:\Windows\system\JEXjCnP.exe

Filesize
2.9MB

MD5
1c93d56a52c3a2ffc1c232a6f783d74a

SHA1
076abfe4eb95dbb7ac8f83b0f24bc8d7e9de62a2

SHA256
ce1f38ed5c5817633dedda448c2af8cb84c993c1547aa9441842a3872146755e

SHA512
4b9bd5e93a32aeb04eb99106afee8c0822dab1d016988d431056b7557807a7fcfd73add81f38b1aa692c101227c5cde92cbece4aed8200ec879fb4b34eca3c7e

Download Submit
C:\Windows\system\JSEuhWU.exe

Filesize
2.9MB

MD5
f819cb29743ac4c9e5b48116ca593937

SHA1
c45f610949c0a202594fedc566544d9a6d7c7a2e

SHA256
fb6d6a5fed57a4f67c2f8a5b1c0854495a4f1370f82546860d685e5f7f62b9b1

SHA512
34d4e86047bc5f504763ddb28b29c94826b068e74c6c1853dec0130b958f19b051b548bfa02eca8f585e4471057a09089ecc10c16fb17663aa0e1ab206d2a20c

Download Submit
C:\Windows\system\LxVeLNa.exe

Filesize
2.9MB

MD5
4e061bc5f35c2c7ef83320b5f7493909

SHA1
2b44c6c04a21a112e17a154d6d7747e0cbea9009

SHA256
fe7b023e60dacad36fa49897a2f1031113a395763fc4bf68eecf8fb8c69da73e

SHA512
ddd90748ba5483ece81935939fae291de1af15b2ced9d997ff4663ce6d32977ec614b11432586f63e3fb53a3e5b4a89ee198b293ae7a09af788b1dc3a37417e7

Download Submit
C:\Windows\system\OiEqfVW.exe

Filesize
2.9MB

MD5
e45436a697b289bdf365e475327c4fc6

SHA1
07a2067f2079c0c497e6f17c27d76250e895693c

SHA256
8f500e10cb736c72bae3b395155a60e926980ea70118ffbbeaabfbeb680621ad

SHA512
900aed06b4813b6f0d7e3944b23126fd50a0c3ccb8acc1399ed8b6db6f932cb9c4b4a1bff75b61ec9d36b060884e41641e9b1414ab05e1a4a6af47db71e0711d

Download Submit
C:\Windows\system\OpsyRmq.exe

Filesize
2.9MB

MD5
4d4e39d3e624880efc83e0b54f7b9d61

SHA1
bc29860341714de38f5e555deba8e5e0869d9fa7

SHA256
566c7f7daa89fe24d74864c4cc50e7539cd45371e6c4b65399435cc59ae582a3

SHA512
e438ebda05855c45068ad3250756e851ae419c736e8846450f9b91c42efa2d5aa438b23a1fcbd9ee15571f4e3107b876473138b1224e00b8b53ffa6c76230613

Download Submit
C:\Windows\system\PyPOaKu.exe

Filesize
2.9MB

MD5
c622b0c254c8bf9e79ecc097c3776135

SHA1
a125198192c55dfe69c8711720de15176b3b22ff

SHA256
a6adbbe595d2181fb521dfb60ddcb020a7407f3d84fdefd44db84313b6b77100

SHA512
2b600d018bed1865ead1992ebba2942abcba179b17282a8c3b3cbab68dd86891407d638675ae19059037027e805f4caeff5b5dfbed2db812d179fb704859a8c0

Download Submit
C:\Windows\system\SIVKHLs.exe

Filesize
2.9MB

MD5
727361d130bcf282a52f33f5fde8c526

SHA1
d50d4265609ead3a06132a88fc545bb4b80eed86

SHA256
298b8e855d76e3f6d7426a81de1e0dc500773674d7a0fdb55dc7da0d18b791db

SHA512
d1e918e3dc346448211679911ec5c29392001904475b475da2d7091fd98445ef9928533741a0e5c9f8e3f7cc52bd01d9510dff75a91fb1d7dc7cb8f060a8eac7

Download Submit
C:\Windows\system\TlGMUqC.exe

Filesize
2.9MB

MD5
359dd6cf66ff736082e6a80c182250ec

SHA1
d1f6451fc04210d97fce8bd3172c9392b9ef7a67

SHA256
0bf26a69dc4d1a00e37a11a49f9f8177f96d63551b66af35d8ecb0c79ebb9e8d

SHA512
e045be73ff5d8dd737f2e410a66db29c7280bd69ac5eb6700e7d2273bb0d3eaca8eff0695393ee97bb6b9e61ea173dc1053de4514f1a038b18abc488c5e70977

Download Submit
C:\Windows\system\WYBUMLC.exe

Filesize
2.9MB

MD5
d61484b7c7ac07d943422a12a29eebd5

SHA1
b7b21131060535366f0fd6d41a797ef2ab998e5f

SHA256
e02388cbaf6dbf651bb3e8035983871dd8c83c8abb1cd6aac6f67f6c59fa1238

SHA512
2952d4cc578bbc1b659d00b8d23262e7dae046902f2acccacc845653ac86251950c0c9ced54a72f88cd4d951ede0e243744fd4fd673cda17385a5d4688b525da

Download Submit
C:\Windows\system\ZIDjBNC.exe

Filesize
2.9MB

MD5
ba524a1de65b0559ac86db3150b773b9

SHA1
5f855c6393630f6886cd826c14d96c9664beab1d

SHA256
8cac9d10ea1ec5e425923af7076c7673e81d6f074c4349fda10c11dfd09da6e5

SHA512
7b80cb05fc5416040cbac836fb66536640e731c5af9c162edda580b1d9b0243ec31bf1bfd4e638787fd729a92dffc8c8830a6a4566176e0b208da0c3b8d22d2b

Download Submit
C:\Windows\system\ZxuLzUe.exe

Filesize
2.9MB

MD5
ae062d3d78e5e075a7eb4412972a99f3

SHA1
c150a9f31a655005cec01b24d90179682e0fb3f0

SHA256
3c04bcf59df7e6b0e2a40fbbfae62301b7c9b38b6a773e9364f41c3ced063bda

SHA512
85f859b02892f151bd02c6b10fe15684ee1bf6eca3840c2803f2ff9356e8eff19da6d59ec62a93a7bae07e6a6bc56530b87dd514906a87a5a790492424ab7ec2

Download Submit
C:\Windows\system\iARXlEf.exe

Filesize
2.9MB

MD5
ffbd2f6f7e3f138affbb4164018ef2b8

SHA1
da66d2e2241176cde7ffb844c49718aef065d202

SHA256
7c97cc5b49a92fdc6e988f975663fd75540aa7ac22680770ac61461a9fdfca00

SHA512
c22a0e2a95cdf1440e1102fb72a1ad45affe33454746d4c24c699448e5d672543af99d0f9c4f5c06511948a65daf6024025bdf66e3903d9f357dc8bec9f3ffab

Download Submit
C:\Windows\system\ihVUvlH.exe

Filesize
2.9MB

MD5
14f04371ebeb5678843e4ef478d7bc86

SHA1
a44189917158d201ad013506cfcc0416e6fc6626

SHA256
2eaf670be8d436093e32ceecf3e96075e2d1c6ffb75d93d7325d274751ba17cd

SHA512
46844ff889d1554d7b162ac93b0fb882fb05f75f37e3fd61ec5f0ea860cfbce2d82c07402ce831580821d0ddc8f66b9a0b06a21eaee855844bdf7cfa481b6c6a

Download Submit
C:\Windows\system\jUiahvu.exe

Filesize
2.9MB

MD5
19e4daf1864e548c8dc55cc2002dabd1

SHA1
4e98abf6289610ab641f36f8e0b6d52d54634c51

SHA256
76fe0fed0a931aa47169a04fd6f42bad58106eafaf86b9e27994a01af271523d

SHA512
0f8c50b7c32bbe56e571b1a0a27c3889c44b2bae31055f80cef9c4a05f3e8b399bc06ead42279f51961a575d02b597c313923c5b78781fca3c2ec8b803f96f95

Download Submit
C:\Windows\system\lhjIVbC.exe

Filesize
2.9MB

MD5
1f825b59cb106dfa5a867a94b38368de

SHA1
76cb44f36d7025972227d72e14f5d8bab6b62971

SHA256
abe2d314d95653ba53ebab8741415b46e4d8fa6277e0439ff947af24bc40babf

SHA512
c1bf6dce7f5488de5d4497e9bbb369a7b7a9fe8f129bfe92678e9ceb1845dffaa8a969b77990bff98bd195ee0bc5c55c9c2cd43764ddc44e2e0c5e1d2033570c

Download Submit
C:\Windows\system\lpARZND.exe

Filesize
2.9MB

MD5
f5e6163fc4ccff2bdb1b6492dd86c2ab

SHA1
1fb49e82bd3188f4c5475b817c1779cff4cfffd0

SHA256
3832721981c9df8def8dfe3725658e4684c28249e17ece8dfd63468eede5e34e

SHA512
8696e358ada3ab8d475dde3983d548188483eb2a44187a05f8b699ec0ff87d7374b86c672355747e206450a156799cac9b857249b052c586e505edb52cc49b25

Download Submit
C:\Windows\system\muYhsYu.exe

Filesize
2.9MB

MD5
2e036d86899e2f1deb3cf9196a126fbc

SHA1
d9fc1ce30d030185c745c4a1caa469263f242355

SHA256
ff06165835a739002142a07c0a0c9b4faef231fd98c2ad2e9c242db253d5e437

SHA512
fbf907f0aeb33a7ad0d27098dbde98551ff6930bf91a786fb532227488e680e6fba9e3bfab647e48d5a437329ff5b48c1d5829e4ce89ecac38bd3b31fa5e86ed

Download Submit
C:\Windows\system\nHiyOoP.exe

Filesize
2.9MB

MD5
2bc66a5d35d5311443309f82e26fd136

SHA1
f4b8fa2c67fe0d77673acf28e2c99a52de935585

SHA256
1d316738f92e8f0c94af60d03d0a09c8e15fcccffb461717754ff063e23ea833

SHA512
98a34ae9c28d0fe3a17f5a8150ea43609db954590bfff355b1cee081c509f610745f0bea28057b7f86c0864dc6a6fbb3575ada9f9cb49d9f2c4d69537baf9c3b

Download Submit
C:\Windows\system\oszgXLh.exe

Filesize
2.9MB

MD5
c9ce1070d209954da33d90309b3d061f

SHA1
d59e503287e2d18736fe5cc570049a46db3c9b7c

SHA256
cd67315a01ddc83cb436f4a44a55d8f88bc41ce2bd7bfc87f9dc5c6986f17ca8

SHA512
c9416f97094c20d3d99295faeb0008fd2a7c12075d6d97a50f2c44129bd79bff261d4ca40592718db9befad73ad4c17f36ccfc3c353bd510951e8c94a6a54cc6

Download Submit
C:\Windows\system\pOriuPT.exe

Filesize
2.9MB

MD5
be67c20dacacc21bef5895e2dcc7f063

SHA1
b762713e7a77198bca852bc22831029a664e526b

SHA256
8500243e426251283582425f721815593a097d64f044f5e0ee844592e1c56367

SHA512
21388eb24c7ca5441bdda3b03021b22b207d5112896c95d629b92a99f716876d5bd53ef19375a76d55fea0eb884bc3a127a69cacc82bb0049b2f0fb759bfc98a

Download Submit
C:\Windows\system\pZXmPOV.exe

Filesize
2.9MB

MD5
e4b98122723c0d99c9ba937f8cf57435

SHA1
367ad0672831b57a219db5a69b66e1ccb50e32ca

SHA256
95d8489c65b45bd23335308aeda69e2e72c6866bf7dee0856665116030e83a33

SHA512
f3e5f8930dc6fe93f8dd3f1367299ea515489d8e31ab435682d14577ae65640cc679516cbf9f4dbc60570008d21f1581b62a2fb5509e52827915bf58118f5014

Download Submit
C:\Windows\system\tHGQbPV.exe

Filesize
2.9MB

MD5
c166ebdde50f2477609fe63d29a21ef3

SHA1
09ff6235bf5f4d83128302a3bd68d89bf2e7945b

SHA256
984be350e847c6ab24eaaadf72154e5ab972f50281716c35bbc66868f55a4eb4

SHA512
e6224794cf9e3d233a1656c384023318031f92f4db3f87bdb898c84409b217c0c0ff3a290201766317bebe2dea4c30e3b549b0ca29c4f2899036caf5dade5aff

Download Submit
C:\Windows\system\xsHhxMH.exe

Filesize
2.9MB

MD5
2d5879c22e1cf8ce7a8b8163a188d1fd

SHA1
b13d08d9e15a9a0647dca7feadbf8aa5401fdec6

SHA256
280ab072ecfaabccb6a63f11e0bd94cf419c47215b19ec4ece61e7a6314edb6c

SHA512
980519418d0539e78311d44c707c90e3e653acefde99328459f7cb67fe48e20d3df8e514c33e2dde4a61fd92a04455d6d3ccb97d68c06be01b98dfcf12e8c8a0

Download Submit
C:\Windows\system\zvNCsXc.exe

Filesize
2.9MB

MD5
7c13fdfcf59cc2b545efc484a7333fdb

SHA1
82ea83222e61453a5524b5da4e477540ed02449c

SHA256
8d8545db563ba7efc933cba5c3b05f6cc7149c0d42864679c8df33eaca105324

SHA512
991d44dcdaf9d02cde39512727a8a3927765e17c08ab6f84f244b3af072a2a45ee0f7e2636b9fedb6dc7c3c362fa7091bc91258ab8cd16808bc7efa9bf7f3706

Download Submit
\Windows\system\ALABstD.exe

Filesize
2.9MB

MD5
1a6699455df1ef2f720bceafd934fddb

SHA1
ef87af1f9c17bf4c866850206596199e9c0a3f53

SHA256
9df29f89c25729d20358e340c7354a0812b338cbcc62babb8b2cf376dfd88f28

SHA512
4651b19df323174cf81bb966b4f52e3c12966190162c8e7cf92e011110546e6d0c78429f8a88449be1b1b43c51b3ad495f810b42fb4130c1a270a41dea9ab82f

Download Submit
\Windows\system\uwENPeA.exe

Filesize
2.9MB

MD5
9e9b740b1b5e0695f9968ecef310d53a

SHA1
b3c9ddf8d93996141978a27ce58c3ec3efbf6f07

SHA256
b53a8f7a18c963008d950b3bde45d2864dee4804e1866f689e0aadbe3257a0bc

SHA512
8f7964ce597576acd8a8a6d5102c22511487ef2a0a7ada31825fab9247e0a2d8a0a8bfaebde2e8b3f07db655b3731c5c236faa212407afadaee0f038cfa3cfb2

Download Submit
memory/1528-216-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/1528-5861-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/1588-214-0x000000013F330000-0x000000013F726000-memory.dmp

Filesize
4.0MB

Download
memory/2076-217-0x0000000002A90000-0x0000000002B10000-memory.dmp

Filesize
512KB

Download
memory/2076-175-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2076-176-0x00000000022A0000-0x00000000022A8000-memory.dmp

Filesize
32KB

Download
memory/2240-2683-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2240-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2240-206-0x0000000003740000-0x0000000003B36000-memory.dmp

Filesize
4.0MB

Download
memory/2240-204-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/2240-3998-0x0000000003740000-0x0000000003B36000-memory.dmp

Filesize
4.0MB

Download
memory/2240-18-0x0000000003480000-0x0000000003876000-memory.dmp

Filesize
4.0MB

Download
memory/2240-2300-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2240-30-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2240-32-0x000000013F730000-0x000000013FB26000-memory.dmp

Filesize
4.0MB

Download
memory/2240-1-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2240-208-0x0000000003740000-0x0000000003B36000-memory.dmp

Filesize
4.0MB

Download
memory/2240-24-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2240-7-0x000000013FB30000-0x000000013FF26000-memory.dmp

Filesize
4.0MB

Download
memory/2240-210-0x0000000003740000-0x0000000003B36000-memory.dmp

Filesize
4.0MB

Download
memory/2240-218-0x000000013FE40000-0x0000000140236000-memory.dmp

Filesize
4.0MB

Download
memory/2240-4446-0x000000013FE40000-0x0000000140236000-memory.dmp

Filesize
4.0MB

Download
memory/2240-215-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/2288-209-0x000000013F160000-0x000000013F556000-memory.dmp

Filesize
4.0MB

Download
memory/2288-5862-0x000000013F160000-0x000000013F556000-memory.dmp

Filesize
4.0MB

Download
memory/2504-203-0x000000013F550000-0x000000013F946000-memory.dmp

Filesize
4.0MB

Download
memory/2504-5845-0x000000013F550000-0x000000013F946000-memory.dmp

Filesize
4.0MB

Download
memory/2564-5853-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/2564-205-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/2652-194-0x000000013F730000-0x000000013FB26000-memory.dmp

Filesize
4.0MB

Download
memory/2712-2691-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2712-5854-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2732-5855-0x000000013FE40000-0x0000000140236000-memory.dmp

Filesize
4.0MB

Download
memory/2732-196-0x000000013FE40000-0x0000000140236000-memory.dmp

Filesize
4.0MB

Download
memory/2740-2684-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2740-25-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-2511-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-19-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5851-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download
memory/2984-5846-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/2984-207-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/3004-9-0x000000013FB30000-0x000000013FF26000-memory.dmp

Filesize
4.0MB

Download